From 2a993b30c5c645d675adb3f125c9d0fccd700b85 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Fri, 10 Jul 2026 09:52:47 +0000 Subject: [PATCH 01/28] docs(rbac): note that Secret refs are namespace-local by design The cluster-scoped Secret grant is a property of the packaged manager ClusterRole, not of the API: secretRef on GitProvider, commit signing, and GitTarget encryption all name a Secret in the owning object's namespace. Record that locality as the intended direction, so cross-namespace Secret use would arrive as an explicit access grant rather than a namespace field on the existing refs. Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/future/least-privilege-remaining-work.md | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/docs/future/least-privilege-remaining-work.md b/docs/future/least-privilege-remaining-work.md index 595084b5..6faa090a 100644 --- a/docs/future/least-privilege-remaining-work.md +++ b/docs/future/least-privilege-remaining-work.md @@ -42,10 +42,13 @@ permission is granted — but watched types still churn. ## 3. Scope the Secret grant, and an RBAC generator -`secrets: get,create,update` is cluster-scoped because a `GitProvider` may reference a Secret in any -namespace. A `selected` install therefore cannot *enumerate* Secrets but can still read one it can -name. Closing that needs a namespaced `Role` per referenced namespace, which the chart cannot render -without knowing the manifests. +`secrets: get,create,update` is cluster-scoped because the packaged manager role is one ClusterRole. +The API references themselves are local: `GitProvider.spec.secretRef`, +`GitProvider.spec.commit.signing.secretRef`, and `GitTarget.spec.encryption.secretRef` name Secrets +in the same namespace as the owning `GitProvider` or `GitTarget`. A `selected` install therefore +cannot *enumerate* Secrets but can still read one if it already knows a name and namespace. Closing +that needs a namespaced `Role` per referenced namespace, which the chart cannot render without +knowing the manifests. Which is the same input an **RBAC generator** needs: read `GitProvider`, `GitTarget`, `WatchRule` and `ClusterWatchRule` manifests and emit the narrow role set — fixed controller grants, Secret @@ -53,6 +56,11 @@ and `ClusterWatchRule` manifests and emit the narrow role set — fixed controll signing-key generation applies, and one `get,list,watch` per selected GVR. Manifest input first: it is reviewable in CI and needs no cluster access. +Future direction: keep the CRD references namespace-local by default. If cross-namespace Secret use +ever becomes necessary, make it an explicit access-grant feature rather than adding a `namespace` +field to these refs. The normal path should be one credentials/signing/encryption Secret beside the +object that uses it, and generated or hand-written RBAC should follow that locality. + Until it exists, the escape hatch is `rbac.create: false` with a hand-written role set. ## What not to do From 9fbb8698fe7b809a3bc85ee2c13c324249d9e833 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Fri, 10 Jul 2026 09:53:00 +0000 Subject: [PATCH 02/28] test(fixtures): add a corpus of real-world GitOps layouts "Does GitOps Reverser support Argo CD / Flux repositories?" is the wrong question: both are mostly orchestration around folders, and the real compatibility boundary is set by what a folder contains and how it is rendered. Deciding that boundary honestly needs the shapes users actually have, so check them in. Fifteen self-contained example repositories under test/fixtures/gitops-layouts: Argo CD plain directories, App of Apps, both ApplicationSet generators (directory and file), kustomize base+overlays, a standard Helm chart, a chart with per-environment values, an external chart with a values-only repo, the canonical Flux monorepo, Flux HelmRelease, repo-per-environment, a cluster x app matrix, SOPS, committed rendered manifests, and a deliberately hostile mixed folder. The corpus is descriptive and drives no test. Each fixture states what the pattern is and what questions it raises; none records a verdict about what is supported, accepted, or refused. Deciding those answers, and pinning them as golden reports under internal/manifestanalyzer/testdata/scan-repo, is a separate step. Every credential, token, key, and ciphertext is a placeholder. The kustomize secretGenerator fixture checks in a secrets.env on purpose, so .gitignore gains a scoped negation for it. Co-Authored-By: Claude Opus 4.8 (1M context) --- .gitignore | 3 + .../f8-repo-discovery-and-onboarding-scan.md | 7 ++ .../gitops-layouts/01-argocd-plain/README.md | 64 ++++++++++ .../apps/frontend/ci-metadata.yaml | 8 ++ .../apps/frontend/deployment.yaml | 34 +++++ .../apps/frontend/ingress.yaml | 19 +++ .../apps/frontend/namespace.yaml | 8 ++ .../apps/frontend/rbac-and-config.yaml | 20 +++ .../apps/frontend/service.yaml | 14 +++ .../argocd/frontend-application.yaml | 23 ++++ .../02-argocd-app-of-apps/README.md | 69 ++++++++++ .../applications/backend.yaml | 18 +++ .../applications/frontend.yaml | 18 +++ .../02-argocd-app-of-apps/bootstrap/root.yaml | 23 ++++ .../manifests/backend/deployment.yaml | 30 +++++ .../manifests/backend/service.yaml | 14 +++ .../manifests/frontend/application.yaml | 33 +++++ .../manifests/frontend/service.yaml | 14 +++ .../README.md | 79 ++++++++++++ .../apps/backend/deployment.yaml | 30 +++++ .../apps/backend/service.yaml | 14 +++ .../apps/disabled-example/README.md | 11 ++ .../apps/empty/.gitkeep | 4 + .../apps/frontend/deployment.yaml | 30 +++++ .../apps/frontend/service.yaml | 14 +++ .../apps/platform/monitoring/deployment.yaml | 33 +++++ .../apps/platform/monitoring/service.yaml | 14 +++ .../apps/worker/deployment.yaml | 31 +++++ .../bootstrap/applicationset.yaml | 41 ++++++ .../04-argocd-applicationset-files/README.md | 69 ++++++++++ .../applicationset.yaml | 55 ++++++++ .../chart/Chart.yaml | 8 ++ .../chart/templates/deployment.yaml | 24 ++++ .../chart/templates/service.yaml | 13 ++ .../chart/values.yaml | 8 ++ .../deployments/dev/backend.yaml | 9 ++ .../deployments/dev/frontend.yaml | 9 ++ .../deployments/production/backend.yaml | 9 ++ .../deployments/production/frontend.yaml | 9 ++ .../05-kustomize-overlays/README.md | 96 ++++++++++++++ .../apps/backend/base/deployment.yaml | 22 ++++ .../apps/backend/base/kustomization.yaml | 6 + .../apps/backend/base/service.yaml | 13 ++ .../overlays/production/kustomization.yaml | 16 +++ .../apps/frontend/base/deployment.yaml | 26 ++++ .../apps/frontend/base/kustomization.yaml | 8 ++ .../apps/frontend/base/service.yaml | 13 ++ .../overlays/production/config.properties | 4 + .../overlays/production/deployment-patch.yaml | 18 +++ .../overlays/production/kustomization.yaml | 39 ++++++ .../frontend/overlays/production/secrets.env | 4 + .../overlays/staging/config.properties | 4 + .../overlays/staging/deployment-patch.yaml | 16 +++ .../overlays/staging/kustomization.yaml | 33 +++++ .../gitops-layouts/06-helm-chart/README.md | 91 ++++++++++++++ .../06-helm-chart/charts/frontend/.helmignore | 15 +++ .../06-helm-chart/charts/frontend/Chart.lock | 9 ++ .../06-helm-chart/charts/frontend/Chart.yaml | 25 ++++ .../charts/frontend/charts/.gitkeep | 3 + .../frontend/crds/widgets.example.com.yaml | 51 ++++++++ .../charts/frontend/templates/NOTES.txt | 19 +++ .../charts/frontend/templates/_helpers.tpl | 47 +++++++ .../charts/frontend/templates/configmap.yaml | 10 ++ .../charts/frontend/templates/deployment.yaml | 50 ++++++++ .../charts/frontend/templates/ingress.yaml | 36 ++++++ .../charts/frontend/templates/service.yaml | 15 +++ .../frontend/templates/serviceaccount.yaml | 12 ++ .../templates/tests/test-connection.yaml | 21 ++++ .../charts/frontend/values.schema.json | 52 ++++++++ .../06-helm-chart/charts/frontend/values.yaml | 62 +++++++++ .../07-helm-environment-values/README.md | 82 ++++++++++++ .../argocd/dev.yaml | 31 +++++ .../argocd/production.yaml | 28 +++++ .../chart/Chart.yaml | 7 ++ .../chart/templates/deployment.yaml | 31 +++++ .../chart/templates/service.yaml | 17 +++ .../chart/values.yaml | 26 ++++ .../values/common.yaml | 14 +++ .../values/dev.yaml | 15 +++ .../values/production.yaml | 16 +++ .../08-argocd-external-helm/README.md | 106 ++++++++++++++++ .../applications/cert-manager.yaml | 35 ++++++ .../applications/external-dns.yaml | 38 ++++++ .../applications/ingress-nginx.yaml | 31 +++++ .../extras/ingress-nginx/middleware.yaml | 35 ++++++ .../platform/cert-manager/application.yaml | 28 +++++ .../platform/cert-manager/clusterissuer.yaml | 18 +++ .../platform/cert-manager/values.yaml | 17 +++ .../values/cert-manager/production.yaml | 13 ++ .../values/external-dns/production.yaml | 12 ++ .../values/ingress-nginx/common.yaml | 18 +++ .../values/ingress-nginx/production.yaml | 21 ++++ .../gitops-layouts/09-flux-monorepo/README.md | 112 +++++++++++++++++ .../apps/base/frontend/deployment.yaml | 28 +++++ .../apps/base/frontend/kustomization.yaml | 8 ++ .../apps/base/frontend/service.yaml | 13 ++ .../apps/production/frontend-patch.yaml | 17 +++ .../apps/production/kustomization.yaml | 12 ++ .../apps/staging/frontend-patch.yaml | 16 +++ .../apps/staging/kustomization.yaml | 12 ++ .../clusters/production/apps.yaml | 25 ++++ .../flux-system/gotk-components.yaml | 49 ++++++++ .../production/flux-system/gotk-sync.yaml | 28 +++++ .../production/flux-system/kustomization.yaml | 7 ++ .../clusters/production/infrastructure.yaml | 43 +++++++ .../clusters/production/kustomization.yaml | 12 ++ .../clusters/staging/apps.yaml | 21 ++++ .../staging/flux-system/gotk-components.yaml | 49 ++++++++ .../staging/flux-system/gotk-sync.yaml | 28 +++++ .../staging/flux-system/kustomization.yaml | 7 ++ .../clusters/staging/infrastructure.yaml | 42 +++++++ .../clusters/staging/kustomization.yaml | 9 ++ .../configs/cluster-issuers.yaml | 17 +++ .../infrastructure/configs/kustomization.yaml | 5 + .../controllers/ingress-nginx.yaml | 33 +++++ .../controllers/kustomization.yaml | 6 + .../10-flux-helmrelease/README.md | 100 +++++++++++++++ .../apps/frontend/helmrelease.yaml | 24 ++++ .../apps/frontend/kustomization.yaml | 15 +++ .../apps/frontend/values.yaml | 24 ++++ .../clusters/production/apps.yaml | 39 ++++++ .../flux-system/gotk-components.yaml | 49 ++++++++ .../production/flux-system/gotk-sync.yaml | 28 +++++ .../production/flux-system/kustomization.yaml | 7 ++ .../clusters/production/infrastructure.yaml | 41 ++++++ .../clusters/production/kustomization.yaml | 9 ++ .../ingress-nginx/helmrelease.yaml | 49 ++++++++ .../ingress-nginx/kustomization.yaml | 6 + .../ingress-nginx/values-configmap.yaml | 31 +++++ .../infrastructure/sources/kustomization.yaml | 5 + .../infrastructure/sources/repositories.yaml | 39 ++++++ .../11-repo-per-environment/README.md | 86 +++++++++++++ .../gitops-dev/.gitignore | 6 + .../gitops-dev/apps/backend/deployment.yaml | 31 +++++ .../gitops-dev/apps/backend/service.yaml | 14 +++ .../gitops-dev/apps/frontend/deployment.yaml | 31 +++++ .../gitops-dev/apps/frontend/service.yaml | 14 +++ .../gitops-dev/namespaces.yaml | 15 +++ .../gitops-production/.gitignore | 6 + .../apps/backend/deployment.yaml | 31 +++++ .../apps/backend/service.yaml | 14 +++ .../apps/frontend/deployment.yaml | 33 +++++ .../gitops-production/apps/frontend/hpa.yaml | 23 ++++ .../apps/frontend/service.yaml | 14 +++ .../gitops-production/namespaces.yaml | 15 +++ .../gitops-staging/.gitignore | 6 + .../apps/backend/deployment.yaml | 31 +++++ .../gitops-staging/apps/backend/service.yaml | 14 +++ .../apps/frontend/deployment.yaml | 31 +++++ .../gitops-staging/apps/frontend/service.yaml | 14 +++ .../gitops-staging/namespaces.yaml | 15 +++ .../12-multicluster-applicationset/README.md | 80 ++++++++++++ .../applicationsets/cluster-matrix.yaml | 41 ++++++ .../apps/backend/deployment.yaml | 30 +++++ .../apps/backend/service.yaml | 13 ++ .../apps/frontend/deployment.yaml | 30 +++++ .../apps/frontend/service.yaml | 13 ++ .../clusters/eu-production.yaml | 22 ++++ .../clusters/staging.yaml | 24 ++++ .../clusters/us-production.yaml | 22 ++++ .../values/eu-production/backend.yaml | 9 ++ .../values/eu-production/frontend.yaml | 12 ++ .../values/staging/frontend.yaml | 14 +++ .../values/us-production/frontend.yaml | 12 ++ .../13-sops-encrypted/.sops.yaml | 14 +++ .../13-sops-encrypted/README.md | 80 ++++++++++++ .../apps/frontend/deployment.yaml | 31 +++++ .../apps/frontend/kustomization.yaml | 8 ++ .../apps/frontend/secret.enc.yaml | 37 ++++++ .../clusters/production/apps.yaml | 32 +++++ .../secrets/db-credentials.enc.yaml | 32 +++++ .../infrastructure/secrets/kustomization.yaml | 6 + .../14-rendered-manifests/README.md | 84 +++++++++++++ .../argocd/production.yaml | 20 +++ .../rendered/production/frontend.yaml | 68 ++++++++++ .../rendered/staging/frontend.yaml | 68 ++++++++++ .../src/frontend/base/deployment.yaml | 30 +++++ .../src/frontend/base/kustomization.yaml | 12 ++ .../src/frontend/base/service.yaml | 13 ++ .../overlays/production/kustomization.yaml | 11 ++ .../overlays/staging/kustomization.yaml | 11 ++ .../14-rendered-manifests/src/render.sh | 21 ++++ .../15-mixed-and-hostile/README.md | 108 ++++++++++++++++ .../15-mixed-and-hostile/application.yaml | 28 +++++ .../15-mixed-and-hostile/ci/.gitlab-ci.yml | 17 +++ .../ci/docker-compose.yml | 12 ++ .../crossplane/composition.yaml | 63 ++++++++++ .../15-mixed-and-hostile/empty-dir/.gitkeep | 2 + .../kro/resourcegraphdefinition.yaml | 53 ++++++++ .../15-mixed-and-hostile/kustomization.yaml | 17 +++ .../15-mixed-and-hostile/mixed/bundle.yaml | 47 +++++++ .../mixed/deployment.json | 38 ++++++ .../15-mixed-and-hostile/mixed/service.yml | 14 +++ .../15-mixed-and-hostile/secrets/db.enc.yaml | 32 +++++ .../templates/deployment.yaml | 27 ++++ .../15-mixed-and-hostile/values.yaml | 14 +++ test/fixtures/gitops-layouts/README.md | 118 ++++++++++++++++++ 197 files changed, 5407 insertions(+) create mode 100644 test/fixtures/gitops-layouts/01-argocd-plain/README.md create mode 100644 test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/ci-metadata.yaml create mode 100644 test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/ingress.yaml create mode 100644 test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/namespace.yaml create mode 100644 test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/rbac-and-config.yaml create mode 100644 test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/service.yaml create mode 100644 test/fixtures/gitops-layouts/01-argocd-plain/argocd/frontend-application.yaml create mode 100644 test/fixtures/gitops-layouts/02-argocd-app-of-apps/README.md create mode 100644 test/fixtures/gitops-layouts/02-argocd-app-of-apps/applications/backend.yaml create mode 100644 test/fixtures/gitops-layouts/02-argocd-app-of-apps/applications/frontend.yaml create mode 100644 test/fixtures/gitops-layouts/02-argocd-app-of-apps/bootstrap/root.yaml create mode 100644 test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/backend/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/backend/service.yaml create mode 100644 test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/frontend/application.yaml create mode 100644 test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/frontend/service.yaml create mode 100644 test/fixtures/gitops-layouts/03-argocd-applicationset-directories/README.md create mode 100644 test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/backend/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/backend/service.yaml create mode 100644 test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/disabled-example/README.md create mode 100644 test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/empty/.gitkeep create mode 100644 test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/frontend/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/frontend/service.yaml create mode 100644 test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/platform/monitoring/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/platform/monitoring/service.yaml create mode 100644 test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/worker/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/03-argocd-applicationset-directories/bootstrap/applicationset.yaml create mode 100644 test/fixtures/gitops-layouts/04-argocd-applicationset-files/README.md create mode 100644 test/fixtures/gitops-layouts/04-argocd-applicationset-files/applicationset.yaml create mode 100644 test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/Chart.yaml create mode 100644 test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/service.yaml create mode 100644 test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/values.yaml create mode 100644 test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/dev/backend.yaml create mode 100644 test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/dev/frontend.yaml create mode 100644 test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/production/backend.yaml create mode 100644 test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/production/frontend.yaml create mode 100644 test/fixtures/gitops-layouts/05-kustomize-overlays/README.md create mode 100644 test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/base/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/base/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/base/service.yaml create mode 100644 test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/overlays/production/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/base/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/base/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/base/service.yaml create mode 100644 test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/config.properties create mode 100644 test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/deployment-patch.yaml create mode 100644 test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/secrets.env create mode 100644 test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/staging/config.properties create mode 100644 test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/staging/deployment-patch.yaml create mode 100644 test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/staging/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/06-helm-chart/README.md create mode 100644 test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/.helmignore create mode 100644 test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/Chart.lock create mode 100644 test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/Chart.yaml create mode 100644 test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/charts/.gitkeep create mode 100644 test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/crds/widgets.example.com.yaml create mode 100644 test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/NOTES.txt create mode 100644 test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/_helpers.tpl create mode 100644 test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/configmap.yaml create mode 100644 test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/ingress.yaml create mode 100644 test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/service.yaml create mode 100644 test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/serviceaccount.yaml create mode 100644 test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/tests/test-connection.yaml create mode 100644 test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/values.schema.json create mode 100644 test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/values.yaml create mode 100644 test/fixtures/gitops-layouts/07-helm-environment-values/README.md create mode 100644 test/fixtures/gitops-layouts/07-helm-environment-values/argocd/dev.yaml create mode 100644 test/fixtures/gitops-layouts/07-helm-environment-values/argocd/production.yaml create mode 100644 test/fixtures/gitops-layouts/07-helm-environment-values/chart/Chart.yaml create mode 100644 test/fixtures/gitops-layouts/07-helm-environment-values/chart/templates/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/07-helm-environment-values/chart/templates/service.yaml create mode 100644 test/fixtures/gitops-layouts/07-helm-environment-values/chart/values.yaml create mode 100644 test/fixtures/gitops-layouts/07-helm-environment-values/values/common.yaml create mode 100644 test/fixtures/gitops-layouts/07-helm-environment-values/values/dev.yaml create mode 100644 test/fixtures/gitops-layouts/07-helm-environment-values/values/production.yaml create mode 100644 test/fixtures/gitops-layouts/08-argocd-external-helm/README.md create mode 100644 test/fixtures/gitops-layouts/08-argocd-external-helm/applications/cert-manager.yaml create mode 100644 test/fixtures/gitops-layouts/08-argocd-external-helm/applications/external-dns.yaml create mode 100644 test/fixtures/gitops-layouts/08-argocd-external-helm/applications/ingress-nginx.yaml create mode 100644 test/fixtures/gitops-layouts/08-argocd-external-helm/extras/ingress-nginx/middleware.yaml create mode 100644 test/fixtures/gitops-layouts/08-argocd-external-helm/platform/cert-manager/application.yaml create mode 100644 test/fixtures/gitops-layouts/08-argocd-external-helm/platform/cert-manager/clusterissuer.yaml create mode 100644 test/fixtures/gitops-layouts/08-argocd-external-helm/platform/cert-manager/values.yaml create mode 100644 test/fixtures/gitops-layouts/08-argocd-external-helm/values/cert-manager/production.yaml create mode 100644 test/fixtures/gitops-layouts/08-argocd-external-helm/values/external-dns/production.yaml create mode 100644 test/fixtures/gitops-layouts/08-argocd-external-helm/values/ingress-nginx/common.yaml create mode 100644 test/fixtures/gitops-layouts/08-argocd-external-helm/values/ingress-nginx/production.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/README.md create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/apps/base/frontend/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/apps/base/frontend/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/apps/base/frontend/service.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/apps/production/frontend-patch.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/apps/production/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/apps/staging/frontend-patch.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/apps/staging/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/apps.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/flux-system/gotk-components.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/flux-system/gotk-sync.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/flux-system/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/infrastructure.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/apps.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/flux-system/gotk-components.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/flux-system/gotk-sync.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/flux-system/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/infrastructure.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/configs/cluster-issuers.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/configs/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/controllers/ingress-nginx.yaml create mode 100644 test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/controllers/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/10-flux-helmrelease/README.md create mode 100644 test/fixtures/gitops-layouts/10-flux-helmrelease/apps/frontend/helmrelease.yaml create mode 100644 test/fixtures/gitops-layouts/10-flux-helmrelease/apps/frontend/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/10-flux-helmrelease/apps/frontend/values.yaml create mode 100644 test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/apps.yaml create mode 100644 test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/flux-system/gotk-components.yaml create mode 100644 test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/flux-system/gotk-sync.yaml create mode 100644 test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/flux-system/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/infrastructure.yaml create mode 100644 test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/controllers/ingress-nginx/helmrelease.yaml create mode 100644 test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/controllers/ingress-nginx/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/controllers/ingress-nginx/values-configmap.yaml create mode 100644 test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/sources/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/sources/repositories.yaml create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/README.md create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/.gitignore create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/backend/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/backend/service.yaml create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/frontend/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/frontend/service.yaml create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/namespaces.yaml create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/.gitignore create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/backend/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/backend/service.yaml create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/frontend/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/frontend/hpa.yaml create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/frontend/service.yaml create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/namespaces.yaml create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/.gitignore create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/backend/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/backend/service.yaml create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/frontend/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/frontend/service.yaml create mode 100644 test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/namespaces.yaml create mode 100644 test/fixtures/gitops-layouts/12-multicluster-applicationset/README.md create mode 100644 test/fixtures/gitops-layouts/12-multicluster-applicationset/applicationsets/cluster-matrix.yaml create mode 100644 test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/backend/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/backend/service.yaml create mode 100644 test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/frontend/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/frontend/service.yaml create mode 100644 test/fixtures/gitops-layouts/12-multicluster-applicationset/clusters/eu-production.yaml create mode 100644 test/fixtures/gitops-layouts/12-multicluster-applicationset/clusters/staging.yaml create mode 100644 test/fixtures/gitops-layouts/12-multicluster-applicationset/clusters/us-production.yaml create mode 100644 test/fixtures/gitops-layouts/12-multicluster-applicationset/values/eu-production/backend.yaml create mode 100644 test/fixtures/gitops-layouts/12-multicluster-applicationset/values/eu-production/frontend.yaml create mode 100644 test/fixtures/gitops-layouts/12-multicluster-applicationset/values/staging/frontend.yaml create mode 100644 test/fixtures/gitops-layouts/12-multicluster-applicationset/values/us-production/frontend.yaml create mode 100644 test/fixtures/gitops-layouts/13-sops-encrypted/.sops.yaml create mode 100644 test/fixtures/gitops-layouts/13-sops-encrypted/README.md create mode 100644 test/fixtures/gitops-layouts/13-sops-encrypted/apps/frontend/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/13-sops-encrypted/apps/frontend/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/13-sops-encrypted/apps/frontend/secret.enc.yaml create mode 100644 test/fixtures/gitops-layouts/13-sops-encrypted/clusters/production/apps.yaml create mode 100644 test/fixtures/gitops-layouts/13-sops-encrypted/infrastructure/secrets/db-credentials.enc.yaml create mode 100644 test/fixtures/gitops-layouts/13-sops-encrypted/infrastructure/secrets/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/14-rendered-manifests/README.md create mode 100644 test/fixtures/gitops-layouts/14-rendered-manifests/argocd/production.yaml create mode 100644 test/fixtures/gitops-layouts/14-rendered-manifests/rendered/production/frontend.yaml create mode 100644 test/fixtures/gitops-layouts/14-rendered-manifests/rendered/staging/frontend.yaml create mode 100644 test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/base/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/base/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/base/service.yaml create mode 100644 test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/overlays/production/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/overlays/staging/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/14-rendered-manifests/src/render.sh create mode 100644 test/fixtures/gitops-layouts/15-mixed-and-hostile/README.md create mode 100644 test/fixtures/gitops-layouts/15-mixed-and-hostile/application.yaml create mode 100644 test/fixtures/gitops-layouts/15-mixed-and-hostile/ci/.gitlab-ci.yml create mode 100644 test/fixtures/gitops-layouts/15-mixed-and-hostile/ci/docker-compose.yml create mode 100644 test/fixtures/gitops-layouts/15-mixed-and-hostile/crossplane/composition.yaml create mode 100644 test/fixtures/gitops-layouts/15-mixed-and-hostile/empty-dir/.gitkeep create mode 100644 test/fixtures/gitops-layouts/15-mixed-and-hostile/kro/resourcegraphdefinition.yaml create mode 100644 test/fixtures/gitops-layouts/15-mixed-and-hostile/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/15-mixed-and-hostile/mixed/bundle.yaml create mode 100644 test/fixtures/gitops-layouts/15-mixed-and-hostile/mixed/deployment.json create mode 100644 test/fixtures/gitops-layouts/15-mixed-and-hostile/mixed/service.yml create mode 100644 test/fixtures/gitops-layouts/15-mixed-and-hostile/secrets/db.enc.yaml create mode 100644 test/fixtures/gitops-layouts/15-mixed-and-hostile/templates/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/15-mixed-and-hostile/values.yaml create mode 100644 test/fixtures/gitops-layouts/README.md diff --git a/.gitignore b/.gitignore index fef4c644..24bb047a 100644 --- a/.gitignore +++ b/.gitignore @@ -7,6 +7,9 @@ bin/* Dockerfile.cross *.env +# The GitOps layout fixtures check in a kustomize secretGenerator env file on purpose. +# Its contents are placeholder text, never a real credential. +!test/fixtures/gitops-layouts/**/*.env # Test binary, built with `go test -c` *.test diff --git a/docs/design/gitops-api/f8-repo-discovery-and-onboarding-scan.md b/docs/design/gitops-api/f8-repo-discovery-and-onboarding-scan.md index fa4d425a..d727770e 100644 --- a/docs/design/gitops-api/f8-repo-discovery-and-onboarding-scan.md +++ b/docs/design/gitops-api/f8-repo-discovery-and-onboarding-scan.md @@ -359,6 +359,13 @@ nested base (deduped `rendered`), an overlay base holding parked YAML (excluded - Reuse existing corpora where they fit (`internal/manifestanalyzer/testdata/contextual-namespace`, the `ambiguous-*` folders) rather than duplicating fixtures. +- A **descriptive** corpus of real-world layouts lives at + [`test/fixtures/gitops-layouts/`](../../../test/fixtures/gitops-layouts/): Argo CD plain + directories, App of Apps, both ApplicationSet generators, kustomize overlays, Helm charts + and per-environment values, the Flux monorepo and `HelmRelease` shapes, + repo-per-environment, a cluster×app matrix, SOPS, committed rendered manifests, and a + hostile mixed folder. It records **no verdicts** — it is the input to deciding them. When a + layout there graduates into a decision, it gains a golden report under `scan-repo/` above. ## Open questions diff --git a/test/fixtures/gitops-layouts/01-argocd-plain/README.md b/test/fixtures/gitops-layouts/01-argocd-plain/README.md new file mode 100644 index 00000000..342ebf09 --- /dev/null +++ b/test/fixtures/gitops-layouts/01-argocd-plain/README.md @@ -0,0 +1,64 @@ +# 01-argocd-plain + +## What this is +The simplest Argo CD pattern: a single `Application` that points at a plain +directory of raw Kubernetes manifests in a Git repository. There is no Helm, +no Kustomize, no templating — Argo CD just reads every YAML file under the +`path` and applies it. This is the first layout most teams adopt when they move +from `kubectl apply -f` to GitOps, and it remains common for small services and +for bootstrapping. The `Application` resource itself lives in the `argocd/` +directory and is typically applied out-of-band (by hand or by a bootstrap job), +while the workload manifests live under `apps/frontend/`. + +## Layout +``` +01-argocd-plain/ +├── README.md +├── argocd/ +│ └── frontend-application.yaml # Argo CD Application (control-plane object) +└── apps/ + └── frontend/ + ├── namespace.yaml # cluster-scoped object + ├── deployment.yaml + ├── service.yaml + ├── ingress.yaml + ├── rbac-and-config.yaml # multi-doc: ServiceAccount + ConfigMap + └── ci-metadata.yaml # YAML but NOT a Kubernetes object +``` + +## What makes it structurally distinct +- **Two roles of YAML in one tree.** `argocd/frontend-application.yaml` is an + Argo CD control-plane object that *describes where to sync from*; the files + under `apps/frontend/` are the *workloads it syncs*. They are not + interchangeable even though both are valid YAML. +- **Mixed scope in one directory.** `namespace.yaml` is cluster-scoped (no + `metadata.namespace`); every other object is namespaced. A reader cannot + assume every file in an app directory targets the same namespace, or any + namespace at all. +- **Arbitrary filenames.** `rbac-and-config.yaml` is named for what a human + thinks it contains, not for a `kind`. Filenames carry no guaranteed relation + to the objects inside — the only source of truth is `apiVersion`/`kind`. +- **Multi-document files.** `rbac-and-config.yaml` holds two objects + (`ServiceAccount` + `ConfigMap`) separated by `---`. One file does not mean + one object. +- **Non-manifest YAML in a manifest directory.** `ci-metadata.yaml` is build + metadata (`pipeline`, `commit`, `builtAt`) with no `apiVersion`/`kind`. It is + YAML sitting beside manifests but is not KRM and must not be applied. +- **`directory.include` / `directory.exclude` change the file set.** The + Application uses `include: '*.yaml'` and `exclude: 'ci-metadata.yaml'`, so the + *effective* set of applied files is not simply "every file under path" — it is + filtered by globs declared elsewhere (in the Application), plus `recurse: + true` decides whether subdirectories are scanned at all. + +## Open questions +- Given only the files under `apps/frontend/`, how would a tool decide which are + Kubernetes objects and which (like `ci-metadata.yaml`) are not? +- The include/exclude globs live in the `Application`, not next to the + manifests. If you only have the manifest directory, can you know which files + Argo CD would actually apply? +- Does `recurse: true` here matter when the directory is currently flat, and how + would adding a subdirectory later change what gets applied? +- If a filename (`rbac-and-config.yaml`) does not name a `kind`, and a file can + hold many kinds, what can a filename be trusted to tell you at all? +- `namespace.yaml` creates the very namespace the other objects target — does + apply ordering within a plain directory guarantee it exists first? diff --git a/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/ci-metadata.yaml b/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/ci-metadata.yaml new file mode 100644 index 00000000..07932838 --- /dev/null +++ b/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/ci-metadata.yaml @@ -0,0 +1,8 @@ +# NOT a Kubernetes object: this is build metadata emitted by CI and dropped +# into the manifest directory. It has no apiVersion/kind, so it is not KRM. +# The Application excludes it via directory.exclude so it is never applied. +pipeline: frontend-release +commit: 9f3c1ab7d2e4c5061b8a0f2d3e4c5061b8a0f2d3 +builtAt: "2026-07-09T14:22:07Z" +builtBy: github-actions +image: ghcr.io/example-org/frontend:1.8.3 diff --git a/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/deployment.yaml b/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/deployment.yaml new file mode 100644 index 00000000..e63cc53f --- /dev/null +++ b/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/deployment.yaml @@ -0,0 +1,34 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend + namespace: frontend + labels: + app.kubernetes.io/name: frontend +spec: + replicas: 2 + selector: + matchLabels: + app.kubernetes.io/name: frontend + template: + metadata: + labels: + app.kubernetes.io/name: frontend + spec: + serviceAccountName: frontend + containers: + - name: frontend + image: ghcr.io/example-org/frontend:1.8.3 + ports: + - name: http + containerPort: 8080 + envFrom: + - configMapRef: + name: frontend-config + resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 250m + memory: 128Mi diff --git a/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/ingress.yaml b/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/ingress.yaml new file mode 100644 index 00000000..68df3a53 --- /dev/null +++ b/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/ingress.yaml @@ -0,0 +1,19 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: frontend + namespace: frontend + labels: + app.kubernetes.io/name: frontend +spec: + rules: + - host: frontend.example.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: frontend + port: + name: http diff --git a/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/namespace.yaml b/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/namespace.yaml new file mode 100644 index 00000000..717e244a --- /dev/null +++ b/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/namespace.yaml @@ -0,0 +1,8 @@ +# Cluster-scoped object: a Namespace has no metadata.namespace of its own. +apiVersion: v1 +kind: Namespace +metadata: + name: frontend + labels: + app.kubernetes.io/name: frontend + app.kubernetes.io/part-of: example-platform diff --git a/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/rbac-and-config.yaml b/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/rbac-and-config.yaml new file mode 100644 index 00000000..e0b5a427 --- /dev/null +++ b/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/rbac-and-config.yaml @@ -0,0 +1,20 @@ +# Multi-document file: two unrelated Kubernetes objects separated by '---'. +# The filename says nothing about which kinds live inside. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: frontend + namespace: frontend + labels: + app.kubernetes.io/name: frontend +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: frontend-config + namespace: frontend + labels: + app.kubernetes.io/name: frontend +data: + LOG_LEVEL: info + BACKEND_URL: http://backend.backend.svc.cluster.local diff --git a/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/service.yaml b/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/service.yaml new file mode 100644 index 00000000..ceacdd95 --- /dev/null +++ b/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: frontend + namespace: frontend + labels: + app.kubernetes.io/name: frontend +spec: + selector: + app.kubernetes.io/name: frontend + ports: + - name: http + port: 80 + targetPort: http diff --git a/test/fixtures/gitops-layouts/01-argocd-plain/argocd/frontend-application.yaml b/test/fixtures/gitops-layouts/01-argocd-plain/argocd/frontend-application.yaml new file mode 100644 index 00000000..6f1e77cc --- /dev/null +++ b/test/fixtures/gitops-layouts/01-argocd-plain/argocd/frontend-application.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: frontend + namespace: argocd +spec: + project: default + source: + repoURL: https://github.com/example-org/gitops.git + targetRevision: main + path: apps/frontend + directory: + recurse: true + # include/exclude are glob patterns evaluated against files under path. + # ci-metadata.yaml is plain build metadata, not a Kubernetes object, so + # it is excluded to stop Argo CD trying to apply it to the cluster. + include: '*.yaml' + exclude: 'ci-metadata.yaml' + destination: + server: https://kubernetes.default.svc + syncPolicy: + syncOptions: + - CreateNamespace=false diff --git a/test/fixtures/gitops-layouts/02-argocd-app-of-apps/README.md b/test/fixtures/gitops-layouts/02-argocd-app-of-apps/README.md new file mode 100644 index 00000000..607a3f94 --- /dev/null +++ b/test/fixtures/gitops-layouts/02-argocd-app-of-apps/README.md @@ -0,0 +1,69 @@ +# 02-argocd-app-of-apps + +## What this is +The classic Argo CD bootstrap pattern, known as "app of apps". A single root +`Application` does not point at workloads at all — it points at a directory that +contains *other* `Application` manifests. Argo CD syncs the root, which creates +the child Applications, and each child then syncs its own workloads. Teams use +this to bootstrap an entire cluster from one hand-applied resource: apply +`root`, and everything else follows. It predates `ApplicationSet` and is still +widely used because it needs no generator — child Applications are just static +YAML committed to the repo. + +## Layout +``` +02-argocd-app-of-apps/ +├── README.md +├── bootstrap/ +│ └── root.yaml # root Application -> path: applications +├── applications/ +│ ├── frontend.yaml # child Application -> manifests/frontend +│ └── backend.yaml # child Application -> manifests/backend +└── manifests/ + ├── frontend/ + │ ├── application.yaml # TRAP: an ordinary Deployment named frontend + │ └── service.yaml + └── backend/ + ├── deployment.yaml + └── service.yaml +``` + +## What makes it structurally distinct +- **Three distinct roles collide in one repo:** + 1. `bootstrap/root.yaml` and `applications/*.yaml` are Argo CD `Application` + resources — control-plane objects that *describe where deployments come + from*. + 2. `manifests/frontend/` and `manifests/backend/` hold the actual workloads + those Applications *reference*. + 3. `manifests/frontend/application.yaml` is an ordinary Kubernetes + `Deployment` that merely *happens to be named* `application.yaml`. +- **The filename trap is explicit.** `manifests/frontend/application.yaml` has + `kind: Deployment`. A tool keying off the filename `application.yaml` would + misclassify it as an Argo CD Application. Only `apiVersion`/`kind` disambiguate. +- **Directory names are conventions, not contracts.** The directory is called + `applications/` because a human put Applications there, and `manifests/` + because a human put workloads there — but nothing enforces this. A Deployment + sits inside `manifests/` under a file named like a control-plane object. +- **Recursion + automation.** `root.yaml` uses `directory.recurse: true` over + `applications/`, so any Application YAML added to that tree is picked up + automatically, and `syncPolicy.automated` means adding a file can create real + cluster objects with no further human step. +- **Same object names at different layers.** There is an `Application` named + `frontend` (in `applications/`) and a `Deployment` named `frontend` (in + `manifests/frontend/`). Name alone does not tell you which layer you are in. + +## Open questions +- If directory names (`applications/`, `manifests/`) are only conventions, can + the location of a file be trusted to tell you what role it plays? +- `manifests/frontend/application.yaml` is a Deployment. What signal, other than + parsing `kind`, could reliably separate a control-plane Application from a + workload with the same filename? +- The root Application's `directory.recurse: true` means a newly committed + Application file becomes a live child Application. Is committing that file a + configuration change, or a deployment action? +- Two objects are both named `frontend` at different layers. When something + refers to "frontend", how do you know whether it means the Application or the + Deployment? +- Nothing in `manifests/frontend/` states which Application references it — the + link lives only in `applications/frontend.yaml`. If you start from the + workload directory, how do you find its owning Application? diff --git a/test/fixtures/gitops-layouts/02-argocd-app-of-apps/applications/backend.yaml b/test/fixtures/gitops-layouts/02-argocd-app-of-apps/applications/backend.yaml new file mode 100644 index 00000000..a051ad56 --- /dev/null +++ b/test/fixtures/gitops-layouts/02-argocd-app-of-apps/applications/backend.yaml @@ -0,0 +1,18 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: backend + namespace: argocd +spec: + project: default + source: + repoURL: https://github.com/example-org/gitops.git + targetRevision: main + path: manifests/backend + destination: + server: https://kubernetes.default.svc + namespace: backend + syncPolicy: + automated: + prune: true + selfHeal: true diff --git a/test/fixtures/gitops-layouts/02-argocd-app-of-apps/applications/frontend.yaml b/test/fixtures/gitops-layouts/02-argocd-app-of-apps/applications/frontend.yaml new file mode 100644 index 00000000..c74decf0 --- /dev/null +++ b/test/fixtures/gitops-layouts/02-argocd-app-of-apps/applications/frontend.yaml @@ -0,0 +1,18 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: frontend + namespace: argocd +spec: + project: default + source: + repoURL: https://github.com/example-org/gitops.git + targetRevision: main + path: manifests/frontend + destination: + server: https://kubernetes.default.svc + namespace: frontend + syncPolicy: + automated: + prune: true + selfHeal: true diff --git a/test/fixtures/gitops-layouts/02-argocd-app-of-apps/bootstrap/root.yaml b/test/fixtures/gitops-layouts/02-argocd-app-of-apps/bootstrap/root.yaml new file mode 100644 index 00000000..ad1f85d9 --- /dev/null +++ b/test/fixtures/gitops-layouts/02-argocd-app-of-apps/bootstrap/root.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: root + namespace: argocd +spec: + project: default + source: + repoURL: https://github.com/example-org/gitops.git + targetRevision: main + # path points at a directory full of *other* Application manifests. + path: applications + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=false diff --git a/test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/backend/deployment.yaml b/test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/backend/deployment.yaml new file mode 100644 index 00000000..29f062f6 --- /dev/null +++ b/test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/backend/deployment.yaml @@ -0,0 +1,30 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: backend + namespace: backend + labels: + app.kubernetes.io/name: backend +spec: + replicas: 3 + selector: + matchLabels: + app.kubernetes.io/name: backend + template: + metadata: + labels: + app.kubernetes.io/name: backend + spec: + containers: + - name: backend + image: ghcr.io/example-org/backend:2.4.0 + ports: + - name: http + containerPort: 9090 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 500m + memory: 256Mi diff --git a/test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/backend/service.yaml b/test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/backend/service.yaml new file mode 100644 index 00000000..640d8789 --- /dev/null +++ b/test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/backend/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: backend + namespace: backend + labels: + app.kubernetes.io/name: backend +spec: + selector: + app.kubernetes.io/name: backend + ports: + - name: http + port: 80 + targetPort: http diff --git a/test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/frontend/application.yaml b/test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/frontend/application.yaml new file mode 100644 index 00000000..672e1839 --- /dev/null +++ b/test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/frontend/application.yaml @@ -0,0 +1,33 @@ +# FILENAME TRAP: this file is called application.yaml but it is an ordinary +# apps/v1 Deployment, NOT an Argo CD Application. The kind is the only reliable +# signal; the filename is misleading on purpose. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend + namespace: frontend + labels: + app.kubernetes.io/name: frontend +spec: + replicas: 2 + selector: + matchLabels: + app.kubernetes.io/name: frontend + template: + metadata: + labels: + app.kubernetes.io/name: frontend + spec: + containers: + - name: frontend + image: ghcr.io/example-org/frontend:1.8.3 + ports: + - name: http + containerPort: 8080 + resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 250m + memory: 128Mi diff --git a/test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/frontend/service.yaml b/test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/frontend/service.yaml new file mode 100644 index 00000000..ceacdd95 --- /dev/null +++ b/test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/frontend/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: frontend + namespace: frontend + labels: + app.kubernetes.io/name: frontend +spec: + selector: + app.kubernetes.io/name: frontend + ports: + - name: http + port: 80 + targetPort: http diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/README.md b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/README.md new file mode 100644 index 00000000..41c3ac58 --- /dev/null +++ b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/README.md @@ -0,0 +1,79 @@ +# 03-argocd-applicationset-directories + +## What this is +An Argo CD `ApplicationSet` using the **git directory generator**: instead of +writing one `Application` per service, you write one `ApplicationSet` whose git +generator scans the repository for directories matching a glob (`apps/*`) and +templates one `Application` per matching directory. Adding a new service becomes +"create a new folder under `apps/`"; the generator notices the directory and +produces an Application for it. This is the standard way large monorepos manage +dozens or hundreds of apps without hand-maintaining an Application per app. The +Application's name and destination namespace are derived from the directory +basename via Go templating (`{{.path.basename}}`). + +## Layout +``` +03-argocd-applicationset-directories/ +├── README.md +├── bootstrap/ +│ └── applicationset.yaml # ApplicationSet with a git directory generator +└── apps/ + ├── frontend/ # matched -> Application "frontend" + │ ├── deployment.yaml + │ └── service.yaml + ├── backend/ # matched -> Application "backend" + │ ├── deployment.yaml + │ └── service.yaml + ├── worker/ # matched -> Application "worker" + │ └── deployment.yaml + ├── disabled-example/ # matched by apps/* but explicitly excluded + │ └── README.md # no Kubernetes manifests at all + ├── empty/ # matched by apps/* but contains no manifests + │ └── .gitkeep # placeholder so git keeps the empty directory + └── platform/ # matched -> Application "platform" + └── monitoring/ # NOT matched: two levels below apps/ + ├── deployment.yaml + └── service.yaml +``` + +## What makes it structurally distinct +- **Wildcard directory selection.** `apps/*` matches every immediate + subdirectory of `apps/`. The set of Applications is not written down anywhere — + it is *computed* from the directory listing at sync time. +- **Explicit exclusion.** `apps/disabled-example` is matched by `apps/*` but an + `exclude: true` entry removes it, so no Application is generated. Being present + under the wildcard is necessary but not sufficient. +- **An empty directory still matches.** `apps/empty` matches `apps/*`, so the + generator would create an Application named `empty` — pointing at a directory + with nothing to apply. `.gitkeep` is a non-manifest file that exists only so + git preserves the otherwise-empty directory. +- **A matched directory with no manifests.** `apps/disabled-example` contains + only a `README.md` (not KRM). Even without the exclusion, there would be no + Kubernetes objects to deploy there. +- **A nested directory the glob does NOT match.** `apps/platform/monitoring` + holds real manifests but sits two levels below `apps/`, so `apps/*` skips it. + Meanwhile `apps/platform` *is* matched, yielding an Application named + `platform` whose `path` is `apps/platform` — a directory whose only real + content lives one level deeper. Depth of the glob silently decides what is and + is not a deployable unit. +- **The directory name becomes the Application name.** `{{.path.basename}}` + turns the folder name into the Application `metadata.name` and the destination + namespace. Renaming a folder renames (and can recreate) an Application. + +## Open questions +- If the list of Applications is derived from a directory listing, is *creating a + new folder* under `apps/` itself a deployment operation — even before any + manifest is committed into it? +- `apps/empty` matches and would generate an Application, but there is nothing to + apply. What is the meaning of an Application whose source directory is empty? +- `apps/platform` is matched but its real workloads live in + `apps/platform/monitoring`, which the glob excludes. How would a reader know, + from the layout alone, which directories are intended as deployable units? +- The directory basename becomes the Application name and namespace. What happens + to the running Application if the folder is renamed or moved? +- `.gitkeep` and `disabled-example/README.md` are files that are not Kubernetes + objects. How does a tool distinguish "directory that should yield an app" from + "directory that only exists as scaffolding"? +- Nothing inside `apps/frontend/` references the ApplicationSet that generates + its Application. Starting from a workload directory, how would you discover that + a generator — not a static Application — owns it? diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/backend/deployment.yaml b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/backend/deployment.yaml new file mode 100644 index 00000000..29f062f6 --- /dev/null +++ b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/backend/deployment.yaml @@ -0,0 +1,30 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: backend + namespace: backend + labels: + app.kubernetes.io/name: backend +spec: + replicas: 3 + selector: + matchLabels: + app.kubernetes.io/name: backend + template: + metadata: + labels: + app.kubernetes.io/name: backend + spec: + containers: + - name: backend + image: ghcr.io/example-org/backend:2.4.0 + ports: + - name: http + containerPort: 9090 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 500m + memory: 256Mi diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/backend/service.yaml b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/backend/service.yaml new file mode 100644 index 00000000..640d8789 --- /dev/null +++ b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/backend/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: backend + namespace: backend + labels: + app.kubernetes.io/name: backend +spec: + selector: + app.kubernetes.io/name: backend + ports: + - name: http + port: 80 + targetPort: http diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/disabled-example/README.md b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/disabled-example/README.md new file mode 100644 index 00000000..c5088ed5 --- /dev/null +++ b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/disabled-example/README.md @@ -0,0 +1,11 @@ +# disabled-example (intentionally excluded) + +This directory is deliberately excluded from the ApplicationSet git directory +generator via an `exclude: true` entry (`path: apps/disabled-example`) in +`bootstrap/applicationset.yaml`. + +Even though it sits under `apps/`, and even though `apps/*` would otherwise +match it, no `Application` is generated for it. It contains no Kubernetes +manifests — only this note — so there is nothing here to deploy. It exists to +show that presence under the wildcard path is not sufficient: an explicit +exclusion overrides the match. diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/empty/.gitkeep b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/empty/.gitkeep new file mode 100644 index 00000000..5013c878 --- /dev/null +++ b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/empty/.gitkeep @@ -0,0 +1,4 @@ +# Intentionally empty directory. +# Git cannot track an empty directory, so this .gitkeep placeholder preserves it. +# apps/* still MATCHES apps/empty, so the generator would produce an Application +# named "empty" pointing at a directory with no manifests to apply. diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/frontend/deployment.yaml b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/frontend/deployment.yaml new file mode 100644 index 00000000..1fb48897 --- /dev/null +++ b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/frontend/deployment.yaml @@ -0,0 +1,30 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend + namespace: frontend + labels: + app.kubernetes.io/name: frontend +spec: + replicas: 2 + selector: + matchLabels: + app.kubernetes.io/name: frontend + template: + metadata: + labels: + app.kubernetes.io/name: frontend + spec: + containers: + - name: frontend + image: ghcr.io/example-org/frontend:1.8.3 + ports: + - name: http + containerPort: 8080 + resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 250m + memory: 128Mi diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/frontend/service.yaml b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/frontend/service.yaml new file mode 100644 index 00000000..ceacdd95 --- /dev/null +++ b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/frontend/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: frontend + namespace: frontend + labels: + app.kubernetes.io/name: frontend +spec: + selector: + app.kubernetes.io/name: frontend + ports: + - name: http + port: 80 + targetPort: http diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/platform/monitoring/deployment.yaml b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/platform/monitoring/deployment.yaml new file mode 100644 index 00000000..e8030af9 --- /dev/null +++ b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/platform/monitoring/deployment.yaml @@ -0,0 +1,33 @@ +# NESTED application directory: this lives at apps/platform/monitoring, two +# levels below apps/. The generator's apps/* pattern matches apps/platform but +# NOT apps/platform/monitoring, so these manifests are not selected on their own. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: monitoring + namespace: platform + labels: + app.kubernetes.io/name: monitoring +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: monitoring + template: + metadata: + labels: + app.kubernetes.io/name: monitoring + spec: + containers: + - name: monitoring + image: ghcr.io/example-org/worker:0.9.1 + ports: + - name: metrics + containerPort: 9091 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 500m + memory: 256Mi diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/platform/monitoring/service.yaml b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/platform/monitoring/service.yaml new file mode 100644 index 00000000..166242a1 --- /dev/null +++ b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/platform/monitoring/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: monitoring + namespace: platform + labels: + app.kubernetes.io/name: monitoring +spec: + selector: + app.kubernetes.io/name: monitoring + ports: + - name: metrics + port: 9091 + targetPort: metrics diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/worker/deployment.yaml b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/worker/deployment.yaml new file mode 100644 index 00000000..99b5c905 --- /dev/null +++ b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/worker/deployment.yaml @@ -0,0 +1,31 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: worker + namespace: worker + labels: + app.kubernetes.io/name: worker +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: worker + template: + metadata: + labels: + app.kubernetes.io/name: worker + spec: + containers: + - name: worker + image: ghcr.io/example-org/worker:0.9.1 + command: + - /worker + args: + - --queue=default + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 500m + memory: 256Mi diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/bootstrap/applicationset.yaml b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/bootstrap/applicationset.yaml new file mode 100644 index 00000000..323f5ac8 --- /dev/null +++ b/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/bootstrap/applicationset.yaml @@ -0,0 +1,41 @@ +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: apps + namespace: argocd +spec: + goTemplate: true + goTemplateOptions: + - missingkey=error + generators: + - git: + repoURL: https://github.com/example-org/gitops.git + revision: main + # Each directory matching apps/* becomes one Application. + # apps/* matches only ONE level deep: apps/frontend, apps/backend, + # apps/worker, apps/empty, apps/disabled-example, apps/platform. + # It does NOT match apps/platform/monitoring (that is two levels deep). + directories: + - path: apps/* + # Excluded: this directory is skipped and never becomes an Application. + - path: apps/disabled-example + exclude: true + template: + metadata: + # The directory's basename becomes the Application name. + name: '{{.path.basename}}' + spec: + project: default + source: + repoURL: https://github.com/example-org/gitops.git + targetRevision: main + path: '{{.path.path}}' + destination: + server: https://kubernetes.default.svc + namespace: '{{.path.basename}}' + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/README.md b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/README.md new file mode 100644 index 00000000..43eb9d76 --- /dev/null +++ b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/README.md @@ -0,0 +1,69 @@ +# 04-argocd-applicationset-files + +## What this is +An Argo CD `ApplicationSet` using the **git files generator**. A single +`ApplicationSet` object watches a directory of small config files +(`deployments/**/*.yaml`) and renders one `Application` per file. This is a +common multi-tenant / multi-environment pattern for teams who want to add an +environment or app by dropping a tiny data file into Git rather than by writing +a full `Application` manifest by hand. Each generated `Application` deploys the +in-repo Helm chart under `chart/`, parameterised from the generator file. + +## Layout +``` +04-argocd-applicationset-files/ +├── README.md +├── applicationset.yaml # KRM: kind ApplicationSet +├── deployments/ +│ ├── dev/ +│ │ ├── frontend.yaml # NOT KRM - generator input (plain data) +│ │ └── backend.yaml # NOT KRM - generator input (plain data) +│ └── production/ +│ ├── frontend.yaml # NOT KRM - generator input (plain data) +│ └── backend.yaml # NOT KRM - generator input (plain data) +└── chart/ + ├── Chart.yaml # NOT KRM - Helm chart metadata (valid YAML) + ├── values.yaml # NOT KRM - Helm default values (valid YAML) + └── templates/ + ├── deployment.yaml # NOT parseable YAML - Helm/Go template + └── service.yaml # NOT parseable YAML - Helm/Go template +``` + +## What makes it structurally distinct +- Four distinct *categories* of `.yaml` file live in one directory tree: + - **A Kubernetes object:** `applicationset.yaml` (kind `ApplicationSet`). + - **Generator input that is NOT a Kubernetes object:** + `deployments//.yaml`. These files have no `apiVersion`, no `kind`, + and no `metadata`. They are arbitrary key/value data whose top-level keys + (`name`, `namespace`, `chartVersion`, `values`) become template parameters. + - **Helm value/metadata YAML that is NOT a Kubernetes object:** `Chart.yaml` + and `values.yaml`. They are valid YAML documents but there is no `Chart` or + `Values` kind in the Kubernetes API. + - **Helm templates that are NOT even valid standalone YAML:** + `chart/templates/*.yaml`. They contain Go template actions + (`{{ .Values.replicas }}`, `{{ include "tenant-app.fullname" . }}`) and only + become Kubernetes objects after Helm renders them. +- The actual deployed Kubernetes objects (a `Deployment`, a `Service`) exist + **nowhere as a checked-in document** — they are produced at sync time by + expanding the chart with per-`Application` parameters. +- The desired state for an environment is spread across three places: the + `ApplicationSet` template, the generator input file, and the chart defaults. +- `dev/frontend.yaml` and `production/frontend.yaml` share the same `name` but + differ in `replicas`, so file path (not file content) carries the environment. + +## Open questions +- How does a tool decide which `.yaml` file in this tree is a Kubernetes object? + `apiVersion` + `kind` presence distinguishes `applicationset.yaml` from the + generator inputs, but `Chart.yaml` also has an `apiVersion` (`v2`) and no + Kubernetes `kind` — is `apiVersion`-alone enough to misclassify it? +- If a tool wants to reflect a running `Deployment` back into Git, which file + does it edit — the generator input `values.image`, the chart `values.yaml` + default, or the `ApplicationSet` parameter list? +- Can the effective desired state be reconstructed without executing the git + files generator and rendering Helm, i.e. without an Argo CD-equivalent engine? +- The `Deployment`'s final `metadata.name` depends on `include + "tenant-app.fullname"` and the per-Application `releaseName` — can that name be + known statically from the files alone? +- If someone adds `deployments/staging/frontend.yaml`, a new `Application` + appears with no other change. How would a tool notice that a directory listing + is itself part of the desired state? diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/applicationset.yaml b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/applicationset.yaml new file mode 100644 index 00000000..1cad8074 --- /dev/null +++ b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/applicationset.yaml @@ -0,0 +1,55 @@ +# This IS a Kubernetes object: an Argo CD ApplicationSet. +# Its git "files" generator reads the config files under deployments/**/*.yaml, +# which are themselves NOT Kubernetes objects (see deployments//.yaml). +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: tenant-apps + namespace: argocd +spec: + goTemplate: true + goTemplateOptions: + - missingkey=error + generators: + - git: + repoURL: https://github.com/example-org/gitops.git + revision: main + # Each matched file is parsed and its top-level keys become template + # parameters. The files below are plain data, not KRM. + files: + - path: deployments/**/*.yaml + template: + metadata: + # One Application per matched generator file, e.g. dev-frontend. + name: '{{.namespace}}-{{.name}}' + namespace: argocd + spec: + project: default + source: + repoURL: https://github.com/example-org/gitops.git + targetRevision: main + # The rendered Application deploys the Helm chart under chart/, + # NOT the generator input file that produced it. + path: chart + helm: + releaseName: '{{.name}}' + parameters: + - name: nameOverride + value: '{{.name}}' + - name: image + value: '{{.values.image}}' + - name: replicas + value: '{{.values.replicas}}' + # chartVersion is carried as a parameter so downstream tooling can pin + # the rendered chart even though the source path is a directory. + valuesObject: + chartVersion: '{{.chartVersion}}' + destination: + server: https://kubernetes.default.svc + namespace: '{{.namespace}}' + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/Chart.yaml b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/Chart.yaml new file mode 100644 index 00000000..8abfd0dc --- /dev/null +++ b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/Chart.yaml @@ -0,0 +1,8 @@ +# Helm chart metadata. This IS a well-formed YAML document, but it is a Helm +# Chart.yaml, not a Kubernetes API object (kind Chart does not exist in the API). +apiVersion: v2 +name: tenant-app +description: A minimal Helm chart deployed by the ApplicationSet above. +type: application +version: 1.4.2 +appVersion: "1.8.3" diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/deployment.yaml b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/deployment.yaml new file mode 100644 index 00000000..497d562e --- /dev/null +++ b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/deployment.yaml @@ -0,0 +1,24 @@ +# Helm template. Despite the .yaml extension this is NOT valid YAML on its own: +# the Go template actions below must be rendered by Helm before it becomes a +# Kubernetes Deployment. Parsing it as plain YAML will fail. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "tenant-app.fullname" . }} + labels: + app.kubernetes.io/name: {{ include "tenant-app.name" . }} +spec: + replicas: {{ .Values.replicas }} + selector: + matchLabels: + app.kubernetes.io/name: {{ include "tenant-app.name" . }} + template: + metadata: + labels: + app.kubernetes.io/name: {{ include "tenant-app.name" . }} + spec: + containers: + - name: app + image: {{ .Values.image | quote }} + ports: + - containerPort: {{ .Values.service.targetPort }} diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/service.yaml b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/service.yaml new file mode 100644 index 00000000..f1910b65 --- /dev/null +++ b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/service.yaml @@ -0,0 +1,13 @@ +# Helm template. Not valid YAML until Helm renders the {{ ... }} actions. +apiVersion: v1 +kind: Service +metadata: + name: {{ include "tenant-app.fullname" . }} + labels: + app.kubernetes.io/name: {{ include "tenant-app.name" . }} +spec: + selector: + app.kubernetes.io/name: {{ include "tenant-app.name" . }} + ports: + - port: {{ .Values.service.port }} + targetPort: {{ .Values.service.targetPort }} diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/values.yaml b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/values.yaml new file mode 100644 index 00000000..f7527d71 --- /dev/null +++ b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/values.yaml @@ -0,0 +1,8 @@ +# Default Helm values. Plain YAML data, NOT a Kubernetes object. The +# ApplicationSet overrides nameOverride/image/replicas per generated Application. +nameOverride: "" +replicas: 1 +image: ghcr.io/example-org/frontend:1.8.3 +service: + port: 80 + targetPort: 8080 diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/dev/backend.yaml b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/dev/backend.yaml new file mode 100644 index 00000000..20787b44 --- /dev/null +++ b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/dev/backend.yaml @@ -0,0 +1,9 @@ +# ApplicationSet generator input. This is NOT a Kubernetes object: it has no +# apiVersion, no kind, and no metadata. It is plain data consumed by the git +# files generator in applicationset.yaml. +name: backend +namespace: backend +chartVersion: 1.4.2 +values: + replicas: 1 + image: ghcr.io/example-org/backend:2.4.0 diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/dev/frontend.yaml b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/dev/frontend.yaml new file mode 100644 index 00000000..35b362fa --- /dev/null +++ b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/dev/frontend.yaml @@ -0,0 +1,9 @@ +# ApplicationSet generator input. This is NOT a Kubernetes object: it has no +# apiVersion, no kind, and no metadata. It is plain data consumed by the git +# files generator in applicationset.yaml. +name: frontend +namespace: frontend +chartVersion: 1.4.2 +values: + replicas: 1 + image: ghcr.io/example-org/frontend:1.8.3 diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/production/backend.yaml b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/production/backend.yaml new file mode 100644 index 00000000..92c232cb --- /dev/null +++ b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/production/backend.yaml @@ -0,0 +1,9 @@ +# ApplicationSet generator input. This is NOT a Kubernetes object: it has no +# apiVersion, no kind, and no metadata. It is plain data consumed by the git +# files generator in applicationset.yaml. +name: backend +namespace: backend +chartVersion: 1.4.2 +values: + replicas: 3 + image: ghcr.io/example-org/backend:2.4.0 diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/production/frontend.yaml b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/production/frontend.yaml new file mode 100644 index 00000000..4c9dc8dc --- /dev/null +++ b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/production/frontend.yaml @@ -0,0 +1,9 @@ +# ApplicationSet generator input. This is NOT a Kubernetes object: it has no +# apiVersion, no kind, and no metadata. It is plain data consumed by the git +# files generator in applicationset.yaml. +name: frontend +namespace: frontend +chartVersion: 1.4.2 +values: + replicas: 4 + image: ghcr.io/example-org/frontend:1.8.3 diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/README.md b/test/fixtures/gitops-layouts/05-kustomize-overlays/README.md new file mode 100644 index 00000000..b811b221 --- /dev/null +++ b/test/fixtures/gitops-layouts/05-kustomize-overlays/README.md @@ -0,0 +1,96 @@ +# 05-kustomize-overlays + +## What this is +The most recognizable general-purpose GitOps layout: per-app `base/` + +`overlays//`. A `base` holds environment-agnostic Kubernetes objects, and +each overlay layers environment-specific changes on top with a +`kustomization.yaml`. This is the default structure produced and consumed by +`kustomize build` and by Flux `Kustomization` / Argo CD kustomize sources. The +`frontend` app is fully self-contained in this repo; the `backend` production +overlay instead builds on a **remote** base fetched from another repository. + +## Layout +``` +05-kustomize-overlays/ +├── README.md +└── apps/ + ├── frontend/ + │ ├── base/ + │ │ ├── deployment.yaml # KRM: Deployment + │ │ ├── service.yaml # KRM: Service + │ │ └── kustomization.yaml # kustomize config (not a cluster obj) + │ └── overlays/ + │ ├── staging/ + │ │ ├── kustomization.yaml # namespace, namePrefix, replicas, + │ │ │ # images(newTag), patch, cmGenerator + │ │ ├── deployment-patch.yaml# partial object (strategic merge) + │ │ └── config.properties # NOT YAML - key=value env file + │ └── production/ + │ ├── kustomization.yaml # namespace, nameSuffix, replicas, + │ │ # images(newName+newTag), patch, + │ │ # cmGenerator, secretGenerator + │ ├── deployment-patch.yaml# partial object (strategic merge) + │ ├── config.properties # NOT YAML - key=value env file + │ └── secrets.env # NOT YAML - fake key=value secrets + └── backend/ + ├── base/ + │ ├── deployment.yaml # KRM: Deployment + │ ├── service.yaml # KRM: Service + │ └── kustomization.yaml # kustomize config (not a cluster obj) + └── overlays/ + └── production/ + └── kustomization.yaml # uses a REMOTE base (github.com/...) +``` + +## What makes it structurally distinct +- **Plain desired objects vs. build inputs.** The base `deployment.yaml` and + `service.yaml` are complete, checked-in Kubernetes objects. The + `kustomization.yaml` files, `deployment-patch.yaml` files, `config.properties` + and `secrets.env` are *inputs*: nothing runs them as-is; `kustomize build` + must render the overlay first to get the objects that are actually applied. +- **`kustomization.yaml` looks like KRM but is not a cluster object.** It carries + `apiVersion: kustomize.config.k8s.io/v1beta1` and `kind: Kustomization`, but + the API server never stores an object of that kind — it is build config. +- **Patches are partial objects.** `deployment-patch.yaml` has `apiVersion`, + `kind`, and a `metadata.name`, yet it is intentionally incomplete (no + selector, no full pod template). It is only meaningful merged onto the base. +- **Generator output has a content hash, so it has no single source document.** + `configMapGenerator` and `secretGenerator` emit a `ConfigMap`/`Secret` whose + name gains a hash suffix (e.g. `frontend-config-abc12`) derived from + `config.properties` / `secrets.env`. The rendered object exists only after a + build and its name changes whenever the input file changes. +- **`config.properties` and `secrets.env` are not YAML at all** — plain + `key=value` lines. `secrets.env` holds deliberately fake placeholder values. +- **`namePrefix` / `nameSuffix` mutate object identity.** In staging the base + `frontend` Deployment is applied as `staging-frontend`; in production as + `frontend-prod`. The applied object's `metadata.name` never appears verbatim + in any base file. +- **Namespace is a transform, not a field on the base.** Base objects omit + `metadata.namespace`; the overlay stamps `frontend-staging` / + `frontend-production` / `backend-production` at build time. +- **A remote base lives outside the repository entirely.** + `apps/backend/overlays/production/kustomization.yaml` references + `github.com/example-org/gitops//apps/backend/base?ref=v1.4.0`. That base is not + in this checkout; kustomize fetches it over the network at a pinned ref. + +## Open questions +- Which files could a tool safely edit in place and round-trip? The base + objects have a stable identity, but an overlay's effective object identity is + the product of `namePrefix`/`nameSuffix`/`namespace` — editing the rendered + output has no obvious single home file. +- If a tool observes a running `ConfigMap` named `frontend-config-abc12`, how + would it map that hash-suffixed name back to `config.properties`, and what + does it write when the desired content changes (the hash then changes too)? +- Where does an image bump belong: the base `deployment.yaml` `image:` field, or + the overlay `images:` override? For production the override uses `newName`, so + the running image string appears in *no* base file. +- For `backend` production, the base is remote and pinned to `ref=v1.4.0`. Can a + tool reason about, or edit, desired state it does not have checked out — and is + bumping `ref` the only in-repo change available? +- A strategic-merge patch changes an existing object by field. If a tool wants + to reflect a live change (e.g. a raised memory request), does it edit the base + container spec or the overlay `deployment-patch.yaml`, and how does it decide? +- The staging and production overlays diverge in *which* constructs they use + (staging has no Secret; production repoints the image repository). How would a + tool present "the desired state of frontend" when each environment is a + different transformation of the same base? diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/base/deployment.yaml b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/base/deployment.yaml new file mode 100644 index 00000000..a8d81d4a --- /dev/null +++ b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/base/deployment.yaml @@ -0,0 +1,22 @@ +# Plain checked-in Kubernetes object: the base Deployment. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: backend + labels: + app: backend +spec: + replicas: 2 + selector: + matchLabels: + app: backend + template: + metadata: + labels: + app: backend + spec: + containers: + - name: backend + image: ghcr.io/example-org/backend:2.4.0 + ports: + - containerPort: 9090 diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/base/kustomization.yaml b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/base/kustomization.yaml new file mode 100644 index 00000000..23b5c2bc --- /dev/null +++ b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/base/kustomization.yaml @@ -0,0 +1,6 @@ +# Kustomize build instructions (NOT a cluster object). +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - deployment.yaml + - service.yaml diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/base/service.yaml b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/base/service.yaml new file mode 100644 index 00000000..242a01b1 --- /dev/null +++ b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/base/service.yaml @@ -0,0 +1,13 @@ +# Plain checked-in Kubernetes object: the base Service. +apiVersion: v1 +kind: Service +metadata: + name: backend + labels: + app: backend +spec: + selector: + app: backend + ports: + - port: 80 + targetPort: 9090 diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/overlays/production/kustomization.yaml b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/overlays/production/kustomization.yaml new file mode 100644 index 00000000..9c756a6e --- /dev/null +++ b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/overlays/production/kustomization.yaml @@ -0,0 +1,16 @@ +# Production overlay build instructions (NOT a cluster object). +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + # REMOTE base: this base is NOT in this repository. Kustomize fetches it over + # the network from another repo at a pinned ref. The desired-state inputs for + # this environment therefore live partly outside this checkout entirely. + - github.com/example-org/gitops//apps/backend/base?ref=v1.4.0 +namespace: backend-production +# images: override applied on top of the remotely fetched base. +images: + - name: ghcr.io/example-org/backend + newTag: 2.4.0 +replicas: + - name: backend + count: 3 diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/base/deployment.yaml b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/base/deployment.yaml new file mode 100644 index 00000000..52a5fe67 --- /dev/null +++ b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/base/deployment.yaml @@ -0,0 +1,26 @@ +# Plain checked-in Kubernetes object: the base Deployment. Overlays patch and +# transform this document; they never rewrite it in place. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend + labels: + app: frontend +spec: + replicas: 1 + selector: + matchLabels: + app: frontend + template: + metadata: + labels: + app: frontend + spec: + containers: + - name: frontend + image: ghcr.io/example-org/frontend:1.8.3 + ports: + - containerPort: 8080 + envFrom: + - configMapRef: + name: frontend-config diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/base/kustomization.yaml b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/base/kustomization.yaml new file mode 100644 index 00000000..12f39928 --- /dev/null +++ b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/base/kustomization.yaml @@ -0,0 +1,8 @@ +# This is a kustomization.yaml: a Kustomize config file. It has a Kubernetes-like +# apiVersion/kind but is NOT a cluster object - the API server never stores a +# Kustomization of kind kustomize.config.k8s.io. It is build instructions. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - deployment.yaml + - service.yaml diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/base/service.yaml b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/base/service.yaml new file mode 100644 index 00000000..019f1874 --- /dev/null +++ b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/base/service.yaml @@ -0,0 +1,13 @@ +# Plain checked-in Kubernetes object: the base Service. +apiVersion: v1 +kind: Service +metadata: + name: frontend + labels: + app: frontend +spec: + selector: + app: frontend + ports: + - port: 80 + targetPort: 8080 diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/config.properties b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/config.properties new file mode 100644 index 00000000..348afc12 --- /dev/null +++ b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/config.properties @@ -0,0 +1,4 @@ +# NOT YAML. Plain key=value lines consumed by configMapGenerator envs:. +LOG_LEVEL=info +FEATURE_CHECKOUT_V2=true +API_BASE_URL=https://api.example-org.com diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/deployment-patch.yaml b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/deployment-patch.yaml new file mode 100644 index 00000000..263a9c09 --- /dev/null +++ b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/deployment-patch.yaml @@ -0,0 +1,18 @@ +# Strategic-merge patch (partial object). Merged onto the base Deployment +# "frontend"; production asks for larger resource limits than staging. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend +spec: + template: + spec: + containers: + - name: frontend + resources: + requests: + cpu: 500m + memory: 512Mi + limits: + cpu: "1" + memory: 1Gi diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/kustomization.yaml b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/kustomization.yaml new file mode 100644 index 00000000..b17fdeb9 --- /dev/null +++ b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/kustomization.yaml @@ -0,0 +1,39 @@ +# Production overlay build instructions (NOT a cluster object). +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + # Relative path to the in-repo base. + - ../../base +# namespace: transformation. +namespace: frontend-production +# nameSuffix: mutates object identity - "frontend" becomes "frontend-prod". +nameSuffix: -prod +# replicas: override. +replicas: + - name: frontend + count: 4 +# images: override using BOTH newName and newTag - the image is repointed to a +# different repository and tag than the base. +images: + - name: ghcr.io/example-org/frontend + newName: ghcr.io/example-org/frontend-hardened + newTag: 1.8.3 +# patches: strategic-merge patch changing an existing object. +patches: + - path: deployment-patch.yaml + target: + kind: Deployment + name: frontend +# configMapGenerator: from a non-YAML env file; output name is hash-suffixed. +configMapGenerator: + - name: frontend-config + behavior: create + envs: + - config.properties +# secretGenerator: builds a Secret from a non-YAML env file. Also hash-suffixed, +# and the secret material lives in plain text in secrets.env, not in a manifest. +secretGenerator: + - name: frontend-secrets + type: Opaque + envs: + - secrets.env diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/secrets.env b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/secrets.env new file mode 100644 index 00000000..e8f62748 --- /dev/null +++ b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/secrets.env @@ -0,0 +1,4 @@ +# NOT YAML. Plain key=value lines consumed by secretGenerator envs:. +# Deliberately fake placeholder values - this is a fixture, not real secrets. +DATABASE_PASSWORD=not-a-real-password +SESSION_SIGNING_KEY=not-a-real-key diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/staging/config.properties b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/staging/config.properties new file mode 100644 index 00000000..043ee75a --- /dev/null +++ b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/staging/config.properties @@ -0,0 +1,4 @@ +# NOT YAML. Plain key=value lines consumed by configMapGenerator envs:. +LOG_LEVEL=debug +FEATURE_CHECKOUT_V2=true +API_BASE_URL=https://staging.api.example-org.internal diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/staging/deployment-patch.yaml b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/staging/deployment-patch.yaml new file mode 100644 index 00000000..10b35b6c --- /dev/null +++ b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/staging/deployment-patch.yaml @@ -0,0 +1,16 @@ +# Strategic-merge patch. This is a PARTIAL object, not a full manifest: it only +# carries the fields that change and relies on the base for everything else. +# Merged onto the base Deployment "frontend" by the overlay's patches: entry. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend +spec: + template: + spec: + containers: + - name: frontend + resources: + requests: + cpu: 100m + memory: 128Mi diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/staging/kustomization.yaml b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/staging/kustomization.yaml new file mode 100644 index 00000000..174c568d --- /dev/null +++ b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/staging/kustomization.yaml @@ -0,0 +1,33 @@ +# Staging overlay build instructions (NOT a cluster object). +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + # Relative path to the in-repo base, rendered fresh on every build. + - ../../base +# namespace: transformation - rewrites .metadata.namespace on every object. +namespace: frontend-staging +# namePrefix: mutates object identity - the Deployment "frontend" becomes +# "staging-frontend", and every reference to it is rewritten to match. +namePrefix: staging- +# replicas: override of the base Deployment's replica count. +replicas: + - name: frontend + count: 2 +# images: override - swap the tag on the base image (newTag). +images: + - name: ghcr.io/example-org/frontend + newTag: 1.8.3-rc2 +# patches: strategic-merge patch changing an existing object. +patches: + - path: deployment-patch.yaml + target: + kind: Deployment + name: frontend +# configMapGenerator: builds a ConfigMap from a non-YAML env file. The output +# name gets a content-hash suffix (e.g. frontend-config-abc12), so there is no +# single checked-in document for the generated object. +configMapGenerator: + - name: frontend-config + behavior: create + envs: + - config.properties diff --git a/test/fixtures/gitops-layouts/06-helm-chart/README.md b/test/fixtures/gitops-layouts/06-helm-chart/README.md new file mode 100644 index 00000000..9e6f5600 --- /dev/null +++ b/test/fixtures/gitops-layouts/06-helm-chart/README.md @@ -0,0 +1,91 @@ +# 06-helm-chart + +## What this is +A single, self-contained Helm chart in the canonical directory layout produced +by `helm create` and standardized by the Helm project. This is the most +standards-conforming, least ambiguous packaging format in the whole corpus: the +file names, the `templates/` vs `crds/` split, `Chart.yaml`/`Chart.lock`, +`values.yaml`, and `values.schema.json` all mean specific things defined by +Helm, not by local convention. Charts like this are authored by application +teams and by upstream vendors, published to chart repositories +(`https://charts.bitnami.com/bitnami` and the like), and consumed either +directly with `helm install` or as the source of an Argo CD / Flux application. +The chart here is `frontend`, with a conditional `redis` subchart dependency. + +## Layout +``` +06-helm-chart/ +├── README.md +└── charts/ + └── frontend/ + ├── Chart.yaml # chart metadata + dependencies (NOT a K8s object) + ├── Chart.lock # resolved dependency pins (machine-managed) + ├── values.yaml # default config values (NOT a K8s object) + ├── values.schema.json # JSON Schema for values.yaml + ├── .helmignore # package-time ignore globs + ├── charts/ + │ └── .gitkeep # vendored subchart dir, empty here + ├── crds/ + │ └── widgets.example.com.yaml # plain CRD, Helm treats it specially + └── templates/ + ├── _helpers.tpl # partial library, renders no object itself + ├── deployment.yaml # Helm template, not plain KRM + ├── service.yaml + ├── configmap.yaml + ├── ingress.yaml # whole object gated on ingress.enabled + ├── serviceaccount.yaml + ├── NOTES.txt # plain-text post-install message + └── tests/ + └── test-connection.yaml # Pod behind a helm.sh/hook: test +``` + +## What makes it structurally distinct +- **`templates/*.yaml` is not plain KRM.** Every file under `templates/` is a Go + text/template. As stored, `deployment.yaml` does not parse as a valid + Deployment — `{{ include "frontend.fullname" . }}` and `{{ .Values.* }}` must + be rendered against a merged values set and release context first. You cannot + apply these files with `kubectl apply -f`. +- **`crds/*.yaml` generally IS plain YAML, but Helm treats it specially.** + `crds/widgets.example.com.yaml` is an ordinary + `apiextensions.k8s.io/v1` CustomResourceDefinition with no template actions. + Helm installs everything under `crds/` before the `templates/` resources and + intentionally never templates, upgrades, or deletes it. +- **`values.yaml` is not KRM.** It has no `apiVersion`/`kind`; it is the default + input to the templates, addressable as `.Values`. +- **`values.schema.json` carries useful type information.** It is a draft-07 JSON + Schema constraining `replicaCount`, `image.repository`, `image.tag`, and + `service.port`, with `required` fields — a machine-readable description of what + a valid value override looks like. +- **`Chart.yaml` and `Chart.lock` are metadata, not objects.** There is no + `kind: Chart` in the Kubernetes API. `Chart.lock` is machine-managed and pins + the `redis` dependency to a resolved version and digest. +- **`_helpers.tpl` and `NOTES.txt` render no object.** The `_`-prefixed partial + is a template library included by other files; `NOTES.txt` is plain text shown + after install. Neither becomes a resource. +- **Conditional and looped resources.** `ingress.yaml` is wrapped in + `{{- if .Values.ingress.enabled }}`, so with default values it renders to + nothing. `configmap.yaml` `range`s over `.Values.config`. The set of objects a + release actually contains is decided at render time, not by counting files. +- **A rendered resource does not map back to one template or one value.** + `deployment.yaml` pulls from `image.repository`, `image.tag`, `replicaCount`, + `resources`, `service.targetPort`, the `_helpers.tpl` label partials, and + `Chart.AppVersion`. One value (`service.port`) feeds several objects. The + file-to-object and value-to-field relationships are many-to-many. + +## Open questions +- Should a chart-template folder be rejected outright as un-editable KRM, or + should a tool instead expose only safe values editing (`values.yaml` + constrained by `values.schema.json`) and leave the templates alone? +- If `deployment.yaml` cannot be parsed without rendering, on what basis would a + tool decide it is even a Deployment before a Helm render is performed? +- A rendered object draws from many values and helpers; if an operator wants to + change the effective image tag, is the correct write target `values.yaml`, + `Chart.yaml`'s `appVersion`, or an install-time override — and how would a tool + know which? +- `crds/widgets.example.com.yaml` is appliable as-is while its sibling + `templates/*.yaml` is not. Should the two directories be treated as different + kinds of source entirely? +- `ingress.yaml` renders to nothing under default values. Does a resource that + only conditionally exists belong in an inventory of what the chart manages? +- `Chart.lock` names a `redis` subchart that is not vendored here (`charts/` is + empty). What is the effective object set before `helm dependency update` runs? diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/.helmignore b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/.helmignore new file mode 100644 index 00000000..e2aaa7fb --- /dev/null +++ b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/.helmignore @@ -0,0 +1,15 @@ +# Patterns to ignore when packaging the chart with `helm package`. +# These files never end up inside the .tgz artifact. +.DS_Store +.git/ +.gitignore +.vscode/ +*.tmproj +*.bak +*.orig +*.swp +# CI and editor cruft +.idea/ +.editorconfig +# Test harness scratch +ci/ diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/Chart.lock b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/Chart.lock new file mode 100644 index 00000000..f52bcead --- /dev/null +++ b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/Chart.lock @@ -0,0 +1,9 @@ +# Generated by `helm dependency update`. Pins the resolved version of every +# dependency declared in Chart.yaml plus a digest of the whole dependency set. +# This is machine-managed YAML, not a Kubernetes object. +dependencies: + - name: redis + repository: https://charts.bitnami.com/bitnami + version: 20.6.2 +digest: sha256:3f5a1e6b2c9d4a7f8e0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f +generated: "2026-05-14T09:12:44.517283Z" diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/Chart.yaml b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/Chart.yaml new file mode 100644 index 00000000..7aea7d4e --- /dev/null +++ b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/Chart.yaml @@ -0,0 +1,25 @@ +# Helm chart metadata. This is a well-formed YAML document, but it is a Helm +# Chart.yaml, not a Kubernetes API object (there is no `kind: Chart` in the API). +apiVersion: v2 +name: frontend +description: A Helm chart for the example-org frontend web application. +type: application +version: 1.4.2 +appVersion: "1.8.3" +keywords: + - frontend + - web +home: https://github.com/example-org/gitops +sources: + - https://github.com/example-org/gitops +maintainers: + - name: Platform Team + email: platform@example-org.test +dependencies: + # A real subchart pulled from an external Helm repository. It is only rendered + # when redis.enabled is true, so its presence in the chart does not guarantee + # the resulting release contains any Redis objects. + - name: redis + version: ~20.6.0 + repository: https://charts.bitnami.com/bitnami + condition: redis.enabled diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/charts/.gitkeep b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/charts/.gitkeep new file mode 100644 index 00000000..be53c04a --- /dev/null +++ b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/charts/.gitkeep @@ -0,0 +1,3 @@ +# Placeholder so the vendored-subchart directory exists in git even though no +# dependency .tgz has been fetched here. `helm dependency update` would populate +# this directory with redis-.tgz based on Chart.lock. diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/crds/widgets.example.com.yaml b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/crds/widgets.example.com.yaml new file mode 100644 index 00000000..976d879f --- /dev/null +++ b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/crds/widgets.example.com.yaml @@ -0,0 +1,51 @@ +# A plain, non-templated CustomResourceDefinition. Files under crds/ are NOT +# rendered as Go templates by Helm: `{{ ... }}` here would be emitted literally. +# Helm installs these before the templates/ resources and never upgrades or +# deletes them. This is ordinary Kubernetes YAML that happens to live in a chart. +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: widgets.example.com +spec: + group: example.com + scope: Namespaced + names: + plural: widgets + singular: widget + kind: Widget + shortNames: + - wdg + versions: + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + required: + - size + properties: + size: + type: string + enum: + - small + - medium + - large + color: + type: string + default: blue + status: + type: object + properties: + phase: + type: string + additionalPrinterColumns: + - name: Size + type: string + jsonPath: .spec.size + - name: Age + type: date + jsonPath: .metadata.creationTimestamp diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/NOTES.txt b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/NOTES.txt new file mode 100644 index 00000000..d247e489 --- /dev/null +++ b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/NOTES.txt @@ -0,0 +1,19 @@ +Thank you for installing {{ .Chart.Name }} (version {{ .Chart.Version }}). + +Your release is named {{ .Release.Name }} in namespace {{ .Release.Namespace }}. + +To reach the frontend, run: + + kubectl --namespace {{ .Release.Namespace }} port-forward \ + svc/{{ include "frontend.fullname" . }} 8080:{{ .Values.service.port }} + +{{- if .Values.ingress.enabled }} + +The application is exposed via Ingress at: +{{- range .Values.ingress.hosts }} + http://{{ .host }} +{{- end }} +{{- else }} + +Ingress is disabled. Enable it with `--set ingress.enabled=true`. +{{- end }} diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/_helpers.tpl b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/_helpers.tpl new file mode 100644 index 00000000..7a5730bc --- /dev/null +++ b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/_helpers.tpl @@ -0,0 +1,47 @@ +{{/* +Template helpers for the frontend chart. This file is NOT Kubernetes YAML and +is NOT rendered into an object: files beginning with "_" are treated as partial +libraries and only produce output where they are `include`d elsewhere. +*/}} + +{{/* Base name of the chart, truncated to the 63-char DNS label limit. */}} +{{- define "frontend.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* Fully qualified app name used for most object metadata.name fields. */}} +{{- define "frontend.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* Common labels stamped on every rendered object. */}} +{{- define "frontend.labels" -}} +helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{ include "frontend.selectorLabels" . }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* Selector labels: the stable subset used in spec.selector and matchLabels. */}} +{{- define "frontend.selectorLabels" -}} +app.kubernetes.io/name: {{ include "frontend.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* Name of the ServiceAccount to use. */}} +{{- define "frontend.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "frontend.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/configmap.yaml b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/configmap.yaml new file mode 100644 index 00000000..98edadf6 --- /dev/null +++ b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/configmap.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "frontend.fullname" . }} + labels: + {{- include "frontend.labels" . | nindent 4 }} +data: + {{- range $key, $value := .Values.config }} + {{ $key }}: {{ $value | quote }} + {{- end }} diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/deployment.yaml b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/deployment.yaml new file mode 100644 index 00000000..a02ae5c0 --- /dev/null +++ b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/deployment.yaml @@ -0,0 +1,50 @@ +# A Helm template, NOT plain KRM. As stored this file does not parse as a valid +# Deployment: the {{ ... }} actions must be rendered against .Values first. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "frontend.fullname" . }} + labels: + {{- include "frontend.labels" . | nindent 4 }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + selector: + matchLabels: + {{- include "frontend.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "frontend.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "frontend.serviceAccountName" . }} + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: {{ .Values.service.targetPort }} + protocol: TCP + envFrom: + - configMapRef: + name: {{ include "frontend.fullname" . }} + livenessProbe: + httpGet: + path: /healthz + port: http + readinessProbe: + httpGet: + path: /readyz + port: http + resources: + {{- toYaml .Values.resources | nindent 12 }} diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/ingress.yaml b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/ingress.yaml new file mode 100644 index 00000000..ddabc774 --- /dev/null +++ b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/ingress.yaml @@ -0,0 +1,36 @@ +# The entire object is gated on a value. With the default values.yaml +# (ingress.enabled: false) this template renders to nothing at all, so the +# release contains no Ingress even though the file is present in the chart. +{{- if .Values.ingress.enabled }} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "frontend.fullname" . }} + labels: + {{- include "frontend.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + ingressClassName: {{ .Values.ingress.className }} + {{- with .Values.ingress.tls }} + tls: + {{- toYaml . | nindent 4 }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + pathType: {{ .pathType }} + backend: + service: + name: {{ include "frontend.fullname" $ }} + port: + number: {{ $.Values.service.port }} + {{- end }} + {{- end }} +{{- end }} diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/service.yaml b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/service.yaml new file mode 100644 index 00000000..708b0eda --- /dev/null +++ b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "frontend.fullname" . }} + labels: + {{- include "frontend.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "frontend.selectorLabels" . | nindent 4 }} diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/serviceaccount.yaml b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/serviceaccount.yaml new file mode 100644 index 00000000..63d6eaa6 --- /dev/null +++ b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "frontend.serviceAccountName" . }} + labels: + {{- include "frontend.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/tests/test-connection.yaml b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/tests/test-connection.yaml new file mode 100644 index 00000000..5bc405ba --- /dev/null +++ b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/tests/test-connection.yaml @@ -0,0 +1,21 @@ +# A Helm test hook. Only created when `helm test` runs, not on install/upgrade, +# because of the helm.sh/hook annotation. It is a real Pod once rendered. +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "frontend.fullname" . }}-test-connection" + labels: + {{- include "frontend.labels" . | nindent 4 }} + annotations: + helm.sh/hook: test + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded +spec: + restartPolicy: Never + containers: + - name: wget + image: busybox:1.36 + command: + - wget + args: + - "--spider" + - "{{ include "frontend.fullname" . }}:{{ .Values.service.port }}" diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/values.schema.json b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/values.schema.json new file mode 100644 index 00000000..db60cbb8 --- /dev/null +++ b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/values.schema.json @@ -0,0 +1,52 @@ +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "title": "frontend chart values", + "description": "Schema for the values consumed by the frontend Helm chart.", + "type": "object", + "required": ["replicaCount", "image", "service"], + "additionalProperties": true, + "properties": { + "replicaCount": { + "type": "integer", + "minimum": 1, + "description": "Number of pod replicas when autoscaling is disabled." + }, + "image": { + "type": "object", + "required": ["repository"], + "properties": { + "repository": { + "type": "string", + "description": "Container image repository, without the tag." + }, + "tag": { + "type": "string", + "description": "Image tag; empty string falls back to Chart.appVersion." + }, + "pullPolicy": { + "type": "string", + "enum": ["Always", "IfNotPresent", "Never"] + } + } + }, + "service": { + "type": "object", + "required": ["port"], + "properties": { + "type": { + "type": "string" + }, + "port": { + "type": "integer", + "minimum": 1, + "maximum": 65535 + }, + "targetPort": { + "type": "integer", + "minimum": 1, + "maximum": 65535 + } + } + } + } +} diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/values.yaml b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/values.yaml new file mode 100644 index 00000000..5c16f2b5 --- /dev/null +++ b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/values.yaml @@ -0,0 +1,62 @@ +# Default configuration values for the frontend chart. This file is NOT a +# Kubernetes object: it has no apiVersion/kind. Its keys are consumed by the +# templates as `.Values.*` and can be overridden at install/upgrade time. +replicaCount: 2 + +image: + repository: ghcr.io/example-org/frontend + # Defaults to .Chart.AppVersion (1.8.3) when left empty; see deployment.yaml. + tag: "" + pullPolicy: IfNotPresent + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + create: true + annotations: {} + name: "" + +podAnnotations: {} + +service: + type: ClusterIP + port: 80 + targetPort: 8080 + +ingress: + enabled: false + className: nginx + annotations: {} + hosts: + - host: frontend.example-org.test + paths: + - path: / + pathType: Prefix + tls: [] + +resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 250m + memory: 128Mi + +autoscaling: + enabled: false + minReplicas: 2 + maxReplicas: 5 + targetCPUUtilizationPercentage: 80 + +config: + # Rendered verbatim into a ConfigMap by templates/configmap.yaml. + LOG_LEVEL: info + BACKEND_URL: http://backend + +# Values for the redis subchart. Disabled by default; the Chart.yaml condition +# `redis.enabled` gates whether the subchart renders at all. +redis: + enabled: false + architecture: standalone diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/README.md b/test/fixtures/gitops-layouts/07-helm-environment-values/README.md new file mode 100644 index 00000000..ea649383 --- /dev/null +++ b/test/fixtures/gitops-layouts/07-helm-environment-values/README.md @@ -0,0 +1,82 @@ +# 07-helm-environment-values + +## What this is +One Helm chart deployed to several environments, where each environment is just +a different stack of values files pointed at the same chart. This is the most +common way an application team owns its own chart: the chart lives in the repo +once, shared settings live in a `common.yaml`, and each environment +(`dev`, `production`) contributes a small override file. An Argo CD `Application` +per environment names the chart as its source and lists the value files, in +order, under `spec.source.helm.valueFiles`, optionally pinning a value like the +image tag inline via `helm.parameters`. Nothing here duplicates the chart per +environment — the environments differ only in which values get layered on top. + +## Layout +``` +07-helm-environment-values/ +├── README.md +├── chart/ +│ ├── Chart.yaml # chart metadata (NOT a K8s object) +│ ├── values.yaml # chart defaults, lowest merge layer +│ └── templates/ +│ ├── deployment.yaml # Helm template, not plain KRM +│ └── service.yaml +├── values/ +│ ├── common.yaml # shared overrides (NOT a K8s object) +│ ├── dev.yaml # dev-only overrides (NOT a K8s object) +│ └── production.yaml # prod-only overrides (NOT a K8s object) +└── argocd/ + ├── dev.yaml # Argo CD Application (control-plane object) + └── production.yaml # Argo CD Application (control-plane object) +``` + +## What makes it structurally distinct +- **The effective config is a merge, not a file.** What actually runs in `dev` + is `chart/values.yaml` overlaid by `values/common.yaml`, then + `values/dev.yaml`, then the inline `helm.parameters` entry from + `argocd/dev.yaml`. No single file on disk contains the resolved configuration; + it only exists after Helm merges the layers at render time. +- **Layer order is precedence.** In `valueFiles`, later wins over earlier, and + every file wins over the chart's own `values.yaml`. `helm.parameters` wins over + all of them. The order of the two lines under `valueFiles` is load-bearing. +- **The same key is deliberately set in more than one layer.** `image.tag` + appears in `chart/values.yaml` but is intentionally omitted from the + environment value files and instead pinned inline per environment + (`1.8.3-rc.4` for dev, `1.8.3` for production). `ingress.host` is set in each + environment file; `replicaCount` differs between chart default, dev, and prod. +- **`values/*.yaml` are not Kubernetes objects.** `common.yaml`, `dev.yaml`, and + `production.yaml` have no `apiVersion`/`kind`. They are Helm inputs; only the + chart templates and the Argo CD `Application`s are (or render to) K8s objects. +- **`chart/templates/*.yaml` are not plain KRM.** They only become Deployments + and Services after a render against the merged values, so the replica count and + image reference are not knowable from the template files alone. +- **Two Applications, one chart.** `argocd/dev.yaml` and `argocd/production.yaml` + differ only in which environment file they layer, the inline tag, and the + destination namespace. The environment axis lives entirely in the value stack. + +Two sibling conventions appear in the wild for the same idea and are worth +noting even though they are not laid out as separate directories here. First, +flat `values-dev.yaml` / `values-production.yaml` files sitting directly beside +the chart (rather than in a `values/` subdirectory), which is the shape Helm's +own `-f values-dev.yaml` examples use. Second, a nested `values/` directory +placed *inside* the chart directory itself, so the overrides travel with the +packaged chart. Both encode the same "chart plus per-environment overlay" idea; +they differ only in where the override files sit relative to the chart. + +## Open questions +- When an operator edits an *effective* value (say, the running replica count in + production), which layer should the change be written back to — the chart + default, `common.yaml`, `production.yaml`, or the inline `helm.parameters`? +- If a value is set in more than one layer (as `image.tag` and `replicaCount` + are), how is a tool to know which layer is the intended "home" for a change + versus an incidental override? +- The `valueFiles` paths (`../values/common.yaml`) are relative to the chart and + declared in the `Application`, not in the chart. Given only `chart/` and + `values/`, could a tool reconstruct which files compose each environment? +- The resolved configuration exists only after a Helm merge. Without performing + that merge, what can be said about what `dev` versus `production` actually run? +- Inline `helm.parameters` silently overrides the value files. Should an edit + ever target a value file when an inline parameter for the same key would win? +- The flat `values-dev.yaml` and the in-chart nested `values/` conventions carry + the same intent as this layout — should all three be recognized as the same + pattern, or treated as structurally different sources? diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/argocd/dev.yaml b/test/fixtures/gitops-layouts/07-helm-environment-values/argocd/dev.yaml new file mode 100644 index 00000000..1a36d6c4 --- /dev/null +++ b/test/fixtures/gitops-layouts/07-helm-environment-values/argocd/dev.yaml @@ -0,0 +1,31 @@ +# Argo CD Application for the dev environment. This IS a Kubernetes object (an +# Argo CD control-plane CRD). Its Helm source layers value files in order and +# then applies an inline parameter that wins over all of them. +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: frontend-dev + namespace: argocd +spec: + project: default + source: + repoURL: https://github.com/example-org/gitops.git + targetRevision: main + path: 07-helm-environment-values/chart + helm: + # Applied lowest-to-highest precedence: a later file overrides an earlier + # one, and both override the chart's own values.yaml. + valueFiles: + - ../values/common.yaml + - ../values/dev.yaml + # Inline parameter: highest precedence of all, overrides any value file. + parameters: + - name: image.tag + value: "1.8.3-rc.4" + destination: + server: https://kubernetes.default.svc + namespace: frontend-dev + syncPolicy: + automated: + prune: true + selfHeal: true diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/argocd/production.yaml b/test/fixtures/gitops-layouts/07-helm-environment-values/argocd/production.yaml new file mode 100644 index 00000000..ef17db5d --- /dev/null +++ b/test/fixtures/gitops-layouts/07-helm-environment-values/argocd/production.yaml @@ -0,0 +1,28 @@ +# Argo CD Application for the production environment. Same chart and layering +# shape as dev.yaml, but a different environment values file and a different +# pinned image tag. This IS a Kubernetes object (Argo CD control-plane CRD). +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: frontend-production + namespace: argocd +spec: + project: default + source: + repoURL: https://github.com/example-org/gitops.git + targetRevision: main + path: 07-helm-environment-values/chart + helm: + valueFiles: + - ../values/common.yaml + - ../values/production.yaml + parameters: + - name: image.tag + value: "1.8.3" + destination: + server: https://kubernetes.default.svc + namespace: frontend-production + syncPolicy: + automated: + prune: true + selfHeal: true diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/chart/Chart.yaml b/test/fixtures/gitops-layouts/07-helm-environment-values/chart/Chart.yaml new file mode 100644 index 00000000..468b48f0 --- /dev/null +++ b/test/fixtures/gitops-layouts/07-helm-environment-values/chart/Chart.yaml @@ -0,0 +1,7 @@ +# Helm chart metadata. Not a Kubernetes object (there is no `kind: Chart`). +apiVersion: v2 +name: frontend +description: Application-owned frontend chart, deployed per environment via layered values. +type: application +version: 1.4.2 +appVersion: "1.8.3" diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/chart/templates/deployment.yaml b/test/fixtures/gitops-layouts/07-helm-environment-values/chart/templates/deployment.yaml new file mode 100644 index 00000000..fbf5199e --- /dev/null +++ b/test/fixtures/gitops-layouts/07-helm-environment-values/chart/templates/deployment.yaml @@ -0,0 +1,31 @@ +# Helm template, not plain KRM. Values are resolved from the merged layers at +# render time, so the replicas and image tag here are not knowable from this +# file alone. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Release.Name }}-frontend + labels: + app.kubernetes.io/name: frontend + app.kubernetes.io/instance: {{ .Release.Name }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app.kubernetes.io/name: frontend + app.kubernetes.io/instance: {{ .Release.Name }} + template: + metadata: + labels: + app.kubernetes.io/name: frontend + app.kubernetes.io/instance: {{ .Release.Name }} + spec: + containers: + - name: frontend + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: {{ .Values.service.targetPort }} + resources: + {{- toYaml .Values.resources | nindent 12 }} diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/chart/templates/service.yaml b/test/fixtures/gitops-layouts/07-helm-environment-values/chart/templates/service.yaml new file mode 100644 index 00000000..75c8b7ec --- /dev/null +++ b/test/fixtures/gitops-layouts/07-helm-environment-values/chart/templates/service.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ .Release.Name }}-frontend + labels: + app.kubernetes.io/name: frontend + app.kubernetes.io/instance: {{ .Release.Name }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + app.kubernetes.io/name: frontend + app.kubernetes.io/instance: {{ .Release.Name }} diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/chart/values.yaml b/test/fixtures/gitops-layouts/07-helm-environment-values/chart/values.yaml new file mode 100644 index 00000000..577c4a31 --- /dev/null +++ b/test/fixtures/gitops-layouts/07-helm-environment-values/chart/values.yaml @@ -0,0 +1,26 @@ +# Chart defaults. NOT a Kubernetes object. These are the lowest layer of the +# merge: values/common.yaml, then values/.yaml, then inline Argo CD +# helm.parameters each override keys on top of what is defined here. +replicaCount: 1 + +image: + repository: ghcr.io/example-org/frontend + tag: "1.8.3" + pullPolicy: IfNotPresent + +service: + type: ClusterIP + port: 80 + targetPort: 8080 + +resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 250m + memory: 128Mi + +ingress: + enabled: false + host: frontend.example-org.test diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/values/common.yaml b/test/fixtures/gitops-layouts/07-helm-environment-values/values/common.yaml new file mode 100644 index 00000000..af28a013 --- /dev/null +++ b/test/fixtures/gitops-layouts/07-helm-environment-values/values/common.yaml @@ -0,0 +1,14 @@ +# Shared value overrides applied to EVERY environment. This is NOT a Kubernetes +# object; it is a Helm values file, layered on top of the chart's own +# values.yaml and below the per-environment file. +image: + repository: ghcr.io/example-org/frontend + pullPolicy: IfNotPresent + +service: + type: ClusterIP + port: 80 + targetPort: 8080 + +ingress: + enabled: true diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/values/dev.yaml b/test/fixtures/gitops-layouts/07-helm-environment-values/values/dev.yaml new file mode 100644 index 00000000..c3f7d63a --- /dev/null +++ b/test/fixtures/gitops-layouts/07-helm-environment-values/values/dev.yaml @@ -0,0 +1,15 @@ +# Dev-only overrides. NOT a Kubernetes object. Overrides a subset of keys on top +# of common.yaml. Note image.tag is intentionally omitted here: the Argo CD +# Application for dev sets it inline via helm.parameters instead. +replicaCount: 1 + +resources: + requests: + cpu: 25m + memory: 32Mi + limits: + cpu: 100m + memory: 64Mi + +ingress: + host: dev.frontend.example-org.test diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/values/production.yaml b/test/fixtures/gitops-layouts/07-helm-environment-values/values/production.yaml new file mode 100644 index 00000000..fde201d4 --- /dev/null +++ b/test/fixtures/gitops-layouts/07-helm-environment-values/values/production.yaml @@ -0,0 +1,16 @@ +# Production-only overrides. NOT a Kubernetes object. Overrides a subset of keys +# on top of common.yaml. image.tag is deliberately omitted; the production +# Argo CD Application pins it inline via helm.parameters so image promotion is a +# one-line change in one place. +replicaCount: 4 + +resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 500m + memory: 256Mi + +ingress: + host: frontend.example-org.test diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/README.md b/test/fixtures/gitops-layouts/08-argocd-external-helm/README.md new file mode 100644 index 00000000..ed0ec04c --- /dev/null +++ b/test/fixtures/gitops-layouts/08-argocd-external-helm/README.md @@ -0,0 +1,106 @@ +# 08-argocd-external-helm + +## What this is + +The most common way platform teams install third-party add-ons with Argo CD: the +chart itself lives in an **external Helm or OCI registry** (upstream projects such +as ingress-nginx, cert-manager, and external-dns), and the Git repo holds almost +none of the rendered Kubernetes manifests. Instead the repo carries only Argo CD +`Application` resources that point at the remote chart, the chart version to pin, +the value overrides, and the occasional plain manifest that has to sit alongside +the chart (a custom ConfigMap, an Ingress, a ClusterIssuer). + +This shape is what you get by following the Argo CD docs for Helm charts and the +"apps repo vs. chart repo" separation. Argo CD uses Helm purely to *render* the +chart into manifests; Argo CD itself — not Helm's `helm install` — then owns the +apply/prune/heal lifecycle of the resulting objects. The repo is therefore a mix +of Argo CD configuration, Helm inputs, and a small tail of real KRM. + +This fixture also deliberately shows the **three different ways an Application can +carry values**, plus a co-located "hybrid folder" that mixes all the natures in +one directory. + +## Layout + +``` +08-argocd-external-helm/ +├── README.md +├── applications/ +│ ├── ingress-nginx.yaml # multi-source Application, valueFiles via $values ref +│ ├── cert-manager.yaml # single source, inline helm.values (a YAML string) +│ └── external-dns.yaml # single source, helm.valuesObject (structured mapping) +├── values/ +│ ├── ingress-nginx/ +│ │ ├── common.yaml # Helm values -- NOT a Kubernetes object +│ │ └── production.yaml # Helm values -- NOT a Kubernetes object +│ ├── cert-manager/ +│ │ └── production.yaml # Helm values -- NOT a Kubernetes object (unreferenced) +│ └── external-dns/ +│ └── production.yaml # Helm values -- NOT a Kubernetes object (unreferenced) +├── extras/ +│ └── ingress-nginx/ +│ └── middleware.yaml # plain KRM: ConfigMap + Ingress (multi-document) +└── platform/ + └── cert-manager/ + ├── application.yaml # an Argo CD Application (multi-source) + ├── values.yaml # Helm values -- NOT a Kubernetes object + └── clusterissuer.yaml # plain KRM (cert-manager.io/v1 ClusterIssuer) +``` + +## What makes it structurally distinct + +- **Most of the deployed resources are never in Git.** The Deployments, Services, + and CRDs that actually run come from the remote chart; the repo only pins a + `chart:` name and `targetRevision:` and layers value overrides on top. +- **Five files are YAML but NOT Kubernetes objects.** Every file under `values/` + (`values/ingress-nginx/common.yaml`, `values/ingress-nginx/production.yaml`, + `values/cert-manager/production.yaml`, `values/external-dns/production.yaml`) and + `platform/cert-manager/values.yaml` are Helm value inputs: they have no + `apiVersion` and no `kind`. They look like manifests to a naive YAML scan but are + not KRM. +- **Values appear in four physically different forms across the fixture:** as + external files referenced by a `$values` ref (`applications/ingress-nginx.yaml`), + as an inline YAML string in `helm.values` (`applications/cert-manager.yaml`), as a + structured `helm.valuesObject` mapping (`applications/external-dns.yaml`), and as a + co-located file consumed via `$values` (`platform/cert-manager/`). +- **The `$values` ref source has no chart and no path.** In the multi-source + Applications, the second source exists only to expose this repo's value files to + the first source; on its own it deploys nothing. +- **`extras/ingress-nginx/middleware.yaml` is real KRM and multi-document** — a `v1` + ConfigMap of NGINX snippet config and a `networking.k8s.io/v1` Ingress default + backend in one file — sitting next to a chart it is not part of. +- **`values/cert-manager/production.yaml` and `values/external-dns/production.yaml` + are present but unreferenced:** their matching Applications carry values inline + instead, so these files are inputs that no Application currently points at. +- **`platform/cert-manager/` is the hybrid folder — the most representative + real-world shape in this fixture.** One directory holds three files of three + different natures side by side: an Argo CD `Application` (Argo CD configuration), + a `values.yaml` (Helm input, not KRM), and a `clusterissuer.yaml` (plain + `cert-manager.io/v1` KRM). The ClusterIssuer additionally depends on CRDs that the + chart the Application installs must create first. +- **The cert-manager chart is modeled twice.** `applications/cert-manager.yaml` and + `platform/cert-manager/application.yaml` both install the cert-manager chart and + both use `metadata.name: cert-manager` — one flat, one co-located. + +## Open questions + +- How should a folder like `platform/cert-manager/`, whose three files have three + different natures (Argo CD config, Helm values, plain KRM), be classified — as a + KRM directory, an Argo CD app source, or none of these? +- Without the chart available locally, what schema validates a value file — how + would a reader know `controller.replicaCount` or `installCRDs` is meaningful, or + catch a typo, when the keys are only defined by a remote chart's `values.yaml`? +- Are `values/cert-manager/production.yaml` and `values/external-dns/production.yaml` + dead configuration, or are they consumed by something outside this repo — and how + would a scanner tell the difference from structure alone? +- Two Applications install the cert-manager chart under the same `metadata.name`: + is `platform/cert-manager/` an alternative to the flat `applications/` layout that + you would pick between, or would both be reconciled into the same namespace? +- What is the `$values` ref source (no chart, no path) "deploying", and how should a + reader that walks sources reason about a source whose only job is to carry files? +- Does `platform/cert-manager/clusterissuer.yaml` belong to the Application in the + same folder, or is a separate directory-source Application expected to apply it — + and if so, would that source also try to apply `application.yaml` and `values.yaml`? +- In `extras/ingress-nginx/middleware.yaml`, what applies the two objects if the + Application only renders the remote chart — is a directory source expected to pick + up this file, and how is its relationship to the chart expressed anywhere? diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/applications/cert-manager.yaml b/test/fixtures/gitops-layouts/08-argocd-external-helm/applications/cert-manager.yaml new file mode 100644 index 00000000..f8b99b36 --- /dev/null +++ b/test/fixtures/gitops-layouts/08-argocd-external-helm/applications/cert-manager.yaml @@ -0,0 +1,35 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cert-manager + namespace: argocd +spec: + project: default + # Single source. Values are carried inline as `helm.values`: a YAML document + # embedded as a plain string inside this Kubernetes object. + source: + repoURL: https://charts.jetstack.io + chart: cert-manager + targetRevision: v1.16.2 + helm: + values: | + installCRDs: true + replicaCount: 2 + global: + leaderElection: + namespace: cert-manager + prometheus: + enabled: true + resources: + requests: + cpu: 25m + memory: 64Mi + destination: + server: https://kubernetes.default.svc + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/applications/external-dns.yaml b/test/fixtures/gitops-layouts/08-argocd-external-helm/applications/external-dns.yaml new file mode 100644 index 00000000..0f3be3eb --- /dev/null +++ b/test/fixtures/gitops-layouts/08-argocd-external-helm/applications/external-dns.yaml @@ -0,0 +1,38 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-dns + namespace: argocd +spec: + project: default + # Single source. Values are carried as `helm.valuesObject`: a structured + # mapping (not a string), so ordinary YAML tooling can parse them in place. + source: + repoURL: https://kubernetes-sigs.github.io/external-dns + chart: external-dns + targetRevision: 1.15.0 + helm: + valuesObject: + provider: aws + policy: sync + registry: txt + txtOwnerId: example-org + domainFilters: + - example-org.com + - internal.example-org.com + sources: + - service + - ingress + serviceAccount: + create: true + annotations: + eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/external-dns + destination: + server: https://kubernetes.default.svc + namespace: external-dns + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/applications/ingress-nginx.yaml b/test/fixtures/gitops-layouts/08-argocd-external-helm/applications/ingress-nginx.yaml new file mode 100644 index 00000000..75b2b3d1 --- /dev/null +++ b/test/fixtures/gitops-layouts/08-argocd-external-helm/applications/ingress-nginx.yaml @@ -0,0 +1,31 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: ingress-nginx + namespace: argocd +spec: + project: default + # Multiple sources: the chart is pulled from the upstream Helm repo, while the + # value files are read from this Git repo via the `$values` ref below. + sources: + - repoURL: https://kubernetes.github.io/ingress-nginx + chart: ingress-nginx + targetRevision: 4.11.3 + helm: + valueFiles: + - $values/values/ingress-nginx/common.yaml + - $values/values/ingress-nginx/production.yaml + # This source carries no chart and no path; it exists only so the value + # files above can be resolved through the `values` ref. + - repoURL: https://github.com/example-org/gitops.git + targetRevision: main + ref: values + destination: + server: https://kubernetes.default.svc + namespace: ingress-nginx + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/extras/ingress-nginx/middleware.yaml b/test/fixtures/gitops-layouts/08-argocd-external-helm/extras/ingress-nginx/middleware.yaml new file mode 100644 index 00000000..478b3753 --- /dev/null +++ b/test/fixtures/gitops-layouts/08-argocd-external-helm/extras/ingress-nginx/middleware.yaml @@ -0,0 +1,35 @@ +# Plain Kubernetes manifests that accompany the ingress-nginx chart. +# Unlike everything under values/, both documents below ARE Kubernetes objects +# (they have apiVersion + kind). This is a multi-document file. +apiVersion: v1 +kind: ConfigMap +metadata: + name: ingress-nginx-custom-snippets + namespace: ingress-nginx + labels: + app.kubernetes.io/part-of: ingress-nginx +data: + # Injected into the NGINX http{} block via the controller's main-snippet key. + custom-headers.conf: | + more_set_headers "X-Content-Type-Options: nosniff"; + more_set_headers "X-Frame-Options: SAMEORIGIN"; + more_set_headers "Referrer-Policy: strict-origin-when-cross-origin"; +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: default-backend + namespace: ingress-nginx + annotations: + nginx.ingress.kubernetes.io/server-snippet: | + location = /healthz { + return 200 'ok'; + } +spec: + ingressClassName: nginx + # A catch-all Ingress that routes anything unmatched to a maintenance backend. + defaultBackend: + service: + name: default-http-backend + port: + number: 80 diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/platform/cert-manager/application.yaml b/test/fixtures/gitops-layouts/08-argocd-external-helm/platform/cert-manager/application.yaml new file mode 100644 index 00000000..92d80329 --- /dev/null +++ b/test/fixtures/gitops-layouts/08-argocd-external-helm/platform/cert-manager/application.yaml @@ -0,0 +1,28 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cert-manager + namespace: argocd +spec: + project: default + # Multi-source: the chart comes from the upstream Helm repo, and the value file + # is the values.yaml sitting next to this Application in the same folder. + sources: + - repoURL: https://charts.jetstack.io + chart: cert-manager + targetRevision: v1.16.2 + helm: + valueFiles: + - $values/platform/cert-manager/values.yaml + - repoURL: https://github.com/example-org/gitops.git + targetRevision: main + ref: values + destination: + server: https://kubernetes.default.svc + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/platform/cert-manager/clusterissuer.yaml b/test/fixtures/gitops-layouts/08-argocd-external-helm/platform/cert-manager/clusterissuer.yaml new file mode 100644 index 00000000..7e5e9f9d --- /dev/null +++ b/test/fixtures/gitops-layouts/08-argocd-external-helm/platform/cert-manager/clusterissuer.yaml @@ -0,0 +1,18 @@ +# Plain Kubernetes manifest (cert-manager.io/v1 ClusterIssuer) co-located with the +# Application and the Helm values in this folder. This one file IS a Kubernetes +# object -- but it depends on CRDs the cert-manager chart installs first. +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-production +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: platform-team@example-org.com + privateKeySecretRef: + name: letsencrypt-production-account-key + solvers: + - dns01: + route53: + region: us-east-1 + hostedZoneID: Z0123456789ABCDEFGHIJ diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/platform/cert-manager/values.yaml b/test/fixtures/gitops-layouts/08-argocd-external-helm/platform/cert-manager/values.yaml new file mode 100644 index 00000000..f7b8418c --- /dev/null +++ b/test/fixtures/gitops-layouts/08-argocd-external-helm/platform/cert-manager/values.yaml @@ -0,0 +1,17 @@ +# Helm values for the cert-manager chart -- NOT a Kubernetes object. +# Consumed by the co-located application.yaml through the `$values` valueFiles ref. +# It sits in the same folder as an Application and a ClusterIssuer, yet it is +# neither an Argo CD resource nor a Kubernetes object. +installCRDs: true +replicaCount: 2 +prometheus: + enabled: true +webhook: + replicaCount: 2 +resources: + requests: + cpu: 50m + memory: 128Mi +extraArgs: + - --dns01-recursive-nameservers-only + - --dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53 diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/values/cert-manager/production.yaml b/test/fixtures/gitops-layouts/08-argocd-external-helm/values/cert-manager/production.yaml new file mode 100644 index 00000000..1c2e1a29 --- /dev/null +++ b/test/fixtures/gitops-layouts/08-argocd-external-helm/values/cert-manager/production.yaml @@ -0,0 +1,13 @@ +# Helm values for the cert-manager chart (production overlay) -- NOT a Kubernetes object. +# Present in the repo but not referenced by applications/cert-manager.yaml, which +# instead carries its values inline. Rendered by Helm when a chart consumes it. +installCRDs: true +replicaCount: 2 +prometheus: + enabled: true +webhook: + replicaCount: 2 +resources: + requests: + cpu: 50m + memory: 128Mi diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/values/external-dns/production.yaml b/test/fixtures/gitops-layouts/08-argocd-external-helm/values/external-dns/production.yaml new file mode 100644 index 00000000..b40dd08a --- /dev/null +++ b/test/fixtures/gitops-layouts/08-argocd-external-helm/values/external-dns/production.yaml @@ -0,0 +1,12 @@ +# Helm values for the external-dns chart (production overlay) -- NOT a Kubernetes object. +# Present in the repo but not referenced by applications/external-dns.yaml, which +# instead carries its values inline as valuesObject. Rendered by Helm. +provider: aws +policy: sync +registry: txt +txtOwnerId: example-org +domainFilters: + - example-org.com +sources: + - service + - ingress diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/values/ingress-nginx/common.yaml b/test/fixtures/gitops-layouts/08-argocd-external-helm/values/ingress-nginx/common.yaml new file mode 100644 index 00000000..f3ef6be8 --- /dev/null +++ b/test/fixtures/gitops-layouts/08-argocd-external-helm/values/ingress-nginx/common.yaml @@ -0,0 +1,18 @@ +# Helm values for the ingress-nginx chart -- NOT a Kubernetes object. +# Rendered by Argo CD via Helm; this file has no apiVersion or kind of its own. +# Merged first; production.yaml overlays the environment-specific settings. +controller: + replicaCount: 2 + ingressClassResource: + name: nginx + default: true + admissionWebhooks: + enabled: true + metrics: + enabled: true + serviceMonitor: + enabled: true + config: + use-forwarded-headers: "true" + proxy-body-size: 16m + ssl-redirect: "true" diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/values/ingress-nginx/production.yaml b/test/fixtures/gitops-layouts/08-argocd-external-helm/values/ingress-nginx/production.yaml new file mode 100644 index 00000000..0eb2e6f6 --- /dev/null +++ b/test/fixtures/gitops-layouts/08-argocd-external-helm/values/ingress-nginx/production.yaml @@ -0,0 +1,21 @@ +# Helm values for the ingress-nginx chart (production overlay) -- NOT a Kubernetes object. +# Rendered by Argo CD via Helm; there is no apiVersion or kind here. +controller: + replicaCount: 4 + service: + type: LoadBalancer + annotations: + service.beta.kubernetes.io/aws-load-balancer-type: nlb + service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true" + resources: + requests: + cpu: 200m + memory: 256Mi + limits: + cpu: "1" + memory: 512Mi + autoscaling: + enabled: true + minReplicas: 4 + maxReplicas: 12 + targetCPUUtilizationPercentage: 70 diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/README.md b/test/fixtures/gitops-layouts/09-flux-monorepo/README.md new file mode 100644 index 00000000..995fe53d --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/README.md @@ -0,0 +1,112 @@ +# 09-flux-monorepo + +## What this is +The canonical Flux CD layout promoted in the Flux documentation and the upstream +`fluxcd/flux2-kustomize-helm-example` repository. A single Git monorepo drives +one or more clusters. Work is split three ways: `apps/` holds the workloads (a +Kustomize base plus per-environment overlays), `infrastructure/` holds the +platform pieces every app depends on (ingress controller, cert-manager issuers), +and `clusters//` holds the per-cluster entry points that Flux +reconciles. `flux bootstrap` writes the `clusters//flux-system/` +directory (the `gotk-*` files) into the repo and commits it; everything else is +authored by humans. This shape is what most teams inherit when they adopt Flux +"the documented way," and it scales from one cluster to many by adding another +`clusters//` directory. + +## Layout +``` +09-flux-monorepo/ +├── README.md +├── apps/ +│ ├── base/ +│ │ └── frontend/ +│ │ ├── deployment.yaml +│ │ ├── service.yaml +│ │ └── kustomization.yaml # kustomize.config.k8s.io (build file) +│ ├── staging/ +│ │ ├── frontend-patch.yaml # partial Deployment (patch) +│ │ └── kustomization.yaml # kustomize.config.k8s.io overlay +│ └── production/ +│ ├── frontend-patch.yaml # partial Deployment (patch) +│ └── kustomization.yaml # kustomize.config.k8s.io overlay +├── infrastructure/ +│ ├── controllers/ +│ │ ├── ingress-nginx.yaml # HelmRepository + HelmRelease +│ │ └── kustomization.yaml # kustomize.config.k8s.io (build file) +│ └── configs/ +│ ├── cluster-issuers.yaml # cert-manager ClusterIssuer +│ └── kustomization.yaml # kustomize.config.k8s.io (build file) +└── clusters/ + ├── staging/ + │ ├── flux-system/ # written by `flux bootstrap` + │ │ ├── gotk-components.yaml # TRUNCATED (~35k lines in reality) + │ │ ├── gotk-sync.yaml # GitRepository + root Kustomization CR + │ │ └── kustomization.yaml # kustomize.config.k8s.io (build file) + │ ├── apps.yaml # Flux Kustomization CR (NOT a build file) + │ ├── infrastructure.yaml # Flux Kustomization CRs (NOT build files) + │ └── kustomization.yaml # kustomize.config.k8s.io (build file) + └── production/ + ├── flux-system/ + │ ├── gotk-components.yaml # TRUNCATED (~35k lines in reality) + │ ├── gotk-sync.yaml # GitRepository + root Kustomization CR + │ └── kustomization.yaml # kustomize.config.k8s.io (build file) + ├── apps.yaml # Flux Kustomization CR (NOT a build file) + ├── infrastructure.yaml # Flux Kustomization CRs (NOT build files) + └── kustomization.yaml # kustomize.config.k8s.io (build file) +``` + +## What makes it structurally distinct +- **Two unrelated kinds share the word "Kustomization."** Every file literally + named `kustomization.yaml` is a `kustomize.config.k8s.io/v1beta1` Kustomization: + a *build instruction* that `kustomize`/the kustomize-controller reads to render + manifests. The API server never stores one. By contrast, `clusters/*/apps.yaml` + and `clusters/*/infrastructure.yaml` contain + `kustomize.toolkit.fluxcd.io/v1` Kustomizations: *custom resources* the API + server stores and the kustomize-controller reconciles. Same word, different + `apiVersion`, different lifecycle, different filename convention. The Flux CR is + never in a file called `kustomization.yaml`, and the build file is never named + `apps.yaml`. +- **`clusters//flux-system/` is the strongest Flux fingerprint.** The + trio `gotk-components.yaml`, `gotk-sync.yaml`, `kustomization.yaml` with the + `# This file is generated by flux bootstrap. DO NOT EDIT.` header is written by + `flux bootstrap` and appears in no other tool's layout. `gotk-sync.yaml` + contains the `GitRepository`/`Kustomization` pair named `flux-system` whose + `path` points back at this same cluster directory — the reconciliation loop's + root. +- **`apps/` vs `infrastructure/` is a reconciliation-ordering split, not just + tidiness.** The Flux Kustomization for `apps` sets `dependsOn: [infrastructure]` + and the one for `infra-configs` sets `dependsOn: [infrastructure]`, so + controllers (ingress-nginx, cert-manager CRDs) reconcile and pass their + `healthChecks` before configs and before any application object is applied. The + directory boundary encodes an ordering guarantee. +- **The cluster root is a Kustomization listing Kustomizations.** + `clusters/production/kustomization.yaml` is a build file whose `resources` are + the `flux-system/` dir plus `apps.yaml` and `infrastructure.yaml` — which are + themselves Flux Kustomization CRs. The collision appears inside a single file. +- **`gotk-components.yaml` is truncated here.** The real file is ~35,000 lines of + CRDs, RBAC and controller Deployments. This fixture keeps one `Namespace` and + one `source-controller` Deployment as representatives. +- **Files that are YAML but NOT Kubernetes objects:** every `kustomization.yaml` + (all seven of them) is a kustomize build file, not a stored API object. The + `frontend-patch.yaml` overlays are partial Deployments — real `apiVersion`/ + `kind`, but incomplete documents that only mean anything after a merge. + +## Open questions +- Given only a file's contents, how does a tool tell a + `kustomize.toolkit.fluxcd.io` Kustomization apart from a + `kustomize.config.k8s.io` one — is the `apiVersion` string the only reliable + signal, and does the filename ever help or only mislead? +- Is a cluster root (`clusters/production/`) ever an editing target, given that + everything in it either points elsewhere (`path:`) or was machine-generated by + bootstrap? +- When `apps.yaml` sets `targetNamespace: production`, the namespace of the + applied objects is decided in `clusters/`, not in `apps/`. Can you know an + app's destination namespace by reading only `apps/production/`? +- `apps.yaml` `dependsOn` `infrastructure`, whose readiness is gated by a + `healthChecks` entry pointing at a HelmRelease in another directory. Can a tool + reason about a single directory's desired state without following those + cross-directory dependency and health edges? +- The `flux-system/` GitRepository points `url` at + `https://github.com/example-org/gitops.git` and `path` back at this cluster + directory. If you only have the checked-out files, how do you know which + directory is a reconciliation root versus a plain library of manifests? diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/apps/base/frontend/deployment.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/apps/base/frontend/deployment.yaml new file mode 100644 index 00000000..57e66e17 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/apps/base/frontend/deployment.yaml @@ -0,0 +1,28 @@ +# Plain checked-in Kubernetes object: the base Deployment for the frontend app. +# The per-cluster overlays under apps/staging and apps/production patch this +# document; they never rewrite it in place. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend + labels: + app: frontend +spec: + replicas: 1 + selector: + matchLabels: + app: frontend + template: + metadata: + labels: + app: frontend + spec: + containers: + - name: frontend + image: ghcr.io/example-org/frontend:1.8.3 + ports: + - containerPort: 8080 + resources: + requests: + cpu: 50m + memory: 64Mi diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/apps/base/frontend/kustomization.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/apps/base/frontend/kustomization.yaml new file mode 100644 index 00000000..548a42c8 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/apps/base/frontend/kustomization.yaml @@ -0,0 +1,8 @@ +# This is a kustomization.yaml: a Kustomize build file (kustomize.config.k8s.io), +# NOT a cluster object. The API server never stores a Kustomization of this kind. +# Do not confuse it with the Flux Kustomization CRs in clusters/*/apps.yaml. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - deployment.yaml + - service.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/apps/base/frontend/service.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/apps/base/frontend/service.yaml new file mode 100644 index 00000000..113b4dde --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/apps/base/frontend/service.yaml @@ -0,0 +1,13 @@ +# Plain checked-in Kubernetes object: the base Service for the frontend app. +apiVersion: v1 +kind: Service +metadata: + name: frontend + labels: + app: frontend +spec: + selector: + app: frontend + ports: + - port: 80 + targetPort: 8080 diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/apps/production/frontend-patch.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/apps/production/frontend-patch.yaml new file mode 100644 index 00000000..d5d929d8 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/apps/production/frontend-patch.yaml @@ -0,0 +1,17 @@ +# Strategic-merge patch: a PARTIAL object, not a full manifest. It carries only +# the fields that differ in production and relies on the base for everything else. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend +spec: + replicas: 4 + template: + spec: + containers: + - name: frontend + image: ghcr.io/example-org/frontend:1.8.3 + resources: + requests: + cpu: 200m + memory: 256Mi diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/apps/production/kustomization.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/apps/production/kustomization.yaml new file mode 100644 index 00000000..042646ed --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/apps/production/kustomization.yaml @@ -0,0 +1,12 @@ +# Kustomize build file (kustomize.config.k8s.io), NOT a cluster object. +# This is the production overlay: it renders ../base/frontend and patches it. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: production +resources: + - ../base/frontend +patches: + - path: frontend-patch.yaml + target: + kind: Deployment + name: frontend diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/apps/staging/frontend-patch.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/apps/staging/frontend-patch.yaml new file mode 100644 index 00000000..42d81ef9 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/apps/staging/frontend-patch.yaml @@ -0,0 +1,16 @@ +# Strategic-merge patch: a PARTIAL object, not a full manifest. It carries only +# the fields that differ in staging and relies on the base for everything else. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend +spec: + replicas: 2 + template: + spec: + containers: + - name: frontend + image: ghcr.io/example-org/frontend:1.8.3 + env: + - name: LOG_LEVEL + value: debug diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/apps/staging/kustomization.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/apps/staging/kustomization.yaml new file mode 100644 index 00000000..239b994e --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/apps/staging/kustomization.yaml @@ -0,0 +1,12 @@ +# Kustomize build file (kustomize.config.k8s.io), NOT a cluster object. +# This is the staging overlay: it renders ../base/frontend and patches it. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: staging +resources: + - ../base/frontend +patches: + - path: frontend-patch.yaml + target: + kind: Deployment + name: frontend diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/apps.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/apps.yaml new file mode 100644 index 00000000..73d5f1b5 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/apps.yaml @@ -0,0 +1,25 @@ +# COLLISION WARNING: despite the file being named apps.yaml (and NOT +# kustomization.yaml), the object below is a Flux Kustomization CUSTOM RESOURCE +# (kustomize.toolkit.fluxcd.io/v1) that the API server stores and the +# kustomize-controller reconciles. It is NOT the same kind as the +# kustomize.config.k8s.io/v1beta1 kustomization.yaml build files elsewhere in +# this repo. This CR points the controller at the ./apps/production directory, +# which is where the real kustomize.config.k8s.io Kustomization lives. +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: apps + namespace: flux-system +spec: + # apps reconcile only after infrastructure is Ready: controllers before apps. + dependsOn: + - name: infrastructure + interval: 10m + retryInterval: 1m + timeout: 5m + sourceRef: + kind: GitRepository + name: flux-system + path: ./apps/production + prune: true + targetNamespace: production diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/flux-system/gotk-components.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/flux-system/gotk-components.yaml new file mode 100644 index 00000000..681ccb07 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/flux-system/gotk-components.yaml @@ -0,0 +1,49 @@ +# This file is generated by flux bootstrap. DO NOT EDIT. +# --------------------------------------------------------------------------- +# TRUNCATED FOR THIS FIXTURE. The real gotk-components.yaml is ~35,000 lines: +# every Flux CRD (GitRepository, Kustomization, HelmRelease, ...), the RBAC +# (ServiceAccounts, ClusterRoles, ClusterRoleBindings) and the controller +# Deployments (source-controller, kustomize-controller, helm-controller, +# notification-controller). Only two representative objects are kept below so +# the fixture stays readable. +# --------------------------------------------------------------------------- +apiVersion: v1 +kind: Namespace +metadata: + name: flux-system + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + pod-security.kubernetes.io/warn: restricted +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: source-controller + namespace: flux-system + labels: + app.kubernetes.io/component: source-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + control-plane: controller +spec: + replicas: 1 + selector: + matchLabels: + app: source-controller + template: + metadata: + labels: + app: source-controller + spec: + serviceAccountName: source-controller + containers: + - name: manager + image: ghcr.io/fluxcd/source-controller:v1.4.1 + ports: + - name: http + containerPort: 9090 + resources: + requests: + cpu: 50m + memory: 64Mi diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/flux-system/gotk-sync.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/flux-system/gotk-sync.yaml new file mode 100644 index 00000000..671fdfb4 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/flux-system/gotk-sync.yaml @@ -0,0 +1,28 @@ +# This file is generated by flux bootstrap. DO NOT EDIT. +# It defines the repository Flux syncs from and the root Kustomization that +# reconciles this cluster's directory. Both ARE cluster objects. +apiVersion: source.toolkit.fluxcd.io/v1 +kind: GitRepository +metadata: + name: flux-system + namespace: flux-system +spec: + interval: 1m0s + ref: + branch: main + secretRef: + name: flux-system + url: https://github.com/example-org/gitops.git +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: flux-system + namespace: flux-system +spec: + interval: 10m0s + path: ./clusters/production + prune: true + sourceRef: + kind: GitRepository + name: flux-system diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/flux-system/kustomization.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/flux-system/kustomization.yaml new file mode 100644 index 00000000..3f214d61 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/flux-system/kustomization.yaml @@ -0,0 +1,7 @@ +# Kustomize build file (kustomize.config.k8s.io), NOT a cluster object. Written +# by flux bootstrap to bundle the two generated files into the flux-system dir. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - gotk-components.yaml + - gotk-sync.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/infrastructure.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/infrastructure.yaml new file mode 100644 index 00000000..a4068698 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/infrastructure.yaml @@ -0,0 +1,43 @@ +# COLLISION WARNING: the file is named infrastructure.yaml, but the objects below +# are Flux Kustomization CUSTOM RESOURCES (kustomize.toolkit.fluxcd.io/v1), not +# kustomize.config.k8s.io build files. Two of them, in one multi-doc file. +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: infrastructure + namespace: flux-system +spec: + interval: 1h + retryInterval: 1m + timeout: 5m + sourceRef: + kind: GitRepository + name: flux-system + path: ./infrastructure/controllers + prune: true + wait: true + # healthChecks gate readiness on a specific applied object before dependents + # (apps, infra-configs) are allowed to reconcile. + healthChecks: + - apiVersion: helm.toolkit.fluxcd.io/v2 + kind: HelmRelease + name: ingress-nginx + namespace: ingress-nginx +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: infra-configs + namespace: flux-system +spec: + # cluster-issuers need the cert-manager CRDs from the controllers layer first. + dependsOn: + - name: infrastructure + interval: 1h + retryInterval: 1m + timeout: 5m + sourceRef: + kind: GitRepository + name: flux-system + path: ./infrastructure/configs + prune: true diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/kustomization.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/kustomization.yaml new file mode 100644 index 00000000..bdcab605 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/kustomization.yaml @@ -0,0 +1,12 @@ +# Kustomize build file (kustomize.config.k8s.io), NOT a cluster object. This is +# the cluster ROOT that the flux-system Kustomization (in gotk-sync.yaml) points +# its path at. Its resources are themselves Flux Kustomization CRs (apps.yaml, +# infrastructure.yaml) plus the bootstrap flux-system/ dir - the collision in +# one file: a kustomize.config.k8s.io Kustomization listing +# kustomize.toolkit.fluxcd.io Kustomizations. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - flux-system + - infrastructure.yaml + - apps.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/apps.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/apps.yaml new file mode 100644 index 00000000..1c312d10 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/apps.yaml @@ -0,0 +1,21 @@ +# COLLISION WARNING: named apps.yaml, but this is a Flux Kustomization CUSTOM +# RESOURCE (kustomize.toolkit.fluxcd.io/v1), not a kustomize.config.k8s.io build +# file. It points the kustomize-controller at ./apps/staging. +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: apps + namespace: flux-system +spec: + # apps reconcile only after infrastructure is Ready: controllers before apps. + dependsOn: + - name: infrastructure + interval: 10m + retryInterval: 1m + timeout: 5m + sourceRef: + kind: GitRepository + name: flux-system + path: ./apps/staging + prune: true + targetNamespace: staging diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/flux-system/gotk-components.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/flux-system/gotk-components.yaml new file mode 100644 index 00000000..681ccb07 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/flux-system/gotk-components.yaml @@ -0,0 +1,49 @@ +# This file is generated by flux bootstrap. DO NOT EDIT. +# --------------------------------------------------------------------------- +# TRUNCATED FOR THIS FIXTURE. The real gotk-components.yaml is ~35,000 lines: +# every Flux CRD (GitRepository, Kustomization, HelmRelease, ...), the RBAC +# (ServiceAccounts, ClusterRoles, ClusterRoleBindings) and the controller +# Deployments (source-controller, kustomize-controller, helm-controller, +# notification-controller). Only two representative objects are kept below so +# the fixture stays readable. +# --------------------------------------------------------------------------- +apiVersion: v1 +kind: Namespace +metadata: + name: flux-system + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + pod-security.kubernetes.io/warn: restricted +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: source-controller + namespace: flux-system + labels: + app.kubernetes.io/component: source-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + control-plane: controller +spec: + replicas: 1 + selector: + matchLabels: + app: source-controller + template: + metadata: + labels: + app: source-controller + spec: + serviceAccountName: source-controller + containers: + - name: manager + image: ghcr.io/fluxcd/source-controller:v1.4.1 + ports: + - name: http + containerPort: 9090 + resources: + requests: + cpu: 50m + memory: 64Mi diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/flux-system/gotk-sync.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/flux-system/gotk-sync.yaml new file mode 100644 index 00000000..5e4f1845 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/flux-system/gotk-sync.yaml @@ -0,0 +1,28 @@ +# This file is generated by flux bootstrap. DO NOT EDIT. +# It defines the repository Flux syncs from and the root Kustomization that +# reconciles this cluster's directory. Both ARE cluster objects. +apiVersion: source.toolkit.fluxcd.io/v1 +kind: GitRepository +metadata: + name: flux-system + namespace: flux-system +spec: + interval: 1m0s + ref: + branch: main + secretRef: + name: flux-system + url: https://github.com/example-org/gitops.git +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: flux-system + namespace: flux-system +spec: + interval: 10m0s + path: ./clusters/staging + prune: true + sourceRef: + kind: GitRepository + name: flux-system diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/flux-system/kustomization.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/flux-system/kustomization.yaml new file mode 100644 index 00000000..3f214d61 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/flux-system/kustomization.yaml @@ -0,0 +1,7 @@ +# Kustomize build file (kustomize.config.k8s.io), NOT a cluster object. Written +# by flux bootstrap to bundle the two generated files into the flux-system dir. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - gotk-components.yaml + - gotk-sync.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/infrastructure.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/infrastructure.yaml new file mode 100644 index 00000000..d5f43f99 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/infrastructure.yaml @@ -0,0 +1,42 @@ +# COLLISION WARNING: named infrastructure.yaml, but these are Flux Kustomization +# CUSTOM RESOURCES (kustomize.toolkit.fluxcd.io/v1), not kustomize.config.k8s.io +# build files. Two of them, in one multi-doc file. +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: infrastructure + namespace: flux-system +spec: + interval: 1h + retryInterval: 1m + timeout: 5m + sourceRef: + kind: GitRepository + name: flux-system + path: ./infrastructure/controllers + prune: true + wait: true + # healthChecks gate readiness on a specific applied object before dependents. + healthChecks: + - apiVersion: helm.toolkit.fluxcd.io/v2 + kind: HelmRelease + name: ingress-nginx + namespace: ingress-nginx +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: infra-configs + namespace: flux-system +spec: + # cluster-issuers need the cert-manager CRDs from the controllers layer first. + dependsOn: + - name: infrastructure + interval: 1h + retryInterval: 1m + timeout: 5m + sourceRef: + kind: GitRepository + name: flux-system + path: ./infrastructure/configs + prune: true diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/kustomization.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/kustomization.yaml new file mode 100644 index 00000000..30c42013 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/kustomization.yaml @@ -0,0 +1,9 @@ +# Kustomize build file (kustomize.config.k8s.io), NOT a cluster object. The +# staging cluster ROOT that the flux-system Kustomization points its path at. +# Its resources are themselves Flux Kustomization CRs plus the bootstrap dir. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - flux-system + - infrastructure.yaml + - apps.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/configs/cluster-issuers.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/configs/cluster-issuers.yaml new file mode 100644 index 00000000..9bb24821 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/configs/cluster-issuers.yaml @@ -0,0 +1,17 @@ +# A cert-manager ClusterIssuer: a real cluster-scoped custom resource. It depends +# on the cert-manager CRDs installed by the controllers layer, which is why the +# Flux Kustomization for configs dependsOn the one for controllers. +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-production +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: platform@example-org.dev + privateKeySecretRef: + name: letsencrypt-production-account-key + solvers: + - http01: + ingress: + class: nginx diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/configs/kustomization.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/configs/kustomization.yaml new file mode 100644 index 00000000..efefa7b7 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/configs/kustomization.yaml @@ -0,0 +1,5 @@ +# Kustomize build file (kustomize.config.k8s.io), NOT a cluster object. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - cluster-issuers.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/controllers/ingress-nginx.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/controllers/ingress-nginx.yaml new file mode 100644 index 00000000..5fce80dc --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/controllers/ingress-nginx.yaml @@ -0,0 +1,33 @@ +# Multi-doc file: a Flux HelmRepository source plus the HelmRelease that installs +# from it. Both ARE cluster objects (unlike the kustomization.yaml files). +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: ingress-nginx + namespace: flux-system +spec: + interval: 1h + url: https://kubernetes.github.io/ingress-nginx +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: ingress-nginx + namespace: ingress-nginx +spec: + interval: 30m + chart: + spec: + chart: ingress-nginx + version: 4.11.3 + sourceRef: + kind: HelmRepository + name: ingress-nginx + namespace: flux-system + install: + createNamespace: true + values: + controller: + replicaCount: 2 + service: + type: LoadBalancer diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/controllers/kustomization.yaml b/test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/controllers/kustomization.yaml new file mode 100644 index 00000000..f2a6fac2 --- /dev/null +++ b/test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/controllers/kustomization.yaml @@ -0,0 +1,6 @@ +# Kustomize build file (kustomize.config.k8s.io), NOT a cluster object. +# Aggregates the controller sources/releases that must reconcile before apps. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ingress-nginx.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/README.md b/test/fixtures/gitops-layouts/10-flux-helmrelease/README.md new file mode 100644 index 00000000..a157c4f0 --- /dev/null +++ b/test/fixtures/gitops-layouts/10-flux-helmrelease/README.md @@ -0,0 +1,100 @@ +# 10-flux-helmrelease + +## What this is +Flux CD installing Helm charts the GitOps way: instead of running `helm install`, +you commit a `HelmRepository`/`OCIRepository` (the chart source) and a +`HelmRelease` (the desired release), and the helm-controller reconciles them. +This is how most Flux users run third-party charts (ingress-nginx, cert-manager, +Prometheus) and their own charts. The interesting part is not the release itself +but where its *values* come from: Flux can assemble a HelmRelease's values from +inline YAML, from ConfigMaps, from Secrets, from a single spliced scalar, and +from ConfigMaps that kustomize generates out of plain values files. This fixture +puts all five in one tree, and then adds a Flux Kustomization that rewrites the +result from outside the app folder. + +## Layout +``` +10-flux-helmrelease/ +├── README.md +├── infrastructure/ +│ ├── sources/ +│ │ ├── repositories.yaml # HelmRepository x2 (http + oci) + OCIRepository +│ │ └── kustomization.yaml # kustomize.config.k8s.io (build file) +│ └── controllers/ +│ └── ingress-nginx/ +│ ├── helmrelease.yaml # values mechanisms 1-4 +│ ├── values-configmap.yaml # ConfigMaps backing mechanisms 2 and 4 +│ └── kustomization.yaml # kustomize.config.k8s.io (build file) +├── apps/ +│ └── frontend/ +│ ├── helmrelease.yaml # values mechanism 5 (generated ConfigMap) +│ ├── values.yaml # plain Helm values - NOT a k8s object +│ └── kustomization.yaml # configMapGenerator turns values.yaml into one +└── clusters/ + └── production/ + ├── flux-system/ # written by `flux bootstrap` + │ ├── gotk-components.yaml # TRUNCATED (~35k lines in reality) + │ ├── gotk-sync.yaml # GitRepository + root Kustomization CR + │ └── kustomization.yaml # kustomize.config.k8s.io (build file) + ├── infrastructure.yaml # Flux Kustomization CRs (NOT build files) + ├── apps.yaml # Flux Kustomization CR w/ postBuild + targetNamespace + └── kustomization.yaml # kustomize.config.k8s.io (build file) +``` + +## What makes it structurally distinct +- **Five ways values reach a HelmRelease.** The desired state of a Helm release + is not one document; it is a merge chain: + 1. **inline `spec.values`** — checked straight into `ingress-nginx/helmrelease.yaml`. + 2. **`spec.valuesFrom` → ConfigMap** — a whole values document under one + `values.yaml` key in `values-configmap.yaml`. + 3. **`spec.valuesFrom` → Secret** — sensitive values from a Secret that is + created out of band and intentionally **not committed** to this repo. + 4. **`spec.valuesFrom` with `valuesKey` + `targetPath`** — a single scalar + (`replicas: "3"`) spliced into `controller.replicaCount`, overriding what an + earlier ConfigMap set. + 5. **generated ConfigMap** — `apps/frontend/values.yaml` is a plain Helm values + file (no `apiVersion`, no `kind`) that a `configMapGenerator` in + `apps/frontend/kustomization.yaml` turns into the `frontend-values` + ConfigMap the frontend HelmRelease consumes. One file that is *not* a + Kubernetes object becomes one. + Ordering matters: later `valuesFrom` entries win, so the effective values can + differ from any single source file. +- **Three source kinds, deliberately side by side.** `repositories.yaml` holds a + classic HTTP `HelmRepository`, a `type: oci` `HelmRepository`, and an + `OCIRepository`. They are not interchangeable: the HTTP/oci HelmRepository + selects a chart in the HelmRelease's `chart` block, while the OCIRepository + pins one artifact and is referenced through `spec.chartRef`. +- **`clusters/production/apps.yaml` rewrites the app folder from outside it.** It + is a Flux Kustomization CR (not a build file) that sets `targetNamespace: + production` — deciding where every rendered object lands — and + `postBuild.substitute`/`substituteFrom`, which expand `${var}` tokens (like the + `${cluster_domain}` left unresolved in `apps/frontend/values.yaml`) *after* + kustomize build. The transform is declared in `clusters/`, the tokens live in + `apps/`, and the `cluster-vars`/`cluster-secret-vars` inputs are created out of + band and never committed. +- **Files that are YAML but NOT Kubernetes objects:** every `kustomization.yaml` + (a kustomize build file) and `apps/frontend/values.yaml` (a Helm values file + that only becomes a ConfigMap after generation). `gotk-components.yaml` is + truncated here from its real ~35,000 lines. +- **Things referenced but absent on purpose:** the `ingress-nginx-secret-values` + Secret (mechanism 3) and the `cluster-vars`/`cluster-secret-vars` substitution + inputs. The tree does not contain everything the release depends on. + +## Open questions +- If the effective values are a merge of inline YAML, two ConfigMaps, a Secret, + and a scalar splice — with later entries overriding earlier ones — what is the + "desired values" of the release, and can any single file in the repo be said to + hold it? +- `apps/frontend/values.yaml` is not a Kubernetes object until a + `configMapGenerator` runs. Reading the folder statically, how would a tool know + that this file becomes the ConfigMap the HelmRelease names? +- `clusters/production/apps.yaml` injects `targetNamespace` and rewrites + `${cluster_domain}` via `postBuild`. What does `apps/frontend/`'s "desired + state" even mean when a transform declared in another directory changes the + namespace and the rendered content? +- Two of the inputs (a Secret and the `cluster-vars` ConfigMap) are created out + of band and never committed. Can a repo-only view ever reconstruct what the + cluster will actually receive? +- Mechanism 3's Secret is `optional: true` and mechanism 4 overrides mechanism + 2's `replicaCount`. Does the checked-in YAML tell you the final value, or only + the rules for computing it once cluster state is known? diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/apps/frontend/helmrelease.yaml b/test/fixtures/gitops-layouts/10-flux-helmrelease/apps/frontend/helmrelease.yaml new file mode 100644 index 00000000..773b6903 --- /dev/null +++ b/test/fixtures/gitops-layouts/10-flux-helmrelease/apps/frontend/helmrelease.yaml @@ -0,0 +1,24 @@ +# HelmRelease for the frontend app, installed from the podinfo chart pinned by +# the OCIRepository in infrastructure/sources (referenced via spec.chartRef). +# No metadata.namespace is set on purpose: the Flux Kustomization in +# clusters/production/apps.yaml injects targetNamespace, so where this object +# (and its values ConfigMap) land is decided OUTSIDE this folder. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend +spec: + interval: 15m + releaseName: frontend + chartRef: + kind: OCIRepository + name: podinfo + namespace: flux-system + valuesFrom: + # MECHANISM 5: consume a ConfigMap that does NOT exist as a checked-in + # object. apps/frontend/kustomization.yaml's configMapGenerator builds + # frontend-values from the plain values.yaml file next to it. That values + # file is not a Kubernetes object until kustomize turns it into one. + - kind: ConfigMap + name: frontend-values + valuesKey: values.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/apps/frontend/kustomization.yaml b/test/fixtures/gitops-layouts/10-flux-helmrelease/apps/frontend/kustomization.yaml new file mode 100644 index 00000000..55257a25 --- /dev/null +++ b/test/fixtures/gitops-layouts/10-flux-helmrelease/apps/frontend/kustomization.yaml @@ -0,0 +1,15 @@ +# Kustomize build file (kustomize.config.k8s.io), NOT a cluster object. It turns +# a non-object (values.yaml) INTO an object (a ConfigMap) via configMapGenerator. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helmrelease.yaml +configMapGenerator: + # Builds ConfigMap "frontend-values" from the plain values.yaml file. The + # HelmRelease references it by that exact name, so the content-hash name + # suffix is disabled - otherwise the generated name would not match. + - name: frontend-values + files: + - values.yaml +generatorOptions: + disableNameSuffixHash: true diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/apps/frontend/values.yaml b/test/fixtures/gitops-layouts/10-flux-helmrelease/apps/frontend/values.yaml new file mode 100644 index 00000000..db55a7de --- /dev/null +++ b/test/fixtures/gitops-layouts/10-flux-helmrelease/apps/frontend/values.yaml @@ -0,0 +1,24 @@ +# Plain Helm values file. On its own it is NOT a Kubernetes object: no +# apiVersion, no kind. It becomes the data of a ConfigMap only after the +# configMapGenerator in kustomization.yaml processes it. +# +# The ingress host below is deliberately left as an unresolved ${cluster_domain} +# token. It is NOT valid until the Flux Kustomization in +# clusters/production/apps.yaml rewrites it via postBuild.substitute - a +# transform declared in a different directory entirely. +image: + repository: ghcr.io/example-org/frontend + tag: 1.8.3 +replicaCount: 3 +ingress: + enabled: true + className: nginx + hosts: + - host: frontend.${cluster_domain} + paths: + - path: / + pathType: Prefix +resources: + requests: + cpu: 50m + memory: 64Mi diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/apps.yaml b/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/apps.yaml new file mode 100644 index 00000000..b22f3698 --- /dev/null +++ b/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/apps.yaml @@ -0,0 +1,39 @@ +# COLLISION WARNING: named apps.yaml, but this is a Flux Kustomization CUSTOM +# RESOURCE (kustomize.toolkit.fluxcd.io/v1), not a kustomize.config.k8s.io build +# file. It reconciles the ./apps/frontend directory - AND rewrites the result. +# +# OUT-OF-BAND TRANSFORM: this CR injects configuration the app folder never +# declares. targetNamespace decides where every rendered object lands, and +# postBuild.substitute / substituteFrom expand ${var} tokens (e.g. the +# ${cluster_domain} in apps/frontend/values.yaml) AFTER kustomize build. The +# folder's rendered desired state therefore depends on values defined here. +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: apps + namespace: flux-system +spec: + dependsOn: + - name: infra-sources + interval: 10m + retryInterval: 1m + timeout: 5m + sourceRef: + kind: GitRepository + name: flux-system + path: ./apps/frontend + prune: true + targetNamespace: production + postBuild: + # Inline variables spliced into every ${var} token in the build output. + substitute: + cluster_env: production + cluster_domain: prod.example-org.dev + # Additional variables merged from objects created out of band (NOT in this + # repo): a ConfigMap and a Secret in flux-system. + substituteFrom: + - kind: ConfigMap + name: cluster-vars + - kind: Secret + name: cluster-secret-vars + optional: true diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/flux-system/gotk-components.yaml b/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/flux-system/gotk-components.yaml new file mode 100644 index 00000000..36578e5b --- /dev/null +++ b/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/flux-system/gotk-components.yaml @@ -0,0 +1,49 @@ +# This file is generated by flux bootstrap. DO NOT EDIT. +# --------------------------------------------------------------------------- +# TRUNCATED FOR THIS FIXTURE. The real gotk-components.yaml is ~35,000 lines: +# every Flux CRD (GitRepository, HelmRepository, OCIRepository, HelmRelease, +# Kustomization, ...), the RBAC (ServiceAccounts, ClusterRoles, +# ClusterRoleBindings) and the controller Deployments (source-controller, +# kustomize-controller, helm-controller, notification-controller). Only two +# representative objects are kept below so the fixture stays readable. +# --------------------------------------------------------------------------- +apiVersion: v1 +kind: Namespace +metadata: + name: flux-system + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + pod-security.kubernetes.io/warn: restricted +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: helm-controller + namespace: flux-system + labels: + app.kubernetes.io/component: helm-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + control-plane: controller +spec: + replicas: 1 + selector: + matchLabels: + app: helm-controller + template: + metadata: + labels: + app: helm-controller + spec: + serviceAccountName: helm-controller + containers: + - name: manager + image: ghcr.io/fluxcd/helm-controller:v1.1.0 + ports: + - name: http-prom + containerPort: 8080 + resources: + requests: + cpu: 100m + memory: 64Mi diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/flux-system/gotk-sync.yaml b/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/flux-system/gotk-sync.yaml new file mode 100644 index 00000000..671fdfb4 --- /dev/null +++ b/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/flux-system/gotk-sync.yaml @@ -0,0 +1,28 @@ +# This file is generated by flux bootstrap. DO NOT EDIT. +# It defines the repository Flux syncs from and the root Kustomization that +# reconciles this cluster's directory. Both ARE cluster objects. +apiVersion: source.toolkit.fluxcd.io/v1 +kind: GitRepository +metadata: + name: flux-system + namespace: flux-system +spec: + interval: 1m0s + ref: + branch: main + secretRef: + name: flux-system + url: https://github.com/example-org/gitops.git +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: flux-system + namespace: flux-system +spec: + interval: 10m0s + path: ./clusters/production + prune: true + sourceRef: + kind: GitRepository + name: flux-system diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/flux-system/kustomization.yaml b/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/flux-system/kustomization.yaml new file mode 100644 index 00000000..3f214d61 --- /dev/null +++ b/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/flux-system/kustomization.yaml @@ -0,0 +1,7 @@ +# Kustomize build file (kustomize.config.k8s.io), NOT a cluster object. Written +# by flux bootstrap to bundle the two generated files into the flux-system dir. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - gotk-components.yaml + - gotk-sync.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/infrastructure.yaml b/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/infrastructure.yaml new file mode 100644 index 00000000..ae1cd516 --- /dev/null +++ b/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/infrastructure.yaml @@ -0,0 +1,41 @@ +# COLLISION WARNING: named infrastructure.yaml, but these are Flux Kustomization +# CUSTOM RESOURCES (kustomize.toolkit.fluxcd.io/v1), not kustomize.config.k8s.io +# build files. Sources must exist before the HelmReleases that reference them. +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: infra-sources + namespace: flux-system +spec: + interval: 1h + retryInterval: 1m + timeout: 5m + sourceRef: + kind: GitRepository + name: flux-system + path: ./infrastructure/sources + prune: true +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: infra-controllers + namespace: flux-system +spec: + # HelmReleases need their HelmRepository/OCIRepository sources to exist first. + dependsOn: + - name: infra-sources + interval: 1h + retryInterval: 1m + timeout: 5m + sourceRef: + kind: GitRepository + name: flux-system + path: ./infrastructure/controllers + prune: true + wait: true + healthChecks: + - apiVersion: helm.toolkit.fluxcd.io/v2 + kind: HelmRelease + name: ingress-nginx + namespace: flux-system diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/kustomization.yaml b/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/kustomization.yaml new file mode 100644 index 00000000..96fe1469 --- /dev/null +++ b/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/kustomization.yaml @@ -0,0 +1,9 @@ +# Kustomize build file (kustomize.config.k8s.io), NOT a cluster object. The +# cluster ROOT that the flux-system Kustomization (gotk-sync.yaml) points at. +# Its resources are themselves Flux Kustomization CRs plus the bootstrap dir. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - flux-system + - infrastructure.yaml + - apps.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/controllers/ingress-nginx/helmrelease.yaml b/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/controllers/ingress-nginx/helmrelease.yaml new file mode 100644 index 00000000..c664d37d --- /dev/null +++ b/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/controllers/ingress-nginx/helmrelease.yaml @@ -0,0 +1,49 @@ +# HelmRelease for ingress-nginx. It lives in flux-system but deploys the chart +# INTO the ingress-nginx namespace (spec.targetNamespace). This one HelmRelease +# demonstrates four of the five value-delivery mechanisms in this fixture. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: ingress-nginx + namespace: flux-system +spec: + interval: 30m + releaseName: ingress-nginx + targetNamespace: ingress-nginx + storageNamespace: ingress-nginx + chart: + spec: + chart: ingress-nginx + version: 4.11.3 + sourceRef: + kind: HelmRepository + name: ingress-nginx + namespace: flux-system + install: + createNamespace: true + # MECHANISM 1: inline values, checked straight into this file. + values: + controller: + service: + type: LoadBalancer + metrics: + enabled: true + valuesFrom: + # MECHANISM 2: merge a whole values document from a ConfigMap in this folder + # (values-configmap.yaml). Later entries win over spec.values above. + - kind: ConfigMap + name: ingress-nginx-values + valuesKey: values.yaml + # MECHANISM 3: merge sensitive values from a Secret created OUT OF BAND. The + # Secret is intentionally NOT committed to this repo (see README); optional + # keeps reconciliation from failing before an operator/SOPS creates it. + - kind: Secret + name: ingress-nginx-secret-values + valuesKey: values.yaml + optional: true + # MECHANISM 4: splice a SINGLE scalar. Take the raw string at .data.replicas + # in the ConfigMap and write it into spec.values at controller.replicaCount. + - kind: ConfigMap + name: ingress-nginx-tuning + valuesKey: replicas + targetPath: controller.replicaCount diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/controllers/ingress-nginx/kustomization.yaml b/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/controllers/ingress-nginx/kustomization.yaml new file mode 100644 index 00000000..72636f38 --- /dev/null +++ b/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/controllers/ingress-nginx/kustomization.yaml @@ -0,0 +1,6 @@ +# Kustomize build file (kustomize.config.k8s.io), NOT a cluster object. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helmrelease.yaml + - values-configmap.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/controllers/ingress-nginx/values-configmap.yaml b/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/controllers/ingress-nginx/values-configmap.yaml new file mode 100644 index 00000000..5c862969 --- /dev/null +++ b/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/controllers/ingress-nginx/values-configmap.yaml @@ -0,0 +1,31 @@ +# Two ConfigMaps consumed by the ingress-nginx HelmRelease's valuesFrom. These +# ARE cluster objects. Note the two shapes of value delivery they back: +# +# ingress-nginx-values carries a WHOLE Helm values document under a single +# values.yaml key (a YAML string), merged by valuesFrom mechanism 2. +apiVersion: v1 +kind: ConfigMap +metadata: + name: ingress-nginx-values + namespace: flux-system +data: + values.yaml: | + controller: + replicaCount: 2 + resources: + requests: + cpu: 100m + memory: 128Mi + admissionWebhooks: + enabled: true +--- +# ingress-nginx-tuning carries a single SCALAR under the replicas key, spliced +# to controller.replicaCount by valuesFrom mechanism 4 (valuesKey + targetPath). +# It overrides the replicaCount that ingress-nginx-values set above. +apiVersion: v1 +kind: ConfigMap +metadata: + name: ingress-nginx-tuning + namespace: flux-system +data: + replicas: "3" diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/sources/kustomization.yaml b/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/sources/kustomization.yaml new file mode 100644 index 00000000..eec205fe --- /dev/null +++ b/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/sources/kustomization.yaml @@ -0,0 +1,5 @@ +# Kustomize build file (kustomize.config.k8s.io), NOT a cluster object. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - repositories.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/sources/repositories.yaml b/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/sources/repositories.yaml new file mode 100644 index 00000000..c361fe39 --- /dev/null +++ b/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/sources/repositories.yaml @@ -0,0 +1,39 @@ +# Multi-doc file holding three DIFFERENT chart-source kinds. All are cluster +# objects in the flux-system namespace; a HelmRelease points its chart at one. +# +# (a) A classic Helm HTTP index repository. +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: ingress-nginx + namespace: flux-system +spec: + interval: 1h + url: https://kubernetes.github.io/ingress-nginx +--- +# (b) A HelmRepository in OCI mode: same kind as (a) but type: oci, so the URL is +# an oci:// registry namespace and the chart is chosen in the HelmRelease's +# chart block. Present here as an alternative source; not consumed in this +# fixture (frontend uses the OCIRepository below instead). +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: podinfo + namespace: flux-system +spec: + interval: 1h + type: oci + url: oci://ghcr.io/stefanprodan/charts +--- +# (c) An OCIRepository: a DIFFERENT kind that pins one chart artifact by tag. +# The frontend HelmRelease references this via spec.chartRef. +apiVersion: source.toolkit.fluxcd.io/v1 +kind: OCIRepository +metadata: + name: podinfo + namespace: flux-system +spec: + interval: 10m + url: oci://ghcr.io/stefanprodan/charts/podinfo + ref: + tag: 6.7.1 diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/README.md b/test/fixtures/gitops-layouts/11-repo-per-environment/README.md new file mode 100644 index 00000000..a983b656 --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/README.md @@ -0,0 +1,86 @@ +# 11-repo-per-environment + +## What this is +A layout where the environment boundary is a **repository** boundary rather than a +directory boundary. Instead of one repo with `dev/`, `staging/`, and `production/` +folders, each environment gets its own independent Git repository, frequently with +its own access control (e.g. only the SRE team can push to the production repo). +This is common in regulated organisations and in setups where promotion is a +cross-repo pull request or a mirror/sync job rather than a merge inside one repo. + +Because the three repositories are genuinely separate, the same application path +(`apps/frontend/`) exists three times, in three repos, with **no shared base in Git**. +There is no `base/` or common overlay anywhere; each repo carries a full, standalone +copy of every manifest. + +## Layout +``` +11-repo-per-environment/ +├── README.md # this file — explains the simulation +├── gitops-dev/ # stands in for a whole repository +│ ├── .gitignore +│ ├── apps/ +│ │ ├── frontend/ +│ │ │ ├── deployment.yaml +│ │ │ └── service.yaml +│ │ └── backend/ +│ │ ├── deployment.yaml +│ │ └── service.yaml +│ └── namespaces.yaml +├── gitops-staging/ # stands in for a second, separate repository +│ ├── .gitignore +│ ├── apps/ +│ │ ├── frontend/ +│ │ │ ├── deployment.yaml +│ │ │ └── service.yaml +│ │ └── backend/ +│ │ ├── deployment.yaml +│ │ └── service.yaml +│ └── namespaces.yaml +└── gitops-production/ # stands in for a third, separate repository + ├── .gitignore + ├── apps/ + │ ├── frontend/ + │ │ ├── deployment.yaml + │ │ ├── service.yaml + │ │ └── hpa.yaml # production-only object, no counterpart elsewhere + │ └── backend/ + │ ├── deployment.yaml + │ └── service.yaml + └── namespaces.yaml +``` + +## What makes it structurally distinct +- **The three top-level directories stand in for three independent Git repositories.** + They are nested inside this one folder only for convenience in this corpus. In the + real world you would `git clone` each of `gitops-dev`, `gitops-staging`, and + `gitops-production` separately; they would have unrelated commit histories and + potentially different owners and permissions. +- Each simulated repo carries its own `.gitignore` at its root so that it reads as a + repository root rather than as a subdirectory of a larger repo. The `.gitignore` + files are the only files here that are **not** Kubernetes objects. +- The three repos are **structurally identical but textually divergent**: the same + file paths in each repo, but different image tags (`frontend:1.8.1` in dev, + `1.8.2` in staging, `1.8.3` in production; `backend:2.3.8` / `2.3.9` / `2.4.0`), + different `replicas`, different resource requests, and different namespace names + (`frontend-dev` / `frontend-staging` / `frontend-production`). +- `gitops-production` additionally contains an `autoscaling/v2` HorizontalPodAutoscaler + (`apps/frontend/hpa.yaml`) with **no counterpart** in dev or staging. This is drift + that is intentional, not accidental. +- There is no shared base, kustomization, or common overlay anywhere in the corpus. + Every manifest is a complete standalone copy. + +## Open questions +- What does "promotion" mean here when moving a change from dev to staging to + production crosses a repository boundary rather than a directory boundary? +- With no shared base to edit, where does an operator make a change that is meant to + apply identically to a single environment — and how is that change kept consistent + with the two other repos it was copied from? +- If an edit should apply to **all three** environments at once (say, a new + security-context field on `frontend`), which repo is the source of truth, and how is + the same edit fanned out to three repos with three separate histories? +- Is the production-only HorizontalPodAutoscaler considered part of the desired state + of "frontend", or an environment-specific addition that intentionally has no peer? +- When the same logical object exists three times with divergent field values, which + copy — if any — is authoritative for a question like "what is frontend's replica + count"? diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/.gitignore b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/.gitignore new file mode 100644 index 00000000..6b4e7098 --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/.gitignore @@ -0,0 +1,6 @@ +# This file marks gitops-dev/ as a standalone repository root. +# In the real world this directory would be cloned as its own Git repository, +# with its own history and its own access control, separate from staging/production. +.env +*.tmp +.DS_Store diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/backend/deployment.yaml b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/backend/deployment.yaml new file mode 100644 index 00000000..93f5499a --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/backend/deployment.yaml @@ -0,0 +1,31 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: backend + namespace: backend-dev + labels: + app.kubernetes.io/name: backend + app.kubernetes.io/part-of: storefront +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: backend + template: + metadata: + labels: + app.kubernetes.io/name: backend + spec: + containers: + - name: backend + image: ghcr.io/example-org/backend:2.3.8 + ports: + - name: grpc + containerPort: 9090 + resources: + requests: + cpu: 50m + memory: 128Mi + limits: + cpu: 250m + memory: 256Mi diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/backend/service.yaml b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/backend/service.yaml new file mode 100644 index 00000000..fae7c33d --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/backend/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: backend + namespace: backend-dev + labels: + app.kubernetes.io/name: backend +spec: + selector: + app.kubernetes.io/name: backend + ports: + - name: grpc + port: 9090 + targetPort: grpc diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/frontend/deployment.yaml b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/frontend/deployment.yaml new file mode 100644 index 00000000..ca566cfa --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/frontend/deployment.yaml @@ -0,0 +1,31 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend + namespace: frontend-dev + labels: + app.kubernetes.io/name: frontend + app.kubernetes.io/part-of: storefront +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: frontend + template: + metadata: + labels: + app.kubernetes.io/name: frontend + spec: + containers: + - name: frontend + image: ghcr.io/example-org/frontend:1.8.1 + ports: + - name: http + containerPort: 8080 + resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 250m + memory: 128Mi diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/frontend/service.yaml b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/frontend/service.yaml new file mode 100644 index 00000000..0945c3d7 --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/frontend/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: frontend + namespace: frontend-dev + labels: + app.kubernetes.io/name: frontend +spec: + selector: + app.kubernetes.io/name: frontend + ports: + - name: http + port: 80 + targetPort: http diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/namespaces.yaml b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/namespaces.yaml new file mode 100644 index 00000000..d9704bd9 --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/namespaces.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: frontend-dev + labels: + environment: dev + app.kubernetes.io/part-of: storefront +--- +apiVersion: v1 +kind: Namespace +metadata: + name: backend-dev + labels: + environment: dev + app.kubernetes.io/part-of: storefront diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/.gitignore b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/.gitignore new file mode 100644 index 00000000..b93ad153 --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/.gitignore @@ -0,0 +1,6 @@ +# This file marks gitops-production/ as a standalone repository root. +# In the real world this directory would be cloned as its own Git repository, +# typically with the tightest access control of the three environments. +.env +*.tmp +.DS_Store diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/backend/deployment.yaml b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/backend/deployment.yaml new file mode 100644 index 00000000..5a4b7f76 --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/backend/deployment.yaml @@ -0,0 +1,31 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: backend + namespace: backend-production + labels: + app.kubernetes.io/name: backend + app.kubernetes.io/part-of: storefront +spec: + replicas: 3 + selector: + matchLabels: + app.kubernetes.io/name: backend + template: + metadata: + labels: + app.kubernetes.io/name: backend + spec: + containers: + - name: backend + image: ghcr.io/example-org/backend:2.4.0 + ports: + - name: grpc + containerPort: 9090 + resources: + requests: + cpu: 250m + memory: 512Mi + limits: + cpu: "1" + memory: 1Gi diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/backend/service.yaml b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/backend/service.yaml new file mode 100644 index 00000000..83ac1bd5 --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/backend/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: backend + namespace: backend-production + labels: + app.kubernetes.io/name: backend +spec: + selector: + app.kubernetes.io/name: backend + ports: + - name: grpc + port: 9090 + targetPort: grpc diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/frontend/deployment.yaml b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/frontend/deployment.yaml new file mode 100644 index 00000000..4ea6e0a2 --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/frontend/deployment.yaml @@ -0,0 +1,33 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend + namespace: frontend-production + labels: + app.kubernetes.io/name: frontend + app.kubernetes.io/part-of: storefront +spec: + # replicas=3 here, but dev has 1 and staging has 2. This field has drifted across + # the three repos and there is no shared base in Git to reconcile it against. + replicas: 3 + selector: + matchLabels: + app.kubernetes.io/name: frontend + template: + metadata: + labels: + app.kubernetes.io/name: frontend + spec: + containers: + - name: frontend + image: ghcr.io/example-org/frontend:1.8.3 + ports: + - name: http + containerPort: 8080 + resources: + requests: + cpu: 250m + memory: 256Mi + limits: + cpu: "1" + memory: 512Mi diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/frontend/hpa.yaml b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/frontend/hpa.yaml new file mode 100644 index 00000000..4b8ec490 --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/frontend/hpa.yaml @@ -0,0 +1,23 @@ +# Production-only object: neither gitops-dev nor gitops-staging has a HorizontalPodAutoscaler. +# This is intentional drift — autoscaling is enabled only in production. +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: frontend + namespace: frontend-production + labels: + app.kubernetes.io/name: frontend +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: frontend + minReplicas: 3 + maxReplicas: 10 + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 70 diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/frontend/service.yaml b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/frontend/service.yaml new file mode 100644 index 00000000..d0269242 --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/frontend/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: frontend + namespace: frontend-production + labels: + app.kubernetes.io/name: frontend +spec: + selector: + app.kubernetes.io/name: frontend + ports: + - name: http + port: 80 + targetPort: http diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/namespaces.yaml b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/namespaces.yaml new file mode 100644 index 00000000..764bfb2b --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/namespaces.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: frontend-production + labels: + environment: production + app.kubernetes.io/part-of: storefront +--- +apiVersion: v1 +kind: Namespace +metadata: + name: backend-production + labels: + environment: production + app.kubernetes.io/part-of: storefront diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/.gitignore b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/.gitignore new file mode 100644 index 00000000..4408a151 --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/.gitignore @@ -0,0 +1,6 @@ +# This file marks gitops-staging/ as a standalone repository root. +# In the real world this directory would be cloned as its own Git repository, +# with its own history and its own access control, separate from dev/production. +.env +*.tmp +.DS_Store diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/backend/deployment.yaml b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/backend/deployment.yaml new file mode 100644 index 00000000..c667774b --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/backend/deployment.yaml @@ -0,0 +1,31 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: backend + namespace: backend-staging + labels: + app.kubernetes.io/name: backend + app.kubernetes.io/part-of: storefront +spec: + replicas: 2 + selector: + matchLabels: + app.kubernetes.io/name: backend + template: + metadata: + labels: + app.kubernetes.io/name: backend + spec: + containers: + - name: backend + image: ghcr.io/example-org/backend:2.3.9 + ports: + - name: grpc + containerPort: 9090 + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: 500m + memory: 512Mi diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/backend/service.yaml b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/backend/service.yaml new file mode 100644 index 00000000..02c56d8e --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/backend/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: backend + namespace: backend-staging + labels: + app.kubernetes.io/name: backend +spec: + selector: + app.kubernetes.io/name: backend + ports: + - name: grpc + port: 9090 + targetPort: grpc diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/frontend/deployment.yaml b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/frontend/deployment.yaml new file mode 100644 index 00000000..e60dd925 --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/frontend/deployment.yaml @@ -0,0 +1,31 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend + namespace: frontend-staging + labels: + app.kubernetes.io/name: frontend + app.kubernetes.io/part-of: storefront +spec: + replicas: 2 + selector: + matchLabels: + app.kubernetes.io/name: frontend + template: + metadata: + labels: + app.kubernetes.io/name: frontend + spec: + containers: + - name: frontend + image: ghcr.io/example-org/frontend:1.8.2 + ports: + - name: http + containerPort: 8080 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 500m + memory: 256Mi diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/frontend/service.yaml b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/frontend/service.yaml new file mode 100644 index 00000000..6a4e9611 --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/frontend/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: frontend + namespace: frontend-staging + labels: + app.kubernetes.io/name: frontend +spec: + selector: + app.kubernetes.io/name: frontend + ports: + - name: http + port: 80 + targetPort: http diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/namespaces.yaml b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/namespaces.yaml new file mode 100644 index 00000000..146ecdf0 --- /dev/null +++ b/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/namespaces.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: frontend-staging + labels: + environment: staging + app.kubernetes.io/part-of: storefront +--- +apiVersion: v1 +kind: Namespace +metadata: + name: backend-staging + labels: + environment: staging + app.kubernetes.io/part-of: storefront diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/README.md b/test/fixtures/gitops-layouts/12-multicluster-applicationset/README.md new file mode 100644 index 00000000..731bad37 --- /dev/null +++ b/test/fixtures/gitops-layouts/12-multicluster-applicationset/README.md @@ -0,0 +1,80 @@ +# 12-multicluster-applicationset + +## What this is +An Argo CD `ApplicationSet` using a **matrix generator** to produce one Application +per (cluster x app) pair. This is the standard way large Argo CD installations fan a +small set of app directories out across a fleet of clusters: a `clusters` generator +enumerates the registered cluster Secrets, a `git` generator enumerates the app +directories under `apps/*`, and the matrix generator takes their Cartesian product. +The template then stamps out an Application for every combination. + +The set of rendered Applications is therefore a **product, not a sum**: it is +`(number of selected clusters) x (number of app directories)`, not +`(clusters) + (apps)`. + +## Layout +``` +12-multicluster-applicationset/ +├── README.md # this file +├── applicationsets/ +│ └── cluster-matrix.yaml # ApplicationSet with a matrix(clusters x git) generator +├── clusters/ +│ ├── eu-production.yaml # Argo CD cluster Secret (a destination, not a workload) +│ ├── us-production.yaml # Argo CD cluster Secret +│ └── staging.yaml # Argo CD cluster Secret (NOT selected by the matrix) +├── apps/ +│ ├── frontend/ +│ │ ├── deployment.yaml # rendered once per selected cluster +│ │ └── service.yaml +│ └── backend/ +│ ├── deployment.yaml +│ └── service.yaml +└── values/ + ├── eu-production/ + │ ├── frontend.yaml # NOT KRM — per-cluster values + │ └── backend.yaml # NOT KRM + ├── us-production/ + │ └── frontend.yaml # NOT KRM — backend values intentionally absent + └── staging/ + └── frontend.yaml # NOT KRM — backend values intentionally absent +``` + +## What makes it structurally distinct +- **The same app directory renders once per cluster.** `apps/frontend/` and + `apps/backend/` each exist exactly once on disk, but the matrix generator emits one + Application per selected cluster for each of them. The on-disk file count does not + reflect the number of live Applications. +- **The number of Applications is a product, not a sum.** With the two + `environment: production` clusters selected and two app directories, the matrix + yields `2 x 2 = 4` Applications, named `{{.name}}-{{.path.basename}}` (for example + `eu-production-frontend`, `us-production-backend`). +- **A cluster Secret is a Kubernetes object that configures a *destination*, not a + workload.** The files under `clusters/` are real `v1` Secrets in the `argocd` + namespace carrying the `argocd.argoproj.io/secret-type: cluster` label; they tell + Argo CD where to deploy, they are not themselves anything that runs in a cluster. + Their bearer tokens are deliberately fake. +- **The clusters generator selects on the `environment` label.** The selector matches + `environment: production`, so `staging.yaml` is a registered cluster Secret that the + matrix does **not** select — it participates in nothing here. +- **The values matrix is sparse.** `values/eu-production/` has both `frontend.yaml` + and `backend.yaml`, but `values/us-production/` and `values/staging/` have only + `frontend.yaml`. The per-cluster override grid has holes in it. +- The files under `values/` are **NOT Kubernetes objects**: they are plain YAML value + documents (no `apiVersion`, no `kind`) consumed out-of-band by a config-management + plugin or Helm, not applied to any cluster directly. + +## Open questions +- What is "the desired state of `apps/frontend`" when that one directory is deployed + to multiple clusters, each with different per-cluster values and a different image + tag or replica count? +- When an edit is made to `apps/frontend/deployment.yaml`, it changes every rendered + copy at once — but which of the N live Applications was the edit actually meant for? +- Conversely, if an edit is meant for exactly one cluster (say only `eu-production`), + does it belong in the shared `apps/frontend/` directory at all, or only in that + cluster's `values/` file — and how would a reader tell those two intents apart? +- The `staging` cluster Secret is registered but not selected by the matrix, and + `values/staging/frontend.yaml` exists for it. What state, if any, does that + orphaned pairing describe? +- Where two clusters share the same app directory but differ only in a sparse + `values/` override, which is authoritative when they disagree — the shared manifest + or the per-cluster value? diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/applicationsets/cluster-matrix.yaml b/test/fixtures/gitops-layouts/12-multicluster-applicationset/applicationsets/cluster-matrix.yaml new file mode 100644 index 00000000..9749884e --- /dev/null +++ b/test/fixtures/gitops-layouts/12-multicluster-applicationset/applicationsets/cluster-matrix.yaml @@ -0,0 +1,41 @@ +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: cluster-matrix + namespace: argocd +spec: + goTemplate: false + generators: + # Matrix = Cartesian product of the two nested generators below. + # Rendered Applications = (selected clusters) x (app directories), a product not a sum. + - matrix: + generators: + - clusters: + selector: + matchLabels: + # Selects only production clusters. The staging cluster Secret is + # registered but deliberately NOT matched by this selector. + environment: production + - git: + repoURL: https://github.com/example-org/gitops-multicluster.git + revision: main + directories: + - path: apps/* + template: + metadata: + # e.g. eu-production-frontend, us-production-backend + name: '{{.name}}-{{.path.basename}}' + namespace: argocd + spec: + project: default + source: + repoURL: https://github.com/example-org/gitops-multicluster.git + targetRevision: main + path: '{{.path.path}}' + destination: + server: '{{.server}}' + namespace: '{{.path.basename}}' + syncPolicy: + automated: + prune: true + selfHeal: true diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/backend/deployment.yaml b/test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/backend/deployment.yaml new file mode 100644 index 00000000..f401525b --- /dev/null +++ b/test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/backend/deployment.yaml @@ -0,0 +1,30 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: backend + labels: + app.kubernetes.io/name: backend + app.kubernetes.io/part-of: storefront +spec: + replicas: 2 + selector: + matchLabels: + app.kubernetes.io/name: backend + template: + metadata: + labels: + app.kubernetes.io/name: backend + spec: + containers: + - name: backend + image: ghcr.io/example-org/backend:2.4.0 + ports: + - name: grpc + containerPort: 9090 + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: 500m + memory: 512Mi diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/backend/service.yaml b/test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/backend/service.yaml new file mode 100644 index 00000000..69c1d932 --- /dev/null +++ b/test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/backend/service.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Service +metadata: + name: backend + labels: + app.kubernetes.io/name: backend +spec: + selector: + app.kubernetes.io/name: backend + ports: + - name: grpc + port: 9090 + targetPort: grpc diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/frontend/deployment.yaml b/test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/frontend/deployment.yaml new file mode 100644 index 00000000..82a3421a --- /dev/null +++ b/test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/frontend/deployment.yaml @@ -0,0 +1,30 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend + labels: + app.kubernetes.io/name: frontend + app.kubernetes.io/part-of: storefront +spec: + replicas: 2 + selector: + matchLabels: + app.kubernetes.io/name: frontend + template: + metadata: + labels: + app.kubernetes.io/name: frontend + spec: + containers: + - name: frontend + image: ghcr.io/example-org/frontend:1.8.3 + ports: + - name: http + containerPort: 8080 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 500m + memory: 256Mi diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/frontend/service.yaml b/test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/frontend/service.yaml new file mode 100644 index 00000000..233c01eb --- /dev/null +++ b/test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/frontend/service.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Service +metadata: + name: frontend + labels: + app.kubernetes.io/name: frontend +spec: + selector: + app.kubernetes.io/name: frontend + ports: + - name: http + port: 80 + targetPort: http diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/clusters/eu-production.yaml b/test/fixtures/gitops-layouts/12-multicluster-applicationset/clusters/eu-production.yaml new file mode 100644 index 00000000..045e909a --- /dev/null +++ b/test/fixtures/gitops-layouts/12-multicluster-applicationset/clusters/eu-production.yaml @@ -0,0 +1,22 @@ +apiVersion: v1 +kind: Secret +metadata: + name: eu-production + namespace: argocd + labels: + argocd.argoproj.io/secret-type: cluster + environment: production + region: eu-west-1 +type: Opaque +stringData: + name: eu-production + server: https://eu-production.k8s.example.com:6443 + # The bearerToken below is intentionally fake — this is a fixture, never a real credential. + config: | + { + "bearerToken": "not-a-real-token", + "tlsClientConfig": { + "insecure": false, + "caData": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t" + } + } diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/clusters/staging.yaml b/test/fixtures/gitops-layouts/12-multicluster-applicationset/clusters/staging.yaml new file mode 100644 index 00000000..25f38274 --- /dev/null +++ b/test/fixtures/gitops-layouts/12-multicluster-applicationset/clusters/staging.yaml @@ -0,0 +1,24 @@ +apiVersion: v1 +kind: Secret +metadata: + name: staging + namespace: argocd + labels: + argocd.argoproj.io/secret-type: cluster + # environment=staging, so the ApplicationSet's environment=production selector + # does NOT match this cluster. It is registered but participates in nothing here. + environment: staging + region: eu-west-1 +type: Opaque +stringData: + name: staging + server: https://staging.k8s.example.com:6443 + # The bearerToken below is intentionally fake — this is a fixture, never a real credential. + config: | + { + "bearerToken": "not-a-real-token", + "tlsClientConfig": { + "insecure": false, + "caData": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t" + } + } diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/clusters/us-production.yaml b/test/fixtures/gitops-layouts/12-multicluster-applicationset/clusters/us-production.yaml new file mode 100644 index 00000000..bbd049ea --- /dev/null +++ b/test/fixtures/gitops-layouts/12-multicluster-applicationset/clusters/us-production.yaml @@ -0,0 +1,22 @@ +apiVersion: v1 +kind: Secret +metadata: + name: us-production + namespace: argocd + labels: + argocd.argoproj.io/secret-type: cluster + environment: production + region: us-east-1 +type: Opaque +stringData: + name: us-production + server: https://us-production.k8s.example.com:6443 + # The bearerToken below is intentionally fake — this is a fixture, never a real credential. + config: | + { + "bearerToken": "not-a-real-token", + "tlsClientConfig": { + "insecure": false, + "caData": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t" + } + } diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/values/eu-production/backend.yaml b/test/fixtures/gitops-layouts/12-multicluster-applicationset/values/eu-production/backend.yaml new file mode 100644 index 00000000..40e1641d --- /dev/null +++ b/test/fixtures/gitops-layouts/12-multicluster-applicationset/values/eu-production/backend.yaml @@ -0,0 +1,9 @@ +# Per-cluster override values for backend on the eu-production cluster. +# This is plain YAML, NOT a Kubernetes object: no apiVersion, no kind. +replicaCount: 4 +image: + tag: 2.4.0 +resources: + requests: + cpu: 250m + memory: 512Mi diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/values/eu-production/frontend.yaml b/test/fixtures/gitops-layouts/12-multicluster-applicationset/values/eu-production/frontend.yaml new file mode 100644 index 00000000..137d9dea --- /dev/null +++ b/test/fixtures/gitops-layouts/12-multicluster-applicationset/values/eu-production/frontend.yaml @@ -0,0 +1,12 @@ +# Per-cluster override values for frontend on the eu-production cluster. +# This is plain YAML, NOT a Kubernetes object: no apiVersion, no kind. +# It is consumed out-of-band (Helm values / config-management plugin), not applied directly. +replicaCount: 4 +image: + tag: 1.8.3 +ingress: + host: frontend.eu.example.com +resources: + requests: + cpu: 250m + memory: 256Mi diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/values/staging/frontend.yaml b/test/fixtures/gitops-layouts/12-multicluster-applicationset/values/staging/frontend.yaml new file mode 100644 index 00000000..7a1e6e41 --- /dev/null +++ b/test/fixtures/gitops-layouts/12-multicluster-applicationset/values/staging/frontend.yaml @@ -0,0 +1,14 @@ +# Per-cluster override values for frontend on the staging cluster. +# This is plain YAML, NOT a Kubernetes object: no apiVersion, no kind. +# The matrix is sparse: there is deliberately no backend.yaml for staging. Note also that +# the staging cluster is not selected by the ApplicationSet (environment=production), so +# this file describes an override for a pairing the matrix never renders. +replicaCount: 1 +image: + tag: 1.8.3 +ingress: + host: frontend.staging.example.com +resources: + requests: + cpu: 100m + memory: 128Mi diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/values/us-production/frontend.yaml b/test/fixtures/gitops-layouts/12-multicluster-applicationset/values/us-production/frontend.yaml new file mode 100644 index 00000000..f1ed2714 --- /dev/null +++ b/test/fixtures/gitops-layouts/12-multicluster-applicationset/values/us-production/frontend.yaml @@ -0,0 +1,12 @@ +# Per-cluster override values for frontend on the us-production cluster. +# This is plain YAML, NOT a Kubernetes object: no apiVersion, no kind. +# The matrix is sparse: there is deliberately no backend.yaml for us-production. +replicaCount: 3 +image: + tag: 1.8.3 +ingress: + host: frontend.us.example.com +resources: + requests: + cpu: 200m + memory: 256Mi diff --git a/test/fixtures/gitops-layouts/13-sops-encrypted/.sops.yaml b/test/fixtures/gitops-layouts/13-sops-encrypted/.sops.yaml new file mode 100644 index 00000000..b33c469a --- /dev/null +++ b/test/fixtures/gitops-layouts/13-sops-encrypted/.sops.yaml @@ -0,0 +1,14 @@ +# SOPS creation-rules file. This is CONFIGURATION for the `sops` CLI, not a +# Kubernetes object: it has no apiVersion/kind and the API server never sees it. +# The `age` recipient below is a FAKE but correctly-shaped age public key +# (bech32, `age1` prefix). NOT A REAL KEY. +creation_rules: + # Any file whose path ends in `.enc.yaml` is encrypted to the age recipient. + - path_regex: .*\.enc\.yaml$ + # Fake age recipient. NOT A REAL KEY. + age: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p + # Only values under `data`/`stringData` are encrypted; keys and structure + # (apiVersion, kind, metadata) stay cleartext so the file is still valid KRM. + - encrypted_regex: ^(data|stringData)$ + # Fake age recipient. NOT A REAL KEY. + age: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p diff --git a/test/fixtures/gitops-layouts/13-sops-encrypted/README.md b/test/fixtures/gitops-layouts/13-sops-encrypted/README.md new file mode 100644 index 00000000..43ce5c42 --- /dev/null +++ b/test/fixtures/gitops-layouts/13-sops-encrypted/README.md @@ -0,0 +1,80 @@ +# 13-sops-encrypted + +## What this is +The standard way teams keep Secrets in a public or shared GitOps repo: encrypt +them at rest with [SOPS](https://github.com/getsops/sops), commit the encrypted +files, and let the GitOps controller decrypt in-cluster at apply time. Flux has +first-class SOPS support (`spec.decryption.provider: sops`); Argo CD teams reach +the same outcome with `ksops`, `argocd-vault-plugin`, or a decrypt sidecar. The +private key (here an `age` identity) lives only in the cluster, never in Git. + +The defining property of SOPS is **partial** encryption: it encrypts *values* +but leaves keys and document structure in cleartext. So a SOPS-encrypted Secret +is still a syntactically valid Kubernetes object — you can read its `kind`, +`metadata.name`, and `metadata.namespace` — but its `data` values are opaque. + +## Layout +``` +13-sops-encrypted/ +├── README.md +├── .sops.yaml # sops creation-rules (NOT a K8s object) +├── apps/ +│ └── frontend/ +│ ├── deployment.yaml # KRM: plain, unencrypted Deployment +│ ├── secret.enc.yaml # KRM: SOPS-encrypted Secret (data opaque) +│ └── kustomization.yaml # kustomize config (NOT a K8s object) +├── infrastructure/ +│ └── secrets/ +│ ├── db-credentials.enc.yaml # KRM: SOPS-encrypted Secret +│ └── kustomization.yaml # kustomize config (NOT a K8s object) +└── clusters/ + └── production/ + └── apps.yaml # Flux Kustomization (+GitRepository), + # spec.decryption.provider: sops +``` + +## What makes it structurally distinct +- **A single file is both readable and unreadable.** In `secret.enc.yaml` the + `apiVersion`, `kind`, `metadata`, and `type` are cleartext and fully + structural; the values under `data` are `ENC[AES256_GCM,...]` ciphertext. + Structure is legible; content is not. +- **`.sops.yaml` is YAML that is NOT a Kubernetes object.** It has no + `apiVersion`/`kind`; it is configuration for the `sops` CLI describing which + paths to encrypt (`path_regex: .*\.enc\.yaml$`) and which fields + (`encrypted_regex: ^(data|stringData)$`), and to which `age` recipient. +- **The `sops:` block is metadata about the encryption, not part of the K8s + object.** It carries `age.recipient`, an armored key-wrap `enc` blob, + `lastmodified`, a `mac`, and `version`. `kubectl apply` would reject or ignore + it; it exists only so `sops` can decrypt and verify integrity. +- **The `mac` binds the whole cleartext.** It is a message authentication code + over the decrypted tree. Any change to key order, indentation, or values that + is not made through `sops` invalidates it, and decryption then fails. +- **The decryption key is not in the repo.** `clusters/production/apps.yaml` + points `spec.decryption.secretRef` at a cluster Secret named `sops-age`; that + private `age` identity exists only in the cluster. +- **`.enc.yaml` is a naming convention, not a guarantee.** The `.sops.yaml` + rule keys encryption to the filename suffix; a mis-named file would be + committed in cleartext, and nothing in the file's *content* announces it as + the plaintext of an intended-encrypted resource. +- **All ciphertext here is fake.** Every `ENC[...]` string, the armored age + block, and the `mac` are placeholders, not real SOPS output. + +## Open questions +- If a tool must reflect a change to a resource whose `spec`/`data` it cannot + read, what does it edit? It can see the object's identity but not its current + values. +- Does re-serialising `secret.enc.yaml` (even reformatting whitespace or + reordering keys) destroy the `mac` and make the file undecryptable — and how + would a tool that rewrites YAML avoid that? +- Is the `sops:` block part of the "desired state" of the Kubernetes object, or + is it out-of-band metadata that a manifest-aware tool should treat as opaque + and never touch? +- To change one value under `data`, must a tool hold the private `age` key, + decrypt, edit, and re-encrypt — and if it does not have the key, is any + in-place edit of that value possible at all? +- How should a tool decide that `secret.enc.yaml` is encrypted: by the `.enc` + suffix, by the presence of a top-level `sops:` key, by `ENC[...]` value + shapes, or by matching `.sops.yaml`? Do those signals ever disagree? +- The `metadata` is cleartext but the referenced envFrom Secret's contents are + not. Can a tool reason about what the running Pod actually consumes without + ever decrypting? diff --git a/test/fixtures/gitops-layouts/13-sops-encrypted/apps/frontend/deployment.yaml b/test/fixtures/gitops-layouts/13-sops-encrypted/apps/frontend/deployment.yaml new file mode 100644 index 00000000..a0e3fffd --- /dev/null +++ b/test/fixtures/gitops-layouts/13-sops-encrypted/apps/frontend/deployment.yaml @@ -0,0 +1,31 @@ +# Plain, unencrypted Kubernetes object. It sits in the same directory as an +# encrypted Secret; only the Secret's values are opaque, this Deployment is not. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend + namespace: frontend-production + labels: + app: frontend +spec: + replicas: 3 + selector: + matchLabels: + app: frontend + template: + metadata: + labels: + app: frontend + spec: + containers: + - name: frontend + image: ghcr.io/example-org/frontend:1.8.3 + envFrom: + - secretRef: + name: frontend-credentials + ports: + - containerPort: 8080 + resources: + requests: + cpu: 50m + memory: 64Mi diff --git a/test/fixtures/gitops-layouts/13-sops-encrypted/apps/frontend/kustomization.yaml b/test/fixtures/gitops-layouts/13-sops-encrypted/apps/frontend/kustomization.yaml new file mode 100644 index 00000000..bb78387c --- /dev/null +++ b/test/fixtures/gitops-layouts/13-sops-encrypted/apps/frontend/kustomization.yaml @@ -0,0 +1,8 @@ +# kustomize build config (not a cluster object). It lists an encrypted Secret +# as an ordinary resource; kustomize copies the ciphertext through untouched. +# Decryption happens later, in the cluster, via the Flux Kustomization. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - deployment.yaml + - secret.enc.yaml diff --git a/test/fixtures/gitops-layouts/13-sops-encrypted/apps/frontend/secret.enc.yaml b/test/fixtures/gitops-layouts/13-sops-encrypted/apps/frontend/secret.enc.yaml new file mode 100644 index 00000000..885bd9bc --- /dev/null +++ b/test/fixtures/gitops-layouts/13-sops-encrypted/apps/frontend/secret.enc.yaml @@ -0,0 +1,37 @@ +# SOPS-encrypted Secret. +# apiVersion/kind/metadata/type are CLEARTEXT and structural; only the values +# under `data` are opaque ciphertext. Every ENC[...] string, the armored age +# block, and the whole `sops:` metadata block below are FAKE — not real +# ciphertext, not a real MAC. This file is simultaneously a valid Kubernetes +# object and unreadable without the private age key. +apiVersion: v1 +kind: Secret +metadata: + name: frontend-credentials + namespace: frontend-production + labels: + app: frontend +type: Opaque +data: + # Values are AES256-GCM ciphertext. The base64 blobs below are fake. + api-key: ENC[AES256_GCM,data:Yk3nQ2p7dZ8v,iv:9pQ2n1V0aK7sD4uT6hG3xJ5b,tag:s7Kd2mP0qR8vT1xW9yZ3,type:str] + session-secret: ENC[AES256_GCM,data:Lm4pX8vB2nQ7,iv:aZ0kD3sT6hG9xJ2bN5wL8rM1,tag:cY4zE7fH0iA3pQ6nV9kD,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p + # Fake armored age key-wrap block. NOT REAL. + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBub3QtYS1yZWFsLWtleQpm + YWtlLWJhc2U2NC1ibG9iLWZvci1maXh0dXJlLXVzZS1vbmx5LW5vdC1yZWFsLXNv + cHMtd3JhcC1rZXktZGF0YS1oZXJlCg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-07-10T09:00:00Z" + # Fake MAC. Re-serialising the cleartext would invalidate a real one. + mac: ENC[AES256_GCM,data:F0iA3pQ6nV9kD3sT,iv:6hG9xJ2bN5wL8rM1cY4zE7fH,tag:0iA3pQ6nV9kD3sT6hG9x,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.9.0 diff --git a/test/fixtures/gitops-layouts/13-sops-encrypted/clusters/production/apps.yaml b/test/fixtures/gitops-layouts/13-sops-encrypted/clusters/production/apps.yaml new file mode 100644 index 00000000..9495358d --- /dev/null +++ b/test/fixtures/gitops-layouts/13-sops-encrypted/clusters/production/apps.yaml @@ -0,0 +1,32 @@ +# Flux Kustomization CR that reconciles the apps and decrypts SOPS-encrypted +# resources in-cluster. The `decryption` block names a Secret (`sops-age`) that +# holds the private age key; the key is NOT in this repo. Without it the +# encrypted values stay opaque. +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: apps + namespace: flux-system +spec: + interval: 10m + path: ./apps/frontend + prune: true + sourceRef: + kind: GitRepository + name: gitops + decryption: + provider: sops + secretRef: + name: sops-age +--- +# The Git source the Kustomization above reconciles from. +apiVersion: source.toolkit.fluxcd.io/v1 +kind: GitRepository +metadata: + name: gitops + namespace: flux-system +spec: + interval: 5m + url: https://github.com/example-org/gitops.git + ref: + branch: main diff --git a/test/fixtures/gitops-layouts/13-sops-encrypted/infrastructure/secrets/db-credentials.enc.yaml b/test/fixtures/gitops-layouts/13-sops-encrypted/infrastructure/secrets/db-credentials.enc.yaml new file mode 100644 index 00000000..693b9213 --- /dev/null +++ b/test/fixtures/gitops-layouts/13-sops-encrypted/infrastructure/secrets/db-credentials.enc.yaml @@ -0,0 +1,32 @@ +# SOPS-encrypted Secret for database credentials. +# metadata/type are cleartext; the values under `data` are fake ciphertext. +# The `sops:` block is fake. NOT REAL. +apiVersion: v1 +kind: Secret +metadata: + name: db-credentials + namespace: infrastructure +type: Opaque +data: + # Fake ciphertext. + username: ENC[AES256_GCM,data:R8vT1xW9zK3m,iv:cY4zE7fH0iA3pQ6nV9kD3sT6,tag:hG9xJ2bN5wL8rM1cY4zE,type:str] + password: ENC[AES256_GCM,data:Q7sD4uT6hG3x,iv:8wL2rM0cY1zE9fH4iA3pQ6nV,tag:9kD3sT6hG9xJ2bN5wL8r,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p + # Fake armored age key-wrap block. NOT REAL. + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBub3QtYS1yZWFsLWtleQpk + Yi1jcmVkcy1mYWtlLWJhc2U2NC1ibG9iLW5vdC1yZWFsLXNvcHMtd3JhcC1rZXkt + ZGF0YS1mb3ItZml4dHVyZS11c2Utb25seQo= + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-07-10T09:00:00Z" + # Fake MAC. NOT REAL. + mac: ENC[AES256_GCM,data:9kD3sT6hG9xJ2bN5,iv:wL8rM1cY4zE7fH0iA3pQ6nV9,tag:kD3sT6hG9xJ2bN5wL8rM,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.9.0 diff --git a/test/fixtures/gitops-layouts/13-sops-encrypted/infrastructure/secrets/kustomization.yaml b/test/fixtures/gitops-layouts/13-sops-encrypted/infrastructure/secrets/kustomization.yaml new file mode 100644 index 00000000..1c573872 --- /dev/null +++ b/test/fixtures/gitops-layouts/13-sops-encrypted/infrastructure/secrets/kustomization.yaml @@ -0,0 +1,6 @@ +# kustomize build config (not a cluster object). Passes the encrypted Secret +# through as-is; nothing here can read it. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - db-credentials.enc.yaml diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/README.md b/test/fixtures/gitops-layouts/14-rendered-manifests/README.md new file mode 100644 index 00000000..9b0b0bf5 --- /dev/null +++ b/test/fixtures/gitops-layouts/14-rendered-manifests/README.md @@ -0,0 +1,84 @@ +# 14-rendered-manifests + +## What this is +The "rendered manifests" (a.k.a. "hydrated manifests" or "rendered YAML") +pattern. Instead of pointing the GitOps tool at Helm charts or kustomize +overlays and letting it template at apply time, a CI job runs the renderer +(`kustomize build`, `helm template`) and commits the *plain* output. The GitOps +tool then applies fully-resolved KRM and never templates anything. Popularised +by the Argo CD "apps of rendered manifests" guidance and by +`kubernetes-sigs/kustomize` users who want Git to show exactly what runs; also +the model behind tools like `holos` and rendered-branch workflows. + +Here `src/` holds the kustomize sources, `src/render.sh` renders each overlay, +and the results land under `rendered//`. Argo CD reads only `rendered/`. + +## Layout +``` +14-rendered-manifests/ +├── README.md +├── src/ # inputs — the GitOps tool never reads these +│ ├── frontend/ +│ │ ├── base/ +│ │ │ ├── deployment.yaml # KRM source +│ │ │ ├── service.yaml # KRM source +│ │ │ └── kustomization.yaml # kustomize config (configMapGenerator) +│ │ └── overlays/ +│ │ ├── staging/ +│ │ │ └── kustomization.yaml # namePrefix, namespace, image tag +│ │ └── production/ +│ │ └── kustomization.yaml # namePrefix, namespace, image tag +│ └── render.sh # NOT YAML — bash renderer +├── rendered/ # GENERATED artifacts — the desired state +│ ├── staging/ +│ │ └── frontend.yaml # multi-doc plain KRM, "DO NOT EDIT" +│ └── production/ +│ └── frontend.yaml # multi-doc plain KRM, "DO NOT EDIT" +└── argocd/ + └── production.yaml # Application → path: rendered/production +``` + +## What makes it structurally distinct +- **Git is the desired state, exactly.** The files under `rendered/` are the + literal objects applied to the cluster — no templating, no overlay math + happens after commit. What you read is what runs. +- **...at the cost of the committed files being generated artifacts.** Each + `rendered/**/frontend.yaml` opens with a `# Generated by ... DO NOT EDIT.` + header naming the build command and the source commit. They are outputs, not + authored files. +- **`src/render.sh` is not YAML.** It is the bash renderer that produces the + YAML; a `*.yaml` scan skips it, yet it is the real source of the outputs. +- **The rendered files carry rendering fingerprints.** A hash-suffixed + ConfigMap name (`prod-frontend-config-t9k4h2m5bd`), an applied `namePrefix` + (`prod-` / `staging-`), a stamped `namespace`, a resolved image tag + (`1.8.3` for production, `1.9.0-rc.2` for staging), and + `config.kubernetes.io/origin` annotations recording the source path. +- **The same logical object appears twice, differently resolved.** `frontend` + exists as `prod-frontend` and `staging-frontend`; neither name is written + verbatim in any `src/` file. +- **The origin annotation points back, but not one-to-one.** The ConfigMap's + origin is `configuredIn: src/frontend/base/kustomization.yaml` with a + generator, not a single source document — there is no file that *is* the + ConfigMap. +- **Argo CD points at `rendered/`, never `src/`.** `argocd/production.yaml` has + `path: rendered/production`. The sources are invisible to the cluster. + +## Open questions +- If a tool edits `rendered/production/frontend.yaml` in place, the next + `render.sh` overwrites it. Where should an intended change actually be + written so it survives the next render? +- The round-trip from a rendered object back to `src/` is many-to-one: a + namespace came from the overlay, a tag from `images:`, the ConfigMap body from + a generator. Given only the rendered file, can a tool reconstruct which source + file owns a given field? +- Does the hash suffix `t9k4h2m5bd` have any stable source? It is a function of + the generator inputs; it changes when `LOG_LEVEL`/`FEATURE_FLAGS` change, and + it is identical across environments only because the inputs are identical. + What does a tool key on if the name is content-derived? +- The `# DO NOT EDIT` header is advisory. What, structurally, distinguishes a + generated file from an authored one to a tool that only sees the file bytes? +- Both environments share one hash today. If staging's config diverged, its + ConfigMap name would change but production's would not. How would a tool know + the two `frontend.yaml` files are renders of the same base? +- Is the desired state the `rendered/` output or the `src/` inputs — and if a + human changes one but not the other, which does a tool believe? diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/argocd/production.yaml b/test/fixtures/gitops-layouts/14-rendered-manifests/argocd/production.yaml new file mode 100644 index 00000000..54ab80ff --- /dev/null +++ b/test/fixtures/gitops-layouts/14-rendered-manifests/argocd/production.yaml @@ -0,0 +1,20 @@ +# Argo CD Application. Its source path is rendered/production — the generated +# output — never src/. Argo CD applies the committed artifacts verbatim. +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: frontend-production + namespace: argocd +spec: + project: default + source: + repoURL: https://github.com/example-org/gitops.git + targetRevision: main + path: rendered/production + destination: + server: https://kubernetes.default.svc + namespace: frontend-production + syncPolicy: + automated: + prune: true + selfHeal: true diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/rendered/production/frontend.yaml b/test/fixtures/gitops-layouts/14-rendered-manifests/rendered/production/frontend.yaml new file mode 100644 index 00000000..5f8a46c2 --- /dev/null +++ b/test/fixtures/gitops-layouts/14-rendered-manifests/rendered/production/frontend.yaml @@ -0,0 +1,68 @@ +# Generated by `kustomize build src/frontend/overlays/production`. DO NOT EDIT. +# Source commit: 4f2a1c9. Regenerate with src/render.sh. +apiVersion: v1 +kind: ConfigMap +metadata: + name: prod-frontend-config-t9k4h2m5bd + namespace: frontend-production + labels: + app: frontend + annotations: + config.kubernetes.io/origin: | + configuredIn: src/frontend/base/kustomization.yaml + configuredBy: + apiVersion: builtin + kind: ConfigMapGenerator +data: + LOG_LEVEL: info + FEATURE_FLAGS: canary +--- +apiVersion: v1 +kind: Service +metadata: + name: prod-frontend + namespace: frontend-production + labels: + app: frontend + annotations: + config.kubernetes.io/origin: | + path: src/frontend/base/service.yaml +spec: + selector: + app: frontend + ports: + - port: 80 + targetPort: 8080 +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: prod-frontend + namespace: frontend-production + labels: + app: frontend + annotations: + config.kubernetes.io/origin: | + path: src/frontend/base/deployment.yaml +spec: + replicas: 1 + selector: + matchLabels: + app: frontend + template: + metadata: + labels: + app: frontend + spec: + containers: + - name: frontend + image: ghcr.io/example-org/frontend:1.8.3 + envFrom: + - configMapRef: + name: prod-frontend-config-t9k4h2m5bd + ports: + - containerPort: 8080 + resources: + requests: + cpu: 50m + memory: 64Mi diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/rendered/staging/frontend.yaml b/test/fixtures/gitops-layouts/14-rendered-manifests/rendered/staging/frontend.yaml new file mode 100644 index 00000000..faf647db --- /dev/null +++ b/test/fixtures/gitops-layouts/14-rendered-manifests/rendered/staging/frontend.yaml @@ -0,0 +1,68 @@ +# Generated by `kustomize build src/frontend/overlays/staging`. DO NOT EDIT. +# Source commit: 4f2a1c9. Regenerate with src/render.sh. +apiVersion: v1 +kind: ConfigMap +metadata: + name: staging-frontend-config-t9k4h2m5bd + namespace: frontend-staging + labels: + app: frontend + annotations: + config.kubernetes.io/origin: | + configuredIn: src/frontend/base/kustomization.yaml + configuredBy: + apiVersion: builtin + kind: ConfigMapGenerator +data: + LOG_LEVEL: info + FEATURE_FLAGS: canary +--- +apiVersion: v1 +kind: Service +metadata: + name: staging-frontend + namespace: frontend-staging + labels: + app: frontend + annotations: + config.kubernetes.io/origin: | + path: src/frontend/base/service.yaml +spec: + selector: + app: frontend + ports: + - port: 80 + targetPort: 8080 +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: staging-frontend + namespace: frontend-staging + labels: + app: frontend + annotations: + config.kubernetes.io/origin: | + path: src/frontend/base/deployment.yaml +spec: + replicas: 1 + selector: + matchLabels: + app: frontend + template: + metadata: + labels: + app: frontend + spec: + containers: + - name: frontend + image: ghcr.io/example-org/frontend:1.9.0-rc.2 + envFrom: + - configMapRef: + name: staging-frontend-config-t9k4h2m5bd + ports: + - containerPort: 8080 + resources: + requests: + cpu: 50m + memory: 64Mi diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/base/deployment.yaml b/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/base/deployment.yaml new file mode 100644 index 00000000..5696322d --- /dev/null +++ b/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/base/deployment.yaml @@ -0,0 +1,30 @@ +# Source input, NOT what the GitOps tool applies. `kustomize build` consumes +# this; the plain output is written under rendered/ and only that is deployed. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend + labels: + app: frontend +spec: + replicas: 1 + selector: + matchLabels: + app: frontend + template: + metadata: + labels: + app: frontend + spec: + containers: + - name: frontend + image: ghcr.io/example-org/frontend:1.8.3 + envFrom: + - configMapRef: + name: frontend-config + ports: + - containerPort: 8080 + resources: + requests: + cpu: 50m + memory: 64Mi diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/base/kustomization.yaml b/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/base/kustomization.yaml new file mode 100644 index 00000000..314b00d1 --- /dev/null +++ b/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/base/kustomization.yaml @@ -0,0 +1,12 @@ +# kustomize config (not a cluster object). The configMapGenerator makes the +# rendered ConfigMap name gain a content-hash suffix. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - deployment.yaml + - service.yaml +configMapGenerator: + - name: frontend-config + literals: + - LOG_LEVEL=info + - FEATURE_FLAGS=canary diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/base/service.yaml b/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/base/service.yaml new file mode 100644 index 00000000..af7726de --- /dev/null +++ b/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/base/service.yaml @@ -0,0 +1,13 @@ +# Source input, NOT what the GitOps tool applies. +apiVersion: v1 +kind: Service +metadata: + name: frontend + labels: + app: frontend +spec: + selector: + app: frontend + ports: + - port: 80 + targetPort: 8080 diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/overlays/production/kustomization.yaml b/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/overlays/production/kustomization.yaml new file mode 100644 index 00000000..6733a997 --- /dev/null +++ b/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/overlays/production/kustomization.yaml @@ -0,0 +1,11 @@ +# Production overlay input. Adds a namePrefix and namespace and pins the image +# tag. `kustomize build` on this directory produces rendered/production/frontend.yaml. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namePrefix: prod- +namespace: frontend-production +resources: + - ../../base +images: + - name: ghcr.io/example-org/frontend + newTag: 1.8.3 diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/overlays/staging/kustomization.yaml b/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/overlays/staging/kustomization.yaml new file mode 100644 index 00000000..a1937a1f --- /dev/null +++ b/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/overlays/staging/kustomization.yaml @@ -0,0 +1,11 @@ +# Staging overlay input. Adds a namePrefix and namespace and pins the image +# tag. `kustomize build` on this directory produces rendered/staging/frontend.yaml. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namePrefix: staging- +namespace: frontend-staging +resources: + - ../../base +images: + - name: ghcr.io/example-org/frontend + newTag: 1.9.0-rc.2 diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/src/render.sh b/test/fixtures/gitops-layouts/14-rendered-manifests/src/render.sh new file mode 100644 index 00000000..6b3d9829 --- /dev/null +++ b/test/fixtures/gitops-layouts/14-rendered-manifests/src/render.sh @@ -0,0 +1,21 @@ +#!/usr/bin/env bash +# Renders every overlay with `kustomize build` and writes the plain KRM output +# under rendered//frontend.yaml. The GitOps tool (Argo CD) reads only +# rendered/; it never sees src/. Run from the fixture root. +set -euo pipefail + +overlays_dir="src/frontend/overlays" +out_dir="rendered" +commit="$(git rev-parse --short HEAD)" + +for overlay in "${overlays_dir}"/*/; do + env="$(basename "${overlay}")" + out="${out_dir}/${env}/frontend.yaml" + mkdir -p "$(dirname "${out}")" + { + printf '# Generated by `kustomize build %s`. DO NOT EDIT.\n' "${overlay%/}" + printf '# Source commit: %s. Regenerate with src/render.sh.\n' "${commit}" + kustomize build "${overlay}" + } > "${out}" + echo "rendered ${out}" +done diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/README.md b/test/fixtures/gitops-layouts/15-mixed-and-hostile/README.md new file mode 100644 index 00000000..f843f221 --- /dev/null +++ b/test/fixtures/gitops-layouts/15-mixed-and-hostile/README.md @@ -0,0 +1,108 @@ +# 15-mixed-and-hostile + +## What this is +A deliberately adversarial folder. Nothing here is invented: every trap is +something real repositories have shipped — a `kustomization.yaml` that is a Flux +CR, an `application.yaml` that is a Deployment, Helm values beside manifests, CI +YAML that is not KRM, a JSON manifest, a `.yml` manifest, Go templates with no +chart, a SOPS Secret, and controllers (Crossplane, kro) whose objects embed +other objects. Collected in one place, this fixture exists to break naive +assumptions about what a file "is" from its name, extension, or directory. + +## Layout +``` +15-mixed-and-hostile/ +├── README.md +├── application.yaml # TRAP: apps/v1 Deployment, NOT an Argo Application +├── kustomization.yaml # TRAP: Flux Kustomization CR, NOT a kustomize file +├── values.yaml # TRAP: Helm values, NOT a K8s object +├── ci/ +│ ├── .gitlab-ci.yml # YAML, not KRM (GitLab CI pipeline) +│ └── docker-compose.yml # YAML, not KRM (Docker Compose) +├── mixed/ +│ ├── bundle.yaml # 4 docs: Deployment, non-KRM, empty, Service +│ ├── deployment.json # K8s Deployment in JSON, not YAML +│ └── service.yml # KRM with a .yml extension +├── templates/ +│ └── deployment.yaml # TRAP: Go template, no Chart.yaml — invalid YAML +├── secrets/ +│ └── db.enc.yaml # SOPS-encrypted Secret (fake ciphertext) +├── crossplane/ +│ └── composition.yaml # KRM whose spec embeds full KRM as base +├── kro/ +│ └── resourcegraphdefinition.yaml # KRM whose spec embeds templated KRM +└── empty-dir/ + └── .gitkeep # placeholder for an otherwise-empty dir +``` + +## What makes it structurally distinct +Each trap and the assumption it breaks: + +- **`application.yaml` — filename implies kind.** Named like an Argo CD + Application; it is an `apps/v1` Deployment. The filename tells you nothing + about `kind`. +- **`kustomization.yaml` — a reserved filename implies kustomize config.** It is + a Flux `Kustomization` CR (`kustomize.toolkit.fluxcd.io/v1`), a real cluster + object — not `kustomize.config.k8s.io/v1beta1` build config. Same name, two + APIs. +- **`values.yaml` — YAML implies a Kubernetes object.** It has no + `apiVersion`/`kind`; it is Helm input, applied by no cluster. +- **`ci/.gitlab-ci.yml`, `ci/docker-compose.yml` — a `.yml`/`.yaml` file implies + KRM.** Both are YAML config for other systems entirely; their top-level keys + are job names / Compose services, not Kubernetes fields. +- **`mixed/bundle.yaml` — every `---` chunk implies an object.** Four documents: + a Deployment, a non-KRM config document, an *empty* document (null node), and + a Service. A naive splitter that treats each chunk as KRM mishandles docs 2 + and 3. +- **`mixed/deployment.json` — extension implies format.** A valid Kubernetes + Deployment in JSON. `kubectl` accepts it; a `*.yaml`-only scan never sees it. + (JSON carries no `#` comments, so this trap is documented here, not in-file.) +- **`mixed/service.yml` — a `*.yaml` glob is complete.** A real Service that a + `.yaml`-only matcher skips because it ends in `.yml`. +- **`templates/deployment.yaml` — `.yaml` implies parseable YAML, and + `templates/` implies a Helm chart.** It contains `{{ .Values.replicaCount }}` + and `{{- toYaml .Values.resources | nindent 12 }}`, so it does not parse as + YAML, and there is no `Chart.yaml` anywhere to render it. +- **`secrets/db.enc.yaml` — a YAML file's values are readable.** A SOPS Secret: + structure cleartext, `data` values opaque ciphertext (fake here). +- **`crossplane/composition.yaml` — KRM never nests KRM.** A Crossplane + `Composition` whose `spec.resources[].base` holds full nested manifests. +- **`kro/resourcegraphdefinition.yaml` — KRM never nests KRM (templated).** A kro + `ResourceGraphDefinition` whose `spec.resources[].template` embeds a Deployment + and a Service carrying `${schema.spec.*}` expressions. +- **`empty-dir/` — a directory of YAML implies a manifest directory.** This + directory holds only a `.gitkeep`; it contains no manifests at all. + +Two further traps **cannot be committed as files** and are therefore absent +here, but a real reader must still expect them: + +- **A symlink that escapes the folder.** A repo can contain a symbolic link + pointing at `../../etc/passwd` or at another tree outside this fixture. Git + stores it as a link, not the target's bytes; a tool that follows links can be + walked out of the intended scope. This fixture stores no such link (adding one + to the corpus would be a path-traversal hazard), but the case is real. +- **A genuinely empty directory.** Git cannot track an empty directory at all — + hence the `.gitkeep` above. A directory that exists in someone's working tree + but carries no committed entry is invisible in the repository, so "the set of + directories in Git" is not the same as "the set of directories on disk." + +## Open questions +- If a tool infers `kind` from filename, what does it do with `application.yaml` + and `kustomization.yaml` here — and can it recover once it reads the content? +- When two files claim the reserved name `kustomization.yaml` with different + APIs across the corpus, how does a tool decide which one a directory means? +- Should a scan key on file extension, on a parsed `apiVersion`/`kind`, or on + both — and what happens to `deployment.json` and `service.yml` under each? +- In `bundle.yaml`, how should the non-KRM document and the empty document be + represented: dropped, preserved, round-tripped? Does dropping them change the + file on rewrite? +- `templates/deployment.yaml` does not parse as YAML. Is it in scope for a + manifest tool at all, and how would the tool tell it apart from a corrupt file? +- For the Crossplane and kro files, is the "desired state" the outer object, the + embedded objects, or both? If a tool wants to change the frontend image, does + it edit the nested `base`/`template`, or is that owned by the controller? +- The embedded objects use `${schema.spec.image}` and patch paths, not literal + values. Can a tool reason about the effective running image without evaluating + the controller's templating? +- Given a symlink escaping the folder or a phantom empty directory, what is the + boundary of "this repository" that a tool should refuse to cross? diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/application.yaml b/test/fixtures/gitops-layouts/15-mixed-and-hostile/application.yaml new file mode 100644 index 00000000..30a8aa06 --- /dev/null +++ b/test/fixtures/gitops-layouts/15-mixed-and-hostile/application.yaml @@ -0,0 +1,28 @@ +# TRAP: the filename `application.yaml` suggests an Argo CD Application +# (argoproj.io/v1alpha1). It is an ordinary apps/v1 Deployment. +# Filename does not imply kind. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: backend + labels: + app: backend +spec: + replicas: 2 + selector: + matchLabels: + app: backend + template: + metadata: + labels: + app: backend + spec: + containers: + - name: backend + image: ghcr.io/example-org/backend:2.4.0 + ports: + - containerPort: 8080 + resources: + requests: + cpu: 50m + memory: 64Mi diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/ci/.gitlab-ci.yml b/test/fixtures/gitops-layouts/15-mixed-and-hostile/ci/.gitlab-ci.yml new file mode 100644 index 00000000..58f09536 --- /dev/null +++ b/test/fixtures/gitops-layouts/15-mixed-and-hostile/ci/.gitlab-ci.yml @@ -0,0 +1,17 @@ +# YAML, not KRM. A GitLab CI pipeline definition. No apiVersion/kind; the +# top-level keys are reserved words (stages) and job names (build-image, deploy). +stages: + - build + - deploy + +build-image: + stage: build + image: gcr.io/kaniko-project/executor:latest + script: + - /kaniko/executor --context . --destination ghcr.io/example-org/frontend:$CI_COMMIT_SHORT_SHA + +deploy: + stage: deploy + image: alpine/k8s:1.29.0 + script: + - kubectl apply -f rendered/ diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/ci/docker-compose.yml b/test/fixtures/gitops-layouts/15-mixed-and-hostile/ci/docker-compose.yml new file mode 100644 index 00000000..85b62b53 --- /dev/null +++ b/test/fixtures/gitops-layouts/15-mixed-and-hostile/ci/docker-compose.yml @@ -0,0 +1,12 @@ +# YAML, not KRM. A Docker Compose file. `services:` looks structural but these +# are Compose services, not Kubernetes Services. No apiVersion/kind. +version: "3.9" +services: + frontend: + image: ghcr.io/example-org/frontend:1.8.3 + ports: + - "8080:8080" + backend: + image: ghcr.io/example-org/backend:2.4.0 + depends_on: + - frontend diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/crossplane/composition.yaml b/test/fixtures/gitops-layouts/15-mixed-and-hostile/crossplane/composition.yaml new file mode 100644 index 00000000..d09333d5 --- /dev/null +++ b/test/fixtures/gitops-layouts/15-mixed-and-hostile/crossplane/composition.yaml @@ -0,0 +1,63 @@ +# TRAP: KRM whose spec EMBEDS other KRM as templates. A Crossplane Composition: +# the objects under spec.resources[].base are full manifests nested inside this +# one object. Naive assumption broken: KRM never nests KRM. +apiVersion: apiextensions.crossplane.io/v1 +kind: Composition +metadata: + name: frontend-platform +spec: + compositeTypeRef: + apiVersion: platform.example-org.io/v1alpha1 + kind: XFrontend + resources: + - name: deployment + base: + # A full Kubernetes object nested inside the Composition's spec. + apiVersion: kubernetes.crossplane.io/v1alpha2 + kind: Object + spec: + forProvider: + manifest: + apiVersion: apps/v1 + kind: Deployment + metadata: + name: frontend + labels: + app: frontend + spec: + replicas: 2 + selector: + matchLabels: + app: frontend + template: + metadata: + labels: + app: frontend + spec: + containers: + - name: frontend + image: ghcr.io/example-org/frontend:1.8.3 + ports: + - containerPort: 8080 + patches: + - fromFieldPath: spec.replicas + toFieldPath: spec.forProvider.manifest.spec.replicas + - name: service + base: + apiVersion: kubernetes.crossplane.io/v1alpha2 + kind: Object + spec: + forProvider: + manifest: + apiVersion: v1 + kind: Service + metadata: + name: frontend + labels: + app: frontend + spec: + selector: + app: frontend + ports: + - port: 80 + targetPort: 8080 diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/empty-dir/.gitkeep b/test/fixtures/gitops-layouts/15-mixed-and-hostile/empty-dir/.gitkeep new file mode 100644 index 00000000..2b5dafc4 --- /dev/null +++ b/test/fixtures/gitops-layouts/15-mixed-and-hostile/empty-dir/.gitkeep @@ -0,0 +1,2 @@ +# Placeholder so git tracks this otherwise-empty directory. A truly empty +# directory cannot be committed to git; this file is the workaround. diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/kro/resourcegraphdefinition.yaml b/test/fixtures/gitops-layouts/15-mixed-and-hostile/kro/resourcegraphdefinition.yaml new file mode 100644 index 00000000..d56cc2d0 --- /dev/null +++ b/test/fixtures/gitops-layouts/15-mixed-and-hostile/kro/resourcegraphdefinition.yaml @@ -0,0 +1,53 @@ +# TRAP: KRM whose spec embeds templated KRM. A kro ResourceGraphDefinition: +# each spec.resources[].template is a full Kubernetes object with ${schema.spec.*} +# expressions resolved by the kro controller at instantiation. KRM nesting +# templated KRM; the `${...}` values are plain YAML scalars until kro resolves them. +apiVersion: kro.run/v1alpha1 +kind: ResourceGraphDefinition +metadata: + name: frontend +spec: + schema: + apiVersion: v1alpha1 + kind: Frontend + spec: + replicas: integer | default=2 + image: string | default="ghcr.io/example-org/frontend:1.8.3" + resources: + - id: deployment + template: + apiVersion: apps/v1 + kind: Deployment + metadata: + name: frontend + labels: + app: frontend + spec: + replicas: ${schema.spec.replicas} + selector: + matchLabels: + app: frontend + template: + metadata: + labels: + app: frontend + spec: + containers: + - name: frontend + image: ${schema.spec.image} + ports: + - containerPort: 8080 + - id: service + template: + apiVersion: v1 + kind: Service + metadata: + name: frontend + labels: + app: frontend + spec: + selector: + app: frontend + ports: + - port: 80 + targetPort: 8080 diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/kustomization.yaml b/test/fixtures/gitops-layouts/15-mixed-and-hostile/kustomization.yaml new file mode 100644 index 00000000..285be789 --- /dev/null +++ b/test/fixtures/gitops-layouts/15-mixed-and-hostile/kustomization.yaml @@ -0,0 +1,17 @@ +# TRAP: `kustomization.yaml` is the filename kustomize reserves for its build +# config (kustomize.config.k8s.io/v1beta1). This file is instead a Flux +# Kustomization custom resource (kustomize.toolkit.fluxcd.io/v1) — a real +# Kubernetes object the API server stores and reconciles. Same reserved +# filename, entirely different API and meaning. (Fixture 09's collision, hostile.) +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: apps + namespace: flux-system +spec: + interval: 10m + path: ./apps + prune: true + sourceRef: + kind: GitRepository + name: gitops diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/mixed/bundle.yaml b/test/fixtures/gitops-layouts/15-mixed-and-hostile/mixed/bundle.yaml new file mode 100644 index 00000000..0603bcc6 --- /dev/null +++ b/test/fixtures/gitops-layouts/15-mixed-and-hostile/mixed/bundle.yaml @@ -0,0 +1,47 @@ +# Document 1 of 4: a real apps/v1 Deployment. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend + labels: + app: frontend +spec: + replicas: 2 + selector: + matchLabels: + app: frontend + template: + metadata: + labels: + app: frontend + spec: + containers: + - name: frontend + image: ghcr.io/example-org/frontend:1.8.3 + ports: + - containerPort: 8080 +--- +# Document 2 of 4: plain configuration, NOT a Kubernetes object. No apiVersion, +# no kind. A YAML stream may carry arbitrary documents between the KRM ones. +settings: + logLevel: info + featureFlags: + - canary + - new-ui +--- +# Document 3 of 4: an empty document. Valid YAML; it yields a null node and +# contributes no object. A splitter that assumes every `---` chunk is KRM breaks here. +--- +# Document 4 of 4: a real v1 Service. +apiVersion: v1 +kind: Service +metadata: + name: frontend + labels: + app: frontend +spec: + selector: + app: frontend + ports: + - port: 80 + targetPort: 8080 diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/mixed/deployment.json b/test/fixtures/gitops-layouts/15-mixed-and-hostile/mixed/deployment.json new file mode 100644 index 00000000..2ae8d7a1 --- /dev/null +++ b/test/fixtures/gitops-layouts/15-mixed-and-hostile/mixed/deployment.json @@ -0,0 +1,38 @@ +{ + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "name": "backend", + "labels": { + "app": "backend" + } + }, + "spec": { + "replicas": 2, + "selector": { + "matchLabels": { + "app": "backend" + } + }, + "template": { + "metadata": { + "labels": { + "app": "backend" + } + }, + "spec": { + "containers": [ + { + "name": "backend", + "image": "ghcr.io/example-org/backend:2.4.0", + "ports": [ + { + "containerPort": 8080 + } + ] + } + ] + } + } + } +} diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/mixed/service.yml b/test/fixtures/gitops-layouts/15-mixed-and-hostile/mixed/service.yml new file mode 100644 index 00000000..cab54f7e --- /dev/null +++ b/test/fixtures/gitops-layouts/15-mixed-and-hostile/mixed/service.yml @@ -0,0 +1,14 @@ +# KRM with a `.yml` extension (not `.yaml`). A tool that globs only `*.yaml` +# misses a real Kubernetes object. Extension does not imply presence/absence of KRM. +apiVersion: v1 +kind: Service +metadata: + name: backend + labels: + app: backend +spec: + selector: + app: backend + ports: + - port: 80 + targetPort: 8080 diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/secrets/db.enc.yaml b/test/fixtures/gitops-layouts/15-mixed-and-hostile/secrets/db.enc.yaml new file mode 100644 index 00000000..7e0edf60 --- /dev/null +++ b/test/fixtures/gitops-layouts/15-mixed-and-hostile/secrets/db.enc.yaml @@ -0,0 +1,32 @@ +# SOPS-encrypted Secret (same shape as fixture 13). metadata/type are cleartext; +# the values under `data` are FAKE ciphertext and the `sops:` block is FAKE. +# NOT REAL. A `.enc.yaml` here is a plain YAML file whose values are opaque. +apiVersion: v1 +kind: Secret +metadata: + name: db-credentials + namespace: backend +type: Opaque +data: + # Fake ciphertext. + username: ENC[AES256_GCM,data:T6hG3xJ5aB2c,iv:bN8wL2rM0cY1zE9fH4iA3pQ6,tag:nV9kD3sT6hG9xJ2bN5wL,type:str] + password: ENC[AES256_GCM,data:3sT6hG9xJ2bN,iv:5wL8rM1cY4zE7fH0iA3pQ6nV,tag:9kD3sT6hG9xJ2bN5wL8r,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p + # Fake armored age key-wrap block. NOT REAL. + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBub3QtYS1yZWFsLWtleQpo + b3N0aWxlLWZpeHR1cmUtZmFrZS1iYXNlNjQtc29wcy13cmFwLWtleS1kYXRhLW5v + dC1yZWFsLWRvLW5vdC11c2UK + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-07-10T09:00:00Z" + # Fake MAC. NOT REAL. + mac: ENC[AES256_GCM,data:xJ2bN5wL8rM1cY4z,iv:E7fH0iA3pQ6nV9kD3sT6hG9x,tag:J2bN5wL8rM1cY4zE7fH0,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.9.0 diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/templates/deployment.yaml b/test/fixtures/gitops-layouts/15-mixed-and-hostile/templates/deployment.yaml new file mode 100644 index 00000000..bd3ca2ff --- /dev/null +++ b/test/fixtures/gitops-layouts/15-mixed-and-hostile/templates/deployment.yaml @@ -0,0 +1,27 @@ +# TRAP: Go template syntax with NO Chart.yaml anywhere in this repo. The `{{ }}` +# actions make this INVALID YAML until a templating engine renders it. A YAML +# parser fails on `replicas: {{ .Values.replicaCount }}`. A `templates/` dir +# does not imply a Helm chart, and `.yaml` here does not imply parseable YAML. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend + labels: + app: frontend +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app: frontend + template: + metadata: + labels: + app: frontend + spec: + containers: + - name: frontend + image: {{ .Values.image.repository }}:{{ .Values.image.tag }} + ports: + - containerPort: 8080 + resources: + {{- toYaml .Values.resources | nindent 12 }} diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/values.yaml b/test/fixtures/gitops-layouts/15-mixed-and-hostile/values.yaml new file mode 100644 index 00000000..af1b6c81 --- /dev/null +++ b/test/fixtures/gitops-layouts/15-mixed-and-hostile/values.yaml @@ -0,0 +1,14 @@ +# TRAP: Helm values sitting beside real manifests. This is NOT a Kubernetes +# object — no apiVersion, no kind. It is input to `helm template`, and is +# meaningless to `kubectl apply`. YAML does not imply a manifest. +replicaCount: 3 +image: + repository: ghcr.io/example-org/frontend + tag: 1.8.3 +resources: + requests: + cpu: 50m + memory: 64Mi +service: + type: ClusterIP + port: 80 diff --git a/test/fixtures/gitops-layouts/README.md b/test/fixtures/gitops-layouts/README.md new file mode 100644 index 00000000..e742719e --- /dev/null +++ b/test/fixtures/gitops-layouts/README.md @@ -0,0 +1,118 @@ +# GitOps layout fixtures + +Real-world GitOps repository layouts, checked in so we can design and reason +against concrete examples instead of prose. + +> **These fixtures record no conclusions.** Nothing here says which layouts +> GitOps Reverser supports, accepts, or refuses. Each fixture describes *what a +> layout is* and *what questions it raises*. Deciding the answers — and pinning +> them as golden reports — is deliberately a later step. + +## Why this exists + +The compatibility question "does GitOps Reverser support Argo CD / Flux +repositories?" is the wrong question, because Argo CD and Flux are mostly +orchestration *around* folders. The real boundary is determined by **what a +folder contains and how it is rendered**, not by which controller points at it. + +To find that boundary honestly we need the actual shapes users have. This corpus +is that set of shapes. + +The first-class target — a path whose checked-in files *are* the desired +Kubernetes objects, rather than inputs that must first be rendered — is only one +of the layouts below. The others exist so the edges are visible. + +## Reading the corpus + +Each fixture directory holds a self-contained example repository plus a +`README.md` with four sections: + +| Section | Contains | +|---|---| +| What this is | The real-world pattern and who uses it | +| Layout | A tree of the fixture | +| What makes it structurally distinct | The discriminating facts, including every file that is YAML but *not* a Kubernetes object | +| Open questions | Unanswered questions the layout poses | + +## The fixtures + +| # | Fixture | Structural axis it isolates | +|---|---|---| +| 01 | [01-argocd-plain](01-argocd-plain/) | A directory of plain KRM; multi-doc files, arbitrary filenames, non-manifest YAML, `directory.include`/`exclude` globs | +| 02 | [02-argocd-app-of-apps](02-argocd-app-of-apps/) | An `Application` that *describes* a deployment vs. the manifests it *references* vs. an ordinary object merely named `application.yaml` | +| 03 | [03-argocd-applicationset-directories](03-argocd-applicationset-directories/) | Directory names *become* Applications; wildcards, exclusions, an empty directory, a directory with no manifests, a nested app directory `apps/*` misses | +| 04 | [04-argocd-applicationset-files](04-argocd-applicationset-files/) | YAML that is **not KRM at all** — ApplicationSet generator input, beside a Helm chart | +| 05 | [05-kustomize-overlays](05-kustomize-overlays/) | `base/` + `overlays//`; patches, `configMapGenerator`, `secretGenerator`, `namespace`, `namePrefix`, `images`, `replicas`, and a remote base | +| 06 | [06-helm-chart](06-helm-chart/) | The standard chart format: `templates/` is not KRM, `crds/` is, `values.yaml` is not, `values.schema.json` carries type information | +| 07 | [07-helm-environment-values](07-helm-environment-values/) | Effective config as a **merge** of chart defaults + common + environment + inline parameters | +| 08 | [08-argocd-external-helm](08-argocd-external-helm/) | Chart lives in an external registry; the repo holds Applications, versions, values, and stray plain manifests — three natures in one folder | +| 09 | [09-flux-monorepo](09-flux-monorepo/) | `apps/` + `infrastructure/` + `clusters/`; the strongest Flux fingerprint, and the `Kustomization` CR vs. `kustomization.yaml` collision | +| 10 | [10-flux-helmrelease](10-flux-helmrelease/) | Helm values inside CRDs — five delivery mechanisms — plus `postBuild.substitute` and `targetNamespace` injected from outside the folder | +| 11 | [11-repo-per-environment](11-repo-per-environment/) | The environment boundary is a **repository** boundary; no shared base exists in Git | +| 12 | [12-multicluster-applicationset](12-multicluster-applicationset/) | A cluster × app matrix: one folder renders N times, with a sparse per-cluster values matrix | +| 13 | [13-sops-encrypted](13-sops-encrypted/) | A file that is simultaneously a valid Kubernetes object and unreadable: cleartext `metadata`, opaque `data` | +| 14 | [14-rendered-manifests](14-rendered-manifests/) | Git holds generated output, not sources; hash-suffixed names with no stable origin | +| 15 | [15-mixed-and-hostile](15-mixed-and-hostile/) | Every naive assumption broken at once — filename implies kind, extension implies format, YAML implies KRM, KRM never nests KRM | + +## The layout dimensions underneath + +Repositories organise primarily around one of four axes, and serious ones combine +two or three. The fixtures above are instances of these combinations; there is no +universal standard that says which is correct. + +- **Application-first** — `apps//` +- **Environment-first** — `environments///` +- **Cluster-first** — `clusters///` +- **Team-first** — `teams///` + +Of the three ecosystems, only one is genuinely standardised: **Helm charts** have +a strict directory format. **Flux** has a documented convention that `flux +bootstrap` reinforces (`clusters//flux-system/`). **Argo CD** has no +canonical structure at all — its common shapes emerge from App of Apps, +ApplicationSets, Kustomize, and Helm value-file patterns. + +## Deliberately absent + +Two hostile cases cannot be represented as committed files, and are described in +prose inside [15-mixed-and-hostile](15-mixed-and-hostile/) instead: + +- a **symlink** escaping the folder +- a genuinely **empty directory** (git cannot store one; the fixtures use `.gitkeep`) + +Also out of scope for now: Jsonnet sources, Argo CD config-management plugins, +and Kustomize `components`. + +## Conventions + +Fixtures share names so they can be compared: apps `frontend` / `backend` / +`worker`, images under `ghcr.io/example-org/`, environments `dev` / `staging` / +`production`, and repo `https://github.com/example-org/gitops.git`. + +Every credential, token, key, and ciphertext is **fake** and marked as such. The +`age` recipients are public keys from upstream documentation; the SOPS blocks are +structurally correct with placeholder ciphertext. + +`05-kustomize-overlays` checks in a `secrets.env` file on purpose, so the root +[`.gitignore`](../../../.gitignore) carries a scoped `!test/fixtures/gitops-layouts/**/*.env` +negation for it. + +## Relationship to the other corpora + +This corpus is **descriptive** and drives no test. Two sibling corpora already +exist and *are* assertion-driven — do not duplicate them here: + +- [`internal/manifestanalyzer/testdata/scan-repo/`](../../../internal/manifestanalyzer/testdata/scan-repo/) — + repo-discovery fixtures, each with a golden JSON report. +- [`internal/manifestanalyzer/testdata/contextual-namespace/`](../../../internal/manifestanalyzer/testdata/contextual-namespace/) — + the supported/unsupported boundary for kustomize-inherited namespaces. + +When a layout here graduates into a decision, that decision belongs in one of +those corpora (as an assertion) and in +[`docs/design/gitops-api/`](../../../docs/design/gitops-api/) (as the reasoning). + +## Adding a fixture + +Add one whenever a new "can we handle X?" question comes up and the existing +fixtures cannot express it. Keep it small, keep it real — real apiVersions, real +chart names, plausible images — follow the four-section README, and resist +recording a verdict. From f1ab8dbebcca200c56c84a5ace1840d175ab9094 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Fri, 10 Jul 2026 10:17:17 +0000 Subject: [PATCH 03/28] test(fixtures): make the Helm charts real, fix four layout bugs, add image automation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review pass on the corpus. The fixtures claim to be realistic, so they should survive the tools that consume these shapes. Correctness: - Two charts did not lint. Go's template parser reads {{ ... }} inside YAML comments too, so the very comment explaining "this is a template" broke the chart. Reword both; 06 now says why an example action cannot appear there. - Fixture 04's chart called include "tenant-app.fullname" and shipped no _helpers.tpl to define it. Add one. All three charts now `helm lint` clean, and 04 and 07 `helm template` offline. 06 declares an unvendored redis subchart, so it needs `helm dependency build` first — the normal state of a real chart repo, now stated in its README. - Fixture 07's Argo CD Applications pointed at 07-helm-environment-values/chart. Every other fixture treats its own directory as the repo root, so the path resolved nowhere. It is `chart`. - Fixture 12 set goTemplate: false while templating dotted variables like {{.path.basename}}, which only the Go engine resolves. It is true now, with goTemplateOptions, and a comment on why the two syntaxes are not interchangeable. - Fixture 15's Flux Kustomization pointed at ./apps, which does not exist there — an undocumented second failure mode on top of the intended filename collision. Point it at ./mixed, and document that its GitRepository sourceRef resolving outside the folder is deliberate, not a defect. - render.sh had a shebang and mode 100644. It is executable. New coverage — the repository has other writers: - 16-flux-image-automation: ImageRepository, ImagePolicy, ImageUpdateAutomation. A controller clones the repo, rewrites image tags, and pushes a commit, so Git is an output as well as an input. The tag is marked by a # {"$imagepolicy": "flux-system:frontend"} setter — a load-bearing YAML comment whose loss silently disables automation, and a cross-object reference expressed as a string no schema validates. - .argocd-source.yaml (path-wide) and .argocd-source-.yaml (per-app) are hidden dotfiles merged over an Argo CD Application's spec.source, outranking the values and transformers a reader would inspect. Added to 07, where it beats the Application's own helm.parameters, and to 05, where Argo CD Image Updater writes and commits it — the Argo analogue of ImageUpdateAutomation. The F8 design doc records the question these raise and does not answer it: comment-preserving in-place editing is necessary but may not be sufficient when another controller commits to the same branch. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../f8-repo-discovery-and-onboarding-scan.md | 13 +++- .../chart/templates/_helpers.tpl | 35 +++++++++ .../chart/templates/service.yaml | 2 +- .../05-kustomize-overlays/README.md | 22 +++++- .../.argocd-source-frontend-production.yaml | 14 ++++ .../gitops-layouts/06-helm-chart/README.md | 9 +++ .../charts/frontend/templates/deployment.yaml | 4 +- .../07-helm-environment-values/README.md | 16 +++++ .../argocd/dev.yaml | 2 +- .../argocd/production.yaml | 2 +- .../chart/.argocd-source.yaml | 19 +++++ .../applicationsets/cluster-matrix.yaml | 8 ++- .../14-rendered-manifests/src/render.sh | 0 .../15-mixed-and-hostile/kustomization.yaml | 8 ++- .../16-flux-image-automation/README.md | 72 +++++++++++++++++++ .../apps/frontend/deployment.yaml | 35 +++++++++ .../apps/frontend/kustomization.yaml | 7 ++ .../apps/frontend/service.yaml | 15 ++++ .../clusters/production/apps.yaml | 16 +++++ .../clusters/production/image-automation.yaml | 12 ++++ .../clusters/production/kustomization.yaml | 5 ++ .../image-automation/imagepolicy.yaml | 21 ++++++ .../image-automation/imagerepository.yaml | 14 ++++ .../imageupdateautomation.yaml | 34 +++++++++ .../image-automation/kustomization.yaml | 7 ++ test/fixtures/gitops-layouts/README.md | 43 ++++++++++- 26 files changed, 421 insertions(+), 14 deletions(-) create mode 100644 test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/_helpers.tpl create mode 100644 test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/.argocd-source-frontend-production.yaml create mode 100644 test/fixtures/gitops-layouts/07-helm-environment-values/chart/.argocd-source.yaml mode change 100644 => 100755 test/fixtures/gitops-layouts/14-rendered-manifests/src/render.sh create mode 100644 test/fixtures/gitops-layouts/16-flux-image-automation/README.md create mode 100644 test/fixtures/gitops-layouts/16-flux-image-automation/apps/frontend/deployment.yaml create mode 100644 test/fixtures/gitops-layouts/16-flux-image-automation/apps/frontend/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/16-flux-image-automation/apps/frontend/service.yaml create mode 100644 test/fixtures/gitops-layouts/16-flux-image-automation/clusters/production/apps.yaml create mode 100644 test/fixtures/gitops-layouts/16-flux-image-automation/clusters/production/image-automation.yaml create mode 100644 test/fixtures/gitops-layouts/16-flux-image-automation/clusters/production/kustomization.yaml create mode 100644 test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/imagepolicy.yaml create mode 100644 test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/imagerepository.yaml create mode 100644 test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/imageupdateautomation.yaml create mode 100644 test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/kustomization.yaml diff --git a/docs/design/gitops-api/f8-repo-discovery-and-onboarding-scan.md b/docs/design/gitops-api/f8-repo-discovery-and-onboarding-scan.md index d727770e..81770185 100644 --- a/docs/design/gitops-api/f8-repo-discovery-and-onboarding-scan.md +++ b/docs/design/gitops-api/f8-repo-discovery-and-onboarding-scan.md @@ -363,9 +363,16 @@ nested base (deduped `rendered`), an overlay base holding parked YAML (excluded [`test/fixtures/gitops-layouts/`](../../../test/fixtures/gitops-layouts/): Argo CD plain directories, App of Apps, both ApplicationSet generators, kustomize overlays, Helm charts and per-environment values, the Flux monorepo and `HelmRelease` shapes, - repo-per-environment, a cluster×app matrix, SOPS, committed rendered manifests, and a - hostile mixed folder. It records **no verdicts** — it is the input to deciding them. When a - layout there graduates into a decision, it gains a golden report under `scan-repo/` above. + repo-per-environment, a cluster×app matrix, SOPS, committed rendered manifests, Flux image + automation, and a hostile mixed folder. It records **no verdicts** — it is the input to + deciding them. When a layout there graduates into a decision, it gains a golden report + under `scan-repo/` above. +- Two of those fixtures raise a question this design does not yet answer: **the repository has + other writers.** Flux's `ImageUpdateAutomation` and Argo CD Image Updater both commit to the + same branch a `GitTarget` writes, and both depend on constructs a naive rewrite destroys — a + `# {"$imagepolicy": ...}` setter comment on the image line, and a hidden + `.argocd-source-.yaml` that outranks the kustomization. Comment-preserving in-place + editing is necessary but may not be sufficient; concurrent writers need a story of their own. ## Open questions diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/_helpers.tpl b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/_helpers.tpl new file mode 100644 index 00000000..7a0fabca --- /dev/null +++ b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/_helpers.tpl @@ -0,0 +1,35 @@ +{{/* +Template helpers. This file defines named templates and renders no object of its +own; the leading underscore keeps Helm from treating it as a manifest source. +*/}} + +{{- define "tenant-app.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- define "tenant-app.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{- define "tenant-app.labels" -}} +helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{ include "tenant-app.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end -}} + +{{- define "tenant-app.selectorLabels" -}} +app.kubernetes.io/name: {{ include "tenant-app.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end -}} diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/service.yaml b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/service.yaml index f1910b65..8c7575b1 100644 --- a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/service.yaml +++ b/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/service.yaml @@ -1,4 +1,4 @@ -# Helm template. Not valid YAML until Helm renders the {{ ... }} actions. +# Helm template. Not valid YAML until Helm renders its template actions. apiVersion: v1 kind: Service metadata: diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/README.md b/test/fixtures/gitops-layouts/05-kustomize-overlays/README.md index b811b221..5ce6c91d 100644 --- a/test/fixtures/gitops-layouts/05-kustomize-overlays/README.md +++ b/test/fixtures/gitops-layouts/05-kustomize-overlays/README.md @@ -26,6 +26,9 @@ overlay instead builds on a **remote** base fetched from another repository. │ │ ├── deployment-patch.yaml# partial object (strategic merge) │ │ └── config.properties # NOT YAML - key=value env file │ └── production/ + │ ├── .argocd-source-frontend-production.yaml + │ │ # HIDDEN Argo CD override, written by + │ │ # Image Updater (NOT a K8s object) │ ├── kustomization.yaml # namespace, nameSuffix, replicas, │ │ # images(newName+newTag), patch, │ │ # cmGenerator, secretGenerator @@ -72,6 +75,15 @@ overlay instead builds on a **remote** base fetched from another repository. `apps/backend/overlays/production/kustomization.yaml` references `github.com/example-org/gitops//apps/backend/base?ref=v1.4.0`. That base is not in this checkout; kustomize fetches it over the network at a pinned ref. +- **A hidden dotfile overrides the kustomization, and a controller writes it.** + `.argocd-source-frontend-production.yaml` is an Argo CD source override scoped + to the Application named `frontend-production`. Its `kustomize.images` entry + beats the `images:` transformer in the sibling `kustomization.yaml`, so the + image that actually deploys is decided by a file a reader inspecting the + kustomization never opens. Argo CD Image Updater *writes and commits* this file + on its own, which makes Git an output of the cluster here, exactly as Flux's + `ImageUpdateAutomation` does in [16-flux-image-automation](../16-flux-image-automation/). + It is not a Kubernetes object: no `apiVersion`, no `kind`. ## Open questions - Which files could a tool safely edit in place and round-trip? The base @@ -81,9 +93,13 @@ overlay instead builds on a **remote** base fetched from another repository. - If a tool observes a running `ConfigMap` named `frontend-config-abc12`, how would it map that hash-suffixed name back to `config.properties`, and what does it write when the desired content changes (the hash then changes too)? -- Where does an image bump belong: the base `deployment.yaml` `image:` field, or - the overlay `images:` override? For production the override uses `newName`, so - the running image string appears in *no* base file. +- Where does an image bump belong: the base `deployment.yaml` `image:` field, the + overlay `images:` override, or the `.argocd-source-*.yaml` that outranks both? + For production the override uses `newName`, so the running image string appears + in *no* base file. +- If a controller commits `.argocd-source-frontend-production.yaml` on its own + schedule, is that file safe for anything else to edit — and how should a tool + that does not know Argo CD's precedence rules report the effective image? - For `backend` production, the base is remote and pinned to `ref=v1.4.0`. Can a tool reason about, or edit, desired state it does not have checked out — and is bumping `ref` the only in-repo change available? diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/.argocd-source-frontend-production.yaml b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/.argocd-source-frontend-production.yaml new file mode 100644 index 00000000..128f1e58 --- /dev/null +++ b/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/.argocd-source-frontend-production.yaml @@ -0,0 +1,14 @@ +# Argo CD source override, scoped to the Application named `frontend-production`. +# Written and rewritten by Argo CD Image Updater, which commits it back to this +# repository whenever it selects a newer tag - the Argo CD analogue of Flux's +# ImageUpdateAutomation (fixture 16). Git is an output here, not only an input. +# +# NOT a Kubernetes object: no apiVersion, no kind. It is a fragment of an Argo CD +# Application's `spec.source`, merged over whatever the Application declares. +# +# The `images` entry below silently overrides the `images:` transformer in this +# folder's kustomization.yaml, so the rendered image is decided by this hidden +# dotfile rather than by the kustomization a reader would naturally inspect. +kustomize: + images: + - ghcr.io/example-org/frontend-hardened:1.8.4 diff --git a/test/fixtures/gitops-layouts/06-helm-chart/README.md b/test/fixtures/gitops-layouts/06-helm-chart/README.md index 9e6f5600..57db7961 100644 --- a/test/fixtures/gitops-layouts/06-helm-chart/README.md +++ b/test/fixtures/gitops-layouts/06-helm-chart/README.md @@ -59,6 +59,15 @@ The chart here is `frontend`, with a conditional `redis` subchart dependency. - **`Chart.yaml` and `Chart.lock` are metadata, not objects.** There is no `kind: Chart` in the Kubernetes API. `Chart.lock` is machine-managed and pins the `redis` dependency to a resolved version and digest. +- **The chart is valid but not renderable offline.** `helm lint` passes; `helm + template` fails with "found in Chart.yaml, but missing in charts/ directory: + redis" until `helm dependency build` fetches the subchart over the network. + This is the normal state of a real chart repository, which vendors `charts/` + rarely if ever — so a folder's object set is not derivable from its bytes alone. +- **A template action inside a YAML comment is still a template action.** Helm + parses the whole file, comments included, so a `#` comment containing example + braces is a parse error, not documentation. The template comments here are + worded to avoid it. - **`_helpers.tpl` and `NOTES.txt` render no object.** The `_`-prefixed partial is a template library included by other files; `NOTES.txt` is plain text shown after install. Neither becomes a resource. diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/deployment.yaml b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/deployment.yaml index a02ae5c0..38f55f4c 100644 --- a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/deployment.yaml +++ b/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/deployment.yaml @@ -1,5 +1,7 @@ # A Helm template, NOT plain KRM. As stored this file does not parse as a valid -# Deployment: the {{ ... }} actions must be rendered against .Values first. +# Deployment: its template actions must be rendered against .Values first. +# This comment spells out no example action on purpose - Helm parses actions +# inside YAML comments too, so an example here would fail to parse the chart. apiVersion: apps/v1 kind: Deployment metadata: diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/README.md b/test/fixtures/gitops-layouts/07-helm-environment-values/README.md index ea649383..970c1747 100644 --- a/test/fixtures/gitops-layouts/07-helm-environment-values/README.md +++ b/test/fixtures/gitops-layouts/07-helm-environment-values/README.md @@ -16,6 +16,7 @@ environment — the environments differ only in which values get layered on top. 07-helm-environment-values/ ├── README.md ├── chart/ +│ ├── .argocd-source.yaml # HIDDEN Argo CD source override (NOT a K8s object) │ ├── Chart.yaml # chart metadata (NOT a K8s object) │ ├── values.yaml # chart defaults, lowest merge layer │ └── templates/ @@ -39,6 +40,15 @@ environment — the environments differ only in which values get layered on top. - **Layer order is precedence.** In `valueFiles`, later wins over earlier, and every file wins over the chart's own `values.yaml`. `helm.parameters` wins over all of them. The order of the two lines under `valueFiles` is load-bearing. +- **A hidden dotfile is the outermost layer.** `chart/.argocd-source.yaml` is an + Argo CD *source override*: Argo CD reads it from the Application's source path + and merges it over `spec.source`. It therefore beats the `helm.parameters` + written in `argocd/production.yaml`, and the image tag that actually deploys is + the `1.8.4` in the dotfile, not the `1.8.3` in the Application. It carries no + `apiVersion`/`kind`; its top-level keys are Application `spec.source` fields. + A sibling `.argocd-source-.yaml` targets one named Application and + wins over the path-wide file. A directory listing that hides dotfiles shows + none of this. - **The same key is deliberately set in more than one layer.** `image.tag` appears in `chart/values.yaml` but is intentionally omitted from the environment value files and instead pinned inline per environment @@ -80,3 +90,9 @@ they differ only in where the override files sit relative to the chart. - The flat `values-dev.yaml` and the in-chart nested `values/` conventions carry the same intent as this layout — should all three be recognized as the same pattern, or treated as structurally different sources? +- `.argocd-source.yaml` is deployment-affecting configuration that a scanner + ignoring dotfiles never sees, and that a scanner treating all YAML as KRM would + misclassify as a malformed object. Which is the worse failure? +- Reporting the effective image tag for this folder requires knowing that a + hidden file overrides the Application. Can that be discovered structurally, or + only by encoding Argo CD's precedence rules? diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/argocd/dev.yaml b/test/fixtures/gitops-layouts/07-helm-environment-values/argocd/dev.yaml index 1a36d6c4..20e518a9 100644 --- a/test/fixtures/gitops-layouts/07-helm-environment-values/argocd/dev.yaml +++ b/test/fixtures/gitops-layouts/07-helm-environment-values/argocd/dev.yaml @@ -11,7 +11,7 @@ spec: source: repoURL: https://github.com/example-org/gitops.git targetRevision: main - path: 07-helm-environment-values/chart + path: chart helm: # Applied lowest-to-highest precedence: a later file overrides an earlier # one, and both override the chart's own values.yaml. diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/argocd/production.yaml b/test/fixtures/gitops-layouts/07-helm-environment-values/argocd/production.yaml index ef17db5d..f5f0e45f 100644 --- a/test/fixtures/gitops-layouts/07-helm-environment-values/argocd/production.yaml +++ b/test/fixtures/gitops-layouts/07-helm-environment-values/argocd/production.yaml @@ -11,7 +11,7 @@ spec: source: repoURL: https://github.com/example-org/gitops.git targetRevision: main - path: 07-helm-environment-values/chart + path: chart helm: valueFiles: - ../values/common.yaml diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/chart/.argocd-source.yaml b/test/fixtures/gitops-layouts/07-helm-environment-values/chart/.argocd-source.yaml new file mode 100644 index 00000000..f6422190 --- /dev/null +++ b/test/fixtures/gitops-layouts/07-helm-environment-values/chart/.argocd-source.yaml @@ -0,0 +1,19 @@ +# Argo CD source override. A HIDDEN dotfile that changes what gets deployed. +# +# Argo CD reads `.argocd-source.yaml` from the Application's source path and +# merges it over `spec.source` in the Application manifest. It applies to EVERY +# Application whose path is this directory. A file named +# `.argocd-source-.yaml` targets one named Application and wins over +# this one. +# +# It is not a Kubernetes object: no apiVersion, no kind. Its top-level keys are +# the fields of an Argo CD Application's `spec.source`. +# +# Consequence for this fixture: the effective image tag is NOT the "1.8.3" that +# argocd/production.yaml sets in spec.source.helm.parameters. It is the value +# below, because this file is merged over that. +helm: + parameters: + - name: image.tag + value: "1.8.4" + forceString: true diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/applicationsets/cluster-matrix.yaml b/test/fixtures/gitops-layouts/12-multicluster-applicationset/applicationsets/cluster-matrix.yaml index 9749884e..674ab48a 100644 --- a/test/fixtures/gitops-layouts/12-multicluster-applicationset/applicationsets/cluster-matrix.yaml +++ b/test/fixtures/gitops-layouts/12-multicluster-applicationset/applicationsets/cluster-matrix.yaml @@ -4,7 +4,13 @@ metadata: name: cluster-matrix namespace: argocd spec: - goTemplate: false + # The template below uses dotted Go-template variables such as {{.path.basename}}, + # so goTemplate MUST be true. Under the legacy (fasttemplate) engine the parameter + # names are flat - {{path.basename}} - and the dotted form never resolves. The two + # syntaxes are not interchangeable. + goTemplate: true + goTemplateOptions: + - missingkey=error generators: # Matrix = Cartesian product of the two nested generators below. # Rendered Applications = (selected clusters) x (app directories), a product not a sum. diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/src/render.sh b/test/fixtures/gitops-layouts/14-rendered-manifests/src/render.sh old mode 100644 new mode 100755 diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/kustomization.yaml b/test/fixtures/gitops-layouts/15-mixed-and-hostile/kustomization.yaml index 285be789..5dc50cee 100644 --- a/test/fixtures/gitops-layouts/15-mixed-and-hostile/kustomization.yaml +++ b/test/fixtures/gitops-layouts/15-mixed-and-hostile/kustomization.yaml @@ -10,8 +10,14 @@ metadata: namespace: flux-system spec: interval: 10m - path: ./apps + # Points at ./mixed, a directory that does exist here, so the only trap in this + # file is the filename collision above - not a dangling path. + path: ./mixed prune: true + # The GitRepository named `gitops` is NOT defined anywhere in this fixture. That + # is deliberate and realistic: a Flux Kustomization names a source object that + # lives in the cluster, created from some other folder or out of band entirely. + # A reference resolving outside the folder is normal, not a defect. sourceRef: kind: GitRepository name: gitops diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/README.md b/test/fixtures/gitops-layouts/16-flux-image-automation/README.md new file mode 100644 index 00000000..4e133fdc --- /dev/null +++ b/test/fixtures/gitops-layouts/16-flux-image-automation/README.md @@ -0,0 +1,72 @@ +# 16-flux-image-automation + +## What this is +Flux's image automation: `ImageRepository` scans a container registry, +`ImagePolicy` picks one tag, and `ImageUpdateAutomation` **writes that tag back +into the Git repository and pushes a commit**. + +This is the one fixture in the corpus where a controller is a *writer* of the +repository rather than only a reader of it. Anything else that edits these files +shares the repo with a non-human committer that runs on an interval. + +## Layout +``` +16-flux-image-automation/ +├── README.md +├── apps/ +│ └── frontend/ +│ ├── deployment.yaml # carries a load-bearing $imagepolicy comment +│ ├── service.yaml +│ └── kustomization.yaml +├── infrastructure/ +│ └── image-automation/ +│ ├── imagerepository.yaml # scans the registry +│ ├── imagepolicy.yaml # selects one tag +│ ├── imageupdateautomation.yaml # commits the tag back to Git +│ └── kustomization.yaml +└── clusters/ + └── production/ + ├── apps.yaml # Flux Kustomization CR + ├── image-automation.yaml # Flux Kustomization CR + └── kustomization.yaml # kustomize build file +``` + +## What makes it structurally distinct +- **A YAML comment is load-bearing.** In `apps/frontend/deployment.yaml` the + image line ends with `# {"$imagepolicy": "flux-system:frontend"}`. That comment + is a kustomize *setter*: it is the only thing that marks the field as + automated. Strip it, reformat it away, or move it to its own line, and + automation silently stops updating that image. A comment-destroying rewrite of + this file is a functional regression that no schema validator would catch. +- **The marker is a cross-object reference in string form.** `flux-system:frontend` + is `:` of the `ImagePolicy`. Nothing in the Deployment's schema + expresses that dependency; renaming the ImagePolicy breaks it silently. +- **Git is an output, not only an input.** `ImageUpdateAutomation` clones, rewrites, + commits as `fluxcdbot`, and pushes to `flux-image-updates`. The checked-in image + tag is therefore both desired state *and* a value the cluster produces. +- **`update.path` scopes the writer.** Only `./apps/frontend` is rewritten. An + identical setter comment outside that subtree is inert. +- **`spec.git.commit.messageTemplate` is a Go template inside a Kubernetes object.** + Its `{{range .Updated.Images}}` body is data to the API server and a program to + the controller. +- **Referenced but absent:** the `ghcr-credentials` Secret and the `flux-system` + `GitRepository` live in the cluster, created elsewhere. Not every reference a + folder makes is resolvable inside that folder. + +## Open questions +- If another tool rewrites `deployment.yaml`, how does it guarantee the trailing + `$imagepolicy` comment survives — byte for byte, on the same line as the image? +- Two writers now target the same file on the same branch. What happens when an + automated tag bump and a human edit race? Who rebases, and what is the conflict + unit — the file, the document, or the field? +- Is the image tag in Git a value a user should be allowed to edit at all, given a + controller will overwrite it on the next interval? Should such a field be + presented as read-only? +- `push.branch` sends commits to `flux-image-updates` rather than `main`. Does the + "desired state" of this folder live on the branch a tool reads, or the branch + automation writes? +- Can a scanner detect that a field is machine-owned purely from structure, or does + recognising `$imagepolicy` require special-casing this controller's convention? +- How many other conventions encode meaning in comments (kustomize setters, `# yaml-language-server` + schema hints, `# renovate:` directives), and does treating comments as + presentation-only quietly break all of them? diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/apps/frontend/deployment.yaml b/test/fixtures/gitops-layouts/16-flux-image-automation/apps/frontend/deployment.yaml new file mode 100644 index 00000000..91e30a44 --- /dev/null +++ b/test/fixtures/gitops-layouts/16-flux-image-automation/apps/frontend/deployment.yaml @@ -0,0 +1,35 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend + namespace: frontend + labels: + app: frontend +spec: + replicas: 3 + selector: + matchLabels: + app: frontend + template: + metadata: + labels: + app: frontend + spec: + containers: + - name: frontend + # LOAD-BEARING COMMENT. The trailing `$imagepolicy` marker is a kustomize + # "setter": image-automation-controller finds it, reads the latest tag + # selected by the named ImagePolicy, and rewrites the image value on this + # line - then commits the result straight back to this repository. + # + # Two consequences. The comment is not decoration: strip it and automation + # silently stops updating this image. And this file has a second writer + # that is not a human. + image: ghcr.io/example-org/frontend:1.8.3 # {"$imagepolicy": "flux-system:frontend"} + ports: + - name: http + containerPort: 8080 + resources: + requests: + cpu: 100m + memory: 128Mi diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/apps/frontend/kustomization.yaml b/test/fixtures/gitops-layouts/16-flux-image-automation/apps/frontend/kustomization.yaml new file mode 100644 index 00000000..f60b6b5b --- /dev/null +++ b/test/fixtures/gitops-layouts/16-flux-image-automation/apps/frontend/kustomization.yaml @@ -0,0 +1,7 @@ +# Kustomize build config (kustomize.config.k8s.io), not the Flux Kustomization CR. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: frontend +resources: + - deployment.yaml + - service.yaml diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/apps/frontend/service.yaml b/test/fixtures/gitops-layouts/16-flux-image-automation/apps/frontend/service.yaml new file mode 100644 index 00000000..7b4040dd --- /dev/null +++ b/test/fixtures/gitops-layouts/16-flux-image-automation/apps/frontend/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: frontend + namespace: frontend + labels: + app: frontend +spec: + type: ClusterIP + selector: + app: frontend + ports: + - name: http + port: 80 + targetPort: http diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/clusters/production/apps.yaml b/test/fixtures/gitops-layouts/16-flux-image-automation/clusters/production/apps.yaml new file mode 100644 index 00000000..2bbfacdc --- /dev/null +++ b/test/fixtures/gitops-layouts/16-flux-image-automation/clusters/production/apps.yaml @@ -0,0 +1,16 @@ +# A Flux Kustomization CUSTOM RESOURCE (kustomize.toolkit.fluxcd.io/v1), not a +# kustomize.config.k8s.io build file. Same collision as fixture 09. +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: apps + namespace: flux-system +spec: + dependsOn: + - name: image-automation + interval: 10m + sourceRef: + kind: GitRepository + name: flux-system + path: ./apps/frontend + prune: true diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/clusters/production/image-automation.yaml b/test/fixtures/gitops-layouts/16-flux-image-automation/clusters/production/image-automation.yaml new file mode 100644 index 00000000..cdf2da66 --- /dev/null +++ b/test/fixtures/gitops-layouts/16-flux-image-automation/clusters/production/image-automation.yaml @@ -0,0 +1,12 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: image-automation + namespace: flux-system +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: flux-system + path: ./infrastructure/image-automation + prune: true diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/clusters/production/kustomization.yaml b/test/fixtures/gitops-layouts/16-flux-image-automation/clusters/production/kustomization.yaml new file mode 100644 index 00000000..eb7aaa53 --- /dev/null +++ b/test/fixtures/gitops-layouts/16-flux-image-automation/clusters/production/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - image-automation.yaml + - apps.yaml diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/imagepolicy.yaml b/test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/imagepolicy.yaml new file mode 100644 index 00000000..37d8f1db --- /dev/null +++ b/test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/imagepolicy.yaml @@ -0,0 +1,21 @@ +# Chooses ONE tag out of everything the ImageRepository scanned. The chosen tag +# is what gets written into apps/frontend/deployment.yaml by the automation. +# +# The name here (flux-system:frontend) is exactly the string referenced by the +# `$imagepolicy` setter comment in that Deployment. Rename this object and the +# marker silently stops matching. +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImagePolicy +metadata: + name: frontend + namespace: flux-system +spec: + imageRepositoryRef: + name: frontend + # Ignore release-candidate and nightly tags, then pick the highest 1.x semver. + filterTags: + pattern: '^(?P\d+\.\d+\.\d+)$' + extract: '$version' + policy: + semver: + range: '>=1.8.0 <2.0.0' diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/imagerepository.yaml b/test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/imagerepository.yaml new file mode 100644 index 00000000..af7a96b8 --- /dev/null +++ b/test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/imagerepository.yaml @@ -0,0 +1,14 @@ +# Scans a container registry on an interval and records the tags it finds. +# It reads the registry, never the Git repository. +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImageRepository +metadata: + name: frontend + namespace: flux-system +spec: + image: ghcr.io/example-org/frontend + interval: 5m + # Credentials for a private registry are created out of band; the Secret is not + # checked into this repository. + secretRef: + name: ghcr-credentials diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/imageupdateautomation.yaml b/test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/imageupdateautomation.yaml new file mode 100644 index 00000000..07476d9c --- /dev/null +++ b/test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/imageupdateautomation.yaml @@ -0,0 +1,34 @@ +# THE WRITER. This object gives a controller commit access to this repository. +# +# On every interval it clones the repo, walks `update.path`, rewrites every image +# value carrying a `$imagepolicy` setter comment, commits, and pushes to the +# branch named below. Git is not only the source of truth here - it is also an +# output of the cluster. +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImageUpdateAutomation +metadata: + name: frontend + namespace: flux-system +spec: + interval: 30m + sourceRef: + kind: GitRepository + name: flux-system + git: + checkout: + ref: + branch: main + commit: + author: + name: fluxcdbot + email: fluxcdbot@users.noreply.github.com + messageTemplate: | + chore(images): update {{range .Updated.Images}}{{println .}}{{end}} + # Pushing to a branch other than the checkout branch turns automation into a + # pull-request flow rather than a direct commit to main. + push: + branch: flux-image-updates + update: + # Only this subtree is rewritten. Setter comments outside it are ignored. + path: ./apps/frontend + strategy: Setters diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/kustomization.yaml b/test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/kustomization.yaml new file mode 100644 index 00000000..275a54c0 --- /dev/null +++ b/test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: flux-system +resources: + - imagerepository.yaml + - imagepolicy.yaml + - imageupdateautomation.yaml diff --git a/test/fixtures/gitops-layouts/README.md b/test/fixtures/gitops-layouts/README.md index e742719e..ee939de8 100644 --- a/test/fixtures/gitops-layouts/README.md +++ b/test/fixtures/gitops-layouts/README.md @@ -53,6 +53,7 @@ Each fixture directory holds a self-contained example repository plus a | 13 | [13-sops-encrypted](13-sops-encrypted/) | A file that is simultaneously a valid Kubernetes object and unreadable: cleartext `metadata`, opaque `data` | | 14 | [14-rendered-manifests](14-rendered-manifests/) | Git holds generated output, not sources; hash-suffixed names with no stable origin | | 15 | [15-mixed-and-hostile](15-mixed-and-hostile/) | Every naive assumption broken at once — filename implies kind, extension implies format, YAML implies KRM, KRM never nests KRM | +| 16 | [16-flux-image-automation](16-flux-image-automation/) | A controller that **commits to the repo**; a `$imagepolicy` comment is load-bearing, so Git is an output as well as an input | ## The layout dimensions underneath @@ -71,6 +72,20 @@ bootstrap` reinforces (`clusters//flux-system/`). **Argo CD** has no canonical structure at all — its common shapes emerge from App of Apps, ApplicationSets, Kustomize, and Helm value-file patterns. +## Two things worth knowing before you read any fixture + +**Some comments are load-bearing.** A `# {"$imagepolicy": ...}` setter in +[16](16-flux-image-automation/) is the only marker that makes a field automated; +a `{{ ... }}` action inside a *YAML comment* in a Helm template is still parsed by +Helm and will break the chart. Comments are not presentation. + +**Some hidden dotfiles decide what deploys.** `.argocd-source.yaml` (path-wide) and +`.argocd-source-.yaml` (per-Application) are merged over an Argo CD +Application's `spec.source`, so they outrank the values and transformers a reader +would naturally inspect. They appear in [05](05-kustomize-overlays/) — written and +committed by Argo CD Image Updater — and in [07](07-helm-environment-values/). +They carry no `apiVersion`/`kind`. + ## Deliberately absent Two hostile cases cannot be represented as committed files, and are described in @@ -79,8 +94,15 @@ prose inside [15-mixed-and-hostile](15-mixed-and-hostile/) instead: - a **symlink** escaping the folder - a genuinely **empty directory** (git cannot store one; the fixtures use `.gitkeep`) -Also out of scope for now: Jsonnet sources, Argo CD config-management plugins, -and Kustomize `components`. +Out of scope for now, roughly in the order they deserve to graduate: + +- **Kustomize `components`** — common enough to be worth a fixture soon. Already + represented as an assertion in + [`contextual-namespace/unsupported/components/`](../../../internal/manifestanalyzer/testdata/contextual-namespace/unsupported/components/). +- **SealedSecrets and ExternalSecrets** — two more shapes of "a Secret that is not + the Secret", alongside the SOPS case in [13](13-sops-encrypted/). +- **Jsonnet / Tanka sources**, and **Argo CD config-management plugins** — arbitrary + programs that emit KRM. ## Conventions @@ -96,6 +118,23 @@ structurally correct with placeholder ciphertext. [`.gitignore`](../../../.gitignore) carries a scoped `!test/fixtures/gitops-layouts/**/*.env` negation for it. +## Checking the fixtures are real + +The three Helm charts are genuine charts, not sketches: + +```bash +helm lint 04-argocd-applicationset-files/chart +helm lint 06-helm-chart/charts/frontend # renders after `helm dependency build` +helm lint 07-helm-environment-values/chart +``` + +All three lint clean. `04` and `07` also `helm template` offline; `06` declares an +unvendored `redis` subchart, so rendering it needs `helm dependency build` first — +which is the normal state of a real chart repository. + +Every other YAML in the corpus parses, except where a fixture states it must not: +Helm `templates/`, and `15-mixed-and-hostile/templates/deployment.yaml`. + ## Relationship to the other corpora This corpus is **descriptive** and drives no test. Two sibling corpora already From 848d25cd314aca265724dbbe34f85a511b4447bb Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Fri, 10 Jul 2026 11:17:02 +0000 Subject: [PATCH 04/28] docs(gitops-api): the orchestrator knowledge boundary, and ownership as a second axis MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Running scan-repo across the new layout corpus produced a snapshot whose refusals are healthy and whose accepts are the finding: three fixtures written to say "a tool must not touch this" came back green. A SOPS Secret, a folder rewritten on an interval by ImageUpdateAutomation, and a file whose first line is DO NOT EDIT. All three are perfectly renderable — plain KRM, one document, one home file — so the support boundary passes them. They fail a question it never asks. Renderability ("can an edit be mapped back to one source document?") and ownership ("does something else already write this file?") are independent axes, and only the first exists in the code. Renderability is a property of a folder's own contents; ownership is a property of something outside the folder pointing at it. That asymmetry is why the structure-only walk cannot answer it, and why Argo CD / Flux knowledge is needed at all. The doc argues that knowledge is cheap to isolate, because it arrives as ordinary KRM the analyzer has already parsed: an Application is an object with spec.source.path; a Flux Kustomization is an object with spec.path and spec.postBuild. So orchestrator-specific packages emit *claims about paths* in a closed, tool-neutral vocabulary (RenderRootFor, WrittenBy, Generated, OverriddenBy, TransformedOutOfBand, NotAnEditingTarget) that core consumes without ever learning what Flux is. No argo-cd or fluxcd Go dependency, ever. fleetRoot is the specimen: Flux's vocabulary, none of Flux's evidence, and a three-directory-name guess that false-negatives on the canonical Flux layout (which spells it `infrastructure`, not `infra`) and false-positives elsewhere. It is also a public field in pkg/manifestanalyzer at SchemaVersion v1, so renaming it is free today and a major bump once anything depends on it. Also records two confirmed defects the snapshot exposed: `editable` is documented as an ownership claim and computed as pathWithin, which is why an encrypted Secret counts as editable; and isFleetRoot tests directory names rather than flux-system/gotk-sync.yaml. Ships no code. Proposes two ladder entries and answers none of its own open questions. Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/design/gitops-api/README.md | 1 + .../orchestrator-knowledge-boundary.md | 347 ++++++++++++++++++ test/fixtures/gitops-layouts/support-today.md | 251 +++++++++++++ 3 files changed, 599 insertions(+) create mode 100644 docs/design/gitops-api/orchestrator-knowledge-boundary.md create mode 100644 test/fixtures/gitops-layouts/support-today.md diff --git a/docs/design/gitops-api/README.md b/docs/design/gitops-api/README.md index 77557d22..84f7dd1c 100644 --- a/docs/design/gitops-api/README.md +++ b/docs/design/gitops-api/README.md @@ -4,6 +4,7 @@ > Captured: 2026-07-06 > Related: > [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md), +> [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md), > [../../future/idea-application-editing.md](../../future/idea-application-editing.md), > [../manifest/contextual-namespace-and-kustomize-folder-editing.md](../manifest/contextual-namespace-and-kustomize-folder-editing.md), > [../manifest/file-agnostic-placement.md](../manifest/file-agnostic-placement.md), diff --git a/docs/design/gitops-api/orchestrator-knowledge-boundary.md b/docs/design/gitops-api/orchestrator-knowledge-boundary.md new file mode 100644 index 00000000..5a9df13a --- /dev/null +++ b/docs/design/gitops-api/orchestrator-knowledge-boundary.md @@ -0,0 +1,347 @@ +# Orchestrator knowledge boundary: renderability, ownership, and claims + +> Status: direction-setting; proposes two ladder entries, ships no code. +> Captured: 2026-07-10 +> Related: +> [README.md](README.md), +> [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md), +> [f8-repo-discovery-and-onboarding-scan.md](f8-repo-discovery-and-onboarding-scan.md), +> [unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md), +> [gittarget-granularity-and-cross-environment-edits.md](gittarget-granularity-and-cross-environment-edits.md), +> the layout corpus at [`test/fixtures/gitops-layouts/`](../../../test/fixtures/gitops-layouts/) + +## Purpose + +This doc answers two questions that turned out to be the same question: + +1. **What makes a folder safe to write?** The support boundary today answers + *"can an edit be mapped back to one source document?"* That is necessary and + it is not sufficient. +2. **Where does Argo CD / Flux knowledge belong?** It is real knowledge, the + product needs it, and it must not be smeared through the acceptance gate. + +The answer to (2) falls out of (1): the missing safety property is **ownership**, +ownership is asserted by orchestrator objects that already live in the repository +as ordinary KRM, and so orchestrator knowledge enters the system as a bounded set +of *claims about paths* rather than as a dependency on Argo CD or Flux. + +## The evidence + +Running `manifest-analyzer --mode scan-repo` across the layout corpus produced a +snapshot (`test/fixtures/gitops-layouts/support-today.md`). Its refusals are +healthy: specific, actionable messages for non-KRM YAML, foreign files, impure +multi-document files, and unsupported kustomize features. + +The **accepts** are the finding. Three fixtures written specifically to say *"a +tool must not touch this"* came back green: + +| Fixture | Reported | Why that is wrong | +|---|---|---| +| `13-sops-encrypted` | `apps/frontend` accepted, `rendered/editable/nonKrm = 2/2/0` | One of those two "editable" documents is a SOPS Secret. Rewriting it invalidates the `mac`; decryption then fails in-cluster. | +| `16-flux-image-automation` | all three candidates accepted | `apps/frontend` is rewritten and committed by `ImageUpdateAutomation` on an interval, and its image field is pinned by a `$imagepolicy` setter comment. | +| `14-rendered-manifests` | `rendered/production` accepted | The first line of the file is `DO NOT EDIT`. Any edit is destroyed by the next CI render. | + +A false refusal costs a support ticket. **A false accept corrupts a user's +repository**, and in the SOPS case does so in a way the user cannot see in the +diff. + +## The two axes + +All three folders above are perfectly renderable: plain KRM, one document, one +home file, no generator, no patch. They pass every question the gate asks. + +They fail a question it never asks. + +| Axis | Question | Failure mode | Modelled today | +|---|---|---|---| +| **Renderability** | Can an edit be written back to exactly one source document, such that live → Git → live round-trips? | We cannot express the change. | ✅ Yes — this *is* the [support boundary](kustomize-support-boundary-and-product-model.md). Generators, `namePrefix`, patches, remote bases, Helm inflation are refused because they are non-invertible. | +| **Ownership** | Is this file already owned by something else that writes it? | We *can* express the change, write it, and destroy someone else's invariant. | ❌ No. | + +The two are independent. A folder can be renderable and unowned (write it), +renderable and owned (refuse, or write elsewhere), unrenderable and unowned +(refuse), or both (refuse twice). + +Renderability is a property of the **folder's own contents**. Ownership is a +property of **something outside the folder** that points at it. That asymmetry is +why ownership cannot be answered by the structure-only walk that answers +renderability, and it is exactly why orchestrator knowledge is needed at all. + +### The governing rule, restated + +[README §The governing rule](README.md) says every edit must have exactly one +writable destination in Git. This doc adds the second half: + +> **…and that destination must not already have a writer.** + +## Where orchestrator knowledge lives today + +The module has **no Argo CD or Flux Go dependency** — `go.mod` is clean, and the +upstream checkouts under `external-sources/` are gitignored reference material, +not vendored code. That is the right posture and this doc does not change it. + +But orchestrator knowledge has still leaked in, through two unrelated side doors +with no seam between them: + +| Site | Shape of the knowledge | +|---|---| +| [`internal/sanitize/types.go`](../../../internal/sanitize/types.go) | Hardcoded label/annotation prefixes (`kustomize.toolkit.fluxcd.io/`, `kro.run/`, `applyset.*`) stripped before a document reaches Git. | +| [`internal/manifestanalyzer/scan_repo.go`](../../../internal/manifestanalyzer/scan_repo.go) — `isFleetRoot` | Three directory names: `clusters`, `apps`, `infra`. | + +Neither is wrong to exist. Both are in the wrong place, and the second one is +wrong on its own terms. + +## The specimen: `fleetRoot` + +`fleetRoot` is worth dwelling on, because it shows precisely how this knowledge +leaks when it has nowhere principled to go. + +- Its **name** is Flux vocabulary. `fleet-infra` is the repository name in the + `flux bootstrap` documentation. +- Its **implementation** contains no Flux knowledge whatsoever: it requires three + top-level directories named `clusters`, `apps`, and `infra`. Any tool can + produce that tree, and many repositories that are not fleet roots do. +- The **thing it reaches for** — *"this is a cluster entry point, never an editing + target"* — is real, and the genuine evidence is somewhere else entirely: + `clusters//flux-system/` containing `gotk-components.yaml` and + `gotk-sync.yaml`, which `flux bootstrap` writes and nothing else does. + +So it carries Flux's vocabulary, none of Flux's evidence, and a name-based guess +that: + +- **false-negatives** on the canonical Flux layout in `09-flux-monorepo`, which + uses `infrastructure/` — the spelling the Flux documentation itself prescribes + — and therefore reports `fleetRoot: false` on the most Flux-shaped repository + in the corpus; +- **false-positives** on any repository that happens to use those three names. + +Argo CD's equivalent concept is not a directory at all. It is a *document*: a +root `Application` (app-of-apps) or an `ApplicationSet`. No directory-name +heuristic can ever see it. + +## The tiering + +Three tiers of knowledge. Only the third is the one to isolate. + +### Tier 0 — KRM facts + +Is this document a Kubernetes object? Is it encrypted? Is this file YAML but not +KRM? Do two documents claim the same identity? Zero tool knowledge. This is the +core, and it is the only tier permitted in the acceptance gate's hot path. + +### Tier 1 — Renderer facts + +Kustomize build semantics: `resources` graphs, render roots, generators, +`namePrefix`/`nameSuffix`, `images`, `replicas`, remote bases. + +**This is not Argo CD or Flux knowledge.** Kustomize is a real, versioned engine +whose semantics directly determine round-trippability, both tools drive it, and +the operator's own writer must understand it. It belongs in core, where it +already is. + +### Tier 2 — Orchestrator facts + +- *This folder is the source of Argo CD `Application` X.* +- *This folder's namespace is injected by Flux `Kustomization` Z's + `targetNamespace`, and its `${var}` tokens by `postBuild.substitute`.* +- *This folder is written by `ImageUpdateAutomation` Y.* +- *This `.argocd-source-.yaml` outranks the `kustomization.yaml` beside it.* + +Tier 2 is what to isolate. And isolating it is cheap, because of one fact: + +> **Tier 2 knowledge arrives as ordinary KRM documents in the repository that +> Tier 0 has already parsed.** + +An Argo CD `Application` is an object with `spec.source.path`. A Flux +`Kustomization` is an object with `spec.path` and `spec.postBuild`. Reading them +needs their group and kind strings and a handful of field paths. It never needs +Argo CD's or Flux's code. + +## The claim vocabulary + +Core produces a document store and a set of folder candidates. **Interpreters** +— one per orchestrator — read that store and emit **claims about paths**, in a +closed vocabulary that never names a tool: + +| Claim | Meaning | Emitted from | +|---|---|---| +| `RenderRootFor{path, by}` | Something deploys this folder. | Argo `Application.spec.source.path`; Flux `Kustomization.spec.path` | +| `TransformedOutOfBand{path, by, what}` | Namespace or substitution injected from outside the folder. | Flux `postBuild.substitute`, `targetNamespace`; Argo Application-level Helm parameters | +| `WrittenBy{path, by}` | A machine commits to this path. | Flux `ImageUpdateAutomation.spec.update.path`; Argo CD Image Updater write-back | +| `OverriddenBy{path, file}` | A file outranks the visible configuration. | `.argocd-source.yaml`, `.argocd-source-.yaml` | +| `Generated{path}` | Committed render output, not source. | `DO NOT EDIT` headers, `config.kubernetes.io/origin` annotations | +| `NotAnEditingTarget{path, why}` | A cluster entry point. | `flux-system/gotk-sync.yaml`; a root `Application`/`ApplicationSet` | + +Core consumes claims. It never learns what "Flux" is. Adding kro, Crossplane, or +Renovate later means adding an interpreter, not touching the acceptance gate. + +The vocabulary is not invented — it is read straight off the corpus. `WrittenBy` +is fixtures 16 and 05. `Generated` is 14. `TransformedOutOfBand` is 10. +`OverriddenBy` is 05 and 07. `NotAnEditingTarget` is the honest `fleetRoot`. + +Note that **encryption is Tier 0, not Tier 2.** A SOPS document is +self-describing: the `sops:` stanza is in the file. No orchestrator asserts it. +The analyzer already knows — `Encrypted` and `CauseEncrypted` exist in +[`internal/manifestanalyzer/analyzer.go`](../../../internal/manifestanalyzer/analyzer.go). +The bug is that `scan-repo` never surfaces it (see below). Ownership has two +sources: the document itself, and a claim about it. + +## Architecture rules + +**Never depend on `argoproj/argo-cd` or `fluxcd/*` Go modules.** They pull very +large dependency trees and version-lock this module to their Kubernetes +libraries. Match on `apiVersion`/`kind` strings over `unstructured`, with typed +accessors for the few field paths that matter. Keeping upstream source in a +gitignored `external-sources/` is exactly right: consult it as documentation, +never as a dependency. + +**Match on group + kind, tolerating version.** You will meet +`helm.toolkit.fluxcd.io/v2beta1` and `v2`, `image.toolkit.fluxcd.io/v1beta2` and +`v1`, in the same repository. An interpreter that pins a version is a bug. + +**Do not extract a separate repository or Go module yet.** Make the *package* +boundary real now — `internal/gitops/{argocd,flux}` over a shared claim +vocabulary and registry — and extract only when a second consumer exists. A +premature module split buys release overhead and nothing else. The claim +vocabulary is the contract; the package layout is an implementation detail that +can move. + +**Keep ownership *policy* in core, not in the interpreters.** The interpreter +says "`ImageUpdateAutomation` writes this path." The rule "refuse to write a +machine-owned file" is core policy, applied uniformly to every claim from every +interpreter. Invert this and the product ships Flux-shaped safety with no +Argo-shaped equivalent. + +**Interpreters are read-only and cluster-free**, exactly like `ScanRepo`. They +read the parsed store, never the network, never a kubeconfig. + +## What this changes in the code + +Two of these are small, confirmed defects that stand on their own, independent of +whether the tiering above is adopted. + +### 1. `editable` promises ownership and delivers location + +[`scan_repo.go`](../../../internal/manifestanalyzer/scan_repo.go) documents +`Editable` as *"the source the operator would own and write in place"* — an +ownership claim — and computes it as `pathWithin(filePath, dir)`, which is pure +location. That is why fixture 13 reports a SOPS Secret as `editable`. + +The fix is small and already half-built: surface the existing `Encrypted` count +through `ResourceCounts`, and stop counting non-editable documents as editable. +This is a **contract** fix, not only a code fix: the field is exported through +[`pkg/manifestanalyzer`](../../../pkg/manifestanalyzer). + +### 2. `isFleetRoot` uses the wrong evidence + +Replace the `clusters` + `apps` + `infra` directory-name test with the real +fingerprint: a `flux-system/` directory containing `gotk-sync.yaml`. Until +Tier 2 exists, that is a one-function change that both fixes the false negative +on `09-flux-monorepo` and stops the false positives. + +### 3. A public field with a clock on it + +`RepoSummary.FleetRoot` is exported from `pkg/manifestanalyzer`, whose +[`doc.go`](../../../pkg/manifestanalyzer/doc.go) promises that *"fields are added, +never repurposed or removed within a schema major."* `SchemaVersion` is `v1`. + +Renaming it to something honest — `clusterEntryPoints []string`, or folding it +into a `NotAnEditingTarget` claim carrying a reason — is **free today and a +schema major bump once anything depends on it**. Nothing does yet. This decision +should be made before the write path hardens around the name, not after. + +### 4. Onboarding, not refusal, for foreign files + +`01-argocd-plain` is refused because `ci-metadata.yaml` is non-KRM — a file the +Argo CD `Application` beside it already excludes via `directory.exclude`. Every +simulated repo root in `11-repo-per-environment` is refused for carrying a +`.gitignore`. Real repository roots always carry `.gitignore`, `README.md`, and +`LICENSE`. + +The refusal message already names the remedy (`.gittargetignore`). Onboarding +should **propose** that file rather than report a refusal, and an Argo CD +interpreter can seed it from `directory.exclude`. This is a report-quality bug, +not a boundary question. + +## Proposed ladder entries + +Neither is designed here beyond the shape above. + +| Proposed | Scope | +|---|---| +| **Ownership axis** | `Encrypted`/non-editable in `ResourceCounts`; a core write-gate that refuses a machine-owned or generated destination; `Generated` detection from headers and `config.kubernetes.io/origin`. Delivers the three false accepts. | +| **Orchestrator interpreters** | `internal/gitops` claim vocabulary + registry; `argocd` and `flux` interpreters; `fleetRoot` re-expressed as `NotAnEditingTarget`; role classification (workload / control-plane / generated / machine-written) in the F8 report. | + +The ownership axis is the one with a correctness argument behind it and should go +first. Interpreters are what make it complete, and what make the F8 report an +onboarding answer rather than a folder census. + +## Why the F8 report is not yet an onboarding answer + +Related, and worth recording while the evidence is fresh. `scan-repo` counts +candidates, and every candidate counts the same: + +- `02-argocd-app-of-apps` reports four accepted candidates. Two are `bootstrap/` + and `applications/` — directories of Argo CD `Application` CRs, not workloads. +- `06-helm-chart` reports one accepted candidate: `charts/frontend/crds`, a + directory *inside* a Helm chart that Helm owns. +- `07-helm-environment-values` reports one accepted candidate: `argocd/`. + +Each is structurally true. None is a useful thing to tell a user during +onboarding, and a product that leads with "1 folder supported" on a Helm +repository is misleading rather than honest. Candidates need a **role** beside +their layout, and a Helm chart should surface as an explicit layout rather than +as silence plus an incidental `crds/`. + +## Corpus and baseline + +Two follow-ups on the corpus itself, which is the test surface for all of the +above: + +- **No fixture currently produces `kustomize-overlay` / `overlay-fan-out-needs-f2`.** + Every overlay in the corpus also uses `patches`, so `refused-structural` — the + permanent wall — fires first and hides the F2 ladder rung. The + [F8 doc](f8-repo-discovery-and-onboarding-scan.md) calls that ladder-versus-wall + distinction load-bearing and says it must never collapse; today nothing pins it. + A minimal overlay that only sets `namespace` and `images` over `../../base` + closes the gap. +- **`support-today.md` should be generated, not pasted.** A task target that runs + `scan-repo` over every fixture and rewrites the file turns the corpus from + documentation into a **behavioural baseline**: not an assertion, a diff. Any + change to the acceptance gate then shows, in the pull request, exactly which + fixtures moved and in which direction. That is the cheapest way to keep this + map honest, and it is the step that makes every fix above reviewable. + +## Non-goals + +- **No orchestrator emulation.** Interpreters read declarations. They do not run + kustomize on a remote base, resolve a Helm chart, evaluate an ApplicationSet + generator, decrypt SOPS, or contact a registry. +- **No new operator dependency.** Interpreters serve the analyzer and the F8 + report. Whether the operator ever consumes a claim is a separate decision; the + ownership *gate* it needs can be fed by Tier 0 (`Encrypted`) alone for the + first cut. +- **The write boundary does not widen.** Everything refused for renderability + stays refused. Ownership only ever refuses more. + +## Open questions + +1. **Where does a claim about a path outside every candidate go?** A Flux + `Kustomization` in `clusters/production/` claims `./apps/frontend`. Both are + candidates. Does the claim attach to the target, the source, or the edge? +2. **Is `Generated` detectable without a convention?** `DO NOT EDIT` headers and + `config.kubernetes.io/origin` are conventions, not guarantees. Is a + false-negative here acceptable, given the cost is an overwritten edit? +3. **Should `WrittenBy` refuse the folder, or only the fields the machine owns?** + In `16-flux-image-automation` the automation owns exactly one field — the image + on the line carrying the `$imagepolicy` comment. Refusing the whole folder is + safe and coarse; refusing the field is precise and needs setter-comment + awareness. The same question, in a different costume, as F3's restricted patch + authoring. +4. **Does a `RenderRootFor` claim from an Argo CD `Application` change which + folders are candidates at all**, or only annotate the ones the structural walk + already found? The structural walk found `manifests/frontend` without help; + the `Application` merely confirms it. Where do the two disagree? +5. **How is a claim from a *different repository* represented?** An `Application` + in a bootstrap repo points at a path in a workload repo. The single-repo scan + cannot see it. Is that simply out of scope, or does the product layer stitch + claims across repositories? diff --git a/test/fixtures/gitops-layouts/support-today.md b/test/fixtures/gitops-layouts/support-today.md new file mode 100644 index 00000000..a6eba038 --- /dev/null +++ b/test/fixtures/gitops-layouts/support-today.md @@ -0,0 +1,251 @@ +# Support today: GitOps layout fixtures + +Generated from the current `manifest-analyzer` repo scan. This file is +descriptive: it records what the tool reports today, not what the product should +eventually support. + +Command used per fixture: + +```bash +go build -o /tmp/manifest-analyzer ./cmd/manifest-analyzer +/tmp/manifest-analyzer --mode scan-repo --format json test/fixtures/gitops-layouts/ +``` + +Important reading rules: + +- `rc=0` means the scan command succeeded. It does not mean the fixture is fully supported. +- `accepted` and `refused` count reported candidate folders, not whole repository support. +- `scan-repo` is structure-only. It does not execute Argo CD, Flux, Helm, SOPS, + plugins, or remote fetches. +- A missing candidate can be as important as a refusal: it means the tool did not + explain that part of the repo at all. + +## Summary + +| Fixture | rc | Outcome | Accepted | Refused | Layouts | Fleet root | Unsupported constructs | Reported refusal signal | +|---|---:|---|---:|---:|---|---|---|---| +| 01-argocd-plain | 0 | Partial | 1 | 1 | plain=2 | false | - | non-krm-yaml: ci-metadata.yaml: YAML is not a Kubernetes manifest | +| 02-argocd-app-of-apps | 0 | All reported candidates accepted | 4 | 0 | plain=4 | false | - | None | +| 03-argocd-applicationset-directories | 0 | All reported candidates accepted | 5 | 0 | plain=5 | false | - | None | +| 04-argocd-applicationset-files | 0 | No reported candidates accepted | 0 | 1 | plain=1 | false | - | non-krm-yaml: chart/Chart.yaml: YAML is not a Kubernetes manifest
foreign-file: chart/templates/_helpers.tpl: foreign file chart/templates/_helpers.tpl is not a managed manifest; remove it or name it in .gittargetignore
non-krm-yaml: chart/templates/deployment.yaml: YAML is not a Kubernetes manifest
non-krm-yaml: chart/templates/service.yaml: YAML is not a Kubernetes manifest
+5 more | +| 05-kustomize-overlays | 0 | Partial | 1 | 3 | kustomize-single=1, refused-structural=3 | false | configMapGenerator, namePrefix, nameSuffix, patches, remote-base, secretGenerator | refused-structural: kustomization uses unsupported feature(s): remote-base
refused-structural: kustomization uses unsupported feature(s): configMapGenerator, nameSuffix, patches, secretGenerator
refused-structural: kustomization uses unsupported feature(s): configMapGenerator, namePrefix, patches | +| 06-helm-chart | 0 | All reported candidates accepted | 1 | 0 | plain=1 | false | - | None | +| 07-helm-environment-values | 0 | All reported candidates accepted | 1 | 0 | plain=1 | false | - | None | +| 08-argocd-external-helm | 0 | Partial | 2 | 1 | plain=3 | false | - | non-krm-yaml: values.yaml: YAML is not a Kubernetes manifest | +| 09-flux-monorepo | 0 | Partial | 4 | 2 | kustomize-single=4, refused-structural=2 | false | patches | refused-structural: kustomization uses unsupported feature(s): patches | +| 10-flux-helmrelease | 0 | Partial | 3 | 1 | kustomize-single=3, refused-structural=1 | false | configMapGenerator | refused-structural: kustomization uses unsupported feature(s): configMapGenerator | +| 11-repo-per-environment | 0 | Partial | 6 | 3 | plain=9 | false | - | foreign-file: .gitignore: foreign file .gitignore is not a managed manifest; remove it or name it in .gittargetignore | +| 12-multicluster-applicationset | 0 | All reported candidates accepted | 4 | 0 | plain=4 | false | - | None | +| 13-sops-encrypted | 0 | All reported candidates accepted | 3 | 0 | kustomize-single=2, plain=1 | false | - | None | +| 14-rendered-manifests | 0 | Partial | 3 | 2 | plain=3, refused-structural=2 | false | namePrefix | refused-structural: kustomization uses unsupported feature(s): namePrefix | +| 15-mixed-and-hostile | 0 | Partial | 3 | 2 | kustomize-single=1, plain=4 | false | - | non-krm-yaml: ci/.gitlab-ci.yml: YAML is not a Kubernetes manifest
non-krm-yaml: ci/docker-compose.yml: YAML is not a Kubernetes manifest
foreign-file: empty-dir/.gitkeep: foreign file empty-dir/.gitkeep is not a managed manifest; remove it or name it in .gittargetignore
mixed-managed-allowlisted: kustomization.yaml: managed resource kustomize.toolkit.fluxcd.io/v1/Kustomization/flux-system/apps must not live in the allowlisted build-directive file kustomization.yaml
+8 more | +| 16-flux-image-automation | 0 | All reported candidates accepted | 3 | 0 | kustomize-single=3 | false | - | None | + +## Review notes + +- The scanner gives useful, specific refusal messages for non-KRM YAML, foreign + files, invalid YAML, mixed managed/non-KRM documents, and unsupported kustomize + features. That is the good news. +- Helm support is under-reported. Fixtures `06-helm-chart` and + `07-helm-environment-values` do not produce a clear "Helm chart/templates are + unsupported" result; the scanner mostly reports only adjacent KRM such as + `crds/` or Argo CD Application manifests. +- Argo CD and Flux orchestration semantics are not modeled. The scanner treats + their CRs as ordinary KRM and does not follow Application paths, ApplicationSet + generators, Flux image update policies, or Helm value references. +- The Flux fleet-root signal did not fire for the realistic `clusters/` + + `apps/` + `infrastructure/` shape in fixture `09-flux-monorepo`; the current + detector appears narrower than the fixture vocabulary. +- Several accepted candidates are control-plane/configuration folders (`argocd`, + `applications`, `bootstrap`, `clusters`, `infrastructure`) rather than workload + desired-state folders. That may be structurally true KRM, but it is probably + not the onboarding answer a product should lead with. + +## 01-argocd-plain + +Reported result: **Partial**. Accepted `1`, refused `1`. +Unsupported constructs summary: `none`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `apps/frontend` | `plain` | false | `frontend` | 6/6/1 | non-krm-yaml: ci-metadata.yaml: YAML is not a Kubernetes manifest | +| `argocd` | `plain` | true | `argocd` | 1/1/0 | none | + +## 02-argocd-app-of-apps + +Reported result: **All reported candidates accepted**. Accepted `4`, refused `0`. +Unsupported constructs summary: `none`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `applications` | `plain` | true | `argocd` | 2/2/0 | none | +| `bootstrap` | `plain` | true | `argocd` | 1/1/0 | none | +| `manifests/backend` | `plain` | true | `backend` | 2/2/0 | none | +| `manifests/frontend` | `plain` | true | `frontend` | 2/2/0 | none | + +## 03-argocd-applicationset-directories + +Reported result: **All reported candidates accepted**. Accepted `5`, refused `0`. +Unsupported constructs summary: `none`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `apps/backend` | `plain` | true | `backend` | 2/2/0 | none | +| `apps/frontend` | `plain` | true | `frontend` | 2/2/0 | none | +| `apps/platform/monitoring` | `plain` | true | `platform` | 2/2/0 | none | +| `apps/worker` | `plain` | true | `worker` | 1/1/0 | none | +| `bootstrap` | `plain` | true | `argocd` | 1/1/0 | none | + +## 04-argocd-applicationset-files + +Reported result: **No reported candidates accepted**. Accepted `0`, refused `1`. +Unsupported constructs summary: `none`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `.` | `plain` | false | `argocd` | 1/1/9 | non-krm-yaml: chart/Chart.yaml: YAML is not a Kubernetes manifest; foreign-file: chart/templates/_helpers.tpl: foreign file chart/templates/_helpers.tpl is not a managed manifest; remove it or name it in .gittargetignore; non-krm-yaml: chart/templates/deployment.yaml: YAML is not a Kubernetes manifest; non-krm-yaml: chart/templates/service.yaml: YAML is not a Kubernetes manifest; non-krm-yaml: chart/values.yaml: YAML is not a Kubernetes manifest; non-krm-yaml: deployments/dev/backend.yaml: YAML is not a Kubernetes manifest; non-krm-yaml: deployments/dev/frontend.yaml: YAML is not a Kubernetes manifest; non-krm-yaml: deployments/production/backend.yaml: YAML is not a Kubernetes manifest; non-krm-yaml: deployments/production/frontend.yaml: YAML is not a Kubernetes manifest | + +## 05-kustomize-overlays + +Reported result: **Partial**. Accepted `1`, refused `3`. +Unsupported constructs summary: `configMapGenerator, namePrefix, nameSuffix, patches, remote-base, secretGenerator`. +Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `apps/backend/base` | `kustomize-single` | true | `` | 2/2/0 | none | +| `apps/backend/overlays/production` | `refused-structural` | false | `backend-production` | 0/0/0 | refused-structural: kustomization uses unsupported feature(s): remote-base | +| `apps/frontend/overlays/production` | `refused-structural` | false | `frontend-production` | 2/0/3 | refused-structural: kustomization uses unsupported feature(s): configMapGenerator, nameSuffix, patches, secretGenerator | +| `apps/frontend/overlays/staging` | `refused-structural` | false | `frontend-staging` | 2/0/1 | refused-structural: kustomization uses unsupported feature(s): configMapGenerator, namePrefix, patches | + +## 06-helm-chart + +Reported result: **All reported candidates accepted**. Accepted `1`, refused `0`. +Unsupported constructs summary: `none`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `charts/frontend/crds` | `plain` | true | `` | 1/1/0 | none | + +## 07-helm-environment-values + +Reported result: **All reported candidates accepted**. Accepted `1`, refused `0`. +Unsupported constructs summary: `none`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `argocd` | `plain` | true | `argocd` | 2/2/0 | none | + +## 08-argocd-external-helm + +Reported result: **Partial**. Accepted `2`, refused `1`. +Unsupported constructs summary: `none`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `applications` | `plain` | true | `argocd` | 3/3/0 | none | +| `extras/ingress-nginx` | `plain` | true | `ingress-nginx` | 2/2/0 | none | +| `platform/cert-manager` | `plain` | false | `argocd` | 2/2/1 | non-krm-yaml: values.yaml: YAML is not a Kubernetes manifest | + +## 09-flux-monorepo + +Reported result: **Partial**. Accepted `4`, refused `2`. +Unsupported constructs summary: `patches`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `apps/production` | `refused-structural` | false | `production` | 2/0/0 | refused-structural: kustomization uses unsupported feature(s): patches | +| `apps/staging` | `refused-structural` | false | `staging` | 2/0/0 | refused-structural: kustomization uses unsupported feature(s): patches | +| `clusters/production` | `kustomize-single` | true | `flux-system` | 7/7/0 | none | +| `clusters/staging` | `kustomize-single` | true | `flux-system` | 7/7/0 | none | +| `infrastructure/configs` | `kustomize-single` | true | `` | 1/1/0 | none | +| `infrastructure/controllers` | `kustomize-single` | true | `` | 2/2/0 | none | + +## 10-flux-helmrelease + +Reported result: **Partial**. Accepted `3`, refused `1`. +Unsupported constructs summary: `configMapGenerator`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `apps/frontend` | `refused-structural` | false | `` | 1/1/1 | refused-structural: kustomization uses unsupported feature(s): configMapGenerator | +| `clusters/production` | `kustomize-single` | true | `flux-system` | 7/7/0 | none | +| `infrastructure/controllers/ingress-nginx` | `kustomize-single` | true | `flux-system` | 3/3/0 | none | +| `infrastructure/sources` | `kustomize-single` | true | `flux-system` | 3/3/0 | none | + +## 11-repo-per-environment + +Reported result: **Partial**. Accepted `6`, refused `3`. +Unsupported constructs summary: `none`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `gitops-dev` | `plain` | false | `` | 6/6/1 | foreign-file: .gitignore: foreign file .gitignore is not a managed manifest; remove it or name it in .gittargetignore | +| `gitops-dev/apps/backend` | `plain` | true | `backend-dev` | 2/2/0 | none | +| `gitops-dev/apps/frontend` | `plain` | true | `frontend-dev` | 2/2/0 | none | +| `gitops-production` | `plain` | false | `` | 7/7/1 | foreign-file: .gitignore: foreign file .gitignore is not a managed manifest; remove it or name it in .gittargetignore | +| `gitops-production/apps/backend` | `plain` | true | `backend-production` | 2/2/0 | none | +| `gitops-production/apps/frontend` | `plain` | true | `frontend-production` | 3/3/0 | none | +| `gitops-staging` | `plain` | false | `` | 6/6/1 | foreign-file: .gitignore: foreign file .gitignore is not a managed manifest; remove it or name it in .gittargetignore | +| `gitops-staging/apps/backend` | `plain` | true | `backend-staging` | 2/2/0 | none | +| `gitops-staging/apps/frontend` | `plain` | true | `frontend-staging` | 2/2/0 | none | + +## 12-multicluster-applicationset + +Reported result: **All reported candidates accepted**. Accepted `4`, refused `0`. +Unsupported constructs summary: `none`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `applicationsets` | `plain` | true | `argocd` | 1/1/0 | none | +| `apps/backend` | `plain` | true | `` | 2/2/0 | none | +| `apps/frontend` | `plain` | true | `` | 2/2/0 | none | +| `clusters` | `plain` | true | `argocd` | 3/3/0 | none | + +## 13-sops-encrypted + +Reported result: **All reported candidates accepted**. Accepted `3`, refused `0`. +Unsupported constructs summary: `none`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `apps/frontend` | `kustomize-single` | true | `frontend-production` | 2/2/0 | none | +| `clusters/production` | `plain` | true | `flux-system` | 2/2/0 | none | +| `infrastructure/secrets` | `kustomize-single` | true | `infrastructure` | 1/1/0 | none | + +## 14-rendered-manifests + +Reported result: **Partial**. Accepted `3`, refused `2`. +Unsupported constructs summary: `namePrefix`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `argocd` | `plain` | true | `argocd` | 1/1/0 | none | +| `rendered/production` | `plain` | true | `frontend-production` | 3/3/0 | none | +| `rendered/staging` | `plain` | true | `frontend-staging` | 3/3/0 | none | +| `src/frontend/overlays/production` | `refused-structural` | false | `frontend-production` | 2/0/0 | refused-structural: kustomization uses unsupported feature(s): namePrefix | +| `src/frontend/overlays/staging` | `refused-structural` | false | `frontend-staging` | 2/0/0 | refused-structural: kustomization uses unsupported feature(s): namePrefix | + +## 15-mixed-and-hostile + +Reported result: **Partial**. Accepted `3`, refused `2`. +Unsupported constructs summary: `none`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `.` | `kustomize-single` | false | `backend` | 0/0/6 | non-krm-yaml: ci/.gitlab-ci.yml: YAML is not a Kubernetes manifest; non-krm-yaml: ci/docker-compose.yml: YAML is not a Kubernetes manifest; foreign-file: empty-dir/.gitkeep: foreign file empty-dir/.gitkeep is not a managed manifest; remove it or name it in .gittargetignore; mixed-managed-allowlisted: kustomization.yaml: managed resource kustomize.toolkit.fluxcd.io/v1/Kustomization/flux-system/apps must not live in the allowlisted build-directive file kustomization.yaml; impure-managed-file: mixed/bundle.yaml: a file with managed resources may contain only valid KRM documents; document #1 is a non-KRM document; impure-managed-file: mixed/bundle.yaml: a file with managed resources may contain only valid KRM documents; document #2 is an empty document; foreign-file: mixed/deployment.json: foreign file mixed/deployment.json is not a managed manifest; remove it or name it in .gittargetignore; invalid-yaml: templates/deployment.yaml: invalid YAML: yaml: line 21: did not find expected key; non-krm-yaml: values.yaml: YAML is not a Kubernetes manifest | +| `crossplane` | `plain` | true | `` | 1/1/0 | none | +| `kro` | `plain` | true | `` | 1/1/0 | none | +| `mixed` | `plain` | false | `` | 3/3/2 | impure-managed-file: bundle.yaml: a file with managed resources may contain only valid KRM documents; document #1 is a non-KRM document; impure-managed-file: bundle.yaml: a file with managed resources may contain only valid KRM documents; document #2 is an empty document; foreign-file: deployment.json: foreign file deployment.json is not a managed manifest; remove it or name it in .gittargetignore | +| `secrets` | `plain` | true | `backend` | 1/1/0 | none | + +## 16-flux-image-automation + +Reported result: **All reported candidates accepted**. Accepted `3`, refused `0`. +Unsupported constructs summary: `none`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `apps/frontend` | `kustomize-single` | true | `frontend` | 2/2/0 | none | +| `clusters/production` | `kustomize-single` | true | `flux-system` | 2/2/0 | none | +| `infrastructure/image-automation` | `kustomize-single` | true | `flux-system` | 3/3/0 | none | From f682b47164511feb15302cbccb7abbad168b80d1 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Fri, 10 Jul 2026 11:33:47 +0000 Subject: [PATCH 05/28] docs(pkg): stop promising compatibility we have not earned MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The package told consumers that "fields are added, never repurposed or removed within a schema major", that its refusal codes were "stable across releases", and that it was the "public, stable answer". The project is at v0.34.0. None of those promises are ones we are ready to keep, and the first API rename we want (RepoSummary.FleetRoot) would have had to break one of them. Say the true thing instead: pre-1.0, no compatibility guarantee, pin a version. Keep the two habits that genuinely help a consumer — ignore unknown fields, and match on IssueKind and the refusal reason codes rather than on the prose in Issue.Message and RefusalReason.Detail. SchemaVersion stays, demoted from a promise to a marker. docs/UPGRADING.md repeated the same guarantee to users and is corrected alongside. The design note that quoted the old wording is updated: the clock on renaming FleetRoot was never the doc comment, it is adoption. Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/UPGRADING.md | 3 ++- .../orchestrator-knowledge-boundary.md | 21 ++++++++++++------- pkg/manifestanalyzer/doc.go | 18 +++++++++++----- pkg/manifestanalyzer/folder.go | 8 ++++--- 4 files changed, 33 insertions(+), 17 deletions(-) diff --git a/docs/UPGRADING.md b/docs/UPGRADING.md index c5445289..9340ac8b 100644 --- a/docs/UPGRADING.md +++ b/docs/UPGRADING.md @@ -93,7 +93,8 @@ The JSON documents also gained a `schemaVersion` field, and one field was droppe - Replace `--mode scan` with `--mode scan-folder`, and `--mode repo-walker` with `--mode scan-repo`. A stale invocation fails loudly rather than falling back to the default `analyze` mode. -- Read `schemaVersion` and ignore fields you do not know; new fields are added within a schema major. +- Read `schemaVersion` and ignore fields you do not know; new fields get added. The report is + pre-1.0 and carries no compatibility guarantee — pin a version. - If you exec'd the binary only to reach the acceptance verdict, prefer importing `pkg/manifestanalyzer` and calling `ScanFolder` / `ScanRepo`. They run the same acceptance gate the operator's writer enforces, so a tool built on them cannot drift from the operator that will later diff --git a/docs/design/gitops-api/orchestrator-knowledge-boundary.md b/docs/design/gitops-api/orchestrator-knowledge-boundary.md index 5a9df13a..2399cd7c 100644 --- a/docs/design/gitops-api/orchestrator-knowledge-boundary.md +++ b/docs/design/gitops-api/orchestrator-knowledge-boundary.md @@ -238,16 +238,21 @@ fingerprint: a `flux-system/` directory containing `gotk-sync.yaml`. Until Tier 2 exists, that is a one-function change that both fixes the false negative on `09-flux-monorepo` and stops the false positives. -### 3. A public field with a clock on it +### 3. A public field worth renaming early -`RepoSummary.FleetRoot` is exported from `pkg/manifestanalyzer`, whose -[`doc.go`](../../../pkg/manifestanalyzer/doc.go) promises that *"fields are added, -never repurposed or removed within a schema major."* `SchemaVersion` is `v1`. +`RepoSummary.FleetRoot` is exported from +[`pkg/manifestanalyzer`](../../../pkg/manifestanalyzer). It should become something +honest — `clusterEntryPoints []string`, or a `NotAnEditingTarget` claim carrying a +reason. -Renaming it to something honest — `clusterEntryPoints []string`, or folding it -into a `NotAnEditingTarget` claim carrying a reason — is **free today and a -schema major bump once anything depends on it**. Nothing does yet. This decision -should be made before the write path hardens around the name, not after. +That package used to promise that fields are added and never repurposed or removed. +It no longer does: the project is pre-1.0, and +[`doc.go`](../../../pkg/manifestanalyzer/doc.go) now says so plainly, so a rename +costs nothing on paper. + +The real clock is **adoption, not the doc comment**. Every consumer that reads +`fleetRoot` before the rename is a consumer that has to change. Nothing does yet. +The decision should be made before the write path hardens around the name. ### 4. Onboarding, not refusal, for foreign files diff --git a/pkg/manifestanalyzer/doc.go b/pkg/manifestanalyzer/doc.go index 9190acad..33ec4bc2 100644 --- a/pkg/manifestanalyzer/doc.go +++ b/pkg/manifestanalyzer/doc.go @@ -1,6 +1,6 @@ // SPDX-License-Identifier: Apache-2.0 -// Package manifestanalyzer is the public, stable answer to two questions a tool built +// Package manifestanalyzer is the public answer to two questions a tool built // around GitOps Reverser needs to ask about a Git repository, without a cluster and // without writing anything: // @@ -11,11 +11,19 @@ // it commits a byte, so a tool built on this package cannot drift from the operator that // will later refuse the folder. Nothing here re-implements a rule. // -// # Stability +// # Stability: none yet // -// This package is the supported surface. The types below carry JSON tags and a -// [SchemaVersion]; fields are added, never repurposed or removed within a schema major. -// Everything under internal/ is not covered by that promise and is not importable from +// GitOps Reverser is pre-1.0, and so is this package. It is the surface a tool is meant +// to build on rather than reaching into internal/, but it carries no compatibility +// guarantee: fields may be renamed, removed, or given a new meaning in any release, and +// [SchemaVersion] may bump for reasons that would be breaking after 1.0. Pin a version. +// +// Two habits will nonetheless save you work. Ignore fields you do not recognise, because +// new ones do get added. Do not switch on the human-readable strings — [Issue.Message] +// and [RefusalReason.Detail] are prose, while [IssueKind] and the refusal reason codes +// are the values worth matching on. +// +// Everything under internal/ carries no guarantee either, and is not importable from // another module. // // The command-line equivalents are `manifest-analyzer --mode scan-folder --format json` and diff --git a/pkg/manifestanalyzer/folder.go b/pkg/manifestanalyzer/folder.go index 56a9a1d7..3db251e9 100644 --- a/pkg/manifestanalyzer/folder.go +++ b/pkg/manifestanalyzer/folder.go @@ -12,12 +12,14 @@ import ( ) // SchemaVersion identifies the JSON contract [FolderReport] and [RepoReport] marshal to. -// It bumps only on a breaking change — a field removed, renamed, or given a new meaning. -// Adding a field is not breaking, so consumers must ignore fields they do not know. +// It is a marker, not a promise: while the project is pre-1.0 the contract may change +// under a consumer, with or without a bump. Adding a field never bumps it, so consumers +// must ignore fields they do not know. const SchemaVersion = "v1" // IssueKind classifies why a folder was not accepted. The values are the operator's own -// refusal codes, stable across releases. +// refusal codes. They are the part of an [Issue] worth matching on, and they change less +// often than the surrounding shape — but pre-1.0 they can still change. type IssueKind string const ( From 871ac1f9ce23d05e6de385783858abf7bb6846b4 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Fri, 10 Jul 2026 11:39:04 +0000 Subject: [PATCH 06/28] =?UTF-8?q?docs(gitops-api):=20write-only=20encrypte?= =?UTF-8?q?d=20secrets=20=E2=80=94=20describe=20the=20ciphertext,=20never?= =?UTF-8?q?=20read=20it?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A SOPS Secret in Git is not a folder to refuse. It is a resource we can describe precisely and write blindly: "this is a SOPS Secret, it holds the keys DATABASE_PASSWORD and API_KEY, it is encrypted to these recipients, you may set a new value, and neither you nor GitOps Reverser can read the current one." This works because encryption is asymmetric. Encrypting to an age recipient needs only the public key that .sops.yaml already publishes in the repository, in plaintext. "Write but never read" is not a discipline we enforce; it is what the cryptography gives for free — and it is already how internal/git/encryption.go behaves. ResolvedEncryptionConfig "carries public age recipients only"; a Flux .agekey Secret is read "only to derive the public recipient"; SOPSEncryptor has Encrypt and no Decrypt. The gap is the model, not the crypto. The MAC is what shapes the API. It spans every plaintext value in the document, so one key cannot be patched while keys we cannot read are preserved: the unit of write is the whole document, and its plaintext comes from the live cluster rather than from Git. That kills the tempting CRD whose spec carries plaintext — that is just a Secret with worse RBAC. Instead EncryptedSecret is a projection: sourceRef to the live Secret, and a status that is entirely readable without a key, because SOPS leaves metadata and key *names* in cleartext and encrypts only values. Readable=False is the guarantee, not a degraded state. Four mermaid diagrams: key custody, today's false accept on fixture 13, the rotation sequence, and how the analyzer should classify. Records six open questions, including the sharp one: two encryptions of identical plaintext differ byte-for-byte, so the writer cannot converge by diffing. Ships no code. The boundary doc gains a one-liner and a link. Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/design/gitops-api/README.md | 1 + .../orchestrator-knowledge-boundary.md | 8 +- .../write-only-encrypted-secrets.md | 313 ++++++++++++++++++ 3 files changed, 321 insertions(+), 1 deletion(-) create mode 100644 docs/design/gitops-api/write-only-encrypted-secrets.md diff --git a/docs/design/gitops-api/README.md b/docs/design/gitops-api/README.md index 84f7dd1c..34a0a660 100644 --- a/docs/design/gitops-api/README.md +++ b/docs/design/gitops-api/README.md @@ -5,6 +5,7 @@ > Related: > [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md), > [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md), +> [write-only-encrypted-secrets.md](write-only-encrypted-secrets.md), > [../../future/idea-application-editing.md](../../future/idea-application-editing.md), > [../manifest/contextual-namespace-and-kustomize-folder-editing.md](../manifest/contextual-namespace-and-kustomize-folder-editing.md), > [../manifest/file-agnostic-placement.md](../manifest/file-agnostic-placement.md), diff --git a/docs/design/gitops-api/orchestrator-knowledge-boundary.md b/docs/design/gitops-api/orchestrator-knowledge-boundary.md index 2399cd7c..7b4c9b19 100644 --- a/docs/design/gitops-api/orchestrator-knowledge-boundary.md +++ b/docs/design/gitops-api/orchestrator-knowledge-boundary.md @@ -185,6 +185,12 @@ The analyzer already knows — `Encrypted` and `CauseEncrypted` exist in The bug is that `scan-repo` never surfaces it (see below). Ownership has two sources: the document itself, and a claim about it. +Ownership is also not always exclusive, and SOPS is the case that proves it: the +key holder owns *reading* while we can still own *writing*, because encrypting to +an `age` recipient needs only the public key that `.sops.yaml` publishes. That +turns a refusal into a capability, and it is designed in +[write-only-encrypted-secrets.md](write-only-encrypted-secrets.md). + ## Architecture rules **Never depend on `argoproj/argo-cd` or `fluxcd/*` Go modules.** They pull very @@ -273,7 +279,7 @@ Neither is designed here beyond the shape above. | Proposed | Scope | |---|---| -| **Ownership axis** | `Encrypted`/non-editable in `ResourceCounts`; a core write-gate that refuses a machine-owned or generated destination; `Generated` detection from headers and `config.kubernetes.io/origin`. Delivers the three false accepts. | +| **Ownership axis** | `Encrypted`/non-editable in `ResourceCounts`; a core write-gate that refuses a machine-owned or generated destination; `Generated` detection from headers and `config.kubernetes.io/origin`. Delivers the three false accepts. Its first API surface is [`EncryptedSecret`](write-only-encrypted-secrets.md). | | **Orchestrator interpreters** | `internal/gitops` claim vocabulary + registry; `argocd` and `flux` interpreters; `fleetRoot` re-expressed as `NotAnEditingTarget`; role classification (workload / control-plane / generated / machine-written) in the F8 report. | The ownership axis is the one with a correctness argument behind it and should go diff --git a/docs/design/gitops-api/write-only-encrypted-secrets.md b/docs/design/gitops-api/write-only-encrypted-secrets.md new file mode 100644 index 00000000..088aeeb2 --- /dev/null +++ b/docs/design/gitops-api/write-only-encrypted-secrets.md @@ -0,0 +1,313 @@ +# Write-only encrypted secrets: describe the ciphertext, never read it + +> Status: direction-setting; proposes an API, ships no code. +> Captured: 2026-07-10 +> Related: +> [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md), +> [README.md](README.md), +> [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md), +> [f8-repo-discovery-and-onboarding-scan.md](f8-repo-discovery-and-onboarding-scan.md), +> fixture [`13-sops-encrypted`](../../../test/fixtures/gitops-layouts/13-sops-encrypted/) + +## The idea + +A SOPS-encrypted `Secret` in Git is not a folder we should refuse. It is a +resource we can **describe precisely and write blindly**: + +> *"This is a SOPS-encrypted Secret. It lives at `apps/frontend/secret.enc.yaml`. +> It holds the keys `DATABASE_PASSWORD` and `API_KEY`. It is encrypted to these +> recipients. You **may** set a new value. You **cannot** read the current one, +> and neither can GitOps Reverser."* + +In the real cluster, the GitOps tool decrypts it and an ordinary `Secret` appears. +GitOps Reverser never participates in that step, and never wants to. + +This is [the ownership axis](orchestrator-knowledge-boundary.md) in its clearest +form. Refusal is the wrong answer because ownership here is not exclusive: the +key owner owns *reading*; we can still own *writing*. + +## Why this is not wishful thinking + +Encryption is **asymmetric**. Encrypting to an `age` recipient needs only that +recipient's **public** key, which SOPS publishes in plaintext, in the repository, +in `.sops.yaml`. Decryption needs the private identity, which lives in the +cluster and never leaves it. + +So "write but never read" is not a compromise or a policy we enforce by +discipline. It is what the cryptography already gives us for free. + +### It is already how the writer behaves + +This is not a new posture. It is the one +[`internal/git/encryption.go`](../../../internal/git/encryption.go) already +implements, and says so out loud: + +> `ResolvedEncryptionConfig` *"carries public age recipients only. The write path +> encrypts, it never decrypts, so no private age identity is retained, written to +> disk, or passed to the sops process."* + +and, where a Flux-compatible `.agekey` Secret is the source of recipients: + +> *"The write path reads these only to derive the public recipient; the private +> identity is never kept."* + +[`SOPSEncryptor`](../../../internal/git/sops_encryptor.go) has an `Encrypt` +method and **no `Decrypt`**. The gap this doc closes is therefore not +cryptographic and not in the writer. It is in the **model**: nothing in the API +or the reports tells a user that a resource is write-only, so the analyzer treats +an opaque document as an ordinary editable one. + +### Key custody + +```mermaid +flowchart LR + subgraph repo["Git repository"] + SOPSCFG[".sops.yaml
age recipient — PUBLIC"] + ENC["secret.enc.yaml
metadata + key names cleartext
values opaque ciphertext"] + end + + subgraph rev["GitOps Reverser"] + PUB["public recipient only"] + ENCR["sops --encrypt"] + end + + subgraph cluster["Real cluster"] + PRIV["age identity — PRIVATE
Secret sops-age"] + DEC["kustomize-controller
decryption.provider: sops"] + SEC["Secret frontend-db
plaintext"] + end + + SOPSCFG --> PUB --> ENCR --> ENC + ENC --> DEC + PRIV --> DEC --> SEC + + classDef secret fill:#fde,stroke:#b36 + class PRIV,SEC secret +``` + +The private identity never crosses into the left two boxes. That is the whole +design, and it already holds. + +## The constraint that shapes the API: the MAC + +A SOPS document carries a `mac` computed over **all** of its plaintext values and +sealed with the document's data key. Recomputing it requires knowing every +plaintext value in the document, and re-encrypting requires the data key, which +is itself sealed to the recipients. + +Two consequences, and they are not negotiable: + +1. **You cannot modify one key while preserving keys you cannot read.** Editing + `DATABASE_PASSWORD` in place while leaving `API_KEY` untouched is impossible + without decrypting `API_KEY` — because the `mac` spans both. +2. **The unit of write is the whole document.** The operator must supply every + value, generate a fresh data key, encrypt to the recipients from `.sops.yaml`, + and compute a new `mac`. This is exactly what `sops --encrypt` over a complete + plaintext document does, and exactly what the writer does today. + +So where does the complete plaintext come from, if not from Git? **From the live +cluster.** The intent cluster holds a real, readable `Secret`; Git holds the +ciphertext. The plaintext flows one way, and the operator never needs to reverse +it. + +That constraint is not a limitation to apologise for. It *is* the model: + +| Operation | Possible? | Why | +|---|---|---| +| Write a complete Secret | ✅ | Public recipient + full plaintext from the live cluster | +| Rotate one value, supplying all others | ✅ | Still a complete document | +| Patch one key, leaving unread keys intact | ❌ | The `mac` spans values we cannot read | +| Read the current value | ❌ | No private identity, by design | +| Diff desired plaintext against Git ciphertext | ❌ | Two encryptions of the same plaintext differ (fresh data key, fresh nonce) | +| List which keys exist | ✅ | Key **names** are cleartext in SOPS; only values are encrypted | + +That last row is the one that makes a useful API possible. With +`encrypted_regex: ^(data|stringData)$`, a SOPS file's `metadata`, its `kind`, and +the **names** of its keys are all plainly readable. Only the values are opaque. +We can describe almost everything about the secret without holding a key. + +## What is wrong today + +The analyzer already knows a document is encrypted — `CauseEncrypted` and an +`Encrypted` count exist in +[`internal/manifestanalyzer/analyzer.go`](../../../internal/manifestanalyzer/analyzer.go). +The write path already refuses to append plaintext into an encrypted file +([`placement.go`](../../../internal/manifestanalyzer/placement.go)). But +`scan-repo` never surfaces any of it, and its `editable` count is positional +rather than semantic, so: + +```mermaid +flowchart TD + A["apps/frontend/
deployment.yaml + secret.enc.yaml"] --> B{scan-repo} + B --> C["layout: kustomize-single
accepted: true
rendered/editable/nonKrm = 2/2/0"] + C --> D["A consumer reads:
'both documents are mine to write'"] + D --> E["Rewriting secret.enc.yaml
invalidates the mac"] + E --> F["kustomize-controller:
decryption fails"] + + classDef bad fill:#fdd,stroke:#c33 + class D,E,F bad +``` + +This is fixture `13-sops-encrypted` reporting green, and it is the sharpest of +the three false accepts recorded in +[the boundary doc](orchestrator-knowledge-boundary.md). The failure is invisible +in a diff: the ciphertext *looks* rewritten because ciphertext always looks +rewritten. + +## Proposal: `EncryptedSecret` as a projection, not a container + +The tempting design is a CRD whose `spec` carries the new plaintext. **Reject +it.** A Kubernetes API serves back what you applied, so plaintext in a CR `spec` +is a `Secret` with worse ergonomics and no `Secret`-specific RBAC, encryption at +rest, or audit handling. + +Instead, keep the plaintext where Kubernetes already knows how to hold it — in an +ordinary `Secret` — and let the new kind be the thing that is *missing*: a +**description of the ciphertext in Git, and of what you are permitted to do to +it.** + +```yaml +apiVersion: configbutler.ai/v1alpha3 +kind: EncryptedSecret +metadata: + name: frontend-db + namespace: frontend +spec: + # The live Secret whose plaintext is the source. Writing that Secret is how you + # write this resource. There is no plaintext anywhere in this object. + sourceRef: + kind: Secret + name: frontend-db + provider: sops +status: + # Everything below is readable WITHOUT a decryption key. + file: apps/frontend/secret.enc.yaml + keys: [DATABASE_PASSWORD, API_KEY] + recipients: ["age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p"] + encryptedAt: "2026-07-09T11:04:22Z" + readable: false + readableReason: NoDecryptionKey + conditions: + - type: Writable + status: "True" + reason: RecipientsResolved + - type: Readable + status: "False" + reason: NoDecryptionKey + message: >- + GitOps Reverser holds only the public age recipient. The value in Git + cannot be read here, by design. +``` + +The object is honest in both directions. `Readable=False` is not a degraded +state to be fixed; it is the guarantee. `Writable=True` says the recipients +resolved and a write will land. + +### Rotating a password + +```mermaid +sequenceDiagram + actor User + participant K8s as Intent cluster + participant Rev as GitOps Reverser + participant Git + participant Flux as kustomize-controller + participant Prod as Real cluster + + User->>K8s: kubectl edit secret frontend-db
(sets DATABASE_PASSWORD) + K8s-->>Rev: watch event: Secret changed + Note over Rev: Holds public recipient only.
Never reads Git ciphertext. + Rev->>Rev: sanitize → complete plaintext document + Rev->>Rev: sops --encrypt (fresh data key, new mac) + Rev->>Git: commit secret.enc.yaml on a branch + Rev-->>K8s: CommitRequest Pushed=True, sha, branch + Note over Git: Product layer opens the PR; a human merges. + Git-->>Flux: reconcile + Flux->>Flux: decrypt with private age identity + Flux->>Prod: apply Secret frontend-db +``` + +The operator's arrow into Git is one-way. It reads the live `Secret`, never the +committed one. Note also that **the whole document is rewritten** — which is +sound precisely because the live `Secret` is complete. + +### How the analyzer should classify it + +```mermaid +flowchart TD + D["document in Git"] --> E{sops: stanza present?} + E -- no --> P["ordinary KRM
readable ✔ writable ✔"] + E -- yes --> R{"private identity available?"} + R -- "no (always, by design)" --> W["encrypted
readable ✘ writable ✔
project as EncryptedSecret"] + R -- yes --> X["out of scope:
we do not hold keys"] + + W --> C1["counts: encrypted += 1
editable unchanged"] + P --> C2["counts: editable += 1"] + + classDef good fill:#dfd,stroke:#3a3 + class W,P good +``` + +The folder stays **accepted**. What changes is that its report says *what kind of +ownership we have over each document*, rather than silently claiming all of it. +`ResourceCounts` grows an `encrypted` field, and an encrypted document stops +counting as `editable` — the fix already named in the boundary doc. + +## Why this is a good product result + +- **A refusal becomes a capability.** "We do not support SOPS folders" turns into + "we support SOPS folders, and we cannot read your secrets." The second sentence + is a *feature*, and it is the one a security reviewer wants to hear. +- **The blast radius of a compromised operator shrinks to what it can encrypt.** + It cannot exfiltrate a secret it has never been able to decrypt. That claim is + auditable: no `Decrypt` exists in the binary. +- **It composes with the existing least-privilege direction.** The Secret grant is + namespace-local, and the operator holds a public key. Both are the same + argument, made at different layers. +- **It generalises.** `EncryptedSecret` is the first concrete case of surfacing an + ownership fact as an API object rather than as a refusal. `Generated` (committed + render output) and `WrittenBy` (image automation) want the same treatment: not + "refused", but "here is what you may do to it." + +## What this is not + +- **Not a decryption feature.** No `Decrypt`, no private key, no `--ignore-mac`, + not now and not behind a flag. The moment the operator can read, the security + argument above evaporates. +- **Not a secret manager.** Rotation policy, generation, and vault integration are + the product layer's business. +- **Not a merge.** A per-key patch of an encrypted document is impossible without + reading it, and pretending otherwise would corrupt the `mac`. + +## Open questions + +1. **Convergence without a diff.** Two encryptions of identical plaintext are + byte-different, so the writer cannot ask "has this changed?" by comparing. + Today [`secretEncryptionCacheScope`](../../../internal/git/encryption.go) + scopes a cache to avoid re-encrypting. Is that sufficient across restarts and + resyncs, or does the document need a stable plaintext fingerprint — an + HMAC-under-the-recipient, say — carried as an annotation so a no-op write can + be recognised as a no-op? Without an answer, a resync risks a commit per + reconcile. +2. **Adoption of a secret we did not write.** For a `secret.enc.yaml` already in + Git, `status.keys` is readable but the values are not. If the live `Secret` + has *fewer* keys than Git, writing it **deletes** the keys we could not see. + Is adoption therefore gated on key-set equality, and what surfaces the + mismatch? +3. **Where does `status.keys` come from when `encrypted_regex` is unusual?** The + common config encrypts only `data`/`stringData`. A rule encrypting + `metadata.name` would make even the identity opaque. Refuse those, or degrade + the projection? +4. **Is `EncryptedSecret` cluster-scoped truth or per-`GitTarget`?** The same + `Secret` name may exist in several targets with different recipients. Does the + projection key on `(GitTarget, identity)`? +5. **Should `Readable=False` block the intent cluster from showing a `Secret` at + all?** A user who runs `kubectl get secret frontend-db -o yaml` in the intent + cluster sees whatever plaintext they last wrote — which may be stale relative + to Git if someone edited the ciphertext by hand. Is the live `Secret` + authoritative, or is that drift we must detect and cannot see? +6. **Does this extend to SealedSecrets and ExternalSecrets?** Both are + "a Secret that is not the Secret." A `SealedSecret` is also write-only under an + asymmetric key — the same shape, a different controller. An `ExternalSecret` + holds no ciphertext at all, only a reference, which is a *third* ownership + shape. Worth one abstraction, or three kinds? From 10b1a13bada5475d2c24fa614a444cb97fa3d179 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Fri, 10 Jul 2026 12:01:14 +0000 Subject: [PATCH 07/28] docs: fix four mermaid sequence diagrams broken by a semicolon MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mermaid's sequenceDiagram lexer maps `;` to NEWLINE, so a semicolon in note or message prose ends the statement and the remaining words are parsed as a new one — "Expecting SOLID_ARROW..., got 'NEWLINE'". The diagram renders as an error box. The rotation sequence in write-only-encrypted-secrets.md hit it. Parsing every mermaid block in docs/ against mermaid 11.16 found three more, all predating this branch and all the same construct: design/manifest/gitpathaccepted-projection-race-and-external-drift.md finished/canonical-stream-retirement.md finished/commitrequest-multi-finalize-design.md Semicolons become commas. No prose meaning changes. All 78 mermaid blocks under docs/ now parse. Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/design/gitops-api/write-only-encrypted-secrets.md | 2 +- .../gitpathaccepted-projection-race-and-external-drift.md | 2 +- docs/finished/canonical-stream-retirement.md | 2 +- docs/finished/commitrequest-multi-finalize-design.md | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/design/gitops-api/write-only-encrypted-secrets.md b/docs/design/gitops-api/write-only-encrypted-secrets.md index 088aeeb2..392e2959 100644 --- a/docs/design/gitops-api/write-only-encrypted-secrets.md +++ b/docs/design/gitops-api/write-only-encrypted-secrets.md @@ -221,7 +221,7 @@ sequenceDiagram Rev->>Rev: sops --encrypt (fresh data key, new mac) Rev->>Git: commit secret.enc.yaml on a branch Rev-->>K8s: CommitRequest Pushed=True, sha, branch - Note over Git: Product layer opens the PR; a human merges. + Note over Git: Product layer opens the PR, then a human merges. Git-->>Flux: reconcile Flux->>Flux: decrypt with private age identity Flux->>Prod: apply Secret frontend-db diff --git a/docs/design/manifest/gitpathaccepted-projection-race-and-external-drift.md b/docs/design/manifest/gitpathaccepted-projection-race-and-external-drift.md index 6b38bc4b..decbf7f3 100644 --- a/docs/design/manifest/gitpathaccepted-projection-race-and-external-drift.md +++ b/docs/design/manifest/gitpathaccepted-projection-race-and-external-drift.md @@ -170,7 +170,7 @@ sequenceDiagram DP->>DP: first resync sees secrets.txt DP->>Map: MarkTargetGitPathRefused Note right of DP: map updated, but the
controller is NOT enqueued - Note over CP,DP: condition stays True until the next requeue (10m);
e2e gives up at 150s → failure + Note over CP,DP: condition stays True until the next requeue (10m)
e2e gives up at 150s → failure ``` ## 3. What is and is not the cause diff --git a/docs/finished/canonical-stream-retirement.md b/docs/finished/canonical-stream-retirement.md index afae4868..adcc259a 100644 --- a/docs/finished/canonical-stream-retirement.md +++ b/docs/finished/canonical-stream-retirement.md @@ -342,7 +342,7 @@ sequenceDiagram WH-->>Streams: mirror cm@101, deploy@102 Author->>API: CREATE CommitRequest (rv_C = 105) API-->>CRC: watch event (phase=="") - CRC->>CRC: capture rv_C=105; stamp WaitingForAuditEvent + CRC->>CRC: capture rv_C=105, stamp WaitingForAuditEvent Streams-->>Tails: deliver 101,102 Tails->>BW: enqueue upserts cm/a, deploy/b CRC->>Tails: BARRIER: wait each G-tail applied past rv_C (105) diff --git a/docs/finished/commitrequest-multi-finalize-design.md b/docs/finished/commitrequest-multi-finalize-design.md index deb79eda..a45fee73 100644 --- a/docs/finished/commitrequest-multi-finalize-design.md +++ b/docs/finished/commitrequest-multi-finalize-design.md @@ -197,7 +197,7 @@ sequenceDiagram CRC1->>FC: Enqueue({rv_C=100, types, author1, msg1}) CRC2->>FC: Enqueue({rv_C=110, types, author2, msg2}) - Note over FC: channel is FIFO; CR-1 was enqueued first + Note over FC: channel is FIFO, CR-1 was enqueued first Note over FC: START processing CR-1 FC->>Tails: DrainTailsToWatermark(rv_C=100) From c273abd3af5e549559a807ac0ad3d05c5b3cd276 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Fri, 10 Jul 2026 12:20:04 +0000 Subject: [PATCH 08/28] docs(gitops-api): capability model, SealedSecrets/ExternalSecrets, intent-cluster hydration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Answers the open question left by write-only-encrypted-secrets.md — "one abstraction, or three kinds?" — with: neither. One capability model, and exactly one new kind, for a reason that is not encryption. A real API server settles it. The same ciphertext that Kubernetes rejects inside a Secret ("illegal base64 data at input byte 3", because `data` is typed as base64 bytes, plus "unknown field sops") is accepted and round-tripped byte for byte inside a CRD field typed `string`. So a SOPS Secret is hard because it is not schema-conformant, not because it is opaque. A SealedSecret holds the same sort of ciphertext in its own CRD and is ordinary, valid KRM. An ExternalSecret holds no ciphertext at all. resource-capability-model.md — Tier 0b, between "is this KRM?" and "how does kustomize render it?". Four knobs asserted by the document itself: schemaConformant, visibility (plain/opaque/elsewhere), writeUnit (document/key/none), derived. A compiled-in classifier table, explicitly not a plugin API and never a decryption interface. Unknown kinds default to ordinary KRM, so the registry only ever narrows. sealed-secrets-and-external-secrets.md — SealedSecrets seals each value independently with no MAC across the document, so unlike SOPS it supports per-key writes. Its real cost is not crypto: a live Secret producing a SealedSecret document is a *kind* transform, and the writer's identity model assumes one identity per document. Strict sealing scope binds ciphertext to (namespace, name), so renaming silently destroys every value we did not re-seal — refuse the rename. ExternalSecrets needs no support at all; it already works. What both make urgent is a gate we do not have: ESO and sealed-secrets stamp an ownerReference on the Secret they derive, and a WatchRule matching v1/Secret would mirror that derived Secret into Git as a second source of truth. Not a plaintext leak — content_writer.go refuses an unencrypted Secret — but sanitize.go deletes ownerReferences without ever gating on them, so the evidence is destroyed rather than used. Never mirror an object with a controller ownerReference. Tier 0, live-state, protects far more than secrets. intent-cluster-hydration.md — can Argo CD or Flux sync these into a temporary cluster? No, on two independent grounds. A reconciler's whole job is to revert divergence, and in the intent cluster divergence IS the user's edit. And a SOPS Secret fails to deserialize regardless of validation settings, so Flux does not ignore it, it fails the Kustomization. Worse, a lenient applier stores the ciphertext as the value and an app reads its password as the literal text "ENC[AES256_GCM,...]" with no error anywhere. The rule: the intent cluster gets CRDs, never controllers. It is a schema surface, not a reconciliation surface. SealedSecret and ExternalSecret then hydrate as themselves and sit inert and editable. A SOPS Secret cannot, which is the entire reason EncryptedSecret exists. Hydration is a one-shot strict apply of the document store the analyzer already builds, and RepoReport should grow requiredCRDs to say what must be installed first. Ships no code. Eleven new open questions, none answered. Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/design/gitops-api/README.md | 3 + .../gitops-api/intent-cluster-hydration.md | 209 +++++++++++++++ .../orchestrator-knowledge-boundary.md | 35 ++- .../gitops-api/resource-capability-model.md | 203 ++++++++++++++ .../sealed-secrets-and-external-secrets.md | 251 ++++++++++++++++++ .../write-only-encrypted-secrets.md | 17 +- 6 files changed, 707 insertions(+), 11 deletions(-) create mode 100644 docs/design/gitops-api/intent-cluster-hydration.md create mode 100644 docs/design/gitops-api/resource-capability-model.md create mode 100644 docs/design/gitops-api/sealed-secrets-and-external-secrets.md diff --git a/docs/design/gitops-api/README.md b/docs/design/gitops-api/README.md index 34a0a660..c8875f3c 100644 --- a/docs/design/gitops-api/README.md +++ b/docs/design/gitops-api/README.md @@ -5,7 +5,10 @@ > Related: > [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md), > [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md), +> [resource-capability-model.md](resource-capability-model.md), > [write-only-encrypted-secrets.md](write-only-encrypted-secrets.md), +> [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md), +> [intent-cluster-hydration.md](intent-cluster-hydration.md), > [../../future/idea-application-editing.md](../../future/idea-application-editing.md), > [../manifest/contextual-namespace-and-kustomize-folder-editing.md](../manifest/contextual-namespace-and-kustomize-folder-editing.md), > [../manifest/file-agnostic-placement.md](../manifest/file-agnostic-placement.md), diff --git a/docs/design/gitops-api/intent-cluster-hydration.md b/docs/design/gitops-api/intent-cluster-hydration.md new file mode 100644 index 00000000..491e29af --- /dev/null +++ b/docs/design/gitops-api/intent-cluster-hydration.md @@ -0,0 +1,209 @@ +# Intent-cluster hydration: CRDs, never controllers + +> Status: direction-setting; answers "can Argo CD or Flux sync these into the +> intent cluster?", ships no code. +> Captured: 2026-07-10 +> Related: +> [resource-capability-model.md](resource-capability-model.md), +> [write-only-encrypted-secrets.md](write-only-encrypted-secrets.md), +> [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md), +> [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md), +> [README.md](README.md) + +## The asymmetry nobody wrote down + +GitOps Reverser's whole design is one direction: **live → Git**. Watch the cluster, +edit the folder, push a branch. + +But the product's premise is that a user *edits Kubernetes objects*. Before they +can edit an object, that object has to **exist** in the intent cluster. Something +must run the other direction — **Git → live** — at least once. + +That direction is exactly what Argo CD and Flux do for a living, and the obvious +move is to point one of them at the repository. This doc argues against that, on +two independent grounds, and lands on a rule that is much simpler than either +tool. + +## Ground one: a reconciler would fight the user + +Argo CD and Flux do not hydrate. They **reconcile**. Their job, their entire +value, is that when live state diverges from Git, they *put it back*. + +In the intent cluster, live state diverging from Git is not drift. **It is the +user's edit.** It is the product. + +```mermaid +sequenceDiagram + actor User + participant K8s as Intent cluster + participant Recon as Flux or Argo CD + participant Rev as GitOps Reverser + participant Git + + Recon->>K8s: apply desired state from Git + User->>K8s: edit replicas 3 to 5 + Note over Recon: sees "drift" + Recon->>K8s: revert replicas to 3 + Note over Rev: may never observe the edit at all + Rev-->>Git: nothing to commit +``` + +At best this is a race the user loses. At worst — with `prune: true`, or Argo CD +`selfHeal` — the edit is reverted before the watch even fires. Turning +self-healing off leaves a reconciler that still owns fields, still prunes, and +still re-applies on every interval. + +> **The intent cluster must never have a controller reconciling it toward Git.** +> Hydration is a one-shot apply, not a reconciliation. + +This conclusion holds for every resource kind, and has nothing to do with secrets. + +## Ground two: a SOPS Secret cannot be applied at all + +The user's instinct — *"SOPS is by default not a good KRM object, so will Flux +ignore it, or fail?"* — is right, and the answer is **fail**, deterministically. + +Verified against a real API server (Kubernetes v1.36, +`kubectl apply --dry-run=server`): + +| Document | Result | +|---|---| +| `Secret` with `data:` holding `ENC[AES256_GCM,...]` | `BadRequest: illegal base64 data at input byte 3` | +| …the same, with validation disabled | **same error** | +| `Secret` with valid base64 plus a top-level `sops:` field | `BadRequest: strict decoding error: unknown field "sops"` | +| …the same, with validation disabled | created, `sops:` silently dropped | +| `Secret` with `stringData:` ciphertext, validation disabled | created, value stored as the literal text `ENC[AES256_GCM,...]` | + +The first two rows are the load-bearing ones. `data` is typed as base64 bytes, so +the failure happens at **deserialization**, before validation. No amount of +lenient decoding rescues it. Any applier — `kubectl`, Argo CD, Flux's +kustomize-controller — hits the same wall. + +So Flux does not ignore a SOPS Secret. It fails the whole `Kustomization`, and the +apply error is the only thing the user sees. Flux's own answer is +`spec.decryption`, which needs the **private** age identity — precisely the thing +[we will never hold](write-only-encrypted-secrets.md). + +The last row is the nightmare: a lenient applier stores the ciphertext *as the +value*, and an application reads its password as the literal string +`ENC[AES256_GCM,...]`. Nothing errors. **Hydration must use strict decoding.** + +## The rule that falls out + +Hydration is not "run a GitOps tool against a small cluster." It is: + +> **Install the CRDs. Never install the controllers.** + +The intent cluster is a **schema surface**, not a reconciliation surface. It exists +so that `kubectl` can validate, store, and serve intent — nothing more. Every +controller you install has a job, and in this cluster every one of those jobs is +wrong: + +| Controller | What it would do here | Verdict | +|---|---|---| +| Flux / Argo CD | revert the user's edit as drift | fatal | +| sealed-secrets | try to unseal without the private key | fails, noisily | +| External Secrets Operator | fetch real secrets from the real Vault into a throwaway cluster | a security regression | +| any workload controller | schedule Pods nobody asked for | pointless | + +Install their **CRDs**, and every one of those kinds becomes storable, editable +and `kubectl`-validatable. Install nothing else. + +Notice how cleanly this resolves the three secret shapes: + +```mermaid +flowchart TD + subgraph git["Git"] + A["SealedSecret"] + B["ExternalSecret"] + C["Secret with sops: stanza"] + end + + A --> H{"hydrate
strict apply"} + B --> H + C --> H + + H -- "valid KRM, CRD installed" --> OK1["stored as itself
editable"] + H -- "valid KRM, CRD installed" --> OK2["stored as itself
editable"] + H -- "not schema-conformant" --> REJ["API server refuses"] + REJ --> PROJ["GitOps Reverser projects
an EncryptedSecret instead"] + + A --- OK1 + B --- OK2 + + classDef good fill:#dfd,stroke:#3a3 + classDef bad fill:#fdd,stroke:#c33 + class OK1,OK2,PROJ good + class REJ bad +``` + +A `SealedSecret` and an `ExternalSecret` hydrate *as themselves*, because they are +ordinary KRM ([and that, not encryption, is the discriminator](resource-capability-model.md)). +Their controllers stay out, so they sit there inert and editable, which is exactly +what we want. + +A SOPS `Secret` cannot hydrate as itself, because it is not a valid `Secret`. That +— and nothing else — is why `EncryptedSecret` exists. + +## Who hydrates, then? + +Not Argo CD. Not Flux. GitOps Reverser already parses the repository into a +document store to answer `ScanRepo`. Hydration is that store, applied once: + +1. Walk the `GitTarget` subtree, exactly as `ScanDir` does. +2. For each document, ask the [capability registry](resource-capability-model.md). +3. `schemaConformant` → apply it, **strictly**. +4. Not `schemaConformant` → do not apply it. Create its projection instead. +5. Never prune. Never re-apply on an interval. Never watch Git. + +No Git-host knowledge is added, no orchestrator is emulated, and the operator +gains a capability it half has already. + +The intent cluster is disposable. If it drifts from Git for reasons other than the +user's edit, the answer is to throw it away and hydrate a fresh one — not to +reconcile it. + +## What this asks of `scan-repo` + +To hydrate a repository, you must first install the CRDs for every kind it +contains. Nothing reports that today. + +`RepoReport` should grow a **`requiredCRDs`** field: the set of group/kind pairs a +repository's documents use that are not built into Kubernetes. It is free to +compute — the walk has already parsed every document's `apiVersion` and `kind` — +and it is exactly the list an onboarding step needs before it can stand a cluster +up. It sits naturally beside `unsupportedConstructs`, which already answers the +neighbouring question "what does this repo use that we do not manage?" + +For the layout corpus, `requiredCRDs` would report `HelmRelease` and +`Kustomization` for [`09-flux-monorepo`](../../../test/fixtures/gitops-layouts/09-flux-monorepo/), +`Application` for the Argo CD fixtures, and `Composition` plus +`ResourceGraphDefinition` for +[`15-mixed-and-hostile`](../../../test/fixtures/gitops-layouts/15-mixed-and-hostile/). + +## Open questions + +1. **Real CRDs, or synthesised permissive ones?** To *edit* an `Application` you + do not need Argo CD's real schema — a structural CRD with + `x-kubernetes-preserve-unknown-fields` would store it. That removes the need to + track upstream CRD versions, at the cost of losing every validation the user + would want. Which failure is worse: rejecting a valid edit, or accepting an + invalid one that only fails at merge? +2. **What is the hydration unit?** One `GitTarget` subtree, or the whole + repository? A subtree may reference a `ConfigMap` defined outside it. The + [read-scope](f8-repo-discovery-and-onboarding-scan.md) machinery already knows + how to answer this for kustomize bases. +3. **How long does an intent cluster live?** Per editing session, per `GitTarget`, + or long-lived per tenant? A long-lived one will drift from Git as other people + merge, and nothing here reconciles it. Is re-hydration on branch change the + answer, and what happens to an in-flight edit? +4. **Does the user ever see the ciphertext?** `EncryptedSecret` deliberately shows + key names and not values. A user in the intent cluster running + `kubectl get secret` sees only what they themselves wrote this session, because + the plaintext was never hydrated. Is that surprising enough to need surfacing + as a condition on the object? +5. **What hydrates a kind we do not recognise?** A CR with no capability + classifier is assumed `plain`, applied, and edited. If it turns out to hold + ciphertext in a string field, we will happily rewrite it from live state. + Is the ordinary-KRM default right, or should an unknown CRD be read-only until + someone classifies it? diff --git a/docs/design/gitops-api/orchestrator-knowledge-boundary.md b/docs/design/gitops-api/orchestrator-knowledge-boundary.md index 7b4c9b19..4c5ed49b 100644 --- a/docs/design/gitops-api/orchestrator-knowledge-boundary.md +++ b/docs/design/gitops-api/orchestrator-knowledge-boundary.md @@ -120,7 +120,7 @@ heuristic can ever see it. ## The tiering -Three tiers of knowledge. Only the third is the one to isolate. +Four tiers of knowledge. Only the last is the one to isolate. ### Tier 0 — KRM facts @@ -128,6 +128,20 @@ Is this document a Kubernetes object? Is it encrypted? Is this file YAML but not KRM? Do two documents claim the same identity? Zero tool knowledge. This is the core, and it is the only tier permitted in the acceptance gate's hot path. +### Tier 0b — Resource semantics + +*What may I do to this document?* A value may be unreadable, may live in another +system, or may be owned by a controller. Every such fact is asserted by **the +document itself** — a `sops:` stanza, a `SealedSecret`'s `encryptedData`, an +`ExternalSecret`'s `remoteRef` — which is what separates this from Tier 2, where +the fact is asserted by *another* object. + +Four knobs and a lookup table, designed in +[resource-capability-model.md](resource-capability-model.md). The discriminator +turns out not to be encryption but **schema conformance**: a real API server +rejects a SOPS `Secret` and accepts the identical ciphertext inside a CRD field +typed `string`. + ### Tier 1 — Renderer facts Kustomize build semantics: `resources` graphs, render roots, generators, @@ -178,7 +192,7 @@ The vocabulary is not invented — it is read straight off the corpus. `WrittenB is fixtures 16 and 05. `Generated` is 14. `TransformedOutOfBand` is 10. `OverriddenBy` is 05 and 07. `NotAnEditingTarget` is the honest `fleetRoot`. -Note that **encryption is Tier 0, not Tier 2.** A SOPS document is +Note that **encryption is Tier 0b, not Tier 2.** A SOPS document is self-describing: the `sops:` stanza is in the file. No orchestrator asserts it. The analyzer already knows — `Encrypted` and `CauseEncrypted` exist in [`internal/manifestanalyzer/analyzer.go`](../../../internal/manifestanalyzer/analyzer.go). @@ -281,10 +295,19 @@ Neither is designed here beyond the shape above. |---|---| | **Ownership axis** | `Encrypted`/non-editable in `ResourceCounts`; a core write-gate that refuses a machine-owned or generated destination; `Generated` detection from headers and `config.kubernetes.io/origin`. Delivers the three false accepts. Its first API surface is [`EncryptedSecret`](write-only-encrypted-secrets.md). | | **Orchestrator interpreters** | `internal/gitops` claim vocabulary + registry; `argocd` and `flux` interpreters; `fleetRoot` re-expressed as `NotAnEditingTarget`; role classification (workload / control-plane / generated / machine-written) in the F8 report. | - -The ownership axis is the one with a correctness argument behind it and should go -first. Interpreters are what make it complete, and what make the F8 report an -onboarding answer rather than a folder census. +| **Resource capability registry** | Tier 0b: four knobs, three classifiers ([design](resource-capability-model.md)). Carries the day-1 gate below. | +| **Derived-object gate** | Never mirror an object carrying a controller `ownerReference` — it is a controller's output, not desired state. Live-state, Tier 0, no orchestrator knowledge. Today [`sanitize`](../../../internal/sanitize/sanitize.go) *deletes* that field without ever gating on it, so an ESO- or sealed-secrets-derived `Secret` would be committed as a second source of truth. See [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md). | + +The derived-object gate is the smallest and the most urgent: it is a few lines, +it needs nothing else in this doc, and it protects far more than secrets. The +ownership axis is next, being the one with a correctness argument behind it. +Interpreters are what make it complete, and what make the F8 report an onboarding +answer rather than a folder census. + +A fifth thing falls out of hydration rather than from ownership: `RepoReport` +should report `requiredCRDs`, the group/kind pairs a repository needs installed +before an intent cluster can hold its documents. See +[intent-cluster-hydration.md](intent-cluster-hydration.md). ## Why the F8 report is not yet an onboarding answer diff --git a/docs/design/gitops-api/resource-capability-model.md b/docs/design/gitops-api/resource-capability-model.md new file mode 100644 index 00000000..2da41149 --- /dev/null +++ b/docs/design/gitops-api/resource-capability-model.md @@ -0,0 +1,203 @@ +# Resource capability model: what may I do to this document? + +> Status: direction-setting; proposes one small registry, ships no code. +> Captured: 2026-07-10 +> Related: +> [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md), +> [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md), +> [intent-cluster-hydration.md](intent-cluster-hydration.md), +> [write-only-encrypted-secrets.md](write-only-encrypted-secrets.md), +> [README.md](README.md) + +## Purpose + +Some resources do not fully align with "read it, edit it, write it back." A +value may be unreadable, may live in another system entirely, or may be owned by +a controller. Today the writer discovers this one special case at a time. + +This doc proposes the smallest vocabulary that lets **any present or future +kind** declare what may be done to it, without core learning anything about that +kind's controller. + +Four knobs and a lookup table. Not a plugin system. + +SOPS is deliberately **not** the subject here. It is one row in the table, and +the point of the table is that it stops being a special case. + +## Where this sits + +[The boundary doc](orchestrator-knowledge-boundary.md) tiers knowledge. This adds +the missing half-tier, and its defining property is *who asserts the fact*: + +| Tier | Question | Asserted by | +|---|---|---| +| **0** | Is this a Kubernetes object at all? | the bytes | +| **0b** | **What may I do to this object?** | **the document itself** | +| 1 | How does kustomize render it? | the kustomization | +| 2 | Who else claims this path? | *another object* (Argo `Application`, Flux `Kustomization`, `ImageUpdateAutomation`) | + +Tier 0b is self-describing, which is exactly why it must not live with the +orchestrator interpreters. A `SealedSecret` announces its own opacity. Nothing +external has to tell us. + +## The evidence: schema conformance, not encryption + +The instinct is that encrypted things are hard because they are encrypted. That +is wrong, and a real API server settles it. Every result below is from +`kubectl apply --dry-run=server` against Kubernetes v1.36. + +| # | Document | Result | +|---|---|---| +| 1 | `Secret` with `data:` holding `ENC[AES256_GCM,...]` | `BadRequest: illegal base64 data at input byte 3` | +| 2 | `Secret` with `stringData:` ciphertext plus a top-level `sops:` field | `BadRequest: strict decoding error: unknown field "sops"` | +| 3 | `Secret` with *valid* base64 plus a top-level `sops:` field | `BadRequest: strict decoding error: unknown field "sops"` | +| 4 | as (3), with `--validate=false` | **created** — `sops:` silently dropped | +| 5 | as (2), with `--validate=false` | **created** — value stored as the literal string `ENC[AES256_GCM,...]` | +| 6 | A CRD field typed `string` holding the *identical* ciphertext | **created**, round-tripped byte for byte | + +Read rows 1 and 6 together. The same ciphertext is rejected inside a `Secret` and +accepted inside a CRD. + +> A SOPS `Secret` is not hard because it is encrypted. It is hard because it +> stores ciphertext in `data`, a field the `Secret` schema types as +> base64-encoded bytes, and adds a top-level `sops` field the schema does not +> have. A `SealedSecret` stores the same kind of ciphertext in a field its own +> CRD types as `string`, so it is ordinary, valid KRM. + +**Encryption is orthogonal. Schema conformance is the discriminator.** + +Row 5 is the one to be frightened of: with validation disabled, the API server +accepts the document and an application later reads its password as the literal +text `ENC[AES256_GCM,...]`. No error anywhere. Anything that applies documents on +our behalf must use strict decoding. + +## The four knobs + +```mermaid +flowchart TD + D["a KRM document"] --> S{"would an API server
accept it as-is,
strict decoding?"} + S -- no --> NC["schemaConformant: false
needs a projection kind"] + S -- yes --> V{"where is the value?"} + V -- "in the document, readable" --> P["visibility: plain"] + V -- "in the document, encrypted" --> O["visibility: opaque"] + V -- "not here, only a reference" --> E["visibility: elsewhere"] + + O --> U{"is each value
independently sealed?"} + U -- yes --> K["writeUnit: key"] + U -- "no, one MAC spans all" --> W["writeUnit: document"] + + D --> OWN{"controller ownerReference?"} + OWN -- yes --> DER["derived: true
never mirror it"] + + classDef bad fill:#fdd,stroke:#c33 + classDef good fill:#dfd,stroke:#3a3 + class NC,DER bad + class P,O,E,K,W good +``` + +**1. `schemaConformant`** — would an API server accept this document as written, +under strict decoding? If not, it can never be stored, hydrated, or edited as +itself, and it needs a projection kind. This is the *only* reason to mint a new +kind, and it is why [`EncryptedSecret`](write-only-encrypted-secrets.md) exists. + +**2. `visibility`** — `plain` (the value is here and readable), `opaque` (the +value is here and encrypted), or `elsewhere` (there is no value here, only a +reference to one). Note `elsewhere` is not a degraded `opaque`: an +`ExternalSecret` is entirely readable, it simply is not the secret. + +**3. `writeUnit`** — `document`, `key`, or `none`. Whether a single value can be +replaced without knowing the others. SOPS is `document` because one `mac` spans +every plaintext value. Sealed Secrets is `key` because each value is sealed +independently. `none` means the document is not ours to write at all. + +**4. `derived`** — this object was produced by a controller from another object. +It is an *output*, not desired state, and mirroring it to Git creates a second +source of truth. Evidence: a controller `ownerReference` on the live object. + +That last knob is not hypothetical. `internal/sanitize/sanitize.go` **deletes** +`ownerReferences` before a document reaches Git, and nothing gates on them +first — so the evidence that an object was derived is destroyed rather than used. +See [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md) +for what that costs. + +## The table + +| Kind | `schemaConformant` | `visibility` | `writeUnit` | New kind needed? | +|---|---|---|---|---| +| `ConfigMap`, `Deployment`, … | ✅ | `plain` | `document` | no | +| `Secret` (plain) | ✅ | `plain` | `document` | no | +| `Secret` + `sops:` stanza | ❌ | `opaque` | `document` | **yes** — `EncryptedSecret` | +| `SealedSecret` | ✅ | `opaque` | `key` | no | +| `ExternalSecret` | ✅ | `elsewhere` | `document` | no | +| any object with a controller `ownerReference` | ✅ | — | `none` (`derived`) | no | +| a file claimed by `ImageUpdateAutomation` | ✅ | `plain` | `none` | no (a Tier 2 claim) | + +The punchline of the whole exercise: + +> **Exactly one row needs a new kind, for exactly one reason, and that reason is +> not encryption.** + +## Shape of the registry + +The classifier cannot be a constant per GVK, because `Secret` is `plain` or +`opaque` depending on whether the document carries a `sops:` stanza. So the +registry maps a group/kind to a **classifier**, and the classifier reads the +document. + +```go +type Visibility int // Plain | Opaque | Elsewhere +type WriteUnit int // Document | Key | None + +type Capability struct { + SchemaConformant bool + Visibility Visibility + WriteUnit WriteUnit + Derived bool + // Reason is prose for a human. Never switch on it. + Reason string +} + +type Classifier interface { + // Handles is version-tolerant: group and kind only. + Handles(group, kind string) bool + Classify(doc *Document) Capability +} +``` + +Default for an unknown kind: `schemaConformant: true`, `plain`, `document` — the +ordinary KRM assumption that already holds today. The registry only ever *narrows* +what may be done, never widens it, which keeps it safe to add classifiers +incrementally. + +## Deliberately not + +- **Not a plugin API.** A compiled-in table of three or four classifiers. If + users need to describe their own CRDs, the escape hatch is the existing + `.gittargetignore`, not a DSL. +- **Not a decryption interface.** No knob asks for a key. `opaque` is terminal. +- **Not controller emulation.** The registry never unseals, fetches, or renders. +- **Not a fifth knob.** If a kind seems to need one, check first whether the fact + is asserted by *another object* — in which case it is a Tier 2 claim, and it + belongs in the claim vocabulary, not here. + +## Open questions + +1. **Where does `schemaConformant` come from?** Today it would be hardcoded for + the SOPS case. It could instead be *derived*: fetch the OpenAPI schema and try + a strict decode. That is exact, and it needs a cluster — which + [`ScanRepo` explicitly does not have](f8-repo-discovery-and-onboarding-scan.md). + Is a hardcoded classifier acceptable, or does this belong to a cluster-aware + second pass? +2. **Is `visibility` per-document or per-field?** A `SealedSecret` is `opaque` in + `spec.encryptedData` and `plain` in `spec.template`, which is fully editable. + `writeUnit: key` covers the practical need, but a per-field model would be + more truthful. Is the extra dimension worth it? +3. **Does `derived` belong here at all?** It is a fact about the *live* object + (an `ownerReference`), not about the Git document — every other knob reads the + document. Perhaps `derived` is a fifth thing: a **live-state** gate on the + mirror path, sibling to this registry rather than inside it. +4. **What is the default for an unknown CRD carrying obvious ciphertext?** We + cannot know that `spec.encryptedData` is opaque for a kind we have never heard + of. Treating it as `plain` means we would happily rewrite it. Is that + acceptable, given we would rewrite it with values from the live cluster, which + is the same source the controller derived it from? diff --git a/docs/design/gitops-api/sealed-secrets-and-external-secrets.md b/docs/design/gitops-api/sealed-secrets-and-external-secrets.md new file mode 100644 index 00000000..fdf85f5d --- /dev/null +++ b/docs/design/gitops-api/sealed-secrets-and-external-secrets.md @@ -0,0 +1,251 @@ +# Sealed Secrets and External Secrets: what day-1 support actually costs + +> Status: analysis; proposes one write-path provider and one safety gate. +> Captured: 2026-07-10 +> Related: +> [resource-capability-model.md](resource-capability-model.md), +> [write-only-encrypted-secrets.md](write-only-encrypted-secrets.md), +> [intent-cluster-hydration.md](intent-cluster-hydration.md), +> [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md) + +## The question + +[write-only-encrypted-secrets.md](write-only-encrypted-secrets.md) closed on an +open question: SOPS, Sealed Secrets and External Secrets are all "a Secret that is +not the Secret" — *one abstraction, or three kinds?* + +## The answer + +**Neither.** One [capability model](resource-capability-model.md), and: + +| | New kind? | Day-1 code | +|---|---|---| +| SOPS `Secret` | **yes** — `EncryptedSecret` | the projection | +| `SealedSecret` | no | a second encryption provider, plus a rename guard | +| `ExternalSecret` | no | **none** | + +SOPS needs a kind because it is [not schema-conformant](resource-capability-model.md), +not because it is encrypted. The other two are ordinary, valid KRM documents that +an API server stores happily. `ExternalSecret` is not encrypted at all. + +The real day-1 work is not in supporting either kind. It is a **safety gate** that +both of them make urgent, and which is missing today. + +--- + +## Sealed Secrets + +`bitnami.com/v1alpha1`, kind `SealedSecret`. The ciphertext lives in +`spec.encryptedData`, a string map. `spec.template` carries the shape of the +`Secret` it will produce — name, namespace, labels, `type` — **in cleartext**. + +### It is the same posture as SOPS, and strictly better + +Sealing uses the controller's **public certificate**, obtainable with +`kubeseal --fetch-cert` or handed over offline as a file. The private key never +leaves the target cluster. That is precisely the posture +[the writer already implements for SOPS](../../../internal/git/encryption.go): +public material in, no decryption, ever. + +But one property makes it *better* than SOPS: + +> Each value in `spec.encryptedData` is sealed **independently** — an AES session +> key per value, wrapped with RSA-OAEP. There is no MAC spanning the document. + +So a value can be replaced without knowing the others. `kubeseal --raw` exists +precisely to seal exactly one value. Where SOPS forces `writeUnit: document`, +Sealed Secrets permits `writeUnit: key`: + +```mermaid +sequenceDiagram + actor User + participant K8s as Intent cluster + participant Rev as GitOps Reverser + participant Git + + Note over Git: encryptedData holds api-key and session-secret.
Both unreadable here. + User->>K8s: set api-key only + K8s-->>Rev: watch event + Rev->>Rev: seal api-key with the public cert + Note over Rev: session-secret is copied through untouched.
Never decrypted, never needed. + Rev->>Git: commit SealedSecret with one value changed +``` + +Compare the SOPS rotation, where the whole document must be re-encrypted from a +complete plaintext supplied by the live cluster. Sealed Secrets needs no such +completeness. + +### The cost nobody expects: it is a *kind* transform + +The user edits a `Secret`. Git holds a `SealedSecret`. These are different GVKs. + +SOPS is a **document transform** — a `Secret` in, an encrypted `Secret` out, same +identity, same file path. Sealed Secrets is a **kind transform** — a `Secret` in, +a `SealedSecret` out. + +The writer's identity model keys a document by group/resource/namespace/name to +resolve its file and its placement. A kind-changing write means the live object's +identity and the Git document's identity are no longer the same, and every part +of the pipeline that assumes they are — placement, deletion planning, the +`GitPathAccepted` projection — has to learn about the mapping. + +**This, and not the cryptography, is what Sealed Secrets costs.** It is worth +knowing before the estimate is made. + +### The rename hazard + +Sealing scope is `strict` by default: the ciphertext is bound to the target +`(namespace, name)`. The annotations `sealedsecrets.bitnami.com/namespace-wide` +and `sealedsecrets.bitnami.com/cluster-wide` relax it. + +Under `strict` scope: + +> Renaming or moving a `SealedSecret` invalidates **every value we did not +> re-seal** — and we cannot re-seal a value we cannot read. + +A rename is therefore a silent, partial destruction: the keys we rewrote survive, +the keys we merely copied through become undecryptable. Day-1 rule: **refuse a +name or namespace change on a strictly-scoped `SealedSecret`.** The scope is +readable from the annotations, so this gate needs no key and no controller. + +### Capability + +| knob | value | +|---|---| +| `schemaConformant` | ✅ — it is a CR with a string map; an API server stores it | +| `visibility` | `opaque` for `spec.encryptedData`; `plain` for `spec.template` | +| `writeUnit` | `key` | +| new kind | none needed | + +Adoption of an existing `SealedSecret` in Git is well served: `spec.template` +gives the target name, namespace, labels and type, and `spec.encryptedData` gives +the **key names** — all in cleartext. The same honest projection as +`EncryptedSecret`, obtained for free from ordinary KRM. + +Proposed write path: a second provider on the existing +`GitTarget.spec.encryption`, whose enum is today `sops` only. +`provider: sealed-secrets` with a `certRef` to a public certificate — symmetric +with the age recipients the SOPS provider already carries, and equally free of +private key material. + +--- + +## External Secrets + +`external-secrets.io` (served at `v1beta1` and `v1`; match group and kind, +[tolerate the version](orchestrator-knowledge-boundary.md)), kind +`ExternalSecret`. + +### It is already supported, and that is the finding + +An `ExternalSecret` contains **no secret material at all**. It is a reference: + +```yaml +spec: + secretStoreRef: {name: vault-backend, kind: SecretStore} + target: {name: frontend-db, creationPolicy: Owner} + data: + - secretKey: password + remoteRef: {key: prod/frontend/db, property: password} +``` + +Every byte is plaintext, structural, ordinary KRM. It is readable, writable, +round-trippable, and an API server stores it without complaint. Its capability is +`schemaConformant: true`, `visibility: elsewhere`, `writeUnit: document`. + +**Day-1 code required: none.** It already flows through the existing path. + +`elsewhere` is not a weaker `opaque`. The document is not hiding a value; there is +no value in it. Editing `remoteRef.key` changes *which* secret is fetched. Nothing +a user does to this document can change what that secret *contains* — that lives +in Vault, and neither we nor Git has any say. + +The only work is honesty in the UI: a field that looks like a secret's address is +not a secret's value. + +### The hazard both kinds share, and it is live today + +External Secrets Operator creates the `Secret` named by `spec.target.name`, and +(under the default `creationPolicy: Owner`) stamps it with an `ownerReference` to +the `ExternalSecret`. The sealed-secrets controller does the same for the `Secret` +it unseals. + +Now consider a `WatchRule` that matches `v1/Secret`: + +```mermaid +flowchart TD + ES["ExternalSecret
(a reference, in Git)"] --> ESO["ESO controller"] + Vault[("Vault")] --> ESO + ESO --> SEC["Secret frontend-db
plaintext, ownerRef to ExternalSecret"] + SEC --> W{"WatchRule matches v1/Secret"} + W --> SAN["sanitize
DELETES ownerReferences"] + SAN --> ENC["encrypt (Secrets are always sensitive)"] + ENC --> GIT["committed to Git"] + GIT --> P["a second source of truth,
with the evidence it was derived
stripped on the way in"] + + classDef bad fill:#fdd,stroke:#c33 + class SAN,GIT,P bad +``` + +This is not a plaintext leak: a `Secret` cannot reach Git unencrypted — the writer +errors with *"secret encryption is required but no encryptor is configured"* +([`content_writer.go`](../../../internal/git/content_writer.go)). It is worse in a +quieter way. The vault's secret is now **also** a SOPS blob in Git; two systems +believe they own it; and `internal/sanitize/sanitize.go` has deleted the +`ownerReferences` that proved the object was derived, so nothing downstream can +tell. + +### The gate + +> **Never mirror an object that carries a controller `ownerReference`.** It is a +> controller's output, not anyone's desired state. + +This is a **Tier 0, live-state** rule. It needs no Argo CD knowledge, no Flux +knowledge, no Sealed Secrets knowledge, and no External Secrets knowledge. It +reads one field that every derived object in Kubernetes already sets, and it +protects far more than secrets: `ReplicaSet`s owned by `Deployment`s, `Pod`s owned +by `ReplicaSet`s, `Endpoint`s, and every CR any operator generates. + +Today `sanitize` *deletes* that field. The fix is to **gate on it before deleting +it** — the evidence must be consumed before it is discarded. + +That single gate is the entire day-1 cost of supporting External Secrets safely, +and it is not really about External Secrets at all. + +## What to build, in order + +1. **The `ownerReference` gate on the mirror path.** Smallest, most valuable, + independent of everything else here. Protects the External Secrets and Sealed + Secrets derived `Secret`s, and much besides. +2. **The [capability registry](resource-capability-model.md)** with three + classifiers: `Secret`+`sops:`, `SealedSecret`, `ExternalSecret`. `ExternalSecret` + is a two-line classifier that exists only to say `visibility: elsewhere`. +3. **`EncryptedSecret`** — the projection SOPS needs because it is not + schema-conformant. +4. **The `sealed-secrets` encryption provider**, priced honestly as a kind + transform rather than as a crypto change. + +Steps 1 and 2 are day-1. Step 3 is the SOPS work already designed. Step 4 is a +genuine feature, and the estimate belongs to the identity model, not to `kubeseal`. + +## Open questions + +1. **Does `spec.dataFrom` defeat the key projection?** An `ExternalSecret` can pull + an entire store with `dataFrom.extract` or `dataFrom.find`. The resulting key + set is not knowable from the document. Does the projection report + `keys: unknown`, or does it refuse to summarise? +2. **Who supplies the sealing certificate?** SOPS publishes its recipients in + `.sops.yaml`, in the repository. Sealed Secrets does not publish a cert + anywhere in Git by convention. Does a `certRef` on the `GitTarget` suffice, and + what happens when the controller rotates its key? +3. **Is a kind transform in scope at all?** A live `Secret` producing a + `SealedSecret` document breaks the one-identity-one-document assumption that + placement, deletion planning and `GitPathAccepted` all rest on. Is there a + cheaper framing — for instance, the user edits a `SealedSecret` *directly* in + the intent cluster, with a `stringData`-style write-only field that the + operator seals and clears? +4. **`creationPolicy: Merge` and `Orphan`.** With `Orphan`, ESO sets **no** + `ownerReference`. The gate in this doc then does not fire, and the derived + `Secret` looks exactly like a hand-written one. Is that acceptable, or does the + gate need a second signal — the presence of a matching `ExternalSecret` naming + this `Secret` as its target? diff --git a/docs/design/gitops-api/write-only-encrypted-secrets.md b/docs/design/gitops-api/write-only-encrypted-secrets.md index 392e2959..621f111c 100644 --- a/docs/design/gitops-api/write-only-encrypted-secrets.md +++ b/docs/design/gitops-api/write-only-encrypted-secrets.md @@ -306,8 +306,15 @@ counting as `editable` — the fix already named in the boundary doc. cluster sees whatever plaintext they last wrote — which may be stale relative to Git if someone edited the ciphertext by hand. Is the live `Secret` authoritative, or is that drift we must detect and cannot see? -6. **Does this extend to SealedSecrets and ExternalSecrets?** Both are - "a Secret that is not the Secret." A `SealedSecret` is also write-only under an - asymmetric key — the same shape, a different controller. An `ExternalSecret` - holds no ciphertext at all, only a reference, which is a *third* ownership - shape. Worth one abstraction, or three kinds? +6. **Does this extend to SealedSecrets and ExternalSecrets?** — *answered, in + [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md).* + Neither one abstraction nor three kinds: one + [capability model](resource-capability-model.md), and exactly one new kind. + SOPS needs `EncryptedSecret` because a SOPS `Secret` is **not schema-conformant** + — an API server rejects it — and not because it is encrypted. A `SealedSecret` + holds the same sort of ciphertext in a CRD field typed `string`, so it is + ordinary KRM, and it seals each value independently, so it supports per-key + writes that SOPS cannot. An `ExternalSecret` holds no ciphertext at all and + needs no support: it already works. What both make urgent is a gate this + design does not have — **never mirror an object carrying a controller + `ownerReference`**. From da9dc24c987dd53d3ac67a075dc8c1d9d306514c Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Fri, 10 Jul 2026 12:31:49 +0000 Subject: [PATCH 09/28] =?UTF-8?q?docs(gitops-api):=20correct=20the=20hydra?= =?UTF-8?q?tion=20doc=20=E2=80=94=20a=20triggered=20reconciler=20is=20the?= =?UTF-8?q?=20design,=20not=20the=20hazard?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The hydration doc claimed "the intent cluster must never have a controller reconciling it toward Git". That is too absolute, and docs/bi-directional.md already says something sharper: the problem is causality, not co-existence. An *autonomous* reconciler races the commit and replays a stale revision. A deliberately triggered one, waiting on the exact SHA, does not. That handshake is not a proposal. test/e2e/bi_directional_e2e_test.go runs it against real Flux with prune: true, and asserts the hard part — one live edit produces exactly one commit and Flux converges without a second. Both the GitRepository and the Kustomization carry a 30m interval while the test drives `flux reconcile` explicitly and waits for the expected revision. That long interval is the discipline: it makes the reconciler an applier rather than a competitor. The same test also covers a SOPS Secret written by the operator and reconciled by Flux, and a revert. So hydration is the degenerate case of the acknowledgment handshake — apply revision X into an empty cluster and wait for it to be reported applied — and a triggered Flux Kustomization is the better hydrator whenever the subtree is schema-conformant. GitOps Reverser applies the document store itself only where no applier can: the SOPS class. The rule becomes "always install the CRDs; install a controller only if it is an applier you drive, and never one that materialises secrets." ESO and sealed-secrets stay out for what they would pull into a throwaway cluster, not because they reconcile. Also corrects the key-custody claim in write-only-encrypted-secrets.md. The operator does not merely receive a public recipient: GitTargetReconciler calls generateAgeIdentity(), mints a keypair, stores the private half in a Secret annotated "Back up the private key", and the bi-directional e2e hands that same Secret to Flux as its decryption key. The write path still never reads it back — Encrypt is the only method — but under that bootstrap model "cannot decrypt" is a design rule enforced by a code shape, not a cryptographic guarantee. Under the user-supplied-recipient model it is cryptographic. Name the model before making the claim. Argo CD remains untested for the handshake; its analogue is Refresh plus selfHeal: false. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../gitops-api/intent-cluster-hydration.md | 166 +++++++++++++----- .../write-only-encrypted-secrets.md | 46 ++++- 2 files changed, 161 insertions(+), 51 deletions(-) diff --git a/docs/design/gitops-api/intent-cluster-hydration.md b/docs/design/gitops-api/intent-cluster-hydration.md index 491e29af..bc4c21e0 100644 --- a/docs/design/gitops-api/intent-cluster-hydration.md +++ b/docs/design/gitops-api/intent-cluster-hydration.md @@ -4,6 +4,8 @@ > intent cluster?", ships no code. > Captured: 2026-07-10 > Related: +> [../../bi-directional.md](../../bi-directional.md) — the operating models and the +> proven Flux handshake this doc builds on, > [resource-capability-model.md](resource-capability-model.md), > [write-only-encrypted-secrets.md](write-only-encrypted-secrets.md), > [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md), @@ -20,51 +22,105 @@ can edit an object, that object has to **exist** in the intent cluster. Somethin must run the other direction — **Git → live** — at least once. That direction is exactly what Argo CD and Flux do for a living, and the obvious -move is to point one of them at the repository. This doc argues against that, on -two independent grounds, and lands on a rule that is much simpler than either -tool. +move is to point one of them at the repository. That move is **right**, with one +qualification that has already been designed, documented and proven in this +repository — and one that has not. -## Ground one: a reconciler would fight the user +## Ground one: an *autonomous* reconciler fights the user. A triggered one does not. -Argo CD and Flux do not hydrate. They **reconcile**. Their job, their entire -value, is that when live state diverges from Git, they *put it back*. +Argo CD and Flux do not hydrate. They **reconcile**. Their value is that when live +state diverges from Git, they *put it back*. -In the intent cluster, live state diverging from Git is not drift. **It is the -user's edit.** It is the product. +In an editing cluster, live state diverging from Git is not drift. **It is the +user's edit.** So a reconciler left to run on its own interval is a hazard, and +[`docs/bi-directional.md`](../../bi-directional.md) already names it exactly: the +problem is **causality, not YAML**. ```mermaid sequenceDiagram actor User - participant K8s as Intent cluster - participant Recon as Flux or Argo CD + participant K8s as Editing cluster + participant Recon as autonomous Flux or Argo CD participant Rev as GitOps Reverser participant Git - Recon->>K8s: apply desired state from Git + Note over Recon: has applied revision A User->>K8s: edit replicas 3 to 5 - Note over Recon: sees "drift" - Recon->>K8s: revert replicas to 3 - Note over Rev: may never observe the edit at all - Rev-->>Git: nothing to commit + Rev->>Git: commit revision B + Note over Recon: has not refreshed its source yet + Recon->>K8s: re-apply stale revision A + K8s-->>Rev: looks like another live change + Rev->>Git: commit again ``` -At best this is a race the user loses. At worst — with `prune: true`, or Argo CD -`selfHeal` — the edit is reverted before the watch even fires. Turning -self-healing off leaves a reconciler that still owns fields, still prunes, and -still re-applies on every interval. +Stale replay, extra commits, possible loops. The failure is a **race window** +between the commit and the reconciler's source refresh — not a fundamental +incompatibility. -> **The intent cluster must never have a controller reconciling it toward Git.** -> Hydration is a one-shot apply, not a reconciliation. +### The fix is an acknowledgment handshake, and it works -This conclusion holds for every resource kind, and has nothing to do with secrets. +`bi-directional.md` prescribes it: treat the GitOps controller as a **deliberately +triggered applier**. Publish the commit, trigger the applier, and wait until it +reports that it applied *that exact revision*. -## Ground two: a SOPS Secret cannot be applied at all +GitOps Reverser already exposes the primitive the handshake needs — a +`CommitRequest` reaching `Pushed=True` with `status.sha` and `status.branch`. + +```mermaid +sequenceDiagram + actor User + participant K8s as Cluster + participant Rev as GitOps Reverser + participant Git + participant Flux + + User->>K8s: edit through the Kubernetes API + K8s-->>Rev: watch event + Rev->>Git: commit, push + Rev-->>K8s: CommitRequest Pushed=True, status.sha + Note over Flux: long interval. Not racing anybody. + Rev->>Flux: trigger source refresh, then reconcile + Flux->>Git: fetch the exact sha + Flux->>K8s: apply revision sha + Flux-->>Rev: Kustomization reports revision sha applied + Note over Rev: applied state equals committed state,
so nothing new to commit. The loop is closed. +``` + +This is not a proposal. [`test/e2e/bi_directional_e2e_test.go`](../../../test/e2e/bi_directional_e2e_test.go) +runs it against real Flux with `prune: true`, and asserts the hard part — that +GitOps Reverser produces **exactly one commit** for a live edit and Flux converges +without a second one. It also covers a SOPS-encrypted `Secret` written by the +operator and reconciled by Flux, and a revert. The Flux `Kustomization` and +`GitRepository` both carry a `30m` interval, and the test drives +`flux reconcile source` / `flux reconcile kustomization` explicitly, then waits for +the expected SHA. That long interval *is* the discipline: it is what makes the +reconciler an applier rather than a competitor. + +So the rule is narrower and better than "no controllers": + +> **No *autonomous* reconciler on a shared path.** A reconciler driven by an +> acknowledgment handshake is not merely permitted — it is how the loop closes. + +Hydration is then simply the **degenerate case of that handshake**: apply revision +X into a cluster that holds nothing yet, and wait until it is reported applied. +Same operation, empty starting state. + +The genuinely open part is the second half of `bi-directional.md`'s status list: +the handshake is proven with Flux and **not yet with Argo CD**, which has no +`suspend` + `flux reconcile` equivalent — its analogue is a `Refresh` annotation +plus `syncPolicy.automated.selfHeal: false`, and nothing here has tested it. + +## Ground two: a SOPS Secret cannot be applied *without a decryption key* The user's instinct — *"SOPS is by default not a good KRM object, so will Flux -ignore it, or fail?"* — is right, and the answer is **fail**, deterministically. +ignore it, or fail?"* — is right, and the answer is **fail**, deterministically, +whenever the applier cannot decrypt. -Verified against a real API server (Kubernetes v1.36, -`kubectl apply --dry-run=server`): +Flux's answer, when it *is* the real cluster, is `spec.decryption` with the +private age identity, and that path is exercised in the bi-directional e2e above. +The question that matters here is what happens in a cluster that deliberately +holds **no** key. There, the document is applied as written, and verified against +a real API server (Kubernetes v1.36, `kubectl apply --dry-run=server`): | Document | Result | |---|---| @@ -79,32 +135,43 @@ the failure happens at **deserialization**, before validation. No amount of lenient decoding rescues it. Any applier — `kubectl`, Argo CD, Flux's kustomize-controller — hits the same wall. -So Flux does not ignore a SOPS Secret. It fails the whole `Kustomization`, and the -apply error is the only thing the user sees. Flux's own answer is -`spec.decryption`, which needs the **private** age identity — precisely the thing -[we will never hold](write-only-encrypted-secrets.md). +So a keyless Flux does not ignore a SOPS Secret. It fails the whole +`Kustomization`, and the apply error is the only thing the user sees. The escape +is `spec.decryption` and the private age identity, which is exactly the material +an editing cluster should not be handed +([why](write-only-encrypted-secrets.md)). The last row is the nightmare: a lenient applier stores the ciphertext *as the value*, and an application reads its password as the literal string `ENC[AES256_GCM,...]`. Nothing errors. **Hydration must use strict decoding.** -## The rule that falls out +This is the one place where hydration genuinely cannot be "just run the applier", +and it is a property of one document class, not of the tool. -Hydration is not "run a GitOps tool against a small cluster." It is: +## The rule that falls out -> **Install the CRDs. Never install the controllers.** +> **Always install the CRDs. Install a controller only if it is an applier you +> drive, and never one that materialises secrets.** -The intent cluster is a **schema surface**, not a reconciliation surface. It exists -so that `kubectl` can validate, store, and serve intent — nothing more. Every -controller you install has a job, and in this cluster every one of those jobs is -wrong: +The intent cluster is primarily a **schema surface**: it exists so `kubectl` can +validate, store and serve intent. A reconciler is welcome in it only in the +handshake role above — triggered, SHA-acknowledged, on a long interval — and the +two secret-materialising controllers are never welcome at all, for reasons that +have nothing to do with reconciliation. -| Controller | What it would do here | Verdict | +| Controller | What it does here | Verdict | |---|---|---| -| Flux / Argo CD | revert the user's edit as drift | fatal | -| sealed-secrets | try to unseal without the private key | fails, noisily | -| External Secrets Operator | fetch real secrets from the real Vault into a throwaway cluster | a security regression | -| any workload controller | schedule Pods nobody asked for | pointless | +| Flux / Argo CD, **autonomous** | re-applies a stale revision over the user's edit | hazard — see [bi-directional.md](../../bi-directional.md) | +| Flux, **triggered + SHA-acknowledged** | applies exactly the revision we published | **the intended design**, proven in e2e | +| Argo CD, triggered | the same shape, `Refresh` + `selfHeal: false` | untested | +| sealed-secrets | tries to unseal without the private key | fails noisily; the object is inert, which is what we want | +| External Secrets Operator | fetches **real** secrets from the **real** Vault into a throwaway cluster | a security regression | +| any workload controller | schedules Pods nobody asked for | pointless, and it will fight `status` | + +The two secret controllers are the interesting rows. Neither is excluded because +it reconciles; both are excluded because of what they would *pull into* a cluster +that is supposed to hold intent and nothing else. Leave them out and their objects +sit there inert and editable — which is precisely the goal. Install their **CRDs**, and every one of those kinds becomes storable, editable and `kubectl`-validatable. Install nothing else. @@ -147,8 +214,19 @@ A SOPS `Secret` cannot hydrate as itself, because it is not a valid `Secret`. Th ## Who hydrates, then? -Not Argo CD. Not Flux. GitOps Reverser already parses the repository into a -document store to answer `ScanRepo`. Hydration is that store, applied once: +Two answers, and the choice turns on one question: **does this subtree contain a +document an applier cannot apply?** + +**A triggered Flux `Kustomization`** is the better answer whenever the subtree is +all schema-conformant. It is the real applier with real semantics, it is already +the acknowledgment step in the handshake above, and it is proven. Point it at the +revision, trigger it, wait for the SHA, leave it on a long interval. Nothing new +is built. + +**GitOps Reverser applies the document store itself** when the subtree contains +documents no applier can accept — today, exactly the SOPS class. It already parses +the repository into a document store to answer `ScanRepo`, so hydration is that +store, applied once: 1. Walk the `GitTarget` subtree, exactly as `ScanDir` does. 2. For each document, ask the [capability registry](resource-capability-model.md). diff --git a/docs/design/gitops-api/write-only-encrypted-secrets.md b/docs/design/gitops-api/write-only-encrypted-secrets.md index 621f111c..4ee4d36d 100644 --- a/docs/design/gitops-api/write-only-encrypted-secrets.md +++ b/docs/design/gitops-api/write-only-encrypted-secrets.md @@ -85,8 +85,34 @@ flowchart LR class PRIV,SEC secret ``` -The private identity never crosses into the left two boxes. That is the whole -design, and it already holds. +The private identity never reaches the *write path*. That is the whole design, and +it already holds. + +### Two custody models, and only one of them is a hard guarantee + +The diagram above is the **user-supplied recipient** model: someone else generated +the age identity, only the public recipient was ever configured, and no amount of +compromise makes decryption possible here. The guarantee is cryptographic. + +There is a second model in the codebase, and honesty requires naming it. +`GitTargetReconciler` calls `generateAgeIdentity()` +([`internal/controller/gittarget_controller.go`](../../../internal/controller/gittarget_controller.go)), +mints a keypair, stores the private half in a `Secret` — annotated *"Back up the +private key and remove warning annotation"* — and publishes the recipient. The +[bi-directional e2e](../../../test/e2e/bi_directional_e2e_test.go) then hands that +same `Secret` to Flux as its `decryption` key, which is how Flux reconciles the +encrypted `Secret` this operator wrote. + +In that bootstrap model the operator **had** the private key, for as long as it +took to write it down. The write path still never reads it back: `Encrypt` is the +only method, and `ResolvedEncryptionConfig` carries recipients only. So the +property is preserved by construction — but it is preserved by *design discipline*, +not by cryptography. + +The distinction matters for the security claim below, and it matters for +[hydration](intent-cluster-hydration.md): an operator that can read that `Secret` +*could* decrypt. The rule that it must not is a rule, and it should be written +down as one. ## The constraint that shapes the API: the MAC @@ -259,8 +285,13 @@ counting as `editable` — the fix already named in the boundary doc. "we support SOPS folders, and we cannot read your secrets." The second sentence is a *feature*, and it is the one a security reviewer wants to hear. - **The blast radius of a compromised operator shrinks to what it can encrypt.** - It cannot exfiltrate a secret it has never been able to decrypt. That claim is - auditable: no `Decrypt` exists in the binary. + It cannot exfiltrate a secret it cannot decrypt, and that claim is auditable: + no `Decrypt` exists in the binary. Under the **user-supplied recipient** model + that is cryptographic. Under the **bootstrap** model it is a design rule + enforced by a code shape, because the operator minted the identity and could + read the `Secret` it stored — a compromised operator with that RBAC could + decrypt. State which model an install is in; do not claim the stronger one by + default. - **It composes with the existing least-privilege direction.** The Secret grant is namespace-local, and the operator holds a public key. Both are the same argument, made at different layers. @@ -271,9 +302,10 @@ counting as `editable` — the fix already named in the boundary doc. ## What this is not -- **Not a decryption feature.** No `Decrypt`, no private key, no `--ignore-mac`, - not now and not behind a flag. The moment the operator can read, the security - argument above evaporates. +- **Not a decryption feature.** No `Decrypt`, no `--ignore-mac`, not now and not + behind a flag — not even in the bootstrap model, where the key material is + reachable and the restraint is therefore ours to keep. The moment the operator + reads, the security argument above evaporates. - **Not a secret manager.** Rotation policy, generation, and vault integration are the product layer's business. - **Not a merge.** A per-key patch of an encrypted document is impossible without From 4c3d4336ea7bf2ac309681a714a2c474dc85626a Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Fri, 10 Jul 2026 12:47:17 +0000 Subject: [PATCH 10/28] =?UTF-8?q?docs(gitops-api):=20yes,=20Flux=20can=20s?= =?UTF-8?q?kip=20SOPS=20documents=20=E2=80=94=20tested=20against=20real=20?= =?UTF-8?q?Flux?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ran four experiments against the running kustomize-controller on a folder holding one plain ConfigMap and one SOPS Secret, no decryption key configured. First correction: Flux never reaches the API server's base64 error. It guards explicitly, and says so — "Secret/.../frontend-credentials is SOPS encrypted, configuring decryption is required for this secret to be reconciled". kustomize build itself is perfectly happy and passes the document through, sops: stanza and all. The guard is kustomize-controller's. But the refusal is all-or-nothing: the ordinary ConfigMap beside it was not applied either. Then, can it be told to skip? Kustomization.spec.ignore, paths /data and /sops -> Ready=False, same message. It excludes JSON-pointer paths from drift detection and apply, and the SOPS guard fires before the ignore rules run. The obvious answer is not the answer. GitRepository.spec.ignore excluding **/*.enc.yaml -> Ready=False, "accumulating resources from 'secret.enc.yaml': no such file". The kustomization.yaml still lists it, so removing it from the artifact breaks kustomize build. Kustomization.spec.patches with $patch: delete -> Ready=True. ConfigMap applied, Secret never created. plain folder (no kustomization.yaml) + GitRepository.spec.ignore -> Ready=True. So both working mechanisms exist and the choice is decided by folder layout — precisely the plain-versus-kustomize split the analyzer already reports. And neither should be hand-maintained: the analyzer already knows which documents are encrypted (CauseEncrypted) and which folders are render roots, so the hydrator can generate the right exclusion and project an EncryptedSecret for each document it excluded. This makes triggered Flux the hydrator for SOPS repositories too, not only for schema-conformant ones. Applying the document store directly stays as the fallback for environments with no GitOps controller, and is a smaller thing to build than it looked. Caveats recorded: GitRepository.spec.ignore is a property of the source shared by every Kustomization referencing it, so an intent cluster wants its own GitRepository; excluded resources are never applied and so never pruned. Argo CD is untested and has no SOPS guard at all — its analogues are directory.exclude and kustomize.patches, and an unexcluded document would hit the raw base64 error. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../gitops-api/intent-cluster-hydration.md | 135 ++++++++++++++---- 1 file changed, 108 insertions(+), 27 deletions(-) diff --git a/docs/design/gitops-api/intent-cluster-hydration.md b/docs/design/gitops-api/intent-cluster-hydration.md index bc4c21e0..3d596219 100644 --- a/docs/design/gitops-api/intent-cluster-hydration.md +++ b/docs/design/gitops-api/intent-cluster-hydration.md @@ -135,18 +135,96 @@ the failure happens at **deserialization**, before validation. No amount of lenient decoding rescues it. Any applier — `kubectl`, Argo CD, Flux's kustomize-controller — hits the same wall. -So a keyless Flux does not ignore a SOPS Secret. It fails the whole -`Kustomization`, and the apply error is the only thing the user sees. The escape -is `spec.decryption` and the private age identity, which is exactly the material -an editing cluster should not be handed -([why](write-only-encrypted-secrets.md)). - The last row is the nightmare: a lenient applier stores the ciphertext *as the value*, and an application reads its password as the literal string -`ENC[AES256_GCM,...]`. Nothing errors. **Hydration must use strict decoding.** +`ENC[AES256_GCM,...]`. Nothing errors. **Any hydrator must use strict decoding.** + +### Flux is kinder than the API server, and says so + +Flux never reaches that base64 error, because kustomize-controller checks first. +Run against real Flux (kustomize-controller, `spec.decryption` unset, the +[fixture 13](../../../test/fixtures/gitops-layouts/13-sops-encrypted/) Secret plus +an ordinary `ConfigMap` in one folder): + +``` +Kustomization Ready=False + Secret/fluxsops/frontend-credentials is SOPS encrypted, + configuring decryption is required for this secret to be reconciled +``` + +Note that `kustomize build` itself is perfectly happy — it passes the document +through untouched, `sops:` stanza and all. The guard is kustomize-controller's, +and it is explicit. + +But the failure is **all-or-nothing**: the ordinary `ConfigMap` in the same folder +was *not* applied. Flux does not ignore the encrypted Secret and proceed. It +refuses the whole `Kustomization`. + +So the question becomes: can Flux be *told* to skip it? + +## Yes — and the mechanism depends on the folder layout + +Four attempts, all run against real Flux (v1 `Kustomization`, kustomize-controller, +no decryption key), on a folder holding one plain `ConfigMap` and one SOPS `Secret`: + +| Attempt | Mechanism | Outcome | +|---|---|---| +| do nothing | — | `Ready=False`, *"is SOPS encrypted, configuring decryption is required"*. **The ConfigMap is not applied either.** | +| ignore the *fields* | `Kustomization.spec.ignore` with `paths: ["/data", "/sops"]` | `Ready=False`, same message. The SOPS guard runs **before** the ignore rules. | +| drop the *file* at the source | `GitRepository.spec.ignore` (`.sourceignore` syntax) excluding `**/*.enc.yaml` | `Ready=False` — `kustomize build failed: accumulating resources from 'secret.enc.yaml': no such file`. The `kustomization.yaml` still lists it. | +| drop the *resource* from the build | `Kustomization.spec.patches` with `$patch: delete` | ✅ **`Ready=True`.** ConfigMap applied, Secret never created. | +| plain folder + drop the file | no `kustomization.yaml`, plus `GitRepository.spec.ignore` | ✅ **`Ready=True`.** | + +Two mechanisms work, and **which one you need is decided by the folder layout** — +the same plain-versus-kustomize split the analyzer already reports: + +- **Plain KRM folder** (the product's first-class target): exclude the file at the + source with `GitRepository.spec.ignore`. kustomize-controller synthesises a + kustomization from the files it finds, so an absent file is simply absent. +- **Kustomize folder**: the file is named in `resources:`, so removing it from the + artifact breaks the build. Remove the *resource from the build output* instead, + with a `$patch: delete` entry per encrypted document. + +`Kustomization.spec.ignore` looks like the obvious answer and is not: it excludes +JSON-pointer paths from **drift detection and apply**, and the SOPS guard fires +before it ever runs. -This is the one place where hydration genuinely cannot be "just run the applier", -and it is a property of one document class, not of the tool. +```mermaid +flowchart TD + F["folder to hydrate"] --> K{"kustomization.yaml
lists the encrypted file?"} + K -- no --> SI["GitRepository.spec.ignore
drop the file from the artifact"] + K -- yes --> PD["Kustomization.spec.patches
one delete per encrypted doc"] + SI --> OK["Ready=True
everything else applied"] + PD --> OK + OK --> PROJ["GitOps Reverser projects an
EncryptedSecret for each excluded doc"] + + classDef good fill:#dfd,stroke:#3a3 + class OK,PROJ good +``` + +### This is generatable, not hand-written + +The exclusion is not something a user should maintain. The analyzer **already +knows** which documents are encrypted (`CauseEncrypted`) and whether a folder is +plain or a kustomize render root. So the hydrator can emit the right exclusion for +the right layout, and project an `EncryptedSecret` for every document it excluded. + +The user gets a cluster holding everything that could be hydrated, plus an honest +description of everything that could not. + +Two operational caveats: + +- `GitRepository.spec.ignore` is a property of the **source**, shared by every + `Kustomization` that references it. An intent cluster wants its own + `GitRepository`, not the production one. +- Excluded resources are never applied, so `prune` will never delete them. That is + correct here, and it is worth stating because it looks like a leak. + +**Argo CD is untested.** Its analogues exist — `directory.exclude` for a plain +folder, `kustomize.patches` for a kustomize source — but Argo CD ships no SOPS +awareness at all, so an unexcluded document would not meet a friendly guard. It +would be sent to the API server and hit `illegal base64 data` from the table +above. Same outcome, worse message. ## The rule that falls out @@ -214,28 +292,31 @@ A SOPS `Secret` cannot hydrate as itself, because it is not a valid `Secret`. Th ## Who hydrates, then? -Two answers, and the choice turns on one question: **does this subtree contain a -document an applier cannot apply?** - -**A triggered Flux `Kustomization`** is the better answer whenever the subtree is -all schema-conformant. It is the real applier with real semantics, it is already -the acknowledgment step in the handshake above, and it is proven. Point it at the -revision, trigger it, wait for the SHA, leave it on a long interval. Nothing new -is built. +**A triggered Flux `Kustomization` can do all of it**, including subtrees that +contain SOPS documents, provided the exclusion above is generated for it. It is the +real applier with real semantics, it is already the acknowledgment step in the +handshake, and it is proven. Point it at the revision, trigger it, wait for the +SHA, leave it on a long interval. -**GitOps Reverser applies the document store itself** when the subtree contains -documents no applier can accept — today, exactly the SOPS class. It already parses -the repository into a document store to answer `ScanRepo`, so hydration is that -store, applied once: +The hydration step is then: 1. Walk the `GitTarget` subtree, exactly as `ScanDir` does. 2. For each document, ask the [capability registry](resource-capability-model.md). -3. `schemaConformant` → apply it, **strictly**. -4. Not `schemaConformant` → do not apply it. Create its projection instead. -5. Never prune. Never re-apply on an interval. Never watch Git. - -No Git-host knowledge is added, no orchestrator is emulated, and the operator -gains a capability it half has already. +3. For every non-`schemaConformant` document, emit an exclusion — a + `GitRepository.spec.ignore` pattern for a plain folder, a `$patch: delete` for a + kustomize root — and project an `EncryptedSecret` for it. +4. Hand the source and the `Kustomization` to Flux. Trigger. Wait for the SHA. +5. Never prune what was excluded. Never leave the interval short. + +GitOps Reverser contributes the one thing Flux cannot know — *which documents are +unhydratable, and why* — and Flux contributes everything else. No orchestrator is +emulated, no Git-host knowledge is added, and the operator does not grow an apply +loop of its own. + +Applying the document store directly, strictly, without Flux remains the fallback +for an environment with no GitOps controller at all. It is a smaller thing to build +than it looked before this section was written, because it is no longer the only +way to hydrate a repository that uses SOPS. The intent cluster is disposable. If it drifts from Git for reasons other than the user's edit, the answer is to throw it away and hydrate a fresh one — not to From a988bb9fe903616dec36aacbac1cd14dc3fca1a8 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Sat, 11 Jul 2026 19:22:50 +0000 Subject: [PATCH 11/28] docs(gitops-api): the expansion boundary, and a triage plan for the doc tree Two proposals, no code. expansion-boundary-and-corpus-organisation.md adds the axis the model was missing. Renderability and ownership are both questions about files in Git; neither asks whether a live object has a home in Git at all. ApplicationSets, ResourceSets, KRO, Crossplane and HelmReleases all synthesise objects that have no home, and mirroring them creates a second source of truth that fights the controller that made it. Source-verified against external-sources/: ApplicationSet generates pointers into Git (the workload KRM stays as files, so it round-trips), while flux-operator's ResourceSet generates the KRM itself, inline in the CR spec. That asymmetry decides the support story, and it exposes a defect: the planned derived-object gate keys on ownerReference, which ApplicationSet sets and ResourceSet does not. documentation-triage.md classifies all 180 docs. About 35 bind; the rest is history. The folders lie in both directions: docs/design/ holds 23 shipped designs, and docs/finished/ holds 10 documents that are the sole record of a live invariant. Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/design/documentation-triage.md | 270 ++++++++ ...ansion-boundary-and-corpus-organisation.md | 593 ++++++++++++++++++ 2 files changed, 863 insertions(+) create mode 100644 docs/design/documentation-triage.md create mode 100644 docs/design/gitops-api/expansion-boundary-and-corpus-organisation.md diff --git a/docs/design/documentation-triage.md b/docs/design/documentation-triage.md new file mode 100644 index 00000000..384a1bc2 --- /dev/null +++ b/docs/design/documentation-triage.md @@ -0,0 +1,270 @@ +# Documentation triage: what binds, what is history, what to do + +> Status: proposal; no files moved yet. +> Captured: 2026-07-11 +> Scope: all 180 markdown files under `docs/` (~55,000 lines). + +## The headline + +**About 35 documents actually bind. The other ~145 are history.** You cannot +currently tell which is which without reading them, and that — not the volume — is +the problem. + +| Group | Files | Of which still binding | +|---|---:|---:| +| `docs/*.md` (user/operator guides) | ~20 | all — they are the product surface | +| `docs/facts/` | 4 | all — durable reference | +| `docs/design/*.md` + `design/stream/` | 57 | **9 active**, 9 reference | +| `docs/design/gitops-api/` | 13 | **all — the live workstream** | +| `docs/design/manifest/` + `version2/` | 19 | ~3 — the rest shipped | +| `docs/finished/` | 41 | **10 load-bearing** (see below — this is the bug) | +| `docs/future/` | 13 | 8 still wanted | +| `docs/ci/`, `docs/audit-setup/`, misc | 13 | reference | + +## The diagnosis: the folder names lie, in both directions + +This is the whole finding, and it explains why the tree feels unmanageable. + +**`docs/design/` contains 23 documents whose work has already shipped**, sitting +beside the 9 that are still open, with nothing to distinguish them. Several still +say `Status: PROPOSAL` while the code that implements them has been in `main` for +weeks (`unsupported-folder-refusal-plan.md` is the clearest case — it ships as +`GitPathAccepted` with an e2e test, and its header still says "PROPOSAL"). + +**`docs/finished/` contains 10 documents that are the *sole written record* of a +live invariant.** They are not finished at all. The worst case: + +> **`docs/finished/current-manifest-support-review.md`** is the live specification +> of `internal/manifestanalyzer`. It is cited by section name from eight Go files, +> and it is a cited input to the *active* gitops-api workstream. It holds the +> non-negotiable rules — *a GitTarget makes an all-or-nothing claim on a folder*; +> *never partially materialize a multi-doc file*; *refuse the folder rather than +> prune unwatched KRM*. It is filed under "finished." + +Nine more like it are listed below. **Archive `finished/` wholesale and you delete +the contract.** + +Only 74 of 180 files carry a `> Status:` line at all, and several of those are +stale. There is no mechanical way to ask "what is still true?" + +## Hard constraint: 17 doc citations in the Go code are already broken + +A previous reorganisation moved documents and never fixed the pointers. Today, +`grep`ping the Go sources for `docs/**.md` yields **17 paths that do not exist**: + +``` +docs/guide.md docs/keep.md +docs/design/manifest/implementation-plan.md docs/design/commit-window-refactor.md +docs/design/manifest/current-manifest-support-review.md docs/design/audit-readiness-probe-plan.md +docs/design/stream/api-source-of-truth-reconcile.md docs/design/gitops-api/f1-...md +docs/future/secret-value-retention-plan.md docs/design/gitops-api/f7-...md +docs/design/stream/audit-diagnostic-streams-plan.md …and 6 more +``` + +Six of those point at documents that no longer exist anywhere. The rest point at +documents that *moved into* `docs/finished/`. + +Two consequences, and they shape the entire plan below: + +1. **The code already thinks the load-bearing docs live in `docs/design/`.** That + is an argument for moving them back rather than for leaving them where they are. +2. **Any move must fix citations in the same commit,** or it makes this worse. This + is exactly how the current mess was made. + +## What actually binds — the read-this list + +If you read nothing else, read these. This is the set that describes how the system +works *today* or what is being decided *now*. + +### The live workstream (13) — `docs/design/gitops-api/` + +All of it. This is the branch you are on. My separate proposal +([expansion-boundary-and-corpus-organisation.md](gitops-api/expansion-boundary-and-corpus-organisation.md)) +recommends adding a `support-contract.md` front door and folding four restatements +of the fan-in rule into one. + +### Load-bearing, but misfiled under `finished/` (10) — **promote these** + +Each is the only place a still-current invariant is written down, and most are cited +from the code: + +| Doc | The invariant that lives only here | +|---|---| +| `current-manifest-support-review.md` | all-or-nothing folder claim; never partially materialize a multi-doc file; refuse rather than prune | +| `manifestedit-field-ownership-spike.md` | "the API wins" — full-object ownership, no field-subset ownership, plus the explicit do-not-build list | +| `sops-single-file-no-multidoc.md` | SOPS encrypts a *file* as one cryptographic unit → one document per encrypted file | +| `scale-subresource-audit-rehydration.md` | the `/scale` → `FieldPatch` translation rules and denied-subresource list | +| `commit-window-refactor.md` | one grouped commit = exactly one (author, GitTarget) tuple | +| `commitrequest-multi-finalize-design.md` | why `MaxConcurrentReconciles=1` on the CommitRequest controller | +| `type-lifecycle-events-and-wobble-settling.md` | the settle-window / flap-coalescing spec `internal/typeset` implements | +| `gittarget-isolation-on-rule-change.md` | a rule change on target A must never re-snapshot target B | +| `audit-readiness-probe-plan.md` | why liveness must never depend on Redis (the restart-loop trap) | +| `gvk-gvr-mapping-layer.md` | GVK↔GVR contract; still cited by four active design docs | + +### Still-open design (9) — `docs/design/` + +`e2e-coverage-gaps-and-improvements-plan.md`, `e2e-finish-plan.md`, +`metrics-observability-plan.md`, `multi-cluster-audit-ingestion-implications.md`, +`reconcile-triggering.md`, `release-image-reuse-plan.md`, +`sensitive-resource-diagnostics-follow-up.md`, `watch-and-catalog-architecture.md`, +`stream/residual-e2e-flakes-2026-06-19.md`. + +### Durable reference (9 + `docs/facts/`) + +`status-conditions-guide.md`, `e2e-serial-registry.md`, `e2e-test-design.md`, +`kubernetes-api-discovery.md`, `kubernetes-api-resource-catalog.md`, +`kubernetes-apf-and-inflight-tuning.md`, `audit-webhook-api-server-connectivity.md`, +`watch-event-ordering-and-attribution-grace.md`, `sops-repo-bootstrap-out-of-scope.md`. + +### Still wanted (8) — `docs/future/` + +`idea-application-editing.md` (the product seed of the gitops-api workstream — +still holds the branch/session grouping strategies nothing else covers), +`ha-gittarget-distribution-plan.md` (cited three times by `architecture.md`), +`least-privilege-remaining-work.md`, `design-commit-request-phase-2.md` (verified +live gap: nothing GCs `CommitRequest` objects), `idea-unify-pending-write-kinds.md`, +`idea-cross-kind-dependency-watches.md`, `publish-age-recipients-as-metadata.md`, +`idea-commit-signing-key-validation.md`. + +## What is history + +### Shipped, but still sitting in `docs/design/` (23) — move to `finished/` + +`audit-webhook-tls-design`, `commitrequest-admission-authorship`, +`deletecollection-attribution-expander`, `dynamic-analysis-fuzzing-plan`, +`e2e-aggregated-apiserver-test-design`, `e2e-bi-directional-corner`, +`e2e-ci-runner-sharding-plan`, `e2e-signing-followups`, `e2e-speedup-plan`, +`git-credentials-interop`, `gitpath-foreign-content-stringency`, +`image-refresh-test-design`, `mutation-capture-lab-design`, `redis-key-schema-v3`, +`sensitive-resource-classification-plan`, +`sops-repo-bootstrap-and-key-management-architecture`, +`startup-robustness-cert-and-crd-wobble`, `tilt-playground-plan`, +`typeset-owns-discovery-grace`, `unsupported-folder-refusal-plan`, +`watch-first-ingestion-architecture`, `stream/commitrequest-design`, +`stream/streaming-readiness-status-machine-design`. + +Note `watch-first-ingestion-architecture.md` is the *most* important of these — it +is the rewrite that deleted half the audit world — but it has landed, so it is now +an explainer, not a plan. It should arguably graduate into `docs/architecture.md` +rather than into `finished/`. + +### Superseded (6 + 13) — **delete** + +Git is the archive. These have named successors and nothing cites them: + +- In `design/`: `e2e-aggregated-apiserver-proxy-hookup-plan`, + `gittarget-lifecycle-and-repo-architecture`, + `gittarget-state-machine-bootstrap-assessment`, `status-design-git-target`, + `watchrule-wildcard-and-resolution-semantics`, + `stream/per-type-streaming-readiness-plan`. +- In `finished/`: `api-source-of-truth-reconcile`, + `commitrequest-attribution-divert-reliability`, `internal-audit-type-demand`, + `design-commit-request-api`, `deletecollection-resync-nudge-plan`, + `audit-metrics-overhaul-plan`, `materialization-tail-and-live-readiness-review`, + `watch-list-checkpoint-plan`, `per-resource-type-rv-keyed-streams-experiment`, + `idea-audit-enrichment-side-channel`, `rule-set-snapshot-discovery-lag-fix`, + `watchrule-gvr-resolution-plan`, `manifestedit-new-file-placement-spike`. + +One catch before deleting `materialization-tail-and-live-readiness-review.md`: +`internal/typeset/materializer.go:34` still cites its "Rec 6" as an open +optimisation. Move that note into the code comment first. + +### Closed investigations (9) — **delete** + +Forensics whose bugs are fixed: `e2e-full-suite-shared-state-investigation`, +`e2e-watchrule-cross-spec-interference`, `upgrade-finding`, +`watch-audit-rule-matching-improvement`, `watch-first-merge-readiness`, and four +under `stream/`. These are the genre with the worst read-value-to-length ratio — +long, dramatic, and entirely about bugs that no longer exist. + +Keep one exception: `stream/signing-snapshot-tail-replay-failure-investigation.md` +is cited from `internal/git/branch_worker.go:330` as the reason a watermark gate +exists. Move that reasoning into the code comment, then delete. + +### Archaeology (18 in `finished/`) — cold-store or delete + +Mostly the pre-watch-first audit world: `demand-gated-audit-ingestion`, +`canonical-stream-retirement`, `shallow-audit-event-misclassification`, +`partial-object-audit-event-handling`, `design-audit-ingestion-hardening`, and 13 +more. `internal/gate` and the audit-as-state pipeline they describe are **deleted +code**. Nothing forward-looking depends on them. + +### Overtaken / stale (5) — delete + +`future/design-snapshot-engine-evolution` (every part landed elsewhere in a +different shape), `future/idea-end-user-commit-messages` + +`future/addendum-end-user-commit-messages-audit-transports` (both rest on "the audit +stream is the source of truth", which watch-first made **false**), +`future/watchrule-wildcard-support-plan`, +`future/further-away/accesspolicy-design` (targets `GitRepoConfig`, a CRD two +renames dead), `design/voter-gitops-demo-instances`. + +## The plan + +Phased so that the cheap, zero-risk win lands first and nothing breaks. + +### Phase 0 — the index (zero risk, most of the benefit) + +**Write `docs/INDEX.md`: the ~35 documents that bind, grouped by topic.** Move +nothing. Delete nothing. You immediately get "read these 35, the rest is history", +which is the actual thing you asked for. Everything below is optional cleanup. + +### Phase 1 — status headers (mechanical) + +Put a `> Status:` line on every design doc, from a closed vocabulary: +`active` | `shipped` | `superseded-by: ` | `closed-investigation` | +`reference`. Then `grep '^> Status: active'` answers the question forever, and the +next person does not have to redo this triage. + +### Phase 2 — fix the 17 broken citations, and promote the 10 load-bearing docs + +Do these **in one commit**, because the fix and the move touch the same lines. The +code already points at `docs/design/` for most of them, so promoting them back +*is* the fix. + +Suggested destination: a `docs/spec/` folder meaning **"this is true now and the +code depends on it"** — distinct from `design/` ("we are still deciding") and +`finished/` ("this happened"). The three-way split is what the current two-way one +cannot express, and it is precisely the distinction that broke. + +### Phase 3 — move the 23 shipped docs out of `design/` + +Now `docs/design/` means what it says: undecided work. It shrinks from 57 files to +~9. + +### Phase 4 — delete the dead (~50 files) + +Superseded, closed investigations, archaeology, stale. Extract the three code-cited +facts first (noted above). Git keeps everything; nothing is lost that a +`git log --follow` cannot recover. + +### Phase 5 — the gitops-api consolidation + +Separately proposed in +[expansion-boundary-and-corpus-organisation.md](gitops-api/expansion-boundary-and-corpus-organisation.md): +add a `support-contract.md` front door, fold the four restatements of the fan-in +invariant into one, and de-duplicate the `--dry-run=server` evidence table. + +## What I would *not* do + +- **Do not bulk-archive `docs/finished/`.** Ten of those documents are the contract. + That is the single highest-risk action available here, and it is the one that + looks most obviously safe. +- **Do not move anything without fixing the Go citations in the same commit.** That + is how the current 17 broken pointers were created. +- **Do not delete the investigations to save space.** Delete them because their bugs + are gone. Two of them still hold the *reason* a guard exists in live code; those + reasons must land in the code comment first, or you will lose them and someone + will remove the guard. + +## Open question + +**Should `docs/design/manifest/` survive at all?** Its three subsystems — +`internal/typeset`, `internal/git/manifestedit`, `internal/manifestreport` — have +all shipped, so most of its 19 files are archaeology. But it is also where the +*reasoning* behind the manifest model lives, and the gitops-api workstream is built +directly on top of it. My instinct is that two or three docs graduate to `spec/` +(`contextual-namespace-and-kustomize-folder-editing.md`, +`version2/gittarget-new-file-placement-rules.md`, +`version2/type-followability.md`) and the other sixteen go, but that is the call I +am least sure of and it is worth your eye rather than mine. diff --git a/docs/design/gitops-api/expansion-boundary-and-corpus-organisation.md b/docs/design/gitops-api/expansion-boundary-and-corpus-organisation.md new file mode 100644 index 00000000..e66d15b2 --- /dev/null +++ b/docs/design/gitops-api/expansion-boundary-and-corpus-organisation.md @@ -0,0 +1,593 @@ +# The expansion boundary, and how to organise this material + +> Status: proposal; ships no code. Reorganisation + one new axis. +> Captured: 2026-07-11 +> Related: +> [README.md](README.md), +> [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md), +> [resource-capability-model.md](resource-capability-model.md), +> [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md), +> [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md), +> the layout corpus at [`test/fixtures/gitops-layouts/`](../../../test/fixtures/gitops-layouts/) + +## What this proposes + +Three things, in order of importance: + +1. **A missing axis.** The model has two axes — *renderability* (can an edit be + written back to one document?) and *ownership* (does that document already have + another writer?). Both are questions about **files in Git**. Neither asks the + question that ApplicationSets, ResourceSets, KRO, Crossplane, and HelmReleases + all raise: **does this live object have a home in Git at all?** +2. **A support contract that fits on one page** — a catalogue of the constructs + people actually put in GitOps repos, each with a verdict and a reason. Today the + boundary is asserted in 17 places across two doc trees, in three unrelated + refusal vocabularies, and nowhere in full. +3. **A topical spine for the corpus and the docs**, so new material has an obvious + home instead of a new number. + +The corpus's 16 fixtures raise 95 open questions. They are not 95 decisions. They +compress to five, and the fifth is the one we have never written down. + +## The finding: expansion is a third axis + +Every GitOps repository is a **starting point that explodes into more KRM**. That +explosion happens in one of two fundamentally different ways, and the difference +decides everything: + +| | Expansion mechanism | Does the resulting object exist in Git as a file? | +|---|---|---| +| **Render-time** | `kustomize build`, `helm template`, a CI script | **Yes** (or it is a deterministic function of files that do) | +| **Controller-side** | ApplicationSet, ResourceSet, KRO, Crossplane, HelmRelease, ESO | **No.** The object is synthesised in-cluster from a template plus inputs | + +Renderability covers the first row. It has nothing to say about the second. + +This matters because GitOps Reverser is a **live → Git** tool. It watches live +objects and writes them to files. A controller-synthesised object is a live object +like any other — it will be watched, it will be sanitized, and it will be written +to a file that has never existed and that nothing in Git will ever read again. That +is not a lossy edit. It is the creation of a **second source of truth that fights +the controller that made it**. + +So the third axis is **provenance**, and it is the mirror image of ownership: + +| Axis | Direction | Question | Modelled today | +|---|---|---|---| +| Renderability | Git → live | Can an edit be written back to exactly one document? | ✅ the support boundary | +| Ownership | Git side | Does that document already have another writer? | ⚠️ designed, unbuilt | +| **Provenance** | **live → Git** | **Did a controller synthesise this object, or did a human author it?** | ❌ **not modelled** | + +Ownership and provenance are the same concern seen from the two sides of the +Git ↔ cluster boundary: *who else writes this file* and *who else creates this +object*. Naming them as one pair is what makes the third axis obvious rather than +ad hoc. + +## The support contract, in one sentence + +> **GitOps Reverser edits the intent layer. It never edits the expansion layer.** + +Every repository has an **intent layer** — the documents a human authored and +committed — and an **expansion layer** — the objects a controller derived from +them. We mirror and edit the intent layer, because that is the layer with a home in +Git and the layer a careful human would edit anyway. We refuse the expansion layer, +because expansion is a one-way function and its output has nowhere to go. + +This is a *defensible* boundary, not a gap, and for the modern tools it is a +**good** answer rather than a grudging one: a ResourceSet or a HelmRelease puts the +whole of a user's intent in one editable document, which is precisely our sweet +spot. What we decline to do is reach past that document into the objects it +produces — which is also what the tools themselves tell users not to do. + +## The expansion catalogue + +Verified against the upstream checkouts in `external-sources/`, not from memory. + +### The structural asymmetry that decides everything + +> **Argo CD's ApplicationSet generates *pointers into Git*. Flux's ResourceSet +> generates *the KRM itself*.** + +An `ApplicationSet` template is a typed stencil of exactly one `Application` +(`ApplicationSetTemplate` = metadata + `ApplicationSpec`). Each generated +`Application` carries `spec.source.{repoURL,path,targetRevision}` — so the +Deployments and Services beneath it are **real files at a real path**. The +generated `Application` CRs are a thin control-plane layer that exists only in etcd; +the fat layer of workload KRM stays in Git and round-trips normally. + +A `ResourceSet` has no such layer. Its `spec.resources` is +`[]*apiextensionsv1.JSON` — **arbitrary KRM embedded in the CR itself** — rendered +once per input set through a Go `text/template` with `<< >>` delimiters. There is +no `path`, no `sourceRef`, no `resourcesFrom`. Flux's own `Kustomization` has +`spec.path` + `spec.sourceRef`; `ResourceSet` deliberately does not. The flux-operator +docs are candid about the consequence, describing ResourceSet image automation as +suitable for **"Gitless GitOps"** workflows where "instead of pushing changes to a +Git repository, the updates are applied directly to the cluster." + +The product consequence: **for an ApplicationSet repo we can round-trip the +workloads; for a ResourceSet repo there are no workload files to round-trip.** The +ResourceSet CR is the only artifact. + +### The generator family, side by side + +| | Argo CD `ApplicationSet` | flux-operator `ResourceSet` | +|---|---|---| +| Group/version | `argoproj.io/v1alpha1` | `fluxcd.controlplane.io/v1` | +| What it templates | one `Application` (typed stencil) | arbitrary KRM (`spec.resources`, `spec.resourcesTemplate`) | +| Template engine | `fasttemplate` `{{ }}`, or Go template + sprig when `goTemplate: true` | Go `text/template`, `<< >>` delimiters, sprig | +| Inputs from | 9 generators: `list`, `clusters`, `git` (`directories`/`files`), `scmProvider`, `pullRequest`, `matrix`, `merge`, `clusterDecisionResource`, `plugin` | `spec.inputs` (inline) + `spec.inputsFrom` → `ResourceSetInputProvider` | +| Input providers | — | 22 types: `Static`, `GitHub*`, `GitLab*`, `AzureDevOps*`, `AWSCodeCommit*`, `Gitea*`, `OCIArtifactTag`, `ACR/ECR/GAR`, `ExternalService` | +| Cartesian fan-out | `matrix` generator | `inputStrategy: Permute` | +| Second template layer | `templatePatch` (rendered, then merged onto the Application) | — | +| Generated objects tracked by | **`ownerReference`** (`controllerutil.SetControllerReference`) | **owner labels** `resourceset.fluxcd.controlplane.io/{name,namespace}` + `status.inventory` — **no ownerReference** | +| Writes to Git? | No | No | +| Workload KRM in Git as files? | **Yes** — behind the generated `Application` | **No** — inline in the CR | + +Two facts from that table are load-bearing and are addressed below: the different +ownership evidence, and the fact that a `GitHubPullRequest` or `OCIArtifactTag` +input provider means **the input set is not in the repository at all** — it is +queried live from a Git-host or registry API. The desired object set depends on +which pull requests are open right now. No repository scan can see it, ever. + +### The whole family, generalised + +Every one of these is the same shape — an authored document, a controller, and +objects that exist only in the cluster: + +| Authored document (intent) | Controller | Expansion (live only) | Ownership evidence on the child | +|---|---|---|---| +| Argo CD `ApplicationSet` | applicationset-controller | `Application` CRs | `ownerReference` ✅ verified | +| flux-operator `ResourceSet` | flux-operator | `spec.resources` × inputs | `resourceset.fluxcd.controlplane.io/{name,namespace}` labels + `status.inventory`; **no `ownerReference`** ✅ verified | +| Flux `HelmRelease` | helm-controller | the chart's rendered objects | labels, not an `ownerReference` — exact keys **unverified**, see below | +| KRO `ResourceGraphDefinition` + instance | kro | the graph's objects | `kro.run/*` labels (inferred from our own `sanitize` strip list) | +| Crossplane `Composition` + XR | crossplane | composed resources | `ownerReference` (unverified) | +| `ExternalSecret` | external-secrets | a `Secret` | `ownerReference` (per `sealed-secrets-and-external-secrets.md`) | +| `SealedSecret` | sealed-secrets | a `Secret` | `ownerReference` (per `sealed-secrets-and-external-secrets.md`) | + +Consistent rule, at least three different kinds of evidence. Which is exactly the +problem. + +Only the first two rows are verified against upstream source in this pass — +`external-sources/` carries argo-cd and flux-operator, but not helm-controller, +kro, or crossplane. **Confirming the exact provenance marker for each remaining row +is a prerequisite for building the gate**, and is the first task this proposal +implies. The structural claim ("no home file, therefore never mirror it") does not +depend on which marker it turns out to be; the *implementation* of the gate depends +on it entirely. + +## Three defects this exposes + +### 1. The derived-object gate keys on evidence that half these controllers do not emit + +[resource-capability-model.md](resource-capability-model.md) knob 4 and +[sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md) +both define `derived` as *"Evidence: a controller `ownerReference` on the live +object."* Against the table above, that test: + +- **catches** ApplicationSet children (verified: the controller calls + `controllerutil.SetControllerReference` on every generated `Application`), and — + per the secrets doc — ESO- and sealed-secrets-derived `Secret`s; +- **misses ResourceSet children entirely** — flux-operator uses owner labels plus a + status inventory, never an `ownerReference` (verified: no `SetControllerReference` + anywhere in `resourceset_controller.go` or `internal/builder/`); +- **probably misses HelmRelease-rendered objects**, which are labelled rather than + owner-referenced (the exact keys need confirming against helm-controller, which is + not checked out). + +An `ownerReference` is neither necessary nor sufficient. And a label alone is not +sufficient either, which is the subtle half: + +> A `Deployment` applied by a Flux `Kustomization` also carries a controller's +> label (`kustomize.toolkit.fluxcd.io/name`). It is **not** derived — it has a +> home file, and mirroring it is exactly right. + +So the real test is not "did a controller touch this object?" but: + +> **Does this object have a home in Git?** — and the answer depends on *which* +> controller applied it and *what its source is*: a folder of files (home exists — +> mirror it) or a template inside a CR (no home — never mirror it). + +That is a **Tier 2 claim**, not a Tier 0 field check. It belongs in the interpreter +registry the [boundary doc](orchestrator-knowledge-boundary.md) already proposes, +as a small table keyed by provenance marker: + +| Provenance marker on the live object | What the controller's source is | Verdict | +|---|---|---| +| `kustomize.toolkit.fluxcd.io/name` | a folder in Git | has a home → **mirror it** | +| `argocd.argoproj.io/tracking-id` | a folder in Git | has a home → **mirror it** | +| `resourceset.fluxcd.controlplane.io/name` | a CR's `spec.resources` | no home → **never mirror** | +| `helm.toolkit.fluxcd.io/name` (keys to confirm) | a chart | no home → **never mirror** | +| `kro.run/*` | a `ResourceGraphDefinition` | no home → **never mirror** | +| controller `ownerReference` | another object | no home → **never mirror** | + +Note the first two rows: these objects are *applied by a controller* and must still +be mirrored, because the controller's source is a folder of files. That is why +"was a controller involved?" is the wrong question and "does it have a home in +Git?" is the right one — and why this table cannot be replaced by a single field +check. + +### 2. We destroy the provenance evidence before anything gates on it + +This is now a pattern with three instances, and it is the same bug each time: + +- [`sanitize.go`](../../../internal/sanitize/sanitize.go) **deletes** + `ownerReferences` before a document reaches Git — already noted in the secrets doc. +- [`sanitize/types.go`](../../../internal/sanitize/types.go) `isOperationalLabel` + **strips `kro.run/`** — the only marker that an object was expanded by KRO. +- `isOperationalAnnotation` strips `kustomize.toolkit.fluxcd.io/` and keeps Argo's + `tracking-id` on an exact-key deny-list. + +In each case the evidence that would answer *"should this object be here at all?"* +is thrown away by the code whose job is to decide what a document looks like once +we have already decided to write it. **The gate must run before the sanitizer, on +the live object, not on the sanitized document.** + +### 3. ResourceSet owner labels would leak into Git today + +`isOperationalLabel` strips `kustomize.toolkit.fluxcd.io/`, `kro.run/`, and +`applyset.kubernetes.io/`. It does **not** strip +`resourceset.fluxcd.controlplane.io/{name,namespace}`. Our code contains **zero** +occurrences of `ResourceSet`, `ApplicationSet`, or `fluxcd.controlplane.io` — we +know nothing about these kinds. + +This is the same family as the Argo CD `tracking-id` hazard already documented in +`types.go`: controller bookkeeping committed to Git, where it is read back as +intent. It is currently moot only because the gate above would refuse the object +outright — but if the gate lands keyed on `ownerReference`, the object is mirrored +*and* the labels leak. + +## The construct catalogue — the support statement + +This is the artifact I think the branch is missing: one table a PM, a user, or an +onboarding report can be checked against. Five verdicts, deliberately few: + +| Verdict | Meaning | +|---|---| +| **Editable** | We mirror it and write edits back to its file. | +| **Read-only context** | We read it to understand the folder; we never write it. | +| **Not mirrored** | It exists live, but a controller synthesised it and Git has no home for it. | +| **Refused** | The folder cannot be written safely; we say why, and fail the target. | +| **Write-only** | We can describe and replace it, but never read it (SOPS). | + +### Delivery and orchestration + +| Construct | Layer | Verdict | Why | +|---|---|---|---| +| Plain KRM folder | intent | **Editable** | files *are* the objects — the first-class target | +| Argo CD `Application` (hand-written) | intent | **Editable** | ordinary KRM (F7) | +| Argo CD `Application` generated by an ApplicationSet | expansion | **Not mirrored** | `ownerReference`; no home file | +| Argo CD `ApplicationSet` (the CR) | intent | **Editable as a document** | but its `template` is a fan-out surface — see below | +| App-of-apps root `Application` | intent | Editable, flagged **cluster entry point** | not an onboarding answer | +| Flux `Kustomization`, `GitRepository`, `OCIRepository`, `HelmRepository` | intent | **Editable** | ordinary KRM | +| Flux `HelmRelease` | intent | **Editable** | shipped, F7 | +| Objects the helm-controller renders from it | expansion | **Not mirrored** | no home file | +| flux-operator `ResourceSet` (the CR) | intent | **Editable as a document** | `spec.inputs` is the supported edit surface | +| Objects a `ResourceSet` expands | expansion | **Not mirrored** | `spec.resources` × inputs; no home file | +| flux-operator `ResourceSetInputProvider` | intent | **Editable** | but `status.exportedInputs` is live-only and unwritable | +| flux-operator `FluxInstance` | intent | Editable, flagged **cluster entry point** | manages Flux itself | +| KRO `ResourceGraphDefinition` / Crossplane `Composition` + claims | intent | **Editable** | ordinary KRM (F7 covers KRO) | +| Objects they expand | expansion | **Not mirrored** | no home file | + +### Rendering + +| Construct | Verdict | Why | +|---|---|---| +| kustomize: `resources`, `namespace`, `images`, `replicas` | **Editable** | invertible; F1 ships `images`/`replicas` edit-through | +| kustomize base + un-fancy overlays | **Editable at launch (F2)** | base is read-only context | +| kustomize base shared by >1 overlay, edited in place | **Refused** | write-fan-in > 1 (L2) | +| kustomize `patches*`, generators, `components`, `namePrefix`/`nameSuffix`, remote bases | **Refused** | non-invertible; F3 addresses patches | +| kustomize `helmCharts:` (inflation) | **Refused** | we never render a chart | +| Helm chart (the whole folder: `Chart.yaml` + `templates/` + `values.yaml` + `crds/`) | **Skipped as a unit** | decision 4 — detect the chart by its folder structure and skip it whole; report it as a `helm-chart` layout, not as silence | +| Flux `HelmRelease` / Argo `Application` Helm knobs (chart version, inline values, parameters) | **Editable** | the Helm surface people actually use — see the Helm section below | +| Free-standing Helm values file (`values/production.yaml`) | **Refused today** | not KRM; a `ValuesFile` projection is proposed below | +| CI-rendered `rendered/` output | **Refused** | the next render destroys the edit | + +### Machine-written Git and secrets + +| Construct | Verdict | Why | +|---|---|---| +| Path written by Flux `ImageUpdateAutomation` | **Refused** | a bot commits here; `$imagepolicy` comments are load-bearing | +| `.argocd-source*.yaml` (Argo CD Image Updater) | **Refused / read-only** | written by a bot, and outranks the config a reader would inspect | +| SOPS `Secret` | **Write-only** | not schema-conformant; the `mac` binds the whole document | +| `SealedSecret` | **Editable** | ordinary KRM; `writeUnit: key` | +| `ExternalSecret` | **Editable** | ordinary KRM; the value simply lives elsewhere | +| `Secret` derived by ESO / sealed-secrets | expansion → **Not mirrored** | `ownerReference` | + +## Why we must understand generators without running them + +The launch use case is *"add something to the test environment."* Generators change +**the recipe for adding a thing**, and getting the recipe wrong is not a +degradation — it produces a duplicate object that fights the controller. + +There are three recipes, and nothing inside a workload folder tells you which one +applies: + +| Repo shape | To add an app you must… | Getting it wrong produces | +|---|---|---| +| App-of-apps, Flux `Kustomization`-per-app | add the manifests **and** author the `Application`/`Kustomization` CR | nothing deploys | +| Kustomize folder | add the manifests **and** the `resources:` entry | nothing deploys (F4 handles this) | +| ApplicationSet `git.directories`, ResourceSetInputProvider | add the manifests / an input **and author no CR** — the generator picks it up | a **duplicate** `Application` that fights the generator | + +The third row is why the corpus keeps asking *"is creating a folder itself a +deployment operation?"* (fixtures 03, 04). It is. The directory listing is a field +of desired state. + +This needs exactly **one new claim** in the vocabulary the +[boundary doc](orchestrator-knowledge-boundary.md) already defines: + +| Claim | Meaning | Emitted from | +|---|---|---| +| `EnumeratedBy{glob, by}` | Any folder/file matching this glob becomes a deployed unit automatically. Do not author a CR for it. | `ApplicationSet.spec.generators.git.directories[].path` / `.files[].path`; a `ResourceSetInputProvider` | + +Reading it needs a group, a kind, and one field path. It never needs Argo's or +Flux's code, and it never evaluates the generator — consistent with the standing +non-goal. + +**Per decision 3 below, we do not currently add an app to such a repository — we +refuse, explicitly.** The claim exists so we can *recognise* the shape and refuse +it precisely, rather than guess and produce a duplicate. + +### And the fan-out rule already covers templates + +The existing L2 write boundary says: *no in-place edit of a source file that more +than one render path reaches.* **Write-fan-in must be 1.** That rule, unchanged, +already answers the template question — the inputs simply play the role of the +render paths: + +| Surface | Fan-in | Verdict | +|---|---|---| +| Kustomize base reached by 2 overlays | 2 | refused (today) | +| `ResourceSet.spec.resources[i]` with 1 input | 1 | **editable** | +| `ResourceSet.spec.resources[i]` with N inputs | N | **refused** — the edit would change every instance | +| `ApplicationSet.spec.template` with N generator results | N | **refused** | +| `ResourceSet.spec.inputs[j].version` | 1 | **editable** — this is the right edit surface | + +That is a satisfying result: the boundary we already enforce for kustomize bases is +the *same* boundary, and it lands in the right place for ResourceSets. "Bump +tenant2's version" is an edit to `spec.inputs[1]`, which has fan-in 1. "Change the +template" does not, and never will. + +The honest caveat: a fan-in-1 edit into `spec.resources[i]` is an edit to a KRM +document **nested inside another KRM document**, and the writer has no concept of +that today. Fixture 15's "KRM never nests KRM" assumption-breaker is exactly this, +and ResourceSet/KRO/Crossplane make it mainstream rather than hostile. + +## The strategic note worth recording + +The flux-operator guides present ResourceSet as a **replacement for base + overlays** — +their own example replaces an `apps/app1/{base,overlays/tenant1,overlays/tenant2}` +tree with "a single file." That tree is exactly the layout **F2 exists to +support**. + +So: to the extent ResourceSets succeed, the repositories F2 targets get replaced by +repositories whose workload KRM is not in Git as files at all. That does not make +F2 wrong — the base+overlay corpus is enormous and will be for years — but it does +mean the ResourceSet answer ("edit the CR, edit its inputs, never its children") is +a **launch-relevant** story rather than a future one, and it is a story we can tell +well and cheaply, because the CR is one editable document. + +## Proposed organisation + +### The corpus: group by axis, not by number + +The fixture numbers `01`–`16` carry no meaning and related shapes sit far apart +(05 and 14 are both "Git holds a renderer's output"; 03, 04, and 12 are all +ApplicationSet). The corpus drives no test and nothing depends on the paths, so +regrouping is cheap **now** and expensive after the first golden report pins a path. + +```text +test/fixtures/gitops-layouts/ +├── README.md # the map: axis → family → fixture +├── support-today.md # GENERATED baseline, not pasted (see below) +├── 1-desired-state/ # the files ARE the objects — first-class target +│ ├── argocd-plain/ (01) +│ └── repo-per-environment/ (11) +├── 2-rendered/ # the files are INPUTS to an offline renderer +│ ├── kustomize-overlays/ (05) +│ ├── helm-chart/ (06) +│ ├── helm-environment-values/ (07) +│ ├── argocd-external-helm/ (08) +│ └── rendered-manifests/ (14) +├── 3-expanded/ # a CONTROLLER materialises the objects ← the new family +│ ├── argocd-app-of-apps/ (02) +│ ├── argocd-applicationset-directories/ (03) +│ ├── argocd-applicationset-files/ (04) +│ ├── argocd-multicluster-matrix/ (12) +│ ├── flux-monorepo/ (09) +│ ├── flux-helmrelease/ (10) +│ ├── flux-resourceset-inline/ NEW — inline KRM + inputs, << >> templating +│ ├── flux-resourceset-pull-requests/ NEW — ResourceSetInputProvider; inputs not in Git +│ └── kro-and-crossplane/ NEW — extracted from 15; KRM nested in KRM +├── 4-machine-written/ # Git is an OUTPUT +│ ├── flux-image-automation/ (16) +│ └── argocd-image-updater/ NEW — extracted from 05's .argocd-source dotfile +├── 5-opaque/ # the object is not the object +│ ├── sops-encrypted/ (13) +│ ├── sealed-secrets/ NEW +│ └── external-secrets/ NEW +└── 6-hostile/ # parser edges + └── mixed-and-hostile/ (15) +``` + +Six families, one per decision the corpus actually forces. A new fixture now has an +obvious home, and `ls` shows the model instead of hiding it. + +If the rename is judged too much churn, the fallback is to keep the flat numbering +and carry `family` + `axis` in a `fixtures.yaml` manifest — but I would rather pay +the churn once, while nothing depends on the paths. + +**Also**: `support-today.md` should be **generated** by a task target, not pasted. +That turns the corpus from documentation into a behavioural baseline, so any change +to the acceptance gate shows up in the pull request as a diff of exactly which +fixtures moved and in which direction. The boundary doc already argues this; it is +the single cheapest thing on this list. + +### The docs: one new page, one new topic, and stop restating + +The design tree does not need reshuffling so much as it needs a **front door** and +one **missing chapter**: + +| Action | Doc | Rationale | +|---|---|---| +| **Add** | `support-contract.md` | The construct catalogue above, and nothing else. The one page that answers "what do you support?" Today that answer is asserted in 17 places, in 3 unrelated refusal vocabularies, and assembled nowhere. | +| **Add** | this doc, or a successor | The expansion axis, the generator family, `EnumeratedBy`. Currently ApplicationSet appears only as a non-goal, and ResourceSet appears nowhere at all. | +| **Consolidate** | the write-fan-in invariant | Stated four times (`kustomize-support` §4, `gittarget-granularity` §1, `README`, `unreflectable-edits`). `gittarget-granularity` §7 already asks whether to fold these; the answer is yes — keep §1, have the rest cite it. | +| **Consolidate** | the `--dry-run=server` evidence table | Duplicated near-verbatim in `resource-capability-model.md` and `intent-cluster-hydration.md`. One home, one citation. | +| **Amend** | `resource-capability-model.md` knob 4, `sealed-secrets-and-external-secrets.md` "The gate" | `derived` cannot key on `ownerReference` alone. It is a Tier 2 provenance claim, not a Tier 0 field check. | +| **Restructure** | `README.md` "Related:" | Group by topic (boundary / product model / orchestrator / secrets / topology / features) instead of a flat list of nine links. | + +Nothing gets deleted, and no doc gets rewritten. The two consolidations are +cross-reference edits, not merges. + +## Decisions (2026-07-11) + +The five questions this doc opened have been answered. Recorded here; the ones that +change another doc are flagged. + +### 1. The intent cluster runs **both** ways — design for both + +An intent cluster may be a **lightweight, workload-less cluster** or **an actual +production cluster**. Both are supported topologies, so the design must hold in +both. That resolves the gate question decisively: + +| Intent-cluster mode | Is flux-operator / ApplicationSet running? | Consequence | +|---|---|---| +| Lightweight control cluster | **No** — CRDs only, per the standing rule ("install a controller only if it is an applier you drive"). A `ResourceSet` expander is not an applier we drive. | Children never materialise. The `ResourceSet` CR sits there inert and editable. Nothing to gate. | +| Production cluster | **Yes** | Children materialise as live objects. **The provenance gate is mandatory** — without it we mirror them and create a second source of truth. | + +So the gate is **not optional**: the production-cluster mode requires it. And in the +lightweight mode the CR is cleanly editable with no expansion layer at all, which +is the better editing experience and worth saying out loud. + +Hydration of the lightweight cluster is guaranteed to have **both Argo CD and Flux +available**, so it always starts from clean data. That closes the "untested with +Argo CD" caveat in +[intent-cluster-hydration.md](intent-cluster-hydration.md) as a *product* matter — +the Argo CD handshake still needs proving in e2e, but we will never be forced to +hydrate without a working applier. + +### 2. Fan-in = 1 stays the ground rule + +**We do not change more than one thing.** The write-fan-in invariant holds as +stated, and it is what makes `spec.inputs[j]` writable and a multi-input template +not. Noted for the record that this may not hold forever — a future feature may +want a deliberate, declared fan-out edit — but nothing is designed against that +today, and the rule stays. + +### 3. Adding an app to a generator-enumerated repo is **disallowed**, loudly + +When `EnumeratedBy` holds — an `ApplicationSet` `git.directories` glob, a +`ResourceSetInputProvider` — creating a new app is a **special case we refuse for +now**, explicitly. Not silently skipped: an explicit refusal with a reason. + +This is the right call because the failure mode of guessing is the worst one +available: author the CR and you get a duplicate `Application` fighting the +generator; omit it and nothing deploys. A refusal that says *"this repo enumerates +apps from a glob; adding one is not something I can do safely — do it in Git"* is +honest and costs the user one PR. + +The `EnumeratedBy` claim is still worth emitting, because it is what lets us +*recognise* the case in order to refuse it precisely rather than fail confusingly. + +### 4. Helm charts are skipped as a unit — including `crds/` + +A Helm chart is **recognisable by its folder structure** (`Chart.yaml` + +`templates/`), so detect the chart and skip the whole thing, `crds/` included. + +This fixes the report bug directly: `06-helm-chart` today reports exactly one +accepted candidate — `charts/frontend/crds` — which makes the onboarding report say +"1 folder supported" about a repository we cannot meaningfully support. A chart +should surface as an explicit `helm-chart` layout that reports honestly, not as +silence plus an incidental `crds/`. + +### 5. `Permute` / `matrix` fan-out: refused, and noted + +Fan-in is N > 1, so the verdict follows from decision 2 with nothing new to decide. +Noted because users *will* want per-cell edits on a sparse input matrix (fixture +12), and that want is real — it is simply not something we can serve inside the +fan-in-1 rule. If the rule ever relaxes, this is the first case to revisit. + +## Helm: name the surface we already support, do not invent a standard + +The instinct that *"we cannot credibly tell the Helm world we do nothing with +Helm"* is right, and the good news is that **we already do more than the messaging +admits**. The proposed fix is not a new "helm-lite" standard — you cannot make the +field adopt a subset you invent, and a standard nobody follows is worse than none. +The fix is to **name the Helm surface that already works**. + +Here is what people actually do with Helm in a GitOps repo, and where each lands +today: + +| What a user wants to do | Where it lives | Verdict | +|---|---|---| +| Bump a chart version | `HelmRelease.spec.chart.spec.version`; Argo `Application.spec.source.targetRevision` | ✅ **works today** — ordinary KRM edit | +| Change a value | `HelmRelease.spec.values` (inline) | ✅ **works today** | +| Change a value | `Application.spec.source.helm.parameters` | ✅ **works today** (structured) | +| Change a value | `Application.spec.source.helm.values` | ⚠️ works, but the field is an embedded YAML **string** — a blob, not a tree | +| Change a value held in a `ConfigMap` (`valuesFrom`) | a real `ConfigMap` | ✅ **works today** — it is KRM like anything else | +| Install a chart / add an app | add a `HelmRelease` + `HelmRepository`/`OCIRepository` | ✅ **works today** (F4 placement) | +| Change a value in a free-standing values file | `values/production.yaml` | ❌ **the gap** — not KRM, so no object exists to edit | +| Edit the chart's `templates/` | chart source | ❌ refused, permanently — and correctly | +| Edit a rendered object | live only | ❌ not mirrored (expansion layer) | + +Read that table and the honest headline is not "no Helm." It is: + +> **We support Helm the way GitOps repositories actually use it — as a declaration +> you edit, not a chart you render.** The most common Helm operation in a GitOps +> repo is "bump the chart version" or "change a value on a `HelmRelease`", and both +> have worked since F7. + +### The one real gap, and the precedent that closes it + +The genuine hole is the **free-standing values file** — `values/production.yaml`, +`values/common.yaml` — which fixtures 07, 08, and 12 are all built around. It is +not KRM, so nothing hydrates it into the intent cluster, so there is no object for +a user to edit. + +There is an exact precedent for this in the branch already: +[`EncryptedSecret`](write-only-encrypted-secrets.md) projects a document we cannot +store as itself into a kind we *can*, and its punchline is *"a refusal becomes a +capability."* The same move works here — project a values file as a synthetic +`ValuesFile` (or `HelmValues`) object, let the user edit it, write it straight back +to the file. + +And the invertibility argument is unusually clean, which is why this is worth +proposing rather than just noting: + +- The file is **plain YAML we own end to end**. No renderer stands between it and + Git — we are not inflating a chart, we are editing a file whose bytes are the + desired content. +- **Fan-in is 1** whenever exactly one `HelmRelease`/`Application` references it, + which the analyzer can already determine from `valuesFrom` / `valueFiles`. Shared + values files (`common.yaml`) have fan-in > 1 and are refused by the existing rule + with no new machinery. +- It is **not chart inflation** — the boundary that must never move. We still never + render `templates/`, and we still never learn what a value *means*. + +This deserves a ladder entry rather than a decision here, and it is the single +highest-leverage thing available for the Helm story: it turns the biggest "we do +nothing with Helm" objection into a supported edit, using a pattern already +designed for another problem. + +### What a "helm-lite" recommendation *can* be + +Not a standard — a **migration recommendation in the onboarding report**. F8 can +honestly say: *"this repository keeps its values in free-standing files; these three +are shared and cannot be edited; these four are single-use and can."* That is a +report, not a standard, and it is achievable. + +## Residual open questions + +1. **Argo CD's triggered-hydration handshake is still unproven in e2e.** Decision 1 + guarantees Argo CD will be *available*; it does not prove the `Refresh` + + `selfHeal: false` handshake converges the way the Flux one does + ([bi-directional.md](../../bi-directional.md) says the same). Still the largest + untested assumption under the intent cluster. +2. **What exactly makes a chart a chart?** Decision 4 says "recognisable folder + structure." `Chart.yaml` + `templates/` is the obvious test, but fixture 15 + plants a `templates/` directory with **no** `Chart.yaml` and unparseable content + precisely to break it. Which signal is load-bearing, and what happens to a chart + vendored under `charts/` inside another chart? +3. **Does the provenance gate run on the live object or the sanitized document?** + The evidence (`ownerReferences`, `kro.run/` labels) is destroyed by `sanitize`, + so the gate must run first — but nothing in the pipeline is structured that way + today. This is the one decision that blocks implementation. From 2cd3d01edee0e09edb042966508fa54a9e864477 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Sat, 11 Jul 2026 19:29:49 +0000 Subject: [PATCH 12/28] docs: split the tree by lifecycle, and fix every dangling citation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 180 documents, ~55k lines, in two folders whose names lied in both directions: docs/design/ held 23 designs whose work had shipped, and docs/finished/ held 10 documents that were the sole record of a live invariant — including current-manifest-support-review.md, the spec of internal/manifestanalyzer, cited by section name from eight Go files. Three folders now mean three things: design/ we are still deciding (9 open items + the gitops-api workstream) spec/ this is true now, and the code depends on it (NEW, 25 docs) finished/ this happened (history; nothing here binds) docs/design/manifest/ is gone. All three of its subsystems (internal/typeset, internal/git/manifestedit, internal/manifestreport) have shipped, so its 19 working-note documents collapse into one spec/manifest-system.md that states how the pipeline works today, plus the four that were genuinely live specs. The important part: 17 doc citations in the Go source were ALREADY broken before this change — six pointed at documents that no longer existed anywhere. Earlier "docs: cleaning" commits moved files and never fixed the pointers, which is how the tree became unreadable. Every citation now resolves: 125 in Go, 244 relative links rewritten across the docs, 39 de-linked where the target is genuinely gone. Verified by a link check over every markdown file and every docs/*.md path mentioned in Go. 180 -> 117 documents. Nothing is lost; git log --follow has all of it. Co-Authored-By: Claude Opus 4.8 (1M context) --- CONTRIBUTING.md | 4 +- cmd/main.go | 4 +- cmd/manifest-analyzer/main.go | 2 +- cmd/mutation-capture-lab/main.go | 2 +- cmd/readiness.go | 6 +- docs/TODO.md | 4 +- docs/UPGRADING.md | 2 +- docs/architecture.md | 40 +- docs/attribution-setup-guide.md | 12 +- docs/audit-setup/cluster/readme.md | 2 +- docs/bi-directional.md | 4 +- docs/ci/findings.md | 2 +- docs/configuration.md | 4 +- ...-aggregated-apiserver-proxy-hookup-plan.md | 512 ---------- ...e2e-coverage-gaps-and-improvements-plan.md | 10 +- ...e-full-suite-shared-state-investigation.md | 445 --------- .../e2e-watchrule-cross-spec-interference.md | 216 ----- docs/design/gitops-api/README.md | 10 +- .../gitops-api/argocd-bi-directional.md | 4 +- .../f8-repo-discovery-and-onboarding-scan.md | 6 +- .../f1-images-replicas-edit-through.md | 2 +- ...granularity-and-cross-environment-edits.md | 2 +- .../gitops-api/intent-cluster-hydration.md | 2 +- ...mize-support-boundary-and-product-model.md | 6 +- .../unreflectable-edits-and-write-gating.md | 2 +- .../write-only-encrypted-secrets.md | 2 +- ...ttarget-lifecycle-and-repo-architecture.md | 536 ----------- ...rget-state-machine-bootstrap-assessment.md | 438 --------- ...e-full-suite-flakiness-findings-2026-06.md | 243 ----- .../manifest/file-agnostic-placement.md | 26 - ...pted-projection-race-and-external-drift.md | 447 --------- ...ifest-inventory-file-agnostic-placement.md | 572 ----------- .../manifest/manifestedit-abstraction-plan.md | 337 ------- ...festedit-integration-readonly-reconcile.md | 132 --- .../manifest/manifestedit-writer-followups.md | 132 --- .../api-catalog-watched-type-architecture.md | 907 ------------------ .../catalog-mapper-vs-watched-type-table.md | 329 ------- .../discovery-catalog-typeset-boundary.md | 411 -------- .../version2/double-repo-detection.md | 494 ---------- docs/design/manifest/version2/dream.md | 24 - ...arget-repository-validity-and-placement.md | 305 ------ .../version2/subresource-scope-reduction.md | 237 ----- .../type-followability-implementation.md | 437 --------- .../type-followability-naming-proposal.md | 276 ------ docs/design/metrics-observability-plan.md | 6 +- docs/design/reconcile-triggering.md | 4 +- .../residual-e2e-flakes-2026-06-19.md | 30 +- ...ensitive-resource-diagnostics-follow-up.md | 2 +- docs/design/status-design-git-target.md | 262 ----- ...e2e-per-type-tail-failure-investigation.md | 209 ---- .../stream/late-lane-e2e-2026-06-16-final.tsv | 55 -- .../late-lane-e2e-2026-06-16-midrun.tsv | 21 - .../per-type-streaming-readiness-plan.md | 176 ---- ...verlap-band-coverage-drop-investigation.md | 335 ------- ...atermark-stream-readiness-investigation.md | 223 ----- docs/design/upgrade-finding.md | 157 --- docs/design/voter-gitops-demo-instances.md | 268 ------ docs/design/watch-and-catalog-architecture.md | 14 +- .../watch-audit-rule-matching-improvement.md | 687 ------------- docs/design/watch-first-merge-readiness.md | 155 --- ...hrule-wildcard-and-resolution-semantics.md | 142 --- .../audit-webhook-api-server-connectivity.md | 0 .../kubernetes-apf-and-inflight-tuning.md | 0 .../kubernetes-api-discovery.md | 0 .../kubernetes-api-resource-catalog.md | 0 ...ch-event-ordering-and-attribution-grace.md | 2 +- .../finished/api-source-of-truth-reconcile.md | 434 --------- ...audit-consumer-username-attribution-gap.md | 139 --- docs/finished/audit-metrics-overhaul-plan.md | 510 ---------- .../audit-webhook-tls-design.md | 0 docs/finished/canonical-stream-retirement.md | 431 --------- ...trequest-attribution-divert-reliability.md | 396 -------- .../commitrequest-barrier-timeout-decision.md | 85 -- docs/finished/current-flows-and-cutover.md | 256 ----- ...urrent-manifest-support-review-feedback.md | 211 ---- .../deletecollection-resync-nudge-plan.md | 347 ------- docs/finished/demand-gated-audit-ingestion.md | 516 ---------- .../design-audit-ingestion-hardening.md | 190 ---- docs/finished/design-commit-request-api.md | 226 ----- .../design-rule-change-snapshot-trigger.md | 220 ----- .../dynamic-analysis-fuzzing-plan.md | 0 .../e2e-aggregated-apiserver-test-design.md | 12 +- .../e2e-ci-runner-sharding-plan.md | 14 +- docs/finished/e2e-metrics-over-logs-plan.md | 267 ------ .../e2e-signing-followups.md | 0 docs/{design => finished}/e2e-speedup-plan.md | 4 +- docs/finished/git-author.md | 165 ---- .../git-credentials-interop.md | 0 .../idea-audit-enrichment-side-channel.md | 734 -------------- .../image-refresh-test-design.md | 0 docs/finished/internal-audit-type-demand.md | 250 ----- docs/finished/manifest-parser-poc.md | 322 ------- .../manifestedit-new-file-placement-spike.md | 182 ---- ...lization-tail-and-live-readiness-review.md | 4 +- .../partial-object-audit-event-handling.md | 366 ------- .../path-scoped-bootstrap-template-design.md | 210 ---- ...source-type-rv-keyed-streams-experiment.md | 512 ---------- .../redis-key-schema-v3.md | 10 +- .../remove-gittarget-admission-webhook.md | 153 --- .../rule-set-snapshot-discovery-lag-fix.md | 237 ----- .../scale-subresource-state-code-removal.md | 107 --- .../sensitive-resource-classification-plan.md | 2 +- .../shallow-audit-event-misclassification.md | 432 --------- ...pshot-tail-replay-failure-investigation.md | 12 +- ...otstrap-and-key-management-architecture.md | 0 .../sops-repo-bootstrap-out-of-scope.md | 0 .../startup-robustness-cert-and-crd-wobble.md | 2 +- ...reaming-readiness-status-machine-design.md | 30 +- .../tilt-playground-plan.md | 0 .../watch-first-ingestion-architecture.md | 6 +- docs/finished/watch-gvr-resolution-cleanup.md | 157 --- docs/finished/watch-list-checkpoint-plan.md | 169 ---- .../finished/watchrule-gvr-resolution-plan.md | 367 ------- docs/finished/wildcard-ci-failure-findings.md | 293 ------ ...d-user-commit-messages-audit-transports.md | 399 -------- docs/future/design-commit-request-phase-2.md | 2 +- .../design-snapshot-engine-evolution.md | 701 -------------- .../further-away/accesspolicy-design.md | 624 ------------ docs/future/ha-gittarget-distribution-plan.md | 6 +- docs/future/idea-end-user-commit-messages.md | 434 --------- docs/future/idea-unify-pending-write-kinds.md | 4 +- .../future/watchrule-wildcard-support-plan.md | 269 ------ docs/proud.md | 6 +- docs/security-model.md | 2 +- docs/sops-age-guide.md | 4 +- docs/spec/README.md | 36 + .../audit-readiness-probe-plan.md | 10 +- .../commit-window-refactor.md | 0 .../commitrequest-admission-authorship.md | 6 +- .../stream => spec}/commitrequest-design.md | 38 +- .../commitrequest-multi-finalize-design.md | 4 +- ...-namespace-and-kustomize-folder-editing.md | 10 +- .../current-manifest-support-review.md | 18 +- .../deletecollection-attribution-expander.md | 16 +- .../e2e-bi-directional-corner.md | 10 +- docs/{design => spec}/e2e-serial-registry.md | 4 +- docs/{design => spec}/e2e-test-design.md | 10 +- .../gitpath-foreign-content-stringency.md | 0 .../gittarget-isolation-on-rule-change.md | 0 .../gittarget-new-file-placement-rules.md | 36 +- .../gvk-gvr-mapping-layer.md | 10 +- docs/spec/manifest-system.md | 157 +++ .../manifestedit-field-ownership-spike.md | 4 +- .../mutation-capture-lab-design.md | 4 +- .../reconcile-via-watchlist-mark-and-sweep.md | 28 +- .../scale-subresource-audit-rehydration.md | 8 +- .../sops-single-file-no-multidoc.md | 10 +- .../status-conditions-guide.md | 0 .../version2 => spec}/type-followability.md | 16 +- ...pe-lifecycle-events-and-wobble-settling.md | 18 +- .../typeset-owns-discovery-grace.md | 8 +- .../unsupported-folder-refusal-plan.md | 4 +- internal/audit/outcome/outcome.go | 2 +- .../controller/commitrequest_controller.go | 10 +- internal/controller/constants.go | 4 +- .../controller/dependency_watches_test.go | 2 +- internal/controller/gitprovider_controller.go | 2 +- .../controller/gitprovider_controller_test.go | 2 +- internal/controller/gittarget_controller.go | 6 +- .../gittarget_placement_validation.go | 2 +- internal/controller/watchrule_controller.go | 2 +- internal/git/branch_worker.go | 2 +- internal/git/branch_worker_credread_test.go | 2 +- internal/git/commit_request_attach.go | 2 +- internal/git/commit_request_attach_loop.go | 2 +- internal/git/encryption.go | 2 +- internal/git/inplace_overrides_test.go | 2 +- internal/git/manifestedit/decision.go | 4 +- internal/git/manifestedit/decision_test.go | 2 +- internal/git/manifestedit/fieldpatch.go | 2 +- internal/git/manifestedit/kustomization.go | 4 +- internal/git/manifestedit/types.go | 2 +- internal/git/plan_flush.go | 12 +- internal/git/resync_flush.go | 4 +- internal/git/resync_push_test.go | 2 +- internal/git/types.go | 8 +- internal/manifestanalyzer/acceptance.go | 4 +- internal/manifestanalyzer/analyzer.go | 2 +- .../contextual_namespace_corpus_test.go | 2 +- internal/manifestanalyzer/delete_plan.go | 4 +- internal/manifestanalyzer/gittargetignore.go | 4 +- internal/manifestanalyzer/overrides.go | 2 +- .../manifestanalyzer/overrides_projection.go | 2 +- internal/manifestanalyzer/overrides_test.go | 2 +- internal/manifestanalyzer/placement.go | 4 +- internal/manifestanalyzer/plan.go | 6 +- internal/manifestanalyzer/scan.go | 2 +- internal/manifestanalyzer/store.go | 12 +- internal/manifestreport/render.go | 10 +- internal/manifestreport/report.go | 2 +- internal/mutationlab/record.go | 2 +- internal/mutationlab/store/store.go | 2 +- internal/queue/attribution_index.go | 2 +- internal/reconcile/git_target_event_stream.go | 2 +- internal/rulestore/store_test.go | 2 +- internal/types/identifier.go | 2 +- internal/typeset/funnel.go | 2 +- internal/typeset/lifecycle.go | 2 +- internal/typeset/materializer.go | 8 +- internal/typeset/model.go | 4 +- internal/typeset/registry.go | 2 +- internal/typeset/scan.go | 2 +- internal/watch/api_resource_catalog.go | 2 +- internal/watch/manager.go | 6 +- internal/watch/manager_catalog.go | 4 +- internal/watch/scope_resolve.go | 2 +- internal/watch/target_watch.go | 2 +- .../validate_operator_types_handler.go | 2 +- test/e2e/aggregated_apiserver_e2e_test.go | 2 +- test/e2e/argocd_bi_directional_e2e_test.go | 2 +- test/e2e/bi_directional_common_test.go | 2 +- test/e2e/commit_request_e2e_test.go | 6 +- test/e2e/commit_window_batching_e2e_test.go | 2 +- test/e2e/deletecollection_intent_e2e_test.go | 2 +- test/e2e/e2e_suite_test.go | 2 +- test/e2e/f4_placement_e2e_test.go | 2 +- test/e2e/flux_bi_directional_e2e_test.go | 4 +- test/e2e/foreign_content_e2e_test.go | 2 +- test/e2e/gittarget_isolation_e2e_test.go | 4 +- test/e2e/gittarget_overlap_e2e_test.go | 4 +- test/e2e/helmrelease_mirror_edit_e2e_test.go | 2 +- test/e2e/icecream.go | 2 +- test/e2e/image_refresh_test.go | 2 +- test/e2e/inplace_edit_e2e_test.go | 2 +- test/e2e/restart_reconcile_e2e_test.go | 2 +- test/e2e/signing_e2e_test.go | 2 +- test/e2e/unsupported_folder_e2e_test.go | 2 +- 227 files changed, 604 insertions(+), 21870 deletions(-) delete mode 100644 docs/design/e2e-aggregated-apiserver-proxy-hookup-plan.md delete mode 100644 docs/design/e2e-full-suite-shared-state-investigation.md delete mode 100644 docs/design/e2e-watchrule-cross-spec-interference.md delete mode 100644 docs/design/gittarget-lifecycle-and-repo-architecture.md delete mode 100644 docs/design/gittarget-state-machine-bootstrap-assessment.md delete mode 100644 docs/design/manifest/e2e-full-suite-flakiness-findings-2026-06.md delete mode 100644 docs/design/manifest/file-agnostic-placement.md delete mode 100644 docs/design/manifest/gitpathaccepted-projection-race-and-external-drift.md delete mode 100644 docs/design/manifest/manifest-inventory-file-agnostic-placement.md delete mode 100644 docs/design/manifest/manifestedit-abstraction-plan.md delete mode 100644 docs/design/manifest/manifestedit-integration-readonly-reconcile.md delete mode 100644 docs/design/manifest/manifestedit-writer-followups.md delete mode 100644 docs/design/manifest/version2/api-catalog-watched-type-architecture.md delete mode 100644 docs/design/manifest/version2/catalog-mapper-vs-watched-type-table.md delete mode 100644 docs/design/manifest/version2/discovery-catalog-typeset-boundary.md delete mode 100644 docs/design/manifest/version2/double-repo-detection.md delete mode 100644 docs/design/manifest/version2/dream.md delete mode 100644 docs/design/manifest/version2/gittarget-repository-validity-and-placement.md delete mode 100644 docs/design/manifest/version2/subresource-scope-reduction.md delete mode 100644 docs/design/manifest/version2/type-followability-implementation.md delete mode 100644 docs/design/manifest/version2/type-followability-naming-proposal.md rename docs/design/{stream => }/residual-e2e-flakes-2026-06-19.md (88%) delete mode 100644 docs/design/status-design-git-target.md delete mode 100644 docs/design/stream/github-e2e-per-type-tail-failure-investigation.md delete mode 100644 docs/design/stream/late-lane-e2e-2026-06-16-final.tsv delete mode 100644 docs/design/stream/late-lane-e2e-2026-06-16-midrun.tsv delete mode 100644 docs/design/stream/per-type-streaming-readiness-plan.md delete mode 100644 docs/design/stream/signing-overlap-band-coverage-drop-investigation.md delete mode 100644 docs/design/stream/watch-replay-watermark-stream-readiness-investigation.md delete mode 100644 docs/design/upgrade-finding.md delete mode 100644 docs/design/voter-gitops-demo-instances.md delete mode 100644 docs/design/watch-audit-rule-matching-improvement.md delete mode 100644 docs/design/watch-first-merge-readiness.md delete mode 100644 docs/design/watchrule-wildcard-and-resolution-semantics.md rename docs/{design => facts}/audit-webhook-api-server-connectivity.md (100%) rename docs/{design => facts}/kubernetes-apf-and-inflight-tuning.md (100%) rename docs/{design => facts}/kubernetes-api-discovery.md (100%) rename docs/{design => facts}/kubernetes-api-resource-catalog.md (100%) rename docs/{design => facts}/watch-event-ordering-and-attribution-grace.md (98%) delete mode 100644 docs/finished/api-source-of-truth-reconcile.md delete mode 100644 docs/finished/audit-consumer-username-attribution-gap.md delete mode 100644 docs/finished/audit-metrics-overhaul-plan.md rename docs/{design => finished}/audit-webhook-tls-design.md (100%) delete mode 100644 docs/finished/canonical-stream-retirement.md delete mode 100644 docs/finished/commitrequest-attribution-divert-reliability.md delete mode 100644 docs/finished/commitrequest-barrier-timeout-decision.md delete mode 100644 docs/finished/current-flows-and-cutover.md delete mode 100644 docs/finished/current-manifest-support-review-feedback.md delete mode 100644 docs/finished/deletecollection-resync-nudge-plan.md delete mode 100644 docs/finished/demand-gated-audit-ingestion.md delete mode 100644 docs/finished/design-audit-ingestion-hardening.md delete mode 100644 docs/finished/design-commit-request-api.md delete mode 100644 docs/finished/design-rule-change-snapshot-trigger.md rename docs/{design => finished}/dynamic-analysis-fuzzing-plan.md (100%) rename docs/{design => finished}/e2e-aggregated-apiserver-test-design.md (98%) rename docs/{design => finished}/e2e-ci-runner-sharding-plan.md (94%) delete mode 100644 docs/finished/e2e-metrics-over-logs-plan.md rename docs/{design => finished}/e2e-signing-followups.md (100%) rename docs/{design => finished}/e2e-speedup-plan.md (98%) delete mode 100644 docs/finished/git-author.md rename docs/{design => finished}/git-credentials-interop.md (100%) delete mode 100644 docs/finished/idea-audit-enrichment-side-channel.md rename docs/{design => finished}/image-refresh-test-design.md (100%) delete mode 100644 docs/finished/internal-audit-type-demand.md delete mode 100644 docs/finished/manifest-parser-poc.md delete mode 100644 docs/finished/manifestedit-new-file-placement-spike.md delete mode 100644 docs/finished/partial-object-audit-event-handling.md delete mode 100644 docs/finished/path-scoped-bootstrap-template-design.md delete mode 100644 docs/finished/per-resource-type-rv-keyed-streams-experiment.md rename docs/{design => finished}/redis-key-schema-v3.md (98%) delete mode 100644 docs/finished/remove-gittarget-admission-webhook.md delete mode 100644 docs/finished/rule-set-snapshot-discovery-lag-fix.md delete mode 100644 docs/finished/scale-subresource-state-code-removal.md rename docs/{design => finished}/sensitive-resource-classification-plan.md (97%) delete mode 100644 docs/finished/shallow-audit-event-misclassification.md rename docs/{design/stream => finished}/signing-snapshot-tail-replay-failure-investigation.md (98%) rename docs/{design => finished}/sops-repo-bootstrap-and-key-management-architecture.md (100%) rename docs/{design => finished}/sops-repo-bootstrap-out-of-scope.md (100%) rename docs/{design => finished}/startup-robustness-cert-and-crd-wobble.md (99%) rename docs/{design/stream => finished}/streaming-readiness-status-machine-design.md (92%) rename docs/{design => finished}/tilt-playground-plan.md (100%) rename docs/{design => finished}/watch-first-ingestion-architecture.md (99%) delete mode 100644 docs/finished/watch-gvr-resolution-cleanup.md delete mode 100644 docs/finished/watch-list-checkpoint-plan.md delete mode 100644 docs/finished/watchrule-gvr-resolution-plan.md delete mode 100644 docs/finished/wildcard-ci-failure-findings.md delete mode 100644 docs/future/addendum-end-user-commit-messages-audit-transports.md delete mode 100644 docs/future/design-snapshot-engine-evolution.md delete mode 100644 docs/future/further-away/accesspolicy-design.md delete mode 100644 docs/future/idea-end-user-commit-messages.md delete mode 100644 docs/future/watchrule-wildcard-support-plan.md create mode 100644 docs/spec/README.md rename docs/{finished => spec}/audit-readiness-probe-plan.md (95%) rename docs/{finished => spec}/commit-window-refactor.md (100%) rename docs/{design => spec}/commitrequest-admission-authorship.md (99%) rename docs/{design/stream => spec}/commitrequest-design.md (96%) rename docs/{finished => spec}/commitrequest-multi-finalize-design.md (99%) rename docs/{design/manifest => spec}/contextual-namespace-and-kustomize-folder-editing.md (97%) rename docs/{finished => spec}/current-manifest-support-review.md (98%) rename docs/{design => spec}/deletecollection-attribution-expander.md (96%) rename docs/{design => spec}/e2e-bi-directional-corner.md (98%) rename docs/{design => spec}/e2e-serial-registry.md (98%) rename docs/{design => spec}/e2e-test-design.md (97%) rename docs/{design => spec}/gitpath-foreign-content-stringency.md (100%) rename docs/{finished => spec}/gittarget-isolation-on-rule-change.md (100%) rename docs/{design/manifest/version2 => spec}/gittarget-new-file-placement-rules.md (97%) rename docs/{finished => spec}/gvk-gvr-mapping-layer.md (97%) create mode 100644 docs/spec/manifest-system.md rename docs/{finished => spec}/manifestedit-field-ownership-spike.md (95%) rename docs/{design => spec}/mutation-capture-lab-design.md (99%) rename docs/{design/manifest => spec}/reconcile-via-watchlist-mark-and-sweep.md (92%) rename docs/{finished => spec}/scale-subresource-audit-rehydration.md (96%) rename docs/{finished => spec}/sops-single-file-no-multidoc.md (94%) rename docs/{design => spec}/status-conditions-guide.md (100%) rename docs/{design/manifest/version2 => spec}/type-followability.md (96%) rename docs/{finished => spec}/type-lifecycle-events-and-wobble-settling.md (93%) rename docs/{design => spec}/typeset-owns-discovery-grace.md (97%) rename docs/{design => spec}/unsupported-folder-refusal-plan.md (99%) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index fb517913..3361f85e 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -85,7 +85,7 @@ task fuzz-smoke # short active-fuzz smoke of each target If fuzzing finds a crash, Go writes the reproducer under `/testdata/fuzz//`. Commit it: it fixes the input as a permanent regression case, replayed by `task test` thereafter. See -[`docs/design/dynamic-analysis-fuzzing-plan.md`](docs/design/dynamic-analysis-fuzzing-plan.md). +[`docs/finished/dynamic-analysis-fuzzing-plan.md`](docs/finished/dynamic-analysis-fuzzing-plan.md). ## E2E tests @@ -133,7 +133,7 @@ The Tilt UI keeps build/deploy work on the existing `task prepare-e2e` path, the - `playground-status` prints the current starter resources and the recent repo commit log The design note for the playground flow lives in -[`docs/design/tilt-playground-plan.md`](docs/design/tilt-playground-plan.md). +[`docs/finished/tilt-playground-plan.md`](docs/finished/tilt-playground-plan.md). **Troubleshooting:** - envtest errors: run `task setup-envtest` then retry diff --git a/cmd/main.go b/cmd/main.go index 4ccc8ef9..fdf8cc23 100644 --- a/cmd/main.go +++ b/cmd/main.go @@ -269,7 +269,7 @@ func main() { // lives in its own Redis corner (author:v1:command), independent of // --author-attribution (which governs mirrored-resource attribution). It is wired // whenever the admission server is on; the controller reads the captured submitter - // back with no wait (docs/design/commitrequest-admission-authorship.md §2, §6). + // back with no wait (docs/spec/commitrequest-admission-authorship.md §2, §6). // // AuthorLookup must be a nil interface — not a non-nil interface wrapping a nil // *CommandAuthorStore — when the webhook is off, so the controller's nil check @@ -898,7 +898,7 @@ func newManager( // value in memory. Typed Secret Get/List go straight to the API server instead, // which also keeps credential/age-key rotation reads fresh. Mirrored Secrets // selected by a WatchRule use the separate dynamic-watch path, not this cache. - // See docs/future/secret-value-retention-plan.md. + // See docs/rbac.md. Client: client.Options{ Cache: &client.CacheOptions{ DisableFor: []client.Object{&corev1.Secret{}}, diff --git a/cmd/manifest-analyzer/main.go b/cmd/manifest-analyzer/main.go index c44c9754..740d634d 100644 --- a/cmd/manifest-analyzer/main.go +++ b/cmd/manifest-analyzer/main.go @@ -3,7 +3,7 @@ // manifest-analyzer is a standalone, read-only CLI that analyzes a folder of // Kubernetes manifests. It is the proof-of-concept consumer of the // internal/manifestanalyzer library described in -// docs/design/manifest/current-manifest-support-review.md. It writes nothing; it +// docs/spec/current-manifest-support-review.md. It writes nothing; it // only reports what it finds. // // Usage: diff --git a/cmd/mutation-capture-lab/main.go b/cmd/mutation-capture-lab/main.go index 6b5ca602..cf54ffdc 100644 --- a/cmd/mutation-capture-lab/main.go +++ b/cmd/mutation-capture-lab/main.go @@ -4,7 +4,7 @@ // of recorders (native watch, audit webhook, validating admission webhook) whose // output is a versioned corpus of the exact structures Kubernetes emits. It is // deliberately NOT a second GitOps Reverser; see -// docs/design/mutation-capture-lab-design.md. +// docs/spec/mutation-capture-lab-design.md. // // It deliberately serves the SAME webhook URLs as the product // (/validate-all, /audit-webhook) so a lab deployment can swap the product image diff --git a/cmd/readiness.go b/cmd/readiness.go index 88e0d61a..6b084056 100644 --- a/cmd/readiness.go +++ b/cmd/readiness.go @@ -3,7 +3,7 @@ // Liveness and readiness wiring for the controller. Liveness (/healthz) stays a bare process // ping; readiness (/readyz) reflects the audit-serving preconditions so the kube-apiserver — which // dials this pod through a Service — only routes audit events here once the pod can actually -// receive and enqueue them. See docs/design/audit-readiness-probe-plan.md. +// receive and enqueue them. See docs/spec/audit-readiness-probe-plan.md. package main @@ -46,7 +46,7 @@ type redisPinger interface { // endpoints — but once it has connected, transient Redis blips are handled at the request layer // (the audit handler returns HTTP 500 and the apiserver retries the batch), NOT by flapping // readiness, which would yank every replica out of endpoints at once. See -// docs/design/audit-readiness-probe-plan.md §4. +// docs/spec/audit-readiness-probe-plan.md §4. type redisReadinessGate struct { pinger redisPinger timeout time.Duration @@ -152,7 +152,7 @@ func combineReadyChecks(checks ...healthz.Checker) healthz.Checker { // reflects the locally-checkable audit-serving preconditions (listener up, TLS cert loaded, first // Redis connection made) so the kube-apiserver, which dials this pod through a Service, only routes // audit events here once the pod can actually receive and enqueue them. See -// docs/design/audit-readiness-probe-plan.md. +// docs/spec/audit-readiness-probe-plan.md. func addHealthChecks( mgr ctrl.Manager, auditProbe auditReadinessProbe, diff --git a/docs/TODO.md b/docs/TODO.md index 0030213d..43b6bdc0 100644 --- a/docs/TODO.md +++ b/docs/TODO.md @@ -42,7 +42,7 @@ This file is meant to track the smaller current backlog, not historical notes. - [ ] Fix recurring full e2e flakiness around WatchRule/snapshot convergence. This has shown up more than once as timeout-based failures in manager SOPS bootstrap and signing snapshot-message specs, then passed on rerun. Capture and mitigation notes live in - [docs/design/e2e-watchrule-cross-spec-interference.md](design/e2e-watchrule-cross-spec-interference.md). + [docs/design/e2e-watchrule-cross-spec-interference.md](spec/e2e-serial-registry.md). This should be addressed before the next feature that expands commit-message, snapshot, or write-window behavior, otherwise new failures will be hard to separate from existing timing debt. @@ -77,7 +77,7 @@ This file is meant to track the smaller current backlog, not historical notes. - [ ] Handle resources whose GVK cannot be resolved against the live cluster. A manifest may reference a `apiVersion`/`kind` whose CRD is not installed, so the RESTMapper cannot map it to a GVR. This is already a problem today and also blocks the manifest-inventory - work in [docs/design/manifest/manifest-inventory-file-agnostic-placement.md](design/manifest/manifest-inventory-file-agnostic-placement.md): + work in [docs/design/manifest/manifest-inventory-file-agnostic-placement.md](spec/manifest-system.md): indexing must record the manifest identity and defer rather than fail the whole scan. diff --git a/docs/UPGRADING.md b/docs/UPGRADING.md index 9340ac8b..bc980aa5 100644 --- a/docs/UPGRADING.md +++ b/docs/UPGRADING.md @@ -277,7 +277,7 @@ add `--redis-insecure`** — otherwise startup fails on a TLS handshake. ## Unreleased — Git credentials interop (next minor; breaking) Two user-visible breaking changes land together. Both come from -[`design/git-credentials-interop.md`](design/git-credentials-interop.md). +[`design/git-credentials-interop.md`](finished/git-credentials-interop.md). ### 1. `providerRef` no longer advertises a Flux `GitRepository` diff --git a/docs/architecture.md b/docs/architecture.md index f0a5f394..a0376801 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -135,7 +135,7 @@ normal pipeline and is audit-attributed like any other resource. See ### Proving it on new Kubernetes versions How Kubernetes actually emits these structures is not something to guess at. A separate, standalone -project — the **mutation-capture lab** ([design](design/mutation-capture-lab-design.md), +project — the **mutation-capture lab** ([design](spec/mutation-capture-lab-design.md), [cmd/mutation-capture-lab/](../cmd/mutation-capture-lab/)) — records the exact watch, audit, and admission output a real apiserver produces for each interesting scenario and commits it as normalized example YAML (a versioned *corpus*). It doubles as a regression harness: point it at a new Kubernetes release, regenerate, @@ -277,7 +277,7 @@ The controller verifies repository reachability and manages the signing key life ed25519 keypair when `signing.generateWhenMissing` is set. The portable artifact across GitOps ecosystems is the credentials Secret, not a foreign repository object. The credentials reader accepts the Kubernetes native, Flux, and Argo CD Secret key dialects (see -[design/git-credentials-interop.md](design/git-credentials-interop.md)). +[design/git-credentials-interop.md](finished/git-credentials-interop.md)). *** @@ -711,7 +711,7 @@ FIFO. So: a few seconds at most. The full analysis, worked examples, and the future non-blocking option are in -[Watch event ordering under the attribution grace window](design/watch-event-ordering-and-attribution-grace.md). +[Watch event ordering under the attribution grace window](facts/watch-event-ordering-and-attribution-grace.md). *** @@ -736,13 +736,13 @@ keeps only mechanical bookkeeping. **All judgement across scans lives in the typ (`Registry.UpdateFromScan`): a failed group/version keeps serving last known facts instead of looking like an empty API surface, and a group/version that vanishes from a complete scan rides a removal grace rather than being pruned. Both protect against accidental Git deletions on a discovery blink (see -[typeset-owns-discovery-grace.md](design/typeset-owns-discovery-grace.md)). The catalog refreshes on +[typeset-owns-discovery-grace.md](spec/typeset-owns-discovery-grace.md)). The catalog refreshes on startup, periodically, and when CRD/APIService trigger informers fire. ### TypeRegistry and Followability * **Source**: [internal/typeset/](../internal/typeset/) -* **Design**: [design/manifest/version2/type-followability.md](design/manifest/version2/type-followability.md) +* **Design**: [design/manifest/version2/type-followability.md](spec/type-followability.md) `internal/typeset` is the single decision surface for "can this type be followed?" Each `TypeRecord` carries GVK/GVR identity, scope and preferred version facts, origin classification, subresource facts @@ -767,7 +767,7 @@ namespaces. Desired state comes from one **raw watch per `(GitTarget, GVR, scope)`**. Each event is sanitized, diffed against current Git content, and applied — there is no separate per-type object store to reconstruct, because Git already holds current state. The authoritative design is -[design/watch-first-ingestion-architecture.md](design/watch-first-ingestion-architecture.md). +[design/watch-first-ingestion-architecture.md](finished/watch-first-ingestion-architecture.md). * **Manager**: [internal/watch/manager.go](../internal/watch/manager.go) * **Watch / replay / sweep**: [internal/watch/target_watch.go](../internal/watch/target_watch.go) @@ -829,7 +829,7 @@ The acceptance gate is **structure-only on purpose**: it never refuses on a disc followability fact (unwatched / out-of-scope), which can blink on a discovery wobble; only facts that are true from the path's structure alone block a GitTarget. The same gate runs on the live write path, so a refused path is never written into by a racing live event either. See -[unsupported-folder-refusal-plan.md](design/unsupported-folder-refusal-plan.md). +[unsupported-folder-refusal-plan.md](spec/unsupported-folder-refusal-plan.md). A reconcile is **type scoped** (`ScopeGVR`): the sweep is restricted to one `(group, resource)`, so anchoring one type again never disturbs another's manifests. The desired set for the sweep is the @@ -924,7 +924,7 @@ Placement runs **only for a resource with no existing document** in the target. manifest identity, not by path — instead of recomputing placement. So a change to how new files are placed never moves a file already in Git. A new resource is placed by the first of these that applies ([internal/manifestanalyzer/placement.go](../internal/manifestanalyzer/placement.go), -[design](design/manifest/version2/gittarget-new-file-placement-rules.md)): +[design](spec/gittarget-new-file-placement-rules.md)): 1. **Declared policy (`spec.placement`).** A `GitTarget` can declare a `byType` map (exact `[group/]version/resource` → path template) plus a `default` template, rendered from a small @@ -1068,7 +1068,7 @@ Metrics are exported over OTLP / the metrics server. The audit-attribution path * resync/background-apply failure counters so a silently-recovered fault stays visible. Per-watch volume/restart/replay metrics and per-attribution result/wait histograms are designed -([watch-first metrics](design/watch-first-ingestion-architecture.md#metrics)) but **not yet emitted**; see +([watch-first metrics](finished/watch-first-ingestion-architecture.md#metrics)) but **not yet emitted**; see [Operational Boundaries](#operational-boundaries). *** @@ -1129,21 +1129,21 @@ Deeper dives live under [docs/design/](design/): **Ingestion, attribution, and reconcile:** -* [Watch-first ingestion architecture](design/watch-first-ingestion-architecture.md) — the authoritative +* [Watch-first ingestion architecture](finished/watch-first-ingestion-architecture.md) — the authoritative model: watch is the only object-state source, audit is optional attribution. -* [Watch event ordering under the attribution grace window](design/watch-event-ordering-and-attribution-grace.md) -* [Reconcile via watchlist mark and sweep](design/manifest/reconcile-via-watchlist-mark-and-sweep.md) -* [CommitRequest design](design/stream/commitrequest-design.md) +* [Watch event ordering under the attribution grace window](facts/watch-event-ordering-and-attribution-grace.md) +* [Reconcile via watchlist mark and sweep](spec/reconcile-via-watchlist-mark-and-sweep.md) +* [CommitRequest design](spec/commitrequest-design.md) **Types, discovery, status, and the Git write side:** -* [Type followability](design/manifest/version2/type-followability.md) -* [Typeset owns discovery grace](design/typeset-owns-discovery-grace.md) -* [Kubernetes API resource catalog](design/kubernetes-api-resource-catalog.md) -* [GitTarget status design](design/status-design-git-target.md) -* [GitTarget lifecycle and repo architecture](design/gittarget-lifecycle-and-repo-architecture.md) -* [Git credentials interop](design/git-credentials-interop.md) -* [SOPS/age key management](design/sops-repo-bootstrap-and-key-management-architecture.md) +* [Type followability](spec/type-followability.md) +* [Typeset owns discovery grace](spec/typeset-owns-discovery-grace.md) +* [Kubernetes API resource catalog](facts/kubernetes-api-resource-catalog.md) +* [GitTarget status design](spec/status-conditions-guide.md) +* [GitTarget lifecycle and repo architecture](architecture.md) +* [Git credentials interop](finished/git-credentials-interop.md) +* [SOPS/age key management](finished/sops-repo-bootstrap-and-key-management-architecture.md) * [Commit signing](commit-signing.md) * [Interpreting metrics](interpreting-metrics.md) diff --git a/docs/attribution-setup-guide.md b/docs/attribution-setup-guide.md index ecc50d17..42c4e27a 100644 --- a/docs/attribution-setup-guide.md +++ b/docs/attribution-setup-guide.md @@ -20,7 +20,7 @@ which only self-managed control planes expose: - **Not supported:** managed control planes (EKS, GKE, AKS) that hide apiserver configuration. On a managed platform, either front it with a self-managed control plane or stay in configured-author -mode. The [audit webhook connectivity design](design/audit-webhook-api-server-connectivity.md) has +mode. The [audit webhook connectivity design](facts/audit-webhook-api-server-connectivity.md) has the full reasoning on hosting. ## Prerequisites @@ -29,7 +29,7 @@ the full reasoning on hosting. - A control plane whose apiserver flags you can set and reload. - **Redis/Valkey, required.** In configured-author mode it is optional; with attribution on it holds the audit attribution facts (in addition to watch resume cursors), so `queue.redis.addr` must be - non-empty. See [Redis is required for HA](redis-required-for-ha.md) for sizing notes. + non-empty. See Redis is required for HA for sizing notes. ## The two sides of the setup @@ -75,9 +75,9 @@ The chart deliberately does **not** touch your nodes. Working from the rendered **Use `batch` mode. Never start with `blocking` or `blocking-strict`** — those couple normal API request latency to the health of the audit receiver and can reject valid requests when the receiver -is slow. The [connectivity design doc](design/audit-webhook-api-server-connectivity.md#audit-webhook-backend-best-practices) +is slow. The [connectivity design doc](facts/audit-webhook-api-server-connectivity.md#audit-webhook-backend-best-practices) covers the recommended flags and what to tune first; the -[TLS design doc](design/audit-webhook-tls-design.md) covers trusting the receiver certificate versus +[TLS design doc](finished/audit-webhook-tls-design.md) covers trusting the receiver certificate versus the local-only `insecure-skip-tls-verify` shortcut. For a k3s-specific file-placement walkthrough, see [`audit-setup/cluster/readme.md`](audit-setup/cluster/readme.md). @@ -108,7 +108,7 @@ Service are removed; you can then also remove the apiserver audit flags on the n ## Related docs -- [`design/audit-webhook-api-server-connectivity.md`](design/audit-webhook-api-server-connectivity.md): networking, DNS, and TLS tradeoffs for audit delivery -- [`design/audit-webhook-tls-design.md`](design/audit-webhook-tls-design.md): trusting the audit receiver certificate +- [`design/audit-webhook-api-server-connectivity.md`](facts/audit-webhook-api-server-connectivity.md): networking, DNS, and TLS tradeoffs for audit delivery +- [`design/audit-webhook-tls-design.md`](finished/audit-webhook-tls-design.md): trusting the audit receiver certificate - [`configuration.md`](configuration.md): core configuration objects - [`../README.md`](../README.md): product overview and configured-author quick start diff --git a/docs/audit-setup/cluster/readme.md b/docs/audit-setup/cluster/readme.md index 66d2051a..3da289f7 100644 --- a/docs/audit-setup/cluster/readme.md +++ b/docs/audit-setup/cluster/readme.md @@ -32,5 +32,5 @@ sudo k3s kubectl get nodes ``` For the broader connectivity and TLS tradeoffs, use -[`../../design/audit-webhook-api-server-connectivity.md`](../../design/audit-webhook-api-server-connectivity.md) +[`../../design/audit-webhook-api-server-connectivity.md`](../../facts/audit-webhook-api-server-connectivity.md) instead of this short placement note. diff --git a/docs/bi-directional.md b/docs/bi-directional.md index cda14cc4..f03ade75 100644 --- a/docs/bi-directional.md +++ b/docs/bi-directional.md @@ -246,6 +246,6 @@ with `task argocd-ui`): Design detail: -- [`design/e2e-bi-directional-corner.md`](design/e2e-bi-directional-corner.md) — the corner +- [`design/e2e-bi-directional-corner.md`](spec/e2e-bi-directional-corner.md) — the corner - [`design/gitops-api/argocd-bi-directional.md`](design/gitops-api/argocd-bi-directional.md) — why `selfHeal` is opposed to bi-directional -- [`design/gittarget-lifecycle-and-repo-architecture.md`](design/gittarget-lifecycle-and-repo-architecture.md) — controller and repo lifecycle +- [`design/gittarget-lifecycle-and-repo-architecture.md`](architecture.md) — controller and repo lifecycle diff --git a/docs/ci/findings.md b/docs/ci/findings.md index 93d57133..01250bb0 100644 --- a/docs/ci/findings.md +++ b/docs/ci/findings.md @@ -2,7 +2,7 @@ Last updated: 2026-06-02 -Recent investigation: [E2E full-suite shared-state flake](../design/e2e-full-suite-shared-state-investigation.md) +Recent investigation: [E2E full-suite shared-state flake](../spec/e2e-serial-registry.md) This folder documents why the repository uses its current devcontainer and CI behavior, especially around Go caches, workspace paths, and k3d cluster access from inside the container. diff --git a/docs/configuration.md b/docs/configuration.md index 0f268b6f..85d7106c 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -428,8 +428,8 @@ The boundaries that keep it predictable: want all ConfigMaps bundled even though none exist yet" is a job for `byType` below. The full ladder, tie-break rules, and edge cases are in -[design/manifest/version2/gittarget-new-file-placement-rules.md](design/manifest/version2/gittarget-new-file-placement-rules.md); -the vision behind it is [design/manifest/file-agnostic-placement.md](design/manifest/file-agnostic-placement.md). +[design/manifest/version2/gittarget-new-file-placement-rules.md](spec/gittarget-new-file-placement-rules.md); +the vision behind it is [design/manifest/file-agnostic-placement.md](spec/gittarget-new-file-placement-rules.md). #### Declaring a layout (`byType` / `default`) diff --git a/docs/design/e2e-aggregated-apiserver-proxy-hookup-plan.md b/docs/design/e2e-aggregated-apiserver-proxy-hookup-plan.md deleted file mode 100644 index b51e55be..00000000 --- a/docs/design/e2e-aggregated-apiserver-proxy-hookup-plan.md +++ /dev/null @@ -1,512 +0,0 @@ -# E2E Aggregated API Proxy Hookup Plan - -This document records the plan for integrating `apiservice-audit-proxy` into the main project's -e2e environment so aggregated API mutations can produce rich audit-backed commits. - -This document is intentionally written to be **self-contained**. It should be enough to hand to an -implementation agent later without needing the rest of the conversation. - -## Related Docs - -- [E2E Test Design: Aggregated API Server](e2e-aggregated-apiserver-test-design.md) -- [Kubernetes API Discovery and Watching in GitOps Reverser](kubernetes-api-discovery.md) -- [Audit Webhook API Server Connectivity](audit-webhook-api-server-connectivity.md) - -This document is about **environment wiring and bootstrap**. The test-design document covers what -the e2e suite must prove once the environment exists. - -## Repository Context - -The main repo already has: - -- Flux bootstrap manifests under `test/e2e/setup/flux/` -- e2e orchestration in `test/e2e/Taskfile.yml` -- aggregated API e2e coverage in `test/e2e/aggregated_apiserver_e2e_test.go` -- gitops-reverser audit webhook kubeconfig generation logic in `hack/` - -The full source of the upstream helper project is available locally in: - -- `external-sources/apiservice-audit-proxy/` - -That local clone includes: - -- Go source -- Helm chart -- docs -- e2e setup examples - -So the implementation should treat `external-sources/apiservice-audit-proxy/` as the local source -reference when checking how the project works, even though the actual cluster bootstrap should use -the packaged OCI chart. - -## Design Bias - -Bias hard toward the **simplest reusable approach**. - -That means: - -- reuse the upstream Helm chart instead of copying its resources into this repo -- reuse upstream chart features instead of adding gitops-reverser-specific manifests when possible -- prefer small upstream changes if they make the integration cleaner -- avoid maintaining a second parallel demo stack in gitops-reverser - -If something is awkward in the chart and would force a lot of local glue code here, it is -acceptable to change the upstream `apiservice-audit-proxy` project instead. It is a new project and -is intended for `gitops-reverser`. - -## Simple Plan - -The intended implementation path is: - -1. install `apiservice-audit-proxy` via Flux from the packaged OCI chart -2. enable the sample-apiserver backend through that chart -3. make the HelmRelease non-blocking during bootstrap so a not-yet-present webhook Secret does not - deadlock Flux -4. let the proxy reference the final webhook Secret from the start, even before that Secret exists -5. create the final webhook Secret later from gitops-reverser e2e wiring -6. wait for the proxy, backend, `APIService`, and discovery checks to become healthy - -If that path feels complicated in practice, prefer simplifying the upstream chart rather than -adding more local special-case logic here. - -## Naming Decision - -Use `aggregated-api` as the repo-facing name for this feature. - -That means: - -- docs, task names, readiness gates, and values files should prefer `aggregated-api` -- Flux resources that we own should prefer `aggregated-api` -- user-facing language in the repo should prefer "aggregated API" over "Wardle" - -Keep `wardle` only where it is part of the upstream sample-apiserver surface: - -- API group `wardle.example.com` -- kinds such as `Flunder` and `Fischer` -- any upstream chart or manifest field that must still point at those concrete API identifiers - -Recommended practical split: - -- **feature name**: `aggregated-api` -- **example API served inside the test**: `wardle.example.com` - -If we rename the Kubernetes namespace from `wardle` to `aggregated-api`, do it intentionally and -consistently in the Flux values override. The API group itself still remains `wardle.example.com`. - -## Goal - -Make the aggregated API stack part of cluster bootstrap so it is installed via Flux and ready for -the e2e suite without a separate late `kubectl apply -k` path. - -Target request path: - -`kube-apiserver -> apiservice-audit-proxy -> sample-apiserver` - -Target audit path: - -`apiservice-audit-proxy -> gitops-reverser audit webhook` - -## Preferred Outcome - -After `task prepare-e2e`, the environment should feel simple: - -- Flux has already installed the aggregated API stack -- the proxy is the `APIService` backend -- the sample-apiserver backend is already present through the chart -- the only extra gitops-reverser-specific step is creating the final webhook kubeconfig Secret -- once that Secret exists, the aggregated API becomes ready and the existing e2e tests can run - -This should feel like "one normal bootstrap service" rather than a special snowflake path. - -## Non-Goals - -- Do not solve duplicate suppression in this pass. -- Do not solve production-grade delegated-header trust in this pass. -- Do not redesign the whole shared e2e bootstrap model. -- Do not replace the Wardle sample API with a custom aggregated API. - -## Recommended Architecture - -### 1. Flux owns the aggregated API stack - -Add the aggregated API stack to `test/e2e/setup/flux/` as a first-class bootstrap service, just -like cert-manager, Gitea, Valkey, ingress, and reflector. - -Flux should install: - -- the `apiservice-audit-proxy` chart -- the sample-apiserver backend enabled through that chart -- the `APIService` registration -- the proxy serving cert machinery -- the backend client cert machinery - -This removes the need for the hand-maintained proxy/sample-apiserver manifest bundle under -`test/e2e/setup/manifests/sample-apiserver/`. - -The HelmRelease should explicitly depend on cert-manager because the chart relies on certificate -resources as part of the proxy/backend setup. - -### 2. GitOps Reverser still owns the final audit webhook Secret contents - -The proxy's outbound webhook kubeconfig still depends on the gitops-reverser audit receiver wiring, -which is produced after the controller install and post-install TLS bootstrap. - -So the ownership split should be: - -- **Flux/bootstrap ownership**: install the aggregated API stack and reference the expected Secret - name from the beginning -- **gitops-reverser e2e ownership**: generate and create the final - `audit-pass-through-webhook-kubeconfig` Secret after `_webhook-tls-ready` - -### 3. Rely on the normal Kubernetes "missing Secret" behavior - -The proxy Deployment can safely reference a Secret that does not exist yet. - -That means: - -- we do **not** need to delay creating the HelmRelease until the Secret exists -- we do **not** need a bootstrap-time placeholder Secret just to make the chart render -- we can let the proxy pod wait for the Secret to appear - -Practical consequence: - -- the aggregated API HelmRelease can be present from cluster bootstrap -- the proxy workload may remain unavailable until the webhook Secret is created later -- once the Secret exists, the pod can proceed without re-rendering the chart - -This is simpler than treating the Secret as a separate install phase. - -Important Flux-specific consequence: - -- the aggregated API HelmRelease must not block cluster bootstrap while the webhook Secret is still - intentionally missing - -Preferred approach: - -- set `spec.install.disableWait: true` -- set `spec.upgrade.disableWait: true` - -Fallback approach if that is not enough: - -- make `_flux-setup-ready` gate on "HelmRelease observed / reconciling" rather than "HelmRelease - Ready" - -## Source of Truth Decision - -Use the `apiservice-audit-proxy` Helm chart as the source of truth for the proxy/backend demo -stack. - -That means: - -- do **not** keep evolving a parallel hand-written copy of the same resources in - `test/e2e/setup/manifests/sample-apiserver/` -- do keep the local clone in `external-sources/apiservice-audit-proxy/` as the reviewable source - tree that explains what the chart and image are - -Use the packaged OCI chart for the actual e2e bootstrap: - -- chart: `oci://ghcr.io/configbutler/charts/apiservice-audit-proxy` -- install example: `helm install apiservice-audit-proxy oci://ghcr.io/configbutler/charts/apiservice-audit-proxy --version 0.3.0` -- first pinned version: `0.3.0` -- image: use the chart default that comes with `0.3.0`; do not add a separate image pin unless a - real mismatch forces it - -Use the local source tree for inspection and, if needed, upstream fixes: - -- `external-sources/apiservice-audit-proxy/` - -The local clone remains useful for: - -- code review -- documentation references -- syncing chart expectations with the main repo - -## Naming and Namespace Recommendation - -Prefer `aggregated-api` for the namespace and Flux release names that this repo owns. - -Recommended shape: - -- namespace: `aggregated-api` -- Flux source name: `apiservice-audit-proxy` -- Flux release name: `aggregated-api` -- task/readiness stamp names: `_aggregated-api-ready`, `aggregated-api.ready` - -Keep the backend API identity unchanged: - -- `APIService`: `v1alpha1.wardle.example.com` -- resources: `flunders`, `fischers` - -Reasoning: - -- `aggregated-api` is clearer in our repo than `wardle` -- `wardle` is still correct for the actual sample-apiserver API group -- this keeps the example API stable while making our bootstrap plumbing easier to understand - -## Simplest Integration Shape - -Add new Flux resources under `test/e2e/setup/flux/`: - -1. namespace for the aggregated API stack -2. OCIRepository for the chart source -3. ConfigMap for e2e-specific values -4. HelmRelease that installs the chart with: - - `apiService.enabled=true` - - `testApiserver.enabled=true` - - `webhookTester.enabled=false` - - `webhook.kubeconfigSecretName=audit-pass-through-webhook-kubeconfig` - - chart-generated ownership of `audit-pass-through-webhook-kubeconfig` disabled or absent - - `dependsOn` pointing at cert-manager - - `install.disableWait=true` - - `upgrade.disableWait=true` - -The values file should live next to the other Flux values files, for example: - -`test/e2e/setup/flux/values/aggregated-api-values.yaml` - -Reviewer note: - -- this will likely be the first `OCIRepository` under `test/e2e/setup/flux/` - -Prefer this over: - -- building a custom local image for the first pass -- rendering chart manifests into this repo and owning them here -- keeping the old `test/e2e/setup/manifests/sample-apiserver/` path active - -## What To Reuse From Upstream - -The implementation should try to reuse these upstream chart capabilities directly: - -- `apiService.enabled=true` -- `testApiserver.enabled=true` -- `webhook.kubeconfigSecretName` -- backend client certificate wiring -- proxy serving certificate wiring -- the chart's own resource naming and mounting conventions - -If any of those are close but not quite right for gitops-reverser e2e, prefer a small upstream -change over adding a custom local workaround here. - -One thing to verify explicitly: - -- the chart must **not** create `audit-pass-through-webhook-kubeconfig` -- that Secret must be owned only by gitops-reverser e2e wiring - -Disabling `webhookTester.enabled` is part of this, but the implementation should still confirm -there is no other chart path that auto-creates or takes ownership of that Secret. - -## Acceptable Upstream Adjustments - -If the integration is cleaner with upstream changes, those changes are welcome. - -Examples of good upstream adjustments: - -- making Secret names easier to pin from values -- making namespace/service naming clearer -- reducing values required for the proxy + sample-apiserver demo stack -- improving chart behavior when the webhook Secret does not exist yet -- simplifying the values needed for a GitOps Reverser-focused install - -Examples of poor local-only workarounds to avoid if upstream can be fixed instead: - -- carrying a large forked manifest set in this repo -- patching many rendered resources after install -- maintaining duplicate TLS/cert wiring here that already exists in the chart -- inventing a second bootstrap path just for aggregated APIs - -## Readiness Model - -The current bootstrap has two readiness layers: - -- `_flux-setup-ready` for Flux-managed shared services -- later task-specific readiness for components that need extra post-install work - -The aggregated API stack should follow the same pattern. - -### Phase A: Flux bootstrap ready enough - -`_flux-setup-ready` should confirm that Flux has created the aggregated API release objects, but it -should **not** require the proxy Deployment to be Available yet. - -Reason: - -- the proxy pod is allowed to wait on the missing webhook Secret -- requiring full readiness here would deadlock bootstrap on a Secret that is intentionally created - later by gitops-reverser e2e logic -- default Flux wait behavior is not compatible with this plan unless explicitly disabled for this - HelmRelease - -### Phase B: aggregated API fully ready - -Create a dedicated `_aggregated-api-ready` gate that runs after: - -- the gitops-reverser controller is installed -- `_webhook-tls-ready` has generated the final audit receiver kubeconfig material - -That gate should: - -1. create/update `audit-pass-through-webhook-kubeconfig` in the aggregated API namespace -2. wait for the proxy Deployment to become Available -3. wait for the sample-apiserver backend to become Available -4. wait for `apiservice/v1alpha1.wardle.example.com` to become `Available` -5. confirm discovery shows `flunders` - -This is the point where the aggregated API path becomes truly usable for e2e. - -Keep the gap between Secret creation and full readiness as short as possible so the cluster does -not spend long with an unhealthy registered `APIService`. - -## Minimal Local Ownership - -The gitops-reverser repo should only need to own: - -- Flux resources that install the chart -- one e2e values file for the chart -- one readiness gate that creates the final webhook kubeconfig Secret and waits for health -- documentation and test wiring - -Everything else should ideally stay in or come from `apiservice-audit-proxy`. - -## Concrete Implementation Plan - -### Phase 1: Move bootstrap ownership into Flux - -1. Add a namespace manifest for the aggregated API stack under `test/e2e/setup/flux/namespaces/`. -2. Add an `OCIRepository` source for the packaged chart. -3. Add `test/e2e/setup/flux/values/aggregated-api-values.yaml`. -4. Add a HelmRelease for `apiservice-audit-proxy` to `test/e2e/setup/flux/releases/` with: - - `dependsOn` on cert-manager - - `install.disableWait=true` - - `upgrade.disableWait=true` -5. Include those resources from `test/e2e/setup/flux/kustomization.yaml`. -6. Before committing the HelmRelease, sanity-check the namespace-dependent rendering with - `helm template` against the override values so that choosing `aggregated-api` does not leave - stray hard-coded `wardle` namespace references in service URLs, Secret names, or mounts. - -### Phase 2: Remove the duplicate manifest path - -1. Stop treating `test/e2e/setup/manifests/sample-apiserver/` as the active source of truth. -2. Delete `test/e2e/setup/manifests/sample-apiserver/` once the Flux path has been green for one - full `prepare-e2e` run. -3. Update docs that still describe the old `kubectl apply -k test/e2e/setup/manifests` ownership - model for this stack. - -### Phase 3: Update task and readiness naming - -1. Rename task/readiness language from `sample-apiserver-ready` to `aggregated-api-ready`. -2. Keep concrete checks against: - - `deployment/` - - `deployment/` - - `apiservice/v1alpha1.wardle.example.com` - - `kubectl api-resources --api-group=wardle.example.com` -3. Grep the whole tree for feature-name uses such as `sample-apiserver-ready` and convert them - together across `test/e2e/Taskfile.yml`, `hack/`, docs, and CI-related files. -4. Leave `wardle` intact only where it refers to the actual upstream API group or example kinds. - -### Phase 4: Fix source and image references - -1. Replace stale `external-prototype/audit-pass-through-apiserver` references with - `external-sources/apiservice-audit-proxy` where local source references still matter. -2. If local image loading remains part of any fast-dev path, rename the default image reference to - `apiservice-audit-proxy:e2e-local`. -3. Remove doc references to the deleted prototype path. - -## Concrete Files Likely To Change - -In gitops-reverser: - -- `test/e2e/setup/flux/kustomization.yaml` -- `test/e2e/setup/flux/namespaces/*.yaml` -- `test/e2e/setup/flux/releases/*.yaml` -- `test/e2e/setup/flux/values/aggregated-api-values.yaml` -- `test/e2e/Taskfile.yml` -- `hack/e2e/prepare-sample-apiserver-proxy-webhook-kubeconfig.sh` or a renamed equivalent -- docs that still mention the old prototype path or old manifest ownership - -In the local upstream source, if needed: - -- `external-sources/apiservice-audit-proxy/charts/apiservice-audit-proxy/values.yaml` -- `external-sources/apiservice-audit-proxy/charts/apiservice-audit-proxy/values-demo.yaml` -- `external-sources/apiservice-audit-proxy/charts/apiservice-audit-proxy/templates/*` -- other files under `external-sources/apiservice-audit-proxy/` as needed - -## Implementation Rules - -When implementing from this document, follow these rules: - -1. Start by checking whether the upstream chart already supports the needed behavior. -2. Prefer changing upstream over adding large local glue in gitops-reverser. -3. Keep the gitops-reverser side focused on Flux install + final Secret creation + readiness. -4. Keep naming consistent: `aggregated-api` for our feature plumbing, `wardle` for the concrete - sample API group. -5. Do not keep both the old manifest path and the new Flux path active longer than necessary. - -## Verification Scope - -The acceptance checks should stay aligned with -[e2e-aggregated-apiserver-test-design.md](e2e-aggregated-apiserver-test-design.md): - -- aggregated resources are discoverable -- WatchRules can target them -- a `Flunder` create produces a Git commit -- the proxy recovers `objectRef.name`, `requestObject`, and `responseObject` - -Do **not** make the hookup plan depend on proving every aggregated API edge case before merge. -The load-bearing proof is that the Flux-bootstrapped environment supports the existing aggregated -API e2e scenarios. - -## Done Criteria - -This plan is complete when all of the following are true: - -1. The aggregated API stack is installed by Flux during normal e2e bootstrap. -2. The bootstrap uses the packaged OCI chart, not a large copied manifest set. -3. The source of the project remains locally available in - `external-sources/apiservice-audit-proxy/`. -4. The proxy can reference the final webhook Secret before it exists. -5. A later readiness step creates that Secret and waits for the stack to become healthy. -6. The old duplicate manifest-managed stack is deleted. -7. The existing aggregated API e2e tests pass against this environment. - -## Main Risks - -- Flux bootstrap can deadlock if we accidentally require the aggregated API release to become fully - healthy before the later webhook Secret exists. -- If `APIService v1alpha1.wardle.example.com` exists while the proxy pod is still blocked on the - missing Secret, cluster-wide discovery can log errors and unrelated e2e behavior may become - noisy or flaky during that window. -- Naming drift can make the stack harder to reason about if some parts still use `wardle` as the - feature name while others use `aggregated-api`. -- Keeping both the Flux-managed chart and the old hand-written manifest stack alive for too long - invites divergence. -- A values file that quietly bakes in the old `wardle` namespace can make the move to - `aggregated-api` confusing unless all URLs, Secret names, and service names are updated together. - -## Recommended First Cut - -The fastest credible first cut is: - -1. add the aggregated API HelmRelease to Flux bootstrap -2. give it the final webhook Secret name up front, even before that Secret exists -3. create the webhook Secret later in `_aggregated-api-ready` -4. wait for the proxy/backend/APIService/discovery checks after the Secret appears -5. delete the duplicate manifest-managed stack once the Flux path is green - -That gets us to the desired end state quickly without inventing a second bootstrap mechanism just -for this component. - -## Summary For A Future Implementation Agent - -If you are starting implementation with only this document: - -- use Flux to install `apiservice-audit-proxy` from `oci://ghcr.io/configbutler/charts/apiservice-audit-proxy` - pinned to `0.3.0` -- prefer the chart as the source of truth -- inspect local source in `external-sources/apiservice-audit-proxy/` before inventing local - workarounds -- keep `aggregated-api` as the feature name and `wardle.example.com` as the actual sample API group -- let the proxy reference the final webhook Secret from bootstrap time -- create that Secret later from gitops-reverser e2e wiring -- make the environment simple enough that the aggregated API test feels like a normal e2e service, - not a one-off special case diff --git a/docs/design/e2e-coverage-gaps-and-improvements-plan.md b/docs/design/e2e-coverage-gaps-and-improvements-plan.md index ca9409cc..e609e629 100644 --- a/docs/design/e2e-coverage-gaps-and-improvements-plan.md +++ b/docs/design/e2e-coverage-gaps-and-improvements-plan.md @@ -233,7 +233,7 @@ creates the GitTarget + a ConfigMap WatchRule, and asserts: - the kstatus surface reports a human-fixable block: `Ready=False`, `Reconciling=False`, `Stalled=True`, and - the operator **commits nothing** on top of the seed — the remote tip is unchanged. -The implementation design is in [unsupported-folder-refusal-plan.md](unsupported-folder-refusal-plan.md); +The implementation design is in [unsupported-folder-refusal-plan.md](../spec/unsupported-folder-refusal-plan.md); the structure-only refusals (duplicate identity, impure managed file, standalone non-KRM/invalid YAML, mixed managed+allowlisted) are unit-proven in `internal/manifestanalyzer/acceptance_test.go`, so the e2e focuses on the headline hard-Kustomize case and the status surface. @@ -250,12 +250,12 @@ These came out of the investigation and are genuine forks — capturing them her managed file, standalone non-KRM / invalid YAML, mixed managed+allowlisted), wire the gate into the write path, surface it on GitTarget status, and stop committing until the folder is cleaned. Test D then proves it. The implementation design lives in - [unsupported-folder-refusal-plan.md](unsupported-folder-refusal-plan.md). + [unsupported-folder-refusal-plan.md](../spec/unsupported-folder-refusal-plan.md). - ~~(b) Keep current behavior and document it.~~ Rejected. - ~~(c) Defer.~~ Rejected. 2. **If we implement refusal — what's the signal?** A new `Synced` reason (e.g. `UnsupportedContent`) vs. a dedicated condition vs. a `failingTypes`-style count + event. Needs to fit the two-axis status - design in [status-design-git-target.md](status-design-git-target.md). + design in [status-design-git-target.md](../spec/status-conditions-guide.md). 3. **If we implement refusal — is it whole-GitTarget or scoped?** Refuse the entire GitTarget subtree, or only the offending `(group, resource)` while other types keep syncing? The resync is already type-scoped (`ScopeGVR`), so per-type refusal may be the more consistent shape. @@ -266,7 +266,7 @@ These came out of the investigation and are genuine forks — capturing them her contract, or a limitation to revisit? The answer decides whether Test C asserts "dropped" or "preserved." 6. **Coverage vs. e2e wall-clock.** The suite is already large and the team has active e2e-speedup work - ([e2e-speedup-plan.md](e2e-speedup-plan.md)). Tests A and B each need a controller restart/scale + ([e2e-speedup-plan.md](../finished/e2e-speedup-plan.md)). Tests A and B each need a controller restart/scale cycle (slow). Can they fold into the existing `restart-reconcile` `Serial` ordering to share one restart, rather than each paying its own? @@ -305,4 +305,4 @@ These came out of the investigation and are genuine forks — capturing them her - Test D, if pursued via §4.1(a), is the first consumer of the acceptance gate ([acceptance.go](../../internal/manifestanalyzer/acceptance.go)) inside the running controller, and would extend the GitTarget status design in - [status-design-git-target.md](status-design-git-target.md). + [status-design-git-target.md](../spec/status-conditions-guide.md). diff --git a/docs/design/e2e-full-suite-shared-state-investigation.md b/docs/design/e2e-full-suite-shared-state-investigation.md deleted file mode 100644 index 724d1db3..00000000 --- a/docs/design/e2e-full-suite-shared-state-investigation.md +++ /dev/null @@ -1,445 +0,0 @@ -# E2E Full Suite Shared-State Investigation - -## Purpose - -This note captures an investigation into an intermittent `task test-e2e` failure that appeared -after commit `9c7e0bc3c455f99242480e0577ab2776fae16d60` and was observed concretely in CI for image -`ghcr.io/configbutler/gitops-reverser:ci-621200eefaf185dfe1000526b1e0f53dc3a8d93f`. - -The goal of this document is not to claim a final fix. The goal is to preserve the best current -explanation, the strongest evidence, and the exact breadcrumbs that should make the next -investigation much faster if the instability returns. - -## Status - -### 2026-04-17 - -Current status: - -- the CI is green again -- the failure was observed during `task test-e2e` -- targeted local runs of `test-e2e-manager` and `test-e2e-audit-redis` were green when run in isolation -- the strongest remaining explanation is a full-suite shared-state interaction, not a simple single-test regression -- a later repro on then-current `main` showed the same class of failure with a narrower stale path: - - expected: - - `e2e/configmap-test/v1/configmaps//test-configmap.yaml` - - actual: - - `e2e/secret-autogen-test/v1/configmaps//test-configmap.yaml` -- that later repro strengthened the hypothesis that earlier secret-manager specs were still eligible to react - to later ConfigMap events -- a mitigation was then tried locally: - - the manager secret specs were changed to use a secret-only WatchRule template instead of the broader - `watchrule.tmpl` - - after that change, `task test-e2e` passed locally, including the manager spec - `should create Git commit when ConfigMap is added via WatchRule` -- this is encouraging, but it is still not proof that the broader full-suite instability is permanently fixed - -Confidence level: - -- high confidence in the symptom -- medium confidence in the root cause -- low confidence that the issue is permanently gone just because CI is green now - -## Short Version - -The failure does match a shared-state hypothesis, but with an important refinement: - -- the most likely leak is not `tilt-playground` directly -- the stronger signal is stale manager-suite rules and targets from earlier specs in the same ordered container -- those stale rules appear to keep writing to the same Git repo when a later spec expects only its own `GitTarget` path to be touched - -The clearest evidence is this mismatch from CI: - -- expected latest touched path: - - `e2e/configmap-test/v1/configmaps//test-configmap.yaml` -- actual latest touched path: - - `e2e/v1/configmaps//test-configmap.yaml` - -That `e2e/` path corresponds to an earlier manager test target, not the current `configmap-test` target. - -Later, the same failure pattern reappeared with an even more specific stale path: - -- expected latest touched path: - - `e2e/configmap-test/v1/configmaps//test-configmap.yaml` -- actual latest touched path: - - `e2e/secret-autogen-test/v1/configmaps//test-configmap.yaml` - -That later variant matters because it points directly at the earlier secret auto-generation manager spec, -which at the time was still using the broad `watchrule.tmpl` fixture that included `configmaps` as well -as `secrets`. - -## Triggering Commit - -The investigation started from: - -- `9c7e0bc3c455f99242480e0577ab2776fae16d60` -- commit subject: - - `fix: WatchRule leaking resources from other namespaces in live event stream` - -That commit changed three relevant areas: - -1. `RuleStore.GetMatchingRules()` became namespace-aware for namespaced `WatchRule`s -2. the audit consumer began passing namespace context into the matcher -3. watch-manager startup began bootstrapping the in-memory `RuleStore` from existing rules before initial reconcile - -Relevant files: - -- [internal/rulestore/store.go](/workspaces/gitops-reverser/internal/rulestore/store.go) -- [internal/queue/redis_audit_consumer.go](/workspaces/gitops-reverser/internal/queue/redis_audit_consumer.go) -- [internal/watch/bootstrap.go](/workspaces/gitops-reverser/internal/watch/bootstrap.go) -- [internal/watch/manager.go](/workspaces/gitops-reverser/internal/watch/manager.go) - -## Concrete CI Failure - -The observed failure in CI happened in: - -- image / SHA context: - - `621200eefaf185dfe1000526b1e0f53dc3a8d93f` -- failing spec: - - `Manager Manager should create Git commit when ConfigMap is added via WatchRule` - -The test timed out while waiting for the latest commit to match the expected touched path set. - -Expected: - -```text -e2e/configmap-test/v1/configmaps/1776422075-test-manager/test-configmap.yaml -``` - -Actual: - -```text -e2e/v1/configmaps/1776422075-test-manager/test-configmap.yaml -``` - -This is the single most important observation from the failure. - -## Why The Path Mismatch Matters - -The current spec under test creates a `GitTarget` with path: - -- `e2e/configmap-test` - -So if the system were behaving correctly, the resulting commit should have touched only: - -- `e2e/configmap-test/v1/configmaps//.yaml` - -Instead, the latest commit touched: - -- `e2e/v1/configmaps//.yaml` - -That shorter path is associated with an earlier manager spec that uses a `GitTarget` path of: - -- `e2e` - -That means the commit that "won the race" at the end of the assertion window was produced by a -different target than the one created by the current spec. - -## Strong Evidence From Controller Logs - -The controller logs from the same CI run show that immediately before and during the failing -ConfigMap test, the controller was still performing unrelated writes in the same repository: - -- deleting: - - `e2e/v1/secrets/.../test-secret-autogen.sops.yaml` - - `e2e/v1/secrets/.../sops-age-key-autogen.sops.yaml` - - `e2e/secret-encryption-test/.../sops-age-key-autogen.sops.yaml` - - `e2e/secret-autogen-test/.../sops-age-key-autogen.sops.yaml` -- then creating the ConfigMap -- then creating that same ConfigMap multiple times via repeated per-event writes - -This matters because the failing spec expects a clean repo outcome for one target path, but the log -shows active writes from several other previously created paths in the same branch and repository. - -The logs strongly suggest: - -- earlier specs had not become fully irrelevant by the time this later spec ran -- multiple `GitTarget`s and/or `WatchRule`s were still producing writes to the same branch -- the final latest commit was allowed to come from the wrong target path - -## Refined Hypothesis - -The refined working hypothesis is: - -1. earlier manager specs create additional `WatchRule` and `GitTarget` pairs targeting the same repo and branch -2. some of those rules remain active long enough to overlap with later specs -3. after `9c7e0bc`, startup/bootstrap/reconcile behavior made that overlap easier to observe -4. when the later ConfigMap test creates one object, more than one target path can still react -5. the e2e assertion checks the latest commit only, so if a stale target writes after the intended target, the spec fails - -This is a stronger explanation than "the new path assertion was wrong" because the logs show the -system really was making unrelated writes in the same repo during the assertion window. - -## What Seems Less Likely Now - -The first-pass theory was that `tilt-playground` was the primary cause because it only appears in -the full suite and not in the isolated manager run. - -That is still possible as background pressure, but it is no longer the strongest explanation. - -Why it got downgraded: - -- the concrete path mismatch points directly at another manager spec's `GitTarget` path, not the playground path -- the observed writes in the controller logs are to manager-test paths, not to `tilt-playground` paths -- the failure reads like cross-spec interference inside the ordered manager container more than global cluster pollution from the playground - -Refined stance: - -- `tilt-playground` may still contribute to "full-suite-only" conditions -- but the highest-value place to inspect is manager-spec lifecycle and target/rule cleanup behavior - -## Likely Mechanisms - -The following mechanisms could all produce the observed symptom. - -### 1. Rule lifetime overlaps between ordered specs - -Earlier manager specs create: - -- `GitProvider` -- `GitTarget` -- `WatchRule` - -Those are later cleaned up, but there may be a window where: - -- the next spec has already started -- the old rule is still present, still compiled, or still in a live event path - -This would explain why a later ConfigMap causes writes under an older target path. - -### 2. In-memory `RuleStore` / reconcile state lags deletion - -`9c7e0bc` introduced `bootstrapRuleStore()` at startup and relies on reconcile behavior in: - -- [internal/watch/bootstrap.go](/workspaces/gitops-reverser/internal/watch/bootstrap.go) -- [internal/watch/manager.go](/workspaces/gitops-reverser/internal/watch/manager.go) - -Even if the API objects are deleted correctly, there may be a timing window where: - -- the old compiled rule is still present -- the watch manager still treats it as active -- or a flush/reconcile cycle emits work for an already-stale target - -### 3. One repo, one branch, many paths, one latest-commit assertion - -The tests deliberately reuse: - -- the same repository -- the same branch - -across multiple manager specs. - -That is reasonable, but it means a spec that asserts "the latest commit touched only X" is fragile if -other legitimate or stale writers can still commit to the same branch. - -This does not prove the assertion is wrong. It proves the assertion is sensitive to any overlap. - -### 4. Snapshot/reconcile writes and live writes interleave - -The logs include both: - -- per-event commits -- atomic reconcile commits - -If a target transitions through reconcile or buffered-event flush at the same time another test is -waiting on a live-event commit, the latest commit may belong to the wrong mechanism or the wrong target. - -## Why Isolated Runs Were Green - -During investigation: - -- `task test-e2e-manager` passed when run in isolation -- `task test-e2e-audit-redis` passed when run in isolation - -This is consistent with a shared-state explanation because isolated runs remove: - -- earlier manager spec buildup from the full suite -- later spec interference -- branch noise from unrelated targets in the same repo - -So "isolated green, full-suite flaky" is not contradictory here. It supports the idea that the -system is sensitive to test ordering and lifecycle overlap. - -## Things The CI Log Proves - -The CI log proves all of the following: - -1. the ConfigMap event was seen -2. the controller did write ConfigMap commits -3. the repo was not idle during the assertion window -4. the latest commit path was not the one owned by the current spec -5. the failure was not "nothing happened"; it was "the wrong thing won the race" - -That last point is especially important. - -This was not a dead system. -This was an over-active or cross-wired system. - -## Things The Investigation Did Not Prove - -The investigation did not fully prove: - -- the exact deletion or reconciliation code path that preserved the stale rule -- whether the stale writer came from API object lifetime, in-memory cache lifetime, or buffered event lifetime -- whether the same issue also explains the concurrent signing-suite failure - -The signing failure may be related because it also reasons about latest commits on a shared branch, -but this document keeps the manager-path failure as the primary anchor because the path mismatch there -is unusually direct and easy to interpret. - -## Best Current Root-Cause Statement - -Best current statement: - -> A full-suite shared-state interaction allowed a stale or overlapping manager test target to keep -> writing to the same repository branch after a later manager spec had started. The later spec then -> failed because its "latest commit touches only my expected path" assertion observed a commit from -> the older target path (`e2e/...`) instead of the current target path (`e2e/configmap-test/...`). - -This statement is intentionally a little cautious. It matches the evidence well without pretending -to have proven the last missing internal transition. - -## What Was Tried After This Note - -After the later repro on `main`, one concrete mitigation was tried in the manager e2e suite: - -- add a secret-only WatchRule template for the secret-manager specs -- stop using the broad `test/e2e/templates/watchrule.tmpl` for: - - `should commit encrypted Secret manifests when WatchRule includes secrets` - - `should generate missing SOPS age secret when age.recipients.generateWhenMissing is enabled` - -Why that change was chosen: - -- `watchrule.tmpl` matches both `configmaps` and `secrets` -- that meant an earlier secret-oriented manager spec could still legally react to a later ConfigMap - event if cleanup lagged -- the later failure path - `e2e/secret-autogen-test/v1/configmaps//test-configmap.yaml` - is exactly what that overlap would produce - -Observed result of the mitigation: - -- local validation passed with: - - `task fmt` - - `task generate` - - `task manifests` - - `task vet` - - `task lint` - - `task test` - - `task test-e2e` -- the manager spec - `should create Git commit when ConfigMap is added via WatchRule` - passed after the change - -Current interpretation: - -- this mitigation is a strong fit for the newer `secret-autogen-test` variant -- it reduces one clear source of cross-spec overlap in the manager suite -- it should be treated as a tested mitigation, not yet a fully proven final root-cause closure for every - possible `task test-e2e` flake - -## Files Most Worth Re-Inspecting If It Returns - -Primary files: - -- [internal/watch/manager.go](/workspaces/gitops-reverser/internal/watch/manager.go) -- [internal/watch/bootstrap.go](/workspaces/gitops-reverser/internal/watch/bootstrap.go) -- [internal/controller/watchrule_controller.go](/workspaces/gitops-reverser/internal/controller/watchrule_controller.go) -- [internal/controller/gittarget_controller.go](/workspaces/gitops-reverser/internal/controller/gittarget_controller.go) -- [internal/reconcile/git_target_event_stream.go](/workspaces/gitops-reverser/internal/reconcile/git_target_event_stream.go) -- [internal/git/branch_worker.go](/workspaces/gitops-reverser/internal/git/branch_worker.go) -- [test/e2e/e2e_test.go](/workspaces/gitops-reverser/test/e2e/e2e_test.go) -- [test/e2e/repo_assertions_test.go](/workspaces/gitops-reverser/test/e2e/repo_assertions_test.go) - -Specific areas to question: - -- when a `WatchRule` is deleted, how quickly does it disappear from the active compiled store? -- when a `GitTarget` is deleted, how quickly is its stream fully unregistered? -- can buffered events still flush after the spec has moved on? -- can snapshot/reconcile logic emit writes for a target that is already logically done from the test's point of view? - -## What To Capture Next Time - -If this resurfaces, the following evidence will be the most valuable. - -### 1. Latest commit inventory, not just latest commit path - -Capture: - -```bash -git -C log --oneline -n 20 -git -C diff-tree --no-commit-id --name-only -r HEAD -git -C show --stat --summary HEAD -``` - -This helps distinguish: - -- wrong-path latest commit -- multiple rapid commits from different targets -- reconcile commit vs per-event commit - -### 2. Active rules and targets at failure time - -Capture: - -```bash -kubectl get watchrules --all-namespaces -kubectl get gittargets --all-namespaces -kubectl get gitproviders --all-namespaces -``` - -Especially look for old manager-spec resources still present in the test namespace. - -### 3. Controller logs around the exact failure window - -Search for: - -- `Starting git commit and push` -- `Starting write request operation` -- `Created commit` -- `Created atomic commit` -- `Reconciliation completed, transitioning to LIVE_PROCESSING` -- `Finished processing buffered events` - -### 4. Path ownership map - -It will help to quickly map every manager spec to its intended target path: - -- `e2e` -- `e2e/secret-encryption-test` -- `e2e/secret-autogen-test` -- `e2e/configmap-test` -- `e2e/delete-test` -- `e2e/icecream-test` - -If a later spec fails and the latest commit touches one of the earlier paths, that is a very strong sign of cross-spec leakage. - -## Practical Interpretation For Now - -Since CI is green again, the right stance is: - -- do not panic -- do not forget this -- treat this as a likely instability pattern that may reappear under timing pressure - -If it comes back, the current best working assumption should be: - -- not "the controller missed the event" -- not "the repo assertion is obviously wrong" -- but "another target probably wrote to the same repo after the expected target" - -That framing should save time. - -## Summary - -The best current explanation is a full-suite shared-state race involving earlier manager-suite -targets, not a simple single-test path bug. - -What the evidence says most clearly: - -- the expected commit did happen -- but it did not stay the latest commit -- an older target path appears to have remained active long enough to overwrite the test's assumption - -If the flake returns, start by proving which target wrote the final commit and whether that target -should still have been active at all. diff --git a/docs/design/e2e-watchrule-cross-spec-interference.md b/docs/design/e2e-watchrule-cross-spec-interference.md deleted file mode 100644 index 7f709e33..00000000 --- a/docs/design/e2e-watchrule-cross-spec-interference.md +++ /dev/null @@ -1,216 +0,0 @@ ---- -title: e2e WatchRule cross-spec interference and bandaids -status: open -date: 2026-04-26 ---- - -# e2e WatchRule cross-spec interference - -## TL;DR - -Specs in the Manager describe block share one Gitea repo (`managerRepo`) and one test namespace. They each create a WatchRule that matches `configmaps` (sometimes `secrets`/`deployments`/`ingresses` too) and a GitTarget with a *different* `commitPath`. When a spec finishes and calls `cleanupWatchRule` / `cleanupGitTarget`, the WatchRule is deleted from the Kubernetes API, but the controller's internal event-router state is **not** synchronously drained. The next spec creates its WatchRule, then triggers an event (creating or deleting a ConfigMap), and the controller fans the event out to *every* WatchRule it still believes is active, including the now-deleted ones from prior specs. - -The visible symptom: each spec's expected commit lands at its own `commitPath`, but additional commits from prior specs' "ghost" WatchRules also land at unrelated `commitPaths`. Whichever commit lands last is on `HEAD`, which is what the assertions used to check — so the assertion sees a commit at the wrong path and fails. - -The signing batch spec hits a closely related but mechanistically different version of the same problem (described below): when *any* prior spec has failed, the suite's "preserve resources for investigation" policy skips every subsequent `DeferCleanup`, leaving fully alive WatchRules in the cluster across spec boundaries. - -This is recurring timing debt, not a one-off CI hiccup. If the next feature changes commit messages, -snapshot writes, write-window aggregation, or target bootstrap behavior, fix or isolate this first; -otherwise the suite can report old convergence failures as if they were regressions in the new work. - -## Evidence from CI run 24966661233 (sha 9da6a3e) - -Three independent WatchRules all reacted to the same `delete configmap test-configmap-to-delete` event in the **delete** spec: - -``` -20:54:36 Deleted file from repository e2e/configmap-test/v1/configmaps//test-configmap-to-delete.yaml -20:54:36 Deleted file from repository e2e/delete-test/v1/configmaps//test-configmap-to-delete.yaml -20:54:37 Deleted file from repository e2e/v1/configmaps//test-configmap-to-delete.yaml -``` - -The current spec only owns the middle one (`e2e/delete-test/...`). The other two come from prior specs whose WatchRules *should* be gone: - -- `e2e/configmap-test/...` — leaked from the prior "should create Git commit when ConfigMap is added" spec. -- `e2e/...` — leaked from the early "should reconcile a WatchRule CR" spec, which uses the bare `getBaseFolder()` path. - -### The signing batch spec — same symptom, different mechanism - -Earlier in the same CI run: - -``` -20:55:xx manager-delete spec FAILS (the path-pollution issue above) -20:57:40 signing-committer-template spec runs -20:57:45 STEP: preserving e2e resources; skipping cleanup for WatchRule 1777236647-test-signing/signing-committer-template-wr -20:57:45 STEP: preserving e2e resources; skipping cleanup for GitTarget 1777236647-test-signing/signing-committer-template-dest -20:57:48 signing-batch spec creates GitTarget signing-batch-dest in the SAME namespace -20:57:50 signing-batch spec recreates GitTarget to force a fresh snapshot batch -20:59:21 signing-batch spec times out: "expected a commit in e2e/signing-batch" -``` - -The `signing-committer-template-wr` is still alive in `1777236647-test-signing`. It watches configmaps. When the batch spec creates `batch-cm-{0,1,2}` in the same namespace, *both* WatchRules pick them up. The controller now has to serialize work for two independent GitTargets through the same branch worker, and the snapshot batch the spec is waiting for either never lands or lands far outside its `Eventually` window. - -The two failure modes — manager and signing — share the same observable shape ("more WatchRules are reacting than this spec expects") but the leak source is different: - -| Spec class | What leaks the extra WatchRule | Whose fault | -|---|---|---| -| Manager (create/delete) | `cleanupWatchRule` removes the WatchRule from k8s, but the controller's event router still routes events to it | Controller bug — ghost WatchRule in the in-memory cache | -| Signing (batch) | A prior spec failed → suite-wide "preserve resources for investigation" mode skips every subsequent `DeferCleanup` → previous WatchRule stays fully alive in k8s | Test-infrastructure cascade, downstream of an earlier real failure | - -A useful corollary: fixing the manager ghost-WatchRule bug will *incidentally* turn the signing batch spec green most of the time, because the preservation cascade is only triggered after the manager spec fails. The signing batch spec could still be made flaky on its own (e.g. if the signing-committer-template spec fails for unrelated reasons), but the day-to-day correlation between these two failures is not coincidence. - -## Evidence from CI run 25370586792 (sha ea5c953) - -On 2026-05-05, the push run for the merged GitHub Actions Dependabot update failed on attempt 1 and -passed on rerun. The PR run for the same change had already passed. The failing attempt had all -non-full-e2e jobs green: build, lint, unit tests, chart build, devcontainer validation, and both -quickstart e2e variants. - -Only `E2E (full)` failed, with two timeout-style assertions: - -- `Manager > should generate missing SOPS age secret when age.recipients.generateWhenMissing is enabled` - timed out after 30s at `test/e2e/e2e_test.go:647`. The generated Secret existed and had already - been read, but the expected repository bootstrap file did not appear: - `.stamps/repos/e2e-manager-1777976528/e2e/secret-autogen-test/.sops.yaml`. -- `Commit Signing > should produce a snapshot commit with the custom snapshot message template` - timed out after 30s at `test/e2e/signing_e2e_test.go:481`. The observed snapshot-path history - contained a per-event line, `[CREATE] v1/secrets/signing-key-batch`, while the spec expected the - path history to contain only custom snapshot-template subjects. - -The rerun of the same GitHub Actions run completed successfully. That makes this concrete instance -look like asynchronous convergence flakiness rather than a deterministic regression in the -Dependabot change. - -This newer instance is not identical to the earlier delete/configmap evidence below, but it rhymes: -the tests are asserting on git state produced by asynchronous WatchRule/snapshot machinery with a -fixed 30s wall-clock window. When that machinery lags, cross-spec state, stale route registration, or -preserved resources can make the failure appear in unrelated specs. - -## Evidence from CI run 25372010729 attempt 1 (sha 41d160b) - -On 2026-05-05, the push run for the docs/release guard change failed in `E2E (full)` on attempt 1. -You reran the failed job; attempt 1 is the failure analyzed here. As with the earlier May 5 run, all -non-full-e2e jobs were green, including build, lint, unit tests, chart build, devcontainer -validation, and both quickstart e2e variants. - -Two specs failed: - -- `Manager > should generate missing SOPS age secret when age.recipients.generateWhenMissing is enabled` - timed out after 30s at `test/e2e/e2e_test.go:647`. The generated Secret existed and the - controller logged `Generated missing encryption secret with age key`, but the expected - `.sops.yaml` bootstrap file never appeared under: - `.stamps/repos/e2e-manager-1777978467/e2e/secret-autogen-test/.sops.yaml`. -- `Commit Signing > should produce a snapshot commit with the custom snapshot message template` - timed out after 30s at `test/e2e/signing_e2e_test.go:481`. - -The signing failure is the same **assertion-history pollution** mechanism described in run -`25337578768`, not a missing snapshot. The controller created and pushed the snapshot commit: - -``` -11:00:43 git commit created messageKind=event message="[CREATE] v1/secrets/signing-key-batch" -11:00:44 git commit created messageKind=snapshot message="e2e-snapshot: synced 11 resources to signing-snapshot-dest" -11:00:49 Push successful -``` - -The test then failed because `git log --format=%s -- e2e/signing-snapshot` contained both subjects: - -``` -e2e-snapshot: synced 11 resources to signing-snapshot-dest -[CREATE] v1/secrets/signing-key-batch -``` - -So for the signing spec, this attempt is **not** evidence that the snapshot batch failed to fire. -The latest relevant snapshot commit existed. The assertion is too broad because it rejects any -per-event-looking subject anywhere in the path history, including the generated signing-key Secret -bootstrap commit. - -The manager SOPS-age failure is closer to the asynchronous bootstrap/convergence bucket: the -controller generated the age Secret, registered the GitTarget stream, retrieved cluster state with -`resourceCount=0`, and transitioned to live processing, but no `.sops.yaml` commit was observed -within the fixed 30s window. That is still not the original ghost-WatchRule/delete-path symptom, -because there is no evidence in this attempt of multiple WatchRules writing the same event to -unrelated manager paths. - -## Evidence from CI run 25337578768 (sha cba48a6, merge sha 85fd8f2) - -On 2026-05-04, the PR run for the Go dependency Dependabot update failed in `E2E (full)` while -build, lint, unit tests, chart build, devcontainer validation, and both quickstart e2e variants were -green. - -Only one spec failed: - -- `Commit Signing > should produce a batch commit with the custom batch message template` - timed out after 30s at `test/e2e/signing_e2e_test.go:481`. - -This is **not the same mechanism** as the earlier preservation-cascade signing failure. There was no -earlier failed spec in the Ginkgo summary, and `signing-committer-template-wr` was cleaned up before -the batch spec started: - -``` -19:10:45 cleaning up WatchRule signing-committer-template-wr -19:10:45 cleaning up GitTarget signing-committer-template-dest -19:10:45 Commit Signing should produce a batch commit with the custom batch message template -``` - -It is also not exactly "the batch never fired". The controller log shows both of these commits for -the `signing-batch` target: - -``` -19:10:46 Created commit operation=CREATE resource=v1/secrets/signing-key-batch -19:10:47 Created atomic commit message="e2e-batch: synced 11 resources to signing-batch-dest" -``` - -The failing assertion output contained the same two subjects: - -``` -e2e-batch: synced 11 resources to signing-batch-dest -[CREATE] v1/secrets/signing-key-batch -``` - -So this run exposes a different sharp edge in the signing batch spec: the generated signing key is a -Secret, the WatchRule watches Secrets, and the GitTarget is already live while -`generateWhenMissing` creates `signing-key-batch`. That can legitimately place a per-event commit in -the same `e2e/signing-batch` path before the forced snapshot batch lands. The latest path commit may -be the correct atomic batch commit, but `git log --format=%s -- e2e/signing-batch` still contains the -older per-event secret commit, so the "path history must not contain `[`" assertion is too broad. - -Interpretation: this belongs to the same family of "signing batch assertions are over-sensitive to -asynchronous WatchRule writes", but it is not evidence of ghost WatchRules or skipped cleanup. The -fix should be in the test assertion/setup: assert the latest path commit's subject and touched files, -or move/ignore the generated signing-key Secret so per-event bootstrap commits cannot pollute the -history check. - -## What changed in the staged work - -| Change | File | Effect | -|---|---|---| -| Path-anchored assertion `assertLatestCommitForPathTouchesOnlyWithOptional` | `test/e2e/repo_assertions_test.go` | Looks up the commit hash that touched our expected file rather than blindly trusting `HEAD`. Bypasses the case where a ghost WatchRule's commit lands on `HEAD` after ours. | -| Switched the create spec to the path-anchored variant | `test/e2e/e2e_test.go` | Asserts on our commit even when ghost commits pile on. | -| 5-second `time.Sleep` after WatchRule + GitTarget reach Ready, before the test event fires | `test/e2e/e2e_test.go` (create + delete specs) | Gives the controller time to drop the previous spec's deleted WatchRule from its informer cache. Empirically reduces (but does not eliminate) the duplicate-commit pile-up. | -| Refactored `controllerLogs` to iterate pod names instead of `kubectl logs -l ...` | `test/e2e/helpers.go` | More reliable in HA mode; unrelated to the failures here. | -| Reverted earlier attempt to remove the GitTarget-recreation step in the signing batch spec | `test/e2e/signing_e2e_test.go` | The recreation step is genuinely load-bearing — it is what triggers the controller to emit a fresh snapshot batch. Removing it broke the spec; reinstated. | -| Lowered the signing batch `Eventually` from 90s to 30s | `test/e2e/signing_e2e_test.go` | All inputs (kube-apiserver audit batch wait, controller reconcile loops, gitea push) are configured to respond quickly, so the batch commit should land well under 30s. A *higher* timeout was the original instinct, but the tighter window is more useful as a signal: if it fails, that genuinely means the batch did not fire (e.g. cascade from a prior preservation), not that we waited long enough. | -| Added `ensure_inotify_limits()` to the cluster bootstrap | `test/e2e/cluster/start-cluster.sh` | Bumps `fs.inotify.max_user_instances` from 128 to 512 via a privileged container. Required when the dev/CI host already runs another k3d cluster (e.g. `audit-pass-through-e2e`); otherwise containerd silently fails to write some files (notably the serverlb's `/etc/confd/values.yaml`), and the cluster comes back as "unhealthy" after a docker daemon restart. Lifted from `external-sources/apiservice-audit-proxy/docs/E2E_SETUP_LESSONS.md` lesson 2. | -| `wait_for_ready_active_pod` in the port-forward script | `hack/e2e/setup-port-forwards.sh` | Filters out pods with `deletionTimestamp` before `kubectl wait`, so we don't hang on a terminating pod during a rolling update. | - -## What is fixed and what is not - -**Fixed:** -- The `Manager > should create Git commit when ConfigMap is added via WatchRule` spec is green in CI on `bf40992` and locally with both the create and delete fixes applied. -- Cluster bootstrap is robust to the inotify-exhaustion case that caused `❌ Existing k3d cluster ... is unhealthy.` after a daemon restart. - -**Band-aided (still fragile):** -- `Manager > should delete Git file when ConfigMap is deleted via WatchRule` — now uses the path-anchored assertion and has the same 5s settle wait. The spec will pass as long as our commit can be found *somewhere* in history at the expected path. It still produces 3 git commits per delete event in CI; we just stop checking `HEAD` for the assertion. -- `Commit Signing > should produce a batch/snapshot commit with the custom message template` — has at least two distinct fragile modes now. One is the earlier preservation cascade, where a prior failed spec leaves another WatchRule alive in the same signing namespace and the batch does not land inside the `Eventually` window. The other is the generated signing-key Secret producing a legitimate per-event commit in the same path before the atomic snapshot; in that case the batch can land correctly, but the spec still fails because it searches the entire path history for per-event-style subjects. Tightened the `Eventually` window to 30s (down from 90s) so a real "batch did not fire" remains visible; the history-pollution assertion should be fixed separately rather than widened. - -**Open root causes:** -1. **Ghost WatchRules (controller bug).** `cleanupWatchRule` is fire-and-forget. When the next spec's event fires, the controller's event router still holds the deleted WatchRule and routes the event to it, producing extra commits at the wrong `commitPath`. This is not a test bug — a real user creating, deleting, and recreating a WatchRule with overlapping selectors would hit the same window. The right fix is in the controller: when a WatchRule is removed from the informer cache, its registration in the event router (and any in-flight reconciles) must be drained before any further events are dispatched. As long as that is not the case, *any* test that shares a managerRepo across specs will be flaky. -2. **Preservation cascade (test infrastructure).** When a spec fails, every subsequent spec's `DeferCleanup` is skipped to keep state available for investigation. The skipping is global, not per-spec: a single failure leaves a trail of fully alive WatchRules and GitTargets in shared namespaces, which then cause unrelated specs (notably the signing batch spec) to fail for reasons that have nothing to do with their own logic. This makes the suite's failure output misleading — a single root failure produces a wave of secondary failures that look independent. Options: scope preservation to the failing spec only; run preserved-mode specs in throwaway namespaces so the leaked WatchRules cannot match later test fixtures; or skip subsequent specs entirely once preservation kicks in. -3. **Bare `e2e` `commitPath`.** The "should reconcile a WatchRule CR" spec uses `getBaseFolder()` which returns `"e2e"`. That overlaps the prefix used by every other spec. Even if we fix the ghost-WatchRule bug, having one spec pin the bare prefix while siblings use `e2e/` keeps the failure mode latent. Switching to a unique sub-folder (e.g. `e2e/watchrule-reconcile-test`) or a unique namespace per spec would make the suite robust by construction. - -## Suggested order to address - -1. Land the band-aids so CI is green and the suite stops costing iteration time. -2. Instrument the controller's event router to log when it dispatches an event to a WatchRule whose UID is no longer in the informer cache. That gives a fast signal when the ghost-WatchRule path is hit in production code, not just in tests. -3. Decide whether to (a) make the controller drain the event router on WatchRule deletion, or (b) restructure the test suite to use unique namespaces per spec so the cross-spec contamination cannot happen. (a) is the correct product behavior; (b) is cheaper and orthogonal. -4. Scope the "preserve resources for investigation" behavior to the failing spec only — or skip dependent specs after preservation kicks in — so a single failure does not produce a wave of secondary failures masking the actual root cause. -5. Replace the 30s window in the signing batch spec with a wait against a controller log line or metric that confirms the snapshot-batch loop ran, so the spec asserts on causality rather than a wall-clock budget. diff --git a/docs/design/gitops-api/README.md b/docs/design/gitops-api/README.md index c8875f3c..15b9f17c 100644 --- a/docs/design/gitops-api/README.md +++ b/docs/design/gitops-api/README.md @@ -10,9 +10,9 @@ > [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md), > [intent-cluster-hydration.md](intent-cluster-hydration.md), > [../../future/idea-application-editing.md](../../future/idea-application-editing.md), -> [../manifest/contextual-namespace-and-kustomize-folder-editing.md](../manifest/contextual-namespace-and-kustomize-folder-editing.md), -> [../manifest/file-agnostic-placement.md](../manifest/file-agnostic-placement.md), -> [../../finished/current-manifest-support-review.md](../../finished/current-manifest-support-review.md) +> [../manifest/contextual-namespace-and-kustomize-folder-editing.md](../../spec/contextual-namespace-and-kustomize-folder-editing.md), +> [../manifest/file-agnostic-placement.md](../../spec/gittarget-new-file-placement-rules.md), +> [../../finished/current-manifest-support-review.md](../../spec/current-manifest-support-review.md) ## Goal @@ -25,7 +25,7 @@ operator writes the changes to a branch. The product layer then opens the pull request through the Git host's API. The division of responsibility is deliberate and already a recorded decision -([file-agnostic-placement.md](../manifest/file-agnostic-placement.md)): +([file-agnostic-placement.md](../../spec/gittarget-new-file-placement-rules.md)): - **GitOps Reverser**: watch live state, edit the folder the way a careful human would (in place, comment-preserving, refusing what it cannot own), @@ -140,7 +140,7 @@ base"), and the mirror-mode vs. intent-cluster topology — live in | F1 | Kustomize `images:` / `replicas:` edit-through — a live change produced by an override entry is written back to that entry, never through into the source manifest | [finished/f1-images-replicas-edit-through.md](finished/f1-images-replicas-edit-through.md) | implemented ([#198](https://github.com/ConfigButler/gitops-reverser/pull/198)) | | F7 | Higher-level KRM objects as first-class documents — corpus + e2e pinning that Flux `HelmRelease`/`Kustomization`, Argo CD `Application`, KRO resources, and core resources mirror and edit like any KRM document (they should already; F7 *proves* it), plus "install an app = add KRM" user docs | [finished/f7-higher-level-krm-documents.md](finished/f7-higher-level-krm-documents.md) | implemented (manifestedit corpus for HelmRelease/Application/KRO; HelmRelease mirror+edit e2e; [installing-apps-as-krm.md](../../installing-apps-as-krm.md) user docs) | | F2 | Render-root scoping — a GitTarget declares its render root (e.g. `overlays/env1`); base files reached through `../../base` become read-only context, dissolving overlay fan-out ambiguity. Launch scope: overlay `images:`/`replicas:` entries + overlay-local documents, shipped **with** the per-edit `FullyReflected` accounting | — | not designed — **launch-critical** | -| F4 | New-file placement rules — sibling inference + `spec.placement` template so new resources land in the folder's convention, not the canonical REST path; includes creating the `resources:` entry when the target folder carries a kustomization | designed in [version2/gittarget-new-file-placement-rules.md](../manifest/version2/gittarget-new-file-placement-rules.md) | implemented (v1: declared policy + sibling inference steps 1/2/4 + kustomize `resources:` entry; step 3 and ordered-rule Option A deferred) | +| F4 | New-file placement rules — sibling inference + `spec.placement` template so new resources land in the folder's convention, not the canonical REST path; includes creating the `resources:` entry when the target folder carries a kustomization | designed in [version2/gittarget-new-file-placement-rules.md](../../spec/gittarget-new-file-placement-rules.md) | implemented (v1: declared policy + sibling inference steps 1/2/4 + kustomize `resources:` entry; step 3 and ordered-rule Option A deferred) | | F5 | Branch/session ergonomics — base-branch selection, opt-in remote branch cleanup, a GitTarget-level quiescence condition | — | not designed — **launch-critical** | | F3 | Restricted patch authoring — write/update scalar-field strategic-merge patches in an overlay ("live drift lands in the environment's overlay"); turns the launch-time unreflected class (per-env edits of base-owned fields) into reflected edits | — | post-launch; priced by tier-2 metrics | | F6 | Admission preflight gate — opt-in intent-cluster webhook rejecting edits that cannot be reflected into the folder (fail-open; the underlying per-edit `FullyReflected` accounting ships with the F2/F4 launch unit) | [unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md) | designed, unbuilt — value highest while F3 is absent | diff --git a/docs/design/gitops-api/argocd-bi-directional.md b/docs/design/gitops-api/argocd-bi-directional.md index a33d2d56..2e5677c9 100644 --- a/docs/design/gitops-api/argocd-bi-directional.md +++ b/docs/design/gitops-api/argocd-bi-directional.md @@ -27,7 +27,7 @@ All citations are against the Argo CD tree vendored at line, which is materially identical for these paths). Exercised end-to-end in [`../../../test/e2e/argocd_bi_directional_e2e_test.go`](../../../test/e2e/argocd_bi_directional_e2e_test.go); corner design in -[`../e2e-bi-directional-corner.md`](../e2e-bi-directional-corner.md). +[`../e2e-bi-directional-corner.md`](../../spec/e2e-bi-directional-corner.md). ## How fast is self-heal, and why it cannot be slowed @@ -200,6 +200,6 @@ forgotten. ## References - User-facing guidance: [`../../bi-directional.md`](../../bi-directional.md) -- E2E corner design: [`../e2e-bi-directional-corner.md`](../e2e-bi-directional-corner.md) +- E2E corner design: [`../e2e-bi-directional-corner.md`](../../spec/e2e-bi-directional-corner.md) - Exercised behavior: [`../../../test/e2e/argocd_bi_directional_e2e_test.go`](../../../test/e2e/argocd_bi_directional_e2e_test.go) - Argo CD source (vendored): `external-sources/argo-cd` — cited inline by file:line. diff --git a/docs/design/gitops-api/f8-repo-discovery-and-onboarding-scan.md b/docs/design/gitops-api/f8-repo-discovery-and-onboarding-scan.md index 81770185..44d19963 100644 --- a/docs/design/gitops-api/f8-repo-discovery-and-onboarding-scan.md +++ b/docs/design/gitops-api/f8-repo-discovery-and-onboarding-scan.md @@ -11,8 +11,8 @@ > [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md), > [finished/f1-images-replicas-edit-through.md](finished/f1-images-replicas-edit-through.md), > [finished/f7-higher-level-krm-documents.md](finished/f7-higher-level-krm-documents.md), -> [../manifest/file-agnostic-placement.md](../manifest/file-agnostic-placement.md), -> [../../finished/current-manifest-support-review.md](../../finished/current-manifest-support-review.md) +> [../manifest/file-agnostic-placement.md](../../spec/gittarget-new-file-placement-rules.md), +> [../../finished/current-manifest-support-review.md](../../spec/current-manifest-support-review.md) ## Why this exists @@ -49,7 +49,7 @@ Repo-wide target discovery is therefore a **new axis**, not a new operator feature. Putting it in the operator would fight both the simplicity goal and the one-owner invariant. It belongs in the CLI/library and, above that, the product layer — exactly the division already recorded in -[file-agnostic-placement.md](../manifest/file-agnostic-placement.md) and the +[file-agnostic-placement.md](../../spec/gittarget-new-file-placement-rules.md) and the [README](README.md) responsibilities table: | Layer | Owns | Gains repo-wide discovery? | diff --git a/docs/design/gitops-api/finished/f1-images-replicas-edit-through.md b/docs/design/gitops-api/finished/f1-images-replicas-edit-through.md index 2a20f116..bff8f7c2 100644 --- a/docs/design/gitops-api/finished/f1-images-replicas-edit-through.md +++ b/docs/design/gitops-api/finished/f1-images-replicas-edit-through.md @@ -6,7 +6,7 @@ > Captured: 2026-07-06 > Related: > [../README.md](../README.md), -> [../../manifest/contextual-namespace-and-kustomize-folder-editing.md](../../manifest/contextual-namespace-and-kustomize-folder-editing.md), +> [../../manifest/contextual-namespace-and-kustomize-folder-editing.md](../../../spec/contextual-namespace-and-kustomize-folder-editing.md), > [../../../../internal/git/manifestedit/DECISION.md](../../../../internal/git/manifestedit/DECISION.md) ## Problem diff --git a/docs/design/gitops-api/gittarget-granularity-and-cross-environment-edits.md b/docs/design/gitops-api/gittarget-granularity-and-cross-environment-edits.md index 001540a8..bf1ca090 100644 --- a/docs/design/gitops-api/gittarget-granularity-and-cross-environment-edits.md +++ b/docs/design/gitops-api/gittarget-granularity-and-cross-environment-edits.md @@ -12,7 +12,7 @@ > [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md) > (§4 invariant, §5 overlay model, §9 three arrows), > [unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md), -> [../gitpath-foreign-content-stringency.md](../gitpath-foreign-content-stringency.md) +> [../gitpath-foreign-content-stringency.md](../../spec/gitpath-foreign-content-stringency.md) ## Purpose diff --git a/docs/design/gitops-api/intent-cluster-hydration.md b/docs/design/gitops-api/intent-cluster-hydration.md index 3d596219..08a1ccf3 100644 --- a/docs/design/gitops-api/intent-cluster-hydration.md +++ b/docs/design/gitops-api/intent-cluster-hydration.md @@ -86,7 +86,7 @@ sequenceDiagram Note over Rev: applied state equals committed state,
so nothing new to commit. The loop is closed. ``` -This is not a proposal. [`test/e2e/bi_directional_e2e_test.go`](../../../test/e2e/bi_directional_e2e_test.go) +This is not a proposal. `test/e2e/bi_directional_e2e_test.go` runs it against real Flux with `prune: true`, and asserts the hard part — that GitOps Reverser produces **exactly one commit** for a live edit and Flux converges without a second one. It also covers a SOPS-encrypted `Secret` written by the diff --git a/docs/design/gitops-api/kustomize-support-boundary-and-product-model.md b/docs/design/gitops-api/kustomize-support-boundary-and-product-model.md index 7f5f7736..cf7ca90f 100644 --- a/docs/design/gitops-api/kustomize-support-boundary-and-product-model.md +++ b/docs/design/gitops-api/kustomize-support-boundary-and-product-model.md @@ -8,9 +8,9 @@ > [README.md](README.md), > [gittarget-granularity-and-cross-environment-edits.md](gittarget-granularity-and-cross-environment-edits.md), > [finished/f1-images-replicas-edit-through.md](finished/f1-images-replicas-edit-through.md), -> [../manifest/contextual-namespace-and-kustomize-folder-editing.md](../manifest/contextual-namespace-and-kustomize-folder-editing.md), -> [../unsupported-folder-refusal-plan.md](../unsupported-folder-refusal-plan.md), -> [../manifest/version2/gittarget-new-file-placement-rules.md](../manifest/version2/gittarget-new-file-placement-rules.md) +> [../manifest/contextual-namespace-and-kustomize-folder-editing.md](../../spec/contextual-namespace-and-kustomize-folder-editing.md), +> [../unsupported-folder-refusal-plan.md](../../spec/unsupported-folder-refusal-plan.md), +> [../manifest/version2/gittarget-new-file-placement-rules.md](../../spec/gittarget-new-file-placement-rules.md) ## Purpose diff --git a/docs/design/gitops-api/unreflectable-edits-and-write-gating.md b/docs/design/gitops-api/unreflectable-edits-and-write-gating.md index 15b382e5..9398f969 100644 --- a/docs/design/gitops-api/unreflectable-edits-and-write-gating.md +++ b/docs/design/gitops-api/unreflectable-edits-and-write-gating.md @@ -7,7 +7,7 @@ > Related: > [README.md](README.md), > [finished/f1-images-replicas-edit-through.md](finished/f1-images-replicas-edit-through.md), -> [../unsupported-folder-refusal-plan.md](../unsupported-folder-refusal-plan.md) +> [../unsupported-folder-refusal-plan.md](../../spec/unsupported-folder-refusal-plan.md) ## Problem diff --git a/docs/design/gitops-api/write-only-encrypted-secrets.md b/docs/design/gitops-api/write-only-encrypted-secrets.md index 4ee4d36d..02a0a841 100644 --- a/docs/design/gitops-api/write-only-encrypted-secrets.md +++ b/docs/design/gitops-api/write-only-encrypted-secrets.md @@ -99,7 +99,7 @@ There is a second model in the codebase, and honesty requires naming it. ([`internal/controller/gittarget_controller.go`](../../../internal/controller/gittarget_controller.go)), mints a keypair, stores the private half in a `Secret` — annotated *"Back up the private key and remove warning annotation"* — and publishes the recipient. The -[bi-directional e2e](../../../test/e2e/bi_directional_e2e_test.go) then hands that +bi-directional e2e then hands that same `Secret` to Flux as its `decryption` key, which is how Flux reconciles the encrypted `Secret` this operator wrote. diff --git a/docs/design/gittarget-lifecycle-and-repo-architecture.md b/docs/design/gittarget-lifecycle-and-repo-architecture.md deleted file mode 100644 index 757c7dd1..00000000 --- a/docs/design/gittarget-lifecycle-and-repo-architecture.md +++ /dev/null @@ -1,536 +0,0 @@ -# GitTarget Lifecycle And Repo Architecture - -> ## ⚠️ Partially superseded by R3 (2026-06-11) -> The **`SnapshotSynced` condition and the `evaluateSnapshotGate` bootstrap gate referenced -> throughout this doc were removed** in the api-source-of-truth rework (R3). The current GitTarget -> readiness is: **`Validated` → ensure BranchWorker + register the `GitTargetEventStream` → `Ready`**; -> there is no whole-GitTarget initial snapshot to gate on. Per-type serviceability is now the -> **Materializer phase** (`Dormant → Requested → Syncing → Synced`), surfaced in -> `GitTargetStatus.Materialization`. The repo-creation, SOPS-age-Secret, and bootstrap-template -> sections below remain accurate. For the current readiness + bootstrap model read -> [architecture.md](../architecture.md). - -## Purpose - -This document describes two things: - -1. where the local Git working repository is created and managed -2. what the current `GitTarget` lifecycle means, step by step - -It also explains: - -- what `GitTargetConditionValidated` means -- when the controller moves from one condition to the next -- where the generated SOPS age Secret is created -- how bootstrap files fit into the current design - -## High-Level Model - -Today the system has three related layers: - -1. `GitTarget` controller lifecycle -2. branch worker lifecycle -3. local repository/worktree lifecycle - -These are related, but they are not the same thing. - -### 1. GitTarget lifecycle - -This is the user-visible state machine exposed in `GitTarget.status.conditions`. - -The main conditions are defined in: - -- [internal/controller/gittarget_controller.go](/workspaces/gitops-reverser/internal/controller/gittarget_controller.go) - -Current lifecycle conditions: - -- `Ready` -- `Validated` -- `EncryptionConfigured` -- `SnapshotSynced` -- `EventStreamLive` - -### 2. Branch worker lifecycle - -A branch worker is the in-memory component that serializes writes for one: - -- provider namespace -- provider name -- branch - -It is managed by: - -- [internal/git/worker_manager.go](/workspaces/gitops-reverser/internal/git/worker_manager.go) - -### 3. Local repository/worktree lifecycle - -Each branch worker uses a local repository checkout under `/tmp`. - -This is managed by: - -- [internal/git/branch_worker.go](/workspaces/gitops-reverser/internal/git/branch_worker.go) -- [internal/git/git.go](/workspaces/gitops-reverser/internal/git/git.go) - -## Where The Local Git Repository Is Created - -The local repository path is derived in the branch worker. - -Relevant functions: - -- [internal/git/branch_worker.go](/workspaces/gitops-reverser/internal/git/branch_worker.go) - - `repoRootPath()` - - `repoPathForRemote(remoteURL string)` - -### Current path layout - -The worker stores repositories under: - -```text -/tmp/gitops-reverser-workers////repos/ -``` - -This means: - -- one logical worker owns one provider+branch combination -- the actual repo directory is keyed by a hash of the remote URL -- the repo directory is reused across operations for that worker - -### Why the remote URL is hashed - -The worker uses: - -- `repoCacheKey(remoteURL string)` - -to build a stable directory name from the remote URL. - -That avoids path issues from raw URLs while still keeping one reusable local checkout per remote. - -## Where The Local Repository Is Opened Or Initialized - -The main entrypoint for repository preparation is: - -- [internal/git/git.go](/workspaces/gitops-reverser/internal/git/git.go) - - `PrepareBranch(...)` - -### What `PrepareBranch(...)` does - -`PrepareBranch(...)` is responsible for: - -- ensuring the parent directory exists -- opening an existing local repository if present -- creating a clean repository if missing or broken -- ensuring the `origin` remote is set correctly -- syncing local branch state against the remote - -This function does **not** just write files. It is the core “make sure local repo state is usable” operation. - -### Where it is called from - -The branch worker calls `PrepareBranch(...)` in three important places: - -- `ensureRepositoryInitialized(...)` -- `prepareBootstrapRepository(...)` -- the main write/sync path before commit/push - -Relevant locations: - -- [internal/git/branch_worker.go](/workspaces/gitops-reverser/internal/git/branch_worker.go) - -## What The Branch Worker Owns - -The branch worker is the owner of: - -- local repository synchronization -- worktree mutation -- bootstrapping files in the worktree -- batching or serializing events for commit/push - -Important file: - -- [internal/git/branch_worker.go](/workspaces/gitops-reverser/internal/git/branch_worker.go) - -### Worker identity - -A worker is keyed by: - -- provider namespace -- provider name -- branch - -This means multiple `GitTarget`s can share a worker if they write to different paths on the same branch. - -### Worker manager - -Workers are created and looked up by: - -- [internal/git/worker_manager.go](/workspaces/gitops-reverser/internal/git/worker_manager.go) - -Important functions: - -- `EnsureWorker(...)` -- `GetWorkerForTarget(...)` -- `RegisterTarget(...)` -- `UnregisterTarget(...)` - -## Exact Current GitTarget Lifecycle - -The lifecycle is implemented in: - -- [internal/controller/gittarget_controller.go](/workspaces/gitops-reverser/internal/controller/gittarget_controller.go) - -The controller processes the gates in this order: - -1. `Validated` -2. `EncryptionConfigured` -3. `SnapshotSynced` -4. `EventStreamLive` -5. `Ready` - -`Ready=True` only happens after the earlier gates are satisfied. - -## What `Validated` Means - -`Validated` means: - -- the referenced `GitProvider` exists -- the target branch matches the provider’s `allowedBranches` -- there is no path conflict with another `GitTarget` using the same provider+branch+path - -This logic lives in: - -- `evaluateValidatedGate(...)` -- `validateProviderAndBranch(...)` -- `checkForConflicts(...)` - -all in: - -- [internal/controller/gittarget_controller.go](/workspaces/gitops-reverser/internal/controller/gittarget_controller.go) - -### What `Validated=True` does not mean - -It does **not** mean: - -- the local repo has been cloned -- a worker definitely exists -- the branch exists remotely -- bootstrap files are present -- snapshot reconciliation has completed - -It only means that the target is logically allowed and conflict-free enough to continue. - -### When the controller jumps to `Validated=True` - -The controller sets `Validated=True` after: - -- the `GitProvider` lookup succeeds -- branch pattern validation succeeds -- conflict detection succeeds - -The exact status set is: - -- `type: Validated` -- `status: True` -- `reason: OK` -- `message: Provider and branch validation passed` - -### When `Validated=False` happens - -Examples: - -- provider not found -- branch does not match allowed patterns -- another earlier `GitTarget` already owns the same provider+branch+path - -When `Validated=False`, later lifecycle conditions are explicitly blocked: - -- `EncryptionConfigured=Unknown` -- `SnapshotSynced=Unknown` -- `EventStreamLive=Unknown` -- `Ready=False` - -## What `EncryptionConfigured` Means - -`EncryptionConfigured` means: - -- if SOPS age encryption is not enabled, nothing more is required -- if SOPS age encryption is enabled, the encryption Secret exists and can be resolved into usable recipients - -This logic lives in: - -- `evaluateEncryptionGate(...)` -- `ensureEncryptionSecret(...)` - -in: - -- [internal/controller/gittarget_controller.go](/workspaces/gitops-reverser/internal/controller/gittarget_controller.go) - -### When `EncryptionConfigured=True` happens - -There are two main cases: - -1. Encryption is not enabled - -Then the condition becomes: - -- `True` -- `NotRequired` - -2. Encryption is enabled and valid - -Then the condition becomes: - -- `True` -- `OK` -- `Encryption configuration is valid` - -### When `EncryptionConfigured=False` happens - -Examples: - -- referenced secret missing -- invalid secret contents -- invalid age configuration -- `generateWhenMissing` disabled but secret absent - -If encryption is not configured correctly: - -- `SnapshotSynced` stays not started -- `EventStreamLive` stays not started -- `Ready=False` - -## Where The New SOPS Secret Is Created - -Yes, this is currently part of the `GitTarget` controller lifecycle. - -The generated age Secret is created by: - -- `ensureEncryptionSecret(...)` -- `createGeneratedEncryptionSecret(...)` - -in: - -- [internal/controller/gittarget_controller.go](/workspaces/gitops-reverser/internal/controller/gittarget_controller.go) - -### When this happens - -It happens during the `EncryptionConfigured` gate, not during bootstrap and not in the branch worker. - -So the flow is: - -1. `GitTarget` enters encryption evaluation -2. if `generateWhenMissing=true`, controller checks whether the Secret exists -3. if it does not exist, controller generates an age identity -4. controller creates or updates the Kubernetes Secret -5. then the controller resolves encryption config again - -### Important consequence - -The generated SOPS Secret is: - -- a Kubernetes resource concern -- handled by the `GitTarget` controller - -It is **not** created by: - -- bootstrap file staging -- the branch worker -- the git write path - -## What `SnapshotSynced` Means - -`SnapshotSynced` means: - -- the initial cluster snapshot for this `GitTarget` path has been reconciled against the Git path - -This is handled in: - -- `evaluateSnapshotGate(...)` - -and depends on: - -- the event router -- a `GitTargetEventStream` -- a branch worker -- a folder reconciler - -Relevant files: - -- [internal/controller/gittarget_controller.go](/workspaces/gitops-reverser/internal/controller/gittarget_controller.go) -- [internal/reconcile/git_target_event_stream.go](/workspaces/gitops-reverser/internal/reconcile/git_target_event_stream.go) - -### What happens in this gate - -The controller: - -1. ensures there is a `GitTargetEventStream` -2. puts it into reconciling/buffering mode -3. starts initial snapshot reconciliation -4. waits until both cluster state and repo state have been seen -5. records snapshot stats and completion time - -### Why this gate matters - -It prevents live watch events from racing ahead of the first consistent path sync. - -## What `EventStreamLive` Means - -`EventStreamLive` means: - -- the `GitTargetEventStream` has transitioned from reconciliation/buffering mode into normal live processing - -Handled in: - -- `evaluateEventStreamGate(...)` - -This is the final gate before `Ready=True`. - -If it fails: - -- `Ready=False` -- reason becomes stream-related, not validation-related - -## What `Ready` Means - -`Ready=True` means: - -- `Validated=True` -- `EncryptionConfigured=True` -- `SnapshotSynced=True` -- `EventStreamLive=True` - -and the controller sets: - -- `reason: OK` -- `message: All lifecycle gates satisfied` - -So `Ready` is now the final summary condition, while the other lifecycle conditions explain which stage is blocking. - -## Where Bootstrap Fits In Now - -Bootstrap is no longer a user-visible lifecycle condition. - -There is no current `Bootstrapped` condition in the `GitTarget` status path. - -### What bootstrap means now - -Bootstrap is an internal worktree preparation step that makes sure: - -- `README.md` -- `.sops.yaml` when needed - -exist inside the target path in the local repository worktree. - -Relevant code: - -- [internal/git/branch_worker.go](/workspaces/gitops-reverser/internal/git/branch_worker.go) - - `EnsurePathBootstrapped(...)` - - `prepareBootstrapRepository(...)` -- [internal/git/bootstrapped_repo_template.go](/workspaces/gitops-reverser/internal/git/bootstrapped_repo_template.go) - - `ensureBootstrapTemplateInPath(...)` - -### Important distinction - -Bootstrap is now: - -- local repo/worktree preparation - -not: - -- a dedicated `GitTarget` phase -- a separate status gate -- a separate init commit - -### Relationship to encryption - -Bootstrap and encryption do work together, but indirectly: - -- `GitTarget` controller resolves encryption configuration -- branch worker uses resolved recipients to decide whether `.sops.yaml` should be included -- bootstrap file rendering uses those recipients when writing `.sops.yaml` - -So: - -- the Secret is generated by the controller -- the `.sops.yaml` file is rendered by the git layer - -They are related, but they are not created by the same subsystem. - -## Current Repo/Bootstrap Flow In Practice - -For a path that needs to be written: - -1. branch worker prepares or reuses the local repo -2. branch worker calls `PrepareBranch(...)` -3. bootstrap files may be ensured in the local worktree -4. resource files are written or deleted -5. commit generation happens -6. push happens - -This means the worktree is the place where bootstrap and resource files come together before commit. - -## Important Current Architectural Tension - -Right now the lifecycle assumes: - -- a branch worker will exist by the time snapshot/event-stream setup runs - -But the recent e2e investigation suggests that this assumption is currently broken in at least one path. - -That is why the failing `GitTarget` gets stuck at: - -- `Validated=True` -- `EncryptionConfigured=True` -- `SnapshotSynced=False` - -with: - -- `branch worker not found` - -So the current architecture is: - -- conceptually clear -- but still missing a reliable worker-materialization step before snapshot startup - -## Short Answer Summary - -### Where is the local Git repo working directory created and managed? - -By the branch worker, under: - -- `/tmp/gitops-reverser-workers/...` - -using: - -- `repoRootPath()` -- `repoPathForRemote()` -- `PrepareBranch(...)` - -### What does `Validated` mean exactly? - -It means: - -- provider exists -- branch is allowed -- no conflicting `GitTarget` owns the same provider+branch+path - -It does **not** mean repo/worker/bootstrap is ready yet. - -### When do we jump to `Validated=True`? - -Immediately after provider validation and conflict checks pass, before encryption and before snapshot. - -### Where is the new SOPS Secret created? - -In the `GitTarget` controller during the `EncryptionConfigured` gate, via: - -- `ensureEncryptionSecret(...)` -- `createGeneratedEncryptionSecret(...)` - -### Is that tied to bootstrap? - -Only indirectly. - -- the controller creates the Kubernetes Secret -- the git layer later uses the resolved recipients to render `.sops.yaml` - -So bootstrap is no longer a lifecycle phase, but it still depends on encryption being resolved correctly. diff --git a/docs/design/gittarget-state-machine-bootstrap-assessment.md b/docs/design/gittarget-state-machine-bootstrap-assessment.md deleted file mode 100644 index b035e48d..00000000 --- a/docs/design/gittarget-state-machine-bootstrap-assessment.md +++ /dev/null @@ -1,438 +0,0 @@ -# GitTarget Startup State Machine and Status Contract - -## Purpose - -Define a concrete implementation plan for `GitTarget` startup lifecycle and status design, integrating: - -- explicit startup gates (validation, encryption, bootstrap, initial snapshot, stream-live), -- Kubernetes condition best practices, -- current `gitops-reverser` CRD/controller patterns. - -This document supersedes the earlier bootstrap-only assessment and aligns with `docs/design/status-design-git-target.md`. - -## Current Repo Landscape (What Exists Today) - -## Existing CRD status patterns - -- `GitTarget.status` currently has: - - `conditions []metav1.Condition` - - `lastPushTime *metav1.Time` -- `GitProvider`, `WatchRule`, `ClusterWatchRule` status currently use condition-driven readiness and do not expose `phase`. -- Across controllers, the dominant pattern is a single `Ready` condition with reason/message updates. - -## Existing startup behavior - -Current `GitTarget` reconcile path (`internal/controller/gittarget_controller.go`) effectively does: - -1. Validate provider/branch/conflict. -2. Ensure encryption secret (optional auto-create). -3. Register worker and event stream. -4. Signal stream transition via `OnReconciliationComplete()`. - -Bootstrap and startup synchronization exist, but they are implicit side effects across controller, worker manager, branch worker, and event stream. - -## Key Gaps - -1. Startup gates are not represented as first-class conditions. -2. Initial snapshot sync (including stale-file deletion) is not an explicit lifecycle gate in status. -3. Worker manager lock scope includes slow bootstrap work. -4. Status today is not explicit enough for operators to answer "what gate is blocking readiness". - -## Naming Alignment With Current CRDs - -Use current schema names from `api/v1alpha3`: - -- `spec.providerRef` (not `destinationRef`, not `gitRepoConfigRef`) -- `spec.encryption.provider` -- `spec.encryption.secretRef.name` -- `spec.encryption.generateWhenMissing` - -Status additions should extend `GitTargetStatus` while preserving existing fields such as `lastPushTime` -for compatibility. - -## Proposed GitTarget Status Contract - -## Required top-level fields - -- `observedGeneration int64` -- `conditions []metav1.Condition` -- `lastReconcileTime metav1.Time` - -Keep existing: - -- `lastPushTime *metav1.Time` - -## Optional detail blocks (recommended) - -- `workerRef {name, uid}` -- `encryption {provider, secretRefName, recipientsHash, lastValidatedTime}` -- `bootstrap {targetPath, commit, lastAppliedTime}` -- `snapshot {lastCompletedTime, stats{created,updated,deleted}}` -- `stream {registered bool, registeredTime, lastEventTime}` - -These are observational only; they must never become desired-state inputs. - -## Condition Types and Ready Semantics - -## Condition types - -Required gate conditions: - -- `Ready` (summary) -- `Validated` -- `EncryptionConfigured` -- `Bootstrapped` -- `SnapshotSynced` -- `EventStreamLive` - -Optional UX condition: - -- `Reconciling` - -## Ready semantics - -`Ready=True` iff all required gates are true: - -- `Validated=True` -- `EncryptionConfigured=True` (or `True` with `NotRequired`) -- `Bootstrapped=True` -- `SnapshotSynced=True` -- `EventStreamLive=True` - -## Canonical reason set - -- `Validated`: `OK`, `ProviderNotFound`, `BranchNotAllowed`, `TargetConflict` -- `EncryptionConfigured`: `OK`, `NotRequired`, `MissingSecret`, `InvalidConfig`, `SecretCreateDisabled` -- `Bootstrapped`: `BootstrapApplied`, `BootstrapNotNeeded`, `WorkerNotFound`, `BootstrapFailed` -- `SnapshotSynced`: `Running`, `Completed`, `SnapshotFailed` -- `EventStreamLive`: `Registered`, `RegistrationFailed`, `Disconnected` -- `Ready`: `OK`, `ValidationFailed`, `EncryptionNotConfigured`, `BootstrapNotComplete`, `InitialSyncInProgress`, `StreamNotLive` - -## Deterministic condition mechanics - -Implement one shared upsert helper (recommended: shared utility reusable by all controllers): - -- condition set behaves as map keyed by `Type`, -- no duplicate types, -- `LastTransitionTime` changes only when `Status` changes, -- `Reason` and `Message` always refreshed, -- condition-level `ObservedGeneration` set on update, -- unevaluated gates start as `Unknown` with explicit reason (`NotChecked`/`NotStarted`/`Blocked`). - -## Proposed Startup Lifecycle (Gate Pipeline) - -Each reconcile evaluates gates in order and writes status before returning on block: - -1. `Validated` -- Check provider exists, branch allowed, no target conflict. -- If false: `Ready=False`, stop. - -2. `EncryptionConfigured` -- If encryption disabled: set `True/NotRequired`. -- If enabled: resolve config, ensure secret, validate recipient derivation input. -- If false: `Ready=False`, stop. - -3. `Bootstrapped` -- Ensure worker exists and target path bootstrap is applied/idempotent. -- Capture bootstrap commit when created. -- If false: `Ready=False`, stop. - -4. `SnapshotSynced` -- Trigger initial full snapshot reconciliation. -- Must include create/update/delete reconciliation for target path. -- Keep `SnapshotSynced=False, reason=Running` until complete. -- If failed: `SnapshotSynced=False, reason=SnapshotFailed`, stop. - -5. `EventStreamLive` -- Register/verify stream only after initial snapshot success. -- Call `OnReconciliationComplete()` only at this point. -- If false: `Ready=False`, stop. - -6. `Ready` -- Compute from gate conditions only. - -## Status YAML Examples - -These are illustrative snapshots of `GitTarget.status` for key situations. - -## 1. Validation blocked (missing provider) - -```yaml -status: - observedGeneration: 7 - lastReconcileTime: "2026-02-19T10:10:11Z" - conditions: - - type: Validated - status: "False" - reason: ProviderNotFound - message: "Referenced GitProvider 'sut/main-provider' not found" - observedGeneration: 7 - lastTransitionTime: "2026-02-19T10:10:11Z" - - type: EncryptionConfigured - status: Unknown - reason: Blocked - message: "Blocked by Validated=False" - observedGeneration: 7 - lastTransitionTime: "2026-02-19T10:10:11Z" - - type: Bootstrapped - status: Unknown - reason: Blocked - message: "Blocked by Validated=False" - observedGeneration: 7 - lastTransitionTime: "2026-02-19T10:10:11Z" - - type: SnapshotSynced - status: Unknown - reason: NotStarted - message: "Initial snapshot sync has not started" - observedGeneration: 7 - lastTransitionTime: "2026-02-19T10:10:11Z" - - type: EventStreamLive - status: Unknown - reason: NotStarted - message: "Event stream activation has not started" - observedGeneration: 7 - lastTransitionTime: "2026-02-19T10:10:11Z" - - type: Ready - status: "False" - reason: ValidationFailed - message: "Validated gate failed: ProviderNotFound" - observedGeneration: 7 - lastTransitionTime: "2026-02-19T10:10:11Z" -``` - -## 2. Encryption blocked (secret missing + autocreate disabled) - -```yaml -status: - observedGeneration: 8 - lastReconcileTime: "2026-02-19T10:13:45Z" - conditions: - - type: Validated - status: "True" - reason: OK - message: "Provider and branch validation passed" - observedGeneration: 8 - lastTransitionTime: "2026-02-19T10:13:40Z" - - type: EncryptionConfigured - status: "False" - reason: SecretCreateDisabled - message: "Encryption secret sut/sops-age-key is missing and generateWhenMissing is false" - observedGeneration: 8 - lastTransitionTime: "2026-02-19T10:13:45Z" - - type: Bootstrapped - status: Unknown - reason: Blocked - message: "Blocked by EncryptionConfigured=False" - observedGeneration: 8 - lastTransitionTime: "2026-02-19T10:13:45Z" - - type: Ready - status: "False" - reason: EncryptionNotConfigured - message: "EncryptionConfigured gate failed: SecretCreateDisabled" - observedGeneration: 8 - lastTransitionTime: "2026-02-19T10:13:45Z" -``` - -## 3. Snapshot running (initial create/delete reconciliation in progress) - -```yaml -status: - observedGeneration: 9 - lastReconcileTime: "2026-02-19T10:18:02Z" - conditions: - - type: Validated - status: "True" - reason: OK - message: "Provider and branch validation passed" - observedGeneration: 9 - lastTransitionTime: "2026-02-19T10:17:54Z" - - type: EncryptionConfigured - status: "True" - reason: OK - message: "Encryption configuration is valid" - observedGeneration: 9 - lastTransitionTime: "2026-02-19T10:17:55Z" - - type: Bootstrapped - status: "True" - reason: BootstrapApplied - message: "Bootstrap commit applied for path clusters/prod" - observedGeneration: 9 - lastTransitionTime: "2026-02-19T10:17:57Z" - - type: SnapshotSynced - status: "False" - reason: Running - message: "Initial snapshot reconciliation in progress" - observedGeneration: 9 - lastTransitionTime: "2026-02-19T10:18:02Z" - - type: EventStreamLive - status: Unknown - reason: Blocked - message: "Blocked until SnapshotSynced=True" - observedGeneration: 9 - lastTransitionTime: "2026-02-19T10:18:02Z" - - type: Ready - status: "False" - reason: InitialSyncInProgress - message: "SnapshotSynced gate is still running" - observedGeneration: 9 - lastTransitionTime: "2026-02-19T10:18:02Z" - snapshot: - stats: - created: 12 - updated: 3 - deleted: 2 -``` - -## 4. Stream registration failed after snapshot success - -```yaml -status: - observedGeneration: 9 - lastReconcileTime: "2026-02-19T10:18:17Z" - conditions: - - type: Validated - status: "True" - reason: OK - message: "Provider and branch validation passed" - observedGeneration: 9 - lastTransitionTime: "2026-02-19T10:17:54Z" - - type: EncryptionConfigured - status: "True" - reason: OK - message: "Encryption configuration is valid" - observedGeneration: 9 - lastTransitionTime: "2026-02-19T10:17:55Z" - - type: Bootstrapped - status: "True" - reason: BootstrapNotNeeded - message: "Bootstrap files already present" - observedGeneration: 9 - lastTransitionTime: "2026-02-19T10:17:57Z" - - type: SnapshotSynced - status: "True" - reason: Completed - message: "Initial snapshot reconciliation completed" - observedGeneration: 9 - lastTransitionTime: "2026-02-19T10:18:14Z" - - type: EventStreamLive - status: "False" - reason: RegistrationFailed - message: "Failed to register GitTargetEventStream for sut/prod-target" - observedGeneration: 9 - lastTransitionTime: "2026-02-19T10:18:17Z" - - type: Ready - status: "False" - reason: StreamNotLive - message: "EventStreamLive gate failed: RegistrationFailed" - observedGeneration: 9 - lastTransitionTime: "2026-02-19T10:18:17Z" -``` - -## 5. Fully ready - -```yaml -status: - observedGeneration: 10 - lastReconcileTime: "2026-02-19T10:22:01Z" - lastPushTime: "2026-02-19T10:21:58Z" - conditions: - - type: Validated - status: "True" - reason: OK - message: "Provider and branch validation passed" - observedGeneration: 10 - lastTransitionTime: "2026-02-19T10:21:40Z" - - type: EncryptionConfigured - status: "True" - reason: NotRequired - message: "Encryption is not configured for this GitTarget" - observedGeneration: 10 - lastTransitionTime: "2026-02-19T10:21:40Z" - - type: Bootstrapped - status: "True" - reason: BootstrapNotNeeded - message: "Bootstrap files already present" - observedGeneration: 10 - lastTransitionTime: "2026-02-19T10:21:41Z" - - type: SnapshotSynced - status: "True" - reason: Completed - message: "Initial snapshot reconciliation completed" - observedGeneration: 10 - lastTransitionTime: "2026-02-19T10:21:47Z" - - type: EventStreamLive - status: "True" - reason: Registered - message: "GitTarget event stream is live" - observedGeneration: 10 - lastTransitionTime: "2026-02-19T10:21:48Z" - - type: Ready - status: "True" - reason: OK - message: "All lifecycle gates satisfied" - observedGeneration: 10 - lastTransitionTime: "2026-02-19T10:21:48Z" -``` - -## Phase Field Analysis (Repo-Wide) - -## What the repo currently does - -- No current CRD status type includes `phase`. -- Existing resources (`GitProvider`, `WatchRule`, `ClusterWatchRule`, `GitTarget`) expose readiness through conditions. -- Automation expectations are already condition-centric (`Ready`). - -## Recommendation - -Do not add `status.phase` in the first implementation step. - -Rationale: - -- It is not used elsewhere in the project today. -- It adds one more state surface to maintain and test. -- Conditions already provide machine-readable and human-readable gate state. - -If added later for UX, keep it strictly derived from conditions and informational only. Suggested derived values: - -- `PENDING`, `BOOTSTRAPPING`, `SYNCING`, `RUNNING` - -But phase must never be used as an automation contract. - -## Refactor Strategy - -1. Split worker registration APIs: -- `EnsureWorker(...)` under short lock. -- `EnsureTargetBootstrapped(...)` outside manager global lock. - -2. Introduce GitTarget gate-condition pipeline in reconciler. - -3. Add initial snapshot completion barrier before stream live transition. - -4. Add shared condition helper and migrate GitTarget to it first. - -5. Optionally follow-up by migrating `GitProvider`/`WatchRule`/`ClusterWatchRule` to same helper for consistency. - -## Testing Plan - -## Unit - -- Condition helper upsert behavior (no duplicates, transition-time semantics). -- Gate evaluation table tests for each block point. -- Ready aggregation tests. - -## Integration - -- Startup progression assertions on conditions: - - validate -> encryption -> bootstrap -> snapshot -> stream -> ready. -- Snapshot gate explicitly verifies stale-file deletion path. -- `kubectl wait --for=condition=Ready=true gittarget/` compatibility. -- Optional: `kubectl wait --for=condition=SnapshotSynced=true` if exposed. - -## Minimal First Delivery - -1. Add gate conditions on `GitTarget` (without adding `phase`). -2. Move bootstrap out of `WorkerManager` global lock scope. -3. Add initial snapshot sync gate and block stream-live transition until complete. -4. Keep `Ready` as summary contract. - -This delivers the main operational clarity and race/ordering improvements with minimal API churn. diff --git a/docs/design/manifest/e2e-full-suite-flakiness-findings-2026-06.md b/docs/design/manifest/e2e-full-suite-flakiness-findings-2026-06.md deleted file mode 100644 index dbf20474..00000000 --- a/docs/design/manifest/e2e-full-suite-flakiness-findings-2026-06.md +++ /dev/null @@ -1,243 +0,0 @@ ---- -title: e2e full-suite flakiness — forensic findings (poc/manifestedit, June 2026) -status: investigation -date: 2026-06-09 -related: - - e2e-watchrule-cross-spec-interference.md - - e2e-full-suite-shared-state-investigation.md ---- - -# e2e full-suite flakiness — forensic findings - -This records a concrete investigation triggered while hardening the -contextual-namespace work on `poc/manifestedit`. The local `task test-e2e` was -red while GitHub CI was green. This document starts with the raw facts, then -interprets them, then states what is and is not the cause. - -## 1. Facts and observations (no interpretation yet) - -### 1.1 CI was green on the recent commits - -The last five `CI` runs on `poc/manifestedit` were all `success` (`gh run list`, -2026-06-08): - -| Run | Commit subject | Result | When | -|---|---|---|---| -| 27161369593 | feat: flexible manifests | success | 2026-06-08T19:21:52Z | -| 27160517400 | feat: flexible manifests | success | 2026-06-08T19:06:00Z | -| 27156885656 | feat: flexible manifests | success | 2026-06-08T17:59:24Z | -| 27153490992 | feat: flexible manifests | success | 2026-06-08T17:09:07Z | -| 27144704089 | feat: flexible manifests | success | 2026-06-08T14:29:21Z | - -`main` is green as well. The newest green run corresponds to the branch HEAD -commit `72df204` ("chore: re-enable serial and updating architecture"). - -CI runs the full suite via `task test-e2e` at **`E2E_GINKGO_PROCS=4`** with **no -`--flake-attempts`/retry** (`.github/workflows/ci.yml`; the matrix even comments -"Validated locally at --procs=4; trialing the same in CI"). So CI's parallelism is -the same as the local run, and there is no retry masking failures. - -### 1.2 CI never tested the code that was red locally - -The green CI runs validated the **committed** tree at `72df204`. At the time of -this investigation the working tree additionally contained, all **uncommitted**: - -- the contextual-namespace hardening (`internal/manifestanalyzer/store.go`, - `internal/git/plan_flush.go`); -- a **new** e2e spec, `Manager Manifest Folder Editing` - (`test/e2e/inplace_edit_e2e_test.go`) — `git log` on that file shows the - committed version contains **zero** occurrences of "Manifest Folder Editing"; -- timeout bumps in `test/e2e/crd_lifecycle_e2e_test.go` (60s → 2m). - -Therefore **CI has never run this working tree**, and in particular has never run -the new manifest-folder spec. "CI is green" and "local is red" were never the same -code. - -### 1.3 Local full-suite runs (same box, same cluster, procs=4 unless noted) - -| Run | Tree / image | Procs | Result | -|---|---|---|---| -| A | working tree (hardening + new specs) | 4 | **12 failed**, 17 passed, 24 skipped | -| B | `inplace-edit` label only (the feature) | 1 | **0 failed**, 2 passed | -| C | committed baseline `72df204` (stashed) | 4 | **1 failed**, 39 passed | -| D | working tree, re-run | 4 | **8 failed**, 22 passed | -| E | hardening image + baseline spec set (no new spec) | 4 | **10 failed**, 17 passed | - -The failure **count is high-variance** (1, 8, 10, 12) across nominally-similar -runs. Only B (serial, the feature in isolation) was clean. - -### 1.4 Every failure is one of two shapes - -- `status.conditions not found` — a **WatchRule** that never received *any* status - for 90s (`e2e_test.go:224` → `:194`). The GitTarget for the same spec **does** - reach Ready; only the WatchRule hangs. -- `CRD file should exist … icecreamorders…crd…: no such file` at **60s** - (`crd_lifecycle_e2e_test.go:150`) — the CRD-install commit did not land in time. - -The single baseline failure (run C) was the second shape. - -### 1.5 Controller health and the reflector noise - -- The controller pod was `Ready`, **Restart Count 0**, no panic, across all runs. -- The logs carry **403** repetitions of - `Failed to watch … icecreamorders.crd-lifecycle.e2e.example.com … the server - could not find the requested resource` — a reflector retrying a CRD that a spec - has deleted. -- Specs that only validate a `GitProvider` (no WatchRule readiness) passed every - run. The failing specs are the ones that need a WatchRule to go Ready and/or - touch the `icecreamorders` custom resource (CRD Lifecycle, the wildcard - custom-API WatchRule, Bi-Directional IceCreamOrder, Aggregated API, plus - WatchRule-bootstrap-dependent specs caught in the wave). - -## 2. What the code actually does (mechanism) - -Read against current `main`-line code, not the older design notes: - -1. **The catalog tolerates partial discovery.** `discoverCatalogRefresh` - (`internal/watch/api_resource_catalog.go`) treats `*ErrGroupDiscoveryFailed` - as partial success: it keeps the healthy groups, marks the failed group - degraded (keeping its last-known entries), and sets `complete=false` so no - group is removed on a wobble. `Registry.Ready()` is a **latch** — once the - surface has been observed it stays ready. **So a single deleted CRD does not - flip the global registry to not-ready and does not fail-close unrelated - GitTargets through the catalog/snapshot path.** - -2. **The snapshot mark-and-sweep is GitTarget-global and content-derived, and it - fails closed on purpose.** `StreamClusterSnapshotForGitDest` / - `resolveSnapshotGVRs` (`internal/watch/snapshot_stream.go`) abort the whole - snapshot if any watched type is within the `RemovalGrace` (60s) and currently - unserved, because `Desired` is the complete set and the worker deletes any git - doc **not** in `Desired` — snapshotting "only the healthy types" would sweep - the retained type's mirror. This is anti-destruction safety, not a bug. - -3. **The block is bootstrap-only.** `evaluateSnapshotGate` - (`internal/controller/gittarget_controller.go:390`) does **not** re-run the - resync once `SnapshotSynced` is true. An already-live GitTarget is **not** - knocked offline by a later type wobble; "one type fails the whole GitTarget" - only bites during the *initial* snapshot. - -4. **Event routing is live against the RuleStore.** `handleEvent` → - `matchRules` → `RuleStore.GetMatchingRules` (a live read of the store map) → - `routeWatchRules` (`internal/watch/informers.go`, `internal/watch/manager.go`). - On WatchRule deletion the controller calls `RuleStore.Delete` - (`internal/controller/watchrule_controller.go:85`), which removes the rule from - that same map. **A deleted WatchRule therefore stops matching immediately** — - the only residual is the sub-second async window before the delete-reconcile - runs. - -## 3. Diagnosis - -The first instinct is to reach for the two mechanisms in -[e2e-watchrule-cross-spec-interference.md](e2e-watchrule-cross-spec-interference.md) -(April 2026). **Both are already fixed in current code**, and were verified -*inactive* in these runs — so neither is the cause here: - -- **Not the preservation cascade.** `markSuiteWidePreservation` - (`test/e2e/suite_state.go`) is called only on a **BeforeSuite failure** or an - **OS signal** (`e2e_suite_test.go:57,281`), never on a per-spec failure — the - current comment is explicit: "Per-spec failures deliberately do NOT preserve: the - run finishes, cleanup runs, and the next spec starts from a known clean state." - All four captured run logs contain **zero** `Preserving e2e resources` and - **zero** `skipping cleanup for` lines, confirming preservation never engaged. -- **Not ghost-WatchRule routing.** Matching is live against the RuleStore and - deletion removes the rule (§2.4), so a deleted WatchRule stops matching at once. - A "drain on delete" change would fix a non-bug. - -What *is* going on: - -- **Root trigger: discovery-cache lag after a fresh CRD install.** - `e2e_test.go:220` literally notes "after a fresh CRD install the controller's - discovery cache can lag tens of seconds." Under load that lag exceeds the - CRD-lifecycle spec's 60s budget, so that spec fails — the one failure baseline - run C also showed. -- **The 403 `icecreamorders` reflector burst is bounded, not a runaway drain.** A - type that leaves the watched set has its informer cancelled by - `stopInformerNamespace` (`internal/watch/manager.go:599`). The type lingers only - for the 60s `RemovalGrace` (so a discovery wobble never sweeps git), during which - the running informer's reflector retries the now-absent CRD and logs the 403s. - After the grace it is stopped. So the 403s are a ~60s burst per CRD deletion, not - an unbounded hot-loop. -- **The wave is resource/timing contention under local `--procs=4`, not a named - bug.** Every failing spec is wall-clock-bound on asynchronous discovery / - WatchRule readiness (60–90s windows). A constrained dev box running a heavy - ~50-spec suite four-wide — plus CRD-lifecycle create/delete churn and (in the - working-tree runs) one extra heavy concurrent spec — pushes marginal reconciles - past those windows. That a *type wobble* anywhere makes the whole **bootstrapping** - GitTarget wait (§2.2–2.3) concentrates the pain on WatchRule-readiness specs. The - high-variance count (1→8→10→12) is the signature of timing/scheduling, not a - deterministic regression. - -## 4. The interesting case: green CI, reproducibly-red local - -Three independent reasons stack, and together they fully explain it: - -1. **Different code.** CI validated `72df204`; the red local runs validated an - uncommitted tree that adds a heavy new spec CI never ran (§1.2). A green CI here - says nothing about the working tree. -2. **Timing/load, not logic.** Both failure shapes are wall-clock timeouts around - asynchronous discovery/WatchRule machinery, not assertion-of-wrong-content. A - more constrained local box under `--procs=4`, plus one extra heavy concurrent - spec, tips marginal reconciles past their 60–90s windows. CI's `ubuntu-latest` - has more headroom. -3. **The suite is timing-sensitive here.** The failing specs already carry a trail - of band-aids (`e2e-watchrule-cross-spec-interference.md`), and the branch's own - recent history bumped the CRD-lifecycle timeout — evidence the author was already - fighting this class of flake. Note the *named* bugs from that April doc (ghost - routing, preservation cascade) are now fixed (§3); what remains is the wall-clock - sensitivity itself. - -The trap worth naming: **a green CI lulls you into thinking the suite validates -your working tree.** It validated a different commit. And because the failure -*count* of a cascade-prone suite is high-variance, a single green or red run proves -little on its own — only the serial isolation run (B) is a clean signal. - -## 5. Was the contextual-namespace hardening responsible? No. - -- The feature passes **serially in isolation** (run B, 2/2), so its own code path - is correct end to end. -- The hardening code is a **no-op for every failing spec**: it only does work when - a `kustomization.yaml` is present in the GitTarget's watched worktree, and none - of the failing specs' folders have one. -- It does not touch the WatchRule reconciler, `internal/watch`, or - `internal/typeset` — the paths that own WatchRule readiness and the catalog. -- The 1-vs-{8,10,12} spread is cascade variance + the extra spec's load (run E, - with the *baseline* spec set but the hardening image, still produced 10 — i.e. - the spread tracks parallel cascade, not the image). - -## 6. Recommendations (ordered by leverage ÷ risk) - -The honest headline: there is **no warranted controller "quick fix"** here. The two -bugs one would reach for are already fixed, and the reflector burst is bounded. The -residual is wall-clock contention, addressed by lowering load or asserting on -signals — and, properly, by the already-designed M10 work. - -1. **Lower local parallelism (zero-risk, immediate).** Run `E2E_GINKGO_PROCS=2` (or - 1) locally; the suite is reliably green serially. CI keeps `--procs=4` because - `ubuntu-latest` has the headroom. This is a runner-budget knob, not a code fix. -2. **Reduce the CRD-install discovery-lag flake (the usual *root* trigger).** The - 60s→2m timeout bump is a reasonable band-aid; the durable fix is making - ClusterWatchRule type-expansion react to the CRD-install event faster, or - asserting on a controller signal/metric rather than a wall-clock window. -3. **Reduce cross-spec timing coupling (test infra).** Specs in the Manager block - share a namespace/repo; even with correct cleanup, async timing couples them - under load. Unique namespaces per spec (recommendation #3 of - `e2e-watchrule-cross-spec-interference.md`) decouples them by construction. -4. **Per-type reconcile (the proper, larger fix).** So a single bootstrapping type - that is slow/unhealthy does not block the whole GitTarget's readiness — the one - real product-side contributor (§2.2–2.3). It requires a **type-scoped** sweep, - which is exactly why it is not a safe sliver on top of today's global - mark-and-sweep. -5. **Do not** add a ghost-WatchRule drain or a preservation-cascade fix — both are - already handled in current code (§3). Verify before reviving an old root cause. - -## 7. Appendix: how each claim was checked - -- CI status/commit: `gh run list --branch poc/manifestedit`. -- "CI never ran the new spec": `git log -p -1 -- test/e2e/inplace_edit_e2e_test.go` - on the committed tree → 0 hits for "Manifest Folder Editing". -- Baseline reproduction: `git stash -u` to `72df204`, `E2E_GINKGO_PROCS=4 task - test-e2e` → 1 failure (the CRD-install lag), proving the redness is not the - uncommitted code. -- Feature correctness: `ginkgo --procs=1 --label-filter='inplace-edit'` → 2/2. -- Mechanism: direct reads of `api_resource_catalog.go`, `snapshot_stream.go`, - `gittarget_controller.go`, `informers.go`, `manager.go`, `rulestore/store.go`. diff --git a/docs/design/manifest/file-agnostic-placement.md b/docs/design/manifest/file-agnostic-placement.md deleted file mode 100644 index 388f6909..00000000 --- a/docs/design/manifest/file-agnostic-placement.md +++ /dev/null @@ -1,26 +0,0 @@ -The whole cool thing of KRM and the Kubernetes API is that the exact content of the YAML file contains everything needed to reflect the actual resource inside the Kuberntes API. The actual location of the file doesnt matter. - -At this moment gitops-reverser has a fixed convention on where it expects/places files. Obviously the placement of new files is something that always needs some rule (either hardcoded or fixed). But why would it be important to start workin? For normal GitOps application like ArgoCD or Flux it's also not important (ok, if configured well offcourse). - -There is some interesting problems to this: -* It's normal/allowed in YAML files to place multiple resources in one file, the `/n---/n` trick is used as seperator. -* For some resources it would be very beneficial to NOT write the namespace, actually all my examples until now have the problem that it's not entirly logical to also place the namespace. It might be a nice option on a GitTarget to drop it. -* Most examples also would have benefitted from having a simple folder based set of 'bootstrap' files. I already do this for the .sops.yaml file, but why not for a simple kustomization.yaml? Which allows to easily hook it up to normal GitOps tools and deploy it into a different namespace? -* It would be very logical for people to hook up a cloud version of this to an existing Gitrepo: I will never be able to support everyhing but to be so strict in where files are to placed is madness, then it will certainly not work. - -Requirements: -* Parse an existing folder and parse all yaml/KRM that can be found in it. - * Have a notion / index of this (can be in memory) so that I can write back changes or updates at the right place. -* Recognize a kustomization / the current structure and be able to not write the namespace. -* Be able to (or even require GitOps tooling!) to stream the initial set of yamls into some location so that we can start looking for changes. Not sure how to cope with this one, it's again a form if bidirectional GitOps. -* Detect helm shizzle and ignore it with a good error message. -* Detect Kustomize and only support the very basic constructs in both directions (what would that exactly look like). - -The dream would to be able to point gitops-reverser (potenially combined with flux for example) at a folder and to be able to provide a GitOps API for it without even thinking. People would have insigt in which objects are detected, they can edit them and a pull request is automatically created out of it. - -Boundries: -* I don't believe that gitops-reverser should get knowledge on things like GitHub (so creating that PR is a respnsiblity for another layer, but pushing changes to a branch is fine). -* We really shouldnt get into the details of kustomize or helm to soon: we can also start with a clean folder of yaml manifests. - -Follow-up investigation: -* [contextual-namespace-and-kustomize-folder-editing.md](contextual-namespace-and-kustomize-folder-editing.md) diff --git a/docs/design/manifest/gitpathaccepted-projection-race-and-external-drift.md b/docs/design/manifest/gitpathaccepted-projection-race-and-external-drift.md deleted file mode 100644 index decbf7f3..00000000 --- a/docs/design/manifest/gitpathaccepted-projection-race-and-external-drift.md +++ /dev/null @@ -1,447 +0,0 @@ ---- -title: GitPathAccepted projection race + external-git-drift reconcile gap -status: investigation -date: 2026-06-28 -related: - - e2e-full-suite-flakiness-findings-2026-06.md - - reconcile-via-watchlist-mark-and-sweep.md ---- - -# GitPathAccepted projection race + the external-git-drift reconcile gap - -This document records two related defects discovered from a single CI failure. - -1. A **race** that lets a GitTarget's `GitPathAccepted` condition lag the actual - data-plane refusal by up to 10 minutes — the proximate cause of the CI flake. -2. A **deeper, pre-existing gap**: when something changes the Git repo - out-of-band (an external push, a human deleting files), nothing re-runs the - path's reconcile to bring it back in line with the cluster, even though the - cluster (kube-api) is the source of truth. - -It follows the house style: **raw facts first**, then interpretation, then what -is and is not the cause, then the design direction. - ---- - -## 1. Facts and observations (no interpretation yet) - -> **Update (2026-07-07, secret-value-retention):** §1 is a point-in-time snapshot of the -> code at investigation time. Two facts below have since changed. (1) The GitTarget -> control-plane **Secret watch was removed**, so `SetupWithManager` now watches -> `GitProvider`, `WatchRule`, and `ClusterWatchRule` — not `Secret` (§1.5). (2) The -> `RequeueShortInterval`/`RequeueLongInterval` split (2 min / 10 min) collapsed into a single -> 5-minute `RequeueSteadyInterval`, so the happy-path GitTarget reconcile requeues after -> **5 minutes, not 10** (§1.5, §2). The projection-race analysis and its GitPath-channel fix -> are otherwise unaffected. See -> [`../../security-model.md`](../../security-model.md). - -### 1.1 The failure - -CI run [`28331751067`](https://github.com/ConfigButler/gitops-reverser/actions/runs/28331751067) -on branch `investigate` (head `a555d9d`) failed on **attempt 1** and passed on the -**re-run (attempt 2)**. - -- Of all jobs, only **E2E (full)** failed. Build, Unit tests, Lint, Helm, and - **E2E (quickstart)** all passed. -- Within E2E (full): **51 Passed | 1 Failed | 0 Pending | 8 Skipped**. -- The one failing spec: - - > **Manager Foreign Content Refusal → "refuses a loose foreign file without - > writing"** — `test/e2e/foreign_content_e2e_test.go:104` - -- The assertion that timed out (`waitForGitTargetGitPathRefused`, defined in - `test/e2e/unsupported_folder_e2e_test.go:161`): - - ``` - [FAILED] Timed out after 150.000s. - GitPathAccepted must be False for an unsupported path - Expected - : True - to equal - : False - ``` - - The condition stayed `True` for the full 150 s. - -### 1.2 The operator DID detect the foreign file - -The controller logs for the GitTarget `foreign-content-dest` show the refusal was -correctly detected on the data plane, at `2026-06-28T18:37:07Z`: - -``` -logger=event-router -msg="per-type reconcile refused: unsupported GitTarget path content" -gitDest="1782671468-test-manager-foreign-content/foreign-content-dest" -detail="Git path refused at secrets.txt: foreign file secrets.txt is not a - managed manifest; remove it or name it in .gittargetignore" -``` - -So the refusal logic worked. The failure is purely that this refusal never -reached the GitTarget's **status condition**. - -### 1.3 No GitTargetReconciler reconcile ran during the test window - -In the entire attempt-1 log there is exactly **one** `GitTargetReconciler` line -mentioning `foreign-content-dest`, and it is the cleanup delete at -`18:39:37` ("GitTarget not found, was likely deleted"). No status-projecting -reconcile of that GitTarget ran between its creation (`18:37:07.697`) and its -deletion. - -### 1.4 The repo looked empty at first contact - -Immediately before the refusal was recorded, the GitProvider reconcile logged: - -``` -ts=2026-06-28T18:37:07Z msg="Repository is empty" -GitProvider={"name":"foreign-content-provider", ...} -``` - -The test seeds the foreign file at `18:37:07.089` and creates the GitTarget at -`18:37:07.697` — i.e. the seed push landed essentially at the same instant the -worker first looked at the repo. - -### 1.5 Relevant code facts - -- `GitPathAccepted` is written **only** by `GitTargetReconciler.Reconcile`, which - reads the watch-manager's in-memory acceptance map and projects it: - `internal/controller/gittarget_controller.go:220` - (`gitPath = r.EventRouter.WatchManager.GitPathAcceptanceForGitTarget(gitDest)`), - then `applyDataPlaneConditions(&target, streams, gitPath)`. -- The refusal is recorded on the data plane by - `EventRouter.handleScopedResyncError` → - `WatchManager.MarkTargetGitPathRefused` (`internal/watch/event_router.go:274`). - That method **only mutates the in-memory map and returns** - (`internal/watch/git_path_acceptance.go:29`). It does **not** enqueue the - GitTarget for reconciliation. -- `GitTargetReconciler.SetupWithManager` watches only `Secret`, `GitProvider`, - `WatchRule`, and `ClusterWatchRule` - (`internal/controller/gittarget_controller.go:966`). There is **no** channel / - `source.Channel` by which the data plane can poke the controller when - acceptance changes. -- Requeue intervals (`internal/controller/constants.go`): - - `RequeueStreamSettleInterval = 10 * time.Second` - - `RequeueShortInterval = 2 * time.Minute` - - `RequeueLongInterval = 10 * time.Minute` -- On the happy path (streams running **and** path currently accepted), the - reconcile returns `RequeueAfter: RequeueLongInterval` - (`internal/controller/gittarget_controller.go:238`). Only if - `!gitPath.Accepted` (or streams not yet running) does it use the 10 s settle - interval (`...:235`). - ---- - -## 2. Interpretation: the projection race - -`GitPathAccepted` is the projection of an **asynchronous, in-memory** fact (the -data-plane acceptance map) onto a **reconcile-driven** status field. Two -goroutines run without a handshake: - -- **Control plane** — `GitTargetReconciler` reads the acceptance map at reconcile - time and writes the condition, then schedules its next wake-up. -- **Data plane** — the branch worker, on its first write/resync attempt, hits - `AcceptanceRefusedError` and records the refusal in the map. - -The condition is therefore correct **only if the reconcile reads the map after -the data plane has written the refusal into it.** There is no mechanism forcing -that ordering. - -What happened in this run (§1.2–§1.4): - -1. The seed push landed at the same instant the worker first prepared the branch, - which still saw "Repository is empty" (§1.4). -2. The GitTarget reconcile ran, read the acceptance map, found the **default** - (`Accepted: true` — see `GitPathAcceptanceForGitTarget`, - `internal/watch/git_path_acceptance.go:60`), set `GitPathAccepted=True`, and — - because streams were running and the path "accepted" — scheduled the **10 min** - `RequeueLongInterval` (§1.5). -3. Moments later the branch worker's resync saw `secrets.txt`, raised - `AcceptanceRefusedError`, and called `MarkTargetGitPathRefused` (§1.2). This - updated the map but **did not** wake the controller (§1.5). -4. With the next reconcile 10 minutes out, the `False` projection never happened - inside the test's 150 s window → timeout. - -```mermaid -sequenceDiagram - participant CP as GitTarget reconciler
(control plane) - participant Map as Acceptance map
(in-memory) - participant DP as Branch worker
(data plane) - CP->>Map: read acceptance (default = accepted) - CP-->>CP: set GitPathAccepted=True,
requeue +10m (RequeueLongInterval) - DP->>DP: first resync sees secrets.txt - DP->>Map: MarkTargetGitPathRefused - Note right of DP: map updated, but the
controller is NOT enqueued - Note over CP,DP: condition stays True until the next requeue (10m)
e2e gives up at 150s → failure -``` - -## 3. What is and is not the cause - -- **It is not** a regression in the refusal logic. The gate fired correctly and - named the offending file (§1.2). Had the test waited 10 minutes, it would have - gone green on its own. -- **It is not** a pure test-timing artifact to be papered over with a longer - timeout or `--flake-attempts`. The same lag is visible to a real operator - watching `kubectl get gittarget`: a refused path can read `GitPathAccepted=True` - for up to `RequeueLongInterval`. -- **It is** a missing edge in the event graph: data-plane acceptance changes do - not enqueue the owning GitTarget. The condition is only as fresh as the next - periodic requeue. - -This corrects an earlier assumption (see -[e2e refusal/recovery note] in agent memory and -`reconcile-via-watchlist-mark-and-sweep.md`) that the **refusal** direction was -deterministic in e2e while only **recovery** was racy. Both directions are racy -for the same structural reason: the condition is a lazily-projected view of -data-plane state. - -### 3.1 Minimal fix for defect 1 - -Give the data plane an edge into the controller. `MarkTargetGitPathRefused` and -`MarkTargetGitPathAccepted` should enqueue the owning GitTarget — e.g. a -`source.Channel` fed by the watch manager and wired in -`GitTargetReconciler.SetupWithManager`, emitting a `GenericEvent` for the -`gitDest` whenever its acceptance entry changes. The reconcile then re-reads the -map and projects the new value within one reconcile, not one `RequeueLongInterval`. - ---- - -## 4. The deeper gap: external Git changes do not trigger a re-check - -The race above is the symptom that surfaced in CI. The investigation exposes a -larger, pre-existing gap that the same enqueue plumbing should serve. - -### 4.1 Fact: drift is detected but not acted on - -- `BranchWorker.syncWithRemote` / `SyncAndGetMetadata` fetch the remote and - compute `IncomingChanges` when the branch SHA moved - (`internal/git/branch_worker.go:1389`, `:1414`; the flag is set in - `internal/git/git.go:378` as `before != after`). -- The field is explicitly documented as actionable — - `internal/git/types.go:86`: - - ```go - IncomingChanges bool // SHA changed, requiring resource-level reconcile - ``` - -- **But the only consumer just logs it** (`branch_worker.go:1414`, "Detected - remote changes during sync"). No code path turns `IncomingChanges == true` into - a re-run of the path's mark-and-sweep. The metadata is also cached for 30 s - (`metadataCacheDuration`, `branch_worker.go:1359`), so even the detection is - best-effort and reconcile-triggered, not push-triggered. - -### 4.2 Why this matters: kube-api is the source of truth - -The product's contract (see `reconcile-via-watchlist-mark-and-sweep.md`) is that -the Git folder is a **materialization** of the watched, in-scope cluster -resources. The cluster is authoritative. That means an out-of-band edit to the -repo is **drift to be corrected**, not input to be honored: - -- A human (or another tool) **deletes** a managed manifest under the path. The - resource still exists in the cluster, so the operator must **recreate** the file. -- A human **edits** a managed manifest. The operator must **overwrite** it back to - the cluster-derived content. -- A human **drops a foreign file** (`secrets.txt`, the exact §1.2 case) into the - path after it was already accepted. The path must **flip to refused**, just as it - would on first contact. - -Today none of these are corrected until the next event for an affected resource -happens to drive a per-type reconcile, or the (currently absent) drift action -fires. The "single consistent snapshot" guarantee the mark-and-sweep design buys -us on the *initial* reconcile is not re-established after external drift. - -### 4.3 What a "replay-mark session" is, and when we need one - -The full reconcile described in `reconcile-via-watchlist-mark-and-sweep.md` is: - -```text -build managed model from worktree -open one streaming-list watch per tracked type -fold every initial ADD over the model (mark touched) -wait for every type's initial-events-end bookmark -orphans = managed docs the stream never touched (sweep) -plan = creates + updates + managed drops (orphans) -apply plan, flush dirty/deleted files once -``` - -This is the heavyweight operation we want to **avoid running needlessly**, but -**must run** whenever the on-disk reality may no longer match what we last wrote. -Two triggers should arm it: - -- **acceptance change** (defect 1) — cheap, already in memory; just needs the edge. -- **external Git drift** (defect 2) — needs an efficient "did the relevant subset - change?" check, because the remote SHA moving tells us *something* changed, not - *whether it touched files we own*. - -### 4.4 Terminating objects must not be re-materialized (membership rule) - -A replay-mark session folds a streaming list-watch into the managed model. The -cluster will hand us objects that are **marked for deletion** (a non-nil -`metadata.deletionTimestamp`) but still present because finalizers have not yet -cleared. We are about to delete those ourselves — fast — so they are **not** -desired state and must not be folded in as members. - -What exists today: - -- The **live-event** path already applies a *deletion-as-intent* rule: an object - carrying a `deletionTimestamp` renders as a DELETE, not an upsert - (`internal/watch/target_watch.go:750`, `operationForLiveTargetWatchEvent`). - `deletionTimestamp` is server-owned runtime metadata that `sanitize` strips - (`internal/sanitize/sanitize.go:103`), so it is never desired state. - -What is missing: - -- The mark-and-sweep **membership predicate** in - `reconcile-via-watchlist-mark-and-sweep.md` ("The Central Invariant") lists only - *valid KRM* + *watched GVK* + *in-scope namespace*. It does **not** exclude - Terminating objects. A replay/initial fold that takes the streaming ADD at face - value would therefore **mark a Terminating object as a desired member and - re-materialize its file**, only to delete it again moments later — churn at best, - and a lingering file if the timing is unlucky. - -**Rule to add:** a document is a member of the managed model iff, in addition to -the existing three conditions, its live object has **no `deletionTimestamp`**. A -Terminating object is treated as logically absent — exactly the live-event rule, -applied consistently in the replay fold so steady-state and replay agree. This -keeps the intent-tree invariant ("a file present means the resource is intended to -exist") true across both code paths. - ---- - -## 5. Design options for the "do we need a replay-mark session?" check - -The remote HEAD SHA is too coarse: a commit to an unrelated path on the same -branch (another GitTarget's subtree, a top-level `README`) moves the branch SHA -but must **not** trigger our path's expensive replay. We need a fast predicate -over **only the GitTarget's relevant file subset**. Three candidate mechanisms, -with trade-offs: - -### Option A — partial content hash over the relevant subset - -Maintain, per GitTarget, a hash of the materialized subset (e.g. a hash of the -sorted `(path, blob-oid)` pairs under the GitTarget's `path`, derived straight -from the Git tree without checking blobs out). After a fetch, recompute and -compare to the last value we wrote. - -- **Pros:** cheap to compute from the tree object; no extra working copy; naturally - scoped to the subset; stable and order-independent if we sort. -- **Cons:** must be kept in sync with what we *intended* to write (so a no-op - external commit that reverts to our content correctly reads as "no drift"); needs - care around `.gittargetignore` and allowlisted-but-unmaterialized files - (`kustomization.yaml`) so they don't produce false drift. -- **Note:** Git already gives us a per-subtree identity for free — the **tree OID - of the GitTarget's path** changes iff something under that path changed. That is - arguably the cheapest "partial hash" and avoids us hashing blobs at all. - -### Option B — dedicated working copy containing only the relevant subset - -Use a sparse checkout / partial clone scoped to the GitTarget path, so the working -copy *is* the subset and any standard "is the tree dirty vs HEAD" check answers -the question. - -- **Pros:** conceptually simple; smaller checkouts for huge repos; the diff is - exactly the subset. -- **Cons:** more moving parts and disk per GitTarget; sparse-checkout edge cases; - worker model currently shares one checkout per branch - (`branch_worker.go`, repo path per remote), so this is a larger structural change. - -### Option C — compare against the last-known-good tree we pushed - -We already track `lastCommitSHA` per worker. Extend that to remember the -**subtree OID** (Option A's tree-OID idea) that we last pushed for each GitTarget. -On fetch, resolve the current subtree OID for the path; if it differs from the one -we pushed, the subset drifted → arm a replay-mark session for that GitTarget only. - -- **Pros:** reuses existing fetch/metadata plumbing; O(1) comparison; precisely - scoped; no extra checkout. -- **Cons:** need to persist/restore the per-GitTarget subtree OID across worker - restarts (or accept a forced replay-mark on first sync after restart, which is - safe but costs one heavyweight pass). - -### Recommendation - -Lead with **Option C built on the Git subtree OID** (a specific, near-free form of -Option A): on every fetch, resolve the tree OID of each GitTarget's `path` and -compare to the OID we last materialized. A mismatch arms exactly one replay-mark -session for that GitTarget. This is the cheapest correct predicate, scopes -naturally to the subset, and rides the metadata fetch we already do — at the cost -of one extra recorded OID per GitTarget and one forced replay after a cold start. - -Defer Option B unless very large repos make full-branch checkouts a real cost. - ---- - -## 6. Resolving drift: coordinate with the GitOps controller - -Detection (§5) tells us the subset drifted. Resolution has two strategies, and the -right one depends on whether a GitOps controller (Flux / Argo CD) is in the loop. -This generalizes the "controlled acknowledgment step" already described in -`docs/bi-directional.md`. - -- **Mirror mode — cluster is source of truth (safe default).** We re-run the - replay-mark over the subset and overwrite Git from the cluster. A human edit or - delete in Git is reverted; deleted-but-still-live files are recreated. - -- **Bi-directional acknowledgment — let Flux/Argo apply the change.** Instead of - reverting, let the GitOps controller apply the changed revision **into** the - cluster. The change then flows back through our own watch; because Git already - holds it, our materialization matches and we emit **no commit**. This closes the - loop with the existing GitOps controller and avoids a revert war between two - always-on writers (the exact instability `docs/bi-directional.md` warns about). - -**Pre-reconcile webhook (optional, off by default).** On detecting a new subtree -hash, fire an outgoing webhook *before* running our replay-mark. That is the moment -to trigger `flux reconcile` / Argo refresh and wait for the GitOps controller to -apply Git→cluster first. By the time we fold the watch, the cluster already -reflects Git, so we neither fight it nor commit a redundant revert. The hook is -per-GitProvider/GitTarget; the safe default (audit-only / mirror) skips it. - -```mermaid -flowchart TD - A[fetch remote] --> B{subtree OID
changed?} - B -- no --> Z[done — no replay] - B -- yes --> C{pre-reconcile
webhook set?} - C -- yes --> D[fire webhook:
trigger Flux/Argo apply Git→cluster, wait] - C -- no --> E - D --> E[run replay-mark over the subset
exclude Terminating objects, §4.4] - E --> F{bi-directional
acknowledgment?} - F -- yes --> G[cluster already reflects Git →
materialization matches → no commit] - F -- no / mirror --> H[overwrite Git from cluster
cluster is source of truth] -``` - -## 7. Proposed direction (summary) - -1. **Defect 1 (status freshness):** wire a `source.Channel` from the watch - manager into `GitTargetReconciler.SetupWithManager`; have - `MarkTargetGitPathRefused` / `MarkTargetGitPathAccepted` emit a `GenericEvent` - for the affected `gitDest`. Removes the up-to-10-min lag and fixes the e2e - flake at its root rather than via a longer timeout. -2. **Defect 2 (external drift):** make `IncomingChanges` actionable. On a fetch - that moves the branch SHA, resolve the per-GitTarget subtree OID and, on - mismatch, arm a single replay-mark session for that GitTarget (§5, Option C). - This restores the cluster-is-source-of-truth contract for deleted/edited/foreign - files added after initial acceptance. -3. **Membership (§4.4):** exclude objects with a `deletionTimestamp` from the - replay-mark managed model, mirroring the live-event deletion-as-intent rule, so - a Terminating object is never re-materialized. -4. **Coordination (§6):** prefer letting Flux/Argo apply external Git changes - (bi-directional acknowledgment, no commit), with an optional pre-reconcile - webhook to sequence "GitOps applies first, we reconcile after." -5. The unifying idea: **a change to data-plane reality (acceptance, or the on-disk - subset) must enqueue the owning GitTarget**, instead of waiting for the next - periodic requeue. - -> **Status:** Defect 1 (the enqueue) is implemented — see -> `internal/watch/gitpath_events.go` and the `WatchesRawSource` wiring in -> `GitTargetReconciler.SetupWithManager`. Defects 2, §4.4, and §6 remain design. - -## 8. Open questions - -- Where should the per-GitTarget subtree OID live so it survives worker restarts - without forcing a replay every restart? (Status subresource? In-memory with an - accepted cold-start replay?) -- How does the subtree-OID check interact with `.gittargetignore` and - retained-but-unmaterialized allowlisted files, so they never read as drift? -- Should an external-drift replay-mark be rate-limited / coalesced when many - GitTargets share a branch that sees frequent unrelated commits? -- Does the per-type reconcile path already cover the "edited managed file" case - well enough that drift handling only needs to worry about deletes and - newly-introduced foreign files? diff --git a/docs/design/manifest/manifest-inventory-file-agnostic-placement.md b/docs/design/manifest/manifest-inventory-file-agnostic-placement.md deleted file mode 100644 index 2b344eff..00000000 --- a/docs/design/manifest/manifest-inventory-file-agnostic-placement.md +++ /dev/null @@ -1,572 +0,0 @@ -# Manifest inventory for file-agnostic placement - -> Status: proposed (vision) -> Related: [file-agnostic-placement.md](file-agnostic-placement.md), -> [manifest-parser-poc.md](../../finished/manifest-parser-poc.md), -> [bi-directional.md](../../bi-directional.md) - -This is the vision document. It holds the requirements and the bigger "why". -The first concrete step is scoped separately in -[manifest-parser-poc.md](../../finished/manifest-parser-poc.md). - -## Summary - -GitOps Reverser currently treats the generated file path as part of the storage -contract. A Kubernetes resource is written to a deterministic path derived from -its API identity, and Git state is discovered by parsing that path back into a -resource identifier. - -That is simple, but it makes GitOps Reverser hard to attach to existing -repositories. Kubernetes manifests already carry their API identity in -`apiVersion`, `kind`, `metadata.name`, and, for namespaced resources, -`metadata.namespace`. The file path should be placement metadata, not the source -of truth for identity. - -The proposed direction is to introduce a manifest inventory layer: - -- scan a target folder for YAML manifests -- parse Kubernetes resources from their content -- map each resource identity to its exact file location -- update existing resources in place -- use a configurable placement policy only when a new resource has no known - location yet - -## Why this matters - -Existing GitOps repositories rarely follow GitOps Reverser's current generated -layout. They may use application folders, environment overlays, namespace -folders, multi-document YAML files, bootstrap files, or generated output from a -larger delivery pipeline. - -If GitOps Reverser can only write: - -```text -{group}/{version}/{resource}/{namespace}/{name}.yaml -``` - -then it can mirror resources into Git, but it cannot comfortably become a GitOps -API for an existing repository. A file-agnostic placement model lets users point -at a folder and have GitOps Reverser discover what is already there. - -## Principle - -Resource identity comes from Kubernetes object identity. File path is an -implementation detail of where that object is stored. - -For a normal manifest this means: - -- `apiVersion` and `kind` identify the Kubernetes type as written in YAML -- API discovery / RESTMapper maps that GVK to the watched GVR -- `metadata.name` identifies the object name -- `metadata.namespace` identifies the namespace for namespaced resources - -Namespace elision is a special case. If a manifest omits -`metadata.namespace`, then the YAML content alone no longer fully identifies the -live object. The missing namespace must come from an explicit context, such as a -GitTarget setting or a very small supported Kustomize namespace rule. That should -be treated as contextual identity, not as pure content identity. - -For the first implementation, keep writing `metadata.namespace`. Namespace -elision can come later behind an explicit GitTarget setting, such as -`writeNamespace`, after the contextual identity rules are clear. - -## Authority model - -The API remains leading. The manifest inventory changes how GitOps Reverser -finds and edits files, but it does not change the reconciliation direction. - -On initial reconcile, GitOps Reverser expects the normal GitOps system, user, or -managing layer to have already synced valid KRM from the target folder into the -watched Kubernetes API surface. GitOps Reverser then compares: - -- valid watched KRM found in Git -- resources currently present in the watched Kubernetes API - -The reconciliation behavior stays the same as today: - -- if a watched resource exists in the API but not in the Git folder, add it to - Git using the placement policy -- if valid watched KRM exists in Git but is not present in the API, remove it - from Git -- if a resource exists in both places, update the Git manifest from the API - state while preserving the existing file location and formatting where safe - -Only watched GVRs participate in add/remove. Documents and files for unwatched -types are never pruned and are left untouched. - -### Initial-reconcile prune risk - -The remove rule has a real risk worth stating plainly: on initial reconcile, -valid watched KRM that exists only in Git is deleted. If the surrounding system -has not yet synced the source-of-truth manifests into the watched API, those -files look like deletions and are removed even though they should have stayed. - -GitOps Reverser does not try to make this safe on its own, and that is -intentional. The API is leading; the orchestration around GitOps Reverser must -sequence initialization so the watched API is populated before reverse pruning -runs. This tooling must be orchestrated well to prevent disasters. Making the -prune path self-protecting is explicitly out of scope for this feature. - -### No separate reconciliation-state layer - -Because the API is leading and almost every change originates from GitOps -Reverser itself, the design must converge to "no change" on repeated reconciles -without keeping a separate persisted projection or shadow state. The guard -against edit oscillation (a commit that is immediately reverted on the next -reconcile) is a single, consistent desired-content projection plus semantic -no-op detection, validated by tests — not a stateful reconciliation layer. In -practice the existing bi-directional patterns have not shown this oscillation. -Keeping extra state is not forbidden, but it is explicitly not the first measure. - -## Encrypted manifests (SOPS) - -GitOps Reverser already manages SOPS encryption (the `.sops.yaml` bootstrap and -the existing encryptor path). File-agnostic placement has to coexist with -encrypted manifests, and the rules here are opinionated and load-bearing — they -will make or break the implementation. - -- **Detection is by file extension for now.** A file is treated as SOPS-managed - based on its extension (the existing encrypted-file convention). Anything more - precise is deferred. -- **Partial encryption only.** An encrypted manifest must keep its identity - fields — `apiVersion`, `kind`, `metadata.name`, `metadata.namespace` — in - cleartext. Only data-bearing fields (`data`, `stringData`, and similar, per - the `.sops.yaml` rules) are encrypted. The inventory reads identity straight - from the file, exactly as it would for a plaintext manifest. -- **Must have readable identity and a `sops` key, or it is invalid.** A - SOPS-managed file must have both readable cleartext identity and a `sops` key. - If either is missing — including full-file encryption that hides the identity — - the file is flagged invalid and ignored with a diagnostic. This is a hard - requirement, not best effort. -- **One document per encrypted file.** Encrypted files are single-document. - Multi-document handling does not apply to them. -- **No decryption, ever.** GitOps Reverser never decrypts SOPS material. It does - not read, compare, or preserve encrypted values. This is a deliberate security - measure: the reverser should not need the decryption keys to do its job. -- **Re-encrypt on write.** Because it cannot read the existing ciphertext, the - writer renders the desired object and re-encrypts the whole file through the - existing encryptor on initial reconcile and on every write. -- **No formatting preservation for encrypted files.** Re-encryption rewrites the - file, so comment and scalar-style preservation goals do not apply to encrypted - content. This is an accepted, intentional trade-off. -- **Optional caching to avoid spurious commits.** Re-encrypting always produces - fresh ciphertext, which would otherwise look like a change on every reconcile. - An optional cache of the last-encrypted desired plaintext (by identity) lets - the writer skip a real commit when the underlying object has not changed. This - is an optimization, not a correctness requirement. - -The net effect: strong security posture (no keys needed to read secrets) in -exchange for losing formatting fidelity on encrypted files only. - -Open questions are tracked in [Remaining questions](#remaining-questions). - -## Manifest inventory - -The inventory is an index built from a GitTarget folder. It can start as -process-local state. It only needs to be rebuilt when the GitTarget is -initialized, when the tracked branch moves externally, or when the local worktree -is refreshed from an incoming remote change. Normal API-driven writes can update -the inventory incrementally as part of the write. - -### Manifest identity and resource identity - -The inventory deals with two views of the same object, and the document keeps -them distinct on purpose: - -- **Manifest identity** is what is written in the YAML: `apiVersion` and `kind` - (a GroupVersionKind), plus `metadata.name` and, for namespaced resources, - `metadata.namespace`. This is content identity — what a human reads in the - file. -- **Resource identity** is the API-side key GitOps Reverser already uses on the - watch/reconcile path: group, version, resource (a GroupVersionResource), plus - namespace and name. The manifest GVK is mapped to the watched GVR through API - discovery / RESTMapper. - -So manifest identity is the on-disk representation and resource identity is the -normalized API key the inventory indexes by. The inventory's core job is to keep -the mapping `resource identity -> file location` while remembering the manifest -identity that produced it. - -Each discovered resource should record: - -- resource identity: group, version, resource, namespace, name -- manifest identity: apiVersion, kind, namespace, name -- file path relative to the GitTarget path -- document index inside that file -- byte range or AST node location for the document, if available -- whether the manifest came from plain YAML, basic Kustomize context, or an - unsupported source -- diagnostics such as duplicate identity, invalid YAML, unsupported template, or - missing namespace context - -This changes the write decision from: - -```text -resource id -> generated path -``` - -to: - -```text -resource id -> existing inventory location, else placement policy -``` - -### Document index is authoritative - -GitOps Reverser is in control of the Git side. Almost every write originates -from it, so it updates the document index as part of writing, and any external -change to the branch triggers a full rescan that rebuilds the inventory from -scratch. Within a given inventory state the document index is therefore -authoritative: the writer locates the document to edit directly by its index and -does not need to re-derive the position from manifest identity on every edit. - -### Rebuild and rescan - -The rescan stays deliberately simple. A rebuild is triggered when something -changed under the GitTarget base path. The cheap gate is "did anything in the -base folder change" — if nothing changed, do nothing. If something did, do a -full rebuild. Because the API is leading and most changes originate from GitOps -Reverser itself, a full rebuild on change is acceptable and we do not want -anything smarter than the change gate. The rescan must stay doable and no more -advanced than strictly needed. - -### Untrusted input and disallowed constructs - -The folder is parsed as untrusted input, so the scan must be bounded: - -- **Alias / anchor expansion bombs.** YAML anchors (`&x`) and aliases (`*x`), - and merge keys (`<<`), allow a small file to reference nodes repeatedly and - expand exponentially when fully materialized — the classic "billion laughs" - YAML bomb that can exhaust CPU and memory. These constructs are also unsafe to - edit through. Anchors, aliases, and merge keys go on a disallow list: a file - using them is ignored as non-editable, with a diagnostic, and must not be - fully materialized. -- **Symlink traversal.** A symlink under the base folder could point outside the - tree or form a cycle. The scan does not follow symlinks; it skips them. - -Both behaviors must have tests. - -## Edit preservation - -File-agnostic placement must be more careful than the current canonical writer. -If a user has comments, document ordering, blank lines, or nearby resources in a -YAML file, GitOps Reverser should avoid rewriting the entire file when it only -needs to update one object. - -The target behavior: - -- preserve comments when possible -- preserve unrelated YAML documents in the same file byte-for-byte -- update only the matching document in a multi-document YAML file -- detect whether the desired object is semantically different before writing -- when possible, update only the changed fields instead of re-rendering the - whole object -- delete only the matching document on resource deletion -- avoid changing sibling resources in the same file -- preserve scalar style for unchanged values, especially block strings -- keep existing file names and folder structure for known resources -- fall back to canonical YAML only for newly placed resources or cases where - round-trip preservation is not possible - -A pure whole-file round-trip through `yaml.v3` cannot meet the byte-for-byte -requirement for unrelated documents, because re-encoding a whole file normalizes -indentation, quoting, and spacing across every document. So the baseline is -decided: split a file into its documents textually and only re-render the one -document that changed; unrelated documents are spliced back verbatim. The -in-document editor and its parser are the subject of -[manifest-parser-poc.md](../../finished/manifest-parser-poc.md). - -## Editing strategy: structural merge - -GitOps Reverser already avoids commits when existing and desired manifests are -semantically equal. File-agnostic placement should go one step further: when a -resource does change, touch only the parts of the YAML document that changed. - -The mechanism is a **structural merge of the desired object onto the existing -document's node tree**, not a "compute a diff, then map field paths back to -nodes" pass. Path-string-to-node mapping is the brittle part (sequences, merge -keys, ambiguous matches); walking both trees together keeps the target node in -hand at every step, and add, update, and delete all fall out of the same -traversal: - -- for a mapping: for each key in the desired object, find the matching key in - the existing node - - both are maps or sequences → recurse - - scalar and unchanged → leave the existing node untouched (its style and - comments are preserved for free) - - scalar and changed → update the value, keeping the existing scalar style - when the new value is safely representable in it, otherwise let the encoder - choose - - key absent in the existing node → insert it - - key present in the existing node but absent in the desired object → delete it -- for sequences, start with index-based alignment; Kubernetes-aware keyed - matching (for example by container `name`) is a later nicety -- a merge that mutates no node is a semantic no-op and produces no write - -Because the merge only ever visits nodes that exist in the desired object, -unrelated nodes are preserved by construction. A common example is a ConfigMap -containing a script: - -```yaml -apiVersion: v1 -kind: ConfigMap -metadata: - name: startup-scripts - namespace: default -data: - start.sh: |- - #!/bin/sh - set -eu - - echo "starting app" - exec /app/server -``` - -If the only change is `metadata.labels.app: demo`, the merge walks -`metadata` → `labels`, inserts one key, and never descends into `data.start.sh`. -The block scalar style, indentation, blank lines, and chomping indicator (`|-`) -survive because that node is never visited. Rewriting it as an escaped one-line -string, a folded block, or a differently chomped literal block would make the -Git diff noisy and damage readability. - -This does not require preserving every byte of an edited field. It requires that -unrelated fields — especially human-authored strings such as scripts, -certificates, templates, and policy snippets — are not reformatted as collateral -damage. When a node cannot be merged unambiguously, fall back to replacing the -whole document with a diagnostic. - -## Multi-document files - -YAML files can contain multiple Kubernetes resources separated by `---`. The -inventory must treat each document as a distinct editable slot. - -Example: - -```yaml -apiVersion: v1 -kind: ConfigMap -metadata: - name: app-config - namespace: default ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: app - namespace: default -``` - -If the Deployment changes, only the second document should be updated. The -ConfigMap document should be preserved, including comments and formatting when -possible. - -Deletion should remove just the target document and leave a valid YAML file. If -the deleted document was the only document in the file, the file can be removed. - -## Duplicate resources - -> Superseded for implementation: see -> [gittarget-repository-validity-and-placement.md](version2/gittarget-repository-validity-and-placement.md). -> Duplicate KRM should block `RepositoryValid` instead of being auto-pruned. - -The same Kubernetes object may appear in more than one file, or more than once -in a multi-document file. Because the API is leading and there must be exactly -one source location per resource, GitOps Reverser resolves this deterministically -instead of refusing to act: **the first occurrence wins, and the extra manifests -are deleted automatically** so Git converges to a single copy. - -"First" is defined by a stable scan order (for example lexicographic file path, -then document index) so the outcome is reproducible. A diagnostic records what -was removed: - -```text -apps/v1/deployments/default/app: keeping apps/app.yaml document 2, -removing duplicate in overlays/dev/app.yaml document 1 -``` - -Scan ordering can be annoying when the "wrong" copy wins, but a single -authoritative location matters more than preserving an ambiguous duplicate. This -applies to plain manifests; a future overlay-aware mode could model intentional -duplicates explicitly. - -## Placement policy for new resources - -The inventory solves updates and deletes for resources that already exist in -Git. New resources still need a destination. - -The first version can keep a conservative default: - -```text -{group}/{version}/{resource}/{namespace}/{name}.yaml -``` - -but this should become a placement policy rather than a hardcoded identity rule. -Possible policy knobs: - -- default generated layout -- namespace folder layout -- resource-kind folder layout -- one file per resource -- append new resources to a specific file -- custom template using resource identity fields - -The important distinction is that placement policy only applies when the -inventory has no existing location for the resource. - -## Bootstrap files - -GitTarget path bootstrapping already creates `.sops.yaml`. The same idea could -extend to simple GitOps bootstrap files, especially `kustomization.yaml`. - -This should stay modest: - -- create missing bootstrap files for clean folders -- preserve existing bootstrap files -- avoid taking ownership of complex user-authored bootstrap files -- make this optional per GitTarget - -## Kustomize - -Kustomize should be supported carefully and in phases. - -The first useful step is detection: - -- detect `kustomization.yaml` -- identify listed resource files when the structure is simple -- detect `namespace:` as contextual namespace only when it is unambiguous -- report unsupported generators, patches, remote bases, components, and complex - overlays instead of editing through them - -Basic support could allow GitOps Reverser to understand a simple folder that a -normal GitOps tool can apply, without pretending to reverse-engineer every -Kustomize transform. - -## Helm - -Helm source editing should be out of scope for this feature. - -GitOps Reverser can still write normal Kubernetes resources such as Flux -`HelmRelease` objects, because those are plain KRM resources. But it should not -edit Helm chart templates, rendered chart output mixed with source templates, or -values-driven manifests. - -The desired behavior is detection with a clear diagnostic: - -```text -Skipping chart templates in charts/api/templates: Helm source editing is not supported. -``` - -## Phased plan - -### Phase 1: plain manifest inventory - -- recursively scan `.yaml` and `.yml` files below a GitTarget path -- parse Kubernetes-looking documents -- build `ResourceIdentifier -> ManifestLocation` -- read identity from partially-encrypted SOPS files; skip fully-encrypted ones -- ignore disallow-listed constructs (anchors, aliases, merge keys) and symlinks -- detect invalid YAML, empty documents, non-KRM YAML, duplicates, and Helm - source folders -- surface inventory diagnostics in GitTarget status -- keep the current generated path for new resources - -This phase can improve snapshot reconciliation immediately because Git state can -be discovered from YAML content rather than path shape. It does not change the -API-first reconcile contract: Git-only watched KRM is removed, and API-only -watched resources are added. - -### Phase 2: in-place updates and deletes - -- update existing resources at their inventory location -- update only the matching document in multi-document files -- structurally merge the desired object onto the existing node tree, touching - only changed nodes -- delete only the matching document -- preserve comments and unrelated documents when possible -- preserve scalar styles such as literal blocks, folded blocks, quoting, and - chomping indicators for unchanged fields -- refuse or warn when round-trip preservation is unsafe - -This is the phase that makes the feature feel respectful of real repositories. - -### Phase 3: configurable placement policy - -- expose placement options on GitTarget -- support one or two simple layouts first -- keep the generated layout as the default fallback -- add status diagnostics showing where new resources will be placed - -Appending new resources to an existing multi-document file should be a later, -explicit placement mode. It would be useful to recognize local patterns, such as -"all ConfigMaps in this folder are appended to `configmaps.yaml`", but GitOps -Reverser should not infer that behavior until the pattern is clear enough to -explain and override. - -### Phase 4: basic Kustomize context - -- detect simple `kustomization.yaml` files -- use `namespace:` as contextual namespace where safe -- optionally maintain the `resources:` list when GitOps Reverser creates a new - file in that folder -- reject complex transforms with diagnostics - -## Non-goals - -- creating pull requests directly -- full Kustomize reverse transformation -- Helm chart or values editing -- decrypting SOPS material -- preserving every formatting detail in every YAML edge case -- making two autonomous GitOps controllers safely own the same resources -- making the initial-reconcile prune path safe on its own - -## Current decisions - -- The Kubernetes API remains leading. -- The initial reconcile expects valid KRM in the target folder to have already - been synced into the watched API by the user or a normal GitOps tool. The - surrounding orchestration is responsible for sequencing this; the prune path - is not self-protecting. -- Valid watched KRM found only in Git is removed from Git; only watched GVRs - participate in add/remove. -- Watched API resources missing from Git are added to Git. -- Duplicate copies of the same resource are resolved first-occurrence-wins by a - stable scan order; the extra copies are deleted automatically. -- Convergence to no-change relies on a consistent desired-content projection plus - semantic no-op detection, not a separate reconciliation-state layer. -- SOPS files are detected by file extension and must have both readable cleartext - identity and a `sops` key, otherwise they are flagged invalid and ignored. They - are single-document, never decrypted, and re-encrypted on write. Formatting is - not preserved for encrypted files. -- Identity is the inventory key. The document index is authoritative within an - inventory state, because GitOps Reverser updates it on write and rebuilds it - via a full rescan on any external change. -- The rescan is gated on "did anything under the base path change" and is a full - rebuild otherwise — nothing smarter. -- Anchors, aliases, and merge keys are disallow-listed; symlinks are not - followed. -- A whole-file `yaml.v3` round-trip is rejected; per-document text splitting is - the baseline. -- Inventory diagnostics start in GitTarget status. -- `metadata.namespace` stays written for now. -- Namespace elision is deferred until there is an explicit GitTarget setting and - a clear contextual identity model. -- Appending to multi-document files is a later configurable placement mode, not - the initial default. - -## Remaining questions - -- **`.sops.yaml` rule changes:** when the encryption rules change which fields - are covered, every matching file must be re-encrypted. Is that an intended mass - commit, or should it be gated? -- **New encrypted resources:** when a brand-new encrypted resource is created, - which fields get encrypted — derived purely from the in-repo `.sops.yaml`, or - from a GitTarget setting? This ties into the existing TODO about non-Secret - sensitive custom resources. -- **Diagnostics surface:** GitTarget status will not scale to thousands of - manifests. Start with high-level stats, and consider a small read API on - GitOps Reverser itself for the per-resource detail later. Open. -- How far can structural-merge patching be pushed before the safer behavior is to - replace the whole document? -- Which preservation requirements are hard guarantees, and which are best-effort - niceties with diagnostics? diff --git a/docs/design/manifest/manifestedit-abstraction-plan.md b/docs/design/manifest/manifestedit-abstraction-plan.md deleted file mode 100644 index 13747655..00000000 --- a/docs/design/manifest/manifestedit-abstraction-plan.md +++ /dev/null @@ -1,337 +0,0 @@ -# Follow-up plan: the `manifestedit` package abstraction - -> Status: proposed (follow-up to the parser POC) -> Related: [manifest-parser-poc.md](../../finished/manifest-parser-poc.md), -> [manifest-inventory-file-agnostic-placement.md](manifest-inventory-file-agnostic-placement.md), -> POC decision record: `internal/git/manifestedit/DECISION.md` - -The parser POC is done: `gopkg.in/yaml.v3` node editing plus per-document text -splitting passes the implemented hard requirements (with recorded drift -limitations) and converges. This document is about the -*next* concern — getting the **abstraction** right so the package stays a small, -self-contained, well-tested library that the rest of GitOps Reverser builds on, -rather than something tangled into the controller and writer. - -## The core idea: we always compare two versions of a resource - -Everything this package does is a function of **two representations of the same -Kubernetes object**: - -- the **Git version** — a document at a known location: raw bytes, a parsed node - tree, and a manifest identity; -- the **desired version** — what Git *should* contain for that resource: a clean - Kubernetes object (typically the API object after the reverser's projection). - -Every operation is one cell in this table: - -| Git version | Desired version | Decision | -|---|---|---| -| absent | present | **create** — out of scope: placement is upstream, and this is *not* a valid `Comparison` (`Git` is required; see invariants) | -| present | absent | **delete** the matching document | -| present | present, equal | **no-op** (preserve bytes) | -| present | present, different | **patch** in place (or whole-document replace fallback) | -| present (encrypted) | present | **refuse** in-place; route to the re-encrypt writer | -| present (anchors/dupes/…) | present | **skip** with a diagnostic | - -Making this comparison explicit and first-class is the whole game. The package -should express it directly, not bury it inside a `PatchDocument` side effect. - -## Principle: mechanism, not policy - -The package is **mechanism**: "make this Git document equal this desired object, -with the smallest, most faithful edit possible." It must not own **policy**: - -- what "clean" means (which server fields to drop, kind-specific rules) → - that is the **projection/sanitizer**, owned by the caller; -- which resources are watched, prune sequencing, placement of new files → - the **reconcile loop**, owned by the integration layer. - -Keeping mechanism and policy apart is what lets the package stand on its own and -be tested without a cluster, a worktree, or the controller. - -### Concretely: drop the `internal/sanitize` dependency - -Today `PatchDocument` calls `sanitize.Sanitize(desired)` internally. That couples -the library to one projection policy. **Invert it: the caller passes the desired -Git projection already computed.** Then: - -- the package depends only on `gopkg.in/yaml.v3` and - `k8s.io/apimachinery/.../unstructured` (both stable, neither GitOps-Reverser - specific); -- the comparison becomes honest and symmetric — "Git bytes vs the object you say - should be there" — with no hidden cleaning step. - -What must **not** happen is reinventing the canonical render. The whole-document -fallback and new-file rendering define the house output format, so that render is -**policy, not mechanism**. Inject it — a `func(*unstructured.Unstructured) -([]byte, error)`, satisfied today by `sanitize.MarshalToOrderedYAML` — rather than -duplicating it in the package, where it could silently diverge from the existing -writer's output contract. There is **no silent production default**: a path that -needs canonical output (`Replace`, or a new file) with no renderer injected fails -loudly with a diagnostic, so a missing wiring cannot mask itself as plausible -YAML. The preservation and delete paths need no renderer at all; tests inject a -small one explicitly. This keeps the preservation editor (mechanism, owned) -cleanly separate from canonical rendering (policy, injected). - -Input type decision: keep `*unstructured.Unstructured`. It is already the -currency used by the watch and Git writer paths, keeps metadata access ergonomic, -and is a stable dependency. `manifestedit` still treats the object as plain data: -the caller passes the already-computed Git projection, and this package must not -import `internal/sanitize`. - -## Recommended API shape - -Make the comparison itself a value, and split deciding from applying: - -```go -type Comparison struct { - Git *Document // required: an existing parsed document - Desired *unstructured.Unstructured // nil means "absent" -> delete - Options EditOptions // injected strategies (see below) -} - -type EditOptions struct { - // Render is the canonical renderer for whole-document replacement and new - // files — the house output format, so it is policy: injected, not owned here. - // Nil is allowed only when no canonical output is needed (pure patch, no-op, - // delete); a path that needs it with no Render fails loudly. - Render func(*unstructured.Unstructured) ([]byte, error) - // ListMatch aligns sequences (default: by index). A keyed strategy names the - // field to match on; the GVK->field choice is made above this layer. - ListMatch ListMatchStrategy - // Owns reports whether a field path is owned by the reverser (default: all). - // The field-ownership seam: an absent field is deleted only when owned. - Owns func(path FieldPath) bool -} - -// Decide is a pure preflight: it inspects and compares, never mutating Git. -func Decide(c Comparison) Decision - -type Decision struct { - Action DecisionAction // NoChange | Patch | Replace | Delete | Skip - Reason string // human-readable, for diagnostics - Snapshot SnapshotRef // observed identity + target-doc hash; Apply validates against this -} - -// Apply is authoritative: it re-parses c.Git, performs the edit, and returns what -// actually happened. There is no separate file argument — c.Git is the single -// source of truth for the bytes. -func Apply(c Comparison, d Decision) (EditResult, []Diagnostic) -``` - -`Document` is immutable data: the **whole file content**, the target document -index, and the manifest identity — enough for `Apply` to splice the edited -document back among untouched siblings. The snapshot fingerprint is *not* part of -`Document`; it is derived by `Decide` and carried in the `Decision` (see -invariants). `Document` is deliberately not a shared mutable node tree (see below). - -`Desired == nil` models deletion as just another cell of the same comparison, with -no second code path. The *trigger* for deletion still belongs to the reconcile -layer (its set-difference: "Git has watched KRM the API lacks"); the package only -formalizes the per-document consequence. - -`PatchDocument`/`DeleteDocument` become thin wrappers over `Decide` + `Apply`. -`Options` is the one seam where later strategies plug in (renderer, keyed-list -key, field-ownership predicate), so the core merge stays small and pure. - -### API invariants - -These contracts keep the comparison honest; make them explicit before -implementing: - -- **`Git` is required.** A `Comparison` always describes an *existing* document. - `Git == nil, Desired != nil` is not a valid comparison: creating a brand-new - resource is a **placement** decision (where does the file go?) owned upstream. - Once a path is chosen, a new file is just `Options.Render(desired)` — it never - goes through `Decide`. So the table's `absent | present -> create` row lives in - the integration layer, not here. -- **`Apply` uses `c.Git` and validates the snapshot.** There is no separate file - argument. `Apply` re-parses `c.Git`, confirms the document at the recorded index - still has the identity (and a content fingerprint) that `Decide` compared, and - refuses with a conflict diagnostic if the file drifted in between. One source of - truth; no stale edit applied to a changed shape. -- **`Decision` is preflight; `EditResult.Mode` is authoritative.** Because - `Decide` does not merge, it states an *intent* (e.g. `Patch`). `Apply` re-parses - and merges, and may legitimately land elsewhere — `Replace` if a node turns out - ambiguous, `Skip` if the snapshot drifted. The returned `EditResult` is the - truth about what happened, not the `Decision`. -- **Deletion is content-agnostic, so refusals never block prune.** The encrypted - and disallowed-construct refusals apply only to *content edits* (`Patch` / - `Replace`), which read and rewrite the object. `Delete` only removes a document - (splicing siblings verbatim) — it never decrypts or merges — so an encrypted - resource, a disallowed-construct document, or a duplicate loser can always be - pruned. - -### Decide must not mutate - -The current merge mutates the node tree as it walks while returning `changed`. -That is fine inside `Apply`, but it must never leak into `Decide`, or a "decision" -could silently change Git before anything is applied. Two rules keep it honest: - -- **The node tree is never shared.** `Document` carries raw bytes, identity, and - index — not a mutable parsed tree. `Decide` and `Apply` each parse internally, - so nothing one mutates can affect the other. -- **`Decide` does not run the structural merge at all.** It needs only cheap, - non-mutating checks: parseable? disallowed construct? encrypted? non-mapping - root (→ `Replace`)? and the object-level equality the no-op path already uses - (Git-as-written vs desired → `NoChange` or `Patch`). The node mutation happens - only in `Apply`, on its own fresh parse. - -This is simpler than clone-before-merge or a dry-run merge: by not sharing the -tree and not merging in `Decide`, there is nothing to clone. We also deliberately -avoid building a serializable "patch plan" in `Decide` and replaying it in -`Apply` — that duplicates structure for no current benefit; revisit only if we -ever need to *show* a diff before applying. - -## Internal layering (one package, clear seams) - -Keep a single package but with hard internal seams, so a layer can later graduate -to a sub-package if it earns reuse: - -1. **Document model (pure YAML, no Kubernetes):** `split`/`join` (byte-preserving), - decode/encode nodes, `reskin` framing, the structural `merge`. Knows nothing - about KRM. This is the part most likely to become `manifestedit/yamldoc`. -2. **Manifest model (Kubernetes identity):** `Identity`, `Inventory`, - KRM/SOPS/disallowed-construct detection. Maps content to identity and location. -3. **Decision layer (the two-version comparison):** `Decide` and `Apply`, plus the - encrypted-refusal and skip rules. - -Rule of thumb: nothing in layers 1–2 imports the controller, git worktree, -rulestore, or telemetry. If it needs those, it belongs in the integration layer, -not here. - -## "More specific edits": granularity and ownership - -The structural merge already gives **field-level specificity** — it only rewrites -nodes whose value actually differs, so unrelated fields, comments, and block -scalars are untouched. "More specific" is really a question of **how granular the -comparison is and what the reverser owns**. Three axes, in increasing ambition: - -1. **Keyed list matching.** Today lists are index-based, so a reorder rewrites - slots and mis-attributes item comments (pinned limitation). Match list items by - a key field so an item is compared to its counterpart, not its slot. Crucially, - the pure document model only ever sees a generic *list-match strategy* ("match - this list by field X"); the Kubernetes knowledge of which key applies to which - GVK (`name` for containers, and so on) lives in the manifest/decision layer or - the caller, never baked into the YAML merge. -2. **Field ownership (the big one).** Right now the desired object is the *whole* - truth: any field present in Git but absent from desired is deleted. A more - specific model owns only certain field paths (server-side-apply-style managed - fields) and leaves user-managed fields in Git alone. This is a real product - decision — "does the reverser own the entire object or a declared subset?" — - and it lives naturally as a predicate over the merge walk (own this path / skip - that path). It should be decided explicitly, not drifted into. -3. **Per-path preservation policy.** Narrower than ownership: always keep certain - annotations/labels, never touch a given subtree. Same mechanism (a path - predicate), smaller scope. - -All three hang off the *same* comparison engine: they are strategies that answer -"for this node/path, what does it mean to be equal, and do we own it?" Keeping -them as injected strategies (not branches baked into `merge`) keeps the core -small and each strategy independently testable. - -## Invariant that must survive every change: convergence - -The POC proved repeated reconciles settle to a byte-stable no-op after the first -write (`convergence_test.go`). Any new strategy — keyed lists, field ownership — -must preserve this. The rule: **`Decide` after an `Apply` with the same desired -must return `NoChange`.** Make it a property test that every strategy runs through. - -## Test taxonomy (the package carries its own proof) - -The package already tests this way; the plan is to keep the discipline as it -grows. Each capability lands with tests in its own group: - -- **document model:** split/join, framing (CRLF/BOM/`...`/leading `---`), merge. -- **manifest model:** identity, inventory, duplicates, SOPS, disallowed constructs. -- **decision:** no-op vs cleaning, patch, whole-replace fallback, delete, skip, - encrypted refusal. -- **fidelity:** comments (head/line/delete-with-field), literal vs folded blocks, - quoting. -- **recorded limitations:** flush-left sequences, folded reflow, list-reorder - comment migration — pinned so a future fix announces itself by failing. -- **convergence:** the property above, ideally run across the whole corpus. -- **corpus:** `testdata/corpus` gates byte-for-byte round-trip. - -A good signal that the abstraction is right: a new strategy needs a new test file -and a small predicate, and touches nothing in layers 1–2. - -## Current implementation anchors - -This plan is a refactor of the working POC, not a rewrite from blank paper. The -important existing anchors are: - -- `PatchDocument` in `internal/git/manifestedit/patch.go` is the current mixed - seam: it validates the target document, refuses unsafe edits, sanitizes the - desired object, decides no-op vs patch, applies the merge, and falls back to - whole-document rendering. `Comparison`, `Decide`, `Apply`, and injected - rendering should tease those responsibilities apart without changing the - proven behavior. -- `mergeMapping` in `internal/git/manifestedit/merge.go` is today's whole-object - ownership rule: a field present in Git but absent from desired is deleted. - Keep that as the default `Owns == nil` behavior, then add ownership predicates - as an extension point rather than changing the baseline semantics. -- `IndexFiles` and `DocumentRecord` in `internal/git/manifestedit/index.go` - already define the manifest identity, duplicate resolution, encrypted flag, and - editability diagnostics that the decision layer should consume. -- `DeleteDocument` in `internal/git/manifestedit/delete.go` is already the - content-agnostic document-splice operation. The new delete action should route - through that behavior, including the existing `FileEmpty` signal for callers - that should remove the file. -- `sanitize.MarshalToOrderedYAML` is already the house renderer used by the Git - writer. `manifestedit` should receive it through `EditOptions.Render`; it - should not grow its own canonical renderer or keep calling `sanitize` - internally. -- `convergence_test.go` is the guardrail for the whole abstraction: after - `Apply`, running `Decide` again with the same desired object must settle to - `NoChange` and preserve the resulting bytes. - -## Work sequence - -1. **Decouple `sanitize`** — caller supplies the desired projection, and the - canonical renderer is injected (trivial default for tests), not reinvented in - the package. Small, unlocks true standalone status. -2. **Introduce `Comparison` + `Decide`/`Apply`** — make the two-version comparison - a first-class, pure value (`Decide` non-mutating, `Desired == nil` = delete); - keep `PatchDocument`/`DeleteDocument` as wrappers. -3. **Convergence property test** across the corpus, wired so every later strategy - inherits it. -4. **Keyed list matching** as the first injected strategy (fixes the reorder - limitation). -5. **Field-ownership design spike** — decide whole-object vs declared-subset; this - is a product decision and deserves its own short doc. -6. **Integration milestone (separate doc):** a read-only, inventory-driven - reconcile that *reports* what it would add/remove/update against a real cluster, - consuming this package unchanged. Defers the prune hazard and the GVK→GVR - mapping (`docs/TODO.md`) until after the comparison is trusted end to end. - -Steps 1–4 keep all work inside `internal/git/manifestedit` with no controller -coupling. Only step 6 reaches into the writer/commit path -(`commit_executor.go`, `branch_worker.go`), and it consumes the library rather -than changing it. - -## Implementation decisions - -- **Desired input stays `*unstructured.Unstructured`.** This matches the current - event and writer path: watch/audit code already routes sanitized - `unstructured` objects, and the Git writer already renders them. The package - must not sanitize internally; the caller passes the desired Git projection. -- **Field ownership starts as whole-object truth.** This matches today's merge - behavior and convergence tests: a field present in Git but absent from desired - is removed. Keep the `Owns(FieldPath) bool` seam with default "own all", but - defer declared managed paths to a separate product/design spike because it - changes what GitOps Reverser promises to preserve. -- **The document model stays in one package for now.** The YAML document seams - (`split`/`join`, framing, decode/encode, merge) should remain file-separated - inside `internal/git/manifestedit`. Graduate them to `manifestedit/yamldoc` - only after another caller needs that API. -- **The snapshot fingerprint is the target document body, not the whole file.** - Sibling documents can change without invalidating the target edit. `Decide` - records the observed identity plus target-document hash in the `Decision`; - `Apply` re-parses the current document and returns a soft `Skip` diagnostic on - drift, so the next reconcile can re-decide cleanly. -- **Projection and canonical rendering stay in `internal/sanitize` for now.** - The integration layer injects `sanitize.MarshalToOrderedYAML` as - `EditOptions.Render`. Add a contract test around that adapter so - whole-document replacement and new-file output cannot drift from the existing - writer output. diff --git a/docs/design/manifest/manifestedit-integration-readonly-reconcile.md b/docs/design/manifest/manifestedit-integration-readonly-reconcile.md deleted file mode 100644 index 20f5cf0a..00000000 --- a/docs/design/manifest/manifestedit-integration-readonly-reconcile.md +++ /dev/null @@ -1,132 +0,0 @@ -# Step 6: the read-only, inventory-driven reconcile - -> Status: in progress (the read-only report is implemented; writer wiring landed, narrowly — see below) -> Related: [manifestedit-abstraction-plan.md](manifestedit-abstraction-plan.md) -> (step 6), [manifestedit-field-ownership-spike.md](../../finished/manifestedit-field-ownership-spike.md), -> [manifest-inventory-file-agnostic-placement.md](manifest-inventory-file-agnostic-placement.md), -> [architecture.md](../../architecture.md), -> POC decision record: `internal/git/manifestedit/DECISION.md` - -This is the integration milestone. Steps 1–5 built and proved a cluster-free, -well-tested comparison library (`internal/git/manifestedit`) plus the policy -decision (API-first, whole-object truth). Step 6 connects it to the real world — -but **read-only first**: a reconcile that *reports* what it would add, remove, or -update against a real cluster, consuming the library unchanged, before anything -is allowed to write or prune. - -The point of read-only-first is trust. The comparison must be demonstrably -correct end to end — over real repositories and real cluster state — before it is -wired into the commit path, where a wrong "delete" is a destroyed file. - -## What is built now - -Package `internal/manifestreport` is the integration layer. It supplies the two -pieces of policy `manifestedit` deliberately refuses to own, and a read-only -reconcile: - -- **`Project`** = `sanitize.Sanitize` — the Git projection (what "clean" means). -- **`Render`** = `sanitize.MarshalToOrderedYAML` — the house canonical renderer, - the *same* function the live writer uses - ([content_writer.go](../../../internal/git/content_writer.go) `buildContentForWrite`). - A contract test (`render_contract_test.go`) pins that whole-replace/new-file - output is byte-identical to what the writer commits, so the two cannot drift. -- **`EditOptions`** = production options: the house renderer, index-based list - matching (no global keyed strategy — see below), and `Owns == nil` - (whole-object truth). -- **`BuildReport(files, desired)`** indexes the Git folder, compares it to the - desired cluster state, and returns a `Report` of per-resource `Action`s - (`no-change` / `update` / `create` / `delete` / `skip`). It uses - `manifestedit.Decide` **only** — never `Apply` — so it cannot mutate Git or - reach the writer. It is the set-difference reconcile made observable. - -The report maps every cell of the two-version comparison: - -| Cluster (desired) | Git (inventory) | Report action | -|---|---|---| -| present | absent | `create` (placement is upstream; only flagged) | -| present | present, equal | `no-change` | -| present | present, different | `update` | -| present | present, encrypted/disallowed | `skip` (route elsewhere; never in-place) | -| absent | present (authoritative) | `delete` (prune candidate) | -| — | present (duplicate loser) | `delete` (prune candidate) | -| — | present (non-editable) | `skip` | - -## The Git transaction boundary (read this before wiring writes) - -The folder index is **only** trustworthy for the exact bytes of a single -checked-out commit. An inventory built from one worktree and applied against a -different remote tip is a stale decision — and `manifestedit`'s snapshot -validation (index + identity + body hash) will reject the individual edit, but -the *set-level* verdicts (what to create, what to prune) are equally -snapshot-bound. The whole report is valid only for the commit it was built from. - -So any future writing reconcile must run as one repository transaction, and this -ordering is not optional: - -1. **Fetch/checkout** the target branch to a clean worktree (the existing - `BranchWorker` clone, see [architecture.md](../../architecture.md) §Git Operations). -2. **Index** that worktree's files for the GitTarget's path → `Inventory`. -3. **Compare** against the current desired cluster state → `Report` (this package). -4. **Edit** via `manifestedit.Apply` per entry, against the *same* worktree bytes - the report was built from. `Apply`'s snapshot check is the per-document guard - that the worktree did not shift mid-transaction. -5. **Commit** the resulting tree. -6. **Push with lease** (compare-and-swap on the remote ref): if the remote moved, - the push is rejected — do **not** force. -7. **On rejection, discard and replay**: re-fetch, re-index, re-compare, re-edit. - This is the project's existing "checkout fresh + replay" strategy - ([git_atomic_push.go](../../../internal/git/git_atomic_push.go), - [git_smart_fetch.go](../../../internal/git/git_smart_fetch.go)), and it is safe - precisely because the API is the source of truth: any stale commit can be - regenerated from current object state. - -The single-writer-per-branch invariant ([BranchWorker](../../../internal/git/branch_worker.go)) -already serializes step 1–6 within a pod; push-with-lease covers the cross-pod / -external-writer race. The report layer must never assume it is the only writer: -it produces verdicts for a snapshot and lets the transaction boundary enforce -freshness. - -## Deliberately deferred - -Per the plan, step 6 does not yet take on: - -- **The prune hazard.** `delete` is only *reported*. Automatically removing files - for "absent from cluster" is dangerous when the cluster view is partial (a - degraded discovery or an incomplete snapshot looks like mass deletion — see - [architecture.md](../../architecture.md) §Watch / Informer System on partial - snapshots). Acting on `delete` needs the same partial-state guards the existing - `FolderReconciler` already reasons about, wired explicitly. -- **GVK→GVR mapping.** The inventory keys on manifest identity (GVK + name + - namespace), not the API-side GVR. Turning a desired-set difference into actual - cluster reads/writes needs the RESTMapper-backed mapping tracked in - `docs/TODO.md`. Read-only reporting against a caller-supplied desired set sides - steps this until the comparison is trusted. -- **Writer wiring (now landed, narrowly).** The live writer - ([git.go](../../../internal/git/git.go) `handleCreateOrUpdateOperation`) now calls - `manifestreport.EditInPlace` through `preserveExistingFormatting`: when an - existing file genuinely differs and is **non-sensitive** and **not already in the - operator's canonical format** (i.e. it carries hand-authored comments/layout), - the resource update is applied as a minimal in-place edit instead of a wholesale - rewrite, so the formatting survives. A canonical, operator-authored file keeps - the wholesale path and stays byte-identical to before — existing behavior is - untouched. This consumes `manifestreport` + `manifestedit` unchanged. It is still - scoped to the **deterministic path**: matching a resource to an arbitrary - existing file location via the folder inventory (full file-agnostic placement) - is the remaining reach. - -## Notes and non-goals - -- **No global keyed list matching.** Production `EditOptions` keeps list matching - index-based. A blanket `ListMatch.KeyField: "name"` would silently change every - named mapping list's behavior; keyed matching should arrive with a - path/GVK-aware strategy chosen above the merge, not a global default. -- **Relationship to `FolderReconciler`.** The existing - [FolderReconciler](../../../internal/reconcile/folder_reconciler.go) diffs cluster - vs. Git for the initial snapshot and emits a whole-file `WriteRequest`. The - manifestedit path is the finer-grained, in-place, formatting-preserving successor - for *editing existing documents*; this read-only report is the bridge that lets - us validate it against the same inputs before swapping anything. -- **Whole-object truth end to end.** Because Git was written by `Render(Project(obj))` - and the report compares against `Project(obj)`, a freshly mirrored resource - reports `no-change` and round-trips byte-stably — the convergence property from - step 3, now observed across the integration boundary. diff --git a/docs/design/manifest/manifestedit-writer-followups.md b/docs/design/manifest/manifestedit-writer-followups.md deleted file mode 100644 index 9856a0be..00000000 --- a/docs/design/manifest/manifestedit-writer-followups.md +++ /dev/null @@ -1,132 +0,0 @@ -# manifestedit writer: follow-ups after the file-agnostic placement fixes - -> Status: open follow-ups — captured 2026-06-03 on branch `poc/manifestedit` -> Related: [manifestedit-new-file-placement-spike.md](../../finished/manifestedit-new-file-placement-spike.md), -> [manifest-inventory-file-agnostic-placement.md](manifest-inventory-file-agnostic-placement.md), -> [file-agnostic-placement.md](file-agnostic-placement.md), -> [manifestedit-integration-readonly-reconcile.md](manifestedit-integration-readonly-reconcile.md), -> [manifestedit-field-ownership-spike.md](../../finished/manifestedit-field-ownership-spike.md) - -## What this branch already fixed - -A review of the live writer on this branch turned up four defects. Three were -fixed; each has a regression test that started red and now pins the corrected -behavior. This document records what is fixed and what is deliberately left for a -follow-up, so the remaining edges are not lost. - -| # | Defect | Fix | Guard test | -|---|---|---|---| -| High | Writer was not file-agnostic: update wrote a second copy at the canonical path and delete missed a moved manifest. | `resolveManifestLocation` indexes the GitTarget tree and edits/deletes the resource where it already lives (match-first); only a genuinely new resource uses the deterministic path. Delete is now per-document via `manifestedit.DeleteDocument`. | `TestApplyEvent_UpdateMustFollowExistingPlacement`, `TestApplyEvent_DeleteMustFollowExistingPlacement` ([internal/git/known_placement_bugs_test.go](../../../internal/git/known_placement_bugs_test.go)) | -| Medium | An in-place no-op (multi-doc edge) was staged as a change and could drive an empty commit. | `handleCreateOrUpdateOperation` returns `false` when the preserved edit equals the bytes on disk. | `TestHandleCreateOrUpdate_NoOpInMultiDocReportsNoChange` (same file) | -| Medium | `BuildReport` classified a desired resource whose only Git doc is non-editable as both `Create` and `Skip`. | When there is no editable location but a non-editable record exists, the desired side no longer emits `Create`; the single `Skip` from `gitOnlyEntries` stands. | `TestBuildReport_NonEditableDesiredIsNotDoubleClassified` ([internal/manifestreport/noneditable_desired_bug_test.go](../../../internal/manifestreport/noneditable_desired_bug_test.go)) | -| (perf, load-bearing) | Match-first scanned the tree **per event**. A snapshot of many large manifests (cluster-wide CRD watch ≈ O(events × tree) on big YAML) blew the per-commit deadline — a real e2e failure, not just slowness. | `manifestLocator` scans each base path **once per write batch** (the checked-out commit) and caches it. | Covered by the CRD-install e2e (`crd_lifecycle_e2e_test.go`); see "Follow-up 2 (done)". | - -Code: [internal/git/git.go](../../../internal/git/git.go) (`manifestLocator`, -`handleDeleteOperation`, `handleCreateOrUpdateOperation`), -[internal/git/commit_executor.go](../../../internal/git/commit_executor.go) (one -locator per batch), -[internal/manifestreport/report.go](../../../internal/manifestreport/report.go). - -## Follow-up 1 — DELETE match-first needs the resource identity - -Match-first resolves a resource's location from its **content identity** (GVK + -namespace + name), read from the event's object. Production DELETE events carry -only the API identifier (GVR + namespace + name) and **no object** -([internal/reconcile/folder_reconciler.go](../../../internal/reconcile/folder_reconciler.go) -builds `toDelete` events with `Identifier` only). The inventory keys by GVK, and -mapping GVR→GVK needs a live RESTMapper, which the manifestedit POC deliberately -does not own. - -Consequence today: a delete of a resource a user **moved** off the canonical path -falls back to the deterministic path and therefore misses the moved file (same as -before this branch — safe, not a regression). Update/create placement is fully -fixed; deletes are only fixed when the event happens to carry an object. - -Options for the follow-up: - -- Attach a minimal identity (apiVersion/kind/name/namespace) to DELETE events in - the reconcile layer so the writer can content-match without a RESTMapper. -- Or give the writer a GVR→GVK resolver (RESTMapper) and match deletes by GVR. - -The first is smaller and keeps the GVR→GVK mapping out of the writer. - -## Follow-up 2 (done) — cache the inventory per write batch - -Originally deferred as "just performance," this turned out to be **load-bearing**. -The first implementation rebuilt the inventory (`manifestedit.IndexDir`) per event, -so a batch of N writes was O(N × tree). The CRD-install e2e — whose `ClusterWatchRule` -watches **all** CustomResourceDefinitions cluster-wide — snapshots ~40 large CRDs -into one commit; the O(N²) re-scan of those big schemas pushed the single commit -past the test's 60 s deadline, so the spec failed (zero commits). The bug-for-bug -controlled test confirmed it: neutralizing match-first made the spec pass; restoring -it with the per-batch cache also passed. - -`manifestLocator` ([internal/git/git.go](../../../internal/git/git.go)) now scans each -base path **once per write batch** (the checked-out commit) and caches it; the batch -gets one locator in [commit_executor.go](../../../internal/git/commit_executor.go). -Building the inventory once from the pre-batch state is also the semantically correct -unit per decision 1 of -[manifestedit-new-file-placement-spike.md](../../finished/manifestedit-new-file-placement-spike.md) -(location is valid for the checked-out commit). - -On top of that, `locate` takes a **stat fast-path**: the operator writes each -resource to its canonical path, so if a file already exists there, the resource -lives there and no scan happens at all. The inventory scan only fires for a resource -whose canonical file is absent — a genuinely new resource, or one a user moved off -the canonical path (the only case match-first actually needs). In steady state every -resource is at its canonical path, so the amortized cost is ~one `stat` per event, -i.e. back to the pre-match-first baseline. This was needed because the per-batch -cache alone still re-scanned the (growing) base path on every reconcile, which under -full-suite load was enough for the cluster-wide CRD watch to miss the commit -deadline even after the O(N²)→O(N) fix. - -Remaining (smaller) optimization: a cache that lives **longer than one batch**, -governed by the rebuild-on-change gate in -[manifest-inventory-file-agnostic-placement.md](manifest-inventory-file-agnostic-placement.md), -so back-to-back batches on a warm worktree don't each re-scan. Not required for -correctness. - -Note: the scan is rooted at the GitTarget `spec.path`, so a non-empty path keeps -`.git` out of the walk. A target with an empty path walks the worktree root -(including `.git`, which holds no manifests) — another reason the longer-lived cache -is worthwhile. - -## Follow-up 3 — cleanup of duplicate ("double") entries - -**Yes — this is part of the same theme.** Match-first reduces how often we *create* -duplicates, but it does not yet *remove* duplicates that already exist, and the -incomplete delete in Follow-up 1 can still leave a stale copy behind. Those are -"double entries": the same resource identity present in Git at more than one path. - -What exists: - -- The inventory already detects duplicates with first-occurrence-wins - (lexicographically first path is authoritative; later copies are losers) — - [internal/git/manifestedit/index.go](../../../internal/git/manifestedit/index.go). -- `BuildReport` already surfaces every duplicate loser as an `ActionDelete` - "prune candidate", and every Git-only resource the cluster lacks as a prune - candidate too — [internal/manifestreport/report.go](../../../internal/manifestreport/report.go). - -What is missing: this is **report-only**. Nothing in the writer acts on those -prune candidates, by design — the prune hazard (a partial cluster view turning -into spurious deletions) is deliberately deferred across the placement docs. So a -duplicate, once present, is reported but never cleaned up. - -The follow-up is to wire duplicate/orphan pruning from the read-only report into -the writer, behind whatever safety gate the prune-hazard decision lands on -(e.g. only prune duplicate *losers*, which is safe because the authoritative copy -is kept, before touching cluster-absent orphans). Doing duplicate-loser cleanup -first is attractive: it is the half with no prune hazard (the resource still -exists in exactly one place afterwards) and it directly cancels any double entry -that Follow-up 1's fallback delete might leave. - -## Suggested order - -1. Follow-up 1 (identity on deletes) — closes the last placement correctness gap. -2. Follow-up 3, duplicate-loser pruning only — safe, cancels leftover double - entries, no prune-hazard exposure. -3. Orphan pruning (cluster-absent resources) — only after the prune-hazard gate is - designed. - -(Follow-up 2, the per-batch inventory cache, is already done — see above. A -longer-lived cache across batches remains an optional optimization.) diff --git a/docs/design/manifest/version2/api-catalog-watched-type-architecture.md b/docs/design/manifest/version2/api-catalog-watched-type-architecture.md deleted file mode 100644 index 16abc8ed..00000000 --- a/docs/design/manifest/version2/api-catalog-watched-type-architecture.md +++ /dev/null @@ -1,907 +0,0 @@ -# API catalog and watched type architecture - -> Status: architecture proposal, captured 2026-06-08. -> -> A simpler greenfield redesign — fewer layers, one unified per-type output -> instead of separate followability and health reports — lives in -> [type-followability.md](type-followability.md). Read that first; this doc is kept -> for the grounded, layer-by-layer reasoning behind it. -> -> Question: how should `APIResourceCatalog` and `WatchedTypeTable` relate when -> both currently carry Kubernetes type identity and policy facts? -> -> Short answer: keep `APIResourceCatalog` as the raw discovery cache, introduce a -> resolved type surface as the policy boundary, and make `WatchedTypeTable` a -> GitTarget-specific projection of already-resolved types. - -## Problem - -The current implementation has useful pieces, but the boundaries are blurry. - -`APIResourceCatalog` owns discovery refresh, group/version trust state, indexes, -and raw type facts. `WatchedTypeTable` owns GitTarget selection, namespace -operation filters, conflict visibility, pending removals, and snapshot/informer -safety. - -The overlap is that both objects now handle type identity: - -```text -APIResourceEntry - GVK, GVR, namespaced, verbs, preferred, subresource, allowed, policy reason - -WatchedType - GVK, GVR, namespaced, served version, preferred, scope, namespace operations -``` - -That overlap forces `WatchedTypeTable` to look back into the raw catalog with -`LookupGVR`, then repeat part of the GVK/GVR validity policy locally. It also -means product policy is spread across `APIResourceCatalog`, `CatalogMapper`, -`RuleGVRResolver`, `WatchedTypeTable`, and the git writer's sensitive-resource -policy. - -The neat model is to make raw discovery, type policy, and GitTarget selection -three different layers. - -## Current Comparison - -| Concern | `APIResourceCatalog` today | `WatchedTypeTable` today | Desired owner | -| --- | --- | --- | --- | -| Discovery refresh | Calls Kubernetes discovery and handles partial failure | Does not refresh discovery | `APIResourceCatalog` | -| Raw indexes | Indexes by GVK, GVR, resource, group/resource, group/version | Calls `LookupGVR` while building a target table | `APIResourceCatalog` | -| Readiness and degraded discovery | Tracks ready, generation, degraded group/versions | Stores `ResolvedAt`; blocks gather on blocking misses and pending removals | Catalog for raw source state; resolved surface for live-set stability | -| Type facts | Stores GVK, GVR, namespaced, verbs, preferred, subresource | Repeats GVK, GVR, namespaced, preferred, served version | Resolved type surface should expose accepted type facts | -| Allowed/disallowed policy | Computes `Allowed` and `PolicyReason` during catalog entry creation | Receives misses and avoids unplanned types indirectly | Resolved type surface/type policy | -| GVK ambiguity | Catalog can return multiple entries for a GVK | Detects conflicts only among selected GVRs | Resolved type surface | -| GVR validation | `LookupGVR` returns one raw catalog entry | Treats the returned GVR as enough to build a watched type | Resolved type surface | -| WatchRule expansion | Raw resource/group indexes support wildcard and omitted-group lookups | Consumes resolved selections after expansion | Watch rule resolver, backed by type surface | -| GitTarget scope | None | Owns namespace ops, cluster-wide selection, target identity | `WatchedTypeTable` | -| Pending removals | None | Owns grace period and sweep safety | Resolved type surface live set | -| Sensitive resource handling | None | None | Type policy/type surface, consumed by git writer | - -The important asymmetry: `APIResourceCatalog` is cluster-global; `WatchedTypeTable` -is GitTarget-specific. Any shared type decision between them belongs in a layer -between them, not inside either one. - -## Target Layers - -```text -APIResourceCatalog - raw Kubernetes discovery cache - indexes, generation, readiness, degraded group/versions - -APIResourceEnricher - joins discovery with CRDs and APIServices - classifies resource origin and records CRD subresource details - -TypePolicy - GitOps Reverser policy over resource types - allowed/disallowed, sensitive/encrypted, optional policy reasons - -ResolvedTypeSurface - stable interface over catalog + policy - followability requirements, live-set hysteresis - exact GVK lookup, exact GVR lookup, candidate listing, one refusal vocabulary - -ResourceMapper - narrow adapter for manifest analysis - GVK -> GVR only - -RuleGVRResolver - WatchRule selector semantics - wildcards, omitted groups, preferred version, scope, followability support - -WatchedTypeTable - GitTarget-selected operational view - namespace operations, conflicts/misses for visibility -``` - -## APIResourceCatalog Responsibility - -`APIResourceCatalog` should answer: what did Kubernetes discovery currently say, -and how trustworthy is that observation? - -It should own: - -- discovery refresh; -- raw discovery source observations; -- preserving previous clean group/versions when discovery is partially degraded; -- generation increments; -- raw indexes for efficient lookups; -- cloning and sorting raw entries; -- catalog metrics facts. - -It should not own: - -- GitTarget rule semantics; -- snapshot, informer, or sweep behavior; -- sensitive-resource write behavior; -- final "is this type usable by GitOps Reverser?" decisions. - -The catalog may still store raw decorations such as preferred version and -subresource shape because those come from discovery or are direct projections of -discovery names. But a caller should not treat a raw catalog entry as a permission -to watch or write that type. - -## Resource Origin and Enrichment - -Every resource type should expose where GitOps Reverser believes it came from: - -```text -kubernetes-internal -crd -aggregated-api -unknown -``` - -This is not available from `APIResourceList` alone. Discovery tells us that a -group/version/resource is served, but not whether it is built in, CRD-backed, or -proxied through an aggregated API server. So the raw discovery catalog should be -enriched from two additional API surfaces: - -| Origin | Evidence | Notes | -| --- | --- | --- | -| `crd` | `apiextensions.k8s.io/v1 CustomResourceDefinition` whose `spec.group`, served `spec.versions[*].name`, and `spec.names.plural` match the GVR | This is the only source that contains CRD `/scale` JSONPaths. | -| `aggregated-api` | `apiregistration.k8s.io/v1 APIService` claiming the resource's group/version and forwarding to a service-backed API server | The APIService identifies the group/version backend; discovery still supplies the resource list underneath it. | -| `kubernetes-internal` | Served by discovery and not matched by CRD or aggregated API evidence | Includes core resources and built-in Kubernetes API groups served by kube-apiserver. | -| `unknown` | Discovery data exists but the enrichment inputs were unavailable or degraded | Must be surfaced as health, not hidden as a successful classification. | - -Classification should be stored with provenance: - -```go -type ResourceOrigin string - -const ( - ResourceOriginKubernetesInternal ResourceOrigin = "kubernetes-internal" - ResourceOriginCRD ResourceOrigin = "crd" - ResourceOriginAggregatedAPI ResourceOrigin = "aggregated-api" - ResourceOriginUnknown ResourceOrigin = "unknown" -) - -type ResourceSourceFact struct { - Origin ResourceOrigin - - // Confidence is "observed" when backed by a clean CRD/APIService snapshot, - // "inferred" when built-in is inferred by exclusion, and "unknown" when the - // required enrichment surface was unavailable. - Confidence string - - // Ref is bounded operator context, for example: - // crontabs.stable.example.com - // v1beta1.metrics.k8s.io - // Empty for inferred Kubernetes-internal resources. - Ref string -} -``` - -CRD matching is per GVR, not just per group/version, because one CRD defines one -plural resource and may serve multiple versions. Aggregated API matching is -normally per group/version because `APIService` owns a whole group/version path; -the resource list still comes from discovery. - -Origin should be a fact on every resolved type and every refused type report. A -health report that says "deployment is healthy" but does not say whether it is -built-in, CRD, or aggregated is incomplete. - -## Subresource Facts - -The resolved type surface should expose the supported subresources that matter to -GitOps Reverser without making subresources independent watched types. - -Minimum shape: - -```go -type SubresourceFacts struct { - Status StatusSubresourceFact - Scale ScaleSubresourceFact -} - -type StatusSubresourceFact struct { - Enabled bool - Source string // discovery, crd, builtin-registry, unknown -} - -type ScaleSubresourceFact struct { - Enabled bool - Source string // discovery, crd, builtin-registry, aggregated-api, unknown - - // ResponseKind is normally autoscaling/v1, Kind=Scale. - ResponseGVK schema.GroupVersionKind - - // Parent write paths. For built-in resources these come from the built-in - // registry. For CRDs these are read from CRD spec.versions[*].subresources.scale. - SpecReplicasPath string - StatusReplicasPath string - LabelSelectorPath string - LabelSelectorKind string // serialized-string, label-selector, unknown - - // UsableForGit is true only when a mutating /scale audit event can be mapped - // back to a durable parent desired-state field. - UsableForGit bool - UnusableReason string -} -``` - -For CRDs, the scale pointers come directly from the CRD version: - -```yaml -subresources: - status: {} - scale: - specReplicasPath: .spec.replicas - statusReplicasPath: .status.replicas - labelSelectorPath: .status.labelSelector -``` - -CRD pointer rules from Kubernetes matter and should be retained as facts: - -- `specReplicasPath` is required, must be dot-notation JSONPath under `.spec`, - and maps to `Scale.Spec.Replicas`. -- `statusReplicasPath` is required, must be dot-notation JSONPath under - `.status`, and maps to `Scale.Status.Replicas`. -- `labelSelectorPath` is optional, must be dot-notation JSONPath under `.status` - or `.spec`, and maps to `Scale.Status.Selector`. -- `labelSelectorPath` must point at a string field containing a serialized label - selector; it is needed for HPA/VPA support. - -This changes the previous deferred CRD-scale story: CRD `/scale` remains -unsupported only until the enriched type object can carry these paths. Once -`ScaleSubresourceFact.SpecReplicasPath` is populated from the CRD, a CRD scale -event has enough information to patch the parent desired field without guessing. - -Built-in scalable resources should use the same fields, populated from an -explicit built-in scale pointer registry. That makes built-ins and CRDs look the -same to the translator, health report, and any future GUI: - -```yaml -builtinScalePointers: - - gvr: apps/v1/deployments - responseGVK: - group: autoscaling - version: v1 - kind: Scale - specReplicasPath: .spec.replicas - statusReplicasPath: .status.replicas - labelSelectorPath: .spec.selector - labelSelectorKind: label-selector - - gvr: apps/v1/statefulsets - responseGVK: - group: autoscaling - version: v1 - kind: Scale - specReplicasPath: .spec.replicas - statusReplicasPath: .status.replicas - labelSelectorPath: .spec.selector - labelSelectorKind: label-selector - - gvr: apps/v1/replicasets - responseGVK: - group: autoscaling - version: v1 - kind: Scale - specReplicasPath: .spec.replicas - statusReplicasPath: .status.replicas - labelSelectorPath: .spec.selector - labelSelectorKind: label-selector - - gvr: v1/replicationcontrollers - responseGVK: - group: autoscaling - version: v1 - kind: Scale - specReplicasPath: .spec.replicas - statusReplicasPath: .status.replicas - labelSelectorPath: .spec.selector - labelSelectorKind: label-selector -``` - -The registry should be data, not scattered conditionals. It can start small and -only include built-in resources whose scale paths are verified. Discovery still -decides whether the resource and `{resource}/scale` are actually served on the -cluster; the registry only supplies parent paths and response shape for known -built-in types. - -The selector field is intentionally typed. A CRD `labelSelectorPath` must point to -a serialized string because that is the CRD contract. Built-in resources can -derive `Scale.Status.Selector` from a structured label selector, so their registry -entry should report both the source path and `labelSelectorKind: label-selector`. -The scale write path still depends only on `specReplicasPath`; selector details -are health and GUI facts. - -Aggregated API scale should also land in `ScaleSubresourceFact`, but it is only -usable when the aggregated API surface provides an equivalent trusted parent path. -Plain discovery of `{resource}/scale` is not enough. - -Subresource entries from discovery such as `deployments/status` and -`deployments/scale` should be folded into the parent type's `SubresourceFacts`. -They should not appear as standalone `WatchedType` entries. - -## Per-Type Health Report - -Every resource type should have an actual health report. This report is not just -for selected WatchRule types; it should be available for any cataloged resource -type so operators can answer "why is this type watched, ignored, or unsafe?" - -Sketch: - -```go -type TypeHealthLevel string - -const ( - TypeHealthHealthy TypeHealthLevel = "healthy" - TypeHealthDegraded TypeHealthLevel = "degraded" - TypeHealthRefused TypeHealthLevel = "refused" - TypeHealthUnknown TypeHealthLevel = "unknown" -) - -type TypeHealthReport struct { - Level TypeHealthLevel - - // One-line bounded summary suitable for status, logs, and diagnostics. - Summary string - - // Conditions are bounded and stable. They should not include object names, - // request URIs, or unbounded backend messages. - Conditions []TypeHealthCondition -} - -type TypeHealthCondition struct { - Type string // Discovery, Source, Policy, Identity, Subresources, Watch, Scale, Followability, Selection - Status string // True, False, Unknown - Reason string - Message string -} -``` - -Recommended conditions: - -| Condition | Healthy when | Degraded/refused examples | -| --- | --- | --- | -| `Discovery` | group/version was discovered from trusted data | catalog unavailable, group/version degraded, stale preserved entry | -| `Source` | origin is classified as internal, CRD, or aggregated with evidence | CRD/APIService enrichment unavailable, origin unknown | -| `Policy` | type is allowed by product policy | disallowed resource, sensitive resource without required handling, subresource-only match | -| `Identity` | GVK ↔ GVR is a clean 1:1 mapping in both directions | `ambiguous_gvk` (one GVK served by multiple GVRs), `ambiguous_gvr` (one GVR resolving to multiple Kinds) | -| `Watch` | type supports `get`, `list`, `watch`, and `patch` when selected for a WatchRule | missing required verb, selected scope mismatch | -| `Subresources` | status/scale facts are internally consistent | discovery says scale exists but CRD scale paths are missing | -| `Scale` | scale is disabled or has a known parent replica path when enabled | `scale_path_unresolved`, invalid CRD JSONPath, aggregated scale without path source | -| `Followability` | type is in the live set | denied, missing verb, retained during grace, expired absence | -| `Selection` | GitTarget selection folded cleanly | conflicting GVRs across selections for this target | - -Examples: - -```yaml -gvr: apps/v1/deployments -source: - origin: kubernetes-internal - confidence: inferred -subresources: - status: - enabled: true - source: discovery - scale: - enabled: true - source: builtin-registry - responseGVK: - group: autoscaling - version: v1 - kind: Scale - specReplicasPath: .spec.replicas - statusReplicasPath: .status.replicas - labelSelectorPath: .spec.selector - labelSelectorKind: label-selector - usableForGit: true -health: - level: healthy - summary: built-in resource is watchable and scale paths are known -``` - -```yaml -gvr: stable.example.com/v1/crontabs -source: - origin: crd - confidence: observed - ref: crontabs.stable.example.com -subresources: - status: - enabled: true - source: crd - scale: - enabled: true - source: crd - responseGVK: - group: autoscaling - version: v1 - kind: Scale - specReplicasPath: .spec.replicas - statusReplicasPath: .status.replicas - labelSelectorPath: .status.labelSelector - labelSelectorKind: serialized-string - usableForGit: true -health: - level: healthy - summary: CRD resource is watchable and scale paths are known -``` - -```yaml -gvr: metrics.k8s.io/v1beta1/pods -source: - origin: aggregated-api - confidence: observed - ref: v1beta1.metrics.k8s.io -subresources: - status: - enabled: false - scale: - enabled: false -health: - level: refused - summary: aggregated metrics resource is read-only or not watchable for Git mirroring -``` - -The health report should be part of `TypeResult` for exact lookups and part of -catalog diagnostics for list-all views. `WatchedTypeTable` can then copy the -accepted type's health into target status without recalculating catalog facts. - -## Followability Requirements - -GitOps Reverser should distinguish "served by Kubernetes discovery" from -"followable by GitOps Reverser." A served type is raw cluster fact. A followable -type is safe enough for the product to mirror, watch, snapshot, route audit -events for, and potentially sweep from Git. - -The default lookup path should return only followable live types. Callers that -need diagnostics can ask for an inspection result, but ordinary mapper, resolver, -and writer code should not accidentally act on raw or unstable discovery entries. - -Each requirement below has a sharp, stable name and exactly one refusal reason. -The refusal reason is the single vocabulary GitOps Reverser uses everywhere a type -can be turned away — default lookup status, `FollowabilityReport.Reasons`, and -health conditions — so an operator always gets the same machine-readable answer to -"why isn't this type picked up?" A type enters the live set only when every -required row passes; the first failing row supplies the refusal reason. - -| Requirement | Rule | Required | Refused with | -| --- | --- | --- | --- | -| `parent-resource` | The type is a top-level parent resource, not a subresource. Subresources are folded into the parent's `SubresourceFacts`. | yes | `subresource_only` | -| `policy-allowed` | The type is not on the GitOps Reverser deny list. | yes | `denied_by_policy` | -| `sensitive-handled` | The type is not sensitive, or its sensitivity has supported encryption/write handling. | yes | `sensitive_unsupported` | -| `discovery-trusted` | The backing group/version was discovered from trusted, non-degraded data. | yes | `discovery_degraded` | -| `served-stable` | The type survived transient registration wobble, or is still inside the 60-second removal grace. | yes | `served_unstable`, `absence_expired` | -| `gvk-resolves-to-one-gvr` | The type's GVK is served by exactly one accepted GVR. | yes | `ambiguous_gvk` | -| `gvr-resolves-to-one-gvk` | The type's GVR resolves back to exactly one Kind. | yes | `ambiguous_gvr` | -| `scope-known` | The system knows whether the get/list/watch paths are namespaced or cluster-scoped. | yes | `scope_unknown` | -| `required-verbs` | Discovery advertises `get`, `list`, `watch`, and `patch`. | yes | `missing_verb_` | -| `source-classified` | Origin is classified as `kubernetes-internal`, `crd`, or `aggregated-api` with evidence. | yes | `source_unknown` | -| `scale-resolved` | When scale routing is required, the parent `SpecReplicasPath` is known and not guessed. | conditional | `scale_path_unresolved` | - -### Unambiguous GVK ↔ GVR identity - -GitOps Reverser follows a type only when its identity is a clean 1:1 mapping in -**both** directions. This is two named requirements, not one: - -- `gvk-resolves-to-one-gvr`: exactly one GVR serves a given GVK; and -- `gvr-resolves-to-one-gvk`: that GVR resolves back to exactly one Kind. - -The round trip must close. `GVK -> GVR -> GVK` must return the original GVK, and -`GVR -> GVK -> GVR` must return the original GVR. If either direction forks, the -type is refused with `ambiguous_gvk` or `ambiguous_gvr` respectively and never -enters the live set; it remains visible only through `Inspect*` and the health -report. - -This is deliberately strict, and the strictness is the point. A served but -ambiguous identity is exactly where silent mis-mirroring, wrong-parent writes, and -confusing sweeps come from. The ambiguity is almost always a symptom of an -unhealthy cluster: duplicate CRDs claiming the same kind, an aggregated API -shadowing a built-in group/version, or two resources sharing a kind across -versions. GitOps Reverser should not paper over that with a guess. It refuses the -type, names the conflict in the health report, and lets the operator fix it — -**keep your cluster healthy** is a precondition Reverser relies on, not something -it tries to work around. Keeping ambiguous identities out of the live set removes -a large, recurring source of unclarity in one move. - -The deny list belongs in type policy, not in WatchRule expansion. A rule that asks -for a denied resource should resolve to a typed refusal with the policy reason. -The denied type should still appear in inspection diagnostics and health reports; -it should not appear in the default live list. - -`patch` is deliberately part of the live-set requirement. GitOps Reverser may not -patch the Kubernetes API directly for every flow, but audit events and -subresource translations include patch-shaped desired-state changes. Treating -patchless resources as live would create an uneven contract for writer and UI -code. - -## Live Type Set - -The resolved type surface should maintain a hysteresis-protected live set: - -```text -raw discovery + enrichment + policy + followability checks - -> candidate type facts - -> live type set with removal hysteresis -``` - -Additions should be fast. When a new CRD becomes served and passes the -requirements, it can enter the live set immediately. Removals should be slow: -once a type is live, a failed refresh, missing group/version, missing resource, or -temporary CRD registration wobble must not remove it from the live set until the -absence has persisted for **60 seconds**. - -The 60-second removal grace should be fixed, not configurable. It is product -safety, not tuning. The goal is to avoid turning a short API discovery gap into a -large destructive Git sweep. - -Sketch: - -```go -const liveTypeRemovalGrace = 60 * time.Second - -type FollowabilityStatus string - -const ( - FollowabilityLive FollowabilityStatus = "live" - FollowabilityPending FollowabilityStatus = "pending" - FollowabilityRetained FollowabilityStatus = "retained" - FollowabilityRefused FollowabilityStatus = "refused" - FollowabilityUnknown FollowabilityStatus = "unknown" -) - -type FollowabilityReport struct { - Status FollowabilityStatus - Live bool - - // Reasons are bounded machine-readable requirement outcomes drawn from the - // single refusal vocabulary, for example: subresource_only, denied_by_policy, - // sensitive_unsupported, discovery_degraded, served_unstable, absence_expired, - // ambiguous_gvk, ambiguous_gvr, scope_unknown, missing_verb_patch, - // source_unknown, scale_path_unresolved. - Reasons []string - - FirstObserved time.Time - LastObserved time.Time - MissingSince *time.Time - RetainedUntil *time.Time -} -``` - -`Retained` means the type failed the latest raw observation but remains in the -live set because the 60-second removal grace has not elapsed. During that window, -consumers should continue treating the previous type fact as live for planning, -snapshot, informer, and writer identity purposes. Health should show the degraded -condition, but lookup should not drop the type. - -Once the grace expires, the type leaves the default live set and becomes an -inspection result with `FollowabilityRefused` or `FollowabilityUnknown`, -depending on the reason. A deletion/sweep workflow can then make a deliberate -decision from a stable absence instead of a discovery blink. - -This moves the current `WatchedTypeTable` pending-removal behavior one level up. -`WatchedTypeTable` should not be the only place that protects against spurious -type disappearance; all GitOps Reverser components need the same stable type -view. - -## Lookup Modes - -The type surface should make the safe path the easy path. - -```go -type TypeSurface interface { - Ready() mapping.MapperReadiness - Generation() uint64 - - // Default lookups return only live followable types. - ForGVK(ctx context.Context, gvk schema.GroupVersionKind) (TypeResult, error) - ForGVR(ctx context.Context, gvr schema.GroupVersionResource) (TypeResult, error) - LiveTypes(ctx context.Context) ([]TypeFact, error) - - // Inspection lookups return served, retained, refused, and unstable facts for - // status, GUI, CLI, and debugging. They never authorize mirroring by - // themselves. - InspectGVK(ctx context.Context, gvk schema.GroupVersionKind) (TypeResult, error) - InspectGVR(ctx context.Context, gvr schema.GroupVersionResource) (TypeResult, error) - InspectTypes(ctx context.Context) ([]TypeResult, error) -} -``` - -Default lookup behavior: - -- `ForGVK` and `ForGVR` return `Resolved` only for live followable types. -- A denied, ambiguous, missing-verb, source-unknown, subresource-only, or - expired-missing type returns a refusal status. -- A retained type still returns as live, with health/followability conditions - explaining that it is retained during the removal grace. -- Callers that need to render "why not?" use `Inspect*`, not raw catalog lookups. - -## Component Needs - -Different components need different projections of the same type fact. The point -of the abstraction is to avoid each component rediscovering or weakening the -rules. - -| Component | Needs live-only lookup? | Extra facts needed | Why | -| --- | --- | --- | --- | -| Manifest analyzer / mapper | yes | GVK, GVR, scope, refusal reason | Map committed manifests to live API identities without accepting denied or ambiguous types. | -| WatchRule resolver | yes | resource names, preferred versions, scope, get/list/watch/patch verbs | Expand user selectors only into followable resources. | -| WatchedTypeTable | yes | namespace operation filters plus copied `TypeFact` health | Project already-live types into a GitTarget view. | -| Snapshot / informer manager | yes | GVR, scope, list/watch/get support, retained-state health | Avoid starting/stopping streams on transient discovery gaps. | -| Audit consumer | yes | parent GVR, source, subresource facts, scale `SpecReplicasPath` | Route events only for live parents and translate `/scale` without guessing. | -| Git writer | yes | sensitivity, source, health, scale field-patch source | Decide write/encryption behavior from the same accepted type facts. | -| CLI / GUI / status | no, also needs inspect | origin, verbs, subresources, followability report, health conditions | Show all cluster resource types, including denied/refused/unstable, and explain what GitOps Reverser will do. | - -The `/scale` case is the useful pressure test. The audit consumer should be able -to ask for a parent type and receive: - -```yaml -gvr: apps/v1/deployments -followability: - status: live - live: true -verbs: [get, list, watch, patch] -subresources: - scale: - enabled: true - specReplicasPath: .spec.replicas - usableForGit: true -``` - -If the same call is made for a CRD with `/scale` but no resolved -`SpecReplicasPath`, the default lookup should either refuse the type for scale -routing or return the parent as live with `scale.usableForGit: false`, depending -on whether the parent itself is otherwise followable. In both cases, the scale -translator must not guess `.spec.replicas`. - -## Resolved Type Surface Responsibility - -The missing abstraction is the policy boundary between raw discovery and consumers. - -Sketch: - -```go -type TypeFact struct { - GVK schema.GroupVersionKind - GVR schema.GroupVersionResource - - Namespaced bool - Verbs []string - Preferred bool - Subresource bool - - Source ResourceSourceFact - Subresources SubresourceFacts - - Allowed bool - Sensitive bool - PolicyReason string - - Followability FollowabilityReport - Health TypeHealthReport -} - -type TypeResult struct { - Fact TypeFact - Status mapping.Status - Reason string - Generation uint64 -} - -type TypeSurface interface { - Ready() mapping.MapperReadiness - Generation() uint64 - - // Default lookups return only live followable types. - ForGVK(ctx context.Context, gvk schema.GroupVersionKind) (TypeResult, error) - ForGVR(ctx context.Context, gvr schema.GroupVersionResource) (TypeResult, error) - LiveTypes(ctx context.Context) ([]TypeFact, error) - - // Inspection lookups return served, retained, refused, and unstable facts for - // status, GUI, CLI, and debugging. - InspectGVK(ctx context.Context, gvk schema.GroupVersionKind) (TypeResult, error) - InspectGVR(ctx context.Context, gvr schema.GroupVersionResource) (TypeResult, error) - InspectTypes(ctx context.Context) ([]TypeResult, error) -} -``` - -`ForGVK` and `ForGVR` must share the same product policy: - -- no trusted data means `CatalogUnavailable`; -- degraded lookup scope means `DiscoveryDegraded`; -- served but excluded means `Disallowed`; -- subresource-only matches are refused; -- one GVK served by more than one GVR is `Ambiguous` (`ambiguous_gvk`); -- one GVR resolving to more than one Kind is `Ambiguous` (`ambiguous_gvr`); -- exact GVR lookup must validate the entry's GVK against the full GVK lookup and - confirm the round trip `GVR -> GVK -> GVR` returns the original GVR; -- live lookups only return types that pass followability requirements or are - retained inside the 60-second removal grace. - -Those identity points close the current gap: `LookupGVR` is single-valued in the -index because GVR strings are unique, but a unique index key is not proof of a -healthy identity. The required property is a closed GVK ↔ GVR bijection in both -directions. If the GVR's GVK is globally ambiguous, or the GVR itself resolves to -more than one Kind, selecting that GVR is still refused. - -`ForGVK` and `ForGVR` should return health even on refusal. A refused result that -only says "Disallowed" forces UI/status code to reverse-engineer the real issue. -A refused result that includes source, policy, subresource, and watch conditions -is useful immediately. - -## WatchedTypeTable Responsibility - -`WatchedTypeTable` should answer: for this GitTarget, which already-accepted -types are operationally active, under which namespaces and operations? - -It should own: - -- GitTarget destination identity; -- selected namespace and operation filters; -- cluster-wide versus named namespace stream shape; -- resident table generation; -- blocking snapshot safety; -- conflict and miss visibility for target planning. - -It should not own: - -- raw GVR to GVK lookup; -- global GVK ambiguity policy; -- allowed/disallowed policy; -- sensitive-resource classification; -- Kubernetes discovery freshness; -- discovery hysteresis and removal grace. - -In the target shape, `buildWatchedTypeTable` receives resolved facts, not raw GVRs -that it must validate against the catalog: - -```go -type resolvedSelection struct { - fact TypeFact - namespace string - ops []configv1alpha1.OperationType -} -``` - -Then the table builder only folds selections by accepted type identity and merges -namespace operation sets. If ambiguity or disallowed state exists, it arrives as a -typed miss from the resolver instead of being rediscovered inside the table. - -`WatchedType` should retain enough of `TypeFact` to render an operator report: - -```go -type WatchedType struct { - GVK schema.GroupVersionKind - GVR schema.GroupVersionResource - - Source ResourceSourceFact - Subresources SubresourceFacts - Followability FollowabilityReport - Health TypeHealthReport - - Namespaced bool - Scope configv1alpha1.ResourceScope - ServedVersion string - Preferred bool - NamespaceOps map[string]OperationSet -} -``` - -That does not make the watched table responsible for calculating source, -subresource, followability, or health facts. It only preserves the -already-resolved report for status and diagnostics. - -## Sensitive Resources - -The startup flag for additional sensitive resources is currently consumed by the -git writer. That works for encryption, but it keeps an important type policy -outside the type system. - -Prefer `Sensitive bool` on `TypeFact`, backed by the existing -`types.SensitiveResourcePolicy`. - -This should mean: - -- core `v1/secrets` are always sensitive; -- startup additional sensitive resources are classified at type-policy time; -- writer code can still receive the policy directly during migration; -- eventually the selected type fact can carry sensitivity into write planning. - -The field should be named `Sensitive`, not `Secret`, because configured resources -may be Secret-shaped CRDs rather than Kubernetes `Secret` objects. - -## RuleGVRResolver Role - -`RuleGVRResolver` should keep WatchRule-specific syntax: - -- omitted apiGroups; -- wildcard groups/resources/versions; -- preferred-version selection when versions are omitted; -- namespaced versus cluster scope; -- followability capability checks; -- operator-facing miss detail. - -But it should not use raw catalog entries as final answers. It can use catalog or -surface candidate listing for expansion, then validate concrete candidates through -the type surface. - -Practical target: - -```text -WatchRule selector - -> candidate raw resources for expansion - -> TypeSurface.ForGVR for each concrete GVR - -> resolvedSelection or ResolveMiss - -> WatchedTypeTable fold -``` - -`ResolveMiss` can remain a watch-domain type, but it should optionally carry the -core mapping status so UI/status/logging does not need to parse reason strings. - -## Refactor Path - -1. Add a `TypeFact`/`TypeResult` shape in the mapping layer or a small new core - package that does not import `internal/watch`. -2. Add `ResourceSourceFact`, `SubresourceFacts`, and `TypeHealthReport` to that - shape. -3. Add `FollowabilityReport`, the fixed 60-second live-set removal grace, and - live-only default lookup methods. -4. Add enrichment from CRDs and APIServices: - - CRD GVR source classification; - - CRD `/status` and `/scale` flags; - - CRD scale `specReplicasPath`, `statusReplicasPath`, and `labelSelectorPath`; - - aggregated API group/version source classification. -5. Add a built-in scale pointer registry that populates the same - `ScaleSubresourceFact` fields used by CRDs. -6. Fold discovery subresource entries into parent resource facts. -7. Add exact GVR resolution beside exact GVK resolution and make it validate - global GVK uniqueness. -8. Move allowed/disallowed and sensitive classification behind a small type-policy - object used by the live surface and static tests. -9. Compute per-type health reports during resolution and expose them for accepted - and refused types. -10. Keep `CatalogMapper` as a thin `ResourceMapper` adapter over the surface. -11. Change `RuleGVRResolver` so concrete GVRs are accepted only through the surface. -12. Change `WatchedTypeTable` so it folds resolved `TypeFact` selections instead of - calling `catalog.LookupGVR`. -13. Remove local conflict detection from the table once ambiguity is guaranteed to - arrive as a typed planning miss. -14. Move pending-removal behavior out of `WatchedTypeTable` and into the shared - live-set hysteresis. -15. Add regression coverage for the GVK ↔ GVR bijection in both directions: - - one GVK served by two GVRs, only one selected by a GitTarget, still refused - with `ambiguous_gvk`; - - one GVR resolving to more than one Kind refused with `ambiguous_gvr`; - - a clean type whose `GVK -> GVR -> GVK` and `GVR -> GVK -> GVR` round trips - both close is accepted. -16. Add regression coverage for live-set hysteresis: - - a newly served CRD can enter the live set immediately; - - a previously live type remains live while absent for less than 60 seconds; - - a previously live type leaves the live set after 60 seconds of stable absence; - - retained types report degraded health but still resolve from default lookups. -17. Add regression coverage for built-in and CRD scale path extraction and health: - - built-in scale paths populate `ScaleSubresourceFact` from the registry; - - CRD with status and scale reports both enabled; - - CRD scale paths are version-specific; - - CRD scale without usable `specReplicasPath` is unhealthy/refused for scale - routing; - - aggregated API scale without a trusted parent path reports - `scale_path_unresolved`. - -## Decision - -Do not merge `APIResourceCatalog` and `WatchedTypeTable`. - -They have different lifetimes and scopes: - -- `APIResourceCatalog` is cluster-global and discovery-shaped. -- `WatchedTypeTable` is GitTarget-local and operation-shaped. - -The overlap should be removed by inserting a resolved type surface between them. -That surface becomes the single place where GitOps Reverser turns raw discovery -into accepted or refused type facts. - -## References - -- [catalog-mapper-vs-watched-type-table.md](catalog-mapper-vs-watched-type-table.md) -- [subresource-scope-reduction.md](subresource-scope-reduction.md) -- [gvk-gvr-mapping-layer.md](../../../finished/gvk-gvr-mapping-layer.md) -- [resource-types.md](../../../facts/resource-types.md) -- [subresources.md](../../../facts/subresources.md) -- [`internal/watch/api_resource_catalog.go`](../../../../internal/watch/api_resource_catalog.go) -- [`internal/watch/watched_type_table.go`](../../../../internal/watch/watched_type_table.go) -- [`internal/watch/rule_gvr_resolver.go`](../../../../internal/watch/rule_gvr_resolver.go) -- [`internal/watch/catalog_mapper.go`](../../../../internal/watch/catalog_mapper.go) -- [`internal/types/sensitive_resource.go`](../../../../internal/types/sensitive_resource.go) diff --git a/docs/design/manifest/version2/catalog-mapper-vs-watched-type-table.md b/docs/design/manifest/version2/catalog-mapper-vs-watched-type-table.md deleted file mode 100644 index 1b5ea531..00000000 --- a/docs/design/manifest/version2/catalog-mapper-vs-watched-type-table.md +++ /dev/null @@ -1,329 +0,0 @@ -# Raw catalog, resolved type surface, GitTarget selection - -> Status: design investigation, captured 2026-06-05 -> -> Question: should `internal/watch/watched_type_table.go` become the single -> GVK/GVR abstraction, including for CLI/offline tooling, or should -> `internal/watch/catalog_mapper.go` stay separate? -> -> Short answer: neither object is the core abstraction. The core abstraction is a -> resolved type surface behind an interface. `CatalogMapper` and -> `WatchedTypeTable` should both consume that surface. - -## Verdict - -The right model is layered: - -```text -APIResourceCatalog - raw discovery observations, indexes, freshness, degradation - -Resolved type surface - core interface over trusted type facts: - exact GVK lookup, exact GVR lookup, one refusal vocabulary - -ResourceMapper - narrow GVK->GVR adapter for manifest analysis, CLI, tests - -WatchedTypeTable - per-GitTarget selected subset plus watch lifecycle -``` - -This keeps the nasty cluster details at the edge. Discovery wobble, missing -catalog data, disallowed resources, and ambiguous type relationships are -classified before lower-level code acts on them. The lower a caller gets, the more -it should be able to trust what it receives. - -So the direction should be: - -1. Keep programming to interfaces. -2. Keep `internal/watch` out of CLI and manifest analysis. -3. Keep `WatchedTypeTable` as a GitTarget-specific operational table. -4. Keep `CatalogMapper` as a narrow adapter/interface. -5. Extract the shared type surface into core mapping code. -6. Treat ambiguous GVK->GVR as a hard, observable refusal. - -## 1. What is shared - -Both the mapper and the watched table are built from the same type facts: - -```text -GVK -GVR -namespaced -verbs -preferred -subresource -allowed -``` - -That shape already exists as `mapping.Entry` in -[`internal/mapping/mapper.go`](../../../../internal/mapping/mapper.go). - -The shared abstraction is not "a table" and not "a mapper." It is a resolved view -of API resource discovery: - -```text -Given a GVK, either return the one allowed served GVR or a refusal. -Given a GVR, either return the one allowed served type fact or a refusal. -``` - -Both entry points must apply the same product policy. In particular, exact GVR -lookup must not become a bypass around ambiguous GVK detection. - -## 2. What is not shared - -`WatchedTypeTable` is not just a generic set of types today. It also carries -GitTarget behavior: - -- selected rules and resource scope; -- namespace operation filters; -- pending removals and removal grace; -- sweep safety; -- informer/snapshot/per-type reconcile lifecycle; -- GitTarget destination identity. - -Those concerns belong in `internal/watch`. They should not be imported by CLI, -offline analysis, or lower-level manifest code. - -The reusable part is the type fact and the resolution contract underneath the -table. - -## 3. The interface boundary - -The important move is to program against a small core interface rather than against -the live watch implementation. - -Sketch: - -```go -type TypeSurface interface { - Ready() MapperReadiness - Generation() uint64 - - ForGVK(ctx context.Context, gvk schema.GroupVersionKind) (Result, error) - ForGVR(ctx context.Context, gvr schema.GroupVersionResource) (Result, error) -} -``` - -The concrete implementations can vary: - -- live catalog in the controller; -- kubeconfig-backed discovery for CLI; -- static snapshot for tests/offline review; -- structure-only implementation that declines mapping. - -Callers should not care which implementation they received. That is the point of -the abstraction. - -`ResourceMapper` can remain as the narrower interface for callers that only need -manifest GVK->GVR resolution: - -```go -type ResourceMapper interface { - GVRForGVK(ctx context.Context, gvk schema.GroupVersionKind) (Result, error) -} -``` - -That narrow adapter is still useful. It keeps manifest analysis from knowing about -watch rules, informers, or discovery internals. - -## 4. Ambiguity policy - -Product policy: - -> A cluster that serves one GVK through multiple GVRs is misconfigured for GitOps -> Reverser. We do not pick a winner. We do not serve that type. - -The code must still detect and report this condition, but it should not model it -as a valid operating mode. - -This matters for exact GVR lookup. - -It is true that `APIResourceCatalog` has a single entry for an exact GVR. But that -does not prove the type is acceptable. If that GVR's GVK is globally ambiguous, the -selected GVR must still be refused. - -Correct `ForGVR` behavior: - -```text -1. Look up the exact GVR. -2. If missing, return unavailable/degraded/unserved as appropriate. -3. Read the entry's GVK. -4. Resolve that GVK against the full catalog. -5. Accept only if the GVK resolves to exactly this GVR. -6. Otherwise return the same refusal status the GVK path would return. -``` - -This prevents a GitTarget rule from accidentally selecting one side of an -ambiguous cluster shape and making it look safe. - -Current caveat: `WatchedTypeTable` detects conflicts among selected GVRs. That is -narrower than the product policy above. If only one ambiguous GVR is selected, the -table may not currently observe the global ambiguity. A shared type surface should -close that gap. - -## 5. Status vocabulary - -There should be one core vocabulary for catalog/type lookup outcomes: - -```text -Resolved -Unserved -Ambiguous -Disallowed -Subresource -CatalogUnavailable -DiscoveryDegraded -StructureOnly -``` - -That vocabulary belongs with the resolved type surface. - -But watch-rule planning has extra domain concepts that should not be forced into -the core lookup vocabulary: - -- wildcard expansion; -- omitted apiGroups matching multiple groups; -- version preference; -- scope filtering; -- list/watch support; -- operation-specific planning messages. - -So do not blindly collapse `ResolveMissReason` into `mapping.Status`. - -Better: - -```text -mapping.Status - core type lookup outcome - -watch.ResolveMiss - watch-rule planning miss, optionally carrying a mapping.Status plus - rule-specific detail -``` - -That keeps lower-level mapping clean while allowing higher-level watch code to -explain rule failures precisely. - -## 6. Layer responsibilities - -### APIResourceCatalog - -Owns raw discovery facts: - -- indexes by GVK and GVR; -- catalog readiness; -- degraded group/version state; -- generation. - -It can be messy because Kubernetes discovery is messy. - -### Resolved type surface - -Owns product policy over those facts: - -- exact GVK resolution; -- exact GVR validation; -- allowed/disallowed filtering; -- subresource refusal; -- ambiguity refusal; -- trusted absence versus degraded absence. - -It returns normalized results. Consumers should not need to interpret catalog -internals. - -### ResourceMapper - -Owns the manifest-facing interface: - -- manifest GVK -> served GVR; -- no dependency on `internal/watch`; -- usable by CLI, tests, controller, and structure-only analysis. - -It can be an adapter over the resolved type surface. - -### RuleGVRResolver - -Owns WatchRule selector expansion: - -- resource and group wildcards; -- explicit or preferred versions; -- namespaced versus cluster scope; -- list/watch capability; -- rule-specific miss details. - -It should call the resolved type surface when it needs to validate concrete type -facts, but it should keep rule semantics in `internal/watch`. - -### WatchedTypeTable - -Owns the GitTarget-selected operational view: - -- watched types; -- namespace operation filters; -- conflicts and misses for visibility; -- pending removals; -- sweep and informer safety. - -It should be built from trusted type-surface results, not by reinterpreting raw -catalog entries. - -## 7. What this rejects - -Do not move `WatchedTypeTable` into CLI. It is too operational and too coupled to -GitTarget lifecycle. - -Do not delete `CatalogMapper`. The interface boundary is valuable, even if the -implementation becomes a thin adapter. - -Do not add reverse mapping to delete planning. Delete planning should rely on the -GitTarget folder inventory. If the inventory does not know the resource identity, -we should not invent it at delete time. - -Do not let exact GVR lookup bypass global GVK ambiguity. - -Do not make lower layers parse string reasons from higher layers. Use typed -statuses and typed misses. - -## 8. Recommended refactor path - -1. Add a core exact-GVR lookup/validation path beside `ResolveGVK`. -2. Ensure exact GVR validation checks global GVK uniqueness. -3. Keep `ResourceMapper` as the GVK-only interface for manifest analysis. -4. Have the live catalog mapper implement the core surface internally. -5. Have `buildWatchedTypeTable` consume validated surface results instead of raw - `LookupGVR(...).Entries[0]`. -6. Let `RuleGVRResolver` keep rule-specific misses, but attach or translate from - core `mapping.Status` where appropriate. -7. Add tests for the important policy case: one GVK served by two GVRs, only one - selected by the GitTarget, still refused. - -## 9. Design principle - -The lower layers should be boring. - -At the top, the system deals with Kubernetes discovery churn, partial catalogs, -ambiguous clusters, rule syntax, and operator-facing diagnostics. - -At the bottom, the writer, analyzer, sweep, and per-type reconcile should operate -on already-classified facts: - -```text -this type is resolved and trusted -this type is refused and observable -this surface is degraded, so destructive work must stop -``` - -That is the reason to push the shared abstraction into core and program toward -interfaces. It simplifies the lower layers without pretending the cluster is -always clean. - -## References - -- [gvk-gvr-mapping-layer.md](../../../finished/gvk-gvr-mapping-layer.md) -- [`internal/mapping/mapper.go`](../../../../internal/mapping/mapper.go) -- [`internal/watch/catalog_mapper.go`](../../../../internal/watch/catalog_mapper.go) -- [`internal/watch/watched_type_table.go`](../../../../internal/watch/watched_type_table.go) -- [`internal/watch/rule_gvr_resolver.go`](../../../../internal/watch/rule_gvr_resolver.go) -- [`internal/watch/api_resource_catalog.go`](../../../../internal/watch/api_resource_catalog.go) diff --git a/docs/design/manifest/version2/discovery-catalog-typeset-boundary.md b/docs/design/manifest/version2/discovery-catalog-typeset-boundary.md deleted file mode 100644 index 049df327..00000000 --- a/docs/design/manifest/version2/discovery-catalog-typeset-boundary.md +++ /dev/null @@ -1,411 +0,0 @@ -# Discovery catalog and typeset boundary - -> Status: proposal, partly landed. Migration step 0 (the registry change signal, Stage 10) -> and steps 1–3 (rule status moved onto the registry's followable set; `RuleGVRResolver` and -> the dead catalog lookup/enumeration APIs deleted, Stage 11) have landed. Steps 4–6 are still -> forward-looking. See -> [type-followability-implementation.md](type-followability-implementation.md). -> -> Companion to [type-followability.md](type-followability.md), -> [type-followability-implementation.md](type-followability-implementation.md), and -> [type-followability-naming-proposal.md](type-followability-naming-proposal.md). - -## Question - -After the followability work, `internal/typeset` owns the type decision surface: -identity uniqueness, followability checks, the live set, retention grace, and GVK -lookup for the writer/analyzer path. That leaves -[`APIResourceCatalog`](../../../../internal/watch/api_resource_catalog.go) looking -smaller and a bit suspicious. - -Should the catalog be folded into `typeset`? Or is it still doing enough to stay? - -## Short answer - -Do not fold the catalog into `typeset`. - -Keep a small discovery-shaped catalog in `internal/watch`, but narrow it to raw -Kubernetes discovery state and rename it when we do the broader naming pass: - -```text -DiscoveryCatalog - Refresh(discovery client) - Ready() - Generation() - Stats() - DegradedGroupVersions() - Entries() or Observations(...) - -typeset / typeinventory - Entry - Observation - Registry - TypeRecord - Followability - Lookup -``` - -`typeset` should remain a leaf package. It should not depend on Kubernetes -discovery clients, controller-runtime, dynamic informers, manager logging, or -telemetry. The live manager owns those integrations and feeds neutral entries into -`typeset`. - -The cleanup is still worthwhile: several catalog APIs are now only there because -rule status still uses the old `RuleGVRResolver`. - -## Current production callers - -Search scope: `internal` and `cmd`, excluding `*_test.go`. - -| Caller | Uses | Current reason | Move to `typeset`? | -| --- | --- | --- | --- | -| `Manager.RefreshAPIResourceCatalog` | `Refresh`, `Stats`, `logCatalogTransitions` | Pulls Kubernetes discovery, records refresh metrics, rebuilds registry after a successful scan. | No. Discovery and metrics integration stay in watch/manager. | -| `Manager.logCatalogTransitions` | `Ready`, `DegradedGroupVersions` | Edge-triggered logs for first ready catalog and degraded/recovered group versions. | No for degraded GV logs; maybe use registry stats for known/followable counts. | -| `recordCatalogStats` | `CatalogStats` | Emits API catalog gauges. | Partially. Raw discovery counts stay catalog; policy/refusal/followability counts should move to registry/type stats. | -| `Manager.refreshTypeRegistry` | `Ready`, `Observations`, `Generation` | Converts current catalog scan to `typeset.Observation` and publishes `Registry`. | Keep as boundary adapter, but make catalog provide raw entries and let the adapter apply product policy. | -| `RuleGVRResolver` | `entriesForResource`, `entriesForGroup`, `entriesForGroupResource`, `allEntries`, `hasDegradedLookup`, `Ready` | Old WatchRule/ClusterWatchRule status resolver. | Yes. Replace with registry-backed rule projection/status. | -| `Manager.ResolveWatchRuleResources` | `NewRuleGVRResolver` | Status feedback for one namespaced WatchRule. | Yes. Should use the same registry/type selection as actual informers/snapshots. | -| `Manager.ResolveClusterWatchRuleResources` | `NewRuleGVRResolver` | Status feedback for one ClusterWatchRule. | Yes. Same as above. | -| `Manager.ReconcileForRuleChange` | `RefreshAPIResourceCatalog` | Refreshes discovery before computing target type sets. | No. It should keep asking the manager to refresh discovery+registry. | -| `resolveSnapshotGVRs` | `RefreshAPIResourceCatalog`, then registry readiness | Fails closed before snapshotting. | No direct catalog call is fine at manager level; snapshot should keep reading registry after refresh. | - -## APIs that were obsolete after rule status moved (done — Stage 11) - -These catalog methods had no production caller except the old `RuleGVRResolver`, or no -production caller at all. With rule status moved onto the registry (Stage 11) they are gone: - -| API | Old state | Fate | -| --- | --- | --- | -| `Entry` | No production caller found. | **Deleted.** | -| `CatalogLookup`, `LookupGVK`, `LookupGVR` | No production caller found; leftover from mapper era. | **Deleted.** `typeset.Registry.ByGVK` is the live lookup surface. | -| `GroupVersionDegraded` | No production caller found. | **Deleted.** A mapper-era leftover with no caller once rule status stopped probing the catalog. | -| `DegradedGroupVersions` | Operator degraded/recovered log + catalog stats. | **Kept** — for the operator-facing degraded-group/version log line and the catalog gauges, *not* for rule status. | -| `entriesForResource`, `entriesForGroup`, `entriesForGroupResource`, `allEntries` | Only `RuleGVRResolver`. | **Deleted.** | -| `hasDegradedLookup` | Only `RuleGVRResolver`. | **Deleted** (not re-homed). Rule status reports only the followable types a rule watches; it raises no per-selector "discovery degraded" diagnostic — see "Rule status resolution" below. | -| `byGVK`, `byResource`, `byGroupRes` indexes | Only supported the obsolete lookups/resolver. | **Deleted.** | - -After this cleanup the catalog keeps only its group/version-keyed raw scan (`byGroupVer`), the -derived `byGVR` index it feeds to `typeset`, and group/version trust state. - -## What should not move - -### Discovery refresh - -`typeset` should not call `ServerGroupsAndResources()`. That would pull live -cluster IO and Kubernetes discovery error handling into a package that is currently -usable by: - -- the live watch manager, -- the no-cluster manifest analyzer, -- tests and snapshot fixtures, -- the git writer's `typeset.Lookup`. - -That leaf shape is valuable. Keep discovery IO in `internal/watch`. - -### Partial discovery preservation - -The catalog currently preserves the last trusted entries for group/versions that -discovery reports as failed, and separately marks those group/versions degraded. -That is scan mechanics, not product followability. `typeset` should receive this as -entry facts: - -```go -typeset.Entry{ - GVK: ... - GVR: ... - Degraded: true, -} -``` - -Then `typeset` can decide `trusted -> discovery-degraded` or `retained`, but it -does not need to know how Kubernetes discovery produced that state. - -### Refresh metrics and discovery logs - -Metrics like refresh duration, refresh changed/unchanged/error, and degraded -group/version transitions belong near discovery refresh. They are about scanning -the API server, not about type followability. - -## What should move - -### Rule status resolution — done (Stage 11) - -`ResolveWatchRuleResources` and `ResolveClusterWatchRuleResources` no longer use -`RuleGVRResolver`; they report the same decision the actual watch/snapshot path uses, -because they read the same surface. - -Before, two paths could disagree: - -```text -actual watching: registry.Followable() -> match rule selectors -> TargetTypeSet -> informers/snapshots -rule status: APIResourceCatalog -> RuleGVRResolver -> ResolveMiss -> status text -``` - -That split could lie — a rule could read "resolved" through `RuleGVRResolver` while the -registry refused the same type (identity, origin, scale, sensitivity, a stricter verb -requirement), or the reverse. Now both paths share one matcher: - -```text -registry.Followable() -> matchFollowableRecords(rule selector) -> watched types -``` - -`matchFollowableRecords` (in `internal/watch/watched_type_resolver.go`) is the single -rule-matching surface, used by both the per-GitTarget watched-type tables and rule status, -so the status answer and the active informer/snapshot answer cannot drift. - -**Report only what is watched — no refusal taxonomy, no degraded diagnostic.** The status is -deliberately minimal: a rule's `ResourcesResolved` condition reports catalog readiness and how -many distinct followable types the rule currently watches (`"watching N resource type(s)"`), -and nothing more. It does *not* explain why an individual selector matched nothing — absent, -denied-by-policy, verb-poor, ambiguous, and discovery-degraded are all the same to a mirror, -and the application does not surface those distinctions. The only unresolved (`False`) case is -a catalog that has not yet observed discovery (`"API resource catalog is not ready"`). - -This **reverses** the earlier proposal in this section, which kept a per-selector -`DiscoveryDegraded` diagnostic and therefore wanted `hasDegradedLookup` re-homed onto the -status projection. That diagnostic is gone — `hasDegradedLookup` was *deleted, not re-homed*. -The full machine-readable "why is this type not followed?" answer still lives on the registry -record (`Manager.TypeRecords()`) for anyone who needs it; it is simply not projected per rule -selector into operator status. The catalog's `DegradedGroupVersions()` stays, but only for the -manager's operator-facing degraded/recovered **log** line and the catalog gauges. - -### Policy application inside catalog entries - -`APIResourceEntry` currently stores `Allowed` and `PolicyReason`. That is product -policy, not raw Kubernetes discovery. - -Better boundary: - -```text -DiscoveryCatalog.Entry - GVK - GVR - Namespaced - Verbs - Preferred - Subresource - Degraded - -watch/catalog_observe.go adapter - applies allowedResource(...) - applies SensitiveResourcePolicy - builds typeset.Entry - -typeset - evaluates policy/sensitivity/followability -``` - -This keeps the catalog raw and makes the policy boundary explicit. - -### Allowed/excluded catalog metrics - -`CatalogStats` currently counts `AllowedResources` and `ExcludedResources`. -Those are no longer pure catalog facts once policy moves out of the raw entry. - -Suggested split: - -| Metric family | Owner | Examples | -| --- | --- | --- | -| Discovery scan metrics | `DiscoveryCatalog` / manager | refresh outcome, duration, generation, trusted/degraded group versions, served top-level resource count | -| Type decision metrics | `typeset.Registry` / manager | known records, followable/live records, refused records by first failing requirement/reason | - -That split names what is actually being measured. - -### The registry's own change signal (the gate the table watches) — landed - -This was the boundary leak that mattered most in practice, because it caused a real -bug. It is the one part of this proposal already implemented (Stage 10); the rest of -this document is still forward-looking. - -The per-GitTarget `WatchedTypeTable` is re-projected only on a deliberate trigger — a -rule-set change or a "did the type surface change?" signal — so the common no-change -reconcile is a cheap compare rather than a rescan. The question is *which* signal -answers "did the type surface change?". - -That signal **used to be `registry.Generation()`**, which is just the catalog's -generation passed straight through: - -```go -reg.Update(catalog.Observations(...), catalog.Generation()) -``` - -So a consumer of the decision surface (the table) was actually gated on the **scan -layer's** counter — the boundary inversion this document set out to remove: the table -should depend on the registry, not on how Kubernetes discovery counts revisions. - -It was not only inelegant — it was **incorrect at the retention-grace boundary.** The -grace is owned by the registry and is time-based, so a type can leave the live set -*without any discovery change*: - -```text -t0 discovery serves T catalog gen = N T followable -t1 discovery drops T catalog gen = N+1 T retained (grace running) <- gen moved, table re-projects, keeps T -t1..t60 discovery stable catalog gen = N+1 T still retained -t61 grace elapses catalog gen = N+1 T dropped from Followable() <- gen did NOT move -``` - -At `t61` the followable set changed but the catalog generation did not, so a -generation-gated table never re-projected: the dropped type lingered in the table, its -informer kept listing a resource the server no longer served, and the target's -mark-and-sweep snapshot failed closed against a phantom GVR. The old `watchedTypeStore` -removal grace hid this by re-judging absence itself; once the grace moved into the -registry, the gate had to watch a registry-owned signal instead. - -**Implemented: the registry exposes `Revision()` — the decision-surface analog of the -catalog's `Refresh() (changed, generation)`.** - -```go -// Update bumps an internal revision whenever the *followable membership* changes -// (a type appears, drops after grace, or flips followable<->refused) or the backing -// scan generation moves. It is the registry's "something a consumer cares about -// changed" signal — independent of how discovery counts generations. -func (r *Registry) Update(obs []Observation, generation uint64) -func (r *Registry) Revision() uint64 -``` - -The `WatchedTypeTable` gate is now `(registry.Revision(), rulesFingerprint)` instead of -`(catalog generation, rulesFingerprint)`. The payoff, confirmed in practice: - -- **Correctness:** the revision bumps exactly when a retained type leaves the live set, - so the grace-drop re-projects the table and stops the phantom informer — no separate - watched-type-layer absence tracking required. (`internal/typeset/registry_test.go` - `TestRegistry_RevisionBumpsOnGraceDropAtStableGeneration` locks this in.) -- **Clean boundary:** the table depends only on the decision surface. The catalog's - generation is now a pure scan-layer detail (still passed into `Update` as the - `ResolvedAt` stamp), and the registry exposes its own change-of-decision signal. Each - layer reports change in its own terms. -- **No new cost:** the revision also bumps on generation change, so steady-state - re-projection frequency is unchanged from the generation-gated version; the grace case - only adds the occasional extra bump it was previously missing. - -The companion safety — `resolveSnapshotGVRs` failing closed while a watched type is -`retained` (currently unserved, mid-grace) rather than streaming a phantom GVR — landed -alongside it, re-expressing the old pending-removal fail-closed in the registry's -verdict vocabulary. - -`Generation()` stays available (still useful as the `ResolvedAt` stamp and for -diagnostics); `Revision()` is the thing the gate watches. - -## Proposed final shape - -### `internal/watch/discovery_catalog.go` - -Raw discovery cache: - -```go -type DiscoveryCatalog struct { - byGroupVersion map[schema.GroupVersion][]DiscoveryEntry - groupVersion map[schema.GroupVersion]DiscoveryGroupVersionState - generation uint64 - ready bool -} - -type DiscoveryEntry struct { - GVK schema.GroupVersionKind - GVR schema.GroupVersionResource - Namespaced bool - Verbs []string - Preferred bool - Subresource bool - Degraded bool -} -``` - -Public-ish surface: - -```go -func (c *DiscoveryCatalog) Refresh(d apiResourceDiscovery) (changed bool, err error) -func (c *DiscoveryCatalog) Ready() bool -func (c *DiscoveryCatalog) Generation() uint64 -func (c *DiscoveryCatalog) Entries() []DiscoveryEntry -func (c *DiscoveryCatalog) Stats() DiscoveryStats -func (c *DiscoveryCatalog) DegradedGroupVersions() []schema.GroupVersion -``` - -No GVK/GVR lookup helpers. No resource selector expansion. No product policy. - -### `internal/watch/catalog_observe.go` - -Boundary adapter: - -```go -func observationsFromDiscoveryCatalog( - catalog *DiscoveryCatalog, - sensitive types.SensitiveResourcePolicy, -) []typeset.Observation -``` - -Responsibilities: - -- copy raw discovery entries, -- apply default resource policy, -- apply configured sensitive-resource policy, -- call `typeset.ObservationsFromEntries`. - -### `internal/typeset` - -Decision surface: - -```go -Registry.Update([]Observation, generation) -Registry.All() -Registry.Followable() -Registry.ByGVK() -Registry.Revision() // change-of-decision signal the TargetTypeSet gate watches -``` - -Potential additions for rule status: - -```go -type Selector struct { - APIGroups []string - APIVersions []string - Resources []string - Scope Scope -} - -func MatchRecords(records []TypeRecord, selector Selector) MatchResult -``` - -Whether this helper belongs in `typeset` or `internal/watch` depends on whether -we want `typeset` to know WatchRule selector semantics. The conservative choice is -to keep selector matching in `internal/watch` but make it consume only -`typeset.TypeRecord` values. - -## Migration plan - -0. ✅ **Done (Stage 10).** Gave `Registry` a `Revision()` and gated the `WatchedTypeTable` - on it instead of the catalog generation. This was the smallest, highest-value step: it - fixed the retention-grace lingering-type bug and removed the table's dependency on the - scan counter. It was independent of the rule-status work below. -1. ✅ **Done (Stage 11).** Moved WatchRule and ClusterWatchRule status onto registry-backed - matching (`matchFollowableRecords` over `registry.Followable()`). The status now reports - only what the rule watches — catalog readiness plus a followable-type count — and drops the - refusal taxonomy entirely. The degraded-group/version diagnostic was *deliberately dropped*, - not preserved: the application does not surface per-selector discovery-degraded reasons (see - "Rule status resolution" above). This reverses the earlier sub-proposal to re-home - `hasDegradedLookup`. -2. ✅ **Done (Stage 11).** Deleted `RuleGVRResolver` (and the `ResolveMiss` reason vocabulary). -3. ✅ **Done (Stage 11).** Deleted the catalog lookup/enumeration APIs and indexes that only - existed for the old resolver (`Entry`, `CatalogLookup`/`LookupGVK`/`LookupGVR`, - `GroupVersionDegraded`, `hasDegradedLookup`, `entriesFor*`/`allEntries`, and the - `byGVK`/`byResource`/`byGroupRes` indexes). -4. Move `Allowed`/`PolicyReason` out of `APIResourceEntry` and into the observation - adapter. -5. Split catalog stats into raw discovery stats and registry/type decision stats. -6. Rename `APIResourceCatalog` to `DiscoveryCatalog` during the naming pass. - -## Recommendation - -Keep the boundary: - -```text -DiscoveryCatalog: what Kubernetes discovery said and how trustworthy the scan is. -typeset/typeinventory: what GitOps Reverser decides about each type. -TargetTypeSet: what one GitTarget selected from the followable/live records. -``` - -Most callers should not move to `typeset`; they should move to the manager's -registry-backed view. The one big exception is rule status: it should stop reading -raw catalog entries and start reporting the same registry decisions that drive the -actual watchers. diff --git a/docs/design/manifest/version2/double-repo-detection.md b/docs/design/manifest/version2/double-repo-detection.md deleted file mode 100644 index 88881183..00000000 --- a/docs/design/manifest/version2/double-repo-detection.md +++ /dev/null @@ -1,494 +0,0 @@ -Here is a strong prompt you can paste into your agent. - -You are working in the ConfigButler codebase. - -I want you to write a design document for a change around detecting duplicate Git destinations / Git upstreams. - -Context: -ConfigButler has a concept called GitDestination. A GitDestination represents a Git upstream repository that ConfigButler can write to, read from, or otherwise use as a configured target. Users may configure the same repository multiple times through different URLs, for example over SSH and HTTPS: - -- git@github.com:ConfigButler/gitops-reverser.git -- ssh://git@github.com/ConfigButler/gitops-reverser.git -- https://github.com/ConfigButler/gitops-reverser -- https://github.com/ConfigButler/gitops-reverser.git - -These can all refer to the same real repository. I want ConfigButler to detect these cases reliably where possible. - -Important insight: -Do not assume that Git itself gives us a universal repository identity. It does not. A Git remote is basically an endpoint exposing objects and refs. There is no global built-in repository UUID that works across arbitrary Git servers. - -Also, do not treat the SHA of `main` or the default branch as a unique repository identifier. That only tells us something about current content. Different repositories can have the same default branch SHA, especially forks, mirrors, templates, empty repos, or recently copied repositories. - -The design should treat repository identity as a confidence-based classification problem, not a perfect equality check. - -Please inspect the existing codebase before writing the design. Look for: -- The existing GitDestination CRD/schema. -- Existing controllers/reconcilers touching GitDestination. -- Existing status/conditions conventions. -- Existing Git provider abstractions, Git authentication handling, URL parsing, cloning, ls-remote usage, or related packages. -- Existing documentation style/design docs, if any. - -The task is to write a design document only. Do not implement the change yet. - -The design document should be written in Markdown and should be suitable for inclusion in the repository, for example under `docs/design/` or a similar location if one exists. - -The document should cover the following. - -# 1. Problem statement - -Explain the problem clearly: - -Users may configure the same Git repository multiple times using different remote URLs, protocols, credentials, ports, or provider-specific aliases. - -Examples: -- SSH vs HTTPS for the same GitHub repo. -- URLs with or without `.git`. -- `git@host:owner/repo.git` vs `ssh://git@host/owner/repo.git`. -- Canonical provider URLs vs vanity domains or redirects. -- Self-hosted Git servers with non-standard ports. -- Mirrors and forks that expose the same refs but are not the same repository identity. - -Explain why naive approaches are insufficient: -- String equality of URLs misses common aliases. -- DNS resolution is not enough because of CNAMEs, virtual hosting, redirects, SSH config, load balancers, and provider-specific routing. -- Default branch SHA is only a content signal, not identity. -- Full refs equality is stronger than default branch SHA, but still represents “same exposed content,” not necessarily “same repository.” -- Provider APIs may expose authoritative IDs, but only for recognized providers and when credentials allow access. - -# 2. Goals - -The design should aim to: -- Detect high-confidence duplicate GitDestinations. -- Detect possible duplicates or mirrors without making unsafe claims. -- Support both SSH and HTTPS remotes. -- Work across common providers such as GitHub, GitLab, Gitea, and possibly Bitbucket where feasible. -- Work reasonably for arbitrary/self-hosted Git servers. -- Avoid false-positive hard failures where two distinct repositories merely share content. -- Surface duplicate information clearly in status. -- Keep the user in control for ambiguous cases. -- Make the implementation incremental. - -# 3. Non-goals - -Explicitly state non-goals: -- We are not trying to prove global Git repository identity for arbitrary Git remotes. -- We are not relying solely on DNS canonicalization. -- We are not rejecting GitDestinations purely because the default branch SHA matches. -- We are not requiring every provider to have a resolver on day one. -- We are not trying to understand all possible SSH client config aliases from the user’s local machine. -- We are not cloning full repositories just for identity detection unless the existing system already does so for another reason. - -# 4. Identity model - -Design a confidence-based identity model. - -Suggested levels: - -- `Authoritative` - - Same provider-native repository/project ID. - - Example: GitHub repository ID/node ID, GitLab project ID, Gitea repository ID. - - This is the strongest signal. - -- `Strong` - - Same normalized canonical remote URL under provider-specific normalization rules. - - Example: GitHub SSH and HTTPS URLs normalize to the same host/owner/repo key. - - This is strong but less authoritative than provider ID. - -- `Medium` - - Same complete remote refs fingerprint. - - Computed from `git ls-remote` output over advertised refs. - - Indicates the remotes currently expose the same content/refs. - - Could mean same repo, mirror, fork, or copied repo. - -- `Weak` - - Same default branch name and default branch SHA. - - Useful as a clue only. - - Should not produce a hard duplicate classification by itself. - -- `None` / `Unknown` - - Insufficient data, inaccessible remote, unsupported provider, authentication failure, etc. - -The design should be careful with terms: -- “same repository” should only be used for authoritative or very high-confidence cases. -- “same content” or “possible duplicate” should be used for medium/weak signals. -- Avoid claiming certainty when the system only has a fingerprint. - -# 5. Suggested status shape - -Propose a status structure for GitDestination or a related status object. - -Possible shape: - -```yaml -status: - identity: - observedGeneration: 3 - provider: github - providerRepositoryId: "123456789" - canonicalRemoteUrl: "https://github.com/ConfigButler/gitops-reverser.git" - normalizedRemoteKey: "github.com/configbutler/gitops-reverser" - defaultBranch: main - defaultBranchSha: "abc123..." - refsFingerprint: "sha256:..." - confidence: Authoritative - lastResolvedAt: "2026-06-05T10:00:00Z" - - duplicateDetection: - duplicates: - - name: github-ssh - namespace: configbutler-system - reason: SameProviderRepositoryId - confidence: Authoritative - possibleDuplicates: - - name: mirror-over-https - namespace: configbutler-system - reason: SameRefsFingerprint - confidence: Medium - -This is only a suggested shape. Please inspect existing CRD/status conventions and propose a shape that fits the codebase. - -Also consider Kubernetes conditions, for example: - -IdentityResolved -DuplicateDetected -PossibleDuplicateDetected -IdentityResolutionFailed - -The status should be machine-readable and human-readable. - -6. URL normalization - -Design URL parsing and normalization. - -Support at least these forms: - -git@github.com:owner/repo.git -ssh://git@github.com/owner/repo.git -ssh://git@github.com:22/owner/repo.git -https://github.com/owner/repo -https://github.com/owner/repo.git - -Normalization should likely include: - -Lower-casing known provider hostnames. -Removing default ports where safe, for example SSH 22 and HTTPS 443. -Removing trailing .git where provider semantics allow it. -Normalizing SCP-like SSH syntax into URI-like components. -Preserving non-default ports. -Preserving path case for unknown/self-hosted providers unless a provider-specific rule says otherwise. -Avoiding unsafe assumptions for arbitrary Git servers. - -Provider-specific normalization may be needed: - -GitHub owner/repo matching can be normalized more aggressively. -GitLab/Gitea self-hosted instances may need more conservative rules. -Unknown Git servers should use conservative normalization. - -Please discuss edge cases: - -Case sensitivity. -Ports. -Nested GitLab paths/groups. -URL redirects. -Vanity domains. -SSH aliases. -Credential/userinfo in HTTPS URLs. -Different usernames in SSH URLs. -Same host/path but different auth scopes. -7. Provider-native identity resolvers - -Design an interface for provider identity resolution. - -Possible interface concept: - -type RepositoryIdentityResolver interface { - Supports(remote ParsedRemote) bool - Resolve(ctx context.Context, remote ParsedRemote, auth GitAuth) (*ResolvedRepositoryIdentity, error) -} - -The exact interface should fit the existing codebase. - -Provider resolvers should attempt to return: - -Provider name. -Provider repository/project ID. -Canonical clone URL if available. -Default branch if available. -Visibility/permissions if useful. -Provider-specific metadata needed for stable identity. - -Start with the providers that are realistic for the codebase. Likely: - -GitHub -GitLab -Gitea - -For each provider, discuss whether the repository ID is authoritative and how it can be fetched: - -Through provider API if credentials are available. -Possibly through unauthenticated API for public repositories. -Fallback to URL normalization and ls-remote when API access is unavailable. - -Do not overpromise. The design should explicitly say that provider identity resolution may be unavailable due to missing credentials, unsupported provider, permissions, or network errors. - -8. Git remote fingerprinting - -Design a fallback fingerprint based on git ls-remote. - -Possible data to collect: - -Symbolic HEAD, via git ls-remote --symref HEAD. -Default branch name. -Default branch SHA. -Advertised refs, via git ls-remote . -Branch refs. -Tag refs. -Optionally whether peeled tags are included and how they are normalized. - -Possible fingerprint: - -refsFingerprint = sha256(sorted(refname + "\x00" + sha + "\n")) - -The design should specify: - -Which refs are included. -Whether to include tags. -How to handle peeled annotated tags like refs/tags/v1.0^{}. -How to handle hidden refs. -How to handle authorization differences where different credentials expose different refs. -How to handle empty repositories. -How to handle remote failures. -How often to refresh the fingerprint. -Whether to debounce/retry. -Whether the fingerprint should be used for status only or also for duplicate detection. - -Important: -A refs fingerprint is not repository identity. It means “these remotes currently expose the same refs.” Treat this as a medium-confidence possible duplicate/mirror signal. - -9. Duplicate classification algorithm - -Propose an algorithm along these lines: - -Parse and normalize the configured remote URL. -Build a conservative normalized remote key. -Try provider-specific identity resolution. -Run git ls-remote to determine default branch and refs fingerprint, if credentials and network allow. -Store the resolved identity data in status. -Compare this GitDestination with other GitDestinations in the same relevant scope. -Classify matches: -Same provider and same provider repo ID => duplicate, authoritative. -Same normalized remote key => duplicate/probable duplicate, strong. -Same full refs fingerprint => possible duplicate/mirror, medium. -Same default branch SHA only => possible related repository, weak; probably do not report prominently unless useful. -Set conditions/status accordingly. -Do not block reconciliation for weak/medium matches unless the user explicitly enables a stricter policy. - -Please define the scope of comparison: - -Same namespace? -Cluster-wide? -Same tenant/workspace if ConfigButler has such a concept? -Same GitProvider? -Same credentials? -Same GitTarget? - -Pick the safest default based on the codebase. - -10. User-facing behavior - -Design how users should experience this. - -Important: - -High-confidence duplicates may be surfaced as a warning or condition. -Medium/weak matches should be advisory, not fatal. -The user should be able to intentionally configure aliases/mirrors without fighting the controller. -There may need to be an explicit override or grouping field. - -Consider a field like: - -spec: - identity: - allowDuplicateOf: some-other-destination - -or: - -spec: - identity: - aliasGroup: configbutler-main - -or: - -spec: - duplicatePolicy: WarnOnly | RejectAuthoritativeDuplicates | Ignore - -Do not introduce this unless it fits the project style. Discuss options and recommend one. - -Possible default: - -Always warn on authoritative duplicates. -Do not reject by default. -Allow future policy to reject authoritative duplicates through validation/admission or controller policy. -Never reject on default-branch SHA alone. -11. API and CRD changes - -Propose concrete CRD/schema changes. - -Include: - -New status fields. -New conditions. -Optional spec fields, if needed. -Backward compatibility implications. -Whether conversion webhooks are needed. -Whether existing GitDestinations need migration. -Whether existing status fields can be reused. - -Keep the spec minimal. Prefer status-first unless there is a strong reason for user-configurable behavior. - -12. Security considerations - -Discuss: - -Do not leak credentials in status. -Strip username/password/token from URLs before storing canonical/normalized URLs. -Be careful with SSH usernames. -Provider APIs may reveal private repo metadata; only store safe fields. -Refs may reveal branch names; status may expose branch names to users who can read the CR. -Different credentials may see different refs, so identity can be auth-context-dependent. -Avoid making network calls from admission webhooks if that would make writes slow or fragile. -Prefer controller reconciliation for remote identity resolution. -13. Reliability and performance - -Discuss: - -git ls-remote is network-bound and can fail. -Provider APIs can rate-limit. -DNS/HTTP/SSH can be flaky. -Identity resolution should be retried with backoff. -Results should be cached in status. -Reconciliation should not hammer Git providers. -The controller should use timeouts. -Duplicate comparison should be efficient, possibly using indexes if controller-runtime supports it in this codebase. -Fingerprints should only be refreshed when relevant inputs change, or on a sensible interval. -14. Failure modes - -Include a section with failure modes: - -Remote unavailable. -Authentication failed. -Provider API unavailable. -Provider API says repo not found but git ls-remote works. -URL normalization fails. -Empty repo. -Default branch missing. -Different credentials expose different refs. -Same repo reachable through a vanity domain. -Same content in two different repos. -Mirror intentionally configured. -Fork initially identical to upstream. -Repo transferred/renamed. -GitHub/GitLab redirects. -Self-hosted provider with unusual path semantics. - -For each, describe expected behavior. - -15. Testing plan - -Design tests. - -Unit tests: - -URL parser and normalizer. -SCP-style SSH parsing. -HTTPS parsing. -.git suffix behavior. -ports. -case sensitivity. -provider-specific path normalization. -refs fingerprint calculation. -duplicate classification. - -Integration tests: - -Fake Git server or local bare repos. -Same repo exposed via multiple URLs if feasible. -Two repos with identical refs. -Fork-like repo with same default branch SHA. -Repos that diverge after initial fingerprint. -Auth failure. -Empty repo. - -Controller tests: - -Status updates. -Conditions. -Duplicate detection across multiple GitDestinations. -Reconciliation retry behavior. -No hard failure for weak/medium matches by default. - -E2E tests: - -Use existing e2e framework if present. -Prefer local/self-contained Git server such as Gitea if the project already uses it. -Test SSH and HTTPS remotes if possible. -16. Rollout plan - -Propose an incremental rollout: - -Add URL parser/normalizer. -Add status fields for normalized key and basic remote info. -Add ls-remote based fingerprint. -Add duplicate detection based on normalized key and fingerprint. -Add provider resolvers for one provider first, likely GitHub or Gitea depending on existing e2e setup. -Add policy/override fields only after real behavior is understood. -17. Alternatives considered - -Discuss alternatives and why they are insufficient: - -Use only URL string equality. -Use only normalized URL. -Use only default branch SHA. -Use only full refs fingerprint. -Always clone the repo and inspect object database. -Rely on DNS canonicalization. -Rely only on provider APIs. -Hard reject all apparent duplicates. -18. Recommended decision - -End with a concrete recommendation. - -The recommendation should likely be: - -Implement a status-first identity system. -Use provider-native repository IDs as authoritative where available. -Use conservative URL normalization as a strong signal. -Use git ls-remote refs fingerprint as a medium-confidence “same exposed content” signal. -Use default branch SHA only as a weak diagnostic signal. -Do not reject duplicates by default. -Surface authoritative duplicates and possible duplicates clearly in status/conditions. -Keep room for future policy enforcement. -19. Open questions - -List open questions that need project-owner input, such as: - -Should duplicate detection be namespace-scoped or cluster-scoped? -Should authoritative duplicates eventually be rejected? -Should mirrors be explicitly modelled? -Which providers should be supported first? -Should identity resolution be tied to GitProvider credentials? -Should users be able to set a manual identity/alias group? -How much remote metadata is acceptable to expose in status? - -Output requirements: - -Produce a complete Markdown design document. -Be specific and concrete. -Do not invent existing code details. If something is unknown, say what needs to be inspected or verified. -Prefer a design that can be implemented incrementally. -Include YAML examples where useful. -Include pseudocode for the classification algorithm. -Use the terminology GitDestination unless the codebase uses a different exact name. -Keep the design honest: arbitrary Git repository identity cannot be solved perfectly. - -I’d keep the prompt this opinionated. Otherwise an agent will often drift toward the tempting-but-wrong “compare URLs \ No newline at end of file diff --git a/docs/design/manifest/version2/dream.md b/docs/design/manifest/version2/dream.md deleted file mode 100644 index cfcaa96e..00000000 --- a/docs/design/manifest/version2/dream.md +++ /dev/null @@ -1,24 +0,0 @@ -I have a 'dream' on the initial GitTarget reconcile. It consists out of a few things: - -* I believe that we should have a more fixed GKV GKR lookup table per GitTarget, off course it should change, but it should be a consise step. -* I really would like to split the reconcile into every bound GKV, so if we have 5 gkvs that we are tracking: we will have have 5 reconcile actions. One for every gkv. Once a reconicle is done the tracking is starting: that helps in multiple situations. - * We can do them one by one, having one reconile commit per type - * We can immediatly start tracking changes once the initial type is done - * If new types are added or removed from the GitTarget GKV table then we reconcile that sepeate, without needing a completely new reconicle - * We might be able to even do one 'reconcile' on the kubernetes side (one LIST or InitialSendEvents) and 'stream' that to all GitTargets that need it. - -There is also a technical improvement in the Kubernetes API that makes this more approachale: within a resource type you can now trust the RV to be increasing over time. This is really nice since this also would give the option to even pickup events from during the resync. Especially for longer syncs (bigger sets of resources) that would be a very nice property. I would look at it as merging two datastreams: the initial send (the fake 'added' events from the watch) and when thats finished, picking up the first event that has an higher RV. (you can pick up the earlier events but you should drop them off course). - -I see some consequenes: -* More than one commit (which is fine and even more readable I guess?) And perhaps we can also use the normal mechanism to get quick reconciles into one (that we also do for multiple events). -* We should be carefull now with multiple commits / writers (I guess that it still should go on the branchworkers queue so that it all is in order) -* I'm now sketing a scenario with bigger amounts of resources: we might want to create a good e2e test for this as well, and then als add some metrics on that specific situation. -* This gives a bit of breathing room for wobbly types in the Kubernetes API that are 'not reachable' or whatever: we now can just sync the types that are stable. And only have troubles with types that are not stable (which also is understandable and not the fault of gitops-reverser) -* Perhaps: we can even drop the whole hash thing? Since we now can trust the RV to be correct? I guess that all that hashing of content is not really good for our CPU usage... Also the hashing for the whole group etc. I would hope that we can drop some complexity because of this. - -Visibility: -* I would love it to have more overview of the actual data inside a GitTarget: which resource types do we exactly follow. Which exact CRD version is behind something, etc. It would be very good to have some API for that, not sure if we could push it to the status since it could become to big? -* I would love to see the sync state and perhaps even a total synced counter per type. Not sure here: it's a lot of data, but it's also a lot of 'darkness' now for a new user if we don't provide anything. -* Off course metrics are also a good place to start for anyone curious: and most admins/devs do that these days as well - - diff --git a/docs/design/manifest/version2/gittarget-repository-validity-and-placement.md b/docs/design/manifest/version2/gittarget-repository-validity-and-placement.md deleted file mode 100644 index 471a81a5..00000000 --- a/docs/design/manifest/version2/gittarget-repository-validity-and-placement.md +++ /dev/null @@ -1,305 +0,0 @@ -# GitTarget repository validity and placement controls - -> Status: proposed -> Related: [manifest-inventory-file-agnostic-placement.md](../manifest-inventory-file-agnostic-placement.md), -> [manifestedit-new-file-placement-spike.md](../../../finished/manifestedit-new-file-placement-spike.md), -> [manifestedit-integration-readonly-reconcile.md](../manifestedit-integration-readonly-reconcile.md) - -## Summary - -GitTarget startup should include a repository-content validity gate. A GitTarget -is valid only when the configured branch/path contains at most one editable KRM -document for each Kubernetes resource identity. If Git contains two manifests for -the same resource, the API is still the source of truth, but Git no longer has a -single safe destination for that truth. The GitTarget must not start, and a -running GitTarget must transition back to invalid as soon as the branch scan sees -the duplicate. - -This replaces the older "first occurrence wins, delete duplicate losers" idea in -the file-agnostic placement vision. Duplicate KRM is not a prune candidate; it is -an invalid repository state that requires a human or upstream Git process to -choose the authoritative file. - -This same round should add two GitTarget placement controls: - -- `spec.discovery.recurse`: whether repository discovery scans only the immediate - GitTarget path or recursively scans child folders. -- `spec.newFilePath`: a template that decides where newly-discovered API objects - are written when no existing Git document owns them. If multiple new resources - resolve to the same file path, the writer may create or append a multi-document - YAML file. - -## Desired API shape - -```yaml -apiVersion: configbutler.ai/v1alpha3 -kind: GitTarget -spec: - providerRef: - name: platform - branch: main - path: clusters/prod - discovery: - recurse: true - newFilePath: "{{ .GroupPath }}/{{ .Version }}/{{ .Resource }}/{{ .Namespace }}/{{ .Name }}.yaml" -``` - -`discovery.recurse` defaults to `true` to preserve the current inventory -direction, which recursively scans YAML below the GitTarget path. Users with flat -GitOps folders can set it to `false`; then only files directly under -`spec.path` are discovered, and subdirectories are ignored for duplicate -detection and repo-state snapshots. - -`newFilePath` replaces any enum-style choice for new-file placement. It is a -single template evaluated relative to `spec.path`. The default renders the -current canonical layout. Suggested template variables: - -| Variable | Meaning | -|---|---| -| `.Group` | API group, empty for core resources | -| `.GroupPath` | API group as a path segment, omitted for core resources | -| `.Version` | API version | -| `.Resource` | plural resource name | -| `.Kind` | manifest kind when available | -| `.Namespace` | namespace, empty for cluster-scoped resources | -| `.Name` | object name | - -Rules: - -- The rendered path must be relative, clean, and stay under `spec.path`. -- Empty path segments are removed before joining. -- Sensitive resources still use `.sops.yaml` unless `newFilePath` already - renders that suffix. -- Existing-resource writes always follow the inventory location. `newFilePath` - applies only when Git has no document for the API object. - -## Multi-document creation - -`newFilePath` makes multi-document files a natural outcome instead of a separate -mode enum. If two API objects with no existing Git location render to the same -file, the writer appends the second object as another YAML document in that file: - -```yaml -apiVersion: v1 -kind: ConfigMap -metadata: - name: app-config - namespace: default ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: app - namespace: default -``` - -This is allowed only for plaintext manifests. Encrypted SOPS files remain -single-document because the writer re-encrypts whole files and must not combine -multiple secrets or secret-adjacent objects into one encrypted document stream. - -If an existing file at the rendered `newFilePath` contains valid KRM documents, -the writer may append the new document when doing so does not create a duplicate -identity. If the file is invalid YAML, non-editable, encrypted, or outside the -discovery scope, the write is refused and surfaced as a repository validity -problem instead of overwriting user content. - -## Repository validity gate - -Add a new condition: - -```text -RepositoryValid -``` - -Suggested reasons: - -| Reason | Meaning | -|---|---| -| `OK` | Branch/path scanned and no blocking repository-content issues were found | -| `DuplicateResourceManifests` | Two or more KRM documents target the same resource | -| `InvalidRepositoryContent` | YAML or placement content is unsafe enough to block startup | -| `ScanFailed` | The branch/path could not be fetched or scanned | -| `NotStarted` | Blocked by an earlier gate | - -Gate order: - -1. `Validated`: provider, branch allow-list, GitTarget path conflicts. -2. `EncryptionConfigured`. -3. `RepositoryValid`: fetch/sync the branch and scan `spec.path` with the - configured recursion policy. -4. `SnapshotSynced`. -5. `EventStreamLive`. -6. `Ready`. - -When `RepositoryValid=False`, set: - -- `SnapshotSynced=Unknown` with reason `Blocked` -- `EventStreamLive=False` with reason `RepositoryInvalid` -- `Ready=False` with reason `RepositoryInvalid` - -The GitTarget must not accept live events while invalid. If the target had -already reached live processing and a later branch scan discovers duplicate KRM, -the controller disables or unregisters that GitTarget's event stream and deletes -its `FolderReconciler`. The branch worker may remain alive for other GitTargets -on the same provider/branch. - -## Duplicate identity definition - -The validity scan should use the API-side resource identity wherever possible: - -```text -group/version/resource/namespace/name -``` - -Manifest content gives `apiVersion`, `kind`, `metadata.namespace`, and -`metadata.name`. The scanner maps GVK to GVR through the same discovery/catalog -path used by WatchRule resolution. If mapping is unavailable, the scanner may use -manifest identity as a fallback diagnostic, but a production duplicate block -should be based on API identity so aliases or preferred-version details do not -hide conflicts. - -Cluster-scoped resources use an empty namespace. Documents with no namespace for -a namespaced resource are invalid unless an explicit future namespace-context -feature supplies that namespace. - -Duplicate examples that must block: - -- `apps/v1 Deployment default/app` in `app.yaml` and `copy.yaml` -- the same ConfigMap repeated twice inside one multi-document YAML file -- one copy at the canonical path and one user-placed copy under `apps/app.yaml` - -Non-KRM YAML, empty YAML documents, and unwatched resource kinds do not -participate in duplicate blocking unless they are otherwise invalid enough to -block scanning. - -## Detecting external pushes - -Repository validity is not only a startup check. Every time the controller syncs -or observes a newer remote branch tip for a GitTarget, it must rescan the -configured path before keeping the target live. - -Implementation model: - -1. Fetch branch metadata for the GitTarget. -2. If the remote HEAD changed since the last repository-valid scan, checkout the - new tree and rebuild inventory for `spec.path`. -3. If duplicate identities are found, transition the GitTarget to - `RepositoryValid=False` in the same reconcile and stop its event stream. -4. If a later push removes the duplicate, the next scan returns the GitTarget to - `RepositoryValid=True`, runs snapshot sync again, then resumes live events. - -"Immediately" means the next GitTarget reconcile after the remote change is -observed. In e2e tests this should be driven by an explicit reconcile trigger or -by waiting for the controller's branch metadata poll interval; if a Git webhook -or provider callback is added later, it can shorten the same path without -changing the state machine. - -## Implementation steps - -1. Extend the API: - - add `GitTargetSpec.Discovery *GitTargetDiscoverySpec` - - add `GitTargetDiscoverySpec.Recurse *bool` defaulting to `true` - - add `GitTargetSpec.NewFilePath string` - - add kubebuilder validation for relative path template output constraints - where possible; runtime validation still owns rendered paths. -2. Extend manifest scanning: - - add `IndexDir(root, options)` or `IndexDirWithOptions` - - support recursive and flat scans - - expose duplicate groups, not only duplicate losers - - keep diagnostics bounded for status. -3. Add repository validation to `BranchWorker`: - - fetch/prepare branch - - scan the GitTarget path - - return summary counts plus duplicate details. -4. Add the `RepositoryValid` gate to `GitTargetReconciler`. -5. Make `EventRouter`/`GitTargetEventStream` stoppable for invalid targets. -6. Replace new-file placement enum usage with `newFilePath` rendering. -7. Add append-to-existing-file support for same-path new resources, with - plaintext-only and no-duplicate guards. -8. Update CRDs, samples, Helm chart values, and configuration docs. - -## E2E tests - -### Existing folder with duplicate KRM blocks startup - -Purpose: prove the simple invalid-at-start case. - -Setup: - -1. Create a fresh e2e repo/branch. -2. Commit two plaintext YAML files under the future GitTarget path: - - ```text - clusters/prod/app-a.yaml - clusters/prod/app-b.yaml - ``` - - Both files contain the same `v1/ConfigMap default/app`, with different data so - it is obvious they are separate copies. -3. Create a `GitProvider`, `GitTarget`, and `WatchRule` for ConfigMaps. Set - `spec.path: clusters/prod` and leave `discovery.recurse` at the default. - -Expected assertions: - -- `GitTarget.status.conditions[RepositoryValid]` becomes `False`. -- Reason is `DuplicateResourceManifests`. -- The condition message names the duplicated resource and both locations, bounded - if there are many duplicates. -- `Ready=False` with reason `RepositoryInvalid`. -- `SnapshotSynced` is `Unknown` or `False` and did not create a write request. -- `EventStreamLive=False` or `Unknown`; live API edits to `default/app` do not - produce a commit while invalid. - -### External push with duplicate KRM invalidates a live GitTarget - -Purpose: prove a valid running target becomes invalid after another actor pushes -a duplicate manifest into the branch/path. - -Setup: - -1. Create a fresh e2e repo/branch with one valid manifest under - `clusters/prod/app.yaml`. -2. Create `GitProvider`, `GitTarget`, and `WatchRule`. -3. Wait until the GitTarget is `Ready=True`, - `RepositoryValid=True`, `SnapshotSynced=True`, and `EventStreamLive=True`. -4. From an external clone or direct Gitea API helper, push - `clusters/prod/copy.yaml` containing the same `v1/ConfigMap default/app`. -5. Trigger or wait for the GitTarget reconcile that observes the new remote HEAD. - -Expected assertions: - -- The GitTarget transitions from `Ready=True` to `Ready=False`. -- `RepositoryValid=False` with reason `DuplicateResourceManifests`. -- `EventStreamLive=False` with reason `RepositoryInvalid`, and the stream no - longer accepts live events for that GitTarget. -- The controller does not auto-delete either duplicate file. -- An API update to the ConfigMap while the GitTarget is invalid does not create a - Git commit. -- After removing `copy.yaml` with another external push, the next reconcile makes - `RepositoryValid=True`; the target runs snapshot sync before returning to - `Ready=True`. - -### Discovery recursion coverage - -The duplicate tests should be extended with a table once `discovery.recurse` -lands: - -| `recurse` | Duplicate location | Expected | -|---|---|---| -| `true` | `clusters/prod/app.yaml` and `clusters/prod/nested/app.yaml` | invalid | -| `false` | `clusters/prod/app.yaml` and `clusters/prod/nested/app.yaml` | valid; nested file ignored | -| `false` | `clusters/prod/app-a.yaml` and `clusters/prod/app-b.yaml` | invalid | - -This can be unit-tested first around the scanner and covered in e2e by one -representative `recurse=false` GitTarget. - -## Open questions - -- Should invalid YAML block `RepositoryValid`, or only the subset that looks like - KRM and cannot be safely classified? -- How much duplicate detail belongs in GitTarget status before it becomes too - large? A bounded summary plus first N examples is likely enough. -- Should a branch push notification be added so external invalidating pushes are - observed faster than the normal reconcile/poll interval? -- Should `newFilePath` support conditionals, or only simple variable expansion - plus path cleanup? diff --git a/docs/design/manifest/version2/subresource-scope-reduction.md b/docs/design/manifest/version2/subresource-scope-reduction.md deleted file mode 100644 index 86387db2..00000000 --- a/docs/design/manifest/version2/subresource-scope-reduction.md +++ /dev/null @@ -1,237 +0,0 @@ -# Subresource Scope Reduction - -> Status: improvement proposal, captured 2026-06-08. -> -> Amends: -> [api-catalog-watched-type-architecture.md](api-catalog-watched-type-architecture.md) -> and -> [scale-subresource-audit-rehydration.md](../../../finished/scale-subresource-audit-rehydration.md). -> -> Trigger: after reviewing Kubernetes subresource facts and the recorded -> `deployments/scale` audit event, the previous generic-subresource direction is -> broader than GitOps Reverser needs. - -## Decision - -For the first simplification pass, support only Kubernetes `/scale` subresources -whose parent replica path is known. Built-in Kubernetes types get that path from -a built-in scale pointer registry; CRDs eventually get the same fields from CRD -`spec.versions[*].subresources.scale`. - -Ignore every other subresource for now. - -Do not add CRD scale support until the richer API resource object exists. CRD -scale needs that object to carry the parent `specReplicasPath`; until then, a CRD -scale event must fail clearly as "scale path unresolved" rather than guessing -`.spec.replicas`. - -Do not add special aggregated-API handling. Aggregated API subresources should -fall through the same unsupported path as any other non-built-in subresource. If -an aggregated API exposes `/scale`, it will not have a known parent replica path -in the current API resource model and should be dropped with the same "scale path -unresolved" outcome. - -## Why This Is Enough - -The recorded Deployment scale event proves the useful case: - -- the request is addressed to `deployments/scale`; -- the audit `responseObject` is `autoscaling/v1 Scale`, not `apps/v1 Deployment`; -- the parent Deployment is still the object that changed; -- the accepted desired value is `responseObject.spec.replicas`; -- the `Scale.metadata.resourceVersion` matched the normal parent Deployment read - in the local capture. - -That is a narrow, valuable GitOps case: a subresource writes parent desired -state, and Kubernetes exposes the accepted value in a standardized response. - -Most other subresources do not have that shape. They are observed state, runtime -streams, derived reads, credentials, lifecycle control, proxying, or imperative -actions. Treating them as generic parent `spec` patches invites accidental -mirroring of behavior that is not durable desired state. - -## Scope - -### In Scope - -- `*/scale` on scalable resources whose parent path is known. -- Built-in scalable resources whose paths come from the built-in scale pointer - registry, such as Deployments, StatefulSets, ReplicaSets, and - ReplicationControllers. -- Metrics for dropped subresources. -- Parent-resource WatchRule matching. Rules continue to name `deployments`, not - `deployments/scale`. -- Field-patch writes into existing parent manifests. - -### Out Of Scope - -- Generic translation of arbitrary `responseObject.spec` trees. -- Subresources in `WatchRule.resources`. -- Subresources in `WatchedTypeTable`. -- Writing subresource response objects to Git. -- CRD scale support until CRD scale pointers are carried on the API resource - object. -- Aggregated API subresource support. -- Status, exec, attach, portforward, log, proxy, eviction, binding, finalize, - approval, token, restart, console, VNC, or similar operation subresources. - -## Architecture Tune-Back - -The API catalog should remain a raw discovery cache for served resources. It may -retain raw subresource entries because Kubernetes discovery reports them, but -GitOps Reverser should not build an operational subresource type system on top of -them. - -The resolved type surface, if kept, should resolve parent resources only: - -- exact GVK to parent GVR; -- exact GVR to parent type facts; -- top-level resource ambiguity and disallowed policy; -- subresource-only matches refused as a planning miss. - -`WatchedTypeTable` stays GitTarget-local and parent-GVR-only. A watched type is -the object we list, watch, snapshot, and write as a manifest. A subresource is an -audit-event modifier on that parent, not a watched type. - -This means we can drop the broad direction where every subresource gets a generic -translation opportunity guarded by sanitized parent field presence. Scale support -should be explicit: if the parent replica path is not known, the event is dropped. - -## Scale Translation - -Replace generic subresource translation with a scale-specific translator. - -Input requirements: - -- `objectRef.subresource == "scale"`; -- verb maps to a mutating operation; -- `responseObject.spec.replicas` exists; -- parent GVR matches at least one WatchRule or ClusterWatchRule; -- parent replica path is known by the API resource object. - -Translation: - -```text -autoscaling/v1 Scale responseObject.spec.replicas - -> parent manifest assignment at resolved replicas path -``` - -For built-in scalable resources, the API resource object should be populated from -the built-in scale pointer registry, so the translator sees the same shape it -will later see for CRDs: - -```text -responseObject.spec.replicas -> parent .spec.replicas -``` - -For CRDs and aggregated APIs in the first pass: - -```text -no known parent replica path -> dropped_scale_path_unresolved -``` - -Do not read: - -- `requestObject.spec`; -- `responseObject.status`; -- arbitrary leaves under `responseObject.spec`; -- the subresource body's `apiVersion` or `kind` as parent identity. - -## CRD Scale Deferred - -Do not add a separate CRD scale path index in this pass. - -The desired future shape is a richer API resource object that can answer: - -```text -parent GVR -> scale parent replica path -``` - -For a built-in Deployment this answer should come from the built-in scale pointer -registry: - -```text -apps/v1 deployments -> ["spec", "replicas"] -``` - -For a CRD with scale enabled, the future answer should come from: - -```text -spec.versions[*].subresources.scale.specReplicasPath -``` - -Until that API resource object exists, CRD scale events are not supported. They -must not be special-cased through a parallel CRD informer, and they must not -default to `.spec.replicas`. - -## Metrics - -Keep labels bounded: - -```text -source, group, version, resource, subresource, verb, outcome -``` - -Do not label by name, namespace, UID, request URI, or backend identity. - -Recommended outcomes: - -| Outcome | Meaning | -| --- | --- | -| `routed_scale_subresource` | Scale translated and routed with a known parent path. | -| `dropped_non_scale_subresource` | Subresource is not `scale` and is not supported. | -| `dropped_scale_missing_response_replicas` | Scale response lacks `responseObject.spec.replicas`. | -| `dropped_scale_path_unresolved` | No known parent replica path exists for this resource. | -| `scale_patch_no_parent` | Parent manifest absent from Git. | -| `scale_patch_unsafe` | Parent manifest exists but cannot be patched safely. | - -`audit_events_received_total` can continue to expose the raw `subresource` label, -but the explicit dropped outcomes are what make ignored subresources visible. - -## Implementation Plan - -1. Replace `translateSubresourceToAssignments` with a scale-only translator. -2. Keep `manifestedit.PatchFields` and `git.FieldPatch`; they are the right write - primitive for Scale. -3. Remove the sanitized parent field-presence gate from subresource routing. -4. Add built-in scale paths through the same API resource field that CRD scale - will use later; do not scatter built-in path conditionals through the - translator. -5. Do not add CRD scale path indexing yet. -6. Do not add aggregated API classification for subresource handling. -7. Change webhook ingress to forward only candidate Scale events; drop and metric - non-scale subresources. -8. Change consumer metrics from generic subresource outcomes to scale-specific - outcomes. -9. Add tests: - - built-in Deployment scale routes to `spec.replicas`; - - built-in Deployment scale path is read from the API resource scale fact, not - a translator-local conditional; - - CRD scale is dropped with `dropped_scale_path_unresolved`; - - generic `responseObject.spec.foo` subresource is dropped; - - aggregated API scale is dropped with `dropped_scale_path_unresolved`; - - `WatchRule.resources: ["deployments/scale"]` remains rejected. - -## Complexity To Remove - -- Generic "walk every leaf of `responseObject.spec`" subresource translation. -- The idea that sanitized parent field presence is enough to authorize unknown - subresources. -- The sanitized parent field-presence gate for subresource routing. -- A parallel CRD scale-path index. -- Translator-local built-in scale conditionals once the built-in registry - populates the shared API resource scale fact. -- Aggregated API subresource classification. -- Any future work to add subresource entries to watched-type planning. -- Any resolved type-surface API that treats subresources as first-class selected - types. -- Broad hard-deny taxonomy as the main safety mechanism. With scale-only support, - the primary rule is simpler: only `scale` can route; everything else drops. - -## Revised Principle - -Subresources are not a new manifest surface for GitOps Reverser. - -They are ignored by default. `/scale` is the single exception because Kubernetes -standardizes it as a view that writes parent desired replica state. Even `/scale` -routes only when the parent replica path is known. diff --git a/docs/design/manifest/version2/type-followability-implementation.md b/docs/design/manifest/version2/type-followability-implementation.md deleted file mode 100644 index 7da19ef6..00000000 --- a/docs/design/manifest/version2/type-followability-implementation.md +++ /dev/null @@ -1,437 +0,0 @@ -# Type followability — implementation log - -> Companion to [type-followability.md](type-followability.md). This file is the -> running, append-only record of what the implementation actually changed, in the -> order it changed it. The design doc says what we want; this says what we did. -> Naming follow-up: [type-followability-naming-proposal.md](type-followability-naming-proposal.md). -> Catalog/typeset boundary follow-up: -> [discovery-catalog-typeset-boundary.md](discovery-catalog-typeset-boundary.md). - -## Goal - -Collapse the scattered type-handling logic (catalog scan + GVK→GVR mapper + rule -GVR resolver + watched-type table/resolver + a hardcoded scale switch) into the -three-layer model of the design: - -``` -Scan ─▶ Observation ─▶ TypeRegistry (the single decision surface) ─▶ TargetView -``` - -The heart is one `TypeRecord` carrying one `Followability` (verdict + summary + -funnel-ordered checks), with a single reason-code vocabulary used everywhere a -type is turned away. - -## Strategy - -Land it in green-keeping increments — `task test` (>90% coverage) and -`task test-e2e` must stay green at every committed step. New canonical model lives -in a fresh leaf package `internal/typeset` (no Kubernetes client deps, just -apimachinery `schema`), so both the live cluster path (`internal/watch`) and the -no-cluster analyzer path can share one decision surface. - -## Change list - -### Stage 1 — `internal/typeset` model + funnel evaluator (additive) - -- New package `internal/typeset`. Pure data model + the funnel that turns an - `Observation` (raw per-type facts) plus policy into a `Followability`. -- Files: - - `model.go` — `Identity`, `Scope`, `Origin`, `OriginKind`, `Confidence`, - `TypeRecord`, `Followability`, `Check`, `Verdict`, `Requirement`, `Result`, - `Reason`, `Subresources`, `StatusFact`, `ScaleBinding`. `TypeRecord.Followable()`. - - `scale.go` — the built-in scale registry (`BuiltinScale`), the single source - of `/scale` parent-replica facts for built-ins (folds the old - `auditutil.BuiltinScaleReplicasPath`). - - `funnel.go` — `Evaluate(Observation, Policy) Followability`: the funnel-order - requirement checks and the mechanical verdict derivation. -- Reason vocabulary (kebab-case, stable): `not-served`, `subresource-only`, - `discovery-degraded`, `catalog-unavailable`, `absence-expired`, `gvk-not-unique`, - `gvr-not-unique`, `scope-unknown`, `missing-verb`, `origin-unknown`, - `denied-by-policy`, `sensitive-unsupported`, `scale-path-unresolved`. - -- Tests: `model_test.go`, `funnel_test.go`, `scale_test.go` — table-driven, 95.2% - package coverage. The funnel test mutates one field of a baseline followable - Deployment observation per case and asserts verdict + summary + the failing check. - -### Stage 2 — `typeset.Registry` decision surface (additive) - -- `registry.go` — `Registry`: one `TypeRecord` per known type, the lookups - (`ByGVK`, `ByGVR`, `Followable`, `All`, `Ready`, `Generation`), and the live-set - `RemovalGrace` (fixed 60s). `Update(observations, generation)` replaces the set and - applies the grace: additions are immediate; a previously-live type that stops being - observed is re-judged `retained` within the grace and dropped once it elapses. The - clock is injectable (`newRegistry`) so the grace is deterministic in tests. -- Identity ambiguity: a GVK served by >1 GVR keeps one refused record per resource - (each carries `gvk-not-unique`); `ByGVK` returns the deterministic first by GVR. -- Tests: `registry_test.go` — grace retain→drop, reappearance restarts the grace, - refused (never-live) types drop immediately, ambiguous-GVK refusal. 97% coverage. - -### Stage 4 — single source of built-in scale facts - -- `auditutil.BuiltinScaleReplicasPath` is now a thin `[]string` adapter over - `typeset.BuiltinScale` + `typeset.SplitFieldPath`. The hardcoded apps/core switch - moved into `typeset.BuiltinScale`, so the followability registry (origin/scale - enrichment) and the audit consumer (`internal/queue` scale write) read one binding - and can never drift. Callers and their tests are unchanged (path still - `["spec","replicas"]`, still a fresh owned slice). - -### Stage 5 — live Scan → Observation → Registry pipeline in the Manager - -- `internal/watch/catalog_observe.go` — `APIResourceCatalog.Observations()` projects - the catalog scan into one `typeset.Observation` per served top-level type: identity - (GVK/GVR/scope), discovery verbs, preferred, trust state, resource policy - (`Allowed`/`PolicyReason` → `denied-by-policy`), GVK identity uniqueness, the core - Secret sensitivity flag, and folded subresource facts (`/status` presence, `/scale` - binding from `typeset.BuiltinScale`). Origin is a group-shape heuristic (builtin vs. - crd, confidence `inferred`) that never returns `unknown` for a served type. -- `internal/watch/manager_catalog.go` — the Manager holds a `*typeset.Registry` - (`typeRegistryInstance`), `refreshTypeRegistry()` republishes it from the scan after - every `RefreshAPIResourceCatalog`, and `FollowableTypeRecords()` / `TypeRecords()` - expose the live set and the full inventory. The "API resource catalog ready" log - line now reports `followableTypes` / `knownTypes`, so the pipeline is exercised on - the real cluster during e2e. -- Tests: `catalog_observe_test.go` — followable built-in (Deployment, with a usable - scale binding), followable CRD, policy-denied built-in (Pod), missing-verb built-in - (Node), sensitive-but-supported (Secret), subresources excluded from the registry, - ambiguous-GVK refusal, and the Manager refresh populating the registry at the - catalog generation. - -### Stage 6 — CatalogMapper deleted; the live mapper is registry-backed - -The user asked to remove `CatalogMapper` outright and accept the behavior change, -simplifying where a choice is forced (no detailed per-GitTarget report for a -misconfigured cluster type — yet). - -- **Deleted** `internal/watch/catalog_mapper.go` (the `CatalogMapper` struct, the old - `Manager.Mapper()`, and the `mappingEntries`/`verbSlice`/`lookupState` helpers). -- **New** `internal/watch/registry_mapper.go` — `registryMapper` implements - `mapping.ResourceMapper` over `typeset.Registry`. `Manager.Mapper()` returns it. - `GVRForGVK` now answers from the single decision surface: - - known + followable/retained → `Resolved` (GVR, scope→Namespaced, verbs, preferred); - - known + refused → first-failing requirement maps to a status: `identity` → - `Ambiguous`, `policy` → `Disallowed`, anything else → `Unserved` (the simplification - — the analyzer already lumps the non-policy refusals into one "unresolved" issue, - so collapsing verb/scope/origin/scale refusals to `Unserved` loses no decision); - - unknown kind → `CatalogUnavailable` (registry not ready), `DiscoveryDegraded` (its - group/version is degraded), else `Unserved`. Trust state still comes from the - catalog via the new `APIResourceCatalog.GroupVersionDegraded`. -- `refreshTypeRegistry` now publishes only once `catalog.Ready()`, so an unready - catalog keeps the registry (and therefore the mapper) reporting `CatalogUnavailable` - rather than an empty-but-ready scan. -- The mapper reduction in `internal/mapping` is untouched — the no-cluster analyzer - still uses the static-snapshot/structure-only implementations. Only the *live* - implementation moved onto the registry. -- Tests: `catalog_mapper_test.go` → `registry_mapper_test.go` (Resolved, Unserved, - CatalogUnavailable, Disallowed, **Ambiguous** — the new global identity rule — - DiscoveryDegraded, context-cancelled, nil-registry, and Manager hand-out). - -**Verb requirement relaxed (deliberate deviation from the design doc).** The doc lists -`verbs` as get/list/watch/**patch**. Once the registry backs the *live* mapper, a -patch requirement would refuse read-only-but-mirrorable types (and broke the -list/watch-only test fixtures). GitOps Reverser mirrors cluster→Git, which is a read -path, so [`requiredVerbs`](../../../../internal/typeset/funnel.go) is now -**get/list/watch**. The one write-back (a `/scale` replica assignment) is gated on the -scale subresource's own verbs via the `scale` requirement, not on the parent carrying -`patch`. This also keeps the funnel coherent with the live watch resolver (which only -ever required list+watch). - -### Stage 7 — `internal/mapping` deleted; the registry is the only Lookup - -The whole `mapping.ResourceMapper` / `mapping.Result` contract is gone. It had two -jobs: a status reporter (its 8-way vocabulary — not needed, the registry answers one -followability question) and a *source abstraction* that let the offline analyzer and -the live worker share one engine. `typeset` now does the second job too, so the -package was deleted. - -- **`typeset.Lookup`** ([lookup.go](../../../../internal/typeset/lookup.go)) — the - minimal surface every consumer reads: `Ready() bool` + `ByGVK(gvk) (TypeRecord, - bool)`. `*typeset.Registry` satisfies it. The three former mapper modes are now - three registry constructors: live (`Manager.TypeRegistry()`), snapshot - (`NewSnapshotRegistry`, for fixtures/CLI), and structure-only (an un-`Update`d - `NewRegistry()`, whose `Ready()==false` is exactly "no API source — don't judge"). -- **`typeset.ObservationsFromEntries`** ([observe.go](../../../../internal/typeset/observe.go)) - — the scan reduction (identity uniqueness, origin, scale, sensitivity, policy) moved - out of `internal/watch` into `typeset`, operating on a neutral `typeset.Entry`. The - catalog converts its discovery entries to `Entry`; the snapshot builds `Entry` - fixtures. One reduction, two sources. -- **`internal/manifestanalyzer`** now consumes a `typeset.Lookup`. `DocumentModel. - Mapping` is a 3-value `MappingOutcome` (`Followable` / `NotFollowable` / - `NoSource`) instead of `mapping.Status`. Acceptance collapses every not-followable - cause into one `IssueUnresolvedKRM` refusal (the `IssueUnwatchedAPIKRM` policy - distinction is dropped — the user asked not to over-report *why* a type is refused). - `hasAPISource` / `plan.go` follow the 3-state. -- **`internal/git`** worker threads a `typeset.Lookup` (the field/method keep the - `mapper`/`SetMapper` names); `cmd/main.go` injects `watchMgr.TypeRegistry()`. -- **`internal/watch`** gained `Manager.logTypeRefusals` — the single central place - refusals are logged (one V(1) line per refused type, edge-triggered by GVK+summary - so a stable refusal logs once). The full machine-readable "why" stays on the - registry record (`TypeRecords()`), not in logs. -- **Deleted:** `internal/mapping/` (mapper.go, static_snapshot.go, structure_only.go - + tests). All fixtures across `manifestanalyzer` and `git` tests moved to - `typeset.Snapshot`/`typeset.Entry`; a snapshot entry with no Verbs is assumed - followable-verbed (a fixture convenience), and the status-table tests collapsed to - the 3 outcomes. - -### Stage 8 — close the GVR→Kind direction of the bijection (review follow-up) - -A review noted `gvr-not-unique` was modelled but never produced: `observationFromEntry` -hardcoded `GVRUnique: true`. Verdict: not a real-world bug (a GVR is -group/version/**resource**, and discovery keeps a resource name unique per -group/version, so `GVR → Kind` is structurally 1:1 from a live cluster — and the -catalog dedupes `byGVR` before observations are even built), but a genuine -model-consistency gap: the funnel advertised a `gvr-not-unique` reason and -`GVRUnique`/`GVRConflictDetail` fields that were dead, and a non-discovery `Lookup` -source (a snapshot fixture) could be handed a duplicate GVR and would silently pick a -winner instead of refusing both. - -Fix in [observe.go](../../../../internal/typeset/observe.go): identity uniqueness is -now computed in **both** directions from the entries — `distinctGVRsByGVK` (GVK→ -distinct resources, `gvk-not-unique`) and `distinctGVKsByGVR` (GVR→distinct kinds, -`gvr-not-unique`), both keyed on distinct values so an exact duplicate (same GVR+GVK) -collapses rather than being mistaken for a conflict. The live path is unchanged -(catalog `byGVR` is deduped, so `GVRUnique` stays true — correct, real discovery is -1:1); the snapshot/non-discovery path now refuses a GVR served by two Kinds with -`gvr-not-unique`. Regression tests: `TestObservationsFromEntries_AmbiguousGVR` and -`_ExactDuplicateIsNotAConflict`. - -### Stage 9 — sensitivity is a policy input on the Entry, not inferred (review follow-up) - -A review asked: shouldn't `Sensitive` be modelled on `typeset.Entry` already, since it -is known at startup? It was right. `typeset` hardcoded `coreSecret(group, resource)`, -which **ignored the operator-configured `SensitiveResourcePolicy`** (the flag-driven -"additional sensitive resources") — so `TypeRecord.Sensitive` was wrong for anything -sensitive beyond core Secrets. (Nothing reads `TypeRecord.Sensitive` yet, so this was a -model-correctness fix, not a behavior change.) - -- `typeset.Entry` gained a `Sensitive bool` input (next to `Allowed`/`PolicyReason`); - `observationFromEntry` now reads `e.Sensitive` and the hardcoded `coreSecret` helper - is gone. `typeset` no longer knows the word "secrets" — sensitivity is policy, applied - by the entry builder. -- `APIResourceCatalog.Observations(sensitive types.SensitiveResourcePolicy)` applies the - configured policy per entry (`sensitive.IsSensitive(group, resource)`), exactly as the - allow/deny policy is applied. The watch `Manager` gained a `SensitiveResources` field, - set from `cfg.sensitiveResources` in `cmd/main.go` (the same value the worker already - gets); `refreshTypeRegistry` passes it. The zero value still treats core Secrets as - sensitive. -- Test: `TestObservations_AppliesConfiguredSensitivePolicy` proves an operator-marked - type (configmaps) comes back `Sensitive`, core Secrets stay sensitive, and an unlisted - type does not. - -### Stage 10 — `WatchedTypeTable` is a registry projection; the duplicate grace is gone - -The last duplicated decision surface. The table used to run its **own** identity/conflict -check and its **own** 60-second removal grace (`watchedTypeStore.pendingRemovals`), in -parallel with the registry's. The user asked to delete the duplication outright, keep less -code, and accept losing the per-GitTarget conflict/miss reporting. - -- **`WatchedTypeTable` is now a subset of the typeset.** `resolveWatchedTypeTables` reads - `registry.Followable()` once and projects each GitTarget's WatchRules/ClusterWatchRules - onto it via `matchFollowableRecords` (the same group/version/resource/scope + preferred- - version + omitted-apiGroups ambiguity semantics as `RuleGVRResolver`, but over the - already-followable records, so a refused type — `gvk-not-unique`, `denied-by-policy`, - verb-poor — simply never matches). `buildWatchedTypeTable` is a pure fold of matched - records into `WatchedType` + `NamespaceOps`; it does no catalog lookup and makes no - decision. -- **The 60-second grace lives only in the registry now.** Because selection reads - `registry.Followable()`, a type that briefly leaves discovery stays `retained` (and so - stays in the table, the informer set, and the snapshot) until the registry's grace - elapses — then it drops from `Followable()` and the table on the next refresh. No table - re-judges absence. **Deleted** `watchedTypeStore.{pendingRemovals,removalGrace,now}`, - `applyPersistentAbsence`, `holdAbsentTypes`, `pendingRemoval`/`PendingRemoval`, - `logReappearances`/`logAbsence`, `rulesStillSelectWatchedType` + the rule-vs-type - matchers, and `hasPendingRemovals`. -- **Identity/conflict reporting dropped.** `TypeConflict`/`WatchedTypeTable.Conflicts`, - `logTypeConflicts`, and the local conflict detection are gone — the registry decides - identity uniqueness globally, and an ambiguous kind is just absent from the table. The - `gitopsreverser_watched_type_conflicts` and `_pending_removals` gauges were removed. -- **The change-gate is kept, keyed on the registry's own `Revision()`.** An early cut - dropped the gate and reprojected (and rebuilt the registry) on every - `refreshWatchedTypeTables`; under parallel e2e that starved the controllers (every - GitProvider/GitTarget/WatchRule reconcile timed out waiting for status). The gate is - restored and keyed on `(registry.Revision(), rulesFingerprint)` — **not** the catalog - generation. `Revision()` bumps when the followable membership changes (incl. a grace drop - at a stable generation, when the catalog generation does **not** move) or the scan - generation moves, so a grace-expired type leaves the table promptly — its phantom informer - stops and its target's snapshots recover, with no separate watched-type-layer absence - tracking. The heavy scan→registry rebuild stays where it always was — once per - `RefreshAPIResourceCatalog`; `refreshWatchedTypeTables` only rebuilds the registry lazily - the first time (for unit tests that drive it directly) and otherwise just reprojects on a - real change. `refreshMu` still serializes resolve-and-publish. See - [discovery-catalog-typeset-boundary.md](discovery-catalog-typeset-boundary.md) for the - boundary rationale (the table depends on the decision surface, not the scan counter). -- **Snapshot fail-closed re-expressed on the registry verdict.** `WatchedTypeTable.{Misses, - BlockingMisses}` were dropped; `resolveSnapshotGVRs` now fails closed on two registry - signals: (1) `registry.Ready()` is false (the API surface has not been observed yet), and - (2) any watched type is currently `retained` (followable under the grace but not served - right now — a discovery wobble). The retained case is the old pending-removal fail-closed - re-expressed in the registry's vocabulary: streaming a retained-but-unserved type would - fail, and sweeping the reduced view would delete a still-valid mirror, so the gather aborts - until the type is served again or the grace elapses and the `Revision()` bump re-projects it - out of the table. (Deliberate detail loss: the old discovery-degraded-while-still-selected - abort is folded into the same grace/retained path.) -- `RuleGVRResolver` is unchanged and still backs the WatchRule/ClusterWatchRule controller - *status* feedback (`ResolveWatchRuleResources`); only the table stopped using it. - **(Superseded in Stage 11 — the controller status moved onto the registry too and - `RuleGVRResolver` was deleted.)** -- Tests: `watched_type_table_test.go` now covers the pure fold + `matchFollowableRecords` - (scope filter, wildcard, preferred-version collapse); `watched_type_resolver_test.go` - covers the registry-driven resolution incl. an ambiguous-GVK exclusion; - `watched_type_metrics_test.go` keeps only the `watched_types` gauge; - `watched_type_pending_removal_test.go` was deleted (the grace is covered by - `internal/typeset/registry_test.go`); a new `resolveSnapshotGVRs` test covers the - registry-not-ready fail-closed. - -### Stage 11 — rule status is a registry projection; `RuleGVRResolver` and the dead catalog APIs are gone - -The last consumer of the old catalog-mechanics path. WatchRule/ClusterWatchRule controller -*status* was still computed by `RuleGVRResolver` over raw `APIResourceCatalog` entries, in -parallel with — and able to disagree with — the registry-backed set the watchers actually -follow. The user's direction: the application does not get to worry about *why* a type is or -isn't followed; status should report only what is watched, and the duplicated resolver + -catalog lookups should go. - -- **Status reports only what is watched.** `ResolveWatchRuleResources` / - `ResolveClusterWatchRuleResources` now match each rule's selectors with - `matchFollowableRecords` over `registry.Followable()` — the *same* matcher the per-GitTarget - watched-type tables use, so status and watching cannot drift. The `ResourcesResolved` - condition is `True` whenever the catalog is ready, with message `"watching N resource - type(s)"` (N = distinct followable types the rule selects); the only `False` case is an - unobserved catalog (`"API resource catalog is not ready"`). -- **No refusal taxonomy, no degraded diagnostic (deliberate).** The whole `ResolveMiss` - vocabulary (`NotServed`/`Ambiguous`/`Disallowed`/`CatalogUnavailable`/`DiscoveryDegraded`) - and the per-selector "discovery degraded" signal are dropped: absent, denied-by-policy, - verb-poor, ambiguous, and discovery-degraded are all the same to a mirror. The full - machine-readable "why" still lives on the registry record (`Manager.TypeRecords()`); it is - just not projected into operator status. **This reverses** the - [boundary doc](discovery-catalog-typeset-boundary.md)'s earlier "keep the - degraded-group/version diagnostic / re-home `hasDegradedLookup`" sub-proposal — that doc was - updated to match. -- **Deleted.** `internal/watch/rule_gvr_resolver.go` (the `RuleGVRResolver` struct, the - `ResolveMiss`/`ResolveMissReason` vocabulary, and all the catalog-candidate helpers); - `FormatResolveMisses`/`formatResolutionStatus`/`ruleSelectorsContainWildcard` and the - now-orphaned `uniqueStrings`. On the catalog: `Entry`, `CatalogLookup`/`LookupGVK`/ - `LookupGVR`, `GroupVersionDegraded`/`degradedForGroupVersionLocked`, `entriesForResource`/ - `entriesForGroup`/`entriesForGroupResource`/`allEntries`, `hasDegradedLookup`, the - `byGVK`/`byResource`/`byGroupRes` indexes (and their rebuild/sort), `APIResourceEntry. - Supports`, and the `cloneAPIResourceEntries`/`cloneAPIResourceEntry`/`mapKeys` helpers. - `rebuildIndexesLocked` became `rebuildGVRIndexLocked` (the catalog keeps only the one raw - `byGVR` index it feeds to `typeset`, plus `byGroupVer` + group/version trust state). -- **Kept.** `APIResourceCatalog.DegradedGroupVersions()` — but only for the manager's - operator-facing degraded/recovered **log** line (`logCatalogTransitions`) and the catalog - gauges, no longer for rule status. `matchesScope` moved to `watched_type_resolver.go` and - `dedupeGVRs` to `gvr.go` (their surviving consumers). -- Tests: `rule_gvr_resolver_test.go` and `api_resource_catalog_lookup_test.go` deleted; new - `rule_status_test.go` covers the followable-match count, the unmatched-but-ready case (still - resolved — the app does not flag it), the not-ready fail-closed, and a wildcard ClusterWatchRule; - `api_resource_catalog_test.go`'s newly-served and degraded-preservation tests now read the raw - scan (`byGVR`) instead of `Entry`/the resolver. The wildcard e2e status assertion changed from - `"wildcard expanded to"` to `"watching "`. - -### Stage 12 — typeset owns discovery grace (2026-06-11) - -Implemented per [typeset-owns-discovery-grace.md](../../typeset-owns-discovery-grace.md) -(S1–S3; S4 remains an open re-evaluation): - -- **`Registry.ByGroupResource(group, resource)`** — the one version-less index (S1); - the late-event nudge's stream-key→GVR resolution moved onto it. -- **`Registry.UpdateFromScan(typeset.Scan)`** (S2) — the registry now receives raw - per-scan facts and owns ALL cross-scan judgement in one place: a failed - group/version's records are carried forward untrusted (`VerdictRetained`, - indefinitely — retain-on-error relocated from the catalog), a record missing from a - scanned (or completely-scanned-away) group/version rides the existing - `RemovalGrace`, and an incomplete scan judges nothing it did not see. The catalog's - instant prune on complete-scan omission is gone. -- **`APIResourceCatalog` shrunk to a per-scan normalizer** (S3) — produces a - `typeset.Scan`; keeps only the last scan (change fingerprint + the - `refreshTypeRegistry` re-derive source), generation, readiness. Deleted: - `Observations()`/`catalog_observe.go`, `APIResourceEntry`, the `byGVR`/`byGroupVer` - merge state and trust flags, `applyCleanGroupVersions`/`markFailedGroupVersions`/ - `removeUndiscoveredGroupVersions`. `Stats()`/`DegradedGroupVersions()` are per-scan - facts now. The Stage-11 note above about the catalog keeping a raw `byGVR` index is - superseded by this stage. -- Tests: leaf semantics in `typeset/scan_test.go` (retain-on-error outlives the grace, - complete-omission rides the grace, incomplete scans judge only what they saw); - `api_resource_catalog_test.go` re-expressed against the scan + registry. - -## Files touched - -New: - -- `internal/typeset/model.go`, `funnel.go`, `scale.go`, `registry.go`, `observe.go`, - `lookup.go` (+ tests). -- `internal/watch/catalog_observe.go` (+ `catalog_observe_test.go`). -- `docs/design/manifest/version2/type-followability-implementation.md` (this log). - -Deleted: - -- `internal/mapping/` (mapper.go, static_snapshot.go, structure_only.go + tests) — the - registry is now the only `Lookup`. -- `internal/watch/catalog_mapper.go` and `registry_mapper.go` (+ tests) — the worker - reads `Manager.TypeRegistry()` directly. - -Modified: - -- `internal/auditutil/subresource_policy.go` — `BuiltinScaleReplicasPath` now adapts - `typeset.BuiltinScale`. -- `internal/watch/manager.go` — `typeRegistry` + `typeRefusalsLogged` fields. -- `internal/watch/manager_catalog.go` — `typeRegistryInstance`, `refreshTypeRegistry` - (gated on `catalog.Ready()`), `TypeRegistry`, `FollowableTypeRecords`, `TypeRecords`, - `logTypeRefusals`, ready-line `followableTypes`/`knownTypes`. -- `internal/watch/api_resource_catalog.go` — added `GroupVersionDegraded`. -- `internal/typeset/funnel.go` — `requiredVerbs` relaxed to get/list/watch. -- `internal/manifestanalyzer/` — `store.go` (`MappingOutcome`, `typeset.Lookup` - signatures, `resolveMapping`/`resolvedIdentity`), `acceptance.go`, `plan.go`, - `scan.go`, `analyzer.go` migrated off `mapping`. -- `internal/git/worker_manager.go`, `branch_worker.go`, `plan_flush.go` — `mapper` - field/param is now `typeset.Lookup`. -- `cmd/main.go` — `SetMapper(watchMgr.TypeRegistry())`. - -Stage 10: - -- `internal/typeset/registry.go` — added `Revision()` (the change-of-decision signal) + - `followableKeysLocked`/`sameKeySet`; `Update` bumps it on a followable-membership change - or generation move. -- `internal/watch/watched_type_table.go` — `WatchedTypeTable` is now a registry projection - (`watchSelection`/`buildWatchedTypeTable`/`watchedTypeFromRecord`); dropped - `TypeConflict`, `PendingRemoval`, `Misses`, `BlockingMisses`. -- `internal/watch/watched_type_resolver.go` — registry-driven `resolveWatchedTypeTables` + - `matchFollowableRecords` (group/version/resource/scope + preferred-version + ambiguity); - deleted the whole `watchedTypeStore` removal-grace machinery; gate keyed on - `(registry.Revision(), rulesFingerprint)`. -- `internal/watch/snapshot_stream.go` — `resolveSnapshotGVRs` fails closed on - `!registry.Ready()` or any `retained` watched type (`retainedWatchedTypes`/`gvkListSummary`). -- `internal/watch/gvr.go`, `manager.go` — `ComputeRequestedGVRs` drops misses; removed the - unplanned-resources log and `blockingSnapshotMisses`. -- `internal/telemetry/exporter.go` — removed `WatchedTypeConflicts`/`WatchedTypePendingRemovals`. -- **Deleted** `internal/watch/watched_type_pending_removal_test.go` (grace covered by - `registry_test.go`); `RuleGVRResolver` kept for controller status only. -- `docs/design/manifest/version2/discovery-catalog-typeset-boundary.md` — added the - registry change-signal proposal. - -## Validation - -- `task fmt` / `task generate` / `task manifests` — clean, no generated diffs (no API - types changed). -- `task vet` / `task lint` — clean (the lint pass fixed: cyclop on `reasonPhrase`, - gochecknoglobals on the verb list, gocognit on the scale test, nonamedreturns on - `splitSubresource`, unparam on `newRegistry`, and the `exhaustive` map/switch checks - — resolved with a phrase map + a boolean helper). -- `task test` — all packages pass; `internal/typeset` 98.4%, `internal/watch` 81.7% - (whole-package; the new code paths are covered). -- `task test-e2e` — **44 Passed, 0 Failed, 8 Skipped — Test Suite Passed**, re-run - green at each behavior-changing step: the registry as additive inventory (Stage 5), - the live mapper switched onto it (Stage 6), `internal/mapping` deleted with the worker - + analyzer reading the registry directly (Stage 7), the gvr-not-unique (Stage 8) and - sensitivity-policy (Stage 9) follow-ups, and the `WatchedTypeTable`-as-registry- - projection migration (Stage 10). The worker resolves manifest GVKs through the registry - on the real k3d cluster, so e2e exercises the whole pipeline end to end. -- **Stage 10 e2e note (lesson learned):** the suite must be run on a *fresh* k3d cluster. - Re-running it repeatedly on a long-lived cluster (≈2h, ~9 manager rollouts, accumulated - CRD/gitea/etcd state) produced spurious `status.conditions not found` controller-throughput - timeouts on the heavier specs (17/11 → 23/9 → 19/9 across reuses) that were **not** code - failures — `task clean-cluster` then `task test-e2e` returned a clean 44/0/8. The fixes - that did matter for Stage 10 (found via those runs) were: keeping the re-projection - change-gate (an early gate-less cut rebuilt the registry on every hot-path refresh and - starved the controllers), and re-expressing the snapshot fail-closed on the registry's - `retained` verdict + the `Revision()` gate (so a grace-held deleted type stops being - streamed and is dropped from the table promptly). diff --git a/docs/design/manifest/version2/type-followability-naming-proposal.md b/docs/design/manifest/version2/type-followability-naming-proposal.md deleted file mode 100644 index a45d732b..00000000 --- a/docs/design/manifest/version2/type-followability-naming-proposal.md +++ /dev/null @@ -1,276 +0,0 @@ -# Type followability naming proposal - -> Status: proposal -> -> Companion to [type-followability.md](type-followability.md) and -> [type-followability-implementation.md](type-followability-implementation.md). -> Discovery boundary follow-up: -> [discovery-catalog-typeset-boundary.md](discovery-catalog-typeset-boundary.md). - -## Problem - -The implementation has mostly collapsed the old split between API discovery, -mapping, rule resolution, and watched-type tables into one shared type decision -surface. The current names still carry some of the old shape: - -- `typeset` sounds like a set, but the package now owns records, evaluation, - live-set retention, lookup, and snapshot construction helpers. -- `WatchedTypeTable` sounds like a resolved lookup table, but it is now a - per-GitTarget projection of globally followable records through WatchRules. -- `funnel.go` describes the order of checks, not the thing the file owns. -- `model.go` is generic; it hides the fact that the file defines the public - vocabulary and record shape. - -The names should make the three different scopes obvious: - -1. **All known cluster types**: every type the registry can explain. -2. **Followable/live cluster types**: the globally safe/actionable subset. -3. **Per-GitTarget watched type set**: the subset selected by that target's - WatchRules and ClusterWatchRules, including namespace and operation scope. - -## Recommended vocabulary - -Use `followable`, `live`, and `target` instead of `valid`. - -`valid` is not precise enough. A type can be a valid Kubernetes resource while -GitOps Reverser refuses it because policy denies it, identity is ambiguous, or -the required verbs are absent. `followable` names the product decision; `live` -names the operational set that remains actionable during the retention grace. - -| Concept | Recommended name | Why | -| --- | --- | --- | -| Every known/explainable type | `allTypeRecords` / `TypeRecords()` | Includes refused and unknown records, so `all` is honest. | -| Globally actionable type set | `followableTypeRecords` / `FollowableTypeRecords()` | Matches the existing `Followability` decision vocabulary. | -| Operational live set | `liveTypeRecords` / `LiveTypeRecords()` | Good if we want `retained` to feel first-class: followable + retained. | -| Per-GitTarget selected set | `TargetTypeSet` | It is really a set per target, limited by watch rules. | -| One member of that set | `TargetType` or `WatchedType` | Keep `WatchedType` if we want continuity with current call sites. | -| Rule match before folding | `typeSelection` or `watchSelection` | A temporary selected record plus namespace/ops. | - -Preferred public shape: - -```text -TypeRegistry - AllRecords() -> []TypeRecord - FollowableRecords() -> []TypeRecord - LiveRecords() -> []TypeRecord (optional alias if retained should be explicit) - -TargetTypeSetStore - TargetTypeSet(gitDest) -> TargetTypeSet - AllTargetTypeSets() -> []TargetTypeSet - -TargetTypeSet - GitTarget - Destination - Types []WatchedType - ResolvedAt -``` - -If we keep only one accessor for the actionable global subset, prefer -`FollowableRecords()`. If the retained state starts appearing in status/UI, add -`LiveRecords()` as a clearer alias and document it as "followable or retained". - -## Package name options - -### Recommended: `internal/typeinventory` - -`typeinventory` says the package owns a durable inventory of Kubernetes resource -types, not merely a set. It fits all current responsibilities: records, decisions, -lookup, live-set retention, and snapshot-backed registries. - -Suggested package-level names: - -- `typeinventory.Record` instead of `typeset.TypeRecord` -- `typeinventory.Registry` -- `typeinventory.Observation` -- `typeinventory.SnapshotRegistry` -- `typeinventory.Lookup` - -Pros: - -- Clearer than `typeset` for non-set responsibilities. -- Avoids collision with `APIResourceCatalog`; this is not raw discovery. -- Works for both live cluster and no-cluster analyzer paths. - -Cons: - -- Longer import name. -- "Inventory" sounds descriptive rather than decisional unless paired with - `Followability`. - -### Alternative: `internal/typecatalog` - -Good if we want the package to read as the canonical type catalog, with decisions -included. - -Pros: - -- Very easy to understand. -- Pairs naturally with `TypeCatalog`, `TypeRecord`, `TypeLookup`. - -Cons: - -- We already have `APIResourceCatalog` for raw discovery. Two catalogs can blur the - boundary unless names become `DiscoveryCatalog` and `TypeCatalog`. - -### Alternative: `internal/typesurface` - -Good if we want to emphasize "the cluster API surface as GitOps Reverser sees it". - -Pros: - -- Captures observed, degraded, and retained API surface well. -- Less generic than `typeset`. - -Cons: - -- Slightly abstract. -- "Surface" does not immediately say it contains a registry and decisions. - -### Alternative: keep `internal/typeset` - -This is acceptable only if we rename the per-GitTarget object away from -`WatchedTypeTable`. Then `typeset` can mean "the global set of type records". - -Pros: - -- Smallest code churn. -- The user's intuition is right: there is a real set here. - -Cons: - -- The package has more than set semantics now. -- It remains easy to confuse the global type set with the per-GitTarget selected - set. - -## File name options inside the package - -Recommended file layout if the package becomes `typeinventory`: - -| Current file | Recommended file | Why | -| --- | --- | --- | -| `model.go` | `record.go` | Defines `TypeRecord`, identity, origin, scope, and subresource facts. | -| `funnel.go` | `followability.go` | Defines `Observation`, checks, verdict derivation, and summaries. | -| `registry.go` | `registry.go` | Already exact. | -| `observe.go` | `observations.go` | Plural because it builds observations from entries. | -| `lookup.go` | `lookup.go` | Already exact. | -| `scale.go` | `scale_binding.go` | Names the actual domain object, not just the feature. | - -If `followability.go` becomes too broad, split it: - -- `observation.go`: `Observation` and raw facts. -- `checks.go`: requirement check functions. -- `verdict.go`: verdict derivation and summary rendering. - -That split is only worth it if the file grows; today one `followability.go` is -probably clearer. - -## Watch-layer rename proposal - -The watch package should stop saying "table" for the per-target projection. - -| Current name | Proposed name | Notes | -| --- | --- | --- | -| `WatchedTypeTable` | `TargetTypeSet` | The user's suggested "typeset, one per GitTarget" is exactly this object. | -| `watchedTypeStore` | `targetTypeSetStore` | Stores the published per-target projections. | -| `refreshWatchedTypeTables` | `refreshTargetTypeSets` | Reprojects registry records through rules. | -| `resolveWatchedTypeTables` | `buildTargetTypeSets` | It no longer resolves followability; the registry already did. | -| `buildWatchedTypeTable` | `buildTargetTypeSet` | Pure fold of selected records. | -| `watchedTypeTableForGitDest` | `targetTypeSetForGitDest` | Reads one set. | -| `allWatchedTypeTables` | `allTargetTypeSets` | Reads every set. | -| `residentWatchedTypeTables` | `residentTargetTypeSets` | Published in-memory view. | -| `WatchedType` | keep or rename to `TargetType` | Keep if we want continuity; rename if we want the full model to be crisp. | - -Recommended package/file names: - -- `target_type_set.go`: `TargetTypeSet`, `WatchedType`, folding helpers. -- `target_type_sets.go`: store, refresh, projection from rules. -- `target_type_set_test.go` / `target_type_sets_test.go`. - -If we keep `WatchedType`, the relationship reads well: - -```text -TypeRegistry.FollowableRecords() - -> TargetTypeSet.Types []WatchedType -``` - -The `WatchedType` name is still useful because the value has namespace/operation -scope and is consumed by informers/snapshots. The set itself should carry the -target-specific name. - -## Naming schemes - -### Scheme A: explicit and conservative - -- Package: `internal/typeinventory` -- Global registry: `TypeRegistry` -- Global complete set: `AllRecords` -- Global actionable set: `FollowableRecords` -- Per-target set: `TargetTypeSet` -- Per-target member: `WatchedType` -- Evaluation file: `followability.go` -- Record file: `record.go` - -This is the recommended scheme. It keeps `Followability` as the product term and -uses `TargetTypeSet` for the user's "typeset, one per GitTarget" idea. - -### Scheme B: shorter, set-oriented - -- Package: `internal/typeset` -- Global registry: `Registry` -- Global complete set: `All` -- Global actionable set: `Followable` -- Per-target set: `TargetTypeSet` -- Per-target member: `WatchedType` -- Evaluation file: `followability.go` -- Record file: `record.go` - -This minimizes churn. It works if `TargetTypeSet` replaces `WatchedTypeTable`, -because the two levels are no longer both called some form of watched type table. - -### Scheme C: catalog-oriented - -- Package: `internal/typecatalog` -- Global registry: `Catalog` -- Global complete set: `AllRecords` -- Global actionable set: `LiveRecords` -- Per-target set: `TargetWatchSet` -- Per-target member: `WatchType` -- Evaluation file: `decision.go` -- Record file: `record.go` - -This is readable, but it risks confusion with `APIResourceCatalog`. Choose it only -if the raw discovery catalog is renamed to `DiscoveryCatalog`. - -## Suggested migration order - -1. Rename `WatchedTypeTable` to `TargetTypeSet` first. This gives the biggest - clarity win with the least package churn. -2. Rename `model.go` to `record.go` and `funnel.go` to `followability.go`. - These are file-only changes and should be easy to review. -3. Decide whether `internal/typeset` is good enough after the target rename. If it - still feels overloaded, rename the package to `internal/typeinventory`. -4. Only then consider accessor changes like `All()` -> `AllRecords()` and - `Followable()` -> `FollowableRecords()`; API churn is easier once the domain - names are settled. - -## Recommendation - -Adopt Scheme A unless minimizing churn is more important than clarity: - -```text -internal/typeinventory - record.go - followability.go - registry.go - observations.go - lookup.go - scale_binding.go - -internal/watch - target_type_set.go - target_type_sets.go -``` - -Use `TargetTypeSet` for the per-GitTarget object. Avoid `validTypes`; use -`allTypeRecords`, `followableTypeRecords`, and optionally `liveTypeRecords` when -the retained state needs to be explicit. diff --git a/docs/design/metrics-observability-plan.md b/docs/design/metrics-observability-plan.md index 764dce60..31a1cc9a 100644 --- a/docs/design/metrics-observability-plan.md +++ b/docs/design/metrics-observability-plan.md @@ -67,7 +67,7 @@ serious, honest metrics to show, and the audit subsystem is glass-box. ## 4. Target metric model — by pipeline stage New watch metrics use the shape already sketched in -[watch-first-ingestion-architecture.md → Metrics](watch-first-ingestion-architecture.md), but this +[watch-first-ingestion-architecture.md → Metrics](../finished/watch-first-ingestion-architecture.md), but this plan modernizes type labels to the live audit convention: separate `group`, `version`, and `resource` labels instead of a packed `gvr` string. Keep `version` on watch metrics even though it adds some series: Git paths and audit metrics already treat version as part of the resource identity, @@ -93,7 +93,7 @@ cursor progress. | Metric | Type | Labels | Answers | |---|---|---|---| -| `watch_events_filtered_total` | counter | `group`, `version`, `resource`, `reason` (`sanitized_noop`/`status_only`/`not_followable`/`duplicate`) | is the product-side filter behaving, or masking real changes? A mis-tuned filter is visible, per [watch-first](watch-first-ingestion-architecture.md). | +| `watch_events_filtered_total` | counter | `group`, `version`, `resource`, `reason` (`sanitized_noop`/`status_only`/`not_followable`/`duplicate`) | is the product-side filter behaving, or masking real changes? A mis-tuned filter is visible, per [watch-first](../finished/watch-first-ingestion-architecture.md). | The reason set is the target shape, not a claim that one chokepoint exists today. Phase 3 first locates or consolidates the scattered filter decisions on the watch-to-Git path, then records the @@ -291,5 +291,5 @@ rows → dashboard panels → alerts, validated per [AGENTS.md](../../AGENTS.md) - [architecture.md](../architecture.md) — leading source of truth (esp. *Common Flows*, *Optional Attribution*, *State Ingestion*, *Observability*). - [interpreting-metrics.md](../interpreting-metrics.md) — the live baseline + the per-metric doc bar. -- [watch-first-ingestion-architecture.md](watch-first-ingestion-architecture.md) — the watch-first +- [watch-first-ingestion-architecture.md](../finished/watch-first-ingestion-architecture.md) — the watch-first ingestion design and the earlier metric sketch this plan modernizes. diff --git a/docs/design/reconcile-triggering.md b/docs/design/reconcile-triggering.md index b426b5ee..7cf39fcd 100644 --- a/docs/design/reconcile-triggering.md +++ b/docs/design/reconcile-triggering.md @@ -76,7 +76,7 @@ The branch worker discovers a refused Git path **asynchronously**, after the GitTarget's reconcile has already run and scheduled its 10-minute requeue. Before the fix, `GitPathAccepted` could read `True` for up to 10 minutes after the path was actually refused (it caused a CI flake; full write-up in -[gitpathaccepted-projection-race-and-external-drift.md](manifest/gitpathaccepted-projection-race-and-external-drift.md)). +[gitpathaccepted-projection-race-and-external-drift.md](../spec/manifest-system.md)). The fix gives the data plane a controller-runtime `source.Channel` edge: @@ -253,7 +253,7 @@ pull immediately. Pulling on the push event is strictly better than discovering drift on a later fetch: we re-align (or refuse) while the change is fresh, and we usually avoid the expensive replay-mark session entirely. It is the push-driven complement to the poll-driven drift detection in A3 and the subtree-OID check in the -[sibling doc](manifest/gitpathaccepted-projection-race-and-external-drift.md). +[sibling doc](../spec/manifest-system.md). **Flow.** diff --git a/docs/design/stream/residual-e2e-flakes-2026-06-19.md b/docs/design/residual-e2e-flakes-2026-06-19.md similarity index 88% rename from docs/design/stream/residual-e2e-flakes-2026-06-19.md rename to docs/design/residual-e2e-flakes-2026-06-19.md index 5796f9f5..4b45443b 100644 --- a/docs/design/stream/residual-e2e-flakes-2026-06-19.md +++ b/docs/design/residual-e2e-flakes-2026-06-19.md @@ -21,7 +21,7 @@ measurements, not conclusions. - CI run `27830248680` (commit `5d85e7d`, the committed fix) failed **only** the `E2E (full)` job; all other jobs (Build, Unit, Lint, Helm, Dev Container, **E2E quickstart**) passed. - The failing spec: **"Commit Request — finalizes the open commit window on demand and reports the - resulting SHA"** ([commit_request_e2e_test.go:133](../../../test/e2e/commit_request_e2e_test.go#L133)). + resulting SHA"** ([commit_request_e2e_test.go:133](../../test/e2e/commit_request_e2e_test.go#L133)). - The assertion that timed out: `status.phase == "Committed"` within **120 s** (`Eventually`). - In the same run, a *different* CommitRequest (`commit-request-bundle-save-…`) reached `Committed` fine (age 12.7 s) — so the commit/push path itself was working; one CR did not finalize. @@ -89,14 +89,14 @@ find that event within its 60 s attribution window. ### What would raise certainty The parallel agent has added a **"last 5 commits" diagnostic** (`recentCommitDiagnostics`, -[repo_assertions_test.go](../../../test/e2e/repo_assertions_test.go)) to the phase/sha/message/count -assertions ([commit_request_e2e_test.go:123](../../../test/e2e/commit_request_e2e_test.go#L123)): on a +[repo_assertions_test.go](../../test/e2e/repo_assertions_test.go)) to the phase/sha/message/count +assertions ([commit_request_e2e_test.go:123](../../test/e2e/commit_request_e2e_test.go#L123)): on a failure it prints the latest 5 `origin/main` commits (sha, time, author, subject), path-scoped — so the next reproduction makes "wrong / older / later commit, or a gap" obvious at a glance. Beyond that: the one-line `scanForCommitRequestCreate` diagnostic from §2.3 (entries-scanned + whether a create-for-name was seen on a miss) to separate attribution-miss from sequencing; or read the controller log on the next reproduction. The durable fix candidate (deferred) is the early-ingestion author store -([internal-audit-type-demand.md](../../finished/internal-audit-type-demand.md)), which removes the scan entirely. +([internal-audit-type-demand.md](../architecture.md)), which removes the scan entirely. --- @@ -105,10 +105,10 @@ reproduction. The durable fix candidate (deferred) is the early-ingestion author ### Facts (observed) - Spec: **"Commit Signing — should not replay already-reconciled configmaps as per-event commits to a - late-joining target"** ([signing_e2e_test.go:507](../../../test/e2e/signing_e2e_test.go#L507)). + late-joining target"** ([signing_e2e_test.go:507](../../test/e2e/signing_e2e_test.go#L507)). - The convergence assertion: every `overlap-b-cm-NN` ConfigMap must be **present under path B**. It runs under the **90 s** suite default (`SetDefaultEventuallyTimeout(90s)`, - [signing_e2e_test.go:82](../../../test/e2e/signing_e2e_test.go#L82)); it does **not** override it. + [signing_e2e_test.go:82](../../test/e2e/signing_e2e_test.go#L82)); it does **not** override it. *(Correction: an earlier doc draft said 30 s — that was the explicit timeout in the run-3/f3-era code shown by `Timed out after 30.000s`; it has since been raised to the 90 s default.)* - Observed failures: `overlap overlap-b-cm-17` (f3) and `overlap-b-cm-15` (run-3) not present under B. @@ -129,10 +129,10 @@ its **initial backfill** (the splice folds the checkpoint `(R, head]` and writes the **coverage-watermarked tail** (forwards live entries with stream id `> Hc`). **Key code fact (checked this session):** the splice sets `coverageHead = the last entry it folded` -([redis_type_splice.go](../../../internal/queue/redis_type_splice.go)), and the watermark is published +(redis_type_splice.go), and the watermark is published as **exactly that value** — `publishTargetTypeWatermark(gitDest, gvr, snapshot.CoverageHead)` -([event_router.go:241](../../../internal/watch/event_router.go#L241)) — and the tail forwards id `> Hc` -([audit_tail.go](../../../internal/watch/audit_tail.go)). So `Hc` is **contiguous with the fold by +([event_router.go:241](../../internal/watch/event_router.go#L241)) — and the tail forwards id `> Hc` +(audit_tail.go). So `Hc` is **contiguous with the fold by construction**: everything `≤ coverageHead` is in the backfill, everything `> coverageHead` is forwarded by the tail. There is no `(S, Hc]` window for an object to fall into — *unless its stream entry is missing entirely*. **This demotes the "watermark set ahead of the backfill" boundary-gap I hypothesised @@ -141,7 +141,7 @@ in the first two drafts.** The split that was actually observed (`00–15` backfilled, **`16` missing**, `17–19` live) fits a **diverted cm-16** far better — the overlap band is one batch `kubectl apply`, so audit events can arrive **out of RV order**; an event whose RV lands **below the stream high-water** is **diverted** -(rejected from the per-type stream, [redis_bytype_queue.go](../../../internal/queue/redis_bytype_queue.go)). +(rejected from the per-type stream, redis_bytype_queue.go). A diverted cm-16 is in **neither** the fold (not in the stream) **nor** the tail (not in the stream), and is healed only when the **divert nudge** re-anchors the type — which races the 90 s deadline: @@ -162,7 +162,7 @@ and is healed only when the **divert nudge** re-anchors the type — which races fix mirrors a claimed type slightly earlier — could marginally shift join timing; not demonstrated.* > **Defer to the authoritative deep-dive:** -> [`signing-overlap-band-coverage-drop-investigation.md`](signing-overlap-band-coverage-drop-investigation.md) +> [`signing-overlap-band-coverage-drop-investigation.md`](../finished/signing-snapshot-tail-replay-failure-investigation.md) > is the rigorous (FACT/DERIVED/HYPOTHESIS-tagged) investigation of this exact flake, and it **measured > the divert counter**. The bullets below are reconciled to it — and it walks back the "divert" lead I > had given (the diagram above is now just *one — contradicted — candidate*). @@ -194,10 +194,10 @@ and is healed only when the **divert nudge** re-anchors the type — which races ### What would raise certainty — and the instrumentation added this session On the next reproduction, these now-added logs disambiguate divert vs boundary in one read: -- **`late audit event nudged a type resync`** (now **info**, [materialization.go](../../../internal/watch/materialization.go)) — fires iff a divert happened; if it names `configmaps` around the join, the divert mechanism is confirmed. +- **`late audit event nudged a type resync`** (now **info**, [materialization.go](../../internal/watch/materialization.go)) — fires iff a divert happened; if it names `configmaps` around the join, the divert mechanism is confirmed. - the scoped **`diag_all`** firehose already captures `configmaps`, so a diverted cm-16 shows as `outcome=older_than_high_water`. -- **`target-type watermark published / held`** ([target_type_watermark.go](../../../internal/watch/target_type_watermark.go)) — shows B's actual `Hc` and whether a stale-high prior was held (the secondary hypothesis). -- **`audit-tail routed batch to target`** (V(1), [audit_tail.go](../../../internal/watch/audit_tail.go)) — per-batch `routed / suppressedAtOrBelowHc / firstID / lastID`; if cm-16 appears here and is `suppressedAtOrBelowHc`, it is the boundary case; if it never appears, it was diverted upstream. +- **`target-type watermark published / held`** (target_type_watermark.go) — shows B's actual `Hc` and whether a stale-high prior was held (the secondary hypothesis). +- **`audit-tail routed batch to target`** (V(1), audit_tail.go) — per-batch `routed / suppressedAtOrBelowHc / firstID / lastID`; if cm-16 appears here and is `suppressedAtOrBelowHc`, it is the boundary case; if it never appears, it was diverted upstream. If the repro shows divert: the durable answer is faster/again-reliable nudge-heal (or accept + widen the test deadline). If it shows a held stale-high `Hc`: fix the publish to not hold a boundary ahead of the @@ -224,7 +224,7 @@ published *as* the splice's `coverageHead`, so the boundary is contiguous by con `Hc := S` boundary-fix I first proposed is largely moot); (2) the divert lead I then gave is itself **contradicted** by the deep-dive's `lateCount=0` measurement — so the honest state for Flake B is "the object was off the main stream, **but by which path is unconfirmed**," tracked rigorously in -[`signing-overlap-band-coverage-drop-investigation.md`](signing-overlap-band-coverage-drop-investigation.md). +[`signing-overlap-band-coverage-drop-investigation.md`](../finished/signing-snapshot-tail-replay-failure-investigation.md). I deliberately **did not apply a fix** (trust gate not met); instead I landed the instrumentation (nudge→info, watermark publish/held, per-batch tail-route summary) that, with that doc's §6.1 ingestion-side capture, collapses H1–H4 on the next reproduction. Flake A's leading hypothesis stays diff --git a/docs/design/sensitive-resource-diagnostics-follow-up.md b/docs/design/sensitive-resource-diagnostics-follow-up.md index 9cc9fade..53f1c6fe 100644 --- a/docs/design/sensitive-resource-diagnostics-follow-up.md +++ b/docs/design/sensitive-resource-diagnostics-follow-up.md @@ -1,7 +1,7 @@ # Follow-up: Sensitive Resource Diagnostics This follow-up builds on -[sensitive-resource-classification-plan.md](sensitive-resource-classification-plan.md). +[sensitive-resource-classification-plan.md](../finished/sensitive-resource-classification-plan.md). The first increment only adds explicit startup classification to the Git write path. This document keeps the diagnostics and policy work out of that small change. diff --git a/docs/design/status-design-git-target.md b/docs/design/status-design-git-target.md deleted file mode 100644 index 68bb6fa0..00000000 --- a/docs/design/status-design-git-target.md +++ /dev/null @@ -1,262 +0,0 @@ -# GitTarget status, conditions, and lifecycle - -Status: design (current + target) · Updated: 2026-06-12 - -This supersedes the original pre-R2 plan, which described a `Bootstrapped → SnapshotSynced` -gate chain (and a `Ready` that depended on the initial snapshot). The api-source-of-truth -pivot removed that lifecycle: there is no bootstrap snapshot gate anymore — a type is -serviceable the moment its per-type checkpoint is `Synced`, and a per-type splice reconcile -does the mirroring. See -[materialization-tail-and-live-readiness-review.md](../finished/materialization-tail-and-live-readiness-review.md) -(Gap 3, Gap 6, Rec 4) for the analysis this doc records as a decision. - -## Outcomes - -- `GitTarget.status` is an observation-only view of reality. -- `status.conditions` is the automation contract (`kubectl wait --for=condition=…`). -- **Two orthogonal axes**: `Ready` = control-plane correctness (config + plumbing); `Synced` - = data-plane currency (the mirror reflects what it can). Neither depends on the other. -- A small `status.phase` provides quick human scanning, derived purely from conditions. -- Condition updates are deterministic (no duplicates, no flapping — in particular no flap on - the periodic checkpoint re-anchor). - -## 1. Current state (as implemented today) - -Conditions actually set by `internal/controller/gittarget_controller.go`: - -- `Validated` — provider exists, branch allowed, no path conflict. -- `EncryptionConfigured` — SOPS/age config resolved (or `NotRequired`). -- `EventStreamLive` — the branch worker exists and the GitTarget's event stream is - registered. With R3 there is no bootstrap gather behind this; it is purely "is the - worker/stream wired?". **To be removed** — see the debt list and §3. -- `Ready` — summary: `True` iff `Validated ∧ EncryptionConfigured ∧ EventStreamLive`. - -`status.materialization` carries a bounded demand-axis roll-up -(`ClaimedTypes / SyncedTypes / PendingTypes / FailingTypes / NotFollowableTypes`, -`ObservedTime`) but is **not** projected into a condition or phase — so today there is no -first-class "the mirror is current" signal; e2e re-derives one from the raw counts -(`waitForGitTargetMaterializationSettled`). - -Known debt to clear as part of this work: - -- **No `status.phase` field** exists yet. -- **`status.snapshot` (`GitTargetSnapshotStatus`) is vestigial** — nothing has written it - since the pre-R2 bootstrap gather was removed. Delete it. -- **`GitTargetReadyReasonInitialSyncInProgress` is unused** (a leftover of the removed - snapshot gate). Delete it. -- The roll-up **mis-buckets serviceability** (see §3.2): `Resyncing` is counted as - `Pending`, so any naive liveness check flaps on the periodic re-anchor. -- **`EventStreamLive` is in-memory wiring, not an external state** — `EnsureWorker` → - `worker.Start` only spawns the event-loop goroutine and returns (the git clone/push is - lazy), so the condition is `True` whenever `Validated ∧ EncryptionConfigured` are, and it - is not user-actionable. Its name also wrongly implies a live connection. Remove it as a - condition and fold the wiring step into `Ready` (§2.1, §5). - -## 2. The core decision: `Ready` does not depend on `Synced` - -A GitTarget can be in any of four states: - -1. config/plumbing broken, -2. plumbing fine, mirror still building (first checkpoints in flight), -3. mirror fully current, -4. plumbing fine, mirror as-current-as-possible **but a claimed type is not followable** (a - CRD that is not installed, or a typo in a WatchRule). - -A single boolean cannot represent these honestly. Folding liveness into `Ready` makes a -state-4 GitTarget `NotReady` *forever* despite being correctly configured and mirroring all -it can; excluding not-followable types from the gate instead makes `Ready=True` silently -ignore a type the user asked to watch. Only two orthogonal axes tell the truth: - -- `Ready=True` (plumbing fine) **and** -- `Synced=False, phase=Degraded` with `notFollowableTypes=1` surfaced. - -This is the Deployment `Available` vs `Progressing` split. The decision is **principled, not -backward-compat** (there are no end users yet): keep `Ready` a stable control-plane signal -that does not flap on data-plane activity, and add a separate data-plane signal. - -### 2.1 `EventStreamLive` is not a real condition — fold it into `Ready` - -`EventStreamLive` is the inverse mistake: a condition for something that is **internal wiring -the controller should just get right**, not an externally meaningful state. `EnsureWorker` → -`worker.Start` only spawns the in-memory event-loop goroutine (the git clone/push is lazy), so -the gate is `True` whenever `Validated ∧ EncryptionConfigured` are, never user-actionable, and -its "Live" name wrongly implies a live connection it never checks. - -Remove the condition. **Keep the step** — the pipeline must still ensure the worker and -register the event stream before it `Declare`s demand — but on its (rare) failure set -`Ready=False` with a reason (`WorkerUnavailable`), not a dedicated condition. Net: -`Ready = Validated ∧ EncryptionConfigured ∧ worker-wired`. - -This leaves a genuine gap the misnamed condition was papering over: **nothing reports whether -the git write path is actually healthy** (clone/push/auth). A push failure today only shows as -a stale `lastPushTime` + metrics. The honest replacement, if/when wanted, is a `Writable` (or -`Pushing`) condition driven by real push success/failure — the condition `EventStreamLive` -pretended to be. Note its natural scope: a `BranchWorker` is keyed by `(provider, branch)` and -**serves N GitTargets** (each under its own non-overlapping `spec.path`), and the push is a -branch-level operation. So write-path health is a property of the *worker*, computed once and -reflected identically on every GitTarget sharing that branch — not something each GitTarget -discovers independently. Out of scope for now; noted so the intent (and its scope) is not lost -when the bit is deleted. - -## 3. Target status surface - -### 3.1 Fields - -Top-level: - -- `observedGeneration: int64` (kept) -- `conditions: []metav1.Condition` (kept) -- `phase: string` (NEW — small derived enum; informational only) -- `lastReconcileTime: metav1.Time` (kept) -- `lastPushTime` (kept) -- `materialization: {...}` (kept; counts recomputed on the serviceability basis below) -- ~~`snapshot: {...}`~~ (REMOVE — vestigial) - -Conditions: - -- `Validated`, `EncryptionConfigured`, `Ready` — unchanged. -- ~~`EventStreamLive`~~ — REMOVE (§2.1); its wiring step folds into `Ready`. -- `Synced` (NEW) — the data-plane condition. `True` when every **followable, claimed** type - is serviceable. Name it `Synced` (or `Materialized`), **not `Live`** — "Live" is the vague - name we are retiring with `EventStreamLive`, and it reads as a connection/heartbeat rather - than "the mirror reflects reality". - -### 3.2 Serviceability (the predicate that fixes the flap) - -A type is *serviceable* when it has a usable checkpoint: `checkpointRV != ""`. That is true -for phases `Synced`, **`Resyncing`** (still serves the prior checkpoint while refreshing), -and **`Failing`-with-a-prior-checkpoint**. It is false for `Dormant`, `Requested`, `Syncing`, -and `Failing`-without-a-checkpoint. - -The roll-up and the `Synced` condition must use serviceability, **not** `phase == Synced`. -Otherwise the periodic ~1h re-anchor (`Synced → Resyncing → Synced`) drops `Synced` to -`False` and back every cycle even though nothing was ever unavailable — and it churns the -fast `materializationSettling` requeue. Recompute the roll-up so: - -- `syncedTypes` counts serviceable types (not just `phase==Synced`), -- `pendingTypes` counts only genuinely-not-serviceable progressing types - (`Requested`/`Syncing`), -- `notFollowableTypes` and `failingTypes` stay as the operator-visible signals. - -### 3.3 Phase values (small, stable, derived) - -Phase is a pure function of conditions + the serviceability roll-up, never an independent -state machine: - -| Phase | Meaning | -| --- | --- | -| `Pending` | `Ready=False` — a control-plane gate is not satisfied yet | -| `Initializing` | `Ready=True`, but ≥1 followable claimed type is not yet serviceable (first sync in flight) | -| `Synced` | `Ready=True` and all followable claimed types are serviceable (fully live) | -| `Degraded` | `Ready=True`, serviceable ones are serviceable, but ≥1 claimed type is not followable or is failing-without-a-checkpoint | - -Rule: automation depends on **conditions**, never on phase. - -```mermaid -flowchart TD - A["Ready True?"] -->|no| P["phase = Pending"] - A -->|yes| B["any claimed type not followable, or failing w/o checkpoint?"] - B -->|yes| D["phase = Degraded (Synced=False)"] - B -->|no| C["all followable claimed types serviceable?"] - C -->|no| I["phase = Initializing (Synced=False)"] - C -->|yes| S["phase = Synced (Synced=True)"] -``` - -## 4. Condition mechanics (still valid; keep) - -### 4.1 Upsert helper - -A single `SetCondition` (the existing `upsertCondition`) that: - -- treats conditions as a map keyed by type, -- updates `LastTransitionTime` only when `Status` changes, -- always refreshes `Reason`/`Message`, -- stamps `ObservedGeneration` into the condition. - -### 4.2 Reason enums - -Per-condition reason constants (CamelCase). Current + additions: - -- `Validated`: `OK`, `ProviderNotFound`, `BranchNotAllowed`, `TargetConflict` -- `EncryptionConfigured`: `OK`, `NotRequired`, `MissingSecret`, `InvalidConfig`, - `SecretCreateDisabled` -- `Synced` (NEW): `OK`, `Initializing`, `NotFollowable`, `SyncFailing` -- `Ready`: `OK`, `ValidationFailed`, `EncryptionNotConfigured`, `WorkerUnavailable` - (replaces `StreamNotLive` with the folded wiring step; drop the unused - `InitialSyncInProgress` and the `EventStreamLive` reasons) - -### 4.3 No-flap rules - -- no duplicate types, -- no `LastTransitionTime` churn unless `Status` changes, -- a not-yet-evaluated gate is `Unknown` with a clear reason (`NotChecked`/`NotStarted`/ - `Blocked`), -- `Synced` is computed on **serviceability** so a re-anchor does not flap it (§3.2). - -## 5. Reconcile pipeline (gate-by-gate, current) - -Each step computes its gate from observed state, writes its condition, and — if blocking — -stops further progress while still updating `Ready` and `phase`. - -1. **Bookkeeping** — `status.lastReconcileTime = now`; `observedGeneration = generation`. -2. **`Validated`** — provider exists, branch allowed, no path conflict. False ⇒ `Ready=False` - reason `ValidationFailed`, return. -3. **`EncryptionConfigured`** — resolve/ensure encryption (or `NotRequired`). False ⇒ block. -4. **Worker wiring** (no condition, §2.1) — ensure the branch worker and register the event - stream. On failure ⇒ `Ready=False` reason `WorkerUnavailable`, return. -5. **`Ready`** — `True` iff steps 2–4 all succeeded. **Independent of `Synced`.** -6. **Demand + data-plane** — `DeclareForGitTarget` renews the claim lease (idempotent); read - the **serviceability** roll-up; set `status.materialization`, the `Synced` condition, and - derive `phase`. A still-initializing target requeues on the fast settle cadence; a - `Degraded`/`Synced` target requeues on the long cadence. - -Note that step 6 is bookkeeping + a separate condition: it never gates `Ready`, so a failed -or partial materialization never reports the GitTarget as misconfigured. - -## 6. Golden-path progression - -| Stage | Conditions | phase | -| --- | --- | --- | -| New GitTarget | gates `Unknown`, `Ready=False` | `Pending` | -| Validated + encryption + worker wired | `Validated/EncryptionConfigured=True`, `Ready=True`, `Synced=False/Initializing` | `Initializing` | -| First checkpoints land | `Synced=True` | `Synced` | -| Periodic re-anchor (Synced→Resyncing→Synced) | `Synced` stays `True` (serviceable) | `Synced` (no flap) | -| A watched CRD is not installed | `Ready=True`, `Synced=False/NotFollowable` | `Degraded` | - -## 7. Testing plan - -### 7.1 Condition helper (unit) - -- upsert inserts/updates without duplication; `LastTransitionTime` changes only on status - change; ordering-independent. - -### 7.2 Reconcile gate tests (table-driven) - -- provider missing ⇒ `Validated=False`, `Ready=False`, `phase=Pending` -- encryption secret missing, autocreate off ⇒ `EncryptionConfigured=False` -- worker wiring fails ⇒ `Ready=False` reason `WorkerUnavailable` (no `EventStreamLive` condition) -- all gates pass, types still syncing ⇒ `Ready=True`, `Synced=False`, `phase=Initializing` -- all followable claimed types serviceable ⇒ `Synced=True`, `phase=Synced` -- a periodic re-anchor (Synced→Resyncing→Synced) ⇒ `Synced` does **not** flap -- a claimed-but-not-followable type ⇒ `Ready=True`, `Synced=False`, `phase=Degraded` - -### 7.3 `kubectl wait` compatibility (integration/e2e) - -- `kubectl wait --for=condition=Ready=true gittarget/` -- `kubectl wait --for=condition=Synced=true gittarget/` (the gate specs use before - asserting on mirrored content) — and delete the bespoke - `waitForGitTargetMaterializationSettled` helper, whose logic (and latent re-anchor flap) - moves into the controller and is fixed there. - -## 8. Implementation checklist - -- [ ] Recompute the materialization roll-up on the **serviceability** predicate (§3.2) -- [ ] Add `status.phase` and the `Synced` condition (+ reason constants); derive both -- [ ] Set `Ready` = `Validated ∧ EncryptionConfigured ∧ worker-wired` (no `Synced` dep) -- [ ] Remove the `EventStreamLive` condition; fold the worker-wiring step into `Ready` - (reason `WorkerUnavailable` on failure); update tests/e2e that referenced it -- [ ] Remove vestigial `status.snapshot` / `GitTargetSnapshotStatus` and the unused - `InitialSyncInProgress` reason; run `task manifests` -- [ ] Add a `phase` printcolumn alongside the `Ready` column -- [ ] Unit + reconcile tests per §7; replace the e2e helper with `--for=condition=Synced` -- [ ] Document the two-axis contract (`Ready` vs `Synced`, phase informational) diff --git a/docs/design/stream/github-e2e-per-type-tail-failure-investigation.md b/docs/design/stream/github-e2e-per-type-tail-failure-investigation.md deleted file mode 100644 index 0552b5d1..00000000 --- a/docs/design/stream/github-e2e-per-type-tail-failure-investigation.md +++ /dev/null @@ -1,209 +0,0 @@ -# GitHub E2E failure investigation: CommitRequest after canonical stream removal - -> Status: investigation note, updated 2026-06-12. -> Context: GitHub Actions run -> [27371711951](https://github.com/ConfigButler/gitops-reverser/actions/runs/27371711951), -> attempt 1, commit `0c0a526b6a7368c88bf4a58c20bb4e8b0cd9cb9b` -> (`chore: finish deletion of the single big audit queue`). -> Related: [commitrequest-barrier-timeout-decision.md](../../finished/commitrequest-barrier-timeout-decision.md) -> (Option A), and **[commitrequest-design.md](./commitrequest-design.md)** — the -> CommitRequest design this failure motivated now lives there. -> Scope: the facts and root cause of the full E2E failure seen after the old canonical -> audit queue/consumer path was removed, plus the narrow worker fix it needs. The -> CommitRequest design (how the feature should work) is **not** in this note — it is in -> commitrequest-design.md. - -## 1. Executive summary - -The referenced GitHub run has two visible attempts: - -- **attempt 1 failed** in `E2E (full)`; -- **attempt 2 was cancelled** after a newer run superseded it. - -Attempt 1 does **not** show three failed specs. It shows one failed spec: - -```text -Commit Request -[It] finalizes the open commit window on demand and reports the resulting SHA - -Expected - : NoOpenWindow -to equal - : Committed -``` - -The important correction to the earlier theory is this: the Deployment edit was -not simply lost by the per-type tail. The run logs show the edit reached the -branch worker and was locally committed before the CommitRequest finalized: - -```text -19:33:53 git commit created -message="[CREATE] apps/v1/deployments/commit-request-deploy-1781206173" - -19:33:55 CommitRequest finalized -phase="NoOpenWindow" barrierReached=true -``` - -So the sharper failure is: - -> A normal event opened a window, but that window was closed before the -> CommitRequest finalize signal arrived, even though the test configured -> `commitWindow=300s`. - -The barrier did exactly what Option A says it should do on the happy path: -`barrierReached=true`. Extending the 15 s barrier timeout would not fix this -failure. This is a worker/window-lifetime problem after a successful barrier, not -a barrier-timeout problem. - -## 2. Verified GitHub run facts - -- Run: `27371711951` -- Attempt with failure: **attempt 1** -- Branch: `poc/redis-copy` -- Commit: `0c0a526b6a7368c88bf4a58c20bb4e8b0cd9cb9b` -- Commit title: `chore: finish deletion of the single big audit queue` -- Previous green full E2E run: `27368636247` -- Previous green commit: `cc426d8f74c7ec28895f2d73612ed10659dfe5a8` -- Full E2E mode: `--procs=4` -- Attempt 1 full E2E result: `43 Passed | 1 Failed | 10 Skipped` -- Failing job: `E2E (full)` -- Passing jobs in the same attempt: lint, unit tests, build, Helm chart, - devcontainer, quickstart E2E. - -Attempt 2 for the same run was cancelled, and its partial logs should not be used -as evidence for the failure. - -## 3. The failed sequence - -The CommitRequest E2E intentionally uses a long commit window: - -```go -const commitWindow = "300s" -``` - -The spec creates a Deployment, asserts for 10 s that the remote branch is still -absent, then creates a CommitRequest. The expected behavior is: - -```text -Deployment event -> open worker window -CommitRequest -> barrier passes -> finalize signal closes that same window -status.phase = Committed -``` - -The observed behavior was: - -```text -19:33:43 create Deployment -19:33:43..19:33:53 remote branch remains absent -19:33:53 worker creates local event commit for the Deployment -19:33:53 create CommitRequest -19:33:55 CommitRequest reports NoOpenWindow, barrierReached=true -``` - -That sequence means the worker no longer had an `openWindow` when the finalize -signal was processed. - -## 4. What this rules out - -### 4.1 Not a stale CRD lifecycle assertion in this GitHub attempt - -The earlier note discussed a CRD lifecycle log assertion that looked for the -literal substring `git commit` while the resync path logs `git resync commit -created`. That may still be a brittle assertion worth cleaning up, but it is not -the failure in GitHub attempt 1 of run `27371711951`. The run summary has only -the CommitRequest failure. - -### 4.2 Not fixed by a longer CommitRequest barrier timeout - -The CommitRequest terminal log says `barrierReached=true`. Option A from the -barrier-timeout decision only applies when `DrainTailsToSnapshot` cannot reach -the snapshot in 15 s and returns `false`. - -This failure is worse in a different way: the barrier reported success, so the -status carried no degrade message. The problem happened after the barrier's -freshness condition was satisfied. - -### 4.3 Not simply "the Deployment audit event was never consumed" - -The worker logged a local event commit for the exact Deployment. That proves the -event entered the GitTarget worker path. A pure skip-before-registration loss -would usually leave no such local event commit. - -## 5. Most likely product bug - -There are two credible mechanisms that can close the window before the -CommitRequest finalize signal. - -### 5.1 A background worker item closes the window - -`handleResyncRequest` starts with: - -```go -l.finalizeOpenWindow() -``` - -That means a per-type resync or sweep queued after the Deployment event but before -the CommitRequest finalize will close the live event window using the generated -group message. If the resync itself is a no-op, the function does not call -`maybeSchedulePush()` for the just-finalized live window. The local event commit -can therefore exist while the remote branch is still absent, and a later -CommitRequest sees `NoOpenWindow`. - -This matches the visible shape especially well: - -- the local event commit exists; -- there is no corresponding CommitRequest `Committed` status; -- the branch had remained absent during the test's 10 s check; -- `NoOpenWindow` follows shortly after. - -The current logs do not name the reason `finalizeOpenWindow()` ran, so this is a -ranked hypothesis rather than a fully proven cause. - -### 5.2 The worker is not honoring the configured `300s` commit window - -The local commit appears almost exactly 10 s after the Deployment was submitted, -while the GitProvider was created with `commitWindow=300s`. If no background -resync was involved, then the worker may have started with an unexpected -commit-window value or a stale provider view. - -The code currently does not log the parsed commit window when a branch worker -starts, so the GitHub log cannot distinguish this from the resync hypothesis. - -## 6. The narrow fix this failure needs - -The actionable, worker-local conclusion is simple: a background close — the -`resync-before-apply` finalize, or any other path — must not be able to **strand** a -just-closed live window. Whatever finalizes a window into a pending write must also -schedule its push (`maybeSchedulePush`), so the local event commit reaches the remote -even when the resync that closed it was a no-op. That alone prevents the worst version -of the bug: a user-authored commit that is neither pushed nor still open for the -CommitRequest. - -Two diagnostics make this provable in CI rather than inferred: log the **reason** a -window is finalized (timer / finalize-signal / resync-before-apply / buffer-limit / -author-change / shutdown — most of this already exists via `windowFinalizeReason`), and -log the parsed `commitWindow` when a branch worker starts. - -A regression test should pin it: a no-op resync that closes an open live window must -not strand its pending write. The fuller test plan — including the intent-durability -case where a cut-off still carries the CommitRequest's message — lives in -commitrequest-design.md §8. - -## 7. The design this failure motivated (moved) - -This failure raised a deeper question than "how long should the barrier wait?": **what -does a CommitRequest mean now that the single canonical stream has been replaced by one -audit stream per Kubernetes type?** Earlier revisions of this note explored answers -inline — a target-aware watermark barrier, a "tail picture" of per-type -resourceVersions, a baseline finalize algorithm, and a state model. That exploration is -superseded and now lives, reworked, in: - -> **[commitrequest-design.md](./commitrequest-design.md)** - -In brief, that design drops the watermark barrier entirely (it was best-effort and -could report false-positive success), attaches the CommitRequest's message to the -author's open window as early as possible so any cut-off still commits with the user's -message, resolves the request on push (so `Committed` means "on the remote"), and -renames the `NoOpenWindow` phase to `Rejected` with a structured reason. Treat that -document as the source of truth for CommitRequest behavior; this note is only the -record of the failure that prompted it. diff --git a/docs/design/stream/late-lane-e2e-2026-06-16-final.tsv b/docs/design/stream/late-lane-e2e-2026-06-16-final.tsv deleted file mode 100644 index 04d09d00..00000000 --- a/docs/design/stream/late-lane-e2e-2026-06-16-final.tsv +++ /dev/null @@ -1,55 +0,0 @@ -base id reason verb api_group resource namespace name rv last_rv rv_gap user stage_millis -gitops-reverser:apiextensions.k8s.io:customresourcedefinitions 1781599889449-0 older-than-high-water update apiextensions.k8s.io customresourcedefinitions etcdsnapshotfiles.k3s.cattle.io 217 219 2 system:k3s-supervisor 1781599879316 -gitops-reverser:apiextensions.k8s.io:customresourcedefinitions 1781599889452-0 older-than-high-water update apiextensions.k8s.io customresourcedefinitions helmchartconfigs.helm.cattle.io 223 227 4 system:k3s-supervisor 1781599879338 -gitops-reverser:bi-directional.e2e.example.com:icecreamorders 1781599997497-0 rv-missing-before-high-water patch bi-directional.e2e.example.com icecreamorders 1781599706-test-bi-directional bi-bob-order-1781599981478403287 0 system:serviceaccount:flux-system:kustomize-controller 1781599997494 -gitops-reverser:bi-directional.e2e.example.com:icecreamorders 1781599997498-0 rv-missing-before-high-water patch bi-directional.e2e.example.com icecreamorders 1781599706-test-bi-directional bi-alice-order-1781599981478403287 0 system:serviceaccount:flux-system:kustomize-controller 1781599997494 -gitops-reverser:bi-directional.e2e.example.com:icecreamorders 1781600011644-0 older-than-high-water patch bi-directional.e2e.example.com icecreamorders 1781599706-test-bi-directional bi-bob-order-1781599981478403287 3325 3376 51 system:serviceaccount:flux-system:kustomize-controller 1781600011626 -gitops-reverser:bi-directional.e2e.example.com:icecreamorders 1781600031689-0 older-than-high-water patch bi-directional.e2e.example.com icecreamorders 1781599706-test-bi-directional bi-alice-order-1781599981478403287 3428 3492 64 system:serviceaccount:flux-system:kustomize-controller 1781600031673 -gitops-reverser:bi-directional.e2e.example.com:icecreamorders 1781600031692-0 older-than-high-water patch bi-directional.e2e.example.com icecreamorders 1781599706-test-bi-directional bi-bob-order-1781599981478403287 3325 3492 167 system:serviceaccount:flux-system:kustomize-controller 1781600031674 -gitops-reverser:bi-directional.e2e.example.com:icecreamorders 1781600041249-0 older-than-high-water patch bi-directional.e2e.example.com icecreamorders 1781599706-test-bi-directional bi-alice-order-1781599981478403287 3428 3687 259 system:serviceaccount:flux-system:kustomize-controller 1781600041233 -gitops-reverser:bi-directional.e2e.example.com:icecreamorders 1781600041250-0 older-than-high-water patch bi-directional.e2e.example.com icecreamorders 1781599706-test-bi-directional bi-bob-order-1781599981478403287 3325 3687 362 system:serviceaccount:flux-system:kustomize-controller 1781600041234 -gitops-reverser:bi-directional.e2e.example.com:icecreamorders 1781600051012-0 older-than-high-water patch bi-directional.e2e.example.com icecreamorders 1781599706-test-bi-directional bi-alice-order-1781599981478403287 3428 3773 345 system:serviceaccount:flux-system:kustomize-controller 1781600050978 -gitops-reverser:bi-directional.e2e.example.com:icecreamorders 1781600051013-0 older-than-high-water patch bi-directional.e2e.example.com icecreamorders 1781599706-test-bi-directional bi-bob-order-1781599981478403287 3325 3773 448 system:serviceaccount:flux-system:kustomize-controller 1781600050978 -gitops-reverser:core:configmaps 1781599890077-0 older-than-high-water create configmaps gitops-reverser-audit-warmup audit-warmup 2295 2351 56 system:admin 1781599877528 -gitops-reverser:core:configmaps 1781599890078-0 older-than-high-water patch configmaps gitops-reverser-audit-warmup audit-warmup 2296 2351 55 system:admin 1781599877563 -gitops-reverser:core:namespaces 1781599890076-0 older-than-high-water create namespaces gitops-reverser-audit-warmup 2293 2337 44 system:admin 1781599877495 -gitops-reverser:core:secrets 1781600031675-0 older-than-high-water patch secrets 1781599706-test-bi-directional bi-controller-sops-1781599981478403287 3200 3614 414 system:serviceaccount:flux-system:kustomize-controller 1781600031662 -gitops-reverser:core:secrets 1781600031675-1 older-than-high-water patch secrets 1781599706-test-bi-directional git-creds-invalid-e2e-bi-directional-1781599706 3093 3614 521 system:serviceaccount:flux-system:kustomize-controller 1781600031663 -gitops-reverser:core:secrets 1781600031676-0 older-than-high-water patch secrets 1781599706-test-bi-directional bi-secret-1781599981478403287 3491 3614 123 system:serviceaccount:flux-system:kustomize-controller 1781600031663 -gitops-reverser:core:secrets 1781600031677-0 older-than-high-water patch secrets 1781599706-test-bi-directional git-creds-e2e-bi-directional-1781599706 3091 3614 523 system:serviceaccount:flux-system:kustomize-controller 1781600031663 -gitops-reverser:core:secrets 1781600031682-0 older-than-high-water patch secrets 1781599706-test-bi-directional git-creds-ssh-e2e-bi-directional-1781599706 3092 3668 576 system:serviceaccount:flux-system:kustomize-controller 1781600031668 -gitops-reverser:core:secrets 1781600031683-0 older-than-high-water patch secrets 1781599706-test-bi-directional sops-age-key 3094 3669 575 system:serviceaccount:flux-system:kustomize-controller 1781600031671 -gitops-reverser:core:secrets 1781600041231-0 older-than-high-water patch secrets 1781599706-test-bi-directional bi-secret-1781599981478403287 3673 3741 68 system:serviceaccount:flux-system:kustomize-controller 1781600041227 -gitops-reverser:core:secrets 1781600041245-0 older-than-high-water patch secrets 1781599706-test-bi-directional git-creds-e2e-bi-directional-1781599706 3674 3741 67 system:serviceaccount:flux-system:kustomize-controller 1781600041227 -gitops-reverser:core:secrets 1781600041246-0 older-than-high-water patch secrets 1781599706-test-bi-directional bi-controller-sops-1781599981478403287 3672 3741 69 system:serviceaccount:flux-system:kustomize-controller 1781600041228 -gitops-reverser:core:secrets 1781600041247-0 older-than-high-water patch secrets 1781599706-test-bi-directional git-creds-invalid-e2e-bi-directional-1781599706 3675 3741 66 system:serviceaccount:flux-system:kustomize-controller 1781600041228 -gitops-reverser:core:secrets 1781600041248-0 older-than-high-water patch secrets 1781599706-test-bi-directional sops-age-key 3678 3741 63 system:serviceaccount:flux-system:kustomize-controller 1781600041232 -gitops-reverser:core:secrets 1781600041248-1 older-than-high-water patch secrets 1781599706-test-bi-directional git-creds-ssh-e2e-bi-directional-1781599706 3677 3741 64 system:serviceaccount:flux-system:kustomize-controller 1781600041232 -gitops-reverser:core:secrets 1781600050976-0 older-than-high-water patch secrets 1781599706-test-bi-directional git-creds-e2e-bi-directional-1781599706 3674 3741 67 system:serviceaccount:flux-system:kustomize-controller 1781600050973 -gitops-reverser:core:secrets 1781600050977-0 older-than-high-water patch secrets 1781599706-test-bi-directional bi-secret-1781599981478403287 3673 3741 68 system:serviceaccount:flux-system:kustomize-controller 1781600050973 -gitops-reverser:core:secrets 1781600050978-0 older-than-high-water patch secrets 1781599706-test-bi-directional git-creds-invalid-e2e-bi-directional-1781599706 3675 3741 66 system:serviceaccount:flux-system:kustomize-controller 1781600050973 -gitops-reverser:core:secrets 1781600051009-0 older-than-high-water patch secrets 1781599706-test-bi-directional bi-controller-sops-1781599981478403287 3672 3741 69 system:serviceaccount:flux-system:kustomize-controller 1781600050973 -gitops-reverser:core:secrets 1781600051010-0 older-than-high-water patch secrets 1781599706-test-bi-directional sops-age-key 3678 3741 63 system:serviceaccount:flux-system:kustomize-controller 1781600050977 -gitops-reverser:core:secrets 1781600051011-0 older-than-high-water patch secrets 1781599706-test-bi-directional git-creds-ssh-e2e-bi-directional-1781599706 3677 3741 64 system:serviceaccount:flux-system:kustomize-controller 1781600050977 -gitops-reverser:core:services 1781599998497-0 older-than-high-water update services kube-system kubelet 1426 3133 1707 system:serviceaccount:prometheus-operator:prometheus-operator 1781599998452 -gitops-reverser:core:services 1781600179084-0 older-than-high-water update services kube-system kubelet 1426 3937 2511 system:serviceaccount:prometheus-operator:prometheus-operator 1781600178453 -gitops-reverser:k3s.cattle.io:addons 1781599888839-0 older-than-high-water update k3s.cattle.io addons kube-system auth-delegator 394 2355 1961 system:k3s-supervisor 1781599883803 -gitops-reverser:k3s.cattle.io:addons 1781599888839-1 older-than-high-water update k3s.cattle.io addons kube-system rolebindings 514 2355 1841 system:k3s-supervisor 1781599886503 -gitops-reverser:k3s.cattle.io:addons 1781599888840-0 older-than-high-water update k3s.cattle.io addons kube-system runtimes 529 2355 1826 system:k3s-supervisor 1781599886867 -gitops-reverser:k3s.cattle.io:addons 1781599888842-0 older-than-high-water update k3s.cattle.io addons kube-system auth-reader 400 2355 1955 system:k3s-supervisor 1781599883906 -gitops-reverser:k3s.cattle.io:addons 1781599888844-0 older-than-high-water update k3s.cattle.io addons kube-system metrics-apiservice 405 2355 1950 system:k3s-supervisor 1781599883992 -gitops-reverser:k3s.cattle.io:addons 1781599888848-0 older-than-high-water update k3s.cattle.io addons kube-system metrics-server-deployment 439 2355 1916 system:k3s-supervisor 1781599884457 -gitops-reverser:k3s.cattle.io:addons 1781599888849-0 older-than-high-water update k3s.cattle.io addons kube-system ccm 281 2355 2074 system:k3s-supervisor 1781599880977 -gitops-reverser:k3s.cattle.io:addons 1781599888850-0 older-than-high-water update k3s.cattle.io addons kube-system metrics-server-service 453 2355 1902 system:k3s-supervisor 1781599884584 -gitops-reverser:wardle.example.com:flunders 1781599901657-0 rv-missing-before-high-water deletecollection wardle.example.com flunders gitops-reverser-audit-warmup 0 system:serviceaccount:kube-system:namespace-controller 1781599901519 -gitops-reverser:wardle.example.com:flunders 1781599921510-0 rv-missing-before-high-water deletecollection wardle.example.com flunders 1781599706-test-manager-overlap 0 system:serviceaccount:kube-system:namespace-controller 1781599921142 -gitops-reverser:wardle.example.com:flunders 1781599937550-0 rv-missing-before-high-water deletecollection wardle.example.com flunders 1781599706-test-deployment-scale 0 system:serviceaccount:kube-system:namespace-controller 1781599936919 -gitops-reverser:wardle.example.com:flunders 1781599959744-0 rv-missing-before-high-water deletecollection wardle.example.com flunders 1781599706-test-manager-isolation 0 system:serviceaccount:kube-system:namespace-controller 1781599959696 -gitops-reverser:wardle.example.com:flunders 1781599962555-0 rv-missing-before-high-water deletecollection wardle.example.com flunders 1781599706-test-commit-request 0 system:serviceaccount:kube-system:namespace-controller 1781599962455 -gitops-reverser:wardle.example.com:flunders 1781599976648-0 rv-missing-before-high-water deletecollection wardle.example.com flunders 1781599706-test-commit-request-bundle 0 system:serviceaccount:kube-system:namespace-controller 1781599976641 -gitops-reverser:wardle.example.com:flunders 1781599990454-0 rv-missing-before-high-water deletecollection wardle.example.com flunders 1781599706-test-manager-watchrule 0 system:serviceaccount:kube-system:namespace-controller 1781599989534 -gitops-reverser:wardle.example.com:flunders 1781600008643-0 rv-missing-before-high-water deletecollection wardle.example.com flunders 1781599706-test-manager-inplace-edit 0 system:serviceaccount:kube-system:namespace-controller 1781600007654 -gitops-reverser:wardle.example.com:flunders 1781600018506-0 rv-missing-before-high-water deletecollection wardle.example.com flunders 1781599706-test-signing 0 system:serviceaccount:kube-system:namespace-controller 1781600018459 -gitops-reverser:wardle.example.com:flunders 1781600019506-0 rv-missing-before-high-water deletecollection wardle.example.com flunders 1781599706-test-commit-window-batching 0 system:serviceaccount:kube-system:namespace-controller 1781600019455 -gitops-reverser:wardle.example.com:flunders 1781600029109-0 rv-missing-before-high-water deletecollection wardle.example.com flunders 1781599706-test-manager-manifest-folder 0 system:serviceaccount:kube-system:namespace-controller 1781600029013 -gitops-reverser:wardle.example.com:flunders 1781600039153-0 rv-missing-before-high-water deletecollection wardle.example.com flunders 1781599706-test-manager-gitprovider 0 system:serviceaccount:kube-system:namespace-controller 1781600038530 diff --git a/docs/design/stream/late-lane-e2e-2026-06-16-midrun.tsv b/docs/design/stream/late-lane-e2e-2026-06-16-midrun.tsv deleted file mode 100644 index 84b8f93a..00000000 --- a/docs/design/stream/late-lane-e2e-2026-06-16-midrun.tsv +++ /dev/null @@ -1,21 +0,0 @@ -base id reason verb api_group resource namespace name rv last_rv rv_gap user stage_millis -gitops-reverser:apiextensions.k8s.io:customresourcedefinitions 1781599889449-0 older-than-high-water update apiextensions.k8s.io customresourcedefinitions etcdsnapshotfiles.k3s.cattle.io 217 219 2 system:k3s-supervisor 1781599879316 -gitops-reverser:apiextensions.k8s.io:customresourcedefinitions 1781599889452-0 older-than-high-water update apiextensions.k8s.io customresourcedefinitions helmchartconfigs.helm.cattle.io 223 227 4 system:k3s-supervisor 1781599879338 -gitops-reverser:core:configmaps 1781599890077-0 older-than-high-water create configmaps gitops-reverser-audit-warmup audit-warmup 2295 2351 56 system:admin 1781599877528 -gitops-reverser:core:configmaps 1781599890078-0 older-than-high-water patch configmaps gitops-reverser-audit-warmup audit-warmup 2296 2351 55 system:admin 1781599877563 -gitops-reverser:core:namespaces 1781599890076-0 older-than-high-water create namespaces gitops-reverser-audit-warmup 2293 2337 44 system:admin 1781599877495 -gitops-reverser:k3s.cattle.io:addons 1781599888839-0 older-than-high-water update k3s.cattle.io addons kube-system auth-delegator 394 2355 1961 system:k3s-supervisor 1781599883803 -gitops-reverser:k3s.cattle.io:addons 1781599888839-1 older-than-high-water update k3s.cattle.io addons kube-system rolebindings 514 2355 1841 system:k3s-supervisor 1781599886503 -gitops-reverser:k3s.cattle.io:addons 1781599888840-0 older-than-high-water update k3s.cattle.io addons kube-system runtimes 529 2355 1826 system:k3s-supervisor 1781599886867 -gitops-reverser:k3s.cattle.io:addons 1781599888842-0 older-than-high-water update k3s.cattle.io addons kube-system auth-reader 400 2355 1955 system:k3s-supervisor 1781599883906 -gitops-reverser:k3s.cattle.io:addons 1781599888844-0 older-than-high-water update k3s.cattle.io addons kube-system metrics-apiservice 405 2355 1950 system:k3s-supervisor 1781599883992 -gitops-reverser:k3s.cattle.io:addons 1781599888848-0 older-than-high-water update k3s.cattle.io addons kube-system metrics-server-deployment 439 2355 1916 system:k3s-supervisor 1781599884457 -gitops-reverser:k3s.cattle.io:addons 1781599888849-0 older-than-high-water update k3s.cattle.io addons kube-system ccm 281 2355 2074 system:k3s-supervisor 1781599880977 -gitops-reverser:k3s.cattle.io:addons 1781599888850-0 older-than-high-water update k3s.cattle.io addons kube-system metrics-server-service 453 2355 1902 system:k3s-supervisor 1781599884584 -gitops-reverser:wardle.example.com:flunders 1781599901657-0 rv-missing-before-high-water deletecollection wardle.example.com flunders gitops-reverser-audit-warmup 0 system:serviceaccount:kube-system:namespace-controller 1781599901519 -gitops-reverser:wardle.example.com:flunders 1781599921510-0 rv-missing-before-high-water deletecollection wardle.example.com flunders 1781599706-test-manager-overlap 0 system:serviceaccount:kube-system:namespace-controller 1781599921142 -gitops-reverser:wardle.example.com:flunders 1781599937550-0 rv-missing-before-high-water deletecollection wardle.example.com flunders 1781599706-test-deployment-scale 0 system:serviceaccount:kube-system:namespace-controller 1781599936919 -gitops-reverser:wardle.example.com:flunders 1781599959744-0 rv-missing-before-high-water deletecollection wardle.example.com flunders 1781599706-test-manager-isolation 0 system:serviceaccount:kube-system:namespace-controller 1781599959696 -gitops-reverser:wardle.example.com:flunders 1781599962555-0 rv-missing-before-high-water deletecollection wardle.example.com flunders 1781599706-test-commit-request 0 system:serviceaccount:kube-system:namespace-controller 1781599962455 -gitops-reverser:wardle.example.com:flunders 1781599976648-0 rv-missing-before-high-water deletecollection wardle.example.com flunders 1781599706-test-commit-request-bundle 0 system:serviceaccount:kube-system:namespace-controller 1781599976641 -gitops-reverser:wardle.example.com:flunders 1781599990454-0 rv-missing-before-high-water deletecollection wardle.example.com flunders 1781599706-test-manager-watchrule 0 system:serviceaccount:kube-system:namespace-controller 1781599989534 diff --git a/docs/design/stream/per-type-streaming-readiness-plan.md b/docs/design/stream/per-type-streaming-readiness-plan.md deleted file mode 100644 index d979cb02..00000000 --- a/docs/design/stream/per-type-streaming-readiness-plan.md +++ /dev/null @@ -1,176 +0,0 @@ -# Per-type stream readiness — simple plan - -> Status: plan / proposal · Branch: `investigate` · Date: 2026-06-26 -> -> Fixes the timing problem documented in -> [watch-replay-watermark-stream-readiness-investigation.md](./watch-replay-watermark-stream-readiness-investigation.md). -> Deliberately simpler than the `Initializing / PartiallyLive / Live` axis sketched -> in [materialization-tail-and-live-readiness-review.md](../../finished/materialization-tail-and-live-readiness-review.md): -> two happy-path states per watched type plus one condition to wait on. -> -> The concrete status objects, fields, printer columns, naming rationale, state -> machine, and the source-code this lets us delete are designed in -> [streaming-readiness-status-machine-design.md](./streaming-readiness-status-machine-design.md). -> Names below follow that doc (`StreamsReady` / `Replaying` / `Streaming` / -> `Blocked`), chosen to fit Kubernetes API conventions. - -## 1. Goal - -Give every watched type a clear, observable answer to one question: **"is this type's -stream ready, or still replaying?"** Then callers — first of all the e2e suite — -set things up, **wait for `StreamsReady`**, and only then perform the actions whose -live / attributed behaviour they assert. Nothing should expect a write issued in the -same instant a watch is being established to be a live, attributed event; this plan -makes "the streams are ready" a fact you can wait for instead of a guess. - -## 2. The states - -Per `(GitTarget, type)` — two happy-path states plus an honest dead-end: - -- **Replaying** — the `SendInitialEvents` replay is in flight (first replay, or a - fresh replay after `410 Expired`). A write observed now is folded into the - **unattributed baseline** — no per-event CREATE, no audit attribution. -- **Streaming** — the watch crossed `k8s.io/initial-events-end`, or resumed from a - durable cursor with live routing active. A write observed now is a **live, - per-event, attributable** event. -- **Blocked** — the type cannot be watched (not followable / RBAC) or its watch keeps - erroring; it can never reach Streaming until the cause clears. Counted honestly, not - hidden inside Replaying. - -```text - start (no cursor) ─▶ Replaying ──(initial-events-end)──▶ Streaming - restart (cursor) ──────────────────────────────────────▶ Streaming - Streaming ──(410 Expired)──▶ Replaying - Replaying ──(not followable / watch error)──▶ Blocked ──(recovers)──▶ Replaying -``` - -**Normal operation does not replay.** A live GitTarget keeps a durable watch cursor -(the last processed resourceVersion, already implemented — `recordTargetWatchCursor` / -`lookupTargetWatchCursor` in -[target_watch.go](../../../internal/watch/target_watch.go)). On restart it *resumes -from the cursor* and goes straight to **Streaming** — it picks up where it left off, no -full replay. Replaying is only the first replay, or recovery after the cursor expires -(`410 Expired`). So in steady state, "wait for `StreamsReady`" is fast. - -The controller already knows the transitions today; it just doesn't surface them: - -- → Streaming after replay: `target watch replay complete` ([target_watch.go:417](../../../internal/watch/target_watch.go#L417)), then `streamLiveTargetWatchEvents`. -- → Streaming via resume: `recordTargetReconcileCompleted(gitDest, "cursor_resume")` ([target_watch.go:324](../../../internal/watch/target_watch.go#L324)). - -## 3. Where the state lives — recommendation - -The **source of truth** is the watch manager (it owns the per-`(gitDest, gvr)` -lifecycle). The question is only where to **surface** it. - -**Recommendation: per-rule granularity on the (Cluster)WatchRule; a bounded aggregate -on the GitTarget.** Both expose a `StreamsReady` condition. - -- **WatchRule / ClusterWatchRule** — `StreamsReady` True ⟺ every type this rule - resolves is Streaming for its target. This is the object a user authored and reasons - about, and its `spec.resources` is the natural, explicit enumeration to report on. -- **GitTarget** — one aggregate `StreamsReady` condition plus bounded counts. No - per-type list. - -Why this split (and why not a per-type list on the GitTarget): - -- The codebase **already made this call** for the checkpoint roll-up: - `GitTargetMaterializationStatus` is deliberately "a summary (counts), not a per-type - list, so it stays bounded regardless of how many types are watched" - ([gittarget_types.go:128-159](../../../api/v1alpha3/gittarget_types.go#L128-L159)). - A GitTarget fans in from multiple WatchRules and wildcard expansions, so a per-type - list there is unbounded by construction. -- The WatchRule is the bounded, user-scoped place. **Caveat:** a wildcard - ClusterWatchRule can itself resolve to many types, so even there emit the condition + - counts + a *capped* sample of not-yet-ready types, never a full list. - -So the GitTarget answers "is everything I serve ready?"; the WatchRule answers "is *my* -declared set ready?". Both are conditions you can `kubectl wait` on. - -## 4. Status surface - -Shapes, fields, examples, and printer columns are in the -[design doc](./streaming-readiness-status-machine-design.md) §3. In brief: - -- **GitTarget** and **(Cluster)WatchRule** each get a `StreamsReady` condition and a - bounded `status.streams` roll-up (`summary` / `total` / `ready` / `replaying` / - `blocked`; the rule adds a capped `pendingSample`). -- `Ready` and `StreamsReady` are independent. **`Ready` must not gate on stream - readiness** — a large watched set can take a while to replay, and `Ready` keeps - meaning "admitted and valid," size-independent. -- `phase` is **not** part of this contract and not a printer column (API conventions - discourage `phase`; automation gates on conditions). - -## 5. Wiring - -Reuse the path that already drives status — the `Materializer` → -`MaterializationObserver` events that already populate the GitTarget roll-up -([materializer.go](../../../internal/typeset/materializer.go)). Carry a per-type state -(Replaying / Streaming / Blocked) on that event when the watch crosses the watermark, -resumes from a cursor, or errors, and let: - -- the GitTarget controller fold it into the aggregate `StreamsReady` condition + counts, -- the WatchRule controller (which already resolves `spec.resources` → GVRs to set - `Ready`) join those GVRs against the per-type states to set its own `StreamsReady`. - -No new transport, no new watch. The data already flows; this names it and surfaces it. - -## 6. e2e: every test needs this - -The payoff, and **not optional per spec** — the race is general. Any spec that asserts -per-event behaviour, authorship/attribution, or commit ordering can lose it, so **all -e2e tests** adopt the same shape: - -1. Create `GitProvider` → `GitTarget` → `(Cluster)WatchRule`. -2. **Wait for `StreamsReady`** before any asserted action: - - `waitForStreamsReady(name, ns)` → `kubectl wait --for=condition=StreamsReady=true gittarget/ --timeout=120s` - (blocks until ready or the timeout) for "everything this target serves is ready"; or - - `waitForWatchRuleStreamsReady(name, ns)` for a spec that depends on one rule. -3. Only then create the resources whose live/attributed/ordered behaviour is asserted. - -Concretely: - -- Add the `waitForStreamsReady` / `waitForWatchRuleStreamsReady` helpers next to the - existing `waitForGitTargetSynced` - ([e2e_test.go:235](../../../test/e2e/e2e_test.go#L235)). -- **Audit every spec** and replace the "wait for `Ready`/`Synced` then act" gate with - "wait for `StreamsReady` then act" wherever the assertion depends on a live per-event - observation. The two known failures - ([signing_e2e_test.go:603](../../../test/e2e/signing_e2e_test.go#L603), - [commit_author_attribution_e2e_test.go:171](../../../test/e2e/commit_author_attribution_e2e_test.go#L171)) - are the first conversions; the comment on `waitForGitTargetSynced` (which already - warns about the baseline fold) flags the others. -- Retire `Synced` / `waitForGitTargetSynced` (design §6). - -## 7. Edge cases - -- **Cursor resume:** straight to `Streaming` once the watch is open and routing — no - `Replaying` flash, no full replay (Section 2). The contract is "post-gate writes are - live events," not "zero lag." -- **`410 Expired`:** drop the affected type back to `Replaying` (aggregate - `StreamsReady` → `False`) until the fresh replay re-crosses the watermark. -- **Not followable / watch error:** `Blocked`, surfaced via the `WatchNotPermitted` / - `WatchError` reason — never silently counted as replaying. -- **Wildcard rules:** condition + counts + capped sample only; never a full list. -- **Multiple WatchRules → one GitTarget:** the GitTarget aggregate is the AND over all - its tracked types; each WatchRule reports only its own resolved subset. - -## 8. Non-goals - -- Reworking the baseline resync itself (the baseline is correct; this is about *knowing - when it ends*). -- Changing `Ready` semantics or gating `Ready` on stream readiness. -- A full per-type status list on any object. -- Per-object (vs per-type) readiness. - -## 9. Steps - -1. Watch manager: track per-`(gitDest, gvr)` state (Replaying / Streaming / Blocked); - set Streaming on watermark-crossed and on cursor-resume, Replaying on `410`, Blocked - on not-followable / watch error. -2. Plumb the state through the existing materialization event to the controllers. -3. GitTarget: derive aggregate `StreamsReady` condition + `streams` counts. -4. (Cluster)WatchRule: derive a `StreamsReady` condition over the rule's resolved types. -5. e2e: add `waitForStreamsReady` / `waitForWatchRuleStreamsReady`; convert **all** - specs to setup → wait-for-`StreamsReady` → act; start with the two known failures. -6. Regression: the mutationlab `configmap/watch-replay-collapse` row already pins the - Kubernetes-side fact this plan is designed around. diff --git a/docs/design/stream/signing-overlap-band-coverage-drop-investigation.md b/docs/design/stream/signing-overlap-band-coverage-drop-investigation.md deleted file mode 100644 index ce32a7ce..00000000 --- a/docs/design/stream/signing-overlap-band-coverage-drop-investigation.md +++ /dev/null @@ -1,335 +0,0 @@ -# Signing overlap-band coverage drop: a single object never reaches a late-joining target - -Status: **open investigation.** This records exactly what was observed, what it proves, and what is -still an unproven assumption. It is deliberately conservative: every claim is tagged **FACT** -(directly observed), **DERIVED** (forced by a FACT plus code we can read), or **HYPOTHESIS** (a -candidate mechanism not yet confirmed). The goal is a precise, falsifiable starting point — not a -fix. - -It is the sequel to -[`signing-snapshot-tail-replay-failure-investigation.md`](signing-snapshot-tail-replay-failure-investigation.md) -(the per-target coverage watermark `Hc`, §5–§8). That doc closed the *replay* direction (historical -entries wrongly re-committed). This one is the *opposite* failure: an object that should be present -under a late-joining target is **silently absent**, and §8.1's claim that content-convergence is -"deterministic regardless of which path delivers it" did not hold. - ---- - -## 1. Executive summary - -A full `task test-e2e` run failed on one spec: `Commit Signing > should not replay already-reconciled -configmaps as per-event commits to a late-joining target` -([`test/e2e/signing_e2e_test.go:507`](../../../test/e2e/signing_e2e_test.go#L507)). The convergence -assertion at [line 609](../../../test/e2e/signing_e2e_test.go#L609) timed out: under target **B**, -`overlap-b-cm-16` was missing. All 40 `seed` ConfigMaps and the other **19 of 20** `overlap-b` -ConfigMaps were present. - -The object was **dropped, not delayed**: it is still absent in the Gitea repo for that run long after -the test gave up. The failure is **not** caused by re-running the suite ("second run") — per-run -state is clean, the spec passes in isolation, later full-suite runs against the same reused cluster -passed the overlap spec again, and a full-suite run after `task clean-cluster` also passed. Later -warm-cluster failures were in unrelated specs. It is an **intermittent coverage gap** exposed under -the concurrency of the full suite. - -What is *not* yet known: the exact path by which a single CREATE'd ConfigMap reached neither target -B's reconcile fold nor its live tail. The most intuitive cause (late-lane diversion) is **weakened** -by a counter measurement (§4.4) and must not be assumed. - ---- - -## 2. Verified facts (with evidence) - -All from the failing run on **2026-06-15**, Ginkgo report written **14:06:10**, against the reused -k3d cluster `k3d-gitops-reverser-test-e2e`. - -**F1 — One spec failed, and the assertion was content-convergence.** -The JSON report (`.stamps/cluster/k3d-gitops-reverser-test-e2e/gitops-reverser/ginkgo-report-full.json`) -shows `passed:55, skipped:8, failed:1`. The failure message: -`Timed out after 30.001s … overlap overlap-b-cm-16 must be present under path B` -(`signing_e2e_test.go:609`, inside the `Eventually` at lines 601–619). The listing in the failure -shows `overlap-b-cm-00..15` and `overlap-b-cm-17..19` present — exactly one missing: **cm-16**. - -**F2 — The missing object is a genuine drop, not slowness.** -Querying Gitea (`testorg/e2e-signing-1781531991`, branch `main`, path -`e2e/signing-overlap/b/v1/configmaps/1781531991-test-signing/`) well after the run: - -| Band | Present under B | -|---|---| -| `seed-cm-*` | 40 / 40 | -| `overlap-b-cm-*` | **19 / 20** (cm-16 absent) | -| `live-b-*` | 0 (the spec failed before that step ran) | - -The repo is per-run (timestamped name), so this is the same data the test saw — cm-16 never landed. - -**F3 — Per-run state is isolated.** -Each run uses a fresh timestamped namespace (`1781531991-test-signing`), a fresh Gitea repo, and the -coverage watermark is in-memory on the controller, keyed by the GitTarget's namespaced name, cleared -on delete (`clearTargetTypeWatermarks`) and lost on controller restart (the pod is redeployed each -run). There is no documented channel for run N−1 to corrupt run N. - -**F4 — Redis streams are bounded, not accumulating.** -At inspection the largest per-type stream was `core:configmaps:audit:stream` at 433–454 entries; most -others sit near a ~50 trim cap. Valkey is **not** flushed between runs, but `XADD MAXLEN` keeps each -stream bounded, so "the second run drowns in run-1 backlog" is not the mechanism. - -**F5 — The spec passes in isolation.** -A focused re-run (`ginkgo --focus="late-joining target" --procs=1`) against the same warm cluster -**passed** (1/1, 35.0s; bootstrap was a 2.1s no-op). The failure is therefore **intermittent**, and -correlates with full-suite concurrency (`--procs=4`), not with run ordinality. - -**F6 — Two requested full-suite follow-ups did not reproduce the failure.** -On **2026-06-15**, while the cluster from the failed investigation was still available, a full -`task test-e2e` run against the reused cluster **passed**: random seed `1781535194`, warm -`SynchronizedBeforeSuite` `1.423s`, `48 Passed / 0 Failed / 8 Skipped`, suite runtime `335.793s` -(Ginkgo total `5m36.963847831s`). The overlap-band spec itself passed in `34.220s`. - -Then `task clean-cluster` **passed**, deleting `gitops-reverser-test-e2e` and -`.stamps/cluster/k3d-gitops-reverser-test-e2e`. Docker was rechecked and available. A fresh-cluster -`task test-e2e` run also **passed**: random seed `1781535554`, cold `SynchronizedBeforeSuite` -`206.329s`, `48 Passed / 0 Failed / 8 Skipped`, suite runtime `522.089s` (Ginkgo total -`8m43.437847699s`). The overlap-band spec itself passed in `39.479s`. - -These two passes are negative evidence only: they show the failure does not currently reproduce on -demand, with or without cluster reuse. They do **not** explain where the original missing -`overlap-b-cm-16` event went. - -**F7 — A later warm-cluster rerun failed elsewhere, while the overlap-band spec passed again.** -On **2026-06-15**, Docker was available, but `make test-e2e` could not run because the repository has -no `test-e2e` make target (`make: *** No rule to make target 'test-e2e'. Stop.`). The equivalent -project task, `task test-e2e`, was run against the warm cluster with random seed `1781536217`. - -That run **failed** overall: `47 Passed / 1 Failed / 8 Skipped`, suite runtime `346.814s` (Ginkgo -total `5m48.038004632s`). The failure was **not** the signing overlap-band spec. The overlap-band -spec passed in `39.591s`. - -The failing spec was `Commit Window Batching > collapses a burst of events into one grouped commit -and one push` ([`test/e2e/commit_window_batching_e2e_test.go:164`](../../../test/e2e/commit_window_batching_e2e_test.go#L164)): -`expected 1 grouped commit for the burst, got 3`. The local checkout for -`e2e-commit-window-1781536217` showed the expected grouped 4-resource commit, plus two extra commits -touching `commit-window-burst-1781536217-3.yaml` (`D` then `A`). This is evidence of a separate -commit-window behavior, not a reproduction of the signing coverage drop. - -**F8 — Another warm-cluster rerun passed overlap and commit-window, then failed in CRD lifecycle.** -On **2026-06-15**, Docker was available and `task test-e2e` was run again against the same warm -cluster without `task clean-cluster`. Random seed: `1781536806`. Warm `SynchronizedBeforeSuite`: -`1.900s`. - -That run **failed** overall: `44 Passed / 1 Failed / 11 Skipped`, suite runtime `425.066s` (Ginkgo -total `7m6.313383409s`). The overlap-band spec passed in `34.665s`; the previously failing -commit-window batching spec also passed in `31.315s`. - -The failing spec was `Manager CRD Lifecycle > should create Git commit when IceCreamOrder is added -via WatchRule` ([`test/e2e/crd_lifecycle_e2e_test.go:340`](../../../test/e2e/crd_lifecycle_e2e_test.go#L340)). -It timed out after `120.000s` waiting for -`.stamps/repos/e2e-manager-crd-1781536806/e2e/icecream-test/crd-lifecycle.e2e.example.com/v1/icecreamorders/1781536806-test-manager-crd/alices-order.yaml`. -During the quiet period, the test process was blocked deleting namespace -`1781536806-test-manager-crd`; the namespace was `Terminating` for more than two minutes and then -completed deletion. The local checkout for `e2e-manager-crd-1781536806` contained the CRD-install -commits, including `icecreamorders.crd-lifecycle.e2e.example.com.yaml`, but no -`e2e/icecream-test/.../alices-order.yaml`. - ---- - -## 3. What this rules out - -- **R1 — Not a "second run / reuse" determinism bug.** F3 + F4 + F5 + F6. The user's framing ("it - should run a second time") is correct *as a property*; the observed failure simply is not caused by - the re-run. The first run passing and the second failing is consistent with an intermittent race - sampled twice, and the later reused-cluster pass plus clean-cluster pass make a reuse-only - explanation even less likely. -- **R2 — Not stale coverage-watermark contamination.** The watermark is in-memory, namespaced-name - keyed, and reset on delete/restart (F3). A run-1 `signing-overlap-b` boundary cannot gate run-2. -- **R3 — Not the docs/upgrade-notes change.** That change set is pure markdown; it does not touch the - watch/queue/git path. - ---- - -## 4. The mechanism: what is forced, and what is still open - -### 4.1 The invariant that narrows the cause (DERIVED) - -Target B becomes present-correct for a type by exactly two paths, both fed from one -`SpliceSnapshotForType` call ([`event_router.go:210–241`](../../../internal/watch/event_router.go#L210-L241)): - -1. **the reconcile fold** — `snapshot.Desired`, the materialized checkpoint+log folded into a desired - set, written by a scoped resync; -2. **the live tail** — `applyAuditChangesForType` - ([`audit_tail.go:211–220`](../../../internal/watch/audit_tail.go#L211-L220)) routes a main-stream - entry to B iff its stream id is strictly after `Hc = snapshot.CoverageHead`. - -`Desired` and `CoverageHead` come from the **same** splice, so they are intended to be a consistent -cut: every object folded has id ≤ `Hc`; every object with id > `Hc` is routed live. **Therefore an -object that is a normally-ordered entry on the main RV stream cannot be dropped** — it is either ≤ -`Hc` (folded) or > `Hc` (routed). - -**DERIVED conclusion:** cm-16 was *not present as a normally-ordered main-stream entry within the -splice's cut at the moment B reconciled.* The drop must come from one of: (a) it was diverted off the -main stream, (b) it was never ingested onto the main stream, or (c) the checkpoint the splice folded -did not contain it *and* `Hc` was nonetheless advanced past its position. - -### 4.2 The late-lane path (the obvious candidate) - -The mirror keeps the main stream strictly RV-ordered; an event whose RV is **strictly below the -stream high-water** is rejected by `XADD` and diverted to the diagnostic late lane `:audit:late` -([`redis_bytype_queue.go:53–68, 119–145`](../../../internal/queue/redis_bytype_queue.go#L53-L68)). -The ordered log **never replays** a late-lane entry, so the fold never folds it and the tail never -routes it — a silent loss by construction. The `lateNotify` callback is the only recovery: it asks -the materialization layer to *pull the next checkpoint forward* so a fresh LIST re-captures the -object. This is the "late-event → resync nudge." - -If cm-16's CREATE arrived out of RV order under batch+join load, this path explains the drop exactly, -and explains why a backstop *should* have recovered it. - -### 4.3 Why a single object can race here (HYPOTHESIS) - -The spec deliberately creates the 20-object `overlap-b` band and target B **at the same instant** -([`signing_e2e_test.go:588–598`](../../../test/e2e/signing_e2e_test.go#L588-L598)), precisely to keep -the band straddling B's join (§8.1 of the sibling doc). Under `--procs=4`, audit delivery for a batch -is not RV-ordered, so one object landing just below the high-water — or just after B's checkpoint cut -— is plausible for *some* object on *some* run. That it was cm-16 specifically is noise. - -### 4.4 The fact that disciplines the late-lane hypothesis (FACT → caution) - -The per-type `:audit:idstate` hash for ConfigMaps reads: - -``` -mainCount=454 rvMissingCount=66 lastRV=12442 lastStreamID=12442-0 -# lateCount field absent ⇒ 0 -``` - -**`lateCount=0` for ConfigMaps.** Across this cluster's stream life, *no* ordered ConfigMap event was -diverted to the late lane (other types show `lateCount` 1–54). So **§4.2 is not supported by the -counters for this type** and must not be assumed to be the cause. Two honest caveats keep this from -being a clean refutation: the idstate hash persists across runs and may have been reset when the -stream was last (re-)created, and the late lane was **empty** at inspection (trimmed), so the original -cm-16 entry — wherever it went — was not captured. - -What `lateCount=0` does *not* rule out is the **`rvMissingCount=66`** path: ConfigMap events here are -frequently RV-less and "attach to the high-water" (`placementAttachedToLastRV`). Whether that attach -can ever place an object where neither the fold nor the tail picks it up is **unverified** and worth a -unit test. - -### 4.5 Candidate mechanisms, ranked by current evidence - -| # | Hypothesis | Supported by | Argued against by | Decisive check | -|---|---|---|---|---| -| H1 | **Never ingested** onto the main stream (audit-delivery gap or best-effort mirror-write loss, IR8/IR9) | consistent with `lateCount=0`; the splice/tail invariant (§4.1) forces "not on the stream" | no direct evidence of a dropped webhook delivery | Dump the ConfigMap stream for the run's namespace at failure time; check audit-webhook receive logs for cm-16's UID | -| H2 | **Late-lane diversion** (RV below high-water) | exact silent-loss-by-construction; nudge-should-recover story | **`lateCount=0` for ConfigMaps** (§4.4) | Snapshot `:audit:late` + `lateCount` *at failure time*, before trim | -| H3 | **RV-missing attach anomaly** (`rvMissingCount=66`) places the entry outside the fold/tail cut | rv-missing is common for this type | attached entries are still on the main stream (should be folded or routed) | Unit test: an RV-less CREATE around a splice boundary | -| H4 | **Checkpoint/`Hc` seam**: the folded checkpoint lacked cm-16 yet `Hc` advanced past its position | the only main-stream-consistent drop | the splice is one consistent read (§4.1) | Assert in `SpliceSnapshotForType` that every id ≤ `CoverageHead` is in `Desired` | - -H1 is currently the **least-contradicted** by measurement; H2 is the most intuitive but is -**contradicted by `lateCount=0`**. No hypothesis is confirmed. - ---- - -## 5. The assumption to challenge directly - -The spec — and §8.1 of the sibling doc — assume content-convergence under B is **fast and -self-completing**: "Present eventually … regardless of which path delivered it," asserted inside a -**30s** `Eventually`. But the only *guaranteed* recovery for an object that missed both the -join-time fold and the live tail is the **next checkpoint / heal re-anchor**, which re-LISTs the live -API. If that backstop is not bounded within 30s — and `DeferCleanup` deletes target B at spec end, -removing it before any later heal can run — then the test asserts a timeliness guarantee the system -may not actually make. - -So a precise question, ahead of any fix: - -> Is "every object that exists when a target joins appears under that target within *one* reconcile" -> a guarantee we make, or only "…by the next checkpoint/heal"? The test currently assumes the former. - -The answer decides whether this is a **product bug** (the join-time path must be gap-free) or a -**test over-assertion** (convergence is eventually-consistent and the assertion needs the heal cadence -in its budget) — or both (a real gap *and* a too-tight assertion masking it). - ---- - -## 6. Getting a deterministic reproduction - -Chasing this through the full e2e is the wrong instrument (§8.1: an e2e cannot classify the overlap -band without an observable `Hc` or a tail-pause hook). Proposed order of attack: - -1. **Instrument the e2e failure path first (cheap, high value).** On this spec's failure, before - `DeferCleanup`, dump for `core:configmaps`: the main-stream `XRANGE` filtered to the run namespace, - the `:audit:late` `XRANGE`, and the `:audit:idstate` hash; plus the controller's audit-ingest log - lines for the missing object's name. One real capture collapses H1–H4 to one. -2. **Unit/integration repro in `internal/watch` / `internal/queue`** (`TestAuditTailFanout_*`, - `redis_bytype_queue_test.go`): drive a splice while feeding the mirror an object event that is - (a) RV below high-water, (b) RV-less, and (c) arriving just after the checkpoint cut — and assert - the object is present under the target after the splice settles (and after a simulated late - notify). This is the red-first proof the sibling doc already recommended for the replay direction. -3. **Only then** decide the fix surface: a gap-free join-time path, a reliable late→resync nudge for - the affected target (not just the type), or an explicit "converges by next checkpoint" contract - with the test budget adjusted to match. - ---- - -## 7. Open questions (explicit unverified assumptions) - -- **Q1.** Where did cm-16's event actually go — main stream, late lane, or nowhere? *Unverified;* the - evidence was trimmed before capture. Instrumentation (§6.1) is required. -- **Q2.** Does the `lateNotify` resync nudge re-drive a reconcile for an **already-Synced** target B, - or only refresh the type's checkpoint? If only the latter, B's `Desired` can stay stale until a - separate re-anchor fires. -- **Q3.** Is `SpliceSnapshotForType` guaranteed to return a `CoverageHead` that is ≤ the highest id it - folded into `Desired`? (The H4 invariant.) Untested as an assertion today. -- **Q4.** Can an RV-less event attached to the high-water (`rvMissingCount` path) ever sit at an id the - fold excludes but the tail also excludes? (The H3 invariant.) -- **Q5.** What is the heal / re-anchor cadence relative to the spec's 30s window, and does - `DeferCleanup` delete B before it can run? (Decides §5.) - ---- - -## 8. Bottom line - -A single CREATE'd ConfigMap was permanently absent under a late-joining target. It is a real, -intermittent coverage gap, not a re-run artifact; subsequent full-suite checks on both the reused -cluster and a fresh cluster passed, and later suite failures were in commit-window batching and CRD -lifecycle while the overlap spec passed. The splice/tail invariant proves the object was not a -normally-ordered main-stream entry within B's reconcile cut, but the **specific** path off the main -stream is **unconfirmed**, and the most intuitive explanation (late lane) is contradicted by -`lateCount=0` for this type. The next concrete step is not a fix but a **capture**: instrument the -spec to dump the stream, late lane, idstate, and ingest log at failure time, so H1–H4 collapse to one. - ---- - -## 9. Update (2026-06-19/20): §6.1 instrumentation partly landed; not reproduced since - -Tracking against this doc's "capture first" plan (§6.1). Cross-references: this is **Flake B** in -[`residual-e2e-flakes-2026-06-19.md`](residual-e2e-flakes-2026-06-19.md); it surfaced alongside the -first-event-loss fix (`first-event-loss-on-reclaim-plan.md`, -landed `5d85e7d`), which is a *separate* bug (a freshly-claimed type's first event, not a late-join -gap) and does not affect the conclusions here. - -**Instrumentation landed (`2bd5303`)** — turns the silent paths observable so the next reproduction -collapses H1–H4: -- the divert nudge `late audit event nudged a type resync` raised **V(1)→info** — fires iff a divert - happened for the type (H2 signal at default log level, no debug needed); -- `target-type watermark published / held` in `publishTargetTypeWatermark` — shows B's actual `Hc` and - whether a **stale-high prior `Hc` was held** ahead of this reconcile's `coverageHead` (the H4 seam); -- a per-batch `audit-tail routed batch to target` summary in `routeAuditChangesToTarget` - (`routed / suppressedAtOrBelowHc / firstID / lastID`) — distinguishes **"cm-16 reached the tail and - was suppressed at/below `Hc`"** (H4) from **"cm-16 never appeared in the tail batch"** (H1/H2). -- The scoped `diag_all` firehose already captures `configmaps` ingestion, and the validation - orchestrator dumps it (with a count of `older_than_high_water` diverts) on any failure — the - ingestion-side half of §6.1. - -**Still missing for a one-shot capture:** the agent's §6.1 idstate-hash snapshot and main-stream -`XRANGE` for the run namespace **inside the spec's failure path (before `DeferCleanup` deletes B)** — -the route summary + diag_all give the controller-side view, but a test-side dump at the moment of -failure is still the cleanest way to answer Q1. - -**A code fact that sharpens H4 vs H1/H2 (DERIVED, checked this session):** the watermark is published -as **exactly** `snapshot.CoverageHead` -([`event_router.go:241`](../../../internal/watch/event_router.go#L241)), and `SpliceType` sets -`coverageHead` to the **last entry it folded** — so for any object that *is* a normally-ordered -main-stream entry, `Hc` is contiguous with the fold by construction (§4.1's invariant, now traced to -the publish site). That makes **H4 unlikely unless `publishTargetTypeWatermark` holds a higher *prior* -`Hc`** (the new "watermark held" log is exactly that check), and pushes weight back onto **H1 (never a -normally-ordered stream entry)** — consistent with §4.5's ranking. It does **not** resolve Q2 (whether -the nudge re-drives an already-Synced B) or §5 (test-budget vs heal cadence). - -**Not reproduced since (weak evidence only):** `clean-cluster` + 3 runs and `clean-cluster` + 2 runs -after the instrumentation landed were all green (48/0); the overlap spec did not fail, so the new logs -have **no capture yet**. The flake remains low-frequency; the instrumentation is armed for the next -CI/warm reproduction. No fix applied — the trust gate (a confirmed mechanism) is not met. diff --git a/docs/design/stream/watch-replay-watermark-stream-readiness-investigation.md b/docs/design/stream/watch-replay-watermark-stream-readiness-investigation.md deleted file mode 100644 index 5b5c9153..00000000 --- a/docs/design/stream/watch-replay-watermark-stream-readiness-investigation.md +++ /dev/null @@ -1,223 +0,0 @@ -# Watch-first replay watermark: a stream-readiness timing bug - -> Status: investigation note / bug report. Facts first; analysis and a proposed -> direction follow and are labelled as such. -> Captured 2026-06-26 · Branch: `investigate` · Author: investigation. -> -> Context: GitHub Actions CI run -> [28231170122](https://github.com/ConfigButler/gitops-reverser/actions/runs/28231170122) -> (and its re-run), PR #174, commit `445c5b33d7f9065babb7f199f9e940be33bf599a`. -> -> Related: -> [watch-first-ingestion-architecture.md](../watch-first-ingestion-architecture.md), -> [materialization-tail-and-live-readiness-review.md](../../finished/materialization-tail-and-live-readiness-review.md) -> (the `Initializing / PartiallyLive / Live` liveness proposal this aligns with), -> [signing-snapshot-tail-replay-failure-investigation.md](./signing-snapshot-tail-replay-failure-investigation.md), -> [mutation-capture-lab-design.md](../mutation-capture-lab-design.md). - -## 1. Facts - -Everything in this section is observed and reproduced, not inferred. - -### 1.1 CI symptom - -- The `E2E (full)` job on branch `investigate` failed three consecutive runs, each - on a **different** spec; specs that failed on one run passed on a re-run. The - Ginkgo suite exited `201` (test failure), every other job (build, lint, unit, - e2e-quickstart) passed. -- In the re-run of run `28231170122`, two specs failed: - - **Commit Signing** — *"should not replay already-reconciled configmaps as - per-event commits to a late-joining target"* — - [signing_e2e_test.go:603](../../../test/e2e/signing_e2e_test.go#L603). - - **Commit Author Attribution** — *"attributes a commit to the OIDC display name - and email from user.extra"* — - [commit_author_attribution_e2e_test.go:171](../../../test/e2e/commit_author_attribution_e2e_test.go#L171). - -### 1.2 Failure 1 — a CREATE never surfaced as a per-event commit - -The spec seeds a live per-event tail by creating then labelling a ConfigMap -`probe-a`, and expects a `[CREATE] v1/configmaps/probe-a` commit. The assertion -timed out after 30s; the git log for the path contained only: - -```text -[UPDATE] v1/configmaps/probe-a -e2e-reconcile: synced 42 v1/configmaps@3814 to signing-overlap-a -e2e-reconcile: synced 8 v1/secrets@3813 to signing-overlap-a -``` - -The controller emitted exactly **one** per-event commit for `probe-a`, and it was -classified `[UPDATE]`: - -```text -worker-manager.branch-worker Opening commit window resource=v1/configmaps/probe-a author=system:admin -git commit created messageKind=event events=1 message="[UPDATE] v1/configmaps/probe-a" -``` - -The create-then-label sequence produced **no distinct `[CREATE]`** — the create -moment was not emitted as its own commit. - -### 1.3 Failure 2 — a CREATE was absorbed into the unattributed baseline - -The spec impersonates an OIDC user carrying `user.extra` claims -(`display-name: "Simon Koudijs"`, `email: something@configbutler.ai`), creates a -ConfigMap, and expects the commit author to be that identity. It timed out after -180s; the commit author was the **default committer**: - -```text -Expected : GitOps Reverser -to equal : Simon Koudijs -``` - -The controller log for the test namespace `1782476630-test-commit-author` shows the -ConfigMap landing inside the initial watch replay and being committed as a baseline -resync, not as a live per-event commit: - -```text -12:27:45 watch-first target watch set reconciled watchCount=1 -12:27:46 target watch replay complete gvr=/v1,configmaps count=2 resourceVersion=3899 -12:27:46 Handling resync request resources=2 revision=3899 -12:27:46 First commit written to local repository commits=1 -12:27:46 Resync request applied committed=true created=2 updated=0 deleted=0 -``` - -The impersonated create was logged at `12:27:46.002` — the same second the replay -snapshot (`count=2`, rv `3899`) was taken. The baseline resync ships with the -GitProvider's committer identity and never consults the attribution index -([attribution_index.go:223 `LookupAuthor`](../../../internal/queue/attribution_index.go#L223)), -so the OIDC identity could not reach the commit. No subsequent per-event -`[CREATE] .../commit-author-oidc-cm…` commit exists. - -### 1.4 The transport mechanism, reproduced deterministically - -The product's watch-first replay -([target_watch.go:259-264](../../../internal/watch/target_watch.go#L259-L264)) -opens a watch with: - -```go -SendInitialEvents: ptr.To(true), -ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan, -AllowWatchBookmarks: true, -``` - -It buffers every event **before** the `k8s.io/initial-events-end` BOOKMARK into a -baseline replay and applies it as one resync; only events **after** the bookmark -stream as attributable per-event commits. The boundary lives entirely in -`internal/watch/target_watch.go`: `handleTargetWatchSessionEvent` -([target_watch.go:370](../../../internal/watch/target_watch.go#L370)) dispatches on a -`replaying` flag — while replaying, `foldTargetReplayEvent` -([target_watch.go:401-437](../../../internal/watch/target_watch.go#L401-L437)) folds -`ADDED`/`MODIFIED` into the baseline slice until the `initial-events-end` bookmark -(`metav1.InitialEventsAnnotationKey`), at which point it flips to live and the resync -is enqueued; thereafter `routeLiveTargetWatchEvent` -([target_watch.go:533](../../../internal/watch/target_watch.go#L533)) emits per-event -commits and calls `attachAuthor` → `AuthorResolver.ResolveAuthor` -([author_resolver.go](../../../internal/watch/author_resolver.go)) for attribution. -The baseline resync path has no `attachAuthor` call, which is why a create folded -into it carries the committer identity, never the audit author. - -(The "streaming-list watch" comment in -[materializer.go](../../../internal/typeset/materializer.go) describes the *checkpoint* -revision model and is explicitly a *planned, not-yet-built* optimisation — see its -header, Gap 5 — so it is not the owner of this runtime boundary.) - -A probe using that exact transport against the live e2e cluster, contrasting an -identical create-then-modify performed before vs. after the watch opens: - -| Timing | Events the watch delivered | -|---|---| -| writes **before** the watch opens | a single `ADDED` at the **post-modify** rv (3952), *before* `initial-events-end` — no CREATE, no MODIFIED; the create's rv (3949) is invisible | -| writes **after** `initial-events-end` | two events: `ADDED` (3953) then `MODIFIED` (3954) — a distinct, attributable CREATE | - -A `SendInitialEvents` replay collapses an object's whole pre-watch history into a -single synthetic `ADDED` carrying its latest resourceVersion. There is no signal -distinguishing "just created" from "long-existing and modified". - -### 1.5 Regression assets added - -- A mutationlab `replay` watch-probe mode - ([watch_probe.go](../../../internal/mutationlab/recorder/watch_probe.go)) that - captures the full replay window (every initial `ADDED` + the terminating - `initial-events-end` BOOKMARK) using the product's transport. -- Driver scenario `TestWatchReplayCollapsesCreateThenModify` - ([watch_transport_test.go](../../../test/mutationlab/e2e/watch_transport_test.go)) - → corpus `configmap/watch-replay-collapse/`. -- A cluster-free unit test `TestWatchProbe_ReplayKeepsCollapsedAdded` - ([recorder_test.go](../../../internal/mutationlab/recorder/recorder_test.go)). - -## 2. Mechanism (analysis) - -Both failures are one race, against the `initial-events-end` watermark: - -- The product treats the watermark as the boundary between **baseline** (everything - in the initial-events replay: applied as an unattributed mark-and-sweep resync) - and **live tail** (everything after: per-event, attributed via the audit index). -- An object whose creation is observed by the replay — because the watch opened at - or after the create's resourceVersion — is delivered as a single collapsed - `ADDED` in the baseline. It therefore (a) never appears as a per-event `[CREATE]` - (Failure 1) and (b) is committed under the committer identity rather than the - audit-attributed author (Failure 2). -- Win the race — create *after* the watch is live and past the bookmark — and the - same object is a distinct, attributable per-event CREATE. Which spec loses the - race on a given run is timing-dependent, which is exactly the observed flake - signature (different spec red each run). - -This is a faithful consequence of the watch-first design, not a defect in the -replay itself: Kubernetes genuinely does not carry per-object history across a -watch that joins late (see [mutation-capture-lab-design.md](../mutation-capture-lab-design.md) -Findings 1 and 6 — the live-watch caveat). - -## 3. Framing: a timing problem, not a correctness bug in the stream - -The stream does the right thing. Nobody should expect a write issued in the same -instant the watch is being established to be classified as a live, attributed -event — the replay has to draw its baseline somewhere, and a brand-new object that -falls inside that baseline is, by construction, indistinguishable from existing -state. - -The real defect is that **callers act before the stream is demonstrably live**. The -e2e specs create their probe/attributed objects and immediately expect per-event, -attributed commits, but nothing they waited on actually guarantees the watch for -that resource type has crossed `initial-events-end` and is tailing live. The -existing `waitForGitTargetSynced` gate (used by the attribution spec) does not -imply per-type live-tailing past the watermark. - -## 4. Chosen direction - -The fix is an **observable per-type stream-readiness signal, separate from `Ready`**, -that callers wait on before acting when they need live, attributed per-event -behaviour. The full design is in the two companion docs: - -- [per-type-streaming-readiness-plan.md](./per-type-streaming-readiness-plan.md) — - the per-type state model (Replaying / Streaming, plus a Blocked dead-end), where - the state lives, and the e2e conversion for all specs. -- [streaming-readiness-status-machine-design.md](./streaming-readiness-status-machine-design.md) - — the concrete status objects, fields, printer columns, the `StreamsReady` - condition, the Kubernetes-convention naming rationale, and the source-code - simplification it enables. - -The only rationale that needs to live *here* (it is the reason the signal is new -rather than folded into an existing one): **it must be separate from `Ready`.** -Replay for a large watched set can take meaningful time, so gating `Ready` on full -per-type stream readiness would make `Ready` slow and size-dependent and would -conflate "configured and valid" with "caught up and streaming". `Ready` keeps meaning -"admitted and watches established"; stream readiness is a second, finer axis named -`StreamsReady`. - -> Superseded: earlier drafts floated an `Initializing / PartiallyLive / Live` axis -> (from [materialization-tail-and-live-readiness-review.md](../../finished/materialization-tail-and-live-readiness-review.md)). -> The companion docs replace it with two happy-path states (`Replaying` → `Streaming`) -> plus a `Blocked` dead-end, surfaced as a single `StreamsReady` condition. Treat the -> `Initializing / PartiallyLive / Live` phrasing as historical context, not an active -> candidate. - -## 5. Reproduce / regress - -- Live, deterministic: the `replay` mutationlab probe (Section 1.5) — drive a - create-then-modify before the watch, observe the single collapsed `ADDED` inside - the replay window; create after the bookmark, observe `ADDED` + `MODIFIED`. -- Corpus row `configmap/watch-replay-collapse/` defends the Kubernetes-side fact on - version bumps. -- Note: the mutationlab reproduces the **Kubernetes transport determinant**, not the - product's baseline/attribution handling (the lab deliberately does not run the - product ingestion). The product-side fix and its proof belong in `internal/watch` - and the e2e specs that already catch it. diff --git a/docs/design/upgrade-finding.md b/docs/design/upgrade-finding.md deleted file mode 100644 index 62103c9f..00000000 --- a/docs/design/upgrade-finding.md +++ /dev/null @@ -1,157 +0,0 @@ -# gitops-reverser WatchList Bookmark Report - -Date: 2026-05-25 - -## Summary - -`apiservice-audit-proxy` 0.5.0 appears to have addressed the original -transport-level watch-stream problem, but the remaining production warning in -`gitops-reverser` points to a separate client-side watch-list behavior. - -`gitops-reverser` is built with `k8s.io/client-go v0.36.1`. In that version, -the `WatchListClient` feature defaults to enabled. Dynamic informers created by -`gitops-reverser` therefore use Kubernetes streaming-list semantics: - -```text -watch=true -sendInitialEvents=true -allowWatchBookmarks=true -resourceVersionMatch=NotOlderThan -``` - -client-go then waits for a special bookmark event annotated as the end of the -initial events stream. The production warning means that bookmark is not being -received. - -## Production Symptom - -Representative log line: - -```text -Warning: event bookmark expired err="pkg/mod/k8s.io/client-go@v0.36.1/tools/cache/reflector.go:343: hasn't received required bookmark event marking the end of initial events stream, received last event 59.998946102s ago" -``` - -This is not a generic watch timeout. It specifically means client-go is waiting -for the initial-events-end bookmark required by streaming-list mode. - -## Evidence - -`gitops-reverser` creates dynamic shared informer factories for watched -resources: - -- `external-resources/gitops-reverser/internal/watch/manager.go` -- `external-resources/gitops-reverser/internal/watch/manager_catalog.go` - -The relevant call sites are: - -```go -dynamicinformer.NewDynamicSharedInformerFactory(client, 0) -dynamicinformer.NewFilteredDynamicSharedInformerFactory(client, 0, ns, nil) -``` - -and: - -```go -dynamicinformer.NewDynamicSharedInformerFactory(dynamicClient, 0) -``` - -In `client-go v0.36.1`, dynamic informers wrap their list/watcher with -watch-list support: - -```go -cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{...}) -``` - -The reflector enables watch-list mode from the client-go feature gate: - -```go -r.useWatchList = clientfeatures.FeatureGates().Enabled(clientfeatures.WatchListClient) -``` - -`WatchListClient` defaults to true as of the v1.35 client-go feature defaults, -which are present in `v0.36.1`. - -When enabled, the reflector starts the initial stream with: - -```go -metav1.ListOptions{ - ResourceVersion: lastKnownRV, - AllowWatchBookmarks: true, - SendInitialEvents: ptr.To(true), - ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan, - TimeoutSeconds: &timeoutSeconds, -} -``` - -It only considers the initial stream complete when it receives a bookmark with: - -```go -meta.GetAnnotations()[metav1.InitialEventsAnnotationKey] == "true" -``` - -The repeated production warning is emitted by client-go while waiting for that -bookmark. - -## Interpretation - -The proxy can pass watch events through, but it does not and should not -synthesize Kubernetes streaming-list bookmarks. The initial-events-end bookmark -must be produced by the Kubernetes API server or aggregated backend serving the -watched resource. - -So the remaining failure is most likely: - -1. `gitops-reverser` accidentally opted into streaming-list mode through the - client-go upgrade. -2. One or more watched API paths, especially aggregated APIs, do not produce - the required initial-events-end bookmark. -3. client-go keeps the reflector in its initial watch-list phase and logs the - missing-bookmark warning every 10 seconds. - -The design documents in `gitops-reverser` discuss future use of -`sendInitialEvents=true`, but the current implementation uses ordinary dynamic -informers. That makes this behavior an implicit dependency-default change, -rather than a fully implemented and tested watch-list design. - -## Immediate Workaround - -Disable the client-go `WatchListClient` feature in the `gitops-reverser` pod: - -```yaml -env: - - name: KUBE_FEATURE_WatchListClient - value: "false" -``` - -The Helm chart already exposes `.Values.env`, so this can be applied as a values -override. - -Example values fragment: - -```yaml -env: - - name: KUBE_FEATURE_WatchListClient - value: "false" -``` - -After rollout, the dynamic informers should return to the older LIST-then-WATCH -behavior and stop requiring the initial-events-end bookmark. - -## Recommended Follow-Up - -For `gitops-reverser`, make the choice explicit instead of relying on the -client-go default: - -- Disable `WatchListClient` by default in the manager process, or document and - set the environment override in the chart defaults. -- Add a regression test or e2e lane that watches resources through the - aggregated API path and confirms informer sync completes. -- Revisit streaming-list support later as an intentional feature, with explicit - tests for `sendInitialEvents=true`, `allowWatchBookmarks=true`, and the - `k8s.io/initial-events-end` bookmark. - -For `apiservice-audit-proxy`, the existing watch-stream work remains useful: -the proxy still must keep watch responses open, flush promptly, avoid audit -body spooling for watches, and avoid imposing write deadlines. This report is -about a different layer: client-go reflector semantics in the downstream -consumer. diff --git a/docs/design/voter-gitops-demo-instances.md b/docs/design/voter-gitops-demo-instances.md deleted file mode 100644 index 39a80dfa..00000000 --- a/docs/design/voter-gitops-demo-instances.md +++ /dev/null @@ -1,268 +0,0 @@ -# Voter GitOps Demo Instances - -## Goal - -Run two voter applications next to each other for the demo: - -- `demo.configbutler.ai` -- `demo-test.configbutler.ai` - -Each instance should be independently routable and should not fight over namespaces, RBAC, Traefik objects, generated -session secrets, sample resources, or Flux reconciliation ownership. - -The immediate goal was to get both applications live under the Cloudflare routes first. That is now the local target -state for this branch. The next demo layer is CoffeeConfig promotion: edit config in the test app, let GitOps Reverser -commit it to a test branch, then promote it to production by merging that branch into `main`. - -The old checked-in `test/e2e/setup/demo-only/vote` app can be removed in this branch if doing so simplifies the demo. -For now, the local demo manifests keep enough of it around for the existing demo harness and avoid routing traffic to it. - -The original upstream manifests are available in this workspace at `external-sources/voter/k8s`. The local demo manifests -can copy from that directory when we need to move fast, and then upstream can be cleaned up into a reusable packaging -story later. - -## Current State - -`test/e2e/setup/demo-only/voter-gitops` currently creates local, repo-owned voter app instances: - -- namespace `voter-production` -- namespace `voter-test` -- app resources copied from `external-sources/voter/k8s` -- local Traefik routes for `demo.configbutler.ai` pointing at `voter-production` -- local Traefik routes for `demo-test.configbutler.ai` pointing at `voter-test` - -This is intentionally branch-local and pragmatic. It gets the demo live before we solve the cleaner upstream packaging -work. The time pressure matters here: keeping the manifests local is more cumbersome than ideal, but it gives us direct -control over namespaces, RBAC, ingress, and promotion wiring while the demo is being prepared. - -The upstream `external-sources/voter/k8s` manifests are hardcoded for one installation: - -- namespace `voter` -- service names `voter-frontend` and `auth-service` -- service accounts `auth-service` and `quiz-access` -- `FORWARD_SA_NAMESPACE=voter` -- `COFFEE_CONFIG_NAME=testnet-coffee` -- example objects in namespace `voter` -- Traefik hosts `voter.z65.nl` and `coffee.z65.nl` -- cluster-scoped `ClusterRole/auth-service` -- cluster-scoped `ClusterRoleBinding/auth-service` - -The last two are the immediate bug. They collide with the old checked-in `vote` app, which also creates -`ClusterRole/auth-service` and `ClusterRoleBinding/auth-service`. The live failure: - -```text -User "system:serviceaccount:voter:auth-service" cannot get resource "coffeeconfigs" -``` - -happened because the shared `ClusterRoleBinding/auth-service` was bound to `system:serviceaccount:vote:auth-service` -instead of `system:serviceaccount:voter:auth-service`. - -## Demo Harness Coupling - -The e2e demo test is still coupled to the old `vote` app. It pins `TESTNAMESPACE=vote` and expects the reverse-GitOps -repository to contain files such as: - -- `v1/namespaces/vote.yaml` -- `apps/v1/deployments/vote/vote-frontend.yaml` -- `v1/services/vote/vote-frontend.yaml` -- `traefik.io/v1alpha1/ingressroutes/vote/frontend-static.yaml` - -So removing `test/e2e/setup/demo-only/vote` is possible, but the demo test should either be retargeted to the new voter -namespace or changed to verify generic demo repository activity instead of legacy `vote-frontend` files. - -## Recommended Fast Path - -For time pressure, use branch-local manifests in this repo for the two demo instances, and keep upstream changes small. - -Suggested layout: - -```text -test/e2e/setup/demo-only/voter-gitops/ - base/ - kustomization.yaml - app.yaml - auth-service-rbac.yaml - quiz-rbac.yaml - examples/ - crds/ - coffeeconfigs.yaml - production/ - kustomization.yaml - namespace.yaml - ingress-*.yaml - test/ - kustomization.yaml - namespace.yaml - ingress-*.yaml -``` - -Use two namespaces: - -- `voter-production` -- `voter-test` - -Use local Kustomize overlays for the immediate demo. GitOps Reverser and Flux-based promotion can come after this is -stable. - -This path is a little cumbersome, but it keeps the demo unblocked and keeps the routing manifests obvious. It also avoids -waiting on a polished upstream packaging story before the demo is usable. - -## CoffeeConfig Promotion Demo - -The demo is specifically about promoting application config, not the whole application. For now, narrow GitOps Reverser -to `CoffeeConfig` only. - -The expected flow is: - -1. `demo-test.configbutler.ai` runs in namespace `voter-test`. -2. The test app uses `CoffeeConfig/testnet-coffee` as live data. -3. A `WatchRule` in `voter-test` watches only `coffeeconfigs.examples.configbutler.ai`. -4. A `GitTarget` writes those changes to branch `demo-test` in the local Gitea demo repository. -5. A `GitProvider` allows pushes to `demo-test` and reads from `main`. -6. Flux in `voter-test` follows branch `demo-test` so Git changes are picked up directly by the test app. -7. Later, `demo-test` is merged to `main` by PR in the local Gitea demo repository. -8. Flux in `voter-production` follows branch `main` and applies the same generated CoffeeConfig path to - namespace `voter-production`. - -The generated resource is expected to be committed with the test namespace, because it is captured from `voter-test`. -Production must therefore use Flux `Kustomization.spec.targetNamespace: voter-production`, matching the existing -`podinfos-production` idea: intent can come from one namespace-shaped path, while the target environment overrides where -it is applied. - -One API limitation is worth calling out: `WatchRule` filters by resource type, not object name. For this demo it can -watch only `CoffeeConfig` resources in the `voter-test` namespace, but it cannot currently express "only -`CoffeeConfig/testnet-coffee`" without an upstream GitOps Reverser feature. - -The branch-local implementation uses: - -| Concern | Value | -|---|---| -| Test namespace | `voter-test` | -| Production namespace | `voter-production` | -| GitProvider | `voter-test/demo-coffeeconfig` | -| GitTarget | `voter-test/demo-coffeeconfig` | -| GitTarget branch | `demo-test` | -| GitTarget path | `voter-coffee` | -| Watched resource | `examples.configbutler.ai/v1alpha1`, resource `coffeeconfigs` | -| Test Flux source | `voter-test/demo-coffeeconfig`, branch `demo-test` | -| Production Flux source | `voter-production/demo-coffeeconfig`, branch `main` | -| Flux apply path | `/voter-coffee/examples.configbutler.ai/v1alpha1/coffeeconfigs/voter-test/` | - -The Cloudflare side only needs both published applications pointing to Traefik: - -- `demo.configbutler.ai` -> `http://traefik.traefik-system.svc.cluster.local:80` -- `demo-test.configbutler.ai` -> `http://traefik.traefik-system.svc.cluster.local:80` - -With those in place, the in-cluster Traefik `IngressRoute` host matches decide whether traffic goes to -`voter-production` or `voter-test`. - -## Required Local Changes For Two Instances - -For each instance, make these values unique: - -| Concern | `demo.configbutler.ai` | `demo-test.configbutler.ai` | -|---|---|---| -| Namespace | `voter-production` | `voter-test` | -| Local overlay | `production` | `test` | -| Traefik host | `demo.configbutler.ai` | `demo-test.configbutler.ai` | -| Auth service account subject | `voter-production/auth-service` | `voter-test/auth-service` | -| Forward auth URL | `auth-service.voter-production.svc` | `auth-service.voter-test.svc` | -| `FORWARD_SA_NAMESPACE` | `voter-production` | `voter-test` | -| CoffeeConfig name | instance-specific or shared name in each namespace | instance-specific or shared name in each namespace | - -Cluster-scoped names must also be unique if both instances are installed from raw YAML: - -- `ClusterRole/voter-production-auth-service` -- `ClusterRoleBinding/voter-production-auth-service` -- `ClusterRole/voter-test-auth-service` -- `ClusterRoleBinding/voter-test-auth-service` -- `ServersTransport/voter-production/voter-production-kube-apiserver-transport` -- `ServersTransport/voter-test/voter-test-kube-apiserver-transport` - -The CRDs should not be duplicated per instance. Install them once as shared demo infrastructure: - -- `coffeeconfigs.examples.configbutler.ai` -- `quizsessions.examples.configbutler.ai` -- `quizsubmissions.examples.configbutler.ai` - -## Upstream Changes Needed - -Upstream should become instanceable. The important changes are: - -1. Split CRDs from app installation. - - Put CRDs in a separate path such as `k8s/crds`, and app resources in a path such as `k8s/app` or - `k8s/overlays/default`. Flux can install CRDs once, then create multiple app instances. - -2. Remove hardcoded namespace assumptions. - - Upstream should support namespace selection through Kustomize overlays, Helm values, or substitutions. The current - fixed `metadata.namespace: voter` appears in deployments, services, RBAC, example objects, and Traefik resources. - -3. Rename cluster-scoped RBAC. - - Never use generic cluster-scoped names like `auth-service` in reusable manifests. Use a release/instance-specific - name, for example `voter-auth-service`, or template it as `${name}-auth-service`. - -4. Make ClusterRoleBinding subjects configurable. - - The subject namespace must match the instance namespace. This is the direct cause of the CoffeeConfig permission - failure. - -5. Make ingress hosts configurable or optional. - - Upstream should not force `voter.z65.nl` or `coffee.z65.nl`. Either move ingress to overlays or expose host values. - -6. Make auth-service configuration configurable. - - These should be values, not hardcoded demo constants: - - - `FORWARD_SA_NAMESPACE` - - `COFFEE_CONFIG_NAME` - - `ADMIN_PASSWORD` - - `COOKIE_SECURE` - - image pull secret name - -7. Consider unique cookie/session settings per host. - - If both apps share a parent domain, confirm cookie names and domains do not conflict. Host-only cookies are usually - fine, but explicit cookie domain settings would need care. - -## Should We Vendor All Kubernetes Resources Here? - -Short term: yes, if the demo date is close. - -Keeping the full Kubernetes resources in this repo, or adding local Flux patches around the upstream repo, is the fastest -way to get two working instances. It gives us complete control over hostnames, RBAC names, namespaces, and cleanup. - -Long term: no. - -Copying all resources here means the demo fork becomes its own packaging layer. Every upstream app change then has to be -copied or re-patched here, which is exactly the cumbersome feeling. The durable solution is upstream packaging that accepts -instance values. - -## Practical Plan - -1. Fix the live single-instance bug immediately. - - Rename or patch the voter RBAC so `system:serviceaccount:voter:auth-service` can read CoffeeConfig. - -2. Remove the old `vote` app from demo-only setup if the new voter app is now the real demo UI. - - Keep only what the reverse-GitOps demo test still needs, or update that test so it no longer expects - `vote-frontend` and old Traefik files. - -3. Add a second local voter instance. - - Create `voter-production` and `voter-test` overlays with separate hosts and unique cluster-scoped names. - -4. Once the demo is stable, upstream the reusable packaging changes. - - The upstream target should be either Kustomize components/overlays or a Helm chart. For this use case, a small Helm - chart may be less awkward than many JSON patches because it naturally handles names, namespaces, hosts, image tags, - and environment values. - -## Decision - -Use local demo manifests to get two instances running quickly, but treat that as a bridge. Upstream should be changed so -`voter` can be installed multiple times by Flux without copying or deeply patching raw Kubernetes YAML. diff --git a/docs/design/watch-and-catalog-architecture.md b/docs/design/watch-and-catalog-architecture.md index 81c06280..3ec4919e 100644 --- a/docs/design/watch-and-catalog-architecture.md +++ b/docs/design/watch-and-catalog-architecture.md @@ -1,9 +1,9 @@ # Watch & Catalog Architecture — Requirements, Current State, Target Design Status: **vision / proposed** — supersedes the framing in -[watchrule-wildcard-support-plan.md](../future/watchrule-wildcard-support-plan.md), -[watchrule-wildcard-and-resolution-semantics.md](watchrule-wildcard-and-resolution-semantics.md), -and [rule-set-snapshot-discovery-lag-fix.md](../finished/rule-set-snapshot-discovery-lag-fix.md); +[watchrule-wildcard-support-plan.md](../spec/type-followability.md), +[watchrule-wildcard-and-resolution-semantics.md](../spec/type-followability.md), +and [rule-set-snapshot-discovery-lag-fix.md](../spec/typeset-owns-discovery-grace.md); those become implementation details of the model described here. This document is in three parts: @@ -182,7 +182,7 @@ Beyond the four beliefs above, a complete design needs: excluded kinds back in. - **Sensitive resources.** Wildcards will select Secrets and similar. This must compose with the existing sensitive-resource classification work - ([sensitive-resource-classification-plan.md](sensitive-resource-classification-plan.md)). + ([sensitive-resource-classification-plan.md](../finished/sensitive-resource-classification-plan.md)). - **Migration / backward compatibility.** Changing selector semantics changes what *existing* rules watch. Required: no silent expansion of an existing user's scope on upgrade — a migration story or explicit opt-in. @@ -198,12 +198,12 @@ Beyond the four beliefs above, a complete design needs: - **`APIResourceCatalog`** ([api_resource_catalog.go](../../internal/watch/api_resource_catalog.go)) — since the typeset-grace relocation - ([typeset-owns-discovery-grace.md](../typeset-owns-discovery-grace.md)): a thin + ([typeset-owns-discovery-grace.md](../spec/typeset-owns-discovery-grace.md)): a thin per-scan normalizer producing a `typeset.Scan` (entries + scanned/failed group/versions + completeness) with only mechanical state (last scan as the change fingerprint, `generation`, readiness). Degraded-GV retention and the removal grace for omitted GVs both live in `typeset.Registry.UpdateFromScan`. -- **`RuleGVRResolver`** ([rule_gvr_resolver.go](../../internal/watch/rule_gvr_resolver.go)) +- **`RuleGVRResolver`** (rule_gvr_resolver.go) — maps one rule selector to concrete GVRs via the catalog, returning `ResolveMiss` values classified by reason. **Refuses wildcards** in `preflightMisses`. @@ -253,7 +253,7 @@ ReconcileForRuleChange (manager.go:740) (`currentRuleSetSnapshots`, manager.go:1248/1264) and the snapshot path (manager.go:559-594) both resolve rules independently — duplicated logic that has already drifted (the bug that birthed - [watchrule-gvr-resolution-plan.md](../finished/watchrule-gvr-resolution-plan.md)). + [watchrule-gvr-resolution-plan.md](../spec/type-followability.md)). 2. **Snapshots are whole-target, not per-cell.** Adding one GVR re-lists and re-diffs the *entire* target (`emitSnapshotForRuleChange` → `RequestClusterState` over all GVRs). Violates requirement 1.3. diff --git a/docs/design/watch-audit-rule-matching-improvement.md b/docs/design/watch-audit-rule-matching-improvement.md deleted file mode 100644 index 68dcc4b2..00000000 --- a/docs/design/watch-audit-rule-matching-improvement.md +++ /dev/null @@ -1,687 +0,0 @@ -# Watch And Audit Rule Matching Improvement Note - -## Purpose - -This note captures two reproduced bugs and turns them into an implementation-ready guide: - -- namespaced `WatchRule`s can route events for objects from other namespaces -- operator restart does not rebuild the in-memory `RuleStore` from existing `WatchRule` and - `ClusterWatchRule` CRs before startup reconcile - -This document is intentionally written so a human or an LLM can use it to: - -1. understand the current architecture -2. see where the abstractions drifted away from intent -3. implement a safe fix without accidentally removing future capabilities -4. strengthen e2e assertions so this class of bug is caught earlier next time - -## Executive Summary - -The current system has two separate source adapters for live-ish information: - -- watch/informer ingestion -- audit-stream ingestion - -Both of them eventually rely on the same `RuleStore` matcher contract, but that matcher is only a partial -match for namespaced `WatchRule`s. Namespace is stored on the compiled rule, yet namespace is not part of -the `GetMatchingRules` contract. - -That mismatch stayed partially hidden while informer scoping did some of the filtering implicitly. After the -audit webhook became authoritative for live events, the hidden assumption became much easier to violate, -because audit events naturally arrive from all namespaces. - -Separately, startup reconcile depends on the same in-memory rule cache, but there is no explicit cache warm-up -step before `watch.Manager.Start()` performs its initial reconcile. - -## Status Update - -### 2026-04-17 - -The minimal-fix implementation described later in this note has now landed. - -Implemented: - -- namespaced `WatchRule` matching is now namespace-aware in `RuleStore.GetMatchingRules` - - [store.go](/workspaces/gitops-reverser/internal/rulestore/store.go:244) -- both live routing paths now pass namespace context into the matcher - - watch/informer path: informers.go - - audit consumer path: [redis_audit_consumer.go](/workspaces/gitops-reverser/internal/queue/redis_audit_consumer.go:317) -- watch-manager startup now bootstraps the in-memory `RuleStore` from existing `WatchRule` and - `ClusterWatchRule` objects before initial reconcile - - [bootstrap.go](/workspaces/gitops-reverser/internal/watch/bootstrap.go:31) - - [manager.go](/workspaces/gitops-reverser/internal/watch/manager.go:99) -- the previously skipped `RuleStore` namespace-contract tests were un-skipped and updated to enforce the new behavior - - [store_test.go](/workspaces/gitops-reverser/internal/rulestore/store_test.go:837) - -Additional hardening discovered during validation: - -- startup could fail if the audit consumer tried to initialize its Redis consumer group before Redis DNS/service - readiness settled, which temporarily left the webhook service without endpoints during e2e startup -- `AuditConsumer.Start()` now retries consumer-group initialization instead of crashing the manager process - - [redis_audit_consumer.go](/workspaces/gitops-reverser/internal/queue/redis_audit_consumer.go:153) - -Validation completed after the implementation: - -- targeted red tests were first confirmed failing, then re-run green after the fix -- `task fmt` -- `task vet` -- `task lint` -- `task test` -- `docker info` -- `task test-e2e` - -Current status against this note: - -- the two reproduced correctness bugs in this note are fixed -- the startup timing issue for audit-consumer Redis initialization is also fixed -- the larger architectural follow-up remains open: - - separate planner-vs-matcher semantics more explicitly - - introduce a first-class full event-match input if we want the cleaner long-term API - - strengthen e2e assertions around exact touched-path sets and cross-namespace negative assertions - -Note: - -- the red/green inventory below is preserved as the original analysis and implementation guide -- where it says "red" or "skipped", read that as historical context rather than current status - -## Graphic - -```mermaid -flowchart TD - A1[Watch / Informer Source Adapter] --> B[Event Router Inputs] - A2[Audit Stream Source Adapter] --> B - A3[Startup Reconcile] --> C[GVR Planner] - - B --> D[RuleStore.GetMatchingRules] - C --> E[RuleStore Snapshot] - - D --> F[GitTarget Event Stream] - E --> G[Informer / Snapshot Setup] - - subgraph Current Problem - D1[Partial Match Only\nGVR + op + scope\nno namespace in contract] - D2[Caller-specific filtering] - end - - D --> D1 - D1 --> D2 - - subgraph Target Shape - T1[Source Adapter] - T2[Event Matcher\nfull event context] - T3[GVR Planner\nplanning only] - T4[RuleStore Bootstrapper] - end -``` - -## Named Abstractions - -These names are recommended so the implementation and future design discussion stay precise. - -### Existing abstractions - -- `RuleStore` - - current role: compiled cache of `WatchRule` and `ClusterWatchRule` -- watch source adapter - - current implementation: informer path in `internal/watch/informers.go` -- audit source adapter - - current implementation: audit consumer path in `internal/queue/redis_audit_consumer.go` -- GVR planner - - current implementation: `ComputeRequestedGVRs`, `getNamespacesForGVR`, and related watch-manager planning code -- event router - - current implementation: `EventRouter` plus `GitTargetEventStream` - -### Missing or under-specified abstractions - -- event matcher - - desired role: perform a full rule match for one concrete event -- rule-store bootstrapper - - desired role: load and compile existing rules before startup reconcile -- source envelope - - desired role: represent the source and fidelity of an event without coupling source-specific logic into routing - -## Red/Green Test Inventory - -All tests below are written to assert the **desired** behavior. Tests that expose bugs fail today (red) and will -turn green when the fix lands. Guard-rail tests already pass (green) and protect against over-correction. - -### 1. Cross-namespace routing for namespaced `WatchRule` - -#### Bug tests (red — fail today) - -| Test | File | Asserts | -|---|---|---| -| `TestHandleEvent_NamespacedWatchRuleMustNotRouteForeignNamespaceObject` | informers_test.go | watch path must NOT route a `Service` from `gitops-reverser` via a `WatchRule` in `tilt-playground` | -| `TestProcessMessage_NamespacedWatchRuleMustNotRouteForeignNamespaceAuditEvent` | [redis_audit_consumer_test.go](/workspaces/gitops-reverser/internal/queue/redis_audit_consumer_test.go) | audit path must NOT route a `Service` from `gitops-reverser` via a `WatchRule` in `tilt-playground` | -| `TestHandleEvent_MixedRules_OnlyClusterWatchRuleMatchesForeignNamespace` | informers_test.go | event from `ns-b`: `WatchRule` in `ns-a` must NOT match, `ClusterWatchRule` MUST match | -| `TestProcessMessage_MixedRules_OnlyClusterWatchRuleMatchesForeignNamespace` | [redis_audit_consumer_test.go](/workspaces/gitops-reverser/internal/queue/redis_audit_consumer_test.go) | same as above via audit path | - -#### Guard-rail tests (green — pass today, protect against over-correction) - -| Test | File | Asserts | -|---|---|---| -| `TestHandleEvent_NamespacedWatchRuleRoutesOwnNamespaceObject` | informers_test.go | watch path MUST route a `Service` from the same namespace as the `WatchRule` | -| `TestProcessMessage_NamespacedWatchRuleRoutesOwnNamespaceAuditEvent` | [redis_audit_consumer_test.go](/workspaces/gitops-reverser/internal/queue/redis_audit_consumer_test.go) | audit path MUST route a `Service` from the same namespace as the `WatchRule` | - -#### RuleStore contract tests (skipped — waiting for API change) - -| Test | File | Asserts | -|---|---|---| -| `TestGetMatchingRules_MustFilterByNamespaceForNamespacedWatchRule` | [store_test.go](/workspaces/gitops-reverser/internal/rulestore/store_test.go) | documents the desired namespace filtering contract; skipped until matcher API accepts namespace | -| `TestGetMatchingRules_NamespacedWatchRule_NamespaceContract` | [store_test.go](/workspaces/gitops-reverser/internal/rulestore/store_test.go) | three sub-tests for same-ns/foreign-ns/cluster-rule; skipped until API change, then un-skip | - -#### Root cause - -- `RuleStore.GetMatchingRules` matches by `{resourcePlural, operation, apiGroup, apiVersion, scope}` and explicitly - leaves namespace filtering to callers - - [store.go](/workspaces/gitops-reverser/internal/rulestore/store.go:242) -- the live watch path does not perform a namespace check after calling `GetMatchingRules` - - informers.go -- the audit consumer also does not perform a namespace check after calling `GetMatchingRules` - - [redis_audit_consumer.go](/workspaces/gitops-reverser/internal/queue/redis_audit_consumer.go:303) - -This means the rule-store API is currently under-specified for namespaced rules. The source namespace is stored on the -compiled rule, but it is not part of the matcher contract. - -### 2. Restart does not warm the in-memory rule cache - -#### Bug tests (red — fail today) - -| Test | File | Asserts | -|---|---|---| -| `TestManagerStart_MustSeedRuleStoreFromExistingWatchRules` | [manager_startup_test.go](/workspaces/gitops-reverser/internal/watch/manager_startup_test.go) | `SnapshotWatchRules()` and `ComputeRequestedGVRs()` must be non-empty after `Start()` | -| `TestManagerStart_MustSeedRuleStoreFromExistingClusterWatchRules` | [manager_startup_test.go](/workspaces/gitops-reverser/internal/watch/manager_startup_test.go) | `SnapshotClusterWatchRules()` and `ComputeRequestedGVRs()` must be non-empty after `Start()` | - -Observed behavior: - -- `watch.Manager.Start()` performs an initial reconcile -- that reconcile reads requested GVRs from `RuleStore` -- on a fresh process start, `RuleStore` is empty until controllers reconcile `WatchRule` / `ClusterWatchRule` -- there is no startup bootstrap step that loads existing CRs into the store first - -Relevant code: - -- startup reconcile in [manager.go](/workspaces/gitops-reverser/internal/watch/manager.go:97) -- requested GVR computation reads only `RuleStore` in [gvr.go](/workspaces/gitops-reverser/internal/watch/gvr.go:37) -- controller reconciliation is what currently populates the store: - - [watchrule_controller.go](/workspaces/gitops-reverser/internal/controller/watchrule_controller.go:194) - - [clusterwatchrule_controller.go](/workspaces/gitops-reverser/internal/controller/clusterwatchrule_controller.go:171) - -This makes startup behavior implicitly dependent on controller replay timing instead of making cache warm-up an explicit -part of watch-manager startup. - -## Why This Became Easier To Miss After Audit Became Authoritative - -The audit decision record is still directionally correct: - -- [audit-ingestion-decision-record.md](/workspaces/gitops-reverser/docs/design/audit-ingestion-decision-record.md) - -Audit should remain the authoritative live source when the product wants correct user attribution for mutating API -operations. - -The problem is not the decision itself. The problem is that the routing contract underneath both sources is incomplete. - -The important architectural shift was: - -- live routing is now split across two source adapters - - informer path for snapshot/reconcile support and optional live fallback - - audit stream for authoritative live mutations -- both adapters still depend on the same rule matching contract - -That means an under-specified matcher that was once partially masked by informer scoping now leaks into the -cluster-wide audit path immediately. - -In short: - -- watch did not guarantee correctness; it sometimes masked incompleteness -- audit did not create the bug; it made the bug much easier to observe - -## Future Direction: Watch Must Remain A Useful Source Of Information - -Watch should not be treated as a mistake or as something to phase out entirely. - -The future system should still allow watch-derived information to be valuable in at least four ways: - -1. snapshot and reconcile -2. discovery and rule planning -3. reduced-fidelity mode when audit is unavailable -4. corroboration and repair signals even when audit is authoritative - -### Desired semantic split - -- audit path - - authoritative for live mutating-user attribution - - best source for "who changed what" -- watch path - - authoritative for cluster state discovery and resync - - valid source of information about resulting object state - - optionally a live source in reduced-fidelity mode - -### Important nuance - -The future should not frame watch as "not a real source." - -Instead: - -- watch is a real source of state information -- audit is the higher-fidelity source for mutating user attribution - -That distinction matters because a future product mode may intentionally support: - -- `audit + watch` -- `watch only` -- or `audit live authority + watch repair` - -The fix should preserve that flexibility rather than baking in source-specific routing rules everywhere. - -## Abstractions That Are No Longer Pulling Their Weight - -### 1. `RuleStore.GetMatchingRules` is not a complete namespaced-rule matcher - -Current reality: - -- it returns namespaced `WatchRule` matches without considering object namespace -- callers must remember to filter `rule.Source.Namespace` themselves - -Problem: - -- the API shape suggests "matching" is complete, but it is only partial -- each caller has to remember extra semantics that are not represented in the function signature - -Desired direction: - -- make the matcher take the full event context, including namespace -- or rename/split the API so it is obvious that this is only GVR+operation prefiltering - -### 2. Event planning and event routing use the same rule cache, but not the same semantics - -There are really two different jobs here: - -- planning which GVRs need watchers or snapshots -- deciding whether one concrete object event should route to one concrete target - -Those jobs need different inputs: - -- planning can work at GVR granularity -- routing must work at full object-event granularity, including namespace and eventually cluster identity - -Desired direction: - -- keep a GVR planning layer for watcher/snapshot setup -- add a distinct event matcher for concrete object events - -### 3. Startup cache warm-up is implicit instead of owned - -Current reality: - -- controllers populate `RuleStore` -- watch manager assumes `RuleStore` is already warm when startup reconcile runs - -Problem: - -- process startup becomes timing-sensitive -- restart behavior depends on controller replay rather than on an explicit bootstrap contract - -Desired direction: - -- one component should own initial rule-store warm-up from the API server before startup reconcile -- this can live in watch manager startup or in a dedicated rule-store bootstrapper - -### 4. Source identity is only partially modeled - -The audit path already carries `clusterID`: - -- [redis_audit_consumer.go](/workspaces/gitops-reverser/internal/queue/redis_audit_consumer.go:309) - -The watch path does not, because it is implicitly local-cluster. - -That split is fine, but the routing model should still be explicit about the dimensions that define a match: - -- source cluster -- resource GVR -- namespace -- object name -- operation -- source fidelity - -Right now namespace is already under-modeled for namespaced `WatchRule`. If multi-cluster audit ingestion grows, -`clusterID` becomes the next dimension that must be first-class in the event matching contract. - -## Proposed Target Architecture - -### 1. Source adapters - -Introduce a clean conceptual split: - -- `WatchEventSourceAdapter` -- `AuditEventSourceAdapter` - -Both of these produce a shared source envelope. - -Example: - -```go -type EventSourceKind string - -const ( - EventSourceWatch EventSourceKind = "watch" - EventSourceAudit EventSourceKind = "audit" -) - -type EventFidelity string - -const ( - EventFidelityAuthoritative EventFidelity = "authoritative" - EventFidelityStateOnly EventFidelity = "state_only" -) - -type SourceEnvelope struct { - Kind EventSourceKind - Fidelity EventFidelity - ClusterID string -} -``` - -### 2. Full event-match input - -Recommended new routing input: - -```go -type RuleMatchInput struct { - Source SourceEnvelope - Group string - Version string - Resource string - Namespace string - Name string - Operation configv1alpha1.OperationType - ClusterScoped bool - NamespaceLabels map[string]string -} -``` - -Both watch and audit should route through this single matcher. - -### 3. Planner separated from matcher - -Suggested split: - -- `ComputeRequestedGVRs()` remains a planner concern -- `MatchEventToRules(input RuleMatchInput)` becomes the routing concern - -This keeps informer setup logic from leaking into concrete event-routing assumptions. - -### 4. Startup bootstrapper - -Add a bootstrap phase before startup reconcile: - -1. list existing `WatchRule` -2. resolve each `GitTarget` and `GitProvider` -3. compile and load them into `RuleStore` -4. list existing `ClusterWatchRule` -5. resolve their references -6. compile and load them into `RuleStore` -7. only then run initial watch-manager reconcile - -## Invariants - -Any fix should preserve these invariants. - -### Namespaced `WatchRule` - -- a namespaced `WatchRule` must only match namespaced objects in the same namespace as the rule -- this must be true regardless of source adapter -- this must be true even if a cluster-wide informer is active for the same GVR - -### `ClusterWatchRule` - -- a cluster-scoped rule may match cluster-scoped resources when `scope=Cluster` -- a cluster-scoped rule may match namespaced resources across namespaces when `scope=Namespaced` -- future namespace selectors should refine this explicitly, not implicitly - -### Startup - -- startup reconcile must operate on a warmed rule cache -- restart behavior must not depend on controller replay timing - -### Future source support - -- watch must remain valid as a source of state information -- audit must remain usable as authoritative live mutation input -- routing correctness must not depend on which source adapter delivered the event - -## Concrete Code Touchpoints - -These are the likely first-pass implementation touchpoints. - -### Routing and matching - -- [internal/rulestore/store.go](/workspaces/gitops-reverser/internal/rulestore/store.go) -- internal/watch/informers.go -- [internal/queue/redis_audit_consumer.go](/workspaces/gitops-reverser/internal/queue/redis_audit_consumer.go) -- [internal/watch/manager.go](/workspaces/gitops-reverser/internal/watch/manager.go) - -### Startup bootstrap - -- [cmd/main.go](/workspaces/gitops-reverser/cmd/main.go) -- [internal/watch/manager.go](/workspaces/gitops-reverser/internal/watch/manager.go) -- [internal/controller/watchrule_controller.go](/workspaces/gitops-reverser/internal/controller/watchrule_controller.go) -- [internal/controller/clusterwatchrule_controller.go](/workspaces/gitops-reverser/internal/controller/clusterwatchrule_controller.go) - -### Tests - -Unit tests (red/green TDD — see "Red/Green Test Inventory" above for full matrix): - -- internal/watch/informers_test.go — 3 new tests (2 red, 1 green guard rail) -- [internal/queue/redis_audit_consumer_test.go](/workspaces/gitops-reverser/internal/queue/redis_audit_consumer_test.go) — 3 new tests (2 red, 1 green guard rail) -- [internal/watch/manager_startup_test.go](/workspaces/gitops-reverser/internal/watch/manager_startup_test.go) — 2 new tests (both red) -- [internal/rulestore/store_test.go](/workspaces/gitops-reverser/internal/rulestore/store_test.go) — 2 new tests (skipped, waiting for API change) - -E2E tests (existing, to be strengthened per the E2E section below): - -- [test/e2e/e2e_test.go](/workspaces/gitops-reverser/test/e2e/e2e_test.go:717) -- [test/e2e/tilt_playground_e2e_test.go](/workspaces/gitops-reverser/test/e2e/tilt_playground_e2e_test.go:55) -- [test/e2e/commit_window_batching_e2e_test.go](/workspaces/gitops-reverser/test/e2e/commit_window_batching_e2e_test.go:54) -- [test/e2e/commit_request_e2e_test.go](/workspaces/gitops-reverser/test/e2e/commit_request_e2e_test.go:54) - -## E2E Evidence From A Real Repo History - -The issue is not just theoretical. During analysis, the current `playground` repo contained commits for resources -outside `tilt-playground`. - -Concrete examples observed in the cloned `playground` repo: - -- `db2825c` created `live-cluster/apps/v1/deployments/gitops-reverser/gitops-reverser.yaml` -- `06480bf` updated that same `gitops-reverser` deployment file -- `170f25b` updated that same `gitops-reverser` deployment file again -- `f52da76` created `live-cluster/v1/services/gitops-reverser/gitops-reverser-webhook.yaml` -- `d7a9844` created `live-cluster/v1/services/gitops-reverser/gitops-reverser-service.yaml` -- `ac94292` created `live-cluster/v1/services/gitops-reverser/gitops-reverser-audit.yaml` -- `e63f371`, `f05e5c4`, and `113fd81` created/updated/deleted - `live-cluster/v1/configmaps/gitops-reverser/audit-test-cm.yaml` - -At the same time, the intended playground content also existed: - -- `live-cluster/v1/configmaps/tilt-playground/playground-sample-config.yaml` -- `live-cluster/v1/secrets/tilt-playground/...` - -This is strong evidence that the e2e suite already exercises enough cluster activity for bleed to happen, but the -assertions are not currently looking for it. - -## Why Existing E2E Assertions Did Not Catch It - -The current e2e tests mostly assert positive expectations: - -- expected file exists -- expected content exists -- latest commit message contains a resource path - -What they usually do **not** assert: - -- no unrelated namespace files changed -- only the expected file changed -- repo path stayed confined to the rule's namespace for namespaced rules -- the playground repo remained free of controller-install namespace objects - -That means a test can pass even if: - -- the expected file was written -- and additional unrelated files were also written in the same repo - -This is exactly the kind of gap that allows cross-namespace bleed to survive in a production-grade test suite. - -## Suggested E2E Assertion Improvements - -### 1. Assert the exact changed file set - -After each action, inspect the latest commit with: - -```bash -git diff-tree --no-commit-id --name-only -r HEAD -``` - -For a namespaced `WatchRule` test, assert: - -- exactly one expected file changed for create/update -- or exactly one expected file was removed for delete -- and no path under another namespace changed in the same commit - -### 2. Add negative namespace assertions - -For namespaced `WatchRule` tests, explicitly assert that the repo path does **not** contain touched files under: - -- `gitops-reverser/` -- `flux-system/` -- `kube-system/` -- any sibling test namespace in the same suite run - -This should be done as part of the repo verification step, not as a separate optional debug check. - -### 3. Add a dedicated playground bleed e2e - -Recommended scenario: - -1. bootstrap `tilt-playground` -2. confirm the playground repo starts clean and namespace-confined -3. create or update resources in `gitops-reverser` -4. create or update resources in one random e2e namespace -5. assert the playground repo did **not** change outside `tilt-playground` - -This is the closest e2e approximation of the real bug. - -### 4. Add a restart recovery e2e - -Recommended scenario: - -1. create `WatchRule` and `ClusterWatchRule` -2. restart the operator deployment -3. wait for operator readiness -4. mutate a watched resource -5. assert the expected repo change occurs without reapplying the rules - -This catches the startup bootstrap bug directly. - -### 5. Add helper assertions instead of repeating ad hoc checks - -Recommended helpers: - -- `assertLatestCommitTouchesOnly(repoDir, []string{...})` -- `assertNoPathsUnderNamespaces(repoDir, []string{...})` -- `assertRepoTreeConfinedToNamespace(repoDir, basePath, namespace)` -- `assertOperatorRestartRebuildsRuleCache(...)` - -This reduces the risk that future tests only assert the happy path again. - -## LLM Implementation Guide - -This section is intentionally precise enough for an LLM-based coding agent. - -### Bug statements - -1. `GetMatchingRules` does not include namespace in the namespaced `WatchRule` match contract. -2. Both watch and audit routing paths rely on that partial matcher. -3. Startup reconcile runs before the in-memory rule cache is explicitly warmed. - -### Required outcomes - -1. Namespaced `WatchRule` routing must be namespace-correct for both watch and audit source adapters. -2. Startup reconcile must see the current rule set after process restart. -3. Future watch-only or mixed-fidelity modes must remain possible. - -### Preferred implementation order - -1. Introduce a full event-match input type. -2. Add a matcher function that performs complete namespaced rule evaluation. -3. Migrate watch routing to the new matcher. -4. Migrate audit routing to the same matcher. -5. Add explicit rule-store bootstrap before startup reconcile. -6. Verify unit tests turn green (the red/green tests are already in place — see "Red/Green Test Inventory"). -7. Un-skip the `RuleStore` contract tests in `store_test.go` once the matcher API accepts namespace. -8. Strengthen e2e assertions with exact touched-path checks. - -### Implementation note: minimal vs. full refactor - -The namespace bug can be fixed at two levels of ambition: - -**Minimal fix** (recommended first step): -- Add `namespace string` to `GetMatchingRules` and filter inside the store by comparing - `rule.Source.Namespace` against the passed namespace for namespaced `WatchRule`s. -- Both callers (watch path and audit path) already have access to the object namespace — just - pass it through. -- This makes all red tests green without introducing new types or restructuring the routing. - -**Full refactor** (recommended follow-up): -- Introduce `RuleMatchInput` and `MatchEventToRules` as described in "Proposed Target Architecture". -- Separate GVR planning from event routing cleanly. -- This is the right long-term shape, but should not block the bug fix. - -The existing red/green tests work with either approach — they test behavior at the caller level, -not the matcher API shape. - -### Do not do - -- do not hard-code audit-specific namespace behavior in only one path -- do not "fix" this only by relying on informer scoping -- do not remove watch as a future valid source of state information -- do not let startup correctness depend on controller replay timing - -### Acceptance criteria - -Unit tests (all must pass — these are the red/green TDD boundary): - -- `TestHandleEvent_NamespacedWatchRuleMustNotRouteForeignNamespaceObject` passes -- `TestHandleEvent_NamespacedWatchRuleRoutesOwnNamespaceObject` still passes (guard rail) -- `TestHandleEvent_MixedRules_OnlyClusterWatchRuleMatchesForeignNamespace` passes -- `TestProcessMessage_NamespacedWatchRuleMustNotRouteForeignNamespaceAuditEvent` passes -- `TestProcessMessage_NamespacedWatchRuleRoutesOwnNamespaceAuditEvent` still passes (guard rail) -- `TestProcessMessage_MixedRules_OnlyClusterWatchRuleMatchesForeignNamespace` passes -- `TestManagerStart_MustSeedRuleStoreFromExistingWatchRules` passes -- `TestManagerStart_MustSeedRuleStoreFromExistingClusterWatchRules` passes -- `TestGetMatchingRules_NamespacedWatchRule_NamespaceContract` sub-tests un-skipped and passing - -E2E (follow-up — defense in depth): - -- e2e tests prove namespaced repos do not absorb unrelated namespace files -- e2e restart scenario proves operator restart recovers without manual rule reapply - -## Concrete Next Steps - -1. Decide whether to: - - keep `RuleStore` as a partial prefilter and add a new event matcher - - or evolve `RuleStore` itself into the full event matcher -2. Add a startup bootstrap path for `RuleStore` before `watch.Manager.Start()` performs its initial reconcile. -3. Tighten e2e repo assertions so they check both presence and absence. -4. Add a dedicated playground bleed e2e and operator-restart recovery e2e. - -## Bottom Line - -These are not isolated bugs. They point to two architectural mismatches: - -- "matching rules for an event" is currently modeled too weakly -- "the watch manager has the current rules at startup" is currently assumed rather than guaranteed - -The audit-webhook shift amplified the problem because audit is inherently cluster-wide input, while the old watch path -could accidentally rely on informer scoping to hide an incomplete matcher contract. - -The fix should improve correctness **without** closing the door on a future where watch remains a valid source of -information, state repair, and reduced-fidelity operation. diff --git a/docs/design/watch-first-merge-readiness.md b/docs/design/watch-first-merge-readiness.md deleted file mode 100644 index dffe99a8..00000000 --- a/docs/design/watch-first-merge-readiness.md +++ /dev/null @@ -1,155 +0,0 @@ -# Watch-first branch — merge readiness & finishing plan - -> Status: ASSESSMENT — 2026-06-28. Scope: the `investigate` branch (watch-first ingestion big-bang) -> against `main`. This is a review-and-checklist document, not a design. The design is -> [watch-first-ingestion-architecture.md](watch-first-ingestion-architecture.md); the e2e gap analysis -> is [e2e-coverage-gaps-and-improvements-plan.md](e2e-coverage-gaps-and-improvements-plan.md). This doc -> consolidates "can we merge, and what's left." - -## 1. What this branch is - -A big-bang rewrite from **audit-first** to **watch-first** ingestion. `WATCH` (with `sendInitialEvents` -replay) becomes the only source of object state; the audit webhook is demoted to an **optional** -attribution lookup. **Redis/Valkey remains required** — it holds each GitTarget's watch resume cursors -(state continuity, so a restart/reconnect re-picks up where it left off), and it underpins HA and the -planned move of the branchworker queue into Redis (to keep working while Git is unreachable). Only -**author attribution** is optional. ~15k lines deleted, ~22k added across 280 files. The diff is -*deletion-forward*: whole subsystems were removed (`internal/gate`, most of `internal/queue/redis_*`, -`internal/watch/{audit_tail,splice_snapshot,materialization phase machine,target_type_watermark,type_objects_mirror}`, -`webhook/audit_joiner.go`). - -The vision shift is real and, in this reviewer's read, a net improvement: - -- **DeleteCollection is solved by construction.** Audit delivered one opaque `deletecollection` event; - watch delivers N independent `DELETED` events, one per object, each handled by the normal delete path. - No special code is needed for state correctness. (Attribution of *who* ran the collection delete is a - separate, optional feature — see §4.) -- **Aggregated APIs, shallow bodies, CRD conversion** — the cases that hurt audit-first — are handled - because watch carries the full persisted object. -- **The "lose a delete" failure mode is closed two ways:** Mode-A exact-RV resume (the delta carries the - deletes) and Mode-B `sendInitialEvents` replay + mark-and-sweep (reconciles deletes missed while no - watch ran). Neither path silently drops a delete. - -## 2. Implementation status (verified against code) - -| Area | Status | Evidence | -|---|---|---| -| Mode-A exact-RV resume (cursor in Redis, resume delta) | ✅ done | `internal/watch/target_watch.go` resume path + `queue/attribution_index.go` `WatchCursorStore` | -| Mode-B `sendInitialEvents` replay + mark-and-sweep | ✅ done | `target_watch.go` replay accumulation → `EnqueueResync` with `ScopeGVR`; sweep in `git/resync_flush.go` | -| Bookmark handling (`initial-events-end`, RV advance) | ✅ done | `target_watch.go` bookmark/`InitialEventsAnnotationKey` handling | -| Sanitize on the hot path | ✅ done | `sanitize.Sanitize` before diff in `target_watch.go` | -| Optional **attribution** (audit off → committer-authored) | ✅ done | `cmd/main.go` `--author-attribution`; nil author-lookup all the way down | -| Redis **required**; resume cursors decoupled from audit | ✅ **done in this pass** — see §5 | `cmd/main.go` builds the index + wires `WatchCursorStore` unconditionally; audit gated by `--author-attribution` | -| Conservative resolver + bounded grace window | ✅ done + tested | `internal/watch/author_resolver.go` (`DefaultAttributionGraceWindow`), `author_resolver_test.go` | -| CommitRequest: fail-closed → finalize-as-committer | ✅ done | `internal/controller/commitrequest_controller.go` | -| Refuse unsupported folder + GitTarget status | ✅ done + e2e | `manifestanalyzer/acceptance*`, `test/e2e/unsupported_folder_e2e_test.go` | -| `.gittargetignore` support | ✅ done + unit tests | `manifestanalyzer/gittargetignore.go`, `git/gittargetignore_writer_test.go` | -| DeleteCollection **attribution** expander + deletion-as-intent | ✅ done + unit + e2e | `RecordDeleteCollectionFacts` in `attribution_index.go`, `operationForLiveTargetWatchEvent` in `target_watch.go`, `exact_deletecollection_item` reason code, `test/e2e/deletecollection_intent_e2e_test.go`. See [deletecollection-attribution-expander.md](deletecollection-attribution-expander.md) | -| No-op suppression *on the watch hot path* | ⚠️ deferred to writer | writer diffs to no-op; design-acknowledged CPU cost, not a correctness gap | - -**No `TODO`/`FIXME`/`panic("unimplemented")` in the core data path.** The only two TODOs are unrelated -GitProvider-readiness notes in the watchrule/clusterwatchrule controllers. - -## 3. Loose ends to close before merge - -> Only **remaining** work is listed here. Items finished during this review — the Redis-required / -> cursor-decoupling change, the dead-code removal, and the doc reconciliation — are recorded in §2 -> (status) and §5 (work done), not repeated as open tasks. - -### Blocking-ish (correctness/trust proof) - -1. **Test A — missed-delete mark-and-sweep e2e (the "heart of the system").** Only the *safe half* - (don't over-delete on restart) is proven (`restart_reconcile_e2e_test.go`). The active half — stop - the operator, delete a watched object, restart, replay-sweep removes the orphaned file — has **no - e2e**. The mechanism is unit-proven (`internal/git/resync_flush_test.go` - `TestResync_DropsManagedResourceAbsentFromCluster`), so this is a proof gap, not a code gap. Sketch is - in [e2e-coverage-gaps §Test A](e2e-coverage-gaps-and-improvements-plan.md). **Highest-value test to - add.** -2. **DeleteCollection state-level e2e.** The headline win is currently only *captured* in the mutation - lab corpus (`test/mutationlab/corpus/configmap/deletecollection/`), not *exercised* against the - running operator. The gaps doc marks a dedicated e2e "out of scope / covered transitively." Given the - user-facing claim, a thin e2e (delete a collection of 3 ConfigMaps → 3 files removed in one or more - committer commits) is worth the cost to *prove* the promise. Pairs naturally with Test A. - -### Should-fix (cleanup / honesty) - -3. **Aggregated-API user guide is a content regression.** `docs/aggregated-api-guide.md` (102 lines of - real setup instructions) was deleted and **not** migrated — `architecture.md` mentions aggregated APIs - only once. README links were repointed (this branch) so there are no broken links, but a self-managed - user who needs aggregated-API capture now has no setup guide. Decide: restore + rewrite for watch-first, - or fold into `architecture.md`. The feature itself still works and is e2e-tested - (`test/e2e/setup/manifests/sample-apiserver/`, `aggregated_apiserver_e2e_test.go`). -4. **`docs/tasks/bounded-queue.md` is obsolete.** It is about bounding the audit Redis stream - (`--audit-redis-max-len`), a flag and a subsystem that no longer exist. Archive or delete. -5. **Attribution reason-code granularity.** Reason codes implemented today: `exact_user`, - `exact_serviceaccount`, `weak`, `exact_deletecollection_item` (✅ landed with the expander — §4), - `conflict`, `expired`, `absent`. The remaining finer codes (`weak-no-rv`, `conflict-multi-user`, - `absent-attribution-disabled`, `absent-policy-dropped`) are still not distinct. Not blocking; fast-follows that improve - attribution fidelity and observability. (Note: the SA naming policy / `serviceaccount_collapsed` result was - removed — a matched service account is always named by its own username.) - -### Nice-to-have (test breadth) - -6. Test B — comments survive a resync/restart (extends the live-path in-place edit proof). -7. Test C — encryption re-encrypt boundary (pins "comments dropped on re-encrypt" as an explicit contract). - -## 4. The DeleteCollection nuance (now closed) - -"Watch-first solves DeleteCollection" was always **true at the state level** (each deleted object produces its -own watch event). The **attribution expander** is now **built** ([deletecollection-attribution-expander.md](deletecollection-attribution-expander.md)): -`RecordDeleteCollectionFacts` expands one `deletecollection` response body into N per-UID facts, joined to each -removal event by UID (not RV), surfacing as `exact_deletecollection_item`. It ships alongside the -**deletion-as-intent** render rule — an object marked with a `deletionTimestamp` is removed from the intent tree -at delete-request time and attributed to the requester, even while a finalizer keeps it Terminating; later -finalizer cleanup folds to a no-op. When the API server returns a hollow body (aggregated / metadata-only), the -collection delete still commits as **committer** (the documented v1 limit), consistent with "a wrong author is -worse than no author." Unit + e2e coverage landed (`test/e2e/deletecollection_intent_e2e_test.go`). - -## 5. Work completed in this pass - -Applied on-branch (no commit). Validated end to end: `go build`, `go vet`, `task lint` (0 issues), -`task test` (unit, 73.8%), and `helm template` (both modes). - -**Framing rule (owner decision):** Valkey/Redis is **required** — it holds each GitTarget's watch resume -state and underpins HA and the future durable branchworker queue. **Only author attribution is -optional.** Everything below states it that way; never call Redis optional. - -**Code** - -- **Redis required; resume cursors decoupled from attribution.** `cmd/main.go` now builds the Redis - index and wires `watchMgr.WatchCursorStore` **unconditionally**; `validateAuditConfig` **requires** a - non-empty `--redis-addr`; a new `--author-attribution` flag (default `true`, chart - `attribution.enabled`) gates **only** the audit webhook ingress + resolver + CommitRequest lookup. So - "configured-author" now means *attribution off, Redis still on*. `cmd/main_audit_server_test.go` updated - (empty `--redis-addr` is now an error; configured-author is the attribution toggle). -- **Dead-code removal.** Deleted the last materialization-phase-machine residue in `internal/watch` - (`NudgeTypeResyncForLateEvent` → `claimedGVRForGroupResource` → `materializerInstance` + the backing - `lateNudge*`/`materializer*` fields and `lateNudgeMinInterval` const), zero-external-caller verified; - refreshed the stale `declaredGVRs` comment. (`dropTargetGitPathAcceptanceLocked()` was a false-positive - in automated analysis — it is called from `target_watch.go`; kept.) - -**Docs & chart** - -- `README.md`: rewrote "How it works" to watch-first (Redis tracking resume state as an explicit step); - added an **Operating modes** table framed on the *attribution* axis (both modes require Valkey/Redis); - state-mirror/opportunistic-history honesty note; marked **only audit delivery** as attributed-mode-only - in the quick start (Valkey is "required — both modes"); fixed two broken links to the deleted - aggregated-API guide; bumped tested K8s 1.35 → 1.36. -- `charts/gitops-reverser/README.md`: Valkey/Redis listed as **required**; **only** audit delivery listed - as optional; feature bullets reworded; K8s 1.35 → 1.36. -- `charts/gitops-reverser/values.yaml` (new `attribution.enabled`, reworded Redis comments) and - `deployment.yaml` (passes `--author-attribution`); `NOTES.txt` left at its Redis-present framing. -- `docs/configuration.md` and `docs/architecture.md` now state Redis as required with attribution as the - only optional capability (including the startup flowchart and the incidental "no Redis" phrasings); the - design-record `watch-first-ingestion-architecture.md` was rewritten so its body states Redis-required - throughout (the earlier correction banner is folded in, not bolted on top). - -## 6. Merge recommendation - -**Mergeable in principle — the rewrite is complete, builds clean, and the core trust guarantees are -implemented.** The Redis-required / cursor-decoupling correction is done (§5). Before merge, the two -items worth not skipping are **Test A (missed-delete sweep e2e, §3.1)** and a **DeleteCollection state -e2e (§3.2)**, because they are exactly the scenarios that justify the rewrite and are currently proven -only at the unit / corpus level. The obsolete-doc cleanup and aggregated-API guide (§3.3–3.4) are -low-risk and make the deletion-forward story honest. The DeleteCollection attribution expander (§4) and -reason-code granularity (§3.5) are legitimate fast-follows, not blockers. diff --git a/docs/design/watchrule-wildcard-and-resolution-semantics.md b/docs/design/watchrule-wildcard-and-resolution-semantics.md deleted file mode 100644 index 3f91f005..00000000 --- a/docs/design/watchrule-wildcard-and-resolution-semantics.md +++ /dev/null @@ -1,142 +0,0 @@ -# WatchRule Wildcard & Resolution Semantics - -How GitOps Reverser turns a `WatchRule`/`ClusterWatchRule` resource selector into -a concrete set of watchable GVRs, what it deliberately refuses, and why there is -no "watch everything" rule. - -Source of truth: `RuleGVRResolver` in -[rule_gvr_resolver.go](../../internal/watch/rule_gvr_resolver.go), backed by the -[APIResourceCatalog](../../internal/watch/api_resource_catalog.go). See also -[watchrule-gvr-resolution-plan.md](../finished/watchrule-gvr-resolution-plan.md). - -> **Note:** this documents *current* behavior. The CRD field docs promise -> admission-webhook-style wildcard semantics that this resolver does not yet -> implement — see -> [watchrule-wildcard-support-plan.md](../future/watchrule-wildcard-support-plan.md) for -> that finding and the plan to resolve it. - -## Two directions, treated differently - -Resource selectors are used in two distinct places, and they handle wildcards -**oppositely**: - -| Direction | Code | Question it answers | `*` behavior | -|---|---|---|---| -| **Planning / resolution** | `RuleGVRResolver.Resolve(...)` ([rule_gvr_resolver.go:67](../../internal/watch/rule_gvr_resolver.go#L67)) | "Which concrete GVRs should I set up informers for and snapshot?" | **Refused** (`Wildcard*` miss). | -| **Matching** | `matchesAPIGroups`/`matchesResources` ([manager.go:480-513](../../internal/watch/manager.go#L480-L513)) | "Does this concrete incoming event's GVR match a rule?" | **Honored** (`"*"` matches anything). | - -The planning direction is the only one that creates informers and drives -snapshots (`gvrFromCompiledRule → Resolve`, -[gvr.go:79-92](../../internal/watch/gvr.go#L79-L92)). The matching direction only -runs against a GVR an informer **already delivered** -([collectWatchRuleNamespaces](../../internal/watch/manager.go#L416-L424)). - -**Consequence:** a `*` rule with no concrete companion rule sets up zero -informers and therefore watches nothing. The matching-side `*` only ever matches -events some *other* concrete rule already brought in. A lone `resources: ["*"]` -rule looks like "watch everything" but is effectively a no-op (it logs a -`WildcardResource` miss at `V(1)`). - -## The preflight gate - -`Resolve` calls `resolveResource` per resource name, which first runs -`preflightMisses` ([rule_gvr_resolver.go:108-131](../../internal/watch/rule_gvr_resolver.go#L108-L131)). -This gate short-circuits **before the catalog is ever queried**: - -| Condition | Result | Meaning | -|---|---|---| -| `resource == ""` | dropped, no miss | Empty resource entry is ignored. | -| `resource == "*"` | `WildcardResource` | `*` in `resources` — expansion unsupported. | -| `hasWildcard(groups)` | `WildcardGroup` | `*` in `apiGroups` — expansion unsupported. | -| `strings.Contains(resource, "/")` | `NotServed` | Subresource (e.g. `pods/status`) planning unsupported. | -| catalog nil or not `Ready()` | `CatalogUnavailable` | Discovery hasn't populated a catalog yet. | -| otherwise | proceed | Look the resource up in the catalog. | - -`WildcardResource` vs `WildcardGroup` is purely *which axis* held the `*`. -Resource is checked first, so `apiGroups:["*"], resources:["*"]` reports -`WildcardResource`. - -## What the resolver *does* expand from the catalog - -Two narrower, **bounded** expansions are supported — neither is an open wildcard: - -- **Empty `apiGroups`** (not `*`): `resourceCandidates` looks the resource name - up across *all* groups via - [`entriesForResource`](../../internal/watch/api_resource_catalog.go#L286-L290), - but [`ambiguityMiss`](../../internal/watch/rule_gvr_resolver.go#L141-L152) - refuses with `Ambiguous` if more than one group serves that name. So it is - "find this one kind without naming its group," requiring a unique answer — not - a fan-out. -- **Empty or `*` `apiVersions`**: - [`choosePreferredVersions`](../../internal/watch/rule_gvr_resolver.go#L212-L235) - collapses to the single **preferred** version per group-resource. - -Note the asymmetry: a version wildcard *is* accepted (it resolves to exactly one -version), but group/resource wildcards are refused. The dividing line is -**boundedness**: does the selector resolve to a fixed, knowable set? - -## There is no "watch everything" rule - -By design, no single rule can watch the whole cluster: - -- `resources: ["*"]` → `WildcardResource`, refused. -- `apiGroups: ["*"]` → `WildcardGroup`, refused. -- Empty `apiGroups` → resolves *one* kind across groups, and only if unambiguous. -- Empty `resources` → the `Resolve` loop iterates `resources`, so it yields zero - GVRs and watches nothing. - -The only way to watch broadly is to **enumerate each concrete resource kind -explicitly**. That list is static: a newly installed CRD is not picked up until a -rule names it (or a wildcard pattern would match it — which is exactly what is -refused). Dynamic "all current and future kinds" is intentionally not -expressible. - -## Why this is intentional - -1. **Bounded vs unbounded.** A version wildcard collapses to one preferred - version. A group/resource wildcard expands to an open-ended set whose - membership depends on what is installed right now. The resolver only expands - selectors that resolve to a fixed set. -2. **Plan stability.** A wildcard plan's membership would change every time *any* - CRD is installed or removed, churning the per-GitTarget effective-watch-plan - hash on unrelated cluster activity — the same spurious re-snapshot problem - described in - [rule-set-snapshot-discovery-lag-fix.md](../finished/rule-set-snapshot-discovery-lag-fix.md), - but permanent and amplified. Refusing wildcards keeps watch plans - deterministic. -3. **Snapshot safety.** Snapshotting `*` would commit the entire cluster (minus - policy-excluded kinds) to git on every rule-change snapshot — heavy, - surprising, and far more exposed to the partial-view aborts that - `RequestClusterState` enforces ([manager.go:596-601](../../internal/watch/manager.go#L596-L601)). -4. **A terse alternative already exists.** Empty `apiGroups` lets a rule name a - resource without its group as long as the name is unambiguous, so users are - not pushed toward wildcards just to stay concise. - -## Relationship to the snapshot miss classification - -`blockingSnapshotMisses` ([manager.go:657-669](../../internal/watch/manager.go#L657-L669)) -groups `WildcardGroup`/`WildcardResource` with `CatalogUnavailable`/ -`DiscoveryDegraded` as "blocking" — all four prevent emitting a snapshot. But the -two families differ in nature: - -- **Transient-blocking** (`CatalogUnavailable`, `DiscoveryDegraded`): the answer - changes once discovery recovers. Genuinely "ask again later." -- **Stable-blocking** (`WildcardGroup`, `WildcardResource`): a fixed property of - the rule text. Retrying never changes it; it is effectively a configuration - error to surface to the user. - -This distinction matters for the state model in -[rule-set-snapshot-discovery-lag-fix.md](../finished/rule-set-snapshot-discovery-lag-fix.md): -only the transient family should drive "retry next cycle"; the wildcard family -will not resolve on its own. - -### Same policy applies one step later, at list time - -The `NotServed` skip above happens during *resolution* (a type absent from the -catalog never enters the watch set). The identical condition can also surface one -step later, during the authoritative `list` in `RequestClusterState`: a type that -was served at resolve time can have its CRD/APIService removed before the list -runs, which returns `NotFound`. For consistency that list-time `NotFound` is -handled the same way — the GVR is skipped, not treated as a partial-view abort. -Every *other* list error (a served type we could not read) still aborts. See the -[Item D decision](../future/watchrule-wildcard-support-plan.md#item-d-decision-notfound-skips-everything-else-aborts). diff --git a/docs/design/audit-webhook-api-server-connectivity.md b/docs/facts/audit-webhook-api-server-connectivity.md similarity index 100% rename from docs/design/audit-webhook-api-server-connectivity.md rename to docs/facts/audit-webhook-api-server-connectivity.md diff --git a/docs/design/kubernetes-apf-and-inflight-tuning.md b/docs/facts/kubernetes-apf-and-inflight-tuning.md similarity index 100% rename from docs/design/kubernetes-apf-and-inflight-tuning.md rename to docs/facts/kubernetes-apf-and-inflight-tuning.md diff --git a/docs/design/kubernetes-api-discovery.md b/docs/facts/kubernetes-api-discovery.md similarity index 100% rename from docs/design/kubernetes-api-discovery.md rename to docs/facts/kubernetes-api-discovery.md diff --git a/docs/design/kubernetes-api-resource-catalog.md b/docs/facts/kubernetes-api-resource-catalog.md similarity index 100% rename from docs/design/kubernetes-api-resource-catalog.md rename to docs/facts/kubernetes-api-resource-catalog.md diff --git a/docs/design/watch-event-ordering-and-attribution-grace.md b/docs/facts/watch-event-ordering-and-attribution-grace.md similarity index 98% rename from docs/design/watch-event-ordering-and-attribution-grace.md rename to docs/facts/watch-event-ordering-and-attribution-grace.md index 76e1fc68..76bb1a4a 100644 --- a/docs/design/watch-event-ordering-and-attribution-grace.md +++ b/docs/facts/watch-event-ordering-and-attribution-grace.md @@ -2,7 +2,7 @@ > Status: **explainer / decision record** > Date: 2026-06-26 -> Related: [Watch-first ingestion architecture](watch-first-ingestion-architecture.md), +> Related: [Watch-first ingestion architecture](../finished/watch-first-ingestion-architecture.md), > [`internal/watch/target_watch.go`](../../internal/watch/target_watch.go), > [`internal/watch/author_resolver.go`](../../internal/watch/author_resolver.go), > [`internal/reconcile/git_target_event_stream.go`](../../internal/reconcile/git_target_event_stream.go), diff --git a/docs/finished/api-source-of-truth-reconcile.md b/docs/finished/api-source-of-truth-reconcile.md deleted file mode 100644 index 0decbd05..00000000 --- a/docs/finished/api-source-of-truth-reconcile.md +++ /dev/null @@ -1,434 +0,0 @@ -# API as source of truth: checkpoint + log per-type reconcile - -> ## ✅ LANDED (2026-06-11) -> **R3 ("the great deletion") is implemented and green.** The pivot to the spliced per-type -> materialization (R2) and the §5.1 demolition are done: the live object-informer fabric, the -> per-reconcile streaming gather, the RECONCILING handover, and both content hashes are -> **deleted**, and the per-type **checkpoint + audit-log splice** (correctness) plus the -> per-type **audit tail** (freshness) are the **sole** live-truth path. The full e2e suite is -> green at procs=1 and procs=4 (the only intermittent failure is the pre-existing IceCreamOrder -> CRD-discovery wobble — see -> [../startup-robustness-cert-and-crd-wobble.md](../design/startup-robustness-cert-and-crd-wobble.md)). -> File/symbol references below to `snapshot_stream.go` and `informers.go` are **historical** — -> those files no longer exist; they record what was removed (links to them have been delinked). -> Minor deviation from the plan: the GVR *resolver* helpers (`resolveSnapshotGVRs`, -> `resolveSnapshotGVRForType`, `snapshotGVRsFromTable`, …) were **moved** to -> `internal/watch/scope_resolve.go`, not deleted (only the live *gather* was deleted). -> **For the current runtime picture + the bootstrap walk-through, read -> `architecture-and-bootstrap.md`.** The original agreed-direction -> status (for history) follows. -> -> Status: **agreed direction — the demand substrate is COMPLETE; the pivot + demolition are -> next.** The capture substrate is real and finished on the demand side: the write-only -> per-type keyspace (R0) and the **entire** demand lifecycle -> (`demand-driven-type-materialization-lifecycle.md`, -> steps **L-1→L-6** — all landed) are in. So today only the types a GitTarget *claims* are -> filled into the checkpoint; the checkpoint is durable (`:objects:state` + boot rebuild) and -> observable (metrics + a bounded GitTarget status roll-up). That already delivers parts of R1 -> (durable checkpoint state) and R4 (visibility). What remains here is the **pivot** (make -> GitTarget reconcile a *consumer* of the spliced materialization — R2) plus R1's RV-first log, -> and the **demolition** the pivot unlocks (§5.1): the live informer fabric, the per-reconcile -> gather, the RECONCILING handover, and content hashing all go. This is a bold **cutover**, not -> a parallel path left to linger. Supersedes the always-open "merged streaming tail" (M13) -> sketch in -> `../manifest/version2/per-type-reconcile-and-streaming-tail.md` -> with a watch-free, periodic-reconcile model built on the per-type Redis keyspace. -> Captured: 2026-06-10 · Updated: 2026-06-10 -> Owner: Simon -> Related: -> `demand-driven-type-materialization-lifecycle.md` (**which** types get a checkpoint and the Dormant→Syncing→Synced lifecycle that governs it — the demand layer beneath this doc), -> `audit-log-ingestion-and-ordering.md` (the log producer / ordering / late-lane detail this doc leaves out), -> [per-resource-type-rv-keyed-streams-experiment.md](per-resource-type-rv-keyed-streams-experiment.md) (the write-only prototype this consumes), -> [../manifest/version2/dream.md](../design/manifest/version2/dream.md) (the origin), -> [../manifest/reconcile-via-watchlist-mark-and-sweep.md](../design/manifest/reconcile-via-watchlist-mark-and-sweep.md) (the plan/sweep machinery, reused), -> `../manifest/version2/per-type-reconcile-and-streaming-tail.md` (M10–M12 it builds on). - -## 1. One paragraph - -The Kubernetes API is the **ultimate** source of truth; Git is the durable mirror that -follows it so closely it is the source of truth for everything downstream. Today each -GitTarget re-derives the API for itself — a per-reconcile streaming-list gather -(`StreamClusterSnapshotForGitDest`) plus -a second always-open informer feed. This design replaces both with a single, standing, -**type-keyed materialization of the API in Redis** and makes GitTarget reconcile a -**consumer** of it. The API is captured **once per type** — and only for the types a GitTarget -actually follows (`demand-driven-type-materialization-lifecycle.md`) -— by two decoupled writers — an -always-on audit-webhook **log** and a periodic LIST **checkpoint** — and every GitTarget -reconciles by **splicing the checkpoint with the log**, per type, into one commit. No -object watch stays open. Content hashing is dropped: a per-type, RV-anchored ordering -sequence makes "what is newer" exact, and the writer's existing no-op detection makes -"did it change" exact. The plan is deliberately **subtractive**: once the splice is the only -live truth path, the live informer fabric, the per-reconcile gather, the bootstrap handover, -and both content hashes are **deleted, not kept alongside** (§5.1). - -## 2. Requirements - -These are the requirements this design must satisfy. They are the agreed acceptance -surface; every decision in §4 traces back to one. - -| # | Requirement | -|---|---| -| **R1** | **API is the source of truth.** The reconcile's desired state is a pure function of the materialized API (checkpoint + log), never of Git paths or re-derivation from scratch. Git is the mirror. | -| **R2** | **Reconcile per type.** The unit of reconcile is one watched type `(GVK, GVR, scope)`; a GitTarget watching five types has five independent reconciles and one commit per type. | -| **R3** | **No long-lived object watches.** Watches are opened only briefly to fill a checkpoint, then closed. The only always-on intake is the audit-webhook push. (A *discovery* watch for new resource **types** is allowed — it is type-level, not object-level.) | -| **R4** | **The audit intake never stops.** It is the freshness feed; missing events degrades freshness, never correctness (R13). Surviving failover is an HA concern, deferred (R10). | -| **R5** | **The checkpoint is refreshed periodically** by a LIST (or modern WATCH-with-bookmark), e.g. hourly — **not** by folding the audit log into it. The two feeds stay decoupled. | -| **R6** | **Reconcile splices checkpoint + log** to compute current desired state and emits **one** reconcile commit per type. It does **not** replay history as per-event commits, even on first sync of a new GitTarget. | -| **R7** | **Drop content hashing.** Remove the sha256-of-YAML dedup on both the informer edge and the event stream; rely on the ordering sequence (R8) + writer no-op detection. | -| **R8** | **Replayable, RV-anchored ordering.** The per-type log carries a self-assigned, strictly increasing sequence anchored to the resourceVersion, so a reconcile can replay from a checkpoint point with a guarantee, and RV-less events still get a position. | -| **R9** | **Per-type independence.** A wobbly, throttled, or removed type fails *itself*; stable types keep reconciling. | -| **R10** | **HA-ready, not HA-now.** The design must not preclude multiple replicas / failover, but HA is out of scope for this plan. | -| **R11** | **Fail-closed.** Never sweep Git on a stale, unobservable, or partial view. An untrusted absence is never a deletion. | -| **R12** | **Visibility.** An operator can see what a GitTarget follows, per-type sync state, and counts (metrics first, bounded status, optional inventory). | -| **R13** | **Big resource sets are a first-class case** — their own e2e and metrics (checkpoint duration, log lag, commit counts). | -| **R14** | **Coalescing is a follow-up.** Grouping co-arriving changes into one commit is desirable but not required for the first cut. | - -## 3. The model: checkpoint + log, spliced per type - -Two decoupled capture writers per type, neither holding a watch open, plus a per-type -consumer that splices them. This is a **checkpoint + write-ahead-log** shape. - -> **Terminology — "checkpoint fill."** Throughout, *filling the checkpoint* means a **brief -> streaming-list WATCH** (`sendInitialEvents=true` + the initial-events-end bookmark), with a -> consistent **LIST as the per-type fallback** for a server that cannot stream — never a -> long-lived watch (R3). This is the modern path the Materializer documents -> ([materializer.go](../../internal/typeset/materializer.go)). The current writer -> ([`mirrorTypeObjects`](../../internal/watch/type_objects_mirror.go#L59)) uses the LIST -> fallback; the streaming-list fast-path is an R1 upgrade. Where older text below says "LIST -> checkpoint," read "checkpoint fill." - -```mermaid -flowchart TD - subgraph CAP["Capture — per type (only the audit HTTP intake is always-on)"] - AW["audit webhook (always-on PUSH)"] -->|every mutating change| LOG[":audit:stream — the log
RV-anchored, replayable"] - TMR["periodic timer + type-set change"] --> LIST["brief LIST / WATCH+bookmark, then CLOSE"] - LIST -->|"full replace @ RV R"| CKPT[":objects:items @ :objects:rv=R — the checkpoint"] - end - LOG --> SPLICE - CKPT --> SPLICE - subgraph CON["Consume — per GitTarget × type (periodic + on audit arrival)"] - SPLICE["desired = fold( checkpoint@R , log entries with seq > R )"] - SPLICE --> SCOPE["filter to GitTarget scope"] - SCOPE --> PLAN["BuildScopedPlan(store, desired, type-scope)"] - PLAN --> COMMIT["one reconcile commit per type"] - end -``` - -The two feeds are deliberately **not** connected (R5). They cover each other's weakness: - -| Feed | Strength | Weakness | Covered by | -|---|---|---|---| -| `:audit:stream` (always-on push) | **freshness** (near-real-time) | completeness not guaranteed | the checkpoint heals it within the interval | -| `:objects:items` (periodic checkpoint fill) | **correctness** (authoritative full set; catches orphans / missed deletes) | up to one interval stale alone | the log makes the reconcile current | - -This is what lets R4 be true without being fatal: an audit gap costs **freshness until the -next checkpoint**, never **correctness** (R13, R11). It is also the HA seam (R10): the -checkpoint is a standing resume point a failover replica can reconcile against. - -### 3.1 Relationship to what exists today - -The live path is **already** Redis-stream-driven, not informer-driven: -[`AuditConsumer`](../../../internal/queue/redis_audit_consumer.go#L206) `XREADGROUP`s one -canonical stream, matches rules per event, and routes `git.Event`s to the BranchWorker. -This design is **v2 of "audit drives Git"**: shard that single stream into the per-type -`:audit:stream`s the prototype already writes, add the periodic checkpoint for -mark-and-sweep correctness (deletes/orphans no longer depend on a delete event arriving), -and make the unit a per-type splice reconcile. The plan/apply machinery is reused -unchanged (§5). - -## 4. Decisions (the choices, with rationale) - -### DEC-1 — Capture = periodic checkpoint + always-on log, decoupled *(satisfies R3, R4, R5)* - -**Chosen.** The checkpoint is the only thing that touches the API on a schedule, and it -closes immediately. The log is fed by the existing audit-webhook tap -([`mirrorByType`](../../internal/webhook/audit_handler.go#L518)). They are never wired -to each other. - -*Rejected:* keep `:objects:items` live by folding the log into it — couples the two feeds, -re-introduces a standing consumer, and makes the snapshot only as complete as the audit -policy. *Rejected:* an always-open informer/streaming tail (the old M13) — violates R3 and -owns reconnect / `410 Gone` / fan-out-refcount lifecycle we no longer need. - -### DEC-2 — Reconcile = splice(checkpoint, log) per type → one commit *(satisfies R1, R2, R6)* - -**Chosen.** Per `(GitTarget, type)`, desired state is `fold(checkpoint, log-after-R)`, -scoped, then `BuildScopedPlan` → one commit. Pure function of the materialized API (R1). -No history replay (R6). - -### DEC-3 — RV-ordered, replayable log (drop millisecond-first ordering) *(satisfies R8)* - -**Chosen.** Re-key the per-type log from today's millisecond-first `-` -to **resourceVersion-first**, so the log is ordered by etcd commit order and a reconcile -can replay exactly from a checkpoint (`XRANGE (R +`). This makes "is this event after -checkpoint R?" a precise, delivery-order-independent test, which is what lets DEC-6 drop -content hashing. - -The encoding (`-*` with Valkey-allocated subsequence), the RV-comparison rules, the -diagnostic **late lane** for out-of-order arrivals, RV-less placement, and the deferred -Lua / pre-sorter improvements all live in the dedicated producer design: -**`audit-log-ingestion-and-ordering.md`**. The -load-bearing invariant that doc establishes, and that this reconcile relies on: **the main -stream is strictly RV-ordered — we never knowingly insert an out-of-order event** — so the -splice in §6 can fold by stream position. - -### DEC-4 — Checkpoint trigger = demand-gated, periodic **and** event-driven *(satisfies R2, R5, R9)* - -**Chosen.** A checkpoint is built **only for a type a GitTarget claims** — not for every -followable type — and once built is re-anchored on a timer (default ~1h) **and** on a -deliberate type-set change (a claim that adds the type, or a catalog generation bump from a -CRD installed/upgraded). The phase machine that governs this — `Dormant → Requested → Syncing -→ Synced ⇄ Resyncing`, the claim/lease demand model, and the single periodic pass that both -re-anchors the still-wanted and releases the no-longer-wanted — is specified in -**`demand-driven-type-materialization-lifecycle.md`**. -This doc assumes a `Synced` checkpoint exists for the type being reconciled. - -### DEC-5 — RV-less events: best-effort in the log, correctness from the next checkpoint *(satisfies R11, R13)* - -**Chosen consequence.** RV-bearing events (all creates/updates) replay exactly. RV-less -events (some deletes, collection verbs) get a best-effort placement in the log for -**freshness**; their **correctness** is guaranteed by the next checkpoint — the LIST will -simply not contain a deleted object, and the type-scoped mark-and-sweep removes it. We do -not over-engineer the RV-less path; the checkpoint backstops it. The placement mechanics -are in `audit-log-ingestion-and-ordering.md` (IR5). - -### DEC-6 — Drop content hashing *(satisfies R7)* - -**Chosen, and wanted.** Remove `isDuplicateContent` -(informers.go) and `computeEventHash` / -`processedEventHashes` -([git_target_event_stream.go](../../internal/reconcile/git_target_event_stream.go)). -"Newer?" is answered by the stream position (DEC-3); "changed?" is answered by the writer's -existing no-op detection (`manifestedit.Decide` → `EditNoChange`, -`manifestsAreSemanticallyEqual` in [plan_flush.go](../../internal/git/plan_flush.go)), -already computed for free at the commit boundary. Measured before/after on a high-churn -type (R13); the cheap fallback if ever needed is a per-identity last-position equality -check (string compare, not a hash). - -### DEC-7 — Retire long-lived informers, the gather, and the RECONCILING handover *(satisfies R3)* - -**Chosen.** With the audit push as the sole live feed and the checkpoint as the periodic -truth, three things go: the informer **object-watch** pipeline (the `startInformerScope` / -`startSingleInformer` lifecycle in [manager.go](../../internal/watch/manager.go) + -`addHandlers`), the per-reconcile **streaming -gather** (`StreamClusterSnapshotForGitDest` -and its per-type twin), and the bootstrap/steady-state **handover** buffer -(`BeginReconciliation`/`OnReconciliationComplete`). The checkpoint writer is the per-type -fill ([`mirrorTypeObjects`](../../internal/watch/type_objects_mirror.go#L59), now demand- -driven), **not** the whole-GitTarget gather — so that gather is deleted outright, not kept as -a "checkpoint writer." Deleted-final-state handling and shared fan-out, which informers gave -for free, are now provided by the checkpoint (catches missed deletes) and Redis fan-out (one -capture, N consumers). The **type-level** discovery watch -([`startAPISurfaceTriggerInformers`](../../internal/watch/manager_catalog.go#L378)) stays -— it watches resource *types*, not objects (R3). **Sequencing (per review): this deletion -happens only after the splice (R2) is proven the sole live truth path.** - -### DEC-8 — Coalescing is a follow-up *(satisfies R14)* - -**Chosen.** First cut may reconcile-and-commit per audit-triggered wake-up. Debouncing -co-arriving changes into one commit per window is a later optimization; the BranchWorker -commit window already coalesces, so this is tuning, not new machinery. - -## 5. What is reused unchanged - -The entire write side stays. **Only the source of `Desired` changes** — from "a live API -stream this reconcile opened" to "the spliced materialization." - -- [`BuildScopedPlan`](../../internal/manifestanalyzer/plan.go#L210) — type-scoped - mark-and-sweep; a reconcile passes that type's desired set + scope predicate, a pure - sweep passes an empty desired set (M12). -- [`ResyncRequest{Desired, Revision, ScopeGVR}`](../../internal/git/types.go#L224) + - [`EnqueueResync`](../../internal/git/branch_worker.go#L294) — the BranchWorker entry - point; `ScopeGVR` already makes a resync per-type. -- The BranchWorker single-writer queue, commit window, and `plan_flush` apply path. - -### 5.1 What we delete — the demolition *(the inverse of §5: a lot)* - -The pivot (R2) makes the spliced materialization the **only** desired-state source, so every -path that *re-derived* the API — by watching it, gathering it per reconcile, or de-duping its -echoes — becomes dead weight. The plan is net-**subtractive**: when R3 lands, the diff is -mostly red. **This deletion happens only after R2 is proven** (per review — never drop the -old path until the splice is the sole live truth). Grouped by the decision that kills each: - -| Kill | Code (file · symbols) | Why dead | Replaced by | -|---|---|---|---| -| **Content hashing** (DEC-6/R7) | `isDuplicateContent` + `lastSeenHash`/`clearDeduplicationCacheForGVRs`/`resourceMatchesGVRs`/`splitResourceKey` ([manager.go](../../internal/watch/manager.go)); `computeEventHash`/`processedEventHashes` ([git_target_event_stream.go](../../internal/reconcile/git_target_event_stream.go)) | "newer?" = stream position (DEC-3); "changed?" = writer no-op detection | `manifestedit.Decide` at the commit boundary | -| **Long-lived object informers** (DEC-7/R3) | the informer lifecycle in [manager.go](../../internal/watch/manager.go) — `activeInformers`/`informerFactories`, `desiredInformerScope`, `informersToStart`/`informersObsolete`/`compareInformerScope`, `startInformerScope`/`startSingleInformer`/`startCollectedInformers`/`stopInformerNamespace`/`initializeInformerMaps`; the object-watch handlers in informers.go (`addHandlers` + funcs) | no object watch stays open (R3) | checkpoint (missed deletes) + audit push (live) + Redis fan-out | -| **RECONCILING handover** (DEC-7) | `GitTargetEventStream` buffering + `BeginReconciliation`/`OnReconciliationComplete` ([git_target_event_stream.go](../../internal/reconcile/git_target_event_stream.go)); `EventRouter.BeginReconciliationForStream`/`CompleteReconciliationForStream`; `Manager.beginReconciliationForTargets`/`completeReconciliationForTargets` | no bootstrap-vs-steady race once there is no informer bootstrap | reconcile-off-checkpoint is uniform | -| **Per-reconcile streaming gather** (R2) | most of snapshot_stream.go — `StreamClusterSnapshotForGitDest`, `StreamSnapshotForType`, `resolveSnapshotGVRForType`, `joinSnapshotStreams`, `streamInitialEvents`, `listInitialEvents`, `streamingListOptions`, `snapshotStreamTasks` | desired is no longer gathered live per reconcile | the splice (§6) | -| **Whole-GitTarget resync + plan-hash selection** (R2) | [manager.go](../../internal/watch/manager.go) — `emitSnapshotForRuleChange`, `snapshotTargetsNeedingDelivery`, `currentRuleSetSnapshots`/`watchPlanFromTable`, `ruleSetSnapshotTarget`/`targetWatchPlan`, `lastDeliveredRuleSetHash`/`pendingRuleSetHash`/`markRuleSetSnapshotDelivered`, `snapshotEmitCount`; [event_router.go](../../internal/watch/event_router.go) — `EmitResyncForGitDest`, `TriggerResyncForGitDest`, `gatherAndEnqueueResync` | reconcile is per-type off the checkpoint, not a whole-target gather on rule churn | per-type splice (R2) + the demand `Declare` (L-2) for scope | -| **Bootstrap `SnapshotSynced` gate** (R2) | [gittarget_controller.go](../../internal/controller/gittarget_controller.go) — `evaluateSnapshotGate`'s resync + `GitTargetConditionSnapshotSynced`; `Manager.gitTargetSnapshotSynced` ([type_lifecycle.go](../../internal/watch/type_lifecycle.go)) | no initial whole-target snapshot to gate; a type is serviceable when its checkpoint is `Synced` | the materializer phase **is** the readiness signal | -| **Single-stream audit fan** (R2/R3) | the single-canonical-stream match/route in [redis_audit_consumer.go](../../../internal/queue/redis_audit_consumer.go) (`XREADGROUP` one stream → per-event `git.Event`) | capture is sharded per-type and consumed by the splice, not routed per event | per-type `:audit:stream` + splice | - -**Rewired, not deleted:** [`EmitTypeReconcileForGitDest`](../../internal/watch/event_router.go#L324) and `reconcileTypeForSyncedTargets` lose their `StreamSnapshotForType` call and gain the splice as the desired source. - -**Kept (the load-bearing remainder):** the write side (§5 — `BuildScopedPlan`, `ResyncRequest`/`EnqueueResync`, BranchWorker + `plan_flush`); demand + scope resolution (`resolveSnapshotGVRs`, the watched-type tables, `snapshotGVRsFromTable`); the **type-level** discovery watch (`startAPISurfaceTriggerInformers` — CRDs/APIServices, allowed by R3); the audit-webhook tap (`mirrorByType`); and the per-type **checkpoint fill** (`mirrorTypeObjects`, to grow the streaming-list/watch+bookmark fast-path). - -## 6. The splice, specified - -Per `(GitTarget, type)` at reconcile time: - -```text -R := :objects:rv # checkpoint revision = replay cursor -desired := decode(:objects:items) # the anchor set, pinned at R -for entry in XRANGE :audit:stream (R +: # log strictly after the checkpoint - if entry.verb is delete: delete desired[entry.identity] - else: desired[entry.identity] = object(entry) # last-writer-wins by position -desired := filter(desired, GitTarget namespaces/scope) -plan := BuildScopedPlan(store, files, desired, scope(type)) -enqueue plan on BranchWorker → one commit -``` - -- The audit entry already carries the full object body (`payload_json`), and the existing - [`extractObject`](../../../internal/queue/redis_audit_consumer.go#L846) / - `sanitize` path turns it into a Git-writable object — reused verbatim. -- Idempotent: re-running yields the same `desired` (pure function of checkpoint + log). -- Exact under async delivery: membership in `(R +` is decided by `objectRV`, not arrival - time (DEC-3). -- Bounded: the log is trimmed to the checkpoint cursor on each re-anchor, so a reconcile - never scans more than one interval of history. - -**Trim-cursor model (pin this before aggressive trimming — per review).** The trim cursor is -the **oldest currently-serving** checkpoint `:objects:rv` for that type — normally the single -live checkpoint's rv. During a `Resyncing` swap the **prior** checkpoint still serves (L5), so -the log is held from the prior rv until the new fill lands, then trimmed up to the new rv. -"Never below the oldest live checkpoint cursor" means exactly this: trim to -`min(rv over serving checkpoints of the type)`, never below. Trimming is **safe, never -lossy**: a reconcile that finds the log trimmed past its cursor simply re-reads the current -checkpoint and folds from there (§7) — the checkpoint is the floor, the log only ever extends -forward of it. Per-type cursor ownership across HA replicas is deferred (R10, §9). - -## 7. Failure / consistency model *(R11)* - -```mermaid -stateDiagram-v2 - [*] --> Fresh: checkpoint synced + log flowing - Fresh --> Reconcile: fold + commit (per type) - Fresh --> Hold: checkpoint phase != synced / Redis unreachable - Fresh --> ReAnchor: log trimmed past cursor - Hold --> Fresh: capture recovers (NEVER sweeps while held) - ReAnchor --> Fresh: next checkpoint re-anchors + re-trims -``` - -- **Checkpoint not `synced`, or Redis unreachable → hold, sweep nothing** (R11). An - unobservable surface is never a trusted absence — the same guard as M12's degraded- - catalog hold. (The `Syncing`/`Synced`/`Resyncing`/`Failing` phase vocabulary and its own - first-sync-hold vs fail-closed-re-anchor handling live in - `demand-driven-type-materialization-lifecycle.md` §7.) -- **Log trimmed past a cursor → wait for / force the next checkpoint** and reconcile from - it. Bounded by the checkpoint interval, so rare by construction. -- **A type whose checkpoint LIST fails holds itself**; siblings keep reconciling (R9). -- **Consistency pin** is `(commit SHA, :objects:rv, last-applied log position)` per type. - Cross-type "max position" interpretation is an open question (§9). - -## 8. Implementation — bold stages - -Each stage ends green, but each is a **cutover**, not a parallel path left to linger. The -execution order is fixed by one rule the review made explicit: **do not delete the old path -until the splice is proven the sole live truth** — build forward (R1→R2), prove it, then -demolish (R3). - -**Landed already.** R0 (the write-only per-type keyspace) and the **entire demand layer** — -`demand-driven-type-materialization-lifecycle.md` -**L-1→L-6, all shipped**: a `typeset.Materializer` owns per-`(GitTarget, type)` demand (claims -as self-renewing leases), the GitTarget reconcile `Declare`s its watched-type set, a periodic -**Sweep** re-anchors the still-claimed and ages out withdrawn demand, and a checkpoint -**driver** in `internal/watch` fills `:objects:items` for **only the claimed types** -(`runTypeCheckpointSync` → [`mirrorTypeObjects`](../../internal/watch/type_objects_mirror.go#L59), -gated by the Materializer's `Synced` phase). `TypeActivated` no longer mirrors unconditionally — -the big efficiency win is in. The demand layer also **pre-delivers two stage outcomes below**: -its **L-5** gave R1's durable `:objects:state` + boot rebuild (the checkpoint survives a -restart), and its **L-6** gave R4's visibility (phase/claim metrics + a bounded -`GitTargetStatus.Materialization` roll-up). So the checkpoint half of the substrate is real, -demand-gated, durable, and observable; what remains here is the **RV-ordered log** (the rest of -R1), the **splice** (R2), and the **demolition** (R3). - -### R1 — Substrate: RV-ordered log + trimmable, durable checkpoint *(R5, R8)* — *partly landed* - -Make the log replay-exact and the checkpoint durable enough to resume from. -- ✅ **Done (demand-layer L-4 + L-5).** The periodic re-anchor/release runs (the Sweep flags a - still-claimed `Synced` type and the driver re-fills it), and `:objects:state` now persists the - phase/rv (with the full GVR) and is replayed into the Materializer on boot — a restart resumes - `Synced` types without re-filling (the HA seam, R10). -- ⬜ **Remaining — RV-ordered log + trim.** Re-key `:audit:stream` from `-` to - **RV-first** and add the diagnostic late lane — full producer spec in - `audit-log-ingestion-and-ordering.md` (the concrete change - is to [`RedisByTypeStreamQueue`](../../internal/queue/redis_bytype_queue.go)). On each - re-anchor, **trim** `:audit:stream` to the trim cursor (the oldest serving checkpoint rv — the - model is pinned in §6). -- *Done when:* the log is RV-ordered and replay-rangeable by `:objects:rv`; checkpoints trim the - log to the cursor on re-anchor. (Durable resume already lands via L-5.) **Still no consumer.** - -### R2 — The splice reconcile — THE PIVOT *(R1, R2, R6 — headline)* - -One new per-type consumer makes the API-in-Redis the desired state. The instant it lands, -every other desired-set source is **dead on arrival** (R3 then deletes it). -- `desired = fold(:objects:items@R, XRANGE :audit:stream (R +)`, filter to the GitTarget's - scope, `BuildScopedPlan` → `EnqueueResync{ScopeGVR}` → one commit per type (§6). Pure - function of the materialized API (R1); no history replay (R6). -- Wake on the Materializer's `TypeSynced` (the type is now serviceable) and on audit arrival - for a watched type — **rewire** the existing - [`EmitTypeReconcileForGitDest`](../../internal/watch/event_router.go#L324) seam so it - *splices* instead of calling `StreamSnapshotForType`. Fail-closed per §7 (hold while the - checkpoint phase ≠ `Synced`). -- *Done when:* a GitTarget reconciles per type off Redis with **zero per-reconcile API - calls**; N GitTargets fan out from one capture; mark-and-sweep stays within type bounds; - multi-type files stay document-correct; a wobbly type never blocks siblings (R9). - -### R3 — The great deletion *(R3, R7; DEC-6, DEC-7 — itemised in §5.1)* - -With the splice proven, a large body of code is pure dead weight. Delete it in **one -decisive campaign**, not a long tail of "keep X for now": the long-lived **informer fabric**, -the **RECONCILING handover**, the **per-reconcile streaming gather** -(`StreamClusterSnapshotForGitDest` & friends), the **whole-GitTarget rule-change resync + -plan-hash selection**, the bootstrap **`SnapshotSynced` gate**, and **content hashing on both -edges**. Shard the single canonical `AuditConsumer` stream into the per-type `:audit:stream` -the splice reads. The full file-and-symbol list is **§5.1**. -- *Done when:* exactly one live intake remains (audit push) + the periodic checkpoint; no - informer object caches, no live gather, no hash maps, no handover buffer; the diff is - mostly red; e2e green. The hash-drop CPU check (R7) is measured before/after on a - high-churn type; the last-position equality fallback is kept ready but unused. - -### R4 — Visibility + big-set hardening *(R12, R13)* — *partly landed* - -- ✅ **Done (demand-layer L-6).** Per-type phase + demand are observable: low-cardinality metrics - (`materialization_type_phase` by phase, `materialization_sync_events_total` by kind, - `materialization_claimed_types`, `materialization_claimed_unfollowable`) and a bounded - `GitTargetStatus.Materialization` roll-up (claimed / synced / pending / failing / - not-followable). The claim-vs-refused mismatch is surfaced both ways. -- ⬜ **Remaining — big-set hardening + reconcile-side counts.** Prove the **large-set** case: a - synthetic cluster-wide type with thousands of objects, asserting per-type commits, correct - sweep, no lost tail event, bounded checkpoint duration + log lag. Add the reconcile-side counts - (commit counts, last-applied log position) once R2 exists, plus an optional queryable inventory. -- *Done when:* the operator-visibility above is complete **and** the big-set e2e is green. - -### R5 — Commit coalescing *(R14, follow-up)* - -Debounce audit-triggered reconciles so co-arriving changes group per commit window. Tuning on -top of the BranchWorker's existing window, not new machinery (DEC-8). - -## 9. Open questions - -**Status:** the **demand-layer** questions (claim key, release grace, `Declare` transport, -renewal cadence, `Orphaned` phase) are all **settled** — see -`demand-driven-type-materialization-lifecycle.md` §9. -The questions below are **this doc's**, and three are still genuinely open because they depend on -the splice (R2), which is not built yet — they are intentionally not answered now. - -- **Checkpoint interval.** *Settled: ~1h default.* Open only on whether it is per-type - tunable. Freshness between checkpoints rides entirely on the log (R4); the interval only - bounds correctness drift and log size. -- **Cross-type consistency.** Per-type gives one position per type; if any consumer needs a - folder-wide consistent revision (status, a future audit join), define the "max position - across types" interpretation. -- **Trigger debounce shape (R14).** Per-type timer vs. audit-arrival-driven vs. both, and - the debounce window that best matches the commit window. -- **HA (R10, deferred).** Leader-elected single consumer today - ([`NeedLeaderElection`](../../../internal/queue/redis_audit_consumer.go#L200)). Multi- - replica fan-out, the never-stop audit intake across failover, and per-type cursor - ownership are a separate plan; this design must not preclude them. - -> Ordering / late-lane / ingestion open questions (the pre-sorter and Lua triggers, the -> non-numeric-RV policy, the §7 investigation) live in -> `audit-log-ingestion-and-ordering.md`, not here. diff --git a/docs/finished/audit-consumer-username-attribution-gap.md b/docs/finished/audit-consumer-username-attribution-gap.md deleted file mode 100644 index f35907c3..00000000 --- a/docs/finished/audit-consumer-username-attribution-gap.md +++ /dev/null @@ -1,139 +0,0 @@ -# Audit Consumer: Username Attribution Gap - -## What happened - -The correlation webhook removal was completed (all Go code, tests, manifests, Helm chart). -All unit tests and linter pass cleanly. The e2e suite mostly passes — but one test fails: - -``` -[FAILED] Manager Manager should create Git commit when ConfigMap is added via WatchRule -Expected to contain substring "jane@acme.com" -``` - -The test creates a ConfigMap `--as=jane@acme.com` via `kubectl` and asserts that the -resulting git commit has `jane@acme.com` as the author. This is **correct behaviour** — -the audit consumer is supposed to provide exactly this. The test should not be weakened. - ---- - -## Root cause - -The audit consumer's `Start` method is called and the consumer is running. However, every -`XREADGROUP` call fails with: - -``` -XREADGROUP failed: NOGROUP No such key 'gitopsreverser.audit.events.v1' or consumer group -'gitopsreverser-consumer' in XREADGROUP with GROUP option -``` - -Running `XINFO GROUPS gitopsreverser.audit.events.v1` on the live Valkey pod confirms: -**the consumer group does not exist**, despite the stream having 1310 messages and -`ensureConsumerGroup` logging "Consumer group ready" without error. - -### Suspected cause: `NeedLeaderElection() = true` on a single-replica deployment - -The controller-runtime manager only calls `Start` on Runnables that need leader election -**after** the leader lease is acquired. In a single-pod e2e deployment this normally works, -but if the lease is held by a previous pod (from the `prepare-e2e` reinstall) and the new -pod hasn't acquired it yet, the consumer won't start. When it does start, the stream exists -but the group hasn't been created on this connection. - -A cleaner hypothesis: `ensureConsumerGroup` succeeds (creates the group) but the group is -created in the **same startup context that gets cancelled** when the leader lease is -re-acquired or the pod restarts — wiping the in-memory group. The stream persists in -Valkey but the group is lost if Valkey is restarted (Valkey may not be using persistent -storage in the e2e cluster). - -### What to verify in a new session - -1. **Is Valkey persistent?** - ``` - kubectl get deploy -n valkey-e2e valkey -o yaml | grep -A5 storage - kubectl exec -n valkey-e2e deploy/valkey -- valkey-cli CONFIG GET save - kubectl exec -n valkey-e2e deploy/valkey -- valkey-cli CONFIG GET appendonly - ``` - If Valkey uses no persistence and is restarted between test setup and pod startup, - the group creation done by `ensureConsumerGroup` would be lost. - -2. **Does the group get created at all?** - After `prepare-e2e` and pod start, immediately run: - ``` - kubectl exec -n valkey-e2e deploy/valkey -- valkey-cli XINFO GROUPS gitopsreverser.audit.events.v1 - ``` - If the group appears during pod startup but disappears later, Valkey is losing state. - -3. **Does `ensureConsumerGroup` return an error that is being swallowed?** - The `isAlreadyExistsErr` check only looks for `BUSYGROUP`. If Valkey returns a - different error (e.g. auth, ACL, or connection error) for `XGroupCreateMkStream` that - is NOT `BUSYGROUP` but is also not nil, the current code would return it as a fatal - error from `Start`. But the log shows the consumer IS running (producing NOGROUP errors - repeatedly), which means `ensureConsumerGroup` returned nil — so it logged "Consumer - group ready" but the group doesn't actually exist. - - The most likely explanation: `XGROUP CREATE ... MKSTREAM` succeeds (returns OK), Valkey - confirms the group, but then Valkey is restarted or the data is flushed, and by the - time XREADGROUP runs, the group is gone. - -4. **Is the audit handler actually writing to the same Valkey instance?** - The producer (audit handler) and consumer use the same `--redis-addr`. Check - that the `config/deployment.yaml` address (`valkey.valkey-e2e.svc.cluster.local:6379`) - resolves to the same pod that `XINFO` is run against. - ---- - -## State of the removal at the time of pausing - -### Completed -| Item | Status | -|---|---| -| Delete `internal/correlation/` package (6 files) | ✅ | -| Delete `internal/webhook/event_handler.go` + `_test.go` | ✅ | -| `cmd/main.go`: remove import, constants, store init, event handler, webhook registration | ✅ | -| `internal/watch/manager.go`: remove `CorrelationStore` field, `tryEnrichFromCorrelation`, unused imports | ✅ | -| `internal/watch/informers.go`: replace correlation call with `git.UserInfo{}` | ✅ | -| `internal/telemetry/exporter.go`: remove 4 correlation metrics | ✅ | -| `config/webhook.yaml`: replace correlation stanza with GitTarget validator | ✅ | -| `config/webhook/manifests.yaml`: same | ✅ | -| `charts/gitops-reverser/templates/admission-webhook.yaml`: GitTarget validator only | ✅ | -| `charts/gitops-reverser/values.yaml`: remove `webhook.validating`, add `webhook.caBundle` | ✅ | -| `test/e2e/e2e_test.go`: remove 3 correlation webhook tests | ✅ | -| `task lint` passes | ✅ | -| `task test` (unit tests) passes | ✅ | - -### Remaining blocker -The `jane@acme.com` author assertion in the WatchRule e2e test fails because the audit -consumer's `XREADGROUP` can't find its consumer group. The consumer group is either not -being created persistently or is lost between Valkey restarts. This needs investigation -before the e2e suite can pass end-to-end. - -The `test/e2e/e2e_test.go` author assertion at line ~811 has been **restored** to its -original form (it was temporarily removed during investigation but then put back). The -test is correct and should not be weakened. - ---- - -## What the fix is likely to be - -Either: -- Enable Valkey persistence in the e2e cluster (`appendonly yes` or RDB snapshots), **or** -- Make `ensureConsumerGroup` retry with backoff (in case the group is lost after a Valkey - restart mid-session), **or** -- Move `ensureConsumerGroup` into the read loop so the group is re-created whenever - `NOGROUP` is encountered (self-healing approach): - -```go -func (c *AuditConsumer) readAndProcessBatch(ctx context.Context) error { - streams, err := c.client.XReadGroup(ctx, ...).Result() - if err != nil { - if strings.Contains(err.Error(), "NOGROUP") { - // Group was lost (Valkey restart?); recreate it. - _ = c.ensureConsumerGroup(ctx) - } - return fmt.Errorf("XREADGROUP failed: %w", err) - } - ... -} -``` - -The self-healing approach is safest for production resilience regardless of whether the -e2e Valkey is persistent. diff --git a/docs/finished/audit-metrics-overhaul-plan.md b/docs/finished/audit-metrics-overhaul-plan.md deleted file mode 100644 index 4b5a1a59..00000000 --- a/docs/finished/audit-metrics-overhaul-plan.md +++ /dev/null @@ -1,510 +0,0 @@ -# Implementation Plan: Audit Ingestion Metrics Overhaul - -> **Status: SUPERSEDED — moved to `finished/` 2026-06.** This plan targeted the -> audit *ingestion* pipeline (official↔additional body join, consumer, Redis stream). -> That architecture was retired: object state now comes from **watch**, and audit is an -> optional attribution lookup with no body join — so the join/skew/gate/pipeline metrics -> proposed here do not apply. The API-resource-catalog observability portion *did* ship -> (`api_catalog_*`). Kept for historical context; the live metric set is documented in -> [`../interpreting-metrics.md`](../interpreting-metrics.md). -> Scope (historical): audit ingestion pipeline observability, plus API resource catalog -> (watch path) observability — see the dedicated section near the end - -## Goal - -Make the **audit ingestion pipeline** observable enough to operate without -turning every internal branch into a metric. Today the webhook has event-level -metrics after decoding, but it has no request-level view of the inbound -`EventList` boundary. The consumer — the component that turns a Redis stream -entry into a Git write — emits no metrics at all. An operator cannot answer the -basic question "am I seeing a lot of pod create events flow through?" - -While we are in here, delete dead and misleading metrics and fix label -cardinality. The project is not yet used publicly, so metric names and labels -are free to change without a compatibility shim. - -## Operator questions - -This first cut should answer these questions without growing into a dashboard -for every controller: - -| Question | First-cut signal | -| --- | --- | -| Do official and additional audit payloads reach the webhook? | Request-level `audit_eventlists_total`, `audit_eventlist_events_total`, and `audit_eventlist_duration_seconds`, split only by source and bounded outcome. | -| Which canonical resource events reach the consumer often but do not become Git work? | `audit_pipeline_events_total` by GVR labels, `verb`, and non-`routed` outcome (`unmatched`, `dropped_no_body`, `route_failed`). | -| Did an event disappear inside this pipeline? | Compare the EventList ingress, join emissions/drops, and consumer outcomes at their stage boundaries. A receiver metric cannot prove that kube-apiserver never emitted or delivered an event before it reached this webhook. | -| Are my configured rules valid, and are they producing work? | `Ready` status on `WatchRule`, `ClusterWatchRule`, and `GitTarget` remains the configuration-health contract. Add a small GitTarget-grouped route metric for runtime traffic. | - -The boundary matters. Metrics should show whether events arrive, join, match, -and route. They should not replace CR status conditions for invalid references, -Git provider readiness, or GitTarget lifecycle failures. - -## Pipeline and metric map - -The audit ingestion pipeline has four stages. Metrics are emitted at the edge -of each stage; this diagram maps every audit-pipeline metric to where it is -recorded. It also makes the gaps visible — the raw EventList boundary and stage -③ have no metrics today. - -```mermaid -flowchart TD - KAS["kube-apiserver"] - PROXY["apiservice-audit-proxy"] - - subgraph S1["① Ingress — AuditHandler (webhook pod)"] - WH["receive + classify event quality"] - end - subgraph S2["② Join — AuditEventJoiner (webhook pod)"] - JOIN["park / merge / decide → one canonical event per auditID"] - end - STREAM[("Redis stream
gitopsreverser.audit.events.v1")] - subgraph S3["③ Consume — AuditConsumer (leader pod)"] - CONS["filter stage/verb · rule match · extract + sanitize object"] - end - subgraph S4["④ Route + write — EventRouter → BranchWorker"] - ROUTE["dedup → coalesce → commit → push"] - end - GIT[("Git commit")] - - KAS -->|official EventList| WH - PROXY -->|additional EventList| WH - WH --> JOIN - JOIN -->|canonical event| STREAM - STREAM --> CONS - CONS -->|matched + sanitized| ROUTE - ROUTE --> GIT - - M0["audit_eventlists_total
audit_eventlist_events_total
audit_eventlist_duration_seconds"] - M1["audit_events_received_total
audit_event_quality_total"] - M2["audit_join_parked / emitted / duplicate_dropped_total
audit_shallow_dropped / body_late_total
audit_join_skew_seconds
audit_official_gate_wait_seconds"] - M3["audit_pipeline_events_total
audit_pipeline_route_targets_total"] - M4["git_operations_total · commits_total
objects_written_total · git_push_duration_seconds"] - - WH -. metrics .-> M0 - WH -. metrics .-> M1 - JOIN -. metrics .-> M2 - CONS -. metrics .-> M3 - ROUTE -. metrics .-> M4 - - classDef metric fill:#fff3e0,stroke:#ff9800,color:#000; - classDef new fill:#e8f5e9,stroke:#43a047,stroke-width:2px,color:#000; - classDef stage fill:#e8f4fd,stroke:#2196f3,color:#000; - class M1,M2,M4 metric; - class M0,M3 new; - class WH,CONS,S1,S3 new; -``` - -The green metrics are **new** (changes 1-3). Stage ① needs the raw EventList -boundary; stage ③ needs consumer outcomes and a small GitTarget traffic signal. - -Note on the deleted metrics: `events_received_total` and -`events_processed_total` are **not** on this diagram on purpose. Their names -suggest they belong to this pipeline, but neither is recorded on any audit -stage — that mismatch is exactly why changes 7 and 8 remove them. - -## Current state - -Metrics are declared and registered in -[internal/telemetry/exporter.go](../../internal/telemetry/exporter.go). - -| Metric | Where recorded | Verdict | -| --- | --- | --- | -| EventList requests / decoded event items / request duration | — | **Missing — add** | -| `audit_events_received_total` | [audit_handler.go:367](../../internal/webhook/audit_handler.go#L367) | Keep, fix labels | -| `audit_event_quality_total` | [audit_joiner.go:730](../../internal/webhook/audit_joiner.go#L730) | Keep, fix labels | -| `audit_join_*` (parked/emitted/duplicate/shallow/body_late) | [audit_joiner.go](../../internal/webhook/audit_joiner.go) | Keep | -| `audit_join_skew_seconds`, `audit_official_gate_wait_seconds` | [audit_joiner.go](../../internal/webhook/audit_joiner.go) | Keep | -| `events_received_total` | nowhere (only tests) | **Delete — dead** | -| `events_processed_total` | informers.go:109 | **Delete — misleading** | -| consumer pipeline output | — | **Missing — add** | - -`events_processed_total` is misleading on two counts: the name implies the -ingestion pipeline but it is only touched by the watch/informer path, and that -path increments it even when `AuditLiveEventsEnabled` skips routing entirely -(informers.go:108-122) — so it -counts events that were never processed. - -## Changes - -### 1. Add the EventList ingress boundary - -Add request-level metrics around -[`AuditHandler.ServeHTTP`](../../internal/webhook/audit_handler.go#L146) for -recognized official/additional audit endpoints: - -``` -gitopsreverser_audit_eventlists_total{source, outcome} -gitopsreverser_audit_eventlist_events_total{source, outcome} -gitopsreverser_audit_eventlist_duration_seconds{source, outcome} -``` - -`source` stays `official` or `additional`. Keep `outcome` bounded: - -| `outcome` | Meaning | -| --- | --- | -| `processed` | A non-empty decoded EventList finished successfully | -| `empty` | A decoded EventList contained zero events | -| `decode_error` | The request body could not become an `audit.k8s.io/v1 EventList` | -| `process_error` | Event processing failed after decode | - -`audit_eventlists_total` and the duration histogram count request attempts at -the webhook boundary. `audit_eventlist_events_total` increments by -`len(eventList.Items)` only after decode, so `decode_error` has no event-item -sample. It answers "how many audit event items really arrived in EventLists?" -without abusing per-event GVR labels on a mixed batch. - -Do **not** add arbitrary paths, remote addresses, status-code labels, or GVR -labels here. If rejected methods or invalid paths need HTTP observability later, -instrument the audit server/mux boundary separately with another bounded HTTP -contract; this change is for EventLists delivered to the two audit sources. - -Example queries: - -```promql -# Are both audit sources delivering EventLists? -sum by (source, outcome) ( - rate(gitopsreverser_audit_eventlists_total[5m])) - -# How many audit event items arrive per second from each source? -sum by (source) ( - rate(gitopsreverser_audit_eventlist_events_total[5m])) - -# How long does the webhook take to answer, including join wait work? -histogram_quantile(0.95, - sum by (source, le) ( - rate(gitopsreverser_audit_eventlist_duration_seconds_bucket[5m]))) -``` - -### 2. Add the consumer pipeline-output metric - -New counter declared in [exporter.go](../../internal/telemetry/exporter.go): - -``` -gitopsreverser_audit_pipeline_events_total{group, version, resource, verb, outcome} -``` - -Recorded once per audit event in -[`routeAuditEvent`](../../internal/queue/redis_audit_consumer.go#L358) in -[internal/queue/redis_audit_consumer.go](../../internal/queue/redis_audit_consumer.go), -which currently has **no `telemetry.` calls**. `outcome` values: - -| `outcome` | Recorded at | Meaning | -| --- | --- | --- | -| `unmatched` | the `len(wrRules)==0 && len(cwrRules)==0` early return ([line 382](../../internal/queue/redis_audit_consumer.go#L382)) | No rule matched the event | -| `dropped_no_body` | the `errAuditEventObjectMissing` branch ([line 393](../../internal/queue/redis_audit_consumer.go#L393)) | Event matched a rule but had no usable body | -| `routed` | after `routeToMatchedRules` when `routed > 0` ([line 430](../../internal/queue/redis_audit_consumer.go#L430)) | Routed to at least one BranchWorker | -| `route_failed` | after `routeToMatchedRules` when rules matched but `routed == 0` | Every matched target route failed | - -Pre-`objectRef` filtering in -[`processMessage`](../../internal/queue/redis_audit_consumer.go#L311) (wrong -stage, non-mutating verb, nil `objectRef`) is intentionally **not** counted -here — those events have no reliable GVR and are already accounted for by the -ingress `audit_events_received_total`. - -The `group`/`version`/`resource` labels come from -`auditutil.ObjectRefGroupVersion(ref)` and `ref.Resource`, which -`routeAuditEvent` already extracts. `verb` is `auditEvent.Verb`. - -This single metric answers the target question: - -```promql -# "Am I seeing a lot of pod create events?" -sum by (resource) ( - increase(gitopsreverser_audit_pipeline_events_total{verb="create",outcome="routed"}[1h])) - -# pipeline output grouped by GV only (lower cardinality view) -sum by (group, version) ( - rate(gitopsreverser_audit_pipeline_events_total{outcome="routed"}[5m])) - -# Which frequent canonical events reach the consumer but do not become Git work? -topk(10, - sum by (group, version, resource, verb, outcome) ( - rate(gitopsreverser_audit_pipeline_events_total{outcome!="routed"}[5m]))) -``` - -### 3. Add a GitTarget-grouped route signal - -Add a target-level counter in -[`routeToMatchedRules`](../../internal/queue/redis_audit_consumer.go#L450): - -``` -gitopsreverser_audit_pipeline_route_targets_total{ - git_target_namespace, git_target, rule_kind, outcome -} -``` - -Record one sample per matched target route attempt. `rule_kind` has only -`watchrule` or `clusterwatchrule`; `outcome` has `routed` or `route_failed`. -This lets an operator ask whether runtime audit traffic is actually reaching a -GitTarget and whether routing into that target is failing: - -```promql -sum by (git_target_namespace, git_target, outcome) ( - rate(gitopsreverser_audit_pipeline_route_targets_total[5m])) -``` - -Do not add per-rule names in this first cut. The CRs already expose config -validity through status conditions, and a rule-name metric multiplies runtime -series by rule count. If target-grouped traffic plus consumer `unmatched` -outcomes still leave operators blind, revisit either a per-rule hit counter or -a status field such as "last matched at" in a follow-up design. - -### 4. Split the opaque `gvr` label into `group` / `version` / `resource` - -Four metrics carry a single opaque `gvr` string label (e.g. -`"apps/v1/deployments"`), built by -[`extractGVR`](../../internal/webhook/audit_handler.go#L505) and -[`auditEventGVR`](../../internal/webhook/audit_joiner.go#L709): a single opaque -string cannot be aggregated to GV in PromQL without `label_replace`. - -Replace the `gvr` label with three labels `group`, `version`, `resource` on -**all** metrics that carry it — `audit_events_received_total`, -`audit_event_quality_total`, `audit_shallow_dropped_total` -([audit_joiner.go:771](../../internal/webhook/audit_joiner.go#L771)), and -`audit_join_body_late_total` -([audit_joiner.go:780](../../internal/webhook/audit_joiner.go#L780)). -Cardinality is unchanged; the new metric in change 2 uses the -same three-label shape so the whole pipeline reads consistently. The -`extractGVR` / `auditEventGVR` string helpers can stay for **log** fields, or -be reduced to a small shared splitter — implementer's choice. - -Also rename the event-action label from `action` to `verb` on those audit -metrics. That value already comes from the Kubernetes audit `Verb` field, and -the new consumer metric uses the same name. There is no public metric -compatibility burden yet, so do the vocabulary cleanup now. - -### 5. Drop the `user` label from `audit_events_received_total` - -The `user` label ([audit_handler.go:371](../../internal/webhook/audit_handler.go#L371)) -is a cardinality bomb: every distinct user/ServiceAccount becomes a series, -multiplied by resource identity × verb × source. The username is already in the -structured logs (`recordReceivedMetric` logs it). Remove the label; keep the -log. - -### 6. Delete the `cluster` label - -`gitops-reverser` once accepted events from more than one cluster and carried a -`cluster` (cluster-ID) label as a metric dimension. Multi-cluster was removed -(see [architecture.md → Known gaps](../architecture.md), "the removed -`{clusterID}` path segment was a half-measure"). The label is a leftover and -must be deleted wherever it still appears. - -> Verification note: a grep of `internal/` and `cmd/` for a `cluster` metric -> attribute came back empty — the label may already be gone from the Go code. -> The implementer must still confirm and, if present, remove it from: metric -> `attribute.String("cluster", …)` calls, any Helm `ServiceMonitor` / -> relabeling config under `charts/`, and any bundled Grafana dashboard JSON. -> If nothing is found anywhere, record that explicitly so the task is closed -> rather than silently skipped. - -### 7. Delete `events_received_total` - -Remove the `EventsReceivedTotal` instrument and its `counters` registration -entry from [exporter.go](../../internal/telemetry/exporter.go). It is never -incremented in production code — only `exporter_test.go` references it. Delete -those test references too. - -### 8. Delete misleading watcher-path queue metrics - -Remove the `EventsProcessedTotal` instrument and its registration. Delete its -use in informers.go:108-111. -`ObjectsScannedTotal` on the adjacent line already covers "objects seen by the -informer path"; the audit pipeline is now covered by change 2. - -Delete `GitCommitQueueSize` too. Its current production increment is the same -watcher-path line in informers.go:110: -it increments before the `AuditLiveEventsEnabled` skip, and it is not paired -with a real queue-boundary decrement. A queue-depth gauge is useful only when -owned by the queue it describes; reintroduce one at that boundary in separate -Git write-path work if the remaining worker metrics do not cover it. - -### 9. Drop the `parked_kind` label from `audit_join_parked_total` - -`parked_kind` has exactly one possible value (`additional_body`) — see -[audit_joiner.go:748](../../internal/webhook/audit_joiner.go#L748) and the note -in [architecture.md](../architecture.md). A label with one value is noise. -Remove it. - -## API resource catalog observability (watch path) - -> Scope note: this is the **watch/informer path**, not the audit ingestion -> pipeline of changes 1-9. It is bundled into this doc because it is the same -> `telemetry` exporter work and the same "a metric without an interpretation -> is noise" bar. The two halves are otherwise independent. - -The `APIResourceCatalog` -([internal/watch/api_resource_catalog.go](../../internal/watch/api_resource_catalog.go)) -is GitOps Reverser's single trusted in-memory view of the cluster's served API -surface. It is refreshed from Kubernetes discovery by -[`Manager.RefreshAPIResourceCatalog`](../../internal/watch/manager_catalog.go#L68), -which runs: - -- once per `ReconcileForRuleChange` — i.e. on the **30 s periodic ticker**, on - every CRD/APIService trigger-informer event, and on every rule change; -- again inside `getClusterState`, once per GitTarget being snapshotted. - -Today it emits **no metrics**. An operator cannot see how large the catalog -is, how many resources the default watch policy excludes, whether discovery is -degraded, or how often the 30 s sweep actually changes anything. - -### Is the 30 s refresh heavy? - -No — but it is worth being able to prove that. One refresh is: - -1. One `ServerGroupsAndResources()` discovery call. On Kubernetes ≥ 1.27 with - aggregated discovery this is **two cached GETs** (`/api`, `/apis`) that the - apiserver serves from memory. Without aggregated discovery it falls back to - one GET per group/version — 100+ requests on a CRD-heavy cluster. -2. An in-memory diff (`catalogEntriesEqual`) and, only when something changed, - an index rebuild — both O(total resources), microseconds. - -So the cost is dominated by discovery **latency**, not CPU, and the apiserver -side is cheap. The two things actually worth watching are therefore (a) the -refresh **duration** — to catch a slow or non-aggregated apiserver — and (b) -the **changed/unchanged ratio**. A catalog that reports `changed` on every -sweep means something is flapping (e.g. an aggregated APIService going in and -out of `Available`), and *that* is the real cost — each change re-runs informer -reconciliation. A steady stream of `unchanged` is the healthy baseline and -confirms the 30 s cadence is doing nothing expensive. - -One inefficiency the metrics will expose: `getClusterState` calls -`RefreshAPIResourceCatalog` again per GitTarget, so one reconcile pass can -issue several discovery sweeps. The refresh counter against the generation -gauge makes that redundancy visible; collapsing it to one refresh per pass is -a cheap follow-up, not part of this change. - -### Proposed metrics - -All labels are bounded and tiny — no per-GVR cardinality here. - -``` -gitopsreverser_api_catalog_resources{state} gauge -gitopsreverser_api_catalog_group_versions{state} gauge -gitopsreverser_api_catalog_refresh_total{outcome} counter -gitopsreverser_api_catalog_refresh_duration_seconds histogram -gitopsreverser_api_catalog_generation gauge -``` - -| Metric | Labels | Meaning | -| --- | --- | --- | -| `api_catalog_resources` | `state` = `allowed` \| `excluded` | Count of served top-level resources in the catalog, split by `APIResourceEntry.Allowed`. `excluded` is the default-watch-policy set (pods, events, leases, jobs, …) from [resource_policy.go](../../internal/watch/resource_policy.go). Subresources are not counted. | -| `api_catalog_group_versions` | `state` = `trusted` \| `degraded` | Group/versions discovery served cleanly vs. ones it reported as failed (`catalogGroupVersionState.degraded`). A non-zero `degraded` is the signal that a broken aggregated APIService is hiding part of the surface. | -| `api_catalog_refresh_total` | `outcome` = `changed` \| `unchanged` \| `error` | One sample per `RefreshAPIResourceCatalog` call. `changed`/`unchanged` is `Refresh`'s returned bool; `error` covers discovery failure. | -| `api_catalog_refresh_duration_seconds` | — | Wall time of one refresh, including the discovery call. | -| `api_catalog_generation` | — | Current `APIResourceCatalog.Generation()`. `changes(...[1h])` shows churn at a glance. | - -Recording points: - -- `refresh_total` and `refresh_duration_seconds`: wrap `catalog.Refresh(disco)` - in [`RefreshAPIResourceCatalog`](../../internal/watch/manager_catalog.go#L74) - — it already has the `changed` bool and the error in scope. -- `resources`, `group_versions`, `generation`: set after a successful refresh - from a new small `APIResourceCatalog.Stats()` accessor (counts computed under - the existing `RLock`). Gauges are idempotent, so resetting them on every - refresh is correct. - -Example queries: - -```promql -# Is the 30 s sweep doing real work, or just confirming a stable surface? -sum by (outcome) (rate(gitopsreverser_api_catalog_refresh_total[15m])) - -# How many resources is GitOps Reverser actually willing to watch? -gitopsreverser_api_catalog_resources{state="allowed"} - -# Is part of the API surface hidden behind a broken APIService? -gitopsreverser_api_catalog_group_versions{state="degraded"} > 0 - -# Discovery latency — catches a non-aggregated or slow apiserver -histogram_quantile(0.95, - rate(gitopsreverser_api_catalog_refresh_duration_seconds_bucket[5m])) -``` - -Out of scope for this addition: per-GVR catalog series (a cardinality bomb — -the `Allowed`/`PolicyReason` detail belongs in logs and CR status, not -metrics), and a discovery-call counter separate from the refresh counter. - -## Out of scope (noted, not done here) - -- **Redis stream depth / consumer-lag metric** (`XLEN` / `XPENDING`). This is - the natural "is the pipeline keeping up?" signal and is currently missing. - It is a worthwhile follow-up but is a separate change with its own polling - concerns — not bundled into this overhaul. -- **Sender-side proof for events that never reach this receiver.** EventList - ingress tells us what entered the webhook. It cannot prove whether - kube-apiserver or a supplementary sender dropped an event before delivery. -- **Configuration-object health metrics.** `WatchRule`, `ClusterWatchRule`, - `GitTarget`, and `GitProvider` already publish status conditions for config - health. Keep that contract first; add metrics only for runtime flow here. -- **Per-rule hit metrics.** GitTarget-grouped route attempts and consumer - `unmatched` outcomes are the initial operator surface. Add rule-name series - only if real operation shows this is not enough. - -## Documentation updates - -- [docs/interpreting-metrics.md](../interpreting-metrics.md): add rows and - example queries for EventList ingress, `audit_pipeline_events_total`, and the - GitTarget route metric (the doc's own bar — "a metric without an - interpretation is noise"). Remove rows for deleted metrics. Update label - names where `gvr` became three labels and `action` became `verb`. - **Also embed the stage/metric mermaid diagram from this plan** at the top of - the "Audit join pipeline" section — it gives picture-thinkers a map of where - each metric lives before they read the per-metric rows. -- [docs/architecture.md](../architecture.md): update the **Metrics** table in - the Audit Ingestion Pipeline section (lines ~732-741) to the new label set - and the new metrics. -- [docs/interpreting-metrics.md](../interpreting-metrics.md): add a short - "API resource catalog" subsection for the five `api_catalog_*` metrics with - the changed/unchanged-ratio and `degraded` interpretations from above. - -## Validation - -Per [AGENTS.md](../../AGENTS.md), because this change touches Go code the full -sequence is mandatory: - -`task fmt` → `task generate` → `task manifests` → `task vet` → `task lint` → -`task test` → `task test-e2e` (e2e needs Docker; run e2e commands -sequentially). - -Specific checks: - -- `exporter_test.go` updated for the removed/added instruments. -- Handler tests asserting EventList request count, decoded event-item count, - and duration outcomes cover official, additional, empty, decode-error, and - processing-error requests. -- A consumer test asserting `audit_pipeline_events_total` is incremented with - the expected `outcome` for: a matched+routed event, an unmatched event, a - body-missing event, and a matched event whose target routes all fail. -- A route test asserting `audit_pipeline_route_targets_total` is grouped by - GitTarget and records routed/failed target attempts. -- Scrape `/metrics` in an e2e run and confirm official and additional EventList - ingress series appear, and no `cluster`, `gvr`, or `action` label remains on - any audit series. -- A catalog test asserting `api_catalog_refresh_total` records `changed` on a - first refresh and `unchanged` on an immediate second refresh of identical - discovery data, and that `api_catalog_resources{state="excluded"}` reflects - the default-watch-policy set. - -## Resulting audit-pipeline metric inventory - -| Metric | Labels | Stage | -| --- | --- | --- | -| `audit_eventlists_total` | `source`, `outcome` | ingress request boundary **(new)** | -| `audit_eventlist_events_total` | `source`, `outcome` | ingress request boundary **(new)** | -| `audit_eventlist_duration_seconds` | `source`, `outcome` | ingress request boundary **(new)** | -| `audit_events_received_total` | `source`, `group`, `version`, `resource`, `verb` | ingress | -| `audit_event_quality_total` | `source`, `quality`, `group`, `version`, `resource`, `verb` | ingress | -| `audit_join_parked_total` | — | ingress (join) | -| `audit_join_emitted_total` | `source`, `result` | ingress (join) | -| `audit_join_duplicate_dropped_total` | `reason` | ingress (join) | -| `audit_shallow_dropped_total` | `group`, `version`, `resource`, `verb` | ingress (join) | -| `audit_join_body_late_total` | `group`, `version`, `resource`, `verb` | ingress (join) | -| `audit_join_skew_seconds` | `arrival`, `outcome` | ingress (join) | -| `audit_official_gate_wait_seconds` | — | ingress (join) | -| `audit_pipeline_events_total` | `group`, `version`, `resource`, `verb`, `outcome` | **consumer (new)** | -| `audit_pipeline_route_targets_total` | `git_target_namespace`, `git_target`, `rule_kind`, `outcome` | **consumer route (new)** | - -Net: **+5 metrics**, **−3 metrics** (`events_received_total`, -`events_processed_total`, `git_commit_queue_size`), **−2 labels** (`user`, -`cluster`), **−1 label** (`parked_kind`), and event labels read consistently as -`group`/`version`/`resource`/`verb` across the pipeline. diff --git a/docs/design/audit-webhook-tls-design.md b/docs/finished/audit-webhook-tls-design.md similarity index 100% rename from docs/design/audit-webhook-tls-design.md rename to docs/finished/audit-webhook-tls-design.md diff --git a/docs/finished/canonical-stream-retirement.md b/docs/finished/canonical-stream-retirement.md deleted file mode 100644 index adcc259a..00000000 --- a/docs/finished/canonical-stream-retirement.md +++ /dev/null @@ -1,431 +0,0 @@ -# Retiring the canonical stream: relocating `/scale` and CommitRequest - -> Status: **DONE — all stages landed 2026-06-11 (C-A1, C-A2, C-B1, C-B2, C-C).** The canonical -> stream `gitopsreverser.audit.events.v1`, the `AuditConsumer`, its consumer-group/leader-election/ -> auto-claim machinery, the canonical queue metrics, and the Joiner's `auditID` decision dance no -> longer exist; the webhook is decode→classify→merge→mirror and every consumer reads the per-type -> substrate. Original framing kept below for the record. -> -> Originally: proposed — the design for finishing R3's "single-stream audit fan" kill. The -> per-type splice (R2) already carries every full-object create/update/delete, so the -> cluster-wide canonical stream `gitopsreverser.audit.events.v1` and its leader-elected -> `AuditConsumer` are down to **two** jobs: the `/scale` subresource field-patch and the -> CommitRequest window finalize. This doc relocates both onto the per-type substrate and then -> deletes the canonical stream + consumer outright. It is the concrete form of the -> [api-source-of-truth-reconcile.md](api-source-of-truth-reconcile.md) §5.1 "Single-stream audit -> fan" demolition row and the "AuditConsumer side-jobs — preserve/relocate" line in -> [current-flows-and-cutover.md](current-flows-and-cutover.md) §4. -> Captured: 2026-06-11 · Owner: Simon -> Related: -> [api-source-of-truth-reconcile.md](api-source-of-truth-reconcile.md) (R2/R3, §5.1 demolition), -> [current-flows-and-cutover.md](current-flows-and-cutover.md) (the dual-path "you are here" map), -> `audit-log-ingestion-and-ordering.md` (the per-type log producer; IR1/§5.4 updated here), -> `architecture-and-bootstrap.md` (the runtime map; the `CONS` node + §6 row this retires), -> [../manifest/version2/subresource-scope-reduction.md](../design/manifest/version2/subresource-scope-reduction.md) (the scale-only subresource scope). - -## 1. One paragraph - -The canonical stream was the original "audit drives Git" intake: one cluster-wide stream, one -leader-elected consumer that matched rules and routed per-event writes. R2 moved full-object -mirroring to the per-type `:audit:stream` + splice, so the consumer's object path is already a -no-op ([`routeAuditEvent`](../../../internal/queue/redis_audit_consumer.go#L378) returns early when -`Subresource == ""`). What still rides the canonical stream is exactly two things, and both are -"a change that belongs to some other object": - -- **`/scale`** is a mutation of a parent (`deployments`) `spec.replicas`. It belongs in the - parent's per-type stream, in resourceVersion order — **the right place in the audit log** — not - on a separate cluster-wide hop. -- **CommitRequest create** is a *control signal* ("finalize the window now") whose only hard - requirement is ordering: every mutation the author made before it must already be in the window. - That ordering is the parent's `resourceVersion` used as a **cross-type watermark**, not the - position in a single shared stream. - -Relocate scale into the parent stream (a marked field-patch entry, consumed by the existing -freshness tail and splice), drive CommitRequest finalize from its own controller behind an RV -watermark barrier, and the canonical stream has **no consumer left** — delete it, the -`AuditConsumer`, and the consumer-group/leader-election/auto-claim machinery with it. - -## 2. Is the canonical stream really vestigial? (the push-back) - -Yes — with three things consciously handled. Tracing every current consumer of -`gitopsreverser.audit.events.v1`: - -| What the canonical path does today | Still needed? | Where it goes | -|---|---|---| -| Full-object create/update/delete mirroring | **Already gone** — `routeAuditEvent` no-ops top-level objects | per-type `:audit:stream` + splice (R2, landed) | -| `/scale` → parent `spec.replicas` field-patch | yes | **DEC-A** — parent per-type stream | -| CommitRequest create → finalize window + status | yes | **DEC-B** — CommitRequest controller + RV watermark barrier | -| Leader-elected single consumer | only as an HA seam | **DEC-C** — the watch.Manager already owns the per-type tails/driver; HA is one story (R10), not two consumers | -| `XLEN` / consumer-lag metrics on the canonical stream | replaceable | per-type `:audit:idstate` counters (already emitted) | -| **Joiner — body merge** (official-shallow + additional body → complete event) | yes — but orthogonal | **kept** — it is about body *completeness*, not the canonical stream; see §4.1 | -| **Joiner — `auditID` dedupe + "commit decision" anchor** | **no — droppable, the non-obvious win** | **DEC-C / §4.1** — the RV-keyed stream + idempotent splice make duplicate delivery free, exactly like content hashing (R7); delete the decision dance | - -The row people conflate with hashing is the last one. The -[`AuditEventJoiner`](../../internal/webhook/audit_joiner.go) is **two bundled jobs**, and they -have opposite fates (full analysis + diagram + code in **§4.1**): - -- **Body merge** is load-bearing and *orthogonal* to this work — it exists because the official - kube-apiserver audit is often **shallow** (no request/response body, e.g. aggregated APIServices), - so a supplementary `/audit-webhook-additional` proxy supplies the body, parked in Redis by - `auditID` and merged into the official event before it is written. The splice needs that body. Keep it. -- The **`auditID` dedupe + commit-decision anchor** (`claim`/`commit`/`release` on - `audit:decision:v1:`) is the part my earlier draft worried about "re-anchoring." It turns - out we should **delete** it, not re-anchor it: a duplicate delivery now lands in a per-type stream - at the *same* RV and is absorbed by the idempotent fold + writer no-op detection — the **same - argument R7 uses to drop content hashing**. So removing the canonical stream lets the dedupe half - go for free; only the stateless body-merge remains. - -## 3. Requirements - -| # | Requirement | -|---|---| -| **CR1** | **No canonical stream.** `gitopsreverser.audit.events.v1` and the `AuditConsumer` are deleted, not left dormant. The webhook writes only per-type streams. | -| **CR2** | **`/scale` lands in the parent type's log, in RV order.** A scale of `deployments/foo` is an entry in `…:deployments:audit:stream` at the parent's post-scale resourceVersion — consumed by the same freshness tail and splice as every other parent change. | -| **CR3** | **`/scale` reuses the existing field-patch writer.** No new apply path: the entry resolves to a `git.FieldPatch` event ([`applyFieldPatch`](../../internal/git/plan_flush.go#L204)) on the freshness side and a `spec.replicas` mutation on the splice side. Only the *source* of the field-patch changes. | -| **CR4** | **CommitRequest finalize preserves the ordering guarantee** that every mutation made before the CommitRequest is included in the finalized commit — now via the CommitRequest's `resourceVersion` as a cross-type watermark, not single-stream position. | -| **CR5** | **CommitRequest leaves the audit *consumer*.** It is a control object — never checkpointed, never materialized, no stream consumer drives it; its finalize is driven by its own controller. Its per-type mirror entry remains (every mutating event is mirrored, IR8) and is read **on demand** by the controller as the attribution source: the author comes from the CR's own create audit event, exactly as in the consumer era. | -| **CR6** | **Body completeness survives; the dedupe goes.** The official↔additional body merge keeps working; the `auditID` decision/dedupe dance is deleted because the RV-keyed stream absorbs duplicates (same basis as R7). | -| **CR7** | **Subtractive.** The net diff is red: the consumer, its CommitRequest handler, the canonical queue/metrics, and the scale routing on the consumer all go. | - -## 4. Decisions - -### DEC-A — `/scale` becomes a marked field-patch entry in the **parent** stream *(CR2, CR3)* - -**Chosen.** Today a scale event folds onto a *sibling* key (`deployments.scale:audit:stream`, -[`typeBaseKey`](../../internal/queue/redis_bytype_queue.go#L573)) that nothing in the R2 path -reads — so when R3 deletes the consumer, scale freshness would vanish until the next checkpoint -LIST happens to re-LIST the parent with its new replicas. Instead, mirror the scale event into the -**parent** type's stream, keyed at the parent's post-scale `resourceVersion` (the `Scale` -responseObject carries it), retaining `subresource=scale` as the discriminator field already -present in [`entryValues`](../../internal/queue/redis_bytype_queue.go#L511). It then orders -naturally among the parent's other writes (a scale always bumps the parent RV above its prior -value) and both per-type consumers learn one new entry kind: - -- **Freshness tail** ([`auditChangeFromEntry`](../../internal/queue/redis_bytype_queue.go#L289)): - today it *skips* `subresource != ""`. Change it so `subresource == "scale"` is translated — - via the existing [`translateScaleToAssignments`](../../internal/queue/subresource_translate.go#L47) - + `buildFieldPatchEvent` — into a `git.FieldPatch` `git.Event` (no `Path`; the tail stamps it per - GitTarget, exactly as for object events). The writer's `applyFieldPatch` does the rest. **This is - the same field-patch the `AuditConsumer` built; only the source stream changes.** -- **Splice fold** ([`foldAuditEntry`](../../internal/queue/redis_type_splice.go#L137)): today it - *skips* `subresource != ""`. Change it so `subresource == "scale"` mutates `spec.replicas` on the - existing `desired[identity]` (the parent object from the checkpoint or an earlier log entry) at - the known [`BuiltinScaleReplicasPath`](../../internal/auditutil/subresource_policy.go#L51). If - the parent is not in `desired` yet, skip (the next checkpoint backstops it, DEC-5). **The splice - must fold scale, or a correctness reconcile would revert replicas to the checkpoint value and - flip-flop against the freshness tail** — see §5. - -*Translate at consume time, not in the webhook.* The producer stays a pure capture layer (IR8) — -it only routes the scale event onto the parent key. The scale→replicas interpretation -(`BuiltinScaleReplicasPath`, reading `spec.replicas`) lives where the field-patch machinery and -GVR knowledge already are (the consumer side), so the webhook never imports `manifestedit`. A scale -on a CRD/aggregated parent with no known replica path is dropped at translation, unchanged. - -*Doc impact:* this revises `audit-log-ingestion-and-ordering.md` -**IR1/§5.4** for `/scale` specifically — scale no longer keys onto its own `…scale` segment; it is a -parent-stream entry tagged `subresource=scale`. (Other subresources never reach Redis — -[`shouldForwardSubresource`](../../internal/webhook/audit_handler.go#L697) drops them — so scale -is the only subresource the change touches.) - -### DEC-B — CommitRequest finalize = controller-driven, behind an RV watermark barrier *(CR4, CR5)* - -**Chosen.** The [`CommitRequestReconciler`](../../internal/controller/commitrequest_controller.go) -already watches the CRD and today only stamps `WaitingForAuditEvent`, deliberately leaving the -finalize to the audit consumer "so it runs after the author's earlier mutations." That rationale was -**single-stream total order**. Sharded per type, the equivalent is the CommitRequest's own -`resourceVersion` (`rv_C`) as a **global etcd-revision watermark**: every mutation the author made -before creating it has `RV < rv_C` (they committed earlier), and the per-type streams are RV-keyed, -so "before the CommitRequest" is a precise, cross-type test. - -So move the finalize *into the controller* and delete the consumer's CommitRequest path entirely: - -1. On the **first** reconcile (`phase == ""`), capture `rv_C = commitRequest.ResourceVersion` - (the create revision — captured before the status stamp, which would bump it) and stamp - `WaitingForAuditEvent` as today. -2. Drive a **watermark finalize** for the referenced GitTarget `G`: for each of `G`'s claimed type - tails, wait until the tail has *applied* (enqueued onto `G`'s BranchWorker) every entry with - stream-ID `< rv_C` — i.e. drain `G`'s tails to the watermark. Because the BranchWorker is a - single FIFO writer, enqueuing the finalize *after* those upserts guarantees the commit contains - them (§6). -3. Enqueue the existing `FinalizeSignal` - ([`FinalizeGitTargetWindow`](../../internal/watch/event_router.go#L123) → the worker's - finalize path) and write the terminal phase with the unchanged - [`applyFinalizeResultToStatus`](../../../internal/queue/commit_request.go#L214). - -The controller gets native requeue/retry, status conflict handling, and leader election for free — -all of which the consumer hand-rolled. The audit pipeline no longer knows CommitRequest exists. - -*Why controller-driven and not "a CommitRequest entry in its own per-type stream"?* Both need the -same RV barrier, but the stream variant re-derives the object (and `rv_C`) the controller already -holds, and re-implements retry/leader-election the controller already has. The barrier — not the -trigger's location — is the load-bearing part. See §7 for the "typed handler" generalization, which -the barrier makes optional rather than necessary. - -*As landed (C-B2, revised in-session) — the author gate STAYS; attribution rides the audit path.* -A first cut dropped the author match ("the controller can't know the creator"), and was rejected: -a CommitRequest must never finish someone else's window. The insight that restores the gate: -**every request enters through the audit ingestion path — the CommitRequest's create included** — -and `mirrorByType` already lands it in `…commitrequests:audit:stream`. So the controller runs a -small state machine: - -1. **ATTRIBUTE** — `WaitingForAuditEvent` is literal: poll the commitrequests per-type stream - (newest-first, matched by namespace/name + UID guard, late lane included) until the CR's own - create event appears; take the author from it (`resolveUserInfo`, impersonation-aware). Not - observed within 60s → terminal `Failed` ("could not attribute") — an unattributable save is an - error, fail closed. Attribution doubles as the **ordering pacer**: everything the author did - before creating the CR entered the ingest path before the CR's own event, so once attribution - succeeds those mutations are already mirrored and the snapshot+barrier provably covers them. - This closed the race the first e2e run exposed (a controller watch event outruns audit ingest; - the finalize either found no window or a window missing the just-made edit). -2. **DELAY (optional)** — `spec.delaySeconds` (0–300) holds the finalize after creation as an - extra collect window; the author's further changes still join the open window. The window can - still be closed earlier by another author's change (the window-roll behaviour is untouched) or - by the provider's commit-window timer. -3. **FINALIZE, author-bound** — fresh snapshot, barrier, then the strict author+target match. An - open window belonging to a different author/GitTarget replies with the distinct - `FinalizeWindowMismatch` outcome: the foreign window is left open and the CommitRequest - terminates as `NoOpenWindow` with the message "the open commit window belongs to a different - author or GitTarget". - -### DEC-C — delete the canonical Queue + AuditConsumer; re-anchor the Joiner *(CR1, CR6, CR7)* - -**Chosen.** With DEC-A and DEC-B landed the canonical stream has no reader. Then: - -- `cmd/main` stops constructing the canonical `Queue` - ([`NewRedisAuditQueue`](../../internal/queue/redis_audit_queue.go)), the `AuditConsumer` - ([main.go:376](../../cmd/main.go#L376)), and the canonical-stream metrics reporter; the - `--audit-redis-stream` / decision-TTL-for-canonical flags retire. -- [`enqueueCanonicalEvent`](../../internal/webhook/audit_handler.go#L495) collapses to - `mirrorByType`. The webhook path becomes **decode → quality-classify → body-merge → mirror per-type**. -- **Drop the join decision dance, don't re-anchor it (§4.1).** Delete `claimDecision` / - `CommitDecision` / `ReleaseDecision` and the `audit:decision:v1:` key; the Joiner keeps - only the stateless body machinery (`parkBody` / `peekBody` / `waitForBody` / `mergeParkedBody`). A - duplicate official is no longer suppressed here — it re-mirrors at the same RV stream-ID and the - idempotent fold + writer no-op detection absorb it (R7's argument). This *removes* the - durable-accept subtlety that the canonical enqueue used to carry, rather than relocating it. -- Delete `redis_audit_consumer.go`, `commit_request.go`'s consumer methods, and the consumer's - scale routing; keep `translateScaleToAssignments` + `buildFieldPatchEvent` (moved to - `subresource_translate.go`) for DEC-A, and keep `extractObject`/`resolveUserInfo`/`parseAuditEvent` - (already shared by the splice and tail). - -### 4.1 — The Joiner: keep the merge, drop the dedupe - -The Joiner is the part of the webhook that is *not* about Git at all — it makes one **complete** -audit event out of a possibly-shallow official event plus a body supplied by a second source. Its -shape today: - -```mermaid -flowchart LR - APISERVER["kube-apiserver audit"] -->|"/audit-webhook
(official — identity, often NO body)"| QUAL - PROXY["apiservice-audit-proxy"] -->|"/audit-webhook-additional
(body only, for aggregated APIs / redacted policy)"| QUAL - - subgraph WH["AuditHandler (webhook)"] - QUAL["classify quality
complete? shallow? collection?"] - subgraph JOIN["AuditEventJoiner"] - direction TB - PARK["park additional body
audit:body:v1:<auditID> (TTL)"] - MERGE["shallow official + parked body
→ one COMPLETE event ✅ KEEP"] - DEDUP["auditID decision key
claim-NX / commit / release
audit:decision:v1:<auditID> ❌ DROP"] - end - MIR["mirrorByType → per-type :audit:stream"] - end - - QUAL --> JOIN --> MIR - PROXY -.->|"why it exists:
official audit can't see
aggregated-API bodies"| MERGE -``` - -**Where the commit-decision anchor lives.** The handler runs the join, then today writes the -canonical stream, then *commits* the decision: - -```go -// internal/webhook/audit_handler.go — today -if err := h.enqueueCanonicalEvent(ctx, eventToWrite, auditEvent, joinDecision); err != nil { - return err // enqueueCanonicalEvent: Queue.Enqueue(canonical) THEN h.mirrorByType(...) -} -if err := h.commitJoinDecision(ctx, joinDecision); err != nil { // promote claim → "emitted" - return err -} -``` - -```go -// internal/webhook/audit_joiner.go — the dedupe state machine -func (j *RedisAuditEventJoiner) claimDecision(ctx, auditID) (bool, error) { // SET NX → first writer wins - ... SetArgs{Mode: "NX", TTL: j.decisionTTL} ... -} -func (j *RedisAuditEventJoiner) CommitDecision(ctx, auditID, result) error { // state="emitted" - ... j.client.Set(ctx, decisionKey(auditID), payload, j.decisionTTL) ... -} -func (j *RedisAuditEventJoiner) ReleaseDecision(ctx, auditID) error { // undo claim on enqueue failure - ... j.client.Del(ctx, decisionKey(auditID)) ... -} -``` - -That `decisionKey` machinery is a **distributed exactly-once gate**: it guarantees a given `auditID` -is written to the *single* canonical stream once, even across retries and the two sources. It is the -`auditID` analogue of the content hash — and it dies for the same reason: - -- A duplicate official (webhook retry) without the gate now re-runs `mirrorByType`, which does - `XADD -* …` into the per-type stream. The duplicate carries the **same object RV**, so it - lands at the same RV (a fresh sub-sequence) — never the late lane (equal RV ≠ "strictly older"). -- The **splice** folds last-writer-wins by position: two entries for the same identity at the same RV - decode to the same object → identical `desired`. The **freshness tail** upserts it twice → the - second is an `EditNoChange` at the commit boundary. So a duplicate costs one redundant stream - entry and **zero** Git effect — precisely the "no-op write amplification" the ingestion doc already - measured as benign (`audit-log-ingestion-and-ordering.md` §8.2). - -So **drop** `claim`/`commit`/`release` and the decision key entirely. The Joiner reduces to: - -```text -additional source → parkBody(auditID, body, TTL) -official source → if shallow: peekBody / waitForBody(auditID); merge; emit (else emit as-is) -emit → mirrorByType (no decision key, no NX, no commit/release) -``` - -The only things lost are diagnostics (`AuditJoinDuplicateDroppedTotal`, `AuditJoinBodyLateTotal`) — -replaceable by the per-type `idstate` counters — and the micro-optimisation of *not* parking a body -whose official already emitted (now it just parks and expires by TTL: correct, slightly more Redis -writes). A late additional body with no official to meet simply ages out, as it effectively does today. - -**Could we drop the whole Joiner, body-merge included?** Only by changing the **deployment -contract**: if every watched type's audit is guaranteed to carry full request/response bodies -(apiserver audit at `RequestResponse` level, and no aggregated APIServices needing the proxy), then -every official is `Complete`, `mergeParkedBody` is never exercised, and the second webhook + -park/merge can go too. That is a real capability decision (it drops aggregated-API and -redacted-policy support), **orthogonal** to retiring the canonical stream — so it is an open question -(§9), not part of this cut. This cut keeps the merge and deletes only the dedupe. - -## 5. The `/scale` relocation, specified - -```mermaid -flowchart TD - SCALE["audit: deployments/foo /scale
responseObject = Scale @ parent rv R'"] - MIR["mirrorByType
(parent key, subresource=scale field)"] - PSTREAM[":deployments:audit:stream
entry id = R'-subseq, subresource=scale"] - SCALE --> MIR --> PSTREAM - - subgraph FRESH["Freshness tail (sub-checkpoint)"] - T["auditChangeFromEntry:
subresource=scale → FieldPatch event"] - FP["writer applyFieldPatch:
patch parent spec.replicas"] - PSTREAM --> T --> FP - end - subgraph CORR["Splice (correctness, off checkpoint)"] - F["foldAuditEntry: subresource=scale →
set desired[parent].spec.replicas"] - PLAN["BuildScopedPlan → one commit"] - PSTREAM --> F --> PLAN - end -``` - -Why the splice **must** fold scale (not just the tail): a correctness reconcile rebuilds `desired` -from `checkpoint@R + log-after-R`. A scale that happened *after* R is only in the log. If the fold -ignored it, `desired[parent].spec.replicas` would be the checkpoint value (replicas@R), the planner -would re-render the parent and **revert** the live scale, and the freshness tail — which has no new -event to replay — would not correct it until the next checkpoint. Folding the scale entry makes the -splice's desired set agree with what the tail already wrote. Edge cases (`Scale` body missing an RV, -or the parent absent from `desired`) degrade to freshness-best-effort and are backstopped by the -next checkpoint LIST, exactly like RV-less events (DEC-5). - -## 6. The CommitRequest watermark barrier, specified - -```mermaid -sequenceDiagram - autonumber - participant Author - participant API as kube-apiserver - participant WH as audit webhook - participant Streams as per-type :audit:stream (×N) - participant Tails as G's per-type tails - participant BW as G's BranchWorker (FIFO) - participant CRC as CommitRequestReconciler - - Author->>API: PUT cm/a (rv 101), PUT deploy/b (rv 102) - API-->>WH: audit(101), audit(102) - WH-->>Streams: mirror cm@101, deploy@102 - Author->>API: CREATE CommitRequest (rv_C = 105) - API-->>CRC: watch event (phase=="") - CRC->>CRC: capture rv_C=105, stamp WaitingForAuditEvent - Streams-->>Tails: deliver 101,102 - Tails->>BW: enqueue upserts cm/a, deploy/b - CRC->>Tails: BARRIER: wait each G-tail applied past rv_C (105) - Note over Tails: cursor ≥ 105, OR stream high-water < 105 and cursor caught up - CRC->>BW: EnqueueFinalize (after the upserts, FIFO) - BW->>BW: flush open window → one commit (contains a, b) - CRC->>API: write terminal status (Committed/NoOpenWindow/Failed) -``` - -**The barrier condition, per claimed type `T` of `G`:** the tail has consumed all entries with -stream-ID `< rv_C`. Equivalently, wait until `cursor_T ≥ min(rv_C, highWater_T-at-observation)`: - -- `cursor_T ≥ rv_C` → the tail has read at/past the watermark; all pre-C entries of `T` are applied. -- `highWater_T < rv_C` → `T` has no entry as new as the CommitRequest; wait only for the tail to - drain to that high-water (nothing pre-C is left unread once it does). - -Because each tail applies in RV order and enqueues onto `G`'s single FIFO BranchWorker, satisfying -the barrier for every claimed type means **all pre-C upserts are already queued ahead of the -finalize** — so the flushed commit contains them. Implementation: each per-type tail exposes its -last-applied stream-ID (a cursor read); a small drain-coordinator the reconciler calls blocks on the -condition above across `G`'s claimed types (from the watched-type table), with a bounded timeout -that falls back to a plain finalize (degrade to "commit what's there," never hang a reconcile). - -**Residual race — honestly, the same one we have today, and how the trigger gap closed.** The -barrier guarantees every pre-C mutation *already delivered to its stream* is applied. It cannot -include a pre-C mutation whose audit event is still in flight (webhook hasn't mirrored it) or -arrived out of order into the **late lane** (measured ~3.2%, -`audit-log-ingestion-and-ordering.md` §7). The canonical -design had the same in-flight gap, but its *trigger* rode the same ingest path as the mutations -(the CR's own audit event), which roughly equalized the delays. A controller watch event arrives -**faster** than audit ingest, and the first C-B2 e2e run proved it immediately (the generateName -spec's edit + save back-to-back produced a finalize that ran before the edit was mirrored). -**Landed answer: re-anchor the trigger on the audit path** — the controller does not finalize -until the CommitRequest's *own* create event is observed in its per-type stream (the DEC-B -attribution step). Mutations made before the CR entered the ingest path before the CR's event, -so observation of the CR's event implies theirs are mirrored; the snapshot+barrier then orders -them into the window. What remains uncovered is exactly the old gap: ingest-path *reordering* -(late lane), backstopped by the next checkpoint sweep (bulk attribution, R11/DEC-5). - -## 7. The generalization (optional, not required) - -DEC-B can be read as one instance of a **typed per-type-stream handler**: the default handler is the -splice/freshness reconcile (mirror to Git); a *control type* binds a different handler. CommitRequest -would be "the control type whose handler is finalize-at-watermark." This is an attractive symmetry — -"every signal is a typed stream entry, dispatched by type" — and it is where the architecture could -go if more control verbs appear (e.g. a future "atomic write" or "tag" request). - -We are **not** building the registry now, because the watermark barrier (§6) is the actual hard -part and is identical whether the trigger is a stream entry or a controller watch — and the -controller watch is strictly less code (it already has the object, `rv_C`, retries, and leader -election). The barrier is the reusable primitive; expose it as -`FinalizeAtWatermark(gitTarget, rv)` on the EventRouter/BranchWorker seam so that if the typed-handler -model is wanted later, the control handler just calls the same primitive. Build the abstraction when a -second control type asks for it, not before (matches the "simplify, don't just add" stance). - -## 8. Implementation stages (subtractive, each ends green) - -Order is forced by one rule: **a relocation lands and is proven before the canonical path it -replaces is deleted** (the same discipline R2→R3 used). - -| Stage | Change | Done when | -|---|---|---| -| **C-A1** ✅ *(landed 2026-06-11)* | Producer: route `/scale` onto the parent key, keep `subresource=scale` field (revise IR1/§5.4). | scale events appear in the parent `:audit:stream` at the parent RV; the `…scale` sibling stream is gone. | -| **C-A2** ✅ *(landed 2026-06-11)* | Consumers: `auditChangeFromEntry` (tail) and `foldAuditEntry` (splice — via `foldScaleEntry`) handle `subresource=scale`; `translateScaleToAssignments` already lived in `subresource_translate.go`. The consumer's scale routing was deleted outright (routeAuditEvent/routeScaleFieldPatch/routeEvents/routeOne/buildFieldPatchEvent + the pipeline metrics they alone emitted) rather than left disabled — less to demolish in C-C. | a scale is reflected in Git via the freshness tail within a window **and** survives a correctness reconcile (no replicas flip-flop); e2e for `/scale` green with the consumer's scale path disabled. | -| **C-B1** ✅ *(landed 2026-06-11; snapshot API revised 2026-06-11)* | Add the watermark drain-coordinator (per-tail cursor + `FinalizeAtWatermark`). Implemented: each tail records its last-APPLIED stream ID (anchor at start, advanced only after a batch's apply returns); **`Manager.TakeTypeSnapshot(ctx, gitDest)`** reads each claimed type's current stream top via the optional `auditHighWaterReader` capability — per-type, no cross-type RV comparison, correct for aggregated-API types; **`Manager.DrainTailsToSnapshot(ctx, snapshot, timeout)`** polls the §6 condition per type in the snapshot (cursor ≥ snapshot[T]; empty/opaque → skip; no-tail → skip; polls only in-memory cursor map — no Redis during wait loop); **`EventRouter.FinalizeAtWatermark(…, snapshot)`** = drain + finalize, returning `barrierReached` for the Option-A degrade; **`EventRouter.TakeTypeSnapshot`** exposes the snapshot builder to the future CommitRequestReconciler (C-B2). Design rationale: [commitrequest-multi-finalize-design.md](commitrequest-multi-finalize-design.md). | a barrier unit test proves "finalize includes all pre-snapshot upserts per type." | -| **C-B2** ✅ *(landed 2026-06-11)* | Finalize moved into `CommitRequestReconciler` as the DEC-B state machine: uncached re-read (stale-cache guard) → stamp → **ATTRIBUTE** (poll the CR's own create event in `…commitrequests:audit:stream` via `LookupCommitRequestAuthor`; 60s bound → `Failed` fail-closed) → optional **`spec.delaySeconds`** collect window (new CRD field, 0–300) → fresh `TakeTypeSnapshot` → `FinalizeAtWatermark` with the **attributed author** (Option-A 15s bound, `commitrequest_barrier_timeouts_total`, visible degrade in `status.message`) → terminal status with bounded conflict retry. The author gate is strict; a foreign window replies `FinalizeWindowMismatch` → phase `NoOpenWindow` + explanatory message. Landed **simpler** than the coordinator proposal (delta in [commitrequest-multi-finalize-design.md](commitrequest-multi-finalize-design.md) §12): `MaxConcurrentReconciles=1` IS the multi-CommitRequest serialization; the snapshot is re-taken fresh per attempt (no annotation persistence); attribution-on-the-audit-path replaces any rv_C capture AND closes the §6 trigger race the first e2e run exposed. The consumer's `isCommitRequestCreate`/`handleCommitRequest`/`writeCommitRequestStatus` were deleted along with its dead `ruleStore`/`eventRouter`/kube-client fields; the consumer is now a pure ACK-drainer awaiting C-C. | the CommitRequest e2e is green driven entirely by the controller; the consumer no longer references CommitRequest. | -| **C-C** ✅ *(landed 2026-06-11)* | Deleted: the canonical `Queue` surface (`NewRedisAuditQueue`/`DefaultRedisAuditStream`; the stream-append mechanics survive unexported under the debug queue only), the whole `AuditConsumer` + group/auto-claim machinery (`redis_audit_consumer.go` → shared parsing helpers extracted to `audit_event_parsing.go`), the `MetricsReporter` + its six canonical gauges, the dead `AuditPipeline*` counters, the `--audit-redis-stream`/`--audit-event-decision-ttl` flags and their chart values, and the Joiner's `claim`/`commit`/`release` + `audit:decision:v1:*` key + `AuditJoinDuplicateDroppedTotal`/`AuditJoinBodyLateTotal`. The Joiner is merge-only (`parkBody`/`waitForBody`/`mergeParkedBody`; an additional body parks unconditionally and ages out by TTL); `AuditEventJoiner` = `Decide` alone; the handler is decode→classify→merge→`mirrorByType` (the official-source gate mutex stays — it now orders the per-type RV-keyed appends). Duplicate-absorption proof: `TestRedisTypeSplicer_DuplicateDeliveryFoldsOnce` (same-RV double delivery → identical desired set) + `TestAuditHandler_DuplicateOfficialDeliveryMirrorsTwice` (webhook no longer suppresses; the stream absorbs). | nothing constructs or reads `gitopsreverser.audit.events.v1`; no `audit:decision:v1:*` keys; a duplicate-delivery test shows zero extra commits; full suite + e2e green; the diff is mostly red. | - -## 9. Open questions - -- **Barrier timeout shape.** The fallback bound for "a tail never reaches `rv_C`" (a wobbly/removed - type that `G` still claims). Proposal: a per-finalize deadline that degrades to a plain finalize + - a recorded metric, never a hang. **Decision memo with options/consequences:** - [commitrequest-barrier-timeout-decision.md](commitrequest-barrier-timeout-decision.md). -- **Drop the dual-source body merge entirely? (§4.1).** If we can mandate full-body audit - (`RequestResponse` policy) and declare aggregated-API mirroring out of scope, the whole Joiner + - `/audit-webhook-additional` proxy can go, not just the dedupe half. This is a deployment-contract - decision, deliberately separate from canonical-stream removal. Until then: keep the merge, drop the - dedupe. -- **Duplicate absorption proof.** Add the explicit test that a doubly-delivered `auditID` (same RV) - yields exactly one Git effect through both the splice and the freshness tail — the evidence that - retiring the decision key is safe (the R7 analogue measurement). -- **HA (R10, deferred).** The canonical consumer was the one leader-elected audit reader; the - per-type tails + driver run under the watch.Manager. Multi-replica fan-out and per-type cursor - ownership stay in `ha-improvements.md`; this change must not preclude them, - and the controller-driven finalize already rides controller-runtime leader election. diff --git a/docs/finished/commitrequest-attribution-divert-reliability.md b/docs/finished/commitrequest-attribution-divert-reliability.md deleted file mode 100644 index 1e76c74e..00000000 --- a/docs/finished/commitrequest-attribution-divert-reliability.md +++ /dev/null @@ -1,396 +0,0 @@ -# CommitRequest attribution reliability vs. the RV-below-high-water divert - -Status: DECISION RECORDED / IMPLEMENTED — 2026-06-20 -Author: investigation of CI run 27873681498 (branch `poc/redis-copy`) - -Implementation note: this branch adopts Option C. The webhook captures a small -CommitRequest author fact from the accepted, body-merged create audit event before the -demand gate and before the ordered per-type stream write/divert. The finalizer reads -that keyed fact; `commitrequests` is no longer in `AlwaysAllow`. The normal per-type -mirror path is still intact: if a GitTarget claims CommitRequests, their full audit -events continue through the demand-gated stream and can still be materialized into git. -The fact is an idempotent Redis upsert with a TTL chosen to cover leader failover as well -as the attribution window. - -> **TL;DR** A green-everywhere-else CI run went red on one e2e spec because a -> CommitRequest's own `create` audit event was never matched on the ordered -> `commitrequests` stream within the 60 s attribution window, so the finalize -> failed closed (`phase=Failed`). The documented cause of an unattributable -> create is the **RV-below-high-water divert**. The tempting bold move — *stop -> diverting* — is the **wrong cut**: the divert protects a load-bearing -> invariant (R8: the per-type log is strictly RV-ordered) that the checkpoint -> splice, the trim cursor, and the signing coverage-watermark all depend on. -> The right cut is to **stop making attribution depend on the ordered stream at -> all** — capture the author as a small keyed fact at ingestion, before any -> ordering/divert decision. That fix is already designed in -> [internal-audit-type-demand.md §5.1](internal-audit-type-demand.md); this run -> is the CI evidence it was waiting for. A separate, latent **commit-ordering** -> problem in the e2e suite is documented here as open work. - ---- - -## 1. Facts first — exactly what happened - -Everything in this section is taken from the run logs and the code, not inferred. - -### 1.1 The run - -| Field | Value | -|---|---| -| Run | [27873681498](https://github.com/ConfigButler/gitops-reverser/actions/runs/27873681498) (PR #167) | -| Branch / sha | `poc/redis-copy` / `a7c4dcd` (*feat(api)!: rename API group version v1alpha1 → v1alpha3*) | -| Result | `Ran 48 of 56 Specs` — **47 Passed | 1 Failed | 0 Pending | 8 Skipped** | -| Jobs | Build, Unit tests, Lint, Helm, devcontainer, **E2E (quickstart)** all green; only **E2E (full)** failed (`exit code 201`) | - -### 1.2 The failing spec - -- `Commit Request [It] finalizes a CommitRequest created with metadata.generateName` `[commit-request, audit-consumer]` - — [commit_request_e2e_test.go:228](../../test/e2e/commit_request_e2e_test.go#L228). -- Assertion that failed ([:245](../../test/e2e/commit_request_e2e_test.go#L245), reported at [:251](../../test/e2e/commit_request_e2e_test.go#L251)): - - ``` - [FAILED] Timed out after 120.000s. - The function passed to Eventually failed at commit_request_e2e_test.go:245 with: - a CommitRequest created via generateName must reach Committed - Expected - : Failed - to equal - : Committed - ``` - -- The object was `commit-request-gen-1781965173-wxzs5`, created `14:24:10.851`, polled for its - `.status.phase` until the 120 s `Eventually` expired at `14:26:10.917`. - -### 1.3 The confirmed root cause (from the captured manager logs) - -The controller manager logs are dumped into the e2e output at suite end (real time in the JSON -`ts` field). The deduped CommitRequest timeline for namespace `1781965173-test-commit-request`: - -``` -14:24:10Z Opening commit window (author=system:admin, deployments/…) -14:24:10Z Resync request applied committed=false -14:25:11Z CommitRequest attribution timed out; failing closed ← 60s after the 14:24:10 create -14:25:11Z CommitRequest finalized -``` - -- There is **exactly one** `attribution timed out; failing closed` line in the entire run, at - `14:25:11Z` — exactly 60 s after the gen CR's `14:24:10` create. That is - `commitRequestAttributionTimeout = 60s` - ([commitrequest_controller.go:160-167](../../internal/controller/commitrequest_controller.go#L160-L167)). -- `phase=Failed` is therefore the **attribution-timeout** path: - `writeTerminalStatus(..., errors.New(attributionFailedMessage))` → - `applyFinalizeResultToStatus` `finalizeErr != nil` - ([commitrequest_finalize.go:57-60](../../internal/controller/commitrequest_finalize.go#L57-L60)). -- It is **not** the resolve-timeout path: `commitRequestResolveTimeout = 60s + 300s + 120s = 480s` - ([commitrequest_controller.go:98](../../internal/controller/commitrequest_controller.go#L98)), well - outside the 120 s test window. -- It is **not** a git finalize error: the two sibling specs in the same suite - (`commit-request-save`, `commit-request-hold-save`) **committed successfully** in the same run. - -So: the gen CR's own `create` audit event was **not matched on the ordered `commitrequests` stream -within 60 s**, and the request fails closed by design. - -### 1.4 The mechanism (why the create can be unmatched) - -Attribution scans **only the main ordered stream**: - -```go -// commitrequest_author.go:52-55 -// Only the main ordered stream is scanned: a CommitRequest create whose audit event was -// diverted (RV below the high-water) is rejected from that stream and stays unattributable, -// so the finalize fails closed — the documented behaviour (rare, since CommitRequests are low-volume). -``` - -`LookupCommitRequestAuthor` → `scanForCommitRequestCreate` does one -`XREVRANGE … COUNT 512` over `…commitrequests:audit:stream` and matches by `namespace/name`(+uid) -([commitrequest_author.go:56-90](../../internal/queue/commitrequest_author.go#L56-L90)). -An ordered (numeric-RV) event whose RV is **strictly below the per-type high-water** is rejected -by Valkey's strong key ID ordering (`equal or smaller`), and the ingest path treats that rejection -as the **divert** signal — the event is *not written to any stream*; it becomes a counter + outcome -metric + (opt-in) `diag_all` record + a `lateNotify` checkpoint nudge -([redis_bytype_queue.go:551-560](../../internal/queue/redis_bytype_queue.go#L551-L560), -[markDiverted:602-614](../../internal/queue/redis_bytype_queue.go#L602-L614)). - -**Honest confidence note.** A divert emits **no log line** (only a counter / outcome metric, and -`diag_all` was OFF this run), so I could not positively observe a divert record for *this* create. -What is certain: (1) `phase=Failed` via the 60 s attribution timeout (logged); (2) the create was -not matched within 60 s. Divert is the **documented and most-likely** cause; the residual -alternatives are (b) audit delivery delayed > 60 s, or (c) > 512 newer `commitrequests` entries -pushed the create out of the scan window — (c) is implausible at this volume (a handful of CRs). -**All three are eliminated by the same fix** (§4), which is why the exact micro-cause does not -change the recommendation. - -### 1.5 What it is NOT - -- **Not the last commit (the v1alpha1→v1alpha3 rename).** The rename is mechanically inert for this - path: `AlwaysAllow` keys on the **group** `configbutler.ai` (unchanged — only the *version* moved) - ([cmd/main.go:280-281](../../cmd/main.go#L280-L281)); the `auditutil` changes are pure - import-alias + `OperationType` package renames with unchanged enum *values*; the sibling - CommitRequest specs passed in the same run; and the commit was validated `test-e2e 48/0` on a - clean cluster locally. -- **Not the same spec as the two immediately-prior CI reds.** Runs `27723359433` (06-17) and - `27736294243` (06-18) both failed in `[SynchronizedAfterSuite]` - ([e2e_suite_test.go:117](../../test/e2e/e2e_suite_test.go#L117)) — the "late lane must be empty" - invariant (the `late-lane invariant flake investigation`). Same audit-ordering **root family**, a - different surface. - ---- - -## 2. Why the divert exists (and why "just stop it" is the wrong cut) - -The divert is not incidental — it is how the per-type audit log keeps a property the rest of the -system is built on: - -> **R8 / DEC-3 — the per-type `:audit:stream` is strictly RV-ordered; we never knowingly insert an -> out-of-order event.** ([api-source-of-truth-reconcile.md DEC-3](../finished/api-source-of-truth-reconcile.md)) - -Concrete consumers that **depend** on that invariant today: - -1. **The checkpoint splice.** A reconcile replays the log with an *exclusive* `(R +` range from the - checkpoint's `:objects:rv` and folds forward - ([api-source-of-truth-reconcile.md](../finished/api-source-of-truth-reconcile.md), the - `XRANGE :audit:stream (R +` loop). If a strictly-older event were forced into the stream above - `R`, the splice would fold a **stale** create/update over newer state — the exact ordering - inversion the divert prevents. -2. **The trim cursor.** `TrimTypeAuditLog` does `XTRIM … MINID ` - ([redis_bytype_queue.go:334-343](../../internal/queue/redis_bytype_queue.go#L334-L343)). It is - safe only because stream position tracks RV order. -3. **The signing coverage watermark** is a full stream position `-` - (the [signing tail-replay watermark fix](../design/stream/signing-snapshot-tail-replay-failure-investigation.md)). Out-of-order insertion corrupts the watermark - arithmetic and re-opens the signing tail-replay failure that work just closed. - -So the *naive* bold move — "stop diverting, force every event into the stream in arrival order" — -trades a **rare, localized** attribution flake for **systemic** ordering fragility across the -splice, the trim, and signing. That is the wrong trade. - -A *softer* "no divert" (demote an older-numeric-RV event to attach at the high-water with a tag, the -way RV-less events already do — [ingestRVLess:566-600](../../internal/queue/redis_bytype_queue.go#L566-L600)) -is **less wrong**, but it pushes a new burden into every fold/replay consumer: each must now skip -entries whose event-RV is older than what it has already applied (a per-object last-RV guard on the -hot path). More places to get right than the targeted fix below. - -### 2.1 The actual asymmetry — attribution is the one consumer the backstop can't heal - -The divert is declared "safe" because the **checkpoint LIST is the correctness backstop**: a -diverted event's *effect on object state* is recovered when the next checkpoint re-reads the live -API ([redis_bytype_queue.go:566-578](../../internal/queue/redis_bytype_queue.go#L566-L578), -nudged via `Materializer.RequestResync`, -[materializer.go:348-375](../../internal/typeset/materializer.go#L348-L375)). - -But **attribution is authorship, and authorship lives only in the audit event — never in object -state.** A checkpoint LIST of `commitrequests` proves the object exists; it cannot tell you *who* -created it (the `userInfo` was in the diverted event). This is stated outright in the existing doc: - -> *"git materialization … is fine [under divert], because the checkpoint re-reads object state. But -> attribution is authorship, which lives only in the audit event, not in object state — the -> checkpoint cannot recover it."* — [internal-audit-type-demand.md §7](internal-audit-type-demand.md) - -**Principle:** the ordered-log + checkpoint model is correct for consumers whose truth is *current -state*. It is structurally wrong for consumers that need a *per-event fact* (who/when). Attribution -is the first such consumer; any future one (audit trails, event-sourced metadata) has the same shape. - ---- - -## 3. Options considered - -| # | Option | Divert kept? | Blast radius | Verdict | -|---|---|---|---|---| -| A | **Stop diverting; force all events in (arrival order)** | No | Splice + trim + signing watermark all break | ✗ Wrong cut (§2) | -| B | **Demote older-numeric-RV to "attach at high-water" + tag** | No (soft) | Every fold/replay consumer needs a per-object last-RV guard | ~ Viable but spreads cost | -| C | **Dedicated divert-immune attribution store** (capture `{ns,name,uid}→{author,ts}` at ingestion, before the ordering decision) | **Yes** (for the consumers that need it) | Attribution only | ✓ **Recommended** | -| D | Widen scan / make webhook deliver in order | Yes | Band-aid; doesn't fix divert | ✗ | - -Option C is **already fully designed** as -[internal-audit-type-demand.md §5 / §5.1](internal-audit-type-demand.md) ("a small keyed fact -written early at ingestion, not a full always-on mirror"). Its properties: - -- **Divert-immune & scan-miss-immune** — written when the event arrives at the handler, before any - RV-ordering/`canonicalMu` decision; there is no scan and no dependency on the event landing in the - ordered stream. -- **Deletes the `AlwaysAllow` special-case** — `commitrequests` no longer needs to be mirrored at - all; the "who demands this type?" question dissolves. -- **Removes the "audit log as a correctness input" anti-pattern** — the same one whose removal - justified deleting the late lane. -- **Fails loud** — a failed attribution *write* is a visible functional failure, not a silent 60 s - fail-closed. - -That doc was explicitly waiting for exactly this run: it calls a CI red here -*"a live, CI-visible argument for Option B/§5.1."* This is it. - -### 3.1 Does Option C guarantee attribution? And are we masking a real problem? - -Two honest objections were raised against Option C; both deserve a straight answer. - -**"Is it a 100% guarantee?" — No, and it should not claim to be.** Attribution can never go below -one floor: *the apiserver must actually deliver the CommitRequest's create audit event to our -webhook, captured at a sufficient level.* Option C does not remove that floor; it removes the -**extra** dependencies layered on top of it. - -- **Removed (self-inflicted) failure modes:** the divert, the 512-entry scan window, the RV-order - dependency, and the open run-2 "present-but-missed" scan bug — gone, because there is no scan and - no ordered-stream dependency. -- **Residual (fundamental) dependencies that remain:** (1) the event must arrive within the deadline - — the finalize trigger is the controller-runtime *watch*, which fires before the audit event flows - to us, so the **same retry-to-deadline loop** is still needed, now reading a deterministic store; - (2) for `generateName`, the name/UID lives only in `responseObject`, so the audit policy must - capture `commitrequests` at **RequestResponse** level (today's scan needs this too); (3) the store - **write must succeed** (mirroring is best-effort, IR8) and the record **TTL must outlive the - worst-case finalize delay**, not just the nominal 60 s. - -The qualitative win: today attribution can fail **even when the event arrived** (our own -ordering/scan dropped it); after Option C it fails **only when the event genuinely did not arrive in -time** — a real, observable, far rarer external condition. That also makes a *future* attribution -failure meaningful again ("audit didn't deliver") instead of ambiguous noise. - -**"Are we masking things — it should normally have arrived already?" — Split it in two.** - -- **The divert: not masking.** The divert is *by design* (a strictly-ordered stream correctly - rejecting older-RV arrivals), and it stays counted/metric'd, so it is never hidden. Deeper: - `commitrequests` is **attribution-only** — never materialized, spliced, trimmed, or signed — so it - *never needed* the strict-RV ordering that justifies the divert. Mirroring an attribution-only type - into an order-sensitive stream was a category error; Option C corrects the category, it does not - hide a malfunction. -- **The unexplained scan miss: here the objection is right.** Run-2 showed a create that was - demonstrably queued, present the whole window, within the bound, name/uid matching — *yet missed by - ~30 scans*, root cause still open. Deleting the scan deletes the one place we ever noticed that - bug, and it likely lives in the **shared Redis range-read path** that the checkpoint splice - (`XRANGE (R +`) and the signing replay also use. So **Option C must not be used as an excuse to - close the scan-miss investigation** — keep a repro/guard for it independently, or a latent - *correctness* hole in materialization could persist unseen. -- **Delivery slowness: not masked, and made more visible.** Option C still fails loudly when the - event is genuinely late/absent; instrument the store write with ingest-lag - (`now − event.stageTimestamp`) and you get a *direct* "attribution data arriving slowly" signal, - better than today's indirect divert counter. - -### 3.2 The tap is **additive** — the normal ingestion train stays - -A clarification on Option C's shape, because it is easy to misread §5.1's *"`commitrequests` is no -longer mirrored at all"* as *"`commitrequests` can never be mirrored."* It cannot be — and must not -be read that way: - -- `commitrequests` is a **normal Kubernetes resource**. A user may legitimately point a - `WatchRule`/`GitTarget` at it and track it in git like anything else; the system "tracks anything - they claim." So the **normal demand-gated ingestion path must remain fully available** for - `commitrequests` whenever a GitTarget claims it. -- The attribution store does **not** intercept or bypass that path. It is an **additional, always-on - tap of the same incoming events**, taken *earlier* (before the ordering/divert decision), that - records only the small attribution *fact*. The event still flows through the normal train; the tap - just copies one derived field off it sooner. -- This is exactly consistent with §5.1's actual point: **attribution should not be the thing that - *demands* the type.** Dropping `commitrequests` from `AlwaysAllow` removes the *attribution-driven* - demand only. If a GitTarget claims it, demand-gated mirroring activates as usual; if nobody claims - it, it simply is not mirrored for git — but attribution still works, because the tap is independent - of demand. So §8's B-3 should read *"confirm the type is no longer mirrored **for attribution's - sake** (it is still mirrored on demand when a GitTarget claims it),"* not *"never mirrored."* - ---- - -## 4. The commit-ordering claim (separate, latent — open work) - -> *The reviewer's claim:* "There is now a bit of timing in the first reconcile commit — when it -> exactly arrives depends on timing — so we should be checking the last *N* commit that does **not** -> start with `reconciled`." - -This is a **real and distinct** issue from §1. It did **not** fire in run 27873681498 (that failed -at the *phase* assertion, before any git-log check), but it is a latent flake class, and the e2e -suite is **already hand-rolling ad-hoc workarounds for it** — which is the strongest evidence it is -real. - -**Important correction:** there is **no** existing helper that "picks the last commit not starting -with reconciles." That behaviour is **not implemented anywhere**. Reconcile commit subjects render -as `reconciled N ` / `reconciled N configmaps (last resourceVersion: …)` / -`reconcile(): N resources` (the default `ReconcileTemplate`), versus explicit -event/CommitRequest subjects (`[CREATE] …`, `save: …`). The one piece of "reconcile-awareness" -today is an *assertion* that a message must **not** contain `reconciled` -([gittarget_isolation_e2e_test.go:139](../../test/e2e/gittarget_isolation_e2e_test.go#L139)) — -the opposite of a skip-filter. - -### 4.1 e2e inventory — where "latest commit" is read - -**(A) Reads the latest/HEAD commit unscoped — can be fooled by a trailing reconcile commit:** - -| File:line | Reads | Asserts | -|---|---|---| -| [commit_request_e2e_test.go:146](../../test/e2e/commit_request_e2e_test.go#L146) | `log -1 --pretty=%B` | message == explicit `spec.message` | -| [commit_request_e2e_test.go:263](../../test/e2e/commit_request_e2e_test.go#L263) | `log -1 --pretty=%B` | message == explicit `spec.message` | -| [commit_request_e2e_test.go:395](../../test/e2e/commit_request_e2e_test.go#L395) | `log -1 --pretty=%B` | message == explicit `spec.message` | -| [commit_request_e2e_test.go:152](../../test/e2e/commit_request_e2e_test.go#L152) / :401 | `rev-parse HEAD` | HEAD == reported `status.sha` | -| [commit_window_batching_e2e_test.go:218](../../test/e2e/commit_window_batching_e2e_test.go#L218) | `show --name-only HEAD` | HEAD touched all burst files | -| [watchrule_configmap_secret_e2e_test.go:568](../../test/e2e/watchrule_configmap_secret_e2e_test.go#L568) / :583 | `log -1 --pretty=%B` / `%an` | subject has `[CREATE]`; author == `jane@acme.com` | -| [crd_lifecycle_e2e_test.go:598](../../test/e2e/crd_lifecycle_e2e_test.go#L598) / :666 | `log --oneline -n 5` | last 5 contain `DELETE` (window can drop it) | -| [repo_assertions_test.go](../../test/e2e/repo_assertions_test.go) `assertLatestCommitTouchesNoNamespaces` | `diff-tree … HEAD` | HEAD touched no forbidden ns | - -**(B) Already hand-rolls a reconcile workaround — proof the class is real:** - -- [signing_e2e_test.go:375-408](../../test/e2e/signing_e2e_test.go#L375-L408) — scopes to the - ConfigMap's **own file** and loops over its whole history matching the `e2e:` prefix: - `continue // tolerate a later heal/reconcile commit on the same file`. -- [gittarget_isolation_e2e_test.go:106-109](../../test/e2e/gittarget_isolation_e2e_test.go#L106-L109) - — `time.Sleep(5 * time.Second)` to let "baseline reconcile commits … settle" before acting. -- [restart_reconcile_e2e_test.go](../../test/e2e/restart_reconcile_e2e_test.go) — gates on - Prometheus reconcile/queue-depth metrics instead of reading HEAD, and uses a commit *range* - (`headBeforeRestart..HEAD`) rather than HEAD. - -**(C) Robust patterns already in use (the template for a fix):** scope to a pathspec -(`commit_author_attribution_e2e_test.go:155`, `gittarget_isolation` line 188, -`aggregated_apiserver_e2e_test.go:375`), or resolve a specific hash first -(`latestCommitHashForPath`, `signing_common_test.go`). - -### 4.2 Direction for the open work - -Two cheap, shared primitives turn the ad-hoc workarounds into one tested helper: - -1. `latestNonReconcileCommit(checkoutDir, pathspec, subjectPredicate)` — walk `git log` (optionally - `-- pathspec`) and return the newest commit whose subject is **not** a reconcile subject (or - matches the caller's expected prefix). Replaces every `log -1` site in (A) and deletes the sleeps - in (B). -2. Default every message/author assertion to **pathspec scope** — the file the test actually wrote — - so an unrelated reconcile/heal commit on another path can never shadow it. - -This is **test-robustness**, not a product bug: production never "asserts HEAD's message," and -`status.sha` correctly pins the CR's own commit regardless of what lands after. But it removes a -whole flake class and the copy-pasted workarounds. It is **independent** of §1–§3 and can land -first (it is lower-risk and unblocks noisy reds). - ---- - -## 5. Advice — what I'd actually do - -This path has to work reliably, so the bar is *deterministic*, not *less flaky*. - -1. **Do not drop the RV-below-high-water divert.** It is load-bearing for the strict-RV invariant - (R8) that the splice, the trim cursor, and the signing coverage-watermark depend on. "Be bold and - stop the exclusion" optimizes the wrong variable: it would convert a rare, isolated attribution - miss into systemic ordering risk. The bold-but-*right* move is to remove attribution's dependence - on the ordered stream — not to weaken the stream. - -2. **Adopt Option C — the divert-immune attribution store — - [internal-audit-type-demand.md §5.1](internal-audit-type-demand.md).** Write - `{namespace,name,uid} → {author, auditID, ts}` early in the webhook handler, *before* the - ordering/divert decision; read it by key in `LookupCommitRequestAuthor`. This makes attribution - **deterministic** (no 60 s timeout gamble), immune to divert *and* scan-miss *and* delivery delay - (the three §1.4 candidates collapse to one fixed answer), and it **deletes** the `AlwaysAllow` - hardcode and the "audit-as-correctness" coupling in one move. For `generateName`, resolve the - server-assigned name from `responseObject` at write time (same `IdentityFromAuditEvent` logic), - so the keyed fact is stored under the resolved name. This run is the CI evidence that doc was - waiting for — promote §5.1 from PROPOSAL to the work item. - -3. **Land the commit-ordering helper (§4.2) independently and first.** It is low-risk, retires the - `signing`/`isolation`/`restart` workarounds, and removes a latent flake class — even though it is - not what reddened this run. - -4. **Re-run the failed job now** to confirm 27873681498 was the transient flake the analysis says it - is (a single divert/attribution miss), while (2) is built. I expect green on re-run. - -**Net:** the divert stays (it earns its keep); attribution stops betting on it. After Option C, a -reordered or diverted CommitRequest create can no longer fail a finalize — the author was already -recorded the moment the event arrived. That is the reliability the path needs. - ---- - -## 6. References - -- Confirmed prior design (the fix): [internal-audit-type-demand.md](internal-audit-type-demand.md) §5, §5.1, §7 -- Ordering invariant the divert protects: [api-source-of-truth-reconcile.md](../finished/api-source-of-truth-reconcile.md) (R8 / DEC-3) -- Late-lane / divert investigation lineage: `late-lane-e2e-2026-06-16-investigation.md`, [residual-e2e-flakes-2026-06-19.md](../design/stream/residual-e2e-flakes-2026-06-19.md) -- Code: [commitrequest_author.go](../../internal/queue/commitrequest_author.go), [redis_bytype_queue.go](../../internal/queue/redis_bytype_queue.go), [commitrequest_controller.go](../../internal/controller/commitrequest_controller.go), [commitrequest_finalize.go](../../internal/controller/commitrequest_finalize.go) diff --git a/docs/finished/commitrequest-barrier-timeout-decision.md b/docs/finished/commitrequest-barrier-timeout-decision.md deleted file mode 100644 index e1e38225..00000000 --- a/docs/finished/commitrequest-barrier-timeout-decision.md +++ /dev/null @@ -1,85 +0,0 @@ -# Decision memo: what should a CommitRequest do when the barrier can't be satisfied? - -> Status: **DECIDED 2026-06-11 — Option A** (15 s bound; on expiry finalize anyway with a -> visible status reason + one counter metric; constant, not a knob). This resolves the -> "barrier timeout shape" open question of -> [canonical-stream-retirement.md](canonical-stream-retirement.md) §9. The same session -> also settled the other §9 questions: body merge KEPT (re-decide once the Joiner is -> merge-only after C-C), duplicate-absorption test goes in with C-C. -> **IMPLEMENTED with C-B2 (2026-06-11):** `watch.FinalizeBarrierTimeout` (15 s constant), -> `gitopsreverser_commitrequest_barrier_timeouts_total` (incremented in -> `EventRouter.FinalizeAtWatermark`), and the degrade sentence in `CommitRequest` -> `status.message` (`barrierDegradeMessage` in `internal/controller`); the phase stays -> `Committed`/`NoOpenWindow` — a timeout never fails the request. -> Captured: 2026-06-11 · Decided by: Simon - -## 1. The promise a CommitRequest makes - -A user who creates a CommitRequest is saying: *"finalize the open commit window for this -GitTarget **now** — and the commit must contain everything I changed before I asked."* - -The second half is the hard part. The user's earlier edits travel as audit events through -the per-type streams and tails before they reach the GitTarget's BranchWorker. If we -finalize the moment the CommitRequest appears, an edit the user made two seconds earlier -might still be in flight — and would land *after* the finalized commit, in a later one. -That breaks the natural reading of "commit what I just did". - -## 2. How the barrier delivers the promise (settled — §6 of the retirement doc) - -Kubernetes gives us a global clock for free: `resourceVersion`. Every edit the user made -*before* creating the CommitRequest has a smaller RV than the CommitRequest itself -(`rv_C`). The per-type streams are RV-keyed. So the controller can simply **wait** until, -for each type this GitTarget claims, the tail has applied every stream entry older than -`rv_C`. Then it enqueues the finalize — the BranchWorker is a single FIFO, so everything -queued before the finalize is inside the commit. Done; promise kept. - -For a quiet type (no entries near `rv_C`) the check passes immediately. In the normal -case the whole barrier resolves in well under a second. - -## 3. The question: the wait might not finish — then what? - -The barrier can stall when: - -- a tail is **far behind** on a very busy stream (catch-up takes seconds); -- a claimed type's tail is **not running** (the type fell out of followability for - longer than the grace — rare now that typeset-grace landed, but possible); -- **Redis is briefly unreachable** (cursor cannot advance at all). - -We must pick a bounded behaviour. The honest context for judging the options: - -1. **Today's behaviour has the same gap.** The current consumer finalizes when the - CommitRequest's own audit event arrives, *assuming* earlier events were processed - first — a delivery-order hope, not a guarantee. So "finalize without the barrier" is - never *worse* than what ships today. -2. **The checkpoint backstop catches stragglers.** A mutation that misses the finalized - commit is not lost — the next per-type checkpoint reconcile commits it (with bulk - attribution instead of the user's, the known R11 limitation). The damage of a missed - barrier is *"my edit landed one commit later than I asked"*, not data loss. - -## 4. The options - -| | Behaviour on stall | What the user sees | Cost / risk | -|---|---|---|---| -| **A — short bound, visible degrade** *(recommended)* | Wait up to **~15 s** (≈3 tail read windows). On expiry: finalize anyway, set the terminal status with an explicit reason (e.g. `Committed` + `barrierTimedOut=true` / message "finalized without full ordering guarantee"), bump a metric. | Almost always: a normal fast finalize. On a stall: still gets the commit within ~15 s, and the status *tells them* an in-flight edit may follow in the next commit. | Honest and bounded. Needs one extra status field/message. | -| **B — long bound (60 s+), silent degrade** | Same, but wait much longer and don't surface the degrade in status (metric only). | A stuck tail makes every finalize feel hung for a minute. Degrade is invisible — user can't tell their commit might be missing an edit. | "Feels like a hang"; hides exactly the fact the user would care about. | -| **C — non-blocking requeue loop** | Don't block the reconcile; re-check cursors every ~2 s via requeue until satisfied or deadline. | Same outcomes as A, slightly later. | More moving parts (deadline persisted in status, requeue churn) for the same result; only worth it if blocking a reconcile worker ever measured as a problem. CommitRequests are rare — it won't. | -| **D — refuse: fail instead of degrading** | On expiry, do **not** finalize; mark the CommitRequest `Failed` ("ordering could not be guaranteed"). The window stays open. | Strictest reading of the promise. But the user asked for a commit and gets nothing; they must retry; and today's behaviour never refused. | Turns a freshness hiccup into a user-visible failure. Worst UX for the same underlying data-safety (the backstop exists either way). | - -The timeout *value* in A is not sacred: it just needs to cover a tail's normal catch-up -(reads happen in ≤5 s blocking windows, so ~3 windows ≈ 15 s) without feeling like a hang. - -## 5. Recommendation - -**Option A.** It keeps the promise whenever the system is healthy, is never slower than -~15 s, is never worse than today's behaviour when the system is not, and — unlike B/D — -tells the user the one thing they'd want to know in the degraded case. C is a refactor -of A we can do later if blocking ever shows up in a profile; D punishes the user for an -internal freshness hiccup the checkpoint already heals. - -What "choosing A" pins concretely: - -- `FinalizeAtWatermark(gitTarget, rv, timeout)` blocks ≤ timeout (default 15 s, a - constant — not a knob — unless operations later prove otherwise); -- terminal status carries the degrade fact (field or message) + one counter metric - (`commitrequest_barrier_timeouts_total`); -- no behaviour change at all for the no-stall path. diff --git a/docs/finished/current-flows-and-cutover.md b/docs/finished/current-flows-and-cutover.md deleted file mode 100644 index e036736a..00000000 --- a/docs/finished/current-flows-and-cutover.md +++ /dev/null @@ -1,256 +0,0 @@ -# Where the events flow today — the dual-path picture and how close R3 is - -> ## ⚠️ HISTORICAL — the cutover is COMPLETE (R3 landed 2026-06-11; C-track too) -> This doc captured the **dual-path** moment *during* the cutover (R1+R2 landed, R3 pending). -> **R3 ("the great deletion") has since landed**, so the "OLD live-truth path" described below -> — the long-lived object informers, the single-canonical-stream resource fan, the -> RECONCILING handover, the per-reconcile gather, and content hashing — **no longer exists** -> (`informers.go` and `snapshot_stream.go` are deleted). The §4 "AuditConsumer side-jobs" -> were then relocated and the canonical stream itself deleted -> ([canonical-stream-retirement.md](canonical-stream-retirement.md), all stages landed -> 2026-06-11): `/scale` rides the parent type's stream, CommitRequest finalize is -> controller-driven behind audit attribution + the watermark barrier, and the -> `AuditConsumer`, the canonical stream, and the Joiner's auditID dedupe are gone. The -> per-type checkpoint+log **splice** (correctness) and the per-type **audit tail** -> (freshness) are the **sole** path. This file is kept as the cutover record; **for the -> current single-path architecture read -> `architecture-and-bootstrap.md`.** -> -> Original status: **explainer / snapshot after R1 + R2 landed** (commit `3d249e3`). Companion -> to the three design docs; this one is the "you are here" map, not a spec. -> Captured: 2026-06-10 -> Related: -> [api-source-of-truth-reconcile.md](api-source-of-truth-reconcile.md) (the plan + §5.1 demolition list), -> `audit-log-ingestion-and-ordering.md` (the per-type log producer), -> `demand-driven-type-materialization-lifecycle.md` (the checkpoint demand layer). - -## 1. One paragraph - -> *(Historical — describes the dual-path moment during the cutover. R3 has since landed; the old -> path described here is now deleted. See the banner above.)* - -At the time of capture **two pipelines ran at once**. The *old* one — long-lived object -**informers** plus the single-canonical-stream **AuditConsumer**, both feeding one -`GitTargetEventStream` (deduped by a content hash), with a per-reconcile streaming **gather** for -bootstrap/rule-change — was the live truth path. The *new* one — the per-type `:audit:stream` log -+ the demand-gated `:objects` **checkpoint**, folded by the **splice** into a per-type reconcile — -was fully built and running **beside** it. R3 ("the great deletion") then **removed the old -machinery** so the splice + per-type audit tail are the *sole* live feed, and hardened the -freshness wake (the per-type tail) now that the old path's backstop is gone. - -## 2. The current dual-path flow - -```mermaid -flowchart TB - API["Kubernetes API server"] - - subgraph CAP["Capture — always-on (R0/R1, landed)"] - WH["audit-webhook handler
(mirrorByType)"] - CANON[":audit canonical stream
gitopsreverser.audit.events.v1"] - PERTYPE["per-type :audit:stream
RV-ordered + late lane"] - WH -->|every mutating event| CANON - WH -->|every mutating event| PERTYPE - end - API -->|audit events| WH - - subgraph OLD["OLD live truth paths — still running, R3 deletes"] - INF["object informers
(live WATCH per GVR×ns)"] - AC["AuditConsumer
XREADGROUP canonical"] - GTES["GitTargetEventStream
content-hash dedup +
RECONCILING handover"] - GATHER["per-reconcile streaming gather
StreamClusterSnapshotForGitDest
+ SnapshotSynced bootstrap gate"] - API -->|object ADD/UPD/DEL| INF --> GTES - AC -->|resource events| GTES - API -->|brief LIST/WATCH| GATHER - end - - subgraph NEW["NEW splice path — R0–R2, landed, runs in parallel"] - LIST["periodic LIST checkpoint
mirrorTypeObjects (claimed types only)"] - CKPT[":objects:items @ :objects:rv"] - TAIL["per-type audit tail
XREAD + burst settle"] - SPLICE["splice = fold( checkpoint@R ,
log after R ) → BuildScopedPlan"] - API -->|brief LIST| LIST --> CKPT --> SPLICE - PERTYPE --> TAIL -->|wake| SPLICE - MAT["Materializer
TypeSynced wake"] -->|wake| SPLICE - end - - subgraph WRITE["Write side — shared, kept unchanged"] - BW["BranchWorker
single-writer + commit window
+ no-op detection (manifestedit.Decide)"] - GIT["Git"] - end - - GTES -->|per-event git.Event| BW - GATHER -->|whole-target resync| BW - SPLICE -->|per-type scoped resync via EnqueueResync| BW - BW --> GIT - - subgraph SPECIAL["AuditConsumer ALSO owns — must survive R3"] - CR["CommitRequest finalize"] - SCALE["/scale → parent field-patch"] - LEAD["leader election"] - end - AC -.-> CR - AC -.-> SCALE - AC -.-> LEAD -``` - -Reading it: - -- **Capture (top)** is the future and is already complete: the webhook mirrors **every** event into - both the legacy canonical stream *and* the per-type `:audit:stream`. The per-type streams carry - 100% of traffic today. -- **Old paths (left)** are still the load-bearing live truth. Note the informers **and** the - AuditConsumer both write into the same `GitTargetEventStream` — that overlap is precisely why - **content hashing** exists (to keep the same change from being committed twice). The **gather** is - the bootstrap / rule-change whole-target snapshot, gated by `SnapshotSynced`. -- **New path (right)** is the splice, woken two ways: by the Materializer's **TypeSynced** (after a - fresh, authoritative checkpoint LIST) and by the per-type **audit tail** (freshness, between - checkpoints). It enters the BranchWorker via `EnqueueResync` — a *scoped mark-and-sweep*, not a - per-event write. -- **Write side (bottom)** is shared and unchanged: one BranchWorker per branch, commit window, - no-op detection at the commit boundary. -- **AuditConsumer's other jobs (dashed)** — CommitRequest finalize, `/scale` field-patch, leader - election — are *not* resource mirroring and must be preserved or relocated when R3 retires the - single-stream fan. - -## 3. The partial-burst mark-and-sweep — what it is and why it bites - -The splice does not write events one by one; it computes a **whole desired set for the type** and -mark-and-sweeps: - -```text -desired := decode(:objects:items) # the checkpoint, complete as of revision R -for entry in XRANGE :audit:stream (R +: # the log, strictly after R - delete or upsert desired[identity] -plan := BuildScopedPlan(store, desired, scope=this type) # upsert desired; SWEEP any managed doc of this type NOT in desired -``` - -The **sweep** is the feature: it catches orphans and missed deletes the checkpoint reveals. It is -**safe only when `desired` is complete**. The checkpoint half is always a consistent snapshot (an -atomic LIST at `R`). The **log half can be momentarily incomplete**: an object created after `R` -whose audit event has not landed in the stream *yet* is not in `desired` — and if the reconcile -sweeps then, it **deletes that object from Git**. - -Under the design's core assumption — *gitops-reverser is the sole writer of its path* — this is -harmless: an object it hasn't observed isn't in Git yet, so there's nothing to sweep. The -**bi-directional** case breaks that assumption: **Flux writes the object to Git first**, then -applies it; gitops-reverser sees Git holding an object its log hasn't caught up to → spurious -delete → re-add when the event arrives → **commit loop**. - -```mermaid -sequenceDiagram - participant Flux - participant API as API server - participant Log as per-type :audit:stream - participant Tail as audit tail - participant Splice - participant Git - - Flux->>Git: commit Alice + Bob (shared path) - Flux->>API: apply Alice + Bob (one kustomization) - API-->>Log: CREATE Alice (rv=101) - Note over Log: Bob's CREATE still in flight (μs) - Log-->>Tail: new entry → wake - Tail->>Splice: reconcile NOW (no settle) - Splice->>Splice: desired = {Alice} (Bob not in log yet) - Splice->>Git: mark-and-sweep → DELETE Bob ❌ (Bob exists, just unseen) - API-->>Log: CREATE Bob (rv=102) - Log-->>Tail: new entry → wake - Tail->>Splice: reconcile → desired = {Alice, Bob} - Splice->>Git: re-add Bob (commit) → the loop -``` - -### How it's contained **today** - -1. **The old path is still live and backstops it.** In R2 the splice is *additive*; the informer/ - audit-consumer live path already wrote both objects, so even a bad splice sweep is corrected. -2. **The burst-settle window** ([audit_tail.go](../../internal/watch/audit_tail.go)). The tail no - longer reconciles on the first arrival; it **drains until the stream is quiet for one settle - window**, so a co-arriving burst (Alice+Bob land μs apart) is folded together → `desired = - {Alice, Bob}` → no spurious sweep. Each arrival extends the window, so even a spread-out burst - coalesces into one reconcile. This is what made the bi-directional e2e green again. -3. **The fail-closed gate** (§7): the splice only runs while the checkpoint phase is `Synced`; a - Dormant/Syncing type holds rather than sweeping a non-view. - -### Why R3 makes it sharp - -The moment R3 deletes the old live path, **backstop #1 is gone** — the splice is the *only* writer, -so a partial-burst sweep is a real, uncorrected data loss until the next re-anchor. The settle -window narrows the race but does not close it for a straggler event arriving after the window. So R3 -must deliberately resolve it. The recommended resolution — **upsert on the log, sweep only on the -checkpoint** — is in §6; it removes the hazard by construction rather than narrowing the race. - -## 4. How far are we from "all events through the new streams"? - -Short answer: **the new streams already carry every event end-to-end; we are one campaign (R3) away -from them being the *only* path.** Capture is 100% done; consume is built and proven in parallel; -what remains is removing the old machinery and promoting the freshness wake from "accelerator with a -backstop" to "sole live feed." - -| Stage | What it is | State | -|---|---|---| -| **Capture → per-type log** | every mutating event mirrored to `:audit:stream`, RV-ordered + late lane | ✅ **100%** — all traffic already flows here (R0/R1) | -| **Checkpoint** | `:objects:items @ :objects:rv`, demand-gated LIST, durable + boot-replayed, trimmed on re-anchor | ✅ for **claimed** types (by design — unclaimed types are intentionally not materialized) | -| **Splice consume** | per-(GitTarget, type) reconcile folds checkpoint + log; zero per-reconcile API calls | ✅ **landed (R2)** — woken by TypeSynced + audit tail | -| **Old live paths** | informers + AuditConsumer + gather + content hash + RECONCILING handover + `SnapshotSynced` gate | ❌ **still running in parallel** — this is the R3 delete | -| **AuditConsumer side-jobs** | CommitRequest finalize, `/scale` field-patch, leader election | ⚠️ live in the consumer — R3 must **preserve/relocate**, not delete | -| **Freshness wake at scale** | one blocking-read goroutine **per** Synced type | ⚠️ fine as an accelerator; **load-bearing after R3** → wants a single multiplexed `XREAD` + bounded debounce | - -So the gap is not "build more pipeline" — the pipeline is built and carrying traffic. The gap is -**subtractive**: cut the parallel old path (R3a–e in the plan), keep the three things the consumer -also does, and harden the audit-arrival wake for the day it has no backstop. - -## 5. The target state (post-R3), for contrast - -```mermaid -flowchart TB - API["Kubernetes API server"] - WH["audit-webhook handler"] - PERTYPE["per-type :audit:stream
(the only live intake)"] - LIST["periodic LIST checkpoint"] - CKPT[":objects:items @ :objects:rv"] - UPSERT["log apply: per-identity
UPSERT / delete — NO sweep
(freshness, O(events))"] - SPLICE["full splice + scoped SWEEP
(correctness, O(N), authoritative)"] - BW["BranchWorker"] - GIT["Git"] - CR["CommitRequest finalize +
/scale field-patch (retained)"] - - API -->|audit events| WH --> PERTYPE - PERTYPE -->|every change| UPSERT --> BW - API -->|brief LIST| LIST --> CKPT --> SPLICE --> BW - BW --> GIT - WH -.-> CR -.-> BW -``` - -One always-on intake (the audit push) + one periodic checkpoint. **Two jobs, split by trigger:** the -log drives cheap per-identity **upserts** (freshness, never sweeps); the checkpoint drives the full -**splice + sweep** (correctness, only off an authoritative LIST — see §6). No object informers, no -live gather, no content-hash maps, no handover buffer, no `SnapshotSynced` gate. The diff that gets -us there is mostly red — that's the point. - -## 6. Recommended R3 shape — split freshness from correctness - -R2 reuses one mechanism (full fold + `BuildScopedPlan` *with sweep*) for both freshness and -correctness. That is exactly what creates the partial-burst hazard (§3) and an `O(N-objects-of-type)` -cost on **every** burst. In R3, separate the two responsibilities **by trigger** — this removes the -hazard by construction, not by tuning a window: - -- **Log → incremental UPSERT (freshness).** The per-type `:audit:stream` wake should apply only the - **identities that changed** in the slice it read — upsert creates/updates, `PlanDelete` an explicit - RV-bearing delete — and **never sweep**. This is the old per-event apply, just **re-sourced** from - the canonical stream onto the per-type stream; keep that proven logic, do not reinvent it. Cost is - `O(events)`, and with no sweep it **cannot** delete an unseen object, so the partial-burst race - disappears and the settle window becomes a nicety, not a correctness crutch. -- **Checkpoint → full splice WITH sweep (correctness).** Mark-and-sweep is the only way to catch - orphans / missed deletes, and it is safe **only** off an authoritative full LIST. Run it - exclusively on checkpoint-authoritative moments: the periodic re-anchor (`TypeSynced`), a new claim - on an already-Synced type (the declare-time wake), and boot-restore. Never off log membership alone. - -Mechanically this is one predicate on the existing planner: the upsert path calls `BuildScopedPlan` -with an **empty sweep scope** (nothing swept; desired still upserted) or `PlanDelete` per identity; -the checkpoint path calls it with the **full type scope** (sweep on). RV-less / uncertain deletes -stay best-effort on the log and are backstopped by the next checkpoint sweep (DEC-5) — do not act on -them incrementally. - -Net effect: the log path becomes the cheap, sweep-free freshness feed (safe as the sole live intake), -and the expensive authoritative reconcile happens only when it is both safe and worth it. This is the -shape the "just handle events + reconcile periodically" intuition points at. diff --git a/docs/finished/current-manifest-support-review-feedback.md b/docs/finished/current-manifest-support-review-feedback.md deleted file mode 100644 index 4d0c44fc..00000000 --- a/docs/finished/current-manifest-support-review-feedback.md +++ /dev/null @@ -1,211 +0,0 @@ -# Architecture Review Feedback: Current Manifest Support Review - -> Status: feedback on -> [current-manifest-support-review.md](current-manifest-support-review.md), -> captured 2026-06-04. Grounded against the actual code, including the parts the -> reviewed document does not mention. - -## Verdict - -The recommended direction — materialized model, dual identity index, first-class -plan, plan→apply→dirty-flush as the one write mechanism — is **right**, and it -should be pursued. The low-level reads are accurate: `manifestedit` is a good -mechanism layer; the writer is the part that "feels off." - -But the document has **one major blind spot that undermines its own diagnosis**, -plus an **internal contradiction** in its most dangerous policy decision, and it -over-flattens settled decisions with open questions. Fix those three and this -becomes a strong directional doc. - ---- - -## 1. The blind spot: the review never mentions `FolderReconciler`, which is where the real disease lives - -The doc frames the problem as "the live writer in -[git.go](../../internal/git/git.go) processes events one at a time" and -proposes making the inventory authoritative *in the writer*. But the writer is -**downstream** of the actual reconcile engine, which the doc never names: -[folder_reconciler.go](../../../internal/reconcile/folder_reconciler.go). - -What is actually happening today is worse than "event-by-event," and in a way -that strengthens the case for the rewrite. There are **three** independent -"compare git ↔ desired" engines using **two incompatible identity models**: - -| Engine | Identity model | Git side sourced from | -|---|---|---| -| `FolderReconciler.findDifferences` (the *real* production diff) | **GVR** `ResourceIdentifier` | **path-parsed** via `parseIdentifierFromPath` | -| `manifestLocator` + `reconcileAgainstExisting` (the writer) | **content GVK** `manifestedit.Identity` | `manifestedit.Inventory` (content scan) | -| `manifestreport.BuildReport` (read-only, ~dead in prod) | content GVK | `manifestedit.Inventory` | - -The headline problem is not "event-by-event." It is that **the authoritative -diff (`FolderReconciler`) decides creates and deletes from path-derived GVR -identity** (`listResourceIdentifiersInPath` → `parseIdentifierFromPath`), then -**hands a flat `[]git.Event` to the writer, which re-scans the same tree by -content identity** to place each one. The two scans happen at different layers, -at different times, against possibly different commits, with two different -notions of "what resource is this." - -That is the actual reason "DELETE placement is incomplete when delete events only -carry GVR/name" (Cons & Gaps in the reviewed doc): a manifest moved off its -canonical path is *invisible to the reconciler's git scan entirely* — -`parseIdentifierFromPath` derives identity from the path, so a moved file either -parses to the wrong identity or not at all. The reconciler then emits a CREATE -(duplicate at the canonical path) while never seeing the moved copy. The writer's -content-based locator cannot save it because the reconciler already made the -wrong decision upstream. - -**The proposed `ManifestStore` with both `ByManifestIdentity` and -`ByResourceIdentity` is exactly the fix** — but the doc presents it as "promote -the locator cache," when what it really does is **collapse three engines and two -identity models into one**. Say that. It is a much stronger justification than -the one currently written, and it tells the reader that `parseIdentifierFromPath` -and `listResourceIdentifiersInPath` are the things being deleted. - -The "Current Architecture" mermaid reinforces the blind spot: it draws the -writer, `manifestedit`, and `manifestreport`, but omits `reconcile`, `watch`, and -`events` — i.e. it omits the layer that actually owns the diff. Redraw it to -include `FolderReconciler` and the cluster/repo-state control events, or the -diagram is describing a subsystem, not the system. - -## 2. Where the store and plan must live — the layering question the doc doesn't resolve - -Because the doc skips `FolderReconciler`, it never confronts a hard fact: **the -desired/cluster state lives in the reconcile layer** (`clusterObjects`, already -"cluster-as-source-of-truth"), while **the worktree lives in the writer**. The -doc's data structures put `ManifestStore` "owned by the writer or a new -integration package" and place the plan there too — but the writer only receives -events; it has no cluster snapshot to plan against. - -The clean answer that matches the existing `fs.FS` purity in -[analyzer.go](../../internal/manifestanalyzer/analyzer.go) is to make the -**Plan the cross-layer contract**, computed from pure inputs: - -```text -ManifestStore = f(fs.FS) // pure, no cluster, no runtime — already exists -Plan = f(ManifestStore, desiredSet, policy) // pure — this is BuildReport, graduated -applied = f(ManifestStore, Plan) // pure mutation -Flush = f(applied, worktree) // the only side effect -``` - -Then the *reconcile layer* (which has the cluster snapshot) builds the store and -computes the plan; the *writer* becomes a dumb "apply plan + flush"; *scan mode* -is "compute plan, render, don't flush"; the *CLI* is "compute plan, render"; -*status* is "summarize plan." All four consumers fall out of one pure function. -The doc gestures at this ("the plan is already a first-class value") but its -struct placement quietly contradicts it by nesting store+plan inside the writer. -Resolve it in favor of the pure boundary and push it **up** to the layer that -owns desired state. - -Corollary the doc should state: **the plan is valid only for a `(commit SHA, -cluster snapshot revision)` pair.** Today `FolderReconciler` waits for two -independently-delivered async events (`OnClusterState`, `OnRepoState`) and -reconciles when both have *ever* arrived — there is no shared revision. The -"single repository transaction" trust model borrowed from `BuildReport` is the -right instinct; extend it to pin both sides to one snapshot, or plan-then-flush -will flush a plan computed against a stale tree. - -And say it plainly: **`manifestreport.BuildReport` is not a throwaway — it -graduates into the Plan computation.** It is already 80% of the planner -(create/update/delete/skip, duplicate losers, non-editable handling) and is -currently near-dead in production (only `EditInPlace` is called live). The doc -treats the *analyzer* as the seed of the model; `BuildReport` is the seed of the -*plan*. Connect them. - -## 3. The internal contradiction: "prune unwatched KRM by default" vs "refuse by default" - -This is the riskiest decision in the doc and it contradicts itself: - -- **Acceptance Checks:** "**Unwatched (bucket 4) is pruned.** … We deliberately - choose pruning over the safer-looking 'leave it inert' option." Stated as *the - rule*. -- **Adoption Policy:** "`refuse` (safest, good default for first materialization)" - and "`prune` … should be opt-in." - -These cannot both be the default. As written, a literal reader implements "delete -every KRM doc with no matching watched API resource" — which **deletes -`kustomization.yaml`, every unwatched CRD, every Flux `Kustomization`/`HelmRelease` -not watched, sealed secrets, etc.** in any real GitOps repo. The doc notices the -`kustomization.yaml` edge but treats destruction as the default and preservation -as the escape-hatch allowlist. That is the safety polarity inverted. - -Strong recommendation: **make unwatched-KRM pruning opt-in per GVK (a -prune-allowlist of kinds you are willing to delete), not opt-out with an -exemption-allowlist.** Reasons: (a) it matches the doc's own `refuse` default; -(b) the analyzer already proved how fragile "valid KRM" classification is — the -`generateName`-only object gets misfiled as non-KRM today, and a misclassification -on the prune path *deletes data*; (c) the source-of-truth conviction justifies -pruning resources you *manage*, but an unwatched kind is by definition one you -have made no claim over — deleting it asserts authority you explicitly declined to -take. Keep the strong conviction for *watched* GVKs; downgrade unwatched to -"report, prune only on explicit per-kind opt-in." - -Separately: the conviction "the API is the source of truth, git is a pure -projection" is stated as "non-negotiable," but it is a **product decision**, not -an architectural one, and it is in tension with the tool being usable on a -Flux-consumable repo that mixes generated and hand-authored manifests. The -architecture should *support* the strict-projection mode without *mandating* it. -Frame it as a configurable posture (the `refuse`/`scan`/`prune` settings already -exist), not a conviction the data model bakes in. - -## 4. Smaller but real - -- **The RESTMapper / GVK↔GVR layer does not exist yet.** Grep finds `RESTMapper` - only in comments and docs, never in code. The doc leans on "resolve GVK to - watched GVR using the watch/catalog/RESTMapper layer" as if it is a layer to - call; it is a layer to *build*, and it must satisfy the analyzer's no-cluster - constraint (so it is an injected interface with a live-informer impl, a - kubeconfig impl, a static-snapshot impl, and a nil "structure-only" impl). This - is phase 2 in the doc but it is underweighted — it is the hardest - dependency-injection problem in the whole plan and everything in phases 3–7 - depends on it. Promote it and spec the interface. - -- **Full materialization has an unbounded memory/CPU cost the doc waves away.** - `FileModel` holds `Original` + `Current` full bytes for *every* file, and the - plan says build node trees for all documents. For the cluster-wide CRD watch - the doc itself cites as the perf motivation, that is the entire tree in memory - and fully parsed per batch. Recommend bounded/lazy materialization: identity - indexing needs only a cheap header parse (`apiVersion`/`kind`/`metadata`), and - the expensive `manifestedit` node tree should be built **only for documents a - plan action touches**. Keep this as an explicit design constraint, not a - "phase 9 optimization" — it changes the `DocumentModel` shape (a - `SnapshotRef`/lazy handle rather than eager bytes), so retrofitting it later is - exactly the kind of rewrite the doc says it wants to avoid. - -- **The doc reads at uniform confidence across settled and unsettled decisions.** - Plan-then-flush, dual index, dirty-flush, "BuildReport graduates" — these are - settled and well-argued. Prune-unwatched default, kustomization allowlist, - refuse-vs-prune default — these are open product questions. Right now they are - written with the same authority, which makes the genuinely strong parts easier - to dismiss. Split into a short **Decisions (non-negotiable)** block and an - **Open policy questions** block. For a doc whose goal is "strong architectural - direction," that separation *is* the strength. - -## What to change in the reviewed doc - -1. Add `FolderReconciler` + the path-derived/content-derived dual-scan problem as - the headline diagnosis (and fix the architecture mermaid to include the - reconcile/watch/events layer). -2. Resolve the store/plan layering explicitly toward the pure `f(fs.FS)` → `Plan` - → apply → flush boundary, with the plan as the cross-layer contract and - `BuildReport` named as its origin. -3. Fix the prune default contradiction and invert the unwatched-prune safety - polarity to opt-in-per-GVK. -4. Pull the RESTMapper/source abstraction and bounded materialization up into - first-class constraints. -5. Split Decisions vs Open Questions. - -## Code references - -- [`internal/reconcile/folder_reconciler.go`](../../../internal/reconcile/folder_reconciler.go) - — the real production diff engine (cluster-as-source-of-truth), unmentioned by - the reviewed doc. -- [`internal/git/helpers.go`](../../internal/git/helpers.go) — - `parseIdentifierFromPath`, the path-derived GVR identity to be deleted. -- [`internal/git/branch_worker.go`](../../internal/git/branch_worker.go) — - `listResourceIdentifiersInPath`, the path-derived git scan. -- [`internal/git/git.go`](../../internal/git/git.go) — `manifestLocator` and - `reconcileAgainstExisting`, the content-derived second scan. -- [`internal/manifestreport/report.go`](../../internal/manifestreport/report.go) - — `BuildReport`, the near-dead planner prototype to graduate. -- [`internal/manifestanalyzer/analyzer.go`](../../internal/manifestanalyzer/analyzer.go) - — the existing pure `f(fs.FS)` boundary to extend. diff --git a/docs/finished/deletecollection-resync-nudge-plan.md b/docs/finished/deletecollection-resync-nudge-plan.md deleted file mode 100644 index 1bb21cac..00000000 --- a/docs/finished/deletecollection-resync-nudge-plan.md +++ /dev/null @@ -1,347 +0,0 @@ -# `deletecollection`: nudge for correctness, parse the body for attribution - -> **Status: SUPERSEDED — not implemented.** This plan solved a problem of the *audit-stream* ingestion -> model: a name-less `deletecollection` skipped the per-type audit tail, so only a periodic checkpoint -> reconcile removed the deleted objects. The -> [watch-first ingestion rewrite](../design/watch-first-ingestion-architecture.md) removes that model: -> `deletecollection` becomes N per-object watch `DELETED` events while the watch is live, and the -> mark-and-sweep on replay reconciles any deletes missed during a watch outage — so the resync nudge -> (Tier 2) is moot. The body-parse attribution (Tier 1) is carried forward, but as the watch-first -> resolver's `deletecollection` fact expander (join per-object `DELETED` by UID, not RV). Kept for -> historical context only. - -## 1. Scope and one paragraph - -A `deletecollection` audit event removes many objects at once but is **name-less**: -the per-type live tail skips it, and only a later checkpoint reconcile removes the -deleted objects from git. For a mirrored warm stream, today nothing prompts that -reconcile, so a collection delete lingers in git until the ~1h periodic sweep. This -plan is **two tiers**: - -- **Tier 2 — correctness floor (do first):** fire the resync nudge that already - exists, so the wired `RequestResync → TypeSynced → deferred heal → scoped sweep` - chain reconciles the type promptly and to ground truth. Smallest correct change. -- **Tier 1 — attribution path (do second, on top of Tier 2):** when the response - body is present (it usually is for core types / CRDs — §2), opportunistically - expand it into per-object **named, attributed** deletes for items that are actually - gone, so the common case ("alice deleted configmap x/y/z") lands precisely through - the normal commit path. Whatever the body misses or gets wrong, the Tier-2 sweep - backstops, and the sweep's removals carry a `Co-authored-by` cause annotation as the - attribution floor. - -The two tiers answer the same question from both ends: Tier 1 gives precise -attribution when the body is trustworthy; Tier 2 guarantees correctness (and floor -attribution) when it is not. We never make the body the *correctness* source — §6. - -## 2. Current state (verified) - -- A `deletecollection` is classified `AuditEventQualityCollection` and emitted by the - joiner — [audit_joiner.go:572](../../internal/webhook/audit_joiner.go#L572). The - classification only means "emittable with or without a body" so an aggregated, hollow - proxy body does not block emission - ([audit_joiner.go:573-582](../../internal/webhook/audit_joiner.go#L573-L582)). It - does **not** strip a real body: `ResponseObject` is carried through the envelope and - merge ([audit_joiner.go:476-504](../../internal/webhook/audit_joiner.go#L476-L504)). -- **For events that are mirrored, the deleted-items list is already captured and - stored.** The audit policy captures `delete`/`deletecollection` at `level: RequestResponse` - ([policy.yaml](../../test/e2e/cluster/audit/policy.yaml)), so for a standard - etcd-backed core type (and CRDs via apiextensions) the response — a `List` of the - removed items, names included — rides in the event. The full event, including - `user` and the complete `payload_json` (request + response bodies), is stored in the - per-type stream entry - ([redis_bytype_queue.go:691](../../internal/queue/redis_bytype_queue.go#L691)) - and round-trips via `parseAuditEvent` - ([audit_event_parsing.go:111](../../internal/queue/audit_event_parsing.go#L111)). - **So Tier 1 needs no joiner/ingestion change — the body is already in the mirror; - only the consumer must learn to read it.** -- **Demand-gated ingestion only mirrors *claimed* types — but now from a claimed type's - FIRST event.** See - [demand-gated-audit-ingestion.md](demand-gated-audit-ingestion.md) (esp. - its §0 capture-before-baseline correction) and - `first-event-loss-on-reclaim-plan.md`: the gate now - opens the moment a GitTarget **claims** a type — synchronously, **before** its checkpoint - syncs — so a claimed type's `deletecollection` is mirrored from the start, not skipped - while it materializes. (The earlier "skip pre-materialization types" behaviour was the - first-event-loss bug, since fixed; capture must precede baseline.) What is still dropped: - a **genuinely unclaimed** type (no GitTarget consumer — nothing to mirror to git anyway), - and an RV-less event that arrives before the type has any numeric high-water — `ingestRVLess` - drops it as `rvless_empty_highwater`, a no-op (the empty mirror has nothing to act on), - checkpoint-backstopped. For `deletecollection` the empty-stream drop may remove a little - too much; this plan accepts that tradeoff for now (dropped events do **not** nudge; the - periodic checkpoint backstops that edge). Revisit under §10. -- The live per-type tail **skips it**: `auditChangeFromEntry` returns `ok=false` for any - name-less entry (`id.Name == ""`) — - [redis_bytype_queue.go:450](../../internal/queue/redis_bytype_queue.go#L450). - Intentional (DEC-5) and correct. -- A `deletecollection` carries no usable RV, so `Enqueue` routes it through - `ingestRVLess` — - [redis_bytype_queue.go:579](../../internal/queue/redis_bytype_queue.go#L579). -- The resync nudge already exists end-to-end and is already the backstop, invoked from - **exactly one** call site today — the `isIDTooSmall` branch of `ingestOrdered`, where a - numeric event whose RV is below the high-water is diverted (rejected from the main stream) - ([redis_bytype_queue.go:551-558](../../internal/queue/redis_bytype_queue.go#L551-L558)). - The chain it drives: `NudgeTypeResyncForLateEvent` - ([materialization.go:70](../../internal/watch/materialization.go#L70)) → - `RequestResync` ([materializer.go:357](../../internal/typeset/materializer.go#L357)) - → `TypeSynced` deferred heal + scoped sweep - ([materialization.go](../../internal/watch/materialization.go)), - wired in cmd ([main.go:241](../../cmd/main.go#L241)). -- Backstop today: `materializationSweepInterval = time.Hour` - ([materialization.go:54](../../internal/watch/materialization.go#L54)). -- Commits already author from the actor: `Author` ← `AuthorUserInfo`, with - `authorName`/`authorEmail` mapping - ([commit.go:198-240](../../internal/git/commit.go#L198-L240)); the message is built - by `buildGroupedCommitMessageData` - ([commit.go:111](../../internal/git/commit.go#L111)). `Co-authored-by` trailers - (§7) extend this without touching the git `Author`/`Committer` identity. - -## 3. What is already correct — do not "fix" these - -- **The tail skipping name-less entries** stays - ([redis_bytype_queue.go:450](../../internal/queue/redis_bytype_queue.go#L450)). - Tier 1's per-object deletes come from the body expansion, not from un-skipping the - name-less entry. -- **The checkpoint/sweep as the correctness plane.** Tier 2 reuses it as-is; Tier 1 - never replaces it. -- **The deferred-until-idle heal** (heal=true, Rec 1) — the nudge inherits it. -- **The collection event emitting with or without a body**, and the aggregated shallow- - drop fix (2026-06-13). Tier 1 reads the body *when present in a mirrored event* and - degrades to Tier 2 when it is hollow/absent — it does not re-introduce a body demand - at ingress. -- **The 15s per-type nudge floor** (`lateNudgeMinInterval`, - [materialization.go:60](../../internal/watch/materialization.go#L60)) already - coalesces teardown bursts. We lean on it explicitly. -- **The empty-stream RV-less drop stays for now** (the `rvless_empty_highwater` outcome — a - no-op, checkpoint-backstopped). We do not nudge for events that `ingestRVLess` drops before - a high-water exists. - -## 4. The gap, located precisely (Tier 2) - -A successful warm-stream `deletecollection` enqueue does not request a resync, so the -deleted objects linger in git for up to one sweep interval (~1h). - -The gap is in **`ingestRVLess`.** A `deletecollection` is RV-less, so it never reaches the -one branch that nudges today (the numeric-RV divert in `ingestOrdered`). Three outcomes -matter after demand-gated ingestion: - -- **Unclaimed type:** if no GitTarget claims the type, `mirrorByType` never calls - `Enqueue` — but an unclaimed type has no consumer, so there is nothing to mirror to git - anyway. (Post capture-before-baseline, a *claimed* type is `Require`d from claim time, so - a claimed type's `deletecollection` always reaches `Enqueue` — outcomes below.) -- **Empty stream (accepted edge):** if the type is wanted but has no numeric - high-water yet, `ingestRVLess` drops the RV-less event as a no-op (`rvless_empty_highwater`). - No event, no nudge. This was introduced to avoid counting harmless RV-less system deletes - (GC, aggregated-API) as diverts; it may drop too much for collection-delete promptness, but - we accept that for v1. -- **Warm stream (the common case):** once a numeric high-water exists, the event - attaches to the high-water with `rv_present=false`; the tail then skips it - (name-less) → silent ~1h wait. This is the case Tier 2 fixes. - -The fix nudges only for the **successful warm-stream ingest**, scoped to -**name-less / `verb == deletecollection`**, not all RV-less events — ordinary single -deletes are RV-less too and the tail already applies them by name -([redis_bytype_queue.go:455](../../internal/queue/redis_bytype_queue.go#L455)); -nudging those would fire a checkpoint LIST per delete. - -## 5. Tier 2 — the nudge (do first) - -1. **Thread the collection signal from `Enqueue` into `ingestRVLess`.** `byTypeAuditKeys` - carries only `group`/`resource`, not verb/name - ([redis_bytype_queue.go:496](../../internal/queue/redis_bytype_queue.go#L496)), - so `Enqueue` must detect `verb == deletecollection` and pass that down (a param or a - `byTypeAuditKeys` field). Small but real plumbing — call it out in review. -2. **Fire the existing nudge for that case only.** On a successful RV-less ingest of a - `deletecollection`, call `q.lateNotify(keys.group, keys.resource)` (the same divert-notifier - hook the `isIDTooSmall` branch uses). `Subresource == ""` for a collection delete, so - `keys.group`/`resource` are already populated - ([redis_bytype_queue.go:262-267](../../internal/queue/redis_bytype_queue.go#L262-L267)). - Fire only after the event attaches to an existing high-water. If `ingestRVLess` drops - on an empty stream, do not nudge for now. Best-effort, non-blocking (IR8). -3. **Nothing downstream changes** — `RequestResync → TypeSynced → deferred heal → scoped - sweep` is unchanged; the 15s floor coalesces; unclaimed/not-Synced is a no-op. - -Net: a handful of lines plus the Enqueue→`ingestRVLess` signal. - -## 6. Why the body is an attribution *hint*, never the correctness plane - -The user's question — "if I delete a bunch of configmaps, isn't the deleted set in the -body? shouldn't we parse it?" — is right for the mirrored warm-stream common case, and -§2 shows the body is already there for that case. But the body must stay a Tier-1 *hint* -under the Tier-2 sweep, because as a *correctness* source it fails in ways that silently -corrupt git: - -- **Finalizers (the headline risk).** `deletecollection` does not remove an object that - has a finalizer — it sets `deletionTimestamp`. The returned list item is that object - *with the timestamp set*, not a confirmation of removal. Deleting it from git would - **over-delete** (the object still exists) **and mis-attribute** (the actual removal - happens later, under the finalizer controller's own event, not Alice's). **Tier-1 - rule: only act on a body item that is actually gone — no pending `deletionTimestamp` - / finalizers; skip the rest and let the sweep + their own later delete events handle - them.** -- **Partial bodies.** A large collection delete can fail partway and return a partial - list → **under-delete**. The sweep backstops. -- **Aggregated / external apiservers** return a hollow body or a `Status` — no usable - list (the case the joiner already tolerates). No list → Tier 1 no-ops, Tier 2 covers. -- **Policy dependence.** A `Metadata`-only policy for these resources means no body - arrives at all. Tier 1 must degrade silently to Tier 2; it can never *assume* a body. -- **Shape variance.** The body may be a typed `…List`, a `v1.List`, or a `Status`. - Parse defensively: list-with-items → expand; anything else → fall back. - -So the body lets us be *precise and attributed* when it is trustworthy, and we lean on -state-based reconciliation when it is not. That is the honest division of labor: events -for attribution, state for correctness. - -## 7. Attribution — Tier 1 precision, `Co-authored-by` floor, and the author-binding line - -> "Alice can delete a namespace without being attributed for it" — a no-go. - -Two mechanisms, layered, both honest: - -**Tier 1 — per-object attributed deletes (the common case).** When the body yields named -items that are actually gone (§6 rule), emit them as ordinary **named deletes carrying -the actor** (the audit event's `user`, via `resolveUserInfo`). These go through the -*normal* commit path — real name, real author — so "alice deleted configmap x" is -precise and needs **no special author-binding handling at all**: it is just a delete, -indistinguishable from a single `kubectl delete configmap x`. This is the cleanest -possible attribution and it covers the case the user cares about most. - -**Tier 2 — `Co-authored-by` cause annotation on the heal (the floor).** What the sweep -removes that Tier 1 did not attribute (finalizer survivors that later vanished, partial/ -absent/aggregated bodies) still deserves a name. But a heal commit is a *generic, -state-reconciling fold* and must not be stamped as one author's, because: - -- **The sweep is state-based** — it removes whatever is missing, which can exceed what - Alice deleted (a finalizer survivor, Bob's earlier missed delete). Stamping it "Alice" - is false. -- **Coalescing merges causes** — the 15s floor + per-type resync can fold several - `deletecollection`s on the same type (Alice in `ns-a`, Bob in `ns-b`) into one heal. - -So credit actors as **`Co-authored-by:` trailers**, which the user proposed and which fit -the existing message builder -([commit.go:111](../../internal/git/commit.go#L111), -[commit.go:226-240](../../internal/git/commit.go#L226-L240)) exactly: - -- Carry an attributable **cause** — `{operation, username, email, auditID, namespace, - resource}` read from the stored event (§2) — into the resync request (a `ResyncCause`, - distinct from per-object author binding). -- The heal commit keeps the **operator/reconciler** as git `Author`/`Committer` (it is a - reconcile, not a human's window) and appends one **`Co-authored-by: Name `** per - distinct actor, reusing `authorName`/`authorEmail`. Multiple causes → multiple - trailers — which, as the user notes, is what should be possible in theory. -- This respects the standing rule - ([commitrequest-author-binding-steer]): identity comes from the audit path / per-type - mirror; **no window is finalized**, no false per-object claim is made (trailers credit - contribution, they are not the commit's `Author`); and it is **fail-closed** — an - unattributable cause leaves a generic trailer-less portion ("…and other unattributed - changes"), never an invented author. - -**The reassurance, scoped honestly:** for mirrored warm-stream events, even before Tier 1 -ships, the actor is not lost — the `deletecollection` event with `user` is in the mirror -(§2). So a v1 that ships only Tier 2 already records *who* via the `Co-authored-by` -floor for that case; Tier 1 then upgrades the common case from "co-authored heal" to -"precise named delete." Dropped demand-gate / empty-stream events have no stored cause -today; §10 records that as a later-improvement target, not a v1 requirement. - -## 8. Unit tests — red-first - -Tier 2 (`internal/queue`; red against current code, green after §5): - -1. **RED → GREEN:** `deletecollection` enqueue fires the nudge on the warm high-water - path (the common case). -2. **GREEN guard:** empty-stream `deletecollection` is dropped and does **not** nudge - for now (documents the accepted edge from demand-gated ingestion). -3. **RED → GREEN:** the Enqueue→`ingestRVLess` collection signal is wired (guards the - plumbing against a silent refactor drop). - -Guards (green throughout): a normal named delete does **not** nudge; `ReadTypeAuditChanges` -still skips a name-less `deletecollection` -([redis_bytype_queue.go:386](../../internal/queue/redis_bytype_queue.go#L386)). - -Materialization: claimed+Synced nudges `RequestResync`; unclaimed/not-Synced no-ops; -repeats within the floor coalesce; a post-nudge `TypeSynced` sweeps only that ScopeGVR -and leaves siblings/namespaces/multi-doc intact. - -Tier 1 (body fan-out): - -4. **A list body with three gone items expands to three named, attributed deletes** - crediting the actor. -5. **A finalizer-pending item (deletionTimestamp + finalizers) is skipped**, not deleted - from git (the headline §6 rule) — the sweep is left to handle it. -6. **A hollow / `Status` / absent body no-ops Tier 1** and falls through to the Tier-2 - nudge when the event was mirrored on a warm stream (aggregated and `Metadata`-policy - cases). -7. **A partial list under-deletes safely** — Tier 1 emits what it has, Tier 2 reconciles - the rest. - -Tier 2 attribution floor: - -8. **Cause survives Enqueue → resync;** a single-cause heal emits one `Co-authored-by`; - a coalesced multi-cause heal emits one trailer per distinct actor; an unattributable - cause yields a generic trailer-less portion. - -## 9. E2E — red-first (and flake-aware) - -The policy already captures `deletecollection` at RequestResponse -([policy.yaml](../../test/e2e/cluster/audit/policy.yaml)) — no policy change. Red/green -hinges on **promptness** (the only backstop today is the ~1h sweep), so "objects gone -from git within a bounded window" fails today and passes after §5. - -**Assertion discipline:** assert **convergence** — "these specific objects gone, these -siblings remain" — never an absolute / global drop count. A convergence assert depends -only on the objects the test created, not on whatever else already lives in the cluster, -so these scenarios run correctly against a **reused** cluster and need **no** fresh-cluster -precondition. The old aggregated-`deletecollection` absolute-drop-count flake is not a -reason to clean first: it was fixed at the source by the 2026-06-13 shallow-drop fix -(deletecollection now emits as-is whether or not it carries a body), so there is no -remaining drop-count signal to keep at zero. - -Scenarios (`test/e2e/deletecollection_e2e_test.go`): - -1. **`kubectl delete configmap --all -n `** — objects disappear from git within a - bounded window. RED today, GREEN after §5. With Tier 1: assert the commits are - **named, attributed deletes** crediting the actor. -2. **Label-selector delete** with a non-matching sibling — only matching objects leave - git; sibling survives (convergence assert). -3. **Finalizer survivor** — a configmap with a finalizer in the deleted set stays in git - until its finalizer clears (proves Tier 1 does not over-delete / mis-attribute). -4. **Teardown burst** — convergence + the 15s floor coalesces (no resync storm); the heal - commit carries `Co-authored-by` for each actor. -5. **Aggregated-API path — already covered** by existing fixtures (hardened 2026-06-13); - confirm green, no new aggregated assert. - -## 10. Later improvements - -- **Prove the accepted dropped-event edge with a red e2e.** Invent an e2e where a - followed type has no numeric high-water yet, then an RV-less `deletecollection` lands - before the first numeric write. Expected current behavior: the event is dropped, no - nudge fires, attribution is absent, and git converges only at the periodic checkpoint. - That gives us a concrete regression test if we later decide the tradeoff is too - expensive. -- **Consider a safe nudge-before-drop path.** If the red e2e shows meaningful user pain, - revisit carrying a minimal `{group, resource, actor, auditID}` cause into a resync - request before the empty-stream drop. That is intentionally deferred because the - current practical goal is to avoid counting harmless RV-less system deletes as divert noise. -- **Re-evaluate the empty-stream RV-less drop for collection deletes.** With capture-before- - baseline a *claimed* type is mirrored from its first event, so the old "demand-gate skips - pre-materialization types" sharpness is gone — the only remaining drop that touches a - claimed type's `deletecollection` is the empty-stream `rvless_empty_highwater` no-op (an - RV-less collection delete before the type's first numeric write). That is the sharp edge to - revisit; any future relaxation should be narrow and checkpoint-backed. - -## 11. Definition of done - -- **Tier 2 first:** §8.1 and §8.3 written red-first then green; §8.2 and the other - guards stay green; §9.1 demonstrated RED→GREEN with convergence asserts (no - fresh-cluster precondition — convergence asserts run against a reused cluster). The - `Co-authored-by` floor (§8.8) lands with Tier 2 so v1 records *who* - for mirrored warm-stream collection deletes. -- **Tier 1 second, on the Tier-2 floor:** §8.4–8.7 (esp. the finalizer-skip rule) and - §9.1's attributed-delete assert + §9.3 finalizer survivor. -- Full validation per AGENTS.md: `task fmt → generate → manifests → vet → lint → test → - test-e2e` (e2e sequentially; clean-cluster first if k3d is stale). -- README/chart wording: collection deletes trigger **prompt reconciliation/sweep**, with - **opportunistic attributed per-object deletes when the API server returns the deleted - set** — not unconditional per-item fan-out (§6). -- Author-binding respected throughout: Tier 1 deletes are ordinary named/authored writes; - Tier 2 credits actors via `Co-authored-by` trailers, fail-closed, never as the git - `Author` of a heal and never finalizing a window. diff --git a/docs/finished/demand-gated-audit-ingestion.md b/docs/finished/demand-gated-audit-ingestion.md deleted file mode 100644 index a86110ad..00000000 --- a/docs/finished/demand-gated-audit-ingestion.md +++ /dev/null @@ -1,516 +0,0 @@ -# Demand-gated audit ingestion: only mirror types that are actually wanted - -Status: **IMPLEMENTED** — landed on `poc/redis-copy` 2026-06-17 (uncommitted at time of writing). -`task fmt`/`vet`/`lint` and the full `task test` are green, and `task test-e2e` passed **48/0/8 from -a clean cluster**. - -**As built:** -- New `internal/gate` package — [`gate.go`](../../internal/gate/gate.go): `Gate` with - the `__required__` SET + `__required__:updates` ping stream, `Seed`/`Run`/`Allow`/`Require`/ - `Unrequire`, an `AlwaysAllow` static set (§5), and `Start` so it plugs into the controller-runtime - manager. Unit tests cover HA cross-instance propagation, idempotency, key derivation, seed, - run-loop, always-allow. -- `queue.DeleteType` + exported `queue.TypeBaseKey` ([`redis_bytype_queue.go`](../../internal/queue/redis_bytype_queue.go)), with a `DeleteType` unit test. -- Reader wiring: [`mirrorByType`](../../internal/webhook/audit_handler.go#L499) gates via the - nil-safe `MirrorGate` interface (a nil gate keeps the legacy mirror-everything behaviour). -- Writer wiring: [`handleMaterializationEvent`](../../internal/watch/materialization.go) — originally - `Require`d at `SyncRequested` and `Unrequire`+`DeleteType`d at `Released`. **Superseded — see §0:** - `Require` is now synchronous on claim (`DeclareForGitTarget`), `Unrequire` moved to the `Unclaimed` - event, and `Released` keeps only `DeleteType`. -- [`cmd/main.go`](../../cmd/main.go) constructs the gate, seeds `AlwaysAllow` with - `configbutler.ai/commitrequests`, and adds it as a manager runnable. -- **Empty-stream guard** (§8): `ingestRVLess` now DROPS an RV-less event that arrives before its - type has any numeric high-water (a no-op on an empty mirror, checkpoint-backstopped) instead of - diverting it to the late lane. Without this, RV-less system-controller deletes (GC of an owned - object, an aggregated-API delete) racing ahead of their type's first numeric write still landed in - the late lane under gating — the e2e late-lane assertion caught this. -- **Late-lane metric + e2e invariant:** `telemetry.AuditLateLaneDivertedTotal{reason}` - (`gitopsreverser_audit_late_lane_diverted_total`) is incremented in `divertLate`; the e2e suite's - `SynchronizedAfterSuite` asserts it stayed 0 for the whole run (with a liveness guard so a dead - metrics pipeline can't pass vacuously) — the operator-facing "is the late lane empty?" signal. -- **Two regressions the e2e suite caught (units passed in isolation):** (1) CommitRequest author - attribution reads the unclaimed `commitrequests` stream — fixed with the `AlwaysAllow` set (§5); - (2) RV-less-before-high-water deletes still hit the late lane — fixed with the empty-stream guard. - -Author note: this grew out of the late-lane diagnostics work -(`late-lane-e2e-2026-06-16-investigation.md` -and the 2026-06-16 fresh-run follow-up). Chasing "why is anything in the late lane" surfaced a -bigger, dumber problem underneath it, described in §2. - -**Reading order:** §3 (principles — "over-capture is free, under-capture is rare and self-healed") -and §5–§7 (what "wanted" means + coverage model + the shared-list / ping-stream mechanism); §12 is -the as-built code map. -Background: the demand lifecycle (`demand-driven-type-materialization-lifecycle.md`) -and the reconcile model ([`api-source-of-truth-reconcile.md`](api-source-of-truth-reconcile.md)), -whose **checkpoint is the correctness authority this design leans on** (§6). - -## 0. Refinement (2026-06-19): the gate opens on CLAIM, not on sync — capture before baseline - -The original wiring (the "As built" bullet above) `Require`d a type at **`SyncRequested`** — i.e. only -once its checkpoint sync had begun. That is **materialize-first**, and it loses a freshly (re)claimed -type's **first events**: between a GitTarget claiming a type and its first LIST completing, live events -were gated `not_needed` and dropped, with nothing to heal them (a state snapshot captures *what exists*, -not *what happened* — authorship, a create-then-delete, the very first event before any LIST). This was -diagnosed and fixed as a real loss bug — see `first-event-loss-on-reclaim-plan.md`. - -**Principle (capture before baseline):** the demand gate is now opened the moment a type is **claimed** -— synchronously, in `DeclareForGitTarget`, independent of and before any checkpoint sync — and closed -only when the **last claim is withdrawn** (the sweep's `Unclaimed` event), *not* on the checkpoint -`Released` event (a followability wobble force-releases the checkpoint while the claim survives, and such -a type must keep being mirrored). The invariant is **`Required ⟺ claimed`**. Capture must start early -(an event before it is unrecoverable); baseline can follow (the folded log keeps it current); over- -capture is free (§3). This supersedes the §5/§6 "wanted flips at sync" wording and the -`Require@SyncRequested`/`Unrequire@Released` line in the intro. - -## 1. Scope and one paragraph - -Today the audit webhook mirrors **every** audited, body-merged event into a per-resource-type -Redis stream — unconditionally, for every type the cluster emits, whether or not any GitTarget will -ever follow it ([`audit_handler.go` `mirrorByType`](../../internal/webhook/audit_handler.go#L499) -→ [`RedisByTypeStreamQueue.Enqueue`](../../internal/queue/redis_bytype_queue.go#L199)). The -**checkpoint/objects** sink is already demand-driven — the materializer only LISTs *claimed* types -(L-3, `mirrorTypeObjects`) — but the **audit-log** sink is not. This doc closes that gap: gate the -per-type audit mirror on a **shared required-types set in Redis**, kept fresh on every ingest pod via -a tiny **ping stream**, so a type is mirrored only while it is wanted and torn down when it is not. -The design is **multi-pod-ready from day one** (any pod may receive any type's audit events), and it -deliberately favours *over*-capture, because the periodic checkpoint is the correctness backstop -(§6). - -## 2. Motivation - -### 2.1 Mirroring every type is the perfect way to make Redis explode - -The per-type stream model is great for a *followed* type and pure overhead for an *unfollowed* one. -We currently pay, for every type the cluster ever audits: - -- a `…:audit:stream` (RV-ordered, `MAXLEN`-bounded — but bounded × N types), -- a `…:audit:late` lane (never trimmed), -- a `…:audit:idstate` hash, -- an entry in the `…:__index__` set. - -The cost scales with **the cluster's type cardinality and churn**, not with **demand**. That is -backwards. A real cluster has hundreds of CRDs plus the high-churn core/system types -(`events.k8s.io/events`, `discovery.k8s.io/endpointslices`, leases, `controllerrevisions`, …), and a -typical install follows a *handful* of them. Every unfollowed type is a stream we write, index, and -never read. - -Measured on a fresh `task test-e2e` run (2026-06-17), which is already **wildcard-heavy** (most types -get claimed), the waste is still plain: - -| | types | stream entries | -|---|---:|---:| -| claimed (has `:objects:state`) | 62 | 244 | -| **unclaimed (mirrored for nothing)** | **13** | **220 (~47%)** | - -The 13 unclaimed types carrying ~half the stream volume are exactly the high-churn ones nobody -follows — `discovery.k8s.io:endpointslices` (38), `core:namespaces` (34), `events.k8s.io:events` -(24), `monitoring.coreos.com:prometheuses/alertmanagers/...` (18 each), `batch:jobs/cronjobs` (18 -each), `apps:controllerrevisions` (18). On a cluster with **targeted** WatchRules instead of -wildcards the ratio inverts: a few claimed types out of hundreds, the rest pure waste. There is no -`MAXLEN` that fixes this — the leak is in the **number of streams**, not their length. - -### 2.2 It is also a late-lane noise source - -The late-lane investigations keep finding the same shape: the diagnostic noise is concentrated on -types that are either dry-run-only, or **cold/unfollowed**, or being touched by cluster lifecycle -machinery *before any object of that type was ever materialized*: - -- `core:namespaces` / `core:configmaps` warmup creates (the e2e `gitops-reverser-audit-warmup` - primer) — and `namespaces` is **unclaimed** here, so today it gets a stream + a late entry for a - type nobody follows. -- `wardle.example.com:flunders` namespace-GC `deletecollection`s, all stamped **13:05–13:07**, while - the first real flunder is not mirrored until **13:12** — i.e. they all land *before* flunders - materialization starts. - -Both classes vanish when the mirror only exists during a type's active materialization window (§5). -What is left in the late lane after that is the genuinely interesting case — a real recent reorder on -an actively-materialized type — which the floor/empty-stream guard in -[`api-source-of-truth-reconcile`](api-source-of-truth-reconcile.md)'s late-lane -cleanup then classifies (§8). The two changes are complementary: demand-gating removes the *surface*, -the guard cleans the *residual*. - -## 3. Principles - -1. **Demand, not cardinality, decides what we mirror.** A type stream exists iff some GitTarget - currently wants it. (Mirrors the checkpoint sink's existing rule.) -2. **One shared signal in Redis.** The set of required types lives in Redis (`__required__`) and is - readable by every ingest pod; a tiny ping stream (`__required__:updates`) keeps each pod's local - copy fresh. There is exactly one definition of "wanted", shared, with no per-pod divergence. -3. **Over-capture is free; under-capture is rare and self-healed.** Mirroring a type slightly *too - early* only writes entries with `rv ≤ C` that the next trim drops — harmless. Mirroring slightly - *too late* can miss an event, but **the periodic checkpoint re-LIST captures it at the next - re-anchor** — so a miss costs *freshness*, never *correctness*. We therefore bias hard toward - early/over-capture (§6). The checkpoint, not the gate, is the correctness authority. -4. **Best-effort on the hot path.** `Allow` is an in-memory lookup against the locally-cached set; a - stale cache or a Redis hiccup never fails an audit request and self-corrects on the next ping or - slow-poll (§7, §10). -5. **Release reclaims space, on a lifecycle event.** Losing demand for a type fires the existing - `Released` materialization event, which already drops the checkpoint; we hang the audit-key - deletion off that same event (next to the existing `:objects:*` cleanup), so Redis shrinks when - WatchRules narrow — the inverse of the explosion. No inactivity scanning (§7). - -## 4. Invariants - -- **DG1 (coverage — best-effort, checkpoint-backstopped).** For a type's materialization window with - first checkpoint revision `C`, the log *should* contain every event with `rv > C`. We make that - hold in practice by adding the type to `__required__` **early** (at the `Requested` transition, - well before the LIST that pins `C`) and propagating via the ping stream, so by the time `C` exists - every pod is already mirroring (§6). When a miss does occur (a pod that has not yet seen the ping - processes an `rv > C` event), the gap is **bounded by one re-anchor interval and healed by the next - checkpoint** — never permanent loss. (Contrast DG1's *hard* form, which would require a synchronous - cross-pod lead before every first LIST; we deliberately do not pay that — see §14.) -- **DG2 (no orphan streams).** When a type is no longer wanted, its `:objects:*`/`:audit:*` keyspace is - reclaimed. **Updated by §0 (capture-before-baseline):** the keyspace cleanup (`clearTypeObjects` + - `DeleteType`) stays on the **`Released`** event (a checkpoint drop), but the gate flag (`Unrequire`, - SREM from `__required__`) **moved to the `Unclaimed` event** — the sweep's GC of the *last claim* — - because `Released` also fires on a followability wobble while the claim survives, and a still-claimed - type must keep being mirrored. So the gate tracks the **claim** (`Required ⟺ claimed`), the keyspace - cleanup tracks the **checkpoint**. (Originally both were on `Released`; see - `first-event-loss-on-reclaim-plan.md` §6.2.) - `Released`/`Unclaimed` are **grace-protected upstream** (§5), so by the time they fire the type has - been cold for the grace — no inactivity scan needed. -- **DG3 (membership ⊆ checkpoint demand).** A type is only ever in `__required__` while it is - claimed ∩ followable — i.e. a subset of what the checkpoint driver syncs. Over-capture lives - *within* a type's own window (early add), never across types that are not wanted at all. - -## 5. What "wanted" means and when it flips - -A type is wanted exactly when it is **claimed ∩ followable** — precisely the set of phases past -`PhaseDormant` in the materializer -([`materializer.go`](../../internal/typeset/materializer.go#L84-L132)): - -| Phase | In `__required__`? | Why | -|---|:--:|---| -| `Dormant` | no | no live claim, or not followable — nothing wants it | -| `Requested` | **yes (added here)** | claimed + followable; added *early*, before the first LIST, to maximise propagation slack (§6) | -| `Syncing` / `Synced` / `Resyncing` / `Failing` | yes | actively materializing or serving a checkpoint | - -Membership tracks two existing materialization lifecycle events, so the gate never re-derives demand: - -- **Add on `SyncRequested`** (emitted at `Dormant → Requested`) — `gate.Require` (§7). -- **Remove on `Released`** (checkpoint dropped → Dormant) — `gate.Unrequire` + `DeleteType` (§7). - -`Released` is **grace-protected on both axes**, which is what makes tearing the stream down on it -safe (the type has been cold for the grace by the time it fires): - -- **Followability/discovery loss** is held for `RemovalGrace = 60s` - ([`registry.go:33`](../../internal/typeset/registry.go#L33) — "stops a short discovery blink from - turning into a large Git sweep") before `TypeRemoved` → `forceReleaseLocked` → `Released`. -- **Demand withdrawal** ages the claim lease out over the materializer `Sweep`, then - `releaseLocked` → `Released`. - -The materializer leaf stays Redis-free: it emits these phase events; the watch/driver layer (which -already owns Redis) translates them into the `Require`/`Unrequire`/`DeleteType` calls (§7). - -**Demand is not only from GitTargets — internal consumers count too.** Some types are read from the -per-type mirror by the controller itself, not for git. The CommitRequest author attribution scans -the `configbutler.ai/commitrequests` stream for the request's own create event -([`commitrequest_author.go`](../../internal/queue/commitrequest_author.go)), but **no GitTarget -claims `commitrequests`** — so a pure claim-driven gate would drop those events and attribution would -fail closed (`"create audit event was not observed"`). These are handled by an **always-allow** set -(`gate.Config.AlwaysAllow`): types mirrored on every pod from startup, independent of claims and -never released. It is config-driven (identical on every pod, so it needs no sharing) and is the -gate's expression of "an internal consumer demands this type." Today it holds exactly -`configbutler.ai/commitrequests`; add to it only when another internal consumer reads a stream no -GitTarget claims. (This was the one regression the e2e suite caught — unit tests passed in isolation -because the gate didn't know about the system-level consumer; see §11 #2.) - -## 6. Coverage model: add early, heal late - -The whole correctness argument rests on one asymmetry (Principle 3): **over-capture is free, -under-capture is self-healed.** That lets the gate be a cheap, eventually-consistent shared cache -instead of a synchronously-coordinated lock. - -Timeline for one type's first sync, across pods: - -``` - type enters Requested checkpoint LIST taken later writes - SADD __required__ + ping (rv = C) (rv > C, captured) - │ ── ping propagates ──▶ │ │ │ │ - ──────●───────────●──────────●──────────●───────────●─────────●────●────●────► time - │ │ │ │ - │ pod A sees it pod B sees it │ (all pods mirroring well before C) - └───────────── slack ─────────────┘ -``` - -- **Add early.** Membership is written when the type enters `Requested`, which is *before* the driver - runs the LIST (the LIST is downstream of `BeginSync`, which is downstream of `Requested`). The - natural latency between "claim observed" and "LIST issued" is the propagation slack — no explicit - sleep or lead-time constant needed. The entries this captures with `rv ≤ C` are redundant and are - dropped by the normal trim ([`TrimTypeAuditLog`](../../internal/queue/redis_bytype_queue.go#L250)). -- **Fast propagation via a stream, not pub/sub.** A Redis *stream* is replayable: a pod resumes from - its last-read ID, so a brief disconnect never silently loses a wakeup (pub/sub would). Each entry is - a trivial "changed" ping (an epoch counter); pods react by re-reading the *whole* `__required__` - set, so the update is idempotent and a pod that missed many pings still converges from the latest - one. `MAXLEN` can be tiny. -- **The rare miss is healed by the checkpoint.** If a pod processes an `rv > C` event before its cache - reflects the open, that one event is absent from the log. Between `C` and the next checkpoint `C'` - the mirror is briefly stale; at `C'` (≥ that event's rv) the consistent LIST re-reads the world and - the state is captured. The log/tail is a *freshness optimisation over* the checkpoint, which is the - correctness floor (the api-source-of-truth model) — so a gate miss degrades latency, not integrity. - -Why this is sound rather than just convenient: the cost of a miss is exactly "a change is reflected -in the GitTarget mirror one re-anchor later than ideal," and re-anchors already run on a timer (and -are nudged by late-lane events). For a GitOps-reversal mirror that is an acceptable, bounded -staleness — and it removes an entire class of cross-pod coordination from the hot path. - -## 7. Mechanism — shared required-set + ping stream - -``` - Redis (shared) - ┌────────────────────────────────────────────┐ - │ :__required__ SET of base │ - │ :__required__:updates ping stream │ - └───▲───────────────────────────────┬────────┘ - │ SADD/SREM + XADD ping │ SMEMBERS (seed) + XREAD BLOCK (wakeup) + slow poll - writer: watch/driver reader: every ingest pod - │ │ - handleMaterializationEvent: mirrorByType: Allow(group,resource) before Enqueue - SyncRequested → Require + LIST - Released → Unrequire + DeleteType (+ existing stopTail/clearObjects) -``` - -**Keys.** Two shared keys under the existing prefix (`gitops-reverser`): -- `…:__required__` — a SET whose members are per-type **base keys** (`::`, - same shape as [`__index__`](../../internal/queue/redis_bytype_queue.go#L60) / - [`typeBaseKey`](../../internal/queue/redis_bytype_queue.go#L650)). -- `…:__required__:updates` — a Redis stream; each entry is a small ping (e.g. `epoch=`). Trimmed - to a tiny `MAXLEN` (only the latest entry matters; older ones are wakeups already consumed). - -**Reader (every ingest pod, hot path stays in-memory).** -- On startup: read the stream's current last ID, then `SMEMBERS __required__` to seed a local - `map[baseKey]struct{}`, then begin `XREAD BLOCK` from that last ID (this ordering can't miss an - update between seed and subscribe). -- A background goroutine blocks on `XREAD`; on *any* new entry it re-reads `SMEMBERS __required__` - and swaps the local set. A **slow poll** (re-`SMEMBERS` every ~30s regardless) backstops a missed - wakeup or a silent period. -- [`mirrorByType`](../../internal/webhook/audit_handler.go#L499) calls `Allow(group, resource)` — - an O(1) local lookup — before `Enqueue`. The key is derived exactly like - [`baseKey`](../../internal/queue/redis_bytype_queue.go#L632): a `scale` subresource maps to the - **parent** type (DEC-A), a missing resource (`__unknown__`) is never allowed. On `false` we skip - `Enqueue` (and can skip the body-join/park work earlier in - [`processEvent`](../../internal/webhook/audit_handler.go#L290), since the joined event has no - consumer but this mirror now that the canonical stream is retired). - -**Writer (the materialization owner; single-pod = the one pod, multi-pod = the per-type owner, §9).** -The two writes hang off the existing -[`handleMaterializationEvent`](../../internal/watch/materialization.go#L428) dispatcher — no new -control loop, no scanning: -- **`SyncRequested` →** `gate.Require(gvr)` (`SADD __required__ ` + a ping) **then** the - existing `runTypeCheckpointSync` ([`materialization.go:435`](../../internal/watch/materialization.go#L435)). - Require precedes the LIST, so the early-add of §6 is automatic. Idempotent — re-adding an - already-required type is a no-op `SADD`; skip the ping when `SADD` added nothing (re-anchors don't - re-ping). -- **`Released` →** alongside the existing `stopTypeAuditTail` + `clearTypeObjects` - ([`materialization.go:436-438`](../../internal/watch/materialization.go#L436)): `gate.Unrequire(gvr)` - (`SREM __required__ ` + ping, stopping new mirroring across pods within a ping) **then** - `DeleteType(gvr)`. Tail-stop precedes both, so the owner is not itself still writing. - -`DeleteType(group, resource)` is the audit-side twin of `clearTypeObjects`: a new -[`RedisByTypeStreamQueue`](../../internal/queue/redis_bytype_queue.go#L130) method that `DEL`s -`…:audit:stream`, `…:audit:late`, `…:audit:idstate` and `SREM`s the base key from `__index__` (mirror -of [`ensureIndexed`](../../internal/queue/redis_bytype_queue.go#L603)). The `:objects:*` keys are -already deleted by `clearTypeObjects` on the same event — so on `Released` a type's entire Redis -footprint (objects + audit + index) goes away together. - -**Why no janitor is needed:** `Released` fires only *after* a grace (§5), so the type is cold by then; -and in single-pod the writer and the sole reader are one process — no reader-lag window. The only -residual is the multi-pod release race (§10), covered by §9's demand-reconcile backstop (not an -inactivity scan). Out of the day-one (single-pod) plan. - -**The gate type.** All of the above sits behind one small `TypeMirrorGate`: -`Allow(group, resource) bool` (reader), `Require(gvr)` / `Unrequire(gvr)` (writer), plus the internal -subscriber goroutine and seed/slow-poll. The local set is guarded for concurrent access (an -`RWMutex`, or an `atomic.Pointer` the subscriber swaps), because the audit hot path reads it while the -subscriber replaces it. There is a single Redis-backed implementation — the design from day one, -single-pod included (the one pod is both the writer and the sole subscriber, at negligible cost); no -in-memory-only variant is kept. - -## 8. Interaction with the late-lane guard - -These compose; neither subsumes the other: - -- **Demand-gating (this doc)** removes (a) all streams for never-claimed types — the bulk of the - explosion and incidental noise like the `namespaces` warmup entry, and (b) all *pre-materialization* - events for claimed types — e.g. the flunders `deletecollection`s that arrive before flunders is in - `__required__` (anything before the early add is simply not mirrored). -- **The floor / empty-stream guard** then classifies the *residual* on actively-materialized types. - Two parts, with different status: - - **Empty-stream (RV-less-before-high-water → no-op): IMPLEMENTED here** in `ingestRVLess`. This was - not optional after all — the e2e late-lane assertion showed that even under gating, RV-less - system-controller deletes (GC, aggregated-API) that race ahead of their type's first numeric write - still hit the late lane. Dropping them as no-ops (checkpoint-backstopped) is what actually makes - the late lane reliably empty. - - **Floor (numeric RV below the checkpoint cursor → provably superseded → drop): still future.** Not - needed for what e2e exhibits today (0 `older-than-high-water` observed), but it is the catch for a - genuine stale-replay/dry-run reorder on a populated stream. Until it lands, such an event (rare) - would still divert and the e2e invariant would flag it — which is the correct, investigate-worthy - signal. - -End state: the late lane is empty in a clean run, and any entry in it is actionable — the original -goal. - -## 9. Multi-pod operation, ownership, and boot - -The **reader side is multi-pod-ready immediately** — extra ingest pods just subscribe and need no -rework. Multi-pod **writing** (multiple control planes) rides per-type ownership, which is deferred; -the open questions are *who writes* `__required__` and how a restart recovers. - -- **Writers are single per type.** Each type's membership is written by that type's materialization - owner. In single-pod that is trivially the one pod; in multi-pod it rides the **per-type - single-writer ownership** that HA needs anyway for the LIST/trim - (`ha-improvements.md` §5, genuinely deferred). One owner per type means no - `SADD`/`SREM` fights. The ping stream and the `__required__` set themselves are plain shared - structures — no per-entry TTL/lease — because a single writer per type is the simpler liveness - story than N self-expiring leases. -- **Failover rebuilds membership from durable state.** On a new owner taking over (or any boot), it - reconstructs the set of required types it owns from the durable claim + checkpoint state - (`:objects:state`, the demand records — `ha-improvements.md` §3) and - re-asserts `Require` for each. A type that is no longer wanted then releases through the normal - `Released` path at the next sweep (which deletes its keys); a thin **demand-reconcile** backstop - (delete keys whose base is absent from `__required__`) covers the rare orphan from a release that - raced a crash. No handoff message to lose, and — note — this backstop is demand-driven, not the - inactivity scan we rejected (§14). -- **Readers seed before serving.** An ingest pod completes its initial `SMEMBERS` seed before the - audit handler starts accepting events, so a restart does not begin in a blind state. (Even if it - did, Principle 3 bounds the damage to a checkpoint-healed miss.) -- **Stream stays tiny by nature.** The update rate is bounded by *claim churn* (types entering/leaving - the followed set — rare, controller-paced), not by event rate. With ping-not-payload entries and a - small `MAXLEN`, `__required__:updates` cannot become hot. - -## 10. Edge cases & failure modes - -- **Cache lags a fresh open (the DG1 miss).** A pod processes an `rv > C` event before its ping - arrives → that event is absent from the log → mirror briefly stale → healed at the next checkpoint - (§6). Made rare by early-add + stream wakeup; never unbounded. -- **Release race (multi-pod only).** Deletion is on the `Released` event after `Unrequire`+ping. - Single-pod has no race (one process is both writer and reader). Multi-pod: a pod whose cache - hasn't yet seen the ping could `Enqueue` one bounded entry just after `DeleteType`, re-creating the - stream; the demand-reconcile backstop (§9) deletes it on a later pass. Tiny window (near-instant - ping, type already cold), `MAXLEN`-bounded, and only relevant once per-type ownership lands. -- **Writer/owner crash mid-release.** If a crash interrupts a release, the type is simply still - un-`Released`; on restart the owner rebuilds `__required__` (§9) and, if the type is no longer - wanted, the next sweep emits `Released` and deletes its keys. Plain set + lifecycle event, no TTL. -- **Reader disconnect.** `XREAD` resumes from the last ID (stream replay); the slow poll covers a long - outage; a full restart re-seeds via `SMEMBERS`. -- **Followable churn / CRD wobble.** A wobble freezes sync but keeps serving the checkpoint - (`frozen`); the type stays in `__required__` (we still want freshness for a served type) and is - removed only on actual release. -- **Unknown / no-objectRef events.** Never wanted → never mirrored (today they pollute the - `__unknown__` bucket). -- **Redis unavailable for the gate read.** Hot path uses the last-known local set, so ingestion keeps - working on the most recent membership; it converges when Redis returns. A gate write failure is - logged and retried on the next phase event. - -## 11. Acceptance criteria - -**Status: met.** Unit + `DeleteType` + handler-gating tests green; `task test-e2e` passed 48/0/8 -from a clean cluster (2026-06-17), including the CommitRequest specs (#2-style coverage in practice) -after the `AlwaysAllow` fix. - -1. A type never added to `__required__` produces **zero** `…:audit:*` keys and no `__index__` - membership. -2. **Happy-path coverage:** a freshly claimed type added at `Requested` captures every `rv > C` write - — integration test: claim → (early add) → race writes around the LIST → assert the tail sees every - post-`C` write. -3. **Heal-on-miss (soundness of the best-effort posture):** with membership *forced* to arrive late - (simulate a slow pod) so an `rv > C` event is missed, the next checkpoint re-anchor restores the - missing state — assert the mirror converges after one re-anchor. -4. **Propagation:** a second subscriber updates its local set within one ping (and, with pings - suppressed, within the slow-poll interval) of a `Require`/`Unrequire`. -5. **Release deletes keys (DG2):** on the `Released` event, `Unrequire` stops new mirroring (within a - ping) and `DeleteType` removes `…:audit:stream` / `…:audit:late` / `…:audit:idstate` and the - `__index__` entry — next to the existing `clearTypeObjects`. Assert a released type's full Redis - footprint is gone. -6. On a clean `task test-e2e` run, `__index__` equals `__required__` (no unclaimed streams); the - unclaimed-waste row in §2.1 is **0 types / 0 entries**. -7. No regression in tail freshness for claimed types; full suite + e2e green. - -## 12. Code map (read these first) - -Line anchors correct as of 2026-06-17 (`poc/redis-copy`); re-grep if they drift. - -**New — the gate:** `TypeMirrorGate` (suggested `internal/queue` or a new `internal/gate`): the -`__required__` SET + `__required__:updates` stream ops, the subscriber goroutine (seed + `XREAD` + -slow poll), and `Allow` / `Require` / `Unrequire`. Model its tests on -[`internal/queue/redis_bytype_queue_test.go`](../../internal/queue/redis_bytype_queue_test.go) -(miniredis supports streams + sets). - -**Reader — audit hot path:** [`internal/webhook/audit_handler.go`](../../internal/webhook/audit_handler.go) -- `AuditHandlerConfig` [L66](../../internal/webhook/audit_handler.go#L66); `ByTypeQueue` [L79](../../internal/webhook/audit_handler.go#L79); `AuditEventQueue` [L83](../../internal/webhook/audit_handler.go#L83) — add the gate alongside. -- `processEvent` [L290](../../internal/webhook/audit_handler.go#L290) (early-gate candidate); `mirrorByType` [L499](../../internal/webhook/audit_handler.go#L499) (**minimal correct gate point, before `Enqueue`**); `extractGVR` [L580](../../internal/webhook/audit_handler.go#L580). - -**Queue — key schema + new cleanup:** [`internal/queue/redis_bytype_queue.go`](../../internal/queue/redis_bytype_queue.go) -- Suffixes [L57-60](../../internal/queue/redis_bytype_queue.go#L57); `baseKey` [L632](../../internal/queue/redis_bytype_queue.go#L632) + `typeBaseKey` [L650](../../internal/queue/redis_bytype_queue.go#L650) — **gate key must match** (scale→parent, `__unknown__`). -- `Enqueue` [L199](../../internal/queue/redis_bytype_queue.go#L199); `ensureIndexed` [L603](../../internal/queue/redis_bytype_queue.go#L603); `TrimTypeAuditLog` [L250](../../internal/queue/redis_bytype_queue.go#L250). -- **New:** `DeleteType(group, resource)` — `DEL` the three keys + `SREM` from `__index__`. - -**Demand leaf — phase machine (stays Redis-free):** [`internal/typeset/materializer.go`](../../internal/typeset/materializer.go) -- Phases [L59-77](../../internal/typeset/materializer.go#L59); `Declare` [L157](../../internal/typeset/materializer.go#L157); `BeginSync` [L240](../../internal/typeset/materializer.go#L240); `SyncSucceeded` [L285](../../internal/typeset/materializer.go#L285); `Sweep` [L384](../../internal/typeset/materializer.go#L384); `releaseLocked` [L503](../../internal/typeset/materializer.go#L503); `Inventory` [L618](../../internal/typeset/materializer.go#L618). Emits `MaterializationEvent`s — do **not** add a gate dependency here. - -**Driver — where `Require`/`Unrequire`/`DeleteType` fire (the single hook surface):** -- [`handleMaterializationEvent`](../../internal/watch/materialization.go#L428) — the dispatcher. - `case SyncRequested` [L434-435](../../internal/watch/materialization.go#L434): `gate.Require(gvr)` - **before** `runTypeCheckpointSync`. `case Released` [L436-438](../../internal/watch/materialization.go#L436): - add `gate.Unrequire(gvr)` + `DeleteType(gvr)` alongside the existing `stopTypeAuditTail` + - `clearTypeObjects` (the `:objects:*` twin to model `DeleteType` on). -- Lifecycle vocabulary: [`materialization_lifecycle.go`](../../internal/typeset/materialization_lifecycle.go#L41) — `SyncRequested` (L41), `Released` (L56). -- The grace that makes `Released` safe: [`registry.go` `RemovalGrace = 60s`](../../internal/typeset/registry.go#L33) (followability axis) → `TypeRemoved` → [`forceReleaseLocked`](../../internal/typeset/materializer.go#L488); demand axis → [`Sweep`](../../internal/typeset/materializer.go#L384) → [`releaseLocked`](../../internal/typeset/materializer.go#L503). - -**Wiring:** [`cmd/main.go`](../../cmd/main.go) — `NewRedisByTypeStreamQueue` [L221](../../cmd/main.go#L221); `AuditLogTrimmer` [L256](../../cmd/main.go#L256); `NewAuditHandler` [L347](../../cmd/main.go#L347) + `ByTypeQueue` [L351](../../cmd/main.go#L351). Construct the gate; reader half → handler config; writer half → watch `Manager` (the `Require`/`Unrequire`/`DeleteType` calls live in `handleMaterializationEvent`). - -## 13. Implementation order (red-first) — completed - -This is the order it was built in (all steps done): - -1. **Gate substrate** (`TypeMirrorGate`, Redis-backed): `__required__` SET + `__required__:updates` - stream; `Require`/`Unrequire` (`SADD`/`SREM` + ping), reader (seed `SMEMBERS` → `XREAD` loop → - slow poll) maintaining the local set, `Allow`. Unit tests (miniredis): membership, key derivation - (scale→parent, `__unknown__`), ping→refresh, slow-poll backstop, reconnect/replay. *Red first.* -2. **Coverage tests:** (a) happy-path — early add → every post-`C` write captured; (b) heal-on-miss — - forced-late membership → missed `rv > C` event restored by the next checkpoint (acceptance #2, #3). -3. **Reader wiring:** `mirrorByType` consults `Allow` before `Enqueue` (then optionally hoist earlier - in `processEvent`). -4. **Writer wiring (in `handleMaterializationEvent`):** `gate.Require(gvr)` in the `SyncRequested` - case before `runTypeCheckpointSync`; `gate.Unrequire(gvr)` in the `Released` case. -5. **`DeleteType` (new queue method, + test):** called in the `Released` case next to the existing - `clearTypeObjects` (its `:objects:*` twin). No janitor — `Released` is the grace-protected trigger. - (Defer the multi-pod demand-reconcile backstop of §9 until per-type ownership exists.) -6. **`cmd/main.go`** construction; boot ordering (reader seeds before the handler serves; writer - rebuilds `__required__` from durable state). -7. **e2e acceptance (§11 #1, #5, #6):** `__index__` == `__required__`; release → `DeleteType` on the - `Released` event removes the keys. -8. `task fmt → generate → manifests → vet → lint → test → test-e2e` (e2e sequential). - -## 14. Alternatives rejected (for the record — do not re-propose without new reasons) - -- **Per-type ZSET+TTL leases as the gate signal** (`ha-improvements.md` §2 - for the *claim* layer). Rejected for the gate: N self-expiring leases are more moving parts than one - shared set + a single writer-per-type, and the TTL's only real benefit (auto-cleanup on writer - death) is covered here by the `Released` event + failover-rebuild. (The claim layer may still use leases; that is - a separate concern.) -- **Synchronous "open-and-confirm-visible" lead before every first LIST** (block `Open` until all - pods' caches reflect the open). It would make DG1 a *hard* guarantee, but it puts a cross-pod - propagation wait on the first-sync path and a constant to tune — and the checkpoint already heals - the rare miss, so the hard guarantee is not worth its cost (§6, Principle 3). -- **Per-event Redis `SISMEMBER`.** Linearizable and lead-free, but a Redis read on *every* audit event - — including a read per event for *unwanted* high-churn types (no negative cache possible) — which - defeats the cost win that motivated gating. -- **Inactivity-scanning janitor as the primary deletion path** (delete a type's keys after no writes - for a while). Rejected: it re-derives "nobody is watching" from a proxy (idleness) when the - materializer already emits the exact signal — `Released`, grace-protected by `RemovalGrace`/sweep — - next to which `clearTypeObjects` already deletes the sibling `:objects:*` keys. Deletion belongs on - that event. (A demand-reconcile pass — keys absent from `__required__` — survives only as a thin - multi-pod crash backstop, §9; it keys off demand, never idleness.) - -## 15. Open questions - -- **Gate package home:** *Resolved* — standalone `internal/gate`, so the audit handler depends on a - small `MirrorGate` interface, not the whole queue. -- **Early gating point:** *Partly done* — as built, gating is at `mirrorByType` just before - `Enqueue`. Hoisting it earlier in `processEvent` to also skip the body-join for unwanted types is a - remaining optimisation, not yet done. -- **Multi-pod orphan backstop:** *Still deferred* — whether the demand-reconcile pass (§9) is worth - building, or the bounded cold-type orphan is simply tolerable. Decide when per-type ownership lands. -- **Other internal consumers:** only `commitrequests` is in `AlwaysAllow` today (§5). If a future - controller reads another unclaimed type's stream, add it there. diff --git a/docs/finished/design-audit-ingestion-hardening.md b/docs/finished/design-audit-ingestion-hardening.md deleted file mode 100644 index ee0e6b24..00000000 --- a/docs/finished/design-audit-ingestion-hardening.md +++ /dev/null @@ -1,190 +0,0 @@ -# Design: audit ingestion hardening - -> Status: design — implemented in the same change set. -> Date: 2026-05-14 -> Implemented baseline: [Audit Ingestion Pipeline](../architecture.md#audit-ingestion-pipeline). - -## What changes and why - -The shipped joiner parks both additional bodies *and* shallow officials. The official-parking -branch has two real problems: - -1. **It breaks stream ordering on the official channel.** When official A arrives shallow and - gets parked, then official B arrives complete and emits, then A's body arrives and A - finally emits — the canonical stream order is B → A. For two events targeting the same - object that's wrong. -2. **Its terminal failure is silent.** A parked official whose body never arrives just - TTL-evicts and disappears. The headline design promise "no silent shallow writes" only - holds with extra observability work (a sweeper) that we'd rather not pay for. - -This change drops the official-parking branch. Officials emit synchronously. A shallow -official with no matching parked body is immediately counted as lost and logged. We rely on -the assumption below to keep merges working. - -The change also bundles four small cleanups whose value only becomes obvious once the joiner -shrinks. - -## Assumption: additional arrives before official - -Events posted to `/audit-webhook-additional` for an `auditID` reach gitops-reverser before -the corresponding kube-apiserver event for the same `auditID`. - -**Rationale.** `apiservice-audit-proxy` emits in line with the request. kube-apiserver's -audit webhook batches with `--audit-webhook-batch-max-wait` (default 30s). In the steady -state the proxy has a margin of seconds to minutes. - -**Verification.** Confirm `apiservice-audit-proxy` does not implement its own batching. This -is the only realistic way the assumption breaks. Out of scope for this change set; tracked -as a verification step against the proxy source. - -**Failure modes if violated.** - -| Failure | New design | Shipped design | -| --- | --- | --- | -| Proxy unreachable during request | Immediate shallow drop + metric + log | Silent TTL expiry | -| Late additional after gitops-reverser blip | `body_late` + drop | `body_late` + drop | -| Proxy batches internally | Shallow drops where shipped design would merge | Merges (with broken ordering) | - -The third row is the cost. The first row is an improvement (loss surfaces immediately -instead of silently after `body-ttl`). The second row is unchanged. - -## Result: simplified joiner - -```mermaid -stateDiagram-v2 - [*] --> AdditionalParked: additional with body, no committed decision - [*] --> EmittedAsIs: official body-rich, no parked body - [*] --> EmittedMerged: official body-rich, parked body exists - [*] --> EmittedMerged: official identity_shallow, parked body exists - [*] --> ShallowDropped: official identity_shallow, no parked body - [*] --> DuplicateDropped: official matches committed decision - [*] --> BodyLateDropped: additional with body, decision already committed - - AdditionalParked --> EmittedMerged: official arrives within TTL - AdditionalParked --> [*]: TTL expires silently - - EmittedAsIs --> [*] - EmittedMerged --> [*] - ShallowDropped --> [*] - DuplicateDropped --> [*] - BodyLateDropped --> [*] -``` - -`audit:body:v1:` now holds only proxy-side body contributions. Orphan bodies (no -matching official ever arrives) expire silently on Redis TTL — we **accept** that visibility -loss for simplicity. The mitigation is the alert on `audit_join_body_late_total` and -operator awareness of the proxy/official deployment match. - -## Code cleanups bundled in this change - -These were tracked separately but only become obvious once the joiner shrinks: - -1. **Classify quality once.** The handler classifies in the no-joiner path; the joiner - classifies again inside `Decide`. Move classification into the handler, pass the result - to `Decide`. One source of truth. -2. **`body_late` only fires when the decision is committed.** Today it fires when the - decision key exists regardless of state. Inspect the decision envelope; `state=emitted` - → `body_late`; `state=claimed` → `duplicate_dropped{reason="in_flight_claim"}`. -3. **Drop the `processed` label** on `audit_events_received_total`. The label was only ever - set from `Subresource != "status"` and is meaningless next to the quality and join - metrics. Dashboards switch to `audit_event_quality_total`. -4. **Drop unused envelope fields.** `AuditBodyEnvelope.Source` and `Event` only existed to - support parking shallow officials. Both removed. - -## Metrics after the change - -Re-export and now actually drive: - -| Metric | When | -| --- | --- | -| `gitopsreverser_audit_shallow_dropped_total{gvr, action}` | Synchronous, in the joiner when an identity-shallow official finds no parked body | - -Removed: - -| Metric | Reason | -| --- | --- | -| `gitopsreverser_audit_join_body_miss_total` | Replaced by `audit_shallow_dropped_total`; same intent, clearer name | - -Not re-exported (deliberately): - -| Metric | Reason | -| --- | --- | -| `gitopsreverser_audit_join_body_orphan_total` | Requires a sweeper to drive; we accept silent TTL expiry instead | - -Unchanged: - -`audit_events_received_total` (minus `processed`), `audit_event_quality_total`, -`audit_join_parked_total`, `audit_join_emitted_total`, -`audit_join_duplicate_dropped_total{reason}`, `audit_join_body_late_total`. - -## Operator log on shallow drop - -Single WARN line, copy-pasteable remediation, at the joiner boundary: - -``` -audit shallow event dropped: install apiservice-audit-proxy or update kube-apiserver -audit policy to include request/response bodies (auditID= gvr= verb=) -``` - -Structured fields: `auditID`, `gvr`, `verb`, `source`, `quality`, `hasRequestObject`, -`hasResponseObject`. Rate-limiting deferred until real flood data exists. - -## Tests added in this change - -- Shallow official with no parked body → immediate drop + `audit_shallow_dropped_total` - increments + WARN log emitted. -- Shallow official with parked body → still merges (no change, existing coverage). -- `body_late` increments only when the decision is `emitted`; `claimed` state increments - `duplicate_dropped`. -- `quality=collection` survives joiner → stream → consumer with the full `*List` body - preserved in the stream entry. - -## Known non-atomic windows - -The joiner uses `GET` + `SET NX` rather than a Lua script. Two non-atomic windows exist: - -1. **Official: peek body → claim decision.** Between the `GET audit:body:v1:` and the - `SET NX audit:decision:v1:`, an additional event could park a body. The official - then drops as `identity_shallow` while a body sits in Redis until TTL. -2. **Additional: peek decision → park body.** Between the `GET audit:decision:v1:` and - the `SET audit:body:v1:`, an official could claim and emit. The body parks but is - never consumed. - -Both windows are microsecond-wide and are protected from steady-state damage by the timing -assumption: additional events arrive seconds-to-minutes before officials. The damage when -either races is bounded to one wasted parked body that evicts on TTL. We accept this for -v1 because: - -- The "no silent shallow writes" invariant still holds — case 1 increments - `audit_shallow_dropped_total`, so the operator sees the loss. -- The dedupe invariant (at most one canonical entry per `auditID` within decision-TTL) still - holds — the decision key is the serialization point, and a single `SET NX` is atomic. -- The orphan body cost is bounded by `body-ttl` and is already an accepted tradeoff (see - the architecture doc's Known gaps section). - -Tighter atomicity (single Lua script that does decision-claim + body-check + body-delete -in one round trip) is the obvious next step if real telemetry shows the race firing under -load. Tracked as a future hardening; not gating v1. - -## Invariant: only ResponseComplete drives the dedupe key - -The joiner keys decisions by `auditID`. kube-apiserver may emit multiple stages -(`RequestReceived`, `ResponseStarted`, `ResponseComplete`, `Panic`) under the same -`auditID`, depending on audit policy. If a non-`ResponseComplete` event claimed the -decision key first, the later `ResponseComplete` for the same `auditID` would be dropped -as a duplicate before reaching Git. - -**Fix.** The handler filters events at the boundary: only `Stage=ResponseComplete` events -reach the joiner. Earlier stages are counted by the receive metric and dropped silently -(they are not useful for the Git pipeline and were already being filtered by the consumer -as a defense-in-depth check). - -This filter is what makes the auditID-keyed dedupe safe. - -## Open questions - -- Verify `apiservice-audit-proxy` does not batch internally. If it does, we either push back - on the proxy or reintroduce an ordering-preserving official-park path (separate design). -- Rate-limit the shallow-drop log per `(gvr, verb)`? Defer until flood data exists. -- Move joiner ops to Lua scripts to close the race windows above? Defer until telemetry - shows it's needed. diff --git a/docs/finished/design-commit-request-api.md b/docs/finished/design-commit-request-api.md deleted file mode 100644 index b54efd64..00000000 --- a/docs/finished/design-commit-request-api.md +++ /dev/null @@ -1,226 +0,0 @@ -# Design: `CommitRequest` CRD - -> Status: **implemented**. Namespaced CRD in API group `configbutler.ai/v1alpha3`. -> Deferred work is tracked in [design-commit-request-phase-2.md](../future/design-commit-request-phase-2.md). -> Date: 2026-05-18 - -## What it is - -`CommitRequest` is a small namespaced CRD that acts as a **"save now" signal**. A frontend -creates one after a user's resource edits; gitops-reverser then finalizes the open commit window -for the named `GitTarget` immediately — instead of waiting for the rolling silence timer — and -records the resulting commit SHA in the object's status. An optional `spec.message` becomes the -commit message verbatim. - -It does exactly one thing: - -> When the `CommitRequest`'s own audit event is consumed, finalize the open commit window for the -> authenticated author on the referenced `GitTarget`, using `spec.message` if set, and record the -> outcome in `status`. - -The commit fires **on the audit event for the create, never on the API create directly** — that -is what makes the timing correct (see [The flow](#the-flow)). - -## Resource shape - -```yaml -apiVersion: configbutler.ai/v1alpha3 -kind: CommitRequest -metadata: - namespace: team-a - generateName: save- # one fresh object per save -spec: - gitTargetRef: - name: team-a-config # required; GitTarget in the same namespace - message: "Increase checkout API memory after load-test failures" # optional; omit for a bare "commit now" -status: - phase: Committed # WaitingForAuditEvent | Committed | NoOpenWindow | Failed - branch: main # set when Committed - sha: "a1b2c3d4e5f6789..." # set when Committed - message: "" # failure detail; set when Failed - observedTime: "2026-05-18T12:34:56Z" -``` - -### Spec - -- **`gitTargetRef.name`** (required) — the `GitTarget` whose open window to finalize. Must live - in the `CommitRequest`'s own namespace. One target per object keeps `status` flat: a single - SHA, no list. -- **`message`** (optional) — the commit message, used verbatim. "Optional" here means the field - may be **omitted**, not that it may be **blank**: omitting `message` entirely is a valid - request — it just finalizes the window with the generated grouped-commit message, which is the - intended "trigger a commit now, no custom message" form. An explicit empty string - (`message: ""`) is *rejected* by the apiserver, because when the field is present the CRD - requires 1–1024 Unicode characters. Newlines are allowed (so a subject plus body works); all - other ASCII control characters are rejected (pattern `^[^\x00-\x09\x0B-\x1F\x7F]*$`). - -`spec` is immutable after creation — a CEL validation rule on the CRD (`self == oldSelf`) rejects -any update that changes it, so a delayed audit event always acts on the spec the object was -created with. - -### Status - -| `phase` | Meaning | -|---|---| -| `WaitingForAuditEvent` | Initial. The object was created; its audit event has not been processed yet. | -| `Committed` | Terminal. The window was finalized; `branch` and `sha` are set. | -| `NoOpenWindow` | Terminal. The audit event arrived but the author had no open window on that `GitTarget` (they saved with nothing pending). Not an error. | -| `Failed` | Terminal. The finalize could not complete — a failed commit, a saturated worker queue, a missing `GitTarget`, etc. `status.message` carries the reason. | - -## The flow - -The whole design is one ordered sequence. Timing is correct because the commit is driven by the -audit stream, not by the API create. - -1. The frontend issues its resource mutations (`Deployment` patch, `ConfigMap` update, …) and - awaits them. -2. The frontend creates a `CommitRequest` in its namespace, naming a `GitTarget` and optionally a - message. -3. A minimal controller stamps `status.phase: WaitingForAuditEvent` on the new object. It does no - other work. -4. kube-apiserver persists the object and emits an audit event for the `create`. Because the CRD - is served by kube-apiserver itself, the event is **complete**: it carries `auditID`, `user`, - and `objectRef` (namespace, name, uid). -5. The audit event flows through the existing audit pipeline. By audit-stream ordering, every - mutation from step 1 produced an *earlier* event — so by the time the consumer reaches the - `CommitRequest` event, those writes have already been applied to the open window. This is what - makes "commit now" safe under parallel writes. -6. The audit consumer recognizes the `commitrequests` `create` event. It takes the **author** from - the audit event's effective user, reads the `CommitRequest` object to get `spec.gitTargetRef` - and `spec.message`, and verifies the object's `uid` matches `objectRef.uid`. -7. It finalizes the open window **for that author on that `GitTarget`**, producing the commit. -8. It writes the terminal status: `Committed` (+ `branch`/`sha`), `NoOpenWindow`, or `Failed` - (+ `message`). -9. The frontend, watching the object, sees the terminal phase. - -The audit stream's only job here is **timing** — it tells gitops-reverser "every edit before this -save has landed; commit now." The message lives in the object; the author lives in the audit -event. - -## Author and target binding - -A `BranchWorker` is keyed by `(provider, branch)` only, and holds at most one open window. So "the -open window" must be pinned to the request's intent: - -- The **author** is the audit event's effective user (the impersonated user under impersonation). - Anonymous and unauthenticated callers never get an object created — kube-apiserver rejects them - first. -- The finalize signal carries `Author`, `GitTargetName`, and `GitTargetNamespace`. The worker - finalizes the window **only if all three match** the open window. A mismatch — someone else's - window happens to be the one open — yields `NoOpenWindow` and leaves that window untouched for - its real author. - -## Why no webhook - -A stored CRD object does not record its creator, so an admission webhook was considered to capture -the creating user. It is not needed: the audit event for the `create` already carries the -authenticated `user`, and gitops-reverser already reacts to that audit event. The author comes -from the audit event — the same authenticated identity a webhook would have seen — and the message -comes from reading the persisted object. No webhook, no request stash, no extra TLS or admission -plumbing. - -## How it works internally - -Three pieces are net-new on top of existing machinery: - -1. **Finalize signal.** `git.FinalizeSignal` is a `WorkItem` variant meaning "finalize the open - window now." It is enqueued on the **same per-worker queue** as resource events — which is what - makes the audit-ordering argument hold: the signal is processed after every earlier write. - `EventRouter.FinalizeGitTargetWindow` resolves the `GitTarget` to its `(provider, branch)` - worker, enqueues the signal, and blocks (up to 30s) for the result. -2. **Outcome reporting.** The signal carries a result channel; the worker replies with the commit - SHA, `NoOpenWindow`, or an error. A finalize error is propagated as a Go error — never silently - mapped to a benign phase. -3. **Status mapping.** No open window → `NoOpenWindow`. A finalize error → `Failed` with the - reason in `status.message`. The audit consumer's `handleCommitRequest` writes the terminal - status, retrying on optimistic-concurrency conflicts and re-checking the object `uid` each - time. - -When no worker exists for the `GitTarget` (nothing has been written to that branch yet) there is, -by definition, no open window → `NoOpenWindow`. In per-event commit mode (`commitWindow == 0`) -every event already commits immediately, so the signal simply finds no open window. - -## RBAC and audit policy - -- End users (or a backend acting for them) need `create` on `commitrequests` in their namespace. - That is all. -- The gitops-reverser identity needs `get`/`list`/`watch` on `commitrequests` and `update` on - `commitrequests/status`. -- Audit policy: `Metadata` level on `commitrequests` `create` is sufficient — the consumer needs - `auditID`, `user`, `verb`, and `objectRef`, then reads the object body from the apiserver. The - repo's e2e audit policy captures this via a catch-all `create` rule; shipping a dedicated - fragment in the Helm chart is a phase-2 item. - -## Edge cases - -- **No open window** → terminal `NoOpenWindow`. Not an error. -- **Object deleted before its audit event is processed** → the consumer cannot read the spec; it - logs and skips. The object is gone, so there is no status to write. -- **Object recreated under the same name** (delete + recreate before a delayed audit event) → the - consumer compares `objectRef.uid` to the live object's `uid` and skips the stale event. -- **Audit event never arrives** (audit pipeline degraded) → the object stays - `WaitingForAuditEvent`. Acceptable for now; the lifecycle gap this creates is the headline item - of the phase-2 doc. -- **Transient finalize failure** (e.g. a saturated worker queue) → terminal `Failed`. The audit - message is ACKed once with no redelivery, so a terminal phase is more honest than a silently - stuck object. The rolling silence timer still commits the pending edits later with the generated - message — only the caller's custom message is lost. - -## Alternatives considered - -The parent exploration ([idea-end-user-commit-messages.md](../future/idea-end-user-commit-messages.md)) and -the superseded aggregated-API design -(`design-commit-context-api.md`) weighed several transports. They -are summarized here so the choice is not relitigated. - -- **Aggregated API `CommitContext`.** A request-only aggregated API kind, nothing persisted. The - blocker: kube-apiserver's native audit events for aggregated APIs are "hollow" — no - `requestObject`, no `objectRef.name` — so the message text would have to be recovered from a - Valkey "request stash" keyed by `Audit-ID`. A plain CRD is served by kube-apiserver directly, so - **its audit events are complete**. That single fact removes the stash, the `APIService` - registration, and the requestheader-CA / TLS plumbing. The full deep-dive on the aggregated-API - audit gap is kept in `design-commit-context-api.md`. -- **Audit `user.extra` enrichment.** Put the reason in `userInfo.extra` and read it from the same - audit event as the mutation. Cheap for gitops-reverser and naturally per-event — but ordinary - clients cannot set `extra`. It needs an authentication webhook on the hot path, OIDC claim - mappings, or impersonation with `Impersonate-Extra-*`. Granting a backend "impersonate any user - and set arbitrary extras" is a heavy, alarming RBAC posture for what is essentially a commit - message. -- **Transient annotations stripped by a mutating webhook.** Attach a - `gitops-reverser.io/commit-message` annotation to the edited object; a mutating webhook strips - it before persistence; the consumer recovers it from the audit payload. Per-event and atomic - with the change — but it requires an always-on mutating webhook on the request path of every - watched resource type, a steep operational cost for a cosmetic feature, and the intent is hidden - inside metadata where other tools may disturb it. -- **Short-lived `CommitIntent` CRD.** This design's ancestor. The early sketch treated it as - ephemeral "use this message for the next window, then delete it" state, which felt unnatural - because the cleanup clock should be the commit window, not a TTL. Reframing it as an explicit, - audited **"save now" request that reports its own status** — rather than a hidden message slot — - is what made a CRD the right shape. That reframed CRD is `CommitRequest`. -- **Do nothing.** Keep template-generated commit messages only. The status quo; rejected because - frontends do have real user intent at edit time and currently no clean channel for it. - -`CommitRequest` wins because a CRD's audit events are complete (no stash, no webhook), the create -is an explicit auditable operation, and reporting status back on the object gives the frontend a -clean success/SHA signal. - -## Deferred - -Garbage collection, multi-target "save everything I edited," retry for transient finalize -failures, and outcome metrics are intentionally out of this first cut. They are tracked — with the -object-lifecycle question front and center — in -[design-commit-request-phase-2.md](../future/design-commit-request-phase-2.md). - -## References - -- Deferred / phase-2 work: [design-commit-request-phase-2.md](../future/design-commit-request-phase-2.md) -- Superseded aggregated-API design, kept for the audit-gap deep-dive: - `design-commit-context-api.md` -- Parent exploration — transport options and the audit-stream-as-source-of-truth principle: - [idea-end-user-commit-messages.md](../future/idea-end-user-commit-messages.md) -- Audit ingestion pipeline this design rides on: - [design-audit-ingestion-hardening.md](design-audit-ingestion-hardening.md) -- Implementation: `api/v1alpha3/commitrequest_types.go`, - `internal/controller/commitrequest_controller.go`, `internal/queue/commit_request.go`, - `internal/git/finalize_signal.go` plus the `FinalizeSignal` path in - `internal/git/branch_worker.go`, and `EventRouter.FinalizeGitTargetWindow`. diff --git a/docs/finished/design-rule-change-snapshot-trigger.md b/docs/finished/design-rule-change-snapshot-trigger.md deleted file mode 100644 index e3947b6b..00000000 --- a/docs/finished/design-rule-change-snapshot-trigger.md +++ /dev/null @@ -1,220 +0,0 @@ -# Design: rule-change snapshot trigger - -> Status: implemented — captured after issues #145/#146-style symptoms surfaced. -> Date: 2026-05-20 -> Implemented: 2026-05-21 -> Tests that anchor this work: -> - [internal/watch/rule_change_snapshot_test.go](../../internal/watch/rule_change_snapshot_test.go) — four unit tests -> - [test/e2e/e2e_test.go](../../test/e2e/e2e_test.go) — `It("should backfill pre-existing ConfigMap when WatchRule is added afterwards", ...)` - -## Implementation summary - -The fix landed as an in-memory delivery contract between `WatchManager` and the -`FolderReconciler` registry: - -- `WatchManager` now computes a per-GitTarget rule-set hash from the compiled - `WatchRule` and `ClusterWatchRule` entries that affect that target. -- `ReconcileForRuleChange` treats GVR changes as informer work, not as the only - snapshot trigger. If the rule-set hash changed, the target is marked pending - even when the GVR set is unchanged. -- Snapshot delivery only advances `lastDeliveredRuleSetHash` after the target has - a registered `FolderReconciler` and both repo and cluster state requests were - handed to the router. -- `ReconcilerManager.CreateReconciler` calls `WatchManager.MaybeReplaySnapshot` - when a new reconciler appears, so restart-like bootstraps drain pending - snapshots instead of dropping them. -- `GitTargetReconciler` now creates a `FolderReconciler` even when - `SnapshotSynced=True`, preserving the "no new initial snapshot" gate while - still allowing rule-change snapshots to be delivered. - -Validation at implementation time: - -- `go test ./internal/watch -run 'TestReconcileForRuleChange' -count=1` -- `task lint` -- `task test` -- `task test-e2e` with the new backfill spec included in the full e2e suite - -## The problem in one sentence - -`WatchManager.ReconcileForRuleChange` emits its snapshot as a fire-and-forget broadcast against the EventRouter, with no notion of "did this snapshot actually reach a `FolderReconciler` for the affected GitTarget?" and no retry — so any time the rule-set changes without changing the GVR set, or the receiver isn't registered yet, the backfill is silently lost. - -## Two failure modes, one root cause - -Both reduce to: *no delivery contract between snapshot producer and snapshot consumer.* - -### A. Rule-add when GVR is already watched - -The old `ReconcileForRuleChange` implementation short-circuited when the GVR -set didn't change: - -```go -if len(added) == 0 && len(removed) == 0 { - return nil -} -``` - -Adding a second rule for an already-watched GVR, or editing a rule's selectors without touching its GVR, takes this path. The snapshot is never even attempted. Resources that match the new rule and already exist in the cluster stay out of git until they're next mutated. Symmetric across `WatchRule` and `ClusterWatchRule`. - -### B. Restart with `SnapshotSynced=True` - -The `GitTargetReconciler` writes `SnapshotSynced=True` after a successful initial snapshot. On restart this is read back from the object's status, so the old `evaluateSnapshotGate` path took the early-return — it ensured a `GitTargetEventStream` was registered, but it did *not* create a `FolderReconciler`. Meanwhile `WatchManager.Start` ran its own initial `ReconcileForRuleChange`, which *did* emit a snapshot. That snapshot's `RequestClusterState` reached `RouteClusterStateEvent`, which looked up the reconciler, found none, and dropped the event with a V(1) log line. The same dropping happened for `RouteRepoStateEvent`. The user saw: "live updates write fine, but pre-existing resources never appear after a restart." - -The 30-second periodic `ReconcileForRuleChange` then hits failure mode A (GVRs stable), so there's no self-heal. - -## How the snapshot walk works - -User asked specifically: *how do we walk through all resources in all namespaces when a ClusterWatchRule is adjusted?* The full chain: - -1. **Trigger.** `ClusterWatchRuleReconciler` finishes reconciling and calls `WatchManager.ReconcileForRuleChange(ctx)` ([clusterwatchrule_controller.go:183](../../internal/controller/clusterwatchrule_controller.go#L183)). -2. **GVR diff and rule hash.** `ReconcileForRuleChange` computes the desired GVR set from the rule store and diffs it against `activeInformers`. The implemented path also computes per-target rule-set hashes, so unchanged GVRs no longer suppress a needed snapshot. -3. **Informer churn.** `startInformersForGVRs(added)` / `stopInformer(removed)` brings the informer set in line with the desired set. New informers run `WaitForCacheSync`, so by the time this returns every existing resource has been observed by the informer and forwarded as an ADDED event. -4. **Stream buffering.** `beginReconciliationForTargets` transitions every registered `GitTargetEventStream` for a target needing delivery to `Reconciling` so informer ADDED events from step 3 are *buffered* instead of producing N individual `[CREATE]` commits. -5. **Snapshot emission.** `emitSnapshotForRuleChange` calls `ProcessControlEvent(RequestRepoState)` and `ProcessControlEvent(RequestClusterState)` for every target that needs delivery and has a registered `FolderReconciler`. `handleRequestClusterState` calls [`GetClusterStateForGitDest`](../../internal/watch/manager.go): - - Build `gvrMap[GVR] -> {namespaces, clusterWide}` from active rules. ClusterWatchRule entries set `clusterWide=true`. - - For each entry, call `listResourcesForGVR`: cluster-wide `List` when `clusterWide`, namespaced `List` when WatchRule. - - Sanitize each item, key it by `ResourceIdentifier`, return as a `ClusterStateEvent`. -6. **Diff and write.** `FolderReconciler.OnClusterState` ([folder_reconciler.go:120](../../internal/reconcile/folder_reconciler.go#L120)) stores the cluster-state half. When the matching `RepoState` half also arrives, `reconcile()` diffs (`findDifferences`) and emits one atomic `WriteRequest` containing `CREATE`/`UPDATE`/`DELETE` per resource. -7. **Flush.** `completeReconciliationForTargets` transitions streams back to `LiveProcessing`. The buffered events from step 3 flush; they're no-ops at the git layer because the snapshot batch just wrote those files. - -So the *walk itself* is functional and correctly cluster-wide for ClusterWatchRule. The original hole was steps 4-6: **the broadcast at step 5 had no acknowledgment.** The implemented delivery contract now keeps the snapshot pending when no receiver is registered. - -### Architectural note worth flagging now - -`listResourcesForGVR` doesn't apply rule selectors today — it lists every resource of the GVR and returns them all unfiltered (the rulestore is MVP-simplified, `rulestore/store.go:328` confirms `NamespaceSelector` isn't implemented yet). For *live events*, `matchRules` applies the full predicate including `nsLabels`. The two paths diverge. - -This is fine as long as ClusterWatchRule means "all of this GVR, everywhere." The moment `namespaceSelector` / `labelSelector` lands on the rule spec (which the existing CRD comments already hint at), the snapshot walk must apply the same predicates as the live path or the steady state will not match the snapshot state and we'll get spurious deletes on every reconcile. Fix should land in the same change-set that introduces selectors, not retrofitted later. - -## Implemented fix shape - -The minimum change to close both failure modes is **a delivery contract per GitTarget**. - -### Core idea - -For each GitTarget, the WatchManager tracks two values: - -- `lastDeliveredRuleSetHash` — fingerprint of the rule-set that was last successfully snapshotted *and* delivered to a registered `FolderReconciler`. -- `currentRuleSetHash` — recomputed on every `ReconcileForRuleChange`, derived from the rules in the store affecting this GitTarget. - -The trigger logic becomes: - -``` -for each target in currentRuleSetSnapshots(): - if currentRuleSetHash[gitDest] == lastDeliveredRuleSetHash[gitDest]: - continue # already in sync - if no FolderReconciler registered for gitDest: - mark gitDest as needing snapshot; do not advance lastDelivered - continue - emit RequestRepoState + RequestClusterState - on successful delivery (route function found the receiver): - lastDeliveredRuleSetHash[gitDest] = currentRuleSetHash[gitDest] -``` - -And one additional hook: when `EventRouter.RegisterGitTargetEventStream` (or whenever the reconciler is created via `ReconcilerManager.CreateReconciler`) registers a new receiver, ask the WatchManager whether that gitDest has a pending snapshot — if so, drain it. - -This single change covers: - -- **Failure A.** `compareGVRs` becomes informational only; the snapshot decision is rule-hash-based. `len(added)==0 && len(removed)==0` no longer short-circuits the snapshot path. -- **Failure B.** When `WatchManager.Start` fires the initial snapshot before the GitTargetReconciler has registered a receiver, `lastDelivered` doesn't advance. The GitTargetReconciler subsequently registers, which drains the pending entry, the snapshot fires again with a receiver present, and `lastDelivered` advances. - -The early-return on truly-stable state (rule-hash unchanged) is preserved — we keep idempotency for periodic ticks. - -### Receiver registration hook - -The cleanest place is `ReconcilerManager.CreateReconciler` (called from `GitTargetReconciler.evaluateSnapshotGate`). It already has the gitDest. Adding "on new reconciler creation, notify WatchManager" makes the coordination explicit and avoids implicit timing assumptions. - -Sketch: - -```go -// In ReconcilerManager.CreateReconciler, after inserting the reconciler: -if m.onReconcilerCreated != nil { - m.onReconcilerCreated(gitDest) -} -``` - -And `onReconcilerCreated := watchManager.MaybeReplaySnapshot` is wired at startup. - -### Why not just remove the early-return at manager.go:660? - -That fixes failure A but not failure B, and it makes every 30-second periodic tick a full cluster-wide list. The hash-based version pays the same cost only when the hash changes, which is the right knob. - -### What the implemented rule-set hash contains - -Per gitDest, in canonical order, the implementation fingerprints the compiled -rule inputs currently held in `RuleStore`: - -- For each `WatchRule` targeting it: source name/namespace, resolved target, - provider, branch, path, and compiled resource rules. -- For each `ClusterWatchRule` targeting it: source name, resolved target, - provider, branch, path, and compiled cluster resource rules. - -This uses the compiled store state rather than fetching the original CR objects -or relying on `metadata.generation`. That keeps the snapshot trigger cheap and -aligned with what live matching actually sees. - -## Non-goals - -- **No removal of the periodic 30-second `ReconcileForRuleChange`.** It stays as a safety net (informer restarts, missed events). Just becomes hash-aware so it's free when there's nothing to do. -- **No rewrite of the snapshot walk.** The walk is correct; only the trigger and delivery contract change. -- **No new CRD fields.** This is internal coordination; the user-visible surface doesn't change. - -## Risk / open questions - -- **Hash for status-only rule updates.** The implemented hash is derived from compiled rule store state, not object status. If future work fetches live CR objects for hashing, avoid including `status`, `resourceVersion`, or other status-only metadata. -- **Delivery confirmation vs. delivery success.** The route function "found a receiver" doesn't mean the reconciler actually wrote anything to git — the diff might be empty, or a git push could fail later. We're only promising the snapshot was *handed off* to the right receiver; downstream failures are observable through existing git-push error paths and don't need to be folded in here. -- **Concurrent rule changes.** Two `ReconcileForRuleChange` calls landing close together must not race the hash update. A per-gitDest mutex (or the existing `activeInformers` lock) is enough. -- **Selector parity (flagged earlier).** When selectors land, `GetClusterStateForGitDest` must filter through the same predicate the live path uses, or the diff will produce spurious deletes. - -## Downsides and future improvements - -- **Hash format is implementation-local.** The current hash is built from - formatted compiled rule structs. It is fine for an in-process trigger, but a - future persistent or cross-version delivery contract should use explicit - canonical JSON or a typed hash builder. -- **Pending delivery state is in memory.** A restart recomputes desired state on - the next reconciliation, but pending state is not persisted. If this project - moves toward multi-replica watch managers or stronger crash recovery, this - contract should move into leader-owned status, a lease-backed store, or a - durable work queue. -- **Delivery still means "handed to the reconciler."** The implementation does - not wait for git writes or pushes to succeed before advancing the rule-set - delivery hash. Downstream failures remain observable through existing git - error paths. A future version could expose a stronger end-to-end snapshot - completion condition if users need it. -- **Rule deletion cleanup needs explicit thought.** A hash computed only from - current rules cannot, by itself, identify a GitTarget that just lost its last - rule. If deletion should remove previously written files, future work should - retain tombstones for affected targets or make rule deletion trigger a - target-scoped cleanup snapshot before forgetting the target. -- **Replay uses the reconciler creation edge.** This solves the known restart - gap, and periodic reconciliation remains a safety net. If reconciler lifecycle - grows more complex, consider a small pending-snapshot work queue with retry, - backoff, and metrics instead of a direct callback. -- **Snapshot selector parity remains important.** When namespace or label - selectors become authoritative in snapshot listing, the hash must include - those selector inputs and `GetClusterStateForGitDest` must filter with the - same predicate as live event matching. - -## Acceptance criteria - -The four failing unit tests in -[internal/watch/rule_change_snapshot_test.go](../../internal/watch/rule_change_snapshot_test.go) -go green: - -- `TestReconcileForRuleChange_AddingSecondRuleSameGVR_EmitsSnapshot` -- `TestReconcileForRuleChange_NarrowingSelectorOnExistingRule_EmitsSnapshot` -- `TestReconcileForRuleChange_AddingSecondWatchRuleSameGVR_EmitsSnapshot` -- `TestReconcileForRuleChange_RestartLikeBootstrap_NoSnapshotDrops` - -The e2e spec -`It("should backfill pre-existing ConfigMap when WatchRule is added afterwards", ...)` -passes against a real k3d cluster. - -The `EventRouter.SnapshotDeliveryDrops()` counter stays at 0 in steady state under a representative load test (creating and editing rules, restarting the controller). - -## References - -- Trigger bug summary: [idea-cross-kind-dependency-watches.md](../future/idea-cross-kind-dependency-watches.md) (related coordination concern around dependency-watches). -- The old early-return: `ReconcileForRuleChange` in [manager.go](../../internal/watch/manager.go). -- The snapshot consumer drop instrumentation: `RouteRepoStateEvent` and `RouteClusterStateEvent` in [event_router.go](../../internal/watch/event_router.go). -- The GitTarget restart gate: `evaluateSnapshotGate` in [gittarget_controller.go](../../internal/controller/gittarget_controller.go). -- The snapshot walk itself: `GetClusterStateForGitDest` and `listResourcesForGVR` in [manager.go](../../internal/watch/manager.go). diff --git a/docs/design/dynamic-analysis-fuzzing-plan.md b/docs/finished/dynamic-analysis-fuzzing-plan.md similarity index 100% rename from docs/design/dynamic-analysis-fuzzing-plan.md rename to docs/finished/dynamic-analysis-fuzzing-plan.md diff --git a/docs/design/e2e-aggregated-apiserver-test-design.md b/docs/finished/e2e-aggregated-apiserver-test-design.md similarity index 98% rename from docs/design/e2e-aggregated-apiserver-test-design.md rename to docs/finished/e2e-aggregated-apiserver-test-design.md index e8a47b2b..0e8aefc7 100644 --- a/docs/design/e2e-aggregated-apiserver-test-design.md +++ b/docs/finished/e2e-aggregated-apiserver-test-design.md @@ -23,13 +23,13 @@ resources. ### What the existing docs already say -[kubernetes-api-discovery.md](kubernetes-api-discovery.md) already states that aggregated API +[kubernetes-api-discovery.md](../facts/kubernetes-api-discovery.md) already states that aggregated API resources are theoretically supported: "yes, you can watch resources served through `APIService`; CRD is not required." However, this has **never been tested end-to-end**. This design closes that gap. The concrete bootstrap and wiring plan for the proxy-backed environment lives in -[e2e-aggregated-apiserver-proxy-hookup-plan.md](e2e-aggregated-apiserver-proxy-hookup-plan.md). +[e2e-aggregated-apiserver-proxy-hookup-plan.md](e2e-aggregated-apiserver-test-design.md). This document focuses on **what the tests must prove** once that environment exists. ### What we need to prove about gitops-reverser vs. what is Kubernetes behavior @@ -111,8 +111,8 @@ Note: `fischers` is only served at `v1alpha1`, not `v1beta1`. The sample-apiserver uses `genericregistry.Store` which defaults to `path.ValidatePathSegmentName` for instance name validation. This rejects only `/`, `%`, and `..` — it **does allow** underscores, dots, and other characters that would be invalid in DNS labels. This is confirmed by reading the -[flunder strategy](../../external-sources/sample-apiserver/pkg/registry/wardle/flunder/strategy.go) -and [REST store](../../external-sources/sample-apiserver/pkg/registry/wardle/flunder/etcd.go). +flunder strategy +and REST store. This means S7 (non-standard names with underscores and dots) is viable without modifying the sample-apiserver. @@ -126,7 +126,7 @@ The concrete installation mechanism is intentionally separated from this test-de - This document defines the required environment capabilities and the assertions the tests should make. - The active bootstrap ownership and rollout sequence are defined in - [e2e-aggregated-apiserver-proxy-hookup-plan.md](e2e-aggregated-apiserver-proxy-hookup-plan.md). + [e2e-aggregated-apiserver-proxy-hookup-plan.md](e2e-aggregated-apiserver-test-design.md). At the time of writing, the preferred direction is to have Flux bootstrap the aggregated API stack through the `apiservice-audit-proxy` chart rather than keep a permanently hand-maintained parallel @@ -414,7 +414,7 @@ category. ### S1 — Discovery + WatchRule: aggregated resource is accepted **What it validates:** the combination of `FilterDiscoverableGVRs()` in -[internal/watch/discovery.go](../../internal/watch/discovery.go) and the WatchRule controller +internal/watch/discovery.go and the WatchRule controller correctly accepting an aggregated API resource. **Action:** diff --git a/docs/design/e2e-ci-runner-sharding-plan.md b/docs/finished/e2e-ci-runner-sharding-plan.md similarity index 94% rename from docs/design/e2e-ci-runner-sharding-plan.md rename to docs/finished/e2e-ci-runner-sharding-plan.md index b548ea63..c878ac11 100644 --- a/docs/design/e2e-ci-runner-sharding-plan.md +++ b/docs/finished/e2e-ci-runner-sharding-plan.md @@ -17,7 +17,7 @@ why, what changed, and a concrete plan. - **Sharding across runners is strictly *safer* than raising `--procs` on one cluster.** Each shard gets its own k3d cluster, so the full-suite shared-state races documented in - [e2e-full-suite-shared-state-investigation.md](e2e-full-suite-shared-state-investigation.md) + [e2e-full-suite-shared-state-investigation.md](../spec/e2e-serial-registry.md) **cannot cross a shard boundary**, and `Serial` specs stop contending with everything else in the run. - **The economics work now**: in both current e2e lanes, *test execution* @@ -73,10 +73,10 @@ Historical context, not a blocker anymore: serially ≈ 45 min. Recorded in [e2e-speedup-plan.md](e2e-speedup-plan.md). - **Shared-state flakes** within one cluster (stale `GitTarget`/`WatchRule` writing to a shared repo/branch — see the - [shared-state investigation](e2e-full-suite-shared-state-investigation.md)). + [shared-state investigation](../spec/e2e-serial-registry.md)). Sharding *removes* this class between shards (separate clusters) and the per-target isolation fix - ([gittarget-isolation-on-rule-change.md](../finished/gittarget-isolation-on-rule-change.md)) + ([gittarget-isolation-on-rule-change.md](../spec/gittarget-isolation-on-rule-change.md)) already raised the safe in-cluster parallelism from `procs=1` → `procs=4`. ## Why sharding beats "just raise `--procs`" @@ -146,7 +146,7 @@ tune the leg count to trade minutes for latency. shrink without editing branch protection each time. 4. **Keep `fail-fast: false`** (already set) so one leg's flake doesn't cancel the others mid-run and lose their reports. -5. **Serial registry stays authoritative.** [e2e-serial-registry.md](e2e-serial-registry.md) +5. **Serial registry stays authoritative.** [e2e-serial-registry.md](../spec/e2e-serial-registry.md) still governs *within* a shard. Sharding doesn't let us drop any `Serial` marker — it just means a `Serial` spec only blocks its own (smaller) shard. 6. **Disk pressure is per-shard.** Each fresh runner has its own disk, so the @@ -192,10 +192,10 @@ and a branch-protection edit). Reverting to the 2-lane matrix is a one-file reve - [e2e-speedup-plan.md](e2e-speedup-plan.md) — Phases 0–3 already shipped; this plan is its "Revisit if we get real concurrent runner capacity" item. -- [e2e-serial-registry.md](e2e-serial-registry.md) — the authoritative `Serial` set. -- [e2e-full-suite-shared-state-investigation.md](e2e-full-suite-shared-state-investigation.md) +- [e2e-serial-registry.md](../spec/e2e-serial-registry.md) — the authoritative `Serial` set. +- [e2e-full-suite-shared-state-investigation.md](../spec/e2e-serial-registry.md) — the cross-spec races sharding isolates away. -- [gittarget-isolation-on-rule-change.md](../finished/gittarget-isolation-on-rule-change.md) +- [gittarget-isolation-on-rule-change.md](../spec/gittarget-isolation-on-rule-change.md) — the fix that raised safe in-cluster parallelism to `procs=4`. - [ci-overview.md](../ci-overview.md) — trust-zone CI design the matrix lives in. diff --git a/docs/finished/e2e-metrics-over-logs-plan.md b/docs/finished/e2e-metrics-over-logs-plan.md deleted file mode 100644 index e90d7a02..00000000 --- a/docs/finished/e2e-metrics-over-logs-plan.md +++ /dev/null @@ -1,267 +0,0 @@ -# E2E: assert on metrics, not operator logs - -**Status:** IMPLEMENTED 2026-06-12 (see "Implementation outline" — all steps landed). -**Date:** 2026-06-12 - -## The ask - -Several e2e specs prove "something happened" (most importantly: *a commit was -created*) by scraping the operator's pod logs for a substring. That is brittle: -log strings are not a contract, a tail window can miss the line, and — the part -that bites under Ginkgo parallelism — a substring match cannot tell *this* spec's -commit from a commit driven by another spec sharing the controller. - -The proposal: assert on the existing counter -[`gitopsreverser_commits_total`](../../internal/telemetry/exporter.go) instead, -adding labels so a spec can isolate *its own* commits when many run at once. - -This document does three things: (1) catalogs every log-scrape in the e2e suite -and sorts the real candidates from the false positives, (2) confirms the -metric-assertion plumbing already exists and is in use, and (3) recommends a -concrete label set — which is **not** quite the one the ask guessed at, and the -reason is the interesting part. - -## Method - -Scanned every `*.go` under [test/e2e/](../../test/e2e/) for log reads -(`controllerLogs(...)`, `kubectl logs`, `showControllerLogs(...)`) and for -`ContainSubstring`/`MatchRegexp` assertions, then traced each to whether it gates -a spec's pass/fail (a real assertion) or merely dumps context for debugging. - -## Findings — the catalog - -The grep is noisier than the reality. Most `ContainSubstring` hits that *look* -like log scraping are actually reading **git log output**, a **CRD status -condition**, or **`kubectl` output** — those are legitimate and should stay. -Only **three** sites assert on operator pod logs. - -### A. True operator-log assertions — the conversion candidates - -| # | Site | Reads | Asserts | Purpose | -|---|------|-------|---------|---------| -| A1 | [crd_lifecycle_e2e_test.go:284-296](../../test/e2e/crd_lifecycle_e2e_test.go#L284-L296) | `controllerLogs(2000)` | `"git commit created"` **OR** `"git resync commit created"` | a commit happened for the CRD instance | -| A2 | [watchrule_configmap_secret_e2e_test.go:514-522](../../test/e2e/watchrule_configmap_secret_e2e_test.go#L514-L522) | `controllerLogs(500)` | `"git commit"` | a commit happened | -| A3 | [controller_basics_e2e_test.go:117-130](../../test/e2e/controller_basics_e2e_test.go#L117-L130) | `kubectl logs` | `"Serving metrics server"` | the metrics server started | - -A1 and A2 are the same idea — *did a commit get created* — and are the heart of -the ask. A3 is a one-time readiness check and is already shadowed by a metric -query on the very next lines (`up{job='gitops-reverser'}`), so it is nearly -redundant today. - -Note A1's awkwardness: it has to `Or(...)` **two** different log strings because a -commit can come from the per-event path (`"git commit created"`) or the backfill -resync path (`"git resync commit created"`). This is exactly the kind of -implementation-coupling a metric removes — see "Why the metric is also *more -correct*" below. - -### B. Diagnostic-only log usage — leave as-is - -These dump logs for human debugging; they never gate a result. Keep them. - -- [gitprovider_validation_e2e_test.go](../../test/e2e/gitprovider_validation_e2e_test.go) — seven `showControllerLogs(...)` context dumps. -- [e2e_test.go:254](../../test/e2e/e2e_test.go#L254) `showControllerLogs(...)` and [helpers.go:405-415](../../test/e2e/helpers.go#L405-L415) — last-N-lines dump on failure. -- [helpers.go:307-328](../../test/e2e/helpers.go#L307-L328) `controllerLogs(...)` — the shared reader the A-sites call. - -### C. Looks like a log scrape, but isn't — leave as-is - -These read real state (git history, CRD status, API discovery), not logs. They -are the *robust* assertions and should not change. - -| Site | Actually reads | -|------|----------------| -| [crd_lifecycle_e2e_test.go:609](../../test/e2e/crd_lifecycle_e2e_test.go#L609), [:677](../../test/e2e/crd_lifecycle_e2e_test.go#L677) | `git log --oneline` → `"DELETE"` (commit message) | -| [watchrule_configmap_secret_e2e_test.go:803](../../test/e2e/watchrule_configmap_secret_e2e_test.go#L803) | `git log --oneline` → `"DELETE"` | -| [signing_e2e_test.go:482](../../test/e2e/signing_e2e_test.go#L482) | `git log --format=%s` → commit subjects | -| [watchrule_configmap_secret_e2e_test.go:181-182](../../test/e2e/watchrule_configmap_secret_e2e_test.go#L181-L182) | CRD `.status.conditions[...].message` (`"watching N resource type(s)"`) | -| [aggregated_apiserver_e2e_test.go:129-130](../../test/e2e/aggregated_apiserver_e2e_test.go#L129-L130) | `kubectl api-resources` output | - -## What happens often - -The dominant "did it work?" pattern in the suite is **pull the repo and stat the -expected file** (`pullLatestRepoState` + `os.Stat`/content checks) — robust, and -the overwhelming majority of specs already do this. The log scrape for "a commit -happened" is the *weaker variant*, and it appears in only two spots (A1, A2). - -So the honest scope of this work is small and sharp: **two commit-existence log -checks** to convert, plus **one optional** readiness check (A3) to retire. It is -not a sprawling refactor. But the *value* is outsized, because A1/A2 are commit -proofs and commits are the product — making them parallel-safe and -implementation-independent is worth more than the line count suggests. - -## The plumbing already exists - -There is nothing to build for the test harness. The metric-assertion path is -established and in production use in the suite: - -- A shared Prometheus scrapes the controller every **5s** via a ServiceMonitor - (job `gitops-reverser`): [servicemonitor.yaml](../../test/e2e/setup/manifests/prometheus/servicemonitor.yaml), - [instance.yaml](../../test/e2e/setup/manifests/prometheus/instance.yaml). -- Helpers already exist: - [`setupPrometheusClient()`](../../test/e2e/helpers.go#L58), - [`queryPrometheus(query)`](../../test/e2e/helpers.go#L82), - [`waitForMetric(...)`](../../test/e2e/helpers.go#L105) / - [`waitForMetricWithTimeout(...)`](../../test/e2e/helpers.go#L110). -- Precedent: [restart_reconcile_e2e_test.go:185-205](../../test/e2e/restart_reconcile_e2e_test.go#L185) - already gates on `gitopsreverser_target_reconcile_completed_total` and - `gitopsreverser_branch_worker_queue_depth`; `controller_basics` and - `aggregated_apiserver` already query `up{job='gitops-reverser'}`. - -A commit-existence check is the same shape as the restart-reconcile spec's reconcile -check that already ships. - -## The gap in `gitopsreverser_commits_total` - -The metric exists and is incremented at -[branch_worker.go:1226-1228](../../internal/git/branch_worker.go#L1226), but it is -recorded **with no attributes**: - -```go -telemetry.CommitsTotal.Add(w.ctx, int64(commitsCreated)) -``` - -With no labels, a PromQL query sees one global series. Two specs committing -concurrently are indistinguishable — exactly the parallelism problem the ask -calls out. The fix is to add labels at this one call site. - -### Why the metric is also *more correct* - -Both commit paths funnel through this single counter: - -- per-event / atomic writes → `executePendingWrite` → - [`"git commit created"`](../../internal/git/commit_executor.go#L160) -- backfill resync writes → `executeResyncPendingWrite` → - [`"git resync commit created"`](../../internal/git/resync_flush.go#L226) - -…and **both** return their `created` count up into -[`recordPendingWritesMetrics`](../../internal/git/branch_worker.go#L1217), which -adds them to `CommitsTotal`. So the single metric already unifies what A1 has to -express as an `Or(...)` of two log strings. Converting A1 is *strictly simpler* -than the log check it replaces, not just more robust. - -## Recommended labels — and why not `gittarget_*` - -The ask guessed at GitTarget labels ("we already create a new GitTarget every -time"). That instinct is right about *isolation* but wrong about *which -dimension*, and the doc says so plainly because the ask invited it ("perhaps I'm -wrong"). - -The commit is produced by a **`BranchWorker`**, whose identity is -`{GitProviderNamespace, GitProviderRef, Branch}` -([branch_worker.go:83](../../internal/git/branch_worker.go#L83)). The worker does -**not** know a single GitTarget at commit time — a branch worker is keyed by -provider+branch, and *multiple* GitTargets that share a provider+branch are served -by the *same* worker, their writes coalesced into one commit batch. A -`gittarget_name` label would therefore be either unavailable or a lie (which of -the N GitTargets sharing the batch?). Threading per-GitTarget attribution down -into the commit batch is possible but invasive and semantically muddy, and is not -warranted for this. - -**Recommendation: label `gitopsreverser_commits_total` with -`{provider_namespace, provider_name, branch}`** — the worker's own identity. This: - -- is available at the call site with zero plumbing (`w.GitProviderNamespace`, - `w.GitProviderRef`, `w.Branch`); -- matches the existing - [`gitopsreverser_branch_worker_queue_depth`](../../internal/git/branch_worker.go#L387) - labels exactly, so the two branch-worker metrics read consistently; -- **isolates concurrent specs anyway** — because each suite mints its - GitProvider in a unique namespace - ([`testNamespaceFor`](../../test/e2e/namespace.go#L43) → - `"-test-"`), so `provider_namespace` is already - per-suite-unique. A query filtered on the spec's own namespace sees only that - spec's commits. - -In short: you get the GitTarget-level isolation you wanted, via the provider's -namespace, without inventing a label the commit layer can't honestly populate. - -> **Reserved-label caveat (load-bearing).** Use the prefixed keys -> `provider_namespace` / `provider_name`, **never** bare `namespace` / `name`. A -> Prometheus pod scrape with `honor_labels=false` overwrites a metric's -> `namespace` attribute with the *scraping target's* namespace, so a -> per-provider `namespace` selector would silently match nothing. This is the -> same reasoning already documented for `TargetReconcileCompletedTotal` in -> [exporter.go](../../internal/telemetry/exporter.go) — follow it. - -> **Note on existing label-name drift.** The codebase already has two styles: -> `provider_namespace`/`provider_name`/`branch` (branch-worker metrics) and -> `git_target_namespace`/`git_target` (the audit route metric, see -> [docs/interpreting-metrics.md](../interpreting-metrics.md)). For -> `commits_total`, stay with the **branch-worker** style because that is the -> layer doing the recording. - -> **Scrape-lag caveat.** A counter only reflects in PromQL after the next scrape -> (≤5s here). `Eventually(...)` with the existing 2s poll / 30s timeout absorbs -> this; do not assert on the metric synchronously right after the git push. - -## How a converted assertion looks - -A1/A2 become a one-liner against the spec's own provider namespace. With the -GitProvider in `testNs`, the substring scrape is replaced by a single call to a -helper added next to the other metric helpers in -[helpers.go](../../test/e2e/helpers.go): - -```go -// in the spec — replaces the controllerLogs(...) substring scrape -waitForCommitInNamespace(testNs) - -// the helper (helpers.go): or vector(0) keeps the query scalar before any series -// exists; the Go-side `> 0` matches the restart-reconcile idiom. It also lazily -// sets up the Prometheus client so a suite need not wire setupPrometheusClient(). -func waitForCommitInNamespace(providerNamespace string) { - ensurePrometheusClient() - query := fmt.Sprintf( - `sum(gitopsreverser_commits_total{provider_namespace=%q}) or vector(0)`, - providerNamespace, - ) - waitForMetricWithTimeout(query, func(v float64) bool { return v > 0 }, - fmt.Sprintf("a commit was created for GitProvider namespace %q", providerNamespace), - 45*time.Second) -} -``` - -The metric gate is a *progress* signal; each converted spec keeps its existing -authoritative check (the repo pull + `os.Stat` of the specific committed file) -immediately after, so a counter already-positive from an earlier spec in the same -suite cannot produce a false pass. (A `branch` filter can be added when a spec -commits to several branches under one provider.) - -## Implementation outline (for the follow-up, non-docs change) - -1. **Metric (one site).** At - [`recordPendingWritesMetrics`](../../internal/git/branch_worker.go#L1217), add - `metric.WithAttributes(provider_namespace, provider_name, branch)` to the - `CommitsTotal.Add`, mirroring `recordQueueDepth`. The caller early-returns when - `commitsCreated == 0`, so the series first appears on the first commit (the - e2e assertion uses `sum(...) > 0`, which handles that cleanly — no need to - pre-instantiate at zero). Unit tests assert the attribute set *and* the - per-namespace isolation via the manual reader - ([`InitTestExporter`](../../internal/telemetry/exporter.go#L221) + - `CollectInt64Sum`). -2. **Docs.** Add a `Labels` column row for `commits_total` in - [docs/interpreting-metrics.md](../interpreting-metrics.md) (it is currently - listed label-less at line 326). Labels are a public observability contract — - document them. -3. **E2E helper.** Add `waitForCommitInNamespace(...)` to - [helpers.go](../../test/e2e/helpers.go). -4. **Convert A1** ([crd_lifecycle](../../test/e2e/crd_lifecycle_e2e_test.go#L284)) - and **A2** ([watchrule](../../test/e2e/watchrule_configmap_secret_e2e_test.go#L514)) - to the helper. A1 loses its two-string `Or(...)` for free. -5. **A3 (optional):** drop the `"Serving metrics server"` log check in - [controller_basics](../../test/e2e/controller_basics_e2e_test.go#L117); the - `up{job='gitops-reverser'}` query immediately below already proves the metrics - server is up and scraped. -6. **Validate** per [AGENTS.md](../../AGENTS.md): `task lint` → `task test` → - `task test-e2e` (e2e needs Docker; run sequentially). This step touches Go, - so it is *not* under the docs-only exception. - -## Scope / non-goals - -- **In scope (later):** label `commits_total`; convert A1, A2; optionally retire - A3; document the labels. -- **Out of scope:** the git-log `"DELETE"` checks, `kubectl`/status checks, and - the diagnostic log dumps (sections B and C) — they read real state and stay. -- **Explicitly not doing:** per-GitTarget commit attribution. The branch-worker - layer can't populate it honestly, and `provider_namespace` already gives the - per-spec isolation the ask wants. -- **This document changes no code.** It is the plan for a small, separately - validated follow-up. diff --git a/docs/design/e2e-signing-followups.md b/docs/finished/e2e-signing-followups.md similarity index 100% rename from docs/design/e2e-signing-followups.md rename to docs/finished/e2e-signing-followups.md diff --git a/docs/design/e2e-speedup-plan.md b/docs/finished/e2e-speedup-plan.md similarity index 98% rename from docs/design/e2e-speedup-plan.md rename to docs/finished/e2e-speedup-plan.md index 7cf04395..8b1c2cec 100644 --- a/docs/design/e2e-speedup-plan.md +++ b/docs/finished/e2e-speedup-plan.md @@ -5,7 +5,7 @@ devs, AI agents, and CI. Phases 0–3 below have **shipped**; this doc keeps the baseline, the outcomes, and the rationale for what was deliberately *not* done. The authoritative list of which specs still run `Serial` (and why) is the living -[e2e-serial-registry.md](e2e-serial-registry.md). +[e2e-serial-registry.md](../spec/e2e-serial-registry.md). ## Non-goals @@ -97,7 +97,7 @@ Parallelism is driven by the `ginkgo` CLI (`--procs=$E2E_GINKGO_PROCS`, default pre-cleanup once on process #1. Per-file CRD-group isolation ([test/e2e/icecream.go](../../test/e2e/icecream.go)) gives `crd_lifecycle`, `restart_reconcile`, and `bi_directional` their own API groups so they never -collide by name. The [e2e-serial-registry.md](e2e-serial-registry.md) captures +collide by name. The [e2e-serial-registry.md](../spec/e2e-serial-registry.md) captures the specs that still need `Serial`. **Measured (local, procs=2):** smoke **352 s** vs 418.7 s sequential (~16 %). diff --git a/docs/finished/git-author.md b/docs/finished/git-author.md deleted file mode 100644 index ad8407a3..00000000 --- a/docs/finished/git-author.md +++ /dev/null @@ -1,165 +0,0 @@ -# gitops-reverser improvement plan - -## Title - -Use OIDC display name and email from audit `user.extra` for the git commit author - -## Body - -`gitops-reverser` attributes each commit to the user that made the cluster -change. Today the author name and email are both derived from a single string — -the Kubernetes username — which produces poor results for OIDC users. - -With an OIDC-authenticated user, the Kubernetes username is the issuer-prefixed -identity, e.g. `https://keycloak.cozy.z65.nl/realms/cozy#simon`. The resulting -commit is: - -```text -Author: https://keycloak.cozy.z65.nl/realms/cozy#simon -``` - -The email is mangled because [`ConstructSafeEmail`](../internal/git/commit.go) -strips every character outside `[a-z0-9.-]` from the username and appends -`@noreply.cluster.local`. The name is the raw username. - -The real display name and email *are* available — they just are not used. -A Kubernetes audit event carries `Event.User.Extra` (`map[string]ExtraValue`, -where `ExtraValue` is `[]string`), and the API server can be configured (via -structured authentication configuration) to map the OIDC `name` and `email` -claims into that map. When it does, `gitops-reverser` still ignores them: -`resolveUserInfo` reads only `event.User.Username`. - -We would like commits to read: - -```text -Author: Simon Koudijs -``` - -## Requested change - -Let `gitops-reverser` source the git author **display name** and **email** from -two fixed keys in the audit event's `user.extra` map, falling back to the -current behaviour when those keys are absent or carry an unusable value. - -To start simple, the key names are **hardcoded** rather than configurable: - -```text -configbutler.ai/claims/display-name e.g. "Simon Koudijs" -configbutler.ai/claims/email e.g. "something@configbutler.ai" -``` - -These match the extras published by our reference kube-apiserver structured -authentication configuration. Making the key names configurable is a possible -later enhancement — deferred until a second cluster actually needs different -names. - -Behaviour: - -- If the display-name extra is present and its value is usable, use it for the - git author `Name`; otherwise use `Username` as today. -- If the email extra is present and its value is usable, use it for the git - author `Email`; otherwise fall back to `ConstructSafeEmail(Username)` as today. -- When neither extra is present, behaviour is byte-for-byte unchanged. This - keeps the change fully backward compatible. - -### Identity selection (impersonation) - -`resolveUserInfo` already prefers the impersonated user over the authenticated -user when impersonation is in play. That behaviour does not change. The new code -reads `Extra` from **the same user that wins** — if the impersonated user is -used, read `ImpersonatedUser.Extra`; otherwise read `User.Extra`. Display name, -email, and username always describe one consistent identity. - -### Keeping it safe - -`user.extra` values originate from an external identity provider, so they are -untrusted input being placed into a git signature header. Two guards keep this -safe: - -- **Multi-value handling.** `ExtraValue` is a `[]string`. Treat an empty slice - as absent; use the first element otherwise. -- **Value validation before use.** A name or email containing a newline or - control character would corrupt the git commit object. Before using an extra - value: - - *Display name*: reject it if it contains control characters or newlines, or - is empty/whitespace after trimming. On rejection, fall back to `Username`. - - *Email*: accept it only if it matches the same valid-email regex already - used inside `ConstructSafeEmail`. On rejection, fall back to - `ConstructSafeEmail(Username)`. - -Both fallbacks are exactly today's behaviour, so a malformed claim degrades -gracefully rather than producing a broken commit. - -`email-verified` is also published as a separate extra -(`configbutler.ai/claims/email-verified`), so `gitops-reverser` could later -decline to use an unverified email. That is a possible enhancement, not part of -this change. - -## Implementation pointers - -The change is localised to the `git` and `queue` packages. Module -`github.com/ConfigButler/gitops-reverser`, observed at release `0.24.0`: - -- **Hardcoded keys.** Define the two extra-key constants near `resolveUserInfo` - in [`internal/queue/redis_audit_consumer.go`](../internal/queue/redis_audit_consumer.go), - e.g. `displayNameExtraKey` and `emailExtraKey`. -- **`internal/git/types.go`** — extend `UserInfo` with optional - `DisplayName string` and `Email string` fields. Adding fields is additive; the - ~20 existing `UserInfo{Username: ...}` test constructions are unaffected. -- **`internal/queue/redis_audit_consumer.go`** — `resolveUserInfo()` currently - returns `git.UserInfo{Username: username}`. After selecting the effective - user (authenticated or impersonated), read that user's `Extra` at the two - hardcoded keys, apply the multi-value and validation rules above, and populate - the new `DisplayName` / `Email` fields. Leaving a field empty signals "fall - back". -- **`internal/git/pending_writes.go`** — `PendingWrite.Author()` returns a bare - username string. Add an accessor that surfaces the full author identity - (e.g. `AuthorUserInfo()` returning the `UserInfo` of `Events[0]`) so the - display name and email reach commit time. Prefer this over a parallel - `AuthorSignature()` helper. -- **`internal/git/commit.go`** — `commitOptionsFor()` builds the - `object.Signature`. Use `UserInfo.DisplayName` for `Name` and `UserInfo.Email` - for `Email` when present; keep `Username` + `ConstructSafeEmail` as the - fallback. Validation can live here, next to `ConstructSafeEmail`, so the git - package owns "what is safe in a signature". -- **`internal/git/open_window.go`** — commit-window coalescing keys on - `Author` (the username) at `open_window.go:50`/`open_window.go:61`. Keep that - key as the username — it is the stable identity used for coalescing and for - the grouped commit *message* `{{.Author}}`. Only the commit's `Author:` - signature gains the display name; the message text is unchanged. - -### Scope note - -Author identity flows through per-event and grouped (commit-window) commits. -Atomic / reconcile-driven commits set the operator as the author already -(`commitOptionsFor` returns the committer when `PendingWrite.Author()` is empty) -and are intentionally left unchanged by this work. - -## Why this matters - -`gitops-reverser` turns cluster changes into a git history. A git history is -only useful for audit and `git blame` if the author is a real, recognisable -identity. With OIDC — which is the recommended way to authenticate real humans -to a cluster — the current output is an unreadable URL fragment and a -non-deliverable email address. - -The fix does not require `gitops-reverser` to understand OIDC, talk to an -identity provider, or hold any credentials. It only needs to read two extra -fields that the Kubernetes audit event already delivers. The API-server side -(mapping `name`/`email` claims into `user.extra`) is standard, supported -Kubernetes configuration and is the operator's responsibility. - -## Verification - -With the API server configured to map `name` → `configbutler.ai/claims/display-name` -and `email` → `configbutler.ai/claims/email`, a commit made by an OIDC user -should read: - -```text -Author: Simon Koudijs -``` - -A cluster whose API server publishes neither extra should produce today's -output for an identical change, confirming backward compatibility. A claim -carrying a malformed value (newline in the name, non-email string in the email) -should also fall back to today's output rather than producing a broken commit. diff --git a/docs/design/git-credentials-interop.md b/docs/finished/git-credentials-interop.md similarity index 100% rename from docs/design/git-credentials-interop.md rename to docs/finished/git-credentials-interop.md diff --git a/docs/finished/idea-audit-enrichment-side-channel.md b/docs/finished/idea-audit-enrichment-side-channel.md deleted file mode 100644 index 3433754c..00000000 --- a/docs/finished/idea-audit-enrichment-side-channel.md +++ /dev/null @@ -1,734 +0,0 @@ -# Idea: dedicated audit enrichment side-channel - -> Status: superseded — the implemented body-parking pipeline replaces this proposal. -> See the [Audit Ingestion Pipeline section](../architecture.md#audit-ingestion-pipeline) in -> the architecture document for the shipped design. This doc is kept as historical context for -> the design exploration only. -> Related to but not blocking `design-commit-context-api.md`. -> Date: 2026-05-07 - -## Why this idea exists - -Today gitops-reverser ingests audit events from two sources through a single endpoint: - -- kube-apiserver, via `--audit-webhook-config-file` -- `apiservice-audit-proxy`, when deployed in front of an aggregated API - -Both POST `auditv1.EventList` payloads to `/audit-webhook/{clusterID}` and both flow through -the same `AuditHandler`. For a request that passes through the proxy, two events with the same -`auditID` end up in the canonical audit stream — one hollow native event from kube-apiserver, -one enriched synthetic event from the proxy. - -This works but couples the two channels and forces every consumer to reason about the -duplicate. The `CommitContext design` notes this as the reason -for an idempotency-marker mechanism in its consumer logic. A cleaner alternative is to give -the proxy its own ingestion endpoint that does *not* feed the canonical stream, and instead -populates a side-cache the consumer reads when processing the canonical event. - -This is best treated as **pipeline cleanup, not a `CommitContext` prerequisite.** -`CommitContext` v1 should ship with the local stash plus idempotency marker described in -`design-commit-context-api.md`; the side-channel is the -follow-up that removes the marker workaround once the broader pipeline is reshaped. -Treating it as a prerequisite would block `CommitContext` behind a refactor that does not -need to be in the critical path. - -## Current shape - -`AuditHandler.ServeHTTP` accepts both kube-apiserver and proxy POSTs, decodes the -`EventList`, and enqueues each event to the Valkey audit stream -([internal/webhook/audit_handler.go:107](../../internal/webhook/audit_handler.go#L107), -[internal/webhook/audit_handler.go:226](../../internal/webhook/audit_handler.go#L226)). - -The proxy's send is fire-and-forget with no retry -([handler.go:202](../../external-sources/apiservice-audit-proxy/pkg/proxy/handler.go#L202)): - -```go -go h.buildAndSendAuditEvent(...) // 5s timeout, single attempt -``` - -kube-apiserver's send is batched and retried per its own audit-webhook semantics. - -Two costs of the current shape: - -1. **Two events with the same `auditID` reach the consumer.** Every consumer has to reason - about both arrivals. For designs like `CommitContext` this means an idempotency marker is - needed to avoid false stash-miss alarms. -2. **The proxy and kube-apiserver share an ingestion endpoint.** In principle the proxy - could delay or perturb native event ordering. In practice they do not interfere, but the - coupling is real. - -```mermaid -flowchart LR - actor["Actor
kubectl / API client"] - apiserver["kube-apiserver"] - proxy["apiservice-audit-proxy"] - backend["aggregated backend"] - - actor -->|"mutating request"| apiserver - apiserver -->|"proxied"| proxy - proxy -->|"forward"| backend - backend -->|"response"| proxy - proxy -->|"response"| apiserver - apiserver -->|"response"| actor - - handler["AuditHandler
/audit-webhook/{clusterID}"] - stream[("Valkey audit stream")] - consumer["redis_audit_consumer
must dedupe by auditID"] - - apiserver -. "native event
hollow, batched, retried" .-> handler - proxy -. "synthetic event
enriched, fire-and-forget" .-> handler - handler --> stream - stream --> consumer - - classDef real fill:#e8f4ff,stroke:#2f6f9f,color:#102a43 - classDef receiver fill:#fff4d6,stroke:#a36b00,color:#3d2a00 - classDef store fill:#f0e6ff,stroke:#5a2a9f,color:#2a1040 - class apiserver,proxy,backend real - class handler,consumer receiver - class stream store -``` - -Both audit channels converge on the same handler and the same stream. The consumer ends up -holding the duplicate-detection responsibility. - -## Proposed shape - -Move `apiservice-audit-proxy` ingestion to its own endpoint, working name -`/audit-enrichment/{clusterID}`, served by a new `AuditEnrichmentHandler` separate from -`AuditHandler`. The new handler's only job: - -1. Validate the inbound `EventList` came from a trusted proxy (mTLS / kubeconfig as today). -2. For each event, write the enriched payload to a Valkey cache keyed by `auditID`: - - key: `audit:enrichment:` - - value: the full event including `requestObject`, `responseObject`, and `objectRef.name` - - TTL: minutes — long enough to outlive kube-apiserver batch delivery, short enough not - to pile up -3. Return 200. - -The canonical audit stream now contains *only* native kube-apiserver events. When the -consumer processes one for an aggregated-API kind, it does a single Valkey GET on -`audit:enrichment:`: - -- **Hit:** merge the enriched payload onto the hollow native event, process the merged - result, DEL the cache entry. -- **Miss:** process the hollow event as-is. For built-in resources this is already the - default. For aggregated APIs with no proxy in their path, it is the existing degraded - behaviour. - -```mermaid -flowchart LR - actor["Actor
kubectl / API client"] - apiserver["kube-apiserver"] - proxy["apiservice-audit-proxy"] - backend["aggregated backend"] - - actor -->|"mutating request"| apiserver - apiserver -->|"proxied"| proxy - proxy -->|"forward"| backend - backend -->|"response"| proxy - proxy -->|"response"| apiserver - apiserver -->|"response"| actor - - auditH["AuditHandler
/audit-webhook/{clusterID}"] - enrichH["AuditEnrichmentHandler
/audit-enrichment/{clusterID}
(new)"] - stream[("Valkey audit stream
canonical, single channel")] - cache[("Valkey enrichment cache
audit:enrichment:{auditID}
TTL minutes")] - consumer["redis_audit_consumer
read event,
GET cache, merge, DEL"] - - apiserver -. "native event
hollow, batched, retried" .-> auditH - proxy -. "enrichment event
retried, off request path" .-> enrichH - auditH --> stream - enrichH --> cache - stream --> consumer - cache -.->|"lookup at processing time"| consumer - - classDef real fill:#e8f4ff,stroke:#2f6f9f,color:#102a43 - classDef receiver fill:#fff4d6,stroke:#a36b00,color:#3d2a00 - classDef new fill:#d4f7d4,stroke:#2a7f2a,color:#0a3d0a - classDef store fill:#f0e6ff,stroke:#5a2a9f,color:#2a1040 - class apiserver,proxy,backend real - class auditH,consumer receiver - class enrichH new - class stream,cache store -``` - -The enrichment becomes a *side-channel* (green): a separate endpoint, a separate Valkey key -space, a separate retry policy, separate metrics. The canonical pipeline (yellow boxes plus -the audit stream) carries exactly one event per request and the consumer joins enrichment -in on demand. The enrichment write happens in a goroutine right after the proxied response, -so under normal conditions it lands in cache before the kube-apiserver batched native -delivery — but this is "almost always" rather than "structurally guaranteed" (see the -ordering point in the next section). The architecture's real win is removing the -duplicate-event problem; the consumer accepts a brief wait-or-degrade fallback for the -rare cases where native arrives first. - -## Why this is better - -- **One event per request in the canonical pipeline.** No more sibling-event reasoning, no - more idempotency markers, no "is this miss real or already-attached?" branching. The - consumer's logic for `CommitContext` and similar designs collapses to "GET stash, attach, - DEL." -- **Ordering: usually right, but not strictly guaranteed.** The proxy's enrichment send - starts in a goroutine *after* the proxied response is written - ([handler.go:196](../../external-sources/apiservice-audit-proxy/pkg/proxy/handler.go#L196)), - so it generally beats kube-apiserver's batched native delivery — but only generally. If - the receiver is slow, the proxy's goroutine pool backs up, retries kick in, or audit - webhook batching is configured aggressively, the native event can still arrive first. - The consumer should therefore be designed as "GET the cache; for events from kinds - that are *expected* to be enriched, optionally wait or retry briefly before degrading - to the hollow event," not "single GET is always enough." The architecture's real - structural win is removing the duplicate-event problem entirely; ordering is "almost - always wins, with a defined fallback" rather than a hard guarantee. -- **Separation of concerns / uptime isolation.** The proxy is an enrichment side-channel, - not a parallel main channel. Its uptime, retries, and timing cannot affect the order or - completeness of native audit events. If the proxy is down, audit ingestion still works — - events are just hollow for aggregated APIs the proxy was supposed to enrich. -- **Testable independently.** A separate handler is its own RBAC scope, its own cert, its - own metrics, and its own e2e surface. - -## Required upstream changes in `apiservice-audit-proxy` - -- The proxy must **retry** on transient send failures. The current shape (one attempt, 5s - timeout) is acceptable for best-effort delivery alongside native audit, but in the - enrichment role losing the event loses the only source of `requestObject`/`responseObject` - for that request. A bounded retry with backoff (e.g., 3 attempts over ~10s) is the - minimum. Retry must run in a goroutine pool that does not block the main request path, so - a slow receiver cannot back-pressure the proxy's pass-through duty. -- The proxy chart needs a way to point its webhook kubeconfig at the new - `/audit-enrichment/` endpoint instead of `/audit-webhook/`. - -## Observability for "something is wrong" - -There is no existing miss or orphan counter on the audit pipeline today. `AuditHandler` -exports `gitopsreverser_audit_events_received_total` -([internal/telemetry/exporter.go:70-71](../../internal/telemetry/exporter.go#L70-L71)) but -nothing equivalent for "expected enrichment did not arrive." Net-new counters that land -alongside this work: - -- `audit_enrichment_miss_total` — incremented when the consumer processes a native event - for a resource that should have been enriched (aggregated API kind) but found no - enrichment cache entry. -- `audit_enrichment_orphan_total` — incremented when an enrichment cache entry expires - without ever being matched by a native event. -- `audit_enrichment_received_total` — total enrichments received (parallel to the existing - `audit_events_received_total`). -- `audit_enrichment_handler_errors_total{reason}` — handler-side errors (TLS, decode, - validation). - -Persistent non-zero rates on the miss or orphan counters indicate one of: proxy down, -cluster has aggregated APIs that bypass the proxy, network partition between proxy and -gitops-reverser, or misconfigured Valkey routing. Alert thresholds and runbook entries -should land alongside the metrics themselves. - -**Implementation note on orphan counters.** Valkey TTL expiry does not natively emit a -counter increment, so `audit_enrichment_orphan_total` (and the analogous -`commit_context_stash_orphan_total`) cannot be assumed for free. Implementing them -requires either subscribing to Valkey keyspace notifications -(`__keyevent@*__:expired`, configured via `notify-keyspace-events`) or maintaining a -small secondary index of in-flight cache entries plus a sweeper that decrements on a -successful match and counts on expiry. Either approach is straightforward but is a -non-trivial implementation choice that should be designed deliberately and land -alongside the metric — not promised in advance and discovered missing later. - -## Open questions - -- **TTL value.** "Minutes" is a placeholder. Concrete value should be longer than the - cluster's `--audit-webhook-batch-max-wait` plus typical processing lag, but short enough - not to bloat Valkey. 5–15 minutes is a reasonable starting range; whether to expose this - to operators or fix it in code is open. -- **Cache value schema versioning.** Different proxy versions may emit different enrichment - shapes. The cache value should carry a schema version (`{"v":1, "event": ...}`) so a - future proxy upgrade does not surprise the consumer. -- **Multi-proxy support.** If multiple proxies front different aggregated APIs, they all - write to the same enrichment cache. Should the proxy identify itself in the value - (proxy name + version) for debugging? Audit annotations on the event itself would carry - this naturally. -- **Marker for "this kind is expected to be enriched."** The miss counter only makes sense - if the consumer knows which audit events *should* have had enrichment. Either the - consumer keeps a list of aggregated-API kinds it knows the proxy fronts, or the proxy - attaches a flag (`apiservice-audit-proxy/expected: true`) to enrichment payloads at - registration time. Worth pinning the rule before metrics start firing alerts. -- **Should the CommitContext stash collapse into this cache?** Probably no. The - CommitContext stash holds the request body that *gitops-reverser's own handler* saw — the - proxy is not in the picture and is not even required to be deployed for `CommitContext`. - Two caches with two purposes is fine; the doc should make the distinction clear. -- **Is the enrichment endpoint a good place for other advisory data?** Future signals - (a webhook-policy decision log, a downstream replication confirmation) could ride on the - same envelope. Premature to commit, but the endpoint should be designed not to lock out - adjacent uses. - -## Potential problems and risks - -The refinement is not free. Concrete things that can go wrong: - -- **Trust boundary on the new endpoint.** The enrichment payload carries `requestObject` and - `responseObject` that the consumer treats as the source of truth for a hollow native - event. A compromised or misconfigured proxy can therefore inject false content for a - specific `auditID`. mTLS and kubeconfig restrict *who can write*, but the consumer has no - independent way to verify *what was written* against kube-apiserver's view (the native - event has no body). Mitigations: pin the proxy identity in the cache value, log - prominently on first-of-kind enrichments per cluster, and treat any merge as a low-trust - enrichment for security-sensitive audit consumers. -- **Cache memory pressure.** Every aggregated-API mutation goes through the enrichment - cache. For high-volume aggregated APIs (metrics-server-style traffic, custom-metrics - apiservers, etc.) this can become significant Valkey memory. TTL bounds it but the - steady-state working set scales with traffic — capacity planning becomes a deployment - concern. -- **Replay after consumer crash.** If the consumer DELs the enrichment cache entry but - crashes before durably committing the joined event downstream, on restart the audit - event replay finds an empty cache. The consumer must either write the joined-event - result downstream first and DEL only after success, or accept "process hollow on replay - and lose enrichment." Pick one and document it. -- **Proxy retry backpressure.** With retry semantics, a slow or down receiver causes the - proxy to spend time retrying. If retry runs on the proxy's request path it back-pressures - the proxy's pass-through duty and slows the apiserver's view of the aggregated API. Retry - must be off the request path, in a goroutine pool with bounded concurrency. -- **Disagreement between native and synthetic views of the same request.** In pathological - cases (proxy and kube-apiserver disagree on response status, or one drops the request - mid-flight) the cache might say `responseStatus.code == 201` while the canonical event - says `responseStatus.code == 500`. Pick a rule: consumer trusts the canonical event for - status, identity, and timestamps; only `requestObject` / `responseObject` / `objectRef.name` - come from enrichment. The synthetic event's view of `responseStatus` is only useful as - debugging context, never as authority. -- **Operator runbook complexity.** Two audit endpoints, two caches, two retry stories, two - metrics families. Troubleshooting "why isn't this commit landing?" now has more variables. - A runbook section that walks through the layered failures becomes a release requirement, - not a nicety. -- **Cluster federation / multi-Valkey deployments.** If gitops-reverser runs multiple - instances pointing at separate Valkeys (per-tenant, per-region), the proxy needs to know - which Valkey to land in. Today the kubeconfig-based webhook delivery routes per-cluster - via the URL path; the new endpoint must follow the same model so split deployments still - work. -- **Net-new TLS surface.** The new endpoint needs its own TLS terminus. Either share the - existing audit-webhook cert (works if DNS / SANs match) or issue a second cert. Either - way it is a deployment item that did not exist before, and rotation procedures must - cover both. -- **Distinguishing "no proxy in path" from "proxy delivered nothing".** Both look like - enrichment misses to the consumer. Without the "should-have-been-enriched" hint (see - open questions) the alert metric will fire on benign cases — every audit event for an - aggregated API the cluster does not run a proxy for will count as a miss. Until that - hint exists, the metric is best treated as a debugging signal rather than an alerting - signal. -- **Schema drift across proxy versions.** If a future proxy version adds a field to the - cache value and an older consumer ignores it, that is fine. If a future consumer expects - a field an older proxy never wrote, the consumer must degrade gracefully. The schema - version field listed under open questions is the seatbelt for this. - -## Migration - -This refinement is non-breaking with respect to `CommitContext` v1alpha1: - -- If the refinement lands first, the idempotency-marker case in - `design-commit-context-api.md`'s failure-modes list - disappears — only one event per `auditID` reaches the consumer, so there is no - double-attach to defend against. -- If `CommitContext` ships first, the marker mechanism handles the dual-event case until - the refinement lands. - -Either ordering works in principle, but the recommended sequencing is `CommitContext` -first with the marker in place, side-channel afterwards as a pipeline-cleanup follow-up. -See the [Recommendation chapter](#recommendation-which-approach-fits-best) for the full -argument. - -## Alternative: `audit-proxy` as universal audit fan-out hub - -A more ambitious option, raised because the same maintainer owns -`apiservice-audit-proxy`: expand its scope substantially. Rename it to `audit-proxy`, point -kube-apiserver's `--audit-webhook-config-file` at it instead of at gitops-reverser, give it -its own Redis, and let it own the entire job of producing a trustworthy unified audit -stream. The proxy then fans that stream out to one or more downstream consumers — -gitops-reverser becoming one consumer among potentially many. - -### Sketch - -- kube-apiserver's audit webhook target moves from gitops-reverser to `audit-proxy`. -- `audit-proxy` continues to do what `apiservice-audit-proxy` does today: sit in front of - aggregated API backends, capture request and response bodies, attach `Audit-ID`. -- All native kube-apiserver audit events also land in `audit-proxy`. -- `audit-proxy` runs its own Redis (or dedicated Valkey database) used as a short-lived - stitching cache: it joins the hollow native event with the body it captured for the same - `auditID`, in-process, without crossing a public network boundary. -- The stitched result is a single, complete, audit-id-deduplicated stream that - `audit-proxy` exposes as one or more output channels. -- gitops-reverser drops its audit-webhook receiver entirely. It becomes a plain consumer of - `audit-proxy`'s output channel. The transport between the hub and its consumers is itself - a design choice — covered below — and is not necessarily a Redis stream. - -```mermaid -flowchart LR - actor["Actor
kubectl / API client"] - apiserver["kube-apiserver"] - proxy["audit-proxy
(generalised
apiservice-audit-proxy)"] - backend["aggregated backend"] - proxyRedis[("audit-proxy Redis
stitching + fan-out stream")] - - grA["gitops-reverser A"] - grB["gitops-reverser B"] - other["other consumer
SIEM / archiver / ..."] - - actor -->|"mutating request"| apiserver - apiserver -->|"proxied request"| proxy - proxy -->|"forward"| backend - backend -->|"response"| proxy - proxy -->|"response"| apiserver - apiserver -->|"response"| actor - - apiserver -. "audit webhook target
all events, native" .-> proxy - proxy <--> proxyRedis - - proxy -->|"complete events"| grA - proxy -->|"complete events"| grB - proxy -->|"complete events"| other - - classDef real fill:#e8f4ff,stroke:#2f6f9f,color:#102a43 - classDef hub fill:#d4f7d4,stroke:#2a7f2a,color:#0a3d0a - classDef receiver fill:#fff4d6,stroke:#a36b00,color:#3d2a00 - classDef store fill:#f0e6ff,stroke:#5a2a9f,color:#2a1040 - class apiserver,backend real - class proxy hub - class proxyRedis store - class grA,grB,other receiver -``` - -### Transport: Redis stream vs webhook-style HTTP - -The diagram above leaves the transport between the hub and its consumers deliberately -underspecified. The instinct of "audit-proxy publishes to a Redis stream and consumers -attach with consumer groups" is one option, but probably not the right default. A more -conservative choice is to keep the *external* contract of the hub identical to -kube-apiserver's audit webhook — same wire format, same shape, just with the bodies filled -in. - -The webhook-style transport has real advantages: - -- **Consumers do not change their receive model.** gitops-reverser already speaks - audit-webhook. If `audit-proxy` is just "kube-apiserver but with complete events," every - existing consumer integrates without a code change. The hub becomes drop-in. -- **Simple installations stay simple.** A cluster that does not run any aggregated APIs — - or that accepts hollow audit for the ones it does — can skip the hub entirely and point - kube-apiserver directly at gitops-reverser, exactly as today. The hub becomes optional - rather than mandatory. The cost is real and explicit: without the hub, aggregated-API - events stay hollow. -- **No public Redis surface.** The hub's Redis can stay strictly internal. The network - contract between hub and consumer is HTTPS, not a Redis pubsub/stream. Smaller exposure - area, simpler TLS story, no need to publish a Redis client API. - -The Redis-stream transport in turn has its own strengths — durable replay, consumer-group -back-pressure, easy multi-consumer fan-out — which matter more if there are many -consumers or a consumer needs to catch up after extended downtime. - -Best read: keep the *external* contract on the hub webhook-shaped (same wire format as -kube-apiserver's audit webhook). The hub uses whatever it wants internally — including a -Redis stream as an internal staging buffer — but consumers see audit-webhook. If a -consumer later needs durable replay across restarts, the hub can grow a Redis-stream -output channel alongside the webhook output without breaking anyone. - -### Configurable enrichment policy - -The hub has to make a choice when the synthetic enriched event and the hollow native -event both exist for the same `auditID`. Rather than hardcoding one strategy, this should -be configuration: - -- **Stitch and emit one merged event.** Hold the hollow native event briefly, wait for - the synthetic enrichment, merge native identity/timestamps with synthetic body, emit one - record. Highest fidelity, highest latency. -- **Synthetic wins, drop native.** When the synthetic enriched event lands first (the - expected case for aggregated APIs the proxy fronts), emit it immediately into the - output and discard the hollow native event when it arrives later. Lowest latency for - aggregated APIs; trades the native event's batch-and-retry durability for speed. -- **Native wins, drop synthetic.** Emit the native hollow event as it arrives and - discard the synthetic. Equivalent to "no enrichment" — useful when the operator only - wants the hub for fan-out, not for body recovery. -- **Pass both.** Today's accidental behaviour. Useful as a debugging mode, but not a - steady-state strategy. - -The choice can be cluster-wide, per-aggregated-APIService, or even per audit-policy rule. -A reasonable default for a typical gitops-reverser deployment is "synthetic wins, drop -native" for aggregated APIs (fastest path to a complete event) and pass-through for -built-in resources (no synthetic exists, so nothing to choose). The merge mode is for -consumers that need both the native event's exact stage timestamps *and* the body — a -security audit archive, for example. - -Making this configurable also gives a clean upgrade path: a new strategy can be added -without breaking existing consumers, and operators can tune for latency vs durability per -their constraints. It also acknowledges the maintainer's point that this is a *choice*, -not a single right answer. - -### Why it is appealing - -- **Dedicated Redis means fast.** The stitching cache is internal to one process boundary; - reads and writes do not cross mTLS, kubeconfig, or pod-to-pod network. Latency is - fundamentally lower than any cross-pod design and there is no shared cluster-wide Valkey - to compete with. -- **Ordering is guaranteed at the source.** The proxy is the only thing that emits events - downstream. It can hold a hollow native event briefly until the matching enrichment - arrives (or a timeout fires) and emit one complete record. Downstream consumers see one - ordered stream of fully-formed events. gitops-reverser shrinks because it no longer has - to defend against duplicates, hollow events, or missing bodies. -- **Reusable. The audit-stream-trust problem is general.** Other projects that consume - Kubernetes audit logs face the same hollow-events-for-aggregated-APIs gap. A standalone - `audit-proxy` that solves it is useful well beyond gitops-reverser. The fix lives once, - in the right place — auditing infrastructure rather than a downstream consumer. -- **Fan-out to multiple receivers — the killer feature.** kube-apiserver's audit webhook - configuration accepts exactly one URL per cluster. Today that makes it impossible to run - multiple gitops-reverser instances against one cluster, or to layer in a SIEM and an - archiver alongside gitops-reverser. With the proxy as the only direct webhook target, - fan-out happens cheaply on the proxy side: each subscriber gets its own consumer group - on the output stream. Multi-consumer audit becomes a Day 1 capability, including the - "two gitops-reverser instances in one test cluster" case the maintainer hits today. -- **Enterprise adoption depends on it.** Many companies already point their kube-apiserver - audit webhook at a SIEM, compliance archiver, or in-house security tool. Because - kube-apiserver supports exactly one webhook target, gitops-reverser cannot be deployed - alongside that existing consumer without displacing it — and security teams will not - allow displacing audit infrastructure they already depend on. A fan-out hub turns this - from "you'd have to convince our security team to replace the SIEM" into "point - everything at the hub; nothing on the existing consumer side changes." For larger - clusters this is potentially the difference between "tool that runs in test clusters" - and "tool a company can actually adopt without a security review of replacing audit - infrastructure." - -### Trade-offs and risks - -The reach is much wider than the side-channel proposal, and so is the surface area. - -- **Massively expanded scope for `apiservice-audit-proxy`.** Today it is a small focused - tool that closes one gap. Becoming the cluster's audit hub means owning fan-out semantics, - consumer-group management, retention, replay, observability for *all* downstream - consumers, security sensitivity for the full audit log, and an upgrade story that does - not break any consumer in the wild. The maintainer cost approximately doubles. -- **Single point of failure for the entire cluster's audit ingestion.** Today - gitops-reverser is also a single point, but the blast radius is "gitops-reverser stops - working." With the hub, the blast radius is "no audit-driven tool in the cluster gets - events." That changes how operator teams think about uptime, blue/green upgrades, and HA. -- **One more network hop, paid by every event.** Native audit events that did not need - enrichment (built-in resources) now traverse the proxy anyway. For an off-request-path - signal this is acceptable, but it is a tax on every audited mutation in the cluster. -- **Security blast radius concentrates.** Audit events carry identity, request bodies, and - occasionally secrets-adjacent content. Concentrating that in one fan-out hub raises the - consequences of a compromise. The hub has to be hardened to a higher bar than a - consumer-side proxy that only sees a subset. -- **gitops-reverser may or may not gain a hard dependency on `audit-proxy` — it depends - entirely on the transport choice.** Under a Redis-stream-coupled transport, the - dependency is real: gitops-reverser cannot ingest audit at all without the hub running. - Under a webhook-shaped transport (see - [Transport: Redis stream vs webhook-style HTTP](#transport-redis-stream-vs-webhook-style-http)), - the property the `CommitContext` design relies on — that gitops-reverser runs without - `apiservice-audit-proxy` in simple installs — is preserved: a cluster can point - kube-apiserver directly at gitops-reverser and skip the hub entirely, losing only - enrichment of aggregated-API events. So this risk is avoidable by design and lands on - the transport decision, not on the hub idea itself. The recommended default is - webhook-shaped output, which keeps simple installs simple and makes the hub an - *optional* component rather than a required one. -- **Consumer-group semantics need a real design pass.** At-least-once vs at-most-once, - per-consumer retention, slow-consumer back-pressure, replay from a given audit ID, - ordering guarantees across fan-out edges — none of this is hand-wave. Each consumer's - failure mode has to be characterised. -- **Operationally heavier.** A second Redis (the proxy's), a second TLS chain (between the - proxy and each consumer), separate alerting, separate runbooks, separate upgrade - sequencing. -- **For non-aggregated-API events, enrichment value is zero.** Most audit volume in most - clusters is not an aggregated API — it is core resources whose native events are already - complete. Putting them through a stitching cache buys nothing for those events but pays - the cost. -- **Dual-purpose proxy mixes concerns.** The proxy today has one job: pass-through with - enrichment. Adding fan-out, retention, and consumer management mixes two - responsibilities inside one binary. A future split (e.g., a "front-proxy" that does - pass-through and an "audit-hub" that does fan-out) may eventually become natural — and - reversing course is harder once consumers have integrated against the combined surface. - -### Where it differs from the side-channel proposal - -The side-channel proposal keeps gitops-reverser as the audit ingestion point and adds an -internal cache for proxy enrichment. It is a small change, scoped to gitops-reverser, with -no operator-facing impact. The hub proposal moves audit ingestion *out* of gitops-reverser -entirely, into a tool the maintainer already owns, and turns the -one-receiver-per-cluster constraint into a fan-out feature. The two are different -architectural commitments, not deployment variants of the same idea. - -### Prior art - -A fan-out hub for Kubernetes audit events is not a new idea. The existence of several -mature implementations is itself an argument for the pattern — and a reason to study them -before designing this one from scratch. - -- **[gardener/auditlog-forwarder](https://github.com/gardener/auditlog-forwarder)** — - the closest direct analogue. A webhook server that receives Kubernetes audit events, - enriches them with metadata annotations, and forwards to multiple configured backends. - Same architectural shape (single inbound webhook from kube-apiserver, multiple - outbound backends, optional enrichment). Worth studying for its config model and - transport choices before committing to building. -- **[KubeSphere kube-auditing-webhook](https://kubesphere.io/docs/v3.4/toolbox/auditing/auditing-receive-customize/)** — - KubeSphere's CRD-based audit webhook with multiple receiver types (alertmanager and - more). Tied to KubeSphere as a platform, but demonstrates the same multi-receiver - need with a CRD-driven configuration model. -- **[sysdiglabs/aks-audit-log](https://github.com/sysdiglabs/aks-audit-log)** — - Azure-specific (AKS), forwards to Sysdig and Log Analytics. Confirms the - multi-destination pattern in a managed-Kubernetes context. -- **General-purpose log routers** like - [Fluent Bit](https://fluentbit.io/), [Fluentd](https://www.fluentd.org/), - [Vector](https://vector.dev/), and the - [OpenTelemetry Collector](https://opentelemetry.io/docs/collector/) can be configured - to receive a Kubernetes audit webhook and fan out to multiple sinks. They do not - reconstruct hollow events for aggregated APIs, but they are what most enterprises - already have available for log-shaped fan-out — and they are battle-tested at scale. - -What is *not* yet a turnkey component is "fan-out hub plus aggregated-API enrichment in -one tool." Gardener's forwarder enriches but does not (as far as the public docs show) -reconstruct hollow events for aggregated APIs the way `apiservice-audit-proxy` does. The -general-purpose routers do neither. The hub direction therefore has a real -differentiation story — it is not "yet another audit forwarder" but specifically "the -one that closes the aggregated-API gap *and* fans out." - -The prior art also opens a build-vs-borrow question. Rather than growing -`apiservice-audit-proxy` into a full hub, an alternative is to extend (e.g.) -`gardener/auditlog-forwarder` with the aggregated-API capture role and let it own the -fan-out side it already does well. Worth weighing if the hub direction is taken — it -trades maintenance commitment on a familiar codebase for cooperation with an upstream -project that already has its own roadmap. - -### If upstream solved it - -The honest meta-point: this whole class of work is firefighting around an upstream -Kubernetes gap. If kube-apiserver one day populated `requestObject`, `responseObject`, and -`objectRef.name` for aggregated API audit events natively, the entire enrichment story -disappears. Consumers would receive complete events directly, the side-channel cache -becomes unnecessary, and `audit-proxy`'s pass-through-with-enrichment role evaporates. - -What does *not* go away in that future is the fan-out problem. kube-apiserver still -accepts only one audit webhook target per cluster. A cluster that wants multiple audit -consumers (gitops-reverser plus a SIEM, or two gitops-reverser instances) still needs a -fan-out hub between the apiserver and the consumers — even if every event the hub -forwards is already complete out of the box. - -So the layered reality: - -- **If upstream fills the audit gap:** the side-channel and the enrichment role both - retire. The hub stays alive but only for fan-out. -- **If upstream also adds multi-target audit webhook configuration:** the hub retires - entirely. None of these documents are needed. -- **If neither lands:** the maintenance burden is permanent and the hub becomes a more - attractive long-term investment. - -This framing matters for sequencing. Investing heavily in stitching infrastructure has -diminishing returns if upstream is moving on the gap; investing in fan-out is durable -regardless. If the maintainer has to pick which capability of the hub to harden first, -fan-out is the most upstream-resilient bet. - -## Recommendation: which approach fits best - -| Aspect | Current shape | Side-channel cache | `audit-proxy` hub | -|--------|---------------|--------------------|-------------------| -| Scope of change | none | gitops-reverser only | `apiservice-audit-proxy` generalisation + gitops-reverser drops audit ingestion | -| New components | none | new endpoint + cache in gitops-reverser | new Redis + fan-out story in audit-proxy | -| Cluster operator impact | none | audit-policy update | new audit-webhook target, new component to operate | -| Multiple consumers? | no | no | yes — major win | -| gitops-reverser complexity | high (consumer-side dedupe) | medium (cache lookup) | low (plain stream consumer) | -| Single point of failure for cluster audit | gitops-reverser | gitops-reverser | audit-proxy | -| Reusable for other projects | no | no | yes | -| Time to first viable implementation | already shipped | days to weeks | months — design + maintenance commitment | -| Reversibility | n/a | easy to roll back | hard once consumers integrate | -| Solves "two gitops-reverser in one cluster" | no | no | yes | - -The honest read: - -- **The side-channel is pipeline cleanup, not a `CommitContext` prerequisite.** - `CommitContext` v1 should ship with the local stash + idempotency marker described in - `design-commit-context-api.md`. That is enough to get the - feature working under the current single-endpoint shape. The side-channel comes - afterwards as the follow-up that removes the marker, removes consumer-side reasoning - about duplicate `auditID`s, and stops every future audit-driven feature from inheriting - the same workaround. Treating it as a prerequisite would block `CommitContext` on a - broader audit-pipeline refactor that does not need to be in the critical path. -- **Pursue it eventually — sooner if aggregated-API enrichment matters beyond - `CommitContext`.** The side-channel pays for itself the moment a second feature in - gitops-reverser depends on a complete (non-hollow) audit event for an aggregated API. - Until then it is "valuable but not urgent." It is contained, low-risk, and reversible, - so when it does become a priority it is a normal-sized engineering project rather than - a risky refactor. -- **The hub direction is probably not worth pursuing — and the prior art is the reason.** - Fan-out for Kubernetes audit events is already a solved problem at enterprise scale. - Companies that need it use Fluent Bit, Fluentd, Vector, the OpenTelemetry Collector, - [gardener/auditlog-forwarder](https://github.com/gardener/auditlog-forwarder), or - whichever log router their observability or security team has already standardised on. - Building another forwarder means competing with battle-tested components inside - someone else's standardised pipeline — a hard place to win adoption from. The unique - value `apiservice-audit-proxy` carries today is closing the aggregated-API audit gap, - which none of those tools do; that capability does not require fan-out to be shipped, - and bundling fan-out into the proxy dilutes the differentiation. See - [Prior art](#prior-art). -- **Multi-consumer audit needs are best deferred to existing fan-out tools.** A cluster - with a SIEM and gitops-reverser points the kube-apiserver audit webhook at (e.g.) - Fluent Bit, which fans out to both. If the cluster also wants aggregated-API bodies, - place `apiservice-audit-proxy` *upstream* of the fan-out tool — every event the proxy - emits looks like a normal kube-apiserver audit event with bodies filled in, and any - compliant fan-out tool ingests it as-is. -- **The deciding question for the maintainer flips.** It stops being "should we grow - `apiservice-audit-proxy` into a hub?" and becomes "do we keep it narrowly focused on - the aggregated-API gap, where it is differentiated?" The latter framing fits the - smaller maintenance commitment naturally and aligns with the upstream-resilience - point below. -- **Upstream may eventually obsolete the proxy itself.** If kube-apiserver fills the - aggregated-API audit gap, `apiservice-audit-proxy` retires entirely — and the cluster - is left with whatever fan-out tool it already had, which was the right answer all - along. Investing in fan-out as a proxy capability is double-fragile: redundant against - existing fan-out tools today, and obsoleted against upstream tomorrow. Investing in - the narrow enrichment role is at least useful for as long as the gap exists. See - [If upstream solved it](#if-upstream-solved-it). - -## Conclusion - -The prior-art survey above is the strongest argument *against* the hub direction, not -for it. Fan-out for Kubernetes audit events is already a solved problem in any serious -enterprise environment. Companies that need it have Fluent Bit, Fluentd, Vector, the -OpenTelemetry Collector, gardener/auditlog-forwarder, or whichever log router their -observability or security team has already standardised on. They are not waiting for -another audit forwarder, and they will not adopt one when an existing component already -fits their pipeline. - -The unique thing `apiservice-audit-proxy` does today is close the aggregated-API audit -gap by capturing `requestObject` and `responseObject` for requests that pass through it. -That is genuinely differentiated work — none of the general fan-out tools do it. Keeping -the proxy narrowly focused on that one job preserves the differentiation, avoids the -maintenance cost of competing in a crowded category, and lets enterprises drop the -proxy into whatever audit pipeline they already run. - -The duplicate-`auditID` ordering problem is real but small, and it is gitops-reverser's -problem to solve internally. The side-channel proposal in the first half of this -document does exactly that, with a contained change scoped to one project. Enterprises -do not care about gitops-reverser's internal pipeline shape; they care that the tool -integrates with the audit forwarder they already trust. That is a much smaller surface -to defend. - -End-state recommendation: - -1. **Keep `apiservice-audit-proxy` doing its one unique thing.** Aggregated-API audit - enrichment via a synthetic webhook event. Do not grow it into a fan-out hub. -2. **Solve gitops-reverser's duplicate-`auditID` issue inside gitops-reverser**, via - the side-channel pattern in this document, after `CommitContext` v1 ships with the - local-stash + idempotency-marker approach. -3. **Direct enterprise users with multi-consumer audit needs at the existing fan-out - tools.** Place `apiservice-audit-proxy` *upstream* of those tools — every event the - proxy emits looks like a normal kube-apiserver audit event with bodies filled in, - and any compliant fan-out tool consumes it as-is. ConfigButler composes with - whatever audit forwarder the cluster already runs; it does not ask to replace it. -4. **Revisit only if** multi-consumer audit *plus* aggregated-API enrichment together - becomes a real gap that no existing fan-out tool covers. By then upstream Kubernetes - may have closed the audit gap and made the proxy itself redundant — which would moot - the question. - -This is a tighter scope than the hub direction promised, and that is the point. -Differentiation lives in the narrow capability that no one else covers; everything else -should compose with what enterprises already run. - -## References - -- Existing audit handler: - [internal/webhook/audit_handler.go](../../internal/webhook/audit_handler.go) -- Existing proxy send path: - [external-sources/apiservice-audit-proxy/pkg/proxy/handler.go](../../external-sources/apiservice-audit-proxy/pkg/proxy/handler.go) -- Audit-ID propagation through the serving hierarchy: - [Audit ID Chain (kubernetes/kubernetes#101597)](https://github.com/kubernetes/kubernetes/issues/101597) -- Native audit gap context: - [external-sources/apiservice-audit-proxy/README.md](../../external-sources/apiservice-audit-proxy/README.md) -- Related design that surfaces this trade-off: - `design-commit-context-api.md` diff --git a/docs/design/image-refresh-test-design.md b/docs/finished/image-refresh-test-design.md similarity index 100% rename from docs/design/image-refresh-test-design.md rename to docs/finished/image-refresh-test-design.md diff --git a/docs/finished/internal-audit-type-demand.md b/docs/finished/internal-audit-type-demand.md deleted file mode 100644 index 3836738f..00000000 --- a/docs/finished/internal-audit-type-demand.md +++ /dev/null @@ -1,250 +0,0 @@ -# Internal-consumer demand for audit types (and CommitRequest attribution) - -Status: IMPLEMENTED — 2026-06-20 - -Implementation note: Option B landed. CommitRequest attribution is now a small Redis-backed -keyed fact captured by the audit webhook from the accepted, body-merged create event before -demand-gating and before the ordered per-type stream write/divert. `LookupCommitRequestAuthor` -reads that fact instead of scanning `commitrequests:audit:stream`, and `commitrequests` has -been removed from `AlwaysAllow`. The normal demand-gated mirror path remains available: if a -GitTarget claims CommitRequests, their full events still flow through the per-type stream and -can be captured in git. The attribution record TTL is intentionally longer than the 60 s -attribution window so it also covers leader failover and post-failover reconcile backlog. - -## 1. Scope and the question - -Demand-gated ingestion only mirrors an audit type when **something demands it**. Today there are -two demand sources, and they are lopsided: - -- **GitTarget claims** → the materialization layer calls `gate.Require(gvr)` synchronously the moment - a type is **claimed** (`DeclareForGitTarget`), and `Unrequire` on the `Unclaimed` event (the sweep's - GC of the last claim) — capture-before-baseline, see - `first-event-loss-on-reclaim-plan.md`. This is dynamic, - Redis-backed, multi-pod, and releasable ([gate.go `Require`/`Unrequire`](../../internal/gate/gate.go), - [materialization.go](../../internal/watch/materialization.go)). -- **Internal consumers** → a **static `AlwaysAllow` list hardcoded in `cmd`** - ([cmd/main.go:279-281](../../cmd/main.go)) that force-allows `commitrequests`, because the - CommitRequest finalizer's author attribution scans that type's audit stream - ([commitrequest_author.go](../../internal/queue/commitrequest_author.go)) but **no GitTarget - claims it**. - -The user's question: *who is asking for `commitrequests`?* Right now the answer is "a literal in -`cmd`," which is a smell — the component that actually needs the type (the CommitRequest finalizer) -does **not** express that need; `cmd` does, on its behalf, in a place divorced from the consumer. -**The controller should ask for its own types.** This doc designs that, and — taking the late-lane -investigation with it — questions whether scanning the audit stream for attribution is the right -shape at all. - -## 2. Current mechanics (verified) - -- The gate keeps two sets: a read-only **`static`** set (from `AlwaysAllow`, unioned into every - `Allow` check, never released) and a dynamic **`members`** set (the Redis `__required__` set, - refreshed by the subscriber loop) — [gate.go:99-207](../../internal/gate/gate.go). -- `commitrequests` is **attribution-only**. It is never written to git, never materialized (no - checkpoint, no per-type tail). The only consumer is `LookupCommitRequestAuthor`, which - `XREVRANGE`-scans `…commitrequests:audit:stream` for the request's own `create` event to resolve - the author ([commitrequest_author.go:56-61](../../internal/queue/commitrequest_author.go)). -- The CommitRequest **finalize trigger is _not_ the audit stream** — it is the controller-runtime - watch on CommitRequest objects ([commitrequest_controller.go](../../internal/controller/commitrequest_controller.go)). - So the *only* reason `commitrequests` is ingested at all is attribution. -- The finalizer **gates on attribution and fails closed**: if the create event has not been observed - within `commitRequestAttributionTimeout`, it writes a terminal "attribution failed" status rather - than finalize on a guess ([commitrequest_controller.go:158-168](../../internal/controller/commitrequest_controller.go)). -- **Investigation tie-in (the risk is broader than divert).** Two failure modes for audit-scan - attribution are now evidenced: - 1. **Divert.** Since the late lane was removed - (`audit-diagnostic-streams-plan.md`), - `LookupCommitRequestAuthor` scans **only the main ordered stream**, so a `create` whose audit - event is *diverted* (RV below the high-water) is rejected from the main stream and never - attributable → fail closed. - 2. **An unexplained scan miss (worse).** In a real e2e run, a CommitRequest `create` that was - demonstrably **`queued` to the correct main stream and present for the whole 60s window** was - still missed by ~30 successive scans → fail closed. Ingestion lag, the 512 scan bound, the UID - guard, MaxLen trimming, and a restart were all ruled out; the root cause is still open. See - `e2e-flakes-2026-06-18-investigation.md §2`. - The upshot: **scanning the shared, ordered audit stream for attribution is fragile in ways we - cannot even fully diagnose** — which is the strongest possible argument for not doing it. - - **Update (2026-06-19): this bit CI.** Run `27830248680` on `5d85e7d` failed `E2E (full)` on - *"Commit Request — finalizes the open commit window on demand and reports the resulting SHA"* - (`commit_request_e2e_test.go:133`): the CommitRequest never reached `Committed` within 120 s while a - *sibling* CR committed fine. It is intermittent (the re-run passed). This is **Flake A** in - [`residual-e2e-flakes-2026-06-19.md`](../design/stream/residual-e2e-flakes-2026-06-19.md) — the leading hypothesis is - this very scan miss (~55%), with a wrong/older/later-commit *ordering* mismatch a tracked secondary - (~30%); a "last 5 commits" diagnostic (`153a0f2`) now prints on failure to tell them apart. It is a - live, CI-visible argument for Option B/§5.1. - -## 3. What an internal consumer actually needs - -Generalising from `commitrequests`, an internal consumer of the audit pipeline needs one of two -things — and they have very different demand shapes: - -1. **The full per-type stream** (to scan/replay it). This is what attribution does today. It - requires the type to be **ingested** (gate-allowed), and it inherits the stream's ordering - semantics — including the divert gap. It does **not** require materialization. -2. **A specific, derived fact about each event** (here: "who authored this create"). This needs the - event **seen at ingestion**, not the whole stream mirrored, and it can be captured in a shape - that is immune to ordering. - -Today we serve (2) by doing (1) — mirror the whole `commitrequests` type just so one scan can pull -one field. That over-demands (a whole always-on per-type stream) **and** under-delivers (divert -gap). Both options below fix the "who asks" question; they differ on which of (1)/(2) we build. - -## 4. Option A — first-class self-demand (keep audit-scan attribution) - -Make the internal demand **expressed by the consumer**, not hardcoded in `cmd`. The gate's `static` -set is already the right home (always-allowed, never-released, identical on every pod); only its -*population* moves. - -- Each internal consumer declares the audit GVRs it needs — e.g. a package-level - `commitrequest.RequiredAuditTypes() []schema.GroupVersionResource`, owned by the CommitRequest - controller package. `cmd` aggregates every consumer's declaration into `gate.Config.AlwaysAllow` - (or a renamed `InternalDemand`) instead of a literal list. The demand now lives **with** the - consumer; `cmd` only wires. -- Optionally surface it: log/metric the internal-demand set at startup so "why is `commitrequests` - ingested?" is answerable from the running system, not from reading `cmd`. - -**What this fixes:** the "who asks" smell — the consumer owns its demand, new internal consumers add -a line in their own package, and the set is auditable. **What it does not fix:** the divert -fail-closed gap (§2) — a reordered create is still unattributable, because attribution still depends -on the create landing in the ordered main stream. Cheap (a few lines), but it is a *relocation* of -the current design, not a robustness improvement. - -## 5. Option B — a dedicated author-attribution store (remove the demand and the anti-pattern) - -Stop scanning the audit stream for attribution. Capture the fact we need **at ingestion**, in a -purpose-built store, and let the finalizer read that. - -- When the webhook handler accepts a `commitrequests` **create** event, write a small bounded record - keyed by `{namespace, name, uid}` → `{author, auditID, timestamp, rv}` (a Redis hash/stream with - `MAXLEN`/TTL). This is the same `resolveUserInfo` author the scan resolves today, recorded once. -- `LookupCommitRequestAuthor` reads that store by key instead of scanning a per-type stream. -- **`commitrequests` no longer needs to be ingested/mirrored at all** — the attribution store - replaces the only reason. `AlwaysAllow` for `commitrequests` goes away; the demand question - *dissolves* rather than being relocated. - -**Why this is the principled fix (and the natural completion of the late-lane work):** - -- **It is divert-immune.** The store is written when the event *arrives* at the handler, before any - RV-ordering/divert decision. A reordered create still records its author → no fail-closed gap. -- **It removes the "audit stream as a correctness input" anti-pattern.** The same anti-pattern that - justified deleting the late lane (a "diagnostic" surface had quietly become correctness) applies - here: the per-type *audit log* is a reconcile/replay substrate, and attribution had piggy-backed - on it. A dedicated store makes attribution an explicit, owned, functional surface — *"events for - attribution, state for correctness"* applied honestly. -- **A failed attribution write is a real, visible functional failure** (not silent), exactly as we - want for a fail-closed path — and it can be retried/alerted on its own. - -**Costs:** a new ingestion-side hook (recognise CommitRequest creates, write the record), a store -with a retention/cleanup story (TTL keyed to the attribution window + a bound), and the finalizer -read path swap. More code than Option A, but it deletes the `AlwaysAllow` special-case and the -divert gap in one move. - -### 5.1 "Store all `commitrequests` upfront" — the always-on variant (recommended shape of B) - -The natural question — *should we just store everything for `commitrequests` from the start?* — is -exactly Option B made **always-on and demand-free**, and it is the right shape: - -- **Write the record at ingestion, before the ordering/divert decision _and_ before the - `canonicalMu` serialization** (i.e. early in the webhook handler, alongside the raw decode), so it - is immune to *both* evidenced failure modes (divert **and** the unexplained scan miss) — there is - no scan and no dependency on the event landing in the ordered stream. This also avoids re-creating - the throughput cost of an in-lock second write - (`e2e-flakes-2026-06-18-investigation.md §6`). -- **Store the attribution _fact_, not the full event.** We only need - `{ns,name,uid}→{author,auditID,ts}` (a tiny keyed record), not a mirror of every CommitRequest - body. "Full store of all events" would re-introduce the per-type stream we are trying to delete; - the keyed fact is bounded and cheap (TTL ≥ the 60 s attribution window). -- **Always-on, not demand-gated.** Because it is the controller's own hard requirement and trivially - cheap, it needs no gate entry — `commitrequests` drops out of `AlwaysAllow` entirely and is no - longer mirrored at all. (If we ever *also* want the full event stream for another reason, that is a - separate, demand-gated decision — but attribution should not be the thing that demands it.) - -So: **yes, capture `commitrequests` author attribution upfront — but as a small keyed fact written -early at ingestion, not as a full always-on mirror.** That is divert-immune, scan-miss-immune, -load-cheap, and dissolves the demand question. - -## 6. Recommendation - -**Adopt Option B; treat Option A as an optional stepping-stone only if B can't land immediately.** -B is the design the late-lane investigation points to: it answers "who asks for this type?" by -making the answer *"no one needs the type mirrored — the consumer captures its own fact at -ingestion,"* and it closes the divert fail-closed gap that A leaves open. A is a clean relocation of -the demand but preserves the fragile audit-scan attribution, so it is worth doing **only** as a -quick correctness/clarity win while B is built (and it is then deleted by B). - -If we keep audit-scan attribution for any reason, Option A is mandatory (the `cmd` hardcode should -not stay) — but we should still document the divert fail-closed as an accepted, monitored edge. - -## 7. The divert/ordering angle (why this matters beyond cleanliness) - -The whole audit-outcome taxonomy now classifies a diverted event as `older_than_high_water` (dropped, -checkpoint-recovered) — fine for **git materialization**, because the checkpoint re-reads object -*state*. But attribution is **authorship**, which lives *only* in the audit event, not in object -state — the checkpoint cannot recover it. So an internal consumer that needs authorship cannot rely -on the ordered log surviving a divert. Option B is the only one that makes such a consumer correct: -capture the authorship at ingestion, before ordering can drop it. This is the general principle for -*any* future internal consumer that needs a per-event fact (not just attribution): **derive and -store the fact at ingestion; do not demand the ordered stream and scan it.** - -## 8. Migration / slices - -1. **B-1 — attribution store at ingestion (implemented).** Add the store + the webhook hook that - writes a `{ns,name,uid}→{author,auditID,ts}` record on a `commitrequests` create. Write it **early - in the handler — after body joining, before the demand gate and the ordering/divert decision** — - so it is divert-immune and scan-miss-immune. Unit-test the write + the divert case (a create that - would have been diverted still records its author). -2. **B-2 — finalizer reads the store (implemented).** Swap `LookupCommitRequestAuthor` to read the store by key; - keep the fail-closed-on-timeout semantics (now only triggered by a genuinely-absent record, not a - divert). e2e: the existing CommitRequest finalize spec stays green; add a divert-injection unit - test that proves attribution survives reorder. -3. **B-3 — drop the demand (implemented).** Remove `commitrequests` from `AlwaysAllow`; confirm the type is no - longer mirrored **for attribution's sake** — it is still mirrored on demand whenever a GitTarget - claims it (it is a normal trackable resource; the attribution tap is *additive*, not a bypass of - the normal ingestion train — see - [commitrequest-attribution-divert-reliability.md §3.2](commitrequest-attribution-divert-reliability.md)) — - and confirm attribution still works. Delete `commitrequest_author.go`'s stream scan. -4. *(Only if B slips)* **A-0 — self-demand interim:** move the `AlwaysAllow` population from the - `cmd` literal to a `commitrequest`-package declaration that `cmd` aggregates; log the - internal-demand set at startup. - -### 8.1 HA considerations - -Option B is the HA-friendly shape because it follows the existing HA design's -capture-decoupled-from-consume seam -(`ha-improvements.md §1`): audit intake runs on whichever -ready pod receives the Service traffic, writes the attribution fact to shared Redis, and the -leader-only CommitRequest finalizer reads that fact later. A new leader after failover needs no -handoff; it reads the same Redis keyspace. - -The implementation carries four HA constraints: - -- **TTL covers failover, not just attribution.** Retention must outlive the 60 s attribution window - plus leader-failover detection and any post-failover reconcile backlog. The current TTL is 10 - minutes for that reason. -- **Duplicate delivery is an idempotent upsert.** Multiple apiservers or webhook retries can deliver - the same create more than once, possibly to different pods. The store is keyed by - `{namespace,name,uid}` and rewritten with the same deterministic author, so at-least-once delivery - converges. -- **No single-writer ownership is needed.** Attribution is a keyed fact, not a checkpoint LIST or - trim cursor. It does not need the single-writer machinery deferred in - `ha-improvements.md §5`. -- **Redis HA can cause transient read misses.** If a future Redis topology reads from a lagging - replica immediately after a write, the existing retry-to-deadline loop absorbs it. If that ever - becomes visible, pin attribution reads to the primary; do not reintroduce stream scanning. - -This is orthogonal to HA Improvement A (claim leases as Redis ZSET+TTL). Attribution is not -demand-gated after Option B, so the claim-lease migration neither blocks nor is blocked by this -store. - -## 9. Non-goals / open questions - -- **Not** changing the finalize *trigger* (the controller-runtime watch on CommitRequest objects is - correct and untouched). -- **Not** re-introducing any late lane or treating the audit stream as a correctness input. -- **Open:** store shape and retention — a per-key hash with a TTL ≥ the attribution window, vs a - bounded stream scanned by key. The window is short (a CommitRequest attributes within - `commitRequestAttributionTimeout`), so a modest TTL bounds it. -- **Open:** whether other internal consumers exist or are foreseen. If attribution is the only one, - B is narrowly scoped; if more are coming, the "derive-and-store at ingestion" principle (§7) - should be stated as the house pattern and the generic self-demand registry (§4) may still be worth - it for the genuinely "needs the whole stream" cases. diff --git a/docs/finished/manifest-parser-poc.md b/docs/finished/manifest-parser-poc.md deleted file mode 100644 index 72d14014..00000000 --- a/docs/finished/manifest-parser-poc.md +++ /dev/null @@ -1,322 +0,0 @@ -# POC: in-document YAML editor choice - -> Status: implemented — see `internal/git/manifestedit` and its -> [DECISION.md](../../internal/git/manifestedit/DECISION.md). -> Outcome: `gopkg.in/yaml.v3` node editing + per-document text splitting passes -> the implemented hard requirements; goccy/kyaml/text-slice were not needed. One -> drift limitation is recorded (yaml.v3 normalizes flush-left sequence -> indentation in the *edited* document), and the larger vision items -> (Helm/Kustomize detection, GVK→GVR mapping, watched-GVR filtering, placement -> policy) are explicitly left to writer integration, not this parser POC. -> Related: [manifest-inventory-file-agnostic-placement.md](../design/manifest/manifest-inventory-file-agnostic-placement.md) - -## Goal - -The manifest-inventory vision document already decides the editing architecture. -This POC has one narrow job: prove whether `yaml.v3` can edit a **single YAML -document** with enough formatting fidelity to honor the preservation -requirements, and if not, pick the fallback. - -The decision is driven by tests, not preference. - -## What is already decided (not part of this POC) - -These come from the vision document and are not re-litigated here: - -- **Document isolation is textual.** A file is split into its documents on - document boundaries, and only the changed document is re-rendered; unrelated - documents are spliced back verbatim. A whole-file `yaml.v3` round-trip is - rejected, because re-encoding the whole file normalizes indentation, quoting, - and spacing across every document and so cannot keep unrelated documents - byte-for-byte identical. -- **Editing is a structural merge.** The desired (sanitized) object is merged - onto the existing document's node tree, touching only changed nodes. There is - no separate "diff then map field paths back to nodes" pass. -- **`kyaml` is not a separate candidate.** `sigs.k8s.io/kustomize/kyaml` is built - on `yaml.v3` and inherits its formatting and comment fidelity, so it cannot - fix a `yaml.v3` preservation gap — it only adds KRM ergonomics. It is dropped - from the parser comparison. -- **Encrypted files are out of POC scope.** SOPS files are single-document, - never decrypted, and re-encrypted through the existing encryptor on write - (see the vision document). The only inventory behavior the POC needs to honor - is reading identity from a partially-encrypted file and skipping a file whose - identity is encrypted. - -## The one open question - -Within a single changed document, is `yaml.v3` node fidelity good enough? - -The fallback order if it is not: - -1. `yaml.v3` — primary; already the closest to today's code. -2. `goccy/go-yaml` (`github.com/goccy/go-yaml`) — fallback if `yaml.v3` loses - formatting; it exposes token/CST-level detail and generally has stronger - comment and position fidelity. -3. Per-scalar text-slice within the changed document — last resort, only if - neither parser can preserve directly changed-adjacent scalars. - -| Option | Shape | Strength | Risk | -|---|---|---|---| -| `yaml.v3` node merge | Parse the one document into `yaml.Node`, merge the desired object onto it, encode back | Comments, node kinds, scalar styles, line/column metadata; smallest step from today | Known round-trip drift on block scalars, indentation, and comments | -| `goccy/go-yaml` | Same merge, richer token/CST access | Better comment and position fidelity | New dependency and behavior to learn | -| Per-scalar text-slice | Keep the document as text, replace only the spans of directly changed scalars | Best chance at exact preservation | Byte ranges and YAML edge cases are hard | - -## POC boundaries - -Build a small isolated prototype, not production integration. It must be easy to -delete or rewrite after the decision. - -Suggested package: - -```text -internal/git/manifestedit -``` - -A deliberately small API: - -```go -type Location struct { - Path string - DocumentIndex int -} - -type EditResult struct { - Content []byte - Mode EditMode -} - -func IndexFile(path string, content []byte) (Inventory, []Diagnostic) -func PatchDocument(content []byte, documentIndex int, desired *unstructured.Unstructured) (EditResult, []Diagnostic) -``` - -The exact API is less important than the tests. - -## Experiment order - -This order front-loads the cheapest decisive experiment. - -1. **No-op round-trip baseline.** Parse → encode each document in a real manifest - corpus with no change, and measure how much `yaml.v3` drifts before any - editing. If unrelated nodes already drift here, that bounds everything else. -2. Document splitting and inventory detection. -3. Semantic no-op detection using the existing sanitizer path. -4. Whole-document replacement for one document in a multi-document file. -5. Structural merge for simple maps and scalars. -6. Run the ConfigMap script-block tests. -7. Run comment and quote preservation tests. -8. Decide whether `yaml.v3` is sufficient. -9. Only if it is not, repeat the relevant tests against `goccy/go-yaml`, then a - per-scalar text-slice approach. - -## Required test cases - -Hard requirements are marked. The rest are strong preferences whose limitations -must be documented if unmet. - -### 1. No-op round-trip drift (hard, gating) - -Parse and re-encode a corpus of real manifests with no edits. Record exactly -where the encoder changes bytes (block scalar re-wrapping, indentation, quoting, -comment placement). This is the baseline the merge editor inherits. - -### 2. Multi-document inventory - -A file with a ConfigMap, an empty document, and a Deployment should index the -ConfigMap as document 0, ignore or diagnose the empty document without failing -the file, index the Deployment as document 2, and preserve document indexes. - -### 3. Non-KRM YAML - -Ordinary YAML without `apiVersion`, `kind`, and `metadata.name` should be -ignored or get a non-fatal diagnostic, and must not block editing valid -manifests in the same folder. - -### 4. Duplicate identity - -The same object in two files, or twice in one file, should be detected as a -duplicate set with a diagnostic. Resolution follows the vision document: the -first occurrence by a stable scan order wins, and the extra copies are deleted. -The investigation still matters here — the POC must detect the duplicate set -reliably and pick the deterministic winner — so the result is one authoritative -copy kept and the other removed. - -### 5. Semantic no-op vs cleaning (hard) - -Two opposite directions that must not be confused. The API is the truth and Git -holds only clean, GitOps-compatible manifests; the sanitizer defines that clean -projection. - -**True no-op — preserve bytes.** Operational fields the sanitizer strips -(`resourceVersion`, `managedFields`, `status`, and similar) are removed from the -*desired* side, so they are never written. A Git manifest that is already clean -and otherwise matches is therefore equal: return "no change" and preserve the -original bytes exactly. - -```yaml -# already in Git (clean); API returns the same object plus -# metadata.resourceVersion and managedFields -> no write -apiVersion: v1 -kind: ConfigMap -metadata: - name: app-config - namespace: default -data: - color: blue -``` - -**Cleaning — not a no-op.** If the *Git* document itself carries operational -noise such as `resourceVersion`, that field is absent from the clean desired -projection, so Git differs and must be rewritten to remove it. This is field -deletion (see test 12), not a preserved no-op. - -```yaml -# in Git (dirty) -> resourceVersion must be deleted, rest preserved -apiVersion: v1 -kind: ConfigMap -metadata: - name: app-config - namespace: default - resourceVersion: "12345" -data: - color: blue -``` - -The asymmetry is the point: sanitizer fields are stripped from the desired object -so they are never written, and if Git already carries them they are cleaned out. - -### 6. Document-scoped update (hard) - -In a multi-document file where only the second document changes, documents 0 and -2 remain byte-for-byte identical, only document 1 changes, and the separators -stay valid. - -### 7. Comment preservation - -```yaml -# app config -apiVersion: v1 -kind: ConfigMap -metadata: - name: app-config # stable name - namespace: default - labels: - app: demo # selector label -``` - -Adding or changing one label should preserve comments not attached to the -changed node. Comments on the changed node should be preserved if the parser can -do so cleanly; otherwise the behavior must be documented. - -### 8. ConfigMap script block survives unrelated edits (hard) - -```yaml -apiVersion: v1 -kind: ConfigMap -metadata: - name: startup-scripts - namespace: default -data: - start.sh: |- - #!/bin/sh - set -eu - - echo "starting app" - exec /app/server -``` - -When the desired object only adds `metadata.labels.app: demo`, `data.start.sh` -must remain byte-for-byte identical. The literal block style and chomping -indicator must not change. - -### 9. ConfigMap script block changes intentionally - -When `data.start.sh` itself changes, the editor should keep literal block style -if possible — a changed script should still render as a readable block scalar, -not an escaped one-line string. Strong preference; record the limitation if -exact chomping preservation is not possible. - -### 10. Quoted and string-like values - -```yaml -data: - build: "00123" - enabled: "false" -``` - -Unrelated edits should preserve quoting; direct edits must not convert these into -numeric or boolean YAML values. - -### 11. List item update - -Updating one container image in a multi-container Deployment should change only -that image field when the list item can be identified safely. Index-based -patching is fine for the POC; field-keyed matching is a later nicety. - -### 12. Field deletion - -A field present in Git but absent from the sanitized desired object should be -removed without rewriting unrelated fields, including deleting one label from a -map that has comments and sibling labels. - -### 13. Disallowed constructs are ignored, not materialized (hard) - -A document using anchors, aliases, or merge keys (`&`, `*`, `<<`) — including a -deliberately crafted alias-expansion bomb — must be ignored as non-editable with -a diagnostic, and must not be fully materialized (no memory/CPU blowup). Files -with duplicate keys or unusual tags fall in the same bucket: diagnose and skip, -never silently rewrite. Symlinked files under the scan root are skipped. - -### 14. Line-ending and boundary fidelity (hard) - -CRLF line endings, a UTF-8 BOM, presence or absence of a trailing newline, a -leading `---`, and a trailing `...` must survive an unrelated edit. These are -where "byte-for-byte" quietly fails. - -### 15. Partially-encrypted manifest indexing - -A SOPS file with cleartext identity and encrypted `data` is indexed by its -identity. A file whose identity fields are encrypted is skipped with a -diagnostic. The POC does not decrypt or edit encrypted content. - -## Decision criteria - -The editor is acceptable only if it satisfies the hard requirements: - -- parse multi-document YAML and preserve document indexes -- identify KRM resources from YAML content -- detect duplicates -- avoid writes for semantic no-ops -- update only the matching document, keeping unrelated documents byte-for-byte -- keep an unrelated ConfigMap script block byte-for-byte -- ignore disallow-listed constructs without materializing them -- preserve line-ending and document-boundary bytes on unrelated edits -- index partially-encrypted manifests by cleartext identity and skip - identity-encrypted files -- emit diagnostics when preservation is unsafe - -Nice-to-have: - -- preserve comments around changed nodes -- preserve scalar style for directly changed strings -- field-level deletion without whole-document replacement -- safe list-item updates -- output stable enough to keep Git history clean - -If `yaml.v3` passes the hard requirements, use it. If it fails mainly on -ergonomics but preserves formatting, wrap it with local helpers. If it fails on -preservation, evaluate `goccy/go-yaml`. If both fail on exact document/scalar -preservation, use a per-scalar text-slice approach within the changed document. - -## Expected outcome - -A short decision record: - -- chosen in-document editor (`yaml.v3`, `goccy/go-yaml`, or text-slice) -- tests passed and failed -- preservation guarantees GitOps Reverser can honestly promise -- cases that produce diagnostics or whole-document replacement -- implementation impact for the manifest inventory feature - -The default expectation is an AST-based editor with canonical Kubernetes -serialization retained for semantic comparison. The open question is how much -exact source preservation that AST delivers on its own within a single document. diff --git a/docs/finished/manifestedit-new-file-placement-spike.md b/docs/finished/manifestedit-new-file-placement-spike.md deleted file mode 100644 index 482a647a..00000000 --- a/docs/finished/manifestedit-new-file-placement-spike.md +++ /dev/null @@ -1,182 +0,0 @@ -# New-file placement: where does a brand-new resource's file go? - -> Status: decided (first version) — supersedes the original open brainstorm seed -> Related: [file-agnostic-placement.md](../design/manifest/file-agnostic-placement.md), -> [manifest-inventory-file-agnostic-placement.md](../design/manifest/manifest-inventory-file-agnostic-placement.md), -> [manifestedit-integration-readonly-reconcile.md](../design/manifest/manifestedit-integration-readonly-reconcile.md), -> [manifestedit-field-ownership-spike.md](manifestedit-field-ownership-spike.md), -> [manifestedit-abstraction-plan.md](../design/manifest/manifestedit-abstraction-plan.md), -> [architecture.md](../architecture.md) - -## The one question - -When the reverser must write a resource that has **no existing document in Git**, -*where does the file go?* The manifestedit comparison is explicit that this is -out of its scope: the two-version comparison requires an existing `Git` document, -and the read-only report already classifies this cell as `ActionCreate` with the -reason *"no existing document in Git; placement is an upstream decision"* -([internal/manifestreport/report.go](../../internal/manifestreport/report.go)). -Placement is precisely that upstream decision, and it is currently unowned as a -configurable policy. - -## What is already true (don't re-litigate) - -- **Today's placement is deterministic and implicit.** New files are written to - `{spec.path}/{group}/{version}/{resource}/{namespace}/{name}.yaml` - (`.sops.yaml` for encrypted Secrets), via `generateFilePath` / - `ResourceIdentifier.ToGitPath()` - ([internal/git/git.go](../../internal/git/git.go), - [internal/types/identifier.go](../../internal/types/identifier.go)). Repo state - was historically discovered by parsing that path back into an identity. -- **Identity is content, not path.** The inventory - ([internal/git/manifestedit](../../internal/git/manifestedit)) keys resources by - GVK + namespace + name read from the YAML, so a resource can be *found* at any - path, not only the deterministic one. -- **In-place editing already landed (narrowly).** When a document already exists - for a resource, the writer edits it in place preserving formatting - ([git.go](../../internal/git/git.go) `preserveExistingFormatting` → - `manifestreport.EditInPlace`). Placement is the missing other half: it only - matters when the resource is *absent* from Git. -- **The policy north star is API-first, whole-object truth** - ([manifestedit-field-ownership-spike.md](manifestedit-field-ownership-spike.md)). - Whatever placement does, the API stays the source of truth. - -## The reframe that drives every decision - -The thing that makes today's behavior feel rigid is that the path is a *pure -function of identity, recomputed on every write* (`ToGitPath`). The file-agnostic -vision flips that: identity is content, and **location is data the inventory -owns**. - -So placement is not "a better path formula." It is a **resolver that runs once, -when a resource is brand-new, and whose result is then recorded in the inventory** -like any other location. Recomputing a path on every write is what couples the -layout to the storage contract; resolving once and recording removes that -coupling — and quietly defuses most of the original open axes (renames, append) -before they have to be designed. - -## Decisions (first version) - -### 1. Match-first is an invariant, not a setting - -The write path always asks the inventory "do we already have a location for this -identity anywhere under the GitTarget path?" first, and only invokes placement -when the answer is no. This is not a user knob — it is simply correct, and it is -the bridge from "edit at the deterministic path" to true file-agnostic placement. - -Cost: the inventory is built from the already-checked-out commit and cached for -the lifetime of the Git transaction (never a per-write re-scan). The -rebuild-on-change gate in -[manifest-inventory-file-agnostic-placement.md](../design/manifest/manifest-inventory-file-agnostic-placement.md) -already governs when it is rebuilt. - -### 2. Placement is create-time and non-retroactive - -Once a file is placed, its location lives in the inventory. Changing the -placement policy later affects **only resources created after the change** — it -does **not** move existing files. This is load-bearing: - -- No rename/move machinery in this version. -- No new prune-hazard surface: the writer never relocates a file, so it never - produces a "delete the old path + write the new path" pair. -- A future explicit "reorganize / migrate layout" action can come later as its - own opt-in operation, separate from placement. - -### 3. A `Placement` seam returning a `ManifestLocation` - -Placement is *policy* and lives in the integration/writer layer -(`manifestreport` / the writer), never in the `manifestedit` mechanism — the same -mechanism-vs-policy line drawn elsewhere. Shape it so the type can express -everything we will ever want, even though the first version only uses part of it: - -```go -type ManifestLocation struct { - Path string // relative to the GitTarget path - DocumentIndex int // -1 == new file - Mode PlacementMode // CreateFile | AppendToFile -} - -type Placement interface { - Locate(id types.ResourceIdentifier, spec GitTargetSpec) (ManifestLocation, error) -} -``` - -The first version always returns `{path, -1, CreateFile}` (a discrete, -one-resource file). Because the *type* can already say "append to this file at -this document index," multi-document append becomes a new `Placement` -implementation later with **zero reshaping** of the seam. - -### 4. `spec.placement.layout` is a closed enum, default `apiStructure` - -The user-facing surface is a small closed enum, not a free-text template. Every -layout must encode the **full identity** (group/version/resource + namespace + -name) somewhere in its path, just arranged into a different folder shape. That -makes each layout a **bijection with identity**: two distinct resources can never -resolve to the same path, so the enum needs **no uniqueness/collision validation -at all**. "Is this layout bijective with identity?" is the admission test for any -future layout. - -```text -spec.placement.layout: - apiStructure # DEFAULT — {group}/{version}/{resource}/{namespace}/{name}.yaml - # byte-identical to ToGitPath today → an absent spec.placement - # field reproduces current behavior exactly (zero migration). - namespaceFolder # {namespace}/{group}/{version}/{resource}/{name}.yaml - # namespace on top: a namespace's resources live under one - # folder, which is what makes dropping a kustomization.yaml in - # it (and hooking it into Flux/Argo per namespace) natural. -``` - -Ship exactly these two. `flat` (single folder, identity encoded into the -filename) and a kind-first variant are each a few lines to add later on the same -seam and are intentionally *not* shipped speculatively — they are listed as -future-trivial, not as v1 knobs. Per-target setting for now; a provider-level -default with per-target override is a later refinement if it is ever asked for. - -### 5. The SOPS extension decision lives inside the placer - -The `.sops.yaml` extension for sensitive resources is decided **inside** -`Locate`, not bolted on around it. This guarantees no current or future layout -can route a Secret (or other sensitive resource) to a cleartext path — the -sensitive-path rule is structurally inside the one place that computes the -destination. - -## Deferred (and absorbed by the seam, so no future reshaping) - -- **Multi-document append** — a future `Placement` implementation; the - `ManifestLocation` type already expresses it. -- **Renames / reorg / layout migration** — a future explicit opt-in action; - decision 2 keeps existing files put in the meantime. -- **Namespace elision** (`writeNamespace`) — already deferred in the vision doc; - orthogonal to placement. -- **Path templates** — deliberately not in the closed enum; would reintroduce - collision/path-safety validation that the bijection rule avoids. Can be added - later as one more `Placement` implementation if a concrete need appears. - -## Hard constraints any answer must respect - -- **The Git transaction boundary.** Placement decisions are valid only for the - checked-out commit: fetch → index → compare → place/edit → commit → - push-with-lease → replay-on-race - ([manifestedit-integration-readonly-reconcile.md](../design/manifest/manifestedit-integration-readonly-reconcile.md)). -- **The prune hazard stays deferred.** Moving/placing files must not turn a - partial cluster view into spurious deletions; deletes are still report-only. - Decision 2 (non-retroactive placement) adds no new prune surface. -- **Encryption.** Secrets must land at `.sops.yaml` paths and never be written in - cleartext — enforced by decision 5. -- **Convergence.** A placed file, re-read next reconcile, must be a byte-stable - no-op (the property `assertConverges` guards inside manifestedit). -- **Mechanism vs policy.** Placement is *policy* and belongs in the integration - layer (`manifestreport` / the writer / a GitTarget setting), never baked into - the `manifestedit` mechanism (decision 3). - -## Suggested implementation order - -1. Introduce the `Placement` seam + `ManifestLocation` with a single - `apiStructure` implementation that reproduces `ToGitPath` exactly, and wire the - writer to call it (behind match-first) instead of `generateFilePath`. Pure - refactor — output is byte-identical, existing e2e assertions unaffected. -2. Add `spec.placement.layout` to `GitTargetSpec` defaulting to `apiStructure`; - confirm an absent field is still byte-identical. -3. Add the `namespaceFolder` implementation + tests (including a placed-then- - re-read convergence assertion and a SOPS-extension test). diff --git a/docs/finished/materialization-tail-and-live-readiness-review.md b/docs/finished/materialization-tail-and-live-readiness-review.md index 4d5d7a79..ec62471d 100644 --- a/docs/finished/materialization-tail-and-live-readiness-review.md +++ b/docs/finished/materialization-tail-and-live-readiness-review.md @@ -17,7 +17,7 @@ how to (a) restore periodic checkpoint healing without stealing commit windows, It is the companion to: -- [api-source-of-truth-reconcile.md](./api-source-of-truth-reconcile.md) — the R-stage +- [api-source-of-truth-reconcile.md](../architecture.md) — the R-stage splice/tail architecture. - `demand-driven-type-materialization-lifecycle.md` — the demand axis (claims, phases) this builds on. @@ -412,7 +412,7 @@ latent re-anchor flap, move into the controller and are fixed there). Because `R counts as serviceable, a periodic re-anchor does **not** flap the phase. Also **delete the vestigial `status.snapshot`** while here. The full two-axis status contract (conditions, phase derivation, reasons, tests) is written up in -[../status-design-git-target.md](../design/status-design-git-target.md). +[../status-design-git-target.md](../spec/status-conditions-guide.md). ### Rec 5 — Tests to add diff --git a/docs/finished/partial-object-audit-event-handling.md b/docs/finished/partial-object-audit-event-handling.md deleted file mode 100644 index 2f3bb880..00000000 --- a/docs/finished/partial-object-audit-event-handling.md +++ /dev/null @@ -1,366 +0,0 @@ -# Partial-object audit events: classify the finalizer-patch fragment as a benign drop - -> Status: implemented. The end-to-end miniredis metric test below was -> intentionally skipped — the `handleExtractObjectError` unit test already -> covers the `dropped_partial_object` outcome mapping. -> Date: 2026-05-22 -> Observed on: **CozyStack** prod (`gitops-reverser-v0.26.0`), deleting `mongodb-simon2`. -> Related: [Shallow audit events](./shallow-audit-event-misclassification.md), -> [Audit Ingestion Pipeline](../architecture.md#audit-ingestion-pipeline). - -## Summary - -The audit consumer logs an `error`-level "poison-pill" line for an audit event -whose object body is a **finalizer-removal patch fragment** rather than a full -Kubernetes object: - -``` -{"level":"error","logger":"audit-consumer.audit-consumer", - "msg":"Failed to route audit event; ACKing to avoid poison-pill", - "msgID":"1779479358795-0", - "error":"extracting object for tenant-root/mongodb-simon2: failed to unmarshal - object JSON: Object 'Kind' is missing in '{\"metadata\":{\"finalizers\":null}}'"} -``` - -The body is `{"metadata":{"finalizers":null}}` — the merge-patch a controller -sends to drop the last finalizer while a resource is being deleted. It is valid -JSON but carries no `apiVersion`/`kind`, so -[`(*Unstructured).UnmarshalJSON`](https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured#Unstructured.UnmarshalJSON) -rejects it with `Object 'Kind' is missing`. - -The **outcome is already correct** — the event is ACK'd and dropped, no -poison-pill loop, no crash, and the resource's real `[DELETE]` commit lands -through its own delete audit event (in the captured run, the -`[DELETE] helm.toolkit.fluxcd.io/v2/helmreleases/mongodb-simon2` commit at -`19:49:02`, ~16s before this line). The **classification is wrong**: a routine, -expected event shape is funnelled through the generic error path instead of the -benign-drop path that `errAuditEventObjectMissing` and `errAuditEventObjectIsStatus` -already have. The cost is alert-grade log noise and no way to measure how often -it happens. - -This design adds a third recognised body shape — **partial object** — alongside -"missing body" and "Status error body", with its own benign-drop path, log -gating, and metric outcome. - -## Root cause - -[`extractObject`](../../internal/queue/redis_audit_consumer.go#L708) selects a -raw body and unmarshals it: - -```go -obj := &unstructured.Unstructured{} -if err := obj.UnmarshalJSON(raw); err != nil { - return nil, fmt.Errorf("failed to unmarshal object JSON: %w", err) // <-- generic -} -``` - -`(*Unstructured).UnmarshalJSON` requires a non-empty `kind`. A merge-patch body -has none, so the call fails. The returned error is a plain wrapped error — it -matches neither `errAuditEventObjectMissing` nor `errAuditEventObjectIsStatus`, -so [`handleExtractObjectError`](../../internal/queue/redis_audit_consumer.go#L459) -falls through its `switch` to `return false`, and -[`routeAuditEvent`](../../internal/queue/redis_audit_consumer.go#L408-L417) -surfaces it. [`processMessage`](../../internal/queue/redis_audit_consumer.go#L365) -then logs it at `error`. - -### Why the body is a fragment, not the full object - -[`selectAuditObjectRaw`](../../internal/queue/redis_audit_consumer.go#L754) -prefers `responseObject` for non-delete verbs and only falls back to -`requestObject`. For a `PATCH`, `requestObject` *is* the patch document — a -fragment by definition. The full merged object normally arrives as -`responseObject`, but when the patch removes the **last finalizer** of an object -that already has a `deletionTimestamp`, the object is deleted as part of that -same request and the apiserver records no resource `responseObject`. The -fallback then picks the only body present — the patch fragment. - -So this is **not** a malformed-event anomaly. It is the normal audit shape of -the finalizer-removal step of any finalizer-driven deletion, and CozyStack's -operator-managed resources (`mongodbs` → `helmreleases`) hit it on every delete. - -### How it differs from the shapes we already handle - -| Body shape | Example | Sentinel | Recognised today | -| --- | --- | --- | --- | -| No body at all | `requestObject`/`responseObject` both empty | `errAuditEventObjectMissing` | yes | -| `metav1.Status` error body | `{"apiVersion":"v1","kind":"Status",...}` | `errAuditEventObjectIsStatus` | yes | -| **Partial object** | `{"metadata":{"finalizers":null}}` | **`errAuditEventObjectPartial`** (new) | **no — falls to error path** | - -A partial object is **valid JSON with no `kind`**. That is precisely the -condition under which `UnmarshalJSON` fails while the bytes are still -well-formed — which makes it cheap and unambiguous to detect. - -## Design - -### 1. New sentinel error - -In [redis_audit_consumer.go](../../internal/queue/redis_audit_consumer.go), next -to the existing sentinels: - -```go -// errAuditEventObjectPartial marks an audit event whose body is valid JSON but -// lacks the apiVersion/kind identity of a full Kubernetes object — typically a -// merge-patch fragment such as {"metadata":{"finalizers":null}} recorded as the -// requestObject of a finalizer-removal PATCH. It carries no routable resource -// state, so it is dropped before git routing rather than treated as a decode -// failure. The resource's real mutation is mirrored from its own (delete or -// full-body) audit event. -var errAuditEventObjectPartial = errors.New( - "audit event object body is a partial object (no kind)") -``` - -### 2. Detect it in `extractObject` - -Distinguish "valid JSON, no kind" (partial) from "not JSON at all" (a genuine -decode failure worth an error) when `UnmarshalJSON` fails: - -```go -obj := &unstructured.Unstructured{} -if err := obj.UnmarshalJSON(raw); err != nil { - if isPartialObjectBody(raw) { - return nil, errAuditEventObjectPartial - } - return nil, fmt.Errorf("failed to unmarshal object JSON: %w", err) -} - -// isPartialObjectBody reports whether raw is well-formed JSON describing an -// object that lacks a "kind" — the condition that makes -// (*Unstructured).UnmarshalJSON fail on an otherwise valid body. A merge-patch -// fragment (e.g. {"metadata":{"finalizers":null}}) matches; malformed bytes do -// not, so a real decode failure still surfaces as an error. -func isPartialObjectBody(raw []byte) bool { - var m map[string]any - if err := json.Unmarshal(raw, &m); err != nil { - return false - } - kind, _ := m["kind"].(string) - return kind == "" -} -``` - -This adds no API discovery, no catalog lookup — it is a pure function of the -bytes, consistent with the recognition-rule principle in the -[shallow-event design](./shallow-audit-event-misclassification.md#the-recognition-rule). - -### 3. Benign-drop path with its own outcome - -[`handleExtractObjectError`](../../internal/queue/redis_audit_consumer.go#L459) -currently returns a single `bool` and the caller hard-codes -`pipelineOutcomeDroppedNoBody`. To measure the new case distinctly, change the -signature to return the metric outcome it classified: - -```go -func (c *AuditConsumer) handleExtractObjectError( - log logr.Logger, auditEvent auditv1.Event, err error, gvr, namespace, name string, -) (outcome string, handled bool) -``` - -- `errAuditEventObjectMissing` → `(pipelineOutcomeDroppedNoBody, true)` — unchanged. -- `errAuditEventObjectIsStatus` → `(pipelineOutcomeDroppedNoBody, true)` — unchanged. -- `errAuditEventObjectPartial` → `(pipelineOutcomeDroppedPartialObject, true)` — new. -- default → `("", false)`. - -New `case` in the `switch`, mirroring the existing two — first occurrence at -`Info` with actionable text, the rest at `V(1)`, gated by a new -`firstPartialDropped sync.Once`: - -```go -case errors.Is(err, errAuditEventObjectPartial): - c.firstPartialDropped.Do(func() { - c.log.Info( - "First audit event dropped before git routing — body is a partial "+ - "object (no kind), typically a finalizer-removal PATCH fragment. "+ - "The resource's real change is mirrored from its own audit event; "+ - "this fragment is not routable. Further drops will log at V(1) only.", - "auditID", auditEvent.AuditID, "gvr", gvr, "verb", auditEvent.Verb) - }) - log.V(1).Info( - "audit event dropped before git routing: partial object body (no kind)", - "auditID", auditEvent.AuditID, "gvr", gvr, "verb", auditEvent.Verb, - "namespace", namespace, "name", name) - return pipelineOutcomeDroppedPartialObject, true -``` - -The caller in `routeAuditEvent`: - -```go -sanitized, err := extractObject(auditEvent, op, fullAPIVersion, ref.Resource, namespace, name) -if err != nil { - if outcome, handled := c.handleExtractObjectError( - log, auditEvent, err, fullAPIVersion+"/"+ref.Resource, namespace, name, - ); handled { - recordPipelineEvent(ctx, gvr, auditEvent.Verb, outcome) - return nil - } - return fmt.Errorf("extracting object for %s/%s: %w", namespace, name, err) -} -``` - -The generic `error`-level "poison-pill" log is now reached only by a *genuine* -decode failure (not valid JSON) — which is the anomaly that line was written -for. - -## Metric - -Add one outcome value to the existing -**`gitopsreverser_audit_pipeline_events_total`** counter — no new metric, no new -label, so existing dashboards and `InitTestExporter` wiring are untouched: - -```go -const ( - pipelineOutcomeUnmatched = "unmatched" - pipelineOutcomeDroppedNoBody = "dropped_no_body" - pipelineOutcomeDroppedPartialObject = "dropped_partial_object" // new - pipelineOutcomeRouted = "routed" - pipelineOutcomeRouteFailed = "route_failed" -) -``` - -A sample is emitted as -`gitopsreverser_audit_pipeline_events_total{group=…,version=…,resource=…,verb=…,outcome="dropped_partial_object"}`. - -Operational use: -- **Expected, low and flat** — one count per finalizer-driven delete. A baseline - rate that tracks deletions of finalizer-bearing resources is healthy. -- **Alert on sustained growth on non-`delete`/`patch` verbs** — a - `dropped_partial_object` for a `create`/`update` would mean a full-body event - is being lost upstream, which is a real gap, not a benign finalizer fragment. - Suggested expression: - `sum by (resource, verb) (rate(gitopsreverser_audit_pipeline_events_total{outcome="dropped_partial_object", verb!~"delete|patch"}[15m])) > 0`. - -The [architecture.md metrics table](../architecture.md#metrics) row for -`gitopsreverser_audit_pipeline_events_total` is updated to list the new outcome: -`unmatched`, `dropped_no_body`, `dropped_partial_object`, `routed`, -`route_failed`. - -## Tests - -All in package `queue`. Two unit tests on `extractObject`, one decision test on -`handleExtractObjectError`, one end-to-end metric test. - -### Unit — `extractObject` classifies the fragment - -In [redis_audit_consumer_test.go](../../internal/queue/redis_audit_consumer_test.go), -beside `TestExtractObject_RejectsStatusErrorBody`: - -```go -// TestExtractObject_ClassifiesPartialFinalizerPatch reproduces the CozyStack -// prod occurrence: deleting mongodb-simon2 produced an audit event whose only -// body was the finalizer-removal patch fragment {"metadata":{"finalizers":null}}. -// extractObject must classify it as a partial object, not a decode failure. -func TestExtractObject_ClassifiesPartialFinalizerPatch(t *testing.T) { - ev := auditv1.Event{ - Verb: "patch", - RequestObject: &runtime.Unknown{Raw: []byte(`{"metadata":{"finalizers":null}}`)}, - // ResponseObject deliberately nil: the object was deleted by this same - // PATCH (last finalizer removed), so the apiserver recorded no body. - } - - _, err := extractObject( - ev, configv1alpha1.OperationUpdate, - "helm.toolkit.fluxcd.io/v2", "helmreleases", "tenant-root", "mongodb-simon2", - ) - require.ErrorIs(t, err, errAuditEventObjectPartial) -} - -// TestExtractObject_MalformedBodyStillErrors guards the boundary: bytes that are -// not valid JSON are a genuine decode failure and must NOT be reclassified as a -// benign partial object — they still deserve the error-level poison-pill log. -func TestExtractObject_MalformedBodyStillErrors(t *testing.T) { - ev := auditv1.Event{ - ResponseObject: &runtime.Unknown{Raw: []byte(`{"metadata":`)}, // truncated - } - - _, err := extractObject(ev, configv1alpha1.OperationCreate, "v1", "ConfigMap", "default", "cm") - require.Error(t, err) - require.NotErrorIs(t, err, errAuditEventObjectPartial) - require.NotErrorIs(t, err, errAuditEventObjectMissing) - require.NotErrorIs(t, err, errAuditEventObjectIsStatus) -} -``` - -### Unit — `handleExtractObjectError` maps it to the benign outcome - -```go -// TestHandleExtractObjectError_PartialObjectIsBenign confirms a partial-object -// error is handled (ACK, no poison-pill) and reported under the -// dropped_partial_object metric outcome. -func TestHandleExtractObjectError_PartialObjectIsBenign(t *testing.T) { - c := &AuditConsumer{log: logr.Discard()} - outcome, handled := c.handleExtractObjectError( - logr.Discard(), auditv1.Event{Verb: "patch"}, - errAuditEventObjectPartial, "helm.toolkit.fluxcd.io/v2/helmreleases", - "tenant-root", "mongodb-simon2", - ) - assert.True(t, handled) - assert.Equal(t, pipelineOutcomeDroppedPartialObject, outcome) -} -``` - -### End-to-end — the metric is emitted, the router is not called - -> Not implemented — intentionally skipped to keep the change small. The -> `handleExtractObjectError` unit test above already pins the -> `dropped_partial_object` outcome, and `recordPipelineEvent` records whatever -> outcome that function returns. The sketch below is kept for reference. - -In [audit_metrics_test.go](../../internal/queue/audit_metrics_test.go), modelled -on `TestAuditPipelineEventsMetric_DroppedNoBody`: - -```go -func TestAuditPipelineEventsMetric_DroppedPartialObject(t *testing.T) { - reader, err := telemetry.InitTestExporter() - require.NoError(t, err) - - mr := miniredis.RunT(t) - er := &fakeEventRouter{} - c := newTestConsumer(t, mr, configmapRuleStore(), er) - require.NoError(t, c.ensureConsumerGroup(context.Background())) - - // A patch event whose only body is a finalizer-removal fragment. - ev := makeAuditEvent("patch", auditv1.StageResponseComplete, "configmaps", "default", "cm") - ev.RequestObject = &runtime.Unknown{Raw: []byte(`{"metadata":{"finalizers":null}}`)} - pushAuditMessage(t, mr, ev) - require.NoError(t, c.readAndProcessBatch(context.Background())) - - pipeline, ok := telemetry.CollectInt64Sum(reader, pipelineEventsMetric, map[string]string{ - "resource": "configmaps", "verb": "patch", "outcome": "dropped_partial_object", - }) - require.True(t, ok, "expected a dropped_partial_object audit_pipeline_events_total sample") - assert.Equal(t, int64(1), pipeline) - - // The fragment must never reach the git pipeline. - assert.Empty(t, er.calls, "partial-object event must not be routed") -} -``` - -(`readAndProcessBatch` returning `nil` is itself the assertion that the event -was ACK'd on the benign path — a poison-pill error would surface here. -`fakeEventRouter.calls` records every `RouteToGitTargetEventStream` call, so an -empty slice proves the fragment never reached the git pipeline.) - -## Out of scope - -- **Splitting the `Status` drop into its own outcome.** `errAuditEventObjectIsStatus` - still reports `dropped_no_body`, which is mildly inaccurate (there *is* a body). - Correcting it is a one-line follow-up but is not required here and would change - an existing metric series. -- **Recovering state from the fragment.** A finalizer patch has no full object; - there is nothing to mirror. The resource's real change is already covered by - its delete/full-body audit event. Dropping is the correct terminal action. -- **The CozyStack aggregated-apiserver watch instability** (`INTERNAL_ERROR` - HTTP/2 stream resets, `bookmark expired`) seen in the same logs — an upstream - environment issue on a different code path, tracked separately. - -## References - -- [internal/queue/redis_audit_consumer.go](../../internal/queue/redis_audit_consumer.go) - — `extractObject`, `handleExtractObjectError`, `routeAuditEvent`, the sentinel - errors, `pipelineOutcome*`, `recordPipelineEvent`. -- [internal/queue/redis_audit_consumer_test.go](../../internal/queue/redis_audit_consumer_test.go) - — existing `extractObject` test patterns. -- [internal/queue/audit_metrics_test.go](../../internal/queue/audit_metrics_test.go) - — existing `audit_pipeline_events_total` outcome tests. -- [docs/architecture.md](../architecture.md#metrics) — the metrics table to update. -- [shallow-audit-event-misclassification.md](./shallow-audit-event-misclassification.md) - — the related body-shape classification work. diff --git a/docs/finished/path-scoped-bootstrap-template-design.md b/docs/finished/path-scoped-bootstrap-template-design.md deleted file mode 100644 index e634a673..00000000 --- a/docs/finished/path-scoped-bootstrap-template-design.md +++ /dev/null @@ -1,210 +0,0 @@ -# Path-Scoped Bootstrap Template Design (Direction Change) - -## Why this document - -This documents: -1. What was just implemented. -2. Why that direction is wrong for multi-`GitTarget` setups. -3. The new design direction for bootstrap files per `GitTarget.spec.path`. -4. Encryption ownership and runtime behavior for multi-path repos. - -## Current Implementation State (as of now) - -Recent changes introduced a repository-level bootstrap template: -- `internal/git/bootstrapped-repo-template/.sops.yaml` -- `internal/git/bootstrapped-repo-template/README.md` - -And wired bootstrap into branch initialization: -- `PrepareBranch(...)` in `internal/git/git.go` now creates and pushes a bootstrap commit on unborn/empty branches. -- Normal write path no longer ensures `.sops.yaml`. - -### What this means behavior-wise - -- Bootstrap is currently **branch-scoped** and **repo-root scoped**. -- It does not distinguish multiple `GitTarget` paths sharing the same `(GitProvider, branch)`. - -## Why this does not match the required model - -You are correct: the system supports multiple `GitTarget`s on the same repo/branch, each with its own folder (`spec.path`). - -Current bootstrap behavior is wrong because: -- It initializes only repo root, not each target folder. -- `BranchWorker` is the sharing boundary (per provider+branch), so path-level intent should be handled there. -- A new `GitTarget` path can be introduced long after branch creation, but current bootstrap logic only runs during initial branch preparation. - -## Requirement interpretation - -Requested behavior: -- When a **new unique `GitTarget` folder path** is introduced, copy `bootstrapped-repo-template` into that folder. -- This is path-level bootstrap, not branch-root bootstrap. - -This makes architectural sense in this codebase. - -## Encryption placement decision - -Encryption behavior must be configured at `GitTarget`, not `GitProvider`. - -Reason: -- multiple `GitTarget`s can share one repo/branch but represent different environments (`test`, `prod`). -- those environments may require different key material. -- `sops` already supports path-based key selection via nearest `.sops.yaml`. - -Decision: -- `GitProvider` remains read-only transport/auth concerns (clone/fetch/push). -- remove encryption configuration from `GitProvider` in this direction. -- add encryption configuration to `GitTarget`: - - `spec.encryption.provider` (`sops` for now) - - `spec.encryption.secretRef.name` (namespace-local secret with sops credentials/env) - -Runtime behavior: -- when writing an event for a `GitTarget`, the writer uses that target's encryption credentials. -- `sops` resolves rules from the path-scoped `.sops.yaml` created in the target folder. -- no repo-wide default encryption in this increment (explicitly out of scope). - -## Final semantic choice - -Bootstrap is **one-time per path registration**. - -Meaning: -- when a normalized path is first registered and not yet marked bootstrapped, initialize it. -- after success, persist that this path is bootstrapped. -- do not continuously heal/restore files during normal write flow. - -## Proposed design direction - -## 1) Move bootstrap trigger from `PrepareBranch` to path-aware registration flow - -Remove bootstrap commit logic from `PrepareBranch`. - -Bootstrap should happen when a new path is registered for a worker: -- Entry point: `WorkerManager.RegisterTarget(...)` -- Worker key: `(providerNamespace, providerName, branch)` -- Path argument already exists in `RegisterTarget` and is currently only logged. - -## 2) Add a BranchWorker service: `EnsurePathBootstrapped(path string)` - -`BranchWorker` should expose a synchronous method that: -- ensures local repo is initialized (`PrepareBranch` without bootstrap side effects) -- writes template files under `/` (or repo root if path is empty) -- commits and pushes only if files were newly added - -Template source should be renamed to: -- `internal/git/path-bootstrap-template/` - -Rationale: -- name reflects path-scoped behavior (not repo-wide bootstrap). -- clear ownership to GitTarget bootstrap concern. - -Should these files live under `internal/`? -- yes, for this increment. -- they are controller runtime assets, not external API or user library surface. -- if we later support user-provided templates, that can become a separate API/reference mechanism. - -## 3) Track unique bootstrapped paths per worker - -`WorkerManager` should track per worker which paths are already bootstrapped (in-memory map keyed by normalized path). - -On `RegisterTarget(...)`: -- If path is new for this worker: call `EnsurePathBootstrapped(path)`. -- If already seen: skip. - -This keeps steady-state cheap and avoids per-event checks. - -Persistence is required (see section below), so in-memory cache is only a fast mirror of persisted status. - -## 4) Resolve encryption per GitTarget (not per worker) - -`BranchWorker` is shared by `(provider, branch)`, so one shared encryptor is unsafe. - -Required change: -- stop caching encryption config as one worker-global writer state. -- for each event batch (or each event), resolve encryption from the owning `GitTarget`. -- use a writer/encryptor scoped to that `GitTarget` credentials. - -This prevents cross-target credential bleed when multiple paths share a branch worker. - -## 5) Keep normal event write path focused on mirroring resources - -The branch-worker write path remains path-aware for resource files only. -No bootstrap enforcement in write loop. - -## 6) Path normalization rules (must be shared) - -Reuse existing path sanitizer behavior (or equivalent) so these are treated consistently: -- `"clusters/prod"` -- `"/clusters/prod/"` (if ever accepted upstream) -- `""` (repo root) - -Use one canonical key for uniqueness tracking. - -## 7) Commit strategy - -Bootstrap commit should be small and explicit, e.g.: -- `chore(bootstrap): initialize path ` - -If multiple files are added for same path, keep them in one commit. - -## Edge cases to handle explicitly - -1. Nested paths (`clusters` and `clusters/prod`): -- Current webhook uniqueness appears to prevent exact duplicates, not prefix overlaps. -- For now: implement it so that we don't accept overlaps. - -2. Path updates on an existing `GitTarget`: -- Treat new path as newly introduced and bootstrap it. -- Old path is not cleaned up automatically. - -3. Deleted/recreated targets: -- Recreated target with same path should bootstrap only if path has not been seen in current process. -- On controller restart, behavior depends on whether we persist path-bootstrap state. - -4. Manual deletion of bootstrap files: -- If we keep one-time semantics, we do not continuously restore them. - -## Persistence choice (recommended) - -Use `GitTarget.status` for persistence. - -Proposed status field: -- `status.bootstrappedPaths: []string` - - normalized path values successfully bootstrapped by this target. - - include `""` for repo-root path. - -Why list instead of bool: -- supports path changes over time without losing history. -- keeps one-time semantics explicit per normalized path. - -Controller startup check (required): -- on startup, list GitTargets and load `status.bootstrappedPaths`. -- seed worker/path bootstrap cache from persisted status. -- for each active GitTarget: - - normalize `spec.path` - - if path already present in `status.bootstrappedPaths`, skip bootstrap - - if missing, run bootstrap once and update status on success - -Status update contract: -- append path only after bootstrap commit+push succeeded. -- do not append on partial failure. -- use status patch with retry/conflict handling. - -## Implementation impact summary - -Will need updates in: -- `internal/git/git.go` (remove branch-level bootstrap from `PrepareBranch`) -- `internal/git/bootstrapped_repo_template.go` (support writing template into arbitrary base path; rename template dir usage) -- `internal/git/worker_manager.go` (track unique paths per worker, call bootstrap) -- `internal/git/branch_worker.go` (new synchronous bootstrap service method) -- `internal/git/encryption.go` (resolve from `GitTarget` instead of `GitProvider`) -- `internal/controller/gittarget_controller.go` and related flows (pass/resolve target encryption context) -- `api/v1alpha3/gittarget_types.go` + CRDs (add `spec.encryption`, add `status.bootstrappedPaths`) -- `api/v1alpha3/gitprovider_types.go` + CRDs (remove/deprecate encryption there in this direction) -- `internal/controller/gittarget_controller.go` (ensure registration/bootstrap is triggered at the right lifecycle point and rehydrated at startup) -- tests in `internal/git/*_test.go`, controller tests, and e2e tests - -## Conclusion - -Your requested direction is valid and better aligned with the actual multi-target architecture. - -Key corrections: -- bootstrap must be **path-scoped at worker registration time**, not **repo-root at branch initialization time**. -- encryption must be **GitTarget-scoped**, with no repo-wide default in this increment. diff --git a/docs/finished/per-resource-type-rv-keyed-streams-experiment.md b/docs/finished/per-resource-type-rv-keyed-streams-experiment.md deleted file mode 100644 index d62358d1..00000000 --- a/docs/finished/per-resource-type-rv-keyed-streams-experiment.md +++ /dev/null @@ -1,512 +0,0 @@ -# Per-resource-type keyspace in Redis - -> Status: **implemented (write-only)** — write-first. This is the *real* per-type -> data structure we intend to keep; the write path landed, no consumer / read path -> yet. Two sinks now share one per-type key root (`gitops-reverser::`): -> the **audit stream** (`:audit:stream`) and the **current-objects snapshot** -> (`:objects:items`/`:objects:rv`/`:objects:state`). -> Implementation: `internal/queue/redis_bytype_queue.go` (audit sink, tapped in -> `internal/webhook/audit_handler.go`'s `mirrorByType` /`enqueueCanonicalEvent`); -> `internal/queue/redis_objects_snapshot.go` (objects sink) driven from -> `internal/watch/type_objects_mirror.go` on the `TypeActivated`/`TypeRemoved` -> lifecycle edges; both wired always-on in `cmd/main.go`. -> **First e2e observations measured 2026-06-10 — see §12.** Headline correction: the -> late lane is *not* empty — it carries ~3–4% of events and is the §7 INV-1 signal -> firing exactly as designed (it is *why* the main stream stays RV-ordered). Confirmed on -> a **clean cluster** (§12.0) — genuine within-run reordering, not cross-run contamination. -> Captured: 2026-06-09 -> Updated: 2026-06-09 -> Owner: Simon -> Related: -> [../watch-and-catalog-architecture.md](../design/watch-and-catalog-architecture.md), -> [../audit-ingestion-decision-record.md](../design/audit-ingestion-decision-record.md), -> [../best-practices-webhook-ingress.md](../design/best-practices-webhook-ingress.md), -> [../manifest/reconcile-via-watchlist-mark-and-sweep.md](../design/manifest/reconcile-via-watchlist-mark-and-sweep.md) - -## 0. Key layout - -Every key is `gitops-reverser:::…`, colon-separated, so a -type's audit history and its current objects sit under one shared base key. The -core API group renders as `core`; a subresource is folded onto the resource -segment with a dot (`deployments.scale`); any colon inside a name is scrubbed. - -```text -# audit — the event history (stream + late lane + idstate implemented; pending:rv reserved) -gitops-reverser:::audit:stream # XADD per canonical event ← implemented -gitops-reverser:::audit:late # diagnostic late lane ← implemented -gitops-reverser:::audit:idstate # high-water + counters ← implemented -gitops-reverser:::audit:pending:rv # (reserved) - -# objects — the current cluster state, loaded when the type starts being watched -gitops-reverser:::objects:items # HASH identity → object JSON ← implemented -gitops-reverser:::objects:rv # list resourceVersion ← implemented -gitops-reverser:::objects:state # {phase,count,rv,updated_at} ← implemented - -# enumeration -gitops-reverser:__index__ # SET of per-type base keys -``` - -Examples: `gitops-reverser:apps:deployments:audit:stream`, -`gitops-reverser:core:configmaps:objects:items`, -`gitops-reverser:gitops.koudijs.dev:gittargets:objects:items`, -`gitops-reverser:apiextensions.k8s.io:customresourcedefinitions:objects:items`. - -## 1. One sentence - -Tap `enqueueCanonicalEvent` — the point where the fully-merged, body-complete -`StageResponseComplete` event is written to the canonical stream — and mirror it -into **one Redis stream per resource type**, as a **single entry** carrying the -compact **overview** fields plus the full event JSON in a `payload_json` field, -ordered **millisecond-first**, and *just write* for now: no consumer yet. - -## 2. Goal — what we want to learn - -We are not reading the data back yet. Writing it first lets us observe, after -the fact, things we currently only guess at: - -- **Volume shape per type.** How lopsided is event traffic across resource - types? Which types dominate the firehose? -- **Ordering reality.** Does the millisecond-first stream ID produce a sane - per-type history, and how often does event time disagree with arrival order? -- **RV availability.** How often is a usable ResourceVersion *present* on an - incoming event vs. missing (deletes, collection verbs, sub-resources, shallow - bodies)? -- **Duplication.** These are already joiner-deduped canonical events, so per - `audit_id` duplication should be ~0 — worth confirming it actually is. -- **Key cardinality.** How many distinct type streams appear over an hour / a - day on a real cluster? - -The deliverable for now is **the populated Redis keyspace** plus the inspection -notes below. The streams themselves are the structure we plan to consume later. - -## 3. Non-goals (for this first pass) - -- No consumer, no read path, no replay, no Git writes yet. -- No change to the existing canonical or debug streams, or to the join - pipeline. This sits *beside* them. -- Not wired into WatchRules — every type is captured; relevance is a later, - consumer-side concern. - -## 4. Where this plugs in — `enqueueCanonicalEvent` - -Current ingress path, in -[internal/webhook/audit_handler.go](../../internal/webhook/audit_handler.go): - -1. API server (official) and the additional-source proxy POST an - `auditv1.EventList` to `/audit-webhook` / `/audit-webhook-additional`. -2. `decodeEventList` parses the list; `enqueueDebugEvents` mirrors every raw - event to the debug stream (unchanged). -3. `processEvent` applies the gates and — importantly — **early-returns on any - stage other than `StageResponseComplete`** - ([audit_handler.go:294](../../internal/webhook/audit_handler.go#L294)), - then runs the join pipeline (`eventForCanonicalStream`), which merges the - additional-source **body** into the event. -4. `enqueueCanonicalEvent` writes that fully-merged event to the canonical - stream. - -The per-type push lives **inside `enqueueCanonicalEvent`**, right after the -canonical `Queue.Enqueue` succeeds. This is the right tap for two reasons: - -- The `*event` it receives is the **post-join, body-complete** event — the work - we wanted to happen before mirroring has already happened. -- It is only ever reached for **`StageResponseComplete`** (every earlier stage - was dropped by the early-return upstream). We *want* only ResponseComplete - here: it is the single canonical, deduped, body-bearing event per change, - whereas the earlier stages are partial and duplicative. This supersedes the - earlier "keep all stages" idea. - -``` -EventList POST ─▶ decode ─▶ enqueueDebugEvents (existing) - processEvent - ├─ drop unless StageResponseComplete - ├─ gates / quality / join + body merge - └─ enqueueCanonicalEvent - ├─ Queue.Enqueue → canonical stream (existing) - └─ push to per-type streams ◀── NEW (this doc) -``` - -This sink is **always active** — no enable flag, no separate DB. Keep it simple, -and keep it best-effort (see §7) so it can never fail the canonical write. - -## 5. The fields we extract per event - -### 5.1 Resource type → which stream - -Derive from `event.ObjectRef` via the existing `gvrParts` helper (group / -version / resource). Stream identity: **`group` + `resource` -(+ subresource suffix)** — version-agnostic, so all versions of a kind share one -ordered history (RV is an etcd-global revision, not per-apiVersion). - -- Core group → empty group string; render as `core`. -- Sub-resources (`deployments/scale`, `pods/status`) → suffix the stream name, - e.g. `apps.deployments.scale`. -- Sanitize for a Redis key: lowercase, `/`→`.`, strip anything outside - `[a-z0-9._-]`. -- Events with no `ObjectRef` / no resource → a single `__unknown__` stream - (worth seeing how big it gets). - -### 5.2 Millisecond value → leads the stream ID - -> **Superseded.** The shipped ingestion re-keys the main stream to `-` -> (RV-first), not millisecond-first, and routes strictly-older events to `:audit:late` instead -> of falling back to a looser ID. The millisecond is kept as the `stage_millis` field only. See -> `audit-log-ingestion-and-ordering.md` §5/§9 for the -> current design; the rest of this subsection records the original experiment. - -`event.StageTimestamp` is a `metav1.MicroTime`; use -`event.StageTimestamp.Time.UnixMilli()`. This is "the millisecond value first": -the event's own millisecond is the leading ID component. - -**RV-in-ID experiment.** A Redis stream ID is `-`, both 64-bit. Instead of -letting Redis auto-assign the sequence (`*`), we **fold the event's resourceVersion -into the sequence component**: the ID becomes **`-`**, so the ID -itself encodes `(event-time, RV)`. Within a millisecond, entries then order by RV — -the etcd commit order — rather than by arrival. RV fits a stream sequence (it is an -int64 etcd revision). - -Stream IDs must strictly increase, so we try candidates in increasing looseness and -fall back on the "equal or smaller" rejection (`streamIDCandidates` in -[internal/queue/redis_bytype_queue.go](../../internal/queue/redis_bytype_queue.go)): - -1. `-` — the experiment (skipped when RV is absent/non-numeric — - deletes, collection verbs, shallow bodies, §5.3). -2. `-*` — auto sequence within the millisecond. Covers two events sharing - an `(ms, rv)` (close `deletecollection`s repeat a collection RV — see §9) and the - no-RV case. -3. `*` — fully server-assigned, for a genuinely **older** millisecond arriving late. - -Count how often we fall past candidate 1; together with `stage_millis` / -`resource_version` (kept as fields for the true order) it directly answers the -"ordering reality" and "RV availability" questions in §2. - -### 5.3 ResourceVersion → a field, when available - -RV is **not always present**, so it is **not** part of the key — it is just a -field. When present it comes from the object body's `metadata.resourceVersion` -(mirroring [internal/git/content_writer.go](../../internal/git/content_writer.go)'s -`event.Object.GetResourceVersion()`), because `ObjectRef.ResourceVersion` is -usually empty on writes (it is the *precondition* RV). - -Extraction order, stored as the `resource_version` field (empty if none): - -1. `event.ResponseObject.Raw` → `metadata.resourceVersion`. -2. else `event.RequestObject.Raw` → `metadata.resourceVersion`. -3. else `event.ObjectRef.ResourceVersion`. -4. else `""` (and the field is simply absent/empty — we'll measure how common). - -## 6. One stream per type: overview fields + payload field - -For each event we write **one** entry into the per-type audit stream, using the -stream-ID strategy from §5.2: - -- **Audit stream** — the compact overview fields *and* the full event JSON, on the - same row: `gitops-reverser::[.]:audit:stream` - -The overview fields still make the stream scannable with `XRANGE` (the big blob is -one field you can ignore when skimming), and the payload rides along on the same -entry — no second stream, no `audit_id` join, no chance of the overview and its -body diverging or trimming at different rates. - -> Earlier this was two streams (an overview stream and a `.payload` sibling -> correlated by `audit_id`). Collapsed to one entry: the payload is now just the -> `payload_json` field below. - -### 6.1 Entry fields - -| field | source | -|--------------------|-----------------------------------------------------| -| `audit_id` | `event.AuditID` | -| `stage` | `event.Stage` — always `ResponseComplete` here (§4) | -| `verb` | `event.Verb` | -| `api_group` | `gvrParts` group | -| `api_version` | `gvrParts` version | -| `resource` | `gvrParts` resource | -| `subresource` | `ObjectRef.Subresource` | -| `namespace` | `ObjectRef.Namespace` | -| `name` | `ObjectRef.Name` | -| `resource_version` | §5.3 (empty when unavailable) | -| `stage_millis` | `StageTimestamp.UnixMilli()` (also the ID prefix) | -| `user` | `event.User.Username` | -| `payload_json` | `json.Marshal(event)` — the full merged event | - -The webhook source (official / additional) is intentionally **not** a field: by -the time we mirror, the joiner has merged the additional-source body into the -single canonical event, so "source" no longer identifies a distinct record. - -### 6.2 Concrete write - -``` -XADD gitops-reverser:apps:deployments:audit:stream - \ - audit_id stage ResponseComplete verb update \ - api_group apps api_version v1 resource deployments subresource "" \ - namespace prod name web resource_version 184467 \ - stage_millis 1749470400123 user system:... payload_json {...} -``` - -The type's **base** key is registered in a set so the keyspace can be enumerated -later without `SCAN` (shared with the objects snapshot, §11): - -``` -SADD gitops-reverser:__index__ gitops-reverser:apps:deployments -``` - -## 7. Config & safety - -- **Always on.** No enable flag. Reuse the existing Redis connection - (`RedisAuditQueueConfig`: addr, auth, DB, TLS) wired in - [cmd/main.go](../../cmd/main.go). -- **Bounded growth.** Streams support approximate trimming — set `MaxLen` with - `Approx` per stream, exactly like the existing canonical/debug streams, so a - busy type can't grow Valkey memory without limit. Reuse the same MaxLen knob. -- **Best-effort, after the canonical write.** Mirror only *after* - `Queue.Enqueue` succeeds, so the per-type streams reflect exactly what reached - the canonical stream. Swallow-and-count errors here; this sink must never fail - an audit request, release a join decision, or perturb the canonical/debug - paths. Log the first error per stream, then a counter metric. - -## 8. How we'll inspect it (later, manually) - -All read-only, ad hoc (`` = `gitops-reverser::`): - -- `SMEMBERS gitops-reverser:__index__` → the set of per-type base keys. -- `XLEN :audit:stream` per type → volume distribution (§2 "shape"). -- `HLEN :objects:items` / `GET :objects:state` → current-object count - and snapshot freshness per type (§11). -- `XRANGE :audit:stream - +` → the per-type history, scan for places where - `resource_version` or `stage_millis` move backwards vs. ID order → ordering / - RV-gap anomalies. Skip the `payload_json` field to keep the scan readable. -- Entries with empty `resource_version` → RV-availability rate. -- Entry count vs. distinct `audit_id` → duplication / multi-stage rate. -- The `payload_json` field on any row → the full body, already on the same entry. - -## 9. Open questions - -1. **Stream ID strategy** — now `-` (event-time-first, RV folded - into the sequence; §5.2), falling back to `-*` then `*`. Measure the - fall-past-candidate-1 rate: a high rate (e.g. many same-`(ms, rv)` - `deletecollection`s, or many RV-less events) tells us how often the in-ID RV is - actually usable vs. when the `resource_version` field is the only carrier. -2. **Stream granularity** — `group.resource` (proposed) vs. include version vs. - include namespace. Namespace-in-key explodes cardinality; keep it in fields. -3. **Trim size** — per-type `MaxLen`; pick a starting value once we see volumes. - -## 10. Evolution / teardown - -Because this *is* the intended real structure, "teardown" mostly means changing -the write rules, not deleting a throwaway. If we abandon it: remove the sink -wiring (audit tap in the handler, objects mirror on the lifecycle edges, both in -`cmd`) and `DEL` the `gitops-reverser:*` keyspace. No downstream coupling exists -until a consumer is built. - -## 11. Current-objects snapshot (`:objects:*`) - -The audit stream is *history*; the objects snapshot is *current state*. When a type -becomes followable and **settles** (the `TypeActivated` lifecycle edge in -[internal/typeset/lifecycle.go](../../internal/typeset/lifecycle.go)), we list -its objects **once** and write them under the same base key. This is loaded at the -moment we start watching a type — not per GitTarget — so we do not re-list on every -GitTarget change. `TypeRemoved` clears the snapshot (leaving a `removed` tombstone). - -- **Where.** [internal/watch/type_objects_mirror.go](../../internal/watch/type_objects_mirror.go) - (`mirrorTypeObjects`), called from the Manager's lifecycle drain goroutine, so a - large list never blocks the registry updater. The sink is - [internal/queue/redis_objects_snapshot.go](../../internal/queue/redis_objects_snapshot.go) - (`RedisObjectsSnapshot`), an optional `Manager.ObjectMirror` (nil disables it). -- **Why activation, not every rule change.** `TypeActivated` fires off the full - catalog scan for every served, stable type — so the snapshot is keyed to the type, - not to any GitTarget. The same revision-pinned current state then serves every - GitTarget that watches the type. This is the cluster-state half the - [mark-and-sweep reconcile](../design/manifest/reconcile-via-watchlist-mark-and-sweep.md) - needs, computed once per type instead of per target. - -### 11.1 Keys - -| key | type | contents | -|----------------------|--------|-------------------------------------------------------------| -| `:objects:items` | HASH | field `/` (cluster-scoped: ``) → an **envelope** (§11.2) | -| `:objects:rv` | string | the LIST `resourceVersion` the items are pinned to | -| `:objects:state` | string | `{phase,count,resource_version,updated_at}` — `synced` or `removed` | - -A HASH (not a stream) because this is *current* state keyed by identity: a re-list -**replaces** the set in one transaction, so a deleted object cannot linger. - -### 11.2 The item envelope - -Each item value is an envelope that **lifts the identity, resourceVersion, and -generation out of the body** and stores them beside the sanitized object, using the -same field names as the audit overview (§6.1) so the two structures are directly -joinable. This matters because `internal/sanitize` (the same pass the Git writer uses, -so the embedded `object` is directly comparable to a materialized manifest) **strips** -`uid`/`resourceVersion`/`generation` — without lifting them out, the rv would be -unreadable. - -```json -{ - "api_group": "apps", "api_version": "v1", "resource": "deployments", - "kind": "Deployment", "namespace": "prod", "name": "web", - "uid": "…", "resource_version": "184467", "generation": 7, - "object": { …sanitized Deployment… } -} -``` - -### 11.3 Concrete write - -``` -# one transaction per type at activation (full replace) -SADD gitops-reverser:__index__ gitops-reverser:apps:deployments -DEL gitops-reverser:apps:deployments:objects:items -HSET gitops-reverser:apps:deployments:objects:items \ - prod/web {"name":"web","resource_version":"184467",…,"object":{…}} prod/api {…} -SET gitops-reverser:apps:deployments:objects:rv 184467 -SET gitops-reverser:apps:deployments:objects:state {"phase":"synced","count":2,"resource_version":"184467","updated_at":"…"} -``` - -### 11.4 Caveats (this is a prototype) - -- **Best-effort.** A nil mirror, a missing dynamic client, or a list/write error is - logged and swallowed; the mirror never disturbs the watch/reconcile path. -- **Unbounded list.** A single `LIST` (no chunking) loads the whole type. Fine for a - prototype; high-cardinality types (events, pods) are exactly what we want to *see* - the size of before deciding on paging or a trim/exclude policy. -- **No live updates yet.** The snapshot is refreshed on activation/re-activation, not - per watch event. Folding steady-state watch events into `:objects:items` is the - natural next slice (and where `:audit:pending:rv` / `:audit:late` come in). - -### 11.5 Proposed refinement — gate the LIST on the followability / disallow checks - -> Status: **proposed, not implemented.** - -Today [`mirrorTypeObjects`](../../internal/watch/type_objects_mirror.go#L59) lists -**every** object of an activated type and stores all of them. Activation is already -gated at the **type** level — `TypeActivated` only fires for a settled-Followable type -([internal/typeset/lifecycle.go](../../internal/typeset/lifecycle.go)) — so a -disallowed *type* is never listed. The refinement pushes the same decision **down to the -object**: include only the objects that pass the followability / disallow checks the -rest of the pipeline applies, so large objects on the disallow list are not -listed-and-stored for nothing. - -- **Why.** The snapshot is the desired-state anchor a reconcile splices against - ([reconcile doc §6](api-source-of-truth-reconcile.md)). Storing objects that will be - filtered out downstream wastes Valkey memory and payload size on exactly the big - objects we explicitly do **not** follow — pure overhead, no consumer benefit. -- **Where.** Filter `list.Items` through the per-object disallow predicate before - building the envelope / `HSET`; the type-level gate stays where it is. It must be the - **same** predicate the audit/reconcile path uses, so the snapshot and the log agree on - what is in scope (typeset owns the *type* decision; the per-object disallow predicate - is the new seam). -- **Open.** Whether the disallow is purely object-level (filter items) or can also skip - the `LIST` **entirely** for a type none of whose objects could pass — saving the API - call, not just the storage. - -## 12. First e2e observations (2026-06-10) - -Read-only inspection with `valkey-cli` against the e2e Valkey -(`valkey-e2e/valkey` in the k3d test cluster). This is the experiment's deliverable (§2): -measured, not guessed. Measured **twice** — see §12.0 — to rule out cross-run -contamination. The cluster is **bursty** (fixture create/delete plus k3s bootstrap), so -these numbers are closer to a worst case for ordering than a steady-state cluster. - -### 12.0 Two runs — contamination ruled out - -The first read came after several back-to-back `task test-e2e` runs against a Valkey that -was **not** flushed between them. That raised a fair question: are the late entries just a -*previous* run's high-water rejecting a *fresh* cluster's low RVs? So the experiment was -repeated on a **clean cluster** — namespace torn down, fresh etcd (RVs reset to ~1), empty -Valkey (new `run_id`, 7-min-old pod). The late lane **still filled, with the same profile**. -With no stale high-water possible, that is decisive: the late entries are **genuine -within-run out-of-order webhook delivery**, not contamination. The clean run is the -authoritative measurement below; the multi-run figures corroborate it. - -| metric | clean single run | earlier multi-run | -|---|---:|---:| -| distinct type streams (`__index__`) | 98 | 98 | -| main-stream entries (Σ `XLEN :audit:stream`) | 1475 | 2497 | -| ↳ RV-bearing (idstate `mainCount`) | 1354 | 2290 | -| ↳ RV-less, attached to high-water (`rvMissingCount`) | 121 | 207 | -| objects snapshot items (Σ `HLEN :objects:items`) | 599 | 589 | -| late-lane entries (= idstate `lateCount`) | 49 | 112 | -| late ratio (late / all events) | **~3.2%** | ~4.3% | - -The counters **reconcile exactly** both runs: `mainCount + rvMissingCount = ` main entries -(1354 + 121 = 1475), and Σ`lateCount` = late-lane length. The `idstate` cache is not -drifting from the streams it summarizes. - -### 12.2 What held up - -- **Main stream is strictly RV-ordered.** IDs are `-`, not millisecond-first — - the §5.2 re-key landed and holds. -- **Objects snapshot loads cleanly** per activated type (serviceaccounts, secrets, - replicasets, services …), keyed to the type and version-agnostic. -- **RV availability is high** — ~92% of events carry a usable RV. The RV-less remainder - (deletes / collection verbs) is placed by the declared policy (§5.3 / ingestion IR5), - never crashing. -- **Zero `non-numeric-rv`** in both runs. Even the wardle aggregated apiserver - (`wardle.example.com:flunders`) emitted numeric etcd RVs. - -### 12.3 The late lane is NOT empty — and that is the point - -Correcting the field impression that "there were no late streams": the clean run has **49**, -~**3.2%** of all events, **all `older-than-high-water`** (0 `rv-missing-before-high-water`, -0 `non-numeric-rv`). This is the late lane **working as designed** — diverting genuinely -out-of-order webhook delivery is exactly *why* the main stream stays RV-clean (ingestion -doc P1/P2). It is the §7 **INV-1** signal firing. - -**RV-gap distribution** (`last_rv − resource_version`, clean run): - -| stat | value | | bucket | count | -|---|---:|---|---|---:| -| min | 1 | | ≤2 (trivial skew) | 1 | -| median | 152 | | 3–10 | 4 | -| mean | 686 | | 11–100 | 19 | -| max | 2732 | | >100 | 26 | - -The tail is **large and heavy** — ~52% of late events are >100 revisions behind, not -1–2-revision skew (the earlier multi-run agreed: median 168, max 4650, 63% >100). - -### 12.4 What the late entries actually *are* (which resources, and why) - -The clean-run late entries fall into two mechanisms, plus a tiny trivial-skew tail: - -- **A — controller re-apply of old objects (large gaps, >1000).** `k3s.cattle.io:addons` - (11 entries, `update`, gaps ~1785–2031: every k3s bootstrap addon — - `local-storage`, `ccm`, `metrics-server-*`, `auth-*`, …), `core:services` - (`kube-system/kubelet`, 3× the **same** body `rv=1438`, gaps 1557–2732), `apps:deployments` - (`coredns`, `metrics-server`, gaps ~1500). These are old objects (low body RV) re-touched - by their controllers and **delivered long after the type's high-water advanced**. No - reorder window of sane size catches a 2000-revision-old re-apply. -- **B — burst writes on test fixtures (moderate gaps, 36–409).** `core:secrets` (19, mostly - `patch` on the bi-directional fixtures — `git-creds-*`, `sops-age-key`, `bi-secret`, plus - one `deletecollection`) and `bi-directional…icecreamorders` (6, `patch` on the alice/bob - orders). The test rapid-fires patches across many objects of one type, so per-type delivery - order scrambles vs. RV order. -- **Trivial skew (≤10, window-catchable):** only ~5 entries — - `discovery…endpointslices` (gaps 9, 12), a CRD (5), `core:configmaps`/`coredns` (3), a - helmchart CRD (1). - -**Cross-cutting — these are no-op write amplification, and main already supersedes them.** -Many late entries are *repeated touches of an object whose body `resourceVersion` never -moved* — `kubelet` `rv=1438` ×3, `bob-order` `rv=2782` ×4, several secrets at the same RV ×2. -Because **etcd bumps `resourceVersion` on every real mutation**, several events at an identical -body RV mean **at most one was a real write; the rest are no-op patches** (a controller -re-applying identical content). Per-object check of every bi-directional `core:secrets` / -`…icecreamorders` late entry confirmed each was **`redundant`** — the main stream already held -the object at an **equal-or-higher** RV — so the splice consumer loses no freshness, and the -writer's no-op detection would drop them anyway. Event-time skew was 0–10s and delivery latency -~0.01s (the reorder is a tight concurrent burst, not slow delivery). Two consequences for the -pre-sorter, detailed in **ingestion `§8.2`**: a ≤30s window -*would* catch mechanism B but would suppress a signal that costs the consumer nothing; and -**you must never make a time field the sort key** — a no-op patch carries a *fresh* timestamp -with a *stale* body RV, so time-ordering would let stale state overwrite fresh (RV is the only -trustworthy order; time may bound the buffer, not order it). - -### 12.5 Implication for the deferred pre-sorter (ingestion §7 / §8.2) - -This data **argues against** building the pre-sorter for now. A bounded reorder window only -catches small gaps; here only ~10% of late events (gap ≤10) are window-catchable, while the -dominant mass is large-gap controller re-applies (mechanism A) a window of any sane size -would miss. Those are exactly what the **checkpoint backstop** ([reconcile doc -DEC-5](api-source-of-truth-reconcile.md)) is for: the next `LIST` already holds the object's -current state, so the late event never needs to reach main. Net: the late lane is -**correct, observable, and backstopped** — **no pre-sorter is justified by these runs.** -Re-measure on a steady-state cluster (and check the >1-pod delta, ingestion §8.1) before -revisiting. diff --git a/docs/design/redis-key-schema-v3.md b/docs/finished/redis-key-schema-v3.md similarity index 98% rename from docs/design/redis-key-schema-v3.md rename to docs/finished/redis-key-schema-v3.md index bb741647..471ad804 100644 --- a/docs/design/redis-key-schema-v3.md +++ b/docs/finished/redis-key-schema-v3.md @@ -3,7 +3,7 @@ > Status: **IMPLEMENTED** — 2026-06-29. The `v2 → v3` key-format bump landed for the live Redis families: > the audit author index, the watch-resume cursor, and the new command-author **store** (storage > mechanics only — the CommitRequest admission/controller rewrite in -> [commitrequest-admission-authorship.md](commitrequest-admission-authorship.md) is a separate round and +> [commitrequest-admission-authorship.md](../spec/commitrequest-admission-authorship.md) is a separate round and > is **not** wired up yet). Scope: (1) replace the opaque `attr` namespace with a top-level `author` > domain; (2) re-lay audit-sourced resource author facts as a readable, **object-grouped** hierarchy > (`:object::` + `:last`, plus a type-scoped `:rv:` escape hatch), carrying @@ -22,9 +22,9 @@ > [`internal/queue/attribution_index.go`](../../internal/queue/attribution_index.go), > [`internal/queue/redis_store.go`](../../internal/queue/redis_store.go), > [`internal/watch/author_resolver.go`](../../internal/watch/author_resolver.go), -> [CommitRequest authorship from admission](commitrequest-admission-authorship.md), -> [deletecollection attribution & deletion-as-intent](deletecollection-attribution-expander.md), -> [watch event ordering & attribution grace](watch-event-ordering-and-attribution-grace.md), +> [CommitRequest authorship from admission](../spec/commitrequest-admission-authorship.md), +> [deletecollection attribution & deletion-as-intent](../spec/deletecollection-attribution-expander.md), +> [watch event ordering & attribution grace](../facts/watch-event-ordering-and-attribution-grace.md), > [watch-first ingestion architecture](watch-first-ingestion-architecture.md). ## 1. Today (`v2`) and the companion plan @@ -182,7 +182,7 @@ A given `(uid, rv)` had **exactly one writer** — that RV exists *because* of t - A **delete** writes `:last` = the deleter; the `DELETED` watch event (RV ≠ any write RV) resolves the deleter. Correct. - A **deletecollection** expands one `:last` per member = the actor; each per-object removal joins it - (see [deletecollection §3](deletecollection-attribution-expander.md)). The whole reason that design + (see [deletecollection §3](../spec/deletecollection-attribution-expander.md)). The whole reason that design pinned itself to the uid-only variant — body RV ≠ removal RV — is just "use `:last`" here. - A **burst** (author₁ rv₁, author₂ rv₂): `:`=author₁, `:`=author₂ (both precise), `:last`=author₂. Watch events for rv₁ and rv₂ each hit their exact key → both precise. This is the precision an earlier diff --git a/docs/finished/remove-gittarget-admission-webhook.md b/docs/finished/remove-gittarget-admission-webhook.md deleted file mode 100644 index dc95fa51..00000000 --- a/docs/finished/remove-gittarget-admission-webhook.md +++ /dev/null @@ -1,153 +0,0 @@ -# Plan: Remove GitTarget Admission Webhook - -## Context - -The GitTarget admission webhook (`internal/webhook/gittarget_validator.go`) is a validating webhook -that rejects invalid GitTarget resources at `kubectl apply` time. It checks two things: - -1. **Encryption spec shape** — `secretRef.name` is required when encryption is configured -2. **Uniqueness** — no two GitTargets may share the same `(repo URL, branch, path)` combination - -The GitTarget controller independently enforces both of these constraints: - -- Encryption configuration is validated in the `EncryptionConfigured` gate - ([internal/controller/gittarget_controller.go:319](../internal/controller/gittarget_controller.go#L319)) -- Path uniqueness is checked in `evaluateValidatedGate` → `checkForConflicts` - ([internal/controller/gittarget_controller.go:304](../internal/controller/gittarget_controller.go#L304)) - -This makes the admission webhook a UX convenience, not a correctness requirement. Removing it -simplifies the operator's runtime topology, deployment configuration, and certificate management. - -## Pros - -- **Drop the controller-runtime webhook server entirely.** The GitTarget validator is the only - admission webhook in the project. Removing it means the operator no longer needs to run an HTTPS - server on port 9443 for admission reviews. - -- **No more webhook TLS certificate management.** Today every deployment needs either cert-manager - or a manually provisioned TLS certificate for the admission endpoint. This is consistently one of - the most common sources of setup friction for Kubernetes operators. - -- **Simpler Helm chart.** The `servers.admission` values block, the `admission-webhook.yaml` - template, the admission Certificate resource, the admission Service port, the caBundle injection, - and the associated README sections all go away. - -- **Simpler kustomize config.** Three files deleted (`webhook/manifests.yaml`, `webhook/patch.yaml`, - `webhook-service.yaml`), plus the replacement stanzas and the admission Certificate in - `config/certs/`. - -- **Fewer CLI flags.** `--webhook-cert-path`, `--webhook-cert-name`, `--webhook-cert-key`, and - `--webhook-insecure` can all be removed. The fallback logic that copies webhook cert paths to - audit cert paths also goes away, making the audit TLS configuration self-contained. - -- **Removes a failure mode.** If the webhook is misconfigured or its certificate expires, GitTarget - creates/updates are rejected cluster-wide. This is a high blast radius for a UX convenience. The - `failurePolicy: Fail` setting means a broken webhook blocks all GitTarget operations. - -- **Less code.** Approximately 700 lines of Go code (validator + tests) plus significant Helm/kustomize - configuration. - -## Cons - -- **Slower feedback on invalid GitTargets.** Without the webhook, a user who creates a duplicate - GitTarget will see it accepted by `kubectl apply`, then find `Validated=False` in the status - conditions. The error is still surfaced, but after a reconcile cycle rather than immediately. - -- **Encryption spec errors are deferred.** A GitTarget with `encryption.enabled: true` but no - `secretRef.name` will be created and sit in `EncryptionConfigured=False` instead of being - rejected at apply time. Again, the error is clear in status, just not immediate. - -Both of these are standard Kubernetes operator behavior. Most operators do not use admission -webhooks for their CRDs and rely entirely on status conditions for validation feedback. - -## What changes - -### Files to delete - -| File | What it is | -|---|---| -| `internal/webhook/gittarget_validator.go` | Validator implementation | -| `internal/webhook/gittarget_validator_test.go` | Validator tests (~669 lines) | -| `config/webhook/manifests.yaml` | Generated ValidatingWebhookConfiguration | -| `config/webhook/patch.yaml` | cert-manager CA injection patch | -| `config/webhook-service.yaml` | Admission Service (port 9443) | -| `charts/gitops-reverser/templates/admission-webhook.yaml` | Helm ValidatingWebhookConfiguration | - -### Files to edit - -#### `cmd/main.go` - -- Remove `SetupGitTargetValidatorWebhook` call (lines 181-184) -- Remove `initWebhookServer` call and function definition — this is the only admission webhook, so - the entire controller-runtime webhook server can go -- Remove `webhookCertPath`, `webhookCertName`, `webhookCertKey`, `webhookInsecure` from `appConfig` - and their flag bindings -- Remove the fallback logic that copies webhook cert paths into audit cert paths — make the audit - TLS flags self-contained with their own defaults -- Remove `WebhookServer` from `newManager` call - -#### `cmd/main_audit_server_test.go` - -- Remove `webhookInsecure` default assertion -- Remove or rewrite `TestParseFlagsWithArgs_FallsBackToWebhookCertPath` — the fallback concept no - longer exists -- Update any test that passes `--webhook-cert-path` as an argument - -#### `config/deployment.yaml` - -- Remove `--webhook-cert-path=...` CLI argument -- Remove `containerPort: 9443 / name: admission` -- Remove `volumeMount` and `volume` for `webhook-certs` - -#### `config/kustomization.yaml` - -- Remove `webhook-service.yaml` from resources -- Remove `webhook/manifests.yaml` from resources -- Remove `webhook/patch.yaml` from patches -- Remove the `replacements` stanza for `ValidatingWebhookConfiguration` - -#### `config/certs/certificates.yaml` - -- Remove the `gitops-reverser-admission-server-cert` Certificate resource -- Remove its corresponding replacement entry in `config/certs/kustomization.yaml` - -#### Helm chart - -| File | Changes | -|---|---| -| `templates/certificates.yaml` | Remove admission Certificate resource (lines 14-35) | -| `templates/deployment.yaml` | Remove admission TLS args, container port, volumeMount, volume | -| `templates/services.yaml` | Remove `admission` port from Service | -| `templates/configmap.yaml` | Remove `webhook.port` entry | -| `values.yaml` | Remove `servers.admission` block, `webhook.caBundle`, `service.ports.admission` | -| `README.md` | Remove cert-manager prerequisite, webhook config section, troubleshooting section | - -#### Tests - -| File | Changes | -|---|---| -| `test/e2e/e2e_test.go:134` | Update smoke test — the admission port is gone from the Service | - -#### Documentation - -| File | Changes | -|---|---| -| `docs/architecture.md` | Remove admission webhook paragraph, startup diagram node, package map entry | - -### Not affected - -- **Audit webhook** (`internal/webhook/audit_handler.go`) — this is a plain HTTP server, not a - Kubernetes admission webhook. It has its own TLS configuration and is completely independent. -- **Audit TLS setup in e2e** (`inject-webhook-tls.sh`, `_webhook-tls-ready` task) — despite the - name, this is for the audit webhook, not the admission webhook. -- **CI workflows** — no webhook-specific CI steps exist. - -## Suggested order of implementation - -1. Remove the Go code first (`gittarget_validator.go`, its tests, `cmd/main.go` changes) -2. Verify the operator builds and unit tests pass without the webhook server -3. Remove kustomize configuration -4. Remove Helm chart configuration -5. Update e2e smoke test -6. Update `docs/architecture.md` -7. Run full e2e suite to confirm nothing depends on the webhook diff --git a/docs/finished/rule-set-snapshot-discovery-lag-fix.md b/docs/finished/rule-set-snapshot-discovery-lag-fix.md deleted file mode 100644 index 95923ef7..00000000 --- a/docs/finished/rule-set-snapshot-discovery-lag-fix.md +++ /dev/null @@ -1,237 +0,0 @@ -# Rule-Set Snapshot Discovery-Lag Fix - -> Status: **shipped**. Drives the per-GitTarget effective-watch-plan hash in -> `internal/watch/manager.go`. - -## Problem - -This fix introduced the per-GitTarget effective-watch-plan hash: - -- `currentRuleSetSnapshots()` resolves rules through the API resource catalog. -- It ignores `ResolveMiss` values from `resolver.Resolve(...)` - (`gvrs, _ := resolver.Resolve(...)`). -- If a target's rules temporarily resolve to zero GVRs, the target is omitted - entirely ([manager.go:1280-1282](../../internal/watch/manager.go#L1280-L1282)). -- `snapshotTargetsNeedingDelivery()` treats an omitted target as "this target no - longer has rules" and deletes `lastDeliveredRuleSetHash` - ([manager.go:1189-1194](../../internal/watch/manager.go#L1189-L1194)). -- When discovery recovers, the same target appears again with the same real - watch plan but no remembered baseline, so it gets a full rule-change snapshot - even though the user's rules did not change. - -That makes a transient discovery gap look like a real watch-plan change. It can -hide event commits behind later `reconcile: sync ...` commits and is the reason -`crd_lifecycle` still needs `Serial` protection. - -## Two facts that shape the fix - -Before designing anything, two existing properties narrow what the fix actually -has to do: - -1. **Partial snapshots are already refused downstream.** - `RequestClusterState` aborts whenever `blockingSnapshotMisses(...)` is - non-empty — "refusing to snapshot a partial cluster view" - ([manager.go:596-601](../../internal/watch/manager.go#L596-L601)). So a - half-resolved plan can never *emit* a snapshot. The selection layer does not - need to be perfect about blocked plans for **correctness** — only to avoid - noisy select-then-abort retry loops. - -2. **"No rules" vs "rules that didn't resolve" needs no miss classification.** - It is already encoded in the RuleStore. `currentRuleSetSnapshots()` only - builds a plan for a target that appears in `SnapshotWatchRules()` / - `SnapshotClusterWatchRules()`. A target with zero rules never gets a plan and - falls out of `currentKeys` naturally. The bug exists solely because the - `if len(p.entries) == 0 { continue }` guard drops a target that *still has - rules* but momentarily resolved to nothing. - -Together these mean the headline bug has a small, safe fix, and the richer -classification is a set of optional refinements layered on top. - -## Expected states — and when they happen - -A target's resolved plan can be in one of four states. The two that produce zero -GVRs (states 3 and 4) look identical to the old code, which is the root cause. - -| State | Trigger | Stable? | Action | -|---|---|---|---| -| 1. No rules | The last WatchRule/ClusterWatchRule for the GitTarget was deleted, or its `gitTargetRef` was repointed. | — | Prune remembered state. | -| 2. Resolved plan | One or more rules resolve to served, allowed GVRs. The normal steady state. | yes | Compare hash to last settled; emit a snapshot only if it changed. | -| 3. Stable empty plan | Rules exist but resolve to zero watchable GVRs for a reason that will not change on its own: `NotServed`, `Ambiguous`, `Disallowed`. | yes | No snapshot (nothing to watch). Optionally record a no-watch settled hash (Refinement B). | -| 4. Blocked / uncertain | Rules exist and *would* resolve, but discovery can't answer authoritatively right now: `CatalogUnavailable`, `DiscoveryDegraded`, `WildcardGroup`, `WildcardResource`. | no | Do not snapshot, do not mutate remembered state. Retry next cycle. | - -Concrete triggers: - -- **State 1 — No rules.** `kubectl delete watchrule`, or editing a rule to point - at a different GitTarget. The target no longer exists in the RuleStore - snapshot, so no plan is built for it. -- **State 2 — Resolved plan.** Steady state, every reconcile. A real change is - e.g. a rule that newly adds `secrets` alongside `configmaps`, or a wildcard - that begins matching a freshly installed CRD. -- **State 3 — Stable empty.** The user wrote a rule for a CRD that was never - installed, typo'd a resource name, omitted `apiGroups` in a way that matches - multiple groups, or named a resource the operator is configured to refuse. - Re-running discovery returns the same answer, so this is settled. -- **State 4 — Blocked.** **This is the bug's trigger.** A CRD is mid - install/delete (the `crd_lifecycle` spec), the controller just started and - discovery is still warming up, or the aggregation layer briefly 503s. Unlike - state 3, the answer **changes on retry**. - -The crucial pair is **3 vs 4**: both yield zero GVRs, but 3 is a settled fact and -4 is a temporary "ask again later." The original code collapsed both into "target -removed," which is what turned a routine CRD install (state 4) into a spurious -full re-snapshot of every unrelated target. - -## Fix (ship this) - -The headline bug is fixed by a near-trivial change. No new types, no miss -classification, no rename. - -1. In `currentRuleSetSnapshots()`, **stop dropping empty-entry plans.** Keep - every target that has at least one rule, even if it currently resolves to zero - GVRs. (Delete the `if len(p.entries) == 0 { continue }` guard.) -2. In `snapshotTargetsNeedingDelivery()`, **if a plan has no entries, `continue` - — skip selection and leave `lastDeliveredRuleSetHash` untouched.** There is - nothing to snapshot, and the remembered baseline must survive the gap. -3. The existing prune loop now fires only for targets with genuinely zero rules. - That is already correct — no change needed. - -Walk the transient-gap case through it: `valid -> (gap, empty) -> valid`. During -the gap the target is kept but skipped, `lastDeliveredRuleSetHash` stays at the -valid hash; on recovery the hash matches, so no snapshot is emitted. Bug gone. - -This alone fixes finding #2 and unblocks de-serializing `crd_lifecycle`. - -### What the Fix gives up - -Exactly **one** behavioral difference versus a fully classified design: the -`valid -> stable-empty -> valid` *edit* sequence (a user edits a rule to -something non-watchable, then edits it back). The Fix keeps the baseline at the -valid hash the whole time, so on return it sees "unchanged" and skips the -recovery snapshot — even though no live events were watched during the empty -window. Refinement B below addresses exactly this case if you want it. - -## Refinement A (optional): skip blocked plans instead of aborting them - -The Fix is safe for the **mixed** case (one resolved GVR plus one blocking miss → -non-empty entries) because the downstream abort at -[manager.go:596](../../internal/watch/manager.go#L596) refuses the partial -snapshot. But it does so by *selecting* the target every cycle and aborting it, -which logs an error each reconcile until discovery recovers. - -To avoid that noise, capture misses in the plan and add a `blocked` flag: - -```go -// fields added to the existing targetWatchPlan, not a parallel type -blocked bool -blockingMisses []ResolveMiss -``` - -Set `blocked` when any rule for the target produces a miss in -`blockingSnapshotMisses(...)` (`CatalogUnavailable`, `DiscoveryDegraded`, -`WildcardGroup`, `WildcardResource`). Then in `snapshotTargetsNeedingDelivery()`: - -```go -if plan.blocked { - // Rules exist, but the current resolved plan is not authoritative. - // Keep lastDeliveredRuleSetHash and pendingRuleSetHash as-is; - // discovery/catalog recovery will retry. - continue -} -``` - -This is a quality-of-noise optimization, not a correctness fix — the Fix is -already safe without it. - -## Refinement B (optional): settle a stable-empty hash - -This is the *only* mechanism that fixes the `valid -> stable-empty -> valid` edit -case, and the only reason to compute a hash for an empty plan. - -Include the **stable** misses (`NotServed`, `Ambiguous`, `Disallowed`) in the -hash so a target can settle into a known "no-watch" plan and later transition -back to a resolved plan: - -``` -valid hash -> stable empty hash -> valid hash -``` - -The settled empty hash differs from the valid hash, so the final transition is -detected and the target is re-snapshotted. In `snapshotTargetsNeedingDelivery()`: - -```go -if !plan.hasEntries { // hasEntries == len(plan.entries) > 0 - // Stable empty/no-watch plan. No cluster snapshot to emit, but the - // rule-set state did advance. Mark it settled so a later empty -> resolved - // transition emits a snapshot. - lastDeliveredRuleSetHash[key] = plan.hash - delete(pendingRuleSetHash, key) - continue -} -``` - -Do **not** include blocking misses in the hash — a blocked plan is not an -authoritative plan, and a blocked target must hit the Refinement A path -(`continue` without mutating state) before this branch. - -When is this worth it? Only when a *served* resource churns during a window in -which the user deliberately edited the rule to be non-watchable and back. Rare, -and the worst case without it is a missed recovery snapshot that self-heals on -the next real rule change. For `NotServed` resources there are by definition no -objects to miss, so it is often moot. - -## Implementation notes - -- Extend the existing `targetWatchPlan` with the `blocked` / `blockingMisses` - fields rather than introducing a parallel `ruleSetSnapshotPlan` type. Express - `hasEntries` as `len(entries) > 0`, not a stored field. -- Reuse `blockingSnapshotMisses(...)` for the classification. If the name reads - oddly in a planning context, extract a thin alias such as - `blockingRuleSetPlanMisses(...)`. -- If Refinement B lands, `lastDeliveredRuleSetHash` would be more accurately - named `lastSettledRuleSetHash`, because stable empty plans are settled without - a delivered snapshot. Rename only if the patch stays readable; otherwise add a - comment explaining the broadened meaning. -- Log blocked plans at `V(1)` with `FormatResolveMisses(...)`. Avoid - default-verbosity logs on every periodic reconcile; catalog transition logs - already cover the noisy discovery edges. -- Do not mark a blocked plan as pending. Pending is for a snapshot that should be - emitted once a reconciler exists, not for a plan that is not yet authoritative. - -## Test plan - -Tests map onto the tiers, so you can land the Fix and its three tests and drop -`Serial` without ever building Refinement A or B. Add them near -[rule_change_snapshot_test.go](../../internal/watch/rule_change_snapshot_test.go): - -**Fix:** - -- `TestSnapshotTargets_DiscoveryUnavailableKeepsDeliveredHash`: seed a delivered - configmaps plan, swap the manager catalog to unavailable, call - `snapshotTargetsNeedingDelivery()`, and assert the target is not selected and - `lastDeliveredRuleSetHash` is not pruned. -- `TestSnapshotTargets_DiscoveryRecoveryDoesNotResnapshotUnchangedPlan`: after - the unavailable-catalog pass above, restore the common catalog and assert the - unchanged target is still not selected. -- `TestSnapshotTargets_RuleRemovalPrunesDeliveredHash`: remove the rule from the - RuleStore and assert the remembered hash is pruned. This guards against - confusing "blocked" (state 4) with "deleted" (state 1). - -**Refinement A:** - -- `TestSnapshotTargets_MixedResolvedAndBlockingMissDoesNotSnapshotPartialPlan`: - give one target a resolved GVR plus a discovery-degraded lookup. Assert the - target is not selected and no hash is advanced. -- `TestSnapshotTargets_BlockedTargetDoesNotAffectOtherTargets`: target A is - blocked by discovery, target B changes from configmaps to configmaps+secrets. - Assert B is selected and A's remembered state is preserved. - -**Refinement B:** - -- `TestSnapshotTargets_StableEmptyPlanSettlesAndRecoverySnapshots`: seed a - delivered configmaps plan, change the rule to a definitely not-served resource, - assert no snapshot is selected but the settled hash changes, then change back - to configmaps and assert the target is selected. - -The e2e follow-up is to remove `Serial` from `Manager CRD Lifecycle` only after -these unit tests pass and at least one parallel CI confidence window shows that -CRD install/delete no longer drags unrelated GitTargets into snapshots. diff --git a/docs/finished/scale-subresource-state-code-removal.md b/docs/finished/scale-subresource-state-code-removal.md deleted file mode 100644 index 99a02ff9..00000000 --- a/docs/finished/scale-subresource-state-code-removal.md +++ /dev/null @@ -1,107 +0,0 @@ -# Removing the dead scale-subresource *state* code - -> Status: implemented. -> Date: 2026-06-30. -> Scope: pure dead-code deletion — no behavior change. `task fmt`, `task vet`, -> `task lint` (0 issues), and `task test` pass. -> Related: [Data Sources](../architecture.md#data-sources), -> [Optional Attribution](../architecture.md#optional-attribution), -> [Partial-object audit events](./partial-object-audit-event-handling.md) (describes the -> now-removed audit-as-state consumer). - -## Summary - -When the project moved to **watch-first ingestion**, watch became *the only object-state -source* and the old **audit-as-state** pipeline (`internal/queue/redis_audit_consumer.go` -— `extractObject` → `routeAuditEvent` → `RouteToGitTargetEventStream`) was deleted. A -`/scale` write used to be interpreted by that consumer: it read the accepted replica count -out of the `Scale` response object and wrote it onto the parent's `.spec.replicas`. Once -watch owns state that interpretation is unnecessary — a `kubectl scale` mutates the parent -Deployment's `spec.replicas` *in place* and bumps its `resourceVersion`, so the parent's -own watch event already carries the new value. - -The consumer was removed, but its **scale helpers were left behind** as orphans. This -change deletes them. - -## What was removed, and why each was dead - -| Symbol | File | Why it was dead | -|---|---|---| -| `BuiltinScaleReplicasPath(group, resource)` + its two tests | `internal/auditutil/subresource_policy.go`, `_test.go` | Zero production callers. It returned the parent replica field path (`["spec","replicas"]`) for the deleted consumer to write. Watch carries the value now, so nothing asks for the path. | -| `SplitFieldPath(path)` + `TestSplitFieldPath` | `internal/typeset/scale.go`, `scale_test.go` | Sole purpose was to bridge a `ScaleBinding`'s dotted path string into the writer's `[]string` — its doc said so. Its only caller was `BuiltinScaleReplicasPath`. Removing that orphaned it. | -| The whole `subresource_policy.go` / `subresource_policy_test.go` | `internal/auditutil/` | After the two functions above were gone, the file held only `IsScaleSubresource(s) == (s == "scale")`, used in exactly one place: `shouldForwardSubresource` in the webhook. The literal was inlined there (its comment already documents the policy), so the file — and a package-level essay for a one-liner — was deleted. | - -`auditutil` survives: the webhook still uses `auditutil.VerbToOperation`. - -## What survives, and why - -The `/scale` special-case in -[`shouldForwardSubresource`](../../internal/webhook/audit_handler.go) stays — but it is now -purely an **attribution forwarding gate**, not a state path. A `/scale` write surfaces in -the audit stream only under the parent's `…/scale` subresource, so the handler forwards -just that one subresource to name *who* scaled the parent (joined to the parent watch event -by `resourceVersion`); every other subresource — `status`, `exec`, `log`, `proxy`, … — is -dropped before the attribution index. With attribution disabled, a scale still mirrors -correctly through the parent watch; the commit is simply committer-authored. - -`typeset.BuiltinScale` also survives: the followability funnel -([`scaleCheck`](../../internal/typeset/funnel.go)) reads its `Enabled` / `Usable` flags to -decide whether a scalable parent is followable. It no longer reads the *path*. - -## Things learned - -1. **A scale never needs subresource interpretation under watch.** The apiserver's `/scale` - handler writes `spec.replicas` onto the parent object itself and bumps its - `resourceVersion`. The operator watches `apps/v1/deployments`, receives the full - `MODIFIED` parent, sanitizes, diffs, and commits. The dedicated e2e proves exactly this — - its title is "mirrors kubectl scale **through the parent Deployment watch**" - ([deployment_scale_subresource_e2e_test.go](../../test/e2e/deployment_scale_subresource_e2e_test.go)). - -2. **Removing one orphan cascades.** Deleting `BuiltinScaleReplicasPath` made - `SplitFieldPath` dead, which in turn left `ScaleBinding`'s richer fields write-only. The - honest cleanup follows the chain rather than stopping at the first symbol. - -3. **`ScaleBinding` is now mostly write-only — a noted follow-up, left intact here.** In - production only `Enabled` and `Usable` are read (by the followability funnel). The - reporting/state fields — `SpecReplicasPath`, `ResponseGVK`, `Source`, - `StatusReplicasPath`, `SelectorPath`, `SelectorKind` — are set by `BuiltinScale` and - asserted by typeset unit tests, but no production code reads them. Collapsing - `ScaleBinding` to `{Enabled, Usable}` is a reasonable simplification, but it touches the - typeset "fact" model and its corpus expectations, so it was deliberately **not** done in - this behavior-neutral pass. - -4. **The surviving `/scale` gate's one purpose — attribution — had no e2e coverage, now - added.** This surfaced while checking the cleanup, and the gap is closed by - [deployment_scale_author_attribution_e2e_test.go](../../test/e2e/deployment_scale_author_attribution_e2e_test.go): - - **Unit:** covered. `audit_handler_test.go` asserts a `/scale` event forwards, a - non-scale subresource is dropped, and a captured real `kubectl scale deployment` - recording is recorded as an attribution fact - (`TestAuditHandler_ForwardsRealScaleSubresourceRecording`). - - **e2e (was a gap):** the dedicated scale e2e asserts only the *replica value* in git, - never the commit author; the attribution e2e - ([commit_author_attribution_e2e_test.go](../../test/e2e/commit_author_attribution_e2e_test.go)) - never scales. So the end-to-end join *scale fact → resolver → commit authored by the - scaler* was never exercised. The new spec runs a literal `kubectl scale deployment … - --replicas=3 --as= --as-group=system:masters` and asserts both that the parent - manifest reaches `replicas: 3` (proving state flows through the parent watch) **and** - that the resulting commit is authored by the human who scaled. - - The e2e **infrastructure already supported** it: the audit policy - ([cluster/audit/policy.yaml](../../test/e2e/cluster/audit/policy.yaml)) captures a human - `*/scale` at `RequestResponse` (the rule-3 catch-all) and drops the HPA controller's - `apps/*/scale` at `level: None` (rule 2). - - One constraint worth recording: kubectl's CLI cannot set `user.extra`, so the new spec - attributes a **bare username** (`grace-hopper` → `grace-hopper@noreply.cluster.local` - via `ConstructSafeEmail`), not the richer OIDC display-name/email form. The - claims-enrichment path stays covered by the impersonation-based ConfigMap attribution - e2e, which uses client-go's `ImpersonationConfig` to carry the claims kubectl can't. - -## References - -- [internal/auditutil/](../../internal/auditutil/) — `subresource_policy.go` removed; - `VerbToOperation`, `identity`, `objectref` remain. -- [internal/typeset/scale.go](../../internal/typeset/scale.go) — `SplitFieldPath` removed; - `BuiltinScale` / `ScaleBinding` remain. -- [internal/webhook/audit_handler.go](../../internal/webhook/audit_handler.go) — - `shouldForwardSubresource`, the attribution-only `/scale` gate. -- [docs/architecture.md](../architecture.md#data-sources) — watch is the only object-state - source; audit is optional attribution. diff --git a/docs/design/sensitive-resource-classification-plan.md b/docs/finished/sensitive-resource-classification-plan.md similarity index 97% rename from docs/design/sensitive-resource-classification-plan.md rename to docs/finished/sensitive-resource-classification-plan.md index d4c2ec42..70189275 100644 --- a/docs/design/sensitive-resource-classification-plan.md +++ b/docs/finished/sensitive-resource-classification-plan.md @@ -103,4 +103,4 @@ Run the required validation sequence sequentially. Catalog validation, rule-status diagnostics, runtime skipping for unencrypted targets, and the open questions around those behaviors are split into -[sensitive-resource-diagnostics-follow-up.md](sensitive-resource-diagnostics-follow-up.md). +[sensitive-resource-diagnostics-follow-up.md](../design/sensitive-resource-diagnostics-follow-up.md). diff --git a/docs/finished/shallow-audit-event-misclassification.md b/docs/finished/shallow-audit-event-misclassification.md deleted file mode 100644 index 4338e939..00000000 --- a/docs/finished/shallow-audit-event-misclassification.md +++ /dev/null @@ -1,432 +0,0 @@ -# Shallow audit events: definition, recognition, and the `/v1/pods` flood - -> Status: root cause confirmed — the flood is `pods/exec`, not pod object creation. -> Date: 2026-05-22 -> Cluster under investigation: **CozyStack** (`cluster="cozystack"`, `tenant="tenant-root"`). -> Related: [Audit Ingestion Pipeline](../architecture.md#audit-ingestion-pipeline), -> [apiservice-audit-proxy README](../../external-sources/apiservice-audit-proxy/README.md). - -## Summary - -After a recent upgrade, `audit-joiner` emits a high-volume flood of warnings: - -``` -WARNING: official shallow audit event timed out waiting for additional body; -the official event will be dropped. Install or repair apiservice-audit-proxy -so request/response bodies arrive within the wait budget. - auditID=... gvr=/v1/pods verb=create wait=0.5 -``` - -The volume is confirmed by metrics (see [Evidence](#evidence-from-the-cluster)): -thousands of `official` / `identity_shallow` / `pods` / `create` events. - -The early debug Redis stream captured the exact incoming event. It is a -successful streaming `pods/exec` request, not a pod object create: - -- `objectRef.resource: pods` -- `objectRef.subresource: exec` -- `verb: create` -- `responseStatus.code: 101` -- no `requestObject` or `responseObject` - -That resolves the apparent policy contradiction. Kubernetes audits POST-style -exec requests with verb `create`, while GitOps Reverser's quality metric labels -resource but not subresource. The metric therefore looked like a flood of -bodyless pod creates. The reported audit policy excludes top-level `pods`; a -`pods/exec` audit-policy match is separate and falls through to its later -`RequestResponse` rule. - -The fix for this flood is to reject all non-empty `objectRef.subresource` audit -events before the join pipeline. Current WatchRule planning rejects subresources -too; they are not the top-level object state this Git writer mirrors. The -previous audit ingress check rejected only `status` subresources, which was too -narrow. - -This document also keeps the shallow-event analysis because the aggregated-API -body gap is real, but that gap did not produce this `/v1/pods` flood. - -## Confirmed offending event - -The captured event has this load-bearing shape: - -```json -{ - "level": "RequestResponse", - "stage": "ResponseComplete", - "requestURI": "/api/v1/namespaces/cozy-kubeovn/pods/ovn-central-7955dc78d8-lvwh4/exec?...", - "verb": "create", - "objectRef": { - "resource": "pods", - "namespace": "cozy-kubeovn", - "name": "ovn-central-7955dc78d8-lvwh4", - "apiVersion": "v1", - "subresource": "exec" - }, - "responseStatus": { - "code": 101 - } -} -``` - -`pods/exec` upgrades into a command stream. It cannot provide a resource object -for Git mirroring and no additional-body proxy can repair it. The joiner used to -see `verb=create` plus empty object bodies, classify it `identity_shallow`, then -wait for a body that can never arrive. - -## Background: the two audit channels - -GitOps Reverser ingests audit events from two endpoints: - -| Endpoint | Sender (intended) | Role | -| --- | --- | --- | -| `/audit-webhook` | kube-apiserver | Canonical audit source — authority for identity, verb, status | -| `/audit-webhook-additional` | `apiservice-audit-proxy` | Supplementary **body** source | - -The endpoint the payload arrives on *is* the source role — there is no in-band -marker ([audit_handler.go](../../internal/webhook/audit_handler.go#L534)). The -metric label `source="official"` therefore means only "POSTed to -`/audit-webhook`" — **not** "proven to come from kube-apiserver." That -distinction matters below. - -`apiservice-audit-proxy` exists for exactly one reason. Per its -[README](../../external-sources/apiservice-audit-proxy/README.md): - -> It exists to recover audit fields that kube-apiserver does not populate for -> **aggregated API requests**: `objectRef.name`, `requestObject`, and -> `responseObject`. - -For a request to an **aggregated (`APIService`-backed) API**, kube-apiserver -proxies the call to a separate backend and never sees the request or response -body. Its native audit event for that request is *hollow*. The proxy sits in -front of the backend, observes the bodies, and posts an enriched event to -`/audit-webhook-additional` so the joiner can merge it. - -For **built-in resources** — `pods`, `configmaps`, `deployments`, every core and -standard API — kube-apiserver handles the request itself and its native audit -event is **already complete**. The proxy is never in that path and contributes -nothing. - -Note CozyStack specifically: the proxy README has a -[CozyStack case study](../../external-sources/apiservice-audit-proxy/README.md) -— the proxy redirects CozyStack's existing `APIService` objects (the -`cozystack-api` aggregated API) to itself. That covers CozyStack's aggregated -API groups; it does **not** put core `v1/pods` behind the proxy. - -## What a shallow event actually is - -A **shallow event** is the hollow native event kube-apiserver emits for an -**aggregated API request** — the case the additional-body channel was built to -repair. It is *not* simply "an event without a body." - -The distinction is visible in a real captured payload — the proxy's checked-in -`audit-lane-a-kube-apiserver-hollow.json`, kube-apiserver's native event for a -`create` on the aggregated `flunders` API: - -```jsonc -{ - "level": "RequestResponse", // policy asked for bodies... - "verb": "create", - "objectRef": { - "resource": "flunders", - "namespace": "default", - "apiGroup": "wardle.example.com", - "apiVersion": "v1alpha1" - // ...but NO "name" - } - // ...and NO "requestObject", NO "responseObject" -} -``` - -Even though the audit policy requested `RequestResponse`, kube-apiserver could -not fill in `objectRef.name`, `requestObject`, or `responseObject`, because the -real work happened in an aggregated backend it cannot see. **That** is a shallow -event — and note it still carries `level: RequestResponse`. - -Contrast the event shapes the joiner must tell apart: - -| Event shape | `level` | `objectRef.name` | `requestObject` / `responseObject` | What it is | Correct treatment | -| --- | --- | --- | --- | --- | --- | -| Complete | `Request` / `RequestResponse` | set | present | Built-in resource, or a merged event | Emit as-is | -| **Shallow** | **`RequestResponse`** | **empty** | **empty** | **Aggregated-API hollow event** — policy asked for bodies, apiserver could not supply them | **Wait for an additional body** | -| Bodyless by policy | `Metadata` / `None` | set | empty | Built-in resource the audit policy never captures bodies for | Reject at ingress — no Git write possible, nothing to wait for | - -(Bodyless *deletes* are a separate, documented carve-out — `body_shallow_deletable` — -and emit on `objectRef` identity alone; they are not covered by this table.) - -## The recognition rule - -A shallow event is **recognisable from the event alone**. No API discovery, no -`APIResourceCatalog` lookup, no `APIService` enumeration, no new field anywhere -is needed: - -> An audit event is a **genuine shallow event** when `objectRef.name`, -> `requestObject`, and `responseObject` are **all empty** — typically together -> with `level: RequestResponse` (the policy wanted bodies; the apiserver could -> not supply them). - -`objectRef.name` is the load-bearing field. It is metadata, not body, so the -audit *level* does not strip it: a built-in resource keeps its name even at -`level: Metadata`. Only the aggregated-API path drops it. So the presence or -absence of `objectRef.name` on the offending event is exactly what tells the two -remaining hypotheses apart. - -This matches the **documented** definition in the architecture quality table, -which already says `identity_shallow` means *"No body, **missing `objectRef` -identity**"*. The code drifted from it — see [The classifier -divergence](#the-classifier-divergence). - -## Evidence from the cluster - -### The audit policy reported as configured - -```yaml -apiVersion: audit.k8s.io/v1 -kind: Policy -omitStages: - - "RequestReceived" -rules: - - level: None - resources: - - group: "" - resources: ["events", "endpoints", "nodes", "pods", "secrets", "bindings", "componentstatuses", "*/status"] - - group: "authentication.k8s.io" - resources: ["tokenreviews"] - - group: "authorization.k8s.io" - resources: ["subjectaccessreviews", "selfsubjectaccessreviews", "localsubjectaccessreviews", "selfsubjectrulesreviews"] - - group: "coordination.k8s.io" - resources: ["leases"] - - group: "apps" - resources: ["*/status"] - - group: "networking.k8s.io" - resources: ["*/status"] - - level: None - users: ["system:serviceaccount:kube-system:horizontal-pod-autoscaler"] - verbs: ["update", "patch"] - resources: - - group: "apps" - resources: ["*/scale"] - - level: RequestResponse - omitManagedFields: true - verbs: - - create - - update - - patch - - delete - - deletecollection -``` - -Kubernetes audit policy is **first-match-wins**. For a core top-level `pods` -object `create`: - -- Rule 1 has a `GroupResources` entry `group: ""`, `resources: [... "pods" ...]`. - A core pod create matches it. Rule 1 has no `users`/`verbs`/`namespaces` - selectors, so those are wildcards — the match holds. -- First match wins → **`level: None`** → the event is **not generated at all.** - -It never reaches rule 3 (the `RequestResponse` catch-all). So a kube-apiserver -running this exact policy emits **zero** top-level `pods` object audit events of -any level. The captured event is `pods/exec`, which is a separate audit-policy -resource match. The same top-level-resource distinction applies to `secrets`, -`events`, `endpoints`, `nodes`, `bindings`, and the explicit `*/status` -patterns. - -### The metric - -Query: `gitopsreverser_audit_event_quality_total{verb="create", quality!="complete"}` - -``` -gitopsreverser_audit_event_quality_total{ - quality="identity_shallow", resource="pods", version="v1", - source="official", verb="create", - cluster="cozystack", tenant="tenant-root", - pod="gitops-reverser-56f948fdd8-ttrm6", ... -} - min: 34 median: 2127 max: 4116 -``` - -`addQualityMetric` is recorded immediately after classification, before any drop -([audit_handler.go](../../internal/webhook/audit_handler.go#L292)) — so this -counts every such event that actually arrived. Thousands of `official`, -`identity_shallow`, core `v1/pods`, `create` events are reaching the handler. - -## The resolved contradiction - -The policy says **zero top-level pod object events.** The metric says -**thousands of events labeled `resource="pods"` and `verb="create"`**. Both can -describe the same apiserver because the metric does not label -`objectRef.subresource`, while Kubernetes audit policy distinguishes `pods` from -`pods/exec`. - -My earlier draft asserted the cause was a `Metadata`-level policy for pods. That -assertion was unverified and is now retracted. The later H1/H2 split below is -kept as shallow-event analysis, not as the root-cause fork for this flood. - -## Earlier hypotheses - -Before the debug stream captured `objectRef.subresource: exec`, the analysis -split on `objectRef.name`. That split is no longer needed for this flood, but it -records the remaining shallow-event question for top-level resources. - -### H1 — genuine shallow events (the joiner is behaving correctly) - -If the offending `pods/create` events have **empty `objectRef.name`** and empty -bodies, they are *genuine shallow events* by the [recognition -rule](#the-recognition-rule). Something is routing core pod creates through an -aggregated/proxied path where the emitting apiserver cannot see the body. In -that case: - -- The joiner is **right** to wait for an additional body. -- The real gap is that no additional-body source is enriching these — the - `apiservice-audit-proxy` deployment does not cover whatever path this is. -- The warning's advice ("install/repair apiservice-audit-proxy") is *correct*. -- This is **not** a classification bug. - -### H2 — bodyless-but-identified events (a real misclassification) - -If the offending events have a **populated `objectRef.name`** and empty bodies, -they are built-in pod events whose bodies were dropped by an audit policy -(a broad policy auditing pods at `Metadata`, contradicting the pasted one). In -that case: - -- They are *not* shallow — they have full identity. -- The classifier still labels them `identity_shallow` and routes them into the - wait path (see below), so the joiner waits for a body that can never come. -- This **is** a classification bug, and the [proposed fix](#proposed-fix) - applies. - -A debug-level (`V(1)`) log already records `hasRequestObject` / -`hasResponseObject` in `dropShallowOfficial` -([audit_joiner.go](../../internal/webhook/audit_joiner.go#L319)); it does **not** -record `objectRef.name` or `level`. Adding both to that log line is the cheapest -way to settle H1 vs H2 in production. - -## The classifier divergence - -Independent of which hypothesis holds, the classifier does not match its own -documented contract. - -`classifyAuditEventQuality` in -[internal/webhook/audit_joiner.go](../../internal/webhook/audit_joiner.go#L681) -decides quality from body presence and never inspects `objectRef.name` on the -create/update/patch path: - -```go -if hasAuditV1ObjectBody(event) { - return AuditEventQualityComplete -} -if allowsBodylessAuditV1Delete(event) { // delete-only carve-out - return AuditEventQualityBodyShallowDeletable -} -return AuditEventQualityIdentityShallow // <-- everything else bodyless -``` - -`hasAuditV1ObjectBody` only checks `requestObject` / `responseObject`. The only -place `objectRef.name` is consulted is `allowsBodylessAuditV1Delete`, gated on -`verb == "delete"`. So a bodyless **`create`** / `update` / `patch` with a -complete `objectRef` falls through to `identity_shallow` even though it has full -identity — exactly the H2 failure. The architecture doc says `identity_shallow` -requires *missing* `objectRef` identity; the code assigns it on body absence -alone. - -### Contributing history - -Commit `605964a` ("gate audit body joins by rule relevance") added a gate that -dropped shallow officials for resources no `WatchRule` could match — but it -gated on the **wrong axis** (WatchRule relevance, not shallow-vs-identified). -Commit `a688620` then removed that gate entirely to fix an unrelated e2e race. -Neither corrected the classification. A later "louder logging" change then made -the pre-existing behaviour impossible to ignore — which is why the flood appears -to be new even though the misroute (under H2) is older. - -## Impact - -- **Log flood** — one WARN per offending event, on every occurrence (the WARN is - deliberately not gated by `sync.Once`). -- **Throughput cost** — each such event holds the official canonical gate for - the full `--audit-event-body-wait` budget (`500ms`), so later official events - queue behind a wait that is guaranteed to fail. -- **Data loss** — the event is dropped (`audit_shallow_dropped_total`). Under H1 - this means genuinely missing data; under H2 it means a built-in mutation is - silently not mirrored. -- **Possibly misleading advice** — under H2 the "install apiservice-audit-proxy" - WARN points operators at a fix that cannot help. Under H1 it is correct. - -## Proposed fix - -For the confirmed flood: - -1. **Gate every non-empty `objectRef.subresource` at audit ingress.** This - generalizes the previous `status`-only check to current product capability: - subresources are not top-level resource state and are not supported by - WatchRule planning. -2. **Keep a literal `pods/exec` regression event.** The regression must keep - the observed `verb: create`, `subresource: exec`, `responseStatus.code: 101`, - and empty object bodies so the joiner cannot start waiting on it again. - -For top-level bodyless resources, two changes are still worth considering -because they harden diagnosis: - -1. **Log `objectRef.name` and `level`** in `dropShallowOfficial` and in the - `waitForBody` timeout WARN. This settles H1 vs H2 in-cluster without a packet - capture, and is a one-line change. -2. **Revisit whether the classifier contract and docs should key on identity or - body repairability.** The earlier draft proposed tightening - `identity_shallow` - should require `objectRef.name` to be empty **in addition to** both bodies - being empty. That needs its own decision because URL-named aggregated - subresource-free requests can still need body repair. - -If **H2** is confirmed, additionally: - -3. **Gate the official ingress on `level`.** An official event at `level: None` - or `level: Metadata` cannot drive a Git write and has nothing to wait for; it - should be rejected in `classifyAuditIngress` - ([audit_handler.go](../../internal/webhook/audit_handler.go#L597)) before the - joiner, with a rate-limited log pointing at the audit policy — not the proxy. - -If **H1** is confirmed, the classifier is already correct; the work moves to the -deployment side — identifying the path these pod creates take and extending an -additional-body source to cover it. - -None of this needs an `APIResourceCatalog` attribute, `APIService` enumeration, -or extra discovery calls. - -## Deferred top-level shallow-event checks - -The captured `pods/exec` event is enough to explain and gate this flood. If a -separate top-level resource still arrives bodyless after that gate, these checks -would settle whether it is an aggregated-API hollow event or an audit-policy -body gap: - -1. **`objectRef.name` on the top-level event** — empty or populated. This field - decides H1 vs H2 for a subresource-free bodyless event. -2. **The audit configuration the *relevant* kube-apiserver is actually running** - on the CozyStack cluster — the live `--audit-policy-file` / - `--audit-webhook-config-file` flags of the process emitting those events, not - only the ConfigMap or Helm value the policy was pasted from. -3. **Which sender produced those events** — the CozyStack management control - plane, a tenant (Kamaji) control plane, or `apiservice-audit-proxy`. The - `auditID`, `sourceIPs`, and `userAgent` on a sample event will indicate this. -4. **Whether `apiservice-audit-proxy` is deployed** on this cluster and which - endpoint it posts to (`/audit-webhook` vs `/audit-webhook-additional`). - -## Open question - -If H2 is confirmed: what should happen to a bodyless-but-identified -`create` / `update` / `patch` — a built-in resource fully identified but with -bodies stripped by policy? Drop it (treat a thin policy as misconfiguration, -with a rate-limited WARN), or emit it as an identity-only event (the -`body_shallow_deletable` carve-out already does this for `delete`)? Left open -deliberately — it is a design decision, not a classification bug. - -## References - -- [internal/webhook/audit_joiner.go](../../internal/webhook/audit_joiner.go) — - `classifyAuditEventQuality`, `handleOfficial`, `waitForBody`, - `dropShallowOfficial`, `allowsBodylessAuditV1Delete`, `hasAuditV1ObjectBody`. -- [internal/webhook/audit_handler.go](../../internal/webhook/audit_handler.go) — - `classifyAuditIngress`, `auditSourceFromPath`, `addQualityMetric`. -- [docs/architecture.md](../architecture.md#audit-ingestion-pipeline) — the - pipeline and the quality table the code should match. -- [apiservice-audit-proxy README](../../external-sources/apiservice-audit-proxy/README.md) - — aggregated-API hollow vs complete events, and the CozyStack case study. diff --git a/docs/design/stream/signing-snapshot-tail-replay-failure-investigation.md b/docs/finished/signing-snapshot-tail-replay-failure-investigation.md similarity index 98% rename from docs/design/stream/signing-snapshot-tail-replay-failure-investigation.md rename to docs/finished/signing-snapshot-tail-replay-failure-investigation.md index 82e4bf0a..36d111de 100644 --- a/docs/design/stream/signing-snapshot-tail-replay-failure-investigation.md +++ b/docs/finished/signing-snapshot-tail-replay-failure-investigation.md @@ -9,9 +9,9 @@ > attempt 1, commit `113b4bc0224cfc0e5f900e38f877b8676828dfe9`. > > Related: -> [materialization-tail-and-live-readiness-review.md](../../finished/materialization-tail-and-live-readiness-review.md) +> [materialization-tail-and-live-readiness-review.md](materialization-tail-and-live-readiness-review.md) > (Gap 2 / Rec 2), -> [github-e2e-per-type-tail-failure-investigation.md](github-e2e-per-type-tail-failure-investigation.md). +> [github-e2e-per-type-tail-failure-investigation.md](signing-snapshot-tail-replay-failure-investigation.md). > > Scope: why a reconcile-only signing path can still receive per-event commits, > and how the per-target coverage watermark should close that gap. @@ -101,13 +101,13 @@ commit history was not reconcile-only. 1. `DeclareForGitTarget` drives an initial-backfill splice for newly claimed, already-Synced types and then starts the per-type audit tail - ([internal/watch/materialization.go](../../../internal/watch/materialization.go)). + ([internal/watch/materialization.go](../../internal/watch/materialization.go)). 2. `startTypeAuditTail` is idempotent per GVR. If a tail is already running for the type, a later GitTarget joins the existing shared tail; the existing tail keeps its cursor. 3. `applyAuditChangesForType` fans every audit-tail batch to every current GitTarget that watches that GVR and has a registered event stream - ([internal/watch/audit_tail.go](../../../internal/watch/audit_tail.go)). + (internal/watch/audit_tail.go). 4. That fan-out checks: - the GitTarget watches the GVR; - the GitTarget's event stream is registered; @@ -286,7 +286,7 @@ flowchart LR ## 6. Reconciliation With the Readiness Review The readiness review's -[Rec 2 "Implementation note (landed)"](../../finished/materialization-tail-and-live-readiness-review.md) +[Rec 2 "Implementation note (landed)"](materialization-tail-and-live-readiness-review.md) explicitly declined to add a per-`(GitTarget, type)` tail-delivery gate: > The broader "tail does not *deliver* to an un-backfilled target" per-target gate @@ -520,7 +520,7 @@ Today `@{{.Revision}}` is the checkpoint RV, not `Hc`. > **Follow-up (2026-06-15):** the content-convergence claim below ("Present eventually … regardless > of which path delivers it", step 8) was observed to **break** — one `overlap-b` object was > permanently absent under target B. See -> [`signing-overlap-band-coverage-drop-investigation.md`](signing-overlap-band-coverage-drop-investigation.md). +> [`signing-overlap-band-coverage-drop-investigation.md`](signing-snapshot-tail-replay-failure-investigation.md). A ConfigMap E2E is useful, but it should be framed as a user-path guard, not as the only proof of the watermark logic. The red-first proof should be the diff --git a/docs/design/sops-repo-bootstrap-and-key-management-architecture.md b/docs/finished/sops-repo-bootstrap-and-key-management-architecture.md similarity index 100% rename from docs/design/sops-repo-bootstrap-and-key-management-architecture.md rename to docs/finished/sops-repo-bootstrap-and-key-management-architecture.md diff --git a/docs/design/sops-repo-bootstrap-out-of-scope.md b/docs/finished/sops-repo-bootstrap-out-of-scope.md similarity index 100% rename from docs/design/sops-repo-bootstrap-out-of-scope.md rename to docs/finished/sops-repo-bootstrap-out-of-scope.md diff --git a/docs/design/startup-robustness-cert-and-crd-wobble.md b/docs/finished/startup-robustness-cert-and-crd-wobble.md similarity index 99% rename from docs/design/startup-robustness-cert-and-crd-wobble.md rename to docs/finished/startup-robustness-cert-and-crd-wobble.md index 29e6c67c..793bf0fa 100644 --- a/docs/design/startup-robustness-cert-and-crd-wobble.md +++ b/docs/finished/startup-robustness-cert-and-crd-wobble.md @@ -212,7 +212,7 @@ live mirror. B5 is a reasonable interim to keep CI green. > **Steering update (2026-06-11):** B1 will NOT be implemented inside the catalog — the > catalog stays a thin discovery wrapper with no time-sensitive state. The omission-grace > mechanism moves into the typeset registry instead; see -> [typeset-owns-discovery-grace.md](./typeset-owns-discovery-grace.md) for the revised +> [typeset-owns-discovery-grace.md](../spec/typeset-owns-discovery-grace.md) for the revised > plan (B2 lives on there as stage S4). > > **Implemented (same day):** the relocation landed (S1–S3) — the catalog is now a diff --git a/docs/design/stream/streaming-readiness-status-machine-design.md b/docs/finished/streaming-readiness-status-machine-design.md similarity index 92% rename from docs/design/stream/streaming-readiness-status-machine-design.md rename to docs/finished/streaming-readiness-status-machine-design.md index 6965991a..4d39d94b 100644 --- a/docs/design/stream/streaming-readiness-status-machine-design.md +++ b/docs/finished/streaming-readiness-status-machine-design.md @@ -3,13 +3,13 @@ > Status: design · Branch: `investigate` · Date: 2026-06-26 > > Implements the direction in -> [per-type-streaming-readiness-plan.md](./per-type-streaming-readiness-plan.md), +> [per-type-streaming-readiness-plan.md](streaming-readiness-status-machine-design.md), > which fixes -> [watch-replay-watermark-stream-readiness-investigation.md](./watch-replay-watermark-stream-readiness-investigation.md). +> [watch-replay-watermark-stream-readiness-investigation.md](streaming-readiness-status-machine-design.md). > > **Supersedes** the `Synced` condition, the `materialization` counts, and the > `Pending / Initializing / Synced / Degraded` phase set in -> [status-design-git-target.md](../status-design-git-target.md) §3.1–§3.3. Those were +> [status-design-git-target.md](../spec/status-conditions-guide.md) §3.1–§3.3. Those were > designed around an audit-tail checkpoint (`checkpointRV != ""`); watch-first with > cursor resume collapses "has a checkpoint" and "is live" into one transition, so the > two models should not coexist. @@ -69,17 +69,17 @@ stateDiagram-v2 ``` Every trigger already exists in -[target_watch.go](../../../internal/watch/target_watch.go); the machine only *names* +[target_watch.go](../../internal/watch/target_watch.go); the machine only *names* them: - `Replaying → Streaming`: `foldTargetReplayEvent` sees the `initial-events-end` - bookmark ([target_watch.go:414-420](../../../internal/watch/target_watch.go#L414-L420)), + bookmark ([target_watch.go:414-420](../../internal/watch/target_watch.go#L414-L420)), `handleTargetWatchSessionEvent` flips `replaying = false` - ([target_watch.go:380-398](../../../internal/watch/target_watch.go#L380-L398)). + ([target_watch.go:380-398](../../internal/watch/target_watch.go#L380-L398)). - `[*] → Streaming` (resume): `targetWatchResumeAndStream` - ([target_watch.go:299-326](../../../internal/watch/target_watch.go#L299-L326)). + ([target_watch.go:299-326](../../internal/watch/target_watch.go#L299-L326)). - `Streaming → Replaying`: `errTargetWatchExpired` on a `410` - ([target_watch.go:520-525](../../../internal/watch/target_watch.go#L520-L525)). + ([target_watch.go:520-525](../../internal/watch/target_watch.go#L520-L525)). ### 2.3 Reasons @@ -281,10 +281,10 @@ bad-rbac-target True False 4/5 WatchNotPermitted 2m has crossed its `initial-events-end` watermark — or resumed from a durable cursor with the watch open and live routing active — and is routing through `routeLiveTargetWatchEvent` -([target_watch.go:533](../../../internal/watch/target_watch.go#L533)). Any write issued +([target_watch.go:533](../../internal/watch/target_watch.go#L533)). Any write issued to those types **after** observing `StreamsReady=True` is delivered as a live, per-event event and offered to the attribution resolver -([author_resolver.go](../../../internal/watch/author_resolver.go)) — never folded into +([author_resolver.go](../../internal/watch/author_resolver.go)) — never folded into the unattributed baseline. The contract is **"post-gate writes are handled as live events," not "zero lag."** A @@ -331,12 +331,12 @@ Watch-first already made much of the checkpoint machinery vestigial. **Safe to d now:** - `Manager.RestoreSyncedCheckpoint` + `Materializer.RestoreSynced` - ([materialization.go:103-112](../../../internal/watch/materialization.go#L103-L112)) + ([materialization.go:103-112](../../internal/watch/materialization.go#L103-L112)) — self-described "harmless compatibility hook"; watch-first restores nothing. - `GitTargetMaterializationSummary`'s `Failing` / `NotFollowable` / `FailingNoCheckpoint` fields and the 5-count `GitTargetMaterializationStatus` - ([materialization.go:114-141](../../../internal/watch/materialization.go#L114-L141), - [gittarget_types.go:128-159](../../../api/v1alpha3/gittarget_types.go#L128-L159)) + ([materialization.go:114-141](../../internal/watch/materialization.go#L114-L141), + [gittarget_types.go:128-159](../../api/v1alpha3/gittarget_types.go#L128-L159)) — under watch-first `MaterializationSummaryForGitTarget` already computes `Claimed == Synced == len(types)`; the rest is dead. Replace with `streams` (§3.1). - The `Synced` condition, the `Initializing`/`Synced` phases, and the §3.2 @@ -344,11 +344,11 @@ now:** That predicate only existed to stop the ~1h `Synced→Resyncing→Synced` re-anchor from flapping; **watch-first with cursor resume has no periodic full re-anchor**, so the whole anti-flap apparatus is unnecessary — `StreamsReady` flaps only on a real `410`. -- `waitForGitTargetSynced` ([e2e_test.go:235](../../../test/e2e/e2e_test.go#L235)) → +- `waitForGitTargetSynced` ([e2e_test.go:235](../../test/e2e/e2e_test.go#L235)) → `waitForStreamsReady`. **Bigger collapse — evaluate, don't blind-delete:** the `Materializer` `Phase` enum -([materializer.go:57-78](../../../internal/typeset/materializer.go#L57-L78)) has six +([materializer.go:57-78](../../internal/typeset/materializer.go#L57-L78)) has six checkpoint phases. The **demand/claim/followability** half is still needed (it decides *which* types to watch and feeds the `Blocked` state); the **checkpoint** half (`Syncing`/`Resyncing`/`Failing` + `checkpointRV` + `RestoreSynced`) maps onto the diff --git a/docs/design/tilt-playground-plan.md b/docs/finished/tilt-playground-plan.md similarity index 100% rename from docs/design/tilt-playground-plan.md rename to docs/finished/tilt-playground-plan.md diff --git a/docs/design/watch-first-ingestion-architecture.md b/docs/finished/watch-first-ingestion-architecture.md similarity index 99% rename from docs/design/watch-first-ingestion-architecture.md rename to docs/finished/watch-first-ingestion-architecture.md index 9d47d040..3f548ccb 100644 --- a/docs/design/watch-first-ingestion-architecture.md +++ b/docs/finished/watch-first-ingestion-architecture.md @@ -5,8 +5,8 @@ > > Related: > [Current architecture](../architecture.md), -> [Mutation Capture Lab](mutation-capture-lab-design.md), -> [API-source-of-truth reconcile](../finished/api-source-of-truth-reconcile.md), +> [Mutation Capture Lab](../spec/mutation-capture-lab-design.md), +> [API-source-of-truth reconcile](../architecture.md), > [Mutation lab corpus](../../test/mutationlab/corpus/), > [Mutation lab README](../../test/mutationlab/README.md) @@ -403,7 +403,7 @@ raw-watch ingestion plus a small attribution index and RV-resume cursor. | [internal/reconcile](../../internal/reconcile/) | **KEEP** | `GitTargetEventStream` is the per-GitTarget seam the design leans on. | | [internal/watch](../../internal/watch/) | **KEEP core, gut LIST/checkpoint half** | Keep discovery/catalog, `event_router`, `type_lifecycle`, `scope_resolve`, `watched_type_table`. Promote `watch_state.go`/`watch_compare.go` to the real path. Cut the `materialization.go` phase machine, `audit_tail.go`, `splice_snapshot.go`, `target_type_watermark.go`, and the heavy Redis objects-snapshot write in `type_objects_mirror.go` — but **keep that file's `sendInitialEvents` watch as the replay/resume path**, swapping the snapshot write for a tiny `(GVR,scope)→RV` cursor. | | [internal/queue](../../internal/queue/) | **CUT ~90%** | Delete `redis_bytype_queue`, `redis_type_splice`, `redis_objects_snapshot`, `redis_audit_queue`, `redis_watch_splice`, `redis_watch_stream`, `subresource_translate`. Keep only the attribution-fact pieces (`commitrequest_author` folds into the new index). | -| [internal/gate](../../internal/gate/) | **CUT** | Demand-gating existed to bound the per-type mirror. No mirror, no gate. | +| internal/gate | **CUT** | Demand-gating existed to bound the per-type mirror. No mirror, no gate. | | [internal/webhook](../../internal/webhook/) | **SHRINK hard** | `audit_joiner.go` (body-joining) → **gone**. `audit_handler.go` → shrinks to fact extraction → index. `admission_allow_handler.go` stays as the future-policy seam. | | [internal/auditutil](../../internal/auditutil/) | **SHRINK** | Keep only what feeds attribution facts. | | giteaclient, ssh, sshsig, telemetry, types, rulestore, mutationlab | **KEEP** | Provider/credential/signing/metrics/test infra, all source-agnostic. | diff --git a/docs/finished/watch-gvr-resolution-cleanup.md b/docs/finished/watch-gvr-resolution-cleanup.md deleted file mode 100644 index 55eaf12d..00000000 --- a/docs/finished/watch-gvr-resolution-cleanup.md +++ /dev/null @@ -1,157 +0,0 @@ -# Cleanup Plan: Dead Code After `APIResourceCatalog` - -## Context - -Commit `aa2e463` introduced `APIResourceCatalog` and `RuleGVRResolver` as the -single source of truth for turning a `WatchRule` into concrete GVRs. It added -~1580 lines and removed ~382. Several pre-catalog mechanisms are now logically -dead: they still compile and are still reachable through a live call chain, so -the `unused` linter stays quiet, but their behaviour is now impossible to reach. - -This plan removes that dead code. It is pure cleanup — no behaviour change is -intended. Each item below states why it is dead and what evidence confirms it. - -Unrelated correctness nits found during review (discovery refresh has no -debounce/TTL, wrong-scope resources report as `NotServed`, stale -`ResourcesResolved` condition on non-success paths) are **out of scope** here and -tracked separately. - -## Removal items - -### 1. Delete `internal/watch/discovery.go` - -`FilterDiscoverableGVRs` is redundant. `RuleGVRResolver.Resolve` already returns -only entries that pass `Allowed && !Subresource && Supports("list","watch")` -(`rule_gvr_resolver.go` `gvrsForCandidates`) and `filterScope`. -`FilterDiscoverableGVRs` re-applies the identical predicate against the same -catalog, and calls `RefreshAPIResourceCatalog` a second time in one reconcile -(`ReconcileForRuleChange` already refreshed). - -Actions: - -- Remove `FilterDiscoverableGVRs`. -- In `ReconcileForRuleChange`, drop the `filter` / `m.discoveryFilter` - indirection and pass `requestedGVRs` straight to `compareGVRs`. -- Remove the `discoveryFilter` field from `Manager` (`manager.go`). -- Relocate the still-used helpers so the file can be deleted: - - `parseGroupVersion`, `groupVersion`, `key`, `groupVersionSplit`, - `matchesScope` → `api_resource_catalog.go` (catalog/resolver helpers). - - `restConfig()` → `manager_catalog.go` (with the rest of the discovery - wiring). -- Delete `internal/watch/discovery.go`. - -Test impact: `discovery_integration_test.go` calls `FilterDiscoverableGVRs` -directly and stubs `discoveryFilter`; `rule_change_snapshot_test.go` stubs -`discoveryFilter` to force `compareGVRs` to see zero GVRs. Both must be reworked -to control `requestedGVRs` instead (empty RuleStore or empty catalog). See -[Test impact](#test-impact). - -### 2. Delete `internal/watch/resource_filter.go` - -`shouldIgnoreResource` is now a no-op (`return false`). The real exclusion list -moved to `resource_policy.go` (`isDefaultResourceExcluded` / `allowedResource`), -surfaced on `APIResourceEntry.Allowed`. - -Actions: - -- Remove the dead `shouldIgnoreResource` call sites — `manager.go` - `listResourcesForGVR` and `informers.go` — both are unreachable branches. -- Delete `internal/watch/resource_filter.go` and - `internal/watch/resource_filter_test.go` (the test exercises a no-op). - -### 3. Remove dead helpers from `internal/watch/gvr.go` - -`singleConcrete` and `addGVR` are not used by any production code — the new -`gvrFromCompiledRule` / `gvrFromClusterRule` go through `RuleGVRResolver`. They -are kept compiling only by `helpers_test.go`. `addGVR` also calls the dead -`shouldIgnoreResource` from item 2. - -Actions: - -- Remove `singleConcrete` and `addGVR` from `gvr.go`. -- Remove their tests from `helpers_test.go`. - -### 4. Remove the unavailable-GVR retry machinery from `internal/watch/manager.go` - -This subsystem existed to handle "a requested GVR is not discoverable yet (CRD -not installed) — track it and retry discovery." That state can no longer occur. - -Evidence it is dead: - -- `requestedGVRs` (from `computeRequestedGVRs` → `RuleGVRResolver.Resolve`) only - ever contains catalog-validated GVRs (`Allowed`, listable, watchable, - scope-correct). -- `discoverableGVRs` is `FilterDiscoverableGVRs(requestedGVRs)`, which applies - the same predicate against the same catalog — so - `discoverableGVRs == requestedGVRs` in every non-race case. -- Therefore `processRequestedGVRs` always takes the `handleAvailableGVR` branch, - `newlyUnavailable` is always empty, `scheduleRetries` never spawns a goroutine, - and `unavailableGVRs` / `unavailableGVRsLastTry` stay empty for the process - lifetime. -- A genuinely unserved resource is now a `ResolveMiss(NotServed)` and never - becomes a GVR, so the "requested but not discoverable" case is structurally - impossible. - -The retry behaviour is already replaced — and improved: - -- CRD and `APIService` trigger informers (`startAPISurfaceTriggerInformers`) - signal `catalogRefreshCh` on any add/update/delete, driving an event-paced - `ReconcileForRuleChange`. This picks up a freshly installed CRD faster than - the old fixed 2s retry poll. -- The 30s `periodicReconcileInterval` ticker is the backstop for missed signals - and built-in API changes. - -Actions — remove from `manager.go`: - -- Functions: `updateUnavailableGVRTracking`, `initializeUnavailableMaps`, - `buildDiscoverableSet`, `processRequestedGVRs`, `handleAvailableGVR`, - `handleUnavailableGVR`, `handleNewlyUnavailableGVR`, - `handlePreviouslyUnavailableGVR`, `calculateRetryDelay`, - `cleanupUnrequestedGVRs`, `isGVRRequested`, `scheduleRetries`, - `retryDiscoveryAfterDelay`. -- Fields: `unavailableGVRsMu`, `unavailableGVRs`, `unavailableGVRsLastTry`. -- Constants: `crdDiscoveryRetryInterval`, `crdDiscoveryMaxRetries`, - `maxRetryShift`. -- The call site `m.updateUnavailableGVRTracking(...)` in - `ReconcileForRuleChange`. - -Keep (still core to informer diffing): `compareGVRs`, -`buildDesiredGVRNamespaces`, `findAddedGVRs`, `hasNewNamespaces`, -`findRemovedGVRs`, `getNamespacesForGVRUnlocked`, and -`periodicReconcileInterval`. - -Minor residual risk: a CRD object can appear in discovery slightly before its -resource endpoints are fully served. The trigger informer's `UpdateFunc` fires -on the CRD `Established`-condition transition, so the catalog re-refreshes -within seconds; the 30s periodic reconcile is the final backstop. No dedicated -retry timer is needed. - -## Test impact - -- `discovery_integration_test.go` — calls `FilterDiscoverableGVRs` directly and - uses the `discoveryFilter` seam. Rework to assert on `ComputeRequestedGVRs` - output directly, or remove if fully subsumed by `rule_gvr_resolver_test.go`. -- `rule_change_snapshot_test.go` — replace the `discoveryFilter` stub with an - empty RuleStore (or empty catalog) to produce zero requested GVRs. -- `resource_filter_test.go` — deleted with item 2. -- `helpers_test.go` — drop the `singleConcrete` / `addGVR` tests (item 3). -- No test references the item 4 machinery, so its removal needs no test rework - beyond confirming the suite still builds. - -## Sequencing - -1. Item 3 (`gvr.go` helpers) — smallest, self-contained. -2. Item 2 (`resource_filter.go`) — removes the no-op and its call sites. -3. Item 4 (unavailable-GVR machinery) — largest, but isolated; no test rework. -4. Item 1 (`discovery.go`) — last, because it carries the test-seam rework. - -Each step should leave `task test` green on its own. - -## Validation - -`task fmt` → `task generate` → `task manifests` → `task vet` → `task lint` → -`task test` → `task test-e2e` (e2e sequentially; Docker required). - -Expected net effect: one focused cleanup commit, several hundred lines removed, -no behaviour change. The quickstart e2e regression fix from `aa2e463` must stay -green throughout. diff --git a/docs/finished/watch-list-checkpoint-plan.md b/docs/finished/watch-list-checkpoint-plan.md deleted file mode 100644 index 02229b32..00000000 --- a/docs/finished/watch-list-checkpoint-plan.md +++ /dev/null @@ -1,169 +0,0 @@ -# WATCH-first checkpoint materialization - -> Status: IMPLEMENTED on `poc/redis-copy` (2026-06-13). `mirrorTypeObjects` now prefers a -> WATCH-first streaming-list (`streamTypeObjects`) with the consistent `LIST` -> (`listTypeObjects`) as fallback; the bookmark RV pins the checkpoint and a partial watch never -> marks a type `Synced`. A `~60s` stream deadline (`streamCheckpointTimeout`) backstops a backend -> that accepts the watch but never emits the `initial-events-end` bookmark. The process-local -> "GVR requires LIST" cache from the plan below is deliberately deferred (the plan called it -> optional for the first cut). -> Scope: `internal/watch/mirrorTypeObjects`, the demand-driven per-type checkpoint fill. -> Related: -> [materialization-tail-and-live-readiness-review.md](./materialization-tail-and-live-readiness-review.md) -> Rec 6, -> `audit-log-ingestion-and-ordering.md`, -> [../upgrade-finding.md](../design/upgrade-finding.md). - -## Goal - -Replace the current checkpoint `LIST` with a small WATCH-first path using Kubernetes streaming-list -semantics: - -```text -watch=true -sendInitialEvents=true -resourceVersionMatch=NotOlderThan -allowWatchBookmarks=true -``` - -The checkpoint still produces the same output as today: complete objects for one GVR stored through -`ReplaceTypeObjects`, plus the revision `R` that the `Materializer` records as `Synced`. - -The important rule: **keep the existing consistent `LIST` as fallback**. WATCH-first is an -efficiency and cleaner-anchor improvement, not a reason to stop serving clusters or aggregated APIs -that do not implement streaming-list correctly. - -This plan assumes a recent Kubernetes API server. We are not designing compatibility for old -kube-apiserver versions that predate streaming-list support; the fallback exists for non-conformant -extension/proxy paths in otherwise supported clusters. - -## Current Path - -`runTypeCheckpointSync` calls `mirrorTypeObjects`, which currently does a plain dynamic-client list: - -```go -list, err := dc.Resource(gvr).List(ctx, metav1.ListOptions{}) -``` - -That is correct but heavier for large tracked types. It also pins the checkpoint to the collection -`resourceVersion` from the LIST, rather than to the `initial-events-end` bookmark used by -streaming-list mode. - -## Proposed Shape - -Keep `mirrorTypeObjects` as the public orchestration point, but split the fill into two helpers: - -```text -mirrorTypeObjects - ├─ streamTypeObjects(ctx, gvr) # preferred - └─ listTypeObjects(ctx, gvr) # fallback and existing behavior -``` - -`streamTypeObjects` should: - -1. Open `dc.Resource(gvr).Watch(ctx, metav1.ListOptions{...})` with: - - `SendInitialEvents: ptr.To(true)` - - `ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan` - - `AllowWatchBookmarks: true` -2. Fold initial `ADDED` events into the same `map[string]string` written today. -3. Stop only when it receives a bookmark with - `metadata.annotations["k8s.io/initial-events-end"] == "true"`. -4. Use that bookmark object's `resourceVersion` as checkpoint revision `R`. -5. Return `(items, R, nil)` to `mirrorTypeObjects`. - -The live events after the bookmark are intentionally ignored by this helper. Freshness after `R` -continues to belong to the Redis audit tail and the periodic/heal reconcile path. - -## LIST Fallback - -Fallback to the existing LIST path when WATCH-first cannot prove it has a complete initial set. - -Fallback triggers: - -- the server rejects `sendInitialEvents` / `resourceVersionMatch=NotOlderThan`; -- the server rejects or closes the watch before the initial-events-end bookmark; -- the watch times out before the initial-events-end bookmark; -- the returned watch stream contains malformed objects that make the initial set untrustworthy. - -Do not fallback on ordinary context cancellation or shutdown. That should end the checkpoint sync. - -Keep the fallback local to this checkpoint attempt. A process-local cache of "GVR requires LIST -fallback" is useful but optional for the first cut; it can avoid paying the watch timeout on every -hourly re-anchor for a known non-conformant type. - -## Which Types Need This - -WATCH-first is useful for any type with many tracked objects, because it avoids forcing the apiserver -and controller through one large list response on every checkpoint/re-anchor. The most likely wins -are: - -- `configmaps` and `secrets` when watched across busy namespaces; -- CRDs with many instances; -- cluster-scoped inventory-like types when a `ClusterWatchRule` follows them; -- aggregated API resources that correctly implement streaming-list. - -The fallback is primarily for: - -- aggregated API servers with hand-written `Watch` implementations that do not emit the - `k8s.io/initial-events-end` bookmark; -- APIService/proxy paths that pass normal watch events but reject or mishandle - `sendInitialEvents`. - -Standard kube-apiserver-backed resources, including normal built-ins and CRDs, should be expected to -take the WATCH-first path. Aggregated APIs are the risk surface. This matches the production warning -captured in [upgrade-finding.md](../design/upgrade-finding.md): client-go can wait forever for the special -bookmark if an aggregated backend never emits it. - -## Tests - -Unit tests should not rely on the dynamic fake client magically supporting streaming-list. Add a -small test seam instead: - -- a fake watcher that emits existing objects as `ADDED`, then a bookmark annotated with - `k8s.io/initial-events-end`; -- a fallback test where the watch returns an unsupported/rejected error and `listTypeObjects` is used; -- a timeout/closed-before-bookmark test proving the checkpoint does not mark the type `Synced` from a - partial watch result unless the LIST fallback succeeds; -- a regression test that the stored checkpoint revision is the bookmark RV, not the last object RV. - -E2E plan: - -1. Add a focused case to the existing `aggregated-api` lane or a new `watch-list-checkpoint` label. -2. Pre-create two resources before applying the WatchRule. -3. Apply the WatchRule/GitTarget and wait for `GitTarget` `Synced=True`. -4. Assert both pre-created resources are present in Git from the reconcile commit. -5. For fallback coverage, use the existing Wardle aggregated API if it cannot produce the - initial-events-end bookmark; otherwise keep fallback coverage at unit/integration level unless we - add a deliberately non-conformant test APIService. - -The E2E should prove the real-apiserver happy path. The fallback path is better covered with a -controlled fake watcher unless the test cluster intentionally installs a broken aggregated API. - -## Observability - -Each completed fill reports which path it took, so the fallback surface is visible without -guessing per cluster (support is per-API-path, not per-cluster — an aggregated backend can fail -streaming-list while the core apiserver supports it): - -- **Metric** — `gitopsreverser_materialization_checkpoint_fills_total{path="watch"|"list"}`, a - low-cardinality counter (2 series). A rising `list` share is the fallback surface; the - fallback rate is `list / (watch + list)`. Pair it with the log line below to find the type. -- **Log** — `objects-mirror: snapshot loaded ... path=watch|list` per GVR on every fill; the - reason for a fallback is logged at `-v=1`: `objects-mirror: WATCH-first unavailable, falling - back to LIST reason=...`. - -Operators can also confirm a cluster's support directly: the server-side feature gate via -`kubectl get --raw /metrics | grep -i watchlist` (expects -`kubernetes_feature_enabled{name="WatchList"} 1`), or an empirical probe of one resource for the -`k8s.io/initial-events-end` bookmark. The `WatchList` gate is alpha in Kubernetes 1.27 and beta -(on by default) from 1.32. - -## Acceptance Criteria - -- `mirrorTypeObjects` prefers WATCH-first and stores the same object envelope format as today. -- A successful watch-list pins `R` from the `initial-events-end` bookmark. -- A non-conformant watch path falls back to the existing LIST behavior. -- No checkpoint is marked `Synced` from a partial watch. -- Existing reconcile/tail behavior is unchanged after the checkpoint lands. -- Each fill reports its path via `gitopsreverser_materialization_checkpoint_fills_total{path}` - and the per-GVR `snapshot loaded ... path=` log line. diff --git a/docs/finished/watchrule-gvr-resolution-plan.md b/docs/finished/watchrule-gvr-resolution-plan.md deleted file mode 100644 index 1a88df00..00000000 --- a/docs/finished/watchrule-gvr-resolution-plan.md +++ /dev/null @@ -1,367 +0,0 @@ -# Implementation Plan: WatchRule GVR Resolution - -## Error - -CI run `26272823512` failed on `E2E (quickstart)` (`E2E (full)` was canceled by -fail-fast). The quickstart test timed out after 180s waiting for a ConfigMap -snapshot file that was never written. The controller log showed: - -```text -aborting cluster snapshot ...: failed to list /v1, Resource=deployments: - the server could not find the requested resource -``` - -The quickstart `WatchRule` template (`test/e2e/templates/watchrule.tmpl`) uses -bare resource names: - -```yaml -rules: -- resources: ["deployments", "services", "configmaps", "secrets"] -- resources: ["ingresses"] -``` - -The failure comes from inconsistent rule expansion: - -- The informer planner in `internal/watch/gvr.go` defaults omitted `apiGroups` - to core and omitted `apiVersions` to `v1`. -- The snapshot planner in `internal/watch/manager.go` does the same. -- `deployments` is served from `apps/v1`, not core `/v1`. - -That bad expansion has two effects: - -1. The informer path plans `/v1/deployments`, then discovery filtering silently - drops the wrong GVR. The requested deployment watch never starts. -2. The snapshot path tries to list `/v1/deployments`. Since commit `48e7d9d` - snapshot list failures abort instead of being logged and skipped, one bad GVR - prevents the snapshot for every other resource on that GitTarget. - -Commit `48e7d9d` made an existing resolution bug visible. Its stricter snapshot -behavior is still correct for a served resource that fails to list: a partial -object snapshot looks like deletions to the Git mirror. - -## Status - -Implemented. `APIResourceCatalog` and `RuleGVRResolver` landed in commit -`aa2e463`; the pre-catalog discovery code they replaced was removed in the -follow-up cleanup (see -[`watch-gvr-resolution-cleanup.md`](./watch-gvr-resolution-cleanup.md)). This -document is retained as the design record. - -## Requirements - -### Keep bare resource rules working - -The existing WatchRule style must work again: - -```yaml -rules: -- resources: ["deployments"] -``` - -On a normal cluster that rule should resolve to the served Deployment resource, -for example `apps/v1/deployments`. It must not be rewritten to core -`/v1/deployments` just because `apiGroups` and `apiVersions` were omitted. - -`WatchRule` and `ClusterWatchRule` use a rule shape inspired by Kubernetes -resource trigger rules such as audit -[`PolicyRule` and `GroupResources`](https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/#audit-k8s-io-v1-PolicyRule). -GitOps Reverser defines omitted fields for its rules as: - -- Omitted `apiGroups` means all groups. -- Explicit `apiGroups: [""]` means the core API group. -- Omitted `apiVersions` means all versions. -- Explicit group and version selections remain constraints. -- `resources` entries are resource names, not guesses about group or version. - -The exception is ambiguity. If more than one served API group exposes a resource -named `deployments`, the bare rule no longer identifies one resource type. The -resolver must report the matching groups and require the user to set -`apiGroups` explicitly instead of choosing one. - -This choice must be documented on the WatchRule and ClusterWatchRule CRD fields -as part of the implementation. It is not safe to rely on readers inferring it -from generic Kubernetes `apiGroups` conventions. - -### Resolve one concrete watch target safely - -Snapshot and informer planning need concrete GVRs. Resolution from a rule to -concrete GVRs must be consistent across: - -- informer GVR planning, -- snapshot GVR planning, -- namespace planning for namespaced WatchRules, -- WatchRule and ClusterWatchRule status feedback. - -For an omitted-group resource declaration: - -- One matching served resource type resolves to that resource type. -- No matching resource type in a trusted lookup scope is `NotServed`. -- More than one matching served resource type is `Ambiguous`. -- A degraded lookup scope that could change the answer is - `DiscoveryDegraded`. - -Ambiguous bare resource names must fail resolution with actionable feedback -instead of choosing arbitrarily. The resolver should report every matching -group it found and ask the user to set `apiGroups` explicitly. The ambiguous -rule is not tracked until it is made specific; previously tracked files may be -deleted by the next authoritative reconcile. - -### Keep destructive snapshots trustworthy - -The Kubernetes API server is authoritative for: - -- which resource types are currently served, -- the object state returned for a served resource type. - -Those two decisions have different failure modes: - -- If a resource type is absent from the trusted API resource catalog, it is no - longer tracked. -- If a resource type is present in the trusted catalog but its object `List()` - fails, the snapshot must abort. Returning the other objects would produce a - partial cluster view. - -The source used for served resource types must therefore retain trust at the -group/version level. A discovery failure for one aggregated API must not turn -absence from that failed group/version into `NotServed` or delete unrelated Git -files, and it must not prevent cleanly discovered groups from resolving. - -## Single Source Of Truth - -### Proposed name: `APIResourceCatalog` - -Create a shared `APIResourceCatalog` in `internal/watch`. - -This name is deliberate: - -- `APIResource` matches the Kubernetes discovery vocabulary and the data shape - carried by `metav1.APIResource`. -- `Catalog` says this is an indexed view of resource types, not a snapshot of - live Kubernetes objects. -- It avoids overloading `inventory`, which this project already uses near object - snapshots and reconciliation state. - -The catalog is GitOps Reverser's in-memory view of the trusted Kubernetes API -surface. Rule resolution should read from it instead of each caller performing -its own discovery lookup or applying its own core `/v1` defaults. - -The detailed discovery model, refresh triggers, trust rules, and -streaming-list note live in -[`kubernetes-api-resource-catalog.md`](../design/kubernetes-api-resource-catalog.md). - -### Catalog responsibilities - -`APIResourceCatalog` should: - -- Build the first catalog from Kubernetes discovery with per-group/version trust. -- Retain concrete resource entries by GVR and GVK-related metadata. -- Preserve preferred-version information for rules that need one concrete GVR - from an omitted or wildcard version declaration. -- Expose indexed lookup by resource name, group/resource, and concrete GVR. -- Expose filtered views for resources that GitOps Reverser can list and watch. -- Refresh when the API surface may have changed. -- Track discovery confidence per group/version so lookups can distinguish a - cleanly discovered absence from a degraded discovery gap. -- Preserve the last trusted entries for failed group/versions across refreshes. - -Catalog refresh triggers should include CRD and `APIService` changes plus a -recovery path for missed or non-object signals. Those watches invalidate the -catalog; discovery rebuilds the replacement catalog. - -### Catalog entry shape - -A catalog entry needs at least: - -```text -APIResourceEntry - GVR: group, version, resource - GVK: group, version, kind - Namespaced: bool - Verbs: set[string] - Preferred: bool - Subresource: bool - Allowed: bool -``` - -The catalog can keep the full served API surface and let callers request -operation-specific candidates. Current WatchRule resource planning should ignore -subresources and require the `list` and `watch` verbs where live watch planning -needs them. - -`Allowed` is GitOps Reverser policy, not Kubernetes discovery state. The current -built-in exclusion list in `internal/watch/discovery.go` should initialize that -policy bit until the policy is redesigned or made configurable. A default -excluded resource should still remain present in the catalog as served; it -should resolve as explicitly disallowed instead of silently looking -undiscovered. - -Full-version discovery and preferred-version selection may require more than one -discovery view. If the catalog uses `ServerGroupsAndResources()` for all served -versions, it must merge preferred-version data from group or preferred-resource -discovery and apply the same degraded group/version handling to that merge. - -## Rule Resolver - -Add a catalog-backed rule resolver over `APIResourceCatalog`. - -Working names: - -- `APIResourceCatalog` for the trusted API-surface data. -- `RuleGVRResolver` for the resolver that applies WatchRule semantics to that - catalog. - -`RuleGVRResolver` should return concrete GVRs and structured misses: - -```text -Resolve(ruleGroups, ruleVersions, resource) -> ([]GVR, []ResolveMiss) -ResolveMiss - Resource - Reason - Detail -``` - -Initial miss reasons: - -| Reason | Meaning | -|---|---| -| `NotServed` | No resource type in the trusted catalog matches the declaration | -| `Ambiguous` | An omitted-group resource name matches more than one served resource type | -| `Disallowed` | The resource type is served but GitOps Reverser policy excludes it | -| `WildcardGroup` | Planning cannot yet expand an explicit `"*"` group safely | -| `WildcardResource` | Planning cannot yet expand an explicit `"*"` resource safely | -| `CatalogUnavailable` | No resolver source is ready for a lookup that needs API discovery | -| `DiscoveryDegraded` | The relevant group/version discovery state is not trusted enough to return `NotServed` | - -Expected resolution behavior: - -| Declaration | Behavior | -|---|---| -| Concrete group and concrete version | Validate and use the matching catalog resource | -| Explicit core group `""` | Search only the core group | -| Omitted group | Search all served groups for the named resource | -| Omitted version or version `"*"` | Choose the catalog's preferred served version for the resolved group/resource | -| Multiple resource-name matches across groups | Return `Ambiguous` and require explicit `apiGroups` | -| Matching resource with `Allowed=false` | Return `Disallowed`; do not collapse policy exclusion into `NotServed` | - -## Implementation Work - -### 1. Add `APIResourceCatalog` - -- Add the catalog in `internal/watch`. -- Replace the current point discovery index with catalog construction and lookup. -- Build from discovery across served group/versions, retain preferred-version - information, and track refresh trust per group/version. -- Add API-surface refresh triggers and a refresh path that re-runs rule planning - after a catalog generation changes trusted entries. - -### 2. Add `RuleGVRResolver` - -- Resolve WatchRule and ClusterWatchRule resource declarations against the - catalog. -- Remove the naive omitted-group-to-core and omitted-version-to-`v1` defaults. -- Keep unresolved results structured so snapshot planning and status reporting - do not parse strings. - -### 3. Wire snapshot planning - -`GetClusterStateForGitDest` should plan snapshot GVRs through the resolver. - -- `NotServed`, `Ambiguous`, and `Disallowed` resource declarations are recorded - and omitted from the planned resource types under the API-server-authoritative - model. -- `WildcardGroup` and `WildcardResource` still abort until the resolver can - expand those wildcard forms without a partial view. -- Object list failure for any planned served GVR still aborts the snapshot. - -### 4. Wire informer planning - -`ComputeRequestedGVRs` should use the same resolver. - -- Bare declarations such as `deployments` and `ingresses` resolve to their - served non-core GVRs. -- The discovery filter becomes a catalog-backed safety filter or is removed if - resolution already proves the same contract. -- The namespace-planning matchers in `manager.go` must use the same omitted - group/version semantics. Otherwise a namespaced WatchRule that resolves to a - non-core GVR can accidentally fall back to cluster-wide informer planning. - -### 5. Surface resource resolution status - -The WatchRule and ClusterWatchRule controllers should report resource resolution -after dependency validation: - -- Add a `ResourcesResolved` condition. -- Use `Resolved` and `UnresolvedResources` reasons. -- Keep `Ready` focused on GitTarget/GitProvider wiring. A rule with resolved and - unresolved resources can still be `Ready=True` while reporting degradation in - `ResourcesResolved`. -- Emit warning events for unresolved resource declarations with precise reasons. -- Surface `Disallowed` as policy feedback so a served resource excluded by - defaults or later configuration is not reported as missing from Kubernetes. -- Re-evaluate resource status when a catalog generation changes trusted - resolution. -- Requeue unresolved resources as a retry fallback while catalog refresh signals - settle or are degraded. - -Example feedback: - -```text -"ingresses": not served by any API group -"widgets": ambiguous resource name; set apiGroups to one of ["team-a.example.io", "team-b.example.io"] -"jobs": served as "batch/v1/jobs" but excluded by GitOps Reverser watch policy -``` - -Optional follow-up: add structured `status.unresolvedResources` data and a -printcolumn if plain `kubectl get watchrule` should expose resolution health. - -## Tests - -- Unit — `APIResourceCatalog`: builds complete lookup indexes, records - preferred versions, rejects subresource candidates for current watch planning, - records built-in watch exclusions as `Allowed=false`, - preserves last trusted entries for failed group/versions across refreshes, and - distinguishes cleanly discovered absence from degraded discovery. -- Unit — `RuleGVRResolver`: omitted group resolves `deployments` to `apps/v1`; - explicit core group stays core; missing resource returns `NotServed`; multiple - group matches return `Ambiguous`; a served policy exclusion returns - `Disallowed`; unsupported wildcard forms return their explicit miss reasons. -- Unit — catalog unavailable: snapshot and informer planning fail closed before - the catalog can answer a lookup. -- Unit — snapshot: a not-served catalog miss does not reach object `List()`; an - object list failure on a planned served GVR still aborts. -- Unit — informer planning: a bare namespaced WatchRule resolved to a non-core - GVR still plans namespace-scoped informers for the WatchRule namespace. -- Unit — controller: unresolved resources produce the `ResourcesResolved=False` - condition and warning feedback. -- E2E — keep `test/e2e/templates/watchrule.tmpl` bare and assert deployment and - ingress snapshots appear, not only core ConfigMap snapshots. -- Regression — keep the `48e7d9d` wildcard snapshot coverage passing. - -## Files Touched - -| File | Change | -|---|---| -| `internal/watch/discovery.go` and new catalog files | Build and refresh `APIResourceCatalog` | -| `internal/watch/gvr.go` | Resolve informer GVR planning from the shared resolver | -| `internal/watch/manager.go` | Resolve snapshot and namespace planning from the shared resolver | -| `internal/controller/watchrule_controller.go` | Resource resolution condition and warning feedback | -| `internal/controller/clusterwatchrule_controller.go` | Same for ClusterWatchRule | -| `api/v1alpha3/watchrule_types.go`, `clusterwatchrule_types.go` | Document omitted-group semantics; optional structured unresolved-resource status | -| `internal/watch/*_test.go`, `internal/controller/*_test.go`, `test/e2e/*` | Coverage above | - -## Sequencing - -1. Implement `APIResourceCatalog` with per-group/version trust, refresh - triggers, and catalog tests. -2. Implement `RuleGVRResolver` and resolver tests over the catalog. -3. Wire snapshot planning so the quickstart regression stops listing the wrong - GVR. -4. Wire informer and namespace planning so bare non-core resources are actually - watched. -5. Add WatchRule and ClusterWatchRule resource-resolution feedback. -6. Add optional structured status only after the core behavior is stable. - -## Validation - -`task fmt` → `task generate` → `task manifests` → `task vet` → `task lint` → -`task test` → `task test-e2e` (e2e commands run sequentially; Docker required). diff --git a/docs/finished/wildcard-ci-failure-findings.md b/docs/finished/wildcard-ci-failure-findings.md deleted file mode 100644 index fbc65f60..00000000 --- a/docs/finished/wildcard-ci-failure-findings.md +++ /dev/null @@ -1,293 +0,0 @@ -# Wildcard re-add — CI failure findings - -Investigation of the red `main` builds following commit -`8e1b3ab` ("fix: readds support for wildcards"). Two **distinct** failure -signatures showed up across two consecutive `main` runs. They have different -root causes and should be tracked separately. - -| | Run A | Run B | -|---|---|---| -| CI run | [`26848671083`](https://github.com/ConfigButler/gitops-reverser/actions/runs/26848671083) | [`26850118478`](https://github.com/ConfigButler/gitops-reverser/actions/runs/26850118478) | -| Commit | `8e1b3ab` — *fix: readds support for wildcards* | `0945809` — *chore(main): release gitops-reverser 0.27.1 (#162)* | -| Failed job | E2E (full) | E2E (full) | -| Result | 1 failed | 5 failed / 14 skipped | -| Signature | GitTarget isolation regression | Controller-availability cascade (WatchRules never reach `Ready`) | -| Determinism | **Deterministic** — reproduced locally | Looks like a timing/bootstrap race — not yet confirmed deterministic | -| Wildcard *expansion* test itself | **passed** | failed (collateral of the cascade) | - -Context: every `main` build before `8e1b3ab` was green; `8e1b3ab` is the first -red one. The wildcard *feature* (expansion across core + custom namespaced APIs) -works in both runs where the controller was healthy — what broke is elsewhere. - ---- - -## Failure A — GitTarget isolation regression (deterministic) - -### Symptom - -Spec: **`Manager GitTarget Isolation › keeps target A's commits as events while -target B's rules churn`** — [test/e2e/gittarget_isolation_e2e_test.go:143](../test/e2e/gittarget_isolation_e2e_test.go#L143). - -``` -Timed out after 30s. -target A's commit for iso-cm-N must be a [CREATE] event commit -Expected : to contain substring : [CREATE] -``` - -The controller log at the moment of failure shows what target A committed -instead of a `[CREATE]` event commit: - -``` -git commit created messageKind=snapshot events=1 message="reconcile: sync 1 resources" -``` - -Target A was dragged into **rule-change snapshot mode** even though only -target B's rules changed. - -### Reproduced locally - -`task test-e2e` on a fresh local k3d cluster — same single failure as CI: - -``` -45 Passed | 1 Failed | 0 Pending | 2 Skipped (46 of 48 specs, 14m21s) -Summarizing 1 Failure: - [FAIL] Manager GitTarget Isolation - keeps target A's commits as events while target B's rules churn - test/e2e/gittarget_isolation_e2e_test.go:143 -``` - -Extra data point: **CI failed on iteration 1** (target B *removes* `services` -from its watch set), **local failed on iteration 0** (target B *adds* `services`). -Different iteration, identical defect → it is **not** add-vs-remove specific. -*Any* change to target B's effective watch plan churns the **global informer -set** and forces every target to snapshot. - -### Root cause (hypothesis) - -This is exactly the coupling that -[docs/finished/gittarget-isolation-on-rule-change.md](finished/gittarget-isolation-on-rule-change.md) -claimed was removed. That design says snapshot selection must be driven purely -by a **per-target effective-watch-plan hash** (resolved GVR + scope + unioned -operations + destination), with the global `added`/`removed` `force` flag gone. - -The wildcard re-add reintroduced the cross-target coupling. Two candidate -mechanisms, both in `internal/watch`: - -1. The global GVR add/remove delta is once again reaching - `snapshotTargetsNeedingDelivery` for targets whose own plan did not change - (the old `force` path), **or** -2. `currentRuleSetSnapshots()` - ([internal/watch/manager.go:1233](../internal/watch/manager.go#L1233)) now - produces an **unstable per-target plan hash** when the catalog / informer set - churns — e.g. a plain `"configmaps"` rule resolving to a different GVR set - across catalog refreshes because of the new wildcard resolution paths. - -The wildcard commit's changes to the resolver -([internal/watch/rule_gvr_resolver.go](../internal/watch/rule_gvr_resolver.go) — -`resourceCandidates`, `wildcardResourceCandidates`, `choosePreferredVersions`, -`ambiguityMiss`) are the most likely source of (2): they change how candidates -and preferred versions are chosen, which feeds the resolved GVR set that the -per-target hash is computed over. - -### Where to look - -- [internal/watch/manager.go:739](../internal/watch/manager.go#L739) — `ReconcileForRuleChange` -- [internal/watch/manager.go:1177](../internal/watch/manager.go#L1177) — `snapshotTargetsNeedingDelivery` -- [internal/watch/manager.go:1233](../internal/watch/manager.go#L1233) — `currentRuleSetSnapshots` (per-target plan hash) -- [internal/watch/rule_gvr_resolver.go](../internal/watch/rule_gvr_resolver.go) — resolution changes from `8e1b3ab` - -Suggested first step: assert the per-target plan hash for a target whose own -rules are unchanged is **stable** across an unrelated target's rule change -(unit-level), then trace whether a global delta still reaches snapshot -selection. - ---- - -## Failure B — controller-availability cascade (timing/bootstrap) - -### Symptom - -5 specs failed, **all with the same assertion** at -[test/e2e/e2e_test.go:194](../test/e2e/e2e_test.go#L194) inside `verifyResourceStatus`: - -``` -Timed out after 90s. -status.conditions not found -Expected : false to be true -``` - -i.e. a `WatchRule`/`ClusterWatchRule` was created but **never got any status -written** within 90s — it never reached `Ready` because nothing reconciled it. - -| Failing spec | Resource stuck without status | -|---|---| -| Manager WatchRule … *should expand wildcard resources …* | `watchrule/watchrule-wildcard-expansion-test` | -| Commit Signing … *snapshot commit with custom template* | `watchrule/signing-snapshot-wr` | -| Commit Request `[BeforeAll]` … | `watchrule/commit-request-watchrule-*` | -| Bi Directional … *avoid a commit loop* | `watchrule/bi-watchrule-*` | -| Restart Snapshot Safety … *git mirror intact on restart* | `clusterwatchrule/restart-snapshot-wildcard` | - -The `[BeforeAll]` failure in *Commit Request* is what skips ~14 specs (an -ordered container whose `BeforeAll` fails skips all its specs). - -### Root cause (evidence points to controller unavailability, not assertion logic) - -The early specs **passed** — `Manager Controller Basics` (run successfully, -service exposed, metrics serving, audit webhook events) and several -`Manager CRD Lifecycle` specs all went green at ~21:58. So the controller -(`gitops-reverser-6969c78bb5-bwj9p`) was healthy and reconciling at the start. - -Then a **second controller pod replaced the first** mid-run, and the replacement -got stuck on a TLS-bootstrap mount race: - -``` -Killing pod/gitops-reverser-6969c78bb5-bwj9p Stopping container manager -SuccessfulCreate replicaset/gitops-reverser-6969c78bb5 Created pod: ...-kzpj5 -Warning FailedMount pod/gitops-reverser-6969c78bb5-... \ - MountVolume.SetUp failed for volume "audit-webhook-certs": secret "audit-server-cert" not found -``` - -While the replacement pod could not mount `audit-server-cert` (cert-manager had -not issued/published it yet), the controller was **not reconciling WatchRules**. -Every spec that created a fresh WatchRule during that window timed out at 90s -waiting for `status.conditions`. The same `audit-server-cert` / audit-root-ca -bootstrap warnings also appear (benignly, self-healing) in Run A's event dump, -so this is a pre-existing startup race that simply landed badly in Run B. - -Note: the controller log in this run is **flooded** with a benign, unrelated -retry — `Failed to build pending write; dropping open window … get GitProvider: -… "gitprovider-normal" not found` (a branch worker retrying against an -already-cleaned-up namespace). It is noise, not the cause. - -### Why this is *not* (clearly) the wildcard code - -- The failing specs are a mix — some involve wildcards/CRDs, some don't - (signing, commit-request). They are unified only by *timing* (all created - WatchRules during the unavailable window), not by a shared code path. -- The mechanism is "controller wasn't running/ready," not "reconcile produced - the wrong result." -- The wildcard expansion spec passed in Run A. - -It is *possible* the wildcard work lengthens initial reconcile/discovery (a fresh -wildcard plan expands across all served GVRs), widening the vulnerable window — -but that is unconfirmed. - -### Where to look / next step - -- Confirm determinism: re-run E2E (full) on the same commit. If Run B's cascade - does **not** reproduce, it is an infrastructure/bootstrap flake to harden, not - a logic bug. -- Controller startup ordering vs `audit-server-cert`: the manager should not be - killed/rolled while the cert secret is unpublished, or should tolerate the - mount gap without dropping reconciliation. See the audit TLS design: - [docs/design/audit-webhook-tls-design.md](design/audit-webhook-tls-design.md). -- Investigate **why a second controller pod was created mid-run** in Run B - (rollout / eviction / cert rotation) — that replacement is the trigger. - ---- - -## Failure C — local only: disk-pressure node taints (environment, not code) - -Hit while reproducing Failure A locally. Not a product bug — recorded so the -next person does not lose time to it. - -### Symptom - -`task prepare-e2e` failed at the `portforward-ensure` step: - -``` -⏳ Waiting for Prometheus pod to be ready... -error: timed out waiting for the condition on pods/prometheus-prometheus-shared-e2e-0 -❌ Prometheus pod failed to become ready -NAME READY STATUS RESTARTS AGE -prometheus-prometheus-shared-e2e-0 0/2 Pending 0 4m11s -``` - -The controller pods were `Pending`/`Error` too, with: - -``` -FailedScheduling 0/4 nodes are available: 4 node(s) had untolerated taint(s). -``` - -### Root cause - -All four k3d nodes carried `node.kubernetes.io/disk-pressure:NoSchedule`: - -``` -NAME TAINTS -...-agent-0 [.../disk-pressure ...] -...-server-0 [.../disk-pressure ...] -``` - -The host Docker overlay was **94% full** (`231G / 248G`), tripping kubelet's -`imagefs`/`nodefs` eviction threshold. `docker system df` showed the hog: -~169 GB reclaimable images and ~25 GB build cache. - -### Fix / workaround - -``` -docker builder prune -f # reclaimed ~25 GB build cache -docker image prune -f # dangling images -``` - -Disk dropped 94% → 82% → 33% free, the `disk-pressure` taints cleared on their -own, the cluster recovered, and `task test-e2e` then ran to completion -(surfacing Failure A). A leftover second cluster (`audit-pass-through-e2e`) was -also consuming disk and was a contributing factor. - -### Takeaways - -- Local full-suite runs need real disk headroom. The failure does **not** - present as "disk full" — it shows up as `Pending` pods and - `FailedScheduling … untolerated taint(s)`, which is easy to misread as a - scheduling/resource-request problem. -- If pods won't schedule, check `kubectl get nodes -o custom-columns=NAME:.metadata.name,TAINTS:.spec.taints` - for `disk-pressure` before anything else, and `df -h /` + `docker system df`. -- Tear down stale k3d clusters between runs; they hold image/volume disk. - ---- - -## Update (2026-06-04) — Failure D: snapshot abort on a vanished CRD (fixed) - -A later red `E2E (full)` run (on branch `poc/manifestedit`, -[run 26935363495](https://github.com/ConfigButler/gitops-reverser/actions/runs/26935363495)) -reproduced the same `status.conditions not found` cascade as Failure B, but the -controller logs pinned a **distinct, deterministic root cause** rather than a -bootstrap race: - -``` -aborting cluster snapshot for .../watchrule-wildcard-expansion-test-dest: -failed to list bi-directional.e2e.example.com/v1, Resource=icecreamorders: -the server could not find the requested resource -"snapshot replay did not complete, leaving target pending" -``` - -Three e2e specs each register an `icecreamorders` CRD under a *different* API -group (`bi-directional.…`, `crd-lifecycle.…`, `wildcard-watchrule.…`). Under -`--procs=4` they create and tear down those CRDs concurrently. A wildcard target's -snapshot enumerates all of them; when one CRD is gone mid-flight the `list` -returns NotFound, the **whole snapshot aborted** (the partial-view guard), the -GitTarget was left pending, its WatchRule never reached `Ready`, and the 90s -`verifyStatus` timed out — cascading to unrelated specs sharing the controller. - -This is the CRD-churn half of **Phase 2 / item D** in -[watchrule-wildcard-support-plan.md](future/watchrule-wildcard-support-plan.md). -**Fixed** by skipping a `NotFound` (no-longer-served type) during the snapshot -list while still aborting on every other list error — see the -[Item D decision](future/watchrule-wildcard-support-plan.md#item-d-decision-notfound-skips-everything-else-aborts). -Not related to the manifest-editing work on that branch. - -## Summary - -- **Failure A is the real, deterministic regression from the wildcard re-add** — - GitTarget isolation no longer holds; an unrelated target's rule change forces - other targets into snapshot commits. Reproduced locally. Fix lives in - `internal/watch` snapshot-selection / per-target plan hash. -- **Failure B is a controller-availability cascade** triggered by a mid-run - controller pod replacement blocked on the `audit-server-cert` mount. It is a - bootstrap/timing problem (pre-existing race), not an assertion-logic bug, and - should be confirmed with a re-run before assuming it is caused by the wildcard - change. -- The wildcard **expansion feature itself is not implicated** in either failure. -- **Failure C is local-environment only** — disk-pressure node taints from a full - host Docker overlay. Not a product bug; clear disk before running the suite. diff --git a/docs/future/addendum-end-user-commit-messages-audit-transports.md b/docs/future/addendum-end-user-commit-messages-audit-transports.md deleted file mode 100644 index 6549d964..00000000 --- a/docs/future/addendum-end-user-commit-messages-audit-transports.md +++ /dev/null @@ -1,399 +0,0 @@ -# Addendum: audit-carried transports for end-user commit context - -> Status: exploratory — addendum to [idea-end-user-commit-messages.md](idea-end-user-commit-messages.md). -> Date: 2026-05-07 - -## Why this addendum exists - -The parent doc lists two audit-carried transports for end-user reasons: - -1. audit `user.extra` enrichment -2. transient metadata annotations stripped by a mutating admission webhook, with the reason - recovered from the audit request payload - -It treats them as roughly comparable, with `user.extra` framed as "cheapest credible." This -addendum re-examines that framing. After looking closer at how `user.extra` actually gets -populated in real clusters, the answer is more nuanced. It also surfaces a cleaner variant of the -second transport: instead of having the audit consumer reconstruct the stripped annotation from -the audit request payload, a mutating webhook can copy it into an audit annotation on the -`AdmissionResponse`, where the apiserver records it on the audit event at every audit level. - -The doc covers each transport in turn, then compares them. - -## Transport A: `user.extra` enrichment - -### What `user.extra` is - -Every authenticated Kubernetes request resolves to a `userInfo` struct on the API server side: - -```yaml -userInfo: - username: alice@example.com - uid: ... - groups: [...] - extra: - : - - - - -``` - -`extra` is a `map[string][]string`. Keys are arbitrary strings; values are ordered lists. The -field is populated by whichever authenticator handled the request (OIDC, webhook, client cert, -service account, anonymous) and may be augmented by impersonation. Authorization, admission, and -audit all see the same `userInfo`. - -For gitops-reverser the relevant property is that this struct is part of the audit event envelope. -It does not require capturing the request body. - -### How it surfaces in audit - -`userInfo` is recorded on every audit event at every audit level, including `Metadata`. That -matters: most clusters run with `Metadata` for chatty resources to control log volume, and switch -to `Request` or `RequestResponse` only for sensitive resources. A commit-message reason carried in -`user.extra` rides along with the existing `userInfo` capture and does not require widening audit -policy to record full request bodies. - -A representative audit event fragment: - -```yaml -kind: Event -apiVersion: audit.k8s.io/v1 -level: Metadata -verb: update -objectRef: - resource: deployments - namespace: checkout - name: api -user: - username: alice@example.com - groups: ["system:authenticated"] - extra: - gitops-reverser.io/reason: - - "Increase checkout API memory after load-test failures" -``` - -gitops-reverser's audit consumer would read `user.extra["gitops-reverser.io/reason"]` from this -event and attach it to the matching pending write before the commit window closes. - -### Sources of `user.extra` values - -There are four practical ways a value lands in `user.extra`. Each has different operational and -trust properties. - -#### 1. OIDC structured authentication - -Modern Kubernetes (`AuthenticationConfiguration`, beta from 1.30) lets the cluster operator map -OIDC token claims into `extra` keys via CEL expressions: - -```yaml -apiVersion: apiserver.config.k8s.io/v1beta1 -kind: AuthenticationConfiguration -jwt: - - issuer: - url: https://idp.example.com - audiences: [kubernetes] - claimMappings: - username: - claim: email - groups: - claim: groups - extra: - - key: "gitops-reverser.io/reason" - valueExpression: "claims.gitops_reverser_reason" -``` - -The mapping is centrally controlled by the cluster operator. It only really works if the IdP can -be made to issue a per-request claim, which is unusual: OIDC tokens are typically reused for many -requests in a session, so the reason would either be missing or stale for most calls. - -#### 2. Webhook token authenticator - -A cluster can delegate token validation to a webhook. The webhook's `TokenReview` response can -populate `status.user.extra`: - -```json -{ - "apiVersion": "authentication.k8s.io/v1", - "kind": "TokenReview", - "status": { - "authenticated": true, - "user": { - "username": "alice@example.com", - "extra": { - "gitops-reverser.io/reason": ["Increase checkout API memory after load-test failures"] - } - } - } -} -``` - -This gives full control over `extra` content at request time, but it pushes a non-trivial -component into the auth path: the webhook is on the hot path of every authenticated API call. If -it slows down or fails, the API server does. - -#### 3. Impersonation headers - -A trusted client can call the API server as another user by setting impersonation headers, and -that includes setting extra fields: - -```http -Authorization: Bearer -Impersonate-User: alice@example.com -Impersonate-Group: dev -Impersonate-Extra-gitops-reverser.io%2Freason: Increase checkout API memory after load-test failures -``` - -The `Impersonate-Extra-` header maps directly to `userInfo.extra[]`. Keys containing -characters disallowed in HTTP header names (notably `/`) must be percent-encoded in the header -name. Multiple values for the same key are sent as repeated headers. - -Impersonation requires explicit RBAC. To set the example key above, the impersonating identity -needs at minimum: - -```yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: gitops-reverser-impersonator -rules: - - apiGroups: [""] - resources: ["users", "groups"] - verbs: ["impersonate"] - - apiGroups: ["authentication.k8s.io"] - resources: ["userextras/gitops-reverser.io/reason"] - verbs: ["impersonate"] - - apiGroups: ["authentication.k8s.io"] - resources: ["uids"] - verbs: ["impersonate"] -``` - -`resourceNames` can further narrow which users or groups may be impersonated. The -`userextras/` resource pattern is how RBAC scopes which extra keys an impersonator is -allowed to set; without that rule the API server rejects the `Impersonate-Extra-*` header. - -#### 4. Service account tokens - -Service account tokens, including projected tokens with bound audiences, do not carry custom -extras. They populate fixed fields like `authentication.kubernetes.io/pod-name`. There is no -mechanism for a SA-authenticated request to set an arbitrary `gitops-reverser.io/reason` value -without going through impersonation or a webhook authenticator. - -The practical consequence is the one noted in the parent doc: if a UI's only path to Kubernetes -is "POST to backend, backend talks to apiserver as its own SA," and that backend does not -impersonate, gitops-reverser will only ever see the backend's identity and no reason. - -### Pragmatic reading of the four sources - -Looking at the four together, the picture is less rosy than "cheapest credible": - -- **OIDC structured auth.** The argument that "issue a fresh token per save action is itself a - security measure" is weak. OIDC tokens are session identity, not per-action authorization. - Forcing a fresh token per save would conflate identity assurance with intent capture, hurt UX, - and only works if the IdP can be made to mint per-request claims. Step-up auth exists for - high-value operations, but that is about identity confidence, not about ferrying free-text - intent. Useful as a baseline ("this token belongs to a reason-aware UI") rather than a - per-mutation channel. -- **Webhook token authenticator.** Disqualified for this use case. Auth webhooks sit on the hot - path of every authenticated API call. Adding one to forward a free-text reason is wildly - disproportionate to the value, and the failure-mode blast radius is the whole cluster. -- **Impersonation headers.** Workable but semantically off-label. `Impersonate-Extra-*` was - designed for "this trusted client is acting as user X with these identity claims." Repurposing - it as a generic payload-shipping mechanism for free-text reasons is, well, a repurposing. The - RBAC story (`userextras/` rules) was built to gate identity claims, not message text. - Cluster operators reading the resulting RBAC will be surprised at why a generic backend has - impersonation rights at all. -- **Service account tokens.** Dead end. SA-only frontends silently degrade to "no reason, - backend identity." - -The conclusion: `user.extra` is the option with the smallest gitops-reverser-side change but the -largest off-label Kubernetes-side usage. Its "cheapest credible" framing in the parent doc -deserves to be softened. - -### RBAC summary - -To make the impersonation path usable for a backend frontend: - -- The backend's identity (typically a service account) needs `impersonate` on the user, on - optional `groups`, on `uids`, and on each `userextras/` it wants to set. -- The cluster operator should restrict `resourceNames` so the backend cannot impersonate - arbitrary users or set arbitrary extra keys. -- Auditing the backend's own service account activity becomes important, because every - user-attributed change in audit will have been issued by that backend. The audit - `impersonatedUser` field, combined with the backend's authenticated identity, is what proves - who actually made the call. - -### Audit policy - -The minimum audit policy needs to: - -- record `userInfo` (always present on events) -- include the verbs and resources that gitops-reverser already watches at a level that produces - an event at all (i.e. not `None`) - -A `Metadata` level event already contains `userInfo.extra`, so no payload-level audit is required -for this transport. - -If the cluster currently filters `user.extra` from audit logs for privacy reasons (some operators -do this in a downstream log pipeline rather than in audit policy itself), that filter has to be -loosened for the chosen reason key. - -## Transport B: audit annotations from a mutating admission webhook - -A different audit-carried path avoids both the off-label feel of impersonation and the audit -payload reconstruction the parent doc's stripped-annotation option requires. A mutating admission -webhook can attach key/value pairs directly to the audit event via the `auditAnnotations` field -on its `AdmissionResponse`, without modifying the object. - -### What audit annotations are - -Audit annotations are not object annotations. They are key/value pairs the apiserver records on -an audit event under the top-level `annotations:` field, alongside `authorization.k8s.io/decision` -and similar built-in entries. They exist precisely so admission controllers can attach decision -context to the audit log. - -A mutating or validating webhook returns them in its `AdmissionResponse`: - -```json -{ - "apiVersion": "admission.k8s.io/v1", - "kind": "AdmissionReview", - "response": { - "uid": "...", - "allowed": true, - "patchType": "JSONPatch", - "patch": "", - "auditAnnotations": { - "reason": "Increase checkout API memory after load-test failures" - } - } -} -``` - -The apiserver prefixes the keys with the webhook configuration name. If the webhook is named -`gitops-reverser-commit-context.example.com`, the audit event records: - -```yaml -annotations: - gitops-reverser-commit-context.example.com/reason: "Increase checkout API memory after load-test failures" -``` - -### Why this is cleaner than reading the request payload - -Compared to the parent doc's "strip and read from request payload" version of the -transient-annotation transport: - -- **Audit level.** Audit annotations are present on the event regardless of audit level. The - request body is not. The parent doc's variant requires `Request` or higher audit on every - watched resource type to recover the stripped annotation. The audit-annotation variant works - at `Metadata` level, the same as `user.extra`. -- **Structured place.** The apiserver records audit annotations in a place explicitly designed - for workflow context attached to a request. The consumer reads a known field, not a - reconstructed object payload. -- **No payload reconstruction.** Patches, server-side apply, and create-vs-update variants all - just work. The webhook sees the request, parses the transient annotation wherever it is, and - emits one audit annotation. The consumer does not have to handle multiple request shapes. - -### Worked example - -1. The frontend sets a transient annotation on the resource update: - - ```yaml - metadata: - annotations: - gitops-reverser.io/commit-message: "Increase checkout API memory after load-test failures" - ``` - -2. The mutating admission webhook receives the request, reads the annotation, and returns: - - a JSON patch that removes the transient annotation from the object - - `auditAnnotations: { "reason": "Increase checkout API memory after load-test failures" }` - -3. The apiserver applies the patch, persists the cleaned object, and emits an audit event: - - ```yaml - user: - username: alice@example.com - annotations: - gitops-reverser-commit-context.example.com/reason: "Increase checkout API memory after load-test failures" - ``` - -4. gitops-reverser's audit consumer reads the annotation under the configured webhook prefix, - attaches it to the matching pending write, and the commit window finalizes with that reason - in the commit message. Author still comes from `user.username` per existing audit-backed - authoring rules. - -### Trade-offs - -- **The webhook is still in the path,** but it is admission-time on the watched resource types - only, not auth-time on every API call. That is a qualitatively different risk profile than the - webhook-token-authenticator option in Transport A. If the webhook fails open (or fails closed - for only a small set of resources), the blast radius is narrow. -- **Webhook-name prefix matters.** The apiserver prefixes audit-annotation keys with the webhook - configuration name, so the audit consumer needs to know that prefix. It is a deployment-time - configuration item. -- **Patch-versus-strip behaviour.** The webhook is responsible for stripping the transient - annotation from the object. If it is misconfigured to a smaller resource scope than the audit - consumer watches, transient annotations may leak into stored state. -- **Multi-request edits.** Per-event reasons. The same composition question as Transport A and - the parent doc's stripped-annotation option. -- **Confidentiality.** Audit annotations land in audit logs the same way `user.extra` does. - Length cap and PII review apply equally. - -## Comparison: A vs B - -| Property | A: `user.extra` | B: audit annotation from mutating webhook | -|----------|------------------|--------------------------------------------| -| Frontend mechanism | Impersonation headers (or auth-layer enrichment) | Transient object annotation, stripped by webhook | -| Required Kubernetes feature | Impersonation RBAC for `userextras/` | `MutatingWebhookConfiguration` on watched types | -| Auth-path component | Yes if using webhook authenticator; no if using impersonation | No | -| Admission-path component | No | Yes, admission-time only | -| Required audit level | `Metadata` | `Metadata` | -| Author binding | `user.username` from impersonated identity | `user.username` from authenticated request | -| Off-label feel | High — repurposing identity-claim plumbing for payload | Low — audit annotations are designed for this | -| Operator surprise | RBAC grants impersonation rights to a backend | Standard mutating webhook with documented purpose | - -Neither option is free. Transport A asks the cluster to grant impersonation rights to a frontend -backend and to accept that those rights will be used to ferry free-text reasons, not just -identity claims. Transport B asks the cluster to install one more mutating admission webhook, but -that webhook is using the audit-annotation field exactly as Kubernetes intends. - -The recommendation that follows from this addendum is: - -- Transport B (audit annotation via mutating webhook) is the cleanest audit-carried path and - should be prototyped before Transport A. -- Transport A is still worth understanding because some clusters will already have OIDC or - webhook-authenticator infrastructure that can populate `user.extra` essentially for free, in - which case its off-label feel is less load-bearing. -- Both transports are per-event by nature. The aggregated `CommitContext` API in the parent doc - remains useful as a complementary "send last" close-off for parallel-write frontends, not as a - competitor. - -## Open questions - -- Should gitops-reverser define and document the canonical reason key, or accept a configurable - key per `GitTarget` or per cluster? -- Does the consumer accept multi-value lists / multiple reasons in one event (joining them) or - only the first value? -- Should the consumer surface a structured warning event when a reason was supplied but the - audit-driven write was rejected for an unrelated reason, so the frontend learns that the - reason was discarded along with the change? -- For Transport B, should gitops-reverser ship the mutating webhook itself, or define the - contract and let operators install whichever webhook they prefer? -- How should audit-carried per-event reasons compose with a future aggregated `CommitContext` - close-off message: are they joined, or does the close-off message replace them? - -## References - -### Kubernetes documentation -- [Dynamic Admission Control](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/) — `auditAnnotations` field on the webhook response. -- [Audit Annotations](https://kubernetes.io/docs/reference/labels-annotations-taints/audit-annotations/) — catalog of built-in audit annotations and how they appear on events. -- [kube-apiserver Admission (v1) API reference](https://kubernetes.io/docs/reference/config-api/apiserver-admission.v1/) — formal `AdmissionResponse` schema. -- [Validating Admission Policy](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/) — same audit-annotation pattern in CEL-based policies. - -### Source-of-truth Go types -- [`admission/v1/types.go` in kubernetes/api](https://github.com/kubernetes/api/blob/master/admission/v1/types.go) — the `AdmissionResponse` struct and the `AuditAnnotations` field comment. -- [`admissionreview.go` in kubernetes/apiserver](https://github.com/kubernetes/apiserver/blob/master/pkg/admission/plugin/webhook/request/admissionreview.go) — apiserver-side handling that copies webhook audit annotations onto the audit event with the `/` prefix. - -### Background and history -- [PR #58679 — support annotations for admission webhook](https://github.com/kubernetes/kubernetes/pull/58679/files) — original change introducing `auditAnnotations` on `AdmissionResponse`. -- [PR #115973 — KEP-3488: enforcement actions and audit annotations](https://github.com/kubernetes/kubernetes/pull/115973) — extension of the same pattern to `ValidatingAdmissionPolicy`. -- [Issue #125522 — `auditAnnotations` always included on the audit event](https://github.com/kubernetes/kubernetes/issues/125522) — discussion of when audit annotations actually surface on audit events. diff --git a/docs/future/design-commit-request-phase-2.md b/docs/future/design-commit-request-phase-2.md index d1591827..cb69c0f5 100644 --- a/docs/future/design-commit-request-phase-2.md +++ b/docs/future/design-commit-request-phase-2.md @@ -1,6 +1,6 @@ # Phase 2: `CommitRequest` — deferred work -> Status: proposed. Follow-up to [design-commit-request-api.md](../finished/design-commit-request-api.md). +> Status: proposed. Follow-up to [design-commit-request-api.md](../spec/commitrequest-design.md). > Date: 2026-05-18 The first cut of `CommitRequest` is intentionally minimal. This doc tracks what was deliberately diff --git a/docs/future/design-snapshot-engine-evolution.md b/docs/future/design-snapshot-engine-evolution.md deleted file mode 100644 index 7c16c0d4..00000000 --- a/docs/future/design-snapshot-engine-evolution.md +++ /dev/null @@ -1,701 +0,0 @@ -# Design: snapshot engine evolution - -> Status: proposed — continuation of -> [design-rule-change-snapshot-trigger.md](../finished/design-rule-change-snapshot-trigger.md). -> Date: 2026-05-21 -> Author context: written after a critical review of the rule-change snapshot -> trigger implementation ([ed3a1db](#) "fix: better reconcile"). - -This plan picks up where the rule-change snapshot trigger left off. That work -closed the *delivery contract* gap (a snapshot now stays pending until a -`FolderReconciler` exists). This document covers what is still wrong, what is -still expensive, and a longer-term architecture for the watch/snapshot engine — -including a two-tier GVK model, a dedicated tracking engine, a Redis-backed -state layer, and a path to multi-pod HA. - -It is deliberately staged: Part 1 is correctness, Part 2 is cost, Part 3 is -architecture. Parts 1 and 2 are small and should land first; Part 3 is a -direction, not a committed design. - -## Background: GVR vs GVK - -The rest of this document — and the Part 3 architecture in particular — hinges -on a distinction that is easy to blur. Both forms address a Kubernetes type by -**Group / Version**, but the third component differs: - -| Form | Third component | Example | What it identifies | -|------|-----------------|---------|--------------------| -| **GVK** — GroupVersionKind | **Kind** — schema type name, singular, PascalCase | `apps/v1`, Kind `Deployment` | The *type* as written in a manifest's `apiVersion` + `kind` | -| **GVR** — GroupVersionResource | **Resource** — plural, lowercase REST path segment | `apps/v1`, Resource `deployments` | The *HTTP endpoint* you `LIST`/`WATCH` against | - -The mapping between them is **not** a trivial pluralisation. It is owned by the -cluster's RESTMapper, populated from API discovery, and it is many-to-one in -both directions in practice: - -- One Kind can expose several Resources — subresources such as `pods/status`, - `deployments/scale`. These share a Kind but are distinct Resources. -- The Resource (plural) is irregular often enough (`ingresses`, `endpoints`, - `networkpolicies`) that it must be discovered, not guessed. - -**Why it matters here.** Everything on the *watch path* is GVR-addressed: the -`watch.GVR` type, the dynamic client (`dc.Resource(gvr)` requires a GVR), and -the informer keys are all GVR. Everything on the *git representation path* is -GVK-addressed: a file written to the repo carries `apiVersion` + `kind`, i.e. a -GVK. The engine therefore lives on a GVR↔GVK seam, and the Tier 1 catalog in -[Part 3.1](#31-two-tier-gvk-model) must hold **both** keys plus the mapping — -calling it a "GVK catalog" is shorthand; its watch-facing index is GVR. Where -this document says GVK loosely, read it as "the type", and where precision -matters the explicit form is used. - -## What the Kubernetes API server can deliver - -Before proposing a new engine it is worth being explicit about what the API -server actually offers a read/watch client, which of those capabilities we use -today, and what we leave on the table. A prior document, -[docs/design/kubernetes-api-discovery.md](../design/kubernetes-api-discovery.md), -already covers *discoverability and verbs* — this section is the read/watch -mechanics complement to it, and capacity tuning is covered separately in -[docs/design/kubernetes-apf-and-inflight-tuning.md](../design/kubernetes-apf-and-inflight-tuning.md). - -```mermaid -flowchart TD - APISERVER["kube-apiserver"] - APISERVER --> DISC["Discovery
/api, /apis, aggregated discovery"] - APISERVER --> LIST["LIST
collection GET"] - APISERVER --> WATCH["WATCH
streamed deltas"] - APISERVER --> STREAM["Streaming list
WATCH + initial events"] - - DISC --> D1["groups, versions, resources"] - DISC --> D2["scope, verbs, Kind↔Resource"] - - LIST --> L1["labelSelector / fieldSelector — server-side filter"] - LIST --> L2["limit + continue — pagination"] - LIST --> L3["resourceVersion=0 — served from watch cache"] - LIST --> L4["list carries its own resourceVersion (snapshot point)"] - - WATCH --> W1["ADDED / MODIFIED / DELETED since RV"] - WATCH --> W2["BOOKMARK events — cheap RV checkpoint"] - WATCH --> W3["410 Gone — RV compacted, must re-LIST"] - STREAM --> S1["sendInitialEvents=true - synthetic ADDED"] - STREAM --> S2["initial-events BOOKMARK - sync boundary"] - STREAM --> S3["then normal WATCH without a separate LIST"] - - classDef used fill:#1b5e20,color:#fff; - classDef unused fill:#5d4037,color:#fff; - class DISC,D1,D2,L4,WATCH,W1,W3 used; - class L1,L2,L3,W2,STREAM,S1,S2,S3 unused; -``` - -Green = used today, brown = available but unused. - -### Discovery - -`/api`, `/apis`, and the per-group endpoints enumerate every served Group / -Version / Resource together with each resource's **scope** (namespaced or not), -its **verbs** (`list`, `watch`, …), and its **Kind**. Newer clusters also serve -*aggregated discovery* (`APIGroupDiscovery`), collapsing the whole catalog into -one round-trip. - -**We use this** via `ServerPreferredResources` in -[`FilterDiscoverableGVRs`](../../internal/watch/discovery.go#L44). The benefit -is concrete: CRDs and `APIService`-backed (aggregated) resources are supported -with no hardcoding — if a type is in discovery with `list`+`watch`, it is a -candidate. This is exactly the Tier 1 catalog of [Part 3.1](#31-two-tier-gvk-model) -in embryonic form. - -### LIST - -A collection `GET` is the bulk-read primitive. Its options matter a great deal -for cost: - -- **`labelSelector` / `fieldSelector`** — server-side filtering, so the wire - payload is already narrowed. We do **not** use these. This is the same - selector-parity gap flagged in the predecessor doc: the snapshot LIST returns - everything of a GVR while the live path filters — they must converge. -- **`limit` + `continue`** — pagination, bounding peak client memory. We do - **not** use these; `listResourcesForGVR` - ([manager.go:616](../../internal/watch/manager.go#L616)) passes a bare - `metav1.ListOptions{}`, materialising every object of a GVR at once. -- **`resourceVersion=0`** — serve the list from the API server's in-memory - watch cache instead of a quorum read from etcd. Much cheaper on the - apiserver; bounded staleness. We do **not** set it. -- Every list response carries its own **`resourceVersion`** — the consistent - snapshot point a subsequent watch resumes from. We rely on this *indirectly* - through informers but never read it ourselves. - -### WATCH - -A `WATCH` streams `ADDED` / `MODIFIED` / `DELETED` deltas since a given -`resourceVersion`: - -- **`410 Gone`** — if that RV has aged out of the watch cache / been compacted, - the watch fails and the client *must* fall back to a full re-LIST. This is - the fundamental limit on "give me everything since an arbitrary moment" — - detailed in [Part 2.2](#22-resourceversion-and-watches--what-they-can-and-cannot-do). -- **`BOOKMARK` events** (`allowWatchBookmarks=true`) — the server periodically - emits an object-free event that only advances the RV, letting a client - cheaply checkpoint progress. A controller that persists the latest bookmark - RV can resume a watch after a short restart *without* a full re-LIST, - provided it stays inside the compaction window. We do **not** use bookmarks - today; they become relevant to the durable-state work in - [Part 3.3](#33-redis-backed-state-layer). - -**We use WATCH** only transitively: the `dynamicinformer` factory performs -LIST+WATCH internally for each tracked GVR. We never open a raw watch, so we -also never see bookmarks or drive the resume logic ourselves. - -### Streaming LIST+WATCH - -Kubernetes also exposes a watch form known as -[streaming lists](https://kubernetes.io/docs/reference/using-api/api-concepts/#streaming-lists). -The current upstream docs mark it as `Kubernetes v1.34 [beta]` and enabled by -default. Instead of issuing a separate collection `LIST` before the `WATCH`, -the client starts one watch with `sendInitialEvents=true`, -`allowWatchBookmarks=true`, `resourceVersion=`, and -`resourceVersionMatch=NotOlderThan`. - -The server begins the stream with synthetic `ADDED` events for the current -collection. It then sends a `BOOKMARK` annotated as the end of initial events; -that bookmark carries the RV for the established snapshot. After that point the -same connection continues as an ordinary watch stream from that RV. - -This is conceptually a better primitive for GitOps Reverser's future tracking -engine than a hand-rolled `LIST` then `WATCH`, because the API server gives us -one ordered stream and an explicit "initial state is complete" marker. It does -not remove the need to keep a local store: the engine still has to accumulate -the synthetic `ADDED` events into its snapshot cache, persist the bookmark RV -if we want resume, and fall back to classic list/watch or re-list on -unsupported APIs and `410 Gone`. - -**We do not use this today.** The current `dynamicinformer` path owns the -bootstrap internally, and the snapshot path does a second raw `LIST`. The -project is already on Kubernetes libraries that expose the needed knobs in -`metav1.ListOptions` (`SendInitialEvents`, `AllowWatchBookmarks`, -`ResourceVersionMatch`), so no dependency upgrade is required to prototype a -custom tracker. - -### What we use, and what we benefit from - -| Capability | Used today | Benefit / cost left on the table | -|------------|-----------|----------------------------------| -| Discovery (`ServerPreferredResources`) | Yes | CRD + aggregated-API support with zero hardcoding | -| Informer LIST+WATCH per GVR | Yes | Live deltas; in-memory cache already holds every object | -| Raw LIST in `GetClusterStateForGitDest` | Yes | **Redundant** — second full list of an already-cached GVR (Part 2.1) | -| `limit`/`continue` pagination | No | Unbounded peak memory on large GVRs | -| `resourceVersion=0` (watch-cache read) | No | Cheaper apiserver path for the unavoidable lists | -| `labelSelector`/`fieldSelector` | No | Server-side narrowing; also closes the selector-parity gap | -| Watch bookmarks | No | Cheap restart resume without full re-LIST | -| Streaming lists (`sendInitialEvents=true`) | No | One ordered initial-state + live-delta stream for a custom tracker | -| Protobuf encoding | No (dynamic client → JSON) | Smaller payloads for built-in types | - -The headline: we extract real value from **discovery** and from the -**informer** machinery, but the snapshot read path uses the *least* efficient -shape of LIST the API server offers, and ignores every incremental-resume -mechanism. Streaming lists sharpen the Part 3 direction: the future tracking -engine should probably speak in watch streams with explicit sync bookmarks, -not in ad-hoc full-list snapshots. - -## Where we are today - -The rule-change snapshot trigger added a per-GitTarget delivery contract in -`watch.Manager`. The moving pieces: - -```mermaid -flowchart TD - WR["WatchRule / ClusterWatchRule
controllers"] -->|ReconcileForRuleChange| MGR - GTR["GitTargetReconciler
evaluateSnapshotGate()"] -->|CreateReconciler| RM - - subgraph MGR["watch.Manager"] - HASH["currentRuleSetSnapshots()
per-target xxhash of compiled rules"] - subgraph S1["STATE — ruleSetSnapshotMu"] - LD["lastDeliveredRuleSetHash
gitDestKey → hash"] - PD["pendingRuleSetHash
gitDestKey → hash"] - end - subgraph S2["STATE — informersMu"] - AI["activeInformers
GVR → ns → cancelFunc"] - end - subgraph S3["STATE — lastSeenMu"] - LS["lastSeenHash
resourceKey → contentHash"] - end - EMIT["emitSnapshotForRuleChange()"] - end - - subgraph RM["reconcile.ReconcilerManager"] - RECS["reconcilers map
gitDestKey → *FolderReconciler"] - CB["onReconcilerCreated callback"] - end - - CB -->|MaybeReplaySnapshot| MGR - HASH --> EMIT - EMIT -->|ProcessControlEvent| ER - - subgraph ER["watch.EventRouter"] - RCS["handleRequestClusterState → live LIST"] - RRS["handleRequestRepoState → git ls"] - DROP["snapshotDeliveryDrops counter"] - end - - ER -->|OnClusterState / OnRepoState| FR - FR["FolderReconciler
repo-half + cluster-half
→ findDifferences → WriteRequest"] - FR --> GIT[("git repository")] - FR -.->|status| GTSTATUS["GitTarget.Status
SnapshotSynced cond"] -``` - -The full delivery sequence, including the restart-bootstrap replay path: - -```mermaid -sequenceDiagram - participant Ctl as WatchRule controller - participant M as watch.Manager - participant RM as ReconcilerManager - participant ER as EventRouter - participant FR as FolderReconciler - - Ctl->>M: ReconcileForRuleChange(ctx) - M->>M: currentRuleSetSnapshots() → per-target hash - M->>M: snapshotTargetsNeedingDelivery() - Note over M: pendingRuleSetHash[gitDest] = hash - - alt FolderReconciler already registered - M->>ER: ProcessControlEvent(RequestRepoState / RequestClusterState) - ER->>FR: OnRepoState / OnClusterState - FR->>FR: reconcile() → WriteRequest - M->>M: markRuleSetSnapshotDelivered() - Note over M: lastDeliveredRuleSetHash advances - else No reconciler yet (restart bootstrap) - M-->>M: leave pending, do NOT advance lastDelivered - Note over RM: later — GitTargetReconciler runs - RM->>M: onReconcilerCreated → MaybeReplaySnapshot(gitDest) - M->>ER: emitSnapshotForRuleChange(...) - ER->>FR: OnRepoState / OnClusterState - M->>M: markRuleSetSnapshotDelivered() - end -``` - -Key source: - -- [internal/watch/manager.go](../../internal/watch/manager.go) — - `ReconcileForRuleChange`, `snapshotTargetsNeedingDelivery`, - `currentRuleSetSnapshots`, `emitSnapshotForRuleChange`, `MaybeReplaySnapshot`, - `GetClusterStateForGitDest`, `listResourcesForGVR`. -- [internal/watch/event_router.go](../../internal/watch/event_router.go) — - `RouteClusterStateEvent`, `RouteRepoStateEvent`, `snapshotDeliveryDrops`. -- [internal/reconcile/reconciler_manager.go](../../internal/reconcile/reconciler_manager.go) — - `CreateReconciler`, `SetOnReconcilerCreated`. -- [internal/controller/gittarget_controller.go](../../internal/controller/gittarget_controller.go) — - `evaluateSnapshotGate`. - -All snapshot-trigger state (`pendingRuleSetHash`, `lastDeliveredRuleSetHash`, -`activeInformers`, `lastSeenHash`) is **in-memory and leader-local**. The only -persisted state is `GitTarget.Status` and git itself. - -## Lessons from recent failures - -Two failures in the current watch/audit path make the rebuild constraints more -concrete: - -1. A startup snapshot once interpreted a wildcard-versioned rule differently - from the live audit path. The snapshot resolved to zero resources, the - reconciler treated that as authoritative, and it deleted the existing Git - mirror. A failed `List()` that is logged and skipped has the same shape: - "partial cluster view" becomes "cluster deletion" at the diff boundary. -2. The audit webhook path once tried to join shallow audit bodies before it - knew whether the event could match a rule. Unwatched pod churn then paid - Redis lookups and waits inside the kube-apiserver request context, producing - timeout noise and `context canceled` failures before exact rule routing even - ran. - -These are not only point bugs. They show where the current system is fragile: -rule selection, snapshot completeness, event enrichment, and delivery ownership -are split across several paths with different timing and failure behavior. - -The future engine should turn those failure modes into invariants: - -- **One selection contract.** Snapshot bootstrap, live tracking, audit - relevance checks, and final Git routing may operate at different precision, - but they must share the same interpretation of wildcard versions, groups, - resources, operations, scope, and selectors. An early "could match" gate may - be conservative; it must not contradict the exact matcher downstream. -- **Completeness before deletion.** A snapshot or tracked shard is either known - complete for its rule predicate or it is an error / pending state. Missing - data from discovery, wildcard resolution, LIST, aggregated APIs, cache sync, - or cross-shard fan-in must not be converted into delete writes. -- **Initial sync is not recoverable from future deltas.** After a bad snapshot, - only objects that emit later audit/watch events heal themselves; quiet - resources stay absent from Git. The tracker must establish and record an - explicit initial-sync boundary before deltas are allowed to stand in for - state. -- **Cheap relevance before expensive enrichment.** Mutating events should be - classified by stage, verb, subresource, GVR, and possible rule relevance - before body joins, waits, or API fallback reads. Complete events should take - the short path. Exact filtering still belongs after enrichment. -- **Readiness and ownership are state, not timing assumptions.** Startup and - failover will briefly have incomplete rule, discovery, and shard state. Gates - must either fail open for non-destructive ingestion or fail closed for - destructive reconciliation, and the reason must be observable. - -The incident evidence therefore supports the Part 3 direction: a tracker with a -durable notion of "selected", "synced", "pending", and "owned" is not just a -scaling convenience for HA. It is how destructive Git convergence stops -depending on duplicated best-effort paths. - -## Part 1 — Correctness: finish the delivery contract - -The delivery contract is sound in shape but has gaps the original doc either -under-specified or claimed as handled when they are not. - -### 1.1 Per-gitDest emission mutex (the real concurrency fix) - -The original doc's risk section says *"A per-gitDest mutex (or the existing -`activeInformers` lock) is enough."* It was not implemented. `ruleSetSnapshotMu` -guards **only the hash maps**. The actual emission — `emitSnapshotForRuleChange` -→ `reconciler.ResetState()` → cluster LIST → routing — runs with no lock. - -A 30 s periodic `ReconcileForRuleChange` and a `MaybeReplaySnapshot` (fired -synchronously from `CreateReconciler`) can run concurrently for the *same* -gitDest. Both call `ResetState()` -([folder_reconciler.go:111](../../internal/reconcile/folder_reconciler.go#L111)); -one can wipe a half-arrived state pair from the other, so `reconcile()` either -never fires or fires on mismatched halves. - -**Fix:** a per-gitDest mutex held across the whole emit (reset → emit repo → -emit cluster → mark delivered). A `map[string]*sync.Mutex` keyed by -`gitDest.Key()`, or a single emission mutex if contention is acceptable at MVP -scale. - -### 1.2 Stop using `context.Background()` in `MaybeReplaySnapshot` - -`MaybeReplaySnapshot` -([manager.go](../../internal/watch/manager.go) — see `MaybeReplaySnapshot`) -runs a full cluster-wide LIST with no deadline, **synchronously inside the -GitTarget reconcile loop** (`CreateReconciler` → `onReconcilerCreated` -callback). A slow API server stalls a controller-runtime reconcile worker. - -**Fix:** thread the reconcile `ctx` through the callback, or dispatch the -replay onto the Manager's own goroutine with a bounded context. - -### 1.3 Mark delivered only on confirmed receipt - -`emitSnapshotForRuleChange` calls `markRuleSetSnapshotDelivered` immediately -after `ProcessControlEvent` returns `nil`. But `RouteClusterStateEvent` / -`RouteRepoStateEvent` return `nil` *even when they drop the event* — they only -bump `snapshotDeliveryDrops` -([event_router.go:260-281](../../internal/watch/event_router.go#L260-L281)). -The `GetReconciler` existence check just above guards this today, but it is -TOCTOU: a reconciler deleted between check and route advances the hash on a -dropped snapshot → permanent silent loss until the next rule change. - -**Fix:** have the route functions return a `delivered bool`; advance -`lastDeliveredRuleSetHash` only when delivery is confirmed. - -### 1.4 Make `force` per-target, not global - -`snapshotTargetsNeedingDelivery(len(added) > 0 || len(removed) > 0)` -([manager.go:695](../../internal/watch/manager.go#L695)) passes a **global** -boolean. Any GVR add/remove anywhere forces a snapshot for *every* GitTarget, -including unaffected ones. The original doc claims the hash version *"pays the -same cost only when the hash changes"* — true only on the non-force path. - -**Fix:** drop `force` entirely. A genuine GVR change already changes the -affected target's rule hash, so the hash alone is sufficient and naturally -per-target. This removes a whole-cluster re-list amplification on CRD install. - -### 1.5 Doc hygiene - -[design-rule-change-snapshot-trigger.md](../finished/design-rule-change-snapshot-trigger.md) -still cites `manager.go:660` for the old early-return; it is now line 696. -Fix the stale reference since the doc is marked "implemented". - -## Part 2 — Cost: stop paying for the cluster twice - -This addresses the open worry: *will this concept eat too many resources in big -clusters with many resources?* - -### 2.1 Serve the snapshot from the informer cache - -`GetClusterStateForGitDest` → `listResourcesForGVR` -([manager.go:616](../../internal/watch/manager.go#L616)) does a fresh -`dc.Resource(gvr).List(...)` — a **second full cluster LIST** — for a GVR whose -informer is *already synced and already holding every object in its in-memory -indexer*. We pay for the list twice: once for `WaitForCacheSync` -([manager.go:1165](../../internal/watch/manager.go#L1165)), once for the -snapshot. - -**Fix:** read the snapshot from `informer.GetIndexer().List()` instead of a -live API LIST. The snapshot becomes essentially free — no API round-trip, no -second in-memory copy. The reconcile flow already guarantees the informer is -synced before emission, so correctness holds. - -This is the single highest-leverage change for big-cluster cost. - -### 2.2 resourceVersion and watches — what they can and cannot do - -The idea of "request changesets since a moment" using `resourceVersion` is -exactly what informers already do (LIST, remember RV, WATCH from that RV). Two -hard limits stop it from being a primary snapshot mechanism: - -- **Watch history is bounded.** The API server retains only recent watch events - (etcd compaction + watch-cache window — minutes, not hours). A watch from an - aged-out RV returns `410 Gone`, forcing a full re-LIST. "Everything changed - since the last restart" is therefore not reliable across any restart longer - than the compaction window. -- **`resourceVersion` is opaque.** It is not an ordered comparable integer in - the API contract. You cannot do `if obj.RV > lastSyncedRV` in your own diff - logic; you can only hand it back to the API server. - -Where per-object RV *does* help: as a **persisted dedup key**. Storing the -last-synced RV per resource lets a re-LIST skip the sanitize + diff for any -object whose RV is unchanged — it does not save the LIST, but it saves CPU when -the diff is the bottleneck. This is the natural successor to the in-memory -`lastSeenHash` map. - -### 2.3 Bound the unavoidable LISTs - -For the LISTs that remain (initial sync, post-`410` re-sync): - -- **Pagination** — `ListOptions{Limit: N, Continue: ...}` bounds peak memory. - `listResourcesForGVR` currently passes a bare `metav1.ListOptions{}`. -- **`ResourceVersion: "0"`** — serves the LIST from the API server watch cache - rather than a quorum etcd read; much cheaper on the apiserver, with bounded - staleness that is acceptable here. - -```mermaid -flowchart LR - subgraph Now["Today — double list"] - I1[informer LIST+WATCH] --> C1[(informer cache)] - SNAP1[GetClusterStateForGitDest] --> L2[second live LIST] - end - subgraph Next["Proposed — single list"] - I2[informer LIST+WATCH] --> C2[(informer cache)] - SNAP2[GetClusterStateForGitDest] --> C2 - end -``` - -### 2.4 Treat streaming lists as a tracker primitive, not the Part 2 fix - -Streaming lists are tempting because they sound like "a cheaper snapshot." For -this codebase, the immediate Part 2 fix is still to serve snapshots from the -already-synced informer cache. That removes the redundant raw `LIST` without -rewriting the watch stack. - -Streaming lists become valuable when Part 3 introduces an explicit tracking -engine. At that point the engine can replace the classic bootstrap: - -```text -LIST collection -> remember list RV -> WATCH from RV -``` - -with: - -```text -WATCH sendInitialEvents=true -> accumulate synthetic ADDED events --> initial-events BOOKMARK -> mark tracked shard synced --> continue processing live events -``` - -That gives the engine a natural state machine: - -| Phase | Input | Engine behavior | -|-------|-------|-----------------| -| `bootstrapping` | synthetic `ADDED` | Populate the snapshot store, but do not emit per-object git writes yet | -| `initial-synced` | initial-events `BOOKMARK` | Persist the snapshot RV and emit one coherent snapshot/reconcile signal | -| `live` | normal watch events | Apply deltas and update per-object RV/hash dedup state | -| `expired` | `410 Gone` or unsupported option | Fall back to classic relist/bootstrap | - -This also fits the Redis/state-store idea in [Part 3.3](#33-redis-backed-state-layer): -the initial-events bookmark is the clean point at which the engine can record -"this `(GVR, namespace)` shard is current through RV X." - -## Part 3 — Architecture: a two-tier GVK model and a tracking engine - -This part responds to the broader question: *should there be an abstraction -over all GVKs (split per namespace), with a catalog of all available GVKs and a -second, narrower set of tracked GVKs — and should tracking/storing move into a -separate process and a Redis layer, in preparation for HA?* - -Short answer: yes to the two-tier model and the dedicated engine — they -formalise concepts that are already implicit in the code. Redis and multi-pod -HA are a real direction but should come last and be entered with eyes open. - -### 3.1 Two-tier GVK model - -The code already computes two GVK sets but does not name them as a model: - -- **Requested** GVRs — `ComputeRequestedGVRs` - ([gvr.go:53](../../internal/watch/gvr.go#L53)) — derived from rules. -- **Discoverable** GVRs — `FilterDiscoverableGVRs` - ([discovery.go:44](../../internal/watch/discovery.go#L44)) — filtered against - the discovery API. - -Promote this into an explicit two-tier registry: - -- **Tier 1 — GVK Catalog.** Every GVK the cluster exposes, refreshed - periodically from the discovery API, annotated with scope (namespaced vs - cluster), served-ness, and CRD lifecycle. This is cluster-global and - rule-independent. -- **Tier 2 — Tracked Set.** The subset the rules actually select, keyed by - `(GVK, namespace)` so namespace-scoped informers are first-class rather than - a special case threaded through `getNamespacesForGVR`. Each tracked entry - carries its delivery state: rule-set hash, last snapshot RV, owning shard. - -```mermaid -flowchart TD - DISC["Discovery API"] -->|periodic refresh| CAT - CAT["Tier 1 — GVK Catalog
all served GVKs + scope + CRD lifecycle"] - RULES["RuleStore
compiled WatchRule / ClusterWatchRule"] --> SEL - CAT --> SEL - SEL["selection: rules ∩ catalog"] - SEL --> TRACK - TRACK["Tier 2 — Tracked Set
key = (GVK, namespace)
per-entry: ruleSetHash, lastSnapshotRV, shard"] - TRACK --> ENG["Tracking Engine
owns informer lifecycle + snapshot store"] -``` - -Benefits: CRD-availability retry logic -(`updateUnavailableGVRTracking` and friends) becomes a property of Tier 1 -rather than ad-hoc maps; the `(GVK, namespace)` key removes the cluster-wide vs -namespaced branching that currently runs through `compareGVRs`, -`getNamespacesForGVR`, and `collectInformersToStart`. - -### 3.2 A dedicated tracking engine - -Today `watch.Manager` is a controller-runtime `Runnable` that does discovery, -informer lifecycle, dedup, snapshot emission, and the delivery contract — all -in one object, all on the leader. Splitting the *tracking/storing* concern into -its own component (not necessarily its own OS process — a clearly-bounded -internal service with its own goroutine and queue) gives: - -- A single owner for informer lifecycle and the snapshot store. -- A single owner for tracked-shard completeness: only synced shards may - contribute authoritative absence/deletion facts to a GitTarget snapshot. -- A natural seam to make snapshot emission a queued, retried, observable - operation instead of inline calls inside `ReconcileForRuleChange`. The - original doc's "future improvements" already names this: *"a small - pending-snapshot work queue with retry, backoff, and metrics."* -- A place to keep the conservative audit "could match" gate aligned with the - tracked set without moving exact Git routing into the webhook hot path. -- A boundary that can later be moved across a process or pod boundary without - re-plumbing the controllers. - -### 3.3 Redis-backed state layer - -Everything fragile in Part 1 is fragile because it is in-memory and -leader-local. A shared store would hold: - -- `pendingRuleSetHash` / `lastDeliveredRuleSetHash` — survive restart and - failover, so a pending snapshot is not silently lost on leader change. -- The per-resource RV / content-hash index (today `lastSeenHash`) — dedup - survives restart and can be shared across pods. -- The Tier 2 Tracked Set, per-shard sync/completeness state, and shard ownership - leases. - -Redis is a reasonable first choice (leases, hashes, pub/sub for cross-pod -notification). **But be honest about the cost:** it adds an external dependency -and a new failure mode to a project whose code still says *"Single-pod MVP"*. -An intermediate step worth considering first: persist the delivery contract -into `GitTarget.Status` (already durable, already reconciled) and keep only the -high-churn dedup index in memory. That removes the worst silent-loss case -without a new dependency. - -### 3.4 Multi-pod / HA - -Today `Manager.NeedLeaderElection()` returns `true` -([manager.go:207](../../internal/watch/manager.go#L207)) — strictly -single-active. Two evolution paths: - -```mermaid -flowchart TD - subgraph AP["Option A — active / passive"] - L1["leader pod: all informers + snapshots"] - L2["standby pod: idle, reads shared state"] - L1 -.->|failover, state in Redis| L2 - end - subgraph SH["Option B — sharded active / active"] - S1["pod 1: shard A of (GVK,ns)"] - S2["pod 2: shard B of (GVK,ns)"] - S3["pod 3: shard C of (GVK,ns)"] - LEASE["Redis leases — shard ownership"] - S1 --- LEASE - S2 --- LEASE - S3 --- LEASE - end -``` - -- **Option A — active/passive with fast failover.** Keep single-active, but - persist the delivery contract so the new leader resumes pending snapshots - and initial-sync boundaries instead of dropping them. Low complexity, no - informer fan-out change. This is the recommended next HA step. -- **Option B — sharded active/active.** Partition the Tier 2 Tracked Set across - pods by `(GVK, namespace)`, each shard leased via Redis. This is true - horizontal scale but the hard part is that rules map GitTargets to GVKs - many-to-many — a snapshot for one GitTarget may need GVKs owned by several - shards. That cross-shard fan-in needs its own design and should not be - attempted before Options A and the two-tier model are in place. - -**Recommendation:** treat Option B as a stated direction, not a near-term -commitment. The selector-parity hazard already flagged in the prior doc must -also be resolved before sharding, or different shards will diff against -different predicates. - -## Staging and acceptance - -```mermaid -flowchart LR - P1["Part 1
correctness fixes"] --> P2["Part 2
informer-cache snapshot"] - P2 --> P3a["Part 3a
two-tier GVK model"] - P3a --> P3b["Part 3b
tracking engine"] - P3b --> P3c["Part 3c
durable state / Redis"] - P3c --> P3d["Part 3d
HA: active/passive → sharded"] -``` - -- **Part 1** — small, self-contained, no API change. Acceptance: the four - existing tests in - [rule_change_snapshot_test.go](../../internal/watch/rule_change_snapshot_test.go) - still pass, plus a new test that runs a periodic reconcile and a - `MaybeReplaySnapshot` concurrently for one gitDest and asserts exactly one - coherent reconcile. -- **Part 2** — no API change. Acceptance: `GetClusterStateForGitDest` issues - zero live LIST calls for an already-synced GVR; a load test over a large - synthetic cluster shows bounded memory. -- **Part 3** — each sub-stage is its own design doc. The two-tier model - (3a) and tracking engine (3b) are internal refactors with no CRD change. - Durable state (3c) and HA (3d) change operational surface and need their own - acceptance criteria, including a `SnapshotDeliveryDrops()`-equivalent staying - at zero across a simulated failover, no destructive reconcile from a partial - shard/snapshot, and parity tests that run wildcard-version and aggregated-API - rules through bootstrap and live event selection. - -## Non-goals - -- No CRD changes in Parts 1 and 2. -- No new external dependency before Part 3c, and only after the - `GitTarget.Status`-only intermediate step is evaluated. -- No sharded active/active before the two-tier model, the tracking engine, and - selector parity all land. - -## References - -- Predecessor: - [design-rule-change-snapshot-trigger.md](../finished/design-rule-change-snapshot-trigger.md). -- API discovery background (discoverability and verbs): - [docs/design/kubernetes-api-discovery.md](../design/kubernetes-api-discovery.md). -- API server capacity tuning: - [docs/design/kubernetes-apf-and-inflight-tuning.md](../design/kubernetes-apf-and-inflight-tuning.md). -- Kubernetes API concepts, especially streaming lists and resourceVersion - semantics: - [kubernetes.io/docs/reference/using-api/api-concepts](https://kubernetes.io/docs/reference/using-api/api-concepts/#streaming-lists). -- Related coordination concern: - [idea-cross-kind-dependency-watches.md](idea-cross-kind-dependency-watches.md). -- Snapshot walk and double-list: - [GetClusterStateForGitDest / listResourcesForGVR](../../internal/watch/manager.go). -- Delivery contract state: - `snapshotTargetsNeedingDelivery`, `markRuleSetSnapshotDelivered`, - `MaybeReplaySnapshot` in [manager.go](../../internal/watch/manager.go). -- Drop instrumentation: - `RouteRepoStateEvent` / `RouteClusterStateEvent` in - [event_router.go](../../internal/watch/event_router.go). -- GVK discovery: `ComputeRequestedGVRs` - ([gvr.go](../../internal/watch/gvr.go)), - `FilterDiscoverableGVRs` - ([discovery.go](../../internal/watch/discovery.go)). - - diff --git a/docs/future/further-away/accesspolicy-design.md b/docs/future/further-away/accesspolicy-design.md deleted file mode 100644 index 1188585d..00000000 --- a/docs/future/further-away/accesspolicy-design.md +++ /dev/null @@ -1,624 +0,0 @@ -# GitRepoConfig AccessPolicy: Detailed Design Document - -**Status**: Design Phase -**API Version**: v1alpha1 -**Feature**: Cross-Namespace Access Control - -## Overview - -The AccessPolicy field enables GitRepoConfig to control which WatchRules and ClusterWatchRules can reference it, enabling secure resource sharing across namespaces while maintaining security boundaries. - -## Problem Statement - -**Current Behavior**: GitRepoConfig can only be referenced by WatchRules in the same namespace. - -**Limitations**: -1. Teams need separate GitRepoConfigs for the same repository (inefficient) -2. No way to share a central audit repository across namespaces -3. Forces duplication of Git credentials and configurations - -**Solution**: Add `accessPolicy` field to GitRepoConfig for flexible, secure access control. - -## Use Cases - -### Use Case 1: Central Audit Repository - -**Scenario**: Organization wants single audit repository for all Kubernetes changes - -**Solution**: -```yaml -apiVersion: configbutler.ai/v1alpha3 -kind: GitRepoConfig -metadata: - name: company-audit - namespace: audit-system -spec: - repoUrl: "git@github.com:company/k8s-audit.git" - branch: "main" - secretRef: - name: git-credentials - accessPolicy: - namespacedRules: - mode: AllNamespaces # Any namespace can use this - allowClusterRules: true # Allow cluster resources too -``` - -### Use Case 2: Team-Specific Repositories - -**Scenario**: Platform team wants shared repository only for their namespaces - -**Solution**: -```yaml -apiVersion: configbutler.ai/v1alpha3 -kind: GitRepoConfig -metadata: - name: platform-audit - namespace: platform-system -spec: - repoUrl: "git@github.com:company/platform-audit.git" - branch: "main" - secretRef: - name: git-credentials - accessPolicy: - namespacedRules: - mode: FromSelector - namespaceSelector: - matchLabels: - team: platform - environment: production -``` - -### Use Case 3: Namespace-Isolated (Default) - -**Scenario**: Development team wants private audit repository - -**Solution**: -```yaml -apiVersion: configbutler.ai/v1alpha3 -kind: GitRepoConfig -metadata: - name: dev-audit - namespace: dev-team -spec: - repoUrl: "git@github.com:company/dev-audit.git" - branch: "main" - secretRef: - name: git-credentials - # No accessPolicy = defaults to SameNamespace mode -``` - -## API Specification - -### Complete Type Definitions - -```go -// GitRepoConfigSpec defines the desired state of GitRepoConfig. -type GitRepoConfigSpec struct { - // RepoURL is the URL of the Git repository - // +required - RepoURL string `json:"repoUrl"` - - // Branch is the Git branch to commit to - // +required - Branch string `json:"branch"` - - // SecretRef specifies the Secret containing Git credentials - // +optional - SecretRef *LocalObjectReference `json:"secretRef,omitempty"` - - // Push defines the strategy for pushing commits - // +optional - Push *PushStrategy `json:"push,omitempty"` - - // AccessPolicy controls which WatchRules can reference this GitRepoConfig. - // If not specified, defaults to SameNamespace mode (most restrictive). - // +optional - AccessPolicy *AccessPolicy `json:"accessPolicy,omitempty"` -} - -// AccessPolicy defines access control rules for GitRepoConfig. -type AccessPolicy struct { - // NamespacedRules controls access from namespace-scoped WatchRules. - // If not specified, defaults to SameNamespace mode. - // +optional - NamespacedRules *NamespacedRulesPolicy `json:"namespacedRules,omitempty"` - - // AllowClusterRules controls whether cluster-scoped ClusterWatchRules - // can reference this GitRepoConfig. - // Defaults to false for security (explicit opt-in required). - // +optional - // +kubebuilder:default=false - AllowClusterRules bool `json:"allowClusterRules,omitempty"` -} - -// NamespacedRulesPolicy defines which namespaces can access this GitRepoConfig. -type NamespacedRulesPolicy struct { - // Mode determines the access control mode. - // - SameNamespace (default): Only WatchRules in the same namespace - // - AllNamespaces: WatchRules from any namespace can access - // - FromSelector: Only namespaces matching the selector - // +optional - // +kubebuilder:default=SameNamespace - // +kubebuilder:validation:Enum=SameNamespace;AllNamespaces;FromSelector - Mode AccessPolicyMode `json:"mode,omitempty"` - - // NamespaceSelector selects which namespaces can access this GitRepoConfig. - // ONLY evaluated when Mode is "FromSelector". - // MUST be nil when Mode is NOT "FromSelector". - // +optional - NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"` -} - -// AccessPolicyMode defines the access control mode. -// +kubebuilder:validation:Enum=SameNamespace;AllNamespaces;FromSelector -type AccessPolicyMode string - -const ( - // AccessPolicyModeSameNamespace allows only same namespace access (default, most secure) - AccessPolicyModeSameNamespace AccessPolicyMode = "SameNamespace" - - // AccessPolicyModeAllNamespaces allows access from any namespace - AccessPolicyModeAllNamespaces AccessPolicyMode = "AllNamespaces" - - // AccessPolicyModeFromSelector allows access from matching namespaces only - AccessPolicyModeFromSelector AccessPolicyMode = "FromSelector" -) -``` - -## CEL Validation Rules - -### Rule 1: NamespaceSelector Requires FromSelector Mode - -**Goal**: Prevent invalid configuration where selector is set but mode doesn't use it - -**Implementation**: -```go -// +kubebuilder:validation:XValidation:rule="!has(self.accessPolicy) || !has(self.accessPolicy.namespacedRules) || !has(self.accessPolicy.namespacedRules.namespaceSelector) || self.accessPolicy.namespacedRules.mode == 'FromSelector'",message="namespaceSelector can only be set when mode is 'FromSelector'" -type GitRepoConfigSpec struct { - // ... fields -} -``` - -**CEL Expression Breakdown**: -``` -!has(self.accessPolicy) - OR !has(self.accessPolicy.namespacedRules) - OR !has(self.accessPolicy.namespacedRules.namespaceSelector) - OR self.accessPolicy.namespacedRules.mode == 'FromSelector' -``` - -**Logic**: Validation passes if ANY of these is true: -1. No accessPolicy defined (valid: use defaults) -2. No namespacedRules defined (valid: use defaults) -3. No namespaceSelector defined (valid: not using selector) -4. Mode is FromSelector (valid: selector is used) - -**Result**: Validation **fails** only when selector is set but mode is NOT FromSelector - -### Rule 2: FromSelector Mode Requires NamespaceSelector - -**Implementation** (in webhook validation): -```go -if namespacedRules.Mode == AccessPolicyModeFromSelector { - if namespacedRules.NamespaceSelector == nil { - return fmt.Errorf("namespaceSelector is required when mode is 'FromSelector'") - } -} -``` - -## Validation Webhook - -### File: `internal/webhook/v1alpha1/gitrepoconfig_webhook.go` - -```go -package v1alpha3 - -import ( - "fmt" - - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/labels" - "k8s.io/apimachinery/pkg/runtime" - ctrl "sigs.k8s.io/controller-runtime" - logf "sigs.k8s.io/controller-runtime/pkg/log" - "sigs.k8s.io/controller-runtime/pkg/webhook" - - configv1alpha1 "github.com/ConfigButler/gitops-reverser/api/v1alpha3" -) - -var gitrepoconfiglog = logf.Log.WithName("gitrepoconfig-webhook") - -// SetupWebhookWithManager registers the webhook with the manager -func (r *configv1alpha1.GitRepoConfig) SetupWebhookWithManager(mgr ctrl.Manager) error { - return ctrl.NewWebhookManagedBy(mgr). - For(r). - Complete() -} - -// +kubebuilder:webhook:path=/validate-configbutler-ai-v1alpha1-gitrepoconfig,mutating=false,failurePolicy=fail,sideEffects=None,groups=configbutler.ai,resources=gitrepoconfigs,verbs=create;update,versions=v1alpha1,name=vgitrepoconfig.kb.io,admissionReviewVersions=v1 - -var _ webhook.Validator = &configv1alpha1.GitRepoConfig{} - -// ValidateCreate implements webhook.Validator -func (r *configv1alpha1.GitRepoConfig) ValidateCreate() error { - gitrepoconfiglog.Info("validate create", "name", r.Name) - return r.validateAccessPolicy() -} - -// ValidateUpdate implements webhook.Validator -func (r *configv1alpha1.GitRepoConfig) ValidateUpdate(old runtime.Object) error { - gitrepoconfiglog.Info("validate update", "name", r.Name) - return r.validateAccessPolicy() -} - -// ValidateDelete implements webhook.Validator -func (r *configv1alpha1.GitRepoConfig) ValidateDelete() error { - gitrepoconfiglog.Info("validate delete", "name", r.Name) - // No validation needed for delete - return nil -} - -// validateAccessPolicy validates the accessPolicy field -func (r *configv1alpha1.GitRepoConfig) validateAccessPolicy() error { - if r.Spec.AccessPolicy == nil { - return nil // No access policy = use defaults (valid) - } - - namespacedRules := r.Spec.AccessPolicy.NamespacedRules - if namespacedRules == nil { - return nil // No namespaced rules = use defaults (valid) - } - - // Validate: namespaceSelector requires mode=FromSelector - if namespacedRules.NamespaceSelector != nil { - if namespacedRules.Mode != configv1alpha1.AccessPolicyModeFromSelector { - return fmt.Errorf( - "namespaceSelector can only be set when mode is 'FromSelector', got mode '%s'", - namespacedRules.Mode, - ) - } - } - - // Validate: mode=FromSelector requires namespaceSelector - if namespacedRules.Mode == configv1alpha1.AccessPolicyModeFromSelector { - if namespacedRules.NamespaceSelector == nil { - return fmt.Errorf( - "namespaceSelector is required when mode is 'FromSelector'", - ) - } - - // Validate label selector is well-formed - _, err := metav1.LabelSelectorAsSelector(namespacedRules.NamespaceSelector) - if err != nil { - return fmt.Errorf("invalid namespaceSelector: %w", err) - } - } - - return nil -} -``` - -## Controller Implementation - -### WatchRule Controller Updates - -**File**: `internal/controller/watchrule_controller.go` - -```go -// validateGitRepoConfigAccess checks if WatchRule can access GitRepoConfig -func (r *WatchRuleReconciler) validateGitRepoConfigAccess( - ctx context.Context, - watchRule *configv1alpha1.WatchRule, -) error { - // Get GitRepoConfig (in same namespace as WatchRule) - gitRepoConfig := &configv1alpha1.GitRepoConfig{} - err := r.Get(ctx, types.NamespacedName{ - Name: watchRule.Spec.GitRepoConfigRef, - Namespace: watchRule.Namespace, - }, gitRepoConfig) - - if err != nil { - return fmt.Errorf("GitRepoConfig not found: %w", err) - } - - // Check access policy - if gitRepoConfig.Spec.AccessPolicy == nil { - // Default: SameNamespace - if gitRepoConfig.Namespace != watchRule.Namespace { - return fmt.Errorf("GitRepoConfig does not allow cross-namespace access (no accessPolicy)") - } - return nil - } - - policy := gitRepoConfig.Spec.AccessPolicy.NamespacedRules - if policy == nil { - // Default: SameNamespace - if gitRepoConfig.Namespace != watchRule.Namespace { - return fmt.Errorf("GitRepoConfig does not allow cross-namespace access (no namespacedRules)") - } - return nil - } - - switch policy.Mode { - case configv1alpha1.AccessPolicyModeSameNamespace, "": // Empty string = default - if gitRepoConfig.Namespace != watchRule.Namespace { - return fmt.Errorf("GitRepoConfig only allows same-namespace access") - } - - case configv1alpha1.AccessPolicyModeAllNamespaces: - // Always allowed - return nil - - case configv1alpha1.AccessPolicyModeFromSelector: - // Get namespace object to check labels - ns := &corev1.Namespace{} - err := r.Get(ctx, types.NamespacedName{Name: watchRule.Namespace}, ns) - if err != nil { - return fmt.Errorf("failed to get namespace %s: %w", watchRule.Namespace, err) - } - - // Check if namespace matches selector - selector, err := metav1.LabelSelectorAsSelector(policy.NamespaceSelector) - if err != nil { - return fmt.Errorf("invalid namespace selector: %w", err) - } - - if !selector.Matches(labels.Set(ns.Labels)) { - return fmt.Errorf( - "namespace '%s' does not match GitRepoConfig selector", - watchRule.Namespace, - ) - } - } - - return nil -} -``` - -### ClusterWatchRule Controller Implementation - -**File**: `internal/controller/clusterwatchrule_controller.go` - -```go -// Check if GitRepoConfig allows cluster rules -if gitRepoConfig.Spec.AccessPolicy != nil { - if !gitRepoConfig.Spec.AccessPolicy.AllowClusterRules { - return fmt.Errorf("GitRepoConfig does not allow cluster rules") - } -} else { - // Default: do not allow cluster rules (explicit opt-in required) - return fmt.Errorf("GitRepoConfig must explicitly allow cluster rules via accessPolicy.allowClusterRules") -} -``` - -## Default Behavior - -**When accessPolicy is NOT specified**: -```yaml -# Equivalent to: -accessPolicy: - namespacedRules: - mode: SameNamespace - allowClusterRules: false -``` - -**Security Principle**: Default is most restrictive (same namespace only, no cluster rules) - -## Examples - -### Example 1: Minimal Configuration (Default) - -```yaml -apiVersion: configbutler.ai/v1alpha3 -kind: GitRepoConfig -metadata: - name: team-repo - namespace: team-a -spec: - repoUrl: "git@github.com:company/team-a-audit.git" - branch: "main" - secretRef: - name: git-creds -# No accessPolicy = SameNamespace mode, no cluster rules -``` - -**Behavior**: -- ✅ WatchRules in `team-a` namespace can use this -- ❌ WatchRules in other namespaces cannot use this -- ❌ ClusterWatchRules cannot use this - -### Example 2: Allow All Namespaces - -```yaml -apiVersion: configbutler.ai/v1alpha3 -kind: GitRepoConfig -metadata: - name: central-audit - namespace: audit-system -spec: - repoUrl: "git@github.com:company/k8s-audit.git" - branch: "main" - secretRef: - name: git-creds - accessPolicy: - namespacedRules: - mode: AllNamespaces -``` - -**Behavior**: -- ✅ WatchRules in ANY namespace can use this -- ❌ ClusterWatchRules cannot use this (allowClusterRules defaults to false) - -### Example 3: Selector-Based Access - -```yaml -apiVersion: configbutler.ai/v1alpha3 -kind: GitRepoConfig -metadata: - name: platform-audit - namespace: platform-system -spec: - repoUrl: "git@github.com:company/platform-audit.git" - branch: "main" - secretRef: - name: git-creds - accessPolicy: - namespacedRules: - mode: FromSelector - namespaceSelector: - matchLabels: - team: platform - matchExpressions: - - key: environment - operator: In - values: [production, staging] -``` - -**Behavior**: -- ✅ WatchRules in namespaces with `team=platform` AND `environment in [production, staging]` -- ❌ WatchRules in other namespaces -- ❌ ClusterWatchRules cannot use this - -### Example 4: Full Access (Cluster + All Namespaces) - -```yaml -apiVersion: configbutler.ai/v1alpha3 -kind: GitRepoConfig -metadata: - name: global-audit - namespace: audit-system -spec: - repoUrl: "git@github.com:company/global-audit.git" - branch: "main" - secretRef: - name: git-creds - accessPolicy: - namespacedRules: - mode: AllNamespaces - allowClusterRules: true # Explicit opt-in -``` - -**Behavior**: -- ✅ WatchRules in ANY namespace can use this -- ✅ ClusterWatchRules can use this -- ⚠️ Most permissive configuration (use with caution) - -### Example 5: Invalid Configuration (Caught by CEL) - -```yaml -# ❌ This will be REJECTED by CEL validation -apiVersion: configbutler.ai/v1alpha3 -kind: GitRepoConfig -metadata: - name: invalid-config - namespace: audit-system -spec: - repoUrl: "git@github.com:company/audit.git" - branch: "main" - secretRef: - name: git-creds - accessPolicy: - namespacedRules: - mode: AllNamespaces # Mode is NOT FromSelector - namespaceSelector: # But selector is defined! - matchLabels: - team: platform -``` - -**Error**: `namespaceSelector can only be set when mode is 'FromSelector'` - -## Status Conditions - -WatchRule/ClusterWatchRule conditions related to accessPolicy: - -- **AccessDenied**: GitRepoConfig doesn't allow access from this rule -- **GitRepoConfigNotFound**: Referenced GitRepoConfig doesn't exist -- **InvalidAccessPolicy**: GitRepoConfig has invalid accessPolicy configuration - -## Testing Strategy - -### Unit Tests - -```go -func TestGitRepoConfigWebhook_ValidateAccessPolicy(t *testing.T) { - tests := []struct{ - name string - config *configv1alpha1.GitRepoConfig - expectError bool - errorMsg string - }{ - { - name: "valid - no access policy", - config: minimalGitRepoConfig(), - expectError: false, - }, - { - name: "valid - AllNamespaces mode", - config: gitRepoConfigWithAllNamespaces(), - expectError: false, - }, - { - name: "valid - FromSelector with selector", - config: gitRepoConfigWithSelector(), - expectError: false, - }, - { - name: "invalid - selector without FromSelector mode", - config: gitRepoConfigWithSelectorButWrongMode(), - expectError: true, - errorMsg: "namespaceSelector can only be set when mode is 'FromSelector'", - }, - { - name: "invalid - FromSelector without selector", - config: gitRepoConfigWithFromSelectorButNoSelector(), - expectError: true, - errorMsg: "namespaceSelector is required when mode is 'FromSelector'", - }, - } - // ... test implementation -} -``` - -### E2E Tests - -1. **Cross-Namespace Access Test**: Create GitRepoConfig with AllNamespaces, verify WatchRule in different namespace works -2. **Selector Test**: Create namespaces with different labels, verify only matching ones can access -3. **Cluster Rules Test**: Verify ClusterWatchRule access control -4. **Default Behavior Test**: Verify same-namespace-only default - -## Migration Considerations - -Since there's no public release: -- No migration required -- No backward compatibility concerns -- New field is optional with safe defaults - -## Security Implications - -### Risks - -1. **AllNamespaces mode**: Any namespace can use the GitRepoConfig (including malicious actors) -2. **allowClusterRules**: Grants access to cluster-wide resources -3. **FromSelector abuse**: Attackers might label their namespaces to match selectors - -### Mitigations - -1. **Default deny**: Defaults to most restrictive (SameNamespace, no cluster rules) -2. **Explicit opt-in**: Cluster rules require `allowClusterRules: true` -3. **Audit trail**: All access attempts logged -4. **RBAC integration**: Namespace creation/labeling controlled by RBAC -5. **Webhook validation**: Prevents invalid configurations - -## Best Practices - -1. **Least Privilege**: Use SameNamespace unless cross-namespace needed -2. **Specific Selectors**: Prefer FromSelector over AllNamespaces -3. **Label Governance**: Control namespace labeling via RBAC -4. **Separate Configs**: Use different GitRepoConfigs for different security zones -5. **Monitor Access**: Watch for unexpected namespace access patterns - -## Summary - -AccessPolicy provides flexible, secure cross-namespace access control for GitRepoConfig while maintaining strong security defaults. CEL validation prevents configuration errors, and webhook validation ensures runtime safety. - -The three-tier model (SameNamespace/AllNamespaces/FromSelector) plus cluster rule control provides the right balance of flexibility and security for enterprise Kubernetes environments. \ No newline at end of file diff --git a/docs/future/ha-gittarget-distribution-plan.md b/docs/future/ha-gittarget-distribution-plan.md index caf29b7c..fff060ef 100644 --- a/docs/future/ha-gittarget-distribution-plan.md +++ b/docs/future/ha-gittarget-distribution-plan.md @@ -3,7 +3,7 @@ Status: **proposed** (not started) > **Reconciliation note (watch-first rewrite).** This plan predates -> [watch-first ingestion](../design/watch-first-ingestion-architecture.md), which removed the +> [watch-first ingestion](../finished/watch-first-ingestion-architecture.md), which removed the > audit-as-correctness pipeline. The **branch-ownership core is unchanged and remains the HA target**: > the `BranchWriteShard` model, the shard-ownership leases (HA-0 → HA-2), durable per-shard write > queues, and the `PushAtomic` compare-and-swap fence. What changed is the **ingress half**: object @@ -368,7 +368,7 @@ API server's compaction horizon returns `410 Gone` and must fall back to a fresh relist. This matches the low-risk path already sketched in -[design-snapshot-engine-evolution.md](design-snapshot-engine-evolution.md#34-multi-pod--ha). +[design-snapshot-engine-evolution.md](../architecture.md#34-multi-pod--ha). ### Phase HA-5: Active/Active Tracking Shards @@ -383,7 +383,7 @@ absence/deletion facts. ## Relationship To WatchRule Wildcards -[WatchRule wildcard support](watchrule-wildcard-support-plan.md) increases the +[WatchRule wildcard support](../spec/type-followability.md) increases the number of GVRs a single target may watch. That stresses informer scale and snapshot completeness, but it should not be the first distributed-systems problem solved. diff --git a/docs/future/idea-end-user-commit-messages.md b/docs/future/idea-end-user-commit-messages.md deleted file mode 100644 index b977c17b..00000000 --- a/docs/future/idea-end-user-commit-messages.md +++ /dev/null @@ -1,434 +0,0 @@ -# Idea: End-user supplied commit messages - -> Status: exploratory - captured for future design. -> Date: 2026-05-05 - -## The proposal in one sentence - -Give end users a Kubernetes-native way to attach intent text to audit-backed changes, so frontends -can collect "why was this changed?" and have that reason appear in git history. - -## Context - -Today, the end user can influence Kubernetes state, but not the commit message gitops-reverser writes -after observing that state change. That is a natural consequence of the architecture: - -- the user talks to the Kubernetes API -- audit events describe what happened -- gitops-reverser reconstructs files and commits them later - -That decoupling is useful, but it makes commit messages difficult. There is no ordinary field on a -`Deployment`, `ConfigMap`, `Application`, or other watched object that means "use this as the commit -message for the eventual reverse GitOps commit." Frontends may have good user intent available at the -moment of editing, but gitops-reverser currently has no clean channel to receive it. - -## Load-bearing principle: audit stream as source of truth - -The defensible version of this feature is not "a frontend tells gitops-reverser to use this -message." It is: - -"The Kubernetes audit stream contains both the change and the user's reason, and gitops-reverser -derives commits from that audited record." - -That principle should hold regardless of the transport: - -1. the user or frontend sends a Kubernetes API request that carries the reason somehow -2. Kubernetes authenticates and authorizes the request normally -3. Kubernetes emits an audit event containing the authenticated `userInfo` and the reason -4. the audit consumer reads the reason from that audit event -5. the audit consumer uses the audit event's identity and observed order to update the matching - commit window - -The implementation should not depend on handler-local state. The author should not come from a -user-provided field. Timing should follow the same audit stream ordering that the rest of the -audit-backed authoring model already trusts. - -If this principle is too weak for commit messages, it is probably too weak for the audit-backed -authoring model in general. - -## Option: audit `user.extra` enrichment - -The cheapest possible version may be to put the reason into audit `user.extra`. - -Kubernetes audit events already carry `userInfo.extra`. A frontend or backend that can influence the -authenticated request identity could add something like: - -```yaml -userInfo: - username: alice@example.com - extra: - gitops-reverser.io/reason: - - "Increase checkout API memory after load-test failures" -``` - -gitops-reverser would read that value from the same audit event as the resource mutation. No new CRD, -no aggregated API, no mutating webhook, and no request body capture are required if the audit event -already includes `userInfo.extra`. - -This option lines up well with the audit-stream principle: - -- the reason is part of the audited request identity/context -- the author still comes from audit `userInfo` -- each resource-changing request can carry its own reason -- commit-window grouping can combine reasons from multiple events instead of relying on one - per-author slot - -The hard part is how real frontends get the value into `user.extra`. Ordinary clients cannot usually -invent arbitrary `user.extra` fields. This likely requires one of: - -- an authentication layer that populates extra fields -- Kubernetes impersonation with permission to set `Impersonate-Extra-*` headers -- a backend service that is explicitly trusted to impersonate both user and extra context - -That may still be cheaper than introducing a new API surface. It is especially worth prototyping -because many real frontends already reach Kubernetes through a backend service account. If that -backend cannot use impersonation or equivalent identity enrichment, the whole "end-user supplied" -feature becomes much less useful regardless of transport. - -## Option: transient metadata stripped by admission - -Another serious option is to attach commit context directly to the object being changed, using -transient metadata annotations: - -```yaml -metadata: - annotations: - gitops-reverser.io/commit-message: "Increase checkout API memory after load-test failures" -``` - -A mutating admission webhook could read those annotations and remove them before the object is -persisted. The fields would not appear in stored Kubernetes state and would not be rendered into git. - -The least surprising version is "strip only, act from audit": - -1. the mutating webhook removes the transient annotations before persistence -2. Kubernetes emits an audit event for the original update request -3. the audit consumer reads the stripped annotation from the audit event request payload -4. gitops-reverser applies the reason to the same resource event, using audit `userInfo` for author - -This is attractive because the reason rides along with the exact resource update it describes. It is -atomic with the change from the user's point of view, naturally scoped to the same audit identity, and -does not require registering an APIService. - -It also handles a real commit-window case better than a single per-author message slot. If the same -user edits A with reason "fix typo" and then B with reason "scale up" inside one commit window, each -event can carry its own reason. The grouped commit can render both reasons or choose a deterministic -summary. A one-message-per-window API would lose or overwrite one of them. - -Costs and risks: - -- every resource type that wants this behavior must pass through the webhook -- the intent is hidden inside object metadata rather than modeled as an explicit operation -- tools that preserve, diff, or rewrite annotations may accidentally retain or disturb it -- audit policy must capture enough request payload to recover the stripped metadata -- patch requests may need careful handling because the reason may live in the patch body, not a full - object - -This option is somewhat hacky, but the objection is not enough to discard it. Its benefits match the -project's grain: Kubernetes request in, audit event out, no durable side channel. - -## Option: aggregated API commit context - -An aggregated API endpoint is still plausible, but it should not be treated as the obvious first -version. APIServices need registration, TLS and requestheader CA wiring, availability handling, and -meaningful e2e coverage. gitops-reverser has already paid some of that cost for audit proxy work, but -that does not make the next APIService free. - -A frontend would call a lightweight aggregated endpoint: - -```yaml -apiVersion: gitops-reverser.io/v1alpha1 -kind: CommitContext -action: setMessage -message: "Increase checkout API memory after load-test failures" -scope: - gitTargetRef: - name: team-a-config -``` - -The handler would authenticate normally, validate the payload, and return. gitops-reverser would not -act on the handler call directly. It would wait for the `CommitContext` request to appear in the -Kubernetes audit stream, then read the message and author from that audit event. - -This shape is useful when: - -- the frontend cannot alter the resource update payload -- `user.extra` enrichment is not available -- the reason should be an explicit operation rather than metadata on the changed object -- a `gitTargetRef` or other gitops-reverser-specific scope is needed - -The downsides are the operational cost and the message-cardinality problem. A standalone -`setMessage` operation naturally creates a per-author or per-author/target slot. That fits a single -edit session, but it collapses when multiple distinct reasons land inside the same commit window. - -## Option: short-lived CommitIntent CRD - -Another possible design is a small CRD, tentatively called something like `CommitIntent`, -`CommitMessageIntent`, or `NextCommitMessage`. - -A frontend would create one before or near the mutating Kubernetes request: - -```yaml -apiVersion: gitops-reverser.io/v1alpha1 -kind: CommitIntent -metadata: - generateName: alice- -spec: - message: "Increase checkout API memory after load-test failures" -``` - -gitops-reverser would interpret the audited creation of that object as: - -"For the current authenticated author, use this message for the next matching commit window, then -delete the intent object." - -The object is not meant to be durable project state. It is closer to a request-side note that crosses -the Kubernetes API boundary so the asynchronous git writer can pick it up later. - -This feels less natural than the audit-carried options because the cleanup clock should be the commit -window, not a broad TTL. A CRD is only worth revisiting if users need inspectable pending intent -state, ordinary watch/list behavior, or RBAC boundaries that are hard to express otherwise. - -## Commit now - -`commitNow` is a possible future action, but it should be treated as v2 at the earliest. - -The tempting shape is: - -```yaml -apiVersion: gitops-reverser.io/v1alpha1 -kind: CommitContext -action: commitNow -message: "Scale worker pool for import backlog" -``` - -`commitNow` would set or replace a message and ask the branch worker to finalize the matching open -commit window immediately, instead of waiting for the rolling silence timer. - -That is useful when `commitWindow` is deliberately lengthened and a UI knows the user pressed -save/apply. But it also exposes commit timing as a frontend-visible contract. Today the operator owns -when gitops-reverser commits. Once frontends can force a commit, users will depend on that timing. - -Risks to resolve before implementing it: - -- interaction with byte-cap finalization -- interaction with push cooldown -- interaction with conflict handling and replay -- whether `commitNow` waits for the commit or only acknowledges a requested flush -- whether it applies to all open windows for the author or requires a `gitTargetRef` -- whether committing an empty window is a no-op or an error - -Recommendation: defer `commitNow` unless the product deliberately chooses longer commit windows and -needs an explicit "save session is complete" signal. - -## Why this is compelling - -- **Better audit trail.** Git history can explain the reason for a change, not only the object that - changed. -- **Frontend-friendly.** Any UI with a "reason" or "description" field can forward that text without - needing git credentials. -- **Kubernetes-native authorization.** RBAC, authentication, impersonation, and audit policy remain - the control points. -- **Decoupling preserved.** The Kubernetes API remains the integration point; frontends do not need - direct access to the gitops-reverser queue. - -## Core design questions - -### How is "current author" determined? - -The author must come from the audit event's `userInfo`, not from a user-provided body field, -annotation value, or CRD spec field. That keeps one user from setting a message for another user's -commit unless an explicit, auditable impersonation or delegation model exists. - -Service-account frontends are the hard case. If most UIs talk to Kubernetes through a backend service -account and that backend does not use impersonation or identity enrichment, gitops-reverser will only -see the service account. In that world, the feature is not truly end-user supplied. Solving that may -be more important than the transport shape. - -### What does "current commit window" mean? - -By default, `spec.push.commitWindow` is `5s`, so a user has a short rolling window where their latest -actions are grouped into one commit. Commit-message context should have the same lifetime. Keeping an -unused message around for minutes would be surprising because it no longer belongs to the edit -session that produced it. - -Message cardinality depends on the transport: - -- `user.extra` and stripped annotations can attach a reason to each audited resource mutation -- aggregated API and CRD shapes tend to create one message slot per author or author/target window - -Per-event reasons are more expressive. If multiple reasons land inside one commit window, the grouped -commit template needs a rule: join unique reasons, choose the latest reason, render a subject plus -body, or fall back to the existing generated message. - -### What does cleanup mean? - -For audit-carried options, cleanup is mostly "do not persist it": - -- `user.extra` is already request context -- transient metadata is stripped before the object is stored -- extracted reasons live only until the corresponding commit window is finalized - -For aggregated API or CRD slots: - -- consumed successfully: remove the slot when the window is finalized -- not consumed: remove it after the same `commitWindow` duration -- invalid or too long: reject the request - -The commit itself should not depend on successful cleanup. - -### What must audit policy capture? - -The answer depends on the option: - -- `user.extra`: audit `userInfo.extra` must be present -- transient metadata: audit must capture the request object or patch payload before the webhook strips - the annotation -- aggregated API: audit must capture the `CommitContext` request body -- CRD: audit of the create request must capture enough object content to recover the message - -If the audit event only contains metadata, gitops-reverser may prove who made the request but still -cannot recover the requested message. - -## Possible shapes - -### `user.extra` - -```yaml -userInfo: - username: alice@example.com - extra: - gitops-reverser.io/reason: - - "Increase checkout API memory after load-test failures" -``` - -### Transient metadata - -```yaml -metadata: - annotations: - gitops-reverser.io/commit-message: "Increase checkout API memory after load-test failures" -``` - -### Aggregated API - -```yaml -apiVersion: gitops-reverser.io/v1alpha1 -kind: CommitContext -action: setMessage -message: "Increase checkout API memory after load-test failures" -scope: - gitTargetRef: - name: team-a-config -``` - -## Comparison - -Modern frontends often issue resource updates as parallel requests rather than one synchronous -sequence. That changes how these options weigh up. Audit-carried reasons survive parallel writes -naturally because each request carries its own context. A separate "send the message last" signal, -such as an aggregated API call after the mutations have landed, becomes more attractive when a -frontend wants a single consolidated reason for a batch of updates rather than one reason per -request. - -| Approach | Running complexity | Flexibility | Correctness | Parallel-write fit | Notes | -|----------|--------------------|-------------|-------------|--------------------|-------| -| audit `user.extra` | Low for gitops-reverser, but depends on an auth layer or impersonation upstream | Per-event reason | Author and reason both bound to the audited request identity | Excellent — each parallel request carries its own reason | Most frontends cannot set `user.extra` without a trusted backend that impersonates | -| transient metadata stripped by webhook | Medium — mutating webhook on every watched type, audit policy must capture request payload | Per-event reason, scoped to the exact resource update | High if audit captures the request object before strip; patch requests need care | Excellent — each parallel request carries its own reason | Intent hidden inside metadata; other tools may retain or disturb the annotation | -| aggregated API `CommitContext` | High — APIService registration, TLS, requestheader CA, availability handling | One message per author or author/target slot; can act as an explicit close-off after parallel writes | Author from audit `userInfo`; ordering follows the audit stream | Strong when used as a "send last" terminator after a batch of mutations | Best fit when a frontend deliberately wants one consolidated reason for many updates | -| `CommitIntent` CRD | Medium — CRD plus controller cleanup logic | One message per intent object | Author from audit of the create; cleanup tied to commit window, not TTL | Adequate, but the CRD adds visible state for something meant to be ephemeral | Worth revisiting only if inspectability or RBAC needs it | -| do nothing | None | None — template-driven messages only | N/A | N/A | The current behavior | - -The parallel-write angle does not eliminate the audit-carried options, but it does strengthen the -case for the aggregated API as a *complement* rather than a competitor. Per-event reasons via -`user.extra` or stripped annotations give fine-grained context; an optional `CommitContext` -"close off" call lets a frontend consolidate a multi-request edit session into a single commit -message when that is what the UI actually wants to express. - -## Reassessment after deeper review - -The addendum [addendum-end-user-commit-messages-audit-transports.md](addendum-end-user-commit-messages-audit-transports.md) -examines the audit-carried transports more closely. It surfaces three points that shift the -weighting in the comparison table. - -**The audit-carried options are heavier than the table suggests.** - -- `user.extra` enrichment requires one of: an authentication webhook on the hot path of every - authenticated API call (disqualified — putting cosmetic-ish features in the auth path is - wildly disproportionate), OIDC claim mappings minted per save action (uncommon in real IdPs; - the "fresh token per save = security" framing is also weak — OIDC tokens are session - identity, not per-action authorization), or impersonation. Impersonation works, but - `Impersonate-Extra-*` was designed to carry identity claims, not free-text reasons. The - resulting RBAC story ("backend X may impersonate any user and set arbitrary extras") is - alarming for a feature that "just" attaches a commit message. Calling the impersonation path - off-label is fair. -- The transient-annotation transport — including the cleaner audit-annotation variant the - addendum considered, which uses `AdmissionResponse.auditAnnotations` instead of reading from - the audit request payload — requires a mutating admission webhook on the path of every - relevant change. That webhook becomes a new always-on dependency in the request path, called - for every incoming mutation on every watched type. For a feature whose value is "the commit - message has more context," that is a steep operational cost. - -**The aggregated API has an ordering nuance that matters.** - -- In grouping mode (current default `commitWindow: 5s`), the natural pattern is "send the - message last" as a close-off after the related resource changes have landed. The audit event - for the `CommitContext` request falls inside the still-open window, gitops-reverser attaches - the message to the in-progress group, and the window finalizes shortly after. Clean and - well-defined, and a particularly good fit for parallel-write frontends because the message - acts as a synchronization barrier after the parallel batch completes. -- In a hypothetical per-event mode (very short or per-event windows), the message would have to - be sent *before* the resource change to be picked up — and that is racy: other parallel - actions could land between the message and the action, and the message could be wrongly - associated. This is a real point in favour of audit-carried per-event reasons for that mode, - but per-event mode is not the default and not a near-term goal. -- For the current default and the typical UI shape, the grouping-mode close-off pattern is - enough. - -**Aggregated API is also future-proof for other transient actions.** - -A `CommitContext`-shaped resource is a natural place to put other temporary, audited actions -that are not durable Kubernetes state: a `commitNow` flush signal (still deferred — see -"Commit now" above), a `proposeAsPullRequest` action that asks the branch worker to push a -feature branch and open a PR instead of pushing to the target branch directly, and so on. -Audit-carried transports are tied to "the reason for this single mutation"; they do not -naturally extend to actions that are not themselves a Kubernetes resource mutation. Once the -APIService cost is paid, additional actions are cheap to add and they all share the same -audit-stream-as-source-of-truth treatment. - -**Updated ordering.** - -For the current defaults and the most likely deployment shapes: - -1. **Aggregated API `CommitContext`** — preferred. The operational cost is a one-time - APIService registration; once that exists, additional actions are cheap. Grouping-mode - close-off handles the parallel-write case the comparison table flagged. -2. **`user.extra` via impersonation** — viable as a fallback when the cluster already has - impersonation infrastructure in regular use for other reasons. Skip for clusters that do - not. -3. **Transient annotations (any variant) via mutating webhook** — defer. The always-on webhook - in the request path is a heavier ask than the value of the feature, especially when the - aggregated API can cover the same use case and more. -4. **`CommitIntent` CRD** — defer. The aggregated API covers the same shape with less - persisted state. -5. **Do nothing** — fall back if none of the above is available. - -## Recommendation - -Build the aggregated API `CommitContext` first. It is operationally heavier than the -audit-carried options on paper, but the audit-carried options have hidden costs (impersonation -RBAC for arbitrary user identities, always-on admission webhook on every relevant change) that -this comparison underweighted on the first pass. The aggregated API is also future-proof: -future temporary actions (`commitNow`, "propose as PR") fit the same shape with no new -transports, and the close-off pattern is a clean fit for parallel-write frontends. - -The previous detailed CommitContext sketch was removed with the superseded design notes; revisit the -transport from the current CommitRequest and attribution model if this work resumes. - -The audit-carried transports remain valuable as a fallback for clusters that already have the -infrastructure in place (impersonation in regular use, or OIDC `AuthenticationConfiguration` -mappings), and as documentation of what the design considered. - -The most important invariant is unchanged: users can only set commit messages for their own -attributed changes, and that is proven through the audit event itself unless an explicit, -auditable impersonation or delegation model exists. diff --git a/docs/future/idea-unify-pending-write-kinds.md b/docs/future/idea-unify-pending-write-kinds.md index f7c87523..e362bbd1 100644 --- a/docs/future/idea-unify-pending-write-kinds.md +++ b/docs/future/idea-unify-pending-write-kinds.md @@ -19,7 +19,7 @@ unset. The temptation is to make that the dispatch and delete the `Kind` enum. ## Use case walkthrough -The four use cases in [commit-window-refactor.md](../finished/commit-window-refactor.md#use-cases): +The four use cases in [commit-window-refactor.md](../spec/commit-window-refactor.md#use-cases): 1. **Burst collapse.** Per-event-only behavior (atomic is one commit by definition). Unification neither helps nor breaks this. @@ -78,7 +78,7 @@ finalize trigger, a do-not-split byte-cap rule, an event/window invariant A rough sketch of the change footprint: - **Producers** (small): three `UserInfo` fabrication sites in - [folder_reconciler.go](../../internal/reconcile/folder_reconciler.go) deleted; the + folder_reconciler.go deleted; the reconcile `WriteRequest` site sets `CommitMessage` instead of `CommitMode`. The audit producer in [git_target_event_stream.go](../../internal/reconcile/git_target_event_stream.go) is unchanged. diff --git a/docs/future/watchrule-wildcard-support-plan.md b/docs/future/watchrule-wildcard-support-plan.md deleted file mode 100644 index 8100f723..00000000 --- a/docs/future/watchrule-wildcard-support-plan.md +++ /dev/null @@ -1,269 +0,0 @@ -# WatchRule Wildcard Support — Finding & Plan - -Status: **implemented** — Phases 0–1 shipped; **not the full happy flow** (Phase 2 -snapshot robustness and Phase 3 guardrails are still outstanding — see -[Implementation status](#implementation-status)). - -> **Superseded framing:** the finding below stands, but the recommended way to -> resolve it is the unified model in -> [watch-and-catalog-architecture.md](../design/watch-and-catalog-architecture.md). Treat -> this document as the focused finding + a tactical (Phase-0-first) fallback if -> the larger refactor is deferred. - -## Implementation status - -Wildcards resolve and watch again. The resolver expands `apiGroups: ["*"]`, -`apiVersions: ["*"]`, and `resources: ["*"]` from the API-resource catalog and -feeds the expanded GVR set through both the informer-planning and snapshot paths; -the rule status reports `"wildcard expanded to N GVRs"`. Admission now rejects -subresource entries (`pods/log`, `pods/*`) via an `items` pattern, and the CRD -field docs were corrected to match. Covered by unit tests in the resolver and -manager-snapshot suites and a manager-labeled e2e smoke spec. - -**Done:** Phase 0 (docs + admission validation), Phase 1 (resolver expansion -A + B + C, status surfacing F-partial). - -**Not done (the "not fully happy flow" caveat):** - -- **Phase 2 / item D — snapshot robustness.** *Partially decided (see - [Item D decision](#item-d-decision-notfound-skips-everything-else-aborts) - below).* A `list` that returns **NotFound** (the type is no longer served) now - skips that GVR instead of aborting the whole snapshot; every other `list` error - still aborts (pinned by `TestSnapshotWildcardResourceAbortsOnAnyListError` and - `TestSnapshotAbortsOnListError`). This closes the CRD-churn race that wedged - wildcard targets. The remaining, larger half of D — resilience to *transient* - failures on *served* types at hundreds-of-GVR scale (retry/partial-snapshot - strategy) — is still open and is the gating item for declaring wildcard support - truly "done". -- **Phase 3 — guardrails.** No informer-count cap/observability and no CRD-burst - debounce yet. -- **HA.** Single-pod only by design; the branch-shard prerequisite in - [ha-gittarget-distribution-plan.md](ha-gittarget-distribution-plan.md) must - land before wildcard watches become a multi-pod feature. - -The finding and difficulty assessment below are retained as the rationale and the -roadmap for the remaining phases; they describe the pre-implementation state. - -## Finding: documented behavior contradicts implemented behavior - -The `WatchRule`/`ClusterWatchRule` CRD field docs promise Kubernetes -admission-webhook / RBAC wildcard semantics, but the GVR resolver refuses them. - -The field comments in [watchrule_types.go:71-118](../../api/v1alpha3/watchrule_types.go#L71-L118) -(shipped as the CRD OpenAPI schema → `kubectl explain`) state: - -- "All fields except Resources are optional and default to matching all when not - specified." -- `apiGroups`: "Wildcards supported: `*` matches all groups", "`["*"]` or `[]` - matches all groups". -- `apiVersions`: "If empty, matches all versions", "`*` matches all versions". -- `resources`: "Wildcard semantics follow Kubernetes admission webhook patterns: - `*` matches all resources", "`pods/*` matches all pod subresources", - "`pods/log` matches specific subresource". - -The resolver's preflight gate -([rule_gvr_resolver.go:108-131](../../internal/watch/rule_gvr_resolver.go#L108-L131)) -does the opposite: - -| User writes | Field doc promises | Resolver actually does | -|---|---|---| -| `resources: ["*"]` | all resources | `WildcardResource` miss — **refused** | -| `apiGroups: ["*"]` | all groups | `WildcardGroup` miss — **refused** | -| `apiVersions: []` / `["*"]` | all versions | single **preferred** version only | -| `apiGroups: []` (ambiguous resource) | all groups | `Ambiguous` miss — **refused** | -| `resources: ["pods/log"]`, `["pods/*"]` | subresource match | `NotServed` — **refused** | - -There is **no admission validation** rejecting these (only `Operations` has an -enum), so a user can `kubectl apply` a `resources: ["*"]` rule, get no error, and -**silently watch nothing** — only a `V(1)` resolve-miss log. See -[watchrule-wildcard-and-resolution-semantics.md](../design/watchrule-wildcard-and-resolution-semantics.md) -for the full current semantics. - -### Why it matters - -The field docs were written in the Kubernetes admission-webhook / RBAC / -audit-policy idiom (the comment says so verbatim). **That is what users will -expect** — `*` and "empty = all" are universal in those APIs. The current -behavior is a silent, surprising divergence from a well-known contract. - -### Why it diverges today - -RBAC and audit policy evaluate selectors **lazily, per request**: a concrete GVR -already exists on the incoming request and the rule is just a predicate. GitOps -Reverser must **eagerly materialize** the watch set — an informer per GVR plus -authoritative `list` snapshots — so it needs concrete GVRs *before* any event -exists. The resolver was added to fix a concrete expansion bug -([watchrule-gvr-resolution-plan.md](../finished/watchrule-gvr-resolution-plan.md)) and, in -making expansion safe, narrowed the contract without updating the docs. Notably -the *matching* layer ([manager.go:480-513](../../internal/watch/manager.go#L480-L513)) -*does* honor `*` lazily like RBAC — but it only ever runs against GVRs an -informer already delivers, so it cannot rescue a wildcard rule that planned -nothing. - -## What already exists (good news for difficulty) - -The hard part of dynamic wildcard support — reacting to a changing API surface — -is **already built and running**: - -- API-surface trigger informers watch CRDs and APIServices and coalesce - add/update/delete into `catalogRefreshCh` - ([manager_catalog.go:278-303](../../internal/watch/manager_catalog.go#L278-L303)). -- The manager loop re-runs `ReconcileForRuleChange` on that signal and every 30s - ([manager.go:218-245](../../internal/watch/manager.go#L218-L245)). -- `ReconcileForRuleChange` re-resolves desired GVRs, diffs added/removed against - active informers, and starts/stops informers live - ([manager.go:751-794](../../internal/watch/manager.go#L751-L794)). -- Per-GitTarget snapshot isolation already scopes which targets re-snapshot on a - plan change - ([gittarget-isolation-on-rule-change.md](../finished/gittarget-isolation-on-rule-change.md), - [rule-set-snapshot-discovery-lag-fix.md](../finished/rule-set-snapshot-discovery-lag-fix.md)). - -So "we'd have to redo reconciles when a GVR is added" is **already the steady -state** for explicit rules. Wildcard support mostly means letting the resolver -emit a larger, catalog-derived set; the reconcile/informer/snapshot plumbing -downstream is unchanged. The churn cost is real but **scoped to the targets that -actually use a wildcard** — explicit-rule targets keep full isolation. - -The default watch policy is a small **denylist** -([resource_policy.go:30-47](../../internal/watch/resource_policy.go#L30-L47)): -pods, events, endpoints, endpointslices, leases, controllerrevisions, jobs, -cronjobs, flowcontrol. So "watch everything" really means "every served, allowed, -listable, watchable resource minus ~12 noisy kinds" — still large (every CRD -kind in the cluster), which drives the scale concerns below. - -## Difficulty assessment - -Ordered low → high effort/risk. - -### A. Resolver wildcard expansion — **moderate, low risk** - -Replace the preflight refusals with catalog enumeration: - -- `apiGroups: ["*"]` → enumerate all groups serving the named resource(s). -- `resources: ["*"]` → enumerate all resources in the named group(s) (or all - groups if combined with group `*`). -- Both `*` → every entry in the catalog. - -The catalog already holds the data (`byGVR`, `byGroupVer`, `byResource`); add -enumeration accessors (e.g. `allEntries()`, `entriesForGroup(group)`). Reuse the -existing `Allowed` / `Supports("list","watch")` / scope filters in -`gvrsForCandidates` so policy and listability still apply. Bounded, mechanical. - -### B. Empty-vs-wildcard semantics — **small, but a real decision** - -Today empty `apiGroups` demands a *unique* group (`Ambiguous` otherwise). A -wildcard must mean "**all** matches", not "exactly one". Decision: keep `[]` = -"resolve to the single served group, else error" (current, safe) and make `["*"]` -= "all served groups". This preserves a useful strict mode while honoring the -documented wildcard. Same split for versions: `[]` = preferred (current), -`["*"]` = all served versions (new). - -### C. Subresources — **small; mostly a docs fix, not a feature** - -`pods/log` / `pods/*` cannot be `list`/`watch`-ed as a snapshot surface; the -list/watch+mirror model can't represent them. Recommend **dropping the -subresource promise from the field docs** rather than implementing it, and -keeping the `NotServed` classification. (Subresources still flow as audit events -through a different path; this is only about WatchRule planning.) - -### D. Snapshot robustness at wildcard scale — **moderate→large, the real risk** - -A wildcard target lists *every* allowed GVR. Two existing behaviors get stressed: - -- **Partial-view abort.** `RequestClusterState` aborts the whole target snapshot - if any single GVR `list` fails - ([manager.go](../../internal/watch/manager.go)) — correct for a *served* type - that we could not read, because a missing list looks like deletions. The - **NotFound** case (type no longer served) is now split out and skipped (see - [Item D decision](#item-d-decision-notfound-skips-everything-else-aborts)). - Across hundreds of GVRs the probability that *one served type* fails transiently - is still higher, so a wildcard target could rarely produce a complete snapshot. - Resolving that needs a per-GVR resilience strategy (retry/backoff or an explicit - partial-snapshot mode) that still distinguishes "failed to list a served type" - from "genuinely empty" without mirroring spurious deletions. This is the hardest - correctness question and the still-open remainder of D. -- **Informer scale / memory.** One informer per GVR across the whole surface is a - real resource cost; worth a soft cap or opt-in guardrail. - -#### Item D decision: NotFound skips, everything else aborts - -**Decided (2026-06-04).** The "one GVR failed to list" question splits cleanly on -the *kind* of failure: - -- **`NotFound` → skip that GVR, keep snapshotting.** A `list` returning NotFound - means the type is no longer served — its CRD or aggregated APIService was - removed between catalog resolution and the list. This is the **same condition - the resolver already treats as non-blocking** (`ResolveMissNotServed` is omitted - from `blockingSnapshotMisses`): a type absent from the catalog at resolve time is - silently skipped today. A type that vanishes in the narrow resolve→list race is - the identical situation discovered one step later, so it must be handled - identically. A no-longer-served type has no live resources to mistake for - deletions, so skipping it cannot mirror a spurious delete. -- **Any other error → abort the whole snapshot (unchanged).** A timeout, 5xx, or - connection failure on a type that *is* served means we could not read resources - that may well exist. Treating that as "empty" would wipe their mirrored files, - so the partial-view abort stays. - -This is provenance-independent — it applies whether the GVR came from a wildcard -or a named rule — because the resolver's existing `NotServed` skip is already -provenance-independent. It needs no per-GVR "is this wildcard?" tracking. It is -deliberately the *smaller* half of D: it fixes the CRD-churn race (a deleted CRD -elsewhere in the cluster no longer wedges every wildcard target) without yet -solving resilience to transient failures on served types at scale, which remains -open above. - -Implemented in `GetClusterStateForGitDest` -([manager.go](../../internal/watch/manager.go)); pinned by -`TestSnapshotSkipsTypeNoLongerServed` (skip path) alongside the unchanged -`TestSnapshotAbortsOnListError` / `TestSnapshotWildcardResourceAbortsOnAnyListError` -(abort path). Origin: this race was the dominant cause of the red `E2E (full)` runs -analysed in [wildcard-ci-failure-findings.md](../wildcard-ci-failure-findings.md). - -### E. Plan-hash churn — **small mechanically, a policy choice** - -A wildcard target's effective-watch-plan hash changes on every CRD install/delete -→ it re-snapshots each time. Per-target isolation already contains this to -wildcard targets. Options: accept it (simplest; the user opted into "everything"), -or debounce/coalesce CRD bursts. The existing `catalogRefreshCh` already coalesces -to depth 1, so bursts are partly absorbed. **Probably acceptable as-is for now.** - -### F. Status & validation surface — **small** - -- `ResolveWatchRuleResources` / `ResolveClusterWatchRuleResources` - ([manager_catalog.go:230-265](../../internal/watch/manager_catalog.go#L230-L265)) - should report "wildcard expanded to N GVRs" in status so users see the effect. -- Correct the CRD field docs (requires `task generate` + `task manifests`). -- Optionally add a `DiscoveryDegraded`-aware guard: a wildcard expanded while a - relevant group's discovery is degraded is an incomplete plan and should block - (consistent with current snapshot-safety rules). - -## Proposed phased plan - -1. ✅ **Phase 0 — stop the silent lie (smallest, ship independently).** Done: the - field docs now match reality (subresources rejected, `[]` resolves - uniquely/preferred) *and* admission validation rejects subresource entries. -2. ✅ **Phase 1 — resolver expansion (A + B + C).** Done: `*` enumeration with the - all-vs-unique split, subresource promise dropped, expansion surfaced in status - (F, partial). Gated behind the existing reconcile machinery; no snapshot - changes. Wildcard targets watch live events correctly. -3. ⬜ **Phase 2 — snapshot robustness (D).** Decide and implement per-GVR list - resilience so a wildcard target can take a complete, safe cluster snapshot. - This is the gating item for declaring wildcard support "done". -4. ⬜ **Phase 3 — guardrails (D scale, E debounce).** Informer-count cap/observability - and optional CRD-burst debounce if churn proves costly in practice. - -## Open decisions - -- Phase 0: fix docs, or add rejecting validation, or both? (Both is cleanest.) -- D: ~~what is the correct "one GVR failed to list" behavior for a wildcard target - — skip that GVR for this cycle (risk: looks like deletions) vs abort the whole - target (risk: wildcard targets rarely snapshot)?~~ **Split and partly decided:** - a **NotFound** (type no longer served) skips that GVR; every other error still - aborts — see - [Item D decision](#item-d-decision-notfound-skips-everything-else-aborts). The - transient-failure-on-a-served-type half (retry vs partial snapshot at scale) is - still open. -- Should "watch everything" remain policy-filtered by the default denylist, or - should wildcard rules be able to opt into the excluded noisy kinds? -- Is the plan-hash churn for wildcard targets acceptable for v1, or is debounce a - prerequisite? diff --git a/docs/proud.md b/docs/proud.md index a88a78f6..5df5eb23 100644 --- a/docs/proud.md +++ b/docs/proud.md @@ -13,7 +13,7 @@ to capture. ## 1. You can start programming in one click Open the repo in VS Code, **Reopen in Container**, and everything is already there. No "install -these twelve tools first" README. The [devcontainer](.devcontainer/devcontainer.json) ships every +these twelve tools first" README. The [devcontainer](../.devcontainer/devcontainer.json) ships every pinned tool the project needs — Go, `kubectl`, k3d, Helm, Kustomize, Kubebuilder, Flux, Tilt, `golangci-lint`, Delve, `valkey-cli`, `actionlint` — plus Go module/build caches on named volumes and SSH commit signing auto-synced from your host agent. @@ -51,7 +51,7 @@ The build isn't a `Makefile` — it's a real **DAG** expressed in [Task](https:/ step from source file to a running controller under e2e declares its real `sources`, `generates`, and `deps`, so **only what changed re-runs**. A cold e2e bring-up is ~5–6 minutes; a warm re-run of the *same* suite is ready in **seconds**, because every stamp is still up to date. The whole graph, -and why it pays off, is written up in [docs/tasks-overview.md](docs/tasks-overview.md). +and why it pays off, is written up in [docs/tasks-overview.md](tasks-overview.md). ## 6. An e2e harness that respects your time — and helps when it breaks @@ -97,7 +97,7 @@ be **SSH-signed**. It even captures resources served by an **aggregated API serv - **Three install modes** — config-dir, Helm, and plain manifests — all exercised by e2e. - A **mutation-capture lab** (`lab-e2e`) for stress-testing capture correctness. - `actionlint` on the CI workflows, Conventional Commits driving `release-please`. -- A genuinely deep [docs/architecture.md](docs/architecture.md) that answers the "but how does it +- A genuinely deep [docs/architecture.md](architecture.md) that answers the "but how does it actually…" questions instead of hand-waving. --- diff --git a/docs/security-model.md b/docs/security-model.md index 29028061..9bc03386 100644 --- a/docs/security-model.md +++ b/docs/security-model.md @@ -107,7 +107,7 @@ resource types can opt into the same encryption path at controller startup. See method from the keys present, preferring an SSH key, then HTTP basic auth, then a bearer token. The examples below use the Kubernetes-native key names; the reader also accepts the Flux and Argo CD key names so an existing GitOps Secret works unchanged (see -[`design/git-credentials-interop.md`](design/git-credentials-interop.md)). +[`design/git-credentials-interop.md`](finished/git-credentials-interop.md)). **HTTPS (basic auth)** diff --git a/docs/sops-age-guide.md b/docs/sops-age-guide.md index aea46a0e..35762b8e 100644 --- a/docs/sops-age-guide.md +++ b/docs/sops-age-guide.md @@ -190,5 +190,5 @@ The bootstrap template currently contains a static recipient in - For install and starter resource setup: [`../README.md`](../README.md) - For chart quickstart values: [`configuration.md`](configuration.md) -- For the deeper bootstrap/encryption architecture: [`design/sops-repo-bootstrap-and-key-management-architecture.md`](design/sops-repo-bootstrap-and-key-management-architecture.md) -- For explicit non-goals and deferred work: [`design/sops-repo-bootstrap-out-of-scope.md`](design/sops-repo-bootstrap-out-of-scope.md) +- For the deeper bootstrap/encryption architecture: [`design/sops-repo-bootstrap-and-key-management-architecture.md`](finished/sops-repo-bootstrap-and-key-management-architecture.md) +- For explicit non-goals and deferred work: [`design/sops-repo-bootstrap-out-of-scope.md`](finished/sops-repo-bootstrap-out-of-scope.md) diff --git a/docs/spec/README.md b/docs/spec/README.md new file mode 100644 index 00000000..b4ef3c4c --- /dev/null +++ b/docs/spec/README.md @@ -0,0 +1,36 @@ +# `docs/spec/` — this is true now, and the code depends on it + +Three folders, three meanings. This is the one that binds. + +| Folder | Means | +|---|---| +| [`../design/`](../design/) | **we are still deciding.** Open questions, proposals, unbuilt work. | +| **`spec/`** (here) | **this is true now.** The code implements it and cites it. Change the code, change the doc. | +| [`../finished/`](../finished/) | **this happened.** Shipped plans and closed investigations, kept for `git log`-grade context. Nothing here binds. | + +Everything in this folder is cited from Go source. If you change one of these +contracts, the citation is how the next person finds out. + +## Start here + +- [`manifest-system.md`](manifest-system.md) — **how the whole live → Git pipeline + works.** Read this first; it summarises everything else in this folder. + +## The contracts + +| Spec | What it pins | +|---|---| +| [`current-manifest-support-review.md`](current-manifest-support-review.md) | the manifest store, plan/apply/flush, and the all-or-nothing folder claim | +| [`contextual-namespace-and-kustomize-folder-editing.md`](contextual-namespace-and-kustomize-folder-editing.md) | kustomize graph-aware namespace inference; the supported subset | +| [`reconcile-via-watchlist-mark-and-sweep.md`](reconcile-via-watchlist-mark-and-sweep.md) | initial reconcile; **no bookmark, no sweep** | +| [`gittarget-new-file-placement-rules.md`](gittarget-new-file-placement-rules.md) | where a brand-new resource's file goes (F4) | +| [`manifestedit-field-ownership-spike.md`](manifestedit-field-ownership-spike.md) | "the API wins" — full-object ownership, and the do-not-build list | +| [`type-followability.md`](type-followability.md) | is a type followable, and if not, the single reason | +| [`type-lifecycle-events-and-wobble-settling.md`](type-lifecycle-events-and-wobble-settling.md) | removal grace and flap coalescing | +| [`gvk-gvr-mapping-layer.md`](gvk-gvr-mapping-layer.md) | the GVK↔GVR bijection contract | +| [`sops-single-file-no-multidoc.md`](sops-single-file-no-multidoc.md) | one encrypted file is one document | +| [`scale-subresource-audit-rehydration.md`](scale-subresource-audit-rehydration.md) | `/scale` → bounded field patch; every other subresource ignored | +| [`commit-window-refactor.md`](commit-window-refactor.md) | one grouped commit = one (author, GitTarget) | +| [`commitrequest-multi-finalize-design.md`](commitrequest-multi-finalize-design.md) | why `MaxConcurrentReconciles=1` on the CommitRequest controller | +| [`gittarget-isolation-on-rule-change.md`](gittarget-isolation-on-rule-change.md) | a rule change on target A never touches target B | +| [`audit-readiness-probe-plan.md`](audit-readiness-probe-plan.md) | why liveness must never depend on Redis | diff --git a/docs/finished/audit-readiness-probe-plan.md b/docs/spec/audit-readiness-probe-plan.md similarity index 95% rename from docs/finished/audit-readiness-probe-plan.md rename to docs/spec/audit-readiness-probe-plan.md index d70f2627..127cce56 100644 --- a/docs/finished/audit-readiness-probe-plan.md +++ b/docs/spec/audit-readiness-probe-plan.md @@ -21,7 +21,7 @@ This plan makes `/readyz` reflect the **locally-checkable audit-serving precondi in the wild, the kube-apiserver stops routing audit traffic to a pod that isn't ready to receive it — without the e2e's external probing. It is the production implementation of recommendation **A1** in -[startup-robustness-cert-and-crd-wobble.md](../design/startup-robustness-cert-and-crd-wobble.md#L163-L167). +[startup-robustness-cert-and-crd-wobble.md](../finished/startup-robustness-cert-and-crd-wobble.md#L163-L167). --- @@ -29,7 +29,7 @@ it — without the e2e's external probing. It is the production implementation o The kube-apiserver reaches the manager **through a Service** — the chart and the e2e kubeconfig both target `gitops-reverser-audit..svc.cluster.local:9444` -([prepare-sample-apiserver-proxy-webhook-kubeconfig.sh:17](../../hack/e2e/prepare-sample-apiserver-proxy-webhook-kubeconfig.sh#L17)), +(prepare-sample-apiserver-proxy-webhook-kubeconfig.sh:17), and the pod already carries a `readinessProbe → /readyz` ([charts/.../deployment.yaml:124-132](../../charts/gitops-reverser/templates/deployment.yaml#L124-L132), [config/deployment.yaml:50-66](../../config/deployment.yaml#L50-L66)). @@ -149,8 +149,8 @@ brief blip never depopulates endpoints — but given the existing 500-retry path recommended** as a first step. Implementation note: the audit queues wrap `*redis.Client` -([redis_bytype_queue.go:130](../../internal/queue/redis_bytype_queue.go#L130), -[redis_objects_snapshot.go:65](../../internal/queue/redis_objects_snapshot.go#L65)) but expose no +(redis_bytype_queue.go:130, +redis_objects_snapshot.go:65) but expose no health method. Add a small `Ping(ctx) error` to the by-type queue (the canonical audit producer) and call it once at boot to satisfy the gate; no new client or pool is needed. @@ -195,7 +195,7 @@ and call it once at boot to satisfy the gate; no new client or pool is needed. ## 8. Relationship to existing work - Implements **A1** from - [startup-robustness-cert-and-crd-wobble.md](../design/startup-robustness-cert-and-crd-wobble.md#L163-L167); + [startup-robustness-cert-and-crd-wobble.md](../finished/startup-robustness-cert-and-crd-wobble.md#L163-L167); complementary to **A2** (apply certs before the Deployment) — A2 shrinks the not-ready window, this makes the window safe. - Orthogonal to the CRD-wobble hazard (B-series) in the same doc. diff --git a/docs/finished/commit-window-refactor.md b/docs/spec/commit-window-refactor.md similarity index 100% rename from docs/finished/commit-window-refactor.md rename to docs/spec/commit-window-refactor.md diff --git a/docs/design/commitrequest-admission-authorship.md b/docs/spec/commitrequest-admission-authorship.md similarity index 99% rename from docs/design/commitrequest-admission-authorship.md rename to docs/spec/commitrequest-admission-authorship.md index f6672356..ffaa330a 100644 --- a/docs/design/commitrequest-admission-authorship.md +++ b/docs/spec/commitrequest-admission-authorship.md @@ -23,7 +23,7 @@ related: > audit-sourced CommitRequest attribution rather than layering on top of it. This is the forward-facing companion to -[commitrequest-attribution-divert-reliability.md](../finished/commitrequest-attribution-divert-reliability.md), +[commitrequest-attribution-divert-reliability.md](commitrequest-admission-authorship.md), which adopted "Option C" (capture the author as a keyed fact at audit ingestion). Option C was the right *shape* — a divert-immune keyed fact, not an ordered-stream scan — but it kept the **wrong source** (the audit event) and therefore kept a @@ -79,7 +79,7 @@ would silently inherit semantics that are wrong for a command: So: a **separate store, separate author subnamespace, separate record type.** It is not cosmetic separation — it keeps each path's invariant clean. The Redis naming plan is `author:v1:audit` for persisted-resource facts and `author:v1:command` for -admission-captured commands ([redis-key-schema-v3.md](redis-key-schema-v3.md)). +admission-captured commands ([redis-key-schema-v3.md](../finished/redis-key-schema-v3.md)). --- @@ -468,7 +468,7 @@ who need it, and a cert-manager easy-route shipped in the chart for everyone els ([validating-webhook.yaml](../../config/webhook/validating-webhook.yaml)). Gate the whole block on a chart value (e.g. `internalCommands.enabled`, `internalCommands.certManager.enabled`) so a non-cert-manager user can opt into BYO - certs instead. See [audit-webhook-tls-design.md](audit-webhook-tls-design.md) for the + certs instead. See [audit-webhook-tls-design.md](../finished/audit-webhook-tls-design.md) for the long-lived-CA + short-lived-serving-cert rotation model to mirror. This is the one genuinely new packaging surface (the chart "ships no webhook/cert diff --git a/docs/design/stream/commitrequest-design.md b/docs/spec/commitrequest-design.md similarity index 96% rename from docs/design/stream/commitrequest-design.md rename to docs/spec/commitrequest-design.md index 65b8540d..fea2cc08 100644 --- a/docs/design/stream/commitrequest-design.md +++ b/docs/spec/commitrequest-design.md @@ -9,15 +9,15 @@ > `Ready`/`Pushed`/`Stalled` conditions and the `Ready` reason. > (2) The spec field `delaySeconds` is now **`closeDelaySeconds`** (it delays closing the open window). > Read every `delaySeconds` below as `closeDelaySeconds`. See -> [status-conditions-guide.md](../status-conditions-guide.md) §CommitRequest and +> [status-conditions-guide.md](status-conditions-guide.md) §CommitRequest and > `api/v1alpha3/commitrequest_types.go` for the contract. > Status: living design note, 2026-06-12. > Supersedes the speculative redesign in -> [github-e2e-per-type-tail-failure-investigation.md](./github-e2e-per-type-tail-failure-investigation.md) §11–§15. -> Related: [commitrequest-barrier-timeout-decision.md](../../finished/commitrequest-barrier-timeout-decision.md) -> (Option A), [commitrequest-multi-finalize-design.md](../../finished/commitrequest-multi-finalize-design.md) -> (single-worker serialization), [canonical-stream-retirement.md](../../finished/canonical-stream-retirement.md) +> [github-e2e-per-type-tail-failure-investigation.md](../finished/signing-snapshot-tail-replay-failure-investigation.md) §11–§15. +> Related: [commitrequest-barrier-timeout-decision.md](commitrequest-design.md) +> (Option A), [commitrequest-multi-finalize-design.md](commitrequest-multi-finalize-design.md) +> (single-worker serialization), [canonical-stream-retirement.md](../architecture.md) > (the per-type-stream refactor that motivates this note). ## 1. What a CommitRequest is for @@ -121,7 +121,7 @@ The design's job is to **bound and report** them, not to pretend they don't exis ### 5.1 The CRD -`CommitRequestSpec` ([api/v1alpha3/commitrequest_types.go](../../../api/v1alpha3/commitrequest_types.go)): +`CommitRequestSpec` ([api/v1alpha3/commitrequest_types.go](../../api/v1alpha3/commitrequest_types.go)): - `gitTargetRef.name` — the GitTarget whose window to finalize (same namespace). - `message` — optional verbatim commit message (1–1024 chars, no control chars). @@ -135,7 +135,7 @@ The design's job is to **bound and report** them, not to pretend they don't exis ### 5.2 The controller state machine -[`CommitRequestReconciler.Reconcile`](../../../internal/controller/commitrequest_controller.go) +[`CommitRequestReconciler.Reconcile`](../../internal/controller/commitrequest_controller.go) runs with `MaxConcurrentReconciles=1` — the single worker *is* the multi-CommitRequest ordering design, so no two finalizes interleave. One object is advanced through: @@ -169,7 +169,7 @@ Step 2 does two jobs at once, and this is the most important property of the des ### 5.4 The finalize signal and the open window `FinalizeGitTargetWindow` enqueues a `FinalizeSignal` -([finalize_signal.go](../../../internal/git/finalize_signal.go)) onto the branch +(finalize_signal.go) onto the branch worker's **FIFO event queue** — the same queue resource events ride — so by arrival order it is processed after every earlier write for that worker. `handleFinalizeSignal`: @@ -182,18 +182,18 @@ order it is processed after every earlier write for that worker. ### 5.5 The watermark barrier (the part we are removing) Today, before finalizing, the controller takes a per-type watermark snapshot and -drains the tails to it ([commit_barrier.go](../../../internal/watch/commit_barrier.go)), +drains the tails to it (commit_barrier.go), bounded by `FinalizeBarrierTimeout = 15s`, degrading visibly on timeout (Option A). Three facts decide its fate: - It is **already best-effort** — the 15s timeout means it never was an invariant. - It is taken **audit-anchored**, in step 4 *after* attribution and delay - ([commitrequest_controller.go:175](../../../internal/controller/commitrequest_controller.go#L175)), + ([commitrequest_controller.go:175](../../internal/controller/commitrequest_controller.go#L175)), despite the stale "creation time" comment in the code. - It has a **target-local gap**: the tail advances one cursor *per type* even when a particular GitTarget was skipped - ([audit_tail.go:177](../../../internal/watch/audit_tail.go#L177) vs the skip at - [audit_tail.go:200](../../../internal/watch/audit_tail.go#L200)), so it can report + (audit_tail.go:177 vs the skip at + audit_tail.go:200), so it can report `barrierReached=true` for a target that did not actually receive every protected entry. A best-effort mechanism that can return a **false positive** launders "we don't know" into a green status. @@ -343,7 +343,7 @@ Transitions, all on the single worker loop goroutine (so no locking beyond the t #### 6.4.2 One chokepoint makes every cut-off honor the message All finalize paths already funnel through a single function -([`finalizeOpenWindowWithMessage`](../../../internal/git/branch_worker.go)). That is +([`finalizeOpenWindowWithMessage`](../../internal/git/branch_worker.go)). That is the leverage point. Change it to: 1. use the explicit override message if the caller passed one, **else the window's @@ -458,9 +458,9 @@ is the honest, defensible contract. ## 6.5 Resolving the request: on push, from the `PendingWrite` The `PendingWrite` is already the system's nicest construct here: it carries the -commit message verbatim ([commit_executor.go:73](../../../internal/git/commit_executor.go#L73)), +commit message verbatim ([commit_executor.go:73](../../internal/git/commit_executor.go#L73)), it is retained across the cooldown wait, and it survives the push-conflict -rebase-replay ([branch_worker.go:1091](../../../internal/git/branch_worker.go#L1091)) +rebase-replay ([branch_worker.go:1091](../../internal/git/branch_worker.go#L1091)) because the replay re-commits straight from it. So make it carry the CommitRequest's result handle too, and resolve the request **when, and only when, its `PendingWrite` is pushed**: @@ -475,7 +475,7 @@ PendingWrite: - `executePendingWrite` already calls `worktree.Commit`, which returns the hash; thread it back onto `CommitSHA`. On a rebase-replay the write is re-executed, so `CommitSHA` is naturally **refreshed to the post-rebase hash** — no stale SHA. -- On a successful push ([`pushPending`](../../../internal/git/branch_worker.go#L910)), +- On a successful push ([`pushPending`](../../internal/git/branch_worker.go#L910)), walk the pushed writes and, for each that carries a `CommitRequest`, record `commitRequestOutcomes[cr] = {Committed, CommitSHA, branch}`. @@ -491,7 +491,7 @@ the contract: *after* any rebase-replay. The SHA-churn problem from the push-honesty discussion disappears. - **Push failure is honest too.** A failed push retains the `PendingWrite` - ([branch_worker.go:916-922](../../../internal/git/branch_worker.go#L916-L922)) and + ([branch_worker.go:916-922](../../internal/git/branch_worker.go#L916-L922)) and does not advance `lastPushAt`, so the request simply stays non-terminal while the worker retries, with the push error surfaced in `status.message`. It flips to `Committed` when a retry lands. It genuinely is not saved until then, and the status @@ -573,7 +573,7 @@ discriminator that status consumers and tests assert on. This is the case that interacts with §6.5, and it is why it needs explicit handling. A finalized window normally creates a commit whose `PendingWrite` resolves the request -on push. But [`executePendingWrite`](../../../internal/git/commit_executor.go#L132-L138) +on push. But [`executePendingWrite`](../../internal/git/commit_executor.go#L132-L138) returns `(0, nil)` when the events produce no change — **no commit, nothing to push.** A request waiting for a push that never comes would sit in `AwaitingPush` until the controller's safety bound and then mis-resolve. @@ -614,7 +614,7 @@ The CRD keeps a small phase set; the richer "moments" are internal. ## 8. End-to-end tests (both use cases must be covered) Both use cases get a dedicated e2e spec. They share the existing harness shape -([test/e2e/commit_request_e2e_test.go](../../../test/e2e/commit_request_e2e_test.go)): +([test/e2e/commit_request_e2e_test.go](../../test/e2e/commit_request_e2e_test.go)): a dedicated Gitea repo, GitProvider with a **large `commitWindow` (300s)** so the silence timer can never be what produces the commit, a GitTarget, and a WatchRule. A large window plus the dedicated repo realize A1; the dedicated namespace/repo diff --git a/docs/finished/commitrequest-multi-finalize-design.md b/docs/spec/commitrequest-multi-finalize-design.md similarity index 99% rename from docs/finished/commitrequest-multi-finalize-design.md rename to docs/spec/commitrequest-multi-finalize-design.md index a45fee73..3b9ac5f5 100644 --- a/docs/finished/commitrequest-multi-finalize-design.md +++ b/docs/spec/commitrequest-multi-finalize-design.md @@ -5,7 +5,7 @@ > shipped; the coordinator goroutine, the annotation persistence, and the requeue-poll > state machine did not — `MaxConcurrentReconciles=1` plus a fresh snapshot per attempt > deliver the same guarantees with less machinery. -> Context: [canonical-stream-retirement.md](canonical-stream-retirement.md) §8 C-B2 row +> Context: [canonical-stream-retirement.md](../architecture.md) §8 C-B2 row > + the multi-CommitRequest ordering hazard raised 2026-06-11 ## 1. The problem the design must solve @@ -387,7 +387,7 @@ weight without benefit. and only then finalizes with the strict author match. Unattributable within 60s → `Failed`, fail closed. The same wait re-anchors the trigger on the audit ingest path, closing the watch-event-outruns-ingest race the first e2e run exposed — see the DEC-B - "as landed" note in [canonical-stream-retirement.md](canonical-stream-retirement.md) §4. + "as landed" note in [canonical-stream-retirement.md](../architecture.md) §4. A new `spec.delaySeconds` (0–300) optionally holds the finalize as an extra collect window after creation. diff --git a/docs/design/manifest/contextual-namespace-and-kustomize-folder-editing.md b/docs/spec/contextual-namespace-and-kustomize-folder-editing.md similarity index 97% rename from docs/design/manifest/contextual-namespace-and-kustomize-folder-editing.md rename to docs/spec/contextual-namespace-and-kustomize-folder-editing.md index 456ed1ae..bab31df2 100644 --- a/docs/design/manifest/contextual-namespace-and-kustomize-folder-editing.md +++ b/docs/spec/contextual-namespace-and-kustomize-folder-editing.md @@ -6,11 +6,11 @@ > Captured: 2026-06-08 > Updated: 2026-06-08 > Related: -> [file-agnostic-placement.md](file-agnostic-placement.md), -> [manifest-inventory-file-agnostic-placement.md](manifest-inventory-file-agnostic-placement.md), -> [current-manifest-support-review.md](../../finished/current-manifest-support-review.md), -> [version2/gittarget-repository-validity-and-placement.md](version2/gittarget-repository-validity-and-placement.md), -> [version2/gittarget-new-file-placement-rules.md](version2/gittarget-new-file-placement-rules.md) +> [file-agnostic-placement.md](gittarget-new-file-placement-rules.md), +> [manifest-inventory-file-agnostic-placement.md](manifest-system.md), +> [current-manifest-support-review.md](current-manifest-support-review.md), +> [version2/gittarget-repository-validity-and-placement.md](gittarget-new-file-placement-rules.md), +> [version2/gittarget-new-file-placement-rules.md](gittarget-new-file-placement-rules.md) ## Summary diff --git a/docs/finished/current-manifest-support-review.md b/docs/spec/current-manifest-support-review.md similarity index 98% rename from docs/finished/current-manifest-support-review.md rename to docs/spec/current-manifest-support-review.md index aac41a3f..3926b37b 100644 --- a/docs/finished/current-manifest-support-review.md +++ b/docs/spec/current-manifest-support-review.md @@ -3,12 +3,12 @@ > Status: architecture review, captured 2026-06-04 > Related: > `implementation-plan.md`, -> [reconcile-via-watchlist-mark-and-sweep.md](../design/manifest/reconcile-via-watchlist-mark-and-sweep.md), +> [reconcile-via-watchlist-mark-and-sweep.md](reconcile-via-watchlist-mark-and-sweep.md), > [gvk-gvr-mapping-layer.md](gvk-gvr-mapping-layer.md), -> [current-manifest-support-review-feedback.md](current-manifest-support-review-feedback.md), -> [manifest-inventory-file-agnostic-placement.md](../design/manifest/manifest-inventory-file-agnostic-placement.md), -> [manifestedit-abstraction-plan.md](../design/manifest/manifestedit-abstraction-plan.md), -> [manifestedit-writer-followups.md](../design/manifest/manifestedit-writer-followups.md), +> [current-manifest-support-review-feedback.md](current-manifest-support-review.md), +> [manifest-inventory-file-agnostic-placement.md](manifest-system.md), +> [manifestedit-abstraction-plan.md](manifest-system.md), +> [manifestedit-writer-followups.md](manifest-system.md), > [`internal/git/manifestedit/DECISION.md`](../../internal/git/manifestedit/DECISION.md) ## Summary @@ -35,9 +35,9 @@ manifest-identity and a resource-identity index, fed by a first-class plan that the same value for the writer, scan mode, the CLI, and status. The initial reconcile is driven by a streaming-list watch and a mark-and-sweep against that model — see -[reconcile-via-watchlist-mark-and-sweep.md](../design/manifest/reconcile-via-watchlist-mark-and-sweep.md). +[reconcile-via-watchlist-mark-and-sweep.md](reconcile-via-watchlist-mark-and-sweep.md). The feedback that drove this sharpening is in -[current-manifest-support-review-feedback.md](current-manifest-support-review-feedback.md). +[current-manifest-support-review-feedback.md](current-manifest-support-review.md). ## Non-Negotiable Design Decisions @@ -480,7 +480,7 @@ store, and a **mark-and-sweep** drops the watched, in-scope documents the stream never touched. Untracked content is never a member of that swept model, so it can never be deleted by construction. Steady-state events are single plan actions over the maintained store, not a re-sweep. See -[reconcile-via-watchlist-mark-and-sweep.md](../design/manifest/reconcile-via-watchlist-mark-and-sweep.md). +[reconcile-via-watchlist-mark-and-sweep.md](reconcile-via-watchlist-mark-and-sweep.md). ### Two boundaries: cheap per event, materialize per commit @@ -675,7 +675,7 @@ sweep can flip it per document. We deliberately do not: the durable model holds file, not the document. A multi-document file with one document dropped is dirty, not deleted; it becomes deleted only when its last document is dropped. - *The sweep needs no flag.* Per - [reconcile-via-watchlist-mark-and-sweep.md](../design/manifest/reconcile-via-watchlist-mark-and-sweep.md), + [reconcile-via-watchlist-mark-and-sweep.md](reconcile-via-watchlist-mark-and-sweep.md), the "mark" is the set of streamed identities and the "sweep" is a one-pass set-difference (`orphans = members − streamed`) computed at the bookmark, which then *emits* drop actions. This is isomorphic to per-document flag-toggling but diff --git a/docs/design/deletecollection-attribution-expander.md b/docs/spec/deletecollection-attribution-expander.md similarity index 96% rename from docs/design/deletecollection-attribution-expander.md rename to docs/spec/deletecollection-attribution-expander.md index 096ee510..e9a8faf5 100644 --- a/docs/design/deletecollection-attribution-expander.md +++ b/docs/spec/deletecollection-attribution-expander.md @@ -9,10 +9,10 @@ > already solved by construction in watch-first (one watch event per object); this doc adds the *intent > semantics* and the *attribution*. > Related: -> [watch-first ingestion architecture](watch-first-ingestion-architecture.md), -> [watch-first merge readiness §4](watch-first-merge-readiness.md), -> [superseded `deletecollection` nudge plan](../finished/deletecollection-resync-nudge-plan.md), -> [watch event ordering & attribution grace](watch-event-ordering-and-attribution-grace.md), +> [watch-first ingestion architecture](../finished/watch-first-ingestion-architecture.md), +> watch-first merge readiness §4, +> [superseded `deletecollection` nudge plan](deletecollection-attribution-expander.md), +> [watch event ordering & attribution grace](../facts/watch-event-ordering-and-attribution-grace.md), > [`internal/watch/target_watch.go`](../../internal/watch/target_watch.go), > [`internal/sanitize/sanitize.go`](../../internal/sanitize/sanitize.go), > [`internal/queue/attribution_index.go`](../../internal/queue/attribution_index.go), @@ -112,7 +112,7 @@ One local change in the watch router, plus a dependency that already holds: on the logical delete — call this out in review.) - **Later events fold to no-ops.** The eventual finalizer-clearing `MODIFIED` (still `Terminating`) and the final `DELETED` re-issue "delete X" against an already-absent path → the writer diffs them to **no-op → no commit** - ([merge-readiness](watch-first-merge-readiness.md): no-op suppression lives in the writer). No extra + (merge-readiness: no-op suppression lives in the writer). No extra bookkeeping is needed to suppress the follow-on events; the empty diff does it. ## 3. Why collection-delete attribution joins by UID, not RV (the linchpin) @@ -126,7 +126,7 @@ A removal cannot join the attribution index on resourceVersion: The only field **stable and identical on both sides is `metadata.uid`.** So the expander writes a **UID-keyed** fact per item, and the removal event joins it by UID — exactly "join per-object by UID, not RV" carried from the -[superseded nudge plan](../finished/deletecollection-resync-nudge-plan.md). Concretely, the expander writes the +[superseded nudge plan](deletecollection-attribution-expander.md). Concretely, the expander writes the **uid-only** key variant (`factKeyVariants(..., uid, "")` returns just that one key — the exact and rv-only variants are skipped when no RV is supplied, which is precisely right since the body RV is dead). @@ -139,7 +139,7 @@ variants are skipped when no RV is supplied, which is precisely right since the ## 4. Background: what's already true (don't re-solve these) - **State is solved by construction** — N watch events, mark-and-sweep backstop - ([merge-readiness §4](watch-first-merge-readiness.md)). + (merge-readiness §4). - **A name-less event stores nothing today.** `RecordFact` early-returns when `identity.Name == ""` ([attribution_index.go:216](../../internal/queue/attribution_index.go#L216)), so a `deletecollection` writes **zero** facts now — the expander is purely **additive**. @@ -195,7 +195,7 @@ When a removal event matches an expander fact, `attributionResultForMatch` ([attribution_index.go:332](../../internal/queue/attribution_index.go#L332)) today returns `weak` (uid-only). Add `AttributionExactDeleteCollectionItem` and return it when `fact.Verb == "deletecollection"`, so collection-member attributions are distinct from generic weak matches in metrics — realizing the `exact-deletecollection-item` -reason code that [merge-readiness §3.5](watch-first-merge-readiness.md) lists as unused. +reason code that merge-readiness §3.5 lists as unused. ## 6. The hard case — hollow / empty body (aggregated & metadata-only) diff --git a/docs/design/e2e-bi-directional-corner.md b/docs/spec/e2e-bi-directional-corner.md similarity index 98% rename from docs/design/e2e-bi-directional-corner.md rename to docs/spec/e2e-bi-directional-corner.md index f50271ef..51536c09 100644 --- a/docs/design/e2e-bi-directional-corner.md +++ b/docs/spec/e2e-bi-directional-corner.md @@ -387,7 +387,7 @@ stripped too, so its applies are commit-neutral.) Expected timeline, from the verified constants: self-heal's **first** revert is sub-second (backoff is zero on attempt 0; -[`argocd-bi-directional.md`](gitops-api/argocd-bi-directional.md)), replaying the +[`argocd-bi-directional.md`](../design/gitops-api/argocd-bi-directional.md)), replaying the stale cached revision. The Reverser commits `WaffleBowl`, then observes the revert and commits `Cone`. At the 180s refresh Argo finds `Cone` in Git and is already Synced. **The user's change is lost, and Git history flaps.** @@ -430,7 +430,7 @@ directions: the API can now own it, but a **Git-side** change to `/spec/scoops` would no longer reach the cluster either. That is the whole point of split ownership, and the whole reason it is not the bi-directional answer. The genuine bi-directional configuration is `selfHeal: false` + the webhook (see -[`argocd-bi-directional.md`](gitops-api/argocd-bi-directional.md)); Spec C exists +[`argocd-bi-directional.md`](../design/gitops-api/argocd-bi-directional.md)); Spec C exists to pin the *contrast* — the difference from Spec B is one `ignoreDifferences` stanza, and it is the difference between the cluster losing the change and the cluster keeping it by taking the field out of GitOps. @@ -446,7 +446,7 @@ patch and the Reverser's commit, which would otherwise reset the field `syncPolicy.automated: {prune: true, selfHeal: false}`, no `ignoreDifferences`. This is the genuine bi-directional configuration from -[`argocd-bi-directional.md`](gitops-api/argocd-bi-directional.md): the field stays +[`argocd-bi-directional.md`](../design/gitops-api/argocd-bi-directional.md): the field stays fully GitOps-managed (unlike Spec C, which carves it out) and changes from **both** sides. It is the deterministic counterpart to Spec B — nothing reverts live drift, so every step can be asserted directly, with no timing race. @@ -570,7 +570,7 @@ New matrix entry in `.github/workflows/ci.yml`: `GOCOVERDIR` overlay, so Codecov unions its `e2e` upload with the other legs and the non-regression ratchet still holds. -Per [`e2e-sharding`](e2e-ci-runner-sharding-plan.md), e2e is **not** a required +Per [`e2e-sharding`](../finished/e2e-ci-runner-sharding-plan.md), e2e is **not** a required check on `main` (only *Project image*, *Unit tests*, *Lint* are), so adding a leg carries no merge-gating risk. The two specs are pulled out of `full-core`, so that leg gets faster. @@ -620,6 +620,6 @@ neither is `Serial`. - [`docs/bi-directional.md`](../bi-directional.md) — the product-level guidance this closes gaps in - [`docs/design/e2e-serial-registry.md`](e2e-serial-registry.md) — parallelism and shared cluster state -- [`docs/design/e2e-ci-runner-sharding-plan.md`](e2e-ci-runner-sharding-plan.md) — leg membership and rebalancing +- [`docs/design/e2e-ci-runner-sharding-plan.md`](../finished/e2e-ci-runner-sharding-plan.md) — leg membership and rebalancing - [`test/e2e/flux_bi_directional_e2e_test.go`](../../test/e2e/flux_bi_directional_e2e_test.go) and [`test/e2e/argocd_bi_directional_e2e_test.go`](../../test/e2e/argocd_bi_directional_e2e_test.go) — the two specs in this corner - [`internal/sanitize/types.go`](../../internal/sanitize/types.go) — the strip lists diff --git a/docs/design/e2e-serial-registry.md b/docs/spec/e2e-serial-registry.md similarity index 98% rename from docs/design/e2e-serial-registry.md rename to docs/spec/e2e-serial-registry.md index cd95b3f6..5b2843a4 100644 --- a/docs/design/e2e-serial-registry.md +++ b/docs/spec/e2e-serial-registry.md @@ -3,7 +3,7 @@ This is a **living document**. It is the authoritative list of e2e test containers that must run `Serial` (i.e. never concurrently with any other spec) under bounded Ginkgo parallelism (Phase 2.5 of -[e2e-speedup-plan.md](e2e-speedup-plan.md)). +[e2e-speedup-plan.md](../finished/e2e-speedup-plan.md)). > De-serializing any row below is an isolation refactor, not a label flip. > The two audit-consumer specs, `bi_directional`, and `aggregated_apiserver` have @@ -90,7 +90,7 @@ was de-serialized after its `Serial` justification proved **stale**. The note claimed it "installs/removes a cluster-scoped `APIService` while it is in flight", but the wardle APIService (`v1alpha1.wardle.example.com`) is installed once at cluster setup by the apiservice-audit-proxy HelmRelease -([setup/flux/releases/aggregated-api.yaml](../../test/e2e/setup/flux/releases/aggregated-api.yaml)) +(setup/flux/releases/aggregated-api.yaml) and stays Available for the whole suite. The spec only *reads* it — it never registers or removes it — so there is no in-flight discovery perturbation to serialize against. Everything the spec mutates is name-isolated (own namespace, diff --git a/docs/design/e2e-test-design.md b/docs/spec/e2e-test-design.md similarity index 97% rename from docs/design/e2e-test-design.md rename to docs/spec/e2e-test-design.md index a9e30e8a..c2886b9d 100644 --- a/docs/design/e2e-test-design.md +++ b/docs/spec/e2e-test-design.md @@ -42,7 +42,7 @@ What it does not promise: - removal of all remaining shell from the harness - total independence from shared cluster-side services -Those broader open items live in [e2e-finish-plan.md](./e2e-finish-plan.md). +Those broader open items live in [e2e-finish-plan.md](../design/e2e-finish-plan.md). ## Cross-Cutting Requirements @@ -214,7 +214,7 @@ has already copied into the target namespace. ## BeforeSuite Contract -The central setup happens in [test/e2e/e2e_suite_test.go](/workspaces/gitops-reverser/test/e2e/e2e_suite_test.go). +The central setup happens in [test/e2e/e2e_suite_test.go](../../test/e2e/e2e_suite_test.go). `ensureE2EPrepared()` is intentionally narrow: @@ -223,7 +223,7 @@ The central setup happens in [test/e2e/e2e_suite_test.go](/workspaces/gitops-rev 3. Ensures `E2E_AGE_KEY_FILE` points at the prepared age key `BeforeSuite` does **not** bootstrap any Gitea repo. Per-file repo setup is the responsibility of each -repo-using test file via [`SetupRepo(...)`](/workspaces/gitops-reverser/test/e2e/suite_repo_test.go). +repo-using test file via `SetupRepo(...)`. The only cluster-level variable still consumed across files is: @@ -283,7 +283,7 @@ That is exactly why the issue surfaced around `image_refresh_test.go`: it repeat ### 2. CI does not necessarily exercise the exact same sequence every time -Current CI e2e matrix in [.github/workflows/ci.yml](/workspaces/gitops-reverser/.github/workflows/ci.yml:248): +Current CI e2e matrix in .github/workflows/ci.yml: - `quickstart-helm-and-makefile-image-refresh` - `quickstart-manifest` @@ -308,7 +308,7 @@ did not trip over the shared-fixture deletion at that time. Yes. -That happens in [hack/cleanup-installs.sh](/workspaces/gitops-reverser/hack/cleanup-installs.sh:32). +That happens in hack/cleanup-installs.sh. Specifically, for each namespace with an install stamp it does: diff --git a/docs/design/gitpath-foreign-content-stringency.md b/docs/spec/gitpath-foreign-content-stringency.md similarity index 100% rename from docs/design/gitpath-foreign-content-stringency.md rename to docs/spec/gitpath-foreign-content-stringency.md diff --git a/docs/finished/gittarget-isolation-on-rule-change.md b/docs/spec/gittarget-isolation-on-rule-change.md similarity index 100% rename from docs/finished/gittarget-isolation-on-rule-change.md rename to docs/spec/gittarget-isolation-on-rule-change.md diff --git a/docs/design/manifest/version2/gittarget-new-file-placement-rules.md b/docs/spec/gittarget-new-file-placement-rules.md similarity index 97% rename from docs/design/manifest/version2/gittarget-new-file-placement-rules.md rename to docs/spec/gittarget-new-file-placement-rules.md index 2e0232d2..f12ea305 100644 --- a/docs/design/manifest/version2/gittarget-new-file-placement-rules.md +++ b/docs/spec/gittarget-new-file-placement-rules.md @@ -10,13 +10,13 @@ > the encryption guarantee is preserved without the API-level split. > Captured: 2026-06-05 > Related: -> [file-agnostic-placement.md](../file-agnostic-placement.md) — **the vision Option C serves**, -> [contextual-namespace-and-kustomize-folder-editing.md](../contextual-namespace-and-kustomize-folder-editing.md), -> [gittarget-repository-validity-and-placement.md](gittarget-repository-validity-and-placement.md), -> [current-manifest-support-review.md](../../../finished/current-manifest-support-review.md), -> [manifestedit-new-file-placement-spike.md](../../../finished/manifestedit-new-file-placement-spike.md), -> [reconcile-via-watchlist-mark-and-sweep.md](../reconcile-via-watchlist-mark-and-sweep.md), -> [gitpath-foreign-content-stringency.md](../../gitpath-foreign-content-stringency.md) +> [file-agnostic-placement.md](gittarget-new-file-placement-rules.md) — **the vision Option C serves**, +> [contextual-namespace-and-kustomize-folder-editing.md](contextual-namespace-and-kustomize-folder-editing.md), +> [gittarget-repository-validity-and-placement.md](gittarget-new-file-placement-rules.md), +> [current-manifest-support-review.md](current-manifest-support-review.md), +> [manifestedit-new-file-placement-spike.md](gittarget-new-file-placement-rules.md), +> [reconcile-via-watchlist-mark-and-sweep.md](reconcile-via-watchlist-mark-and-sweep.md), +> [gitpath-foreign-content-stringency.md](gitpath-foreign-content-stringency.md) ## Summary @@ -50,7 +50,7 @@ they layer: layout already in the repo*; on an empty repo it falls through to today's canonical path, so default behaviour is byte-identical to now. C is what makes "point me at an existing folder and it just works" real — the vision in - [file-agnostic-placement.md](../file-agnostic-placement.md) — and it removes the + [file-agnostic-placement.md](gittarget-new-file-placement-rules.md) — and it removes the need for B to carry a catch-all default, because the gaps B leaves are filled by inference rather than by a hand-written fallback template. @@ -104,23 +104,23 @@ escape hatch if users later need scope-wide or metadata-aware placement. The current `GitTargetSpec` has `providerRef`, `branch`, `path`, and optional `encryption`; it has no placement policy yet -([api/v1alpha3/gittarget_types.go](../../../../api/v1alpha3/gittarget_types.go)). +([api/v1alpha3/gittarget_types.go](../../api/v1alpha3/gittarget_types.go)). The writer already uses the materialized-model direction described in -[current-manifest-support-review.md](../../../finished/current-manifest-support-review.md): +[current-manifest-support-review.md](current-manifest-support-review.md): - steady-state writes scan the GitTarget subtree into a content-derived store, then apply a commit-scoped plan - ([internal/git/plan_flush.go](../../../../internal/git/plan_flush.go)); + ([internal/git/plan_flush.go](../../internal/git/plan_flush.go)); - resync uses the same content-derived upsert path plus mark-and-sweep for - managed orphans ([internal/git/resync_flush.go](../../../../internal/git/resync_flush.go)); + managed orphans ([internal/git/resync_flush.go](../../internal/git/resync_flush.go)); - existing resources are found by manifest identity, so moved files are updated in place; - new resources still fall back to `ResourceIdentifier.ToGitPath()`; sensitive resources are currently routed through the encrypted writer and commonly use the built-in `.sops.yaml` naming convention - ([internal/types/identifier.go](../../../../internal/types/identifier.go), - [internal/git/git.go](../../../../internal/git/git.go)). + ([internal/types/identifier.go](../../internal/types/identifier.go), + [internal/git/git.go](../../internal/git/git.go)). So placement policy should replace only the final "resource has no document in Git, pick a path" step. It should not change content identity, acceptance, @@ -571,7 +571,7 @@ canonical placement ("existing manifests are still match-first", above). Option extends "follow the existing location" from *the same resource* to *its siblings*: a resource the operator has never written before is placed next to the resources it most resembles. It is the literal implementation of -[file-agnostic-placement.md](../file-agnostic-placement.md)'s goal — "point at a +[file-agnostic-placement.md](gittarget-new-file-placement-rules.md)'s goal — "point at a real folder and it just works", "the location doesn't matter" — because the layout already in Git, having passed acceptance, is by definition a layout the operator will accept. @@ -624,7 +624,7 @@ correctly — there is no split to configure. ### Namespace style comes along for free Because C mirrors a sibling, it also mirrors that sibling's `NamespaceSource` -(from [contextual-namespace-and-kustomize-folder-editing.md](../contextual-namespace-and-kustomize-folder-editing.md)). +(from [contextual-namespace-and-kustomize-folder-editing.md](contextual-namespace-and-kustomize-folder-editing.md)). Drop a new file beside namespace-less documents that sit under a supported kustomize context and it inherits that style — no `metadata.namespace` is written; beside explicit-namespace documents the namespace is written. This is the one @@ -694,7 +694,7 @@ are for, and the three compose cleanly: - if a per-repo override is ever wanted *without* CRD surface, the repo-native form — consistent with the just-landed `.gittargetignore` (an in-repo, versioned, zero-API policy file, see - [gitpath-foreign-content-stringency.md](../../gitpath-foreign-content-stringency.md)) + [gitpath-foreign-content-stringency.md](gitpath-foreign-content-stringency.md)) — is the natural shape. Noted, not required: C's whole point is that the base case needs nothing. @@ -776,7 +776,7 @@ more visible. Acceptable, but call it out. **P7 — An inferred path is still subject to the write-time ignore invariant.** A resolved path — inferred or canonical — can collide with a `.gittargetignore` pattern and trip the §4.3 `IgnoreShadowsManagedPath` precondition -([gitpath-foreign-content-stringency.md](../../gitpath-foreign-content-stringency.md)), +([gitpath-foreign-content-stringency.md](gitpath-foreign-content-stringency.md)), aborting the flush. Ignored and foreign files are never in the store, so they can never *be* siblings (good) — but a new canonical-fallback path can still be shadowed. C inherits this failure mode rather than creating it; the existing diff --git a/docs/finished/gvk-gvr-mapping-layer.md b/docs/spec/gvk-gvr-mapping-layer.md similarity index 97% rename from docs/finished/gvk-gvr-mapping-layer.md rename to docs/spec/gvk-gvr-mapping-layer.md index 71a1adcf..afd0d222 100644 --- a/docs/finished/gvk-gvr-mapping-layer.md +++ b/docs/spec/gvk-gvr-mapping-layer.md @@ -3,10 +3,10 @@ > Status: design, captured 2026-06-04 > Related: > [current-manifest-support-review.md](current-manifest-support-review.md), -> [reconcile-via-watchlist-mark-and-sweep.md](../design/manifest/reconcile-via-watchlist-mark-and-sweep.md), -> [../kubernetes-api-resource-catalog.md](../design/kubernetes-api-resource-catalog.md), +> [reconcile-via-watchlist-mark-and-sweep.md](reconcile-via-watchlist-mark-and-sweep.md), +> [../kubernetes-api-resource-catalog.md](../facts/kubernetes-api-resource-catalog.md), > [`internal/watch/api_resource_catalog.go`](../../internal/watch/api_resource_catalog.go), -> [`internal/watch/rule_gvr_resolver.go`](../../../internal/watch/rule_gvr_resolver.go), +> `internal/watch/rule_gvr_resolver.go`, > [`internal/manifestanalyzer/analyzer.go`](../../internal/manifestanalyzer/analyzer.go) ## Summary @@ -162,10 +162,10 @@ degraded. ## Interface > **Status (2026-06-04): implemented.** The interface and the runtime-independent -> implementations live in [`internal/mapping`](../../../internal/mapping) +> implementations live in `internal/mapping` > (`ResourceMapper`, `StructureOnlyMapper`, `StaticSnapshotMapper`, and the shared > `ResolveGVK` reduction); the catalog-backed implementation is -> [`watch.CatalogMapper`](../../../internal/watch/catalog_mapper.go), built on the +> `watch.CatalogMapper`, built on the > catalog `byGVK`/`LookupGVK` additions > ([`api_resource_catalog.go`](../../internal/watch/api_resource_catalog.go)). > The doc warned the concrete Go names could move, and two did: to satisfy the diff --git a/docs/spec/manifest-system.md b/docs/spec/manifest-system.md new file mode 100644 index 00000000..64f95465 --- /dev/null +++ b/docs/spec/manifest-system.md @@ -0,0 +1,157 @@ +# The manifest system: how it works today + +> Status: reference — describes shipped behaviour. +> Captured: 2026-07-11. +> Replaces the whole of `docs/design/manifest/`, which was 19 documents of +> working notes for a subsystem that has since shipped. The reasoning is in +> `git log`; this is the outcome. + +This is the one document to read to understand how GitOps Reverser turns a live +Kubernetes object into a line in a Git file. It states *what is true now*. The +detailed contracts it summarises each have their own spec in this folder, linked +inline. + +## The shape of it + +```text +kube-apiserver + │ watch (sendInitialEvents + bookmarks) + ▼ +internal/watch ── which types can we follow at all? → type-followability.md + │ + ▼ +internal/manifestanalyzer ── the manifest store: parse the folder, index by identity + │ decide accept / refuse → current-manifest-support-review.md + ▼ + plan ── what would change in Git? (report-only surface: + │ internal/manifestreport) + ▼ +internal/git/manifestedit ── edit the YAML in place, preserving comments + │ + ▼ +internal/git ── flush: write, commit, push with lease +``` + +Four packages, one direction: **live → Git**. Nothing in this pipeline renders +Kustomize or Helm, and nothing decrypts. + +## The load-bearing rules + +These are the invariants. Break one and the product is unsafe rather than merely +limited. + +**Identity is the key, not the file path.** A KRM document carries its own full +identity (group, kind, namespace, name). The store indexes by that identity and +writes an edit back to wherever the document already lives — *match-first +placement*. Being strict about which file a resource "should" live in was +explicitly rejected. Only a genuinely new resource needs a placement decision, and +that is [`gittarget-new-file-placement-rules.md`](gittarget-new-file-placement-rules.md). + +**A GitTarget makes an all-or-nothing claim on its folder.** It either manages +everything in the subtree or it refuses the folder. There is no partial ownership, +because a partially-managed folder cannot be reasoned about — see +[`current-manifest-support-review.md`](current-manifest-support-review.md). + +**Never partially materialize a multi-document file.** If one document in a file +is out of scope, unparseable, or non-KRM, the file is not half-written. The refusal +is the whole file. + +**Refuse the folder rather than prune unwatched KRM.** Encountering API-backed KRM +in the folder that no WatchRule covers means the folder is refused +(`GitPathAccepted=False`), *not* that the document is deleted as drift. Deleting a +user's manifest because we were not told to watch its type is the worst thing this +system could do. + +**At most one editable document per resource identity.** Two documents claiming the +same identity is not a prune opportunity, it is an invalid repository state: it +blocks startup and takes a live target down (`RepositoryValid=False`). The older +"first-occurrence-wins, delete the losers" idea was explicitly abandoned. + +**The API wins — full-object ownership, never field-subset ownership.** When the +live object and the Git document disagree, the live object is the truth for the +whole object. There is no per-field ownership model, and the list of things +deliberately *not* built to support one is in +[`manifestedit-field-ownership-spike.md`](manifestedit-field-ownership-spike.md). + +**Comments and scalar styles survive an edit.** The writer edits the YAML node tree +in place rather than re-serialising it. This is not cosmetic: a +`# {"$imagepolicy": ...}` setter comment is load-bearing to Flux, and a SOPS `mac` +binds the exact bytes. + +**One encrypted file is one document.** SOPS encrypts a *file* as a single +cryptographic unit, so an encrypted file holds exactly one document and may never +mix ciphertext with plaintext — [`sops-single-file-no-multidoc.md`](sops-single-file-no-multidoc.md). + +**No bookmark, no sweep.** Initial reconcile is a streaming list-watch with +mark-and-sweep. The sweep is a set-difference taken at the joined +`initial-events-end` bookmark, and a partial mark must never drive a sweep — a +missing bookmark fails closed. See +[`reconcile-via-watchlist-mark-and-sweep.md`](reconcile-via-watchlist-mark-and-sweep.md). + +**One grouped commit = exactly one (author, GitTarget) tuple** — +[`commit-window-refactor.md`](commit-window-refactor.md). + +**Subresources are not a manifest surface.** They are ignored by default. `/scale` +is the single exception, because Kubernetes standardises it as a view that writes +the parent's desired replica state — and even then only when the parent's replica +path is known. It lands as a bounded field patch on the committed parent, never as +a document of its own. See +[`scale-subresource-audit-rehydration.md`](scale-subresource-audit-rehydration.md). + +**A rule change on target A must never re-snapshot target B** — +[`gittarget-isolation-on-rule-change.md`](gittarget-isolation-on-rule-change.md). + +## Kustomize + +The store follows the `resources` graph rather than the filesystem, so a document's +effective namespace can be inherited from a `kustomization.yaml` that does not sit +beside it. Raw identity (what the bytes say) and effective identity (what kustomize +would produce) are tracked separately, and an inherited namespace is kept *out* of +the file bytes on write. The supported subset, and why everything outside it is +refused rather than unimplemented, is +[`contextual-namespace-and-kustomize-folder-editing.md`](contextual-namespace-and-kustomize-folder-editing.md). + +The governing constraint is invertibility: an edit must round-trip in both +directions. Generators, `patches*`, `namePrefix`/`nameSuffix`, `components`, remote +bases and Helm inflation are refused because they are one-way, not because nobody +got to them. The current boundary and the product model built on it live in +[`../design/gitops-api/`](../design/gitops-api/). + +## Types + +Not every type can be followed. `internal/typeset` answers one question — *is this +type followable, and if not, what is the single reason?* — with a funnel-ordered +check list and a kebab-case reason vocabulary. GVK↔GVR must be a bijection in both +directions; an ambiguous mapping is a hard, observable refusal. A type that +disappears from discovery gets a 60-second removal grace before its informer is +dropped, and flapping types are coalesced by a settle window +([`type-lifecycle-events-and-wobble-settling.md`](type-lifecycle-events-and-wobble-settling.md)). + +Full model: [`type-followability.md`](type-followability.md). The GVK/GVR contract +underneath it: [`gvk-gvr-mapping-layer.md`](gvk-gvr-mapping-layer.md). + +## Known gap: external Git drift + +The cluster is the source of truth, and the pipeline is driven by cluster events. +So when something changes Git *out of band* — an external push, a human deleting +files on the branch — **nothing re-runs the path's reconcile to bring Git back in +line.** The drift is detected but not acted on. + +The recommended fix, not yet built, is a per-GitTarget **subtree OID** compare that +arms exactly one replay-mark session when the subtree moves underneath us. This is +the one substantive open item inherited from the old `manifest/` folder and is +worth keeping in view. + +A related membership rule *is* enforced: objects with a `deletionTimestamp` +(Terminating) must never be re-materialized. + +## What happened to the old folder + +`docs/design/manifest/` held 19 documents written while this subsystem was being +designed. All three of its subsystems — `internal/typeset`, +`internal/git/manifestedit`, `internal/manifestreport` — have shipped. Fourteen of +those documents were working notes, superseded proposals, or closed investigations +and have been deleted; four were live specs and now sit beside this file in +`docs/spec/`. + +Nothing is lost: `git log --follow` has all of it. diff --git a/docs/finished/manifestedit-field-ownership-spike.md b/docs/spec/manifestedit-field-ownership-spike.md similarity index 95% rename from docs/finished/manifestedit-field-ownership-spike.md rename to docs/spec/manifestedit-field-ownership-spike.md index 07b26eff..1a0c17ce 100644 --- a/docs/finished/manifestedit-field-ownership-spike.md +++ b/docs/spec/manifestedit-field-ownership-spike.md @@ -1,8 +1,8 @@ # Field ownership: the API wins > Status: decided -> Related: [manifestedit-abstraction-plan.md](../design/manifest/manifestedit-abstraction-plan.md) -> (step 5), [manifest-inventory-file-agnostic-placement.md](../design/manifest/manifest-inventory-file-agnostic-placement.md), +> Related: [manifestedit-abstraction-plan.md](manifest-system.md) +> (step 5), [manifest-inventory-file-agnostic-placement.md](manifest-system.md), > [bi-directional.md](../bi-directional.md), > POC decision record: `internal/git/manifestedit/DECISION.md` diff --git a/docs/design/mutation-capture-lab-design.md b/docs/spec/mutation-capture-lab-design.md similarity index 99% rename from docs/design/mutation-capture-lab-design.md rename to docs/spec/mutation-capture-lab-design.md index a80a95cf..0cb93ee6 100644 --- a/docs/design/mutation-capture-lab-design.md +++ b/docs/spec/mutation-capture-lab-design.md @@ -501,7 +501,7 @@ lab-only behavior to the Helm chart. ## Related - [Issue #168: Watch mode](https://github.com/ConfigButler/gitops-reverser/issues/168) -- [Audit Ingestion Decision Record](audit-ingestion-decision-record.md) -- [Watch & Catalog Architecture](watch-and-catalog-architecture.md) +- [Audit Ingestion Decision Record](../architecture.md) +- [Watch & Catalog Architecture](../design/watch-and-catalog-architecture.md) - [Architecture](../architecture.md) - `test/mutationlab/README.md` — the scenario index (Row → test → corpus dir → sources) diff --git a/docs/design/manifest/reconcile-via-watchlist-mark-and-sweep.md b/docs/spec/reconcile-via-watchlist-mark-and-sweep.md similarity index 92% rename from docs/design/manifest/reconcile-via-watchlist-mark-and-sweep.md rename to docs/spec/reconcile-via-watchlist-mark-and-sweep.md index f9ef8a74..08747406 100644 --- a/docs/design/manifest/reconcile-via-watchlist-mark-and-sweep.md +++ b/docs/spec/reconcile-via-watchlist-mark-and-sweep.md @@ -2,10 +2,10 @@ > Status: design direction, captured 2026-06-04. > Related: -> [current-manifest-support-review.md](../../finished/current-manifest-support-review.md), -> [gvk-gvr-mapping-layer.md](../../finished/gvk-gvr-mapping-layer.md), -> [current-manifest-support-review-feedback.md](../../finished/current-manifest-support-review-feedback.md), -> [`internal/git/manifestedit/DECISION.md`](../../../internal/git/manifestedit/DECISION.md) +> [current-manifest-support-review.md](current-manifest-support-review.md), +> [gvk-gvr-mapping-layer.md](gvk-gvr-mapping-layer.md), +> [current-manifest-support-review-feedback.md](current-manifest-support-review.md), +> [`internal/git/manifestedit/DECISION.md`](../../internal/git/manifestedit/DECISION.md) ## Summary @@ -199,35 +199,35 @@ Names are grounded against today's code. ### Thrown away outright - **The path-derived git identity.** `parseIdentifierFromPath` - ([internal/git/helpers.go](../../../internal/git/helpers.go)) and + (internal/git/helpers.go) and `listResourceIdentifiersInPath` - ([internal/git/branch_worker.go](../../../internal/git/branch_worker.go)). Git + ([internal/git/branch_worker.go](../../internal/git/branch_worker.go)). Git identity now comes from document **content** in the store (`ByResourceIdentity` / `ByManifestIdentity`), never from the file path. - **The GVR set-difference diff.** `FolderReconciler.findDifferences` and the `clusterResources` / `gitResources` / `objectForResource` / `lastSnapshotStats` machinery - ([internal/reconcile/folder_reconciler.go](../../../internal/reconcile/folder_reconciler.go)). + (internal/reconcile/folder_reconciler.go). Replaced by mark-and-sweep set-difference over the managed model. - **The two-snapshot request/response handshake.** The `RequestClusterState` and `RequestRepoState` control events, the `ClusterStateEvent` / `RepoStateEvent` pair, and the `ReconcileResource` per-resource reminder - ([internal/events/events.go](../../../internal/events/events.go)), together with + (internal/events/events.go), together with `OnClusterState` / `OnRepoState` / `ResetState` / `HasBothStates` / `StartReconciliation` - ([internal/reconcile/folder_reconciler.go](../../../internal/reconcile/folder_reconciler.go)). + (internal/reconcile/folder_reconciler.go). Cluster state now arrives as the streaming-watch initial events; repo state is the in-memory store. There is no "reconcile when both have ever arrived" gate — there is one snapshot pinned to one bookmark RV. - **The per-event locator and per-batch inventory cache.** `manifestLocator`, `manifestTarget`, `newManifestLocator`, `inventoryFor`, `locate`, and the canonical-path stat fast path inside `locate` - ([internal/git/git.go](../../../internal/git/git.go)). The store *is* the + ([internal/git/git.go](../../internal/git/git.go)). The store *is* the inventory, built once and maintained; placement is a property the store answers, not a per-event lookup. - **The event-by-event write control flow.** `applyEventToWorktree` and the `handleCreateOrUpdateOperation` / `handleDeleteOperation` dispatch - ([internal/git/git.go](../../../internal/git/git.go)). Replaced by apply-plan + + ([internal/git/git.go](../../internal/git/git.go)). Replaced by apply-plan + flush-once. ### Absorbed, not deleted (logic survives, shape changes) @@ -236,11 +236,11 @@ Do **not** delete these — their decision logic moves into Plan computation / A - `reconcileAgainstExisting`, `preserveExistingFormatting`, `manifestsAreSemanticallyEqual`, `canonicalizeManifestForComparison` - ([internal/git/git.go](../../../internal/git/git.go)) — the no-op detection, + ([internal/git/git.go](../../internal/git/git.go)) — the no-op detection, in-place-vs-whole-replace choice, and multi-doc safety guard become **plan decisions** (patch / replace / skip) computed once, not re-derived per event. - `manifestreport.BuildReport` - ([internal/manifestreport/report.go](../../../internal/manifestreport/report.go)) + ([internal/manifestreport/report.go](../../internal/manifestreport/report.go)) — graduates into the Plan computation; it is already the create/update/delete/ skip comparison, just read-only today. - `manifestedit.Apply` / `manifestedit.DeleteDocument` — kept verbatim as the @@ -249,7 +249,7 @@ Do **not** delete these — their decision logic moves into Plan computation / A ### Stays (do not confuse with the throwaway path) - `ResourceIdentifier.ToGitPath` - ([internal/types/identifier.go](../../../internal/types/identifier.go)) — still + ([internal/types/identifier.go](../../internal/types/identifier.go)) — still the **new-file placement** policy (identity → path). Only the *reverse* (`parseIdentifierFromPath`, path → identity) is thrown away. diff --git a/docs/finished/scale-subresource-audit-rehydration.md b/docs/spec/scale-subresource-audit-rehydration.md similarity index 96% rename from docs/finished/scale-subresource-audit-rehydration.md rename to docs/spec/scale-subresource-audit-rehydration.md index ed336bef..2562f8ec 100644 --- a/docs/finished/scale-subresource-audit-rehydration.md +++ b/docs/spec/scale-subresource-audit-rehydration.md @@ -7,7 +7,7 @@ > updated today. > > Scope update: see -> [subresource-scope-reduction.md](../design/manifest/version2/subresource-scope-reduction.md). Future work +> [subresource-scope-reduction.md](scale-subresource-audit-rehydration.md). Future work > should narrow this from generic subresource translation to built-in and CRD > `/scale` only. @@ -191,7 +191,7 @@ Hard-denied before Redis: > Superseded: the broad hard-deny taxonomy above and the sanitized parent gate > below were the generic-subresource design. The shipped behavior is scale-only — -> see [subresource-scope-reduction.md](../design/manifest/version2/subresource-scope-reduction.md). Only +> see [subresource-scope-reduction.md](scale-subresource-audit-rehydration.md). Only > `/scale` reaches the consumer now; everything else is dropped at webhook ingress. ## Metrics @@ -234,7 +234,7 @@ There should be no `rehydrated_*` or `fallback_*` outcomes. paths into the same API resource scale fact that CRD scale will use. The gate, its tests, and `dropped_subresource_field_not_in_parent` were removed; the scale-specific outcomes are in the Metrics section above. See - [subresource-scope-reduction.md](../design/manifest/version2/subresource-scope-reduction.md). + [subresource-scope-reduction.md](scale-subresource-audit-rehydration.md). - [ ] Add the writer outcome counters `subresource_patch_no_parent` / `subresource_patch_unsafe` (today logged with those exact `reason` strings, not yet counters). @@ -249,7 +249,7 @@ There should be no `rehydrated_*` or `fallback_*` outcomes. ## Current State The scope reduction has landed (see -[subresource-scope-reduction.md](../design/manifest/version2/subresource-scope-reduction.md)). The shipped +[subresource-scope-reduction.md](scale-subresource-audit-rehydration.md)). The shipped behavior is scale-only, and the generic translator plus the sanitized parent gate are gone: diff --git a/docs/finished/sops-single-file-no-multidoc.md b/docs/spec/sops-single-file-no-multidoc.md similarity index 94% rename from docs/finished/sops-single-file-no-multidoc.md rename to docs/spec/sops-single-file-no-multidoc.md index 4a539df6..08928013 100644 --- a/docs/finished/sops-single-file-no-multidoc.md +++ b/docs/spec/sops-single-file-no-multidoc.md @@ -3,10 +3,10 @@ > Status: decided > Captured: 2026-06-08 > Related: -> [file-agnostic-placement.md](../design/manifest/file-agnostic-placement.md), -> [contextual-namespace-and-kustomize-folder-editing.md](../design/manifest/contextual-namespace-and-kustomize-folder-editing.md), -> [../sops-repo-bootstrap-and-key-management-architecture.md](../design/sops-repo-bootstrap-and-key-management-architecture.md), -> [../sops-repo-bootstrap-out-of-scope.md](../design/sops-repo-bootstrap-out-of-scope.md) +> [file-agnostic-placement.md](gittarget-new-file-placement-rules.md), +> [contextual-namespace-and-kustomize-folder-editing.md](contextual-namespace-and-kustomize-folder-editing.md), +> [../sops-repo-bootstrap-and-key-management-architecture.md](../finished/sops-repo-bootstrap-and-key-management-architecture.md), +> [../sops-repo-bootstrap-out-of-scope.md](../finished/sops-repo-bootstrap-out-of-scope.md) ## Decision @@ -15,7 +15,7 @@ SOPS file**. We do **not** write SOPS-encrypted multi-document YAML (no `\n---\n`-separated documents inside an encrypted file). Plaintext manifests may still be multi-document where that is convenient (see -[file-agnostic-placement.md](../design/manifest/file-agnostic-placement.md)); this decision is +[file-agnostic-placement.md](gittarget-new-file-placement-rules.md)); this decision is scoped to files we encrypt with SOPS. ## Why this came up diff --git a/docs/design/status-conditions-guide.md b/docs/spec/status-conditions-guide.md similarity index 100% rename from docs/design/status-conditions-guide.md rename to docs/spec/status-conditions-guide.md diff --git a/docs/design/manifest/version2/type-followability.md b/docs/spec/type-followability.md similarity index 96% rename from docs/design/manifest/version2/type-followability.md rename to docs/spec/type-followability.md index 7bbf9175..5e9c887e 100644 --- a/docs/design/manifest/version2/type-followability.md +++ b/docs/spec/type-followability.md @@ -3,7 +3,7 @@ > Status: greenfield proposal, captured 2026-06-08 > > Supersedes the layered model in -> [api-catalog-watched-type-architecture.md](api-catalog-watched-type-architecture.md). +> [api-catalog-watched-type-architecture.md](type-followability.md). > That doc grounds in today's packages and ends up with seven layers and two > parallel reports (followability requirements + a health report). This one starts > from the question we actually want answered and works backward. @@ -302,7 +302,7 @@ type ScaleBinding struct { `SpecReplicasPath` comes from `CustomResourceDefinition` `spec.versions[*].subresources.scale` for CRDs and from a small built-in registry for built-ins, so both look identical to the writer. The CRD JSONPath rules live in -[../../../facts/subresources.md](../../../facts/subresources.md) and are not repeated +[../../../facts/subresources.md](../facts/subresources.md) and are not repeated here. The scale write path depends only on `SpecReplicasPath`; selector facts are for reporting. The `scale` requirement is `skip` when scale is unused and only `fail`s (`scale-path-unresolved`) when a needed parent path is missing. @@ -356,9 +356,9 @@ Greenfield names, but they land on existing packages: ## References -- [api-catalog-watched-type-architecture.md](api-catalog-watched-type-architecture.md) -- [catalog-mapper-vs-watched-type-table.md](catalog-mapper-vs-watched-type-table.md) -- [subresource-scope-reduction.md](subresource-scope-reduction.md) -- [gvk-gvr-mapping-layer.md](../../../finished/gvk-gvr-mapping-layer.md) -- [resource-types.md](../../../facts/resource-types.md) -- [subresources.md](../../../facts/subresources.md) +- [api-catalog-watched-type-architecture.md](type-followability.md) +- [catalog-mapper-vs-watched-type-table.md](type-followability.md) +- [subresource-scope-reduction.md](scale-subresource-audit-rehydration.md) +- [gvk-gvr-mapping-layer.md](gvk-gvr-mapping-layer.md) +- [resource-types.md](../facts/resource-types.md) +- [subresources.md](../facts/subresources.md) diff --git a/docs/finished/type-lifecycle-events-and-wobble-settling.md b/docs/spec/type-lifecycle-events-and-wobble-settling.md similarity index 93% rename from docs/finished/type-lifecycle-events-and-wobble-settling.md rename to docs/spec/type-lifecycle-events-and-wobble-settling.md index 6ac39170..f619e762 100644 --- a/docs/finished/type-lifecycle-events-and-wobble-settling.md +++ b/docs/spec/type-lifecycle-events-and-wobble-settling.md @@ -5,18 +5,18 @@ > (`LifecycleEvent`/`Observer`/`Subscribe`, `SettleWindow`, settle + flap coalescing in > `Registry.Update`); M12 per-type reconcile/sweep via > `manifestanalyzer.BuildScopedPlan`, the `ScopeGVR` resync request, the registry -> subscription + drain goroutine in [internal/watch/type_lifecycle.go](../../internal/watch/type_lifecycle.go), +> subscription + drain goroutine in internal/watch/type_lifecycle.go, > and `EventRouter.EmitTypeReconcile/SweepForGitDest`. Proposal 3's consolidation is the > shared `Manager.typeWobbling` predicate. The per-type path is gated on `SnapshotSynced`, > so bootstrap is unchanged; `Unknown` granularity and bootstrap-decoupling remain open. -> Origin: the per-type reconcile track ([dream.md](../design/manifest/version2/dream.md), +> Origin: the per-type reconcile track ([dream.md](type-followability.md), > `per-type-reconcile-and-streaming-tail.md`) -> and the [e2e flakiness findings](../design/manifest/e2e-full-suite-flakiness-findings-2026-06.md). +> and the [e2e flakiness findings](e2e-serial-registry.md). > Related: -> [discovery-catalog-typeset-boundary.md](../design/manifest/version2/discovery-catalog-typeset-boundary.md), -> [type-followability.md](../design/manifest/version2/type-followability.md), -> [catalog-mapper-vs-watched-type-table.md](../design/manifest/version2/catalog-mapper-vs-watched-type-table.md), -> [api-catalog-watched-type-architecture.md](../design/manifest/version2/api-catalog-watched-type-architecture.md). +> [discovery-catalog-typeset-boundary.md](type-followability.md), +> [type-followability.md](type-followability.md), +> [catalog-mapper-vs-watched-type-table.md](type-followability.md), +> [api-catalog-watched-type-architecture.md](type-followability.md). ## Why now @@ -45,7 +45,7 @@ simplification this document is also chasing. ## What we already have (the foundation — keep it) The typeset registry (`internal/typeset/registry.go`, -[type-followability.md](../design/manifest/version2/type-followability.md)) is the single owner of type +[type-followability.md](type-followability.md)) is the single owner of type identity and the live set. Per known type it computes one `TypeRecord` with a `Verdict`: @@ -153,7 +153,7 @@ changed?" is currently answered in three layers that each re-derive a slice of i pending-removal. Layer 1 and 2 are the right boundary and stay (see -[discovery-catalog-typeset-boundary.md](../design/manifest/version2/discovery-catalog-typeset-boundary.md)). +[discovery-catalog-typeset-boundary.md](type-followability.md)). **Layer 3's re-classification is the duplication to remove**: once the registry emits transitions, the watched-type store stops diffing and re-classifying — it *subscribes* to its types' transitions and updates membership directly. Concretely, diff --git a/docs/design/typeset-owns-discovery-grace.md b/docs/spec/typeset-owns-discovery-grace.md similarity index 97% rename from docs/design/typeset-owns-discovery-grace.md rename to docs/spec/typeset-owns-discovery-grace.md index 47fcc4ba..76f2d6d2 100644 --- a/docs/design/typeset-owns-discovery-grace.md +++ b/docs/spec/typeset-owns-discovery-grace.md @@ -21,7 +21,7 @@ ## 1. Steering Two wobble-hardening directions were on the table in -[startup-robustness-cert-and-crd-wobble.md](./startup-robustness-cert-and-crd-wobble.md) §5: +[startup-robustness-cert-and-crd-wobble.md](../finished/startup-robustness-cert-and-crd-wobble.md) §5: B1 ("confirm removals over a window **in the catalog**") and B2 ("don't force-release a recently-served checkpoint **in the materializer**"). A B1 prototype (a `catalogRemovalConfirmWindow` with per-group/version `missingSince` timestamps inside @@ -45,7 +45,7 @@ The pipeline is `discovery scan → APIResourceCatalog → Observations → type The boundary is already fairly clean — outside [api_resource_catalog.go](../../internal/watch/api_resource_catalog.go), [manager_catalog.go](../../internal/watch/manager_catalog.go) and -[catalog_observe.go](../../internal/watch/catalog_observe.go), no component reads the +catalog_observe.go, no component reads the catalog directly; everything consumes the registry (or a projection of it, like the watched-type table). But the catalog is **not** a thin wrapper: it holds cross-scan state and makes retention decisions of its own: @@ -270,8 +270,8 @@ catalog→registry *feed* and the catalog's own innards. ## 6. Relationship to existing docs - Supersedes the **B1-in-the-catalog** candidate of - [startup-robustness-cert-and-crd-wobble.md](./startup-robustness-cert-and-crd-wobble.md) + [startup-robustness-cert-and-crd-wobble.md](../finished/startup-robustness-cert-and-crd-wobble.md) (the mechanism survives, relocated into the registry as S2). B2 remains open as S4. -- Complements [type-followability](./manifest/version2/type-followability.md): the +- Complements [type-followability](type-followability.md): the registry stays "the single type Lookup + decision surface"; this proposal completes that claim by making it the single *grace* surface too. diff --git a/docs/design/unsupported-folder-refusal-plan.md b/docs/spec/unsupported-folder-refusal-plan.md similarity index 99% rename from docs/design/unsupported-folder-refusal-plan.md rename to docs/spec/unsupported-folder-refusal-plan.md index d748bb44..18b47d54 100644 --- a/docs/design/unsupported-folder-refusal-plan.md +++ b/docs/spec/unsupported-folder-refusal-plan.md @@ -9,11 +9,11 @@ > the goal is a status contract legible to Flux / Argo CD / `helm --wait`, not just to humans reading YAML. > > **Decision recorded** in -> [e2e-coverage-gaps-and-improvements-plan.md §4.1](e2e-coverage-gaps-and-improvements-plan.md): the +> [e2e-coverage-gaps-and-improvements-plan.md §4.1](../design/e2e-coverage-gaps-and-improvements-plan.md): the > operator must **refuse** a GitTarget path it cannot safely manage, for the cases where we already > know the content is a problem — not silently keep writing. Written against the **actual** current code, > not the superseded `Synced`/`materialization` model in -> [status-design-git-target.md](status-design-git-target.md). +> [status-design-git-target.md](status-conditions-guide.md). --- diff --git a/internal/audit/outcome/outcome.go b/internal/audit/outcome/outcome.go index f6b39932..5ea296e2 100644 --- a/internal/audit/outcome/outcome.go +++ b/internal/audit/outcome/outcome.go @@ -8,7 +8,7 @@ // outcomes, the per-type queue for queue outcomes). The Git-materialization fate // (read-time tail/splice skips) is deliberately NOT an Outcome — those are // repeatable per (GitTarget, GVR) and would multi-count the same stored entry. -// See docs/design/stream/audit-diagnostic-streams-plan.md. +// See docs/architecture.md. package outcome import ( diff --git a/internal/controller/commitrequest_controller.go b/internal/controller/commitrequest_controller.go index fdd85748..522d61fd 100644 --- a/internal/controller/commitrequest_controller.go +++ b/internal/controller/commitrequest_controller.go @@ -22,7 +22,7 @@ import ( ) // CommitRequestFinalizer is the EventRouter seam the reconciler drives, using the -// attach-then-poll protocol (docs/design/stream/commitrequest-design.md §6.4.3): +// attach-then-poll protocol (docs/spec/commitrequest-design.md §6.4.3): // ServiceCommitRequest registers the attach idempotently on the GitTarget's branch // worker (bind the message to the author's open window, finalize after the grace) // and returns the request's current outcome — resolved=false means keep polling. @@ -39,7 +39,7 @@ type CommitRequestFinalizer interface { // CommandAuthorLookup resolves the author of a CommitRequest from the submitter // captured at admission by the validate-operator-types webhook, keyed by the persisted // object's UID. *queue.CommandAuthorStore satisfies it without adaptation. The lookup -// is present-or-never (docs/design/commitrequest-admission-authorship.md §2): a miss is +// is present-or-never (docs/spec/commitrequest-admission-authorship.md §2): a miss is // immediate and final — the webhook is not configured (or a best-effort write missed) — // and the controller finalizes as the committer with no wait. type CommandAuthorLookup interface { @@ -71,8 +71,8 @@ const ( ) // CommitRequestReconciler drives a CommitRequest through its state machine -// (docs/design/stream/commitrequest-design.md §6.4 and -// docs/design/commitrequest-admission-authorship.md §5): +// (docs/spec/commitrequest-design.md §6.4 and +// docs/spec/commitrequest-admission-authorship.md §5): // // 1. ATTRIBUTE — a single synchronous read of the submitter captured at admission // (present-or-never, §2). A hit names that submitter as the author @@ -341,7 +341,7 @@ func (r *CommitRequestReconciler) writeTerminalStatus( // multi-CommitRequest ordering design — concurrent CommitRequests for the same // GitTarget are serialized exactly as a dedicated finalize-coordinator // goroutine would serialize them, without the extra moving parts (see -// docs/design/stream/commitrequest-multi-finalize-design.md). +// docs/spec/commitrequest-multi-finalize-design.md). // // Restart recovery is best-effort by design (commitrequest-design.md §6.6): the // message is durable in spec.message, so on restart any non-terminal request is diff --git a/internal/controller/constants.go b/internal/controller/constants.go index e5628492..0f172b02 100644 --- a/internal/controller/constants.go +++ b/internal/controller/constants.go @@ -46,7 +46,7 @@ const ( // validate-operator-types webhook recorded the submitter, False (CommitterFallback) when // no admission record exists — the webhook is not configured — and the commit is // authored by the configured committer. False is not a failure and does not affect - // Ready (docs/design/commitrequest-admission-authorship.md §5). + // Ready (docs/spec/commitrequest-admission-authorship.md §5). ConditionTypeAuthorAttributed = "AuthorAttributed" // ConditionTypePushed indicates whether a CommitRequest's commit reached the // remote repository. @@ -57,7 +57,7 @@ const ( MsgSnapshotCompleted = "Initial snapshot reconciliation completed" // RequeueSteadyInterval is the unified control-plane periodic reconcile fallback. - // The control plane no longer watches Secrets (docs/future/secret-value-retention-plan.md), + // The control plane no longer watches Secrets (docs/rbac.md), // so out-of-band credential and age-key changes are picked up on this steady cadence // instead of via a Secret informer. It replaces the former split of a 2-minute // transient-retry, a 5-minute auth/secret, and a 10-minute revalidation interval with diff --git a/internal/controller/dependency_watches_test.go b/internal/controller/dependency_watches_test.go index 86fb9fac..740e194e 100644 --- a/internal/controller/dependency_watches_test.go +++ b/internal/controller/dependency_watches_test.go @@ -390,7 +390,7 @@ func TestDependencyMapFunctionsTolerateListErrors(t *testing.T) { // TestRequeueSteadyIntervalIsFiveMinutes locks the unified control-plane periodic reconcile // fallback at 5 minutes. After the secret-value-retention change the control plane no longer // watches Secrets, so out-of-band credential and age-key rotations are picked up on this steady -// cadence rather than by a Secret informer. See docs/future/secret-value-retention-plan.md. +// cadence rather than by a Secret informer. See docs/rbac.md. func TestRequeueSteadyIntervalIsFiveMinutes(t *testing.T) { assert.Equal(t, 5*time.Minute, RequeueSteadyInterval) } diff --git a/internal/controller/gitprovider_controller.go b/internal/controller/gitprovider_controller.go index cbd19464..c5ca618e 100644 --- a/internal/controller/gitprovider_controller.go +++ b/internal/controller/gitprovider_controller.go @@ -386,7 +386,7 @@ func (r *GitProviderReconciler) setCondition( // updateStatusAndRequeue updates the status and requeues on the unified control-plane steady // interval. The control plane no longer watches Secrets, so every status outcome falls back to -// this single cadence; see docs/future/secret-value-retention-plan.md. +// this single cadence; see docs/rbac.md. func (r *GitProviderReconciler) updateStatusAndRequeue( ctx context.Context, gitProvider *configbutleraiv1alpha3.GitProvider, diff --git a/internal/controller/gitprovider_controller_test.go b/internal/controller/gitprovider_controller_test.go index ef6584e4..2e370900 100644 --- a/internal/controller/gitprovider_controller_test.go +++ b/internal/controller/gitprovider_controller_test.go @@ -401,7 +401,7 @@ var _ = Describe("GitProvider Controller", func() { Expect(err).NotTo(HaveOccurred()) // Control-plane reconciles now share one steady fallback cadence; see - // docs/future/secret-value-retention-plan.md. + // docs/rbac.md. Expect(result.RequeueAfter).To(Equal(RequeueSteadyInterval)) // Verify the resource was updated with failure condition diff --git a/internal/controller/gittarget_controller.go b/internal/controller/gittarget_controller.go index 9e68dda5..6e452dec 100644 --- a/internal/controller/gittarget_controller.go +++ b/internal/controller/gittarget_controller.go @@ -67,7 +67,7 @@ const ( GitTargetReasonGitPathAccepted = "GitPathAccepted" GitTargetReasonUnsupportedContent = "UnsupportedContent" // GitTargetReasonIgnoreShadowsManagedPath is the terminal reason for the one - // unrecoverable .gittargetignore footgun (docs/design/gitpath-foreign-content-stringency.md + // unrecoverable .gittargetignore footgun (docs/spec/gitpath-foreign-content-stringency.md // §4.3): an ignore pattern matches a path the operator writes, which would blind it to its // own file. The writer's write-plan precondition refuses the flush before any byte is // written and the GitTarget is failed with this reason. The string must stay in sync with @@ -974,7 +974,7 @@ func (r *GitTargetReconciler) SetupWithManager(mgr ctrl.Manager) error { // full-object Secret watch made the process retain every Secret value in the // cluster. Generated-age-Secret recovery and out-of-band age-key updates are // picked up by the periodic reconcile (RequeueSteadyInterval) instead. - // See docs/future/secret-value-retention-plan.md. + // See docs/rbac.md. // GenerationChangedPredicate keeps this watch reacting to a freshly // applied or spec-changed GitProvider while ignoring the status-only // updates the controllers write themselves — without it every provider @@ -1004,7 +1004,7 @@ func (r *GitTargetReconciler) SetupWithManager(mgr ctrl.Manager) error { // React to a data-plane GitPath acceptance TRANSITION (refused/recovered) so GitPathAccepted // is re-projected within one reconcile instead of lagging up to RequeueSteadyInterval (5m). // The watch manager records acceptance asynchronously and pushes a GenericEvent here. See - // docs/design/manifest/gitpathaccepted-projection-race-and-external-drift.md. + // docs/spec/manifest-system.md. if r.EventRouter != nil && r.EventRouter.WatchManager != nil { b = b.WatchesRawSource(source.Channel( r.EventRouter.WatchManager.GitPathEvents(), diff --git a/internal/controller/gittarget_placement_validation.go b/internal/controller/gittarget_placement_validation.go index 2f0081d4..9cc0fc80 100644 --- a/internal/controller/gittarget_placement_validation.go +++ b/internal/controller/gittarget_placement_validation.go @@ -19,7 +19,7 @@ const coreSecretsTypeKey = "v1/secrets" // validatePlacementPolicy statically validates a GitTarget's declared placement // policy (F4, Option B2: -// docs/design/manifest/version2/gittarget-new-file-placement-rules.md) against the +// docs/spec/gittarget-new-file-placement-rules.md) against the // spec alone — no repository scan is needed, so this runs as part of the Validated // gate, the same spec-well-formedness check that already covers provider/branch // resolution and path-overlap conflicts. A nil spec (no declared policy) is always diff --git a/internal/controller/watchrule_controller.go b/internal/controller/watchrule_controller.go index b22730f8..ad164249 100644 --- a/internal/controller/watchrule_controller.go +++ b/internal/controller/watchrule_controller.go @@ -371,7 +371,7 @@ func conditionIsFalse(conditions []metav1.Condition, conditionType string) bool // updateStatusAndRequeue updates the status and requeues on the unified control-plane steady // interval. The control plane no longer watches Secrets, so every status outcome falls back to -// this single cadence; see docs/future/secret-value-retention-plan.md. +// this single cadence; see docs/rbac.md. func (r *WatchRuleReconciler) updateStatusAndRequeue( ctx context.Context, watchRule *configbutleraiv1alpha3.WatchRule) (ctrl.Result, error) { if err := r.updateStatusWithRetry(ctx, watchRule); err != nil { diff --git a/internal/git/branch_worker.go b/internal/git/branch_worker.go index 7604b7a2..e2a12aba 100644 --- a/internal/git/branch_worker.go +++ b/internal/git/branch_worker.go @@ -1082,7 +1082,7 @@ func (w *BranchWorker) commitPendingWrites(pendingWrites []PendingWrite, hasPend // that touches the remote (PrepareBranch fetches the tip). Later commits in the // same cycle build on the local repo and never use auth, so re-reading the // credentials Secret here would be a wasted API GET per commit now that the - // Secret cache is disabled. See docs/future/secret-value-retention-plan.md §5. + // Secret cache is disabled. See docs/rbac.md §5. auth, err := getAuthFromSecret(w.ctx, w.Client, provider, w.sshHostKeys) if err != nil { return fmt.Errorf("resolve auth: %w", err) diff --git a/internal/git/branch_worker_credread_test.go b/internal/git/branch_worker_credread_test.go index 39041332..eac0c4f2 100644 --- a/internal/git/branch_worker_credread_test.go +++ b/internal/git/branch_worker_credread_test.go @@ -26,7 +26,7 @@ import ( // re-read the Git credentials Secret for every commit in a push cycle. Only the first commit // (hasPendingCommits=false) touches the remote through PrepareBranch and needs auth; later commits // build on the local repo and must not issue another Secret GET — with the Secret cache disabled -// that would be a wasted API round-trip per commit. See docs/future/secret-value-retention-plan.md §5. +// that would be a wasted API round-trip per commit. See docs/rbac.md §5. func TestCommitPendingWrites_ResolvesCredentialsOncePerPushCycle(t *testing.T) { tempDir := t.TempDir() remotePath := filepath.Join(tempDir, "remote") diff --git a/internal/git/commit_request_attach.go b/internal/git/commit_request_attach.go index c84b9a1e..6ca847d9 100644 --- a/internal/git/commit_request_attach.go +++ b/internal/git/commit_request_attach.go @@ -44,7 +44,7 @@ type FinalizeResult struct { // AttachCommitRequest is the "bind this CommitRequest's message to the author's // open window, then finalize that window after the grace" work item (§6.4 of -// docs/design/stream/commitrequest-design.md). It rides the same per-worker FIFO +// docs/spec/commitrequest-design.md). It rides the same per-worker FIFO // event queue as resource events, so by audit-stream ordering it is processed // after every earlier write for that worker. Re-sends are idempotent: the worker // keys pending requests by identity and keeps the first finalize deadline. diff --git a/internal/git/commit_request_attach_loop.go b/internal/git/commit_request_attach_loop.go index 5b70bdc4..01dd9b81 100644 --- a/internal/git/commit_request_attach_loop.go +++ b/internal/git/commit_request_attach_loop.go @@ -7,7 +7,7 @@ import ( ) // This file holds the worker-loop side of CommitRequest eager attach (§6.4 of -// docs/design/stream/commitrequest-design.md). All methods run on the single event +// docs/spec/commitrequest-design.md). All methods run on the single event // loop goroutine, so pendingCRs needs no locking; only the resolved-outcome table // (BranchWorker.crOutcomes) crosses goroutines and is mutex-guarded. // diff --git a/internal/git/encryption.go b/internal/git/encryption.go index e90d91e5..bbb8accc 100644 --- a/internal/git/encryption.go +++ b/internal/git/encryption.go @@ -47,7 +47,7 @@ const ( // // It carries public age recipients only. The write path encrypts, it never decrypts, so no // private age identity is retained, written to disk, or passed to the sops process. See -// docs/future/secret-value-retention-plan.md. +// docs/rbac.md. type ResolvedEncryptionConfig struct { Provider string AgeRecipients []string diff --git a/internal/git/inplace_overrides_test.go b/internal/git/inplace_overrides_test.go index b6661792..ca53a696 100644 --- a/internal/git/inplace_overrides_test.go +++ b/internal/git/inplace_overrides_test.go @@ -19,7 +19,7 @@ import ( "github.com/ConfigButler/gitops-reverser/internal/typeset" ) -// The F1 edit-through scenarios (docs/design/gitops-api/f1-images-replicas-edit-through.md): +// The F1 edit-through scenarios (docs/design/gitops-api/finished/f1-images-replicas-edit-through.md): // a live change produced by a kustomization's images:/replicas: entry lands on // the entry, and the source manifest keeps its bytes. diff --git a/internal/git/manifestedit/decision.go b/internal/git/manifestedit/decision.go index cfd15915..abd52e8a 100644 --- a/internal/git/manifestedit/decision.go +++ b/internal/git/manifestedit/decision.go @@ -16,7 +16,7 @@ import ( // desired version (the clean object Git should contain). Comparison makes that // two-version comparison a first-class value; Decide is a pure preflight over it // and Apply is the authoritative edit. See -// docs/design/manifest/manifestedit-abstraction-plan.md. +// docs/spec/manifest-system.md. // Document is immutable data describing one target document inside a file: the // whole file content, the target document index, and the manifest identity. It @@ -88,7 +88,7 @@ type EditOptions struct { // owned. The product decision is API-first, whole-object truth: production // MUST leave this nil (own everything), so a field absent from the desired // projection is deleted from Git. See - // docs/design/manifest/manifestedit-field-ownership-spike.md. Do not grow configuration + // docs/spec/manifestedit-field-ownership-spike.md. Do not grow configuration // on top of this; it exists only to keep the deletion decision explicit and to // keep the merge testable. Owns func(path FieldPath) bool diff --git a/internal/git/manifestedit/decision_test.go b/internal/git/manifestedit/decision_test.go index 6b0e3153..eeea259c 100644 --- a/internal/git/manifestedit/decision_test.go +++ b/internal/git/manifestedit/decision_test.go @@ -179,7 +179,7 @@ func TestApply_PatchAndDeleteNeedNoRenderer(t *testing.T) { // The product policy is API-first, whole-object truth: production always passes // Owns == nil, so a field absent from the desired projection is deleted from Git -// (see docs/design/manifest/manifestedit-field-ownership-spike.md). This is the only +// (see docs/spec/manifestedit-field-ownership-spike.md). This is the only // supported behavior, pinned here. func TestApply_WholeObjectTruth_AbsentFieldIsDeleted(t *testing.T) { content := []byte("apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: a\ndata:\n color: blue\nextra: drop\n") diff --git a/internal/git/manifestedit/fieldpatch.go b/internal/git/manifestedit/fieldpatch.go index de95dc6c..f4e6ff91 100644 --- a/internal/git/manifestedit/fieldpatch.go +++ b/internal/git/manifestedit/fieldpatch.go @@ -10,7 +10,7 @@ import ( ) // Field patches are the editing primitive behind subresource audit resolution -// (docs/design/manifest/version2/scale-subresource-audit-rehydration.md). A +// (docs/spec/scale-subresource-audit-rehydration.md). A // mutating subresource such as deployments/scale does not carry a full parent // object, only a bounded set of changed field paths ("spec.replicas: 3"). Rather // than hydrate the parent, carry those assignments to Git and set exactly them on diff --git a/internal/git/manifestedit/kustomization.go b/internal/git/manifestedit/kustomization.go index cfcd3b8a..1d02f0c0 100644 --- a/internal/git/manifestedit/kustomization.go +++ b/internal/git/manifestedit/kustomization.go @@ -11,7 +11,7 @@ import ( // Kustomization override sections the editor accepts. The editor is the // mechanism half of the F1 images/replicas edit-through -// (docs/design/gitops-api/f1-images-replicas-edit-through.md): it updates the +// (docs/design/gitops-api/finished/f1-images-replicas-edit-through.md): it updates the // scalar value of a field that ALREADY EXISTS on an entry that ALREADY EXISTS, // and nothing else — it never adds or removes entries, keys, or files. const ( @@ -128,7 +128,7 @@ func applyKustomizationEdit(root *yaml.Node, e KustomizationEdit) error { // AppendKustomizationResource adds one entry to an existing kustomization.yaml's // resources: sequence — the mechanism half of F4's "add to the right kustomize -// file" (docs/design/manifest/version2/gittarget-new-file-placement-rules.md): a +// file" (docs/spec/gittarget-new-file-placement-rules.md): a // new sibling file placed inside a kustomize-governed directory must also be named // in that directory's resources: list, or kustomize never renders it. // diff --git a/internal/git/manifestedit/types.go b/internal/git/manifestedit/types.go index f488b5e5..34fec01e 100644 --- a/internal/git/manifestedit/types.go +++ b/internal/git/manifestedit/types.go @@ -8,7 +8,7 @@ everything it did not change. It is intentionally throw-away: the package proves whether gopkg.in/yaml.v3 node editing is good enough before any of this is wired into the real writer. See -docs/design/manifest/manifest-parser-poc.md. +internal/git/manifestedit/DECISION.md. */ package manifestedit diff --git a/internal/git/plan_flush.go b/internal/git/plan_flush.go index 23724d2d..3c480b42 100644 --- a/internal/git/plan_flush.go +++ b/internal/git/plan_flush.go @@ -25,7 +25,7 @@ import ( ) // flushEventsToWorktree is the plan-then-flush write path (M7), described in -// docs/design/manifest/current-manifest-support-review.md ("Writer Model: Plan, +// docs/spec/current-manifest-support-review.md ("Writer Model: Plan, // Apply, Dirty Flush"). It replaces the per-event locate+write loop: it builds the // byte-free structure model for the GitTarget subtree once, resolves each coalesced // event to a single-identity action over that model, applies the actions to @@ -34,7 +34,7 @@ import ( // removed. // // This is the steady-state half of the design's "Two Paths, One Plan Type" -// (docs/design/manifest/reconcile-via-watchlist-mark-and-sweep.md): every event is +// (docs/spec/reconcile-via-watchlist-mark-and-sweep.md): every event is // a single-identity intent — an upsert (create/patch/replace) for an object-bearing // event, or a delete-document for a DELETE — and the writer NEVER mark-and-sweeps a // batch. Whole-folder mark-and-sweep is the resync mechanism (M8), not steady state. @@ -85,7 +85,7 @@ type writeBatch struct { // and therefore cannot see coming — form one deterministic, resource-identity- // sorted multi-document file instead of each writeWholeFile call silently // discarding the one before it. See - // docs/design/manifest/version2/gittarget-new-file-placement-rules.md, + // docs/spec/gittarget-new-file-placement-rules.md, // "Collision and append behavior": "if several new plaintext resources in one // plan render to the same path, write a multi-document file in deterministic // resource-identity order." @@ -245,7 +245,7 @@ func (wb *writeBatch) applyUpsert(ctx context.Context, event Event) (upsertOutco // createNew resolves the placement of a resource with no existing document — // declared policy (Option B), sibling inference (Option C), or the canonical -// fallback — per docs/design/manifest/version2/gittarget-new-file-placement-rules.md, +// fallback — per docs/spec/gittarget-new-file-placement-rules.md, // adds the kustomize resources: entry the placement may require, and writes the new // document: a brand-new file, or an additional document appended to an existing // accepted plaintext bundle. A placement LocateNew cannot honour safely (today, only @@ -573,7 +573,7 @@ func (wb *writeBatch) resolveFieldPatchTarget(event Event) (string, manifestedit // When the document is governed by a kustomize images/replicas override chain, the // desired projection is first split: values the chain produces are restored to their // source form (so the file keeps its bytes) and the divergence is routed to the -// override entries instead — see docs/design/gitops-api/f1-images-replicas-edit-through.md. +// override entries instead — see docs/design/gitops-api/finished/f1-images-replicas-edit-through.md. func (wb *writeBatch) patchExisting( ctx context.Context, event Event, @@ -817,7 +817,7 @@ func currentDocIndex(filePath string, content []byte, id manifestedit.Identity) // least one file was written or removed. // // Before touching a single byte it enforces the write-plan precondition (§4.3 of -// docs/design/gitpath-foreign-content-stringency.md): no path the operator is about to +// docs/spec/gitpath-foreign-content-stringency.md): no path the operator is about to // write, edit, or delete may be shadowed by the active .gittargetignore. The check is a // precondition, not a post-hoc detector, so the unrecoverable state (an ignored file the // operator can no longer see) is never reached — the flush is refused and the GitTarget diff --git a/internal/git/resync_flush.go b/internal/git/resync_flush.go index d92f5e5b..a60366ea 100644 --- a/internal/git/resync_flush.go +++ b/internal/git/resync_flush.go @@ -129,7 +129,7 @@ func (l *branchWorkerEventLoop) applyResync(req *ResyncRequest) { // commit is now in pendingWrites and must reach the remote — or the resync itself // committed. Any finalize that closes a window must schedule its push, or the // window's commit is stranded: committed locally but never pushed (the - // stranded-write fix, docs/design/stream/commitrequest-design.md §6.4.2; the + // stranded-write fix, docs/spec/commitrequest-design.md §6.4.2; the // failure analyzed in github-e2e-per-type-tail-failure-investigation.md). // maybeSchedulePush no-ops when nothing is pending, so a pure no-op resync that // closed no window stays a no-op and does not disturb the push cooldown. @@ -301,7 +301,7 @@ func (w *BranchWorker) refuseUnsafeWorktree(ctx context.Context, worktree *gogit } // applyResyncToWorktree is the streaming mark-and-sweep resync apply (M8), described -// in docs/design/manifest/reconcile-via-watchlist-mark-and-sweep.md ("Two Paths, One +// in docs/spec/reconcile-via-watchlist-mark-and-sweep.md ("Two Paths, One // Plan Type" — the Resync path). It folds the COMPLETE desired snapshot over the // content-derived store of the GitTarget subtree: // diff --git a/internal/git/resync_push_test.go b/internal/git/resync_push_test.go index c3633f80..caaab457 100644 --- a/internal/git/resync_push_test.go +++ b/internal/git/resync_push_test.go @@ -38,7 +38,7 @@ func TestEnqueueResync_ReportsEnqueueOutcome(t *testing.T) { } // TestHandleResyncRequest_ClosedWindowIsPushedEvenWhenNoOpResync pins the -// stranded-write fix (docs/design/stream/commitrequest-design.md §6.4.2, §9.5): a +// stranded-write fix (docs/spec/commitrequest-design.md §6.4.2, §9.5): a // resync that closes a live commit window but commits nothing of its own must // still schedule the window's commit for push. Before the fix maybeSchedulePush // ran only when the resync itself committed, so a window the resync closed was diff --git a/internal/git/types.go b/internal/git/types.go index ba6c1c03..f46c4a72 100644 --- a/internal/git/types.go +++ b/internal/git/types.go @@ -195,7 +195,7 @@ type PendingWrite struct { // CommitRequest, when set, is the CommitRequest claiming this write: it is // resolved Committed (with CommitSHA) once this write is pushed (§6.5 of - // docs/design/stream/commitrequest-design.md). It rides the write through the + // docs/spec/commitrequest-design.md). It rides the write through the // push cooldown and the conflict rebase-replay, so the result follows the data. CommitRequest *commitRequestID // CommitSHA is the hash of the commit this write created, captured in @@ -319,7 +319,7 @@ type Event struct { // route). The sub-sequence is load-bearing: distinct entries can share an rv (an rv-less // DELETE/Status rides the high-water, duplicate/same-rv writes get fresh seqs), so the gate // compares full positions, not bare rvs. Empty on the live admission path; not used by the - // writer. See docs/design/stream/signing-snapshot-tail-replay-failure-investigation.md §7. + // writer. See docs/finished/signing-snapshot-tail-replay-failure-investigation.md §7. AuditStreamID string // UserInfo contains user information for commit messages. @@ -351,7 +351,7 @@ func (e Event) IsFieldPatch() bool { // carried in place of a full Object. It is how an author-preserving subresource // mutation (e.g. deployments/scale) reaches Git: set exactly the audited field // paths on the already committed parent, never reconstructing the whole object. -// See docs/design/manifest/version2/scale-subresource-audit-rehydration.md. +// See docs/spec/scale-subresource-audit-rehydration.md. type FieldPatch struct { // Assignments are the (path, value) pairs to set on the parent manifest. Paths // are disjoint; each owns only its own subtree, so the patch is additive and @@ -455,7 +455,7 @@ func (r ResourceRef) String() string { // GroupedCommitMessageData is the template context for grouped commit // messages. Each grouped commit covers exactly one (author, gitTarget) tuple -// (see docs/design/commit-window-refactor.md). +// (see docs/spec/commit-window-refactor.md). type GroupedCommitMessageData struct { // Author is the verbatim event.UserInfo.Username for the group. Author string diff --git a/internal/manifestanalyzer/acceptance.go b/internal/manifestanalyzer/acceptance.go index 25af58a6..b7e84c09 100644 --- a/internal/manifestanalyzer/acceptance.go +++ b/internal/manifestanalyzer/acceptance.go @@ -13,7 +13,7 @@ import ( // Acceptance is the M4 adoption gate: the distinct step between "build the store" // and "use it as the planning model", described in -// docs/design/manifest/current-manifest-support-review.md ("Acceptance Checks On +// docs/spec/current-manifest-support-review.md ("Acceptance Checks On // First Materialization"). A GitTarget folder is adopted only when it passes; any // blocking refusal stops it and reconciles nothing until a human cleans the folder. // @@ -93,7 +93,7 @@ const ( IssueUnsupportedKustomize IssueKind = "unsupported-kustomize" // IssueForeignFile marks a non-YAML regular file under spec.path that matches no // recognized role — the operator-exclusive subtree refuses content it cannot manage - // (docs/design/gitpath-foreign-content-stringency.md §3). Foreign YAML is already + // (docs/spec/gitpath-foreign-content-stringency.md §3). Foreign YAML is already // refused as IssueNonKRM; this is the non-YAML case the gate was previously blind to. IssueForeignFile IssueKind = "foreign-file" // IssueForeignSymlink marks any symlink under spec.path. A writer could follow it out diff --git a/internal/manifestanalyzer/analyzer.go b/internal/manifestanalyzer/analyzer.go index e7004b32..a1e41808 100644 --- a/internal/manifestanalyzer/analyzer.go +++ b/internal/manifestanalyzer/analyzer.go @@ -3,7 +3,7 @@ /* Package manifestanalyzer is a runtime-independent analyzer for a folder of Kubernetes manifests. It is the proof-of-concept core described in -docs/design/manifest/current-manifest-support-review.md: build the manifest model +docs/spec/current-manifest-support-review.md: build the manifest model once, classify every file, and report what we know about it — without any controller runtime, and without writing anything. diff --git a/internal/manifestanalyzer/contextual_namespace_corpus_test.go b/internal/manifestanalyzer/contextual_namespace_corpus_test.go index abb43919..9f761735 100644 --- a/internal/manifestanalyzer/contextual_namespace_corpus_test.go +++ b/internal/manifestanalyzer/contextual_namespace_corpus_test.go @@ -25,7 +25,7 @@ type wantDoc struct { // testdata/contextual-namespace. Each folder is built as a GitTarget subtree and the // per-document namespace provenance is asserted, so the supported boundary is pinned by // real layouts rather than prose. See -// docs/design/manifest/contextual-namespace-and-kustomize-folder-editing.md. +// docs/spec/contextual-namespace-and-kustomize-folder-editing.md. func TestContextualNamespaceCorpus(t *testing.T) { cases := []struct { dir string diff --git a/internal/manifestanalyzer/delete_plan.go b/internal/manifestanalyzer/delete_plan.go index f1c39825..57d0c4ae 100644 --- a/internal/manifestanalyzer/delete_plan.go +++ b/internal/manifestanalyzer/delete_plan.go @@ -9,12 +9,12 @@ import ( // PlanDelete resolves a steady-state DELETE watch event to a single delete-document // plan action over the store, or no action when Git holds no managed document for the // resource. It is the M6 milestone: closing the delete-identity gap the review names -// (docs/design/manifest/current-manifest-support-review.md, "Cons And Gaps") so a +// (docs/spec/current-manifest-support-review.md, "Cons And Gaps") so a // moved manifest is still deleted, and the writer (M7) deletes by RecordRef instead of // regenerating a canonical path. // // This is the per-event delete path of the design's "Two Paths, One Plan Type" -// (docs/design/manifest/reconcile-via-watchlist-mark-and-sweep.md). Unlike BuildPlan's +// (docs/spec/reconcile-via-watchlist-mark-and-sweep.md). Unlike BuildPlan's // full-snapshot mark-and-sweep, it targets exactly ONE identity and NEVER sweeps, so a // lone delete intent can never be mistaken for "every other document is now an orphan". // M7's steady-state loop folds this over its coalesced PendingChanges (a delete is a diff --git a/internal/manifestanalyzer/gittargetignore.go b/internal/manifestanalyzer/gittargetignore.go index 54dd16d1..89095171 100644 --- a/internal/manifestanalyzer/gittargetignore.go +++ b/internal/manifestanalyzer/gittargetignore.go @@ -13,7 +13,7 @@ import ( ) // GitTargetIgnoreFileName is the basename of the in-repo escape hatch described in -// docs/design/gitpath-foreign-content-stringency.md (§4). Exactly ONE copy is honoured — +// docs/spec/gitpath-foreign-content-stringency.md (§4). Exactly ONE copy is honoured — // the file at the GitTarget path root — and the patterns it carries name content the // operator must NEVER read, even when it is YAML. A copy deeper in the subtree is NOT // honoured and is refused as foreign content (D-foreign-2). @@ -25,7 +25,7 @@ const gitDirName = ".git" // ForeignKind classifies a non-managed filesystem entry found under a GitTarget path — // the foreign role of the five-role model in -// docs/design/gitpath-foreign-content-stringency.md (§3). A foreign entry is refused, not +// docs/spec/gitpath-foreign-content-stringency.md (§3). A foreign entry is refused, not // ignored: the path is an operator-exclusive subtree. type ForeignKind string diff --git a/internal/manifestanalyzer/overrides.go b/internal/manifestanalyzer/overrides.go index e0e02eaf..65995397 100644 --- a/internal/manifestanalyzer/overrides.go +++ b/internal/manifestanalyzer/overrides.go @@ -15,7 +15,7 @@ import ( // kustomization.yaml and attributing an unambiguous override chain to every // resource file a render root reaches. The write-side projection consumes the // attached KustomizeOverrides. See -// docs/design/gitops-api/f1-images-replicas-edit-through.md. +// docs/design/gitops-api/finished/f1-images-replicas-edit-through.md. // reasonAmbiguousOverrides marks a build-time diagnostic for a resource file that // more than one render root reaches with differing override chains. The store diff --git a/internal/manifestanalyzer/overrides_projection.go b/internal/manifestanalyzer/overrides_projection.go index e22c4f1b..bc1520b3 100644 --- a/internal/manifestanalyzer/overrides_projection.go +++ b/internal/manifestanalyzer/overrides_projection.go @@ -18,7 +18,7 @@ import ( // governing override chain, it splits the live state into what the SOURCE FILE // should hold and what the KUSTOMIZATION ENTRIES should hold — "the edit lands // where the value lives". See -// docs/design/gitops-api/f1-images-replicas-edit-through.md. +// docs/design/gitops-api/finished/f1-images-replicas-edit-through.md. // OverrideEdit routes one live-value change to a field of an existing // kustomization override entry. diff --git a/internal/manifestanalyzer/overrides_test.go b/internal/manifestanalyzer/overrides_test.go index 3b57cc72..e1e6a214 100644 --- a/internal/manifestanalyzer/overrides_test.go +++ b/internal/manifestanalyzer/overrides_test.go @@ -16,7 +16,7 @@ import ( // single-root overlay attaches its entries, a nested base composes // innermost-first, and two roots with differing chains attach nothing and emit // the ambiguity diagnostic. See -// docs/design/gitops-api/f1-images-replicas-edit-through.md. +// docs/design/gitops-api/finished/f1-images-replicas-edit-through.md. func corpusDeployment(t *testing.T, store *ManifestStore) *DocumentModel { t.Helper() diff --git a/internal/manifestanalyzer/placement.go b/internal/manifestanalyzer/placement.go index 98d4c9c6..61f3bc6f 100644 --- a/internal/manifestanalyzer/placement.go +++ b/internal/manifestanalyzer/placement.go @@ -14,7 +14,7 @@ import ( ) // PlacementPolicy is a resolved GitTarget placement declaration (Option B2 of -// docs/design/manifest/version2/gittarget-new-file-placement-rules.md): a single +// docs/spec/gittarget-new-file-placement-rules.md): a single // exact-type map plus a fallback default template, consulted for every resource // regardless of sensitivity. It mirrors api/v1alpha3.GitTargetPlacementSpec // field-for-field but is defined locally so this analyzer package stays free of any @@ -92,7 +92,7 @@ type PlacementResult struct { } // LocateNew resolves the placement of a resource with no existing document, per -// docs/design/manifest/version2/gittarget-new-file-placement-rules.md: a declared +// docs/spec/gittarget-new-file-placement-rules.md: a declared // template (Option B) wins when present; otherwise an existing sibling cohort // decides (Option C, steps 1/2 — same type+namespace, then same type+any // namespace); otherwise the canonical path. diff --git a/internal/manifestanalyzer/plan.go b/internal/manifestanalyzer/plan.go index 90d9511e..645d367b 100644 --- a/internal/manifestanalyzer/plan.go +++ b/internal/manifestanalyzer/plan.go @@ -13,7 +13,7 @@ import ( ) // Plan is the first-class, cross-layer contract described in -// docs/design/manifest/current-manifest-support-review.md ("Writer Model: Plan, +// docs/spec/current-manifest-support-review.md ("Writer Model: Plan, // Apply, Dirty Flush"). It is a pure function of (ManifestStore, desired set, // policy): the same value the live writer applies, scan mode renders, the CLI // prints, and GitTarget status summarizes. M3 builds the model and its @@ -116,7 +116,7 @@ func (p Plan) Counts() map[PlanActionKind]int { // the mapping. // // This is a full-snapshot input — the "Resync" path of the design's "Two Paths, One -// Plan Type" (docs/design/manifest/reconcile-via-watchlist-mark-and-sweep.md). It is +// Plan Type" (docs/spec/reconcile-via-watchlist-mark-and-sweep.md). It is // NOT a per-event PendingChange: BuildPlan mark-and-sweeps every watched document // absent from this set as a managed drop, so the set must be the whole desired state // (scan mode / resync), never a partial batch. Steady-state, per-event planning that @@ -192,7 +192,7 @@ func allInScope(types.ResourceIdentifier) bool { return true } // // With allInScope this is exactly BuildPlan — the full-snapshot mark-and-sweep — so the two // share one implementation and one set of safety guarantees. See -// docs/design/manifest/version2/type-lifecycle-events-and-wobble-settling.md (Proposal 3 / M12). +// docs/spec/type-lifecycle-events-and-wobble-settling.md (Proposal 3 / M12). func BuildScopedPlan( store *ManifestStore, files []manifestedit.FileContent, diff --git a/internal/manifestanalyzer/scan.go b/internal/manifestanalyzer/scan.go index 65b52f65..96a68acc 100644 --- a/internal/manifestanalyzer/scan.go +++ b/internal/manifestanalyzer/scan.go @@ -13,7 +13,7 @@ import ( // Scan is the M5 dry-run: the one planner shared by the manifest-analyzer CLI and // the controller's scan path, described in -// docs/design/manifest/current-manifest-support-review.md ("Scan Mode (Dry-Run)"). +// docs/spec/current-manifest-support-review.md ("Scan Mode (Dry-Run)"). // It builds the store (applying the policy's allowlist), runs the acceptance gate, // and computes the full plan against the desired set — then stops. It writes // nothing. diff --git a/internal/manifestanalyzer/store.go b/internal/manifestanalyzer/store.go index 1e4286bc..24f72abb 100644 --- a/internal/manifestanalyzer/store.go +++ b/internal/manifestanalyzer/store.go @@ -19,7 +19,7 @@ import ( ) // ManifestStore is the byte-free, in-memory structure model of a GitTarget folder -// described in docs/design/manifest/current-manifest-support-review.md ("Concrete +// described in docs/spec/current-manifest-support-review.md ("Concrete // Data Structures"). It is the backbone the live writer, scan mode, the CLI, and // status all consume; the analyzer Report is rendered as a projection over it. // @@ -81,7 +81,7 @@ type ManifestStore struct { // Foreign lists the filesystem entries under spec.path that matched no recognized role // (non-YAML files, symlinks, submodules) and survived the .gittargetignore filter. The // acceptance gate refuses each one (foreignContentRefusals); the path is an - // operator-exclusive subtree. See docs/design/gitpath-foreign-content-stringency.md. + // operator-exclusive subtree. See docs/spec/gitpath-foreign-content-stringency.md. Foreign []ForeignEntry // Ignore is the active root .gittargetignore matcher (nil when the path carries none). @@ -155,7 +155,7 @@ func (f *FileModel) Deleted() bool { return f.Current == nil && f.Original != ni // without storing a fragile mutable field. The M4 acceptance gate additionally // refuses any managed file that is not entirely valid KRM (Decision #2), so an // accepted file is contiguous anyway. manifestedit is given the position only at -// apply time. See docs/design/manifest/current-manifest-support-review.md ("Concrete +// apply time. See docs/spec/current-manifest-support-review.md ("Concrete // Data Structures") and the M4 acceptance gate (acceptance.go). type DocumentModel struct { // ManifestIdentity is the EFFECTIVE content identity (apiVersion + kind + @@ -175,7 +175,7 @@ type DocumentModel struct { // ambiguous-kustomize-overrides diagnostic). The writer routes a live change // produced by one of these entries back to the entry instead of writing it // through into the source document. See - // docs/design/gitops-api/f1-images-replicas-edit-through.md. + // docs/design/gitops-api/finished/f1-images-replicas-edit-through.md. Overrides *KustomizeOverrides // ResourceIdentity is the API-side identity (GVR + namespace + name). It is set @@ -206,7 +206,7 @@ type DocumentModel struct { // It replaces an earlier "namespace came from kustomize" boolean so the store can also // explain the no-context and ambiguous cases to status, duplicate diagnostics, and // future placement — see -// docs/design/manifest/contextual-namespace-and-kustomize-folder-editing.md. +// docs/spec/contextual-namespace-and-kustomize-folder-editing.md. type NamespaceSourceKind string const ( @@ -647,7 +647,7 @@ func kustomizationInfos(kusts map[string]*kustomizationDoc) map[string]*Kustomiz // namespace transformer, its resources/bases graph entries, and whether it uses any // feature outside the supported contextual-namespace subset (which disqualifies it as // a namespace source). See the "Kustomize subset proposal" in -// docs/design/manifest/contextual-namespace-and-kustomize-folder-editing.md. +// docs/spec/contextual-namespace-and-kustomize-folder-editing.md. type kustomizationDoc struct { path string // kustomization file path (slash) namespace string // the namespace: transformer value diff --git a/internal/manifestreport/render.go b/internal/manifestreport/render.go index 39a337f7..6b9582a4 100644 --- a/internal/manifestreport/render.go +++ b/internal/manifestreport/render.go @@ -7,11 +7,9 @@ two pieces of policy manifestedit deliberately refuses to own — the Git projection and the canonical renderer — and provides a read-only reconcile that reports what it would add, remove, or update. -It is the seam described in step 6 of -docs/design/manifest/manifestedit-abstraction-plan.md and detailed in -docs/design/manifest/manifestedit-integration-readonly-reconcile.md. It depends on -internal/sanitize (the projection/renderer) and internal/git/manifestedit (the -mechanism); manifestedit itself stays free of both. +It is the read-only reconcile seam described in docs/spec/manifest-system.md. It +depends on internal/sanitize (the projection/renderer) and +internal/git/manifestedit (the mechanism); manifestedit itself stays free of both. */ package manifestreport @@ -46,7 +44,7 @@ func Render(obj *unstructured.Unstructured) ([]byte, error) { // strategy — keyed matching needs a path/GVK-aware policy that does not exist // yet, and a blanket KeyField would change every named list's behavior; // - Owns: nil = whole-object truth (API-first), the only supported policy -// (docs/design/manifest/manifestedit-field-ownership-spike.md). +// (docs/spec/manifestedit-field-ownership-spike.md). func EditOptions() manifestedit.EditOptions { return manifestedit.EditOptions{Render: Render} } diff --git a/internal/manifestreport/report.go b/internal/manifestreport/report.go index b84cb95b..052bbca8 100644 --- a/internal/manifestreport/report.go +++ b/internal/manifestreport/report.go @@ -66,7 +66,7 @@ func (r Report) Counts() map[Action]int { // The trust model is a single repository transaction: files must be the content // of one checked-out commit/worktree, and the resulting verdicts are valid only // for that snapshot. See -// docs/design/manifest/manifestedit-integration-readonly-reconcile.md. +// docs/spec/manifest-system.md. func BuildReport( files []manifestedit.FileContent, desired []*unstructured.Unstructured, diff --git a/internal/mutationlab/record.go b/internal/mutationlab/record.go index bf58c86b..67e08a44 100644 --- a/internal/mutationlab/record.go +++ b/internal/mutationlab/record.go @@ -5,7 +5,7 @@ // native watches, audit webhooks, and validating admission webhooks, and // commits those structures as a versioned corpus. It is deliberately NOT a // second implementation of GitOps Reverser; see -// docs/design/mutation-capture-lab-design.md. +// docs/spec/mutation-capture-lab-design.md. package mutationlab import ( diff --git a/internal/mutationlab/store/store.go b/internal/mutationlab/store/store.go index 144d1d1b..88a87cc9 100644 --- a/internal/mutationlab/store/store.go +++ b/internal/mutationlab/store/store.go @@ -5,7 +5,7 @@ // next has started; clearing between scenarios is therefore not enough. The store // keeps every record attributed to its scenario and serves reads filtered by // scenario, so the test driver isolates scenarios instead of trusting a clean -// slate (see docs/design/mutation-capture-lab-design.md, "Isolated Test Setup"). +// slate (see docs/spec/mutation-capture-lab-design.md, "Isolated Test Setup"). package store import ( diff --git a/internal/queue/attribution_index.go b/internal/queue/attribution_index.go index 9f9063a9..f11e6bf6 100644 --- a/internal/queue/attribution_index.go +++ b/internal/queue/attribution_index.go @@ -224,7 +224,7 @@ func (a *AttributionIndex) writeFactKeys(ctx context.Context, gr, uid, rv string // dead. Finalizer-pending items are NOT skipped — under the deletion-as-intent rule a // deletionTimestamp already removes the file, so the actor who ran the collection delete // is credited with that removal even while Kubernetes finalization is still in flight. -// See docs/design/deletecollection-attribution-expander.md. +// See docs/spec/deletecollection-attribution-expander.md. func (a *AttributionIndex) RecordDeleteCollectionFacts(ctx context.Context, event auditv1.Event) error { if !strings.EqualFold(event.Verb, "deletecollection") || event.ObjectRef == nil || event.ObjectRef.Resource == "" { return nil diff --git a/internal/reconcile/git_target_event_stream.go b/internal/reconcile/git_target_event_stream.go index 7eb4d928..7125c1b7 100644 --- a/internal/reconcile/git_target_event_stream.go +++ b/internal/reconcile/git_target_event_stream.go @@ -19,7 +19,7 @@ import ( // into a parent-manifest field patch (redis_audit_consumer.routeScaleFieldPatch). "Newer?" is now // answered by the audit stream's RV ordering and "changed?" by the writer's no-op detection // (manifestedit.Decide at the commit boundary), so no hash is computed here. See -// docs/design/stream/api-source-of-truth-reconcile.md (DEC-6, DEC-7). +// docs/architecture.md (DEC-6, DEC-7). type GitTargetEventStream struct { gitTargetName string gitTargetNamespace string diff --git a/internal/rulestore/store_test.go b/internal/rulestore/store_test.go index 8edad8fc..baeec8cf 100644 --- a/internal/rulestore/store_test.go +++ b/internal/rulestore/store_test.go @@ -384,7 +384,7 @@ func TestGetMatchingRules(t *testing.T) { // deduped to one). // // This matters for the per-target effective watch plan -// (docs/design/gittarget-isolation-on-rule-change.md): a target's watched +// (docs/spec/gittarget-isolation-on-rule-change.md): a target's watched // operation set for a GVR is the union across its rules, and each returned // CompiledRule carries its own GitTarget, so two complementary rules pointing at // the same target make that target watch the union. diff --git a/internal/types/identifier.go b/internal/types/identifier.go index 7c1eef27..d52633d4 100644 --- a/internal/types/identifier.go +++ b/internal/types/identifier.go @@ -54,7 +54,7 @@ func (r ResourceIdentifier) Key() string { // once any layout exists in the target, sibling inference follows it, and an // existing document is always edited in place at its current location (match-first), // so changing this shape never moves a file that is already in Git. See -// docs/design/manifest/version2/gittarget-new-file-placement-rules.md. +// docs/spec/gittarget-new-file-placement-rules.md. func (r ResourceIdentifier) ToGitPath() string { scope := r.Namespace if scope == "" { diff --git a/internal/typeset/funnel.go b/internal/typeset/funnel.go index 8e4eaa3e..2d5e977f 100644 --- a/internal/typeset/funnel.go +++ b/internal/typeset/funnel.go @@ -12,7 +12,7 @@ import "strings" // assignment) is gated on the scale subresource's own verbs via the scale // requirement, not on the parent carrying patch. This is a deliberate simplification // of the design doc's get/list/watch/patch list — see -// docs/design/manifest/version2/type-followability-implementation.md. +// docs/spec/type-followability.md. func requiredVerbs() []string { return []string{"get", "list", "watch"} } // Observation is the raw per-type facts the funnel reduces into a Followability. It diff --git a/internal/typeset/lifecycle.go b/internal/typeset/lifecycle.go index e375f7d1..e1e6ca2b 100644 --- a/internal/typeset/lifecycle.go +++ b/internal/typeset/lifecycle.go @@ -14,7 +14,7 @@ import ( // just-appeared type does not drive a per-type reconcile on a state that is about to change // again. Like RemovalGrace it is product safety, not tuning, so it is a fixed constant — but // it is deliberately short where the grace is long. See -// docs/design/manifest/version2/type-lifecycle-events-and-wobble-settling.md (Proposal 2). +// docs/spec/type-lifecycle-events-and-wobble-settling.md (Proposal 2). const SettleWindow = 5 * time.Second // EventKind names a per-type lifecycle transition the registry emits. The events are diff --git a/internal/typeset/materializer.go b/internal/typeset/materializer.go index 91bdaae8..6ec58f20 100644 --- a/internal/typeset/materializer.go +++ b/internal/typeset/materializer.go @@ -11,7 +11,7 @@ import ( ) // The Materializer is the second axis from -// docs/design/stream/demand-driven-type-materialization-lifecycle.md: a sibling state +// docs/spec/type-followability.md: a sibling state // machine to the Registry, in the same leaf package. The Registry answers the supply // question ("can we follow this type?"); the Materializer answers the demand-met // question ("has anyone claimed it, and have we listed it?"). A type is materialized — @@ -31,9 +31,9 @@ import ( // resourceVersionMatch=NotOlderThan, allowWatchBookmarks=true, fold the initial ADDED events, and // pin the initial-events-end bookmark's resourceVersion as R, falling back to the consistent LIST // only when the server rejects sendInitialEvents — is a planned optimisation, not yet built (Gap 5 / -// Rec 6 in docs/design/stream/materialization-tail-and-live-readiness-review.md). This leaf is +// Rec 6 in docs/finished/materialization-tail-and-live-readiness-review.md). This leaf is // agnostic to which path produced the rv; it owns only the phase machine and the lease GC, never the -// fill. See docs/design/manifest/reconcile-via-watchlist-mark-and-sweep.md. +// fill. See docs/spec/reconcile-via-watchlist-mark-and-sweep.md. // Phase is where a type sits on the materialization axis. It is orthogonal to the // followability Verdict: a Followable type may be Dormant (unclaimed) and a claimed type @@ -599,7 +599,7 @@ type TypeMaterialization struct { // type that has a prior checkpoint. It is false for Dormant/Requested/Syncing and for a // Failing type that never landed a first checkpoint. This is the single predicate the // status roll-up buckets on, so a periodic re-anchor (Synced→Resyncing→Synced) never flaps -// the derived liveness signal. See docs/design/status-design-git-target.md §3.2. +// the derived liveness signal. See docs/spec/status-conditions-guide.md §3.2. func (t TypeMaterialization) Serviceable() bool { return t.CheckpointRV != "" } diff --git a/internal/typeset/model.go b/internal/typeset/model.go index 7ac44a3f..553573e0 100644 --- a/internal/typeset/model.go +++ b/internal/typeset/model.go @@ -3,7 +3,7 @@ // Package typeset is GitOps Reverser's single decision surface for "is this // resource type followable, and if not, what is the one reason it is not?". // -// It is the greenfield model from docs/design/manifest/version2/type-followability.md. +// It is the greenfield model from docs/spec/type-followability.md. // Every served type carries one TypeRecord with one Followability: a verdict, a // one-line summary, and the full funnel-ordered list of requirement checks. That // single value replaces the old split between a "requirements" table and a "health @@ -84,7 +84,7 @@ type StatusFact struct { // ScaleBinding is the only subresource fact the writer needs: where a /scale // mutation lands on the parent's desired state. SpecReplicasPath drives the scale // write path; the selector facts are for reporting. See -// docs/design/manifest/version2/type-followability.md. +// docs/spec/type-followability.md. type ScaleBinding struct { Enabled bool Source string // discovery | crd | builtin-registry | aggregated | unknown diff --git a/internal/typeset/registry.go b/internal/typeset/registry.go index 18fa54d0..b832cf19 100644 --- a/internal/typeset/registry.go +++ b/internal/typeset/registry.go @@ -48,7 +48,7 @@ type Registry struct { // followable<->refused) or the backing scan generation moves. Consumers that cache // a projection of the registry (the per-GitTarget watched-type set) gate on this, // not on the catalog generation — so a retention-grace drop at a stable generation - // still invalidates their cache. See docs/.../discovery-catalog-typeset-boundary.md. + // still invalidates their cache. See docs/spec/type-followability.md. revision uint64 ready bool } diff --git a/internal/typeset/scan.go b/internal/typeset/scan.go index 5504f8fc..0e189405 100644 --- a/internal/typeset/scan.go +++ b/internal/typeset/scan.go @@ -8,7 +8,7 @@ import "k8s.io/apimachinery/pkg/runtime/schema" // produces, with no judgement attached. The catalog stays a thin normalizer; ALL // cross-scan judgement ("additions fast, removals slow": retain-on-error, the removal // grace for omissions) is applied by Registry.UpdateFromScan. See -// docs/design/typeset-owns-discovery-grace.md. +// docs/spec/typeset-owns-discovery-grace.md. type Scan struct { // Entries are the resources this scan served, policy-annotated. All are trusted // facts: a failed group/version contributes no entries (the registry carries its diff --git a/internal/watch/api_resource_catalog.go b/internal/watch/api_resource_catalog.go index 12c76deb..b5470aa1 100644 --- a/internal/watch/api_resource_catalog.go +++ b/internal/watch/api_resource_catalog.go @@ -24,7 +24,7 @@ type apiResourceDiscovery interface { // typeset registry: it turns one ServerGroupsAndResources() result into a // policy-annotated typeset.Scan. It holds NO judgement and no time-sensitive state — // retain-on-error and the removal grace for omissions both live in -// typeset.Registry.UpdateFromScan (see docs/design/typeset-owns-discovery-grace.md). +// typeset.Registry.UpdateFromScan (see docs/spec/typeset-owns-discovery-grace.md). // The only state kept is mechanical bookkeeping: the last normalized scan (the change // fingerprint, and the registry's re-derive source for refreshes without a discovery // round-trip), the scan generation, and readiness. diff --git a/internal/watch/manager.go b/internal/watch/manager.go index 09834f6e..7433865d 100644 --- a/internal/watch/manager.go +++ b/internal/watch/manager.go @@ -49,7 +49,7 @@ import ( // holds NO long-lived object informers: the only always-on resource intake is the // audit-webhook push (mirrored into the per-type :audit:stream); the only API touch on a // schedule is the brief checkpoint fill (mirrorTypeObjects) the materialization driver runs -// for claimed types. See docs/design/stream/api-source-of-truth-reconcile.md. +// for claimed types. See docs/architecture.md. type Manager struct { // Client provides cluster access. Client client.Client @@ -162,7 +162,7 @@ type Manager struct { // state TRANSITIONS, so the GitTarget controller re-projects GitPathAccepted promptly // instead of waiting up to RequeueSteadyInterval (5m) for its next periodic reconcile. The // data plane records acceptance asynchronously; without this edge the status lags. See - // docs/design/manifest/gitpathaccepted-projection-race-and-external-drift.md. Lazily + // docs/spec/manifest-system.md. Lazily // created by GitPathEvents() and guarded by gitPathEventsMu. gitPathEventsMu sync.Mutex gitPathEventsCh chan event.GenericEvent @@ -175,7 +175,7 @@ type Manager struct { gitTargetUIDs map[string]string // typeRegistry is the followability decision surface (see - // docs/design/manifest/version2/type-followability.md): one typeset.TypeRecord + // docs/spec/type-followability.md): one typeset.TypeRecord // per served type, refreshed from the catalog scan on every catalog refresh. It // is the inventory/status surface ("is this type followable, and if not, why?"); // typeRegistryInit guards its lazy construction for zero-value Managers in tests. diff --git a/internal/watch/manager_catalog.go b/internal/watch/manager_catalog.go index 26ee0123..6da271ce 100644 --- a/internal/watch/manager_catalog.go +++ b/internal/watch/manager_catalog.go @@ -217,10 +217,10 @@ func (m *Manager) typeRegistryInstance() *typeset.Registry { // refreshTypeRegistry publishes the catalog's latest normalized scan to the typeset // registry, which owns ALL cross-scan judgement (retain-on-error, the removal grace -// for omissions — docs/design/typeset-owns-discovery-grace.md). It runs after every +// for omissions — docs/spec/typeset-owns-discovery-grace.md). It runs after every // catalog refresh, so the registry tracks discovery and its grace clocks advance on // the same cadence the catalog scans do. It is the "Scan -> Registry" pipeline of -// docs/design/manifest/version2/type-followability.md. +// docs/spec/type-followability.md. func (m *Manager) refreshTypeRegistry() { // Only publish once the catalog holds trusted data, so the registry's readiness // tracks the catalog's: an unready catalog must leave the registry unready, which diff --git a/internal/watch/scope_resolve.go b/internal/watch/scope_resolve.go index 39a947a9..9e481a34 100644 --- a/internal/watch/scope_resolve.go +++ b/internal/watch/scope_resolve.go @@ -23,7 +23,7 @@ import ( // rather than reconciling a reduced view (R11, §7). The desired set itself is no longer // gathered live — it is the spliced materialization (splice_snapshot.go) — so this file holds // only scope resolution and the object→DesiredResource projection both the splice and the -// demand Declare share. See docs/design/stream/api-source-of-truth-reconcile.md. +// demand Declare share. See docs/architecture.md. // ClusterSnapshot is one type's revision-pinned desired set for a GitTarget: Desired is the // scoped object set the worker folds over the git folder; Revision is the checkpoint diff --git a/internal/watch/target_watch.go b/internal/watch/target_watch.go index 4421c6da..57802627 100644 --- a/internal/watch/target_watch.go +++ b/internal/watch/target_watch.go @@ -821,7 +821,7 @@ func operationForWatchEvent(eventType watch.EventType) string { // the writer folds to a no-op against the already-absent path. deletionTimestamp is // server-owned runtime metadata (sanitize strips it), never desired state, so the // intent tree's invariant — a file present means the resource is intended to exist — -// holds. See docs/design/deletecollection-attribution-expander.md §2. +// holds. See docs/spec/deletecollection-attribution-expander.md §2. func operationForLiveTargetWatchEvent(eventType watch.EventType, u *unstructured.Unstructured) string { if u != nil && u.GetDeletionTimestamp() != nil { return string(configv1alpha3.OperationDelete) diff --git a/internal/webhook/validate_operator_types_handler.go b/internal/webhook/validate_operator_types_handler.go index e8a13a11..a9a843bc 100644 --- a/internal/webhook/validate_operator_types_handler.go +++ b/internal/webhook/validate_operator_types_handler.go @@ -60,7 +60,7 @@ type CommandAuthorRecorder interface { // submitter into the CommandAuthorStore and always allows — pure observation with a // single side effect (a Redis upsert), never a rejection, so a user's command never // depends on it succeeding (a missed capture degrades to a committer-authored commit; -// see docs/design/commitrequest-admission-authorship.md §2, §4). It dispatches on the +// see docs/spec/commitrequest-admission-authorship.md §2, §4). It dispatches on the // resource (isCommandKind today), so a future config-validation branch for non-command // kinds slots in alongside without disturbing this one. type ValidateOperatorTypesHandler struct { diff --git a/test/e2e/aggregated_apiserver_e2e_test.go b/test/e2e/aggregated_apiserver_e2e_test.go index ecacac09..66d5c881 100644 --- a/test/e2e/aggregated_apiserver_e2e_test.go +++ b/test/e2e/aggregated_apiserver_e2e_test.go @@ -18,7 +18,7 @@ import ( // Not Serial: the wardle APIService is installed once at cluster setup and only // read here; everything this spec mutates is name-isolated. See -// docs/design/e2e-serial-registry.md. +// docs/spec/e2e-serial-registry.md. var _ = Describe("Aggregated API server", Label("aggregated-api"), Ordered, func() { var ( testNs string diff --git a/test/e2e/argocd_bi_directional_e2e_test.go b/test/e2e/argocd_bi_directional_e2e_test.go index c65be0c6..e5679062 100644 --- a/test/e2e/argocd_bi_directional_e2e_test.go +++ b/test/e2e/argocd_bi_directional_e2e_test.go @@ -16,7 +16,7 @@ import ( "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" ) -// Argo CD half of the bi-directional corner (docs/design/e2e-bi-directional-corner.md). +// Argo CD half of the bi-directional corner (docs/spec/e2e-bi-directional-corner.md). // // Argo CD is only installed for this corner, by the `_argocd-installed` Taskfile // node. `task test-e2e` skips these specs; `task test-e2e-bi-directional` runs them. diff --git a/test/e2e/bi_directional_common_test.go b/test/e2e/bi_directional_common_test.go index 2f7a9268..2ac009af 100644 --- a/test/e2e/bi_directional_common_test.go +++ b/test/e2e/bi_directional_common_test.go @@ -24,7 +24,7 @@ import ( // because it is the only place Argo CD is installed — `task test-e2e` skips it, // `task test-e2e-bi-directional` runs it. // -// See docs/design/e2e-bi-directional-corner.md and docs/bi-directional.md. +// See docs/spec/e2e-bi-directional-corner.md and docs/bi-directional.md. const biDirectionalEnabledEnv = "E2E_ENABLE_BI_DIRECTIONAL" const ( diff --git a/test/e2e/commit_request_e2e_test.go b/test/e2e/commit_request_e2e_test.go index 755ad438..0331bbbb 100644 --- a/test/e2e/commit_request_e2e_test.go +++ b/test/e2e/commit_request_e2e_test.go @@ -25,7 +25,7 @@ import ( // branch is its own GitTarget, fed exclusively by audit events from its own // namespace. The HEAD/SHA assertions below therefore read back only this spec's // own commit; concurrent audit traffic for other GitTargets lands in other -// repos and cannot move this repo's HEAD. See docs/design/e2e-serial-registry.md. +// repos and cannot move this repo's HEAD. See docs/spec/e2e-serial-registry.md. var _ = Describe("Commit Request", Label("commit-request", "audit-consumer"), Ordered, func() { var ( testNs string @@ -214,7 +214,7 @@ var _ = Describe("Commit Request", Label("commit-request", "audit-consumer"), Or // validating admission runs, so the validate-operator-types webhook records the // submitter keyed by uid with no response-body name recovery (the old audit // generateName headache is gone, see - // docs/design/commitrequest-admission-authorship.md §8). This spec proves a + // docs/spec/commitrequest-admission-authorship.md §8). This spec proves a // generateName CommitRequest still finalizes and becomes Ready. It is skipped in // configured-author mode, where the edit's window is committer-authored and the // named admission author would not match it end to end. @@ -267,7 +267,7 @@ var _ = Describe("Commit Request", Label("commit-request", "audit-consumer"), Or // The UC2 suite exercises a `kubectl apply` bundle that includes a CommitRequest // as its FIRST document — the deliberately-hard ordering where the save intent -// arrives before the work it is meant to save (docs/design/stream/commitrequest-design.md +// arrives before the work it is meant to save (docs/spec/commitrequest-design.md // §2 UC2, §6.2, §8.2). A non-zero spec.closeDelaySeconds is the close-delay collect // window that lets the bundle's resources arrive and join the same window after the // CommitRequest is attributed, so the whole bundle lands in ONE commit carrying diff --git a/test/e2e/commit_window_batching_e2e_test.go b/test/e2e/commit_window_batching_e2e_test.go index 489c78a4..036029fb 100644 --- a/test/e2e/commit_window_batching_e2e_test.go +++ b/test/e2e/commit_window_batching_e2e_test.go @@ -26,7 +26,7 @@ import ( // burst inside one commit window collapses into one commit) is a per-GitTarget // branch-worker behaviour: each GitTarget runs its own commit window, so events // routed to other GitTargets cannot land in this spec's grouped commit. See -// docs/design/e2e-serial-registry.md. +// docs/spec/e2e-serial-registry.md. var _ = Describe("Commit Window Batching", Label("commit-window-batching", "audit-consumer"), Ordered, func() { var ( diff --git a/test/e2e/deletecollection_intent_e2e_test.go b/test/e2e/deletecollection_intent_e2e_test.go index 4dca7bd4..b8d915c1 100644 --- a/test/e2e/deletecollection_intent_e2e_test.go +++ b/test/e2e/deletecollection_intent_e2e_test.go @@ -36,7 +36,7 @@ import ( // The state correctness of collection deletes is solved by construction in watch-first // (one watch event per object); this spec adds the intent semantics and the attribution // that the headline claim depends on. See -// docs/design/deletecollection-attribution-expander.md. +// docs/spec/deletecollection-attribution-expander.md. // // Not Serial: the GitProvider uses a 0s commit window, so every watched event commits // immediately as its own commit, and every assertion reads the author/state scoped to a diff --git a/test/e2e/e2e_suite_test.go b/test/e2e/e2e_suite_test.go index c56fc322..3e378a9e 100644 --- a/test/e2e/e2e_suite_test.go +++ b/test/e2e/e2e_suite_test.go @@ -84,7 +84,7 @@ var _ = SynchronizedAfterSuite(func() {}, func() { // audit delivery, recovered by the next checkpoint) are expected and deliberately NOT gated. The // counter resets when the controller restarts (the restart-reconcile spec does this), but // Prometheus retains the pre-restart samples, so max_over_time over the run window catches any -// error that ever happened, on any pod. See docs/design/stream/audit-diagnostic-streams-plan.md. +// error that ever happened, on any pod. See docs/architecture.md. func assertNoAnomalousAuditOutcomes() { By("verifying no audit event ended in an error outcome (audit-outcome invariant)") ensurePrometheusClient() diff --git a/test/e2e/f4_placement_e2e_test.go b/test/e2e/f4_placement_e2e_test.go index cd419a30..d8c2b293 100644 --- a/test/e2e/f4_placement_e2e_test.go +++ b/test/e2e/f4_placement_e2e_test.go @@ -14,7 +14,7 @@ import ( // Validates F4 new-file placement end-to-end: a brand-new resource with no // existing document in Git — the "install something extra in test" launch use -// case (docs/design/manifest/version2/gittarget-new-file-placement-rules.md, +// case (docs/spec/gittarget-new-file-placement-rules.md, // docs/design/gitops-api/README.md) — lands inside the kustomize-managed overlay // directory it belongs to, not the canonical GVR-tree path, and the overlay's // kustomization.yaml gains the resources: entry so kustomize actually renders it. diff --git a/test/e2e/flux_bi_directional_e2e_test.go b/test/e2e/flux_bi_directional_e2e_test.go index 5614c491..3140a3ad 100644 --- a/test/e2e/flux_bi_directional_e2e_test.go +++ b/test/e2e/flux_bi_directional_e2e_test.go @@ -72,7 +72,7 @@ type iceCreamScoop struct { // biDirectionalRepo holds the file-local repo fixtures for the Bi Directional describe block. var biDirectionalRepo *RepoArtifacts -// Flux half of the bi-directional corner (docs/design/e2e-bi-directional-corner.md). +// Flux half of the bi-directional corner (docs/spec/e2e-bi-directional-corner.md). // Opt-in: `task test-e2e-bi-directional`, not `task test-e2e`. The corner is the // only place Argo CD is installed, and the two specs share that one cluster. // @@ -89,7 +89,7 @@ var biDirectionalRepo *RepoArtifacts // dragging unrelated targets into a re-reconcile; that is fixed — a target now // only re-reconciles when its *resolved* plan hash changes (manager.go) — so a // foreign catalog refresh no longer perturbs this repo's commit count. See -// docs/design/e2e-serial-registry.md. +// docs/spec/e2e-serial-registry.md. var _ = Describe("Bi Directional (Flux)", Label("bi-directional", "flux"), Ordered, func() { var run biDirectionalRun var testNs string diff --git a/test/e2e/foreign_content_e2e_test.go b/test/e2e/foreign_content_e2e_test.go index 182c1946..27c4e267 100644 --- a/test/e2e/foreign_content_e2e_test.go +++ b/test/e2e/foreign_content_e2e_test.go @@ -13,7 +13,7 @@ import ( ) // This spec proves the foreign-content stringency end to end -// (docs/design/gitpath-foreign-content-stringency.md): a GitTarget path is an +// (docs/spec/gitpath-foreign-content-stringency.md): a GitTarget path is an // operator-exclusive subtree, so a loose non-YAML file the operator cannot manage is REFUSED // (GitPathAccepted=False / UnsupportedContent / Stalled=True) with the offending file named, // and the operator commits nothing. It reuses the GitPathAccepted refusal plumbing the diff --git a/test/e2e/gittarget_isolation_e2e_test.go b/test/e2e/gittarget_isolation_e2e_test.go index 6b8ecf84..5e19515c 100644 --- a/test/e2e/gittarget_isolation_e2e_test.go +++ b/test/e2e/gittarget_isolation_e2e_test.go @@ -12,7 +12,7 @@ import ( ) // This spec is the e2e regression for GitTarget isolation on rule changes (see -// docs/design/gittarget-isolation-on-rule-change.md). The original symptom was a +// docs/spec/gittarget-isolation-on-rule-change.md). The original symptom was a // parallel-run flake: one GitTarget's ConfigMap event commit ("[CREATE] ...") // was replaced by a reconcile commit ("reconciled N ") because an // unrelated spec changed a *different* target's rules at the same time, dragging @@ -121,7 +121,7 @@ var _ = Describe("Manager GitTarget Isolation", Label("manager"), Ordered, func( "target A's commit message must name the resource path") g.Expect(msg).NotTo(ContainSubstring("reconciled"), "target A must not enter reconcile mode because of target B's unrelated rule change "+ - "(GitTarget isolation — see docs/design/gittarget-isolation-on-rule-change.md)") + "(GitTarget isolation — see docs/spec/gittarget-isolation-on-rule-change.md)") } Eventually(assertEventCommit).Should(Succeed()) } diff --git a/test/e2e/gittarget_overlap_e2e_test.go b/test/e2e/gittarget_overlap_e2e_test.go index 3ee27345..3bc52be0 100644 --- a/test/e2e/gittarget_overlap_e2e_test.go +++ b/test/e2e/gittarget_overlap_e2e_test.go @@ -11,8 +11,8 @@ import ( ) // This spec is the e2e for the GitTarget non-overlap topology guard (design: -// docs/design/manifest/current-manifest-support-review.md, milestone C1 in -// docs/design/manifest/implementation-plan.md). Within one provider+branch, no +// docs/spec/current-manifest-support-review.md, milestone C1 in +// docs/spec/current-manifest-support-review.md). Within one provider+branch, no // GitTarget path may be equal to, an ancestor of, or a descendant of another's. // Sibling folders are fine; nesting is rejected at the Validated gate so every // materialized folder has exactly one owner. The reject path surfaces as a diff --git a/test/e2e/helmrelease_mirror_edit_e2e_test.go b/test/e2e/helmrelease_mirror_edit_e2e_test.go index 00012f6e..1c3d8ef1 100644 --- a/test/e2e/helmrelease_mirror_edit_e2e_test.go +++ b/test/e2e/helmrelease_mirror_edit_e2e_test.go @@ -20,7 +20,7 @@ import ( // version bump, launch use case 2) round-trips into the mirrored file in place, // preserving hand-authored formatting. The generic-CRD case is already pinned by // crd_lifecycle_e2e_test.go; this pins a real, named higher-level type. -// See docs/design/gitops-api/f7-higher-level-krm-documents.md. +// See docs/design/gitops-api/finished/f7-higher-level-krm-documents.md. var _ = Describe("Manager F7 Higher-Level KRM (HelmRelease)", Label("manager", "f7-higher-level-krm"), Ordered, func() { var ( diff --git a/test/e2e/icecream.go b/test/e2e/icecream.go index f08b266e..1f9cf9b7 100644 --- a/test/e2e/icecream.go +++ b/test/e2e/icecream.go @@ -5,7 +5,7 @@ package e2e // Per-file IceCreamOrder CRD groups. Every e2e file that installs the // IceCreamOrder CRD owns its own API group so the files no longer share // cluster-scoped state and can run on parallel Ginkgo processes (Phase 2.5 of -// docs/design/e2e-speedup-plan.md). The kind, plural and singular stay the same +// docs/finished/e2e-speedup-plan.md). The kind, plural and singular stay the same // across all of them; only the group differs. Because the plural // ("icecreamorders") is shared, kubectl resource references MUST be qualified as // "icecreamorders." (see iceCreamCRDName) to avoid ambiguity when more diff --git a/test/e2e/image_refresh_test.go b/test/e2e/image_refresh_test.go index e2832064..2e654d3c 100644 --- a/test/e2e/image_refresh_test.go +++ b/test/e2e/image_refresh_test.go @@ -27,7 +27,7 @@ import ( // task test-image-refresh // // Serial: redeploys / changes the controller image, perturbing the shared -// controller for any concurrent spec. See docs/design/e2e-serial-registry.md. +// controller for any concurrent spec. See docs/spec/e2e-serial-registry.md. var _ = Describe("image refresh dependency chain", Label("image-refresh"), Serial, Ordered, func() { var ( projectDir string diff --git a/test/e2e/inplace_edit_e2e_test.go b/test/e2e/inplace_edit_e2e_test.go index 047240fb..1e9e8274 100644 --- a/test/e2e/inplace_edit_e2e_test.go +++ b/test/e2e/inplace_edit_e2e_test.go @@ -21,7 +21,7 @@ import ( // document in Git carries hand-authored formatting (here a YAML comment) that the // operator did not produce, a later cluster update is applied as a minimal // in-place edit that preserves the comment, rather than a wholesale rewrite. See -// docs/design/manifest/manifestedit-integration-readonly-reconcile.md. +// docs/spec/manifest-system.md. var _ = Describe("Manager In-Place Manifest Editing", Label("manager", "inplace-edit"), Ordered, func() { var ( testNs string diff --git a/test/e2e/restart_reconcile_e2e_test.go b/test/e2e/restart_reconcile_e2e_test.go index b22d8f7e..08e62d4f 100644 --- a/test/e2e/restart_reconcile_e2e_test.go +++ b/test/e2e/restart_reconcile_e2e_test.go @@ -30,7 +30,7 @@ import ( // watches with a concrete `apiVersions: ["v1"]` rule passes even with the bug // present — which is exactly why the existing e2e suite never caught this. // Serial: rolls the controller deployment, which disrupts any spec running -// concurrently on another process. See docs/design/e2e-serial-registry.md. +// concurrently on another process. See docs/spec/e2e-serial-registry.md. var _ = Describe("Restart Reconcile Safety", Label("restart-reconcile"), Serial, Ordered, func() { var ( testNs string diff --git a/test/e2e/signing_e2e_test.go b/test/e2e/signing_e2e_test.go index 534fdd31..c71aba78 100644 --- a/test/e2e/signing_e2e_test.go +++ b/test/e2e/signing_e2e_test.go @@ -401,7 +401,7 @@ var _ = Describe("Commit Signing", Label("signing"), Ordered, func() { commitPath := "e2e/signing-reconcile" // The reconcile template names the synced type ({{.APIVersion}}/{{.Resource}}) and pins the // {{.Revision}} so the per-type splice commits are self-describing — the §9 "name the synced - // type" improvement in docs/design/stream/signing-snapshot-tail-replay-failure-investigation.md. + // type" improvement in docs/finished/signing-snapshot-tail-replay-failure-investigation.md. customReconcileTemplate := "e2e-reconcile: synced {{.Count}} {{.APIVersion}}/{{.Resource}}" + "@{{.Revision}} to {{.GitTarget}}" diff --git a/test/e2e/unsupported_folder_e2e_test.go b/test/e2e/unsupported_folder_e2e_test.go index 6cb161d8..d0acc83a 100644 --- a/test/e2e/unsupported_folder_e2e_test.go +++ b/test/e2e/unsupported_folder_e2e_test.go @@ -18,7 +18,7 @@ import ( // commits nothing and surfaces the refusal on GitTarget status as GitPathAccepted=False, // Stalled=True, and Ready=False. WatchRule and ClusterWatchRule surface the same dependency // on GitTargetReady. The source streams stay truthful to watch state; the path is left untouched -// until a human cleans it. See docs/design/unsupported-folder-refusal-plan.md. +// until a human cleans it. See docs/spec/unsupported-folder-refusal-plan.md. var _ = Describe("Manager Unsupported Folder Refusal", Label("manager", "unsupported-folder"), Ordered, func() { var ( testNs string From e45145af8be0d5513a50a660d3ac435c0e4c3ef3 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Sat, 11 Jul 2026 19:34:41 +0000 Subject: [PATCH 13/28] docs: add the index, the support contract, and lifecycle banners MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Phase 0 of the triage, which is the part that actually answers "this is too much to oversee": - docs/INDEX.md names the ~35 documents that bind, out of 117. Everything not on that page is a user guide or history. - docs/design/gitops-api/support-contract.md is the single page that says what we support and what we refuse. That statement was previously asserted in 17 places across two doc trees, in three unrelated refusal vocabularies, and assembled nowhere. - Every doc in spec/, design/, finished/ and facts/ now opens with a one-line lifecycle banner, so a reader arriving from a Go citation knows immediately whether they are holding a contract or an artefact. Consolidation, so the boundary stops being restated: - fan-in = 1 now has one home (gittarget-granularity §1). kustomize-support §4 quotes it and says so. - The kubectl --dry-run=server evidence matrix lived twice, near-verbatim; intent-cluster-hydration now cites resource-capability-model instead of repeating it. - The gitops-api README's flat list of nine "Related:" links is now a table grouped by topic, with support-contract.md as the front door. Two stale headers corrected: unsupported-folder-refusal-plan.md said PROPOSAL while shipping as GitPathAccepted with an e2e test, and the triage plan itself moves to finished/ now that it has been executed. task lint: 0 issues. task test: pass, coverage 75.5% (unchanged). Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/INDEX.md | 100 +++++++++++++ docs/README.md | 39 ++--- ...e2e-coverage-gaps-and-improvements-plan.md | 2 + docs/design/e2e-finish-plan.md | 2 + docs/design/gitops-api/README.md | 33 +++-- .../gitops-api/intent-cluster-hydration.md | 38 ++--- ...mize-support-boundary-and-product-model.md | 8 + docs/design/gitops-api/support-contract.md | 138 ++++++++++++++++++ docs/design/metrics-observability-plan.md | 2 + ...ti-cluster-audit-ingestion-implications.md | 2 + docs/design/reconcile-triggering.md | 2 + docs/design/release-image-reuse-plan.md | 2 + docs/design/residual-e2e-flakes-2026-06-19.md | 2 + ...ensitive-resource-diagnostics-follow-up.md | 2 + docs/design/watch-and-catalog-architecture.md | 2 + .../audit-webhook-api-server-connectivity.md | 2 + docs/facts/generated-name-support.md | 2 + .../kubernetes-apf-and-inflight-tuning.md | 2 + docs/facts/kubernetes-api-discovery.md | 2 + docs/facts/kubernetes-api-resource-catalog.md | 2 + docs/facts/resource-types.md | 2 + docs/facts/resource-versions.md | 2 + docs/facts/subresources.md | 2 + ...ch-event-ordering-and-attribution-grace.md | 2 + docs/finished/audit-webhook-tls-design.md | 2 + .../documentation-triage.md | 16 +- .../e2e-aggregated-apiserver-test-design.md | 2 + docs/finished/e2e-ci-runner-sharding-plan.md | 2 + docs/finished/e2e-signing-followups.md | 2 + docs/finished/e2e-speedup-plan.md | 2 + docs/finished/git-credentials-interop.md | 2 + docs/finished/image-refresh-test-design.md | 2 + docs/finished/redis-key-schema-v3.md | 2 + .../sensitive-resource-classification-plan.md | 2 + ...pshot-tail-replay-failure-investigation.md | 2 + ...otstrap-and-key-management-architecture.md | 2 + .../sops-repo-bootstrap-out-of-scope.md | 2 + .../startup-robustness-cert-and-crd-wobble.md | 2 + ...reaming-readiness-status-machine-design.md | 2 + docs/finished/tilt-playground-plan.md | 2 + .../watch-first-ingestion-architecture.md | 2 + docs/spec/commit-window-refactor.md | 2 + .../commitrequest-admission-authorship.md | 2 + .../commitrequest-multi-finalize-design.md | 2 + ...-namespace-and-kustomize-folder-editing.md | 2 + docs/spec/current-manifest-support-review.md | 2 + .../deletecollection-attribution-expander.md | 2 + docs/spec/e2e-bi-directional-corner.md | 2 + docs/spec/e2e-serial-registry.md | 2 + docs/spec/e2e-test-design.md | 2 + .../gitpath-foreign-content-stringency.md | 2 + .../gittarget-new-file-placement-rules.md | 2 + docs/spec/gvk-gvr-mapping-layer.md | 2 + docs/spec/manifest-system.md | 2 + .../manifestedit-field-ownership-spike.md | 2 + docs/spec/mutation-capture-lab-design.md | 2 + .../reconcile-via-watchlist-mark-and-sweep.md | 2 + .../scale-subresource-audit-rehydration.md | 2 + docs/spec/sops-single-file-no-multidoc.md | 2 + docs/spec/status-conditions-guide.md | 2 + docs/spec/type-followability.md | 2 + ...pe-lifecycle-events-and-wobble-settling.md | 2 + docs/spec/typeset-owns-discovery-grace.md | 2 + docs/spec/unsupported-folder-refusal-plan.md | 6 +- 64 files changed, 434 insertions(+), 56 deletions(-) create mode 100644 docs/INDEX.md create mode 100644 docs/design/gitops-api/support-contract.md rename docs/{design => finished}/documentation-triage.md (94%) diff --git a/docs/INDEX.md b/docs/INDEX.md new file mode 100644 index 00000000..61060a97 --- /dev/null +++ b/docs/INDEX.md @@ -0,0 +1,100 @@ +# Index: what to read, and what is history + +> Rebuilt 2026-07-11, when the tree went from 180 documents to 117. + +There are 117 markdown files here. **About 35 of them bind.** This page names +those. If a document is not on this page, it is either a user guide (see +[`README.md`](README.md)) or history you can safely not read. + +## The four folders, and what each one means + +| Folder | Means | Binds? | +|---|---|---| +| [`spec/`](spec/) | **This is true now, and the code depends on it.** Every doc here is cited from Go source. Change the behaviour, change the doc. | **yes** | +| [`design/`](design/) | **We are still deciding.** Open questions, proposals, unbuilt work. | yes — it is the roadmap | +| [`facts/`](facts/) | Durable reference: how Kubernetes behaves, and what we discovered about it. | yes, as reference | +| [`finished/`](finished/) | **This happened.** Shipped plans, closed investigations. Kept for context. | **no** | + +The rule that was missing before: `design/` used to hold shipped work and +`finished/` used to hold live contracts. If you are adding a document, pick the +folder by **lifecycle**, not by topic. + +## If you are new: read these five + +1. [`../README.md`](../README.md) — what the product does. +2. [`architecture.md`](architecture.md) — how the operator is put together. +3. [`spec/manifest-system.md`](spec/manifest-system.md) — **how a live object + becomes a line in a Git file.** The single best explanation of the core. +4. [`spec/current-manifest-support-review.md`](spec/current-manifest-support-review.md) + — the manifest store's contract, and the rules that must never break. +5. [`design/gitops-api/README.md`](design/gitops-api/README.md) — what is being + built now, and the feature ladder. + +## The contracts — [`spec/`](spec/) + +The code cites these. Breaking one without updating it is how the next person gets +misled. Full list in [`spec/README.md`](spec/README.md); the ones that carry a +*rule* rather than a description: + +| Spec | The rule | +|---|---| +| [`manifest-system.md`](spec/manifest-system.md) | the whole live → Git pipeline, and every invariant below in summary | +| [`current-manifest-support-review.md`](spec/current-manifest-support-review.md) | all-or-nothing folder claim; never half-write a multi-doc file; **refuse rather than prune** | +| [`manifestedit-field-ownership-spike.md`](spec/manifestedit-field-ownership-spike.md) | the API wins — full-object ownership, never field-subset | +| [`reconcile-via-watchlist-mark-and-sweep.md`](spec/reconcile-via-watchlist-mark-and-sweep.md) | **no bookmark, no sweep** | +| [`contextual-namespace-and-kustomize-folder-editing.md`](spec/contextual-namespace-and-kustomize-folder-editing.md) | kustomize namespace inference; the supported subset | +| [`gittarget-new-file-placement-rules.md`](spec/gittarget-new-file-placement-rules.md) | where a new resource's file goes (F4) | +| [`sops-single-file-no-multidoc.md`](spec/sops-single-file-no-multidoc.md) | one encrypted file is one document | +| [`scale-subresource-audit-rehydration.md`](spec/scale-subresource-audit-rehydration.md) | `/scale` only; every other subresource ignored | +| [`commit-window-refactor.md`](spec/commit-window-refactor.md) | one grouped commit = one (author, GitTarget) | +| [`gittarget-isolation-on-rule-change.md`](spec/gittarget-isolation-on-rule-change.md) | a rule change on target A never touches target B | +| [`audit-readiness-probe-plan.md`](spec/audit-readiness-probe-plan.md) | liveness must never depend on Redis | +| [`type-followability.md`](spec/type-followability.md) | is a type followable, and if not, the one reason | +| [`gitpath-foreign-content-stringency.md`](spec/gitpath-foreign-content-stringency.md) | refusing a path that shadows foreign content | +| [`unsupported-folder-refusal-plan.md`](spec/unsupported-folder-refusal-plan.md) | `GitPathAccepted`, and refusing what we cannot own | +| [`commitrequest-design.md`](spec/commitrequest-design.md) | the CommitRequest window and its conditions | +| [`commitrequest-admission-authorship.md`](spec/commitrequest-admission-authorship.md) | how a real Kubernetes user becomes a commit author | +| [`e2e-serial-registry.md`](spec/e2e-serial-registry.md) | which e2e specs must run Serial, and why | + +## What is being decided now — [`design/`](design/) + +**The live workstream** is [`design/gitops-api/`](design/gitops-api/) — editing +existing GitOps folders through the Kubernetes API. Start at its +[README](design/gitops-api/README.md) for the feature ladder (F1–F8), then +[`support-contract.md`](design/gitops-api/support-contract.md) — **the single page that +says what we support and refuse**. + +Nine other open items: + +| Doc | Open question | +|---|---| +| [`watch-and-catalog-architecture.md`](design/watch-and-catalog-architecture.md) | the target three-layer watch model — **needs a human call before building** | +| [`metrics-observability-plan.md`](design/metrics-observability-plan.md) | the watch-stage metrics do not exist yet | +| [`reconcile-triggering.md`](design/reconcile-triggering.md) | which controllers still fail to wake up | +| [`multi-cluster-audit-ingestion-implications.md`](design/multi-cluster-audit-ingestion-implications.md) | there is still no CRD for remote cluster connectivity | +| [`release-image-reuse-plan.md`](design/release-image-reuse-plan.md) | PRs 2–5 unstarted | +| [`e2e-coverage-gaps-and-improvements-plan.md`](design/e2e-coverage-gaps-and-improvements-plan.md) | tests A/B/C still proposals | +| [`e2e-finish-plan.md`](design/e2e-finish-plan.md) | remaining e2e harness work | +| [`residual-e2e-flakes-2026-06-19.md`](design/residual-e2e-flakes-2026-06-19.md) | Flake B still open | +| [`sensitive-resource-diagnostics-follow-up.md`](design/sensitive-resource-diagnostics-follow-up.md) | deferred diagnostics | + +## Deferred, but still wanted — [`future/`](future/) + +[`idea-application-editing.md`](future/idea-application-editing.md) is the product +seed of the whole gitops-api workstream and still holds the branch/session +grouping strategies nothing else covers. +[`ha-gittarget-distribution-plan.md`](future/ha-gittarget-distribution-plan.md) is +the HA plan `architecture.md` cites three times (and the reason Redis is required). +[`least-privilege-remaining-work.md`](future/least-privilege-remaining-work.md) has +three open RBAC items. Five more ideas sit beside them. + +## History — [`finished/`](finished/) + +Eighteen shipped plans and closed investigations. **Nothing here binds.** Read one +only when you want to know *why* something is the way it is; the answer to *what it +is* always lives in `spec/`. + +Note that most of the pre-2026-07 audit-pipeline archaeology has been deleted +outright: the watch-first rewrite removed `internal/gate`, the audit joiner, and +the audit-as-state pipeline, so ~30 documents describing them were prose about +code that no longer exists. `git log` has them. diff --git a/docs/README.md b/docs/README.md index 76823f3d..89bb0152 100644 --- a/docs/README.md +++ b/docs/README.md @@ -30,21 +30,24 @@ If you only want the supported product docs, start with the files below. ## Maintainer notes -These directories are useful when changing internals, but they are not the primary user-facing -docs surface: - -- [`design/`](design/): architecture notes, investigations, and implementation plans -- [`finished/`](finished/): design docs and reports for work that has shipped or been resolved, - kept for historical context -- [`ci/`](ci/): CI/devcontainer rationale and troubleshooting -- [`future/`](future/): ideas that are intentionally deferred -- [`audit-setup/`](audit-setup/): cluster-specific audit delivery notes and examples - -These root-level files are also working notes rather than polished user docs: - -- [`TODO.md`](TODO.md) -- `*plan*.md` -- `*analysis*.md` - -If you are cleaning up documentation, that maintainer-notes layer is usually the first place to -trim, archive, or merge. +**Start at [`INDEX.md`](INDEX.md)** — it names the ~35 documents that actually bind, out of the +117 here. Everything else is a user guide (above) or history. + +The maintainer folders are organised by **lifecycle**, not by topic. Pick a folder by asking +"what state is this work in?", never "what is this about?": + +| Folder | Means | Binds? | +|---|---|---| +| [`spec/`](spec/) | **This is true now, and the code depends on it.** Every doc is cited from Go source. Change the behaviour, change the doc. | **yes** | +| [`design/`](design/) | **We are still deciding.** Open questions and unbuilt work. | yes — it is the roadmap | +| [`facts/`](facts/) | Durable reference: how Kubernetes behaves, and what we learned about it. | yes, as reference | +| [`finished/`](finished/) | **This happened.** Shipped plans and closed investigations. | **no** | +| [`future/`](future/) | Deferred ideas we still want. | as intent | +| [`ci/`](ci/) | CI/devcontainer rationale and troubleshooting. | as reference | +| [`audit-setup/`](audit-setup/) | Cluster-specific audit delivery notes. | as reference | + +The one rule that keeps this working: **a document in `spec/` is cited from the code.** If you +move or rename one, fix the citation in the same commit. Not doing that is what made the previous +tree unreadable — 17 citations were pointing at files that no longer existed. + +[`TODO.md`](TODO.md) is a scratch list, not a plan. diff --git a/docs/design/e2e-coverage-gaps-and-improvements-plan.md b/docs/design/e2e-coverage-gaps-and-improvements-plan.md index e609e629..4d876dfd 100644 --- a/docs/design/e2e-coverage-gaps-and-improvements-plan.md +++ b/docs/design/e2e-coverage-gaps-and-improvements-plan.md @@ -1,5 +1,7 @@ # E2E Coverage Gaps & Improvements — plan +> **design** — open, not yet built. Index: [`../INDEX.md`](../INDEX.md) + > Status: PROPOSAL — 2026-06-26. **Architecture-led**: [architecture.md](../architecture.md) is the > spine. This plan reads the current e2e suite against the architecture's load-bearing guarantees, > records where the suite is strong, names the gaps, and proposes a small, prioritized set of new diff --git a/docs/design/e2e-finish-plan.md b/docs/design/e2e-finish-plan.md index c4bd304e..8c830822 100644 --- a/docs/design/e2e-finish-plan.md +++ b/docs/design/e2e-finish-plan.md @@ -1,5 +1,7 @@ # E2E Finish Plan +> **design** — open, not yet built. Index: [`../INDEX.md`](../INDEX.md) + This is the one active plan for the remaining e2e harness work. For current debugging and reuse behavior, see diff --git a/docs/design/gitops-api/README.md b/docs/design/gitops-api/README.md index 15b9f17c..d854cfc0 100644 --- a/docs/design/gitops-api/README.md +++ b/docs/design/gitops-api/README.md @@ -1,18 +1,25 @@ # GitOps API: editing existing GitOps folders as a product surface -> Status: active workstream -> Captured: 2026-07-06 -> Related: -> [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md), -> [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md), -> [resource-capability-model.md](resource-capability-model.md), -> [write-only-encrypted-secrets.md](write-only-encrypted-secrets.md), -> [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md), -> [intent-cluster-hydration.md](intent-cluster-hydration.md), -> [../../future/idea-application-editing.md](../../future/idea-application-editing.md), -> [../manifest/contextual-namespace-and-kustomize-folder-editing.md](../../spec/contextual-namespace-and-kustomize-folder-editing.md), -> [../manifest/file-agnostic-placement.md](../../spec/gittarget-new-file-placement-rules.md), -> [../../finished/current-manifest-support-review.md](../../spec/current-manifest-support-review.md) +> **design** — the active workstream. Captured 2026-07-06. +> +> **New here? Read [support-contract.md](support-contract.md) first** — it is the one +> page that says what we support, what we refuse, and why. This README is the *plan* +> (the feature ladder); that one is the *boundary*. + +## The folder, by topic + +| Topic | Docs | +|---|---| +| **The boundary** | [support-contract.md](support-contract.md) — the single statement · [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md) — field taxonomy + layout allowlist · [gittarget-granularity-and-cross-environment-edits.md](gittarget-granularity-and-cross-environment-edits.md) — **the write boundary; the one home of fan-in = 1** | +| **Orchestrators & expansion** | [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md) — renderability vs ownership; claims about paths · [expansion-boundary-and-corpus-organisation.md](expansion-boundary-and-corpus-organisation.md) — provenance; ApplicationSet vs ResourceSet; Helm · [argocd-bi-directional.md](argocd-bi-directional.md) — why `selfHeal` is incompatible | +| **Documents & secrets** | [resource-capability-model.md](resource-capability-model.md) — what may I do to this document · [write-only-encrypted-secrets.md](write-only-encrypted-secrets.md) — SOPS · [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md) | +| **Topology** | [intent-cluster-hydration.md](intent-cluster-hydration.md) — how objects get into the cluster to be edited | +| **Edits with no home** | [unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md) | +| **Onboarding** | [f8-repo-discovery-and-onboarding-scan.md](f8-repo-discovery-and-onboarding-scan.md) | +| **Shipped** | [finished/f1-images-replicas-edit-through.md](finished/f1-images-replicas-edit-through.md) · [finished/f7-higher-level-krm-documents.md](finished/f7-higher-level-krm-documents.md) | +| **Evidence** | [`test/fixtures/gitops-layouts/`](../../../test/fixtures/gitops-layouts/) — the corpus of real-world repo shapes | +| **Origin** | [../../future/idea-application-editing.md](../../future/idea-application-editing.md) — the product seed | +| **Foundations** | [current-manifest-support-review.md](../../spec/current-manifest-support-review.md) · [contextual-namespace-and-kustomize-folder-editing.md](../../spec/contextual-namespace-and-kustomize-folder-editing.md) · [gittarget-new-file-placement-rules.md](../../spec/gittarget-new-file-placement-rules.md) | ## Goal diff --git a/docs/design/gitops-api/intent-cluster-hydration.md b/docs/design/gitops-api/intent-cluster-hydration.md index 08a1ccf3..f0ff9d1f 100644 --- a/docs/design/gitops-api/intent-cluster-hydration.md +++ b/docs/design/gitops-api/intent-cluster-hydration.md @@ -119,25 +119,25 @@ whenever the applier cannot decrypt. Flux's answer, when it *is* the real cluster, is `spec.decryption` with the private age identity, and that path is exercised in the bi-directional e2e above. The question that matters here is what happens in a cluster that deliberately -holds **no** key. There, the document is applied as written, and verified against -a real API server (Kubernetes v1.36, `kubectl apply --dry-run=server`): - -| Document | Result | -|---|---| -| `Secret` with `data:` holding `ENC[AES256_GCM,...]` | `BadRequest: illegal base64 data at input byte 3` | -| …the same, with validation disabled | **same error** | -| `Secret` with valid base64 plus a top-level `sops:` field | `BadRequest: strict decoding error: unknown field "sops"` | -| …the same, with validation disabled | created, `sops:` silently dropped | -| `Secret` with `stringData:` ciphertext, validation disabled | created, value stored as the literal text `ENC[AES256_GCM,...]` | - -The first two rows are the load-bearing ones. `data` is typed as base64 bytes, so -the failure happens at **deserialization**, before validation. No amount of -lenient decoding rescues it. Any applier — `kubectl`, Argo CD, Flux's -kustomize-controller — hits the same wall. - -The last row is the nightmare: a lenient applier stores the ciphertext *as the -value*, and an application reads its password as the literal string -`ENC[AES256_GCM,...]`. Nothing errors. **Any hydrator must use strict decoding.** +holds **no** key. There, the document is applied as written — and it does not +survive contact with a real API server. + +> The evidence (a `kubectl apply --dry-run=server` matrix against Kubernetes +> v1.36) lives once, in +> [resource-capability-model.md § The evidence](resource-capability-model.md). +> It is not repeated here. + +Two of its rows drive everything below: + +- A `Secret` whose `data:` holds `ENC[AES256_GCM,...]` fails with + `illegal base64 data`, **even with validation disabled** — `data` is typed as + base64 bytes, so the failure happens at *deserialization*, before validation. No + lenient decoding rescues it, and every applier — `kubectl`, Argo CD, Flux's + kustomize-controller — hits the same wall. +- With validation disabled, a `stringData:` ciphertext **is created**, storing the + value as the literal text `ENC[AES256_GCM,...]`. An application then reads its + password as that string, and nothing errors anywhere. **Any hydrator must use + strict decoding.** ### Flux is kinder than the API server, and says so diff --git a/docs/design/gitops-api/kustomize-support-boundary-and-product-model.md b/docs/design/gitops-api/kustomize-support-boundary-and-product-model.md index cf7ca90f..ed47e85a 100644 --- a/docs/design/gitops-api/kustomize-support-boundary-and-product-model.md +++ b/docs/design/gitops-api/kustomize-support-boundary-and-product-model.md @@ -151,6 +151,14 @@ the minimal expression of the change **in the right variant**." > root.** (Write fan-in = 1. Base files and shared components are read-only > context, always.) +> **This rule has one home:** +> [gittarget-granularity-and-cross-environment-edits.md §1](gittarget-granularity-and-cross-environment-edits.md) +> specifies it as the two-layer write boundary (L1 filesystem jail, L2 fan-in = 1) +> and names its enforcement — a write-plan precondition that aborts the whole flush +> and fails the GitTarget with `GitPathAccepted=False` / `WriteBoundaryRefused`. +> The paragraph above states the rule; it does not redefine it. If the two ever +> disagree, §1 wins. + This single sentence: - makes "operator edits base" structurally impossible — nothing observed in diff --git a/docs/design/gitops-api/support-contract.md b/docs/design/gitops-api/support-contract.md new file mode 100644 index 00000000..e46d3eef --- /dev/null +++ b/docs/design/gitops-api/support-contract.md @@ -0,0 +1,138 @@ +# The support contract: what we edit, what we refuse, and why + +> **design** — the single statement of the boundary. Index: [`../../INDEX.md`](../../INDEX.md) +> +> Status: the front door for this workstream. Captured 2026-07-11. +> Every other doc in this folder argues *for* one of the verdicts below; this page +> only states them. If a claim here and a claim there disagree, this page is wrong +> and should be fixed — the boundary has one home now. + +## The contract, in one sentence + +> **GitOps Reverser edits the intent layer. It never edits the expansion layer.** + +Every GitOps repository has an **intent layer** — the documents a human authored +and committed — and an **expansion layer** — the objects a controller derived from +them. We mirror and edit the intent layer, because that is the layer with a home in +Git and the layer a careful human would edit anyway. We refuse the expansion layer, +because expansion is a one-way function and its output has nowhere to go. + +That refusal is **the product's defensible support contract, not a gap.** + +## The three questions we ask + +An edit must survive all three. They are independent, and each has its own design +doc. + +| # | Question | Failure if we get it wrong | Where it is argued | +|---|---|---|---| +| 1 | **Is it KRM, and may I read/write it?** | we corrupt a document we did not understand | [resource-capability-model.md](resource-capability-model.md) | +| 2 | **Can this edit be written back to exactly one document?** | we cannot express the change, or we change more than one thing | [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md), [gittarget-granularity-and-cross-environment-edits.md §1](gittarget-granularity-and-cross-environment-edits.md) | +| 3 | **Does that document already have another writer — and does this object even have a home in Git?** | we destroy someone else's invariant, or invent a second source of truth | [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md), [expansion-boundary-and-corpus-organisation.md](expansion-boundary-and-corpus-organisation.md) | + +**The governing rule of question 2 is fan-in = 1: we never change more than one +thing.** An edit may be written to a document only if exactly one live object +derives from it. That single rule refuses shared kustomize bases, ApplicationSet +templates, and multi-input ResourceSet templates alike. It is specified once, in +[gittarget-granularity-and-cross-environment-edits.md §1](gittarget-granularity-and-cross-environment-edits.md) +(the two-layer write boundary, L1/L2); everywhere else it is quoted, not redefined. + +## The five verdicts + +| Verdict | Meaning | +|---|---| +| **Editable** | We mirror it and write edits back to its file. | +| **Read-only context** | We read it to understand the folder; we never write it. | +| **Not mirrored** | It exists live, but a controller synthesised it and Git has no home for it. | +| **Refused** | The folder cannot be written safely. We say why, and fail the target. | +| **Write-only** | We can describe and replace it, but never read it (SOPS). | + +## Delivery and orchestration + +| Construct | Layer | Verdict | Why | +|---|---|---|---| +| Plain KRM folder | intent | **Editable** | the files *are* the objects — the first-class target | +| Argo CD `Application` (hand-written) | intent | **Editable** | ordinary KRM | +| Argo CD `Application` generated by an `ApplicationSet` | expansion | **Not mirrored** | carries an `ownerReference`; no home file | +| Argo CD `ApplicationSet` (the CR) | intent | **Editable as a document** | but its `template` has fan-in N — see below | +| App-of-apps root `Application` | intent | Editable, flagged **cluster entry point** | not an onboarding answer | +| Flux `Kustomization`, `GitRepository`, `OCIRepository`, `HelmRepository` | intent | **Editable** | ordinary KRM | +| Flux `HelmRelease` | intent | **Editable** | shipped (F7) | +| Objects the helm-controller renders from it | expansion | **Not mirrored** | no home file | +| flux-operator `ResourceSet` (the CR) | intent | **Editable as a document** | `spec.inputs` is the supported edit surface | +| Objects a `ResourceSet` expands | expansion | **Not mirrored** | `spec.resources` × inputs; no home file | +| flux-operator `ResourceSetInputProvider` | intent | **Editable** | but `status.exportedInputs` is live-only and unwritable | +| flux-operator `FluxInstance` | intent | Editable, flagged **cluster entry point** | it manages Flux itself | +| KRO `ResourceGraphDefinition`, Crossplane `Composition` + claims | intent | **Editable** | ordinary KRM | +| Objects they expand | expansion | **Not mirrored** | no home file | + +## Rendering + +| Construct | Verdict | Why | +|---|---|---| +| kustomize `resources`, `namespace`, `images`, `replicas` | **Editable** | invertible; F1 ships `images`/`replicas` edit-through | +| kustomize base + un-fancy overlays | **Editable at launch (F2)** | the base stays read-only context | +| kustomize base shared by >1 overlay, edited in place | **Refused** | fan-in > 1 | +| kustomize `patches*`, generators, `components`, `namePrefix`/`nameSuffix`, remote bases | **Refused** | non-invertible; F3 would author patches | +| kustomize `helmCharts:` (inflation) | **Refused** | we never render a chart | +| A Helm chart (`Chart.yaml` + `templates/` + `values.yaml` + `crds/`) | **Skipped as a unit** | detected by folder structure and reported as a `helm-chart` layout, not as silence plus an incidental `crds/` | +| Helm knobs on a `HelmRelease` / `Application` (chart version, inline values, parameters) | **Editable** | the Helm surface people actually use — see below | +| Free-standing Helm values file (`values/production.yaml`) | **Refused today** | not KRM; a `ValuesFile` projection is proposed | +| CI-rendered `rendered/` output | **Refused** | the next render destroys the edit | + +## Machine-written Git, and secrets + +| Construct | Verdict | Why | +|---|---|---| +| A path written by Flux `ImageUpdateAutomation` | **Refused** | a bot commits here; `$imagepolicy` comments are load-bearing | +| `.argocd-source*.yaml` (Argo CD Image Updater) | **Refused / read-only** | written by a bot, and it outranks the config a reader would inspect | +| SOPS `Secret` | **Write-only** | not schema-conformant; the `mac` binds the whole document | +| `SealedSecret` | **Editable** | ordinary KRM; each value sealed independently | +| `ExternalSecret` | **Editable** | ordinary KRM; the value simply lives elsewhere | +| `Secret` derived by ESO / sealed-secrets | expansion → **Not mirrored** | carries an `ownerReference` | + +## What "we do not do Helm" gets wrong + +We already do more Helm than that sentence admits, and the honest headline is: + +> **We support Helm the way GitOps repositories actually use it — as a declaration +> you edit, not a chart you render.** + +The most common Helm operations in a GitOps repo are *bump the chart version* and +*change a value on a `HelmRelease`*, and both have worked since F7. What stays +refused, permanently and correctly, is **chart inflation**: we never render +`templates/`, and we never learn what a value means. + +The one genuine gap is the **free-standing values file**, which is not KRM and so +has no object for a user to edit. The proposed fix reuses the +[`EncryptedSecret`](write-only-encrypted-secrets.md) trick — project it into a kind +we can store — and is argued in +[expansion-boundary-and-corpus-organisation.md](expansion-boundary-and-corpus-organisation.md). + +## What we will not do + +- **No orchestrator emulation.** We do not run kustomize on a remote base, resolve + a Helm chart, evaluate an ApplicationSet generator or a ResourceSet template, + decrypt SOPS, or contact a registry. +- **No Argo CD or Flux Go dependency.** Their kinds are matched by group and kind + over `unstructured`; the upstream checkouts under `external-sources/` are + reference material, never vendored code. +- **We never widen the boundary by guessing.** Ownership and provenance only ever + *refuse more*. Everything refused for renderability stays refused. + +## Where the arguments live + +| Doc | What it settles | +|---|---| +| [README.md](README.md) | the feature ladder F1–F8, and the launch path | +| [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md) | the kustomization field taxonomy and the supported-layout allowlist | +| [gittarget-granularity-and-cross-environment-edits.md](gittarget-granularity-and-cross-environment-edits.md) | **the write boundary (L1/L2) — the one home of fan-in = 1** | +| [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md) | where Flux/Argo knowledge lives: claims about paths, not a dependency | +| [expansion-boundary-and-corpus-organisation.md](expansion-boundary-and-corpus-organisation.md) | the provenance axis; ApplicationSet vs ResourceSet; the Helm surface | +| [resource-capability-model.md](resource-capability-model.md) | what may I do to *this document* (schema conformance, visibility, write unit) | +| [write-only-encrypted-secrets.md](write-only-encrypted-secrets.md) | SOPS: describe the ciphertext, never read it | +| [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md) | why neither needs a new kind, and the derived-object gate | +| [intent-cluster-hydration.md](intent-cluster-hydration.md) | how the objects get into the cluster to be edited at all | +| [unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md) | what happens to an edit with no legal destination | +| [f8-repo-discovery-and-onboarding-scan.md](f8-repo-discovery-and-onboarding-scan.md) | reporting all of this over a whole repository | +| [`test/fixtures/gitops-layouts/`](../../../test/fixtures/gitops-layouts/) | the corpus of real-world shapes every verdict is checked against | diff --git a/docs/design/metrics-observability-plan.md b/docs/design/metrics-observability-plan.md index 31a1cc9a..067a9100 100644 --- a/docs/design/metrics-observability-plan.md +++ b/docs/design/metrics-observability-plan.md @@ -1,5 +1,7 @@ # Metrics & Audit Observability — improvement plan +> **design** — open, not yet built. Index: [`../INDEX.md`](../INDEX.md) + > Status: PROPOSAL — 2026-06-26. **Architecture-led**: [architecture.md](../architecture.md) is the > spine; every metric below maps to a stage in > [Common Flows](../architecture.md#common-flows). The live baseline and the diff --git a/docs/design/multi-cluster-audit-ingestion-implications.md b/docs/design/multi-cluster-audit-ingestion-implications.md index afea4d71..b104b0e8 100644 --- a/docs/design/multi-cluster-audit-ingestion-implications.md +++ b/docs/design/multi-cluster-audit-ingestion-implications.md @@ -1,5 +1,7 @@ # Multi-Cluster Audit Ingestion: Implications and Configuration Mapping +> **design** — open, not yet built. Index: [`../INDEX.md`](../INDEX.md) + ## 1. Purpose This document describes what changes are implied by supporting audit ingestion from multiple clusters, how this maps to diff --git a/docs/design/reconcile-triggering.md b/docs/design/reconcile-triggering.md index 7cf39fcd..55977c2c 100644 --- a/docs/design/reconcile-triggering.md +++ b/docs/design/reconcile-triggering.md @@ -9,6 +9,8 @@ related: # Reconcile triggering — how our controllers wake up +> **design** — open, not yet built. Index: [`../INDEX.md`](../INDEX.md) + A controller is only as good as the events that wake it. Periodic requeue is a **safety net**, not a mechanism: if state changes and nothing enqueues the owner, the change is invisible until the next periodic tick — up to 10 minutes here. This diff --git a/docs/design/release-image-reuse-plan.md b/docs/design/release-image-reuse-plan.md index aa87add5..8d31ece7 100644 --- a/docs/design/release-image-reuse-plan.md +++ b/docs/design/release-image-reuse-plan.md @@ -1,5 +1,7 @@ # Plan: build release images once on main, retag at release +> **design** — open, not yet built. Index: [`../INDEX.md`](../INDEX.md) + Status: **PR 1 (§8 core) MERGED to `main`** — squash-merged 2026-07-03 as [#190], commit `2b3a949`. PRs 2–5 remain unstarted follow-ups. No real release has exercised the retag path yet as of this writing (an open diff --git a/docs/design/residual-e2e-flakes-2026-06-19.md b/docs/design/residual-e2e-flakes-2026-06-19.md index 4b45443b..3b127c53 100644 --- a/docs/design/residual-e2e-flakes-2026-06-19.md +++ b/docs/design/residual-e2e-flakes-2026-06-19.md @@ -1,5 +1,7 @@ # Residual e2e flakes after the first-event-loss fix (2026-06-19) +> **design** — open, not yet built. Index: [`../INDEX.md`](../INDEX.md) + Status: ACTIVE FOR FLAKE B; FLAKE A CLOSED BY THE 2026-06-20 ATTRIBUTION FIX. After the capture-before-baseline fix (`first-event-loss-on-reclaim-plan.md`, committed in `5d85e7d`), diff --git a/docs/design/sensitive-resource-diagnostics-follow-up.md b/docs/design/sensitive-resource-diagnostics-follow-up.md index 53f1c6fe..ab8e1f14 100644 --- a/docs/design/sensitive-resource-diagnostics-follow-up.md +++ b/docs/design/sensitive-resource-diagnostics-follow-up.md @@ -1,5 +1,7 @@ # Follow-up: Sensitive Resource Diagnostics +> **design** — open, not yet built. Index: [`../INDEX.md`](../INDEX.md) + This follow-up builds on [sensitive-resource-classification-plan.md](../finished/sensitive-resource-classification-plan.md). The first increment only adds explicit startup classification to the Git write diff --git a/docs/design/watch-and-catalog-architecture.md b/docs/design/watch-and-catalog-architecture.md index 3ec4919e..5b756930 100644 --- a/docs/design/watch-and-catalog-architecture.md +++ b/docs/design/watch-and-catalog-architecture.md @@ -1,5 +1,7 @@ # Watch & Catalog Architecture — Requirements, Current State, Target Design +> **design** — open, not yet built. Index: [`../INDEX.md`](../INDEX.md) + Status: **vision / proposed** — supersedes the framing in [watchrule-wildcard-support-plan.md](../spec/type-followability.md), [watchrule-wildcard-and-resolution-semantics.md](../spec/type-followability.md), diff --git a/docs/facts/audit-webhook-api-server-connectivity.md b/docs/facts/audit-webhook-api-server-connectivity.md index 3618e87a..648b62f0 100644 --- a/docs/facts/audit-webhook-api-server-connectivity.md +++ b/docs/facts/audit-webhook-api-server-connectivity.md @@ -1,5 +1,7 @@ # Audit Webhook API Server Connectivity +> **reference** — durable background. Index: [`../INDEX.md`](../INDEX.md) + GitOps Reverser relies on the Kubernetes [audit webhook backend](https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/#webhook-backend): the kube-apiserver POSTs audit events to an HTTPS endpoint using a kubeconfig file written on the control-plane node(s). This works best on clusters you fully control — k3s, k3d, Talos, Kamaji. Managed platforms (EKS, GKE, AKS) restrict access to apiserver configuration; running on them requires switching to a self-managed control plane or a platform that does expose it. ## The problem diff --git a/docs/facts/generated-name-support.md b/docs/facts/generated-name-support.md index 55df0dc9..e75c723d 100644 --- a/docs/facts/generated-name-support.md +++ b/docs/facts/generated-name-support.md @@ -1,5 +1,7 @@ # Kubernetes `generateName` and audit identity facts +> **reference** — durable background. Index: [`../INDEX.md`](../INDEX.md) + This note records the Kubernetes API behavior relevant to resources created with `metadata.generateName`, especially when the create request is consumed from Kubernetes audit events. diff --git a/docs/facts/kubernetes-apf-and-inflight-tuning.md b/docs/facts/kubernetes-apf-and-inflight-tuning.md index 58e89aa5..d558d0f6 100644 --- a/docs/facts/kubernetes-apf-and-inflight-tuning.md +++ b/docs/facts/kubernetes-apf-and-inflight-tuning.md @@ -1,5 +1,7 @@ # Kubernetes API Priority and Fairness — and How to Tune It for High Concurrency +> **reference** — durable background. Index: [`../INDEX.md`](../INDEX.md) + When you throw a sudden burst of requests at a Kubernetes API server — say, 300 clients all authenticating simultaneously — it doesn't just pass everything through. It applies a two-layer traffic control system: a hard concurrency ceiling called **max-requests-inflight**, and a sophisticated queuing layer called **API Priority and Fairness (APF)**. Understanding both is the key to making high-concurrency workloads reliable without adding more hardware. --- diff --git a/docs/facts/kubernetes-api-discovery.md b/docs/facts/kubernetes-api-discovery.md index 5ef8d888..22786566 100644 --- a/docs/facts/kubernetes-api-discovery.md +++ b/docs/facts/kubernetes-api-discovery.md @@ -1,5 +1,7 @@ # Kubernetes API Discovery and Watching in GitOps Reverser +> **reference** — durable background. Index: [`../INDEX.md`](../INDEX.md) + This document explains how GitOps Reverser decides what it can watch, and gives Kubernetes API background for learning. diff --git a/docs/facts/kubernetes-api-resource-catalog.md b/docs/facts/kubernetes-api-resource-catalog.md index 296cb237..b9d439c3 100644 --- a/docs/facts/kubernetes-api-resource-catalog.md +++ b/docs/facts/kubernetes-api-resource-catalog.md @@ -1,5 +1,7 @@ # Kubernetes API Resource Catalog for GitOps Reverser +> **reference** — durable background. Index: [`../INDEX.md`](../INDEX.md) + ## Purpose GitOps Reverser needs to know which Kubernetes resource types the API server diff --git a/docs/facts/resource-types.md b/docs/facts/resource-types.md index 77800512..4512089b 100644 --- a/docs/facts/resource-types.md +++ b/docs/facts/resource-types.md @@ -1,3 +1,5 @@ +> **reference** — durable background. Index: [`../INDEX.md`](../INDEX.md) + schemaVersion: 1 kind: KubernetesResourceTypeFacts title: Kubernetes resource type read API facts diff --git a/docs/facts/resource-versions.md b/docs/facts/resource-versions.md index 75445a36..dbb1481b 100644 --- a/docs/facts/resource-versions.md +++ b/docs/facts/resource-versions.md @@ -1,5 +1,7 @@ # Fact: Kubernetes resourceVersion semantics +> **reference** — durable background. Index: [`../INDEX.md`](../INDEX.md) + Reference: [Kubernetes API concepts — resource versions](https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions) This is a standing reference for how GitOps Reverser may and may not rely on diff --git a/docs/facts/subresources.md b/docs/facts/subresources.md index 197e0303..c7f8dcf8 100644 --- a/docs/facts/subresources.md +++ b/docs/facts/subresources.md @@ -1,5 +1,7 @@ # Kubernetes Subresources +> **reference** — durable background. Index: [`../INDEX.md`](../INDEX.md) + A factual reference on what subresources are in the Kubernetes API, which ones exist, how they behave, and how `configbutler.ai` resources use them. diff --git a/docs/facts/watch-event-ordering-and-attribution-grace.md b/docs/facts/watch-event-ordering-and-attribution-grace.md index 76bb1a4a..5e07040f 100644 --- a/docs/facts/watch-event-ordering-and-attribution-grace.md +++ b/docs/facts/watch-event-ordering-and-attribution-grace.md @@ -1,5 +1,7 @@ # Watch event ordering under the attribution grace window +> **reference** — durable background. Index: [`../INDEX.md`](../INDEX.md) + > Status: **explainer / decision record** > Date: 2026-06-26 > Related: [Watch-first ingestion architecture](../finished/watch-first-ingestion-architecture.md), diff --git a/docs/finished/audit-webhook-tls-design.md b/docs/finished/audit-webhook-tls-design.md index f760eb39..6cda5d85 100644 --- a/docs/finished/audit-webhook-tls-design.md +++ b/docs/finished/audit-webhook-tls-design.md @@ -1,5 +1,7 @@ # Audit Webhook TLS Design +> **finished** — shipped or closed. Kept for context only; **nothing here binds**. For current behaviour see [`../spec/`](../spec/). Index: [`../INDEX.md`](../INDEX.md) + ## The two operator questions This design needs to answer two practical questions before anything else: diff --git a/docs/design/documentation-triage.md b/docs/finished/documentation-triage.md similarity index 94% rename from docs/design/documentation-triage.md rename to docs/finished/documentation-triage.md index 384a1bc2..f39f37ef 100644 --- a/docs/design/documentation-triage.md +++ b/docs/finished/documentation-triage.md @@ -1,8 +1,14 @@ # Documentation triage: what binds, what is history, what to do -> Status: proposal; no files moved yet. -> Captured: 2026-07-11 -> Scope: all 180 markdown files under `docs/` (~55,000 lines). +> **finished** — this plan was executed on 2026-07-11. Kept as the record of *why* the +> tree looks the way it does. For what to read now, see [`../INDEX.md`](../INDEX.md). +> +> Outcome: 180 documents -> 117. `docs/spec/` created (25 docs the code depends on), +> `docs/design/manifest/` deleted (19 -> 1 summary + 4 promoted specs), ~50 dead documents +> removed, and every dangling citation repaired — including the 17 that were already broken +> before this started. +> +> Scope as surveyed: all 180 markdown files under `docs/` (~55,000 lines). ## The headline @@ -79,7 +85,7 @@ works *today* or what is being decided *now*. ### The live workstream (13) — `docs/design/gitops-api/` All of it. This is the branch you are on. My separate proposal -([expansion-boundary-and-corpus-organisation.md](gitops-api/expansion-boundary-and-corpus-organisation.md)) +([expansion-boundary-and-corpus-organisation.md](../design/gitops-api/expansion-boundary-and-corpus-organisation.md)) recommends adding a `support-contract.md` front door and folding four restatements of the fan-in rule into one. @@ -241,7 +247,7 @@ facts first (noted above). Git keeps everything; nothing is lost that a ### Phase 5 — the gitops-api consolidation Separately proposed in -[expansion-boundary-and-corpus-organisation.md](gitops-api/expansion-boundary-and-corpus-organisation.md): +[expansion-boundary-and-corpus-organisation.md](../design/gitops-api/expansion-boundary-and-corpus-organisation.md): add a `support-contract.md` front door, fold the four restatements of the fan-in invariant into one, and de-duplicate the `--dry-run=server` evidence table. diff --git a/docs/finished/e2e-aggregated-apiserver-test-design.md b/docs/finished/e2e-aggregated-apiserver-test-design.md index 0e8aefc7..0ce30724 100644 --- a/docs/finished/e2e-aggregated-apiserver-test-design.md +++ b/docs/finished/e2e-aggregated-apiserver-test-design.md @@ -1,5 +1,7 @@ # E2E Test Design: Aggregated API Server (Extension API Server) +> **finished** — shipped or closed. Kept for context only; **nothing here binds**. For current behaviour see [`../spec/`](../spec/). Index: [`../INDEX.md`](../INDEX.md) + > Last updated: April 2026 ## Motivation diff --git a/docs/finished/e2e-ci-runner-sharding-plan.md b/docs/finished/e2e-ci-runner-sharding-plan.md index c878ac11..30ddcf9a 100644 --- a/docs/finished/e2e-ci-runner-sharding-plan.md +++ b/docs/finished/e2e-ci-runner-sharding-plan.md @@ -1,5 +1,7 @@ # E2E CI Runner Sharding Plan +> **finished** — shipped or closed. Kept for context only; **nothing here binds**. For current behaviour see [`../spec/`](../spec/). Index: [`../INDEX.md`](../INDEX.md) + ## Question We are now allowed **up to 20 concurrent GitHub-hosted runners** (previously this diff --git a/docs/finished/e2e-signing-followups.md b/docs/finished/e2e-signing-followups.md index 976e1955..02753f85 100644 --- a/docs/finished/e2e-signing-followups.md +++ b/docs/finished/e2e-signing-followups.md @@ -1,5 +1,7 @@ # E2E Signing Overview +> **finished** — shipped or closed. Kept for context only; **nothing here binds**. For current behaviour see [`../spec/`](../spec/). Index: [`../INDEX.md`](../INDEX.md) + This document is the short status summary for the e2e signing work. ## What The Signing Suite Proves diff --git a/docs/finished/e2e-speedup-plan.md b/docs/finished/e2e-speedup-plan.md index 8b1c2cec..dd764237 100644 --- a/docs/finished/e2e-speedup-plan.md +++ b/docs/finished/e2e-speedup-plan.md @@ -1,5 +1,7 @@ # E2E Speedup Plan +> **finished** — shipped or closed. Kept for context only; **nothing here binds**. For current behaviour see [`../spec/`](../spec/). Index: [`../INDEX.md`](../INDEX.md) + Make `task test-e2e*` faster for the three audiences that pay the cost: local devs, AI agents, and CI. Phases 0–3 below have **shipped**; this doc keeps the baseline, the outcomes, and the rationale for what was deliberately *not* done. diff --git a/docs/finished/git-credentials-interop.md b/docs/finished/git-credentials-interop.md index 69da1ed9..0b6c8bb1 100644 --- a/docs/finished/git-credentials-interop.md +++ b/docs/finished/git-credentials-interop.md @@ -1,5 +1,7 @@ # Git config interop: rollout plan +> **finished** — shipped or closed. Kept for context only; **nothing here binds**. For current behaviour see [`../spec/`](../spec/). Index: [`../INDEX.md`](../INDEX.md) + Status: **this is the plan we execute in one go.** We are pre-1.0 with no existing users, so there are no migration shims, compatibility windows, or deprecation steps — we change the schema and the credentials reader directly and ship them as one change set. The rollout plan section lists the diff --git a/docs/finished/image-refresh-test-design.md b/docs/finished/image-refresh-test-design.md index dab04041..7715ca7c 100644 --- a/docs/finished/image-refresh-test-design.md +++ b/docs/finished/image-refresh-test-design.md @@ -1,5 +1,7 @@ # Image Refresh Test Design +> **finished** — shipped or closed. Kept for context only; **nothing here binds**. For current behaviour see [`../spec/`](../spec/). Index: [`../INDEX.md`](../INDEX.md) + ## What This Tests The Task-driven image-refresh dependency chain is load-bearing infrastructure. When it breaks, diff --git a/docs/finished/redis-key-schema-v3.md b/docs/finished/redis-key-schema-v3.md index 471ad804..3cccc312 100644 --- a/docs/finished/redis-key-schema-v3.md +++ b/docs/finished/redis-key-schema-v3.md @@ -1,5 +1,7 @@ # Redis key schema v3 — author and watch namespaces +> **finished** — shipped or closed. Kept for context only; **nothing here binds**. For current behaviour see [`../spec/`](../spec/). Index: [`../INDEX.md`](../INDEX.md) + > Status: **IMPLEMENTED** — 2026-06-29. The `v2 → v3` key-format bump landed for the live Redis families: > the audit author index, the watch-resume cursor, and the new command-author **store** (storage > mechanics only — the CommitRequest admission/controller rewrite in diff --git a/docs/finished/sensitive-resource-classification-plan.md b/docs/finished/sensitive-resource-classification-plan.md index 70189275..9aea8c28 100644 --- a/docs/finished/sensitive-resource-classification-plan.md +++ b/docs/finished/sensitive-resource-classification-plan.md @@ -1,5 +1,7 @@ # Implementation Plan: Startup Sensitive Resource Classification +> **finished** — shipped or closed. Kept for context only; **nothing here binds**. For current behaviour see [`../spec/`](../spec/). Index: [`../INDEX.md`](../INDEX.md) + Tracks [#147](https://github.com/ConfigButler/gitops-reverser/issues/147) — support CozyStack's `tenantsecrets.core.cozystack.io` so Secret-shaped custom resources are encrypted before they land in Git. diff --git a/docs/finished/signing-snapshot-tail-replay-failure-investigation.md b/docs/finished/signing-snapshot-tail-replay-failure-investigation.md index 36d111de..8726f72d 100644 --- a/docs/finished/signing-snapshot-tail-replay-failure-investigation.md +++ b/docs/finished/signing-snapshot-tail-replay-failure-investigation.md @@ -1,5 +1,7 @@ # Signing reconcile E2E failure: per-type tail replay creates event commits +> **finished** — shipped or closed. Kept for context only; **nothing here binds**. For current behaviour see [`../spec/`](../spec/). Index: [`../INDEX.md`](../INDEX.md) + > Status: investigation note. The chosen fix is a per-target coverage watermark. > Captured 2026-06-12, refreshed 2026-06-13 after the materialization-healing and > GitTarget status work landed. diff --git a/docs/finished/sops-repo-bootstrap-and-key-management-architecture.md b/docs/finished/sops-repo-bootstrap-and-key-management-architecture.md index 3e396e8a..c1fe912d 100644 --- a/docs/finished/sops-repo-bootstrap-and-key-management-architecture.md +++ b/docs/finished/sops-repo-bootstrap-and-key-management-architecture.md @@ -1,5 +1,7 @@ # SOPS Repo Bootstrap and Key Management Architecture +> **finished** — shipped or closed. Kept for context only; **nothing here binds**. For current behaviour see [`../spec/`](../spec/). Index: [`../INDEX.md`](../INDEX.md) + ## Scope for This Increment This document is intentionally narrow. It defines only what we will implement now. diff --git a/docs/finished/sops-repo-bootstrap-out-of-scope.md b/docs/finished/sops-repo-bootstrap-out-of-scope.md index 1679241d..ac56fef1 100644 --- a/docs/finished/sops-repo-bootstrap-out-of-scope.md +++ b/docs/finished/sops-repo-bootstrap-out-of-scope.md @@ -1,5 +1,7 @@ # SOPS Repo Bootstrap: Out of Scope (Current Increment) +> **finished** — shipped or closed. Kept for context only; **nothing here binds**. For current behaviour see [`../spec/`](../spec/). Index: [`../INDEX.md`](../INDEX.md) + This file tracks explicit non-goals and deferred items, so the main architecture plan stays small and execution-focused. ## Explicitly Not Doing Now diff --git a/docs/finished/startup-robustness-cert-and-crd-wobble.md b/docs/finished/startup-robustness-cert-and-crd-wobble.md index 793bf0fa..07de13cc 100644 --- a/docs/finished/startup-robustness-cert-and-crd-wobble.md +++ b/docs/finished/startup-robustness-cert-and-crd-wobble.md @@ -1,5 +1,7 @@ # Startup robustness: the audit-cert mount race & the CRD-discovery wobble +> **finished** — shipped or closed. Kept for context only; **nothing here binds**. For current behaviour see [`../spec/`](../spec/). Index: [`../INDEX.md`](../INDEX.md) + This document describes two distinct, pre-existing reliability hazards that surface as a single intermittent e2e failure, explains the mechanisms precisely, and sketches candidate fixes with trade-offs. Both are **independent of the api-source-of-truth / R3 work** — they predate it and diff --git a/docs/finished/streaming-readiness-status-machine-design.md b/docs/finished/streaming-readiness-status-machine-design.md index 4d39d94b..e8d5a4a5 100644 --- a/docs/finished/streaming-readiness-status-machine-design.md +++ b/docs/finished/streaming-readiness-status-machine-design.md @@ -1,5 +1,7 @@ # Stream-readiness status machine — design +> **finished** — shipped or closed. Kept for context only; **nothing here binds**. For current behaviour see [`../spec/`](../spec/). Index: [`../INDEX.md`](../INDEX.md) + > Status: design · Branch: `investigate` · Date: 2026-06-26 > > Implements the direction in diff --git a/docs/finished/tilt-playground-plan.md b/docs/finished/tilt-playground-plan.md index 2052d470..865dc94d 100644 --- a/docs/finished/tilt-playground-plan.md +++ b/docs/finished/tilt-playground-plan.md @@ -1,5 +1,7 @@ # Playground Plan +> **finished** — shipped or closed. Kept for context only; **nothing here binds**. For current behaviour see [`../spec/`](../spec/). Index: [`../INDEX.md`](../INDEX.md) + ## Goal Make the local Tilt loop feel like a small, reliable playground for GitOps Reverser: diff --git a/docs/finished/watch-first-ingestion-architecture.md b/docs/finished/watch-first-ingestion-architecture.md index 3f548ccb..42ffa3a8 100644 --- a/docs/finished/watch-first-ingestion-architecture.md +++ b/docs/finished/watch-first-ingestion-architecture.md @@ -1,5 +1,7 @@ # Watch-first ingestion architecture +> **finished** — shipped or closed. Kept for context only; **nothing here binds**. For current behaviour see [`../spec/`](../spec/). Index: [`../INDEX.md`](../INDEX.md) + > Status: **accepted direction — big-bang rewrite** > Date: 2026-06-25 > diff --git a/docs/spec/commit-window-refactor.md b/docs/spec/commit-window-refactor.md index 9a1d66ca..32b89858 100644 --- a/docs/spec/commit-window-refactor.md +++ b/docs/spec/commit-window-refactor.md @@ -1,5 +1,7 @@ # Commit Window And Commit Planning +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + > Status: implemented > Date: 2026-05-01 diff --git a/docs/spec/commitrequest-admission-authorship.md b/docs/spec/commitrequest-admission-authorship.md index ffaa330a..838a8f25 100644 --- a/docs/spec/commitrequest-admission-authorship.md +++ b/docs/spec/commitrequest-admission-authorship.md @@ -13,6 +13,8 @@ related: # CommitRequest authorship from admission +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + > **Thesis.** A `CommitRequest` is a **command** ("save now, as me"), not a piece of > mirrored state. Its author should be captured where the command is issued — a > **validating admission webhook** dedicated to our own command kinds (the diff --git a/docs/spec/commitrequest-multi-finalize-design.md b/docs/spec/commitrequest-multi-finalize-design.md index 3b9ac5f5..792a85e5 100644 --- a/docs/spec/commitrequest-multi-finalize-design.md +++ b/docs/spec/commitrequest-multi-finalize-design.md @@ -1,5 +1,7 @@ # C-B2: per-GitTarget finalize coordinator (Option A design) +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + > Status: **superseded in part — C-B2 LANDED 2026-06-11 in a simpler form; see §12.** > The per-type snapshot analysis (§3) and the ordering invariant (§1) are the parts that > shipped; the coordinator goroutine, the annotation persistence, and the requeue-poll diff --git a/docs/spec/contextual-namespace-and-kustomize-folder-editing.md b/docs/spec/contextual-namespace-and-kustomize-folder-editing.md index bab31df2..30bbbfb1 100644 --- a/docs/spec/contextual-namespace-and-kustomize-folder-editing.md +++ b/docs/spec/contextual-namespace-and-kustomize-folder-editing.md @@ -1,5 +1,7 @@ # Contextual namespace support for real manifest folders +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + > Status: investigation → partially implemented (graph-aware namespace inference and > ambiguity refusal landed in the manifest store; GitTarget-level refusal and > kustomize scoping still pending) diff --git a/docs/spec/current-manifest-support-review.md b/docs/spec/current-manifest-support-review.md index 3926b37b..348840cc 100644 --- a/docs/spec/current-manifest-support-review.md +++ b/docs/spec/current-manifest-support-review.md @@ -1,5 +1,7 @@ # Current Manifest Support Review +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + > Status: architecture review, captured 2026-06-04 > Related: > `implementation-plan.md`, diff --git a/docs/spec/deletecollection-attribution-expander.md b/docs/spec/deletecollection-attribution-expander.md index e9a8faf5..cee3d8f4 100644 --- a/docs/spec/deletecollection-attribution-expander.md +++ b/docs/spec/deletecollection-attribution-expander.md @@ -1,5 +1,7 @@ # DeleteCollection attribution & deletion-as-intent +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + > Status: **IMPLEMENTED** — 2026-06-28 (rev. 2: deletion-as-intent reframe). The render rule (§2), the > expander (§5), the `exact_deletecollection_item` reason code (§8), unit tests (§9.1), and the four e2e > specs (§9.2) have all landed and pass `task lint`/`task test`/`task test-e2e`. diff --git a/docs/spec/e2e-bi-directional-corner.md b/docs/spec/e2e-bi-directional-corner.md index 51536c09..f61b6510 100644 --- a/docs/spec/e2e-bi-directional-corner.md +++ b/docs/spec/e2e-bi-directional-corner.md @@ -1,5 +1,7 @@ # E2E Design: The Bi-Directional Corner (Flux + Argo CD) +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + ## Status Implemented. This document is the design for: diff --git a/docs/spec/e2e-serial-registry.md b/docs/spec/e2e-serial-registry.md index 5b2843a4..e8839a89 100644 --- a/docs/spec/e2e-serial-registry.md +++ b/docs/spec/e2e-serial-registry.md @@ -1,5 +1,7 @@ # E2E Serial Registry +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + This is a **living document**. It is the authoritative list of e2e test containers that must run `Serial` (i.e. never concurrently with any other spec) under bounded Ginkgo parallelism (Phase 2.5 of diff --git a/docs/spec/e2e-test-design.md b/docs/spec/e2e-test-design.md index c2886b9d..9384aac2 100644 --- a/docs/spec/e2e-test-design.md +++ b/docs/spec/e2e-test-design.md @@ -1,5 +1,7 @@ # E2E Test Design +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + ## Overview The e2e tests exercise `gitops-reverser` against a real k3d cluster, real Flux installs, a real Gitea instance, diff --git a/docs/spec/gitpath-foreign-content-stringency.md b/docs/spec/gitpath-foreign-content-stringency.md index f857cee1..9376373e 100644 --- a/docs/spec/gitpath-foreign-content-stringency.md +++ b/docs/spec/gitpath-foreign-content-stringency.md @@ -1,5 +1,7 @@ # GitTarget path stringency — refuse foreign content, own the subtree +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + > Status: IMPLEMENTED — 2026-06-27. The structural foreign-content refusal, the > `.gittargetignore` filter + parse-time denylist, the write-plan invariant (D-foreign-6), the > bootstrap template, and the distinct `IgnoreShadowsManagedPath` status reason have all diff --git a/docs/spec/gittarget-new-file-placement-rules.md b/docs/spec/gittarget-new-file-placement-rules.md index f12ea305..ace85431 100644 --- a/docs/spec/gittarget-new-file-placement-rules.md +++ b/docs/spec/gittarget-new-file-placement-rules.md @@ -1,5 +1,7 @@ # GitTarget new-file placement rules +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + > Status: implemented (F4 v1 — Option B2: one `byType`/`default` placement map, > with sensitivity treated as an internal write-safety classification rather than a > separate user-facing placement namespace) + Option C sibling inference (steps diff --git a/docs/spec/gvk-gvr-mapping-layer.md b/docs/spec/gvk-gvr-mapping-layer.md index afd0d222..7f0e798f 100644 --- a/docs/spec/gvk-gvr-mapping-layer.md +++ b/docs/spec/gvk-gvr-mapping-layer.md @@ -1,5 +1,7 @@ # Manifest GVK/GVR Mapping Layer +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + > Status: design, captured 2026-06-04 > Related: > [current-manifest-support-review.md](current-manifest-support-review.md), diff --git a/docs/spec/manifest-system.md b/docs/spec/manifest-system.md index 64f95465..5fb04c96 100644 --- a/docs/spec/manifest-system.md +++ b/docs/spec/manifest-system.md @@ -1,5 +1,7 @@ # The manifest system: how it works today +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + > Status: reference — describes shipped behaviour. > Captured: 2026-07-11. > Replaces the whole of `docs/design/manifest/`, which was 19 documents of diff --git a/docs/spec/manifestedit-field-ownership-spike.md b/docs/spec/manifestedit-field-ownership-spike.md index 1a0c17ce..3b2fb82a 100644 --- a/docs/spec/manifestedit-field-ownership-spike.md +++ b/docs/spec/manifestedit-field-ownership-spike.md @@ -1,5 +1,7 @@ # Field ownership: the API wins +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + > Status: decided > Related: [manifestedit-abstraction-plan.md](manifest-system.md) > (step 5), [manifest-inventory-file-agnostic-placement.md](manifest-system.md), diff --git a/docs/spec/mutation-capture-lab-design.md b/docs/spec/mutation-capture-lab-design.md index 0cb93ee6..72d6a6f2 100644 --- a/docs/spec/mutation-capture-lab-design.md +++ b/docs/spec/mutation-capture-lab-design.md @@ -1,5 +1,7 @@ # Mutation Capture Lab +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + The mutation-capture lab is a small, standalone application that records the *exact* structures Kubernetes exposes through native **watches**, **audit webhooks**, and **validating admission webhooks** — at every interesting moment — and commits those structures as a normalized, versioned diff --git a/docs/spec/reconcile-via-watchlist-mark-and-sweep.md b/docs/spec/reconcile-via-watchlist-mark-and-sweep.md index 08747406..9db267d9 100644 --- a/docs/spec/reconcile-via-watchlist-mark-and-sweep.md +++ b/docs/spec/reconcile-via-watchlist-mark-and-sweep.md @@ -1,5 +1,7 @@ # Reconcile via WatchList + Mark-and-Sweep +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + > Status: design direction, captured 2026-06-04. > Related: > [current-manifest-support-review.md](current-manifest-support-review.md), diff --git a/docs/spec/scale-subresource-audit-rehydration.md b/docs/spec/scale-subresource-audit-rehydration.md index 2562f8ec..2a7064b5 100644 --- a/docs/spec/scale-subresource-audit-rehydration.md +++ b/docs/spec/scale-subresource-audit-rehydration.md @@ -1,5 +1,7 @@ # Subresource Audit Resolution +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + > Status: design proposal, captured 2026-06-08, revised 2026-06-08. > > Trigger: `kubectl scale deployment` updates the live Deployment through the diff --git a/docs/spec/sops-single-file-no-multidoc.md b/docs/spec/sops-single-file-no-multidoc.md index 08928013..0db751a5 100644 --- a/docs/spec/sops-single-file-no-multidoc.md +++ b/docs/spec/sops-single-file-no-multidoc.md @@ -1,5 +1,7 @@ # SOPS and multi-document YAML: single-file decision +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + > Status: decided > Captured: 2026-06-08 > Related: diff --git a/docs/spec/status-conditions-guide.md b/docs/spec/status-conditions-guide.md index 207527f4..2f6273a8 100644 --- a/docs/spec/status-conditions-guide.md +++ b/docs/spec/status-conditions-guide.md @@ -1,5 +1,7 @@ # KRM Status & Conditions Best Practices +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + Reference: [Superorbital — "Status and Conditions: Explained!"](https://superorbital.io/blog/status-and-conditions/) ## What status is diff --git a/docs/spec/type-followability.md b/docs/spec/type-followability.md index 5e9c887e..f425cf24 100644 --- a/docs/spec/type-followability.md +++ b/docs/spec/type-followability.md @@ -1,5 +1,7 @@ # Type followability model +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + > Status: greenfield proposal, captured 2026-06-08 > > Supersedes the layered model in diff --git a/docs/spec/type-lifecycle-events-and-wobble-settling.md b/docs/spec/type-lifecycle-events-and-wobble-settling.md index f619e762..6194732d 100644 --- a/docs/spec/type-lifecycle-events-and-wobble-settling.md +++ b/docs/spec/type-lifecycle-events-and-wobble-settling.md @@ -1,5 +1,7 @@ # Type lifecycle events, the wobble-settle phase, and consolidation +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + > Status: design direction, captured 2026-06-09. **Implemented 2026-06-09 (M12 first > slices):** Proposals 1–2 in [internal/typeset/lifecycle.go](../../internal/typeset/lifecycle.go) > (`LifecycleEvent`/`Observer`/`Subscribe`, `SettleWindow`, settle + flap coalescing in diff --git a/docs/spec/typeset-owns-discovery-grace.md b/docs/spec/typeset-owns-discovery-grace.md index 76f2d6d2..5fd3028d 100644 --- a/docs/spec/typeset-owns-discovery-grace.md +++ b/docs/spec/typeset-owns-discovery-grace.md @@ -1,5 +1,7 @@ # Typeset owns discovery grace: thinning the API-resource catalog +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + **Status: S1–S3 IMPLEMENTED (2026-06-11); S4 open.** As-built deltas from the plan below (all minor, same shape): diff --git a/docs/spec/unsupported-folder-refusal-plan.md b/docs/spec/unsupported-folder-refusal-plan.md index 18b47d54..d719d92d 100644 --- a/docs/spec/unsupported-folder-refusal-plan.md +++ b/docs/spec/unsupported-folder-refusal-plan.md @@ -1,6 +1,10 @@ # Refuse unsupported folder content — design + implementation plan -> Status: PROPOSAL — 2026-06-26, **revised 2026-06-27**. The mechanics (refuse a GitTarget path the +> **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) + +> Status: IMPLEMENTED — shipped as `GitPathAccepted` (internal/git/git_path_refusal.go, +> test/e2e/unsupported_folder_e2e_test.go). Originally written 2026-06-26, revised 2026-06-27; +> the "PROPOSAL" label was stale and was corrected 2026-07-11. The mechanics (refuse a GitTarget path the > operator cannot safely manage) are settled. The **status surface** is reopened: this revision records the > back-and-forth that turned a single overloaded `StreamsReady=Blocked` refusal into a deliberate > two-sided status model, and then — after the `k8s-crd-design-review` skill grew a `kstatus-readiness` From 03c28fc1ea68dc48ae1643ed59da65d34e85e227 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Sat, 11 Jul 2026 19:45:08 +0000 Subject: [PATCH 14/28] docs: make the spec/ folder definition accurate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three documents in spec/ are not cited by path from Go (gvk-gvr-mapping-layer, sops-single-file-no-multidoc, e2e-test-design), so "everything here is cited from Go source" was an overclaim in the very document that defines the folder. They belong in spec/ regardless — each is the only written record of a rule the code still obeys — but the claim now says what is true. Full suite green on the reorg: lint 0 issues, unit tests pass at 75.5% coverage, e2e 54 passed / 0 failed. Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/INDEX.md | 2 +- docs/README.md | 8 ++++---- docs/spec/README.md | 9 +++++++-- 3 files changed, 12 insertions(+), 7 deletions(-) diff --git a/docs/INDEX.md b/docs/INDEX.md index 61060a97..b39c8aec 100644 --- a/docs/INDEX.md +++ b/docs/INDEX.md @@ -10,7 +10,7 @@ those. If a document is not on this page, it is either a user guide (see | Folder | Means | Binds? | |---|---|---| -| [`spec/`](spec/) | **This is true now, and the code depends on it.** Every doc here is cited from Go source. Change the behaviour, change the doc. | **yes** | +| [`spec/`](spec/) | **This is true now, and the code depends on it.** Most are cited by path from Go source. Change the behaviour, change the doc. | **yes** | | [`design/`](design/) | **We are still deciding.** Open questions, proposals, unbuilt work. | yes — it is the roadmap | | [`facts/`](facts/) | Durable reference: how Kubernetes behaves, and what we discovered about it. | yes, as reference | | [`finished/`](finished/) | **This happened.** Shipped plans, closed investigations. Kept for context. | **no** | diff --git a/docs/README.md b/docs/README.md index 89bb0152..050ceb00 100644 --- a/docs/README.md +++ b/docs/README.md @@ -38,7 +38,7 @@ The maintainer folders are organised by **lifecycle**, not by topic. Pick a fold | Folder | Means | Binds? | |---|---|---| -| [`spec/`](spec/) | **This is true now, and the code depends on it.** Every doc is cited from Go source. Change the behaviour, change the doc. | **yes** | +| [`spec/`](spec/) | **This is true now, and the code depends on it.** Most are cited by path from Go source. Change the behaviour, change the doc. | **yes** | | [`design/`](design/) | **We are still deciding.** Open questions and unbuilt work. | yes — it is the roadmap | | [`facts/`](facts/) | Durable reference: how Kubernetes behaves, and what we learned about it. | yes, as reference | | [`finished/`](finished/) | **This happened.** Shipped plans and closed investigations. | **no** | @@ -46,8 +46,8 @@ The maintainer folders are organised by **lifecycle**, not by topic. Pick a fold | [`ci/`](ci/) | CI/devcontainer rationale and troubleshooting. | as reference | | [`audit-setup/`](audit-setup/) | Cluster-specific audit delivery notes. | as reference | -The one rule that keeps this working: **a document in `spec/` is cited from the code.** If you -move or rename one, fix the citation in the same commit. Not doing that is what made the previous -tree unreadable — 17 citations were pointing at files that no longer existed. +The one rule that keeps this working: **most documents in `spec/` are cited by path from the Go +source.** If you move or rename one, fix the citation in the same commit. Not doing that is what +made the previous tree unreadable — 17 citations were pointing at files that no longer existed. [`TODO.md`](TODO.md) is a scratch list, not a plan. diff --git a/docs/spec/README.md b/docs/spec/README.md index b4ef3c4c..f61dd3c2 100644 --- a/docs/spec/README.md +++ b/docs/spec/README.md @@ -8,8 +8,13 @@ Three folders, three meanings. This is the one that binds. | **`spec/`** (here) | **this is true now.** The code implements it and cites it. Change the code, change the doc. | | [`../finished/`](../finished/) | **this happened.** Shipped plans and closed investigations, kept for `git log`-grade context. Nothing here binds. | -Everything in this folder is cited from Go source. If you change one of these -contracts, the citation is how the next person finds out. +Everything in this folder states **current behaviour that the code relies on**, and +most of it is cited by path from Go source — that citation is how the next person +finds out you changed a contract. The handful that are not Go-cited +(`gvk-gvr-mapping-layer`, `sops-single-file-no-multidoc`, `e2e-test-design`) are +here because they are the only written record of a rule the code still obeys. + +If you change one of these behaviours, change the document in the same commit. ## Start here From 60f664cc07c85473d62b3776cb6786cd85e5df0e Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Mon, 13 Jul 2026 06:22:15 +0000 Subject: [PATCH 15/28] chore: cleaning links, and automating checks for dead doc links --- Taskfile-build.yml | 20 ++- api/v1alpha3/gittarget_types.go | 2 +- docs/ci/findings.md | 27 ++- hack/audit-kind-check/ATTEMPT.md | 72 -------- hack/audit-kind-check/audit-policy.yaml | 11 -- hack/audit-kind-check/flunder.yaml | 8 - hack/audit-kind-check/kind-config.yaml | 28 ---- hack/doccheck/main.go | 208 ++++++++++++++++++++++++ internal/git/manifestedit/DECISION.md | 2 +- test/e2e/setup/argocd/README.md | 2 +- test/mutationlab/README.md | 8 +- test/mutationlab/corpus/CLUSTER.md | 2 +- 12 files changed, 261 insertions(+), 129 deletions(-) delete mode 100644 hack/audit-kind-check/ATTEMPT.md delete mode 100644 hack/audit-kind-check/audit-policy.yaml delete mode 100644 hack/audit-kind-check/flunder.yaml delete mode 100644 hack/audit-kind-check/kind-config.yaml create mode 100644 hack/doccheck/main.go diff --git a/Taskfile-build.yml b/Taskfile-build.yml index 8c45281f..a00a8040 100644 --- a/Taskfile-build.yml +++ b/Taskfile-build.yml @@ -195,12 +195,30 @@ tasks: done lint: - desc: Run all linters (Go, Dockerfiles, workflows, Helm chart); deps run in parallel where safe + desc: Run all linters (Go, Dockerfiles, workflows, Helm chart, doc links); deps run in parallel where safe deps: - lint-golang - lint-dockerfiles - lint-actions - lint-helm + - lint-docs + + lint-docs: + desc: Check that every doc reference resolves — markdown links, and docs/**.md cited in Go comments + # Re-run whenever a doc moves or a Go comment changes. Task fingerprints these + # under .task/ and skips the run otherwise. + # + # This exists because nothing off the shelf covers the second surface: markdownlint + # does not check links, and link checkers (lychee, markdown-link-check) extract URLs + # from markdown -- they never look inside a Go comment for a repo-relative doc path. + # Those are the references that rot silently, and seventeen of them were dangling + # before this check was written. + sources: + - '**/*.md' + - '**/*.go' + - hack/doccheck/main.go + cmds: + - go run ./hack/doccheck lint-golang: desc: Run golangci-lint diff --git a/api/v1alpha3/gittarget_types.go b/api/v1alpha3/gittarget_types.go index 5c8c8b4d..9a35572c 100644 --- a/api/v1alpha3/gittarget_types.go +++ b/api/v1alpha3/gittarget_types.go @@ -85,7 +85,7 @@ type GitTargetSpec struct { // GitTargetPlacementSpec declares where NEW resources are written when no document // for their identity exists yet in Git — one exact-type map plus a fallback // default template (Option B2 of -// docs/design/manifest/version2/gittarget-new-file-placement-rules.md). There is +// docs/spec/gittarget-new-file-placement-rules.md). There is // deliberately no separate "sensitive" placement block: sensitivity is a // write-safety classification the controller owns (encrypt the content, keep the // path identity-complete, never append or co-mingle), not a second placement diff --git a/docs/ci/findings.md b/docs/ci/findings.md index 01250bb0..daf4fe4c 100644 --- a/docs/ci/findings.md +++ b/docs/ci/findings.md @@ -81,7 +81,32 @@ kubectl config view --minify | sed -n '/server:/p;/tls-server-name:/p' kubectl get nodes ``` -### 6) Related docs in this folder +### 6) kind does not run in this devcontainer — do not retry it + +A `kind` cluster cannot be started from inside this devcontainer, and no amount of +kind-version bumping fixes it. The host's `fs.inotify.max_user_instances` is 128, +which is too low for kind's systemd + kubelet + CRI to all allocate watchers, and +`/proc/sys/fs/inotify` is mounted **read-only** because the Docker-in-Docker setup +does not share a writable sysctl namespace with the host: + +| Attempt | Result | +| --- | --- | +| `sudo sysctl fs.inotify.max_user_instances=8192` | `permission denied on key` | +| `sudo sh -c 'echo 8192 > /proc/sys/fs/inotify/...'` | `Read-only file system` | +| kind v0.24.0 → v0.27.0 (newer node image) | same inotify failure — a newer kind does not fix a host limit | + +Raising the limit needs changes to the *outer* host or the devcontainer feature +config. **Use k3d, which is what the e2e suite already does.** + +Recorded 2026-07-11 from a since-deleted scratch investigation +(`hack/audit-kind-check/`), which tried to stand up kind to compare aggregated-API +audit richness against k3s. That question was ultimately answered by reading the +upstream kube source in `external-sources/kubernetes/` instead — strictly more +conclusive, since a single kind run proves behaviour for one kube version whereas +the source shows it is structural. The aggregated-API e2e now ships against k3d +(`test/e2e/aggregated_apiserver_e2e_test.go`). + +### 7) Related docs in this folder - `go-module-permissions.md` - why `/go` permissions are managed with shared group + ACLs - `windows-devcontainer.md` - Windows-specific mount behavior and expected differences diff --git a/hack/audit-kind-check/ATTEMPT.md b/hack/audit-kind-check/ATTEMPT.md deleted file mode 100644 index 9fcb9e55..00000000 --- a/hack/audit-kind-check/ATTEMPT.md +++ /dev/null @@ -1,72 +0,0 @@ -# Kind-Based Audit Validation Attempt - -## Goal - -Validate one open question from [investigate.md](../../investigate.md): - -> Does upstream Kubernetes (not k3s) emit richer audit events for an aggregated API `create`, or does it produce the same sparse event we saw on k3s? - -If upstream kube is rich, the [audit pass-through APIServer prototype](../../external-prototype/audit-pass-through-apiserver/PLAN.md) premise collapses and the whole effort is unnecessary. If upstream kube is sparse too, the prototype is structurally justified. - -## Approach - -Stand up a one-node kind cluster with `--audit-policy-file` + `--audit-log-path` configured on the control-plane kube-apiserver, install the existing sample-apiserver manifests from [test/e2e/setup/manifests/sample-apiserver/](../../test/e2e/setup/manifests/sample-apiserver/), create a `Flunder`, and read the audit log out of the control-plane container. Compare the resulting event fields against the k3s capture at [.stamps/debug/flunder-create-audit.json](../../.stamps/debug/flunder-create-audit.json). - -## Files scaffolded - -- [audit-policy.yaml](audit-policy.yaml) — `RequestResponse` policy scoped to `wardle.example.com` and `ConfigMap` (control). -- [kind-config.yaml](kind-config.yaml) — kind `Cluster` with `kubeadmConfigPatches` adding `audit-policy-file`, `audit-log-path`, and the `extraVolumes` / `extraMounts` wiring to inject the policy file and persist the log. -- [flunder.yaml](flunder.yaml) — a minimal Flunder instance in `default`. - -## What went wrong - -Kind's node container boots full systemd inside Docker. On this devcontainer, the node fails before reaching `Multi-User.target` with: - -``` -Failed to create inotify object: Too many open files -``` - -This is the well-known kind-in-devcontainer inotify limit issue. The host's `fs.inotify.max_user_instances` is 128, which is too low for kind's systemd + kubelet + CRI to all allocate watchers. - -Attempted resolutions, all blocked: - -| Attempt | Result | -| --- | --- | -| `sudo sysctl fs.inotify.max_user_instances=8192` | `permission denied on key` | -| `sudo sh -c 'echo 8192 > /proc/sys/fs/inotify/max_user_instances'` | `Read-only file system` | -| kind v0.24.0 → v0.27.0 (newer node image) | Same inotify failure — higher kind versions don't fix the host limit | - -`/proc/sys/fs/inotify` is mounted read-only because this devcontainer's Docker-in-Docker setup doesn't share a writable sysctl namespace with the host. Raising the limit requires changes to the outer host or devcontainer feature config, outside the scope of this investigation. - -Existing k3d cluster was left running; kind attempt left no persistent cluster behind. - -## Pivot - -Instead of debugging the devcontainer, we answered the same question by reading the upstream kube source code directly (available in-tree under [external-sources/kubernetes/](../../external-sources/kubernetes/)). That turns out to be strictly more conclusive than a single kind run: the kind result would prove behavior for one kube version, whereas the source-level analysis shows the behavior is structural across all versions that have this architecture. - -The findings are captured in [external-prototype/audit-pass-through-apiserver/WHY.md](../../external-prototype/audit-pass-through-apiserver/WHY.md). - -Short answer: the aggregated-API proxy path in kube-apiserver bypasses the native REST handler layer where `audit.LogRequestObject` / `audit.LogResponseObject` are called. The sparse audit is upstream kube behavior, not a k3s quirk. The prototype is justified. - -## How to retry on a less-restricted host - -If a future operator has root on the host (or a devcontainer feature that bumps inotify): - -```bash -sudo sysctl -w fs.inotify.max_user_instances=8192 -sudo sysctl -w fs.inotify.max_user_watches=524288 - -kind create cluster --config hack/audit-kind-check/kind-config.yaml --wait 180s -kubectl apply -k test/e2e/setup/manifests/ # installs sample-apiserver -kubectl wait --for=condition=Available apiservice/v1alpha1.wardle.example.com --timeout=120s -kubectl apply -f hack/audit-kind-check/flunder.yaml -kubectl create configmap audit-probe --from-literal=k=v # control event - -docker exec audit-check-control-plane cat /var/log/kubernetes/audit.log \ - | jq -c 'select(.verb=="create" and (.objectRef.resource=="flunders" or .objectRef.resource=="configmaps"))' \ - > kind-audit.jsonl - -kind delete cluster --name audit-check -``` - -Expected outcome given the source-level analysis: the `flunders` event will be missing `objectRef.name`, `requestObject`, and `responseObject`; the `configmaps` event will have all three. If that is what you see, you have confirmed empirically what the source code already tells us. diff --git a/hack/audit-kind-check/audit-policy.yaml b/hack/audit-kind-check/audit-policy.yaml deleted file mode 100644 index 50739fe1..00000000 --- a/hack/audit-kind-check/audit-policy.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: audit.k8s.io/v1 -kind: Policy -omitStages: - - RequestReceived -rules: - - level: RequestResponse - resources: - - group: wardle.example.com - - group: "" - resources: ["configmaps"] - - level: None diff --git a/hack/audit-kind-check/flunder.yaml b/hack/audit-kind-check/flunder.yaml deleted file mode 100644 index 6759940c..00000000 --- a/hack/audit-kind-check/flunder.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: wardle.example.com/v1alpha1 -kind: Flunder -metadata: - name: audit-probe - namespace: default -spec: - referenceType: "Flunder" - reference: "some-flunder" diff --git a/hack/audit-kind-check/kind-config.yaml b/hack/audit-kind-check/kind-config.yaml deleted file mode 100644 index cb9fb714..00000000 --- a/hack/audit-kind-check/kind-config.yaml +++ /dev/null @@ -1,28 +0,0 @@ -kind: Cluster -apiVersion: kind.x-k8s.io/v1alpha4 -name: audit-check -nodes: - - role: control-plane - extraMounts: - - hostPath: /workspaces/gitops-reverser/hack/audit-kind-check/audit-policy.yaml - containerPath: /etc/kubernetes/audit-policy.yaml - readOnly: true - kubeadmConfigPatches: - - | - kind: ClusterConfiguration - apiServer: - extraArgs: - audit-policy-file: /etc/kubernetes/audit-policy.yaml - audit-log-path: /var/log/kubernetes/audit.log - audit-log-maxage: "1" - audit-log-maxsize: "50" - extraVolumes: - - name: audit-policy - hostPath: /etc/kubernetes/audit-policy.yaml - mountPath: /etc/kubernetes/audit-policy.yaml - readOnly: true - pathType: File - - name: audit-log - hostPath: /var/log/kubernetes - mountPath: /var/log/kubernetes - pathType: DirectoryOrCreate diff --git a/hack/doccheck/main.go b/hack/doccheck/main.go new file mode 100644 index 00000000..38cf4eb4 --- /dev/null +++ b/hack/doccheck/main.go @@ -0,0 +1,208 @@ +// SPDX-License-Identifier: Apache-2.0 + +// Command doccheck verifies that every documentation reference in the repository +// resolves to a file that exists. +// +// It checks two surfaces that nothing off-the-shelf covers together: +// +// 1. Relative links in Markdown — `[text](../spec/foo.md)`, including links that +// point at source files. External URLs and pure `#anchor` links are skipped. +// +// 2. Repo-relative documentation paths cited inside **Go comments** — the +// `docs/spec/manifest-system.md`-style references the packages use to point at +// their contract. These are the ones that rot silently: a doc gets moved, the +// comment keeps pointing at the old path, and nothing notices. Seventeen of +// them were dangling before this check existed. +// +// The Go side parses the AST and reads only comments, never string literals. That +// distinction matters: the gittargetignore tests build in-memory filesystems whose +// entries are named like documentation paths. Those are fixtures, not citations. A +// regex cannot tell the two apart; the parser can. +// +// Only git-tracked files are scanned, so gitignored scratch notes and the local +// upstream checkouts under external-sources/ are out of scope for free. +// +// Usage: +// +// doccheck [-root DIR] +// +// Exits non-zero and prints file:line for every unresolved reference. +package main + +import ( + "flag" + "fmt" + "go/parser" + "go/token" + "os" + "os/exec" + "path/filepath" + "regexp" + "sort" + "strings" +) + +// markdownLink matches [label](target). Reference-style links and bare autolinks +// are deliberately not matched: the former are rare here, the latter are URLs. +var markdownLink = regexp.MustCompile(`\[[^\]\[]*\]\(([^)\s]+)\)`) + +// docPath matches a repo-relative documentation path as written in a Go comment. +// Anchored on the `docs/` prefix so we do not try to validate arbitrary prose. +var docPath = regexp.MustCompile(`\bdocs/[A-Za-z0-9._/-]+\.md\b`) + +type finding struct { + file string // repo-relative + line int + target string + kind string // "markdown" | "go-comment" +} + +func main() { + root := flag.String("root", ".", "repository root to scan") + flag.Parse() + + abs, err := filepath.Abs(*root) + if err != nil { + fmt.Fprintf(os.Stderr, "doccheck: %v\n", err) + os.Exit(2) + } + + tracked, err := trackedFiles(abs) + if err != nil { + fmt.Fprintf(os.Stderr, "doccheck: %v\n", err) + os.Exit(2) + } + + var findings []finding + var mdFiles, goFiles int + + for _, name := range tracked { + path := filepath.Join(abs, name) + switch { + case strings.HasSuffix(name, ".md"): + mdFiles++ + findings = append(findings, checkMarkdown(abs, path)...) + case strings.HasSuffix(name, ".go"): + goFiles++ + findings = append(findings, checkGoComments(abs, path)...) + } + } + + sort.Slice(findings, func(i, j int) bool { + if findings[i].file != findings[j].file { + return findings[i].file < findings[j].file + } + return findings[i].line < findings[j].line + }) + + if len(findings) == 0 { + fmt.Printf("doccheck: OK — %d markdown files, %d Go files, every reference resolves\n", + mdFiles, goFiles) + return + } + + for _, f := range findings { + fmt.Printf("%s:%d: broken %s reference: %s\n", f.file, f.line, f.kind, f.target) + } + fmt.Fprintf(os.Stderr, "\ndoccheck: %d broken reference(s). "+ + "A moved document must have its references fixed in the same commit.\n", len(findings)) + os.Exit(1) +} + +// trackedFiles lists the repository's git-tracked files. Using git's own index +// rather than a filesystem walk means .gitignore is honoured for free: scratch +// notes and the local upstream checkouts under external-sources/ are never scanned, +// and we never have to maintain a skip-list that drifts. +func trackedFiles(root string) ([]string, error) { + cmd := exec.Command("git", "-C", root, "ls-files", "-z") + out, err := cmd.Output() + if err != nil { + return nil, fmt.Errorf("git ls-files: %w (is %s a git repository?)", err, root) + } + var names []string + for _, n := range strings.Split(string(out), "\x00") { + if n != "" { + names = append(names, n) + } + } + return names, nil +} + +// checkMarkdown resolves every relative link in a Markdown file against the file's +// own directory. http(s), mailto and pure-anchor links are not our business. +func checkMarkdown(root, path string) []finding { + data, err := os.ReadFile(path) + if err != nil { + return nil + } + dir := filepath.Dir(path) + var out []finding + + for i, line := range strings.Split(string(data), "\n") { + for _, m := range markdownLink.FindAllStringSubmatch(line, -1) { + target := m[1] + if isExternal(target) { + continue + } + // Strip a trailing #fragment; we check the file, not the anchor. + if idx := strings.IndexByte(target, '#'); idx >= 0 { + target = target[:idx] + } + if target == "" { + continue + } + if _, err := os.Stat(filepath.Join(dir, target)); err != nil { + out = append(out, finding{ + file: rel(root, path), + line: i + 1, + target: m[1], + kind: "markdown", + }) + } + } + } + return out +} + +// checkGoComments extracts docs/**.md citations from comments only. String +// literals are ignored on purpose — see the package doc. +func checkGoComments(root, path string) []finding { + fset := token.NewFileSet() + file, err := parser.ParseFile(fset, path, nil, parser.ParseComments) + if err != nil { + // A file that does not parse is golangci-lint's problem, not ours. + return nil + } + + var out []finding + for _, group := range file.Comments { + for _, c := range group.List { + for _, target := range docPath.FindAllString(c.Text, -1) { + if _, err := os.Stat(filepath.Join(root, target)); err != nil { + out = append(out, finding{ + file: rel(root, path), + line: fset.Position(c.Pos()).Line, + target: target, + kind: "go-comment", + }) + } + } + } + } + return out +} + +func isExternal(target string) bool { + return strings.HasPrefix(target, "http://") || + strings.HasPrefix(target, "https://") || + strings.HasPrefix(target, "mailto:") || + strings.HasPrefix(target, "#") +} + +func rel(root, path string) string { + r, err := filepath.Rel(root, path) + if err != nil { + return path + } + return r +} diff --git a/internal/git/manifestedit/DECISION.md b/internal/git/manifestedit/DECISION.md index 1b68fe51..ba8e2514 100644 --- a/internal/git/manifestedit/DECISION.md +++ b/internal/git/manifestedit/DECISION.md @@ -1,7 +1,7 @@ # Decision record: in-document YAML editor > Outcome of the POC specified in -> [docs/design/manifest/manifest-parser-poc.md](../../../docs/design/manifest/manifest-parser-poc.md). +> [docs/design/manifest/manifest-parser-poc.md](../../../docs/spec/manifest-system.md). > This package is the throw-away prototype that POC asked for. ## Decision diff --git a/test/e2e/setup/argocd/README.md b/test/e2e/setup/argocd/README.md index 3f165326..acdc8d9f 100644 --- a/test/e2e/setup/argocd/README.md +++ b/test/e2e/setup/argocd/README.md @@ -5,7 +5,7 @@ The only Argo CD installation in this repository. Installed by the only `task test-e2e-bi-directional` and `task argocd-ui` depend on — so the other CI legs never pay for it. -Design: [`docs/design/e2e-bi-directional-corner.md`](../../../../docs/design/e2e-bi-directional-corner.md). +Design: [`docs/spec/e2e-bi-directional-corner.md`](../../../../docs/spec/e2e-bi-directional-corner.md). ## Shape diff --git a/test/mutationlab/README.md b/test/mutationlab/README.md index 924b8e18..2e0ee7ac 100644 --- a/test/mutationlab/README.md +++ b/test/mutationlab/README.md @@ -3,7 +3,7 @@ A small, separate application that records the exact structures Kubernetes exposes through native watches, audit webhooks, and validating admission webhooks, and commits them as a versioned corpus. It is **not** a second -GitOps Reverser — see [the design](../../docs/design/mutation-capture-lab-design.md). +GitOps Reverser — see [the design](../../docs/spec/mutation-capture-lab-design.md). ## Layout @@ -18,10 +18,10 @@ GitOps Reverser — see [the design](../../docs/design/mutation-capture-lab-desi ## Scenario index -Each captured row of the [Difficult Cases Catalog](../../docs/design/mutation-capture-lab-design.md#difficult-cases-catalog) +Each captured row of the [Difficult Cases Catalog](../../docs/spec/mutation-capture-lab-design.md#difficult-cases-catalog) maps to one driver test and one corpus directory. The "Sources" column is what the corpus commits — a **silence** (no audit / no admission) is itself the finding, not a -gap (see [Capturing Intent, Not State](../../docs/design/mutation-capture-lab-design.md#capturing-intent-not-state)). +gap (see [Capturing Intent, Not State](../../docs/spec/mutation-capture-lab-design.md#capturing-intent-not-state)). | Row | Scenario | Test (`e2e/…`) | Corpus dir (`corpus/…`) | Sources committed | |---|---|---|---|---| @@ -46,7 +46,7 @@ gap (see [Capturing Intent, Not State](../../docs/design/mutation-capture-lab-de All seventeen catalogued scenarios are now captured. Rows 16 and 17 test the watch transport itself; the driver uses the lab's targeted `/watch-probe` endpoint so transport-only events can be scenario-attributed — see the -[watch-first ingestion architecture](../../docs/design/watch-first-ingestion-architecture.md) +[watch-first ingestion architecture](../../docs/finished/watch-first-ingestion-architecture.md) design notes. ## How it integrates: swap the image, reuse the wiring diff --git a/test/mutationlab/corpus/CLUSTER.md b/test/mutationlab/corpus/CLUSTER.md index 4c91b6dd..dfcbdc1c 100644 --- a/test/mutationlab/corpus/CLUSTER.md +++ b/test/mutationlab/corpus/CLUSTER.md @@ -5,7 +5,7 @@ records the cluster the committed corpus under `test/mutationlab/corpus/` was captured from. When the cluster version bumps, regenerating the corpus and reviewing the diff *is* the changelog of "what changed in Kubernetes between these versions" (see -[the design](../../../docs/design/mutation-capture-lab-design.md#validating-new-kubernetes-versions)). +[the design](../../../docs/spec/mutation-capture-lab-design.md#validating-new-kubernetes-versions)). The lab reuses the main e2e cluster (`task lab-e2e` swaps the controller image), so this provenance tracks the k3s image used for the committed capture. From fe22fb6470e38b4717a3023d2598f27fabfb9bc9 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Mon, 13 Jul 2026 12:35:08 +0000 Subject: [PATCH 16/28] feat(gitops-api): layout fixture corpus, provenance markers, and a doc-link checker Adds the GitOps layout fixture corpus with a generated behavioural baseline (test/fixtures/gitops-layouts/support-today.md), the expansion provenance-marker e2e spec in the bi-directional corner, and doccheck -- a dev CLI that resolves both markdown links and the docs/**.md citations buried in Go comments, which nothing off the shelf checks together. Also fixes three problems the above surfaced: - lint-docs fingerprinted '**/*.md' and '**/*.go' unrooted, so Task walked every path under the repo root -- including external-sources/ (1.2 GB of upstream checkouts) and bin/ (815 MB). Computing that fingerprint allocated tens of GB inside the Task process itself and OOM-killed the host; `task --status lint-docs` alone hit 4.4 GB and was still climbing. Scoping the globs per top-level tree takes it to 42 MB. - lint-golang's sources omitted hack/**/*.go and pkg/**/*.go, so Task could report "up to date" while golangci-lint had never seen a change in either tree. It lints both. - The docs reorg left eight dangling docs/ citations in Taskfiles, workflows, charts, and scripts. doccheck reads markdown links and Go comments, so it does not cover those surfaces; they were repointed by hand. The devcontainer now caps its own memory so a runaway build cannot starve the host. Note this bounds only what runs in-container: docker-outside-of-docker means the e2e k3d containers are siblings on the host daemon. Co-Authored-By: Claude Opus 4.8 (1M context) --- .devcontainer/devcontainer.json | 8 +- .github/workflows/ci.yml | 6 +- .golangci.yml | 5 + Taskfile-build.yml | 45 +- .../validate-operator-types-webhook.yaml | 2 +- charts/gitops-reverser/values.yaml | 2 +- config/webhook/validating-webhook.yaml | 2 +- docs/INDEX.md | 5 +- docs/alternatives.md | 16 + docs/design/gitops-api/README.md | 3 +- ...ansion-boundary-and-corpus-organisation.md | 297 +++++---- .../gitops-api/intent-cluster-hydration.md | 6 +- .../gitops-api/resource-capability-model.md | 32 +- .../sealed-secrets-and-external-secrets.md | 20 + docs/design/gitops-api/support-contract.md | 2 + ...the-layer-above-and-the-expansion-graph.md | 297 +++++++++ .../write-only-encrypted-secrets.md | 2 +- docs/facts/expansion-provenance-markers.md | 175 +++++ docs/spec/e2e-bi-directional-corner.md | 33 +- hack/doccheck/main.go | 15 +- hack/doccheck/main_test.go | 211 ++++++ hack/e2e/argocd-port-forward.sh | 2 +- hack/gitops-layouts-baseline.sh | 135 ++++ test/e2e/Taskfile.yml | 23 +- test/e2e/provenance_markers_e2e_test.go | 618 ++++++++++++++++++ test/e2e/setup/argocd/values.yaml | 2 +- .../templates/provenance/applicationset.tmpl | 35 + .../e2e/templates/provenance/helmrelease.tmpl | 24 + .../e2e/templates/provenance/resourceset.tmpl | 20 + .../argocd-app-of-apps}/README.md | 2 +- .../applications/backend.yaml | 0 .../applications/frontend.yaml | 0 .../argocd-app-of-apps}/bootstrap/root.yaml | 0 .../manifests/backend/deployment.yaml | 0 .../manifests/backend/service.yaml | 0 .../manifests/frontend/application.yaml | 0 .../manifests}/frontend/service.yaml | 0 .../argocd-plain}/README.md | 2 +- .../apps/frontend/ci-metadata.yaml | 0 .../apps/frontend/deployment.yaml | 0 .../argocd-plain}/apps/frontend/ingress.yaml | 0 .../apps/frontend/namespace.yaml | 0 .../apps/frontend/rbac-and-config.yaml | 0 .../argocd-plain/apps}/frontend/service.yaml | 0 .../argocd/frontend-application.yaml | 0 .../flux-monorepo}/README.md | 2 +- .../apps/base/frontend/deployment.yaml | 0 .../apps/base/frontend/kustomization.yaml | 0 .../apps/base/frontend/service.yaml | 0 .../apps/production/frontend-patch.yaml | 0 .../apps/production/kustomization.yaml | 0 .../apps/staging/frontend-patch.yaml | 0 .../apps/staging/kustomization.yaml | 0 .../clusters/production/apps.yaml | 0 .../flux-system/gotk-components.yaml | 0 .../production/flux-system/gotk-sync.yaml | 0 .../production/flux-system/kustomization.yaml | 0 .../clusters/production/infrastructure.yaml | 0 .../clusters/production/kustomization.yaml | 0 .../flux-monorepo}/clusters/staging/apps.yaml | 0 .../staging/flux-system/gotk-components.yaml | 0 .../staging/flux-system/gotk-sync.yaml | 0 .../staging/flux-system/kustomization.yaml | 0 .../clusters/staging/infrastructure.yaml | 0 .../clusters/staging/kustomization.yaml | 0 .../configs/cluster-issuers.yaml | 0 .../infrastructure/configs/kustomization.yaml | 0 .../controllers/ingress-nginx.yaml | 0 .../controllers/kustomization.yaml | 0 .../repo-per-environment}/README.md | 2 +- .../gitops-dev/.gitignore | 0 .../gitops-dev/apps/backend/deployment.yaml | 0 .../gitops-dev/apps/backend/service.yaml | 0 .../gitops-dev/apps/frontend/deployment.yaml | 0 .../gitops-dev/apps/frontend/service.yaml | 0 .../gitops-dev/namespaces.yaml | 0 .../gitops-production/.gitignore | 0 .../apps/backend/deployment.yaml | 0 .../apps/backend/service.yaml | 0 .../apps/frontend/deployment.yaml | 0 .../gitops-production/apps/frontend/hpa.yaml | 0 .../apps/frontend/service.yaml | 0 .../gitops-production/namespaces.yaml | 0 .../gitops-staging/.gitignore | 0 .../apps/backend/deployment.yaml | 0 .../gitops-staging/apps/backend/service.yaml | 0 .../apps/frontend/deployment.yaml | 0 .../gitops-staging/apps/frontend/service.yaml | 0 .../gitops-staging/namespaces.yaml | 0 .../argocd-external-helm}/README.md | 2 +- .../applications/cert-manager.yaml | 0 .../applications/external-dns.yaml | 0 .../applications/ingress-nginx.yaml | 0 .../extras/ingress-nginx/middleware.yaml | 0 .../platform/cert-manager/application.yaml | 0 .../platform/cert-manager/clusterissuer.yaml | 0 .../platform/cert-manager/values.yaml | 0 .../values/cert-manager/production.yaml | 0 .../values/external-dns/production.yaml | 0 .../values/ingress-nginx/common.yaml | 0 .../values/ingress-nginx/production.yaml | 0 .../helm-chart}/README.md | 2 +- .../helm-chart}/charts/frontend/.helmignore | 0 .../helm-chart}/charts/frontend/Chart.lock | 0 .../helm-chart}/charts/frontend/Chart.yaml | 0 .../charts/frontend/charts/.gitkeep | 0 .../frontend/crds/widgets.example.com.yaml | 0 .../charts/frontend/templates/NOTES.txt | 0 .../charts/frontend/templates/_helpers.tpl | 0 .../charts/frontend/templates/configmap.yaml | 0 .../charts/frontend/templates/deployment.yaml | 0 .../charts/frontend/templates/ingress.yaml | 0 .../charts/frontend/templates/service.yaml | 0 .../frontend/templates/serviceaccount.yaml | 0 .../templates/tests/test-connection.yaml | 0 .../charts/frontend/values.schema.json | 0 .../helm-chart}/charts/frontend/values.yaml | 0 .../helm-environment-values}/README.md | 2 +- .../helm-environment-values}/argocd/dev.yaml | 0 .../argocd/production.yaml | 0 .../chart/.argocd-source.yaml | 0 .../helm-environment-values}/chart/Chart.yaml | 0 .../chart/templates/deployment.yaml | 0 .../chart/templates/service.yaml | 0 .../chart/values.yaml | 0 .../values/common.yaml | 0 .../helm-environment-values}/values/dev.yaml | 0 .../values/production.yaml | 0 .../kustomize-overlays}/README.md | 4 +- .../apps/backend/base/deployment.yaml | 0 .../apps/backend/base/kustomization.yaml | 0 .../apps/backend/base/service.yaml | 0 .../overlays/production/kustomization.yaml | 0 .../apps/frontend/base/deployment.yaml | 0 .../apps/frontend/base/kustomization.yaml | 0 .../apps/frontend/base/service.yaml | 0 .../.argocd-source-frontend-production.yaml | 0 .../overlays/production/config.properties | 0 .../overlays/production/deployment-patch.yaml | 0 .../overlays/production/kustomization.yaml | 0 .../frontend/overlays/production/secrets.env | 0 .../overlays/staging/config.properties | 0 .../overlays/staging/deployment-patch.yaml | 0 .../overlays/staging/kustomization.yaml | 0 .../rendered-manifests}/README.md | 2 +- .../argocd/production.yaml | 0 .../rendered/production/frontend.yaml | 0 .../rendered/staging/frontend.yaml | 0 .../src/frontend/base/deployment.yaml | 0 .../src/frontend/base/kustomization.yaml | 0 .../src/frontend/base/service.yaml | 0 .../overlays/production/kustomization.yaml | 0 .../overlays/staging/kustomization.yaml | 0 .../rendered-manifests}/src/render.sh | 0 .../README.md | 40 +- .../apps/backend/deployment.yaml | 0 .../apps/backend/service.yaml | 0 .../apps/disabled-example/README.md | 0 .../apps/empty/.gitkeep | 0 .../apps/frontend/deployment.yaml | 0 .../apps/frontend/service.yaml | 0 .../apps/platform/monitoring/deployment.yaml | 0 .../apps/platform/monitoring/service.yaml | 0 .../apps/worker/deployment.yaml | 0 .../bootstrap/applicationset.yaml | 0 .../argocd-applicationset-files}/README.md | 2 +- .../applicationset.yaml | 0 .../chart/Chart.yaml | 0 .../chart/templates/_helpers.tpl | 0 .../chart/templates/deployment.yaml | 0 .../chart/templates/service.yaml | 0 .../chart/values.yaml | 0 .../deployments/dev/backend.yaml | 0 .../deployments/dev/frontend.yaml | 0 .../deployments/production/backend.yaml | 0 .../deployments/production/frontend.yaml | 0 .../argocd-multicluster-matrix}/README.md | 2 +- .../applicationsets/cluster-matrix.yaml | 0 .../apps/backend/deployment.yaml | 0 .../apps/backend/service.yaml | 0 .../apps/frontend/deployment.yaml | 0 .../apps/frontend/service.yaml | 0 .../clusters/eu-production.yaml | 0 .../clusters/staging.yaml | 0 .../clusters/us-production.yaml | 0 .../values/eu-production/backend.yaml | 0 .../values/eu-production/frontend.yaml | 0 .../values/staging/frontend.yaml | 0 .../values/us-production/frontend.yaml | 0 .../flux-helmrelease}/README.md | 2 +- .../apps/frontend/helmrelease.yaml | 0 .../apps/frontend/kustomization.yaml | 0 .../apps/frontend/values.yaml | 0 .../clusters/production/apps.yaml | 0 .../flux-system/gotk-components.yaml | 0 .../production/flux-system/gotk-sync.yaml | 0 .../production/flux-system/kustomization.yaml | 0 .../clusters/production/infrastructure.yaml | 0 .../clusters/production/kustomization.yaml | 0 .../ingress-nginx/helmrelease.yaml | 0 .../ingress-nginx/kustomization.yaml | 0 .../ingress-nginx/values-configmap.yaml | 0 .../infrastructure/sources/kustomization.yaml | 0 .../infrastructure/sources/repositories.yaml | 0 .../flux-resourceset-inline/README.md | 75 +++ .../flux-resourceset-inline/tenants/apps.yaml | 62 ++ .../flux-resourceset-pull-requests/README.md | 53 ++ .../previews/preview-envs.yaml | 57 ++ .../flux-image-automation}/README.md | 2 +- .../apps/frontend/deployment.yaml | 0 .../apps/frontend/kustomization.yaml | 0 .../apps/frontend/service.yaml | 0 .../clusters/production/apps.yaml | 0 .../clusters/production/image-automation.yaml | 0 .../clusters/production/kustomization.yaml | 0 .../image-automation/imagepolicy.yaml | 0 .../image-automation/imagerepository.yaml | 0 .../imageupdateautomation.yaml | 0 .../image-automation/kustomization.yaml | 0 .../sops-encrypted}/.sops.yaml | 0 .../sops-encrypted}/README.md | 2 +- .../apps/frontend/deployment.yaml | 0 .../apps/frontend/kustomization.yaml | 0 .../apps/frontend/secret.enc.yaml | 0 .../clusters/production/apps.yaml | 0 .../secrets/db-credentials.enc.yaml | 0 .../infrastructure/secrets/kustomization.yaml | 0 .../mixed-and-hostile}/README.md | 2 +- .../mixed-and-hostile}/application.yaml | 0 .../mixed-and-hostile}/ci/.gitlab-ci.yml | 0 .../mixed-and-hostile}/ci/docker-compose.yml | 0 .../crossplane/composition.yaml | 0 .../mixed-and-hostile}/empty-dir/.gitkeep | 0 .../kro/resourcegraphdefinition.yaml | 0 .../mixed-and-hostile}/kustomization.yaml | 0 .../mixed-and-hostile}/mixed/bundle.yaml | 0 .../mixed-and-hostile}/mixed/deployment.json | 0 .../mixed-and-hostile}/mixed/service.yml | 0 .../mixed-and-hostile}/secrets/db.enc.yaml | 0 .../templates/deployment.yaml | 0 .../mixed-and-hostile}/values.yaml | 0 test/fixtures/gitops-layouts/README.md | 259 +++++--- test/fixtures/gitops-layouts/support-today.md | 351 +++++----- 243 files changed, 2540 insertions(+), 432 deletions(-) create mode 100644 docs/design/gitops-api/the-layer-above-and-the-expansion-graph.md create mode 100644 docs/facts/expansion-provenance-markers.md create mode 100644 hack/doccheck/main_test.go create mode 100755 hack/gitops-layouts-baseline.sh create mode 100644 test/e2e/provenance_markers_e2e_test.go create mode 100644 test/e2e/templates/provenance/applicationset.tmpl create mode 100644 test/e2e/templates/provenance/helmrelease.tmpl create mode 100644 test/e2e/templates/provenance/resourceset.tmpl rename test/fixtures/gitops-layouts/{02-argocd-app-of-apps => 1-desired-state/argocd-app-of-apps}/README.md (99%) rename test/fixtures/gitops-layouts/{02-argocd-app-of-apps => 1-desired-state/argocd-app-of-apps}/applications/backend.yaml (100%) rename test/fixtures/gitops-layouts/{02-argocd-app-of-apps => 1-desired-state/argocd-app-of-apps}/applications/frontend.yaml (100%) rename test/fixtures/gitops-layouts/{02-argocd-app-of-apps => 1-desired-state/argocd-app-of-apps}/bootstrap/root.yaml (100%) rename test/fixtures/gitops-layouts/{02-argocd-app-of-apps => 1-desired-state/argocd-app-of-apps}/manifests/backend/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{02-argocd-app-of-apps => 1-desired-state/argocd-app-of-apps}/manifests/backend/service.yaml (100%) rename test/fixtures/gitops-layouts/{02-argocd-app-of-apps => 1-desired-state/argocd-app-of-apps}/manifests/frontend/application.yaml (100%) rename test/fixtures/gitops-layouts/{01-argocd-plain/apps => 1-desired-state/argocd-app-of-apps/manifests}/frontend/service.yaml (100%) rename test/fixtures/gitops-layouts/{01-argocd-plain => 1-desired-state/argocd-plain}/README.md (99%) rename test/fixtures/gitops-layouts/{01-argocd-plain => 1-desired-state/argocd-plain}/apps/frontend/ci-metadata.yaml (100%) rename test/fixtures/gitops-layouts/{01-argocd-plain => 1-desired-state/argocd-plain}/apps/frontend/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{01-argocd-plain => 1-desired-state/argocd-plain}/apps/frontend/ingress.yaml (100%) rename test/fixtures/gitops-layouts/{01-argocd-plain => 1-desired-state/argocd-plain}/apps/frontend/namespace.yaml (100%) rename test/fixtures/gitops-layouts/{01-argocd-plain => 1-desired-state/argocd-plain}/apps/frontend/rbac-and-config.yaml (100%) rename test/fixtures/gitops-layouts/{02-argocd-app-of-apps/manifests => 1-desired-state/argocd-plain/apps}/frontend/service.yaml (100%) rename test/fixtures/gitops-layouts/{01-argocd-plain => 1-desired-state/argocd-plain}/argocd/frontend-application.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/README.md (99%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/apps/base/frontend/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/apps/base/frontend/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/apps/base/frontend/service.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/apps/production/frontend-patch.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/apps/production/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/apps/staging/frontend-patch.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/apps/staging/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/clusters/production/apps.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/clusters/production/flux-system/gotk-components.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/clusters/production/flux-system/gotk-sync.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/clusters/production/flux-system/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/clusters/production/infrastructure.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/clusters/production/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/clusters/staging/apps.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/clusters/staging/flux-system/gotk-components.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/clusters/staging/flux-system/gotk-sync.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/clusters/staging/flux-system/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/clusters/staging/infrastructure.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/clusters/staging/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/infrastructure/configs/cluster-issuers.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/infrastructure/configs/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/infrastructure/controllers/ingress-nginx.yaml (100%) rename test/fixtures/gitops-layouts/{09-flux-monorepo => 1-desired-state/flux-monorepo}/infrastructure/controllers/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/README.md (99%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-dev/.gitignore (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-dev/apps/backend/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-dev/apps/backend/service.yaml (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-dev/apps/frontend/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-dev/apps/frontend/service.yaml (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-dev/namespaces.yaml (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-production/.gitignore (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-production/apps/backend/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-production/apps/backend/service.yaml (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-production/apps/frontend/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-production/apps/frontend/hpa.yaml (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-production/apps/frontend/service.yaml (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-production/namespaces.yaml (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-staging/.gitignore (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-staging/apps/backend/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-staging/apps/backend/service.yaml (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-staging/apps/frontend/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-staging/apps/frontend/service.yaml (100%) rename test/fixtures/gitops-layouts/{11-repo-per-environment => 1-desired-state/repo-per-environment}/gitops-staging/namespaces.yaml (100%) rename test/fixtures/gitops-layouts/{08-argocd-external-helm => 2-rendered/argocd-external-helm}/README.md (99%) rename test/fixtures/gitops-layouts/{08-argocd-external-helm => 2-rendered/argocd-external-helm}/applications/cert-manager.yaml (100%) rename test/fixtures/gitops-layouts/{08-argocd-external-helm => 2-rendered/argocd-external-helm}/applications/external-dns.yaml (100%) rename test/fixtures/gitops-layouts/{08-argocd-external-helm => 2-rendered/argocd-external-helm}/applications/ingress-nginx.yaml (100%) rename test/fixtures/gitops-layouts/{08-argocd-external-helm => 2-rendered/argocd-external-helm}/extras/ingress-nginx/middleware.yaml (100%) rename test/fixtures/gitops-layouts/{08-argocd-external-helm => 2-rendered/argocd-external-helm}/platform/cert-manager/application.yaml (100%) rename test/fixtures/gitops-layouts/{08-argocd-external-helm => 2-rendered/argocd-external-helm}/platform/cert-manager/clusterissuer.yaml (100%) rename test/fixtures/gitops-layouts/{08-argocd-external-helm => 2-rendered/argocd-external-helm}/platform/cert-manager/values.yaml (100%) rename test/fixtures/gitops-layouts/{08-argocd-external-helm => 2-rendered/argocd-external-helm}/values/cert-manager/production.yaml (100%) rename test/fixtures/gitops-layouts/{08-argocd-external-helm => 2-rendered/argocd-external-helm}/values/external-dns/production.yaml (100%) rename test/fixtures/gitops-layouts/{08-argocd-external-helm => 2-rendered/argocd-external-helm}/values/ingress-nginx/common.yaml (100%) rename test/fixtures/gitops-layouts/{08-argocd-external-helm => 2-rendered/argocd-external-helm}/values/ingress-nginx/production.yaml (100%) rename test/fixtures/gitops-layouts/{06-helm-chart => 2-rendered/helm-chart}/README.md (99%) rename test/fixtures/gitops-layouts/{06-helm-chart => 2-rendered/helm-chart}/charts/frontend/.helmignore (100%) rename test/fixtures/gitops-layouts/{06-helm-chart => 2-rendered/helm-chart}/charts/frontend/Chart.lock (100%) rename test/fixtures/gitops-layouts/{06-helm-chart => 2-rendered/helm-chart}/charts/frontend/Chart.yaml (100%) rename test/fixtures/gitops-layouts/{06-helm-chart => 2-rendered/helm-chart}/charts/frontend/charts/.gitkeep (100%) rename test/fixtures/gitops-layouts/{06-helm-chart => 2-rendered/helm-chart}/charts/frontend/crds/widgets.example.com.yaml (100%) rename test/fixtures/gitops-layouts/{06-helm-chart => 2-rendered/helm-chart}/charts/frontend/templates/NOTES.txt (100%) rename test/fixtures/gitops-layouts/{06-helm-chart => 2-rendered/helm-chart}/charts/frontend/templates/_helpers.tpl (100%) rename test/fixtures/gitops-layouts/{06-helm-chart => 2-rendered/helm-chart}/charts/frontend/templates/configmap.yaml (100%) rename test/fixtures/gitops-layouts/{06-helm-chart => 2-rendered/helm-chart}/charts/frontend/templates/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{06-helm-chart => 2-rendered/helm-chart}/charts/frontend/templates/ingress.yaml (100%) rename test/fixtures/gitops-layouts/{06-helm-chart => 2-rendered/helm-chart}/charts/frontend/templates/service.yaml (100%) rename test/fixtures/gitops-layouts/{06-helm-chart => 2-rendered/helm-chart}/charts/frontend/templates/serviceaccount.yaml (100%) rename test/fixtures/gitops-layouts/{06-helm-chart => 2-rendered/helm-chart}/charts/frontend/templates/tests/test-connection.yaml (100%) rename test/fixtures/gitops-layouts/{06-helm-chart => 2-rendered/helm-chart}/charts/frontend/values.schema.json (100%) rename test/fixtures/gitops-layouts/{06-helm-chart => 2-rendered/helm-chart}/charts/frontend/values.yaml (100%) rename test/fixtures/gitops-layouts/{07-helm-environment-values => 2-rendered/helm-environment-values}/README.md (99%) rename test/fixtures/gitops-layouts/{07-helm-environment-values => 2-rendered/helm-environment-values}/argocd/dev.yaml (100%) rename test/fixtures/gitops-layouts/{07-helm-environment-values => 2-rendered/helm-environment-values}/argocd/production.yaml (100%) rename test/fixtures/gitops-layouts/{07-helm-environment-values => 2-rendered/helm-environment-values}/chart/.argocd-source.yaml (100%) rename test/fixtures/gitops-layouts/{07-helm-environment-values => 2-rendered/helm-environment-values}/chart/Chart.yaml (100%) rename test/fixtures/gitops-layouts/{07-helm-environment-values => 2-rendered/helm-environment-values}/chart/templates/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{07-helm-environment-values => 2-rendered/helm-environment-values}/chart/templates/service.yaml (100%) rename test/fixtures/gitops-layouts/{07-helm-environment-values => 2-rendered/helm-environment-values}/chart/values.yaml (100%) rename test/fixtures/gitops-layouts/{07-helm-environment-values => 2-rendered/helm-environment-values}/values/common.yaml (100%) rename test/fixtures/gitops-layouts/{07-helm-environment-values => 2-rendered/helm-environment-values}/values/dev.yaml (100%) rename test/fixtures/gitops-layouts/{07-helm-environment-values => 2-rendered/helm-environment-values}/values/production.yaml (100%) rename test/fixtures/gitops-layouts/{05-kustomize-overlays => 2-rendered/kustomize-overlays}/README.md (98%) rename test/fixtures/gitops-layouts/{05-kustomize-overlays => 2-rendered/kustomize-overlays}/apps/backend/base/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{05-kustomize-overlays => 2-rendered/kustomize-overlays}/apps/backend/base/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{05-kustomize-overlays => 2-rendered/kustomize-overlays}/apps/backend/base/service.yaml (100%) rename test/fixtures/gitops-layouts/{05-kustomize-overlays => 2-rendered/kustomize-overlays}/apps/backend/overlays/production/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{05-kustomize-overlays => 2-rendered/kustomize-overlays}/apps/frontend/base/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{05-kustomize-overlays => 2-rendered/kustomize-overlays}/apps/frontend/base/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{05-kustomize-overlays => 2-rendered/kustomize-overlays}/apps/frontend/base/service.yaml (100%) rename test/fixtures/gitops-layouts/{05-kustomize-overlays => 2-rendered/kustomize-overlays}/apps/frontend/overlays/production/.argocd-source-frontend-production.yaml (100%) rename test/fixtures/gitops-layouts/{05-kustomize-overlays => 2-rendered/kustomize-overlays}/apps/frontend/overlays/production/config.properties (100%) rename test/fixtures/gitops-layouts/{05-kustomize-overlays => 2-rendered/kustomize-overlays}/apps/frontend/overlays/production/deployment-patch.yaml (100%) rename test/fixtures/gitops-layouts/{05-kustomize-overlays => 2-rendered/kustomize-overlays}/apps/frontend/overlays/production/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{05-kustomize-overlays => 2-rendered/kustomize-overlays}/apps/frontend/overlays/production/secrets.env (100%) rename test/fixtures/gitops-layouts/{05-kustomize-overlays => 2-rendered/kustomize-overlays}/apps/frontend/overlays/staging/config.properties (100%) rename test/fixtures/gitops-layouts/{05-kustomize-overlays => 2-rendered/kustomize-overlays}/apps/frontend/overlays/staging/deployment-patch.yaml (100%) rename test/fixtures/gitops-layouts/{05-kustomize-overlays => 2-rendered/kustomize-overlays}/apps/frontend/overlays/staging/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{14-rendered-manifests => 2-rendered/rendered-manifests}/README.md (99%) rename test/fixtures/gitops-layouts/{14-rendered-manifests => 2-rendered/rendered-manifests}/argocd/production.yaml (100%) rename test/fixtures/gitops-layouts/{14-rendered-manifests => 2-rendered/rendered-manifests}/rendered/production/frontend.yaml (100%) rename test/fixtures/gitops-layouts/{14-rendered-manifests => 2-rendered/rendered-manifests}/rendered/staging/frontend.yaml (100%) rename test/fixtures/gitops-layouts/{14-rendered-manifests => 2-rendered/rendered-manifests}/src/frontend/base/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{14-rendered-manifests => 2-rendered/rendered-manifests}/src/frontend/base/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{14-rendered-manifests => 2-rendered/rendered-manifests}/src/frontend/base/service.yaml (100%) rename test/fixtures/gitops-layouts/{14-rendered-manifests => 2-rendered/rendered-manifests}/src/frontend/overlays/production/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{14-rendered-manifests => 2-rendered/rendered-manifests}/src/frontend/overlays/staging/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{14-rendered-manifests => 2-rendered/rendered-manifests}/src/render.sh (100%) rename test/fixtures/gitops-layouts/{03-argocd-applicationset-directories => 3-expanded/argocd-applicationset-directories}/README.md (72%) rename test/fixtures/gitops-layouts/{03-argocd-applicationset-directories => 3-expanded/argocd-applicationset-directories}/apps/backend/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{03-argocd-applicationset-directories => 3-expanded/argocd-applicationset-directories}/apps/backend/service.yaml (100%) rename test/fixtures/gitops-layouts/{03-argocd-applicationset-directories => 3-expanded/argocd-applicationset-directories}/apps/disabled-example/README.md (100%) rename test/fixtures/gitops-layouts/{03-argocd-applicationset-directories => 3-expanded/argocd-applicationset-directories}/apps/empty/.gitkeep (100%) rename test/fixtures/gitops-layouts/{03-argocd-applicationset-directories => 3-expanded/argocd-applicationset-directories}/apps/frontend/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{03-argocd-applicationset-directories => 3-expanded/argocd-applicationset-directories}/apps/frontend/service.yaml (100%) rename test/fixtures/gitops-layouts/{03-argocd-applicationset-directories => 3-expanded/argocd-applicationset-directories}/apps/platform/monitoring/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{03-argocd-applicationset-directories => 3-expanded/argocd-applicationset-directories}/apps/platform/monitoring/service.yaml (100%) rename test/fixtures/gitops-layouts/{03-argocd-applicationset-directories => 3-expanded/argocd-applicationset-directories}/apps/worker/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{03-argocd-applicationset-directories => 3-expanded/argocd-applicationset-directories}/bootstrap/applicationset.yaml (100%) rename test/fixtures/gitops-layouts/{04-argocd-applicationset-files => 3-expanded/argocd-applicationset-files}/README.md (99%) rename test/fixtures/gitops-layouts/{04-argocd-applicationset-files => 3-expanded/argocd-applicationset-files}/applicationset.yaml (100%) rename test/fixtures/gitops-layouts/{04-argocd-applicationset-files => 3-expanded/argocd-applicationset-files}/chart/Chart.yaml (100%) rename test/fixtures/gitops-layouts/{04-argocd-applicationset-files => 3-expanded/argocd-applicationset-files}/chart/templates/_helpers.tpl (100%) rename test/fixtures/gitops-layouts/{04-argocd-applicationset-files => 3-expanded/argocd-applicationset-files}/chart/templates/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{04-argocd-applicationset-files => 3-expanded/argocd-applicationset-files}/chart/templates/service.yaml (100%) rename test/fixtures/gitops-layouts/{04-argocd-applicationset-files => 3-expanded/argocd-applicationset-files}/chart/values.yaml (100%) rename test/fixtures/gitops-layouts/{04-argocd-applicationset-files => 3-expanded/argocd-applicationset-files}/deployments/dev/backend.yaml (100%) rename test/fixtures/gitops-layouts/{04-argocd-applicationset-files => 3-expanded/argocd-applicationset-files}/deployments/dev/frontend.yaml (100%) rename test/fixtures/gitops-layouts/{04-argocd-applicationset-files => 3-expanded/argocd-applicationset-files}/deployments/production/backend.yaml (100%) rename test/fixtures/gitops-layouts/{04-argocd-applicationset-files => 3-expanded/argocd-applicationset-files}/deployments/production/frontend.yaml (100%) rename test/fixtures/gitops-layouts/{12-multicluster-applicationset => 3-expanded/argocd-multicluster-matrix}/README.md (99%) rename test/fixtures/gitops-layouts/{12-multicluster-applicationset => 3-expanded/argocd-multicluster-matrix}/applicationsets/cluster-matrix.yaml (100%) rename test/fixtures/gitops-layouts/{12-multicluster-applicationset => 3-expanded/argocd-multicluster-matrix}/apps/backend/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{12-multicluster-applicationset => 3-expanded/argocd-multicluster-matrix}/apps/backend/service.yaml (100%) rename test/fixtures/gitops-layouts/{12-multicluster-applicationset => 3-expanded/argocd-multicluster-matrix}/apps/frontend/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{12-multicluster-applicationset => 3-expanded/argocd-multicluster-matrix}/apps/frontend/service.yaml (100%) rename test/fixtures/gitops-layouts/{12-multicluster-applicationset => 3-expanded/argocd-multicluster-matrix}/clusters/eu-production.yaml (100%) rename test/fixtures/gitops-layouts/{12-multicluster-applicationset => 3-expanded/argocd-multicluster-matrix}/clusters/staging.yaml (100%) rename test/fixtures/gitops-layouts/{12-multicluster-applicationset => 3-expanded/argocd-multicluster-matrix}/clusters/us-production.yaml (100%) rename test/fixtures/gitops-layouts/{12-multicluster-applicationset => 3-expanded/argocd-multicluster-matrix}/values/eu-production/backend.yaml (100%) rename test/fixtures/gitops-layouts/{12-multicluster-applicationset => 3-expanded/argocd-multicluster-matrix}/values/eu-production/frontend.yaml (100%) rename test/fixtures/gitops-layouts/{12-multicluster-applicationset => 3-expanded/argocd-multicluster-matrix}/values/staging/frontend.yaml (100%) rename test/fixtures/gitops-layouts/{12-multicluster-applicationset => 3-expanded/argocd-multicluster-matrix}/values/us-production/frontend.yaml (100%) rename test/fixtures/gitops-layouts/{10-flux-helmrelease => 3-expanded/flux-helmrelease}/README.md (99%) rename test/fixtures/gitops-layouts/{10-flux-helmrelease => 3-expanded/flux-helmrelease}/apps/frontend/helmrelease.yaml (100%) rename test/fixtures/gitops-layouts/{10-flux-helmrelease => 3-expanded/flux-helmrelease}/apps/frontend/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{10-flux-helmrelease => 3-expanded/flux-helmrelease}/apps/frontend/values.yaml (100%) rename test/fixtures/gitops-layouts/{10-flux-helmrelease => 3-expanded/flux-helmrelease}/clusters/production/apps.yaml (100%) rename test/fixtures/gitops-layouts/{10-flux-helmrelease => 3-expanded/flux-helmrelease}/clusters/production/flux-system/gotk-components.yaml (100%) rename test/fixtures/gitops-layouts/{10-flux-helmrelease => 3-expanded/flux-helmrelease}/clusters/production/flux-system/gotk-sync.yaml (100%) rename test/fixtures/gitops-layouts/{10-flux-helmrelease => 3-expanded/flux-helmrelease}/clusters/production/flux-system/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{10-flux-helmrelease => 3-expanded/flux-helmrelease}/clusters/production/infrastructure.yaml (100%) rename test/fixtures/gitops-layouts/{10-flux-helmrelease => 3-expanded/flux-helmrelease}/clusters/production/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{10-flux-helmrelease => 3-expanded/flux-helmrelease}/infrastructure/controllers/ingress-nginx/helmrelease.yaml (100%) rename test/fixtures/gitops-layouts/{10-flux-helmrelease => 3-expanded/flux-helmrelease}/infrastructure/controllers/ingress-nginx/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{10-flux-helmrelease => 3-expanded/flux-helmrelease}/infrastructure/controllers/ingress-nginx/values-configmap.yaml (100%) rename test/fixtures/gitops-layouts/{10-flux-helmrelease => 3-expanded/flux-helmrelease}/infrastructure/sources/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{10-flux-helmrelease => 3-expanded/flux-helmrelease}/infrastructure/sources/repositories.yaml (100%) create mode 100644 test/fixtures/gitops-layouts/3-expanded/flux-resourceset-inline/README.md create mode 100644 test/fixtures/gitops-layouts/3-expanded/flux-resourceset-inline/tenants/apps.yaml create mode 100644 test/fixtures/gitops-layouts/3-expanded/flux-resourceset-pull-requests/README.md create mode 100644 test/fixtures/gitops-layouts/3-expanded/flux-resourceset-pull-requests/previews/preview-envs.yaml rename test/fixtures/gitops-layouts/{16-flux-image-automation => 4-machine-written/flux-image-automation}/README.md (99%) rename test/fixtures/gitops-layouts/{16-flux-image-automation => 4-machine-written/flux-image-automation}/apps/frontend/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{16-flux-image-automation => 4-machine-written/flux-image-automation}/apps/frontend/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{16-flux-image-automation => 4-machine-written/flux-image-automation}/apps/frontend/service.yaml (100%) rename test/fixtures/gitops-layouts/{16-flux-image-automation => 4-machine-written/flux-image-automation}/clusters/production/apps.yaml (100%) rename test/fixtures/gitops-layouts/{16-flux-image-automation => 4-machine-written/flux-image-automation}/clusters/production/image-automation.yaml (100%) rename test/fixtures/gitops-layouts/{16-flux-image-automation => 4-machine-written/flux-image-automation}/clusters/production/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{16-flux-image-automation => 4-machine-written/flux-image-automation}/infrastructure/image-automation/imagepolicy.yaml (100%) rename test/fixtures/gitops-layouts/{16-flux-image-automation => 4-machine-written/flux-image-automation}/infrastructure/image-automation/imagerepository.yaml (100%) rename test/fixtures/gitops-layouts/{16-flux-image-automation => 4-machine-written/flux-image-automation}/infrastructure/image-automation/imageupdateautomation.yaml (100%) rename test/fixtures/gitops-layouts/{16-flux-image-automation => 4-machine-written/flux-image-automation}/infrastructure/image-automation/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{13-sops-encrypted => 5-opaque/sops-encrypted}/.sops.yaml (100%) rename test/fixtures/gitops-layouts/{13-sops-encrypted => 5-opaque/sops-encrypted}/README.md (99%) rename test/fixtures/gitops-layouts/{13-sops-encrypted => 5-opaque/sops-encrypted}/apps/frontend/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{13-sops-encrypted => 5-opaque/sops-encrypted}/apps/frontend/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{13-sops-encrypted => 5-opaque/sops-encrypted}/apps/frontend/secret.enc.yaml (100%) rename test/fixtures/gitops-layouts/{13-sops-encrypted => 5-opaque/sops-encrypted}/clusters/production/apps.yaml (100%) rename test/fixtures/gitops-layouts/{13-sops-encrypted => 5-opaque/sops-encrypted}/infrastructure/secrets/db-credentials.enc.yaml (100%) rename test/fixtures/gitops-layouts/{13-sops-encrypted => 5-opaque/sops-encrypted}/infrastructure/secrets/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{15-mixed-and-hostile => 6-hostile/mixed-and-hostile}/README.md (99%) rename test/fixtures/gitops-layouts/{15-mixed-and-hostile => 6-hostile/mixed-and-hostile}/application.yaml (100%) rename test/fixtures/gitops-layouts/{15-mixed-and-hostile => 6-hostile/mixed-and-hostile}/ci/.gitlab-ci.yml (100%) rename test/fixtures/gitops-layouts/{15-mixed-and-hostile => 6-hostile/mixed-and-hostile}/ci/docker-compose.yml (100%) rename test/fixtures/gitops-layouts/{15-mixed-and-hostile => 6-hostile/mixed-and-hostile}/crossplane/composition.yaml (100%) rename test/fixtures/gitops-layouts/{15-mixed-and-hostile => 6-hostile/mixed-and-hostile}/empty-dir/.gitkeep (100%) rename test/fixtures/gitops-layouts/{15-mixed-and-hostile => 6-hostile/mixed-and-hostile}/kro/resourcegraphdefinition.yaml (100%) rename test/fixtures/gitops-layouts/{15-mixed-and-hostile => 6-hostile/mixed-and-hostile}/kustomization.yaml (100%) rename test/fixtures/gitops-layouts/{15-mixed-and-hostile => 6-hostile/mixed-and-hostile}/mixed/bundle.yaml (100%) rename test/fixtures/gitops-layouts/{15-mixed-and-hostile => 6-hostile/mixed-and-hostile}/mixed/deployment.json (100%) rename test/fixtures/gitops-layouts/{15-mixed-and-hostile => 6-hostile/mixed-and-hostile}/mixed/service.yml (100%) rename test/fixtures/gitops-layouts/{15-mixed-and-hostile => 6-hostile/mixed-and-hostile}/secrets/db.enc.yaml (100%) rename test/fixtures/gitops-layouts/{15-mixed-and-hostile => 6-hostile/mixed-and-hostile}/templates/deployment.yaml (100%) rename test/fixtures/gitops-layouts/{15-mixed-and-hostile => 6-hostile/mixed-and-hostile}/values.yaml (100%) diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index bfb22bbd..1d6e2a33 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -18,7 +18,13 @@ }, "runArgs": [ "--group-add=docker", - "--add-host=host.docker.internal:host-gateway" + "--add-host=host.docker.internal:host-gateway", + // Cap the devcontainer so a runaway build/lint/test is OOM-killed inside the + // container instead of starving the remote host. Note this bounds only what runs + // *in here*: docker-outside-of-docker means e2e's k3d containers are siblings on + // the host daemon and are not covered by this limit. + "--memory=12g", + "--memory-swap=16g" ], "forwardPorts": [ 13000, diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0c8c2500..11329e37 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -717,7 +717,7 @@ jobs: # equals what `full` ran — so no spec is added or dropped, the work is # just split across two clusters. The membership is a provisional # first cut; rebalance from the e2e-ginkgo-reports-* per-spec timings - # (docs/design/e2e-ci-runner-sharding-plan.md, "balance from real data"). + # (docs/finished/e2e-ci-runner-sharding-plan.md, "balance from real data"). # Each shard runs config-dir installs (GOCOVERDIR overlay) and collects # coverage; Codecov unions same-flag `e2e` uploads, so merged coverage # is the union of both shards — the non-regression ratchet still holds. @@ -729,7 +729,7 @@ jobs: coverage: "1" # Bumped 1 -> 4: the full suite was serialized to avoid the # cross-target rule-change snapshot coupling, now fixed (per-target - # effective watch plan — docs/design/gittarget-isolation-on-rule-change.md). + # effective watch plan — docs/spec/gittarget-isolation-on-rule-change.md). e2e_ginkgo_procs: "4" k3d_agent_count: "0" - name: full-core @@ -747,7 +747,7 @@ jobs: # only place gitops-reverser shares a path with a foreign GitOps engine. # Its own runner (hence its own cluster) is what keeps the Argo CD # install off the other three legs. - # docs/design/e2e-bi-directional-corner.md. + # docs/spec/e2e-bi-directional-corner.md. # # `task test-e2e-bi-directional` pins its own label filter and Ginkgo # procs (BI_DIRECTIONAL_GINKGO_PROCS), so e2e_label_filter and diff --git a/.golangci.yml b/.golangci.yml index 2a32be16..20b94273 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -370,6 +370,11 @@ linters: # traffic generation, and operator-supplied target URLs. - path: 'test/loadtest/.*\.go' linters: [depguard, forbidigo, gochecknoglobals, gosec, mnd] + # The doc-link checker is a standalone dev CLI: printing its report to the + # console is its entire purpose, and it necessarily stats paths it read out of + # a markdown link (it only ever stats them — it never opens or writes them). + - path: 'hack/doccheck/.*\.go' + linters: [forbidigo, gosec] # Allow fmt.Println in metrics exporter (initialization logs) - path: 'internal/telemetry/.*\.go' linters: [forbidigo] diff --git a/Taskfile-build.yml b/Taskfile-build.yml index a00a8040..be555d53 100644 --- a/Taskfile-build.yml +++ b/Taskfile-build.yml @@ -19,7 +19,7 @@ vars: ENVTEST_STAMP: '.stamps/envtest-{{.ENVTEST_K8S_VERSION}}.ready' # Fuzzing (dynamic analysis) targets, one "package:FuzzTarget" pair per line. # `go test -fuzz` fuzzes exactly one target per invocation, so the fuzz tasks - # loop over these. See docs/design/dynamic-analysis-fuzzing-plan.md. + # loop over these. See docs/finished/dynamic-analysis-fuzzing-plan.md. FUZZ_TARGETS: >- ./internal/git/manifestedit:FuzzManifestEdit ./internal/webhook:FuzzDecodeEventList @@ -184,7 +184,7 @@ tasks: desc: >- Release-time dynamic analysis — longer fuzz discovery run per target under the race detector. Crash reproducers land under /testdata/fuzz// (commit them). - See docs/design/dynamic-analysis-fuzzing-plan.md. + See docs/finished/dynamic-analysis-fuzzing-plan.md. cmds: - | set -eu @@ -213,10 +213,28 @@ tasks: # from markdown -- they never look inside a Go comment for a repo-relative doc path. # Those are the references that rot silently, and seventeen of them were dangling # before this check was written. + # These globs are scoped per top-level tree on purpose. An unrooted '**/*.go' + # makes Task walk every path under the repo root -- including the 1.2 GB of + # upstream checkouts in external-sources/ and the build output in bin/ -- and + # fingerprinting that tree costs tens of GB of RAM inside the Task process + # itself, which is enough to OOM the host. doccheck only ever reads git-tracked + # files (it shells out to `git ls-files`), so these mirror the trees that hold + # them. Add a tree here if tracked .md/.go ever lands outside these. sources: - - '**/*.md' - - '**/*.go' - - hack/doccheck/main.go + - '*.md' + - .devcontainer/**/*.md + - .github/**/*.md + - charts/**/*.md + - config/**/*.md + - docs/**/*.md + - internal/**/*.md + - test/**/*.md + - api/**/*.go + - cmd/**/*.go + - hack/**/*.go + - internal/**/*.go + - pkg/**/*.go + - test/**/*.go cmds: - go run ./hack/doccheck @@ -232,7 +250,9 @@ tasks: sources: - api/**/*.go - cmd/**/*.go + - hack/**/*.go - internal/**/*.go + - pkg/**/*.go - test/**/*.go - .golangci.yml - go.mod @@ -294,6 +314,21 @@ tasks: cmds: - '{{.SCC}} --exclude-dir external-sources,vendor,bin,dist {{.CLI_ARGS}}' + gitops-layouts-baseline: + desc: Regenerate the GitOps layout corpus behavioural baseline (test/fixtures/gitops-layouts/support-today.md) + # The baseline is generated, never hand-edited, so that a change to the + # acceptance boundary shows up in review as a diff of exactly which fixtures + # moved and in which direction. See test/fixtures/gitops-layouts/README.md. + sources: + - test/fixtures/gitops-layouts/**/* + - internal/manifestanalyzer/**/*.go + - cmd/manifest-analyzer/**/*.go + - hack/gitops-layouts-baseline.sh + generates: + - test/fixtures/gitops-layouts/support-today.md + cmds: + - bash hack/gitops-layouts-baseline.sh + build: desc: Build manager binary deps: diff --git a/charts/gitops-reverser/templates/validate-operator-types-webhook.yaml b/charts/gitops-reverser/templates/validate-operator-types-webhook.yaml index 3cfdc20a..1ca2408a 100644 --- a/charts/gitops-reverser/templates/validate-operator-types-webhook.yaml +++ b/charts/gitops-reverser/templates/validate-operator-types-webhook.yaml @@ -5,7 +5,7 @@ # wait. Narrow by construction: one rule per command kind. failurePolicy is Ignore and # the handler always allows, so a user's CommitRequest never depends on this webhook — # a miss degrades to a committer-authored commit (AuthorAttributed=False). -# See docs/design/commitrequest-admission-authorship.md §4. +# See docs/spec/commitrequest-admission-authorship.md §4. apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: diff --git a/charts/gitops-reverser/values.yaml b/charts/gitops-reverser/values.yaml index 9d893028..47b8f761 100644 --- a/charts/gitops-reverser/values.yaml +++ b/charts/gitops-reverser/values.yaml @@ -107,7 +107,7 @@ servers: # attribution governs *mirrored-resource* authorship (from audit), this governs # *command* authorship (from admission). Off → CommitRequests commit as the configured # committer and report AuthorAttributed=False. See - # docs/design/commitrequest-admission-authorship.md. + # docs/spec/commitrequest-admission-authorship.md. # # Command-author capture is Redis-backed: the captured author is written to Redis at admission and # read back at reconcile. Enabled by default so the webhook is always installed, but it is a no-op diff --git a/config/webhook/validating-webhook.yaml b/config/webhook/validating-webhook.yaml index 0f7b1ea9..b4b96ea8 100644 --- a/config/webhook/validating-webhook.yaml +++ b/config/webhook/validating-webhook.yaml @@ -20,7 +20,7 @@ metadata: # kinds (a CommitRequest today) at admission. This one IS product behavior and is # packaged in the chart (charts/.../templates/validate-operator-types-webhook.yaml); the # entry here is the e2e SUT's copy. See -# docs/design/commitrequest-admission-authorship.md §4. +# docs/spec/commitrequest-admission-authorship.md §4. # # The cert-manager.io/inject-ca-from annotation injects the admission server CA bundle # for every webhook in this configuration. diff --git a/docs/INDEX.md b/docs/INDEX.md index b39c8aec..a3ac1c4c 100644 --- a/docs/INDEX.md +++ b/docs/INDEX.md @@ -62,7 +62,10 @@ misled. Full list in [`spec/README.md`](spec/README.md); the ones that carry a existing GitOps folders through the Kubernetes API. Start at its [README](design/gitops-api/README.md) for the feature ladder (F1–F8), then [`support-contract.md`](design/gitops-api/support-contract.md) — **the single page that -says what we support and refuse**. +says what we support and refuse** — and +[`the-layer-above-and-the-expansion-graph.md`](design/gitops-api/the-layer-above-and-the-expansion-graph.md), +which draws the architecture the product is heading for (kcp + Flux + Argo CD above +this operator) and names the one question every layer must agree on. Nine other open items: diff --git a/docs/alternatives.md b/docs/alternatives.md index 96302576..2cb0580a 100644 --- a/docs/alternatives.md +++ b/docs/alternatives.md @@ -23,12 +23,27 @@ It is weaker when you want: | Tool | What it does well | Where GitOps Reverser differs | |---|---|---| +| [syngit-org/syngit](https://github.com/syngit-org/syngit) | Reverse GitOps with admission webhooks: commit the change to Git first, then let it reach the cluster | GitOps Reverser observes changes after they are admitted, so it never sits in the write path | | [robusta-dev/robusta](https://github.com/robusta-dev/robusta) | Observability, alert enrichment, automation workflows | GitOps Reverser is much narrower and focused on Git write-back | | [RichardoC/kube-audit-rest](https://github.com/RichardoC/kube-audit-rest) | Audit-event collection without the full Git write-back model | GitOps Reverser goes further into sanitization, Git shaping, and repo-oriented workflows | | [bpineau/katafygio](https://github.com/bpineau/katafygio) | Snapshotting cluster resources into Git | GitOps Reverser is event-driven and commit-oriented rather than snapshot-first | ## When another option may be better +### You want Git to gate the change, not record it + +Syngit is the closest neighbour to GitOps Reverser: it also turns live cluster changes into commits, +so that people can keep using a UI or `kubectl` without Git falling behind. + +The difference is where it sits. Syngit intercepts writes with a validating webhook and commits them +before the change is applied — if the push fails, the resource is not admitted. That keeps Git strictly +in the lead, at the cost of putting your Git provider in the critical path of every matched write. + +GitOps Reverser works from audit events, after the API server has already admitted the change. Git +converges a moment later instead of gating the write, so an unreachable Git host slows down write-back +rather than blocking the cluster. Pick Syngit if a change that never reached Git must never reach the +cluster either; pick GitOps Reverser if the write path must stay available regardless of Git. + ### You mainly want observability If the real goal is alerting, enrichment, remediations, or incident workflows, a broader platform @@ -50,6 +65,7 @@ about than an event-driven commit stream. If you are evaluating the space, ask these questions first: - Do we control the kube-apiserver audit webhook configuration? +- Should a failed Git push block the change from reaching the cluster, or only delay the commit? - Do we care about per-change history, or is a periodic snapshot enough? - Do we need deployable manifests in Git, or only an audit record? - Are we trying to support API-first workflows, or replace them? diff --git a/docs/design/gitops-api/README.md b/docs/design/gitops-api/README.md index d854cfc0..6ac3366d 100644 --- a/docs/design/gitops-api/README.md +++ b/docs/design/gitops-api/README.md @@ -11,7 +11,8 @@ | Topic | Docs | |---|---| | **The boundary** | [support-contract.md](support-contract.md) — the single statement · [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md) — field taxonomy + layout allowlist · [gittarget-granularity-and-cross-environment-edits.md](gittarget-granularity-and-cross-environment-edits.md) — **the write boundary; the one home of fan-in = 1** | -| **Orchestrators & expansion** | [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md) — renderability vs ownership; claims about paths · [expansion-boundary-and-corpus-organisation.md](expansion-boundary-and-corpus-organisation.md) — provenance; ApplicationSet vs ResourceSet; Helm · [argocd-bi-directional.md](argocd-bi-directional.md) — why `selfHeal` is incompatible | +| **Architecture** | [the-layer-above-and-the-expansion-graph.md](the-layer-above-and-the-expansion-graph.md) — **the stack (kcp + Flux + Argo CD above this operator), the expansion graph, and what kcp does and does not solve** | +| **Orchestrators & expansion** | [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md) — renderability vs ownership; claims about paths · [expansion-boundary-and-corpus-organisation.md](expansion-boundary-and-corpus-organisation.md) — provenance; ApplicationSet vs ResourceSet; Helm · [`../../facts/expansion-provenance-markers.md`](../../facts/expansion-provenance-markers.md) — **the measured markers** · [argocd-bi-directional.md](argocd-bi-directional.md) — why `selfHeal` is incompatible | | **Documents & secrets** | [resource-capability-model.md](resource-capability-model.md) — what may I do to this document · [write-only-encrypted-secrets.md](write-only-encrypted-secrets.md) — SOPS · [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md) | | **Topology** | [intent-cluster-hydration.md](intent-cluster-hydration.md) — how objects get into the cluster to be edited | | **Edits with no home** | [unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md) | diff --git a/docs/design/gitops-api/expansion-boundary-and-corpus-organisation.md b/docs/design/gitops-api/expansion-boundary-and-corpus-organisation.md index e66d15b2..d833d1b0 100644 --- a/docs/design/gitops-api/expansion-boundary-and-corpus-organisation.md +++ b/docs/design/gitops-api/expansion-boundary-and-corpus-organisation.md @@ -1,15 +1,37 @@ # The expansion boundary, and how to organise this material -> Status: proposal; ships no code. Reorganisation + one new axis. -> Captured: 2026-07-11 +> Status: **partly executed.** The corpus reorganisation and the generated baseline +> shipped (2026-07-13); the provenance gate remains unbuilt. The catalogue below is +> no longer inferred — every marker in it has now been **measured against live +> controllers**, and one of its central assumptions did not survive. +> Captured: 2026-07-11 · Measured: 2026-07-13 > Related: > [README.md](README.md), +> [support-contract.md](support-contract.md), +> [the-layer-above-and-the-expansion-graph.md](the-layer-above-and-the-expansion-graph.md) — **the architecture this axis serves**, +> [../../facts/expansion-provenance-markers.md](../../facts/expansion-provenance-markers.md) — **the measurements**, > [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md), > [resource-capability-model.md](resource-capability-model.md), > [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md), > [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md), > the layout corpus at [`test/fixtures/gitops-layouts/`](../../../test/fixtures/gitops-layouts/) +## What the measurements changed + +This doc was written from upstream source reading. It has since been checked against +real Flux, flux-operator, and Argo CD, and the results are pinned as a runnable e2e +spec ([`test/e2e/provenance_markers_e2e_test.go`](../../../test/e2e/provenance_markers_e2e_test.go), +`task test-e2e-bi-directional`). Three things moved: + +1. **The structural claim held, and is now proven** — ApplicationSet generates + *pointers into Git*, ResourceSet generates *the KRM itself*. See + [the graph](the-layer-above-and-the-expansion-graph.md). +2. **The `ownerReference` gate is worse than "incomplete" — it catches one producer + in five.** Neither HelmRelease-rendered objects nor ResourceSet children carry an + `ownerReference` *at all*. Defect 1 below is stronger than it was written. +3. **`EnumeratedBy` is proven.** `mkdir` + commit, with no CR authored, deployed an + app; authoring the CR as well produced exactly the predicted duplicate fight. + ## What this proposes Three things, in order of importance: @@ -26,7 +48,7 @@ Three things, in order of importance: 3. **A topical spine for the corpus and the docs**, so new material has an obvious home instead of a new number. -The corpus's 16 fixtures raise 95 open questions. They are not 95 decisions. They +The corpus's fixtures raise 95 open questions. They are not 95 decisions. They compress to five, and the fifth is the one we have never written down. ## The finding: expansion is a third axis @@ -80,7 +102,9 @@ produces — which is also what the tools themselves tell users not to do. ## The expansion catalogue -Verified against the upstream checkouts in `external-sources/`, not from memory. +Originally verified against the upstream checkouts in `external-sources/`. Since +2026-07-13 the first three rows are **measured on live objects** — see +[`expansion-provenance-markers.md`](../../facts/expansion-provenance-markers.md). ### The structural asymmetry that decides everything @@ -135,43 +159,51 @@ objects that exist only in the cluster: | Authored document (intent) | Controller | Expansion (live only) | Ownership evidence on the child | |---|---|---|---| -| Argo CD `ApplicationSet` | applicationset-controller | `Application` CRs | `ownerReference` ✅ verified | -| flux-operator `ResourceSet` | flux-operator | `spec.resources` × inputs | `resourceset.fluxcd.controlplane.io/{name,namespace}` labels + `status.inventory`; **no `ownerReference`** ✅ verified | -| Flux `HelmRelease` | helm-controller | the chart's rendered objects | labels, not an `ownerReference` — exact keys **unverified**, see below | -| KRO `ResourceGraphDefinition` + instance | kro | the graph's objects | `kro.run/*` labels (inferred from our own `sanitize` strip list) | -| Crossplane `Composition` + XR | crossplane | composed resources | `ownerReference` (unverified) | +| Argo CD `ApplicationSet` | applicationset-controller | `Application` CRs | `ownerReference` — **measured** | +| flux-operator `ResourceSet` | flux-operator | `spec.resources` × inputs | `resourceset.fluxcd.controlplane.io/{name,namespace}` labels + `status.inventory`; **no `ownerReference`** — **measured** | +| Flux `HelmRelease` | helm-controller | the chart's rendered objects | `helm.toolkit.fluxcd.io/{name,namespace}` labels + `meta.helm.sh/release-*` annotations; **no `ownerReference`** — **measured** | +| KRO `ResourceGraphDefinition` + instance | kro | the graph's objects | `kro.run/*` labels (inferred from our own `sanitize` strip list — still unmeasured) | +| Crossplane `Composition` + XR | crossplane | composed resources | `ownerReference` (still unmeasured) | | `ExternalSecret` | external-secrets | a `Secret` | `ownerReference` (per `sealed-secrets-and-external-secrets.md`) | | `SealedSecret` | sealed-secrets | a `Secret` | `ownerReference` (per `sealed-secrets-and-external-secrets.md`) | Consistent rule, at least three different kinds of evidence. Which is exactly the -problem. +problem — and the measurements made it worse than this table originally admitted. + +The top three rows are now **observed on live objects**, not read from source; the +full evidence, including the field-manager signal this doc never considered, is in +[`expansion-provenance-markers.md`](../../facts/expansion-provenance-markers.md). +KRO and Crossplane remain unmeasured and are the obvious next lab. -Only the first two rows are verified against upstream source in this pass — -`external-sources/` carries argo-cd and flux-operator, but not helm-controller, -kro, or crossplane. **Confirming the exact provenance marker for each remaining row -is a prerequisite for building the gate**, and is the first task this proposal -implies. The structural claim ("no home file, therefore never mirror it") does not -depend on which marker it turns out to be; the *implementation* of the gate depends -on it entirely. +The structural claim ("no home file, therefore never mirror it") never depended on +which marker it turned out to be. The *implementation* of the gate depends on it +entirely — and it turns out the markers are three incompatible vocabularies with one +trap in the middle of them (defect 1). ## Three defects this exposes -### 1. The derived-object gate keys on evidence that half these controllers do not emit +### 1. The derived-object gate keys on evidence that four of these five controllers do not emit [resource-capability-model.md](resource-capability-model.md) knob 4 and [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md) both define `derived` as *"Evidence: a controller `ownerReference` on the live -object."* Against the table above, that test: - -- **catches** ApplicationSet children (verified: the controller calls - `controllerutil.SetControllerReference` on every generated `Application`), and — - per the secrets doc — ESO- and sealed-secrets-derived `Secret`s; -- **misses ResourceSet children entirely** — flux-operator uses owner labels plus a - status inventory, never an `ownerReference` (verified: no `SetControllerReference` - anywhere in `resourceset_controller.go` or `internal/builder/`); -- **probably misses HelmRelease-rendered objects**, which are labelled rather than - owner-referenced (the exact keys need confirming against helm-controller, which is - not checked out). +object."* + +**Measured against live controllers, that test catches one producer in five.** + +| Producer | Sets an `ownerReference`? | +|---|---| +| Argo CD `ApplicationSet` → `Application` | **yes** | +| Argo CD `Application` → workload | no | +| Flux `Kustomization` → workload | no | +| Flux `HelmRelease` → workload | **no** — and this one must be refused | +| flux-operator `ResourceSet` → anything | **no** — and this one must be refused | + +The two rows in bold are the failure. Both are objects with **no home in Git**, both +are objects the gate exists to refuse, and **neither carries a single +`ownerReference`**. A gate keyed on one would mirror both — which is precisely the +outcome it was designed to prevent. (ESO- and sealed-secrets-derived `Secret`s *do* +carry one, per the secrets doc; they are not the problem.) An `ownerReference` is neither necessary nor sufficient. And a label alone is not sufficient either, which is the subtle half: @@ -180,6 +212,19 @@ sufficient either, which is the subtle half: > label (`kustomize.toolkit.fluxcd.io/name`). It is **not** derived — it has a > home file, and mirroring it is exactly right. +The measurements sharpen that into a trap with a name: + +``` +kustomize.toolkit.fluxcd.io/name → source is a folder of files → MIRROR IT +helm.toolkit.fluxcd.io/name → source is a chart → NEVER MIRROR +``` + +**Sibling prefixes. Same vendor. Opposite verdicts.** Any rule of the form "gate on +`*.toolkit.fluxcd.io/`" gets exactly one of these two backwards, and it is a coin +flip which. This is the empirical core of the argument that provenance cannot be +collapsed into a field check: *the field is the same in both rows, and the answer is +not.* + So the real test is not "did a controller touch this object?" but: > **Does this object have a home in Git?** — and the answer depends on *which* @@ -190,14 +235,14 @@ That is a **Tier 2 claim**, not a Tier 0 field check. It belongs in the interpre registry the [boundary doc](orchestrator-knowledge-boundary.md) already proposes, as a small table keyed by provenance marker: -| Provenance marker on the live object | What the controller's source is | Verdict | -|---|---|---| -| `kustomize.toolkit.fluxcd.io/name` | a folder in Git | has a home → **mirror it** | -| `argocd.argoproj.io/tracking-id` | a folder in Git | has a home → **mirror it** | -| `resourceset.fluxcd.controlplane.io/name` | a CR's `spec.resources` | no home → **never mirror** | -| `helm.toolkit.fluxcd.io/name` (keys to confirm) | a chart | no home → **never mirror** | -| `kro.run/*` | a `ResourceGraphDefinition` | no home → **never mirror** | -| controller `ownerReference` | another object | no home → **never mirror** | +| Provenance marker on the live object | Applying manager | What the controller's source is | Verdict | +|---|---|---|---| +| `kustomize.toolkit.fluxcd.io/name` | `kustomize-controller` | a folder in Git | has a home → **mirror it** | +| `argocd.argoproj.io/tracking-id` | `argocd-controller` | a folder in Git | has a home → **mirror it** | +| `resourceset.fluxcd.controlplane.io/name` | `flux-operator` | a CR's `spec.resources` | no home → **never mirror** | +| `helm.toolkit.fluxcd.io/name` | `helm-controller` | a chart | no home → **never mirror** | +| `kro.run/*` | (unmeasured) | a `ResourceGraphDefinition` | no home → **never mirror** | +| controller `ownerReference` | — | another object | no home → **never mirror** | Note the first two rows: these objects are *applied by a controller* and must still be mirrored, because the controller's source is a folder of files. That is why @@ -205,6 +250,13 @@ be mirrored, because the controller's source is a folder of files. That is why Git?" is the right one — and why this table cannot be replaced by a single field check. +The **applying manager** column is new, and it is the one genuinely encouraging +result of the measurements: `metadata.managedFields[].manager` is the only channel +that speaks *one* vocabulary across all five producers, where the labels and +owner-references speak three. It is not a sole primary key — managers accumulate, so +it is evidence about who applied a field rather than a unique owner — but it is the +strongest single signal available and no design here had considered it. + ### 2. We destroy the provenance evidence before anything gates on it This is now a pattern with three instances, and it is the same bug each time: @@ -221,19 +273,33 @@ is thrown away by the code whose job is to decide what a document looks like onc we have already decided to write it. **The gate must run before the sanitizer, on the live object, not on the sanitized document.** -### 3. ResourceSet owner labels would leak into Git today +### 3. Three families of controller bookkeeping would leak into Git today `isOperationalLabel` strips `kustomize.toolkit.fluxcd.io/`, `kro.run/`, and -`applyset.kubernetes.io/`. It does **not** strip -`resourceset.fluxcd.controlplane.io/{name,namespace}`. Our code contains **zero** -occurrences of `ResourceSet`, `ApplicationSet`, or `fluxcd.controlplane.io` — we -know nothing about these kinds. +`applyset.kubernetes.io/`. Measured against live objects, it does **not** strip any +of these — and all three were observed on real workloads: + +| Key | Stamped by | Observed on | +|---|---|---| +| `helm.toolkit.fluxcd.io/{name,namespace}` (labels) | helm-controller | every chart-rendered object | +| `resourceset.fluxcd.controlplane.io/{name,namespace}` (labels) | flux-operator | every ResourceSet child | +| `meta.helm.sh/release-{name,namespace}` (annotations) | Helm, via helm-controller | every chart-rendered object | + +Our code contains **zero** occurrences of `ResourceSet`, `ApplicationSet`, or +`fluxcd.controlplane.io` — we know nothing about these kinds. This is the same family as the Argo CD `tracking-id` hazard already documented in -`types.go`: controller bookkeeping committed to Git, where it is read back as -intent. It is currently moot only because the gate above would refuse the object -outright — but if the gate lands keyed on `ownerReference`, the object is mirrored -*and* the labels leak. +`types.go`: controller bookkeeping committed to Git, where it is read back as intent. +It is currently moot only because the gate above would refuse these objects +outright — but the gate is unbuilt, and if it lands keyed on `ownerReference` +(defect 1) the objects are mirrored **and** the labels leak. The two defects +compound. + +Deliberately *not* on that list: `app.kubernetes.io/managed-by: Helm` and +`helm.sh/chart`. Both are chart-authored labels a user may legitimately want in Git, +and both are indistinguishable from the same labels set by hand — the same trap as +Argo CD's `app.kubernetes.io/instance` under `label` tracking. Stripping them would +delete intent. ## The construct catalogue — the support statement @@ -308,7 +374,7 @@ applies: | ApplicationSet `git.directories`, ResourceSetInputProvider | add the manifests / an input **and author no CR** — the generator picks it up | a **duplicate** `Application` that fights the generator | The third row is why the corpus keeps asking *"is creating a folder itself a -deployment operation?"* (fixtures 03, 04). It is. The directory listing is a field +deployment operation?"* (the two ApplicationSet fixtures). It is. The directory listing is a field of desired state. This needs exactly **one new claim** in the vocabulary the @@ -348,7 +414,7 @@ template" does not, and never will. The honest caveat: a fan-in-1 edit into `spec.resources[i]` is an edit to a KRM document **nested inside another KRM document**, and the writer has no concept of -that today. Fixture 15's "KRM never nests KRM" assumption-breaker is exactly this, +that today. The `mixed-and-hostile` fixture's "KRM never nests KRM" assumption-breaker is exactly this, and ResourceSet/KRO/Crossplane make it mainstream rather than hostile. ## The strategic note worth recording @@ -365,61 +431,54 @@ mean the ResourceSet answer ("edit the CR, edit its inputs, never its children") a **launch-relevant** story rather than a future one, and it is a story we can tell well and cheaply, because the CR is one editable document. -## Proposed organisation - -### The corpus: group by axis, not by number - -The fixture numbers `01`–`16` carry no meaning and related shapes sit far apart -(05 and 14 are both "Git holds a renderer's output"; 03, 04, and 12 are all -ApplicationSet). The corpus drives no test and nothing depends on the paths, so -regrouping is cheap **now** and expensive after the first golden report pins a path. - -```text -test/fixtures/gitops-layouts/ -├── README.md # the map: axis → family → fixture -├── support-today.md # GENERATED baseline, not pasted (see below) -├── 1-desired-state/ # the files ARE the objects — first-class target -│ ├── argocd-plain/ (01) -│ └── repo-per-environment/ (11) -├── 2-rendered/ # the files are INPUTS to an offline renderer -│ ├── kustomize-overlays/ (05) -│ ├── helm-chart/ (06) -│ ├── helm-environment-values/ (07) -│ ├── argocd-external-helm/ (08) -│ └── rendered-manifests/ (14) -├── 3-expanded/ # a CONTROLLER materialises the objects ← the new family -│ ├── argocd-app-of-apps/ (02) -│ ├── argocd-applicationset-directories/ (03) -│ ├── argocd-applicationset-files/ (04) -│ ├── argocd-multicluster-matrix/ (12) -│ ├── flux-monorepo/ (09) -│ ├── flux-helmrelease/ (10) -│ ├── flux-resourceset-inline/ NEW — inline KRM + inputs, << >> templating -│ ├── flux-resourceset-pull-requests/ NEW — ResourceSetInputProvider; inputs not in Git -│ └── kro-and-crossplane/ NEW — extracted from 15; KRM nested in KRM -├── 4-machine-written/ # Git is an OUTPUT -│ ├── flux-image-automation/ (16) -│ └── argocd-image-updater/ NEW — extracted from 05's .argocd-source dotfile -├── 5-opaque/ # the object is not the object -│ ├── sops-encrypted/ (13) -│ ├── sealed-secrets/ NEW -│ └── external-secrets/ NEW -└── 6-hostile/ # parser edges - └── mixed-and-hostile/ (15) -``` +## The organisation — done (2026-07-13) + +### The corpus: grouped by axis, not by number + +Shipped. The fixture numbers `01`–`16` carried no meaning and related shapes sat far +apart. The corpus drives no test and nothing depended on the paths, so the regroup +was cheap — and is now done, before the first golden report could pin a path. + +The tree is in [the corpus README](../../../test/fixtures/gitops-layouts/README.md). +Six families, one per decision the corpus forces, and `ls` now shows the model +instead of hiding it. + +**One correction to the proposal, and the axis is what caught it.** This doc +originally filed `argocd-app-of-apps` (02) and `flux-monorepo` (09) under +`3-expanded`. That is wrong, and it is exactly the mistake the provenance axis exists +to prevent: + +- an app-of-apps' child `Application`s are **files a human wrote and committed**; +- a Flux `Kustomization` points at a **folder of real files**, and the measurements + confirm its applied objects carry `kustomize.toolkit.fluxcd.io/*` — the marker that + means *has a home → mirror it*. + +Nothing in either is synthesised. Both involve a controller; neither is expansion. +They live in `1-desired-state`, and `3-expanded` is reserved for what the name +says: **a controller materialises objects that have no home file.** The authored CR +in those fixtures is itself ordinary editable intent; it is its *output* that has +nowhere to go. + +Two of the proposed new fixtures shipped — +[`flux-resourceset-inline`](../../../test/fixtures/gitops-layouts/3-expanded/flux-resourceset-inline/) +(nine live objects, zero files) and +[`flux-resourceset-pull-requests`](../../../test/fixtures/gitops-layouts/3-expanded/flux-resourceset-pull-requests/) +(the input set is not in the repository at all). `kro-and-crossplane`, +`argocd-image-updater`, `sealed-secrets`, and `external-secrets` remain wanted, and +are now named as gaps in the corpus README rather than left as oversights. -Six families, one per decision the corpus actually forces. A new fixture now has an -obvious home, and `ls` shows the model instead of hiding it. +### The baseline is generated now -If the rename is judged too much churn, the fallback is to keep the flat numbering -and carry `family` + `axis` in a `fixtures.yaml` manifest — but I would rather pay -the churn once, while nothing depends on the paths. +`support-today.md` is generated by `task gitops-layouts-baseline`, not pasted. It +carries no interpretation: when it disagrees with the support contract, that +disagreement is the backlog. -**Also**: `support-today.md` should be **generated** by a task target, not pasted. -That turns the corpus from documentation into a behavioural baseline, so any change -to the acceptance gate shows up in the pull request as a diff of exactly which -fixtures moved and in which direction. The boundary doc already argues this; it is -the single cheapest thing on this list. +It earned its keep immediately. Both new ResourceSet fixtures report **"All reported +candidates accepted"** — the analyzer sees an ordinary editable plain folder and says +so. It would onboard, as fully supported, a repository whose nine workloads have no +files, and one whose object set cannot be determined without a GitHub token. The gap +was invisible while ResourceSet was absent from the corpus; it is now a line in a +checked-in baseline. ### The docs: one new page, one new topic, and stop restating @@ -539,7 +598,7 @@ Read that table and the honest headline is not "no Helm." It is: ### The one real gap, and the precedent that closes it The genuine hole is the **free-standing values file** — `values/production.yaml`, -`values/common.yaml` — which fixtures 07, 08, and 12 are all built around. It is +`values/common.yaml` — which `helm-environment-values`, `argocd-external-helm`, and `argocd-multicluster-matrix` are all built around. It is not KRM, so nothing hydrates it into the intent cluster, so there is no object for a user to edit. @@ -577,17 +636,35 @@ report, not a standard, and it is achievable. ## Residual open questions -1. **Argo CD's triggered-hydration handshake is still unproven in e2e.** Decision 1 - guarantees Argo CD will be *available*; it does not prove the `Refresh` + - `selfHeal: false` handshake converges the way the Flux one does - ([bi-directional.md](../../bi-directional.md) says the same). Still the largest - untested assumption under the intent cluster. +1. ~~**Argo CD's triggered-hydration handshake is still unproven in e2e.**~~ + **Closed.** The `selfHeal: false` + push-webhook loop, with a shared field changing + from *both* sides, is exercised against a real Argo CD in the bi-directional corner + ([`argocd_bi_directional_e2e_test.go`](../../../test/e2e/argocd_bi_directional_e2e_test.go)), + alongside its `selfHeal: true` foil where the edit is lost. What remains untested is + not the handshake but its *target*: whether either engine can drive a **kcp + workspace** rather than a real cluster. That is now the largest untested assumption, + and it has moved to + [the-layer-above-and-the-expansion-graph.md](the-layer-above-and-the-expansion-graph.md). 2. **What exactly makes a chart a chart?** Decision 4 says "recognisable folder - structure." `Chart.yaml` + `templates/` is the obvious test, but fixture 15 + structure." `Chart.yaml` + `templates/` is the obvious test, but `mixed-and-hostile` plants a `templates/` directory with **no** `Chart.yaml` and unparseable content precisely to break it. Which signal is load-bearing, and what happens to a chart vendored under `charts/` inside another chart? 3. **Does the provenance gate run on the live object or the sanitized document?** - The evidence (`ownerReferences`, `kro.run/` labels) is destroyed by `sanitize`, - so the gate must run first — but nothing in the pipeline is structured that way - today. This is the one decision that blocks implementation. + Still the one decision that blocks implementation, and the measurements make it + sharper: `sanitize` destroys `ownerReferences` and `kro.run/` labels, and the gate's + *best* signal — the applying field manager — lives in `metadata.managedFields`, + which is stripped even earlier and is not in the sanitized document at all. **The + gate must run on the live object, before the sanitizer**, and nothing in the + pipeline is structured that way today. +4. **Is the gate worth building at all?** New, and it follows from the architecture: in + a kcp intent workspace there are no expansion controllers, so nothing derives + anything and the gate is answered by the topology. The gate is mandatory only for + the *production-cluster* topology, which decision 1 lists as supported. Whether that + topology is a launch commitment or an eventual one is what prices this entire + workstream — see + [the-layer-above-and-the-expansion-graph.md](the-layer-above-and-the-expansion-graph.md). +5. **KRO and Crossplane are still unmeasured.** Their markers are inferred (from our own + strip list, in KRO's case). Given that three of the five measured producers + contradicted what was assumed about them, inference is not good enough here. They are + the obvious next lab, and the corpus has no fixture for either. diff --git a/docs/design/gitops-api/intent-cluster-hydration.md b/docs/design/gitops-api/intent-cluster-hydration.md index f0ff9d1f..c3bc85dd 100644 --- a/docs/design/gitops-api/intent-cluster-hydration.md +++ b/docs/design/gitops-api/intent-cluster-hydration.md @@ -143,7 +143,7 @@ Two of its rows drive everything below: Flux never reaches that base64 error, because kustomize-controller checks first. Run against real Flux (kustomize-controller, `spec.decryption` unset, the -[fixture 13](../../../test/fixtures/gitops-layouts/13-sops-encrypted/) Secret plus +[fixture 13](../../../test/fixtures/gitops-layouts/5-opaque/sops-encrypted/) Secret plus an ordinary `ConfigMap` in one folder): ``` @@ -335,10 +335,10 @@ up. It sits naturally beside `unsupportedConstructs`, which already answers the neighbouring question "what does this repo use that we do not manage?" For the layout corpus, `requiredCRDs` would report `HelmRelease` and -`Kustomization` for [`09-flux-monorepo`](../../../test/fixtures/gitops-layouts/09-flux-monorepo/), +`Kustomization` for [`09-flux-monorepo`](../../../test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/), `Application` for the Argo CD fixtures, and `Composition` plus `ResourceGraphDefinition` for -[`15-mixed-and-hostile`](../../../test/fixtures/gitops-layouts/15-mixed-and-hostile/). +[`15-mixed-and-hostile`](../../../test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/). ## Open questions diff --git a/docs/design/gitops-api/resource-capability-model.md b/docs/design/gitops-api/resource-capability-model.md index 2da41149..4d6de1a9 100644 --- a/docs/design/gitops-api/resource-capability-model.md +++ b/docs/design/gitops-api/resource-capability-model.md @@ -86,7 +86,7 @@ flowchart TD U -- yes --> K["writeUnit: key"] U -- "no, one MAC spans all" --> W["writeUnit: document"] - D --> OWN{"controller ownerReference?"} + D --> OWN{"derived?
(Tier 2 provenance:
which controller, what source)"} OWN -- yes --> DER["derived: true
never mirror it"] classDef bad fill:#fdd,stroke:#c33 @@ -112,11 +112,29 @@ independently. `none` means the document is not ours to write at all. **4. `derived`** — this object was produced by a controller from another object. It is an *output*, not desired state, and mirroring it to Git creates a second -source of truth. Evidence: a controller `ownerReference` on the live object. - -That last knob is not hypothetical. `internal/sanitize/sanitize.go` **deletes** -`ownerReferences` before a document reaches Git, and nothing gates on them -first — so the evidence that an object was derived is destroyed rather than used. +source of truth. + +> ⚠️ **The evidence for this knob is NOT a controller `ownerReference`.** That was +> this doc's claim, and it is empirically false. Measured against live controllers, +> an `ownerReference` catches **one expansion producer in five**: objects rendered +> by a Flux `HelmRelease` and objects expanded by a flux-operator `ResourceSet` — +> both of which have no home in Git and must be refused — carry **none at all**. +> A gate keyed on `ownerReference` would mirror both. +> +> `derived` is a **Tier 2 provenance claim**, not a Tier 0 field check: the answer +> depends on *which controller applied the object and what that controller's source +> is* — a folder of files (has a home) or a template inside a CR (no home). The +> measured evidence table is in +> [`../../facts/expansion-provenance-markers.md`](../../facts/expansion-provenance-markers.md); +> the argument is in +> [expansion-boundary-and-corpus-organisation.md](expansion-boundary-and-corpus-organisation.md). + +That knob is not hypothetical, and the sanitizer makes it worse. +`internal/sanitize/sanitize.go` **deletes** `ownerReferences` before a document +reaches Git, and nothing gates on them first — so what evidence there is gets +destroyed rather than used. The best signal, the applying field manager, lives in +`metadata.managedFields` and never reaches the sanitized document at all. **The gate +must run on the live object, before the sanitizer.** See [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md) for what that costs. @@ -129,7 +147,7 @@ for what that costs. | `Secret` + `sops:` stanza | ❌ | `opaque` | `document` | **yes** — `EncryptedSecret` | | `SealedSecret` | ✅ | `opaque` | `key` | no | | `ExternalSecret` | ✅ | `elsewhere` | `document` | no | -| any object with a controller `ownerReference` | ✅ | — | `none` (`derived`) | no | +| any object a controller **expanded** (no home file in Git) | ✅ | — | `none` (`derived`) | no | | a file claimed by `ImageUpdateAutomation` | ✅ | `plain` | `none` | no (a Tier 2 claim) | The punchline of the whole exercise: diff --git a/docs/design/gitops-api/sealed-secrets-and-external-secrets.md b/docs/design/gitops-api/sealed-secrets-and-external-secrets.md index fdf85f5d..e7048586 100644 --- a/docs/design/gitops-api/sealed-secrets-and-external-secrets.md +++ b/docs/design/gitops-api/sealed-secrets-and-external-secrets.md @@ -209,6 +209,26 @@ by `ReplicaSet`s, `Endpoint`s, and every CR any operator generates. Today `sanitize` *deletes* that field. The fix is to **gate on it before deleting it** — the evidence must be consumed before it is discarded. +> ⚠️ **This gate is correct and necessary — but it is not sufficient, and the +> sentence "every derived object in Kubernetes already sets it" is false.** +> +> It holds for everything this doc is about: ESO- and sealed-secrets-derived +> `Secret`s, `ReplicaSet`s, `Pod`s, `Endpoint`s. Keep it. +> +> It does **not** hold for the *GitOps expansion* family. Measured against live +> controllers, objects rendered by a Flux `HelmRelease` and objects expanded by a +> flux-operator `ResourceSet` carry **no `ownerReference` at all** — they are tracked +> by labels and a status inventory. Both have no home in Git; both must be refused; +> neither is caught here. +> +> So this gate is the **Tier 0 half** of the answer. The other half is a **Tier 2 +> provenance claim** keyed on which controller applied the object and what its source +> is. See +> [`../../facts/expansion-provenance-markers.md`](../../facts/expansion-provenance-markers.md) +> for the measurements and +> [expansion-boundary-and-corpus-organisation.md](expansion-boundary-and-corpus-organisation.md) +> for the argument. + That single gate is the entire day-1 cost of supporting External Secrets safely, and it is not really about External Secrets at all. diff --git a/docs/design/gitops-api/support-contract.md b/docs/design/gitops-api/support-contract.md index e46d3eef..f01f6ed6 100644 --- a/docs/design/gitops-api/support-contract.md +++ b/docs/design/gitops-api/support-contract.md @@ -124,6 +124,8 @@ we can store — and is argued in | Doc | What it settles | |---|---| +| [the-layer-above-and-the-expansion-graph.md](the-layer-above-and-the-expansion-graph.md) | **the architecture: kcp + Flux + Argo CD above this operator, and the graph these verdicts are a property of** | +| [`../../facts/expansion-provenance-markers.md`](../../facts/expansion-provenance-markers.md) | **the measured evidence each producer leaves behind** — and why the `ownerReference` gate catches one producer in five | | [README.md](README.md) | the feature ladder F1–F8, and the launch path | | [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md) | the kustomization field taxonomy and the supported-layout allowlist | | [gittarget-granularity-and-cross-environment-edits.md](gittarget-granularity-and-cross-environment-edits.md) | **the write boundary (L1/L2) — the one home of fan-in = 1** | diff --git a/docs/design/gitops-api/the-layer-above-and-the-expansion-graph.md b/docs/design/gitops-api/the-layer-above-and-the-expansion-graph.md new file mode 100644 index 00000000..6ec8e2ad --- /dev/null +++ b/docs/design/gitops-api/the-layer-above-and-the-expansion-graph.md @@ -0,0 +1,297 @@ +# The layer above: kcp, Flux, Argo CD — and the graph that decides the boundary + +> Status: direction-setting; draws the architecture the product is heading for and +> names the one question every layer must agree on. Ships no code. +> Captured: 2026-07-13 +> Related: +> [support-contract.md](support-contract.md) — the boundary this doc explains the *shape* of, +> [intent-cluster-hydration.md](intent-cluster-hydration.md) — CRDs, never controllers, +> [expansion-boundary-and-corpus-organisation.md](expansion-boundary-and-corpus-organisation.md) — the provenance axis, +> [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md) — the claim vocabulary and the tiering, +> [../../facts/expansion-provenance-markers.md](../../facts/expansion-provenance-markers.md) — **the measurements this doc rests on**, +> [../../bi-directional.md](../../bi-directional.md) — the triggered-applier handshake + +## Why this doc exists + +GitOps Reverser is one arrow: **live → Git**. The product needs the other arrow, and +somewhere to put the user's editing session. The direction now settled on is a layer +*above* this operator that uses **kcp** for the intent cluster and **Flux / Argo CD** +as triggered appliers — the [hydration](intent-cluster-hydration.md) and +[bi-directional](../../bi-directional.md) designs, assembled into a product. + +That layer does not exist yet. Before it is built, the boundaries between it and this +operator have to be crisp, because the most expensive mistake available is to let +orchestrator knowledge leak downward into the operator, or let the operator's refusals +leak upward as product gaps. + +This doc draws the picture, and then names the **one question** the whole stack turns +on. + +## The stack + +Four layers. Each has exactly one job. The interfaces between them are primitives that +already ship. + +```text +┌─ Product layer ──────────────────────────────────────────────────────┐ +│ session + branch lifecycle · PR open / merge · UI │ +│ merge == deploy │ +└───────────────────────────────┬──────────────────────────────────────┘ + │ CommitRequest: Pushed=True + status.sha + status.branch +┌─ Orchestration layer ─────────┴──────────────────────────────────────┐ +│ kcp a workspace per session — the intent cluster │ +│ Flux/Argo TRIGGERED appliers: Git → live (hydrate), and the │ +│ acknowledgment that closes the loop │ +└───────────────────────────────┬──────────────────────────────────────┘ + │ the Kubernetes API — the user's write path +┌─ GitOps Reverser (this repo) ─┴──────────────────────────────────────┐ +│ watch · sanitize · write the folder the way a careful human would · │ +│ push a branch │ +│ NEVER: Git-host APIs · chart rendering · generator evaluation │ +└───────────────────────────────┬──────────────────────────────────────┘ + │ +┌─ Git ─────────────────────────┴──────────────────────────────────────┐ +│ the intent layer — the files, and the only thing that is true │ +└──────────────────────────────────────────────────────────────────────┘ +``` + +The operator's contract with the layer above is deliberately thin and already exists: +it publishes a commit and reports `Pushed=True` with a SHA. Everything the +orchestration layer does — trigger the applier, wait for that exact revision, open the +PR — is built on that one signal. Nothing about kcp, GitHub, or Argo CD needs to enter +this repository for it to work. + +## The one question the whole stack turns on + +Every layer, asked about any live object, must give the same answer to: + +> ### Does this object have a home in Git — exactly one file that is its source? + +- **Yes** → mirror it, edit it, write the edit back to that file. This is the **intent + layer**, and it is the product. +- **No** → never mirror it. A controller synthesised it; writing it to Git invents a + **second source of truth that fights the controller that made it**. This is the + **expansion layer**. + +That is [the support contract](support-contract.md) in one line. And it is a question +about a **graph**, not about a field on an object. + +## The graph + +Every GitOps repository is a starting point that explodes into more KRM. Draw the +explosion as a DAG — files, then controllers, then live objects — and the boundary +becomes a property of the edges rather than a list of special cases. + +```mermaid +flowchart LR + subgraph git["Git — the intent layer"] + F1["apps/frontend/deployment.yaml"] + F2["overlays/prod/kustomization.yaml"] + F3["releases/redis.yaml
(HelmRelease)"] + F4["tenants/apps.yaml
(ResourceSet)"] + F5["bootstrap/appset.yaml
(ApplicationSet)"] + end + + subgraph appliers["Appliers — source is a FOLDER OF FILES"] + KC["kustomize-controller"] + AC["argocd-controller"] + end + + subgraph expanders["Expanders — source is a TEMPLATE INSIDE A CR"] + HC["helm-controller"] + FO["flux-operator"] + AS["applicationset-controller"] + end + + F1 --> KC + F2 --> KC + F1 --> AC + F3 --> HC + F4 --> FO + F5 --> AS + + KC --> O1["Deployment (live)"] + AC --> O2["Deployment (live)"] + HC --> O3["Redis StatefulSet,
Service, ConfigMap…"] + FO --> O4["9 objects across
3 tenants"] + AS --> O5["Application CRs"] + + classDef home fill:#dfd,stroke:#3a3 + classDef nohome fill:#fdd,stroke:#c33 + class O1,O2 home + class O3,O4,O5 nohome +``` + +Green objects have a home file. Red ones do not. **Both kinds were applied by a +controller** — which is why *"was a controller involved?"* is the wrong question. + +The discriminator is one level up: **what is the controller's source?** A folder of +files (invertible — the file is right there) or a template inside a CR (not +invertible — the file is the CR, and the object is a rendering of a field in it). + +## The boundary is the *inverse* of that graph + +GitOps Reverser runs the arrows backwards. So the support contract is simply: **the +inverse is defined exactly where an edge is invertible.** + +Four cases, one rule: + +| In-edges on the live object | Edge kind | Verdict | Why | +|---|---|---|---| +| **0** — nobody applied it | — | **Editable** | a human authored it directly. In an intent cluster this is the *normal* case, and it is the whole product | +| **1** | applier (source = a folder of files) | **Editable** | the file is right there; the edit inverts to it | +| **1** | expander (source = a template in a CR) | **Not mirrored** | there is no file. The CR is editable; its *output* has nowhere to go | +| **N > 1** | applier | **Refused** | a shared kustomize base: the edit would change more than one thing. This is **fan-in = 1**, already the [write boundary](gittarget-granularity-and-cross-environment-edits.md) | + +The three axes the design has been circling — +*renderability*, *ownership*, *provenance* — are the three ways an edge can fail to +invert. They are not three separate models. They are one graph, read backwards. + +Note the row that is easy to miss: **an object with zero in-edges is editable.** That +is not a degenerate case; in a properly-built intent cluster it is *every* object, and +the next section is why. + +## What kcp changes — and what it does not + +### It removes the expansion layer, structurally + +An intent cluster built as a **kcp workspace** carries schemas and nothing else: no +helm-controller, no flux-operator, no applicationset-controller. That follows directly +from the standing rule in +[intent-cluster-hydration.md](intent-cluster-hydration.md) — *"always install the +CRDs; install a controller only if it is an applier you drive"* — and a ResourceSet +expander is not an applier we drive. + +So in the intent workspace **the expansion layer does not exist**. Nothing derives +anything. Every object there arrived by exactly one of two routes: + +```text +file ──hydrate──▶ object ──user edits it──▶ object′ ──reverser──▶ file′ + ▲ + └── or the user created it outright (zero in-edges) +``` + +Both are intent. The graph is trivial, every object has exactly one home, and — the +payoff — + +> **the provenance gate is answered by the topology instead of by evidence.** + +That is the strongest available argument for kcp, and it should be stated plainly, +because it *prices* the hardest unbuilt thing in this workstream: + +| Intent-cluster topology | Expansion controllers running? | Is the provenance gate needed? | +|---|---|---| +| **kcp workspace** (lightweight) | **No** — schemas only | **No.** Nothing derives anything. Structurally impossible, not merely unlikely | +| **A real production cluster** | **Yes** | **Yes — and it is hard.** See the [measurements](../../facts/expansion-provenance-markers.md): three evidence vocabularies, and `ownerReference` catches one producer in five | + +[Decision 1](expansion-boundary-and-corpus-organisation.md) of the expansion doc says +both topologies are supported, and that stands. But the **cost is not symmetric**, and +this is where the asymmetry lands: + +> The more the product leans on kcp, the less the expensive gate matters. The more it +> leans on *"point it at your real cluster"*, the more the gate becomes a hard, +> load-bearing prerequisite — one whose evidence we have now measured and found to be +> a mess. + +That is a strategic fork, not a detail, and it is worth taking deliberately rather than +by drift. + +### What kcp does *not* solve + +Four things, and the last is the one that is easiest to lose. + +1. **Hydration still needs the schemas, and in kcp they are not CRDs.** To store an + `Application` in a workspace you need its schema — an `APIResourceSchema` plus an + `APIExport`/`APIBinding` — rather than a CRD apply. The `requiredCRDs` field + proposed in [intent-cluster-hydration.md](intent-cluster-hydration.md) becomes + `requiredAPIs`, and it is a **precondition of standing the workspace up at all**, + not a nice-to-have on a report. + +2. **Flux and Argo CD have to be able to point *at* a workspace. This is untested.** + kcp is not a full Kubernetes API: no pods, no nodes, a restricted discovery surface. + kustomize-controller mostly does server-side apply against an API server and is a + plausible fit; Argo CD registers clusters and runs a much heavier cache/diff/health + engine whose assumptions are less likely to hold. **This is the largest untested + assumption in the entire direction** and deserves a spike before anything is built + on top of it. + +3. **`kcp.io/cluster` must never reach Git.** Already handled, and it is the only + kcp-awareness in the codebase: `sanitize` strips that key exactly (not by prefix — + sibling `kcp.io/` keys are not assumed to be bookkeeping). It is an *address*, and + committed to Git it would pin a manifest to one workspace and then travel with it + into every other. + +4. **The expansion layer still exists in the repository.** This is the one to hold on + to: + + > **kcp answers "where do I safely edit". It says nothing about "is this repository + > editable".** + + Those are different questions, and only the second is the support contract. A + `ResourceSet` repository's workloads have no files whether you edit them in kcp, in + k3d, or in production. Hydrating such a repo into a pristine workspace does not give + its nine expanded objects a home — it just means nothing expands them, so they never + appear, so the user cannot edit what they came to edit. The refusal is a property of + the repo, and it survives every topology. + +## Bi-directional is the same graph, read backwards, with a clock + +The other arrow — Git → live — is what Flux and Argo CD do for a living. The only +hazard is **causality, not YAML**: a reconciler left on its own interval will re-apply +a stale revision over the user's edit, because in an editing cluster *live state +diverging from Git is not drift — it is the edit*. + +The fix is the [acknowledgment handshake](../../bi-directional.md): treat the +reconciler as a **deliberately triggered applier**, publish the commit, trigger it, and +wait until it reports that it applied *that exact SHA*. Both engines are proven against +it in the [bi-directional corner](../../spec/e2e-bi-directional-corner.md) — Flux via +`flux reconcile` + `lastAppliedRevision`, Argo CD via `selfHeal: false` + a push +webhook. + +**Hydration is the degenerate case of that same handshake**: apply revision X into a +workspace that holds nothing yet, and wait until it is reported applied. Same +operation, empty starting state. + +Which means the Git → live arrow is, in its essentials, already proven. What is *not* +proven is that it works when the target is a kcp workspace rather than a real cluster — +which is risk 2 above, and the reason it is the first thing to spike. + +## What to build, in order + +1. **Spike: point Flux at a kcp workspace.** Hydrate one corpus fixture, close the + acknowledgment handshake, edit an object, get a commit. This is the load-bearing + unknown; everything else is downstream of it. If Argo CD cannot register a workspace, + that is worth knowing before the product assumes it can. +2. **`requiredAPIs` in the scan report** — free to compute (the walk has already parsed + every `apiVersion`/`kind`), and it is precisely the list the workspace needs before + it can hold anything. +3. **Close the sanitize leaks** — `helm.toolkit.fluxcd.io/`, + `resourceset.fluxcd.controlplane.io/`, `meta.helm.sh/`. Small, and independent of + every decision above. +4. **The provenance gate — but only if the production-cluster topology is really on the + roadmap.** And if it is, key it on the + [measured evidence table](../../facts/expansion-provenance-markers.md), not on + `ownerReference`. It must run **on the live object, before the sanitizer**, because + the sanitizer destroys the very evidence it needs. + +## Open questions + +1. **Can Argo CD manage a kcp workspace at all?** Flux is plausible; Argo's cluster + registration, health assessment, and resource cache make far stronger assumptions + about the API surface. If the answer is no, the intent cluster is Flux-only and the + Argo CD story becomes "we mirror and edit your Argo repos", not "we hydrate into an + Argo-managed workspace". That is still a good product — but it is a different one. +2. **Is the intent workspace per session, per `GitTarget`, or per tenant?** A + long-lived workspace drifts from Git as other people merge, and nothing here + reconciles it. Re-hydration on branch change is the obvious answer; what happens to + an in-flight edit is not. +3. **Does the fan-in = 1 rule hold for a field of a document?** A `ResourceSet`'s + `spec.inputs[j]` has fan-in 1 and is the right edit surface; `spec.resources[i]` has + fan-in N. Both are fields of the *same file*. The write boundary is currently + specified over files, and this is the first construct that makes the distinction + matter. +4. **If the gate is answered by topology in kcp, is it worth building at all?** The + honest answer depends on question 1 in + [decision 1](expansion-boundary-and-corpus-organisation.md) — whether "edit your + real production cluster" is a launch topology or an eventual one. It is currently + listed as supported, and that is what makes the gate mandatory rather than optional. diff --git a/docs/design/gitops-api/write-only-encrypted-secrets.md b/docs/design/gitops-api/write-only-encrypted-secrets.md index 02a0a841..4c651ae8 100644 --- a/docs/design/gitops-api/write-only-encrypted-secrets.md +++ b/docs/design/gitops-api/write-only-encrypted-secrets.md @@ -7,7 +7,7 @@ > [README.md](README.md), > [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md), > [f8-repo-discovery-and-onboarding-scan.md](f8-repo-discovery-and-onboarding-scan.md), -> fixture [`13-sops-encrypted`](../../../test/fixtures/gitops-layouts/13-sops-encrypted/) +> fixture [`13-sops-encrypted`](../../../test/fixtures/gitops-layouts/5-opaque/sops-encrypted/) ## The idea diff --git a/docs/facts/expansion-provenance-markers.md b/docs/facts/expansion-provenance-markers.md new file mode 100644 index 00000000..d15f52d9 --- /dev/null +++ b/docs/facts/expansion-provenance-markers.md @@ -0,0 +1,175 @@ +# Expansion provenance markers, measured + +> **reference** — durable background. Index: [`../INDEX.md`](../INDEX.md) +> +> Measured 2026-07-13 against a live cluster: Kubernetes v1.36 (k3d), Flux v2 + +> flux-operator, Argo CD v3.4.5. Every row below was **observed on a real object**, +> not read from upstream source. Where a claim was previously made from source +> reading, this file supersedes it. + +GitOps Reverser is a **live → Git** tool. Before it may mirror a live object it has +to answer one question: + +> **Does this object have a home in Git — one file that is its source?** + +An object a controller *synthesised* has no home. Writing it to Git creates a second +source of truth that fights the controller that made it. So the answer decides +whether the object is mirrored at all, and the answer is read off the **provenance +evidence** the applying controller leaves behind. + +This file records what that evidence actually is. It is not what the design docs +assumed. + +## The table + +| Producer | Evidence on the produced object | `ownerReference`? | `managedFields` manager | The producer's source | Home in Git? | +|---|---|---|---|---|---| +| Argo CD `ApplicationSet` → `Application` | `ownerReference` → the ApplicationSet (`controller: true`, `blockOwnerDeletion: true`) | **yes** | — | a generator | **no** for the `Application`; but it *points at* a real path, so its workloads do | +| Argo CD `Application` → workload | annotation `argocd.argoproj.io/tracking-id` = `:/:/` | no | `argocd-controller` | a folder in Git | **yes** | +| Flux `Kustomization` → workload | labels `kustomize.toolkit.fluxcd.io/{name,namespace}` | no | `kustomize-controller` | `GitRepository` + `spec.path` | **yes** | +| Flux `HelmRelease` → workload | labels `helm.toolkit.fluxcd.io/{name,namespace}`; annotations `meta.helm.sh/release-{name,namespace}`; labels `app.kubernetes.io/managed-by: Helm`, `helm.sh/chart` | no | `helm-controller` | a **chart** | **no** | +| flux-operator `ResourceSet` → anything | labels `resourceset.fluxcd.controlplane.io/{name,namespace}`; plus `status.inventory` on the parent | no | `flux-operator` | `spec.resources` — a template **inside the CR** | **no** | + +## Three consequences, in order of how much they hurt + +### 1. `ownerReference` is evidence for exactly one of the five + +[`resource-capability-model.md`](../design/gitops-api/resource-capability-model.md) +and +[`sealed-secrets-and-external-secrets.md`](../design/gitops-api/sealed-secrets-and-external-secrets.md) +both define a `derived` object as *"Evidence: a controller `ownerReference` on the +live object."* + +Measured, that test catches ApplicationSet children and **nothing else in the Flux +family**. Objects rendered by a `HelmRelease` and objects expanded by a +`ResourceSet` carry **zero** `ownerReferences`. A gate keyed on `ownerReference` +would mirror both — which is the exact failure the gate exists to prevent. + +(ESO- and sealed-secrets-derived `Secret`s do carry an `ownerReference`, per the +secrets doc; they are not re-measured here.) + +### 2. The label prefix is not the discriminator, and it looks exactly like one + +``` +kustomize.toolkit.fluxcd.io/name → the source is a folder of files → MIRROR IT +helm.toolkit.fluxcd.io/name → the source is a chart → NEVER MIRROR +``` + +Sibling prefixes. Same vendor. **Opposite verdicts.** Any rule of the form "strip or +gate on `*.toolkit.fluxcd.io/`" gets one of these two exactly backwards. + +This is the empirical core of the argument that provenance is a **Tier 2 claim** — +a small table keyed by *which controller applied this, and what that controller's +source is* — and not a Tier 0 field check. It cannot be collapsed into one field, +because the field is the same in both rows and the answer is not. + +### 3. `managedFields[].manager` is the only uniform channel + +Every producer sets a distinct, stable applying manager: + +| manager | verdict | +|---|---| +| `kustomize-controller` | has a home | +| `argocd-controller` | has a home | +| `helm-controller` | no home | +| `flux-operator` | no home | + +Where the labels and owner-references speak three different vocabularies, the field +manager speaks one. It is the most promising single signal available, and no design +doc currently considers it. + +**Caveat, and it is real:** `managedFields` accumulates. A Deployment applied by +helm-controller and later touched by another actor shows `helm-controller k3s`. The +manager is evidence about *who applied a field*, not a sole primary key — so it +belongs in the evidence table, not as a replacement for it. + +## What leaks into Git today + +[`internal/sanitize/types.go`](../../internal/sanitize/types.go) strips +`kustomize.toolkit.fluxcd.io/` (labels + annotations), `kro.run/` (labels only), +`applyset.kubernetes.io/`, and — by exact key — `argocd.argoproj.io/tracking-id`, +`argocd.argoproj.io/installation-id`, and `kcp.io/cluster`. + +It does **not** strip, and these are all controller bookkeeping observed on real +objects: + +| Key | Set by | +|---|---| +| `helm.toolkit.fluxcd.io/{name,namespace}` (labels) | helm-controller | +| `resourceset.fluxcd.controlplane.io/{name,namespace}` (labels) | flux-operator | +| `meta.helm.sh/release-{name,namespace}` (annotations) | Helm, via helm-controller | + +Committed to Git, each is read back as user intent. This is the same family as the +Argo CD `tracking-id` hazard the strip list already guards against. + +It is currently *moot* only because the provenance gate would refuse these objects +outright — but the gate is unbuilt, and if it lands keyed on `ownerReference` (see +consequence 1) the objects are mirrored **and** the labels leak. + +`app.kubernetes.io/managed-by: Helm` and `helm.sh/chart` are deliberately **not** +listed as leaks: they are chart-authored labels that a user may legitimately want in +Git, and they are indistinguishable from the same labels set by hand. This is the +same trap as Argo CD's `app.kubernetes.io/instance` under `label` tracking — see the +note in `types.go`. + +## The enumeration finding + +An `ApplicationSet` with a `git.directories: apps/*` generator, over a real +repository: + +``` +$ mkdir apps/worker && git add . && git commit && git push # NO Application CR authored +$ kubectl -n argocd get applications +NAME PATH SYNC HEALTH +app-worker apps/worker Synced Healthy <-- appeared from the folder alone +``` + +**Creating a directory is a deployment operation.** The directory listing is a field +of desired state. + +And the corollary — what happens if a tool "helpfully" authors the CR as well, which +is what *"add an app = add the manifests and author the CR"* would do: + +``` +SharedResourceWarning: ConfigMap/worker-config is part of applications + argocd/app-worker and worker-authored-by-hand +``` + +The generated `Application` flipped to `OutOfSync`, and the workload's `tracking-id` +was **overwritten** to name the hand-authored app — arming the promotion landmine +documented in [`e2e-bi-directional-corner.md`](../spec/e2e-bi-directional-corner.md). + +So in a generator-enumerated repository both naive moves are wrong: author the CR and +you get a duplicate that fights the generator; omit it and — in every *other* layout — +nothing deploys. This is why the `EnumeratedBy` claim exists, and why adding an app to +such a repository is +[refused, loudly](../design/gitops-api/expansion-boundary-and-corpus-organisation.md). + +## Incidental, but worth knowing + +An `ApplicationSet` template using `{{.cluster}}` **without** `spec.goTemplate: true` +does not fail loudly — it renders the literal string. Every element then produces the +same name and Argo reports: + +``` +ApplicationSet guestbook contains applications with duplicate name: {{.cluster}}-guestbook +``` + +Two template engines (`fasttemplate` and Go `text/template` + sprig) behind one +field, selected by a boolean. A third dialect, Go `text/template` with `<< >>` +delimiters, is what flux-operator's `ResourceSet` uses. Any static reading of a +template must know which dialect it is in. + +## Reproducing this + +The measurements are pinned as a runnable spec in the bi-directional e2e corner — +the only place Argo CD is installed: + +```bash +task test-e2e-bi-directional +``` + +See [`e2e-bi-directional-corner.md`](../spec/e2e-bi-directional-corner.md) for the +corner, and +[`test/fixtures/gitops-layouts/3-expanded/`](../../test/fixtures/gitops-layouts/3-expanded/) +for the layouts these producers correspond to. diff --git a/docs/spec/e2e-bi-directional-corner.md b/docs/spec/e2e-bi-directional-corner.md index f61b6510..badf70c1 100644 --- a/docs/spec/e2e-bi-directional-corner.md +++ b/docs/spec/e2e-bi-directional-corner.md @@ -172,11 +172,42 @@ dedicated CI leg: | Piece | Value | | --- | --- | | Category label | `bi-directional` (already exists on the Flux spec) | -| Sub-labels | `flux`, `argocd` | +| Sub-labels | `flux`, `argocd`, `provenance` | | Env gate | `E2E_ENABLE_BI_DIRECTIONAL` | | Task | `task test-e2e-bi-directional` | | CI leg | `bi-directional` | +### The third spec: `provenance_markers_e2e_test.go` + +The corner hosts a third spec, and it is the reason the corner is worth more than the +two bi-directional ones. Because this is the only cluster carrying **Flux, +flux-operator, and Argo CD at once**, it is the only place that can ask what each +GitOps producer stamps on the objects it creates — and therefore the only place that +can answer *"does this live object have a home in Git?"* empirically rather than by +reading upstream source. + +[`provenance_markers_e2e_test.go`](../../test/e2e/provenance_markers_e2e_test.go) +drives five producers off **one Gitea repo and one commit**, and asserts the marker, +the (absent) `ownerReference`, and the applying field manager on each result: + +| Producer | Marker | Source | Home in Git? | +| --- | --- | --- | --- | +| Flux `Kustomization` | `kustomize.toolkit.fluxcd.io/*` | a folder | **yes** | +| Argo CD `Application` | `argocd.argoproj.io/tracking-id` | a folder | **yes** | +| Flux `HelmRelease` | `helm.toolkit.fluxcd.io/*` | a chart | no | +| flux-operator `ResourceSet` | `resourceset.fluxcd.controlplane.io/*` | a template in the CR | no | +| Argo CD `ApplicationSet` | **`ownerReference`** | a generator | no | + +It found that the `derived`-object gate the design docs specify — *"evidence: a +controller `ownerReference`"* — catches **one of those five**. It drives no +`GitTarget` and no `WatchRule`: the reverser is not under test, the ecosystem is. The +results are written up in +[`../facts/expansion-provenance-markers.md`](../facts/expansion-provenance-markers.md). + +It shares the `argocd` namespace with the Argo CD spec but never patches +`argocd-secret` and owns its own repo, namespace, and resource names, so it runs in +parallel with both. `BI_DIRECTIONAL_GINKGO_PROCS` is therefore `3`. + Filter changes so the default suite stops paying for it: - `test/e2e/Taskfile.yml`: `E2E_LABEL_FILTER` default `!image-refresh` diff --git a/hack/doccheck/main.go b/hack/doccheck/main.go index 38cf4eb4..b0c71363 100644 --- a/hack/doccheck/main.go +++ b/hack/doccheck/main.go @@ -30,6 +30,7 @@ package main import ( + "context" "flag" "fmt" "go/parser" @@ -57,6 +58,10 @@ type finding struct { kind string // "markdown" | "go-comment" } +// exitUsage is the exit code for doccheck failing to run at all, as distinct from +// exit 1, which means it ran and found broken references. +const exitUsage = 2 + func main() { root := flag.String("root", ".", "repository root to scan") flag.Parse() @@ -64,13 +69,13 @@ func main() { abs, err := filepath.Abs(*root) if err != nil { fmt.Fprintf(os.Stderr, "doccheck: %v\n", err) - os.Exit(2) + os.Exit(exitUsage) } - tracked, err := trackedFiles(abs) + tracked, err := trackedFiles(context.Background(), abs) if err != nil { fmt.Fprintf(os.Stderr, "doccheck: %v\n", err) - os.Exit(2) + os.Exit(exitUsage) } var findings []finding @@ -113,8 +118,8 @@ func main() { // rather than a filesystem walk means .gitignore is honoured for free: scratch // notes and the local upstream checkouts under external-sources/ are never scanned, // and we never have to maintain a skip-list that drifts. -func trackedFiles(root string) ([]string, error) { - cmd := exec.Command("git", "-C", root, "ls-files", "-z") +func trackedFiles(ctx context.Context, root string) ([]string, error) { + cmd := exec.CommandContext(ctx, "git", "-C", root, "ls-files", "-z") out, err := cmd.Output() if err != nil { return nil, fmt.Errorf("git ls-files: %w (is %s a git repository?)", err, root) diff --git a/hack/doccheck/main_test.go b/hack/doccheck/main_test.go new file mode 100644 index 00000000..131c1d46 --- /dev/null +++ b/hack/doccheck/main_test.go @@ -0,0 +1,211 @@ +// SPDX-License-Identifier: Apache-2.0 + +package main + +import ( + "context" + "fmt" + "os" + "os/exec" + "path/filepath" + "strings" + "testing" +) + +// write creates dir/name with content and returns its full path. +func write(t *testing.T, dir, name, content string) string { + t.Helper() + path := filepath.Join(dir, name) + if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil { + t.Fatalf("mkdir %s: %v", filepath.Dir(path), err) + } + if err := os.WriteFile(path, []byte(content), 0o600); err != nil { + t.Fatalf("write %s: %v", path, err) + } + return path +} + +func targets(findings []finding) []string { + out := make([]string, 0, len(findings)) + for _, f := range findings { + out = append(out, f.target) + } + return out +} + +// gitRun runs git in dir. The caller treats any error as "git is unavailable here" +// and skips, so the combined output is folded into the error to make that decision +// debuggable rather than silent. +func gitRun(ctx context.Context, dir string, args ...string) error { + cmd := exec.CommandContext(ctx, "git", append([]string{"-C", dir}, args...)...) + out, err := cmd.CombinedOutput() + if err != nil { + return fmt.Errorf("git %s: %w: %s", strings.Join(args, " "), err, out) + } + return nil +} + +func TestCheckMarkdown_ReportsOnlyUnresolvableRelativeLinks(t *testing.T) { + root := t.TempDir() + write(t, root, "docs/real.md", "# real\n") + write(t, root, "docs/dir/nested.md", "# nested\n") + + doc := write(t, root, "docs/index.md", `# index + +[resolves](real.md) +[resolves with anchor](real.md#a-heading) +[resolves nested](dir/nested.md) +[external http](http://example.com/missing.md) +[external https](https://example.com/missing.md) +[mailto](mailto:someone@example.com) +[pure anchor](#a-heading) +[broken](gone.md) +[broken with anchor](also-gone.md#x) +`) + + got := targets(checkMarkdown(root, doc)) + + want := []string{"gone.md", "also-gone.md#x"} + if len(got) != len(want) { + t.Fatalf("expected exactly %v, got %v", want, got) + } + for i := range want { + if got[i] != want[i] { + t.Errorf("finding %d: want %q, got %q", i, want[i], got[i]) + } + } +} + +func TestCheckMarkdown_ReportsRepoRelativePathAndLine(t *testing.T) { + root := t.TempDir() + doc := write(t, root, "docs/design/plan.md", "line one\n\n[broken](../nope.md)\n") + + findings := checkMarkdown(root, doc) + if len(findings) != 1 { + t.Fatalf("want 1 finding, got %d", len(findings)) + } + f := findings[0] + + if want := filepath.Join("docs", "design", "plan.md"); f.file != want { + t.Errorf("file: want %q, got %q", want, f.file) + } + if f.line != 3 { + t.Errorf("line: want 3, got %d", f.line) + } + if f.kind != "markdown" { + t.Errorf("kind: want markdown, got %q", f.kind) + } +} + +func TestCheckMarkdown_UnreadableFileIsNotAFinding(t *testing.T) { + root := t.TempDir() + if got := checkMarkdown(root, filepath.Join(root, "absent.md")); got != nil { + t.Errorf("a file that cannot be read must yield no findings, got %v", got) + } +} + +// The package doc's load-bearing claim: doc paths are read from COMMENTS, never +// from string literals. The gittargetignore tests build in-memory filesystems whose +// entries are named like documentation paths, and those are fixtures, not citations. +func TestCheckGoComments_ReadsCommentsAndIgnoresStringLiterals(t *testing.T) { + root := t.TempDir() + write(t, root, "docs/spec/real.md", "# real\n") + + src := write(t, root, "pkg/thing.go", `// Package thing implements the contract in docs/spec/real.md. +package thing + +// doThing is specified by docs/spec/missing.md and must stay in sync. +func doThing() string { + // this citation is also a comment: docs/spec/other-missing.md + return "docs/spec/not-a-citation.md" +} +`) + + got := targets(checkGoComments(root, src)) + + // The path that resolves is absent from the findings, and the one in the string + // literal is never considered at all. (Spelling that resolvable path out here + // would make this very comment a citation doccheck then fails to resolve.) + want := map[string]bool{ + "docs/spec/missing.md": true, + "docs/spec/other-missing.md": true, + } + if len(got) != len(want) { + t.Fatalf("want %d findings %v, got %d: %v", len(want), want, len(got), got) + } + for _, target := range got { + if !want[target] { + t.Errorf("unexpected finding %q — a string literal must never be treated as a citation", target) + } + } +} + +func TestCheckGoComments_UnparseableFileIsNotAFinding(t *testing.T) { + root := t.TempDir() + src := write(t, root, "broken.go", "this is not go source at all, and cites docs/spec/missing.md\n") + + if got := checkGoComments(root, src); got != nil { + t.Errorf("a file that does not parse is golangci-lint's problem, not ours; got %v", got) + } +} + +func TestTrackedFiles_ListsGitTrackedFilesOnly(t *testing.T) { + root := t.TempDir() + write(t, root, "tracked.md", "# tracked\n") + write(t, root, "untracked.md", "# untracked\n") + + ctx := context.Background() + for _, args := range [][]string{ + {"init"}, + {"config", "user.email", "doccheck@example.com"}, + {"config", "user.name", "doccheck"}, + {"add", "tracked.md"}, + } { + if err := gitRun(ctx, root, args...); err != nil { + t.Skipf("git unavailable in this environment: %v", err) + } + } + + names, err := trackedFiles(ctx, root) + if err != nil { + t.Fatalf("trackedFiles: %v", err) + } + + if len(names) != 1 || names[0] != "tracked.md" { + t.Errorf("want [tracked.md], got %v — untracked files must never be scanned", names) + } +} + +func TestTrackedFiles_NonRepoIsAnError(t *testing.T) { + if _, err := trackedFiles(context.Background(), t.TempDir()); err == nil { + t.Error("a directory that is not a git repository must be an error, not an empty list") + } +} + +func TestIsExternal(t *testing.T) { + for target, want := range map[string]bool{ + "http://example.com": true, + "https://example.com": true, + "mailto:a@example.com": true, + "#anchor": true, + "docs/spec/thing.md": false, + "../README.md": false, + "./relative.md": false, + "httpsnot-a-scheme.md": false, + "notes.md#https://not-url": false, + } { + if got := isExternal(target); got != want { + t.Errorf("isExternal(%q): want %v, got %v", target, want, got) + } + } +} + +func TestRel_FallsBackToTheAbsolutePath(t *testing.T) { + if got := rel("/a/b", "/a/b/c.md"); got != "c.md" { + t.Errorf("want c.md, got %q", got) + } + // A relative path cannot be computed from an absolute root to a relative target. + if got := rel("/a/b", "c.md"); got != "c.md" { + t.Errorf("want the path back unchanged, got %q", got) + } +} diff --git a/hack/e2e/argocd-port-forward.sh b/hack/e2e/argocd-port-forward.sh index dfae88d8..4faca30e 100755 --- a/hack/e2e/argocd-port-forward.sh +++ b/hack/e2e/argocd-port-forward.sh @@ -8,7 +8,7 @@ set -euo pipefail # and is reused on the fast path when already up. # # Argo CD is only installed in the bi-directional e2e corner -# (docs/design/e2e-bi-directional-corner.md), so this is a standalone script +# (docs/spec/e2e-bi-directional-corner.md), so this is a standalone script # rather than another service in setup-port-forwards.sh — the default # prepare-e2e must not try to forward a Service that does not exist. # diff --git a/hack/gitops-layouts-baseline.sh b/hack/gitops-layouts-baseline.sh new file mode 100755 index 00000000..b7131cc4 --- /dev/null +++ b/hack/gitops-layouts-baseline.sh @@ -0,0 +1,135 @@ +#!/usr/bin/env bash +# Regenerate test/fixtures/gitops-layouts/support-today.md from a live +# manifest-analyzer scan of every fixture in the corpus. +# +# The output is a BEHAVIOURAL BASELINE, not documentation: it records what the +# analyzer reports today, so that any change to the acceptance boundary shows up +# in review as a diff of exactly which fixtures moved, and in which direction. +# +# It carries no interpretation. Interpretation belongs in +# docs/design/gitops-api/, which is free to disagree with this file — that +# disagreement is the backlog. +# +# Usage: task gitops-layouts-baseline +set -euo pipefail + +repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +cd "$repo_root" + +corpus="test/fixtures/gitops-layouts" +out="$corpus/support-today.md" +analyzer="$(mktemp -d)/manifest-analyzer" +trap 'rm -rf "$(dirname "$analyzer")"' EXIT + +echo "building manifest-analyzer..." >&2 +go build -o "$analyzer" ./cmd/manifest-analyzer + +# Every fixture is /, two levels below the corpus root. +mapfile -t fixtures < <(find "$corpus" -mindepth 2 -maxdepth 2 -type d | sort) + +emit_summary_row() { + # $1 = fixture path relative to the corpus, $2 = rc, $3 = json + local name="$1" rc="$2" json="$3" + local accepted refused layouts constructs outcome signal + accepted=$(jq -r '.summary.accepted // 0' <<<"$json") + refused=$(jq -r '.summary.refused // 0' <<<"$json") + layouts=$(jq -r '(.summary.candidatesByLayout // {}) | to_entries + | map("\(.key)=\(.value)") | join(", ") | if . == "" then "-" else . end' <<<"$json") + constructs=$(jq -r '(.summary.unsupportedConstructs // []) | join(", ") + | if . == "" then "-" else . end' <<<"$json") + signal=$(jq -r '[.candidates[]? | select(.acceptedByOperator == false) + | .refusalReasons[]? | "\(.code): \(.detail)"] + | if length == 0 then "None" + elif length > 4 then (.[0:4] | join("
")) + "
+\(length - 4) more" + else join("
") end' <<<"$json") + + if [[ "$rc" != "0" ]]; then + outcome="Scan failed" + elif [[ "$accepted" == "0" && "$refused" == "0" ]]; then + outcome="No candidates reported" + elif [[ "$refused" == "0" ]]; then + outcome="All reported candidates accepted" + elif [[ "$accepted" == "0" ]]; then + outcome="No reported candidates accepted" + else + outcome="Partial" + fi + + printf '| %s | %s | %s | %s | %s | %s | %s | %s |\n' \ + "$name" "$rc" "$outcome" "$accepted" "$refused" "$layouts" "$constructs" "$signal" +} + +emit_detail() { + local name="$1" rc="$2" json="$3" + local accepted refused constructs fleet + accepted=$(jq -r '.summary.accepted // 0' <<<"$json") + refused=$(jq -r '.summary.refused // 0' <<<"$json") + constructs=$(jq -r '(.summary.unsupportedConstructs // []) | join(", ") + | if . == "" then "none" else . end' <<<"$json") + fleet=$(jq -r '.summary.fleetRoot // false' <<<"$json") + + printf '\n## %s\n\n' "$name" + printf 'Reported rc `%s`. Accepted `%s`, refused `%s`.\n' "$rc" "$accepted" "$refused" + printf 'Unsupported constructs: `%s`. Fleet root: `%s`.\n\n' "$constructs" "$fleet" + + if [[ "$(jq -r '(.candidates // []) | length' <<<"$json")" == "0" ]]; then + printf '_No candidate folders reported._\n' + return + fi + + printf '| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons |\n' + printf '|---|---|---|---|---|---|\n' + jq -r '.candidates[] + | "| `\(.path)` | `\(.layout)` | \(.acceptedByOperator) | `\(.inferredNamespace // "-")` | " + + "\(.resources.rendered // 0)/\(.resources.editable // 0)/\(.resources.nonKrm // 0) | " + + ((.refusalReasons // []) | map("\(.code): \(.detail)") | join("
") + | if . == "" then "none" else . end) + + " |"' <<<"$json" +} + +{ + cat <<'PREAMBLE' +# Support today: the GitOps layout corpus + + + +A behavioural baseline: what `manifest-analyzer --mode scan-repo` reports for every +fixture in this corpus, as of the last regeneration. It is **descriptive**. It +records what the tool does today, not what the product should support — that is +[`docs/design/gitops-api/support-contract.md`](../../../docs/design/gitops-api/support-contract.md). + +This file carries no interpretation on purpose. When it disagrees with the support +contract, that disagreement is the backlog. + +Reading rules: + +- `rc=0` means the scan command succeeded. It does **not** mean the fixture is supported. +- `accepted` / `refused` count reported **candidate folders**, not whole-repository support. +- `scan-repo` is structure-only. It never executes Argo CD, Flux, Helm, SOPS, plugins, + or remote fetches — so it cannot see a generator's output, a rendered chart, or an + input set that lives in a Git-host API. +- **A missing candidate matters as much as a refusal**: it means the tool did not + explain that part of the repository at all. + +## Summary + +| Fixture | rc | Outcome | Accepted | Refused | Layouts | Unsupported constructs | Reported refusal signal | +|---|---:|---|---:|---:|---|---|---| +PREAMBLE + + declare -a details=() + for dir in "${fixtures[@]}"; do + name="${dir#"$corpus"/}" + set +e + json="$("$analyzer" --mode scan-repo --format json "$dir" 2>/dev/null)" + rc=$? + set -e + [[ -n "$json" ]] || json='{}' + emit_summary_row "$name" "$rc" "$json" + details+=("$(emit_detail "$name" "$rc" "$json")") + done + + printf '%s\n' "${details[@]}" +} >"$out" + +echo "wrote $out ($(wc -l <"$out") lines, ${#fixtures[@]} fixtures)" >&2 diff --git a/test/e2e/Taskfile.yml b/test/e2e/Taskfile.yml index 92c43dff..2a6d6ee7 100644 --- a/test/e2e/Taskfile.yml +++ b/test/e2e/Taskfile.yml @@ -124,15 +124,15 @@ vars: ALLURE_CONTAINER_IMAGE: '{{.ALLURE_CONTAINER_IMAGE | default "eclipse-temurin:17-jre"}}' ALLURE_PORT: '{{.ALLURE_PORT | default "19081"}}' # Number of parallel Ginkgo processes for the e2e suite. >1 enables Ginkgo - # parallelism (Phase 2.5 of docs/design/e2e-speedup-plan.md). Files that touch - # shared cluster-scoped state are marked Serial (see docs/design/e2e-serial-registry.md). + # parallelism (Phase 2.5 of docs/finished/e2e-speedup-plan.md). Files that touch + # shared cluster-scoped state are marked Serial (see docs/spec/e2e-serial-registry.md). # Default 4 locally: GitTarget isolation on rule changes is now per-target - # (docs/design/gittarget-isolation-on-rule-change.md), so higher parallelism no + # (docs/spec/gittarget-isolation-on-rule-change.md), so higher parallelism no # longer trips cross-target snapshot coupling. E2E_GINKGO_PROCS: '{{.E2E_GINKGO_PROCS | default "4"}}' FLUX_SERVICES_DIR: '{{.FLUX_SERVICES_DIR | default "test/e2e/setup/flux"}}' # Argo CD — installed ONLY for the bi-directional corner - # (docs/design/e2e-bi-directional-corner.md). Unlike Flux, which is load-bearing + # (docs/spec/e2e-bi-directional-corner.md). Unlike Flux, which is load-bearing # for every cluster (Gitea/Valkey/Prometheus arrive as Flux HelmReleases), Argo # CD is needed by two specs, so it hangs off _argocd-installed and nothing else. # @@ -294,10 +294,13 @@ tasks: test-e2e-bi-directional: desc: Run the bi-directional corner (Flux + Argo CD). Installs Argo CD into the cluster. vars: - # Two heavy Ordered specs, each driving a real GitOps controller through - # several reconcile round-trips. They own separate Gitea repos and separate - # IceCreamOrder CRD groups, and neither is Serial, so they run side by side. - BI_DIRECTIONAL_GINKGO_PROCS: '{{.BI_DIRECTIONAL_GINKGO_PROCS | default "2"}}' + # Three Ordered specs, each driving real GitOps controllers through several + # reconcile round-trips. They own separate Gitea repos, separate namespaces, + # and separate resource names (the two bi-directional ones also own separate + # IceCreamOrder CRD groups), and none is Serial, so they run side by side. + # The provenance spec drives no GitTarget and never patches argocd-secret, so + # it shares the argocd namespace with the Argo CD spec without racing it. + BI_DIRECTIONAL_GINKGO_PROCS: '{{.BI_DIRECTIONAL_GINKGO_PROCS | default "3"}}' BI_DIRECTIONAL_TIMEOUT: '{{.BI_DIRECTIONAL_TIMEOUT | default "25m"}}' cmds: # Sequential, not deps: _prepare-e2e-ready restarts the k3d server node when @@ -894,7 +897,7 @@ tasks: _argocd-installed: # Argo CD for the bi-directional corner. NOT a dependency of prepare-e2e — # only test-e2e-bi-directional and argocd-ui pull it in, so the other CI legs - # never install it. See docs/design/e2e-bi-directional-corner.md. + # never install it. See docs/spec/e2e-bi-directional-corner.md. # # _services-ready, because the Argo Application sources from Gitea, which # arrives as a Flux HelmRelease. @@ -1398,7 +1401,7 @@ tasks: touch "{{.CS}}/demo.ready" # ---------------------------------------------------------------------------- - # Mutation-capture lab (docs/design/mutation-capture-lab-design.md). + # Mutation-capture lab (docs/spec/mutation-capture-lab-design.md). # # Opt-in and SERIAL. These targets are NOT invoked by `task test-e2e` and are # NOT part of the default CI lane. The lab deliberately reuses the product's diff --git a/test/e2e/provenance_markers_e2e_test.go b/test/e2e/provenance_markers_e2e_test.go new file mode 100644 index 00000000..e0e41518 --- /dev/null +++ b/test/e2e/provenance_markers_e2e_test.go @@ -0,0 +1,618 @@ +// SPDX-License-Identifier: Apache-2.0 + +package e2e + +import ( + "encoding/json" + "fmt" + "os" + "path/filepath" + "strconv" + "time" + + . "github.com/onsi/ginkgo/v2" + . "github.com/onsi/gomega" + "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" +) + +// Provenance markers: what each GitOps producer stamps on the objects it creates. +// +// GitOps Reverser is a live -> Git tool, so before it may mirror a live object it +// must answer one question: DOES THIS OBJECT HAVE A HOME IN GIT? An object a +// controller synthesised has none, and writing it to Git invents a second source of +// truth that fights the controller that made it. +// +// The answer is read off the provenance evidence the applying controller leaves +// behind — and the design docs assumed that evidence was a controller +// ownerReference. It is not. This spec pins what the evidence ACTUALLY is, against +// real controllers, so the gate is built on measurement rather than on memory. +// +// It is the executable form of docs/facts/expansion-provenance-markers.md. If a +// controller upgrade changes a marker, this spec fails loudly — which is the point. +// +// Five producers, one Git repository, one commit: +// +// Flux Kustomization -> kustomize.toolkit.fluxcd.io/* source: a FOLDER -> has a home +// Argo CD Application -> argocd.argoproj.io/tracking-id source: a FOLDER -> has a home +// Flux HelmRelease -> helm.toolkit.fluxcd.io/* source: a CHART -> NO home +// flux-operator RS -> resourceset.fluxcd.controlplane.io/* source: a TEMPLATE -> NO home +// Argo ApplicationSet -> ownerReference on the Application source: a GENERATOR-> NO home +// +// Note the two rows that decide everything: kustomize.toolkit and helm.toolkit are +// SIBLING PREFIXES from the same vendor with OPPOSITE verdicts. Any rule that gates +// on the prefix family gets one of them exactly backwards. +// +// Lives in the bi-directional corner because that is the only place Argo CD is +// installed (docs/spec/e2e-bi-directional-corner.md). It drives no GitTarget and no +// WatchRule: the reverser is not under test here — the ecosystem is. +var _ = Describe("Expansion provenance markers", Label("bi-directional", "provenance"), Ordered, func() { + var run provenanceRun + var testNs string + + BeforeAll(func() { + skipUnlessBiDirectionalEnabled() + requireArgoCDInstalled() + + By("creating test namespace") + testNs = testNamespaceFor("provenance") + _, _ = kubectlRun("create", "namespace", testNs) // idempotent; ignore AlreadyExists + + By("setting up a Gitea repo the producers all read from") + provenanceRepo = SetupRepo( + resolveE2EContext(), + testNs, + fmt.Sprintf("e2e-provenance-%d", GinkgoRandomSeed()), + ) + + _, err := kubectlRunInNamespace(testNs, "apply", "-f", provenanceRepo.SecretsYAML) + Expect(err).NotTo(HaveOccurred(), "failed to apply git secrets to test namespace") + + run = newProvenanceRun(testNs) + run.assertCheckoutReady() + + // SetupRepo leaves the remote EMPTY, so `main` does not exist until we push. + // Every producer below sources from that branch, so it must be seeded first. + By("seeding main with one folder of plain KRM and one Helm chart") + run.writeRepoContents() + Expect(run.commitAllAndPush("provenance: seed folders and chart")).To(Succeed()) + }) + + AfterAll(func() { + if !biDirectionalEnabled() { + // BeforeAll skipped before creating anything; `run` and `testNs` are zero. + return + } + run.cleanup() + cleanupNamespace(testNs) + }) + + It("records what each producer stamps, and whether its source is a folder or a template", func() { + run.applyFluxGitRepository() + + // ------------------------------------------------------------------ + // Producer 1 — Flux Kustomization. Source: a folder of files. + // ------------------------------------------------------------------ + By("applying a Flux Kustomization over a folder of plain KRM") + run.applyFluxKustomization() + run.waitForConfigMap(run.kustomizeCM) + + prov := run.configMapProvenance(run.kustomizeCM) + + Expect(prov.labels).To(HaveKeyWithValue(provKustomizeNameLabel, run.fluxKustomizationName), + "kustomize-controller must label the objects it applies") + Expect(prov.labels).To(HaveKey(provKustomizeNamespaceLabel)) + Expect(prov.owners).To(BeEmpty(), + "kustomize-controller sets NO ownerReference — the derived-object gate cannot key on one") + Expect(prov.managers).To(ContainElement("kustomize-controller")) + Expect(prov.annotations).NotTo(HaveKey(provArgoTrackingID)) + + // ------------------------------------------------------------------ + // Producer 2 — Flux HelmRelease. Source: a chart. SAME repo, SAME commit. + // ------------------------------------------------------------------ + By("applying a Flux HelmRelease whose chart is a folder in the same repository") + run.applyFluxHelmRelease() + run.waitForHelmReleaseReady() + run.waitForConfigMap(run.helmCM) + + prov = run.configMapProvenance(run.helmCM) + + Expect(prov.labels).To(HaveKeyWithValue(provHelmNameLabel, run.fluxHelmReleaseName), + "helm-controller labels rendered objects with helm.toolkit.fluxcd.io/name") + Expect(prov.labels).To(HaveKey(provHelmNamespaceLabel)) + Expect(prov.owners).To(BeEmpty(), + "helm-controller sets NO ownerReference either — a HelmRelease's output is invisible to an ownerReference gate") + Expect(prov.managers).To(ContainElement("helm-controller")) + + // THE LOAD-BEARING CONTRAST. Both objects came from the same repository and + // the same commit. Both carry a `*.toolkit.fluxcd.io/` label. One has a home + // file and one does not, and the label prefix does not tell them apart — + // only the controller's SOURCE does. + Expect(prov.labels).NotTo(HaveKey(provKustomizeNameLabel), + "the two Flux markers must be distinguishable: they carry opposite verdicts") + + // ------------------------------------------------------------------ + // Producer 3 — flux-operator ResourceSet. Source: a template in the CR. + // ------------------------------------------------------------------ + By("applying a flux-operator ResourceSet with two inputs and inline KRM") + run.applyResourceSet() + + for _, tenant := range []string{run.tenantOneCM, run.tenantTwoCM} { + run.waitForConfigMap(tenant) + prov = run.configMapProvenance(tenant) + + Expect(prov.labels).To(HaveKeyWithValue(provResourceSetNameLabel, run.resourceSetName), + "flux-operator labels expanded objects with resourceset.fluxcd.controlplane.io/name") + Expect(prov.labels).To(HaveKey(provResourceSetNamespaceLabel)) + Expect(prov.owners).To(BeEmpty(), + "flux-operator sets NO ownerReference — it tracks children by label plus status.inventory") + Expect(prov.managers).To(ContainElement("flux-operator")) + } + + // The parent's inventory is the only enumeration of what it owns. + By("asserting the ResourceSet's status.inventory enumerates both children") + Expect(run.resourceSetInventoryIDs()).To(HaveLen(2), + "status.inventory is flux-operator's substitute for ownerReferences") + + // ------------------------------------------------------------------ + // Producer 4 — Argo CD Application. Source: a folder of files. + // ------------------------------------------------------------------ + By("applying an Argo CD Application over a folder of plain KRM") + run.applyArgoRepoSecret() + run.applyArgoApplication() + run.syncArgoApplication() + run.waitForConfigMap(run.argoCM) + + prov = run.configMapProvenance(run.argoCM) + + Expect(prov.annotations).To(HaveKeyWithValue(provArgoTrackingID, run.expectedTrackingID()), + "Argo CD's default tracking method is `annotation`, and this is its exact format") + Expect(prov.owners).To(BeEmpty(), "Argo CD sets no ownerReference on the objects it applies") + Expect(prov.managers).To(ContainElement("argocd-controller")) + Expect(prov.labels).NotTo(HaveKey(provKustomizeNameLabel)) + + // ------------------------------------------------------------------ + // Producer 5 — Argo CD ApplicationSet. Source: a generator. + // The ONLY producer of the five that uses an ownerReference. + // ------------------------------------------------------------------ + By("applying an ApplicationSet and reading the Application it generates") + run.applyApplicationSet() + run.waitForGeneratedApplication() + + generated := run.generatedApplication() + + genOwners, _, err := unstructured.NestedSlice(generated.Object, "metadata", "ownerReferences") + Expect(err).NotTo(HaveOccurred()) + Expect(genOwners).To(HaveLen(1), + "the applicationset-controller IS the one producer that sets an ownerReference") + + owner, ok := genOwners[0].(map[string]interface{}) + Expect(ok).To(BeTrue()) + Expect(owner["kind"]).To(Equal("ApplicationSet")) + Expect(owner["name"]).To(Equal(run.applicationSetName)) + Expect(owner["controller"]).To(BeTrue()) + + // The structural asymmetry with a ResourceSet, in one assertion: the + // generated Application has no home file, but it POINTS AT one. So the + // workloads beneath it round-trip normally — which is exactly what a + // ResourceSet's expanded objects can never do. + By("asserting the generated Application points at a real path in Git") + sourcePath, _, err := unstructured.NestedString(generated.Object, "spec", "source", "path") + Expect(err).NotTo(HaveOccurred()) + Expect(sourcePath).To(Equal(provAppSetPath)) + Expect(run.repoPath(provAppSetPath, "configmap.yaml")).To(BeAnExistingFile(), + "the path the generated Application names is a real folder of real files") + }) +}) + +// provenanceRepo holds the file-local repo fixtures for the provenance describe block. +var provenanceRepo *RepoArtifacts + +// The markers themselves. Each is a fact about a controller, verified by this spec. +const ( + provKustomizeNameLabel = "kustomize.toolkit.fluxcd.io/name" + provKustomizeNamespaceLabel = "kustomize.toolkit.fluxcd.io/namespace" + provHelmNameLabel = "helm.toolkit.fluxcd.io/name" + provHelmNamespaceLabel = "helm.toolkit.fluxcd.io/namespace" + provResourceSetNameLabel = "resourceset.fluxcd.controlplane.io/name" + provResourceSetNamespaceLabel = "resourceset.fluxcd.controlplane.io/namespace" + provArgoTrackingID = "argocd.argoproj.io/tracking-id" +) + +// Paths inside the seeded repository. Each producer gets its own folder so that no +// two of them apply the same object — two Argo Applications over one path would +// each stamp their own tracking-id and raise SharedResourceWarning on the other. +const ( + provFluxPath = "flux-apps" + provArgoPath = "argo-apps" + provAppSetPath = "appset-apps" + provChartPath = "chart" +) + +const ( + provEventuallyTimeout = 120 * time.Second + provHelmTimeout = 180 * time.Second +) + +type provenanceRun struct { + gitCheckout + + testNs string + argoNs string + + repoURL string + + fluxSecretName string + fluxGitRepositoryName string + fluxKustomizationName string + fluxHelmReleaseName string + resourceSetName string + + argoRepoSecretName string + argoAppName string + applicationSetName string + generatedAppName string + + // One ConfigMap per producer, so a marker can never be attributed to the wrong one. + kustomizeCM string + helmCM string + argoCM string + tenantOneCM string + tenantTwoCM string +} + +func newProvenanceRun(testNs string) provenanceRun { + id := strconv.FormatInt(time.Now().UnixNano(), 10) + return provenanceRun{ + gitCheckout: newGitCheckout(provenanceRepo, testNs), + testNs: testNs, + argoNs: argoNamespace(), + repoURL: provenanceRepo.RepoURLHTTP, + fluxSecretName: fmt.Sprintf("prov-auth-%s", id), + fluxGitRepositoryName: fmt.Sprintf("prov-repo-%s", id), + fluxKustomizationName: fmt.Sprintf("prov-kustomization-%s", id), + fluxHelmReleaseName: fmt.Sprintf("prov-helm-%s", id), + resourceSetName: fmt.Sprintf("prov-rs-%s", id), + argoRepoSecretName: fmt.Sprintf("prov-argo-repo-%s", id), + argoAppName: fmt.Sprintf("prov-app-%s", id), + applicationSetName: fmt.Sprintf("prov-appset-%s", id), + generatedAppName: fmt.Sprintf("prov-generated-%s", id), + kustomizeCM: "prov-kustomize-applied", + helmCM: "prov-helm-rendered", + argoCM: "prov-argo-applied", + tenantOneCM: "prov-tenant-one", + tenantTwoCM: "prov-tenant-two", + } +} + +// writeRepoContents seeds three folders of plain KRM and one real Helm chart. +// +// The chart's template holds `{{ .Release.Namespace }}`, which Helm must render and +// Go's text/template must never see — so these files are written directly rather +// than through renderTemplate. +func (r provenanceRun) writeRepoContents() { + GinkgoHelper() + + configMap := func(name string) string { + return fmt.Sprintf(`apiVersion: v1 +kind: ConfigMap +metadata: + name: %s + namespace: %s +data: + producer: %s +`, name, r.testNs, name) + } + + for path, cm := range map[string]string{ + provFluxPath: r.kustomizeCM, + provArgoPath: r.argoCM, + provAppSetPath: "prov-appset-never-synced", + } { + dir := r.repoPath(path) + Expect(os.MkdirAll(dir, 0o755)).To(Succeed()) + Expect(os.WriteFile(filepath.Join(dir, "configmap.yaml"), []byte(configMap(cm)), 0o644)).To(Succeed()) + } + + chartDir := r.repoPath(provChartPath) + Expect(os.MkdirAll(filepath.Join(chartDir, "templates"), 0o755)).To(Succeed()) + Expect(os.WriteFile(filepath.Join(chartDir, "Chart.yaml"), []byte(`apiVersion: v2 +name: provenance +version: 0.1.0 +description: A minimal chart, so the helm-controller has something real to render. +`), 0o644)).To(Succeed()) + Expect(os.WriteFile(filepath.Join(chartDir, "templates", "configmap.yaml"), []byte(fmt.Sprintf(`apiVersion: v1 +kind: ConfigMap +metadata: + name: %s + namespace: {{ .Release.Namespace }} +data: + producer: helm-controller +`, r.helmCM)), 0o644)).To(Succeed()) +} + +func (r provenanceRun) applyFluxGitRepository() { + GinkgoHelper() + username, password := r.readGitCredentialSecretDataBase64() + Expect(applyFromTemplate("test/e2e/templates/bi-directional/flux-gitrepository-http.tmpl", struct { + Namespace string + SecretName string + Name string + RepoURL string + Branch string + Interval string + Username string + Password string + }{ + Namespace: "flux-system", + SecretName: r.fluxSecretName, + Name: r.fluxGitRepositoryName, + RepoURL: r.repoURL, + Branch: "main", + Interval: "30m", + Username: username, + Password: password, + }, "flux-system")).To(Succeed(), "failed to apply Flux GitRepository") +} + +func (r provenanceRun) applyFluxKustomization() { + GinkgoHelper() + Expect(applyFromTemplate("test/e2e/templates/bi-directional/flux-kustomization.tmpl", struct { + Namespace string + Name string + Path string + SourceName string + Interval string + DependsOn string + Prune bool + Wait bool + TargetNS string + HasTargetNS bool + DecryptionProvider string + DecryptionSecretName string + }{ + Namespace: "flux-system", + Name: r.fluxKustomizationName, + Path: "./" + provFluxPath, + SourceName: r.fluxGitRepositoryName, + Interval: "30m", + Prune: true, + Wait: true, + }, "flux-system")).To(Succeed(), "failed to apply Flux Kustomization") +} + +func (r provenanceRun) applyFluxHelmRelease() { + GinkgoHelper() + Expect(applyFromTemplate("test/e2e/templates/provenance/helmrelease.tmpl", struct { + Name string + Namespace string + TargetNamespace string + ChartPath string + SourceName string + Interval string + }{ + Name: r.fluxHelmReleaseName, + Namespace: "flux-system", + TargetNamespace: r.testNs, + ChartPath: "./" + provChartPath, + SourceName: r.fluxGitRepositoryName, + Interval: "30m", + }, "flux-system")).To(Succeed(), "failed to apply Flux HelmRelease") +} + +func (r provenanceRun) applyResourceSet() { + GinkgoHelper() + Expect(applyFromTemplate("test/e2e/templates/provenance/resourceset.tmpl", struct { + Name string + Namespace string + TargetNamespace string + TenantOne string + TenantTwo string + }{ + Name: r.resourceSetName, + Namespace: "flux-system", + TargetNamespace: r.testNs, + TenantOne: r.tenantOneCM, + TenantTwo: r.tenantTwoCM, + }, "flux-system")).To(Succeed(), "failed to apply flux-operator ResourceSet") +} + +func (r provenanceRun) applyArgoRepoSecret() { + GinkgoHelper() + username, password := r.readGitCredentialSecretDataDecoded() + Expect(applyFromTemplate("test/e2e/templates/bi-directional/argocd-repo-secret.tmpl", struct { + Name string + Namespace string + RepoURL string + Username string + Password string + }{ + Name: r.argoRepoSecretName, + Namespace: r.argoNs, + RepoURL: r.repoURL, + Username: username, + Password: password, + }, r.argoNs)).To(Succeed(), "failed to apply Argo CD repository Secret") +} + +func (r provenanceRun) applyArgoApplication() { + GinkgoHelper() + Expect(applyFromTemplate("test/e2e/templates/bi-directional/argocd-application.tmpl", argoAppConfig{ + Name: r.argoAppName, + ArgoNamespace: r.argoNs, + RepoURL: r.repoURL, + Branch: "main", + Path: provArgoPath, + DestinationNamespace: r.testNs, + }, r.argoNs)).To(Succeed(), "failed to apply Argo CD Application") +} + +func (r provenanceRun) applyApplicationSet() { + GinkgoHelper() + Expect(applyFromTemplate("test/e2e/templates/provenance/applicationset.tmpl", struct { + Name string + ArgoNamespace string + AppSuffix string + RepoURL string + Branch string + Path string + DestinationNamespace string + }{ + Name: r.applicationSetName, + ArgoNamespace: r.argoNs, + AppSuffix: r.generatedAppName, + RepoURL: r.repoURL, + Branch: "main", + Path: provAppSetPath, + DestinationNamespace: r.testNs, + }, r.argoNs)).To(Succeed(), "failed to apply Argo CD ApplicationSet") +} + +// syncArgoApplication refreshes and syncs without the push webhook: this spec never +// pushes a second commit, so there is nothing for a webhook to notice, and Argo's +// own poll is ~120s + jitter. +func (r provenanceRun) syncArgoApplication() { + GinkgoHelper() + By("refreshing and syncing the Argo CD Application") + + _, err := kubectlRunInNamespace(r.argoNs, "annotate", "application.argoproj.io", r.argoAppName, + "argocd.argoproj.io/refresh=normal", "--overwrite") + Expect(err).NotTo(HaveOccurred(), "failed to request an Argo CD refresh") + + Eventually(func(g Gomega) { + _, patchErr := kubectlRunInNamespace(r.argoNs, "patch", "application.argoproj.io", r.argoAppName, + "--type=merge", "--patch", + `{"operation":{"initiatedBy":{"username":"e2e"},"sync":{"revision":"main"}}}`) + g.Expect(patchErr).NotTo(HaveOccurred()) + }, provEventuallyTimeout, biPollInterval).Should(Succeed()) + + Eventually(func(g Gomega) { + out, getErr := kubectlRunInNamespace(r.argoNs, "get", "application.argoproj.io", r.argoAppName, + "-o", "jsonpath={.status.operationState.phase}") + g.Expect(getErr).NotTo(HaveOccurred()) + g.Expect(out).To(Equal("Succeeded"), "Argo CD sync did not succeed") + }, provEventuallyTimeout, biPollInterval).Should(Succeed()) +} + +func (r provenanceRun) expectedTrackingID() string { + // :/:/. A core ConfigMap has an empty group. + return fmt.Sprintf("%s:/ConfigMap:%s/%s", r.argoAppName, r.testNs, r.argoCM) +} + +func (r provenanceRun) waitForConfigMap(name string) { + GinkgoHelper() + Eventually(func(g Gomega) { + _, err := kubectlRunInNamespace(r.testNs, "get", "configmap", name) + g.Expect(err).NotTo(HaveOccurred()) + }, provEventuallyTimeout, biPollInterval).Should(Succeed(), fmt.Sprintf("ConfigMap %q never appeared", name)) +} + +func (r provenanceRun) waitForHelmReleaseReady() { + GinkgoHelper() + Eventually(func(g Gomega) { + out, err := kubectlRunInNamespace("flux-system", "get", "helmrelease", r.fluxHelmReleaseName, + "-o", "jsonpath={.status.conditions[?(@.type=='Ready')].status}") + g.Expect(err).NotTo(HaveOccurred()) + g.Expect(out).To(Equal("True"), "HelmRelease never became Ready") + }, provHelmTimeout, biPollInterval).Should(Succeed()) +} + +// objectProvenance is everything a provenance gate could possibly key on. +type objectProvenance struct { + labels map[string]string + annotations map[string]string + owners []interface{} + managers []string +} + +// configMapProvenance reads every provenance signal off one live ConfigMap. +func (r provenanceRun) configMapProvenance(name string) objectProvenance { + GinkgoHelper() + + // --show-managed-fields is required: kubectl's json/yaml printers strip + // managedFields by default, and the applying field manager is one of the four + // provenance signals this spec exists to record. + out, err := kubectlRunInNamespace(r.testNs, "get", "configmap", name, "-o", "json", "--show-managed-fields") + Expect(err).NotTo(HaveOccurred(), fmt.Sprintf("failed to read ConfigMap %q", name)) + + var obj unstructured.Unstructured + Expect(json.Unmarshal([]byte(out), &obj.Object)).To(Succeed()) + + var prov objectProvenance + + prov.labels, _, err = unstructured.NestedStringMap(obj.Object, "metadata", "labels") + Expect(err).NotTo(HaveOccurred()) + prov.annotations, _, err = unstructured.NestedStringMap(obj.Object, "metadata", "annotations") + Expect(err).NotTo(HaveOccurred()) + prov.owners, _, err = unstructured.NestedSlice(obj.Object, "metadata", "ownerReferences") + Expect(err).NotTo(HaveOccurred()) + + fields, _, err := unstructured.NestedSlice(obj.Object, "metadata", "managedFields") + Expect(err).NotTo(HaveOccurred()) + for _, f := range fields { + entry, ok := f.(map[string]interface{}) + if !ok { + continue + } + if manager, ok := entry["manager"].(string); ok { + prov.managers = append(prov.managers, manager) + } + } + + return prov +} + +func (r provenanceRun) resourceSetInventoryIDs() []interface{} { + GinkgoHelper() + var entries []interface{} + + Eventually(func(g Gomega) { + out, err := kubectlRunInNamespace("flux-system", "get", "resourceset", r.resourceSetName, "-o", "json") + g.Expect(err).NotTo(HaveOccurred()) + + var obj unstructured.Unstructured + g.Expect(json.Unmarshal([]byte(out), &obj.Object)).To(Succeed()) + + var ( + found bool + nestedErr error + ) + entries, found, nestedErr = unstructured.NestedSlice(obj.Object, "status", "inventory", "entries") + g.Expect(nestedErr).NotTo(HaveOccurred()) + g.Expect(found).To(BeTrue(), "ResourceSet has no status.inventory") + }, provEventuallyTimeout, biPollInterval).Should(Succeed()) + + return entries +} + +func (r provenanceRun) waitForGeneratedApplication() { + GinkgoHelper() + Eventually(func(g Gomega) { + _, err := kubectlRunInNamespace(r.argoNs, "get", "application.argoproj.io", r.generatedAppName) + g.Expect(err).NotTo(HaveOccurred()) + }, provEventuallyTimeout, biPollInterval).Should(Succeed(), + "the ApplicationSet never generated an Application") +} + +func (r provenanceRun) generatedApplication() *unstructured.Unstructured { + GinkgoHelper() + out, err := kubectlRunInNamespace(r.argoNs, "get", "application.argoproj.io", r.generatedAppName, "-o", "json") + Expect(err).NotTo(HaveOccurred()) + + var obj unstructured.Unstructured + Expect(json.Unmarshal([]byte(out), &obj.Object)).To(Succeed()) + return &obj +} + +func (r provenanceRun) cleanup() { + // The ApplicationSet must go first: deleting it garbage-collects the Application + // it owns, via the one ownerReference this whole spec exists to demonstrate. + cleanupNamespacedResource(r.argoNs, "applicationset", r.applicationSetName) + cleanupNamespacedResource(r.argoNs, "application", r.argoAppName) + cleanupNamespacedResource(r.argoNs, "secret", r.argoRepoSecretName) + + cleanupNamespacedResource("flux-system", "resourceset", r.resourceSetName) + cleanupNamespacedResource("flux-system", "helmrelease", r.fluxHelmReleaseName) + cleanupNamespacedResource("flux-system", "kustomization", r.fluxKustomizationName) + cleanupNamespacedResource("flux-system", "gitrepository", r.fluxGitRepositoryName) + cleanupNamespacedResource("flux-system", "secret", r.fluxSecretName) +} diff --git a/test/e2e/setup/argocd/values.yaml b/test/e2e/setup/argocd/values.yaml index 93c3a0af..bdfed778 100644 --- a/test/e2e/setup/argocd/values.yaml +++ b/test/e2e/setup/argocd/values.yaml @@ -6,7 +6,7 @@ # chart version is pinned in ARGOCD_CHART_VERSION (test/e2e/Taskfile.yml); its # appVersion is the Argo CD release the specs pin behaviour against. # -# Design: docs/design/e2e-bi-directional-corner.md. README.md lists what to +# Design: docs/spec/e2e-bi-directional-corner.md. README.md lists what to # re-verify on a bump. # CRDs travel with the chart (crds.install: true by default). Keep them on chart diff --git a/test/e2e/templates/provenance/applicationset.tmpl b/test/e2e/templates/provenance/applicationset.tmpl new file mode 100644 index 00000000..8b5f50dc --- /dev/null +++ b/test/e2e/templates/provenance/applicationset.tmpl @@ -0,0 +1,35 @@ +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: {{ .Name }} + namespace: {{ .ArgoNamespace }} +spec: + # goTemplate is load-bearing. Without it the template engine is `fasttemplate`, + # which leaves Go-template syntax literal, so every element renders the SAME + # name and Argo rejects the set with "contains applications with duplicate name". + goTemplate: true + generators: + - list: + elements: + - app: {{ .AppSuffix }} + template: + metadata: + name: '{{ "{{" }}.app{{ "}}" }}' + spec: + project: default + source: + repoURL: {{ .RepoURL }} + targetRevision: {{ .Branch }} + # The generated Application points at a REAL PATH IN GIT. That is the + # structural asymmetry with a ResourceSet: the Application CR itself has + # no home file, but the workloads beneath it do. + path: {{ .Path }} + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: {{ .DestinationNamespace }} + # Deliberately no syncPolicy: this Application must never sync. The spec + # asserts only what the applicationset-controller stamps on the CR it + # generates; syncing it would fight the standalone Application above over + # the same objects. diff --git a/test/e2e/templates/provenance/helmrelease.tmpl b/test/e2e/templates/provenance/helmrelease.tmpl new file mode 100644 index 00000000..373309e1 --- /dev/null +++ b/test/e2e/templates/provenance/helmrelease.tmpl @@ -0,0 +1,24 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: {{ .Name }} + namespace: {{ .Namespace }} +spec: + interval: {{ .Interval }} + releaseName: {{ .Name }} + targetNamespace: {{ .TargetNamespace }} + storageNamespace: {{ .TargetNamespace }} + chart: + spec: + # The chart is a folder of files in the SAME Git repository the Flux + # Kustomization reads. Same source, same commit — and yet the objects the + # helm-controller renders from it have no home file, while the ones the + # kustomize-controller applies do. That contrast is the point of this spec. + chart: {{ .ChartPath }} + reconcileStrategy: Revision + sourceRef: + kind: GitRepository + name: {{ .SourceName }} + interval: {{ .Interval }} + install: + createNamespace: false diff --git a/test/e2e/templates/provenance/resourceset.tmpl b/test/e2e/templates/provenance/resourceset.tmpl new file mode 100644 index 00000000..2c77525b --- /dev/null +++ b/test/e2e/templates/provenance/resourceset.tmpl @@ -0,0 +1,20 @@ +apiVersion: fluxcd.controlplane.io/v1 +kind: ResourceSet +metadata: + name: {{ .Name }} + namespace: {{ .Namespace }} +spec: + inputs: + - tenant: {{ .TenantOne }} + - tenant: {{ .TenantTwo }} + resources: + # Arbitrary KRM embedded in the CR body and rendered once per input. + # There is no `path` and no `sourceRef`: nothing here has a home file. + # flux-operator templates with Go text/template and << >> delimiters. + - apiVersion: v1 + kind: ConfigMap + metadata: + name: << inputs.tenant >> + namespace: {{ .TargetNamespace }} + data: + producer: flux-operator diff --git a/test/fixtures/gitops-layouts/02-argocd-app-of-apps/README.md b/test/fixtures/gitops-layouts/1-desired-state/argocd-app-of-apps/README.md similarity index 99% rename from test/fixtures/gitops-layouts/02-argocd-app-of-apps/README.md rename to test/fixtures/gitops-layouts/1-desired-state/argocd-app-of-apps/README.md index 607a3f94..2003232c 100644 --- a/test/fixtures/gitops-layouts/02-argocd-app-of-apps/README.md +++ b/test/fixtures/gitops-layouts/1-desired-state/argocd-app-of-apps/README.md @@ -1,4 +1,4 @@ -# 02-argocd-app-of-apps +# argocd-app-of-apps ## What this is The classic Argo CD bootstrap pattern, known as "app of apps". A single root diff --git a/test/fixtures/gitops-layouts/02-argocd-app-of-apps/applications/backend.yaml b/test/fixtures/gitops-layouts/1-desired-state/argocd-app-of-apps/applications/backend.yaml similarity index 100% rename from test/fixtures/gitops-layouts/02-argocd-app-of-apps/applications/backend.yaml rename to test/fixtures/gitops-layouts/1-desired-state/argocd-app-of-apps/applications/backend.yaml diff --git a/test/fixtures/gitops-layouts/02-argocd-app-of-apps/applications/frontend.yaml b/test/fixtures/gitops-layouts/1-desired-state/argocd-app-of-apps/applications/frontend.yaml similarity index 100% rename from test/fixtures/gitops-layouts/02-argocd-app-of-apps/applications/frontend.yaml rename to test/fixtures/gitops-layouts/1-desired-state/argocd-app-of-apps/applications/frontend.yaml diff --git a/test/fixtures/gitops-layouts/02-argocd-app-of-apps/bootstrap/root.yaml b/test/fixtures/gitops-layouts/1-desired-state/argocd-app-of-apps/bootstrap/root.yaml similarity index 100% rename from test/fixtures/gitops-layouts/02-argocd-app-of-apps/bootstrap/root.yaml rename to test/fixtures/gitops-layouts/1-desired-state/argocd-app-of-apps/bootstrap/root.yaml diff --git a/test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/backend/deployment.yaml b/test/fixtures/gitops-layouts/1-desired-state/argocd-app-of-apps/manifests/backend/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/backend/deployment.yaml rename to test/fixtures/gitops-layouts/1-desired-state/argocd-app-of-apps/manifests/backend/deployment.yaml diff --git a/test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/backend/service.yaml b/test/fixtures/gitops-layouts/1-desired-state/argocd-app-of-apps/manifests/backend/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/backend/service.yaml rename to test/fixtures/gitops-layouts/1-desired-state/argocd-app-of-apps/manifests/backend/service.yaml diff --git a/test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/frontend/application.yaml b/test/fixtures/gitops-layouts/1-desired-state/argocd-app-of-apps/manifests/frontend/application.yaml similarity index 100% rename from test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/frontend/application.yaml rename to test/fixtures/gitops-layouts/1-desired-state/argocd-app-of-apps/manifests/frontend/application.yaml diff --git a/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/service.yaml b/test/fixtures/gitops-layouts/1-desired-state/argocd-app-of-apps/manifests/frontend/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/service.yaml rename to test/fixtures/gitops-layouts/1-desired-state/argocd-app-of-apps/manifests/frontend/service.yaml diff --git a/test/fixtures/gitops-layouts/01-argocd-plain/README.md b/test/fixtures/gitops-layouts/1-desired-state/argocd-plain/README.md similarity index 99% rename from test/fixtures/gitops-layouts/01-argocd-plain/README.md rename to test/fixtures/gitops-layouts/1-desired-state/argocd-plain/README.md index 342ebf09..3e181ede 100644 --- a/test/fixtures/gitops-layouts/01-argocd-plain/README.md +++ b/test/fixtures/gitops-layouts/1-desired-state/argocd-plain/README.md @@ -1,4 +1,4 @@ -# 01-argocd-plain +# argocd-plain ## What this is The simplest Argo CD pattern: a single `Application` that points at a plain diff --git a/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/ci-metadata.yaml b/test/fixtures/gitops-layouts/1-desired-state/argocd-plain/apps/frontend/ci-metadata.yaml similarity index 100% rename from test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/ci-metadata.yaml rename to test/fixtures/gitops-layouts/1-desired-state/argocd-plain/apps/frontend/ci-metadata.yaml diff --git a/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/deployment.yaml b/test/fixtures/gitops-layouts/1-desired-state/argocd-plain/apps/frontend/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/deployment.yaml rename to test/fixtures/gitops-layouts/1-desired-state/argocd-plain/apps/frontend/deployment.yaml diff --git a/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/ingress.yaml b/test/fixtures/gitops-layouts/1-desired-state/argocd-plain/apps/frontend/ingress.yaml similarity index 100% rename from test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/ingress.yaml rename to test/fixtures/gitops-layouts/1-desired-state/argocd-plain/apps/frontend/ingress.yaml diff --git a/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/namespace.yaml b/test/fixtures/gitops-layouts/1-desired-state/argocd-plain/apps/frontend/namespace.yaml similarity index 100% rename from test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/namespace.yaml rename to test/fixtures/gitops-layouts/1-desired-state/argocd-plain/apps/frontend/namespace.yaml diff --git a/test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/rbac-and-config.yaml b/test/fixtures/gitops-layouts/1-desired-state/argocd-plain/apps/frontend/rbac-and-config.yaml similarity index 100% rename from test/fixtures/gitops-layouts/01-argocd-plain/apps/frontend/rbac-and-config.yaml rename to test/fixtures/gitops-layouts/1-desired-state/argocd-plain/apps/frontend/rbac-and-config.yaml diff --git a/test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/frontend/service.yaml b/test/fixtures/gitops-layouts/1-desired-state/argocd-plain/apps/frontend/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/02-argocd-app-of-apps/manifests/frontend/service.yaml rename to test/fixtures/gitops-layouts/1-desired-state/argocd-plain/apps/frontend/service.yaml diff --git a/test/fixtures/gitops-layouts/01-argocd-plain/argocd/frontend-application.yaml b/test/fixtures/gitops-layouts/1-desired-state/argocd-plain/argocd/frontend-application.yaml similarity index 100% rename from test/fixtures/gitops-layouts/01-argocd-plain/argocd/frontend-application.yaml rename to test/fixtures/gitops-layouts/1-desired-state/argocd-plain/argocd/frontend-application.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/README.md b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/README.md similarity index 99% rename from test/fixtures/gitops-layouts/09-flux-monorepo/README.md rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/README.md index 995fe53d..b676cc4c 100644 --- a/test/fixtures/gitops-layouts/09-flux-monorepo/README.md +++ b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/README.md @@ -1,4 +1,4 @@ -# 09-flux-monorepo +# flux-monorepo ## What this is The canonical Flux CD layout promoted in the Flux documentation and the upstream diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/apps/base/frontend/deployment.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/apps/base/frontend/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/apps/base/frontend/deployment.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/apps/base/frontend/deployment.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/apps/base/frontend/kustomization.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/apps/base/frontend/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/apps/base/frontend/kustomization.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/apps/base/frontend/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/apps/base/frontend/service.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/apps/base/frontend/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/apps/base/frontend/service.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/apps/base/frontend/service.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/apps/production/frontend-patch.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/apps/production/frontend-patch.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/apps/production/frontend-patch.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/apps/production/frontend-patch.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/apps/production/kustomization.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/apps/production/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/apps/production/kustomization.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/apps/production/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/apps/staging/frontend-patch.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/apps/staging/frontend-patch.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/apps/staging/frontend-patch.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/apps/staging/frontend-patch.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/apps/staging/kustomization.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/apps/staging/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/apps/staging/kustomization.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/apps/staging/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/apps.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/production/apps.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/apps.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/production/apps.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/flux-system/gotk-components.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/production/flux-system/gotk-components.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/flux-system/gotk-components.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/production/flux-system/gotk-components.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/flux-system/gotk-sync.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/production/flux-system/gotk-sync.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/flux-system/gotk-sync.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/production/flux-system/gotk-sync.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/flux-system/kustomization.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/production/flux-system/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/flux-system/kustomization.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/production/flux-system/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/infrastructure.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/production/infrastructure.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/infrastructure.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/production/infrastructure.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/kustomization.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/production/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/clusters/production/kustomization.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/production/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/apps.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/staging/apps.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/apps.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/staging/apps.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/flux-system/gotk-components.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/staging/flux-system/gotk-components.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/flux-system/gotk-components.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/staging/flux-system/gotk-components.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/flux-system/gotk-sync.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/staging/flux-system/gotk-sync.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/flux-system/gotk-sync.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/staging/flux-system/gotk-sync.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/flux-system/kustomization.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/staging/flux-system/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/flux-system/kustomization.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/staging/flux-system/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/infrastructure.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/staging/infrastructure.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/infrastructure.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/staging/infrastructure.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/kustomization.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/staging/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/clusters/staging/kustomization.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/clusters/staging/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/configs/cluster-issuers.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/infrastructure/configs/cluster-issuers.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/configs/cluster-issuers.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/infrastructure/configs/cluster-issuers.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/configs/kustomization.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/infrastructure/configs/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/configs/kustomization.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/infrastructure/configs/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/controllers/ingress-nginx.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/infrastructure/controllers/ingress-nginx.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/controllers/ingress-nginx.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/infrastructure/controllers/ingress-nginx.yaml diff --git a/test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/controllers/kustomization.yaml b/test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/infrastructure/controllers/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/09-flux-monorepo/infrastructure/controllers/kustomization.yaml rename to test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/infrastructure/controllers/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/README.md b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/README.md similarity index 99% rename from test/fixtures/gitops-layouts/11-repo-per-environment/README.md rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/README.md index a983b656..7617d92b 100644 --- a/test/fixtures/gitops-layouts/11-repo-per-environment/README.md +++ b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/README.md @@ -1,4 +1,4 @@ -# 11-repo-per-environment +# repo-per-environment ## What this is A layout where the environment boundary is a **repository** boundary rather than a diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/.gitignore b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-dev/.gitignore similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/.gitignore rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-dev/.gitignore diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/backend/deployment.yaml b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-dev/apps/backend/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/backend/deployment.yaml rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-dev/apps/backend/deployment.yaml diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/backend/service.yaml b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-dev/apps/backend/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/backend/service.yaml rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-dev/apps/backend/service.yaml diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/frontend/deployment.yaml b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-dev/apps/frontend/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/frontend/deployment.yaml rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-dev/apps/frontend/deployment.yaml diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/frontend/service.yaml b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-dev/apps/frontend/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/apps/frontend/service.yaml rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-dev/apps/frontend/service.yaml diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/namespaces.yaml b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-dev/namespaces.yaml similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-dev/namespaces.yaml rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-dev/namespaces.yaml diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/.gitignore b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-production/.gitignore similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/.gitignore rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-production/.gitignore diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/backend/deployment.yaml b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-production/apps/backend/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/backend/deployment.yaml rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-production/apps/backend/deployment.yaml diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/backend/service.yaml b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-production/apps/backend/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/backend/service.yaml rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-production/apps/backend/service.yaml diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/frontend/deployment.yaml b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-production/apps/frontend/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/frontend/deployment.yaml rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-production/apps/frontend/deployment.yaml diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/frontend/hpa.yaml b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-production/apps/frontend/hpa.yaml similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/frontend/hpa.yaml rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-production/apps/frontend/hpa.yaml diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/frontend/service.yaml b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-production/apps/frontend/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/apps/frontend/service.yaml rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-production/apps/frontend/service.yaml diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/namespaces.yaml b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-production/namespaces.yaml similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-production/namespaces.yaml rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-production/namespaces.yaml diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/.gitignore b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-staging/.gitignore similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/.gitignore rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-staging/.gitignore diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/backend/deployment.yaml b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-staging/apps/backend/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/backend/deployment.yaml rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-staging/apps/backend/deployment.yaml diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/backend/service.yaml b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-staging/apps/backend/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/backend/service.yaml rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-staging/apps/backend/service.yaml diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/frontend/deployment.yaml b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-staging/apps/frontend/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/frontend/deployment.yaml rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-staging/apps/frontend/deployment.yaml diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/frontend/service.yaml b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-staging/apps/frontend/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/apps/frontend/service.yaml rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-staging/apps/frontend/service.yaml diff --git a/test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/namespaces.yaml b/test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-staging/namespaces.yaml similarity index 100% rename from test/fixtures/gitops-layouts/11-repo-per-environment/gitops-staging/namespaces.yaml rename to test/fixtures/gitops-layouts/1-desired-state/repo-per-environment/gitops-staging/namespaces.yaml diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/README.md b/test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/README.md similarity index 99% rename from test/fixtures/gitops-layouts/08-argocd-external-helm/README.md rename to test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/README.md index ed0ec04c..52061f79 100644 --- a/test/fixtures/gitops-layouts/08-argocd-external-helm/README.md +++ b/test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/README.md @@ -1,4 +1,4 @@ -# 08-argocd-external-helm +# argocd-external-helm ## What this is diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/applications/cert-manager.yaml b/test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/applications/cert-manager.yaml similarity index 100% rename from test/fixtures/gitops-layouts/08-argocd-external-helm/applications/cert-manager.yaml rename to test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/applications/cert-manager.yaml diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/applications/external-dns.yaml b/test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/applications/external-dns.yaml similarity index 100% rename from test/fixtures/gitops-layouts/08-argocd-external-helm/applications/external-dns.yaml rename to test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/applications/external-dns.yaml diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/applications/ingress-nginx.yaml b/test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/applications/ingress-nginx.yaml similarity index 100% rename from test/fixtures/gitops-layouts/08-argocd-external-helm/applications/ingress-nginx.yaml rename to test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/applications/ingress-nginx.yaml diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/extras/ingress-nginx/middleware.yaml b/test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/extras/ingress-nginx/middleware.yaml similarity index 100% rename from test/fixtures/gitops-layouts/08-argocd-external-helm/extras/ingress-nginx/middleware.yaml rename to test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/extras/ingress-nginx/middleware.yaml diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/platform/cert-manager/application.yaml b/test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/platform/cert-manager/application.yaml similarity index 100% rename from test/fixtures/gitops-layouts/08-argocd-external-helm/platform/cert-manager/application.yaml rename to test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/platform/cert-manager/application.yaml diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/platform/cert-manager/clusterissuer.yaml b/test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/platform/cert-manager/clusterissuer.yaml similarity index 100% rename from test/fixtures/gitops-layouts/08-argocd-external-helm/platform/cert-manager/clusterissuer.yaml rename to test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/platform/cert-manager/clusterissuer.yaml diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/platform/cert-manager/values.yaml b/test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/platform/cert-manager/values.yaml similarity index 100% rename from test/fixtures/gitops-layouts/08-argocd-external-helm/platform/cert-manager/values.yaml rename to test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/platform/cert-manager/values.yaml diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/values/cert-manager/production.yaml b/test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/values/cert-manager/production.yaml similarity index 100% rename from test/fixtures/gitops-layouts/08-argocd-external-helm/values/cert-manager/production.yaml rename to test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/values/cert-manager/production.yaml diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/values/external-dns/production.yaml b/test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/values/external-dns/production.yaml similarity index 100% rename from test/fixtures/gitops-layouts/08-argocd-external-helm/values/external-dns/production.yaml rename to test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/values/external-dns/production.yaml diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/values/ingress-nginx/common.yaml b/test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/values/ingress-nginx/common.yaml similarity index 100% rename from test/fixtures/gitops-layouts/08-argocd-external-helm/values/ingress-nginx/common.yaml rename to test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/values/ingress-nginx/common.yaml diff --git a/test/fixtures/gitops-layouts/08-argocd-external-helm/values/ingress-nginx/production.yaml b/test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/values/ingress-nginx/production.yaml similarity index 100% rename from test/fixtures/gitops-layouts/08-argocd-external-helm/values/ingress-nginx/production.yaml rename to test/fixtures/gitops-layouts/2-rendered/argocd-external-helm/values/ingress-nginx/production.yaml diff --git a/test/fixtures/gitops-layouts/06-helm-chart/README.md b/test/fixtures/gitops-layouts/2-rendered/helm-chart/README.md similarity index 99% rename from test/fixtures/gitops-layouts/06-helm-chart/README.md rename to test/fixtures/gitops-layouts/2-rendered/helm-chart/README.md index 57db7961..d584444e 100644 --- a/test/fixtures/gitops-layouts/06-helm-chart/README.md +++ b/test/fixtures/gitops-layouts/2-rendered/helm-chart/README.md @@ -1,4 +1,4 @@ -# 06-helm-chart +# helm-chart ## What this is A single, self-contained Helm chart in the canonical directory layout produced diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/.helmignore b/test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/.helmignore similarity index 100% rename from test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/.helmignore rename to test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/.helmignore diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/Chart.lock b/test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/Chart.lock similarity index 100% rename from test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/Chart.lock rename to test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/Chart.lock diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/Chart.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/Chart.yaml similarity index 100% rename from test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/Chart.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/Chart.yaml diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/charts/.gitkeep b/test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/charts/.gitkeep similarity index 100% rename from test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/charts/.gitkeep rename to test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/charts/.gitkeep diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/crds/widgets.example.com.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/crds/widgets.example.com.yaml similarity index 100% rename from test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/crds/widgets.example.com.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/crds/widgets.example.com.yaml diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/NOTES.txt b/test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/templates/NOTES.txt similarity index 100% rename from test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/NOTES.txt rename to test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/templates/NOTES.txt diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/_helpers.tpl b/test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/templates/_helpers.tpl similarity index 100% rename from test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/_helpers.tpl rename to test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/templates/_helpers.tpl diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/configmap.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/templates/configmap.yaml similarity index 100% rename from test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/configmap.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/templates/configmap.yaml diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/deployment.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/templates/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/deployment.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/templates/deployment.yaml diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/ingress.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/templates/ingress.yaml similarity index 100% rename from test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/ingress.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/templates/ingress.yaml diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/service.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/templates/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/service.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/templates/service.yaml diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/serviceaccount.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/templates/serviceaccount.yaml similarity index 100% rename from test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/serviceaccount.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/templates/serviceaccount.yaml diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/tests/test-connection.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/templates/tests/test-connection.yaml similarity index 100% rename from test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/templates/tests/test-connection.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/templates/tests/test-connection.yaml diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/values.schema.json b/test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/values.schema.json similarity index 100% rename from test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/values.schema.json rename to test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/values.schema.json diff --git a/test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/values.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/values.yaml similarity index 100% rename from test/fixtures/gitops-layouts/06-helm-chart/charts/frontend/values.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-chart/charts/frontend/values.yaml diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/README.md b/test/fixtures/gitops-layouts/2-rendered/helm-environment-values/README.md similarity index 99% rename from test/fixtures/gitops-layouts/07-helm-environment-values/README.md rename to test/fixtures/gitops-layouts/2-rendered/helm-environment-values/README.md index 970c1747..c7815977 100644 --- a/test/fixtures/gitops-layouts/07-helm-environment-values/README.md +++ b/test/fixtures/gitops-layouts/2-rendered/helm-environment-values/README.md @@ -1,4 +1,4 @@ -# 07-helm-environment-values +# helm-environment-values ## What this is One Helm chart deployed to several environments, where each environment is just diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/argocd/dev.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-environment-values/argocd/dev.yaml similarity index 100% rename from test/fixtures/gitops-layouts/07-helm-environment-values/argocd/dev.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-environment-values/argocd/dev.yaml diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/argocd/production.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-environment-values/argocd/production.yaml similarity index 100% rename from test/fixtures/gitops-layouts/07-helm-environment-values/argocd/production.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-environment-values/argocd/production.yaml diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/chart/.argocd-source.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-environment-values/chart/.argocd-source.yaml similarity index 100% rename from test/fixtures/gitops-layouts/07-helm-environment-values/chart/.argocd-source.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-environment-values/chart/.argocd-source.yaml diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/chart/Chart.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-environment-values/chart/Chart.yaml similarity index 100% rename from test/fixtures/gitops-layouts/07-helm-environment-values/chart/Chart.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-environment-values/chart/Chart.yaml diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/chart/templates/deployment.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-environment-values/chart/templates/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/07-helm-environment-values/chart/templates/deployment.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-environment-values/chart/templates/deployment.yaml diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/chart/templates/service.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-environment-values/chart/templates/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/07-helm-environment-values/chart/templates/service.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-environment-values/chart/templates/service.yaml diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/chart/values.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-environment-values/chart/values.yaml similarity index 100% rename from test/fixtures/gitops-layouts/07-helm-environment-values/chart/values.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-environment-values/chart/values.yaml diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/values/common.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-environment-values/values/common.yaml similarity index 100% rename from test/fixtures/gitops-layouts/07-helm-environment-values/values/common.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-environment-values/values/common.yaml diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/values/dev.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-environment-values/values/dev.yaml similarity index 100% rename from test/fixtures/gitops-layouts/07-helm-environment-values/values/dev.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-environment-values/values/dev.yaml diff --git a/test/fixtures/gitops-layouts/07-helm-environment-values/values/production.yaml b/test/fixtures/gitops-layouts/2-rendered/helm-environment-values/values/production.yaml similarity index 100% rename from test/fixtures/gitops-layouts/07-helm-environment-values/values/production.yaml rename to test/fixtures/gitops-layouts/2-rendered/helm-environment-values/values/production.yaml diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/README.md b/test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/README.md similarity index 98% rename from test/fixtures/gitops-layouts/05-kustomize-overlays/README.md rename to test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/README.md index 5ce6c91d..64721e1e 100644 --- a/test/fixtures/gitops-layouts/05-kustomize-overlays/README.md +++ b/test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/README.md @@ -1,4 +1,4 @@ -# 05-kustomize-overlays +# kustomize-overlays ## What this is The most recognizable general-purpose GitOps layout: per-app `base/` + @@ -82,7 +82,7 @@ overlay instead builds on a **remote** base fetched from another repository. image that actually deploys is decided by a file a reader inspecting the kustomization never opens. Argo CD Image Updater *writes and commits* this file on its own, which makes Git an output of the cluster here, exactly as Flux's - `ImageUpdateAutomation` does in [16-flux-image-automation](../16-flux-image-automation/). + `ImageUpdateAutomation` does in [flux-image-automation](../../4-machine-written/flux-image-automation/). It is not a Kubernetes object: no `apiVersion`, no `kind`. ## Open questions diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/base/deployment.yaml b/test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/backend/base/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/base/deployment.yaml rename to test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/backend/base/deployment.yaml diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/base/kustomization.yaml b/test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/backend/base/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/base/kustomization.yaml rename to test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/backend/base/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/base/service.yaml b/test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/backend/base/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/base/service.yaml rename to test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/backend/base/service.yaml diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/overlays/production/kustomization.yaml b/test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/backend/overlays/production/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/05-kustomize-overlays/apps/backend/overlays/production/kustomization.yaml rename to test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/backend/overlays/production/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/base/deployment.yaml b/test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/base/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/base/deployment.yaml rename to test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/base/deployment.yaml diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/base/kustomization.yaml b/test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/base/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/base/kustomization.yaml rename to test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/base/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/base/service.yaml b/test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/base/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/base/service.yaml rename to test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/base/service.yaml diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/.argocd-source-frontend-production.yaml b/test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/overlays/production/.argocd-source-frontend-production.yaml similarity index 100% rename from test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/.argocd-source-frontend-production.yaml rename to test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/overlays/production/.argocd-source-frontend-production.yaml diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/config.properties b/test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/overlays/production/config.properties similarity index 100% rename from test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/config.properties rename to test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/overlays/production/config.properties diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/deployment-patch.yaml b/test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/overlays/production/deployment-patch.yaml similarity index 100% rename from test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/deployment-patch.yaml rename to test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/overlays/production/deployment-patch.yaml diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/kustomization.yaml b/test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/overlays/production/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/kustomization.yaml rename to test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/overlays/production/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/secrets.env b/test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/overlays/production/secrets.env similarity index 100% rename from test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/production/secrets.env rename to test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/overlays/production/secrets.env diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/staging/config.properties b/test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/overlays/staging/config.properties similarity index 100% rename from test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/staging/config.properties rename to test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/overlays/staging/config.properties diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/staging/deployment-patch.yaml b/test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/overlays/staging/deployment-patch.yaml similarity index 100% rename from test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/staging/deployment-patch.yaml rename to test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/overlays/staging/deployment-patch.yaml diff --git a/test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/staging/kustomization.yaml b/test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/overlays/staging/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/05-kustomize-overlays/apps/frontend/overlays/staging/kustomization.yaml rename to test/fixtures/gitops-layouts/2-rendered/kustomize-overlays/apps/frontend/overlays/staging/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/README.md b/test/fixtures/gitops-layouts/2-rendered/rendered-manifests/README.md similarity index 99% rename from test/fixtures/gitops-layouts/14-rendered-manifests/README.md rename to test/fixtures/gitops-layouts/2-rendered/rendered-manifests/README.md index 9b0b0bf5..2457d7c5 100644 --- a/test/fixtures/gitops-layouts/14-rendered-manifests/README.md +++ b/test/fixtures/gitops-layouts/2-rendered/rendered-manifests/README.md @@ -1,4 +1,4 @@ -# 14-rendered-manifests +# rendered-manifests ## What this is The "rendered manifests" (a.k.a. "hydrated manifests" or "rendered YAML") diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/argocd/production.yaml b/test/fixtures/gitops-layouts/2-rendered/rendered-manifests/argocd/production.yaml similarity index 100% rename from test/fixtures/gitops-layouts/14-rendered-manifests/argocd/production.yaml rename to test/fixtures/gitops-layouts/2-rendered/rendered-manifests/argocd/production.yaml diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/rendered/production/frontend.yaml b/test/fixtures/gitops-layouts/2-rendered/rendered-manifests/rendered/production/frontend.yaml similarity index 100% rename from test/fixtures/gitops-layouts/14-rendered-manifests/rendered/production/frontend.yaml rename to test/fixtures/gitops-layouts/2-rendered/rendered-manifests/rendered/production/frontend.yaml diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/rendered/staging/frontend.yaml b/test/fixtures/gitops-layouts/2-rendered/rendered-manifests/rendered/staging/frontend.yaml similarity index 100% rename from test/fixtures/gitops-layouts/14-rendered-manifests/rendered/staging/frontend.yaml rename to test/fixtures/gitops-layouts/2-rendered/rendered-manifests/rendered/staging/frontend.yaml diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/base/deployment.yaml b/test/fixtures/gitops-layouts/2-rendered/rendered-manifests/src/frontend/base/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/base/deployment.yaml rename to test/fixtures/gitops-layouts/2-rendered/rendered-manifests/src/frontend/base/deployment.yaml diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/base/kustomization.yaml b/test/fixtures/gitops-layouts/2-rendered/rendered-manifests/src/frontend/base/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/base/kustomization.yaml rename to test/fixtures/gitops-layouts/2-rendered/rendered-manifests/src/frontend/base/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/base/service.yaml b/test/fixtures/gitops-layouts/2-rendered/rendered-manifests/src/frontend/base/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/base/service.yaml rename to test/fixtures/gitops-layouts/2-rendered/rendered-manifests/src/frontend/base/service.yaml diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/overlays/production/kustomization.yaml b/test/fixtures/gitops-layouts/2-rendered/rendered-manifests/src/frontend/overlays/production/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/overlays/production/kustomization.yaml rename to test/fixtures/gitops-layouts/2-rendered/rendered-manifests/src/frontend/overlays/production/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/overlays/staging/kustomization.yaml b/test/fixtures/gitops-layouts/2-rendered/rendered-manifests/src/frontend/overlays/staging/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/14-rendered-manifests/src/frontend/overlays/staging/kustomization.yaml rename to test/fixtures/gitops-layouts/2-rendered/rendered-manifests/src/frontend/overlays/staging/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/14-rendered-manifests/src/render.sh b/test/fixtures/gitops-layouts/2-rendered/rendered-manifests/src/render.sh similarity index 100% rename from test/fixtures/gitops-layouts/14-rendered-manifests/src/render.sh rename to test/fixtures/gitops-layouts/2-rendered/rendered-manifests/src/render.sh diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/README.md b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/README.md similarity index 72% rename from test/fixtures/gitops-layouts/03-argocd-applicationset-directories/README.md rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/README.md index 41c3ac58..7c838a75 100644 --- a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/README.md +++ b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/README.md @@ -1,4 +1,4 @@ -# 03-argocd-applicationset-directories +# argocd-applicationset-directories ## What this is An Argo CD `ApplicationSet` using the **git directory generator**: instead of @@ -60,10 +60,44 @@ basename via Go templating (`{{.path.basename}}`). turns the folder name into the Application `metadata.name` and the destination namespace. Renaming a folder renames (and can recreate) an Application. +## Observed behaviour (live cluster, 2026-07-13) +Run against a real Argo CD (v3.4.5) with a `git.directories: apps/*` generator over +a real repository, the first open question below **has an answer, and it is yes.** + +Committing a new folder — and authoring **no** `Application` CR — produced an +`Application` and deployed its workload: + +``` +$ mkdir apps/worker && git add . && git commit && git push # no CR authored +$ kubectl -n argocd get applications +NAME PATH SYNC HEALTH +app-backend apps/backend Synced Healthy +app-frontend apps/frontend Synced Healthy +app-worker apps/worker Synced Healthy <-- appeared from the folder alone +``` + +**Creating a directory is a deployment operation.** The directory listing is a +field of desired state. + +The corollary is sharper. Authoring an `Application` for that path *as well* — which +is what "add an app = add the manifests **and** the CR" would do — makes the two +fight over the same objects: + +``` +SharedResourceWarning: ConfigMap/worker-config is part of applications + argocd/app-worker and worker-authored-by-hand +``` + +The generated Application flipped to `OutOfSync`, and the workload's Argo +`tracking-id` was overwritten to name the hand-authored app. So in a repository of +this shape, both available moves are wrong: author the CR and you get a duplicate +that fights the generator; omit it and — in every *other* layout — nothing deploys. +Knowing which shape you are in is not optional. + ## Open questions -- If the list of Applications is derived from a directory listing, is *creating a +- ~~If the list of Applications is derived from a directory listing, is *creating a new folder* under `apps/` itself a deployment operation — even before any - manifest is committed into it? + manifest is committed into it?~~ **Answered above: yes.** - `apps/empty` matches and would generate an Application, but there is nothing to apply. What is the meaning of an Application whose source directory is empty? - `apps/platform` is matched but its real workloads live in diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/backend/deployment.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/apps/backend/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/backend/deployment.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/apps/backend/deployment.yaml diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/backend/service.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/apps/backend/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/backend/service.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/apps/backend/service.yaml diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/disabled-example/README.md b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/apps/disabled-example/README.md similarity index 100% rename from test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/disabled-example/README.md rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/apps/disabled-example/README.md diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/empty/.gitkeep b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/apps/empty/.gitkeep similarity index 100% rename from test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/empty/.gitkeep rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/apps/empty/.gitkeep diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/frontend/deployment.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/apps/frontend/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/frontend/deployment.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/apps/frontend/deployment.yaml diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/frontend/service.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/apps/frontend/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/frontend/service.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/apps/frontend/service.yaml diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/platform/monitoring/deployment.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/apps/platform/monitoring/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/platform/monitoring/deployment.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/apps/platform/monitoring/deployment.yaml diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/platform/monitoring/service.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/apps/platform/monitoring/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/platform/monitoring/service.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/apps/platform/monitoring/service.yaml diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/worker/deployment.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/apps/worker/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/03-argocd-applicationset-directories/apps/worker/deployment.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/apps/worker/deployment.yaml diff --git a/test/fixtures/gitops-layouts/03-argocd-applicationset-directories/bootstrap/applicationset.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/bootstrap/applicationset.yaml similarity index 100% rename from test/fixtures/gitops-layouts/03-argocd-applicationset-directories/bootstrap/applicationset.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-directories/bootstrap/applicationset.yaml diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/README.md b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/README.md similarity index 99% rename from test/fixtures/gitops-layouts/04-argocd-applicationset-files/README.md rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/README.md index 43eb9d76..5146e2e0 100644 --- a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/README.md +++ b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/README.md @@ -1,4 +1,4 @@ -# 04-argocd-applicationset-files +# argocd-applicationset-files ## What this is An Argo CD `ApplicationSet` using the **git files generator**. A single diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/applicationset.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/applicationset.yaml similarity index 100% rename from test/fixtures/gitops-layouts/04-argocd-applicationset-files/applicationset.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/applicationset.yaml diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/Chart.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/chart/Chart.yaml similarity index 100% rename from test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/Chart.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/chart/Chart.yaml diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/_helpers.tpl b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/chart/templates/_helpers.tpl similarity index 100% rename from test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/_helpers.tpl rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/chart/templates/_helpers.tpl diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/deployment.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/chart/templates/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/deployment.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/chart/templates/deployment.yaml diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/service.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/chart/templates/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/templates/service.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/chart/templates/service.yaml diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/values.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/chart/values.yaml similarity index 100% rename from test/fixtures/gitops-layouts/04-argocd-applicationset-files/chart/values.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/chart/values.yaml diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/dev/backend.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/deployments/dev/backend.yaml similarity index 100% rename from test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/dev/backend.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/deployments/dev/backend.yaml diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/dev/frontend.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/deployments/dev/frontend.yaml similarity index 100% rename from test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/dev/frontend.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/deployments/dev/frontend.yaml diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/production/backend.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/deployments/production/backend.yaml similarity index 100% rename from test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/production/backend.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/deployments/production/backend.yaml diff --git a/test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/production/frontend.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/deployments/production/frontend.yaml similarity index 100% rename from test/fixtures/gitops-layouts/04-argocd-applicationset-files/deployments/production/frontend.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-applicationset-files/deployments/production/frontend.yaml diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/README.md b/test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/README.md similarity index 99% rename from test/fixtures/gitops-layouts/12-multicluster-applicationset/README.md rename to test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/README.md index 731bad37..57828e65 100644 --- a/test/fixtures/gitops-layouts/12-multicluster-applicationset/README.md +++ b/test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/README.md @@ -1,4 +1,4 @@ -# 12-multicluster-applicationset +# argocd-multicluster-matrix ## What this is An Argo CD `ApplicationSet` using a **matrix generator** to produce one Application diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/applicationsets/cluster-matrix.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/applicationsets/cluster-matrix.yaml similarity index 100% rename from test/fixtures/gitops-layouts/12-multicluster-applicationset/applicationsets/cluster-matrix.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/applicationsets/cluster-matrix.yaml diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/backend/deployment.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/apps/backend/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/backend/deployment.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/apps/backend/deployment.yaml diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/backend/service.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/apps/backend/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/backend/service.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/apps/backend/service.yaml diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/frontend/deployment.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/apps/frontend/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/frontend/deployment.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/apps/frontend/deployment.yaml diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/frontend/service.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/apps/frontend/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/12-multicluster-applicationset/apps/frontend/service.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/apps/frontend/service.yaml diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/clusters/eu-production.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/clusters/eu-production.yaml similarity index 100% rename from test/fixtures/gitops-layouts/12-multicluster-applicationset/clusters/eu-production.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/clusters/eu-production.yaml diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/clusters/staging.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/clusters/staging.yaml similarity index 100% rename from test/fixtures/gitops-layouts/12-multicluster-applicationset/clusters/staging.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/clusters/staging.yaml diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/clusters/us-production.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/clusters/us-production.yaml similarity index 100% rename from test/fixtures/gitops-layouts/12-multicluster-applicationset/clusters/us-production.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/clusters/us-production.yaml diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/values/eu-production/backend.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/values/eu-production/backend.yaml similarity index 100% rename from test/fixtures/gitops-layouts/12-multicluster-applicationset/values/eu-production/backend.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/values/eu-production/backend.yaml diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/values/eu-production/frontend.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/values/eu-production/frontend.yaml similarity index 100% rename from test/fixtures/gitops-layouts/12-multicluster-applicationset/values/eu-production/frontend.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/values/eu-production/frontend.yaml diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/values/staging/frontend.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/values/staging/frontend.yaml similarity index 100% rename from test/fixtures/gitops-layouts/12-multicluster-applicationset/values/staging/frontend.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/values/staging/frontend.yaml diff --git a/test/fixtures/gitops-layouts/12-multicluster-applicationset/values/us-production/frontend.yaml b/test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/values/us-production/frontend.yaml similarity index 100% rename from test/fixtures/gitops-layouts/12-multicluster-applicationset/values/us-production/frontend.yaml rename to test/fixtures/gitops-layouts/3-expanded/argocd-multicluster-matrix/values/us-production/frontend.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/README.md b/test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/README.md similarity index 99% rename from test/fixtures/gitops-layouts/10-flux-helmrelease/README.md rename to test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/README.md index a157c4f0..e9de12d0 100644 --- a/test/fixtures/gitops-layouts/10-flux-helmrelease/README.md +++ b/test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/README.md @@ -1,4 +1,4 @@ -# 10-flux-helmrelease +# flux-helmrelease ## What this is Flux CD installing Helm charts the GitOps way: instead of running `helm install`, diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/apps/frontend/helmrelease.yaml b/test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/apps/frontend/helmrelease.yaml similarity index 100% rename from test/fixtures/gitops-layouts/10-flux-helmrelease/apps/frontend/helmrelease.yaml rename to test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/apps/frontend/helmrelease.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/apps/frontend/kustomization.yaml b/test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/apps/frontend/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/10-flux-helmrelease/apps/frontend/kustomization.yaml rename to test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/apps/frontend/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/apps/frontend/values.yaml b/test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/apps/frontend/values.yaml similarity index 100% rename from test/fixtures/gitops-layouts/10-flux-helmrelease/apps/frontend/values.yaml rename to test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/apps/frontend/values.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/apps.yaml b/test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/clusters/production/apps.yaml similarity index 100% rename from test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/apps.yaml rename to test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/clusters/production/apps.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/flux-system/gotk-components.yaml b/test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/clusters/production/flux-system/gotk-components.yaml similarity index 100% rename from test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/flux-system/gotk-components.yaml rename to test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/clusters/production/flux-system/gotk-components.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/flux-system/gotk-sync.yaml b/test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/clusters/production/flux-system/gotk-sync.yaml similarity index 100% rename from test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/flux-system/gotk-sync.yaml rename to test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/clusters/production/flux-system/gotk-sync.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/flux-system/kustomization.yaml b/test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/clusters/production/flux-system/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/flux-system/kustomization.yaml rename to test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/clusters/production/flux-system/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/infrastructure.yaml b/test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/clusters/production/infrastructure.yaml similarity index 100% rename from test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/infrastructure.yaml rename to test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/clusters/production/infrastructure.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/kustomization.yaml b/test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/clusters/production/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/10-flux-helmrelease/clusters/production/kustomization.yaml rename to test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/clusters/production/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/controllers/ingress-nginx/helmrelease.yaml b/test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/infrastructure/controllers/ingress-nginx/helmrelease.yaml similarity index 100% rename from test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/controllers/ingress-nginx/helmrelease.yaml rename to test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/infrastructure/controllers/ingress-nginx/helmrelease.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/controllers/ingress-nginx/kustomization.yaml b/test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/infrastructure/controllers/ingress-nginx/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/controllers/ingress-nginx/kustomization.yaml rename to test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/infrastructure/controllers/ingress-nginx/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/controllers/ingress-nginx/values-configmap.yaml b/test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/infrastructure/controllers/ingress-nginx/values-configmap.yaml similarity index 100% rename from test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/controllers/ingress-nginx/values-configmap.yaml rename to test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/infrastructure/controllers/ingress-nginx/values-configmap.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/sources/kustomization.yaml b/test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/infrastructure/sources/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/sources/kustomization.yaml rename to test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/infrastructure/sources/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/sources/repositories.yaml b/test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/infrastructure/sources/repositories.yaml similarity index 100% rename from test/fixtures/gitops-layouts/10-flux-helmrelease/infrastructure/sources/repositories.yaml rename to test/fixtures/gitops-layouts/3-expanded/flux-helmrelease/infrastructure/sources/repositories.yaml diff --git a/test/fixtures/gitops-layouts/3-expanded/flux-resourceset-inline/README.md b/test/fixtures/gitops-layouts/3-expanded/flux-resourceset-inline/README.md new file mode 100644 index 00000000..e7d9b9b8 --- /dev/null +++ b/test/fixtures/gitops-layouts/3-expanded/flux-resourceset-inline/README.md @@ -0,0 +1,75 @@ +# flux-resourceset-inline + +## What this is +A flux-operator `ResourceSet`: one document that carries **both** a template and +the inputs it is rendered against. The controller renders `spec.resources` once +per entry in `spec.inputs` and applies the result. + +The flux-operator guides present this as a **replacement for base + overlays** — +their own worked example collapses an +`apps/app1/{base,overlays/tenant1,overlays/tenant2}` tree into "a single file". +That tree is exactly [`2-rendered/kustomize-overlays/`](../../2-rendered/kustomize-overlays/). +The two fixtures are the same intent expressed two ways, and the difference is the +whole point of this family: over there, every tenant's `Deployment` is a real file; +here, **no tenant has a file at all**. + +## Layout +``` +flux-resourceset-inline/ +├── README.md +└── tenants/ + └── apps.yaml # ONE document: template + 3 inputs -> 9 live objects +``` + +Three inputs × three resources (`Namespace`, `Deployment`, `Service`) = **nine +live objects, zero of which have a home file.** The only artifact in Git is the +`ResourceSet` CR itself. + +## What makes it structurally distinct +- **The KRM is nested inside KRM.** `spec.resources` is a list of arbitrary + Kubernetes objects embedded in the body of another Kubernetes object. A + `Deployment` here is not a document — it is a *field value*. +- **No `path`, no `sourceRef`.** Flux's own `Kustomization` has + `spec.path` + `spec.sourceRef` pointing at a folder of files. `ResourceSet` + deliberately has neither. There is nowhere for it to point, because the content + is already inside it. +- **A third templating dialect.** Go `text/template` with `<< >>` delimiters — + not Helm's `{{ }}`, and not Argo CD's fasttemplate. Three ecosystems, three + incompatible ways to spell "substitute here", none of them YAML. +- **Fan-in is the input count.** `spec.resources[i]` is reached by all three + inputs; `spec.inputs[j]` is reached by exactly one. Those are different + write-fan-in numbers on two fields of the same document. +- **`replicas: << inputs.replicas >>`** is an *unquoted* template substitution + into an integer field. The document is therefore not valid KRM until it is + rendered — `spec.replicas` holds a string that must become a number. + +## Observed behaviour (live cluster, 2026-07-13) +Run against a real flux-operator, the children carry: + +``` +labels: + resourceset.fluxcd.controlplane.io/name: tenant-apps + resourceset.fluxcd.controlplane.io/namespace: flux-system +ownerReferences: +managedFields[].manager: flux-operator +``` + +plus a `status.inventory` on the `ResourceSet` listing every object it owns. +**There is no `ownerReference` anywhere** — the parent/child link is carried by +labels and an inventory, not by the mechanism Kubernetes provides for it. + +## Open questions +- The `ResourceSet` CR is one editable document, and `spec.inputs[j]` has fan-in + 1. Is "bump tenant2 to 1.5.0" therefore an edit to `spec.inputs[1].image` — an + edit *into a field of a document*, rather than to a document? +- Editing a `Deployment` nested at `spec.resources[1]` means writing KRM into a + field of another KRM document. Nothing in the writer models that today. Is a + nested document a document? +- The nine live objects have no file. If they are mirrored anyway, Git gains nine + files that nothing will ever read and that the controller will fight. What + prevents that? +- `replicas: << inputs.replicas >>` is unparseable as an integer before + rendering. Is this file KRM at all, for the purpose of a scan? +- Adding a tenant means adding an entry to `spec.inputs` — not adding a folder and + not authoring a CR. That is a *third* recipe for "add an app", different from + both the plain-folder and the kustomize recipes. How is it discovered? diff --git a/test/fixtures/gitops-layouts/3-expanded/flux-resourceset-inline/tenants/apps.yaml b/test/fixtures/gitops-layouts/3-expanded/flux-resourceset-inline/tenants/apps.yaml new file mode 100644 index 00000000..1731d665 --- /dev/null +++ b/test/fixtures/gitops-layouts/3-expanded/flux-resourceset-inline/tenants/apps.yaml @@ -0,0 +1,62 @@ +# A flux-operator ResourceSet: the whole of a tenant fan-out in ONE document. +# +# This is the layout the flux-operator guides present as a replacement for +# apps//{base,overlays/tenant1,overlays/tenant2} — i.e. exactly the tree +# that 2-rendered/kustomize-overlays represents. There, each tenant's Deployment +# is a real file. Here, NO tenant has a file: the Deployment below is a template +# inside spec.resources, rendered once per entry in spec.inputs. +# +# Note the << >> delimiters — flux-operator uses Go text/template with custom +# delimiters, not Helm's {{ }} and not Argo's fasttemplate. +apiVersion: fluxcd.controlplane.io/v1 +kind: ResourceSet +metadata: + name: tenant-apps + namespace: flux-system +spec: + inputs: + - tenant: tenant1 + replicas: "1" + image: ghcr.io/example-org/frontend:1.4.2 + - tenant: tenant2 + replicas: "3" + image: ghcr.io/example-org/frontend:1.4.2 + - tenant: tenant3 + replicas: "5" + image: ghcr.io/example-org/frontend:1.3.9 + resources: + - apiVersion: v1 + kind: Namespace + metadata: + name: << inputs.tenant >> + - apiVersion: apps/v1 + kind: Deployment + metadata: + name: frontend + namespace: << inputs.tenant >> + spec: + replicas: << inputs.replicas >> + selector: + matchLabels: + app: frontend + template: + metadata: + labels: + app: frontend + spec: + containers: + - name: frontend + image: << inputs.image | quote >> + ports: + - containerPort: 8080 + - apiVersion: v1 + kind: Service + metadata: + name: frontend + namespace: << inputs.tenant >> + spec: + selector: + app: frontend + ports: + - port: 80 + targetPort: 8080 diff --git a/test/fixtures/gitops-layouts/3-expanded/flux-resourceset-pull-requests/README.md b/test/fixtures/gitops-layouts/3-expanded/flux-resourceset-pull-requests/README.md new file mode 100644 index 00000000..30a13f05 --- /dev/null +++ b/test/fixtures/gitops-layouts/3-expanded/flux-resourceset-pull-requests/README.md @@ -0,0 +1,53 @@ +# flux-resourceset-pull-requests + +## What this is +Ephemeral **preview environments**, one per open pull request. A +`ResourceSetInputProvider` of type `GitHubPullRequest` queries the Git host's API +for open PRs carrying the `preview` label, and a `ResourceSet` renders a +namespace + deployment for each one. + +This is the same expansion mechanism as +[`flux-resourceset-inline`](../flux-resourceset-inline/), with one change that +breaks a much deeper assumption: **the inputs are not in the repository.** + +## Layout +``` +flux-resourceset-pull-requests/ +├── README.md +└── previews/ + └── preview-envs.yaml # ResourceSetInputProvider + ResourceSet +``` + +## What makes it structurally distinct +- **The desired object set is not knowable from the repository.** Every other + fixture in this corpus can, in principle, be answered by reading files — even + the ones we refuse. Here the answer is "however many pull requests are open + right now", which lives in GitHub's database. No repository scan can enumerate + it. Not because the scan is weak, but because **the answer is not here.** +- **The set changes with no commit.** Someone opens a PR: a namespace appears. + Someone merges it: the namespace is pruned. Git does not move. There is no + revision that corresponds to the change, so there is no revision to reconcile + against, and nothing for a live→Git tool to write. +- **A `secretRef` to a real credential.** The provider authenticates to the Git + host. The repository's behaviour depends on a token, not just on its contents. +- **`inputsFrom`, not `inputs`.** The inputs are a *reference* to a live object + whose `status.exportedInputs` is populated by a controller. The input set is + itself expansion. +- **The image tag is a commit SHA from another repository.** + `ghcr.io/example-org/frontend:<< inputs.sha >>` — the tag is the PR's head + commit in `example-org/frontend`, which is not this repo. + +## Open questions +- A repository scan reports "what is here". For this repo, the honest report is + "the objects this repo produces cannot be determined from this repo". Is that a + refusal, a layout classification, or a new kind of answer entirely? +- `status.exportedInputs` is live-only and unwritable. The `ResourceSet` and the + provider are ordinary editable KRM; their *inputs* are not. Where is the + boundary drawn on a single document whose spec is editable and whose status is + the only thing that matters? +- If a preview namespace is mirrored to Git, the next merge prunes the live + objects and Git keeps a folder for a pull request that no longer exists. What + deletes it? +- An intent cluster hydrated from this repo would need the GitHub token to + materialise anything at all. Is a repository whose expansion requires a live + credential hydratable, even in principle? diff --git a/test/fixtures/gitops-layouts/3-expanded/flux-resourceset-pull-requests/previews/preview-envs.yaml b/test/fixtures/gitops-layouts/3-expanded/flux-resourceset-pull-requests/previews/preview-envs.yaml new file mode 100644 index 00000000..d67a25f9 --- /dev/null +++ b/test/fixtures/gitops-layouts/3-expanded/flux-resourceset-pull-requests/previews/preview-envs.yaml @@ -0,0 +1,57 @@ +# Ephemeral preview environments, one per OPEN pull request. +# +# The load-bearing fact: the input set is NOT in this repository. It is queried +# live from the Git host's API by the ResourceSetInputProvider below. The set of +# objects that *should* exist depends on which pull requests happen to be open +# right now. No scan of these files can ever enumerate it — not because the scan +# is weak, but because the answer is not here. +apiVersion: fluxcd.controlplane.io/v1 +kind: ResourceSetInputProvider +metadata: + name: frontend-pull-requests + namespace: flux-system +spec: + type: GitHubPullRequest + url: https://github.com/example-org/frontend + secretRef: + name: github-token # a real token; the provider calls the GitHub API + filter: + labels: + - preview + defaultValues: + role: preview +--- +apiVersion: fluxcd.controlplane.io/v1 +kind: ResourceSet +metadata: + name: frontend-previews + namespace: flux-system +spec: + inputsFrom: + - apiVersion: fluxcd.controlplane.io/v1 + kind: ResourceSetInputProvider + name: frontend-pull-requests + resources: + - apiVersion: v1 + kind: Namespace + metadata: + name: preview-<< inputs.id >> + - apiVersion: apps/v1 + kind: Deployment + metadata: + name: frontend + namespace: preview-<< inputs.id >> + spec: + replicas: 1 + selector: + matchLabels: + app: frontend + template: + metadata: + labels: + app: frontend + spec: + containers: + - name: frontend + # the image tag is the PR's head commit — also not in this repo + image: ghcr.io/example-org/frontend:<< inputs.sha >> diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/README.md b/test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/README.md similarity index 99% rename from test/fixtures/gitops-layouts/16-flux-image-automation/README.md rename to test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/README.md index 4e133fdc..998a123d 100644 --- a/test/fixtures/gitops-layouts/16-flux-image-automation/README.md +++ b/test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/README.md @@ -1,4 +1,4 @@ -# 16-flux-image-automation +# flux-image-automation ## What this is Flux's image automation: `ImageRepository` scans a container registry, diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/apps/frontend/deployment.yaml b/test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/apps/frontend/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/16-flux-image-automation/apps/frontend/deployment.yaml rename to test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/apps/frontend/deployment.yaml diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/apps/frontend/kustomization.yaml b/test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/apps/frontend/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/16-flux-image-automation/apps/frontend/kustomization.yaml rename to test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/apps/frontend/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/apps/frontend/service.yaml b/test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/apps/frontend/service.yaml similarity index 100% rename from test/fixtures/gitops-layouts/16-flux-image-automation/apps/frontend/service.yaml rename to test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/apps/frontend/service.yaml diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/clusters/production/apps.yaml b/test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/clusters/production/apps.yaml similarity index 100% rename from test/fixtures/gitops-layouts/16-flux-image-automation/clusters/production/apps.yaml rename to test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/clusters/production/apps.yaml diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/clusters/production/image-automation.yaml b/test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/clusters/production/image-automation.yaml similarity index 100% rename from test/fixtures/gitops-layouts/16-flux-image-automation/clusters/production/image-automation.yaml rename to test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/clusters/production/image-automation.yaml diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/clusters/production/kustomization.yaml b/test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/clusters/production/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/16-flux-image-automation/clusters/production/kustomization.yaml rename to test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/clusters/production/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/imagepolicy.yaml b/test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/infrastructure/image-automation/imagepolicy.yaml similarity index 100% rename from test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/imagepolicy.yaml rename to test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/infrastructure/image-automation/imagepolicy.yaml diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/imagerepository.yaml b/test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/infrastructure/image-automation/imagerepository.yaml similarity index 100% rename from test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/imagerepository.yaml rename to test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/infrastructure/image-automation/imagerepository.yaml diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/imageupdateautomation.yaml b/test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/infrastructure/image-automation/imageupdateautomation.yaml similarity index 100% rename from test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/imageupdateautomation.yaml rename to test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/infrastructure/image-automation/imageupdateautomation.yaml diff --git a/test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/kustomization.yaml b/test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/infrastructure/image-automation/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/16-flux-image-automation/infrastructure/image-automation/kustomization.yaml rename to test/fixtures/gitops-layouts/4-machine-written/flux-image-automation/infrastructure/image-automation/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/13-sops-encrypted/.sops.yaml b/test/fixtures/gitops-layouts/5-opaque/sops-encrypted/.sops.yaml similarity index 100% rename from test/fixtures/gitops-layouts/13-sops-encrypted/.sops.yaml rename to test/fixtures/gitops-layouts/5-opaque/sops-encrypted/.sops.yaml diff --git a/test/fixtures/gitops-layouts/13-sops-encrypted/README.md b/test/fixtures/gitops-layouts/5-opaque/sops-encrypted/README.md similarity index 99% rename from test/fixtures/gitops-layouts/13-sops-encrypted/README.md rename to test/fixtures/gitops-layouts/5-opaque/sops-encrypted/README.md index 43ce5c42..cd00cd03 100644 --- a/test/fixtures/gitops-layouts/13-sops-encrypted/README.md +++ b/test/fixtures/gitops-layouts/5-opaque/sops-encrypted/README.md @@ -1,4 +1,4 @@ -# 13-sops-encrypted +# sops-encrypted ## What this is The standard way teams keep Secrets in a public or shared GitOps repo: encrypt diff --git a/test/fixtures/gitops-layouts/13-sops-encrypted/apps/frontend/deployment.yaml b/test/fixtures/gitops-layouts/5-opaque/sops-encrypted/apps/frontend/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/13-sops-encrypted/apps/frontend/deployment.yaml rename to test/fixtures/gitops-layouts/5-opaque/sops-encrypted/apps/frontend/deployment.yaml diff --git a/test/fixtures/gitops-layouts/13-sops-encrypted/apps/frontend/kustomization.yaml b/test/fixtures/gitops-layouts/5-opaque/sops-encrypted/apps/frontend/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/13-sops-encrypted/apps/frontend/kustomization.yaml rename to test/fixtures/gitops-layouts/5-opaque/sops-encrypted/apps/frontend/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/13-sops-encrypted/apps/frontend/secret.enc.yaml b/test/fixtures/gitops-layouts/5-opaque/sops-encrypted/apps/frontend/secret.enc.yaml similarity index 100% rename from test/fixtures/gitops-layouts/13-sops-encrypted/apps/frontend/secret.enc.yaml rename to test/fixtures/gitops-layouts/5-opaque/sops-encrypted/apps/frontend/secret.enc.yaml diff --git a/test/fixtures/gitops-layouts/13-sops-encrypted/clusters/production/apps.yaml b/test/fixtures/gitops-layouts/5-opaque/sops-encrypted/clusters/production/apps.yaml similarity index 100% rename from test/fixtures/gitops-layouts/13-sops-encrypted/clusters/production/apps.yaml rename to test/fixtures/gitops-layouts/5-opaque/sops-encrypted/clusters/production/apps.yaml diff --git a/test/fixtures/gitops-layouts/13-sops-encrypted/infrastructure/secrets/db-credentials.enc.yaml b/test/fixtures/gitops-layouts/5-opaque/sops-encrypted/infrastructure/secrets/db-credentials.enc.yaml similarity index 100% rename from test/fixtures/gitops-layouts/13-sops-encrypted/infrastructure/secrets/db-credentials.enc.yaml rename to test/fixtures/gitops-layouts/5-opaque/sops-encrypted/infrastructure/secrets/db-credentials.enc.yaml diff --git a/test/fixtures/gitops-layouts/13-sops-encrypted/infrastructure/secrets/kustomization.yaml b/test/fixtures/gitops-layouts/5-opaque/sops-encrypted/infrastructure/secrets/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/13-sops-encrypted/infrastructure/secrets/kustomization.yaml rename to test/fixtures/gitops-layouts/5-opaque/sops-encrypted/infrastructure/secrets/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/README.md b/test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/README.md similarity index 99% rename from test/fixtures/gitops-layouts/15-mixed-and-hostile/README.md rename to test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/README.md index f843f221..50e7b93e 100644 --- a/test/fixtures/gitops-layouts/15-mixed-and-hostile/README.md +++ b/test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/README.md @@ -1,4 +1,4 @@ -# 15-mixed-and-hostile +# mixed-and-hostile ## What this is A deliberately adversarial folder. Nothing here is invented: every trap is diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/application.yaml b/test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/application.yaml similarity index 100% rename from test/fixtures/gitops-layouts/15-mixed-and-hostile/application.yaml rename to test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/application.yaml diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/ci/.gitlab-ci.yml b/test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/ci/.gitlab-ci.yml similarity index 100% rename from test/fixtures/gitops-layouts/15-mixed-and-hostile/ci/.gitlab-ci.yml rename to test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/ci/.gitlab-ci.yml diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/ci/docker-compose.yml b/test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/ci/docker-compose.yml similarity index 100% rename from test/fixtures/gitops-layouts/15-mixed-and-hostile/ci/docker-compose.yml rename to test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/ci/docker-compose.yml diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/crossplane/composition.yaml b/test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/crossplane/composition.yaml similarity index 100% rename from test/fixtures/gitops-layouts/15-mixed-and-hostile/crossplane/composition.yaml rename to test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/crossplane/composition.yaml diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/empty-dir/.gitkeep b/test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/empty-dir/.gitkeep similarity index 100% rename from test/fixtures/gitops-layouts/15-mixed-and-hostile/empty-dir/.gitkeep rename to test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/empty-dir/.gitkeep diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/kro/resourcegraphdefinition.yaml b/test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/kro/resourcegraphdefinition.yaml similarity index 100% rename from test/fixtures/gitops-layouts/15-mixed-and-hostile/kro/resourcegraphdefinition.yaml rename to test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/kro/resourcegraphdefinition.yaml diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/kustomization.yaml b/test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/kustomization.yaml similarity index 100% rename from test/fixtures/gitops-layouts/15-mixed-and-hostile/kustomization.yaml rename to test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/kustomization.yaml diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/mixed/bundle.yaml b/test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/mixed/bundle.yaml similarity index 100% rename from test/fixtures/gitops-layouts/15-mixed-and-hostile/mixed/bundle.yaml rename to test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/mixed/bundle.yaml diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/mixed/deployment.json b/test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/mixed/deployment.json similarity index 100% rename from test/fixtures/gitops-layouts/15-mixed-and-hostile/mixed/deployment.json rename to test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/mixed/deployment.json diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/mixed/service.yml b/test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/mixed/service.yml similarity index 100% rename from test/fixtures/gitops-layouts/15-mixed-and-hostile/mixed/service.yml rename to test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/mixed/service.yml diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/secrets/db.enc.yaml b/test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/secrets/db.enc.yaml similarity index 100% rename from test/fixtures/gitops-layouts/15-mixed-and-hostile/secrets/db.enc.yaml rename to test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/secrets/db.enc.yaml diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/templates/deployment.yaml b/test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/templates/deployment.yaml similarity index 100% rename from test/fixtures/gitops-layouts/15-mixed-and-hostile/templates/deployment.yaml rename to test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/templates/deployment.yaml diff --git a/test/fixtures/gitops-layouts/15-mixed-and-hostile/values.yaml b/test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/values.yaml similarity index 100% rename from test/fixtures/gitops-layouts/15-mixed-and-hostile/values.yaml rename to test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/values.yaml diff --git a/test/fixtures/gitops-layouts/README.md b/test/fixtures/gitops-layouts/README.md index ee939de8..01962efb 100644 --- a/test/fixtures/gitops-layouts/README.md +++ b/test/fixtures/gitops-layouts/README.md @@ -3,107 +3,179 @@ Real-world GitOps repository layouts, checked in so we can design and reason against concrete examples instead of prose. -> **These fixtures record no conclusions.** Nothing here says which layouts -> GitOps Reverser supports, accepts, or refuses. Each fixture describes *what a -> layout is* and *what questions it raises*. Deciding the answers — and pinning -> them as golden reports — is deliberately a later step. +> **These fixtures record no verdicts.** Nothing here says which layouts GitOps +> Reverser supports, accepts, or refuses — that is the job of +> [`docs/design/gitops-api/support-contract.md`](../../../docs/design/gitops-api/support-contract.md). +> Each fixture describes *what a layout is*, *what questions it raises*, and — where +> we have run it — *what the real controller actually did*. A fixture may record an +> **observation**; it never records a support decision. ## Why this exists The compatibility question "does GitOps Reverser support Argo CD / Flux repositories?" is the wrong question, because Argo CD and Flux are mostly -orchestration *around* folders. The real boundary is determined by **what a -folder contains and how it is rendered**, not by which controller points at it. +orchestration *around* folders. The real boundary is decided by **what a folder +contains, how it is rendered, and whether the objects it produces have anywhere to +go back to** — not by which controller points at it. To find that boundary honestly we need the actual shapes users have. This corpus is that set of shapes. -The first-class target — a path whose checked-in files *are* the desired -Kubernetes objects, rather than inputs that must first be rendered — is only one -of the layouts below. The others exist so the edges are visible. +## The six families -## Reading the corpus +The directories are grouped by **the decision each layout forces**, not by a +number. One family per decision: -Each fixture directory holds a self-contained example repository plus a -`README.md` with four sections: +| Family | The question it forces | The thing that decides it | +|---|---|---| +| [1-desired-state/](1-desired-state/) | The files **are** the objects. Mirror and edit them. | every live object has a home file | +| [2-rendered/](2-rendered/) | The files are **inputs to an offline renderer**. Can an edit be inverted back to one of them? | *renderability* | +| [3-expanded/](3-expanded/) | A **controller** materialises the objects, and they have **no home file**. | *provenance* | +| [4-machine-written/](4-machine-written/) | Git is an **output**. Something else already writes here. | *ownership* | +| [5-opaque/](5-opaque/) | The object **is not the object**. We may not be able to read it at all. | *capability* | +| [6-hostile/](6-hostile/) | Every naive parser assumption, broken on purpose. | can we even read the bytes | + +Families 2, 3, and 4 are the three axes of the support model — renderability, +provenance, ownership — and they are the reason this grouping exists at all. The +model is argued in +[expansion-boundary-and-corpus-organisation.md](../../../docs/design/gitops-api/expansion-boundary-and-corpus-organisation.md). + +### The distinction families 1 and 3 exist to protect + +It is tempting to file "anything with an Argo CD or Flux CR in it" under +*expanded*. That is exactly wrong, and it is the mistake the provenance axis exists +to prevent: + +- An `Application` in [1-desired-state/argocd-app-of-apps/](1-desired-state/argocd-app-of-apps/) + is a **file a human wrote**. The root Application points at `applications/`, and + every child Application is checked in. Nothing is synthesised. +- A Flux `Kustomization` in [1-desired-state/flux-monorepo/](1-desired-state/flux-monorepo/) + points at a **folder of real files**. Its objects have homes. +- An `Application` in [3-expanded/argocd-applicationset-directories/](3-expanded/argocd-applicationset-directories/) + is **synthesised from a directory glob**. It exists only in etcd. + +All three involve a controller. Only the third has no home in Git. *"Was a +controller involved?"* is the wrong question; *"does this object have a home in +Git?"* is the right one. + +## The fixtures + +### 1-desired-state — the files are the objects -| Section | Contains | +| Fixture | Structural axis it isolates | |---|---| -| What this is | The real-world pattern and who uses it | -| Layout | A tree of the fixture | -| What makes it structurally distinct | The discriminating facts, including every file that is YAML but *not* a Kubernetes object | -| Open questions | Unanswered questions the layout poses | +| [argocd-plain](1-desired-state/argocd-plain/) | A directory of plain KRM; multi-doc files, arbitrary filenames, non-manifest YAML, `directory.include`/`exclude` globs | +| [repo-per-environment](1-desired-state/repo-per-environment/) | The environment boundary is a **repository** boundary; no shared base exists in Git | +| [argocd-app-of-apps](1-desired-state/argocd-app-of-apps/) | An `Application` that *describes* a deployment vs. the manifests it *references* vs. an ordinary object merely named `application.yaml`. Every child Application is a checked-in file | +| [flux-monorepo](1-desired-state/flux-monorepo/) | `apps/` + `infrastructure/` + `clusters/`; the strongest Flux fingerprint, and the `Kustomization` CR vs. `kustomization.yaml` collision | -## The fixtures +### 2-rendered — the files are inputs to a renderer + +| Fixture | Structural axis it isolates | +|---|---| +| [kustomize-overlays](2-rendered/kustomize-overlays/) | `base/` + `overlays//`; patches, `configMapGenerator`, `secretGenerator`, `namespace`, `namePrefix`, `images`, `replicas`, and a remote base | +| [helm-chart](2-rendered/helm-chart/) | The standard chart format: `templates/` is not KRM, `crds/` is, `values.yaml` is not, `values.schema.json` carries type information | +| [helm-environment-values](2-rendered/helm-environment-values/) | Effective config as a **merge** of chart defaults + common + environment + inline parameters | +| [argocd-external-helm](2-rendered/argocd-external-helm/) | Chart lives in an external registry; the repo holds Applications, versions, values, and stray plain manifests — three natures in one folder | +| [rendered-manifests](2-rendered/rendered-manifests/) | Git holds generated output, not sources; hash-suffixed names with no stable origin | + +### 3-expanded — a controller materialises objects with no home file + +The authored CR in these fixtures is itself ordinary, editable intent. What has no +home is its **output**. That split is the whole support contract, and these +fixtures exist to make it visible. + +| Fixture | Structural axis it isolates | +|---|---| +| [argocd-applicationset-directories](3-expanded/argocd-applicationset-directories/) | Directory names *become* Applications; wildcards, exclusions, an empty directory, a nested app directory `apps/*` misses. **Observed: creating a folder deploys an app** | +| [argocd-applicationset-files](3-expanded/argocd-applicationset-files/) | YAML that is **not KRM at all** — ApplicationSet generator input, beside a Helm chart | +| [argocd-multicluster-matrix](3-expanded/argocd-multicluster-matrix/) | A cluster × app matrix: one folder renders N times, with a sparse per-cluster values matrix | +| [flux-helmrelease](3-expanded/flux-helmrelease/) | Helm values inside CRDs — five delivery mechanisms — plus `postBuild.substitute` and `targetNamespace` injected from outside the folder | +| [flux-resourceset-inline](3-expanded/flux-resourceset-inline/) | **KRM nested inside KRM.** One document carries the template *and* its inputs; nine live objects, zero files. The layout flux-operator pitches as a base+overlay replacement | +| [flux-resourceset-pull-requests](3-expanded/flux-resourceset-pull-requests/) | **The inputs are not in the repository.** The desired object set is "however many PRs are open right now" — unknowable from any scan | + +### 4-machine-written — Git is an output + +| Fixture | Structural axis it isolates | +|---|---| +| [flux-image-automation](4-machine-written/flux-image-automation/) | A controller that **commits to the repo**; a `$imagepolicy` comment is load-bearing, so Git is an output as well as an input | + +### 5-opaque — the object is not the object -| # | Fixture | Structural axis it isolates | +| Fixture | Structural axis it isolates | +|---|---| +| [sops-encrypted](5-opaque/sops-encrypted/) | A file that is simultaneously a valid Kubernetes object and unreadable: cleartext `metadata`, opaque `data` | + +### 6-hostile — parser edges + +| Fixture | Structural axis it isolates | +|---|---| +| [mixed-and-hostile](6-hostile/mixed-and-hostile/) | Every naive assumption broken at once — filename implies kind, extension implies format, YAML implies KRM, KRM never nests KRM | + +## Fixtures are mixtures; families name the *primary* decision + +Real repositories are not pure, and neither are these. A fixture lives in the +family of the decision it primarily isolates, but most touch more than one axis. +The secondary axes are where the surprises are: + +| Fixture | Also touches | Because | |---|---|---| -| 01 | [01-argocd-plain](01-argocd-plain/) | A directory of plain KRM; multi-doc files, arbitrary filenames, non-manifest YAML, `directory.include`/`exclude` globs | -| 02 | [02-argocd-app-of-apps](02-argocd-app-of-apps/) | An `Application` that *describes* a deployment vs. the manifests it *references* vs. an ordinary object merely named `application.yaml` | -| 03 | [03-argocd-applicationset-directories](03-argocd-applicationset-directories/) | Directory names *become* Applications; wildcards, exclusions, an empty directory, a directory with no manifests, a nested app directory `apps/*` misses | -| 04 | [04-argocd-applicationset-files](04-argocd-applicationset-files/) | YAML that is **not KRM at all** — ApplicationSet generator input, beside a Helm chart | -| 05 | [05-kustomize-overlays](05-kustomize-overlays/) | `base/` + `overlays//`; patches, `configMapGenerator`, `secretGenerator`, `namespace`, `namePrefix`, `images`, `replicas`, and a remote base | -| 06 | [06-helm-chart](06-helm-chart/) | The standard chart format: `templates/` is not KRM, `crds/` is, `values.yaml` is not, `values.schema.json` carries type information | -| 07 | [07-helm-environment-values](07-helm-environment-values/) | Effective config as a **merge** of chart defaults + common + environment + inline parameters | -| 08 | [08-argocd-external-helm](08-argocd-external-helm/) | Chart lives in an external registry; the repo holds Applications, versions, values, and stray plain manifests — three natures in one folder | -| 09 | [09-flux-monorepo](09-flux-monorepo/) | `apps/` + `infrastructure/` + `clusters/`; the strongest Flux fingerprint, and the `Kustomization` CR vs. `kustomization.yaml` collision | -| 10 | [10-flux-helmrelease](10-flux-helmrelease/) | Helm values inside CRDs — five delivery mechanisms — plus `postBuild.substitute` and `targetNamespace` injected from outside the folder | -| 11 | [11-repo-per-environment](11-repo-per-environment/) | The environment boundary is a **repository** boundary; no shared base exists in Git | -| 12 | [12-multicluster-applicationset](12-multicluster-applicationset/) | A cluster × app matrix: one folder renders N times, with a sparse per-cluster values matrix | -| 13 | [13-sops-encrypted](13-sops-encrypted/) | A file that is simultaneously a valid Kubernetes object and unreadable: cleartext `metadata`, opaque `data` | -| 14 | [14-rendered-manifests](14-rendered-manifests/) | Git holds generated output, not sources; hash-suffixed names with no stable origin | -| 15 | [15-mixed-and-hostile](15-mixed-and-hostile/) | Every naive assumption broken at once — filename implies kind, extension implies format, YAML implies KRM, KRM never nests KRM | -| 16 | [16-flux-image-automation](16-flux-image-automation/) | A controller that **commits to the repo**; a `$imagepolicy` comment is load-bearing, so Git is an output as well as an input | - -## The layout dimensions underneath - -Repositories organise primarily around one of four axes, and serious ones combine -two or three. The fixtures above are instances of these combinations; there is no -universal standard that says which is correct. - -- **Application-first** — `apps//` -- **Environment-first** — `environments///` -- **Cluster-first** — `clusters///` -- **Team-first** — `teams///` - -Of the three ecosystems, only one is genuinely standardised: **Helm charts** have -a strict directory format. **Flux** has a documented convention that `flux -bootstrap` reinforces (`clusters//flux-system/`). **Argo CD** has no -canonical structure at all — its common shapes emerge from App of Apps, -ApplicationSets, Kustomize, and Helm value-file patterns. +| `flux-monorepo` | rendered | its `apps/` folders are kustomize base + overlays | +| `flux-monorepo` | expanded | it contains `HelmRelease`s, whose rendered objects have no home | +| `kustomize-overlays` | machine-written | it carries a committed `.argocd-source.yaml` written by Argo CD Image Updater | +| `argocd-external-helm` | desired-state | it holds stray plain manifests beside the Applications | +| `mixed-and-hostile` | expanded | it plants KRO and Crossplane documents — KRM nesting KRM | +| `helm-chart` | desired-state | `crds/` **is** KRM, even though `templates/` is not | + +That last row is a live bug, not a curiosity: a repo-scan today reports +`charts/frontend/crds` as the single accepted candidate in `helm-chart`, which +makes an onboarding report say "1 folder supported" about a chart we cannot +meaningfully support at all. + +## What the corpus still lacks + +Named here so a gap is a decision rather than an oversight: + +- **`kro-and-crossplane`** — KRO and Crossplane currently appear only as hostile + documents inside [6-hostile/](6-hostile/mixed-and-hostile/). They deserve a + first-class `3-expanded/` fixture, because KRM-nested-in-KRM is mainstream for + them, not hostile. +- **`argocd-image-updater`** — today only a `.argocd-source.yaml` dotfile inside + [2-rendered/kustomize-overlays/](2-rendered/kustomize-overlays/). It is a + machine-writer and belongs in [4-machine-written/](4-machine-written/). +- **`sealed-secrets` / `external-secrets`** — two more shapes of "a Secret that is + not the Secret", alongside the SOPS case in [5-opaque/](5-opaque/sops-encrypted/). +- **Kustomize `components`** — already represented as an assertion in + [`contextual-namespace/unsupported/components/`](../../../internal/manifestanalyzer/testdata/contextual-namespace/unsupported/components/), + but not as a layout. +- **Jsonnet / Tanka sources**, and **Argo CD config-management plugins** — + arbitrary programs that emit KRM. ## Two things worth knowing before you read any fixture **Some comments are load-bearing.** A `# {"$imagepolicy": ...}` setter in -[16](16-flux-image-automation/) is the only marker that makes a field automated; -a `{{ ... }}` action inside a *YAML comment* in a Helm template is still parsed by -Helm and will break the chart. Comments are not presentation. +[flux-image-automation](4-machine-written/flux-image-automation/) is the only +marker that makes a field automated; a `{{ ... }}` action inside a *YAML comment* +in a Helm template is still parsed by Helm and will break the chart. Comments are +not presentation. **Some hidden dotfiles decide what deploys.** `.argocd-source.yaml` (path-wide) and `.argocd-source-.yaml` (per-Application) are merged over an Argo CD Application's `spec.source`, so they outrank the values and transformers a reader -would naturally inspect. They appear in [05](05-kustomize-overlays/) — written and -committed by Argo CD Image Updater — and in [07](07-helm-environment-values/). -They carry no `apiVersion`/`kind`. +would naturally inspect. They appear in +[2-rendered/kustomize-overlays/](2-rendered/kustomize-overlays/) — written and +committed by Argo CD Image Updater — and in +[2-rendered/helm-environment-values/](2-rendered/helm-environment-values/). They +carry no `apiVersion`/`kind`. ## Deliberately absent Two hostile cases cannot be represented as committed files, and are described in -prose inside [15-mixed-and-hostile](15-mixed-and-hostile/) instead: +prose inside [6-hostile/mixed-and-hostile](6-hostile/mixed-and-hostile/) instead: - a **symlink** escaping the folder - a genuinely **empty directory** (git cannot store one; the fixtures use `.gitkeep`) -Out of scope for now, roughly in the order they deserve to graduate: - -- **Kustomize `components`** — common enough to be worth a fixture soon. Already - represented as an assertion in - [`contextual-namespace/unsupported/components/`](../../../internal/manifestanalyzer/testdata/contextual-namespace/unsupported/components/). -- **SealedSecrets and ExternalSecrets** — two more shapes of "a Secret that is not - the Secret", alongside the SOPS case in [13](13-sops-encrypted/). -- **Jsonnet / Tanka sources**, and **Argo CD config-management plugins** — arbitrary - programs that emit KRM. - ## Conventions Fixtures share names so they can be compared: apps `frontend` / `backend` / @@ -114,26 +186,40 @@ Every credential, token, key, and ciphertext is **fake** and marked as such. The `age` recipients are public keys from upstream documentation; the SOPS blocks are structurally correct with placeholder ciphertext. -`05-kustomize-overlays` checks in a `secrets.env` file on purpose, so the root -[`.gitignore`](../../../.gitignore) carries a scoped `!test/fixtures/gitops-layouts/**/*.env` -negation for it. +[2-rendered/kustomize-overlays](2-rendered/kustomize-overlays/) checks in a +`secrets.env` file on purpose, so the root [`.gitignore`](../../../.gitignore) +carries a scoped `!test/fixtures/gitops-layouts/**/*.env` negation for it. ## Checking the fixtures are real The three Helm charts are genuine charts, not sketches: ```bash -helm lint 04-argocd-applicationset-files/chart -helm lint 06-helm-chart/charts/frontend # renders after `helm dependency build` -helm lint 07-helm-environment-values/chart +helm lint 3-expanded/argocd-applicationset-files/chart +helm lint 2-rendered/helm-chart/charts/frontend # renders after `helm dependency build` +helm lint 2-rendered/helm-environment-values/chart ``` -All three lint clean. `04` and `07` also `helm template` offline; `06` declares an -unvendored `redis` subchart, so rendering it needs `helm dependency build` first — -which is the normal state of a real chart repository. +All three lint clean. `argocd-applicationset-files` and `helm-environment-values` +also `helm template` offline; `helm-chart` declares an unvendored `redis` subchart, +so rendering it needs `helm dependency build` first — which is the normal state of a +real chart repository. Every other YAML in the corpus parses, except where a fixture states it must not: -Helm `templates/`, and `15-mixed-and-hostile/templates/deployment.yaml`. +Helm `templates/`, and `6-hostile/mixed-and-hostile/templates/deployment.yaml`. + +## The behavioural baseline + +[`support-today.md`](support-today.md) records what `manifest-analyzer` reports for +each fixture **today**. It is generated, not written: + +```bash +task gitops-layouts-baseline +``` + +Regenerate it whenever the analyzer's behaviour changes, and commit the diff. A +change to the acceptance boundary then shows up in review as exactly which fixtures +moved, and in which direction — which is the point of having a corpus at all. ## Relationship to the other corpora @@ -145,13 +231,18 @@ exist and *are* assertion-driven — do not duplicate them here: - [`internal/manifestanalyzer/testdata/contextual-namespace/`](../../../internal/manifestanalyzer/testdata/contextual-namespace/) — the supported/unsupported boundary for kustomize-inherited namespaces. -When a layout here graduates into a decision, that decision belongs in one of -those corpora (as an assertion) and in +When a layout here graduates into a decision, that decision belongs in one of those +corpora (as an assertion) and in [`docs/design/gitops-api/`](../../../docs/design/gitops-api/) (as the reasoning). ## Adding a fixture Add one whenever a new "can we handle X?" question comes up and the existing -fixtures cannot express it. Keep it small, keep it real — real apiVersions, real -chart names, plausible images — follow the four-section README, and resist -recording a verdict. +fixtures cannot express it. Put it in the family of the decision it forces. Keep it +small, keep it real — real apiVersions, real chart names, plausible images — follow +the four-section README (*What this is* / *Layout* / *What makes it structurally +distinct* / *Open questions*), and **resist recording a verdict**. + +If you have run the layout against a real controller, add an **Observed behaviour** +section with what the controller actually did. That is a fact, not a verdict, and it +is the most valuable thing a fixture can carry. diff --git a/test/fixtures/gitops-layouts/support-today.md b/test/fixtures/gitops-layouts/support-today.md index a6eba038..aa6d1f13 100644 --- a/test/fixtures/gitops-layouts/support-today.md +++ b/test/fixtures/gitops-layouts/support-today.md @@ -1,251 +1,250 @@ -# Support today: GitOps layout fixtures +# Support today: the GitOps layout corpus -Generated from the current `manifest-analyzer` repo scan. This file is -descriptive: it records what the tool reports today, not what the product should -eventually support. + -Command used per fixture: +A behavioural baseline: what `manifest-analyzer --mode scan-repo` reports for every +fixture in this corpus, as of the last regeneration. It is **descriptive**. It +records what the tool does today, not what the product should support — that is +[`docs/design/gitops-api/support-contract.md`](../../../docs/design/gitops-api/support-contract.md). -```bash -go build -o /tmp/manifest-analyzer ./cmd/manifest-analyzer -/tmp/manifest-analyzer --mode scan-repo --format json test/fixtures/gitops-layouts/ -``` +This file carries no interpretation on purpose. When it disagrees with the support +contract, that disagreement is the backlog. -Important reading rules: +Reading rules: -- `rc=0` means the scan command succeeded. It does not mean the fixture is fully supported. -- `accepted` and `refused` count reported candidate folders, not whole repository support. -- `scan-repo` is structure-only. It does not execute Argo CD, Flux, Helm, SOPS, - plugins, or remote fetches. -- A missing candidate can be as important as a refusal: it means the tool did not - explain that part of the repo at all. +- `rc=0` means the scan command succeeded. It does **not** mean the fixture is supported. +- `accepted` / `refused` count reported **candidate folders**, not whole-repository support. +- `scan-repo` is structure-only. It never executes Argo CD, Flux, Helm, SOPS, plugins, + or remote fetches — so it cannot see a generator's output, a rendered chart, or an + input set that lives in a Git-host API. +- **A missing candidate matters as much as a refusal**: it means the tool did not + explain that part of the repository at all. ## Summary -| Fixture | rc | Outcome | Accepted | Refused | Layouts | Fleet root | Unsupported constructs | Reported refusal signal | -|---|---:|---|---:|---:|---|---|---|---| -| 01-argocd-plain | 0 | Partial | 1 | 1 | plain=2 | false | - | non-krm-yaml: ci-metadata.yaml: YAML is not a Kubernetes manifest | -| 02-argocd-app-of-apps | 0 | All reported candidates accepted | 4 | 0 | plain=4 | false | - | None | -| 03-argocd-applicationset-directories | 0 | All reported candidates accepted | 5 | 0 | plain=5 | false | - | None | -| 04-argocd-applicationset-files | 0 | No reported candidates accepted | 0 | 1 | plain=1 | false | - | non-krm-yaml: chart/Chart.yaml: YAML is not a Kubernetes manifest
foreign-file: chart/templates/_helpers.tpl: foreign file chart/templates/_helpers.tpl is not a managed manifest; remove it or name it in .gittargetignore
non-krm-yaml: chart/templates/deployment.yaml: YAML is not a Kubernetes manifest
non-krm-yaml: chart/templates/service.yaml: YAML is not a Kubernetes manifest
+5 more | -| 05-kustomize-overlays | 0 | Partial | 1 | 3 | kustomize-single=1, refused-structural=3 | false | configMapGenerator, namePrefix, nameSuffix, patches, remote-base, secretGenerator | refused-structural: kustomization uses unsupported feature(s): remote-base
refused-structural: kustomization uses unsupported feature(s): configMapGenerator, nameSuffix, patches, secretGenerator
refused-structural: kustomization uses unsupported feature(s): configMapGenerator, namePrefix, patches | -| 06-helm-chart | 0 | All reported candidates accepted | 1 | 0 | plain=1 | false | - | None | -| 07-helm-environment-values | 0 | All reported candidates accepted | 1 | 0 | plain=1 | false | - | None | -| 08-argocd-external-helm | 0 | Partial | 2 | 1 | plain=3 | false | - | non-krm-yaml: values.yaml: YAML is not a Kubernetes manifest | -| 09-flux-monorepo | 0 | Partial | 4 | 2 | kustomize-single=4, refused-structural=2 | false | patches | refused-structural: kustomization uses unsupported feature(s): patches | -| 10-flux-helmrelease | 0 | Partial | 3 | 1 | kustomize-single=3, refused-structural=1 | false | configMapGenerator | refused-structural: kustomization uses unsupported feature(s): configMapGenerator | -| 11-repo-per-environment | 0 | Partial | 6 | 3 | plain=9 | false | - | foreign-file: .gitignore: foreign file .gitignore is not a managed manifest; remove it or name it in .gittargetignore | -| 12-multicluster-applicationset | 0 | All reported candidates accepted | 4 | 0 | plain=4 | false | - | None | -| 13-sops-encrypted | 0 | All reported candidates accepted | 3 | 0 | kustomize-single=2, plain=1 | false | - | None | -| 14-rendered-manifests | 0 | Partial | 3 | 2 | plain=3, refused-structural=2 | false | namePrefix | refused-structural: kustomization uses unsupported feature(s): namePrefix | -| 15-mixed-and-hostile | 0 | Partial | 3 | 2 | kustomize-single=1, plain=4 | false | - | non-krm-yaml: ci/.gitlab-ci.yml: YAML is not a Kubernetes manifest
non-krm-yaml: ci/docker-compose.yml: YAML is not a Kubernetes manifest
foreign-file: empty-dir/.gitkeep: foreign file empty-dir/.gitkeep is not a managed manifest; remove it or name it in .gittargetignore
mixed-managed-allowlisted: kustomization.yaml: managed resource kustomize.toolkit.fluxcd.io/v1/Kustomization/flux-system/apps must not live in the allowlisted build-directive file kustomization.yaml
+8 more | -| 16-flux-image-automation | 0 | All reported candidates accepted | 3 | 0 | kustomize-single=3 | false | - | None | - -## Review notes - -- The scanner gives useful, specific refusal messages for non-KRM YAML, foreign - files, invalid YAML, mixed managed/non-KRM documents, and unsupported kustomize - features. That is the good news. -- Helm support is under-reported. Fixtures `06-helm-chart` and - `07-helm-environment-values` do not produce a clear "Helm chart/templates are - unsupported" result; the scanner mostly reports only adjacent KRM such as - `crds/` or Argo CD Application manifests. -- Argo CD and Flux orchestration semantics are not modeled. The scanner treats - their CRs as ordinary KRM and does not follow Application paths, ApplicationSet - generators, Flux image update policies, or Helm value references. -- The Flux fleet-root signal did not fire for the realistic `clusters/` + - `apps/` + `infrastructure/` shape in fixture `09-flux-monorepo`; the current - detector appears narrower than the fixture vocabulary. -- Several accepted candidates are control-plane/configuration folders (`argocd`, - `applications`, `bootstrap`, `clusters`, `infrastructure`) rather than workload - desired-state folders. That may be structurally true KRM, but it is probably - not the onboarding answer a product should lead with. - -## 01-argocd-plain - -Reported result: **Partial**. Accepted `1`, refused `1`. -Unsupported constructs summary: `none`. Fleet root: `false`. - -| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | -|---|---|---|---|---|---| -| `apps/frontend` | `plain` | false | `frontend` | 6/6/1 | non-krm-yaml: ci-metadata.yaml: YAML is not a Kubernetes manifest | -| `argocd` | `plain` | true | `argocd` | 1/1/0 | none | - -## 02-argocd-app-of-apps - -Reported result: **All reported candidates accepted**. Accepted `4`, refused `0`. -Unsupported constructs summary: `none`. Fleet root: `false`. - -| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +| Fixture | rc | Outcome | Accepted | Refused | Layouts | Unsupported constructs | Reported refusal signal | +|---|---:|---|---:|---:|---|---|---| +| 1-desired-state/argocd-app-of-apps | 0 | All reported candidates accepted | 4 | 0 | plain=4 | - | None | +| 1-desired-state/argocd-plain | 0 | Partial | 1 | 1 | plain=2 | - | non-krm-yaml: ci-metadata.yaml: YAML is not a Kubernetes manifest | +| 1-desired-state/flux-monorepo | 0 | Partial | 4 | 2 | kustomize-single=4, refused-structural=2 | patches | refused-structural: kustomization uses unsupported feature(s): patches
refused-structural: kustomization uses unsupported feature(s): patches | +| 1-desired-state/repo-per-environment | 0 | Partial | 6 | 3 | plain=9 | - | foreign-file: .gitignore: foreign file .gitignore is not a managed manifest; remove it or name it in .gittargetignore
foreign-file: .gitignore: foreign file .gitignore is not a managed manifest; remove it or name it in .gittargetignore
foreign-file: .gitignore: foreign file .gitignore is not a managed manifest; remove it or name it in .gittargetignore | +| 2-rendered/argocd-external-helm | 0 | Partial | 2 | 1 | plain=3 | - | non-krm-yaml: values.yaml: YAML is not a Kubernetes manifest | +| 2-rendered/helm-chart | 0 | All reported candidates accepted | 1 | 0 | plain=1 | - | None | +| 2-rendered/helm-environment-values | 0 | All reported candidates accepted | 1 | 0 | plain=1 | - | None | +| 2-rendered/kustomize-overlays | 0 | Partial | 1 | 3 | kustomize-single=1, refused-structural=3 | configMapGenerator, namePrefix, nameSuffix, patches, remote-base, secretGenerator | refused-structural: kustomization uses unsupported feature(s): remote-base
refused-structural: kustomization uses unsupported feature(s): configMapGenerator, nameSuffix, patches, secretGenerator
refused-structural: kustomization uses unsupported feature(s): configMapGenerator, namePrefix, patches | +| 2-rendered/rendered-manifests | 0 | Partial | 3 | 2 | plain=3, refused-structural=2 | namePrefix | refused-structural: kustomization uses unsupported feature(s): namePrefix
refused-structural: kustomization uses unsupported feature(s): namePrefix | +| 3-expanded/argocd-applicationset-directories | 0 | All reported candidates accepted | 5 | 0 | plain=5 | - | None | +| 3-expanded/argocd-applicationset-files | 0 | No reported candidates accepted | 0 | 1 | plain=1 | - | non-krm-yaml: chart/Chart.yaml: YAML is not a Kubernetes manifest
foreign-file: chart/templates/_helpers.tpl: foreign file chart/templates/_helpers.tpl is not a managed manifest; remove it or name it in .gittargetignore
non-krm-yaml: chart/templates/deployment.yaml: YAML is not a Kubernetes manifest
non-krm-yaml: chart/templates/service.yaml: YAML is not a Kubernetes manifest
+5 more | +| 3-expanded/argocd-multicluster-matrix | 0 | All reported candidates accepted | 4 | 0 | plain=4 | - | None | +| 3-expanded/flux-helmrelease | 0 | Partial | 3 | 1 | kustomize-single=3, refused-structural=1 | configMapGenerator | refused-structural: kustomization uses unsupported feature(s): configMapGenerator | +| 3-expanded/flux-resourceset-inline | 0 | All reported candidates accepted | 1 | 0 | plain=1 | - | None | +| 3-expanded/flux-resourceset-pull-requests | 0 | All reported candidates accepted | 1 | 0 | plain=1 | - | None | +| 4-machine-written/flux-image-automation | 0 | All reported candidates accepted | 3 | 0 | kustomize-single=3 | - | None | +| 5-opaque/sops-encrypted | 0 | All reported candidates accepted | 3 | 0 | kustomize-single=2, plain=1 | - | None | +| 6-hostile/mixed-and-hostile | 0 | Partial | 3 | 2 | kustomize-single=1, plain=4 | - | non-krm-yaml: ci/.gitlab-ci.yml: YAML is not a Kubernetes manifest
non-krm-yaml: ci/docker-compose.yml: YAML is not a Kubernetes manifest
foreign-file: empty-dir/.gitkeep: foreign file empty-dir/.gitkeep is not a managed manifest; remove it or name it in .gittargetignore
mixed-managed-allowlisted: kustomization.yaml: managed resource kustomize.toolkit.fluxcd.io/v1/Kustomization/flux-system/apps must not live in the allowlisted build-directive file kustomization.yaml
+8 more | + +## 1-desired-state/argocd-app-of-apps + +Reported rc `0`. Accepted `4`, refused `0`. +Unsupported constructs: `none`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons | |---|---|---|---|---|---| | `applications` | `plain` | true | `argocd` | 2/2/0 | none | | `bootstrap` | `plain` | true | `argocd` | 1/1/0 | none | | `manifests/backend` | `plain` | true | `backend` | 2/2/0 | none | | `manifests/frontend` | `plain` | true | `frontend` | 2/2/0 | none | -## 03-argocd-applicationset-directories +## 1-desired-state/argocd-plain -Reported result: **All reported candidates accepted**. Accepted `5`, refused `0`. -Unsupported constructs summary: `none`. Fleet root: `false`. +Reported rc `0`. Accepted `1`, refused `1`. +Unsupported constructs: `none`. Fleet root: `false`. -| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons | |---|---|---|---|---|---| -| `apps/backend` | `plain` | true | `backend` | 2/2/0 | none | -| `apps/frontend` | `plain` | true | `frontend` | 2/2/0 | none | -| `apps/platform/monitoring` | `plain` | true | `platform` | 2/2/0 | none | -| `apps/worker` | `plain` | true | `worker` | 1/1/0 | none | -| `bootstrap` | `plain` | true | `argocd` | 1/1/0 | none | +| `apps/frontend` | `plain` | false | `frontend` | 6/6/1 | non-krm-yaml: ci-metadata.yaml: YAML is not a Kubernetes manifest | +| `argocd` | `plain` | true | `argocd` | 1/1/0 | none | -## 04-argocd-applicationset-files +## 1-desired-state/flux-monorepo -Reported result: **No reported candidates accepted**. Accepted `0`, refused `1`. -Unsupported constructs summary: `none`. Fleet root: `false`. +Reported rc `0`. Accepted `4`, refused `2`. +Unsupported constructs: `patches`. Fleet root: `false`. -| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons | |---|---|---|---|---|---| -| `.` | `plain` | false | `argocd` | 1/1/9 | non-krm-yaml: chart/Chart.yaml: YAML is not a Kubernetes manifest; foreign-file: chart/templates/_helpers.tpl: foreign file chart/templates/_helpers.tpl is not a managed manifest; remove it or name it in .gittargetignore; non-krm-yaml: chart/templates/deployment.yaml: YAML is not a Kubernetes manifest; non-krm-yaml: chart/templates/service.yaml: YAML is not a Kubernetes manifest; non-krm-yaml: chart/values.yaml: YAML is not a Kubernetes manifest; non-krm-yaml: deployments/dev/backend.yaml: YAML is not a Kubernetes manifest; non-krm-yaml: deployments/dev/frontend.yaml: YAML is not a Kubernetes manifest; non-krm-yaml: deployments/production/backend.yaml: YAML is not a Kubernetes manifest; non-krm-yaml: deployments/production/frontend.yaml: YAML is not a Kubernetes manifest | +| `apps/production` | `refused-structural` | false | `production` | 2/0/0 | refused-structural: kustomization uses unsupported feature(s): patches | +| `apps/staging` | `refused-structural` | false | `staging` | 2/0/0 | refused-structural: kustomization uses unsupported feature(s): patches | +| `clusters/production` | `kustomize-single` | true | `flux-system` | 7/7/0 | none | +| `clusters/staging` | `kustomize-single` | true | `flux-system` | 7/7/0 | none | +| `infrastructure/configs` | `kustomize-single` | true | `-` | 1/1/0 | none | +| `infrastructure/controllers` | `kustomize-single` | true | `-` | 2/2/0 | none | -## 05-kustomize-overlays +## 1-desired-state/repo-per-environment -Reported result: **Partial**. Accepted `1`, refused `3`. -Unsupported constructs summary: `configMapGenerator, namePrefix, nameSuffix, patches, remote-base, secretGenerator`. -Fleet root: `false`. +Reported rc `0`. Accepted `6`, refused `3`. +Unsupported constructs: `none`. Fleet root: `false`. -| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons | |---|---|---|---|---|---| -| `apps/backend/base` | `kustomize-single` | true | `` | 2/2/0 | none | -| `apps/backend/overlays/production` | `refused-structural` | false | `backend-production` | 0/0/0 | refused-structural: kustomization uses unsupported feature(s): remote-base | -| `apps/frontend/overlays/production` | `refused-structural` | false | `frontend-production` | 2/0/3 | refused-structural: kustomization uses unsupported feature(s): configMapGenerator, nameSuffix, patches, secretGenerator | -| `apps/frontend/overlays/staging` | `refused-structural` | false | `frontend-staging` | 2/0/1 | refused-structural: kustomization uses unsupported feature(s): configMapGenerator, namePrefix, patches | +| `gitops-dev` | `plain` | false | `-` | 6/6/1 | foreign-file: .gitignore: foreign file .gitignore is not a managed manifest; remove it or name it in .gittargetignore | +| `gitops-dev/apps/backend` | `plain` | true | `backend-dev` | 2/2/0 | none | +| `gitops-dev/apps/frontend` | `plain` | true | `frontend-dev` | 2/2/0 | none | +| `gitops-production` | `plain` | false | `-` | 7/7/1 | foreign-file: .gitignore: foreign file .gitignore is not a managed manifest; remove it or name it in .gittargetignore | +| `gitops-production/apps/backend` | `plain` | true | `backend-production` | 2/2/0 | none | +| `gitops-production/apps/frontend` | `plain` | true | `frontend-production` | 3/3/0 | none | +| `gitops-staging` | `plain` | false | `-` | 6/6/1 | foreign-file: .gitignore: foreign file .gitignore is not a managed manifest; remove it or name it in .gittargetignore | +| `gitops-staging/apps/backend` | `plain` | true | `backend-staging` | 2/2/0 | none | +| `gitops-staging/apps/frontend` | `plain` | true | `frontend-staging` | 2/2/0 | none | + +## 2-rendered/argocd-external-helm + +Reported rc `0`. Accepted `2`, refused `1`. +Unsupported constructs: `none`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `applications` | `plain` | true | `argocd` | 3/3/0 | none | +| `extras/ingress-nginx` | `plain` | true | `ingress-nginx` | 2/2/0 | none | +| `platform/cert-manager` | `plain` | false | `argocd` | 2/2/1 | non-krm-yaml: values.yaml: YAML is not a Kubernetes manifest | -## 06-helm-chart +## 2-rendered/helm-chart -Reported result: **All reported candidates accepted**. Accepted `1`, refused `0`. -Unsupported constructs summary: `none`. Fleet root: `false`. +Reported rc `0`. Accepted `1`, refused `0`. +Unsupported constructs: `none`. Fleet root: `false`. -| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons | |---|---|---|---|---|---| -| `charts/frontend/crds` | `plain` | true | `` | 1/1/0 | none | +| `charts/frontend/crds` | `plain` | true | `-` | 1/1/0 | none | -## 07-helm-environment-values +## 2-rendered/helm-environment-values -Reported result: **All reported candidates accepted**. Accepted `1`, refused `0`. -Unsupported constructs summary: `none`. Fleet root: `false`. +Reported rc `0`. Accepted `1`, refused `0`. +Unsupported constructs: `none`. Fleet root: `false`. -| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons | |---|---|---|---|---|---| | `argocd` | `plain` | true | `argocd` | 2/2/0 | none | -## 08-argocd-external-helm +## 2-rendered/kustomize-overlays -Reported result: **Partial**. Accepted `2`, refused `1`. -Unsupported constructs summary: `none`. Fleet root: `false`. +Reported rc `0`. Accepted `1`, refused `3`. +Unsupported constructs: `configMapGenerator, namePrefix, nameSuffix, patches, remote-base, secretGenerator`. Fleet root: `false`. -| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons | |---|---|---|---|---|---| -| `applications` | `plain` | true | `argocd` | 3/3/0 | none | -| `extras/ingress-nginx` | `plain` | true | `ingress-nginx` | 2/2/0 | none | -| `platform/cert-manager` | `plain` | false | `argocd` | 2/2/1 | non-krm-yaml: values.yaml: YAML is not a Kubernetes manifest | +| `apps/backend/base` | `kustomize-single` | true | `-` | 2/2/0 | none | +| `apps/backend/overlays/production` | `refused-structural` | false | `backend-production` | 0/0/0 | refused-structural: kustomization uses unsupported feature(s): remote-base | +| `apps/frontend/overlays/production` | `refused-structural` | false | `frontend-production` | 2/0/3 | refused-structural: kustomization uses unsupported feature(s): configMapGenerator, nameSuffix, patches, secretGenerator | +| `apps/frontend/overlays/staging` | `refused-structural` | false | `frontend-staging` | 2/0/1 | refused-structural: kustomization uses unsupported feature(s): configMapGenerator, namePrefix, patches | -## 09-flux-monorepo +## 2-rendered/rendered-manifests -Reported result: **Partial**. Accepted `4`, refused `2`. -Unsupported constructs summary: `patches`. Fleet root: `false`. +Reported rc `0`. Accepted `3`, refused `2`. +Unsupported constructs: `namePrefix`. Fleet root: `false`. -| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons | |---|---|---|---|---|---| -| `apps/production` | `refused-structural` | false | `production` | 2/0/0 | refused-structural: kustomization uses unsupported feature(s): patches | -| `apps/staging` | `refused-structural` | false | `staging` | 2/0/0 | refused-structural: kustomization uses unsupported feature(s): patches | -| `clusters/production` | `kustomize-single` | true | `flux-system` | 7/7/0 | none | -| `clusters/staging` | `kustomize-single` | true | `flux-system` | 7/7/0 | none | -| `infrastructure/configs` | `kustomize-single` | true | `` | 1/1/0 | none | -| `infrastructure/controllers` | `kustomize-single` | true | `` | 2/2/0 | none | +| `argocd` | `plain` | true | `argocd` | 1/1/0 | none | +| `rendered/production` | `plain` | true | `frontend-production` | 3/3/0 | none | +| `rendered/staging` | `plain` | true | `frontend-staging` | 3/3/0 | none | +| `src/frontend/overlays/production` | `refused-structural` | false | `frontend-production` | 2/0/0 | refused-structural: kustomization uses unsupported feature(s): namePrefix | +| `src/frontend/overlays/staging` | `refused-structural` | false | `frontend-staging` | 2/0/0 | refused-structural: kustomization uses unsupported feature(s): namePrefix | -## 10-flux-helmrelease +## 3-expanded/argocd-applicationset-directories -Reported result: **Partial**. Accepted `3`, refused `1`. -Unsupported constructs summary: `configMapGenerator`. Fleet root: `false`. +Reported rc `0`. Accepted `5`, refused `0`. +Unsupported constructs: `none`. Fleet root: `false`. -| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons | |---|---|---|---|---|---| -| `apps/frontend` | `refused-structural` | false | `` | 1/1/1 | refused-structural: kustomization uses unsupported feature(s): configMapGenerator | -| `clusters/production` | `kustomize-single` | true | `flux-system` | 7/7/0 | none | -| `infrastructure/controllers/ingress-nginx` | `kustomize-single` | true | `flux-system` | 3/3/0 | none | -| `infrastructure/sources` | `kustomize-single` | true | `flux-system` | 3/3/0 | none | +| `apps/backend` | `plain` | true | `backend` | 2/2/0 | none | +| `apps/frontend` | `plain` | true | `frontend` | 2/2/0 | none | +| `apps/platform/monitoring` | `plain` | true | `platform` | 2/2/0 | none | +| `apps/worker` | `plain` | true | `worker` | 1/1/0 | none | +| `bootstrap` | `plain` | true | `argocd` | 1/1/0 | none | -## 11-repo-per-environment +## 3-expanded/argocd-applicationset-files -Reported result: **Partial**. Accepted `6`, refused `3`. -Unsupported constructs summary: `none`. Fleet root: `false`. +Reported rc `0`. Accepted `0`, refused `1`. +Unsupported constructs: `none`. Fleet root: `false`. -| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons | |---|---|---|---|---|---| -| `gitops-dev` | `plain` | false | `` | 6/6/1 | foreign-file: .gitignore: foreign file .gitignore is not a managed manifest; remove it or name it in .gittargetignore | -| `gitops-dev/apps/backend` | `plain` | true | `backend-dev` | 2/2/0 | none | -| `gitops-dev/apps/frontend` | `plain` | true | `frontend-dev` | 2/2/0 | none | -| `gitops-production` | `plain` | false | `` | 7/7/1 | foreign-file: .gitignore: foreign file .gitignore is not a managed manifest; remove it or name it in .gittargetignore | -| `gitops-production/apps/backend` | `plain` | true | `backend-production` | 2/2/0 | none | -| `gitops-production/apps/frontend` | `plain` | true | `frontend-production` | 3/3/0 | none | -| `gitops-staging` | `plain` | false | `` | 6/6/1 | foreign-file: .gitignore: foreign file .gitignore is not a managed manifest; remove it or name it in .gittargetignore | -| `gitops-staging/apps/backend` | `plain` | true | `backend-staging` | 2/2/0 | none | -| `gitops-staging/apps/frontend` | `plain` | true | `frontend-staging` | 2/2/0 | none | +| `.` | `plain` | false | `argocd` | 1/1/9 | non-krm-yaml: chart/Chart.yaml: YAML is not a Kubernetes manifest
foreign-file: chart/templates/_helpers.tpl: foreign file chart/templates/_helpers.tpl is not a managed manifest; remove it or name it in .gittargetignore
non-krm-yaml: chart/templates/deployment.yaml: YAML is not a Kubernetes manifest
non-krm-yaml: chart/templates/service.yaml: YAML is not a Kubernetes manifest
non-krm-yaml: chart/values.yaml: YAML is not a Kubernetes manifest
non-krm-yaml: deployments/dev/backend.yaml: YAML is not a Kubernetes manifest
non-krm-yaml: deployments/dev/frontend.yaml: YAML is not a Kubernetes manifest
non-krm-yaml: deployments/production/backend.yaml: YAML is not a Kubernetes manifest
non-krm-yaml: deployments/production/frontend.yaml: YAML is not a Kubernetes manifest | -## 12-multicluster-applicationset +## 3-expanded/argocd-multicluster-matrix -Reported result: **All reported candidates accepted**. Accepted `4`, refused `0`. -Unsupported constructs summary: `none`. Fleet root: `false`. +Reported rc `0`. Accepted `4`, refused `0`. +Unsupported constructs: `none`. Fleet root: `false`. -| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons | |---|---|---|---|---|---| | `applicationsets` | `plain` | true | `argocd` | 1/1/0 | none | -| `apps/backend` | `plain` | true | `` | 2/2/0 | none | -| `apps/frontend` | `plain` | true | `` | 2/2/0 | none | +| `apps/backend` | `plain` | true | `-` | 2/2/0 | none | +| `apps/frontend` | `plain` | true | `-` | 2/2/0 | none | | `clusters` | `plain` | true | `argocd` | 3/3/0 | none | -## 13-sops-encrypted +## 3-expanded/flux-helmrelease -Reported result: **All reported candidates accepted**. Accepted `3`, refused `0`. -Unsupported constructs summary: `none`. Fleet root: `false`. +Reported rc `0`. Accepted `3`, refused `1`. +Unsupported constructs: `configMapGenerator`. Fleet root: `false`. -| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons | |---|---|---|---|---|---| -| `apps/frontend` | `kustomize-single` | true | `frontend-production` | 2/2/0 | none | -| `clusters/production` | `plain` | true | `flux-system` | 2/2/0 | none | -| `infrastructure/secrets` | `kustomize-single` | true | `infrastructure` | 1/1/0 | none | +| `apps/frontend` | `refused-structural` | false | `-` | 1/1/1 | refused-structural: kustomization uses unsupported feature(s): configMapGenerator | +| `clusters/production` | `kustomize-single` | true | `flux-system` | 7/7/0 | none | +| `infrastructure/controllers/ingress-nginx` | `kustomize-single` | true | `flux-system` | 3/3/0 | none | +| `infrastructure/sources` | `kustomize-single` | true | `flux-system` | 3/3/0 | none | -## 14-rendered-manifests +## 3-expanded/flux-resourceset-inline -Reported result: **Partial**. Accepted `3`, refused `2`. -Unsupported constructs summary: `namePrefix`. Fleet root: `false`. +Reported rc `0`. Accepted `1`, refused `0`. +Unsupported constructs: `none`. Fleet root: `false`. -| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons | |---|---|---|---|---|---| -| `argocd` | `plain` | true | `argocd` | 1/1/0 | none | -| `rendered/production` | `plain` | true | `frontend-production` | 3/3/0 | none | -| `rendered/staging` | `plain` | true | `frontend-staging` | 3/3/0 | none | -| `src/frontend/overlays/production` | `refused-structural` | false | `frontend-production` | 2/0/0 | refused-structural: kustomization uses unsupported feature(s): namePrefix | -| `src/frontend/overlays/staging` | `refused-structural` | false | `frontend-staging` | 2/0/0 | refused-structural: kustomization uses unsupported feature(s): namePrefix | +| `tenants` | `plain` | true | `flux-system` | 1/1/0 | none | -## 15-mixed-and-hostile +## 3-expanded/flux-resourceset-pull-requests -Reported result: **Partial**. Accepted `3`, refused `2`. -Unsupported constructs summary: `none`. Fleet root: `false`. +Reported rc `0`. Accepted `1`, refused `0`. +Unsupported constructs: `none`. Fleet root: `false`. -| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons | |---|---|---|---|---|---| -| `.` | `kustomize-single` | false | `backend` | 0/0/6 | non-krm-yaml: ci/.gitlab-ci.yml: YAML is not a Kubernetes manifest; non-krm-yaml: ci/docker-compose.yml: YAML is not a Kubernetes manifest; foreign-file: empty-dir/.gitkeep: foreign file empty-dir/.gitkeep is not a managed manifest; remove it or name it in .gittargetignore; mixed-managed-allowlisted: kustomization.yaml: managed resource kustomize.toolkit.fluxcd.io/v1/Kustomization/flux-system/apps must not live in the allowlisted build-directive file kustomization.yaml; impure-managed-file: mixed/bundle.yaml: a file with managed resources may contain only valid KRM documents; document #1 is a non-KRM document; impure-managed-file: mixed/bundle.yaml: a file with managed resources may contain only valid KRM documents; document #2 is an empty document; foreign-file: mixed/deployment.json: foreign file mixed/deployment.json is not a managed manifest; remove it or name it in .gittargetignore; invalid-yaml: templates/deployment.yaml: invalid YAML: yaml: line 21: did not find expected key; non-krm-yaml: values.yaml: YAML is not a Kubernetes manifest | -| `crossplane` | `plain` | true | `` | 1/1/0 | none | -| `kro` | `plain` | true | `` | 1/1/0 | none | -| `mixed` | `plain` | false | `` | 3/3/2 | impure-managed-file: bundle.yaml: a file with managed resources may contain only valid KRM documents; document #1 is a non-KRM document; impure-managed-file: bundle.yaml: a file with managed resources may contain only valid KRM documents; document #2 is an empty document; foreign-file: deployment.json: foreign file deployment.json is not a managed manifest; remove it or name it in .gittargetignore | -| `secrets` | `plain` | true | `backend` | 1/1/0 | none | +| `previews` | `plain` | true | `flux-system` | 2/2/0 | none | -## 16-flux-image-automation +## 4-machine-written/flux-image-automation -Reported result: **All reported candidates accepted**. Accepted `3`, refused `0`. -Unsupported constructs summary: `none`. Fleet root: `false`. +Reported rc `0`. Accepted `3`, refused `0`. +Unsupported constructs: `none`. Fleet root: `false`. -| Candidate | Layout | Accepted today | Namespace | Resources rendered/editable/non-KRM | Refusal reasons | +| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons | |---|---|---|---|---|---| | `apps/frontend` | `kustomize-single` | true | `frontend` | 2/2/0 | none | | `clusters/production` | `kustomize-single` | true | `flux-system` | 2/2/0 | none | | `infrastructure/image-automation` | `kustomize-single` | true | `flux-system` | 3/3/0 | none | + +## 5-opaque/sops-encrypted + +Reported rc `0`. Accepted `3`, refused `0`. +Unsupported constructs: `none`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `apps/frontend` | `kustomize-single` | true | `frontend-production` | 2/2/0 | none | +| `clusters/production` | `plain` | true | `flux-system` | 2/2/0 | none | +| `infrastructure/secrets` | `kustomize-single` | true | `infrastructure` | 1/1/0 | none | + +## 6-hostile/mixed-and-hostile + +Reported rc `0`. Accepted `3`, refused `2`. +Unsupported constructs: `none`. Fleet root: `false`. + +| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons | +|---|---|---|---|---|---| +| `.` | `kustomize-single` | false | `backend` | 0/0/6 | non-krm-yaml: ci/.gitlab-ci.yml: YAML is not a Kubernetes manifest
non-krm-yaml: ci/docker-compose.yml: YAML is not a Kubernetes manifest
foreign-file: empty-dir/.gitkeep: foreign file empty-dir/.gitkeep is not a managed manifest; remove it or name it in .gittargetignore
mixed-managed-allowlisted: kustomization.yaml: managed resource kustomize.toolkit.fluxcd.io/v1/Kustomization/flux-system/apps must not live in the allowlisted build-directive file kustomization.yaml
impure-managed-file: mixed/bundle.yaml: a file with managed resources may contain only valid KRM documents; document #1 is a non-KRM document
impure-managed-file: mixed/bundle.yaml: a file with managed resources may contain only valid KRM documents; document #2 is an empty document
foreign-file: mixed/deployment.json: foreign file mixed/deployment.json is not a managed manifest; remove it or name it in .gittargetignore
invalid-yaml: templates/deployment.yaml: invalid YAML: yaml: line 21: did not find expected key
non-krm-yaml: values.yaml: YAML is not a Kubernetes manifest | +| `crossplane` | `plain` | true | `-` | 1/1/0 | none | +| `kro` | `plain` | true | `-` | 1/1/0 | none | +| `mixed` | `plain` | false | `-` | 3/3/2 | impure-managed-file: bundle.yaml: a file with managed resources may contain only valid KRM documents; document #1 is a non-KRM document
impure-managed-file: bundle.yaml: a file with managed resources may contain only valid KRM documents; document #2 is an empty document
foreign-file: deployment.json: foreign file deployment.json is not a managed manifest; remove it or name it in .gittargetignore | +| `secrets` | `plain` | true | `backend` | 1/1/0 | none | From 63bbcf4c233ba7d2148cda253e40912eaef6669a Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Mon, 13 Jul 2026 12:56:58 +0000 Subject: [PATCH 17/28] fix(doccheck): check YAML and shell citations, and stop fingerprinting the check doccheck read Markdown links and Go comments, but nothing looked at the docs/**.md paths cited in Taskfiles, CI workflows, chart values and hack scripts. A docs reorg left eight of them dangling and the tool reported success. It now scans those too (510 YAML/shell files), and skips docs paths that are the tail of a URL -- those name a rendered page, not a file in this repo. That URL guard fixes a live bug on the Go surface as well: a comment linking to the published docs was reported as a dangling repo-relative path. doccheck's own package doc contains such a link, and it reported itself as broken. lint-docs also loses its `sources:` and now always runs. Its real input is "every git-tracked .md, .go, .yml, .yaml and .sh", which Task cannot express, and both approximations failed: an unrooted '**/*.go' walks external-sources/ and OOM-kills the host (and `exclude:` does not help -- Task expands the glob before filtering), while a hand-maintained per-tree list silently drifts out of sync with the file types doccheck scans, and a stale "up to date" means the check never runs. The whole check takes 0.2s, which is not worth a cache that can be wrong. Co-Authored-By: Claude Opus 4.8 (1M context) --- Taskfile-build.yml | 35 +++++++------------ hack/doccheck/main.go | 70 +++++++++++++++++++++++++++++++++++--- hack/doccheck/main_test.go | 58 +++++++++++++++++++++++++++++++ 3 files changed, 136 insertions(+), 27 deletions(-) diff --git a/Taskfile-build.yml b/Taskfile-build.yml index be555d53..0a74af26 100644 --- a/Taskfile-build.yml +++ b/Taskfile-build.yml @@ -213,28 +213,19 @@ tasks: # from markdown -- they never look inside a Go comment for a repo-relative doc path. # Those are the references that rot silently, and seventeen of them were dangling # before this check was written. - # These globs are scoped per top-level tree on purpose. An unrooted '**/*.go' - # makes Task walk every path under the repo root -- including the 1.2 GB of - # upstream checkouts in external-sources/ and the build output in bin/ -- and - # fingerprinting that tree costs tens of GB of RAM inside the Task process - # itself, which is enough to OOM the host. doccheck only ever reads git-tracked - # files (it shells out to `git ls-files`), so these mirror the trees that hold - # them. Add a tree here if tracked .md/.go ever lands outside these. - sources: - - '*.md' - - .devcontainer/**/*.md - - .github/**/*.md - - charts/**/*.md - - config/**/*.md - - docs/**/*.md - - internal/**/*.md - - test/**/*.md - - api/**/*.go - - cmd/**/*.go - - hack/**/*.go - - internal/**/*.go - - pkg/**/*.go - - test/**/*.go + # Deliberately un-fingerprinted: this task has no `sources:`, so it always runs. + # + # Its real input is "every git-tracked .md, .go, .yml, .yaml and .sh", which Task + # cannot express. Approximating it with globs went wrong twice. An unrooted + # '**/*.go' makes Task walk every path under the repo root -- including the 1.2 GB + # of upstream checkouts in external-sources/ -- and fingerprinting that costs tens + # of GB inside the Task process, enough to OOM the host. (`exclude:` does not help: + # Task expands the glob first and filters afterwards, so the walk still happens.) + # A hand-maintained per-tree list avoids that, but then silently drifts out of sync + # with the file types doccheck scans, and a stale "up to date" means the check + # never runs -- which is how a non-compiling file reached a commit here once. + # + # The whole check takes ~0.2s. That is not worth a cache that can be wrong. cmds: - go run ./hack/doccheck diff --git a/hack/doccheck/main.go b/hack/doccheck/main.go index b0c71363..84d8a11f 100644 --- a/hack/doccheck/main.go +++ b/hack/doccheck/main.go @@ -3,7 +3,7 @@ // Command doccheck verifies that every documentation reference in the repository // resolves to a file that exists. // -// It checks two surfaces that nothing off-the-shelf covers together: +// It checks three surfaces that nothing off-the-shelf covers together: // // 1. Relative links in Markdown — `[text](../spec/foo.md)`, including links that // point at source files. External URLs and pure `#anchor` links are skipped. @@ -14,11 +14,21 @@ // comment keeps pointing at the old path, and nothing notices. Seventeen of // them were dangling before this check existed. // +// 3. The same repo-relative paths cited in **YAML and shell** — Taskfiles, CI +// workflows, chart values, hack scripts. This surface was added after a docs +// reorg left eight of them dangling: the Markdown and Go citations had all been +// repointed, and nothing was looking at the Taskfiles. +// // The Go side parses the AST and reads only comments, never string literals. That // distinction matters: the gittargetignore tests build in-memory filesystems whose // entries are named like documentation paths. Those are fixtures, not citations. A // regex cannot tell the two apart; the parser can. // +// YAML and shell have no comparable parser worth carrying, so they are scanned as +// plain text. The one distinction that must be made there is a docs path in a URL +// (`https://github.com/…/docs/spec/foo.md`), which names a rendered page rather +// than a repo-relative file; those are skipped. +// // Only git-tracked files are scanned, so gitignored scratch notes and the local // upstream checkouts under external-sources/ are out of scope for free. // @@ -79,7 +89,7 @@ func main() { } var findings []finding - var mdFiles, goFiles int + var mdFiles, goFiles, textFiles int for _, name := range tracked { path := filepath.Join(abs, name) @@ -90,6 +100,12 @@ func main() { case strings.HasSuffix(name, ".go"): goFiles++ findings = append(findings, checkGoComments(abs, path)...) + case strings.HasSuffix(name, ".yml"), strings.HasSuffix(name, ".yaml"): + textFiles++ + findings = append(findings, checkTextCitations(abs, path, "yaml")...) + case strings.HasSuffix(name, ".sh"): + textFiles++ + findings = append(findings, checkTextCitations(abs, path, "shell")...) } } @@ -101,8 +117,8 @@ func main() { }) if len(findings) == 0 { - fmt.Printf("doccheck: OK — %d markdown files, %d Go files, every reference resolves\n", - mdFiles, goFiles) + fmt.Printf("doccheck: OK — %d markdown files, %d Go files, %d YAML/shell files, "+ + "every reference resolves\n", mdFiles, goFiles, textFiles) return } @@ -182,7 +198,7 @@ func checkGoComments(root, path string) []finding { var out []finding for _, group := range file.Comments { for _, c := range group.List { - for _, target := range docPath.FindAllString(c.Text, -1) { + for _, target := range citationsIn(c.Text) { if _, err := os.Stat(filepath.Join(root, target)); err != nil { out = append(out, finding{ file: rel(root, path), @@ -197,6 +213,50 @@ func checkGoComments(root, path string) []finding { return out } +// urlPrefix matches a URL running right up to the end of the text before a match, +// i.e. the match is the tail of that URL rather than a repo-relative path. +var urlPrefix = regexp.MustCompile(`https?://\S*$`) + +// citationsIn returns the docs/**.md paths cited in text, skipping any that are the +// tail of a URL. `https://github.com/…/docs/spec/foo.md` names a rendered page on a +// website; only a bare repo-relative path is ours to resolve. Both the Go and the +// YAML/shell surfaces need this, so it lives here rather than in either of them. +func citationsIn(text string) []string { + var out []string + for _, loc := range docPath.FindAllStringIndex(text, -1) { + if urlPrefix.MatchString(text[:loc[0]]) { + continue + } + out = append(out, text[loc[0]:loc[1]]) + } + return out +} + +// checkTextCitations resolves docs/**.md citations in a file with no parser worth +// carrying — YAML and shell, where these paths live in comments. kind names the +// surface so the report says which one broke. +func checkTextCitations(root, path, kind string) []finding { + data, err := os.ReadFile(path) + if err != nil { + return nil + } + + var out []finding + for i, line := range strings.Split(string(data), "\n") { + for _, target := range citationsIn(line) { + if _, err := os.Stat(filepath.Join(root, target)); err != nil { + out = append(out, finding{ + file: rel(root, path), + line: i + 1, + target: target, + kind: kind, + }) + } + } + } + return out +} + func isExternal(target string) bool { return strings.HasPrefix(target, "http://") || strings.HasPrefix(target, "https://") || diff --git a/hack/doccheck/main_test.go b/hack/doccheck/main_test.go index 131c1d46..3e5d516b 100644 --- a/hack/doccheck/main_test.go +++ b/hack/doccheck/main_test.go @@ -140,6 +140,22 @@ func doThing() string { } } +// A Go comment linking to the published docs site is not a repo-relative citation. +// doccheck's own package doc contains such a URL, and reported itself as broken. +func TestCheckGoComments_IgnoresDocsPathsInsideURLs(t *testing.T) { + root := t.TempDir() + src := write(t, root, "pkg/thing.go", `// Package thing is described at +// https://github.com/ConfigButler/gitops-reverser/blob/main/docs/spec/gone.md +// and its contract is docs/spec/gone.md. +package thing +`) + + got := targets(checkGoComments(root, src)) + if len(got) != 1 || got[0] != "docs/spec/gone.md" { + t.Errorf("the URL must not be reported and the bare citation must be; got %v", got) + } +} + func TestCheckGoComments_UnparseableFileIsNotAFinding(t *testing.T) { root := t.TempDir() src := write(t, root, "broken.go", "this is not go source at all, and cites docs/spec/missing.md\n") @@ -149,6 +165,48 @@ func TestCheckGoComments_UnparseableFileIsNotAFinding(t *testing.T) { } } +// The surface that was missing: a docs reorg repointed every Markdown link and Go +// comment, and left eight citations dangling in Taskfiles, workflows and scripts. +func TestCheckTextCitations_ResolvesYAMLAndShellCitations(t *testing.T) { + root := t.TempDir() + write(t, root, "docs/spec/real.md", "# real\n") + + yml := write(t, root, "Taskfile.yml", `version: '3' +tasks: + build: + # The contract lives in docs/spec/real.md. + # This one moved: docs/design/moved.md + cmds: + - echo docs/spec/also-missing.md +`) + + got := targets(checkTextCitations(root, yml, "yaml")) + want := []string{"docs/design/moved.md", "docs/spec/also-missing.md"} + if len(got) != len(want) { + t.Fatalf("want %v, got %v", want, got) + } + for i, target := range got { + if target != want[i] { + t.Errorf("finding %d: want %q, got %q", i, want[i], target) + } + } +} + +// A docs path at the tail of a URL is a rendered page, not a file in this repo. +// Without this, every link to the published docs would be reported as dangling. +func TestCheckTextCitations_IgnoresDocsPathsInsideURLs(t *testing.T) { + root := t.TempDir() + sh := write(t, root, "hack/thing.sh", `#!/usr/bin/env bash +# See https://github.com/ConfigButler/gitops-reverser/blob/main/docs/spec/gone.md +# but this one is a real citation: docs/spec/gone.md +`) + + got := targets(checkTextCitations(root, sh, "shell")) + if len(got) != 1 || got[0] != "docs/spec/gone.md" { + t.Errorf("the URL must not be reported and the bare path must be; got %v", got) + } +} + func TestTrackedFiles_ListsGitTrackedFilesOnly(t *testing.T) { root := t.TempDir() write(t, root, "tracked.md", "# tracked\n") From 7a6ebb885884f8d75336ba03a01de681a7cb8084 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Tue, 14 Jul 2026 04:41:01 +0000 Subject: [PATCH 18/28] docs: keep the support boundary public, take the product roadmap private MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The design folder was named docs/design/gitops-api/ — after a separate, private product repo — and it had grown into that repo's roadmap living inside the public operator. Three docs described the product, not the operator, and the feature ladder (F1-F8, launch scope, delivery order) told anyone reading the OSS project where the commercial layer was going. The line drawn here: the operator publishes what it will and will not write, because that is the contract it owes its users and it announces that boundary at runtime anyway. It does not publish where it is going. - Moved to the private repo: the-layer-above-and-the-expansion-graph, intent-cluster-hydration, and §8-§10 of the kustomize doc (mirror/intent mode, the three arrows, the ladder). The invertibility taxonomy, layout allowlist and fan-in invariant stay public. - Renamed docs/design/gitops-api/ -> docs/design/support-boundary/, and rewrote the README from "editing GitOps folders as a product surface" into an index of the boundary. - Scrubbed the ladder and product-layer vocabulary from the docs that stay. The refusal reasons, the corpus taxonomy, the write boundary, and every piece of test evidence are untouched — that content is the point. - The ladder had leaked into runtime output: the exported ReasonOverlayFanOutNeedsF2 made the CLI tell users "overlay-fan-out-needs-f2 / render-root scoping (F2) required", naming a roadmap item they cannot see. Renamed to ReasonOverlayFanOutUnsupported. No consumer imports the package yet. - CI now regenerates the GitOps layout baseline and fails on a diff, so a change to the acceptance boundary shows up in review as exactly which fixtures moved. Without it the corpus was evidence of nothing. e2e labels (f4-placement, f7-higher-level-krm) are deliberately left alone: CI shards on them and a test label leaks no roadmap. task lint, task test (54 specs) and task test-e2e (54 passed, 0 failed) all pass. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci.yml | 30 ++ cmd/manifest-analyzer/main.go | 2 +- cmd/manifest-analyzer/main_test.go | 2 +- docs/INDEX.md | 29 +- docs/architecture.md | 2 +- docs/bi-directional.md | 4 +- docs/configuration.md | 2 +- docs/design/gitops-api/README.md | 199 -------- .../gitops-api/intent-cluster-hydration.md | 368 -------------- ...mize-support-boundary-and-product-model.md | 471 ------------------ ...the-layer-above-and-the-expansion-graph.md | 297 ----------- docs/design/support-boundary/README.md | 180 +++++++ .../argocd-bi-directional.md | 0 ...ansion-boundary-and-corpus-organisation.md | 122 ++--- .../finished/higher-level-krm-documents.md} | 60 +-- .../images-and-replicas-edit-through.md} | 36 +- ...granularity-and-cross-environment-edits.md | 215 ++++---- .../kustomize-support-boundary.md | 291 +++++++++++ .../orchestrator-knowledge-boundary.md | 72 +-- .../repo-discovery-and-onboarding-scan.md} | 165 +++--- .../resource-capability-model.md | 3 +- .../sealed-secrets-and-external-secrets.md | 51 +- .../support-contract.md | 23 +- .../unreflectable-edits-and-write-gating.md | 206 ++++---- .../write-only-encrypted-secrets.md | 37 +- docs/facts/expansion-provenance-markers.md | 6 +- docs/finished/documentation-triage.md | 12 +- docs/future/idea-application-editing.md | 7 +- docs/installing-apps-as-krm.md | 2 +- docs/spec/README.md | 2 +- docs/spec/e2e-bi-directional-corner.md | 15 +- .../gittarget-new-file-placement-rules.md | 6 +- docs/spec/manifest-system.md | 6 +- hack/gitops-layouts-baseline.sh | 6 +- internal/controller/gittarget_controller.go | 2 +- .../gittarget_placement_validation.go | 2 +- internal/git/inplace_overrides_test.go | 4 +- internal/git/manifestedit/kustomization.go | 8 +- internal/git/placement_test.go | 2 +- internal/git/plan_flush.go | 17 +- internal/git/resync_flush_test.go | 2 +- internal/git/types.go | 4 +- .../git/write_boundary_precondition_test.go | 2 +- internal/manifestanalyzer/acceptance.go | 4 +- internal/manifestanalyzer/overrides.go | 4 +- .../manifestanalyzer/overrides_projection.go | 5 +- .../overrides_projection_test.go | 2 +- internal/manifestanalyzer/overrides_test.go | 2 +- internal/manifestanalyzer/placement.go | 8 +- internal/manifestanalyzer/scan_repo.go | 34 +- internal/manifestanalyzer/scan_repo_test.go | 8 +- internal/manifestanalyzer/store.go | 8 +- .../testdata/contextual-namespace/README.md | 4 +- .../unsupported/base-overlays.golden.json | 12 +- .../overlay-nested-base.golden.json | 4 +- .../overlay-parked-base.golden.json | 4 +- pkg/manifestanalyzer/repo.go | 4 +- pkg/manifestanalyzer/repo_test.go | 2 +- test/e2e/argocd_bi_directional_e2e_test.go | 4 +- test/e2e/f4_placement_e2e_test.go | 2 +- test/e2e/helmrelease_mirror_edit_e2e_test.go | 2 +- .../flux-resourceset-pull-requests/README.md | 6 +- test/fixtures/gitops-layouts/README.md | 6 +- test/fixtures/gitops-layouts/support-today.md | 4 +- 64 files changed, 1134 insertions(+), 1967 deletions(-) delete mode 100644 docs/design/gitops-api/README.md delete mode 100644 docs/design/gitops-api/intent-cluster-hydration.md delete mode 100644 docs/design/gitops-api/kustomize-support-boundary-and-product-model.md delete mode 100644 docs/design/gitops-api/the-layer-above-and-the-expansion-graph.md create mode 100644 docs/design/support-boundary/README.md rename docs/design/{gitops-api => support-boundary}/argocd-bi-directional.md (100%) rename docs/design/{gitops-api => support-boundary}/expansion-boundary-and-corpus-organisation.md (88%) rename docs/design/{gitops-api/finished/f7-higher-level-krm-documents.md => support-boundary/finished/higher-level-krm-documents.md} (79%) rename docs/design/{gitops-api/finished/f1-images-replicas-edit-through.md => support-boundary/finished/images-and-replicas-edit-through.md} (88%) rename docs/design/{gitops-api => support-boundary}/gittarget-granularity-and-cross-environment-edits.md (76%) create mode 100644 docs/design/support-boundary/kustomize-support-boundary.md rename docs/design/{gitops-api => support-boundary}/orchestrator-knowledge-boundary.md (87%) rename docs/design/{gitops-api/f8-repo-discovery-and-onboarding-scan.md => support-boundary/repo-discovery-and-onboarding-scan.md} (74%) rename docs/design/{gitops-api => support-boundary}/resource-capability-model.md (98%) rename docs/design/{gitops-api => support-boundary}/sealed-secrets-and-external-secrets.md (87%) rename docs/design/{gitops-api => support-boundary}/support-contract.md (86%) rename docs/design/{gitops-api => support-boundary}/unreflectable-edits-and-write-gating.md (52%) rename docs/design/{gitops-api => support-boundary}/write-only-encrypted-secrets.md (93%) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 11329e37..7ac0ffcf 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -519,6 +519,36 @@ jobs: fi ' + - name: GitOps layout baseline is current + # test/fixtures/gitops-layouts/support-today.md is generated from a live + # manifest-analyzer scan of the corpus. Regenerating it here and failing on a + # diff is what makes a change to the acceptance boundary show up in review as + # "exactly which fixtures moved, and in which direction". Without this check the + # baseline silently goes stale, and the corpus stops being evidence of anything. + # + # A failure is not necessarily a bug: if the boundary moved on purpose, run + # `task gitops-layouts-baseline` and commit the regenerated file. Review the diff. + # + # Kept out of `task lint` deliberately: the lint step above asserts that a second + # dry-run is fully cached, and this task's fingerprint would have to be threaded + # through that assertion for no benefit. + run: | + docker run --rm \ + -v "${GITHUB_WORKSPACE}:${{ env.CI_WORKDIR }}" \ + -w "${{ env.CI_WORKDIR }}" \ + "${CI_CONTAINER}" \ + bash -lc ' + set -e + git config --global --add safe.directory "$PWD" + task gitops-layouts-baseline --force + if ! git diff --quiet -- test/fixtures/gitops-layouts/support-today.md; then + echo "::error file=test/fixtures/gitops-layouts/support-today.md::The GitOps layout baseline is stale: the analyzer now reports something different for the corpus. If the acceptance boundary moved on purpose, run `task gitops-layouts-baseline` and commit the result." + git --no-pager diff -- test/fixtures/gitops-layouts/support-today.md + exit 1 + fi + echo "baseline is current" + ' + test: name: Unit tests runs-on: ubuntu-latest diff --git a/cmd/manifest-analyzer/main.go b/cmd/manifest-analyzer/main.go index 740d634d..68aeb2fc 100644 --- a/cmd/manifest-analyzer/main.go +++ b/cmd/manifest-analyzer/main.go @@ -277,7 +277,7 @@ func scanExitCode(policy string, accepted bool) int { return exitOK } -// runScanRepo runs the F8 whole-repo onboarding scan: walk every folder, enumerate +// runScanRepo runs the whole-repo onboarding scan: walk every folder, enumerate // candidate GitTarget subtrees, classify each one's layout and acceptance, and emit the // report. It is read-only and needs no cluster. Exit codes stay simple for this cut // (exitOK, or exitUsage on an I/O error); the repo-level --policy refuse gate is diff --git a/cmd/manifest-analyzer/main_test.go b/cmd/manifest-analyzer/main_test.go index 868b939c..26484788 100644 --- a/cmd/manifest-analyzer/main_test.go +++ b/cmd/manifest-analyzer/main_test.go @@ -167,7 +167,7 @@ func TestRun_ScanRepoText(t *testing.T) { if code := run([]string{"--mode", "scan-repo", scanRepoFixture(t)}, &out, &errBuf); code != 0 { t.Fatalf("exit = %d, want 0 (stderr=%s)", code, errBuf.String()) } - for _, want := range []string{"candidates:", "kustomize-overlay", "overlay-fan-out-needs-f2"} { + for _, want := range []string{"candidates:", "kustomize-overlay", "overlay-fan-out-unsupported"} { if !strings.Contains(out.String(), want) { t.Errorf("scan-repo text missing %q:\n%s", want, out.String()) } diff --git a/docs/INDEX.md b/docs/INDEX.md index a3ac1c4c..d57709bf 100644 --- a/docs/INDEX.md +++ b/docs/INDEX.md @@ -11,7 +11,7 @@ those. If a document is not on this page, it is either a user guide (see | Folder | Means | Binds? | |---|---|---| | [`spec/`](spec/) | **This is true now, and the code depends on it.** Most are cited by path from Go source. Change the behaviour, change the doc. | **yes** | -| [`design/`](design/) | **We are still deciding.** Open questions, proposals, unbuilt work. | yes — it is the roadmap | +| [`design/`](design/) | **We are still deciding.** Open questions, proposals, unbuilt work. | yes — as intent, not as shipped behaviour | | [`facts/`](facts/) | Durable reference: how Kubernetes behaves, and what we discovered about it. | yes, as reference | | [`finished/`](finished/) | **This happened.** Shipped plans, closed investigations. Kept for context. | **no** | @@ -21,14 +21,14 @@ folder by **lifecycle**, not by topic. ## If you are new: read these five -1. [`../README.md`](../README.md) — what the product does. +1. [`../README.md`](../README.md) — what the operator does. 2. [`architecture.md`](architecture.md) — how the operator is put together. 3. [`spec/manifest-system.md`](spec/manifest-system.md) — **how a live object becomes a line in a Git file.** The single best explanation of the core. 4. [`spec/current-manifest-support-review.md`](spec/current-manifest-support-review.md) — the manifest store's contract, and the rules that must never break. -5. [`design/gitops-api/README.md`](design/gitops-api/README.md) — what is being - built now, and the feature ladder. +5. [`design/support-boundary/support-contract.md`](design/support-boundary/support-contract.md) + — **what the operator edits, what it refuses, and why.** ## The contracts — [`spec/`](spec/) @@ -43,7 +43,7 @@ misled. Full list in [`spec/README.md`](spec/README.md); the ones that carry a | [`manifestedit-field-ownership-spike.md`](spec/manifestedit-field-ownership-spike.md) | the API wins — full-object ownership, never field-subset | | [`reconcile-via-watchlist-mark-and-sweep.md`](spec/reconcile-via-watchlist-mark-and-sweep.md) | **no bookmark, no sweep** | | [`contextual-namespace-and-kustomize-folder-editing.md`](spec/contextual-namespace-and-kustomize-folder-editing.md) | kustomize namespace inference; the supported subset | -| [`gittarget-new-file-placement-rules.md`](spec/gittarget-new-file-placement-rules.md) | where a new resource's file goes (F4) | +| [`gittarget-new-file-placement-rules.md`](spec/gittarget-new-file-placement-rules.md) | where a new resource's file goes | | [`sops-single-file-no-multidoc.md`](spec/sops-single-file-no-multidoc.md) | one encrypted file is one document | | [`scale-subresource-audit-rehydration.md`](spec/scale-subresource-audit-rehydration.md) | `/scale` only; every other subresource ignored | | [`commit-window-refactor.md`](spec/commit-window-refactor.md) | one grouped commit = one (author, GitTarget) | @@ -58,14 +58,13 @@ misled. Full list in [`spec/README.md`](spec/README.md); the ones that carry a ## What is being decided now — [`design/`](design/) -**The live workstream** is [`design/gitops-api/`](design/gitops-api/) — editing -existing GitOps folders through the Kubernetes API. Start at its -[README](design/gitops-api/README.md) for the feature ladder (F1–F8), then -[`support-contract.md`](design/gitops-api/support-contract.md) — **the single page that -says what we support and refuse** — and -[`the-layer-above-and-the-expansion-graph.md`](design/gitops-api/the-layer-above-and-the-expansion-graph.md), -which draws the architecture the product is heading for (kcp + Flux + Argo CD above -this operator) and names the one question every layer must agree on. +**The live workstream** is [`design/support-boundary/`](design/support-boundary/) — editing +existing GitOps folders through the Kubernetes API. Start at +[`support-contract.md`](design/support-boundary/support-contract.md) — **the single page that +says what we support and refuse** — and then its +[README](design/support-boundary/README.md), which maps the rest of the folder: the +kustomize field taxonomy, the write boundary, the orchestrator/expansion line, and +how secrets are handled. Nine other open items: @@ -83,8 +82,8 @@ Nine other open items: ## Deferred, but still wanted — [`future/`](future/) -[`idea-application-editing.md`](future/idea-application-editing.md) is the product -seed of the whole gitops-api workstream and still holds the branch/session +[`idea-application-editing.md`](future/idea-application-editing.md) is where the +whole edit-through-the-API workstream started, and still holds the branch/session grouping strategies nothing else covers. [`ha-gittarget-distribution-plan.md`](future/ha-gittarget-distribution-plan.md) is the HA plan `architecture.md` cites three times (and the reason Redis is required). diff --git a/docs/architecture.md b/docs/architecture.md index a0376801..c414418a 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -910,7 +910,7 @@ hydrates only touched files into buffers for the commit, and flushes only change entry in the document's kustomization chain is written back to that entry (comment-preserving, only fields the entry already declares); the source manifest keeps its bytes. Anything the inversion cannot express falls back to the plain in-place patch. See - [gitops-api/finished/f1-images-replicas-edit-through.md](design/gitops-api/finished/f1-images-replicas-edit-through.md). + [gitops-api/finished/images-and-replicas-edit-through.md](design/support-boundary/finished/images-and-replicas-edit-through.md). * **Deletes:** use the manifest identity index, so a moved manifest can still be deleted even when it is not at the canonical path. * **Field patches** (currently `/scale` → parent `spec.replicas`) are intentionally narrow: they only diff --git a/docs/bi-directional.md b/docs/bi-directional.md index f03ade75..8ce497f1 100644 --- a/docs/bi-directional.md +++ b/docs/bi-directional.md @@ -159,7 +159,7 @@ that field silently stops applying too. That is [split ownership](#recommended-m (mode 3), a legitimate but *different* mode — not the shared, both-ways behaviour this guide is about. The full reasoning — including why PreSync hooks and self-heal timers can't rescue it either — is in -[`design/gitops-api/argocd-bi-directional.md`](design/gitops-api/argocd-bi-directional.md). +[`design/support-boundary/argocd-bi-directional.md`](design/support-boundary/argocd-bi-directional.md). ## Practical Platform Guidance @@ -247,5 +247,5 @@ with `task argocd-ui`): Design detail: - [`design/e2e-bi-directional-corner.md`](spec/e2e-bi-directional-corner.md) — the corner -- [`design/gitops-api/argocd-bi-directional.md`](design/gitops-api/argocd-bi-directional.md) — why `selfHeal` is opposed to bi-directional +- [`design/support-boundary/argocd-bi-directional.md`](design/support-boundary/argocd-bi-directional.md) — why `selfHeal` is opposed to bi-directional - [`design/gittarget-lifecycle-and-repo-architecture.md`](architecture.md) — controller and repo lifecycle diff --git a/docs/configuration.md b/docs/configuration.md index 85d7106c..077331d0 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -542,7 +542,7 @@ entry). These fallbacks are recorded as store diagnostics — visible in the ana the running operator, in the logs at debug verbosity (`manifest store diagnostic`). For design details and the exact boundary, see -[design/gitops-api/finished/f1-images-replicas-edit-through.md](design/gitops-api/finished/f1-images-replicas-edit-through.md). +[design/support-boundary/finished/images-and-replicas-edit-through.md](design/support-boundary/finished/images-and-replicas-edit-through.md). ## `WatchRule` diff --git a/docs/design/gitops-api/README.md b/docs/design/gitops-api/README.md deleted file mode 100644 index 6ac3366d..00000000 --- a/docs/design/gitops-api/README.md +++ /dev/null @@ -1,199 +0,0 @@ -# GitOps API: editing existing GitOps folders as a product surface - -> **design** — the active workstream. Captured 2026-07-06. -> -> **New here? Read [support-contract.md](support-contract.md) first** — it is the one -> page that says what we support, what we refuse, and why. This README is the *plan* -> (the feature ladder); that one is the *boundary*. - -## The folder, by topic - -| Topic | Docs | -|---|---| -| **The boundary** | [support-contract.md](support-contract.md) — the single statement · [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md) — field taxonomy + layout allowlist · [gittarget-granularity-and-cross-environment-edits.md](gittarget-granularity-and-cross-environment-edits.md) — **the write boundary; the one home of fan-in = 1** | -| **Architecture** | [the-layer-above-and-the-expansion-graph.md](the-layer-above-and-the-expansion-graph.md) — **the stack (kcp + Flux + Argo CD above this operator), the expansion graph, and what kcp does and does not solve** | -| **Orchestrators & expansion** | [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md) — renderability vs ownership; claims about paths · [expansion-boundary-and-corpus-organisation.md](expansion-boundary-and-corpus-organisation.md) — provenance; ApplicationSet vs ResourceSet; Helm · [`../../facts/expansion-provenance-markers.md`](../../facts/expansion-provenance-markers.md) — **the measured markers** · [argocd-bi-directional.md](argocd-bi-directional.md) — why `selfHeal` is incompatible | -| **Documents & secrets** | [resource-capability-model.md](resource-capability-model.md) — what may I do to this document · [write-only-encrypted-secrets.md](write-only-encrypted-secrets.md) — SOPS · [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md) | -| **Topology** | [intent-cluster-hydration.md](intent-cluster-hydration.md) — how objects get into the cluster to be edited | -| **Edits with no home** | [unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md) | -| **Onboarding** | [f8-repo-discovery-and-onboarding-scan.md](f8-repo-discovery-and-onboarding-scan.md) | -| **Shipped** | [finished/f1-images-replicas-edit-through.md](finished/f1-images-replicas-edit-through.md) · [finished/f7-higher-level-krm-documents.md](finished/f7-higher-level-krm-documents.md) | -| **Evidence** | [`test/fixtures/gitops-layouts/`](../../../test/fixtures/gitops-layouts/) — the corpus of real-world repo shapes | -| **Origin** | [../../future/idea-application-editing.md](../../future/idea-application-editing.md) — the product seed | -| **Foundations** | [current-manifest-support-review.md](../../spec/current-manifest-support-review.md) · [contextual-namespace-and-kustomize-folder-editing.md](../../spec/contextual-namespace-and-kustomize-folder-editing.md) · [gittarget-new-file-placement-rules.md](../../spec/gittarget-new-file-placement-rules.md) | - -## Goal - -Enable a product layer on top of GitOps Reverser where an end user points the -operator at a Git folder holding **Kubernetes Resource Model (KRM) documents** -— core resources, custom resources, simple Kustomize folders, and higher-level -control-plane objects such as Flux `HelmRelease`, Argo CD `Application`, or -KRO resources — edits those resources through the Kubernetes API, and the -operator writes the changes to a branch. The product layer then opens the pull -request through the Git host's API. - -The division of responsibility is deliberate and already a recorded decision -([file-agnostic-placement.md](../../spec/gittarget-new-file-placement-rules.md)): - -- **GitOps Reverser**: watch live state, edit the folder the way a careful - human would (in place, comment-preserving, refusing what it cannot own), - push to a named branch, and expose pollable status (`CommitRequest` - `Pushed=True` + `status.sha` + `status.branch`). -- **Product layer**: session/branch lifecycle policy, PR creation and merge, - branch cleanup, and any UI. -- **Onboarding (CLI / library)**: repo-wide discovery — enumerate candidate - `GitTarget`s, classify each folder's layout, report supported-vs-refused with - reasons, and propose the CRs — built on the shared analyzer engine, writing - nothing. See - [f8-repo-discovery-and-onboarding-scan.md](f8-repo-discovery-and-onboarding-scan.md). - -The operator never gains Git-host knowledge (no GitHub/GitLab API calls). - -## The governing rule - -Every feature in this workstream must keep the repository **round-trippable**: -every edit the operator writes has exactly one writable destination in Git, -and the result must be expressible in both directions (live → Git and Git → -live via the GitOps tool's render). Source documents that are shared by more -than one render root are read-only context; lossy or one-way constructs -(arbitrary patches, generators with hash suffixes, name prefixes, Helm -inflation) stay refused. That refusal is the product's defensible support -contract, not a gap. - -## Launch use cases and the practical path - -The product launches on the things non-Git-experts and busy platform engineers -do every day, not on the hardest repository shapes: - -1. **"Add something to the test environment"** — a test deployment, a test - database, an extra tool, or a product-specific abstraction. In KRM terms - this is adding ordinary documents: a `Deployment`, a Flux `HelmRelease` - plus its source, an Argo CD `Application`, or a KRO resource. In an - explicit Kustomize environment folder, the operator must also add the file - to that overlay's `resources:`. -2. **"Roll out a new version of an installation"** — bump an image tag - (F1's `images:` entry, or a plain in-place edit), a chart version on a - Flux `HelmRelease`, a revision on an Argo CD `Application`, or any other - version field on an ordinary KRM document. -3. **"Change the boring knobs without learning the repo"** — replicas, values - held in a CR spec, simple ConfigMap data, or other fields on documents the - environment owns directly. Fields owned by a shared base are explicitly - deferred to F3 patch authoring or a normal Git PR. - -Two consequences shape the plan: - -**Higher-level products come into scope as KRM, not as special cases.** -"No Helm" stays true for *inflation*: `helmCharts` remains refused and we -never render a chart. But a Flux `HelmRelease`, Argo CD `Application`, KRO -resource, or plain `Deployment` is a KRM document. Editing KRM documents is -the product surface; Flux, Argo, KRO, and core Kubernetes are examples of -controllers whose intent can be expressed that way. - -**Both standard layouts are on the launch path — scoped to these use -cases.** The day-to-day repertoire is whole-document adds plus governed -version bumps, and that slice is expressible in *both* shapes people -actually have in their GitOps repos: - -- **One plain folder per environment** (no shared base; no explicit - `kustomization.yaml` required — many GitOps tools can apply a directory of - KRM documents directly). Adding a file to test is just - adding a file; promotion is a product-level copy/diff between sibling - folders. Fully supported today. - - ```text - apps/podinfo/ - ├── test/ # one GitTarget per environment; - │ ├── deployment.yaml # core KRM is intent too - │ ├── helmrelease-postgres.yaml # Flux example - │ └── application-observability.yaml # Argo CD example - ├── acceptance/ - └── production/ - ``` - -- **Base + environment overlays, kept un-fancy** — day-one support, and the - reference layout in - [kustomize-support-boundary-and-product-model.md §6](kustomize-support-boundary-and-product-model.md): - each overlay sets `namespace:` and uses only - `resources`/`images`/`replicas`. This needs **F2** (render-root scoping): - use case 1 lands as an overlay-local file + `resources:` entry, use case 2 - as the overlay's `images:` entry or an overlay-local KRM document edit. - The base is read-only, always. - -The scoping move that keeps this launchable: **F2 + F4 are day-one -Kustomize support; F3 is the deferred hard part.** Adding overlay-local KRM -and bumping governed versions do not need patch authoring. A per-environment -edit of a base-owned *field* (the `kubectl set env` case) has no destination -until F3. Today such an edit is *prevented* — the write-boundary preconditions -refuse it and fail the GitTarget (`WriteBoundaryRefused`), so it is never written -into the base. Turning that target-level refusal into a per-edit report, -reverted by hydration and never silently lost, is the **designed but unbuilt** -unreflected-set accounting -([unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md)), -a launch prerequisite. Tier-2 metrics on how often users hit that wall are -exactly what prices F3. - -## Feature ladder - -Ordered by delivery priority for the launch path above (F-numbers are stable -identifiers, not an ordering). Each feature gets its own design doc in this -folder when work starts; a shipped feature's doc moves to -[finished/](finished/). The cross-cutting scope decisions behind the ladder — the -kustomization field taxonomy, the supported-layout allowlist, who runs -kustomize, the multi-environment product model (promotion, "factor into -base"), and the mirror-mode vs. intent-cluster topology — live in -[kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md). - -| # | Feature | Design doc | Status | -|---|---------|-----------|--------| -| F1 | Kustomize `images:` / `replicas:` edit-through — a live change produced by an override entry is written back to that entry, never through into the source manifest | [finished/f1-images-replicas-edit-through.md](finished/f1-images-replicas-edit-through.md) | implemented ([#198](https://github.com/ConfigButler/gitops-reverser/pull/198)) | -| F7 | Higher-level KRM objects as first-class documents — corpus + e2e pinning that Flux `HelmRelease`/`Kustomization`, Argo CD `Application`, KRO resources, and core resources mirror and edit like any KRM document (they should already; F7 *proves* it), plus "install an app = add KRM" user docs | [finished/f7-higher-level-krm-documents.md](finished/f7-higher-level-krm-documents.md) | implemented (manifestedit corpus for HelmRelease/Application/KRO; HelmRelease mirror+edit e2e; [installing-apps-as-krm.md](../../installing-apps-as-krm.md) user docs) | -| F2 | Render-root scoping — a GitTarget declares its render root (e.g. `overlays/env1`); base files reached through `../../base` become read-only context, dissolving overlay fan-out ambiguity. Launch scope: overlay `images:`/`replicas:` entries + overlay-local documents, shipped **with** the per-edit `FullyReflected` accounting | — | not designed — **launch-critical** | -| F4 | New-file placement rules — sibling inference + `spec.placement` template so new resources land in the folder's convention, not the canonical REST path; includes creating the `resources:` entry when the target folder carries a kustomization | designed in [version2/gittarget-new-file-placement-rules.md](../../spec/gittarget-new-file-placement-rules.md) | implemented (v1: declared policy + sibling inference steps 1/2/4 + kustomize `resources:` entry; step 3 and ordered-rule Option A deferred) | -| F5 | Branch/session ergonomics — base-branch selection, opt-in remote branch cleanup, a GitTarget-level quiescence condition | — | not designed — **launch-critical** | -| F3 | Restricted patch authoring — write/update scalar-field strategic-merge patches in an overlay ("live drift lands in the environment's overlay"); turns the launch-time unreflected class (per-env edits of base-owned fields) into reflected edits | — | post-launch; priced by tier-2 metrics | -| F6 | Admission preflight gate — opt-in intent-cluster webhook rejecting edits that cannot be reflected into the folder (fail-open; the underlying per-edit `FullyReflected` accounting ships with the F2/F4 launch unit) | [unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md) | designed, unbuilt — value highest while F3 is absent | -| F8 | Repo discovery & onboarding scan (**CLI / product-layer**) — walk a whole repo, enumerate candidate `GitTarget`s, classify each folder's layout (plain / kustomize-single / kustomize-overlay / refused), report supported-vs-refused with reasons, and propose the CRs; the product layer (GitHub App) consumes the report to generate `GitTarget`s and open PRs. Built on the shared analyzer engine — **ships no operator code** | [f8-repo-discovery-and-onboarding-scan.md](f8-repo-discovery-and-onboarding-scan.md) | designed, unbuilt | - -## What already works (baseline, 2026-07-09) - -- Raw-YAML folders (explicit namespaces): in-place, comment-preserving edits; - match-first placement; mark-and-sweep resync. -- Single-context Kustomize folders (`namespace:` + `resources:`/`bases`, local - files and child-directory bases): graph-aware namespace inference; inherited - namespaces are kept out of the file bytes on write. -- Branch writing: `GitTarget.spec.branch` (immutable, glob-authorized via - `GitProvider.spec.allowedBranches`); `CommitRequest` as the per-save control - surface with terminal `Pushed=True` + SHA. -- Refusals: unsupported kustomize features, duplicate identities, impure or - foreign content — refuse-first, never mis-edit. -- The two-layer **write boundary**, enforced as write-plan preconditions before - any byte is written: **L1** — no write leaves `spec.path` (reads may, writes - never); **L2** — no in-place edit of a source file that more than one kustomize - render path reaches with override entries at stake (write-fan-in = 1). A - violation aborts the whole flush, commits nothing, and fails the GitTarget with - `GitPathAccepted=False` / reason `WriteBoundaryRefused` — on the live-event path - as well as on resync. Specified in - [gittarget-granularity-and-cross-environment-edits.md §1](gittarget-granularity-and-cross-environment-edits.md). - The refusal is target-level; the per-edit `FullyReflected` accounting that would - name each dropped edit is designed and unbuilt. -- Higher-level KRM documents (Flux `HelmRelease`, Argo CD `Application`, KRO - resources) mirror and edit exactly like core resources — the pipeline is - kind-agnostic, now pinned by F7's corpus + HelmRelease e2e - ([finished/f7-higher-level-krm-documents.md](finished/f7-higher-level-krm-documents.md)). - -## Known boundary (what stays refused) - -Classic base + per-env overlay repositories are refused today on two -independent gates: any overlay feature outside the supported subset -(`patches*`, generators, `components`, `namePrefix`/`nameSuffix`, Helm, remote -bases), and multi-root namespace fan-out over a shared base -(`ambiguous-namespace`). F1 does not change that boundary; F2/F4/F3 are the -features that would move it. - -F2+F4 move the *layout* half of this boundary **at launch**: un-fancy -base+overlay folders (per-overlay `namespace` + `resources`/`images`/ -`replicas`) become accepted, new overlay-local KRM can be added to -`resources:`, and the base stays read-only. The *feature* half stays: -`patches*` (until F3 authors its own), generators, `components`, name -prefixes, Helm rendering, and remote bases keep refusing the folder — that -refusal remains the support contract. diff --git a/docs/design/gitops-api/intent-cluster-hydration.md b/docs/design/gitops-api/intent-cluster-hydration.md deleted file mode 100644 index c3bc85dd..00000000 --- a/docs/design/gitops-api/intent-cluster-hydration.md +++ /dev/null @@ -1,368 +0,0 @@ -# Intent-cluster hydration: CRDs, never controllers - -> Status: direction-setting; answers "can Argo CD or Flux sync these into the -> intent cluster?", ships no code. -> Captured: 2026-07-10 -> Related: -> [../../bi-directional.md](../../bi-directional.md) — the operating models and the -> proven Flux handshake this doc builds on, -> [resource-capability-model.md](resource-capability-model.md), -> [write-only-encrypted-secrets.md](write-only-encrypted-secrets.md), -> [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md), -> [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md), -> [README.md](README.md) - -## The asymmetry nobody wrote down - -GitOps Reverser's whole design is one direction: **live → Git**. Watch the cluster, -edit the folder, push a branch. - -But the product's premise is that a user *edits Kubernetes objects*. Before they -can edit an object, that object has to **exist** in the intent cluster. Something -must run the other direction — **Git → live** — at least once. - -That direction is exactly what Argo CD and Flux do for a living, and the obvious -move is to point one of them at the repository. That move is **right**, with one -qualification that has already been designed, documented and proven in this -repository — and one that has not. - -## Ground one: an *autonomous* reconciler fights the user. A triggered one does not. - -Argo CD and Flux do not hydrate. They **reconcile**. Their value is that when live -state diverges from Git, they *put it back*. - -In an editing cluster, live state diverging from Git is not drift. **It is the -user's edit.** So a reconciler left to run on its own interval is a hazard, and -[`docs/bi-directional.md`](../../bi-directional.md) already names it exactly: the -problem is **causality, not YAML**. - -```mermaid -sequenceDiagram - actor User - participant K8s as Editing cluster - participant Recon as autonomous Flux or Argo CD - participant Rev as GitOps Reverser - participant Git - - Note over Recon: has applied revision A - User->>K8s: edit replicas 3 to 5 - Rev->>Git: commit revision B - Note over Recon: has not refreshed its source yet - Recon->>K8s: re-apply stale revision A - K8s-->>Rev: looks like another live change - Rev->>Git: commit again -``` - -Stale replay, extra commits, possible loops. The failure is a **race window** -between the commit and the reconciler's source refresh — not a fundamental -incompatibility. - -### The fix is an acknowledgment handshake, and it works - -`bi-directional.md` prescribes it: treat the GitOps controller as a **deliberately -triggered applier**. Publish the commit, trigger the applier, and wait until it -reports that it applied *that exact revision*. - -GitOps Reverser already exposes the primitive the handshake needs — a -`CommitRequest` reaching `Pushed=True` with `status.sha` and `status.branch`. - -```mermaid -sequenceDiagram - actor User - participant K8s as Cluster - participant Rev as GitOps Reverser - participant Git - participant Flux - - User->>K8s: edit through the Kubernetes API - K8s-->>Rev: watch event - Rev->>Git: commit, push - Rev-->>K8s: CommitRequest Pushed=True, status.sha - Note over Flux: long interval. Not racing anybody. - Rev->>Flux: trigger source refresh, then reconcile - Flux->>Git: fetch the exact sha - Flux->>K8s: apply revision sha - Flux-->>Rev: Kustomization reports revision sha applied - Note over Rev: applied state equals committed state,
so nothing new to commit. The loop is closed. -``` - -This is not a proposal. `test/e2e/bi_directional_e2e_test.go` -runs it against real Flux with `prune: true`, and asserts the hard part — that -GitOps Reverser produces **exactly one commit** for a live edit and Flux converges -without a second one. It also covers a SOPS-encrypted `Secret` written by the -operator and reconciled by Flux, and a revert. The Flux `Kustomization` and -`GitRepository` both carry a `30m` interval, and the test drives -`flux reconcile source` / `flux reconcile kustomization` explicitly, then waits for -the expected SHA. That long interval *is* the discipline: it is what makes the -reconciler an applier rather than a competitor. - -So the rule is narrower and better than "no controllers": - -> **No *autonomous* reconciler on a shared path.** A reconciler driven by an -> acknowledgment handshake is not merely permitted — it is how the loop closes. - -Hydration is then simply the **degenerate case of that handshake**: apply revision -X into a cluster that holds nothing yet, and wait until it is reported applied. -Same operation, empty starting state. - -The genuinely open part is the second half of `bi-directional.md`'s status list: -the handshake is proven with Flux and **not yet with Argo CD**, which has no -`suspend` + `flux reconcile` equivalent — its analogue is a `Refresh` annotation -plus `syncPolicy.automated.selfHeal: false`, and nothing here has tested it. - -## Ground two: a SOPS Secret cannot be applied *without a decryption key* - -The user's instinct — *"SOPS is by default not a good KRM object, so will Flux -ignore it, or fail?"* — is right, and the answer is **fail**, deterministically, -whenever the applier cannot decrypt. - -Flux's answer, when it *is* the real cluster, is `spec.decryption` with the -private age identity, and that path is exercised in the bi-directional e2e above. -The question that matters here is what happens in a cluster that deliberately -holds **no** key. There, the document is applied as written — and it does not -survive contact with a real API server. - -> The evidence (a `kubectl apply --dry-run=server` matrix against Kubernetes -> v1.36) lives once, in -> [resource-capability-model.md § The evidence](resource-capability-model.md). -> It is not repeated here. - -Two of its rows drive everything below: - -- A `Secret` whose `data:` holds `ENC[AES256_GCM,...]` fails with - `illegal base64 data`, **even with validation disabled** — `data` is typed as - base64 bytes, so the failure happens at *deserialization*, before validation. No - lenient decoding rescues it, and every applier — `kubectl`, Argo CD, Flux's - kustomize-controller — hits the same wall. -- With validation disabled, a `stringData:` ciphertext **is created**, storing the - value as the literal text `ENC[AES256_GCM,...]`. An application then reads its - password as that string, and nothing errors anywhere. **Any hydrator must use - strict decoding.** - -### Flux is kinder than the API server, and says so - -Flux never reaches that base64 error, because kustomize-controller checks first. -Run against real Flux (kustomize-controller, `spec.decryption` unset, the -[fixture 13](../../../test/fixtures/gitops-layouts/5-opaque/sops-encrypted/) Secret plus -an ordinary `ConfigMap` in one folder): - -``` -Kustomization Ready=False - Secret/fluxsops/frontend-credentials is SOPS encrypted, - configuring decryption is required for this secret to be reconciled -``` - -Note that `kustomize build` itself is perfectly happy — it passes the document -through untouched, `sops:` stanza and all. The guard is kustomize-controller's, -and it is explicit. - -But the failure is **all-or-nothing**: the ordinary `ConfigMap` in the same folder -was *not* applied. Flux does not ignore the encrypted Secret and proceed. It -refuses the whole `Kustomization`. - -So the question becomes: can Flux be *told* to skip it? - -## Yes — and the mechanism depends on the folder layout - -Four attempts, all run against real Flux (v1 `Kustomization`, kustomize-controller, -no decryption key), on a folder holding one plain `ConfigMap` and one SOPS `Secret`: - -| Attempt | Mechanism | Outcome | -|---|---|---| -| do nothing | — | `Ready=False`, *"is SOPS encrypted, configuring decryption is required"*. **The ConfigMap is not applied either.** | -| ignore the *fields* | `Kustomization.spec.ignore` with `paths: ["/data", "/sops"]` | `Ready=False`, same message. The SOPS guard runs **before** the ignore rules. | -| drop the *file* at the source | `GitRepository.spec.ignore` (`.sourceignore` syntax) excluding `**/*.enc.yaml` | `Ready=False` — `kustomize build failed: accumulating resources from 'secret.enc.yaml': no such file`. The `kustomization.yaml` still lists it. | -| drop the *resource* from the build | `Kustomization.spec.patches` with `$patch: delete` | ✅ **`Ready=True`.** ConfigMap applied, Secret never created. | -| plain folder + drop the file | no `kustomization.yaml`, plus `GitRepository.spec.ignore` | ✅ **`Ready=True`.** | - -Two mechanisms work, and **which one you need is decided by the folder layout** — -the same plain-versus-kustomize split the analyzer already reports: - -- **Plain KRM folder** (the product's first-class target): exclude the file at the - source with `GitRepository.spec.ignore`. kustomize-controller synthesises a - kustomization from the files it finds, so an absent file is simply absent. -- **Kustomize folder**: the file is named in `resources:`, so removing it from the - artifact breaks the build. Remove the *resource from the build output* instead, - with a `$patch: delete` entry per encrypted document. - -`Kustomization.spec.ignore` looks like the obvious answer and is not: it excludes -JSON-pointer paths from **drift detection and apply**, and the SOPS guard fires -before it ever runs. - -```mermaid -flowchart TD - F["folder to hydrate"] --> K{"kustomization.yaml
lists the encrypted file?"} - K -- no --> SI["GitRepository.spec.ignore
drop the file from the artifact"] - K -- yes --> PD["Kustomization.spec.patches
one delete per encrypted doc"] - SI --> OK["Ready=True
everything else applied"] - PD --> OK - OK --> PROJ["GitOps Reverser projects an
EncryptedSecret for each excluded doc"] - - classDef good fill:#dfd,stroke:#3a3 - class OK,PROJ good -``` - -### This is generatable, not hand-written - -The exclusion is not something a user should maintain. The analyzer **already -knows** which documents are encrypted (`CauseEncrypted`) and whether a folder is -plain or a kustomize render root. So the hydrator can emit the right exclusion for -the right layout, and project an `EncryptedSecret` for every document it excluded. - -The user gets a cluster holding everything that could be hydrated, plus an honest -description of everything that could not. - -Two operational caveats: - -- `GitRepository.spec.ignore` is a property of the **source**, shared by every - `Kustomization` that references it. An intent cluster wants its own - `GitRepository`, not the production one. -- Excluded resources are never applied, so `prune` will never delete them. That is - correct here, and it is worth stating because it looks like a leak. - -**Argo CD is untested.** Its analogues exist — `directory.exclude` for a plain -folder, `kustomize.patches` for a kustomize source — but Argo CD ships no SOPS -awareness at all, so an unexcluded document would not meet a friendly guard. It -would be sent to the API server and hit `illegal base64 data` from the table -above. Same outcome, worse message. - -## The rule that falls out - -> **Always install the CRDs. Install a controller only if it is an applier you -> drive, and never one that materialises secrets.** - -The intent cluster is primarily a **schema surface**: it exists so `kubectl` can -validate, store and serve intent. A reconciler is welcome in it only in the -handshake role above — triggered, SHA-acknowledged, on a long interval — and the -two secret-materialising controllers are never welcome at all, for reasons that -have nothing to do with reconciliation. - -| Controller | What it does here | Verdict | -|---|---|---| -| Flux / Argo CD, **autonomous** | re-applies a stale revision over the user's edit | hazard — see [bi-directional.md](../../bi-directional.md) | -| Flux, **triggered + SHA-acknowledged** | applies exactly the revision we published | **the intended design**, proven in e2e | -| Argo CD, triggered | the same shape, `Refresh` + `selfHeal: false` | untested | -| sealed-secrets | tries to unseal without the private key | fails noisily; the object is inert, which is what we want | -| External Secrets Operator | fetches **real** secrets from the **real** Vault into a throwaway cluster | a security regression | -| any workload controller | schedules Pods nobody asked for | pointless, and it will fight `status` | - -The two secret controllers are the interesting rows. Neither is excluded because -it reconciles; both are excluded because of what they would *pull into* a cluster -that is supposed to hold intent and nothing else. Leave them out and their objects -sit there inert and editable — which is precisely the goal. - -Install their **CRDs**, and every one of those kinds becomes storable, editable -and `kubectl`-validatable. Install nothing else. - -Notice how cleanly this resolves the three secret shapes: - -```mermaid -flowchart TD - subgraph git["Git"] - A["SealedSecret"] - B["ExternalSecret"] - C["Secret with sops: stanza"] - end - - A --> H{"hydrate
strict apply"} - B --> H - C --> H - - H -- "valid KRM, CRD installed" --> OK1["stored as itself
editable"] - H -- "valid KRM, CRD installed" --> OK2["stored as itself
editable"] - H -- "not schema-conformant" --> REJ["API server refuses"] - REJ --> PROJ["GitOps Reverser projects
an EncryptedSecret instead"] - - A --- OK1 - B --- OK2 - - classDef good fill:#dfd,stroke:#3a3 - classDef bad fill:#fdd,stroke:#c33 - class OK1,OK2,PROJ good - class REJ bad -``` - -A `SealedSecret` and an `ExternalSecret` hydrate *as themselves*, because they are -ordinary KRM ([and that, not encryption, is the discriminator](resource-capability-model.md)). -Their controllers stay out, so they sit there inert and editable, which is exactly -what we want. - -A SOPS `Secret` cannot hydrate as itself, because it is not a valid `Secret`. That -— and nothing else — is why `EncryptedSecret` exists. - -## Who hydrates, then? - -**A triggered Flux `Kustomization` can do all of it**, including subtrees that -contain SOPS documents, provided the exclusion above is generated for it. It is the -real applier with real semantics, it is already the acknowledgment step in the -handshake, and it is proven. Point it at the revision, trigger it, wait for the -SHA, leave it on a long interval. - -The hydration step is then: - -1. Walk the `GitTarget` subtree, exactly as `ScanDir` does. -2. For each document, ask the [capability registry](resource-capability-model.md). -3. For every non-`schemaConformant` document, emit an exclusion — a - `GitRepository.spec.ignore` pattern for a plain folder, a `$patch: delete` for a - kustomize root — and project an `EncryptedSecret` for it. -4. Hand the source and the `Kustomization` to Flux. Trigger. Wait for the SHA. -5. Never prune what was excluded. Never leave the interval short. - -GitOps Reverser contributes the one thing Flux cannot know — *which documents are -unhydratable, and why* — and Flux contributes everything else. No orchestrator is -emulated, no Git-host knowledge is added, and the operator does not grow an apply -loop of its own. - -Applying the document store directly, strictly, without Flux remains the fallback -for an environment with no GitOps controller at all. It is a smaller thing to build -than it looked before this section was written, because it is no longer the only -way to hydrate a repository that uses SOPS. - -The intent cluster is disposable. If it drifts from Git for reasons other than the -user's edit, the answer is to throw it away and hydrate a fresh one — not to -reconcile it. - -## What this asks of `scan-repo` - -To hydrate a repository, you must first install the CRDs for every kind it -contains. Nothing reports that today. - -`RepoReport` should grow a **`requiredCRDs`** field: the set of group/kind pairs a -repository's documents use that are not built into Kubernetes. It is free to -compute — the walk has already parsed every document's `apiVersion` and `kind` — -and it is exactly the list an onboarding step needs before it can stand a cluster -up. It sits naturally beside `unsupportedConstructs`, which already answers the -neighbouring question "what does this repo use that we do not manage?" - -For the layout corpus, `requiredCRDs` would report `HelmRelease` and -`Kustomization` for [`09-flux-monorepo`](../../../test/fixtures/gitops-layouts/1-desired-state/flux-monorepo/), -`Application` for the Argo CD fixtures, and `Composition` plus -`ResourceGraphDefinition` for -[`15-mixed-and-hostile`](../../../test/fixtures/gitops-layouts/6-hostile/mixed-and-hostile/). - -## Open questions - -1. **Real CRDs, or synthesised permissive ones?** To *edit* an `Application` you - do not need Argo CD's real schema — a structural CRD with - `x-kubernetes-preserve-unknown-fields` would store it. That removes the need to - track upstream CRD versions, at the cost of losing every validation the user - would want. Which failure is worse: rejecting a valid edit, or accepting an - invalid one that only fails at merge? -2. **What is the hydration unit?** One `GitTarget` subtree, or the whole - repository? A subtree may reference a `ConfigMap` defined outside it. The - [read-scope](f8-repo-discovery-and-onboarding-scan.md) machinery already knows - how to answer this for kustomize bases. -3. **How long does an intent cluster live?** Per editing session, per `GitTarget`, - or long-lived per tenant? A long-lived one will drift from Git as other people - merge, and nothing here reconciles it. Is re-hydration on branch change the - answer, and what happens to an in-flight edit? -4. **Does the user ever see the ciphertext?** `EncryptedSecret` deliberately shows - key names and not values. A user in the intent cluster running - `kubectl get secret` sees only what they themselves wrote this session, because - the plaintext was never hydrated. Is that surprising enough to need surfacing - as a condition on the object? -5. **What hydrates a kind we do not recognise?** A CR with no capability - classifier is assumed `plain`, applied, and edited. If it turns out to hold - ciphertext in a string field, we will happily rewrite it from live state. - Is the ordinary-KRM default right, or should an unknown CRD be read-only until - someone classifies it? diff --git a/docs/design/gitops-api/kustomize-support-boundary-and-product-model.md b/docs/design/gitops-api/kustomize-support-boundary-and-product-model.md deleted file mode 100644 index ed47e85a..00000000 --- a/docs/design/gitops-api/kustomize-support-boundary-and-product-model.md +++ /dev/null @@ -1,471 +0,0 @@ -# Kustomize support boundary and product model - -> Status: direction-setting; feeds F2/F3 design. The §4 fan-in invariant is no -> longer emergent — it ships as a write-plan refusal (see §1 and -> [gittarget-granularity-and-cross-environment-edits.md §1](gittarget-granularity-and-cross-environment-edits.md)). -> Captured: 2026-07-06 -> Related: -> [README.md](README.md), -> [gittarget-granularity-and-cross-environment-edits.md](gittarget-granularity-and-cross-environment-edits.md), -> [finished/f1-images-replicas-edit-through.md](finished/f1-images-replicas-edit-through.md), -> [../manifest/contextual-namespace-and-kustomize-folder-editing.md](../../spec/contextual-namespace-and-kustomize-folder-editing.md), -> [../unsupported-folder-refusal-plan.md](../../spec/unsupported-folder-refusal-plan.md), -> [../manifest/version2/gittarget-new-file-placement-rules.md](../../spec/gittarget-new-file-placement-rules.md) - -## Purpose - -The per-feature docs in this folder answer "how do we build X." This one takes -a step back and answers the questions that decide what X should be: - -1. Which part of the kustomization surface can this product **ever** support, - and which part is permanently out? -2. Which **folder layouts** do we promise to support, and in what order? -3. Who **runs kustomize** — us, or the GitOps tool? -4. How do the multi-environment product questions resolve: how does an app get - into *all* environments, and how does a change **promote** from test to - production? -5. Where does the reverser **run** — inside the workload cluster it mirrors, - or in a separate **intent cluster** whose only job is editing (§8)? - -The governing rule from [README.md](README.md) is the measuring stick for the -first four: the repository must stay **round-trippable** — every edit the -operator writes has exactly one writable Git destination, and the result must -be expressible in both directions (live → Git, and Git → live via the GitOps -tool's render). Shared source documents are read-only context. The fifth is a -deployment axis that leaves that rule — and everything derived from it — -untouched (§8). - -## 1. The kustomization surface: an invertibility taxonomy - -Measured against round-trippability, the ~29 documented `kustomization.yaml` -fields ([reference](https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/)) -fall into four buckets. The boundary is not a temporary implementation gap — -most of the "never" bucket is *structurally* non-invertible, and saying so is -the support contract. - -| Bucket | Fields | Why | -|---|---|---| -| **Invertible — supported** | `resources`/`bases` (local), `namespace`, `images`, `replicas` | Today's subset: namespace inference + F1 edit-through | -| **Invertible — planned** | `patches` (scalar strategic-merge, **operator-authored only**) | The one crossing worth building (F3); env drift needs a per-environment destination | -| **Invertible — possible, not planned** | `labels`, `commonLabels`, `commonAnnotations`, `buildMetadata` (subtractable in projection); `namePrefix`/`nameSuffix` (identity arithmetic cascades into every name reference); `configMapGenerator` limited to literals + `disableNameSuffixHash` | Cost/value is poor; prefixes especially buy little and touch everything | -| **Never — structurally non-invertible** | `helmCharts`/`helmGlobals` (live state does not determine chart+values inputs); generators with hash suffixes (the hash couples content to rollout — inverting means authoring rename cascades); `replacements`/`vars` (the value's source of truth is another field; a change to the target is semantically ambiguous); `generators`/`transformers`/`validators` plugins (arbitrary code = unknowable render); `components` (patch bundles composed across variants); remote bases (cannot edit what we do not own) | -| **Never — policy** | `secretGenerator` | Plaintext secrets in Git contradict the SOPS stance regardless of invertibility | -| **Refuse rather than tolerate** | `configurations`, `openapi`, `crds` | They silently change merge-key semantics, so the editor's assumptions become wrong with no visible signal | -| **Tolerable ignorables** | `sortOptions` | Does not change object state | - -Two nuances found while auditing the current gate -(`hasUnsupportedKustomizeFeature`, `internal/manifestanalyzer/store.go`): - -- **Tolerated metadata transformers leak.** `commonLabels`, `labels`, - `commonAnnotations`, and `buildMetadata` pass the gate silently, but a live - object can carry transformer-supplied metadata its source file lacks — the - writer patches it into the file as "drift." The render stays correct - (idempotent), so this is pollution rather than corruption, but it is the - same "dead text shadowed by a transformer" pathology F1 fixed for `images:`. - A future projection-side subtraction is the F1-style fix; until then the - support statement should name the limitation. -- **The fan-out fallback is now an explicit refusal.** Ambiguous override chains - (`ambiguous-images`, `diamond-images` corpora) still emit a warning at store - build time, but a *planned write* into such a file is refused before any byte - is written: write-through into a file consumed by two render roots is the one - edit that must never happen, and it no longer depends on the coincidental - namespace ambiguity (`NamespaceNone`) that used to block the live-object match. - The refusal fails the GitTarget with reason `WriteBoundaryRefused`. See - [§4](#4-the-invariant) and - [gittarget-granularity-and-cross-environment-edits.md §1](gittarget-granularity-and-cross-environment-edits.md). - -## 2. Supported layouts: an allowlist, not field caveats - -The public support statement should enumerate **layouts we accept**, not -fields we reject. Three layouts, in delivery order: - -1. **Plain manifest folder** — raw YAML, explicit namespaces. *Shipped.* -2. **Single-context kustomize folder** — one render root; `namespace`, - `resources` (local files / child dirs), `images`, `replicas`. *Shipped - (F1).* -3. **Base + environment overlays** — one shared base, N overlay roots, one - Kubernetes namespace per overlay. *The day-one F2+F4 target, completed by - F3; see §5.* This is the canonical layout in the kustomize documentation - and common GitOps examples — a kustomize story without it reads as toy - support. - -**Launch posture:** all three layouts are on the launch path. Layouts 1–2 -apply *per environment* (one plain folder per env, each its own GitTarget); -layout 3 launches in its **F2+F4 scope** — per-overlay `namespace` + -`resources`/`images`/`replicas`, overlay-local documents, base read-only, and -new overlay-local KRM added to that overlay's `resources:`. The day-to-day -use cases (add something to test, bump a version, edit an overlay-local -object) need exactly that slice. Per-environment edits of base-owned *fields* -are the deferred hard part (F3); today they are refused rather than written into -the base, and reporting each one as unreflected is the unbuilt Tier-2 accounting -(§4). See the launch path in [README.md](README.md). - -Explicitly **out of scope**, and worth saying in user docs: - -- **Fleet / cluster-root repositories** (`clusters/` + `apps/` + `infra/` - layouts). A GitTarget points at an *app subtree*, never a cluster root. - This composes fine with fleet repos — a Flux `Kustomization`, Argo CD - `Application`, or another product object can point at the same app folder - we do — and keeps us out of infrastructure folders full of Helm rendering - and components. -- **Helm rendering in any form** (`helmCharts`, hybrid repos): permanently - refused. Flux `HelmRelease`, Argo CD `Application`, KRO resources, and other - control-plane CRs are ordinary KRM documents and fully in scope — the - boundary is chart inflation, not the CRs that request it. -- **Folders transformed outside the folder.** Flux `postBuild` substitutions - and `targetNamespace`, Argo CD Application-level kustomize overrides, or any - controller-side transform that is not written in the folder: the folder - alone no longer determines the render, so the round-trip promise cannot - hold. Our contract is "we mirror what the folder alone renders." (Reading - controller CRs in-cluster to learn those transforms is a possible - much-later feature, not part of this boundary.) - -This allowlist is a **write** contract, not a discovery one. The read-only -onboarding scanner ([F8 repo scan](f8-repo-discovery-and-onboarding-scan.md)) -walks a whole repo and classifies each folder against *exactly* this boundary -— `plain` / `kustomize-single` (accepted), `kustomize-overlay` (forward-looking, -needs F2), `refused-structural` (the permanent wall above) — without widening -what the operator writes. Discovering broadly and writing narrowly is what lets -onboarding meet real GitOps repos without eroding round-trippability. - -## 3. Why overlays are a different animal - -Fan-out is exactly why the governing rule is "one writable destination per -edit," not "one source document owns one live object": a base -`deployment.yaml` can produce N live objects, one per environment. Two -consequences: - -- **Read side** — which overlay produced the object we are watching? We need - a variant → namespace mapping. -- **Write side** — an edit observed in the test environment must land in the - test overlay, *never* in the base. Writing to base changes production - because someone touched test. - -So overlay support is not an incremental extension of F1; it changes the -write model from "edit the document that produced the object" to "synthesize -the minimal expression of the change **in the right variant**." - -## 4. The invariant - -> **The operator never writes to a file consumed by more than one render -> root.** (Write fan-in = 1. Base files and shared components are read-only -> context, always.) - -> **This rule has one home:** -> [gittarget-granularity-and-cross-environment-edits.md §1](gittarget-granularity-and-cross-environment-edits.md) -> specifies it as the two-layer write boundary (L1 filesystem jail, L2 fan-in = 1) -> and names its enforcement — a write-plan precondition that aborts the whole flush -> and fails the GitTarget with `GitPathAccepted=False` / `WriteBoundaryRefused`. -> The paragraph above states the rule; it does not redefine it. If the two ever -> disagree, §1 wins. - -This single sentence: - -- makes "operator edits base" structurally impossible — nothing observed in - one environment can ever change what another environment renders; -- explains the `diamond-images` refusal (two paths from one root); -- decides the multi-environment product questions in §9 (the operator cannot - "add to all environments" *by design*); -- **has been promoted from emergent behavior to an explicit, tested rule** — a - write-plan precondition that refuses the flush (`WriteBoundaryRefused`) rather - than writing through. It is paired with the filesystem jail (writes never leave - `spec.path`); the two layers are specified in - [gittarget-granularity-and-cross-environment-edits.md §1](gittarget-granularity-and-cross-environment-edits.md). - Generalizing it from "a file two override chains reach" to "any file two render - roots reach" is F2 render-root scoping. - -## 5. The overlay model (F2+F4 at launch, F3 completes it) - -With the invariant in place, every observed change in environment X has -exactly one legal destination: - -| Observed change in env X | Lands in | -|---|---| -| image tag / replica count | overlay X's `images:`/`replicas:` entry (F1 machinery, scoped per render root) | -| new object | new overlay-local file in overlay X **+ a `resources:` entry** (F4 placement plus entry creation — F1's "never add entries" boundary moves here) | -| any other spec field (env var, resource limits, args…) | an overlay-X strategic-merge patch — **F3, or nowhere** | -| delete of a base-owned object in one env | unrepresentable without a `$patch: delete` patch — refuse the write, or cover it in F3 | - -The third row is the honesty condition on shipping F2+F4 first: an arbitrary -field edit on a base-owned object has no legal destination without patch -authoring (in-place would be the base). Day-one Kustomize support therefore -covers the common slice — overlay entries, overlay-local documents, and adding -overlay-local KRM to `resources:`. - -Two mechanisms cover what falls outside that slice, and they must not be -conflated: - -| | Status | Granularity | Surface | -|---|---|---|---| -| **Write-boundary refusal** (L1/L2) | **shipped** | aborts the whole flush; commits nothing | `GitPathAccepted=False`, `Stalled=True`, reason `WriteBoundaryRefused` | -| **Per-edit `FullyReflected` accounting** | **designed, unbuilt** | records the individual dropped edit; reverted by hydration | planned `FullyReflected` condition + unreflected set | - -Today an out-of-scope edit is *prevented* — refused before any byte is written — -but the operator is told at the target level, not per edit. Making the third row -"reported and reverted, never silently lost" is the unbuilt accounting, and it is -a **prerequisite for the F2/F4 launch unit**, not something this branch delivers. -That remains a scoped promise rather than a gap: the launch use cases (add to -test, bump a version) never hit the third row, and tier-2 metrics on how often -real users *do* hit it are what price F3. - -F3's scope stays narrow and safe: the operator only creates/updates patches -**it authored** (scalar fields, one patch file per object per overlay); -pre-existing hand-written patches still refuse the folder. The gate keeps its -shape — we accept exactly the structure we fully model, which now includes -our own patches. - -What happens when an edit has **no** legal destination — the "or nowhere" -rows above — and how the user finds out, is designed separately in -[unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md) -(per-edit `FullyReflected` accounting, self-healing via hydration, and the -optional F6 admission preflight). - -### Variant identification: self-describing folders over configuration - -Prefer reading the mapping from the folder to declaring it on the GitTarget. -The analyzer already computes render roots (kustomizations no other -kustomization references); if each overlay sets `namespace:`, the -variant → namespace mapping is free and the repository documents itself. - -- **Rule:** every overlay root must set `namespace:`, distinct per root. - Refusal message: "add `namespace:` to each overlay." -- Namespace injected out-of-band (Flux `targetNamespace`, Argo destination) - stays refused (§2). An explicit GitTarget-side mapping - (`spec.variants: [{root, namespace}]`) is a fallback we add only if real - folders cannot be made self-describing. - -### Scoping: one GitTarget per overlay root - -The natural shape (already sketched as F2 in [README.md](README.md)): a -GitTarget's `spec.path` names the overlay (`…/overlays/test`), so -environment = GitTarget = watch scope = write scope, and multiple GitTargets -share the branch through the existing BranchWorker serialization. - -Structural consequence the F2 design must solve: the base sits *outside* -`spec.path`, so the analyzer needs a **read scope** (the repo subtree -reachable via `../../base`) wider than the **write scope** (the overlay -directory). The GitTarget path-overlap rejection must learn that shared -*read-only* context between targets is legal while overlapping *write* -scopes stay forbidden. - -## 6. The reference layout - -The blessed shape for docs, examples, and the test corpus: - -```text -apps/podinfo/ -├── base/ # read-only to the operator, always -│ ├── kustomization.yaml # resources: [deployment.yaml, service.yaml] -│ ├── deployment.yaml -│ └── service.yaml -└── overlays/ - ├── test/ # GitTarget A → namespace podinfo-test - │ ├── kustomization.yaml # namespace: podinfo-test - │ │ # resources: [../../base, debug-toolbox.yaml] - │ │ # images: [{name: podinfo, newTag: 6.6.0-rc1}] - │ │ # replicas: [{name: podinfo, count: 1}] - │ │ # patches: [{path: podinfo-deployment.patch.yaml}] # F3 - │ ├── debug-toolbox.yaml # an extra installed only in test - │ └── podinfo-deployment.patch.yaml # operator-authored env drift (F3) - ├── acceptance/ - │ └── kustomization.yaml # namespace: podinfo-acc, resources: [../../base], images/replicas - └── production/ - └── kustomization.yaml # namespace: podinfo-prod, resources: [../../base], images/replicas -``` - -"Install extras in test" and "add files in test" are the same mechanism: an -overlay-local resource file plus its `resources:` entry, created by the -operator when a new object appears in that environment's namespace. - -## 7. Who runs kustomize - -Deployment stays with the user's GitOps controller — Flux, Argo CD, or -anything else that consumes KRM — because that keeps the operator out of the -deployment business and out of drift-ownership fights. But "running -kustomize" means two different things: - -- **Deploying** (Git → cluster): theirs, always. -- **Understanding** (folder → expected render): ours, necessarily — the - writer must know which file supplied each live value. - -We keep *re-implementing the narrow transformer subset* rather than embedding -kustomize as the renderer: it is what keeps the refusal boundary honest (we -refuse exactly what we do not model). The worthwhile upgrade is kustomize's -Go API (`krusty`) as a **verification oracle**, not a renderer: in the -acceptance gate or in CI, build each render root in-memory and compare -against our own projection; mismatch → refuse. That buys kustomize's ground -truth without ever depending on semantics we have not modeled — the cheap, -high-confidence version of F1's parked "Option D." - -## 8. Where the reverser runs: mirror mode and intent mode - -Everything above is deliberately **topology-independent** — and that is the -point of this section. The same operator supports two deployment shapes: - -- **Mirror mode (in-cluster) — shipped today.** The reverser runs inside the - workload cluster it watches. The Kubernetes API is the source of truth and - Git is the continuously updated mirror - ([architecture.md](../../architecture.md)); writing the mirror branch - directly is legitimate. -- **Intent mode (separate intent cluster) — the product direction.** The - reverser runs in a dedicated — possibly public-facing — *intent cluster* - that runs no workloads. That cluster's API is an **editing surface over the - Git folder**: `main` is hydrated into it by normal GitOps tooling, people - edit through the Kubernetes API (kubectl, CI, or a product UI on top), the - reverser materializes the edits onto a session branch, and the product - opens the PR. **Merging the PR is the deploy** — the real clusters pick up - `main` through their own GitOps controller, and the intent cluster - re-hydrates to the merged result. - -```mermaid -flowchart TB - subgraph M["Mirror mode — shipped today"] - direction LR - WC[Workload cluster
source of truth] -->|watch| R1[Reverser
in-cluster] - R1 -->|mirror commits| G1[(Git repository)] - end - subgraph I["Intent mode — the product direction"] - direction LR - U[User / product UI] -->|Kubernetes API| IC[Intent cluster
editing surface, no workloads] - IC -->|watch| R2[Reverser
in intent cluster] - R2 -->|session branch| G2[("Git repository
main = source of truth")] - G2 -->|merged main| RC[Real clusters
via GitOps controller] - G2 -.->|hydrate main| IC - end -``` - -The editing loop, in order: - -```mermaid -sequenceDiagram - autonumber - participant U as User / product UI - participant IC as Intent cluster API - participant R as GitOps Reverser - participant G as Git repository - participant P as Product layer - participant F as GitOps controller (real clusters) - - Note over G,IC: hydration — the GitOps tool applies main's render into the intent cluster - U->>IC: edit objects (kubectl apply / UI) - IC-->>R: watch events (+ audit facts naming the author) - R->>G: route each edit (overlay entry / patch / file), push session branch - U->>IC: CommitRequest ("save now") - R-->>IC: Pushed=True + status.sha / status.branch - P->>G: open PR (session branch → main) - Note over G: review + merge — the merge is the deploy decision - G-->>F: new main revision - F->>F: render + apply into each real cluster - Note over G,IC: intent cluster re-hydrates to merged main — loop closed -``` - -### What intent mode changes - -- **What a watched object means.** Mirror mode captures *actual* state; - intent mode captures *proposed* state. The session branch is the unsaved - buffer, the PR is the save dialog, the merge is the deploy. -- **A hydration arrow appears (Git → intent cluster).** The same GitOps - tooling, pointed at the intent cluster, applies **every overlay into its - namespace** — making the intent cluster the one place all environments are - visible side by side (exactly what promotion diffs want). One tension to - design for: a continuously drift-correcting hydrator would revert a user's - edits mid-session, so hydration must be session-aware (suspended while a - session is open, or one-shot per session). That lifecycle is product-layer. -- **Branch discipline replaces direct mirroring.** Intent mode writes only - session branches; `main` moves exclusively by merge. - `GitProvider.spec.allowedBranches` already expresses this. -- **Attribution becomes first-class instead of best-effort.** The product - owns the intent cluster's apiserver configuration, so the audit webhook and - OIDC claim mappings are *guaranteed* wired — every commit, and therefore - every PR, names the real human. In customer-owned workload clusters that - wiring can only be recommended; here it is part of the product. -- **Kubernetes RBAC becomes the edit-permission model for Git.** With - namespace-per-overlay (§5), "may propose changes to test, read-only on - production" is a RoleBinding — and a contributor needs **no access to any - real cluster** to propose a production change. -- **The cluster can be hollow.** Nothing needs to run, so a - control-plane-only cluster (k3s server-only, vcluster, kwok) suffices; - status stays empty, which costs nothing (the sanitizer strips status - anyway). Schema validation, admission, and RBAC still run — that is the - "easy API" being bought: typed, validated, access-controlled editing of a - Git folder. -- **CRD parity is a prerequisite.** Editing a custom resource requires its - CRD installed in the intent cluster; a multi-tenant intent cluster also - needs namespace uniqueness across the repos it hosts. Product-layer - bookkeeping, not operator work. - -### What it does not change - -The taxonomy (§1), the layout allowlist (§2), the fan-in invariant (§4), the -routing table (§5), and the who-runs-kustomize split (§7) apply **verbatim** -— the operator neither knows nor cares whether the cluster it watches runs -real workloads. Intent mode is a deployment pattern plus product-layer -lifecycle, not a fork of the operator. - -The modes also compose: an organization can run mirror mode inside its real -clusters (capturing drift and incident-time edits) and intent mode as the -front door for planned changes — both write the same repository through the -same routing rules. - -## 9. The product model: three arrows - -Every multi-environment question resolves once each direction of data flow -has exactly one owner: - -| Arrow | Owner | Content | -|---|---|---| -| **API → Git** (per environment) | GitOps Reverser | Mirror each environment into *its own overlay*; never cross environments (§4 invariant) | -| **Git → API** | GitOps controller | Render and apply, unchanged | -| **Git → Git** | Product layer | Promotion, "factor into base," PR creation, branch/session policy | - -The arrows are topology-independent (§8): in intent mode the API → Git arrow -originates in the intent cluster, and Git → API runs twice — the hydrator -converging the intent cluster and the customer's GitOps controller converging -the real clusters — but every arrow keeps its single owner. - -Consequences: - -- **"Add the same app to all environments" is deliberately not an operator - capability.** The story is: the app appears in test (live apply, or via the - product) → the operator lands it as `overlays/test/whatever.yaml` → the - product offers **promote**, a pure Git computation (copy/diff between - overlays, open a PR). No component ever writes to base automatically. -- **Promotion is a first-class product verb, not a social convention.** F1 - already makes the highest-frequency case trivial: a tag bump in test - materializes as a one-line change to `overlays/test/kustomization.yaml`, so - "promote to acceptance" is proposing the same one-line edit in the next - overlay's file. Small, safe, demo-able — and it falls out of shipped work. -- **"Factor into base"** (dedupe N overlay copies into base + minimal - patches) is a later, fancier Git → Git refactor — also product-layer, and - computable precisely *because* the operator keeps every environment's - effective state expressible in the folder. - -The operator's contribution to promotion is that it becomes a deterministic -diff instead of an archaeology exercise. - -## 10. Consequences for the feature ladder - -- **Intent mode adds no write-model feature, but raises F5.** The topology's - deltas (hydration lifecycle, PR flow, RBAC mapping) are product-layer; the - operator-side enabler is F5 — branch/session ergonomics (base-branch - selection, remote branch cleanup, a quiescence condition) — whose priority - intent mode raises from "ergonomics" to "product prerequisite." -- **F2+F4 ship at launch; F3 completes them.** Render-root scoping, overlay - new-file placement, `resources:` entry creation, and the (still unbuilt) - unreflected-set accounting are an honest launch unit scoped to adds, bumps, and - overlay-local edits; once the accounting exists, the first `kubectl set env` - against a base-owned object in test is *reported and reverted* rather than - merely refused, and never silently lost. F3 turns that report into a reflected - edit, priced by how often the report fires. -- **Prerequisite hardening (pre-F2/F4): done.** The write-fan-in-=-1 invariant - (§4) is explicit and tested — the ambiguity fallback provably never writes - through into a multi-consumer file, instead of being blocked as a side effect - of namespace ambiguity. It refuses the flush and fails the GitTarget - (`WriteBoundaryRefused`), paired with the L1 filesystem jail. -- **F4 moves a boundary:** overlay new-object placement needs `resources:` - entry *creation*, which F1 explicitly excluded. The exclusion was per-F1 - policy, not architecture; F4's design should own it. -- **Docs follow the allowlist:** the public support statement enumerates the - three layouts of §2 (with the overlay rules of §5), names the - label/annotation leak as a known limitation, and states the Helm / - generator / fleet-root non-goals as the product's support contract. diff --git a/docs/design/gitops-api/the-layer-above-and-the-expansion-graph.md b/docs/design/gitops-api/the-layer-above-and-the-expansion-graph.md deleted file mode 100644 index 6ec8e2ad..00000000 --- a/docs/design/gitops-api/the-layer-above-and-the-expansion-graph.md +++ /dev/null @@ -1,297 +0,0 @@ -# The layer above: kcp, Flux, Argo CD — and the graph that decides the boundary - -> Status: direction-setting; draws the architecture the product is heading for and -> names the one question every layer must agree on. Ships no code. -> Captured: 2026-07-13 -> Related: -> [support-contract.md](support-contract.md) — the boundary this doc explains the *shape* of, -> [intent-cluster-hydration.md](intent-cluster-hydration.md) — CRDs, never controllers, -> [expansion-boundary-and-corpus-organisation.md](expansion-boundary-and-corpus-organisation.md) — the provenance axis, -> [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md) — the claim vocabulary and the tiering, -> [../../facts/expansion-provenance-markers.md](../../facts/expansion-provenance-markers.md) — **the measurements this doc rests on**, -> [../../bi-directional.md](../../bi-directional.md) — the triggered-applier handshake - -## Why this doc exists - -GitOps Reverser is one arrow: **live → Git**. The product needs the other arrow, and -somewhere to put the user's editing session. The direction now settled on is a layer -*above* this operator that uses **kcp** for the intent cluster and **Flux / Argo CD** -as triggered appliers — the [hydration](intent-cluster-hydration.md) and -[bi-directional](../../bi-directional.md) designs, assembled into a product. - -That layer does not exist yet. Before it is built, the boundaries between it and this -operator have to be crisp, because the most expensive mistake available is to let -orchestrator knowledge leak downward into the operator, or let the operator's refusals -leak upward as product gaps. - -This doc draws the picture, and then names the **one question** the whole stack turns -on. - -## The stack - -Four layers. Each has exactly one job. The interfaces between them are primitives that -already ship. - -```text -┌─ Product layer ──────────────────────────────────────────────────────┐ -│ session + branch lifecycle · PR open / merge · UI │ -│ merge == deploy │ -└───────────────────────────────┬──────────────────────────────────────┘ - │ CommitRequest: Pushed=True + status.sha + status.branch -┌─ Orchestration layer ─────────┴──────────────────────────────────────┐ -│ kcp a workspace per session — the intent cluster │ -│ Flux/Argo TRIGGERED appliers: Git → live (hydrate), and the │ -│ acknowledgment that closes the loop │ -└───────────────────────────────┬──────────────────────────────────────┘ - │ the Kubernetes API — the user's write path -┌─ GitOps Reverser (this repo) ─┴──────────────────────────────────────┐ -│ watch · sanitize · write the folder the way a careful human would · │ -│ push a branch │ -│ NEVER: Git-host APIs · chart rendering · generator evaluation │ -└───────────────────────────────┬──────────────────────────────────────┘ - │ -┌─ Git ─────────────────────────┴──────────────────────────────────────┐ -│ the intent layer — the files, and the only thing that is true │ -└──────────────────────────────────────────────────────────────────────┘ -``` - -The operator's contract with the layer above is deliberately thin and already exists: -it publishes a commit and reports `Pushed=True` with a SHA. Everything the -orchestration layer does — trigger the applier, wait for that exact revision, open the -PR — is built on that one signal. Nothing about kcp, GitHub, or Argo CD needs to enter -this repository for it to work. - -## The one question the whole stack turns on - -Every layer, asked about any live object, must give the same answer to: - -> ### Does this object have a home in Git — exactly one file that is its source? - -- **Yes** → mirror it, edit it, write the edit back to that file. This is the **intent - layer**, and it is the product. -- **No** → never mirror it. A controller synthesised it; writing it to Git invents a - **second source of truth that fights the controller that made it**. This is the - **expansion layer**. - -That is [the support contract](support-contract.md) in one line. And it is a question -about a **graph**, not about a field on an object. - -## The graph - -Every GitOps repository is a starting point that explodes into more KRM. Draw the -explosion as a DAG — files, then controllers, then live objects — and the boundary -becomes a property of the edges rather than a list of special cases. - -```mermaid -flowchart LR - subgraph git["Git — the intent layer"] - F1["apps/frontend/deployment.yaml"] - F2["overlays/prod/kustomization.yaml"] - F3["releases/redis.yaml
(HelmRelease)"] - F4["tenants/apps.yaml
(ResourceSet)"] - F5["bootstrap/appset.yaml
(ApplicationSet)"] - end - - subgraph appliers["Appliers — source is a FOLDER OF FILES"] - KC["kustomize-controller"] - AC["argocd-controller"] - end - - subgraph expanders["Expanders — source is a TEMPLATE INSIDE A CR"] - HC["helm-controller"] - FO["flux-operator"] - AS["applicationset-controller"] - end - - F1 --> KC - F2 --> KC - F1 --> AC - F3 --> HC - F4 --> FO - F5 --> AS - - KC --> O1["Deployment (live)"] - AC --> O2["Deployment (live)"] - HC --> O3["Redis StatefulSet,
Service, ConfigMap…"] - FO --> O4["9 objects across
3 tenants"] - AS --> O5["Application CRs"] - - classDef home fill:#dfd,stroke:#3a3 - classDef nohome fill:#fdd,stroke:#c33 - class O1,O2 home - class O3,O4,O5 nohome -``` - -Green objects have a home file. Red ones do not. **Both kinds were applied by a -controller** — which is why *"was a controller involved?"* is the wrong question. - -The discriminator is one level up: **what is the controller's source?** A folder of -files (invertible — the file is right there) or a template inside a CR (not -invertible — the file is the CR, and the object is a rendering of a field in it). - -## The boundary is the *inverse* of that graph - -GitOps Reverser runs the arrows backwards. So the support contract is simply: **the -inverse is defined exactly where an edge is invertible.** - -Four cases, one rule: - -| In-edges on the live object | Edge kind | Verdict | Why | -|---|---|---|---| -| **0** — nobody applied it | — | **Editable** | a human authored it directly. In an intent cluster this is the *normal* case, and it is the whole product | -| **1** | applier (source = a folder of files) | **Editable** | the file is right there; the edit inverts to it | -| **1** | expander (source = a template in a CR) | **Not mirrored** | there is no file. The CR is editable; its *output* has nowhere to go | -| **N > 1** | applier | **Refused** | a shared kustomize base: the edit would change more than one thing. This is **fan-in = 1**, already the [write boundary](gittarget-granularity-and-cross-environment-edits.md) | - -The three axes the design has been circling — -*renderability*, *ownership*, *provenance* — are the three ways an edge can fail to -invert. They are not three separate models. They are one graph, read backwards. - -Note the row that is easy to miss: **an object with zero in-edges is editable.** That -is not a degenerate case; in a properly-built intent cluster it is *every* object, and -the next section is why. - -## What kcp changes — and what it does not - -### It removes the expansion layer, structurally - -An intent cluster built as a **kcp workspace** carries schemas and nothing else: no -helm-controller, no flux-operator, no applicationset-controller. That follows directly -from the standing rule in -[intent-cluster-hydration.md](intent-cluster-hydration.md) — *"always install the -CRDs; install a controller only if it is an applier you drive"* — and a ResourceSet -expander is not an applier we drive. - -So in the intent workspace **the expansion layer does not exist**. Nothing derives -anything. Every object there arrived by exactly one of two routes: - -```text -file ──hydrate──▶ object ──user edits it──▶ object′ ──reverser──▶ file′ - ▲ - └── or the user created it outright (zero in-edges) -``` - -Both are intent. The graph is trivial, every object has exactly one home, and — the -payoff — - -> **the provenance gate is answered by the topology instead of by evidence.** - -That is the strongest available argument for kcp, and it should be stated plainly, -because it *prices* the hardest unbuilt thing in this workstream: - -| Intent-cluster topology | Expansion controllers running? | Is the provenance gate needed? | -|---|---|---| -| **kcp workspace** (lightweight) | **No** — schemas only | **No.** Nothing derives anything. Structurally impossible, not merely unlikely | -| **A real production cluster** | **Yes** | **Yes — and it is hard.** See the [measurements](../../facts/expansion-provenance-markers.md): three evidence vocabularies, and `ownerReference` catches one producer in five | - -[Decision 1](expansion-boundary-and-corpus-organisation.md) of the expansion doc says -both topologies are supported, and that stands. But the **cost is not symmetric**, and -this is where the asymmetry lands: - -> The more the product leans on kcp, the less the expensive gate matters. The more it -> leans on *"point it at your real cluster"*, the more the gate becomes a hard, -> load-bearing prerequisite — one whose evidence we have now measured and found to be -> a mess. - -That is a strategic fork, not a detail, and it is worth taking deliberately rather than -by drift. - -### What kcp does *not* solve - -Four things, and the last is the one that is easiest to lose. - -1. **Hydration still needs the schemas, and in kcp they are not CRDs.** To store an - `Application` in a workspace you need its schema — an `APIResourceSchema` plus an - `APIExport`/`APIBinding` — rather than a CRD apply. The `requiredCRDs` field - proposed in [intent-cluster-hydration.md](intent-cluster-hydration.md) becomes - `requiredAPIs`, and it is a **precondition of standing the workspace up at all**, - not a nice-to-have on a report. - -2. **Flux and Argo CD have to be able to point *at* a workspace. This is untested.** - kcp is not a full Kubernetes API: no pods, no nodes, a restricted discovery surface. - kustomize-controller mostly does server-side apply against an API server and is a - plausible fit; Argo CD registers clusters and runs a much heavier cache/diff/health - engine whose assumptions are less likely to hold. **This is the largest untested - assumption in the entire direction** and deserves a spike before anything is built - on top of it. - -3. **`kcp.io/cluster` must never reach Git.** Already handled, and it is the only - kcp-awareness in the codebase: `sanitize` strips that key exactly (not by prefix — - sibling `kcp.io/` keys are not assumed to be bookkeeping). It is an *address*, and - committed to Git it would pin a manifest to one workspace and then travel with it - into every other. - -4. **The expansion layer still exists in the repository.** This is the one to hold on - to: - - > **kcp answers "where do I safely edit". It says nothing about "is this repository - > editable".** - - Those are different questions, and only the second is the support contract. A - `ResourceSet` repository's workloads have no files whether you edit them in kcp, in - k3d, or in production. Hydrating such a repo into a pristine workspace does not give - its nine expanded objects a home — it just means nothing expands them, so they never - appear, so the user cannot edit what they came to edit. The refusal is a property of - the repo, and it survives every topology. - -## Bi-directional is the same graph, read backwards, with a clock - -The other arrow — Git → live — is what Flux and Argo CD do for a living. The only -hazard is **causality, not YAML**: a reconciler left on its own interval will re-apply -a stale revision over the user's edit, because in an editing cluster *live state -diverging from Git is not drift — it is the edit*. - -The fix is the [acknowledgment handshake](../../bi-directional.md): treat the -reconciler as a **deliberately triggered applier**, publish the commit, trigger it, and -wait until it reports that it applied *that exact SHA*. Both engines are proven against -it in the [bi-directional corner](../../spec/e2e-bi-directional-corner.md) — Flux via -`flux reconcile` + `lastAppliedRevision`, Argo CD via `selfHeal: false` + a push -webhook. - -**Hydration is the degenerate case of that same handshake**: apply revision X into a -workspace that holds nothing yet, and wait until it is reported applied. Same -operation, empty starting state. - -Which means the Git → live arrow is, in its essentials, already proven. What is *not* -proven is that it works when the target is a kcp workspace rather than a real cluster — -which is risk 2 above, and the reason it is the first thing to spike. - -## What to build, in order - -1. **Spike: point Flux at a kcp workspace.** Hydrate one corpus fixture, close the - acknowledgment handshake, edit an object, get a commit. This is the load-bearing - unknown; everything else is downstream of it. If Argo CD cannot register a workspace, - that is worth knowing before the product assumes it can. -2. **`requiredAPIs` in the scan report** — free to compute (the walk has already parsed - every `apiVersion`/`kind`), and it is precisely the list the workspace needs before - it can hold anything. -3. **Close the sanitize leaks** — `helm.toolkit.fluxcd.io/`, - `resourceset.fluxcd.controlplane.io/`, `meta.helm.sh/`. Small, and independent of - every decision above. -4. **The provenance gate — but only if the production-cluster topology is really on the - roadmap.** And if it is, key it on the - [measured evidence table](../../facts/expansion-provenance-markers.md), not on - `ownerReference`. It must run **on the live object, before the sanitizer**, because - the sanitizer destroys the very evidence it needs. - -## Open questions - -1. **Can Argo CD manage a kcp workspace at all?** Flux is plausible; Argo's cluster - registration, health assessment, and resource cache make far stronger assumptions - about the API surface. If the answer is no, the intent cluster is Flux-only and the - Argo CD story becomes "we mirror and edit your Argo repos", not "we hydrate into an - Argo-managed workspace". That is still a good product — but it is a different one. -2. **Is the intent workspace per session, per `GitTarget`, or per tenant?** A - long-lived workspace drifts from Git as other people merge, and nothing here - reconciles it. Re-hydration on branch change is the obvious answer; what happens to - an in-flight edit is not. -3. **Does the fan-in = 1 rule hold for a field of a document?** A `ResourceSet`'s - `spec.inputs[j]` has fan-in 1 and is the right edit surface; `spec.resources[i]` has - fan-in N. Both are fields of the *same file*. The write boundary is currently - specified over files, and this is the first construct that makes the distinction - matter. -4. **If the gate is answered by topology in kcp, is it worth building at all?** The - honest answer depends on question 1 in - [decision 1](expansion-boundary-and-corpus-organisation.md) — whether "edit your - real production cluster" is a launch topology or an eventual one. It is currently - listed as supported, and that is what makes the gate mandatory rather than optional. diff --git a/docs/design/support-boundary/README.md b/docs/design/support-boundary/README.md new file mode 100644 index 00000000..e17762be --- /dev/null +++ b/docs/design/support-boundary/README.md @@ -0,0 +1,180 @@ +# The support boundary: what GitOps Reverser edits, and what it refuses + +> **design** — the reasoning behind the operator's acceptance boundary. Captured 2026-07-06. +> +> **New here? Read [support-contract.md](support-contract.md) first** — it is the one +> page that states what we support, what we refuse, and why. Every other doc in this +> folder *argues for* one of those verdicts. This README is the index and the summary. + +## The folder, by topic + +| Topic | Docs | +|---|---| +| **The boundary** | [support-contract.md](support-contract.md) — the single statement · [kustomize-support-boundary.md](kustomize-support-boundary.md) — field taxonomy + layout allowlist · [gittarget-granularity-and-cross-environment-edits.md](gittarget-granularity-and-cross-environment-edits.md) — **the write boundary; the one home of fan-in = 1** | +| **Orchestrators & expansion** | [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md) — renderability vs ownership; claims about paths · [expansion-boundary-and-corpus-organisation.md](expansion-boundary-and-corpus-organisation.md) — provenance; ApplicationSet vs ResourceSet; Helm · [`../../facts/expansion-provenance-markers.md`](../../facts/expansion-provenance-markers.md) — **the measured markers** · [argocd-bi-directional.md](argocd-bi-directional.md) — why `selfHeal` is incompatible | +| **Documents & secrets** | [resource-capability-model.md](resource-capability-model.md) — what may I do to this document · [write-only-encrypted-secrets.md](write-only-encrypted-secrets.md) — SOPS · [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md) | +| **Edits with no home** | [unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md) | +| **Discovery (read-only)** | [repo-discovery-and-onboarding-scan.md](repo-discovery-and-onboarding-scan.md) | +| **Shipped** | [finished/images-and-replicas-edit-through.md](finished/images-and-replicas-edit-through.md) · [finished/higher-level-krm-documents.md](finished/higher-level-krm-documents.md) | +| **Evidence** | [`test/fixtures/gitops-layouts/`](../../../test/fixtures/gitops-layouts/) — the corpus of real-world repo shapes, and the generated behavioural baseline beside it | +| **Foundations** | [current-manifest-support-review.md](../../spec/current-manifest-support-review.md) · [contextual-namespace-and-kustomize-folder-editing.md](../../spec/contextual-namespace-and-kustomize-folder-editing.md) · [gittarget-new-file-placement-rules.md](../../spec/gittarget-new-file-placement-rules.md) | + +## What the operator is for + +A user points GitOps Reverser at a Git folder holding **Kubernetes Resource Model (KRM) +documents** — core resources, custom resources, simple Kustomize folders, and +higher-level intent documents such as a Flux `HelmRelease`, an Argo CD `Application`, a +KRO `ResourceGraphDefinition`, or a Crossplane claim. The user edits those resources +through the Kubernetes API, and the operator writes the changes back to a named branch. + +The operator's job stops at the branch. It watches live state, edits the folder the way +a careful human would — in place, comment-preserving, refusing what it cannot own — +pushes to a named branch, and exposes pollable status (`CommitRequest` `Pushed=True` + +`status.sha` + `status.branch`). It never gains Git-host knowledge: no GitHub or GitLab +API calls, and no pull requests. A tool built on top of the operator owns session and +branch lifecycle, PR creation, and any UI. + +Repo-wide *discovery* is likewise not the operator's job. A `GitTarget` is told exactly +one subtree and never goes looking for others. Enumerating candidate targets across a +whole repository is a read-only capability of the `manifest-analyzer` CLI and the public +[`pkg/manifestanalyzer`](../../../pkg/manifestanalyzer) library, which write nothing and +need no cluster — see +[repo-discovery-and-onboarding-scan.md](repo-discovery-and-onboarding-scan.md). + +## The governing rule + +Every decision in this folder answers one question: + +> **Does this live object have exactly one home in Git?** + +If yes, GitOps Reverser mirrors it and writes edits back to that home. If no, the object +is expansion output, shared context, machine-written Git, or opaque content — and the +operator refuses or withholds it for a specific, named reason. That refusal is the +support contract, not a gap. + +```mermaid +flowchart LR + subgraph git["Git: intent layer"] + P["plain KRM file"] + K["kustomize overlay"] + H["HelmRelease / Application"] + R["ResourceSet / ApplicationSet template"] + end + + subgraph apply["Appliers: source is files"] + KC["kustomize-controller"] + AC["argocd-controller"] + end + + subgraph expand["Expanders: source is a template or chart"] + HC["helm-controller"] + FO["flux-operator"] + AS["applicationset-controller"] + end + + P --> KC --> O1["live Deployment
home exists"] + K --> KC --> O2["live Service
home exists"] + P --> AC --> O3["live ConfigMap
home exists"] + H --> HC --> O4["rendered chart object
no home"] + R --> FO --> O5["ResourceSet child
no home"] + R --> AS --> O6["generated Application
no home"] + + classDef editable fill:#dfd,stroke:#3a3,color:#111 + classDef refused fill:#fdd,stroke:#c33,color:#111 + class O1,O2,O3 editable + class O4,O5,O6 refused +``` + +The same rule governs ordinary write fan-in: a source document shared by more than one +render root is read-only context, because changing it would change more than one thing. +Lossy or one-way constructs — arbitrary patches, generator outputs, name prefixes, Helm +inflation, controller-expanded children — stay out of the write path. + +Two consequences are worth stating plainly, because both are routinely misread: + +**Higher-level documents are in scope as KRM, not as special cases.** "No Helm" is true +of *inflation*: `helmCharts` is refused and we never render a chart. But a Flux +`HelmRelease`, an Argo CD `Application`, a KRO `ResourceGraphDefinition`, a Crossplane +claim, or a plain `Deployment` is just a KRM document. Editing the intent document is in +scope; editing the objects that document expands is not. Bumping a chart version or +changing inline values on a `HelmRelease` is ordinary KRM editing; editing a chart's +`templates/`, or a live object rendered from a chart, stays refused. + +**Generator-enumerated repositories are recognised and refused explicitly.** +ApplicationSet `git.directories` and `ResourceSetInputProvider` make "create a folder" +part of desired state. In such a repository, authoring a CR as well can create a +duplicate object that fights the generator, while omitting it would be wrong in an +ordinary layout. The operator therefore refuses "add an app" for an `EnumeratedBy` shape +rather than guessing. + +## What works today + +- **Raw-YAML folders** (explicit namespaces): in-place, comment-preserving edits; + match-first placement; mark-and-sweep resync. +- **Single-context Kustomize folders** (`namespace:` + `resources:`/`bases`, local files + and child-directory bases): graph-aware namespace inference; inherited namespaces are + kept out of the file bytes on write. +- **Kustomize `images:` / `replicas:` edit-through** — a live change produced by an + override entry is written back to that entry, never through into the source manifest + ([finished/images-and-replicas-edit-through.md](finished/images-and-replicas-edit-through.md)). +- **Higher-level KRM documents** (Flux `HelmRelease`, Argo CD `Application`, KRO + resources) mirror and edit exactly like core resources — the pipeline is kind-agnostic, + and is pinned by a corpus plus a HelmRelease mirror+edit e2e + ([finished/higher-level-krm-documents.md](finished/higher-level-krm-documents.md), + [installing-apps-as-krm.md](../../installing-apps-as-krm.md)). +- **New-file placement** — sibling inference plus a `spec.placement` template, so a new + resource lands in the folder's convention rather than a canonical REST path, including + the `resources:` entry when the target folder carries a kustomization + ([gittarget-new-file-placement-rules.md](../../spec/gittarget-new-file-placement-rules.md)). +- **Branch writing**: `GitTarget.spec.branch` (immutable, glob-authorized via + `GitProvider.spec.allowedBranches`); `CommitRequest` as the per-save control surface + with terminal `Pushed=True` + SHA. +- **Refusals**: unsupported kustomize features, duplicate identities, impure or foreign + content — refuse first, never mis-edit. +- **The two-layer write boundary**, enforced as write-plan preconditions before any byte + is written: **L1** — no write leaves `spec.path` (reads may, writes never); **L2** — no + in-place edit of a source file that more than one kustomize render path reaches with + override entries at stake (write-fan-in = 1). A violation aborts the whole flush, + commits nothing, and fails the GitTarget with `GitPathAccepted=False` / reason + `WriteBoundaryRefused` — on the live-event path as well as on resync. Specified in + [gittarget-granularity-and-cross-environment-edits.md §1](gittarget-granularity-and-cross-environment-edits.md). + The refusal is target-level; the per-edit `FullyReflected` accounting that would name + each dropped edit is designed and unbuilt + ([unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md)). +- **Repo-wide read-only reports**: `ScanRepo` / `manifest-analyzer --mode scan-repo` + classify candidate folders and feed the generated + [`test/fixtures/gitops-layouts/support-today.md`](../../../test/fixtures/gitops-layouts/support-today.md) + baseline. It reports; it does not propose CRs. + +## Known boundary: what stays refused + +Classic base + per-environment overlay repositories are refused today on two independent +gates: any overlay feature outside the supported subset (`patches*`, generators, +`components`, `namePrefix`/`nameSuffix`, Helm, remote bases), and multi-root namespace +fan-out over a shared base (`ambiguous-namespace`). + +The *feature* half of that is the permanent part of the contract. `patches*`, generators, +`components`, name prefixes, Helm rendering, and remote bases refuse the folder because +they are structurally non-invertible or would make an edit ambiguous — not because the +work is unfinished. The taxonomy that decides which is which is +[kustomize-support-boundary.md §1](kustomize-support-boundary.md). + +The *layout* half is where the boundary can still move: render-root scoping would let an +un-fancy base+overlay folder (per-overlay `namespace` + `resources`/`images`/`replicas`) +be accepted, with new overlay-local KRM added to `resources:` and the base read-only +always. That is designed, not shipped. A per-environment edit of a base-owned *field* — +the `kubectl set env` case — has no legal destination without operator-authored patches; +today it is *prevented* rather than written into the base, and the GitTarget is failed +with `WriteBoundaryRefused`. + +The expansion boundary is separate from the Kustomize boundary. A `HelmRelease`, +`ApplicationSet`, `ResourceSet`, KRO graph, or Crossplane composition can itself be an +editable KRM document, but the objects it materialises are **not mirrored** unless they +have their own file home in Git. The derived-object gate cannot key on `ownerReference` +alone; measured Flux and Argo evidence shows it must be a provenance claim over live +objects, taken before sanitization +([`../../facts/expansion-provenance-markers.md`](../../facts/expansion-provenance-markers.md)). + +Helm charts are skipped as a unit, including `crds/`, once recognised by chart folder +structure. Reporting a chart's incidental `crds/` directory as "one supported folder" is +a report bug, not a capability. diff --git a/docs/design/gitops-api/argocd-bi-directional.md b/docs/design/support-boundary/argocd-bi-directional.md similarity index 100% rename from docs/design/gitops-api/argocd-bi-directional.md rename to docs/design/support-boundary/argocd-bi-directional.md diff --git a/docs/design/gitops-api/expansion-boundary-and-corpus-organisation.md b/docs/design/support-boundary/expansion-boundary-and-corpus-organisation.md similarity index 88% rename from docs/design/gitops-api/expansion-boundary-and-corpus-organisation.md rename to docs/design/support-boundary/expansion-boundary-and-corpus-organisation.md index d833d1b0..d6de57f6 100644 --- a/docs/design/gitops-api/expansion-boundary-and-corpus-organisation.md +++ b/docs/design/support-boundary/expansion-boundary-and-corpus-organisation.md @@ -8,11 +8,10 @@ > Related: > [README.md](README.md), > [support-contract.md](support-contract.md), -> [the-layer-above-and-the-expansion-graph.md](the-layer-above-and-the-expansion-graph.md) — **the architecture this axis serves**, > [../../facts/expansion-provenance-markers.md](../../facts/expansion-provenance-markers.md) — **the measurements**, > [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md), > [resource-capability-model.md](resource-capability-model.md), -> [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md), +> [kustomize-support-boundary.md](kustomize-support-boundary.md), > [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md), > the layout corpus at [`test/fixtures/gitops-layouts/`](../../../test/fixtures/gitops-layouts/) @@ -24,8 +23,7 @@ spec ([`test/e2e/provenance_markers_e2e_test.go`](../../../test/e2e/provenance_m `task test-e2e-bi-directional`). Three things moved: 1. **The structural claim held, and is now proven** — ApplicationSet generates - *pointers into Git*, ResourceSet generates *the KRM itself*. See - [the graph](the-layer-above-and-the-expansion-graph.md). + *pointers into Git*, ResourceSet generates *the KRM itself*. 2. **The `ownerReference` gate is worse than "incomplete" — it catches one producer in five.** Neither HelmRelease-rendered objects nor ResourceSet children carry an `ownerReference` *at all*. Defect 1 below is stronger than it was written. @@ -127,9 +125,9 @@ docs are candid about the consequence, describing ResourceSet image automation a suitable for **"Gitless GitOps"** workflows where "instead of pushing changes to a Git repository, the updates are applied directly to the cluster." -The product consequence: **for an ApplicationSet repo we can round-trip the -workloads; for a ResourceSet repo there are no workload files to round-trip.** The -ResourceSet CR is the only artifact. +The consequence for this operator: **for an ApplicationSet repo we can round-trip +the workloads; for a ResourceSet repo there are no workload files to round-trip.** +The ResourceSet CR is the only artifact. ### The generator family, side by side @@ -303,8 +301,8 @@ delete intent. ## The construct catalogue — the support statement -This is the artifact I think the branch is missing: one table a PM, a user, or an -onboarding report can be checked against. Five verdicts, deliberately few: +This is the artifact I think the branch is missing: one table a user, a maintainer, +or an onboarding report can be checked against. Five verdicts, deliberately few: | Verdict | Meaning | |---|---| @@ -319,28 +317,28 @@ onboarding report can be checked against. Five verdicts, deliberately few: | Construct | Layer | Verdict | Why | |---|---|---|---| | Plain KRM folder | intent | **Editable** | files *are* the objects — the first-class target | -| Argo CD `Application` (hand-written) | intent | **Editable** | ordinary KRM (F7) | +| Argo CD `Application` (hand-written) | intent | **Editable** | ordinary KRM — shipped | | Argo CD `Application` generated by an ApplicationSet | expansion | **Not mirrored** | `ownerReference`; no home file | | Argo CD `ApplicationSet` (the CR) | intent | **Editable as a document** | but its `template` is a fan-out surface — see below | | App-of-apps root `Application` | intent | Editable, flagged **cluster entry point** | not an onboarding answer | | Flux `Kustomization`, `GitRepository`, `OCIRepository`, `HelmRepository` | intent | **Editable** | ordinary KRM | -| Flux `HelmRelease` | intent | **Editable** | shipped, F7 | +| Flux `HelmRelease` | intent | **Editable** | ordinary KRM — shipped | | Objects the helm-controller renders from it | expansion | **Not mirrored** | no home file | | flux-operator `ResourceSet` (the CR) | intent | **Editable as a document** | `spec.inputs` is the supported edit surface | | Objects a `ResourceSet` expands | expansion | **Not mirrored** | `spec.resources` × inputs; no home file | | flux-operator `ResourceSetInputProvider` | intent | **Editable** | but `status.exportedInputs` is live-only and unwritable | | flux-operator `FluxInstance` | intent | Editable, flagged **cluster entry point** | manages Flux itself | -| KRO `ResourceGraphDefinition` / Crossplane `Composition` + claims | intent | **Editable** | ordinary KRM (F7 covers KRO) | +| KRO `ResourceGraphDefinition` / Crossplane `Composition` + claims | intent | **Editable** | ordinary KRM — KRO is shipped and pinned by the corpus | | Objects they expand | expansion | **Not mirrored** | no home file | ### Rendering | Construct | Verdict | Why | |---|---|---| -| kustomize: `resources`, `namespace`, `images`, `replicas` | **Editable** | invertible; F1 ships `images`/`replicas` edit-through | -| kustomize base + un-fancy overlays | **Editable at launch (F2)** | base is read-only context | +| kustomize: `resources`, `namespace`, `images`, `replicas` | **Editable** | invertible; `images`/`replicas` edit-through is shipped | +| kustomize base + un-fancy overlays | **Editable — planned** | not supported today; the base is read-only context, and render-root scoping is unbuilt | | kustomize base shared by >1 overlay, edited in place | **Refused** | write-fan-in > 1 (L2) | -| kustomize `patches*`, generators, `components`, `namePrefix`/`nameSuffix`, remote bases | **Refused** | non-invertible; F3 addresses patches | +| kustomize `patches*`, generators, `components`, `namePrefix`/`nameSuffix`, remote bases | **Refused** | non-invertible; restricted patch authoring is planned, the rest are permanently refused | | kustomize `helmCharts:` (inflation) | **Refused** | we never render a chart | | Helm chart (the whole folder: `Chart.yaml` + `templates/` + `values.yaml` + `crds/`) | **Skipped as a unit** | decision 4 — detect the chart by its folder structure and skip it whole; report it as a `helm-chart` layout, not as silence | | Flux `HelmRelease` / Argo `Application` Helm knobs (chart version, inline values, parameters) | **Editable** | the Helm surface people actually use — see the Helm section below | @@ -360,7 +358,7 @@ onboarding report can be checked against. Five verdicts, deliberately few: ## Why we must understand generators without running them -The launch use case is *"add something to the test environment."* Generators change +The central use case is *"add something to the test environment."* Generators change **the recipe for adding a thing**, and getting the recipe wrong is not a degradation — it produces a duplicate object that fights the controller. @@ -370,7 +368,7 @@ applies: | Repo shape | To add an app you must… | Getting it wrong produces | |---|---|---| | App-of-apps, Flux `Kustomization`-per-app | add the manifests **and** author the `Application`/`Kustomization` CR | nothing deploys | -| Kustomize folder | add the manifests **and** the `resources:` entry | nothing deploys (F4 handles this) | +| Kustomize folder | add the manifests **and** the `resources:` entry | nothing deploys (new-file placement handles this today) | | ApplicationSet `git.directories`, ResourceSetInputProvider | add the manifests / an input **and author no CR** — the generator picks it up | a **duplicate** `Application` that fights the generator | The third row is why the corpus keeps asking *"is creating a folder itself a @@ -408,8 +406,8 @@ render paths: | `ResourceSet.spec.inputs[j].version` | 1 | **editable** — this is the right edit surface | That is a satisfying result: the boundary we already enforce for kustomize bases is -the *same* boundary, and it lands in the right place for ResourceSets. "Bump -tenant2's version" is an edit to `spec.inputs[1]`, which has fan-in 1. "Change the +the *same* boundary, and it lands in the right place for ResourceSets. "Bump one +input's version" is an edit to `spec.inputs[1]`, which has fan-in 1. "Change the template" does not, and never will. The honest caveat: a fan-in-1 edit into `spec.resources[i]` is an edit to a KRM @@ -421,15 +419,16 @@ and ResourceSet/KRO/Crossplane make it mainstream rather than hostile. The flux-operator guides present ResourceSet as a **replacement for base + overlays** — their own example replaces an `apps/app1/{base,overlays/tenant1,overlays/tenant2}` -tree with "a single file." That tree is exactly the layout **F2 exists to -support**. +tree with "a single file." That tree is exactly the layout **render-root scoping +exists to support**. -So: to the extent ResourceSets succeed, the repositories F2 targets get replaced by -repositories whose workload KRM is not in Git as files at all. That does not make -F2 wrong — the base+overlay corpus is enormous and will be for years — but it does -mean the ResourceSet answer ("edit the CR, edit its inputs, never its children") is -a **launch-relevant** story rather than a future one, and it is a story we can tell -well and cheaply, because the CR is one editable document. +So: to the extent ResourceSets succeed, the base+overlay repositories we are +building render-root scoping for get replaced by repositories whose workload KRM is +not in Git as files at all. That does not make render-root scoping wrong — the +base+overlay corpus is enormous and will be for years — but it does mean the +ResourceSet answer ("edit the CR, edit its inputs, never its children") is a story +we need **now** rather than eventually, and it is a story we can tell well and +cheaply, because the CR is one editable document. ## The organisation — done (2026-07-13) @@ -490,39 +489,31 @@ one **missing chapter**: | **Add** | `support-contract.md` | The construct catalogue above, and nothing else. The one page that answers "what do you support?" Today that answer is asserted in 17 places, in 3 unrelated refusal vocabularies, and assembled nowhere. | | **Add** | this doc, or a successor | The expansion axis, the generator family, `EnumeratedBy`. Currently ApplicationSet appears only as a non-goal, and ResourceSet appears nowhere at all. | | **Consolidate** | the write-fan-in invariant | Stated four times (`kustomize-support` §4, `gittarget-granularity` §1, `README`, `unreflectable-edits`). `gittarget-granularity` §7 already asks whether to fold these; the answer is yes — keep §1, have the rest cite it. | -| **Consolidate** | the `--dry-run=server` evidence table | Duplicated near-verbatim in `resource-capability-model.md` and `intent-cluster-hydration.md`. One home, one citation. | | **Amend** | `resource-capability-model.md` knob 4, `sealed-secrets-and-external-secrets.md` "The gate" | `derived` cannot key on `ownerReference` alone. It is a Tier 2 provenance claim, not a Tier 0 field check. | -| **Restructure** | `README.md` "Related:" | Group by topic (boundary / product model / orchestrator / secrets / topology / features) instead of a flat list of nine links. | +| **Restructure** | `README.md` "Related:" | Group by topic (boundary / orchestrator / secrets / topology) instead of a flat list of nine links. | -Nothing gets deleted, and no doc gets rewritten. The two consolidations are -cross-reference edits, not merges. +Nothing gets deleted, and no doc gets rewritten. The consolidation is a +cross-reference edit, not a merge. ## Decisions (2026-07-11) The five questions this doc opened have been answered. Recorded here; the ones that change another doc are flagged. -### 1. The intent cluster runs **both** ways — design for both +### 1. The operator must hold in **both** kinds of watched cluster -An intent cluster may be a **lightweight, workload-less cluster** or **an actual -production cluster**. Both are supported topologies, so the design must hold in -both. That resolves the gate question decisively: +The cluster the operator watches may be a **lightweight, workload-less cluster** +whose only job is editing, or **an actual production cluster**. Both are supported, +so the design must hold in both. That resolves the gate question decisively: -| Intent-cluster mode | Is flux-operator / ApplicationSet running? | Consequence | +| Watched cluster | Is flux-operator / ApplicationSet running? | Consequence | |---|---|---| -| Lightweight control cluster | **No** — CRDs only, per the standing rule ("install a controller only if it is an applier you drive"). A `ResourceSet` expander is not an applier we drive. | Children never materialise. The `ResourceSet` CR sits there inert and editable. Nothing to gate. | +| Lightweight editing cluster | **No** — CRDs only, per the standing rule ("install a controller only if it is an applier you drive"). A `ResourceSet` expander is not an applier we drive. | Children never materialise. The `ResourceSet` CR sits there inert and editable. Nothing to gate. | | Production cluster | **Yes** | Children materialise as live objects. **The provenance gate is mandatory** — without it we mirror them and create a second source of truth. | -So the gate is **not optional**: the production-cluster mode requires it. And in the -lightweight mode the CR is cleanly editable with no expansion layer at all, which -is the better editing experience and worth saying out loud. - -Hydration of the lightweight cluster is guaranteed to have **both Argo CD and Flux -available**, so it always starts from clean data. That closes the "untested with -Argo CD" caveat in -[intent-cluster-hydration.md](intent-cluster-hydration.md) as a *product* matter — -the Argo CD handshake still needs proving in e2e, but we will never be forced to -hydrate without a working applier. +So the gate is **not optional**: the production-cluster case requires it. And where +no expansion controller runs, the CR is cleanly editable with no expansion layer at +all, which is the better editing experience and worth saying out loud. ### 2. Fan-in = 1 stays the ground rule @@ -583,7 +574,7 @@ today: | Change a value | `Application.spec.source.helm.parameters` | ✅ **works today** (structured) | | Change a value | `Application.spec.source.helm.values` | ⚠️ works, but the field is an embedded YAML **string** — a blob, not a tree | | Change a value held in a `ConfigMap` (`valuesFrom`) | a real `ConfigMap` | ✅ **works today** — it is KRM like anything else | -| Install a chart / add an app | add a `HelmRelease` + `HelmRepository`/`OCIRepository` | ✅ **works today** (F4 placement) | +| Install a chart / add an app | add a `HelmRelease` + `HelmRepository`/`OCIRepository` | ✅ **works today** (new-file placement) | | Change a value in a free-standing values file | `values/production.yaml` | ❌ **the gap** — not KRM, so no object exists to edit | | Edit the chart's `templates/` | chart source | ❌ refused, permanently — and correctly | | Edit a rendered object | live only | ❌ not mirrored (expansion layer) | @@ -593,14 +584,14 @@ Read that table and the honest headline is not "no Helm." It is: > **We support Helm the way GitOps repositories actually use it — as a declaration > you edit, not a chart you render.** The most common Helm operation in a GitOps > repo is "bump the chart version" or "change a value on a `HelmRelease`", and both -> have worked since F7. +> work today. ### The one real gap, and the precedent that closes it The genuine hole is the **free-standing values file** — `values/production.yaml`, `values/common.yaml` — which `helm-environment-values`, `argocd-external-helm`, and `argocd-multicluster-matrix` are all built around. It is -not KRM, so nothing hydrates it into the intent cluster, so there is no object for -a user to edit. +not KRM, so no object for it ever appears in the cluster, so there is nothing for a +user to edit. There is an exact precedent for this in the branch already: [`EncryptedSecret`](write-only-encrypted-secrets.md) projects a document we cannot @@ -622,17 +613,17 @@ proposing rather than just noting: - It is **not chart inflation** — the boundary that must never move. We still never render `templates/`, and we still never learn what a value *means*. -This deserves a ladder entry rather than a decision here, and it is the single +This deserves a design of its own rather than a decision here, and it is the single highest-leverage thing available for the Helm story: it turns the biggest "we do nothing with Helm" objection into a supported edit, using a pattern already designed for another problem. ### What a "helm-lite" recommendation *can* be -Not a standard — a **migration recommendation in the onboarding report**. F8 can -honestly say: *"this repository keeps its values in free-standing files; these three -are shared and cannot be edited; these four are single-use and can."* That is a -report, not a standard, and it is achievable. +Not a standard — a **migration recommendation in the onboarding report**. The +onboarding scan can honestly say: *"this repository keeps its values in +free-standing files; these three are shared and cannot be edited; these four are +single-use and can."* That is a report, not a standard, and it is achievable. ## Residual open questions @@ -640,11 +631,7 @@ report, not a standard, and it is achievable. **Closed.** The `selfHeal: false` + push-webhook loop, with a shared field changing from *both* sides, is exercised against a real Argo CD in the bi-directional corner ([`argocd_bi_directional_e2e_test.go`](../../../test/e2e/argocd_bi_directional_e2e_test.go)), - alongside its `selfHeal: true` foil where the edit is lost. What remains untested is - not the handshake but its *target*: whether either engine can drive a **kcp - workspace** rather than a real cluster. That is now the largest untested assumption, - and it has moved to - [the-layer-above-and-the-expansion-graph.md](the-layer-above-and-the-expansion-graph.md). + alongside its `selfHeal: true` foil where the edit is lost. 2. **What exactly makes a chart a chart?** Decision 4 says "recognisable folder structure." `Chart.yaml` + `templates/` is the obvious test, but `mixed-and-hostile` plants a `templates/` directory with **no** `Chart.yaml` and unparseable content @@ -657,13 +644,12 @@ report, not a standard, and it is achievable. which is stripped even earlier and is not in the sanitized document at all. **The gate must run on the live object, before the sanitizer**, and nothing in the pipeline is structured that way today. -4. **Is the gate worth building at all?** New, and it follows from the architecture: in - a kcp intent workspace there are no expansion controllers, so nothing derives - anything and the gate is answered by the topology. The gate is mandatory only for - the *production-cluster* topology, which decision 1 lists as supported. Whether that - topology is a launch commitment or an eventual one is what prices this entire - workstream — see - [the-layer-above-and-the-expansion-graph.md](the-layer-above-and-the-expansion-graph.md). +4. **When does the gate have to exist?** New, and it follows from the topology: in a + watched cluster with no expansion controllers installed, nothing derives anything, + and the question is answered by the deployment rather than by code. The gate is + mandatory only for the *production-cluster* case — which decision 1 lists as + supported, so it must be built; what remains open is how much of it a + controller-free watched cluster is entitled to skip. 5. **KRO and Crossplane are still unmeasured.** Their markers are inferred (from our own strip list, in KRO's case). Given that three of the five measured producers contradicted what was assumed about them, inference is not good enough here. They are diff --git a/docs/design/gitops-api/finished/f7-higher-level-krm-documents.md b/docs/design/support-boundary/finished/higher-level-krm-documents.md similarity index 79% rename from docs/design/gitops-api/finished/f7-higher-level-krm-documents.md rename to docs/design/support-boundary/finished/higher-level-krm-documents.md index eb0a227c..95341110 100644 --- a/docs/design/gitops-api/finished/f7-higher-level-krm-documents.md +++ b/docs/design/support-boundary/finished/higher-level-krm-documents.md @@ -1,20 +1,20 @@ -# F7: Higher-level KRM objects as first-class documents +# Higher-level KRM objects as first-class documents > Status: shipped ([#203](https://github.com/ConfigButler/gitops-reverser/pull/203)) — -> corpus + e2e pins landed with this doc; **no product code changed** (the guarantee -> already held; F7 makes it load-bearing). Filed under `finished/`. +> corpus + e2e pins landed with this doc; **no operator code changed** (the guarantee +> already held; this work makes it load-bearing). Filed under `finished/`. > Captured: 2026-07-07 > Related: > [../README.md](../README.md), -> [../kustomize-support-boundary-and-product-model.md](../kustomize-support-boundary-and-product-model.md), -> [f1-images-replicas-edit-through.md](f1-images-replicas-edit-through.md), +> [../kustomize-support-boundary.md](../kustomize-support-boundary.md), +> [images-and-replicas-edit-through.md](images-and-replicas-edit-through.md), > [../../../future/idea-application-editing.md](../../../future/idea-application-editing.md), > [../../../architecture.md](../../../architecture.md) ## Premise: the pipeline is already kind-agnostic -The launch pitch is "install an app = add a KRM document, roll out a version = -edit a field" and it must hold for the objects platform teams actually deploy: +The promise is *install an app = add a KRM document; roll out a version = edit a +field*, and it must hold for the objects platform teams actually deploy: Flux `HelmRelease`, Flux `Kustomization`, Argo CD `Application`, KRO resources, and plain core objects. That already works, because **nothing in the write path carries a per-kind allowlist**: @@ -46,10 +46,10 @@ default-allowed. The remaining kind-specific branches are **write-safety** and - Sensitive types (core `Secret` plus configured types) are encrypted before they touch the worktree. A `HelmRelease`/`Application`/KRO instance is not sensitive by default, so it writes plaintext like any document. -- The `/scale` subresource route and the kustomize `images:`/`replicas:` - override route ([F1](f1-images-replicas-edit-through.md)) apply to specific - shapes. A control-plane CR hits neither and takes the ordinary in-place patch - path. +- The `/scale` subresource route and the kustomize + [`images:`/`replicas:` override route](images-and-replicas-edit-through.md) + apply to specific shapes. A control-plane CR hits neither and takes the + ordinary in-place patch path. - `status` is stripped from every mirrored object and status-only churn is deduped, so a controller reconciling the CR does not produce spurious commits (`internal/sanitize/marshal.go`, `internal/watch/target_watch.go`). @@ -58,19 +58,20 @@ This kind-agnosticism is **already e2e-proven for a generic CRD**: the icecream-order lifecycle spec installs an arbitrary CRD and pins create→file / update→file / delete→file-removed with `status` never committed ([../../../../test/e2e/crd_lifecycle_e2e_test.go](../../../../test/e2e/crd_lifecycle_e2e_test.go)). -What F7 adds is the same proof for a **named, real higher-level control-plane -type** (Flux `HelmRelease`) plus the un-installed kinds at the unit level. +What this work adds is the same proof for a **named, real higher-level +control-plane type** (Flux `HelmRelease`) plus the un-installed kinds at the +unit level. So a Flux `HelmRelease`, a Flux `Kustomization`, an Argo CD `Application`, a KRO `ResourceGraphDefinition` or its generated instance, and a plain `Deployment` all mirror and edit **identically** — they are KRM documents, and editing KRM -documents is the product surface (README, *"Higher-level products come into -scope as KRM, not as special cases"*). +documents is the whole surface. Higher-level tools come into scope as KRM, not +as special cases. ## Why prove something that already works -F7 is not a code feature; it is the **proof and the promise**. It is -launch-critical for two reasons: +This is not a code feature; it is the **proof and the promise**. It matters for +two reasons: 1. **Regression fence.** "Kind-agnostic" is an *emergent* property of several independent components (watch resolution, the node editor, placement, @@ -78,13 +79,14 @@ launch-critical for two reasons: override heuristic, a placement tweak, a sensitivity default — could quietly break a control-plane CR with no test noticing. A corpus + e2e make the guarantee load-bearing so a regression announces itself. -2. **Marketing the boundary correctly.** The support contract is "we edit KRM +2. **Stating the boundary correctly.** The support contract is "we edit KRM documents; we do not inflate Helm charts." Users conflate "Flux `HelmRelease`" with "Helm." The user docs draw the line: the `HelmRelease` - *document* is first-class; `helmCharts:` *inflation* stays refused (README, - *The governing rule*; kustomize-support-boundary, *"No Helm"*). + *document* is first-class; `helmCharts:` *inflation* stays permanently + refused — see + [../kustomize-support-boundary.md](../kustomize-support-boundary.md). -## What F7 pins +## What this pins ### Coverage split @@ -93,7 +95,7 @@ launch-critical for two reasons: | Flux `HelmRelease` (`helm.toolkit.fluxcd.io/v2`) | ✅ CRD in base e2e cluster | ✅ | | Argo CD `Application` (`argoproj.io/v1alpha1`) | — (CRD not in cluster) | ✅ | | KRO instance, e.g. `PodInfoApp` (`kro.run` group) | — (KRO is demo-only) | ✅ | -| core (`ConfigMap`/`Deployment`) | already pinned (inplace-edit, f4-placement, scale) | already pinned | +| core (`ConfigMap`/`Deployment`) | already pinned (e2e labels `inplace-edit`, `f4-placement`, `scale`) | already pinned | Flux CRDs (`helmreleases.helm.toolkit.fluxcd.io`, `kustomizations.kustomize.toolkit.fluxcd.io`) are established during standard @@ -107,8 +109,8 @@ mirror/edit behavior. ### Live e2e pin — `test/e2e/helmrelease_mirror_edit_e2e_test.go` -Mirrors launch use case 2 ("roll out a new version — a chart version on a Flux -`HelmRelease`"): +Pins the *roll out a new version* case — a chart version on a Flux +`HelmRelease`: 1. A `WatchRule` selecting `helmreleases` → `GitTarget`; create a `HelmRelease` live with `spec.chart.spec.version: X` (its source need not resolve — the @@ -135,18 +137,18 @@ two existing globbed gates then automatically cover them: Each document carries a hand-authored comment and a realistic version/revision field so the gates exercise the properties that matter for these kinds. -## What F7 deliberately does not do +## What this deliberately does not do - **No per-kind semantics.** A `HelmRelease`'s `chartRef`, an `Application`'s `targetRevision`, a KRO field are ordinary scalars; the operator edits the field a human pointed it at, it does not understand chart/app semantics. -- **No chart inflation.** `helmCharts:` in a kustomization stays refused; F7 - mirrors the `HelmRelease` *document*, it never renders a chart. +- **No chart inflation.** `helmCharts:` in a kustomization stays refused; the + operator mirrors the `HelmRelease` *document*, it never renders a chart. - **No new controllers in e2e.** Argo and KRO stay out of the base cluster; adding their CRDs for a live pin is future work, wanted only if the unit-level proof ever proves insufficient. -- **No placement changes.** New-file placement for these kinds is F4's generic - path; F7 adds no kind-specific placement. +- **No placement changes.** New-file placement for these kinds takes the generic + placement path; no kind-specific placement was added. ## Test plan diff --git a/docs/design/gitops-api/finished/f1-images-replicas-edit-through.md b/docs/design/support-boundary/finished/images-and-replicas-edit-through.md similarity index 88% rename from docs/design/gitops-api/finished/f1-images-replicas-edit-through.md rename to docs/design/support-boundary/finished/images-and-replicas-edit-through.md index bff8f7c2..f68ddd38 100644 --- a/docs/design/gitops-api/finished/f1-images-replicas-edit-through.md +++ b/docs/design/support-boundary/finished/images-and-replicas-edit-through.md @@ -1,4 +1,4 @@ -# F1: Kustomize `images:` / `replicas:` edit-through +# Kustomize `images:` / `replicas:` edit-through > Status: shipped ([#198](https://github.com/ConfigButler/gitops-reverser/pull/198)) — > phases A–C landed together with this doc; the ambiguity refusal projection into @@ -6,8 +6,8 @@ > Captured: 2026-07-06 > Related: > [../README.md](../README.md), -> [../../manifest/contextual-namespace-and-kustomize-folder-editing.md](../../../spec/contextual-namespace-and-kustomize-folder-editing.md), -> [../../../../internal/git/manifestedit/DECISION.md](../../../../internal/git/manifestedit/DECISION.md) +> [contextual-namespace-and-kustomize-folder-editing.md](../../../spec/contextual-namespace-and-kustomize-folder-editing.md), +> [manifestedit/DECISION.md](../../../../internal/git/manifestedit/DECISION.md) ## Problem @@ -59,20 +59,20 @@ component is applied to its supplier: already present on an entry that already matches. It never adds or removes `images:`/`replicas:` entries, never adds missing fields (`newTag` on an entry that lacks it), and never creates a kustomization file. The human - declares where the knob lives; the operator turns the knob. "Should env - drift become a new override?" is F2/F3 policy, not F1. + declares where the knob lives; the operator turns the knob. Whether drift in + one environment should *create* a new override entry is a separate policy + question, and is not supported. 2. **Unambiguous context only.** Override routing applies when every supported render root that reaches the document applies an identical override chain. Distinct chains from multiple roots emit an `ambiguous-kustomize-overrides` - diagnostic and fall back to today's write-through (no behavior regression; - F2's render-root scoping resolves this case properly). + diagnostic and originally fell back to plain write-through. - > **Superseded (Track-1 write boundary).** The write-through fallback is gone. + > **Superseded (write boundary).** The write-through fallback is gone. > A planned write into a file flagged `ambiguous-kustomize-overrides` now > refuses the flush (`write-fan-in`) and fails the GitTarget with > `WriteBoundaryRefused`; nothing is committed. See > [../gittarget-granularity-and-cross-environment-edits.md §1](../gittarget-granularity-and-cross-environment-edits.md). - > F2 render-root scoping still generalizes the check. + > Per-render-root scoping would generalize the check; it is not built. 3. **Acceptance tightens only for garbage.** A kustomization whose `images:` or `replicas:` value is present but not structurally parseable (not a list of maps, missing `name`, non-string image fields, non-integer count) is @@ -167,17 +167,17 @@ object, and the override chain, return ## Known limitation: shared entries with divergent live consumers One `images:` entry is a **shared knob**: kustomize rewrites every matching -image in the build, so bumping `newTag` moves all consumers together. F1 -mirrors that faithfully for the normal case — when consumers move together -(the entry is bumped Git-side, or a product bumps "the app version" live for -all of them), the routing is stable and idempotent: the first event updates -the entry, later events for sibling consumers see live == render and do +image in the build, so bumping `newTag` moves all consumers together. The +router mirrors that faithfully for the normal case — when consumers move +together (the entry is bumped Git-side, or a caller bumps "the app version" +live for all of them), the routing is stable and idempotent: the first event +updates the entry, later events for sibling consumers see live == render and do nothing. But if consumers **diverge live** — one Deployment is hot-bumped to a new tag while another keeps the old one — that state is *unrepresentable* in the source layout: one entry cannot hold two tags. No deterministic writer can -mirror it. F1's behavior is then: the entry follows whichever consumer's +mirror it. The behavior is then: the entry follows whichever consumer's change was processed last, and a full resync can alternate the entry between the divergent values (each pass "corrects" it toward a different consumer). The render always matches at least one consumer, never both. @@ -185,15 +185,15 @@ The render always matches at least one consumer, never both. Remedies: align the consumers live, or give each workload its own image name (and entry) so each has its own knob. A cross-consumer consistency refusal at edit time needs the siblings' live state, which the steady-state writer does -not have — batch-wide edit reconciliation is future work, noted for F2. +not have — batch-wide edit reconciliation is not built. -## What F1 deliberately does not do +## What this deliberately does not do - No `kustomize build`, no source maps (Option D remains future research). - No entry creation/deletion, no patch authoring, no `namePrefix`/`nameSuffix` or generator support — the acceptance boundary for those is unchanged. - No multi-root overlay support: base + env1/env2/prod fan-out stays refused - (namespace case) or unrouted (no-namespace case) until F2. + (namespace case) or unrouted (no-namespace case). ## Test plan diff --git a/docs/design/gitops-api/gittarget-granularity-and-cross-environment-edits.md b/docs/design/support-boundary/gittarget-granularity-and-cross-environment-edits.md similarity index 76% rename from docs/design/gitops-api/gittarget-granularity-and-cross-environment-edits.md rename to docs/design/support-boundary/gittarget-granularity-and-cross-environment-edits.md index bf1ca090..4a30f29d 100644 --- a/docs/design/gitops-api/gittarget-granularity-and-cross-environment-edits.md +++ b/docs/design/support-boundary/gittarget-granularity-and-cross-environment-edits.md @@ -1,30 +1,31 @@ # GitTarget granularity, the write boundary, and cross-environment edits > Status: direction-setting / options. The two forks are decided (§2 → **A**, -> §3 → **product promotion**), and the Track-1 write-boundary hardening they +> §3 → **promotion in the layer above**), and the write-boundary hardening they > gate has **shipped**: L1 and L2 are enforced as write-plan preconditions in > `internal/git/plan_flush.go` and surface as the GitTarget reason -> `WriteBoundaryRefused` (§1). What remains open is F2 render-root scoping and +> `WriteBoundaryRefused` (§1). What remains open is render-root scoping and > the divergence notification sketched in §6. > Captured: 2026-07-09 > Related: > [README.md](README.md), -> [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md) -> (§4 invariant, §5 overlay model, §9 three arrows), +> [kustomize-support-boundary.md](kustomize-support-boundary.md) +> (§4 invariant, §5 overlay model), > [unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md), > [../gitpath-foreign-content-stringency.md](../../spec/gitpath-foreign-content-stringency.md) ## Purpose -Two questions surfaced while scoping F2 that the existing docs do not settle, -and both change what the Track-1 write-boundary hardening should build: +Two questions surfaced while scoping render-root scoping (overlay support) that +the existing docs do not settle, and both changed what the write-boundary +hardening had to build: 1. **Granularity** — is a `GitTarget` allowed at an *overlay* subfolder (`overlays/test`), or only at the *app root* (`apps/podinfo`)? "Manage the higher level as one thing" resolves some problems and creates others. 2. **Cross-environment edits** — the model today makes "change one thing in every environment at once" (bump a version everywhere) deliberately - impossible for the operator (§9). People *will* want it. What is the honest + impossible for the operator. People *will* want it. What is the honest answer? This doc records the inputs already settled, lays out each fork as concrete @@ -38,12 +39,13 @@ These are decided; they frame the forks but are not reopened here. - **The write boundary is two layers.** (§1 below.) **L1** — every path the operator writes is inside the target's write scope (a filesystem jail). **L2** — within the reachable graph, never write a file consumed by more than - one render root (fan-in = 1). Both *were* only emergent; Track 1 made them - explicit write-plan preconditions, checked before any byte is written. + one render root (fan-in = 1). Both *were* only emergent; the hardening made + them explicit write-plan preconditions, checked before any byte is written. - **The admission webhook is a fail-open accelerator, not a correctness layer.** It rejects unsavable edits at `kubectl apply` time for immediate, - *atomic* feedback, but it is opt-in, intent-mode-only, and `failurePolicy: - Ignore`. Correctness rests entirely on the L1/L2 write-plan preconditions + *atomic* feedback, but it is opt-in, never used on a cluster the operator + merely mirrors, and `failurePolicy: Ignore`. Correctness rests entirely on + the L1/L2 write-plan preconditions below: with the webhook off, a write that would leave the jail or touch shared context is still refused before any byte is written. The Tier-2 unreflected-set accounting ([unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md)) @@ -65,20 +67,20 @@ These are decided; they frame the forks but are not reopened here. Both forks below are **decided — this is the user's call**, recorded here: -- **Granularity: Option A for launch; keep the way open for Option C; reject - Option B as the operator write model.** A `GitTarget` is a *write partition* — +- **Granularity: Option A; keep the way open for Option C; reject Option B as the + operator write model.** A `GitTarget` is a *write partition* — one overlay = environment = watch scope = write scope. B is rejected not only on the L1-vs-L2 safety point but because, *even if L2 were perfect*, one target spanning test/acceptance/production muddies authorization, audit, status, and - session lifecycle. "Manage the app as one thing" is a **product grouping** - concern (an aggregate/app concept the product layer can add later over N + review. "Manage the app as one thing" is a **grouping** concern for the layer + above the operator (an aggregate/app concept a tool built on top can add over N targets), never a reason to widen an operator target across environments. -- **Cross-environment editing: product-layer promotion now; Option C later, and +- **Cross-environment editing: promotion in the layer above; Option C later, and only for *shared defaults* — not as the answer to "edit every environment."** C (base-as-variant) edits the shared default/template and reaches only the overlays that do **not** override that field; the honest "set every - environment's effective value" stays the product-layer Git operation (§3a). - Promotion and factor-into-base remain distinct verbs (§3/§4). 3c rejected. + environment's effective value" stays a Git-level operation above the operator + (§3a). Promotion and factor-into-base remain distinct verbs (§3/§4). 3c rejected. The rest of this doc keeps the full option analysis so the decision stays legible; §2 and §3 mark the chosen paths. @@ -124,12 +126,12 @@ and **not built**. Wherever this doc says an edit is "unreflected," read it as (write scope) and treats siblings as non-overlapping — so it must not later fold the wider read scope into ownership. -**Before Track 1:** L1 held only because write paths happened to be built +**Before the hardening:** L1 held only because write paths happened to be built relative to the write root, and L2 was not enforced at all — an ambiguous override chain *warned and wrote through*, and the only thing preventing a shared-file clobber was a coincidental namespace-ambiguity block. -**Now (Track 1, shipped):** both are write-plan preconditions in +**Now (shipped):** both are write-plan preconditions in `writeBatch.flush`, evaluated at the one moment every planned path is known and before any byte is touched, alongside the existing `.gittargetignore` shadow check: @@ -208,11 +210,11 @@ flowchart TB - **Base read-only enforced by L1** (it is outside every write scope — the strong, filesystem guarantee). - Clean identity: environment = GitTarget = namespace = write scope = RBAC - scope. This is what §8/§9 lean on — "propose to test, read-only on prod" is a - namespace RoleBinding, and a session branch is naturally single-environment. -- **Cost:** F2 must teach the analyzer to *follow* `../../base` for reading - (today that reference is dropped). More `GitTarget` objects; onboarding emits - several per app. + scope. It is what makes "propose to test, read-only on prod" a namespace + RoleBinding, and it keeps one branch's changes naturally single-environment. +- **Cost:** render-root scoping must teach the analyzer to *follow* `../../base` + for reading (today that reference is dropped). More `GitTarget` objects; + onboarding emits several per app. ### Option B — Coarse: one target at the app root @@ -242,9 +244,8 @@ flowchart TB ("an edit in test writes base → changes prod"), and any future fan-in blind spot (a shared file with no override entries at stake — see §5) is a corruption rather than a refusal. It also dissolves the clean identity: one - target spans three namespaces, its watch scope is all of them, and a session - branch can mix environments — which muddies RBAC, promotion, and session - lifecycle. + target spans three namespaces, its watch scope is all of them, and one branch + can mix environments — which muddies RBAC, promotion, and review. ### Option C — Fine + base-as-variant @@ -274,7 +275,7 @@ flowchart TB (fan-in = 1 there → writable). The write jail per target is unchanged; ownership stays disjoint. - **Nuance:** `base/` has no namespace, so the base target must inject a - synthetic one (`podinfo-base`) for the intent cluster and strip it on + synthetic one (`podinfo-base`) on the cluster side and strip it on write-back — which is exactly the existing "inherited namespaces are kept out of file bytes on write" behaviour, reused. @@ -285,17 +286,17 @@ flowchart TB | Base kept read-only by | **L1** (filesystem) | **L2** (graph) ⚠ | **L1** | | Read wider than write | yes (`../../base`) | no | yes | | Identity env=target=ns | clean | broken (target spans envs) | clean | -| Session branch scope | one environment | can mix environments | one environment | +| Branch scope | one environment | can mix environments | one environment | | RBAC per environment | namespace RoleBinding | coarse (whole app) | namespace RoleBinding | | Onboarding output | N targets/app | 1 target/app | N+1 targets/app | -| "Edit all envs at once" | product-layer only (§3a) | tempting but unsafe | edit base variant (§3b) | -| New F2 machinery | follow `../../base` reads | none | follow reads + base variant | +| "Edit all envs at once" | only in the layer above (§3a) | tempting but unsafe | edit base variant (§3b) | +| New render-root machinery | follow `../../base` reads | none | follow reads + base variant | ### Decision — Option A now, C kept open, B rejected -**This is the chosen path (2026-07-09):** Option A for launch, Option C as an -additive later step (shared-defaults editing, §3b), and **B rejected as the -operator write model**. +**This is the chosen path (2026-07-09):** Option A, Option C as an additive later +step (shared-defaults editing, §3b), and **B rejected as the operator write +model**. The decisive safety point stands: B makes the *weaker* guarantee (L2 — enforced now, but only as good as our model of the render graph) the only thing between @@ -305,43 +306,43 @@ need L2**: a `GitTarget` should be a **write partition**. Even with a perfect L2, one target spanning test/acceptance/production muddies four things a per-overlay target keeps clean — authorization (RBAC per namespace), audit (who changed which environment), status -(per-environment `Ready`, and the planned per-edit `FullyReflected`), and session -lifecycle (a session -branch is one environment). "Manage the app as one thing" is a *product grouping* -concern — an aggregate/app concept the product layer can add over N targets -later — not a reason to make the operator's write unit span environments. +(per-environment `Ready`, and the planned per-edit `FullyReflected`), and review +(one branch's changes are one environment). "Manage the app as one thing" is a +*grouping* concern for the layer above — an aggregate/app concept a tool built on +the operator can add over N targets — not a reason to make the operator's write +unit span environments. -A is also where the code and docs already point: the product model fixes +A is also where the code and docs already point: the overlay model fixes environment = GitTarget = watch scope = write scope with shared read-only bases -([kustomize-support-boundary-and-product-model.md §5](kustomize-support-boundary-and-product-model.md#L208)), +([kustomize-support-boundary.md §5](kustomize-support-boundary.md)), and the repo scan already classifies an out-of-subtree base as a -forward-looking F2 gap (`overlay-fan-out-needs-f2`), not permanent unsupported +forward-looking gap (`overlay-fan-out-unsupported`), not permanent unsupported structure -([scan_repo.go](../../../internal/manifestanalyzer/scan_repo.go#L37)). A is the +([scan_repo.go](../../../internal/manifestanalyzer/scan_repo.go)). A is the direction of travel; this decision commits to it. **Onboarding UX is not a reason to pick B.** A produces N targets per app, but -object count is a product-presentation problem, not an API-shape problem: the -product layer groups the N targets as one app in its UI. Do not let "one object +object count is a presentation problem, not an API-shape problem: a tool built on +the operator groups the N targets as one app in its UI. Do not let "one object is tidier" pull the write model into B. ## 3. Fork two — "edit N environments at once" Today the operator cannot write the base, so "bump the image everywhere" has no -operator path — it is a product-layer Git computation (§9). That is correct as a -*safety* stance and wrong as a *product* stance: it is a top-three user request. -Three ways to answer it. +operator path — it is a Git-level computation for the layer above. That is correct +as a *safety* stance, but it is a common request, so the honest answer has to be +stated rather than implied. Three ways to answer it. -### 3a. Product-layer Git operation (status quo, §9) +### 3a. A Git-level operation in the layer above (status quo) The user bumps the tag in `test`; the operator lands the one-line -`overlays/test/kustomization.yaml` change; the product offers **promote** / +`overlays/test/kustomization.yaml` change; the layer above offers **promote** / **factor into base** — a pure Git→Git copy/diff that opens a PR. The operator never writes the base. - **Pro:** operator stays minimal; base edits are ordinary reviewed Git changes. -- **Con:** "all at once" is a product feature that must exist, and until it does - the answer is "edit three files." Not an *operator* capability. +- **Con:** "all at once" has to be built somewhere above, and until it is the + answer is "edit three files." Not an *operator* capability. ### 3b. Base-as-variant (Option C): edit the shared default explicitly @@ -355,8 +356,8 @@ The base is hydrated into a synthetic `podinfo-base` namespace that is a ```mermaid sequenceDiagram autonumber - participant U as User / product UI - participant IC as Intent cluster ns podinfo-base + participant U as User / UI + participant IC as Cluster ns podinfo-base participant R as Reverser base GitTarget participant G as Git base/ participant F as GitOps controllers @@ -373,13 +374,13 @@ sequenceDiagram per-environment observations. - **What it is *not*:** the answer to "set every environment's effective value." For any field an overlay overrides, the base edit is shadowed — the honest - every-environment change is the product-layer promotion of §3a. C edits - defaults; promotion sets effective values. + every-environment change is the promotion of §3a, a Git-level operation above + the operator. C edits defaults; promotion sets effective values. - **RBAC / blast radius:** writing `podinfo-base` changes the default under *all* non-overriding environments at once, so it is not just another environment edit — it needs its own **"global/defaults editor"** permission, distinct from per-environment write access. -- **Intent-only semantics to design:** the synthetic base namespace is a virtual +- **Semantics to design:** the synthetic base namespace is a virtual editing surface with no workloads and is never a deploy target. Bases that inject *multiple* namespaces, and **cluster-scoped** resources living in the base, need explicit handling before C can ship — which namespace the virtual surface @@ -394,31 +395,34 @@ plus a logic slip silently writes the base — reintroducing exactly the "edit test changed prod" failure L1 exists to prevent. It also violates fan-in = 1 by design. Listed only to mark it considered and closed. -### Decision — product promotion now, C later for shared defaults +### Decision — promotion in the layer above now, C later for shared defaults -**Chosen (2026-07-09): 3a is the launch answer; 3b (Option C) comes later and +**Chosen (2026-07-09): 3a is the answer today; 3b (Option C) comes later and only for shared-defaults editing; 3c rejected.** The honest "set every -environment's effective value" is the product-layer Git operation — it falls out -of work already done (a tag bump in one overlay is a one-line diff to copy across -overlays). Base-as-variant is added when editing a shared *default* is worth the -virtual-namespace handling, and it is never sold as "edit everywhere." +environment's effective value" is a Git-level operation in the layer above — it +falls out of work already done (a tag bump in one overlay is a one-line diff to +copy across overlays). Base-as-variant is added when editing a shared *default* is +worth the virtual-namespace handling, and it is never sold as "edit everywhere." Keep **two distinct verbs** and never conflate them: -- **Promotion** — copy an *effective* environment change across overlays - (product-layer Git → Git). This is how "make every environment 6.6.1" is done. +- **Promotion** — copy an *effective* environment change across overlays (a + Git → Git operation above the operator). This is how "make every environment + 6.6.1" is done. - **Factor into base** — refactor a shared *default* into `base/` (Option C's - surface, or a product refactor). This changes the template, not necessarily - every effective value. + surface, or a refactor done above the operator). This changes the template, not + necessarily every effective value. ## 4. Worked examples: action → expected output -Fixed action set, acting in `podinfo-test` unless noted, at the **future** launch -scope (F2+F4, no F3) — this table describes where the model is headed, not what -today's binary does. +Fixed action set, acting in `podinfo-test` unless noted, assuming **render-root +scoping** (overlay support — *not* supported today) and no overlay patch +authoring — this table describes where the model is headed, not what today's +binary does. "Unreflected" here means the *designed* Tier-2 outcome: recorded in the -unreflected set, `FullyReflected=False`, reverted by hydration in intent mode +unreflected set, `FullyReflected=False`, and reverted wherever something +re-applies the folder's render ([unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md)). None of that is built. Until it is, an edit with no legal destination either never matches a source document (nothing happens) or trips a write-boundary @@ -431,7 +435,7 @@ precondition and is refused outright (§1). | `kubectl set image deploy/podinfo podinfo=…:6.6.1` | `images:` entry in `overlays/test/kustomization.yaml` | | `kubectl scale deploy/podinfo --replicas=5` | `replicas:` entry in `overlays/test/kustomization.yaml` | | `kubectl apply -f new-cronjob.yaml` (test-only) | new `overlays/test/cronjob.yaml` + `resources:` entry | -| edit an env var on the **base-owned** Deployment | **unreflected** (no destination until F3); webhook rejects at apply time if enabled | +| edit an env var on the **base-owned** Deployment | **unreflected** (no destination until overlay patch authoring exists); webhook rejects at apply time if enabled | | edit a `HelmRelease` chart version `6.0.0 → 6.1.0` (floating range or pinned) | in-place edit of the `HelmRelease` document — **accepted** (control plane renders it) | | a `kustomization.yaml` gains `resources: [github.com/org/repo//base?ref=main]` | **folder refused** (`GitPathAccepted=False`) — we render kustomize; a remote/floating source is non-invertible | @@ -439,9 +443,9 @@ precondition and is refused outright (§1). | Option | Expected output of "bump everywhere" | |---|---| -| **A** (per overlay) | not an operator action — product **promote** copies the one-line change into each overlay's `kustomization.yaml`, one PR | +| **A** (per overlay) | not an operator action — a **promote** operation in the layer above copies the one-line change into each overlay's `kustomization.yaml`, one PR | | **B** (app root) | *tempting* to write `base/`, but that is the unsafe path — must still be refused/kept to promotion, so B buys nothing here while weakening L1→L2 | -| **C** (base variant) | editing `base/` changes the shared *default* only — but overlays override `images:`, so it does **not** bump those environments. "Every environment effective value" is still product promotion (A's answer). C fits editing a *default*, not this action | +| **C** (base variant) | editing `base/` changes the shared *default* only — but overlays override `images:`, so it does **not** bump those environments. "Every environment effective value" is still promotion (A's answer). C fits editing a *default*, not this action | ### Where the options differ — "how is base kept read-only" @@ -451,26 +455,29 @@ precondition and is refused outright (§1). | **B** | possible in principle — only L2 fan-in stops it, and L2 is the graph-modelling layer, not the path check ⚠ | | **C** | impossible from the test target (L1); the *base* target may write `base/`, but only from a `podinfo-base` edit | -## 5. Consequences for the ladder and Track 1 +## 5. Consequences for the write model -- **Granularity is decided (A), which fixed the Track-1 investment.** Because A - keeps the base read-only by **L1**, Track 1 built **L1 as an explicit - precondition** (the strong, cheap guarantee) and turned **L2 into a refusal** - (never write-through a multi-consumer file) — it never leans on L2 to protect - the base. Both shipped; see §1. -- **L2's remaining blind spot is F2's job.** `fanInPrecondition` fires on the +- **Granularity is decided (A), which fixed what the hardening had to build.** + Because A keeps the base read-only by **L1**, the hardening built **L1 as an + explicit precondition** (the strong, cheap guarantee) and turned **L2 into a + refusal** (never write-through a multi-consumer file) — it never leans on L2 to + protect the base. Both shipped; see §1. +- **L2's remaining blind spot belongs to render-root scoping.** + `fanInPrecondition` fires on the signal the store already carries: a file more than one render path reaches *with override entries at stake*. A file shared by two render roots with no competing `images:`/`replicas:` chain is not flagged — under layout A it is also never dirty (a base doc reached by distinct overlays is `NamespaceNone` and never matches a live object), so nothing is written. Generalizing the check - to "any file reachable from more than one render root" is F2 render-root - scoping, and it is what would be required before layout B could be offered. -- **F2 scope gains one concrete capability under A/C:** follow `../../base` for - *reading* (today dropped), while the write jail stays at `spec.path`. Much of - the read-scope / render-root / out-of-subtree-base logic already exists - read-only in the F8 repo scan and can be promoted into the live analyzer. -- **Cross-environment editing is decided:** product promotion at launch; Option + to "any file reachable from more than one render root" is render-root scoping's + job, and it is what would be required before layout B could be offered. +- **Render-root scoping gains one concrete capability under A/C:** follow + `../../base` for *reading* (today dropped), while the write jail stays at + `spec.path`. Much of the read-scope / render-root / out-of-subtree-base logic + already exists read-only in the + [repo scan](repo-discovery-and-onboarding-scan.md) and can be promoted into the + live analyzer. +- **Cross-environment editing is decided:** promotion in the layer above; Option C (base-as-variant) later and only for editing *shared defaults*, not as the "every environment" answer. Neither reopens the fan-in invariant. - **Floating-source rule needs no new code, only docs + a test:** the @@ -482,13 +489,14 @@ precondition and is refused outright (§1). The write boundary refuses an edit that would land in shared context. But most edits that *want* to land there have a legal destination one level up: the -overlay's own `kustomization.yaml`. This is the reflection path F1 already -implements, and it is worth naming explicitly, because it is the reason the L2 -refusal is a narrow rule rather than a broad one. +overlay's own `kustomization.yaml`. This is the reflection path the operator +already implements for override entries, and it is worth naming explicitly, +because it is the reason the L2 refusal is a narrow rule rather than a broad one. Bump `podinfo` to `9.9.9` in the `test` namespace. The container image lives in `base/deployment.yaml`, which `prod` also renders — writing it there is exactly -the edit L2 forbids. Instead the operator edits the overlay's `images:` entry: +the edit L2 forbids. Instead the operator edits the overlay's `images:` entry +(the reflection path it already implements for `images:`/`replicas:`): ```text apps/podinfo/ @@ -503,7 +511,8 @@ The write stays inside `spec.path` (L1 holds), the shared file is never touched (L2 holds), and the render is correct: kustomize applies `images:` *after* the base is loaded, so the overlay entry wins. `replicas:` behaves the same way. Field-level edits that no override entry can express (an env var, a resource -limit) have no such destination — they are the F3 patch case. Today they are +limit) have no such destination — they are the overlay-patch case, which is not +supported today. Today they are simply refused when they reach a write-boundary precondition; the honest per-edit report of *what was dropped* is the unbuilt Tier-2 accounting ([unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md)). @@ -522,13 +531,13 @@ Two shapes are worth distinguishing: | **Override updated** | an `images:` entry already existed for this image; the operator changed `newTag` | no — the overlay already diverged; the user is editing their own pin | | **Override created** | no entry existed; the overlay rendered the base value, and the operator has now pinned it | **yes** — this is the moment the environment stops tracking base | -**Proposal (not built; own F-item).** On the *create* transition, surface the +**Proposal (not built).** On the *create* transition, surface the divergence at the point it becomes true. Three candidate surfaces, cheapest first, and they are not exclusive: 1. **Commit-message trailer** on the commit that adds the entry — e.g. `Overlay-Diverged: images/podinfo base=6.3.0 overlay=9.9.9`. Free, durable, - reviewable, lands in the product PR where a human is already looking. This is + reviewable, and it lands in the PR where a human is already looking. This is the one to build first. 2. **Kubernetes Event** on the GitTarget (`reason: OverlayDiverged`), so the divergence is visible to `kubectl describe` and to anything watching events. @@ -548,19 +557,19 @@ two would make the common, healthy overlay edit look like a failure. **Decided (2026-07-09) — the user's call:** -1. **Granularity — Option A for launch, C kept open, B rejected** as the operator +1. **Granularity — Option A, C kept open, B rejected** as the operator write model. A `GitTarget` is a write partition (§2 Decision). -2. **Cross-environment edits — product promotion now, Option C later and only for - shared defaults**; 3c rejected. Promotion and factor-into-base stay distinct - verbs (§3 Decision). +2. **Cross-environment edits — promotion in the layer above, Option C later and + only for shared defaults**; 3c rejected. Promotion and factor-into-base stay + distinct verbs (§3 Decision). **Still open:** 3. **Divergence notification (§6)** — build the commit-message trailer on the - "override created" transition? Own F-item; nothing depends on it shipping with - the write boundary. + "override created" transition? Independent; nothing depends on it shipping + with the write boundary. 4. **Write-up placement** — fold the §1 L1/L2 model back into - [kustomize-support-boundary-and-product-model.md §4](kustomize-support-boundary-and-product-model.md) + [kustomize-support-boundary.md §4](kustomize-support-boundary.md) (one canonical invariant statement), or keep §4 as the short invariant and let this doc own the two-layer detail? 5. **Option C sub-questions (deferred with C):** the synthetic base namespace's diff --git a/docs/design/support-boundary/kustomize-support-boundary.md b/docs/design/support-boundary/kustomize-support-boundary.md new file mode 100644 index 00000000..022140a5 --- /dev/null +++ b/docs/design/support-boundary/kustomize-support-boundary.md @@ -0,0 +1,291 @@ +# The Kustomize support boundary + +> Status: the field taxonomy and layout allowlist behind the support contract. +> The §4 fan-in invariant is no +> longer emergent — it ships as a write-plan refusal (see §1 and +> [gittarget-granularity-and-cross-environment-edits.md §1](gittarget-granularity-and-cross-environment-edits.md)). +> Captured: 2026-07-06 +> Related: +> [README.md](README.md), +> [gittarget-granularity-and-cross-environment-edits.md](gittarget-granularity-and-cross-environment-edits.md), +> [finished/images-and-replicas-edit-through.md](finished/images-and-replicas-edit-through.md), +> [../manifest/contextual-namespace-and-kustomize-folder-editing.md](../../spec/contextual-namespace-and-kustomize-folder-editing.md), +> [../unsupported-folder-refusal-plan.md](../../spec/unsupported-folder-refusal-plan.md), +> [../manifest/version2/gittarget-new-file-placement-rules.md](../../spec/gittarget-new-file-placement-rules.md) + +## Purpose + +The other docs in this folder answer "what do we do about X." This one takes a +step back and answers the questions that decide what X should be: + +1. Which part of the kustomization surface can the operator **ever** support, + and which part is permanently out? +2. Which **folder layouts** do we accept? +3. Who **runs kustomize** — us, or the GitOps tool? + +The governing rule from [README.md](README.md) is the measuring stick: the +repository must stay **round-trippable** — every edit the operator writes has +exactly one writable Git destination, and the result must be expressible in both +directions (live → Git, and Git → live via the GitOps tool's render). Shared +source documents are read-only context. + +## 1. The kustomization surface: an invertibility taxonomy + +Measured against round-trippability, the ~29 documented `kustomization.yaml` +fields ([reference](https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/)) +fall into four buckets. The boundary is not a temporary implementation gap — +most of the "never" bucket is *structurally* non-invertible, and saying so is +the support contract. + +| Bucket | Fields | Why | +|---|---|---| +| **Invertible — supported** | `resources`/`bases` (local), `namespace`, `images`, `replicas` | Today's subset: namespace inference + `images`/`replicas` edit-through | +| **Invertible — planned** | `patches` (scalar strategic-merge, **operator-authored only**) | The one crossing worth building; environment drift needs a per-environment destination | +| **Invertible — possible, not planned** | `labels`, `commonLabels`, `commonAnnotations`, `buildMetadata` (subtractable in projection); `namePrefix`/`nameSuffix` (identity arithmetic cascades into every name reference); `configMapGenerator` limited to literals + `disableNameSuffixHash` | Cost/value is poor; prefixes especially buy little and touch everything | +| **Never — structurally non-invertible** | `helmCharts`/`helmGlobals` (live state does not determine chart+values inputs); generators with hash suffixes (the hash couples content to rollout — inverting means authoring rename cascades); `replacements`/`vars` (the value's source of truth is another field; a change to the target is semantically ambiguous); `generators`/`transformers`/`validators` plugins (arbitrary code = unknowable render); `components` (patch bundles composed across variants); remote bases (cannot edit what we do not own) | +| **Never — policy** | `secretGenerator` | Plaintext secrets in Git contradict the SOPS stance regardless of invertibility | +| **Refuse rather than tolerate** | `configurations`, `openapi`, `crds` | They silently change merge-key semantics, so the editor's assumptions become wrong with no visible signal | +| **Tolerable ignorables** | `sortOptions` | Does not change object state | + +Two nuances found while auditing the current gate +(`hasUnsupportedKustomizeFeature`, `internal/manifestanalyzer/store.go`): + +- **Tolerated metadata transformers leak.** `commonLabels`, `labels`, + `commonAnnotations`, and `buildMetadata` pass the gate silently, but a live + object can carry transformer-supplied metadata its source file lacks — the + writer patches it into the file as "drift." The render stays correct + (idempotent), so this is pollution rather than corruption, but it is the + same "dead text shadowed by a transformer" pathology the `images:` + edit-through already fixed. A future projection-side subtraction is the same + kind of fix; until then the support statement should name the limitation. +- **The fan-out fallback is now an explicit refusal.** Ambiguous override chains + (`ambiguous-images`, `diamond-images` corpora) still emit a warning at store + build time, but a *planned write* into such a file is refused before any byte + is written: write-through into a file consumed by two render roots is the one + edit that must never happen, and it no longer depends on the coincidental + namespace ambiguity (`NamespaceNone`) that used to block the live-object match. + The refusal fails the GitTarget with reason `WriteBoundaryRefused`. See + [§4](#4-the-invariant) and + [gittarget-granularity-and-cross-environment-edits.md §1](gittarget-granularity-and-cross-environment-edits.md). + +## 2. Supported layouts: an allowlist, not field caveats + +The public support statement should enumerate **layouts we accept**, not +fields we reject. Three layouts: + +1. **Plain manifest folder** — raw YAML, explicit namespaces. *Shipped.* +2. **Single-context kustomize folder** — one render root; `namespace`, + `resources` (local files / child dirs), `images`, `replicas`. *Shipped.* +3. **Base + environment overlays** — one shared base, N overlay roots, one + Kubernetes namespace per overlay. *Designed, not shipped; see §5.* This is + the canonical layout in the kustomize documentation + and common GitOps examples — a kustomize story without it reads as toy + support. + +**Scope.** Layouts 1–2 are shipped, and apply *per environment* — one plain +folder per environment, each its own GitTarget. Layout 3 is designed but not +shipped, and its designed scope is deliberately narrow: per-overlay `namespace` + +`resources`/`images`/`replicas`, overlay-local documents, base read-only, and new +overlay-local KRM added to that overlay's `resources:`. The everyday operations — +add something to an environment, bump a version, edit an overlay-local object — +need exactly that slice. Per-environment edits of base-owned *fields* are the hard +part and are deliberately left out; today they are refused rather than written +into the base, and reporting each one as unreflected is the unbuilt per-edit +accounting (§4). + +Explicitly **out of scope**, and worth saying in user docs: + +- **Fleet / cluster-root repositories** (`clusters/` + `apps/` + `infra/` + layouts). A GitTarget points at an *app subtree*, never a cluster root. + This composes fine with fleet repos — a Flux `Kustomization`, Argo CD + `Application`, or another product object can point at the same app folder + we do — and keeps us out of infrastructure folders full of Helm rendering + and components. +- **Helm rendering in any form** (`helmCharts`, hybrid repos): permanently + refused. Flux `HelmRelease`, Argo CD `Application`, KRO resources, and other + control-plane CRs are ordinary KRM documents and fully in scope — the + boundary is chart inflation, not the CRs that request it. +- **Folders transformed outside the folder.** Flux `postBuild` substitutions + and `targetNamespace`, Argo CD Application-level kustomize overrides, or any + controller-side transform that is not written in the folder: the folder + alone no longer determines the render, so the round-trip promise cannot + hold. Our contract is "we mirror what the folder alone renders." (Reading + controller CRs in-cluster to learn those transforms is a possible + much-later feature, not part of this boundary.) + +This allowlist is a **write** contract, not a discovery one. The read-only +scanner ([repo scan](repo-discovery-and-onboarding-scan.md)) walks a whole repo +and classifies each folder against *exactly* this boundary — `plain` / +`kustomize-single` (accepted), `kustomize-overlay` (recognised, not yet +accepted), `refused-structural` (the permanent wall above) — without widening +what the operator writes. Discovering broadly and writing narrowly is what lets +onboarding meet real GitOps repos without eroding round-trippability. + +## 3. Why overlays are a different animal + +Fan-out is exactly why the governing rule is "one writable destination per +edit," not "one source document owns one live object": a base +`deployment.yaml` can produce N live objects, one per environment. Two +consequences: + +- **Read side** — which overlay produced the object we are watching? We need + a variant → namespace mapping. +- **Write side** — an edit observed in the test environment must land in the + test overlay, *never* in the base. Writing to base changes production + because someone touched test. + +So overlay support is not an incremental extension of the shipped +edit-through; it changes the write model from "edit the document that produced +the object" to "synthesize the minimal expression of the change **in the right +variant**." + +## 4. The invariant + +> **The operator never writes to a file consumed by more than one render +> root.** (Write fan-in = 1. Base files and shared components are read-only +> context, always.) + +> **This rule has one home:** +> [gittarget-granularity-and-cross-environment-edits.md §1](gittarget-granularity-and-cross-environment-edits.md) +> specifies it as the two-layer write boundary (L1 filesystem jail, L2 fan-in = 1) +> and names its enforcement — a write-plan precondition that aborts the whole flush +> and fails the GitTarget with `GitPathAccepted=False` / `WriteBoundaryRefused`. +> The paragraph above states the rule; it does not redefine it. If the two ever +> disagree, §1 wins. + +This single sentence: + +- makes "operator edits base" structurally impossible — nothing observed in + one environment can ever change what another environment renders; +- explains the `diamond-images` refusal (two paths from one root); +- decides the multi-environment question for good — the operator cannot + "add to all environments" *by design*, and nothing above it should expect that; +- **has been promoted from emergent behavior to an explicit, tested rule** — a + write-plan precondition that refuses the flush (`WriteBoundaryRefused`) rather + than writing through. It is paired with the filesystem jail (writes never leave + `spec.path`); the two layers are specified in + [gittarget-granularity-and-cross-environment-edits.md §1](gittarget-granularity-and-cross-environment-edits.md). + Generalizing it from "a file two override chains reach" to "any file two render + roots reach" is render-root scoping. + +## 5. The overlay model + +With the invariant in place, every observed change in environment X has +exactly one legal destination: + +| Observed change in env X | Lands in | +|---|---| +| image tag / replica count | overlay X's `images:`/`replicas:` entry (the shipped edit-through machinery, scoped per render root) | +| new object | new overlay-local file in overlay X **+ a `resources:` entry** (placement plus entry creation) | +| any other spec field (env var, resource limits, args…) | an operator-authored strategic-merge patch in overlay X — **not supported, so nowhere** | +| delete of a base-owned object in one env | unrepresentable without a `$patch: delete` patch — refuse the write | + +The third row is the honesty condition on accepting overlays at all: an +arbitrary field edit on a base-owned object has no legal destination without +patch authoring (in-place would be the base). The designed Kustomize support +therefore covers the common slice — overlay entries, overlay-local documents, and +adding overlay-local KRM to `resources:`. + +Two mechanisms cover what falls outside that slice, and they must not be +conflated: + +| | Status | Granularity | Surface | +|---|---|---|---| +| **Write-boundary refusal** (L1/L2) | **shipped** | aborts the whole flush; commits nothing | `GitPathAccepted=False`, `Stalled=True`, reason `WriteBoundaryRefused` | +| **Per-edit `FullyReflected` accounting** | **designed, unbuilt** | records the individual dropped edit; reverted by hydration | planned `FullyReflected` condition + unreflected set | + +Today an out-of-scope edit is *prevented* — refused before any byte is written — +but the target is told at the target level, not per edit. Making the third row +"reported and reverted, never silently lost" is the unbuilt accounting, and it is +a **prerequisite for accepting overlay layouts at all**. That remains a scoped +promise rather than a gap: the everyday operations (add to an environment, bump a +version) never hit the third row, and how often real users *do* hit it is what +would price patch authoring. + +If patch authoring is ever built, its scope stays narrow and safe: the operator +would only create and update patches **it authored** (scalar fields, one patch +file per object per overlay), and pre-existing hand-written patches would still +refuse the folder. The gate keeps its shape — we accept exactly the structure we +fully model. + +What happens when an edit has **no** legal destination — the "or nowhere" +rows above — and how the user finds out, is designed separately in +[unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md) +(per-edit `FullyReflected` accounting, self-healing by re-applying the folder's +render, and the optional admission preflight). + +### Variant identification: self-describing folders over configuration + +Prefer reading the mapping from the folder to declaring it on the GitTarget. +The analyzer already computes render roots (kustomizations no other +kustomization references); if each overlay sets `namespace:`, the +variant → namespace mapping is free and the repository documents itself. + +- **Rule:** every overlay root must set `namespace:`, distinct per root. + Refusal message: "add `namespace:` to each overlay." +- Namespace injected out-of-band (Flux `targetNamespace`, Argo destination) + stays refused (§2). An explicit GitTarget-side mapping + (`spec.variants: [{root, namespace}]`) is a fallback we add only if real + folders cannot be made self-describing. + +### Scoping: one GitTarget per overlay root + +The natural shape: a GitTarget's `spec.path` names the overlay +(`…/overlays/test`), so +environment = GitTarget = watch scope = write scope, and multiple GitTargets +share the branch through the existing BranchWorker serialization. + +Structural consequence the design must solve: the base sits *outside* +`spec.path`, so the analyzer needs a **read scope** (the repo subtree +reachable via `../../base`) wider than the **write scope** (the overlay +directory). The GitTarget path-overlap rejection must learn that shared +*read-only* context between targets is legal while overlapping *write* +scopes stay forbidden. + +## 6. The reference layout + +The blessed shape for docs, examples, and the test corpus: + +```text +apps/podinfo/ +├── base/ # read-only to the operator, always +│ ├── kustomization.yaml # resources: [deployment.yaml, service.yaml] +│ ├── deployment.yaml +│ └── service.yaml +└── overlays/ + ├── test/ # GitTarget A → namespace podinfo-test + │ ├── kustomization.yaml # namespace: podinfo-test + │ │ # resources: [../../base, debug-toolbox.yaml] + │ │ # images: [{name: podinfo, newTag: 6.6.0-rc1}] + │ │ # replicas: [{name: podinfo, count: 1}] + │ └── debug-toolbox.yaml # an extra installed only in test + ├── acceptance/ + │ └── kustomization.yaml # namespace: podinfo-acc, resources: [../../base], images/replicas + └── production/ + └── kustomization.yaml # namespace: podinfo-prod, resources: [../../base], images/replicas +``` + +"Install extras in test" and "add files in test" are the same mechanism: an +overlay-local resource file plus its `resources:` entry, created by the +operator when a new object appears in that environment's namespace. + +## 7. Who runs kustomize + +Deployment stays with the user's GitOps controller — Flux, Argo CD, or +anything else that consumes KRM — because that keeps the operator out of the +deployment business and out of drift-ownership fights. But "running +kustomize" means two different things: + +- **Deploying** (Git → cluster): theirs, always. +- **Understanding** (folder → expected render): ours, necessarily — the + writer must know which file supplied each live value. + +We keep *re-implementing the narrow transformer subset* rather than embedding +kustomize as the renderer: it is what keeps the refusal boundary honest (we +refuse exactly what we do not model). The worthwhile upgrade is kustomize's +Go API (`krusty`) as a **verification oracle**, not a renderer: in the +acceptance gate or in CI, build each render root in-memory and compare +against our own projection; mismatch → refuse. That buys kustomize's ground +truth without ever depending on semantics we have not modeled — the cheap, +high-confidence version of the "Option D" parked during the `images:`/`replicas:` +work. diff --git a/docs/design/gitops-api/orchestrator-knowledge-boundary.md b/docs/design/support-boundary/orchestrator-knowledge-boundary.md similarity index 87% rename from docs/design/gitops-api/orchestrator-knowledge-boundary.md rename to docs/design/support-boundary/orchestrator-knowledge-boundary.md index 4c5ed49b..ba8711c3 100644 --- a/docs/design/gitops-api/orchestrator-knowledge-boundary.md +++ b/docs/design/support-boundary/orchestrator-knowledge-boundary.md @@ -1,11 +1,11 @@ # Orchestrator knowledge boundary: renderability, ownership, and claims -> Status: direction-setting; proposes two ladder entries, ships no code. +> Status: direction-setting; ships no code. Nothing it describes is supported today. > Captured: 2026-07-10 > Related: > [README.md](README.md), -> [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md), -> [f8-repo-discovery-and-onboarding-scan.md](f8-repo-discovery-and-onboarding-scan.md), +> [kustomize-support-boundary.md](kustomize-support-boundary.md), +> [repo-discovery-and-onboarding-scan.md](repo-discovery-and-onboarding-scan.md), > [unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md), > [gittarget-granularity-and-cross-environment-edits.md](gittarget-granularity-and-cross-environment-edits.md), > the layout corpus at [`test/fixtures/gitops-layouts/`](../../../test/fixtures/gitops-layouts/) @@ -18,7 +18,7 @@ This doc answers two questions that turned out to be the same question: *"can an edit be mapped back to one source document?"* That is necessary and it is not sufficient. 2. **Where does Argo CD / Flux knowledge belong?** It is real knowledge, the - product needs it, and it must not be smeared through the acceptance gate. + operator needs it, and it must not be smeared through the acceptance gate. The answer to (2) falls out of (1): the missing safety property is **ownership**, ownership is asserted by orchestrator objects that already live in the repository @@ -54,7 +54,7 @@ They fail a question it never asks. | Axis | Question | Failure mode | Modelled today | |---|---|---|---| -| **Renderability** | Can an edit be written back to exactly one source document, such that live → Git → live round-trips? | We cannot express the change. | ✅ Yes — this *is* the [support boundary](kustomize-support-boundary-and-product-model.md). Generators, `namePrefix`, patches, remote bases, Helm inflation are refused because they are non-invertible. | +| **Renderability** | Can an edit be written back to exactly one source document, such that live → Git → live round-trips? | We cannot express the change. | ✅ Yes — this *is* the [support boundary](kustomize-support-boundary.md). Generators, `namePrefix`, patches, remote bases, Helm inflation are refused because they are non-invertible. | | **Ownership** | Is this file already owned by something else that writes it? | We *can* express the change, write it, and destroy someone else's invariant. | ❌ No. | The two are independent. A folder can be renderable and unowned (write it), @@ -228,7 +228,7 @@ can move. **Keep ownership *policy* in core, not in the interpreters.** The interpreter says "`ImageUpdateAutomation` writes this path." The rule "refuse to write a machine-owned file" is core policy, applied uniformly to every claim from every -interpreter. Invert this and the product ships Flux-shaped safety with no +interpreter. Invert this and the operator ships Flux-shaped safety with no Argo-shaped equivalent. **Interpreters are read-only and cluster-free**, exactly like `ScanRepo`. They @@ -287,29 +287,29 @@ should **propose** that file rather than report a refusal, and an Argo CD interpreter can seed it from `directory.exclude`. This is a report-quality bug, not a boundary question. -## Proposed ladder entries +## Not supported today -Neither is designed here beyond the shape above. +None of the following is built, and none is designed here beyond the shape above. -| Proposed | Scope | +| Capability | Scope | |---|---| -| **Ownership axis** | `Encrypted`/non-editable in `ResourceCounts`; a core write-gate that refuses a machine-owned or generated destination; `Generated` detection from headers and `config.kubernetes.io/origin`. Delivers the three false accepts. Its first API surface is [`EncryptedSecret`](write-only-encrypted-secrets.md). | -| **Orchestrator interpreters** | `internal/gitops` claim vocabulary + registry; `argocd` and `flux` interpreters; `fleetRoot` re-expressed as `NotAnEditingTarget`; role classification (workload / control-plane / generated / machine-written) in the F8 report. | -| **Resource capability registry** | Tier 0b: four knobs, three classifiers ([design](resource-capability-model.md)). Carries the day-1 gate below. | +| **Ownership axis** | `Encrypted`/non-editable in `ResourceCounts`; a core write-gate that refuses a machine-owned or generated destination; `Generated` detection from headers and `config.kubernetes.io/origin`. Fixes the three false accepts. Its first API surface is [`EncryptedSecret`](write-only-encrypted-secrets.md). | +| **Orchestrator interpreters** | `internal/gitops` claim vocabulary + registry; `argocd` and `flux` interpreters; `fleetRoot` re-expressed as `NotAnEditingTarget`; role classification (workload / control-plane / generated / machine-written) in the repo scan report. | +| **Resource capability registry** | Tier 0b: four knobs, three classifiers ([design](resource-capability-model.md)). Carries the derived-object gate below. | | **Derived-object gate** | Never mirror an object carrying a controller `ownerReference` — it is a controller's output, not desired state. Live-state, Tier 0, no orchestrator knowledge. Today [`sanitize`](../../../internal/sanitize/sanitize.go) *deletes* that field without ever gating on it, so an ESO- or sealed-secrets-derived `Secret` would be committed as a second source of truth. See [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md). | -The derived-object gate is the smallest and the most urgent: it is a few lines, -it needs nothing else in this doc, and it protects far more than secrets. The -ownership axis is next, being the one with a correctness argument behind it. -Interpreters are what make it complete, and what make the F8 report an onboarding -answer rather than a folder census. +The derived-object gate stands alone: it is a few lines, it needs nothing else in +this doc, and it protects far more than secrets. The ownership axis is the one +with a correctness argument behind it — the three false accepts above are its +evidence. Interpreters are what make the ownership axis complete, and what turn +the repo scan report into an onboarding answer rather than a folder census. -A fifth thing falls out of hydration rather than from ownership: `RepoReport` -should report `requiredCRDs`, the group/kind pairs a repository needs installed -before an intent cluster can hold its documents. See -[intent-cluster-hydration.md](intent-cluster-hydration.md). +One further report field comes from neither: `RepoReport` should carry +`requiredCRDs`, the group/kind pairs a repository needs installed before any +cluster can hold its documents. It is computable from `apiVersion`/`kind` alone, +during the scan the analyzer already performs. -## Why the F8 report is not yet an onboarding answer +## Why the repo scan report is not yet an onboarding answer Related, and worth recording while the evidence is fresh. `scan-repo` counts candidates, and every candidate counts the same: @@ -321,7 +321,7 @@ candidates, and every candidate counts the same: - `07-helm-environment-values` reports one accepted candidate: `argocd/`. Each is structurally true. None is a useful thing to tell a user during -onboarding, and a product that leads with "1 folder supported" on a Helm +onboarding, and a report that leads with "1 folder supported" on a Helm repository is misleading rather than honest. Candidates need a **role** beside their layout, and a Helm chart should surface as an explicit layout rather than as silence plus an incidental `crds/`. @@ -331,13 +331,15 @@ as silence plus an incidental `crds/`. Two follow-ups on the corpus itself, which is the test surface for all of the above: -- **No fixture currently produces `kustomize-overlay` / `overlay-fan-out-needs-f2`.** +- **No fixture currently produces `kustomize-overlay` / `overlay-fan-out-unsupported`.** Every overlay in the corpus also uses `patches`, so `refused-structural` — the - permanent wall — fires first and hides the F2 ladder rung. The - [F8 doc](f8-repo-discovery-and-onboarding-scan.md) calls that ladder-versus-wall - distinction load-bearing and says it must never collapse; today nothing pins it. - A minimal overlay that only sets `namespace` and `images` over `../../base` - closes the gap. + permanent wall — fires first and hides the other verdict entirely. The two are + not interchangeable: `refused-structural` is a permanent refusal, while + `overlay-fan-out-unsupported` names a folder that is simply not written today. + [repo-discovery-and-onboarding-scan.md](repo-discovery-and-onboarding-scan.md) + calls that distinction load-bearing and says it must never collapse; today + nothing pins it. A minimal overlay that only sets `namespace` and `images` over + `../../base` closes the gap. - **`support-today.md` should be generated, not pasted.** A task target that runs `scan-repo` over every fixture and rewrites the file turns the corpus from documentation into a **behavioural baseline**: not an assertion, a diff. Any @@ -350,8 +352,8 @@ above: - **No orchestrator emulation.** Interpreters read declarations. They do not run kustomize on a remote base, resolve a Helm chart, evaluate an ApplicationSet generator, decrypt SOPS, or contact a registry. -- **No new operator dependency.** Interpreters serve the analyzer and the F8 - report. Whether the operator ever consumes a claim is a separate decision; the +- **No new operator dependency.** Interpreters serve the analyzer and the repo + scan report. Whether the operator ever consumes a claim is a separate decision; the ownership *gate* it needs can be fed by Tier 0 (`Encrypted`) alone for the first cut. - **The write boundary does not widen.** Everything refused for renderability @@ -369,13 +371,13 @@ above: In `16-flux-image-automation` the automation owns exactly one field — the image on the line carrying the `$imagepolicy` comment. Refusing the whole folder is safe and coarse; refusing the field is precise and needs setter-comment - awareness. The same question, in a different costume, as F3's restricted patch - authoring. + awareness. The same question, in a different costume, as restricted patch + authoring — write the one field, or refuse the document that holds it. 4. **Does a `RenderRootFor` claim from an Argo CD `Application` change which folders are candidates at all**, or only annotate the ones the structural walk already found? The structural walk found `manifests/frontend` without help; the `Application` merely confirms it. Where do the two disagree? 5. **How is a claim from a *different repository* represented?** An `Application` in a bootstrap repo points at a path in a workload repo. The single-repo scan - cannot see it. Is that simply out of scope, or does the product layer stitch - claims across repositories? + cannot see it. Is that simply out of scope, or does a tool built on top of the + operator stitch claims across repositories? diff --git a/docs/design/gitops-api/f8-repo-discovery-and-onboarding-scan.md b/docs/design/support-boundary/repo-discovery-and-onboarding-scan.md similarity index 74% rename from docs/design/gitops-api/f8-repo-discovery-and-onboarding-scan.md rename to docs/design/support-boundary/repo-discovery-and-onboarding-scan.md index 44d19963..24aa3fb3 100644 --- a/docs/design/gitops-api/f8-repo-discovery-and-onboarding-scan.md +++ b/docs/design/support-boundary/repo-discovery-and-onboarding-scan.md @@ -1,26 +1,26 @@ -# F8: Repo discovery and onboarding scan (CLI / product-layer) - -> Status: designed; **first cut shipped 2026-07-09** (branch `feat/gitops-api-f8`) — -> CLI/onboarding tooling, not an operator write-model feature. The engine it needs is -> already shipped; this adds a new entry point plus a report contract. See +# Repo discovery and onboarding scan + +> A read-only capability of the `manifest-analyzer` CLI and the public +> `pkg/manifestanalyzer` library. It ships **no operator code**: the operator never +> discovers anything. +> +> Status: **first cut shipped 2026-07-09**. The engine it needs was already shipped; +> this adds a new entry point plus a report contract. See > [First cut (shipped)](#first-cut-shipped-2026-07-09) for what actually landed and where > it refines the sketch below. > Captured: 2026-07-09 > Related: > [README.md](README.md), -> [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md), -> [finished/f1-images-replicas-edit-through.md](finished/f1-images-replicas-edit-through.md), -> [finished/f7-higher-level-krm-documents.md](finished/f7-higher-level-krm-documents.md), +> [kustomize-support-boundary.md](kustomize-support-boundary.md), +> [finished/images-and-replicas-edit-through.md](finished/images-and-replicas-edit-through.md), +> [finished/higher-level-krm-documents.md](finished/higher-level-krm-documents.md), > [../manifest/file-agnostic-placement.md](../../spec/gittarget-new-file-placement-rules.md), > [../../finished/current-manifest-support-review.md](../../spec/current-manifest-support-review.md) ## Why this exists -The product front door is "point a GitHub App at a repository you own and get an -easy Kubernetes API over it" (the intent-mode direction of -[kustomize-support-boundary-and-product-model.md §8](kustomize-support-boundary-and-product-model.md)). -Between "here is a repo" and "here is your API" sits an **onboarding** step the -operator deliberately does **not** perform: +Between "here is a repository" and "here is a `GitTarget` that edits one folder of +it" sits an **onboarding** step the operator deliberately does **not** perform: - Which folders in this repo can become `GitTarget`s? - What **layout** is each (plain per-env folder, single-context kustomize, @@ -32,7 +32,7 @@ operator deliberately does **not** perform: None of this is the operator's job, and it must stay that way. This doc designs the discovery capability as an extension of the existing `manifest-analyzer` CLI + its shared `internal/manifestanalyzer` engine, and defines the -machine-readable report the product layer consumes. +machine-readable report a tool built on top of the operator consumes. ## The boundary this respects: the operator never discovers @@ -47,8 +47,8 @@ refused to preserve one-owner-per-folder (`checkForConflicts`, Repo-wide target discovery is therefore a **new axis**, not a new operator feature. Putting it in the operator would fight both the simplicity goal and the -one-owner invariant. It belongs in the CLI/library and, above that, the product -layer — exactly the division already recorded in +one-owner invariant. It belongs in the CLI/library, and anything built on top of the +operator consumes its report — exactly the division already recorded in [file-agnostic-placement.md](../../spec/gittarget-new-file-placement-rules.md) and the [README](README.md) responsibilities table: @@ -56,7 +56,7 @@ layer — exactly the division already recorded in |---|---|---| | **GitOps Reverser (operator)** | watch live state, edit one subtree, push a branch, expose `CommitRequest` status | **No.** Unchanged. One `GitTarget` = one subtree. | | **`manifest-analyzer` CLI + `internal/manifestanalyzer` library** | folder walk, acceptance gate, placement, refusal reasons — already shared with the operator | **Yes.** New repo-wide entry point + report. Read-only, writes nothing, needs no cluster. | -| **Product / GitHub App layer** | repo access, CR generation, PR creation, session/branch policy | Consumes the report → generates `GitProvider`/`GitTarget`/`WatchRule` → opens PRs. Still no operator Git-host knowledge. | +| **A tool built on top of the operator** | repo access, CR generation, PR creation | Consumes the report → generates `GitProvider`/`GitTarget`/`WatchRule` → opens PRs. Still no operator Git-host knowledge. | ### Why walking a whole repo does not re-open Pandora's box: discovery ≠ support @@ -66,7 +66,7 @@ principled** — they are deliberately different jobs. scan-repo classifies what *is*; it never widens what the operator will *write*. The write boundary is not a hand-maintained feature allowlist but a **consequence of one rule**: every edit must have a single writable Git destination that round-trips -([boundary §1–§4](kustomize-support-boundary-and-product-model.md)). Anything that creates +([boundary §1–§4](kustomize-support-boundary.md)). Anything that creates resources or mutates identity (generators, patches, `components`, `namePrefix`/`nameSuffix`, Helm inflation, `replacements`) has no source document to write an edit into, so it is refused *structurally* — not "unimplemented," but non-invertible. @@ -74,8 +74,8 @@ refused *structurally* — not "unimplemented," but non-invertible. That is the escape from the "support every kustomize feature" trap: a repo may use constructs the operator will never write, and discovery's only job is to **say so, honestly, per folder**. You onboard a kustomize repo without supporting kustomize writes. The refusal -reasons are the product's honesty surface — "here is exactly what we will not touch, and -why" — not a gap to apologise for. +reasons are the honesty surface — "here is exactly what we will not touch, and why" — not a +gap to apologise for. ## The engine is already there @@ -123,26 +123,26 @@ flowchart TD target unit; its inferred `namespace:` (when set) is the variant identity. 3. **Enumerate candidates:** every render root, plus every plain leaf folder of KRM documents that no kustomization owns (many GitOps tools apply a directory - of manifests directly — the "one plain folder per environment" launch layout). + of manifests directly — the common "one plain folder per environment" layout). 4. **Run the same acceptance gate the operator runs** per candidate, scoped to the candidate subtree plus the read-only context it reaches (bases via `../../base`). This yields, per candidate: accepted?, refusal reasons, layout class, inferred namespace(s)/variants, KRM vs non-KRM document counts. 5. **Detect overlap/nesting** between candidates (mirroring - `gittarget_path_overlap`) so the product never proposes two `GitTarget`s that + `gittarget_path_overlap`) so a caller never proposes two `GitTarget`s that would be mutually refused. 6. **Emit** the report (below). ### Layout classification Discovery reports the layout **and** current operator acceptance as two distinct -truths — they diverge during the F2 gap (see below). +truths — they diverge wherever a layout is well understood but not accepted (see below). | `layout` | Meaning | `acceptedByOperator` today | |---|---|---| -| `plain` | Directory of KRM docs, explicit namespaces, no kustomization | ✅ shipped | -| `kustomize-single` | One render root; `namespace` + `resources`/`images`/`replicas` | ✅ shipped | -| `kustomize-overlay` | Base + N overlay roots, one namespace per overlay | ⛔ until **F2** — reason `overlay-fan-out-needs-f2` | +| `plain` | Directory of KRM docs, explicit namespaces, no kustomization | ✅ supported today | +| `kustomize-single` | One render root; `namespace` + `resources`/`images`/`replicas` | ✅ supported today | +| `kustomize-overlay` | Base + N overlay roots, one namespace per overlay | ⛔ not supported today — reason `overlay-fan-out-unsupported`; render-root scoping would accept it | | `refused-structural` | Helm inflation, generators with hash suffixes, `components`, `namePrefix`/`nameSuffix`, remote bases, `configurations`/`openapi`/`crds` | ⛔ permanent — the support contract | | `refused-fleet-root` | `clusters/` + `apps/` + `infra/` cluster-root repo (a `GitTarget` points at an app subtree, never a cluster root) | ⛔ out of scope by design | | `refused-out-of-band` | Namespace/transform injected outside the folder (Flux `postBuild`/`targetNamespace`, Argo Application-level overrides) | ⛔ permanent — round-trip cannot hold | @@ -155,25 +155,24 @@ truths — they diverge during the F2 gap (see below). > or Argo `Application`. Those CRs are themselves KRM documents in the repo, so detecting > out-of-band overrides later means parsing the fleet CRs and cross-referencing the app > subtree they target — a bounded future capability, already flagged as a "much-later -> feature" in [boundary §2](kustomize-support-boundary-and-product-model.md). The first +> feature" in [boundary §2](kustomize-support-boundary.md). The first > cut therefore ships four candidate layouts: `plain`, `kustomize-single`, > `kustomize-overlay`, `refused-structural`. -The distinction between `overlay-fan-out-needs-f2` and `refused-structural` is -the load-bearing one: the first is a **forward-looking** "not yet" that flips to -accepted when [F2](README.md) render-root scoping lands; the second is the -permanent boundary. Discovery must never collapse them into one "refused." **This -two-bucket split is what keeps the kustomize surface finite:** every construct sorts into -a **ladder** (a bounded roadmap of layouts we choose to build — plain → single → -overlay/F2 → …) or a **wall** (structurally non-invertible, refused forever). Neither is -unbounded work — the ladder is a sequence you climb deliberately; the wall costs nothing -but a clear reason. +The distinction between `overlay-fan-out-unsupported` and `refused-structural` is +the load-bearing one: the first is a **forward-looking** "not yet" that flips to accepted +if render-root scoping lands in the operator; the second is the **permanent** boundary. +Discovery must never collapse them into one "refused." **This two-bucket split is what +keeps the kustomize surface finite:** every construct sorts into either a bounded set of +layouts we choose to support (plain, single-context kustomize, and — planned — overlays) +or a **wall** (structurally non-invertible, refused forever). Neither is unbounded work — +the first is a finite set, built deliberately; the wall costs nothing but a clear reason. ## The report contract -Two renderings, matching the existing `--format text|json` split. JSON is the -product's interface. The shape below is what the [first cut](#first-cut-shipped-2026-07-09) -emits, per candidate — **except `proposedGitTarget`, which is the eventual goal and is +Two renderings, matching the existing `--format text|json` split. JSON is the interface a +tool built on top consumes. The shape below is what the +[first cut](#first-cut-shipped-2026-07-09) emits, per candidate — **except `proposedGitTarget`, which is the eventual goal and is not emitted yet** (CR proposal is deferred). Do not copy `proposedGitTarget` as if it were live output. (The block is fenced `jsonc` because it carries an explanatory comment — the shipped report is strict JSON.) @@ -184,7 +183,7 @@ comment — the shipped report is strict JSON.) "layout": "kustomize-overlay", "acceptedByOperator": false, "refusalReasons": [ - { "code": "overlay-fan-out-needs-f2", "detail": "base \"apps/podinfo/base\" is read from outside this folder's subtree and is shared by 3 render root(s); render-root scoping (F2) required" } + { "code": "overlay-fan-out-unsupported", "detail": "base \"apps/podinfo/base\" is read from outside this folder's subtree and is shared by 3 render root(s); render-root scoping required" } ], "renderRoot": true, "readScope": ["apps/podinfo/base"], @@ -205,8 +204,8 @@ comment — the shipped report is strict JSON.) `{ rendered, editable, nonKrm }` split (see [First cut](#first-cut-shipped-2026-07-09) for why rendered and editable diverge for overlays). Plus a repo-level summary: `candidatesByLayout`, `accepted`/`refused` counts, `overlapConflicts`, `fleetRoot`, and -`unsupportedConstructs` (so the product can say "this repo uses Helm inflation in -`infra/`, which we don't manage"). +`unsupportedConstructs` (so a caller can say "this repo uses Helm inflation in +`infra/`, which the operator does not manage"). **Exit codes** reuse the CLI convention (`exitOK=0`, `exitRefused=1`, `exitUsage=2`). The eventual design: `--policy report` always exits 0 (pure report); @@ -223,7 +222,7 @@ A new mode on `manifest-analyzer` (shipped form): manifest-analyzer --mode scan-repo --format json ``` -Naming note: the modes are named after the product question they answer, matching the +Naming note: the modes are named after the question they answer, matching the public [`pkg/manifestanalyzer`](../../../pkg/manifestanalyzer) entry points — `scan-folder` asks "may **this folder** become a GitTarget?" (`ScanFolder`) and `scan-repo` asks "which folders under **this repo root** could?" (`ScanRepo`). The first @@ -238,14 +237,13 @@ so "discovery" is not overloaded remains a possible follow-up. `--policy` is acc symmetry but the repo-level refuse gate is deferred (see [First cut](#first-cut-shipped-2026-07-09)). -The report should also be exposed as a **library function** (the product is -likely part of the same Go binary family), with the CLI mode as the thin wrapper -+ CI gate. Library-first keeps the product from shelling out and re-parsing JSON. +The report should also be exposed as a **library function**, with the CLI mode as the thin +wrapper + CI gate. Library-first keeps a caller from shelling out and re-parsing JSON. ## First cut (shipped 2026-07-09) -A lean first slice landed on branch `feat/gitops-api-f8`. It **reports**; it does not -yet **propose**. Library-first, as recommended above. +A lean first slice landed on 2026-07-09. It **reports**; it does not yet **propose**. +Library-first, as recommended above. **Surface.** `ScanRepo(ctx, root) (RepoReport, error)` in `internal/manifestanalyzer/scan_repo.go`, with `--mode scan-repo ` @@ -254,7 +252,7 @@ followed — the same posture as `ScanDir`, over the whole tree. It reuses `coll `parseKustomizations`/`renderRoots`, the `Scan`/acceptance gate, and mirrors `gittarget_path_overlap` for nesting. -A product layer consuming this from Go imports [`pkg/manifestanalyzer`](../../../pkg/manifestanalyzer) +A tool consuming this from Go imports [`pkg/manifestanalyzer`](../../../pkg/manifestanalyzer) — `ScanRepo` and `ScanFolder` — rather than exec'ing the binary. That package is the supported, versioned projection of the reports below; the engine above stays internal and free to move. @@ -270,7 +268,7 @@ free to move. reference; for a plain folder it is the whole directory. `editable` counts only the rendered source physically in the candidate's own subtree. They are equal for plain / self-contained kustomize candidates and **diverge for an overlay** (e.g. `rendered: 2, - editable: 0`) — the overlay renders a base it cannot yet edit, which makes the F2 gap + editable: 0`) — the overlay renders a base it cannot edit, which makes the overlay gap legible at a glance. - Repo summary: `candidatesByLayout`, `accepted`, `refused`, `overlapConflicts[]`, `fleetRoot`, `unsupportedConstructs[]`. @@ -283,11 +281,11 @@ falsely reported refused. A refused plain / self-contained candidate carries the issues as `refusalReasons` (`{code, detail}` — duplicate identity, non-KRM YAML, a foreign file, an unsupported nested kustomization, …), never a bare `false`. The structural gate refuses `openapi`/`crds` alongside `configurations`, matching the -[support boundary §1](kustomize-support-boundary-and-product-model.md). +[support boundary §1](kustomize-support-boundary.md). **Classification findings.** -- The overlay discriminator that trips `overlay-fan-out-needs-f2` is precisely **the base +- The overlay discriminator that trips `overlay-fan-out-unsupported` is precisely **the base escaping the render root's own subtree** (`../../base` resolves outside the candidate) — the very fact the operator's hard subtree-scope hits. Fan-out (how many overlay roots share the base) is carried as informative `detail`, not the trigger. A base nested @@ -319,33 +317,30 @@ nested base (deduped `rendered`), an overlay base holding parked YAML (excluded targets, never "apps to deploy." - **Writes nothing, no Git-host calls, no cluster required.** Structure-only, read-only, symlinks never followed — same posture as `ScanDir`. -- **Proposes, never creates.** The CLI/library emits candidate `GitTarget`s; the - product layer decides, renders the actual manifests (naming, labels, - ownerRefs), and opens PRs. CR generation stays out of the operator. +- **Proposes, never creates.** The CLI/library emits candidate `GitTarget`s; a tool + built on top decides, renders the actual manifests (naming, labels, ownerRefs), + and opens PRs. CR generation stays out of the operator. - **Moves no boundary.** Refused layouts stay refused; discovery only *reports* - them. It does not make the operator accept overlays — [F2](README.md) does. + them. It does not make the operator accept overlays — only render-root scoping + in the operator would. - **`WatchRule` proposal is optional (open question).** Discovery can suggest `WatchRule`s from the kinds present in a folder, but watch selection is about - *which cluster resources flow* ([F7](finished/f7-higher-level-krm-documents.md)), + *which cluster resources flow* + ([higher-level KRM documents](finished/higher-level-krm-documents.md)), orthogonal to the Git path — it may be cleaner to stop at `GitTarget` and leave - watch scoping to the user/product. + watch scoping to the user. -## Relationship to the ladder +## Relationship to the operator -- **Dependencies are all shipped:** the acceptance gate, render-root computation - ([F1](finished/f1-images-replicas-edit-through.md)), and namespace inference. - Discovery is additive tooling on top. -- **F2 is the one that changes discovery's *output*, not its code:** pre-F2, - overlay candidates report `acceptedByOperator: false` + - `overlay-fan-out-needs-f2`; once F2 ships they flip to accepted with an +- **It ships no operator code.** Everything discovery depends on is already + shipped — the acceptance gate, render-root computation + ([images/replicas edit-through](finished/images-and-replicas-edit-through.md)), + and namespace inference. Discovery is additive tooling on top of the shared engine. +- **Overlay support would change discovery's *output*, not its code.** Today overlay + candidates report `acceptedByOperator: false` + `overlay-fan-out-unsupported`; if + render-root scoping ships in the operator they flip to accepted, with an `images:`/`replicas:` + overlay-local-file capability summary. The report is designed to be correct across that transition. -- **Intent mode (§8) reuses the same report** as its onboarding front door: the - set of accepted candidates and their namespaces is exactly what tells the - intent cluster which overlays to hydrate. -- **Not itself an operator write-model feature** — hence the "CLI / product-layer" - tag. It is tracked in the ladder for one delivery surface, but it ships no - operator code. ## Test plan @@ -354,7 +349,7 @@ nested base (deduped `rendered`), an overlay base holding parked YAML (excluded Helm-hybrid, and nested/overlapping candidates — each with a golden JSON report. - Assertions: render-root enumeration, layout classification, refusal-reason - codes (especially `overlay-fan-out-needs-f2` vs `refused-structural`), overlap + codes (especially `overlay-fan-out-unsupported` vs `refused-structural`), overlap detection, namespace/variant inference, and proposed `GitTarget` paths. - Reuse existing corpora where they fit (`internal/manifestanalyzer/testdata/contextual-namespace`, the `ambiguous-*` @@ -382,21 +377,21 @@ nested base (deduped `rendered`), an overlay base holding parked YAML (excluded open. 2. **Stop at `GitTarget`, or also propose `WatchRule`s?** — moot for now: the first cut proposes neither (reports only). -3. **Read-scope depth for overlays pre-F2** — how far up the tree to follow - `../../base` when the operator would still refuse the folder. _First cut:_ `readScope` - is the **minimal** set of out-of-subtree base directories (a base nested under another - reached base is folded into its parent, so the rendered-document count never - double-counts a shared nested base). How many levels the product should *display* +3. **Read-scope depth for overlays the operator refuses today** — how far up the tree to + follow `../../base` when the operator would still refuse the folder. _First cut:_ + `readScope` is the **minimal** set of out-of-subtree base directories (a base nested + under another reached base is folded into its parent, so the rendered-document count + never double-counts a shared nested base). How many levels a caller should *display* remains a presentation choice. -4. **Library vs. CLI as the product's integration point** — _settled:_ library-first +4. **Library vs. CLI as the integration point** — _settled:_ library-first (`ScanRepo`), CLI (`--mode scan-repo`) as the thin wrapper + CI gate. -5. **`overlay-fan-out-needs-f2` naming** — the reason code reads as if *fan-out* (a base - shared by several overlays) is the trigger, but the real trigger is a base **escaping - the render root's own subtree**, true even at fan-out = 1. The first cut carries the - shared-root count as descriptive `detail`, not as the condition. Open: rename to - something like `overlay-base-out-of-subtree-needs-f2`, or keep the product-facing code - and rely on the detail. _Not settled._ +5. **`overlay-fan-out-unsupported` naming** — the reason code still reads as if *fan-out* + (a base shared by several overlays) is the trigger, but the real trigger is a base + **escaping the render root's own subtree**, true even at fan-out = 1. The first cut + carries the shared-root count as descriptive `detail`, not as the condition. Open: + rename to something like `overlay-base-out-of-subtree`, or keep the published code — it + is part of `pkg/manifestanalyzer`'s surface — and rely on the detail. _Not settled._ 6. **Repo-level `--policy refuse` gate** — the eventual "zero acceptable candidates → exit 1" onboarding gate (see [Exit codes](#the-report-contract)) is **deferred**: the first cut always exits 0 (or 2 on an I/O error) and `--policy` is not applied in scan-repo - mode. Open: implement it as the CI/onboarding gate when the product needs it. + mode. Open: implement it as the CI/onboarding gate when a caller needs it. diff --git a/docs/design/gitops-api/resource-capability-model.md b/docs/design/support-boundary/resource-capability-model.md similarity index 98% rename from docs/design/gitops-api/resource-capability-model.md rename to docs/design/support-boundary/resource-capability-model.md index 4d6de1a9..f13463a8 100644 --- a/docs/design/gitops-api/resource-capability-model.md +++ b/docs/design/support-boundary/resource-capability-model.md @@ -5,7 +5,6 @@ > Related: > [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md), > [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md), -> [intent-cluster-hydration.md](intent-cluster-hydration.md), > [write-only-encrypted-secrets.md](write-only-encrypted-secrets.md), > [README.md](README.md) @@ -203,7 +202,7 @@ incrementally. 1. **Where does `schemaConformant` come from?** Today it would be hardcoded for the SOPS case. It could instead be *derived*: fetch the OpenAPI schema and try a strict decode. That is exact, and it needs a cluster — which - [`ScanRepo` explicitly does not have](f8-repo-discovery-and-onboarding-scan.md). + [`ScanRepo` explicitly does not have](repo-discovery-and-onboarding-scan.md). Is a hardcoded classifier acceptable, or does this belong to a cluster-aware second pass? 2. **Is `visibility` per-document or per-field?** A `SealedSecret` is `opaque` in diff --git a/docs/design/gitops-api/sealed-secrets-and-external-secrets.md b/docs/design/support-boundary/sealed-secrets-and-external-secrets.md similarity index 87% rename from docs/design/gitops-api/sealed-secrets-and-external-secrets.md rename to docs/design/support-boundary/sealed-secrets-and-external-secrets.md index e7048586..694587a6 100644 --- a/docs/design/gitops-api/sealed-secrets-and-external-secrets.md +++ b/docs/design/support-boundary/sealed-secrets-and-external-secrets.md @@ -1,11 +1,10 @@ -# Sealed Secrets and External Secrets: what day-1 support actually costs +# Sealed Secrets and External Secrets: what supporting them actually costs > Status: analysis; proposes one write-path provider and one safety gate. > Captured: 2026-07-10 > Related: > [resource-capability-model.md](resource-capability-model.md), > [write-only-encrypted-secrets.md](write-only-encrypted-secrets.md), -> [intent-cluster-hydration.md](intent-cluster-hydration.md), > [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md) ## The question @@ -18,7 +17,7 @@ not the Secret" — *one abstraction, or three kinds?* **Neither.** One [capability model](resource-capability-model.md), and: -| | New kind? | Day-1 code | +| | New kind? | Code needed | |---|---|---| | SOPS `Secret` | **yes** — `EncryptedSecret` | the projection | | `SealedSecret` | no | a second encryption provider, plus a rename guard | @@ -28,8 +27,8 @@ SOPS needs a kind because it is [not schema-conformant](resource-capability-mode not because it is encrypted. The other two are ordinary, valid KRM documents that an API server stores happily. `ExternalSecret` is not encrypted at all. -The real day-1 work is not in supporting either kind. It is a **safety gate** that -both of them make urgent, and which is missing today. +The real work is not in supporting either kind. It is a **safety gate** that both +of them make urgent, and which is missing today. --- @@ -59,7 +58,7 @@ Sealed Secrets permits `writeUnit: key`: ```mermaid sequenceDiagram actor User - participant K8s as Intent cluster + participant K8s as Source cluster participant Rev as GitOps Reverser participant Git @@ -104,7 +103,7 @@ Under `strict` scope: > re-seal** — and we cannot re-seal a value we cannot read. A rename is therefore a silent, partial destruction: the keys we rewrote survive, -the keys we merely copied through become undecryptable. Day-1 rule: **refuse a +the keys we merely copied through become undecryptable. The rule: **refuse a name or namespace change on a strictly-scoped `SealedSecret`.** The scope is readable from the annotations, so this gate needs no key and no controller. @@ -153,7 +152,7 @@ Every byte is plaintext, structural, ordinary KRM. It is readable, writable, round-trippable, and an API server stores it without complaint. Its capability is `schemaConformant: true`, `visibility: elsewhere`, `writeUnit: document`. -**Day-1 code required: none.** It already flows through the existing path. +**Code required: none.** It already flows through the existing path. `elsewhere` is not a weaker `opaque`. The document is not hiding a value; there is no value in it. Editing `remoteRef.key` changes *which* secret is fetched. Nothing @@ -229,24 +228,26 @@ it** — the evidence must be consumed before it is discarded. > [expansion-boundary-and-corpus-organisation.md](expansion-boundary-and-corpus-organisation.md) > for the argument. -That single gate is the entire day-1 cost of supporting External Secrets safely, -and it is not really about External Secrets at all. +That single gate is the entire cost of supporting External Secrets safely, and it +is not really about External Secrets at all. -## What to build, in order +## What is missing -1. **The `ownerReference` gate on the mirror path.** Smallest, most valuable, - independent of everything else here. Protects the External Secrets and Sealed - Secrets derived `Secret`s, and much besides. -2. **The [capability registry](resource-capability-model.md)** with three - classifiers: `Secret`+`sops:`, `SealedSecret`, `ExternalSecret`. `ExternalSecret` - is a two-line classifier that exists only to say `visibility: elsewhere`. -3. **`EncryptedSecret`** — the projection SOPS needs because it is not - schema-conformant. -4. **The `sealed-secrets` encryption provider**, priced honestly as a kind - transform rather than as a crypto change. +None of the four exists today. -Steps 1 and 2 are day-1. Step 3 is the SOPS work already designed. Step 4 is a -genuine feature, and the estimate belongs to the identity model, not to `kubeseal`. +- **The `ownerReference` gate on the mirror path.** A few lines, and independent + of everything else here. Protects the External Secrets and Sealed Secrets + derived `Secret`s, and much besides. +- **The [capability registry](resource-capability-model.md)** with three + classifiers: `Secret`+`sops:`, `SealedSecret`, `ExternalSecret`. `ExternalSecret` + is a two-line classifier that exists only to say `visibility: elsewhere`. + Independent of everything else here. +- **`EncryptedSecret`** — the projection SOPS needs because it is not + schema-conformant. Designed in + [write-only-encrypted-secrets.md](write-only-encrypted-secrets.md). +- **The `sealed-secrets` encryption provider**, priced honestly as a kind + transform rather than as a crypto change. The cost belongs to the identity + model, not to `kubeseal`. ## Open questions @@ -262,8 +263,8 @@ genuine feature, and the estimate belongs to the identity model, not to `kubesea `SealedSecret` document breaks the one-identity-one-document assumption that placement, deletion planning and `GitPathAccepted` all rest on. Is there a cheaper framing — for instance, the user edits a `SealedSecret` *directly* in - the intent cluster, with a `stringData`-style write-only field that the - operator seals and clears? + the cluster the operator watches, with a `stringData`-style write-only field + that the operator seals and clears? 4. **`creationPolicy: Merge` and `Orphan`.** With `Orphan`, ESO sets **no** `ownerReference`. The gate in this doc then does not fire, and the derived `Secret` looks exactly like a hand-written one. Is that acceptable, or does the diff --git a/docs/design/gitops-api/support-contract.md b/docs/design/support-boundary/support-contract.md similarity index 86% rename from docs/design/gitops-api/support-contract.md rename to docs/design/support-boundary/support-contract.md index f01f6ed6..81ab3a3e 100644 --- a/docs/design/gitops-api/support-contract.md +++ b/docs/design/support-boundary/support-contract.md @@ -17,7 +17,7 @@ them. We mirror and edit the intent layer, because that is the layer with a home Git and the layer a careful human would edit anyway. We refuse the expansion layer, because expansion is a one-way function and its output has nowhere to go. -That refusal is **the product's defensible support contract, not a gap.** +That refusal is **the operator's defensible support contract, not a gap.** ## The three questions we ask @@ -27,7 +27,7 @@ doc. | # | Question | Failure if we get it wrong | Where it is argued | |---|---|---|---| | 1 | **Is it KRM, and may I read/write it?** | we corrupt a document we did not understand | [resource-capability-model.md](resource-capability-model.md) | -| 2 | **Can this edit be written back to exactly one document?** | we cannot express the change, or we change more than one thing | [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md), [gittarget-granularity-and-cross-environment-edits.md §1](gittarget-granularity-and-cross-environment-edits.md) | +| 2 | **Can this edit be written back to exactly one document?** | we cannot express the change, or we change more than one thing | [kustomize-support-boundary.md](kustomize-support-boundary.md), [gittarget-granularity-and-cross-environment-edits.md §1](gittarget-granularity-and-cross-environment-edits.md) | | 3 | **Does that document already have another writer — and does this object even have a home in Git?** | we destroy someone else's invariant, or invent a second source of truth | [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md), [expansion-boundary-and-corpus-organisation.md](expansion-boundary-and-corpus-organisation.md) | **The governing rule of question 2 is fan-in = 1: we never change more than one @@ -57,7 +57,7 @@ templates, and multi-input ResourceSet templates alike. It is specified once, in | Argo CD `ApplicationSet` (the CR) | intent | **Editable as a document** | but its `template` has fan-in N — see below | | App-of-apps root `Application` | intent | Editable, flagged **cluster entry point** | not an onboarding answer | | Flux `Kustomization`, `GitRepository`, `OCIRepository`, `HelmRepository` | intent | **Editable** | ordinary KRM | -| Flux `HelmRelease` | intent | **Editable** | shipped (F7) | +| Flux `HelmRelease` | intent | **Editable** | shipped; an ordinary KRM document like any other | | Objects the helm-controller renders from it | expansion | **Not mirrored** | no home file | | flux-operator `ResourceSet` (the CR) | intent | **Editable as a document** | `spec.inputs` is the supported edit surface | | Objects a `ResourceSet` expands | expansion | **Not mirrored** | `spec.resources` × inputs; no home file | @@ -70,10 +70,10 @@ templates, and multi-input ResourceSet templates alike. It is specified once, in | Construct | Verdict | Why | |---|---|---| -| kustomize `resources`, `namespace`, `images`, `replicas` | **Editable** | invertible; F1 ships `images`/`replicas` edit-through | -| kustomize base + un-fancy overlays | **Editable at launch (F2)** | the base stays read-only context | +| kustomize `resources`, `namespace`, `images`, `replicas` | **Editable** | invertible; `images`/`replicas` edit-through is shipped | +| kustomize base + un-fancy overlays | **Designed, not shipped** | render-root scoping; the base stays read-only context | | kustomize base shared by >1 overlay, edited in place | **Refused** | fan-in > 1 | -| kustomize `patches*`, generators, `components`, `namePrefix`/`nameSuffix`, remote bases | **Refused** | non-invertible; F3 would author patches | +| kustomize `patches*`, generators, `components`, `namePrefix`/`nameSuffix`, remote bases | **Refused** | non-invertible; the only safe route would be patches the operator authored itself | | kustomize `helmCharts:` (inflation) | **Refused** | we never render a chart | | A Helm chart (`Chart.yaml` + `templates/` + `values.yaml` + `crds/`) | **Skipped as a unit** | detected by folder structure and reported as a `helm-chart` layout, not as silence plus an incidental `crds/` | | Helm knobs on a `HelmRelease` / `Application` (chart version, inline values, parameters) | **Editable** | the Helm surface people actually use — see below | @@ -99,7 +99,8 @@ We already do more Helm than that sentence admits, and the honest headline is: > you edit, not a chart you render.** The most common Helm operations in a GitOps repo are *bump the chart version* and -*change a value on a `HelmRelease`*, and both have worked since F7. What stays +*change a value on a `HelmRelease`*, and both have worked since higher-level KRM +documents landed. What stays refused, permanently and correctly, is **chart inflation**: we never render `templates/`, and we never learn what a value means. @@ -124,17 +125,15 @@ we can store — and is argued in | Doc | What it settles | |---|---| -| [the-layer-above-and-the-expansion-graph.md](the-layer-above-and-the-expansion-graph.md) | **the architecture: kcp + Flux + Argo CD above this operator, and the graph these verdicts are a property of** | | [`../../facts/expansion-provenance-markers.md`](../../facts/expansion-provenance-markers.md) | **the measured evidence each producer leaves behind** — and why the `ownerReference` gate catches one producer in five | -| [README.md](README.md) | the feature ladder F1–F8, and the launch path | -| [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md) | the kustomization field taxonomy and the supported-layout allowlist | +| [README.md](README.md) | the index of this folder, and the summary of what works today | +| [kustomize-support-boundary.md](kustomize-support-boundary.md) | the kustomization field taxonomy and the supported-layout allowlist | | [gittarget-granularity-and-cross-environment-edits.md](gittarget-granularity-and-cross-environment-edits.md) | **the write boundary (L1/L2) — the one home of fan-in = 1** | | [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md) | where Flux/Argo knowledge lives: claims about paths, not a dependency | | [expansion-boundary-and-corpus-organisation.md](expansion-boundary-and-corpus-organisation.md) | the provenance axis; ApplicationSet vs ResourceSet; the Helm surface | | [resource-capability-model.md](resource-capability-model.md) | what may I do to *this document* (schema conformance, visibility, write unit) | | [write-only-encrypted-secrets.md](write-only-encrypted-secrets.md) | SOPS: describe the ciphertext, never read it | | [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md) | why neither needs a new kind, and the derived-object gate | -| [intent-cluster-hydration.md](intent-cluster-hydration.md) | how the objects get into the cluster to be edited at all | | [unreflectable-edits-and-write-gating.md](unreflectable-edits-and-write-gating.md) | what happens to an edit with no legal destination | -| [f8-repo-discovery-and-onboarding-scan.md](f8-repo-discovery-and-onboarding-scan.md) | reporting all of this over a whole repository | +| [repo-discovery-and-onboarding-scan.md](repo-discovery-and-onboarding-scan.md) | reporting all of this over a whole repository | | [`test/fixtures/gitops-layouts/`](../../../test/fixtures/gitops-layouts/) | the corpus of real-world shapes every verdict is checked against | diff --git a/docs/design/gitops-api/unreflectable-edits-and-write-gating.md b/docs/design/support-boundary/unreflectable-edits-and-write-gating.md similarity index 52% rename from docs/design/gitops-api/unreflectable-edits-and-write-gating.md rename to docs/design/support-boundary/unreflectable-edits-and-write-gating.md index 9398f969..00c9ec8e 100644 --- a/docs/design/gitops-api/unreflectable-edits-and-write-gating.md +++ b/docs/design/support-boundary/unreflectable-edits-and-write-gating.md @@ -1,12 +1,11 @@ # Unreflectable edits: honest accounting and the admission preflight gate -> Status: direction-setting (no code change; extends -> [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md) -> §5/§8, defines F6) +> Status: direction-setting — designed, not built (no code change; extends +> [kustomize-support-boundary.md](kustomize-support-boundary.md) §5) > Captured: 2026-07-06 > Related: > [README.md](README.md), -> [finished/f1-images-replicas-edit-through.md](finished/f1-images-replicas-edit-through.md), +> [finished/images-and-replicas-edit-through.md](finished/images-and-replicas-edit-through.md), > [../unsupported-folder-refusal-plan.md](../../spec/unsupported-folder-refusal-plan.md) ## Problem @@ -19,22 +18,23 @@ hydrated object can no longer be changed through the Kubernetes API** — or more precisely, the change persists in the cluster but has no legal destination in Git. -With the reference layout (base + test/acceptance/production overlays, the -product-launch target) and F1 shipped + F2/F3 as scoped, the unreflectable -classes are concrete and enumerable: - -1. **Out-of-scope field edits on a base-owned object.** F3 v1 authors - scalar-field strategic-merge patches; anything beyond that scope - (structural list surgery on unkeyed lists, atomic-list semantics, - map-key removal if excluded from v1) has no destination. Until F3 lands, - *every* per-environment field edit on a base-owned object is in this - class — at launch it is the largest one. +With the reference layout (base + test/acceptance/production overlays) — where +`images:`/`replicas:` edit-through is supported today and overlay **patch +authoring** is not — the unreflectable classes are concrete and enumerable: + +1. **Out-of-scope field edits on a base-owned object.** Overlay patch authoring + (writing a scalar-field strategic-merge patch into the overlay) is designed + but **not supported today**, so *every* per-environment field edit on a + base-owned object currently lands in this class — it is the largest one. Even + with patch authoring, anything beyond scalar fields (structural list surgery + on unkeyed lists, atomic-list semantics, map-key removal) still has no + destination. 2. **Per-environment delete of a base-owned object.** Expressible only as a - `$patch: delete` patch — in or out of F3 v1 is a scope decision; until it - is in, unreflectable. (A rename is a delete plus a create: the create - half is always fine, the delete half is this class.) -3. **Divergent consumers of a shared override entry** (F1's known - limitation): one `images:` entry cannot hold two tags. + `$patch: delete` patch — whether patch authoring ever covers it is a scope + decision; until it does, unreflectable. (A rename is a delete plus a create: + the create half is always fine, the delete half is this class.) +3. **Divergent consumers of a shared override entry** (a known limitation of + `images:`/`replicas:` edit-through): one `images:` entry cannot hold two tags. 4. **Transformer-supplied metadata**: a label or annotation owned by a tolerated-but-unmodeled metadata transformer (`commonLabels`, `labels`, `commonAnnotations`, `buildMetadata`) cannot be edited per environment. @@ -54,10 +54,10 @@ these edits anyway?** a visible fact, not a quiet divergence. 3. **Never punish the folder for one edit.** Structural facts about the *folder* may refuse the whole GitTarget (that gate exists today); a - single runtime *edit* must never stall every session on the target. + single runtime *edit* must never stall every subsequent write to the target. 4. **Feedback belongs near the actor.** The best place to learn "this cannot be saved" is at `kubectl apply` time; the second best is on the - CommitRequest the product already polls; a GitTarget condition is the + CommitRequest a caller already polls; a GitTarget condition is the backstop, not the primary surface. 5. **Correctness must not depend on optional layers.** Any admission-time gate can be down, stale, or disabled; the system underneath it must @@ -73,29 +73,29 @@ at, plus the structural gate that already exists: | Tier | Scope | Mechanism | Status | |---|---|---|---| | **1. Onboarding refusal** | whole folder, structural facts | acceptance gate: `GitPathAccepted=False`, `Stalled=True` on unsupported constructs | shipped | -| **2. Per-edit accounting** | one object/field, runtime edits | the **unreflected set** + `FullyReflected` conditions; self-healing in intent mode | the load-bearing answer — ships with the F2/F4 launch unit | -| **3. Admission preflight** | one API request, pre-persistence | opt-in validating webhook in the intent cluster; rejects writes that would leave residue; **fail-open** | F6, fast-follow | +| **2. Per-edit accounting** | one object/field, runtime edits | the **unreflected set** + `FullyReflected` conditions | designed, not built — the load-bearing answer, and a prerequisite for overlay support | +| **3. Admission preflight** | one API request, pre-persistence | opt-in validating webhook; rejects writes that would leave residue; **fail-open** | designed, not built | ```mermaid flowchart TD E[Sanitized watch event in env X] --> D{Legal destination
in overlay X?} D -->|images / replicas entry| K[Edit overlay kustomization] D -->|overlay-local document| P[In-place file edit] - D -->|F3-expressible field
on base-owned object| S[Author / update overlay patch] + D -->|patch-expressible field
on base-owned object| S[Author / update overlay patch] D -->|new object| N[New overlay file + resources entry] D -->|none| U[Record residue in unreflected set
write nothing] - K --> C[Commit on session branch] + K --> C[Commit on the target's branch] P --> C S --> C N --> C U --> R[FullyReflected=False on
GitTarget + CommitRequest] - R --> H[Intent mode: next hydration reverts the residue
mirror mode: standing honest drift report] + R --> H[Standing, honest drift report
cleared if the render is re-applied] ``` Note the fifth branch: a single API write can contain both reflectable and -unreflectable fields. The writer reflects what it can (F1 already routes -mixed changes field-by-field) and records the remainder — see the atomicity -caveat under tier 3. +unreflectable fields. The writer reflects what it can (override-entry +edit-through already routes mixed changes field-by-field) and records the +remainder — see the atomicity caveat under tier 3. ## Tier 2: the unreflected set (load-bearing) @@ -104,7 +104,7 @@ live state and the folder's render, per GitTarget, annotated with the supplier/reason that made each residue unwritable. It should be recomputable: the mark-and-sweep resync rebuilds it from scratch, steady-state events add and remove entries incrementally, and no durable store is needed (consistent -with "watch supplies state"). But this is real F2 implementation work, not a +with "watch supplies state"). But this is real implementation work, not a status-only rename: the projection must know which fields came from shared context, overlay-local files, override entries, or transformer-owned metadata. @@ -116,34 +116,36 @@ context, overlay-local files, override entries, or transformer-owned metadata. unaffected — the target still works; this is a report, not a failure. - **CommitRequest** gains the same `FullyReflected` condition scoped to the saved window: "everything you asked to save was expressed in the commit." - This is the product's primary surface — it already polls the - CommitRequest for `Pushed` + `status.sha`, so "your session saved, but - these 2 edits could not be expressed and will be reverted" is one more - condition on an object it already reads. - -**Convergence.** What happens to the residue differs by topology, and in -both cases the honest report is our whole job: - -- **Intent mode**: the hydrator re-applies `main`'s render, reverting the - residue — the unsavable part of the buffer is discarded, like an editor - refusing to keep an invalid character. `FullyReflected` returns to `True` - on its own. The loop is safe *by construction*, gate or no gate. -- **Mirror mode**: the cluster is the source of truth and nothing reverts - (unless the customer's own GitOps tool drift-corrects). The condition is - then a standing, honest statement: "live state exists that this folder - cannot express." That is a drift report, not an error — and it must never - block the customer's cluster operations. - -**Clearing.** An entry clears when live equals render again — whether by -hydration, by the customer's drift correction, or by the user undoing the -edit. No timer, no manual ack. - -## Tier 3: the admission preflight gate (F6) - -An opt-in validating admission webhook, registered in the intent cluster on -CREATE/UPDATE/DELETE in the namespaces claimed by gated GitTargets. It -evaluates the same projection the writer uses — "would this write leave -residue?" — and rejects with an actionable message naming the supplier: + This is the primary surface for a caller — a tool built on the operator + already polls the CommitRequest for `Pushed` + `status.sha`, so "the commit + landed, but these 2 edits could not be expressed" is one more condition on + an object it already reads. + +**Convergence.** What happens to the residue depends on whether anything +re-applies the folder's render to the cluster, and in both cases the honest +report is our whole job: + +- **Nothing re-applies the render** (the operator mirrors a cluster that is + itself the source of truth): the residue simply persists. The condition is + then a standing, honest statement — "live state exists that this folder + cannot express." That is a drift report, not an error, and it must never + block the cluster's own operations. +- **Something re-applies the render** (a drift-correcting GitOps controller, + or a layer above the operator that hydrates the cluster from Git): the + residue is reverted — the unsavable part of the buffer is discarded, like + an editor refusing to keep an invalid character. `FullyReflected` returns to + `True` on its own, gate or no gate. + +**Clearing.** An entry clears when live equals render again — whether by a +re-applied render, by drift correction, or by the user undoing the edit. No +timer, no manual ack. + +## Tier 3: the admission preflight gate + +An opt-in validating admission webhook, registered on CREATE/UPDATE/DELETE in +the namespaces claimed by gated GitTargets. It evaluates the same projection +the writer uses — "would this write leave residue?" — and rejects with an +actionable message naming the supplier: > `spec.template.spec.containers[0].env` on `Deployment/podinfo` is supplied > by `apps/podinfo/base/deployment.yaml`, which is shared by all @@ -155,18 +157,19 @@ Design choices, each answering a concern raised against the webhook idea: - **Fail-open (`failurePolicy: Ignore`), because tier 2 backstops it.** The gate is a UX accelerator, not a correctness layer. If it is down, edits - land, tier 2 reports them, hydration reverts them. This is what makes - "slows things down / could be annoying" acceptable: nothing depends on it. -- **Scoped, so the latency worry stays small.** It gates only claimed - namespaces in a cluster the product owns end-to-end; no customer workload - traffic ever crosses it. Evaluation is in-memory against the manifest - store — no Git round-trip. + land, tier 2 reports them, and a re-applied render reverts them. This is + what makes "slows things down / could be annoying" acceptable: nothing + depends on it. +- **Scoped, so the latency worry stays small.** It gates only the claimed + namespaces on a cluster that exists to be edited *through* the operator; no + unrelated workload traffic crosses it. Evaluation is in-memory against the + manifest store — no Git round-trip. - **Staleness is tolerated, not solved.** The decision uses a snapshot of the analyzer store that can race a concurrent push. A wrong *allow* is caught by tier 2; a wrong *deny* is a retry. Neither corrupts anything. - **Free preflight via dry-run.** With `sideEffects: None` the gate runs on `kubectl apply --dry-run=server` — "can I save this?" becomes a native - Kubernetes question the product UI can ask before the user commits. + Kubernetes question any caller can ask before the user commits. - **The real argument for building it is atomicity, not speed.** Tier 2 reflects field-by-field: a single apply that bumps a tag *and* edits an unreflectable field saves the tag and loses the edit — a mixed outcome @@ -176,10 +179,12 @@ Design choices, each answering a concern raised against the webhook idea: [architecture.md](../../architecture.md) — used here for exactly what it is good at: prevention. Admission prevents, audit attributes, watch supplies state.) -- **Never in mirror mode.** We do not get to reject a customer's production - operations because our mirror is lossy. The gate is an intent-cluster - product feature, off by default, enabled per GitTarget (e.g. - `spec.writeGate: Enforce | Off`). +- **Never on a cluster the operator merely mirrors.** We do not get to reject + a cluster's own operations because our mirror of it is lossy. The gate is + off by default and enabled per GitTarget (e.g. `spec.writeGate: Enforce | + Off`) — appropriate only where the cluster is an *editing surface* whose + changes are meant to land in Git, never where the cluster is the source of + truth. ## Why not a GitTarget-wide "unsupported mode" @@ -189,11 +194,11 @@ an unreflectable edit occurs — mixes two different kinds of fact: - **Structural facts** are stable, folder-level, and human-fixable ("this folder uses Helm"). Whole-target refusal is right, exists today (tier 1), and stays. -- **Runtime edits** are transient, object-level, and often self-healing - (hydration reverts them minutes later). Escalating them to a target-wide - state punishes every session for one edit, moves the feedback far from - the actor, and flaps: `Stalled` would toggle as hydration reverts the - residue. +- **Runtime edits** are transient, object-level, and often self-healing (a + re-applied render reverts them minutes later). Escalating them to a + target-wide state punishes every subsequent write for one edit, moves the + feedback far from the actor, and flaps: `Stalled` would toggle as the + residue is reverted. So the target-wide idea survives as the *reporting* half of tier 2 — a `FullyReflected=False` condition with a bounded sample — while never @@ -202,43 +207,44 @@ non-invasive, rather than a trade between the two. ## Reference-layout walk-through -Every row assumes the launch layout (`base/` + `overlays/{test,acceptance, -production}`) with F2+F4 shipped (and F3 where marked), acting in -`podinfo-test`: +Every row assumes the reference layout (`base/` + `overlays/{test,acceptance, +production}`) and **render-root scoping** — overlay support, which is *not* +supported today — acting in `podinfo-test`. New-file placement is shipped; +overlay patch authoring is not. | Action in `podinfo-test` | Outcome | |---|---| | `kubectl set image deploy/podinfo podinfo=…:6.6.1` | reflected → `images:` entry in `overlays/test/kustomization.yaml` | | `kubectl scale deploy/podinfo --replicas=5` | reflected → `replicas:` entry | -| set an env var / resource limit on the base-owned Deployment | with **F3**: reflected → `overlays/test/podinfo-deployment.patch.yaml`; at launch (F2+F4 only): **unreflected** — reported, reverted by hydration | -| `kubectl apply -f new-cronjob.yaml` | reflected → new overlay-local file + `resources:` entry (F4) | +| set an env var / resource limit on the base-owned Deployment | with **overlay patch authoring**: reflected → `overlays/test/podinfo-deployment.patch.yaml`; without it: **unreflected** — reported, and reverted wherever the render is re-applied | +| `kubectl apply -f new-cronjob.yaml` | reflected → new overlay-local file + `resources:` entry (new-file placement) | | edit the test-only debug-toolbox object | reflected → in-place edit of `overlays/test/debug-toolbox.yaml` | -| delete the base-owned Service in test only | **unreflected** until `$patch: delete` lands in F3 → reported, reverted by hydration (gate rejects it up front) | +| delete the base-owned Service in test only | **unreflected** until patch authoring covers `$patch: delete` → reported, reverted where the render is re-applied (the preflight gate rejects it up front) | | change a label supplied by `commonLabels` | **unreflected** (transformer-owned metadata) | -| hot-bump one of two Deployments sharing one `images:` entry | **unreflected** (divergent consumers — F1's known limitation) | +| hot-bump one of two Deployments sharing one `images:` entry | **unreflected** (divergent consumers — a known limitation of override-entry edit-through) | -These rows are the intended residual surface for the launch layout. The F2/F4 -definition of done must prove that surface with a corpus and e2e cases; any -new residual class either gets a legal destination or joins this table with a -clear reason. That is the support statement the product can make — each +These rows are the intended residual surface for that layout. The definition of +done for overlay support must prove that surface with a corpus and e2e cases; +any new residual class either gets a legal destination or joins this table with +a clear reason. That is the support statement the operator can make — each unsupported row has a designed answer (report + revert, optionally reject up front) rather than undefined behavior. -## Consequences for the feature ladder - -- **Tier 2 is part of the F2/F4 definition of done**, not a separate feature: - the Kustomize launch unit ships *without* F3, so overlay support without - the unreflected set would reintroduce silent divergence, which principle 2 - forbids. -- **Tier 3 is F6** — a fast-follow after the F2/F4 launch unit, independent - of F3; intent-mode only, opt-in, fail-open. Its value is *highest while F3 - is absent*: - per-env edits of base-owned fields are then the largest unreflected - class, and the gate is what tells the user so at apply time instead of - after the save. It needs the same projection tier 2 needs, so its +## Consequences + +- **Tier 2 is a prerequisite for overlay support**, not a separate feature: + overlay support without the unreflected set would reintroduce silent + divergence, which principle 2 forbids. Patch authoring is not supported, so + per-environment edits of base-owned fields are the largest unreflected class + exactly where overlays are used. +- **Tier 3 is independent of patch authoring** — opt-in, fail-open, and only + for a cluster that is an editing surface. Its value is *highest while patch + authoring is absent*: per-env edits of base-owned fields are then the largest + unreflected class, and the gate is what tells the user so at apply time + instead of after the save. It needs the same projection tier 2 needs, so its marginal cost is the webhook plumbing, not new analysis. -- **F3 scope decisions move rows between tables.** Each capability added to - patch authoring (`$patch: delete`, map-key removal) deletes a row from - the unreflected classes. The classes list above doubles as F3's backlog, +- **Patch-authoring scope decisions move rows between tables.** Each capability + added to patch authoring (`$patch: delete`, map-key removal) deletes a row + from the unreflected classes. The classes list above doubles as its backlog, priced by how often each row is hit in practice — a metric tier 2's accounting can emit. diff --git a/docs/design/gitops-api/write-only-encrypted-secrets.md b/docs/design/support-boundary/write-only-encrypted-secrets.md similarity index 93% rename from docs/design/gitops-api/write-only-encrypted-secrets.md rename to docs/design/support-boundary/write-only-encrypted-secrets.md index 4c651ae8..6b479ae9 100644 --- a/docs/design/gitops-api/write-only-encrypted-secrets.md +++ b/docs/design/support-boundary/write-only-encrypted-secrets.md @@ -5,8 +5,8 @@ > Related: > [orchestrator-knowledge-boundary.md](orchestrator-knowledge-boundary.md), > [README.md](README.md), -> [kustomize-support-boundary-and-product-model.md](kustomize-support-boundary-and-product-model.md), -> [f8-repo-discovery-and-onboarding-scan.md](f8-repo-discovery-and-onboarding-scan.md), +> [kustomize-support-boundary.md](kustomize-support-boundary.md), +> [repo-discovery-and-onboarding-scan.md](repo-discovery-and-onboarding-scan.md), > fixture [`13-sops-encrypted`](../../../test/fixtures/gitops-layouts/5-opaque/sops-encrypted/) ## The idea @@ -109,10 +109,9 @@ only method, and `ResolvedEncryptionConfig` carries recipients only. So the property is preserved by construction — but it is preserved by *design discipline*, not by cryptography. -The distinction matters for the security claim below, and it matters for -[hydration](intent-cluster-hydration.md): an operator that can read that `Secret` -*could* decrypt. The rule that it must not is a rule, and it should be written -down as one. +The distinction matters for the security claim below: an operator that can read +that `Secret` *could* decrypt. The rule that it must not is a rule, and it should +be written down as one. ## The constraint that shapes the API: the MAC @@ -132,9 +131,9 @@ Two consequences, and they are not negotiable: plaintext document does, and exactly what the writer does today. So where does the complete plaintext come from, if not from Git? **From the live -cluster.** The intent cluster holds a real, readable `Secret`; Git holds the -ciphertext. The plaintext flows one way, and the operator never needs to reverse -it. +cluster.** The cluster the operator watches holds a real, readable `Secret`; Git +holds the ciphertext. The plaintext flows one way, and the operator never needs +to reverse it. That constraint is not a limitation to apologise for. It *is* the model: @@ -234,7 +233,7 @@ resolved and a write will land. ```mermaid sequenceDiagram actor User - participant K8s as Intent cluster + participant K8s as Source cluster participant Rev as GitOps Reverser participant Git participant Flux as kustomize-controller @@ -247,7 +246,7 @@ sequenceDiagram Rev->>Rev: sops --encrypt (fresh data key, new mac) Rev->>Git: commit secret.enc.yaml on a branch Rev-->>K8s: CommitRequest Pushed=True, sha, branch - Note over Git: Product layer opens the PR, then a human merges. + Note over Git: The operator opens no PR. Something above it does,
then a human merges. Git-->>Flux: reconcile Flux->>Flux: decrypt with private age identity Flux->>Prod: apply Secret frontend-db @@ -279,7 +278,7 @@ ownership we have over each document*, rather than silently claiming all of it. `ResourceCounts` grows an `encrypted` field, and an encrypted document stops counting as `editable` — the fix already named in the boundary doc. -## Why this is a good product result +## Why this is a good result - **A refusal becomes a capability.** "We do not support SOPS folders" turns into "we support SOPS folders, and we cannot read your secrets." The second sentence @@ -306,8 +305,8 @@ counting as `editable` — the fix already named in the boundary doc. behind a flag — not even in the bootstrap model, where the key material is reachable and the restraint is therefore ours to keep. The moment the operator reads, the security argument above evaporates. -- **Not a secret manager.** Rotation policy, generation, and vault integration are - the product layer's business. +- **Not a secret manager.** Rotation policy, generation, and vault integration sit + above the operator, not in it. - **Not a merge.** A per-key patch of an encrypted document is impossible without reading it, and pretending otherwise would corrupt the `mac`. @@ -333,11 +332,11 @@ counting as `editable` — the fix already named in the boundary doc. 4. **Is `EncryptedSecret` cluster-scoped truth or per-`GitTarget`?** The same `Secret` name may exist in several targets with different recipients. Does the projection key on `(GitTarget, identity)`? -5. **Should `Readable=False` block the intent cluster from showing a `Secret` at - all?** A user who runs `kubectl get secret frontend-db -o yaml` in the intent - cluster sees whatever plaintext they last wrote — which may be stale relative - to Git if someone edited the ciphertext by hand. Is the live `Secret` - authoritative, or is that drift we must detect and cannot see? +5. **Should `Readable=False` block the watched cluster from showing a `Secret` at + all?** A user who runs `kubectl get secret frontend-db -o yaml` there sees + whatever plaintext they last wrote — which may be stale relative to Git if + someone edited the ciphertext by hand. Is the live `Secret` authoritative, or + is that drift we must detect and cannot see? 6. **Does this extend to SealedSecrets and ExternalSecrets?** — *answered, in [sealed-secrets-and-external-secrets.md](sealed-secrets-and-external-secrets.md).* Neither one abstraction nor three kinds: one diff --git a/docs/facts/expansion-provenance-markers.md b/docs/facts/expansion-provenance-markers.md index d15f52d9..ea9c1483 100644 --- a/docs/facts/expansion-provenance-markers.md +++ b/docs/facts/expansion-provenance-markers.md @@ -34,9 +34,9 @@ assumed. ### 1. `ownerReference` is evidence for exactly one of the five -[`resource-capability-model.md`](../design/gitops-api/resource-capability-model.md) +[`resource-capability-model.md`](../design/support-boundary/resource-capability-model.md) and -[`sealed-secrets-and-external-secrets.md`](../design/gitops-api/sealed-secrets-and-external-secrets.md) +[`sealed-secrets-and-external-secrets.md`](../design/support-boundary/sealed-secrets-and-external-secrets.md) both define a `derived` object as *"Evidence: a controller `ownerReference` on the live object."* @@ -143,7 +143,7 @@ So in a generator-enumerated repository both naive moves are wrong: author the C you get a duplicate that fights the generator; omit it and — in every *other* layout — nothing deploys. This is why the `EnumeratedBy` claim exists, and why adding an app to such a repository is -[refused, loudly](../design/gitops-api/expansion-boundary-and-corpus-organisation.md). +[refused, loudly](../design/support-boundary/expansion-boundary-and-corpus-organisation.md). ## Incidental, but worth knowing diff --git a/docs/finished/documentation-triage.md b/docs/finished/documentation-triage.md index f39f37ef..f2c47561 100644 --- a/docs/finished/documentation-triage.md +++ b/docs/finished/documentation-triage.md @@ -21,7 +21,7 @@ the problem. | `docs/*.md` (user/operator guides) | ~20 | all — they are the product surface | | `docs/facts/` | 4 | all — durable reference | | `docs/design/*.md` + `design/stream/` | 57 | **9 active**, 9 reference | -| `docs/design/gitops-api/` | 13 | **all — the live workstream** | +| `docs/design/support-boundary/` | 13 | **all — the live workstream** | | `docs/design/manifest/` + `version2/` | 19 | ~3 — the rest shipped | | `docs/finished/` | 41 | **10 load-bearing** (see below — this is the bug) | | `docs/future/` | 13 | 8 still wanted | @@ -62,8 +62,8 @@ A previous reorganisation moved documents and never fixed the pointers. Today, docs/guide.md docs/keep.md docs/design/manifest/implementation-plan.md docs/design/commit-window-refactor.md docs/design/manifest/current-manifest-support-review.md docs/design/audit-readiness-probe-plan.md -docs/design/stream/api-source-of-truth-reconcile.md docs/design/gitops-api/f1-...md -docs/future/secret-value-retention-plan.md docs/design/gitops-api/f7-...md +docs/design/stream/api-source-of-truth-reconcile.md docs/design/support-boundary/f1-...md +docs/future/secret-value-retention-plan.md docs/design/support-boundary/f7-...md docs/design/stream/audit-diagnostic-streams-plan.md …and 6 more ``` @@ -82,10 +82,10 @@ Two consequences, and they shape the entire plan below: If you read nothing else, read these. This is the set that describes how the system works *today* or what is being decided *now*. -### The live workstream (13) — `docs/design/gitops-api/` +### The live workstream (13) — `docs/design/support-boundary/` All of it. This is the branch you are on. My separate proposal -([expansion-boundary-and-corpus-organisation.md](../design/gitops-api/expansion-boundary-and-corpus-organisation.md)) +([expansion-boundary-and-corpus-organisation.md](../design/support-boundary/expansion-boundary-and-corpus-organisation.md)) recommends adding a `support-contract.md` front door and folding four restatements of the fan-in rule into one. @@ -247,7 +247,7 @@ facts first (noted above). Git keeps everything; nothing is lost that a ### Phase 5 — the gitops-api consolidation Separately proposed in -[expansion-boundary-and-corpus-organisation.md](../design/gitops-api/expansion-boundary-and-corpus-organisation.md): +[expansion-boundary-and-corpus-organisation.md](../design/support-boundary/expansion-boundary-and-corpus-organisation.md): add a `support-contract.md` front door, fold the four restatements of the fan-in invariant into one, and de-duplicate the `--dry-run=server` evidence table. diff --git a/docs/future/idea-application-editing.md b/docs/future/idea-application-editing.md index 7f59a218..89ddd11f 100644 --- a/docs/future/idea-application-editing.md +++ b/docs/future/idea-application-editing.md @@ -2,9 +2,10 @@ ## Context -gitops-reverser is currently positioned as a tool for "intent clusters" — test environments where you -explore changes before promoting them. This document explores one concrete and powerful use case for -that positioning: making the ArgoCD GUI a first-class GitOps authoring tool. +gitops-reverser mirrors live Kubernetes state back into Git, which makes it useful in a cluster you +change on purpose — a test environment where you explore changes before promoting them. This document +explores one concrete and powerful use case for that: making the ArgoCD GUI a first-class GitOps +authoring tool. ## The idea diff --git a/docs/installing-apps-as-krm.md b/docs/installing-apps-as-krm.md index 0bb6d11f..1d4176ef 100644 --- a/docs/installing-apps-as-krm.md +++ b/docs/installing-apps-as-krm.md @@ -85,7 +85,7 @@ the small authored document, not the large derived tree — the derived tree is **Why mirroring the output is wrong**, not just noisy: -- It breaks the [governing rule](design/gitops-api/README.md) — round-trippability. +- It breaks the [governing rule](design/support-boundary/README.md) — round-trippability. A rendered object is *owned by a controller*: it carries generated names, hash suffixes, injected defaults, and controller-managed metadata. There is no single writable human destination for it, so an edit can't round-trip. Capturing diff --git a/docs/spec/README.md b/docs/spec/README.md index f61dd3c2..ebd8ed37 100644 --- a/docs/spec/README.md +++ b/docs/spec/README.md @@ -28,7 +28,7 @@ If you change one of these behaviours, change the document in the same commit. | [`current-manifest-support-review.md`](current-manifest-support-review.md) | the manifest store, plan/apply/flush, and the all-or-nothing folder claim | | [`contextual-namespace-and-kustomize-folder-editing.md`](contextual-namespace-and-kustomize-folder-editing.md) | kustomize graph-aware namespace inference; the supported subset | | [`reconcile-via-watchlist-mark-and-sweep.md`](reconcile-via-watchlist-mark-and-sweep.md) | initial reconcile; **no bookmark, no sweep** | -| [`gittarget-new-file-placement-rules.md`](gittarget-new-file-placement-rules.md) | where a brand-new resource's file goes (F4) | +| [`gittarget-new-file-placement-rules.md`](gittarget-new-file-placement-rules.md) | where a brand-new resource's file goes | | [`manifestedit-field-ownership-spike.md`](manifestedit-field-ownership-spike.md) | "the API wins" — full-object ownership, and the do-not-build list | | [`type-followability.md`](type-followability.md) | is a type followable, and if not, the single reason | | [`type-lifecycle-events-and-wobble-settling.md`](type-lifecycle-events-and-wobble-settling.md) | removal grace and flap coalescing | diff --git a/docs/spec/e2e-bi-directional-corner.md b/docs/spec/e2e-bi-directional-corner.md index badf70c1..356dd780 100644 --- a/docs/spec/e2e-bi-directional-corner.md +++ b/docs/spec/e2e-bi-directional-corner.md @@ -143,8 +143,9 @@ no further commits occur. Git is polluted, but nothing breaks. It breaks the moment that committed manifest reaches a cluster through **anything other than Argo's repo-server** — `kubectl apply`, Flux, a promotion pipeline, or -an intent-cluster hydration step. Those tools apply the file *verbatim*, tracking-id -and all. The live object now claims to belong to `app-a`. +any tool that applies the committed file into a second cluster. Those tools apply +the file *verbatim*, tracking-id and all. The live object now claims to belong to +`app-a`. When an Argo Application `app-b` later manages that object: @@ -420,7 +421,7 @@ stripped too, so its applies are commit-neutral.) Expected timeline, from the verified constants: self-heal's **first** revert is sub-second (backoff is zero on attempt 0; -[`argocd-bi-directional.md`](../design/gitops-api/argocd-bi-directional.md)), replaying the +[`argocd-bi-directional.md`](../design/support-boundary/argocd-bi-directional.md)), replaying the stale cached revision. The Reverser commits `WaffleBowl`, then observes the revert and commits `Cone`. At the 180s refresh Argo finds `Cone` in Git and is already Synced. **The user's change is lost, and Git history flaps.** @@ -463,7 +464,7 @@ directions: the API can now own it, but a **Git-side** change to `/spec/scoops` would no longer reach the cluster either. That is the whole point of split ownership, and the whole reason it is not the bi-directional answer. The genuine bi-directional configuration is `selfHeal: false` + the webhook (see -[`argocd-bi-directional.md`](../design/gitops-api/argocd-bi-directional.md)); Spec C exists +[`argocd-bi-directional.md`](../design/support-boundary/argocd-bi-directional.md)); Spec C exists to pin the *contrast* — the difference from Spec B is one `ignoreDifferences` stanza, and it is the difference between the cluster losing the change and the cluster keeping it by taking the field out of GitOps. @@ -479,7 +480,7 @@ patch and the Reverser's commit, which would otherwise reset the field `syncPolicy.automated: {prune: true, selfHeal: false}`, no `ignoreDifferences`. This is the genuine bi-directional configuration from -[`argocd-bi-directional.md`](../design/gitops-api/argocd-bi-directional.md): the field stays +[`argocd-bi-directional.md`](../design/support-boundary/argocd-bi-directional.md): the field stays fully GitOps-managed (unlike Spec C, which carves it out) and changes from **both** sides. It is the deterministic counterpart to Spec B — nothing reverts live drift, so every step can be asserted directly, with no timing race. @@ -645,13 +646,13 @@ neither is `Serial`. - **Spec D**, the SharedResourceWarning demonstration, is not implemented. Its premise is verified in source (`resource_tracking.go:88-116` → `state.go:1043-1064` → `sync.go:169-173`), and with the sanitize fix in place - the trap can no longer be armed through this product. It remains the strongest + the trap can no longer be armed through this operator. It remains the strongest empirical argument for the fix, and is worth adding if the strip list is ever questioned. ## References -- [`docs/bi-directional.md`](../bi-directional.md) — the product-level guidance this closes gaps in +- [`docs/bi-directional.md`](../bi-directional.md) — the user-facing guidance this closes gaps in - [`docs/design/e2e-serial-registry.md`](e2e-serial-registry.md) — parallelism and shared cluster state - [`docs/design/e2e-ci-runner-sharding-plan.md`](../finished/e2e-ci-runner-sharding-plan.md) — leg membership and rebalancing - [`test/e2e/flux_bi_directional_e2e_test.go`](../../test/e2e/flux_bi_directional_e2e_test.go) and [`test/e2e/argocd_bi_directional_e2e_test.go`](../../test/e2e/argocd_bi_directional_e2e_test.go) — the two specs in this corner diff --git a/docs/spec/gittarget-new-file-placement-rules.md b/docs/spec/gittarget-new-file-placement-rules.md index ace85431..5cd9a522 100644 --- a/docs/spec/gittarget-new-file-placement-rules.md +++ b/docs/spec/gittarget-new-file-placement-rules.md @@ -2,7 +2,7 @@ > **spec** — current behaviour. The code depends on this document; change one, change the other. Index: [`../INDEX.md`](../INDEX.md) -> Status: implemented (F4 v1 — Option B2: one `byType`/`default` placement map, +> Status: implemented (v1 — Option B2: one `byType`/`default` placement map, > with sensitivity treated as an internal write-safety classification rather than a > separate user-facing placement namespace) + Option C sibling inference (steps > 1/2/4) + the kustomize-root fallback documented below. The earlier B1 surface (a @@ -642,7 +642,7 @@ lands on canonical `ToGitPath()` — **byte-identical to today.** From then on t layout propagates itself. A brand-new target behaves exactly as it does now; the power only appears once a human (or a prior import) has established any layout. -**Amendment, decided during F4 implementation: a kustomize-root fallback sits +**Amendment, decided during implementation: a kustomize-root fallback sits between "no sibling match" and true canonical.** The rule above is exactly right for a flat or already-populated folder, but it silently breaks the moment the GitTarget's one kustomization-managed folder receives its *first* resource of a @@ -654,7 +654,7 @@ document exists to prevent, just for a type instead of a whole folder. So, when steps 1/2 (sibling inference) both miss **and** the scanned subtree is governed by exactly one supported kustomization, the new resource is placed beside that kustomization's other files (and gets a `resources:` entry — see -`kustomize-support-boundary-and-product-model.md` and +`kustomize-support-boundary.md` and `unreflectable-edits-and-write-gating.md` for the product-level "add to the right kustomize file" framing) instead of falling to canonical. This is deliberately narrower than the shelved step 3 (same namespace, any type) above: it never joins diff --git a/docs/spec/manifest-system.md b/docs/spec/manifest-system.md index 5fb04c96..045cd9f2 100644 --- a/docs/spec/manifest-system.md +++ b/docs/spec/manifest-system.md @@ -39,7 +39,7 @@ Kustomize or Helm, and nothing decrypts. ## The load-bearing rules -These are the invariants. Break one and the product is unsafe rather than merely +These are the invariants. Break one and the operator is unsafe rather than merely limited. **Identity is the key, not the file path.** A KRM document carries its own full @@ -116,8 +116,8 @@ refused rather than unimplemented, is The governing constraint is invertibility: an edit must round-trip in both directions. Generators, `patches*`, `namePrefix`/`nameSuffix`, `components`, remote bases and Helm inflation are refused because they are one-way, not because nobody -got to them. The current boundary and the product model built on it live in -[`../design/gitops-api/`](../design/gitops-api/). +got to them. The full boundary — what is supported, what is refused, and why — is +[`../design/support-boundary/support-contract.md`](../design/support-boundary/support-contract.md). ## Types diff --git a/hack/gitops-layouts-baseline.sh b/hack/gitops-layouts-baseline.sh index b7131cc4..82fd0cde 100755 --- a/hack/gitops-layouts-baseline.sh +++ b/hack/gitops-layouts-baseline.sh @@ -7,7 +7,7 @@ # in review as a diff of exactly which fixtures moved, and in which direction. # # It carries no interpretation. Interpretation belongs in -# docs/design/gitops-api/, which is free to disagree with this file — that +# docs/design/support-boundary/, which is free to disagree with this file — that # disagreement is the backlog. # # Usage: task gitops-layouts-baseline @@ -95,8 +95,8 @@ emit_detail() { A behavioural baseline: what `manifest-analyzer --mode scan-repo` reports for every fixture in this corpus, as of the last regeneration. It is **descriptive**. It -records what the tool does today, not what the product should support — that is -[`docs/design/gitops-api/support-contract.md`](../../../docs/design/gitops-api/support-contract.md). +records what the tool does today, not what the operator should support — that is +[`docs/design/support-boundary/support-contract.md`](../../../docs/design/support-boundary/support-contract.md). This file carries no interpretation on purpose. When it disagrees with the support contract, that disagreement is the backlog. diff --git a/internal/controller/gittarget_controller.go b/internal/controller/gittarget_controller.go index 6e452dec..f7420333 100644 --- a/internal/controller/gittarget_controller.go +++ b/internal/controller/gittarget_controller.go @@ -76,7 +76,7 @@ const ( // GitTargetReasonWriteBoundaryRefused is the reason for a write the operator refused // because it had nowhere safe to land, rather than because the folder holds content the // operator cannot manage - // (docs/design/gitops-api/gittarget-granularity-and-cross-environment-edits.md §1): a + // (docs/design/support-boundary/gittarget-granularity-and-cross-environment-edits.md §1): a // planned write escaping spec.path (L1), or an in-place edit of a source file more than // one kustomize render root reaches (L2, write-fan-in > 1). Nothing was committed. The // string must stay in sync with the watch package's gitPathRefusalReason. diff --git a/internal/controller/gittarget_placement_validation.go b/internal/controller/gittarget_placement_validation.go index 9cc0fc80..dd73f15b 100644 --- a/internal/controller/gittarget_placement_validation.go +++ b/internal/controller/gittarget_placement_validation.go @@ -18,7 +18,7 @@ import ( const coreSecretsTypeKey = "v1/secrets" // validatePlacementPolicy statically validates a GitTarget's declared placement -// policy (F4, Option B2: +// policy (Option B2: // docs/spec/gittarget-new-file-placement-rules.md) against the // spec alone — no repository scan is needed, so this runs as part of the Validated // gate, the same spec-well-formedness check that already covers provider/branch diff --git a/internal/git/inplace_overrides_test.go b/internal/git/inplace_overrides_test.go index ca53a696..26068976 100644 --- a/internal/git/inplace_overrides_test.go +++ b/internal/git/inplace_overrides_test.go @@ -19,7 +19,7 @@ import ( "github.com/ConfigButler/gitops-reverser/internal/typeset" ) -// The F1 edit-through scenarios (docs/design/gitops-api/finished/f1-images-replicas-edit-through.md): +// The edit-through scenarios (docs/design/support-boundary/finished/images-and-replicas-edit-through.md): // a live change produced by a kustomization's images:/replicas: entry lands on // the entry, and the source manifest keeps its bytes. @@ -137,7 +137,7 @@ func TestPlanFlush_RoutesImageTagToKustomizationEntry(t *testing.T) { // Live state equal to the overlay's render is a full no-op: the source file's // "stale" tag is dead text the entry shadows, and must NOT be overwritten -// (the write-through fix F1 exists for). +// (the write-through fix the edit-through exists for). func TestPlanFlush_LiveMatchingOverlayRenderIsNoOp(t *testing.T) { writer := newContentWriter(types.SensitiveResourcePolicy{}) worktree := newWorktreeForTest(t) diff --git a/internal/git/manifestedit/kustomization.go b/internal/git/manifestedit/kustomization.go index 1d02f0c0..efd50da1 100644 --- a/internal/git/manifestedit/kustomization.go +++ b/internal/git/manifestedit/kustomization.go @@ -10,8 +10,8 @@ import ( ) // Kustomization override sections the editor accepts. The editor is the -// mechanism half of the F1 images/replicas edit-through -// (docs/design/gitops-api/finished/f1-images-replicas-edit-through.md): it updates the +// mechanism half of the images/replicas edit-through +// (docs/design/support-boundary/finished/images-and-replicas-edit-through.md): it updates the // scalar value of a field that ALREADY EXISTS on an entry that ALREADY EXISTS, // and nothing else — it never adds or removes entries, keys, or files. const ( @@ -127,7 +127,7 @@ func applyKustomizationEdit(root *yaml.Node, e KustomizationEdit) error { } // AppendKustomizationResource adds one entry to an existing kustomization.yaml's -// resources: sequence — the mechanism half of F4's "add to the right kustomize +// resources: sequence — the mechanism half of the "add to the right kustomize // file" (docs/spec/gittarget-new-file-placement-rules.md): a // new sibling file placed inside a kustomize-governed directory must also be named // in that directory's resources: list, or kustomize never renders it. @@ -136,7 +136,7 @@ func applyKustomizationEdit(root *yaml.Node, e KustomizationEdit) error { // (EditNoChange), never a duplicate append. All-or-nothing like PatchKustomization: // a multi-document file, unparseable YAML, or a document with no existing // resources: sequence skips the whole call with a diagnostic — the writer never -// invents a resources: key that is not already there, mirroring F1's "never +// invents a resources: key that is not already there, mirroring the edit-through's "never // creates a kustomization file" boundary one level down (never creates a // resources: section either). func AppendKustomizationResource(path string, content []byte, entry string) (EditResult, []Diagnostic) { diff --git a/internal/git/placement_test.go b/internal/git/placement_test.go index 794b7b32..70679666 100644 --- a/internal/git/placement_test.go +++ b/internal/git/placement_test.go @@ -19,7 +19,7 @@ import ( ) // newConfigMapEvent builds a CREATE event for a new ConfigMap with no existing -// document anywhere in the fixture — the only case F4 placement runs for. +// document anywhere in the fixture — the only case new-file placement runs for. func newConfigMapEvent(name, namespace string) Event { return Event{ Object: &unstructured.Unstructured{Object: map[string]interface{}{ diff --git a/internal/git/plan_flush.go b/internal/git/plan_flush.go index 3c480b42..cc942296 100644 --- a/internal/git/plan_flush.go +++ b/internal/git/plan_flush.go @@ -74,7 +74,7 @@ type writeBatch struct { docLoc map[*manifestanalyzer.DocumentModel]manifestanalyzer.RecordRef contentByPath map[string][]byte buffers map[string]*fileBuffer - // policy is the GitTarget's declared new-file placement policy (F4), consulted + // policy is the GitTarget's declared new-file placement policy, consulted // only for a resource with no existing document. nil means no declared policy — // placement falls through to sibling inference and then the canonical path. policy *manifestanalyzer.PlacementPolicy @@ -200,7 +200,7 @@ const ( // sensitive and a plaintext document, or would overwrite a multi-document file. // It is distinct from upsertNoChange (a genuine no-op) so the resync path can // count it and surface it, rather than have a not-mirrored resource vanish with - // no signal (F4 Option B2's fail-safe skips — see createNew/writeWholeFile). + // no signal (placement Option B2's fail-safe skips — see createNew/writeWholeFile). upsertSkippedUnsafe ) @@ -228,7 +228,7 @@ func (wb *writeBatch) applyEvent(ctx context.Context, event Event) error { // a sensitive document is re-encrypted wholesale AT ITS EXISTING PATH (never patched in // place — that would drop the SOPS metadata and write the secret back in cleartext, and // never at the canonical path, which would orphan the moved copy). A resource with no -// existing document is placed by createNew (F4). It returns what it did to the bytes +// existing document is placed by createNew. It returns what it did to the bytes // (created / updated / no change). func (wb *writeBatch) applyUpsert(ctx context.Context, event Event) (upsertOutcome, error) { if id, ok := manifestIdentity(event.Object); ok { @@ -408,7 +408,7 @@ func appendYAMLDocument(existing, newDoc []byte) []byte { // appendKustomizationResource adds the new document's path to its resources: // sequence as part of the same commit, so kustomize picks up the file createNew just -// placed inside the kustomization's directory — F4's "add to the right kustomize +// placed inside the kustomization's directory — the "add to the right kustomize // file." The entry is rendered relative to the kustomization's own directory // (resources: entries are relative to the kustomization file, not the repo root). // A failure here only drops the resources: entry (logged as a diagnostic); the @@ -504,7 +504,8 @@ func (wb *writeBatch) applyFieldPatch(ctx context.Context, event Event) error { // routeGovernedFieldAssignments diverts a spec.replicas assignment whose value a // replicas override governs to its kustomization entry (the /scale subresource -// case of F1) and returns the assignments the file patch should still apply. An +// case of the images/replicas edit-through) and returns the assignments the file +// patch should still apply. An // ungoverned assignment — any other path, a non-integer value, no matching // entry — keeps today's bounded file patch. func (wb *writeBatch) routeGovernedFieldAssignments( @@ -573,7 +574,7 @@ func (wb *writeBatch) resolveFieldPatchTarget(event Event) (string, manifestedit // When the document is governed by a kustomize images/replicas override chain, the // desired projection is first split: values the chain produces are restored to their // source form (so the file keeps its bytes) and the divergence is routed to the -// override entries instead — see docs/design/gitops-api/finished/f1-images-replicas-edit-through.md. +// override entries instead — see docs/design/support-boundary/finished/images-and-replicas-edit-through.md. func (wb *writeBatch) patchExisting( ctx context.Context, event Event, @@ -830,7 +831,7 @@ func (wb *writeBatch) flush(ctx context.Context, worktree *gogit.Worktree, root, // guard (§4.3), the L1 write-scope jail (writes stay inside spec.path), and the L2 // write-fan-in = 1 rule (never write a live change through into context shared by more // than one render root). See - // docs/design/gitops-api/gittarget-granularity-and-cross-environment-edits.md §1. + // docs/design/support-boundary/gittarget-granularity-and-cross-environment-edits.md §1. if err := wb.ignoreShadowPrecondition(); err != nil { return false, err } @@ -948,7 +949,7 @@ func writePathEscapesScope(rel string) bool { // refusal, so the fan-in guarantee no longer depends on the emergent side effect of namespace // ambiguity blocking the match. It fires only on an actual planned write, so the legitimate // base-sharing layout (a base doc reached by distinct overlays is NamespaceNone and never -// dirty) is not refused — F2 render-root scoping generalizes the check. +// dirty) is not refused — per-render-root scoping would generalize the check. func (wb *writeBatch) fanInPrecondition() error { var issues []manifestanalyzer.AcceptanceIssue for _, rel := range sortedBufferKeys(wb.buffers) { diff --git a/internal/git/resync_flush_test.go b/internal/git/resync_flush_test.go index 2ef0da78..e3c8c34b 100644 --- a/internal/git/resync_flush_test.go +++ b/internal/git/resync_flush_test.go @@ -274,7 +274,7 @@ func TestResync_FoldsCreateUpdateDropTogether(t *testing.T) { _, dropErr := os.Stat(dropFull) assert.True(t, os.IsNotExist(dropErr)) - // F4: with existing ConfigMap siblings ("keep", "drop") each in their own file + // Placement: with existing ConfigMap siblings ("keep", "drop") each in their own file // under apps/, a genuinely new ConfigMap follows that established layout // (Option C sibling inference) rather than the canonical GVR-tree path. freshInferred := filepath.Join(root, "apps", "fresh.yaml") diff --git a/internal/git/types.go b/internal/git/types.go index f46c4a72..451dc84f 100644 --- a/internal/git/types.go +++ b/internal/git/types.go @@ -154,7 +154,7 @@ type ResolvedTargetMetadata struct { Path string BootstrapOptions pathBootstrapOptions EncryptionConfig *ResolvedEncryptionConfig - // Placement is the GitTarget's declared new-file placement policy (F4), resolved + // Placement is the GitTarget's declared new-file placement policy, resolved // from spec.placement. Nil when the GitTarget declares none, in which case new // resources are placed by sibling inference and then the canonical path. Placement *manifestanalyzer.PlacementPolicy @@ -268,7 +268,7 @@ type ResyncResult struct { // counts; Skipped is documents present but not safely editable (e.g. encrypted or // disallowed constructs). PlacementSkipped is new resources the writer refused to // place fail-safe — placement could not be resolved safely, or the write would -// co-mingle sensitive and plaintext documents (F4 Option B2). It is counted (not +// co-mingle sensitive and plaintext documents (placement Option B2). It is counted (not // silently swallowed) and logged per-resource so a not-mirrored resource is visible // in the resync summary; it is not (yet) surfaced as a dedicated GitTarget status // condition. diff --git a/internal/git/write_boundary_precondition_test.go b/internal/git/write_boundary_precondition_test.go index 5c082262..9253c4ec 100644 --- a/internal/git/write_boundary_precondition_test.go +++ b/internal/git/write_boundary_precondition_test.go @@ -24,7 +24,7 @@ import ( // The write-boundary preconditions (Track 1) make two invariants explicit and tested rather // than emergent, before any byte is written. See -// docs/design/gitops-api/gittarget-granularity-and-cross-environment-edits.md §1: +// docs/design/support-boundary/gittarget-granularity-and-cross-environment-edits.md §1: // - L1: every planned write stays inside the GitTarget write scope (spec.path). // - L2: never write a live change through into a source file more than one render root // reaches with override entries at stake (write-fan-in must be 1). diff --git a/internal/manifestanalyzer/acceptance.go b/internal/manifestanalyzer/acceptance.go index b7e84c09..f3d598bc 100644 --- a/internal/manifestanalyzer/acceptance.go +++ b/internal/manifestanalyzer/acceptance.go @@ -113,14 +113,14 @@ const ( // but never writes outside it. Enforced by the writer's pathScopePrecondition; today it is // defense-in-depth (planned write paths are base-relative by construction), made explicit // and tested per - // docs/design/gitops-api/gittarget-granularity-and-cross-environment-edits.md §1. + // docs/design/support-boundary/gittarget-granularity-and-cross-environment-edits.md §1. IssueWriteEscapesScope IssueKind = "write-escapes-scope" // IssueWriteFanIn marks a planned in-place edit of a source file that more than one // kustomize render path reaches with override entries at stake (write-fan-in > 1). Writing // the change through would corrupt what another render root renders, so the flush is // refused instead of falling back to write-through. It is the L2 write-boundary invariant // made explicit; the broader "any file shared by multiple render roots" generalization is - // F2 render-root scoping. + // Per-render-root scoping would generalize this. IssueWriteFanIn IssueKind = "write-fan-in" // A refusal made up purely of the two write-boundary kinds above surfaces as the GitTarget diff --git a/internal/manifestanalyzer/overrides.go b/internal/manifestanalyzer/overrides.go index 65995397..bf95af55 100644 --- a/internal/manifestanalyzer/overrides.go +++ b/internal/manifestanalyzer/overrides.go @@ -10,12 +10,12 @@ import ( "github.com/ConfigButler/gitops-reverser/internal/git/manifestedit" ) -// This file implements the model half of F1 (kustomize images/replicas +// This file implements the model half of the kustomize images/replicas // edit-through): parsing the two supported override transformers out of // kustomization.yaml and attributing an unambiguous override chain to every // resource file a render root reaches. The write-side projection consumes the // attached KustomizeOverrides. See -// docs/design/gitops-api/finished/f1-images-replicas-edit-through.md. +// docs/design/support-boundary/finished/images-and-replicas-edit-through.md. // reasonAmbiguousOverrides marks a build-time diagnostic for a resource file that // more than one render root reaches with differing override chains. The store diff --git a/internal/manifestanalyzer/overrides_projection.go b/internal/manifestanalyzer/overrides_projection.go index bc1520b3..5a244648 100644 --- a/internal/manifestanalyzer/overrides_projection.go +++ b/internal/manifestanalyzer/overrides_projection.go @@ -13,12 +13,13 @@ import ( "github.com/ConfigButler/gitops-reverser/internal/git/manifestedit" ) -// This file is the projection half of F1 (see overrides.go for the model half): +// This file is the projection half of the images/replicas edit-through (see +// overrides.go for the model half): // given the source document as Git holds it, the live desired object, and the // governing override chain, it splits the live state into what the SOURCE FILE // should hold and what the KUSTOMIZATION ENTRIES should hold — "the edit lands // where the value lives". See -// docs/design/gitops-api/finished/f1-images-replicas-edit-through.md. +// docs/design/support-boundary/finished/images-and-replicas-edit-through.md. // OverrideEdit routes one live-value change to a field of an existing // kustomization override entry. diff --git a/internal/manifestanalyzer/overrides_projection_test.go b/internal/manifestanalyzer/overrides_projection_test.go index 095df743..67a41f67 100644 --- a/internal/manifestanalyzer/overrides_projection_test.go +++ b/internal/manifestanalyzer/overrides_projection_test.go @@ -65,7 +65,7 @@ func imgEntry(name string, set map[string]string) ImageOverride { return e } -// TestSplitDesired_TagRoutedToEntry pins the core F1 behavior: a live tag change +// TestSplitDesired_TagRoutedToEntry pins the core edit-through behavior: a live tag change // produced by a newTag entry lands on the entry and the file keeps its bytes. func TestSplitDesired_TagRoutedToEntry(t *testing.T) { git := deploymentObj("ghcr.io/example/app:1.0.0", nil) diff --git a/internal/manifestanalyzer/overrides_test.go b/internal/manifestanalyzer/overrides_test.go index e1e6a214..12d5d1bc 100644 --- a/internal/manifestanalyzer/overrides_test.go +++ b/internal/manifestanalyzer/overrides_test.go @@ -16,7 +16,7 @@ import ( // single-root overlay attaches its entries, a nested base composes // innermost-first, and two roots with differing chains attach nothing and emit // the ambiguity diagnostic. See -// docs/design/gitops-api/finished/f1-images-replicas-edit-through.md. +// docs/design/support-boundary/finished/images-and-replicas-edit-through.md. func corpusDeployment(t *testing.T, store *ManifestStore) *DocumentModel { t.Helper() diff --git a/internal/manifestanalyzer/placement.go b/internal/manifestanalyzer/placement.go index 61f3bc6f..963d377c 100644 --- a/internal/manifestanalyzer/placement.go +++ b/internal/manifestanalyzer/placement.go @@ -78,7 +78,7 @@ type PlacementResult struct { // Kustomization is set when Path's directory carries a supported // kustomization.yaml whose resources: list does not already name Path — the // writer must add it as part of the same commit so kustomize picks the file - // up (F4's "add to the right kustomize file"). + // up ("add to the right kustomize file"). Kustomization *KustomizationInfo // NamespaceInherited is true when Path's destination infers its namespace // from build context (a kustomization.yaml's namespace: transformer) rather @@ -133,13 +133,13 @@ func LocateNew(store *ManifestStore, policy *PlacementPolicy, req PlacementReque return finishPlacement(store, req, canonicalPath(req), PlacementSourceCanonical, "", false) } -// resolveKustomizeRoot is a narrow, F4-specific fallback for when no sibling cohort +// resolveKustomizeRoot is a narrow, placement-specific fallback for when no sibling cohort // exists (steps 1/2 both miss) — typically a resource whose type has never before // appeared in this GitTarget. The canonical path (step 4) is a // {group}/{version}/{resource}/{namespace}/{name}.yaml tree a kustomization's // resources: graph can never reach, so a brand-new type in an otherwise // kustomize-managed folder would silently land outside the folder's own -// convention — precisely the problem F4 exists to fix. When the whole scanned +// convention — precisely the problem new-file placement exists to fix. When the whole scanned // subtree is governed by exactly one supported kustomization (today's // single-context baseline), the new resource belongs beside that kustomization's // other files instead. @@ -254,7 +254,7 @@ func kustomizationListsResource(k *KustomizationInfo, resolvedPath string) bool // segments), no Windows-style backslash separators, a non-empty final file name, // and a recognized YAML suffix (".sops.yaml"/".sops.yml" satisfy this too, since // they end in ".yaml"/".yml"). finishPlacement runs this on every path before a -// single byte is written, so a bad declared template (F4 Option B) can never +// single byte is written, so a bad declared template (Option B) can never // escape the folder the writer owns — sanitizePlacementSegment already defends // each individual variable's value, but the template's own literal text is // author-supplied and unconstrained without this gate. diff --git a/internal/manifestanalyzer/scan_repo.go b/internal/manifestanalyzer/scan_repo.go index 07eed438..f75343be 100644 --- a/internal/manifestanalyzer/scan_repo.go +++ b/internal/manifestanalyzer/scan_repo.go @@ -17,8 +17,8 @@ import ( "github.com/ConfigButler/gitops-reverser/internal/git/manifestedit" ) -// This file implements the first cut of F8 (repo discovery / onboarding scan), -// designed in docs/design/gitops-api/f8-repo-discovery-and-onboarding-scan.md. It +// This file implements the first cut of repo discovery (the onboarding scan), +// designed in docs/design/support-boundary/repo-discovery-and-onboarding-scan.md. It // walks a WHOLE repository once (today's Scan/ScanDir is subtree-only), enumerates // candidate GitTarget subtrees, classifies each one's layout, runs the same // acceptance gate the operator runs, and emits a machine-readable report. @@ -34,8 +34,8 @@ import ( // --policy refuse exit semantics — see the design doc's "explicitly defer" list. // Layout is the structural shape of a candidate subtree. Layout and acceptedByOperator -// are two distinct truths that diverge during the F2 gap: a kustomize-overlay has a -// well-understood layout yet is not accepted until render-root scoping (F2) lands. +// are two distinct truths that diverge while overlays stay unsupported: a kustomize-overlay +// has a well-understood layout yet is not accepted until render-root scoping lands. type Layout string const ( @@ -49,8 +49,8 @@ const ( // LayoutKustomizeOverlay is a render root that reaches a base kustomization OUTSIDE // its own subtree (the classic base/ + overlays/{env} shape reached via ../../base). // The operator hard-scopes to one subtree and cannot see the base, so it is refused - // today with the forward-looking overlay-fan-out-needs-f2 reason — it flips to - // accepted when F2 render-root scoping ships. + // today with the forward-looking overlay-fan-out-unsupported reason — it flips to + // accepted if render-root scoping ships. LayoutKustomizeOverlay Layout = "kustomize-overlay" // LayoutRefusedStructural is a render root whose kustomization uses a feature the // contextual-namespace writer cannot map back to editable source (helm inflation, @@ -60,12 +60,12 @@ const ( ) // Refusal reason codes. The distinction between the two is load-bearing: -// ReasonOverlayFanOutNeedsF2 is a forward-looking "not yet" that flips to accepted -// when F2 lands; ReasonRefusedStructural is the permanent boundary. Discovery must +// ReasonOverlayFanOutUnsupported is a forward-looking "not yet" that flips to accepted +// if render-root scoping ships; ReasonRefusedStructural is the permanent boundary. Discovery must // never collapse them into one "refused". const ( - ReasonOverlayFanOutNeedsF2 = "overlay-fan-out-needs-f2" - ReasonRefusedStructural = "refused-structural" + ReasonOverlayFanOutUnsupported = "overlay-fan-out-unsupported" + ReasonRefusedStructural = "refused-structural" ) // RefusalReason is one machine-readable reason a candidate is not accepted, with a @@ -79,7 +79,7 @@ type RefusalReason struct { // can actually edit. For a plain or self-contained kustomize candidate the two are // equal; for an overlay they diverge — rendered counts the documents pulled from the // out-of-subtree base, editable counts only the source physically in the candidate's -// own subtree (zero for a pure overlay), making the F2 gap legible at a glance. +// own subtree (zero for a pure overlay), making the gap legible at a glance. type ResourceCounts struct { // Rendered is the number of managed KRM documents the candidate renders: its own // subtree plus every base it reads (readScope). @@ -94,7 +94,7 @@ type ResourceCounts struct { } // RepoCandidate is one subtree the product could turn into a GitTarget, with its -// layout, current operator acceptance, and the facts a product layer needs to decide. +// layout, current operator acceptance, and the facts a tool built on top needs to decide. // This cut reports these; it proposes no GitTarget/WatchRule. type RepoCandidate struct { // Path is the candidate directory, slash-separated and relative to the repo root. @@ -150,7 +150,7 @@ type RepoSummary struct { } // RepoReport is the whole-repo discovery report: the machine-readable contract the -// product layer consumes. +// a tool built on top of the operator consumes. type RepoReport struct { // Root is the scanned repository root as passed to ScanRepo. It is informational. Root string `json:"root,omitempty"` @@ -160,7 +160,7 @@ type RepoReport struct { Summary RepoSummary `json:"summary"` } -// ScanRepo is the F8 whole-repo discovery pass (the library entry point; the CLI +// ScanRepo is the whole-repo discovery pass (the library entry point; the CLI // --mode scan-repo is a thin wrapper). It is read-only, writes nothing, needs no // cluster, and never follows symlinks — the same posture as ScanDir, just over the // whole tree rather than one subtree. It verifies root is a directory, then walks @@ -238,7 +238,7 @@ func classifyRenderRoot( c.AcceptedByOperator = false c.ReadScope = outsideBases c.RefusalReasons = []RefusalReason{{ - Code: ReasonOverlayFanOutNeedsF2, + Code: ReasonOverlayFanOutUnsupported, Detail: overlayFanOutDetail(outsideBases[0], kusts), }} c.Resources = countResources(store, rootDir, rendered) @@ -426,7 +426,7 @@ func reachedResourceFiles(kusts map[string]*kustomizationDoc) map[string]struct{ return out } -// overlayFanOutDetail explains why an overlay needs F2: the shared base and how many +// overlayFanOutDetail explains why an overlay is unsupported: the shared base and how many // render roots reach it from outside their subtree. func overlayFanOutDetail(base string, kusts map[string]*kustomizationDoc) string { shared := 0 @@ -437,7 +437,7 @@ func overlayFanOutDetail(base string, kusts map[string]*kustomizationDoc) string } return fmt.Sprintf( "base %q is read from outside this folder's subtree and is shared by %d render root(s); "+ - "render-root scoping (F2) required", + "render-root scoping required", base, shared) } diff --git a/internal/manifestanalyzer/scan_repo_test.go b/internal/manifestanalyzer/scan_repo_test.go index dd4544ba..8981c012 100644 --- a/internal/manifestanalyzer/scan_repo_test.go +++ b/internal/manifestanalyzer/scan_repo_test.go @@ -30,7 +30,7 @@ metadata: // inference, and the rendered/editable split are all fixed by real layouts rather than // prose. The corpus is split supported/ vs unsupported/ mirroring the // contextual-namespace corpus. See -// docs/design/gitops-api/f8-repo-discovery-and-onboarding-scan.md. +// docs/design/support-boundary/repo-discovery-and-onboarding-scan.md. func TestScanRepo_Golden(t *testing.T) { for _, group := range []string{"supported", "unsupported"} { base := filepath.Join("testdata", "scan-repo", group) @@ -89,7 +89,7 @@ func checkGoldenFixture(t *testing.T, fixture string) { } // TestScanRepo_RefusalCodesStayDistinct pins the load-bearing distinction the design -// calls out: a forward-looking overlay-fan-out-needs-f2 must never collapse into the +// calls out: a forward-looking overlay-fan-out-unsupported must never collapse into the // permanent refused-structural boundary. base-overlays is the former; helm-inflation and // unsupported-kustomize are the latter. func TestScanRepo_RefusalCodesStayDistinct(t *testing.T) { @@ -98,8 +98,8 @@ func TestScanRepo_RefusalCodesStayDistinct(t *testing.T) { wantCode string layout Layout }{ - {"unsupported/base-overlays", ReasonOverlayFanOutNeedsF2, LayoutKustomizeOverlay}, - {"unsupported/overlay-parked-base", ReasonOverlayFanOutNeedsF2, LayoutKustomizeOverlay}, + {"unsupported/base-overlays", ReasonOverlayFanOutUnsupported, LayoutKustomizeOverlay}, + {"unsupported/overlay-parked-base", ReasonOverlayFanOutUnsupported, LayoutKustomizeOverlay}, {"unsupported/helm-inflation", ReasonRefusedStructural, LayoutRefusedStructural}, {"unsupported/unsupported-kustomize", ReasonRefusedStructural, LayoutRefusedStructural}, } diff --git a/internal/manifestanalyzer/store.go b/internal/manifestanalyzer/store.go index 24f72abb..45330de9 100644 --- a/internal/manifestanalyzer/store.go +++ b/internal/manifestanalyzer/store.go @@ -72,7 +72,7 @@ type ManifestStore struct { // Kustomizations indexes every kustomization.yaml found under the scanned root by // its directory (slash, relative to the root; "." for the root itself). New-file - // placement (F4) consults it to decide whether a candidate directory is + // placement consults it to decide whether a candidate directory is // kustomize-governed and, if so, which file's resources: list a new sibling must // be added to. Populated independent of the allowlist — build-directive discovery // does not depend on which files the writer materialises. @@ -175,7 +175,7 @@ type DocumentModel struct { // ambiguous-kustomize-overrides diagnostic). The writer routes a live change // produced by one of these entries back to the entry instead of writing it // through into the source document. See - // docs/design/gitops-api/finished/f1-images-replicas-edit-through.md. + // docs/design/support-boundary/finished/images-and-replicas-edit-through.md. Overrides *KustomizeOverrides // ResourceIdentity is the API-side identity (GVR + namespace + name). It is set @@ -601,7 +601,7 @@ type namespaceAssignment struct { } // KustomizationInfo is the write-relevant view of one kustomization.yaml exposed for -// new-file placement (F4): whether the directory it lives in carries a supported +// new-file placement: whether the directory it lives in carries a supported // kustomization and, if so, its local resources/bases entries (raw, relative to its // own directory) — the list a new sibling file must be added to so kustomize // includes it. @@ -628,7 +628,7 @@ type KustomizationInfo struct { } // kustomizationInfos exports the analyzer's internal kustomization index for -// new-file placement (F4). Copying into a fresh map/slice keeps ManifestStore +// new-file placement. Copying into a fresh map/slice keeps ManifestStore // immune to any future mutation of the internal kustomizationDoc values. func kustomizationInfos(kusts map[string]*kustomizationDoc) map[string]*KustomizationInfo { out := make(map[string]*KustomizationInfo, len(kusts)) diff --git a/internal/manifestanalyzer/testdata/contextual-namespace/README.md b/internal/manifestanalyzer/testdata/contextual-namespace/README.md index feb81984..97551e8e 100644 --- a/internal/manifestanalyzer/testdata/contextual-namespace/README.md +++ b/internal/manifestanalyzer/testdata/contextual-namespace/README.md @@ -13,8 +13,8 @@ asserts the outcome. are the inputs the pending `RepositoryValid` refusal will fail the GitTarget on. The `images-overlay`, `replicas-overlay`, and `ambiguous-images` folders pin the -F1 override-chain attribution the same way (`overrides_test.go`); see -`docs/design/gitops-api/finished/f1-images-replicas-edit-through.md`. +override-chain attribution the same way (`overrides_test.go`); see +`docs/design/support-boundary/finished/images-and-replicas-edit-through.md`. See `docs/design/manifest/contextual-namespace-and-kustomize-folder-editing.md` (the "Supported and unsupported example folders" matrix). Add a new folder here diff --git a/internal/manifestanalyzer/testdata/scan-repo/unsupported/base-overlays.golden.json b/internal/manifestanalyzer/testdata/scan-repo/unsupported/base-overlays.golden.json index 497e4dc0..e8728b62 100644 --- a/internal/manifestanalyzer/testdata/scan-repo/unsupported/base-overlays.golden.json +++ b/internal/manifestanalyzer/testdata/scan-repo/unsupported/base-overlays.golden.json @@ -6,8 +6,8 @@ "acceptedByOperator": false, "refusalReasons": [ { - "code": "overlay-fan-out-needs-f2", - "detail": "base \"base\" is read from outside this folder's subtree and is shared by 3 render root(s); render-root scoping (F2) required" + "code": "overlay-fan-out-unsupported", + "detail": "base \"base\" is read from outside this folder's subtree and is shared by 3 render root(s); render-root scoping required" } ], "renderRoot": true, @@ -27,8 +27,8 @@ "acceptedByOperator": false, "refusalReasons": [ { - "code": "overlay-fan-out-needs-f2", - "detail": "base \"base\" is read from outside this folder's subtree and is shared by 3 render root(s); render-root scoping (F2) required" + "code": "overlay-fan-out-unsupported", + "detail": "base \"base\" is read from outside this folder's subtree and is shared by 3 render root(s); render-root scoping required" } ], "renderRoot": true, @@ -48,8 +48,8 @@ "acceptedByOperator": false, "refusalReasons": [ { - "code": "overlay-fan-out-needs-f2", - "detail": "base \"base\" is read from outside this folder's subtree and is shared by 3 render root(s); render-root scoping (F2) required" + "code": "overlay-fan-out-unsupported", + "detail": "base \"base\" is read from outside this folder's subtree and is shared by 3 render root(s); render-root scoping required" } ], "renderRoot": true, diff --git a/internal/manifestanalyzer/testdata/scan-repo/unsupported/overlay-nested-base.golden.json b/internal/manifestanalyzer/testdata/scan-repo/unsupported/overlay-nested-base.golden.json index 1cb4de55..318d7fd3 100644 --- a/internal/manifestanalyzer/testdata/scan-repo/unsupported/overlay-nested-base.golden.json +++ b/internal/manifestanalyzer/testdata/scan-repo/unsupported/overlay-nested-base.golden.json @@ -6,8 +6,8 @@ "acceptedByOperator": false, "refusalReasons": [ { - "code": "overlay-fan-out-needs-f2", - "detail": "base \"base\" is read from outside this folder's subtree and is shared by 1 render root(s); render-root scoping (F2) required" + "code": "overlay-fan-out-unsupported", + "detail": "base \"base\" is read from outside this folder's subtree and is shared by 1 render root(s); render-root scoping required" } ], "renderRoot": true, diff --git a/internal/manifestanalyzer/testdata/scan-repo/unsupported/overlay-parked-base.golden.json b/internal/manifestanalyzer/testdata/scan-repo/unsupported/overlay-parked-base.golden.json index a4d980a3..13781d47 100644 --- a/internal/manifestanalyzer/testdata/scan-repo/unsupported/overlay-parked-base.golden.json +++ b/internal/manifestanalyzer/testdata/scan-repo/unsupported/overlay-parked-base.golden.json @@ -6,8 +6,8 @@ "acceptedByOperator": false, "refusalReasons": [ { - "code": "overlay-fan-out-needs-f2", - "detail": "base \"base\" is read from outside this folder's subtree and is shared by 1 render root(s); render-root scoping (F2) required" + "code": "overlay-fan-out-unsupported", + "detail": "base \"base\" is read from outside this folder's subtree and is shared by 1 render root(s); render-root scoping required" } ], "renderRoot": true, diff --git a/pkg/manifestanalyzer/repo.go b/pkg/manifestanalyzer/repo.go index 37de0de8..6d7072ee 100644 --- a/pkg/manifestanalyzer/repo.go +++ b/pkg/manifestanalyzer/repo.go @@ -33,9 +33,9 @@ const ( // Refusal reason codes. The distinction is load-bearing and a consumer must not collapse // it: one is a "not yet", the other is permanent. const ( - // ReasonOverlayFanOutNeedsF2 is the forward-looking refusal that flips to accepted + // ReasonOverlayFanOutUnsupported is the forward-looking refusal that flips to accepted // when render-root scoping ships. - ReasonOverlayFanOutNeedsF2 = "overlay-fan-out-needs-f2" + ReasonOverlayFanOutUnsupported = "overlay-fan-out-unsupported" // ReasonRefusedStructural is the permanent support boundary. ReasonRefusedStructural = "refused-structural" ) diff --git a/pkg/manifestanalyzer/repo_test.go b/pkg/manifestanalyzer/repo_test.go index 7550eb96..294713a9 100644 --- a/pkg/manifestanalyzer/repo_test.go +++ b/pkg/manifestanalyzer/repo_test.go @@ -61,7 +61,7 @@ func TestScanRepo_RefusalCodesStayDistinct(t *testing.T) { }{ "overlay fan-out is a not-yet": { group: "unsupported", name: "base-overlays", - wantCode: manifestanalyzer.ReasonOverlayFanOutNeedsF2, + wantCode: manifestanalyzer.ReasonOverlayFanOutUnsupported, wantLayout: manifestanalyzer.LayoutKustomizeOverlay, }, "helm inflation is permanent": { diff --git a/test/e2e/argocd_bi_directional_e2e_test.go b/test/e2e/argocd_bi_directional_e2e_test.go index e5679062..5b7ec706 100644 --- a/test/e2e/argocd_bi_directional_e2e_test.go +++ b/test/e2e/argocd_bi_directional_e2e_test.go @@ -249,7 +249,7 @@ var _ = Describe("Bi Directional (Argo CD)", Label("bi-directional", "argocd"), // // Two clocks: self-heal reverts live drift essentially immediately — // sub-second on the FIRST drift, because the backoff is zero on attempt 0 - // (design/gitops-api/argocd-bi-directional.md) — while a new Git revision is + // (design/support-boundary/argocd-bi-directional.md) — while a new Git revision is // only noticed on the 180s timed refresh. So Argo replays its stale cached // revision long before it ever looks at what the reverser committed. The // user's change is lost. @@ -401,7 +401,7 @@ var _ = Describe("Bi Directional (Argo CD)", Label("bi-directional", "argocd"), // Phase 4 — the recommended shared-field loop: selfHeal:false + webhook. // // This is the ONE Argo CD configuration docs/bi-directional.md recommends - // for a genuinely shared field (design/gitops-api/argocd-bi-directional.md). + // for a genuinely shared field (design/support-boundary/argocd-bi-directional.md). // It is the deterministic counterpart to phase 2: phase 2 proved selfHeal // LOSES the API edit; this proves selfHeal:false KEEPS it, and — unlike the // ignoreDifferences of phase 3 — the field stays fully GitOps-driven, so a diff --git a/test/e2e/f4_placement_e2e_test.go b/test/e2e/f4_placement_e2e_test.go index d8c2b293..14f960bb 100644 --- a/test/e2e/f4_placement_e2e_test.go +++ b/test/e2e/f4_placement_e2e_test.go @@ -15,7 +15,7 @@ import ( // Validates F4 new-file placement end-to-end: a brand-new resource with no // existing document in Git — the "install something extra in test" launch use // case (docs/spec/gittarget-new-file-placement-rules.md, -// docs/design/gitops-api/README.md) — lands inside the kustomize-managed overlay +// docs/design/support-boundary/README.md) — lands inside the kustomize-managed overlay // directory it belongs to, not the canonical GVR-tree path, and the overlay's // kustomization.yaml gains the resources: entry so kustomize actually renders it. var _ = Describe("Manager F4 New-File Placement", Label("manager", "f4-placement"), Ordered, func() { diff --git a/test/e2e/helmrelease_mirror_edit_e2e_test.go b/test/e2e/helmrelease_mirror_edit_e2e_test.go index 1c3d8ef1..27817daf 100644 --- a/test/e2e/helmrelease_mirror_edit_e2e_test.go +++ b/test/e2e/helmrelease_mirror_edit_e2e_test.go @@ -20,7 +20,7 @@ import ( // version bump, launch use case 2) round-trips into the mirrored file in place, // preserving hand-authored formatting. The generic-CRD case is already pinned by // crd_lifecycle_e2e_test.go; this pins a real, named higher-level type. -// See docs/design/gitops-api/finished/f7-higher-level-krm-documents.md. +// See docs/design/support-boundary/finished/higher-level-krm-documents.md. var _ = Describe("Manager F7 Higher-Level KRM (HelmRelease)", Label("manager", "f7-higher-level-krm"), Ordered, func() { var ( diff --git a/test/fixtures/gitops-layouts/3-expanded/flux-resourceset-pull-requests/README.md b/test/fixtures/gitops-layouts/3-expanded/flux-resourceset-pull-requests/README.md index 30a13f05..32979c13 100644 --- a/test/fixtures/gitops-layouts/3-expanded/flux-resourceset-pull-requests/README.md +++ b/test/fixtures/gitops-layouts/3-expanded/flux-resourceset-pull-requests/README.md @@ -48,6 +48,6 @@ flux-resourceset-pull-requests/ - If a preview namespace is mirrored to Git, the next merge prunes the live objects and Git keeps a folder for a pull request that no longer exists. What deletes it? -- An intent cluster hydrated from this repo would need the GitHub token to - materialise anything at all. Is a repository whose expansion requires a live - credential hydratable, even in principle? +- Any cluster populated from this repo alone would need the GitHub token to + materialise anything at all. Can a repository whose expansion depends on a live + credential be reconstructed from Git at all, even in principle? diff --git a/test/fixtures/gitops-layouts/README.md b/test/fixtures/gitops-layouts/README.md index 01962efb..c20836aa 100644 --- a/test/fixtures/gitops-layouts/README.md +++ b/test/fixtures/gitops-layouts/README.md @@ -5,7 +5,7 @@ against concrete examples instead of prose. > **These fixtures record no verdicts.** Nothing here says which layouts GitOps > Reverser supports, accepts, or refuses — that is the job of -> [`docs/design/gitops-api/support-contract.md`](../../../docs/design/gitops-api/support-contract.md). +> [`docs/design/support-boundary/support-contract.md`](../../../docs/design/support-boundary/support-contract.md). > Each fixture describes *what a layout is*, *what questions it raises*, and — where > we have run it — *what the real controller actually did*. A fixture may record an > **observation**; it never records a support decision. @@ -38,7 +38,7 @@ number. One family per decision: Families 2, 3, and 4 are the three axes of the support model — renderability, provenance, ownership — and they are the reason this grouping exists at all. The model is argued in -[expansion-boundary-and-corpus-organisation.md](../../../docs/design/gitops-api/expansion-boundary-and-corpus-organisation.md). +[expansion-boundary-and-corpus-organisation.md](../../../docs/design/support-boundary/expansion-boundary-and-corpus-organisation.md). ### The distinction families 1 and 3 exist to protect @@ -233,7 +233,7 @@ exist and *are* assertion-driven — do not duplicate them here: When a layout here graduates into a decision, that decision belongs in one of those corpora (as an assertion) and in -[`docs/design/gitops-api/`](../../../docs/design/gitops-api/) (as the reasoning). +[`docs/design/support-boundary/`](../../../docs/design/support-boundary/) (as the reasoning). ## Adding a fixture diff --git a/test/fixtures/gitops-layouts/support-today.md b/test/fixtures/gitops-layouts/support-today.md index aa6d1f13..5c51101a 100644 --- a/test/fixtures/gitops-layouts/support-today.md +++ b/test/fixtures/gitops-layouts/support-today.md @@ -4,8 +4,8 @@ A behavioural baseline: what `manifest-analyzer --mode scan-repo` reports for every fixture in this corpus, as of the last regeneration. It is **descriptive**. It -records what the tool does today, not what the product should support — that is -[`docs/design/gitops-api/support-contract.md`](../../../docs/design/gitops-api/support-contract.md). +records what the tool does today, not what the operator should support — that is +[`docs/design/support-boundary/support-contract.md`](../../../docs/design/support-boundary/support-contract.md). This file carries no interpretation on purpose. When it disagrees with the support contract, that disagreement is the backlog. From 2b227c674599ae7afdf7f0231feee6660116e271 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Tue, 14 Jul 2026 04:47:18 +0000 Subject: [PATCH 19/28] test(e2e): drop the ladder shorthand from the e2e labels and fixtures The f4-placement / f7-higher-level-krm labels were the last place the feature ladder was visible, and nothing depended on them: CI shards the suite on "manager", "!manager && !image-refresh && !bi-directional" and "bi-directional", never on these. They follow the house pattern of a descriptive second label for ad-hoc local runs, so they are renamed rather than deleted: f4-placement -> new-file-placement f7-higher-level-krm -> higher-level-krm The rename also covers the spec filenames, Describe names, fixture folder, GitProvider/GitTarget/WatchRule names, git path, Gitea repo name and test namespace, so no F-number survives in what an e2e run prints. Verified by running exactly the two renamed specs: task test-e2e E2E_LABEL_FILTER="new-file-placement || higher-level-krm" Ran 2 of 65 Specs -- 2 Passed | 0 Failed task lint and task test pass. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../finished/higher-level-krm-documents.md | 4 ++-- .../deployment.yaml | 10 +++++----- .../kustomization.yaml | 0 test/e2e/helmrelease_mirror_edit_e2e_test.go | 6 +++--- ...test.go => new_file_placement_e2e_test.go} | 20 +++++++++---------- 5 files changed, 20 insertions(+), 20 deletions(-) rename test/e2e/fixtures/{f4-placement-folder => new-file-placement-folder}/deployment.yaml (58%) rename test/e2e/fixtures/{f4-placement-folder => new-file-placement-folder}/kustomization.yaml (100%) rename test/e2e/{f4_placement_e2e_test.go => new_file_placement_e2e_test.go} (88%) diff --git a/docs/design/support-boundary/finished/higher-level-krm-documents.md b/docs/design/support-boundary/finished/higher-level-krm-documents.md index 95341110..887df749 100644 --- a/docs/design/support-boundary/finished/higher-level-krm-documents.md +++ b/docs/design/support-boundary/finished/higher-level-krm-documents.md @@ -95,7 +95,7 @@ two reasons: | Flux `HelmRelease` (`helm.toolkit.fluxcd.io/v2`) | ✅ CRD in base e2e cluster | ✅ | | Argo CD `Application` (`argoproj.io/v1alpha1`) | — (CRD not in cluster) | ✅ | | KRO instance, e.g. `PodInfoApp` (`kro.run` group) | — (KRO is demo-only) | ✅ | -| core (`ConfigMap`/`Deployment`) | already pinned (e2e labels `inplace-edit`, `f4-placement`, `scale`) | already pinned | +| core (`ConfigMap`/`Deployment`) | already pinned (e2e labels `inplace-edit`, `new-file-placement`, `scale`) | already pinned | Flux CRDs (`helmreleases.helm.toolkit.fluxcd.io`, `kustomizations.kustomize.toolkit.fluxcd.io`) are established during standard @@ -156,7 +156,7 @@ field so the gates exercise the properties that matter for these kinds. (round-trip byte-identical, convergence perturb-then-settle) with no new test code — the gates already glob `testdata/corpus/*.yaml`. - **e2e:** `HelmRelease` mirror + chart-version-bump edit, comment-preserving, - under the `manager` + `f7-higher-level-krm` labels. + under the `manager` + `higher-level-krm` labels. - **User docs:** [../../../installing-apps-as-krm.md](../../../installing-apps-as-krm.md) — "adding an app is adding a KRM document," with `HelmRelease`/`Application` examples and the chart-inflation boundary. diff --git a/test/e2e/fixtures/f4-placement-folder/deployment.yaml b/test/e2e/fixtures/new-file-placement-folder/deployment.yaml similarity index 58% rename from test/e2e/fixtures/f4-placement-folder/deployment.yaml rename to test/e2e/fixtures/new-file-placement-folder/deployment.yaml index c56ae44f..7371deae 100644 --- a/test/e2e/fixtures/f4-placement-folder/deployment.yaml +++ b/test/e2e/fixtures/new-file-placement-folder/deployment.yaml @@ -1,20 +1,20 @@ # A pre-existing resource in the overlay, proving the folder is already a real -# kustomize context before F4 places anything new in it. +# kustomize context before placement puts anything new in it. apiVersion: apps/v1 kind: Deployment metadata: - name: f4-placement-web + name: new-file-placement-web labels: - app.kubernetes.io/part-of: f4-placement + app.kubernetes.io/part-of: new-file-placement spec: replicas: 1 selector: matchLabels: - app: f4-placement-web + app: new-file-placement-web template: metadata: labels: - app: f4-placement-web + app: new-file-placement-web spec: containers: - name: web diff --git a/test/e2e/fixtures/f4-placement-folder/kustomization.yaml b/test/e2e/fixtures/new-file-placement-folder/kustomization.yaml similarity index 100% rename from test/e2e/fixtures/f4-placement-folder/kustomization.yaml rename to test/e2e/fixtures/new-file-placement-folder/kustomization.yaml diff --git a/test/e2e/helmrelease_mirror_edit_e2e_test.go b/test/e2e/helmrelease_mirror_edit_e2e_test.go index 27817daf..eef00fff 100644 --- a/test/e2e/helmrelease_mirror_edit_e2e_test.go +++ b/test/e2e/helmrelease_mirror_edit_e2e_test.go @@ -13,7 +13,7 @@ import ( . "github.com/onsi/gomega" ) -// F7: higher-level KRM objects are first-class documents. This spec proves the +// Higher-level KRM objects are first-class documents. This spec proves the // mirror/edit pipeline treats a Flux HelmRelease — a control-plane custom // resource, the canonical "install an app" object — exactly like a core // resource: it is mirrored to Git on create, and a live field edit (a chart @@ -21,8 +21,8 @@ import ( // preserving hand-authored formatting. The generic-CRD case is already pinned by // crd_lifecycle_e2e_test.go; this pins a real, named higher-level type. // See docs/design/support-boundary/finished/higher-level-krm-documents.md. -var _ = Describe("Manager F7 Higher-Level KRM (HelmRelease)", - Label("manager", "f7-higher-level-krm"), Ordered, func() { +var _ = Describe("Manager Higher-Level KRM (HelmRelease)", + Label("manager", "higher-level-krm"), Ordered, func() { var ( testNs string repo *RepoArtifacts diff --git a/test/e2e/f4_placement_e2e_test.go b/test/e2e/new_file_placement_e2e_test.go similarity index 88% rename from test/e2e/f4_placement_e2e_test.go rename to test/e2e/new_file_placement_e2e_test.go index 14f960bb..b0d2cfc7 100644 --- a/test/e2e/f4_placement_e2e_test.go +++ b/test/e2e/new_file_placement_e2e_test.go @@ -12,33 +12,33 @@ import ( . "github.com/onsi/gomega" ) -// Validates F4 new-file placement end-to-end: a brand-new resource with no +// Validates new-file placement end-to-end: a brand-new resource with no // existing document in Git — the "install something extra in test" launch use // case (docs/spec/gittarget-new-file-placement-rules.md, // docs/design/support-boundary/README.md) — lands inside the kustomize-managed overlay // directory it belongs to, not the canonical GVR-tree path, and the overlay's // kustomization.yaml gains the resources: entry so kustomize actually renders it. -var _ = Describe("Manager F4 New-File Placement", Label("manager", "f4-placement"), Ordered, func() { +var _ = Describe("Manager New-File Placement", Label("manager", "new-file-placement"), Ordered, func() { var ( testNs string repo *RepoArtifacts - providerName = "f4-placement-provider" - destName = "f4-placement-dest" - ruleName = "f4-placement-rule" - gitPath = "e2e/f4-placement" + providerName = "new-file-placement-provider" + destName = "new-file-placement-dest" + ruleName = "new-file-placement-rule" + gitPath = "e2e/new-file-placement" ) const ( - fixtureRoot = "test/e2e/fixtures/f4-placement-folder" + fixtureRoot = "test/e2e/fixtures/new-file-placement-folder" newConfigMap = "debug-toolbox" newFileRepoPath = "debug-toolbox.yaml" kustRepoPath = "kustomization.yaml" - repoName = "e2e-f4-placement" + repoName = "e2e-new-file-placement" ) BeforeAll(func() { - By("creating the f4-placement test namespace") - testNs = testNamespaceFor("manager-f4-placement") + By("creating the new-file-placement test namespace") + testNs = testNamespaceFor("manager-new-file-placement") _, _ = kubectlRun("create", "namespace", testNs) By("setting up Gitea repo and credentials") From 1574ed463f75b99b704b09ea9647c65e17a90666 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Tue, 14 Jul 2026 04:51:54 +0000 Subject: [PATCH 20/28] fix(doccheck): resolve references against git, not against this disk MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI was already red on this branch before any of the boundary work, and the reason is a hole in doccheck itself: it listed git-tracked files as the *sources* to scan but resolved link *targets* with os.Stat. A link into a gitignored path therefore existed on the author's machine and passed, then broke in CI's fresh clone. That is the exact class of dangling reference the check exists to catch, and it was blind to it. docs/spec/unsupported-folder-refusal-plan.md linked twice into .agents/skills/, which .gitignore excludes (line 56). Locally: OK. In CI: 2 broken references, Lint red. Both citations are now plain text — the skill is named, not linked. Existence is a question about the repository, not about this disk, so targets now resolve against `git ls-files` plus the directories those files imply (a link may legitimately point at a folder). Two regression tests pin both halves. task lint, task test and doccheck all pass. Co-Authored-By: Claude Opus 4.8 (1M context) --- doccheck | Bin 0 -> 3905521 bytes docs/spec/unsupported-folder-refusal-plan.md | 12 ++-- hack/doccheck/main.go | 62 ++++++++++++++++--- hack/doccheck/main_test.go | 49 ++++++++++++--- 4 files changed, 98 insertions(+), 25 deletions(-) create mode 100755 doccheck diff --git a/doccheck b/doccheck new file mode 100755 index 0000000000000000000000000000000000000000..b9258fba1dc725fe67eb966a2a5525a089ec0ade GIT binary patch literal 3905521 zcmeFadwf*Y)i*v95*Q$G0wx#)WKstq-bfTMBT!}}firM|QK_JyM#YGimXypSQ34E1 zqL~gyQ)|^$`;=O5eOe!F>w};flblWS}%5vsA_(7)lw%*C**hgE#g))CbS*Q2@&twNnXP8i#{k!&G z{sp3(%>BJj$M@#=Kg&R9`rt3c%x>Y+!n1`>t2PU-*7slplFR?o9G8EZJA=kvUDgwEo7#zl=@LjrnQ27y*{I;O`hGS?=~9bsl}ERnUB2fp>EG^0YZ3 zr9ACi@g7)dcErqYf@OZ$K>eM|2bak44lcP+t*@UdRgAt z8GKvU^4FQ=ds+1+=*=vjK#a`L75>sL<(-ep_MMN)^3_(o=G)oj`^Weu{8sy`&GM_w z@+Do`?^>SqCzrSVQnqjVrELG|@l5Ub=j;fIPzcZD@}*nv67i*5M~nC3SHvsva3(@B z5XOsh$%23X0}DmM{s+d0cR}CI9dL@+j>p3YCYN{C-Xjv7wHJxE=Z5cw|4HN$Iao>Z zzo2Ztv~zKpH!0uq2=`RJbcHN`;2o=HvQU@mY=1dRdGD-CM1diVvYhqoT7Eqey2df@ zoPn2$A`%NCC>~w&?nJDJ>(c)fX8E7p*}J2#l{YEoLo2RJ`Tl;+Y@4m+-0$xH=VvLu zGcrMxfBC`A5O@Bv+0LA${EEQ^qWqt-#VhgXTD~75I#Za;ns>1*U;V5s!D^NxXm!)7 zb}-^P_fVF9@jbT)jB1hPWo-AcI`1sy-+g?dDB|i|yvMP&>i*CBKN$EA2L6MA|6t%h z82Aqc{{O`Q*G<>skMHS=Y_=<>j$1f$!ks0Hr~agT!QzECx$iBzbnNtd#xE*=;JWEQ zoqF3;-=*Gb^DccLZ|qO+x#GT(nK#^h!??TeRPSC?Rk+~F8^_*v-_)wxD{sAXy6=h~ zFUl*+yC!eOeWGrzYN=05pY^ zIK0gpI-vNPPN&BD%a4)xNGq<}7Z?^gVE2X&+STyx@ae+v`)YVsad@*D+L&?k231cx z^k0K*sy^aR_YJWb@4wr})}V$9T@K?OeIze;_`M1(O}N22?FtRm1aL8KTv0 z%{2t8&m9yuF>B+e+!B_@*8j7;L}yRst@f-)>jy_SH-Xp9p=j+=l@Q?@`-6Q9~y^>d<{^&WEb~nCEy)Ft7#vvIqJGt5a@O z9&3uF>gmhKI04Nj|{onGXNH~GSQ)uz*Zz$%ubZ~lS4(8+#_Ka9SQ zRT%KYFD3LgK16=haJmSDj2gC~hWVKjeeq^r_%yf}YB+=%;{J4B=oD*+pil$DN@$5F z&)oW?L8`tyWtKj?pE9x#Afm~^vvk)v*XXX{#Xv@{(DsyAFJJf@HT<-zo;|esAFgrD zRl|?Df+A8PM+4`m*21%0rCL~XEi9^S^rHfYr{3?nMhh=+m4nmW|LegvEesyK$G9xk z2Rur1m3QE;Zj16@8y0m$_mikuSu@*pO?`%{UmFL2mN+MCr#jccK%Pq+Kr zM|_HQMAhfJid1)-e}v!#M~$(QIMlKp(Tpge>T^;sH6@$){~2GnT|My;1`TbWQSF-uXQ`%NV=s0$6^EOP6|IS#n^@MM zy1xvh6}wwwHxt1n9E>2UCd#YT@T;x{wi7<0g`13g0nlt@Lc7(f`&b7^vXE%S7jE^1 zkz@iMkyTU`60%U!w`%x36EZF5J=J~&q6FC3N^CT;DfgHD476u#yebLRD>kl18fM|Z zD;+kYFCVFRaDE!6C*bQiA4mB(%*UsAnZ%0&75 zSpF`Q$4r8hm68vb%~nC)PSWj|!ump2u5rOolWjm^x*!~x1*7DI#6T9XFIO(>kG^r5 zV*0HAEcx?8WsL(u`t3GI=g9aqe7UzSQ>0kVgjm)FI%4UR*@_w&qDE!`v>lKDKj&R1SjQ_I{lQv;a@^+u?7pkG9FxMw<) z#~OQ-`&Nf3KPt0DFGGj3*U@}rjKP>d&&h^(OW@dOJ2x4hu@wj^Lp4qw6NAT1ofiGfx)RrblpSW7LWobG%VSXG;Jdg6vy+?WIUepYRX9q7+R^G^u z+-<5}0S4HGMTJhL);zMJ;EwXZWr2qvSJBc2)xB+Ly0T_mwkLRIa^Q0|wLvrmf-X_P zC&~%iD#85R+mwgCN)}%YYUp&TvT`4VmtOIWFMP!0iJ?zYHRvXqo|&h)wzz`Zvj=j;!PvPF;k^RqOjBMB!@=wI3eFJ#%? z$iT1}Z$F6$P{&+ShtpWYPd)7yN0IJi`g3M_DbrQsahdL_L^>L>8Fh$IC_jyftU5w0 zgFBQ&KmQhk41O|(q`0uG!FWR#Rc}3kqB$%&!>oFtB+QAj>Ma4Q>WdIz{EMYJYJHNm zM$(oqK*u5jf_zaL@~np zssZGJSUo2DT+~TfSfILhDIp;#BUuwgWQ{9tQ{h$FcI3L85$;_TKLO>OkFenFBOwHS z2m~g^b;vjIxba0q;NdTy01xM*JD9)5lE)>gN+qS-$4@=&RE0I1^AKSSS;b6=%C~sC1$Qc{*HVW1bdMb>66i~y?pMgKMbhe#thpO2M)|^x5^Y&O zMwE9`VM?|g#TVkE*u7)%{~8an(iM0#7)uze)4spV=*kd)q67FX(6ygn$u>O`J; zG1@J`7ZJ$~8x&qwEwZhaU!^kJEBtB+ZpO<5_1I#Otx;yXN@m+3vl(~+6RhoUy~ws- zemP{eBm8Pf`)BDGu`hz)9y1u4ytoWoPyTZ-eb*t*D7?r4>W7{^6LT=_c}BIOKSj!% z_yR35Zd5yFP$bm_^4CJ`DT@9#%odc@kx`9|SjJaq1Eg5iy$rhdR1`r7t>@;fs*mqe znrSnh*$*WtJYXKuLzBO{(`-F!BEF4Hxn}Fvv-L5oBHRoD(A4mVAK**Vr=Ip`Hal#&?{Ev0k@ z63VskhsIEJwKxp($n_3ixFVxCd`EV1_+H43C1cS2JYRTT!K}!tlpva!6?rU$BWH{P zfMyv@ACOv=Wt$aFPeJg7doDsyOUWQ;V@M(bv;yjn1J+^enCL`!g_$vr8C4=iWSlE9 zUI&_DMh`OHWM(X3#)XND)gt3%X2w!vyxh!KKBJ{Jh4g3Utxb6nA0m6I$S(VW5@+rv zu&YFuLhZd2y;+W8%PnFQ*YYJt@i_)DiZhZ%(R)iK=I_1_#V|gG457)FF5obpi(&WU zTj;l^M<);E&8#OelymUaX(&nK9Ygui9jxvDW+-QkNes*X@lf6b06T{A@kNQD+_3OF zhVoc>$51|PW|Tvj7;`z4@0uAolq=1QawroS)bWM)hZrHPoNp*->v0+1NW zi$w`*C{q>vFLEfqnJ!S?CfqKxAc-XFD<=<{VClLq{IOp~Is^ zG)D=fp@Y)UQ4ST&_=RZX9LzQ`3w_}wn1xd@3ulhO%*?~AEWo1B5kxCk>^V3K1${j= ziol6-s-E=?G$1vMM)fSmU1amK(KdhrT}bE($bhmwzn|G=10+4`02m*`;P{0O)yjv# zL)vyTp9kUB&3xefg^q<*K8zjG{>RK$itsPYe2@aQ4o*Xvwbt<@!XkIQ$ZhsT&$>et zcuaIjZAo=8m*E0+bY`}NE=OIXQu_i(0bEyIi(El9oa!=8BBoo`aN0$;pkJsCbYL_7 z(L@xsEHRdJYdO`$)++kqnW8)@OqI1;{8{)+t5ERlEt2{uk2Ye-*eIAq38IH9k8a4> zRzKnr*;snTAdWxu$G*y%w9635-1TWcK!_TbGBSvc+d}Pql$Ae*PFz3RH4XarbfSc$ zYBVFVE85brjLv`_l!^9w;m?6T!g&tc{^A zFT^+y^P~(ClMl-vF}X+vM<5s!!2^BK*)`+m;sf9xhe|mc_1rD9Wq6cFH^J)anwE3I zQ$P7i#CmGuO6^8~k7j_7G?&bIK7!}T;2;DuMDV~sWEu%H)~DHIgo72L{$pUQ*i%Ty zXA3Gec!HDvAefti3P>O9!mkjchBnTHMWNf%xWA9X7M=Zd&t{n5}-F#Hm`$yHjW6Y&=I3!h~_NmxO~s*#cmvHo>mpApEx-b!}C_1S@J z1cnw|KQsU%5!m!Ft}px91mr+WXM@Y_y&cGc=7mxpd%RP#i4UpY=VGp!FgRhrfSG3 zIX_$MBxDyBAlqy+juwL6LnZv4f)h&JL|K2z+3FwGy?zcF;OtcYR~%}@b*q0L5&(ZM zv;Ol5fA1vt-(Y&A6Z|ilbtS|9*jehY{qdQ2Ja)fW3)8q&fFZ&{f)>e8Qwqm8k7HZ_ zyNP4z4P4u23#}oNiS_MptYS3>)chSr10*F3^vFCLIbbqqI>_Nf!N~B-89+)Z0@@IV zu>g4m|8ETZGQTmFM!vu)=u9^1as7L`S2CGJ{{%}#g18XiPED(!zWyWgpPI8n&DpBz z=_!JqqABVdSD63QoIPqzn`+-9Q&LrXtNOZP{$rtVtJ?G#w*FdWhKxkWiOr!w*g)z! z`Ova+5vGege42-I$;60RYLHW3_-?y>+k+YQ#PM%CI?jL}~>hL)i z*`{EaWBu`=;A12{&Q{RuCMSFC4>*6^ZNBghP0=>^LhTM^hhcFD-BpHfJ)_P)mj{WMsttj;}m?<;4ag zJC>z=+VSZR zsLEzl*`nq*smkBBsBMNC+K=r?v+xW({cQkm!&iwbXw{%;qyk;sWexLsh6DEerRS;|!9CyixFsrgsl2qtwp zqh^V(g<2eh)(L!jl+Zu;p%9d34S|Gz(DnC|3hZO&% zu-s>`aPA&oOEW3d*LKR+b`S*}CTd%?oSkOb;;?fAw^ZTiFfF6(4@VUL*m{;D_e3FI z=rcPC4(wVmoUy^zf-IPBXKzkB|40wzf|F}*0 zmcy7s_&C+RTY#0|~^IDp5^zp#Wcr5$_xbPJVSRy5~=eUJk{PLQ3j0 zKf}(BrWd-#L{Ifd7gjC7$^NsI&t`dN^!4v759$Fkqc$MuXyrTTO>lBwQD+7BZ%AE& z*BKaR>_Y6M#;@ZQ-3*4lzUuvmAi{}6LS9XP)o8pB9%&Q{7fl(6~X&XfKDP(db{ z#3C_1$lUgM5`To=gQDP%xhKFPy9r9wy*uDgTN*h*uw97B{ts93`^G4>{t-@!_?EZnki^%$UG#gpVB31S>_lHVtD5;jV=(mDQ+Ec4?%*MZs zTqzoxpOo!zbeGK5r)mlTw5z$z-pG90Hz*^rcQke+`bT7q_zS*aTjwTKvMc&?S&5_S z2gS0ZC)LQ68hiGINRi;iqIb)DO4Zd?V?H$2&O#!8M{8e1Co?aa!%(BW7n15}i{{9B zGOF^w^n&%VvZJ8rb3w$dAlzf>3XBMJ#@h0vVjo67BaMXGM^=?u&9iu+?TDzQhYC92 zIT(Ejg^^``0U6(JwDM)56>cqP#YTv&9C1Jx1SZI|v z6uZs>hXo34`$f4PiuCU&LXkMXU_WNre$241%sMlz49%EVzLs8Wh*KyTh#(|_(!pA{hfWA)ED1ZyW97}Afl)v&rSW1Yu`Qs5 zgv@24142{ao6N-y6ch;I8%+q`p(v3MwkYA>?%rFm)dz8lgd}+y-qUul>9Y*x_!Cou zlSf}ChVFJ$pAf41I}237Pb`u_(z*MvHwpa|aQiVB zNj;4nhomQo_oB)Bx}}>Etv)H;TGc1560vZ^;-JQ*b~3vdi@yYw(xfO?c_uw{SSCO? zTxI5Qr?sGS(JHg3M;al_qT&U*PgxGMwA-=wg)mU0rwv+$-O+&!}MSLAF##*r0Bz##0(OC8TXP|=-0yS z>(mdb1`8+853x%^dW+Kj1g{LGE)SW41$jyxoi#z5y=vyd+F}oFbp}t}9)LqyNeWyf z&Un|NEnDm^kz+zb@YJH@G}@wLGez2YfoNd@5F8&JeA@4XrG~H z+PrH;=>gugFzG;ZC5R1h=nM2&?_sgtYAEihs)WAYFMv+Kad4;l`mcW_{tb;?$wgI1 zJPPn%Mr>p;t=bQvb0`8q%lU$m`8$0l;6PUb_vFoRy7az*4A4*y!G-|GSGZoD_UTLF z`CE$e_Z8)T9OK$WAMr>LEP48XwHM(f%uOQpei{2{Zl~BgWUQ8m#nQGo9HTp&PJ2j^ zvgVS0Wewiox3>a8b&UaR5Psl&lVHUDUZgMGfgyx_$s3IKtsLwPz3W8WZ}By>>K=st zP*l)TF%$Zi&)rsWNwMgJ;ILA~l@=cQoJEJ6RY#TfJ6gj``uB)A+?oEbK(ewX zBY5iKz`1H1Ud4Np{VI3B6)7ip>e9e@J*2%Z1|%haCm~!2BmZb446e^L&W+fNSvnPX zg$HJzw?sZSI|HW;unB@O28IiaLH20)xc>r&^g~BrkYWZstB?iBPN4EpCV6U)`xOjA zXrqT-(OE8$4wq8Q&9^)t3RNlGuEw{Bb`lQSakx*Cm5qkoKF|-o5*1e>n!ziM`0BDn-raScxX5f%`G*J&CM>CZ4()CG`QdiCA_F=CsZu z_w|vUN3J0{FNql^Ge$Ek$8Q@tnBdf?Kacpmp8N@{Q{8&=?ZW|?fEbMhqsW-vjd`oQ9Ih=;>k1pT?Pb zIxJ9)s=IyZDA-j~dwWBTJG{a6zLk4K)sM)ktCOnUj0FH_2cy$uB2%2%$@#MvUa|9*sp;LR)$tgHUq1rd2izziKICP*uS)ba0;9yYxod&#-XG zTihE@cjXXlnhm9k`+H7&-?lgl&$22-R2$od1d~6t-x^2{oyiNF^VY3w|2SrkIsOZYk!l)c{MZ1n`Bt~X4<0)WZ*eGOQDu#+N`t%fE263lSz=RR zulN{WYrAmvYry^tgc7OU({M~d7H+ayWv#lXS*pfjW`v^Yp@r)~n)ygV86cmFmD)d| z7($mSwNDcudM)m$7-B&;htM7S8=*saLSWPMtL+?L&AmZc$xRlV!BKNtHMoWQPVDu; zC%ibPxmZt4F=<52K^pAcIK7eETI_Cy1qOI5CFFCZ=X89F7H*^;S>J)uVqGes1rwT! z{c=~yrqqm!W7r&r11B5Pujly$pS!ikYK6~$Axj#OUV2Agz1Zyg5 zNzJ}HSLOvXTL}N%lYJdF<10L%x%~Scaq8#70&v6wzv}LVjDdrKjVC+^J@xQXqaR}d z$HHU${4f#JNjhLiMD`41Cm)0XpV^Vg6MaU=jD%LCr@IQ3L2mrr4|{VArvR4ZdFm&n z(^pk;$+~@&my$cKeb=0z!vFpdZ0@~qWCLe&CaqUzdWr&3g6`{?^Wg0HbH+v15-(aLbr(+Z z2%33_o;_d)ySQxLm4R`9glK~CYv~BpeR3(cY3vY|nSCYyFF5AkU)jqS-|W*fq1aSG zXNDhtd^=P_Y*=Z~(Q%^de#jQ?V(cKB-~qEwHT^o+1V~K#w49Hyw5N8Sn0Y>)SNxPS zPt#q4aWv;yE%#HOoB&G)DWP8M1x9CTeNF#(?B_i7v&y?^g&drfIB_VN-YVxuWigLV zB{DN|9_^Bms30F|LP)%FK^boia0Tv@%ax z{y`c1Z;=%Hom6vJyRr3?WHuh1*F_;pR*p>m1Q2V=Ej9^n{{;!|g7ZNuP7A6HwE}2R zWp?n?_y8A}uvQ)oj0~>jsM!Ke)Uj*;mhRc{P}2^~f>=M$X>Vj!e$fO)2S@8>#$z`% zsNpABT|=xdHRY~+_`GC3%o**FeE6(08vQ?=f-#G4p&U35@Y#c>+!bHMo9p32M#&>6 zD7Jl*E#IUbP&V=l>WRH(&E++yM2=?{^x%BPv#x5OP#)2E6)u@#oL3yCkBJI(C9| z+-vknm*AA5hEs}|p>3ZrTO+b*;i#`IriBlP<&xTVkO}m;L4p;CP}5a*|`f;w+n7W{`|Bay*Ba9t`(=~+vrXW3%u*4Iz*rRk~tp)XZT zRdKY8+8sgP%!5xaQd!-kfhY^gBn*@ z|E!CQ4vX4bEXXa2Nz5=5P*&9e7H{yI=~d_8S>)$)dSEe<0N)MxxHEwHv&#M1fB!{Mr}Bxx5pxG^sC#;)9h(xLat-Z{^`2KCCqX?Aoqdq2*nLKb(`sh!6|# zm2~aKJKGHJH^aWjAZpcNsQa;^@P6ap7a=c(h_i+#F>m3)KTd!SU0)J5bPI_+3(vmr zp&}*YN?`d4ysL=r3Oq8ZvKh(-0rBkok)rT{@Gj#)_>?C`99=66f8q`AzybQ=a1_oR z$P5#ekgvu>j8szAS6u~w21G(12llnf>T5>VzB-fo%5ZXDfox;N2(d(2C5QkgkET}* z#VAW)>y7+dC4Rv4GBeY|&$*^DH#1c-gnduk5>N>*2q#^f%zpIh$W;bkMcCm)Bv&O7^EZ@INKP&zl`0nCg<6*8RN5(a)sa5 z!k@#+iq^3HKPM>#E1=lTVg)qr;vsVVv~ShfRzY0i7aMqc>M?A17uMIhj^eF>6}F4_ zV=fywrv@qDz?&>`KjJABc8hndYX{#tmYVBmkj8)&;IEovSncEkYG0!#z9sOl?nz@r zIW4@+xZxP}hgGtXNMDXL+oho{7tT^*A=_r;oj@)fEEi3pHnEmtL-&J3o)#T}lvh?2 zfwV9^SBWl>maERgv&hfqbX?_7w-38tb^D@k176baoq>EV$k~davk3?pVg*`dM{8zv zIP4hJQ4Yn*{MSLhMBuJKA*vJnngA<>@Xwl!lXVu@Zc*ndvra6mtsYo)a@`!eig1l5 z66)Eu9S0x*5cG%R-wRO}T!1N*k{1w7)|K&7$+j4hY>WIxMW@6B z!LaTJ#LAji#RL<&gPcRg1CqfsBAGg;WjX9Hi+3E#rXdH+U^Xoxut(3+oP8uGlF*p zrqY14P>U>Zm1~jva1R177eq-7Bva3KIMu~7sScP9c=^kINH^n;6n(;pS&{o2C(E$4 zFRQ#usiPWi)x-YbJl`@!bIa5E%hRx)jP=F?mjqa?6zg}yVb1pc4Hespm7;$@v;1ah zAD??i4Erm^?t{xc2y4nUD6xRx-bZk87lBW&h8=m5%Zm#M$ZG+n7XG9-Y!p+y-D%hp zkR}(@T-C+y-K?%ScQ^Kyyz9{{+SMRja9+)jhO9{@x8Rm2}`3ZCkjpdM_K5=rzW6ve;Jjb<%+t!pl_|33+#;losY9{dz#6~>mB6h;y{ zA&exzQW)I?sUUNT`S;Y3;f zWPQ`7Ej%&2`h1t&Tkuh3f3d$38_V%WLV8ib zr~W>&!eK#Nk~9RX7{nRsXK@0SLywTE^ExMT$8a56o3%f5<#iAfJAV&A!+UYqJ$@-nvd}a` zZ;A$Nxc>*i{U~Kq9()lvqAo>{FjYwYYf1j9eiK^WQ!$*^yG*lc{@_~FT#cGBT@Z~l z2p;exnkEGO;zkzbVPQ*>dsf4(lD|hu(5EqxV3{Sjb9EWj=OZZ29V{GG@hR7|!*RpD zyq{o-(RVS02_I2}@;-OFvhoYWaerL}6B${od!W3nk~r1p#Bmt{&;?PpP+YyiwMhf3 z4{s3a*!c65Px4iaZnoDQ(wDE6(V1(A*VJtByopAWWeRpwu4Q0>L#G-QDn&mY)~jDfAd_I_GKLhd=E88fNzL64uiA=p)(SSpov$yAthO|a z6Sk_3fQ3DYtT%5UvFCC7%6&{(^&t)5l0rV^l3lgPq-GXiI# zzZsIhy$LEZjRT~5&K!Xh@VCwQCV$%@-sarIQgOfd#@ZY2@8NG4inH>!ImJNIvHwD^ zlKGp(B_M&8kG9xXV*Xu#GQ{5-C?Z;`|3{L)x}~&OcDbtG3I@Hm;scU^N=gg2T2wRv&={@1LA|6w z+(w2Ru~%sYXSUPizpDv<-OgnfnPfQBDtl@s%KnmN&0K;@Gz3NGTEDMErpIm%V0cWMZTZ+PE!^x9LG*AgEujK~^V>*-wdqOVB zS@TEE8Z1l-UDGYVy#O5cv!^>CCx7Om1eu~$*z_QLPepO(;p2FSNtD4!gqfuAF0)SN zGfpB8ClO}Se4HDf`VQ;GnO0LFMu{$VG)^K9ClO{6N<>?G^7fVfEB`>R%=I%y4y3@z z5=11W73qVMqre;)uvOeoXZ3R43=Gflrw9yUiAhlosA4&e6`T@IyoHsW%@{ijV=VDC z$SOaK<=3D*vtpO*O;Mg>&GPESuq(xD#+apsk?uWK(fvLYT_T!BEX!Xk+v#&2N`^M7 z-Ru#>sgvN3A;H5G0cSSj>ruI>B z0DMvfd=}zL#f_MmIG2-x>;JGl<$DvsJTnj5OMMVHIVTHqRc>w3 zy4r}Uxbo$gm}(4G)}UYB7+FrOkdBvQj`aI;ENhQ2c$Ro?ZTRd%Yc z*SGMZ@%K6d)cKmClZd_|-J2&_MAN}kA+14zOJ{OOrh*RHVt!I5ZeojHKS>&b)zs>V z0KRie@ynve03|A0Hp{F>KrY0zK7KIkd8unX9T*WxVG<^wsutnmv|*?+d@Qux=_xoC z=(DbzXii&KLS)7_lr<3AQ81TGOM>{tX=rIGTC#wonFN4xfA=d2QVS!$k1cXm2kX@h>N~LhN$$S)GO}GZSWrt>`hTmtg+%v_w%|!D=Nh{zkr9#;; zVKoW!3c|Ymag$8QTS|$36X1k;*Z*4y^ckt;0r;qd7nBHi6I!K!w|CDGc2?o5>>Gn7KI(?onW*RAxa7T#}>x zn>TQo;EOl zy#xTz4<75%J|&XmjY&<$g!bT|_5c+E5{!aUEXL$@sO(;n<=sfz$YJW_i^#Ep3UOAe z`{1Nqxegti`a|U?Q+IHxp)<}vy3vxx=}zxt++QuoxAVON0>TbiY*cON22FJc zTKACDUk0N=69y0^SIT0O1m`D&*O<6~0xFDBw-}s2y}PyVGksypX+B{82AlY&V88f_ z@H{*5VFMg;&b$WpQt7}IpY#v72oXFoqJ&n1&T&ITs(SaSZ8wPBe+75mo*p~eHX|~w zw;FGuFF@1h6Er?~nl+o`PjC&iBNXM>lEsciUi+I%$TU`wbKO`rKI41TYFYOhGc!XKMP?q+cp zj(Ldz7m;no4hO0UiCbK#g5q#M8TOa65eac!qUz}|`}$BLZ2lMm<98j|?{1Y&6sO=s z@t0@l>obS`tC zFXGRKpJOBLJ}!n6JkTG9(bfUg=}M3CgmsyM7zf%iIZw(-h1KNQm>Af07HT!;$rwtS zY_f2ts;9!XP8%V78gS9TemDtc0LN%&FH5Q>G8y*ZY7Dq1!{OBUls(71$Hf^OH;b(% zJog+RAqpeNjs~$TgHE8V8cx6jCQt0)BzG3$j1ccOh(kH#W$Ip>intBe=#Qs@l}8a$ zuDt$pKLi?LPe zUSe*PFNa6=6qu7?&a!I834`GnL0;J-cldxQgD;r4R(0TEHht_v9e~@8ue_Bdsf(~tqaUbGtu8-yoIUC5{1juM! z!kd88!hpBcfEd$nxE$^&pmXoKAHpP~0c2Bm(i0F@oW{`Iq74p=m^x*WfpY)MxaoK=oADz)O8A(G2kgayC5iPt z_D_uoOv&#^F^Uk|(8Xdb7_QM@93tq%`30|y{spJi&&FTtEz@!6FlGlPOJa_$IBl~9 zal9dj5f>b`>iamX#bEo8!6x(9AwBZfr!Gq3uRAdBO!f-hYfl5#8^e?*nw2#>sXvBy zL9`C#?dZ91Ew2R?V|hh#d`<8_*fTBG3r}##db7{UdbOPGh4xRtdW*uX-q-0;PihC* zTrgeF?2Erg<^G8KSjA14P3K}(?8dBsK^zTELW2obYaYh4`@$z%`Rf{g4Wwfm^J_9Q1X~iD{e1_U z#lD0TYJCKkjg3nTANjA8ZcE91y7AW$xdQtGyRueze}>}2y0X@Bs6(GL3_fyDO~5eQ zK85RZHh-0%(RbpXzVO!&kItg-7nnsDx|7bLp<4=ZOTF^)37_&ZB=Hwc-gtxE_NLEs z5>s`%oT^6`_`)Jf?g^}&l~o%^XJEV8SgwGh&||6X-_j{_XK~IyyzXx+RqziSzsxSe z12@!R&JFO!x2#_PvWPa}0ldOL1;6V_#A1uG3u1+BO$gX+uKT1+0#OWEjs+IE-;a3?L!`9}N} z&Eoz=bsq;V6We$&PHZ;rI4fK}_FTZ_ZT)v)?iYpnoHXy7CWRjKH5~?pUgDar-}jQO z$i8JdtkKi;N$ExIe+2Gj7m~nlXaL@ik(n*ztZDoF8a)+&djR-u2_Kx>Kcq=)Dt}ey z6Kpy_B0*aq=#4nQQ`Ug{xv+s)w=hc2 zO&Mw~)+CD^YVHO#jIR^>@Vg-Rfr#CzUC0NIYCjs9e9=I-XySsQh&*3xoNny{Q3>13 zJZSGJC=X#e!wHN*d#3zb@(-)e9m>5i4Y%-hQQxDNW6{x_e^UWzGMq4@s7*1vHet4H zfGVTBya)Y36t*Wo174xJIuYa&$%!kJaFzxJrzmD*6X1p-)St7q+c9^c|4-|{-6r+K zAxa2f40E$V*mt)Xm4JR!T^6g`q$1!OapFlYQwDzXguzNTN|ukO^_NIHpqDfjVub9$RP-HIL2es{O+A( zpS~5%bnbg`jVC@NGo^uoT4X7H z6C{rP@hl%qNt%A?_6tVau8Gvpw$=ovT_4nk6NkXGhFBtCW-oshj<7WgyumJV$cLjo zLvho8jo8uw{^_tC$c1*vu) z!}-KA_+CeT>ZJBu3S&O-Q|x|QspF5bQaivxr|({zkrF>ga}1w8{CDpRoafVj#7#*+ z_j6>O8JQhzSL0qM%G2t16Y7MI!Pixb$QHnz@1t=T9gd09W$zpB^VkAn%oxAu|Cg>S9HhSP5z_5s2DIaGA@eJ6QUnOO)!SAkwJVM#;+(Deb}7TF^$tZ1ZZF73(#(kXW0y+R74$+ zQCBhQABe(a@9v?%Ss+XhdB)HABQ6*jV8gPr3!8(mvx{Akyy&G}_bBB2ez$`^W65>8 zpHfGgk60gu+80z@fjcMqErl{Y;FI5BZrPi}9#9P2Cd+vM5qkR7oR^>haOTaxId=wh z@Nn$uNk4n8Vv&qxZVT5*IC^IK52EJms+p>;Vkx(kt3I4(R&zG1`ux;9oTdk%*JK^(=caD z{$}>S@htsc-L?Pw&(?no*4)lWAoLLYa2pQuCzOr=6CHRtVI1Xpi#Be|iKUq;++8?7 zLZ`AT?$}hAI#xJ!H1oS^ma5MHzP5|sA|bxu13f=e;OnT-@2G_@Oc}58G|shKXxk!i zW{jcwn~bum?V!xXcqHTP>OXhF8!yf45DSTrkWceX+<8c$CA8*GfjQ9JzuZ%Ck+~6% z^|ZA!Q8$+6ze4O;4O_uxkVINtDEG5Yd}L6G#DIFbZ7~VMo1l7G{;5}z!IYXNEp3A8 z%W%Iy=kZPeZU*G|Z|fNUa&FlM(K@6M;DhA`vq4-YWo-h7;tS*nKsi6+VrFE$^IxQl zQ^JWQ2A{38-XCV!V9uz1i!%e(?JKyI++k{0#rdHVuuBf{amb$aHohfQFsqIEQ&K$V&Xu*!u(Sn zdK(~eE4-d>s4}^rvu1GAYET(}0TLwEj>Q*uAITWtFAFh8FF$<5t|oMI<YxNKPE5X-s(; zekv^--?&Q&{Q{-w2Mra;^>h~fC@&c+=^OfuckxTnGGu_>h72Qm$qd6s3i`+Xl2-{$ zL~_HXPZc%EV2e51(=?@)37_Je%+#SA9 zqZfwB^;oRq_d};(OBTK6%z)p{)2`LX$I+^$c3UnzEpECP)8lLWav`UO;1boQmxatN zXDbJ~n#5Di83JxN7L*JAX-s^VCCyBjDX0NCX&b@L2FDQ-1~68^v^!&cH=a6{9P_BL zCYFXDu99q2@KCEP{I6RYy{N^wVhh?a!=sbJ!;->EQn;54yIA(b=05oO!kXci;XomD zW-PP;JWjY3<5vMOyccljc*ZRUy7J^Zek}%Y(iC%iFn$|im&4YK!ONN^6EksF;VExL z27VK9IL8c5Qqe-%D@*_%M1xlN0fzOoid><9d~+Py#$9v2YZB230~@%SE1&os_DACP zJGBnz9>^U1b64GiELcn^3|j`21L~UKUXbPZG1yZuSBwDtU{zncA4oFwONh|5Pd@kR z1n;foVd<4NT)Vs3w)NK&ae4z6F)P?dn~2S*Mwp6mh>iR$b?ICzzkIERGc3^VghIr&)`SD z;BmO6>d9zdL|KJk<=G4vm5@P5^{E(&wBD$N74%l&dHdj2BuLP(yr|2BP>TL9qJ&3a z_!uZ1`?!lW>d>FBrwtVom}Z($_nujhdkVKpX!_JMP)4zg3S$R%z#rbnF9G7vyc;cK z_QU+Cyb~++UN|VZ1WNG9suyBlq7`uzgs~`0aH>!OnJ4vugM8&>%#1ngvGJ!cGkM)X z#TizGV+cnp`vNMMiH_Wi{cU3&ehbjJfsbqX(C~mlU4$11h@Cdvj339xSUkEMLsr-2 z42=F@W}mxS(4)<2Q&R!fM#I(hNwE+xEx4Pz8SC@S6gO|(wsFLlSj0>H6Y#XE>wdoM z^i}2C>$#R@CHVQ=#i{E0Z5b`Euhn~F4+=)Eskp3o>MnI%?)*oZzaBIH5i{!#ku^nK zZ$_ejNm&yYdB|F)sBg*J!hSVWb#M15zrbRCYLiDJ< zlPSwD!_yuZxRy7zL1Dga3Oqh$F(oi*Ew6M#+~s+QyUNlp@H=n=*Ya!}QnJS&#fjXh zh|7?1x403Pz7}Q?=D7V5s2M`druo7H{s!H(3(if|M!bZ6rgrFOR26W)1bk3NtoSC^ zrrrTD!qXjhoblapWUcT54exnIL3b;$Q+8c)WtASF-o2GK*jn4@s}8bUg*PL zzUV4iq0fvdMEoVu@*Y$%0pIuz_+b0ybs}i|BMHS?I{|3f@H7e=vyy@7SPoIh8;?Gp z%!t6`vt#&uLQ%h`qyFUnpGN;h=fm&iAIIjRk9V11i2@#U#GuGZ^t+>}4u!(V>C|9{ z<{6754ZwG_Z%=C9!Z=%B3(KU; zu<#S0BaZk+L-Y(diWh{kTq4TL<+%QgjMyR5Ta(g_RZZPRn=$9vZa9oyAn`{1&;0%4 zst)~cH9(=hLSHJX*{_JV`8&wndhIlBc&S^j=ffEQ^A~+lR{fh~4Hv9NRs-YR$`tC0 z=6Zv_jU4##Z9rdDH5D1rmR{ouywwZYLAJ*3-xDXe#gJ+qvrw(Uk{Snbi7^;iA4er5^dnP$r?q+W}6&93@7-*l0S9p8n#pt z3NYbX^$|-0mLT7}kT{#Lpjs{_IM_cTV4`EDBbrfou+y-Qe?<&?poY{{%_2Ao`?LfL zMOcq9sB@7N6rujG&p#ZruyMMemACOy<}`v_R%~32LZlP?QZS;9smevo%A75HZ$75n z(j;sg;?A~?tRt4nYL@j-&4}A%+U?!aM1x&xx{ZK-cMlD(>xu8)7@YxokXwH&z~x3552r zRv}Fi*A_`=DD$GIOCE4wovWFSqr{vW{Ks%3-k48uC}{9ukkt!m4|dNr-s4WzDfot5 z5O&ayJIy_9v@MW>iC%z!aqla&^e}J5qF{c+f8<=%+x2zz_ zx=ax(VFQ&e1;a5X7YK^L3;h~DhoG#yS7epW(D;Q`q@!vpy-8U)Eh$}y56l^Ga&wP!iYB&?j5QkkEFPPy~Qhxv8`{&OrvIFqRJgSl_+xW$sNx>k;@Y1H0^vq|qC1PuY zYn)sNP;y}1iy2-BKMJU=jPWE-@*RTqg;%<@h$6!lFha(2hF@ho^

pz`8odhx|+O z9eSnn2XtKmKDfR>@_Tst;h_Nne%g3)Kcww=p)Yqg7J_HY3toLWfJ8#TdtR|*PEl(4 zyJ1+Trs61Z`&j&hB{>Fum7FFBQmeK8#7~{W{{|5hhv=QjWMBa*k>iJ>MFEYrrRw06 zyuj7S4|{~FT!RyrwSwNskZSMZ`3&^D6hh8$tfx3IQ-OAP*vUqt9%M7N02KVrDlWZ{ zS*%o!P(gGAYclf_zrer_G>0E&m&d)xwt|G$z1N?`u_+hY&JN>I({Z5u4b+d-WnJ4NCWs*&ScV)3XdQDG-lm>V4r0x+;@~Kb+;iHygwyC{-M-ek1rvsq>3*21b+Us7OJ2cCaZxJXwXV5%^Jrv=c)#gV#e0>@gSQYtWU*%vK}@0uBA4cT za*DF@BoDvGnBQX5@GaF1Q}uy3+KqDjN71w&Z@?eNwKEV*vgRE|8c#TY&PplqDB)Ch z+MlODx;QZdUO~V(^anB_GJ+zCp;ESMW_*zu@iWW=USP)8k&#lUUi>~sQcgwKmnn+o zizEpPMbQOhAQE_amP$yWFSrW^F472aVvut3vser46O+}jWuDV_SDj)r)1Jn$D)2zoc!=rk@kdu7j<8ztcI7?);c=^JP0yDCYUQKMjxNn5RzR8!L;~g;x>nDiel-wfN<^5|D8AKXxrv`9 zN`)c6)@2iPMmCVF6+4Z)es@+x@CG&xT@Vck{U7?pL*H=xO^FWd?1jOUF#r)7zlm@1 z1M{R9hBLGQ2AYo&E)a0f!%aMd#@(($^nAJ zWpm1FlX`*W3HmR?t&*22b;YEHH8s6baC@0ksrw;5Nr4N6%g3t{SbZ99`JyfpYC=Gs zmFdhgF%0F{j6BCuWz}#xx9v#PyHeFta?w3jXW4-=@(+TGE?>szafrE zp@DiI8iyEuL6d1J*024B-fr^RU0=>l4u+&DTq*LbP%?_`2N@(YgvA}dMnv^SjDM)T zcfdtX4a2lVPh?#G6=&|aYw@B$y7HRVKecSd$v`>IaDyk5a)?1af_XxylBq@u;ekWW zDo0d;Pmarx)i|^CtG|(mBP!^ID^VfvkMof|;iL2T&Y*rP=#z9pjc%+-#Y^!nG$qjC-I2jwC>wRUT|$nS_D6E>dAJK95xf%qj;c5B>}*ir}(dV{!jRE$r!DkW}<< ztVOD9=G5T$UWg=V)f0<;2kuLYnkv=w}cfkVP&_3g)-spZVA`O zgpzIv6J)}bof8_^>4Z$dsAJJ66faX2;X};a`9|-@dYZHlOCBx?QS3vZKjNBeutTur z$E11%&b4Zjpn|>1%E`clsm+?aBX=(+78NpIcyBSzCE+NUF9(rN3#|;UydWPqF6 z_R#MSBwF_f;)xCN7t?YgN3Qc&4V)kbQNb%IAt?yU&(`rG&o;a|C;V9^{H0sMlQQ8~ zT@v)PJuuwA0Y_n*@toIMzf61y%JT$1^7*)gkI{I5?Ef(n*@rTFC9)fXn3T>(A3jp> zfc@lp?&M&Np;XMHgvR;<3tp~;RL;2)u7&23xtALC zkDz&wk5gI*FrhFUEWrgi7ewM%RS6eFIOv2D(FtGmWILh_Nvw)Ucx-cwxCtEdo|kLa zqGK2&_jcvs4IQmVgE5_x_ailGugQhC)EUZsAn@Nq%qAn2`(RPI(gTM0?-XT~(ql{`wM1^;d)!;9a#cmZWW)=yagWG$2a&hXYO%{!;R!@`l9t~mE`XoRtja^;LQ_h4+;IheT|d-xy`EK3ktL;L zdu;G}Zm$7hxMvNwoQ{Z%#;%zAOMfos17-$oJcbt&jMKnF?W#m54x9lXdF1iwlcfB{ z{_=y;*L}wuIL?jHFc$ucx`#>M6#YUzp=MRq6gqj%>*NA3>%j49#4c{haV~-M{J55f zt9IBln=x_OyeNdZ2kQeD^Vt461iPVNd4qA^e6r*qiW*!RfZGz?LcklWZ(5zi?LVm z+!=B3OeXm|u{zvjI!BDpLEQojJeA8NeSB^annn)IE!ItmuvZ zp`bYN2X*IdyyX6etOX;O@!gvr zB45W2hFNTcU)C4sQlFl-zt9?&6<76unZq!Hbj3`2hdIgGwn)4s|7qyJ4{X{HgD?zD z#NQJ7Q7xe#)snn*9%6!9xyC~W#dHd|(SQC>%&;n)cH1B`=-65`rX3Poa-q0Cam0(4 z3f%kwFK7rM{wN7Bwo}HoCCAENYc-}nXZ5VX7-n@SdTj^SOn`5W@8kb>@V6Y0@J~v> zKeIFZWu4$RE)noY@v_ENc0rL{$iOQ(!R*Bf?0QOzpK-%O=BPxqE}fA0e;RaW(&t=~ z*g{$mf&$;zZNMQX2mwrpx^qaMFzV5a0ucfE0?!ySf2HnMh~oAThq9xzs0#jA2EEql zm~bb#bG7DftSaN|1=}_)`e7_&5f%m-VQ#^PtP3Ozb}!sVVc+s`=cS#@vYh-6_v^Dg z!AlSa;lcB@g2ym~^M4Qg9-L!*90z3dv>`WHJYr*C@(8(=YRpL$JmUBNws^$zNL|Z* zVSgHF#soVa*UCCxtnS1gmRyPIcbyT{zjmWl{hgwENC5mkyr_G6qV5@@ZlY80pM6L- zcG>VaDl1Vt*FOyP%TXl0pr#4FU^zSrTe(qH*KN{uv5-eI&oT$Of7mXKyEHaPBG?$D z^-E%Zm20&aQFAjEga3*-(m;?H=@jN^hKZ1F>_ z63&INwsfda3%jUL(GR&%i9Hr+lwpC;;UIVdASfl0=bpXnODIeBR!Rb#D|SO<*~oyE zxuXI2!E@KVj1ST>@zs!bXAEH-$l* z=FiRe?l{{n^apEdkH9=?;0z>U6Y4*v{wX=X{|nSXE7TEDrL3Cs-4Nfey7r5=X|o3R z*v)TH#T}rE5HzS{sz@VMq*+w4XP-qC^uiOi7^?at!64s&NsySyAqbx|$eN?ij|@=G z?_QIX(qW%mdlD`>;PxE|?tpAoo{S#2X zU~*2*iL)<)4PCg=7k=N;H~KG286)}~J-hY^Aui?L3J||3|2!-KF;bmp^C-XBq(wY1 ze_%nuUq(BE?UnH6|Bt#ifv>W<_PZ^-6<(Q6H*KQBpG|W6`M0InD>&9(SF2f%Fw>x6?W1HJn8y|TDk)1|6XV26KY$;~` zX5V93fl2>(idoxGNttt^LmD~OhFq#;MF9Ow zWgn04VHiqaatecDoTe=uP984PNEr`J(f!KJp_|S$O);E_04P{DZgX9%fxGq+M#iqc z+C4jK*}GXk`jP4JkysVi^svPjM*pS(lv%CKEOT=3&hVq`F2=SOyNGcR?jS!LEfj6;h$!i)m_S! zr!a&?cln#xWr%{fSwD7*3SYD1H2-${B9VHL_1V|#+dEQk`Qj@3?CR7rH~DQy>2>{i znLpTnboq=f4XV07zroITu=_G14Xk~JE|Z43k<|u_!5y~~PVH-;7Jn6B=HV|(NO`^> zqb3Q%c~ZJUs6J1gI4t1KVBU=L5F4!9b*5V4%86=+orGFsZ!omtbp!sjPS;Dh@`|nc zdTH$)`d<;+Y)-`k^#nU}lLM^$=A`tS6&~oszYg)UbMnnY!E0?D-R5lEp!J^D%yKy=r6VYOHIz{b9Y%aTxxZwOVa=dBV zC`%@6luz8if>$1W;6l^S*o_ywBV71;9)Kr+8UA?|2Ea(wollJ8lqoFu=j#)&E_rYI zx{lM;+*#i+`;_aWQ-VpN*0wD?JyP`r^VJ|T2}$G54?D4o3f&WIS-YoMB*5-Re-!S| z?(%V^m;T_+TdWDqT9q0#uzR~OssH~h{+yELf21&)HL#+gB(!|IXxxw?;I9xg!onyA ze#6$GA%|O4G@ifjvjY4h?#yXwUeJr_(3T~o#S=Csl6ketX`@q*;|5Dc9#R*ZT$rej zwJ;AhH7F)<!Nue)w1ILl$=8-hYCpt`)LiW#smV;`eBX@b{>Wy<^3xas*VWowPUk$gu zR396%%Z%T&JffaqBp>16S2I83o-q54$z*8i{6H?aTp$4$EiS$}+ohI^JlRx&PWFTFeQn=q>J`cuXq%dL82 z;5+RH!N6}E3liAn8QIF{7IhJ-p%dwZ#$zQwcxIX_L>1ER`@0&5*(-NED=%C2VS!wktcaVSH!s z-Yh*q{jKgbN6{(ILgGz2&ppoO&QzDpTa>b>cC*@|kPtKDuie}&i~7K*`va@Y_d}u< zKKY=e2cL3P<%kd)HE-gIaGcX4FE8c%wyQDRH?4U;G;d8ncaJxRT6wa4SC~9hWE6)n zv2*d>BtXxJ^gWsDOQ__4V=4NPu?5*ff07)spsg?%8ZHn6dU1Kq0+3R(kg z3*S4^{I5YxGzrKps=eI@GN>gW8>aVhkp7GyU6O{hSubkc4$NEBwf58k%K#t!+W^0$ zE;a?=gU2QshY%|J_R zev8R-MTo&BEHG>vVk)e3gO@ui4qGyYmh`Lc9|2K zQtm!-*dTa$%@&xEm8Xt?S(e0fZji~K`;sGr?tt4omb{qW)EpU116R8xsmdf1+vn~d zmKvZ%L=A9{10qTv1k%%568ND8`hCh>(4gKp9%W6ga4Srgezn=_k^-mbi|LYoP2-0K z-D~i*q@+a6p>%0UX}Rf*VNFoc%3*|T)q!6cF_IX{LF48SNg2X($~dl{*^^vJ65wWG_kPm?vQA} zDE;RHpV)lE+QNveT#2j5zF;U~%m82m?Ck8JkPz$7@CO?^+FlT#Tk2w;YXrf%YGUWL zB)~FOUmlh%$ghu`U(PU4=;~r$Y^u-M0W0IZWo0m*`q(AqhLwSdoRj3l&SQ=zAo_W@ z)roGA5HTFV2m{`?3JK_~dzMKoW%_N@MLOR-U6hBZd=krSM$WjNbx*}b9I3i;V+yYs zBNUMwtBqx#6SwFYSH%QIp4UcCmF7|#ol=Mzh_X@cMA17oPA*o38zz_VZ*;P7)e~h2){8Lye$&m z{&uu&7|NNM)d{5dD4icy-+P z^s0j$*Nq7%^>Y62j`jz(v&4HJdZ2m?aXTxk#{l)ROV`1nVZ=G}2Wk<>k;iZxX~A0h z1H!gJrj+8h!$J3hk$p8Lx9ghBxl$jByRYg!Tb6!geDi3S8IXN~xoDJpYVqY0jQyjP zfK4QkVP_`IU@W_~Ct)H)RTW@@@vADFx1Cn&SE1MfqX@u9nf#PCKxhz&9ZlXVI6B#` z(sX21f`NvP%6bbWs}gjm{RXFpJ5^03q!SLV1 ziGfn;Y=qe}je#T)`dBU^?ZH4Rp;Fk5+>;CKWHFwZ{6h%C>rstoHfez6HL+?*vyo?V zB#z|IOSy>!qa#(@*NN*DK+k6e-I!@5msZZStqi4=3iqjyYF34!`b1(wUU>&IEQ5jl zo1#IxERtek?Qd80nPv5*qsJS0D2&rux|`E6x<#TD5Vc+6U`aNvw}%%ADF&vpJRie zzs;?6POO&bX!v~Oy5d0VcxZH3_=624t%sR4`;+d4;%D9`!+GYO>puX$v>J~YLEyhJ2&)QM`;H_z23TO`_bjjVJNgVEg%R%dD>8AQJD5S_Mn0e9(RP_T zo>1|J6jGGRMGzl#Ho*_>Q~#4MAi;Ok>!91|SDF01FKYY!wfJ>t8owAnmO9ZeO4}z` zH3U;?ES&me>2zjM@VK_wPmR?T2CFOgwc$&d-lP-JZAwm3l$oxg4n84UM_aWzZ3PH~ z0r!H}HPZ*N+GCdcy3f237EDYB?+N$hy?8j}0uESiRFX)bO>V0;&fZ#`wMq81$8w5kjl47+5vjVTeKm86Ob0}ziBGnE81jDy zzT_M$B(!n>Vv_Ns?YykLg=s=vATgl_xNQ-)XC`c?|}S;U+y3B z(hu+c2;egr7XHtt;g8nA+A-zf_e>B@=fH#$TWnO45}kY10S^n`h!u~sGiC%QY<^h6 zwA)y9j9Lf>#h#6Su)T+)+))|%d_p4f5({kQLymMo&(I%cnnRUH5%Y1^JIJT~!5h99 zuGr9)^n*+5DyxG;5bxytT=)qr##kv^#pbEoi5;y-v2T4-1rJ&x@UZ#9qbHnxccf;|F!JpicV>X<(sSUy&$@Zb>fJnOCMs z@>{hTQM*6bdcMD{1SYo~;7nvm7Q19(kc=0IcyuwS-iR;8?f&R1Mrs8yo|r*t^ia6o z$MX&)Yce3VffC;Pl&~@^(GaYaeAAe8d2faw!Pkw9gK(#RyR_uhG z*x{ZXrKGPNWs7IA+N%7Fh@Q!^RoMdoo&|wY_7Nk4wjqPoo)^0$SZHh^wUxWu9uo}8 z%oz0x|!RR&Okjt&D$3= zJjMx4-r_9VC*RT{!a>AL;xk$8gnqxp*|-*Bl0Rw-CI#PuF8I;j6YjNU@(uTq!J9VE zdFikKfd$3CL;*XM1wcaeF}1!e*Cx;1cUhm2nvCFve!54{VsD|Aac{@pogP1=Tm$!_ zjq+xYw<7c)ev$568ErHW;di0dnYjVAYP4Y~wb5zCk*c8&YElcav(k9fMyi_uQUU#MFZJ9o=6_S_MFq=R3L z4WRC`PVU8pC|`d_TY*kBeuQbo3;qHVDK-!*c+o&?;4gq!&QN+7&)@%odGzYNJbI@f z3y2zEvHMU{Cj8XV;_kotQpv(cI|w}dXb^mw1fLd$HmXK}QJz!0{$_Jc0O?`3bXYIrOoT$fZ z`*vF?XgmJ~NR#YkJzw0yT0+H=j3re4bz%oM$+Hh3Ws-;L(X&{ySw`mt*6}`grN#zHJ@P#tD(C zb-xiQ9fbydI5Y9AdnaBS;}Mfh?h%x-!-L6*!a_&vuF2Y)kum$+TRt2}$7xXL;E3HB zLvxAd9w5wWRD(|LEWW`HV(cpH$U4(ER_3bpskU|Cb|$UwbdNNxdltc+w0LGvggK?c zJ22x&zfGfFnwCNjI(a>to1;!%=)qu5S2H$SI#njpAP@DqEAylQlpCUL+-WHEvY$es zb%$nAXj&VvT)p7Z{^!+l^;3FHZc2YtengLcAzf`E0CMfx#@QjJOHg5gU;LlNMrxBh zknC`S5d9lDPz+Lr%~?`D8`I5F&V$&PCS^QJ9vW;H8ff~{UN9j=Lp^epr&hNBF}7+S zO7bl2kAajg7AZd`;LJ;DSUxqQwRoFTnJb!+Mj@U{4(Zm*48qmLW<%9;wLfQWDX4XY zCGGu&dLiu>g<}f>ZSWZarsyX zR}d~X%An?7GuAVV|9x?*aie1o`>eHx9c#Qu#_C2)3@Gld`iC&y>~N(8pSgs6<|42) z7&pr_dm6QI{p8B>cB#71S}-kkK8v2iXsI@O#I%hyN*|1U?+99|a4$~RZWy9=XvT)8 z<&bqep*N9Nymb@0)3fBZ)@F-g80pUJ2t7D6uV-y@bY>pUlKFb}Vdze&#Z6v{1b&5+ zh)G|r8}-*9Jn`Qbe+0&(pO5f0nGB(xacTM6bRuIs{BI0BIB$RxKYJnnZfx#)H@7DA zV4!B)Mt;J1{5m+iaKnTTJha<{5Po%>7m?LSh zsV=v+&=cQXqLEDrN#W781d(^S`2;!Tg(ANJTs5)tI}4|Ve!it9%0=?06iEJ1JrT&9 zKch!^IbJjF0{VB7_y{T_viUF+v^IP z_>7#i|F_a%@|FwiY^d()rmlU|C4*h8?$*N458hjFNa%s8nxBmeB=Ol#*VI1lpt3mV zC-kX{aNg~h_N&HFVtG&NpxsVrm5F*1C4&#;m}?i2LqybHE_$73h@3BW{Z#q!jES{{ zD3I>CniIwKaNu|)u|`w8+K%M6Y;(={XYhBr59rUY z^ygmwBzlpnyXb;GG};}p5uld-{tkRS`YY_j4fofddx~;Hq5CjynA+%wS^|umC=r^{ zmHw#tz(drG|LZsA8pAkw;PH!+Ee|;LB(XUV69$0!YGi4o>JGokdByIRO_hVSo>Es! zM7`xKS&H5IBh*u^JEPUsKX6vYlQLm{xx$B5&V(foBjj#oI8t?ns%|4pj8uCH6PwxK z=F@_?PxbsFkTzUKwRl8~Z`S_JW^8W#fAodavwfv@nt@sPtxv-bW!qn$XjpW!q1gJM zwweH%-R?NznMn}5yiMnU-zQFj_y&gR+QqghB5-UoYDK8C|7_n^uXs!RyI_SPBflhp{XpBl10P11;0XcSw$`4x)b;j+f9f$EGTo$SN z)lWQ{ndi7GOru9w1aEL?!3jM$ZGZxjWAoT2`FQB&I{85f2-b;2kb87bSYakH%>?4ia|39d|(DV9l zkk>yew8S|53xjpBMyEEiILP6JhtnlbVIGUrHtTaC>N^shpck_!I_(KJB4l!f&HiAP zni2;c%$eR`9AcyyP^|{^=X#iQq-yd1cu;F^a2xR1)N861Ga#qIv@bi)eBejhY2(kH zZ76jDR*~Fl(f3Tci6`Gs{_xTJaW%sw;RVM3r0Wv3^fG8$v(oh2R@$>-{^-xzVGBTz%38?F%S=R?t}lUEMshN zpZSVWErqY$FY&^}D9C)bty!q^E?5h1jESWvhSse157nnMDR;4Te8cQcjM zM?roq1!ohUF^g48A+keJF%Vy*YK8d#_0@jRXj<<@qK3JNsjeSDv8jNQh8+4k$TUCNYrZb} zf_tRtfwz9NU9OGpu8T5-ey=rDhSz9J(UEh_G|q#1IqU_=Gfz}E(NGM4>NKSq~f9%~vUGm}WlcjSZ61?tS&1Eb3nF9~LY5v#{Kg zJtb1h$oWlDr9j@Ikm3Kc#b+ZjSi0qcw7Kjh=iCeYibYR=3Uf^IM@GU~`L>Pe_S%@| z`1`K>bXnd;D5Tmz89Yz!*{C1l>UXR*5&U+Sw>$AoCc?@>yR9~Y}`tS*=DI;A8Udg zyfGtQ%KN!C+7iT>5t|DaWR2gV1$|?!;Vdj$eDlB;c)7!_Tgsi~DAi_hucbt&hE$YZ z`XsHgg?26Jh@=B=34axD$S2{HmR`{t0^OxTbWXvc7_yKED7!<`J#(unxU;lFP}w*+ zNHGO#%)i_%m>3C3Vcbdv#Lw=${q zBJXAfQ{v9A?K8Wf2W4`t{CNFdXPS8Q-=vLNorA^yBWEf8k6qC4@7^}Mj>TRu{(UE+ zsE!8r++XdJ87Rw)CL^Dr6oT<}KA#ti&% zx9$f|Y<#hyhRM8#`LR56KwP3BiB zsZS2g2?C25M}sWSdYu^_8@aBK_2npIs`})DE13(Y$uxoCa)+S&((BoMGA>=+XRM&ad#j zd?o&P6qBLx5L7W?=hO+WC6B0$=jB<#+gsbSUJ8M+(?h(*hHDFl6MJm-h>FlVSS85 z#0iC}J6@mVvoVCp2GzG)FE^gSI+Sd&vjlZW(bjRZzxzAA{1Edi{AMBOk5q+R(Yqnn znh@m5vaZh8;L^5OqjnoxY^YPw>D{+dXI;!6*$si(RCK>}pfJ!s`vcv}KzlfTx9ucW zAED*{1L?}Fx(_Gj@}7sOh~R>$PvcN~m;3tA)aSc9wP1ti4D-{kh911YSm7_o!vs&s z7n>tD;^iZM>xvyHAjwMwt2NZ*?^R(5puH;JDed5)0IG>~PkvQsXG`McZi;>0u#I`J zjR`Pl%QjHXE&OpKCA!Z>d})TEI?we6)?0|Ozo{->dX!P~jA{oY@&3(~2HND1!{8^T z?J4E%=`Rk%YIxtb&^(lt(Mw3cbT-KimvPJN5~=*<+1{EUwKc_3q(9lU(e<9gkgy{6 zqE|8pHNPo#eT(p;Wk!6+K+XitT~MQGZZgi0U%a4>9B(>;=LQAW=m+xL_}9?Qq3&Pt zT9{RdERcEVQ)n4}P7QAxO-Xp=X{;o10vHzw&Z3#P3J;U7gvTBR_vDz6c#b3U^0CJA zzxSrc1T249&9R1laUrX;bvD+GiM*e)a^@JVo>I&pR&d)J#}gdCxfSkC#BprY3f*I% ze&+3geXY9R3-@8@-SxfFdwcO|Pcq4#{(@eC{<2LoXZ4qjT#89^q=0$2xHzCpgtK5U z!zFarVVd5t=gEYOJ@Ony)&{#TqCSsDV1LlMm4BF7#JkbrP-WsZrNex6pQz~+KReit zLQjX05M{aVaj~tDSC@iB72*kHB*`P6b3FeGV?2e*!guzrfp$ZX45IP;Td@VB-E#wP zgC|R=*h)UVy4ZQ*U!L#dFmGV~UcfBxXF@K+WYE_jq#KN3R}68z5augr1AqBkZ0=xo z+KwD-G}_9)wLO_E>&+mvv(WdY!Uu3b8Z`joJFkhZ4Yr-6$Is!I@NRN22R)Hwf?A6! z4{h6Jjud~B)k6~sk{k?nh(Aq#kP`7m!Y4>_Ck6}Vu!;q9i&_7FqV>xgz47CzG=6OE z2R}+Jexx_G?Rf_LXm1R&kJ2EBb{zlTLy!$=1bKZaxKSZ~P{!i63V42&6gx)Yw)k<@ zJHij6bz1O!6&rE-HZRx15thZ-{xO3i?AZInI3m^Ypg8i6Pk|#xpidec@s&HZ%Rk{61JAg)0Dnp6WLP+^*wz`Yn?%k)4<#*EGw1av+{4Tvx!yfG|)(Ct_!)u=6 zV6DnVfRC@T?J_ExuaP?)k`LQPz~j(u4)E_ykz)nx zqWb8YCZU>G=wT+*B=q3?yq*os(fN61;e-VwFVJ?X6pFBv5ERd?Zug6Vrkw9gOW4et z>8B47se(j7@uks^w1F>qI1CB1)Y=3GsC-6N%H-!1q>15vw>s01I5$e%xc^97AnfDB zl$B=}haS8>ujkLr(d&`#XUfrfCfiRrx|Uer&)Y3;poO%8c>elVe6)DATWI0+5`*1E zVp=MU;0aX#qvEOBm__mdU9>Co`6?#0$moAx+nUs?Lx z(wl$xE8l-;sN|E#_gPu&TkFRP{Q+mQXqNqf{}vf9#UFb1g#2m1`8sW!98G`S#cq~- zzZYY%m4yFJ`930Bz7sAzn0+OGYulMfj{8W#ZYBG*THp_zE~y?Ty^t@c1F62^Ch#SD zkps7W*NFCRCq7wLaLeAeecvCMcu?lbebwois3D{)?#=`2g$Z{4U+g{q{mSnjq~`x) z<@cqZ5CQ(>`OgyJn);LsmyUORu{ZskuLiAT$?u)~LB9gr$nOV9c%0p%|6}=$_2T~}`AtibwteOIbjk0!|M%th zxE=k@? z_t|Ovy1}f^2YLE+ll1Er$=-P>;tW6MjludiU$*qwB)Kq8G-8S)PP0UHg(XgCmO#UU zs@F~KTfeiUU<-Q0c}s8NY;tRUpII(>g&L*{N~q>rOTG2^Mis{X6K>16R|(s9fV+{dnct5NFxJh!gw}eLkL?`!UM( zF};-QGOJt*ziQDvQu=kcKm9tiLK{f?QIVOn1&!EDt&U7+$U6}Xc&#I5DBRf3uekbi zCMZYw#R$acmkh&+gR9Z#;{#J_H2y33uH*SPY){FTyP+k6l$w5G`?B?D?VpGhEP4vM z%P@;wqxxULsjPFB>-FNh>NJ~C0JR@ZrGny{;mt$odYbC3X(R^{U?U3j8 z-PPcs)z|FbUNSk_4;>(nnU?4DUH`cqyG2EtZ+J^dTfJJ}t)&REDPclmR z`X7!%M7dc(!Y9&}oN0ZQ#qhuW_by@av)h&w4c(6K5$6Kj)R=T$#_abLD&cUpQeHWn zwZWrpB>Dh3w5oNqbcOZWV}k3VN%!1SaGI`ZyUJr)77{{mV5UB@-U*9Y!XE6j$=6ZQ zy%<{7l{)ybo0cqon5|2H7kw9d0>CU(Q+rq~#1?)t1=nnpHGX0D!q4;}7t=fOm)RM{ zpx(%vT7N9~X#71ag};NiviSRokn{gv`1{o~{^qk&(#SXA?_ghRx4=H+8=kgrZ+|)1 zN8|gSO)X{Ys~7LgEctIlWl}&|RAznpNpP8%vxDOD^(Prz{_>~9|nBZ&@tbG6<`_ zv4pXnzCIe9?*>-~-4lLe^`%sCPmlYB+LDFo7*-Pr6H@JhVekN}q=vA(h1n=P!@%W~+7rd{z^j z58?$cPCLNu1ZvUN2!F+!9qN?h%{sGv5n}U^8(S<}_Mr$2viqjT>INZyY6h{Y+uZgG z`M|N7F42BfFME4*oq|U6%&dXYN@Mt-D4tDL^Z0Gv+xeh+0O_8971 z*<@&lvH%epO+bj=vsB;aJ`*HT*M$aC6CuOCt4ijMSqP6~1*0$3G?grt+ zPP4qXK_0N6vaI0PH z^HSf@b3eG&(=Lb)?q1y6W1X#J82$WAPd``gz19=R^6id2yl)<;)3Ersk6xND4U#NI z?&zgDu|XojUFdfqd0%$*#(ui+_>}&yJtvj3%1o5?p%0ZZBkuL=2=J8tl(=!n`W2cn zB_HZlYx9J-w>B#JgX6cOYTfl( zl#cJHT4gRuJF5O@E=F`z{nA_<-cj{kbHPTy{BLumW>)6c&L0<8XXkgW2b*#Y2icHE z7#MrStV;t1TC4z)61U+n9j;~TopX( zUlk2l={*}&LAD9=wq(xxH#qV2b9VpJdAuty=l!dk_)~LszwJE!1UHvE@lEFMw#;U1 z{U7+XjylP&b?hAfYW!XPRl!idrJ@@Ds@$}>!L+%KW-fK&ug}^2yz}_0-28_Ve`n6_ zr=7=la&v>z_Nd;sJ(w0C`fdJO#&; zf(Mh*@?T`Ate>Ju^?ma7b+=s;YJb!*Co#|gy7?^Cd zF!_OP5enLFD5&UgsR#_{$-hb; zr~7pk-RobC8beNI)8^Q_{Huc7{FcVA_pc`H_ph?xcO3Nqt~C7aun(AI4}Lk+YA4x) z-#q)kgJ0;wbN2SU)C+#Qa@GtA9Q*0vcY!~GQIGmpV<+G4!?fKWLD4V$t1SAs&~_}1 zpBwChG<{5>F2-_D{Jg+#tLRbxYSiR}58qY(Rl(JM`{RG;Url<>zsiE|6x(7NzQ48) z((oNkty%C**asebd)D-vv#TeRjh}&Y0&7BnU7s317y2V8y4SxN^@@Krw)kt_NXOsi zUlr8&qndQRe^qtAuC7HM2Ig$L!HKUil(?1~2DQTw-8OE3y1g0IV+OPhA@h=@z^kd= zPJ<}W{`X>fgu9_Y`(KIoaH^re$3B7rEq}Yf?|0Fo{?(|-cckXezbZJ{AItc;{?(*! z`&ZfXXSJ?zkT43Zz&qu%^9;N{u$^P6bQ8Yv-ipQ z=QsTk6b-r48`Y?r{Hw8h{i}j^e(t>;U+Rx^(#8H&*7zc}v+41@Zy%(`cNw*2jc==c z;E!(*?(dxY)7WXoxA&Yt;KTDiHT^x18o^usRneGl_#@rnkE-Nfl@CXz>bljx8av>d zUi}5D{Q8Sh@XO+#NAV4i05qO{vBEw`^UuHA2Y{x3{o+W!t)g4~t5E~K<+VSy-M=dM zrQehBulZM#hW9&vxzt0S((^apK1k2s%k}}C^yE_m&G3moe}=uh(QEz;dnx|Z^LM&G zf}(rb^2EaUEgTQhG?~m zxv@u3M}H8u^6_-Pg`#`?t5IXV{`ge;lOFbak_F%6YR%PD^{+-%_#-I!^!!zJ;$RIXgF??%9es4_ zxTmTk{|GLbvc5X!-JbK}CvBbc1WHkTV9xI4&M}+w&WoS6W6t~ktc`8f^QA-o)c*B- zyQhX$^-Rq?1{io?(y3eqGKJgDl17 zZ&S{k_x|ea+&t&K=bfF~1h?~_HGf~x>!m|V&CmIz6yx@i(gEgoZfUOeg>!g0t^BT3 zXMvE^R7{s06a==}?NTZ0*hgIW_H!b8g9<$u^QV1x(3yWa*95l~toqVr;{r>*%+CMtjT4;cbI!N}vVqMDJupG% zb)L+=?&_SHl{KZ~>*CWndk1%*MY!%)@a^_vGIIwE>-UgJ>&j0zK*grsQ@E(*s;=~; zy7(+wz)Cpb1ESiKS2-I|b&Qc!Zc(=X;G7~+WKJPo1q_ZhNwZ#MmJ2;_NUB#=qH^VA{t~-tb+|X>{}Q@=xqLpAPlw`5xNye3&jFaVgvsxD z>5JPVMNYYvY$-wU6hYcOfTTL_g%Xa;41a%9Z_|qeTm{CSLZ_7RZ@BW^C@V=mwK) z@h&rQBI`%jEWC}Z;s>^vPMd@jiy?axrAHbFX&n2Xiu_%(0fg)LWk-``D z?_|Bmya}28;j=k#%)LN=X6jF!{(O!<*0UrYT9~%?y9I;#H}!W9JBXXh@_%sv&qqD<)4;vd9Rbur{Vn$;@xr6}nC57ES%i z8n4U4a;N5OB?DLOxc8ymkw-A#XQz(ap-wFz1hZ}&FV{PJb~sFRZO_`e(OVHgb(OCh zr{%d~TjlC(shCt5eXWbW?EY^M{GlhAJ@oe6m~NJuZc4V0u!Rbgw&HwdHjz}+rwKCE zL2o8wQ<`GJ?0<95#1-mJ;!nSrV?AIWFDVG1 zUck7EE>86!UU0lBz8N-@Z#LvGD`eZxFVs_mPJ9e*)JPr3KeR%^uZE1DR5Zv8fUZ6D zc}9f(c{;nn*XUYjnv)3iWwwY98;nN4DGJd^zci)RwC0hih42F(0Lee7u3Yz948rT4 zR1dw^t&uquws?fYD%ZJ>Pv!`FbE%$~{48e;@TSgWnd>u6xPLjl#JTxkXUN<42Yqe* zvwr@rLig=DI)IZO2WipK^_oo0#Bu-2OmMa=GePeP>FAGg1_hGRsD&R3mw3Fzz|!&j z&aGl|V2W5_xGug@N;sK%$%qq8nB_?HeiK(4U8UthU9`ij7IZExoATXKX}uE38*kED zMgKX{v;!r&ivGHUhxDb``hCmXVRT4yR@Ti~DjC>p@mB=y_c4}Gh4J}$(ff4~**~Oh zvJ*?ZWa_m&izQrpXF3>5?6P-uS(A_w#~9SzjUB1ZF<&62`98K%PmLnI)t#+NlZ2u~ z-^u0dM8B!-NB*E>-iqXr&7AKpl@P!+h&@%9?_&3>d$CpORpp*VgACl0 z#WnGBb84a;dRHCY6?y$wCwAJdn#zp}A4-0|6ZP@_0B;gCp~8tYdOE-Jl?-}eA%Flw z$+Xg706-A#N6#rN+QWY0Q{1z92AYWtb|2Os7`#yzK74umyvvkTfYV7hUHIXv=a!tR zTav2J+Z=d!;`lk&>2@2p+X4@_US4vAZlB|JXCOMHw5JPzO1Im%Z5gTC=XJX?U@)b*E_C&q`tv@$So#~G-@|$QX%2n39>)9bOO(ClAI;UF z`FjfW_o+f2y!!@!cwepebl$!n(#-2&ddML9d>u4j7a#QNLHhb=^Y!k~(l3Rn;xTog zTOIhPKDHfr+H~Mub>K0T?p6ovdv)Mx(}8#U`Py{gY14szzg7pHHXV3Z6S7*MpqgjY ziT7#gn%61tHv@!c3ia@B>ccbY!~4zNTlL_XVaV70HU4?(Fc>kStvuUiuAb#;XFwe06}kZ% z(`8bZZ<|XI3>-{P|EbF!(br4->*gOc^x*-X!Z`TznEpJYKQGd+FNOJYMFW2pH1TKg zJoPTp;q@+-@Gic7k9TqR{anb(5om_9?X`-8)gOv|+5FH+h!A(>KR@gn@pr11y)S4Z z{x*7I(8@ohJMroW`cC9sB;CueuS3;~Kt|{W^As3Im}FH-}E{YRhX* zES?rRc}?4Z#pK9fS?2!YH|mAbUQXELJT&^p7ku@5SGNVs%^$yX`|2y+{d|DfV3aIr zrpmP*a39t&Q+70~(jV+_9_ssnQG0ApYqEOU{U815J_4Y{|IUp5zi<2BtO4XE7Ek9Q zV*qdc`qK;`r~&LN_*VuH`FrMkb!#!(&-7dRKRJazXwfB|0k_#Gr8e|MA6r>fex2KiDFRxBKh<>tC(>m}$K0FMc_+;*m7`%Y=i(*SB#7 z0LdjtG2OZ#^uT<3U@?0y=LIwI=2=jcq`7X}a$0#f10&WlR2>By>%aWegOz8ar2R0u z)!NVQK6PN=pw!2e1A%z{wXYl&aNoKoD~z1{LAx`@ z-;G%^YaUm@c?t79=zq9xDh6|&&B2P;`0Rrhhy^P@>hnjHMEs*l*!L!!+k|+h!?|sj zMeY0>47JdS(A{05H)VBI)WpBRBB%Zec;7pDTpYo_*?FOp*ZKuRCqELpbFC`fGWsAf zgkJqlkc%VuH=Ee;bOl_0Obv#Ap5XH?Kaky+qBwFM%pKuYe$bCNea)oBOL4+g2b(}s z|M+zMM8_XtYDbKMnz89(w!+|9AcDu{WV$e14F89_IJ=?#=x5<4ssB`=a4(^t`bT_x z{h<{deC&|vNh2!64l50UCbQaxMx9O6_y%jEgA#{p^>8y_JDs-Y=^>-N&EDTl1g zl08jUs~>=@9yuvL;Qsg)pQuK1;Gp}h|H>jNW3P7SkT@^RSR_=6yJz&GE}y^m)BiBQ zZz#q;^RM;4^OU~*KY*FX9jyMp9`*Zw38y2v+rQIK|G)q4C-1)!82CKCqw32>4LPQx z>IQRB)KS%DE`}sF)cV)E#U}55d`7bdQrR%&AI+OJ1<$+&9Qc*FDF;+Tiz8zi+69Cr;)g41On~ zs&1@JpTj?)BWK1T$G#y)h2(LO-WWhUzXNS%RAaH z4}?0aL@qI>1WRIpjsvBw(DI}75b6nI9XvKi?#5$RI&(PBphS)?mE;6Er|Z=Mc|hYu zjpvOE>~ca~9C`nUJ1f^edNg(swR&aphfv1dzHfkmV3@R)Eqr*C_n~ZiJ1?cc!u_cN zGx_)x8hB1MqfKSqHx!zD_LpP)gsB>;1sq}i!uZKB!KdZtOC!k%oIU8~C&?#yyvatc@Tf17hvM(@P zOw8hr4fLZCH_RnCj+^8#m@8X$1=wBcZg{gd5YRx%ovHx(@q)oJsEJ3l;8-UgsDAa8 zDh+CIR62}Gi&g1J_c?aIWCN7C0R1IE-F%yku)XdKeO%;?5`(VYY{c#(YM76%gN|d} z9BN-QN+$~CbSQSa4$`ouJ1WmH(~5qGY>EW_R?Wsi`oZLvC-gyOl;pKMGGY43~Xc<%Y{64%{y)^xsnC2e_ zK0pBmM6ZJ6ckHJf7>T=%4ko)E^}cMRuyAOIMi=S~!3a94_MgpiEwp?9H{evMaH^x~ z6+LVnQU{0uKmH27hdNe`)?1TF z!!WDg1oDKO^O0G<33RYO7Ciu7$@tm5gIPwt0`tC{n_yYap@Yis?g6l5=LvYx%02{CjfM zS1>m^S@Aj=fcfj=cWA}Ebl8JL7_7LtV_aZ$0Cxyt$-S5jbPh36%a>6oQuS*Dcwp%T z!VP$tR?47CnS0uyxdCC7tcZWPMBv-mI#5GRewnN#_Ucj=0|l>_7HRcSbQ`~zXSci`It(?DtF;Mt za&18G3g+8)oGJTm7x(ymLWMit4_&%8RJfHN(nlxpiRj%)Yt%+%SLnP=M0lCbtJ|6? z=H9r;*)!>G{;M5@VSAbZ#3s+XC-lbv?f6~*`+Z75Ed?Dpow0*K2as8~g+h^^QKIAe zqG0Ie+qsg=C~@|@O8i{M6}o>oLFGL?Tvcuj-Q36{|9i4O-0GN5#B7M+>in*%h4YoL zx()_fX;)Mb&;QygPGBGMebsL8M^8bb5);1Qe!WAP$!|TAS#86+3;OG*LQw&SCc6Le z;XrGR(;a9&`(F4WiVEB{oJnIGCgk@Y)z5r?I}ECfunQuv}W_kaDuI;CVLea17& zMX)yZ&6NTUtAJ6Q|D;dM7fo&?>x(AE^jXr5=eygCiSB#ji_mWlB#?4seEhoS;&pHN zhIueWDWc2)f7kIKA(&cBaer!(-0RlJ#r+=t^w$_tsE6u1|kE7$4Cw;B(+6f2<$d8yxzdYY^ir0ye z_K|@$4$^7}N|h&*cY8R%!klB~Dhv7T+~&nNHi??6esVfcTr`l_n387nll^^|u2hJ% zrX}HVIjGVi@PrfYj5hU>E~rI=AED*40wycyhK-}74W-k3NS01>Zr&eIodfP~?=(>V zpNkpIU_Hpy17!)}a74-UAMmg)HaS=iyPq7XT6cz~`Zy9T6>^qYxGr`vNeiBJA3HFR zXu84m(J4VPhH>`W^y1o$VYP*aJsj5gL%L2L7pYpN8WQAzh=uvwaom~aTh3FNu9F(u z!yVV3&HHh6h=^#{gf%t{XxG%xuU58$a@8_&92=PGN2+iFE2y8Zq8ts#F$_9W*ohtH zRL+FxT?QF?;Lg$x8t>fJb|eZmU0+ZhcTz#`E7UO_n;km zW@fIQ1Q<%+@!3e#8dLNH4v^$b$2r0J*jE~L7W-PlCN*l*T}cyXo~MIB3Jcg=KEXx@2609w)vjM4GQsXgT5EGbEHV(A-bGMRGS1r zQ&$YHja=6hXdSfrL>?#eSK~<#XBkjf6o@|iM@}dW7*rS62)paQ26_W}M7&s8fDqv+5XJ^^z&Igj z@%&?yGT#^%K69cKBaT2z5!FW2PK$(B6B*h|RNJ{&V#nxB6oH=zOC@aN+=~1dj z6Hwz6qu=76FvuG&2B;Q)N@Q?Xbxtf-y#YR6NBFK-EabHbUUfvvD6`y3gWC5|m+%K7 z^z?>=o^P03#d7-k@<3~;I|O${uQdYVije>kj$T&%x@%D+P`v0yzP7p;y(qKlI?E6G z#}c~wx!zSp)>nYu6b<&$83pMwH?cEw;?)dop*fnMCv(7f_T1^t%>P(#?kKLTCX<6k z@3Q*Ufg8-SPxhAt9ZEi)U5A~2QJ_}`ts&(%a|kj0Ov&bA_cvEb&Lj(stSMm_J%?E8 zqMH<}3@oe^(L%fxnS|>uz6TJQGO?KzI?X-G4>GOo56;Hw3fc`Mf6K0eqb#KqyFb5H zl8y&P#nJf$fXi*8>jHkTTc;ak48e@Q*6TYnU@Smd%PEaf1xL9s7cU6B{666h{aw#zcOiJ>WbO#RFz8arJqnvRiRa>i-_uSilo83M% zf`aW{_z~?d{`mGoD-K6T@?g+l^uM>IJTR6fRAqF&&8?$rD{nL8D^36RIvip=pl5uG zPq5_L-@!Kq}CDU%#(essEE2fYm#-SGuo7&D#hb}Tk$82M!4>+i-Zu#m%S>yQ`JCk5j!U3l<^y8Ge4<-yY5VcS&ViAt zf1E_K9B6^5wl229Fu5)GMQBhe8Tw`SrE<$gzutR_Ojrq1#M0H9A`r(neW46%luXfg zRKKQZfu^XzOwmtG1HgH9#uQEQrif$eH+niUQ*^2MoGIdQ?Ak{6Wb^3=&90`XK`L@9 z5$D4vtYLCiYjRA8vv=5#EOY9VIuDFPrZ$eny13X~52$LRBWTQmb*B?$Y77%+dl(ew zPR5(iFEAm-KENE_nalZKCmLWrE{Mf`qeev^rXj=yM@#>fHdX-lPp$^S|-+kURRmW!>WVW=P%k+Z=sYUSI5XwP2B7Q-LE1*WNU?MjB(!B;Gi zHR0&2u*+?&XZZZVUn(CDfWy*pPN9^0?ikB7Iq1j#&Q`*Mz31Z(Rr#2Q9YWxboAAo~dcuWd~FljxK)xunD*ecgip^psxD zv4Q*qh<(~l9y(zSvl20`k4V)A$AkEbY;Okl@gK!dfV}>QvQj#MlaT-T?#l%=+Av0f z{O)No+(s$_ZP!?gb=+saq7oi_=q?)_yzc7z*>`34cpWSK!KvOQ>|#Fz&<*dii~WsS za>Vl=p2mEb#r~0cK%=1*Mk9+gqJxlrE_C0sPOc6!w+m-Y%rRnlh~_XXmEe&l-PPAx zL<4@_3wIOhkk`j-m4#)7RasDe{Lvj~@%rz>)1OMl;Vsi0_ZbSM#$=Z14eppr!J&^@ zrk9++th61fq>CMlUurBX^(0;u|54UrT`TpsHIc1w$Ogy#J_U{7u}gBJ_jV45RBbk8 zj;V{8)u2}LJ4{KI)mpL6vNAVn-a64je;t2^K9kXaxl0abRY3O78c1Qb=?@P*vq>EX z*4OJ0S*Hp9Z`umg#cmOCaXz@Qu4F7LBUNYGE@K!7y6@uCp_=qs-Eoxvw>nZa%#`|! zx7KE@-bB*sox-29Y@OC7Foh-hY?kX^V!7^cUCn^Pj+X0Bjum9a(hQ6B26EpwssiY9 zr)`s^zGv~7jl$tC*TZ3bZ}%Hcj}76 z_^3%M`p;d_h4|rQ1Fe~~&+@)6Zj{E*Hi-^?93dQF?sg=FaK@8zUuA?JI!cxup zX?40Yd={yCvs42G=grzb;oglWrr*Use779`*7D6-(~GRfae&z-yQbgJn$;I$Cit4E z7^A|s&0J0~^^WLeCeZS~#T0}oH8cX>5vE+9^*_jOmJgu^F2T-V8BsjH;dUt6ES_ty z`qCXLK{%iS{19MenD6pT8@~Aty~LXDhSJ!<&39?lq%=~s_Bh~#{YLgXzQ-)}HGCdW zlyAQ?%E>3Q-_4T#m~Fpn!^_MB1-dUs=wf?dF>Y)RjZzPqG&0#9ZY}NLxy%oZ*8C9X z*1*N%Cf@qT=xMSLxK}=AXC^3iRcMR@-NkIK^yOXeUnAf9wGT|5OUn^sA6WG0$Jhtn zL0o$BGc0OoP=^?ba`&R;&-0B0Vc$q_h8?EAERW~sz2M8vLq}NI*&ym^(l8pez@4Y1 zE-qXY2oj2-4|Luw(7>qOyWW>VmQ}9X^7)2}n$UycVvc~=>g3`)fLR98r>CBR6!T$!(@~JQy6LI@soOCu$u^Q2<0X#Ed+zW2#SjB+YkGRq@+6miM9EKn!+i>e; z9^qJ&7Lo=H)wpM7^|yEYiRs@6ul^FOlMJQI{qgHyoLnrK^k@2KbW%fm$@QYOEcz;z zbrTE64k6Y}e>ZiYi)M7@7Ys3@iZ1)TpWoH^qR%6S3hoByD}jGVXBiDzlOLUFWBxdD znF_bM$6a8BP#F_246;Ec3|a0wNz`b}1FJFE_`PsX@;i`RZdgS})iWc6!z7^{Yj~=X z(2n9tNoYH&J`|U1h0hfHkYbU|IV%h9<^nC0XZZ;|+caQh{>@yZRPHPmB>03@3{CS7 zScl9K@DEtWZ%aE2f-aFF4$>x1c2C3~*bBdn8AB)y0k$YVius6%;-j?_*1%mK7&$JG z_OAr-t*o7j=KSlLSiyhuYAOI+(mBA1JluFJ?JYf$t0rAFCl=w&dbmZ`I&FKad#@G- zTDS3w2P)w1ByPS}fAY^b?*!(D5EauQxVK|==;~;0k)F08x7T?ZuRFXhFOXmo;su3t zh0U~PIhV!>4ZJvmzHZr=i6Xt}>t5CXnE>`MmkP|PlNkHtNcW9@^y#w+7~risQl#nf z_Y_aW8nQ9m+0zQ@Px|py3@m>3P$#}rTfEWloMk;OOV}G0ILkiN#eyYH{JI=Keiqw= zYollHa^inDnr%0n#qI2Qv9@d9IpU#Rujkf{ew-5yG0*RFLUsF`%606C?Rq0uiBVb* zv>F$oFh&0uE>zDSZyL@c+=HAL(fnh$O%8H;@<(w2@NQ=A%wE-vYt#vM1xzquz@YOF zcG>d}loZ8)W7%8MP?U$}F8yw_`m-jKjhvSWQeaU-VO{(`P0xF_)JLDM-Sd2H*K4`8 z z)u1~hyE#L7YHrzj%^61OpX)p@JI!|gOZwiuool$gtQvFIdsNc>(f)JGe=z&{`U`3S z#u$V~JpZ0@;um*bK7nLm(E~?Pe!00?VGksek8yFl`x(8QKmK2aM@#kHAc$EsmS+OR0k*i;bqdbnH z$&CA+@SDxB-L`VCf6GNRQz^C$wfQS0Oj$6}W`Dvl$5149(R9N_gI`84W`+NN9Q|nRs=Ctz4w!zeTdh7M7F;~qk z)QgG(C)@c6Dj$c3GtwjQe;XRZ{~d(C zj=+CovF7$WGqDC{Q4-_S4hX_MsyLs~8xc*s$5z51l|l$R87?)E4#ZGK`1k$Cv$a;_J-EqI~P4V&k z@$a&ABJn%R<_cw+fLRWSer+XPK*^)|Won+^Thz9jzgzqi)A@!DTxygtq?kqd_Qulx zV7~Q7Dw@ZVKzNG*Ev^o9(Q+cOOC;pzXZ}y#85U4#A;X_mzb3(I*jD~|t?<@2uctYB zNAbc))#4+7z1DFskz|28e!GUiwWd7EPD%=v$?7&s<+OL!23d@yoY}p)faXn*1^y8_ z@sNRR<({@_cyly%roJMYyV2a3fkw9igl~GlxZf1txJ*C#Z^JS{BS+x6hYOEE#q(Rf z2)i7{6ZfsF5uxr1Al?14R7t^S;gue2fJtj9F>$vU{YmVxmhLgNk*cpBuKtG>#wlY9#~`DL7xK=`0D{F6A%(o8x_G{^0x&tqIi46M?BN*`rWzQ+`3Mp(W6Z!D zTdO9;JflZM>$=}UKG;iD5p)N6hzR|5%Qx5$Uips<{QUD5X=rk=1KW3r``SREjV$ME zDsaCES!ORHBH9h3^~C`I^AYE-Sonwur|_39HjrLs+aV{genC?Sbw1-ks6nkYqR0P% zcUrBpAVrOitSyu^pz^&?{J&H(c70GmX_W_VxOggAtBR{T_Eoj!Po?Zk%{G)PI>5Mt z6;(7WLpet4HSQ^YWG5U`4)9b0+@vvDG3$SsK+CJ6T_Ved=S6g+9_9hD8Yb-yQCis%38a&T9S&Mm*vSN}9lFMf2k z5Q`?Q%Fz92ul14E2OZw|Xz1Yvh|AvEYXH_+Dy3UOgN5_Z)raU|ykJAwFxlE=y<`33 z-n|drtWkNTX&EpZ2S%9lQ+N4`Nk) zpje0LlR(OXoHtbH&I#1s%B4`kmgfP+A0V^Ai>1qc!~I*^eF^VLy_dmOk&T zvvia0Df$w>iYTN01IO5+J9JC^^!d)xUFPOaukUx3y4-8&_#LyPddPel{j>0Q#BQx0 zOr(##mAL=CJ_b&XsA--c*P$mYhy@C_`*$DW#%jZotRhU^yzZEJ?*p+q=>BN0pl)mg zou!HFw}tM_dP|#Tf5x+I#w0>3D(A**?Z?tv>Zf(dqj**O*MrYsJuqtQH*QBGqBzXSTu08QC-cL=M z-^^JG>REi!ACI#|%`8DkP5N%D-eKertaQIgzuuH_z>mH=ce?$~PT94^xaJ|%PCILS z;!=zOMxXR2%58fuV^j|r%rf>98YK^B{^ZJG*iQ=hOnKX)J2lm#X3QCesJJ@|9)>-- z4|pWU{CD5ok5b_?M}7@|Jjvr-a27Oyhvd!6*iF5-8u{?l`*bjp9fD)z?_$3(O=n^M z`_n(V{t>FbwV(Qp>f#R1YC!l>oU#5f0-=A?mKkMT{D-CY!*eW)VeRz)(Dp9yQ5M(# ze*y_4+%`ziaMMI12DO^trHP1cG{CdEfuK~Q&~ItQNUd!#BmucdUE{aUVG5>T#Q0w{u5<>KX8)(habTwC*de`cQDB!F$d|JUo!>&51I=9xJ&bLPyM zGiS~@lVCCHnAU#Z5?m{fX8J-;@0KK#CuYn%Fo=!!q;{wY( z>DBP|n!vK$TdS*oTz#2&omq6SsFeVOM71q_L8Daq;v{|%x?9%-OWyEBzl5*(La(P2 zP7s@|YX72H`FEBrVw$mzTt2k4zV&S1{5L5P3_odt7YABjDKGiR7qWH{&*y7al~HI^ zAoP#iITu4eBZy~5OxQN37>-$6nCK-( zhvH%TpbmhUG^)V2M6HqyS+(v<6ykIbosdMTDi6PhOc@Bj&Z}V&^YevC9i~hbmlAqM zESi-~0MV2f*HCbNb9ZWa$r0az4Y1cB*JT!x<0_(to|@{f|7yCgVK3Ecp)>nDd@Q0* zlMujz40X=meW9Q5=7he=ol}6Kt@f<)h7W5`S2rh{CV4|nQB~=Sf;q7{vtzJG8 z>Y^^3ykqnvNOW5@&6vEYg9a61z$f%?P1&if-yjZS;Lv;VUcvCkJjT1&zvBPPfD(kF zCX9fh_&+19bcIeYW7-qY=ev9jAMh&qV~3B(W$k0xxKvf8 z#BVvF$7dGx2EMxzOBU0OlZ@rbx@__DuloF+`fU3O9k7;qeRYoOYy9e9_^Vhd2O5T# zDh%b1EE`=%3B|!g;JIp1S+)~kyXGM|5PnPAG{H3T1BBkK`W$E3>mE-G9Qx2{-rL!U zrk%q7`oNG^0->YX)&CRIhFg!m&@tf;E}lV(nP$NuIMA=j4j`(f0Ka`WuoiyxU0qau@C$O8 zhe>=gKppT5e$|WwekTaOftLT@@OvJ_>;^dPb<6lM>+3MRU8k#t;8|nWFLsoBY}zgO$35Ep%f|`PJM`%kCn@V%dC=HnJwXOcGn!-R zp-D}RLz^wux`93znmipiGy;7&>-S;vF6=jky-5rD`kdQjr z?X806tES$zOnsuJ_a*MznjH6OuYhCVyW=s3H}MT(JCrNh^PX>bHT`#6sS3BoD^=k> ztpcy|YTNf)TWTD0*z~HJcia>^^B?lXsroETJO8du)m=^qup(Lc_hPBI7gM zr`hMk#@Gy3B-%32%Rs07u6wravLF8KE zRGP#13`hAa1FQmff4+xFrLxJjwBCm<2|6aL? zZjs8p#%t_ZTP8O#d{T2*@|x&go6Mg|e&ll%sJ8_!v`DTU>k(ry_!;2kFLpPnCwK4~ zA4h|(ra{!Nu)$~gmfH5XpPywrG0}aJ%$7f>z*+7%YT#t?b!CXAXY^oC&Lp7z@fQH~ zR8$XN-mB>6%q0BY7XHwV@W%`Ose;d$M_c=EvEZT4j_}X7@V}je zKOhPJSr`Ug+srk{rfS>%V`7I(01{h?@SVhu#e4Cig z9v}uk;_nvzvzo-w^y@mppDFm43jVNm@GbiN@RyZm*zyxCeu5VM>?HhQN%&(e`~y2W zw10r$Zv}{5A3M%0+CRP{{7+$eG;&Z9{thJ={Oq^9>8Bmx8~LD4@MoGe&eO-)4iw|x zb9#sN-)rH&xF><1nI8ON_kIh1Xh-X)vV#63 zcFuDlwVEe? zV%@!~15~$Lvb|(t8Fu>#;PYgP$>__yrepRUmMeXdMt>RL6n6s&ZiC5`7;ALHl^kTO zbESuHGxaT+zBF0lVU@U^)cE)WeliiA0(k&<9(+% z@};{HuHzmQkmJ|K$Dio9KAu#Lw(|3*w7Y};KYoW=m}}JaZn2=#BBPNnaM!EG`J|cl z53ubIZcnsd@~L~PDPqpO1ZD{Cd>Bh^^KNC360E?X`EvjDR-yLUP=T=em&r?HY^xIzY|Yszh^y=l%gt=XM(q zccu>J0qN=YKRrRe|73nHkgfjh2e2ql#b4>s-9-Mnr=mEaNxp`mWZ;MaGriSD!;gIX zt#mA5nz7xoH}}}n4ks$F3HF!nj`vYavSnGu5J>m-u=(2#3k7cFA5K646Tv(G$CCBl zMk6_o-y`J6LyelaY zAil@EBEj?WU;rB|A&&FhBNr6ZE@M+2EJ@`+=iJ&qO1JTtpbdFL`%fupoajhyC-QXB z9BSB0ID&aiPU>N$Hz|)9V$St6#6#SfPoK~^3El|o(3UFqa)b)wndlv2C}kWyQt<%pbVmE!C4O3}ykmwxZ`-t7QBZxkges*O5TtEiJ= ziyDa@G$`Fc&39Oz$*L{7$?9okq-)PLc^>fYXq#{JZq~lP@0*tk+yhpFLRP;Au2_Eo zSHa&5Q*+-}yW6Y|NkZ78M%};M97Wmlm6hAU*Fz=HFC5N^-ShZYasBXH_ZM(xepdbPZ<~ky&WZ~s-CB3y zk7{9Rh|+7}6z~~iL|qu)9y*rk zYcN9wR`By-jshuzxq^Mx#^VlP;V2v+`co)hty8bUl2tW7C!mR`kXj1d-HMkLO&|UQ zjPpFfxRZ5=Vg=4EO>Vm7s?H63?5B_8v~=^e(A^6!b3e-Q)<5@{1=H&~a^@)K?PC~$ z2AlfHTvE?eYId^x)8d8E^uv$vX^1`@Vb!))WIqw;djReJ)|Ov3HUTvos4(dB-Sh01 zqF4BGm5Q(M1i(VK!a}|&lTV^Q!`~M3nRcJAUR@~o=L-G^3#Bp%|M}4%+x`4e275?* z7HrOUW_x3sLEL9TuC62A^CbQ@)&5uGjPWLn(u9^q5;oVC&rm$&b#<4qw)Z@Y9HPid z?u}~9jodA9!3K)<(6?9kcEDGuh)g{t4=Epmlfk*LkYXS0uaSc?-0Nr?xf$`;Z7c{0 zeXFrQZl*}0jpXTDWguRFe_ma=t+-{{AgW(g+kHl+FKe9z%!4mWfrP15?Qjz9{XOsn z=9@M_;i0%aQQ3$me>c-(ozv`Ie0D1yK2EeTmC4b_G0??R&vDXUXBRBCi+g&w*-)~x zWe>#dclxb&^0=CBJICRQO26rVZ^Ej^j!i(`%W!XBoam>}DLW9?& z9*$p+v0?;4;6OZ}^az$ZssAt<=L5PX>SB_zaC?uR=Uc+xH=Io|Yz#7pzM0`0?Xg+6miwwC;Vd5Ug%tO z$^LzOj7-mPias#QI4jpX&Y_QK3wc0v^FAj!m8y@Lulv-$X|JlOw0l|KXb0e_ zjsQmeO8}OC>jFk^{!BSRf6L)yBShjpi&_-MrGpId>4}o1^+7L_wNmABq=&;!@9DbN zX1d;{7bYD;VP3hiC!HvnmgEW1^BR^PpI4HRQ9Qu5BUNwOh-g<7P94m8eRUw4KX z<58v#Cpsa&5D}^|D&?ExBLeVWT&)nhYb~9!h8Z)X!Lc8r2!L60%OEor+KLb27s~t$b>Zk7H}wIHbj&Ou0S$ zIVy~#ejU)+A7Cy*pdNr?Nz;w%p@77b!C9{1&*P`7F@$aVy+MMJ!LxM&pJUzhA`r8G}uYG)$J72HS z^r6Y`Q@!uGri;#yb?z>^M*Kio%pzMs7Pq?qhhA|yr~*%Ys6CQmpB#^$IgE#gA6ktv zOHHrz{L7$;`sq0-wf$UU8A~54)P{*_D7eCF%(tXs$b7E7>! z>Qcc#UduHY4Li~6`e6x$Pr`nS|B@{=Lu4wIYgpKRccW(x(4h`}PE?e7U{S>oXUHM$ zE5zf$X>LUxJrs=g80HMwUw<^K`Z7bnvYaX~*U&oA%6=wV8P|fkud7|^!5Y8(9XRu>t5NvPu z^GM}%cT3GF^v>NUx=x_4aFH{_*5?*;r@`@rZOp$6eLc{A=K^7tgFeLi{oUa3FEVi<*--8 zouml)+)f(?xA7~S)GvAKL?@>@&0h?6Qomvc(3#Xl6Ee<|RU2Stt&t5ED{5%hJ|a_T zcvyn;a4uHbYy3I#xlyEnX!->hcde8ajk{+A{fegdNG5D1!D7Mfn&>m<7yo8`m3`Sx zyZJmfp~Rm1>BDBOTH7Cp6U)V#{L|rgSMdLCalgC8{qB|#(cL9Qt#S5Rm!F>Nw65ij z|3%~I}5Q@=0s{$V{I0il=Gwsnq1Tx`<(5qZ^`tG)KS z{a!htC{7Xo5&vBj z_E7E{(;STUz2M6}+(Y|LO^Fje91L&KMY)ycQV_4pSZvr`Na7x0&w@%Aw1B`@CaCiE z*O+D8cPBH1ov;5~ezJ!JOV-Z%Ah|ycwPyK3zo!8@Z!SKsJUWmYYR3~^)3!elI!61Y z8Z3{d@x{NqTt*S};U72x?P*l|ee=G>_tDX^fv1lMzg7AowWY)_Di6O?8v4X1bC5+O z1f#=0JOlp1?n$rQe0lj5qZVCW5NLfp(7ZRzP(XRZXS3HS`dpW*)&T6>VDzfNR6qlC zmKKa&_cwfU0*BtUUP#-hF%1MB?F8yJF~`K05Kuf?NQSCzN;1Tlaa!2-RrwEpma)paR-K|A(fH0?C-QGlz(X{M2( zZ_-E^AdHO7X71xBMohFhd{66bs30UOYdV%TlDOyt`9FRL_8|tp9{~?xZh3&eZlIf1 z8qaJoG$Sj;+=np033bYkaZrWI9XG#)jC69jG9x=D=S`8 z-MK6b7qOBIt;YjyJnD?=V6ojGRJ$-wPqZM>dibLWYwaHVBYV32{NTA{`uI`1=k4vD zUvKx^%rpDzb}7&B>^|L=ApW~pX%Drfx%coKh)z%V=ZU_f3RtbaT|T+AwFz6SrgE;% z#euC8^m_#In#ahr(f2At-$$YEO``8q-#odFu%2;adi<_LV-3_NS( zq6s}thyA7n)~-T4ZH0tqZ%gR6xZVASq%rV4PCwV&3Lu6Sz)R5Z585~TM+sW8#J-2t zvS318fe*^V8v=*62e?POJg2W zQRLJ+)|6%603psO(d#s6~|_6|uQlZgaJ` z3(4iKN;eW>-De5$Z!D6Z+d}|C3P$RzZB~Bw-KP@0b)UJ{>t1X`VwZ!QJ?mD-_u>|3 z?HZAm<10hCSIvt3Rp#u>qRlTM-lnig46QnXWLHp~)o3F9m`f8fIB;A&pH+PHKbEUv$tjoeVW z-YFTAL4-1-$U<{IKwEC;j?DsoY4_c%0WjVVHTrr3Wp2Q` zb@3`cRsV-SO+1FzS(Ig#(M0rI0N-h$de@X9tE_T${f8Z2mxg)ci>pX_*B-r7Rz9I&g5+o11i%%%@NXY(3A*i-9l-`{ zb-Va(Y&zih&Rr$#&t>bRk@_z*QoYO8WiW~C{(^6i1{e*s?R=`vb~}iyvVv+9lWl-?>eK{r=h{?6iF*NaA*=J#E&?#`qtc6%TG5 z>~_B(wUkS94eAn&okKzvxJ+~f^x^042Er)m(!2>KNw{?b;oB~{GYh@BH7{l9{7Opn z*0nI^eJt`>jpdOP$$Y**NlxvqK#7x4i%8K#^rhqU3CH8u;BCf@`B}P^11%PV>&ri2&gJ z@);m<6nd09)JZ+)gjvroIb)T+Xb;3^KXdbLRie!tW0(k(@GcDjGun{K38q)w#jw;j zG-Yc(H+y(ZIUpPsyDPRUJym(rko_6p;;-P61|?sUQCrejKYYR8>>M;2`EJzdero_N zfpOESo=0+N1b+UJzF+8x)XLZtu{Ms~XS4m_(t;Fsk~I1p#hyZfEUn$^Nw9S8E?Q`T zN&gUA{IBU-J0GTe1Xrx78OSRa-M}z!FwWOV$*Bi;kwboDR!deRgWaOR#`CA9r&!hp zfrT&(f5z&sA7t%sw%Ps7pJ8lf63zYeG2s-9_?C>#KDa8iW;723>|FH)RGTsFGKS{K zvt)t;DpU-b`oH%M@E8@BQPKoz7DI61$j=)8_I7FejkONI$D z)E1%;=mf^MkV9Gqc)mFoTJ)&5IjWHxjGX$Rpo!XeLrb%?1}?oOOl(nWPQ6tu9b<)EAx1Mj#mZkw1C zH|Vp~n_2zUV(#)&NAs$_e@b=XsISD=qf-zOIzjIt#vAbC{Mx3?*8>{Z4+eg^Mr0j?=;yR z`x@U#ufV3vi1e2vo4WN@>o`VaosH&GUmdeX9yPskw=GJ1RcQr8zedv~(a&GB0GDp! zEQ{91sJvDyIJ%tIYrcn=Pd_1#;&{(QqzlcAZctI(1TDfcH{0XrcyrP zibMygIQEuyH9RFd2D4Jfi{G#v%axy4Uxi_}J1cuU8G8z&+C(BjM=lBtui6fO5LBBZ zPRqTcOgK-DTkuP7$)Cx(S@uQ_WS{(QO%`I`0_OZ3HIQ#*j&X^b`^saCIXn!k)bnIC zMr@QG;~Ab``xr~+6n>CGHB;P4JX>~xdq$Rfi4MT&3^SJ3*x=-Oo#o#$tnk)H8yex; zTMNK0`bl?XUscxg`PTU zOQWxCdK-Ohh+{X{dNG}^#6=)>k+hzKu9Tei z$9FVx2rK%6hd+OFtsk%E1u^9itf%MbV1fIsBE8wa9lHR`*KsCe%E;}PhUXGTkHR(i z1;h=_ivLA*f+tX~I&<9LVT^BvLmdPQq{Xf~X$Nfk?`>;8m7597nq~DfO*KCxnu!^O zELs(BR{V!6)R_+$#FW|#1Rh3YIz#<(N;bXg(3zThI9I+p5_l^a%t#sR7*c1ty# zX~u~)-`26_f7}02Ui~@4VGSu$eViLb`*ymvFA_+P4RPJ5Q@|}f{nigoS(XN+akl>3 z{+#+V0mER)oM#%*Qhj`tp2Y3Xw^V7)p(uVgVTOZC&a3D`uEKpZ0?s&V(^ zUWO$OP+Q!&ebqnXCTc8=2rqI2Y~s1evao&m!bvYqpERiMF+|nCvK210FP(F5>upDd6w`9BH!k1Lp7hyn z+>e?VGd#<65*#u?Op*`L^uS9H|C5)At(vtakTE|sG<>Kks)hbKOo6{GUmC& zM<}9x4n-5ZMDyPrKijs2Sq&?R-Eo|_XvgR6w(%)8JAzdS{iocO@BNEm%;LA5)dTBp3YIj@?xiqLp(|5r;)omZ zk2T~K!f2(0a#(FPPEXgd$A58yV>L-^_mNMV&06hj*=hIio1MHC^%B{1o&JL6Rq~v4 zqF3c4HU()p>NcE~4VxG(7H0>2_x??7Hw3cMc4LpP{uQM~am@BQpa=;n390GGk%fn@ zB)sHVzz)wQBxEOThCW4|J%X4rX>e4u$}T6ttb1|@gY?g?@* zI653mWVJ{fssvqBoO`kAeV z(n0lP;|;Y>>A6nHzS-xg?aZ9A<}4e$`A*F$(Eh5L?G-UV!mG+7BMZwTi_B!jSjch) z_KMvC%M(*O!1;Li9fbCPIS4NgKdju19%J~e8T8)m;841Ehtgsx$CVC5PJuD7rC@eT zUMUtCbE*e*?stC!NEpP7HIH83Y~IF>pwsy{%gE#Ah?V zcWh&7G z*Q9EH)HeU2XJ#t%f8Fd}qG#eTpJe`f_lf)qCScf!vt@Tuk;ge0s!X(jY=A^G(X{K( z4g6EO0o0SZ3082VkC1UZD>$HTSXN+r1S{CCG|LK-{7?6#H7gwmC$a=}?CV$pVUXIf z1Y-8Ag(HX`3}vG|2gmJZ&OgNtKDs76t~o=wEA^D6r-^!k+b0-|sgYd;N_#ea;ry^n3$l5Q&wK4Pue?Hh)C@LSy(7dS+-1Ud0~ClYf_S>U#*D+~ zbscqHrv2p!`N^^@RwKm)WGh*P{#FYSfx}K~RK*1=)fe~UU35Ys6Y)c%>EE6R%JPM> zADxrfmAOyUdQFW#+7V+N-%R~868NhpIxejE|R9nn`F!K<@sU_Q-8_|Fds_ z^bv_Rdd>Kjnt^>;RlA04u&N!DfT-`*UZpjK;X)P1?R%!x1$v}w#B5J}*JNIcYDE)S z^MtX+M%Iowv3~-Imgm@(|1g=*HQ93fgA%Qdjb&&$B9}Me*SFwj)X~2EXelOn?f?FX z*zSEoDuNaX6I7>8rh>tGIvf6#_tYnuz@$L+OzyCY?5N~7()jhwxbhu&1?9*w_ zs&2NAiOw-Ckw;^>bSRR+s)6kadn0%J2lFM; zccNDV;U4E66AJH6UuiHY&dTAohrU!XF65i-;Oevc4Xy^OWaJd~ze3j;9nrNO_4IKb zA5xA)#a6ub$_cQNGsu-qsD%gY#?;CS{r)pdZ~_v!rADGmme7{K0kzJdS|P{PHJwgBK0Y zDd}BzXMouj8iK}g$Y2?!#dMI*+5zOGPh&< zx_4|}Z05G_75NGZx zeGGqTgtQiS>Q6*@QcN|hpVhKV0BA897sK-T+g4}$C(B>f(VGO0h)exum$Or_H#hc` zp~Gdq&|i%rABU$QeL(ciw(ANS_{#n@{Jw zk+7A#E%8bG^)vHv%#SIjYaZNd__)ldBdq?E@9tKYpZ&ImyB3l2QgT}Q7%%1ZCm+qm)LhLbVLZ7FJ;mQ@kC()=#m_$yM>nBQ zD?~$)`!gV2jlVW}8~EC~Ds0lsR%}7W!RFMOVXA@6PmLJYe(5LwQ7rvu6_8do?kGYI0(=NCqot zdCGz;l>WZ?f8bpiBmLtKD9p}fRFTnG%{^5B-=L{Vj2nRo_@2$q2hOYN|A_gY)pQGn zciMwdqQdN?g^GC5*TlXnBLK!}g4UNncD00z9`u84gRx)R=4<#9RhKOqmwzf7`B~$F z(f=Yu&^BN6A(Gvy6PdP98DUo}l@9`>Hnt{Wo?&R%?f{5iYEx8=zA;@w)wnh--^3(4 zgu3`R9{PU-HwSP+xi9n@h#)q4EmqV_N#s{f22OzON4jJ)#3C8K|6$=Z;xEL|B3&UX z-0+Q>80v>6wdsjzv+0iQgSQc$$ex;k)iA<`YY8#_Fz`Kxjj!AbWL7FpN#WH-eqJp%8}l6f4PJ zCeB#QX^0q!d&4m;Fs8`>4XqG--N4J{T)FIEuqh+lrf2u1ryVKY= zVXa)WBxE3jU!ob}xXaK^ABRG_#N}cpZFZ|vt=)g~Tp`d-2Ma~#cL^|e{(k^t_80HW zfTLi(p5peBCOMkE0lQA)mIQw~h9=jO)C#}vv5MHo;KOo=f6HHvp+@<){N;ZjDvw8@ z9?@Ps()Z~X3XuO9_c^*)>Zb74K;-Viz_Nt)CfIo)kW<=JFy&Is~}#OTHCLF#Ws;eO_oRJyDBZ6lXq-k>pjY)r^rwB)UbJ0zuMmQ z%b%r0if&gf&3a!3VF|hM1=$swb!0|AGbRg9BjGeMyWdv=2lnA@lCKV}(j2I{nc10H zJ&wh%_G~jV-FYbakE5y{2u_lc&AdY^3tKbvv>X2$)`NZ8$@a1I|Etg&os3iy?@@Hn zzX17jH5h3M9|*6d;_$K99&uYOA#T6h5@c~9X^Dly`)k*aN2$geU)Tcif$Iv}Y3Mt@ zWJa=`mj1BO((~(S={@}|qvnK7=7!D0eY=7FBc2T^6{nthY9nR?J+}KqCT{ zqs#XYbcb?fR^KXRTox+0fbIOga^JJPb)h2{Io7o3=7lV6ILm_2o8>$hD~j_p$>?DC z4>tlIQ;)fy2s@FA7{k7{9lSJ7FbC1x(*Y-M zp1B_jT(D%TU}<}MNZUOk05d9wv1E@I`&R7As7`CxEJKG&&e?2wS=+UN6V$`;Zsw27 z9#goUxP#z z#{Gd`(6Tyq6ZHzGt*ZkTlE8c}!wbYyqn4}DGSO&3yum$F0s9gN|HY=+KSVi8-EUMh zu`5wpIGc_HQ2Qp99bM+;-ZxfL5|~BZK=7Kmsy!kN&0tA8JsewCyeyc7DPU&DcFqkEF~3gj9mKLPU`i>K=Xp&YHR)V!2&e&Kc3`*mZ zR0*OdXCYhEtaFrO%g5GJkVKATF4?w(yhGBr>krB^qeO78U5uzXk{{aA{YH3> z(bfGuJGly+drJa2qOboXzOiq?N1(@Re{of4`0e}hQ?jgl?Q2-dH`x6}Y6U!b{zJSc z&0}=Gg`Ayz3;QS=FPzKx=KWN(gw1iq;kkP=tCs_B^P%hWMOKZRAtdip8i6c zfXhdE`vWYCsJ(WLW>61PD1Ff=E@IfzjJ=WUORfe`I6a^4C2SmUMV@uY-F*;C*Kqpv zYV_Ll3jX+M+cNF^+%BTY=AHeWbmm59v00`m_&;QYy zLL2hla5C9pX=a3uUU_#W{lAK8;t?L6atcx!<8vDwv)Q7dbJ!wfH`5(+Ne#zUkkD=S zLPFQ8PtTnK-9*#(%_KqF7x!_KfH_sT@5tvV73p~;e@@WiZ*@v8Ih_x+TVme=E$%(r z4Q>85E3qE-`%sfQ{iwSC4MM3=$(@Oh$S-@K=OwmG_kNVY?jyxLo4W1(X_);q;t133 z6n)x20l+;0IE~+qzZr;UBp|v^3*fD`)bvgOG$ZyFhfnSo+f3dghdo$k{4Ka~YTZvP ztWU>KN@J<-kHK)w}a;E*h|7EXMcLU$u1`GA!)I|UOH_MEk(cqaq#U7h*CGI%Z zA!;)Tjc$+cu=(uDV&<*??d<;u$8DK_XaDD!;mO3UiH6B3Mf-3VcC<00Qz}z;wWuE! zu!m$s6xpqmY^v#6v^iEJZjhcuE}0&2vOD|_>@6Y6F3o*XN{tnQTbjoK8@vyJ2t)iP z@)`ApoL5wj*+p5?yck{Pqp@o7F8yKknL>_$z~d{$nN=zly?gt|2{wC55UGFinDD?2 zT1KXiiT2nYSeRO_0OeR$JxqSVni9k{0e_~{^??=igXzIuAazrqIo3Z&Jd=f6#VnY3 zlNI*zFBB?|{9;>bDrU4hd<{~FGe{{IxeoebbDxyu-FR`w{D>m*<=kh=dhW4a@%rUE zDUB6&<4P5DSKX=js`2jL>qXT%cYD;B{;8R&QJd+7jjFUm!^J3)t!it0>HN+fH}!>X zp{DXk{ua)sKJ+!nd^gDOOb`zOvn19ShO7FMT`?MBJg6{2Zq zzl9-P9qW@~T&dl+rwI9pS*W|9q-jh{MNOlL8i|UwigdQ-k!c|OzY>kF7p=|jLaP+7 zR@02m?sRYdG3%6^YH}=NNnAh zU^l;dp-;+7lG)t;-}eZt7_`dL)-V8O1AVm9%t_bC=+hz{7dD^#T;Ur%$Colq zFy28VsL&&2P41cGPBfY5uEN_C&h5%}d_F+u){4)d1pY^Y549xwf8DC%Ni+MKhtZ$O{QgU=x4)1&E zivn5taxTB+zN^0|eOd3p@Oq+^e|u=Q(r{r|j{{@vP!w~FVQ1MYwSe>3BKEx+LyTg8; zV!w~KE8S1NL51)o)_?PTettbK!gi&*j1>3!E&Tk*R`$&*GRw!Y3jJ+nLNc~u60M|T zoQAupl}uV1f*dCK2^wb?!-tsLE>aireU5K|Mmj0qOSEGV3^ip)K3IH^N!@543Yopk(eon3vS!8%U``f*20_`%f z_y_7HFyjP?P9BH5^RWmpjgQ^TV0nxAN&eXV$vQ~iYk$Ff1m=xN0Uoa&bx<~iREdw0m?NqkG0~Q9DZ>cFhK_$R@yi<5}RY~bk-vX&ueM_6TEoU-2!Zp67cTU8; zp>t_YRrt<{zNL3j`=RRIRV7=Da%dxNNk$`6g;MI&Duy-N?e?Z2xL>~qLG=Qf`wL`2 z-_kNQx5@n@WCEj~@Frio>+4MKYqop8D5wV%35i|Fs{P|Q(?DcbBug9K(#*9!q2l7(vvd4C=wd%cU8T% z$?%#VS0`v$dtnd$w>(0ymft;Kn(fKJj{h%^pS}kp;GPAf!Z$0uG<5#_)4$ z8?K_Yrz10dilQPFp(vpGHtGnK#=cZ6^0W)&~*x1&4{ zy~n8Hsg z=wrlxW+H2A2C$ftO{S>?K46wqaPq*xEBr>Qa1V-JQW@osnxMs~GJ9hI?_A2*4{?xORbvLjNK!X)wy7qgorw!VAp6 zw5HbfNeoP5O-5p5aJ9}qLt46AEf&}qfA>)&0B(})?!AxwWwMH!P1Q1w(@=sjL_H|l z{n2$EF&mbw^&>Xymj>y+xdgaGFS7kI>~%lKLT?PTmHKlG>?vyt-%h`DK7WDu&H#VpSsF@Wm^al z;Gg{?2(+?rR5ZUo50gdJAJyGFDmt+Li0F7x^=hcPC#ip{=^9?AgP5xVocXPjUUN%~ zA|G1f-i%XtdDtng8WFB6B-w$un|X02Qm=@6S9#}&Iq`G@L*xy4iIO1HLgYI`-%Ek-C;Pqp*Zq!4i`ZAO^?rj$WPZn8$>=S-w!clm)1|8lv2|Z$q-j<=Etxf zA%35Vin@NdkFhv`#`}sCSdiLi{3)XQh*Tl(q58Q+(FIn}xNW3}&qi!um zrli)R>)6}a?368T$9N38iQWz4Sz+k=tFNPPV%KpPk>`=~ykBU3x1;YnA4yigE(F?^ zOQOfQ|9S_6y|xL39P*`o7A4XD#k@7PO#u*=_byT!RiYWQ)6hq15^3NWT zxrs0YnfEyv0HnWfy;^1Nf^;hROd-xKBD4CSuoIduyz}jb zEq^9-P83Ih^sU$!|LjTK?=8$AsNOwSxoUcLQO}lm!I> zn=B4pz{s2<@zyD=p8*A5j3Pf6cHNmjuw#XP4!_>ox| zaRQ`pAoc+}u^`tCKagvgW1*9J6?(olP{~HML18_G+lWIW$*g=gpQ~z?rqN5N-F*%1 zZ~gFBf0LX^1G8jwO($8#bsm0>>Ssc6m6usBije)u*Eg7%9lUP{JW?@-){KE32&GqpfFBdYDR+hOWmqpW9T6%8WW|x+`G$Bv76A~sn zB6A%Ra$O)H&R=b&WAF{8<5*3{4R$$UI&L)6@pfj=O-#r9ems2NE+;pPj1KJAZaL`% z{>+ME4)(2_w3qDOQu0}O-rn-?SWU>AG$F?_Ay@G-mI*ml6LNQX=kJ;c`Jv__6Y`|1 z3CE$##ntY0U)qTXMb(J6n}uXMYl+BgqIQ?LOu;kELV{X=DR_ZhMBKxy9-1;|h!!cX zx{@%YyU3NJuixmx=J#Wr4Gn*iVdEq?5J}5-?_$aX!UF=~t2rbb$Pw(wtU%{dSjR|n z|KCJQKQQ#B49zir{qQQ4K3*6*MJIc(j9fRPx2BZV08RW8S1BAUFB$k}PAQ;&vr_ff zB4tY#yHBHr^-61PQWH^Y7l1&c7?5R&V|KKhD29 z9%cTCx}Xii?F(gb(cKBn%;0*q2iC^ZjpdJ)fLu_F`w~vtqrSn?yVhTrs^5vJ(8B}2 z6g?nbFOt^B9r<061n0YKex0@TO4C2AW{{ix)ME~O&}L$v^KL{5_7b`Z}I z<~O>Z_p;0uC~6PlIn>FGnQyie(L4Ro6Vc(5}3e5TK2ZmP>O+i^3y2=1X?ipRT`!XNEMJ>C4#!EIw}y~HIwnrR_Qoyc)j%|%XV z24?K%JCTQ5gfzy3{p5JFpB(hUBaGL=`;Bfba($N5c`VqxKFiJiwl~cpiv*QGB8^1D z&|E$FK2VJ_Q@y|wv=|bmCz}WeA;&#?WP7Sp?{Z@IpG<$Zmw;&HbQtN`z*C^)KA{7-pf!Cq@5Ug~vs<)Xa&H*XzB@75(|Q{q+kSLRiS`%N z4?iaXzVBcI9?M_@K6Q}Z>xUnHiZf&1{AWx9jfjkVTt9rLl54vZZAMjmrZhlk=#USt zh6_NYj&UqN=j-9!uc7|2H?Q!kfP@ie_PO2V8UZQfMxLvHY8o33)^(4LZVlg~H+1jO zdk9F3#;j<^f_~nf|0c%zk^f|@{h{G|ekIiPVpxdG6WY1YoykEmc$GDGk_4=kKwepU zq#3%6y?&f}#M)nu^mq^J!Du*cc$qN6!3BncH4?&&yZZeyw{eEBf45J>$YONXx&3#V zfyLV2G{AlOYOmV(6O56@r*5VPKNo*oPK!DHjbG{vf#q*=qHtjl#?qLBDo)R6e@XC- z!We#I7500uBDEk(Gckww3RBNXY`$w&ir^LS=Dr%Pz$_|lpVQd5V^-US6*nu zbTjSyzWNZ;9)h`(r7!RIFgSTkL@qg1j|~TFdpIxA82y_QXQ5?H(|Lt4frhyl9Y-+V zZ?Oc8-KO!mWu3<#4MQ|}-Vmb5Hq;$47_D5$ICMwTua|#LF=gC0zD#ewKv_CDV(^yO zZCN@wo2Hl<<_xD?*SoulB)SrDMW=hMJR3?$x+*%I@0W>`vohhWXyRPT`AGMm9@=A! z-EeX3FT=LhRf(`eiY5&`Z6Wny%pK9NVKuFA(rljzj(K5d55XLp*_sU~ox2lrrW6h* z&o7<3>o5&Sz#t^I!VIl*!plt)qCMB6d^m8GFDpBf&_ffpa}7r&0gfiTd%$@W^fvcklbk#^QW+lwyt6x z+zg#wlM8KG*lv#MGwWiwlO1%o;Yz&Lyz=Ppf89>LFhe+tgd~4wT3(M)$`)V4IFj+D zNXbn}sq>ldu|ksUfhClH$w+9M>75BeV?>S#M1$zK(177kg-eo-5%b3#D{LP&6NR@3o-Gh19OwNEGB}W0< zOAQ45kLf%UoV@lkwR!`A*`n!Z_JN=1EK2y9`2{RR{gtCwAlmq}9sRF*OFe-BOslXWQyVqWR0$%KBYR6|x)MIYDMc%A$ zMILToLnc%TJa?Up@YI9-?k_%4cp}6a_e}y<)0hsjmmQ6_hn-MsTYQYVJ|6rGH)Y$j6+!z*MW7jE8Fr3{vjXK;NUuNRcLsYX&aFb zpI_CaX|d~iZ(pv+hmV@HgizDg*+l>9hj03cx^^ymG~*_lC*m#ix+T1USLT@^!9uSm zz*RThr8m+Ci|;nb_Q``^ENFB)8SesRIe`>%oFQ8xQzmdyNla@Dkg;KPQXwif?v3tu z>4f%q9>K%%h~tfqxHJ+@pk(aiTDGa?{u8AJ!utb5wsTxIG#GxveN_ulVhudLP3_+k z{U-|b_hbv-fIP_(Hhr?J9_#LC*^7d$heUTgBSWh*;yoN}bCreV=?cQ@X8RAW$-+}A zQk@$|r*D>OghOVfyX!6(7foZeH7Uscy$r&*^W1aX5?^k{qr$u!T)Xk4V$gg6!6(g} z=!4gOg2tHk*P_I_o{)1{7)nR3&&589Mrk!<;ucW38#Im53ymTfPa703>zENbSED^4 z`A*3cB-u3H6SbZAH-SH~8OB$m#ZwMvpW#ix@J8&@*83XRwSzDM;T{m?5ZS>kXMq`k zRH7oRs_q_)bPc9bWiuDdXcyGtl&tYBc#h1zB{!PhfZ!W*W>b0ID#AFl1_)6ZIz|G=KwNCm63kl_>!SrOybh4D3?AE|4hx^- z$1aiNa6skwR&FBLzW;F^dX7*39oh+c8v*urFze z{e;nNhbv=m&*{OK?9zkHOsHUFOs-6S4UyImchJbg{AlFe1zrUZxiY{cm}H5nr0CC* zgGKY_U4lc{9LTAEd#N$*59l%(9a4Wt@N$N?{H%dRL9JvQB5V#4CmKwZm#kCt>rKHS z&Cc9rLpRN_&ZXMEricK->xsxroJ7duT?>p8@73ketFhZ!Zz$v_6|67MTW2T)hOK3i zQI^kc^XD{%t?B+!vr7zY*%h?&L68W~8_3%)=y@B;OIoI0L%Tb+!UV3w&ON|ADu=cO zqX8O0C{*=mb0F^k&J{F5hVX=nCao!$x5hcN)yX?Re+-|Y4aZ~MefW+}DUJV{{w9hA zX0Fn$G>2BPa$;95gLUFRg;_Ox^FJlY3ldw;Q!4R@_V#Z?zVj?9v7g%8 zl*+Lvo9%HKS>dDEOjIUeH#TX9*&ANNERACXoA_RfQmyZ}y9b-RnZzE_&Ly6%n3YXM z2V|JSr>$xjgbj1$NHm;g15LSF_5)e=u)E ziVdgbmlGq2ilI=M3u5hNDvn;9<*o;K@(7#VyKjC7m?odD;~28lSlyOKvx{VhTj^C2 z2)#lS+L9+Ksc`B7&B+Q+8k3frnv8tsXrB1pk)@LKjrvgno0_1RLZ>MvA&Xr}m0 zC9xuLG1IAFWS;F*b0E~55k&Dsjll?^YfkJ7^4T$A2a^{T60HKaZZ;=hGr36i_`987tDVe^&Y{(Ie#r#6 ze)zBjW`1D`(w=HzrR-AqS5I=PCQpA(k|9kjRgEv#H!vAqewwCQ>X=Acv!ZnoLK^nt zb~{^htUSUNH@uDhV}{ct@|hyx#h;iVTFFu1`n7B)CWfNEMGrACE&>uS7QX{H|BdG* z=EEbFbl!tnaaa9~oe!Di90i;(4ORh4{w)V<>MVhZ@XPZ3*m1)Bp{4SOffhjQg76

--8m6T=5|~Ag$@zv~^4m z<_FQ6H_q879OTBIRWpgd!TsaN<|Jj9DSiSWBJSt1ex%kGnffDs)S-V-b)2rI=ucaV z9N$QM+4tGVapCO{(=O~qXmn%>BG*RN*-WXin`2#wMD$H7}COttU*T_Jf+?l0*BsiYGO%dAr0-m(k!Xb%ZIWH z-`3a|hz{Jw-4rOmTK#oFE)ZdXBq1B)r0bdjks@cy=SJK;l3agv+njYJW7U=W&{=)7 z3T)Xe(a-6(!^vai+ZxZqnB3X2mzCQH66RJqFQESWPU{=S<7{8Yz6seL)gYg@7i5`1 zIvHyxna>gvKkWYLhgO;`@B|x^3~MDfTS9`#N9NGAuQH&Z$SJHAT&5Pg3~B-Eolo#A zI$)fkw9%T9!%eFDxNl$z~-b4&FZv zX43ZUc)@bn)wDNbZ?{uB%ZftZ z(kU3)Zml`H(Kqii&3T5qKsL6R>rO95_-`#;<|jSiD?1#&9FjLmlPc&To1j@>pH1~V z&1nW6QgBq{h_TY-aO{Y0DS%`FoDKhk&TCJL-s}(UX{suDf7;5b@RUNN2m=t4hs&zU zO4ig(3<^ecOe(f)(Ses?@n*$Mu+AJ-x}Z<`p7yn(tozQ}=;mbTi~eQ@EY&b0w`E9z6|G64+u~0;wFLf5;4t^YjS64w zhg&w)e3z}PVU3Lm-Z0*Ft#PmB1k`JHPO{yj8Ium=;ho08HfSg`0f*dK7)jxOGAMLVL={`&F1NT$q0n-%;`xhOU zGz*iB_c*t3HhWGzcficQl?v_pG2Q~*y#b)cQ*SSUKHT4uDpRa;xa&p@LIyONLuZN_ zg&YW<7fqu7wdEH+P5GYc_|ufPV{PrHX%&sW@3(yKq3`#2-wSR1$GAI+?=zC$Z}+|z zd+Xb8Y0jxs;y(MB`u7`tx~fhZG*Rn+Q*EvegVxMFlRn`Omj0`2S&pwr;Ai~ybmB)- zlrP_q6QJ?VOZO_7=+3nDKedog0Kot6X$yR^hadZWzrG{1;s3yQx4{BDJ4!0*Ia;Hk zLe`w@-o6)Q{_PC3*FVlasCqZ;Tqj5tR8svQ?wbohfCxe_WYWVN_OF|5xNT#!qv%-)h(N>B0+n%yK^YxIJja z{4ORy5b+N}uT&z{fo8-1N~UM{7CfuLIkZ-csTQmJC7l#LxO3?ym!JLQ1=y3)M zwl5g@mAYrpXZ1tDl3yA8q0m4xCf1&9WM;EZG)EI|zl*#HqYE8F;1pk_bznb-L-upWhou6M1 zvXFm|iR;w;il6&!CF6ThNj@LF`TZ8nil!gSCDoX1?IodY!)Di~Uz5G#OqEh8dNt3(o!GSzKpK=-6_;! z`fHd4w*vR8YOFu-Ijn6IOv{7Z$!E6bJh74! z7Oi$PZhA#vI2o-B#QzTWQba*6%!~J0)Q1Ii4Oh|Z#Tx~J{3>JWr@ke{jl{ADeKIE) zby7urU8}Q=Y8PWLq|h%q7d6ES&Oe=`TOo@=yXOSL zuOV!saSgOKQ=4QvV-}g&0_;6qs~W2}27S*Ux3!i`(*-S@Gb7v}^nM{+4dGtV8!^4! z+ZiSq;F7-~TQEJ=mh~(q$$1DoTtT`$umywW{Sr{4H>Uh5s_$4Fz*W|^JuBCAxwmuX*&DqY3mUtw0^CxEA%ZHV6Eh~ zeB!jesVKL?qQD_ABd>d^xV6BEJ#5yCFJq17?+3*?EZfKq0O+hmR5iELhS!4K3{(MjiH!8naVE8L9o1jn%=0WCsL~ zX+-RKE>+r$8ZK7N8Yyk4BzPPv-`42m{hh%BTqc6M+1|Y`{URPw-$c2*Og$vPH9kd$ zxV`q7b?tXU_#}ZM?S}G>8v1!NmI+$S{9LSPU4|~VgYQ%VG?#{ULYGtwUG8k7OEkti zgPCg;W~XcQ>$JhH|9Q03%#`NjOlep@?Xz#M7M0r_2;?2i+}xO;AfgzvRc}RwLVR4} z*Hphvja`Me{kdavzB zNpf1J1;!#Ew=;1@#{UI)(e$!Aunrh=3uCMXVwga@nY4nGg^TuONH!+NfllO(K5y0? z)FSRGx`%%2KZqacTW}>j%4-7wbx!Kv=_3oBTF2h5dSX(2+gMdnO@P*2%-H&4=^$n8 z{B={(z!m>Eh&9hr@izQfa~k~n)x82tDmvdem<0lxhy%X)8^|5G6LA|niH-H7%Gplm^{a><|QGi;)WGX*z~m5_eVxEIXy9nwjGCBO~dZDVotytB#~ z!aPG7lV2HD2L6`M9p6g_nf?3Njr$dC?NsXb*SDtEVrOIAE^aPRa%BOrhY@NF^nrpt z4d@0o@x55ICqPBMXW&cGzGu%ih9S-UtJaoQsmrEwiRSkGiZ0RI-tOD!e3S?^AF%9@ zaeJ*8TJwEjBsbD`S|@tGs&lxa(tHY6ROzo#2`QLaq!Ja;o}Qc)d+odidQP7=)7by) z7+_6;{WLnuG+KrXM$$&)IZ&8fI}a%ek#RoFc-<`d6Msp9+43BE%_O{>%<-{JcLFGXG;Ni$xDkp*gBDk0=q+ zGnHe~Ioe>-990WR7dD#wki;pBi}Et{p++ZilO4Qh`lh?E&0X)F+g}4l3Bx}<|LLi> zC5SxI_xmX#noCxt>Q4{ifdwiz?G5ct<@g2L&XkmwM4OIp1ed3Avo8I~b+?|O_CibO zO4xp&JXV0Lurmewu!K)Jgdpn}Z_FlL${^v#yf{GvU+QKt!c!#^c9YOfssh zP8^MDjhj(U>@pVe6NWXJV8{2Jw()g@=t|m|CA2}cenYj9zSXVgq-eh4%X3hN5v#Qk zE5@2mtk)OK5e-CUZ7akHX6+q=Irvyx^R7hcLP_>0X2vk*|XJ4*9#2)!5fqv_)p zF$+r}16tp$IXEtg7fHxGj-1fG|v4C-wy(5B?R~0{ZQxQ_=JvFQnPs z=&Qbh(|x$Z_uK0qpPo6k&3A#Mhlh5Ukr_ox7s%Dl?_GLqR)OqP42VgpChTOLjj z^T#->10#zQn`1vS-?Bd8n^B!?u-~%XU3}qu;C}6oEP&>pk;y1|K3ba~ez$+JYlR(` zZbRd?e>EV{>)&MGk_<~(c7BJB;D0rW@9G|V{Ju~B9M7F4Y2C1B>WNL!0M5DUhd()E zu(6%rfee!Fo|Da7v_ z{|lK-HA)aZi6;lvwo;bq*7h8beDK&gDVt)N8KGV9nf1%{ZH32YIIY(q6JtR0;W$x$ zhI{rPPyZuPC_VNe*^A(Vtnb80YtVUa{qUB%5`9`9@9AFOhfW~(GAw@e?R$b+fw1S^ zHNbYSqOE(~6Wwc6Jj6u*h*LS#>tHn zX1jexF=I(7COGm#N-DPM!eQ5@rZBIwjgJc*o^#9K6!&*mrD{AiR_hOBsQuFJ*Qf+Pg@kraoLfZIqwXx8)@#oiQ$>bILNHqqgUsZDT zQ1*Guis_I;EIPPpZOK7q;)%@4iRJUN3FySUH@geTD{Q_#+wWhxeV9 zAYDzzhqFYwGPHqiVah0O-B)rf(N1h5+W&M;e$A9r2dBG1Epv<>TLCRNSX?~V9D9QO z4yV+XCOt3kCpgz^R9iCK>ADz+(iyQICFAxc7GTStnn87f|5k-&PE7I5*NJ+h=RXgf zlfsRsk*SrK7j}!@)w*ydPw~v~hK1KwhVjp?VO71JSu}N`uthng-Uz z{&Fy)o@$;aU-B=jN-kS=9P&PFni* z9r#Dn*Zcv>=wt9dtci&TVoF+OvlL!DH*zT!6`$+1tA+A109U%>da?H&b7Eg?``0k* zlH-Fo>G+nMX7$JZ`Rq?$pe9;3`S0hXa0Zt?6$1W5;LT|6}b<;G-;(#{UUqARyxe$Y2!FfI$*)F{rqS7)>DP z1Oogww1>guwrL2*)yKe;79N-*L6km2eksnP`OtK|!_ zVtR{PXq$d>ka_y>11dAbF_tKg%#(QZ6-qBM{UXEx5SmG-&^4kZ$1uznZ}LgK zt|kgasz%{&eKmd8YF;N&PK>Uqi|>|ww~chH06D+*Vj7dM1B}khD{B7HWNFquC*ZTj9wDqc`kGYiZ(g%V#6Cmdgn>f`m0TE|ThB*xWY;K)rs}^*0qe}R9 z0jEdMN_fX~qZu-^-GL0Ft9UUjwfRnFMJkqU`g5SzJWPqvsO|8GuXVbBq34A!Qcjj> zIK*woFZt)Kir@_ogFAag_gk1&X**_b$I=HhBiKDp<$g-|pAbd-|Ae(b%E|y0PyTM{ zGyV`C;ba7OC{6yr$vj{LF*IDP0Oo6yd_UoSOJ4b2>Q#^j4D<->=v!#QH3urdoa+NY(sR5;?Y>=;luF&t20&pw{POEo}jz@!uLN z!jGdM0<_}1aEru+xOEM0kdx$HuEch;IQQm{lc16n{s`(0%5u|iqj#1>P;breT$>#X zKa)RE!kp{S)V-h?tDKA~z>gug?uP7kwH(>sJ!mWAYtbFJ((I(D3;gT)?jE@r@nQz+ zZZlhA#1@WO;K<3{6=c)}g+!vwDNrzO6}TkY*6~|^eGOyL@{g@GhnbUa0x8$l^E00} zX_U=aR%EsY;h)rOy_R@yel<_iK~hD$f4haTr9RMZmr+bMO$9C_l^x$R?D(E~l{=En zm2Oh03hmnp8!ndYaGbw5G=i@03kRQ!9~0M4DHLG99G7y>t|8$NPicwDA7s8O>ZjGN6jYJD3or&Y@2FPmp;rAb6yH|I(SCJYlvB5d6ZB>?)^Cs`SA z3IvY_E{y!&3k+Gn5LciTIR~}gLW{)-7TzEKNMQ^{kNG}q;b|+tqO`)&=T?b{cwau1 zuG0Bwotsoz2mG;&3gS0Sh*$klH$JF9MK4^q-UMV8)c!pS(6Mt)%u2H%nBqlk?1FpNV-8^Q-ps zZ+^a~^K4Hq_}upNUD7b{e z;FNeTe<}ggNqX5#v+V4vOXD?O<;KSQ7&YB`Gf4Pj72Rtt2WHC`YWAMsl+?%_!Yv&B z1=i5(C{4QAOiwAz#AND;cxw}|E+p0jq{O=@(L6?O^O^K_24QtGnLy?K1@EzasCuy! zcg3?_kEypn`Wt}skw;?0m+SPRBw_{S?3|gs!m9HLH7MpoSrrI7CtMWBe zI{$Yp9d0;7WXy49%?w4sDPL0ee5w0yMcPBS8Dn0zJ#qPXwLPcii0XP; z*%j4CrHJZycK(DalpFZOx2%Tvn-DOWn%q-*h)Au&8Ila7DHqzZ`SP42IUWljP-+xCrOf*o2-i>zFCO zWBYupXoBHjK7z8OgZmS6*uh?U3$X&(c=o9y7CtAxh;34Nz8G|vrnPFspq@2 zhlD*;cJ+hV<#l`7)%2(TcODSwZhg!q>tT}4qCq~{iEZG)BiYW(Ik9FoML1VE?Rb{^kjYKqy<~J zY&~E|zQ-T=5#&@knQw5E;Ofu&$x(tzd&IyW`cgU@d<5lifeeP?@_KF+lDsR#$^{X3 z)=~_z@gW}epr#x?uM_u!)ohau$s)Nk>}Z5f>>VyZD8vITmIJHQe8D}XRlezy;q~v< zU`BzGAJc;kXFEq?TMTFAFiah=W2cBaxV(|hW!iL_LqbbDEHHKJfVGsKbScIXMBH9M zS=jzd5qM#25HDDHL8qwFnUP!Ber7)BTrfSLek+hXTQ{@j{xfG0LwbD3{tAIW6vwfv zY>C2T#1Y?eXS&WmwHqw{OH=rd=vJ;1iYk(xfU>uk!!EWemy09>T~Khkwp`32qph<= z&8zM*z(%n-Yq017^}J&xyi3MQAsT9SNTNaoWv2fEmQFTBWPu<{C^Z)nvfCBzro}h7 z)w1&O&YEB03>JOLhqav$%{!ucEBSC*pmwW#M5n$LV0!PR#_$h*&>t<5n?S9O-ivG|E1tD!`Tz&IAo4Lw2~sZ&7v|?`f0WF znpwtZ3@)%(S_&>hw(z>z_`l}I0k*U*e7&&{&_K>ppL2b;W2 z6r){=fA;xsA?pZAWoxD+WH8%pDn3>!EnC9priD4Tfi|ffI;pNE;m)o^v11 zk>MTDs;~yN-n3o{iFk*z@|5n*TQ-n@mqZLzHKKX#F|Vhk3{@F?)vljIyr)c;XYFw@ z)RH0EP`SUwSmn^M?Oi0y-X0Yw$h-IPOc@(+x*yIwmY9Y4jl^)A^?N>L{+m7$UR{L_ zq>ga8T5r%!G3VXL{b)?5RpC#>-j<;vv?(JeVL*hXoj{$v~GZxtMUh~hssv@gd$_c9$?dVj#BvZ;vwR4yL;J z7<==7+E+HWo<6eokHevd+)rdncFc?q{Q8)a|FIJaw=|J@V_7NM)q_iWlWFOyrKAC z&N@YUYU1i)xw7RdgwI6GX@v5^>fC6oxH1BLlJ%TK)))00!%gvw&bhfZef#R%@VU9= ztIK3R(i57I%lVfY%&fsDZVp)N+(&Rd_pj8+2o(O*x>`;*0=*i>RWr0aByL&AK{ts1 z*qO-MG;2&Uudpl`#FuFi(pww~B|k|>Y%Lke;>l%rO_D{MB?hQKuDYqC5+ZHj#`)je zfBho^4^Ps3w0x6%{hU{K{kpZLkUD>NW3tZ4@~J>tkusI|87$#F!bPTYz7LTLCo&md zS7Gl`g8ypv8p`UC51WE^^v%gCcT|E9-clY8i!kw1%w_h=LibE$5${uCBz+QJX6qxY z#!l|u0sXT49LEpvMF*R)Gd_}@LtC3F^rXC7{vu})T>g?Lnf2DXCW@C2E?J%0=*lcG z^3hq`6GT)P^UgA{kDJ=#B}Qs%uw?Jlj%v}0L{j(-eIdRK*l9S`8GL=Pz!Topy#MIt zFOSOD-@Lz_v+N^^XxM2_?U(yU?I_%jrQMmE8#Yeu5{2z7_>_3Y7elFc_`O|Q2~wyD z>q#sGvPmK$kNBH{U~|p!Fg19IY=1#Q_~{8heIH49vLV$?j{Cr@IOhm=s*d!UB>?=*-4iAkNsEi_@u@k@ zKNlpz`sox%Xh$9;vZ$=sQ4oJA(iicmh2i;1*$5FCo~4#h7T(7EK$C;CC11}v53_Eh zm1m>~rgjztCso2WcjUo@cE~Qxj-pU$A4s0|)hys#h6J9sqlo3r4g{5dn~v=Aj0_(m zCozy?vh_5RUOU?s2b7qO1Gx+Jgs6_Pw5BJmP5ceBpuKp|1@Cxa6wfrj< zES4E|(q-I0RmpIVLs_Q+uRg(EQTNN6cOs)l?m=25wgp!pD6y}e9mwO5i4#3jq zb99vpiTZPj%uXw`WLz)fqWMUZ?jGTphybgOHnu7d$Qs-dC z2Uxiu!HlZT>UwkJ89_(yL=wytVwJBNk$183gY~>>ilugxRe)eHRV}WIO}>VySS_MX5!1UhXj!Y>#TdHSeNxK|u4@(Be(*CK#lf0e1V`cDC zBE6{ofYz8L`()ATu9>vcf-<32Gd_n1LXtf1pf$NuJid_~sreu^xz5()fUeg7w`N7s zxN4~x{iAl(E0-bed0y(n&xh%*uV8?*zJB8A;TxbpANK40xn$&+VxT&{XO-}5N% zdb#mt#$;4)Cr@nW;WBc_kp17bX7y6(Jd_-V)DAX}+af;qGrbNWHSL%DI|+{G@834R z>bCIPqKsV%E0eyk2t+^hGS_VC@CeBvp|)7C^!Y@Rf95fM(C9o=j%&Hrwb81Eb^eAM ziLPpR)!#6c7boz{=zLr{*9wD))^vhWz0af2VcgqX84lR$6P_Hy(gck#w>ot?K5>6>mYGEEdc!4

1EFQt}a&XZz9>cjE^hc!%?7-!kCUOOjV)>kVi%hGzp8tRPjbpUx}oW=(Ph| zFZ$y}t>Uw9UzeIwf1>&ijiUOB`J&Y7Kl~lFJx*%7?0>ZSkKai^4+&UIKx*~3#L}u? znL1vTe_R}|J4%@Dr^DjW1y=+kIqieirpo$YToddKzbk2;TBvF|=)zh#E3xS=?JY;Q zp|vCmTuhEkt4eIPR?QBznDgCLcE znzMhTUI@I{a)EhQL!H-#WtoKHhyAR;7>@h8`0GESza$?G6kZKR%VZpvi2iVE?FrHX_^r$! z%vxhiKUxqfEgHr!v%0`CO=14Ys*Xm%hRw@=(7B>k41AO}&;6rp@lZ9h_9~6)UP+YB z7{zW>(2Sa(Q8||oCFfk3AA7oy1!jTGw>9YIQ~EUfB$RUV%mOl-`Q!O{!~*|J><2~e zG(GMCoe^*6g#_pj^%9^Yb^zuFn4iG>ttnh5Ng`rjlTD0Op_Cly_QUM$%!nA0Mo$4p zwc~;P^cC6mEX}gvQltFm0JGYA?cifQ6@vWL-m7_)s8H#drGi+FX9q?RW)9B~jU3)Q z&ZV;6Aq2Ue#ymSt4~DaKM<><~OBMksOS8aXq~Tg7?$lT-Zl25i{qeipHFJg7$#M6~ ztX`zqcM_VLi1&q>e1^(%U8KJ!zuYppCv|arpAm^|;yd!-Aco_8Mczu@oia=pM_5gM zI+0B;)~9BOG$ibMh6JI~$f;6uaZJCEZ;c*ik@_-qR%e-8+0Kwd@sYrNhoM{xS2K!P&fq0} zZKmBdYiPQGBW3gRKVq~|+_v^zLDIbzSj2Y?7Y4r6k77-ufIuyx>B8Be(y1w61|+~N z_ysUqEST%l!Cc5ehL`#anBFcJO($UdDPUgSA8*Y~zW_#bR%}V=-OWZw8jE@v|Sq7CanZeZviyg1*GW&(CG@u_Re=d#@lmA z3K;Z12kD|NDTU*4$6)g3)vWCQHG@`)4`ZC6=t$_V{_S zUTgt%P6yNy1CYu&PcFA;({uvpFU3i;otFS}WeS*s_s@M6(EXk?#GQ}XmmNPr7m%hC zKqsdFitUTHCxfe$e{PuGWx<@14rbWXfD!95v+a4?9!)1;-u!j4J@pAN4`2cIb6}zt z%%;}tRBq7calj}UTbOL6gf{FJ}&jg_Iwty^aM=rN)r_lnsG9A!@r{eAD>H^Yq z0;u)mWP6@rW5kld$K8_car>tYpgIdEqYa=(0L1);e7npdPSXjXJ5m6hl>jt51(1%P zb}|ygV#&5=x&?F3{xrmW_+-326h@&1{S0My(yiMWHcXQBnP?#HzDypGR~m()%BwJsn{CxCvhfGmH@ zNr1T|12GthKZRucYSq#3UqS`4g7)>W& z3KUGdf41(5x2N(K00k|e{^@}3$6D_tU3G3)V%wwX1kg(-Cec=t0P_X9i#R`U`=?Ed z$}FJfeQAh0uMR-Evop~Jr0E3E`6+-7NdO9`0MhFYNf~-xf?pdjAwzFyHP?Yt8Q$(;DS(_dILSrs)Jsqk@U|&yWP5wd|?H5vT2G z1E|0PnwJjfi<=;)O8y!Cy&Jy)iHar>tYpgaqxcRHZ!<^xD?YhLq= zZIPxEKuZQC5qDJrP^T0?2WwBR1@ru#G{jAK05Hl%|KNhrbOPq=6fl_yFpv6v4sEi} z9`T-^4x{T0zz|Yn{j~3CY0P;f6A;^rk}bKPofS(0XQzVjA@Ev+ss0acjmOCO`PsHL z+jpn6=F>Sq(qVd=!dYn338>iuD(VW?gA=e~UD`CK&8(1R;nb(YIdnR3bd(No;b=O6 zb9hRV)N&r1in6^KsuOR=wVfsV1M$T7LFzq zIDb1%u!0F#H5;_p-zGp^_Y0t8Q=3kF^t&{qUHBrPjv>m7b|Gmxfpoe;a@T)sf!G!u zkpkx6^u68!Do+P=<+A`%YBB$?P11A%X!C$%M>`2X%Q#~6bMw_23+BCV)7q1t05jVK zqv-_9H7Q{76JRcE3#JW2Y_edcq=T9D4y{o&z!5GOO($To6ikBtzlbPa8l_SU~rGlZLogHv&jK&;?yU znoaP;=DiMa{_=}<|V+M(~O{LpfeZfIMxC%D^dU!~!p9FHOv4^tks=&qAiNbUY0wTsI~fkgEd zWyZ6aZZk03L1M zhVa_7U?Ko6P6v>U6HGgXye@!=3Sej7WD6c+XT_pu^e+Gy2Y?^{o7RGhngF0$(T5gW z6pd2=x2FIYkpQr}-OslGYX|SW=>R6n#H(CjmA3tJSzCH*O-q&|s~vfYw&tm6N6 zt)+D3FEU_p-zoME$iL}ut`R1yqI3@d!hj8GUv^X|ayLO1@*5`wE&87HB+z$kdO?r; zIo|HqA5LlaOMO5em)Ig@%7#kp81`XKI*e^2*)DmIaz}={$0M!1I2STU0;63xRpCGf zQj_WPxqZnLF!I25cn6#aTRGgJuE4&ui7Q6@k@rDYRfN-g0IKk3pD^6t^+cYNvw4|< zORDV2dGeMgZ(J7NbxKj)3;ER~_S7yFd*m^^%Fd6W?4a|4mV*Pr{5-OoD#(*8s6-0=(gGrURnua-ZQf|192Ckg73|HKj7 z_=6nI=6*d)a4mdWAHj{ZRjCDFr57y^fd6>=oM9mYgV!Qp=Cuz2% z!PV_4f&IZ@Sv)*HVc)WoH17T{_fHQ25Em4^DX55V>as1YW@Tz%R+G;e1={%z3C-T$ ziRFfG6YpYo&>?hP_GPu#2GN5`F}1^%a=ZkwNP&0e$}ksWu$NuNOLk>=iX`VMz3`MgjyM#^-ZuAq%^>BlVw^;8P_t{^DmE0b zFHX7PnhnL60Bp$PrtPPDxu;`p<;4WJ3^}?iOL{62Sb8KTbe%f06E1e1tD7z(*nG=) z5dvHKy1RKC+_eqi5QpzMw~8Gewj7bb#lI3?G+ppy)aw&St&!WFb<4JF=F2UpLB*`I z7Tu2Z!BIZrC-$(d`PwCG0eBD-0&BkZGF$ah5w&k9b!jKd@%_-Vz=MyLzA|QfU-6*_ zH}GrK)gE;a2|`Q6kHZ%hyJWg!J7JWST~i(nbc2Faatc1zY)bk#>W( z%WimBq}MAXUnVv-DMw1KyUz9i8EuX9=5JxT_i6RiEJSV}Ws*`%)CtT7FTlH&oJ`8_ zMfs*$*Xctwk>cexa0TC*zFN|6QZ`hPurslxTmPJID08R&&ZKNiDvQG3#`;^ay`s5T z+RrdPDZFd$b=iz0#y1>5Y)NV7Vrq!{**S7?1((!>_QP4eqclo62_w@bV$d_L3gh$X z@FZATMvCgKb&8gavaA}2W{2EK4$(O zyy8x+NNOYuWt<${fN5}*pqe_D!Haem>8*rgsfTc;iG1C_RW!)kv5wNLO7Q`0>n=zg zgI)7(=Da224=b-JCnk%ny|Ygbr!~Bc1*ncQNJznVK|4<3YQ_K}VZfrcjY^1#4muED zik8@5@Jow(_#3uT2f+gM@2~YgY^2kN(`xYdeeX+SssDHy8yguuBDxH`3M~&hOgIZS zZ&mEh<&r3os&z0yd)Pi#Fs$@GfFtECPYxhV*V)pneZ`w@Jr-RGvxN8hKI}n>y|o47 zgv82V-drPj4s-5phl2or{RC3NV8w^b%;r4$zPZ?3M-3~(Co;28!(rJiLnVzICEq~% zS^}IMVVpLxZDVh9zOt6#7V!?t?56x_5hrnw|E2g^>~`eDO*kk%I;ZDaoB#J-!{^iO zlaM0T|62wsDJsK<#NMKe=`$%*SBwEE)SZd0_(+6}VJpRhgr}wF0WRaxIINrxTWpP+ zE@Y+aGQahT%KH3|^m(tVgq)whL%(s>BTu9ujTc`e806#SCg)Z+xj(T#r?x-+8z*hK4K-)8n2`6d*EV&Y{mJfD(mFY~ z)%lilqZ=i%bKUiqAqJgJ`JvL!Vg7tHLL1V{bTt?HVqR!wTnc75pE*D%)(FH%V0Dhn z4Rs2?WP`tcCTt&c79ErCX$kSp9kX&-Zf#C*_6&PbZfCtHmxKIG%rvf2wq!*OGKIi$ za4sn}!$(Uwq3g4#NRGaql0CU|3j!!r*L28>QUghg^B+&$^@nx$H$2;(AV_v1p0`h! zuxk~5CmTu#n-IFbhzon)rAh8Zycsnemjx*x=3ORiG3a1S52u?X*U8p@LWqCK4Ts_J znr;Z|*QlJG&DL>wW-v0USf-Kj9M4aLj^yJoTq1qNiHxjiLl{(57vqjDpIhF8!PxQq zmcouwb zTa#0M!O#t59S`K^VZ-vT1hX^tZ24$<27XGoW^+Gr9iN8;n4K7Wn-t>NL!eE8GY7u#?X zRsb@5kPPE5RZivx@rn=_5joW_#~$=V6&6zmC zpcWn_jCwtOms*RcTMIiH>+|oDZwPFRRQW#l1I*!J%l%+D)aO5;ANBcL z{m#rc(SQ9^Q%nHXW1{<6N|CWnGsxKvfKD{m5xlIAgt0EuI696=*IP4OmSJKYS{dem zAii%Qus^ejV$S%Xy~q3kp2qorgBP0rQ-vOVutF=P(69GVXcu9WpZ|E!imsR7h_Cv$ zvYf->86*BI*%dly<)5oKNaeS&xofVF%0F}sR2p87|2+y_CTeYbTFA{J5%1$wk~5ni zZSW6hWX$b*$umjvM7+QG6s}!Pw6&j+0 zqC(ot%xULvn4ip|7l02P!B^AHzO-Dz!M6DM{@Z}!t^tBvMP49WkK7bx1d8vG=dw3NA0R)TWLMa#JLk!5%WvjN`=AZG)`TcWlPU07p^BPoL>Bnyz?=vjMf)0}^Q&wR!(%Ov) zceYftQe0j-i)7xC0}DY8EO2k7;}kLd5+0OC;d|U^;s5PgiCz1R|Kc^@__MvezVGh& z#(#l#7R68S4_xEF6Vg$o)OhMm`+vzls-=&YQtDq<`uQkfcRnZJ?}Rc858NwaUR8r} zmtdz*>A$li+Me;D?lKdPhh8&kOYmbH5cSzij==lA87B9$h)C@Z7QPxR>9ybplzaC! zvpiYL>Q8IQ%&1SF6vQT8uxM57j#s&(3gUUOTzwjmv*0MTzvBEl~5!W|P!yex*@gbM%W7u4PeN3SQOdIAxr zAXVX=w6Ej@fBi<#=R7YtxP8li%St|jI7E|y%kqWaipZI*(TcD-d65gcy4SrZSNegU znyldJGqOL}%Nc6t4pAKl|GQiiYm13Tm)%*A?XPr}NTm7i>$;W}&A!A3SI?1P`NISM z4r(v{R-cehN)SdQij*deekKtv6_W;KNTdioVC*FEh}ftZtNui4x2M0Ii1 z1Yex;B*HW8(R7@FyIfWRQ8Jl5&q&OC{WzGn{QtiK9_p(*vB9P1nT=I z279LSwW81&-?6|d%+SRWDJo+7hTADA#~j0EkSfilF!|mjK{7K;N}!k#utQ2k=$PIj z>P@o%NVN47mRYtd5BU?=;|Ts8iHt#k)P}#yA!S`)dRLMHycUaHg={vlh^p2SBHkVDdi5hI z5Pci+5F2Lt5nn=6?fz}6EwHPD8Qx~8V1{>vJR;uZ`2E&q?)^ub+L){&2-9-Ti0>GZ zvxS7xPW%9j_nqCI_HmyY!f0|m`iu^Jx#sgEbLC&8xuQSjDqdKyb@KpvP5bwRhZ#y3ie z$`Hrs(bhU)NAfDzy^nZP{9zjm1;=}Hd|*-L;{j;xk@DA|rynO_8NNTrBjQ~_F;c`D z1>tHB*1I3tbzAhqO(7I_&EstVN$V$fvy8@!o^JWrePnYQrIt9;iiV@|Chb2q?o^|u zTil<9h{@yNj@+;pe?!KxVKqJ}{k0Fl?XR5CYmE*O^jnvSz>!)(vZT*m$O)NaaTg8U0p}D+C7uSO`O)xgy`U z3^|C?*A!__<-@C7`H<}kyCi1qz&e(e7jffaZYAE$DxK-9%qHbR*=ywxE=Y!e*kj;O z@JOdDtE#YxvDX0vS2^vf!ro6i3;p1v!+SksYMy1tA<7gZrjDR9VvX@CDEwj_jli14 z%XrWew9!V0%e;d|-(9Z;!;KO|Js+T8=7$##C^9V|#Xs6#VP6W!`bQIj8_E(Vb*dgX zxxFVgI=H%SHzXl{f*<925QfY0go(raCJOVSeM25S$e20JZ^sPrJ!|Ex^~C-CJm`8W znZ=#Jn5>lhH3FybReL5o@K1K2OYl}S$O#-pScT*5$)mhv{j>nFPDklF?|dFyQTrSP zDf4J~An|q=Z-bCa{PiD$A!*)oho;L2XJ6aiv&y@eQZrV2-{WE~`6FTAWYveVfwjtt zDS5*GwhDu`&cT8aH73i+H&uUY(_HqBq@bFf0`LqMpy^w~06w|`+X>-)^Sr+&4HDDN zsJZIBHU$J7JNZDa-t(!Nx(Z!ATc&g`)eDvG=8iQrSY9B#VjgAVLk(iQwTDU##i#2} z%~<zOl=IXlAh4NB+nfRDo<*oh!a)_bf!#^2~Z1heeR(byFIu*OM;jIu2ds2VW zJt@`hna87!|nkWsB3?v&8xy%7r=V zO(dpZKW+k>YL`nP1*_1eSeFe8{z^>`=3ip!LHIYLive1Oe)FQA=ifsp^_Tc}{Qg^- zIT`L>BbT<0U`jfl4!db7kfbHqsOj}1{vM;HLs5*%&I|GJgofv ze|7(@==xmzXGfhz83my|nYHKpmoz@Xdt~(2b$i=QJv}n|OP=W3oyIZ{5E~I{j@9kS zoQCkO0d}$Pl;@eg;)6}6Fe{?ztFHE$)l!0V=7XYwlC_U?J3UuEE^0oVVee;Vyl+iO zA1^`>V)yT7&`hO6b}Rs@a8!pqAFmKsUmmfJ5K|X!pAK^8>dm-W zCSq`v#N#&zx~U#?UF-=7;bwTQMV2?L zrnpj0N{~I(*QHyXUfX4{R`RYt^rL)JsXQw6rUW{fxOJAHdVwwf1z^6Y5fqW|AIjZ+ z{*b7*DeEqcJ!z9vATP0h`=&p%koZvPjy*CDFmAi-Gq13frF-&cG1gAnN73W8BI~A1 z;QeggL#0iUUKD>d`2{hi&?7gPo5`l%nipfT@JSokqib176@%e7TR6Dh>h#Jad&VZb zWpKAyV3P;6B_jGQJm((nzqQF7ZJ#u$e#&g+X*SEx2Kjl7pQ!okgTlWkO!=38&Tmrs zkNVw6S&8=fuHdWYc+*YMRLdSg;J1VX2L#5*BOLgHJe-Rvk9iN2bLH&z#l}4?%qKJ=)qACEpvM>QdfVvJE0IB7tGw%{)?T z3>`v(L-UZ2X8b|=Ug*pj%_!Pf`*F(vL9?d-J7*jTQN)N1rDFbKT&7e8&{p z!wLMAXNqd3gX&UNGzKn|OWTmu5LuC6o}r~tGY3U++U%rDJ1CcBHa96zaLO{zPWe{W z=|W*18H!PnYE=Kr{)mV>tmMRG4Z-XNuZTUGAbyROQ)js>JKCgCMyuvf;CF~{)JWhv zS}xMuT~Y?B3aNv9-=}4|;b8>4tNzla>WDz}A^s}aER-B9fA~Bvzps20>4zIA*^g_R zU4a2))lGf)1-4s9Buyjwq>lWBN^jz_IL410l(TZ@3GA~-N32$X(4|S1-d7C^+ z0?i!cLq@u1y{q6j{LgJL8Z{H%Y!d{xgf#4izFG4&T*KqQCy3uz;~k5BK&S}ZkB(Ew}*T{vvT!rut5k`M#G&#QO#h z)qa@2|6QaN@B0!yz`KfvyCKj-=q~-#9RRfd7mHIPZ-^S$%h<}nICZxlr>1@!kAWpI zb)^sQ>&x)y(CV#}Tq3f*Oo-W41Viu+(zbY?mylN$aW}BUKO|qj9t=Z?c&qFCdCXNS z!C%B%zf(r7MXPzPH_M>`idMvMLUE>Se~3FAG_s)o>T(j+ry9*f&KKxdOZ&(ah9m+^-Nr{ z*Xvy?{Cby3)~hvsFyaCT+x73FHl%DSamQ#r-KA)5c-^*I2L8An5Q7pqi zzHC@d*xuJehYKFfoL6OtpG5^c{+s8sP?5c;Cpjr8dr@C=To1~u&o5Re75T@a3gsG( zuG6#3<2f=*djGsf$$QsV5D~kfOP5^n$A5bN_3Js-CcOJn*`vi~3dirL+&fR<1mW(S zndfQJg!y=QQ*hVE5Eo7YPwK}1l3?Mtm}%wuLj$vYu{s~2Z5|tq~4ofz!UoFF7t=C_=j%pRZt_25){`KHqjf z8|~*C?q`%wOwcCFg&2h^f)QxKUUvh74ZmY{iFRLJu_3A80;PWM9*9XZxtqmXDqg_f zz9Xss5{<(%8BJ3Oyk6C|%>Q(K`&mqYZk+SNYg$uw$<~lo_b2`Jm#M&HhpFi-WktMW z_J9kj?J;)?g!5eJ)!HzdTlJ5HB1>)Vs(B`N1HGy%y^K75nSV`BGDbn*ZAjA~XrVp= zx62~~ca~1zR(Xxwn?HtqnE)V}dzZK$?=}UNAM7$tJs?%slkYLAu~8&io4L zrgnk3z9;AzEC?WGi*`U$VtC2so__wjj*uBxlPBlKxzq{((gLkGWA4`dFkn+>}|;(T;bu zh@8zPN2*jL_;S22s}$<{)%ReyxrLbd`FR@S>yr|cYl99;3CgxX=V_5PW0nND#e3v^ zy!YYnC>Lnee4536ZQ7QOPz!vT`Bg7JWqOd<5yB!P-VxFeWeA76u>#y2XJd~`#O^!X zVqWTD4z;oO%QzN+nD%dVNpG;!O`)TvyufTbX=&n#Ei$K?}EaNVH$ld_$;-$j=(O z%zVOIsMIh+WZd92gJ;T~&Zr{)k_B>eS>(djXye`TR>x-Vp(?4|%DrbMf_+G+bU(S` z_SHAPO+C%quhH>^a*>JedFC;O-DCRbb=;@&HTYNZXlN2U2u4`dYV2IQvg5grYpp8V zN9BeV?veU%#E`K+IiwQni!Qmq|Y zWZ-`NT$sNUG{H|w@8+BH51>i40KI1O&G>j+#PXi(b^eKO`O|VM_^|pdR+CacDFwEH z?zUd1BmuOBu%MG+rpc*E(&%@nnPsw@Mig|eO?S!qnJ?4nuYF4|U4FZ)&FTc0-1_V( zn~LGIcP+=GRTwF_wT&<$63u{J$5>5m=ik|l`lI3jdoF@i$&!rPI8O6PRlDwgks{u4$n1 zk44W4m7*DKdv6;u0`d_WA%DZ~nU>?5-~Rg1e8o4wqbS#+i8L3 zfbcI32Vvufb)}QppE^ruR(EwqbB+5=GLOn%sC1kbg?{8I;r*tY7IdQM6~~ZH!sIWC zktI9RX*U5%7-KYk@}buwUv^{u6atBO$Kppt7|)nxN0M8QF%H^ko-L!6>?cH9ZxRNn zud=s2rZQYjN$1IxOe2a$I$;s0LZv@`L@Tv_{Pn{4|7F00H<;Jwg8_JZKNSA#gh^(v)KkZ(baR2Z5_fPm zCbU$FZC8uBftX^sRisfZI#<^zDy4VLR@x+c&Z6y>Y-7aCI5AejcT0DP+O%7IfFy5& z?!WiUp(UyCr|%6H2}7zJ*b z8QmGdqN*c5m)m5;awZS0BKrAK<~l)dmN{g;407IDn&bP6{y9^qq|4vR;(J&!nZVpZ zrHZl3bkh9q5DQH%C~~4&F&bBMnpoD=9L;Zgj)qD1>Q3GAjspDf(~$8$=FJV%1y&}3 zLO(5Q6A=Qd*j~5%S*i2^d$o1T)Xvghf2$;;+688wS5`I^GG()oqdP8`G}Wrq^AFam zrlpr1vAI#kMV@R-ohqlH*apc)d3hfN$sg00k<~5How(TPK7!=x+rh8ulDF4uJTd~Z z{zdefnV*drSRP5NaCIiZ=HuRaCzI4!#rzYr&VsH?(k+uP;UD`3gRzia-xBf8jM5_m zh%ptX(j&@W!Z5|D=}a+Y3bym_&17-=2LpTAt5W<*{+`=}{^a%t-=zO&duj_E-}{Jv zPGBp)CF`c4PWM&uiqt%k2U1`kVG5pDH~UDnWVVb~c4kY~&+>79?`)?hD(Ele)7_%} zHwA1_ViNevslTNs;rl5yx39MTk!1aImkO(37CMKjh+$jn8pn6CRJ6H9uDrlfTsoJ2 z&9U-pJ0R#^ac&u#Ew|%-?1a(WXaxeg@eheqT&NQQ*1pC4#QE=R&0iJ6~b( z^IdZOofIma@m@bqJAcFL!tKM}OK7Xec!G%$+Wf(*KL!g-&)gp*M^zdy*aCh2xfk=~ zj@E5VUaT3n(cQA{36m*Q`pv&(;%2t>UCXz5=suaY4`JDJF`x2B%+Z^rT)7$53G~!= zCPvV7q!8#h6WuDQV3n@n0m+CLlvW8jm$5~P0~My;P-&jlfzzj3%n{6&u|qNEkA$j$ zWaiy&?GeVr?GYsJICI&oW=MgVcAi1Ug$I|QOahy!0qJMu}ky;L)WtKKi z?^ihAi)uiX9z$I?L9<1u=Ua&fEc0L8L@lDJ2A?KnZuT0R{iQ_q_KECwOZI1oH)qSw zJQVciVVk_moz(hx>S1zz?e&=BZD^nNgv#`%{3na#Q;CQ*8NZF+*)Ao1k;I=*M9amD zbZaMB#Bn7W#SG_tYnzaah#`)5z55O!cwckh^LSt5zUP{MaMKvbd{|hH$dkyALnvR` zU2UGUn11jJFoa6o9X~zY_#!jNa-wj0{5~dZ$zNc)+W5R=?WKRVy757Ct&QLEqubNA z|CYP)%>Ooidq$%5I=jE~ezuvOcDNCW^m>;~2lHK# zS6V*(0Wuep*@One7X))zW@(5xnvm7<#(HP=LFdzy^=LvzQ_F#b;YGrN9Uh?hcnHqL3E*3 zMZ}Uaw9@Tr&(L}gk$O)JFr}^bK6V8_`O}C#L_ifH~Q0y8_ z{Om?}S`nqxl`iAeQ**>B?-TL@`Q6Vm?w-Tf*VP-<6R7nYOZjo52*D<+fi5ta@?ukd zl|Yt|G&?I4Iq#Uumbm>dr#WhOn89!_jKKzepiJz0PYK7$6;J#abIk!owfw_`Oqp=3j^A+evj{E@bK6|An zGsE+uuw*8kq!vGquNg(b(8{vbH){W*g3+2;Ao)nKH|YTgyg6_p)q{_RXF27Mz5Dxg z8-Mg%M`jUbz}GiXUW%`NMl`ei;hQ@z{SYXaI`FZTqp;?&R z-K(QGTMz_mR1+0qW6KrG-Py@CH+NGk`+1Ks_m*dAL&KcrUW@e4)vuw_5nB2uLFWQ% z-?i^99eJ@0+<%}^GKIf^^44tA7@5MC^C^D{=uwGl03-VKclkQZf?doz2Q62Z=SgCg zbMSwGj9Zb>dHDZ?0zEY!0Xfe!Sg7bv)`v=;(+Ghpd!Xiu1l)7^ls|aNcjFx<;C1EZeZExMtw;VVsb z>W61X?!3BNNZfL2DunxuHC^O5jwfc%M`8al)wilc5q+dDmGl#j&=T;b}f$S~|p-;A{%$*d>au-?j&-80Wf=BuRR>=tZQB&XZiIPw}kL(N5JGOZL?MtE%MHsU_vBDvDYM61G3~cS+V82Y5w88*@5TVI9G8 zn_D@X_sWIR!ARx_RfQ|n{(U(+(`JeMJjoB9hN{AEYHd0z{Rc}{&pbT>I7 zaC~(I`;hAfZAE?&DP80bYtI~eglB_f^)0!d*)Q<$)G-zeR2kf=#Z-O-a zh{qMhxF~IX-Sm#0+B2lv#tAkj3Y*TAE9#@=R>#Z@peL*qZPeWuo4`Sp3T}`N_=ci`YUW8B<=m(1i z&w@m9*sLdL)|RvBwsPk-(Y94YMzltUhaGv3s(yM8JUp&`^Vi4tO6sTI=L^bSdJgoF zC-m`X|8)9z5B#ZgYY91)E~U_k*+FMg7B`w>KpQN4mkH^H!B_}S{*?^04AJujAz1v& z(bEVo!OW<=p?XeN$9F@A0#9r6++Z1}u-DGQ3B?weRj}lPX=tj-?Bt4R6i4;9R2J@* zZVCg58P88)cqEmf9uMF}Ecreb~mE z{~F_f!M2{kMkk0ZTWJ(Sv_Hi!@AG^V?EP-=B{It&`s-c6PH!rc+`~)~-%fs0aE`N& z^}*(kODmVz#H~kH_I|grlU(79nt8{LD$L>H6Gnu2jwxa#f_ZqK{=WJXU1a+wWq&ER zZGDS3`5TsN-w2pNtx*4yr;r)h8~5qwPDzRcSGlJpTH<8Pg&R+;H)HxWKh zb=r$hewWL%z=>1(Z)`uW$4;71k@=Gx5adjySX0RY8vCE!8LE!JG@!{G`mIL)^cFcSS3G-#i zDnv>v>mFwPjG(Z4nAAkWMzj1Fe3uqqdbbq6m8*_LL9`Nbn>Dk_>GDBzxU)b?w)<=4 zT+m$G4eweDo*=9|wBqaXy1kvJ7F3q3neuylIjj|#H+z(m(`25Eh$q2A#FO!;aF?da z)~47a*uSrvazd!|8Jn)k$ysm0$#hlWF6+4|w}sOlFv06_DDWyhnTNQP$zHHs|3*Qr zd3y@0l=TN-FYdnx>mlVYqOQAXy&%s!{zX}!BA+**Uw5+51ZBl=B7j?fjnZEHf~~*d zVwO=Gg3i-hXj*W<)9d9idsS;I3jXFVyRkqjgTD+OM1iwJHD915KW%L4kK_^gvrQfA zMoWA7CFO${1b5&ib`Q09`$AS=j&GGb!e0MaePr_pmEOMw)J650(yxd%ljo~O(Oy&P z`?ut1{s`X!kNV~9%flKD zf5P%lF5vd=m33fy?>_tZ!9Ki_Jk*3T)Ayn#T62!HJICqgDd4;F zQ<3A#BRgk6`JE7D`{H;xgD;{R-R=9kJQ!bj!H5hf-jEd#D9qEM$I_J>VL5Wp$HL!- znhExi6K*n3ShjKJCb&x`!F*8 zvI@#F{P(!gxn==UE;;-En`n_eEdIv2@pE9v5t2)_qje)7xz?Avi zXh{oXTK7vG&hH)P&n9-YSF4lNvQ5~DoKN0j52uWxPm~B|Z@-UBvX3u355Fc$c{I+? z7b!+)p_nJNtCL4buMw~H^-L=+>2(IrsYMLEmSvDB!d53vdW)4x%sXf!TvkL=i~~3q zK4@pl22i8zE9rHpwE83AF21^y2^y3^24W z!(ab7bqeikr!n`v(iewE#5jS+UuA=6)8rl{y&mCh>Y;_3%nG`Ilgw|E!3iwTc>hga z2&JUgT)zBs_7KBtF^`WzyyAV}pYySX1SSy@baLK!bKz}EjYGRRYYL0@ep^#vO zGct9YO@YimEWkH9%-UG{fj`IGb<+0~h>E!IFa&G#FT30#q43Ckh zZ=88zPv-(=y|LEsGTH9iN|4gl%u`EX_hRd5t!N0hv($tqqa6DTH(x* z5m}BuED_PsKemVU2>Is8s+e_^EN*2rUjercaQ++ly{9Pmg!VXL1u2EqUYHz8zgsuq z*>P)at*&?Lp4UmD_BtAL7@{uzgE2S|eH3jfFmKAfn~t~)B!H^?yj8O$J@2FvF}Q~` z`!KV5i}36!fzLq9k?7o{)q)9f+MkK1jOmA%yj426$b=*z5%1BW1nNq;TE7`RMLrB% z@iX$_)C=NsdocV>u=%rY!IE#M+1+kAzL~LuWmT7|$Q+L+6FCP3)wh_|qu^t~!f`kM z&`mDZHem==l`l;cb(PNb(tfr@MPYs}JLu6-$SmS*ZM~>PpHm^+e6e5{0YNwwR zz{LU}Lu*F7L?Tv*!k&5+(cT;|V)uUqcz^0&L5^T}o|aB|(4cP+L5}Z4e%r&O!@fe^ zv~&+IroB{OD{Qu0PUmit+4{ggcm2fV;`Z@$ro>0i7UuLpuzBCkeYL@RL|J!M^GcwJR^ZMkaT%Qt;8ynai~ z2csfKZmP_9wUW)BJjOx@na4BAIr6>e@Ok6MC-j5(f5$+wfj9v$rmnPf8O*x&h~dt7 zCYUnZoBUAYtB73Fet5}te?zuZikg>IMus7)z)Pd%2((v1!(~Cose?FT2pydg<%MjqI0lK2KSZWwN)}Rw#=02D)jR7-{IisQoLH7^nuRuV_t>#i0o=sf^P~x z$-IZR7ZdnMzlzLj@^vO(<`SF3{~bB9CC7#yUM!z4%^zq!e_som_#RPelRuTh1pYu# zLWHG=Oo~wc*3%aA-z%Bv)pBbd#ROM3c|Zp9huJz?Kg$HdoAzC|_*U{R@ymIlJczR? z<6KJm1Ye4_EEg-hpZ>GsYZj%)d8k<4ojXwk+)JxiR0qSWn5Ee?8MLu-*VmQ)e>RJE z_bO*tZdC^JkGOfqV<|jO2!vtrs;NBN_7fc-!I3j^t$(-hn}{b7-&L!R@tFS{MH=O> z=9GKIIZC1dQcSLSWqfKYq}Ov>4r>1;^8Icr-`~gVW*hNxop@%%@f!y>52HCj@x>S{ z8RW0OmxhY5Y-kxnTl7EvTS7d8p=BQVuD!0(xw(-yVQUwPg)intTb9a*@)8v57WcE* zz;+5g4hWM*PD=N)*hocWrYIA<1T9`zP4daTa#AJMU)J}Z|Mq5P+8(GZjtYjh*TKB) zFSIPvyv(6Jbhjc}HgE9Y<^AOFD)(E!4Pm6t;5%3L^Gpc(uU@5J3-}5;OU2j=7Up^a zeUlTHYrd)SAJ?o2MLl1FP_3b;=f6hL-<5ooa_AbO^;hkGQC_P2RjYJa zmjWx*wI~IWbx*Lpg~h>_u)f7Q2Q&0#WVo4KIJ~r@Rp$8V6RcoRUpD(k%2fw+x0vlV z00&;gj8j*-Y8BI*o=x8vJK9u^<7~RL+|~qIX5L{p+~R}{%i2z>>O|R?5u4@C-0RIr zS1^^sDFkh+W^1f4fdc2LYQa{+&Z&n)&S(waBwsP?4sXIeo$T*yos;XR$#Y~3XF~1~ zst{MD-Qw!}q%|$9sBNtxKF*pbXB;C0JWiT3F&GgerEq4xo!@8tzU}%Z-Vmoz*GLU( zL#4G#k|Y*%o=|qzhkYZL#8%fyi2T*~%)DpdT=6nOif@lU(u0cEEmdRIngOCq-L#;) z@`o80%SdWVPc4rjzFPhRw-fu~Mgm&a0D``$|0~bB(&JfQ#=9k8p1RoWmXyvA`?^GT zc;x)1xU?FV~)sba8&HwoBf9vf zs_*I_q&FVW-nf5dycHW`0h3QF6a^{0k=7TJq%VqPIr#2`gEpo3|FS8J)}QVPGwshJ zM=5_3K5st%oy*-hUo!;Pwm&^RS^rc$-MJ|nKlA+K!?^*JFn?sTn%{eo*Av_FQ$@)9 zHuXUNcTY3kL^bRBznhw(noan>qugKie@FS)pXDPSx^*n8N5T5=Q&K(_Av(m(Z*BSb zy^D`y$G7~Sa>xf~$o~4bg=2#lW>1Vmqh|5^16YPcil=dV0HYq^J_nhd9m=4i=O7S+ zOC@&^OSzuG7m=LgkNu|2oR|3WH0Fo7PwGzTYa4}oP@G*50@-7xW7n+C(VYLs+PTL^ zRb72Qfds-Oo!b;rKHz1zUSV(zGGi;Isioi-EIC0c10rm#C690 z+aj{Bc6&FPWeG>IsCn{oHfG{CoeBSYTKtbtLNt*oG(TzBU4WS-qntMIOL&W7M+Z;{ z0GT1UvEf)%3@MvP9`t`a!^%z+`#ac@rnPk^31EfRf{aPdYG+=1-@?a;tMp{CDbaWU zZ;Pz?V`L=W#WE~i6BoDS{tP_w9(h+qB;mF-D!2ZDo7&8_HE7s9J_!BQY`{DDVV?#B z=0NgU*zeJB*x>JtK5p5~*`VcYpKkfPMBe;-o?`{a^H-*ku4SXxD(3QLnuM3-fg=H} zNO|6|HNHPvC%L?)J!bobFNt^E^$^gHkJdQftbBMJqwxDsY_@Q5>agqEwvWE(BChuz zMjKR?Bb~%1@Uq}8@(@w++x%3-@@Mgr2)8YK%=C?1#A)PH6>{dls_3Ux(Vr+Kg?VXj zf}1hNnZh8rUe4r&_#@_1!OhQ&R;l?H5M}ciKH-w-@KX`Z59p2h25|5NiPCIFO>f^_ z%7`Dpy&P4EQG08FJP8{j-lwZcGgn={lt=q7LdaR(ZwBOMd<#*Mn>rp<9hXsunNeGf zc};LE?J<*!3b@aX zj8wX|mY8X%SngL6?saT>nX;=@OY~J9M_j>USMF8(HA>z2r}c!(vk2d5xEO}gE*iXv zuZ9NA)MQcA`}4;Jp=Hw$k$I78bIrK(l6U>v$zgta#CL~}zkx7h@VxOONrDp73;9jN z5=I<%+fvmD4nYB9$>$7v0t6@POw_bzT(_h;;u->;c1+dsSvX&~gra>bkdG zKan}pvrzl2O-*T7{;Ys*Uane_(D86w5R^3O@P5{@0ZlwbhVK1+0~ z1ycK}es8XyYzqHigGqj5FUeBtL!USJ>FmF?I`Sa1ZwX(CeNgJ4!0z^k$FXKR^1yq@m{D|i%l$E&Tm$Vi;9U(#G`Cg_6hwg z9#h0G4yM0oB+8RMe=PpcWDH}GIfc6SC(`0?=i~XmSY}l{>P32@y#bEq$F`lWjOh&8 zvO%i~i09vWw6d?`vXL&E?reF(_$*F8Y7*nNYw0RZI$9Oq?@@*JH_5M{7+aEw4k z6`D-~x~`t5wwi4CZa}$(&uj<1OB?tOc((JN&h9NmK_Yw8-RhkxNVsD<^lWm$H&3pJ z^(rrIsqZ6`OX}|xvB^1;vfEi7DoR^sq9VSsFtx?ry7zk~B#(`7?Jv;-vbasoOR!xA zXZHU2pAasuhzDLG<}_O2|taz(CL7VH_Ic?h# zJGML)9_aR7JYG}Z+rp%3YI$DMHmEk*QAwm8bbyB-#!O}=$r)sb@u=w=pr+&!rMI=5 zsZQ>YB{!a%qcA9i`Y@w+E}S=Gq&_-*erKH_v3hJ3mOej!qX&K7p_h2>!4(<$+~y}6 z`ux~Z-2u)^r|EO0pT1u`SWmhaevLo3*k-a%qjNzeZS2+EIdj8BhHaRVZ>%*9?~-HE z5aplRvs;@m!qBZ-(%s_zC);ULw#N2qYPwh6Xi{0y$3`TMx0USg=^&P4Ly{~jORS;$$cwER~sPd6|=zv1rU-m*dQlIl~woH1q9 z_Tyt8|3tRhoT4_TYg0X=VQzpkIa17^4tJWRsStfi6Z9*dp}fv};aGZ^KoBe*dlv5#frX zKs|=l;axyAQXQWLr|zeRQ?VutP{q^NgaX+qoS*C?oL}y^{@?f|*{1*D(w6xj$(tWv zql(zTK5l$qpUT*k2V`BNg&&oKx=v znBKQq`vv2{$(@C7^D*p9+K-j-v4xx!95}WsYz`u``YaH@W{48z2w<*&3>6u%PJ8$o zc1Q8wYLis3gr7+a`~uNIq39q;yV>Q=1FaP@$tLfRz7Yt!nwlEn6Lqc$bEz7011(Uq zf26(kEJ|i2X62O|Aue@F#ghEZc%DqcBAfnpY*Vkub5oEek@|krDpT@WlAY!RgclG$lqPeKLDUqz`qye@YVN^x$PUfNmS)p}X%>W*Lqp$t@4KD|u-N|hM@ zuM2)omsrCj?{X@EzIh&NoId5Uz@{!?e=A<91gA&dQ#30^se%2-7SR37%I2P|;iDl` z207ohvuVLERo|fTZpa@xYK(YcTZ)MQJQ~>sMpie3ZaYmEXsL{@hD&&(fhOmh^wRDP zJ(urH16q!aj?cf%gZM`Sg9KoXAq*<@-n zd8w5A^NND*n0;LIw;-(1SHtqTu<0`{95(zy?AkvmX6o^6Zw4L5NAc$%9m7T4ShulF z)R8l9P19hqKnd~^F%?kRV$(19`B~ZmUIawU7ElB-3m=09lRRd( z7bT36nMl+x`ew!ud3lQTF)hMAZ_zY37QXPBr9-E)(2$TpV)!%^m!_t(MNJTsy*Fx1 z#gc+0?8@a|u>o?jUytiaPODNmOuy2d=G(Brd3#ZGHf?j7BJ?1-+Ei}Q?Yg&oXjrhe zfEo7K9dMLM2< z7%rpvhBYz|W`0djdxB=h9xyx^_E?O$MsvlJ0O2+~XRRDUK#pEw7#seWF^u_(gVS`D zDz<#w&0dc)i1ULJOY&+z(SaV>qPIl{zNmEaiei&}n}#I>TI&*%!aQ zcZGh7e?n>aQy%;&`6s@ZUU*{*?B{{-w*+4;eLnhi%e^>%?H3cL`?k0j$V%_M1Jcm4 zE4VC{fAQm5Vk`K|B9gE9^X4Mop%libue^6)cTJ75QU>qrKeuhN*cWiKv9ZYwAljLX z88O{(Kz1WX-KKxT#%lc5 z{lHMLWoYwsAfVu;U;9Mv#(roLdvc{(CM`a2NGexY9PqiP)ATxgBSRn64;%VeX?ThB z!SUR0{|X}c?=rQj4{AE8OXx5Lm?q*mgOH)*IOKDS>uv_Yx#2_JriF~e^FBM20&4C( zgaZ0enH4@V`oB{_4qyJL*33=mmW#zgS;L<#YM^TQu2%wYE*My-4T(7tva63&GO*l! z;dph3PpQAL1g83hyIMPUg(EF_@*%mWT_+}2JJ0RRn)N|dd~jA(>{!89D<;l%aC}J< z5;w*vI>d;|(jl`8kv}U-ugR-tK6Y0|HzKq?c?Z)oxsq(-jW~PIJIH<>CUmYQdAy)C z#V`$T>IaG-Zt$2(<=>S6Jtxdc*_{Km5HL;)z>pW${+UBwcC6yGbHr(p)9GIFtKwl+ zgr%o>f>6K+n1WDH;z+Ug$BTMGS{*SAn^`0^nE-1ufcGD){C9RY|EUrDr>k~EGA%oV zdKKt31&jG*3I^a@$=M@)<$M5B@i&n>^30^}`RLEV!6A%4ysu>f*)V65hxr+wTE%ug z-0Jl%k8JO2{CZk9?2?znF}V9wM%Sf&i7$ouj$I^-_q%*5nUM;Y8JXZ}I!c)ib~HwA z^M>7Sp*UTmog)aswQX0s?`MPCCod8Fn79&T6z{(wIm16-3{KN0>fy3#;14IFni6-+ zp4gllIiksS<#o69lOU%XKA(Llhs{Fri%Omh#`R~H6xq?Y+$fLAH*PO)>Zlu|`TSpd zVqHsxF3g;ZMq|2ZDV}4lUI|G@*q|O6`Qy=igI_RP!-)-o7zZ}96S1gbu!Q(A|3^ra z`ODk?)={&*1(ex3&c$;tdkq=~;nBZ+dI*glj)& zA-_+lCEZkD@qa3$==Y(-{jC&}PIH+d&ugcH?7I`V$KiIIHTyJiA7W-##x5@mH?}sM z$kw2V8~Zp>J;8~50U3d^2&7krQpb|VC9#UT=_zrkzB9a#hT;ld)eu5C7<8C(TSM7T z9?<%496%yvLw>@`{F5u3WtW#!mA213foemFCkF{#;w;U{p47D3X_A12K-Nny%?s#% zVs}LzXEZMdp9^-Mf`?zPumlF&7U*JjJEeybUt(IqIJSh?a7?F$$+5w!$QV^}puBNA z2Z6FK#xc5=LNkE&`NDT2%aw23IXOOu%0{j&M{Dz;@%JYK_ z!sd$TJKn3r%9n!U1F~~>*CUEgTj#yGj0WPlOMU}>3H;tIxE~vo_qM`0Na}o^ByBal zu%G0b^>L+5PX3H!hCuvpKe^hcADce*=cF?|$bY1Juc$psQS?r%w#Hd{`OVnq>&82U zd2Z}7bIub8UcrUupZ|-3wfVEyc2;x}&Z9hl6QI`X-N*+&Fj%JbFt#wH?L+TNV4wEU zu9JtXmZ#kS7Phq*XG_)}Zy4|1rln?#zffGc5$fcvt?A)!d%+}aSeYLFWIu`FYk#uR zrYHY1Gk!lkJ${=$R`9XoC*6C+Huz6LC5Hyhnq_2r?{|8Q=eDW<^KX(uZd)7dv&)O~ zL8kEZ#UJt9tZn3zuHM`8F_hS5*u6IiD-V@yFJeF^EAb5y6T<(aE?h>V&zV1wb8hY zy?nBXC=wgINlLuqK>GfTJN9=83l8~-t4Pp0=`VJQSZ-**`}0d?p1$!@z+v$4 zm->K~xq&9Vg69ExwO=A=7M&Qm;QeNmt#+2WH;X6O)j;A12lfip>q2kEv!>>Xr>WU^ zOS-0Jl2~88m9z$=KluZxCN9*eerkIDZTf95lFm{B{`=`Z{tROorTl!URt90))x(P13xB8zWrp7aXsnGf`+cH&;oOtZzyXN*fo}Y1O*zjq`x;D0acms1 z1J(aX@9)o;flU^1<&q2g7p-{bn!Zam@e#(&?r>wEF8&_g3R~tv4Oax|xgu#`?_*x6 zrSK0QA>CkJv7cTd{J6k!)>DL+qI9pnpX%esT;|_fswQaK(2Eg(O55vj&~%FTSW_%Vzp?;57gyVF!+ltw1s}Y6}{>FS7 zb8j>&egc{7Rl^_b!Y}<+>#mbI@v23?sdvJ+Pn(5*xax=x=IkH~KenYB7s(~M9;bN< z3??S+t2iJ9BkysFc0E!H6quE@@x#RKP~Q2-lt#ozOBkn^Lb2*Xw{eweiAY?C7hfP= z7|xu%*Dt2X1_cEtYH4?MKHX<*YDr6bT0Xb2k!IcM;_XjP)005sds^C^rOyuSv9kNU zqQhLvYSwk&8*18Dm!p1Ksm#Q;m3!6w4-aL?z3F?@K1Sqh<}YmC#aA<7{!(y$kLNS= z9M3(sie=#}dd&WMrN^of&m9`#)9HNje#eJQco^Tm<}W1pGYQ+sU)DSd+AvaZ!Jo}D z=d|oO?iNvKToRD0Xo9g>CfMJHs49$(;T^++B$AX6aVjlYy4rb5D}r!&wiF%E;lx5K zMLxQP{-rkJ<>yoD)A7sErnJ;uagomHwLX*y0+CfUvb8dPZ61e8`c^p=t(E<9aC{=%Lgy@Y?d;u> zy-5npY)i3p)Ud|xw%f)gyR89q-Xm8WY5}}$oDVB4P=Vz2$UWWrg~Ok0|LedVA3uW) zWm^{-P9vwso+5`f4nq$SIPwuVt{T=u;NbkKI0;&E1n^O!QOia0BOkyz*o^MUY&V^y z5BAC$n9cU1!)f}hDYf4nl|?9HH=YpCoTW1tggQQUofkiYfsAQ`hg3KbR!Tfsa&LVD zPnOugr_9E)H5sItX*%H(eLeDFUuW58Ab9kEwTzT+++o?zY&C*H$&H6Yp(SH2|0{3W z<20X03Zg&ex5*3S<~p{icSn+j@vj2-w5k;ob=7?>C$rBUIN8nS;6(cN@rdFbNJulg zzkozR1fLF1*R{(3!f6uq8xm_`k!XSKq1JGgp#zm#vfry77dk+>PLqVwNZCEjG78Lr zId1;}Y(hdt?Cj{i){k>plAVQ*naT>DS6Y1VGiZSx|9ob7Y(R8f>*pu7?i!ZOZ*Fu` z>(1OUif@J)@OG;Dk+M(yEX^WW=dXYd%{G+`e0q1kQmawRma>fo*F>rrU$#*VK%fk; z$D?tw|-sdtO`n>dG`)t1N*Vy2?9sn@}-p;|Cl|t4H$AKh@MQ@R5C+ zc8?ruU?aX}xf@m`^Wgox3J|rkSM}cG$qwIJUXp7^o;>CVTD9ZvLsQ-3&xr-1>ovQ; zvGG6_X|>0qj^;|r8$0s4LOK4oOHjGzF^xL17PU`0x%T}gfvBxPN%|M7$vLgCGZi@) zSP|gWx#TU*gV*1jpmZTw2m@un34#}|Y#@X8TmA@lgRv`eVq>G5$LviYM5-6V=>{@RfvZ$JYSS_(6HL?ucPhc6Mkv#4}a?JfzvZ?isK zK=z)sWaKNa@k}3V7GX9VMLU@GZ~YsUr1_hMQ)0-q8wPG?q}7|LI%ylM zTuoLgp&!W4rZ~~z^a{*XT=#ZH?k&>FkCgX z@N21GWty<_)Qziep5AjT$%`}Nu<(DmyZ?chn^T%so0t3<-#D3W; zJAC6siQzgp-PV}qyo@KFd#O6Nsns|)tlZio#C(1!$ z+L6I~^w}?LB-LN)?W^i2aZv986o{sx3<9rD>?CAfb0<d0 zjPd;CXkT73+M9vnwcSAfBVQO8JOLshX*D+~caN9Npm>J)rV{+vSmuGHy%doA? zgT_}s-ya*aY_{*!C9#@f>j>6C>*MK!_vv}M8SEpWRvofA`LxkB+1(QFM-$BnA-645 z0;uS+i|KjnhJ}L^x_OaXsA!gM(EKfG3l%F58<_F*UUR0-dV7o06EQtQ-Rbq`74rLi z3>w&fon4>RKg{Jqo=Dl^x$2if%wDAZAiSq{B6YmUdMY2hzr17+#7LSZTJFuTuDsBa zI|GU@nzE>D7+E|w+w3S`^~#w!!@#`F+APHKy?TSsPwOX|kJKV`UTJTub#EY}Omf{=dP`yPi+~U5@r}0|?fYf^a9=$0mKWySGNS%5xA)W2@vC=V z+E)DRW1aJRf9Q_gXEo3=xe>cIYSLr*1LrXOu^l=#B}M(%4f|M0&gsKf0{u7rl26gi zeEclB!Pj4uZgLjlbHa$Qut@lZz|UDf8$0>9hs3@M7I0PkrM5@eN9-f7yQ!N&5> zjL<9@qMKWH<)-`BiG9%~=aI|?ksdx%0qSl z=h1kbzQzYWy>IjGk)@KO2=hTZQdSom{7gddvY%mvGOGi>UNKf$ulG&TprQZQ%Mks! zf-l}cJzb)wiTtsA%G*3Dm*I$r|JrRivm~tZ-3|79_iVO{hDaJe+An~yi)`FsH-z`6 zH-z|ue6|LMm{RhxIjnSEToaD$XNNYN50&xB6Ds2c$!AW^y2M#Fc;Y0Y<1IX)yx}01 zNqpbbxMq~XK}^H+ggvSq9a9#zbu?2Oz~9R3brnnchohgGy=psKRWy4nf*aqT)bv{2 z#q1AHs?7eO_I;7ED;CJ?GZ33tgWJ`#aSk8L(MeHvmGh^qn9#8DV=#JG^5IW%7)#^J z8WOA`^T45tfI(YCLCx)X^3eClRLNP1?fl~FwcwSLvnIyIEp%^tCyTnJgL5gj#iVln z92PWz{})KhvLL8G(y}bj_XX0jESRD{GqhlHchMCL5=?QLE?2v;pW0Ti2ReT;-rS}; z*^4y7hO%Ao0nM+|WRcf8(6gGb5ZyL3&peOEsjD)!XuQDE zlw};P&I>y)9-yVI8bG`9H?Gl`5()W|$1xaqV{^o>9`rr-eeh%(zmQ1TyR10b^EveQ zegE9az$lP^wT32C# zm^Oy%WP(yJkLNT@?rLhAPGys`A8eb!udoH=O$$J!YdN~u`w-97|Gi^?IfR8&8~|3@ea3G zWtLv^VEKPNUGmpA*l)pvenzYNBK3nyfQfTttskS+bsN8cZn4&mrvMt=z0&BC<|~W9 zlqTO+`>|9;MDvi!C~dK2f8K4eU4>c~Ypq;gAPW3qu_-&t2tV1{*C@^SPAu$#0ks@l z+#omNRNu;MFzsS&Ani`XY+_B*=-2iKoX9WeYE?X^wJH{9>RT1Nu{9Ka9=5B0Sydz7 z2)|&T_3}0)q^x_J|KAAj+fX%fYh`qBn_O}7c31Ta;4t5d=l&c<`n1YfzACj)3R{E| zb~bVk^@jfoM7RC>&Md9MBuI2Zh-4sgmkA=BTmEa^KDJmn$$PTQOsjzC{eox9V5g~O z$pEy$TIPK#=+B|E%+#y|Eq%$$jt~*;{Iz$_UyZs6%Xq$si33%PF3ycVC1S0Nm+!{l zzFU*$T#UW}jh?x+nL%yDAd>d{aD8ts=Y`$jwiW>{>{RS#`u1XA$aABHrkR}Y&eY`8 z_8Yt5Q`cGEk;2i4?V8s-yF5C0bvRC7s?XLkMZU zVS>A-VSn3YXqqz$a1Kk*d99Y9nJq)m4OE>bXz#RlBo(L*(7=_bT%CqRDh?LZu!yu7 z8aMdiJ$iw~2s-KA$Fs!TliIhsC&) z&`0aTr5l{@-$shg2|jGvc+f=rfH4%5&lsIG$&%IkBCGdO1aRR5dnHP~hfercm$S@o zpXDH-vS3iV`L+F!H%~ zAir^=sd6s?9e(cv*`T>!`#7gmb_rLE>x*N6!l`*vxvz1jvI}kv`jRq0MA-U8W5ELhA(i3ttn7pr~PdH&TGL%g|81%^2cI4?q*SuR>hFmQ(41e`x@ zM8GrLVTzGRa7y<)u7NQCG85%fD->3ZrW^|SOfZ@e9=SWbuS0}4r*h<)O6P@^a9gX0 z8MfDo_YBuG^d#nAeAf`O;d+(M@|M(T>cezP(*HP~30hik4|y~%wpmhPbB4Ud^QKfX za}9JKGC%gR=!F~H_~qH*u2qzqM7c^1kHmi{NI1`LDStjhMmq90m{4W(t#XXQ5Yfi} zu8Lo{7NTb-P#+PqHEeCGwIYaRR=)8j{-QF`F7(&PXmL_zwKOgpjC3b@J8DiJa z)5I?M`GT#YcfUHYQtcjss>!*4ob_Eam!W;{zs~C>`-ge%LH5%!3xOt}*t>3MPuh2u zrDqK};uo=|Ic5LZ*e+J`)YmKH&{u^MD4FC88q4ntj;{>56WKd3 zqfk$ULSj~L4(^DZfX=rRO|OjI4jo2XirHRNW^by@-d36YVO6$=Qr_@y*_Y=1O2V^< zTfDTv{MuvHT872T#5m`8GwwI;2S0xZ*-fr42EPtID%S@k4|>QZ&mmdVVAqFjCf&vd z@;?5N$ucjUh4pErpDu3bt+(md_eg)VM|mwtbKLB9Nw&(*qxYySQZ|oP5dnyQN&#;a zUA676OqeD|sY;j*`YXS}23~0Y23tNk+wZk^s-G@+kbZ$pZ_A|j?~$&Ks2+9XSevn+ zfr|R_&D-%41fc!wW3&x%RXR5V2>!BnZ%$5d-qYeMtm#0|UjnSyBFK`JRw2k!iMV9YRUAdT zXu}EB1LO<*!cX$*?=wJ*%JJkF)s@TGeE5=-szjvU`?!pgIo0ala^)$vh2}j-A>$d< z@d&jrPLulH4^5RH){|=H+ti#)>Lfq)38mK9)c5PsWk;J-AfoxViErOUqQS5J>gOw_ZL`zt?q{*O zX4<=0$?@E$RHGT(n-BNstM`COtsL@CKldS;24!h#_Fu~oZvog<|#cpjVx9U9`^ zOrxKcMx3*LYf}SRw%1lVE7x8YANZCr7x0#CqYml!TGS0yX6gw?_f$pK zRmJ*MjajARhQF_hzFIY=wUU_bkLd`*49S1fCF+8%qN((zh2C+zVT&XU4a__KU9&Xf zt5iXLc=H@l-VCch|BGFpNBHZr3TPvd$>lxbhg1rw(0DsmQlVbEM>2gC+n##w4KTgzub72xIY%m`);TKG__7c| zi+*c`#_=a(@nkk**tWCHO-z~y@4UA(2gqrPk2_|oIy6NB4bxR_?2lC#Ahm`}31{!- z8WZo=0=VFuNKQhcavNKf7mt@{ryl`^o(`+kvuI(?_ZY%ytI2smDKT^O5Y69JYBI5*nc~&0P)rP4RzqJaDUi_g=9xW>7aP=5n)yG)zpVeRuba@VI0046Zw*t0VIvl3 z-u9dxoyx85RIVo6ImGQm=2+t{AF%oH8D;%9KW^_h%XOpI1QLtBf)XQkjhw6J?&2vqsVl!@VuHC@zsT-WY*1gV6o#Y+$%w@`Z;~NPMtSx%#F+gdbp2$3j zz1eSC0qj#t=BYjN)RB4G!V?DQ?fMaNL}%2fsSjytnsdg^*~jSZPW$#o{TRNz6>@&O z1~-7uxX>uwNqV)8UJ^5G(BeF}2QI9b-g(f!NSUt9%mTr>zsXOzAM8bvCo*8{oP{@; zP*aQeL6H;GH77bk(3XkEmC#Y#MfaQA)w@=6RB9flD@1de0Ydy{bIUv@OZ#Do`yHno zQ-x-c5`I0Z*M3-6H+l&knO&7I^tx!VM+ZID8+v)A?&frUa0)NvkzeaCKqVNh39BrN z8U?FyEQIV#M59#R5mgd|a z`gPVE@=%jky~L!QFHy)YKOyvY5(?>0i8tu`Ci$f9WSEAx%}+1(_TaHi)qB26aqulI zKlth6y-u5c!u_PnR%hjlNB#6dZ>+6%eMtrLga5SUd)j2k{uCZOu=%r>bO_q1+-G!d9K5>cdzGqKj7l`Bf8B zk5H~1m&S7f%IKVG?pv$5RFr*_;RvsB5BXlFrd`QIYvr2_C$@+9@kDopA#WAwpqoR} zPS2!NEL}5ySh`)NDu27F!|Kinzbgn6Jqa7;>8HTqF{{jk1ywZwJu8E;YS;Z~l zh9`#Lh!fx?-kbMA^&R|y!8|duCx5yj?(>HdYRQkAzWbpgjr_IEGQ7Lfg}hTKuw14I z%U@R7^zjiYMY6{KpLFjPHD%`CCuc}^3Z!j7&T|dV2IxFj^V~p5k#{lAhE{nFazq70 zW3%H8@vEESRodpRzs+ZI-lO7rv{d7bwMi4wNk0Gc)2qEfHvPQ2DXNn!HvI-aotCA~ z)#h1Evtj)vTmosb~*V(|Ifn@MT^Qu!;&eFxllPi8jS7LEOPYv7#dMrz2Joo(@ z6dpAMe*Fwl)Z#27L!3&>O`*lC0_e~C`h25XbL}jZEn}5AIAQt6e^9s2{|lL6Pd$T6 zCwB7yYgoXU8AQ8X!P1TQd@oi|Sc^BohT5UAf@AHIiT! zY-My0mDHY$&ryjUkcZ7V0`*_-{bT)@oq_0xh|tyJ9=jgTVO{YS*`Mpge?^yK1#7Px zoz=B2x*^Pcn?&TWz7ZK`iR>@J%hQe$;jz0FbtKAP0<>?(H-ht+&Yw1DIBwLGEbUy- ziwn_WBfjCJs=@EFJRqds;20{r%pc3tB5zJNNyD z&xiJ9Q(M<)$X6>SBY~Hd&pmq2paK>1l2V6_ZK8HG>xnNBz5js zEdD&$jXxowOttE)@#(8>WWuXE`>1H6oIu8KM^L5Ulp7HbIHDxbH_=Omi*qE`YR~@) zAnJhUXrtP`$nMf9YcPxoIPMf#sS#(@o#++Q<8*oX<$tVtGFjc&50x=e_L$IIL7@L^ zpm*hPLGNt0En@01WhR0MNTUs9FMn$kRrf)gjMut%3G$A#H1O;38fnn%3|1lpWvvjz zy*_^wHzxu8-?rLsDkE%yMS5(Pw=O_o;Xu#O_m_1=mzY@V$DpS1W3B79)Yua3v*LFW z`~Dd{>6+uC#lAN^p}}HiI^?_h@N3Av$NV1C>&W>%Kg|jAgba+7jk^|DTfe>WDS`nBaIwV(?prZ$ zgrnM0X5bz%M>6!c=l;X1&hFX!GQ76I%Mp*X$6FtpKtkN54hYx zS2xsLwYIpOK^bg>6}Flsl>^4+YC7|wgXGi@^yAzcS71v>9QMA`7g$96GhH2usZy-Z z4?cY)yD1tM)PpM+i{$o znZoXw84%A98uOASv~3Gd@agQj%pDW|p3X`%Mudw;t^lPIb%P~AaLzZLJCZ)BLtHrM zjZ)Mui^hzyhg9UnzBm$I^6%_PbUmKU{7%cvuka4cbzQ+t`aSOkL6RQHEoK&nv{nH@ zV)MXYf?UyDO=!~^?r3(MOV(q#>%ybHag`Pl+%IOb8ls=+&_2^nxVq}?`j_9qRD^y| z)8e3LI+iFlKM$AaXUtZYpoAnoHD0f!@62S!`l&lctedZj7|f>hRa!BcZ*z$kd+*ZD z`fGFDcn_+ksG&i?#boqs0znQI;EYor&wvXwDv>+WDo|xRm}-G){dc zHQJ5?oQdaoggMdT-#6)`4?{4Hy^!}`fZR+ZtG=zOqy8?b4aaav^v8r@yl^T1cX2zq z`<>6q-0V#VWwf=GYkK*4*DaG8QirYCjkI)e3Q7Iq+IJm=Q7v?JD;c@Bv7Mh!fsp+n z-v1@QVfV}eBd6>J@+IQatJ4og-qPfO%mGnCp*OzH2<^X^4l(92Y_DyBmY0g6z%=4N z++`AxkKo&GoZ$|EH~~MEe=LyO93r z20xwqKULF5xQcmwZHL}g+PTwbR@S~y`>!%L;lX>2vq z%7<890zK^4bg_8MGU3?6W_K5R%FKz;*05*qG%DTJ9@w&Pr$LqMz1(SobltWJj>CMG z2i#KpAt!cl@&*aIu|Y^;uTw_g%l&bwcHY;OLmAhh3);ddcRuGoVL!Jcb81iDBK1Iv z_VlYF+u76aa{Hk*F<;RM*0fNAQRNJxn34DTN~PP9LYaD_34z|ioetgvcTsuaYO_Ao z|3`-R#dAmf2jG>Y;AKz1GvDyv!fB1;zc;OJP{W*F)9MB+H)Ao(V})k)rJ!Y*M?qsODg|6fz2M<3$f^N|Jonfo;f+uH~=p_O2S?a2_+ zlYncwLU$JU?SYQqWCb``G_kjlZ<*abHqpC(ra`S+X8EXP@o(5Y7FUrGDC`a7)%y)d z=&iEZKl}ZhQUevL67JuHib-n!;at_t#uKFFL>oGC@qn)4U z$#K+?vh_yd)nFN9adbmwgfMPKs0Hxp`@2W@O7}e3G2vf2!*sc|#vhcoWN!C>=>IS~ zq=`5BL-M}ur)xl@9~9U4jJfg#*&+2$56PE*ew!ivr}m{u{}gb>4$zM8H{Ihi_uHeY zv@3sROx#{EPmVP)tcUEdS~-r+(xq)V*a!F4Or2r}_0hHILH*@!J18>? zu4PZ(yCFTKACqdt2d3yWjpr1Nr`%R@{7fYEy&Z&+Gm?!EH+gnuNQX=! zGA0rK$_>z&bZ-kK=YLW7D@8zT5>veS@|J-2Z zA7oCXhYtyVFPgm0$eG^51Jn_;PTe;G^+)+|fBJH!`!km_4UOGz_6ye|$C%5Rh@XG- z4MRM)mu-KW&L5a%=Ke`ymbrVsF3~;zqKpJDT^ z8>-&?!I9A{2{*0#KbDX#7oNYW9!zykUx$1zuHRu^7+7+GyZo;{epqp)x3N$Z{NobF z6(2}st}ypkZgoel0|NQ?8BmXSSU;G9OV`aBDCwv)e+}8|5h|_oEk~dVE)`s|4P0{b z%u8T(kMw^`Ht9!*KmPvcp>FvHYZ|s`rx{{q5ByW1W8FYq2@{aa7?3vI>-}&&}cv zjBxb0aP(4yIU|)+=Yh7dErU2;ON3G%m$j*rmZre`C|;FUOkr~+&{dQy4M;6{+`L5ZE~B>6j-bR(-L*3M9Qu;MG$Tp z_0j8>DY2P5sX2kHua<++=6$chZi32J{$FW!d45$5|}6XOQO0hmU7^ zv3rl-i&Qkj<4pT^`t3tVAcER&CVqu@V{yZr;aRm6=3rgnn$U2z(d;3pJd59ee$8f} zt?@BE^DkjGE?p$LadNW$d}28_M?Jm!78_kMtX>Tn{}bXLr$KXPPrj4xpj}^vuw46n zoT8#Lj4@=6db%y*LrU?AO5HrCc{7+VY4EKx#jXOl#6i)m^?71pub6L`Q)+k%VR6CM z1fj20uU#l-Mpo^Kbo7Ho8a^&4;5+}DxYTY}XYv`1&|8fA{v_wxF7D?XhZm0oQxhyH z1XiIer7DykTyn}5YS7rVW4p$FhJPZ?GT!%Y(UuqY{q$shh4^JF2IXVDrX{*MlnZ&9 zYH@{!eBP@6|dNw@*|EK9h^O=0{c088GY}2iP7x=_SB{Rf;!T;pSFI8_^`TaB>w+tgJ zH2BZvM!g5;M-YC|dlP!33wb`~dcRUEI@0q}FQzf|=)V?!ks;Ig8`SI>8Xrj;hQ_7% zFqk`mYzgl++5)IZ3VocwDgeN6@&^JsZAP4h+ZnqVu%T8^PQ}yPt6p6lXhfU;B#416 zBwR5E{9P`UKo90|mF9ZbSk(xS%`ZYiFv!Ux8)!^uKBQOK-5nzvU`kRCd-(R8?gsPK0SY zO~*q)1oT%1iXg3=`zF35LY(bICZRgOfqg05v<6DQu6 z1Ag4$PsU(x>>n+)-=m|?lB)VRx~hrdDX1BtCaK_QvczcZR6Fg8sleVrjhrIygk3p@ zv%{-#<1;bpTbRpqF!kxu)&GajE>UH^>>i=OHa11iP5JX=wv_5dp*1Ofl9{#)v6=Zh z&xZ}d2O9m@^#~%9>Hgik>jZ?fEvKFD4Pp_odb8|aw2r(h{n`ceKD8oK-{B9Iet+6c zzXllN1&k1puUv2LRIP8he~`=;%l}XFQ}B@a8S!)dWN!r&PSaIXA;1MKl<5=UjDV3V()i;ddQ})wCNu$BHe_^T;it(ZTh1& zz3CgI8~xF@{q#cjJ1w^usxw6I&9oVJUQR}1mo6tG` z{;gH|7-N;btc;CTxWVvZfBxouw%e_p^86S-Ei3b$=2%oflto~z}< zuSYsDJYS5)Yu_pzLUw+{p&523GOxrh#9S@Ev*r!PV$VsTjdIIW)1uGPSDnaz8_b^N9FF}`jIOXPN2$z7pULr@K5EwvwbPrL>P*7I%3op7zsSg%4@ao3ywGbaSUl6w+8=f1>ELi+Y$UfQnLB6|>;C&n%#`@63_Do!x{+c!V|D*;+_e zqoGs2wiaQiHxt{XcL#qGVv~7>ntfh5uPErvI^^85x&fCbA$k6ncps+Yd!Ua@(>Dvx z!JOH%_?un(EzWPqVusB5b^o6`a+UjH<^=_Hzg2EOOc$Gy`vn%tI?aQr&3$pU|IZz{ z#(ggHf+3;b8e78fw`8j+X6$W*@S1%SRpb%J{lx|TKT|yO(xZ41GzS(Ga+-gsN?z<* zVE;2kGA})fq^>1>Rj;x`6*xJ5iOc;dF0khUZ#W~on^{JDfL1UScD*^n1Lj$-?noO^2 zd?h;H^cmqvU@pjd^AHUA3ea-)xC1Ko7>+Q-djtZc#rCw8IakapA)aL253+~ahw?ic;j*53`Y-yolDFC@i7M!gdmueRbOf5xAdGx$T;hKR=RvnjE}9- z6z_W{JaTVB>6N7$W}Z;Ro_OT?L}lrknR#5T;AX#$92{M*i)+@W;3Vs1UEuufZq9*% zs*Kjl`9jxcgz(SC9O^B-&PX%wdFVJvP&?r;-Wb*{(0% z4G&Ph-X{GlQ$9CSewfNXr1DSOOnq7?KQdE(80C-7@yfUNq?jHYue}Gyv-G1y+ovD4 zue!seC4n-|%-@E2+!}GtgB2$e-G^*;dBKB?lf76_!p_q(O04;09q`KJAUTmRSN*XW zgk}n^QU%$ct3dU5Ti{(jU&!Zhv^rG2xTca;y+8b36q<>;v>1_07+2`cB7&SCO3(*= z1CNN&!~LKaz-gGC*vosu^dWe} z_ChEe^pfu!9j>V#_GmZ#sFq;}aaZxRbNIzQAvOqM?H=%ob>SVM)}}PvBLk{b*>S{Ii#{YumX>sG=(RQMmQ*K~sKGsaIDtt-SG{yR&B< zPd=_ycwcc{?I$j-dpYGy8vA~#fA@z;P4Cw>RF=L|I~Kg#jqm^fH_YQ|y@#^4PsmDr zM~ucklg?>$<7+pFAatpV8b9pnn&8X7yCEk0cch2Pmc}3mHk>gLBtbMyW7%E=pQkA* z>)d94;L$BByBMM-XA5P=GI8^Uhz&(|o7`!KzU`?u_?mj%yAJc`Q7mhAhAjT~u&=S_ zLyyg^F_E9s3o(DYS<|(d@xekGSOctfSAg520hBxeTR#r!3cuD*hDJV|keF6Mq2beD zmS2JI1+^zFidCb{<15BGBK7oDIrtkZ2Mh-(B;=OvoAp(8x}f!NadRPg5#r@g*(zIi zV)+85Ir{iWr^itV#pa{(P9-a#F9MrsDxt2KMsKUG}1l( z6ZqI;{7|7Q0;v9XkO&JIJ`URJbB1z#jsXP&%78-mZx+cp#e(9X_Rj~kBp(h7C-P$f z--m}*M50y|iQAjYhN>@*=VVvKLtSCE4e)-q^}`{R+1!!&0r1)b*ks~mL(-lWh(%Wi z1iV65v|@Q!?};JSr_%kia@^?T5EDC*nP$BMt5}wu%67Yc9GI2o?t7QAcaQfWpSK^D z-J3t)_faIxwOfw>zLhkOcE3>jbwje|__G!;YIN=O%>FCJUSZ%{RLoHknZg4sUyVB~x^4z{)94E9A|HOuVr-7$ z3iJVM^AbW?ovq0ed|sW!-BFx8t}M!7%O}ij{Q%K!eR*WZ*TStkhK2?4ox#d}EY&$% z(in<3XZVY^4J)a)NjGk#S>hqTN6;UUlOeQmLo@r&FXRI|`^-`|r?&63Xmziso8v6Y z%YJKG6azrkH0-Fo>IQH>MP6jb7YXj5ORpYSK7@Efyc4c8i*xlY>Baep8&MuCt0>a_ zPu|LFOzQ2ENX-NK-V#zpJ0-UNkCN^Uxtc#?Z9Nz1rizou>8CF_1P{zw)n;O{3pGT3 zTB^)7euoU)f3f5LDb@KiX~ti=arUUg20X?LSi@YKebix|b%hzoZ4xhx4AP3wV20^! z{<=w8T#+8*uSqgvYa<_aBJU8R}aC1)#H{%<3RPOTH zYiMLq>)wdkbqBhAjIV*|SWRmFiY|Js=*wxAZ>F>4ulgIR zVa4I~Kj?=JRldvb-}aVsy3$w|ZlvgSoWH5z&`eDV1^M)1D*b!i33ngw1pZ3D{%&6T z-<`+rTIwmpylNvwt_hW7({8Acxbf6wyhv8}NFAF=JrV=#{J+VV((~_@7CMV$C^Gov zme%As3pHjpUR{W<12P0wP&ON|3`xismvAt=$ZfnU@K18pT?O50Ur~!yCKTjLR_a)< z9(A@As6j{y;t^FIP#P>2J1DYw|I|>gnp_x3=TNE9;bsecO>Q|(m8tq!0h(@Q`@;uG zY53o^wJO2;R3^%J?y?{I*yG*1=n%v)inTw!*%NWBV(s&zE7lI754GUK2OcfG5n5)M zc1xQiThV`Qrs6Ju(e8vl+?s-9#i@zN=e>wVWQJP%M$nCYO*cY*;6@e%vg*Pd0Si{K zxuA$(nck-4NfNym!+>bS6*NkG=xHCrdX4Nhhq@Nfu&M7MH+F4+ASu{mF3~NM22{jb ztk}%yy!CSOh?sl6{HZB$u}Ym}>er&$Rvx5(M57^ml+D-Hq8iNp;!*6I3A4_4Gv4r_ zm;4|DGmAfRz0BYb@JSUf<+p=lYXOyjBEY9V$#NOf?+EK;OeBLEjlKspjD36I%R5v?2=jNO?N ztsPpFV1|blyIts%>{h`Kg!jGO1_%Gv2@Z~-Lq@)6;+vm-Iq8%=WX<-55+G0WY?-yX zQ<(hqVes8RWj=h_jG{>RwT26tO|k3i1bK0E9?+NZ-db2;Q}6WpW#Ug7=+G|sVxY{L zyaTO+<{&<9fE%w53irU^yE#Sl`Pb^`%T$8L?hG%WvjcUEiDZTZ8TY&1;Ri)A*me&ZJinKl*#OzXiiP)6f6J z|C%5F4GOURu$Cp_1?1m6(!^^Wn5xj*)x4$pC1N8kpm5K}32Z}DYz z!rj6b+ejL|C8Z;Zmz|PD0P&0Ys3u~0(RB!SQqryUy~-kmq!F`OEqBo50NZ3|!5h3JFhSi_GMf5ywTC(K4r1kgu=Er@VH@Omm!8LvoFo}`%Ziu# z4&SUT+559=WQ^^2Sm;7#<(5#vT} z|HgCASVr!XHEwTP0}zkrE_k0WTxE;>j1QJHpjFv}27CL~`?Df(POH}7!}O1Tqo9xf zCEl3cVuky=>iz*91Wp{4wNFvi7C6n1kt>$}?Z2ENvKWkg{!Z{TWVCki5q}nVHCFQ$ug=zkR(FH>&lOW4n2(kcrUm*R<2|{VFJfVqHHad9!Y96%Lp4FS zOm?Apix}}Luu<^;8`tK2HceeNAd2VSuo+OCPBsJIl?woe_m98gbsJz9hcf|-pSSkF zPvHy4A8zKNI_kH+W8e~;Dm8@7%cmoll2f<=sHgi_!P|Ug>k!Xzp7#g33uKX!IFKn$+~B#7g9tNYxo)6BmQ9xck8byNT65o2w$4Bm8$5MF2r1Y31%}@Q*G;eO0lap0@QS8#1 zSXR9H3(aq7XWf{%+hw@Kr8SmK90ONb3DkrVa3)_aIpm3PTo?sShLX#B_?|SyXn6~G z?XUXXGuxk}4yN|#(V>qPf4<5VFTK9X*U$tR?=mMQf#z$&V7;x4I|NEjnVu**h>uvx zS6JI|Ry(vMRxs$9Q@9Q%)hAZamnR6N(0LG*OYI0vA4_7mq$?`#*R1nak^|I!j#YK&TpG%}JV1TKi3~*KBPBXv_ zbzh0DX-J zadvK`EM5dL&L2VQEngf<7x21xy!|k*i$r3Dne%u-3#hsXzl%em1|gP!5C{?Q#36vU zh{+CmD<>NM>&lRCuwgO`TL%9j+!+FYx#1F%eymHn;m@a%PF+P_xlQ@n1X2uV57?BT zH<}dhmlfIKPk#Ns(M_OcT{(5G7}70kt^WQ0;-BR#9L~sm{3=%b`p60)LRMWtWW{cN zjfX3zZU#BcZ}X;wnPoNq>Jyk2mR3Fq?~39xVJR%AOiL+Anih+E9kGH3|74J_U#wsW zPiA2UIzTBPBph6aj||JGcZX~p;7lQU*x{Mggn97_nKj3F3{fr>GAK578~Qz3@0sx> zW&B_t)kIJOa(?^se;qcFqPk%0q8jEekSJ}h?Hg(B&2@>JOabBh<4*!htHI!W{#|L} z^#Y)T_-$TtO@^r`zTy;6&4w^ri(s?6t z)S`y6DW{KOrux8+)}}^!@4eES+DS$HCFValB)denI7@BGwEQj64(l{ErNhTw8Dz=D zw1ddij-!*e;x*M|V~lqn1?=CoKKe}h$n7(}2YnZ}z{Jc!+xUE3=*`e0UmV?oUVTe< zrn`@^yMvYSB@J|lNcM}K#Jel(w4U$Ap3^4dxsleR)E~{rX03h<|4^sRa1QMU<{?^ z2I+5dgLF=jpS?1BXL;nmiR%4YWi*+I>g_BYTHds^_S@wRcLj25Pe`Ok62=TdSWFEj z$(_qxyd!qm4{`hpP zT3+=RyC-5o+oS#GWt0=R{e= z8cY^#^7Ldr7dn-(n?piPt{^WOSibL#@{!yd*|&VdN3vd>qc|CAjrHXMF#722NlD@M zXf%w$JUO^8bhT_UH$b*BQr+H2RmJe6F2$dJo$#VinQ@wIpLJVhY%=tbT@@RcO+BN& zQJ@Id@7MNKc$NROs4 z`Y{KlRg}K&Ec#_GqBs4*@^bf-X>Aircx{_Fj%BQD*l6ayc4QTcU{%aSIUzXrj>_1# zr*pH#N9t_$Zv)2)B$ENqkUN4yJ0TlttY?zQ*+ z@Q@BILXV*(m%`u`5yojotj&sDRRdWSam8Wt_w!F$tXyvOfE!g87};xW2z z(WNyFb8j{L%V~NYwBe3-vm7*`7#vgNGn6yIi9cnsvMRsCr+<-F^8-`;3uzkWig>BL-mMHe`jW26qV>=$ZD2OQt z$Cas^FWK}P>xRo+w_{rt${F_-(I1|E%T))Sel7Zqr{9sUE_&&(Ww}S?roYkk9ZBww zgjb6|on`ZwuI8@U$MqO1{5u(?Vg#;XYc9G)?cUBN-Rt{T;~m1Nhv^ne6T>$0b}#i{ zAc}_Q3?7|jS95dCvJGOX3F?s0$?>Ax(^SDiDln7e#x9+%wNE+BLE3o!`6I3K+Mw=^ zfR)AqH`E>r@}b{AnJnP%H2p#krI(&ncLlx|b`mbKy{Y#n;Y|Sef0%@iUtuvg25>;! zO{!k;J#2*^@Rb_U6*k!lahVS1{o7d`1bsiMDrHvF-s@wiSF`q*YG&4+&@boj{!7Xl zKL#$7Xp?ieV4C=qFB~?HX5~oZNn&+3lS1|(8PGn^5Q85_POQcWBg<^1UVk1)lFQ-j7rhq0_TznVgK__ zx0KyhJ_BG-i>v`}VT;rrwBQ^HD0hGF?2TV^r6voANw`Y}i143~UVKPaJ$`gZdgGq| zGB8RnscH6}lZk z6_z3!+WW(ijP=++Ud`{pbL{>^he3~1`6VGSG@DoWbG}J`_$<=RF6G;Px++lnHr>0F z^nl7wCLO2*y>F7j{GG>M<}=$!`=7}K%(J{(=@Whel|^51mbImO<}5RvRK;SuS{~+j zH`t;NXX@XDvQ=z?|GF4>_cw>GfKpwPGqdyyZeDu(#%jSUE-ELZwk*G;VgaL2q(HHLb3`MT=pw(I^Z-N zD>98uo(?l?cY9AR9!vT)XK>g6&#E-LaYk!8$Djrut`df0@mqGzo-h2-_kB`Yb@Fg+k*`Z%au? zOco&!x8;<6^5T>4fJQl$rSHz%omvblkhtqTv@3Ytb!=jW-*`V5Yl!t%(u9lIKwrZy6ggXR_0Blgq@Q*M>0&mdAH2Y( zH>iPQZ2H_wNEfpqeH-b9-Ry-ty*tk4&tlukB?{CbL%z4~Hp3FHUBHLo`tSiCfC*cD zIoNr}FBf=uGro1nyxrXjJFB0&k3zow1V!3JU+NZ=_V(EJ@mfW&nt&26UVu~tv0kw18OADNYq(hR|NizqXJ!)6KF|C9 z`FzNnbM`rVuf6tKYp=c5+H0?TLh(dM^6Fzt5KK2mb@p zdcpq>ed)pPkO9?P`|zKdfj`MI(1X9<{}}$J8$8@&)t_9bE!3#Bu|n;^W822A#)w1` z=UFoAy?8Iyp+dEvEVzs}1VM@WDjD5)P@j2l?s#}v@BgRXA8&!uwpw2LB}7soBI&qV zhPF%ogiX5X3z2N`tJC>B7-#yEt9$>6S<1ycIzv#hatlKo3_JdHL+isb?G4pT1Sho6 zxUuE1z#u+nym@WnNr1)boc%v~0H()#^WVv){G?3zIcd~(>6h*;UrzRb~4`CqC%(KzyUxyZk%LM$NV7puC z{(vYw_YdaQuY|ZU>E_A|Fz_iVA=X1JO&1?C#|&y+AN*+ttA|kpj+DD4`Zif`?%|+f z052Qw^MQp~mlCTRt*VK1Sv5>M4Vmt+1nEu&lzFW-HqhXa zU&ulCex9;^=datuaJsi~r7FI{H<%Or{V^AlQD|RYJ_ji459yWgsLMo8_z~))JK}J5 z%c@sxEqhuTi!@qxfYSp4YeAi(Cv|$G-n?;$?(IMezSI#+T;|34)WI_GBnyfpcO_;G ze&=54i(2>LM?Eo{TAhi&w*1o{joss)D*06x-F=MGM-pk&(KsNO_&Jq{X~Gh#PRoRE z9E$FNB@_ojy42nJu!PoDg;NNlVtGdaKy$6LP~igW-3ypi?5>^0=2wUA*30DOUe|j&xTd5Z0FHuK*NMeH97iar~1_!PjG+o zE`uXCAi?Ox!&SojnD?qTHmppYZ6@)8Aw1TPyZUispDe!?GP%#}l%)7gcN; zEZs!<2a>r^jPQL0$Nh^}8o!NzA8BYRZ4{H-bLml>%%Gh_?m&@~k@y_qY+{^vkwO~u+MA8H;?i~O zmpRKE@LUp`a8-a@#Ek=2x16s=;U}TMJ5=LmI8@tmh~w)2?nNBzF8o3j$l@mn7kl_| zgqnJxrA9Tf<^mhUhn-~2mZlI?%y7?=G}B~)!eKkXQ+2uC7$r#~$R2#{!HxzdmqbUu zOawefgmIt?LBaha9lOu0EnmZloYB#w4ZudUT?oT6I$nsb5)k1u5NvR7K%$#=e0<~C zvk#1>6IbIz8{(@0m?{Af769XozdwpH8kxUaqtWnaaPeLI)+U$q2mb=3dnpNDeW_J`bIRcpvI z3R0(j@c`TLeVU$l<4ax4ZX$g%zk&P4VQ!P$jsnsjOT=aDhb8FGjZ=9QRxm69reO~i zaMU|+DSzPUqJI41qb&V_hZ6T{go&yv6gO02CN4}Dn%F0)kVZYd7<_({2p;Vp*5J$@ z0tPo~n$RnjtPOnb3Y?A>9d6t2z5b{A<_DXbrC%t)tUc=d{%vZw(uv&w$Yf&O;1U^O zKnoFUV(j}PJXn2pCfX7P(@P3rZRWco_h;rKs!b1d)Bg497Q_BTOlqZ-m#7>mrJkeG~C1(DAma?&HTh}&zD=~fKans9~CJw?2Q087fS2(9q#bF(bHtn-8%=3^}!&XjwZ#o?A$9Y z9fbd?o38LTaE5s%zOWz*s+3t8p1?C+iSKMrzJ=-e6vGKmIR&c&^UUqouz^)a}t9G~r8K1_}ZeMQM1D7C$V> z{}E@vu5r)xMhRlADfIY0T?us*LLH3aRWjj={(YJ7CmOH}fh>qksQ%3I*L+`C>O1di zfqJeF>c3qd`p_P3$zB;KEeDX4vOPV5|A!`=k;ge@3)jvWqLE*skr%nI;)Z0N3<$V8 zAKZPjf>04~w>Ef3d;0BO^V1)*^o##w!io7-yJ%;9pv2XqxOb7gJ`e;=whPfD4*Hu_o$OD`j*Z-!E71w@f<6%ve_o>Ro zu7`AAu zqQ;dyB;@ap+4t*zn?Iz<&recfNrQw6ia{!H10eI>lQewZ_UTI_elPOX3t_3yt!B`K zjKcJz`)g1J{yz0Lc=d->|LM8)A9)J(OB}ktx+qisR(kN|_1Ad#5e24ER^6*qDYSl& z?T{pnzNCEa5#7B zn@~1_DZ#HdK^b#9$?w`3yOCR+aYmwr{{aZEz&_2RX^^GV2l(tu~D^mtQDFjukaf|pkOSditLZ~{vQp`D-V2We5ktRj}I&R zD$|!AP$Tw@uPIgFj8Bh2Js%7rF6U`p<8brFRIc575GF>sfMsa=KZF*Bm^fT2qB6#d zJ4fQ_<@@`HCu&I)45b#s34Hyp&#BQd;t7V3aQ$h!9ZYH}bPu8%s<$vT(GH&%-+prz zeiNGLB;wZbi$X}OP9dQ>qnIkrR5R#9#9z_Y-Lysjjso6f!MG*DJ_S}9ynBQOS1QRj@t{-#CJhy&)}6JwlVx&)A1|#8hfRq&F@FRGB_I>1XP41EHON=Vj-Ya4QwJ zO(*u=>VMU3b-KP~peNVs1m1Lq_T9V4? zF$?<+`T?8oOJ810NKii~QKU4alFp1s<^a$ljFKA^O{%h@wwuqtqGfM@3_5t;VJeXOgTl%SCit_jq@@2M%h>~qfX9V(AEY*l6i(l_j+-N6; z=SPo#1klkI{7q<;W>DbjMNG;l!efySr~H;z+{?4&Ro76yo2lI^pQG}#vgOSx&-woQ zDnBw?-rlEts>=Ii%L}jV{ryQQ-~LVpzB-kcW#J2|d}X%$E|rI}cU|xDAFKSVZ28PS-(RirBeUhp`jk&qdB1FVo$Al&-$^Rp zzTNBp>Xx?{A8?PEEIEv@nC%0W+)}cXSY{cdZPd)Xcb%k`fJoTl)QDsA7{>SpW52wF zagm<6VrNC(3N1CfFXt)6QWgUC^KGtF~^9tM^o5IYkCOT0ZA zPcs1o7v+PAXyUFm&_`rv)5($QZME^&qrpl1yjwf^b<%D`@6BRC!Kz*t!70Y+`cm!?6^y#z~>RteMPIc1{Ya7Gdt8UV>DJq<5wz8sQc83 zA|$^*vWQ!mY@DII5{-97PP~ zKzHTc9$9EHR4?MJcR#$}4tBja*jKeJ+|=~{Y`azKeGhK=VmmJbYB=4;u|mMHzzj*7hatC?*Cl@pUw1CjX3 zI9Y&>SVGy(bJz)nrLr^J+SBktV!~T3#H?>h4@ykf%$456*ragvipC1>{AKIscl_9C zuSp0J&qIZYXcH(R(N1G(OOD%9JNo(BxEu81x7b}9TyzGMVe@1Zb3#XO(Rj1GANNUZ z;^r-)Qv7P7hNMhW_tpmtSK)MiS*$7E@h$@LDf13w#BHgdo#-ERLxI8%H z>$QZr5?0`FsfbtDqqh3FIsI$nZ$;zRVXhRTD}K6Orz1nDPgg88sI$StGWShac9X** zJ%3(Cu@XCCS z=Y?1b#QrHx0`ZcAidksk7bW#8lM^F9l*${j>xU69ppw%$^2?A3mv#i8ykB>jUwlEv zC#Hz%7M`SMW8ny8ykquI)Mn|)6G{1dqSj^9T}32kzYT0K!6D}rJvK&sW~;xM4)tna z+#%hY%Xb=sD4glHB{|VdfMvJ7Gu=p7lEn`sl`bs1Dd(oHQ^<6^;!81(VV8_fg~DUaiddlRwjXK__o1GyaP|g~1i_{$J`n1CKh>YNH#0 z!PP^!m7TO3(KXovfJxi$`^lb|Ycnqy_W`Buz4u9E*c6Tjnj$zS$oHLXTl7E9ukSUA z{JLbc@G3QG{&SX>Fpr7?-1{HX%IaSJ>IvN8{+Mg`Wk0__N-any$>ir!C@% zSv1YkAo#=$bm*)?B;SMYR}0_opI|X?25q}-m^E`oMm;2cXXAeT zOFx)xL_KSTz}h4T(ea<5BD#SXO6GqBDR(#_|GPE#vv1TEd1mU#iD4_r2c8~U)0%f) z{EQ9JHC?cJhCf$gf4j3MO^1*a{q7KqfDnW^4Ehe7+cCWlM~}sw+@IV78TMU z=$QWwf|=9-+D>0ga_C6)mYU$tR@DsZ%6xAYQ+fGKgSD3;Upu=Dn#Qq)Viv=M{>ZJW z3`ME^9PI!(iyFNKjC_q$ubH!+dYe|`OOiqFTi?sVQ6>~`cJL+^7WzUFSzK>wBX^F{A}96h6O?s3ijc(4Va^zS|fXA z<0y~#F_bb4bDRP#;oRMvALfy3;x@hLBrj(7Nef@dKcnB-%F(*fl*R8hKbE{Z+g0ig zmlGBtT7a&fXJ29HLUHyjv8;-06;Sr1JV62dSPD$LcNu|;FJ^D%a z*ZKCmIe6^a)YoAqZV8a!1Unyu^uam>V3QcX(7*C@8mk&eB+h81Z-Y(Wn7R!8iau~^ z$Z5*{jJ2tSLWwrll6jMfTVvq<5oaxm20M}bB6sgG#y&Uy zxuv{dbz4?EeQIsAwFX=F8oA4~F9{7y6Q!i-7VNfAfn3oXF=Fwq`C*?7xfnb=4Jh00 z0@}45lNJ&6zlXzSU^0n*L|DSan~!LJ|CqdU*q}R5xZ9R4C!gLC^*hma16nvmMt4Q4 zx0~G{5e{P`-5s0aj$ZRF<+0Ct8m6;9iTx!Lqlpvp`6il}P|Qzl;9uxzwbdWY{z~oW zccaxQQcu1}2o~pxZHy*y1N~y z6<*xIFI*C(W_8A-kg5`T`WIW402~qw3 zQS}c~eanQ?K1Lx9wzkmimI=q}CZiocM4oc3hOd@vT_U_dEqc){Jyu%o9p+&+-2DIj zILua4J*w?eT0uA@3qHDy8S^-`dD#SJ18;)))9-rCm{Ogjy&Z=C&fk=NcM%4i%9H|G})5gH8Vcv-Ed zyT_t3aw^dU$N_UGE%Jr4q$FmD?=hQ)(WC3Fe68Nx5M;r}c+4YkaMG25bb+~)LEmA2 z*Cs68os%l*FnjPOoh)LQb46RtG9b>IxM)Bs1eq#aGqU76m&f1OkVZ@^89GAt5GOuq zhQ0~pbxyie6{H*3?nREMeG`MRXZbFgEO`CUqYwp8=F_uDGisC0PIidyq^L&vPF~IO z7XH=-&s`Tmi=@dpCE-t32XM5Iu$f~lBY}^jqt|GS-inD6YfPkj=T-4ZC<xj5#VV zG3=iBMVA6Xl>wd&gmh)RBuMbdNj84fl^tBDL6+Az!6$39Gx7>?yth8R*OY@BdJ}dM zQ)dL9yy#?NT-Q1MrfEE|->RRB0zb4$U-k7N+%mMwf1I62o3Y+t$%}=@QgP%}OL4 zbdpaPa{`JhyG4cKysr0mh6}&W;W#sph&!DLLhc;wg897Ml2;VSqZp|R0U<`Sx+ zB_o$}SV610knxe2yjm$Y$A%O|zuIl>M_RR5CGxoz!P?f=PbNrX#w%#phQOM?s)yb= z^WVwSq8phRO%@$KH94$MNs|@aRgUu9au=V?BDSXm*omK77hE&|%92QtawX1loaB;1 zRi0c{#gF@>)F%-cseO0>o1lHSHnBvNMafP;=89ouk$9W#C1+=hZ8!K!{gXN)i59^c z8QsBlZVbQesaDexbBvMdLJ!6rGC&ny>C%tnglAJj^Oz(-?&&`>l6+h@0`ldb(7c4W z#t3tFvfv0kZoWg0J@91)$G|Eu}kU5JTphMvgY;!^Z86l|#nz$x^NO&8=t~cAR7)acTpvF&abd zXl$)5-^l)l+l7flK?8aYF5K_xC$L8C*7J0VZbd-uupVAZ7JPp`(pSRBePECfJ(1M@ zPxaSG6^s}}5xOY;Wv{4G-LI!Q_fGptefLl=$ospzV(EJX726CkAGCaHm6E?=9Belo z_l8Z^RkiUY7N;vCC>A2>nGB~fz?rq7#_o6TnX&8ddShqwgSkI7emnl=XseKltPY z^(OQ1RjAMlzln%S%${ETu(Hwx7fzPMN?gDeZ=-;r|2CC+6s z>D(#$_VXVcN4Vc`wr-mlWnyS(`fyAb6X_4>D;M5KdsoHg)&uxurs+$dB9VYBLRdbM z1&!~B(bu~t+)BrxmKi9LU$JE3y+gvhWWm?H*9Pz!x1)B!J7r)ONw2R$RKD`#W5i!0*gGbIm~Iyo5-5rDLqy(SwXljpSV1=b zI9-&36Iq0LOW=YxQnD3&Rd;d@ygM$J)jcOEzHo zaE@Cd3kZ{|y-h4xrlE?OT*X zJM4e*$}4U83d-HDp%%I4TR=~lLC=}-Jo&z2tm*#S_wn>p^F0sxXe;jKn|O&fb2O9G zSw<3KI>xGOLuj4&bZ~FBl z80L*Sy#XOzAyQdXNECyW5A31zvX5{>=N6Q@7RXdSWy_g)})4DXyJ*o`JCV*_la&Z2VaDz_mvo z_uBG!=KFPCxwk)VF1PMC7+UuS7Rc+10aCs5+CQn+aJoZ&lslAdse8XjGFuzA#s4O% z^X51353*7J;oHV>PHb*rUgHV;5MFwWlK@}f+U&|0NEBXS8=3mz(|HPEoL%DS$p+IN zZiVC$i{$e^HJChBN5qt8;TL~^j<9MM#o)VR-|*c&VVoR^E0)Bu)1x&41VOMegwN|mUkj`?Z2-N@*czK(t&4fyB0 zsW)(^IL$_ANYu6Um~BEv>VdmT_ngOatRiL3ag)K1aEcVJ3qBDkp=vfY)6XjR@Sx^l zCRQ9#EuckGKO|S&a9O+eI*HSi@pw!$F{uzccH^M%_&FsFC0x!qxbe+4-8F4V4_pRZ zd44`5+X<5yy?SnaowCW3RB$Ns+Rg^!5Id%Uf{; zV|NQQbI{q#)~)L;!IUo`IqWpDyL$PGjFjqnXJ?@?GOCAnv9V4)WWQA*U}8)4POoPD zuK0^%YFeH#;c^X!L^{tcd4tmvH3uHrs`x3hPU12>(0kUv1=CTwz;qds!}sHRH%`3E z2)j?tg$|AYVCZMX@x3U)XfW^JkV_3#gZbpZJG3l++}W2tFy?{B4i@|F-mM;Ke8(e= zk}oHXF^}YsMoES=JZdN^Hu-mCmG46ib-Cn#b$U{v=ASG{1T9HyGZgVknjvO<4~Har z2rk0}I}Zx;&q2O|VL$D%FB$e6|BGF5|Im*8OWvt*cKO}$p~fC-L!Ytl?%Em3jQ%|( zUpV^6$1jY(5sUR2+iCKNvI4q*u?;b{?%QMhk!3VW+=EGkCyw$q!JlpAo*loxWXF#= zfc>E2Z+P1nlXUhRYWPeP-(rkl{4*}$4!Lm-S=RU(VpNu!fjVfMaIM%4rCH-O( z#=j&p6CsDJ`?QpwsU^$w^r==KosB@9Tje(3Ju=U0<2bxHI9qRXQ4)#IMn>`#7okXe zF17+R5BRj+iO&r=@e3-QI2pC6vJSUrEnZ(8qxl#Jh)vi9G%P*t<;K3S4UN)`9G-8y zD_-DL@QDj9k0hF^)JI_X`3Bx@?T@Ws`oXAdpRNpO;|&WYcPJsxcIiZ8_sQMDq@{MYF<{$&}#^(*p_wXZ_ zSL&91n&tBrXj-Y}(W zyGs;+0jI_M>WD5dVJ5M#0pb}^@*{-+kt`SkWbUtVTNodgenAt=`9X7-sauSBv%iP63w!|Jb#6A~dXWD_bA$Bd%FsyO` zvCp=|?$f#G3WBdXK-3@%V0&kF$-C#0oF+Em69CL>V8Ng;fW&e`*aOLXC&Cs#7#cQl zl@RjmEl1{Y(%}auS?OEVcP{!uL1dQh(gZYjTam#P$YqtLR&bY^;|>o%in347Z8$I? zrm!bv?BAa-ZW;ZHiXePXTcsT{WiyeRLHUP9@BIO0B!9Px>upcjkqnvQS5#an@g*%{ z_1Puh-e@uBfp-J-c?^^3$a$5q2{*!u#zNk}7~(>{pvpZjDR{Y$#J_3;71HMb144Cx zX-8w(r&cInwJ`I0Cbg#K_bdfl2R=z)<#UJ%)>HvQz z*kSwwn=CT}u#C&vV?KHvjJZU-f_^c?>`gHH);Pi7Fu7L<+2*{S>dlRVTIQA%;(o2( zJZEU*o4RS*${FcGZ90f2mplgyzWMfJon%E=JW~HheEVwS@RlEyaQ+UCp6YLxH4Nhs z^LO>DC~ccm()5C6X!bY`WrqHgn%H{0GyOt*Ttz{D$mpjpFr5FFI!dMc=|FJ|3VL6u(Do%_f$*m=?zpuLQw-}}yb{){ z?XQZ8zut~WJ+62lKW&KAlXOcidGjL*G}Br@rJ5o_`f|2FuxPY@JKK%7;S%vQbI9{_Z@>T z8Ul$B@_*A_p3*&CB91B!FR3W>iz#QBZ+9 zT+k#7u6~B=!H;t-Rxri+D!xdKfx|KcdcNqC`9T7mia=cT$I=NK1^|wXwaJ3H-$q3~ znkF^>tQh5M$wtt+>F?!^`oG;@YvKP+)_z+Ve1eU4J?s4VhS=Ug!Nn&~E||v?WVoZ~ zki4FX%?A2&MHSU}qd@hnKO3GnogeYU6}n9nPc%OnRqqs2nk*>hLr*_K- z%Zhz%uH@uLP`E|T`+M(4B#Db&6Y^f{`4?@Kp7^xdD(zlj+A1BT+eB#|Kh~WPFNwwr zJ~pMvg8TL1KVaNcy=lfNBY0==P*dqbl{K46i#H0?z) zQ9d;C_g+;z&{Q0T@z=W#PBS+4WWi`&!MF_qor7h~igN!EwbuHy_4}SDX5Ze`|g+)!t=F$)m3i z)9`cZBI>fZ#^NV@Ckwv15~`o_eGl2+<5h2bOhcvlAQOzgxZGm=pZtRH&E}^;^vYCs zN~bAJ7M!Gp7SIsze*m2tun*V6Vhi@?`tG=5`+mImBU4TB2J@2vyThyPZNPWO3GAhQ zT`%cT$G;2;E>~xdD?ZM2GG2UvZWG1h%ulASqfKeD;HUh$F5Jjb%F-7^W9!{HIBpG$ zO)9>|);mo#99KNTd>Jo3Tepeg3iFexw^XH~&NH}he=Ih)noqJ|^&TvOvg5gBBYUx^ zeZP-$3OQr>^Do)?e>^~3gyeOSb!Xz*7@!G?fULuu;`5!ge{dHeaMj{`m$3(XtP}cuqKy!HP-fnoX`1D?I2wZyVR{$Ib zsbvd?`cM4FAT3{jB@Jo~D6jgU>{9;gUijJT*AzP}2NVMYzH1QBuE9WiD*BknRy!CS z=>nri>u@+)VI%V%HGnJ~*4?-Mb(#AAsOpkM{e1klCiDQ(DS-gKf%ueRoORE6x?CJE z<8hM2@n9oxSlB{|GM$Oq_+*6tNxYzhOY?q@q~B|XC8bkm-Vd45w~hQ-;T4Dc;x*ny zvf%K~pm4U$ILf47n6Z8`=KGEJCYVXSU!K0Nd z9jN=ogH6q8iK*2R0Wmax=^rc`zKKPATjM|2$BpV-?D7hgt>vdJ{Y&?USFzjo!rp30 zMnkah-d$CfGd_a8sBZl>RIvAYq3+Q2v=b< zug50b&-9Q-epm7Hcw|?itxPTbhw+c_D6_tOSkIk;Wqf7om8=cB5474vZIu&PP{|9j zpA(Jt=vcjMH7#_*GI#D@X+K%8`|G}0ay)o?Z`}^W@i+PN zD?T&&!RhwSy&Fa zfh+f$K@@oxN;%o(vp0XtLpFN+GeacO?06fOTIpMxFr!sqJ@STmByP@t*0Cz>D5}~u zLco!^)}|X1jGNa24#?KPM|JE#oMXmF(LRagW<(jNddYhfIR!=?>fyTC!!_H?TWAyF zwuU1e%}n48^Mkj+km@6Wt!93*XMca*!~{mLoB)NwI7VQ&2`XxfR^PmYr?Uq}c~6S#8ja!#P1TpDQwW| zkRx;0g=?By`+3&#j`s!T5~I6Ygx)ix&ECYg5wfP6@5DqQzS#w3Yyd-ssf2%XEVW{ymIyff zLni1BL)$x444=#}E0UeVq1iItaF0L4NPp8I!@qOkM=R&E^y{8`*?y#(nzoq% zu=RlBeSP|^SI?|1zvbMcS^wbJQ9ow3=Cv#{-EF*Nb&D=Y#}7rxUCjTv+9Wl%jPW)E z3R>%|+;K0y%2QCss=61tRUM}nIEmW~u-cFAH-tz!nM{(Hx0yLX{<_NVIxourJ#1?8> zG%>wC%6^lj6s4e{Jkr1+3yyMluA^5%VxxbtSPd_EykaXa$(a5-{VH)QBQk!nWn3sZ zIREXIo*)dx;Sx<5ZY9RLjrX(ogIO2-h8neL($o~s->h8b?YxDt20FQ~qJ?X$GryiI6cP8sFxw=XfoV#dyEr3}7BmDWkcQ&)3W!>^TcA zn!xugcR(G<|58UyP81PZ-3riD>tn50??9TBlM_)yTYv!x&fo4~XsCPPDXKyq1Wv3v zR-x$ae9d0J8GgKFw0d=L(MpY7Vpjd+c>Ze4hM6ssAWy`gcO^)c(YZXM6!TKgnrM78 zTiQ@yg13-KB2Q;-T&9ZPqq=CaxOwxDIJ}C8T-@b!eOMb`73p%L$)n48OfvE3;Hc}^ znVOu?X5O3EStz~=le);v%aQUmPWelbo^}N_)}w$&jUAIWWGkqr{xZJP{sjx6&1^vZ z9k1xIt@;#RkxXp%j&#Y;hkBi?hT}w^)A2rYvd>6rp7$EQkCfB(p0>?SuSF8E3GmX2 z=1A8&Y+!y3WqVJ!_OP|JY%zj3x$tPo(=z4s<6; zV$Ye8@@}m6r-=%_iz*?(4f#E8MuNU}KAy0%C)S)3S+bw*oB z1%OoU^-A?ff8=uyAt;vX!JqWN+kX&YhUnOFl(+t}DQRX$ zA&yre8+HcD#q$f2&pU1W_%@izD0%ZgFq5?>fF%N#s)L_cyH&M2dnR1A70w!tye8-(?a2+JI} z26YkP9}a6P(UT{tds-ZTa0DZK%0L*6vR=3gyQM~aSr?;F%FyuGtdC3@NV)dy?#Qat zkpY3Z+Q6O#UK@Y=fTz@{)~_1Qg%m6W=f7tpr<6HgGZdf){aZk<(NIkQ!<;5(K>{yNf); z9p`Z508nZ5*#-l^g~)&Jh-eQG4I~Fc#cmfECfK&PEh8K?e_8nuj8%YD$>mD1z6Jim z&B!`4xL(9j$NOmc^9;&Jq8SdWjhVhiz3F&$7_iAt4dlWssuD|z&(X_V8vse@ zVX@tX^FB%)raRuBZoxWArk1>r=rCzeCU2=XdItgt4J|nTeLIR4Bx0bX-@6e3;!|6* zg#>EjaCk#%4;t>zl3Ja8{M8>?a6qn9Z9cH_>p00_Z)B#*E9zaJopXIE*L{VB+wU9u ziHOvPHfew-8}wt>?=AG$TmO}`Qq@!38%2#x*)7ZLk^#U<2TYJ*ViPN25?vYiv^YWZ z&K~D@*{uf2W*Rg349&XT-FqQ2Wt(wNC?zua+?F#}+BfJ6AG>pKb>_hDP9i5=R=TC8 zGg3Jq_qx>imMXU*?khxCdLk|q&?vNer%>KkF`oNYYCYxVr!-YhNa!d2c*RmWst^i^ zKD-x2)S$=gDd*NNe!QZLdlD8A*Y9+8(q2#cXsvqk^cqwGLsaR~(-NHc=TMbdpT_nS z1e0GyvWaqMvg7OK7p0aItx?{L_}Us{hh^4xy0%YER!p0cxbCeIbd|sH)_I9DUY(Mt zFa`u)7g#riEj_i>F9sJJPqgq=XvFJ+i$`)PwfABAz>b#a=pD837jx9es9nWIy0=B1 z>1`C=HqVYeN!(*cHU)ke%0IG!#rTjE=?4maDu1y~l>A`Ha&fmOPOA6=YHk9>X z?7TsF^t$MEEOm{tg>F`_q;G3-+R3j@*=aZTnoW=t8mFnr{Nw!PgjvS#vBvGLccvza z=-S#y*IOLEjIe>=q7GnRe=h*rRt&hceI9v(zHfo257K7p*4i(@!+~!R7CtIeXwTy_`P8=ENyQ zt{Jd)N8@igpkdMPP;r#0$uJ{5#{AfU*;ey39nOn%{jIkAb|hR7RN?Qd2nM>OG$XL7mgfg zo$);qt21gzG(mM5`P2!BsPmF%9Qg%R*|(%)sqq6;y=}O%Y8=4qH8RrB9TW=IrG{I?%sot5^Dmds9 z77gq(55{I0_`?t|+G@PR(k4rM^RLBOxSs0}BYMs%$l&cWgRwDuV4tD;hcvlV24e$w zXlPHWQJK4owlPFLp+ItDbf4eFLJGFZa}RyV6#e31ia;UxTPYHBLWR5MMN@jx7kKuKb^Q5(ee=KH;LQ@=wBK*bW3K2(jghuVI*y&1F3q;k zQe_u`=Y_%4b3ArSuH)6t_Ph|4D zI)_($0^g5k-t2_1S-!(F)m_0wi@`lL2V1W*bi51epa8TYS;A%EtA=$=%BA4)?T8D@ z$|J0bQYyXL^yvLF5%WZaMB^`OTB$RO%h?05y~6l|;h8bstEf+oyJfW*;QO|NI71m% zV~_WTpXIgNz23ZV(|`M8c&>Rtb~JaJEt{tCGsHB;E1T|(pDlm)kN&rVz4AJ5{B8O3 znerVQ)HpHrwtSz4wuzy2Zv#yCcnfPF1M3R&x<{&0Y-MGgG&Y2RfIjZ^%0({je^VJe zu>DVz%ke?^T(4Z?<{rfN?jSW*p>{I-*&++BW{0=**6*G-wOr88H(H+R)nQ5>gdl0- zjYnx?fL=e$E8VS|Kd3vu?c~o&)#C9OR@tuSrFIk%X6YRSoh)uKkMeocYO;&DC)tLt zFY|l>;=dIy+iJF`_LtV0w*Rz?wo7@S{(I#BLH{XtN2~RTR5i98|9TyGAqDMy4-@{_ zj;H)zar?v&>Y{0D0@(@?4te@ixbXmYQ&{rmLyluJ-izQQXP zb~AQnwzQsYU;UxvP61`^?dC;oB>9~c6w~}#+&Ny+csFT_PW6k}KkAiL`SRszzs#d= z%H2;_Ss<4P2xa`e#ppwf59Y35GG<`A!%Ue@VkEwVH$35!!`t0tScE+z!E?4ClioXX zcA?cA(j)B3xzvh-h~yQPtZ4kDTJg9wh-q0oUWT9W?7^%wLwTv+OVD+EIL3aJx=**s zg4?!&juN3`)jsx}LO&yLp1Q;JXDEMiwd}Ve5`n%AA@wL*^Lwe*=EklMY9JbKeZcxm zXP6E32OESi*vT_UPy6aDwk6aQvgtg>^jsU*NUEyZ>NT^FVwl|X*)kADMAsCikIXUl zCiBZ`0~@fW%pzejUR3I=-aA`1X_J|hj%$`PQy=HEtfWrh0-w11hYnNqHJPeU&s6=0rJc*4q3Xd@ z?a4QYrS5jDG8KbxYL+ra_xQn z+z)uws%J>49Q90}b!=w`?YI&-4lUobNRoW+1ooz@-9r=}h|7!MT=`~VY-+`OT>RYc zC03c`ocPTW;@Y~dAbS(pu$r@Sjo>ln3^VDFIK))ozViX~nGX|>8tLyf2~dI0W%&)^ zk0HLJy1NPA;Q~8BpwdkQP*Z(QOKuY%Ly%8zWWa;;%Pr7EWC(JE6?xxnr$|$lyF(O8 zkvBi?6Tvh=Fz#)tgaXG&c=Hi$p&OnFn%LPcrOz$44Xyov+B5+m|Gnxe-A5#(k_E56 zMwx`GrO&xud6oMyQ-WKhmX5WxT=@!b8ewr~H~Y>z+w(#c?zkLT@h*RI3HF~0dJ*hZ z8DE_BzlHl}=o3F1u6BbinZ(Rm6D|8Ia5UZno+LI~XBnA1v>Fc0D=kr|DUGhY?p200zP=GiRT#K?{4f zzffODvSvSAEm-^Z4bK^GM;qW3d+}Y`H~g1MYhw1g_v7zmyBf>6p2Kwxx0xx)U2qdG zLr6@vzKK6|>wW=%c7BfL@ZT44Rx4tp4`U$)_y?YQ+x6@Ix4h+;nMHQ}-%_7%*Ejw5 z{2{^EeI9>>#b2m0#C?1Te|e6R9HahZlisJvd|vM{n^~V4PnXAU#+F*?zHfH2AtZ!4 z#3^n`_b02J9v0t{=?^K{5ZM%cLw1cHvx?{>RD!VH;l|71q%xL z=s4#IM z&bNN#BgFT{5)#IKYhW9uM0T*GheSH_J7m(#*v7?zp-6IAiIbd07qO9l5x-gE{~XS; zXcK7Dsg5HI^H+M+Azx)||GPPkLoZO9;k7p3zw9#|;!=@B{x-Be?4QGQ<1n*(Q~=%& zg#*7iLLKxd0Lh`ze)lr*zx=tz>R##Ifo&nRB!?IKUz+8`?n|=QX|DI<#V5Wl)c5Aa z1%?+rt*lVfGshQU>>F+HUV`eh{miS{W*=u3z715kz~=y*aK^W z6FZ~TuPGs7qmeaX<{f{O^Wr5aGWA?BbV_C9`ks514SXgT! z0ZOs*F&zM+F{LmQ2vXzT!_@LE2HB8XUWh~3vNqCmd9N;^)|EyFt+YME<~GI|v{@N% zV%j*x{DmhoHz94GC5V-8WGnLZU)(hs>ZBCLK(-WvRE+Sfl`Gruau5sF{RZSKH+*}v zoHd=CTMD91UV`QL6V$(C@h}vvXN#!LZJ1`mtYCY5g*xm5FAjQ7)8x*HD+_r83nzp* zB_3VL`DX>UALHp~!B(MhN}_0`yYc@h29n(8=M|($_eE4^N z9kGNt!T7&NoZ*qCVi!wNFZ5YTSo}SgpTXY@XH0hFiYdGlNsR17U#T$~MWpL} z0w^|@7%y{dA7izxww%mbf6Xw)%Qi+L8c0RU_tchSiF^6RgCf;01Q#gD5I}D(B&Fyn zw~{hc=S5OkVQu`cxJqi1^IoLso3y(mQMB1q`zCoogNus!FcMfxYUFA{l8E0JugAB( z15%@jXYOJZ5=qXhu=9VUx+l2k73MzCPrZ}4(*%umyw5hCafd=HhZaTyt7{WbXdFm8 zh+oNB6cYi}wFBH-^q6onjEu({GxmS=*!+ud=#U}N)uK{MueIgRkwTwT`_c0E6de*R ze*3J}=1162f2_W=1-&FVdA}puhX5dVEGFgJ-ksW00adro#?VEW{LGiK;zp6DjR#%e!p1xp}2F zz9Z88*V=NI8LmJ1)@sXlDD_&HylY*`yH;ENR&DuT2(At;(ux9+Suz>d1>*=Bf+ozX zHwHAke%H@S4hs;vhLxgeP#b{`(b4PE1^hC}C};iq%m`+-)B>eW0S^xGH5-}+wAGGY zXHo=ffkE8Q8Ygk9!VJ;i$#r)$X4hwAP;jRbnX6%_)B4leSG8tRrVx3fd045m+~i%W zUYRD(sP3iQ8h0(tIHOnFoun(-p&sA94*!=D2_Yo5^*JeSbwb0^%MH@i2hvnFqFjJCRu3B z(sCa&iZ2!1>z}lxG6t*1e80^rmnd?lQ0`vyD1TaQJq60-aiWSoaedJz?W9D~1`h-F ztyA}(ng?dx+@Ab{0lk@e=6)+qU;Y{Ik}v;G7Rv$}|5^kyxg`m1aX4>*&|=V5R|e;Y zLnQgz8<*%vA-8p4?c`(;duJl>)>>$^{9}_>c+xt8bsGj_1e;wDjju`%;18#za86_) zrWz9ymst+`oB0)SLPzV3SQSAr)Myzp119q~G7%B}JQ2KXI~njOW?sb5qw(cMEqs#s zcvz)VB}cAv|D?CLGi%X0_n5D8YpBNdZdd?EzbHavy~P>5Dm{?jvD=XEB5X~+hOpH> zge@BdFAr#ojBXcQw+n!<$@08`uE{)l7l?xf?|&NFK8R~~_Bpw<-G{9Cwij6=C%%xZ zFXy1@T(Z8$FpV;KD7U0E{z~zN@TY4X$x5L19Tf~Cn>a2mOBZJDC@1`C>+C~#9_qy! zXtBARB2Ea4DIIO%&h0r#=wS+$v+kqkL;m0Uqq2@68~Cp9;46Xebl7#nBy#8m8ox$Z zFM9UV>zuB1?45uUd<^YD=|9<^YOhPolDB`M%^$6uNra%d4shE`--f5a6uJ)3Kg9L=$D)TX$1GOF}?|M{CM`ES_F0N zaLQj5fAuu}b$OWY(}yXpo~1$8hfX;swm-e;89hd6-z=|-7nT&?`V7pNN8l(n+7fTN zkCg9>Bxf@BY}E7eZi0mi9&I)Id(J`d4E)3iF6&93s4iA&3>b(8b#^!Mci#!0nOT8n z$P4q>#Fke&-J6~AnT7n%V)1>4PgAhb%dItlt>iE)S6C_@ZUn5^t}4@}5J3rJBnI%-S@|7l5y zQsf7iq4g6aUKj~JKy(Z8GZ_0Z=p?|Hbi)uIAQ(S?Cb@rz#2!V}Kz)#+Sp@%y9fq z+D*Nz1#+S!nn=ii%TXjHnEh%|VKCeNM2{%6`>vk~1H#xI3>AA{);B0EvJrSvLF^^m zcedw+5N1D%A{uY!kN;p1*KIj8bEomfXE^TtjCtAH-|=*I{;qEYh=1?@I9v0#@6u?{ z4b(I<5QC%4iC7-de*j2~F(#WAD)`(zQK9*xq>+Qfw$MHl8^mW+c# zp+CfM^{XZ3HXMmR@7wM%nvPu67U`Dpak#u(^WV+O+uhTK68v0h2T%}M_u1|8V~_^Q ziQg$io0PnS+r-QUl6W^`d=!9qu9gJ!DLQvR{LW@GHH%1dBND^V0)hsD%Q}B-Z?74s z7G;Z}z3I5_hFgb>;#x`mi?d-sHbhhQn_#RTMY#3IjvC=B+Kt5jf{s5t5__v1MVpgp z-jb47M@OHFD7F`^si%h%vGVCP-6S*$tPwgar8uPc+$sg-V+Mo`h>$>q=Y+hP`R{7+ z$tRJHzaP@pcHW?2?$q*2-7p%nM{h>>xr<*^lzQpQH|hK{jvWP}sy;P+sDP%Fw1K$n6p^+Le23{++_f3s6vENBHgIW>!%+ls2RdJ z>{HA-PB*pOj{%;d8rR-(J!Ex?}}!EG3#@hD6T_o zlnPK5P2_I@*Q~)|rkz)0=C$lcy2xixvZgOEk{b6>Q83ZVAI@!JTM(tn|@mzDAcmP%ywYuT-yQEI==%_ z=}WxT{rL1l2c!x>e$z>Qr^h*J`wu-yG7q3;D(2Yf#6s88Lz<}mR+}lj(E&e+GuBxB5ge@yr~lR#4L;o& z2|&C1dLqGzTX1$_17@l8=U2U$Wpv3`dAEa2X6Zk9{(oLZ(8xG^)-LGe>$4SidwwQF z-yH1N$G#h~=HQG)x6~Q*h8J(vvE4K8u5vPaa#lsy@dniv29u9jss(bvT4RJd=4y6s z5etp+>!WCLQXsmpv*87!zF;9w4~-auV0utw^cwVN0%ciCH=WA9wb{eu#qIhiGH72U zIX4hlxUX?r`X>?TTvYg(Dfvv6IEp@N9AefOlu{IpzaQ!TOC|F{1 zC-4$LG%iGbr_Pjg)ajQ0H%PGSgQn{|-ep%8%a$U>t|K)dU18(H_l4&SaT_Jmj8g4h zD>gQl47Tj6g|pcXHEfN87=-?Iu%sEF)d98$a*=gf&yBS5+}wgWVrK8r`_mfUNsrb9 zi8qr#U-^+_#12)gJu_6=@zedP7AhD8II}nX8tajsMh0fBU|}R*oy@5QB%q3~tqnfC zp=L#xZyDCEh!o|MOgr8H6;1;@oYRHdo^0+dlmZpSF`L%4>PNw&&_J6 zoBnn)KA%9K;aTG%!9VZJQgpWyTMb3OkqXl(Y`6m=qw#Wpk1pw-JVUN@Dd25@3FzfI zcL~y~|9)uyU@(t+(2fsu8+*)PN&70pq#i1T5YB{H`djmLV2O)tp zN1(3d5k1vmylg~$8;eQs&$}WPEIPC^nmo57l00K9zQh0rbfgzSliGC%u!9TBbI#;W2(cr|@to=HOzb3fqrT~b5Yf@&>kUSU7X>E#(hoE4$ zK}hu{O>Bk9V8wf!i;zContz(k@aJ}s71IaqacDSM7nc53=8pGHXk=0_u6v5zzv)?a z^`AqJ*B-SWJ*MyO(`xqCv_C7uKgjw@)x}Eho&I)wb_W`9M?8kTP%-bxnV&->fjK8Y zbAY!K(`>T%<)z2uxhHSe&TTEb;@AhIGIGIe>Kz0555-N7pb|I!mtK|@_o*Xu0Zv^D zI{UzPiU%LnI+bYYd-C!*WQL6e?XlWD@e#IHU5c(&H;mFfRi zGxf)sO9IN*@8F8cU&B(bDpUKo=cygXGWlt{{0=Zb?JM`7|C0Jo%haE6N}SkQiGcoJ z(9GL1ZJA~+%QWNOnQ7#qEa>LS(_dJGdTrE6Ppj7$&X~Bwn#COSk!DfV%r;g+zxJhPa95{OiF|EhtyyPvc<0_vrN%@h^Skbcu_HeJhbCvpkv z*uJ&tQPIS(k81<#jB9lJ;Hk-?LyQGt$AH?gZ1-DDz}QW%<7y{>$pqKDH#oC5azJ$K zODJfc+Mt^uxRxf8sDE)JFc;?toi66d?>4-h&4ab_HXq*kYW{@gS)v@{<>LH76sIq#c#e^d3 zq!J%&_>(E?e5d+`lEx36>RDxtu2X$+sBybl_~Dm8f0A3lhteF zAU>Hs$d0VoLPSbI-Zd3E_FTN6+kkG_!CSC%24uvW0E*3y>;q*SIa%0-fK}Q!XR*!P zH+hyhKjYp%S=t)!p+yw($&XHO5@+mWKG_wi-rbP)D%-!;;Gb-OHox88AAtH=uQtgo zA=%b;X7AcqJb^)=`*-6k{pMjqC0aV!8j}S_eFBFQBf|1EO#JN2zA(wka4~F1bXGZ$ zRP$Bt&yEmAee;ca14{J@!$)2r_LEnoKFRuIaz%ud55J~0PdozO<^K91BTZ1--FvtM_9AyIK=6iidG}pO8_9<|^!BUVfgW0N|1gq7 zNRzTtfQA3|9Qfg8C}#FN+adz(sjHxy%SG{pP`o=vyM^dMi9L(10RK!0F$Gmf27a4B z+Psobn-dtXi%KWZT&N4u5Ml03G?zL3=aoRT&5CdMI{#1CSo6v>8O9s$_P{*4npKA| z=@F&p3)O)OHi8+S}hPVQG@hOw5z z<*?|MPf8X=CXQYgt!@u4PJ!Uq%6{OGji$E>J_Q)cXX32&%qwzq#Uc8~c6PYzttvAsaU5{6Fx#yB&jLMIbRS>!JKqZM&s%Sk;G2Zu5Z z1}+_3W$C02`Lp5?-b@zXVX8F_Hvhu_hf zSL@H^{6VIOtC%dI7P!hif!ywWI4xCuz=fkX#v0$I5!w0uVuo z7zt!wJN;|D(BuwLsyPw7J}hZ7nsBck^}dmR^HyVgV*BN-3+Sgky6CnU1E8&EPP+2X z%~u}Lv{d^Mp50dY_|lC(>i@no_ElLv;u|z`cXPV|CBI|)sAxQ{uWSWRnF?f&eEmwL2&z&8gX)uI0KH=De z1TzoE0w^9sc-DkAAo$~*<`(MK078oMv|X1_%mXC%u8K`KU3D}b99yp3iFr2-YFU1m zE*h?gCKfE?LJsYdr7?^rmq-JnwA?jJ`KY+rN!%_LHRd-nE~kJZX-CuUl~XZ{s{;ecks{5JL&DMl#?^YA&;0C|$zMr5n5620{ONVPS)xjXlUD){rv%dTL z(p>(^&h@ET8Jl)4ky`qE5%4|wtXJGw3vFoAy>x4HRvs$t2<<+(b&jy6n1k!Nh$c9o zX<_?K2b+y43-lyT>_gAW^ajc8kaD4n^2iwtFk&_qu|jm;`zJ0r4N! zwCp~#@sO51gBuQN*)yzRP|KcRaN%`Yu`g`@QK@nt5lkU8Y5#N!zv;356Z1V0oGfLDfnLh^N6 z731C6ZW6@3%(c6YKYiz=tU~A}4mmJ=7+o;+_r648<|p4iR%k@$vW(E}Ki>$^|9)2A$u*H*L9YlkH477d-PFNMc#AzEwe`r7qLQ#%II|G<$BNBgDU+Ih%v>|hu%pafo9bXXpr|%-R@9j|>Q_LI~y6*hne(OzD zIp5h!wlm~TahXI+hZv6RAvxYZ*4)foCnECHP9pVn>I_S6(7F5ycSvwQ3N*@yQ4P<>QL*91gLL9g1Q_x=OxrPYexdp6UUvd4b~S%2 ziy^;CJd~t{0&uQqHP_1Tw817nVQ;fV!u$_@C%6)mOGvebk7qK@R{vD_i;)VG>CP<` zOU*meDwRslDAIJHiUq}Z{x>U*x>?D7n)RqTtUq;Qduo=MIK}t>8_`He)m^5F8!#F5 z1ZG8|D3)pvZ=BP^zVw`_RbiGw5woDx+TC9*rwXQ6Wty^lV#Iy^QIy`s4J8s+je4wPv1+8aYrf`mk0Q6<~_fM$76 zh^LxJy-kg;rEwjujl%6bRbt%c5QIdRkND~3=&OmDWm)@D^~b@*+VvvRnjzAulaD)W zXB+A?rs$Vzyk*cv_xE~NvxWrxDUjU76A7z;n5qmx;)msP)_$6-Ahs$UjZWpC+Zx>K zyw7LQFH=ulVu_Rk=?U>RT}ewg#Mctq8gkWy>EL$AaS+%5{#XKYw-x*J^~ixZ&EofM zTJ`X2mNTf2tf16KdP`gd!fEU_y9RRyv$4|sbz1WYoidB)NtdyRK6$Bhd!?j{?d_-7 zEi)6Vo7G!?G&XoqJ26jVI)WFi)$jUU!EcjQ2fb-maC*O8!J++}z~sWTlk*j;xyDic zXT4tyKD6Gve%P*HNx^C79SowtBsB%73GWW)7Pg`8JX{Z0`yMc>iSe5Dd^scrhwptO zhq_qhK3bG3n^YrQ>>D{W<5!vRnJj6VD>J{H?ct77SH1xY+%9n?U(R7;w-Iqm4u|9^ z`Qd}}+>`X&tZaa;y_C?u<9Xul{=@vg1>mrGNNY>$8a*xy`q2HL=|T z8p`=Qq=Eg{h%A|H7(Q9A^rCuMhg-(Bia}0aDxI^p{^!enL^e|uSNNSD;i@)qZdF@N zPm8F{T%+cWZLcvdyPXq*kKC;9Yl3&IM1MGk1nM)*g%R)T_cJ z(Co5HJ)R??fl4?H*;>y@7}7pRM+cr0ze^2g;A3;>!n5HWpXAvp%AKzqrz*K|5(B8d zXM=4Bsxtf)76`T}+e+#)X+a()zJM0o-w*y0GDv-|FAv%A`7Qwa^OHt_0U#NaMq!3V zfn7@OC-3&l<7BsmLUo%2#Pq}xjbMxeddce3JcAY8W|bK7*a#_+0WAQ4bW%o&30RpqceQ^=DIKT7UE9^@b|BIJsFVEey+~*RZ zv?R;J?rwUc&zYT6km20_seaKk&6j=A#598Aj_Ap+An{UH6SgSLuV*n$Os=$f5lXjF z#%6?*)CMcf^bvKU%Zfs)1;s_nZ8Tzq9kVR{N%*`5zbo;U_v`owQqD zWASG;S(%clDN*`cW}@g7>mso|`EyQml6RN{W=vH!SD$l5=^|dhzZ%<{A6#tC^GMnR zwdo5TOm%OmMs@g2u&vO5qyQ^h zm(q^;N(Bmq9n8mVJ|ykc%0R}&4N@#_(4!lqSlobOLHu{kGCR|eVoECzcfoI@AwZVe z!gq_UiFQrR7!Q{MxYj3^JgQ}yP2OX^+)5wbTYONSd)a0!0=;eJXe$ZeYWlDEt~|w79sbVVa>s$Uh=d_ zz@kjZMOsX=1eK$zRtxQi&5K@+rJ;sv$U2nkR@3~sor>)O?-Rq5O6+uB+$Z@p4bt3)&byn)mU^43eOI&rN< zYym;Z|NEPHp3Md9>pvgZ=XvIO=FFKhXU?2C<7ZgWgFv$yyK_nSyRomR)Ex${G$G7p zqS=zhBFkOrl2GD&Lx!8{3#hAgxjwW9peBw~6HAw#Rg8Pv+bmdKx~|xxccr6V5Y>-* zeSvy?!ARWTeMolY^n^7#Ax#q#LY~;7=L`YlsK_!ZPNk@!4XPBPh^zHW^^qJ=Y<|(b z3%ioDU}z^kW5R*_z?)Z@x)5PtW{HppKfbn9lLAY?(Q)CW8a=J}3Rd!G zjs&sCHYX0Fl)TE8#an<!ic_peOdtkG$fvK=!~mnp~!-*R~7S9FXv za>8G_L9W7uxFPpPX|82&)7*-Yt@IqnqI}%Xriin<+GhlE$${@k-dA6xywc`{f`jj+ zfzO)FMly^uYLcaNKYqIn|bPqPV<8KlzQ7|gY2(5b=MvruKzmd zzoQ*&gwrE>W1+!a%v)v-s$wI!ii?mZG9iWuu@?(kn;Za|RY>$nMDI`ZoRjr|mlL=C zST}n=l$*2ZDmdSc>;cNlU2a=u^-?@mnRB|^sCGMo2WK(o^`dQ7Kl6B}=5?6%@;WuN zecH1kQP5DeZ}u!7zgAL!9%WzA5-+fw#og~wUS!(NVB6%bf&F-uljTXv1-Rco2lA`u z=nZ2_w@8kTnJ~Lf_S;VVx@Mhqf6M41TV%qTTtJxwYt>(q*Re-hFGpevzR;~v zLgvJ;&0wJ`<|TfrBVlRMd#PStD$iM{I;yq_x4wAh_09g+q z1gzB!=hpC@NGSsH&Dn6CH64nS{nh&G_Qy*i?aD9c5MvFWZM9|-BiQ_fpNzPP-)FyV z)8rb+RIU9x_F1m;cyaB29Yu-X{+dqXXMavHs42ZDn?BvdEgH$!v?j8;S{RemZH-u$ zKzmkn6{|$1Ej1r9OR9fZMZ-nyX|I`J2Aw{BC>DR(T?jl5_l-2H?i3I)AMRDQJ07{M zIg5uWo1UQI+oZLqO7&)!@w!7Ji3iCi#TN*{mL2WH#i)17K4dYoI*YmC^ELplr@8h2 zxJLAUo9QmDS&uZn!plT{Vl(;=_}H0 z;572SxDc%ySjm;lB7W0!h=x_rQVTg_Giv43wza|jE<@%9`Q~7R0*_V!kl9E^QtMbk zX-l0BIp|uy)hwu{-6+j5Rd%2IUZTQjgy)^ME|QJjU&X{gtD6% zvK>*zFtT`S-OqAA2Ck;&A_+Uy0+l^`fgIIIgQkzepf-l(jpLEeKkazr40t5dJb2dv zOwF-{A(F%_e<9#&JKS}A6Cv|(XBUvqMwIybE(V^<>bg>?lox>kPiqxiCD9VOL3Xtw zVwNYB!`6AjUPA#_*~WQPE|Yj4EbRmV&x0a7`2v3BFeJXUa8P{A35y;S#CcUO?kQuts0Ab))FF0F)jOK^< zQF=d7KVQtE7r8|9Hh&Y#&JSkZ0zzrEXTG@B#*dmxJfunO%pYc|A0IaxT>QMw@uP@0 z+g#Dl>dL-hWHpyOwCAjAGI)7w=ZWgHqD<>9%so0X#4hiSKi*E6xj8sBCF+$`7c4kg zEU(0$jmNmzI2DK1#&Ebn40}S%QCiJPM`@*&(rliM+~o|#F>jWwn>m8pLg^B&&$QQX z<2J1b9VSt)dXcJEaZOs+N7S!HS6cQ3c78U0JD@Yif9$J{t!tIaCCA?vFg$Yn-7#wJ zsA#09RWWlH+#8<6m>He3ujmr)yR2$7KbKr5ayK4FheZDh8j ze4`z*VW+4ShX!j5&BvT)WF0`8WFb@bReha=>S`~Ye=17bX%`-*dEzN6!bHZh=&?A` zMhK$Sddv`(W7A^#t_TKf3X?GIiW{VaaZtnVB*V_s`lbbO%Oa?dQNKhwZw+jjky$}L z9iCf7X+y-)$?qxJI<~Q(QV{2k`fVgPR*1I2OS~xU{~13qO#2tmFC%T{qofg4Y%s=$d;y|m*=$pD6Q)%so5C;PPbpN!YE&1JhPmdTW@ zn|+~kSTl?WY>>*{nmtaj$uG10m39(|tjFC}@jm>flx?VgI(;qfl|P9kw|Tv|!w@_r z-$qyU=z7>@Agdm8pE|Tv8UJS2;cJ&nh{7vg z9Zydk)S!MRTHv?Krlx6|kH^-xzI}=3#_zy({0SSK@fTSlaZYrvgUR4?ypnKE8M8Fo zJeJgTCo*2q2>*bG1G%nDU5fs^3&;Zm@}<|i(W2BA*IVdit3;M$kEi=U3uPGn{x;i{$^JOyst52_EFQc zp>Df^`xR4z?m3U~yKt8}@+tjrROOu&A?y?wxnElm1dP5s>lNrttz2U4n{)ZAjT~DiN)DjjkHvYBkq^+ab}L5X`}jH8lY>}9691O z{RlTdyPBT|T;`kZAqBqUpg*pU@-Z~&UjfNo>Yw?0aI2Jg|LExAc>7r`bl zOa)Tpn?-ANAAQsH{dl_$GuD0+V3*hXO=A9hnjIzRHGnz`SC!bjFL78AM-*WK@ zOdsR(WbZk1Kz5AURl>{?UIDaB9Ge%pp-_@q`UoM(b$i;Md6%!vFb8>gYg|V%ar85* zue9yr9E;!XGiRe#9ZSsRBIdu-OLl#>%cXle2}_n#-|$t@U9^2inp--h0B?eI2~8OLcshOt}TPEwz6vqvs`oapK0 zVIjp?OWC33RmZ%%+LEd~uM{zQUoX!a=^Zs_@d=6kC|NXOjXk6r+wu`G$BZgut zDn>%80Fm$~{1X&F`F>4oK6vSjEj9IsEp-^)+&=HFGh*0R_*ZIC|1?pO6D6P9vjcZi48T&`)tcSCe?1QQ_W~fq@5A)yh z!Ya}H4IT=t+D9P?>x#52{Mb*o1qAb7CHGN*xS5-6@mjsa#Qag(!o9`cmp#3^4fB31 z?`XG=Mr#*_h z@nek1yNzvZuKN%5e-2(UTjB*QN+uxZ_CNE@p&<^(KkNE{dh)nc^YeqL+v?YJv@ec* zRvYnNs^3i-rxOjlPRZ-&_o9gqoj4kLL zSw7`Q+n&#>J6_nU!I`w~pvH}s z(qt9zc6-*=-emCYkDRnH2Us3)r2aON8EZ%D2UYz2RF$pHa%A(MbK@kkX;~$THD9r# zY5t{cO#;A$G4B0TFam$|Bb4$r-u;>C??;lJVhdW|`Hv1}BFnvz$#sdf`Cekh{px~9 z)rRDT#5%;*6-D$qh15hNRqJ%5G!kn1Fxu;-3>U9wduCFTnAEnA_k(V|(2O=G*K-13 zQjt3X@If#@AuIVeh+tP;ORzs!kSeS_ zl|$5P>raBR)8RRBgp-pHXi|kWF1(+4Fbr1hhJRl?2*@Ej$d?#5{bt!;nM>d^VR}?VFUreF58-fk~X@ErG>dx0IEF4jLzcp33g~cOTUpjFMi;JiukUt989%72scJ<7< zf`wnT@>*Ze*geyFA8*57Pkc2e7o6YNJzI|0N@uZ2Tm(VgeGiFvM%$QQnEeTk@_CCN zTtF~@LPC~*C%4d?2_-)LCvcR&0+$uW8tZ69%Zzy?DC``6)6u0@P!e~u_X+8y`nrAE zs*3ZaXl$0EaZBqgF)Ul?lo;$Nua3)cDQ=y*fmFos;Wyc$+%flsLUfrXuPm`!|ZT-12Wtmh| zVGj!Rw8dxRiCr`6_f=50nfn6*>x1rsWPb&9=XNGlkUf}G3ip%d5iZFW!~9j6`vu|p#vK`Dv}F~R+}L?Q7K2qh z?XwZ-^&qoxx<$UFv0w|(>rZM*54E7vmO{Pq1CVG?jBe@q0L6cL1Pd)vq_5|Cw0zXR z4et}3D1ZNC?P?yxmTf^TcTE*2lX-}vwd`$9Oin3a%kflIrEvXa66FsoOQdm*Ms(_# zg7*n!r{4l&W|FfqIm)_MJ=+fX^~?{g!|W?#!)*B2M{8?KJ2oBuWP0x7Z`z6>d_ZFb z*b{2g0v)P$(AS#b6<@a{!-tNSvI(LsBw1#K_DXd_VL<^6eh=*ke)ZUHH~A#C@`sZC zH*ji$UBe{A6S`I>^gs0^Bx#5(?oA)mQc1bfcUXHZ?X9C7M8;SlMr%hS#KyjXc_@w_ z4JII1sP>SP;az2v;hS}{4QyVzP(_C`e}cpgA+tH}aso)~ncC@mW~cGfVoM#;5d=q^5s`r48x<5bNb!8Dj!b(JXNzc00m*@4^N_NK2gOD-bl2KpHO zw#+5{Vhu?TQ_|kItEYExk%gg;p|T~H2-!%+SRZ9(E~{B ztyq5fkN*fh7JJ)2U?H=A7M9lZRA}AZqde?vYN?HZdbEeTk&}n7TDgjreCa*N{IZ{R zQrX&H_<|t1VD;GK^QrL8aiX{Li%(wJKtj04vwBvbfPeWUjo;06M+WX`c57>5v+w2?Xr?!v-SY+|X4$G| zBvC{au;SUN`A>{xC_Hhp4w++ub~4$qKpV>=<-Txd!L`8U|9yh&%d!t>*@_{VM*>1` zQfRRFgui-a&lJarq777oXNJh49|Axw31U>FaXP)C7EB|d{FPP#n+Litq>BdLLLfZSxEhw@(RwvRmy9>9@STv8{Vu?Q?+{}?d`|IKE?my|`T)LXJGQ!2n6VRZiz-6cHYN3LrtK<#kAchI&T zX904BkVoB}+{78%fXJx5iZJOnHrJ?M!cV@;_$sDB<_fqpwpBs=ybB21b{;={&$THZ z)~!V&Ng1*Ffq7c-x2$SV*4Mt)Ebz->9XT;KxPsg6B>6##?MuPl^zb2L4&!_^rBdtv z{D{axMgHqY1W>Kb+EaDjK%E-@u9zv(Y1yfwHx*`Ve_Q!u)O$XAZSA|ag{IHd;>>y1 zL9hA65Q&utke2!&Ab)7kw55K1d*97n{q?o7oW=jPX| zeJEqz^wCj48fD`i{zr?=yt8dj&zwpB^`&~#`y%x;Q9k`lv+?7n5N{8Ue5wHA{r!b` zQ^_+MA~3h8Br8Ok-vMT}QJ_>N|6a*?mO~-O8&*=hR-`Hj*?0-;bRzeA?SVrKq!+zDe?J+&a#oMjb57Ucs%&4kNaq4O!oV)qzLl-H z?f~5E=f|?WlJ6!y&db}nKHIpt{>$v&7QOD4L}NFwpP0+ivP$KdJJ~tSn3=Sx^_Z@+ znUgQC%gfEr(}dPqF9nX=on&!QmL}0qhIYZFHL%`@Gl7s0shLRIC89se9skg$E8V5T z@^!9Mo-iNRTeaS5^~Sj;Nq?_%D=A;a?X~zNb5M!i5&*d>PU~6)WfikD5+zOpSJPLi zVDwz!Vy`&l9Th%C4;NZ$yt8Z@&iNFQ_#VZYwf_>FCmx9KY*-R?%0r2 z_1ZfDuel@;GOhe}u}}XDE9f7i9rP2Tu}B!C+5=%463`dR@bLJz#U$Z5uKZn`V(P>N zfK!9Ez;1t*Ua%UGDDeVM^XMjs{%3m`f04!WX|E4MT<4Ozp%9$D)k}@|QqHBe>g#nj zeQ>e>5}&4lK;!!dpGQ{2pSrWWyj7ms9*ry+ps-~4&JsE$8NQ20qI~ADhqoK?VI&ux zNih6*)R)2uEG1{jS6HKb33uqY{J5nB?mOfem(7XdvAAmwGMXKaT|iswN$7Mj7{XgWg%Hm8ogzeuzpt6*MRA zCHr4+gizQ2LLS&Zevgc@9S@(vw`u*NJ5mDrx$yNA1A^Z!O^py-^9Yg7WtlLbwIce5M`9mL?*7{=At0>q*4vjvnGv0HrYkq zdKcmq|F-&{t(51}Z;{F=Rkz`!8Ts)LG;L_C&Bif~&e+3lvW5{Qs)8Mlmm-U`eDPBK z)>vWjXZpZ6)7Sr%eHmH2R6!t%v01kU&GOD3lJHNM2A+{#B`PZ^Fz8Thyn=PfW^`^@Q!k>iykz zeNryj71L9@GGv$7Jivf4_wkdlv}w^M;EGJGJ&+I}PaTAP(08zZjx25iykPu`TNfkQ z*mIibM9bGV+7bAMnve=V%~y_K2nv~%U9IEkKf10_ks-v}n|{ud{y3QdVhhiWDXE~$ z&b?&Um>Nkj%3|)?OM;QCQ@$@l#OWNz0ABON-*;(UQy+#GT_;5vk;0$1Xic4Cg_6W9 z4O+&?SMW47TQz?k_XhLlKLWlSP@3h>hY2@k1Aa)7;r&a{qszX4fp?kS4<6l}>Dzqy z7r5(&AY1O~=<|6R>f_gvW*oHMl>n`o$l`m5Qzv>tOB@XUl!(q4J_k$dPFzI;&a>m2 z=FUE!o{mBR#mPR!>h-vtG$@Vzd9!SfywjP;?f9UOVj+0s9!ZEP0a>Lwe{vG+#+<-U zS9?Gtxub)DPY&WZ9+PDb04K7{&L z&_^Mji9YW(s`MDX(Y!VrNL$Qg+IR^*!9bqK(OW1+eclsyt3R%`MS zI|kPsjt|GW!SL_2C>I(__1afSly%RMUT`4w8NB{$x+eU~?VV{*0q)N1Z7Z~Jah6ZShhPSwuNikHtk zZ`nP^t{AIp7`A8e{xZ-Tw$;0Qt6T1UDMt)m2PYKHB|`@{4y!oqhAnvI_V=A1ipU>z zr(MjG(OYgIX`MWLLU^!{tQ@ujmowa&WxXeO9Fh~<@`7?d&nhsf25EVHCr`#sj0ZCv zOHW$qj`i{4AD;89UX*c04(oKYG7d?`kxJ<$!n8TW0Ek&aHD|Mx-3iB5NMPVCd_i4# z!D?_W`G{IoB((+y>O@L}YJTK=a@S(WR)p9uI*$c?l(fC;r5B1A{H?CV7;yMC$3>#t#Mk#Yp1O#S+xYaRvwt&V zdJ{3vEY+I?n3=2*?ON2jrLi8<@Jl5#2)2Acy3T1fP=oo)5wLM6+@FO-^A^9_>%ijI z^=&;TAe?`RNaGn= z@=tZ~mnj~UV*f|H`Dm2;zHEs(HYVck-2a+Qt7*CGnQdZ?y3_{4aCycjwB#!jBh- zv~Qk^ewx>QE!f{OW=UfRfKjN*NS$|dC zfJU6$yZ}SkJ87CnCf(53? zyv4ST@)X!ron4r8wC|riq8)blt6w|E2r5fuU%E&2=Jd{$m^q!w&pz0W9)Eo}6w3GO zs1|SxO?;PH{qKMW1evSqNpQ!|m}fV;Ss_MeU5bKb zgANcEBh#GeVi3EDiC3lYLnd>7)yrw3s^Y_`+|$buyi`K*-QrOQA3nwX6KtU)f26~o zpBfFBWIY0VBU_o`a3$FlW-jkSy5)PNEKhw{|GW@bp*!qrS!B0zZ3)Gwm(+9Sur(b! zt@ZJ)Dn{{b7=qdC zLo+&K@3;B}dt+yHhdspM4?DWmA45}UbKi5YyRlJyBVn=@cbEKToCFKM^<$#q+}?J`)zVfb?y6ed;3b&QE|+F zZD-LDwV=1IxTrav7s4n@D>ZEAQU_ZOX_e}fzTVWG+dYKs)O#ww1mx7=_QbBFpU=v9 z4f<1SA$e{A{REYr8|6vw)6*y&{+=lR`N2L3utLm&SW5!2OPL>ae-Hen2-^@x1XCOl zBJk#r zm7}$g7tc=G<>i=C4a*VcwGO-hts zG`yHK^gaQyeL-7&c7&LZI59TwuYmqZp<{ zBq9J)ayDFWx=!6BTbg_3$;({Ao(a5~u?Wa-?_k)@^)`H}`LAqpZ6v+c!rOmIDS9_; z7_a1;!?LkN`O`&$cK|l(R}jeo$e8&98!bRALm$k9qE*T88Oql(Iwtt5QWbNdk6Lby z@lq8tD$CxUb-K`mgM=n)#fLMdp5GLPOt+t_v#oc7@pBX9XWELQ)H=f)K@Ik%W@!UQ z&%oMN2|X`)ZY}-~l#nx}PzYFjdx!aIv*j?-9kw1qsQTl{W7$1$`>W@=PKn#PS}%o- zo7101)z!^1bl3m)!qNQxr=x1H{!ElN9Y{SHj_#$V6q$Nghu1QuNR1>6-27T8>TpmK z=M?LNn8~yQ0&*B3jKP*MF=c2N71Dttr0_28(}bEhzEwqIn(L-bOnGxBmU*@HoZlM0 zHq-h!5p>^-3sxt}zh^6Cf(eg13zvJgeY@=W3;roa(~9pc7Oc5s?34@mFof`H;DaL zCTnZO*NPkS66GKD_ZxUk%sgcaz?;Xcf~sU?to2$ER&q`2OrGMU)pl6~&*WUgF^uwc zXF7uNB(U^9iy+#s^4tViEhnJo#yH$jMil&y;{EwgJyZ=3^!XpWFFB~65>a%%ihj*9 zkN~x|FI#(vV3#u>VAJA}spkS7S;72o^+!9TKbn1+Bj6Vryfj(^y51_VMFV>{8dO+K z^Vs597`q1kdw%Iw??{e*&2d-C>#?$-`s7@orY0VK=*!B%IkIv(UCvh(BPeH zE1e19a2tgKMEB2i8|OuX94dHI|{Zi#{FZw?Xaw16z`eYOyc* z1N`I3XpPxu;gkH8njCGo_FUipYGl!7v9D{-3)K%X|2%;V>R7|vsZ3`NP=2C(Vvwx5#2jXm!I!3x%qvle6npnl5=y9; zohU!lreS9FU84N+XaI$0R@>CbJB8$RQ(lECMx_nn?5f_mxEERsr^E3u3BFpVA2md~HNX0;?Vx5a@fO zu*#lp+!IQ(^y+%E7+W%BkFx&PMNF=_($9FE}Se92!Nnh-+V+)+bq-i*h3fVki*$Cd~O9qPP zS6S2{p==iYEa~t$|LDv5`%j<`NoXw88=+d$_evXZdl2Bu4_D--meQ3z!drirL$mNZ z`wE}7OX0E+dTVZJsJ_s?2Syff!I=}Ep!$z9pzjnq zupP|kS$0-&OMW)GwA!s>K z*Ecb*4;axQMC(1zy6#HIS0e_S902T%H}y28>whV!_0#!67OGMvGM(?bY;)6dChov9JpX}Ym;!nfq|PI*9+v!qQx3h%$GI- zD{ae|#9zodmiT_D0adVrIs4M@u*6vE%syV;^HQ&SUh-@huV#V7&e%b(vjXln_$|Jp zc{>y3m+V821_~3zo=KiLo_l~qASgzx=;`q3+-$uxU|OoZ>^gpg?{^=gP24v?f%4 zjpZDUy#T+De#Y$<$3>jL=ChJgjW*aze(|N~_aE!ROd96Hqr`w=Ma>m8h>`q5Z(%Xy zvq>nT{mqPg0-~R?cRnNjvcm1p{vEorjac~EDgl@hf03`j!1wo=z;v72@en)sk6eV^ z`_HoHd1n~|EBq803Rr>vAPq7DO41r*K!q~(`aj0djvMjraD4= z$kGl3HPT*^v4%yo`5C7?0-of&NoTSgOm+-H#?oRB!9F7}sX4Y(O20=@Y@XUA{{$#<0McyWB1R|dC4 z{9p9?f_D|Zf+X<8EO$MV8l}l3hE~QbeH41=?wFvR|IYPkHH~r_OGbyKitn4%)A-~aScq| zTAmiuSAm~A0Yim~{+q#b|bsa?7{xd4)|AdH%G0N&g> z%p&sN#|MZUJVN^O%?fVEWFHm@<}$*}e}hEEzx+ixT$=SXDSLBgcsj{1)ZLUtPmYr( zX#$XOd3n9=bE!kiit0aRYG?gfQ&9iE&7;rF%f4ynueEhUC3HQ$mDShhB^Jg*KL$o{ zV)wU>2bL2Z5K=ROx>DJ*~%;4A1jdnf3^dL9I zy&6sl#Ur;jqZ`~NEPA@AKR#tsWh;oG|n_`=5!HFj4{R@c_I=rsVjZ;3+RESA)v{$g8MOsVS|FxpVZ`PHbVGB zh^USx%6E46r&>0@vuGOZ9{4S)$Bmz-*&oS?OA8e){{&K4D=jlsTOB)bJ%q`TURle` z)4Z|;1v9C60gQE0+-o_lMlh?l(KN5x;w4X;=A};~GT-{Yc>2LE;|yZ0mI!tlSQAUX z8~AA43`u-5h(s^0s&SW_|OGR(!TJ%D))5)G6K24^nBPSZ~V)S`p@%! zz`yLO*y__+5XTcM|3#7PrzRKbg^JJ8gTlM;FVHBi1@(7WKNNIDDKnL}11Mn+j^xJI zEyVedK-TVz1!K$cAO;#+a#T^;Q2w{wLy@xv`Ue3t|4M(?X|ZBjMVxeZsTJ2Ol?-n) zQ&5~C#P5??(SyoN||6WZ6 zVECE%eA<_bSo%VKKEL<$R;r;hQVB@P%InoXbZLwemI9z(`!6g9)8QSPrLq(G#%X`o zEFF=JqAdXQTb>U854PiJ|pamQau(QlCzyy9b8&4Fzn zmRTuIg(>5YzZq&z_nQMH-YPy=)TjFw-!AtQah6`udbYB}7|x8sFJVizMsZR*zLRg6 zJ8g$TmP@Ei-NxY?l2PCFmqFQrs25J%?;r=ZF+%)>D-iIMA&MqCBS}Zk6VGGG>byFU$Iyb%cto zw9?A52Fc|Wk=vgi*K6I_rMPCVEDP0No!H&&y1o^O6{@IP{ia@?p|C+N^ ziH{C*`E2Xq{Xdlb`wRb5*$w5_iFMSUF8Yvvjl(5ml%Ya<4Om11(A z3tzUVIXsShdF&PqI`K_b@E`awcIeIjilO(jlfP*TnBx@E%JoUx+B$9cr^7!|io%ip zy}M`eW$AO*_wDt(rHS|P9q~e~FTr+I0rbDmpYgk>05Yvp|FeA~lPn_j(xr4R-Z}Q1 zExPQsV|e0k@z)*s9e2IC$1~-2#dqb^4-G7}1_mO={$66GhFPc{D=sn9P~Fh<6n4_> zo_Z!hroG(xNTJ-5e0PTAcux9fTU%mRH}o}$YiET1zX1Dg8~2tQ?ui@mLGi!Y(|z7o zAjSVAX0y_Ur;5}RNd8H7LC!OYijV`1?8<SMNUScE*g6%Z63#oX%VFn8nB#67$_tgeUAC0U!j@L1spHh(7^|a)BRBE%>ixZmB(q2)b{8!sGji?zj}_JP;bsucXk*2=EA zYMl_(4v2@F>Xx{s5^N>n(XgILuzN7&-q9e1U18(|J<3;XV00(mb-Q8Hy!6=O8Rj;4 zvoI64>rS(X3DNRz?C%;Et0=+1o$!pes9na&{Gyxo&o|9FNwT6BZ1_Jggu7c7U8COB z0+7pE66J4f6WZAG=xrWk*Cn@giLbWv3b_A5(XO3wZMarpb&;^UGYCy~D{BIzBfAo} zw&_AjZ{M>gDdqd~z3cybX+c0qYGo1UbBzMOz0b#b3ERP;`jbSaLj|1G8X>xGmx^GR0+>_D~&d*KE&D;ObWpP(@v<--@-;b(!qst%>^NL|rH zQ=m=klc3}xROZ+ZS;rq%c4u9Vl_OVEX*8-c@GOSz*k+N6q-@=F>_peXKDW+%CHq4! zT|*0x`nP%t7fI4ar|?a-i>;DCWt5g=$npCJE+pR$${;nhltb)m$$>wK9 z5Eqyue(iS{>$~rCKcIHi{Qg6%hD~AeX(#CAlMigzc|cvbVdug1SGyC}O&u;Mz!zrI zrw7Z4p&aAQ%*O{3))ObREgFjVLNC?tO{;&v9d~Q*g&*u_6Po(;MvBL|85=nbKfT16 zpQ&d(NK|W&k{gscH)_k88cDO%i0YlUxq4WJgO9P!L*J`XWM}LFg zNo)@XM3&!Vb*ZwBEhQ&_b-W*kRh>6iWHY1d5Fo7DjQfk+SKd^7j~WK)6nRJai`mrp z^Oem*`hjntUo5r0>#WXAsu4>!=)UkE`mWV)yA%Y02KziO=avE`8sC-W@9^dtvvN7CF4ZzjoVTn(A zlF3Vc<&@5Bp5OvCe&ccCOEuD6P1A+F7wImf`)QE;S5K&D+*02=gV)Dytxpj)Cfx^X z)-46>v=!d3@j@F*1b3+$WH3oSS>k5z?y?5TE}$rmHTi|a8^5UUQ?Y$LMaSTe*=a1Q z52UXPw+fY%TB}k)ePeNhLMZq^eON(~52C4MQP)~nNFNxg-(LpG7v&*m(y;9t065kg z;Y&SXwjSpcSJmHf(s6TijwV=^--?Kfw2puNiIzxXH(DZH`4L2Vn->r%w%Jj0$ugf% zrJ#$pVpsGn`UNXr9Pf`^m?&#=UoFB5+R&6YL%wEBKPDWzoLwq0QOmX;fdcUNY^Ujb zj}KdZ;NOlSRepQ18h`4{ge){oloI#u-%fIy4`Vz7Ow}6yXGi{2ZApmzpb_kk%~sTN>ZO-UlhBgVufa2j+8|jWZWoksoOchkA7fHaK9)j0k$Fb1sK#CxTCQ1 zD>r9ccZrwk^So;OR0KQHZi)#P)T`mL=~%Q6nzUpSt^F4170hp*qC* zGqI{#DT>T#$GGkR;UeQD71h}oi6_~_Q7=8FnrUIMO=O|+mW+|*1#p?{4y``KrY(GC z-d%oAw{FxNwFpsNbl- z*{`&I#D|xq-z)OO=Gd$u zaUSmfvKD8%gtJKEzle~RUG^Ine&X=f?;Wx={S&{BZlmEivU! zhu<@F;_JiIiG?42G8Bg+g%9xnZH0f)XR7c?`>+~G{DAfUonn>qKIPnT%r|XzApqM5 zRvx?(J^5i++Ht^T>fm2~znC?TckYrq?Y3pG6lqO%>=E#f|LFa~IsSm@sJ#PLIs`Yr z)kQO@TeXryqZVm=10_hn+~pjaV?o=jDTl1q=QF0;T7s3n2(()20Jc_Gjxf^=)Yvb@ z@1?yubX;>XJ$ohe-QyD>X4(NT;umhWgU`d6g~z4`t9LSx#BH#V$z3^+n{ zCpD~iR4W=gl&W*myB_{O)*m^3hkB&{H*ux1`lzo8{&Zg{sx@)jdKLz@c-HP?u z`3>}B6*eooq4qF;IaO-XNTV$M0{Aa&X;3YBc?f;B3auQ)!e(SrkEss88s9^39Y~f&EV4e7jl~UsW&2UqvoUp-7oUmJu68bx2&N5%PWED2|Q*=oPLO5`2a_z#kY%_<(vKu$#6ic7<*`oLUZ?G%{ zPRs5iKdOBq38NgslI=kVZHCH6jZ{C#j9=Xa`<$gJu3We(is&E;^-M|E6q=npuPnd# zx*=$cdsDdiZCACw@aeT~Lfd2RU(=-q^CkxMoqF7_Q(e`1A9(_d_#~-5ih2v5XDvlL zs-wd_6_KX4w$2GzjLcaZ!zP$!zj2&`Zt3z-Y0lk;Lek+cwU@P@U^o3$ zzUu-rRUhea>&~cef4a`bvdVJv=VolP=Yv@ySj2#3s~Cz{*ww=}^w}F{zUs_pItq zbIb9x-w9XtR~=j0xno&8HfRGx)y7===dmYB)A}Dt(`@hd78+HqA5W(d-|MTOe?L_K z@qT`eHz>Zx_k66Hb$)z_%fDG&dp2EbuAwH|zoi}fw-ZR_A4rjucGoZ;8uasiai!)9 zz$5PZ9X=$k{HXyr<{Agdv;YzpKPmvnOco?B)3xRkS4(A((wtopbf=_yI;O8l{LJrG zE8%PS^ld%1#PYZ+3lQ-J12If(&b7^Af@4V*)9&UtSZVRZ&ke>zYRt^-?a% zo6ZPtiX%i^{pDb65WkAS4d%$jnU)uco)(+?>iqrysyF)yy{YgR(wf6H3hq^Z85xyR z!IiSVVW@C^Iu5SP#W%b2d;gbzQ`bJj?CrM?37ttY^;jT3aC6?Gdx(}kQRrFJhQf_+ zezF6Lp6$*5 z9{gu(Qpf&}vQ}W&&ST!!Pd{t%JnySIgR*JofsL1k}!*c#bsnz;!LBd$?C3lIYn4isn z+U_CDzSv(|RToZG=VuR-%#|I8pg;Z1OP%V6vrLH^fyZrvsk8d#>r7#R&THHG9pjaa zX2i#AP3x@oe%@2uH%xb~uUpUMEEo=a#jQ04xtp&TM!k8??~JjTt;8 zX^nx?S=fY!EAvDAl2^{Wvh7!AMMkI^8j4e(zMeYC8y=51HsAFvVOCaS3vF?D`%%$$(&xrrJS6-_=x?}wU@WZ||q z#cD65Xtf6HTGJ)_hT3S-(k^n6su)yP8ZCM zMT>vUKGcV@Kz0*oA;N0D8SFBnxi-tGH~W_yQ}6I%^Uu!ZPpq)&;X1CQ17_O|?`#J1 zZwwHYEmhp26r3~PNjR4ht=1zs=rcW1gI=*;tmpgN@Ro&6+YF+$8vGft=F>wdD$%Y` ze+t+f)@%3NUh?fPCenGio&d6u!YlLww=?GvmkM9Jd1wf=s$CX%A_cH22Dd7Ep%kc* z<+oUKMvl-fy~~<2a)j2IGoJUqEKz^pfI^XsN4hv66Z6(gOunc)V!0&e`xEm_<-+$v zOs^A%y;zkz<`7a$Naqi(!sUEf%Yy%61-uVI@+=7djw}(kuSzep8Mtg#r3_w!1DC5% zkW9>5FFUd;b-gTXa#%}c@&#|$dU;Q(8vH&Qj2@L`UsXlUc+K+nD&3zt1H@D%FP3Wv zx}Yk#3R`wFn!zl7?pmvh*Ndp34>eRVhU2+V5*i6VKTVUc1 zt{U8envf&lbv!q_JHix}y1|x|y4#k^1zu%qW)Aa` zH`-6j5i&mS&=@%TP|c2ZYsvnaMgJXewGN$J&90#xY3-d1f8SGP%ykYgo%oAb+W@@G zxIM^);sdTzx3R(eANWhapOpWor-J+y?fIAg=lmlB`ojz(i=A0uKTQCj&E`7hg- zz;`|&5Mh?}pF~0n7`qAu=3EMwrlKJGSjU#RciX;G{qn25G`uCS+eZRfSwwlyU8X*5 zX=Wg`Rji1shQ+_y)n@L6OsIyLd26JvD%z6h9@-j-s;2vcnr!)1e)*nUeU(uF#WCIM z<;%!kr27T-7u#XkYu$ z;2~6g{2rAz5W@U>8?`Uj5V>{a~T0xDWE>JnDCN;FqAi)qkFke=H$!Hbec^+gpCd z-T`AzV6Zi~-c-MZWSH2|Zw~JCyw7xh%J$8=yV)DO2Eg-?Za0~Sc3Dh}gp&2t!6%<2*swm&MZ(l~{$q^Kd{RVQ(D>~~9oc#UL+s>@I>w2zGkIVEk=5f(Gu@}#p z+B~-30El?zZu=SM^Wajo|4n_X+a~?8W4FCZ`$wQo++_aE6&CLJI@93A0A;5C7hUGR zpVQ%e0`D2|jSh_Szy_a#v@_1u4;|mM^d0PPAu|u!|1Zb^TuQ}^C;hY0{sEXT(z;Dd z;-%{YQh7nRR{qH13{rznA2Vdv*g$3_p9_6+XChma#fNF^6kE=#1{KpFyFLnwqa%>| znGhFlX2l1eKdX3dWci40iQU(88!3(vF@9&o1DUtJC+jq#bqm*fxt!8$CwBL~{>;Sg zUUf0v>gQhympbhHt5ox0R@bbW9{`~2jfy(t{5nM)l8gEoQDz;dQ;lwVwDWW81rSwY zcVVQl9HyPWselq;1sFhGTuDq_eo0y%wa#^gTiF}v zwl-~vM3z5hCEx{ZnfTJD^lIB5Z`d6O!jm^3URCw8;uUYJj+pg26`l?k|1W|F_yxgn z>{FqC!4WfGhzF&^q4sFxOEb!kFESfkyxE+~uJ{4On>X!wb9-=j&||NGAfLUce8<^4 zHO)zs7tQO~YgV@0^L_;J_bu*xV;B&0kag|a5`Idrx1BJjIlSx@OjT*^kN?M=B`{Nd+GXjhQ)ZdAhMO1#dgatO z-M+Mea`jo6T)bYzgE^#z!Z+RCo+;cAFul1Gc|0!SS-?YA&Z$rAZtv9bsP+a&9;(Yj)?JFuO zY<$-tD-QG}?+gxQv3hLq{D#9GGjFR5I4@l8&iC!REEl$AkCZ}3*xYKiY*XR-YHJos zeXa^V$s}D}*}L;Mu+XXhZFBfHLI{xLuLd38|Mk~mZ-F=(P2%E!G#Wc`s1<)iEi z=hMRT?}yIP{p)$Otxts~6QQ#r!&kK~q3r85c2q8sFF}4zsa5?8X`Qd}&;CU*%c28R_!Yy*kPc6qK>*Fff36Go)gc5} z4Y%h4$`2rb-2?FB0(uN5;2;GY?gBoP@;s)1{w`o%2>}NxAm0VdA3}hw_RA95X&(L) z&;+P)^f`yq8OWbGj^CM0TK?b9vJG@k4Ol&f&C&;jSW_{Z60`4iPT%#*=D$$+6Xj=E z3Li>ue%{1zPZj>tKKgIrVUB0R+P6!^C5l#(Ykw!!5`JEZ(&5eAWyjYu?(5H7`N-FD zzJTN$Aj#g|wQBoq>mT6r_5#Y;hjPrv%OH~kIx76XAFRx8?=>@lZhrU&DD}%INt7?K zRM|({EHMdMG1<%(KERkV6WO&vwUD!!?SC7g*~853T`9^-4J@`y9dyYSa=DqD6TKfxO?0=%`%0Mip5c-D}nS-c@HOKB^z6z=d`11>DfGd1jj?mZ`I&h zaHH$r&n^9xWSMo8&dPV@5<;DPq+4hyb8!)bq9uu0cen^8AF@{d)?G*@--aB*J79J& z{bgRpouS37Z|)w%S2R3pEh6fBrwZqOFoZjPug9b-{Ez#{b7wA3$DFQGKmWIS?R#nk zyF{V-F7EmkQ-jIt>GV_8t?@*&zE!N`?PS z9oilHDu~}a$`2e?-urH`b#3?*{*6OK>W!q|wLtWL;(bPgc>1e+ph5r6Cluqo8 z%9#I)FK3;TE0=4O_IHmoP~U@Ei9&((%PGIgEC>?!yfoq@9r>X1)1cu z16PkSKt!5|w>EYVruQL zUuqSQs-9-2`bAvI8LCY9=d2mOkwr%;Uee3|;hC^zVrr@Sc4FC5;k>@LEHNVI-01};!OYN&M&7lgJ5jZgd!KCk>qTei$d50`t%AE^ZB zBkHAQ6_^uj5xx_`2?ecJYZN58zo+#Q@n57=h8CvPb_}ffU&g?gZf*=XH-vvCC{ezz z%G5ax{0wHXxWem6>V*GR>i!ln)(fwV?cjwFdK|QXG@3cCQrgNMDp}&J5G}i(n%0Bi z@}`slNupQl;Z8@`0?h+1V9itlBrch|T)^^50%8hS>H-$!0_M1Y zY4YrUxKdo|0>u1gr6^XqXYMs{ft!MR{k(k4-x+U zeI-(8l%deE?RpO|FY3+8b;v-$a9R($A0q#LT{Cp~4)C8r<$zIQy8p7}%#q1$x=-G} zxR;e>U2#;W9*zYHvkt|3m&GU186>=EWcA9vs4o^U(Q^UD(*MdZhn{cinoHLJUMyG- zzPn3#%Dv=#ax<7Y->ckbcg>w62-pAejTQ92Zz<>d&(TR7yZZ)*$BK@kZ+#9mPk6U( z?J2x)B@m|uouP-O`Ea@3VA-Pre*N__4#k|qelyGGQX&)Oe^@2f$81;_<=f0_%&}Yq z?r&C*KRIYOk3{+PO6iV`)da`Jsz@%rQj-&bCD1I|Jo_Txcuu*?2F0En!YNDa;ZLzu z9U#sZ2l4{K%|5%Oy|e*^+n*r)5^N_5)5@9d|Ln6U0G8;;MLPTd@6gx0Jh)lHp6ajF zCMU~vt$DOea^rIV^riW)z?9+&PlKSKtN*)sK5k=5hshd+R8hL)e_vZn=G%tb?YsUV z`;H+3{^2;!q_RD<32HWDus3d1Rf(@pC{l1#`h+)a!C(HF?r9ELpkwl1WI?{D{h?NWy-z#+6`?`tCRIuQh18omVKZc$9#M*~LvQ*vFV%0WB;xnf zC~S0kQ&*q1CZVIODU#McD?npT+<&Yx5Bild_t__1NoEY1^6}|1wm52fKAs2i8%S-{ zJvS}Zi$x!OL!R1 zT9B+Y<=mF=aeT_2mwc;Wim=VXEU5C9eg;-dVeA`Wis|qbP_Fq1 z9Xjt9u0fN-_<}c>$KoO}U2B_KXcaq{Q+z~c+HHfT57#*K$HVsH`+S&gb2RXzYr|=P?@i781RR?+&%iQQKi&-* zL4Wt**X&>Znx+S7F_1~Dnwz_Z6|K5m^;pv4!(HaxOd7&4tsAc}fg`{T=oq zxW6Hf--hzvtbpUy?Sm$1ZR;%LYWUB9mal2w*y7W$A3qS3KmRJzTTk_K#RGIP_e%oo z0d$Rd^r3IsR)pfj{C+0jCc~lUG;jyy=@FLZh_J7pRap2N9u4K8wS!e1^wDb_Z~UeD z{}VFO`foK~QnrB}uG@laY7@`*)Fr$Ouxj8K@^K*ry=0b+P`7L8M&ep8d53Hvd2Hd4 zD1U}lT4sO8`+S?57x>IxtC+4d|`R51a z-~5Qm|6Wl31eI@tHqQr3;<)>5fcsC}E}UI<+a8^huSvJ?&GlesiFC4OZ34|!pYhK9 zU$?E)+jB8~%uCm>mx_Jiz8+U7_G%7qrP#deKB@3Ye}bqcUI(?9-)e4XBsGwtPG0nL zUMvhZQ@$Ct3&Km3ZwjM#&D4(o`!DgTE=`o*1ZC>rZz}vaVV3@`vnT_kgI?AaQ}}Ko z$bM}P>gD|YaPnWtyZ#d8Rk{3A2vh!D>{77WBvrYeDyN^L%%5DrTqarE9N(XG>3ALt z|NTd)A=Q5a57r-VN7BC`L1l84*Ytiq>z8hDw|?DldD&ZY_^5Tboq39n3|)oi(b|~f2we(n$Wgd>!(e# zDu64HM;>~g^<&F%-N9sGh(w9+MOKD8_p45@>XPintukjqG-HI{c6%C2M^B#(pY1LgCqmJ4w*4{l8)G`gPb9 zhNoGlS_%b3X|L?Kx9BR?p`TL45 zQPhow)Y-nK)B1P7sFU79K(Xg0RKor!Nt?XxrCq4dsVFmTS6~EhpooQ$bhdz;D=b z`WxiP{N%)QPlyq&Q;$`v{@=~@8#fEY+@PS;33tGnaNrqfd<4{|&kp925{iB6JvWz} z@jZvs67hOEuJc?{s~WX%aC6D%ppFi6$#K-tK9|HOdcI%uzwBXHbm>9Sou-lgLD6m+ z`Gh@-T;JGf1d<-vY4dmNg#wkSUlbElE5aCZEhX=yt(sOQ6=nRBZ4(f^Bw_)6Yc z3U=7I)P^Yh|8cbub^jwJe2afiwXpbp)-wu)oB5zv`QZW|knC-p2A2O}>mRQA5vNwD zu0;6}wi3K`ELCx46B`uPLwSQf^_MF?PW`#^pZK=&Ba1I;AHUUhHsDxJCPPW?$bwuv zW!e@OP`q9fJ2Cl}<)f7?nK%#|ux@N9f47NwjGNY8AKsRYnv14Fpt>291C>lLT6x4| zZ9dZ4Vc1zf@)5$9`T*_b=DHb5IZ_N@nj~zPS zPCtg02L>{{Ex!1a)MEk>4SptR-K>FMuBG0qM-NJjV`S;}m^rAaS*X@b+6X?^M${w3 zcP;MQ%1X!vP?9<7xsFGN81=c+OeN;AzgRY2^=}w9M_G{n#Mgxx^QU)h)VLRjvZCSP zepCtmr#9KR({#ScZua%|<9z>)1Bf?wyvfg_Q~(2n?R`5C$2cH1Nn0ZzI6tGhmB|cu zP&~KVhr-Ek%l!Bf^XS_al6wM3T>LygzSP`8yy+uIj&QY1kWVqYxp+q(n7jxJcEWIj zWQxr5=lO(hN1*Uu)Oyt(!_dty>L!1FiDsPf16;4{;h~|$+~)G2M*sEsEJAcYs|029 z;?k}XVnWu(LG7F zEzXQ1MG#xoH5O(BET-vPkn-L9tNcIS-UU9&;`-xGfQ5jp8<0p8kRY)J@e)*&h^YaB z-O!*=ZzyW1S8BCIO%Mb%VH03kRu`)l#kQ#RT3eA?ooHJ);&eYMSp#6mct^_PfkuOjFG&oW;HIn@4 z7k0X+Lu3v|tTN(ndB;^nZ&tD%9bX&Yv?KC#LSs68&UT3QS$My5a`PKcY4C8WrQPuo zldE6%*=8ewKa8VekESTb=Zv>K{gk+!+b!~;jnEI4a=2e9Ju#7Zkym`R+vEu-(UPEq z`I(PrQ@dLt0(yyyNZiNNW6P(K=rp%AK_jV}M^!fVT@TW~b_Nvf{wgq(DX8B=)v!9C zYPT_nXZxz)+y1&i{jr9njjtzyc+4M)Uq!q-ML>*?PC*FA9F+qILKf^sQIa3_V^S>ZI=$}5syL;#w_cS$G z{}dd!e~$Cey!rP48u*{;2LT0ch==6)=K@GPe2aqkZ1*%ofJU-74T+DR5ya=Z1tOB} zg5+plOQ##@iBr`-_jF0~Ke0bk`PZHous`V^2)temJ(y|iC!#(7gPWwse>No)P{Of@ z%Pv>pzpm5NtmHYnIE{PLFvk2#I$zG1KX%_S&q+QeajcSYw_R|#9jgpFzhtcF&{wQ! zXX_B<00I0kLs3Yf*AMq(`O`YkB14J8VyL)dMfIk_WSAhE|Xe+y<*h@R{CeY?6RG0WR*ybH#n|2yf$MrY!Vakl= z$Kb!RG+_sR7`^9xF7AGf_}2Y`(3a)aT^KitE~3zvqa&B?w`xbeE~+$AR!lxJwF%rpHVRa;IF0- z6EjlRY$^vr&lN&TtW9&qw<$l3OKVB|t=LPMvArEDPi3F?hRoQWjuj_V70-VdnyBm^ zS$4x9pbN4J+Bxjhz$YWduwLJHKum{T*1rkSi&Q| zkHfEvwFQs+b=gtV#Uq)Dy=9p{t){bU3nfUBg^I(&~>r(nWy*0Bif$a z%E}b$U)2W$IBt+Np6&63PWnr$G8sA>i=cb|1wU1u3=9g_U*o`(8}m&CGUm0-#Q)N< z*)oNy@7+^Z?+1(40-9{yog5_m{gG>1GgZ{-UhYO9P@}RWPoz!vYK#T= znK~(5zr2{9QN5>YHbe1L69!Fon$Ki`4pOYgim#b<#!97u^(|0GNA6mSAO826fjWq7 z_vUy4{clx9YfvDkUe2A>3KSD20nQ2!&Ki)$sIC@?MA_$wPotMsNT+evF3W7~TsrM`2uz;O=6vrhBWr({fR^J%GKkY=&uiE-VO+>7}&>B8@)i?jDiYT|`LR z)&X}WE_2QvNRo?tK;_+gU_xLCfoc7?hh#gzK9bUoGIu0{vH6;xxeB7P>-2!S3$&y# z4p0ikm6@<0X?A|M&FEz%rTAAzQB%Kf+ar92J&H^8h{>B6{Wp*_8hn2>MjRBFmlXqea}R&ngnjeJPYpDC z6P_X(LvAOlmNFt;u3n!c|C)=H^sTYpfHbMafYd#C7MIbQIY}m@d4UOOSIO)l3A>{< zc|G%CGbSBiJ}llDGw%W!kvq;o_0()=irHVUVHb#d_-)py{Qdw;x%=p1iSWz!GfEP@ z(5&DR@$ga44#a@v7nhSchwwGKo9px>-3|$%A&xJMChpusQ|d={q9%gN2#G61-ts6T z8eg!D6aP)&x3mK#5x!s{5AJB1YpMH5gLJ$KKxj;0spuA#S`^K0 z1$X3Qn%^VLD_%~oC8G`IyD^U=`7h4T$K#JpHlm4|{3s?(>j zoKSgM>(L<*=^eGzb5~JhnIAvuTKZSc*HF(&S~;0TguR6Si`^YE%IXc%xo_>d_TZqA?4(;w5E&GGf{Pd2Zp>~YwzH&D(Yzti}i7w*Fo{gj;> zEbCZISBnuH^5O<=3FzZXRzcm}@EaT1{sxo@Qi{%J*Dum!3X@=+u%SIez;Q{TYUiq@ zZF;66wc0xtP2N6%M~X#v1=D42?PjR{cNh+%^>y?c$0uDjr%xIed#(iW^@G7-KdWeW zv~$u_65VsBm!gBV$|qQ#=JBQBw4n~Z=lU$Cp6+~ZTt_>?d{q_S^EhO{I)dlxhmG=l z{X!c!ZVdW|U?@o}@CyQ4rXG|W*%YtV7hXY=)d4%-GCMo*-}(1;Z+xLLu~N1*ho%m| z|CP89u{X(-^ntRQs9W7{{+0I53UOr%2k0_0rQ~St{_3cXRt*PXssErZ^~XJQ7- zAsX*SZV?Fa7=)15=t~`eRf{l8vbQ_3eBgfiF+iThs_*CN z{aHmlBDGH#O|i|bEPg)Bi}6zyKeNO%S6+s>3rgD1kbCjRHvZpvRE$+^DjHE(*~8tg zg781q9Gtii8vE%I1#^Upz4kiVh5w_L1W3=KHM)CsmMGg@nG@lahX$8py4T0!C9L?Bdw{u;{o{}mJ~i}EN_P`W zHLdPIcJ-V$2#{E$5g>NNK1VrxpPIqiGHuD z=3_jtx;MKlJ_?e2FR*y)_qY7nn^9<~U1G}ym?=Mnm17$^B!!yw z7^tUJIm7F{!Kj<-$~Hw;lS{B#JA;DUGMI6+DfFn`ulZ>Z^8>z+uZTBI#|z=)y@RDI z(cheEYm1F9kLi#F#F_bg=ejoI!4E@f`-vv8W(FU%)9-Ja0YST6Y$7yh{`PAiDDco6 zX7z8!_k=}lQPg!n6R?sq3)zzqGPdugvh7Adz>c(+u1cXsEXmOKU!z9bV6vGlVO|7x zIU^9k=rBM;lTF42O2kD|jXzGHaGMd)MLthdfEAFV_r<=e0-9@_QG_*}QU%Eg%*oWHm zdK9cQ{70flaYRy&oc{K}3p|$LjykMb^u{eH&ZqCdEk(uOYr1$h_N8;?OhW5!e8*j| zSmYO4{seU1iE9|S0AY2-8M0jnk3+U&xVTqI(<^Upt1(k_9#uHd6(I5TOB%(v5DIs{eNFw8&PMCl{;2J{;Vb6@I4LIs{SWM&^=tDF0sO1k5PQqC zXyW9$n$C&m1W2qYv+@&(Q}kb*$7MI{N%sRE%6>883XC&@iho(XQL71H|JW28_IF}? zrBjGOt{e*u7mB}3`~Xf(;5c_Z>Ve)&+XN6Gz<*yA2~V!waO+@ZXeZ!Sm!?djDW>}= z|0+li_3s0zf1`-dANL*WP2)3C`#VEXIF_)kso}viMr*akKh-oim6{f_re#!o*m#2x z{Ckg?e(|a(<)09TF_!RFbPM+gi!a8|LaU`}@Mk%mB8MAeoC_`czdp71X_X0$+q5u# zIAys<{|0|dhH76Yz}CF(@d3BXVe64fQAjAvKltEV=DFXbq;v~{?Bb? z@c;DmuML5DLmi4=&ZjgbO<2~pt%yW-@GDYDw-J}Tuqoc}RbHgvNd0}>i8 zyF+8eSt$*Dv>$enq#DC+1@m+JP>%x~)NR&QsYmQTX8o?J_^bJ%kCT^6({<}F6$#ee zL6Gf_g3=o?N}E30!_A{O+gzl5OPP&BmS>dEp?6uHr1D6B?wjR;eX<|{YdXY=e_-WT zWMl0vbVDr#8@?t|=otFOniZBY?n2%I|S6{JYsjLF^Q~|1Fq(+NdsYG0&$ofCFr$c42Pm@?6 zAsQ=w>~`S_JLSFlb~k@7z=uGuHaSb_6nSob0ptId6x~Z`&#fwc?&tJp@)Pi-q8l{)}4ZZN1t@Rx?Z z^eE#$8NeL=^~2E7Iu@{+H;9E65@a;?)USve1H))|LS{1Rq)BN#-t`z33{doq0Reat&HRI%};^XyF zIau=W-qT`Kc~xWBx~jt|Aj4gB za+@4(JyUMY@W;`Ahz89AH#GLGD!y%z$j5(%U5B9%O&rsW3|1{RWJV4G$lD7KqWl%m zDCgVW!*01!qnnkNtcOtLB6WwRG|Yxotu#0)x)#axbH1m=$aqll%qI3uQoSanvw}(KhS^z(SvFpym>A92 zsCDD^PNfPsU-8_feT3_nO!h6RRWtvcdRAIC;HUz9d(zyaGUjB~uAbV39szZO5}`7J zm^p^ru>#rHIRm8ARm{H$fRsCN3a3+k(fXTQA`lNv~q?_qG=Oz$FfkF^)ykyb`=a%({7y4g$l&1fdyd@!2n} zB?kw9R9-ETFBHjNV#C-y9vEPTwHRQ!HEoQWHAbYqARzVavk(7oRVYE)G_RMi=0_EV z?drP6K!gqvRTbC%Oc+3Lgzw^wnbct8*G<2GU!V4(XDB6Z(-@R0vBXalK5K)*DR|v1 z!zjFWn#nm>*~iD&?6{O(oOpbj`7zv4sB&w{+VCZ{9(>x#C%~GXy{>A2x(eI9M_taq zT5kh%*fnWMAXxL787|hDJb{qq4L0O$X1M2G*0#2o&McV+v&B<58Xb7&?dI?4X5C zzkXY@71^gNOE}+jRhxWbyAjD(okvW$yAK%uUE)=GObgm=m=~XE&PAv6P)TXXx5Yf< zSmY+tm^AP1SLMT*nkRF%(K=3h21%s8+@);|m{wZqNtds2l5351kJ}oS#5eki74Ds= zF!MjMRp~berMD@trD%Ke{P7Y%3~Hi-F}SxfD`N}Og=jiy8O4$LOaJsElXbdyYMZ(# zk@E%B!v3a_lzxoV)LZZv&96);dsg3SKy1ZaN$yH6vC35!UzLi~+{e?Xe&=koyJOc# z1rE)D^O^n@sd-A76XET|8k2;>S))1jQBPP^@p^vI=hlUu*9*gEHBYyeMGhc z_Z42`&f=cxEb2{O)D*v0FYG_Vk8*p$E2b4e$%h$K-%if|m=75KCSOLT)m-#$daBe) z7ppyfKV7Wh`u2FN@1Iud_k~r(k!oS5rWVK;$6R-#;ixqW#!~T}(_uA{n!ELt$ciRS z7-`T#EmF9X;SGbSTk0iX{+kiww$Y7X_(F0<|eo~Bcy~X=cXJNAf=%*L&+1W zZ~t#-O`1Mik)~dyF${eJTK5A#821|X$Njg8iuJXyqm6IFf6xQj9ViIs7u(T~jqd*Y z-Skk7`_-|Sn3(_nclS5E+tNPvhXch&h)h3!?ejbUgu32~MA&p&FjDG?b(gLEs)_l@ z3F|`j48Kg-AJ+1sKP%!vK7fBX$tdtizTDX>7!!QV(Z`zSEWdXmUa62Jgg^(^^UkoX zc!X{-ULTrBh?Ps;?<(cTj8ch{tW@KGH2d;tt28$C=SFG@qBIzjD&J~c=oUbC4c(i2 zwsrr0O@@~KZCRRT|6HxjAA|XIr1oi2R;^&oKFuF$AUxf_oGJD=^x0tDr{Dz!JWl~ib9 z;(mN2;i>`tv?@3b@jAZEII+=>a6MXM&HG`gV!hX``h)MvsHQjLMd^83-QfV+>dM2f zO4V$S)b^uv|6|_RAv168Op$9*tIEK&bMAKwBpFWL4MVlVptCx ztkjRM_B9q(E%*Ic`-lpREtfQ*!{_j2b1jV@T`&3$!2+zHVK7myp&r7b$XqLO)!h_% zK1JF@s%G_a6#|!AiwBBmWHej=Snh$Y@<8vXe6Q$@NbNHuPp{8$pH1zr_(t?a?vm)My@#)=;-2&Q zz&}x!m6Vgw*d3!yE|{# z;NA3}rJnc-w7s$pEI$qeU|CxN6FEsf5<^!_W9j0RqR%Ujr}Ul#31deZynO}lvjLAO zFeH}w{h_Q>g5?E^ftcsh3wdgdKdihV`r|h0`&?Wr8;r0#_xZwrjc-^$kyivoW{cT` z+`k5h0@N{9>my1sVxL;Kvg0b~I`vPmhX?t7Zd?5((FxnR&3$ZFNg`BA81a9xHC$j@0(xTQY7K{^cY-Gb*~dLn;}YqF+CW$iK-a zDcn~K9!G1`cxu>B3^Gl(tz2eb@HbM%x2Ere%B(!b@9XkX^2O^#lIFart(0U|$PA;G zyX<~rICZ)hO^fz!=OcD5qZem3IzM1>uVts1%In0rlyZPp0AZCcQ6)fx!xFW%V4tIl zd94mv<+?8xS#b-rN7~jiW>cI>VrIDaVT+3=h+`=j{uRUp`=@6tw)okri8paQCWy}q znp%Tu%TZ1=`i|zXMiX0MQk&bu(EqZ7^@j>-c<2UC0ofQ-B-IcJMjFhe-O<0r zOGSrWG{+B>Wa!sAvy~&r276Gyr7haF7mib_e8f++sVjIyXNJiX#* z8LBxzf+)KC9Jzm!eQDJpp8l|NlGIc~*(NWql;C6i!_0GTXi;FBv;+6j!Q{H&+m zd$`;omLfPuJ`SCBJBj>G<`u9j?&sa8inLN*KkG5Y@waZ4^nLpLM9vT`2J6xI4IB>e zcJ7K`oeD#eF|4OWmQ817R~3JHy?{F-R{SvHIkVyve8;~R z*mYgC0x}!3(=lCq2ut#}(Kkia*&q)F+H-6GUsdt480ZT2cXe|`=*J##Y>amCRDt`b zKw$`x78~RLb(5E`A~|wcG|oCje&4plXBw%E6X{)U;1R)CF`cX7p9dJ><;h>=FK5=_ zU8r9JcQiVw{&Y31wq5G%beP7wJ8`wzKi@u>3<=rua*kp-8+qE!-LDw=MQSWgvbV|XO5$yasm4h}~k z?<2KeqRFaIh3WzbrHmDKnWAnVtN^PGb%pzWZehN9{$XEhg2MDs88Ku9c~o+q0Ao*r zvLtTE{^72ipLMTmzF(>O>vJwXu~TFYb4aO}PsRZ_Qloubrf3xN?WR2?o7Dq~s?^PW zCo_qz;R^-}xEplRW5HtOkLO%RFe1BBK98O&>^a}ltud3X$7_L!q2)J-$Cl8TT~n`43=Q9i%i~>ByO?6zcwAy=Cjt`1 z4^sJv`0l!<{&jypqBN78m>p`lgGjZEh@7=shp+Bjr(vm0&^xcE(et_4LR8jX-2i>v zGe?4gQv~s;(fG;v&1-<}kQ3Vuhy#{l6Cp5KF+lw<`8CA+B`(!mLsnxUS;0aM&_!yp znYsJ5hsHx(oN1&|OjB<)e27YAy)%M2KNK==j!62)){XsncNf9wmse4m%TAJl8W)pM z^u2^Yb-UPQ{15r7c~~|#n`|-D#5e<>#K@)EC+W}wVJ0y&_d470dvIdtMfO$_`PsSv zdHw507tOvTHD(Z5-T-HA&jTnXYGy*r zEg2f5a(-py_|)zTG#&Nll7R3e(FA#}p7?{g+OwZ3|Ct$lX86x9ukx|7jgWY6@HxSM z{?k5fH&}Q_@a|6m99bj&;wIuHZeIA`d|)VnbRc(f##Y!&mHBxeBl&+JQC$kPFx|q2 z`5I-h;^Ab>z{#_*zPoJ9RjoAbP3!9LukML{*`$f>&GegxN>b})DL%7#DdumKZ9Cg- z7y1W$1s*o5RB4~qmG-7m*KoBO>fywH*ZN3p2J{0(i3h5)-PPK|0zUO&;Gd$BHZ#zb zPke#v1qH<1bMw#8t+*`LWduqmyp@I}i!bm{o!ayYK8fZhy9FhEiU4#+KTb)p;xkBs zKPCp`q2e6sV%I51_X6omf1hZz27L>F*0(_6`}Pm{zEhvcS8tX>KI%p{8-7N46~kCR zze1xVpsV!IO0QxqrIr@dJ;v9ZZVjJvV~^vyhk*YBRdGj(qX?s~c3|+d!T}>WOq*5? zbQ0JR(=Uf-D{mTW;7dcV#u6lkj+|^af9}zfjgHT8Htmd@uCbRf`E&ERCAS{tzaCRTBQO+x=jOoy;f^CA~`qSc>D3 za?$;3WK|~MG@cRvzDkX^Rm2DFwHx&EcW{(Z(LWmdgO!(2*^BYF$Xp?NM$m97b1oy; zS~7Y3uX@A}IwS0};(!M@lOPgHcM0j-ZicY>M4_U>nqg3(d;bS~fd+wY0xB0OkVW(i z*0)bQAW40n5?e^>JiZ{QU;Yd91T@%iCm*tuaMWitHF9yV*Grne1>s}FR23gLZD62? zZ@^*G66_wbQBjbhg|QNQvX`&LXOsJ(sWlMU4S^XKw(wUcaAdLr|jqlKaMy{$D0d-A14$BTmhzr~AH z(7M|N<`k;&%G1`EdX!z)gtS~S=g$B#R#Ps~fSLd@;=#GO>uLdM2L~URCh_x4kMz_QgcHkw>D>S|e%V=~|V1 z;4*7s7RnGzeh@yC2|y$35BhUnm;uA{mfPX{WmWz=(PT&?&M6161 zwRAZ~C<}DkD}E#hl|Z;qF8cDCzP>LN{J-qWUg_<(=w~grOa#c-r;VsoX)cZZuQVF> zO%|DN5t-k&7(@yAno2o^pkU|cp1q1fw6E-7fY#)yt1^+LR)81~8_E6KBc$UyyH(n!u|Cz}g;%m_3NIRQ=#H^Gd@h*Ogc2o?C zEZY%HJoEWNKDn)vb*GhzXL?y*QqxqiS@wlp4O@2TBqlE#crpGu;~?zMQ@Ny}9piJe z{dqG`1oq236rFFG*bn=a5Ibzsc+hex1HD>=Pb@IV?iFNOSz=n0SYcrPrSgNKt(7y- z87rqI!XI7&f7wtGPK3X8soo+#t78_t0riD-@bDOfr=3r%7=;G@%+XMm48jb{T=A#l zp?9pggt!S=o`k!nN%+qcEV0lECUfKgY^{Pk{m!wL&xU!PcpNuKTt30 z?F1dwW(L`not@?J_fahIbJHo3tb>1zW%B@6*-U27bJ@xhuK44$EBZ}cJT`N4*{baY z&n(`2YsXK<4tWU$nfqmvB=kWH!4()UiK`XO6Je6fQ&n1&NE zS`4xefg|Eu6}~gRrHpfYvpW)`b$~+B9i()L?hAmXBd(`jES-C8eqU=nZu}3^HiJ?o z1No(l)`C(_b{|_BUq3p&hZg0Pg6I5F5M5A8VaKvs9~zBWZ9vl+#g0n$I>?|((ZUh& zy7(poji>^ZTEq>>k($3_(wvtwXR5bOzG#GylQltx29{dNi`GPDmm7o6X}n-y#+XE> zHDyIFL~5=yHGNOV%Ht3@hmm}AeC>!j7qSe8`V3zxL$cSbM9~;q#!lY?#|+i@?@xd@>R(+B&nFKiGRFlA_yI=g^q)1r$3_CP|B;6@qVTH?cdV<<%uiu zClE+)$UWFATGAL7SkQAi(>B9U(C({J)^Zu)LCCx3w{AHm(o*V}H3U?vu_bCO4sYZG zCBC*a-cTNYm-)x`8uGH25oE!EOW#tDZ@fCT3~)mlmzA_!d>JJ}XhPW}yO-(aasCpi}%p z=md)uFLOMrE4~kOK&K=F+*jhAXT8mc8=kVZ{zbL)i{mnNwTHmHF|Z@^fBkengUNBd z-a7C``}clZtAbE;mP>W+2pY9~^(~Bse!TnjnYUZ`8~Q;h+w_FSA>5zDdA#HpoL#?k z>%?e$V_ie2Jke=WwCI({?8WMoWcND~T_X=|zEO7PlSZ)cNJ~a1=Bl}46Dg6&=)^*O zjV^kr@-HKbHdJQe=zyk*)5UgX(%@e-W*K*4f2-+3KSb=hUoHF!Mh*OnW?KJM(6c~p z38G5y!TnOP2?7P_oF^z^BN6HH$iM2yj_A+I+p_&pt)q!7+RA@>p}Q#*AV#t~TfNCD zqmt-cxoif74X=Uu_Bfu>AGb#V&lHkO~oRlq$v7nt19@!asWR~`k+BmhhH0HwG!w@Nk+Ogx{&&zZ3TZ zl97(8>?6$H$%mKU>?WzZwY%%lAO9{P_r$Ue*c6N+t^N)H?fnP;K|cukjy;1dtH`GX z2EFFp^R-kcsjp?^nFqO%)Z@nnt^MNtv@Z2sHZKv-OZPkUr_0=F1f*OAU^L#jKLL6A znT=o#V3-z-aY-pGmbp9GtBMC}iZsr7$`5-#bCbmSDJb*}{5VIHtSUAH1WX>IwpmX_E{it7y z6n!3U+o824G(oZQv2)$PjE0AJCvUzHSAr0??x&t;houm+B^ukO<4i_akxzxi%FG`` z^dhN^7ewPvFD3{#0P&%ZDKOseaUPjDzvkDfEu`8KlK9b-Pq2-TRg6>$>U(mJ46w#J zS56OJIrMBD0cV_LKz~@5sufiz!%0Aaa*?m@!OsHDM%R z=kF{<>rYJ>r*$5D2>uxd_KOK?yiZpHfq-Z<{zYRl8k?CPWernN8U<76#|hv#&(L%2 zwV>zGJ3V^F2|diETF}Gdd~5VPLhAj{6IWoo-#i|fIrI5#(<_?mhX@Y%&pn2puTC`l znN$&a|0c3{&$Zzb!Ou<7Ny0-4a4=Dm5KjM*@ z^9jH0^x-5`v-fVcW=vgbV_72yjAglXUyJ4?4;v;ni}L*kFCl*XPC|7I#xEPL_TArn zqSQ+858qr-g`CK!=;u1WrQv3b+IBgy{q3Z86hyM%=tM;?!(YSuWO3)e9YkVS+C&jG z9oEg-ge*&2x)BJml~M+BE4Vx@$9w48U|NIZ>pfB%`%bmfN zvx`kIaCQaULFQFtM($mLNRW_fO};r@$fNk{oduZ zDfB+SR%@AR{V?Dlxeakdk%bRY_{-^V`3pLf{m)xy;i*eRE~eE;w~H-TA9?zZ)Sf|p z?a}D%#;F%$cA|of)sh%TlFS_@ZzbHhKA(VW1!Vbv+TRe+TLEAEMj~X$R~<4M=C|4B zVe+wGKzmZ(;@eySFdCw$EGr;s(-qujdjq;Q1)*_GntrQW=y#k5#7{!SkE@CwpVT6M zdb(r3WO`#vRYFK&A}xVX(3i-@D=vn4c~`}em;}%duT+LWo{&cTSkgqCEGqfEy`mrc zcd|Q@GqEyDkNEodPB$vcgF0yyumzq+@35_TOa#@bXA9%Q5>K;BtNGRi`;g1Lr}GpV z+`8~|7GT+}3tk$vf8|18ZCFliLv{&~*V|C$9loMa)d%bg@bo3BV%k8nXz6O(wyr%) ziF;+3x7Iejf&UlAik-Hn&5hWDtm#WFdt#+hN{qF| zsyP4q0|O;Mmi|X~gH!OHr@kt*`dZ2I9|k)HqZb=;Rhmh z&tEe^RzTwjIixAfYZ8ZXX@K7q>q+(NOFWh~pa~uBs=sI^)i-sPm)a+2AWp(L-|`ed zRexfa6Et;*)QT~CChcYLhKfQw%JzhUVI6+|+MS&`WHjbL3>KtDnf#wYuodm;)EfKA zLuxGNjYQvDD!!-pR(SodSDB!X11vNJMxqvCy#Zq7u#||^cI=5gO(H-1DLgOd(kp{) zSF&Xggyj}xM#M0|ZwdO>k713M8Jin(1#GT%o-uXEW5T{H^)6x$#8Rgy&a>3(cx?*( zgkLLj*X5MCfZfSe#Yc|O1SZRM{B;MT|5dwYwAw?p6t;Y`wvM(xV6f5q=hgpY4v`6^s$T_ix*OP*F@iZ)NqwYN$b$dES?ykfB(NlAJ{&QV7+mtrQY{5nno8TfzS2Gb}H{_xJ z=+Jg6F4)xm5cHFM+jCI5J$7ZA_y?|?WGoHfpP*(>hRjk1%=`X+5?Fv_SJm=o)ExHS zBuYv=eJpw%{K!ap0r8P#;|A?oL*h?JC9F;Mqh8La-4OV0Rq@RiiU-;0_(twOaC<** z#j8uidVAOr_#v3b(f{4VO#EAFr*7iT1CM53m1^-`q-WnJg2Eb_<}Zxq#9S{4H*o*Z zhPZv`w7V{|mL%LVyT||F{FBSqihWFu*b~uCC>8h_9Y0nr3A|YhbF;1`MKaXmBZ!nC z&HbV`2`IBRa>AJVFD?GWB=H)pZs$};`$?Z`@2!NgNrnA64};%i=$ZQnu(gM71ZcxQ zXV_YgJ`mK*3JP4v7xPQ$Ojh_^6mD2@-Sn0WEu2V{*npcJL>0I@JOjB;W7cy3@E^n$ zy6cH`pI*mL7fQGBA3ZPxF%Fhf%?ZsA^b87$y1A7Wb!amLUnl^~6u7X5;HxwQ&~Fe| z=yo#d-L1-v^9k3pmQD+|+YSVxGj$jX!QXu_g(Z3}{DYBJ(>+*B8XJ7f2*P=K4{~_ND zof2Rr*xXN@OgGb_R^CVO!dm)DDC5{B1ss4e*B>pl8q15VjTg6xvqN z-@yRm);LGDJLW4Pgi`?R8AASd?j>0E!}FFK_Zbk!>?(oL__8zp&@i#7eZy$b7US=^ z0qj}sI1&70mdGh5t@^v&e-ALxxOqPe`1XI$!XG{T7)L^>%4?-y6?h6@u?hR+B2UpJ zn4O}7<;E3Du9SWPZePyKG@3je&+*UsSDeTv<4st@qSbqv&dA8P;b><0;fAwWMZ=9@ zQM7)x(&?`;te97Wm>$Th?He_}t7!KBk@MGy-V7Hje!eu&ub~3DgXF+_CX<^6>LmFgAX9AqxJC zJbqT~pb&sjk@{N~TcQUcDqVj{G>JkL#6y4UVw|zZG8X$#5B_4syGjJ)_-JgEP4{jc z3DX+d0pvv!781E&_2<#ZG4)qPBR_uS^T>sDd>y+33>W|WERXwBslf759tdJ@9zPw0 zDp@RanO-!pOmgXY)u>s~ttgsP3;m}$nBa5jX9xg#F@}augW(|k@tgc(1tTk410uL9v?yA1 zL$ui1=6cqoXzbQ;*lHPkS~3Bm<1VEQvdg%WJVX~fLx8Q*A1R2^ z{zWDUv?=1t)3hg~iX3+6P1QD;Kc=$!Gqd0MvZ-mry4lYXo9T6irK0D=)L!wWy%6(0 z>`sMohG(U1!S&|eLSWg`Ke+N|@?YEH9z;&j7LzJ++GIt8X__C@qJj85?-Jv*>Z)jB z5N6&Xl3mJ-cO>>mR*@zepEfO8lzmg@XwkT=8%Hsi5AUQ zTbm^&lHiA6bD-6)!-_;PDV1%2w(&{ZI=2S|Ei$BfG`j~8-yV+)6h?|;E2t<-m`Cgse!#jlt>520 z_V(GifqU!;tRt8^7oD(cXM4`P(CsKYph)*@tvxKD@>!pJBRZtt==`+-RK}sxCi4)$ z@MSI9i%OHPebQVYs!Mwk7iGIz^}daA_a*f-Zre|=wwBNP=O4WXYV-M5eq;WKImZfM zV1x(;Jlc8vElW>`ri7PL=7x=vz<)BdN_?iDI^ahDC`|uiE^1Vi29{ zHv8x~eEYIJfD^vcx_vW(XwKJqv2wJcTiQ1#n^Z_rH#Y^$l*dX4!^uPI+-&B7+6E?;7W5kww=*;LQiNpmftj@S0eNT z$?bgY1H5ST>wN9KYR3!L2gq48p08788ghp1W9-hPX9O9e1*1vBmUd?W8cqN6nezdh zeFQwCH7^MCYp~GVKZ%jq=4TTe^Aerpk$s>MUFZ(G#E5U`Mu_i73UZH$&S@Ac{EWXV zM4y-XkOJ3TpPvMuc~@b7xZHA&Dh&pOyC%pToPXc$<9jGxo#n;^@r8c;uk!I%H|IZw zc=yr8R_Z^dk&BZe*mv({K)BD|XE1baJ=njw{Sd5rJrQkx#M6FX*9CH@LmjHkuEY=d#_L9Z!+89gsnW$&-NeCoMl2WA-V2l zeLfm|a({zcMF1`BI5LgDV}jgxuNC}@eEjASY5a8y;sgB6@bO1C=l`oH^kEOv@1~~l z*XyUk-*4Y-7k|Ce{8MOikF!_Eb3(yCgDj12wjOf(ynFm@Z5e+chB7{)s||iL?fq61 zyz~Suw5%EpXRPE8Ks5e3K%A1ET+0}4wSDNMpcu*OJh8}21zLfpr{1!_p`sMD*ce-_O)`Sg zH>7Q!eOPco+J(#+%%#!K-#dIYh2B+I`k>_9Yv!Jt&(WJ?=t6?s zKT$TD>9dFXXpraM&lO-8*SYa0M@uZU6AE35Ap+k_(wsT$VDT|wHj@@far?1JhhNGT3EfU zZ3~TQDpi*IkXqEiS&ctWSJm#*>OUu_KhN}+#2Bd_SwotJ>_R`72t2LqPHYXgG0XPC zKz@vqSUvVwSt>&=j3+~SFb^GP4d5aFe$j5V&4Hdi7I$i0m)m~v$fl=IL`l!{(}<>$9YH<@SH;9dtC+2k9R-d0FyQ8yJ6ow6UZJR=KL;A-eq z)s%3K)6Ct62K=+c9n1QR@KzFyP0IrQNX_REOR!QE+tWExyV;0GDH2iowC>$#avU4s zdz{Aqo3r(k2W_GC&aF~cCd1RUP$9S7(GoGt_=qUT6Ca!;`d`%1%hJiLMJ-eY_#o-# z;#&#|1WVhD;;<RwSrXEq-cU|4hstPnOvZa z>aZhjnmmz3pds7o-`|=2{itS!e@&@p_{t1W@l@zIix&shrZntWE~sth;2Qq zJU&N3RmB%>WnxefNu@@Zxr&=_W)iOBG12Aeb1`KdtL&i6iuBo-vLPUwb4zQ>zIZP> zWK&suq2lMxk!}02mg~Qxi3_r#gL}(H6cu14oVd|)#n@!89%JJvy_WGBP2TBOIKFIN z;mGN7DpvOLNL|me`l?nd9OcRI-%cT>EK=8_s<>?Uz(8!SZamDr{F=JkF3L$`)@s&% zj%k?Oa_mUO^wPO^ECI|Bb|Z6R=Mlk}v(3P80*(e$fdJ@dY*9+stsImZu`-(+<;i|! z618KwK5A_8qRg@Jg-Tf#TcgG(X_?O(jsMKZExvn|hCpe2gUhZK?VpPrYO-|`KMs;h z9wS!@!p8TY06=(8!?B}Ll-z+=czbc7D}2X`@j}jP*jhF4anfgM_Ys=o+kK}}hyUlo z+yi2e33ZWW_iCwR?n3=Wmc`{8YVKV90{FZ1mk^A1_$=VYRdm|8ctB6l<0NlFuip<_ zG0Xkr*$miZ=&|O23kXOVUlm`td;e#F>qxuC!N(|TJ=kdnIyaJl4<+-lW z1idshs}V;gL*Q}G}E!0y=;Zl&{{1%r@V8p%G9`iJnmK{&depX?iQ^(N=mx0i%7Tvs;C zD!uhz92tZr!@NfI_zTBW5bhL4umqPb*RCEy^$94)eZ*3+A_a;A|E(qxnJQDncbRf>x+YSu@|OXvNpC{+43UuH3JMvM$6tHE9Zj63X7*y ze3KO$jTL3cGbY>UsW*t%{$g#MV@vxaCPaK8W;p{ex$!}z%x;@9TPbtXDRW7g*TAk2 zzw7v%Vzl#Jm#IrtCi!)}ndv?yw&@>^GcH(V4S$=&!A55#CqZ~HLA;L33=dKyuPC`} z-LQEUU>2y5LJAp{E~Me~eF`B#_zi-{IV>~$8gDlFS;dRS@2ab~j;Ia}1^HEpBbrfu zbak43j3c_rR|6t47TB<^nUXyHJO+U@>zF8Bg^h<;CFfI#yO0`0fQ9LP=5%W9E({kiHn(0`vg(z-!CS*;$At+0N-Wex`+ zKS3nh%!*y=mXs;fR>GRXuk*{4tMVCAZEh#kA1&4ML8{xCADrwvQXAmfB_Q)fpvKS_ z3=mGHZK)WgtCzTwHj(q*kO2&lwiKjPnkSSwl5CtG zqwxK+UABKV%^dcf07)NR?-h1C^M~SYa?btgPid}j+JTJ+Xz@0G7!vd?l;^FKS&2{= zS|<9Lh+Gy`!lp7?&4PXfbm{%+Q%?!hpRsWCAFK*bv9Aer<_qymCo6p3@fZeVZJvdZtX$t2Tb4 zeR=9Z%J0~9)x^AZo-(*}1Figh;;;FJ_%YuQf6O<;cl(C;zkkw6T)7Og6eubUNgbBTV&l_&j$s3TS~J!jppM-l(0XX__VKZRu|i6hVwKa4#W zRsFYKUCur@(x1yMDU(@xQBLFm+Wi`&M23DRD0Es4yHKMmHU?9M^C1+p_d( z4C&mYO31;4$PX`Ss+84D?jGWFEWH_N%?frjw!0)U#~d7>B&7sIa>{BB`bEF^OB7`_ zTKDxC(E&T6$@!h6bxA4|q8+0XkGxT{E$(7fp3F7KmB<}QB_T}x;m`L+i*g?5dsN0v zhw-wQm#OILIiJY>p^MQrrI@!D<=io7K*o()dOhAER?A7~CMj)JCFQ9gEAZzuKY~uw{vRXY9RJ@5~eoV86pInz(dIG;tQ1-KHT;-i{&pIK$3Q z`L1vH$k2+H{yllO99*90{!$8@RQ^rhH+?@nNXm;|l1h!QBQ;ZJ&);WGvmRTA`z<>M zq&P283`(`7NHY4=l1&!q2PqV-aZy&U9?fVN4{M9oug>G$ZDfrXIVJv!Xvp@;2-8{&z9eqv;{XK#CPFIb1U-&RH#4qTs}|$->_%)`ytgl*Mo4y6tngZhHo@4GmkDtSVW3 z$rN91$+SEb8t0b3kPdFS>aB9sDKQwE&XMfSh{l4(Lj9rua)M^)rre{%5+XHoEaUaV z8hg6#=4Z-e=ZIlS8{b^_W&gUr_DOc?QMWr3UsLyPXiy!-Y+TTUes&1r^ztpXV6gQA zt_q%d3Zc^#n(UO?(G`6sbdJ7=L3<3H5yX74b;kf5!_U_JeW$Tj?1t(m`zrv(r_k9* zFzu~3{byBWy1Ud{?$fnF_aNl6!B4}C*3vjFwOXFOe|pjjLH|r>?A#Q(rx2lUPAH1Z zBSpn19XYU*rpq=!SnC(kp{U50k`9%i^~5MVhA{MXJ+PlvF2!r|8N74490R9%gi(G5 zd5^TbZ8C>_W<5A$L1a!xUYkN8h1XZv5m@UCW?R7`js|ozxlo>|xwS7@trvIY8JQW0 z@b7ZWEl}+`gO)7O&=jc7b@`c`6x+8^81z!IDg)W)eshIK-{kg5GFChony@o}71%rn z(j-rdsZH#XaFMr_n;1Lr_gy2%Xxx))eU*~vFB)@IBGF;1#82I6R;4V0^&mZ{G7h(tMujL=bD)=nR6X$Q`#fmjaUWwSRisAoEnr1kDzD3nhvV~o9#xL9KGBi z&vo02NS6#U4}@mBnn(SlHrw6&GQcN8TOUSge&u_F;!WaU z7>fod{nMulw8;4wMMo|$otmkQtKrmU)>)8(N+oOc zRT7q~0Zo@6u18FMhc!j%2?}eyZwIjE4R@_g+7JwV(FXPld z;eU3AW8Y;>F4}n85z)&(PwRg>BePyI|HnhulcvE`smnK-{y_5~y?fV&A)A+653SvS z++3k8QG6$-TZfb&P;adFgjVH?@%d2s~pgJD^1b5 znc=aQuP-lp<;LQM4^hIwLT4h%F5f0QW6A?N^K^i{35UKx4f2jf5$JWqm&JFQ_q6aU z2dR-mU*!=ij)GUa8e`~Fe7nN|x-33i3I@G$zfvZKzG#o)-}2ZOkn=qtKPMsp#0;Kn zB^wSPpRL><5XCnGa;3_R550;9=U;lH0XdUzx8U{GfSjb1iJ_(9tcl{|co-mMm#@dW z)Q!U$Ot9g%gopr;DvyzC1jv;wfCw2DWyoO0-_YA&_$v?mcc){?*t0cDWeSzE}}2 z6SA~N?GZH|J#Uhlr|B;ml6P(9wlas*fD{nX#P`tn=b2^%kV+_VGYR_hi4@YB@tyU5 zTApjKFU2oBD0b(Rfl@!Rka{y33+hL9qVeELH(|v+m?MU{aSvi@UPHt_nd@gMf&S1c zJ7s~c$n3XROQJvj-bF-^iH>gtqbVqv%jzP`Zth1?e?C$^70zMuCSh=;`f`bqWv&%6 z=G#Zh=DilDN8Az?I6cCfTq;KB^Dh-W?j^FW}vchr_(i z1?bZZ=uU6CYBVQMcW%>ajhdoOx1c_R^A!sRD|+*$SEb)K{57N#XrbT3nam?r{GRZW(iKEG-yy&)WqxXWRzjipWF<}HTw;&nGkNR_!y3987={uNz%T_E zZa)PW;=kV?hAGW3bX1A)oK8Gq#g_;M1L4CEAe^ud2%8B4g!g;uQT!4Q1Hm}##v4y; zIL(8wl868VY2pV7gw8D>XofjivvmB}$HPe#7SFkzN38fS2L-i(T!dmIu_36yI;gonjFEQ7C*w|S`B{~9Y-{+7iqr>$;sR@zYGc~PvmUvG%#cA z<=e&u5pC2|7E`>#ebg3)xAqNW*Jv(bkIRMlddU$K&9ADKd{vJg6Dp*u)c> zc8&JeP>wG8r1CGLi{7q`jII4!Ww%sWd?ed6HZ@j{OcxfM zRXVN!=nXhG7xHrvFl{yd+wc+dUqWsm}r%5ze(nQ%l zz1$Ot?H(@X!dmT*r>i419A9l}3ilwwF18aLDd#?b`1%^~w#EH^jC6MyKboKG{e1n5 z*H5{AzN4R!{187}@2BWzh<=XM&(ZtWtTJMVt{42PoMTX7aJbpxIAVa zZ{L|i`_l7A_c$L_#Y+!`cmn?cl8+}X@$&IPKY#7CRKk(zV2fn@KVN_rOJBU2GR%E`uT4~&PtC8vNNON7F50iwmVlt%U~;EA#>E&v`!gX=nWhEnrd5fqDf7z4@&f<^#8}Z^p?yo2Mc&v|%4>!Zdk8IArF^Er}&pDO>asDy< zT<>f8wcKhPN=ZKd_DLPISaStr;(h{x8c5oTV0`-)l04m0RmFeCjM~b-!-c=`l>H-X zlULA9H#Ym}_NPSX+Ay&+?P)BWOdA6H`HfkDiB`esLEH>T~yj zx}}Fa{3n9B0RCZKE4FnC@Na5=Cei8``b-;|66f%ueI|-8+E_U{HUnQgXV^(Vx~d@z z7wZHU^Tus|5v;hc{?u~?Z4_qUWK(xyl<#yG|CaUW{l}(zJa>ri(L#57p+&uQ2vOS3 zbrt8&6r@7k^*(ZKIx^_LAU@lT_mnXHXfk7v2>N$b5YPEk5kWab;I8%%oOCrQ4A1ec_bj_oXca#>W0@ppD9-h$lv*V=fR z>U({JwecTUq$%zSR);ORkD{0P=vB?pqlu0-t;YWw^ETFs`qtHS#7)Pvp;TMJSq0gu zE&JPuS$C7q-nfX;!C8iTWVao0o51>x9LNr%3;Hsma~a;fT-Sj%$ogDIYO`1`WZ*z@ zxzWp43rozISv&|nhVkAjcrW0+FYm64=cHE+p#-yupRb`uY@z#x zr3n?G*q*MH$Vx~(+9dYN89M)~8K@}?RT34#Vzzr=fT7}*9|5=Fxe!sL%-QZt&w!pj zk|?n%mlH(gy1_)bN9ZC~M}F($-MzrVPo?)KL%Xy%XDsT-i@<_v%5u*>8mJl#;kIJH zxBn-dn%h6cihP(N1O9m$2n=md6)6^1HA3d`2&E`o)I zOp*i`m)S8uj!wE>_M8C|>z%1eY z*y9lHVCyu%ozyTu>vw-kfTSMq7q z@m`T-AMpCyTGe7Y&mgAErScZ%_tz(Lj-ra$-K^pxDO~x{^kHY`9y9=;ncEuP^r!0+`hcCT z%XOXw?|5CC;a6u(0ytE(Wau8*2ZjJi`_a#;?xn-1$i3XQhk$+ex5bLt8s3S0&@|WY z_KLG6flv?=$Z&W6VZUA!UdY^$suMZWcO$s4WX>Y7sf^S0l3Y-A&qA$U-+CRCuEiA= ziMI5xCB3H)p>sJIH+&7Oj#`7wYO5=X#q5?d4*dNw6L)JA67M!Yn7-WpJA~;@p}sBm zXO#kgot*>&lVio#n&`|^AK-FkLB_`Wh6BdTUhY^BDbk;e*;F@jD4q%@By#5MK2o<) z$&b+0yt?<728+Nh7lH#q+d@uecHiQ2?DEgl?{cZ$REJQ>uib*loU$XMG35}<6!9nX zaxVGDk#fO#rBO@?A8s)6Cg^W{bKnmo7b+{yVO9h(o|smCH$fiC9lQUA2@{2`{(*qA zeD*md77Y&|N#y((C4u7rMQkdF{%}jl$cTYEE}Hq4mYt!-HzMzSQtCwHm#f_( zSh=;SVH**88`tm(Z*I*)#-C^K-i9Z){`CB5G8#j`pC_p^J(J3&Puy@wUVMl>L)Z~$ z$FSzTP14VzMWOLDB69mMjp{_s>3l>Jy|i7a;-JJuopkT#-D?{|Hg~AmUb)g}Me6N1 z&eA7tV0+R#71{BNnCo4vvrrcy5gO0bLFQ=nTBAO5r&ILK%;UuaqwKD6>qDx_?lje5 zmZHrfh!TY$S14GxniBc>+PN3!pPi%iklRn^4C=GVl=53Q|eYsgAYuZfNwYHR17^OER+rk6AF&{d-Q z%hD`7Phk_=$p zPWItv95g*L92;8_YHAf~!@?mwn|FNIu6%Nl-xWK5w6mJC{5=spW@L1K(|UE8;Va{m z8StCYkdB?W<-1x&jU&zDehqa>UvZmX9pqz;bwW+R6#qCiW!{d(q$@>se|Ge#lh!Hy zfn|1Puw}1!RRM%0wYKxZT|CS9gX3ASSyMxzI`&|Kznr9gUok?fqiwu-xPOy^Y*<-Hm)mn7BB>%s@JB)7r?-WMYc3CY6f3vRiaaX3C zRX!g{bAX*oY&;lK4@S&)u{(8}{>1|&%~{-OQyh*i*oOAok-L>WSo)zuyc$W>mZype zA&?>yPC+4l&J%tL>3vaqeNV;6A7(ecLp#T}CyYAu6gk)@*z$oLGkf5HQDFZEL!;gQ zY2{e)vA7>kHkba$*98y&$T23YZ33ex9SNs1ejovGQu+~*xuAkV-<5N~)2gGJy4_6t%c3!odK^>@Pjig&4ZCmVLAIaYKr?&=qhW&{8$pmDGt-UNJCx2c8V$(I-itF4<;0XKP9 zCm?S8e??Ir28v<3lGQ5C$3&>&k}_W{aW0;kSZ?tu2G!q?;FbikG<{@403YmAf9dK4 zPxFEO!m&2gUZk=V$)C}1>gq;awvd?^(aQcPanOQK-+MnRdZM5y{(mldjWe@ey8d7~ z@IEf)saukI{&oCz-49dzR{kZltzL%X-zr|~oL|0!?6#e3+W8bvEN(7t-dnbP32(NA5`AULCCVNwI z2dXNHPUN}Hf37oU=Og6tT+D=SWj8V}9p|L}WHae#n`FL1k_{OAD2@i0mo3^{tPV{@zjo;_3?v-{;{WAWJ;$w|4iwt@&n+We4tQp~pFZ8CZ+GdQ zmU?!re6pX8cWDjTN4xaov83aClwtb&=@VW0BQAYL9_jdgVE;VUb&c6g<>!)amJC*i zg}d#5>Y}$7$aq)IkiEg-HY^Y^1{>g&N2m>2k9&M|Mgq-BL9SqpE8UvZwR zcprmjp4HC=KuC21_MdJf3huXCHF%-jU|-R}P$!P|;?azAU24#qCDR?2Cy3z<}ytYR1D>urV$QiCp9-O@n?Wxx|lU^{{9?*-xzU$KR#z z9YVSre?Pt4r4MoG>-MGE{bUH3`kA0%8)z|*_yVh*I|-YN-r0j{74n+K)v)8D33tAqa$(#;YG!#u4dAibXQYrGm78O)CkPC8Zks4?obGg599Nn^Pf0jV_RA2Gi{!oO? zE#%}x1Sae&_EHpyOC{*ayjb=|dlfJXO>?y^q^F=@{S~if96vt&Fkohh&7y*wx&XJX zVrs;Gxc-h`nqGA&7Oa@Ea)Gg@UP&C`CC9f1%ZJ_g{wK#2z330 zS<6~|C3AfeF%Ki#NFBD9)NEyMm&AKaWyqomWVkK14!gcEI>}FLRQ78qZyNZLJk}iU zS_%mdYKifed^K0{-F$}ejE25@fJ99qu76g(p6yqt`Q9UZgZ^L{B;a7vgL;MurkSTz z9@?5_zAc)}q73^xL(D_2-q-$->RySOeBb8w@it}gE?bR5OlP zw!%ur^(ijcD3jqFo(KBhrw5lV&gYpcng$1#HWuiyruYam*g?^7c#6+{BC(u8@+cst z?;|C`ECV;&RCVTICns{W?PA6E4Sqof5F*!H6V#PT*SZPr9a^!4Ci1-H=VlA>9hsPmp0sKf>jpdf}H=4Wu178Qc{vb9NtA9LF{LhZnId{`}ryX8QiutI7?G-xB z`8XX6N1h_m?qI59C1Z^dufLNjKZ){pVtqQVzMrFKngp1&X~W0@t54dXgw9z97b6-*#@Lz7nR@ci~)!1d_~GM)vO7W@S$ z7hh5Q6>5H138O5)e9#@eP}HHJSN&k#W9b>snX4-(KxBq_aIE$tHYeC9j34YV#%_Hf zle3S12Tj3;(mrb_JjsGYeMbn6THer?-!IMp`h0sWl;6IOX&c`6$d^?%%D!Be_YgfF{qQ>LJY#HwI zMRRL;^(~C&@#rj!g%p#8u}FWRmZ7Bdv@qJp16~|sg}FZNbH&cTQ1=_$XA9oayCt^O zBY;rzZ#vB+z6Sd&(=AVv-1TbC};$&aa98Txg-8F0NmMvr}&KbZx8 z;+GSqm9O)6jfF+{5nLDW#jcM}1g|Jm$tv6HQ~7Mx@GZ&cl5MEopW_|;a4y6BGK%?H z@)CT_jK(uTF6Ln~iOeA+{$ z73Ds~o~ik1Awn$Y4|;s?JxkWCI5m+4On{2)l0Mny&fka9ralRf!u3(R9&nkb!yr*@C%&;;A7z5$M5o6R)mr<#n4}#@Ea@mD%G+O zpAsAOjd$6d*+?)J9i;n^MBVruIoQ$Ach9yFn-j@C5A8V^uj90T&LGOb0hg|K`a&%6 zD7g`F`}P4M7R&)`oP5T!{&nPj!Bc!fNAfrg1Sf5Yc4J2f7cl%~u%+j9tY>_&mQQA< z{CDJrmUh>lNC>J&sQ^#3AM0B!3aKi7FkSJ(HtQOjOHC;}6L&7R)(^x>KNNjRrIQbZ z6qs#faV@(HaW6L1hBgk!j_05-FTThr8P@lXKjNM8C69}Vc#A!yl@4K)oW-_LZyfJv zcn=ePi;gd+^xKw>V9OX~#gTHD9m9nActtOZfFNKLV~NEm{UD1t4_r5GPbOyaHz&Ha zZAVV&CN#gh+vxzSxBYK{)+xKKpWl{`Jt6}wTv_QC{(jGT zX59{J*4sJ;KE10SL49(MW5b0oHB4A-2}~71UQ;{xqx$oru$Bogc5gWc$h@{sD&d-9 z&xVdf)F1B+d&>(h|Kxlaa*@ko%|#;Dc+OuIBIZi~#XLPGi~GAD=jUVgoJsYksAYxUtXj{|amd&V9IRb4bro{+ZK9AoQ-`_t z=b-*(LdBRxdb*A$hi7wD)JJjq|8&Q$!*4o%a=>VQ7W*q$PXHH+)V}Or|1msc5w~l* z&rV8ZrfN+t*GL`upBulQgFt`$ir6K-P8F1C_zRO9Q_?efP$8E=f%Vuj@nUp;DdM9l zqiMes`WZnZ9~IVLy7w1nyQ<*Q4e_f8X!1jQ6n0U)fqiH(IvIP&vS6-qL=v5bl>w5hgkX_Y0aKc=l>{?jCk%DeZh;YteTqWc(vhu5^vvIx?$7bnmQWE8*CX& zHLP_Dn=|4g`_t9kIAQO4kdGVzf32irWz&A;oAECDzx?Iy#pqgWrb~o9HhtO8=0esV z7MB14rXU0~i&KFEzsABZmdM@siWf`#Q^W2o;zxE(uLBDzCDky`8r`MQG|`5gixcdc znwOcjl(|rM8y8vqpwj9G^%UuPJ8bScvfK1->cJCyMLqa6e=-Yx!!Nx@Y^PKw+t5jT zHY<-!-Ljg7KAv;mM8t@7a=Dw(gGBij6bRi;pRTbfJ~s?-LqvyI3S7>7SlyAuwLeaefFQ7U7neIdAS~!%1aq{ImG~i^`vp%2vlx<`4PME~ z!x4$tQZ1%CcRNO`$u5=+#Z)}gYc>Kx5Qo&$ups(M6t8fkE>VqcWFwfEmQOGAg;m=) zDd%I5ILYg)oAx$R<1DswR+G){AK?ndK4!A0xlc`e;F05kOV?fE#|Nm1=O51d=1Zaj zw{)!LbmENd)$x&eAt`{ns{Ns5kA=zpq;T|ADr|opE@|#V9bPp5Wjh6e`7S#xHBrp~ zDLvKB-(ox=d8qkpK~K(8uZFf?{UxkthtrLpoPkoDVCROIpp z5BH-!rl?E7;Lvz}AbuH3o6og;2A|LFQD*k}>QAbPEfVe4l(xkOX2wGuP5U&H%q&{; z13OosKl%dSf3TAqQwz#Us2nLHMnwK^KdYOZ(X3$lcI&B|6Y$DT%?VxU)W(-2$;}T- z5U#eL#Fqq^SU~aDgU#RJb7Wsuu(^pgW%w*2agD&mOZA~`#VjZS_?fL^ldmjcZoqfH z$9_~!3z^XK7TQ1gxEUepT{ZH0=eQb_sM9VRZ3FHQrM3=Q^&X#&Yeqzp-@A^MuJP1_r508}=G08|GZ%L#-drrYHdnLT)D^CG_3<%zpmu52 zemui9o1X$t>*FD6d8=}FZAa}35x}3(*Nn%WT*197y$r!+nH3>OTXI zrnZ066VwN~@?!f!VI{J+aOPapI(oozBYv%Zyi^aymRh z`3U%}!MH&1ZzQX^Nk8&mHf?@M35)hA2u1U~hhc-e^wYwR#jlym6Qf)<8j*I4P|^Pk z`{CUC`EaH_>^nUr;mqmtd=cJWbHIr+Nh?-{2nhLJ4(AbJ5t~z|^>^E+!%IJFdoQbP zUzRqxGxuQ&n$NZIUU^OF%C;R@ZTtDY*~?t-^_f_LnF#N?nOS)5pr6=NahvhvJjRPp z$|77WK})^pey?;xsA8KJ48NiE@Q+&Y&mPgr(q{LwZZ+Rkvbtv|kxYDvLhXR;<@u@Zy1?qMV&mWbn?Kfm|haR`$}?)+8(r7e^~se{d>3F`br%GO&9g6(k!q{ z`C@f>Et_ZOpb{i6lcwYDTnIDy-VL2e+COfyk)pGKwr(Z`SJnrMOad!)RJ59LN8SmX zajfHHg{755I5xSkJ&-M%$*jKC`y)Ayv!kY&Ee5QZolX5`tsr{*MsOS%l)(Sp)6CcO zqA+F;E#|3ROCpv(r2jP!B~J)J1p$SkFCxh7(A#t!SwAYeIfMyq;it&HT2xmr96O~p zdg{gy>RY+&4;))&7`AoNOs#afQ0A6P<3pjHNm;cO+vW|obv)|VQ5IU0tr^o+SPo&a z-jffYN|uK?EWGGeoAYJ`8z-=PsPv6c>6UPGZ%A?JcJv9gb(|j>_J%+xxi~)bjPdb& zr0Zo_oc9eb96`~GqgPZizlG%Bxp0X65UwNwB-UOpJ|Qc3yx2g*vN5>eb5V_WW5N48 zh0&d-X##B|UA}jC_|_dv2b|86w`;|#(EF=epH#ddWf%tuEgB~){BYYxsM{O8=m9VK z8S?ERCsO8U(KuPuVygv>6Lp%nD~W{Z`?PTEF-s)2XI^|pmdA;j1s4j!_-(u#3@#X{ z7hGOSad-9rj2VJ#Z66b?Zy&+>HhA&u(O%?W7AJ#|LI5LUbt*>LdI{+OjkWLQdLmZrd?D zv(4+bo*c|+(JiIxQ!;5iOwh7!9-{&wd6`H+TzlQircXR3Je;EV-y62t>-V<&Xpt{O zwSW5B;z02JRn6P$7qWl7>5ij?+Uc0+-Yc4!8$#`9q>#zVwp(qE@J;>w%nIMt&yD)I zo*xUpnWWb%^)o>~Vf|dBp9N1IwEhEnp2aguD9f@4$P*&_JL+*UxdsD_mMmJAem&1F zCF-{&kLM$S7~4MK5QuuOKUfaELT^zWa+(6W%+EB0X|4=O64W9Im>j77E1~G?U5ax_ zW;klp?>fJYSI4#dHHkU6m5kNWL^EbxR}=k2lB$j>Mr;p9-;;MIlTOuai=0IAhV@hWTKdp^97OxUeMU{BMYu~-^kc$gu2(6!HrS?bjVqQ_py4goM zv)v-E2>o_6Q2J{&c2mN@eLP=Gb{cF`kpd_AOz-*C)_<{`b|O0iT1an$3S>!M55ct$ z&Zg%mP#wl#eP&*f5KiwGJD$)LhoAa65 zr)*`_yNv0la~C7}D(Z-T;X@>K+m5HftrLM2B~K^FojT>MS;fMx!`ud=ffMEhf~YA$ z|FpC(($c;z%ya|kRhMqAhVQFUifX59#(3o9FRtOimM1Adw!Cpnf&}K)BR>;4p_|eE zdqj6ltgeW(+20KXm%l%3=CQTWw|M$u82TxFlC|LKfbNXNnwdl+J&;*{n#+Qvrbia8 zl?}Fx25j5kgy#@gtP^ce@?Z{ZBm!?9u}zYiJ;Yb(sW!$TFjW*uYuH^G)Q zNw)J3QWhn1+=$Jgw&ZX*AGev|)upSd+umnf4lpj;HGMYc+UmYpm+s#l4XBh>+cVpx z?R>KRK~fR^Gj`j=+S0$(M*qe1>`%>f#tUceudR50UjN#Pp?g4gf^p$Fk z-gR`GPmTehwvUI8%Y3W0-y7lRZIhWQXP;PGv2*qi%aNajqaW2qjfPXEwKv?Lnj6@@ zG~d!5Ca0#F5eQ{8ZoU}K*GrTX(oYRP>c5%$OGJM>=aKu!I7S)QE8~eaxrWyv%6+7M z2I(hEc4&8k2>5CQA*URO16vz?EyR2f>R1`ld?1>9S7bXOFLl-N%Mg-mm2G6LUO_tw zaU5NnX#WGobx=8-I_GG!XW<8=K|d%8HyeQ@f#0@_WUK(_OJ7+BOm64GG9`f?(w#=+Pa!^x;q^G7E^iK`!rz8 z>;8^xnWQy3uhRJ`49CbsPfKd!H)Vw@KAAPDCc0yM^onhHg2Ice>JzGXYsL^XXD)@W zTRz;mWH2wKdCa_ZH)wlZKO6P)vVK1Siy0OUcd%1#33i{)KV) zJ{bV&&>3f*!2|v)eP1f(6zq$&u~ShP-!{*)gHanjg_TS4sc>{hcoA}AZTnZ4$)GPY zNlh*JMQX3ePGaUO-|ad>wa;eO>^(KuFV23q9Rc9a5fjmA;yEpUO8IX*g5+FS)b+b~X%b4b^mQ*CKkSmOm*B=o-4!;9|VBlmm^;=YeOUGp)BYa8P^ ze}9EjK8tQ9j&VG9Ezf*+7p8#MZvb3I!|>HP2dOgC_VY)|UYKJiHyv?~jv7rS^6C!^ zgw1QOpvSOZ!ru%?Jf4$Kp;fdIEBF~T#YX*<--@lX``Qz3$szIEGozI;zD3`N>^L4j zpKnkAwR2;|!C9?daD77aPzjc(4J&9Xmb+1ZBKrb1csIu(*JFDioqJdC%|-n&N5PpQ z+&Y&dHtN49;p8itd~iXFKrDTgC`1FQ3GQ@D8 zA4u4sB$RM@M(N9;=$oNEZ-!XJgodpPXRZhJUR!Gs_vOgR<~r|>sjIfU5xcw>QrBz| z#&V5De_jrHOOlwkYo8AQj^>yXFAOft?_V2zIfNJsMPDJbb}0H%Xv<&6jriok#rgd; z|3u#lSFF2pYx^A<#)$Q!lZMu*%$lQb67}dCkiw)Wxa~RQ?!y0CWcdAe@f}*$rTPC~ z2gLs%IHREm;=f1yZx0#_dmf=<8RAZIn`dr-A#(30W1=GWUjEGbP?r!EEZ{Nn-tkby zM6!9Yf%g2T^Wr*A1s{@b34D2gkBgAG;YJ2a@k#`s)n8Nh>$yVhYblg%!5U@3l33a! z?^6rbUCZo*mn4_u;{m|3tp1FOo#ymdc0f!P&HQ`+97i9&?Zi)&=%Y@NALO&+WD7$z zR1{Ngv_CHlmy_$2Lfu+N$Lbi~>^t5zWtP);Z-z$}m*ay=+~soVwpd81El&~sb#>8n ziL+bt5c3?QJ@-ZhWvA4d#>o`XKks?{7U?Ovcp@LosIT}E!izTPmNrmXmD1IZzQG^= z_A^qW-pK|QztdA=ufCPgn=>7~z(st>yP?%!V2Ki8=ky=+Vg(AQ!wlZO{CO4&&>7^n zvSX9FEd|}Jy`l5R|JH82X-D&0FKBqtZw~A~0DnK& z3oe%GmOG>4^UP6=|4VYf)|XFxCfEV0J9)^~zx~_)7QW!Zm*|-fqx>IZT#X6GgN3#2 zOGwhE+>@Uf&Tb@v?E7}yICCMA5liiTVPJ-tiJz#@f;_R3g(Hx-R#@*+)a^-uj!luu zPk%2i z|FSwZ(&Mz}q8%9XG4rpb0OaS8Lybyz`Ux&<>g<2HS{QZO)58fSMtn5>YNNPcZ7fjB zjoZ2^K5ubb zGs+@=l&5*d{D8GNBtSDMx>3qVL)*nZ`K@7%F`~q@bd9FBP{>{Kdpp>iAqRqmYISQ9Luw!7BG`dFcVS_$c zbX_ZS{fz<4sCRgJ@eUsXP_zgX$$_j6Igl_X6U)vX1W(gnaN(aj@q?33P6V9bc8^+{ z)5xR#v3nlR{Vp%=1SbZ;LGl_&*sH%6QXHN5D&-Bfd|Pj8axU~MS*Ds~K^$Zah{5Kw zUG7q)CxR_Uy4NFkNDd9(p^_h|l8Vn8>b&JlVHp|POrUnYaGEUlPNjAxRBURH z-<;ed;yJf`h(eJ|5%bVsMkk*0we*L@?!)=%53}8e)6*ZO`bFAPYo)Kc4;|VWww2bn z507Yv+MYT&%YC>j{b9KKa9jGrAopQf>VuPC2aeF7k75J8JrCt0#TTi+jz5OeZ=XNP zSjr3)D)?Kdzv;D&9*XpZzj^*&In=oLn9_LimkYmm6=|s5`a|alp5ZG|uky2kE!gQ* zJU?5-&}=g7t(ATWnXcepn>Rby;`w>uW*0ePIq-M5ylpA_nq4;dWex^gw9_H*GWqxX zF0#u-Z_utl|3>_xAg@1=&f}oZf-TRu$0PXq3->sfN138jff}{Wk-Lg)S-ga&`(?>> zyBIWj14DAfBX4aiqsdIrHEf9F*2@IhBrWp z{%UssK!&QSFI3e~zoz?LLZK?K35ERPDx>mQbElb;F{mJIT)2=n%MDw0XpMFB?qQ$f z{l((pj`thRFvI8cPbo)~c=vu*7>=eK=px~$W_s9HVhZ*PtV5EPX>*FSdMkfk(@Xd7N-RSWuj*K5 zZ|9w}*IU-;|5L|pup$-#%}6c=YDOW5Ou3h^32qyV`2fW4wj*Hvs!@pLtp0@^_%-^I zO4{s_hV&Osnr&!urnr3jiu}?3w5*U7>*w9Vsd2Ra`Gu^1>yvg<#H!(53_W&!08Cyu zBbSPQ=-S+O8WsR9ctZb9RV$@jdL8ungdWOpe=i)ddlCA1&n(Hi*e4V+yAqCRxrWYm zQq8O$RMW|SUHm8hoSMX%cFJC%PRblCpR&jKi>A&E3=m#h@lHq&eA}2O*|VCLC$gMI$Qi&EHqX{ORyqPk zZx-k25RL-Hx9X*|&3aV5s?BY?slDEomM;wpo;tbi2|`B(ECZ)|QSB|mMgpVKe0W_i zFgV|j7?_u4wd1<7=C z!l`03yS`Mu(gR)x!sRXBO+YHS=MCFx^WrpkxCo%L>F+aMLRyiCXJQH>t<%n{yWoWe0S;%;fl{i>WO(3mVv6-zTw%11JA6810MAc zRWLmp$in`?uCD2?pB#RC{clq81|Qsoq02W(X3_Nti!n|&%@4Z zBFO_C$%||-XJA42)&bAG)9fsK??nB9JqsZk4+Eb0D!IiGh32OBu=k2sbecu^^bbgj zSRj9w9<<*GGjxLJ^pjta$A>TPdD2;h2qWthKXG0yVaqZysv`S3>Sv}CPi0ca;hz-~ ztB3b^pQOC9oeUEtR!Y1i(${>8hDpL$iIYGs3` zVEmE}b!{Eva>rG{=khNlz}zgN^b1BUY_83Y57+th(7cpJM&gI zYWJA!(#6^VNQ~IL5KGD8DoDuMpJLUMy;#UYH--keGit(Q))y=5KbCCR;d&fton}gG zKj=d8PvmT69^z}l4C3=LF^ubtum{UA3g(TvuHd#$>oNe+pC|I}^yiTUJ|DUJ=bF)q z2A=0}a)aeVa8Wj?Y1I_fT3VsJV5RBSEN(6qx9T1!dBqA^kC@Q${EMY5J!-+KJnb>0 z{OoK_Ib3AMPU|U-Vs2Z`(`0H3pzzo>aJIK?C=QGokrP`=QH2}IF-YT7Qf*^sCUa`B zbYxn0FXU6GVqGx)-;}{`BZORMQ$CZMTY}BscG9e=3~5D#5(_R3plFT%17DCYvbcH$3_2C8=GGiialqyla{Bq zE^)G6p5D3~@j1?bIv+4%Bi_})C#~CGC~C{3_NUheBZo0FB2-SjJXFEk7aUTadSUd` z%cs^vi!blQNNUhPLTz+?djmRVr1HQ|HLnl8BzAKkFfRIz`8C@yI75t!9vHu-CJ+Fx z8TQDrYF>0dHOuQy1Qd!quhBqj9fzZ3pnAoryd)2+UO^tH?b_lI<3@bI`lX*hxvn<; z?aW$So#NWUzYtKTr2U`%6pW0bOsMTcMB%AyQ~cToE%Q4t}Q;B8irnH@i!tI zbE%=|-zBliIUoPQ{JK!QzPQ8N^l3g3tN>3nBFH$WtU~s;OnF z!5=@k@L@i9@iEVM@jC(Te6M0dFw&%NZ670<$Mg+XteJIWFHT{joa@JX@())t1taHE zn63}JM*JM%W(MJ#u8E~Di46?YRFo31qJF|9!FDS*UQ3ZjEm63$v% z*{8Sj-y?gq<9olqTzA~9c?#aEm;2}4Rs>=1IZV?lK5Jaa7uTT~aF8EL)K;tvM((C! z37k3j8RB3CL~>txthiO!ta$6re$~y{#qBR*C$7fMIuslHuXyHe1L_M!57fqPF0Qgd zNs3BsY#!kjI_j_F{@X{zJZFbu-^dGTIt^Ou28E1Jdc}k>mnyq!Hb89E37ltoKQemxbd7MOr2e@;d zLe-7)#$?o=3_zd_XGHQj8M|v-@ag}a0}k*WTQg1vH+A|BAByOzbe<%KBs<^6jrglN z*m5@J9Yk<3#NRC7AeWojNnZG<#^(W+SkUC%R>pJevi_tL(IN~){2*=;d1~YL+9?wY zSw?#!pV@cRnJ*~kQQpksdl=F+t$@UzHvM7!($YHr#Kl(>pQ(wdPQtYu|8+ZKm^puQ zVNvT8;+PC;If~$4vy@mBj@Lm7ieV*ZjkRHx*p4tDkra5ACNgD~V8#*%!RN+Y?D!i> z4@Q2BHB{}+kyK+tlg-JWNj*2#)y8h8nm6tFM%(rU zxDwywS0XqphfyB)XX=o0XJOB=)ucgxZt@{O_w4*3_{T*mU&B_{1AfoJf54UfH}HGO z^COktvz4TPM_SxY9dDY4Qmua(@Kpfsg(9~X;Z2r{DMdQoV!DEFGv{w#6IrJsIbI>R zct?*ZQcDeC`(_LRjK2i}?A@y>!2dVY_rakxO?ubAQ2bu2{U%(H4{nx3%?jV1m%)vB zgm)P6f=sb?<526%xqHQ&_gfZNZ9`aFaLOPWEit?LFET+3ZrwJ7K^?_W^8 zx_V3od~&p{ZD4I|LZNx}>wage3p3i&XyEeikTd(A;BF z21sLmmkI#Miaj26_}E*sTD-?j8_9>Kph1*q$Q z551r!lyX<7ZD|WDd2Aa{!1OTFCxXvGgWDk1#n_y(;L?ee7~XKl+>@fva1;;mjqN&Z z#`TZKr#|Bx9=zxK^aR!w<0C`@o%0ilSM#etEhYV?NaZOHX&f)DMcCpH^EGB(-9~Fq zw9Uygx3B?)b}ONXfTO1LoP2o^lBXm!GO4ChP}hPIN?dO@Bm(WXWB!d)wmzt)MoT-O zscR5KuBkk;hAj}=%#?sSKUp$~nV_&|^&vJW1Hew^>n5h8RXf`%wm0A6{!iP)xwWzD zVc2WxQY{3`^|l41`%Sd)EwwP^OIjG`D;YP|rNnZ(X4TaE9;z5y$HqTj@PGJ$Iy4Ni zjbOdej~~2ZlKSGeIXH`r}SaMkRV!jHV9VNX4a!3gZDCeID+c4?EHlEpZwS}^M8XvmwPiwGwA$=5WYNltiWBy^R=*}Oporbz>ICYoh1jIm+ zGk)*&e)=TRb+oWV=K{;d$HId->cgtB5WnBILVaXjDSXFG zQLVO{SkVd05S@YfsYczM5l}>$v1KG;h|l^mxYLu@Cp#tLo%Sk$K4NqG`TtO73U(p5 zG&LA%(%9_v|7HlS*kg971?(@{j#PS~zWc&l=;t@Ez!5?p30?ZVQ(>w{SV*-z;2g|Lp38JH7s+)yv5sFccY6 zoH6@5ZXq`{K}^5Tbo==g+5+6xeIa7kmqU`GRgzQs60i>nX#0qz?%j5Yh%;x2`67$$ z^h4nPf-k^7bWlD%cE#WTb21iHEH&$N(lrnN1GIK-zjASmEuC@%%*bI(wI>)D9q4W4 zub=p`iK?Y^(-X?Is~qJ|#RN;K)#YS{Qi-&jvUPRmuoR^_{u%vAcXG83E$wkMFerAu zDDeLm#b$oDJH@(|2h*}S3{hk<`Qd&>NY3om&u9ACsh^Mavx6VW7d>y)&nEr6qMtST zS;>#q4|-mzpQrWnYkn9eYY-KGn@9NY<>ulVoLbAwRinGwUnR(xs#8XBR=nhCp9vmi z@bB@@+K*51?Z;T=#|F6j2fO-sYPh`!hu0D=tSK|UGvGU79WBS7OTgW=scQbi@(rEk z`}ZzC*Kfbb-sD=(5*dhPS}uqGF!=Y_aCc^0GU%4pwbIhdy%?f3_fioS>tI%X>_Vu5 zLN9Ku)ND^ZQ{J;8yXn)#jGYH$cE`l-Ewq0Vu65@NPW0geC&JCxfZY{y^!do2ts|}u zCX`ixnO9Soaev+Z!^fyZejO8aL27Mumv27|SJ*WN?r3BoS|@9Q7_k}Zht$N!A{Q0P z31dj6b)CdUAJN5!0(lyf+jM`;|NG)bI$pKdMesN42#u*MRU(9GF0e-*orqa>QFYbK zd3PS2qfOR5@5$L<(_0*>?d#pJ@_S3=u+7>)2#PT-v~w`9!)j#=Y5&%QGp4CjMc zmS`fbIl<*0L%%bxVs(s31+%*iCvmY^&t||O2Mm>=+AjVD7o=t@x>jK7YAsdCiEk#z z5KY-w3AB(ovxfS=uKH)4i=%kM2y$hGt-|4SX_Ne)S* z_9k`x9&I@LfEmqYWwuH7Cd;(ZHB7xOQM{Je4~rXtN~av*GxM|+`T%DxddbqfNHLyc z`mlj?1KQ=Ox@Z=Up|yw&1u} zARNy>bDYjy$VpuANZcaX%rJaz7rc>Ra)O!@sU>2sTG;RUR+v>MsdCS9hM611#?0 z_})~;oF-IVDKRhxp5sL~*!vO*%(H19>f(AYlQVt_?qNp^5mSYIW4j}%5|NY(g(oY> zWXzxJ079e5uRD4uGi3rLV#9lP{q<|iF?BY$0!~el+sZQ=-qYTDvLIUn^REHhZ$MSw@9gJF5o3^L!V)mab1N}T0fJ4Rqwd01KN zp;yc=-zD9i!;pznr=Q>APf_z>`2X8nn8p@b!wy&4>x{IuFWE8!YNN7_U5sguWpwl& zxBNq{}PI#yL4t>*IUD#)^$#YR;X z_J5mOeXBC}+3eQfONJ^k2gfn7X!iELTz!|8K4Rd;s3)G2UtcxE52fUVu5mU?DF!8 z3FR|~dleVw!D1B`2O5T=0GW@OFq0d2LO&jjG)*clJa8iv?*0uYapK3mggMvgUvvMG zk`2}uL2}#1t1L3rWxj;4>YSP{)O=jjjvqr>6?XDLH`Dw2SqYAs=)luCil*~qL^)Dm z^*_N~Ui6)C>_QlDl^D>AUzwNu3%`LR(OB)AFG(GlUy{*~&2}Ea<(NFs?=L!}I;2BS zPPDga>OiHM?_o}4V?&s0$K4!mKCZ=bb2ye|{_cqkMoWx%(Q{*0mPfCm%#|?lK75Yt z9?V5m=2e@EJs9P>iov-OCf=6LkZ1m`_JJPA{YWE7SzDhHSpU;n+ni@`*3et+F~x|27BSq*v9kegc1N zD|u@!a!mEyl`!j7Fzf!zS%-D3*RvPBv_y5YVkz;W<4YoyA4Y@|PC#DiF=TaSsjEbI zLF&%;lDU596X;538)HXmN9ajg>S%7VbVB@+D(G)6MG-j2ZmcXeL7e5Sxv)xq6Oqc> zY$<#%uPijDr+~e%P^ofjys{`#d1V?Lr2K_>=A`c61lC;W)NFhuw0*oU1(l@>F_NVe z#sO3}aE&xKZ*bd{RtYKh&p_IRSSe6puRoN%(>9gmagp+)X6cC%E!{l0dsXaIbf3+>y}h>0qeO_yK-Xt;x4+L#5NYmms&jc()Uxr`sV)2W1Qv)M7{MOrQs2BW(a5e9S->XuI;P+IU z_$Bx~J(Uss_OTfcf!}^MQyRb9x&0=s=8X68`{AAbaD(6FsSG{v`@x^Uuk5sD8!B=_ zGMui7TmvWn=lIq6gLj>CTb~pWH|>0oYGpKA#@|Tg`(poK^IN!{3xc-+o9;X71gy@ zUT&5U5RL=gPjyNqrEc`!g{yGhDPLYJx<{i;-D!n}p=2vy~$tGdCj$|Y|nw2s;R6MhEuu1T#4 zD4{oD60W9A2_GnDzx8WV7ITj(`=u&-QF*(AWygrh8f|44xXNOw%FO0pxe`h?RruKJ|*TQ%r9Lvm#3;R<$e`;<~OQh9Y{1EC{q_o2tH?BwMXyRuw1XX!t%{mn6n2>#7@`2t3;a2t{iM!#V@^Mj;ndgviYz_Z;~cSv-QdWK zAN&5Jf+KcB0&5jUe%|dBE;~ShF&g2S0OU;+EA(JjS|6X*Z!8_+!H5kjQP{qvNp2# zL@;vo!l*x}Ks0|f#);!1d$VRAtwawrEA9dpcf~75(;&;)>l-VV%>?R(!I8bg8V)C6 zI0@EDo(!oF%~u8mT>cw`20d)1*1%!JQ=()!Gxj@)|Omut|D_8vv_ z6iz$as<=C7k{8QgEvTSgt<6;9FYvb9C)xjq=CB`iZaKq?1 zwFf%@K^@wOt_375mFyv8MOUH)#YfHIrTy1hlEia=J+C-pO?H#hVUB$}059DZrnE!H zCCa%#Iqf(wr2hDE1G}PzFd8#Usbwm)faj*z5ddl!f&3BM%?MXdKIs>do>br*wuKH& z7pbqJ|5+7&D}h+<&N&3WSpHt_jNr0dNR#t#L+!mt{)J8Uqv?ykIhAwrjQBmrV`qIn zRb8*Yj=wfgRf@kFmp#o}M#J&&SQ)Ickr(hCY}O&{=B&o$x~n~-{*D9}s_@XX!(Q*c zKda$J$C+>fmIst+pFLxDJxVs%azux@CxLTmYyD{WDZ(O6+(F(R9Jy5-e2mYG&!{km zQqs&Qkqua0nceijP=0U1Zl6?fVtvtKT^mo&WeXBlI(>cOab1IhLn~Djon|hfAW11r@_J z{cEdeO)rssLmI+Lova~eecZH9pX&!i_8n{(;9fYtm`v@kX0T1cQcv4pF)OPR2@{nx zw3SjmvhS#de0d`G99%hm_yFKOsaTLuki0e4W z9vxV0e$umuU$5(q8y4MlV70&B-EXJGxh<*rwFW&wgIH&-QB=!#&g8Wu*>D=AQXxKY z1wMY8uR{dk<(L?Cp<$1IDXxtbZ2hjnGSr^}>m}R;VfDFF6OsMG+x|wXV2?PNW4VUm z(lt)pp@}TI?3Ut;MVSCErXlbVkwE4hi3#;5pbS~N3f^z{SYMNU`Fb~BXM=z?dlVVC zNB?9v=Wj3Pu;tS@yBE=p39yr%0@a7FELL!~gYPt^p^NH}pdhBmx_)Rkkw~;Z9*)So zwz%kdC>f^OV5+GUu*&{d5$V@IEfud`j4Se`_BmQT&(Ty@YpA)N6$=j5Fi{P1Uo$#&wowv zAM{qH*#Cv17Y{puQfT@;V3T(0&~GW@Www!I?sEmEYtytyU$fRp zpt$*eEc-itPbPUJkhI6Q8B(G~e^ho@u(=Na zYJS*zRKo~j*-mF3Xeb${p-`}Ff#TyIU(a5!NY6WhEwK2&5aO)-EY#Y8>(NoE6RN=} z1lCRf)d|So{q@J9u=SaFRO1WJk*v7Z6@SzMx8CIk%VXTslAghSF+*dCyNM>j=2j{k zvqDt|$8AA|6h!vzZ^&*@pj(vX;DUD%m@VtzzcHF7_tziB=Zu+03FxWpPcU;ye|eT% zsz^Aki_HSO-SvH$9}ezsI7L~btJ^-!;ns{k!N}>fg)-g5#1M*)d@6Q!@TaS1a>!SB zSJueh;~R*lNIi+j{6JH8>`z)R^*Si6+5xi1TSdQoiF$7RHJaM1Xr1P-~)l6`P~hI7klVY zGDvG(CrCYW`71z_TPldw%`f+*@4e1YK`r?GqkJ*s1&P@AyXnQ6cJnzNpU3~~rzo#P z_lV8hyLVbF_l>ElvEdRNBaYp`i8<5%6PU9FcUOnM75BirTX{`F;!SGLnD-s9RbK3Q z3xMyo$r-tIBX*loAl1wU0as<1?fCV9`!W$lFe2T^&ia#S*4LmFjg8Ah8gde7(}QBU z<4A(D*53(dol>xcKe18$_*VKkca3B>Z%^v<>&a$E%!--&?nIyj1lFxffb>)#^)Ej3 z`KP*v@RP_p8C7*qB9{Bs^~D*>8kann(H;XZKCI&dH!_s+X6Y@Von4WgyxIK0k3RG+ z%~>|{rf3Si*E%56$vP&sJjmx>Ii2_u#P=U3vsM)M$}QRA#r)!Lb_GYh@J9{Zux*HB zrgmyi4FRV%B?m}{;$F-~Dw3p=6dYP}*FD83#t9u043fc$z{A{$A}Xps)^C1+nrA8W zD1R(9nf_j?aquM4H|6K|K#_w7!7!36LXY`J&n)2TN8cj+R!#B9inVvVmRN=a&oGC> zxyi?&>QgCPPT|FD5Se8?3sdUUoH_V;$8smC5~gll{JrUUwH3UyExM_tb=C>orB0&a zgUu5q9J`J`+-*DsO8A1P`afJr$Pp27BH3gLPDkaVT}C5i2(gBJ_Gk051SM)n${Zqo zDrzSjhE`#2{y70A_UE53TZw5Rd5}Iz^j6CcFdG4o`-js2Ep|nl)jy`eU2S<{>N-;s zl?Y{JrgrPh>-RyM)1g=sBO!T~DOP$s=d;^V^XG5L;V*%rt>z^zLU!~!T7|A8cVp#C z*A*kRk4_C+Q)SO#qr5<5x54O-q>EOGi|x07H${dcSl{1~u#`cbBGxPqEVkgBd@JC9 z3*xr|j^Hmc4}Z@lndzydetr@TB31bR0x2D7kRre_&kXYk!If09%E5mChBQm4-tU|O zD(6J@_H8(~6Eq;MvUo$W7~mkese$?|O+D<_S7`Ep#9U0e`DhV8!|uYqW=1Q&-|@y} zh45HL{W!6zgrMTn1sd=wStdD^Q9siBnv#I~^M6u3*ku2c>dkI_O=EAdGAE%JSBY>o znPUWve2whS2KxPh2Bbm3yWbRfrk1Od0?mEkb6F~MUdoF_QV6DN+)Co@`9k4^A_wwj zPc>lXmTRGDFZbuR#2Zvm>2O^<~(_NPnC=L`9M8iZgxKXEdA%F1{vU*3$R$-(Asm0lwp z@8Ajh-y-uo+l}V$<3Kj`_hc|LH}}x|^;5Tr?sHY1=*)bN0cGwfimp$ekHLP10r5?t zBcAi*jUY6h&C$h0dC`HzZvMdT*=@mZemS=1mml={($e#bNEsX0X%%)NFN$L4XzEq- zr9Dfbzl`qr&6M{1l48hR_*ZuWmGQ}AeAcv9YhZ6J?Oc|om3b$Bf{?9`sY0v1?xld` zAH>a!!*us*@;K>x1;1t$i)C-UOrTc#8+C3eVsYTBGDOxFh^ESMx10|AUF>*v>p0)Om&rB^H_>${~;+ze&RPFmCS`L?v>q^NxW14mYc|GCF^=I zWJ_oLNQ$1-_jT1T)82}#tY%5N`hlwc<7U5l=<|S^NU9~Ct-QR^&&%~lH5A=0iLsjk zW{|5j>tuRbk)kg%m(z+p7~A}!Ul)u^TP$qH9MoyFOjB>#{%qw`k(FqTm1kTF4b0XBH2dgtRS|p?jD#T*ytCt@rrs&ek(W_wd4+WiE?qWPhTSMnYL$k}CkNeEX z)z*PC@D!om$?cd7r&)^!514S4yQ%1y#^u)d+Ayebxt+DRVp%JFO0f#cBxiJFF~rtI z;F?Q&GLXfOE7Yy<03d8QlMR@_%mH2U=<87N2a@oFk&X?_HEedJ3-@kwd(UGjUFu5} z>xuL(?ox^qkuyn}W;V%?vL1HO(|u#wLoIbw7{@y3=-!)`N7n>H)5bbsk|IIuoU&jm1Ed zGPGA=92`5X^S!Z=y7+{01ZXz)9nk^^bCG_8WsAH_RFJ{P!4}G8>U9u2N%OEV&7eKD6y=li00)-iv!8 z6Ue4rWE0@7&Q7wai(Pwn5yx_Zzx^W0Q!>^`&R=L zTT0z1ylbx;msy-Pj9~kUNv#eoaAIA;Hv#iLS*Bn9PLs(OI+)Hjb0d9AR$5YHxwE@2 zk7EJ$+A1s^dAG`2bvhC%yIA}q_T~QPo&v)G+zqPEmlS+}gi#lyp}J71bvUD9ltmq# zW2hj#{4T8&|A(!(@s~x$Zz(Ubck;}0qit;1qD~EBhC-cMkg)MK*qANh17?VG5dJ@1 zKVxY6P*Tv!IwqLZU)c)_RwKq@BNwQK;7?zjQCQ8nxhGzYuBwT)a_H$ycPj4nWI<;& zDd|Z~ETNZD9^=bUDvjstnB}sz}c1Hif6iF@!S^jjM(gFkp9AsbYEL2 z`4nRHbdpW<9yUXA5LOL7_y9VA1iIC~OY>weR@iF0yVLMnUkfl#F!92@f%cV_pR9Z; zO5u(&r|hy0?ti~n4(?T~|9(SB?$<N|Hq`>5! z9l=J~$UHf7@Q-MF{`qR`TERtjdBDwxcW)$3vZ+j`iIR9=2YA3EnM&4by${7oSYQ>* zsJ~L7J*x0BwmbJ`CXw@~lf=e$;*}4xHAgL5Syag)?p zCTT}oKeb5x@A25*#{UlpRd&d~n=QlSVX0I>WOR31#t#lD`s^4u{7ZxJ$FNLZ{6jh3 z09AbBGN?Z|j#EP0aKIpfloh9H8@$;=&-Tcn-O$2SJAD}4i2NDy2zaGL ziH|}LzswX0E%#z6HB0zh zt4{hWXB#Zod^sO14Q{1do4ls|d+%gAT=ad>7s2G=!ddJ#-X5^$zuxegI`*Qw&mI|$ zU(`3m;l6M@chy}*85gnY&J0EN)&wJ?sgSRKjp^%i+0~xz%ihcS`Rn2MqC3%1Db_dC zw09pZ1S6R)_X|t9)$tB#)bY#ibua_Qmv^8#6FFiQcdTtB{&UmE8Sg4A!CveQsG>g> z*o*&)s9<;Py*L&bR#&^4a{*Sp@b=#r4 z$R}<4jakIaf_vJbAp}!E8A#nFnvXcnXC)5bY@fs z4O`7?L)1qrJV?_{_cUdQzC)h<;!n%J(rumeKhi(HPLkzj&O^<%*GC`pnhx3#KQkP^ z1ZHlBnG1F=w2U~ge<-q#5tQ|XuSL)S%sgL|1G`+iNS_?x!EyIkUiMcpeL;>DkHl(9#gy^lj^jxq>1qG6oC5wrA2R&1Mpvg6`X zZnu7NbtpcNX$w_)t$FS!M*vooa-zthRIKkt+#I!@F>5}JxAP{)HOII8n!ZfueiB=UoQf%7ItmWl?awH9jYsD|Gf9%*EIj?N~RS52AATP zwm;jg)`@V;$cB1y-9lN-6*)=${&yGZ{~(*Lg(6#rE0E6VKRdTb|@WhmNb3XQ0D+Tt^eFn}*44x)-~s1YZ*o zC7Zo?7F=2qd~WvSj@476vnN~pk#*jlevd+Tj`t!-~xZ7qUYO~A|O0MaUm{}$&Rk8^t&)%?G|wV#s#uvlXITEpFOO-roGnMYZq9I!0sRc5;yVytvee*v^T3ME2|D+Y}*1tBA{D$_5!u3 ziJI%;dPE-0exQhdGZ{bjbDB-%Zj>u*i28ZZKlohU1v4Ohp9k)v;VdaY%X4dYqha9( z%WLge*iEY@Fc0|f^s8NIxITdBH)IIzLSHt zPz&kO?gkvUr_-Kfw?=Q9Gpoz|+e$iqu3a*NIjS2>ZceeR6q6$>I2{He!csv6=`SYH z@cc!?BlEXh22P}MP76|;uOMmg;RbkX14gMs{84L-d#4k)_itk5rp@G-_w|W6Gvkx~ zJyygnF4n4ZdJX4CR$!Rlmot~mo8jBP__jec-}YJawE&9qU3Wn-V-d9baAe;j+sZkV z#%)ud8iuVrykF~0UFR~E%I=7VSf6!m0*(6?H9TE07wm%*cZK9*X$LILP|qa*{soa` zf=>qikrkV;L;#fEX&m55sR6~Hr|cN15woS%rAXW_ByvAkzTe+Vdx};(>TW}B9f0hh zS$$D{kU*Z-qg`4qf$e%5!0LG4BnF;U*CvTmV3z}^Ggceqr2X5aAVcA-H8{!=n$~*% z(1%4!{GgHhhpyBQ52J4!-V*|D0SEC-tMvdF*ju0T^9Oe_^Dias{)$aq2;@PrJp@Gn zD5@=^2saooNbb+pdXAYs4Txl;=W6Sayg$!|X4-Y~_B)rR~sz@OKMDxbi7m!sT!qNkn`8bv(=rn%ug-qv7r!X z8zQ8~21zP|H(KT++)oJr6_lc0tufkSBgkziFL%rmfAhMEaM0Cc4oY{N(i=Iv{D3~b zjdmW=N26lZNRp6||7E8|S|(A9@ulUXNXuBh#wUGN3H2L)iL|@{Y>2*H&YwwQzH|F0 z+9&Mjz^o!$AS159qBB@uP^~s_c6vwp@F4Ps?U`(pk%~VDorqzK(SVSUC@gF4xR%Tc z$M=ql#Fc7WFF}y*5Vx9q8B3EpE#aHg z2BzUeo-Td)SXzS3c`o$HHN2(}-?7GfEnrrr9CW{F1?g+>SC&lXO7FGUz2TYjI(1Xd z*q0PBtWe(6m^$+;4Sowp~+fk}D@h91s z6R(?oEC6km&sB&p8*{mykiWMd+AVi*x~(6I8&IT^_1{vbGdU!ITUCHhyzGX3$CuAc z{#K{m2@je#kgE?8x9L}!fd1PG^|*DyuIRD}$=eiRk(z@`^0)f-MHf)0zf9D|1||T6 z74`1tu(K{B9q0ep`13f;XA}O+&NW+Hh(D905zPM}NdDGr4}@M2i1fGuKCm!^Vj~h? z%THL(@t)lbeh2hoeTQn6wXLooE{Y<=*$q)h@TJVv%ZdE%td zUQ`DY>?yhYch7&WVd*mTsjMX9al+K0pfSIePa-YF6oaVoN!Lj#a|$f3hbw-zcDQWnWS`21AZkYA?p|3XS?hTcv39cd3f^FQ$(77Y;4}U^K>K8oC zU>PotvPp&W;ZZ0^h%zZir&zr+KBrQ9$AG1;dG%=Y5Y(f&v%FFyq~gxxC?IJ-6Un`E zYewO?=o_DPc9^X~T!#bcg#wgrE>7kC64k{$*woD{;8k0Kb!*_9B!jKsexubekX0HN zKevEidSN?Ndn}|vHy>Nh})dk2jDGMiG&-TOAh70~x5iaCcnC+j;bQ5ZEQdaWQ-Jn{j z+&smAm_GZ`e{?HQC(t1LcFVh7KLq@u(D${#wLY-elPVA?QG91lik;d;u@5smDE63; zV$THeG8D^s&+C^6e$c6e)iG{2IUv1wob7%IF`K>J$aG#Q3n&u(iYL)0N1EJbm7CC* zY$NMwlx@B%5%tq*RJdBA0Yk7j`jC+$J;ANZ8E}QNF zE(+Bb{GRw>FLR+gkthRolBY$?N54NLS#}XB^qC)7_9WOC(r2}V5MqNYP*UB+tSXb_ zDfbzJDrb#ST2^o_R^acS$f-(QM-c9-k@#vxq#H#@bnsTJ{k^`GeP@xcaYa#)a;wm$ zvhow*`eyxelOs=lTAsS5sIw~j!}77OPDzd4N4k8$Tks&mHWj%=VxPJyV5?VuY*p%8 zow23t>7X>SE?j{m%WAk<$$tyex%Q{3Y)#!gRb`vzevd2d=HYO~wo;i*o}z6a>LaIT za-nhiaHbo>AIqXwmA&=i#OQq;S9ryv8WBg&fjm@em&$k0C;3$roR8co6;KTziK;x` z_}`3KhO75H$(kGu1l+qIcDTyaaXa)A3vVUmIV#^6mIv0qo9N3Qn?iXXmH#3vFYx7~ zz6n8`bsZnmd{32`o_zTe*k4;UraT*y7y-0Kgq!WtvEOxs`wPPdVIEqliUCkD`FHmp za$9}?e&jK-5I<&<1F-;6{|RG7u`g=U-=vZyRdb^NN!jEN67nR$pGB-Fkwpz0+Z#YA z*1-9eL}wm3{V&L`%tpI{YgQCBJ^_fc+=S6;5u3eb!{a%WgF4TIYShw9h7RXid~Psn z3&hq}rUjI}D7|hDQf3*tJsgd?6(SjbQ9^fqkeUNcl^oqQS&NBj(aDVD`BA-Cqd>1F zMlhk1=+(68@|pTt$VO&N^!WgE=Ake-9aQk2Tr<lV-V~J86l>BxhAh37D1*VXVue}h!>W?XWHK{6TyPfXMu# z7(d@XVrcVU;)~2u^PW?T`-bGAA%kLlSCvwY>q>@jT}fWmtp1rE80lfLR8=1DE30|@ zQt+C417hvzeiueoj6No&yMW&7TONP&uvp@`%EW8sFQ&_Pt;w$6Se3eF45@6#Rh1n( z{}00Ns<;6g7I#!0;(b_96#PwdpGve)TIyv~VGfx0R0dSQg=F9%Eux(Y|}ywRsM%Kkbt?Sk}*?#V%A zp8qPfUr1kIZmW8f{cl(ouYnX$@3_+DaPvRPjGL^RiMX@Nvg`=Mf|*QXHFUla$P(cK8P)qtLj3(FPzY)*#ML2y48q;nB0=WvvNH&fCD^`?zWaH_< zc-uh3UADN%#3zV0_+i^#+sGv}ZlcUtXA2%4Y$7%AX!@)ViC5nrPT$_~D>#N&Z=2N$Q-iGY zw^Hzk8HM*BFz|cq_oIGxwETd6V>M@4Y2hJ$={f{)mhz@BNOov=8-s3O&g%HHa1jQn zAt{Bk-~v;b8!5ldE^*_6^A@&GNdC4Uq2`7aJez0w-&docBU9y z6u+R*TMePBfwg8GIN;&O_V7_(GdaDmwUzM&WqyvF4CmVeG%}A2h5km}O5IjFy-&v+TabNsll~BdqvLya zginzRjXKfZNOZ)|Mjh>IB-x$Uz437*Uf_6=ODtv0aq976*Mz^XTbT63{gPwO0b(l1 zYIv1(-+GqTePnAF_!!|%^_y6a1qZmn7;(pi62__A z_pW6agJ}l-v!9zMcyzWdUO!$VdzS}26dHHbYdsl2$H3nDY-Q@FJ?`%tFev1s{{B86 zVgy?wpYYNJ{?Kvr9|vmqkA?|#>_kg|{ii^9&Sh3D3kI-bTWLq7z^_P4DN&1@sU4At6o=V9j+_SXCA~r2{{KuU zUZlkbWKA!L+XghNVOsq0k5sv#B4c@II4iVA#24peH;^XvyN16=i~~>q^d-+OGULVc z5dII~Ke5E&u?a9491qWAGK_dzX^xY(sKO?B`zWH^pf0r2kx*cD!^7^Ti=c#;(mHT{C;NKIzJoh}x z;j6^|hUFS8<@fpW>%U1kyARGsh2_gOIJ zAHFZ}Y5p_q{p-F&xt~Af?yc#561~@5dUaW8(#!*tAm44DLo*+hku{Zhy6QAl}jc+NK>;%x+rwTfIR1 z&S1Cqo$j%=`mMx+Z*)HbZ!EG5)CoWx^6ULU3`M_E!~096vs9SX?h&MPFl&8xx99~S zeVoYN25qRi<0WBt^303N3;FY;Cx@k-?~B>Vm{Rsq-Qu8Z#MultX*9gAZB0;i=Bj96R%F>u zYXSSf<+i@}YS%cHXKu<@1)E&7X0sp6xXQ}ky_#~kC-_gfdrNP1!QY7YAqs&X-@_a~ zU-KO7NOI@Y+QtB@E zo%Nl?J7yAEbGw4Xh|jvrx>^Ns`uTm+8q59Nd47HiYpi@g*C?l`xm=nv_?jsPllXa- z!}=xe53c*zBS&JN^t+BBTH93ajyBpqR^yvO$2@pMzSUuRP{xDS-WexlnZOzHz{|=snf3YgSm#F|J9`ijTaxL_A%5B`?p1V#J6;k01ttO_%|vXj+Wou zK^6CNVCSCk4L$TAmB*;)bWTtLmN&k~gCq6eSUvbB<6Pd+~2T zrjeFq%x^;5Dp&(OjTiw(mpni^gi0nm2go!-SOKKs^*{+azCNJ${(qB1?$T)<(V75& z38L48$PA~=`o&MAb#LPuk zl0RYj1N?L!cw{M62SNtPpRimw>7MuH_lk-n%qX82mJ5B|uYLJVnITXUn<+C#07YOM8zVQ88 zH`Et4OrlVdEaZ>j`x0mF1CPS@oK2O?{3&-MtNkFoaEc;D%&Mo=F;q+5@3&l_o}*>4 zc1gYoyMW(!gl)Nd9-+xX%G{LYpd*H<+1jbjOa?h9tJ@TRP(nrMtW6D29u*sznZ)!} zQ8e5A@f0-c@!Uzaw(*Tx_UT z(KV)dnm7H_xc9EGqTdJuOdT=)&OFtqd*0*E7V%|~k=EZ{^+e--?aRL|Wk}3O>mQbD z5bh3N{>bH&ii4?o?v`QZ`(+x=8SId`6YoW^gN!z-XY-&3)K|#v~Y<2Co(=Q9p)Cy#p&<#?mn~+=^mlbK183~ zlhAxMPeP%?F@-^O<9&)2zY!p2x}}&3xWQ3LBF&@uPCR&|Wf)(~E@C;&rZ=rrU_h4r zh-J3(_G@C;_R`lZyVl;EhN8%dwilQx zQooan4o_Jhu9}^%^M?6?<5uCHE;{qSdw!;J2Pr(tT-5h88+QDtIfEUy>cP4;+X(N_ z<+rKa3Z1nxx%Ew7`|}_00E;y7sXSnHSt57Gi{WB*TpOC8y#4Mv;2N&aOw4CTcxO?K z)_37Iyp^liA2Z2`q_n?NbA(Oo#DT_XaS-a!Q{;g1SH9qCw<}+O34S8F-t7K#ty+-* zFEt{es>#X$7S2eV;D&mv0~4-~-!wC;;RC%=XjXL7#1t5H)1^Lmsjx@z(&Wc7zQp~N zl%__UVU1$;PX7{XRPJ?WljcqOxtl@HOo>Zj$~kVcXWY%RHDqKfck%4x>4@{GiUQR~ zod!X2c%L-7l*IvI+&A(3k*?(W>ooO~`|OHi89Z(s3tC|P7OH<{W(qd%Uk*dW3i)LE z4uF`-eHHtMJDV%@SmT+*!VKC1IinJ1$T>dgUr!XRaXIjaoyVx{F|YB5^y#FcNEZ=* zmppfM^I?_ATi2fn*!w=##vl01)A}nHgsc+;Y;*RJ5M;k$aY>Ddo2eaClbsn=mODHp|4T$&kPYfN6zwLh^M9K7{2e1zN z>G4w*!?2G=!rqg0xCWYOlk|C?^U+j)Wa5+d&yQ*UUmxgy0J_t3LU#wyaY~fUh zE5FD@@wj;~k`bEtW@(7joGAh*bnW~^zlb3%=lQCaeTAy|s`}Ovt!mH4f2Z-%IOJ#k z*B)?b{1;zTk^v60Db{*HPScP`BB^97U(|?w@j@F_O1^a))j8p)W@}W%?nJM~wp>NI z**lI3%LCV1Wv|XEp(uw@di*oh3YVyxhB`#;CZlHD3i$x9=m>l<#&oS zZvp*<$5J0caCn1Mlhp$zZmP>ST%ODEwSCdGl%7voXnq0 z^LJdw_wr)r1$?<#B2MjBImO@TUx^^V^!bp`H6k1i9N%_-i&oVTQ&CeDw!9@uxOK$$4+i}Gjaz3 zkSH_WTwfule^>nH`Y&re?di!;g- ze~M)W|Ct8AhQaTMb#AI0`-mcHU9de=kWx_5{ zr)P<~Xgty0=kpPpg~c8o2fHQ^!u{Jg7O0D#8yg8ty0eIFCyAv?oo^)m&TObr#trm; zQ8nYKb&q%^Rev&Nxs=)b-2O^mKHJ^t%U_e;CB?~?@38Vvh8Tz0peL!^Z5L2ae8Q~^ zn~1toV1^VuGoB)rT>FdrD0I{Pux5!V8I$;*1=(2=hM4OZ_snp9-#OOLua#HDCXrVe za*Rb)vD*E2x%KdS?O=?(O$^6p?=Zd^H{Or$!D_0Qsi`0wU$wgfuEqGCET%}pfbs30 z$|Es#H-|!Z`vrXb%y;rrnS5-xBN=Wu*4pG(Sc~=Ujj?{L_k?3L<}F$cGHa3TTbXeK zt(c*yHSDU^{flRs9Vb$xrEm>l(QG%+7gb1oJz7OqTTv!65I!3h=t(N~N|~H&0nQHJ zj=Ep@HM~F*)B>>nl)0Cp_Qo4m^4KOc`KIiwa3V*A6M2B@0y>Po3+Skc0{Yqh_2^~1 zZa`lC*k@d?xL7{0|EAS%|SiPA{Ba8%>7uo2fNyWH*L#)(K-F*d#qX7GIrTnVP{R zTYD=LTQQYZ;s7uEc=2hl{mSHwJh&XmxaHIRyfX1Zdh^uOxkq~YeynV7Ca-27e~BeNjYTfm zk8`yCe-!s-$c{r*Y7TR%)`kc*%tEo&8`$=`!EbrYLzOUhgoOawxKvkhS((9EFtF~P zFYUNi#s-^_I~ixFE0#x;dq~A-$1rvG7(Br{n(SpI9JW=J+!FxKQRG3G2(3bRZ#Zk96wV5J z4Hv>b0HF2ZR>SnfVj%~;0bv*cB8T+`1x#Cb1OTc9fSQi{Ljb_f9~)w3{^cRI>76%YRy;xZgRtlA=Hu@7h_)$HbWDaQ?2!M7|vC$i$)Ve!r- zOL92|kbYOh0l{pup0~Ja04vl9)P9ZVfWlWap=zQ9S=RG7jaj%v*8qHRxD$nqGxg!) z4+S{{!sd8iBS(%>que$~niDiZN3pVx>K-Bst~3>nJ}6~@du2QC zh6waL-&+qL0e3Ia@oFMZO?U~~L4G%{PnbVL6yTw^Stl;yMhN zz_Buw(`y`{gq^Wb(|{N>p(hzCG{YF^b!;X8d2({}ccr_Ov{sevym=s6TO_^!bWM-o zcG9~3TpkSY38cOr{cIc5Je`jN;cf~H`wtl70nqpQ%Pn2{OJvzH1`y(ZF^Jk=noG2G zrG%t0n}+GM;#o|5Pfp!MT1tSlSzs#+W^KjB`}k*_U?$m6R_QG<9*d9Nf%61&ZVtKo z88xecvD1$F{`lo=_J7*#=ep@fihuIaV-oIbkM|sThk~#V*1I;155nvG4XPe!m=X)0E;vswDOPg5alzD_s6wNJW2lM>B} zZ!!O}P4&lmD30GAWN(whp%}<`NU4smE!HpeELB})qLAJgCIhJpcY&@nJf$85E=ncznE=EPIMlflmxZ{9hwY3IwkHIs+Dsyl zzf=fVXPoWxdT0|!pzZ(xTuDIA4pI;INCNUnb$8{tH&gMo$zerK1w8B{fxFUv6w1{A zJkifdMI%@iisB0(YSP>rh>!+8$p`MBoaJuopFA|+ZdO^=4I^?n#Q?0~O$mS{rBDb= zlYjf=Ukm~Lp}wbb-;sNLFthRgsV;y&{Fv_|uj9ckfP4Hzu6ENGqbu#+-;$Q8c@)Lm z!_v1iRkxY5YyBh3wpr^HxEA)EA8Bb5`_^%pee*BlpBwU}5Y-MS?e{#e1aCz23kQ}8$(M*o)3 z{@fn3KubB~M7;j=0jK$+ru9ee2PiB#VXTJPc9LTFTWMM-~B9jf4bKD!HaFrkdJ?>XXQhD?;T%! zd0t2dKE626CKQAVQg;=V@E2x%$eU7mz98UO1e#V@6UR2WQKE&du$DfN)U#}6I4*=8 zg}uWm{7~e8-#@VEgSor7fMF9xus&Tu5lTow(8+21=cVD3b1?o|UMzJ}XJxW4$wXMl zS`OK4k55|MzX;bTC+iB_<+xGo8rm5Y=SdM@Guejxz3(p8ThUb&nn--og3rf7qRkkO z^{c4Ueu==v(QDj|hv^$4-=5%RN}a()GB@F`C@RTIXVq>>VO$}$3>(mf8M$(fU(7!cC8*U?M*JhBo41Ss!@MR_ONmKIx8MdtCqt-zy zVljDHp&Rk6M(Ll$5~u4bdG59;#C~x+tTG6j>o`h3fNi5#GYW7N{}ypFdNflwS`(D5 zk9>DE9vmH&1HVzJOutiJxH;da4<@F)WA`T7$E~&Ox_N>$@WXNJR3xKC=)*yA%P!=5 zMa!;oJI!0ZlJ~M6*T)n3NS{CohFJu@@5_R~BJt%yD-tzSBrhMzN5#-VQmTix?5aq- zSit~;n=SowW5=I)xdKP&Md;#{wucB(nNjUeeC&P>E~XFHaR%&-zQBE-XTqZ91TPyz zg&*++d7#o_dqmEG#_XW%OZ9cFEjw;LLcp|%>ei0Pih0H96VZ%0(eP-|1JrNsS2=5q z;1^rE#}EGxIV?932jprwqaRY^h=x&-74=0I@pV9bKA*$u2k;q*w0s>F7$g=Hq*2&e zS_Xn-s|h}_;YxQ z_g6bp5LGbXM8}niK}mU63bfvRPg)_rZc?PvO;LTIG0TY_IHh^(O<-Z4L#(U3d-gPgmrx6&k-E! z_{g85`y=auj-PR6fPUEjdm(}I#TcPR~>YHy(-+XKO=39f& zn%2!Q27j`6h@c#`Q>~Bb3{0lYAIv_hsVx8-QPV6kz#gz$u?cNq^-*aAhd}j@L zyg}ooeSl7DxNKM8@#(Q_!oNljBKC{B6mW#{w27?s7TNdd6##5|jXUj%49r)`|S*=7{{K=vw zz?h{pzEmFU)M|Gint@4ZFl_H&!o+VM=mE#be+``iWeasbghcel=TbZkWR6 z7>}_aq#qkZOMbFn@*T2&fF2JXqUfWGH-^d<^Sh{Seizlv@1nZ-T~s$e(5gzFa$xOCQbO1S&(=@Bl+zK*eh73)Z}L5L zEjDYK=N|pJ$GyCc+j@oB`2F85&?3~NnMLlp(Sx$wE!Q(G-USAO?;cQSo=`i?ZYFJ% zt*oY1B&I~0;z+V=rO9eoD6yWMYbr_UT=vS`3r#27k`YIDzC^1x-lTDul$=7MhbKQD z2UI!H*~fhse++`CDscg-7j`L{G<|V1QMJTSRBqdoyt9!0%0{^11TVIHTWUb^&SD;M zBrTyJ& zEhq1FzOkKQV=U;>LN#`NcVm(znpC*h*`LHGz44hQHmowaltk89?)P|O2om;_yH}66 zh~Qy#(T`#gt`q`$YIJQigU@Lok7)INlfit=Leun>e zS1+9CxlIbOq8RRxY<*ZTNZwmOr(D&7Rb{hjL#}jXDSM*r>WzWz1 zl{iwNST~JhadPX9v0#F~=uF(e_E~VnrT8YX9s0#=f56ge}eUF?kfZ_ zuX!JzD{60lk;@K~0Z7uI? zlK9aNPM{aCU8zb<%dSea>TCR+Y&ORYB%OJ&;~{=qWFC(DrO&9XFR!Ue*c+3R%hkqY zu5f6boM_c|yatC%;gs>ev1$1anjj@fO?hGiKK{rpXVL*m)lMEuyg$I-=<-Ls9*%V# z-*R}C6)7a9D?wudCpi^1ciGI!@u($I2MFt8S6VrCW3r@b{Ce%WXIl1)FzSj8$6wv! z8S6bP`waLKh-%jfOUR;#h^EpDqs^o-N)G;f*Eqo~|G?Rk5QG3OokF=WY%S_mk2Xxd z?M9H);@GFLRTU9L-MVog@#{zHekZrzSNo$viHsn=c?C7rBcPlA7&hKGQT3 zXCBPcpWjt*u6M<|kK~ChgH`D=Iz9FLfcuO6l!(KF%hVU0;rjI_cFO3BXxm7$%(tHD zhuc4$T8PgF7CJ=T+PPHg=nr$>DP$lsHwR-@*;h2KmM4Lcoqt$)>a~ApymrjI2ZFx0 z%m&?pr*{-T`oNaOecuTtU=G+Sfw7zKo3WyiLIx9hVUQYrX=`O7Zq;#U;QH%)n)b5F zSGK9y$mBivLCUI9P4~bQ@OG5>zju`>M4V{GvWNIvl^C?SDslPdysE@CoAY7yXP~KA zO=h%{cKD_GiMz^v%Ae3C?%&n5*wU9e6Pi%cE)OI-T5IAFO&hhh;qdaNryijZRJPc< z3-fhMoOL{-3;B~H-ufGe0VEoEBeKG884bS8L{iQYctP1FT9CYB-`%d8ca{bg z&H$c@RmEq8kbh!JB5p**w)q$-2^JN8nA%ZJ|?x}cHTdbC_};#`U6i-3sRT(@qorZ_DBQ9&;d*qs~Y!X zL6*TR7S>$|Z33s{$PiBM`zm6b_F`TkQyw?U=TDocR=|ed1JZaQT5|_xvRoWUuU@`Q z-1E;8?KDXPKSuU=1nrI#CieL=F~ z)j?B}*Swk^Th}Ba(Z6!f>c#2HJ*WQyM&CsyCaOdL`O*^1zZhMP5!yZWAEERTA?CBN z1?FOueW|$PoWBztn91MM%y>c>OM1?>Ffrj^4hMR!yo>#u+cHgj;t=Mef*peA)K0nS zHz0u*M{ww6H|;yM;X~a&z)q`d)8ZlXM*F9yG`!F6I`}<#fX#zlfO)_TZ55FgfTpuFTYRaF<2(5Igi` zr9qfwIM4m<9TAB+NHZEmD))x1UA2+JN%--9+C6^gU}_Cpjjs4W=>Ja|0_zU#ndHI{mRy+O1VPZn2`bo^cn%Qt9Kh&j zTSa1x8~(qVAD%CH7a4}pTp%V8mE@X)O`d-~? zwTy&X)Bo{zI;Y6`AOH9JcaI79HlRav?Me7=Kj=B_uKtaL(?9s)Fr=*6< z;vHFb3opu&o)vlg?Zf8wXP==%1nE+1kppq_3xn*l1Ku8w3W%4t_Gruba+CMXH>}USmT$?^IeE-e+=RYkB;2T6(r3(O$mw_0H9k`)?sl zT~os!m9j3exq`d8J3a%y-AFYul#hcpVV*yHkLhOkbIXQBwX#Jt_X%cgAR#McQ|3PGk;3f+=v}_2tf-YmhgMR zF7vp@J98R1KzE<1G4cHz0VYa_#)cmi|0FwI81GawodY>JS5`B-A!luLPIl1wJjTUb zSUag!FE7G7TwhdxUuk6NMy!yeFxENVDAqoB+@p#$EjB|)fX9tbSyH48i%Xwu> z{cw)v^bb0lnrM#Ll+NY)!eQpdtece`H_{(j!?q&J#op41QZ*4@sXAFVlZq{O$xzA% zs(gH=T=RD`u$pKDg{}6E+jO!YMWMFBXUT1RFE6P^vGgfYI>D&bYLK!=WK7zF3$?d* zIuqVcPwjo+W24j-h*3f*+HVw?##OnTzUk_Xy~H@HSZtt@8d$;hUZ?LPg=`7 zTQaZT-B*f!7*`0TEBStQR{Hs#*c0;K4F3nCD~bx5vHDzB>}{5~nVYn;ZEbbGJ&8wg z9YzBvR2WTQ3V~O65vfO>bE|7D}ZSyRLw*Ll+e$}n!9o5Bk zPcKn-n)(Ml;FMSnv@kQn8mMxL8(?9Id14F0qa1&K@Qm*ryf`H?ap#^r5RA|+#Ld4j zvnuYt77=Y?U-_JsKbQ9j5q zgwbV)rk9I`wFKR9ORLnufk9bNy@*|6v<3w$n5h~RuIC3&dV%|(A0Gb2&|pT!3Z|vf zhN5^lNlG7Kr@!KM6~tZo)7teZ7;?JYEd( zH!Lr3Lw)(i-sKC!@rP77!)(ap&H^mf*_+Y`{EZ6^Q8ozfj6vQW8m1%iOo;xMe@>E(r zpQcP_e??{^P#_#yg050ixclq1oT@}+US53CNZ&*(IXus$aimzfkIQgMaAQKUhJkHz ze=86M$dY0UJcfKOl*z_drgLD7yEVAAyaWatz^O0%6+=wr9zB{humf{{BEqknoV#3M2~oi70$Ob-?>d0So9#+^}O!d=zHH#|7UBXV7sKIC%ip zbpO=&=Z)#6Eic~)L>B*C>;sL7pohmd z^;=%Us#XWK{e|ML=H_SMj8hy$fc}59nvTa<$43O6(I};bSq+1dH8m|e7I*1P!?aj9 z`}39!KmwN>*EN*Gq!kS#1XUwaD-Ge3%W@7 zXJZc{^n1?C5PI!-86I9LNBX|&> zlzv@wjN@Ti5b}2%8F=Q&lo<#xyaIJ`0W-(f&xHAbRxc}RiEw^y|4I%YS(&&Hiu9hSE?~qHnM+ z=NuK%h{ZR5Qg@jJ)V1tdJj!s#@E&HobfhW)e`Cn4tRNgYPYk)*7&84O#gMC^YFrS9 zwc@hqef zq&gR8$kjjs$*Ar2?$Grc5=pm5^@XD9&>CX)4Nm*Xq0vO=_L?=29C0B`4Kg1NckV?X zQ;zlog31nYyNUelNgvgYduqDqqZ%j{%Jn`I7}^(NBzDzT$0xnM6GY&C7~Jt3=hO8- zjf#jYb?^RE2tkP5Lf}UcU-DU8=(ZL}+od42C4@PaDnLMkrXXr!l0Xh#K(;g%uz`#s zV53>(yV|nrYs%y6`&2BC_UBhl{TR9l%2$~voE&Kn6ii1^eCK{uQDGJ1;GAmxVX{B& zSvwv!86jMjiv|38wX{TNB*6w<92bnS223L zqI+!k-PeBeGbKe!~*S3Z>fL?6r-oh>nfM3x}^9JE-wZ0#ozTCbW ziy9J^`T{P=CJ8(&81BTf5Bs&a6L0ii&lPoto78~*+(cRr-|KFb!5&^eMC1LDyR$pqZHA^lQO&yrVhe-Qg(fP}%%4Z0Os`it%^Jb!r`AcuWGdhEsy^vkJv z!{MW29*4W~^C*=EJ4M=Gorm*3dFN(;gzaVN>e**{6xOv_q`3Oz$WZXQho~Ov4NqZ_Eys8|E70u7|Jq-a2BD?$A3$w z==XE&34&hxe{M;_0+&2vNX2azTK*q#>_|(TnkHW(%WADU@hwT??_Rf<%){HR%G$HTWNY^$R~EL*WkJ%cb9^Xj{IxyHgZ}YJ`?kYy>e-(Kf&0x5CE5m}1e&hn zZ-rOaHE4)a(6gsNAUY#awtZeLznCPOYYZC`LUrX=na0kY;J$8+O+;Opz|a6Hq+hnZ z?(`sWb$$kmT5U>uj^fIq29yUDo!!O3pYEjx&^fm70Vg~DUH0GLKhnqK$C(tZpa>Yk zt6Wm?e84TQBU|c-U;huO-pzxinu!K`U$>#bc-v)pSRIFWMx)#cL?&Zjc>d-agXB5Q zhs7tou+2bKnY<`)&G(1O*hK~^#Oy_0dJjNQ@2OaRQUCOlVyO8h1bOzEo+;e!HZ#$x zYtK;?8syz6)K1?@RNX=X%Vzn$An80;Kwq{j7Z{k)({7zwWZK%)691>vp3zQ_4+VCV zfe;1_Qj@P6>PuO-C8ygHK2R57ClMKW z&_84df~yc_Dy{9-pu{VY7PmP7P|ALqx&-SpM?T6vj-=Lt{oF1l?ZA|0BPi6{39+&$ zO1RX9$+rc0<-6MZ)pHIM8Z|4ni6s*f@Trj?Hv8sq{fB$139&mn(u^fQ!5huOI?|Yc z@9*)Y8=0#OnT3L$1`MrJSK;E?9$7Y9)R~k$1NZwIsP#FgBjt`}t9^M~lx^!22A2~v65TW(L zF1hFu*PNXfSy9tJ{>Epv^@9QV+Av+dE7QzK^ed>J0%fe(W%B{ygBL8n!ct?+0Te$mX z={hMF)<0?7Mg+5VB^wJ9m~1{If#~Pby3yTtX`&?xpd3bc6&Xr(5PmDrjmu>N4H*1p z4E6XQ`2AgfQC`Pt!y(?r5OEah8Ll%OAJI7y|F&7w5HZJSyu7*~KTGK)H;WUM*hE|( zMh$(l&3Mrc?F5laHcK}@M%1pi6l@nu&ZGJY)0z4OOV^stRQ5^3xyiaB&1ymStQHr0 zsTX!)+7S4&klmPXR%qyllc1x^i;jWR>CB!QUqiEaE<^1aC`hYxi5?uF(6^7vpwNY< zX5@h(i{Z4Jb8}Bj(InB|J9c#AO1D!pS!wPMLWRxH zjF)Le-2;`4j?uEQmf@lK0b3hwz6tSW|6O(=d{5^FqPH#1i|$(2k5K=zt&8Xf*&2%Q zc@e+J1@5GGp}e++R2o^bnW@WO<$L#bo=dUSHdI-E#vgHa6)ZlQtxR5P>$0IhFgZ+3 zF?Vb(1(^mIqN`&FW{y>p;So-2U(`9QCV8CwQw-HI0i~M#M@>|RkXt$z zpBzg(1BNSC-MztXtoYU0oH^ZxL-|z1Rq(WS)BIaP&Wo4R+-3jFgcp?)X||%MTD2lT zd#0pJwX&~(s?dS9L6*{{G$!@8TRVUHS*it7xIUhqGW7> zT}t{bT?N=F3&_$~5ck*I8f z#!xC;gh4M7`EFD<ym+~`717GXU(MD2w7}u^?$r9Dzc=@ZPf9)yD0O~QFllLPO{3)BCg{1-aO6nK z3rm7^x7b3^LOrzG>gop4sm~*n%B|IPEjU}SFPvcX__hMZWx91!{DWUA7vWevDC2=> z_>#g54Igh$x@4(mkKg_MK_m-&J7)a7-F+s$>__wy(r-SS8SY5(xWqIkzdT?Z-tM?c0JyEd@ly?#?R}CC>@UN`Wu|hoXgqUj~AaMTSWYM6&%8}uGD;Y{D?yFY1>#K5uycYa*O!1RKt(1 zOuSg7sJ3;a6J@hSe!f1HY(I3%OEwml)QT z@q1z%+vfb94(+kwZ{I_{z4j@ooFTE)f=&yPByG)`v31I`-wHFREI(HE z>CI=y7=aGCBx!g3lA(+KTw$wxY5u$sV)q4Asgv%nO8qOR2N>+?^wah*y|PN#V($l| zy7n)zvgaakJ*iB%So>Q!QX}e26aLJr z3~`6$hBk3lEG8&GX0CWU4wH^PB=9z;g%}xlvB@ptZ83PZ@Mh~RX199tYne*$1b1zw zyYvscaP?4MJpO*h0)%5gc3>Y9uL;b4cXBLwhe^M(sWVA5p2~f20W&|57d(7sw0pmC zRMID4Ym09)(()kXF!k$+AJ63$d-wYvAGE6&WV?!}buus%z3dCCLyukqcH|n&eRk_Z z+4h@9^w9Bs*55>h8PG;7peyZN08E#m6}A|72&RmZ@QiN7aMjBW541{je#RT(co#fC zmvbl7^;)QZCVumP_>?-<@qB3G;+f2UzmHk8_@6lk$ESGs%g5e>e-xU;YPxA4{^4SH z^UPS8IVS2y0snuwsTcfrJni%MdsTY9J2A(Lh0s15X>OtI&gdYi?<`GyAr=GLF{ktJ z_-p$yl7V$TcL{38v?5h(m4kYWuQbxk*rAzsb-MrK@Q^I_MlZ5`IRZUYinqL@hv$Wc zI}DxXsrCEUi5;M7m!AF0f(+TjkIm4BTglRxBFg(^IhjdoDqWMdx!6=LI?V8kH4~}t)@cdb zxxX;BYs@)aW4`)8k=u*R{P+jcQ5St-SB$^L`5A5e#C-XJQ8}_=N`LS7U zRv*TY8hi%drCb#T$>9S~#Um}hVa&FD#6ZCg3$u+*Ve6#R>o7d4)UYUsPwIGXEHv0K z6E$PRQ!mmAR;`lsG|gxoMeghUY?30PB(yVPH4jN#!BV6K4|yL2qy1(yXH0?oW%p^-#=NHdE##4L8~kJ zwzrS`Q}NN0L)gK&vB?52uLfml8WXeOFXDwdX?d2$dMnt-7+!yNEc<)65dH)HNke-0 zU!lKW_gbFNep=tXKGpOAIK*4EdxfzCazm^R;^!cKWathQic0pRCgulZ$iI}s)97t> zM~V)L;_Ovp1*PDmX!?1_<<$Nc1fM5gZ~$}r6>Du`F0A*HZ1N}N0{pc6M*~ix0FBb zAH~P({Nzr5eo|_i4P@zi_t0lE5EnMC30D5{7yh5FBHI0$F3{mno17^eW=LI`&1xrE z?RyM&<{{uaJIgIKUMy0vnLCaN9}m_wZ+(bz{p)TowtHvTSZusv$KyfjyK03{@rqmf zv?lvs--=JC!C!F*H05qKO+?~x#~K-dRPupO5&2X&(c8`{;Xq*3Rgn$#^P=f!8` zzosPPzrODq2g%JvT#g%Q{*~%-{>pka&&ky~TOK4a@ok@5YMXfFx9iK9{*e=53z@nJ z9W0;KCWJ%ApXSP%P4)K~PRON3GpXVC1*y@SxfNksd{U`ZE!1FVLniO`;aEQj7ouMO z7T*XAQ+~2}uVkK_M*3UYdcW^H@kHzpYN|TGL zRYTJzKgyNKdB}Y8Lh$8MJpk$1-?t`P1?;7->rN;xR*tN&6W`0HBePp&!(2Z7I4>)9 zuV%nm8d=uk5A#7<#nrIKQ`f^DQ-hQV9f*~9`}8g9S6m};KC+c=%<3q6`O&hk?0DJh zcf~!Z=!W4&MfkF?kI#mFUpg3YApv{%_3&TM)KqF2%<5~|DsMFe+eF#fKObC!+O~{@cR-Rhv_)n|=PL z@>Om8Hp5J6@YC>Iy98S{=+uaOhQ}TY6#v-egu?@C>ZPk5a(KX>@ePgKZn+dvBQ80) z*Z2zmsqqzj@%TR6*fqW=E z?WE~{K+EKaIr>w!v3|g9gTKO8)X0HIuH@isMk!moJaS`N@gy_U_cs8E9o*Oc$WdI$ zf+p0D=WBFt%C_DC*(N_O?9v|?T_KxRHyNM^1Nc!+HV5~oJNKE`wcl>t?OngJ-49gN z6bL`J0hzg_e*%tM` zs+T{dPPoSx_2)=(TpRE7udd;u9f7B#5D(qh~gYTvv7vEL z@|kFs+mvKn8W!$+Rd>AOdKE4Zw91ITB#w-JgHxhrZsI?aYj z76d1r`F~iy){5KCpH<$(#RCIyFHiY;RrZE-KOd*1Q+K3U8Op86Lzm#_jte(5 zoG+E-I=X5pRQr@P5;B6hVKZ!*k1fM0fbsuj4at_`7Sx{|3$9g}(0IF!Nf$`F2~ zdX))awC*wXd$06khd;sBPaH9pv2${rA;Dc%-D0eR;aYT-Mv}PNMuHFPz>&PbNpJ&g zkC80QjKqd>(1(XFdU;0vg#0rM80-?-lJPyp{FW3#zYtPA5xq?`!Qiiz2vFu)4c_y8 zFD#6kJrxRzmk`{qKSRw_&PdB=#>;Nb4?P@8^sX&)wI%~t=welK2#4S)na2f(rB@jo zGEAX+MJ$ZNt^WE!z>w{_u%mxZh}imM^uI%|&)zHixN4YQ3oNW_daGIvTATNUhjIBA z4_uqm4<1hXmJEI?fHlOCs9vl_t?M-ZWYDs&fwOCwK+YaZ@bz$5Ga1$gvJSVuO9sji z>a&B$A6^XBt!03^x%wp~CZ()&)vaAa&Vcb8KjbJwPUZf)uIVb)YFscZvll%Ou;2LF z7XVi0W)DQLe*(VuUfvDg<9beH)$*>vipaI*DbdOy;k$L_L8B6UrC;CU_3J!H*?_$C zy`3~ynfOHV4`(afY5{)Ye_zQ{T-N}GRJENA#pYk;P;>(+FfJypbpui$IlUHFaB_N- zN2O#SOuVAq8>uv!!}KAKT8_4g<;`KvHcR8DYv|z0Z3#-QGHZbrozbJ6#66?+(>3ObOL{sQ;%y~^-ZtLQCXed zo5M$bof@3OurpUaJZg!#l$oM{{+HiXv>jN=#q$w=c|p_Ei>5T!s#(j|SF2`gRak4K z+F8^_^{iUopnrj{4B#}3k|I+Zl%dUFx+}Y~mQxjF^JgQSWh=5!jKmhl4xHq)&+MdE zj?}KW-G)OrN2KL<;ehg0BXfl}PAY?|Xs*%KN)=7zMz`ad)k#9HzrN=6)7ft5t5zJe zQ=DVPl3zQlyxG9-F4m7!ZlRpJgQ;>o`7grv8{LFIf7a>Ae0OOPR&Fbaott zWTAT&t43zr>VH>zU+%9D0SQdLI5B_Mv>CvKe`Ejy7y$N(2pE&f{mKmx_DMW(-{b*W zPA?f|98)5&xPqXD61VKj2N9F;POU*P!jw84KQ_mfmmj}|WqgW0;K_8V6Hj2@cZ|VGfB>sa|tcCjNu-zE~P4Yza`e>b|N1ZP*uj=g)MheL~n!ZCqUnP8R6p#vFH=^q&8}h?={6$ z$tKYXSq4cjSgnDjzbfA~4(#n#k=PrUF$QyD3$K_YfLNj&^z*CogqUDwT@8Z`#s>*q zYg`9C%z+fY>q(FlLDQ<)WpITOEoi?}>*Kef^{B$JPsJUdZ^od_+#Y1&-Ti6>{Cd`A zIbmnV`c`A1*ZpyL>Iv6U3v_2M(uBFaTM6{aM&(-44vT>Q8FkQ9qD@U3EQ% z*1q*)^p!6SdF%_D@1b6%KKdWdpGN$`?35K{)V{|UPr!8enVPnT^oxYARTs}?mD)c7 z90+?#5t61r{t0D@!v5e16^`x^3p-ffzGdjE;bTK*MFB5aSkhdbY-P zUh#i*g}OX>L2*#Fpd`|~&Dax6F0x`V0w^om)H%F<5TAYP`|;VYVQ^%{f~(>$9Y=i))n)+#C|K`KetkZ_Y2KN z`~%ZQk1Bm&t6Z`Gwa*Nai%XiG7FRcO3bvW1CB?%VMsV~Sxyes%>+<#ZE^NzFN}~Tm zbs&2@{*_M4mhxiysN`3%AEVp2^}iKHsBQM(>eS0HKn3%-!|;=pk7f+`n;FOT+!iHZW%eIOevf z7aC>CK#xR*>;%EvM!51>gy4$n9sf{Y8*sX>W_omnjND6f3rx$cM(UWrc2!b2E?md9_Lkw8Fy1yRN_8FZnyy&>v0E; z)xgLR8-di!vhEg^nRYh3K|2w(GlwCx8s57HuMF|MwPVyjjNi(SEWv%Cf5PV~!LQIzkpH`_#i`Wyq4ta7cd zco^in2R$XXZ=uK*ydf+qbZNid*OJW4UyXQmSXAIPQ{>V>#`ROvfP@jTjJ6H;7aJG2 z&9==G*x4d92<9SXF z=Ypyi8$JvlGfOLX6L5@r{8TsjS~r*|J2tob@^G@<`&v^+;Ex@n4zcOzu?bOr-F&L} zEx>h1ns5s+Tcby7Z?wN8SGB)k;(LtU_vklDafvsjqk0{f`XAXGC8^>1hBx4a=Xf+j z%4{T`loU2=n6S0wYKZ79Ymhv!))DFh3w?i)!LaP*$Q?hB2=M`q-!W;T3gqMSKvwk3 zT}9~rv;<)8Dk`oAQyQM?s9$Q`brs^`5FxIdhW43x25N1+1 zxp_weC&4m>$}b<|l=|Q8UrBk_h5j$)YrNx0&5=00W-0Nl}LBhjBUY zjN_|=A}dCZD{taH^YJKCU#}@|`gB13 z(R>cCFW@s$&-IW0ZHpF>eX2tNAspCSJd!(^GbJ6b^U%wGjc*xU5E*j=X9xY8mn5!z z4#iUE%Q_zO??+l5rjli!T&LND2*GWdvGE_rEYhZLjGG=R$G$+sUFG=gcJGqLOmadY zJE~x3VdPdzwqK^J$6nBml5Ojn`e^~cE}^c%@|5)HyLfx86{>-ETA{zqf>fvWlH}+Ct?0~obH}#7 z)3+jZLtFXoS9kvy2>W8a8vP4j6%%kJOS`MDIkmgh6`dm?ZH~LiSF}}Tuj78c!}KJ+ zlRq1j_sYUu$bMDP{Bpxo_x@U2?IF$KYC>O9IL^upqH8$?m2tki^zcJHWjyoym8a%p zr~6hUp0~{+xBT|$kXsc5`>cMBtuJ3c_r5|c%_w)HAHYk$%3#8NR4KQDr*4`rdQe5e zG>;!URDQRLdLco$YT%q5ROomg!gdkg!VTRm;2+TY(+_&T8(ndjJ9AbdT;#+x-SV5IpkR(XjYdP z&2U?;IOq~1-Tcdio%urF(pak6fKdOu9l1+WdFmBa5ur_Xcn4ID%cW;;UP>PhX8_A-bj~o6%sP*apOWM1DM^#<@{|O`z zZcfmkL9hmmZLnH{MNI^BqCrnE(Rit%=v%6-(%RZ638Y>F6CmR_HdbqG^?hrv+Phkd zqE-`75VXq0*BfoURo!uHMcX15YyO|_+ULwn0_yvF{yYzvbI!i4z4qE`uf5jVYZnV! zUcTA@|IWjX`_W1HIO*GSw}O=Kzm)f3|Kk!eno*F(+D;5sT-J6;>sP<=mCpsWC2ci} z+Dk6_X3Lk_4!dws`{+x)+V+`__B}3Wo8-!IMr0>)uBN--ad$Ag-1+*N&;d91y-;>x zb7Zz!luW`aLIo$LWR5L$&#dwk24f(>eT5pbNGx|}hOfx`NRIAA)juR#ze&s{Q@Y>G z%J1|4L4Nf8U%E^GQymq|0o7dXYCcP)crbC&H*u0zW5_v&&F`P*1u8rHC8KOClGDM>^L`8oR1B|o2C3?V!q?TJQdPm^$6YxKpF3T6_(uX(uR1W6M2+ zx-LX`>8?*L>!zZ*MK8-G2ibP0j=r1->3nfs;*Fgls#^C08yz;LYgG@$?S4PbCAZG1K_)Eb-5|F7=LdFq|F$$j0DF@Hib>tX5GpfU(;j{s!TK%yGGa1pX*A8SWutjnIiHBW zMx)B3LAc$1udBS%ejlp5%YM0%hF>=Y#;AR(DrWD`WC|PW@5yeXYkOkXDXx74QFwpC zpy{hEK$V+Rzxz2X(W$C$mEQ@;e%a$EPbck$ljnXq-Njg_?-mkLVL>jhK*uX%%W+UN z{^8(4drr5VlVpNbFR|tR?y)IrA32;?_~RVw&9=j1*Gaq673eR@ZK$bYt}dRY`$3q<+%oZ>Km$>@wFzOtF zf;0??aXC`o)QI9*x;Ui#?>roI{z2g$3!TKsYyew}MgtsDiYa zsIIH5318UrURN2{3o6>wxRZajKPRadfQg3>V6<7^B=wi|zBMHAu+9h!G3Scd@z3gh zh|bEn6zsaKa-PalPrxq{*>p|VE^^!I!1(S?G1mW7+v^$5(ECc<9|#~By=Yuim4-uA zvu;ffRbS^J9tsJ*?^2J_te=GTsCnsr!4Y0fR{QStTK0WxrRLL31~s#w(<%?+GGRUD z@;yqc;N$jtov|>aG4<4vpm|H8&Gm*I*6*1FbEwkF;B!cSmApgk4{8UEl@73>qdK1D z0~OWbQmCj9%A;0pzVUU>Or2jeGxfDfwu7ftWtzC{WagB=a}r9bt7BC{4cB!JX}sXC zUcc0^Xs6d-6%UjCN)Z(vGAK_>eRHMtO^C~9-dY9D?i&DQQ=qWwn`F84GGM8zum_J0iMHT1obL65S54yYj77YggY8=&|m@ULU zaJ@gg$iO={Z_4*C?;2Uv8OnZ!foofBZj@ zxOjzXJ(6182A?#fHH0Z<^5q-}id6BudQJ!0Ip$_n93JI!HGD`RP$SX0C*h{4J-mqYlV~e(JmALfmc6W=%Des?WER zk@aPQhkDb0M;-d57&dJvU4m<~MBs6M1gvIdjT$6}m_+2Myl3J8V^G|SP-`yvt$Q#M z)4LNpxOMu+5F74?)f!n}Z5?~AXj#WClIL!9>H0qyY8GkCB;^UdJaF9gS~j@FATNEV zoqzImxl4Td*t~RqJ}RvLWYS$yjby?1_!F$IlmvH@hVnwo@=+74?-Xc^ z)IW6mhlz_aV%Psv@)5k>(J2`4F82Z^wxKGP5UQScPoy@^uAoLY zbiA!En!o>0_7GYz&MvA;t}=%Q;i-e<%y)7O1doJ>fsFDY@L|#!bQ?Jq(rGM1`%`ub zSMOy$9R8c%VCNVK?|unTy!~&&&10RFlF#6ibGy#1JXE6C=iGwd+qhr-CUn8pyucMd ztTDtE?5=o#@w!d^niy-aQj@}V{j?!TV^;OCz&D1=XGZ10HlV)IE7(D zMhhUsKf50YQAiSpiIqOF4cK-w6l;1bDC72!-F8in>Dh-(Q-9FJy?VEe$*YC1 zyNP6Qmzqomr*X?XPr3L943~+7XKLP!y~mFk^_thH6cJ!0z&eM=9-2rwL4udrLP>xp z_*K`)D2=dOv|dH3+&9N-b&#$@N)h9)OgA`;CHN z64^v{EQByo9?IxTftQRZkyVrvE& zrIoOB!-5MoW^Dt)fA)IpDnRf@7$LvZ8G9Gm9nZ{gS^|qQrRmB7t85&$?Bpho{|VjV z7PxRR!drCD_*;mdZszZ7z+Slx3Pdm~aL=rO0>8~ycd$>IqkGwCv%sw&NhB~=sH=9r z)N8u<#%%ic`2by11Q+zWL+_=AKsE5C#;cU#ZsGOf3L)BRAD=&KK{Q! zZU!oNu;hC;&06=G4I@7-w?7v@dxhNC7x?RzLw|0AN+;yR60#WK&)s@j#Ab4I;VwL4 z7i#Du`uc8YAaDQL14McIS33uZw|--4R)ylz-bFIcReBb&^Ng_Sw{Se;v*-7VJjeBX zJ9*grmIP_`Z!Cfz?HM_xzwUma!@aW!Oewp>Fts71-f6!N`MoF-@a@X^*h|8Ac(WD` zRngwhJ^6W#BYlRs8Q& zj$*~ozLXI+(Jxyxc0a#!9nMW{doulEbI98(bYwCT)D8~$=T_8=wf6`n#cKPGfFhJ; z+bCN(ptp+iR&is@%;e*)MM>TYA~?l{n4D$tF0258vO>{T zw{D+|eOr1+@TUr7m{r+A0I8mPjs7DOrpqa z_p6lRdGX};e`aVoa-gB*Gm)X?Q=y@SBlH+rN)_cSi&k^K0uLH(#<<87;%2G(ocqkQ z!Iml(qVj?(VWP^M*jaMr0eMZryYNmdiT07DZW#lW@tZrGufx7Y<4ME0$58(@U?|m3 z8_G%IPZOr>ZXksLKai99&fYC!3F*)%4{9mxHn8{11G~0_5WhOu#mYz6^qnQK#YK!0 z9`)N~LU{iLZo)V=@d^xN{`&#f{bYtu>0yfCJFlQfvhG3vMaM9LpKI&m+m)B-+R9}* zE7O=hq0o;{W9`b=;-83cC;u}@pZ-28MD|wDl|kVSu8tpifjgo>)#;*e!YVaN7^ z+m7VvnEsCKliLmn6085ip}j0fLxRGmam-C_QVhEtQ~GhS%swk%1^Szj9oy?JBmPpy z_H!0a(#kb_1$`^X5MVZ@q!A>c&-bVl?id41Prb9(Becj zH?-|+E^kqu0xWm^nI_lrUxSY#rg{qYk|IrazrjSV)~Z*c|e0YUH1 zV}r?Z^yc6N_=aa+$)w4hGnni4yu%jfN2JFzcgG)@WT!pGeZOM)Jx%EddY+r(V~xUl z&%}!Cu6L2K&=|aKVq!a+-sJ#(A?FKzZq?oc9=*HhtWaQ7JxbTozEzn9)%{;uh%|0E zWjg(Uq}lH4zPcB$r#cg@cS+*X< zg3wGxksv?3Y5X4Y70_#9qIu1YC?^~#F zRv4)5)!R*&P^;`h4|KylfDiu|0F4xGmf(1*zDB@_=bHS={`MI6>`$%t@#`XleZ@pX z^0=M9u%w^fLQ)A0xLK;JIKQsM1M5jBXg$bX@9SCj7@4Ikhdw4KyVaj}LjSul4 z;>hD7(KCF>A4etKYmyd$a<1EcCpFxp^r(i!19OF0HcrKVTXG<{Ekx6(m4e+6KBbG5 zifXKc@e`F3IMY0Sj09U;-%qSZ$4O)4@h1`W^VR^nM)=uL?lGU|t3rs8=^4rsQ=aVM zdt|&Wpa>GHDuVPZ4jeqMA>uT{hFE%q5@-uYP46tll$~(UHj*e=LPOx1 z)GiaLL*-d4o87IyG-#i@7D$Yi*ZoFW>QzeW#4AX53#^z_aOr?V{KB&IMc6EY$*`q( z@5ffrx!H;qQ4#Uyvqe>`@6*b<#%JAMS%qkKCRyEBa++r%;`?EI4d>?xk^JuNnj9{* zeZ$Zn`32PP&t4&WD8tP~{z*rC{~qyui50tJ{7?BCo0BGPGK}Y8p>LfnJhe#ZXcvB~ z;kt*oeSp`U#^AVb2y&29?KoG*Ip8o(raW7u!>#6Wy>+ih^j0OXIwW;!Vx}D;aakgM z&e*`UG&9cAIKXOa)GULkjXiBQ(=3pzhrXvtf0r1zxphBhH>fsBRDG%Wcn*?lqgRig z(V!v34-m~NPo0BIdt3?k)k$?yyCrgW?@rw%j+*#Tx8;2}D*9}|0oEY_JG$h${!LQ# z+#}F|A-IO1B+{N9ArX{*kN`(`v8){Fe zZXMU1`kq?$i>{QSoQoSeWn;Gm@kwAdZ~Lt4rYactL&vi-l}Cx~?!@iyw=A@jZ?f zE!jwz5<;@tuf^COtQ0~V)GE#pOO3))wH+wv*3AxE7GmSxqU0*~>mOPlzxfbT!wz0d z)BL1s74B}o>P$_Mgs2nFj|pLV+}+^QH;I#q@A&>1f2Dl2yVR%Ou{4}@;rtT+CB4R- z>eJs;x@{3Wen@u<1QnUegW>{h=%Bi)V9}}q&>|{_KiyEEFf`nB7{rU3qvgK!~ zd~vRPuITzUoKT;44U}}9zF1-z&B_ws_ENE@^fjT2GSmxJ1h|8H;lO;<^o<;_7xwh6 z^)>82y@lAiG{C8jY6jSiFQ&YlM}JH%PJmQ(Y#-Y?x?_8>;=gxrHK*SmmY%n&WBZsaW9T156;+a$htQ9XWBv0eN&h@drNimRhq?Y z?smINvU3>JZTmTX4FmL})U`(lFop82=jUTf-^=xXuFADw6Bv8RBs^G%qn?=YupV3Y z7a__8Ww5z|fZLM1SlEvjMM57O6>_iMYJ~CD(~OYmMS}Svb!1+)AJ?Lm=_*Wt(9_6g+yx=VHv8+0D^KO_w?FXHrotwR z&97-lg6>(6p5d$ercb*4tWb5S^=GG+?d3`kD3aPF zvYj0c)Z=dR#bM(iWHSB{+{_&q7V)6CdnKBsi~l>S+WkZysIt_pU?APU7;SfofOzZs zKIh_yA$%*$S>xW(S~yaDIVcNIqP>coQeC{(`yKt;zpT^`?)~~y5U&bwNWA18>>E_z>m^D0DsIwW55%EVMywEo! zxAi~kXRpmHcR&P7=GGiL-Q~&J=f3vj>p|je);vVY)Dh2J1`t~pmdcf*k#N4X4@WSJ zJ47%L0%qLtJb3wf0hR*rEFv!VL~I%%=3hx?3$`a^mXX_oQ?g$ea3|AiZFe`;ACEPo9%n zo{_8ScAHM#WpggEFLhQ)WBNEw-i)qnO0JU+bVG07(M^RLcpTPPyRIpAJmuF* zW+!jpJkYk6`(eY0skEdphwaC8oiQ9DJ*zZGU&bb3VJY>EBKAfnu;FqM=3ll=FST1@ zi{Ip-F@=c{L%uPb_Up2O}F(WvhXjAlL;33(w~O(Zbm$ zr$-NON;gzYLI0@sxkmd5+Mmen$-ND|Z_)ntkyrgbYJW%6e%XkV(?x}VU6{F9GcPVC zQLRb9*&@4^@^?owx@&sWl=}(Kn*X=vefxIabAo3yNa6T~Ty05zEAd=F<)W1p2s+Y) zp)&j7%J7zGgwZ{^&Zzv18x|t}GX%7=0&ScYpF)9 zZ$L1NdQC?0<)-1*HZU$L^B~TUFhf-&!a)r>n}n`W9teQVzgbx*B+-byb<_4Mmrp9t z{@KT0Vn97pW>0W-iTfKuMYnQ2NG^Bg?@jokc9#O4%rCNy`1PRx$tT;!?t8iyS&VV) zrl;=AeFt^2+x_IEL7&1Qhkq-^SZX2)VFGgRJT~a%@M7UVdE_Q5WXa>vVsZG{2xN`$ zWQdAK$9_H5SbSKUn&aK@yEQAB`yh|$Sl|zh#~V{8lt%Oy&bLxT;^S7=53Atb@DoZi zr~z6P!{CI{XoeA`Fw8MUId)B7PP)!1)|}AQIE+O*FOMclI7ed3t|1?d`}wOAcgyC5 zC99j#W&A%)K`)s%PlWSkNdCMX7tPq0n6X2cF$J12+)9~)NUcTnXImA2u*RGo(xYjI z8A>}1$&Dd@pyxeA=^4NuuupbSVEzkrU1fy>TVuPg?IpTq`sT5?>>Bbm)~;UI1_#<3 zz`_<@s7tJc1HfU_0%IZ$G~V<_i*{Q5o9ntJivLu@f8cWLTBS~i>TgUQ7k)@8xbT2^ zA^slsQ^Q@aqoW~%Sj;o>*A;o6zR9!uTJD4R$DG`&J0_fy+PMA6tZgZG z>JglR#W6W%G@q=Ze=eY+>zVACW9|Jl-qpV=_{8c9km>!7y7@qU#{Bks9K6AW&ZmFc z2VAWPlAb>d^BfP>FjAY;GV-}+*TOAa%Rbl^KRa+C4SQ9J6T=wEslETe7Xx|XUF6h} zSA8D+kt zg5fk^h{pEktd7z14|q0HL6&FbKY)MkcUhFfe?F(S8pmsd7T-Y*q++f}@G@R{%y;>+ zw9r#$j)2^-GxCY1@2r719Rxq;5;o=FFYTDI@QO){-I8DP(T4i2Zz&j{yY!dg`VoMxh;7C7eAYjy? zA%^|&IEZTRk3@j{lV8T&EOaqPFJcr&2wD~}Got8M8iWV5S=e>=R;@D-oPT)TVrnAN zS^hC!Zdb>OdLLwZ6}X#0iG{q$lv!-5^^M6j4Qx2Et;|(^1@QTX9uhl=mU)4mQl-{E zuJVa3KFyML6vY+?mb+h9GHz`fOaJcl7{zJsrB%d z0b*vpW%Vyr*CPJS{3(ttUZk?gud^VfPut*KL~>UHS)4D947j&xn@LT`kMZx+Lx~U zvxHF%9QHNwwT9I6_3WlnI4_K z?CP%iKlJS@fWqqf!z+e2az837G)wj@ew#-jJbMtAT}&3crs6z3q{~P?jdRf;8`Zq#phq1K@ur3x9tE|MZW6|A*kv@N}%<9XV9YbYOJZ!1xOo`-6*+z_87cZNcan3Xx3dG0g$;duifa; z+P^SQ_OiNR06w;Td3Y0n7sh_~jY-^p{v!!v=pwZBDs>Oyl&XEwjY|96&m%!CJ?@;# z=t2}}K4F&^p8}kjbkwx{dik%22_3@FE*5t?z3rIsJCJ~Rw;W=&6=nnv*WOqGBkJ7P zwr68HrN{1We*}Lfx4Si_#&lAK3!`J5j~T*3;~>0O))g`LTli%Udy4q(T|6uLNlSpQ z*PWKZx6SFbyvo$!5~vUVwf+#YR5 z_RIV0jy!%BX!B|_u&4AirVsj`mPrM5e*}#MTV}@YKBSTraLr7dH6CtEeZ8`!F7Z0y zEM_bs(<$jg-sx^g%~W^VM#v%Sl+K<^9n0acDVw91x(YpVyFu$M@;W3Vl)8&<(B0l3 zxs%J!d<1wJpG3Xg_mf^wx2&jAom#w0ryy=9e83(;W)z$XWx@F!c08L)MtY|HGwqf3 znymF?>H9TjnDYtD)7L9G`fAn$nj56L*8>RriE-f6&FZ|M`Z(^t|5_ARKl$f|$bS7YmGrp5huL<9WFl7z?`(E(>Ynh_}2jCWm~9AZfwY2Du9X%V7o$K zIh$0!?BJQ58;P52^~E|96z_uK8!jM-=kl&Xya)(zh^$oDfJA?C>ZZM`Y@y$xb5+mQ zA>$;UbMGJR>AE8E8iGIfCZ)^ZKHssN@?}X}K|g}z^mSs+EgGD-h9vO)^G#<)=f4H1 zn?(s8|5I|E!TTm3`G0Ac{J-35z#SrXuR(--Hg?ZV*=YP#NPnA}xKuQYk&mfiN>3iP zPj2MsjA0u*zuA<0y)N;$!dYuN-@H@9!oOUVM44%L|MiF{1^~tBuli*N=$zI?LF#*& z&uB&BtW)2UY}Anavuai3qFJejJ{=<0P`eh%Q}>e|<&nF84!J`^k8fpYGiLi2*K`*X4NjFIT`db8|)m#N`+y^}U+ie=leWd2d`*FhMw6 z1`Q`)%+b}GG=uwANvy_w1CDHN3DOw6 z->ZR^FG=kv6 z4YU)&*evr497jwDK<5b@)*tSsb)~W>kig_QqjGL1CpIi;6RZaRw(*>>+w8}kXrc|h z?iglPSWwKe9Zj@sTY->Ga<_C0J04VAI)n!W>6oNkj^R~2;^FA0BFv+upS zTat(V?+?o-7nLsWTN0V_JpLC0X^8(Sm5dAPfk1@XaW#S3i@kt=Jx&*>Ve+-1Fd>KW zAh&xL$`wi~9t^0?y{g`;F@mT9uGL3$Rg0|JsP#Oc`|?6c5^vPxpFx1<$lg6G6Ejtp z2wA1RR$1?DVe6|2X(@kQi=NfL1;>Pa0~83I&ZNzuQ=Ke@uG+tkm?Q_CGZ>L&vlwKV z?N+iT0v9@MgUg*3!I1e?RC$(uwVw#v2=Ko}x_@OGJIH!!ShRf$daKy7KY@;Gn-x6N zV*8?8E)^YM=iJzOR5v&k0it~`d?75d5K9>8kU8olU(5VU{Is*6iGcunLQ}Vts_D}h z$rkDpBSbeP{#u8tHKH|orA5sip2#8tLLB=iun)8!sP}YS^{?p>@NVHG(4Q{;(Ff@B zK0_mJ7|xk|IPOn;u(M15{sSm9JQ?A+gYZPo4cI5%Z-OpAhrjUtsJK7mkI=$^;gjTh z#$gIQ)O5SWH+wl7+Cl{fs^USC8@|@IezRL-QGv^hP715F_zRw@*njV^@k`ulI4&BC_oESDO^}pc4lJ=y z3qAXdUu4?R*YU4;M1qLtum1jRgKmh{ftjM-YLrT)9?W1_3sikLCwmgBsaQ6@rG8*AfJ&6Ic+YMt-`+lT3?&r7mqal47 zaR{Z{JZA)GXZhkw56_^l!zY_tl#^Q?^j#WrLI?MlZMWNOY2WCPkeSfz);1*97RC1^ z`rN^JCCXG{O}0d$r?i_Hwl|%y(%s!tdX^5M51fkd(`sj7NGW~t63m-f{&A4GYM1ob z^5S1!IH}+xv#Hk|GnSC0pmn%Ym>zk6OxYaS!4Tq4uI}z%#1e&C=!EKPyCieN#m|CC zc=6ko2X;?EYQGbxhpkrI;q+tU(y^&76~n!;JK3!#&PufHS=aIK-893kybWtkDE%v& zTD3=SZ<$TatNJ^d`3X|~?MXjp&<}pMXSaQ@bYj6!X35$GBm37T?HOfx1m6DxAiHV7 z(}(tUA$`nMi!E#fJNTx_+?;nO!&96cSNd!vXzOB`E(Vkn;~XneL9d|+IS1Ly4avs141A#6J;=PyaT={R zeG+9NLh=1uM5AH{ZT6C4%`(ce$~+Iw1QNtT?^ijRG&^F8e^8i&7woB;YRrRgg*=`kxbaW-_g6OO1MY?m0Q!^k_X~~;VTY5$zdew`qvYFZ zz_~&pt)}!(*{UlfX88uI^BWY)EO*^R9Lk}}R?$zqzs=Uq*Hb z^p^v~9U&-4V03MBrD6RDO8nZnAtf@UM2Sc56M|_YnHqQb`C$iCpAluVh%&xnKk`T8 z>i(vg&|lo7%n3z#S8f=pR6bP$y3$vhM~)F$W`92szjL+>#P8-Wh2X9D6z~kh?Nt?{>Ceq&6-@Y zeWj0h|_iVfo;)hjJR^dBpaxryv_=X~&Dp{GjOKPiCqapyhDxGa zMf~7tYv?Z8srn*u)AodYn<9xhJ9PG7<2Pu23Mw;BXnx%K59a3t!5PlaUy4){IxUxL z)%|-%ev5ecKd&F^9MbWC!4T{G8O;QV2h={c#csX9blSra zK>*F0t;=*Eo320*=Ai@Y{HWRb(Cl!i!*%02j!CI#T;qeJPWcrTYK#GnnDu{1cig9wzuYeVb|n692Twr;16?2sF8H2JM>=kCWnLeVb#i9Q+mnf@$`pVmt{ z9uOo2IzYf$nTL$a-v(B#b)Ns&LVAw@$~-{k`cA2aRLjeXNmP&};`5n{>SNsZv0(LL z8wmzql6$)Nq~A06tg;1ewhX%h%age4+LqtfPv%dtrJC;{4K}NyxyEMmI`M~0-iX39 z)r*hdzi*v6a6}(qQB|FEH5}2J6$jGZK-SjEG@@$*mQj`_voOm`uAGtyXUl_<<%S-)e49V zXg*h^mSK4}{Zok5niblJ3xFWY^_ta8;?Wkgh>wjOu&TN5{wp7&eXFx5{KWaOnW#=H zn4;PFq4*HAGH`wzF`)ik=Et8YAI=YG^P}a9OB6!Ns7HgBCuykjo@g~DOEzji3mz!v z4*~=#JJ^T+bXW8#J#NuyM#db=Lqs@ZjK`MIu#E+B#9?QVqwqZqZ;cKz&xbb3-cwt~ zv2O`lN{#zZA)a(m;n}D9=`IVM8UtIO z#=C3Knv_0biWs-YRsgof=CD;QSQwrVTg@xV)T+cFEygP}u}s=>pTpMLt;~Mj3t2Yp z-M`=61!FejyZJR%S!nau;(z=t53h8{JAm$ci z8R_|&D~8q_LUWAN{bWl%Msqy0Z`}Yw^z?UNj(-}Kng=abD8hsH-;B&V$q$0b&tcf?DjmhU4-v3+F+T>?g7k?Bs<&8-?KYtM#v(ydZx|ot~5cYR(N-{fLgFlB^w?fTh zR&tL`4E1wT$xX~!mWm?N3~nU@%`&Z+R`Vz~579@z^AU*7)4x4IvjgULq<=`YfNwKq zG$fzLaSEpx$+pRRw!w1qR`xF_#wkgxtKNLHNfm-O!&ut z&j-vi;Y$WV7ulcwk)!{)g0V&XqXQ5O-MgC%IRp5M4U;!Qp*KLGGJrRxZcr!e%8Ovl zqNqdlseNanDrJtC+n`LX;q}X>H>T$lnyEEAMgH6*)97oOA}?r2_3x9WhyZ}R z>zD1TDbng~H^ht@%N$7#vSnj#9catGUz5XqmYFfoUOC8?{gB`=duxay)<-B3E0Nu4 z5L&Kf*4RHtTt1JeIQL7_Vo|3ve#`C$exz;R?K# zpMeK%SA4qb5wr%4a^E?-@Pr(8BmQt@jz5GrPIXJ(%=*XV`J32UnPU&~kAXe>JY2vc z7YziUUUE*^Cp)+P-|n)! z&JzK}MTJbM#)?=S^ZybOiewAGwfVCFV|s;n_qs`j`jHnuFQ4$ zKzRA;E~*b7^x((~@VX&*a1Li^%6=q~JEi{ElT;NT`)#qcseLF%3@`XRDY z5$8NOSoH%<9<8xnHrMtGUjxMHP=h}=G2{F=N}vn7W1ZhsRyojL$3r()2BcJ|j`QN9 zFS|0@?AL?PL&Oqh$ClqJY~%Rq>1P^(Ogi|mgD_^x#senTVv7UJ)g_KVLJ1!|b9NYa zH@4(+q7U{$9aJODiNVOKFxT%BG0|cS0#K`8of^$zr@C%jPl?2g+m8kE*pegR8J<5( zNIVco#*KaZ0Dd|i7;i62IJf|16HiIo_Byk06=@HzL zRv24)wPE%27Ou`^!8*OYF@5rf;T1Vt^jq3g*xQ&s>qFg7*mu0LTA@$-LU9%9cyKdy z0$(dj_vtm#OY{$kE&ULXa9$xtDWB(3?SFFBmiub|Go`0*wdJ!6yKT2m4AbPyzO#99 z%gxApCBvLPg;SH+$Yfx(Sso82h4!zTvbE15mbFsLD`eUbYcvAmA7Icw+X z?WDzfVKlPDt0fKT(VQ+Nj-a{lMDZ=B{SNw1HzQ6A9!VQS#og@*(q|%Fv&DIlSXakd zRTE1M)a3haUk=ZFOa+X6UF?UwI18?AoV<>=tH%V12gNW8+nAW^2mrDW|1=KiqVGqE z^S)av-z+p2i)HLY2-TL#$?gE0heX>ujX9oRVC8@;9vSW@a5o7e#llqQp(&+ z!Yaj0X=Uc+MnXk4B`5YWeDtWXcKuZ&q#qS&{tfVl1Oy;iKQNQhm9aR=G&J*qOJSOH zOZhV}Z#JJ(WtqF(1!OV#n_oD|A<4DunMTJFntVit5CX)5f}r;mcvo@RYZZKkg)v9x zF#$_>Vy6RtJ;#p2zwt%1)sooU*S_Kp&d>Gpck`Dm{nKZVK0@iU!t}tW&-tRIUw1O; zY-kGH!C^YBu)Melyt?J*@@Io@=?}v>Llh@x$RBQ`%*~-?bZ*}i*qtB)JjsEum2x-x z6?JKVY}i+XgT45?tuKd!ysun^s&xQugdNr|Kd*ZgOHS`ALtWVmwyc%sTYaqdQ2+7r zE=_p-N9KR>SCd_z{rYkn-N~*m5fh!Q_2o;W3Lfkrl^C0D%kR{Plw0_|;KDIRK2Io? zP>}U!_Q#uyahyG+ACI=W6)MBYZv-sD<1FOGokpzAk6YKv{JIWfbjx0}&a#NGKm5-? zx<&|J?{^16&8n`T=e$s0Hgy$T1Mok{=D8(+~ke(@zPCjd5)nHGlv`UU93he8lHL4MIj2~FP5a! z{V%IEj5Bl5zBeYHXiRQsOupHe{D+iX*U?&#ddTwH{Hxs-TV`jtQnz_9eYoOz?#BWX zdSP1-t~KeYw+6j$48;)$n`!7R&-g&d<~2-2Z}*K}e@2N-vz<}OoljcLs-^QuL;U$9 zORcAc=={U z1#rzIf)I1Q2Vd*QIf+|z6g;Y-SLb^^wDUv%=>RG7b-w4Q#`MI)o6>VQKlH`YhVo;roPCbsEY|Ya5)hZ zW|cOkPAlhl(|y?h6kN_)5_nNI=CraIjspgtcXlIe(Mxykh;i{`Lvy_ zt4sU|%pAfAz?JF~Dt*ucyCYu+5_1pDDd$>0l|A7Vos9aUN}imaxNp=k!yNKMgu7b+ z-*C574z52;_5V~4S@`YH*fVvBCxO3mBzMXxz(WIv(qie)A=&G2 zTU3A9NZ=nY`1^DjFp?zetIjPJT{WvIJ@J|Drql$^FSfoVq&E}(8qI-CIi16JnO1c* zhvu*a8z$uNDsI?tx*yS)qESlbHyoF`ojl0Di?)$9JTBG7vunxw@MWIO{x~P^<0;BD zEB8U`<1~FcGWX3LtPcm}eHfqjJSOkCkY~<^V|jE(9?hS3dFmdtHreW7?u(M05ukC6 zley^*nvfqcodwOrHtk8S9_=E9dWKd}Ph0lE_sMTKMD-*_q>+eo;FLCzX zu#Of)u$G#{jP}D0#L0mZ)7M$0nKE~x*;o9l9VI5j8lc=_V_QNbhbo>JyLdJ50%Z%K zMC`ODZ(N-a@mBF|mIyQWrVZ#$L*w(#urQrTi(qEYK5wN-1SGP^pl=fl7tO zs<^+E&2FGlp|L7nszPHgGhU>jaHE8G26dk124mfVBzYMOud`Ae%bc&{W45EoT1alI z>>x#i)h^WBZZA01ziW0;3`8~MV+!1j44oD>U-m_W1WwzFz$g^jT3F#aDBPHy)h~1A zNy(y;lal9_@Tak)^rYmKC3dpnB2<&HB@3CsET4)n%US5 z{?<3=ll614rPPpeOHWQ04QWbu6ma(A0eul!iDrXe0AGQ3 zR9ex)BaTY%Hm1j1brfg%3!hR=Y++$2D0NJe`Q;K7Hg6qb@c4m<8X-&tK~$G#8`0o& zP^V2{^|U4;R^bM{_dco&NuWYXBkezxsfs-W5|$d7>;CYpa`4nQYT$m|%ZGoD=56Bb z_Gl4{&JiLB#yY!bK1dwf-#SeKj~`>dxHTxEXWou&pP+ENB%>DFeu2d){j9yZ!KBSD zfX(iq6damZ)3yH$VyFBSF-uV=wA~}vI|4BSZ{z14-0J&A!t?Z~Jq*ysuUJ#ipaU8H zZc$EJ5ofASCQJPKie1mJG0+&@Sa0jzM<|G0i@+}D?rlReet z5~?b+KVQ4xQ$&nm4e(b-*fBZn)WStOGb4J^2voBXy?Vdc(wo(wIB8TYNKSpJ5!Fow z$8uj0yEOQ};%8rf0=acYaQ{BJrmE!{cl`YVIkf1^^|B@dSRq3NaHA>C9IAyZu1pm{ z+H&f8uD8(0gojToGom25!ppg&ocH&~lV9tTj=bpp__*C4-=q8E@gU#`UgHH%DV_K( z{{Ah%DPY#>{`jI21)~3yjZa<2wtd?6>exQAb&rniWvztWj>VRIS-n`&vtS%()#B>q zBp;48GbQ?Bw$-f_xq_HMMTev~Xq*FkQ-LVuKQlo(A zenQ*deIwjkmD*UiD*4-k*ONNhKRcYu*4JkCPX!ZGja>?ZHZ&Dyv=c;sylEvalF|T7 z;!;RrU8hDs;+&mHeirO`7d;L5u8)GE%Fttmb$=L({WCeXG$d_Y)Yw)b&TiTfx)__q#( zt|w>Nc7D=1Z0F_fHvQh*_{uG^L`Ih{ReDaQR^Aof-5I1@YM~)8A zGj!|&U9dLfYuZCY-p!#Q4^6x2nzmr2+tV!BvCda$DM+7Q=q+_-(rSp+6Wn#93|4Er zb&5QBhPsCLU(H&wWhacPM_XRMY|qr0MHtFXOYA6Y3mQ^4tXEMkk2r#7O-QdltmsaC zM`IfWza82(+)Qej&zp)ZbBO;r$p3sQv14dkz5c|QA3Ap#-j7#o_O{@Hy)g#fEMp)l zuR85uAD@}r;6AUW6LRa}gMUCyn=kxojNM*~KMucaVxbKYpH>nz`jz^w>nd+hrJ^;c zX1(o&9v;J|kjx~UY54EI%M*-pNAzL~lH~Y@_YVs+=jde_1pslj`R@is2zQ(gpsL#) ze7YwX)o>yDhbHNNpenb)=lt0wavn^g@h3NJ(Qf+{QBpMXlf4Hi_CLxmTHY~o;W;4Z z_Df?0{gvxI+K=)>Qf)}iOeREs+y1fTPoNY#Z2lw;P5yqCVyllHiS>K9&r@s$*Kqp# zkk)R@+aQdCRa<~@8ZhFY++kn3Z{y2;d~w(EAxG$beNT}PLKZjO zvWtkHmeU(~pHlN+?(6n^ie|`zgdbU0O^o|w|I-Brhkaw;avV^e!zN!B!X8)Bkg91& zwUnSgrS62qP#A^wJhL_$KI!L(-&B#4f8wFe#X5K;G`r|S6a9)G_VS)tAXwNzS^8uQ z%XZdm@44PW(;TF}rMR{9V79gtNPX@_6wLC{07Q3_~*7&`4F%kX$<;Dq0wqaagk@+vxcj*-HR041) z=-NVc-@?@_yf8>#ZxIq%5hW3BCrS{P)J~;|1r-Q`L9CGlUb?N?f8r+~8xVWkv;CMc&lNVb=BcRP1}WTT3<=g&GO#s>aGA0Fe`&+iBGzWy%n`6qeL z-{ZM^cSI}RRpoABbFw?iHEE%bNUa~ScNP(v{1ExSu-3Pi6to_%rmC5F*9h-W7<0u8 zjtT(H1ml$ncK+JkOt5M;wI!6Y`Rv!{$BY+N*!416&7P7mi- z1@o#@0BM2&1<#o=hJ(U~31KS{R&hxJ>kH;b`&V%Nk{HY$pZ+935F6J&b_ zdFH=#V%KPNpi}pR?6JV$wW3+#F6vkH&;Ye#wKNv9Y1?jwJI>iwtiJ!Jc$S##CO?tm zKPSQRR@awSeBO@7stOtP(wC0PMVHd}g%dWmEJl7YgT;kiF{racZ5 zC^|*~wk-N$Kk7wPn5JLeX+3?RYa(;IECvgqqiSi^NKQagzeRS9E&CsM7$k)HW z)jyj08>pWxo3H;RUq7)osb3K!qxwDkf9;wG7aLf=$4>~qxjhN~-!ia(eMoS@+Nc|} zfQfHV4?_H?owBGGFYeNdF*~VFBrsRFfYeOYZ<)CZOn6GU7iHv&Y`{> z;F;e>HTz$y|MIYYKsMz~sSK*4RzQfln6_WUv7Q~Q>C>icMICyfjUbwh^={`Kw9RHR z7at_+E@Sj3N7Srot;QYlh=E!KgMH+5DKr|SUddkc4samiYwo{@3OBuQ5B zdE8I&aq;!0Q;)be#_tnZeq^IMZsdiz*mI?%OPR84h#taO(3A?WPnBVxBId2xr=pm* zhnsy$GLg4Wh5VQpvWMrUxf+?33#@w^oR5&&v1Qlm0Y2XWF4&-8(4vJoVGB>nSV5dT zaVj4TdvFVRjOwgXU3M;BNKZmeQc3Mu`;WCZhA&O2k^jHi8PJovAU)52tp3}0ZDK|L z|Bb3#Cu*ru^l9~fhL^_lXpq!UA*~(q;~V-{dDG5LTOYkuhxM^+ zJjS5CJX>d7j?7(;gZjqwwUQwj0dqpxactwHjSSw=CZ^Ut)fj7hO0Bgt)NX7IM6N8? z#zW1m49&EeLzrZZ$xV&PwXXS9KSA0(tA&lkC0{m2)Z`5!g{LSOEm3G!`uT@>=?Fq1 zuE)GYP|UThZ%9zBw%b+lHSuPo$K6fvGt=5dm1Q1AtF2u-f?3FVtN#kG`7D3J531iy z(8s-VAKgfOD9-z^{V#m@7k{F9oIbpk_u;v`=O>i7nm>8W*Rxa*1ap-@yR63}V(?bX z3$$xP*9K#7#^0jz-|$c5)YR-MH?ugBujl+|8y$yJ$CfvgZS5T*uiu@8m+c?)v)Ozh zt2r(V3Z+$m#rnVQz$}Pv+an=3nHvT&SKicqZ0Ya8W5{D^C!n3e){}YIhd3JVu*EJ} z2vLk{K2Q5`A`}HdhFKoOGu)~a)NplKI%v*R@V6ziuYD=AzkAqsg`JKP`6ngV_|3^CrpCL^VKQ(H*)Kv@i5nkvukWy3 zt z1l9mQMGXoy>i&=PjI*dE^DC3wdmSDIJqpV=48Ovm<}|}zWX^Q_gnujVKOkWnGVXk9 zipi`xm{~^jTHez7mMkND4Dz3Q5W#3ryS7HFUBbpKI~;t)wK>`19|n!E(bs<2_1X6J z$CVKF>oqlR1mkM{$cp~#pn~D6p%}MRWV)e=SBGTMsPbUbYr%-WcE`J_i8WnZ=Uqh`!7v;Zp8cXu9{W5?SQB6 zdtsm<4%)Taif>3(Y3a_4WQ`fxSh!Z2?^HXNlk~?r=ZpC+Z!SZ=-nz0h*7=TQhk*D9 z_3jwkR>n>soR_+jwj5sm;Cd!fXo099B zlCL0t*S>$%6}U;1G$bx(>-xpURC&XO4DlCBn`-x6NZ=3K(_n6tau^LU@_a+@+W`DZ zV{$$1y9v;|#3xA68kJ=d&f6kh6NvrBWq2okDW_mEi<^>95<<;3tbYB%ei2);9b=(v z1I@5qRLHFKU$?2!`wsJj!GY6kaPP4XhhQ)qg@3sT>_n7iF*@wN@C_lfRWvEDSLCh) zb&9f)P!5L@aEps(o)N`$hwFZ0w$WbLmKsMV}g;(tWSxxnr7dDFpua0;a1(X2U6W|wKgGat;XHpTl(6kNs`#_`Pa_r9vbdHBi&s$ zl|Of=5?Z904v+Glwl1*qpT{ZsIn`QxF)%@kH6p5Nx3_O~r<@QC0Y9TwDli0$_w82J zk+_EncZE&XXnyRhF@P`HmsBKM{2wELLiw6>w-t1_vA&VLen8GiS@^H`T11BsO{x2} z%!;&JqD>O@_i^vg$BEZz_o;iii(d1h3BM5axybD{1GWd>o3Jya7#xl|KygEj6NE<%r!^km%| zTP%fWIR1kPxwZtNY@KCfJcDQ2SxP%1;|saJ#2U&c;t|UK)0357LydQ~1!D~d)q;fy8o8}Ym7ppPG@JkZiSA2cPl!L!3b97t&k#zga zVb;b*%@U*A3&J*P+zUrq(mf(++pY#-5&{V8FRAX?Dg1d?RR9%@7}Xm6sC!GmNXu$U z8|luPmnB_Tp_}6yKDCi_Bi*+k*RbcRe~xec!edA`>Rl&tCIi%~^?#aAzhfWLjedU_ zrURYQCkVbH1>dQ@rB-f_$fMr}FB(9qCGKvNigBBck8GgrZ<<2~tM^ggje}r6S~i#gNX3z({Q)&(u9( zqmkNdcTcM*+6b-2=e}LJr!{&)!#B03?IQQ~p*EQR6uUEYU%~vQzq7?E-+}p1<-!Rh ziqH)I;tyn~a2tH;$umh6rG@x6{@`nUdK?q}T9U%fCLf3X$JnxHBAC%emT^|+G0rM? zy07BYPf@!O;Hx5R8m@M;eZx~Gkz@q8CQLH=7sEW0p>>z41`6y#e@p4pryixS(cikS z3>fg8$oAO*?>ltxV(HgM4&O%OOYpg#);$olwyrE{utK!n#GBV(H<4S7Noet4{MKL+w;4~}ziw+!M_bRV^z=PurKhqp zSTMx!yLIIdYh`2RXyP^KTswn4x*Dz28I_X1P-(UfPmQjI&y~Tt%G_r;BjirF$#x9# z{|?e8p-P<^Lx0?WcMo5f(y|TJ4`EKHkYmi>#HMHps1jcyN_@2f|t2ty}x3#yU z?NM4{zcLj8bHUI|hg<*F2mS5|{&=~=kN<->RvP~Lc6&dm{P#Lo0(QCoVw*T}V#aHb z3^BxCP`^_9eON}1($`f!P9kn)dA@HFdapSpNZ(Z1!&p3AM1C^lE~~BJ?ec1b$9Vr! zZLjNPTkt?f_%FbhR>h*?dVk)p2v6nrviya65I@rA{i<(Xe#!_@_bPRB~~rNRZOiR`*&Cx{iZv zFPC0jwMS#BXdR}+ws*|hY9@jHRg%9*osa!(edO!+WEZ}EcXasPs2w{_gAywtdd*Tt{jeX5wCcytt<3nR*PmW@& z-EU4-$uYzFEBM*({SW!kXpMVaPjvNEkx#dEE8FE4o&bOMUPHm;m_Ly(F=LqZlwhIb ze#5(a{&Dq{^8^B;_y?*AHxfv|SF~TZ71~gwo^T9|(a%g`7xCh@kP?;&Vs}qe%Y4r1 z9M9O*lObto#KjiX36Ua~Aa$Sh3ej>Nmfrp7yJk3q*CSfCln%G(iTAHHZqdFixIf1&e6gsw z8j&^Ktw+?g7S%7%uYRdFx9AtHB?#OTyy*Jrqix^m!6O=dlsy6%3T)vVVknnByVe%* zdUxoh+qu7J*ia26Z0KIAyYC7kwNm%=YBlIThIHBYMN5k`-n(H3eM{wG9S;x?S5k2$x~mfZrv1Cb(1g3dqh8B6?dx&&|Pgc`g-tB{|bStt+-_e z&w?nc-{zQQtn+_iwx(FCnYB-BiDH1rIn%FSw<>56oTFWx*=8f!X)U`&N5=$dWzH`EJ6` z!Q7|&{SM}*CR54ZW=R<5>IuC`XLwpOlI{Y*;cp+d>NqBM0^R+eV=eSoEldUs^RETP(G&`#s)C?x_@V2gr;InLUO~ANh-W*+Gzi zch@T8&y*3|#)H}?VoS<~Qa@`6Syaf~@mt}xgGa;fzhPeyesefDLnA1Et-U&SlrG%E z6lOWV(wDzu;|o?s#FllGP(ymm(;;TiMg^(=;=d^O(LeEqd&)^MuWSk|Cgd!>?(3dHVfKK#PkGY^j~>7-Y@RmbkTy86QI z3u~WiYr`QfUWNcz*gAYgKyqfpiW=o&eY{Xdd#7yF@uK2xWH^E>EQs>DDOLKRGvjTerK)J>-0md|bY8o8kJ1nh7!$Tp zettpaxD99dL+ZGi?9imn;W-?`(><4qhG$T1M|^DRJ_A!vhAM-28|xcr+1d3mXkq`o zS?M8{Xd@DJjzhfit8M+=V1~sk4>KMUnFV=$&wCt5#d!(4e;k;7;G34vz?RUcbsYrY zxMBLYOhYbcjC=X(dCtt*hmeP-=F|Nxv4pvpv(N_2hMEA{*#hkZ=`!ZFtzC2Yc$+`Z zlq%ZbHZAjbnwR6F=1LGAc|!hkcPR^~!s!Zzx}O@&L)SgO6dlDniwziS;$Gios{UCP z(0jwS&ee+_blab9*W8VDt`c-q-XiKSP-#-*^T}}Cp9fdl{5+Uc{{#c8_1r;qpS!L! z2hx>Kl?JshNsm;Amb_B&FFXTvgpy#%d$E#)ky@dv&QxHMz z2JFYFvd4qk?XkpVHqO-1keY}|XMF^wD>LxgewYV?mMmPpuR&h4Rfx3(q2~D5@^+Ix z2ChG```W7ucf{`7s5L66eJ-|)kP8LDeTOf4Gpw0) z3tu*DDl=KyP6(I5`vbZ_#L*gl>SOnvP+ecRCU#$cP`J852bynJ2PbpI<&NO}mm07l z2EF}Q=hp;(D>n+M~doEMPQdCGJ4#HSA;_`pC*ju>O4$ zwlND|f_ncC@LA945DUx`vFk5lPQ?~qYBLL?uPiF&C7`y&cmRw(6IK3mbm;kL1K*97!xH^=_#2fqfzA-HE^06bfB(_}> zyZ$|mQTps5=dGfKE%V!{VMy%yKl7D~%ZJ1}`a3QQ`1{Dh;iRGAWL<9Fd<)HYsGSTOuc0L40zilh% z{y+8SANteBpDZH0e!Oj{*9%BLA^Vz?fTvajg)ef0+EzBHL;6=;SbKKOg7e|!tC}wE zsW~AvdWemGU4lDHj*fTsw@q$HU0GT(>$6u5DGi3=Xpn4&&&{ZO_ke;~sVj$6@lEd& zc{g2Q=GRgAA#FcuNVS%h1VdX&GB;CIYdtFW)?*Vh9wu`EX8sg6Jf*l;CN+C5J`D5R z8jL)7S3sjgESEya{>;@Xhpu&)l=<97_6Qj7??0A~Y5kO;QvMwrRBTL*-s8eQ@RR-0bf(rh(lf!&Xx{ms! zl16T#%3Q0mZJmi3h0505ikKOcyZ;@KtK4GSS^x3u{r89c-)y7sy1tWuln=-`-)#GI zV#Xs|)O}Sj*WEOrg1LPaWHtB}ZD*VM&DfF{9}+XJ%NCjEzBHi7yuQCn)0AkhKwbY; zI0ld9T!Gzro}N)5j}Qy$JjJKXD`-0?G2vs{ zBU9%TC1=kjj1V_+VRe|0UQm?W8sZ%LDa)mTHHaSr8I^B>tZs9GIAx3KR9!7wU)Dv_w* zbc?Uo>wFXPxn(q5K z3+XnmpA$ex#Ef_IEC1syUU~Uv=B^=O(c2RJgom@V^)P8UJ?1@z9t#-Dy9m>>x zZb9q5+*@08Vg*xtT(N$TFq=`L91p3J^41BKlF^S(L8rFpQ8fVzN%U4At~Vltf3-0+ zJ5YR(i~_NCZY8}g^({tXC8A|=)0B;M@Bgzd`Ak#oYq6!zkSHN95J2PuC8x=qNXswZ?_j6DLC zkyj$`Jc+#cpHgWf32`86J-HsTI7F!}^~vWOlbOaOxDyZKklgy`a{H!3T|TQgAA9m14E6DQmAV} z&6dHa8DTl+#MM>gm-^Z{vlrfzhpX1g=}oCgb~$fT>Z{<1NI1eX_{!laQ&g`AM5!yP zQ^(J)=YG}6tD0(GiY>i^e(_aE`{B&wOWappnB0hjLv#637AU4{vH;&b?-7jdM2!b}Sg90N;3u#|S!b?h9{R$15cc2Ql&2ZgPp z{QBJS!H~9CSZdgXb%|*OZ92i2@K{VmsBw?})w7+7p!V@Lyzxv=MaWrq@h!HGKU+u?Pns*m^+6zFBDBrAfV))e zzOu{w#`ePQ+D)xFa8eEMaWzf$*}>4pP4wMNh9mv{&VY`92MoA;v>T%X6->oS!C&Qu z-N@=OU}wfSSI~B)D50uvDI@9eFaESm{At10`~W=KK`6~hZ3;HndQy-^^52c+O43SP zf134Yu3Mnn$&{B3($U9N;2(xqi^4>o+;*NbT<@pz?cv`n?8qPA328;0F75mJAa-i| zqlF=Dv|zCR@tay;zZj&itgNDO3nMQOuaO1*nre+CMnm148?51=@Bhc!mw-oAWNmkc zG&D=-MiY&)wHP&sjzL9Y1BrJ}CxS%K^FnVL7fXqMurT_Omb#E_81M+;|^P}miTg$0ar%s)!I(4cF9siCM zC;>(jK!I;VkO0`mylAV3BswkRC|16LkYfmZDv|mX{T}dZnc4=c1UoDKZAQN}an!V6 zL%svwYJP7%41@}oMX*?We+!7SB9A69S@Yq?ChgO7xJm1XNPw7R-cJxpKl;U#Vbpkf ztsUx@j>2}W<0jN8lr<4Kf<;#gNw8g;H5}hY|Cc$2W4rb;@P}iF3Dm2FdY?;wXvF%~ z2yrRI7tUAbi)|3?D}(W~%f?ttM`Vy|In4MbjEU#{5)?`GDf%2p&}VRNIv-7V6A!$5zh^}b$KokN8ux(`b{1jO!XGtmH@8Krz;BYV6Wx`Kr#Ao~M!?991LIqp& zjsNl3>bmfa)^N@e__f(MP=lnuXVNcD-WOZ$cpAZEUT8IpzhlEJ`kXX`qW{YY`8qhF z%j2)E1(A7ZmB79;CU;+SG<>+|D0EtP8>T|?d|B^|$5D=cHrQ&!(O@JBIItn+3y@$m zArfom_&t{%<0z-7msae^G7aILI!f6?d5pKaNz_&w^hupjlu>6!VSfCCihJb)!~sj# zf0}U^#5k5*%g?am-JJlN$@ohVU^rM9c?ENO>=>@BJWO17*!L|gW&AKUF#cgisp0}_SPB>kTS9?EiP>g~ zT;oy}I2NDL69s-pDf1kwOk)lK4nw>NAMwU9o$)h}AcSQUvwRyyK`7MOa&BB)OPePD z2>%>!@{b#pdvPELnN337h*>)53n+)vZ&~*XDE_x{UBr z?iaxMly6X;iGwHF4LE1VRw(%g^Yy>LDBOl-$xeD|RGu9r59P9qX?s1e59zxP+Y`pi z9Wbzhyq6E$Alz>}e$%fClPj2N+liE&co$fIojor+1ATCj^uYu6sygfKQP<3BNNnr< z(Ux2BA(iP)5HAV{6s=3=4POHgj|m9eLXzhBQdHb?{ZdrGX$-$djjJsVYd~m6|JJ8K z|AD0cw?(9XPh>e1{q;IdW)CSpr=Dce7WzlW(T&}4p`6x?i!h->0)N9m6d1zx&zPs9 zs1K95!;~)<#Q6iY@GK8tVQsS;wKm1nosWNdSt4a_`T_LVx-@ z!srYb5#u7*nWBIHmixh{Cil<3(a_xu@J7=R!r31>G=Fev*2khRdk_R2MUav47}U>- ztZx&>rzv!`KBRrD_XlwD0UXr19A>#gd!c`0&e5%+9|+RKb84zL>b>m}gxl5zLVsX9 z@mD;ZfML8s*!3`YuY)bcMb~#F{f)aivLa;A#AKM0K#%bhmcYWV zGLWziSp6d+s$0Z?OZvF#sBJNEzzh;r@o3+6EUahdG0p=Let0`r@P(L|BhkJ&!{+J+Vt=q^3_>$y=X(6j0jK3|$`fZqP)*}7; z&}hS~6$U`)Icw?IadBJD&4gLFYBH|T&041-uTw#;2TV&6OW^2^8DI80xcK>Cc>ro2 zV9*?pnI61WPDMoFuggu^xi$SV*e9>7JjE2PlObB?A4;@_9S>~4_;QYWU(8zKSn@`i z6Z*5d98j>B2-alU za5EVC2NIhMHJvLOVJ%!pvKDH>HYfd3`S4j}Yd<5vT^%ilP0uL2;M%vKIQL<$4SmQZr-LEMx<> zIe*LhVpA`T)6TpW#VvxQ@fLLU{l}7iSm$BZ4tqvOhxrU%b|r*2rOgxkItS9m9Hedq z72CXzH?^k;9}?VgE7Ny8UD7*YKW==<4C}4-Z0n}*pG;G84dVewMxc}nlpJM8K~^5~ zg%V=9frT%CHnz%R6}N?R%07oEb2ViwuayWTP!)}CM8QI%=;LimO?)Tu-xY5O|D8&F z(-vit>Y%Aa$D`3JYjf9VnC z_qNI3jx{HxwOvigs2lYh={ z&9C@BFc10LGkCmz1YS6Fe7&3T1L|`n*=1HgN#s`%ZM#AuUh=o=V2Sv-hb}+x=wagP z4-;Q~nE1e9;v;F})%Z3MG&W_Zm%^(QlYl?`%L96gc}~`F@yi5g(52$%8QyDQZ+z-Qv`yS| zx)7t3lp@8lj8HR0XsH&u9R6t-Engy}O6<2x%cXwHxJ&XMt@f<0#?kAQTH)o+%Hf>D zVJ=23L)fwVKo`_ywedSS-XI!MXd$%FNR&Aerzoxxpt!A|yD`ARhuW`>X5o8ip?x`q z7u<7OxOOVev7ipzgu8B4D=b!V`~p|h^jby3rr_R-{)~y()lj`&x1v<`&%UMhl85+> ziBDiKnSh^&IYFR?qHqT2#j%t#LU+q8DU0<4f4z{2WQX8C?sm72SMAFK?`_+6@@fy# ztM;8Je$~FWi2v~Id*NBqzIUC+_RU^*u=d^X@R7Ces*h9K_X){=nD#y9SJl45{Ul}k z_N@}2(!Q5j_#C2ri=}-Zt;irn(>F2HT5RGcR|J>{o21{w8##oHOk*Z~k{fx%bYd27 zl57t@S*`MbbDxT2wL8krwi^E*tY9Y?o%Y{qv#;pk0pnVaVWA+FF<*^zeKnM~v8 zGR|V+@TYC;lcxGsJk)?rZGe`GKM(%$H7LJjCKa!L;L*d>&)p99r1D{k?KyNj%dS^t z#0RGY{y6u%iRBNdHw2A%k_3J#;-KSK{Th{j{lW69h=b+_O*+)Kre;pYFR()54w^q; zJ2Za=b{slC+J}ZI9qOf=4yrmG6jeIZOJ)knADVv~4ujvC!^Afp zCVs_X;@2N0epA}`cKzdxf1`gakEZJ%Yo@jDAMNr#@B{MKrOhAtE%`@pNB)b`<}dv% z`Om^WgwZi=e)n(5-(fH7|3ljPPi6n>yAk+9*FR)*MFsxGoT5M zeFdMxnDYY10R4Vhk=a*Z!?x;&#Hb9R^Izbpg)q`3W(OEi~*?28xdT(v!5mXFN6q zS_cg3UUPpB$)H^1)DGv5xXpYt5MH5_{r?IuEkG>>Mm7~z=%Jn(rqSFOVVUm>p@%NDuuVvXVmod@VIxIk7HaExk)@ZL-?xB@0xP6QD?BPFAl~5JxLr4>h*YEwO|& zL8@T$SM+3uNOZV(!GD;EKURnJ)OX=7EA)OW$BJ`}{kR`W_y^jN#Qp(# zv5#e{Xi{o*g-NOCvqVwx7tCEO{(_u@65X{xntmMiA9^0ZVTnpSOClTAAu0b)^5t4k zOa3r&(1~I*KLh%U_CIaMLl*MrwoEnN1vu*|Eb#cI1A&J%iGK0 z-$FlET~nfd`Ml)-qGmE47l-|854S*bru}=g2uQe*EnSRG|vk}#j`PlY!v6xV`Z?DAoG)kRt zcDiOQ1DfUu=Up(G?dF>OE_jOtR70V@sUNLQoJrhu-qGI4z)Nh-OGp-SgFjj-0GA%zBU zKYE->4f-AoEYasVoCqMWSTAfUiGm3bL_VYL z(V39I76D}S&f~8I;IyAL`z~WJ$pa90g$UP1$WeDO^r=98t+3QP4R?>2*^PT}t$ACv zI{pN()zL44t$ymr1}0mLxt801UhIz@m%>`aKi7EvHl*XAB>ctBp4;+zy5Y%s9|bQd zaA!5N20R5bB8&+qvAveKwZi+#;KdUbpj)mv_H@fL^6oPC7&N^bHuyN9F*D&E-QaT2 zalU}ifiEruhf#Tura2Z{$6ZS@Mgm2Vrhb@X;kFCz7IO4g{D;25ssKJG1he_X1h&X5 z09O7$(G`;YFUi)+Hq4HWHcBzkznihGnm z&%EDiu{18jfFA~FF63vg7G{S{f<<5CpPxRzx?3VOf2Vf&^8-bbB)`-Ttc$%@)(^9R z)h2(LQy`6aAkLg(=JL~He7Z_7g6vAEUHp9gSp{pTZATD>EOV2bEQY`SgoX zIW|Kqz##+*lTtdg{KF8!TZE*QmIrbXY>x#rNhH~^Z;S>6PGCqQ8fdeNh$uH=dL?DI z#c(8t<^|wyUKPf|XVO}+7g~z)H|%h4felkv7JX+=6ph}ar%J`kg|7yGZLk^$cRW~UizXyxxbj|c5h&af6 z4wpz=Dc4r?;B!qpACB=P2R*z2{bHnkBF5Bc*cPaDkzoWgTnO=rLpC_q z8Eo{(lI;BNkoMkF_Qhtx;PN}N3T_o3V3Du9AHaz-A5LRiErCF?%l#&zY zN{A0k0JRYQ*PP8>H_9_@-ga+NNE8^|fTkcf1jtdo?mu8g$$6Km9=v(743Fq^Hz`E3 zO-v(ksrq~ZK?%}3VW#2mzR(TzgRyC_=xo9GT!k@8rw5dWLIxh-#RE#5ABCXC68XBU z!j!Lf!IsR}9bm1bCS8R@au*P)nGe0a8#jaM+F)G&dj^EJajC{*)k$b9{5#Od7BpT( z``D^*RRan4ThJ&18b&MF+L&@^6kb7nUmb!jfR1Q0#^t6A3gDq!PvU>00c^+GX6UE~mruUId4S69q7cMfs zK^`)#)97TOg8NSn^FE05zp8loLRUTmkLot9?PrTbuM}Bq;qd-zz=4b8Vx6bVS+NkXRznM~+RVUCYgh`I_Ko*=Gxb zgNbAyQ1b(HIczcEekvdv^}*bE05L@KC=6j=1TQItajBAv*y-fLQj}YPeVsoq0=AXV z`#X&*fu=8nvrWVhLL?PKHSE7OCK*j(?Urj3xTceDK<$qOt~N$3NeR{ba~OzdwgI#d z7##RWFli2|!ss9T1+~XJeA=z@WTSr{C~gwx%S`!1)+->_c`20etm_vGkUUbEZR~~N zW1Cp5sI>;iEK8Msq`wxt3wICqqilSU$s8vBQrs0*ac|gYa7=k1s z{4YGkJ}L6;rsOu0ZrL&$a|*K!gufE@kC-ZlmI`lU4Wi~poPQ*^!Fbt%r}hsHn;&bx zl>E0IVg3!6RwkD}AWijmZ>lxh17T2z{*a-EEX`swfl8 zL`xZEDF9OKHzj}KeG#1Rci{rPlgS$36gT>JAC}HlatO~RS#r?G1kC6X(|)UeqHk>w zYG^M1m)d(4U5u-@U`SCM1)zX}Nv8C8&}Z?eZaUd} zR+{W6-z>R6EBp|R`XP-2aS6~jmA8;y`9cpwy!LaT=)N~e+Co-Ilk-?yAbWUKY5%p@ zIzp@Cx;@a2_H4#;r;@fZxnm-X8f8}GPGfwHB1Jx^OFK(pI(THp1UErllmD#xxsB6# zG^ZW^-;hk&H2j~)|08Y7+vd+bME*E`B{34;#lc(`7k_R5fA^1b5s#PMbC<<5supJc zd{c^$rR+Wxjhd&TBi=caN8=6zdzA}s59Z>op2;1x!V4>=U5vnt$}@vSbKYjN^`tTZ zjb*+FLIqL3vxzuDLG}<{xrS*4*Dk4Fnm&2Fzkj2C>2+WN%(z=TaCcrB&g>XrCbimG z^y)_SAB};J3l<$KMY;(|mAB4#>nt7~z)amL#%kk;hJ6{YzNMR|fXmQzpU3G&n zgqkfin2Zl*mAgW*{E1)&GW)$gY9T;#VtFCd$m@4N&c_=YrjU%ie|gTsRo<((0g>WF zBg>a^{Cr{{*9UIgV>t5_)RXN%iGA&ic=TjKc)*)cI(yDl7n?{E2pl zeQhOM9v_(gnbHihP4BI%0?$t=(D?Bzmc}ANn4WE%M_AAjVYR$hHcIUrPpW)M|;`DIc zc&O2Q3(pwy&+0L~r_L?0ukbC}kpJe~wKF<=UosHVr%7I>|C~?v4qU^|u(_{4q;e$y zTo%rB`Wmc!zJWL_vDOz_;@h){nHv2AS3r*J+2apA%;JCo4&USHU`k`k@U`#J&J6tL zmHKi586Vq?@5++v+j1EF@Kk00-Q%`jVzmE8-h}{)aZAE+*{AKpSy>Re|ym zL}TG#qr~D=+DX{Jj;P744$Fz)N;?e0?53sxjPB8btL!p==FK*A24SZg557xJn0UEO%S&w>9!4t>@5_R>hzd$JD%gT9ox#-pF{v;F<8+ky&7@I>1=sE-sKd1>yXmqKX(Ansa0a( zl0>(vi}{JN6&b5cC8h3lg8oE1?5KQ2A?q<-B8k)x8g}H21Rni~#{*bdBi-$PM1bsi z->m{py8rl5%u0`M4rgV~?8XX+mKe@_@kc`P$<08TR z)2fcbM+Zc+e@2f(G@jZ)nk)p{5llWd$A>D^5ixR7b2cth=^nxNw5m=#xj9?Q#~c*w zpE6h|`t1M+i+(_;6bNmOBXmANc0@?VxG z4HqKpQ#uP-AV1Z^QkC~5%55}TmpnzJ+{T^}W^=J1cZ(6{E^B{pcB21c{KTl4=&S`1 zqxyT*5j3)%YZg_f=x}xoUCiuIM$XN@#NzkYgM~G|Ftx_y%Dwi=b2#v0P=oMWF>nL* z;@5cix>SVEOMQyIpMh&YS4NMC;hK9)076SRl;M#yAxXp`FGfuTo`*x58OuJgazkK5)IdKjn0EGyzw;Z7$H^)hQH~ zJjq8&uvQLCo1>TLITu6pK`>Xkf&ZO<V`8bGtA{L& zc@O;(i(>deuUZ0|032MxNY?Wa^zRK-ErFuI0uQD?op8qXl)*#^(P;m>?x*~P-&p$` zMhV=Sz*=D4uxu_IjHlRnI|<0KXOyEy)DGJ82glZgWSuYC&m?_Pn}fyCdhGM@jFMHbqF7@r{? zg?!Uskz*{tiTpNtwuNbQCd6lvL-5-`f)GCP-?tn2bBN?vKvi8;N!W)jCjlsMMZ!KG zzmkRH&s6LFK?pWZQCIvAptW7ZUYP-Wmo$1PdAQeao{%y+7Z&Q9*YSt71Wy&`XF-Nb>>h>gPhaM~=TP{N(gJht?3Br3} z-kx%TP_ErGa-R}aa>9DEP-y`ho>D%WUK3OrqDunGevQI{XFFN)-Q5P;OkB}y0Sg{BW%we zCpHJOJqtVT4M45=@udJ~%?mH%Efd)QX>k8IiCL&t_SR3&J5IDm=zmXu<_XSM+dc~z zkCmopT;#W$e{|KI4D_s)*0Xvo^w==1Iu29naFz=nix7=dg!6mgqINt8$I~KcOqvu# zVsceT{JH~o1l_d0!DBO)ZrqDGIofXtMjmXE+#r{;;n?%Lh{cJ-E-{&(&06WY2PYoX z_U7fx_`_z-cA!xGjrNTS8FGty%)SeOJSRX9B<5&Xm7jeA2f!nS8g^`PLNFfBme>iQ z5-|o`hV$ObNM~iGs=LHL2kXn{tOtcuar9!H#Q@*f?{brg%Lg>j55*!UX0$V9xO4M{sXaO zRuosJTa_9Dnk^s83W*v@F3FPZT)BKfHuM4g*-O%)ja6VZXWE?!4sSGivF8Cg5#*FH zNg!nsR7(1n5n)XbzTzMt(c=m898~zj(F7tjb2ya2Gp3G-Wk0OWST{5xB|KllYmC)r}usXg!=qnsK-gWn7pgP$**VkOf z(U1RXi?p}+{Bx|PiZ3EPP~9CI1Ik`{aT>~EWzkSCjC}$yms?jCu_Ymt?jvuR%aE$$ zvA&U+zpNgqKiu#$TbVS(eR`Vy`X;0vNQt_LJ{5RBI~6sHVtF_rP&DWj5BiWYSMFjo z36^1An0oV#US6P%O00)AQW0>v;)i1&Y>O2*fLS%Ksu0u!jkuF-4~rT%tqM z;X>t(J9c5V)?7RufP^kF8NUJxX)$E0?1CuwMqYIWQ_~(=?UK1N(p}+RUQ02BvYl^u zkghLVfGuS_bpqrimfl$$6NXO15V!pzKn^Y&kHKB{6~scqX<^6Qsfb(0I3aQp3fQz| z(*QBE6f<|&q5T13`E(X@%^nmJm#1w#CV%FelCl9g*f<_iQjJ}lO3QM)I$~b$qG2WN zL_$gF#z!u{jI}s#kTSa&*og6WagkcbLe1rM|Beq`1i1}h;bE2!lY7`#=>e;Jh+U^v z+oWhnD-{|PdaDJsI2x+WIJp82ZXy)NWmsEW*na^u-hYEsgC+WB{&L4@kKh^y<2Gog z6)s0m+UL+Dr__A8W8=g9q%D)GYE?PKm6?G>XvMgr?Q!bBew)Zdl+Z~Ej>CY~A@k4J zhFOgA>@)i7S$Dw-MbEi|zrCM9V7OZkya`yidPY`~iDR?_R8jhU5%8h@*n^a3`usMh= zIl*e-`oYjNNC$>~OO5vEHO87^rRQ;)GFYZ7k+P1M9Ti5dgEMtq_)>eQo*}`_eKmdN z8Ub{uIfl%ymHrq94X8i9<-+#*>uz26*n(y8&uTT#b)pd3hr(|hH+_+u^8hUhbDbc6(R9r;eA?v*~{v`)~`FRW+-oA zYl`v30vO$55#iYRUKb1!&BlwHDQ+b{A%O}7ps^RIzgCR7*QKaNg2=3&tF8_HecRxF zYzqFJlkopD$}}GBaZvm}y*C~HZ!@$V{sT??TfRLQ{@cCn@VEGjBVXynBVsKfg0%0| zCKQYZ6m4P0xXq|m?XP_6?09xm?qOjf6U{O{0Q-uccSVP|btUF-U(fN_jM7i|fQk|N z0@H!S^4KT@)@%=F^!^0hEuWM>u5I~sF_dqY@*jUFrF?(-@^5GPYt})M2Z}21M-Ch{ z(jDKg#{jXh8>3y_B*O_Y6p*=eB+d= z;y`ug_^KfdU6C_-HKICJ{jPTKlnE1Wu5yj5ttj+i5Vi?n7~1)&=LX#Jj$0JX=L~^eDWwCZyN;DR!5mxn zsa0MnvbySOIhW9_rw@l(s5Kq9Ao!hAv*WabdbKE6KP7ry~Y=W!UlECcNh~o)eht zA)FcEr9_zUtA`f-KywF*@k1}j;s&mi*^X?5$@#2e8BLizcA_wh6y$#wr>h&I67*WAlA}$YJ4?VDT zU+TVhAvVJ^rG<(YlI?J(w2@cLX^BFas(@+==!yjLW*I1a6LR=MUqe6bgDB9=!f*-o z3y267eJRX$?B)8~Y3njUTShimLUKq4ti0DzP&(VxvD zq5XviT)_tgshN3m;qpnl_456!x)~hm?MC^=CE4WS@qTWf?zF16_&HTQ@|!QT*SO4^ zTrm?C3Y|+BNo~_8-)0%SfZG@PMhkt&M`lG!PZ4mG zYvzSm-4EBttT0M&FWce~EEn}1jruNaIT>+ee=q8$_22A6*X_Rvb{kWM^Wj#tj(Ad* zyS(DLo+V+6;aQGsFq+z{h4vVohaA9zuPTyUq%sjXLPJ1Aa>dIi34Q77zr|O$Zpwvx zHEIQ8MZt1;6sEBM{W2ex)b-#<4m-InJ{ zs*T)E3zcRM`fsD>8xncj-=R>)3K06`hF@Y09{5!I?tdNoOH=3J=RO5y>?cUc9X&Jt zJ4{Ly>lIiywv0o6R8^Js&9i3l#*bs#PT}>;JTN3yh{n#dG4=bX4TU8C04qOgv1`1k z2fOgBwxAT4mk4Hs1xC^5Gi%-!+=iD0VV!0yyI1X>;Yqxi&&%uzeOte86Y3S**U2?2 zljB!#A$JTja3-^MA$2jbF>?1C@B|jVg)1Vu9fL{k6s5}sH#*Md-vROZC zM3@R$XeYdkk@W?GG^BrGQa1=6ns&~A1A&odf+Szgt31@)+#r!=$%M?Pg`B+pR~-Rp?+e;IXMUml7<^Chgz;x`G_dh-BAE}s3I4s+ODGTa(_h>1CBwrYE}Ov)xVf7^$KCB0w5JuJpmL{9M* zcoeJEXC178F23eKsRZbRV7;Y(y3sb97 zNv^8jlUS*n^&7=!`TFmR(;q7Nd&B@!|2?mrInf`^?Ci%~#5tCI_+EA@SGXrYL~}3? zhIv!i;kcVRtS?aMQP(f^>%*OR#~S_YC!p=CZRO!4*X(ET!S}~1T?n#eK>gOy7p`_j zyFp16-`~(`W33Rc(+2s&S9kI?{m{W5?yceZ$xB=dvX2IT`hxq0x`H~S6e7ysVZ__n zSMqJm{`;bT@`oR(LDM2%CtvNpy(rKXyi%pTsM!RfAPiKYr>8=I{aH_6xFOaTXcx9l zb(Dmb;IhBk?`@DTe7y5LK*T>gV~bsnG@{BSp-)?G1;%mt62nyke5??);!B_L>OYH& z^8Q*<{Y%27s6R@H*B@xB`j>>SLH(ns|4G^+LA@8>2k-^=qy9H%vi>KP3t`^wbzMpS zB_;jWMgLS1eq7Z*iu&(Y^*=+Uy=b`!L_z4HLQhYH!1|YjBdmW(;TqO|X|#*4b~Ec= z0{i-=&6sn4GTuv z$R?O1?=)ZV7f`4VngpRGLb|udjJ1{E$)x^YMWQ#9gr89~+6Ef^qG+^L&^x{F`zbJ% zsL;-BV30(QDiWTNH`D^3i+?|G*;aqP}(8N<#nkt=sA^{D#DV4O@aZC85nN zXL6Wwz4ke`y9SfNT(4oRPIGG7Qp=$}*X&mTj+8h`^y_k#Zz|q@1m|?1pf?$2h(EzF z$2O$2^-tu+@JYo&A#jVoFzG0YzDbZ56&o%qsr~t)cg&LbkNj{=gK$1x%E1_mTy=LN zd!T4&pdZ$kcMwh)i3(H!Z=(h+47CS-y^}ArvZQ~Lzr*ENNn$A2zfQBSF?L~NSz#dntTYwIm$X|^K+VJGRM$hS zLd^a(SB8+;c#_vR3JYGXxp64aGddDjb0eAA*mtq`CH$u(|7PWvG@m7fuS)ni{x42S z_F5v!cqYmJNKzU-5iaY?yYLO|i9cLRdmdj?YlhFh0t3jjA7p-0g43|~ZonJp7&%(j z!9}fB94ob&kC$>`U-}v64fSEMj zwe_m;uNU~&9RECt;Z^z<9-Nuvkz{Q$vy@X zN{Aco79()uTL^qRdt|f_eSlI1i8~>Dd80~<`45s$naKQBQrsOS0yn8&V49`a=O0S} zf@^EA>h!b7n0T7HaP2f$Bhluda5W4^g0vknGKX;p@+zxV!Z%UJRVe@eeGLwJ;!nhcoo zb~Ku1aelWSzs3T3na^pgKG~|ojhq(|zxe$YI3G!93H?UW%<2IvUt(s(^QYAB^Q{#?E@nQC1LLs1Va}0e&P`^{@y6D_OSS`lMKK(SfO^gOeIe#&(@Ds}9j;ltN1DrM7NpO2N_nabY~r25 z{SbpNf=lvQRe_CXCE}&2q`XGzW-a`VSlthGxzEHl*ST;f^BKNr_;F9>OUBc%(t1af z_f+Pu2V7rawX^CRwx~eHhLMzp*cFV`Atv`415V-9Q?6O%=#)6EQoD>D5h4MpRF&&@ zuo5Oe!(^mYJ{6ZRRRdrpm}q8Rqxn4-u5tSl(yW>PMYGae0rCY_@64u{#az6u&bX!CY)U~<2PW_*4X{H!23o=6hw^8m?iKi zNcYqD7kpihsE&-f#f3$Mtv+_r_usKOmm}R5Ko@LmB@B;*ABc zN;cLiBu0M-NXNwS8$$dZ#=fX=A2&zQOFg9CJS0FD48YMdcQE8pc#YE)49DGo0qz0) z7Nh@=eiHpV7S@?2&G!RPkIiRbov9`m&$XJfHkmbqvjzqF*l=7*4{4M+ zn928yw@>X{K$*5xE3AD1o~b+$wUQ}Lg`iR_G`|eA#PHv&^i&Hl4C;6B3Rn~_aFbgTU?=E6tQPfjhIeLt4F8Cr+?$f>Rcm1kylIFsko zLI+R~i5;F{*9!Md#p}ev_9fwNt>Yrah4!gmLpo3O6zd~)KutQS0wdm3Z01jbRcR(v zbE`318#x4oxPm`^{FLB6NWADN^p)}bCQdLyO(lA%+h6$kvGWw@rP-)&=p*ck^{YM*Ll7iA!*TBuMof$%)AL4wICStH?b$Z1Oy?34 zG$QITenfv14q`z{|K)hKk-^1S-*tGv z3p|Ta4bZs}bZ+#;R`^d?0{!L3l^3!Lk0L&ppor}+$J5Y919yv+tdUzw5yPdP%+gUU zMJJ_2l!|j>3>fnKl=+>q;4yOA*Q=$NRg(FuyszZbAFc>4>4(j zTMqxC%2)||RlT?r$a3f9>dV@0rRe6a4BlV5h5#Gl0NZ#J{hO2MPdWm5z9mAk@O-G#Oz>cLBXd2M+I~c#s}Ef6Js$S=r7$qjEBayKjt+i>N6Dvav7Ljf32>$a zGsP=BTJR2Bg{1j{@3JDeKPhv$x2K(D4#x3qa10G;02jjqIGKw`yfF@C!Z4h1i2Q}^ zh?L8{PTB@}WevW?1|~+KHlyGJOOhqnGO<);MG6c*#CID8Wl0`cuCk&7fKmTJvvS_Y!iM(Q19vk}hv z=oQozGduQGjd@Vdv;*ASm!w%kpdjtad%&w}s8;psStsBNDyEXq3g4bDd`){V@Sm_s>yWc=oCo@+dt`ja zta}>K`s-ch>3@Wh5@=yk{?&37z^Kc7M3k?t>sMmTSO$uA%#VpgF*65p)SrqSDipK1O>6&0}3!}a-4%yzS)D3fEp6VBe+ID1IHQ9 z=d>Y?Yk^{wnT?hiTWGmO1T3LZW}s-(T^<-+Sa+b0&Vl*>oa>FxMnmft=imAh&Y${Y zF+Hn!0(K~pW|>}N;4xGtjvsZQw#xh*9bgA(6J5_}-dx<)X$r$2TSI&ZrS;wln@Ztf$C<{M{5uNzuD;N<&S*3C7cacqgZXU~ zGpzdr2KqmNVh)+BR@j8~po9gBMi5x#Cz}44z&crA;W|UWdQWi7CXTPY3>?E*8m_OP zIB^pk#EXE%cdmd}J(KYsGhWh#aOv+yN3~&VvRfmXh={D9iw+c!?A5G&`0? zC5(+FV{E{HjVrX!ojB`vEqF5T7rK4D7=JDzCn`k{7xD%ohLZJvg@@*OJK%EIh1S6w zc1w$Cr>B4$*Ls;BW&2_A7?3=#2yNtfT^Rg*L?RNYmaj2zVg~_Q0GQnwoBw;jeE*_< zaEo1Q+LEb-v$4H>e?FQ&zQ0Cm1Xu9d4A$xVRn{0_IDSPF1BH4NXf$LH1*=8A2!4zC z0@rM_RxU)eZIP@pT*EL>+>;kz0RC+6HsVKf4f{+MdKd}Loa6zwWOgw^16AJ)FhMwH z-xL*Ym0+|$K9LsHh`fGso5*b!BQl&d_8GDuXPxFqzz2n(e<_H+Mh8@>bKyHUK#azi6 zv0tYhc{oRZN{xdN)(-qe3X-iKg=WPXDG@pGPFZcs9H^)IcxRlU22r z(09$mTP5*#!^!_GT)P=lPlu?gr~28ChH))`uVwRYPV?0K_ihwr&crb5m`coME zIEe++v7dZNvQ~0UL!~Kvx#o`9&vf&d0TbL2)E06s3wF@hCuJt>)xtxOlOrppBdKKO zWD&db%gQicKu*B0Z2DyCYCOROu%wBvsAR(0av_%=srqxLk%cD;01S%)0S5YBYvoUW zzWksQM{^!I29qV+F30^Lyls1;rsEc5{Z?FUgiZ{^nlH*V-F$KNYn`zz$x~31s`;FA zu|lXHi3sxK`a@%|VjSWF7}+&Q&KCFk!&!EyHA+Imy?*pA*eDOjF66{fCHnAE?kGBp z^RO{+@LB->^G*B@q)RnUb4^@2&b6#5bC;{45pt;<58rQhyniz;mvRmMsuA+ZJ^3`( z%vr2$aIXip{L1Hb)xAq!?cM+!SKXE1#g;EA$AH!4oc)h`afhq&^j)rUZHH#ZVIs$l z#oYmPLpPRyzrkOvO#0DWGgd4`V!v~fO1{MpK%ANjMJKe2JcK!`^9T`9jG%kKvH-73F7 z%I|LZ{r{1E`!W=@{a^g~j6dJ-X9<5+^QVbFv2lK~9_VgzOZ&EXc8ublSCrfPP34~S zj&e_5rrbdvD7WYnaeq@=40Q%bX1_B+XM}Suo$H+Q==^URgwK^WwRDP4MV_)B(RPvq|gq!{JJ&-haORE)w;b%n%`OW0lbOFlt|(HxX2z|J*` z_x&CzR{tN;9|7OQg?So}IX+ZyFo3Sq1^4;VHUv{>sGIzp zIvcw#1if|SZ#&j9KW!N_l!MC`nIDrwuOCw}O-yL~&>xkx43puwT@B6pd3?>wP$Am~ za4}HWJ^;d^wK3zpY2u;Y`rv~xe*J72zj%>WE44UN`=~t20`2o`3qTt<0oxGq`+bt~ zCpOBbDuZsdN!|{MwPj~`2O81QXJ0^b+f>Z{#WkJ;GdQ&Y>pj5J*t2u2xCIzXdE?bs?F z5U0NhA3Hd0;d|1Fp`9)2J_d;|mj^dp2HYY!i5 z=ydc)FyQw(415t8;YzG0xL%1jOWea}n?iWrYFoY*+`5Cp3F`*zscOydBRy6YMdw}X zf%9Y@u7SV`<4>3y{|QO@YN4B*4NT&CI@oHfJgs*BC1WR6RUKQqZ^Fc}zA9Jk-ieiC zZ>#FG+%ae*t`2CRRB=5Wa@61pM~jyY2UM8h;Hr#4t^Wb!<|PCs&rG7EHCV$oU4taL zU2~{g8j4YJac=Z`?00`xVDNiIlbEAsyvE z;k&vTS7Fy6t&(5L#{lFWqv@)t@GyFTHsm6$a;&Bw4V%x(>$M?4a#Gdx#y?O2v{llI z?j|f%_i6eCvCmTh=#m9#Euf=NpYfw`2?*GNg!hi3%Q2VPuaA8XieC;Q#@76+LlS|B z9|_681$ni?Jyl(dlJmg_`2e8lQ#2KH4TEwdNOE1|Hdo^pfk*GcYPKh8*-LS+ zKH6#t<07)>#$(fSMWTX>NQIV>=?8x#^MUhy=HsUD(Gv}8ete^xF zk-;TM;vHA)`fO;PMh6-_I=I%G4(!C}jL92M=eE2GI#9{cc_%Lb3^3vQ%rrTGPu)kw zFs1jQ@5#KmX1ZrZMa{5R#KwcZH)Y=-O$YFSJ*fj(A(*gc;fIl7JPY3wZ0seG=KOKetu3@ej3V-?({`4vQ=~MXAr|_pw;ZNT| z@dt*GynEf#_=wGR$coq|F5~5M6oiX>dgXJi`cw;g3Aq4D4kW;R^T;S6|B8nov4mWU z0YasLM?zZSA($pe$TSSHDh&p832|WRph7%m$Q$txuNiV9re7*ezzlH#pb7y(0_UHJ zkPH=aYv*{HOcin*%tp*yP8HIe2yv^BD%i-GX*??AM3_LCAzl@-HW3m~AvMs;lP6;^|WU)e2OZ_`3#3N}Q!0wlo#w#Jk7;zC2b_|9{ zifu~t$z)$*e#EKs4I(as+aS$h*9YE!1o?i~vs_1LMh`y70%p!vLRbZ!k0~e9fxpkE z-VHKH78KuU_HQ)%My>xB#&JK2&JD*kjh}F=JbKUJ%lEK+FW_qN^2?0-XrIi^lqkQ< zcn1)f4(0nOr>Fb|Zzuci3VOfCN5_4^sAecs1swtioQDg*BF!k4uB7udF z8TA56G4o(o;1wi@8^Iz&gx|^Zxg$#Y$kJ#ya<)uJ7S?h8@Fy7(PpuIYEhFMLWhV(G z=0gma1bbF?l#QI)EOXdNVr!gz+DLvwv=5oncuKNLy;!CgRU^U+| z3W%oSXRWW|_(2MhiXOPckDnG52jjyivhc%45`K)j2}PKBh##{OKXHK{-DLdEGVwz= z8rqQ_KWlv!#}A@V@Po^;_!-9!AIARxj?fPuN%%2p2^M2!9^%KW#7|t{M>iS22U-;U z5DxstB6Ax0S?jwveh{C6A6%Bj&p3YgFn&c2!4Drv_%W)Vi68vL502m`F7Tt9jNdLp z;fHYG_x_%?_$AhduDfS}g=LKx#}ndE@Ptb|`5DI(AI4P{p7=<@lTmk~C^HZ7WLDBq zT;NGJ8PCg1JP{5&dlS#H_B`*Aodn#((v93V(zH|NlYeBf`HXJ^ld`f4Ib-pK<*0VdPl&<0A=w zMxAHk4?ppTBlwF8{OKm+-_^t);lTfEEIp41|5$qbG2apXhfDnV8OI+V##KO4=#P&i z{26s8P%!fle`Y2BhztDbCgXqEzZLxvPX0e){OxJ^2NwGZ{|tpcJ`?z7fd9Ef=Qx6d z$@n8`(Jm8zWF`KDMEvOze}YPy4d`1<{4<3Ak@?8z-yuEznI`_33V(bi@XrMQqa1~Q zW(xj@+J`l#&>vZeKOqr+y2PKLlJH-R^Y$DE5l;R`<|D(uQ+oWJCjL%^KRy%qJHh{P z{GBQIBkDX0e`F>8ghc%55`Th9!oRD9zf<^s=aJ%%SI^VPf1BIH->vY+X99mW_#a3r z`nyx`N7S7_LFkXH#GjCeKV9NaP)Yb-w%Me=TloKo@rTJ&I{ZB*{vL%tJ`?zR!2c*m z;qOVoA5n{TnD`?r@h2qWPnY-;R1*F=uiYU3c!d9v`N;U^g7o-%P5iwIe|#qJ_k#aX zj>6xYfTwPs{%{JWq#tI&Py;xMU>b zpJ6}?RkXw zyVBzim4)E%R`^3%pTOU3T*WoGqQ5%@f46ZbP%!f-`~gYuhb#C4R1*G|ePz*~3XR@J zj(^|u_L+uvhJEr@?I(&}RLHTNMwcI+K)Cgp7&n;Da$+B`(>#1lN66P`zF` z+Na~}>z>MMxw`{~lE(`+8yBMz(5kEb4UPL7)Vaw97)`+R8mHDDmu#G$XH3W1l6oZs zPIGDl&dx(NQ{f-_4|L>c#1znRKyll=5R4bk5h!QpX;z+iEs2s7FqMM8JvIK-A$lO5 zIE@E&H+Mh^M>(fCj1O4S5D$Dy;9L4ZpeP5AkJ_u;F8f}b8}Q&N3E8Jw>iWkH*FOx` zz-UVvsEMFJ(M{*|<91rh&N2{4EP}EQ2 zPaCHU+3=A;qb5g(Vr9YR=wf+#&?7cvEz3)+Vgf~*3t9f@D!=9e0J{KK;xz%Rv^;C* zQ2^ez06_hE+(X!#3->vME$74*kwNxEEKA-Vd9X!5(@q-Q?kMYIU zl5_BQFXR6UshhTbrXuoDB%+;)hqvG5%Y7=en1Lw^_FYU<7VNpuyroP-x=}QFfpQmn zE!=LdP8haZ3R25Ver8?-uxYu9tuX6kHw;xz?2AxJ7w#hCpc8i9q>G~jC$`I>#b5GM({=Y2 z_*^s1Z(Pa0QN_R@_-o~ZLGUK}YWD|#h^y{L^+6_f)n$WHfub$vbEwEd5@-!@71|yo z3>3Y?P}j^y@Bx#?nhW?-H)dDd8- zO_pZ|JX&p(Xlk|1%GobS2Pa~LYx(v-EcX81?TthltCuO|?;oh?guhEX{PFT<6!HfI zOtW%?0#iOi+|a(8A}v4`}vX@BjLJC;R~i{CN3uFdSU}Xq7?_f<}F(`k{SeOP7udbs85M z+V{ZHP$xLQz^b7W|G?*cTbGik(kj#Y?nr#7CYs)N6Qk3_)OZ+CBaJt`Z=*`JMmfJF zPmNddw`=g}eFF+eL^*SnGfz2<%4u89L3$_bU%>ykR|}VSvkUYj7vPOkS6!y^WxDRp z5(dst-{=Tk_&t+1>LDdMLU-juN61k=bOaB5R!8`~`VgL~tH;M2$Fza{Z0CdLJhgP#r9G#GGSGlKHTxI1d}r!hLfU}LYS;GHBtFxE+hKw7lM{J<0h7VM z9Fx;;wEi3AAn=@ybNqc`U=u&tMDGZ`7^iofGdu$vQ-65|LUezhU%)kfa*Ym@z&LOa z+A0j>Cj+_4JL1pZXU8sAO(*>M$w(@2I4y@q^r12Rb@BMi5m++DFCLY0=ODUYyO0!HDkbkuA1BWB56&ffE9*K!XN>5oEPvWmf~mX zDE!Q*07sP%?L($R4ajsrmrMtI$#jAT93ldTn7}zGDmMdsO*z2VOau6u8iI$IAb604 z;8AgcN6iUdaEC+W;ShT`Kp$o++ha>j(FH_FVIk&Ws!~T81sLUjF$HG%!*k7$znTKG z{P{*R01#`Fo=o@|sy( z&D)#IkoR`L!`{J86ked5_oOd{VK7L`@a?gd3$XFZ+xPqL#KotsyI(PT9CW*`;8Fqz zck6@e3_+m@0sKsg;Ks24!zocASrK*zX!VU%WH{{F8RAAYU59J0CQYRKlAKOq!Xe=ME$k!D}2 z+4nDNno-jaV*m(vE3m1V62Z@1EWYL*A}f%D zG10Pcr9T-_AIvY!I->q1{g?Q0(IOt%2zTpi4qC3hnANO?5*; z!JXk@O)iGn+|`@VBK#QcJ$w&>mp1aH% zBI;rcf91m)@iTHRer^b8wLhs!)m*ZPjn&A;n#;yQ)OJRhnWr@+HCH|=Q{l!>HPNf_ z7VuXiUNxnq{4FC+HKQunEeQlv#d8)h68BdQ<%dAzdm{2Z5&52oeBTa{H%#)Htn=G( zIq2BO2+nVxgi-;^B+P9w^Mp2U1P`c*CZm$m)ahJs;bI8ROR?a>m6Dv7Vy-%dbJg28 zSA{VRS7+nnt6B3oG^x zxL6@z153iK_bN9+7RC3Yjmn+ND;@Fuf>*io0?KV@gxm6W0Kwdcf0`FRQZQU88Lku! zSIUMfg~OH7-=9$w>TAj#HsGP?AzA+ z0-VXyQ|~lA5t@E53M+$CJdQZV0sz`!xP2+ksE6~^@N`Aj2_7UJ)71o z#Dr@$t=nvBx7qY=lNH=1Yq(8TaZBSdI~fYO#Zg>_yz-?u5IM<+Zm_1?)^f$W<%*Nb6SV~rYpz;6#%Bkxcg|Wao*eNwGB;2UR1)#>R=Otc||FKPnhs7D@ePJ zM+#@d_vBzl+IZ?MoXv>0+1}$%1FXT3Hm>%4?@3IeNF68XG88}A4R&@9hgM|Arsz~h z0}}9}t=zQmrF=-+G#T8?VCuFj@!T^sZ0eMT1JFDsH0EdVDw-I&lB2EnXWe3FP94lb z?}aYgo}C=78VnSSd#M2qqt^HDGIzs?0wS)HX<$YHDeBmymQ~({QzX7Pw9HDmd}!!< z;OcDnL1NO@IswMaA8IBE8z8e#SaKFKUT{nfw;&|wL&MVCc7?|2qoOxjwMnKQiiUa| z%}379ZTKcRjkM2ZD@2;aDq7sO<@dCbngv+;FPgW>IS#!ZMA!5OIMm|Q3+4=<6;_|@ zUYCNWReVU|{X^bp0K6((oQJ29aMZ%w1u@_L!hVJB*p=50({P;dIS+?&*ds}Me`u@f zq9I+%(OHgyJfTtU4O80;9@Wm6&2JUFqyJ2)96nO%NB;ISz#==ru3d4$XD0&qm!^T* z(1#TEG{Edz@l^g&i#|*T3P6*{3P9*Mo<80K0&U^04{8?r3S0^Tv{e;Ke(<#$`JsRo zDK&zEB$4q@;t9&f|E>Jl_uBtP{-B~wxu__V>Jx=*Yk3n0iGbM<@Wte#X79PJ| zuR*xrhJXt-y`H?m+XBwP<1ORqIo+=ZN)eAsxhqf5>;00n>R4Q+b3MwyRS4ZhSUF<& zifwA)`Y#ykS+$#hZ1U6v9$~oK)6ce}*fqav6|PIq%9D(aPxJdRKkc7^<$ID}@qcq8 z^(~Z$ZCOXf#~BFCnoIuaHI!m#C`ORH2AnlWa8i!8XASS^z|LGg5n`V&z}g0%3@cz* zI}U5lKV%;OKbyr2W-+k4cMJo@CQopTVOPmRmlz7YaXXeusYeq3HaFssLjv8yFun<; zJ$|I$vFWf$i%6n;(hnWAm*4=*m4K0Wus!8}w#Y9I+Ctv^hE-PD^kW}Uj5m*Yz|Ysb z1evf)&`5_vDMnGeY{Zc@-xvJVR+)=iz-*OAm4s&nkir*i#6!&=!3M(CFc{w$_b7}w z2C?n_BUw(CEFN=&@P&qXOF|P0aEMDC`YQ>2XnX>*F`Qg`uN*MUF*f=$@JrMmbq}fn z)WCW~^oO8>Y7T1P=H?7cl>zIo2ZIHMz^1X;d>=IAO1k*B6>hmn__2W+K9J<`=82EL zcuo*+((!>qC`+3$8h{Pf_vwd8I}WtzBAP)COkhM{bE$}Hz)5!{!Ao>sE4(sxh(Lsd zXS+bss|=9v@%UsJY4P9x)%XKKZrvd>AuSB9LoFtw7SiS;Vr!BIrfU$+eg@f0B0)G~ z5Sp-3Mjwz$jZql%wa^=CjNMk#TBHTUz;b$Z1^eo=*qZMYYo!Zw{(|sZ4{LJ^v*@(xJ ze>txsSZn$=Q`67JU77waKy-(??bSGGuXR0synH;IT84=jHjs>!Nzw86GhGXufxTx; z?!NG7RZj1*QVt6U=REu|%4%DVOYU#JD;b)_bqQDQmpsdC<$R727)2|9$zbeCg?rch zAt51O$y- zG|{N>+C;%7BAOuRjwCe-tti@3FO*ho5podm7CZ@ZdN?(;wzbv1+Uu*mT5Bzct%)EP zt;)qJ%G-La?&GnF+E+kY^ZR_)?0qh|sPFs!|2z*ld(WO(v(}n5Yu2n;Gvi;D0q*#- zdfmt4?~W5NmrUXuwg3-eV1(a$Njz;iu^~M0NPe4AfBmBYOwD*o)2p-W=<{U!86WmC zOgO{@y|=+%bBdwN%BFGJUl_tn=fMa{(qPOG^3KolU)l=@(j;!BGp19S^2+MvBg!w` z+c4;_R2EE79;-{{739{7C7yb0i_EE6`8XZ>b%Ti%1t9W1r}lk%Pp>e9{O@nQ-TS-h z_rHr-k(V(8{?B>Isjp7_S1PSk~>IYklbNkN=;jd_I21QDqjkp7Otc=3~Bp z_1upx|JLk}{=RS9M}PnImfqh#ihrq3&c9N`2gSpRd>+BlFBh75JkSb%UiQ?JU;Ot+ z^6yEGNBt=N9(Q|hXG1>xUzdE?t9(E|J_xyQiS?2Xw-jG&8P11sQ`P-67+3l4t?4DB zh*tH5onb%7$13|4z{g(^!1v$S)(a4-hRsPcFHr#Tp8 z%JuBv4q7g~1yCSASIN;Otj%N(oEtD7+=I?4`L zj;$$O)uh2>8T-#Tr@hP7XbR40&SSgtH0M%xzFc^JZCT`jmZNKD9NjvYGyjIJI!d4> z0jdv}*Shk+e8l-BM&Fl1E+tB#ZU(gsuAMPBdL|D=wKIyM4Ls~!J7e!?Ee}I#XAFsc z%1g8qyYYWUvCa-|fiW{mnJdM*FmcwDuhJAm=P%#Bb^ubRTfBFHc)>#^_NFKo!c^Fu_yeo)K8-v6ikcHXKd8`HZg^VGt0O?V9fyd z{pjIb9u9PYf#Aj2=xb`aa^=wQZwdJu$PWWWOL2I9Df|PSfPV)?{?Jl3 zw{Aw6Nz6DnId0WVHS^4Y(A@K@;`$W4&b%ObaSr}yRn*S%^s#y9k-xh}uv zWF7@p|K~oU{zqd%_xoVxqzcfbE*9v9;o9D4EZpW@$!?tb{UFdsr5{~G(j|HOcQ z*8r@&E2d20M~`>SxT{0hI5K{@Y1X8lJ=C}wr-Fo|tmsq9No zesn0|(P6SHYp0hwQU6%|9h4tR2N|$`M3&tEmHqHYGUlJ(Wde3?KMi~u@`ixXTk3dn z8sJl0E>cxHqbhnh4@Y*^&Nwm(U(c3AR!2u7k+n!=^8z+ zx@#yIk04_osL?*KkiORtnNrBP(6%#=%S zotu^3;C$9oLjFb`D6QQu%0*2rNWqNS=y=An`q~-wrfnUkkCDv1_QwGRh2*L{CjQWk z&sqIiz|x+7H>LZqe@1@EkbgFQ90kt?*G?ZCt>B@kc6w11OT!DsS4KN1ErsI#xTN-r zEbGkeKh8#3Y-0@kXMDL_O<^r@5#wf+SJzS%os}bHiP>oF`cnVxhpekj4#!F?Qa4ue zaAuXi$$h3RBzv*0YA1QIHPtrS`}gv_U#sR^)^Jp)SOrQ`UQUPlWc??a)Bd4+NfC{x zoj#&Ju4E;^CDEKt(Sa>%YBv00O@Ahg<^EKmT9Czj+||Cw?^i ztb83V>GS~8N50;BAP>b*zKs6qS^DWZ`$f4QCC~miRNOF5aFL>i9;L5FkO-u3cA5X& zgZ*Ql&+kmrPem znNrHE+@vL3?^ar0u9R|1IdaJnN~uyxm8Bf8WHbU%T|2!xI-G}^+UYe&hV*-XY9-Tv zuK%2mLnEI@kq!%+giq>0k&bF|guN)zafrRm;C@Z@rAWs}dvBRV-dT|ji``7L%n9Uc zPNd^qnvI?}pWO4g{?OiR?Va-9YU4H1feY9?_TjX`bxF>TUX@Y$r{;7=j?eKDpLhMT zHk&15LiFyNqbyG=n!r|v&Yu^;;^EBs{(rB`)G|HHf(CKDpNFptN&l&AF6=!UfR+nw zv-p;-(X-P8KO8nIiQ9t27xhb2zP)pG!a3z9q zU<(&X?9K1?nk~ex#$G$Pv$MYK!vi86KN+n0R#d8-7r!IevJoEczR7=vl@02Tw4bDm zv0a4Lmg|YV0ak>Ib=!6Cv^EWhOMVf)!u!2q zyNe_3H&Lc-@d0I#juVMI5?E<`%o>W>$|q(w57^)P2+h0oFeqz@H|=j6nhH&^ z-7s7H;fb3;^r1J3UWg*HZv5#|_GD3cIs94uRpZZ0wT|PD7veY1;a8i*PX)p6^~W53 zdhLT>FaFermCp$(Ur8YNI+~z2>Yk|}7uSa%mdFmWh69I2kGJqUt9(FVniVn&m18Zn z$>F%@U|MQ~!||vrr?6q1BrSHF`bLpB#cX_q-J6*niT`ZUM%Pw?)Q4BS+Nve2etuB> z23P%62T}bkmm7;Nb1V`~En)TZUG)*Go>}h-yUZlLpX7h_23Nm8^{GEu^d?stX4#P} zdb-#9$t?=Bz8{nr<$S?{lGvrI*UD5(0k zU*^iXWu20){jIEURL13M6oHs25Kqm{yTD81mw)@Og@49&yBt?@u9kM==MMlCjGw51 z1+@6}jGMa_wlco$;d7@Q(Cn@Lus+KwP>hh(cZ@lg;C?5`ezB}Kb)UOlz-H( z@(7xgV~pk!7CakOi8D*NXLI4f9;+Xb2PW*rMbisQA`c87vwZko^~)!WVOix?x`Tf+ ze|l}T%qftoDJs8jz}{_GVP^GGmjb&aFm@7{~cT4H+&7aZ*MJg!|bJK2!6 z`&3=IQy6;A+&bQ&;OFr2cZDdWzu5hLmT(n5{F7D6cY#w_aOaG0>3!~e-o=4JKz2w>447zmz_bxu3 zN0!HhZUj=<8k2tx3!MQ$M}!1%e?2NGPvP{U(Bc2hEdEvCe?Z&rkymj;D*SERJtE3( zAg?<8DH7#r<*~AD_vk1=VP0)#x~y&Y{y~nCw%rE=k9Z3e5X2ZHuCrX{pMagZ>LBWI zJGN|fc#*iI~ zn%~&GZ$W2zaLq>QvNci1DC-yg;1F!zkh44v8T<(Wd}56kA26a-3lCODqP`xOT4GHW zZ9Uvn<}crdr1hT-(eLzczdOKx;PvguvOi||KMR*iDR&kvX-XV+?!{bSo;cRyr?Kwo z>-S@W{@~`sC8LSjm^r#Qt@|09J6>IMZFAyMl0M6@!RRrcz>Q;nSyEEa6hEfYHsE49 z78t*uIEmHx5xj8))8wHg1q~LI&>VlcF}~Gb@R}`@&60_lUBLf-PLa!xRS`ws`9FO% z%n4GTdw)};;$+set8cH8Cl;VQTG6MroB(!uDuN*Ig8c?er;9Z!*tb}I2= zwZ)y0j&6H2yZ!+lBM-hjWZ@vZ4VeBmK2N4j>(WfP)f_BANj#5GapuPhY);U6S#CLh z+37){PVyem8fn|D1%m`9DhH4 zIa%~*rAfoD|A92Da!L2Oq}!GBGm>(YqF7MoU-`3ud**z3cQqqei%mi@QS$wS-Vul{K+ z*6H8$s>9%C?jKdRIo?YYceY(kKN?iCk^67mRj}EP^mSL^#Z;*Fy@opd_X$M^bldc> zK6n49!LJDWzu@nyRjW%evmgOY>pz$+8_AU25TZFi`HtP0@=LPipZZBaYdTZjYNpmA z7kksJ%pq+38vIayU}^^<4F zEo!%ViNYji5X4b!VdO|oEQS>HH-3foz0p{^&)B!1scv2LI4`!Ote`&f?R6#}rXDoJ zcy-;junQf#{a5eXB>_+}VN=QR|NN=Z@~bDIWqCy?O}1!ky-#SA`)~ayXy9xYR3u7y zYGSC*a#(MVj=oEn)CBakh`u=jJgoKPx~H>Ecmtac#tOVaTw~gL zlA~fv`bek{ePcz43JIn9ypkN-FT=ilOQb`-1u>CW+ZHUyqHmwY(2yveieEDIC6uoY zr>Aer%HXEdgr2hK*JrJ2rAZYu~yY-tFHZACr*c#5q``B?n)q zT1GH>G*xWzlB3RHaN1nlT(`EhwlO)QQ1Z?A6nz0f{O1J>W$`us<%gq4`{BX!R%Lo< zV`A!Nj%lB{S+Q8rleETcJ|5m89S@@m(+8Q$o3?Gaa81r51Dqv=zw#nQ-^iAS%e5?_ z?k|>k7EJ&a)m~4xDrPm~@#{}g6IHAEydVUOpoD<+v{T4>e;=@5Mf`z&DsPT&ZLWB% zkzx9*#3g&N0HJZawXPXvh!HQsh&|2pFoxS7BZL8Pb3FBK+*A|QoRyfmS1E1Bt(2*g zc{kgom(bQPZzVir!d?AKuI^H=N`3C%0~vvl2Ohtv|D6?1(!HC+|Ni^7a!9b^+je-7 z-wxG6f-98sm-2lRbG~c+rr&}=p8xB2>8FpX!S!D`C4&BoR+?Jbk|@P&+^)M*(}V0v zP}by^H&q@aW{;PysAUFT&du(zmy38hCiX#LYmx3){S*^#|8=I!kq5|*1Na!pSGAgf zz(UGd^toM7N;Pvkr?qoMmb^{V;@u6g4TTLmyYZy)_Sm$@)D6>;4aFT>rbVW0kZu^( zfDu!$aBxFx2=%PEXEGbwm3)?^9EGG;t10z8Z+f30Ad+Fbe z@vf=yO*^JVep}4#^xdEoEon$FJYoN*K1A#~wnW;eNQ+<@jP~zg{wT?1N5Dn}d!zAC zvLf=^YZ{aFgWaX|r_B`)W>${Jmc^q)cIz+c{rxXz${)GGo2>0XkvqHOD{o00A9?V# zy%t={9oBKKrF^`m$2JAT*QFM#&uxsJ0Ld>FE;wdt{E>$4U4!Uf(@=Wj)eetwC2jZA zc$c;gu%`70)fQQ4HJkqz7NL#(UJrNsS_4D1u_tI6@K24TmgQ3`55|L175I;LuESkc z5Zx#KPWOj{I^K^S0;5lyA23?_d3Cesq!1)BJAw*yL!^86ARMc$Lsnu(^rVYca=dTP zj!5@j=%{)PN%({OrEJ}D*78*YcF+9yrP9@a5uCD~$6JTG`K31e05ucmd2|Rhy;fbw z$#;%_sZ5F)Fd>X>bq*89-!ugR7#{nX>E`RERz?asVL?sTpTs!$aOL3o z$gS&inK>GSiG#q-5mWrD_6W3+08LWSYeGQHqtAMvjr7KoK`u-bBKJdFkK)FoqHhNU zP}W+YATv+wE)g0`mIit8=X*A-lqlc5SL>MAi~mN<_vJsUlx()NP-F@5zIPY4j)=YZ zVfcmVq=J-VYds9PII`qN|C8XW&uKv)0+x+T)Ep;qNlS*@4Zo2C12%KaRxEzlaS zjrO?NzWY`MQj0%>yDQQbspDVDL2mZm80Qx6=@8peoMw5c%bKWKWdV`xV*vaMM_UC&qDSpN1uz*EX} zezE_P-^y%1L0)ZrL>1$kfpWvq#}^@UP>aw(Saq4dK-st$JC4^Nqf975WD zq?P*1+14d$?x!(?s|9a7x9AJDO3(h6?pL7bBaE8axFGZl^X=)w1Mi;Is6bv0cX8a$(x7v~>Yls)Sdq`B z%fTn~i~j~H68-(7m$k;OHFz~rLP;PNLerfKa9WpxHyqnJMNVh^4k{Ka_wIy>dTD(Ubm3LZq5 zq)!#O(n;vwaP;35r2EzHgGI7vA9Wqjn$PoRN!K%Xp(}xk+9<4w3jIRBY8^*adx;TV zT|;r?rZWJp0<*&PV{D%eTmDOou6|j&WX4zMr)LebtcafKo?m#jnTVT%EkYCTzMM(s zE0+L0Uh=P(H0hrBhNKD(m;4v+{t(uL8l4}XdHF_?LOd`^Bs8;_ia%&2_oPf7nGtQ< z^iQDr_KQWF*4S7(U#5j%Wtyibi47zaBNF4uMT_OV?S9F+|2&;UMPHpGFrI5EinST*@traLH{@#C3CAMWpr2HqR|9%NW z42EfF7=dEdE~ELS$&-)wy5A`8totC+eyy0v)$kP`cy-S#ikcgisic=YnOW+9PQ^vQP}NoR~qd%=s3+kZ7>_40UZ@`l$XGI$y;*uNP6GiyI4Gqa^@N%2-G zD`H;2tgXA)Y={d9^Kt+EVZRA`wUkt;>1Y3$Zw5?OV}UmsEp1*kGh_ z+q%f=ta~QXF5{%qiLTU&;v)Py=@S0byg!ZDUn<_wlpKCiZ1Tp}L_U3O=1KT} z{o7d!vA#B=cv@rx%5Mki+bj|h%p7kcrp^9zNN|!WOLvCyR3QRg`#llR$8PQNJ~WEN z?~@^UeW9J8yUz!GsC&Xux1^`yL$B`LMb{8U%M##gP&cZEX-N>VYRqp9wZ=ss%b z!Nk(gt+j2D;YGt;4degcMOg{#s44b;%mM~$fvC$Gh6^10+x<?$< z-LtLVI$E85d~-4Wy5?e z+H=gX0y_hj)j0pH&#N+a>3Hi;(=jtB`P0hu8=E{*#5p6(OP9NCA)NK;C64#YAT>~z z3W;Fp6RyZzImSz3FZ$aK6;vSvXb_qyOPN3IOhGpJOa3KyO{C))RY$HWm|rUVF_Vk_ z+6KD2raN@2^|@TP*Yj0|R8^-T>t7XAP^PQ&3JU6VCPlp$X=X#MGA4`mhe+nD{=P<^ zjrV4RPN$;jgy>9sbwJ`Ku|6~aacH$Fuqf~J->0)l$$_C!2(A8)G-+@P_U^C5H>b}Y z@(ou8eV*yF$Mv!f0{`?GLEDznnCTLTZUs`}bIgIUL$};9c3$$0d1OEf;0^%k{60FEevTx(fW?p6tk|dJrn)C1@Enx3lN5D4V;wikW!R zhYS46vojURi&VV7D-qByK}q+sf8?^De)Ku2t)?r-0%K;+t^n%>Y&!k*n}US=cdCnY zfy3FQ$@}!U^h5n^9UFf}iKCLE_D2FrykrBI)ok?t;?P1@IT^Y%MCp^n2Sk>A1K^>2 znN(T*_2NP4(nt7Mj|7if`hlLVMQap&`C_BwjR9Z}F1-_=!zE#>x_nUi6;6CQAOykAHx{ zV4|%^66ws*e<2x1%H-cG*ZQI#@uPnX)zjk~>bowZ$2tk^@7Q=<$ zJe@X{p#R2SWja~@(H{a9;mrvHe?+1E-BTZ+s5DpI$cjh;N<>ICwwwR{V z+E(ItFV+oKvtZPQo@dlFgpO}$Z5BeMo%H{o{#(&~^55(^ZFf&>@~!_>f%QQQuba{k zBYK)GsJK_0Kq?6|Xk}JID=$u;qh_CHzEK;4=J+jR9eMMhzTRmv_~(@hD;=Ja9FA16 zqmMZly7Caq9XO3?RdH30_WO}lFZRg4V5RegY<)`-Grw`GPcUkI^MPBMDxQhG7HO{7 z)DU|y(pa~HVG*8`iyZ(5jwoF7FBiW!*66!`dq5vPuhhjzmVfb`LY7x12d0{!BsqMC z5Ii$Es>@5B11ub3ngb%xbNmHkRDfm8b{vZ6LH~=EAhtMilSNMrGVeg~6HJlT93Pt0 zy(H4fw9vEzDg7lKeT2dURKz3u$_JXYsdxLE-u<~L`IE}U(BoVT6@=5@QA%c^0PYM9S7wz#IN!EBBlQzO6q zj8>M`Ol#jBt@q%rxm@DAG=5z3s*}T6Au!!jV}yf%@<{~dI7m8QXntpNVoWn$-Qf*w zlL|Vcth&9L9yT>Gckr~1SE*#}wDwn{wV84G^Tj=nN7@roNi590^_nVkNcV=DnoA~T znMbkyCVldvm=CVLev=Pn-gogXabbBI{UJ=6I)zH4{YN;Sn%Ld2LnXl81TAqEEOznK zO^KfbEWJdh9A^1_HwBvF+fw!L8)c4cb{dFK98K4*u;!7B-ldPpqAzY8R)BqS>h7L( zx(iI1P&Ul}pRGWbG5^2SayIcRQBRNaZ@%4;F97JY@Jq8|&J|itPTQvwZz*qzw^T`F z4H0DM6nzvyUgCV}VY+SyH`=`nD}wfNUCeL%K+HDh=X~(nANzRU&M?70ns>RNTt&_w zr+1+!$|dU7-&~iZRxvy{EX8HlvK{!`VR>;k6;SlTH4W{B&57B?G)SafCSNl~%-qiA zy4RzBSEF>1)W~+MCi!nu{@~7C1d!GjFn*q`>Rp@J9MXwLt{A$8L=2nY$R+@pAgUJ$ zs*a|z=2SDLq8hfzrY~ONymETD1y%H4M<^r)8{ux`$oD}0)5FZC(_rqJNITJaaP^ML zHsDI2LOvD#Px*x89P!~k2+;WY_2}ub#{xH5G|DASR#GuZ4ef&~IrIs3vi0T%)Y+J5 zC~d0S6@5*WZ?J^(U}nmH@Eba{A=)SjoELVkkO)iy>t|w|3W;$U^`ri<%@RYEgQ`h) z2!`^q7zFpuM~wzj0`(cH-6Sq-`;|xltlz`9_KSz*FAU|%m2d(RW|lfe-t)|)?4abo zalIN)Su`CIRdfstrtEl>x`|cYV2+nRztj5FY6Ku$qurbMs+R#5)B2;o<2t&+lR1+^ z9-VzU2mAy3h5;7`tI%sPbt)@v4r5PQcI+`*D``Gz<`);b_-79nQ}2O?;l<9jMbaZP)9%^}*WiuOy;+n$%}boYhJYQ>H$@z3 z<_l$h>k5-19GwQjAj+J9^Hu4!s*8LJ0KSCYv?V?CPvGlLM2&o#H7&^61DC1BKkD}g zK(gqxJtpIquSK9gebfN9$XxvA*Y@Assf!p6!uGi=+diI*ifg57X#o1(0rVt~HQGnA z3%v_63%wO;$2oy@w!y#ouc|8`aF&@>gt^rLT>Pq5zFIG7%aUkw0WVApr2}?o+V3S| zUF5{iSA4bcHu(pe zE1c5}TD0=X4_0%TKbQ3!TltjJSOWvQ{yB>xHu-WDXr))Ql=}^q$yOs6c*_0X$|-J` z#2czQtxMh{?F5HtzWQ+W(7SL=zlr`ktNUADo_$Sj`=l}6EkL`bZ{ziG%|K>00 z+y89;_^^aGxNiDj9kXG_T;xP7X$|({;)fQ6{t+03Typ}9gaf@LAE3?iw1B*c^Md_k z+>W?8UaUr-HFZ)ZZK7sU45!1ROYlH&2+SPX-T&V8{fC8`{ozl7sI0n5Y1WwKPT;?~ zFwiX_ey8Q)2X4XnJ3E#ea)+rALGFKX6v?lz&P67DV|aeUz$d(XBK|f9__N1@(>9_f zy5@==$NI4jvpGEB4X>L%+%~zxe~vcLaX~n6*XVp2bscMeEGzpJ@w5lZUH0c5W)E5Z z^;y3(`C1tA&z*m80WF18a4-OKK$=jk=jE{!M$amv$mo?qo(NzQ&Z{m#lmG4L#=1?g_}6a zwlMk_y!p}Qp#|udNj1I5xt{|@`z6P3xwkhdKiDWzh!Ps%FJ#rG7ad*ea_CrBzgJ;; zP>AiH9kvzh&$*pP&H`xJt0DGo;nd|Vdku_sH)y9fX@6IBFQj{p8VKpzb-Z;R|NRZQ z{MY(RFT9I$@iu;y!`ZJ!$K;_IxD>Dyx3V>WF#%U1*0TJG^J=#LsSvVidKzr0V;big zphed-)jb}$If0Mqx{^rjPJX9F9;hr!@7?gwvE=sZUWktIVjmVpM>VwlYjJenrsTzi zf5Mxv%q+ z(PBcXn6tZhtHlj%Jy$o_A-au`sW0HjF)F>SFFUJ$qgS!ntNU;P?oeiHDb*yya?aG{ zGb>Nm-7&K?U@n%)9e*bbdfD$5y6RgE(uDH=#LvW9JY~IFik$*eiv9gq(V?BRThxnB z!R7#c{lhFCAzCLtw@lL-IQZE<2Vjbdjb3ux4WRS94<^s!uN?I} zzRF!wmyZ-%Lp_mE4e@m9Y4CS!UdK}tR#sDDR%xRmc;>NL;rRvosAQ^5ALBsX-W1P- z@=X3FRF&mZHE$hMMTdhYVMGmWyN*teF$!x~=?N&zesi>jK}MlRCM3HtzP&O2sJJ;_ zhG0umd{*gM$x*YXub=uCAAAb*AlF2}S;?7yK_Q&8t6?4eaIi4O+4Tr6!9t|dq&0Ou zE&@JOFDy?jLJrJ6`*+b*M;Uwv^9W!zcE3Vo`l~MhX`>)f z9{rell$BemzdF+KGMSo^vkRMvfaA8k7N8-a7Yr(FXxmdAX`f+zU{6h?U4dc{W$;rS zlt*pc|7X<3S;zEJ8)H9@+Ngv*y;Zk=$uD}Vjo+@7Fq*Eri8Ya4I^*f?99>6!Q>oAN z|MsJM)j9L`qnw8SDl+4hsMi#*Z0>7>N}tx8lC-rO`l3PtP!E% z_;fpKF1={=yYgwBrF!2xsu!J?A2tx3#eJ&$tW{~eJ-Tmwi+k1QKSq7A-u3;fa-jNd zyQeo_|Ncm(Emtq=Ltk;P`WCCc{d(88V!-;U`qUTA);GOxeYZWF&(C7j_v0gb@pIgO z^{u?SH+@Cf`nIz?(yRTda_iG7b;j86n^_(8tA4Vl$3KlHvrqW#%uadyVayP-^Bwkw zzn?#0>}6uhe%s|1SAI&jbQ7VqZ8D(DH5|I5vDwU+OBTH`80vpoCF&U@sCvz+Qb}+8 zsg(dI@XwqL0 zJBc$#IHE!aZ}e!s3smY|XfE)Oy{&QMZo9j;)9JPxcF^VWk}?ZyS>G zpr!Bio9Uf7(k`>5%r9fcoE3S|U6!h3Sd*x0{uNpF7=jth@ewSo7GveiQ&Y@=$%{XQ zL~pf2>ysB$9>KEUB>rDhsy`#VRkJVp^1@3mZY8L@sqzSK)fHcCy?9=EHRe%M<)>8H ze3twUQfzJaTPG8>`5*5OFW}gRPqUS5)Tb46pdr4OOz=@#s(^>e` zTo=EeRn1_ER!(QtVpBc8S}mPr@Ap@>*zX;cwf6f^rDwma=jbfl zIg!fgkr%8mBVbN!lyDLNU0M9UN6uPn1i&SV)prZtUX>HF}RQOz&%( zHgMsFrGlk6lt z^KgYBKk-Y6I`PkI6zrm z$g#X&bl63r86fRB@y{<)`Il5V`+NdU z%w0dYtm?>hQ_J?^Sd{ZC*nzT;PU1)nS$V6kTK5HZC*GT-7UN`lwWtOb_2op@nP0VvfBJ&HQB?Q zDt4^5^ZBM^d*yoClYn)O+8?pF_)l_ArT1%ybyrVazG8y)U9DrUWB&hPnb|OlCN?Ec zr`6YcE1w8#I9yI1*Xwn^F^GVWk<2S^X+CmuV{BL1f(KIFpzZ9h56dDq{aVB$Fh{=2 zf*^rP*ZW*NEN5C%#X4{23tq@}V@D|Q^nhwBC$`Ug5z^nT5iLP-M%az*u4E|pfxI*L zA%@nlh1<|06GXJwfB2086y!#@T-)b%K;!+rIlSNc0tkE+1jNLlkq2%y4cDo|5&oor zgyakafAhj4Bt2CQ?NIh_Q_&NIyX!OVbEsnjT*K}lL__5v`}&%tLiK+v|5O>se|3Pe zgg_&J4eyGiV}vr5uaP!0z%N~^fth8_i?4I`{cL`FTRax|CsVmf-mGf>fH}hPBbT)Q zxwHRifU}QghjxK300d+?bB+fOJM@tDSMPZD@ibb6@I=N|q7w0tedGJ47umsA%lWPy zJ(2cXNSMl+Z^LH42_F<5+EW=&UmC;tOjCL)yBMjXkL`osYJH^ROJr?K)G73!rc3^V z6}Z{Ra6b&Q404r`p{6U<;=U{iiyo6(H1#+RFv^YF7?j&L@9S*$^_1}I4kRK|ZR%~D zc9eZFguEs1>$UFdjg+0+X*k`N_kAeeA@7m@(sxfp-4cFpDCUfS)CP1l;42`>m0#e# zL(^B?r_=vNS(6Wge@^E6zV7?F4SC;>58;bxsU=Vf_$h+n;E&9dKiPeIEg$~7bUVk> zm&i%kWq-|szlHA&#`9(F`|0cRzTfA{yGFBHaDj11mOr=TeU~#{-;F=e7hQynR_E0` z+vz>{JK#%c=zhDHDdpg6 zU!Y9acFhQ%%|cDh0GL){-8x{h=pf}tj{o#M1PP2B%D0}brn(K+9p97~wO&r&3LIH4 zH`Tn{_)tzYPvbgl?0$pj?y0aXwx{^o=hEw_?(E*xNx!CE#D4{{qiUOKwsbaT2n5|N z)JFSkxb{T~kLq1G^`EZb$5Q$H^S!CO;v-6WjzPuO{*6lS>{ImkPg?YnK1FvDee-|f z--zBIjemCmcA&=2BW4Rn9p$yQlb<=CwEQjomoKM0QZTBH_RDX+#-47)mvvkF&Foz| z^}0qKCr{jq>EvnLN6C|k(%;gL(=dDYf%ZM1H71v!W=%pr)foSvDRHnOY83x?;2Dtz zjv3cf^G4$za|HD-jXi4{>;84^%jrjfdEd5v`BR^R=G4Tfn0d z^_sAMX%=bu<8^8w`Fi>0^s4oF3*Y$2^SAa!r3U_uDpiKhh3)i;`0gygeI~bAx$W$+ zg#`9i|5nN2aTOf;y~*FYQaC9<2`^B&JQDR@Y*jJY3Zf_b(f2{YqF?i0pa5^d$#(I9;8#Rto--&mB0%YpAKeN zJzAN-qu%d6WS1gegFQHwn+-qT7v^ln;Y4NZ6yiS~49;gk>4!VM%s1i}Y8zLE%c(8B zB8wce;Zgj#*ef@1Xh0D&6Sm=NB@p-IuEE!hWGRZJsj(P6(ez4zZoTG_K6)rJV7(9@h}VRu5V^{dnw^K~(g-chgWsKe+gdsGUkdXiM?` z?*14>Ui2e8Bw75yj6gPMRvAGCcXtZiFT z%PIfA=1Gv}*ji?Sy&S|Qm$jXAXmmgMS@D4F-0pSnIW_hQ2flL9h2#}7>JglGwfJ8$ z68}xIQm}>HH$Y51rC44~(KX!sC&d_?f zMQc&3jeo?)WS4&Wo$NptNY7uk%PzZYVSl&_0IM|!#b*HFFi7wp?fiFee(mjVkrhKf zS@g{3vKtdCYNq0L+A?aA>IU>S_N;%A(*;J6$b)K8V786lsA*>e9jmOO%mS(anVIS{nGAWGbo&e=Xm8@z_K zoqA|gM_#f$%NnZwG8*axfU-aHW{#(QpJQ!YBfYtaMtU88dZ%A;4o&q*&L@g2)1)P! zZ?Ptzoz^@q*j-g>g9E*w zZgb=t@9QDSHM5)9YE)DRyi9-r+lwO0meM`djp$3Z%b=Czm+sg0<^;eehI7Q7Hn2A) z#?{DMBgz``xvWG-pqNF_d>gjf0 zF+s~TvB|d~(_u{O6<@KAZ>R9%i0z~;zJ3?8{OI2ifPe(e_C==YCx81Jd`XTURc0;r z#FMf(*5eTQ@ei4>s1lm&sviO3oX2hN^k|ytCcdeeMup9UmQYT$SkPdva*V6dKlaI8 zJ^rFASk}9eKRGjfzo8}258`8K>K5iUeKoA<_rn9(Lva_4?O?7mH$u^5(GWd9ujiN@ zmHPHs1jvToBL}OGenBHBVilpaK;sL(j5PjXxV+*Px9kxhb;eJFen=-ym-xGF`GMy^ zqcWxx`%^Ki!Qih?AeW0(JXx|CCj*~ilZRx>vmM=E6_jV=KN=aId#@vw{94c!1L@9U zL}PAzq}Dg8NO0>LPaw#~i=}V2@aXo3c|568&a>YY=6IA_cd@;~ou(N6J&`Q!VH0$`}-}4(I?INb?T4ONZRkG+8eA27AB9lQf@2XwU8Fkyu z8Hr20mj8=!pO08v?j;fLRe&nUPuIt4ba{Qx#^~Smvddf97W`A=)LTJY+zjpnXW6{+RJ6L*^aIeoOGnFi(jl}ANQkPFG5ucCBxaYz2I)u^`I?{k9h z;-S^PEu}Tk-tVcC`?*}TmP2tIy6B?e!pLhqHsd(wb z9up%3S_V_HgvKp$3;OJ3CLSYC5_y=tcmLXH2!=>w1{c@H&#qc3NF{DAb` zAuQh^c0F-bxdz4Rw(IK(I$Mu~_MNzLM0-^}#pM?}if2`tA)ZT%;a@KNXKxfa8yrRZ zDy5N>{waFu%mFB34KYJeNLf}tE&90geRlpDxaRZmFQ(_%xPkLxm@(kXeZDNT%_CZf%#YMwcK`gZFD_+jUH&W1@+FJ@zYK zE##{1!^n+?QcqKIN};@ZH;&+?k-ePwCJeUsT@ z8-F%+8&)sN5RT2Muk%J5&ZDDfDP?OUc^#;-kUor?5)O^N!M!+iMj?0P^DJUu89u{G zibvqAV&pu|R4RNdHu;zT0TK#vsP%6I0qS<=8&KgU?aye&&WcT5rd&}%Cz&3|khEFC z*`@wjR)qUEv|q9TW7#Z{3m|T)p?X%ku+~2! zSxT`S%l!wJ@~2aO68f`@KfSw%f40}Bcj$b~zB(AD!*AlgKQ;R0*HNNJkoF~udgMw++^liCy=002f2W0Gz1d*WecdR8jK1Jih_S5N4 z1D~H_vw=k60JGO%{+bW}o;>*1d>nl3?}?re>|8iH*tu{hI~UBp({2(rr3KeNa`vKE z&NRF{vz5Wk&p&2<{Ymdn{LPvD@AUCM2N4n_B%GnH&;5y?$+WK`eB~vWz?9G7&)$?H z5-p?ZW{ip+Oz5lj7wM32sNlM1qINjFqQF0KfQsib{!h!Ry7&Er*1nU2`k7c34O_1P~+ADevY?dohy6H7i!9mM@pU$AMIJ5IAGO;Vtf7gI(0fn2G{KD+U27jhcX=%@Aq zqxkseZ^cxJmu%-JHu>rAhgGfS-T&F=bE~>rIg>>-UqdMk2eUj&idp}6tuW(wvEOV3 zZQ>6xCEvN4SucKqWYL5_phur7G(*+(VN}}ZRZw~YM~P0ZEcw&TRNe>-OR`{(@JJJO z48@E7!@j>FU)dolJGax=b8rF0-n}pv=iwy5o-z!c^QNLD{)zg_awYp@{15M!W_%{H z8eLsZEDBhUK1C`Bja{lldjAIJxfybgFl^#XldDG+v})oj&sd@XGwHl?f1h_WyFKkR z8YQ@&^{WBztK8nla?G!!f=*Kbo}BfECK+Xbe^UBy~IMx&ka4M0I3 zWH->hf3W-@adx@C!m@MSfmHZ;Sq6yFr8`9UnW}tw$YCdcCl_Yq&-3HhZL!H038-to z(GMqSzvB&ZFgO(bk|ZxN`q*3aGx0e6Fd?qSeOSWiBsYHG-(r59d_wF?3{@0)W~afL z>z>7&7=Blu7p^-a~? zO1Zjc7B2KSQJWLznBRYo^v3m5tBb{}*yQhhSKJ)loETp1e`Yo_CC0?{gRAv1%~rti zFR!pVes`e;eDnXx_`GC{Gbum{E^kt6)~mAW)OZFp+R>AG*ZiH{(CL4h5c<@;{m8K6 z@3t&|Tbzt}qH~_eo`bj?q1g{Rfq6U}EJlA$I60ZZJ7R0h3gPQ?`xufF=Ry;{;Qf0Z zA@+h9chT7-*g;dnwaSOJGLPPI7qyC~OngRHlELveX?_k&E7gnej(;g(47l$C$ACHh z-TNDl*=zt3CFgYVxvo31>^(4W_j;9_sI42;CMNC79Q2JG@ymk(&cD>=^uwjs ztEJ(qU>zZRIr%ets1@0#SlI6CE|l5hs+b=R zV>Uje_Iv{SCC|Rc>ume$b%xs9PEJuP@}IrWM6Q%Ryy6skZ_fG9ieKL3CjVB1qU!R~`w1F`!35HLuN z{;Ek-5MrDh{S==S;o>5rgJj;rN|BF}{k}mh=*kwr-TaV(C;bg2V$-sZDbH48o6Z4d)S|0 zB+?iv^(XGDDuWAI>Be*9y7Dai%8EXvu0N|OIip9HTYM%ywG=)4g>O}$IZ8j17+mU4 zU@-;Fq3u1Ni4QMLoi8mwP4m?9^EF{z?AS~tcL`)TBFvNI!R{vPg6F4fZ~Y zsr{{X4u~{Hv0k>>2L@XI7eEo=izB5Bcaah8MsB1u_~pHgyd2=#S_x-bHPMuK_zQPx z)?l**mjYW_6+grF|FvY0&t;SSe)C@a;1%E7yZAjX&RJJiw-j(~Q|#(_972<{Jgyem z*Vmj%=JhUGpHINKBY-pAdzQ2pt?aOIr>Wp%pUxc7kUW}z6!-Ti0=kr zLjX7uC!6&@T+EYS-6HVL&+89Ty@Jewz|ys1sQK1ep$XscgZ%9W=+tD%xsx!i-dz>A z1G zf7zUr?r#Z)cRN4oHdK%kfxqpa5rG$(8=3n|5jXHa+m&>V%q;tDudL@+L7=tvyP~qn ze($I(*Dw4oM-KGQOA=#98XEm1rI!WiO-bir(4n;azq*uf&LwYo-FZW#wE;sKuM=q8w3>ggVNO>sBdC(Xpyrh1%S+CzyaHFwSDqgZ zD%nWqLEyDu5V!7Bwlu<>S&cAoj(<9QkiZ#H0T|6*MXX{oMZA=QLnL4h0%6Pv5W^s8 z_~U+5-NXvU6=J0!Md>oJh}>e8j+>HjG~sZS6(Gm!-MovedDvIc3mricIrmgRF89=x zN!yfpdNK1=eiE0@&phqmDZ`ep*b8C-TWVj9oe3LYdfje1%uPwh+}K+;K90kQGcftJXjQbIZ3kPTsgN| ze^L|7QxnWr6D;=Ej1rUjZvut3ibfEcNUG&c5X$PBK5nDoX`4T@Lv0M{fNtPa;RQg`ZQ{a`GUVD#n6 z19T^E1*{)`Mscv`_FU4Gm~a>|5MgKU&6%L*4N&{X32R>tA+ACzL*@OIJFM58UM)^| za3bR3zjh72YMeUr-6Ul?bC}SXjxw(Ae1Nqe1r|T&zgZ*-21Z_$6|W8KfQWb zZ=|^ZCyVdrt2KbttHn4l(s6xju2y_!6L+Z?}UuL49CzF`eh{reP10RM_5K@8;0>Z#lGLf2Bfi8I9MS*5d7SJ=h;=g#b>huKJ4 zE)eCah+SYn7LeG65gyXsX6Ry)1QpcUyG(mkzzfx}Qo;U!kB9Ej3aW+pjvr_ZP$ti< zdO+?q#Cfp?I|Z?|VdW3_vD3s?DZjRde~2HOQ`7vdXQ;{`WE>AC?t%8o0!EnB&+|Yn zVX!Ra20?5k_1{RlTO7WlvXs0l`Oh9A_A2@p4+!sk!Gi^5Vh1&D5Q+$@M){g9X9^uQ zVCiux9otphdSGZJFxHyj8?ygq=n&lkF8fAy-e`^JVo-*pXM>mJV28v7r%6aYW#6 zZ0qcbzyM&Z`$z)40RbOufFCmBBZt1}0-rtq)}_HB*~ij&Y`MeMPNcPOZ!MJOv$f4M@kQ* z%5X%J?`m0t0O!!ZA)voAkNzpj)SrUeC_I4KoBsR)1JO_6kp2-1KgaCvo^Ot)B76aS zVRH6)dqv~x6$UGLb6}sO*%yR8WSf!;!LGa0oZO_%#1$2U`;5*iuMPw z*1N*$Qa7kF*H>rJSM7VyU0Xz1izu`1IyDE34WQQuzs#uX)rRM9>HOFyDCY1X6RgQt zZLBYj%?Fgz6?NdZ42iE&221-|XIqx>R^WHk_c0`b30obmpw@E-GC-R9mb*Z%qfpIw zwJX6#t#|R{ET4?PBDa4Kq8`5nQ2%AiHn(m>HM!D0h>^muqB5duWX{z$Z3kd;>hvn zfT0LUu<@&bswx9jWjEgxP|u2wds=A%r`e-wnx34=@RB?SzB#%%ZAmPY=r_k-4yjGm z+EgD`6X~hfi57J92WYdtk;69SF&ymIu`7^2qu)l2fa1o)sK*qu(|UG9{hRpED63pW zPbW0!ZFPO6$G?RpTU6!5{H0f4kBTuK%F$D<=<6prUg`^*&3co{4xB;PKH9c;oYo)f%{1o7g+nlo@wxdw zr*MdRj(u$P->J<$y%^WFcx-{z3ugsJ_P)R|gVp%s&&~lSWnspu0XwH3U=r*yGzG?; zlRq1^e*hhtv%aWbrU{;O$#FCmXfquW+KusTjkrfja%yw!LzQ+8fS_tU@*#uoCC=r} ztaI>+*4=7gqsMqW`2gdJUM3FpeX96dP{q&dsIU(Y$~1?%l;W8=)J4jtK?pqa2|rIe zfdY{=f@Rjwk!q<^@8&h_*s|y%y_5$ZtAmgAdgo)kNU61t4^>v#M>>lAuCRT;E0G`k zU)yU1JU}Cqqi1o1`CnvBwbP%?U;lIZbGH68>CYMZGlf6s*GYOlQGaUq(ngMB{w-`{?yh*cqclPE3~!oTjxzm8X3g-Dwt|N1=n z*XO71@q78#=g|e6fBm!27c8-89-{He*h?>vZeVe1i`}_Ro>m3n*-3KF8{;KMMQnD9 z8*P(cL`;Ml@oq_v&U(cxZ_~3Bg99e!-=!oFWqpYSDBGNTtJNFirqOOw7F%9pjcT4S zGML&{rH~CflL+I}p|W8$mOAGv%qJ$DoX#S{Yin?`u?xkcaRyKkS;H@Jmo zl}V!EmNo0{)jKBO27bYj4pZ{ASqeW1&yt@BED+vi<+A4Crl6c3mZQLnN()qr5Zw{v zDF$!=`{HvQY`uF)wQuqc^M$R#)S>WGe#HfDJIfqc&vyG(xKsDc0{XwZmm#HNV?-hC zkL-@zlHa0n%3gSt3g8a1M^>;52|Rw}sVFKD959nvzZy8jpODBHocN za~Iyi{Z|^cxOZl9V2|CW!NzzbV4FKA14B}Bgw2Wc(poGso7>4htinkxt*A73UY5GD zzm;Yef3OCUO)g_^)(aGjme4qf0L@N$ERo#;`P$^0oclvS9!ElRv(XUcDyk-O} zsLpw+b3XlVkH+Kdc7F2s#Yed!2P=1#|J)xqs#m7LtUa=&03XW=`p(^mRTCJhn(}j-p?>;ZQF8p z+?NyUSy$}r38aPtShTVD)$eFil=_N9%VVYQugiuP_+LY!`emj6`-6-nk&X_^=*ca9DX1k#nZI9q6OruRuvi4nU$xdNAlrREv>A=tw2pPD^FD;(22K7et%en{?v5S zuJl4mQBGptJpW6FI7ad+@pVUy*_UR0aqj_N?HDpi*K!2Of8wBkj~rZR=SQcu56n9; zQ2Yz-zmlKcrMVI$x>7gsc(qbdjc9o3(ddG0ahq1HW z;c*5cadwNBxEghIAPT_$M@bQjH<Xu3m^n>(Y3Co<*o#i&5UpAUtD!vVq4EL zHD%7%%~q~PG!@|w86UKwX$Mne`BI;Kv-pDi_|hZG)mYjvqw#UnjVh;MPh+3ul~1X#+lm*03opSg{#Y%{TuqT#?grz_ZQxAJvLWh|C^t1*$d zQvtAkC1|M$ic?EaRats^KRNy97iRPyy(es6YwSlDl;2NR3)URlJBZp~TOD*XCMVED zi)eGUJleo(gJoEnkR#0>>mI-UJSj3yc%d4JOXLkj3AKZ*XBN}1OIiP~+{s4!+=V_? zjmmmjJFHYDA-n0t>@Y|UB8!9$yMy*P)&GLkWe`o_=UG{^i!Vh`}p z#2&@w_#=%++95gI#MQ{PO-DZ4lsKe0dCXpog~PeJ!_wBtZ4~)6jZmf5?B_afB5KR63~npewuaZvA2g8>+Uu_xv)Q9_jB* z@vQ&7;~7jF<#)zgc6+LsmXzOMaM&)(+Rk9K!RLtH!T_`JWqUDYp=hx69Z_=|Eh=iV z_+2XaplxEk!bbyvBXbQ_-tx;=C3G={BfwJ_EhoucRYO^LIro9fOi zzjiK~rV4+(zh*1G%JucdM+jW9WJW~hG%?rXU%o_7+>*-3BOycllSThsPm#``$Z@X7 zD)y7RBERWV#9yl>O={)<@5tsB%>938B}k+B(@K>dldr{?6|bz+v)ZaDeu=uc;=W<6 z8UF~7Z$-jk)J2des7I}=NRm$bb*&_C%8T~yJUaf<+t3n>49iJWcONGaUCE2@R?ZkJ z{L%yIkAGAKI`(|OkXJn|_IH+%?_C;6=m>&;*l$qM$?+fdAzXEI2?UyEp2k<{2Y87x zW84p>LLp;Gw=>8yoc{kJ!I1Zoj#M+a{BvdFgV?=>SbJrg{RXb6irOrXO$1F&A*nrJ!PnRF)HIsH&wx)J?T zpG@?86X3*6BCV72bue}&G-52ocJ;I#?f)tWOj9N=5jXnR7oy)WcJj%PC@>9pCnFnv z4JWPn$LP-y{OLUoW+zMXgjD;ljO;TkW@k)h|CoMD-HtP;w^5bz?(C}-=z-7%bn)#9 z#}0QCmwfF@6$KW$&dDnyxc!8k{@P7Ei)4THLhwkI*lL)J1D@+icSclF38We{&ajw# z44*LQQzi#RUz-Pj=a=iWhDiG=G1T3Qhz<3xxfaTN5GSSVM^*pe)!!6VRTE$0xzjv= zh{DN$*wGN_uI*Xh(R1BFWIdb|3#IRVUa~mxKC+W>Kazu67s*~`_gf2cT11@KVUTYU zWHwRTbOKuU&C+_g5ct{xvc)EUiDwSjr|_>;_-YmIDLRK#W17?+_Nd!Af)PxyUfnCP)+L@<7)W`Fej&Fr7N_~Ojfl4a`OcJ1?bTZOmX@ix3P zKfc(te>c1j+P~VhzqT?Q5bP)~`P!uw1>wm%HCdj_BH5qK!8x?K7O>1-Q~Q&yXJi2b z&Llz5FvLra)u)b)*B|dC&qH62AFp@a7$R=Y5sx3|yiTiIY{U$AY~wLQCpg*!12K#Pyi!qH1{w7WeNFAMTZ+#;ETqPNH{CSf=^W6A+$DbRs{9#H_^rgQr zT3+;L23U2))p8NbF}}X0%O5TUfKAY>5dkTfj#0945gQ&hvW;)yr#mU#a6ZGv+8-mF z7{+923}zfU9|oo&e+E&^E617tAVH9UfV>TIDNcaM>Cg_pWEQ_Fna=e>42xY8mzEV96QGVzeD9Su{MUSqz8RUMu)p@gEJ>9wp+X;RAeIKu$;@? zVzy|5Kpa7u`q2vYLe>jcuXoblX~t*?I8_mpUKqJ0xQPuevF*kG9QF2pevtetw>jtX z4VX-Z$kI1oq`fp?+qkI9v}eei!eZIM2UZ6(era%XPUsbZE${OC8}VByuZ=MP*(PAg z(dS%1qt$H+ogv3%{2xEmh}JsJ`9G4Qk5WF&EfsSCnF53nc}BmbS2s}l#7yZoXAe+X zUX&LBL{l)L3UM2Myq)WMG#BXjylm_wQUm)><^K&jKjH>8#tqf_Q?EZQ`ZGs=G|hRq z4R}NvE`8Ze5VEGC@huVZyz$!6)f`Odd56DIRf^_q% zuIQNo#zp|%epof! zAvFl3(nIvj116DLs$#RAXI4&Nt+Nlw*T|W|`87a5!}oMDwo()b{Sk`c{} zT2d!3!+&1x{LkOshYHGvf3Soyf2aJuX z;I8?{_ToO6n;n?C$P{g3{ME*#Z{8K5JKm_Nk5fgz<0()@W#FfNS+=Tx9$M4&p7#qO zTee#9$LMtb1H*WG^lR+dB{F7r53sHp&V5LO51@Yh-){Wid>pOVBqvW1%1hS@?uBdG z0Q{*;j^DT(w@uE;fgPN@05{LK&iFS==oWk9ipoINDZ@BvLTLV5Y-39unLC2G@vjjn z3ff?f`h)*yS*U-Qe|MO-w^2EPRtRUi-uU|}wc{)QD8sD8GQRgOuIcaOb*s#a)&KdRZL7S=9aOyVFmYbj zQY1&8d?enh#05j?xWk9Scf9$8d|Ca@i$8lto)=%@Hvav~@!G%KfZ>uw)W5}cKFD@R zWNHuZ-#9lbUqK(IU9o>;;?<2`{)>YOqGz%r@+KYvFCn*@6pm)Y7@Ds_>IAK@yCfPc zR1A^Hiydv4%7cjJK@x29vI99yAU^}hsd*rOJ<2YFWJ{b35sMFr?H-W}_K1%J`{B<4 z%W03J|II@d({l}Mlz4zVJZyZb8-MjrDRc^j7W0rTbO?o5Kj~^cG^FovEfMbiLWs_w z98_St(_#TDboES-lCP5eVT1b!Nb0JA=Rm#WBettNS2{j#C#nrB9gGi?IKM3j^3dX- z$;X5%kdH@B&6ke_g960*k&m~L%0NaA&yas2W>`%el7UdR&j3Cc~M@u~hm z-AN0f!7QIy1zl>fyzOmwLyD)rN(?r*7|a;eoyWpl>{jUSWlFptfsb5JPpN7%Yc3ze%wgUbfFC~R)( z>71MQ+_S&@;J)q&4W<5BI{BjSDEjf|L++F9U$9QDH260Mn2Tivw;6Y~NxPQ3=lGcK zpI%Fb3@?9Sx!GJPUeX#g1k@~cyrex?`Ewxg+Hx!B%0Gy+f3a!X#@6!#&LZw5BYyV( z*n1c7sH&?CIFkzm2%dlh!#!whNd*ibm>@_-5yxxjX9+s3R?QV!yvWgF;Kd*m;+Jx0|0*gJyX$;59l(E=pD zl35090maJ%X@cTEF+2@eH3_=yIm&*``08Q&u9mFWv<~C95PBRdz_BH;E2;&GRm~QP zdDOt1&2=o8_g1!@CwT6L^ONA=v_C#goDP2$kKhEsG=>tx+zcki!x3 zVF6-kwm`bfopemV_z67PHs0+iMB%>%*a^>J=zfMQmZ4eHUP#nDjH8W2%@n~(S8pEp z>{m|-pRL3rs0&VDW$k>kO8psAhl+f*`ER0nGl_4~iI-atp9;p9%f>7IOQiEscu2=C z(H}k;-N%3)rC=%eIi@W5vlaQE;b8M9Y5GK(dN^xv_0JAXKvuJz)u9=Dmm$6C&R(Ux z`lL|$H9UeI3x1JUX+HI)l5d8Esl8C8E@EmQ_GTzw+Cf0S_P0cbk5exohv!4fDlF2Jeu%CMf2vU^Iz!r}sxLY0ON2iiDm9*|5&k^(dqK!?JXF6st`z?K zm^KK-pDp{{dIT!|%x-Sg`TvSPElER1c&zWwY0aP43(RSg33G%$`>WLRnHu5GUMjUW zQ-wc&@+;xb1nJ+Y_)~-n<(GNW(dbSE+%1Ty`19Eae?p+pyePT}vgRG} zJT{-gR+S}RZkC~!My~B#`a2nV3-JiL6n`p>Z>)Ne&ld>1YK^|pD)n-v_N4rDKPbJs zkmeNsI^3TaJO1=jh!!schR14lLb{qjuNEDS8k_vu*8CC0zZZI1@-J-Y8)XxDQ_0N8 zkWKeui!W{QW5SDNcmyX{{sET8n>JRx%jdfY_l{PnmorsHt@{D?KkY(ViM}8A&b9)e zM45;b_rmGpl;$C;|830wmXIC8(fV*F#ltc4|D!_am3TzY|0?xoOl>j$t2dMQM$P{< zLg~wBj%g)lZPA4I1-KbOD0{m2=cklE)5o=>pLoQYN$An3<}0$Dz$>C z5ehC)sijO63jT71P;gqo_om?U-&$Rznu-~jW;B{X0%x2bqvjWpzY%c@cI`oXJjCp@ z2)lO05##E##@|Rcx8V`I8bh)ZgSw~vR;515RM=MS`Q=wCc_ovjpHJQ|{aipx&v)fi z^WTWW*J7N0m-!`j{R!FZyv!TO1{>s)OAda$k(+h^%bV7`QKo_ zIzKhGExxqp|A>4&_H}fRP9a}o$Cp^!tWLmlDbAdi+F=PwJcXWE`lUVp zg{M4QTN}XMdZK%aGkVm&EK5gP`9m_CD)5Ms8sk)|o2e10QJ_+*8JXT{qXRw zrKgYJ5!KVFD)knoMtXXaN}a+~>FMpil%9^wJ7rH#v3?LEgK{oef=H8X^;t{};#?Ad zH7v4z;-OuOzLUxF#T12@zLgb#HXKSA%NFL^s|*bAkc0lAtYI|Fhb;^=jS-kUr6r-N zLffFg6rF5WSlbS5DtiO$Ijml-(aeq*@*FTX+xAi0Qs!JKWBUp`EOCrEpmQgcn!?me zY-!v%Nu{=9s#tTn;Ra|(tYP>x))i0i@I;gw>fxYUeDcQbQu`8m)mLv8viR{qzQOfh8500=_<7c9yLL(TVHZPke=rlQr1qsMumvUkEI+`F zS``A3TZHfk8N&_BSHw#YI}kWu1unuyRlb?Kjr_D5+o+Q=^Ko(#rcP^j9OEnCMrpT^ z_EsYgGg_yUroj-R{0DWzO2Tiu9Y=5kIMqCVsZjjbD0Up7C4?#MEol2UD83QfQv?>& z$2J;o4E`?L+Z-FRtBsw%{Msf|E-uTj!JDwmVq_Zo z(aVheK(to46=B;~z^;BwIa%6(h7sAK41I0vymnc;3@h6RFoF9#JY@GLk3L&v@KM?M zDT$Hv=4HSY{OGcYFxjJrdqSgR?(^~a@FV!*nB1)LqK+MJwTExL$Hq-RIz%WeTk)Ng zzjYV@BWXf+_}%P(Rynq2Nxhvr97q9u;Mm%^!^rPUDf7aC4B&VQ^q5P7Cqsc-#K+tk zbvfbl>C}pp9b8sA_IvZ|0-T)_TY1b1$a-JMky%91h%t(TSCnJ(W&L>UaU}+dELp~v zP)g^A8~iO99i=gGienFUiOda8szMNjOoKecFs3I;Oxyf%y7q0`I$evGp<4`(MNP`Q z?G!NCmUDXJN&%2j3SbS<3dZxl6O2l}{SK{Kkmg~wjG8FLkOLJI@r#KEj03SBD{Gr= zKfdjL5py%~h?*~lsMMiMjm(!9snmf?mHBd{k3%Z$+}yB$YpEIJwY?~gnlG;lD0;M9 z8%E8S=K}mz)ZzVjrCf@Xa47;WBv->a^cCTc>(ry351EObQ?w-KBz?5wU??=VD;*04 zpvDjb>Vi44#Ud#F2H7kUW`q{?OI2DDiwvO0Q+7CG8?Z5n^qJe=q78i6>PpUGK=$b$ zp=qC7%F|q6UzcG{FfB9$H`>)H`rZwZWYv*DHqH?vh}eI*Eq^s7mNJX*9pZ5VG`KJ3 zBRRKE7D(kChk0uNNvDJY46si&HL3ka*sTPwi1(Z26-=+w0 z4P>I2`QpA-EK2-;C;!sc^skDd|5&>}X9%Z7&N38Djd+TiFZ>;TeJh+MvRAPS>ID@-X0)y({}A_#$9w1Ej>22#6zjhA z@i2KrE*h7+Ha=4qjVI!w@x(HBRs*j)zle-hL}3iI^`M-fMPmcl*!q94F}}qJ#oG%HN?dUr!i4b<1`9e;s)n`aR6u~PF-zB9H!s}3;`K+ z|NC}@i3C?@otvAYxUgnB3e1B{!$~K5UedF62I0e+5X#m=TXDt*-oxs)`XEK{Oq)mU zxdp(d2=FLOnTiAdYN86(yN#5dxSpm|o3l{FLv;Lyfum2M%Ki%xg1%F$!0Dj(Q!(`rNr&XTKcG z;QiT~=b*Y`RCh@#fw!5`{0JMDGjRS553~E;;~{e!zSU6jCr88rSwBOqM;`o$9kmsA zC2MFMlQ}GK$tir`lzi_Pk?$BPSo&$JcXAT1KbcxnzKG{iWrrM(RkL~rOP4KcJ5WLsl3AS2j;%pSM zqfA2RHR=qc-vUH2A^l+EY3{Hv9fPYUqPsL9uFC9d*tJ58-V1`bIE76DNJIcANl|_e zvY>0GUsFGv8cc!cOXGa6A}SGn^X7ZQVaW z`DvZcUTh<|`~a0NGUK!IB!>a%#c;lRduK}AYmh*3<^{=QJ`My#3LK;PsE->%Z*np7mzj=HFfh z8PF&8b^U(4+b-`6NDM46v2!~Mthxc5ZwMa*^ zFH`=w;enSI1oM|>&XiM^@(L{vIc)v|r&uV6XM#MCA+@Bg?D%eg+%O;JTO|^@*~~HR zXKMT&!$~g6j=?NmBy3^c#{9BJ2=i^veso|LH$BS%2uq+c)GzvnxwaQxhmUQ?jvn&Y zO&_)*Y2d1ePXO1qMbOjK6gVA5A8QIs=X3!Q3SA&d4oZ)fi-WQ`V>DkvRIa|-Kf7JQ z;B|V_ULZYHpLMA08b_R-^_5=R@yNcn-+1xK2Z#oF+ld1G305;}dn$LuvbM1S;gwqd zGWDmjLIJcQi`=mto~kM^4J482K~NX2!_>TBF&LuiGtVAWjq?kWGOqx6+lnnaLVvAf z)?L#F=TAl0_>#;kNc^j(4-h}RHCGZa9Ff3AeWSS#hio~;2yB?qO}@mnUueZnVr#%J zMrS8&Dc6c_V{ChOZvC7~?UQaeZTULPg`BtMPJtxo@;6cW=*fXdN1aSIN6lU0o?u5@v2vjn=3*?! zSA-lG1<&CYFWs0J58*Wj($KDNhpo8WO;|b-7KSlVuV+ZV$t0-fS-^pMZnNqkeo@s$ zZB&(ss$_k-_AjTd?g>?0`We95btAxGpq^z`J+i(y zMgQ_qm-KJe+7TcSH4i=mgkRhM2>qw3kyavgO1nDgk`ik8 z>PVnFH|awB)GBwY3|i%Od{O(Gc-IB*;D2e{*pa;0>va{jWOxPI!u;Ngt%2*wa;{n# zf9|`d!P_?#!!I>?>YagqpfZ#`ho!T~$sA3uLqKrkj3UJE{3%igyUq+$Z^S?qW;2UH z*Vt|7xJN@@bN95VCA04S#Q>}_QrqDmqzkvbn@h4#0r+3Wj6~;oNsR#n=z-}}nZAPK z$#)zwY)e_K>^8qr0eXHvnWv3*m?H=vt~Uf*qV3i)kL}t1} zoDi&`!-Gu#Q-&uLf(U3=K^4eY+)vJL<6?0Gk$wSZ*tWMO1HWJ-wFW6bw5Oc|*8`tR z|5x#pzhOiE$Pi{UxS$=uuDpSpt3iYw5-<|Tf1R0cWad}`{&dn<5)e~b4fA)gD__C< zKS6#@XsDLP5zJtd(`Aa{jDpqQe(Z9#R6)#t>|!G^%3WY8WnQ_*Mli)_lZP87gu?O$G%x>Y=jms!IPMxBo+o(-}w#qbK(~ zLC+INJB=a7eDIxCD5A<>>A!D9rgYo1Ay1|MRsi*ueFOThEDmI;6$!zm+nXRXLK75f zY>w?T1woS3-HrCfA?Xre|ViFY#vn@ zm=w53v-U$c&dOL2I3gW5A+ZsjoqqyP(Qg7v@y)70%1SM&pk0w&fm5t2=B%HfgsATd zq@UjpkZ_hh&Rp@{VVFHf8dxl&FCmR?Fl!EF59|5WcrfpVf$th{kx7 zheLyn!j?!wp{t=@J=XD2z+f_;s2f?BQ9%RA&x*+}7E}kV-^;AuldX!`3rcN9U9}qu z$Y2L^sn%ao(1Ho27pSxdm64a8z|-S@*NUcDEU8atJ|fS*$UPOjZACyqUj+o$c}Lb3KlvWg)0SK*-gRAz!n*0E2T4TBe5sPB0E^) z$*rG_i}h4?&WM#N$RePf&stHTblks5&4|kpMTlWWGUfcRs?dcCK zQ>7JH>>JVPhLK4o59;DKigSY1DTof~4Dd)ivqHhY1t9w)bm6he^DyQKuSq!3lFkBv zdk}DpKu#(1J$ZUtG_P) zZW}BHJ9$DH`$XMEr#lr~RtE3zCca-Q^(h;A%wJJZe zh1R=rKcptNT(~KCJ9|&Qa!0O|yJ|f2sE;1!Bw)4Dg6G;IFMDn?5NVr@-!A%c;IxCn z&xZU?p&J9u2s=wK5jL2YI|Elo*pD#H^rir=dd53hgdb$B{yH|uY;I5yJvOArq4hIr ztj;Jd49;$&GxvGWnKbE4?BEU82~@}^u*l!C6XZx4PZT4#NKcIwB9H{wkbiDy5XBWC zh4}^p5f_2G@#){@_OJ8!HwGSz!aEx!wuASv=L1lt4Uik$0Qr{REBvcGEkXZoAiMl^ zZGe0Q)nhDbEzCm*JWn_x6aZ(yrOCFQ&~NC2&k>?pp$)^u-T4R_4N3Hhk`D;xx}vx!)M1;(o0nx`U4 zjYWF&nw9F%2RLcu;k)^-AelzVlmDx9qBbOah02B301z7tTu*}yS{Hn_DWpguzI8Qy z?sn{t6;>u+Dq*!B`W2+rlTiYI^@;#!OIB^w!JxBvFz&zPDZ6QG?^y$1@r1&(C99Oq z;>r3aR)uc=evkj3frp|XWE}$GB8rHNC^AP)5t)Eg>_cmLybOI(`C5u8Tdz31xN`Xc zib&RIXd$L9iV{IXQkdLlWl&B3w;hO{=K|;9G^>4o zLU}V!_jzZ!j6x3YPIHIrhKk5%TZt1HBdfF9U;lD9P$BRfj#_T0%-oId*=ul4EH2QH z#*x-}lNTnj+-=&Dzw;)*2(PtCU6KPUQ2`W+cs6(k8|3-R=1%hcH zrDrmeDt&iM>2rA~4X_iDoC*VlrkIJ9p(>ni9-kijwDvm*y@l$L?!K00N zxqa}fOxJ__haDU@#sYxkE0<%tYukIS`u*|ajBeMu_&@7yDeG%)H+QJpn3P!rgU(3& zzb_H0)rpc$PDQ&9A*`{NGbj6H5>DiIMCnLnzI0-zd~?`TKO@Zsxs(roV< z3jv$_>;Id8O-_xJkXY~v(Q`z5OkYwd3Tn+pBU|L1Hs z1^yV&$zD|uZC_&0_8T}coAF#ih6 zS6zh{+`PehL#C!b|4IFYS0f2})@CT+*FuoTb77Lz2)*HDNa8rRmM^vqDsACe_o;W! zI{xy4r0-EcDI~H{Y37{$rrzG)f>a;A2BQb=4`UeHv#U$o&Zf$nQ%RWn|BhBbm`b#T zpIkqdH+PjcuPFJG#vfI5nz!iZJCdR;7tcp*JacgrF|CMS6N!QiF5u1Hg$|6uSg+*i zwX-2(WFvbInJZ#w!Jc-HLWB>=lXum6H;|W@T2e*Dm(44s17TfJ=eHGYm3jVtb zVx8=Wpj1{Q-xcnME(6>{erULh@A`h&j3ZQ!@)+3W?-^-yTPM*g#}8XB=?KGH=_dX$dk}j^1-JmljJcY6At}C1@3|2^13( zDC0ZXHjnJu3-K;J_0h}VV)5?BS@;6meyy>HbRFbyKf3Ar?xu2 zKwEWf{0yf*zfWAjvPpg5)x9yiiNQH15SFr)A0vF-m)NB@_v6E9jLp7cS!K6h5lFzz z-r5a&{QF_Fnw!Ig@?@lYjN3y|-nO#ok^q|=Tx}D}ScsWiS?jS7?l$`m!DP572QI>n zuUU?U5FZGiZew6i+&Zu9h8qR5YP9IK-EbmXOC=P1Mq$(K4~oh`m*eM$1DE4?>fN*!+c`#IX6#f?+lf9{Qo!Jn&OeZOe9>J@UK#{B*og2$Y_YH<-!h zjsI1=fp{RepAoGn{n&RDL%)dRG48?LH;3SPtA_qp82Tx+Md?OmCOy!BmJc$3mSldH z(SOzcFk0UFifH-otamY^|DWu$k|EKfpC|crLyi6@4UfDvAc|dM2Y+ZN81}c7-)-<0 z0|)jPjL0Qby;vKfH9ZXe0+?%7-4#E>pV%XR*_}P&!*EA*EAV%q8a5g8a3co(SNL!m zd9V&)@S!mXfJ9jsTOC%`V0!_J#l_rgj!I_5-eZ&u2)o-W8Q{vQld=C)u#=026t)F^ zOcGb1Ir!f#z(dF30$1*vYW&xc)&wDH;09&G$RI~TO#9s2**Ev?Oc&Pto;Ox|DZkoIV!^>w`~6Z2S!qo#&QF&Hx$}^0EFE0 zCR!49|D7;X8|=POURYNc8hyU(6T|M4KMS+_r(gU~>>ijv;{9`Lgje!_L-I-kfjd2~ zFzff^6qR`#TDm7KfSn`8BQ5ra8|Md}u+CpWYqb3P zcCoA2y+0^V>lmytj{E8v^Lo)p{yg5;M)FiU0SDy4bM&`^&tCk+9pcskA8}^wV!~^^ zphhIMike~K>xTIAd1 z$LTv(q*eSCzqtN&mLEM4f;R1O8{^~MxD0F*z9is_Rxu7L4$jwX)s~LJw|s4NO7;w7 z|MGQjI$(2W$4mLLqp#xl${MOe!SPB}3ts7(hJeBOnL6adW#5pKZE#KvIQ1HW$YVwp z4&}TSJhcMcVaW%U+`z{9CGGGz#arkK)j|HzBOV47>~pQRZEdp#L5w7VCW4iGAj=)8 zd>0SKg~3s@a&E{^4NXCPZB*8qm91X%-770t=1vU-&I8xGjL8o1U*)|sHgNwMi280r zeSm}8b>}1CDqWFwm=AsqM3uim*1UOr!Ls~rAzUqN1Mczf@$ivtES3psWd$lkqF`BRTF7HeC(wy;PTw94kS3;zeggDqKG{GuBxMNuuD`OB=k&cOr3Djo7R;z^!pl;6sE+Z@8p zI~*=5robtT@|~2^n5onSH~`Uo^U7pCg)7`RbA<888Y$ycjSXU0C7$b$Zl3o~ECpMf zKl(UJoj+QzK)GWKq6nX?R->Q2A^FAr7VW?B9LktiM;Dl>3anBE=%^DTR4EfT_ z%07uogTOy)I~~i&E5$IPk}_eJvhZ2LPVQNo=}iWQ9`dOk{6d=a~EI z=-j&1f8^$^s}v51INzInC9T5_BQ>vG5QnnAXyBThC;4!=Yye0STmJ;szyDqZ&5aN? z2|q@$waAlg)q0`2lc33tuc}+z-b{hHQk?=&^3Ob0 zP0)E40}k;b>i-(JAn|XpuDR>w{$f_^4OjcOSQ(}K|H+G1A3#*bD>9Ov%(eBSN9uVU zH$%h%+Cp;{YUj^v{>(9(AtrJ5!RWjfXE$+#^LCWugp~v5Hs;7SYXM?qoNx4s;~CIY z+LOU^g6HYg$z0#xR7d!c;_{#C^5eQ8e=6{ir}~&&W3K&!MVeE`_nYgrV9y~~I%$m# zr0vb=fFYmT=)ICOFOp>QP8_WuX^Zrx4=KOQUfe53u?)T+Ko*gHp#p?qqkMYbj*Egx z9=-hYec-`;xL*y@1ek5XSZ0b1E{`&#MmQ+|W@ux2Q1K}geSHVeJTQui5gdsJ4egt- z&BIRv<%ltZu;D-s;+n}laq=w!g<11VG#3Y-CZ&ac&b9f|{P(k{$QNce^zSCSQ1Go- z&QQM;e{grd4IC@9^5|*RVJ^VqUZ!jW<84N;b#w0vthsv7UIP0f|ytADclTVNYBAAAb?}|ZP6d200*4+j+rw~H@bCzzjQy{ zxTL54I=Cey8cc4}oSyocvc)gF12>O2-GMW)xZ<}w1MkNKyW_rBdK}j8>#KLzii*B~ zE{#|!yakxY*5HlwSUnJsr#-$QFJ~)`t@{g;5q7+4_aYp9V;lHe%o>B|=whZt8)f`$ z$5p|Rj6LzXQ3$^r_~X1(z4wBzd;aB96}_Pgj`O}SGCq#Sd5wD#d|MM_vv}6wsk;Zp z`J0@z4}~6I<%WYj_2JFXOUl>xNJ@xv`gb|&%~Wmm7U!CIzg!n^YtL=M zl^7Xr$0mK-yLx@#BHnmh|3!xGI8?(wgr*n@gydwq76L>PWBj+{A07dERdY|)Kz3BFC}!l7IBS(~H_ zZ?@_J00Tr@Bk(wJdzVvq-}&-gfX}0OHbYIVb2~P;UbX>p8Hqz(O$eJ&&t;Ze5lNWg zw)yLNZPg~dX&uv5muKpW&fY+Uco9EY$vWd~g09E7jEflxLCnh+Fjl+95 zFkEsNa;OWW;jg|C?=*xj@Nb020ZyHlQ%RJ;Ck%L=4%F8N`spu6F&oa;GfTGqa$JXB zEJI{{Ah&l%sMU#xH>~u(gC$q6A;`MoBF0BZ*K;QqF7ArY$%_z{;Afba-UZtR` z;3Q5}+oCGOJ5c9cq+D`WZ;X<~pdU`^sf&$cM6CI@Ct3}$0Oy}J5Mw1N{Cs<6{LJ~f zC4Q#D&!3WHfJ7je1N>~4@%dT=KZgWAlt-^c;io$`K0ZOjUgF1{TUUbZRCL;1omT{- zT?s}d@N=%Z<7V6lTe03ie1j&(qN_h2fbt2tjLzqpOg z2jd{7qVP7VCyunib`EF7wh?%j_}RzEsKC3YL!itblf$wflOl`*H;v_X8}BmAG%H&p;6~;T2n$n!Ci49zX>j zXhleA8NET6s45&G+KkBs0qc%3Qo|hYhOzzTkiVxQ#RN*`blEVr?=NcmqJG?>JX-j( z{Ak`4THKuTbz=?|uA`5h>;xyxrjm9u8pifn_mA2>$SbZ3!E;ddE-CvOyp!Uvfd@?E zfL`EDOlo+SE$?n#&qjyTy@o4m5%Cf6A6>Y|oHijIC)f;3bXa&DHJ@<&6N!z(=m!aI zqZ@+vbbHX9wGE5ulJ=r@<0inWO?ld{8<=z+3`HRvne3V96e1)%g~mdfCP%twdpI*mXq8#VB^LVi>T|}bYntD&wW!{ zvIUtpiM^pN19{D7*PIL$7?Z=D zVN3ou(HYvzhq3=HJ7ZbQ-G=InCuC9eB`}`8r2zMU#C(Xqh#9(5aGZQAK^w3O- z(!PKS!%eO$bAn)4Q1k!>!SzRl|4?oa@z9zlcseS~6COn2$!(bZDnxVDVGR110)kFB8eayc{2>YHZ_u#^txsw{j zrPhoHh%!OZ%%|O1d(nU1&JFV*h!H28>co`Aw4NU07PJ8Q_L;V%9&gcg=Q4NCQ1D?K z$_hTnJYcnAuv(M0g#I_gnDFWb#Kg#$w~zxDlhHw*D<6++TjzErJ7)vafi#FDbMNYt zp?rjB%3n6AufiyFpOYM9xRG=)2SRI{wj5_Te{^Kt%fU{l6xP?kt1!Qre$;E>75eW2 z{4(eA;~sp}v=l&U{^*7NTQV?}iwRk1WJIkP!0=qo5~KgR_Qpq_xVRQ(C}1>zqX)gY z%AIvcg3CZt@_$f{z24B6d?T^bj2dV85xyur2Umm|DV+>|+=%IK1T*sSy#PP(s-UXQ zsXex?0LwWj7MtB!oAWUg%l84Lb^5eT)catC&d?26!|X8s#262lvon-lIbKa+T#(_! zP-1xgMt8i@5#^CC!YOZAMI+BjA8+N2 ztU)3=u^IoHR&%wisRRETJ>SUua(x)Lm>)-Dk+m<#$#|ppqMGW?&7WuB7EIi2EsHcG zX+M5rtMLv*+2{Ik_X*WZh6Rd|H0#$W9D&Qc_Yn(_;DarxYpsv^SnVg9cTvNEN{%29 z7~H6ZYjm#j%wgeLVk%MmF%YuYs$(*_qS(xoiu82ws#f`L&`Pf^gnG2SWT;*}zmT@a zVi}*V+@qzq;Hh{r0=X>gh3kU#Y6MxRzB&~Khbw3qKoBR%jq)5CC4Jo0g#$df9T#^4 zgJF^QIvV2N;=u3N3SccX8^Eq4PoZ9Y4b-v5Irrg9Dm3{dcQs;OR8L7w#@X;xEVS>< zjw|WluD)S_r@B|Lql?-z{}$6knwl=k#5P^@ZB$<7_J5!t!V1ZIq>~Eyipy5Q8T8jw z`Osp_ohqx@^Ch64kX`3{6)4eQsFQm$2vV>Y`Lv{l`geQNVrtDbT}^0;dE1*zk!yLE@bIRAolckX`gbRZJfk8HAJ@77Oizd339KvmV1wLkb7vq0VrvKRn}mBWJEp?~2_1f7C^%Fu zCq{lCB^CE&CFr3#jJt(hX?p-Nf#`G7D|dTM-aW;YGa@NfZ6|S}EAxJa zKp9`47)+r|;KP%waZ-LDnLG*;H}{EY3LhX(9NWgzyb}2oee)`DyYTzi`6IRpS>TAU z`9@quD)ZlNC~MG+w93_z36Z9#DV8LaT{h5*8*`-)4yL@K8i?jkHLKAGE>)JlL6A7y z)$t$F2&}M+*S2BX0gV8XOQn&=GV25gE7}V$8!O8l=o{YA z5nl6RzzX=R80s)LW2?-nqgvG|jckW1%OG@y=lTk<8}Snz@Mx?uh& zYaUqAAD@?5x0I@TtQeiXfYXHCDdXoDgzt%N-aN+lkppWitO{YefhMo648@mw5h-SQ zW*HidO*J2ajfA*Yy9d^l%^=zyWaYtAQ=TuWom1AT8)|nmUrQZ|x`yC68zQaCJ@`nS z%_YP=Dn4mJ<#w%d1H`9?g7Q^-ahBx_)T(%#z$JIAzpFRF9&mJwZ?6OE=w!3w_ku-r z=evL-ko318sZt(e%Y_}IR#@a-P2&ZN6Y?3sW}CcHZ4AOpdjw(KmZj{_ROSRsW`l) zrkgMDq!)F`Tdd=Lj_JW@*5EFbTrx4yqh(^w}NAkn?=tvN7hz; zl}dBL#j*l}LQ+Q&p}Dac3$bU{;F3cHM?J6rQYK=aQ)~^D5NSK;yTY+Xhn_gJfwV92 z|9!gCFdg5IyQ^=7EjagIrFV+_a^=2J3jMhol*9)GP30Tnsy@Pk%M=$eIJ>`NjpHz@ z=kB0U2FlJ5-FRKf7?+^2FUM5e-Z5V?MgV(r#q_Aa_8RBkWJ00_XVc`-@fp*_M7XfK}yiqUcHf%9EdE zIipJ2W2wuDe8{F?n(78jvN(x?84LzzS`^?^aQ`CY&{lOz_BD%JgVVw51<BOFxbmkwh?Tz|3VVK=M%>&39pRxs7Wa zp8nfhMv4Pt1%^D4qY9GNu$im>jEVK{_)t(TDs2P846};`VMYrG^Np+DhD$>HT*QTK zM3BvSYXE7&!mh0wBAmF|xM{aue+&i=0NpK}^1#0>3O?-kv{{&!Lq}%|Q`Fogj`3j? zz!j|@N9`Z)!`vf8EI;rFs1P3NAmu&Us?@UPi@behhUT(A8oU0lxtY)y>{r%22p4yU z0PqKvsol5Fp*s#DU5t{;N;3O_GrStQzTL8ZsCinfiE4kE_b`Sz1Y^M7XTzYv)~ROD z7>cRTP<3pDS*e&(#UsU(m3Vu@GcJRDudk78r$%PEusB z6(`s;tqzJK?9taYM$Ye2G%YHRfQ+~-vb4mGXG&D+6@+f-qntsrwlJ<@n2c^CC0#l9 zU@^aa;W?2)xZk6byiv$NXzhEgFebF*jdPaej`SA5Pb7A3bvrh@d`BGKb4YSnkcMmz z$hiqn90~=OPS#dEcOdha3BEzIwo_%m{I6>T2qp}#x_Y%OYvUJCA;MUF492OO3ex|n zke<@T_BXo55xkuEE~YX&nG;Ue0}AEE_C~v4ow8ywCy_kc^N2uV;0}PVQ6uyV-?0w! zE{0)b46Qt#X`3csW$H0pHvVzG^D^!J+0gL9oef@Z;XkynQzTKL|2$6X2*MHC$T0a$ zyCi%=|9YG{QznMqP;(Y`4wnM{RqS%XB1{VN-FGyMay#mvEtHHa8#%Iu=)VDyW0zGK zyh9u?l>#hBNd{$`U>x7nUa%~zv(@TZsH1b>`WzPP0?VTPvVey#~L!Ao*FGS^=6WKg{0o3{fc^+^;J*8)RVU0IuA@$T-A5Y>r_Sh93$2<(O&!~S1%`He^tLL&&L{5XJ* zsM!wtzv7!87LEsGR*S5VxW1SfUSIqYL3%6^nMxf7+E50c#w0OYM}oelyA51rf%DXn z7=T!+@75|Mgd6lWE=M56GMr_{ul8Q)Hl~F<{!ejo(p7(ajMMiCcx;c%zuez1=|Qhp z6GUW#6qsPF!-4&<=3~%qLPrk=4E#V{9`D#T>k>BsirvE!)9jM~9rB`UrMe`wK8_J& z_lpU^VNj-{I;O+~Jkqc)x)ovz@ooxmajty}3C{)~)gB@&NR5cx(h==8rK9{m=cs}B2k5%db`Ga|*`4@>cP z-NwLVCB-2`Vhh9 z%)$q^=$Qu*^M#uLw~+qJ2tMgyaq<}($CfzV?V=i|)PyFi8mG*AH_Rq&jF>YpmN^vn zrO27JeRLr-cp?A;D8gO$I&ftKxNDc-{UupZz*Eq??^DHKl5R5?=XB{9mkbufC(D<+K~?PE&?gWv?K>e zk)+*EVGVp+eXR-JVk--ayG4?NZu^X{C~a4Y*6?q*fJRASMUKdj4+%M}dc$g)MUF`% z#{@+V{nTVAfnOUP$)Kb`Z%{FmiTue!AVljV3J-vUM8~i1DK_L<7Rnv;1#-vI%%Bdx zlv#!p_@FY*&*N|+{XQhF!NTk)oQs9V+~tl8x%O`3UPn!E5{bMKZ|L;*2%ct#j}(!a zDC3+GT@e|5r`I2|g(*EbLg|An0U4qf8177H5cwE^zM~!H4IO8|K-FUODfthgx6|&w zUJ+d(E`SROVMfHh672WTqebDiUhU*7C>V(7@^3|^_pM1cn%vNh(PwF2E}Cmm39iTu z$tXoWAyoj*zq9w33s|81Z*G>q><0#X1|stCOgQCEZl zaQnA~-X3Y>C9$Yb=vD1eG>~+ApgoUFrx1EnDrnO=v(O7qsMEtZhx&02epmzT@M2hc z$-_eq1OI_tZS@QUUZgSoamOkw-M0r-_t3&T{-|F92^WACwTpjGCm zZ}D2yPx#Hau7jAOo5#pzrX7=k8x2iCtj@b*r3k00<^*@vd-y4_8Q_|R3t99#cH$n5 zzcUn*3kf{T8nqYtma8djkKMd&#xv(QH@Nc9(H2ETglral9P{xt+W=!MKKA z1^BgD%~toqs52E_O|)@AwVJg}j9qK9rmR@^?SLsObnUra`fIg)tAf|m_D#|qUjs8@ zfP7tU{K1Ew`{7y|qhH6w2nW9_KGdt$d$B+OS&oich#mMtFoIldBs$z#8`onK0ZSZv zebb=bU%^7YWAR>>{<7UB{K9rbw+a8PNMk!+W@F-)fyQ>atKRdrf4L8mfS-0Eh4uC%gT6>ea?2?R}%;6gX~N2e(}S;LhX;;fUsoN`gJ4a4yNo~^2B|e*7Fg0LK~AO z)Mz{r{p)!=fWlDX!V5q;>ory<%+5b6i=r7k0j>iwB4)xwhW+t1AT73HnoU%Lo5M8H zs<;*{A35p9Su_~->PCYXKhe;;vL$Cn!O7;MaAEcK}(}x^?zR%zy z2$!aH2MGWxrt%{B03ge)Nkyw-pYR<`_1>VZ>R!3s+g{m_(#x8MdONJ4o<;jnS@SS& zKRMsVU7$Lo#?0;+;NdBHb)Pvs;5AU)xdaakr1Cd5q7@Lay3dX3#Z9eVIMs_QVqcI& z{4lq^^cI_fR|jy?PBWh34|JNHsS&0=1D$ZlUTZu<>e_=P%?%yH6S~tt`Ha7sihiQ((n0MyV*%m2W zmRVobdZC*ni(092)G-I0PK?Ff*acw`$07LSEbMn$E)9CvfDkgs>c zgR>*i@F`^4OhoMLAsh~P|BhO0Q&Q$v((+6g+s@VAZemQ;>&k7`Djvj?<%UK}no?iN zg1oj3Y_9&tJ&yOqgV#{N9 z5av_`rL}$`tb5^V{@=q2BFOmgtxJT`(-?uN@l2xt1bkZh?aF;itGG^}_=`0P-ttH! zH_<8kzvXcpz`(Ev1taxFql@C1!!o+*GcXWv@p&+|{Wqa^&>W*i;rD9an#b6Foxt(5 z3|_APa^F~Z;c0mpBTj5K+%#sVJh=^8#pPBYQ{kR0II6xPc2~=?;_2Vuax{3d-r!{k zloG^aGN1UZ5ToR(%l`&VO1to?OvRT*@UUAYBMj-xt<1>W$_5Lj^6e1hOw0-c~AqXK?Xv^+YcLa^#}8ut2ovE60NbIFbn$fDZ+&|n6dvTLLovw7 ze9SfHb(Og$9gpa_rn=9`F7hITNAwGSVt00l6yqrnoD2j5vqc_gF*+vT3xszLUPn)* z{7r*wHlF;0_|);$!HotrmGTXFFb~huPNl4h6lF#ZDi#cDh1&8N&@FgeseW%#^%(6< zeHuDknhZ5qNh5B0c-8niHB7W1h%yT`LSY-pb1C- z3nam|#f$g`$C)_o*ZIjXG^^~^{>}fZpmc|zWc=RadE_CI3H2Q*HRA2OJq`)`%%rV)Q)CJhHr z;BgoQL4MOkKQwpGI~*#|t`FVnuD;~LBV6;LjSTqdhf2DN+REy1RIGF0Q+j7{lu85E z{Uxv<)tRgR$}xtEVFbjNgtcL~=#B-_+VvSwL@Qlz+taH@bvKtU1VG&{oi&o3djv zQV`N%i8X7BArW3Qz8B!J)EXh4U^%zcGCHlaSmsmw|7@umLoc>HgFW zdC74z8W8$6&e|hduAInhUc%5TMkgTo|8X4UQwQKcC9o@!+7G8vzn?X|Qs-{1ag|RJmRLn;>RY2^bI11a`t$3s&`P zK?v&Cv-!P-#P;hjniOKw3(krv9|Qy>Btj3V*E);>dFD^Yqw7dikSWH1GMK0vKLhXY z&|ukOWjLM+{;W>yfn!~zA0yI=1NRq~q-#sKD@(}@b{Jos(!rHmzvzu%0#XPp0d)JX zEOdoWT)O?^;dC(`n}e&S^hjo8kR^#@ zgM25k1%fzEHzgw-)f6qBiZga_Xx?3Nt6qIw9!%b18fr8v5ZG`=4bNc|g&h%rtupC| za_FPqGuD{st|Z=v{khqb_3GI`<$XXcVgPWZGt^Zte%W1g|8;n)5ROT8Q`9P1buzdY zYtal>s2*PJn(+@H*j;^HGGM1S`wX~W?F%wu;R7Ro$Ja@nAQ8*1gZT?n9}3G_yM<*DXSWFQIkJK>=LsM&Gx@tllF0LpzO zDgc1MebtpnDahHQRgK1%V2X9sn8y7LIFf`)#sDYjylK_LW&X1-1sK5vG#|8X8mml}=<4%6u#*bU@@&6TL#;W!r9arNKEgfOZ2((9hdh;O+ zn;IHVL73M24d(STh+lhmBH}}-PHx|TSkbNQc6Nf;XK#2^Vdn z6XwIy+lHU}J2!!)ZD8AY(*Br@EXw}a7t1Qk{-}f3X5?!-UlApk8mP!d%&ard_jB38ca!56d3>lg`8R;%6@_1V(!jI^WT&}}LBkWex@V5(Eo zh_$ds{qR{&@_d{ex3)WK1IlE4na75q?%04I;n*sCpdqyV23!P))a?a{Da5; zi5IY;3S95uPc&uXsc?)o^4M;5e5jESN)Gf=DuLW1&IvI~uq{>!K}~YryuSKsL_$#d zBBeaE??z<9X?AV(wH;|K+sINz(!RaPXm*RpkD)R6WtF>_3AztjVev4I8($@X>%9H= zMryJ%13uy$cDT#xZpb~P8RcB4aJM88N_Bj74niXoj&op7bf$XIQLE?ycQc$iJq-Og6fgO@ zhi&T}wbi3??D-G%q-zyi`nU}z?yozNxDZoxT~LeoQ>I^8oyhijYZbMU&-Dpr#rTEo zpd8c$QzNU@-d7^V9QTjouO5@CHD<` za0P?p-py)vyWnN*^nILBpsntmfQ&!UD$bLPQ+Hw+B7lBEKy9bIpA=MQCVGrngSi)9 z@mUh>|5%(1)+#pRyW5zx-PQCTSN#c8`srYpWZ{u^uE$tB*yZ@A$MK#UI!nc4%!s47 z#x>g`23$}7cRWV7_FTPC26}LKy6SdL>liSP2uZn?f?%F35$|X=sv$)|@j7|hw>g?r zV`riYxR;ve-)h}|i^y75J=UXxB2@j`^50|-Ls6$eixGvEG= zqGd5@nF`<`#P=>m{3CNgPen|;Au&6>m;qv9ZM9soVf>nF<|=Bk*y*Wx+n;|RYATOX z1XjU3)LS>Y4TawZXsfpCYS5RT?gnw;Ix-pazL`9*1%;_^De~3{wbYz1^2NMtwa{0q ze9y+B>&sJNam6DFi!+JEWQD~?mtaJU=%J8^7ewNQ7l=febC?S_^m-Kz`SbKRyx>ni z5Dsk>$evapj@S*+2k_+F64u4ef-2GWBxfX5OaCluv5|CV4ZC~R6d3bg^ML4vy1^i( zqVHNHn5$IkPmpTd-FA|!AI`JZ4={6Fk!)t&4372jH*b;HR}@LfB5 ztEZH|$10z}B~CWiA9r`*Hwz@<+IRn3@da=4p8~YTOOhXw$ zfgxt#Fn$ag2hNj(cB1hN`Y+&sDpnsK;0+8$@a-_QuLUxB$==4UrOZ@-+7=oDbpLAw zxk}*qrj2Ux!5dzz#mDm?9z}bjJgw-JSb`|cQ*9#Q=ms`o>kv!~vg`?F^wnb>J_$!& zu;~uE)-erJC^b)=rfYOl!z2uaa)s`4y-pY*kb<%0aP(1RPi82blpb)qh*pI?&!FXcEkVl z#r_EW=hm`!)g43I;1uR{a<$1IX9yF8_5Y(H^G?w*yuax`(lxE}R#~-SF9K(@s2jkL z*qM9*oU(g}{AwiK{|ELhJlUadZYV1tTn!;G`uuD;`*zg)!wjo$d@Z%17Urp}!`u|9 z6q6;rLf{k#laWO;ECOFa=m98#GQN8~iuimuvvv-`D^57l2mS0*$On>A*zdSneguC+ zX4MJ2F}fU4lU`HnL>y~3fAb)uK7e3U07hwqEy<=C{2SjuX<3MWXj9wfDJ6dvAR;8W zW6-I&BmI2~g}e#P&IS~!{TV?c?$=UWg2Pir(pAsIu*h(-2!uI|Yy`&Wb6&Nui0Cgj zO}9`#O7`3Vjlow6n&d)Ii;;9BM{hG7jO38;=@a|tw0H~h`=LicjfF1f2fyFioRx^q>@s%Rw zt4M+}CR%T!f1KK8^VFoag^jY=JOe*!5il`0bN=je-#K@eH#akV!sK!W% z!G5jbwX9R$58j6QIDl)KcTqjN;sK?e#dg)|Vi*-x*TY>7t7m3KVYGkmdhkP^_!1cZop)GRA`rN9&4PVM~ zMtaYcgV@m_Ik1_{3_R^pmUFT4Khi2?0%H1L)&SpQZBeif` zoOXh9-{@QAF?>268uu^EM|oE^t*&2U@?jL-4$ov@$09?iibkIWPeKobKroWN+Jh~M z1Lso8Q;Re@7vUAcb!0=%F@Q%gPqj$^kKzn|!$)c{U*3a{)Z#pT!$)dyA-~}xwRkeW z!502T5v2|fpMgF)5=*gsH?V+KM`isd&2JdBieTy%n72F)FlW>#K;f|3XFJpx1*lFy z$6A2mRp-@sh2{v${|!)dd;nYn&hbvx*IYckWZK1d-aSpJ2Du%*uJZemr`}mI%bPc& z{JxaCrh9YrhNL_+odinzM!)bB@d{s^qyb1Xr`;xw0KjYA3$*Jebwz6MVpW?zDFwfL zqZdk=ywM2E=Pg$f! ziku5tT*7BH4#L;;6ek)lvyKILYFySM=L zuh=0S^GjxVbRrcSnTT$rf>?Zt9S4SpKzVrQ4%1ffzFK@6tgTo;70uT?P^+Y+TJGl_ zq*YzWR356x-BEg}R?!Zgc=^?d4wQG69~qQ=X|}gNtUdXTL|m|OBs<%CE;l0`?fAaz zNVZn_IambcJFq;gn6SxVhE8<2)}ZXj?Cg=*9t1nT6i#B{EUjWO z3bSz~AMEy1rEsEZZk=k5?X%F2wTc3(kjg&N+sy*EMggozjC@E@qB>6O4$@w(AKHr`5kq52bdK`pTrNX;@xB$ zqhb6Jw^vWqs>+c;;TFLE!s`X#IKYxe{FM&VDt^n7)hQ0#-*WX-yv_h&++a7-@95Oo zUXtJKXoue1t5rTuLSWsVwbgB0c_MNQ!rdPsWJjgK`#eFbq@^2UAl0|-@v`O~+S28* z{oRIPCF>LRuc|L~S-USUN?#n|zMu!5yS1uP)dRO99#H(kTMUf1n}Pdhwvhj}Vm~6k zx*Onc_T2r8TZR87S@1Vc1*;cZ6`Qae;g|s#bY3V`8;HTgH1{@0&PBS@qgJ- z0DlrRAtpT&|Zem0*(e*+xB@e1&6q@;kiD}jvc~^~TE(yyKy;PvfPYkre?w6eXvgt2K&yze za#MZ@)FZtp5Rq?SF;yUe@%u_q|0ZB0EGurzW_F+}Uh2P8t9(#EvxQxt1V=0*`2V@$ z9UJpMYCXPZNbQ#Vz}TFQ>Nv8Md?_6o9^6^c8Gr8W0r}05-5JS|k^P%kU_Lu4)GPLm zvLVP+v@Zigi~L%$9wox`ze}rJ6kEeHs3D5G9%6-zXf)?2%ud!mnmzXXTh{bNwNQs7 zM^l?Q`bXtB)@F`AQ8}91%#jh5<3yV|`l%d1Pz4d{^wqtI$cl9cD}7si@3;xoiS-J` zlP>>Pc3h_ZxZ)ZTM8eaEeUkFGf|o9=+ znz!)V2=Nle?{M!x60KqtWsV>T0JMQd-qg+eEhGz;FzRMPoVrBqQEew+NTO{Y&IH{G z2olM#!?lWuY*LNNq1o9Z;GZV-9B;EJ#v-;UcIuXRNy3?P@iuWg7aTuqsG}fusCs}m zo;`K@x7yj8qq8fqh)hZ0?Cm7`PCI+sR6kEq-Pe4H_eW>K9q;M2Yddwnd2KOrk!Jq^ z1gE1J8O5%!?ZMGQfp?n0!HrJ4j(#z#SHSQqg zS5Lw$P~J?Yfg@$^j^Kr=!!T$?Xeq?OLVJzHImC@zDta1z=GGD7tmUqsJw?^n_E_qu z#!~K%*%zG-)4Z-5K|2vM0*iaZ=3MzR?0c->$1nL&g%7npT)>}m`Ed_F?&Qa9{I~@l zwEyz^b^N%7A8vkJ#g8lSf%lj3`v`sv;m1IJ{Foo-;{)$|@q2fEbm2z|KicCXN?=aM zdPQz;Tfe9?Bv7}wf}G7IUjP$}y4Pq+%7ArAb^6vdBG6@rxo^k`D+ZCG_UK%5K5{tM zUVu-JmX8Y)ng@H&b(Zf5;mDV(eov~WLp?kXgXytJuJTPNkcv06d%Lr6j|f7dNnAHq z|My(RsCbcan}E3+ZwACaeO6PXPo(Y@;kuu-ktp?F9;Oe^cjt~v<_=&X9B}fmKAf29 z?XImVOwXB^?#0bHFe3FbmpBi@vj`9f-2`yi>@x@1El3=P;Q#zfN3iVNPToG+Dm^&| z6?emz4msmGcst=s$DDB;wUu?)WI5#xCRTaoX8BgR1^zJ>{Hd@6jN6bLH)OY&cs;f~ zMvn%M#+AT+(m7=b3>4aRV$)F9NF^Pu5@P}4lbdsKA|m*bjg#o-X+V=~Jj;Db;E@9m z-MIr+81ALCl~3T8@um9?U`!-U161acTjWxyWR9=*;B|lM@g+S6S0*z4vN`@Y;G<~p z|7E{#rw*N)16$-cQ~xTlAJi7yb|Yu%Kg*vELpFTp08wMNTZlqWDj!ijk@vLEi0SiU z%z@e}++CEG|8{RKPjPztpyoRc`~KD&gCcRBZd`)@bHz)4 zc>^-SMC#C%e1UH~c?7jG&*98DGCNsYHNu&5aPB#^yf0M_Kis@t>^t#`7HX@CxM<_qBdSmpo`Plex4cANpf7yR}A$1mqUp_JhF znxD3TUyg5W2^Dq0wC_L$rDZnFuY<7UObGd!7casA_=(4{9z2O1W;qt8YwmY~ef)}u z5V9E-Mm}7aP;kuwYYz3NgxrvQ)qv?z)g54ih zXQX6{{a{N;YJ^)Y@ciqsD^Ex{|6n859F7k)!O1+qeSa0-+dMYHn(t)BpmSS#bj%Zl zKMrsUf9L{@@Ctu!;P0s5ZyfM95%}9AkvM?At-zlOx&c5i`CD{SKlIRMJ$JLhAJ+dX zQN6b6l2qS5;P0g1Z#(d}UD-!w&!IgXi&_bC`!01b`shi}alJo+>A?I1r3~jQQj*J# zMsSBqa}Z0&{H@>)6>wKoaF?wkq%qFA#NrJw!tFvXm7uPYFj4H+=CNyIFlTNV9*wUW ziK1x><2Ih*@m(GY!AdpnLM8s*MvwhR>%VO0d$TTYS&nb-7~iI{WxAtQ377Iv9Q

P4-`O z0w~+_Mss&+?nJiR)%WH>RXC6mF6`e{zrS6$20J;SR!K~@KDWz;xG!fkCb|y8#2ML*S8ivAB6RqGH%7STRw9&F|}2@mC2ENELod z6ONdd#jGvAa}7rKK=q~ei$`x$WJ%{)aNIheEn6`>4@4V!x<>e zFbDCpMXaYAke3mF`(t=X5yPdT|JeR%@V}Wte<0pTjOvQn!esM?(Kz9S@eaqNd~7xu zNduq3W)G?@qDT^-r(!s$x%`{eUKd2jWK*5T6GtY1lLv_P@U58m)&h36mSGn2C_^mp zY$oG${%Hcgy*{wvC)CrRB2#_<@KHA4Csta355W~qh-V`(3ke10LK0IsU!5LibHk8m zNCWet7Hl!twd1=tU^H6tvygs5WoU_e_jCs0-SKoSqgzA`p2Wp`(m>D;YD@t&jIk<-wYEDY(hyKB&UQ=B1+;`Bn^P7EzWP#ZB5wa2Ixz}@HFz@amL(b7 zfAfk~SjK8hY zKq+_AOE^&{%^LyyJ$T^%Vejn&s;aX7aS+gpLid88Pb& zkw6Fjl`igrf6J==$Na<6JNFz7oOy@hUFDU+yPEaF zyKoJqogs%GshRR2D&@0{S{a0tvA@0?H!5|kLb>*6w+IE#*NY5D^@|`-ij94Cs{f!c zQqifA+00LP7@={ySyZ)k`d_*>VzUwA*g^?sf=Lj9=iejXnVmHLw^=vT4vtE+G= zLvOA5BrdXY;e64_)cLrT5Y9!g`$GAlmj8m6Qpe0-(NUwJ9iTBQpONAF_|x=%DZ4-U z9ou=7YQmP|T^ajxUgeY?ju(yh?$A#`ftp)Z)AbAIaKn;nd{kbA-1C-#g1db;r(y&3 z(0t$Il=c?Qui9g{RCu{3l@D$cxhI>CLOy12W7b;ahXqZHCUz1Jyh-o6Wti-8s(;ugakvsw&2& zv??iLtMm}R-KsPks%tu1kn&iA{l}A7R_n_NFV6Y{7IX#Ai8X85VkX;7K37JMC z`KBIQ2DrZ}Yr*k$aet^hBFe1Ua_nf)H_xJ+h)u7|ismWU#X9G((vs;=Yv^T8-ueWz8TQ3BMl_TCUP^8=%27noP8E37){DF+;h9$ zNM*LsNhu}EkK(?-u5JDC&IQmMP_vpB72)BPZ~D3wKc)-xCx`t=;}2YI*7^Ul`rEyw z>-yV|4)uRif0Y%eKRIqI9xbK*w!Vq_>qfb@)?dP8)Zd0LI@I5oB^~PTpE+ID-;F;* z{goI(NtMk+tK{;sX)RDYi@`_cOQV#rUdKc0{HMr~TI3mJJ!k5FS!2U17n ztx!rRZ^g>AM)`kr+GhD~cy)&IrPAWnO~dx#o=xYfRr0Ul=?2PWE&un&U84E(vF^ds zRQ{MlPa5N+jsl>4w@Lm#JvHwRc(sUX5BA3P7kKtHj*+?t z;STB#FpPIr4}oe`MlbXUgrO`A-N43kbE?`fv{xP^uVvd`AUD+*gZ#h32LPpf276bi zFd%=7B=5c)m;~s9q3CEifTtRI%1CF;)JRBOXz?5NL(bAR&gVI6uEGbme_A&;*x-h% z4|0N?07idP*I|tIFC6~-iJ9-n2OL^Slgwvri%yxoAm2YNQpjuw^8UpAZvXk^FZGIm zXPN;6$oU&^^KaVK7WN-{Le+oePt6ypBL$>85b4Tog(v}1#SpjsZOPhm$jST$Ge5UI zzf$C+^X7X_zf;BMQrk@`o2e?%J~ zBgV%5E=0$aV%o^SVbhvZ`uz#yYK;G~nQI}Y7SiUR_?SQ3S9&P~eKzwfW}d$aHLysK zg8uhk-?!6q$Q;NtOgQ9KEP4G(W+!TmnU54qP;jOQGas&qik@H(WLEfFNf~A9-B+3r zO8Kcjfl1>e;VEfzR)nWfYz#rMQd!V6mhF6&?E-zL?CkGg)uLdjEFoM>p>)_j1x{QL zh*D!>MgP~>;A4(|VSFR$1z0Hfuojj?^;Q(o(>@*73$mxDX}@<# zG>)hb@V4sQ>qR-3D~*R^F1n9FOkPxY8HGs^n;atc^|c`O`eWa77HL8DibXP|gW)9U zS%L&#$7U)X*}5N@v-+0c_RWhKSNMndDYEhbIe_L%j=_M-?Tb0y%yHK)oUaeO1oM}% z1J9U@4(EL(^WOKZ${RB{?bGe08^9Q^7%?oRQw7KdU+$fMg;G+WOX$wrR|10w6bEs7 z89yOHoBs<*&9NpG#Azu+P;g@PV(Lj_G%a63jKn1!&Ig{8is(^R;c0i2T`BZ4yyg{> z=AVoSy5`aWux&$%?>6Rm>Khs!unkdVqRYwxk5PpqKIdO-kl}=EvqOF!_=N$n$3Oi? z#Q&W={_TM)5TEO#p7vhORl88_p7uCr^&jLV-dTMsUX1dmI#;s!fsy!*7o*86I?LK* z=I5Xx!G>RSWr$8Fl`x(2S%^dwg0<3t*6ZuJ-6fEX(nyF z+$yifX61;$a!RhjVr$l?A0zz=*fHw`n*ZiV@2TvDucOiAwqaXXUY&Fp(OB`_S2~1^ zHa8?2e`PX-Oa{l$q@CiPqxjwcAe!_5o`cSDT+k!7AGBT=dJmz=fUetQKhyQ64iIMa-VG;RZu9y68||#I{Y_}ty{!8FU_9=L0zYVfjHHzh8aPs$D#xgOD-Qv1-2O5d*c7GLuLne;Rp5bF76k(f$GH< z-~C3z@FyxY(pG2F3*=g$eQVk z_}@3`#mueqvG%ha+XJxo|Mv`wyB~)PF9b2&A{N6NRD6jdW+s087*FxeI&Ty1RXfWl zn_PUY$~UsB@-2{)Y!ELa=wk|%aG#L>}X2I3m>PBp<+3xu^(%Z!C zv)S-(hxJkYI3M5gafFYq8X;7fXke1#={CrgZMtxS23**1|Ug~C6l=UE$L$OPvr zqfnf!^M{97vqVDUCe8wL;CwfJz;>z0c>Jg;4)(AxVz|9P6=S+846di##+Lo5$%4j? zEWr2<>z(>>KECDS2p@;}IEY8B(f(>sI-~ue0U3Lkeu+IyxZNJxmTqU8#MBTcdwg)@ z5~05{;5cvi!3byy!)|u*WhiC`@iH+*|Fil$EEJl`5kk6_IU$uBZ7_E9-HgcB@O*sR zkP}^Rg*q>#L&L$L!7kK?QT|WN@@HdgeRXctMKZ%RD#^;X2#H1TOZGDRp920TK zf&*8G3|iH<$n4{vVcI158+uX16>#eCc1&@qn)U+K!TYgcPv3*hf5HS@gTXa{z&y}{ z`#C;;l{9I zm&SrG(?Oy?{(7bYn+fBa{tCbIIpX6@{Gp%8LWYTd(Sjdj;`jek@?S0Z_kKxsNd8aQ z@g){~l!<>-;in7UZ{la#@gptx`igM*rzw1z;0sLrU_1WUD3kuBCceMIA9+^jH}Quq zw$pFH`^t@4sMYr$75euG{=HwA^xN?z7W@aqEB-&K@YRC%oA{Y_{74Iaxrv{q@N)!T zVB!bc@y9MP>HnpP@2~I!6#XXt5SCA{kY%ZV3qHfd?>{2+e_luay?3`sza3v4t!jF>j$D8;=aH7 zJ4;OZ75)yv$D8;=SR?63zXjjl%zyt^LjR^`g#Nos`tA4<3;qk{Z_uysdj#({@iXoC zkrw<*CVra2uMvEKi63moA48`S(tq#GGwE0O4T6t1@rN$7({I7|HuK*f5c)?c`e&K+ z+wmn9{66My(68{PpC@Sg}i-ozgoYNy|V?`!72|FF7Q@n`z!p;_2gf?i9duDn2z;t!LRyN zn1B1f6#7>S{=Jzd{dRnb1%H@$gMNiC6TIKV&$Q!5TJW!#_-P71M(_nDey|;XY`97P zViVtA;iDD(#B;e5W>Ro4%>1!aVZ!-R^yE-#(_|c&%7sd7qfen}Lb!q6KY z4?}NA`1(e}zKt2y!M?i-MXBec80_1&XFAw-zh}#e!6#U3*@&iBej)sw^Azi+_~&8% z=3Zc{pF|6N>si0iNCoS^3O`ElBTRgh9p7@1$)C+H1D`DTw$CO1(|>0EM{f`3|MvN| z{2#R7_fbD~7ks_KZxMW*iTBv?MHc+03xIbBzEa^=3clFH=i2d!7W`ARPkIPGOW~&o zeuRmSvg2DWH0hsZ=HGTm=pUfypOG4}Z{JR{({I7=CI4BAxSw6&KYx<^t26N)JHE(* zuUZUztl%pZeuLnPO?<8$pJ>6~V&g5SOg56k5=@Xc#j=lWWoQF_PJ623cqum$iIotwc`^l_}i$TmHcHX z{A$6EF!51#e9KUi{&Lzk2K}E2{nG`1^j4F8EW~uA--5r)EPuVirwP8!#Cz=cA`AZU zV&t#nr&8gMJR$U(_*^?a(SpBeJ@CCnezFw)Wx@ye{BbZ{zZa6 zdW%W_AUpjQ{JoC@&m%vOe}&Hze4UB+*zrXc{4>6lYS57-)R4T7y3V0Oa2|b*`)s*JN*{?kxJl=`d9dMg0D029y`9s zg8v7c*x)py(68`w1Yd08bM5#<3;wRVfmiw?OW{WeeuRmSvg2C@oAj@u6=KN$Cqn<} z{}TFdGU*>^r{98iQ~xAM`Rf&ai{R@_yvL3&vfz8N{VV=gD*Q^p7n}H8J3i5ZZ>Ib! ze3rsb5&Q@fA7#h4oM+PiFy+^vf4|T_K+!+dq#x@h9reEjf2)bFSNPBWNdDECc#j=l zWWjG_`&05$sqh;FUu@!Y?f66sem?8p=>HVHOzH3;y+4z#I0D!bdCmO}xjBFS6h-VEa@2uT=P*kCA`HCO+4WPqg4arv8W* z`O8xH)q)>k;-l>NmQ<7eXDNS1{qGa{rwjh*4JQ5l?DSjk+kXyxl;mHp@M(gtGw~if zzQ}@q<1XM0{jcyx)(HJ3KG%*1X=)b)} z|02O3z22n%Y&-oHe3V)KdWFvue4UB+*zrXc{C3KZLBGPsDf&%(t{tCf!5^pms`|@P z_&tx3elOYE!Pl91 zj~!oR!Qc24@M`>3sqn)EUu@!Y?f66s{_G9F_fhq)@c;gU&~M_S?D&>}CjD>z5_m)Y zKNR{m3I6D0lYXpdbfn*ccisuSs=s=LuNHiriTBv?MHc)8vw=7Czrwo(Uu@!Y?f66s zzPnleEQL=}^qcr7JHBOrN&nm#$Y0ryZGRK`KlwfRceKc)zmJ`M3w{;bkK$jw!mks2 zor(9@@kJJV1IHhR{#W=pf-g4lxpsV_1wUsE@P_@b@S_Aj!o)|}@h$yL`iI{Rywcxo zdxZYej|lzOne->y>9^pMX9923zrt@3e4UB+*zrXc{G-&r#`ss^R|>w^#OK=ai59&3 z7T}fs%~JR&f*)bxqwM&WekT1Htbc?4-9rBWMSr15f0CVk3%)<~zd^skfBrl2ug=7K z?D!%Je&cQ7{3{iHgW!uze6AgzXuHn1a+i3qSLjM@S zAHCM3zqg%!3w{*&ui8(&!bdCmO}xjBFS6i2BmWKkukbq`CjW{}e6AgzXu&^a;xwOZGno{mnxEbip6J#-u;dPQL|TO!-&(t6t&L1Yc+3J$8JN1;38^ z%aDJCKk|^!Z{l<9_(Ti--;_VY{#E#w1wX>XN7?Z$eNFl&(*9EVr)`(ezew;$3rzYG z?DSjkm1h3+3ZEzVIuq})whx59^p^IQ~=RuUGgx1Yc+3J$8JN1^?A@ z;9Zh`rNR#ve6fkowc`^l_yd0cK1uLd3jgol3jHQN%8qYIHtAn*6Yxg=_rB1-N$^J} zne;pD^jq*_Onkk}B@rf4vwKoE9=zoPzQuLen zC_BC-$)tZX^{-+7z9;m5@*w$lbfQWBS$6s@c&~}CSNL^;uQTx;JHE(*-$?yy(68`w z1Yd08bM5#<3;wTczlQuP{3yYXF!51#d`oYW{wfpSwo~Xo{Trb_-=rT49UbjI3x1M` zuUGgjg0D029y`9sf{$SRDfz2Z_?3b$Hu1T3e4+(kbUpA!{VV(w!H+QUQFeSwqDg<& zRN#&N|6QSffTCYB>5sG1Z^1ve7IBSOZ13STDp5hgy$j&DgY>2KuxwbEa0JB0o*f`!L9y`9sg1=$~@CkyiRQR0_kblJ{KG%*9^o-H}UlfpCt^74i2P(J{2o8~H^Rh6+3_uBne-2*{xbUi zZ9@MV!5_^t>37)ax8U13eu|a+>lOYE!Pl91j~!oR!4K#7QORGW!VedGv5C*M;}b3T z%ccWww10*F_e!DP#7EijE%7G(i#UE)^3%3e=-(vxqq!#iJ?!*b@b&iq?^N_Fe6`@~ zOuWaAFS6i|vi`dZzEa`cf-g4lxpsV_1^+-1@G*kVQuriAzlo2s<6GiP`ZelLRex>o z2>qY<$iJiGO!~Xq>9^n~+yT6y{}g_m;Ok7h$Br+u;BTb;Xn71e|09_W5*X+@XZ`QEBUKb_zi+DHu1T3e4+(kP5q(DpQZ3+ zf*)bxqwM&WSd;$J>ws77uWhr?KSuCJuQKV6veR$DH?sX2^ecR{qTj@O?D!%JehKAQ z>90zK-?@VPD>m`Dc6_1*|5{rA}IjxVy{_Y?rH^jD?AA6YK+oA_KiKGA~zy@}6K_?HDg!o)|} z@hv?}`tQ9q%)hn9^pU*nSN8 zSNJ;wUuWVyc6^Zq|1jH+A^!?LT=2yvKG%* zGw~ifzQ}?fXy#w3@N)!TY~pk6_(Ti-$??d)oA577;YSI6go%%`<6ELk`tRZXIW_;( zwn^we?GgGjLBDl>J8E0XblnJakq*cwn&)?@5i{FL_!9ovKdVmZ-=Uu@W%j&ky3 zPm?|l^dnOQA3nRs7s(kBaO+E3;*uV-aNay(evgdp0Ut8K@zabJ zc&c3TYaFWU2bXnP^FMJ8uj1}}&w(GV^+(IWHr$Sw`9aCqINvoTq8kpmohnU~kRF=< zhRE7r0}et4>&M|bnuzFGaB)#?_|Qnn8}1~ixbuZJB0{EDU#a|JQr@3Zjo+yF$-dFNm%(S&+KXPz&$f3`$6S)5d>G$t4 zeI8fC`K|r^kV^-aboi$Of9@q?szQvB^K<0R406X{%`G^YSb?*MRTF$usvHx1c~#M5 zk1H>8TSafabthYJ0uNl_{k=Ij&>3P$5?C@GZdj98-kcN1I6#fAp=K!Yop19Lq2z{gItakPbKibmoV%ESdhXbPkh@UMKS>NpZ%lstMggUf@VWT zQ*o*edw}QSG~9=aZ*}{}wYxJnJC`j(47U#+O5zf)^~dGo9Ird_H0aCAe0Tn6M4dkq z=ki=Qyonf>F$Uex(v9k;TH_D63*_5L{%8m9&)u!xEmtYY6~n&5RQjbo7x|@Ro^x+s zq=936->7)E!;29FJk>nWs=tqBsBg!kmPh6sJY%c>;Q&}h$>+h^z;N3cG*!Pm9p`C{ zD#fYYQ#jh$GwjqC=QB?%xdL^1Wqz{`LM!e>*-^Ji-fR2=yh7jZMadI&v2RE23wDd# zXSk|GTiq+Zgkwkp1yS_F1cUcOJ+1drF}&q3O!eSiqY0apRzbVpg7qa_@Ar=UT)GuM zUUhg@?+1!iG|>aTe;9h;Ns)7=JeI|pe~~t`38x9~U6PFC9+PyESMi4jc!N%yEZkKI zpU|&FPrT)As2Uu{y$~mo&(fN|)-v0i%YqaDfAs6)ov)zM86dvVsW8aJYVTk$oWd7D6e)b65%Xggyg#0@Lzmv$rZ?_kIJWFG4gl| z?Q7{Z{-mYC|0eQ3Zz=fSK>jx^LJOM@{-Y|%|CRy>(D)qR#5jZf&KzG)@8)4mo~Fpi z#@b+XWTSU;=8p1n5G7PYafmW(hv(oAk`Iw0ZYDl$@m!NAy zb)*m5ii7BB+tmG7dfP7i_u>0MG%xC~)BWlz(Z@szLt<|D9*5_DvynYb{Nsz+(|9gP zRXeR+`b{U;xAY2mV)VxhMeNW?mc>kkJ)K@8@Z?_#JTC-K*ZT?Fa*!=>+Jt9^;k^}n zl)z(5_M+m!v;`g&hVS{Sbd%pNV&S)rWZ`j?HXZ(B?D$_;@Y!Px9_XtT{vE+D zv*4%M@fTX~HN*?`Qxx7W_zA>YyXjR!R5yK1D6uZP>Dh>-UsTzlmQIXA4zz@D9^v^m z)Kc(esionP(cd#jD9(Gj^q1h8s6#E?huEQ7dO91aa6F@L5P0%;mE_YOL-2IHOyHJU z%C*36pgGUsuwJa-ZwmZ2!mVUJcYz}Fu25oKlIdkEu}08-^veA(NG^lQ?a=Lo|EU@~ z?K09B>)aS~7v6a5!-|;Li&Kr;3`9RIpzM3bevr%_S{upYcOOG^xm-JJ%SAN%|9pEqf7Irx8o87)_huf#YL%H~mndOG&)Zq0Ky;I1` z#=4v7{tD;wE1zcfvf4;$;!w}nrk|yP4T+ks1pe8@f07)D<~ihXDRjK4!P`SV-8~ou z@EHa07N!<>^P1r~Ju3qDxVi{B*b{i8x5^Sc)Geze@B!tT z3zI0J1ZTzd!5F@w{PZmJYoz2En<2#-06A_N+Y{8TQAPHzlpOTlf289)MTgs8ErH|J zov9=7Yh=qel`Y?pV?s$f-&D5rd3ylGE$}(urzAVs?JG*Z)}Pd^z+cpkd(H|5?W(P< zb$iF9yZ!J%HQt#p8h;C1e57i)!?cjQ-h&4Yl7DE8F*!Sz!3OnNuTnT}7hH7`>2$4yhm=Hu|5zYC<0rVNq< z7UMQszLDU0sqV;$ID9`5@os8|lbQ-Q!1)69C2Ia?_?^h!1qWXgEwM;KuaK*B=f=tK zfhzt?+Uds<*Q9w1(_yxUBI!wJvdU-?&mj8eACV+jEmR?{z@=wupp@@cCEu;!p6Z0Q zR8hEVQId{A4e6tAgyz!Oa)Yk;NJGVR{g3JxS4-<(=@j^?R!M3nc<*#8>G_fm}+$MuIW zSpWwI{jI@oQX2G1d=Xogk}O`mA*3u8N|K)MY3PBmNb7$TDoWQ3X6W`!gkZrVCtfUq zl@H$>1#rj(;o2S&t;XwnV*kUVf9}8u$d-Ols%qaosXy!CnaC6`y1jvqJBYFpuTc=M zFX5G8R61Oegv9Hzka$&u#j67L=eTrKb_wKb3FPaCiVJ|M5VXkGNXnNNw^tphqIel^ z^nVZewo1;^f9oJQQ153@?V=><-**ADrxKw(=%Yl0mL8!)SyWnITKM^%R$QX_YkZ_! zx$s4Uv+z{@!rufuEstwYgS(=4J5;G$GP`sO)1h(K8{b2I@=)RHn3(ysFq;mKGLy?Q z2ShANMeL9ZM16xe5WQscYG8$SL&@6dzhUE*)!s+wF6q zwL3jCIW7VZ3*FvbmRA4nb?8w3{J3iLO4KK!(f?~mDmxUnubaL-C@o%TzixDM8e(Rl zlrf(U0Trj=U->kIM+7Ahu!<2}`TkGX0;vQ$-XTTkqu1is&Jh)AFy%L-e?4N6FVEvw z!hMP_P58eHzWm(a%hZm1d8rV5S@kD7U-n;+8sf_fU!93BQ$vNduqJRS%$URfTgJ#; zNA$GyKqF}aXLjMYGiMk|4p4h3({HudE8v1iN-NPFB&AkFg%{#=i2VAqqfc2 zM4epV91q7_FlXGDJA!7wO&$=4(PA;cmV)`CIr7^Z-9C&Bst_Od|894BCK^o!LbTWI zeK%x4R287fO#7pfj}?fld8ta)4^FknN9Ey;@&RxB&W(yGba%d%c|es}Fg`ghLVx}q6vZF&7ZsF>~KGO{QVhr@MVP7nuv_LxOx{}tY#$OCZRv;Yqb|(H7(ga^f z>w6)s@`c%a6!I~HkGXifRt2*8OY-@<*7y~r=Z_gX7cK-I@nUF$tl0cnszmhPS5DWju$Y_l2XGN7uYk<0-p@J7)skYKuUpQEhO3aav*snt6u^)O;K%a0 zHvIhvtR8$n3*TP_D}-PcLsMM_3rLst?Bm-a%X-vn_!5k%AI)4|S&}{r zPW5|aw2y}`vY1-Th+V=OgSb}91p*oSgO`wiSD75fP2j3zVx-LKE2K;{@w+8w<02R> z^B>Mtu~I6PM!s*rURKdu32V~Vf5W-0YM_Cyfm!}nzMvmu1n0)D|wOSOs;;&TYgEwW*E+}ORdp5q}O8R!UFYW_(W@C9zLedc!OysT2?#!*u zW&b5{%RYcXvMFsezQJB`F0V$Y8?MXmtKbW0Bf-2Se%Q%L{xL;bYWbO;I9Gkd?~npX z$~WLszVAgC=0)^}|0xZ_S@WPIvQk|~fd(RxGj}*W(!7yNDF6&Ko;B$Y7YJOQRyugIBb9pN(0ggcL`-&BhS~-B^3cQW^!@im1 zABEBQm#F4eRP$CX@(1^@?WktCuEJs7|C*5g$$~Per2eT) z<%9aCGMf+TpUN40Q2*3dAu0aW8oz6eU!{LS$+_T}JK++{&&*?zrFgjJG2K!;T=UZT zhKFk&r%_5_bFWO>1p+ZlB#vgX;KWQ8+&svb!p(!ADcro#>{L_0H%eV9`RAY5L-Tyr zN^@r@|3`Q_ez9nlHenY28EyQN$A9S27*;#=GRAA3t?62O1Me4Xa{6C~$*=jv|F`Qh zl<0DlwStt)CnXi6WIhJ4h!9o&4y$DaxR8(Q?;6{$(i*=Wi#CVXC|C~NN{8jcS7zhk zsQh8Atp9?VhD8Z*{JSU)u4-|}&UkHdT%#6$CJ zV==YNZx+v??F|RzuFKK#$jtd{jGV=B&1Z|88!F(tR1Yj58o*h-|`Z6vnyT zN=Nec=*9z41;ZMle+z21FX}%5)>hJl@y=(OCal0qa0PsC2mXM|*wBAwp``i^EYNj) zxcRu6k8yZ#_R2T1@t;v#HH~e@+-V>dF#Q64^WN+lN1xnin6P|W9gCakds3WHa+EU8 zq1wm3(!a6dC|H=N3E38RV6v3o^|ptYjp~YEU!-`(YW-7{eK8K>TfINld(62ShcQRP z)SUFs9w?{nBE|HcFbWC}nG+pQOVJsg!##4G&$Q;Ph|Xy57Pt~o^9 zamM9q)neRPid~nB$tA5*kss>EB6D)dq5tC3t_sZd6kN^}8}LTm(}Z8pSI>J#P@@tI zO~>HCvJ;_651F5yY}l@FpL^0VKZ6%+57+$Hsr%WQ%Tuc(u=*Wa3hl#=u2p~PF{CNC zM#BHXXL$F=l#LTRDn1T&)a-d@Fq!m=r7#`rYB83C%jTrCpB`|U<_K!*J`m+Au5Q6;~)AWMEXr9FaQ z=j&g_Iz4?5nf(y8EmhO=)Y%-5$}d!7hZK%2{qg`lK3_zqFtPhPoQddm1Oe`4_8Sc-|%pi%-|ayu9CTY!^8Dr6^f33UQoZT z7mYsU1@-HCajo%P{kmRcn_ztYYJSyCA|3V_(9){Upqf^F4b`;jGb+;gmW^l?c(_=g zgbF-dEKouP9xfIrp#l$=QJRE}Rg#;_C{4mfqf{@fmGFd(>enTu0eGV-RZQh8u)zB) z;o`zd!{S7rj!_`E=o!1FPbwO|L%$xYIC7^F=BJ^|s)WV3f&7)#X>0L5%Ug(9X0=@6 zhQ-==swZcbX&WdZnLFAuwvcIY%FYlm^g|T6;BXAuhPr))>H4+ECG;7&6?oyM)`*qw zt#lQ5C#O)Pbx?%smWFEH1(@+SL>#Jx0-NvMr8~~ScZ456Jg5%jM-lgYHUr+0;TqVu zlxyi0HW75C{(&ETgasFW{H{ka9`xZ>IkeZbE2X{uy$9NBO7R)mD`(+`>igd6y3x`d z@6fC`QL9KaL9m>|uc1{W*r%Aho)`(e z8M{~mt#I7l_*E3fey$X)@nDp=dH#r@-jg|O7ZEwT59CyTQ+5_S5br_b-`#+);3iBz z$s7KO2tEtds@-DTCMNnXBdnh>^d8M23CHiSFzMG`UpSj9uJCrOKlcl~iC&iN9fl8e zPH6n~%}zWDt|Kob{oY3U4!u~V;6Sx-Hw5~R$`CTR$IiPjzC2t$&w`;5Wkr|?NWsW( zd)cK}`PHygh5aeG{`cm-+KH_*K;oOE^Q}}oH0SseS}Z)l@6t;y$G@uZ{+RPI5{6*> z5QFMJ`f7v)Q}mJh?(|6IP7%Pi%q$&&Id zVPO{jLdsX7f~GNO7J`iOW&P*!IhQ>LR)l%z!wr(yh*Z6d{6Q@Y)%>_uQaFo=`2{Hv zWjD+IHS{`=zoFPgpn0xzl#kRrOB@kp7vWk#hx7G=JxZfA-&NQQ#13&I4OAa}V0#v( z(0hEC(VMOiLY|C5sh`KrA~5;=2fOq7?rh9YVEdT!m6GnW zYL4R`!sD3A>F&G7!8uBh!#f)GVKoi+s^hm);SfOnIG6p#l;5GwjauKTlZo^Di~U@6 zG69v1CEnoA5Lgar#cNvC$>ef)(bPuQ22-j|_Az3_SDox@yu!&p^+zlfok)saIu`4k z=vb`Wyu=G`_B-Czu75WfH7t@4yd0A7<*bl|>h-UM>i#-=-IE?w{w0?3Lp~$RZpE`( z*#!EJZ;e8q>5p05AJfZHn^GQC$B_TF?xU45EGDs$TR&KRyFE)tGZEDtFPr72cI+V?yKZ(|L=dBzjN>vR&V?W}HB5}L&z-9IqMP-lzyA(A z$7LRDyHKHQs#r0@2yMU)=f?iW-*z}33azpmA(0dSV}{$8lg|0~EF+a{rlMI>iQXae z^Zbr2f-q=!Ard0ZwnlRAK(XYKBz2pfw)A8KXk2s|SX^~0M4`S+nO19sVl+}-Drc;M zA)>7OtiUhdgJbkK2$Hf{*7Bo28Xaw;c49B&z)>=oS)CD$s!hcfxTpI-;QTQ&FBQeQ zvK^vu;~j=L&Sm)*=tEvnGC7x<7ZwEIX{WQ|G#VSn7q!sdYW;bIBRsy)Y2IV|ODldM z4eI7tymWm>D?iM|~#b0HeCcI86`9H1Ess(*}J8Qm%Fq7fEsw(>?)jF%6;{Ont z=ViEp8Bh7e>?jL>apo@h#jUF%T5Hl;`Rk8)q6cFY25 zAv`}?z1>;;pdePKMIfa&k$PA3K=Ea_zhC|Z32DVJr}~*#8Q;rL=R3|P`!TDA1YTDO zh$Y9dhgfnl_7F=>#vWqH%|o~OcDCke%x>RN{yt;2BJp`h+?Wmqb1fzMDT5gnQWAV$ z5-c$igek1%m)FQ-Ei+)PvGzuTbY%U1X`r-p3q=b$3dNQ>hr!M|*RMOwSuUgO|L4Yc zP%E{R%qUE=^VicDp4)RNiOi_L@M6Q<6YX2GlO0q;5>8VBssj*TEOslwWakh|g?KU} zDo~*dT@lV@E1~-}Up_1mM{FuAk$8^7q%G961bgc*;{taM(9A$2lnVO{mOjSXEK$vN z83 z4D=X^J5A2%-77+^*kRd}7g_p^0UL~ui=c}x`nIh-h#TuvA%LkldAth3eAU^ z0`nlYNqz@D$u8~MuiM&rRdL4g9Pc;!pohN0`GfuosmoRiQQmQ|Rb&40Gw?a@*HF74 z>wpM)O!5V==+YVHPmU!gy;$gbt4C^RKq}Ed1X&YIBg<6Cb*cIv-em^rlU%Nni%Gi4 z(E4+s%yVE6Viuk3#p;Zxq)-jue^E_FGnV5*XyA55DT?KTkYd4f4BI@XVH{F&NQwN0 z6z%`1rs|Iwcs=zhX7x}=y*6F(e6N%^=Jr3UZzM=B<2V1nc;1xkkNqf&X70 z|4%2b!ulBd!~F4cJg{k=8h)Z(?*@&-832F$REGT)VVZZZK4~P{^YCzcmQlxFHlpz! z`wDjQdm2HsKi?j%?x(GvhCx#wg3j*(@QY zhT3taxi*j$o@zEMnvOp*z8YlMwots7;J$lOsEoIz!-n!~!EA&+rSALoU`t0V|Fi7x zjEe~w$y=(RwAK8-vl>f^XwQZr3I(f7Uu7*~F&0CrQ%N|2<2jX3HVB*f{)t77NawPb zfRgbMzB;Stpd|!oGGX6bA>P9`5Mz9BD#f|1hIx2Son7X@vtQZ5;9Z*Ux@;QF3$O!i zqS};5%Xv1!VQh2H*dlHhYtwx0V-Ec?So@r=nr-YtV^-1$$uCmjteF%XyU@_dEX>BL zZppJj45PW-Q9r&NCL)$U-p1Z7?_RAj7=ht;D0II;OEq=Cio?SVs*SfMM==g4Uc zM7c9}%zw8w@ESsmNYU6~nuAf9%jfd$<}?<^hndY4xX(;;I5&>!={eNH`OK%;D@G-> zM+B>7e5Y3;Yi!mEFV!@14Po(X*yw_Rz*LuPD9gsC+K;*3fvd4)Gi~^i>NhTgI8Eij z52$UST9#;@j7$x$cii(%hxHCHENv>4m3LQgImcg3;rx4XsYvp7`g;pUEoI=w-jBId z#NE@JJ`0y2lV#XbX)nVdmZ8>IbomYo7nW5b76R+QY8=I_>R9iZ&m2+XFzWL$;gz8| zpF5^S{!71E=3W?%9h`u4tlLnvUYC9E=D@`m2z0E*T9o;MT1zEvplZbokx_}Yti_#y zN`zWtwMB$tMU3}0<}~W4Z5%>tQNi4Np5)5$eAWX?b~`4lNb2TuwQu&iEMjn#MGPnc znDFQ<0+f%yJs?l7*cPq?S+7$jMN+Y(VSf%lqAt=g(PDT0c4<<8acP@(TSD}J1gz?uRj4%~B;FJ+^ivGfS za+qP}KP)o_TKe^`!`4IQ1%5j0dA2J4)fI*vW-DbCkF>roo3`LKe$ zC7rW+7%uZg!mq&7QF;*(Ly1k*SBz(U<#GNFqYTbUqExAR20IxP4Z#K;-PC{!WEh?N zHF_}D^`TiE3sw7NCw>R20#}22g926lKbYm8%GQHfuX40eSdhNa(nC(ZqF2Og35W&z z_xusGf6u}{w7;i)F4H(u)nw&tv~*n$Qn0W`Uh`#YzIoV@9{)+4#XRRcPbjg9SSH4K zBV~?DZeL`An#aGeChX7?Lxco0v-s%W)}MJZM?05#Sb9W8l>V4CS3_JrnyCyw zTF>a0-+m1}A^N-zUd8{IpMDs8^|Zz~m-B8_GJXaa8>MpqjqwMuRA(~q*_Q1RtY5=| z(YdD~bKHHRtovY+{!dwIQUA)JH{N52Z3P;xx!IOI6uDtOB|9BGB=XTxH9ux%U>%-u zs!FR3#<22dYksx(^`nvXYcX~S#rz+xFlxwQo~HSyvtU1U+etP+rFgjJ5nigXH(mi6 z!9OgFpM?XM7_d~4=r>F5oHggpnPnGinHlASmo9YNaQmF{@_w_HE{wbL;_^i2#(8ID zSN)Jv;=uFfinv*|Jhj1{zL=GT8d$o8)hhFYbr)jBkU|&^)Lm%zwfa}i8XkC$T zCEv6^jP@yQ3~NNw)3QCEakd?Yox`*3Tnc)c{gKiNXmyZ;h4~npt-f7}0dxgt+tW_5 z>M^+La<=`hr4YLNuKS+*JL+Y9!m98`;rGV5eZjcI`6+nHyz<=i;N=V{{~20ydhjB=Czr!OnmampuGl9Ckm+T7 zBN%ircV9xBLqPl|f@wHW_Fwkw2#YAW?u*f>0UGLMl$qv%-GATD9N( zx1r*;WjlJafKWs@ajL215mqJsn8?O^*}q*2Gr%E>Q z%w|0!`eXj2g1-6+K@TCQ)>gSfpFZtzMDEzD1cpGMJLuo1pb?DvUBI!mvcZkryRgll z7w(3(KvT0KkTqVluy2yHhRb8_%$#iJvWZAYw(^M`4Qp%aINyNHC|Q&K;9a}|-Eq7z z(pmivDmvd39??jYwKOjS5WSEsRdVysi&R@oPkiaDy3>eXsQF7$c;-Iy8|U&u3B+u- zZ~FUK<-y4#81PUXaXWAn4q}QkakW*HQ%9t`3HTd-{)blvzp(3KM9If|9 z-kz~#$Jt&XQc$=-xB-wE@dWDktk=bEQKzFLvA2}!7RWLBpO6h>q8p=i3PBM=1d_Kv z4(Ry@-s42CD04%YD`0hS9){)-ddX1}*s)>dEvR4Ku#Vy`JD6m% z0e6O`2Vz6InN5KG_b%MLuKMryT;cwEz087Dr@bn_YtkCz7rmhTZc0;oezCyAIro?a-mrDGCNMm_QzaJYOIFXnxA|INUUzwIdAST1U!7q9-`#cze z?qNT7Paz*O`1p?t1~AmH@8>3&7gh=9dp|RFW%5w0?8@YM1hvD4=MmHn8#xp!J8Vj_ z8OA(I3i-y2OJ?wmxtGkv+Y40?1pMVP zyBxWukxcHWeAZ|%=u|R5X2Md(IElJpo#5WWTyOH=dgKsDhN`*J0G^$kmUzJ9c zivO$9B*-uSXK4Tq?MnK8!hZ}WrJ8+f)XK{HU#Plwv96&)xgk1K=l>_GCRK#-|5DX( z4y^}#zhR>K0CfYm(shrgAYtVLg7iAtC+pF^pFLkKBz?h8nrBnmP*8^XGv~4`@Utf- zGy*7%s{NgrWX5G23?cJ?sc9(uCFjcgyLG9oE84`JPc5m3{jB?g|&NoDJf!zRNyX1TeFh?jKL_D)D@XbUn>-M|~;tITA4#rAvUQz z`-a)-E0V0UL2YgDs*W_KngxJ+0aY^vzC@OT@kycz423XT>JV%!m4f4##j6_17mRsz zG=6Z*q9|QXWb}Zq80-#-uGJ!OmMrAZVYOP?M1Qjv6@l|MXKCJJZZGz(R|5?i(0=@< zjk=yHb)B{uvsQbZo_k?gxP2SMt3iRkvOVADeh2YeDN<|XtP78|EQl+12)-m2BSe8v%!}7L9GSD-plt#r`N*!QF&@X%~59! z_N|BvsE+?-;Vb56>R?N|VFS3pJI(tcwfOJV`eB?%*niHN zxA4Xcmc7q~d{Y6X8}Pa42|GB1vKR}uJ2FY^#n~7C& zd~w!nFg`da!{B8rB50Aj8CPr@e_S88_kcbLzEl{d$W&s(=p6V`HunPNhPg?4k$wR4 z{_RrytC{|Pr}*V4KDH;Y7^oxWhuM49a6#tZoi)jL36&$GJ&48PMjVyc=EmVJKP<&| z8g2)GC8MF!M{##3511sBrGa5!wY;Xf{b~2+H+~+SAGyWt-ynR02{I}TU(3-=xDcDK zc;JD7rrY!o|ow-gx&YF2>p81~B-O94@ga*71QL4K!as*g`Fz7%HaVU(`ir4to z9c)0He9!mzG7Mj?@vb{U6=~;ps_yC;BtwK(uJ5W01IT1mK~cp2c^S zsza3p8tNguu`JYC*ZA%@s39o?FEo;(wqgCPLu%Zn+#>u|CJ7v&|7ktp3Yp$`9%l*;4+nQ>6^!p8$Kkb72SvKf@xV(O2WU zK5Z%|HdK6y4@pEH|0dw9TkgEz!6Vv(>fjOWL3Qwmdwp^6NbTx)o7+#gO+*ku>=W2a z@p;uKu|s~((uOr-_MqZoO7t$~1W8uXAAKdm_A;7(K%ZKD<{Z+2WqScCyMJqBBsXlL zw2bGJ{=0G%22y%g0te8dbE{RkTt@dlu1vd`bn)V9=uslD4tgo%ylTzm(Pf6Wa!RQ?S_` zwJwcXfzon-66+r`Ak;rVXu3J8H#5}peN=g2wZx*tEBi;u=LGzJjc_NBVSO=Y{ehi`WauIWsz?UNsP)deQ0cIcP7M57a@rhN-74p++Mpm&W&b`)D*Lg$ zs4{&lYWI)||3rn?>_hl2hQEt&eXIKTminmi<4gFcc^aSt8{L@!C!8=ULKH#RLjr=_ zevC8li&l^hRmOHRm+Fmstl$QSZ>j9NTNyVBzrs$X;85wkp-fQOoQ%g?RM|afpGv=k zj6n7zvZn>Vq53%;U4Gub#yMTl{Zt)&4fw1a=MtQQUvrvTCNN&A=rpS64Sc)CH=rM| z)p(_;EcLn;ui@x@5S?pxN{Pnx%lEX#mM*%+yK)PaCo7F#SU*x6f3@fgz2se0d8*Pd zo|c+5I=3@cp6WltmG=i$p3(a`*}em~ex+T%Yy&DK0}s^Xh4E68yFctj{igRHgHL_b zC#U+f{v*^^6vFvk?uSSH#|dgNKj~S3973z$_xZqb6ejWn5+VLket(#c-!PJFI5_-sOrV?>ccSar5?xz`h+WK)1ir>GSYuu=^rPml zmw}hY{9raGxC%M{JC##xDSSgm0B?hw%s!Qb*)Y$kKF*pXKxBRCa$^~)97{}?e!(=V zJ|u%>uR^8MzgP8#_+@$UjR|tvO!M_;&w-PC+37f#B3r9to3*9et5~a^E!ms_%h-=y z$nvh2%cjVNa_r`sLi9+SYH$Q`klXmL=6D&V2rDpqTO`wjshn&a%1NPA4d2eeY4yH5 z@VWE@mI}7^HA%HO#~a~hVSFpLVq-@Y9Ld(Smz~Qgq?G&<4Kole=T$r~hn0#a94|Dw zW3i9?8#(oHQk4sJ*49%he#_rbXJ5+{7q{SI|7C`nAFj_=^TUZq1oOl1q=n~)!P?OL z@WXebLSF#dKK+IBA1gamX5eZ_u~C7l{;1{8G=GoD^0S>a_cQy<1=$tzI61HR$J~n= z`N6UD;94*ohn;@_Pqe-myhP;3Hs>5~h%8Tb$4su z12xZRILXRKeF<3u|90YBG;r1yXU(Ig|KO@M|Mkaw7%NPAZV#BWV>HEBO`gU4CSwGxv?vMHOV${#c2_5Pu^@6VIXU{Cu z&(|DV__4krslBkP7w3;v*d7)3MhkLiLQvP$xXRmgH3qIfQ!ScnBDGkn!VJ3YlmzRy z;?gtKEzcLAKCr}^i=9K1U44?t7pOBRlh9h4{_ToRg~R^RKU$@!^ShF-56>uHEHm4J z2PZZ(JQK>W73yT7v*r>?nrAdR)f#zQfc;d}_uw^jwx~ZWVD=y9pj4_Jeeg`B-aI(p zkxn$$*Hl6R=NQilXa7<;B#if*gkFCJ^oNd+V1I&fegunVq4Ohn4V@n;w45J7aOnI9 zUe&5v0@wG}B0-)kr~LY&e8AFHZ?A_Y^?wM)&JVXwSU^LVE=be1FU(F(R~X2(3Ou1*NK>*!K~Xq=MpA z(DC;W6p0|a80$NibrO<5t93!bCL$uAcNy}T8rsnTAEgNxe5rNFRA^M`SyfMrWiNf} zVB~@@bRn{XBU`#x{nr;Ta~@GN6tn7dxuwG+{;E4lH2J6Z@1nqW!9p|2DdoG{D4&aY zqHE<&5-en%jlLkZ)Pa>C58b%y-(dDfy@H=lTxj%v<5WfTRTc5VC{+>I=zsv2>RcZE z9qpMHM|Nf>Jw7eIS!-@M}Nj{OVwafM%E$Vhx45>_fM!{hMvDb@a>rs2HEhLvQc11XjiI zYISE4@(dO${qO`DW=IBzPG{jp*H(>kZ| z#I|)Jd#xCt= z|9zb+*S7v%G1{nGWNqDBaqwK}e^Pjs0X&8?WKnCnCd?E|$|gy_>YQ2dF`Gu|_^*<$ zDx_$X0Zk*1{&(O$O!Vi8Mu<`bPB)@0m*C`C{DmWN@~oHcVIjD)aNVH?9P$E-6}aN`c*)WNfF%ATsxvUB1zO*yrt}zvl zRsRg>%s)L>%17<7Favw)RlnCU3#p&1&e;T?HhHA@^92&?-2Q|=*o#vA06vSZn~o{$ zo;aqJRNha^)UqpPac7Bd`i|&YefI>AV`y1XA<)k3U+ZUZ{{cfX->o=LHXclOU=p9> z3>n{6zHpw>F^@2NQP#dl zBY`uinOU{v=SedENzEjGFIDoxJ79n8aH)~agJZcre?KW|>X-Lt z*}`Lc!}y?^guNCM2748Z>hKS|^C9s#aqCS`8fTw|*93pei*3S}wyog6pD*md0li|e zmH5CAQ%xxPC~;?`kNbC$r;JdvO_83pItu*VEBfJ45C(fU36lY3=TWvHOZ4S1vmdg= zR?a@;4I68y>@l&bpd~0M>c4Fm;`s-zUM&Rq>F!%=6M{ZFB?MhTg8qhBmMYbslr8r( z6EGX%3h?}aS!dQa(pM2W{|;%&OH1`l9jc!{jx#KnztSsjQThe8V?K!JhDmr&TV%<( zT07hs@6%4~-Q%`nr{Q_uZP|5=E#-T0CLo9-JlDag+wPJ9 z+OT&!u#JAuBX_BS>xqwq8Fu&{LmaU_IPHv8C$vcYjR=*!IzpdBZoqhESNqn5a>yHQ z;HV~KSQBQECzMBUQzxca0^I&P(jHNpn+8CsN=8eM9H7wp)vPzxP|mpjw-6r}PBm%` zvqXOePLFLQM|sfte|yMuDw3Z!RTd4AFy^SwxMYfN^SIi>B_HMbN45YN8OXst#eB)obVB-E!`KC$3f1@Bb?{o88%4S})Yfv=cod^cyfRlIAy;&3}P@!9rDm zbJ_eB1YS9_4wd?wV$`4bR)BmbgykC}3jHRQghrI5Btvk)pOVkEmrc^t*r zc78~d(7!J*WGT4XQmx@vCI1(73(Nm(-_+q)v#w-AS^&jUf0djlOsa+cfobNC`NejO z2;Mn~zHoav*1Ql)e+3)hEXJGWXAkZlxV8@LnuhW*t*K%X>POf~LzOQ;dm073xn=^= z&D>Sqry7<#+wg2qd|1{h_^RfkZ*-%3d+y#%KrqIVhV2bo%Wxn7HMwKQ=? zYG5yx*ZYCyzchzQ`{QqZ04no(IEhDY7pvTyH5Z~7mK*`!{RHy()hKkfDC`W+*lzEE zeB#mBjrEG82m z4~5|)wqn2C^d08sK`>{AXXJRZhvsa{=J`IbX;In&-;FMAy12XLw~-N%o?{ojih^TN zv|-879B(1c*iPHYk(w)??w!(WIZVsqFfAXho5++mwh2>?kCjTib`?2t>Co}uNba}7 zkpXxo|9e@vA&US9Cpy^w^#3>5E&S*+w3PZ92aCdNq?nU-Tn*Q~liVCZc z2nqtWu&I3ySp3ER`YM?l4DA=DzX5{!q_!xWwa!{qx6_-B0I zxk{Fmx%V~)>C<$W&AT&j6irUws1u7T;7Xc%E%$1W+L0{~Zr|`G zZinEUe1Z2LxVVbD3uqG-c-w+EP-bVd_B6>?4%bRbDs?wLLn@gm7Db!ni%QFlT7*_u zElK5bIz^G^+{gl9ftXq3Xa38%su3>}{n6)W&3b<3Hs`WmqfxR9RR|}i*5WtcA6Ko- zj72n_{$u}~g=IpnWeFd#^eKGoUXD&1o+Yt>p>SN2Vn%^c=uY?#6EhC1RWW=3!t=e0 zcD0hc1#(PLXbmx}3!?JjUe*hrjbMy&qWe4&a>E;~|7Perr{`(ZDC=(lcN5WQrZe_h z{Guu*g#6oqpqCATNaK2ZuGR0tnNrduOK_;ynnMVtwc*3s9a7c1FZj+_|K*_n4SvNZ zrmguWV|S3+fiB~#%;pkoaZ}Fp=rnvna60B>qwgJo1qu8&9FQy#3PO(Z$gXYkb9F*6ZkWjk?$+p z)vDLZQi}?fc3SGF4J@a95u(+Q4dE#TWP%}ap;}O6xDlPSayt$A8u*G^g8kS`M~)9W zh;yR(!w%$U?keR%(W!|&xpbnxSlWgf-iKNfV_+{Fb-Pi0p?eDS2Oq#hlb??jc&Ii` zo$b=6mKY74rEvv@Avat9k${YiJ`7FPQ1&yz+kbqR*fvv!ATA$G2yX+%XG$nu)(lQ zhb1}$<0O|l(4i@-aH#IuPF8c>4%z|ZI-YaGzj#AGLoy`z)o{LZl0BwEO-i>zow;%pXD%D z%@@Pq8Vv^16dS4s=ThFd2I%GX!#m*qsuhZYgh-I)Un%?Nn5Sba%z4m)C#l7Xi%bt; zu%SmoQ>p}SW{H+=VGbdubY}L3|D>I$9HV|Qe9;`%^`%Le-+P>u#}mPslT(~EtEDQ# zGf^0S`*8lV>^scRl~t+=@Qrg((Vz-%#mmGLeU$nbKW`qY z`|mx@R50-;#|p1Q0z62RIXS(2kQ^DwoIJW58&z>QJ9Bb2TVcMYWlqv?uO_GVLo@s2 z1_Xq{UHNNkg#_Yk=C;^p=J|CP)>tBj{qqt;Nk#(t$2-G4;?F{91)D-FJOlpDzlQOD zF!5ji$|#G87p@~$PBFXaUJd5aY$A*dB>kLl-5@6RCUIJT3+i&?2N$5Q{xQiB#JQ;m z{ax8Yj(Im@kwfoi=Kt$({_8uGf1)*gT#{l-KcyUJLy`Do2fd-dK4L5Nek`+lO|%_6 zvhwx9yJ1Fk4`uWp*S9bkrdD-AOEb2?qERvk5rrJWFm$~0#`ZhhzES6+W90p*b;4;3 zOhY7f_%-l=%Kib_I>5`Z&}-wy1WQVK;`@>iR!gi22>;FXKeP>qo1+{eU+7Z(&tw%(xxPuR@;K)!lTv17;+nSA z4cN`lp;+M}8u-F69&O3Mk8!@D0Y51Pt_6KK%$YeURs6RN#oN&Gvk{ig_BSb=<%bKg z%t@oe%_y87w~7q~qty`c+t4^->5)SAMd;CI$nTo8*~b5CMLF>N5=yO!j*)@8-JE?z+vq!a5J4`2;_I|apBp?xUVgEh{91>H;g>rQY zd;Z6VyfYAEA4GDLRBamNYXRE1z5q>tc2Y8{09Fp8>4P_r9|n^` zRe?TZZaBuD7$amVqLj4F_&l{yiRbZba|3PvM^1DV%VD6LKC6QPfdf$hUjMJ7S zILC&f1tH4#33>D$c^-P$5vUA}zUmqe!trWSH_czP%QLp(Etpi!YHnO*9yDZ0;SBb1 zQ<-}eL;Nvc55nG1j#bp9KQjN8#XcMLCm<96Log#gl*NqNz++4l{d+wo!>KW^?BWKD&lIGA!qbb{j6gfbGJ&5{Z`l0*^a6-2RM_j=R zd_Kt=7pmtU#{^}z?EkuxUxWnF32y(yb_|ZHkpL3p?xf|YLSWg%{V`wlmiyY8hyed& z;~8pRT>#OGB>X>P5_UMeV!Mp_MEEy?4 zC|GxBwc9Wc2hN86htdzdB7-R0HjL9URIDo%M}4uuDg5B9p>t8zMFY~&oNx9FjzM@d zccz8H-s%aju%1&fgd1Tqd%_C#oa*kZS!9L#U^c+J3{3%0zX0nU$a*-QlC^O?g)cF9 zJwG^WdJ5LK;==i6@8DP>B=1n*TfNP^jj)-$LwWDu0=>a2xx+3Sa|_LjV-02mdoAgq z##8JAE$oP$KMwiyP`;~$Zm^?RJCWXAKr%!)$WC(ldA^V)iU|g*f8t z85}PCujf=R6R#nde2R0{=pr-*`?}y$?EE|f-$UV5n@EJ~AEQW$eCNjAQgbNMZIYxB z{0g{-`5h@$T!<+?#XTvJ!94^SB}%oxxycImRGOTt=z?=b`QouyXo%6joGxq>ySX8F zPDuWd|5?tOmE7KF#KE>^jF2JwJbRD&J!#-cAMmljZ@1!40-s>u83*`S?B;h~+)y4p ztF|&3Z`;eeRYqf)>atKpk1zs_LZ5?wn<~P@IPq^|R|KK3PMS`tO(C^8Z;C`v#=H!+bG{Ou1Sk&{T|-58aKK~e$|xyfPB)vdBG zir6Cbk*+I3bY)0zw@QPq^YHI3ldj(QcXNoY?imeIKNziEFUgWgWY+$!n8iQ~v-X*Z zl3DMD67A4#LJbI)YG_zwqOwx@+fdS&fM}u)G4#18TYWfcvU-2{jLxyq1?cbpojojP zHf@?uxT`5eKe!MSlkQZ4S1O2zKP4})jnq#Jhs(nqqg zwqz1O&Gym2AfjsyjOeNqQ&lNm_=l|&L%A=w5c`5L%Oa(~loOmi^YkG01vhsp1|)d2 zn&XF;ede#qp~|JVa8eAk#r_Cu$*B8V5D!F%EWmbXATeUtby=s=Bs%QkPkCuvm#oJL z8?z&`V<4PUUQ_+8irK_@a>a+-_^7b0k z9IRlO-|yH6v43(O(_e&mnXS%M%MH>yHdI#IZ;fhOFV$suZbr4uwsT6FqNGUuqIar4 zNdTSjTFL7FWA07BtE#U5?*zFJhIpeA2|_d|N^l~m*hEAV1--!pqN0Lmi!-&_q9lj| z5KMyHU$~n3(^jjkIJDYotF~%UtWD4|h*buwARU~0uGaxaCTrf$ckOfTkc7eh-{*b* zJP$eNo^$rzYp=c5+H0-7_S#h7-SH(La86lc)s8e0`caeKkD5+cyzOtU8|d$JqhW{L z=qm-eJ!$_0gxLUEKo~YpnLTcu zqGsgx!-PXmv~Ut7|G*E)@hG@|;y?N<&9m*SH2HVJ^9OZH^MAtU#gb(u&X>RnM?_|X zA89R(s^2vOIOFYOr=PWF&m@#+YropP;x@YxTQqY35BlRZ(?R#QwdVe(^Pn)=#RT9YGM(|$0>PkjTOtl2k%Q>K2Iq{F-vcRq3~UoP)q zoKmk+cV(73w98U6RqDsC)Hs#8B(u~PDNadit6Zg~P^v|;KSwmd+ba3tMOP3;v4*R} z>pyvyq<7m6mQc;Vc((7QEKxht)eb_%&q#&?V1cAD>0&f#YF$mtBTAp{`!nS6g2*wl z5%b>ve1ZgRaC!WKNM=C|5eMo21@%<#f=LeQQdL6@Nw)}fvCPRQ*f+b1PmzCc3oaJt z;`jzN&v$Xy<`yXf()a-WF|Gn$)F-dTLv|&Nt6g#8aebyAJ!2U-5w41z+pjA6hE~Ef zSp+MKk+Rpq3vHL5@2_g9j!n)^bgzz`n_XG9ZZ<2t;I2CQM&fujY#+^1pKaovk=(;Q z!)@W_rH;|#19yy`K5)nA%_yplzEfScYHlA6uvGsQNl=A92%%QHFQl;b?gW2+KxGY1LlZ;n>Iey_aL44t5hOI)Xlfr zpYGD_aO0=j(OpqB&S8Y5xmua=Cka(x#9Xdu|K@T<`=2flc|VJ5W%ONYRH_{9VRyN5 zY!ACjmcxEF&X;1>Z3Pb3rq+t^-K?|wgG9|X80dAu1g$|a`@*hn(6rdP*jmKnPzC8s z8ykHoSh5`3_-?rIhtNY{pBn03#eAubUDQ4yHVE{+BlHav`Zj5}cZR-8$u#j+c>XPv zA0HbuusSvcZ(-zN^A--Im0&?%i~QmWEvG-m6_L_FbZb>KQ5D_b6=?2`g|6aBV5mo8 zF1U&H1I=UqH41`-T0@0vTLA(F3;UH93nss#@yihbj$V61-q}vRR+arTd~=lP$HgoB zzd^ZuiK2)PV}vw68UDwy7&rm1Yb9RS@v$NMDAR$63f%8B(}Bj!2EbMmq28%b?>_&R zQ?GpTFvHGCm#&PBzL=s~j%%7GdJ?1W&1iH*t*s2^PN~&U^$K`R(dyj~8LbZMK&y*H z7b#kO{lFxxUeVuZ^)Eb0r&YD>)#zO(Qr)fo26UPtQ3D~3MAbr^Sod}l!ik>j-ZcFN ziF@;BybIj$Rk1;2qX{BsHYj4}3jKB#U3pGb_S&lGYt_*WI%bq)tE0e&OvQTYkQZ3r zRmTQ###l$Ov#T-V>}=Ih_Rrb3&`6MfNAM}Zs$2t=(NC>yYj`Oi|F@0AzhS^IL+SyZ z1=(|0&h*aEpKASy=+DXgQGC}Z{Ww;CM(}4>n!-mlyVMkZ!@6c_1tD{Oot)EQehubT zyz9a<<6v};@*q)8I)%z%pH~vk8*coKO+Zd`S4US>4`ch=7^#!nv+D?!YK^xW*$)~~ zxhBChS5RHHehw!HzE?er1LNOF^yLq~Dx+UesTujyuW7l}+70G&H+4uXF9Q9EGc{d( zyGg~>XzK-P0SZ-3eqdFL9uX5UH5s5#UG`4+=0kWqfut0bYd)zS_8%nxO1`(lmcO?5 zS6rD@+4df~!WD&3;FZk43j--=6S&SHwh3HmV%!9NRZ*1=YktC-Wu{XiAIbI!vA$%D zd5f$uBsjS{eIA!eVQFSerLZhBs1)))@9sR_m^P0~gRyzsG#EFJn+jv|I6RQ$=JDBk ztA01@fSq`g;6wy(`W2 z+L1GNr4V!+GeFS5sgTn-Hx~gC3HORC51`_j4S@Ui)q*U34cCFw(Np1=d9 zyB-nFiD8}^X(4CG_*~;+zY)VV#o-T%wZUy~R{$E8u7D(u{ zK8J$%UnK!iF707EPCLMlFXkcZ(>pwZ8sb-owp3xuYGtahWwqk`YMIghP@cetN@bL#kVslXmN8W4G z>;=pNW@G3j7Q!OCJ{zcn(+6sr)e55*%Cl+qyFBSM&Bnu;W>a#@YDv>5>QyW1_hVd5 z8P?T@+m2h$pud6Bpuc_fXD|Kf%b!%`nNwbhBHPr91=I_Dw}o%6h7{4Aa}dp@p;SRn zfhkg%{rBBf=XAvU{GLXOc*-_Cz%F1;7Wg|rQP%nj+ z_|uLMcX(L4Pl(3`gg8?o-3W0eg!mf%4L`nA7G>;Bsx;)hryEk|M0CPO+xvtl9DlTi zb`#Hiy4RUxcJ#Uk+}VsiN#1XTkKw?^nI#RQ@B0NL$^P}mv!t9bZ^#x%5hWA1eID9a zpqPg3ItX@pt`X%*J%Qfb2Y%|IiF&saqO^}8O0zh8ECrCq*9wJ!Q1qggK!=U|G5_-Q z`Zbe3yHH&e3s9=C>vFF+vMVK~s#zc7buZu5`7sissrd23G4y=@K^8PGE-2+HXGoD< zT^u`mBZGMKVgpuF$u`lQgKS-_pKBz8fL`kYgNODFd}A~6|`3&`*E>jIEC7!rnRKEW+iEAw<(x>Np@RAi5W%s)vL-{!!e1o zs#w3gDv759#bvQUC0Jc&$m*)henUN7#5WY(sd+9Fl0 z^AkHh&s4V80UF6v0te2u+>hD+s)}Li_*|$cDdR$mlDbACaW%RcbM2iJOq*UCMi02l zQ1@M9LyMHXL8#M-3FNoVH||sX^k=;cb*JfxLmkUD?9bF=FjAC`I9%BQ;+}96$_fye z@(~BR05xp+q271ACvwJ;$h{D5%h8`b_#^#f`vw1L7k2z<(>9pcv}t+l)UzE^reSVH zIQB3445A$7-Zsqj%fy_^LFOY*dA|&KmiNn$N8YbsR!t+>hS7h&(~zf4YVu9upfu!Z zi8vN2>gOYGjrU}ZA#YDT3FvM$fUy3eHz1}Y9e)IA?F@fLcp%Y19sh^X+=@tab3BZC z=dG9u{+{R0?u)ECMezg0ju!{gMAkI6I|UY)TOYU*2a4~bohBtwnzm$mi(Q>zD&wo( zelu$Yik>9cB0Xefn~2NPbE=y2H*6Y2D%AbPG+&U%{=Yks6bkQaT1kX6%fFLS} zb@tUkW16Ss#dT~5(Y6GVG@p+1nYZGMCds^lr$`2T)ozw-0SFIt)J~B z%xPr}<6U#FhK`T9y8a7sMJ(%9lcyD~;y4`351@TLt;lCWsip(-dd2NUx3<6L!#>K5tuD-UP48)CH#uB+>(5t$#80XRzbE_kwC1YAa^Tk5Gpb`h$`;+c!n=c3{+hARl44KVH~GjOrTpTsDe&^+<5JSeS-^RRx&Z`uEY|1OXBgytI#%&9DU zz4ol?*d^K3P3_j|p0vuqddFI;9qD7|4bqG_a#lRsHGCiqzsQc2_@^@A7(ys_2MaEy zi+J}cv*oUNI$pM;*i7-bCbk@g&#hnl0w;;Df5@pWKS#Y?@ptJO3%&HGp2QVDodwsL zeD|*36DVSCZw@ki$7$iM%!rN8X(kxa&VDy{tdJaN`&VnL6^V&(U;VQp`U38lv9gr^ zfnrz{{X|;h3ZrZ1#*?HmP6WL5_M9zf!pW>L3&v;{oYsO+5SZTay9sV%qgNus{sjw0 zHvcQq)=nbje??-0AXGGJ>!O$|;L6zX-E?o_t!!KP#(MNJ$vbNmif>v?5xjemVcV1$ zxy|d&ZY2EJ))xEj{9xc&iZ9=AHTJpdfOb%wn)seJn9pS|EF0un8rRmLFq77megx>t zvAw1;$jOgQKC(vZeGo@{Cm)KWppeojV%DCtaOE-;=RxRCPLZvc$ zYs2Wg|79*yGUx{kYl#8ln;GjqmAFJ9_NrbNhJ(;i-U1L8m2 zsQjTCicNO)^>g2#m%LxZbMSu(G9$X3G*hvW_bdU_;{+-rK-$(CI7 zetIstfOe~Cj(kYpfiPmk^OLtC1XgHCPE{=f}AQbBG!CTnZ12Pd;Ae| zu$UCkF39N1QsSI^bts~!QI0<_arV+PFI zEHJ++`i=>6;cg#N?cjp(9wt1+n$U`&eT=7WHHBErKbeNM|s5!}anTh}|4+YLmgCuhPY(KquqO z0u-Zv3@jxaWMBPR1EaR2CI;``GF24lbn&CQJP6O$*U#{EH%0*+d7rvc)l%$K2|GmY zH0GMsXc=B^r4e_3!BouVvOE!KNu+FCUUF*;lQKaRX>bh4fFltLR7bly{qfnJN&Rt_ zWWfUZ?#EY1f7k9E(FA}I{uJV?aE zNA6?^g?lv3S1nB&=k%*D9o~XM!->-(*sS=?dJzlt`lAMMgV)wm_zR{KJ3&t2Xw=G( z*z8e@Brp3ceB+nq71qXxGNScfjD#n=7Aad_%Y?ng+h|b)el40zXhfp@04Y9zX(LND z-;i_PssZw4-A@=EX$LG5^e!jg%V@W;&^JHrofU+J%sQVG!EK~H3g2AGyd0i?G3CQg z9Zy1z_TdEA#IDUIC2L|MKab=XFl2O9tRlOr?D^Ui;rU1NE#a6|IoTEUTZh*^HK!GcihirE?O0Q^=mYiqLd?Z};vh`2n6!MNe$MIZh za9~KIHrTG*hAHS?c>ax655siQvhF?HI0Zd<(0U@WPT557FQIjBR?)T&FHT9+>(9P>$ku(y3oq6@I6V zjEMMxPW?QiQy_2lL7d+qa#Dv*p+h}7bSRcKNK5|UIy9sEt~w-F<4rkTcI79WjJZ2q z(ZWPStB6$sK;z?gg`d;o_wWKzB#$P4a`a~p{%8z}3D<=fr<0YJC*j6V)d4*~t$EMC z7p4B*?^uza<|>Wz%sSl0RuhAKX7Jd|4TaeUmMH~ zP>_Jn3Par27 z-ioWXwm%+e}?MMf&9_@t^0lTXD|LB zu;W94!RyWs$q#S)cwT*_KcDK)hx+qx{dt=|l;6lD5V&qI5W$Pp(Mc*_O+WV1cucJ> zTRO9ZLFt>F7+?ct^anC#vZmn1t8X_W+{fZ|XgJ{^A%AFp z3YT=P`9D~k?YkQ#I`6PeUrqJDR>gMbb!F=9|u9S219eG`89KH zEYu|$%AKurpkFm%8Hor&A%1%+Dm74jDx)Mdj^=)LLm_k-y2zEg*p+*ahYh2jOP2cw zzrB`>axc1aqg=V;UAaG5x%tU*PpaIcjB@w6a{IV){am@*t=xDkhZYx#@!QFlffV1!YfHER>dwJve-EXwCd(N z2U<-=xNIF#+?*{HL8V+zTpeapxwO28^i}LM+;Ez<8@3i*GcXc!PLjaX%?lnR_JXZ` z^jkR>yy9;Z{ER{!Y}gF8*;e92bv8-+8t-k1x!Coa(OJSbS}qoNVrr!9m1}ZY5|PF& z0|NgWkeH2xfQlp)Z;Zv*$o5CDr+%i^#2~V<5ZtujK9`rvg^aqY%m}hA+nB8H!WI%A zH4#h5qHoE>f-}u;_GAKwi{=hg{?|GbyYq%jqsycCe|_H5MS=@Gh(&i{D3x;MM}nuf z^`4C)&o3LZUpuk~4F!|_IFzRuL(L`x%bHkGF#_%>-fgabRdtsuB7p zMPl8dZ@1!!6T};0@NcSn)gC0%|T~9#%1ua_nJ~dCWT7;CaiIv0v-P<0L7Of zHFRmJ5L%E#sPZQz_K>d3X1{POsxHMw-tt&)&2)P42wqCLBEs^rr0c*z&e(}5zp zhHe1KoY{}$O-ti4M@>KEr0(9NDJeKYhgWj|6$onQ{IRwmeyd??uW-y1s@TZme~|(? zMzYkwFreDDk z@$>xO*N~Y@7S7X`TThnsY4^j^?hoR=g|W)@{hd+*A6iWHaQFsnvc?IQ?8c9*=+D8&&pI*Eu;Z9G1azXEN#z z5Jc*4P-Sm*#fOR3|eEAhhbkl3|JP+-AaOJ zC$9AW%w)g(RZl9^`q7llk}u9@CC6fmKHz$XU7f!`-mZH629!m*%IF(q8^E;{qO;TC zQZZUksV}*u7f(Q6QYF?1eo0puu7`Mzt6d#+-UkPBh6CbYAchgHyQ#Nh1Sh$#yT~N> z3QDFN62}DogYf()RVTd?%;(N4@tQB+oZsP2S(CnV;@R;0(<$Pd6ZjYKPW;+^^+SCn z@5JG%(w%?f{1X#oHKzO%93qhEpEy({!GroM7e$_F%pgD(@=o*)n0Xo5Sq< z2MqNpu&HU2p*GKjv+w7fqCs{D z<{Ft|6?N5rU$VqU@CD4!g^y%X-5^oPB8E4+t|;&i7~?22ZtxC|Nv{9X=bV*3LDa}2 zuHquedaj~xxlaxWH~hgElm(fT`vjuGed0>QpHVRcu!!pW_oh53oUifOw?wVEnNFa+ z&Kxz|q9FWf15T~!z*hK_QmguoaLl8UKobbu{k~Jhy|wr&-?K6RtORl}+^7ugX-sGC zP?%<_oGM2qdDdq?xmNHo&7~Qc>a)zXBF_qrQF&Gzk`lMexgrdmx+rk2pucYVZ}1bg z9(9yB;geDnCrLK7Gk)Z2G59sb1S@h1J!|+QJyyp=70&VEaAYS)$@kK_RZ4;D3j+5A zzDvW9iUsml&KaULz(oCVM|PNC1K;Cx@NnWij{P=&;&3p1_a|7muH9Pfh=V>A!a=Zz z7tF`6g&S7c=eJq^mUTZWC0dZm20VVG%T-ePf~2#IJN!qq)a)0vIiE3Kq~B$0uDQzm z!z%NTo?!2`>KYp}WVm~ULA@74V@ zZMZ7eVRWtFHG0*LbrRn~{kchhZsZU8$@RLQsXtfg&lUP}nf_eJAL%b#-ttj2vXno-w?y|(>CfZ(^N9XDs6Y4d$LXC?tn<99mFQA-h~z?E z{QfUZ-!+92!ILLLo#T;1H_Y)}dno+vt7N~|_GTSrk9H|4AK}humowF}qaP9Ytv-<# z>wt)#2K}%dq(Qgn8luKh4V?cx{HyeA87gV>XE5{x24`QcyrEYB zN5XfT4RhZ`R|!947SQ@}KtyB!^d6jSHcheGzh3Q|dhXD4T46exTH@DtZ5ISUI{RD- zaRB3`W5TboJs6ueoW-9#IT{z@jpd$n^#N{aYg72~0jwsHUb`>&K8(lSYqMz-|BvX{ z1|t^Qhv&L4h{Psp+wnwKWp?@%ITkY*3P2Ki2?vE_ly9_43I6oyKZXqM?{zE4{a7Kzg4A z0losgrSanUK3(&njsK;7-)q!&5P%<0vnO}Y1My;=K3u7TH@{Khcsx1}9%)^u>tUWV z4kM9NA?e&Fzo##;+!fQ57i6jEkH-q%qXTmP@Li5ci4LGkb1U)o+8O*(t4reJJ9Wa~ zKRMt(@3(*Xy1ijbJI7aDhn^IYPD>XLbP2YbfZ1&BU!8 zn1`Q=f4f8RwU!4%hq4+h908%RXD06TG)58D=3b@zpQZ4FSw;F&!ePVZm$tMMeyE>c z*|*+bi-g(Mx`~k(PHU>*U77B0vFdIcB2|F!V}(0wCxwMO+fE7#ch(M#Je}dNmrirY zyIS$&SB-$2)@H8@5!;K0f@^6W!H9!?M*FtGx(w&0ZUc^}Ch) zdS6AdKjVmwhOOOZ9EpbUl7P}Q!Gqb|sdce*1$&5ov0g8O2F(8Prs$MDZ)AT&=;|)~ zcQ$^(`i?}}2yw&W-&2t*zvM8-E(eIfZhlMzR(RQ^BCxcSyNJ~5w#PQ980GH?;w_9Sf3Fx zaH`}sjuXmqDEz^H$jb3c3iI^4)*;T?J4OZT2nS}aOdv6GADOBN0R3zr_1NRe=ssG} zs*IkN7m3zTQ|_Y6R43VTqoLV+4j(ZIdE@dKY8^>!%wpqvp^x7ZoR2m~3aVoEu2IX# za}5SIhUg&}wP@(o^3dmL{I*}K_K7B{zqVhNRH+JbJ6d**<_hH7dt^MnR_ML7~%*2o4&s?o0=`BFT3a>Ue@aZ~~nQ)DfBU}(!iEKqbHFs-YEpUn! zR1`0(=$GwRWo}fxGSIwb6Sr!@FERfmN1@n)X(!n9z~K9V4KKfU=5$hSAs9_rP{~kymA(`$rK@E;6L`@JD8Ks}R*2coGW& zV61&R-_09A*goPQG^eNY>g6f{&-OjSKlf9EGqyie*`TOhcj8*N_o_cUU;ecekJ;2} zldO5x^UJ@h6;iOr(h<52Ry@lbNGq{4;=ravJNS94LiKO9U?T>OxkYL1M`vwnpZkpd zNF;!`Y1*AC`q?N;)rOh5tyo3MMa~p{EyDIDCdd+2$9ht8Wq86C&3y$_@|mW6 zH0AuSFM!6&*46z$0dBFvvugTedBq1>kehkWi%`%s!6GmyDMKo2iT>CL#Izs(R3ecE zA@|UuR+&wVP@N!&<=>@e0E@)21{e{lu2I zwekE~oq^{qM_d2^OKr|aK}0d<%_NQp zepl3AD;U@d^xHqMZKJvHcU%&Cvhem-h=B~tmjXjIE2js;U_TSTVE);jwdt}3rwJ1I zpVassi7S#gaM8lj{~d1dF38p33w=o(r_3u(VBQNtGTKIfKuL^Ak{?rj#g`30Ta%v! zpjWbj7+_KpPm7YQ|0{6!U?O;zE0td?zu|m4pHQ;rXi2Ra39*Q@=W@p?w~n#%H|{DF zv((+AMkAt)8Ue{SCLk4`L}BX>Xb#*`$lBfSp|_=4(@mG%@1);&rzu>YkDZ&u5i8M? zU9Amjg0T6gzdtun=A<0Yyx9#ptWNTKN?)d&4K|l_^{0#SE9JyamLItD@<`>Mdw6V$ z7|gEbGTtA!fcJfN@ZQaD@9@^|Ly>mWu4nFMxs(0NS2GeXMjBRf5@uTt$GdE4pNj|l z9=?w}*Umlv>LY`R3Pw>}y(toYypOpyYL{rFIsZE`6s^6%9Ud(|M(pGq?;*0KOPaA6 zZ7IdM=hFx?PJMg3mZ+LutXrF4G0uJ8*PCVEOI?tgJSz)NTqK)m(l2FC=Bm_7CcOOS zVxdJ*w4_+!oo6FOZ(EG+Afn3gzOM}g8ez$|`1UT8`m}*^_}LpC^zl>DxUqInBlSjd zo5bd209WVKp!!uw2rwT6@hQxKKK}-~i;8+o9E)75P z@2soqB2BN?<>PmZ^m?81u)zFsVZN?kVkWcw2~|zc*Pg4LH_-z!cFjhHG-hgq5A!$U^FIO3N@TZ#JFXDT#S08~=br`c zCjC)XOXzg>Xq+C6<&i_@0{IsAwfz7>=~MD8E>Gdq;qPzs-N#=+2mA?r&{BZJ#L&+8 z6V@F5z(Jx1gvJJNVT$nsPqml&*r`2VTaq@fjSMDB{kScWVQ)klmTrkOZLSKB%L}l1V1X~y|op5lU+WW(>K71+*7g8 z_?rwX=S&0zCq0#cf_-`gRAngW?i&!s-&gs4&uh#|a+e=}>a$esad=O+7#FP&7wzM? zXx+TG1qRV6*#z=O*Lz23fzRxH-^Y??a6L8O;QI5K!1bFa1Gvooxjx5-%Us84lAk1Q0UNqt?-6Xe0<% z93ANr42Evk>|J*v7G$?aq#oq&!6i|_^FDQimE^wkus!`Nm&9SBpN8%GDl2{N^X|n9 zdO_}i_1=Ap#5K9sBYoWN7)9DRR}BfswviyfmpW1q?{xljI3>T6_>m{d@H06BKNTtb$o>+}!cAIqOUKbyzcwn^%*AlD z?>UB}N6*Q?(I)rRr~1m_C<2Z?a8DDuq~QpplnlqSu}WKMmzU=Zrb)2B>V205)jX{K zK7(eQm!fgDq3Cb10FV1D2=Msp8$sa%pwRe#iTm)j8x5B+nPdwd?}STlqHSNuK%?O| zz9c2f)9Eg_H~zjX#d~lR0=!{s_qx9GMqT>-D=w+)zO4MHY|Tj}CS8~up?ze?3O9bE z6e>l46=x{G70W9QXQPJ^>q6xG>Ysp34&uoK10J$k_?!+}^19JM=4L*D{ zJVxPUK!5{#05A}r{)n3&OCrlFifGLSMMo&b6x5~}x;g(l_iMQ2@NOqqPECnb)s#x* z(Ta2LNkgP|S&-bcGWjA#V-mN@A5!mrv{-$Op0t{RI4 zwW7uGt1zqo<+rY(V(%`kDg#Mz!?lNJ)!}6nWCmlbLh)~Rz1RUH&1CvsHVEgRisgqs zXyjbXMV3(RsmyP%{F@V@|8x>nwcepYPaJ)W%IHo&7RjsY--s0dl{+6+Df)YVXS5Zh z&5G!pSC3#SL^o^HU}Qx$FLf$sn|>JG`19jZX7H6#QZ=PMKcl$*dTc84pyf{fmG$Oa zF6cM?=+8CGi}WXt{v^6f^a+pq8V#B1mF#4>X472Rj7bfxB!UwSNHWFX>Zzd8D!?>MiOLYAq75QhHdn@)*FA(HKP_$JZ>ND3Ev3r%wBm9%w8Oav! ztP01y86O+Emt+O=_v2l0qVZp*{SkHh1$_HsWBb=Tvp-~iZ*unc*ucp(??YLQ8mDK6 z)Eh2bZaD>F*y270xWm!iLl*HKybLu%yqF(uOly24!mYnT#2DkQlE4^uzv^fC#`psd zXwXLgl8YJRFPyF+8-4y6kf4llNpNiRkIWd?1~iZ}D-yH2Cx+D1uAsm~bQ#N1@l_OV zw0Ol>O_2thn2yL%sE|wKFNHsr$eLhE93|^gCUO0BC0VtMgP;10d>Mo_&k0KbEhn2s z@EpBe`5)rH;kj&R>${+;5g|-+IHAgVy?0($<6?!(!+tu6T3CkQg2Lv(sQE7n%7&m- z+#gO-D0PP{cfWqWU-BCv`-q?g$a3YquoXWZwkWh>k>Df{m>4FFvA0JL)-C8sM5I3r z?)g1OQp=iW6~#>R)u>W0AH#IAA=fPUM^#~|`lhcN^)-Yaky>>n!Tjq4Ueh`y^i*`?EIb@Hxlds)Qp~zLK-eRT=Pi z{tJtQ^pStzBL2>QSM(7ZIeWbLdu_PsE{gIvCL;TIAmxOJG;Q4 zfTOSBrI&CgNz^G0{95sr0j(|yX2mz(;nx8?!Tt|h6fv)Rur1aPP@ea~dcJl{>R06Z zpn@zw5a=X7hCcZ*Yt2+GY?v@95@B!QmlmN(I_8TMcKj^hVR@pD0)+IQZ4u%>We7>m ze`T+PZ_GzBD-Gq1J#_gH|BSSKLrRZjRn2GQ={V+kYKshO6ID;u zM*mIxu8a-B6X)W&6C5ceFCecTTV4x~&AReyNuUgL}oevlOGXm>MZiO98c}9>bG!Xup;;uEd9J3g5C+!kypK zBiYLmA-fAuqOi`!^YtDfH{HpRwF&wmIdb9%T0EB)lMMwesIs66`3e9Ab>T93F*Pie z4c8)JE~*GWRf&jkv0_V%d|vw8ri0o8GoT2{`5_ys4hL0wBf%H(b`0C#hwKML&v|q> z-1I&#*ts_4XC{5l(}gZUI{{@nl5@=VEhy7f5+o1!|FIGsY?tLdJeHGu=+hz%H1h|u zokY03yM=d8vo^?JKkGgKg*BYPcrORnS3Io)NGg>zdLxdgSmCr+dS|hIIFi&4ul*R| zX(rH1b?mlU&gy};lm%1G-&|U}{8A^5nE`ji!CeSt#>d~EAc2h_&l6Ypa(SucljuVJ z4s!=A`1;lLU+q->I{o)52-w%}r#k&tbIk!xS1NJ(FEYb?t~=0wL&gK_s5k%6zPPZ` z_1|UazjFfp_byRb{<&NN{THhb9?Yvu(|_v@7x|TIh|r^Qzp&x5?O{?T(0Og*H!!nV zQAd!JNPQ|z>dI4PN2oAkSRQFUC9lOB-VKQn%U!^-Ritc1-Jz-^vfu=hwRk?cas}K0Lo6HNG`&e8C=MuO3ZHjdaqr z_N%x}nglxVko;+oP23RZS9g83)A5)6w8iOHKfpF|O#VWBpl3K@m_=uXrmO_( zU_@Mx+n%5dP6Nui`mjjsYTW$GoVEKQ1f|5(tf}DEFTt(9Oox!ZqE8ch@McDFg^0!M z_x#I#YSc1~i|pO}n^;Nh>2}yCDLyPn*pq?qCVCEBW{D4Ekqp!7k0LCuwayEWF`hhX1B-w7s?Nmp)Bv>f@tw4YtJlaA?~EaB_Yucl6}oiG?1# z!boXR8Fk%tm*&SWk91U&@nIJPWTM_X_2aH>RZaE9@m}e&vLje{eE^xiLQve5`b|wuM8!J{aEf_vouq$I* z`t$V~ZJaFZSGvt1(|0kkJUfOB!EI_Lz@tzlG)hJ+=4$BlCLOM(oFyvP{qU4IC)Swv zg2oC)OV#3UGRmlB@7=4#`{1zMYt2nju1_*0MG$P9oik7jT~a-4Mdds^Qtfjqp4Q*$ z@PxKRkBY^*7n?8@`835aiKd8`@;)*1-E}l+OjBhjlC6${Ktm293*R~MO1+qZdYuO84m~)`!zinT#K*aiM z-N}+B<$SZ+eWTJUW#boaddVs%e5Z&)A8(al3OC-XXFfnKyL<||Iej8!f+_Yay$*=N zX@%*A_C@bPHyy~q>|_O#1$C1jxfW@I!t|`6#sslfe5m%fbfOcVf>QM2cWY~@bv@`7 zhEJ@pdZ_Qe@CI6!>dpv|u&Tq?L;1QtUwfZzF`;Zxlfu@09X=e#hduP+O8c<(XeE>? z$qL`2-E4Kkc8};{q0_8d$0l_J$&ri|-g*diU+I7tVTiExgMqtQa~d$737B2-TL-NF zo>IGkbvHy!yVr!KwN5(B%71qf^3GFQ(nW^HF6N);ztZQQjqmSz{u%AhKP6Sodh5W721Uzwv(&^>9VQ%z z;4m2=M~nEOU;F#28T7oCMSJhBB$$E=Yx`q9v>n?s%lvaq>tIP%VOJ*d`0h72?=kWR z4(Wsc*VjwrEnp5{Vw0{C8`%SRoQ1%HNs*YXPvGxU`>fHpO|pq0nUJWqS5TuZ3TYbh zUh5cJ#6{(7m;C^MB_D2nOE+{5d3k0I(bHLZ3Rcd`BIV%<^fJladOq>YsYvtXQja6` zq)5xE^&`XCkuvffmM-Lky{G1+Fvz9peB%|vCKBZvV6D82*I)3H^}Mg<+Iw{;=M9NQVJOT z+AY>R*@V!O#;o4pcRP`3{K}4IMi>0~YsL6A1ori)cXrC3Y3q}J4v2im>yyDUmRp|$ z5#KRtFNGc)q1QCBSiIiimA%31U3`-*O)laKbHp4e^3*Sx*KU10zvlw8uXDJVW;N7U zU}Wn^U$aseB$`!?QT;@D=f!(5yK_Eufs%B};3G*bL3+pi-4v+Wi^UBFsfuH+xK%`Y zz}#A|7J^m8Qfa?6B7@9TM8EJv6_#h&G#F={r!NLBvbs)U^;)yb9s1=Wcpu`nLZ_>e zUwc#10ylHVE$Tgrzg=cHEF}wkbpbQd#!oF3556F`|2lEENLdr)Jp0;Cj*19aIjyeL zv*_o3PE@Pqx&hR3yQ_sn{{AlRhUc1q((Vj|_dkOj6LmRCnJgszdE=X%xroTOAl|qO{;7m+ zQ~b02U%TWVKfeALv`^po(V%Odc-CJO3wFzAs-|7=&r~x={*4_Qtoey(jB!Q=3n@t_ z=ITacn>Ab#Oep!AH2ATR(W3~=OX;^P{#j=ASpI6`AD`G!4K-s$V!`iJ$a|8JrU#5< zOE;eiFU&&5&x-{X`4tnFWw6y$4XNyT$5t(BA%m@^I!f&#I$kmuwwjj7R>Gvx0R*a~^drY&%eX+Au1 z)yKwZ7ARFNBP5czNx;D9+K_;MUnNa6Fxl*DUsMijQ$~&Q%2?lS@w3GwW$VICw!y`i z??0-zz*Rh3%T|Kdt&R=$SI6)Lx}~wlef(O60@p7l2y4cos09XmmYDVgkS>LTMYjIn3VQ3e%XjBMoFStvBo+ojLaQ9WCN_!M|~Nfl~9|-*?Kt zR{ndw{#fdLByvLKI9bF|!qF~YHSWMjARlC76>wgemSQ3e$oG`ehOEgQd z8vEz09AYNFv({;?N@r&(xxgt}(i2aIsfON9mV)wFXu|z`eEA&$*OoOvoHn*;H>lI( z#{*PiVbHd&*8X>V{G`6cI*_IwZC7#0dOc?M*WU(E{}|UwStOO{MwAe%`s!v?tQ9 zJm(zipK^|wT*PKDcLaV@NmCs_(8{$6$-IJV{pfcOXDyeo&gPs*b1yQ*<_%R+*k2FV zQ^iW>@Y}ndg_z1H8#+&;7lmIQqOFpy;`-6|TLmM?14s=7P3OPN>xR*n1vTU^2i4$%CjDL6@5V6DsWoRm$tSHC*a%^Ptr!e}EmXo1@^i_xE0I1OG6wam zWqG+ze}S?Q>EBYnbzjRrUB7j|I!*)d1$mjvHB*-xe@?EP;Ia98{!Hayg~!>OBW<7T z=lu7PdF_OFWL>Rrl%sK1k7?aMtD-ThvibNezWvZ%J3w(EZ6EiZ_x=_>jx--bqRvfK z(PbpYZxyrmuAg-Y7EmcoHjF;uXwVyO(xyj@5p$I-;y%(`QR3ZlJEYC<)Z2rO{lDAq zKUf6c(MeE0GDH*82Jd#FkTiE5+@jGj;ZFSLp|X$Ggd2y$ZLm*G*}$y$ak_`>CJB+H zN{}?Xe%rpaq55t6)g2^^7}CpDU&8?*Go}&HK{CG?z3Z>PFcfZjRnwzC^;x^je*<01 zwbNB;jVg`!ODWM+(vPnH1^F9uEe3er3!+PT+_eDJdS(w$Fe?Hxeu4~(NK-&lV zXTQ<5ty|MtGZ4b#*In8|Qd=TM69w!e2(}eB=QdNWX=V7QZN%rUByu?xy8Q?UwdHL| zmS9nfvm<<~oA-Y^3CXkRe|aCv?PVBbpY&Xjf1PR03+PxP&pXnVZ``gu_N&`K`P?D_ z&x%4l9|nq+`G2NN-O}DL`tT7{RePpzSRU|~hGQw zRNB00GlAFRRewsc1{2Su3G@!PR{xMx{YOItk>+cGRP^}VdX+c@D0LX`YFA$p0*IL zg-2!6xHrj?{q7AxfLaYTmH3tM|^!o z*-Kp6pSZFm$+G!Y_DCxW7v+xSJI6oUKTvmRTlz=n2$he8PC1kWBp2M=F#!ph*R0}( z(f>X~9ryEB+-2o04@m*S`|d0>Y|BG(-;+7A-v&|(&uhh|QH1($RJhJEkrX5b0m{<- zz`*U)qG_w3a~6{Q2CGKPLh@5Sg)xfYpBGktZTolP+jnGHI0iBPy42?lWcjzwPcmgB zx-$~X*CO=8@WU~91ei`H_Icv67k#Bhg^|-6^jWllrFgX8nF~%1n82`CsXOW+y z#7-b$inoWz9|_9Xj&qcd9)#hTbg+g4v5JOsL|mhZHmRctCYS6ugGu*13_7ROZ+Q9Z z_V`3}=1#(k2Zp~6`AhzdlRP#4o?5i=&x`o^OHSQS)}rkhRsNDc+V=oR{*s0EdDr<% z@@^0k#{o`<{3VwsWt-N2aK|odhN!?B*a@9m-IJ6YMIx^aUhXeMM=~>(pPXY4m!F)c zYs2Uf1_hbb`glDJ2%qNnppK^wVJsYB{Xoq}lc=!%f7frnSkv>dtiWF?YHmKBEq%3& z6<&8m8`|dUNO#)(weDrQ5A6~tu|uUyNA@+b>WanT%od)aq+qkT7Y&d^`^$~ zP@04O!Pn0Yd6OG`DdkrG?4b-CyD6oz1d_vV23<(iYcau^YlgLEvc~Zhr{iH?cSC#} z_&*vW7q~4g%fM^y)u^5F5ox#VH(sG^V*@VyTHdnzcU-xP4wr!?6$Wi%DW^j&rv0o< zW5SR3P%I2_Fm=V41>VC)h+hNnZu6TBz;rbb2GbppDoZU-y`bU(u2nJjThE15ArENh zk1W99Nz2E4s8JZ3%qITkTGe(7pO;SKD&w@E=3gcVgapHfg&c1qsd3nI%; zDF8(bQa837HlIzKM3s-@a$TNxv7A*{BSI(+5T&;aH~msk8x7axWrc4p(`~1g{YW6c zUyOla%CD&1V->V-(%^WsYh%v3l6*>S1fDqt91vUSHX^<;3d2 zt1DyOOIz4FzW3~$3I$zcC30F?P6_|<;+}cog^RIOtIJ*r-}E3i98}$}DmuQPh0njv znVl7080Bf|7(ZLWYxFl|JUb*ugUEq{5f1j_v~Q>X15+b5a5)7dvFZCr-Ha$|{>J@P z6$D)m1oq$rLEP}oKH(eLXv%hg=^yzU2O8d|m}_QSY!F%T*hJIL2@PZTzHG&uzT_(J zJ76pcE92U0*T(kF?7F_>i0<1%`OA-F*B#l^>JF(0|M8fTOXq!aqz?b0z6CTKFJ%2* z1EC)TV-YBq`cWRfXBjJ5UqyzIugL!d+>7&4{$ciS-7Vvx;TtyMHuFlV^(?_Fbl{}C zp>*%^`u6VE4CQZjUC+fd)GaZYAKmOnQTIfZ-q%&=O?~1-e&k%!pT9la$K4Z$>rvfc zO!Nb}>s{AdU*;t8p+A22b)RJ?LW@PW2(vMyIk`WF9HP+;z%s^6GbcE_!%;+h@4~bG zv5I5lWpGo4E|L%15fPkh?X6=-kP<1xvAV`a0zwj%t-a}JpI$wo5vla1 zt~#K^&*ogVVaDL#M3QNTVr)Kt2a*;8)C$1x>s0_StYB&+a7+qdzY+ z=9UXs_Edr>moX*E-?ii|r9^N~tD}9y-$cii zY47s)f`iTb7!J1Rl8%E{SQ!Kd%%qNZz<>N7Wc3o9lMD@OMCCxE0TLP{zkM`3q+8H% zV1R};GV=rfPaPht1bDE|z=M@c!$Xb3Lt>Edz>XXj1Jk0jq(FrC1j{tR!wfV$OtYZj zwjQ8?LW=|i6n=-U?d&{x!Y#3st(j4+*+Mj%T9w~~Gd2MCvoTEkxjwX34WGBDnkZ5K zZwMz=m|oZ0Q`ZPVlR`G_~q>3*hRw>tL>oakK^3Vc&dmPOubOR%CT!pahsr(4Hhgdny>D*Y7+gtPyXq2IsZvzbV`nC z-l%f4rhVz``Htm!{iKmE98#)k8H94KPSIdsO&f7bM$Z~ki7Je!=%0p5+o+7V82UE_ zDy@kcv<*u{D9Pp7bDvt~y--X8WDC0aZF}r*w%x;zD&%U_NeZ;t2ce#q%F4^l(dGY4 z_fhv;Hy3uk~U5H zjoCN5%5VLhgHd`d<%IVLIVRKdTbt*vrG+#vd(RHZs(C*AM;6=~T0d%OF)#7+>8*9X zxAqVB?W;T)L1^(9#NP7{Nd9uCUKD#1=LR5Hi)JmEezydG()?nNc4)%tALrMP=-CBCldn=vPE^DM9A#n zaMQ8+o~5LsNLlU)mvDZ16&lWHZj!2v_s5rQb_H*PpVGN z|IB|Pqs~1Ypm>4Qe#5qI)Q~v0bMZsIM{!Qc%RiW#6iBc9)%tmm0fdWR_Cv$gLuyIj zy7ha(`iT<6C1hiC8?h4Q&wMnC!6Bb^v83rX&p-92bS6;sP&W>C;)Cx>#maObP5Wv5 zaeBaimVK**1IU_I&MA(ajsSa}{gmOy&&+ZADc_Q1gC4O*i+6u(k|ATEvq#x-Lbw|X z1>-Ic76gnx2L_<+c>O#)UjY|B4C(YA3;pQ~6r1(eI&TjnZV^m5EiTCj=cL6#Q})N# z@RYvbWx2T+Pu*Ku7A{6GkjVA6+Uf)MmC;dRE(FXh{wp5f{RBEvEcC}qfP3xPB7}*0 zeG)*Ni?CST5#?U>v+0NyeePC%m-|xvLpIJT&Z?c;(maVIE?I1UM(2zaC;A|1OvDm@ z*V24?PSe^OBDDv^uI6}`=h^cUe*7wb4E|-yRPI|W?eZml7mYr5r++g`0{XFI^^jG4yaymVzdy0i zcU((FYU!|KOIE+P{TaWx#1lKD&xtA8AV}6pL?^0DN+K_{&NR&n-{aey=shJBb0*k;Y<+B)rJjGo##FJw2w=H z?9Lxl{DOZz-i>=Corltmq$_2aY!3WM&zfnQGKzg;nD3;QU|-f=UD+_JJge>pm5NB< z8yS(_3WusX5r__{kpHQzjTPv_JIk zO(FlHmU3hHErVpR^w*55>@0$j{Mzh_Ecf<3g4O)XvVYOKINdf zZsB)T%sJIe{%rp__)`$dkM$);nl81X29fmEO8FnQ&u~^NZaP`5j~|@0THmw+5lq#Y zeI?LY^SaG%pO}=y{!V_3Vj(DaAv%K9r&mU2F!nW!wZ-~sbJlbW*TUgFWVkAT-X|~P z9R!6Naz%BY>Ro=g9ELi+1Md;)qBofgVs`pKvQRAaUjJVH`q?PKk93GI^<;hpf3jb( zPma3v<&$8z<(S~4OH*Hk3^XeyrZlnh;gdcK?@;W-ho!H0IsNesSk9L*)3qGYsKd6J z%X1j#iP5DEZ_h>ls%dFqYgA(iZ(16*%?&qw4u0`mwpKK3nOl4C==OHGCYJc)aMTcv znkBwCK9cX%uefr}wRx(tib6(0#=npMr~T<%8!G<@p;%$dvAxO9_9;3uh?#_P6RNwR zcF!?jvnsNjP&0N2_hD$NDwtv0J}^mgo=`GXwNBIbwY_{Vc%pkHjj|8iWyrX)8`(3c zbSj$qgUE~L@QC@EI@zH&$8{_#aN=>fUKlqdp&q>>0YV*q> z{@4?yC*7j2cgmqw*3MVm&()I*xBH)N>6*APkxy{bJI=ze=D z`sTDBIgx}fRlv+(c?ag!#|Y<0Uc>13drBVJ8g?lP<{hgvGUS(VAxRitg=5tZf2$6C zOT$${+2_a~d{2(k&$j>2$qy!g99kF>jo_thN;MFnf$#VYL|g*|OM?PK8a2H!yeCi= zuKSAKz5Lyz8h1ZQEY)mId_WqxbkbCeey;S#K2L}Q5OtLGOQvt^$8~i@k>&x8vif*c zNJpB^V+sBOM_Akf#cdlAaKqIXJdgt&;tsybAx^4x=(KhlQhhCQPDwy->tmfnUi^|k zt8(<&KV=_Ja_i^H8sO)LDULLhwuc)ZfnK>|N5qAqTsx|nQ@W-PYG2m$)$Bvm>NK@F z9U?6d2HpH|{k5+3X`+Ma4EKww2NaY?NK>sFR2e^T+ZxRd7-X`V!B&!S+W1Gh%pyV0o2W*T&p5?PhDt~VvOaki!Ga=mUEZuvfIUCp?fwk z=*L}=G3clL$PIcdck+L9hxbWUmWX}0WAvrAP7+UqzGuxAPE9qN>Psw?eS{JAw$CB# zFQ+IpV8SOZ=q{tvRGwqhj-oF^DO07(>itC0>@v!qIzEjAmReoljLh=XO4888SXk$XKE*qn%9U@-VaYO-HH5>CSBEySmB@Y zL}kzuUau~@VSNVLh@h?U8u^kTDY1E>1H#;JtJwn9uO8{t)%eg3dAj!NxB;+Ul8cIzN zeGcG(tI#OZK=t%I9*bBegY-P!h|66Lscwy*|y%C z+`EdLm0u+e)#jd9;mL2&`H!D*>KP=hatx=1cWQ->@hwq`o{l^SimH3W+(S74x51oTtWY4UOI zvul3SiH6L1B>&F!JDWWN{b_gk=i@JJpgz$B`?3@NeEgj*_-AvUB>$Kgkh0cU4E(qJ zbN#P7^?j%O^Mj$rKeZqG{4?cj@y|$V`Ih{%JjFlj-9pLgEs)T|O#NN+&zgriLArbV zGxGwUcZ$S2FtMg1ku$be#Cu~Q4T?J5WD9kc<2a0XONkJ|f1Y%&5p@{R0by+33_tUJ z@9?cBo#E?YdXt=mjMrtQ8tM71M( zObY2G4NZ-djo!C%P!`O%HbEzH_u_{;SJLdWKRTA2r0&%S{Ar@?sm`*GG$JkzRqbV? zE8zXQ3Mwe)##L}B@tc%)F$bfke{R%!6_>>Kgff%W9V@OM{mRz;aqx_$rjJikiTqD= z(dkHRSbyF7J_*T5lF{^MiTEAWqP{aoH=r}%pT$h`)?VZkWx6jF`NFSh305qHmrQ?-tyeoSj$^Yn1_DPZ9evNN z@c9o*zqOWCo}Bt?Ym|!|cnZ)5z0LPI76grqTV-CNXJmOB^?)%ci%HY<74ljN(>aNU zf+;#JznrpDxrSb-mxoOrI%h1T^2?R;Ox{Bn-2N7~sDs{X1ks4okJDz@v~M&x5P<9< znzgwpB0qACKLz>IjHPy?GgzLvt7yRIQcb{^4iGFGO;EyzX1o1~vD{Ot-AB_zX{CCP z<-xS>9pN*2xmq@ErztUk*g;jmF_tLJlBes1gG(R7+JGrt%yP|%yX(0l#Saj$K66Xp`_yLx-I91Ny|&KxPCq&_WgpJc&^xEEpXoFf$&Sq1 zn#Cv2=nuLNhuw(5W1;;Ao3r-ytJEBikf5Zj+Zu@yZzpu&He(Rj;hT(8YQ~sb6&bcp z6Y%DZk+$t*6|c@C zPwiXj?`+V5y?LLo^;}EcR%#DSNqU71=LJQ`gFk=++xca&RLV*M21?XZ&={KDTrD7|Yk$DhQp< z!e#M079+i1^QXncmdRf4+C>?Z|C==F>dUXAefotBVe%ILoMhXEw7m6h(C*dUBQF%$ zSvC;a++gwEN!C)&3QQviXS5`E3xK{T@w3i!9Xv7q86NPDacM z`NBJONt2fM-sAUcm;0aQ`t>v15+qHnvmJlxd{cEfO&Tp>5sAbB-o^7xV*1tuLGFB3 zjH9zR|NE4OZ#9LVAu+)ODGJZDZ1#t_WrgyF(SQG3^Cu|>Ci<3+a(8miiSAw-XMkz4 zh*WEPjZW5`kyjNhXHRJDkfG%Zrk@^(b`vsikbje1o2N~#4KEXK{>>i5S4NkaYqceT z?|YdRCZ@6`aTe}+SV}n`IWLFrI6I~$8!ObDT}r^{j+*qAH9(HgicRdr2?rlAEjy(q zTe(szqMI7tryq0+YfpCUm<3~o9O5FyV}-Z3_i`==;%-OXsex{-B~$LiA%~Dtd8k;d zoF%RcXaxN@*$QhfuIIFZ5$XTh4{W|(+cS%)v4jXteBj@I38m=W4MMAs-4z9xDx~2n z_BP&~&YeaJrV0s*oZk}Pp24mG+a#}Uet0-VAINjW1muB~0IM4CNi7Lr*OC|rL4xoY zw&eYbk$ErbP`cu2y&a{cU+4+N4+KoyZW#F{3#M}2u^an; zHu*~C4UikbuU8j%P1Yp8iOF!SU1vU7s6iEjg&Y&kDcQO1XPxLkvNJxAsU$htop0Ru zpO`WJsbRO76R3I8LMDV>S%|6L3jFOfLa(xTpb;X4S8{|lt#%`{<<}aaxDaCN6RNg`b(9@Zm z_=PrX;F}3{$MK1rs>K;n2ZV2J?b7}IQgeAx*DrilH2tN}*Dvy%1>C~Ai1++ujEf)e z1UTO3Kk)&}Jb&ELPyZDCfB@)1)4MQH<2067=+&3tuSd@mDvTT$$8$mc86bZW-hyL3 z^pTGq0P=gVIjGKeAvWjof02M_QiituKiJn&6F#7I9k|>HL8qX~8 zF4u8;(vgzevuCgx7n(wIW{lf>X;yewGpFg950Y-j23ajS{mEqIqn$Zb_OpNf%>tJG zZJ^xwH?;ZCSG}@K;q%T?P98;Zc#wI0>G0aVoKw{b{l_b|3AM^&+2(^6G-a%mmrR7E*=<(zTZp)EsY@<1A1D(oe( zm*F*dtS-u$bP+Ltf^2x{d9hXgU$}7e0u(qcWp6&~HX@jmh>g7Oo!%CI`)M5;pfVe(5M#F|$F!FnPLs+;>zFJ>%EpwHyNYJGioBz{sOMjAr`k`|1M=76Hf&r7RIDE) zD}>e5&2D~$Z{OD$u$#NA5Wr4MtH|8AcIY#}XNNa!3QS{%7B_dt^0)kRP?o=Z{rFM-(FQES z!w0Zu~V*BZMtfl48=#N_WJg)tfS`JeP-OAhO zc5lj;sxDweTQ2fpBAUx8B5lkKxNg1E3zFQ)%8|H}3)EJ@xkedJXEvgIgG?Bv} zpF8!8voEeHg=%KNo!pjlw@dDfh5CLPpzo#rKKgD`A7lA13|Hd{Igf6@<}mwPQX^9K z8hTXOYO#-v0&uLB$61pf zQt!XFqncLmBWOm#z1-p#BJ;M%^a#f;!rD+sr#_QBwz{4F%2iaAjO`P8+JsX(%95fw0Mkc94*T+AQuD|RGnA)?8psbL`j|H}Y<)5>dfxI9thEH=f8OKKuz ztL8i>;W$eb>XWKw1MUvHjcA7?Dov|M*WtjTEJh#vNiRqE-d|R2BfY~InjWPAkLCaU z2pi|xZX-4-Vc+!1vbFyB`l4Ios}Ue_>0$^y*dNPx;ifZrVB;Mrt0@gPjd4FgU^%o? zQyy+QiYGQa_kYarXxb9`1+Au_N%Cn0=&$FYcL?CAYXP$LFu<5s*^eJKzcCB~sYQ}x zkv<^+00Sa8VZ_!Bx_KKk0u1PM;c#k-o&C>9q|{`xB9{O9;f~mIkTaMlNs<;DNKj#+m$zi&r%L`97_Hh~bau zfymS`<1%Eb_y6$rCh$>KXWxHV0%4s2L85>L1qIijqC`X!7MXzwM6otX?SmVl)e0m7 zaf84lG-*0Cw$|5H`;^+&t+v(HA}&<|ltrx~whGd!)wbT_Xe-*v_LTg;zw6xh%w$3B z^S+-ypAVUPIrmwvbDe8H*I^-urY8IS^p7Hs2$ksj&)X%69XF@{NjICRGN=l$_~Eor zOc1V%_mU15OXiPO1MfuJH1M@d1Jkn&yks0T;u_d)&)YQ6tT`S0;Lc9SDF)5_W?qnA z68gt^j9d%!wG5j)Z1vnGCLa8=&llWGr^(?z?n-^M$=n_8sU=U5zMLQ7Rde$*;F9R< zX{|3-A4MxC@D%F#G3SH`MGR&9hT0IAHiX0bOOv191oP8p>$i7+vc8OsyeUUS)8Om= zpb_chKD3|ut0_TeKIns~w;=*(DFsWD_W=Z}>#x^|Cmvz+Aj(GqLNY&Z1)+L#D4dx1 z&$oa?^_lvrDALrda$bvhW2%+2#m^&T3=jb%f75clY!TZ9H~D~Ori8*{ak&tu9bTxg z?FIY^FD%j(f5HnDz`elUmg;e{2t;!k+tTwU=eyl{c8_!EA#mQHZt%VVf&sHhbrts^Udg)v%IgY4Ag@WarPFK`=Vf^euIm zS(P!aSo90oX~0uG-~iZUw-Kc+e?ngqyctFz_FG?5V4pztO3f6|Oc?*}EscKXWMmAd zt_OK@ttdJlq=siM|Hw<(Ed&Zeclk&5s!I?^t$z#% z>vx@X&JT!RzER*Xr1{Elh}UtdJZpv<`(8jDlUAuw$18s0sAJn^hxgf`$A0|*ivbAg zSte%+G}Lbpit-_EpryXlCQv*JK2UhmS_vB7KA{CQ8R}5;HoZ&^?n+nO{y<_Q#YvD( zj(P^oe9Zqb{p81@Ru0|#Z)8RJnSGpJKTOsSzE|{ri-qE)9GXbQG!ukM`f6-y4Q$}w9 z2}O+v)m%1Q>&G^<@g&mn=Yn*p(sY#QEuUovYE|+hurM2`(qSBWQ@JlAPE=wO~ z<4^1(O9m&LP(u6lVk0>{BmZkv;J`7H0nC*$Mp$6)Nfx#6@Ge0Dd%Q~+LHtVCyTtr7 z?tz0vSkt8m2V>pp`Oinb!5hI@X&Sv@P6kdL;3Hb##p?qS)hBm%f$#q+$=Gk?|5XMo zOm$&5|4(fOyPO>-nLo3eEd0aIf-ifMPQ%RxeW}AW{6sEEX>;xDJ6~Y+_-)K}F8fN+ zD8y6_P-N`K3liA6y`OFIiHMNi=1=tFx7>iy+S=e;wx*dN{8mJga!+!l4CNeuEx8)8 zbZqO|2PkazyYI?XBAsy^GA%I)TfBm!00!Y>$^187VKFAhy`~?O7xIpp@mKbD({^yFDa=|T^u~WaZGLzCHfMgn+QsJg zi(44>6~#8cca#6|Q|7nr`BHr$Og7KU-!B0Ej(>=f0hhBJwtJe(&E1)DL;qXpJ~0`E z++jce-oIO?hQ8Q(RjlcZQG4M^CSG7ZzLTgEaXxZ_`zlFt@OtAS{t3qZdWs~2d$)^9 z&30){eN$~h8I5xIjD^`>J%nXEhmHF=Sv8&vj0gTYGW)@+uVv_)C=+YC{%!%=v8aH) zCHtLfE}d-786mMy5@SK;5GNMwIvzKRrzubO=i+IN8;satDEajMl(kG`$?Zn(>lNc*5J=|#O}3YkO@`!ycj^ZEp;~k*s{if1#5N&69B9_p zq58+v2A#JW{L-v1D22bY<^a)|hXc`G=eB|9A}obwj>&~+-K*^(db;_4+CtRU=<8-D z@^gkTc>=1Tle8}3md_}HtRjAOg1T_z-3Ct&0I<9e=p{S;vL!6<{`; z4~htXmXdu?@mFowLgvQk(-5CG0K!QH-k24PClQ>FGL-K>^ZZ4@*RKPX01an6IXTjC z>3WC79h9!gp}NWZ?;pmi$_Z{deHTxcw|#__^5oY4E5cT^15Oe^J7_Q;i%u1AmP4oi zzNlGb+tLpDULjkdSV?mDiZ`%0bftefzC}*D6W-L~C2T+?iYakL`w|6K!iDBhhQJ0@ z=skKHkn9Up%m6Q-@8@Xj-tGxP;^FI`6KCnSfgj@k)N@Nl{v+w)AO@i`(O0iN1?UwwCwJS+qQ@yk6WrAj4$lxfqLnbUi2Y# z7XI9&F3-F8YvLt}2_s+>J{``M@VVzjL4S;Uw#!f1S^ko4m#a$Ce(?r*gT#&8m}%Bk zD*44baEm`sS8-?gOF}DkR9qIuzIUm}MM!y725iZ95fbT*CR zCb(dJq*1$|Z@&w4i!^<=Sw9#NpZnf~MduU06=^wmUS#bH7hZbz>QmR^xp*zI=ettfd3$bOVtXCC zypDb{e9RyrUK!oI0MFOG+l>Bc^8tBF<9Dc+nY^VhLPjPRmk4ul_ zYBlfr>Z<~MHE>=t&(`s*K+n4HjGigVsjBDlXrZD#+ajDSQ4XQa|EWBi$x7(c z7V>+89|-Ix*)Ad%oh;1c+u=Xjg(_V0G6l4c!A3&Y(PqGMZb;(Jf2*}NaUegLdR+Wifj9Ujf552|+Y%@@zL8n{E|s)esi8or z^S{57vF#Y=#x}lLQALu8lQsAdTig2yGX$TG$(R4v--+N`SQTv(PD_}^FK^cn z(K&ptKGEdaD4NlMSKoNS{hN&!V4X~CEOo5FgmyO$uRx(Q$^6ve4$9+wD61r6bF{*?Lhpb3?qQ}*bInw{0tDk zvobh8^WlzA{u`+Wy)J4NDEn;n?ha61_CiM}$C^Jkl*`OwBZF|KP`+2eFvL-C!jEvM zQz*}C_U8DzlaM{6HYu7lhyD5M^IzHZ84)Bw6Y~r!(x_>$_pIYSM82O!HhI`%zMO<) z{jpdLaIjJcJYOx$ZRUfXE$)L}F)hFg3)1;h*-yB=T>JNz*~({e#?WfV$C?Vuo31P^ zC;3x({a>m_Obe~KepqW+?Y~cr4`$%DQ7YEBE7tgDZ~LSBThneA`fvW=`&rm86>Z$= z7r5Y;@Jc6jx|uWr%j z`Yh5^*lf9}q<(gR04KjB(6-MaI`~ecJJATvr}xS5V-E)VpH~RYN$F`90QY|LXeqSDUpl%9;MCSNme1stN%AalW6QVa~}8p9<7O zvfm#Om`s-!_8T(o{H>75l)qw>zb5mi;GGG=M$AYtjs~^01nl4K_sOUjTdm}GVPN=K zk-)Y=R@tcFo8za75Q(Vf}~v`(Ij2$wG|)V$iM$9cawu7 zRo}d^BdL;8xD7>adt>@lbw>7VS`-$TSon*INLB>a-6}WYg@u9}okc0dXyl#0oGAd{ zJSN0l5N$j%G4U50fs_RPOAEZZ1_}HeS|!YtQJJX5(uR`uiSEeX@>Rdjsf8J$n$tz= zUvT~z%}JDlfgnzWYj3`g{I(MXZrV3xowr_Z)*7+&eX>q6Ul)gs6dQ;G{^tA4eDTZI z80ju@fWg!Bt4#k)KG64tDMA|qm^%4(KA7#pFrx40>ihYSy36DQBE<$|)lyRdh$GUW z$dgo{f6GV#07T*Ys|MNP@I?zyT9||Wh}E+?yZ%4+`by6f&3qMnb?g5HVQ$ml6+I-L zpC;6Sm!DVH(>I1QYkQGOkYaHKe}an4d=*8;u%qMRFg@J$w0ih*{5EGKS723Ky$7V2 zCvYNyyF$if{=%-1-;+*gLw@ht-hR0}v|h`FaU#N``y*ei)ckVeuNQ~k$$s6;Jx1^v ztw^QZFRjvK4k;J@oDk|dcAZUR_JR79GfCd}uJ4HS^D-ido1go#^HZw%sniG|Ipcmq z&L56I*8D6a(4x$rpJ&|kv@T=-<(5eeHKZ=l?z{QlN8DY1-sciYaqu+b!tMMW1 zn*Wf>v}=BJO7X0j_m}=@zz;(8-FZZrho7`Eq56L^YuHbebq(onYr1EwsoyUiAI1aX zLAGj2=_2?#_}=cC*RySxf3&Gk2l(!G`_OO@i@t&%I!zh-uMOtqQ2kPUo{5uNtO*38 zSSD^dU4ZeuSj8m&j&>6o(l^O|=LXhV6>{{C6We_Hr(`%y_y>fcflpf*Kt)Oa@z1Jf+bnjg<+Q-f&UUp0M zNzr6Y7sIcu@wYTI=#s+5hf$CBHNTPw^1(;I68N4SPIuzy*ldjDLeCpd-nCFmZ zga6`deb~b($k|ykqaZ#D7~()IWpT|8$IF^33QJ}e#);Kt`>vbJKYeS*Ed*`?5Ulnl3?U;Y<*1y(MZXYw@3B(7^ zC?FS>P@-veA<<%mq55yTyV0)y6{8W4^dzV61PXC}5(^*Guu?AtJH-l{CUG&n z&@1!bPYd2NH20p1>7%_7{`=#D$J8MSrR4l#_WG~W&Ij3MW{&rkEcsWbFkpVYyRT^j zhR*E6p_RAgjz2RFjnA9&Z9B{OV!soz1X(9$mc}O`0YoAtOCxcllA9|^$1kmjpTgAz zTwM?!$<>9;TwWMIg3H-l&5nm6O<$(Zlg4|KzjBCqdv9Kw4$tX)-h!!=epN!s+(T?n zc%iAFq)+^$rbzda8QtS3;6DCglaBcKHzO=V4lBK6Mxp8%+omdqA94`p;)mgI9318= z@b)WB6-6bpixl~v#b4n7_&eu1!{10S$!(DU`Nq8mE!^C5;U;->b^h3O%{I$S{LEtS z_IT&B?5(}J4a9UHcmN)s{=F3VT@&xu$dz=L;j2r0Sv&EZwUW!mnyRXEO6UJlu7NI3 z@zl<5>-S$g@V4V<$sSZ1S|qf`dv&SryMbsmJWC8$4V!G+Pb9L8ZM_ zL(ms7&co@XbVt)M@LHN>S|^Xv%xdef7Ct&o!xaAzQt(^nkmlkcKcJa?(||9tseYtmhv}YT!x^p0VaA$!npyLCCo@`_#rG z^HRff4Q?XWVCl*nO4@T?bLLo5HII(n*|DTbCMoq?bL|>mnGeRn*ltjz6+Zhwec7Su zNsVEQy~PBf$tW|zY|uaVIMN;`GG-(bSZVe+Qce;!S{JBB_5K>EUo}|2)z@P5ll$G0dGu>Yqm1lY6hLCEg1rLZ>}i7KZ%kFEUS8 zA590zL#UDK)VhBP!Q-anEkMY*&zv?2LpC9&AXo_|QY$Ab(9(Rc{&$h^FER1qr!}p! z1uh6^umCOGH`4>Sqs||FsLY)|IydM1QMVMnF|w9AMITDNt3KFcVh^<$J2XHi^MChd z4<>#1`S)XiZRyV>CG($jkB-%&pYtepV%i@&$|0faXky903!V=aYK6Sk1+Uy7*!6elK?%JNh;Ha*FHA*Y2Y)$GGkdb&synqmX-4;2xFn z2>)sgwH#`lhc`G(i7OBq6N7IeG_NB5870014uue+u!!r*8e#jcvG3cGg=E1 z@@dk@D_0sH8XfQ%XbF4<`R4p^Mw$QvXBK*6Zaf5^sc6$VmtWf25Au(OMH3WReg2

)~axN&{h#$(1((2EiFAlY%01!BCz6y54t#7Se}0UwlG#e&j#4CMLTkrua>C@lNZkiNL=#F4M-(vwhc9 zvvJi!ClK_R?jchQ+W3R>VT+7>dkxCume4Vnoi2h0FY5qNTLkG}we6bSsYW20mpYwF zJ9%&I-vF{#U%sh>#ANzNiV1pCV7A9* zGf^&iz)X}i{D|wgj^f*<1M29G6;S-DBh=5n)=waYjEUew{+4o#59Y=-1pI8~wUm zKb_F8mZhR!a|YY~kDs-nU-wzUs4P*)(63R?9)f-i3I_GRpx$mrKvembLHg>=;W z)gbjVX8p{iUk4Tln%S;q>DNsJ`x~uoPrv4W(Vu|-CH?vg{OT1{|NjiXM*FlM{)m1g zkGb2oCULxRn^*b3A@E)Feb*N{Vp|UVaQ20GZwv>r1a+_v`0uZD@8fftB7I9{^o`Fp z^TL$8yb{a{=Ql+LmCP6vKNl+lMuzyAO_5tgPz*@3(mL42%O)i01x=efv7iT z@4II*26~H8@)iP#^h<4*kNJ<+I{&fK4;!GDzrPNCtBuAI^rf;(Gtj<9X#m-v*n8a8 zgZfrQ4R;?Y7E*xoGCay#`Q?AM3*^RMS4g7EPf)l#Z;Y!|hJa1A3M?jW&EJE9?j-F) z+cV#?-^Z*`?a)+bylYg)dJXUeixr-Q1Z zG{5 zNub+Vi?>@f{t+O4!*YePyVr&M>V!8zkh}xzDc&`8>|e0I%2`XJ7yXqr{!&<`0yz$C zGs%BFD57Km#A=QJ;{G=XnVp_!0mP=63XW{GT$iRtKi&iGLnTwtOWa)w9%|{EL-^ z-bh+9nCX)J7O9#0+F8=c6Y)y*M48fMNPk=O0|S|VKxH!j=lh1{c{jZxlX@_f z{yP^NQ`4NTo8I&#%QXIPs#mi8gvVuoj zH^xfdt-3D8GJb@wVvRdEMVWjRmd*)R*l8Cq!^sgsF#i-A6iCa4*#UuLO|In_t5kJG zIsLiukD|#LFtQ?|$tfc_X7{b`<&EcbOH91|KF!{-g4P4-bQ+o)BUy2{z-Cri1P(zw`_248@4VE1;V}=Esy4FEkB-h=r;qzAl{UT%v_jt)BxG0kBdy9-PivH;FJM@pn=OrIJHC%8o3nspE+)#_DQKd>= z6hagC94XmRJ7Q5KuePQ)#>FR! z=~+7ei6VaJ>7q-b#EOhLsDSL~h~3kZXY`gIxIf%_{AC*^HT3NdhC#ocU-mJo6^R8Q zbTv@H=#R9HFuHTR9R8c3_ccrFq)_&22)I`M*zKwHD$7(rRUHCP!jV3`U}kar>4Uj4mIR|#L-lMHepDg+yb6^3;MQOw9Mn>Cik4IT-vjf)B^Y?npAP=mM^x6w6{ z9CnsWq$RIcAuv{J+Fk}H;#C)bKU$u z^^gue*Zk9oxpqJSc#wWtq#zROLO?_Sw6^G-dR?*hAO)Bh1ROad_tvO7rx#H8uvtuv zGN&p4aXazdw~uLWkxw6ilMi{;Z!JKybvxLt+x~{BI=dwG3&B^*mc6qvT-I8%GpA5timIR;LiFEl|X$A%O%&UNv&A)}{9o3tpg3K_wDE1*nOJUGse(Dj<}g(%(Dt za);#L7yd#~dKRPMoc12=AeK3`#)k2V_q+m|fhYKATb-ae*%fHrN)9_WcLg#PT7e(` zR{0l)s2%)IT7hmc*$Si#enp#8fB9*)5gze>S^R-NzZJnq_&_81{ypvI_j>c-Fx?&I zx9w8!Hk{vK6{JEPV;N2V9q;3QA#s0$agSa7fS=zM`nQWkgGV+w{PhQUh>Dx%Z4s%; zhLaE!74|L)no~SeIGcao$shldU0)1Q8j4Y*WX0&(nqGO;mzngE*w=k2Cs;1*Me5!u z%L<;sIspHfA(;bkAXOoFBsWU%_*f3!NrN4x18Y$?pg!7F-SvT_I%dFjJl|M;xCZb|)bl`9?cn1iw8%+~UfEuj@jb*6E1bj*j* zRu0`+AKkMf+Oqe&@)0fN$?gN_#gdS=N35Jnxk(MfdZ&rG0#7+OFeYCD6#04Y!~Pn$ zW(WLlH+rB<5FEojC?RpBqAeNj!Q*-IZ+r4@I>(cL7p0HHH9+X`zS~J z%5U*vYC|l{n=+0^6s(J*ty^M^FJhcn+DCwhmAtg%-SjnXPBt&TL}gC&yS(^(byo?Z zBmJikcyRot(*AkcrkB{UZo|crE47QX zi3RAb)Su=2A%BA|7wgYL{n7gLuF;<>_`~{{!%wqt9-^a#a^mFNb=jQK`fAUVa_-&w z`5{vu$nWA2^FcsTLLtfDvmSgT-C%V$rQ7FKq=7!iY-K4vG2X*gSUiS~5bIW16isaC z7EK&reLd^e7fX@7Vc^15G5R;!mwzmrLcWe<{*f)B)D~0m(g3&QDt*9E0N{{qfZ`^J z3Q5SzX;F-kbiOrV?Vm~eMdf55m_w)I7i$)ngyU=yWRCa(G3lW-Jh3&`Fx{8pP5d8a z;{VachlzoxEUeoe?^|2bCr@MRmsed7ZGAr74TBIt`~}NK@waQdU$pUmOuk4>XA$W| zsQylt9gkDJ-ILz&0^L2tQ{IO|^^4v6bZAn;mxi=PTRs43)3HWK9Y}jjwDC_MY?R}A zSDsJ7SaMnGq|lmS-O5Y;XUU5x9k5{UitOEut)TQd-ON7merRP69-iND>yXxTc=Dzx zgN3-ivksP`|9-HvU##)n@-gq1m%Ov=t#mhTM3_Q#%DK~QqdBEKITh??-6_<>sxC-Y>qv-kq2}($E23buq2Iw)g^jT%=&yk3wq}^fzQH*}vorB~Bj| z8S`3p-A6|3XWf(B3-{UyKh zUY#Q)_sz1zyFH_c&Bca`krv_FKfvyS(27#OMiqb6yFXLBOSbsStOb?s8d@>XFYWMq z$?v_ze2_!rELNkmfxr^z%199`qbtSUDd*-AKe3s@&>D(CMMjE>AVb1=QaxdS{-_-N z`v3&+=^soUanOj$5W7@k5lQ|?Y86GqeHI47>^?~LXe8e*Tl`%jB`r(eiL^e4Gwaq{ zgZ(unEuj@oQnTG8wkPAo$e0$z1drJq&9H{Zh|RI&pb6TTIDoZ1p|rNOw#pBo`hH9s zSDu%qd3{&MLyJVnu*x8vYG4%#UzWis^;HCe2-XXbZJ*_<+Tp@6=%{xpo>cDy{ zzeSQuyExgQNP<)b*1Nrr?s19(ii##A7(T_`w2?c&-}W==TSOw#-RZk*{Y=1{+J3lR zkB%cvDFdiddRHgNC@&(BZF6eq-43m3sGuJON#kM zdSx}W*8Sd?zS>^J)e4Omf4x}zwY+4I{Hf|% z(dcQ=K3b18rc7c+$y&7*C2LG?%@ghGh>K~T-MDF$tmNOd8-bf9Sk{Dt#giMVC$xh5 z=mc2lFuWm?w7h5Ng6<5Xn{aS)!$lL!aiONoIwAaxmHaJ~JP!UYak@gY7OK-}3PFBV z{1~BCV|Wm4-JpRXWd&p6AtZm?laDi|FZA-qB#Hqc`z(M$`E6K-9#dI!=Kg~EO zzo~8jWtexFpv*F?Z%x$`NLo457 zwBnRg6K{tQdAe&aNND9t27?Vnv>(!Fefbp)~KrU z|KAKZ#i7SQ61USO{J$3M{@HJ!-7A)PfcG72Q{_79V>a(f3<+T#m4(ew)?$CH#p;6C zm<`^^UVxKc*NaSkIDp~M`$T_s>(Bf8^Dckd(^O+2LQ+^UK>)rz1q+Jz-7`C=}7ec6r}!RbC9!40+-B z@+-){PyNln(uOH}J=%0BwWL$lpM!sQ0EeKDu4(YZ?`GMP>StMK+Uuq|jLY`wnd5~x zwxt#nppX9uwV8T`Kzt_sOOI{$5dn@<31`@){&)Ds^Zwe&kWN267s@H+*wz5#KdN>9 zqo=U~*&vp`zn6|_-OOv&=GB@attll0WDyndqqRJjy!9acLK)U!qV(Lv?r46jw7tb+>a>d$ZKnom@=;SJh!` z|5rFmF;~|t8_3^j)rF$(y07k^9>MS8>K^>9i4PXJnTz7tTK1%}6qFM`BK@A7(|*SE zZ9HYS|M~pn&EsNvo=c0au#oK-0?MA&cd_L4BhOE*fux7lEb1?TqI}b&{=l`%%=lo9 zG#;|C^~%5^z)OpYI_57<5iFOdOu&&YxO}6g=CTd;;b8cq!D>2f0IN`4KV971pV6lb znmDiO#dT|MX19FZAGnH?Tv`}f^*mP&e)fGnpZSCPlDsu8U?_(7&o`wB&N8by$2o5`DE;R9Td(7vF&v7%sF!P#<;jDetSlcn&!KZD`WAA!YpR_#zj zkRp=YKNs2ax}1KAw~0$y7>+dER3J9802Ld;IR|d<65GbQ5Erz?Z0T=QohNx&bl>b- z@`i4)u3PY3a@-w1XHci+xk1?*WF#w2&5%i)&3?=aVOK^LfzgMmq03&=pIf|z@Yuj9 zr#ZDAn?J>uZp`Fa;rN|J+LvSVD%+5KZ@@f5k0RyBGr?L;TIk=0$ZmHewTUM|tv`q4XSER~0$XvVazZVvQc@bHt02M)MJgSH`{ucW~wDAQoC^yR}?25oyXH{G^vT{ap%5YE>6#LlQG*j@-9=d_v z;Ruu}t>ufLx6&>U#s#RxkA+tT8cA(285U+L5@a3aEiVxOSWrELzr|&t?`)phYd=!s z{_-*VQs0EzMLDoH81li`m;=$|APqTM^7~I8@`0bqBk_v&?SFSR7sDx1wlpx}#QQ)8i?I)Pi?(i!B`0@@m9$h{DdbWK z!u*PsjWGEeb1l(fbt6~vSXm+YUlV?!h`aO|_^kt?^UsG^pWpl+!NARwCPP)(*<@Sx`JspfI*YSuKjsX6_N8OdSY zRKal~AVdKOAHS?`_Z>K33dVvq9|Tl3OLt>k)|tU~r#DRtFoSU-$+@_gY9+YGOF$B| zesAH|Tg;zk2_6L>g$5A8DLX_V+^R^NdbD@eiK@@uhV>SFEriDvnYlc*Z%=224U=wy z{A9N>TwlInGV<^L8)0`>e2Yqx{SFiopjxse9^I7qC8gkp37J!2{fUWRt`*6ry&0w6 z=~G1W$sj12Kc|%RaFZh{wrO&O=Jgg6!4qze`191;t<~v&6FB#+*^8e*?o9Hecd)=X z`^PRS%Jgq}O_+$(yrstoRoEN2W0`tENJ-dRh4TX!Y-F=q)+s8aH`7%lv33hT1xruj zo3-n>OicWtK5LeG)V!7l-i5)pwYt?mzAn^nVq)ByAUc?%;hGkVMr11Xu5jhGJv7>Q zOPIn%D$MVA{i<`LBb#g2>4twu^p6Yyltdn}KkKgmxU3lf`w(I7yoF=@SxoiJ0>X`- zQ!s<^mul_-rrG=~I+@tr4lDzCi_c?qm z#*u=XOvh|WAQIL#?dI?JjipF0>wBH0(kG_ z3qRaDVUmWytsP^ite3d6ar#-BriA6&6C$gR;ITHQfWt*z)o6e8>IW#L7t~Ue+8?M2 zKE}5Faq!W(D?WZe^n)$Tj+CqV8a1>)P0knO<_2_V9{U^RZ01?1$s=kPX7KdLT51$C zaD>3^CiQ;t1wAweW+}b13__g3b3p+j2xGy|Y5K=}GPY6Uc(qroma$gSfLCk^x?V6u zps5$;^i%2f0BNU6d$W)496s%|=v2BbxEy>m8XrCp^=htK1c{Uc2k-!y>X9|xhv?oJ zP*kdaAjPc|VcsEbnCHBoUF0ADv;cs`cAq`Z1z7pRwUOeiH-hAkG||bSqBiR`NU!F& zPZ?V3?CfG_JN0(w#;1%B{`goQ7PX{)Gd@NdEEg~Aj}Oob1dNZNF?w&w)oxT3WP4*+ z=A7u?|(MFpN#wu#3U@)7?~+)kPzXm$C(> zTkCm|#QU`@P=!t>XOq=7!fYbvyj*pv-~bb0h_5`GFD{TAw}hs=fiz?zCsNHv21Z^{ zwz+%ZIbXf@dgRW+?&n6(XCs!DX_9(@eT9iF@D8UFb_)57f>-thD+w7W>#7_C}noL0h_! zSYv@Am6n_nO;&(%FISyJYXUIXDF7c%Yu=;qAFxfa*=-vkUZQtvdMKYXzNt{w2huY2 z{rR}H&t!T(EV1^5KeQi7UTX6HWU2|8{lS0J?AdA-VO*nf`1m!egQ(xG;MW{# z$zq`k9A`&D0nYzEtx$aSwkR#^O0Bb|1w{ho0%NBF+5+V_#NCtZ_ZWu=q`NEp*fJ;n zgj>^}WuL8oL=ht_lz-gIvSpoGSAwv>HtW>#M43SXTX1HbzV`jxb$abTG$6ATugk7e zSREfrII6XQLRL&iY`au{cAoH09Mhiy4b@+&n%?WH0dKsowtJ}>&d(tpIqaP|UO|@b znc=zI40*wlEu*6W$WNlH-sZoz2l*h?>xkfcXXO$>TXEZbfOl)180h?cmG|U=|Gf`71AmrG0(LV^IB2y6zl&dxwV@sO`AFdZV3EMzTe@#8<9EP+0{=?z zB)i@KzVmPGtOEWSlz;ec;6Kf}n2YjvsN(8Stf{wm9n~4a`^G!tI|0H2e>O-qRf706 z2ph7Fgigkc=kI>ymY zQuS{Xag}Vh1(oi$(^2V?{TA;b_2Ss?1$*QfYuLMYs87mSPT|x=$WWcpZ^?IyPx0lS zaAIF|b$(*s;&=#8NMcV zg?ywvEY=ClYM4N~LhrF7a~YRH?F!Qg2JGb5ocxZ(iPkGa-~35Xf1>pZ%SI(yXNBtY zh`UgI3G3DkU+a4)<4-B7G|^gFJuT6CMfDM?q5iN;DQ_+QkkrJ?ed9~dTtQuoWy-_B zSnPxkFT_|YGcR|}51u5VY@S=5z2FVR|4-3#Mr3VTm_Y^MDh_s#h1H#Wp>`lgR7 z zzIB}Y#Fajs(&@>Geb-d?W`R^6lh{`iALI)75zAg!MT%G|?|#C?5Wm4|Xe%i3cYH3O zuY$I;hT0j^ynk4Dy}f8-M@t=^Rmj>cVqZT4r~L6((EVkF$qSxJ?C-kxgk}wlqwB7y zK02lR-^mN^*7JcHLO%x|vO7=XjXE?J^Jp#IrC%~vWK|4I@R1n`D<%#C6VLjptF-cJ ztpD=~4r{AuZ21nv?#g#X?996>8T(h)XBcc_aV~@PS;|yoAzNQNCekPmvj*|^ulR%L?QJ|Ymt0$jNW-KVMkrG{ z&o^sVag%HyEmX5bP|eX^_rrapwyuZyYX&D?LqSKk^-qUZwlFFF{2~Cro>;NVrr7*J zl?HPczrvxLH{(qRKojNN{aB)Y@OBVxe&7AjiYG-_z2jd8Kd&?TnrN-6zCcTVxGjCO z+;yd1PwG&R?7Grs@9rI3pBt?0evB<$+`j5BWvhN+Ck1@&q5gSu_#S9s?xIvThw{=d-g5fI7g@CigyruWn?|vCgwaT(+{Ul;jR*L}KemOR#KDEj z7Aiisvbr>J@T%%%JP6hALdT}}$qK;e>w-y{#{M-sH=d!H@4c>X*#5Oq$i{BGIN=DI z1d?C6FMyAEd&Lw`ecI_cdl zwTc2lVc>~;=gmKI;;Pv zq^gv}meWI&p>D0WjNR&D-%+Sh)nBeUxvji6R?WTecCNT*jiO4{Ql%um(Sah(q7M}5 zeb@MlzQB74KSz!ly?mqa5L#}8vVu7M^#lUOO14*BZoB8%&zdp5Jl0I(vuM2SSnqL_ zbIymih{|oCGFfAMap-~xcngh~>l&u9P5wmzAV&Y7jYqc5VMD2QJ0}j-R8P-ZV6J-j z0Kr{@$KHaB`^oyEXO+C+$szoSgr@FCaO}?Mv?_juVT?TwuO2)-;-}1yyl>cdSR+f>`6uK=PjOO#uJuTkQdV z>^z%Q0e&BTkB)%1Uiw|}x7PjJe<^8ll%!C!Mw?vyAL|4D2754Gi7r1RsNWZy~Q|R${UZBFDuqq zlsc*dBn8G;jy`oY9dY`>fj8PuZN%yg>~BM<`cw3(+fq{`C`cO9ki#;o!=~XtsMw=@ z9~K66Z?aiB6(SII|-0|YD0;sX5SO{i`%*QrbF%>rcS12=~1itTkN?-zvX&*dgi zTtjQ7#}d1{xYSDU@1exfr%teM;dK8Lrvn#632JYyP<-wq#{6KigxEMitaSslT{DU; zEW-@G-2`f#@+UW$`rL_Jw_M>P$!XpNxM^%Ab*vUqJ&-Kbibd7PKPCaWTiCxa#4IlC zlj--24lnTOdwQ_eZmntt9c#R3_OT%fSzi-AV!yvP0_ zGUsY(OJv(q*y(Egudla9q|<^ndV2-5@hK!>O!~{ps>}whNu_Yg-`o)F3x0$QerZCi za~1&jPsh?HCl1uahjRY+n_3rsHywStMeoVx<+|>@pg7yWhST^l_LbZRhoVE?A9@{{ z`lRk^7qgtJB8vWaPJZ5>r9aJ@C*dASnsZHD3Fq#i)ep8$>ZPVm7{RQYb`_UZ&&OVK;$P=~;xROp5S%-ljH9|xyp|n?ppFi0Q59TLpW_Z< zyyNbCDB=cO3fOz45IfxS>mqDqS;_?0*fKai+W^+2yKr&<3S zUwO}Mcyhz7;np+}OIQe=_ZDo&Z{kC$lfqemul$k#4k&u#{|Ndg`ZEy7^d#raR%Kiu z0>y_3A-f_w73x@;vxI|21P{E09pE8wjIJn~IeGJxuH9xvCr=C@qsR*_g7RedlElQ; zIqC+A$dN>}d)tpTKsgy@Af0FtnMIy*(4qZpb+rE#Yu{C)Kwmc>J0w?$>)TXXU;v62 zQJC)BY57clX;BCup=iZwjmUR>%yp{QLiI+rcNbogCO{wz|D8a$f@f_wK`+)&sTscm zZqQ4WCdZ9YH#hzvmm64fkoNhJXNqpPx_bVNSDhVgJfl!P#e$+NYxw)6{z3?Q8;>%! z;M3_%wZeOxd&a<=5y?Cx&^IP0n2${>Yt_{W?ndr{=5i1Db-%QisFFmrKWg`&YgtG$|5#2%!A zahF*YBI_^Z2z0>4_ITL;ka-o~a%7#zj^O zJaP!Tkt7LrqH^Na&gK8ou>KGXIPq*iq1b7?6bPH`7bm6tLU;Lv(mr6fk2zCN(rG2o zPw&7)oj)E#*K$x9>&GCL9KP*3Nr$A};ZtUNWb1bCgGue7?Y-XNkxi?&zQc3!brDV+ zNuIG7g>et!(-hWw$;;JeM3W0Gzu+5$-p%+8lMFG``KaobKx9fDCP#-KETWNVNJDH7 z46J$&+K7wK*HqR$q~eKvUD(c#lGFi$VTRHHg5!-DJv~w{1wn0ampQ7)e(xALnqMGT zY`4|OcS&N2y!Gb@a6t^b&M9)|yW3Gk0+%o92zuTZ*!<%?Qq~@L9r`z(!X5gz!!(4a zN9v{eS8BiC7#XqOJ4ROUOaChER>4*DuhKi_Kk47E+3VTICj!(HWlIJi1+>ti z%X4|yq03kMUDiu=dA|LAW8?z+y<=nzzheJ(``F0Unl+G89KgGFf&=V2y-c)}s^vUg zw*$7V&+Nfabymphvw@MEU)mnh?ebbiOP;GfBS>rc4rq7P{SNIOu61aq%7tharQ`4} z^&w!G-V`I7<=;fn+MYQjL_RCG#*glEHD2o1s72MTM%G{I7KBq*=|Y96aa_t_wQH5r zHLtq&Q}QRJPU87fOStlW@h2apy{pe_KS1S!AHnJ5f8z|RDPxIv+E9H=B)NojwJxp! zPNqBFi^~|DlfVVtH0+u3dV6yR-Y_#PU`WET7(}IzH?Bn#=V)BreapAp8CKpZoiN z&e!(^`hGz6`yQYB`v*Voep8MJkIWIqksLVd74kJN9(;`J}BbCJm-xePfiDx)|{(?m7MWMRu zc%Eoo5ULx%1+3r!-fPvYwqJj{hAN0d>6&JTTizR-c>6qN=isBg^IAu~%Gq~k%pL?-8J)?8YT{Mmj}g&-%IigzD?8QYEZ%<`hg<8JmhpDPF~buEqJPyb`e2;@eU>LcO@s^Z1M5d*im{EdiDsXia+=krIx!= ze+ue5z;gRI6z=tL=+c&_imWJ1ok{sMGXyGfm4?W`-`Q%NCyy%L&7gS>GrO7Yx zdzEu{(=edCORH=j0*97uquJF*H&--|1efAnu*If7doZz)YA^TlJ5RET4DyHE3Uxp$)A&M4je2w@UZ@7vtAUnuPby$1^;RMP$tm{C0!nzZEgOOhjI;oCR5$Yhs6Iu| zEqb6$1l^U~n*D2c{7bBH?^n0D*g0F+#?|p-Z_&}?jrf6fd$XT{`&oY>X$0BeavdTM zD;B0Xa{>#~%%20yo&fVFL`MXpQ=HFtLXfXyzg4dg=M!BV#Q9_`)>3D@NA^fMv5`4+zjq_UqxjU~Z6axOx>_Ydb|#!x*5sx@&DD9ip1YwHt^89{BTrS22*1-)09A zOrIOjp@Q({P4|(a0RBLSvOd|=xBG*hAA487qUfe6FwPY`5V_jz4InfjRmCmw{N0uu z=ld54hlyh>9FU%*$D#TUkEB58nE~n3?0X(|kN1H24M>mRI-jHbt{jj)oR1|ZSY16r z^-t-eCIaAJF&5dl$E%|;&2Or!Yp~anA3%o2 z#Qxs#Ui4>p(0(8HQ9s`F4b>l>X$o`m9_-H=)%W|g=f1nWw+Zqf|LzK2WqH?b?|B}l zZgAx@%xJwBl4C}@y$5$uVut@&j(o7&`=;KE7LZ)ht;V8BVnYc84L8Tt5!J zp}HS{JArBwIA-!kf&ManX>mHojA?f~(X#dCEfgJSFb*AT9xxzFb6yT9t9tTgJj z<4a@KLa)AjWW zSTQ|q0In@FUAyM}00vpF$7GGEC2Crs&Aq)4ZDmbo)_&@WKAN7a%^a1p_l=Oi)e#WUr`u5B>B&JovU^fC!cp{v=(NagF4{PB zljq^KsY06}1}C~@E|36O(xbp3=%0Cp+Tc&y;*DLaEMR*s6{JTx*GWIcYwJNdgr-mC zrtvv)s8%oZLv9?l%b9S3*5qXVLE7=anh`yRr!~5+V#;*FzX!G%Y!cU_Kpp@WMSl4K5wx)5nL=6bcf4Y zw9XZZuyXVQJH18ibl0??KVHwszx&LA)&Mu#2@o2gKIDK43$e1TIS$#{3LtnK`rL5& zf;kG?!Jf|4-a8rSu|Ef|bhw;!zg1*o@}uX=m1++a*%ytxyOs;BU4kHDoK7Z&k0Tqm zrzdBN{Q3q_;dPQH|<*dt5Pz3Km@)?RW>IN2HpFB!n!0UW{2b#A0i=3=M5umaE*6^;YdVoRoKB!K7q(VaXC*{O;HBh?;QRg?t_1DouK?{6f72e% zY9<+;X>Y*H9)@RfMq7-O6X)1Otf)~aMlKVPPlw2y0j?O&og+f6u@~rw&$udK#XXfzNf<=+` zknmo+LQ`5dvexQi+&eLt9dn(nuU$_9Z{CSwf?Unw?qIdVwp3T^U!WdSzKhD^3583XbZo;f3E}l zCR}Uqiw1jW3~HRGWc~Lun`gH$U96!N>K&jqRjs|K(C6A5iVyv{TkxT;ZkfZU0-A5N zFmPAP=b`!AEV18b(fr2qMDwx#`=SEWzpM9!ZkB#x_5ZU1Og~Q}>OI>qWcxKfE4LiQEsE4|f{!+j_p1g(@zmU_S z;~w{_TJm%B*Xj%g!6rKfJKr^9F6o??toTezzSr*-t&Y4@Up$*ZFq;d)R2reBE(kLx zbI_^k%5!V8gLhpS;zp>ZKOn6TLQ1gbGlTCAbq|5EesCsTby(-b+H8a-fek4PE-Vu> zIiejLw;iFzW9A&TpUYK7sOf!ITcPICdA6pqLd~a&G-&UENKLzL4TR%1!m#%tEKIVDN*r3PeDEB@Z%uokRvzxf$$S(% z$#}65mp;sroKMx{T?lSOOviR8JXf{Q@s^wr+_6_P`!B3%Kl?|hKmPvbR%xQ-jWRJN zX!?+|Zd}KO+aSZ1cc=Ix^D>323FXekjtZ&C*a=BDMYrU!#ohs$*5}zgy&rp(A zfV@pWRuFAKT^)P^6NhHZie#jS)8>Ll5L4VS`wh_AyXn_CAoUx_Q4F++LSdglG|hu&3*MYhgo0fP|HC1Zg?aj# zpk>=fr)ajFRiyzbxlzsa&TY=3S-xmB+79-U+tijBu1_wC(q`h&Dy_YF7DQHhYN&2L z_ODiq$Xw&;2UwcPZ}`r@x2J@{r{Opp%kLt2vlsG* z(*bnFpYWn$UGXQps8m<{2`{S96@S8uDs_cL^J(W(q}};iklO!$3>QKbjU$THh%9Ox zMlvYW9OZ-(2;bB|o|V}3h-QkJ8?TQLZi)Z60w`|$6_eKZw(3`jtRRaB8x#(Bnp>!{ zE`6w?U9f8I^SW8Y#AoTfPmj07-j}l3NwB^@m-M8WH;ECk zFx~^RenA@3c%VqUR4JtW&ngVMs zv5%FPydFv@{v?Pc&+Le}_rGj@ClH*|c77Yq%$?sk``gTKyWSsyHfI2-19vuNVHt4d zN)hT~TZ^!d&9KFQ&_oAq^jdNPe|zfmyTj6V1om&v(#Q|3 zIV_z}iTI?@RUPgD_^8#QZP_GP4@d)H7+djV9-HzNI{JX)kx;=!`bK!`a09&?{z<0ET~px zDBEDaxaq2}yvTd(A)jE+CkV18L(L``WpW8oUNA%5BoTvI0kh{#* znO|MXC}*-OE4%1iN!v2x&IR*(6^y{|erDqgMp|1B*NoMAAU{ZN^wSCdI)L5iSQnpv zOe&evFH?n%lqxi@gDNzV?il=@`f0XHZe0{u^@P3l7JuFKPg@!plZ%63R^>4``aRW> zwM}U`f|e%1Bo{`tz@N(+el>~m!6|_e(;=8CRN^sn)OlAEiI80??WuDp@v?2&$)s1f z_!5A-+fLdGOsOIq=N21#<=2U_xeB`tleLrcFu zHNy)YB27^zv?R4p;Wb&YLp1~6HiYV%s{Diwl`qLwUfyZtm!3csf0 zI;Gq0n@Zh8G(`|@)#2BVyn<9rAsn~lKxozZAWvxJ7lcZUoW1!j+W^iWfaccmg#G9D z0}(i{ES^uSX}U+*S_YCA=lr2frb484bBoIJNj1vM8N|Nbs%~+?lcR_cn3=OlA+%=k zpytv~Hs$P5XmxuOTD3uekj{h6&BPBT4t6K4P-0)VC4=~DzQnWA$KpXeOCCJf^FHT4 zJS*Lw>wJ89SDr=w|E9C7N6qQWsfmMJ4(2bpkoUco9L3+BqP1tG$GY#0K2vAt@w3u; z+ndwq&q@z+^qYJ054t)TNGw#osWkNc&5Svn&mZl;Tv<9PlowsTx3=ymodd`5;%JWP zo?|}&f?PL#s03Rtvr9Wn?AO;>Db1OAa1)$3(Ct?LESUad*I7F5v0FKEu?79?`K8CQ zE3=?>|7G#N!!)`q?eipalSjJ6Ptq3<0-==k>E79|ILqtsNJ&ea{aLfYJhGyaMqOXP z3o5%1n6Y(3EZKeNtYr7v#O7_Kp*5}3lf!z_VQrLVy*zi@2_ys#b3RS+qM~MgN|qcE zN&ZShj4VHBLwq)9_S;-2uH~b2V`fBcFI@fvMQCR+P5Jjq_AG_Hm4ays4r730YxmEo z=6p5qvV$s|H4QV_;yg_4&F=_8wJrB8Ly(Q81}9lI78u_wZg0`C`a$GWWq$kngA z^(Y0GM1bG6+t7s-D$~U|kNv87RJ3Wuqtpc(bg#9HM*Fk$7qWqMy85y~?IH6o-fgk; z9oJt@X!~Be)fOt*I|m;{Q~B_z5Jt?^h8h>J;8J<{nY@Y>^b;Z7kNh~kjo``I5Q{JT zL{xxxK^8CSAV_6?hx}blC-{Uk>|IWlrffbT%incokiUy9B}{B4f7iuoWA~3~!%xfQ zSMM@+6;jw`?)v)=vYERmlHJ)b$Th39UCN(Cv)Qy=y_uw)RZKCnpiD;iB4zt{`$E%S zZc(e6Aj=!3N}m}$sccGg=9H;yp%}mbrwk~lWD64Ng>80waEwNnIiL9!*POQdDoa>G zhw#~=Q@ASpeb*~K{Zvd(3O7&NsdDpk_5a2E9LYGmU;pTH&QE%DW`0^oXY@JeXUzq) zae>%dCBxi%sBc+LY3-@WwO(mnxZ}QD?r;#wW23o zqK(_rBB-Ko>=s=*AhfbEY(a9vINkcds5txQWB&QYWHVS+K%vxZb%}~rTtZQvhE~kr zLW`m@HfDRY@%MgG{Md-?&J-}8Y!>I76zPINX?!_Z9?AUhV?Qv^WqVNW?q&nTUUI5) zOeZG;vaY^93tSoXLqXRs*W|ual5JO>vw_HG@utjMQiCLO-(|ngNhb-ty&e)Tpsul>#VaM&Zl#*HBp6jA`k4>fJUDDh1JbuEa(pZ=DMy^lP^BG;zYq>sI*VDVCALhDP z*E74MS5Hk|`UB?sh|t&K!kLm6L#wXWENf0Fw>VCe{fnvh=@fTMLiGo^iZ$IOfW(?s zuj9wEFFdf8D>5)Fvf{!p<4Z-Jc>mczplCx6Ym@;=ws1y;L^6e zxkzz{QBA*8<=(}fFH>WfZ&xVNxI#sw_GM?T{c;ez0Uf=HHU?Q7tOx!?#Tsomvl?T6 z-AlR3*p!CK3IHj1SI*#O7Ld&2JV9WzavCnuXv?3wN1KL~M4MtI1ycyp{{1#d_d#Nd zYOsg%sC{e_&ZxDh4))z9#1nF)NbCqbd`V{!NO^u$TO@BFL_GM+__svfq&&-^#B=6U zbsy8OzDH{PmeuY%fs;~84x~oe)cG1O<8pN28$NB>ENx08!h1*#Z~EY7U{YnnrIET_ zoE~aGR2{XX%d^;m#S%YxVcD^J@Nh0;*hL zEe3rYeQMMQamFu3V~xWKH?y;F%0&?ZKBmL>E<{e?h*3!W1>*}Wr>z;1S4;qkvyX}+Mhc+CsOj}(o;DVl|U&2J0LG!bQFI}mK4U4 zcRJa6zX_g?2Q>#xM;jMbPHiZQAocZ|TDPvcpls7}C(|XXx;Xl~hx{g*x{^0TEB^$M zrj0>|vAA7)AuI2cP<=fGs3QBdf)`#k6`D5)CEgkT$|8>8jH1cWA3}*b>I{ai{zE=M znZ7Cn{-pY=ZDfra&C{W9M)9>dI5W55(kL?QZGG9nJQv8agE@*vB}!1Q1GJ$LaYYV| zghS_LafsAnJ^}$zA<$h>5a{%~a}fygj;YL&khR60iVJ=0>3QMQ$vN0FyC{P_WB$?> zdkC!P1Vw}&jn9wW8q8Fhh+l_9w}yjR1b(T3h!ch-sT~EH1cHo}X#I@<_}H)n|Hn+b zZ-<3G{)yAu@?nZs{hDB#(2DD*OHd~{!v5%(*A)uC=k;jIeokn9y*xQ`Am=1j4+Ikj z4Fmx)=Ww3stV-UrX19^r@faWF{l>~LZ8$TdHHp+%8A}d3LWiwXmL>L&0-1n15hmfN zLO3|Jk6;eu+bi*x27b1l5hmo`?`9{&8HWCGR0hVsC6iHhg$9rdC|3Ye9Z10lEi}hS z07t`-tK+cNQK@qvbY-}4iY3}vDfE0$7nFbA7EAvxQ?48F`m&r&4+!%_I6&ASqK#AjxHsL4F)ogeU-g2|DqK{z89D>PT@zHiUKp zke|nu!zv?TBFVytLRDW3$cRa(psbWYU*NxBDs%n*oto=U5xazrO1bMxg1O9TYUM>2 zmX$XSI})Yf$bzD*cKFFqa0Q!E$%|=(l(4t?O=$*f2O#rn$&0bZaA?I&_GiV2pVYy+ z+afJ*caOI0<8YzpB3<^!#%z*ouX#su4`b}#!6jN=VtrUvYBDep{Fqul6^BgGN`)Z-ThNIm=O|AEnVVj(x=fI1)=NKW)60PZUNQx^{Qf&`4Q!)? z;G^DHx(MN^=ETg<$`Y3ajk*JTRH^jzVe-i+d6U8y-#OB!1!3=rHv|nV(8_~b#P)_z z{r9XDb#OA4IOR6yJkFLXMi=yvgb>iptwBbP?@XqT#hvt#>54Y$5S>oDMX!$Zlb;{i z{aodXbg8AL2E8MH>;FgFyTC_TU3>oo6AT!fpr}!x28}kUsG*`w3ef~XW?%wQs3NFM z)!Nu<8zBJ{w@QSG^V6`>T4@Aoz-%Po-Y-80fv&Yl7URwlcx?0z-Q z)Vpcvkm5+5|KRv;`8Q*~xguJ@z&$r0td3+4VE`NKl| z=31Z$lz>gF2_5lWz*Lc6 zV-ZiCcKO81>f=L8f?FH>m$oJSH3-U z51YQQU%WNYzxOzokF{~nns-HDA0ElRT@zSF*@4~Ch}4GE&xLMz^&y|t({)Uhaz6l^?^*2Cid35VIkUn&^24iPC2;Hh4kkGa#}L?MF9 zYwiY0x=rFDr+(VY*l520)~Vw_!TZ)jV5OlF9$@Ay3RY*=G(h^BgK!Bw!H*~eiBQc{ zUEKCL-_J+wLUWq2KE5teq4P5%u|q|n)qf(EqD-r{O?$qby)Fqg8^S6WzdsJ}q-5m3Ka?R?f%m-}-6n zO@1T}1JMLy^378aj`ZA@Qt<(C_(i}^wC_4&_X`29Q_Q5pSD+BPb^LL z?gu_1k)f6U!Vgir%mSxAaZ_1kUE4%%j9Pa?JBO(+nHGVjs=6V^ox>vf?KI0BUmsX; zgQf=6g{fmCw*1b6(FI+ox!OLO^IjBy;HF{KRb?Dn$6#bQRO~Uv$7>(0pun(})N64? zLb6T7pR1o)3{fiXl*K2w?Hiu~&3R{7(gSBHnVWKkuXyCv{~^kYp`=-98I+kx3P+O7 zRBP(H;d&~(G1{dd(A#X*n%`z^(57aFh8t9(>%!DK_Dn7Nch?j$=AcxU7$qC&R`|DXdR6G+& zj<;j(FKTyvuCgKyP)D4WvraR;9L3&L(SUn80AF zO0>*d`Awt1p?ldB6m$ zB=l9+#x;LOG*Psd)zp$#^x%s`DHcr+S04ziJR|q1Lwbt$d2sP7dgff|q?P|*g7{@e z#=mH9zM;EuT88KhCUD*Fn2PT21aObE zuI{j|dIJ6X4AAF?6rWZ%muJRiPz&Tvfvo&8nwmFS5cA;tyV!%x^W;1B0&8?9Fuh2u z)Z3!Vvs|owZ;ie_uFIpkJfzFdbontC?9Y4k`8!;)IS<*{d+xdJ^QSxk@Zsi9EAc+( zj~zQj#IuUPXMTXs05>C;L6PXZs|cCbwdHAO8u05GyqxQvI56-0%oB$+-LDHJ$LUqt z&o_L0SNjW4)C~Q1gd@Edb=jiJvt0b~>+9oOK5l$a-)Ktrhr5WbZHvZVa`7cf4Hqmb zOx>-4cRdrS-nO{XW>?3bM3a-@#-Tfmn*Yb9+YKqYV?SAEi(g>=c%!9Jg*Ynqkg59F zMGf}$Ry_<~y0?+Qstbr{+kw3)?w+w@KjJQ2@xIR9>wo)g=2_WJu1o*WowKo5>IsRY z%SLxx-M)^?x+eezhsxCWaQ;Wv?I))!@Sk&7MQC-ojNR(B^VoGQ0H-F3)=f=ZwNCQC zzIyADjdtLvclY)~U20--e1@9XWcb5AU%ZS3XIuZtiJ|VTNcD~-FQ;y#P2Trr^OkqH zE|=;O<&ukO*$;mGq)wnTa*C~Aszrtw#+>e63-JBGPZV*rcK=0@wcdsG$>GJ3wTJpo zOP0;9Pv)ODH96{cZLoLC-!UfnK-uK(lLOhz$Z2@yXj@z2sZCjjoO7 zL8a90{q{HL+;ysFsly6Z{Pl)mD>8{f)rcA0>HeBD3<|XbhGd`X)#Lx8Z#y@uK2qCIOu4d0pR@8uGzbxgR{kqcAa^)k z%j73&q zPWW*+DaYu}u4g7Ei+DeRKW594S0jj|aAI6pgxssOZx4=+e$76;dvx&W?IC;$k0g0w z9O|`J_TQqT!gy_wt3$$hU|`&iNcHCVKk$}6Z~9>&e{vbR#{{|cqk?GuNX@uylGo47 zaPg1$Z>gpTJ7R$`Iz($0G$t0r_)>W7UoL_jiwzCi52o>KneD|g;XS6$+h_BuTNpb~ zag!($b4qRFBXjn?>%(UVR|o0#U$v)M5n#MV6J?0ivb~141U|lPG(Gx5=|9?**P$x% zv2Ej*SVZdHd-H|^>}Q#Vy|O>I&;MtYEL%SlEj0Bx<~_pYV=OAKz;*?Elrfd!EJC;; zL;sX1Fx4O<#nx*?Y!Ar8S>@2T&hcyOD?%&;FonrN=NdFJb}!z?d5b)M%kg?!qq!( ze?#4$6{uC?Z*eV0lDhuUj{KR%h7S9j#ew}QiBGV7z+Rvii9Ebj_?C}UQj@z0xrkviAKfBkzm zEXv>K#$foH@6SDIzfcuVTaFG_Z)zElo)W7WW__^_Kgh?2`jz}c#xT5z5GQTtFJz3D;Zr%77ZcX4;ju7yMb_ejw0e}v_pUTS5 zS`7#@qL}hG(r?V}Ad+NT&Pe^4Nr=^awV#lq6AR|dPKQn>m0K>**>7|3|O9VFuW;}A6R+l_sF~T4PftCaiQnWHk!{sJVr*JU6 z>;Dk^=lh(roThS?zR}6$%;eKuBM7$~O?En`(-UdFywFRm)AM}K98bTvP~?z%K7F#F zpxm(gsT8O@aCtXWW~~cbzpnXt?#zp(m^G@w`SR1@SBXD94TObSVKwCN3u;SK&lze% zf>t}Bi@iTnVaR-X8LToTR;am9NEIGy?fn?1>Rv=ub_&IBo_j8sZDc(HW&@A$Q=i6n zc*U&_v9-$TP&xpH7)WibTXoftuJj1raOt_zTK>l-Aon>1^oU)R5Lu1Y+5LR&}=9f(KPD{)V8-1=j(=hn^x541Az7Sv#0E@j<5BMkphT_z2(=%C)@BYc* z?~YvjK?F^rAx6qLEG)q4ZUdDT7b6$P700@kEGfV+N&iK@xl&Qqc?igUeoX+Dv+NAr zu@nM92+WJ&N zftpDCyhwauVX9s?IeO?!+qV&)QB@eL`M#dloDQw>z8*X)vSU{V92#5Ce0qO}YrH*N z+Jy;z4E)I6nxFQf{}l1rK#92d8%7DUy_71 zR1-0PD?*PC49D}?HgXlmpGH+a82@VL1ADtBhOX$kKAISF273h!m*_q_@vdU0=5XJu z;kAcB(EARr$@~+Yh)|r!+P_LvGC?zfkw zL)smy8gi+VZ?i3Pzqh64%a@$>?KcAdxUFy9VzhnP0g+B<`AQK`u;}$ys>0v01OL+{ z5lN1oO4Ravzg_+M%_&aa-LF*j6P6w9I<>gp{F?A}NDh{t;pBv}QQn5s0a!xLf8eGb z_!Pe3d(*pN>{+Hu`5z>B>60)fuhW8ckk@v$SY*#y?12Z)oLkerL?rAJtV?^<2v% z5yU+nm?6HmqGlS(us&ILF_x!ZfNymd`_RzZ5FzH0lNB%-I3&N z?AtvUTCN4IaUO}~;pF7Q`aDy1A1O8Ak!b89wr^+={u-80ee#shI#QIh;)z0IPgss?w`P$#8rJcf{IkXe5pmI_jJR|Dx z`Qx`prptA?RF|kOleoZ;4!>I$N6F(Wj2#S^lHC0$2bli2znGFwN=UNe|IQ!boECw9 zXW2pHk4LqU$$IS$Plj!2vc&tPWz7e?O4}vvso8kiyQ{Qr-<*6D0sHnrgK*X;5Ss(l*NA`fqG)`rH&2_eW7--+=5D79Y5T%j zTCT-?yF`f`y-=T=a6Z*eXVE(iMdPGqZBzm0;428lp5nHSHzFxK%DBT*;w{G% zTBE#vbgbs_zmGu14bmoD+)uUXVbc<2EN6FV{j=~%*+$&0kDpZ^zpij@O+hF-mA7& zi1dC;w3FZO<&XCrUGC-rR=TNIQv|XWFniHDUj4r~O~UA;fkk411%UJjkXEK1?B>Oi ze%R&qznq@$6WOwN?iXg!0*}~Vw~IqZ16-!~U`w_3W0pIq{!I7@iEjQa!7WX8!#?!f zp3v%NP&VPvFJDL(5F#UsH~tKQ{xd9NENc*ES+-uC_yiMtiRP`XPu78ij&Sw5#h-$B z>hb?Ye(idoi;6Avtj>3(8q~bMy+ms32?I3PG4hxd(P4Wy+S#rqikdK2ygMyZ+KjwF z7u^O-r`WP96h&e+;lyhRr8;3b_Z7r8$!EEgK7>M?uSF<)#S`86Pqu7x3j-U;go z!K0R)Q`tY^D^Rb7kS;S<8^HV*)km$MtIBkgx6RB9^{~^5`oWW#9(eW$J(xF3KpNdE zg;nb+<~&)C8q( zD;m3vpS9IAnz$a3K!O=AO3Y&NF~If*r?8H>>n7paJt;s~r>xHoT>G1ZE7pdj=iX<@ zbQ=6C@RbRqj~zTQ({{7ikGCO6z7W4)R4X(UNq$xnj4Fp>)G~9n2+5Ef{&^!CU=PK< zhR)T~wE+J)0sqq192m9suwVB?MnrtA`Bbz80H?~a8O|~NhCsx-a>2oaUEVERSebnF zWL7505wYC^2|^J62-7V4$KBnVx$A}9tvYvWmTsNzZk^+9z5NEaPII@0xm&-}tq`}` zk0^n>Z9mWm0`=BI_@wUX7IzJloaB#xe)NyB^2ewc`SXDAN}hvbZ+D`rF?2K6r^=S{ zGloC;CBdU?K%s;Ra}elfg|k-w3SJhjXJUOH?_1xuP@ZZI^aGjswg;@^C35ktb9wlF9NYMW&ebfKG9`rBTZ_Ls@8{+Se z?O(EFi7?k3NOerJdK{IZ)W6fVq+YWyj=2`(INevalwYuE^cr*W%G^;rzy^>^zVf&e zn3tDtU|xd6C>~H+4KGa4VAa6*RU99l8V+lzAPqfu&q6gJ`5#jQjN#O}FDLyz5tTYU zK#~N1lS#?qzau55a6ukU7-~}T>i4rPoE+uuPvpL}?+w$BC-S2=giBB9 z$NK);y@X!s(^*lMV_yx=%D4N0DzLBYa7`RkYvmufSpI?9rH7Z!{S@g~N4xB_H@Q(a zXCT*Eq3=AC{vC6_O*XcWQE+HIBX}IEKBE_S(J<$PrZeK46=Xuw^fyRc;KsKw<@nDC z52DdqI(;KulxfhJW1-dip;?xh`FRtQ;otiF&t^6Dr~XdV%)~WJSj8!Su2<6KL*|~ClAJJt;Sj*2e*T)r+^aLi|Asr`D82|H@xMqcD;z+A=sy>o;7nNI zy#*%Dirw%y0_=qL)Gnb;qZjxLS6HD@H(b}F)d_NBO}5tD23ITyxfVEa_YGl;_gn{{ zFp+_U?p$i%IY=A?)_71E$l&yqmp`()SV!rkRTEBuKN|8<1JD!pM(Q6*Mq`<_`c;|? zEgva}E5Occ;eDOqwTD>q?{@s196rQE!%!QL(U9fIJi4$$ShW2eGP* zS32S2R<3Amtw)pRAE!Y+d~Glr2vz2Ams`iWDa6|=rn33SgF`q02mNAkeOmd1^XDTj zBTQ_{ePMDx!*If+&|A0Xpyihw;xBCYLCECE;O%gucOlZ^&0hd%vf%gb{@=H8e;fC? zwb|YJBe$eq^zh?6oFiJim3M2HfhCoq1niM~1kOL8^c>$mP%b{KlBHie+TxFzEyVW? z!c=XzdROR<#hMMCDwPnaV55Zv?aX`UAyIB2K+3SoB>OYT*!r6|t=iyX> zME81QwGMEYd4!l~FQhEAZ2o{03@Mfl<>SJQKbajrlgdi3c9jW4Tkgpl9pA0vVe|

FWz5>B=#JIz~TI()xG9dkd&rAcjP&C<9jU=D4cbwysukEHSjd&oki)qBdF4wKtr%E1H}}Rwvol z=%Pg@XXD{uSF^o81w{!Ln$bFQ_pI}=ygiL03HNMCAIDt*(~w> z8urQC^&l>uTZU*|cJH0<;OcxaPFxDI%qyL&I} z5R^Xjk3=T1WtW=Gthe3kQJzz`3M0A>KwklfZIwADz@U)P!LJXaZ6H(ytJKW} z>d|>P+>-vdsQ-qR87HJ(z*q|>eHTc^@(*^)1j_#@2S#!@%;oPW!p8lS#L7%m))xn% zvJTGH1nLG*7}PK*+Q<$?^OOD2R+u)1P8lluV+!SR@PXOq&cOgcuSCRP-zhHdr#E5l#WS88f2E} zP#w5tcdFlLIhFde_v_uH@BM?N^jq+ZRy*hwM-^&H7$Z-U>?F5pQ~#;C7s$i}?J_;V zJ&UCMY}R-ixJ*Yi+C>WpE#Zg3`R3C~_yURRU4UFu|N2`3L zt?!k40-#vM?!DA}J;#?0kcEBlVrcoP>b~Md)e8)Q)#w}ta@3b1tnBm5dOj%t%-VO{ zs(j_1@b`o}n#|8|X~xQ|6f-m#>o_a(p#e0W6)8IZi zp_$F#Yn)_}868;>A?c7OgU1(4W*>%@E4-DJ4~mu$lV$xC5Cch-k2zgsv3aM6yk)l% z4+1hAtBL`+BE=R4dK7x{*Qe|~3Egp@=!;O3AKx9xE*+ndeYq1!4nNM=|Ac^w$Tw{% zVf?AdeXxcCF0}!D1$>VPsSdON+nL-d#)Rzx@jp!531dX_p|7{ecQLP!Se}x5MAYQn z)oe&WWQ4O{%Du``C_ecV1iUW!X_-U;$B0=@NfV>*uGfN}gAsi!r?1c9^o2(;pc8FC zxlH~eJ(4W=Lw_UV57$9)+eaIvZgIEX38galj^{Z#J8@|P z@CkndI7nwExjc!%zt9iK6S`RCnMWlYj@1m=KCEBAdEe0N)k=_{5C(s^O%1RRy0XyQ zJwn4Cydw`x@C=h{OK;O0T9G9O-e2D{*x6#2f)Ab>#%A|l z6!K8aQh8(dgDBRIvtx(4QWqT2fY$itx%081EKnIH0=Z$=2$#}B{^Gs&DgHRj%5e{4P{B&nLMN#%-^ai(6^TAQmIR=F6f;q^2>g(DCWGgBG^6N%70t5sLJaotPk$J2fwyp(kNec4JxqT?u+8rbpLR>dGtggc zxyM1RhBjuLY$%MvGemr>>GCm?jY$1M}&&?OU2V|LH`| zOgsLOedfb}7;~QI8zzKyE-Gu@Frn+(I2t>Cvs3PGgmGy6+SDwwtIi>e^`5^_{MFLZ@dps zJ8-T-lxhW9k>cPJcDhs+pBg3iRvBf=!_RG`H$Fp+AkSQF-Y*8zidHN?)nkdlFPtep zAChP;mQ^`&XL#*fWEf01mTcCJmNUc2`FX@`THkcjV(!}ec*EP+PsGPm;U9qXCmhSX zgqb}5Y^?98@#?KD1*1FK@u=_~%1x%1_lwxxEU(UW z6Lp1MFKM1hi`Gv%FClp1GG^RSj}H{NVehfxs(D9tCa6&ESj(wcdk(g6l7vHn?Zv$g*g@`eC zjU3dkt86cf`p-BsWoor)BVx+R3nkC@UUWBCC}HObR@|WDgb}Y7_DlVXeLnvr_g2fX z>95hoX!ou4i%+oj)}zv+3G^5^G^ftd- z%rEEBn)G+|`>n@5VH1!%Vd@|F@l2T$HdD;6&VfCl{Pbaj76zq<1u(X}Mhy#Q01sVE zxi~5p#vZhho2Di6Yo{h=JVOT1ZuSp!ZNO-Jsr7ZybuIJt+G#NNgT~xOJ=TwHJ+Dm< znw)5Prg(DVs%J`+K67l)S0R0+?+GWSlyq%x>tF=?81<73hV+?<+wG~~+gi~AK+|mM zYBWA^0ruA%3?(_Cq>D`;!twegwd*<~d2G$X!i-kD zET>m}{JF@!-$&N|<09IsANjkf$^4NNULdHbe8ksepLPC9shnu8*Cb8pU2JMtF$Lju zl9aDs*n^76m!lc7`hSnp|0)dc>whO@eOEnOEUPqLC)8lEu!#dXN#GuvsYdk$W3k5a z1`%QwB5F;)<1T7JOq=+3Yu{*Me1oFpNg(@IZSfBXPOyocCopFW1cftc3fzM>6)J`<<8Nk~H@+P+qY`7e>R?=b(}ZYeli#%axXjK`1j*XIR5QJ3CFB|ahq%BTn#M2 zS@rgH@TtEq?B^F2d(14gjLGZOH)t9hV1_?$EU^zYsRBZ3&-*B2Rm`0C&;A)N?{+$rEKK>;q^aL`qtlXqrU$yFl=iCKA3$;kNLFP)vU+^z<6~-ehHg(X*GTs)3<7?x>r~1&+}$m z|LnI_|Kkf&T1r~(o50rmy~O-YN2A4RrrC?k-*Mg<-Jo_5Pv<-^mB1Mf4en4(+kj?U z=qtZ;>>vBfK1dInr-XX=&*V8#!vc6wpO^vjF}1Edsq*pnE?i8p9T% z0PuEmw;w|M-uNKPQ6Ej8qSRWQXRwUoR_|96L_CnCRU0JQ zXojUNnv72|x>RG_r`7%$T2=ptzV*@M`s>Z0M8~;4l}oNGEb8KJb=wFQ$jq6Q*iqQ; z-XSHFN+c-;E5y8R1TY>X+ZoH4=H$rCoh=!5zaC+PjSMPBt}K{~eZGS{li+n%v#(T; zxr5<9ywm2&Ez;RV?wZObkT$p+jFarBq zC3|)VtmNP?;T9AGCfBPcm$o+Mi2L!3cUF}*crZ{V2M>6!PdPtnty;*)`L%nI^Ukl) zQ_g>RGD&FH^lty*B5VJrd-`nu?T&8kfBneq7tp@Y?5ide?#afIS(cO#At4$-zaB z0x}JC=x68_1M0rArTXGG=&FEXfm}8Pke98OYIZpW1D$-@hEw=ET+qjNsjuXS2OhzD z5c`xcRj|n2`nGO0yIVK9Tg$m6`Q&cSa5rz(b76O@&fS`&Tjz5N34j^reN}1yK+5t7 z|9xr=g@C(R6y3kL^~Eay?XNFpI#VsSptxV_g)H_R>Zz!P2Q8X7;ig|3>Yx6N(6SA6 z1T~#b<>ud_v|Sx%JYU`=VaQ`X9LC$5<$u%LSnB84+k=i>sgcRdz|bx^F1M54%aCTS%guX!lIR9o)4Ny&yUo?+(6aX%K3Y-(bDeE& z{Bj5QOg5q3~YzVa$mgv|nO@gLT5&+Y-VC`QEaOvGUO7-!ij-7ArGtWvMF%&dx z`dIYaD)q}3l$@HzcrAto9(zUzWJRz@i_jKD!00LPYikI2FPT4YA)vXT$85`+=2#Gb zs3W;n3xlD`*e@1rXr(b+1WXs$uGTu_z7VYH;JE>GCwfw_5vW-wyzS95MVNpkSjFEI5|Zw^0WzvOn6 zB(Fkw1(Fq4QmM>PF*WHAMn2%Iidma-KQ{4OpOFLSDHoH7FTkZbcb%r~R5hSMNRD>c z-^Z*G%}zslw0H9znoai%&com_RVtP_rT*A3i|*iY48jt14f$dbx>2&*mV2r$90d4S zp~sucMIlf|16E&crG9jRZ&o=FpS%L~GW6mPy4pHhhGm3e?ABs1&@a?B7hI%vbIEzF zk=L%}wE)y$tlr>S#at*%5a z*ygZ6!u}ez(pPPBAxl-7Gnl{J)<@^X6F;EIfz~8dr;*C6pYZe)dOKG*CJDnNPD!ea z^D3|@Kc+biX367aUf1|jkR;*Cz9qWES+W);t zzc+)c-&}*g=SK ztyPw)VL-JxO^$fK|G<7v9%r4gEy_aUI4HcAm_qO7Oh?zzg6yB!=C;DmNr%qqB?l6b ziDIArU58`*4uc{0K+Fm5sbl@8{DEg-DlZ166MUFv{swmwbiBvxKatn?GI7= zMYP|pX@{OZQi!g*5xAfnQ2kLtG}TG!Zg-X1?VHmt4*^P6zp^fnuw2SbLBeG0GMCK( zoY45Gyz=owlOh1s*r`m%A~`DahzRn2*7R|>N#*-WR^y+yFsoaoI-Mpp4TpaU{gW9= zl_@^&XTnUf;Qo6Md}Gg$sFnzz2tll7>(dfQNDoGv4&4C#SbT+V632n#^}@%&PYivD z|NJB88vXp0j~z=@uEEf4cK!OPXZYiTR*Ge*A}{ghr?J5LdG`{(1QhBj86@7s`_*o)U&6I@ zOBdvw-8xH8v=rI~koNSY5sDUMx2441CSXKx-ZTy3R22p0KLt)(&`HgeUX)Og31Nxz zhDyZ~Df+N%y}-G8oo#rQNGs>7GLhNOmpNJ^I&wRwq!TgeY*9&@vOLMpx~2a(yX6M1 zH7$)w(38W`Qph>vF$+m!t%?K1YW})Lkenh&SniwrT|*$l2Z%tsoS*OuR+w*@HB?%T zeJTdYK>bhI5f``yz0>;{4-Eg4cpx|xy3L)|gWS^qFvFT8nvOSebFXH^@x>M+SCT#s z)nNQR(9z?ol?lMAjaKiz{jBk%rQ+Wp>A$A+tw_a=dN$G5$F~Lv^vP@U>PJ2|Em?G$ z>WJ;0IJ%Q#$FvAu3NXIw$N1Y~eKTbT47q&(zhKS0>f%na6MYd&Gpb7faLn_wy)d6_E?JMOM5?r!*Lqv)@d zg~dRwmD$Gj(T$gMmsySPFHuq8b$;m8B}8xek!{H_-jmJo zga5JNe)A1C++Fsf%e4$pVzc1g;vW2}|DfkT=s=M--7Tf+3W@tDwX)4WkjtIoCOU8) z-3)P`P!9^r)C?$8zrVpmmR|R6(0-F%DAagaovtT-fq~wy>m}ru4SK1VC1ZypxHae} zcqB9E?j!lxKWxbNzwU;tCk1YY{(?(e6e26@@V{lovdMl7tm5E+g3MSJjbtn&YS>uR zU|^$oKTtfO_gGqF^J&ReeYiGs--g?aAH2cO{+Cg zwIxSXMY=Xc6Q7DEZouU`2`l}I+GySjv6^welEA_hJPCod%R6?Vgq80KM&Qq{beWHM zQ-e-b9p0VCgD7j(z7?dp&$@}rOU%pphEU(eAQ>)1x8f)I041ByirrQ!`~1zWgBa6K zJx>45KG%=VKDWnc)8ywu;yao0<>MjfSxj=lvkRPkzSLSKAmz=imT`WQwO6FIjM#?x zAvRy^U0^{Xch73g$XQzX1U>farXNHk-&2!thPhmJ@g+kfe7F?=0?zQ)x3=qbaLcP7 z#~zot2dDTC_GFLnk=esR)Qdg7JPwi?DQJ7L$0VH+*OR1x-U*`aw7%wm(fVV5_(*BC z>r*-8TL|7VdPez8z51efAmtWZHo}YxEn0bYgn~2pYRN`O7F<4nKxN(QTFd$Jjg1bz zU`xFx=1#O+$O56ZU+PU`b?jL0y=#0+Cv`{GC*+H$QX8hf*WiFv7oY=(n* zoTEpz+1BmphH&+WZyr9SUn|sb!aaNlEa2^4(bv&zv^2WI%X{N+*ArTac>7)_Z9~na zzwJM13HMUJm{#QEt3wh}WavN zeGp01dMgw0hk`=#J5N!BO{3k&DZ@rk1=p`r0xj#~h59i$xP><`Ph&NM{!<(arpRB> z0gQup|5R#I*(`}uyutH*Ye%u9*~P4dnGX)rjN=qP;SrupIXCs-8GxW139XKq7z!sv z%f#4G0d%zbM9^X!gz+YS_donDc_cm9i_8-W_-q!lGKWYi%K`o8&tP`1KiR;3`V=4R z=|LN8xG}I#_rb<)IK{i1Ce29e3+w|w5vT?4^QVpQ!a%how>ai8_*v7cSC0WjHzu^G zfkvzX-^Ev1{%dMs-}4ff;kLdw&gLd@!n+?pN;17k!8(ff({H%*4FdbTRIU$dpobH9 zZWdCik7(N1tJoXSGhu3j<@^VWzx1zz-g^I)f6U*%u?~C609p2qvkrn&ko>dDutH7A zAtO6PB>uh*vtR41&~2LakN+deY8wwJukM3?#}ypP1PFf z**~=slUOb*-SZDMP=A@;GEll+rA8gJuJ-_HHEY6`BM#K;i=42k#YyWq?aKExK$9~e z#$eDshJ5W4j=$fYIt0X|w>U_}WeqKJ_7aWJQuy^Aqbj~)DNS@IQPbf1bUoSm2lN=IMU2hG*N2l+f!q(LlLfzWti9?&1z3{r zQU1D?{FRN=cd}oCBkVpKP7J4DR7clNDffTIB9%qu1J0Q>moSs&kvV_w_f0<%{q!|05FOHv$i$N&PIU6w<8!8CkS)82RuN)|9wl)+4J zo`S#el|zDcqyqF7S^EwppZ~3FsmO>k6|U2(P1)|p*B*Ifj);O`d2w5Av|teH2v~o` zgsF|?zT1vhaFmt4(FJ}oBOG5F@lROj5D)?9__SNE;z8YeGWj&jddv0_4tfbl9}GBr z*4mS`g`)JI455c$*ACfYi>)^80;)K&xOiLL;{;iNPg_N5%P3}l)uH`Sie*;sTQZo$ zt~pu%tWF+yfftnS6HN?1M8Gw)(wLDJnj;C;XZG$cO3Jg|fuim+idvAxX8+aH+DI1#vf0hH zcX6F+B4101WzGe7W!{XbiBX-gnrHqUV8{=7erjSI(f)CJ>q$0#fyf7So>U8wT2DZ- z5V^B8{qu0eHj{|!BgqM6crtx)VnR3dGuD&d2XlbnT`ql^4Ly?Am0eNm{m7E$10^Ai ziZ1LOW>N9y+SKn@rS#Sw&VLkIsSQ@XeNig=t14&ysXzV&lON;Uu?QFQWhy1QV>Q2h z5EQhWHZ@VUHJTVj=E*Ma`L9cxk`(YYreYxoxQ?k{A=09JDdl{a6J0$-IpSloDttqm zTHL^n#Y!mLD9S8>P8Sat-GTjok?MJ@+>9M&w8nu8lxglpYw{=(!9s-TMTA+ghTOyw z6_nJn+x9{2&D_Mk#M^aH&;;$|S~-^ntxsB=oX96dHm6m|#E)(DA(Q{Ky66iA;&8R7 zgCW%XAijX4b+MWs{5(JsMJz@^ue-blZq6WyBaj0mfsjK}m0!*Q4PBekvuS7E#bHju z(7^<;n#-&m;veJo>U;z5I&0(@ouMqE2iql+^){z?Alv=A^|qn*`>;p%#`{3FFyl}y z3-bRO)emJ*&FrNw5&wb>X}JF#vL6(lXBwV=sK&rEBszglYJVlS9JWV2U?O5LtPfdc zFn+;JePLYkHT6gAJE0o+AE5f}pJ~dnsNVlIGZBw~YFh)8V)2cJ`MpuPd|H>&xS;=r z>GO%Y4AG@Xm!oy*&xPL)!7-nl=O5N?21pz$@}r^x#`A`sl=MemjPKub>x-Q8@%rNb zZ$lCyJd^z~zWDtAQzLB&Mr0xxDe(VSeMDd9^S?y#C*gmB``zgOh$L#qs~{0nGvCM* zl@w^6PsXr$~Rz@a4d~OB_{x z=O;#$r*x-En;-99;yk{@%n=5uzgbvfzgro2JE321yDrb^vQd|3xIjN^`18r>=jLhu zr}Wd=S5|J8pd9_k!1VP;m4rR%RCrnBM#jdF>kx^L({6DdLSZoZt;7SO@psKWjqNW8 zCC?Or@k(h%1C)czCHa^lPPjfM;hMa{w?H`P=!e{hu&cLKZ;epDjiACxC2<^1lZ)=FRV4PTlK5i9)D;1%aX+X9nr$1nBq^HKON;B78 z{X@yopduQ7xxV5r4n8~Kz?rIG;SvYLo1hMSzw^FBI)Mqm??+b+eycmX^5esN@7MDPA_U#q ze{clRsO#&K`C~YK=mx@P=inkM4Bgod6&n5VmGg%b;FAYki)k&YH|4aiBZy|oxN8V9 za1`%)Ku-`IvU7;W=-`w37Bw4l+j@%zwZL=z2k`j$N&do5?>0t}PBV2J z0n208r+-`#hubm8?bfXKU7FL0Mf=5o=4d|EPAodsomdoPs$hu(AD#UdeETHiH$C#n z$S=`dA2|7c1Gw|$f4RuKHnV;(&8qs-W@PJ(ymJlDET6@zjnWZl3o$b9nYIX93laIq zWRveU!LIm;a@@L1urJ9>V)!NmkDZb~aWktTbWv4+$eB5A2Og87GD1AmR{ z&6jZw4p9h!;FoUydHOPu7<8tEe;F=eI@sm<82zF5XIj&<1Tv`-_3>S})=Ax1G+E9T zhBWj%tt+VSv3*_*)3qa3)9?e$UmULw^OujmWw+>iHc=%jt$lHh%VkIEi_+OK9Zc+f z|4Yo^x43+w8JsfVlg;48ZU)`_{a1GWswCE&=^JRctO=a{G%k+~(Rk4dl3bX@dxhP= z0CM_JqJ>C`op_bU{=EI6)njQsnjFs2SF_m+uq(7$YvAC}D@yf`x+PluMrdUPkD+Bb z3Tp|c8Row!`i;tdJw_95ZWX4iQU+!tVr$|~9ZXpn!* zb0tKlo&6w@Z|n2qaKx#WTCdEb&U}kb+qp{NJ3Lly!PS|81sQG|^2}DlrUge>)kPa( zHPP=u1EIFZLB4EFmRDeNmv=eA7TabaB9KRAdP(XYp7HHsvzWcRzX%=NsmmR@Ea&n` zD8j_4H)i}NA`26vskgH_QuHzJBwsfcYIBY^aJvD9D!>Z7vdxK2pPA)SiRR`EK}Y%#58J2}(UGQ=fs#|3hio`P`x71^B?Wab!)j zVy(`riHzJv$sfE>-hn0TKy_i-WWkI7TG($5fik7%5x6CPkASQr1Fsv}Nz+)G0ew%n z;svn1cgg7_#T}EeU#Nc>TK<^vufnjK0GlF+n%ychlQeWvk2r+=P;F?nPHmOEFI9D{ z?Ovo}8}+M}%+Pji`OcQhPSZZa3Kp&)>c#NdF3we8D{s-~Fw`QUX`3i<7HU&DUTQ9~ z%LxAzY$6HHOsndlWO_=a^4RKoOt!FoeZ@0WUk%+Q!<>qvr5q}TkZ;qJp z(lxm}(4Jb8l@%GH%lY8wO9xQ+^i`^9uX40wgjTH55p37yfGO&xj^Qvh%0nx8hrIs6 zc2#*sdfH3UL$yjzm_(lvv7kU+EiFIv45x0f-F-eDu__$`Mxz}6L;%gP)Aq?!52KfG zD9RBH>o|Y{Azs2UDBdp1X|OMQ{4=`b4;?v+k$b~*6%0&AxAm|0#<*Ne2p(h`+8|Y! zBNG1q8NWr!{@;xs?IU6W8QsQDVK&CEYmf1JZ;kCW^we=Vqs|h58~=3p)}Q~d+M21U zY!X5nMG3gcz^=_AzraCj`XP`^K6;R!&Gk&OHHuYU?+(k-iz|o!)?y^i{?HvMqZacQ z*(!=Xuoc8%4rl7zZHOi~x_me!V(H=sy61=a2dc0lBa^Jy<}jSc!7PX8P}NAMV~Ef4 z_K z!*DG*Ef>7noioqTcQ|wP+i+%_XS_Bpy{2W_=X+1f$K-$H_+MrRleFxeRfbTvq*ooA zr^=Rchk7gLBK?^@z9=n?62ug2xbf@CJ8{OJ9?1*my@n1LNM((1Xxc$Zlwl~jB1whm+rkjMg2M}truc0#pc2bD^daZ+J83j7U$bHY}@ za^f&s;q(Ai6(9W}RpwxKBTZrpE@7rTWiH&-z z$p-E{N{WN#3o3zb#qUiSe}y;Za|d9SskiQ9`ucvP2M?Lycmw$bRlVlSNs(*KKzID( zfxe7>1}_F+I7f)$i^X<$A8k$idvp3L8U1DT;Qp1@)jhaJ2SyVYmvGRyEDk$y;b3In z?g$n~bmUHWWVFLdo$BdGVODRG{xuG`gvuSAt+m{0{j`nJ-qXO;$2uF}miOe(g^ z@(RwfdL~LKLc?FD%484y?9zkODK)oUni`!Q-kS&i(d9&Xc{p!o$*P&99FL@8BhHf5 ziGU3yU?FdUAMMTl*ymh9LfdwVl4`c|C!4zH-F8`kH*ebcKB7_ufilXGZ+8#ynW(#b z%Xod2=|2w{7>*sz3$=ZYPZ}R(liLo1zR;awLgj~b@K^o~Eow3^2QK4Gmba5n=%@34 z9v{(f(XBFY7hhnt9f_LUSGJV5L3L=ts%Y7Te7GV{hwRm;aD(~2CXW8o#L<6kPt7JY z6^`dqiu)>=AeNL!o`B?1sg~;H-hr{bPL30~Wu2##lg#b%Bz1HVU4D@+uPPhInR@1* zu4M-WU8Zyxb5PPc+X&JU=gWTYtSVcF9Rp`%e)Q{K2j4@FpVS><`YZ8{tLX#G(o7>c z?b*J5hau`$yb(&4Vh!k^zLholKuwxP_Q#B~{Ktt^FNfOJ0I@s>%S-Hcm67DAz>3Y` zuFcuv?#llSk9;qjhtSWUljKifqr__&*B5kJ|8U^i{h|t_VFL>d3Z-zCd&b=z_{jal z`-B5qJ}4s(lA|6Ga6I3^Uy$xlFSL`^RjcSvV}0^g5}OW&R?eUw3p!G^`>H(K|1+Vg zGqmC^UNzCo!AZ-@c__k%J5I5um6XJyq++wqm57YoZZ$Ix$*f&=!QQU+OnrkRLfki` z7GUTbT>1Q)BVEr%OPRQ z^T)efmrHeta#4h3DJZRv{{#B^JqLFgef=@CvdO2fCec@^Ex*`) zzaHOz#hcNJH+s-lOBn?Af-J=z1co;7j{kgL1m@`LX`jAkMw4ZnR7ou9e?eeQoJf>l zrVt*wiKEAoiwIAN!frR3AxJl&smkM zk-v-Py^g&m`WiXLr!S?)92wxg=?l{82`Eq*v;loZl2?@tvGX<7rfVSo;o;;xOgHu7IF5iBeuNm z#MXnnKAQM?60rB*1V_DXx@^^DgDz{iwD)BdO176vw&TC@7M|0$@|R6!c>$HFk|X5C zX%!~@Kd;KS9gDqs8K_j?8-N-vmU%XK&32S(juYTN^_`{0>1@o!|KlAx8~@&u*#%vX zPtLx`gD?C(YK8Ba8bUKl`la;o6K>qX_RBmbeCU9SlS2n7eWJQ!iHDI;_oRNQvkdO^ zsT1QnCWe0b3jf*WxIVJ|oyfipNU-0;(8L|}@z;rwFZn&k<)Wq1$4|WR6}_r$l1EKS z77dS3bF8{!F=dk0&VMs?6R#Nrn)W6s%|;(8Y~Tslz$N@2ZtKel)mvK0d0`QGHZM)! z(NZ&Qcj4Q%_{rGO(s!++G~rdEjYbp!xm6k@Q_w6+tZ4%GODFIHc6dj+*sR7{9d$54 zVc~ZP?u1r%Xec*s_Hi-%sEK*6kXlqtC@=!>?A7*A>H<*cXsls50;qJ~}=P(auA#qj4Hq8^y{A(xLKW$Cpl@8PpPj+&)- zs!~4*yh@I~Mld%%eL-5bhQCTdCUI(JC-`HQ5HCI5q&4U2O&}ck+SxLk`CvCvvgTjD zG|+7v(lYYeuc)veW+?s!QAfE%*iyZ-hJ{`~@5c)q`pQ)nC;lpJfT=3)EWH*SN=E)H z-D(z?*MI*h(1!h2Yg+q}8|q;V+d#01yc5ME;Iy)mp}XD8MtuB@Gw z9D2{R#Ec!gs012H{)xvUpgpvDxAo$CZa}VFMCgJhiz-GEk%ma(O5(QbB8j?M$yc3; zHz}BzU(TYo%odK~Qwod5&g3-2YEHV{pPV_h-aEuNvfDAC0|uad2YNaZr|IOFd&9}$ zd$1LD#cKYrNN+NQSVC~#G};%_HF(daUG01$B#b1#cAS2j5Go!GC!fdPTZ;KGmrL<2 zCHhnnOnF`IoIfebj8SYjXU=q9EWj^D*tOB_X1`#{e6+oJBS98 zHHRtY`R`wl0nM2a+Q`k=E}n}QW$FpwEZIP%8;YlHgCK#cvTwM&(~ba5`p%$l{dM&D zwXA**3x*#2Tg3*MT>ibJJO7rl#BCCH{Bk8R1?;{iO&iM8+-NPzX1WCJGZmYsV{{i0 z zsID!ani!=ZFQ@J-v3{}ZH23Hm`PV=~ZTixTD7i+W1UUKt1_VxBB?^a1&OB)kg&7>F-83WU-7~xsxN?Eq^syy?@@VQxe1ffl)2o zPRmRGp8SzCF|{id|4~ZAg|ZP!BNbbxCa&L5LLJ`?rPGr6&VEwxu7K(b>Czmz-G8xdw*z9@phjT^{1no|Tw#B+tFX9XGf@j6fI4V;p1d?w2AKRp~Uk@G)g z{pwkdxS#2laW47Z1>dQZ@xNC>NAP*UZ~qy2IqNlvvfxP_Z}9efq@FglyR4LSvG*N| z*SN3#u2pyz&FEzVQoB-;mzI0i)1t{? z?PRZmmYu(=t)KUoZ-bEJ;G-C=a0vtXu6j_15Vp{XOV@G10$?yz#fiKF6zFA^;xA_W z*Wu~~C84`s6&#QeKrf_!2esorPAvOII9WtFZrn0_nZ|Bh($P9fy|qPp$?rVYQQmGX zcw7EU`b7iOOgo&SZkAdXb|`=t)ORwt`tkpQ1(zIg%a@U`MK2t5m7E$_Bx(K^{+i~J zgU9@cXK0Yy5|7D(xA$Y^m8wyO+>ogjbmxJ?;EzTv1UDnucY8J|3m*H{r($+l3ZSq`k$2PzefF6 z(SN&lPos-nWX7ID>>3&DA(5!HsrS~YxkTSXlcfrCl$h~n_xzC?Rgu&(=Y+pQR9^hp z{E=A@U|>JGa}`wlAMY%|DB+lSrUo2Y3dGzN6D2&f=oEAcNjyaH4lOxWKm++6CmP$W zb^vBub8**(6(8O{(oGr6-w53lDH`V$cwiM7i?ylS$-zT`zz9YUS828o640{1$iqYn zmjXhmKo}RUzNU0BhfCX8h-q?g7ncLYV*fB(mGUG1j04)H!hiD$(_0toGgLjVIQ?7g zL}xMnd9@8wT`5W~_fGmxL1T9!Oap68H+so`atp}I1k_Sr@CPW#eZ)>j$UNfx>>4-K z!7B{O2{mspv!TWSjkN^x^NIG4SNL>Y$`I5HkserA5q+#jIlMn-JQG z`^uKmL+Ek;)s0s2#9y|Bg;3a*L}t+mlZ_4uCtGw(Lh%K#n}} z<*UTB2}878=$#w@m-_3GBd>G4-Et4)7&~MGj+=Ej(ktMO3mRqD6j;9>O z+%HpF;}QZf8SPNe$gL-8c%1$D^vEQQsOMIA?duxjZD(tYMdZCN>R(9Xe>tD>31@tu z#kcGuRr?&z(UJQvU-S%66I1k>hH=cpbq-bs-%DBeP}`&=!9zzUB4e=s3ZCRa+M;G8 zYnOt=Wnzt*kz&WbHJv{yG&hE~WfOWxK$)|Eg14D$V=FLbS~4v#S>nXr^BIPv=h z$ng<(eGv^XXp^r2%H96(dr`m0{~z##F)bskYyp4~+&rbe- zPx61GM0mlYe5R9A)X7h{)$XR}wo`oCNhxh0n3v$M8~RB*%Fg0;biC0hlCqY>2-OH!;Sj{)T&Rn))K-%NT-85C!>~px-yW+C~ zh?`c!Lv8~{ZNp+Uv-O_K02|Fy8NWh*+PuixWTwzg=@alh6ncZLCB9pgAhk3HV*ap& zmWBi^9qYY4S}pmNK2L0S`j>hAM!5RY!q#)Be|@uhC2x|WQ4*EjK70NsDx$C&nnJSP zT(k%YG;#8)7Vu7SXvG2MAXf9Ry?3grWAdKKmo>f-&yi)7 zo41!Zi49vl_M)?1%b$lkVfGX|6$9Yu|$#4SvrQiu|muk3As1;Ww@`T#qd@NJNuoS9hx@uBzm zb}ZKKd{}rKyy9+9%iEZ2Y{HTxuJYb{$bNe8o9?G3{nV_V!ro5z)499dPYbl-UJ4cI z*9Iw}O7A?^@F;88cL(xRyZ==Kaos4x%Mn0M|Nl4b`t}(%eRaRk zieIWH5Kt)*hPtz5w?!v1GD)Ser1X*n^M8aN;kXy&M=&j@l301$V>LhgiX_JnDJYz* z;8?+#Fe$mZ5l&pF_1nEfbnLhK_)+$=D>HC0T4rGh)wtq)7k7cX!>{Pu$8WPzf9?mn^0CX;uDLcU!As+O)|+rOu@LpY zk_uvvmtwG}h+cpSc_k%-@DES0bxAW8{!d5Y3j7h5 z9Ql|f0Lc=_39xVAe1}lq#2^~=_YF#=cVElh@D&`2~CQZjaaO5#FtfcW4^Q73RJp^<_;{EaRE6 z!Dq#u*E}c}4QdmHm)_fVWC7>sGiU#^(PD#|hEgp%MoBD2KSGk0>XrqM&q?Tl=}X<% zp)VV8kn^JcIcF??U_D8Bs>`*)C8Mzc#ajkdJ z)MWnA;G`?EeSi7_Q)}Tkbx_ti`8$^0g^EgwY6(Uph;4OHM4QPsldKj4{q|?m5r^u; zd6DEeM8+nca(DW#@dk{>JIrbeoc{)9q%5{_t5DgkWi1H)1FRh(v&4Jr=)Mt_`fE>I zY5nrLE6#sBIWHz8m%S6@H#mdnK0j9>$YF4K50>ZPazfH0Ok9yhP)A4`>q!ht1P>ES zc2p#OK>4q+161m~U#=x(a>w}~e1uocC_87uD)yzwP+Q95nuG;nIPO5q-j#*i10xh? zU|X|mJe=^K^}7(-7U=ON@1F)rLUBUCFl08((o*pB1SP!lVER&DAP0>F2^K-4JmZ~a z;VD^wL0_cIGQo7Sk$QXKu1!i7KDX^9OR86cjV-K?=<*!8Y?NR!Wfa1kIn7w9sl6b(g95HESFM*Adb4|e#2JhK| zBI^)IllK{Ggv=r1%HZW-W&zm7mYS@`maP}1W6k}yoIROulN5glz6oBZ=X!`G$NzS| z3t$$S{nbM@DSxY5Ih}60Szny|e-vc;_DQ87Rq{Wq{t!(T_>inO0h$;aNRGW-FRM=$ z=2O6i(h1y&x>n|p3`5k9_E*2RShe@ah{Wm*LocEfA561%P<8Oy^Qw&Xf;b2Z^#vT&B@--g=JqUs!aS9xM$fh>9W83@kmUIaG69FUS*VPq?N;X2p(cVwV2$ zF|Qj`g3k@AuOS&CGUIYXda?JA0Mf7^IP4YdpX|WgYg-voDA^?Clm*(gZ*jb0E68_* ztQ~<`?tP_y-{M#JC{GQ{mBDWQ_d+C6PpKh-?yk0H5 z+BWl##NZiuABDk_GywE3hAZBq7*qd6X7E*}wAWoz+Dzt9xZ;3*3f*~* zu&Uf3SHCUn*KZ4RK9D&~Fcr8b;DE~-D%OBmpS!t&NsU>7AM-!Nb87{HSE z`#m$yWjDKl{(Rs6UO$rEeV&;!XU=WToS8WzR*o#rvG(!W6~OedC15Ioix<%yu=LIB zuKhsCPaD_%ikOrUcsbZq4?g*3!d;Lp>VU=kDuG+BuEZcw{Ii?{uYJJ_;fGnB`xG7te4JS4N>-lQ#gYh{PS>k#XBi#)g{i|~)A##Qv#h@YBT#7g! ze&7u}7X3rsl+`1YUJ?PK7Sm7=tXWUOOs2$DQQ}0hMfEGB;EmWnr;GX%ik6ct!XTVl zBg}hPPys?5n49vjT)9TU=f=TLOTxQU$w?^5bZy(&WImTpdPusq<5aq~(C%vJKW>h| zXZ>nD&hi;CZl*TN4kzbsbc8Tg>Bnlc*z)+q8$JOZ21^Dh7=}$U*K4GC2w=I2YTtwn zWa9jRvdnfS`*+00ku^8HbPLOX@mW@;D@6afJWJZ@+-xeP8B|{z3@HzCVIGX8p!wri z7W)-O=H_630Y9-#C)GY%vFkFcvtB%uoD@V}hbo)RpGcpnS7_Sg5hoEkKP4~6j7)37 zgdKvEEd#EZ;JhUc%&b!Q_UyNTErT%t){I>pQ{Wh#0v+}$p8l@**WmIGIC6CdmPCvk z5S3AJtR!$BpKca@U@VwVQG|T~*6+tK)M4*dWVDO`IdW=x8$B&n16xeWtcZLzCAv(F zfQ4ITwnMZ9>r*&VD-H=ZUkQxu*wU#SHPn;$F?v^uYP2#^g+ky8CyK zF559ZyU}4csvo zum!P|bd&gp1@3`K~mMus7%G8@5_j`%Fb&;eo`ZrTc|#loys3{cT+3Xz@|Lc+;k zffo`9s>(sb1KAX9J6t!$tdZ?Myt?TFIbWKiNO%l^mKS7ifAcX^G$8t75>v0_YlACa z5H0b#94AaiRZL{pCBiUjo0&uo87NMqK{mG>iVajf31j}T#TuM4EkTFolYCNDBp?L{%MmH&$ z-Yq(iLd=eGzTdOIxSbncVSI%9120xAlQUEiK|ql|U?{~l1m`K?kn zq+-fFC?h!Y_qJkHA(+BAiX?1>bU;p$M?n(fC;(-rV!aI7NuL&OaEq7 zs9-I{=A=Yah@16f(uhhlSA@HH@pE9HD0lx$G)4R`hEy(KO_->7vdEB&^=rmCph3qP zQ}I&PiK(0`K#m$yxroK=vw#@f{T5<0;Oyi8;uRjT5CElx6C%BY9BjIW{oD%6^Z(MH_C*)jmJDH<}k@+{10 zD#|mGQfx!E%KaJyq z+{k#2N}5bgXLJqek;GY2_(38pq@Q(oPYVKr_}ek%muIs7|4Duror_%V$WQEyW28BT zBn*%sd~>>keDT7zMMq$Sa;!%g0O{Ad^2Yd!k~oNJyu`^Um{=9t?Lql6QeMuUwM1R( zkKeUG+30HJ3@H6e$FQU62hr7YJ5P`(_-WdkEMw^9WxxpBZiim3 z^?J2*m$Y&V4DK=ye}IfapfB>{tI$h9RGo6c>_Wx1mHn0c`MIQMJhWvuu@DX7QUQruZM zl|h(QdPg0CFbz0mjPMB-?Baqj*|FKeAtV8qE>2+%Z)j-vEVFdrX8C5dv%h`T3ExV3 zuR~5tv+oD=IU&gYypqT-5Enp@sWYh&5v{#r^OD)A-kb>Why&w^a8+)+>F%o+zuh+4c0*iAw z5rF!{B_PW5WNMF?N~Fw3$E=-VOb}p6T3nRHPeDd*7Z!hx#o^BhWdN#-ftY*=#Mor> z#9|8IU!j5%jDZ4e2y~AN#_-&+jAZz<$7pbhU*g+Tc z5#n!GVn~N^9vGS=m2{?h#NLk~Qqwk?oKR$>j?{diNJjaeI^G@IY2+ZNeojX*>j$ks z4$(*iIrIb)1FyoAL2)t6vhWLA%Zh~?XM3{bHsj&1^~p3JOJ@-d=mtv_t%PznXQ1F$ zCHU2481tDxEi;QB;f&h{_rwnD*M?({Cr|EV+>GDWd@PLMglKV?MuimkFHsLBjS@tSsA7EX^tD82!7d`ep!^-94n7H5|aEh zjucx{0Eetq{f@2E;H3TxU0+BK*<|1pk^h~6F4YACf`&D1#ebW0dbt8j6`mQ3>u{k+ z9ds5sJX7H`R1_fu2pOljRSVw`_Mig{9|YasVYSDNkS;V=(X7q8yeP_@G5;)yJekY2 zJ{6*lxGCte#LUdkE3nV3~SBE{NQ4;g@Mn`>e|q^DE%8B}f$D&y&!+{gLNsDiJs%Me>FI1^)9P#>DZ zKDMSP-7Yzi_Q(|6ke(&2FIWA?9$EGThu2!&Kdx`D%DBeZ^Jy;Zv3VdL2^h4=FADIsm5Zl-$?l?qqQA#yF`eDo zR{(CL@oMf6jvqG`&H3@Hvy9ru@lb^4+S^kL&zlod3eUSaN_a46)yR#tV0CpSgs11@ zN_g;s!t-nag$Gx+sQW$ZAw5_ANVT@_5q6}f$G}ACVXp9+exMvvxMTJ7haINm$)C1FVr>?Q5QZ414iAV&p*N7Q=!`#TAYheuyzNGT1M3h7VDu8_KkX zz+nynh?6edZm<$WrZM z3_y%6VHlV3_csat&nnEt+Z9KUf?b)!QM}eTROL$xe2rCRokkXPY1q}KxSL#&_*9NA>z95Ui?fz3#`q`eReH2;9#gP>{%JFW*=HA?n>U3%iS01*0T}N>s6K`iF}1V~?t2AY*Q^@x)uX z2$-B(Pxgep32`eg7S17T>U%PBOC*AA%VCcK>$jgY>x?*fuJ6fK3!umcs{EYp56;NKw&o#QPd1HF z4i3a+W0ynl62wh#j|*Zyh3^O28;>!(!W~2?Tu#dS(LTI(qys}%A3m*64@Tp`^nB}_ zk1>8?tH~p}o(%x`L)e@&C3m|`@Dk>`&*4uCl)d$%mMHtT=F>Q? z4_V6jbT)y{*K%FlP;0rH_SKv~$i+_BnOEzkvhOI5m`E z_sE5~eDkB+H5qN1QvKNHrWH&kMWq9^(Lm4lZq8L_|(%gp- z3(Rcntv$Hk0C_Imd4(9eXu|%lsROlaLJv6OL=tp+>W~eMc!-$7?TKU<{ooRWcrS}q zOS>8Cl@FV>5_^(LAojCA;fIC~$fqJ=s+;kPQ!%0X97`2A(F(Yy8+0`?Ogu$tEpBw&`|b{U``^&9CsRDAYLHSTJ7R;xLRi8#u12L6Y#%kuGgH=Q;tYWe4Z` ztB<((z~LxZ+a5(eaI9a!lET>LkOg_LuXB$4w+RDj?HV!(0%+8#WCdk82!WOHd>(Fm zxCpJ{3{M{7W~F`C%aBoLnx(xrm-O9=t?I$+C5n0tB`CiHN1ZM<7WdNUpNgsvHw8Q5 z!Nja|`07UjUGU^ca3G$H%tC&!qUy$`U>}(d3|!?)d!rBVko*PITPQkCWtr*Y%VOPW z!y}o#xhT_(Wmbda>b2VHnTMh|v0u+Q(u8c`z^JawW!B;< zs-`@sAQcCV46l`GM=Wn7gbXK<%CQ2FSzC=dI1-a)U2fMw@mv+?NiQ!8Pxi-7h3BeR ziz7p2WGx+p&--o;@m&TZtK>f%|M5o|8OZ;3Et%1mBw*@TX7xqc=V~xO%NK@D zaYin;?=SkmsAYJr2C;p?&&LH2~u@KXp2@dd1Wl=;ZilDhJI_<7c^T*ypjz`L?A zR3W;0eIB(A13GWcse*(t;$mjw3@S!evjB9+0d!cNDiik>l;bSK~v#X7ZffoZ->xs$rojA6J$Yiw($*7jC}?7C1qO#H zC+Z_roKbVHG`C#OZ&kCBD^6uRwNCsycwifUC-`fh!Cs#GxYXC#D>-zT5tR%U!&D0y zd=$neX0p;xIN_Xb3HBP_Z5DO2i9f=(hgDm38s5S@AI`xy|13}3=en0odLS~nJmgS!~U1_V1=>6ncSTp4|? zHFWnsjr@+x(6Z|fUI;fNV3tMzNX%G!VCEE1WpL<7W-tSLkz<`gM>+&MihsW{*am(b znxK!5cKjTzo&r3;7+fDZ*e?i0Qm9D7kH!!kP`_jMAU=aD1 zN~5HbB)FyzqNpwO_tzW80!R-u67~9eoH|4QIRJvP z<9emzch0n~OdnQ-0Rk6$bV5G52%;Xbfp?F~JsWm^^rac-0>U0UWPX15F-+8P& zlGob zO>57%MR;9(tlH|16;`VY{}}w!fqydaN6GJDEFD@0@P{eL2UFrjfhPV(DNyKOCXV?V zi*fLfB#pFzf-1EfSvT4b|0{H`L!kXAoHu-fUzrmC{^JI-^=K&LD)?oZS<$`J6WS*0 z=6AI95&N zYG>T_SG=Ml_8>xX2R%0dX;iR*o|*3>C$)#ux|EJC{inn28F*F0jV2&1n-yZ-k2!0|1_(0R zDUV_Gf!)KXWFko-9#vp}1lJeLIfvPaS<}tJJ;uD_NhJsovBfS=sMlrfNE09m-CiV! znthQhZq-3ed9ydH?;=Gn8%ciKxk-gSM9S=5X`oq7e?FCG!?}-+>Mej-DVq>qd$U@p|$xXtn*(x{5 z6ig*0H;F=?u~S;FXf^&Q{{Fh&dJox-gx5Z-B_XRhGO%pLQLwS>a-*PP$Ft#Bi5Aw) z!i-{S77%VCFQ5hJ|WS-2~UF>I%)%>=-!NOQ0)Un*b#z<#)ZN_A6a zUH62S{ZOk4xqUFiMr`(Zq|erscoAHS15_!*5IJU`D@!YFG2GfVxuQ(?-iwE=F;)oc zq13M#__U_-&+Ytk3;*22KiA=pn&hSQ=2*Yy#-sUi(Itmcn^-kJd;&yq=ZBa=Vfi(3 zIqxmN4c(aPb%dvp1y5s0@LOaiROgrYd;$|OAf{LO3p%ZSUNzQt3u~H@JDQyM_zz~J z7d$74=WVgR_8n|m${QL6O8>9A|3^gLb~2X?m!3HM$ZUooH8VMCkCfLH+&Q(Bav$2Fy8(h(_8p zY-C2npzF|y-J$y(I~-`JFz#!hjmz*~*CWlk@ZX4sG}J@TH^4!c)ovNx>X2R%z3|0q zWh|5SOYQa}=H}4B_R~73rg4Be4N;j{xx?AuY+tCc(0H^Vb|RMe-~45dG>`-Lxa{1; zcA7PlYd7;~vmrC?f#NSOrqVd%VAg|wli`h3ncN?^&$w#R0&nhJ4!zFXr07d-%Os*-t!e zKlM$-mJqfoD=UH(h8WGR#4k>;F&WRc4(>+krl}*tem?^tQZ#Z|I*Z3TW8x2=id$03 z$`AkmUtz_uSC?~&!Y$JV0{?@Rr!n4z6<%(>!pfc8DZCCccizC2@b9UXA?Bg9vc7~` z9fv;@vwUj~+T}={UsvR}-o*q8(Pf=K>UjG()^9Lh!)7*IlpzrTARL_zEUeXE*b-?y zxK@i`bV2;&4xCW*kGlGm$DSim?BNcxyVBF(K2Z>I{y3I7s2M#b#9$^OW!&Gn(C_R~%Z9l17e5;h@c zGB??s?LclgcLOC2bL=_147QV%li1^MievYPm*?6n>y9^@Ybf^vikx!(xI{U3%iYZt zE7@Cn$U`KK^g+-EhKUj|vd-_fCnyMOo@La0f%5p4A2?p_exc(Xr8)WLr&=6b%AlAgTDz3rv4qQ3UpeUkFs*UVwn%$VwYMscxo-J!n1)}mu2zQU~9DZ z)o;`*sny*Y;C*$SdPT;`!4*R8ITN{l{c#h1nk4J2jpqD1ewF2D3?T z;P3(lEc8Ei9Qw6$g)*Js{4h*sv9i9G?=fmt%O`5EYn^QRptDBp@9+v=W@m>E<_GZS zy5Qh9j>j|X*BD&lON$LcmEiGj$gYh@#updk(a9hT9(7iw@~_9Ej&B(1*SnYE>Ke_J zDj5a8r86eseBK1N&RW~l=y4k9i%{OGtV_OenPH_z-5-1npPP$w8)ZVR`_mpnf`=v~ zgHF9CuK7%4Yk2L8G~=#U&_sL>3s>kKUN#1}pT{0{UZH!K&K~B<_#xd~p}Sdp9lN~1c~tpY9E@h1PIxr(Xr+&|3F~kR6d9Q_aZ)3 z@)cyMvF`WKJ$6Uv$mBp)tWx#=$Yi5-Hwse`u8nJXj%vBb(OZ6`0WJ4U)-vMLo~Eti z|Lw9I$|(AGMj#_}@XTPQwRe~MQmZlacNv@)TR)7~K1-{_)wP@}XtB_Jzxp;El(Ax> zgPsyFYg8sBHljzEs8$7sY5zXd)HaxJQ*a}o^hZCer#zZ009euG8g;n>>UVQ}FvlwN z;2mG~4eT@nmnI_yOkOzg_^FLeNw0? zKX8)bf0M@;oNhw?2ZfqE#^C)6@#y4GlgAkJxt3aD8-sOF1v8>jC_;Sn{RffEKIbce ztrxM#99M@Wut-P5BvjZ}j-ww&|7Ki?(IJu<7_N#x&f<`7PBBPtnJ9|^iDX7@(M+a* z6K>HGT2~7AE1F+-OEpF+P!}!^=Ag!FyV9qeZ%yGF-2Wm6Au#Cn!X_Q1m1w>DGl1L& zC9LNxC4>opn0g($zZo;$l_&;hVl~zsX}_1@(^`x_%00E}koJ<}sV~}_yDh})!ib;6 zltVKwtS-n8<{OL6bc{o`{RwoS#fB1G7wq_2KA@|?wEt^o;X5Koee{>5Irtsx>ixz1 z=m_~>-#Ip}jhlKSZoSM8HDNps9m)^vik&?&a`9%2i|wa&qsV8=*W*I(8e7HZ0v z*6s~97kfQ)=-NQXH`rVZz5;d$n30Q`u31h04zG|$9Sgd6sIqLL@9VIFS+Cqo<=@nR z58A)1fIkvCbmQ#PlzxQ{U2W8G!WXH0OrkWLOXGd8AbJA6)rSsM&h8mHbemDrT3%EJ zPmVH|wKIMl3K%sO9)u1}HEKS^7c6qte1K27888D_X5%D2bm)rNMUl$Q2=`3uvebw7 zuhFSq(HeiEkKhjq1V>wuf04aX5tU>U<7-V#S!pX+BQ`B`Cuks=qv z3|*E2U;7z;nMTPW2vOQ^s0m%KTZj*%WTW*<*aeJ^p*0mCS(jws*f3&0X&B50!>HvW z|L>*N*Pk~vEdebM)nZLftgvk!4jP>0{?0$`BM9+W|NX1%}BmlsS}YDjUeTR2Rv3`&F!h~!L2e&FjGS6HO zH9ZrJSs9+9am0e+K^(HIHW)WV4MByh==fwyqawgcez`2J<=0QSg5^+hg=s4$v*1mh zxZ%)7%+3NJE;dGi)F_8n!UXaupG1a|bqHL8b@!R&vJ#9qQy;7AXTrAJ(81FKr-cq) zjV&s;M4}J$_eFuT>~!|(Z*YC&dGChUgNg9jth|h!RkMM2qH#@n!YojvC+qHK>d^$0 zSY_Y_ls=OY(f~$I);W9)>U2RJiC-^ERu3z$m|^ifwtiNggQ->})^V${&Ay+QeRpso zi2ncZ31^9B?|o{xvN|1vClul>OV-m^$F%;4KiVixkpqD*ER;^p9a*1y^`%g6G3?qW^HDLtr45ht34~bFCLXvB`W&V1Tx-R|kbv=CV^r zrV@mkW3MPeywA-5C-LcG(M}oSxg!R#>%zU$E}(;ky{`u=^Rc-IlVeN(u_usI%y$ z>6BjnyRrWo>mQ%t*EHl$gs-uxKK8oR9ZRuR7ydE$rvv^dhKT&{Tx>Jt_5{&%?8DSy zS~h*;O?Iq9(1#P?i1=|$hKP}Vm^X$iHjU!?f*^!Mg zBZq+Uto^U(e$rZHk(${M?;KjQyrZ4(xFrF0v(GC*9D_Q5*%q3YpLdcaolt^O@^Lo_rx+R-ginDGUjzw!snoTVf2`75~(do!l9 zlMv7}YX5*jRy#-nw-r1iaz7SEr#nOYZ6J|IC5+2A5DP)A_YpV(Qp3#FysrS>x3vI~ z6&}%mvzrDA4~vZ596HqAn0pa^hYp?<97>;4LB)2hy7C;vueQy?2Ffxti{B9GE}a=W zHx_RVt=dfccBuWd%;@o`Z&$T8?0{yYS!Lf4{#fujyqr+uRmQ?g;GBdShZ+mdhC$Kq z2k2z-x@8fu0Rec3{elxAKSMDxF&<8=kkYtD`E-hr!O==rfB;&-+zO*Qo_0j5ZV{8Z4>c4JeG@*q<0qxj=ykaoLs9%9~oRhA5ZZ1 zQM|!;wlyLA7iz39YI{icl%Bx;$^Hz|GaW%sy+gO_3DtV^O{qC^_D!M289~Y1 z=MaDC*(jwc^QbCj)Y6r6NOS@UETt3h#!UQK(FcF5n{>><0ps%UN&#|b@bq|66c7Nw zrU@wqqmW*I4mHj)YE5a-BNI!@SyYK@JArt*vG4}b;@-x>^>`V=w#G5GURF=9NJC2V z@cYUMm3q=X&iCTZ$24jp?Q8im$~DIM8*zD+po979gLrh!YC5GCh8lYtwaZvU8w0Ia zXW$VyH2FP`6fz8=`sgUuHE7C4sacczzf5dW+n-a7g;DfB)OdBZAhPU@T43(sQrT!w{3POZ1ct-7l7EnWyK|d z`ufnzV7vFxcJEUmWlUPQ&qGBmtc3$)l9P9qn&eb55K&FI2wL3D&q!v?Zp>Zqvz|X4 zW6qr)k<73E3KHZ=Icy(sgA>^p;E>YK8BmT5Ir>XjueJ`IB}m5) z@o1Xr&7CWgoWLLK`@?#)Ft6WkV_+;Uu7JBZl=-);o%`rpd1Q0o25bb%9UA?O7)_;y z))idD#E6C|Ul&X^Z8aP}*$i*=XyQ;2;nRWv8$SrxFM5c#>b zy04b@=EK}&o$#@=7yi6)8vd*}1%IqFr;4JWP;j zpTO@w`^He?8G!`jHQ2!<`Z?s??)$QicrM}gH>kNQ81uFMfekxI)qkqrScLhG5T_yh z1I>}muIL{``_2qZvjG9sv#>_bt>fzC#Hq^ntoy5ZoncnZPN{|)9`<2EJ$yFqSHfqTKn{Nedc;n~XHnn;{2dkOXwQF+lm*>e zY3O{HQHt3jxrF?!n5bxlf|n(}RC;9_|J}2I65=D+Xa-~$cvOZQ+npz&OF(P0ZSAW* zO*FmMsq5_dXHR^qS96d(f3c@JyFhHu{G(9&_i*P&a_=)T8X%C>Fu7eC{L{@mihJQ? zc=2*Bg44*;XJJ$Gb*J0+s>pQ1y2pkt6O7o?9{BG4A`W~j^e}IzL4Kn^9}&&M)$;8PD%)f)Fx}7I!YgIwiin6!(iTzBARHzf48|IB=zjJu(H@8JU1XDd6Ue~2Ew7^ii2elODW~FV z2DD$}AUR}e8bvG1a1S8DxuLJ*7xrSe`J|`@A*U@y=q-8F5Si_lX^ zF|mc|4>;))Aw9)7G*Q=syDY~%E62ocpin`e)G@IxyQ~il zuRn|-mFEP9Z3m^-TYtnYWpWGU47qU+hcKZ3UACLy!RvwU7pv6z#!h@%<69@e_>WID z!#H|tqOb#xR7V>{N_c*(HKluf@?uJAaP)L4c5Q>a?Qtg^up0%eM9kzpWJETXW3McH zE2vA!#zx*<*SaVRWxLyDJ!0v675(sQ+4SKUPF5PPJ2G=P1qLL49xlD(4Js1E5Hlpf z474b?sOQSQ)<0?M%wOW++vjUh$IK^SWJ4c|(MeA@Kt{sWrCT2`9uiLg z5o;gv2dlR3`;*=E7hKr0iFvKlGy$d5S(2p@&>@4EU`3*)6Vf*bK%vsQ7PP^@L5im*Xj? zehGZregio9L&os#ui_lZ&#pxVr?ov~YU6-y*?u35e$sx=xc;f8<7Mr>Kia)`JH8jk zSpSNjSikE}tpDEQKMnu;eq#MAQq?~ie~$M480r5WPBGBg@x}gc{JSqz{iES`wD*Gl znO^yWeZn9BX|G+0FWL^Rw$46m+bCs`T00mmkC({!Uq@^Ir@#06l8)u+atC8+|3tTa zzt3vVShdI0JoE>s$!kPIgSO^xJPUvz7yK-xe!Tqsg(puu^4Hy|nneDDerI{;pH2Na9wKi2(uD(-SeLm!g(Ite zZ&PGh97p1RB-4)sKzBHRQsL*7j}-JB>;O56e59!V{X=$d;_K5t!I~DuvRu4yOfJv( zZ@aW*i1pGlI-32H{vX{x2s+Itj4wxnFHV1YQq>nm9Ao?cdC=~DLi@*9|COIuKiFdZ zGaUJ3lAWpW_Q4L=_#%9ab|xQI8P-1Q)#!Gr18+sVJSP4+I(>hd|NH;L|EctA**{1n zp9$u_>-{O@yP8>>a6mc@gL_(%flAmYA2IB34tL<&wa8~z2tn0aPhFX-CHPEfWn4q2@)kYi0N+mc0g z-(N~pFW5(#&Z3k)z|r0de&>7elleXdSj>oI4VNXFXU7{Nai4ae1>uN8I`(yU#jn8irPG4KZ6I2c)ypgbvC-?zM^VoCmy`-`n@w z07W&w$NHXUet%58X<~$zok^JQ4|UpI=h9uh2g(NbrySdDf+fgScJB z1l*7F7x&oxNHtQp;IxH{}5mQ z=7jnOe`ohFRef*&^5`G2f55-R{?Tps5YxKHX{N>g`K%2*@!}EOE1im|@bmVszzQeS z@BTm4FSCjh>hGv;fj*+YGC!(IhY6L*h}YIA%|g_0s`jFEfbz-bRe)0JqpB^hiJy4S zP-77KN7!RAy^9M7Lb=_^SYl=T7Wr5CfkV3~|A?<|2o@2n9be=1@qn$(-bE_d=0-?0 zD-ve~$c@sH09dP^bL``T3pD|ww>1ki3VvSu4$(?B{}^Y(h$Y(hqm8e}Fn)UCbGX%9 z1?X^)vxw_=5}!N3;{(a#bITUk(vj3Y&}^n;uFW4ezO4E4GXz-k(x$3Fv*YPGgO6(i zkstqAhtBy9Dhcsr@BBsr*J^&lT`Wq^FlDs%aaG)-cK?dl9cyWRb4>jk;Td0~ecBJ$ zhnDPzGp+aHbcuu0pS7%W|K8*3d?1&=rJ*^yx64|P%BPG8%L92x1bf10?31w13`R1) z_+0Im@N?ILCFQw-hf^Gp%!RG7V2UV)?3VC5yCnc=6p}hwcTeQzbzKX(kCcO=mw^nk z?gTD~Lq})f=yS%2D9!Wdn*mDFo`#QDXWYcfDho3 zSPQpJ>wx8A(unbS2zZ9|-q#14tgIN0!eVr<;?e~c(XhD~OJ2Z1r6p_ri z;}!ABI0BWkPJx<@T$yEUR7F;|S4ApVWD@$&As*$a{{hO_5+*b*b2r1BLBu0CrC|N> zQZNjeIwxcI&J8de(KZ~OWvslYPRnL}^f0V-61!(VqJ1&ucE!FEErXLp^stq)W)tM4 zt`bI-`NSkKMHObaIKYe3SUKEHS`pf10P#DJ2)HSC4-O{$?IZLF2cm21QMH&Z7`7;v zBda9p1#svGSoP=K!na-0TYRcR2+1VUZ_1V$$T{Oa(PdtdGDt>&W@P;n=>AavkMLQ?>z35+CWS0YI!$Fp1kA=jWo$Bl z&c0881}7$?RSXO5=Y0I3DltMzAgx7z-Ms)WoyIY1H2P3vpIop}fxQ5k#cIh(^$kDV z)@ALDB!k;gxaZD2Si?mA2NWng7>rSDgr{aP{n(2D5{I^XGNhfuMOw(PNC1e!Mf~j8 zQWDa1yB1oNr2#*HQ?V;{F;8-0y$%Y1a`}J?9Uw-M=ZGhi$ zzg}U#{BFNQoqm|7)hYTGwtd>FBcDoZ8r$J~O~Yqxp!(0&@~(g`=^$7-q-Zl1P`6_t z(YvPa1;G3~y!TI;=r@NsCVD;P4(52fd_I!i%IEUjJ^bV-p)XZ9i0o?2Rk;S+ zMa6#Ny{w->leh92jySKRoT5j0BkM-k`61^thW_}`O~$Q10_*`S&8Q3VO z^b?QPb-5+mn70k^@Z+u?x3o9ry#_$e`{^f-^93&eiza$%HuG29s zJ7Cm&ge}O}q~j~8%RGBXkF?UdPDo)Ay#d7my0P1ze1S{sHfo+zc% z^8%&+0kAu;3Dv9{53m`_&m~wN!G4R)oB&X%v8wq8N=3KeA)5H1=$R9yO#^-KebkJ% zGXvxGL!tp?@{lDXhu1yucyb5j?F2Ea6XWIm<*c0yYoM$8Q&B z^58O9VVvt7xFNa_yYKY=TGan;(!QR?yhgATKYD)jMEBsY0I283ZvRh1c^B3Y9uUwV>6ZQDmo~EypHzYJxoR8sW#H-} zIUhf81NKkPKsf;UTkjJ`81o*%@QxpwCJ#E@m`A6P@L#(BkyC@XYC41RBGf#LE%k2S zMV|!ET{sb-={QdC6!TDt(f|{C>dQ!twuU=w zu%ka&s73q)+uC2UOeEux_ig^*w+nMR{LsvD(8d}gd)r0cm7GVf!d6v)sXw<-A zGLswTpV%*e6DH1!+P&Cn3iwZcpyBVpZx?G64k&l(yQr33FxeK?yu6#Uqy2Hnp2ReM5ljllc z?Hm?~WMqPLqMwwvnx)wA8@(29&{}uvPh*XF8zDOK9#6izr~7DWzv^90@BS#7to;CX z+G;s^H{WUhQ9K2h;a`j`5&3LDH{#`UFiN=a=u%HdcC%{AugK>gumf4^=deMJem;$- zluyC9_ICV2#|CR1s`=_T_8=`f7SB6LL6#@u@W5kHO;*54QyYxhsa_uAg7en(rT z+T*teCwGjVlj|V!&Hx9QT0BMbSJ>ivxs*c{YuAS&_6hnsyaUi%sJ`o-x>3c!+gl`Z|3#6w91%=Qxinu^-DV68XOG-hDrmf z{f|!ZcBQ$0@b?_xtlXYqLQ=77V^E9yttqXX8vHpxK5on3bd+~V7H)@YSs6W{CeJZ)+bQfJnwBAZz)ExW$R|JB%7sp<2`nT}q4#ix;s zzi!c5*$=;6C_`Y1rfmj6UX!C0jwFh53DmhgS^gK0?5-CpLjaH4aI7!*rp%QjYF4 z5?pLQ`D-^-nFCvakTU!NUk}wCIJrMKMxs7C0*`^}BD5m9u%mk-mG%;WMR8z(SVG&& zNy^_yA&|1RP9-;agySfj*-RdH#OWp=Oe!bVRFM7P5p)BKT6E4|e z%zF+Vo})g>zZpLG;T6WbkxDdXPdfCRQS%4%)M@|9e;Ti-@g4Fl(o$o1+jecwkMN}Q zI2h>f3_WQm4GKszwOddG-MIBFvKR6t@LrU9w$4ajo`WnY`@bi#KhL%i5Fh>%!!+_U zW4<~mvA&+*+(f0A-~zB)P=tYIW;y=VFcuxqLQ(9SX)tfU*evibA&4ORKmfhN0P~L^-;x`^=PBonG`#Jc1 zjHdu2@>P2Vi$pRq&{dbe>iD)zeX*WK&6kiwka7xgPFah;O=R*~ye0nu`0EQ#`^cDg zvXalH_jVv4@)T)n`$vzx_u&qOKe!_Fy&tiVWcbg5Ewu5^bMSAA(snbom$OJDqc#rz zbMerH*POnWK*KcLUM_uq3kv{Hzp|;CgHkRO$BK;xE3H=~OIT7X269C*OE;iUy%e&^ zSP9P_SB=73$VXtdzY@LD-ZlG;d5omG^Yg|rCwwXPxnh&1&sw-gE+(o!V(6~|)pbWY zpWzVbBoqgM1a>X2YC*5Q2dy3Z+=Z-k#yqEIlR-plr{sT2-ZRhq<`$&3vHsRVSyJIQ z1o&GiWK#k28z?)@6L>~Fl>866D)M2e{BxeSvD?s>y@UULAaIGYe}5Ww)?sx<8U5;S z+t+;1(Cw3}1An1XspNj-W7R<@4p2(2NP#)S&jxtR!X za%m@{|K2uf*6BI?xh3`-&emBIB-^Ej0MTC|%E~mSy^-d0SDVthtMhRU)waNpVkEQ0 zeHOtloclZ@8M{y8almcXyZd?uKv;^STgT-}${H)mTur3rmjf)ug{F(mj zrazD8XC3_^<>HnhhCGmW@4Y6e%U)JVj6-YT|IJs~{g6>baaH2Ux@nw^iu{!e{Gb+H zKE^f3s**aKz?$VN#cI!A<;+xF*V{$KdyK;7#?tVb(%#!~dv%*j>uzb~D=mC0fSdM4 z=BDHRj&FjWv%jASc{7Hg60+M{U+#6hIIo_a&7PLyh1s_LAHh_oX>pO15mcjhxboq~uj@H7{~yz`ZvBoSjL zXnyGS`=H&@@M>IRqzF4P9b)uRU{Gn~LWt3qN{l$yfLM+K7^{9SX}VmpjDwb>1Mz9?pXQ?`y<&OleJo)<+BS;>RfJL#Ka#9|NOOzWVm*gXj};`l~g_S@|F)T7A%$WiQB_HAl9 zLI0y2$a1Q4G)>EQ8%7{Oj~^LX!{_(>MAu%D6W#H25&6ef4VeW$-V$M^NNo?bkd7%S zVfv9UB#YO~k0M$2e53SJi*@W_MV3VgWFbk4ND`qB6x~afk2G1H6j+Ky)OoL}L^&1+ zO<+G;X{vlHc}_gipf&o8Q*5Odjn0EcZ*G7_hrR^WywVZ97Z4Iq1^SK87F_kbh9Z-;=yGTuh>lM{O=#nBmaG>3oJ zLvgr!0%)%&dhO>xNrIQml0B^{J({sdPb) zuB895Q_({sJ?tdqZ%zC zBbP5Hgw$NN-Ky7s;W2Z$Q4RldQHNY!5RLB@UprjB$l>xZd_$jvzV9>ghW@>+KiA@u z=iEb*x2vW8#p@}rfT>1vxa9iIvzvDlTQTT8ZV3FT6q}t&>Q0){i{0!q3R@ncAEBP| zHZFtDgrtE`tHB^L?7MaNQ{adE6*6B);l5VI(ODvdspZki zY|j=?(6+S?oixY`X*nE3Sr zCP_T*(~~)tyHA8;`M?*Xv2p^Du)A*LAk6Z$Z>VjC^^XscBMNLJcw!W1ZyK zD^lIz80NG|*5h+1_;qeWTJRr6Sg@IYu`_U1QvYHmxN5bNJ~>XgWGxYwLT;TWk`)X! z)^3IU9`8mbZI11=+BQR?n;;Q43o{ts=Tz)WTQENH%%7%o>469x)^9#{Wdi|_*u84f zF(0j~@t@&7Q0U(6B(O~(r3R?)l~{i#M`D{#950vpUb}leASV&yr1PV%vOu=YpT(p4 zf0-Z61R#n32(08{8|_F-Lz@Ho+q1^E8O8%=*76hd2z`)94+eu5NuEAzEgc+ZHR%vu zCKbFRpC=-u>K!d8^sEjFod`n1VkZj<9S`)91clCw3kqc`Ut%+fI^$DCR6c`)5*;aH z*GR;J==CS)E3LVVT#3H^4VtWH3bYhtebX@o%al&iK1^l!5p=x`pCr>6?~|@xG9~&Z zSf0177shvb&fN*4nS0;_B%je9T~1e$EtN-?FhAO?#{1n+6MD|$K8ZI&eC_yinr5vO z&DfjA8UB;_;Z^UkKk<4)rNJTFUvR@^-SI?9g4kWf+KN20!fYg4RV#VQhmeE0dJJSA+Uo4_WhJ3ux7=`FWV=bkogm+X6HkJ;b73 zf>-zVX_0iW6*Gpmr#V3OOq9OFUwLi93(vjN&e$iVz;|sl7;&~h6hxoiv zfBu4>AY0Ekyxr(hJuCt4mrF9xL^rdiUJDvG(6HjM4m2;IHz@|1rx1`k>OhmD2AZ1y z#yVk#Qc6DizYjD&`V@WFY){Sq=o(x5Fn%vlLrwH}1`t8tw)o^kboD!lRBEnk-Z`+! zxOkM{g*_3yA5v-uFWyro8&+KfFUswOx1ytBAm>K3h2c0ikWob2R-|5dE0ETYah$V= zUL>Q9ShY>oEg!_wm9L#~?jq$IV4P!wD9N08IOoiqGD~cGj{+TrCE=90QvztdcBafc zG%O*D=(U<**DxFihFzgQOZDd{enK%?y-fx-A6V`A)8E^nS+$IjFn{6=H^({}-U2Ar z&)-*~OWT)fG@SC*|2BWx-&P6o;rHSR?zOMCibhjD!)iswCB7qjwV>i`3?NXnXg8- ze~Ma=wW$95oS)&n?BBxz&`YRi@iNJXm2~+&lA(sHt}XN~cApxq77&A*RLfRwvt|c3 zZ&vu@8Na>!xg2!mK>6^t)O3w&`I}D^4Zh;1j&sQQAZPv8uSNsz0$ncTtn@?XOp!Ug zS~T1#5-S1$5udthBf;5fI=w7T=nzc`{TW<4R|4)88Wxk{Dz^WzmNBp0-^)c`K{2$a_#8-B1 zN!=+=%iph0)p9;sretL@@QKe134kujoy@Vh4w*7MWCuTn(hqu?&>}T*NXWXQ3(v_e zmmg`tHE|W{qkmu^5MW=>pHK7C9;1|EW<3dzmkWZ;71KM$(rZz1W_8pF^37=Ti*~fx zD{1?iy3;j*FvhM>6DD=2Y7^yY*E%4Pj1MS@AR9Ik?qc)}`?^?qiCbE8Ydzj3a4U{c zUJ>~f5Fw)mZ9XPOjd2@G5Rr2sm!#xGG|riDZz<{Z;}WSSw@iBcgHG&}P5adTL3!){ zVIG`DF^Od4q7LW5CGW)dlCM+v2j~m@ulo^KWUm(R(-S_$FfC`a#-!Wx-xzL~*lV4! zmgPJ$86Aq6N$hR%^}8R_l-Yao?RY%B!>Y4>cdRU)2cTr}r7ZzUZ`>M(Cc1kQb;CjZc`H9bh<;Mi zCY&2@xBa>a)VEaIQ@&Z9*vx+sc1v(;9G?dC=SB?gu=(SW?zn&DpQNJe(>$nrn%^bJ z3+Y3%;Kaw{=mS8MnVtemE2#@p=tKUu=V&DB8%D&a_Oio?cIe0P?vZ(#LX5pADX1ixn-K%_7zKoSlhFVqD1OqckrFMqy2`LzO@ zOmFw=qdg%XHnEd@3jN2#_dR$v=U3z=w=xk#V?mtGll?{^PH~#X6Q{#|4+WmExCE!;O zhYuui40K(n5*aVpfLIC}P;4Bf5xFuJHKf4hp^M@O7K!5!`D4tz3(}u}!=#irv{yJ> ztYw(TEoTykX;~C3C`jSO*+HoIrO=HDIo5|)2+E+FLK#F@Af z@c*G1{zmPN1dT?{5tojmfRxBDZo{kj8%rvM)SYp*SJksyMr}k&sID2cv*j06|I!@m z@Hpw-Z5jY?1yLHE7o6az{rjp=v0X^1y|xbp!GVt2Kd%Y`G>By^9&6H+=NDXV29Xl4 zxD1+EmYUHoj*KJP=NK;}|JMJ=-@XcmW99Fm%l{Aj&4@>}W&Tc0GJYJ@eq0Z62G^`3VslH z8UMVtgII~}u(8q#_Ip%G%E*QyFXf_@9;{pwC-_ZC!0)OA`#;8uFGe6qHN08zr>DXg z6iOWb0~w63bI69e!U@=0mIBf2ctp9$+(D43bPJCQcEz}hFJpYc<8b?WRsmd+MJrbW zeoMLA2;`^M|HVH)C?NCSIBfgQ;;C#D43r$EGj2;wu>AQ(W;dMezG+_F?HI$?2lxZ|C`5;w1O4 zj$Qvs(H88(|Du0AQlMuQ#bMTx{#}`%e;35*n@?px+ibm9D#+p7ws;C-p@{Uw>6dc! z17F9`=}O_|{C#*Fq2?+cl0U{=o=1$w!Ke+(D2^Ozh46r9dol8QfL2e1)GwOre{eL_ zp6YKMC=tvHZLyt_i1^&uxAANadEy#C3O8#H~!u1hZl`EFdNi6oTnc`i5|97o z{~zH$V~mi#W&FphLjM!~*A0!Me~b9P(2V}b(dUsbqm~}FmkZ7)W4$(7IxsN_1Iio$ zyH6Fmz%B#^z{^B@029%?Abwqv4`$_Cx2keZMZ$Rpgk{z1Mr-ce}JB;xkX;^BKR*5xoP=9@ESW@ z3a1qWaqM%1AByEC2_~3OEYtdx0^yJVL{ubb!E>Hk7)OG3E(uislg^JghgSM^wKM)) zW{*EXAXA3>kDz}!K-fFK1gc{YW}t5f{aa=V`H^Ox&zW$TlZdpd(@7X{%)zej~s!9Jeef+($T5u!-HZwjE_zg4Z_NA~B)5NZM)9oIyTnHU!UQtQLL%URk#y(*-hT9%ntt6da*7xZlsL%RCQBW6ZkY z1^B?7nLE{Ui&w#?qUDO z{LJfB^3Pv^-onT^yJfW>hpShjTQ`n0-d~>k48E-$nLB_v4>97%Uq2{yHJOAZGa1d1 zDj8;AzMR}MBl;nJ+m+LqOqmIb6SF1~Pce*Tyx8Y%fjJUg#^VB&VmNq?YEp3EdN^U4 zb*-8l7KkRK#F1NApye46nolQNI>SzD2r zuQ=SgIDEM;w!>Oec>s@zio#5ABzg{Ju1seSisKKr^4RQA_U~q`U)dPWp$8*#v#d6E z9zcN3kNx8-1LuPeffIpH;d+G9BN@+xn0&e<7wVWE8h+(GAkM2Wk>B<#!Les?_(FiW z5(A#x$*V4*{re{eo9eCI`G=ak^E;(Ki~wpJz!aP)vew{9tfv{~?HSS%77D`521}AZ z_Mk$*Z-(y3X%$55Z*2CBbB4^E8N6N#{776;5nj*nV}@`7UE&+)UdC^~2fs4Dbq4780Zw3qPRXKZmbMZbMZ$IDd|rU!9pO+dh1MAxTZ-FJsN)zVX&P z6*U$952JcLY38#gpJkJp2WpjyD)|}H%As!+?In_;)7sn((5}%macMwKx>5V6bf_u^ z4fxZHx!=*+2_^ING>Dg=ASJaQSlxFW=z#B&2`1gT?ME)p&KJPct@L`M_715(HoJOA zU!(RG{tyN$i@M(0DX&Q^fH6rn7+P3i!3+Aa6UocSaJ-^#6npt~b+O z(~TBmeS;v=SsUx}6U10sn|EkaeL9e{P4!N+`05_Cc#oXz)wFd53%#Ov+>3Phu3)tV zL~9PgMKY$d@)c59hCdNUBw%B$r#5+OZSI7UV^GVw2+Ccr(5JzwKJP=TP=cq4E!;HKCbCra1*#^%zYDO&ANPJ@vv^t zKYw*oPGBqkwh#PM3XPCL53>-+KN)XMn|1>J_BLw%iB9o%ut#k8$jHUpDZfS4jp@eR zzpFPh1E-pOx2aJ({HgiFr)ERb1!nIL%t)8>dF~iFbD|9*LZfl^pc<7hW^FPS@Zg5A zxMWbezW~|n+p$C#*Oy?C-Hcq>$_(RXJEp`h{KUBHE2;CLF^|^Dtjjk0;sVVEl!2@& zAIj{##Z2E38ve^_u&$m1Us<+w4%Sm3i5w$PG#g@G!6CwFB;C_U<#e;~!)cQ>a50jJ zurml-gZ>cfCCx#v^XCA;w9xPmXR|2AE;HL&sEWc~W%H$UFbriEY^;G;6SeyD&*}Vg z3YSQc2m4zH%>g+r3p0R`G)uGq7h2R^$@@=mS@_N5R5>P)#^R3M&Fgn?0@&YL1s7&1 zQhtM$>&);cqA>qi-7d|F-k@{^c7TpeArTDPy3*fJy7J`vT35LK;^>MMp<0IznuR-z z$VtK{$h@(5aHr6b*|Xc4kvr03y)kvSz6!ItI6Yu{c&!O>fRO?I@Y8U$!C>ylFd=_) zjx+(qX+1_7i`SM!G9zoU(=Ij^xA7GnSXohI+_y4zj#-zna8>s-EP2;o{G$h`fP(9W zlVSjcx?@qdNToQMJPJYFwzz7eJ~mFZFuQZ;NdC?YVO5*V{w;m)rYE$&|LgrQZ~rmV=>6y zbRGa!0ww~8D-^;$ur^;yTAo#YOLIx9YiK9qn>FM5IBDB7(<^N&Ix1;9_gyV*5x+;; zFgC!y{^oE~c$FMuwhZ>M1OIS+RN2qN(5ZT5FgKrO8_ZpYY=f!nS z)5%)$z!9JrI^1^VZFO13tCQOx(NB)qexJGGjO&6o-!c*P3f~W6QIHOBX!Rj}!C2>l zY0F7rC7@8H@;N2M>=P4F=nrOvZI5YI=$#>YzYFQuVwP3Un_=iGvzJ-X20A&O`QaYh z$+72$k4PpgIyx)Scg)Y0=RR(Kk@?^{>>9xXHD@$U{PgoDzi>YxM#yuP11Rr0DK{el zcpCUt!Ebr|Hpz^~5Z>tIKvCi`=!v(FUV$~_a0fk3j zr(HpwxBzB4Nbs=|jRTv&6la44cR9}I+6HWdG4DEHM`Gl#2JH7H8E$PsF?(+`(>I$D z9D8Yc9|jO%V+E38gSIulP&Ef_pMthEsiI7Eh90m3;m*WVPF#!oXXH~=PPKC-!5r}OaeI=>GICg~+T zAEuW?A93w(<9$SE7kgU9gTarpFqq7VzsQ;h19~Vg&^f-4Tb!IJw)0YlBCvh%K|;}m zow@iDcssbi>FNVb)^k|twEoOLPvDO-EJ`~nPl?lxFW`#974zJ0Rf8^zkx97Us*cI^ zc@qt?d0d9eizeih)LjR5Adld>wvfrR;t+hO+F_hsp?^#8q$G@6S>$t(=vaw!dCDTW ztg1u@RU{@NiY594uJ#8MCJdQe5&;wVt%~1FJO3{sQ%y=hQ4)}lg(eP#aRmT7JSldX z*>@kQUtuv%?Ht@1MHRBH@4_8K zj8DwOIv~pxt~cggCORnLK+FvYeX>mWxDz|PUZfUl7LwUVr1YY6CPWQ!??N<-bpdIz zw?$OsMcPXEzNC6M!iRa%W?-W3i!`OOX?g@&XVH5ba0M}+2P-PvXn zwD)W!|DhujjRn;Lr|X~BFiv^WgYxmRvVQ9*#PIX>1v#)`X1iRpIF@67E2+B}{J+F! zZNVZ+sq#Tf!xv_m>n`%Ksu@1n4F4RnhICpjPIo8)_{o>>+Vo9e2qbpkBn;*Qvp0V8 ztE`(6aF@vxqa%@w(O*Er-ju_&GV8@=p(1X{- z;hs{WI6TFNa8VXK=WO`M7#g_n#F<5SGA8<6U!F^i?ZlZDLCF+TV)PwC!#@pZ$7Qt7 zdKn8cfLR>oR=o)T<8+h#T*5z|o;oiRXfSZ4RabtXN$Kkxd_(>gEJIoc@TVla(z=b0 z+z}1(XZ8G9oZ6NswRI*@%0K93t8Qp_l|6A6>egW=!1OF+;epPM&ZGXyF~oK0)LV(a zg^oaX-=S#2E0}rQjdKcm_x2l$)?(Ec(OsEs(>>+vhuS!aIs*lR+=_hpYYqgDL)G-) zfa-$Y!G2)i%~Qd^Has@$n#kYQv;&!GBL7tDON(+ppPE0?k?F&lJtT&0+vd=&bTfUA z8qC@bJfM)l@Jr3k^WPoFJ<+-jINw;0Vd6Zr`JW)#td}#llp>kY=S-nQ%Z%QS8U0pS zm4Mi(8GY>JdenQJ^~zb##r2br;ED-d?uqq?|F;L$-_-chVk60!d{&zqK(*ei7RlU- zSLj-3_=}ZJd--VZI^ABrw1nhpnD5```q>JP`1V!{U$JWvU^!xZv(eJ);khcVbID7rt?d&ynNomz7AU65T94QZ= zlS^f72J^srRT1%IG{j!GdZ;_H zhw^RpydqAetW7<<`cxlXmY`6MW~nbqzXk!g_P-%q7?>!wxa5-GAd$>&bsS7xXiXkx z<$J|x+fNN!+{G6w%1v3s}GC;o!gAOQ#s?elf;u6g{Bs0nG#{WaxmB2?; zUHt$V2uPTqghmmK8X#!Z1dRkS8kA)s6Nwfziq^Ok)7I9A6N;jeI07xl0FIn2)Qs?7e_ zSc&hgoyYIPy<}Cw-fearU;v<)79;)S`&#C{@ZDQ;AR7GSd|Ye)>u!XC@|;o(1=R;X zj=>KVVr|eqnXLh42r_gyW?&#i7ecxrHDX`*7*BG1VH{E=(|wt3o3(p9uim#hc+u3# z8_{>f>3at;UAyiElvyGjg>HiTdR3;wa$I?J<$$VLJ##Blgc~pb7_&E^_;z0pw@RGU z{sW;jHO#p8qx~>;3}k(4n*oIxvv%F?mMI;W4j_^h2-IHJ>cGeP&A?B_4~{e2VA3AP zKp^qJ?O}X|QRC%KqmJ(y^Pgw|dd69aV;}Rgcupo7Ga_5M&Tsn0thx~gH;1;y)fC3_ z7oOkL-E-wX`qD;5a_n`NBI8=yT*=edIZ_y1xDr~P31B4UDuziZ4NQv=j*JXbg9@oMx1<;?oRwiu!ix!O z?tY&hPrT^O=KSg(*#GXVAK3p|yqK{6PX{IJ|A(*7`XnRqS{-{~`2Ry{KrG=u8MITqIa<#)emTa$#DZqE_8Bz-fUDa3R8arZ%r`(P>` z-0eR2?B~uG=i-6*hnQcM_JRes{hGWd?pQ_?5q(7t`N+g+90-N}Swp!?uT_rVxGXnn^S(pl~UoX9Bp)864e%yl1*=2tJe z4>H^b`F!x8J_r^(Uv5S;70eILOMT!X06tHqJ#Y(>q~SvP0^A4q^|NtIbaca)ZNY*X ze#)I1QfKp<^YD%9(s;`GdXSTc(=q>h;J&uVNl;fE1jk&eet0^LzUb)6V?0Sss8m5Z z!JhqC93BgB56>szx&8h>9jxTzGLF#e+y{rd55{re%iRaP-3Mpz!CmfyPmXq)nt%sl zzujlAyU!-_qs!a}E8GV@J}7b@{Ez#fh!1ky2XoyAXY#?%+y}pNAC%w$```bzGt9Hy zXJ_-H_uU8i?t@?O!8-TB;qC)r^yTh@-tGf3x_y^E2o^jtJ&wo05uVx$LETwLcVhA1 z;l7gC-kt^m=XFJ3rSHOc`a)`RsGtjF4gz-2TeBHZNa5WnX+w^yya?Xl{Yjd?#`<|2 z$%@Ca>RlFdhcAIfJwL-)ABefAhwL&pHZfEB%2qRlv}q&bj>m)4E}|6lfsMtzhMxG2{w zl&B9bA`;hD!3`JFn^+@$4EmN+g7@36Z9pPafU(bj$i{{0BnV=d8?rL(zTS8xFS?D8 zWJb6XLq{oQ{%xbyFTLgvxq80~YTE?|=gbhJDBgecPg_@IRN?~Q4^_t(=CtkLY9m41T2 zEO|8K{3Hp?tZ9|BDjAujS~h_6Fu>I8A786*lB+~V4+82Vy7TEA6mr+;ooK>-6W%A& z$%}ZgHm3*hf$=E@kxFa8Z7eDu$8szgu1rWW>*tQx@|1+Zz}C=b;9=Y2SE8(f{JW%B z=f6v1c#3_4KH#}HzN4@QF`UgzN{;gPj{b?ch2SG$gZCm^yLK-nf4fNeXCvYwG4j>B zc49c<=>xx-L&SnG{NAef!KlQs6l2v0!R)~K;#7KTz9k*tXa5fiND4LBs6fkb5Ftd@ zrZAyj^QsWb%w8aZE%b#U)q1iBlmRogB@?^@^YQ}9fXQtuD4E&QeGlRb}q)VTr6>k%~X{_+e z#or3Pcnx4ktKf^*Am`^P-wW}-yd}nd!Gf>KXpcu@qBGlGmqm)`;EF;g=$t#;Y*S5# z@5^DwSHX@u4CS+wg8&YI8;HKs2-`q*o;HL1BG(9~wNPj54OfRsvYEvdc?qA17cNZm zwXNb|cbI~`7Ad!8J!Z(tdwMqx75ZX347u}u=*)~@!D#|Cs4^qP9t5Dpg8+q)6p<}C zjBJH2#4Pzi^6o(FG_bYR{?}3N%SEB_TU&Xui~#x$>wy^g z$hC^OdfY?(%`*BIHAXf){a*%d`{0dWLBl09hETs+lM+p{r=VZwQnF&AKbRWxOkIbT zH>}}z=>fXf-`vL$vMzA%)sXx%|HFAq2T6Db zCkXULZed*%ATu3>Pu9pMFW{3?N?}Lvwn$#6XRu)2FUe_x_^QH>X&IRjXGtSYp{icJ z6NANs`1?;n!(e@S3fzOiT_&m2KUj}XjDIh4CeVqTepHQ)K)(jD-$3aYTRo)N|2l$w zBALzjPiR1~$ejVw`CkHYt<;y$prrS9Tx>iVWG$nqwuLXr$v!x@U}j81V%OU+W^(I75Ihn#~_Rb!YJs)&5%763yPHORHj*)jJ>V^>}y zWx$0L`Z_!}LZ9mh{WY%8i?Z3zy1hNCC^DGU0{wYdE4&bB8l^wa3WK&GNb%Z+{+;Fd z&*cz{(wC`fSbbtahnW7lP%;b6m{=L4r;LM4&@(b6)k(>m9;al^*##wIN!biv77g>y zX#|#HkYYc6xKSDi$Q=zsm_)ra%8O7heyEqa*qfqWKvfpVbxT!FE9Be9dA^UdesEfT zWVlOT`cKQ${#}3x0b~C*3f&yX=h>`Qxt^c3TmCN1viUb$FSo-vv>k;V&DAC>QVQ)x z`bv$~n<$Op2!NQ2IA}lYCm5tk8q}G4p$;eZ%R!=U4HYO0KI+~|sXc`0&{}hv8g^z+ z{u8v3m6}`&Uj!UXwxRkJPR2XrNPC37v$ICuX*Tb)@NanN5obv>di^=jOjhbcGmx6= z%O|k1Y;D{M;4!I~r)!A+y#xL?RQOK55)Mg!J=R615CxbLNFRGMJ2BJSR{F!^={Gy& z?L(g|mc9l^Uur;|v-9kG|H+owO7MkdtX(Rc^N{zJThI*#t@<1SaOFt0_p<%wJu>W9 zt93~Aga*T2Bv1`KOS^gCYz|2$%iV5HmTra~gI73p6XZJ>kFvnC$`X)2@`C*-->qJ~ z5x>E(Ynuys^8!d{eIo7^`5n?LG0R3S6R(Z>XXa@}_vHB6>I8xCuVf%ovoe9gMVO)C zj9RwOLN-nK%@^8WA3>*FQ+yO1`>~#;r|92eQ3P5ng>vg6yQujs@7y;W(FpDW?@I< zzc$~Okmj&z&e*Hvh?nr)X+VuVUf(S+@0O`pFI}>bhD*nF-)_dSh60V#LQXzr1eTQm( zu!Ah}k?C(PyMc=(78xRp5})pLKB-?vsKa%{Ep#1fj_;8h^@?+hw(9yGM^`3euKPxI zM2D>5X}AteO*H;aS@&(qAF#-`NlW3o<$KJX1`Begk_sty1Tz$zY6XY+q~rlhlD-xm z6mekNVvsSrI0}^_sEF=|3IDYygKhKm*zX(j+6^B?u0!;$`hVIGNBh}1-#Lhm&EL`f zE?4_IDHeaWaBRTyR{6Ws7!SwZ`Ybq#K=Wz%e-80I2l(EEf_<^KK>3y1iSi#FA(s7+ z2$4h(c)|`ma*$N+9!!QF24ua~>b?=$fGz8Mq3ujw?35ueseq7FhzQkGO4qs&N|SO5 z(OZd^{NXAR#~+4Mj1&d@iIegF^$dTn&%n8;IL4iiLoLvE7-MkT|LYhDFq}T9FK4s{ zdN}EYek=J9{}_ZnQcK(mwZu{oJRk7cFGI7^Di?Bj4O(Dv?+j=F{XBX)>7v$GN){a7 z8I`%OJK<`1AMouNuYg%tMF`1vzSu^wE(sRQJsX^=`9W_@HFN<&hu2!|63ots-k6Pr zP`qn-?l}QXtyn=35QUCd5kEi+9~k~LHp2jOp%4ZErp~YEr9>zY6cc-e=Lu7W7dK;+ z5@+AMg1-=IV>zRG5^>(}{peWi-|Uyk^iBXLjRXr`Dxs)BBhOS?;L4i(H z1$y^pRiI_mYfzgkK!Nx`5jSR4u``HE4s|GWLf3w?3xn`v7$4{|&UhsP3}rIW^h>%A z8BiyXvmrlu@7SjVViD+)nd?zhy<&>^ze zcsF7UzD1d#kSCN?3pKq%n`AcDTHQ0sSZ z{xn!HkU&>J1G052CnD9nwFR(j!GdIGT!|1_iKI*Zntu0~y^h&i&_Vd% zhEx6;RQ{ff$scj2d3q5ls23Y|7%-}1H($aHWS=L&cYR9oALHxBXH66}{Eoc3R3a0k z+^wOdzwCo=QJBBsnLdQp9)*$?OQU;8-O2d>`ZW9TdVp!AKNQe-Y`L^z0z(93&AhhK z4;{@|!^vJ5xGb$4bv@PxaFiQ$o&eo;Gn<0LJ`m$$@}z++nGnx!={4_js2md3B5kB7 zwDLWepWX6ThmO%=m{`8$x1h#h8pq)O>u4jfEDj8T!u8!6a9@s^Zi)%i#L}!PHi2lD zj7Kci%il&bcR(Wr^)c)F)Q1em1uPyQfkxUuP>xK_z?1NoiJXBmnL56PDcqSEzVPw} zbnIREv1bN00;#|Z75w8pfr)->6;d3Y`bBFo3#7;B+(hLt+7GM)>Jd0lC{2tKN4o0U zEsG6)*U!6vA znWR~;q)(iUOwxd7OeTpb5B5c^orAxUCa>UFB~4y|GVdDURisW)_FW^y#Ba<$)PsjFj`4+<$diYMkw4;(DVw z6QZIB>*j(57s}hTn%i3K<6fhRDr~@9d6(<@sCcxbcag< zuo*O7yL_X4#+UJSmtF_x&sn^F?UaDT_Y>Uso(W(##?QP)1KCW-UE>LfVtkB$EDmnd zDBsTc;+wYUqp{eYzchY10_fVPy}(|D7L5)JWLnX4g~%CXlR$3;uXvogtDUNlBL zZ*T33cvc*)rw&4-KBjV1QE&yrh#r;M#o; zRZsxXpCiz^r;6W7@0*>HG){~Q#s-sKVxNC}{BXqDybE6qh7;?nXn2F}HZUE?i07Yo zLB~H!4pHcLoxyD(93|0O%xyXI9xABoujvDcRZkS5}-?edgd;SV+0~DUl(Aba9`OGK>O?s#VdLZ zx#MUL>%+riu!?^>HW9pYnR+7lSdBzn*mr#071%@CgYAdejOSqG-z72lbJ!pN6fQ)5 zXv`adO86sVDz8R3rOfy%JS8($o!qa!68vuJz7f!91W9*6*#7C~T(&<9J=hzLiN`&t z3IE5wuvI}Xv^VkyV~k23`0O4eN-V$DfphHBKZ~bFoB|jbKSUkh_SpE~$RM*58((nW zNpnz=x9`LNwyW58QeZ@Mj^h?tsl7^&e1%y}vIj}ng)gIn@LIm9pkz5QapQM!b0nxP zxEV9HlIx%C{a4IwXXXVmG4UTO3Y zr?m#Q*5A3h9anzkC$4SCXWIpNz(-MNEBBxZeTjfp_Ik1pK02POj6^3xj-66x$g!Xb zf8%bE4?0|RE?sI;w49aD}EmULJWR0*e;k1wUN<*)3JW!b7ksma(fPFFCHc` zOo6Lm^)L3oU)cJ@7j0GfNr9geEqG6LT(~|HR6}%MnFfx?=5Orna{~%6*WdU6&SK!Z zSYNZ$XHAAjSEnz?ek-9m`EqR)@9{sdNd`GppE|=<`@cULKjO&G<9LT7)bTxnM$GtJ z_(1kFlVM5bcGH?V!(G^65dmRvd%yUqQltugj}C4^p$GOSfmKjiSg9At6awF%L;xu* z+=S!uWtvn-(d4u!eEN|WjKC${J2UQ+2}Zc$!ksiWGo70h8Zo_q*%ZUPv~)_@O|JkvdV+fN02-kO=KpUjwdr8I&t5`@{r$Zvt7I5k80o7si`S~flAzkUU$OyhJg zmODoU`Iyb)*u;w3760n&zmoq=ecPik{wGVv>ext{6}aQ_e+e#>|ACQs{=bg=|0{*6 z9Q=QiK*c;f_#ZrMV@EL&C@>-*tPd~**$@G})>%yzfolOX zQCmjVFJ(Rfl@2BFUtYg<979wU8cDhDhGXi;!P|#}`e8@Jf z>)U)U{43cPNx~yXp0Tf#9H1Q|uFy$aOjR;I3^^a zQ`86k-7!psC(&au;r5u19N9U(z3e#lt1J1*ygVj9jl;T-pRw<{@{{vnXZcb47>1!W z_A$Z!Oe0iQuqBQoE5l(cFuR%lr^^(ALdeQx0zrUbnAFsz4>TZw@i?^#Nq~fJu>bas z@{TaHYb#Eqe}E5#g&}(K3pNMBF`|ck=cRZm#kC+s4wYIymro9#Uccvs9sw_30wHLk z9BSl9Uw1FV646 zc{Bb^SNxH5X^cM>9@PbZ4Ed+aA8GG*#UDq-_@jb)Ri-D^%nI(sm%w=w@%(YUEBsda z%rb=}AAEAAKoUTd1akX;yU39WS_%0i-{q5=-&Q`UB9>h~kwQUyDCQn6iu^)7k?@J5 z?(E*=CS>B|+u$>FSx4b)8ZM25VSESr6RRjif7nf>WIV^^6|QQ}Q{^sCWvdG;Q^R(z zBb9FPH$|SwooV(J?-}Cpo3zN2T~V+*`&f8MjDBw((FOgc?QrQ=va>V&XdheEKV0Jy zadnjvahBtiwIky4WxzPsKo5t0#`^2P98yv(SNg-hj7faGz!WF(hZ`U}Nc@WJN=Y$# zE+uuZ4k-mQrDx@0WnD_LM{3>Stbk0nMaaR>I187xdXYeRw)1r-9ILQlxRXuHsA^eM%LinxJu(XZ^$s_Y%d~~zLGTP|; z=wN$KE2$05PbZ%DxCB|e`A|g~KK@RsmIO5DuLMk%7(Cj?C5N}?GX>j;fe@czTT0qX zm})Xw{|=1S9e?e-D8^rb!@JVzZI z0OFFZ$ZNuVKJH6_3y|E^A{c)Ss==j_!L3Cz1>9Ep5e9r%i@bCJKh9BGco@f%$Wc3* z0|K=h&{s^aOch71gI-ZhZx~WXBdVQxhJdqlcm@ArjZE$H+FlN%42gWI9Pux(tybV{ zthgWTt+^9#c%Q1v$D=xb*042I{MEz04jUelC5F+oG~k`Od3>NfnM|Jn*Yu0(IP6bz zmk0ivz5i~oC-hed^&P)|Jy>iK5?Nk}>);;Iw4Aw95QH$W{L zf3F_PJ>7K9!+(Xr9EvV%IYitvYHu^1FFS9NrEPtTd&oQXVovZn3KounXJiCYHJ)Gt zVnL%u$mp3HC9cbL<;zE&E`)sD`L)Uy%7P(ZxK|Xy0c)~NmnT`HJ0-X>n>3w2Z90y>Lgom{HaHUAjIl^3k8& z$zRz8G5PyyNEh-q`z=@gDo~-{F@Nv3?#FIMI4m1+mUr$Un7=bA0H#n>ftHpEJ>BmY5?n0e+v+^Dnh#Sp}Cd@dn8g7Q;2uq*@Wg)5R)#7g z|42(};YU}dVw2}Rxtns^BCoUewrW20K6M+#2^o$FYpVGR*`^jd87X55-2^fSUsIv; zS-QXo=rDD$fTu;^S}K!kQoJgY2hjm%hA!#@E^Oh3f5_(rS5oMaIw-&&j-yJxyNFYa z^Rt?H5uVp7_n4s$Z6to}CB_}rfk?p*R0S8@k;!JsCbT*+8B-nOjq0F%7`s>pGQPt= z9Ph^z)?i^At8C2XJ4KG_C9gxu%r;n|FP*Tm7F%(ue8~C>gCpJkz>Ur*yMAk8ThR+U zlg|t#_rdz_;~=}qxMhcuGEtSf+THO&v1;QSC zE}pS^>RSQ@i?m$+jz`W59)Af7$1(}Cg2T-Q{&KHTgF?S)JSZINOFo2ByIK|nN|qSr z*cl&kPeovp66m&1eooy66{e-o(RBF#nBNesrnijafG|URY%Uk6K>v**wXA4qAb3{Z zt~~0CMw3X;#6qGFRfJ!IBD4I!sBOYW4-4v$s)A7x5hOfk8Ip{ApO&tfZ)p@gW;2;c zttwKu$p2zHOncFmz0mNWlw_Qw8DjkxVp7fbEJ>^l3hW;HU`!RC@kep1PCSw00BSZJ zL)4&k9V&{gs%3&iFEQT?L;$I%;=vD~$E@E9V_(Rb!0s$e{4QV+%NN}fai2JhW(x6A^J?FD7u0O6#@>is-%~S z>|nwEqupUO<0gjnH`53&6-rnVg%V{fsb7u)LgExNb%(lBKMj!$+b1*Rg-BG8<;91w zJoWE^m=E1X!|d>|)Kd9?+Y@5r;M*9-`=8Jv>V9l4wmb3Zc){mS%BPlR#5u4;*3iOq zESDNm&H47qLA2sAFG(=giNi5ounNPom)?js=aHu{hu6t;%Z={rcf;8+`+ee|F6?*H zt3Y&+8)?|fHzl^;vt0We}rp5P|>2nQNNrdAJ25+*=?sMTJ)0 z2m!7!YbT#NhSo~2IEXOgBxLz$sZ_7Jrn(p521e5WN6bxr)tG8EiDvO9)P-KFZy=_c zt|sbm#1BU0>PB?I8XlSqIK#=_n#Ir#uwS?s;H{a>PJ-X%dTTXu*Rn1vb=9L#wMXC^ z`zsSe5*+(Vo?z_2rk?76%Gtiy<$Sv3d!=kV0o~*RL|WJ8BNt0%T|@4quc6%iXlWrk$4P47ayY8D#1t| zCtxhk@8>~+BNj&_2{hYcu_r59f+ESJPc-%8rRElA0Rz28Xz4B zkb(tGM-hid6Sif12!CXe{B1N@SdCiPC_j!C+Uo&=^SU@z`h`S{Fjq?cYcUG_5_{N5 zF&e+d>_?_yqjD#@gn^Xk(q%5Z0e2!aD+lFj`Hq{d&YJS2U_sH5z__>Od>AG8C73il_+!!( z8~$CJ5*f$4tnMwu!k9oGkWE*!-Mc@t_CqguQGT&kR#~C#;QT z;Y-mEv;W0@IBI+fWUCM9U;}HpS{%Ma<%EwcIj(eL}K<*#B7aTw0R@@Liu z?vVO=82-p@iHv-A_Px0%X5Xjw@4~+Cc!?Mh`@V5~BKv-Yvwr0UD0LH@w*Xi*?#%=n z1lo$f#<;^N!$n8SZi4Wi3rw0PLKtwdfMpgC!<4H4rQdmgT6W@{L3jiHx|V$;AqFq7 z%a~>VQl#6NnKbx^Wv}O3Cg##0{2bh|v#9prPn9?=HJ!lQspfV$HX7cPy94v<*yK^> z*T*Ygm(l+!l|(N&Twn-09G=WoeQg6+K;D*%V{t;e5kGPs2C*TgM1{M{$lcfu2J^Ae zk;EJYnz73)hp*SY1r40F*kxKoCa!|zxpx!gXEq<=CZtwW1jfeQ>&1blw_o zz`eX6#omf}7jpkBxY69A3aTm%N(RlzNtG4*#!B%>QQofhT9^B;)FY^ACwK!1ZRL zG0%Vkn&e$4ph(oue65wfEJb01n*@Zpd_InlfzO45-DFdg_);y~dD=lXwX%KmfPk!Q z=WBa2lc>0pL+&jEU(^Pj{K)JYr9Vu9&>yeR|L8T8WCx#OSrPU%coI`H^4sw|&{!;0 znP{2<1)NCr*W-MjK2Cy?H)uRSMGsJ|R9u3bO5)Jvd*hd#<74y<^yz}W`>}PRlmCC| z|Bb%q8c;~z2L+Tk`nL2=NZ(5d*^i`e4ybRJGYi>{zI&L&iKp*Na~%3Exj7+yj~ddB zzHiAa3~2r1>ATXCfWE_k>i?R)NoU09yU^1GeTO{n(l-sI^d0ld)DPad7kV7g-PN%^ zpia|BFb$?m0K2xkGdatb0pBu}hoe9+F>9^?>&&XW5kYER%?cN$FNO`-92_EBm77 z<9LBz6a`yLD~ow#pgsF&G>s8u<01MmIzXrR5x;gd%MaZl<&v`f0E-a(S~*!1{3ge{ z;5)biTEBwp0p107;u^n_y|tB${IF03oByIp!5 z;r!CnT<-U zDB&L)o7V}`=;<`?0>KgU3vHtUC~t1d3wY&04b4I1AQ>pjw}-r|h!xeI?~ad(r4yPX zZxehFHruXYqFLwxI^kO>kWTc;gF52kIqB$rQh@*ZZ}dh;2l}tLJg0J`UCCmH7?u-u zeu=hJ>a9IjJ{J6uY7=oOyt-jTJgtO8KbSv-5#^+tNFy-h@DFZ-Y&YNze&u*;7vYzU z4RT1N46IAw$T9pMO(e8-+8mtEgukP1%H&nxkm#xSJ1KA=Hr;DvkTDbU2e@-i<#794 zRylN!A1nfKa})!PK#l@D4gYM2==9DEi-EzvLtYZo!Ws6+=Z)@X|7mpjG9s10ctR`R zo&T0p5U2m!`hZp}VS+l1udf{P3^1$lOWJdt^*`qq8{lG?DSn)nWkQ&(U^)$9Hj*#l z9^3L4>+$4oV^#`eYE`vPfDewnyfPU)Vap0I$TTaL$_Uq5jMj_2*Y7AwB@h>yp9(?06z1ZU>}b^ zd{A_XSq;DqFV4V>P^K@`svA)Jhz5%^P$%?URe)^HccaI77p@v#cTv{(+)Wd5Kb(;J z$poacHgPx&K%4%e)JCT{1Gh&Q&seZvhR^|YY=N0ofqQIs2h$mh)Np-8)&zg}VaX)> zG3aH0M9!2!iOx|NA#JLE%w}&*Gq6GZhIL>)yfw>kB`x|v|3ZQODn@}CUXHIrtHeuy zPVvWZ5&7h(ra^g$rmp|fPlkRJ47>xfU!8z0(c58g|* z_^+DBmJUwpLeL6?^cVVrf6wBG(LBje)b^quy*J<|@l%ZRgMtssfF<{g`A32FSxNp- z|LyBBCu>5@hn0u>QTn|C53!i_H2gm&MHjJ+dlvVSqQCWrTK%Cn{Gn}596atU#-~HV z)F$nRMs`iZSDk1MgcXIh7lqaqg+K;py3EY~^0)}Zw_J$pG>c9kCqxK8oE*9cABJvN+ls|Z z;0K&L{UZMIoI4yu)m+@;B|r9P4ef{`z>fKJ4fv9LMP8(yA(qKLdS7{!tR@^RtY!^O zJq@dTWM@|FPP*vjwl*ACSNk?fIj}s+G#xE+f1T!l%anzvwf1uEyy(bDM+xCr3LMsV zK=g;=L;%ywl}L0)KEcW(ERYEl!JfBGphWNBw)j})YbshMi5O5J83#yJC@GUIH_cQz z)}G=L@nh}|J>>+rT*Y%EtOnfoTZ5)e3174&WlH#pEopx1*kaUA6_1Gquvf>2#kC&> zHescBps(MWhVzBC-L#tMq*CUoNF={(uDKIAL^xhr-DLc2$W? zeHpR+h*a>r6wbe#X7Ar9X(TP2AOA8sa#YL@8qBFM$lVi}3Tw-%g9EYWBT{JG zKL)A#2)9^A#{PKO&4Xhm9gBi%F?oy*32R%k!-pzWUgkf2I91B}5|4|*I75khtFo3? z%r$P3C)p0gW23w@B~AE~_bkuhnaIO0zLp3wXGP)kMU1~cWxgMC?u+mu=2kXu_y#rj zdWo}PxR9Hl_m?dk+8<_1+rn``cD5`vO(~3S{((aWYK=D}W_G{C^c3uDG*?{`DHDi9?87tKj8D zSPTd=lw`MjzPHW3Zwle$uAO(E0I(Nc1`LEQdbd?b0#bywi#Gn4(;Rhd0VuALzl}QK z3V*MRdky4sRHV{+7|D)=DF)RjbRF{Fwq+v@6Ok+eA*@6d+M#tIP&C+O6t>;C8M%vK;!R;S(;oGm ze!;OoH}cKc=i02(sSbjwUOP9?8%`G1*pz=HI!9f!tOPx!NNBks4-+=@;V0J+M2vb33azW^; zDF5%2(ZRoqDWkqP67soBP!Ib%Kp735>?ouD$3q$Q`Qa|6JLFXJo#zebmq;Ck*hgQg&@&2JS%NI2-N4Hitc+f-(&upwQEDM-iN; zggJKr$O|^)ckDVNiN8ph92)E7Ya~Z1^6!ZKM`PHLAeSLH#kY{#tur~xN!q8Di47&9tlMuNX!Ot)!&Ic06igR zLtKk39{gkeje>Fnd6fg2ekS9{`|u(zn{OJdSD&5_+J;xK$;blygZw03zJYa{fdNe{ ze_`McL5K!uJDYJs82whthCVJ>aw!-+15ZSLhhRA@X}O5sx?|B#-LWX!JD#Mho&>i5 zN%b+%eofGD_8M1L?)QbZ*q1)lwF}!t%aPw>5sO_8RS+bN+dwt%0TdXi^GlN*u%&*bn8ThgY4`){%DTSFcAu-q*U9fQ~^1(pq43NfH6 z4n>6>!A@J!Ca+E2g25+6!)SVSKa`W)?52kWzuwv{SoBg{`$=WGNm4k(nKTWU{!M%A z9|fHfJzKDzLG@y=K8*XU5bLPV?u_v+@DYb;Ne>8qvGvLucJh-y9=SOBtIhuHE@s)f zkBW2>O)_rGUuH;&KLdko?vj;bKkyI;#5q#Qz%lfNmyJ~boTSahQ1DLV1C-(*BiCL2 zt!iW}|2AkBxhFyXZOLCSP|d&9|1DAe&0XKmJeo|L$ysXBK2AAn-J1RpC3jrgi*_b&OGhX*8aNa%(qp_T~Lb5Yd5d=IkC(Bv1rQ z&Q|y=`Q@(cA8ji3_cH5-7vPYZH9@9gAND;3AP#!NJ&6V*hCP=BbOI3!XoiV*^VNbo-&l(H`b= zN^yZnl&M)KF-6YBBETK=gX#%0w-8$dPw=@U?BT~@kZzeyoofmK@E3sSoWBo0;FI=l zgHTk;E4MC_OP$?w8TNDn4yv=~SeeVi z5@b1{m(J%ly9PbtVX2uXfUR@Y)v%vc?UE3q&8vv3=y<()vLDnlz6 zQ73{57MuwyE)OSyborr34ms<@;WhsO+Bv$(Qs-^ms828}atI z;BGF?F>2r>`CjV7xVQkD?l>n5vFro#kCaV-C1Wj3eAT|q^i+sZdN4}WA3H8nS%qkd z;Nc^cRWw0ay>P!Ps}&e@f0=wisf{yeV3p!6vic)NZ-4NS%4$5dVNsB%PqQce#mFo3 z>uHe{-7F#NPJT0wipg)|M_tJ8*#B|mH|PGu@@wjI?gbZoUwuvv5FID7!=3t^JC0OP zN?}^Yd`wURS!GnubP71z4uQlp!H}nCZLlkX7~{FqQQVg!7mhhL2HcY z(KLyKUPcv;r`hBP`Py0Hja^t;>~*bpjLiaYe61wMhSt!O_>@`7*3L%ip% zRt&Km7TyD;Xt?kv6@Q}gpByRwS%v+9K2Sa~H~4vq-TOYnK=qNah%(|8euv-P@z2i8 z82Nzz5>r-48r2=$R6HqP`Mfn{5f{N$M@)oLW{ulF7 z&huG~GAVWtEm@D8elt>+H_P#*eC}|mL?oxJRr7wA(16gS1@RrKkF3TOq z!GOdBCB}03fSRA=8$cyGf=$rtg))Okz=W_{r7zqSK82jAF} zF5~NXPlgfVJ&ZiUiBFu;3J|t)`86a;|)d9YA9tJex;Ou-LRfKtwuqF`=GR1iKI_$&g}v4CdcNC&rcnj6?tx2I#q! z(1p+k#T$r)0yxBhQjrWO*R3FwdMTTP*O)c3tfDu(XASK+8nF|nLY}9)YY%#ib5Ptu z&E-y#74NF~M7h^cS2Q?_E69E=U-sme%-`|l7J*;S4gwX{ znl^abP=Q@{rUKT}7zzNa3;u(^6Ga(Desm$js7h2yA)ec4e=&#y-NtbL6Dwoo6|YoY$IN+ z5QFHFko*IFee6UCpUkb@sVvP`ckoq?obx^!i0O5QnfH?s0P;{@Xi5bWi zKDMC>z`nTw&v8-DQ2`~b^4AGa8%6p1!*i(sih`|B z-G}Qhlv|_=sTe)La{{**d}6Ies^qLV9zA_wmV5ew4C6dzam7}E&<)a|!*(dca1UU( z@(mo!YSoCf9w)}t9`rw41B|h)C(QCG>LDOa+L|*fuMwT!8s{t;?;R}I`WZ<(5DUh8 zr`QkU+-OrSzyvV|jb-+|<27eXZadAn{UM#bUj;{qVq3+*yLfZ(W$@Q_YmVRs@&qCv z)x16OXL#Rs-geCzb&xswT8r-{QSd9022<6+z3M*y^Rt+LHE288FH!#Ij{w``e-MEY*hhal+s1`OP3jWYHafehqFT|uEg133>h$pE-hKaD6OiNTunV{87|Q6!$Lj32-L8zvE@MvBeS&9UKM7;y7t|465?7uqEuDi$8gNtV zSWz`I%5K4@dg+$bux%WH9l9W!q~(>qU=8in3ZOJBM<92yhTnN?KFmmmPN+_GJ^$t*jgB?x@Eolz%tgk(hr?eCc=iH@Lcr%nIv5PNjZp$Eo#Xi#qI} zrv5+onN80#pfJAdyOp5C#h1%AD{LL&%W;IvQ3P(rGHUqJM`U%3FQsJGa8s$+XK(HO zq=e=9vH^^A>p5|Zq>9-+F==gKN-19jAFW*+>)BqsoEORw*l+&d|E9Ks@x3NP=+pG5 z%MoDj42-Y(OC6u`g@lS-M~OmzSr}qp12$&di^a9%7_dS2D@+Vi>8cV3Pq9VEG^;(a zq0I9vld|8um!lXu?45&MD?|8Ev!^f?J+5bmJJ>M4N>X?@9j=y&fjPZBi%`W(RzlHHB zfA79M5r5yGHOq~EvpjD6OS`NpxmCCVlZChgMxP|{ZxwFxzgYZ>{de81b|wmBvGx0J z5x7q4_m{uH+g+^RKZ9_Cs$zd#?tg@F3_fW=*A%{u{0lEpujAJ5H~9%1_m?5zL98;T zF=@rs(>qla)9yjA^wgzbLaoi^J2?M^ zU^u%DZ^gWhDFy&0x3@+%(p53*U%BKAQtPexR1}j_LrR>9e%LSZG4rQD2i3nr2m3uC zf!R~R^32!=3H+p3v4OXVjT=99vB6I{=4JQ`Y>Wp?L=tZsZ1Bl{i;d!?z{aw&4%pc9 zQ5-hbKiB~qFVYc)Z~B-l@;A<7a8^oECH8iKcOS+ANB~ZZ*q<;`1=tOM)fYM)LtHFv zL*1O2ZC@=-Bk3(h8DE;Oo`x$OEU4g{%qQsQa3{y6kiloeu~aOq^%#J)q?g zei|ER?KY;57-3qTqZi?shtFVCAaU?LG|T`FG*CgfRP&)Byr~yp(EO$3(Wb@ zGIykp6RbZi#mqsbu0PcXjrQmVuXIO#Y{zTrSy!QZI4V?&W)Y*>kFmEBZ*;F8OSHzJ zJN=#6Kc>GMU!yKe;9rle16oyo=U9pK_Z3-Y|3a?RG4rcbJF2`XA0$Ep{;G3^X`Vt{ z#A$Bsh6~>#z5W1&ryNGSW&`1o=?NsS@vxTws17jw=h)8Cci*C{(11o`{_`1th64ft zsC+H?rSeKRdNdW|b><(JDBHkXDwMiOS`BZTJND0(={xy!3QC;Yn#!9N|Kg`K=I9Rw z93DQH?H^0PY>SGN*_HZU_Pi4xp%Q{UiCv>Mx} zuTUHt*}u1oo%#yFE+ho}-8)}V^B=oKD8axupCat=Pi~@2cz67>vu})l0Bs&PbFBS#K1%Tnfhu6{#o@hZzSTM3kabhb&P+4-@`xZ>c%#H z!Tf@(Av~>eg5Ae>&J6(5+|CO0&0V(=Nk^WT5&Npp-mxIAcM!Qy@{`fLrYyV*{@lMv zS*p+hvFS8Cus`H&2Wa^WJ^=Byi4Ykxy%ww>*dLWiQ!8#o9A;~>n<437h}Nm^~!*;Tf%@C-|UdXf1m$Y|Ff)5 zjQ_q`*9HI04gwF#e-(9!`0xI#3fKSK8uLGywpJBJl}iE_w%cD0d)ddvS zDJ=!mYgDrZ3H%-2EbMvpq3jMG+6BxA7)@n6LcHnk^m z6Ez>$^-*%40XnECfk(&wa5WL7skCDJLXH#pSzIHbR)A}&L?~m4JD(ND6fx=qhI=cd z(tr~J*4daN;v3i~4_iLyYh<$tQP~cgE*2SQ7M3^moO7&{5>3F`iOM5cvoh3&6+X-H z3J9XdPCiGWko11^WDcrczUSuEj{EsGs*vr`=Yt1Xmxk?9UX$+B8xQL`3Yw7$LSBwF zbrby7=}z(uJ2p;x8*(Daw>~NM@eLA-vO=2Gbq(lE_qa6pM4oc;Ve!c~@c%RjG8fO( zN&3wYM6s(a5FzCTZ-PO^imy%QtxWX}g3aASodos>Lt!5!yHsjNSCazZ3E><~XDc#f zcYmN8qCPdNOg1HK!MQqiuUnXqMBRXT)O4U(gIWWOI)MfKYuypDhIq9+Q`SMn{OxqA znE4_eFnGa&{2f#!G7psvD3I&@*Pkf!DoL8_6&-{SM6=fd8BXVveIF~}j(xqISWdAY z#fNd(Yac$y#>h8d&N8w@Xe-l77zm)L1~gbd)e)Qr*;YGnO1lL|TGZrq8T$(sTp4SD zkYYfCO$)q?OI{Pc9Kd&p%&9sVdM%nEn_+#XGk-A&afwQ*yDq7U0|E<*3st?E3W=T{ z%d$L&8d5uwY6otEP+Oiy3P6GEai9Pc7Clx{726Y|{tMb&Y5_2dW_kW1$G<>6?fr!$ z*Fr-sBv?Y*h##4DBDthq7Y!liDY>UT*^E=Hez}?vB_ZY$q_T+K3U}X>UE73G!``FP zOMrk@-J2hr1a5eN~*V+!=H2l6!VfE_1TbUBlcSN!|rB&;&T+75;%208J}yulz!MBR(%24>4v~GwxlmnN5OAs>mg>i^5;@ zS8|}p?Ev+y*k7TRsYm-7u5`9iN4?9Dik|_cAYhWSU`hfcw&-3gEA}q2Bu% zI#oQz8;d)jdpSh=c3K%L^~)avew?S4Z|BZM15Rtntb~ZUSLU`BQu(C!@kr8Ho>RgQ z$h!*E>w=RdiY^;^0gCbP&6G6P$9i2RN?adHyfK6f5F*Ia&aRN27(J7`3vR}sxj)4> zr&XS8-+{VmH1qL~8NAqUd_SqO#7^HK-w*!3eDC+xGyoQ~R2=vf{yisfwDNT)DwDv% zKtg5d-`@X(^nBGjT_GR=*V)s#rJ9wx_D6km4J&1>)XRR%N3ksv?mZbQnM>X55aUtH za~ZaPhI(3pe6{`5F;q`!&pT0=%gXNgPd6E56p8L{r-FQ8IkA-TzbclMjs4>J6z2S< zvmm4<{-&R#&Z}S^QoaIrfbU6C-&}$Vo!CP4tUIwaQC6kO#Fmww{B18tImOz_%Wfv_ z<6`kYJjWY}VyVKTW$1k6?kysHEI;p?JE|L^mS{ zIfkj;9d|6$ODml7afcLxGEjGAly;am=wR$R$PXL?BT0sKXG2Zg1i@DS*IRQuq6@4J z!5L9$m`akl*)vii2XpcYY=9Qu^^N=&XM>5eqLDkrXY&(c`d9ujYp>--(I)~R`|2C_ z$`KwD|t! zwC?f)&EF^wWg@JZ`Yc%{fqmRj2}Edow(D6JFy`c!atu7= z=_~$0c;a~az9!yC#M5I4A$VG_=>}c847i*868G~1|BVgdYv8faX~HgI>JoH=ZkM=Q zVk?t-%Ew3cGV=*sThA#qupj4-R{K$C><7NoU>yd9HMpBMv@;}iGNt1h64&Hp5{@4c zwM+hd+RB8HyS?fbgj!D%V+)n@<*D1hx{>B z*ddNTg3olt9|se{|1*CKp|xnoA0xRtPfB3KYqw4Dze+*jD1%E8L#^sNC6#aMfuc<%G{P{zU{s^wFqH#<(e;$7b z7x~}ppZN7x3W^V`Q6!uYSJzSgw8B=_zOJJOAp>8C)pPZRQ=eT(`WE|;955V9$-Iew)YZ&(Hnlx+lFpWg`Q|ha=3ABtgPC#;h0fH# zdLGFEJK3XH*;oBCn5JIy)0ob|fn&%|7cWrOK}oh8)KsX!Uy5wEX{8QE6;=l*e+Yo~ zo+p)wIzpWS`(5eq(T~ng7k(MzpEsZEf`6u6?eb4aATj^6XmNHZ*|k5*soTLq*fa&d z7)3SXFI<@8UAM}q!Z?l@K+TV&|NRRB}t22tp&gFc;_FD zn~qc4Ymv-62fyjdAZ3xHj>O-vJRd#jtPg3*q3&_c>Ts($;B3LQ`QCl64_yZ)Lt^Kx z`QjR>Oh}b~i~Rz9Nh|esshVOO3zbzNt{B<>I45IpJmA%Fx~>jh<%SB?t4SwJe~cE7 zJT>KY<<3%eQznhL`Iql+1^B_brE$a$Vj^$NUbId7z8g@YYGiV~-}3x*BTlUzgUM(w zd~x=It^kP(FYA-q^XD!NZRyQKSY7VWc_mB^+N!vdh%`IJlS!gqn4H?EuvJsSfbje>EDU!|(=m9NzS< z#-~SIL!bHV?K3$Rm!orl;Mhq$$JRTieEo5hVidj)CjW?0oUEl^)ya`yK0Sj=L-3b~ zAmBeA7fNBHX|CmewSJl{o z1RR{q-;J$s^yAs>BS-bXy7Rv>(U0SQH7@T$KaTwkFsc4|&efguBir}RJs(6f`K#Fe zrcTYOR-u43oDEK6(w7@AR;;5=*tBjyRPc-2*j zcmG-$NSbi%Y%dBbJ}e`q;L*u1J2T*(&WQmN0CvZJ4UriCo%nDU{MYm=m;aXkCK3PLpOuYVin?gy`nfJz2}rIi z=o8}C=!!P5V1-;Sb(W<~qRXaJZ80vK=;W8;=5If@3GPCj|F!aN79MOg8*Q1@ZdUrV zhmeDNfJInac<<1p-DH~>P4ziLdpE}pNU=On5%-=@n7lG-@sD-2@ zWm7C+*hyZ}*<2s;Yh)t~?qvLbJ$AMjczq^Wznr&x`pwA!Yz&y_e7~$?Xok)Ce(a=9 z4%MWp7KX+AH}h4@gq3k2fP2KtiIw0VbC3cih~ygIxWk=@&>2BlhF1`cuTru zG%^c9gxvzVxTsL8G9&iKhw=Q=VU*K_x{fG>$*>!qqnyfQn6M2-#BVVf zcE-&rs=O_ts!!sj6^Ma=TB%j9k|ko3VI@XhGuH6FQ8j>y+JQLlP#z}y>nv(&5XjBE zboFX-IVS~0p*@>b#ivk8v)pRe_OrzHBg7JT$4A3~3T>25uJhh{0KL`VH$AYO|KP|WE@Zo zv4!nx_LLqydfJFPNtG9~Cs;+dr+Me0r(x{rWbNsVO!Rb?=?TkkI?QP14UwK2+ZRD_ z`yKXUc@`#N$(mO_pKr(uHGI#rB(F?Ola83l^;fkgt0|9BQbOK@`5nHN&lKqdO&7NRFkWx zoj$1>6QI%W@u7Z@$q$G*8qNhTqJH4dG9oDnbsP)NsRU@-5gh=!vJ*gq zy9G$vWCejU?@ewvl8wN>6y_tqV7?7ED)aGD!OU>Lge#Gn0Wg0WePMa-e}DmeA?E)x zJB%*G9f{h>M7{ybQFY%h6BF1*-~g#Fyuso2b|^peg`aLLrSHKoTSKqG1_ic1O}&${ z4#x3h-Q$sULtg6%;Ma?CJu(9tFQSIq*MV+R=f# zCI3eL4ctnDwusHW@P0CX*Ruonq-y85S$o4#s^I0USqhUes$dL$0n5~1^h;=Ie+3Te zOB;^R$AR;S%}gT$5PaKLKp`08yO(=BqY05tHS0L)>HrZR!^vtAp3T}Ry|mcVjh8H+ zxJ3bQAe#6BhE(}8_FTm)Dg)}Low$h3w-30H$l*P%fHd!nS)L!T{0lfuJ{9}FJw>kKR%@6{TZPFYGnod9 zcWO%HQz@WI0CeO{J_&t?J;!o4MK+?)z@B?AU0oBEggaT&_7T@MmgB=_LC3feS1mSU z6A!mL|F-#^n14IfcHj)|U<&d=$u~*+n=}eImP{epwhtiuXnb8>V&9!AHvpL7PUcpK-kIR%N6?}G9C>v3c`-L6?`WY!v|NwdN2 z4~^dXgouS47;Qg{X%~0>uXBiDAgheYgIQXPs0;sd0=;vav41;OW4MQE!)x1UpLscH zX!-`*4A-<0SL*{4#hDa zm94_it$GJuJ-Y#Zr~OX30UnNLK?}_BnTOC|nR;3J=vyDh_|;&w;v3k}Te$lZn1`2f z{sCfs4VVFh7W9G4w8eMES`Z?o*%M3)yo|HN02~E<(0(QOf%scXi(H?b`Oitvn5OhL z+*9+P`WDjB6kDWuQtnahQ-w?SF0q_KyrgNK=kkj>Yn{(JXZX6)KZVd3L^qF(1Ko{+olj84VyRPPlN!|NCd-& zhq(qMP!>xqT^+LiT=Jj6nX5zIB(CrwXvm1ul3xfpfbkJBw=vul+MiH)sw{&$192nY z%_dGUVTSdvOmGk62Otrn6^A~OzmeH8maN$$v14TXmq??u&))G%&5LJ~uQAIe-{mgp zkiA1=LRI^&3k@x0Pg7@V{Cn+3)z%pO1}*7=eoLmh^sB$1GyRyK+o|^BNr#BlyQme_ zeyH}**i%r0i(^#hzL%tqO(M$7J_eweG17w%)pTz%>ORxkb%?t%0%asI!u%eRqHTOxAMO^#y@Xj z_w~f`e-6-N!U-nCcZvTCK**)X~EB*er6gF^AUb%2jTzdCs0<7T%a8zuq z*CS^uWmmN0roD!n9A+lk=wRrzIvU_6r@jnZ{b{uo{fB86#afInHFM%$sVZB=27_&= zDtiXM><3uE1LBuakF={P8`s{vx2q|;W&tewE5kuW*y1u072JzO2iTaeQ#o1NdJQF# z2L}sUA9CE@!727Dn1hMAy@OMnp};uLvSFMD0>0<-31m-1G1Kd5no|)wn4xuFaOM=7 zt-TeH_B{W4ip{)S-|=HB&g=v3R30xO@599-Dx7jOW%OU4YZ#sSBSQIim_5PYZu$R> zIR3w*EB>Dn=yZ}IUFcX%_7ItsLvO!*UD{VtMpg(J}uWi z8I93UHpjK#wrHh$#AOywDSr2l2D~k5v1$eNq2v#AKdWk7L9B{5ambG3iI~BwN-$H2Rms?&iqL(aftAml% zm+W(7jP0UyNYb4w2N~R+iCVp z@@FAbJed<|LeF-MA(B)&(0nXx`&QH%aqQ~yUzGX!ALD?k`Jael%`D@+~lfS9AcOic} zCIf5}|CV%?zaLWnyj=a8tKsn(`=n&oEF&{!HgGBODRu*5w-qeFiX+eg`abn2(Xwx_ZlO6mDW}Kr#t*amec(J4`&fqO_GWJVV5Q!LN&LtZen9V&Zbk|0bI-sL!H@qV zJfMVy>S^YXH2x8~iWyH2e*B&L#tMBy;~ZCQP_PiygfB?J;yfID<@xFnRy?h$^q?d? znu34mASDI<>ExGW>$~G%JjREAkv8sye1$@(x4C5)ix+{A-lz;r@Gvqm;9RHSv_ zfO|ay4?Kz98pfOi=_GP7VZCpl_tr_cboED8-u;w}tFaNjY3k@&YXa8zUuU$ka?h5dGW%p8Q9I8<9| z9f;&w?If;F^l^V2`X+Qt>MT45xHvvpaRJi@f#U4BnW|)#20_51ONk8K^*?%`%J(#x z-9d6ZhKs_#bi&0?iv~$ho{lLbx*BEF+9+t11SNxn_y5B<3ja%x5Ql7egF(Xk-#Jga zMRtt&3he;hY$FYJALcL6bvC<3&d#%^2e9{fPsLuL!5*HnME1HRM4H4s+~EHhOi~fI zW`lpaFq!xLKjRCf4r^i4ib7xbLu-md8w+dN^rQ=(?~45;YM&%41!t%AtenggGh{)7 zT3>h?7{O6WslLA`}<)o&quInwPj^d&kN`~te|&u(9n^cA~x`cno# z7PZSLF^&ODCOSS!?4AMC6}D27lN>X*i&A8HUfL{X?z_KZaq7XJ)52X_qZY2c#5(I! z-#Wt>w#duv%~^N$sriMNeVSTB9!X%Ib`$_0wND#Q?`)rbNc^` zk_%znZu}K{)+{%i>1ZuWi`lpM)v&{Leo&%89_UV%if;}!ZfCO^sRll_^4_cE5F6Fh z!7446+v#Tpd0Rs`AEH6N?L>pqQQv(EInhAmnyCpG3qPu78!(@Xq%G%K{dYGW@FzpVOnWdUz1uyBg@`-xQCx_~^IaGs&SI}sc*elc=N!Vxi&?yA!4o%1 zq|%1JDjReoQbgLDk)nZtp_w)G9!`IoQFaqGE=NmvOnY0kf)Qgtust2dC+&7u~e|fw1k%DH*=wDYyb0wXi;b?sMx`G z8WoEiI8TM0{i!Ezrz^#KvsF=ItGIw^EnnV zoKPQ`Zo@J+?X6HF|CSqef=VS@|T%Tx}OE!s? zS%d_({lqS6nba!PG9B9h0-d4qKl*qzA&8qF9cVx*X+J;u zw|rF?(uAup7P3KcQGv=b=4U~0m=#eHWJU2G?N`mh9SCdutZ3{6m2%g0%O={Lxy^HL zQo6<8B-f|dO$Cl+_#B+pDN)#+eQ0Qk;s3;&y1;+aXczy>Pw9+*zjc2WO|Y7PXo_nB zGN3(lij(;pYO`$lyHt`|K+ABo2-L8+%7o^0mh6p)EBgKxs(^}kC-H0L4Xq-Woi^>7 zej{&pv1!*gCn>?Cf0tmF15|!OAtH2Q<`IbKwVr-KC^5M$%bO62WSPZKN%lmhtng8@ zd@Q>{!F8t(iSr#AWu$d?Qh)lwcWUrr+#Boq2+~OXW*!K4`{+P_?hmr>cyH}|iB)cG zmFA?nVYhwyID%~sl9u9No^nF%CIit7+7xfC)?}N58-m{)ALxe^-O=9K{cJ4eg8J;w z3uAbQ4eBUof!E{4DJ`U>U5=0G5gkQGiT#*a(kw*RU;s*GVEB*?~x*^||XnUu0Kh0-Kpj5VwJYvOFuR zG2n9vTzo`RrV-8C3(QCxg%<#0_!k_hUW)yIuPGietwy7n3F4+q0rpZMPiaa}cf3Fv zOXX|qJ9-f3N5`7>ct`CK(yDp?kqUsucK(Ulj=DfrCV!1E{?nc{dOF~6FoSZn(J-3i zCXoS*Cdm;eQfwI~?(cCEcCUr$E5!drnNG55%ag{HcF=6ko~T^a4EU(AU|CcEeBoP# z^<}T1o9ItjXYT;J_wdfW5A5zeyb511os81ZedrbMJN#eH?Q~B+l?^k9M2Y;|a>-{q ziPKTYe6GAx^M`9Hd;5{ViT0Y1yUvdxGJS}#*Rb^@#3$&mR?>H4)_7|_z&)Pss|Hs^ z$zE|HdI!O)@Q}~LSKxBUPPnm0ggmy7Wh8zY2o$uR5ZE}1eEw#QkvY~@yF56(GnmCe4fMSrYN4!Aky&hJ$=1n17SiWj@;gJ-`d{x?U$2OP+J2O$Hc3G;`PDFiLAj9uCBaKvd!XY zYke*?1&S3rn1i<`070X_h$q~m1RBiVEPrE!TRx96G=TE443DCEe!%Rrl#J%CN{#y5 zfHU6b4$aC0p;t+5%1=vZ`%Z|keH;Io℘gKlT61+PlCHC0lfnn(5$cM}u}?D?#3upKV)l^4$8TJlDqcqa57mYyA)H~3K9uRR$wP2%dt(Pf-KSf*mBH zc~7kpOPEAcw=p;eI_mLnp)J;aqlHeMSc_8^Q@Dtiv;<3dk8A{?iZK&GKp)@5QHWz6 z#74pg0wjMxeDwu#F_ERv+uV55`CA;%k2}$0SwfG#(3%eP&!XYc5`~b|aB{qA+pVfa zm3mE=)D>r6?HFR_{POx}ulQWITHN8qf#gfWQ*rq+ty0fn9_KJetY+MC5Bl9Uz?Cme zhu@KDsnp&{x(Spf5V4)SG4r z9;dHz(jx?eOJ6%U+ZV?Y>FbA35`8^(24^UVz9zONgF~mUyS}FV^L4yO(3i*1*XQ-E z2=|catIsv<(bp}5|4-~WTGE`Mtj6Ego*r1t>saW3>;il+~Z~<+O6~xtW zKUWR!#Xcz)rSRD50~^M3z&qo25qh7IT3D8seW ziQJmht?AMHHbm8dI^#Pgq+sCF#qsG(fq z$;U$r;$eLKohvjjuntE2EVL4Y@&o!oO!Hc#d1JFql2CBZ*dhe?ifFkK0}m-^Q&1rGxPx^ zp8XbH7wcBAE#@}C`$VbBQ0^KMDfH(k80|NIl^|`f)(|x=JC2=iatWspg!2-%g-Bn> zvZ9mn09u$4ZRyWSmvHE~L`oIh?=j0tA$cJ*Bj$}t9bgEDsx~t^v<>PxuzuVA=Q#ZY zXSG8=`%b`+wf(%Se|z-vK%9OcFw7Pt+ypYI$Rsbg;U%J1(z75iAV5{L?jEFAX?Pa9Lz=n>e-~F9ZVqIU()K3q-u0Q7vaC_GhOW%(f%9t&Kj|mH#|nf*!Wjtep7rrt-n8RzJtECE&beN7^~w+ z!EFCE+F>}bDfBrir457i#C+1*ZMiipNFyFA$?l-dT92Ockxz?*vb!T z8<}_QVIAhJy%b*&g+j*?=c&-Qp@zTV^+sY@*(}3`R#7m3f6uNOtir}FmPXvonPvGV z%u7YNqB96%es0A_Hp|FcxYK(Z}0OEb3TCcI-(_x2IxKhE5&wwqxL_6APh(?ys zMatq8YVSa{FV?nvf<%k;TwR3bWPW=M=h}m}pao3lelzf@PEcAu#ZG23LMd47L4*au zm=%>KQ1b&oue4R=tR!}%WM%j+!!32ln?JnS3=v6le~=>=dZ6{O44$bTU(f*W-FU!& zzR&|@CN7ki4*z)FPr*{S%u}n59bGf>@TwzO-^n<41h6>-V^GTmH#f(S&YW+nQt`GA z-`3%+MW*yjSbPk>t0ZP|#fDRS)+?P-UOht4ic=sw8m+$FXXYYaJYiM{(s&SXBVyFl z*w0D8MnqV@4mi@Bgo3Y(bDG!=R>h3~^7|!}R6g_##94KMmv6>PDDt8r8 zC$Nfx)3_TPdC-ngjyN8Gwt6D^Qa@1SfiS^ndWdQbi3M*Uy0~_LZ~}wygsmx{``@-g zmzqgp5g_ytjB(mO@2z`;BY_L>EE>wDDj1mVWyTMLei;_L0RK*`>ZT;L*vTkCEJtiX zeBXD(26%U~2;{dEEw~^2QxMC;pK4-}KHDM|kji4VRG>~VFjm_B)%c-oDC5tJodD-l z#<~*3A$Ut!!BImZF!b8-Om|>RjF8UsaX!jm5$B=ef6SvLf!oRHb%B-#ZfKH2K9|P^ zYy7MpsjUlp<5q>fmmI}#-VgkQqVNf3TiX_R=6OHf>4xjb(QYALptoxL1&14Zw)I($ z24cD0n7LKGf(w>v8^SkTD|JfPXOMjl7JeKEm)-UtD+Yv5$Pcp+a~=GKOe zwW^gLx!FmGGAS;{K1ZQL{lj_2B2Ip}M+@y4}@Ih z=_K7k8b1(y=PZlU_w(nsL*Jv00{%38=O5dezV-TV2LLqoTMqFIVF0wyzLE0}4fu@X z4~zD0-Fo34s}_Px|AE*Jkw38Fy>-j+-50t(9Xo}0>7V)dDWTAjDd4yf-!24nMMJCR z`yywh`$F@xQ>x$}o{}T`_XC4?wRcGH=-3Rb1+pPFzk3(bA{#AX{`X;hxC*pOlQ!r4 zb&K{sa_UL@stN$Z0K_sNzG+KUE*@@^9=daT#E<5#&rb0!T@&k2uu)vos3__je+A_n zV5? z-&yx+7T?Z6IV1L7z?o|mlCfn5U$+yIad{S5%3SH@vUn5scu}Q^4FjO9(t&+Wyhm*+ zzNm{Ri9vv(SqZ$!sRv`3;v1%zwb(0s8x~oM-4rUS>P+jlK6U~W8|>NP{~|=U2@+_z zRm4r%nYK!>vskLJOF3Nf1g8P4hVzrhCyXaJ1Hi zO8Z$iD4B$$P*}i^9R~Y&8|-7;q~n@DsKg*Z3j)}_kvlHCpkJ1Z*F{%VNebg2DmkaUIVWfb>wSF;D4n=_ddfZ^q=g>6sjl~|s-LweMoDWFXW$$DT)VdR+> za?1K_7(qF(eITMTMp1ykcOYgqru!bWO4;5bnW4<5_UG(f07IXC?^)vljdxVLljOw)_h~&;I?oW;PSwqQ2!XvF-o!2$ml)zJLdJ?^cX0r12w|!k`#!3J zl=A6sTrM*a$VK#^j?r?%?H1;OsXlDdHlkbsx%iJcQ zdPJP)xBl?dbV?*PP=j8rH~|=Brm`G}l8WnaZ1Y5{24ww-I7P^QMk&@{C^R}C()2Q3 zzVGXBT*2MO8w@bRbr}36Y zyjdY9VTv-bI!mtONtmgmC<5M=$UB(a$iKP@k&A_<3xEVsxA6*2gQTpL${-Pf8N=M#prI*w>QU)Re?kCr>RV>T+XJi*bzthd+ z5ICyQHkL*rOOw>6y%JuX1x8b)_@`byUY4LgYyl!6U3E42G1H@CL~k5OKcw6q*AGj} zI0J31{|^T?&HCTlmVR*kdw&7XCHVKWa%hl=)3&x4|4chjiI)kQA<_7s?P$%gob?co zJ(XZtYuNhXvOd6m0)@mXDV2QYM$I}55JMm!T@3K9F zmV!zfx)n5Z5odx{Vgm@MNCPxqZB5+6CW7HE{nRyar9j-o-Fz)^LlgH;mw=|dwKHhS zih=t(Y*1MPcRb%(19#rBdbB<}TJ@-A?gx$n%dC1+vkV4^fr_(UTelVDg;4P+?59d% zW2)f>h{}$MJ#lH*0NRz{Lk-HcesA0R_hy*JA@sq9J1=HaIKip42k@Jz?v?iR3s-7@ zh}y6|8;DoCw_NG^+0?vJ?OBMw5^f>>w{^9KRzWN0!a@8C4Y$VmXIg1H{IjhSP^qB@Qq>wW=isSbd5 zMtm*2V(bVofGoVQA05yvl*87Y`=zvNT%Aau!9wgZ&O(S20U$QDd##CMw$Do?1eE}$ zuATr$R3Dm95K5JtO=(Gcrm=orPG)Rp{Tz8F1-;q;YaAXf^44BYI70hz8sRklvYQ~X z3}{rc3ZH!yNx!!U|VzxI&eJ~$)6~emz;+S ze6UB|$YR(@EvFyjoo?}&G6r`MwgIgl!z(i-ehi@(yY{0^sE#lexuzt!E_4{|t9b2A zZ*iXEwe?Ui1a1o8urJo{yjK%T!Un*^P=3PZ4{x*d>3vaP)_xKARSJH>jv_YXOY zGL9<%CSYA|B;sODeN_Ut79rkr>m2Op-xD6AhYWeD0L*p@F6>U!poNrL+`0aQa0B-= zovd0$f)q7*>zc$0*LukpnUju<$|~$-3Pjw@j3MxOB>jW?Q@QNF4wCtFeDsI+@ME6@ z{z2ORrNTAWr3WIN1Chy@fyi&O;bqLH|6}pR($V}pAHF%gbFmK=DB9|+E97fv-X=3n z91GRzm*Xt)MJA&|So3s90s+fW3cq1rioaUI35@D;JmpV;e&?>&oKAWmH3Ne4{K##Bc8v@e31pa@vf8zm&tW0*7Us=;Be!Hfxp=$?hy!W9m;-K=a=zw4pdhajn&=j<2qlJPm7=hnh1 z=(a8q$?n)8L^Ae?^!dMl+3E!tEwGLZ;+^7)UWfk%lbNE@>FWgH*WiJ~v7LV%&$V+v z2D8@^LfKr&ahX8F_GTXclH6?PVc~E zc|X3y+CSUyv0lADF2SO2MI~a{4^6X%O5@LQkI;ea`y6bM)27dXTzP&RNwy99e$;-D zk@5d@Y|B2mG+ysB6h1A)wn)p(`*{8sp57->kh=lTrQ(aH zaK_+f`W*SCt#P)OYBufbt2#?8aSZFXtg=OVJe61&MmQ57@g#!g~mPIQ@;1 z^i(v`_p-!B>Z5~n#ULvVNvi1H#Ta@i6VRpdx~V_V$BH->@6xr{+}XSYVIqiI6}Th< zh;TtQP3R1eHlt|0TCkbSD(7&JKq~qVyi`}1)Fp)!=Oxj<@ZAsZCY8Gj?@Tp`?PKhWv z38nG3ECb*~dVk{AS3L^F+(J3;c(%WS-bYFAWZW=>m{|eGBXTgkeFQajdW}<|b%eq_ zGSK$2QP$h9v;e`!Of~a zTDAeS;(it+t7Hf1(MJ*7LLc^lM{ri*~COFPJ9I>PK-N=m|b3lI^S?St;Txv_CC)H4MfP*l64sy-8s8jOqlf{K3m0 zajUT*nWR^{%0glsnooxmq!|=uhj~*zuPmJ{OFa{8gLi(gkd& znmB-nN8E!a9iA83e^{`>7kUE{cYmk3eR=51$+&(k=nv`J5#MQ6sBA`E*8wql%+`S- z@7{wVJ^1!>k8su<6EtT@$-%NzL<|o7H$2Sk1~tNzaf2GG@mrS35a#9TXtYkEEhn4f zlc)*#hmW9Ze9%}>*N~ZkM`M#+cqMQ<|0N#q?Qs^xMh}Yp?EsFPT!X(n-}@1^UF>_Y zIrS&)N#}A5UKf3b+2qsE-axcxtQV0&o^t$WnNC|}Cm+DYl4n5}y-_g9>!b!P=h zNHQ+9*qv+;6qzGf6_j$!T}Ez4_{o$}T5`2`&lv_pHXuUhE_rOP5oBxwav6~laIxj) zM4vQrjk1mZJCJ;*^Xz(v3BmWZjjQA^pExW7vr-(!ruAgGhpDO544A95%t9gTma_iv%|3dbi}xN z@=hSe$$0EK4$a;WYjPdnc?GK@W7bHH)>=Szn=U!LQa$v87J&k~HQF-X5)o*ZHrkO+ zFofmMBnQlarK(gq8!&m`Q8zLQG`JlF5F1&GKj078b0yw7niHf?=_>LprKMS)bA9ct z{R~C%3!bQT`q#--ME8hs&={~F zgI{ZU7Kng>QYM%CB@o`=5AO=#Ry%YI+ZH*N0x&6Nxr*r~=~xNLN(g($rRhn9VVc z5uaYJYB`=Q8+O1fK!f9)p%{3`$3r21U=Y3%tX?q=AMDkPyQgUZSWZHNankAF zL0(SkV0QinfK6wF=i9kpTc`JqBHXn0#ltY?aR2$qS}L|I+?G`Q{g3TP#dBInMJ*c- zCLb#Zjak3$9?_0`T<~94K348-TRti+A5X_h%B)}OF<@F`9Joz)rsbs;BUWIUo5PHx zf>=2vVcY6tu74QRuv}Wxfi|`^+d8bld*|q3%!DcUKp}?_B-vww2Oqo2xa<-Z`p8|g zK8y>`Xjn+=R{UkjRgI{tXV~Y+FTLa?c&TKL2EvozIiY^@h4+bk*zoEpcmfluF(XLl zHkOeD1Mbz`t!5c@5$ztl=0fQGU!lcUuB7E*mLOb>$eN=}ew4sO!B)^9KUoC+XpnC# zGrqrqN4q}4Cz5y$*@)_(HZ@fIqmPOm4Nb{ZZ(>76HmMj$FdFX+3Ut`pKsr0k?XOd^ zVP7sVhVpWPe5Ux9jhYFMh848TwmdpdRZ7dfXyW+7=jM4|9G83Y3Z1>?6d=qv4um@v zttW}_eA%dBpnv;Fbf9jMEx_rNqgDCp_usco{}cdu=v6$2eJ<;Dii2`XnXX( zGfw|V^w`$8r0}qz|iFZx!L>r}@wi9%$mC(63bP(@uPxGIQL$Hi&ed~7w$`b5| zPlSG-H|p1{Oq{F{0&Y72*o`qw+0v&=*=LDjZ!ZA*lvFi^_Bq$r(gPay~aN>WC_J?=vc4dw>5i z0U?^s)4X+bA0z)m8rwE~X@g=YcA%WBW6orLqFBJa54v|c-pDN*jXs<;TKgc;^^r+j zAz^nMqk7^=HfWZe&9~AKjp9;oE71$dLcZ2r4M&tPPt8F;9|7^{t7`~OK*%#9c1#N~ z;M}yORs1PIZ2N3L%&Ax;OX`GP}XXdFtrzflxCgjCNNfTJpHLHlOyp#K}@ybgRD$h!;OaUW^d8Tf7rc`JFF)=BnB>OCbFYh} z72b-SwvBK_`(TPd#A4df(4xK1+q`LrOVCcxy#*|-jbwnMI_&BMFXM`W*58wu!iv@Td)}D^%hXUBC z-2i5&`0>#M2dPEH3tg73t^-_ThC+!1qacDfAYnV6S6J;jQS4HBT5iQSZ{|=)|9t$N z!&~Jm@lWQQ9R9+Xr=hpF?oWrc_z!Z5??V`Q6^qpMoty6>?{%Dze zy#UjDo%+3x2y>^;!wcduV$9!488J69LJM+ItBUa_Kc#A@*kA69B4}+=wmC1YUS|!! z3V`F2immL8Jn{hKUxcAA`Y{dib=%`DW;S$vPRhK=m}fLLRL)}{W)Am%l;}C`f^8TH z*rwexrI2P1aPam-7Y6`RlQ52=>Qfb%d9}1N0=GCLKt9X|WCKKcDz5)#e4WVKlp@(t z-alqIS@YMaAQ>@TLpwoz$Y#k#@?8GP!e=;h)LRV`atI#OExCwSF_nn#dbygV zmDG&CNVq@Y^fcFg+77t2{j`k zHsce-pIZ6W|C(P)mj^0P9OPfzyK~BD5m*?B)BEwMxa9uue%kLsodupWewX1lV_1mu zxSS&0S|&EU)NHCc84u=>OpSK}dQYHsbo_$5@EGugwnpTmHP14z7L%$}UmWmC{&lRW zt=GC7FjgQ23y~#FQdWC`)DbkAFb`$4W~6OxVia&i?b<`IJ{r~Iuxa&~am1P208G-x z5X&qw6o@b#6l`pUQzO33yd1q1G{~+HkC1)_6@9@-$nK)QbH<;~t-*IBObiv@aw=6k zOc))vfcuXk5Rzx5P)O=muEADL*Uh$9NvBlx73{BG9%SKV{7SS)f0zwHdix`kzx{3d zdgO@j`9StP^rI+DKG>TA5d?_KY@udq) z(|o6O573 zB=G31JrZIDOR|ya>RfCanJX8gOuE3RNPYdW$Y**XF&H0P<)BqqtaZ*mbc?(eaKzZ; zbVWB~ji);HqkY#3wN?QTkI(>+pZ`vjM?^z*^p?20gU9mVKbSF+s}fU!wT9b~5H{ z14Mafp7gi+>v#oq&E*<^O4|hX@4n}EFmo)Q?cat+w3h3Re^kpVYL=~GWPm4|@r!dG zq-gAV3WXSVa3D%xpMiZ4`W!o6?UoG{yftfdY^TFcn}hk^Cmo}ZKRk*q znlj$sCS|z|247J&0LURE@Gj5DgBurksK%C4NhX}G*;otWzjJfQ&pK(5T?2wuAjE`! ztiv@QGM20bd+^^mdifWBMQo+3z;+`Jq8E!1ctHNYAc6mL$ZT!#|Hqg=!~dVP&Hu(f zbQieH_(uu#0sTWJ;3qNLBP|(O*kk|ud@TrS&PkF?R~~g7i0IP#9MnGTMO+!!&}GT z5b_V^A0+Q&{8KjL#kC&K-U#`hJe$i|KR%lvib8iqk9H?jVJ$G?FP9KVF&4(rSp}kw zjl|b!^7XHm>aQgnf{$NIV#ng^*;N;#?qKt^j9<(773PuzAE`ME%E3L|r|F3X6$+r{ z(jcaA))aR@7?UqgoO})hK^KfkWhJ`g4F0ry+qVl7;dpvJ2o?Lc`^ak~G98N|lamyS z^1}Zg=+wKtEmI_879$1QW7(tz|0_{jg8!qVS~yhWrn~$)5dWmii1W`l8LE&h2l;rx3pE*~;1#6T>~LSneWcws~VX6X!B64U_e{9nS&q!Z*W8goMO(&?Io zwxbN_;xXZsR)^rSu&B!jC<|LP(AnYdy=)hHd<=Y&J>O!7X#7pl%o z36Ah>&=wWSw!9Hqo8_{lZmh2OLEoeW!0IzmS#_nl!F+j2_MOpzyFfM)#bHUk^_%HiI_Iv z!+gh(xuAqYtFMA+uh(sVkus-?KGqW*1v#UC#)=Zh?i$i$H%ug&KEU`Ps47Ud;H z5Ae~>d!Y-j_#<^;NuA$4048Y|Oe zf`{C|0l#o{Cfz;gmmV9DM3va0D1pv<-X6SX$VMQtn4uVf$n7QggKA|cR30k6d!z^0(` zUpk3s#A;3t4Xdr0vJImji84V6{BUO7;5OW84$yR*`h`lxel&{=nP`sR%Kw8;wwwYp zN87dGH3{;`Tlbobnf4C2jzdBiDON>#`|pPHISLbafWEil`|3$jNUze>g8xG7Yjf#5 zE{;qV1U96zAjl*bnz0L_%Z~%1My~+n=qw0Q#vBoYTj6img$#t#a71k3U?9(1dzxMh zAqPSLdq~)QqY)(XKZ?{g=zk^q1N)`U>HI3ei{TPtoEO2i!S~UgkiZke=XC<7nc?#^ z$@e5YUp&QJYVd8^NR=EdZ6JSW&!nnhJijn0h-?nz5;r~Bub+dd2cr<|vtHX1q!{f% zpEC*QlSr)IPvQo7Rd6a7lPl0LMbJ#bOHh2_ zEf#TudjoOlj}vhSVECAZFN*0p0cT9Jf6ex^iQ%+Pq2e)vfH~%mNCkqlasI2hv|9)8hK;y(2qg9BtWu zO~9YA|K4w{zu3Na@qg^nFSN7TmBm1nFd~E(8MawpO)Q0SvLGP zWJ1|B;SE<`$%X}{K|B%?^CBmiZVy8G&5{}&SOe#Gj-n7{Ka^(dN89QB)ECl*{sxDu z{hVZ;6B-|k5r{2Vm22e3jwDE?M#K@P}GJhoBAE{2)`2(N!MJ|9a&RV`OJEb&o zOk`eWbR1+#y|3AarAJA2X#{fdh=CYy5Ro6gY_$U$DF|J|0)y*_>{7V*>pr6d4po;x zVmu@=xdaj$79J`H=oQdM+hV<42)S)$;ge#JFoB{qUgr&rxir#qV`*eM_QwN7z3=UP zG#V9^2NWPwL}C{ii;O)Pe`G%XTwb(XLV=BN3$XTd7U{zz^{&x=+v~aF|j05g3F}4|@ zZVxO%sM}HajrC!-pK<^8Y*IcWWd2zO1Z}v<)cJElowIBm)yOK3xK-|Dm8G`I+=MEP zm)evkcd<&PTjg?Axd>JK;oX5gpE7yPnUUE?ru&Qj6&&h!g1M=sb>CEdLEjqWp{G9* zMya7wX`J%~L>K8-%kOTK&XM4enb9=-BEx7?nzYRLiEW#V{NWN;7$7^kBkq4n@DK6A zTVvd6si|EYjCj#{-6rsO#l(3UKQrV=Bheb(%adu{e4!1Q{^m8_<7@B|XU*R6-o9K2 z{-{#!^(?{f(TnD1ezCqkoa7+ftN79BJ?x&2DW$jxyMcV1$8&b9kCSZarI8~7k(_`t zJGXqixBCq#{3nzDWCxsux%v2YI{v$fuWkabZ4O=)2yYLBw}@X|EqIFYjmA&cLgcZR z<>J%>|2wwIGUsudjC*C7^RoF19RnECd*&(VxC&5ZUPlnB@K5G- z+5CmYqUZj>o|Hg1rh1mSZj3kOM3^&T5kAq}+bR$Y_agqaA6cP07}1-q9!8QQqp2~g zJUV7vPH-(Xu?p0d;2p|uyF6Qz>G?unEztVO-OwQrBCsmjnbxEzS7Xs6n|{4*gNI$?Gs8ll)ldkMzWWT*_w=$rR1!QY;^-AP=TIWW@4@ zz8E}}Z4g0L`u6BRWJ0#8-$6t`EHl389KF9t*^DgGO9l4m)go2(0}g@1h4 z=e|mu^YXzahgpyAv zzxK#qy=zBi-zDE)F>=j>>_a$^OW-^n!pZabk)jqnC%hK^4n`!{A`nJaV$&Y5z{O!8 zjLgS+eeEyW?7h7wY^?xza~0YujpU-%r8GVk<{~9uT?#&u0DOMXNG1_p!e5wAqTcbm zJsbv9UYN4NLJJg=u)<}~l~45{Wx%B3%G2;Y;o*2<{nYROL)_pSH?YlT>QY-oFC^h& zH3C64x3Pv~lqy9$%qtirh&FYy9z|3H=_63Ixe8~B8E!QwR6JPvH_x!T@S0{wAiPce zfPD@L>ze_aVNA9^G#@MdZupu$x@Odc-rB#2j1k9x@n_H?iEx7qt69g>12(EU^Fguz z!;q>j=X6&RQcj+jFX+x?9Mt&y-yNa9mp$?w?9-(=L=21+E)D8%2pmP>c8jE&{TDm} zCp=5w7J-W^+z9>{LgohoWS)`45z8fB2d{2EeLwCWA}Bl|-w+!w%u}rfUMdU|`h#W| zv8QVUL>uSc`<>sz)Zj4|9~4xz>@FfOS=BQY2v$Oc92%BG;=}Gva)8p&wjTNziT~zj zV!Irmo|~yg>F$R6*qsf7w<}!}hEb@pbg6Ep)IIDQbiZ6+@MJCpFZY(;x&@n|9sITI zVa?Do{3M3XZ^h6WNp!hb6=aCi(o+kPv~(4H625NNk?N16A!DTm1YXdv<|9o zYn*~9gOGujNWs2m=z=YVI_?7u^`th2s-Au5*Jkw%dl5tL%LyH2e_>md5iL2K8VE7* z5o5oAiU7hNh88tInYyD9RUvqCXh`L8_VQ)(fnvIZN)93)<)T-{jVov)t$$Wp)2glY zR|IPxY)POes1zhj@9GP!&4f-7`%X;$uPJ7njPw(EcK>kRS9n%>tkdY1G0c>zO<*;O z7MgE_9)QDbPF+DfHJR+$8 zbje&e9ypaAKXwK-z1Ou1=pKFFdfKIjuOf3Oiaq;i%oIdEUUiXRCgdVKA zfCXm~K3`k%;u%y?v;RbKaoMp(T(Eo{RHjHcC76%+XQ>DQ zi12&8VyeI~t8Dcnwq6ofOdJgP1b=+ZZ&Iab}0Co<#*D+vFu91&q4d`|>*83;0jmzt~;vb9o$G(NkKTR`4 zEpp)+DZ_Q*Yhg;}zzCfCTS?aMI-WL(o8HB+ic9K1h#Ueg{u0$BvVe^ZZX7QGBHW& z=jNZ9)#mdp4K$7hKG#(eu8uwjwrpHV4`w0ceU}tO_+og~+JiaY;#I@{Fb8!w_o$10b4s``TqX0)e8vtTKd&K^lGD#t`oOnMSE1xwDe`FOzRWOTt0qBwUB^=EO( z@n_3gPQAd3U0jT^5zsJJaP`sEw6fd(pX7(e7OOsj(|?3(f~RAvj8Y&+{@#|Ghrghs zS8{Prl8$rjj%2VjQnC|DAj|feuRDdlI30Upi>i^|8tE6XDLR4PPiETw7wDB6Hp)Z% z<2R%t9L{_Mqm}p^{o5Drnaf0UoOg+6$&?>X@4<(qr4%$5{51L{bP57Pe8dkx36u@t zgIG{jh=>%kBrHT{)*RtsAm?#6H7EyXAr7L85V+T>+5}y z0@&4s#{c14v=?i;6z}gZW<59yIbvQ$tU8Fyh3$?9OyjUc@Jyd{1D&lKvM8R8p_L`L z0jIMDEqWG4poaTpO166WBTk(zf-omrigrJBFybuGC;rcUBg8T|S$>@UA<`OwGzk{u zUk5RS=DC6s6G z;0HO5h+i;BIgY2VE08LW_AoQsQK~@4U5`{qsFTX?g8mURuK+JZI-zp3gRb=kuy5Dz zpo$IMSoXm9zbc<)H2yOIySiCqjf?;1c!TiM3yA+SdbYwpYgo*-!2igt8viVENccaD zlmPr^8+_*&{M%=4*%AMR_zVB$FNydk4zW0>`^j6o2OB8bG41IO`Yes4(=nZmOKmU{ z-yGq_-vd97XRzpj@pFkZr}0xx{9Jq<#sy*}$$>uayb<`heLnHizeg+lutq!hIp#x+ z9~LRiF%dTBWDMAl43rOV^pS>MoD9)?T# z(rZQ%8Ur@~jb~g>G;Z(S3XQDP4jQ*$bBAosB8P;=i^(b=GoL|YnL(p{-fqaO5r0+I z&xu&nROY4qB&5~^Q_+yxua~)`_9@>wS@%Kz2$n`8(xfG7m>)>XzrW`4tEMl6b3*=2 zPeRPFg_M8QBL6a5A%->DLCnkVX~eL|At7cXB>@mK(;%kOAjUqIa3KZy$`kt9_hW0! z2vT0mAxPX9^4xN%i)ZAJ>n%!J2 z^edrG-l&J%MhMb=jl=&P&vrBpD==KqU*$C! z(74v1ag{-1gF&Nx&Npf#8-LXcyNN}k>q*7XwnATO6v#CCq%!KQfXiCT9$ z9$-k7l{!AXe^!d4B8zzq3|!&9$xd3yq)1@Ro=K7O*6cz;kV%noYZPJ@=3YgHQosSzf1Bw4^84m9lv6>sT^K7v@l1e%n3yvg_yx&Jt> zNtK4z`1O7$yO4X6j_U(#4R}BcM20LmT^IE4KfP zeUW#eYhN6N4MJe+)x(qQiz`?+{FdHOIvfj?D2~6f+=*RH>*J;MWVN8>r=`ymq(9BO zWf+C(aCQ=X4!e%>Z?4F{F0JU3HQJ%imt`O1{#+J0B>D^w;%E?;Y3Osgp-=lPr}ZHJ zR%!XStEK#-4X2$m1r7Dl*Ruo@|F(F>)u4bh856D&IEICd0Luovv>&G?p<&QGprQX9 zqM_mNR%l?IcF^$LJDN>dmgqLQsFC#plXEKT06esQq{!$u;>S3h0`kp9M*u;SQr1 z+l&PPoutfZx|P7o!b1z5f`(}4?u0w5=`h2+w@~9#1R_~X@F@H{Er{T}8jK2}lKD~K z6k~xLh*zw`b$Swt*OHXz0NRH56oB+)cNBhD-lS=bHr{rTD_tbBg{&W~e3&3&Sj&fW zfULeKOPci_b201Pe#cpVymPBrXN`7d{XWUfgaptia!9j2;6${Ak)#_&$TYKVpK}aj zaB+?Jf}Kg6QG)e}Png0HoC#CxIL~DY7>h)GR_8?fs54t^Au}xgEq?Y00yTbo#LwEv zN%;BUTHxo~tBIdmI<>+NYqW!(`EP2$!6Ju*pTi7SEHU`0H~6v7lKdK6u|(wO>R1wf z?D{P@%Lt6Wp6lY~Z-Uqie=}XVIC)0|LY=O}U$s=kFzzD}tllp#8Eyu>gK(F52l|T0 z8ZgZK92%WRnqJS2_qu~r4*%$W^a{&Nq!KQJ>X=6O{P`hV2xB2U{HjvtAR`n*908Fmml*>;ev~9fedoLef_rpwKAcpm4pjcnb@ zPawX<5zHB1!CCy`4dfx6G}{-({!v;-vf$w~@;F)M2Nb|e@1rjmQ7B=+(~WE(T+Rrg`+h(pBiIOFmVV{bs5x3B4ZO$( z%z;*7GgDnAJ2HS1kEY3$(quM3$$<|DQ)WT&LuDbX2KS3i0k+2NxDDu<@^k+ZG%<;OJxe}M@+c1VXMnH{Y=&?epW3UW~FZBdh zc4%PK6)2-FQ}nvV3$bg}^aav9qTl(5&+&}in?R~g#w#iCa{sRH{^sc4vA=352KiB% zQ1+^3#emGs#6C-SCWfK?QVECjv26E%Je)>;XjIV40s$ zat=jxcZf27_=iBB540e;v;Z#r^%Np=Aw>SIB~%T2c0Aos18FPOyx(woU&)o%5F)%0 z0z#x9vp!nPpRJ{c$RzM5#nSc!v2_305G4Igb3);0?gVVFYnhbIjrO>-nD%PB(js(f zg0z@70Pu;ln2pzJ!#N@?8ulbi0q+My#0~MM(TY84%xVMCMzrd=y+6zszOm4S-?s=yed)h1 zrwBk47P&Wt)H>!2APEn<^i)Y zrK>db1U4?_>Yi+T=l|Fzwlwvg0YtiqtxR-Lz@rLm3GT1#Jv8mcN!Gk~So2c^Z}&`b#oB>x%x_Aqv)+tF{E zkf7YvZ|hIA6#Ft>tE_2|Pl#Z2dQbWVn~qM#xV>ioa7I5C+^Xi5P(^8U1n4IMrS6i^ z(q}ve#5^B!dn^vV2D#O^5Ybsq?;EjHLb&kHCvqbb+xRAT_=qLxeaOLhDL8)*CcMx%`h~A`i?*%jca~sq`WX7dzYc> zGtVCV3aX@x{s-tPrPMp_KY{S0a@GM^D3Oa}U4YpT{|gE9>u#77ryR!^c%*ScX+MKY zAc`7L5fpD3H?A%WPr`=c9w&)b{5fE7LIS9}1L^=aUdsXz-KT~kQ1sair%+O{Wv+zS zTWMruY2?auY;AgLFB73RnUeI#DcRUtD;OWSDKq*sier2^h_}y^jkhyl@i1;I5Gn44 za;1?W<6(a2s3XzwXq!e!X`iqCYraT>L+YsXK+#9RQ#nL_VBlWe#;SJ{#OCW|6vW%q zH>3t*E&BD@8M1%OGdVKtDEKvixJ|&?8$SSRsl6%gG#a8W3BhXI1TaYHr_ay+H9G*n zw4!uh(VM~3187+Tuz{}LcLU)kbF0bujwcrYz=fn{1Ast8zxFf1rzVuB4}+c@Sy+@Q z1|MSuoZcxv2`OLyGt~Cd69_mL&v3sW5aRd)EN@qesFJc0yPwm3+4^V~DU1Wo1`_pk zKhC{m>>fAGNqKICUw=tLhTbyL=GRpDgxez9F492g!K!dyS8QGKi+F2E;s+nE%z zR3K-;>_qe!A}2?I{)4;XwnQMjMm>5ond^CDOS}P*r2WP+HK=Co2j-7**2CpW@F<9A z-B99UL)aI&5t5}LxZEEpr&QTKN$j)nAhy!*y3#&PJk2#Za%n1-ke>txmpWtP23i9} zKhDFTirUH{P$c3V;%lO%5LA;R<5HR5GFsBMeKwG*yf*B!Q`z7xra@}EHWzxA{}=M* zp=@nVQKm&3lb3nRo^N*s-W(dA0rAMby>BkJFKkyw0)A>o5-mWqI2&$-Sax|v-4wxo>CtGAk$KzLm?Rw91?V?~qK^z6@ z<>M>@R^qkl5+DIm_+6XB*0et^*8d=etJQM|QujL3a3&KP8YTfk7c-8->4?ZN+v&2!u~c@2Si8{y@t2W%1ZCm|uz1O8;8QFJOT!yV`zSs5^U^T*EkO+a z3=Do-)hArzi!JJSCZZP(esk}(2Y)vPpOzW>JwOMYI~S{v|gK9>eRPy?%=*$kTQ$+l z?tu8E(xSJ6MWxO-eIjo=x%eL4?j2)EH*cx?Ow)Xw&~)?+vFOHi$cz>nt!}jIYfrZ; z*uEW+E-39T*xHlO3X~sER z67T-D)smQXNT0j#w?#ie+->%brR|!Dbca#}C$*e7>`^W!*xXSV-*kYd~JJG!D zLwZ^wqy;Xd{R!#KV@bp`L`H*~Y}CGXHo4pskB{Pg>6V>x0IT|9coIAH_$}J(hBLs} z|BJO^Ce~<&neO|WW+oOnBxZ^-S_#ZlXqc(QFq3_jf129lCU>VPcDl<+ z!e5SO*1wZU?cR(y?p;RP^q*u#n+Zl64mur_P#KH{`69L3v21yEgA5j8Ywa`GeCql3MqoZMfw83a?^8Ais0DVW# zIHM)=yt{ez`s3|_ySrZkxI2!p;QkA*RUyH(*2QlCw7R^DCYiW(aX=HOhJqa?5ZqG- zHGvkK>Y6~bzoNTE{FhPvxv|}@^hSKM-Jf18<@Ek^3HkSgf+YT(Iu#>1b29mN$BtI~ z%Np(Q@5g`D{L3PT#J>a5HUCx{{;e_mYo9BPGAzemdftJN`N-^xBtUwsV5eVbG1!X z`#W@{p6DDG_mGdcPpMrw(}sWLJemK4b<~L+jZWw&iX>z$yOH$^jR#kz;o_iI?6Po6 zk=g$z_760u`~HQ#-tQD2RP+K7((XLJ`*6GSygw&lp1;em^SlGE)tFHt_4Gn<1Usoj zC(%`(av+Dc6diIhW@T@;_y7_DjAM_;QZ#nID_J*vfap#+vW|Gvu)TfVn!mI zJ%r7P92zyBL(TBg9punB`!Sl$NUVbst&&4S^^G7|)Ea$%UEB3b66$BQs{iG!2dkfw zQ2+f$TlW9RLF+eckHddgtNNE5w0=!O{j*!u?|abtB?Swm z#Lkvcto7DCiZ6@+!625%Ph>E}?-lwtdX~&L7%7@;z{?gPm+BP+1dK(*3-@E#fP`HB z;UkC(hFt18F&rf-ONW2t0Y>iWccn~$GZj1JWk8}u+?&i&fkck7c_2823xJ@+X0_v`{b*(`z-h=p~C{)<^d22nn$k!qEcc#5ZFxe z0GEW;;9&lSQs#4GuA8Ety|{9M$U~B}i?G!;csG`(rA1#?c}l~d$2#Gk@df{;6<>pf zXp%C91#IE1dy+q#iqt^S7jtJZp0oikNG>xGHxvlNg}KQ_l`dJ0aem1|7sL#Ww;GlO zS{mdp>o|kwqh}1lAI4@9aA@ceg>=}AMsKOJFc(Qhcce`Y_Z$@}{^mo9^kWcgay)Kf z-U|9xtCyKD)Twy0ZgMykwgG{2}H`K!TbQ z#P_YaVW>aS!yj3|qZdISUyE15uQ4$PT$}OeV6pwdx={}%5LrOX`I*q(RPW8-a2OFL zszN&c=0^X|*n-(}`smR1^gt@|wCe1xzGmc3Tbf&gvH+r!006hnCXt`-B+5?!f&8&n zeoD_;ejeshR+0!!mjHpG2_n?QM>(FZsIC52XO~|1KoyTYD%; zEt(~bt%jLSla**7Iu^65E(Kfq!|w(9Z03$)X=HYH!0==6WWO`bP5$^w?sAleD8FJ5 zgNJ@lLkt}9T1PKwIFOXCJK@la#dN|kHVF=^@-$U4&5Fz_Cn$OnW|jI1;s%j3>ItN! zj4wo@qY%59p8enHC zj)vHI35JAEqJ0jkpf;l{*4%jzrI z2lHg|H&I~Q@xkS?E!a1CfXHbh!7c%iHDwAC9K>eJ`c!RW#$rh!!=B18s5cL47_~i|WBZ>~^VA}W}^XHlSb1#I#GRm2P zTPL?CI(05|hR07M>q1j4$6KmistHUe5^rF>E7Xu<(Iw^@U zI~IY~R)T-^VTTmehoLagd>Yt^$a{Vbq2P*mj!%t6Pm-^0E~ajb&(HLikeFl3CON}P zAWnDf!q^aoJZ=|dEE4_{NaYOh&Mu|?bC;yFYs2FDx7hAhnBai~yNBQe3+I7PK;=GI+ zawc*oF>f&?@$<;e3xS$-WgaE(F_65m-fmWVPOC4{;d0&&W&0L!^fAQ|a?u`vfQh$* z!xF`j&PCe`&C%WY$gj+|WTBC?v}?r~Gchvlh|DORF@#TTTMhrR?IM9b$1X^s&merG zZIGw-PaI`<4@eu6t_JXe)6n|#^VbP|&Br?IqqeHbJMoY7Gxc*|I%2jF7|Of*kVolq z>|ZUA)^b`UIaR4>IW7oACd5{@>`2a=56FD zpc(1v>Kk@7;|j+HpvxwD)mo`%(qLjMEQSO>qg%8;fL5q&e`>nikA$R|mEinIV7eyi z($JFc+V1Izq+!J#v^}-`Hz9v=76gC*qVLzDoNN#_t3-;|p7Z?3n!o1j)BR4@9==V# z_#%b%!oQ(ka;`(Pl(rGD2r=m&&5Qb2A=L&{sXjO(hBBnZ#`dS4iLAX)PYMhswxyrJkPGilikCRy6Pv(MkKg{DVCzR@p~K3Il36qjVqX2BJ*n4qm6fRI$5=l}WWbm~XT&EzbbvTt zr*@A=6JcEW@R_a3kyVr4Du|nMpL0&L?`Nooy{Cu1$n>SI^*NL2C|`yKT)M#Be2Ap; z9f`Ia&qGxn>@Ut3O8Aj&Kt{{kbk&=LA3T4XMgbr_I3_JzvFoozQ&DQkk>RQ z!jKQN<9L#d_5pt6$W37p&vzLx(Vx%3?T#?ahWkSMQoVIQptqXBp@>hfQ|#FB%mtjQ zQ__g?kJO3d_B6l5hx+JYRNJuEWj25{!l@>lvrk|Vpo`w(b=a^)qDy5A9}z<=F8XbC z^)B3XT7_)Qv}UU6TeUU)RCEBykoW~9ki{M-_|HZfB0#}0YPDnR5RSBi1PG!O?wT9u z3*Xv+UP8rxm(qyByR{L|Dl9cdNiy5;%X~$V7TQ?@73O%ZlC0vq8O_OfElrNER3P_- zdT!EDwf+!-RF2N{2p@$U4GP9qF&PZnVf#$ueS=Iz+t~#&HZ7%E^54Co%fcF z(jTo6ENxH0QEpGCPH>*cmBOds@0?T!vFmVy$GTT>${vDY7j@`N)#Eg*i|QH{7W_y)Y;Yu<oIcbRKKc_hcjM4KT;ILH^2~c_` zojtyA#D_nj;w6nlF3@#nA)eKAY^;c(M;krFSJC&e;!$6KX{i74r`~We4-UA(fTWN6 z-IvWFZYV3z7x;>t?&da!|LYL$=k_lC7ML(HET4UqP-ywsSDEH8#sj|~n3eZZq7jk= zp;*W^7zn?ko|9vbk_ozgB}#^hmv0~+3E}zZcv-Rvuhmu9*CCc*(VA>1a+7pDKVr(C z{0zR04JUyoos0&);^DD#Y)kO{=_@Gme33si;WP3NqCMF;;)&0xzz%)c6S?E&!1*+(Kpi1g@lZTlHTKMXdw1rq2U zym>jHi}Wt*&a{0QQ}Cx=O??e4EmnofLrTfm8(PaG=yrpAhW`i7GUJ_(2Ag zZ-gY?{4LfjS4*f1G8}11jP&4!#G!Cmse6>b(+&IeN02Am0SMuFL|6L7m!<;~d8*l<`= z@HoXw9z!BgB1fIslyqqT1h$-5qt}W+Pjb?_0tc$Iff>YamS-SX$oBSOu3^U#>| z%?%E*=48q8%*I7r(r_Sx}YCwUUUf1UW4kC z96o{F_6yrYJfZBJ8jo--N6E2oj61qH#}2AqhI2TFkr7>n&vZKL(I&%J>Kt1Xh&(Et z%KYMBoHsNFyhE15Y;4CVI1t-qJ3Byq(f->f;UoeU3i!k8VaEw1(NpOcf@YKfApHDi zQG5iBce2oxwi3UgbPz!9QB(hkJi@o*A4r2+Vj>NeKM85D;259-=YRAohp%ShmE!(w zy~tfvc(oA$(Q6QSnP~m#{Mqvs82-*<`9jLh60O28MP>9;z;?sZ_IP?Kj)NS^nsf^35rR1$p3wXVCom~0>U8=sWg7`)b8f^b3ImxZPUNerL|5HLZynPtvpV>OY647C38P>a=^=8n!XLOp0+Cy{^94L2=LEuy2~LrMDx1D_{@K?83jD z8Y<3^wvL({IWHBinvZBdY^ycucT)PK@VHd)=B-Q|gYM|!*8uM^0H2=>aLp_LJcD5{ z24Gf%{o7#l`>m{}=Epnmg>ROooUF?LQX6nfmq=~K8(2!iJrN`^LmETgvEX6pYKSz2 z#K}yZdfs7Jws~HejF^x=_7{D*3*C#pJdu^Ex)Lnm=E~TS>W7eqlX{mN4$l>HLF0H2 zZj$v!mgI1>k$Ysbs(GD1Qcuq<;@!wuE1Amrv z)gtuhda!QhD<(;!TNthR!_rl#c)nD^`HkSmd(@eURmOe1MI*fBWDYKOJ*3e0DuC_XGw zZm4+ct9Dr1@vNS>IdNEgWp*x0d|};-GZho~MH)EfMl4JH;o-=!ai=uGdCW{#SHzn@ z{? zuCBa}E;+o{+*%$x62*_ef8Frk;rOo;{_9Y%v38??;q#9F$o>F()5OQAX^bu7mgi_V zWi7#<*a_@T1WutZlB#CEgMp!aeRrM+1f=`fR^nay2Cg?{llTwz3rcJyF=+|*;^ljq zqtCQu!HNAg+u$|_ejBWPHV1t~F8ZsiVDMrZe5F7hOhMQk)!N3Zp2>mZpu#rXs;Adq z_|63aG=!ONI@}`Vl`vGQ6*7#$fJpYi>Gc~xlldp+GNZFwEcEsK|079$i*aB!F#r`H zhHISLy_l+69^Ax?XJE49WM?50{3sZ@pF{x5|N9RWZ0P1gUEHHl24TD=Uxi7 z8h&z1wpz3rY*inGFw%nkEbQyFC)lA&KsK!e`|%)YE!c;%v0zUt*p){bgQTQXhp=x? zs^fmTHFH~t^}k#Kcxy+*;niY&)5}H-XtDkXc4S1lA=SSt)^C3yQLMXAw-)QQ(wGtJ z<+dq`^>HHB`%U8R1nr;IJge(u^c2;Kafq{xZkEw(qMm*VZM#vZ`{1WI9Ie@RM%Md` ztjFFD0>I7mQD#Ff8i9{lpoDhiB1|z?E@sngoXg`LQZ;<57WWOjt%2)UE$;8YhE7Xy z-$2TR=8#@O#kWfhj2a0r)y1|v@8TG@bq|Y{#7Qz))@=y3ytFb zMKVtURkkVar--0P7}lDLM*5p8$42IF4+!g;^u@Gb9P_=S71u!q_XVTaCYAd`>!Ko_0}A!O!O{NpjN#F zI1|5Q;|PmfI9+9>cgxBeyoG&- z4+VXW{rG&Y?IBfeJ*m1Hi|q!CF{SDfyX>wy7Zh33_zB94wsT>xqC-yiqH?t4zw8yNpswMkxZPl9t>cXA! zFE^ojO7H^wTFGBk(}0Fq*d11BJYWnooPoC({3}Z^ctJy7ITy-nu-fSGa5~6ag9+#J za<;?mNC+x+#Z$pJGk^0c{Pts|kBZ@S1r6%SyS{_E_12x{;jj(1BeyPL_0Sq1lTKR4 z0k&0u7_EWEAQg(n43-)! z9&jdg{C~JR^Y|#M>;ESt!Jx#62pUD(Sfd8l;F^eNf&nKmfuN{CvBiyIs}>=HD2u^K z(CIKX)}^-E)>><=wXODR(TcS!mbEI2RghM3f5veEHv+Wg_x_yw%#sDv_P-ym7f+sf zp6A|s?m6e4bMCq4o?91tqFJ~2D^8LKoUFwp$IVz!uQFKArzNfFet3*zhI@%)!bXOD z4+`uMEV*a|CjsyO3B~LFQ@3qn-Qw*8>bzDG%3THBi>xM$KP?29eKq8BTmn8&-g5_m z2yy|no+)+fvk&XkoVc;FiO{vPf&YTil-i zL00!$Z}r>bOGP|vu)p)mHrro6B}wduciGR>Y4QGQ8bY4dI0BbMK(BaHf3cIjU&%+s zPWaQHls_FBMh6$CNpNB`s z@Zr@>*AZ7Ysv+hN@IIz01(KzyJAAw4JaG2UkW_PWkGmK|{JVNjrKhJW{UprXg7|8QSrC@p^^7Thsipko6T4?2iB3K$@%9 zRQI)Nye|i+SMj2C#wr-*4_dVZ<3es2M^8abUgMw#MQ19e^&TiXrGAv9e4ylTS2dFnOsOU8YgyAh-(4TN9 zZ;bZ!#*1!F_2iY`2|?DAHp8-WfYXy-*{Vp^VyJuLdeTxBv>F^>py@|vQ29sNe;Y5d z1P)r%nXAg%!erT=@4iRe3Yf%^n0sEW-+*fJQKgq^Akl{pK+&HyI3q)=RFBpwe_YIO zFUjJGwxKSctDpMEVnyOFgztD;ex#+s9?T2bqvz;223{5>qMv3tdCk5Z=-b!DGN~=b z=U0*ik!OmrjITcr%XmY^V(om_sXRuLtzqz210^Es*gN$L%LnEyrW-yCjV=qNE%TX) zFOgJ=Ds-c=SU=r4x{4AjYcLGZuaaP#DYV!3M)_bgm1mGuYg*mF_(-`&SoSQ&Ke9~g zpXJ=V(uPHl8)ljy=LR)bs%)vMs_=d>b!$gk@=#VpB@nCiO;F!7=o{DEB=Vp06+Lal z+T?>mZ`8RdJZHr(o&l-+{?P)b!Bb%=6x}TH$)AOZSZl*VRhHKXp@@q>6X zV|689fj*VniD?Fg27^`RZy6xKXUnW-#6GGlGIYm7DfUrg-osa?*hfG0ulZCv(e~DM z?g1$WP}OK5AXL&Z4ovd_87DxHCYpIUK=j046e_V%X@F2RShZo+O2MGoB15Me3>>I6 z*EM2V$g43>I9U(Lv)tYYoD}0{F}Ov4cpnk?p7>o?AC~4%+T!o#Pj6#<8lLCAXA%sB zS#ABf#|=T!)oVkC-v#s^M!x}bEaW*IfX zxHBZhL6w77I?rqL^O`5rsu##3`bEdAOf&4&dLkPOwTMj5JUnv)PHV@y2X zj5S{c&3BtPSU=|UpJ1G$2?VCMPPT^f9es^0(mG^24XMLaT2nHALRVs_uF8D#=mzS* z_;2A4tt!8b?Jt4FXQ&U1p)KC!za?A*fcW7fk{`UD???hR%>s%sv2;2FN~8|vz1tZogN4 zSA{$PTgn*SVjWzhl?Zi(@i-$nM^HtIb2Ma8hUsq^d!$q ze-*;m(WsO_apO>iXsN1%O$Dv~>2oPXbxw5k4!nxarAwx6B0~>(!1OCnIKt`t*c1u> zsM-R~zj%cN-U-3wH>O)iu^do*QR~E?T$$ZG9MCAJn+?)V!q9){%fm+BN^vX&_9T`U z8QwKM5QPFqozze7TvkOzaziXC*ddnj?LvlPMJH|%GZvi0pF|GwPP|wsxlrs~H^$dE zK{P{g;@wUg224Ni=j$E>H~H;<3@4jvwmQ61Q^k|(JF9m4rSgG!Va$Pye!lr$Ku(mYUov3$$V??qCtQTpL>67Gbco%lpYBU12$a;Us+HhH?30zy)>BU&|!qJA1lG$ieok=(+ucA^=iw z+Pu5@;fxjH1NoZxBL8y}I`N{7uSy>IpP!%koQ6terC`2v;(9&tS)Rz1MSf43T#%Ln zRGj};km(x(SKQ|tB-UMTAnQMhnao%K#F4UUo^4b8D3r3PuId`5uK1xxobvxX#iVoJ zTS4EQ^K=n+Of*iRQ}>wDz^K{~iWl`l2P@h`Nh&XQ&v?@xB=&>p5z2ts`$Vfo*0ZXH}T${yVdu<$(Q#!-$?FS z@z`Ab@oMi!K~m*rd*@e;d~?6qn|ZTfaCL^_s8)O|r}Ce}DG^UMQ%Vk_89`o6Obaa9 z=80J*gF7rb*EdY2?_h3)rD5XVfzg#2t6{Ul)K7SCq9Zdr(I9qibO;8zMFy?!jKxl# zfV7j<)6a~sm;K~TmMsm& zpI!Dq_I@|`z24tl@hIfOP|X^|M6^hYc+EI0UT{hS^XnfL*!=paA0xt`Is_j%F*0Qz-zg5a=aRN99blW_Syk(x^Z=k;}#OxrFmy4M29_ z4r71u&WYA(-~SBtRGOhtp_LUP#!O@@nLB%&tCmi^9B(h!>Q_H#acB@5*;n~4(+^PO5LvECKEy~Fgx;7w{IKJ=J7=tgwe;6+wy zsaJ3ryh7-4{NROGTN3pXb*}xGzcHgWCiR{fkrL@Ux{7qi82;7q$F#gOe?ZN9d_&e> zNkBF`dmDAbY2kxNKELh;;v82=zb5uEK6=WJqH{$#OR*$`J;LVIy6EaqV9d)3lMIfE z_b;jAsQ5~$RlLw^P~7a{4VjPr|DIuycr=mqQoihc<9pk5fpfslf=`KD%tM&dHa3rn z=d;Irqj#5uIEZECbv8Pm2MsLb@;r#;Ph=FE7#y@iK}0V8GkD03)Q(Dd_c039Ph!F9 z25rawy&E=d3-2NS`Q+pP9e3`1@J+$T@A~MW+PN2sPJ-{YSSO$?W{3-048^EsWoXc1 z<_9b199mbkGH_!b)Mqd^SREYnd|kBNj{vVbWJTSem7!eXig467l-Cbh!^%|PmIA}- zEO9IHSgHnY4OWC=jivQfi|YepR_Iyvn0Wp^iaCWFj<>4!J!axqS4WYV@nW`%CJXoa{NCQ%olQPIrh zhQQ4~27$t#tVP^(bJ%}!k$~a1?V6tn{?02k{AD9AiSbEb_%@qguy7J+c}g^m1p#A9 zWw7eGz)er^0A?%&Wfj3eTXkH`Adai~{EW~cudt&UeAfj+mS38*culp!6?|h$Jw#Nh z=an>T__P)M4rt~RJkjXvpu(a(e1UJWkpI3sw-^MFuUmkTMXD}%YO zijY-E*3)HiFR!koLiS%&*kppON*3-o1&3W762+_K(q=<7Z5bn!v`1%8+pM732LQmv zset_5#cv%7Z~5{akQSju@{fG^!4|}3YKK^*`FFC)p8O_|E^)v?{rc!i)ZwXAc4w!wM9=#I27d2wX?pxzFkd3ovL*Mq>36yJXB zHvzoVy`N<7nenI%rminvdzxl4mDcazptZq4>$QzD#b`T%@%;UKj7qG=K%c0IBr`O7 zpE0hyt-8FY%R5}qE1NMv!N`y2VHv#eK9+$~4Zl$gK0?;w0}~5(s~-ILKt-1O`~~_O z%3*wDQLqyI%hXbCwT?uQ5y?%g+q|+|IiURDeD)(N_Mi`&13D5ff<$ppgE%fIkS3#u ztF>qGdySwC&j%~xM4oEa2~v2=$B8>B_Gff8Wf2yypb6s#?{i-P{)<^S{p@>=MbW2d zovF+dDVaQ3Z8WNlDeCcLM06@xbLn3sAc@}%fQ=|g7|=4lYrioRA4XD(&G{pv6MD1K zu>T!0Sc*r-`u6tTYxK>5QH3L;`SJ=<8e*Z^w=hVM`c@gk;v+Rnw`S>#2rWjjP-;6} z>eLAUt_F9RndeK=dlN%)o=0B_0Z`;nCvV&7KE*6UMJN3&|Lg{ww*C|i1R0&? zzIQL=xVfe55&gNR>`@~QSs&~#K34sW7d*|Hq)d$M-X}#ugTJsFpI}E8nEoDD zJhHR!23%`y#pY=&2Yu+AhumCWste6&ABN?+oy?~GIrGOxPZg2-7sLB06lD1w6@6Y*!(;Oddaf=;h3f;jy@g7D1 zWuGw{25~nd6tA=00w|$X$}yx355fm0Y3zkYx~!~WOswx-nyNO_Xl-D@!-l@$E$>@= z>Xf!nv@b`oTvk@d45v89+c;uN$MC@U9hZe-Cmu$a2Hu}pWhEVfI~Iw`j29c{0tIC< zQ2`7BMV5!^H+7f-LAFIhxqCvc+$8E*PM*c1epD7RJfPqw7@Ys z+BZkRvF0W=eA9$#oG9Rh@5Cwuodb>xt~afO;DH5XEa5MKz5XgL-{IF{u=)l8^OJ?Y zV#|*o?rY9Tmx4o`n<7yZFZlD>(4}ebtsTvkIZZh8GcaT|Z+%XT5De@ep@ge|j>)hU zXEb_`?7OvNSq|v#8E<&OvhbG2zGTU-fqQ{EKVn=W1Z$3n@W{|h+CZJ+BT|@3Vv^?< zdq)vTlzNmt90dfA@f_nc9#&rp=J1|mbB|AFM_Z&R6nM#qlE)z!C` zw}F+X`lxOABm=Jo$X(!s85hUge7A(GLF|}JT;uF0+c3Bc_krZwMN65VvHa+yThW+OYwSbLrm|A+F~ah-?FGN6-a;h0theZi(!_#JKHY2q>*hx~vLro! zMl>~;UNQb3_!s$K33A?-Z_G%IZs=GWcyjaC&3*~o_%?l^$kDhW&e*s=8STR zf&?UN$>qCI`i_b#o%EsM+1>|N-W%qrqy=)*?>+0ok;OIo+gPPuXLT}ru$KcuZpjj;E4poCX=kLJo_n~Ia{blTY~Trz2H<*~=MDc*m; zwHt5&#ZH>RpJcvvC~A)TNT)j1HLVsIbM+eT%Mah&HO~pq}0K93Y;#CODI{~ zw6zZhO(br5U4wd*ien(GnaA2`W4qN=DM1#&=#&!h7%yrSo}$aKV&*=h&d5|Q8u6o) za6bG<8f{%PdjybF{Fu0989v^YuyghIkrCOz`LzR43q>QLqwxG1X=9kuKg{U->tus>F?{duF4LBKO@Y3{kWD)d}O{dI28Vyye1GhA3q&W-H|ICcy3bc;XDuLRU zL`QtF1Kz&_KT4n$W2{LwpbHU6xo}hD%68yRv4}~AmiLQuu|~lU_M^fTKGFtdhGy%x zKyjO(sWAPysi{bUxv{zOxWMg8l5B3{$KZAT`b`TCtH+H51%sbsnex5OaEX|;Z*!%} z2U;R}8!xzRHOSxlqprxm`};yZa?&B1WC$ZicjhxCLm1Hd599E8`UBo0LoZdirat6X z;B&3d!FdKV98=h8#4td!P+rjXEC9w{aRal_zV1wwc)|OtfO7KIu26m&?F!}n^*uoO z;R^=k7X2|O|Dtl796X(`eIRXkOls-IE*a60u!ws}5)&OSLzk4a=>FIIuX{;$du!)> z(!uomA&Mux)R#`aD@lSc--)<*;$BFC%;Qd@CdUHN**nSaN;F+mMSp zPYqa9vDl>&0oi*tk}-bpBfS6fsrokhym$6ZjNVv5a+YMLc@2M}+K9Zawm(k>`Qsg} zui^(^KG|y4{AyFvIEp={V)29Pd2R}T8cn}=JLm00RcnX!!E4SH*2w;YpYYE^1t|8x z&Z|G`@LtruRm_@r!QUUj+*n`m*iU?W+ALyJ~-;-+yMgi<;QohRnw~ zXUO0NhH#!2B9X90R&=bBNW)h#^uAkrOyc5Q#f&zhBreeB?pxA6-7OV<|C7-a`~KZp zrd1?_wyakxqHMB?_+J=(4));#F5mZE>b-G2j25x|73rZRuz^rssFqY)Hpm1pweuqR z`*hQG18Ea?QB~)snP1la*%|&QR(>QiYRXNl;?jehT2R28`Ph5*424O^0bm}_I=Dm* zs;ZI2f!i0$F2R~`3m<8qy^Y6pVvBgDaqg`BZ)V!}`LmV;jU))D#-wT}3F9V^Gb@W* z|8|0L%fYUBi`q-G?Z^`E0bci*#;LwDEOTA^|4sg;rKj&=6j=OzW)yru{wC{xvHI_6 z1=^dB5e19L-vhva+x>e?1m;JbfY`fdAjV_?F)9m)@F46gu_b<3IX{JkvmFS#!ou+e zg6(;S@zGmJvaA*TZo0HJ?0KSr!((EDjXkBpxhZCgC?c~F0XCpnAKOI78-5hiO~pqg z?%vhPuoF`npMiOg;js2)R5cxVXH;I!Lbj5yE8W|u_|}Bn0RPTH%!dv8HB1V5KhVh;ead< zep;8o#G7}gFmaXxVON+qqB{tm*7S&l1+QhW@JIh%Sh&-_7Zwi80^w&rPhsJioZVvK z{@LBIFtuk8&dCB{Ocn?yWP$LbUsGZ z_d>%T{ClBc-z*q@@iQL{=!bh4+H5OGD%Kzt_)h)G#MjLZV!mb0=D zfnUK5j7kT>t`Jeu9fY^f=#d@Xc{PKFH~f3yVYz=VJnWSP!Y?JLOg#MQ^W9?Mj+x!C zaB0sVv}A$MoCU&VSs>gzB7=o@?@D3ecn89+u+T3X1VZg49+2~7#uER2C4-7~ z|6Zv0r++V0hz1;TY%Aj}?~L4_yxlS#@W z90>$>b$1Gc= z)aGv_ql5;{|90*c5i@6WLquKAK&<*_h9j5x_d>)&{=H~%brujwJZFv_N*oBgLPYzu z-9T7oNsYSU;jAnW&ddVgh%6A2!!mgItwfZu!yP+zi-mA^5YFrwgf};3u&~*`7Z#rJ z?}dfQSs;9HdkPEv90Dws zzFSm$CmRkowW{nHgzYb9Q1PjMFH~&w?}dtsvOsw6wiGJ%a3Jgo74L+zP~kxMlVwHf zhK1=_AWY2y;k+ymUarny;r9|zhJ}{)-D2Ug?jRiBGYI=;fe^?7;bYcnTy#vl;QTBQ zKKx+{3%L%2U18z1Ca};&KK$NRJ-VUc2Yy?UQ8E8sl=xm24C~Lxpy5%;C|^Fz+_qap zTqr0yPjUzK48)OHKpdV0#GY9|jLrh$0?n)nWmva=W+3be5gVp;1L1*FdQ=y`);f(p z+5e?~FFf4j--{zxpPs?PmH5w`hzdIpc4bAK+Z}{Mdj_F43xw({5X!PZ2xfs$At`Ab z`O&Al#lpI&Sy;%D4|kv3BPyPHDT9h9{ClC|9{*mbSTr<)ir+{+Sm@Gs92~ns#Ylsr z>pb__Z~ODykb$%NdG5XX*yg$Drwb2a+u+GtcjbfE`rRV8e%G1`Qk(nU6Plc|ez!t@ zQ@c#t=+ZH#5ItPDk+}gLxds9qN}X59g`g5hk`+m|%q{*D$f?udcGi+sq=UeRUPS#( z8zoMf$U=@=6N-LJWZT|XP<WG>k}h~KFrUERYl^v<#-;e0 z65W;98lGZmgahvm1`j>1rMhbQ$>>iVE(L`W#0i(AL?*zdgs_vz5bVMNsNHo{QPuv=ePX`e@zNcD_RkK3G!{27#9JuCyhu2=&+F^yQI(0)e2yP+f zc=~iQf2RsD(}kF+LdfhXU|nc8<) zY}T^;VbRdC{NxL|FVuZua)lLFJl9levSm`%M&>>vj>GTyEbQIp7C7!ZKm(7}galD% zyYycxzN#c0Up2pfdI@?Wj2T$4ud>NTcJvF}bP=z_(k|E8J!La^kN@ePi+ksEl&w_+ zSak7Vt#GQKR?*3=q-?(aZW8fLC2v4MXBOAP-b4r2lSp3Yj1o{&M|3gy2T6bF;HbEW4a$a{uMnT@a=Ui=p)m}KNq000245;|YW8(SIk?|9kAtMWy_om96U2%Okgeu~( z8$$K4J3@h9IGx-xP7k>xpZ$kB-|ULi;CF;n_TMP}+8fA9P-ncVtuKq$e_x@xPRtSw zzr7erzP+I{QdQ;ufYe8ddO#}l{_;q@t0$!DVRxkNhD)EHNZ%fMqbowUO-^&^vqyKu zrW*OO*!;a!l#R`c)Z$$)b;hQu{2#D+QQsc0sQ{xd&7$3cgG;c*^sr}a?t(w(eoOp$ z;p<(|`QW#+`Ew>KDV_OK4SiXRPO!SNF}fG6dLv%!j8RqjKVY;shIh9?uc^_O#%K@# zx(#|g>=~oGkfO(ZlfLcwT33XgKPkxu9xri3qU+9cYRrx<) z^Z)QccEe`zSHWg!PuSGMp0T+L{(NnM_;Vq#GV08|0N^GJg_mdZ=ce+m7*#`G7NbvH zrn<5*`dwP}9$4QQqpI?Mz~}^cu^UE9cZX5Vo-G|3Fm@-%ATu5ifztR=M4_qp&pc#)R|IZO!@vEj3 zB)G`woLt3H0QiQkW->O#vzd%d@idbu492c0jJ~7|sPmrdtpg%Xq(-v8Kkn#YYIqq_!->^5&ni1p(WuVa zA!h0^H_?bqZ&ZgeJZ;u4DfPm5DD{VbcBRz6 zFHVb=b?kk}64YrR9aMn@Kpu*_#_OU!)tG)=rU}~&W`+|*sxk4tck}=6_3=99mOr!F zLjuYtRXt#k$&oN|@5VJYy`+2!9ezDRiV)GMNrk+tj^Tk~rAr*l-zmzVcnz20DJ8li zK0cRO7N*=f4x$Lm+qVEB6Jjdf4p!(sN(WVvb^vyM*x%>omRZ}2cU35yRnr)^9 zCG=)f#a_%_HnH6afOBf&`6q+#M1Xsr!U|?iQTQ&rC*m{lYvA#-drjK5q%^07{Ug!O zqt8b-y6p&}xOcS-p|oM|c;%t2nnqKTc*WSwj z^Wot4H+JRVQ@@qw;Nn9&aWJAzEg;HMqBk|K$V`p@{Y{n5p5y)YJeqm?StN;HK2`XC zni>~>5$2M!kq@}bg8O1md+HpWtlaigiRi03NrB`E&S}7&yTJVG@j2E;7s0VR zYY9V5@u_w=O{t?I9hH@;YeS7Tey?>~rf(LI)DT~)8@ygqLb1Nj+4?G5E5iMiyLH+J zV!g*q@<9}P2kBl@HU+lo3JGR%xLYB{N(exFVuZu zaw&VYYRhWK9TR9BKT!2(c9;i6r!Rzoey%b%+-jG!5wbAwX(oS@;?d7#eW;oN2 ztB-NK_(6Bmzt^pQ<2KSiF3GiL#l~%*k$X*I_nFQWb9cGDjQaF$o9m) z@GnNUXwa;zWk*?xY}S8o;5WeKeq3;_1|qhh_rV5s{N(*HwV_u&=wfeuzVFV|B64w} zHtBqt^1p9z{`V2|+k(v491236{?bPAB3{6UftHUYeesYz!t3gro661t=Myx%K=ZiT znp@&{&N{@Ku9lP~=d>~|v&y7g*zG0eLmfhH)*w8bq0( zfl(LzhmLvDCP>#CRX7pEG}cEi!pJ!2Zk#i(ID4?l8W=4Hwl={e$%TRgI~0A*$Nvgv z6bdJ5GF_7#*^_q#07k`$WhktZxgp&ochhBPkhe*F3(bDLK=<4Y9=(h9&gm|reS4(P+ z)K}iEUxyRtb8!xIaUI;yAKoYtvm7M0C>4XChX}6|zZ^~et6n}|iY-B4e^6E;=nfL$ zN=3Lb5ssXr?94klF{-mOUgY%8@BSyf@cCDEgBVrt*WT<>Lej8h83CT!EWTt*DS`uL ztm6N5;>zn_N*MA2{$B!9K2sk%5-Lnkz^hchpY}KI|F3Z+64JorVn)nNOZRb z$fUL;8%WngKTeIuxzC7nEac@6^zDzGjKAHo&XfQ70@m5M3)V3nvi%bcer$HRq^WIQ zsgwoMfCwz}enN4vW@YqwJ30hh>eWU_REGUCMB4@)(X-(~y>n84#cketro_>gAPZUPCtH0x^~buUG_ zy9>T&t&A2};{HPb#P=1PwtQDo4|JI<+?=vPgZbh;8FzJ}sLZIYP94xhhG&tnP9wv}kTZeCAd0uqj zj*h_NE)R0#HPQh%=VMi`@Ym9?lQ;{OYY>Fh))98=lVv;WsgkGogw{|GJif)e7n6RI zn-j*(v^}?JAKU-L`61zBV<%Ki%MbTK6RlX*yD&MN_w1mK3?Y80-`tt`9Ua9vskeQS zNANa3dDh>ftiCt%b$9bD5?qQ(X_#Eqx&qhw2*M>6ELKTxLix`UmTgJ2h zH`>1}NR&w-^vM~#h@Fz3{+dKT`|&FjFF5x?9rDhcm;BL{w(%~NYuwFmw)-F@Z%+@p ztQ#B2S?8f=y|P<_Z=?@jad0lV_i(=5P^NOF!a=z=o+lC@rRsFK_kD8`DK$JiJe#a& zz`Lv#i+`U7I$Qj&wPzzMc}Lf#)9nZ5DFL$&1L;I(%pgnEYiczzV=~!d3A33j)HDy- zCp;FX6sbVAcZBn~!@zG)QWXRR93n0(crDTa~rv7@2h9j zxcylehuS2@AHqRqcvtL`B|*p-NQj6^SCEyd*m#MtFdjKeW_6ngdL}xC3a}e=q!iD= z?4cw`1G87231%O^pAJ9}nC&1UN7i`Dn30JjF6+8AYz@GQKs$?kKWjv+2K3WC-k*>A zq{DlRi&I0!*k0|nY~m!sRJa@ZT$K{tk@rl!1Pv47zm}EZVX`nW6s3VNCqa%DMckF~+7bY22 zLobpL2mY`oC_j>=8d#n9ff@?@fd|(FgM&T_k`~c_mAtljM;^su=Ts!Gj87$jZ%%dd z=egGo@|~tXav-|Ky~QFDEo8c$Jf(R@VCrG^_4LV9^S*uiyxF_UVDp9Zjct84}aijf1N$qHke>)Khon5GnMr_{%*F%~}0tqY84C(Br3 zyztzmYT;k`yBvI9qV}g%Q^0CM92%$MEiCcw{3M%O<(Mc*Tw>DJ?N3_|;(hs1fedT( z5SO#gMSM)rkzI_OYSk6=_P$L+_nkV1ZkUagWW8_$7acWqiuVXPrqU|}!=|JLZh30p zmN0NH0;d)Jz;*IhG#{!4ZSe9A8ckxeDTDW~XE1no-0KD};?oV@I^#&mQ{_um<_(Zb zBg*!YHF$%`pP2AAEO@tnoQ;7*0d-`_Pn{8ymY;OD)A+<1ZRRWMD9IuUPxWmEiO;J*|Mgm$EPhsu23DR&H4 zwRP5$22H%+m;F*~>}^<_V&N!FuSv0dCl0v%qwM}02iW{1v2$0F%ZW3`AOFb6FE|0i zL`ZD}l8M1Q!n&dj6HO}R2U_2hctPl}$?EAbN^qS-AdmCC}i zReyeXYHYu%^YX*rj?F2on$wp&1M8AkAl{GYx5H!>5RR>2T=xphD^%sNvE{L|3rVs= zc&v3|H3cdu@Yz180+H(~SQGh&Nx`w@RlP|0k@}WnXxDKJ?K+O3UB~9|buH_f_Iy&n zCZb%LhtT^u0^NE(4TdO>9Uq^QTXlWD0rqWi0uhe&4(Z4EJ z=udtvh5LoDZ3pb@$SfR+hUo+d9ZSd@sI;)tM&T1i#HPF~pYFw^p<$7D5YGrR<&wzI zdxy(zE+&0qp%?Dsiw{IoYOXM2+oD(xcYudfx_Pw3o%1PHeX!=ZI zQpsH02Hj`KIA-!?AvfLvT^`ltVO@T$%Y9thvLwXR53@%|f((w55RU)LGyE^EFHRrN z(PrE=e+MX4&+7$TeXMrPmYU|Oyztj*nk)0dEIvLywpUH$^;~Wmxp^aZ((tPFO`H$| zu)Z-mnE^Fr67nB66$>?*D=^a7gIphL;D2L9UF^Dw`gqxp`q*SVuGf{YSylVAz%^2gO=Kq4Tcx^B+E~Zs{{nNn%I7#Zgs9YP{$_$Vs zIy$GE0#jPo%_4J#0*{y1xFNp0MvcHdU z%9OcykMk(;VAedx@z){nkFS5InS@}JuVhq}(v6i(*C4n6b;>ZI=rkD# z#bS*Trb4COklsSpz82F?{+?gRBedE(>`_gKm01i7fDpc>{YpksDIUX21hRfzSD{O_ zE)BX&OqPMKUs99oj|+dJnw0Uiqo&c-Va83xvfMlbw1}cV+m__!G=Ujfi*E4dnat5W z@vG|2`0DOt9}C&}-=3BO_~N|?S09Q;4PBJ%EbekR%4iN5&GGxVM6=-XB;Tnz0(-wRpy$F$DqgVikEBGn{{gy19?fr< zgekggO#$PgP>jp~Q;L#roB_5|^Uua)k+;qkGH_|>Gz~P4C93+@klvJAZX=w0J!#m< z&)3O4_ZU2<-m>0FkvOO1;Pk{aEK3rpUU&_*Smu7^V0#r<^GcUBw6f@HW=KJ zdo~#7bp|68n^;IT(|@+tG@n-1JT)7NAz4r?dK4(`{*^<755>K&b%o-9Zcwbql?d++ z#hO#QAcK7>@WB*u># z88?5Z#=tbGBhza(NWAj_$WI^%a{K&Le!rww^ROEO2!Gm_ir7y)I7M**!lzDxZC2BG z7YzhHt5&cA>q7#MT&(CrHH5mV3`Om*)!9T4?K4};NV7|Ik#BHzwJvxH_nAGB^O(r* zc@Ngiu>0M>nJmHh-?gq4Bl+F zbLDBm&ru+&khRuQjo%!T5B1TRh4s-((NAnW@)2O&tc#w@i_1&v$RP^f5TyS?V4iBm zjv?9MK&x>7(Xq>3Zm*BN>b=K8Onvkys-o0Rqr>Rvl`ppo;l=MO#DwUL=I#3gTK^B= zq*!Li1e#5_xgSv?b9=tBIh*8PsF|I&AMGiILZ=tWZ7Fh?QbMvQ9d^~~sWZhz8asRb z0j_=PKF76ey1_sw+VK6ZTzlz|u4AX4Eg^O1+5;;)b1lNUT4rU5+#|?*hP8Jm`(&P?qp%&j#!=Uv}ddq2fRzCGH6fHNSOO{5ZT)8lw z%sTMZknpmykvjRfjBfh!v7)(hpD;^*!3H-!K>wdW>|iWNirv+-O0fs#p#7218!)d2 zuM2M5io;g!4208)m_(-xCC#T(Z>2!71x8U`sFwSL0a;F>Nz$Q!5XHLk=v+2Cv#`?bOTJg?8$TNdj)nj9*0)1cX9b!8Z^pnbq6aBhqhV1#}Y4C^Ne^eOr zZ-1U4{{F-n_CZhp@C{VH8mA+NN`i^KK8hoFA|_$WahFwEG_W)N<)JeFv;Cy7sQp=sHQ@Lu=VQv4&D_>0a@vA@ierg?bmEBihuV`>QhXDS|Grhd(oX*E-()l8XIGbfT9IbIM{6?ykM@e!2x zaClvo*UOu)2t40swejhGf)Rhxq5~gkKOuC0_RwMM&TKm5{m9?nBQ5LdwGXYxmnOwu?t~OGe&$FqF`E>* zUM>-JkfOmx(9?DVB&66&js!=FiH3j0t=U&z14o7Xq&Uoi^hJu9X;L_b?{anYxiv$d z>gGxu3D^7hZwN*fm3!w;6b^0Td_e`X4`yDMo-7ox3NozRt7KILzng!A4Xzi`<5oo~ zbHXRio#EDYj)M8FuZRpi#!BJ+pw#Oud{8R5d{{XY$XV7)zVm828`+s3K1;=iMP{)2 zb6R8ut3M~to#9r0j`6E{{UiWj|D3Drj;@sz_>~RX$YR4~fm?n<6Qtd*7I4>cxXea7 zJ`4Z)38FHcs+CY(MAB=a_f;ma!@ku^_UXV!1m+??4LqF1fRprvJLFQep}P1rw#9KU z$|CP7w4pGC^lg%#q0?;jIDs6-Z%KB>Bq<0-Am6;5w#vd28{!-i8yyV>4H2|b=w0}# zKYvS%?TM0E@dxu#M(*7A%=}92T9;su}Hrg_17@0eeTl~b#!nf1ZR>4i{o zqHDESMv>|YMXM#KGP{rU>w1Z;>m|0Xm)N>~VsZ#=+)5i>=x#OO$7@S+r57PxZw_@GlKBV+Ky3Z$Cf5=V2T`O{}NToqBbLzD^9`1sY6zp_0DmrPmjO z9m_dsBXG+o8-#Lu#PTsxaQoDdZMWqybtpCx`|j*w0#ZX9Btm@Qv?+FQ&ibtFh?5A< z_7?w6l%*}_j@l;$&9Fl6?a#7DRAH)<>CVZ&A+63_;bo58N%b^^VWK3Ybgq^AwMXmmLs_eFs<43^EWAO^2Ju zH#87!^7YI}yLm!3P=4G_XFhp&8`YSJq0aztMkhB99;M4v{7MyHRX>QsDqfT2wfJ@P z;&$}ns=D}u0oYmvBdIPFC8qNgH@}cAYEgp3{ut$EGO*?V**+SYu+J!wuLG>^38=NsLLa{*hq!={o z>=~!OcG^?plGOQO?^KAeY|fa<{C^=!E15-)LgZU+7&Yc^KEV^EHEa5OxQxds^prlo zvx6kP_x;X!?I&hF)(0_prCO~8+*cRS(-Eb%eq-{8!F+h47Vo@t1vRW;U6~fL+I11?-h4jw6<(i+_Pj>VUXEh;m(bI?luApAG~h(;7!8^zd3yH`@;u! zB=KZ!kWCQXPA63LMN8{gM59J+Hbb)4M^|ugml(u7STj8Ot{-rx2ZmfZ048gzYAH|r z{M?$F&p&7n)xmI;&tWqJ4cwxf-J*YB-U0M!WbDKx&8PPZ?;VWHDb8s^MNEfjPi{Uv zuc?fE9^{kv_cGXBIn}#oT6yO5)3eNd8hCsJyKb&7$Nh-mIK48mIak2A+3&;dKxXQ( z)oR#LKx+Eg;G$TCxkBYi@o}Omw@E-lSj%C7{o11COf>(V1Dt^P-k91h4Pqb!6!8j?u_r zwmD&ay9pTlds`(Hv970a2nCWdaTdUaqW3#3g;QZ7B>{e1*$DYN(T^O6y#nY#H6!Ih z)fi}r^FTzBb`fR_c==DgfmZ)fzMgz`zD3M=1@|~TnGIg5OOh2Lj>e_x(*T*0?&oG& zqMv}H>GkAL%!f4Q8V%ue5X7PAWNFgV`9G&v7yX(ey*j5_7wOeG6VY#qNj?RrypL{k zn$O&HzwL0cjA z+ccHK7XG*`($Tt*%lvjpVBV)iz{ZF(v(0DhVC*2XU{V|+qsBXy-T$nAA1Pp2?noW( z;)X(EDyqEe!(i;hRo;(2Nb871y?x{)B>FvA^?cyQDQcf~Hw#Bqs{%J&zylp3IA{$A zPSr_SFXuo(r>r%J#k4_F0zVlLic`Z3`^IJ|-sDe#gYIlGl;7@;!3#8Y*bOk3r)>XZ z?0jAQXbMS46;qeY%Le|kAXnBA7|2;v)()_#-eq|>m_}jPVW6XIrX7z;SeThB-1#A5Y3nZ?r?puhTsh4g ze2^nUj~nDO+5N_a$>Z6Hf}KU2cq2UZiZ_KmYdniZ{R1HDIHX1{H8gH1=0$mZw6reD z3g_}Oi(Tu$6g{(0(qS@5dZbXNpmL^?uD!*CNRm}W37dk*5r z(3{IemVTpSp+)WNuX#_rLqMSpB%83PJtYpDtVPP!%Nb-QsOz|swI;7L-X65htgqL> zJGYz0kmD0i)KjJ_5_fQ-m3fGE4E`*wo8@33P>LmSCkij?hBU?pqHm zkf4k&PAlsb&f^nKgw&_+Coh+bsj#Y75VP-%Z540M_hqv-kRYf9pyql^M0|Ka_Znky zA1;4frKPoMtZ||GLKw$>1zHrc1fYWeE-$=S9jok2*|uZ$43BDo z)LMKb`a6GdsOtG?7icIuL5u#DRh8nrtKNh2Rw$x|i4O<_aS|o^HjN-P#Nkifb$BT+ zB1030i9ONb<5n}R`Iq-3*@$dfBLh4+I$FEBJ#hpu*GK=Byt=D!e)dJT*QyzW+jz-X z2&&zOsz5!P)Ff4I_DlLRw3i+8G%;XmNd&7r0}wcPyzfIR95YaPnL4 zHKNpbVvH}pvmcuLe#y(o?<4gQX4*}6V^mIRtE>7na8rz1tnkpF4?}}Ka7RYgEq*I6 zxOm4Ib%*?eVsUw1eI(K0!~IY?}#9q zPcq}7Yqj@SNNk$GUrsh3j%g89J%+5|QW^+fxr{%L`hm+4v%%$b?SpxdLpJsse<+I?9 z4E4St(xl|`LXsMFmd}}i<=clga&^QUN4Inm)Z#i$Ipmze`sizkD9Zv!Vx3=wAeIPT zqDf17MiZ)97x=+ooJ_MT0ugOq55@YfMYtSL)4Ve;yoX7xrd7k)`x{w}T-jOB^p{C( zHOzMrUX5Qn_r0O*faO2Tw456*tOhCBi{PROZ@d98;YC5pAT?+VntfKgH z0bVd2SlXVr&s;rESsK0i=<2%YC&>dt@$V8im$K5`yHNDG`Y1b3*3J%DSG4XFiXFYR zre!!zl(m7#8XlM^MjosTEErN-*>P=ATR2b`n@wcq%!)Y$h|1*sTZA?jb5{g=lB&zhQ3-VMmSOD-I*qgowjv!tp97C$HIrLp*fcXOLG`5z77Ryr!_g& z6O4_H9{pM<+IMRbAJ18(!RU3Rq4)(%8&@DOB$tHMZatN;k*UyCR9Ce=5V!MdnFP-m z8Owi-ZpuG0JZ`NZ+UeO)1s(!?zf;@Bi3wqg55<{9O7q@m~M*&^Zz4Gt=m$?ZNoe zT=Q=&z^B9T)yDB;9#aH4MB=|xWAVCNvw&?|lAD$Cc zHLXG2Sfnz@5nmqQZO)Ph1L%%7@ECS-&6TcjCud0pjdT zG26ZRfL`ClUo*i)(#=+dEq$fT9eKE`UY~u2I87~ts+Pbviv88q8|*`_UVsOpCo?x zp2lMq(1|Trq264^F#c6tdvYjxHOn;Ca@=G=n zF6``Qwk`x(*9dF2|Dfe>x<%_X_|g5GpCI7mE_RmnNzw3^@uQ#j3SX)4c@jJp;@oP&RwNuHh>+p@<~QXW|5*O~j_nsAt01DL}~z3*64gvL%o^o{~d`HIH_ru@a*liw7afg2MBz}S*dd<4h) zu1X&U%wp1M`_gjlW`#>`<)CV>>T=PUz$mImk&R?&Wo4FsaYf+9+o&wW?pJxYQC+rr zrkx(&g^1|Zwb#Egk<(&hOYSotWSRp4)s#rC>-m{+kA5c_L z0!GpIUhf5}Fs0UdzqrG3UW3S5Vcly%h-lTLwZv#D{VMkJ?j$jjEpnXc(^O{?jfI|C zsW!)NKp?pkivd^kAetH%zC;A`!IuYKtHJG_%p_ zhpqaHsS~fc6`x<+p2g8{hbuzwZ?Z<4njl7m988;`uWA8Y|eI@evZj-wp-{4#V;$n*)8tW6K!HlKKH#X z4CqO0Dr1p6)#tOM%c0eLo`cxKtH}+!GDlFA<{VGhPv7~= z??w8JxxB{ywwRR{jQij5Ub8{fnmcLR;$Au7Z-aqN&0yfgSsZ50mRUhDNnxDxZDtE1 z@f|k~fEq50Qcw{_xyMHJ{B{G933Ll)S0#P2m4!J&W*=NuDFar*-1nV}x*GYp|E{JCf;TVTuUvPGT8&in(J_Z}O#sUPw><)7PG9=ORY zs^*<#;V^E~oJlp?7U6t6a3L@|0#h%_l0?3D~GEaZ*JKW_-HsZYyepWcLyiU!0SD%{{c{Xz!STL@P#j`gCe@4i`U=&bJ;&AL2fGQ8P9!{mH=Bsm> zMq2&0bb3bf^|@z+38Gr>U1=jH6&K>~=-2V%7vkgV)Qqxc!@stbwWGRxVKWVR@wKv+ ze3O&yPOyBVQ=A>}{mW@JkDhs~tQm-d@qD6Yfm+oit}{R6&OuFc0$*?8Ep}-0&Z7eJ zjwD~9VYc;RTwUr!>b-DTh(=h*7o2ZQ^T|CI;+tUpXrM^ib}*yf)CqC-mo@XrsCYg? zJ_~aO!>5QS?{5bKT9+Y$Dhjm5L1L;yU!~TcQ!71~5V+|hpi7%C_(yi05oj67Gwv=7 zwDfUz69TQ*(j$6WNDmiRD>@zS5VZpHZ|4qP8_5KVQrpiA-1HlI!(C0&#axFq9gtl= z?^`dSL}D*MUx))T$9v~_QAwzYEd5*~Zrer~LJ^D|hD$S_Ko*t|x}xS~&Kg_@ALMwy z`Y&s^iy8oNY@kJZZ5{lVG=+F{eW3Lz9=S0w;=ioEN&u29H^1upDSa~J5 z?Umr-&(Dawjop%eJW;@}9>^IOjBN7n{Sngvt<=m9*@}&cPi(n?1z(mA0xiGfxxz#u zLx%(;vaZ$y_GTVx0xQ3ZLa5yM-nlM4@kIFl?rO^^;k{)l*H;_PI`RqAMK&p|;(401 zS?y3ywTIYdL$r7%Bawbxr%>|is&!E)IooW8)8J_|=xqx-PwQquW=p?jkL{*KKNdm- z)HO9)vn)3sel4CfoGm$N26P65znb=8QS!JpMUVTdg{ z8pLUw?PMI7{{{Q?s`P?SGeyLrhQeq{Exc5eQ40@~NhwP$NY!jsAw=7wf6K@w6FD{n z2&CYfX1+oGY}aO=RFQ173&U!(3%tzVXO>d?mjLqkEFkyTHIRM37|3y*fNXS=OG27_ zN0yoS1uvP63w#TsvT{?LB;)?UzMxC?%460gc3b&(Y+}RUtuFO`y+%l6PnQhdY5o-M zyi(41FO_a=1`%emoBd8@^4>kDhxjebN@(o}wBo|&f$2zB#QB~#^PM+usgBj->RI-A}p!djXpzaBjJ-dREUJ-1jp~NrQxN{TFddqaR1*Zmtn4fnSqvvsD`Fyg-`P?u_G;<{>zr}sNUVl z_|LSFReN9A{Z@PE{_eP_l$bl3dlj7Kg zGliG)tvaz1VfXO&wwJZE#fH|56>-phPtsoti^A}+@NUN%iNn+(+u$F#DIl2V?v!sn z@Pl4lH94HsCs?&KF#lr&kWeFlg32lZn+O|YsRJO*ZG{)i}EA~lWq%2w-tU6A};v+$bk_#VQaoof5j2bA2PNd(Rkqu9;AK~{pJ@KdG-zrFV z+@JXGt;4jbR6lzd8G&B^d&h&Z8ae@qn3ez6Q(f;chOm?G12vd&0^FsJLidRoHEsUO zO^Y3#n)M#i!%QDFhyJ5Qqg$9*y-@?(cf`=JJ6mL z{rj5qXa!b{)`xnDY4M<@yn#uwzS%v?1h?3d3NAuRe;{Y?IrO!$7?{o>h&LGB2ght- z@)}xuBdi5P@&jGbNj&^yY}W>>x;0puZjk;D+;x+iKTkL5Tqwl3-yoZ6nR`b+&3}FR8AXVQU)j{VdC1JRrhf7{E#(Y1c3G2)Kef@HbOT*XjokI# zaad{9EggZDJnD1)9dieX0L?>=Zo+qqp}3gfrR20A2BlKFr)`xG_9U|*$5pjjN~nBFHQBRE_I2Wmn6QOA(x{M>GD$a!Q^t&1s}iU0-O_Qp4qD*+^2bF-f85+ zQSKWMnKx%o9-menxP2K<2#l8~z)H|WI9*2@NpkwiqAY$A8=b^)+y`3Df_zV6{qdcx z3Tyxue?Fbx-tY4NZ3B3ITyNt+GnTDJ>Bb#q=QrU-CxrdRcl3)^tJT|}0!;?7Qf8aU zQXZAyAr=DAY?bBjt*<9~(UU00vc|zSzU9_uH1dK};HOdL;6;flnW<)Bl5u?#l$gx6 zI3%vs!vstKdBdoN{jpSZIm2<>R0jWXliXMwVC@y%ceXzkQ%JG#|2YS)Id8S9!<-wx zL=?KcOh3(A?dKl2m^pYV_kaNC0#KShy#hCqHymt@#cT3nn#Xztb6*ZTURm=5$Y#&L z%H*MhTt#21A+Q8TARV5Oo=dtw2}84@>y^}K5?+8OE&H906Z`S-DRwV{s5u7YB>41CN8FZ7=aj5?*qn z#`Y;XdMCpwtZ%}{h($}qoQ;N9wLimoY&WsMtx-w8d264msTq@^r&{=f$&nNbc59<8 zS!^td)13U?j!~JQ4cdw=IrY10Rhd#B{~pZw!%H1=enXv!7d6Fw=F}&qnTr1{&fGi2 zipl!K%U1rJ}z zMAoAHJ^mU#@q$OL1`V-GI*rlKN2k$%2+;uTW0m8caU+re`oz;cqhQgtPAE{wR@KJY zb*PrY$PSiZf^4=)_V@l=u&qODBd-V}6HVwuc6_U8P5k;b@P9|2>C58R|25Ka!1Sjh zOMV{NalrHih@b_qrH$Og!`ykFE(W_>xU_W<^4`MxyUX_@G6@Du>%w;>(zvHvmbQwi zCpYh?x^}RQU-<`TeXV&%MfiZgf^%}YnOdy3dpWk^NK;9k6^INa0Yez-lv5r_J3p89 z(B=knKUM>Qz=9LlOjj|rH`l7^EF~=q4kCnT+0>!(?I&56&Oc*JJii%dWZ&aQ#ZSu( z#&1|-CnPPKP4?7|oYy`rnDugSISvQdCE9MmT_kAul(o#Zj8&1jlm41s>Dw0QJq$SS z!M}>txRZUt_CjSl3)q8&bE(#w`~>eU*^eR9n}LH!uM3lpW-9jYoPLZ_iQh&=U;zlq zpWf8Gqab{7V8LF^+w-qIx_NtEQ!#glDI_DBw6SQEaO6~Cb8xECDPmb<{doJihSZ%Tm)}5krjc~ghrTUd7Gyo zBvLghZ=J%92tFu}^}~;7^0%g{IJ|e@@pF1js%q#JXqm_d%X0GF=W0JN?^{+c*&P{2 z*wn$w7(#0b@f2$YZ^HiBguIYIst%_8z3*&e_%-cAI7m76(L!_hDr}BOm~xp&!8$?X z`WKkj4y5c1EsvdAqk6sXcdzhHtI(}0e%IA!`?aVq@q3Dc??CIXbTcF`e4gL!yM=)m zE4qLjq_>1Ul-I=4XQUq5y_w^(n#u3nOmbv)RfOVziD?y7St-x;wz6(Gc;hqSz=8b4 zlbwCu5oNgah9Nb;-w^(IC+jj;m!r8X%junbIT%^YYLA7-%zkznnIxx`$4jy-3sPyXHe_%D?HfJ>GHF#G@B?D3xnby?td{5ukE^!b+# zK_QUFV8Iro+uBi+7npyx@lMmKEzPIT4Ybz!zuE%}POsM9g+16BS&`fHwVG%<+ZK3K zpyMl+CyQ#D+j|FE`|~|NA^$3mC|hC(w_8l|49b)b=P)8N5Av)ay!Y_v+T?yPM+@|m zvlIqzeUUq!*Hmtwb_nqwpBjHL+g;^(7yenuMWz!S6>VDOCHt7ky#-T8mPv&jGP2Yg z$I6p53OyU|Jn}3prlW4AE1xJKH^)wOAt!uA4!afzFdm2e{?;DfPc2od-D(w zth5)T(qq$AI3j zpZScJxT_1#WeZWqe?NsgI?L#MGY2HCFQ7EOBg>^q_tTCe-@cXms8P&FO0HyqNpbH8 zvzaJtY-|{Q%`glv8e8SaY?vmOFpGP;B-_ z^(5?#ffqP?Lkqu{UDqF+wl{!&ERw4Z7S>++TR&3Uh2F>oB8cdrYHKOZ?h|fq029Yhx5*NJWRJVE{?m+#swbL8D!oAn)uL*-_xUICWU}f zB0GpSCVmv5JM~ie4oa!* zrzhOj%U%&f9%H@;Uk9o{@-LU=FlQH6Fyo+;6U zLRho$;|)B_7{;C|${xQ%HB`;NSnf^9*Kv-r{zAZ}W7Cx7Tg}(Tzu$?ndp+7CW&6LI zp{%vl$yKISVH7m1_uU_L>#yAI2y5OZiXc_Cdh_GkH)r}^t^PNv!pQ_IKI;Uwb znE|s3z=Qmqnni6KjIewTbSUEzoYbJ!r&uxJeWKMO17}7sHeip}_h*b0Jo31#n2iV1#Srh4CWEuXWk23xv z7xkua@HCW#8OF$<%*-(FggbYGH_Zwv5^GXQB@2U2zx+Si-UU9&;`;wjLIM%N4Hq>i zYP4yMRclbxtUyg5!CkU}D2S+NTUu>vt5#dB#Y=4f z3kVhgZzyfWdV99(x8kK-q?-TxGxI!~%|*cP_y6NXo@bxunai0oXU?2C=ggVsV2K|6 zn3gxmd?B5H=8v4_gImU2+|a+}hU~MV#E|boAKT>QE*N{d&LWXOKh`WFM~HT^`^88v z*~kpKg%VAUPt2AN_&81MN-jmuK4!V`w+o)l&8*_1=~A@FADN z%aZ3>ia$yKCkDTGMVjKvEyZ8;uQbIs!OKP%vkIl9d6`dMoPIL$ojjC^D-9C`OX@59 z_`4GYq~L2{*zToT*-I_!lHq^m+1Q%H;Cfj1LC;QXU4TftL=a0zBRAo>;ei9*)S>(vOubTYph{&FN! zMpAAYc3s5SWAJ*B#Tb;$(%6J*Szwlr;wVF}T=y5`@+PE<;6syYW8*fvlHcHvlgiy+ z-YBiv-Fwj zqEA?tjrkLT7m0;w=bce!`%dSngE=3>mv3>}4%~b**_oM#vuZ{$IF#$j(Lr|o!|$So z{E8=vC@FP{&L=y(DsjwsJQ_fo@n_;dPok$G)I?j_TT&oO6vDgsoM zk+*N6u&T1>8wP2A@ZO@p;%n4M&L0hEf?=;7c-!o*{F>;-;|#&A+ET%w6Xrv1o|$FM zqt7~cEzS5j$|7tjq*N8H;#5)WWTJFv8Y7Bul3qU8`dd?Aw1(3#6s>JuIQDVT!V_Az zG<*^KV^hOWlW6Aj&%ltg`CC{}@mLW>$Vfr|r5Jr|Aj}Nz7CwaDeiPukK|rhUeP`pZ z0nvhC+Tz1owPfa5xS(xHUJ5WWrVoQ@Dg^FI_vMZMk>t|EEMu?fp@)9wmdw$We7DD1 z*wV-1F8xcL!J_*#>CF5R+uJX2%Wbs9gl(KXYf)L`3h(qL=cuP%(ZI<&^SAU%V(^dN z^Jk~GFB2^ni1=X}M?Gkh71(5R{A7l|JzQ*=5Nh$L=HpGto~6};0Zv{bbiiH@eSWJF7_TnkXFni9M8ZLTTW6b! z5WM&x`kb;>C@JT^DG}62?q9f7?aH4zcd3=qdKhB+ml^n26c{l?`6}lkXMG+usvTB222TM86~Lm%gOY6n`v10 zOiy=ZD({xbpETSXmv$rEsXYj{n|%LdZhHRB;BQYBF9**yetSz+^s7czE0eH)n$P?s zkUb>gMj*S_+`UZL8emLkvVO0R9)&ydX9#v0a>#BHM$&vWwh}oNC&aYRd?FWZ$@A`J zW=;)n4vDHY+#zgjjp0Bg0v5~gr;TRdhUj=X6xt$pg-+NQ3hoNr_?$Et?8OY+*kN=T z3qB?OQfSv}p_QFy$2buK^OKlbB>TDKS_6zhzPH&2j;G=to6p7l*IRq73Hwn=)}9I5 z)Fu=5B`O_(5fx%u1U2TZC#~d_{jpYSfg4Me&QKk~2oeb!hC_)NpBUk%%Q_Z&y&u9W z-UgM$v)$iGG(cQk{6!{Fpi!&x&*;ClFdFGHCqgKwR;@PIb;83`-B;n=9BEt+HNc^&v7RVqh~^a z$Oqa)!2uC@Slc;*Zt>0qsQY?&4cXaYxllNu0GaGHe(fvKjjRaS|FS~K0G_o|w75Ks ztcI}xSbT^=9;vkXzruzc!(SoZ^T~d~ot3~jMy#D904tTw)+dAN{7o^t#fUcGA*Zu+M z)|EiCiKX%o8lXjr9{XAi9I~xzH9$?qIvU@IUjQ?-IMN1hexn0bgc>Kxb*JNeC{KrP z0^8N+0$Wvg*hcxV`9oFUb^N_2c;EinzQOzUs|N(0xA0JawD|k}I-2IV&tVI7*X!~Z zE&<~|E&J&H79;a+%4CHa9&lTK&2QJPAEB1^Fq%`Q01iY=FTV)_!kA~>PDGHA!%S#P_O_r2`T=EfvNhW3ul-G= zTPG=>mG3>pEvil1g^$N3M3@|7LrdhnGDdq^o_B{-OOW_z@B6vKs@hz%yPne*3`U(-;yDq8;+r524 zOvRcUZDA>53(MskfH1z4cN~B)-t4!mNnBnY8+Xk%5f!1T_hhGzsBx|?QQVj_e`?xW z6Te2btn6_7L(WbviB6M~SIftjHdJWI-wnB{C6fK>tacdF)45p(m2fRfs` zCVo+QXzdy#eOjkOVvZ1_%D4O;oMQQ7R|D#WmG z;zE>zz6Xqs2xd2+Ix<>-+r+?@JuPzwJOM;-eB{gU9&qV*MJQ2CeAj1)@4$D#iPVs{ zq8g6<{jdjq!jr zQiR}E>F~p3L!gkR9{C^p=rjY2^kIp-69r8F?!bId+jDAbeYqPjXY>V3MNeQ1EGT&7 z3e^q1?(g~n8Gcb(6TiAFoCt$@b+0d8;@U!pfk^S}*tqvz62Cnx?3@SJdCgsUhopru zHeSG9*hNV=L0o;KO9BI^zbiFtw#?6ScfwGFOoWt+O6^|ipQ|w9=NFjW)D5OAUtv^| zrcT)Q^*3vO$!HA2A`Y%bY(p9(0@~Z zBH+{9(UtMshe%I+A|)=;Cwx}cwVh_8ahkOYU!3TW_@`$5e1m8=Cb#7Hr|x7m$~-7#zT{5ug}5O5 zfsVK?c2D%{>av$elnDHhkEvTTMF;cS>IYVK;lErZ*BaEOXfybXeVn^+I^(GMefI7X z5;nqaskS&dYFJ!MbcVM?f*Ts=OmreGxm832s0_ZgaBXGc(riP2Rl!#mK2{lgd4BHr z_}G@p;Kl_6UX8X;vOVizHU0I<+%L&o0r=Ni+d|^>zkHI7_80nf@0`r}W_%HMiZ|cB zJ089Lzc#b|elbJSozA5v=?NtUBO?~{qCjDULW_~#59s_+@n5fxkbRjPVx1KW4_E&z z`g8)UuK8g1Va*XSo#qq!w4(W3U%$4fQ{NX>kYWDefD?VH9L%|kNeuweKUeT%%UEzY z5SRS9lH~3zedg&YWhU22sgdq^=?W?mP1$5V$=4`v4t^R~x`={Q08~<nZDc)S>fZq9w-P+#yW#TQV40bd;mYk)z z*&sl9d(fuoi1y~s?1qKwMt&BhC zD!zyqU6G+&kTgTnS}p!33x+fjw{JZBV9;%m;F@{sQaW!$X2%gff`W!~=}AFW`$9#q zTWNwf-OvmEo?^P9D|c(g=Y&7;zkvTjETrx8i2{3-NvUW~(5 zWqhOCB*QG7#9853hF$#z{qQ0-^cG|-98B7$^vj)O&A7O@8UA=N_EL8`m;JSV z==J;Uy+F_2^W%qI+%^7d)qc}-WW~cH&N=xaj&d~MoPaJ7Betr)m8XbcOj8g{`3%L) zA0wKDdP#(wJV`5!q5NIMiL8iLfl3A|6Ayzm`8w#XjK5qN{|EbnS@@-X5ppglq^=^r zuEYGg@a|Nhoomw75KA##jWa3VIjfRWeN7dERQgH6d`YUjGX9dm-(Ke8)bAJywahSL znV-5Yub3%|PtrgdpBRfTvKpp}OfBjh2K~zmo`ZkR1!rDozD(Zx$;;XIY)yF90o<A@viKy^oKyVf9OE@-m(JEqH^=K^QrnjN%u-B` zhAjN98quy+yscIsB!QZLyV&1)mnC|k0Yz%SNvTIG7C|L;P(Nn}b%Syl8tgH7SX!9g z*f%X`{)S_As?IXg+fxmGtWtV&c^p|LW! zcHx##@WaNd;$t6*B&HJv`}xM{mGMeXFnlx=e1A@b+`DO4X((~2k!waUqAGov=KYVD z*`KXKoZ+QJnYEP)hfaUe{(B9ngsLwE=jMq zd}+A0d~6e=j|>GrX#9qJH4&VZy))~8z_AMA-6!odoI2k=LmV@FJ8u|C* z#uJr6kIu}0AU%KFcxWgwXk#c5&JB(T+_jS3SI@-P0sAJ5lkNsx*66a5OFM?^{Lp51 zb@yKBddh&0DjM-S{-E)E?QaEMr+FRKeb88LfafDXZ`F$vctHyyTP50m(0C|eLgT}? z#+$c7x{T6uSIzd9rH{WcXuSEYNCa4#8WuW%Aa(v4SQ>J9 zNpO6D_7W*cp%K3EG&aj&qwi<0#mQ&w>68)4Y;Yp4~Nl@+mdxfQtK zHw;G9AjiDdl1G!JB5~br_Tl8r8}Qfwic0mXj6c(|X8zh(a{B&|FIt ztc5)+%WxOMfFdsw?7!-?+Tip*Ii&l^me)dIyq}G3#{3+JeKj>?$i@N8ZE?w%E7*)CKB8?Gi9je%q-!OnJ zT-oY1eEc>id60@$4lI++0Q|BuFt{OlB=dqjIK4_^8sTtIe4TssEqgjs6H&2Aqtd=Q zc*MfN!HaU6^Sw93#V|W4&F6hQxW`crSRNEy7kwKnmvD4>DqTi!<$_7fDr_*{9g4m4 zX(;$4eWl#_vmM#oo{pTXr$?)(}Vn|Lj8?MAY zh2RH)*zfe9g-ysgn7J7)F$mj(HCeX<@g^JA?Ucvgqf>A=NgQi9ij6i&0Od$x@TiTs zS>fzgFer2oQ#rUQiuVorpX3CJj*a_hrBt6L*7EwrQhN@w8@`67XQTR1;)YMqWwJ~f zPsFNK;S;uoV;%i4q3ak%qK?lUD_OE!fn=7@Y}rrh%)yMX+0%dUFJ!aQvFcQ%!FpuU zfQ33^K-sE=SDnyoUd*stE6xz~_H-%bOd%L> zQeid?kpf?@%yAkzSqffuww1%^AY$Z;+YQBgd z1C9tW4Pv`<0tszF&?x{Sj~eHQu=5>`1Rv2(2X2cVQWJbNdc62=vK}REY~1J$_1{p^ zDcJge)^yCfnmAnuY6Xu>aAA57gI2-hMDZ~gwCK3k)p2(fxA0N+C{Rl1X?tE69rrhv zj+=Lu?KqaFBrs=%VeYbdygrk0D1N`!ag|4bnmtxNdV+zi2G)K?-(CM__1$2t3)BO6Qoa2XNh_WSlpeU3*YrRkCyUYlp6QYv z5G`;jaEGi=x6C$M%+h0qtzx7#2=9mv)QCAQDME>jTl^@u!8QU8C zc-oT_!x>pRt8|laEn}JpU5GCAk1oZH@$~w4!1cjFi|bOE-oQ21#dSJy56qLz4h;>K z85&@<3=(`}_PFQA(^!7Q<2uv*5i%ViZ@56t!19L%k<&Tfa@(TbXns*&7d52Q}rE(u86$DkwTM1T_6xbrMd1-M-1(U&KpVc$^#!QL zzdObQwt!;1J!m;Z&JeKqssUh4W}b`uXAjsyJp*hhcMsT~tg%^3^a)_g&Aqj_Om~1) zkpTM`u1Fl!=HY9_?=7$$9Hozp@oLd~Ji*xJ^~845s6MgS!?y?yoo z-KuA@?&!+;k99VyLd^+K6)A*qxUB(HMULt~e{m)d>TcYyGU@`*ga{t)_^>#f2>O`;XImChR=}$>_txSWx{E%!16~IUXtq~!_}StI$SFw6`GVn7kbbyL zg)A#BGnwq&)?XvX7>6)N9Pg(+ms)ex%AN0W&8msv7t2p><-g7jB?g@u+Pp^_LW<_0 z99d>g7Gd3DkFNG#q$&iX_^>E^w!u1tp?f0llz(PtjoRkAr;5dRUzw(CY9nizgvNKP zV#RS3Qel?VoK|bL!@D<+!GePbV3&raT0cMWbHJpx9`Y#WAyv(^yd2Cs<9&+x!-JM$ z9%39>iaGR(^%f=f@=6&@Mo`q@Kbr!Hjjm^~xrw{io7rX*E-PNAPc(PCxwjT?)g8>J z$Wa}Jzb0=0<6ZrGvIj>yDZKu@{I4G6nnK`><_@paUF64|{>3JmQO;Yxwe68~;c=A} z|Fq@IHu>RW<_;gzopSV^Iks4)dD@}9D0Z@~Qvx&Dw%QIeJJxdMza*^OPEsb)-ji)n zvOf^9|M`!aY>i}EihU(hGWCjs4pfCd+twt82mRR=&lk>PGKlt04^(2FGpF4>uQBZ| z8zq|Y5vpPw?ht{Y6ceIqxJXfUPrjo?iA ze}KXAM}J6TdHr|(7g&C>cst`lLZDJ%2~Ew;TVh=s*r(iheOU&|vzzj|kJlNoD1uivh+vb*3f`=6s^I zb>i=exE?}WA09Brn6iN)l!<1@Z1eep zp-*zQ@a;9${rzG4k%zm}^wS=$(Z9~?jqG3QYa%a;ec_0eBYq6BKN{EQ@2Kge#f5ae!iw90zdaIXo0z2aRok+qU%vQci{?TD zk(b;X@8S5mj_mjyW1JE!`I>zZ8FP}Er_7x6(SzN`uTNF@ z*JIDf3lK>YjA{YuRf)m-FimS(0fT5`sxN^b8&I)w0>(F^V|MWzwG|*I(K~Y#OwJqyMU}lkIU-!cA^FDs(U{UcApTS>@UuPokqs<1tg9#Jkx>*N=Uyj7yH-3*1G*$-u&$a&t z{61+;sTcj0_MqRVfZDzA3l_hnJ@M<)ug$e@`dwz+2KGn4HTQlteuvV;&&KbvO$NUY z+zNh|bne^_mtaYAIx)aMi%axgKR)s+57or~yXODID#}D)pt`IFs;ANb_ut1_R4Y-R ztitBn_hfkjGy48H_CJ3~i~3$a-g|W~O#AD{lZkY~l4fE%Xg>DSeWE#Y{kTp?%=W>O z`;bp239jhyw0v?Tzzh-*(F^P1&v)3l@{zw9#Q*hX5P$D~_lbCBLFoH@;?nnpa&hV2^!>s; zY5M*R!sO>ecm}I}vN+@+Jk$f>b7_Ek$T1e#O4KK^ZLWPIJ8aw>_Qy(c)S|xWdmSd4 z9-PFd@0w=~nrE?icPsYp6U~|Q?P}B2fzkKXcXy}nF#z-V(A|x`Ydv(=_CR+o4Kecf zokv-eD`B4~w>kHX@|TRa!2VEv%g^^k-{;Nhh4l>jeqp^q{Qo#0e%&75O~IPfZjY!5 zzDX_l%$vS*3-&YXfAkuy_k5rT&EFAdJ%JaVe2&lEk$QTxw7l%Jz+#2+!@*{7;HDff zl9>KU%g5RCzN!Nh*{G&4i)s^Gf{EqieZtGf%y&n;|j=qJP; zC~siHm&_rIuV+!Jidpne{c5MEKx+%XjO$9-C96%{i@(Ji3Y|guQ)fgy$G0=7ayAvt z_FrJG$HPfTsKpPm4hZVp4O8ChjO}0-6ED%zfR<3}GYzANh>PjMi=`_oh8IgWgrbhb zxMnyb+~?pWIx9j3gA8~Itb;y~4T+9PO#XKZArEhQR%=x>bHG#3KxiU728qOpheuT5 zA{5NDxmfu4#FUkMg_}hpTZM$gA|bJg5<-*^Y8b<>T7K20LH(I3Fb0>lTWwvLpcVtF z=$FvP><_@l2GsQ~|8&#r#wn(p#tGDsQHEV#Z9{cQc+P`YfN|q^XhP` z8ISHnT`IWX|H;*66RwM7Om_?}3?9INJcLTrQAHtV5H9;8i4t@ACktetUnk2EzdB!{ z867O?A2m><9(3PgFnI9s%PXIvDJy`lkux?H+!g)zsE+p38#c?|jEk2Y4@<(`#={=$ z`o@;r*Twh`UFVIBl9sZ;IFdS{8S=S>{tB#H8zQ$#E&{?b)l;bM29vq?H$H*Gnr$&! zO8gvf*xAH6*PBFuMJBTLX1#_^HZ|jHw~n^3DaJr+^=}~$*yMGT)C)vAe*a0|crb>P zb%tB1Y889}NQzh(K7##*?M3dphs)ef56ox@4km7vbM6caN$}M`Ok2yX*W`6hEc?$!)SNsU4FZVxi8dZwj0+;bNrGv zEUP$5GA$38V7uD?0V(7{>+L$JBJm`RjX1fhh;~H1VHEZ={QYSWHtV+iobTb4ujke{ zwX@Lz)=iF2JDBb> zSEjxy_m84#CwH^E2UZ|gq9Wr;L=JU-y@(EQ4e-F5-W*aQzmoEr;Hu_7iT;vjijd6C z0Jr`MM)fsZ+6{S{!6ZaL?#;!VpFJ^iSb3wI56LC~=ta2Ri;VN99Sn)4lf3h%z4?dP z=+~Zt&&&<-_$~&@!EZjQ5v+1hm0V%bp?L`F63UP*%gS zw7!Ii8BaNbbcg`ge)S%f`&*4Osqh%t4gh^G3 z@4|QUC2HW#o)c{f{4ty(#7=7YIM5J?y-wfE$ceo{-)x9pOx;IFCauu>Oyp- zDz%|eQ~^5!hEcs=-~RBN#;^tC1|N_}%g2W_4DA90`txCl?go}q3@n7(j}%9`U|Df{ zPgri6`T1di9}`!9cQ(S5wnQD2?obva3kMKZ_+XT$ASJa6Kz`Y|1EhRLhm;5&I^^|> z(;Z@c5Blto|018Y>=`!i7zPv5ofk*b@H^`YCm+b2sWa2?AQkxd6DOao(;XnH7P`SG zPDM&kFo3lOHZJ>jzCsKItd&eyNPv{T0W= z2gq`Z%0R)X7`xagP%uaP1nRjI%qh|@E(LS=Fr?mmE!QtD1#@cki%Y?rI{nh6sg$u& z0;IbC@{&hckiq z{Q^;y{Y*$7a}rHNIE~s_s$M!f7Isj~t!^G_wUwbSS>Y`LmEOfubwaCbj#g z{~=a*fW$8bhd9DtMM6*PkVJY!bvz73I%Rn zF6fNoKZmgi_}ct1ri8C+`oq(56X8>Qum=LR`}Kew;dWpN>fbLD)Toxn=esw}Ffdz- zGiTRH9P@dT&kMb=1Fs0y#U7eqttXbOZtx-A31iyfR zGaM>Hfy8QF2+8`uo)J!6*qs9liLY)?{?xn@r`7J%iF_$&D6D|Tu@AGBt+6abs#uBS zkvP=|+B%H z5XPWEnNuL}?EL_E9{pJGWT$&jTPSP8ogF5s%^M!Ov8c4xZ3b5>B~x|~G~L{&F^A|> zOM$;pfnTRUF^vwAh>^xRik^T;d9e=7m^BJrY#2H4v11%ib*B1m52 z^R)@cbSSPYmiUwZH6ovVAT|x>fol(GrRm(m)u(i>_B}I~RuQ13^;t;(iM$8jr|DPk zN%w7KSKoeks~TudMN$KqP*}>IR~&Fn~%;S~x&t>uxu+a<8Ob*}=eq`%Vxbqna>51P`P!ASh_}43QuMroh>&^vof!D0xED z%&0Ljj3fU|>%|M|{1McH7uX`i3%;%*%={H-txYq8Qd5*=2xsvY!r-WP&L3$_P&sr^ zE;>Nr!OK9yu!`7r(ZPBCAYT>z1~hQrdmwt&F42GyszO~f@ZK$=fga=giKz!ZzL^Q= z5z~xJUdo;edV8uE)Dj`NtJj}8A7Dn{`Xh{VVQ`iJ@p^p>_4nv?D_y84ot+sQccw}1 zb^O65y^*u&<*mEZJj1<}k?1bf*x=zfXMs2HSE zDfE;9X0_%1wakM?E4PBwqGwIbsHDHb`i6~=i$6RpYhHhX1no?5#LJ=I;xWX+lBGLC zH!_eV#16CoY|btI;SRGI*Ux`YNJIKId2UJlPq$K4XvbD2~MQ_BiWn#t!FK*}(Xz+2Opt_YUWO zL*Z^xmp8eX@wH7))6?+uTxa_5U#mUMl3Llh?C*1)+GC&dS9|VrE=lim-p4lQiv+;= zy431Yt;?EaK7Ooz=8w>#fh6`W2YWWn&WaXG3apQfyK|{X8SK{1c57=z%EJ&1XOliF zH9HhrA@(JCb#06J#Y1e|RVEKg)ppH}?g&3yiyrka^%c^K{`C*~Pp5C;*-cLIs%g=q z{$Y`N;cLXLmET(4z?%r;{lyW z4DbZXV&_|YJSA-}tTmpB2F_X-1pMLUg@Xb& z4KYA86{M=EBlHL9>h>a>Ge3+m)tKf^N< zd&s=>!)Xp>+p@N1uWvakPw)p?rN#+4!`RFj2|T!^Ix(DDs@b@;1**(z53Bq|l+VlB zDyR6?s=(bZ%n4M*->M4S_d-?Nym&Ei<9gNNObwB&Jlwf5;!G_w^M3^UNKDNk!14-i zTH|$?J8O~+gmL!;sE5D6RJsw*6iubeNdXy!V&jfnV!97uq|Dt>ZMx4}mN1-bqi|GL z$y!>ftrAK)xPv4xz%qr{v6|K`atI^|fC^}eKD8n~dT7O(%AvWqt5*)qPcegd>71!L zLaLHdrBT|PuVOiCuXDYkbds~m8D3E1Tv?D`K}6?*Top>#d@pxZd=*++zK8Ow;xE<& zlYzFgIBclK$(oY5_5m(qU9z27oyc|BF7he+zXtGG5^zW~)Fd3W&;rHSoULe^^-HD| zPk`K~Y{Ax0yo0k{2cP3qy7|PnN?wDzFnZgw^8&38D34Q3AKXA6V5XQ*27Tr*^03_TQN3?E&7^PN6Q6K z{D$(H#FS1ckSE56=Z{}gnV*|IIeuk+z8aC6{53AI=Qz{c+^YD?fE#Fgot+;b=g;9p zZU>9OMExF2SN#Gvl|iXW2v%SA*GDG9ePn>H|IFVy&bI~?V$2ceU?{OB@ZfVb*{_2W z*1_w-E0cLO!RG>PbIHQH+6m6+TLO2lnWNZik-&XxCd5bIqS!={ioo3*f{+!sQDK03 zU{#gIZdBW~YUz&M6i&Wwe>{M?)A7{BUDz$bz5~bYNyndw-OA64-K;crS*v{^8OqJd z8Vgc}dq_!CWHZ!v*JQ(iCxDet!zUSyB%9s4fj%ZE8uESv924?mN<(O1BoUbe#TpNgK((*RSvX^L& zZ9G#>;`FsgtNow!YJV)F{aBGcPy0*kWgGHON>ysB{2srk5)sO)5<0Av78DNY=KV>l zbMfccZek7J<5gNKJJReaiQ<8u7X(}T(LL+TY$kHldW5Ow^#ufo53~)1PG+?S2Lu+& zS3vd6u1OS+AmZWvnrrK_XKr@2&oo5G@}`UWU$r51NhZ=bKX726_1`qh6#o`K{%^$- z%_ZUt!%_!dU2pj6)EPCzk2ZXDeV}cZsbOmEInLPcA}YK$hq!gS5f$D$CqDMOm4Un6 zK4+;E9{%6BK~lDJt0l}Pbgn!E`Qa&L`j*M|=?mc8|1y)QtAJc%{% zXuE>hwqR#$O^J>?L0kUe>-Zqg<4xR=(a!XxTR*StQTGaeX*t}ozn!acqiCPuU&Kd` z4)zWVU_o1N;uRd<#1c2>7U5^`HvG468;J%$%yV}$Z(RMRRKKfR`=uvOw9XUS<`+2~dAI!`FDrE^MOf`{DE@u*eQexM zl+(r~k%X-XmJhe^!<|Jjszh&%FSNWZV)_(Hm=qM6L!mma54bw?0rp)dTMrCf?i5H) zGgP4w%boKIOn6yBs=cqNLHKkl@Zc4zJX6?0U!(l;CyEX+W1Q+O`g4dk15;n=-Y>Q+7&f^9eP(gU z&V!*)B6oybL702WaFYq#QUjUz@v#*Dew<-H)>uFjYO|t7<5sI2^mS~0NX||4&?}&h#uM?m)TxpVA~4sa__*+TodzH zt*$Ao4s#ykz#f4zDKT;Yi^?J~rgqgDd}R)rIJ^Ex0T;n>CBw}2-yyw(e}SiG@qZ+} z=&M(fnO3AYsZ~##h0N?p2=Jkm?^qVP$F0|hH>htj&a0IwR%vNftw;Rk^HqHAfqQjW zZLim~y-3xu*4F`SKnrzoT!9!tNN@u@bmpF6wh$N>E+wYEQUOm_Dlv721iq0TW+ao? zbJH3mv2#(QdT6Cvv~x8IxBe6n+OKIxxP`dwc7=oK8ssn{c*MEiw6P{JzaX4wC{G1s3+_T#`Rg{3^O|-cp zSXKn&O-=J=YC)kK={bkSEa%y`pZP7ea8|@S zK+X(K{2SF#B~J91$?BQR;eKJ~5{mK>`ntyi*>BHVFV<0FB%XqI6}On2Y4GUlt_}uk zhB~^SH>6;)bRz|SqD%vAyT=0SQHj?LYLE&@9TbUsSQk0aJr)*FR_mj@VLsJQ3&;K> z3P-10<1E$?sF6{Wz70F)=gW2ycK%>qJB!Uoa1zT&M7Sz*l;1m%1YQnR!~nSmjSyIy z2D+hHzvbQ(pN5=reO$9ccchqIQ{;-RtaOXwTOtQ>rl2{~0afk$k@!22_)GLfB%#F_ zr>JPHp~2Du07i&*^aG5V0U29i+R<=O%L+qL4Oa*hysa9BpaK((8v09?$}ZUr=d8fQ zS2@QPjdr? ys_O~ohW)asLu-vot~vn^zRq?pj`ga0|?OfPJYI1|CA)zX>$(F$&i z%R`6!Y7&2^Xz55LRlO5-5-mJKT}`+|)HvtYGrI+1H}g(xN4+4E-U{xLs| z0+TrW)gAM1yG%DoiGR0+RIzc3=XxU5_8WP)q5)mJ8RHT)TbVOn2H$x%atzP1f3jYYAc%J zT>0_tS*)){t9Kc5My$UAk??s_*_8N9eNQgOkD2!Y+5cI?65HnQY{+fhlB%V2!L2#ry>O>Jrv9I~;g!43t~quUhYN-~pNk-2&R`l#R>M0@euL7*NAbw+>`Hvq zuK5k4RLYhg7zZyw?sdL5Ob(0){AN_hOlBLNnn7jx4M&7y1jNPJ_X*Q!&BX;(!2uP4 zWouJqd_SmRaD}1R)R%qu1_l<-Cus#@YenD(Yg0o)YbO)|R@bV&s zhn#ER9vk5F@m=Q7t@SnWq#H1J>PFEA+9*TRW`!k;Fr)*m{h0#Hi2gjI@cwfcg}-w9 z7=`bDvuhNt8TJ2q6vj+#N1IXTUO;u9IR=wQ%Re-cx8(;$(Q)S`C_2_WjZ$N!Ms93v z0m5+&%J)RB#-(!s{BBG1oshGnMP207GkI}%Lx{=i{Xp!8yt9sA2!={vr+f*HANq_c zJ`ohPzS9SaHeTC>qPt7Gp~$0AuTTlIQl%nY7(v#j#t4h18RlH@G;wz+m+N6p*P0rR z#E0qq-G=_$G1OCI{l-mUHSuZh@AgUB=ZO9oPQEKgFP}USb2MZ6Y|^ecva3dQCaV!T z+(lSc@lWFFHtKSnp8J{swIt*~5i~zq5|+6ohxI)nN^0R80;NM*vG&X4Uet`er^WOe z&5z#stAEPc^dbN9nAS_O%u8u78zpb1Xoom@|UAoW3i z3YN;FBK~Y7_|HJwSo1t=yfggg5$Bqsir|ZlMd9F!fwrUhfKjW^*fyQv@^94kw3h`1 z>QELSOtT*cZp4iaFm5Q~drk0@Kk#~o%`jEYI(>?7_@;iN*o*Q=PbNlQyfhy+>*s#TuF>IMd#dhBk1s;;g0y z5i9`Rq|mK3=SeR~ObCVIV_z~jlpuYvC<;=plWnL8Cieo9(me*#cK&%G(Dn@MTS@^m z5q@CYLC^c`OWwfOu#+>vnfXq>`z}f&9HXXX78!W~`-a!q6mT!l_(;+$WICPic9OE4 zF5`$H0uPDF;eeU0@gQn64Pbu1)5zCd@JC)?8S(ilAr71mU-Ev6YuS_6ID%;94FgRj z$=l7lfsKbG9{}}=u)g>v(+4nZ3144|jaxQbgm7rs83V@Mt4_n?y6U z0*x;>zoi#SOoa78vp~(UQVCoBZc0!`S5D<*q-`FgDKv2V`jpl%`p~ z8;pd|Ts*sVKy2I}O>W|Z1l)wlY+MvW@x#OMz3g6yP6%TiQ`oMyB|sI%_!kPUiJlw| zuES8UPQQ;;*a>~anXMnJ*j-ErN54CbI1(Fou4*Bio9uB*i(5#X8tMNEJJSZELEY*O z_JN<8KPg^$LOvASjl?s^-Ce|Z1UuK?V&;`AIO5j*)>F(Y-{8G_B^S}Rd$FFT>!R`N zMszucO9rP*FBJ@CC^ff~YlaTF|0&31nIOJU`m-X#F^x{$a7;}Z<>K<8-d+IWkrvZdl_5E#?Dg5;W<&@en220NGY_IwBTksu305n?a|}$%_`BG z*tmd6EMK%z_h~e@K!O-6@ z>`s2x7!L%SnWLPk3^uzk#qCO-UJD1P)au&QIndUnqAhgD)BjZDJE)#UC;y)S_-W##iVrdU`pfNZUR&gv-?`Y1?ErXKO5d zHnkQF`kXhC9~w^tPt(I{{#@v_x+FI4VAW-JsBNd1cEw7sE_Gi#Ui7)FSnmvHs?HC^ zr2FGt9n-cKO{m~U_T>uv; z_uJIM7BTH43B?IypLZ#Rp|VSzLw7!{8c*R>W6^A1Aq|`dpu4mbZm6#I2=(eK^+KQO+Pg$&}?6!BQ2WsYF8D zCd#OBE+nQEYk23HeEg5z3bY-|5?nL7)y9jZ=HdWc8OA|p<(vI0oSB1Qew*BOS5r0c z^{T-yS`21}Ci2?&8dW)~y}Wg2bTSqZHWjK&Hl$m)AqxxlX94|LMdH@HlR^Wn>u8E! z8o2YZu%UCabePYXubu?wglk1J2KR}P?1s9lxFsVuos)(|+>~i=v|lpcJPlk|r*&>7 z1*bQ1{-U2O-3_7!m2DNWLU*NeSu`Af#^Ma*saKT3bdl|v(VB|X9;wng%-xD5{#Z^9 zh7v|~s9~#2R(nJ{mLiq`R!I>~j4VU7780Qw)cBU76=X<_6=S+xS-o|MnyfF_i$*w1 z-ygjy4&pB_y7V44kFQCx^P*bb)Wdc(nu$?miu1U?LT9B1lNqXR5>PFwt&6$Xq^u7} z+mrQl^?i4Au#4Hp6vq{y4wyoys%HbSnaE>E2O`!9=uwWvgYVdLoSDbw5g8++NO*m{G>L`BhIYQlz8s5$)kBdST$n`|J=8%`A@ra z_gjgjEnArcY((>8fsIpNmi-8nORdowprAB_mg)e|FWP`CB&s`7U!LMjJGO8NAfsB^ z5@`F7mleV6=+LAnSMrJRPua|aIXr76KO$G)rT2PKMSM$pID2c&L7Sy>9w3L|4XLoP zMGCoflIs{e=W!(R$o%vGLtA9=C^+hjP0|NOo0DJRt>s-c@$~^Szwbc!MWK@|F*~*Z z6A4P_=}b)Ys1U{+huW)gyk17)MDlr57Ybm_{_}O_XL6;zJ#KFgcYVK?pYBW8 zAKlF|LMHOoFE;Yp_iOS%0Q-XR^yDt^bW+vd^5eaC9w&0{@ zW1rRq5Y}vW+5n9Y?c#u34E2B<{;EZ&0l>FKK0H?^+Pn6LN~m#msV)mui*C{x!%_QfZW#1|)B zI3g+B|hU$GX-F3+-&Z8vud zn7==#3t*4wfw|eL?GRgAT}j}UNg55FV%pt08igl)?J+jwfy=@E5;ZzD?v9JSsr(Ux z1^Ga<3k~k&Cf1RC%d*%C1rO=dnwITc5jJUTlu)MG`=znJ%c% zy+h$1{Wbomjz~NuBWXH+jaGu}cnz+e&z7~}|KM<#!kXYKjqfClF~E69b%xQM-SjCx zH1{?|;>HRML&5)Clai>+{b0Lglz&h%+5zKz{C0keli(NKG;qOJmN+bAuPfiS4gRSBqwgC2P_|imY+M4_d`Tra_(WzX6 zhxkfuC}^uE1J2%@#5QPSY6NM!9SXO4N@6%ivkiKQf`(MIeB8g`kSeEwBiUBXdn;K= z){4Y=yNTeCaqiq^bM72+WZ&n`9Y-nMs|Y1V$0N?rn#3Ri0c@&>ufrlYBr&J^d3N#5 z?J9SYEq6kNa~FN=vaoYqfpawc-#dTqc=7XsP@=N9&`n;@_xW@4oYb`~ANOnc zN(G)jJ6GjLzbI5vs5t~P5=snz)EwS9{H2z&avSVS)oym_LCr-vreasuA#{htS8`&q zcEFgBNqDq!NZ@;4V=nq~9hWb{6U_YR9?38FFkOb|GKh;I9^x}(*(oPKc{rj%@1?PM zqyBF^-|Kt00zNpc?9aZHF^vZe%v9ljoO4TA_047O3YR#!ivWqE7tN=ZAfY7aJNwFP zIOLPthDp;x!6+(lFYqB@P!yz=W`Yt)+*90yKxCKbzr(8TO>r9Yvnm5G*$~HTDvQs7 zVOyb*vBK_=Ax~QQ5?_&~^qUrb$%#~sq7{M1x3fRs5X$7|>-_A;PYr3a5McI_%mq^@ z((TFOVs7eY7=`p+lsiM^>PM}9L=uO7<-8FjS!Tw(fk3QVFYe`TUOdDPfSs64>LRL3 zYm*bxiYMw}yK*FK5qfsLXO*Dm9p3X+?|CGbA=(Rhs5*im<&ueSx!w~ z+1)L0??^cQce&HUe@*uy;;MUfXqdp67;paV?uqefzx{70M#tu8wp$?-lTLjWR#1j} zOh0n=+1yL87Me)>>HSZq3A~MewcshI2uYo`Pw>L=Z3OA>4V0~PLOgO8@T|&t3P`ic zmqd#vCOMh~rT?lP{YPjF0&KM%kJbhE?ymkDeuwEl&Y|LcX8*m=z5l%Yf7e3a`9e+N z8ui~@rvLsGXj^GsTQ}Lh`)}r5^xwbI{bv*vw*NN!{kP=?5cB{i9DdIJqpZpU?!TF~ z|7t&f|IHP6hj`%q|JHxaz51_zKcV;vqBFG6r*!4t0&O#m-RDFZS|&KrAM^6%KwCL4 z*+4wr8QC8EFmUr#B5?-mX`)O~tet-&!7YK9&fe1N4qmgf?Ryo$51J45);EWduO=}y zyC#UCoOdQg;Fzn>l? zV;`f?P=u{89=&}xMc-~lT31gA9*s1FL4l*81N{k@3c;We01VH52N+MXWBjmy%t{_-@Ou&XeJ#+| zts}q{9q8_nRhKxcHgoBJ|RBy7rW1iPy0m=w$=x-h3N?yn7$l1(7*3p_c>Ww8rPBi;JT%`cp^*1YNHIw zoA3)l2{?min%hz1%+&ualpJqGjgsRZV=+p-ayQ{#-P6we&@5*x_I$+owm*Z-9$54NlhBC19nlWqsgMbN zq&sUTM8zD%lG zl5irN-LBAB2_5eqN;DVqt>6s4pUJ&ZndfmSXw>Q4^9mygI|oz+hLrKwM7cwnD3V}e zk;GEN`bc~xFGg{nr_a|Z`@BN^qMc2cRoPct2@m8jaa7tEQ~QS!BZIMVhfbokf!1=V zIYk5-sFrzqJU@~5@X{Q{?MgSbLO3)_RjqpbNx{RD52Tb~gf~EcXFN{mANe7M5*Kj% zGlv)dnBG>v5#(F3@B7VTX(;|Oo)!IZ6wW=YqGfmXyytKhIgG>32OUKhiEJ>$B-k}j{c$SS1IjOue3So(&nT~o8y;;IwrP0n-Iu>#m5-r;m5UEd;87G zafEGOoAh;}|CMj3>`(#?qAH+UPvdR^$<0+)nLu)Lp%oiQZZ6;w^TDg2^(j_?w%jAY zTH`Fg#KdUAJvM^e;oQ&54>lJ^qepOUiW1@LL#<2WuQsqW^nO-2BjQJ=x<2t7JUXzr zj?x_rRYQ~0RgcFU+E=^RGh*EaUFvnYMweN-T*k#N65TUC@c2bCf;u)mc=@66yPX2< z`tV)^A#eQNE_^dS?=^U5{4Uz#GP(naAXg3Ml6KLLPE(&ZGQ@&Qj17$W$30pOF8gF6 z?}F>B88xs{U?`}pavd5<&^;MhcuF0wI@g);mRICu+uGr0%Lq`Ec*LA#LH4imw}9>$ zvOuGFL5bw!*#`Qh<_t=eSm!;rc=sjdzO0xznx1EUY3`E@m&$;ymID0-u}V#efql2$ zHfDSpDjE~=z_E=g&Bz9Uq)y3bRJE7AUpl*&RnbG4KyBNfG)I9@%-Q@cRO1$^aSKi3 zO1(yunR}~Asz!&r_qFD}thiiv*7V{O`q!(W$Y1nC_Pk@v!B3>tKdO1sEbT%tv;tmo zBqZm1TxeSz`Lo{_KG+EhE1{s<#kp8wYbqB-7^L#NRnI5@wtMd_=kj)`0QYY5-5U0V zsU7C|5o=GT98(_UC||o#Qh1AE&xTL7& z4hl^TGh2i-w7P^MDq6;iAa)yWjo&aWoWW21^TCi0pi*J)S`%n{*ZU$s#yg|iDmpvl zWv&E5iSVQ|Ib~JTq#J)OzN4aZ6EV6SVNcznf0Beu7oqS!6x9>Lgm=m*LIt7EQ-sU& z#{Z(HEzC?l{n65)EWumhbu<2n4>?0nnv$Fa%m%sT#0FS3*_pPAAOV%D3PQo%OsEc9 z{?>+=5wHgKFGK~@A3uR{6C`{58pUw`0(S@|9CK3Cg#6SG-Mfh@Cj8yW-Tk31x9YM~ zmz%g)&PM#N{}DkV3MEHn?pyPDTqJR2@p8-D)(lHCx2Z3@9m{*33egAMRS{er9TME+>qR0M^P5tIE7T`2bpdwC>aNf2b1yX|f5_p& z>5?l{a_0JX6JImR*ZG1zkScvjS9!L&fn6`!=Z-QJETIVWs-@%O!+%J#icqVT+W!3@ z&^C*Yyey38{=TBKqEu5T(=evs+yZQ(*nht^SlIC`;C4i75n-5_k7q`3yIPqz^qfQ< zaa>kOcVx%5H9@dN2%W83YeLGi!7w#W#AQ-B?4~(YV!KL}89}9yI2*$C4hiPv zZdJjk%>tvH=7?GY1cfNM1eRRoRWh}&Cb*LLK11|n8lsF>&^duei~9wn|1+IGlkdDb zX&6Sn=-{f>|A`)s$@JTU7>{}wh{EmETpVmq&96G>ExkEPVBSs@^grbvO8yCJa{F;E z@Tu8$x2`@q5y8T`E36>nsRCM+7>>`Nh2tSopvZqdtdKCz@R9X4L2!mIM5H2$&nEZS ze@WgjPRbVZ#x!sTDRCtYtC1=q9G|%vFU81agyxNBOK3*a_m<|2_jZz`*nu_(Ls0j( zY{WUDL~+d@BeIm|(uBt&5ihSG;$`mUNd#dpogA+mRyHZ#Jgh_-^g*$+F;#<_X@qhL zJPN$+$uK{=cdRqEc(AL?8ksjXbLO>}(GGx{7BOW~*={|aR zS!~>I#)%~poG@~h;zzhQP*2*St@3akiSZGm-H$(H;^V)_i%E$=2am-@lx-RJN3 zm~lwx+3&Z(GY+)hi^lfV??!j5r&a|9TZJb;@G)IhhS`OQ1zRhqOAdmbqt6w#K`LoF43~H|kPAP4~ znf_}Ctkp(%yKA$#guQtDJ9_R>n_ir(9;Fb4tU(zXaOy z`M`_9iukm}xDuUHTJ1C!6bc%glyT5`(TpRj&27g&DZAmybDV2)bjs;pIOX&LXDGS= z`BitEIU?%`Kqs!f4b%PYE9v-2LKt(`y`~sUAPnBxctN~27oPjgJWjTS<sw4B}KP7&sr7hjCf`$VO^BG zB42aSvw^nr`GH$fIJ~xU13wvM{3y_m*tmZ~#97h9!_M#xcufa1f8jr`uEbY;H52c~ zGw?l$58puJ@4nUYwFJS-P2>rW+-Lza}?;pRP)UjPGaeZrx>6clYmi zc2dJMQ-dirc@e93i}V**qx<#^L9L?vef?Dx8{-9@76A6{4dgX z4W_fZnDJaq%Gt56yeb&|a=Vqj)^2{y0LadDE z#@I9<{pF7Nu;a*CtgvUErQLgHp)XxG=O3v7HsiDIg`D%}PSa(IE|YYr;$r#t7(Je$ z%P3t=(&czvj^iTxhkhT%MGE*PjXOz>Fqc+t^oH~+&+12F^g@00M$Il}gUBvM%SETD zg#{5Ocb9w0F4I68_%U}^X!E~9iAe;u@Pl0BedQ91zPIl`F!X%_0j1Hm8KX#d^rZ%P zcoLQl?*mKQ+f#?E$vxbnD)|%ipzeu`WA{tC9IFw{;$XR22kW0f3M?&FvuSZ-_$#h>?0!Fe+^`)dB&rl!V;RIwT* zMrG<|VZ&oKsxd8~PHoA{iUj_&K5X4oY66w(iSCJRXVlKHIatEI^$Qvt1{QC`c=AQE zLJd0)HsaRk64GS?7siJ>Mh|D`GKx#LPPXg+KKr*){X0$ld;KWWzwp3a?i6f8>HQ&t z=wCNvjyOyA@8pYZ|MtJ{!20(nQ@A%g-v8+T*uPK76}g&0=1$}y+}`VTZJoNdKHar9 zvFTM^i-d+xj4$P>YirfDScg{SsAHd`V?*6L_N0qoV*}JYzfVJ{A7u6^Ro!K6H;KH3 zoSnDNK4ttpajbgPID9X)`Cuy|kYp{rihn<2%5Bu;I$f^S2l;0PB*q$0_7U;=e zqcwBSP_9wBoTSU~x*W$vT;_tOS!azcE}IQr@9Se7(4OYhqodR`4&-i9@8@KlY2S3 z)K>=fahHDZUaKE`2b#${8AiJM3wBNVQe@VgByU+vd0*okb& z-?=iEEj`b8A)u7ooWi*1Y5Nlw5p#|nfxS-;C8EVMupnVs8iFmcK!&9uGA0(xl^wCM zFz_e|VjHuq{6^&8?1n$9PJ)Dw>LgOPDQj&P|J@ZxXfsYEf!meJ^~_=!Mm8B3>(OSG z=PR=BOrlQ(+EyS1M4SRSk@B}5n;!d4t>Y;N8l51Q(&$A>UT2cGl6*=cm$bR7Dq70e zAsfY&o&1XNsCv9lvTu=qS4+fzmMTNMw+mO57X4l{c2UUh+~Yxy50*+s}V#w5E=CRyyALF}C}F=Cp%{v`1~j&_LzOWd#Q*eMk@ zE2lsSz~ld6PKBh%0SzeO)+Mi?^*o_6J)AO)CnXBP*pcRerJ1q$PEHKZ#*nHC&Wep2 zVJkqNo?YVp^*vQEj5S}rsX+GJb}AxiZ=T;7VH*)dJn-{#O=|nbwlY5vqQPv^8>-f)gtNR%J z{`tCX{?L!T+f=^f$>KZIQd%t3iW1eJcDH`GsBl|gvCd=?C5GTnH#ofHcaZ=Hxr3Je zf9$<^e4JN(@BciumeFR(At445D!>riO&!}=uptSOkHg|_g@CZ^|6`dQ)ltJtoR0MRl9$9SVvc7mWzYV3cXZI-N zKJ`z6|H6Kn>%JefJ-H1R+plSq`^tA?TdNOUpu;=y3a9aG%lRtqu-0?bdZGDNl?+=1H zfPZ}B6Y=Ms)AwCDosZ9SuhAzVW!q;!p15uumwtEaYkpd3c|W@aj80$n@Oc^oT2+1@ z@^!Jc|NHpXO+N`jd`a@@Vw1ipefX8b`POpj!_tW42>bj@ej*whi^5_c-Eu8oo_@Zb z1opX$|NM%xfaRs1r@zHU@!zLzJ3;RbLV>dXNMr{)%m2i#Vh(;UH9d>`=d%1a{2bAw zG4sfFeOYo<*FCqbetmiBxTkMRchXnQkdi!Ld<*Y9mExC@x#asZPQDLCMDD*YF&jTf z|E6E4Z=ddwT!+rhDQ?33tUrF+*|IDjE8n6|`pmTr93yYZFC{)HF97=n<-)YZ}{Gn=&wvPQc`qAC$=aVc`fg)HYIO;3#d8hSO9d)B)1oV;=G3%`|#8z5wZ}z>l9WcaW_+Gf=0@r zx^zG@zE__4qKBMuyM=F{2`%MmwO0;)LkMXPKcpQWU~Zdwm*hJqO`g0pdPXTAThFQP0vi~|HvgNpeEZTtKGRHJv_cYao<%KMxR%h#YiIQcsJ?hdUdZhxOl7N_JSR>e;~ z8h`HV@nbK%Yx-NUc*s}CC6-U}L2~76KD{8OrZ3{X(W;)@5fK>nQy?s8AxM|$$M&$}wi&p;UEMQuDrCDbGXm9L7I_xUc6Im0%t&;(V^ z>vg~g2&wnBf0h@)!JS7KXmj^4=-G?jcjqfVKZ$IqrxT0cdH>IDZ;C(sc`0Lyzd8NN z9d|U^!j{E7cfN8Gjf_k1AXw~~`-fnS|31W>C-r2i^4fV6rNTR!(AuP*ExuMaI`l3< zf?%=H*B=j`HTW)!Y3?eW6LiXDCD)6zC4X;)?rRb9lyirle@@jNKjH1(lAx}GM;_2_ ziyKdti(2K1QrrL(MumO0-~nc+h7QUFbC`nVIer9PSTA405DepFF2U*1N>3htphJ)0 zefy0I_RiJMtg8#UAJ9Q|JFmX}$=K)o&yWRX%@m2{HQo zeGS%8*^>M=S=f8NK4YNwOsz(PE`elPkzAW{w#9ZrZ;>TZ* z0@CTS2D@Np)nvmic7ufukazW~=omYB9siKPZUzNaNsivOdZPROH`Dg^jgM}hd93_9 zN72&YF?{iPzWh)lir@6-_M0s*ckalVI{$T4y=J{h%zO=tv;0C`R8YN!tijuIot7)ip@5#14*eL4QzH{-`n0?3zKkDe&L zru|bFy;1fHc=k*M&z>wNe%tVjE>!W1i}J>AFM)D7T-vLAO|Pn8{!ii8nri>A+1lYPDXm3vuqZ33vgmYwEm^bv<`KlyBJcO14&SMW=6-}eE1 zdI0?DuizJo?>3q3(ucLiL>k27<-2Abnr(Jy=6n8RL9MYZ9M=b#+ixb=5jUFHZ)&dR z>Moa!yMnpBT>RDSQ)DfJI9ATxV_0|2%;y*D|3SzdVcm}$)C9=o_Rz&w?A5xyM6Vl&v$o(Rs4!6-&ZC{_#QTZ z`y7``pH&&}>_fGHKC*D@X}eXy0luhEIX~UWuX-MTcwT_|g_ZoO_hFNll30@3S%+_> zwPWTB)BnzwS}wl$?ALL9>4ozPb=^iH-A|rC={fvD=l0hz+&BDEs^Q z6}SDvFKphv4|&Ad@4tZ6)d<-K%!-KktP;-=pfA~1-ytAzU9Y?=xT7{@O+rUEz=W39Au*}5q!Wy z+<&-YF51j*5&M>n5cR^xXSv+PMc+K@V)KtMN4+Se!22T?sW+W>YL@f zo?6r5-)RBK%-0qUQcpSk^s9Ne#mUTRELYD4jS3jxc_^Q)H3}8^>lhWlMP0!IEjPjj zHHkxk!V5PoG3SjxW;}na>h^Q*W% zqGH(3BxYXdox{I^HK47r)gkaib^wj{!!^w=h%{6aOD^=c@9$6Fee+*m2RKg082vr< zzy0oWK}A1?xGH8K7!*-#sVhGHj-YfEn)naSlP3NEpMwp`TR)&y<+yoxYfR(h*r6xW zmkpmGUj#W1%fSDynzzK|JdoyR_0oc;f7JhF?eF^#udxmRa=$jl^!Ls-Cs&MIG->tr%nAt|?e)@B9*~hQ{`m0f?y#2vffqda_FeG0EX~U1Ahb?B2 zkE#5p@q@{jknX?+R;R-h?0Z}Od@8EoW3Ed28dUj>SNB_HROiCpUw|eKKYm=r4?_(b z$YB794?QN5+Rs*jXaL|jNCOvDykPor#XqhDZ9e_BD%!OCwnLl!uSS~-I{ajAD%XFd z;$w@?SaPVfhHXcFH!#7iS%2qd=e2xb#?^Sxj9zg**E12FXo!5ey2RXj*!udjx4)Ng z&>Jjg>~#!DUk2u*plloUdbX##?Hjx2&Vk`wN6D|dz3O(&p7V_aUo-u!Z!y+BmSMi{ zNu8`k+q!;LEb-jaiDNIltM5(UNQ6J0zHFjh-DmTRbJ#%pU&~wB_K8p>%LQV+e06l; z5D*r<0IDl$5M8Y93L`hLJwo-n-wLW9^W)mD&5oxpTWQtf;A<{__la6mw?QsN_15e7 zpz)*6=m#`^YK1xmn(uwIT>kUu-2no!+a48~!&k}|L8j#k^s`PsZ{_F6DHv4lzyDQ8 ze`Mk5U+(`<{K4-p_f%DX5hs-Xa@3A~FG@tAi8yFPV(IUgprG4+7dJ#XD3Zq#Vtn3A zdd6WD(P~y#)y!j&r0ru{>a}=q*e2$s*7ke91JUzM7&i6f#8~h>dskn+jUUuloCy*L z6Wi~4qI89{se7oEkF2u+P8a#TurxKLn+Y6szNx68YR7zbm=m#7r3a#msXHV{}q0Yu`ox`4C5n&?UX4d&S?Bc2nA?iGk4k zcd}=3HwlZ_-EC zH=_t?P*F>K2>25(TYQG~J%7l9NFMj0ac$_nYde`>=T8qG*}mm}+_4+XlkwyFNNCXXbR?DzVLl3(-k9r ziR?xH5=BY>3d(;5!d7oYPs#((eR&r@+t`0(+srwi*fw+KeSBI%e&#Jdes2e#mzZ3? zZT8Gh$UpNmUXiuW_u(>J`%q$Tt9^>)U3WcUPK1R6jJ;e(O-3It5t}@fQ=CrID*vt4 z005epITC-NlC|&{X#iC*YLb(wTBXll-2FZ#m@XOvXK^%(KQEn~x%3k(+MA8fT^%O) zxUr(K55>2&wP-( zGr)D`d4nI!_Tk4Zr>wSo)ay4{Gq;HRqOMdr{I8V`Z&2+6l@iuj_4I^#`WmX3+^Aj} zeZDaDL1vTkuQ{bR8=t=6vx@J77nkT~qkhiU&w2WJGe5(`FLnM}{jAhat9}~!IpXGM z>HPc|{f_46_c%Y@{G3hC9t2X1zAl1RH2QOyA0go6wK#CP?+P^t8&_rIzu`)}Fv&hf zzQlu?OdB~!e0=gO%`xMh`jB!19tYg}zD%D7^s`Gp3H@y2$ME-^ocOU+v95Yn9Uu5* z`DZ5|wtUkkqWJL1`rBd)mOpgzA-+uUUgidr)8>=Cb5}rZXR-wvYY={JQ|h|hd*933 zw;X@(mzW>kDDLlL`|Y*QB&MI=bX&i@{RI_bpRV95e0mDVMoWFe^=sI`SQNGb2?DHmht(J>-y&EF5ESD{%`J@yYy{9Bi8-_mWSY8 zxQo}RVEV;P?H|zht)y>=OGZ`8(a^8WMzMH4<1=BS?P$=?mL=xSypa7WfMx52Sizy% z=$jj71Cp`T2Y1b#!v&fmtZ9Oaw{hVX?S6K(l_KA|>S%zwgtql_~ zdsKZxMoRZFK`cSpFT;~k z4wL=_E7iS`j~;~j`uV<@a-TC#yUNNVlKd=-hj+>2_d2Y&)>4bDC5umg|1cpJf)_d( z$8)ErXp^VNi1K}Z^{d3g!sDk=HLLU~90ZBm@BS$LgYisz{*TzW+eUrHUCZE2TV8x` zed6RYebJGC*fZLG#J&0G0CN8UK8mL;0)vIj)~C>gQp8YWe5%_c5ZbU)|}LKvAnHsQOxZM_?DFmv|9#^~(3D>;k5>4o?VpU89a^Vn_6 z<7= zqQAqMA`H8OM(7}|X~?o8#pogrDjZYWWxV^qEIXUM;gP`8x3&52)G zw`|DQ3V+UlcWh!BJ|X?`_|!)i71iAbPJD@|V);>ieuc(Ve!ndc_+`q{g5vXE{9*zEV1SJ_g=z>LT@I!mJHi-ZXRYojpLIy_06s3 z*3jx@J4{-AOR7a@_g!_XkpdryZHJ#PC*}nru8@G;c*WdB?UGEApBnDjZ28%J*K!S* zvhBZ9fc4+-S)ZTtG||fPSM_sTKVRgh7F{a+m;UB z|Mf_$8h#>MC(n%9M?R{vk1XB~tOsd{`Md6v22a7y+1Qqr5`j*|ZLf^!E6Gbe{^q~g z=W%zHLLFOPQ^L8av|n&{1JOzpS|!->{R$$Md>g7$*te$rQ>1z*j<|WCgT;Lc(r>wP z72joMN8U%to;WoIc;Ek5%l{UC%lFgzcUJqS;&q#^tUFCdt$(|H|2ClD%Gs!-DY-8d z*55`jd#YR33JgZXft%(SF=;UK3sb^N<+|YctuOzmk@-1479nRjjC!>A-%bHq&84I7 zzlKPBA0X2D%>KIIL3|GQf66cY+sTvDm+gIJm3$+tU2FOAYlHIJ2=Y{Xb@k8xNQ>C& zkK}plT;3`_Z0~ed-uWg4%0FiFr0P3gbnm=#O9$fO; zNA;QutH1eU!jE75eV;#B{c$MGsVIMmZDr%U^ZSoT8qd~WPlZRwsra)d(hHP95}&*5 zg~qzT5>rUPc>C2#z&KkyJpOj=>)iJ3pYTT2eqjHh_V?|U%@*k=v-OSYrF;!%{UwE2 zB>E{GuvMV!=l(5z?3H&-|A&%kHUZyT+6!}~kyWQZQ(3QAvmks9JFF!*wbM>7+CBb&Ct$bcx@Q;FReD0H0(nYdRR?C0- z-WN}51qDgrA6fe%?fbUCF+3QU_TQwMudk@*)pM_XVO3E6zx)7A*`Y_96;Ofkqd+X_ z)*W=qby5<-cWblj*33_=TkrnG-D;1zRj&8Fa>|v|6uP##{8w*uaCSPD3wUY4?Z%&N zJgKi!lSV>>W4*T9=m#W;>CfWCc3WH|PJWKOeB5lddzxDw&(~plXTBll(Ws&cj7Q#j zbBCf=?o&kW;{ZuMhs_C={NH;UP8h-6Boa^6NaR9Atvf^Er=x;6K3M?y85bi$DReXG z_No?SEG9)^3(U>Akd0Hnh-HudlTZQ?2mYh~F28L}F9@P~x3_=#`ZIpcGMAw|p)D&n~iozAv}&Y44xk&Zpzw|1a{klQz$LKs;3E8`?yj!6kdq3{pUw+%Uu7B*szW0oi$G+XMt?3(gzPP?H8W8D( z?>>Qt?``Iu5jw=BW$zcL_laYpG`Q(n__>@r9*Zx255(MkKl8>kx-XwD!S?bSU^vbL zG7jVYe)R0?{%;WA36@Hb8Bkue zO?7L)%H+d2^@|2xS3B^3t<%88(oR3{H^bDTfujeXZs1Yhqp{Quyob(d;7{j&#lVfO zYDWK`82ERew1Jy_|AwCbsq)oP=`m3<~ zZ2WA$Y`kxdRmU44_9UfQ`YpMD?0`Y7cMW1>}`uom1cx~>ipTnobbS<2($<@Ugu@f%f z=PrdI;taa()I%v&J_lf~{ymr<<)8enc&_FPU5X%$bDM8`Vqv*jpzw!z4^g*;zeCc` z4t1*dzVbV_s3UDZ`85TzTrqKsqt*x9(&g8?0#Et^AG7wMBwrw2eqpoK@VCCe{l37w z6*%|VvdQ$`|7F7SzkUIkextY#GF@Hj))%p{caD{xm_(4@`MF29soix3Re4gFBhLPo22J?Z{`>1E>cr|GBWuJQiW1FYt@`JATpFGEnU$1HW`*o!3BPw&Y zEA#jpU71l|X2O>_K^ZyL%PM=ol^yc+9rR@n`?8PwvR~uq@W++E$d|vzmp@|V&;9S; zHR!GQzCrI_ZU%b4rW$~rdg}P2p!dO&)F2P6X($w7a*s;l4mPyVmivE-A_)|nf>Z8( zyUp8+1mCN=*jfZ^aS4!mj%?ac$*<@vhyV8vP97okcavy|iTAk_ovJ1=dwmCQwxX%C-COx* zzfT6>`{&z#e;(z0v*H*&Ih@yen>!@D)=H*ZE2iNlfKIh9b#KW)#m@X$nh_(HQb|C-0vPWS3mp_?6Y;c z=UZ@VIcHue_iTSr{b$xoYcZhepZy#m?|ZLd>C(epG51E>8s3g;A*9mN|EyeR8&yfU zA&s4nH{JQUXQ&x$nV#npP{(>vdZc83lbd{jIL7ks;UgCH{U_a-`%U)P|62R>v@Sr^ z{SrC*gfye~>|MQ63Vc7&;$?TNMoa7@Pn+c)b7WWn6SoO%w^=+cAl*$g$G+cj%s@=W z-?J=eF0Z&rSxQu7;Xve-eV^kI#Wi<2Ho!x)O{So4E+rMWZr4ojc`O&b@Q3J;#n-ZP zD4zoQw{kt3DOvKsl|<>E-8FOOc?+)vi8)_b!7&ayHr!nMZ7n}q`(5Hb1u~oK$LR&% z-72T~YLfFJ^dUg3GJkBj?e}U4M`XB4!nJeZD`-bG zWK%iS{>cg-I1>5{>Y^thlN#WSF<$85phyM;F{TYkMNE9Z-KU!`l^=hWO`<^MarFw} z>$v|Bi2-{HtWz!JkKIB!o_>s(bm%-U_HT$xk0;6xKV=kf^q*mxyih{{fB7><0bLOV zEN-fPBuiZu@9}Dlu!`zNwVxm})@9z}SNNovVc92T69KqUvAz9bd*G6fy3@C~hNWE# zlpkCF+HWC79)1`&u|LGq(z||t^-*;U8((juaNe)MNRL_M(-9vqDUg^xMg@NJ5aBoZ zZ7gB?rUt9GNf?nAr~Tdp^=d6W5hQXSH(Jm9YjmYcU4h*=N{;r8awff&heu3`&$bGh z{qfmuP{Qfz*!S$+iBs#%>L}p^A48!B_gIJTGS9$*dSDavaowG%TP_u-?uAd6n{u1-Ip)ScEyXEo8=7k)L(7g*|IPaG>+AjNY;mgQW z6^m<#9R_vwBeq_6^O&J@`unbTUfr9!%lLZ5Y~J`Osc;1N4PItLFhAVt6-^(7G zzZw{qT9=l-s)`*FJ5nhB`(M4}_}`;i2kS7qg6VValZzF0%*mln{jAZ%JZ_`&AAF8x zLZ+P=CtC?UxxFJaTl19dBj>ztwriC#Qp#NG`7=7s)o%~#?DBaoC8YvJ8Pg*_(fE(Q zCi})s^Wyo@Sxs8rEuUvO-&tw#4cf;?B35r*L_>(rUBnjtlaEYaw�da96AU8w|kC zP?E}jQ1WGsZqC)8PiacnX&FCFD^bdNqRQrk8ic#B7#8!-I zk*iZnC)X_ev6*zgGi=<>Y5EY4j5mb_<|%8B%0YEMY@jb3rj#o274G4POEGtWs) z-e8?~`VC*Ex_wrDGgaUPv{(|HRVaF;_UWZvp($(%*7}}~^6y#STwezxRPzj3@K;EH z=a1+)Ths_!;uglWGLG1Febir1*pZ-=9jRDHSds2mSka&UjblagRw!acRt2*y)F>}+ zG5rf}gfjxBW$j;2{}^j01uSN-i`utT^5d$L4hdKAA7A%pG=+QEn2_%29V>$@=+Y?f zx2hd)D32|wXNs6@uim4^Wp?HqWtqW`XypY_nQG`gPec+Oz*N&d3BE z_vwB_?{got@=&n8MWN4z*taO`vmtry7Q|;mD62Y`H1Am@xMh83daPO42Lt+`x3Hr9 z_dn=mwVy+t_p1*SHj&~wbk<)jcRKriJ%dq>a>S=ix$1iN2|jy~C)5+Izc{|gN}kF^ zq$pm&MhfNsc_ZxPz?1ODGnWylgFkNipR3@Hy9J{TwE^@;1>pVaaZGpS>f5ykgO>Tb zF&llqG~gJey~M=qSC6bbIt#uk2Xemw4c`oLUwzR>L)=$i^wE%x31_!2=)1;fwpH>! zjgIK};djW#mz;(Kr9sj#s)}MxGV>N1Dmh%TuRiRQ!^aWrUO7A=$bki-X^mLYh-k-i zPoXBkeVnFbn(O1`|E3K{DEnc`L|U7+dRZsf+Wbz>uacKu6pWW%4*6FkhM*L^gOlDU z`Z-{zB_Vz9|4#eem(!Qt*)@G^YO19O>W4m>_P#gi{>-1OK5Q@kg;yk;aa5rNNSy3W zlUvX=C9xlJXn9?9{|Jb9savknVf%f!4eFi|+tDb|;LG>i&4_RlnWCqg`n;FApiQW# z2N!Ii)NY_t z_s-oKCf0t1j}IoE``5&=m+=^XJL*|)NbFoqZ+Rh4UWpr-^=RR@X+@)tnBm8{PE4O% zb_e?pd}?TQj&0#fZ`l7O{Z56qtD_B8I;EA`W=pGN&G2(k7$dF0J8yUQSFugp79P1s~0f6ZtbIZYBOxv44J{ zu%7olQsrJ)f7niIgte1KpYirX6oCAU_xpU(JAHqF-S7fi2uiTJnT&+BlQ>S$m9J*r zk<=GRs_d6GBB>%&x7p-)*m~r}_dFN&T`IGvYAaGRhA5Dyq!jY|BY#vQzn$cY-14Vd z3aZ|j31ovUH4_98VOLp4*m}HTBSf9$;q&&;by}z!2xX(rM<2wVrw|*4@S4sdI=_k? zn#<4Z6NQ`(0!u7~HUG8>g5EDI5~K0X0JF4xTxPDmp8BN5&pA`0{L@}11?>g6*r>H5 z*)$^p8R}3^7=MCCy%83Kd*Y>q&|BtzbuW$qi|{c`II+rNqMmPQe1b| zlt0c(wt(T`!<*N)-*r7~k^EH_G<^E-<_k)HyKtq%oFz(~VuzI{?|u~s7ru>E6~X7D zRrqx3U50d49RTIm5YC9WKzmngB^6B)N()gOWavo3~+Z@sd4zu&Fj|}-@?W6 z+sn`i) zu1AZFrj;+gL2txvJHwSKSSga9EH|lIYV8s7*G^OOcrr6KR?NLasmiCm^O_@U8Txdw z`S9kq@C^B4*-pQBeY49SnybzqYNX4>Div%2@D|diGV$4gPS(_SmTu&117{mpj>tTN ze3pa7n$)2DU+(#V(yuNR-ftiehMM*&Y_OG+D>}=0_xRlCF;CoMPOjKc9^kQkEPeWv z%^6;tuALx5(o-klf9IN!{-1yU2Lk^a5D0G!!pSh)5rnBA91g;XFx(S_r7+wTgyTV2 z2*Rl#ECyjd2s1%=FbsQwFdKv;L6{7}L$Po?4EKfMdxB-TLa=PS6fWDhfxnI6vP72S zCjKrAm+hVim+cq|mJRbavLRTO;aHdmmQAF%m*twjd^%WmGtX|;yVRA>h0AvGw~fEu z`CwV`Amwr#H}bbBSe6en&HUvVd@*?Z&H6H%23A$=i{_}Eq%I{datEF*V3PB zFXHcF{x0F~?fh-#Z%erBO3GbHxhpAmCFQQ9+?ABOl5$s4uD^$VjRec4_{$ghV;oZ) zr#K#2qQ@T-M7m&bM(o@tj%-OaKo!p+CbPv+*wj`q*C=G_ouiD$A;iu^CK`I!_ zah4kfhX%5 zxNsv)W|)OSX^`nj9^?mvXHtMmZty1HlA01Yxi_jlk7oq&(m1dmya_<$Qb2qRs12k6 zSZ|KPeMz9ZqXg9Y1j)U*13VZ7YJ2pvBgY)|2@eW+-rb|Y?75IW52U&5De-h$ni))F zb3j+E?bI~pAG7a0 zRm_hCb=l-NWd@T4ehZmf_|1av+$jxDgmv3;s$s}}3qr-ZTsD;s>*C46Xjr$4cf&eJ zf!`jhVR(!gu7eN?VcphTZY->0%&D+0kxPvyWANs_So;c?RS9sX_qo% zCCcBD&gVGK1Jb&IR1zo^4rNn}S4gV+lRz&w#8`TP8@*yg)a)Rc9;Qq_m*cl+?T#f2 zjHr+D^o=sqX+0SzCb>UgHRr9j1@7~1dRXJl4(9}o;aro|tnorrb=M@-&jXwXbyJ*c zzEZrED!~ova$`e4KAR%1vTh=o=YAnQ#vF~NHJi*bcQ^+!^n}{_lf_YkFe555x+Ypw zZ+CI7)(f)w-2a(=C0>3A*+l(OPJKvK{cFuWZ+ zq_<#Ml%&6=nKp0o)#h?6o?Dd1MH`#qz=lT1D>>~g>2%60kFB+wfwjdPwH zgdo)``n=9?8y+SYrp9;|#=g;hsXsfM1p>pxaLjb677h9LYh`{32uP#(=G0 zb%3$wlY$A2b7wG9q~@W_Ftb0F(L9bP3kId^A^Mz3(sKvftQb{YK9i;Ag)!kR%$%O^ zOHYPN8Yy@MAArT)Y^_jF%I0Ot+NCX8%!>opP1$d$kY?0**fDqPcPKpp4)h!5?=|e| zrB^^Bof7Tmb5Qiw+z^-pKcr+lGXgF_Bh11;ah#Gp;GUj})_QW|lt-{}zdxPld^<=Z zJ_FyY+r^wR8+v9(WwAeo)cn%Mth^4x1%%kW+J?t-vw=hzAMO)MW{bs{@un2{xUZ5-l_2VVzDySEO7f@(Xd{)s*oH>+tno(h4s7K z3;jvJP1TtK45EG*;u#L=ODf4BJCq&{>$}G^l=>Z+G=je#F@z#le@$ix9#B7(hr_C$ z<9Z#wsV-gPZo)0M(s>;i3Ws;6>@dI;@(z|+Ul>j1CpbXB)FL)|bx_ZgXqZgBS}5l2 znV9GXK|=DZUJR6jc&BP%x@kSn+;d2crc(zPW&y>7tFfHM*E5Prq5}+Ahujon=+QI1 zz)e~=ZmP;OBBrmeWPM?h>(x5_6vv>wp+mxY`U1n$#0{aWaIj7Qe@)zYvWPlbKW==E zp};TH7x+j}pDb?Qy*H>A!=N%)0_sbBJ}q^wzEAH_*@Tp_`t0Q*`@_xdrVgN%5G9#Uj&qe6QL_j4*f2Glw2&6zX{M8EeHerW3o=;V}LbShC! ze-DK2sxDvCf`kbP@rwXw{O+P0+zi?gG@4`s|q1 zBG$vRtHjCFtQ`^u^T_-9#E?4_?66BBoK8%p3N*A!sz_Lmov~vZy)L8?MtHGy7x{@yW`PM z#eF>x#Sl7v1A1IKRpcn%UeNn+vtsA{yRF<|e`H+4!{T5KU`S~^8#I95qIivq@CU$}cpmk~E)QR|w+F2_Y}muNx~XTviJS%|%-}VYPNDj$ zoQ})`!b)%x0w7`<@+Qo}hV2KDRKPdwkCM-@%!dBl*cjLZ+zKU3D&QtwNdGdE5(^Dz zuqi}9!{ksQH_-2n{XP31aq}KL>W>}|PWWTz7u@~%gMw1*Jn7(n)E~RTew&YZf877Ho5%U@xntKd_ZM(Q@KyY2>1YX5IJ zx;X5Q!9DI;^DDd$8dB(9unzFUABE4w6Ca51P57z#kwq09`$}QMHjgLSoGb+34-IF= znV;OiSZ?aD$Jcp(-2Z7;-wA&V?swOn{&>_MyB=`&_xs~ff1LNn;P2e?E`L1XkHLfP z{$YQd_s8IOeLMcx<&XRQ(bF^VLLr1s1jnK*fQGGUC_N3IC|ryE2wkHYVM#O$q|It- zNDdY_W!{E{>?nG{YHFYo z95t9kzfgE_08+O0u%7F zo7_?Su9Ph#hoS$GoG22wOeAkc?Q57w$=U^8i0Z_)pdqVE#*2=D!9e+x3HXMz6YUN8 zoVy;$nN)8u?U?eiaQ6R@HAOqH$q|h&3!aa2gzxl~pm)?C*GlsY9rvw1+E9p1y|3qy%BC0j(r! z{f0k^4sDn`&t&8B1~iQ9HMOZ>WLGY`GY1}L3ndJf21YZ6c1!<~1=NlPO`GNqHgZ7q zNQK5*+AxgrlrEgedHS1h$9aF;f3v#|@}8dj@u)wZ@W=fH_xyxEb{5_BQGcBG#}oe8 zS#r<2{4tpH_4{L&KhFDOFy)@__s66D7##HV_~YT|`j9X0k4OD6xW(W1$D{t(d8@lW zA01ak^g5EeK%O7z2gz~xZttKBAmpDv_L@ND+8^!t0sovMdPoT^rvVS3bS>m&v6L5m zPi16UG;|jv`9%L?$PxH@cF4+^aY=c+H^$eEjE95oI=Q^xA5TQbvcJFJjwk%_@b}zx zu;`BS{&?d1?)vEea>vde_-lXc`k}i%;g5%(ao6+y82reW_s7m3yX!80ocG85&-!}& zasDUn`tVPE`JcIC=X3t}yno*4vCuk9*JHox!Kq zfN!dVuc9H2cOkJ2KAtpvR{VTedPQIICU-216vX%O#^U5b-eydUFH#t}B`^G7or3tg}4GPoZ0$9aE*uNeHqKX7@E3eI^zU`OOnXGgbt&mTM2yLyDb zN%-&lI(Oam>+X2iKR;S2x7*~)3ID$EJcHgX`Vc?W5kJgO=VsTA_?qhNeA>YyXk`3m zU^cFkoLRFrY}||4A{DK%|G^sf<`%=unvMoqC#Ln zimoE5BorEDPDxtWNe|*rZ{>UOY&T}`b>tz8Mmz#V?u3nr0z3uOZNw=mhmD;WvNk3V z&62i^V$2Ot>WqBgjhsl~XQbC{lx7(;g2nu3v%Lc__YvA}}H5odx>PiDlt ztc`;rZG>ebI{rcEpKgqe$>wDg_GE-^j3URAn}fz&;ezx*o1Ft0bo!w>h3F(jKuByB zInNsj%VqLNe4vS)DbpOoMhM^HHH`$I_TqK{6Oi=MB^#xx*@-h2==?;EsTD>M^FptnQBL;a zedHvcnKayh6PrhhXFBE-Xih*sOmXlB zM3>M6GY58GBbRcceuoGvHp;_Ke9_PkzZYnO_v9c|7LYg; zGBH@%>UZN(>qdii;@;wpY4}2kJqiuzM9~3ec`)N3CJtkO0#o-80%&T42f9btX`C}( z>%8UGXc{)EwL3w#b|>Nhz**|IrU|bkYL`2~er?2MW(srTL@{siuSW5+oTf=Cn;dKK zx=Dg}v;`}+c%RMSIO<;`@xvXI2R_tK6+z=Ix$(ganq;H&lpcce@Rm%`aEwuy(g^=S zw@14N5B-TkJPLkW;k4S4f{2Gh2#}WJGs5|C-+7#E)&#)}dN`7!DaxdB`5Y#SNM^gd zr63z>J4g$L58k8@8x`V(vpZnTl-yr-Cnfj{WeO8=0*la0U#6?TH%C1v);rL|tV}9N zU>`OJ)55JQT2^nxN&HAL&GQC?!II1XhJ(FJ4b)s5731NK)0C-aBsBm-QW<<01}LT} zbpUM{8l>|Yj@Xfbh29`~z!njgG&P~|IPHavyRqcub85tErFz7OJu<}TPhl&v1fovB8yGx8E{R?6Xa_|xQUDYZcEng5qEqu8L)}Kq zVc>Gc&Mis!R?Jh+<}kL6E=e2)vD9d0YzR+QEM`u5kS~luk1oPOxna|v!}8~qSu|7>5VIIAM zE3DUBz<{%1JIm%gf*CX{)EC?9#~Z{%Q|_J|dls&Xfm>Huj4Ot}JujVsHvGLHhKt+Z z8#k^))2<7@=v38kp;dMWIznzj-iJJ6chh5AsZV7Y9?i4SP%JO$7)K15>oHs5aRpCl&D@IUQZdA&VP_aaD#C{llsdCO zRTu*gJk4Lufuxue1qpV>5y_X>I=Y!GBHsL&##T_26!HVxr6NdV#!@8?R0YI= zl~N!aCJOC*IZ3&gQc)00ygLYtO%}!`Qi2cqNGzK}s3~+5!~f=_U@Wajy9A@vEIth8 z!2hKdfQg7bSD&C}@-8MP(>Ba5;lY8l$3#TEv=!mOp}{mS3lGvm1v^teZiZ>nuKYks zOtCXTg!#Y+XcmFPKWT(^rep`8Q9J;-k`e$7=AAnY&H%snTmYUag_B;5h?#GwoNa{b zRp3lAl3oISN)Fg7Cs>T=RC;1W+)+KX1eaI=Ga;i?3t`j5RvE)FM6Jy<5K_o%r+edI zafe)2;$f3%g(;!hVHf8X44f>czGT+qG<`m_%>rOCuWM5?1b?%z)}8tBmWFa8ZbXu! zQW^{z4$g>lS#G?c6dHGL(wtj_4;;Q&|6EiDt-{{5SW--styu+gz#(xi_1Tnr>O*~y zoTgXf19Td8!^n%H>Aal@8as1@6k-Xuh1!k9QWGU7>J3%{@NysyuA2%T8xfnaIU4DK zpULele&ye&z6+0#4-xo5)99NjC&k5-5$IAT!pKfhC?S^&IuJZ(EbZ`KFpxB1{2D%nbGuiDw!x`7*T<=3CHVXKDswh6%eW7iJE_|4UAp^#->XEfEI6eG#)8 z(hg$j+%Vh}`_yEBqbOCPNq2MU#*4y?0~Olcun7)G1!#$!ngEuL&~z2--Kh&rs0PlZ5Hy*oYC^%Csw-3m?oYBSyn$VJ|ZxANegzo^s&sEUmH3KquON>JZU*JLqqielU^=S0)G>o&;=g!Je128R-MDzSyG)MOJVy6~s2lO!D+>QNq$ z%5F4Ucyri9xffPWo zg&qA(O}lc%gbVDbvb^c&Orh|`G^3_WA&~`9jh8qr2rdiZpe4Bi>59hGBwa;Ft?r;M z`BQ8P@L&|x-#}6%pO90_&oQqT2y+lbRItoWcPKyv5~NezE_BChl~Yp;;*w|dOwJRd zH~6fipoqbribVV=O8^|8dW{ODz+)`qRBal{6t77Fc`B0=vH%O9XOojkB6;|ZoCHA&BjUV|5>9U{uU>$ZrTW@s!4 z!q6Qwp`A=KaXsJwWGsygGR+LRC?2iBt{iHNqFj0YkeoyxG&x9RXvS{3WkO_%HcTRP zBWY900IGKlc<2-cP-mL(<%9QjI+E(k6jGcbz7+B^P0B&i6qzQ=pK_rKaKvQtTsP+Y^OzPP)V-RVvx zaYQ)d86-Fcw=aOE;!h=f#Dc~IC<%$3k(iNefpAIy27<&E!+VI*(zF*BaZgfNQB8O? zN+c`lZa=BS#ZkCDl|`nvW2DB0JPX=w$YmU+igLbywNE=jxiRJ^D^I65cupWyGkVsV@&Zz5&aZ*a%3@P8V zH&-Ye3Yz6hBwE;c>+NAP{uB8wlt$W&&6ONk@6OFga|%f_Iv?U*)r8G98!k7rS^8mG zPN{?c=}aODi0UVbAuLG;&89D@y+Y8;ZFK@iyPbIGK=e z4-}!G*`&0o#X)n4K3kAvC}_5zz0-c^Ck`Wj&ir683*&fKo}7e|qWrn9$La)+VCv25 z%*V7|IydmaZ-;A$Oxb4XZ)skI8%1SsiiXX5EJ?t0re>u{#9i`Kvr}URl-AyyhbW6_ z3z{@L>znw9;3;IH51FA@a~4&``$?MRS#iot*bG${)8j_b&4tQ&*nCZosM;d18zSf&mB3bjs8mxKT6S#maqTsHHfegIGVk=HYSMR1f+iGBS?NyV575 zU8($*OT6|0tr0u}1(3_lE{RDL4{q3fV;bN9{C~YIL-6Nrj*ROY?*Jz)p~}dEA11DFU~O$s)nzhU@6!n+u+EKcA5g3!ou{bnXHQd{V=K?=o! z{-+$pqPXb3d4TLZ@1khy!LfDGIrJ-su?!t#XS19&UO{RmbXan}$e`INDyFnFlW9%@ zD+cr^e8V&yQ$@h%9yB#Kcjy;Pm^*h#i|8HDom5h+0mKp?M;Kfot;Y9U55OKjjF+nBYQu~0uGf{nk`XbqgqrA#EN{&7-iOqXbONjmP_ zm9b=`W{b6h%_N3FkHk~RDn?&xMywrzV5KzLxfKCVY%ZKiA^gv!dZi!;p62tQ7<>|D zA&MnD(TuH%)?i_gW~Zab5fW=wtP_XKDB6$XKjtLYIlfI7m+|G@yD$Ng0Zp@NF36kX z`!H@wl2j0l7n^Lt^C*e!y-YBDc8N;}FvcQvJ3F!s-oH8$^qs@^Uj{guY(-P;L!k|(Q=S$ zWQF^4xH?LRe2+o%jp#d0si%yM_ZobGoGSx+j~u9+kLF5ZUW7J~UrJ;ra!Z}-%wQNa zUSaAyMTlR(uOcfST9%q*LfD_13<{gYh5B9cP;){aVlY7cxAG>xoLr7%9Jam?SMmL3 zY5EcEI6Rb$3!Ba1Vz#!%o6K(KN4!_(&RU@iet3Za(*}M>_`uvg@DLmkAU!TacrT-n z6G;3D-jgNI!Q_61*bUk_bIBN!Q&Pl;!n^Sj-#6JRzUq^6n?32vzmAN{Vm&04ylcF) zm^`?CH}C{!@#HAc1)X7{roE+O`i&UBkOiOga4~0wPgM}hvV;-F^NS=YPxlf63`Q6zu>0Q@dyurzZ zphfKe0*5$ZOI4}5F>G;Kn5h$COB7C`ivdqC(AKOqlhVDj^^i$~mfha358tJjXI0{< zTsV>7FD|ZdTWUiagM4LzwV2-O<}_$QhNjR_Oxfaz)Qll;p%Av1M2U)(vIkg9n>G1I zJI>&yomh(umu)`y+X4|Qf^TXB#cmJ+OSxCy?84kZEm(fgEIu44yv6Hc?m}Lty$-kO zoAfS)u5cl_iv)fWUBJ7B5LMDgxd5dr7rq@C4An+uC$xAC%`Al$1XwSxSqz~iieV`w zCMsr2G^2~G)Gj*eb6H3(ZE?Dp1-Ezy#fuP&afOzGX)e3-Krw7VbVdY(OS6*<1=pTKEQ=v#VO?Yuj0T$y5yEs0%( zEmf5aD)D{0Vqo_!p_r6A2{eXn`U>6`*=fQ9j@GxJ#V3Op^J$TrI_KiqK?@_q#Aeewh?x2bUJ`+=sT72@9#w#G2F5xb$qa!8KDK;3oqz>4{M!Mt7 z3Q3Nj1uMd&f!yd3TAK5v#YdkcEdYq+9ur3*Tcl+?Jq}t9BUx$GDJoknLeerQ7lW~1 z(9!}_=^^O{^o_}s$i?f)JC^zEv@L*m(dG(^hL3Ladc0AVvpG>nTTF2<<)T0j>|Lii zv?viI4mhEfuw`dYznlr0dtL0U_)}U&#&YnD!T^F)y~b%)81GE1z*cAXA1xBpgYGHSP>P5Hmf3jLtz>}*A=_t%&cpb@gFIc<)*KEVT)1p)`-mEig zNSp%m)yr*n(W}L!0`{&4ND#V{dbpul zTwZiSQDi{}onQx8j*{E54(u+hcg_+>M%vSWL^$+=Dx&PyLqrl=qzmlL`6upTuQ^!! zoI2IOUkr>A5vFQ_dh79>DlNo#NViWjq;D5SW(9CF{?>202*Wm(CZBxJ$`Go2y){w; zOi^rwx}^oV6o^*G4b&mR8?B~SY(3=IU#kl$d6l6xLZ7Ro`m~z-?@y8`NhG5cPMcS{ zs!7aN$zMUq+)u6ROakZEo7r*ID&%8)m~Ov2d!364=hVa-;bOxo(r_a1o$c+aPl44|BbtwK5GQT(kC zwEE=GUHA<(T17d5mpNW&&rgYDXse7_bbhy*qcsybK9H+HE66c1kOgZ-NnC9m?}a&u z72&sFv?()w9b0J?-?9J=LanJ)ViXUuI+m`hq^d~D)>YC~bfvN1P&L<=yr;1<%*1YU zlLW1mSdRFH-mADo!q!R{M~2zqN zCbT+%=~ibkD^8JJFE1YLDL&%-6SUVyp0yUQ;jIAj^h_ebIXhaNgJvsc6){qO1&Yu< z&^7kpu4tj+&JbSr*s3NUJ86Yo$t__Tv+xX;03ud>p%!yTm@{)%tW^n2!elH6;e_)l z05LQY(NQ`t+ZxtT9j%-IPLZ&6 zXHT^~VHTpzR6ZQ1?kW;t?h3JI9&&fJHAzgBxPiOUR1-J$SDwE_wJ<^0nEs0Q#FwJ? z9G9v-6PNN=o@e>1D7_M%>{8jxc&J>7M^ch!G__qhOJOU{GOc+u6PRa~2oX`ExD?qA ziEO%fk>gqZ>XNY4Os~B;|E%Wf5<%DGs@;T_quoOxtRKa|rM;mX?hJUau0*#ol@sjB zQoVvB!Osu`3Qde%fLP?2grjt2^bda}_FTP6pekxDvMUMIc=@3B5X5-cq4$dHgh=V9 zOU-oBGve1yd{$dWSca{pWBY(SS0)*qKN;F|i(%J`r37ur?M#;BK^GKki-aQz5>(wL zQ%Rt9Q4O9(=kzCRGtxJ!Nv*UNPZe`p`l@r&DrL- zjJd?P=5L32I@&-svV)ueE`;u>n{>#*Iw?GN;enDP?Y6Jp}GyswW1ivWgEnV~ zUf{^5`qbsMR|-=Bn^|Z=tA=aX=7p@M@;0B!((iI4+OEou*VwXc((x@RKmZEcY(o>K zG$9MrYBp2V4AP*jLbAFUw2?A7gtQ^QL%zQ@nX5IIPG;}9#_TuX?1eTBl2TE7iHXx@ z`Kt;p0LY=R&6~7dR9E|KHm-(mOPAKWK36WqnGII%sfdpeMFW(U9#WNp2T^>kjR@65 z0jck#d7IV|J8&pkNke|Fg^22;EnV;yQk!OTgnc^8 z_q0WZ=qT#<0Yg#wC3ibP-j>bzq~JkGx;9gZc+AV}-$6Gf3TRLnOcWu%nj4756tqPG z)cH5sA{mXGMlEg|!qt|+EMr`vBRpkXVu_j1W`37E#iLXERK9+>vQ2xV&(Vt(QwC!d z+qu@S(`Z9aseKnbb-4!Sng?SyU3_81e*h#go^Y``hrS@W3y-;!1;?*0-ssF0>Bw!e zD@heGEx-uJ&rvpqO-{|1Tzv5cAD0T+Ce7En2j^m*1!-;U6;%^8fln5CMsmAd#w9c8 zg0+rs3fpDidsn9r2|X|J0@IKg{OhGxvCm|5Ni+bxPUsDTCE+w<8iBivvLF4^h`IU8 zh;8~yhL;y}jGlTf>MzA3O@r_?Q?TYzDJwOX5$p5sMm&~FGzITgL)~dx=OF8CErT;| z@`#N<&O9fL62X+MVFl7CfQBg+!$T3VJ3YfM!)VizBqBZ?9f@DJc&wROPIAxS6}G zj5o5@J!8x&h=`V#rTv&6&AsHkK+=&xmz zvU9_`wLo(~nOw`eHn=A^4Ar48$B^uDt2hHP;q{ ztGTYo7yo`mp80D_fib<$)mM>c{<)d7HP0*ZiRY2(=d9orx-`+G#7^j2OJlDYWlaR+ zhh4bBr7HCz63hd|`(8QZeResmUMF&FAX0&s15X9s2mN)h0@8xRq2pMt82rKXNBwL| z7gFG7MG2Hy!}Dkz?Rx1XYR@fTUhn(Q^C6a_jjW%vZ9Z3ETX;u{rNF6w=9jYd3kBQUuTQW>)6^yS3H3=~OgJAF*W!2U<hz(sW<(xdh==b=N8*X*G>3HrHXFJy1fXI=%D7g&Insp(; znpT_}tM-Q0kKyG;F?FvvDJnZ8x!OvYZbC%mtS?UwCCnfxM zMyr4{+1HUUPz@ag?M$D1(69FaBxVgQmNO!)HpVo%$V2Np#ZhGl@`qUeaq7~GT);C7S zjKp;VmcWv*c9&8sGclqUuVj)%J(5L>Y>%`~X_<0$FmqBXm8pwck>%T-2<@%}byVq& z4BN`edlt4=+5D*6p>(08^s!2yik|A~ znq(BYYNrvca_zx(XV)Amh2M`bv(7t2oV|ilCVW*X2_-&gW|1t7*7p>DEiKmE@VnYo zON^vUy`-m3(L{Z+MaAvfZO<)Xk`78gFnFML?QrB4AXn>fZnK(J{2qGM5+f-KlT~lz z25&NSn8aNN9t`Ei1r`xu)OF`-105=9s7^6#H^s23Ifm`*7@IcNVcPaP3fhOFK%}<~ z+AVbyCy$aNNv^MH#THE!!uHDI8t?4_apmo@xT@(Z?gr@O^VNmg3OJZ^UyRM)Q0Q$0 zw5!~xGDlxxYlSEK8&#g{Z@4YzYU-#m>8J$$Y1UCxTd8vGu-z?!U^B#G2Byp4pj)&b z{9FXxiB2(5(Ty8PNV!p6k8bR-@MP@`tPFNPsg}?@-3UtMVYeomU22MzFonZ-8ybgW z^om!Y0-;9u8fhj=DiUAmx-yW?4iNjHBdpMk*4lM;5|ZX@TnfB`fje^?>xKzbP{E8?pI zs$Fs??2vzCz|EtHCwHed6GEeKs)o}wSuoy#2#coH^wywbN}J4+m%^qznF)E@RVIR& zbJ+QMDr;WXQbz1jS`h0a1jC@ixTIp8UT>p}ms(@VTMo&mR=qRm9VcN&)$8FnGox@! zxUha}iF6E`FFy*Ymlpr%aJ~>nT9zfiTS63{51{ScJ5m+@h!5U$Ks91msNm6^iWES8 z*^Y7QvlAtf3)+c%$sIwd<_;Xo&1r>6si!170gZx^+}S~gZYfEWx6qHPPEjJ79d1We z=qGhR?H5#Y#HR`4k?37>CpSDSw`|Zc9EB&uc(GyB77?XsmKDpK_;~G~&6e6mF=rTG18)0~V0rTYroL{|684;yp&^yp-vEi#d^wQ9v8o|u1 zcdg=F3r|%aKxOG}ci)H+#ZyfG8x;-(L!v*B#HbYME>YbL%qu`duu-DgRw?u`qVwIv1u7plxw)fZu>XrjqslKv&u-al((_AT*N?MIl$>QiB zWSs#CtVl0F95WPfDo|yHkqvfhiMuykDIGmh(2e54l~rEnhY)qbtO;-Yt&BL(7;M?1 zzgGPz%IHeR?`l>B#8y@m^Mv$O$#t8@rRsHM9xKBRSISdsxuNMHXG8=m0VPZcJXX$$ z(J=k;yh$_Vp&H$)Z2MC!6=gWniKvt<aEJIIn`U^-nI@_IuA@=H6c2-()4Ex z1(zJwj{#AAQGQnZ5j!>P3s2#-D=XQ22uQ`aL8eN-CMqp5;N1UD+n2!4RDS>857GzO z*FwgYCGioVC{rYB_9aVQJK47)$ta?-W(kpLAym>LmDD6kixw(rofa+MRJ3Z-|2+3O z@4Gy6=FaHX|9)Qgb7t<`bKd8i=REs!pX;=LschB7WJxL}sm33nTc1wTxFmI!b!n^C znyC>)k6R^G$v%-P8gFT*cNaG2$tg+tIODV4n(mVPxMEvs z8+E4ipa(%cMqS2GG3Z^wSejK*KOobpOHZm3^zK8HLgx;EcbuAn;-1UR`t&rlZbDHx zp(~C0G{@-_Fm#t{)~g0Lb-t+@nKItHG@jN3(d-YchtqdqwT{z4(3c>GFZpYSNmR#^ z*>17k&MD}}D!qJDx~-_fAsZ>a_$oy?^~~uKe;-VvagJVGJo5A1P7_<{MUAGO>ghFl zPEZw-e5p&Tj$>(=SSRNlF(v5{HF}0`w6kukyYrTtlJ3)2G^R31tSt;fsy+lgOIk|#&FPjoTQsUMtDI8gaaBF2B{5EOp9Yjl)lDh-b4q#5 zMKvq!Y-v+!kc#S_v^Z*XZyM-vnx3U}v)Fs6i<;1cOVtLdUR_C)LUY)e0CbkFOxz^pefck^vakJE^6r2e%x<&yoxV}63LhtROYmT3}W_3u8%Uhp>s?I7k#7hMy z6P-t7y!)ti-ivyZjvZ(Y>s|BJ%)jy}uA-4l*XUU_XW5ZEUgF&6t1?uxm@xQ?dY{^* z)Vx#jaE)+jB%N{jK2=RkbT$$3?o(wM6=5_;?p<>pHq~+9${RkInlGc&u!47=DlK*I z)4N6`^+cyhXO)`h>=$sEQwmPh8SyK z#<$fidXZ)+)nN9j0aXn9^iwY}&`aEv|6Ege$ce7egBPZs;Xhg(#DnRjoI0etlXFms zc=oCvomn~`F1NnhjLj{@ADz)8p1kvToux(EHdi@sk0sxIs@hQXLT)J06)R4mjB8Z3p?snHNFbF~PIsWQUZh0%jXMNRUBR(N&)Nq&1%zu{qi%sJbKK_q zHBD55Ufo9vBm#xH(oapHsB#v%sQc(KG$YOZ%YN1LEp;bLnb&BzmF&>FT&p29%Ktjg zaC6p)4#yU&bg+DO+N0{CS|Kxpw_nxOAzyUZoHnxRQ!qPM16-E##X1qy(68srY}Bzz zE5CZHR&>2p+R>ydjqy06q|T(Ar7x;TbBp;&0ICz=wc$<=l!3SrXQJy>T265acBhQ2 z6LG90l~69z*s|IyiyDZ^B5uy}Mb)|RE;=Q+E~1T#+tU*0mQzJuZ3sS30Ds==gM z)Q$_S(*B1sy0vN5s8OTyaZ&LNp6p&k9Z+AF#mY4~N>AS^3YO{SOj=Pw+XgtZOmrs~ zsbieI9Gv|dN~^LQB`p<8YLS+*C~&8m!m~=N5|5rB8mrnPG=4(Mh*WamPBra8wyXUc zyo=P>!R7>|b>11Gib1z+?MHVz0vSUaNU6sqs2fe5*EM2Cy>O7*p23Scya`AbQnW6EM(yf5Gy9Z_ea|PTf=YGS zQZAANQfcsT)w-@f$;qoaXv<(&fQk@ZB+{B?%e{)&SE-PC)k) z6od4SOQt_K%=5(cR~Kqeu#fL#|}NO`Be)7gq@PSp{kv~YIS zYUPfws^#O8Df&=?5E4~{dT)X~>4st>4YXKor0q?760p(9!+`zuD@Wlqxu6bX|^h$1>7Xq1rJS84~Q zoU*}D2t2=6)?G&tc-E&}YE(IsbLHHjdiAu8iaJ_`M&tF){fIx^+;=AG%IQ2vqee7g zJe7)3uCvNH;~J^CupF`uKOx{uRnm_6<*4SQVRS0xs4}JTGd!hlUT3pNA3Q*&cGvaR z)sX%qsl_=)Ev)tDT%_9nn2an(na7oBlFFiLYHu|4OX+%`j&U2uoGvccc<1?~I?nxhsr65eC%=pH4EM;u4Ub$lD0%j>JktC-M*5$Xor zW^{hg?J?sAuQ5sEpz3Wc`mUVvs8XEKK&O`1$y(m4AgMeYIJzAV*aqwf)F32^1K()} zd&}9qA5?BvGuW3n@8`@d@082kRYRHD4D^0AA->c`qsns)d>UigkYpHRi`#4qwuu^=d9n@sN9^YTd`<+u4K0gss!zo!ZWTiE1)n{D^;|RC6`2 z-$_3-e|l;OqJJ6S2~3#{p`Yk62RAkYd7OS~?EVt8_jK1@e*?!Ejq-ldvFqe3-M=J( zUg;VvkUcJbrxlR_RPs8EL%0N!1#eiP6r{7$~)Y?gEvUqdMXZQl&-v(8| zO25%m4|s#A>dB;bqf;n($?E-vDNyM*XT3^0G*#5#iO1)xj#qt|-n5^fny1e>!?&H3 z-r9kNbeulMq@0RoI#69mOY&8ld4N^X&2dhgIaO9Y43P4VdRJL$3F`6Op=ubR4mefy zs|xTs5%r087oi`?-`qU&Rm8fB=KoO_alVdPMW=V+q*~{R&QOw?0H#bxZDJA&cL$dP zs78kG$JBWT-;a}M1lH-zsveA!G`=7GeHgBJD%S1S%qG*ohf$hUKg8%6vpmmh9*!zD;1SEpg_j!X~ToS%JlacV4ARt=@}0qa*SwFyMn zPEj5hH&XpbPAornY7LWfrdiV9)qwQ0*yy1HtTVNA3Tdwnry2%>oy4Eg74ZG+^3$fR za*u)KYhPmln{I`xM;(A4tUUt1t6GBYbo+;@PIbQ!ziQH?ckY>PETie{^DrOo& zPd&Igz^W36UN=1XnI;O*D$Xkfz$O&8Ra`e|+nrs1nlx66ea6v_jAKYbP`}#Tv~ZHD zN#i?Z7f!yV4X zsA9n54k4h?fMpa)M+`vmVp2EBBWf{|voJH#22ZCokMzllIJnIyL40?N8aj=~RhviX z!GSRnRoS40!OX8G~ zT(qiZ9QXRAj2!D4L+w`n>_`DU4mUT~L*8-= zp&H?E?1LIQqP4k{jZwJk436Gysw~M1HG;*St6Q*^s^Ml;w`axU?5edpv@NZYq2VgO zEKXzus;@?>8Jf&)8rIZC3guXLuX-O~)%4=QNJX`{iM&lKw#fT*o5}!cQ}94#T+g2# zN?J;oN(K2@;mPFMaF(cCH(&WfT`JPfcb^JsU&Ag~!Wj2y9KOYwmsV{eN1ik?9dTL= z)a>)==ftF!xD=6rN{_q2XPKpm<25zg>|e}2K-rx7Vpe0TahL{-1(BLAH!PWP$o$i!@Gru^qa zS29)pZFDXNxNlfBOi!oMAxG#2Lhw!{GuZHA*@Q!P)-gRF^rzcsaBg*yUEkma9TyR7!CcucNaXO#?W)Ux(#3Wmc9MlWwK)r>u%fQh=T8ZzEDx zLI$CtO+6z-&Z?W@fuLD_$I`ta^{rFL>6sZvuB3u5R%zg5+-RCe(K>|4^`%IdT(uTc z?S_bD$yzQvma*8YtILX@jFghX={k|mT-#LC`ZGe1U$QME-xzX(vb@~jG(}U=A|&q^ za?{=ElyGNfh=)Ldl;P%J%AFnb8k%1;ILoHFGc)A2RLLQJOT9UriBx;k(^;r34T<-d zIFcr!f+GM%qobaiKeNfr^>h$9#g9`BtF^tfkWH#U>sX`-aw)xx z)-91olqT-|8N)8+?$BULxjUWzoDexjTj^T`;j=ZhA#;vbZe`;`x;JI2>k- z2ABjp8k(8Fm&0brsnO6gU8x0sx=nHfim&yRf)Y>*61?sqnR0GQP-WJPc+?|Oyc~xx z^ypP+sHEa#rCYG%2(ZXW)5s~DPExr>M!$k)tGuN(G=dfMoU?4Bjzvg8?QmCE3K5f0 zx@BQgV_z+#Z`WP6@TPF%6sT+zv@G7X&ZR@%8qlM5Zf?0Qb}wg#uEa1+pYEtP?1~KT zft|Y?YVsf2e`O(w|H0v!&Az>RDE|#tKli@Gf7^x3-zJ=Y=WR{KO8i@UGJmgd{yBHl zZ7lJh(pd8+GuXeS`)|!8{)4>1TyjgdQ2U1uX){#f9}4^o{u{St#|sjFmre}(L3sL2 znE&?^62GOxz_M$H`>*VZon0mV<~I8;1AmiO8nu@A$Flx*opAhhcJeflpYfx+!};IM zJJ3YpzmxHk8TcCv_~Cqsziu0Cf8^ot^soEDy(=XC{sT3Cd`NiuwH-0;J&AwXd5r&J zxc$vPJmqVN{}A&hFAL{ia%Z_V68{&_e{VSdkssF2llWhlrS*@#9L|5)!YfZm{G~cG z|F&@c#*J6cm-shLWB*qP_y4pdMcJVYg>uw*OK`o8Th*tKe|-HxB6)P zW3PncpLhN7M(T64e zW@9yfWI(w7dDmPcmj9<;tof6#hvPp{?4`XD{(k8HRycpH2iE=|@lT$o@e^-`^S}G- zp%xPVDTCR6Rl@n#{F6UV;-Aq}^T%t3`>*L+!ycCSYXN^mIDdTnj^YykTa2GPCtUx} zR{T9h;{S;G?fT*T?~T|d@>^GM`e)#O{`7_ACH#0>_J4zL{Ci?$KbH8vf&Cfy$8@Y( zM&d8Q`rCQo_^W?=>28VtqApthXi;uR>920P5$(Vx!#*1<@jo$={kJtd{qGuk%Myuy z@D1$04E5)#D`z*5`1efK{E2tM?Z4&oy4589uGeY)NUd=F+rGKKlf<8UBilbRod35o zx85u9Ph^y{(lDcXW$=x&;6H5`rn29)idx{FE>}r|3f)` zB9DgKzweZh<0bsLXL0;z;O|ubmn{p!UKk6#U;k=Zk4%n_&h?F7Ze619@5=ET|1cc?nR^TFlJKW<`p2&hxBue* zt$kJEpFc!v7%v`LSgb%nSG5(H>X-BJnS0{@5Mi{KXG!&z1O_P1pGG4Ep~y=9Q5WfAw25fAlli ze)f)a#gJK^}Tqxr@8$6_lrzx8D} zexVB{6_fC*E@%6{3g@4^V&Pbce?G@gWLtRs6TRkbas0H!LdJhNoIifkezE_4)?&?X zXTX2u(v|Zh{d-Md{tLqGw;q@x=D)kyetSZA`qlh$P7Mja73&|*pnv|Ne~ax0oB5L& z_#eM{gIIshVE)Jx;r=fc8zQ#9uDDkFFZpt~{W-_4C@9(AhtofqA^w_G?|QSufAtcL zA8#6tf7->x#P<6v)<5=jc>4G6bl8^gpFsS76VCtJck?Ps{M$JG5*heAd|OuRzrMi9 zW@kvhx%&#;AmOj%^3QG&uKzieUl7MHZakOsPup<*R-2x49Oy1j_R|2p$0 zD$C;+z<+!}rqn-T8+majY^&fnyY z*7(U=!~Ius#^>Vv&11}FN5lDVU9;&`N&kH}Gk%8ndGw{(2POV9SbzKXaQqj3-SMNu zKNaOqhWJ}Q@p*ClV>07MZV31P4>b=&C4BozZNK$Lxc;?1`uQP=KZn=v#WU#tUazaf z_Ww1kb}|G1>Yw+C{TF+p)<61Zxc)yS&gv)W|7lF~N1hDN|JNL7(NyGbq516${IQ>w zisMhEI%@uS2L8Nve`qP;N0>jEf&ao14GT;B^}(OPe{)~HW{kxDL?gC879M|No}9a0 z;$Ow-7kMh&|0QZntSRw7&#-m|{=C=ciT$5nTC@K%@OLczg}DCe7?*$X&f)eyyXOqi z|JGF+KUyO^e)rkC#rET+$bV`0wRFpBe)q90xx)BehqL*Pnle84M{oS}u*4r>{gVr1 ze$-zJPJi+xDg6dqsu3cy!u{8xsf z4E$9e7$~;?C)}p_V>#jY&urQ8x1|3eetsbNR?z>j8}#n;@*S4=zhwUC{vf~U|3h8A z6#d@?>z8xG^Z#`RuPH30-wa-V9xE2k|7ooUOG*44ZT8>%aQ&MW{ZP#RBQDbXwlRKT z+W+$(_tcT_r-0uWzcBfyU;kMxiGMTJ|6dqPf0O^JZc}fQ_>ZjB`X}!Q=YRi-b|obK za(6NR%5eUjHNNj6@&7N*{HwzGTYtLyu*5%i2J?>$=RdPjg9jx3Ig^=#X;qBCHxg5EGzn{Wkrq$`GE_1Wag1eCHob>b1Vt^&$NHc>RE#% z{3kDG{hJ2yP5y1u>b)xQ@8S9<)BM#_O`j6mpLci5=O|#`8eaas{pKxV{lDTet$)&3 zzisOO)J^RRN%|k){AWKM?!S5U`kycHKh6G68tqpTzhc|xZkPBEjnVoiZVbnNv)$64 zB>vag{>Vq+{96ls@wdd^U=^qTUE%3JedCdS694 z#^hf&qtfXT{}K4l4!8fT({AW@BXDC0PxUI)PiT|E*IgSF!-r@My?r;CN#Q)K~?7zj~@&8TyH?jQgv61=j z3G(Oa%kFa=2hJWZ_Mex}(Kp7<3g_?k#DI-b{M7wZ^T%%t+Hd0DaQu#2CH`Z7XnuQ1 zIQ}mi>zyOCkKPf?zo!1f){W^U;or^tk&QuolYd{Y zA~PiZfgC@PzTy1s8g~-cFaN$l`!8wu&$NHcXNP`~?60~>^CwmY?Kk;vxo!DwiT|wf z+W(pKzoo!e;`rGYY=698(0&vD`6Y9%mGDQj<@ht6Uo-i?y?e$-68~(hpB@p8|Hqx5 z|0(ewn#}$;o_{j&n_S!JPKkfoO3iQI7mRN-%g9R-zf=Dlwk-4c8594pN(r(5cwc>Ozxn)( z$>008qhkB#Ip}XZzhd%lU$a#l|Jv6;%@vq|aGoL>*`A?H9om`DBJqn4HF`H#^LAE+wT--_Qk;^F#V zHKT%9e|*LE$18@{Kflkqp{AsNiK`j@pK$xT4Qefxf8UMM{L!Z2?f09y9Nr<}_nfKu zBY%e5KWRz+4if(X9)B^PKQQB``s`E1`u}2HKb#m9j$h@{d-F;7)u(Iy?LWf#Hx!t& zU*bP&yyj1g4d);AM5Fu?|5dkZe)IVO)BZCH{wnq#CNh4!YB2rH_GkRi#HmvJCi=4e z--hcy@16MXlKwv+{f+hirvCFUXxCZdZy3|~_Ics)KeWSe(f*!TfBs##{-10revyR# z+5*Nm)^D5o=j3z~aSiB|C#qN|K@Q1 z=qa~9CGjtZ{SSomH@N4Qxf1^{UO#89e>cF4&iF}V{g~+R{qAS|9}VZPJ$8WTzoYP{KEQ?rhyl`(Cgu^9XD|l?LhCmK&d-#F4|?>=+SLj(^dVps5Y%>56Gr^2VG~s zaChfK|2B~I#H$0WW|~p&#Vp>Fja#O@v_-*6$>qJ7um zxw!?gKO~;7-ZhoRX70(c?kb?~EWr#W|Hwmwx}KVwTP()=OM?F}l`rdgNWETAE zx=tS>`S01`gugyBe%Hm{4<-J5CVrf{Wyvh~j~0z=m-yBGl+g#RjOq8+eGi{4*{}9D zjBc^4Q|g7M|HmsAt(NfB{!X!NmNmO#kl#%IC(oUGTuOguf1>RibVR_XYfbNZUb<5`RkmSNjvivf%H3>Vk)e|FkZK|JD9Pi7fckQwtO*ZX5CA>`(M` zs{M!q{Bl~+Yj2_aQ(}a{ul6U33jAjLEMGcfBHHlT>H;k6bf3-hR zLf|*^Z(IB4&XoUh%>3uR)E{bpqA2l?pg2?q{02UK z)v}I^diGN(e$@UHvF9zTPi1{4_)Y&c|7gt&DgUVb2@)@)@|*TQzkBz!Qu(8v?@#Pb zB72q<>2OQP0=M_GISo@cq7XCHtM{qxYur!w=BoqP1&UNaeSBzBwlFo8{*R zH-7%9RQ{>wi=!{6;+y_&^!KZ`Nd8yP7smvC=#BJ$rRCCxCI6}CixUFBnSS4GTUkb` zf7J7>u~#i?WRYO}nD{S$w0@N2fAxH4;x&>{KAgX1{Z+3Je@gkKmKDcdx2$8$gZ!rd zj<^0|rsO~Md|l!V%PLh85zt!_m(fyXSi@RswGyQk4_J|Eq{5#Jl z9k8sbyiNrCX8c^RE`{*Nx6^Ah<#rT$jW7e%w+9~y6PpTw`8FN$Ts-}?T#Tcz|@&-X;%N!8!9zi;tZ z`bzez=X+vV@b@V;;Yo>KJ>QcM_>q4=KOW!lgSxr7rOfjGjnO*Yk|!u5(gD4}2l`rM zbIoeP^8uB4egd3He$EJdphKqp^sU7IGRF=0G0zA-(3~ng2TS~RPpv=rF;5CU&}e~? z`y~DcFE#jio)&zd!!J7HZOMO+VSIx9m!HLf5A@wWlj}(Mm%4pU_IyEI5P%PK=N)yb zO8o0D4C>n}huE-*p^-5A@>pm+qJN`x*LUpIq>Pj=5<0DvAH6 z)j@olpOXL|=!e_SC@t~#T^i)aa~9wO9lQGdA`<@uLw}3sxxfedYNel_m-x?K5yZ!H z8sG!{>x(n0N&N3{{2+d@&H#L%n>yy)A@SGe^_AdH@;XECf&RFtkH|lt+E4n>@n>Hw z$KTpZ>b@r7pKb^Ft-Iv-u?x)JEb(95Daem?F3=nFlSiH^DDf{a?2jFn@efY={#S`V zZu0li1qyIMfBfXnl@fo?X+ixXyiWu8K(E?3Y^210{pCS^J5BzbJ8I5f5`UN8njhtM zy7>93|2xMeerJ7u6466rDZEY}dV>z_U8kbNKhv<^=I5Nj2m0f@J>NG#?Q%@4m>-%^8!4%iL)_!S*4l=zo%{DB|O34jl@YwSUhf1S~O!Fv+G z2U@k@x@{7E`;l6Ipf~96r;RBk@%P~MfoQj+!{1YWK@Z9PziIqb z9l*85$>smw?Ys1q_3}}kI?Fo0@TNDY{hu=aqvltm#Q(d||AgN`BR%dZCgFd36A&~a=4o?UhR3g-7z#|E z`M(SpkSZW`Mk?%GY6Gk&&7SczO_y=bt@@R;?tA(&>#uoayn3Cb|7C#}r|NLBW?bSa5u6WmUMuX(iMek;SFb*wGRd7E ziwvDOaU8vBHs_M?#K__Wl>@9x>h^2c*4)*LFFn_IGvF@7H7{sZ<$h|SaGUphJIt{e&c?V#*7OqKB`hv>EGoP z&5!w|ySRUkcCocq|DGv*5jUX8t-D%CUn(yeh2MQc5Guw zelIQ`;D5+ZZaTU2{iOTuizWGQ&NuXDxhLzN-%d1ZCCT48+mO%C!JMr8bK0E!vn2nB zQU2IG{(7?Vi(Pr*T}ggL9^ZlgZ604aS^4ioE*8gMtD5njrF^sgsbBA$b5#8`)u`WJ zQ|%u*%=!!C1p3$1{}JQT+h=V5OUYks)Q@U^n8XLE@(URJ=GWTBg}X}}+N0#ZX~=i> zkNGfFJ~y)rDc)D)E6_@Ifpetv&2h({v`3J?PBwk-UDo3UNq${h>xB6ExAJFi>-mW! z|NL26KGM@IKaJ-VJT>?zQg5Dl=lyc8vFR9lZUv$@AiZ*rz`oG z|3drl;*0bhX8tn!-;e_e`JnYX9Tn@}QQUrje=t6cbcQ^WLN4gN7d-x~6hB{4|3V#z zPrI!izcBZE)^~aTW8O#S)1V95j?PE^!Daa8nRWUK_76%d$gcgCU_qey>~&53^3gv0 z3i4NKy{(1+PX2+{j;sAQT>T;c^?O)<-hU{XrF{4u^ooK7?yT#JAM_tB9)HLFR56av zO!0&AAN0bBzn)O~kLU9LDEE(6x6%5$`%kg|Gs%bFw`z9lr7w@F=Tlw(p#SwJ`v?02 zB^G7pfB1#PTg|H6IaSJEw^Y)1pxi|JGn4+15Bjq`{Htoh{PTmew0y*Wv=GO?@w_VZ z1chAC@)heYmE`}p7#unWV;}BJ{UgW)UDmvFbxD3Fcm7bz$3DR)D}VJfm#>iIU+s>M zYmcLxJK6fNLzhEh|M!T|{*3cJQ75Z^*~AYKN&mG*`#*6=$7d$_c}O;5g5D>4}P`YuKUI}O8$65 z{{7s)!2V8&B^tl5!Eb&=xr6wuvTRNLd?epoUp}RY=0trJoNi+T?qD#`zw+vo27O-r+rA2IMMtbFz^CEsj6?}UH2-5=%t zb*A>SyU>zxwjTVjtdgHF(zoCseFOH7in9JOLqGGY`TMr#DqO147xy7P8}s@LoA;NB zv3$e@?l&oZ2i;t2$lp@_jq>~;%4gIANuH-S<>EW!f+p=VZ<6HqH{@I0_55+B^36=2 zsSl5+T)04il3R`bSLLQ!qX?&Og4@rT;@=z}-nM_;$A15#{qSQ{%g6pwiDf!IGs%Zv zKtJm^t-s`-bsRsscA@!wwgVLYHmQk!^ug;a)xTJ5_~*^~n$zrGnEa-E=ncAZ!3Wn# z`q$+7MZ^!v{Y>c#xuCD_f9+mLeu*VoGswsMZzlP+VNjdq-O{$7dY*_Cf5!0v4WdP(v}#Pyv?URPnQ$WDHY0YI1j zZ-;t5y5!MaU7cUHj_BpkW4u2S_6LiyeAG`YCL{TJ&;RO4`bXAl)+FyA7Ryq9j6Z{J z-~9M|r9TuI&*RVEZDjfP=yqp<TO>F#f}Dm(cx1^_*}di_%6pV}`3)Azgzx+K85$yyQQ zUz^J}P*yXAM2#ymSJh~#^6yb2|L#eXe@%WvT*~-Kr^rL!)+PU7`~l_vcdUPs$2}8S zwyzQlxRq(o;~l5^;}iY6X_#N*{j*}Lb^5}urr!A879W_tP_Es06+h8Jnjhucu8Z{z zX8XC2!Eb(z@deOrt!AkGlimDPVWch}R&LNYV*i@Ny6p5njpc((DAjO)s^1eug8EPA z{axa`KTLx6slhr9@SD_(-vJjMET;Tpj^9>2UvtKd_95zHQ!c(ojRwk`xtGjU^4~P{ zuQO9~xck%Gt?io!L20Nd|I@#Jo+!yLe2W%<{cEDx$~SPAuX{I7$v5-YF7Cfzf14P~ zH_SJr(N{Dum_B!;{g+BU`d?Eyenzo>u>Vbh-#Sv1)%ANlu= zH1U&3er=Wuy8ph#w<`G<{~te2>)-PleWO{vWg7pF8y(nfx8C-$l7G~Qe~ahGu|H6Z z{nMKDOGmz@=N|n>;{q-FD*4uF!Scc4K#y?hu0uJs0J#AOd z`qhN-z13^AW)K&fqyZ66DSGpTB$o@Io4VfnyT5)}%;m!v&cAp+bM#&DU(LN$#00WB8CGO-E+^+%0F)! z@~g6Zv;C8)d`9|%zBp}CKdF59k^3)DCsIcD!(vQLz40A#K~HqN^(;yLEiui3{sqQC zEna5?c_w8x3-pG)4^{M+KWN|Hfd1+IT5oH8cJZHJz$ck@e)Yp{e)(^5`S#LgeM6G> zAB$!w-$Hyb-B)|?WWW3*%kRnlPxAg`v6Ga4l=ZJwpuvZJ`9~rDUe=%YFH2-8KgM#W zGF@K(;mv;eZ}RxVL-0TLH`|b%|IzOP&i;8HIOBWcU()^GTyDQDnxGZH{%28^k9cME zQb+~k%9pJd7jeqBQ?!0)zx6s--{|&tdHgxQ!Eb&=+=CXo>~nE`=b76zC*nWyy2j5m zK9*oWm+l(&x!?bopY6}_iT%xD_iOpki^Zf6^Y=@(zjveR-=TjE|19M3Nvub}IBO>V zLq6zB9XDKBm&!NDNB_Ml2bjA**e0z%vQLWQd?CgZ@%hcAjf44@N`yTM8KGao@-q1 z^Wdd-Ipf>KgZ>}N>(k8kiOFw>bH~SU{j=S*+DQ95^gPe9VtsO~AFAm!F6frDr*#F% z!a3GId_WGUnLnl;ICUM#Puc$?-$?2k_06%4QqEAJ4Eb$}Sg!2Y-?$3t-hIHSVqbJZ z+TWwpb)sSDjaAiewu$+w1OmjC_OWJi*pvj0yd8h^7N z&T;mS@%#S;`hv7o6n+3T^{-yC#aKyx110~a|GWGl+kgB}l0R(c5b{&wC($R@vUhSJ59bp#{eOF#LE|L(kGCiH z49ju$XOZGF`E^k%zN)BCvi@kwFVL*e3Q2w!dj2gwBF7puTFzfKt$&H1og&`NC%~CE z_`QNs{=Hx#=|3{Z*sb&%vQZ$$A!^40z?l7HgL!KN^}1dHJR`wtd) zO!9x;47zzV$-gxyALVC~+DDPQwa#Jxdwu%n8B~9rZuZ~5BmMnH-aop2^IwxbLvPT_ zN|zF!Z*Osj=FSHv;612JlRPhAVn8nF7xy>YS4|inTe41b=J0?U`lp$mlYm^%Rn?a5 z5an+U%18VEWaW3BT%tlPLH`Sul6+c!ju3gB$0aMULt@jCQEs6m{}q-G|5&{K;bi5XwYFwGN&a;ze&|5{ z!h4b-A5`Dv{fFM5j}~w7ne>6@*8{%Zb_`26M@hX38?Hu*WuY~>#uKc=pv z|BGDrA$^gqpy}kJ{sldM&aX%F<>rj=;1tNy<_@Z3zc;{cEgx@Ja)PLlj?Ew%jQupZ6_>aI9#5#)8ex(9W&XnZOtic?+(#yA1KYd;i=S(NRcGG${O7b^dt~ruzbh)ne_xf>r zX`ICFPW`VJi#TUm`7_qEm*hu#YYzJ|S^iRGAIXpID&m~!w&|@ zVf^C&@H=RHf1^c`{J*LH=g9A;^{+q)>+h$aACZ`mYpD|lK7lUk(Yc@`zu!E~5#Oif zSEc$yl5b5TN$TVSpFr>5xb166z8XJLN0j&F3mZpLV@Wt57xbIXeY#5WH;>gEvA4DU zTj;A_{}a?6k9JEPXM-#q?g~5+ z*c1X)t`?ILN zD9ZnpWwP_n2hB^Ck>p><^6~yUQ~sCapD_PB%F(~J`-j{{`_H=bPZ+Beax7xeMd>mQNi|490)Bk_ss{}F0v zkm4sctAKMlH`71J#rF$y=d3T}Yd^q0BYFLqJy@1sj2so_f8aEKIe$+{|2gBe2C>g& z`GwU&H_|`4vVe0!Unj`iFJ#Y;cl4w2&6N3@PSfe8-BgF;{iD1-IKsTyrtj`emp(1& zuf~7Xk^EDSBk1(?@)ycCH4dy!9QXwK*2HOXN&eVdnB#9{UsA z0Ulql_(eme{I*pIKa29`lgIL^O7iRT^Nq=Ivi{l1|1@%=*gmPhMEfT`{{JSw^)0*C zOZs<&{FnZ3^2@(ldA1~f?af;M#9mo`Ub*bjcka$f^(Fa}Vp@Kri7da>gzV(s*sqh= z{+xOf>t9XIzbbv>(ai0i;WN*uE$RQqQY}AP$*;eczfgZ659qtS@(uaxot&=+N%DJ) z(j3V&^3Tn({vFnHL_(7P&`_2?QP#f&&1)*%lcNh->cj!PK|5_f?E^`^njca}^e)<1Gw`$xSe!LR?( z(%I$TJKrchPLi+Y|I`uZ_z9Z_RC9qipf~7WecIn5$v@2HTe7;=|LBOI{;jCVsrpCu zA(|(p69+zlZaUh%uq0p2FFMEHI{wvr9Q^)4{j25~os(~eT+je_r(9ut?T`1|V<}cM@XVBl7$E3MT9FPmzyZE)&O7hkGr8*KBbDrRt(N4t`&VNA1NqH- zZwBPSFQD%q`CRN@305`bZY~3l&yAIV`5r)9bhLQK<#K6=V|1Ohx-peEPrRKFH5s{+nkc`HN`$EjdfCAM(pb zzD-;~{YF|J@-wBAzaM7GpI-TnYbE*9Y5d2&F}?gK$&ZanmG5~}f0}T`bq`AEyI~&X z`)9qoqsDvU@r&8d_98;xF|5*z=ShCc{QdZtD^HW;zcrrx|DtzyB1`%359pD~(=L|Ux2k`a9HLT7rx?Zuu)ZYD<7Q?* z4|1W|nsx_nlh&WzIgI2l%yHiT<&Xb_3UJ@JgWHa4UdW19E(EbItyA;y!jgZsFDCgP zc+rM-sLRM7c5$(Xd}aRL>&YdRCHYSKcBCgiT0<^BRl8RmkPrWWPJH5x4U+#YTHhRf z*IS>lo!YnRsI7^Gd1{PrfkH0mu<`3 z9iUa$pRrSFpFH`8CtH0Q&+^f}1#Ls)>X8z(4w?koL?IXSipv(Z$+_=&IYC=08A*|JcxCI?iyYvdF{hRFRm}OZn z=yXy0+xyEA)T7b;G`~uxYDYTr#q`;xGu;7P(CsyzIVR!f+FC+91AdIK)QNU%oIa~F z-GOukZB#GOP^GWgKDT<2goi9^-y=GG6ScJ;kRw2`??1}zuT^`x27XP|0=S?DXP!Sm z!f$R<`Q*co*2xb4r|LB3pxWDM4&Z{`aekvI68_juRDSvJ6ItTB^+_6hq&w)9Lk2t~ zrT>_LS^&m*)cOj4{F%>L05@KW)@{?7?f@?6WBo^Ul<;r6TuX@f)?fJX5&vi>A^!0_ zTl{+E-u+v`&yBK#y*k}DQ8^{yTbn50=mdUrb8$TpdS26=FG%>`OwtmPef2<1 zI{e7d;+8srAE(diOm_em^oQRMosjTV|4AM3GqwGypX9gyYx?eQ$5W6#iHR;#J zewXUU{r|B4(chbh<6C_%*6_&#+W%^OhaZ0_6|snQMb&t|zu&;xrx27opf7D(HAX6b z-Xj0U9Ed!_*M1>k}{T60fD3I8L)Px$Z?S>j_|O1AjV zF1vZYgl}Cz5+3*2-$17W>;^UM$GWF%@pnzj*Hprfx3#RO4?mG5KGt<*i~sNpd$@%E zjY@wXel#yT`@f}eZ`BS-cOczC@2*i(^nVHRf5L~K$P#}J)xXKE>G6^8LBH#Lt62W3 z@ey@k+(oTl@#nux<0P6p^*`(eJ<<-)`!?C|I=ZY(G78Jzt_)w;jCc!TRbnj@)vf4zBpjvE0X={`9yUj zczsz4J_Ufk{NHSR*W9W9feYGcYln&w{#Lf%Iz_g>VXYwk@Cf-TWE=^a02kjMyR_YQ z$^Tn;{ZH~EfBbp=KSA}K-~Oi5A$7e?Tsb;O*d-%_-Q?y52pS7R2R=Tj%Dhj zxl{kcZqV!QD)WVeuf{Lcf&H&c{F5EW)Y8256Zn4hMR~bW{5^WLz9ZgHw*TS_=y#v} z&g1XC?~rd&*bTbBce~<}{Zr1@oc1U=|5;Tveqz8WmOATGdtAjsr2i?FI@2A%1+BC5 znMWji^?b29V!riX6mstPjJdw=-^SmF5&gyWuXAp8;OQA*fBbv%6sUjfp#>~;o^1IK z`@dtJY|#A{^>>d ziM^K9XP@qWBrec#K-HXcfU0y+2iiXvhtOA3|HE$3$qOp}EZM)B{U7nIZ<5+S(c$!r z1D*di{U^Qg-9!n01Nl=O(RXG4cjNq?XqVqo=e0(8thrPF!*0+u6MD6g@bBUDx0`AF z#T0Ln{gIywS?a|2L*!TbPG`CU=??niS7R@h(tl-pO8-}>{Na6*5-sHPSL?Raf%I3< z@tTMZ{hR+k>;`?fYWYhf`!^82I_&>xT!rJepI$xctPhJ^U(`}3){9y6**P_P%75U3 zR{Zdu(y-a?||2K2`$M4heuhxV4<8SMrAbtxPpYZD= zKs%R!3wrFnwF@Nt-(p%qw4%1(#8=}VR&_7_Xeryj!$0u7IRDh1>{Um6rfh!?mBoDR z?MLahe`EiRvGw;#_OIsk{qd3-U#*|>`ycJk#6MI|(fM!d|EsRtK19OD_%r5})jX^p z|Gyf4e`-#NmJOlU_H2#dZ2c25%y%LiBr|E8&74N3gU*Y)k|3tDkQkB;C(%M6H ze%45TkH3;@sWaUHyFr_tIrA&Y{sy!^KqBeQZzuRY8?YM`^V_f=ahVPunt|qjwLv+_ z{)_L_5^R1yhFYKDxBqTxZ~D{wSk2(~boj6vbjI>Ry(If@qxqKD1D18yde-1|?OMJ{fsOPSelT-2GchGYV*Iyv{|Im4a{IF%U z$NW!Q+5g;3cKwfbQ9Azv7qsCSqpM2zH>&pMYrgh>8ho_>BkU-&%h4X>%Pv9OgZ{bh zt5~(%+_Ja<`**G$uCL(v2CNTCF4KOnc|G4=W<>sjU0%vTvZlZV-CE?y0TTXts&CW* zd<*+RE&p%vKVJLx7zzJ(v_Br!U=o ziE@m;I_Uqs`Zl-zJK6Ya^2^ie{gx^5f1QDkbV#oGZ}A&ES*fCg|M3WI7}jAT{geDY zy8kNu4_;(+FtC>W8bU4HyfxHDA9Own)uJp>?T3nfnHcF*-*lNc(CR~ z`eVPCB)_lczly)#N_A{1;V)aD@sm&L{GTkO8$|X7ZU0oZe;yl%xPx7$-T02*L1SA+ z7MJkbar@id&xzlIWN-X$@t@^bpZ!5IMv9C2=lAm+2v7b5Hzn2X&%YWEwQrHdp z{Xd$X-=en$_}D)n%I}Y}c|UZdzljgK zOuO+Nzk_ybb$Eh=KLqK|>5e$CAJl&Muk!ztv)}3^;jdpF^nY|F=YuVr4*ya8|L38L z&yn!IW&dOUa5w*N{cr6*{KE5FB>b7|f8g7^9zOZVe~bUe+Cm2;{0&PC|Np6Rle}Lz z;(s0odL9QD%AsuIf5z#TzbN&8c1_g+BM<3xSN)9q^auHB{KGC19RE=L4)lr8{>67z zFXj2z%NNM|vmBnNIqd(>_?zx{Yn5dGFQYYn{3P+Ccb#Ub6ZXgHvpR7g--AB#MxnV9 ze(o5}kvvI!_#626o(_M)u@U0Ba#Ncc3T! zDYmQuJ%5M&uhIWIvnBQUE9bX<;PK~ZZ;g*~1yrqzRtNB}-=@ba?EZS(NdM~n2QFx@ zMJM)1{8wlRzy9@~n2)mu((?dx;s7paiw7p$EZM)5 z?6)`Oc>VuAvi<1)*JgmTc)TXkh64z|Oo0np>*Bk`^>+$i9ZB}PY5xh@zb;bOD{s}h z&lr7A+*iao)i|K~o+-Qs?gE86TD9$%01B8q=!1-|EH*6 zic`DfR=S?-kz-v%`6AH(rIn{Y?B8z9S}6Hn?T?tC@y7}YjUVkVr@z`a(T^YD@xpBV z|Jk#rmX_lGpQx4_eO=?K_5c3z&z%40O!>oK{^5CqC_M|HP8|3I`pvq5T_pU^$^Ytz zyy?gH{5S4QoxZW9wElXi!l#wo1 zW{1D%4XtnNFMU75r6v1U7Pwd%|GvKq#qrd9-uj<3_*nk~`={>K_~@^jz+Ot|U%uaT z;LAe7`rpOZ>EGkSbUmhU{Q19fEiZpZrWdqo`Mz7%6|`nl@qSn30`ver=&A{Ki2LiQ z_n)W(?~gU{KcEQ^B^O7w>+ygK8oMZVqZI!~DgGS%4|F=3_&p;*{2}dv->)=&cZAVD zlzYJczRcy{tLIbk{z}w8{T7k!{e0}Zax&a@JF?3v&Ja<(f-8#gd-^ZqtE%)zYWaJerpGp7vr=a zfCC!A2c}QmUhaU(|M3?!AMi`hr2Id_^M91rA)_V%HU0lyGmRVNb=wA9O8>X^yM0GW z@wbT!sKgXG|NY?0Z_4ji4+)n4)A@UJdOk~?IG{Ja@3^GZ09F2&`!lHZ*Y+IRKY`aD zMh9o-f7E~0KXUv57j$Ov{bf%j{I3oFtNkexwuhg{5Y@4ui*72_U3$+Iv=C{6#@gKu`PBaNw?7&a zkl!D$*Tnzp`}U_u`G5D-)c$+Hm;Z-m7k@W$`eVNY;DVa?#ZG^wwuIk-vT<~`haVl5 z9sXE;UOOE=^Z-4x*Gtc-^l!%NJW>9r_1`uP?jiprvcyOHM}CmYKiCht?&u1!{JCtX z)-e8*KmNV`*R9kTQ0bevp@5~%7u1qRiibpuzSD{QX%Pdk7r3Cc=jK{c{yReTpE@GG z{YCxl--}Kq|M;G_!FWJ~)}pI3-FhV8YU!4>>ZU|9O8=DogRh;g;yIrc=W*ZY8tqSi zzEimx_4!j51mpb`@&{~J6nMY~9rI78<&yo8g_m>YLYQRk$-)g_7v)>}y)d@VCbWvxv_TPBM z=t2_yQTRUtew47)3H&%=t20~tnIryqP{POS-t5VK|EH#Z>}J|ul}_MCZzO%_OoxxS z2Oab5kz1wszn9W8=8yj||1SP>>QWkp#Q(|9!yaU()yd zg@63j&407WUOIsvok{6WXSVn^-TmQk$$o2q_E@Avxc?)Btxn*_30s}n;{R~_>Eioc zzK8u8{2wK3bpk&@*y_v{f624W=1BIJfc;a#?Y9YAoxrzZlpb_uiywdPL^BD0`L){r z$qe{0!d55nqlB%_Z1HzqUV4m#A7T5gSHta(6Sg{mA0upaW{dyr`ai_^&m^_~)DgcX z96v$W>I8m*u+^C@{@m)Fr%Lu0)7joitO>_Y61F;lZ_T3gr!!mp+12Zc`}}?NW#yV$nke!IDUe#)d~CrVXHG+{K&#C;`~pP{cm3sj&D)j zuTJ1wRQIbhTl`nYpIb|^Kgs@&v<%0O61F;lA0cdYW{ZDe<2#>~@He6S%YdIGY;^)Z zPT1Fzm!^@w@ZDc>4z)z4a>P*-ELc0^RK>ZKjmfD|NsQqc}^ZH-W zsag;8yFfGbzls>`PvC++vf=fgRR7o9|F1d0CHMOJzl@J7peFtX?*AsQdY4Z>Asi0CE?cq zeyi~Kj}f*yfuAI7b!Lk{`KtSFm+%jA`p4IX%#FPi^yI&fo~JGIb)tN1Re9-X?lK)3Ae)L#|{J)s; zKb^o&5VktA#s6Qcvp$sYb35qrFLqbB|D%MhPT(gATbHk$ z&+atw8p-||uz!07|Es-reEaX%WV<@k*^hQ7=*#oV*Ol{&u+^C@ ze&5KgS4jAWnsfQ{qrd#~=D*ZLD$-WbKE;FI@%%@08N~ygIAAwuzO_Zf_rKq)VJ*A0 zw!c@g;QS}%+mpW*w$zz+{rzu+Et^gph&#|p7uB38_PvhX2T(6tMnwTrcpL(yL zI%;cTeXk5_?c4uAt?Ue$|2ZwMdv(eGRamb5v&L08{`n8!APwMe>wn~Hbuun~XZ2F% ze?F{!|7Hn)Cyzf_znmogw}h?EH2Cm4=vU*m{3!K58YlKl!_9m#noXMgk?ig!9Q*$@2251crm>^Ilnw^R1N4=c(3TeGu& zC$Im{cK!G6oBH>V>{s}X{p|N_<1a$Ct22}RNdK~<+dV7gzg&9$E&7(X|5WrgZ9mF= zQ0zZdTdQl~xfDE)g6B~9=al&W?2<7vCHvR1{fXlmSM5LLUw?t}$L>VW_t4q%Y>E}% zdJD5WN{2t}%8KVm`0D*a>WK0FXX)^*vPCR){#*RKJ0dSPp!mc3SFC?g`)?%|=UBV) zbNM%4`vDONs`OF^{J-(#uFm)963yp)@%=;GN3w&if7JUq{ppYAJR7NE4?ZTWZJmT6B)@&D{H8uJ{I&$B-bemeV;mW~_v85DMd_HMr6u!Ntxfb1XY z;YSzC_Ma@inf}{*7TzkQzuJE)xje_({*R8!L>heay{0Ca8=CtU|FXtj^8eqX{L+L-Qt(0l(>bg8x-<9G&q9{kCPlp;H%i~FN`*4E1E|~P9MGdq+h056qxzpOTd4m}zk{!EdA^nR z-NKUupjdBimbb0>Ib@Ur@b_L8`y|sQ|I91s$A5E}-q&Z!>>z#~@4E$D(DuOLb<)gb z&3sCyoBfKezhE!y2YqAR6%GCP#~HuM+93YcH29h9$G%~v{qV!CL**a#dv77#|zwoLc{?;`3ne0bg!2VnmfJ}!ET>Gpa ze>~gY^wuDL-W@vs!*0+__QwtTp$BO553bze$3M#Hzn$to|FJa<@vG^1gBKJMtaq#P5oo?Z-#{ zt7_Vx20xSib_V+kwW=-JAHB=4fAzn!AN$s&vw!>4pB|Fz-@PP=zcmehCi@eH{m=t+ z`rj>|^y4G{wMF^MYUJH1+n+K2jhFKu@cVAxaG`{MHT(}ZoFslXZxB zGcfF5b8_|rKXyX5pOOEO@9@3rh{x{mpx2K$l!)8M20NtgdnF2Uc(cTcii&HA3R z!;g>pKi}u#kAnV({h(X>)`|J?k^Vi< z{(%~4@H3|Wx54}uVR^uB*SGX(68?JlpYP9$%l2o&kKP%y-^73Xy87=+_fiaQtOWt6VGLk2UI_t^X1~kp>^>P`mW2Q~dZzZh!Bk@ek)f{^xyP zQSO1F{K5XP%w?hc!FA*}^glo+e}3v&e*7m#=>BKl)j|BNY49`EKatOa{)Zl*#jfjC z)Q^wyr}0>Hl(ZgsyzeaR2F;ZJW2=JrsCSSbYF%~nEI&T#|0Rfj)cBl zZ!i1}T+kgQ_qCGnYu{_wzd^Pi{>MJS%;m%Bg$Wte;Z}{ z-Spq8?F7D?|9Jmi;3M5Z>z7y^D1VUtgO{@;(AwzX*^2 z%-tBo&)XDkKlX`Ev7h&i2Hsx2A;I*kqVEL!znA0xH)H%^Ya0Aa_9qPcBa90=Xla2b z{OP}v?XP=3--z_z9BzNQ@)!G7!+z9zpydt^nBd2MkL}-J)_-a6Gua>cF_`|a8~XhD zNsYdKe8m6PM*lO9_q|5F2a5QQr0IWP-|Sp=C+t4X-%ne&e2E|bYqo#w?Lq%`rS+aUety5+w>{A)^o zSRno6!}I-)yE`5~^MCnmOo^oxGn3O_sQu;qYi4u%9n;TvNq;`-+r0XZ@n1hZKmOXa zjGyEG;HiB1XS}4PGs;ILrN7mU`SDlWvv%oc{NBU)@w5IVo!BZ|8jqjz538K|r?x=+ zEPsXSAD-LJ^e#ZMNDtd@qub;0bN+Q8=U-U=-J6{LHOXJ_ZGQTRgS7Jfv3c`P%>Vh$ z{9|o__}3(V!3p`}f5uCC>*-tU9Zx^wzdY^ae{FL5*BF1-e#klJlQ<-XC3c zOFVw2|7NHDtt}A$n$jPvA^l}HuedoLKhyt=Q~y@r+zhL?Q+2$MNeG-PXsu!SU!B@j~jHiFnU_1VPg7q)Uzg|cwhUq3< zQ~Ley^YfqiPTKC)6^Z-5-xvKuHNl3q{HUHod>x*84%DxuzC-52Mn*059zyx8miiC$ zZ$tn6U*aO&^s44NC+Ww0vzPrgwZNuN^&oU;MLxF|{R76O^eWMZh(F)#Je$4q-~S$& zbs;X&aUY*@L6ZK`m@P$r;mW$X^UKX_n}5i5L)uk>)!*faa2n2U_ZwONa5gVXdQ^{u zX`s7HnSRoRd(^2&((h;``b3#~P40Z{H1MhVh8j{mcUn!QCC00^dL1ece)~G+(DtI= zA#|T6l3qFQIcOmI7(xpf@{M%poTC!ukM}>C#g-2vB){YGmvsKA>YI>1<3t@qf2Yot z^O41>J|f>KEf(M9<9iHClE3%+*$`5#?E0FX&ls1#mrt|t1%u^&c(EfZ?6WyZe2E<| z&x$t~DDTDc{K}NvC9k%SA>T;%4@Wjg!neaIHUzK2mR}cNjpUc|!T++ZQ9EN@`y9$| zwXS~Ip`y~P{=HRojoLznxJYl={Fr-^@TIx~-@7({U3_l*r%RL?KaG3-`4TVx{hILc z{U`IT8`UV`{N*nvSRdj0#o_Di#D9=5ATE!eH(Wb>cWMh6;v&8OmYcs#s{i!-%5Y9}exZ5D@{u(I zspfmU{xdj-H7K+GiDRJ1Upzf@cPVj^wjXruBT4etbcp>j{ZVrM7UCb}uMq$E-o?dd z;v(JW=(+up@ag%NYQmF}@ww++y5(hxQ(m4&`7IWojop~mFSNWQseBAlc@h(Dl`Mac zNdv;Tl%Bbnv|q9F0ngZ9K8AdnUFw<1@=X7MJQp(L8|mCJsX7FZBpjm$2CV1ldSpe~628X=#^tlJI?hi2W#isI8w>zrLP{_Lr4zX!((< zEi-C+?;P<*`IOu5B=3yaDddL57@!fsZ!-@4@u#UwS{*Uo}aN+xj?eEO>ExvU1Kg&PQij^Tf z^@+!hk@4FGs~)#{V4R-_rP&R})-elt-uZl6PfN9&HKg1h;KO|}{JZlN6Bteh8xF^h z_$)`t@v9B!p4&BjN%7GG=TA!mX?tV%%u|02Up*uFR zxEbLe@6Ss;lgvNfpXVdM`yaCM;I60t2L93Az}$NiY6!%8rU}F7UO%`t^!F5~s|sQGeAuR~$aK9tLc4GxziCV8e0qk^YE_^sTv` z-tV@-GT^I#e%Ji7WxNx^mo5_DyU@pFIbgg;F12zQK>iBlua6HZK&P0h#)^;OOdW3L zzaKkQ%EYm3#e|p7C-aZYbdKU;ph1_YCwg%Ne0VJv@`YuO0l}*f>7wXP9cK zUuvWI)38W<-GL)0%g5IbdORsdU(eb&&-bJOepG=zf9xsQ^C$Rz63WN;^90|lD1S3W;wu9_Z?pXT?Sb;a{O!yL9qQq^ z47AQ$#}A3~kMdVJNb0|)bZ#Fr}%1^FVJ7@F-gjAkEnh&FD2vK>`WW9j~Hg4pX>HdL)6=zqtBEBh9AU5_p(oq z7}>C1y$x!CkL}xUzO=u0%lZY|r2_c$-bXcl_OGnJp?sv<+VsHL9L{p{OTIhblQLgP zU)|z}N%8&*^LK-N<%|1F4xj&WGXGqB?B}`qFyq;OarEJci`2sp;ydAh=Euh6kM&FM zVIqIkB{_Uyk@((5IS9ARm%oP~m#HiMxPBon((kvuW>dwtfaMPD?+1MaUo3x9i;CkP z^%?!re0({5M$DJEa^~`nd|Z87s;}b90ACvTMoalf#q!sCr8sTP*zZWB4*f;v3P{=3fRl5RG{q^5^4X8^+J~r0&e`^0S}c zNXu{KeA~XU{ASPRs9$16e1U!k`jzZ4km|gk8bA9tD!*pa{Bl~K<=1KV@L7(y_|E%q z$mWXAckq29?OQlA!e^Ew=kMC$3mrYz95DQF@y-3N{d0=1vxBcz`Y-8wB7Et;37^|< zaPd(tS$-Z~v2DF<`2arZpLCb{FBo6PtU|ruznaXyRkGf!#?SsWW+&z&^v>XHy1Z-U z#NCg@_oQs!i1Vf!cgda)y#V-F|J|weU#xu#3*eI>Xx8|k)XNLn=gZ%Qz#TyT7(YJC z5f8ukzQrcB&ny4vf%s;Pmi}q4I=TCMQ%jTi$NPJI1kjQEbIQRz$cHuc4~UDj$)Sfo znbf{Lt@vik)ipR@!+Whbe5nU*K4!K!mPyXiiEwxI{qsD@1M`>i*ZblN7b^eCac?i> zZ@_6%KlhIMFPS3ot*QTFezNr=`Qzeq-S2BLyIq`rtpBRI$(N5r_ag?cC-YC&SJn90 zzs5X9Idk^wKk2xWKlm(1T=(Ub;|^;f^@}?{^ttp;Q!#vIS#kJYf6eBvTaWx3_d3(v zt>*~P#dpw&!&@ccTX&3n@o2=qbdmTtzm}eB^O5o9`dx4@7GKkK4tqQaU!&o|zZgFM zjpF#n`*+DF;(G+;gYJd!QT|BppEhEmmXAqTmuLO5t?)0D^1=NnVUhS)zqsw#XUO-| zNtUl}J~AD|#rIF$d(|fK^1f%=>E55b8s#_DH^1F; z@p+CzH?P}8T7G9Z_?D`|L(iyuq>IFt`qAcZh<$C0?pw@X`5)VSr+o1}Y1E=xm+}FN z&d~G!7C89sIZ^t5=SK49zw_7lwUN5c;iRy?=HHsXL6pCq9=IunxJX@mTu0!(YKGfunUzcbQ_ENO z^Z1_B&EI)t*Bq6Uzh7J+^>ZwLGezP%4*8gI^w;L1e5`H$J~nN|x=Hxzihf-thA()p zIQ|{Q`7Wn_|KTFbzct}=`FiG7TfVROYMlFvD@A`T^<-2&4D=|OucU7NZqECIksjt- zIqy|k!}!R}-`XEL^iSg77L$d4F?{JF@l}I=c1;K zMfrgIIcy?4!~Gp}Xxy>cwu&!s_}BFu@$pQA&-<`Ae7k~wnJ+D$7|+q*UkH3Dx1ohc zmw$5~Z8$cGe|;3+vk|^bk@$XroUt4bUp31w+Py;j%asp&_}i!hCMdpC!+iN`K3(!R zhA)5~FY6Ujw|;4~jSVM+UOe$}elqoyeedywLsyF)w;B)hsfka17cajHuzyGOi+#Dj zp5r6)adG*(FUJ|s>$b5)^Ohm;A%4Cmt-uctbjpb{vg^})&-J&>u8{gK#=mrt_{z}F z@Uc$GaQA^+`Z({zZ71lD@<;mJqFrj@^2hOI^(Df;=Og*^R~E;=+uz7<#~AM{y7#r= z6p}yUB3*Cmv)_p0?)Z2o%ZT?4*yU9%AXhzrRzRhyjJA})Vyf1gx*4@dZd&yxA);=3C-TztoYuXHbj zkNhK@cyIrkRsJf#KkApLm;{eR_{`_U;rjvQlsL$T8TX@H54PbH!bkp*j{9=+Z{qx8 z`PKW~gU2F#=_2u6hW>px)Z!q%`&e#H{$qUP8)@6yd+Yhr8~ETK^@sHS^YHNqpZ`U1 z{L9_{0X`AmOz@9-f#eV0lM)x{qK8V~R(yezznci0@W}{YSR}ru3do;}drkREy!}59 zcZlaN%ZJ`y8$27~OMO`!|Nd(EaQS-g@)O1=|7L)H#8=fz@I4pd^S&w$-@Ny2IdIFz zx^G(dHLY(EAL+Wm8QJ>TJ^x4VpA27&@MVg`cLUln7vBMxzY0d$bgn6XiSOy{yKWuN zU)IlhKV?AWW)X&9RdM{=qd@&!EIto{M|{&iocXEdFXfT=^!~~)hR=Lm9KJ=*Cg<;? zXn)Pcf872O7wJ_MCofLopWg2myb|Sax=4I03*alZ{v$5(Yt&ZkqLe5`kf;CnT~ z=l{Dn{{3C$mpJEM-s_Wi{<8geqm$r!Ey5QTiLWK*$AgJBJ>t3jQxbx$~ z&bj|^nICWL&W|51{PRvIF?v3KTtA!V^82eBo3z{;wrVGl)7ZZ0l@hU@)6cz9Iel#L zpZT_N?i~NLKFjy6A>T-MKXUV%gnzATFn`bT;S0Xh!svbh5BGdEK!BvYU%-bu@n5^K z;BH>WTq62eikJ5cd@c+M!bK1{p*B_Owg80Bwjb#eR~ zjQL%zLoK3f}fJ}chx`}w2v4H z-H(;V{)qG>i;r@a1BM?SDDfS5_YGYYUnTA@BfgU)n9QIke+|w7BHu`L-?th+``4HT zD5vHZn=Uw;UE$99Z%z34{+q*QZ?E_m4(sP&q_n?FjM)tLTcwM{*BLlMr~Dp>`RCLc z^vB(DbL~r0eooSVX@98j?^U7}{`@C7f9r`qHGcMQY=4iVpL0ISFVBf}`%(Bjcg{^E z96oJ+&8>0%m16#CPsMj+U4CZ5BJs_j9^JQA&KSU(oL6XM%U=awIMn6es$H6Ioy5Q2 zeEG0XN$&ox6!g+5cci?(OTA|e_EB)1m(DAI+e5w=;veOXI7@!1*Ep$ut~gipPlwbo z8|-4`-1{{-e>V_+YW(b9*%ApHu6|BS=mD>(es*zxKl+%3N%|$Kzw7sn?w`vPz{mUN zh;L2$B`#l)tQ?8e7+JSzr_Z09bU&J&&k!_=@C7)hf%!_hw)obhAK~(^(YTg=68}`c zIQ%)nXK)TMagnYyKBwNvF%CZ{cXa>u=sG*9{JHv9>-7`<-523Y|4sPZbuZ!|B|g&i zhMYTT#~42LUwVt&r}{Am(=)6DT zBE9CM9ZpEXr~Av*@cx|t=00=XYfeL4q!0dlM&kX@7025z(%R7zBh$@!{Np`{oJZlj zg?B*{qn7g(Mt-X${{s1~miHz4@>?wpagpvj=8VMqlXd^Bnh^VXb)Rf~6Wya&-Z%ez zo^{*jKQBKx|C#u_aV?G7)e;`lrqsq}a`!tDU;FvbK9iKcWzs&V;XX-=FFL=mhbH;W zD310r&l8WY|5o|WyE^#yb)K`4$sgh({kZK}6O!e)*oly%zT%;2w_xdpj-xB0+(EX3``Q2L@wZ!N5 zkY};P7sxxc#FvrZYKbr1P0}NlhPX%@jBjyX626th=h^a6h=1M*!Vj^;my+LViO-kc zYKbq9-&qU(rFx5hu{6X*I=0S9cO~KLgZvG)u=sQzrTow7S3V%&$K`Ff?4yl8k8_@v zIP%z8I>K@Ph4B6M*8PK%@ag_aH7V??EEZp8N~uvxeCesBMlJD$my{Z{#o{~vyU7ic z@O9hG;tTJI^RFbwzbmC9o1K51EIA?eZ0WElKm19hM(uUrUnuX?PQ?4*!cwF5HolkN zp;#LJBHiz?jprrdQ~iH69`ycI4=A3$CnG-Q(Vc>qzm@LMMLw4LC-p-8tW9^b&%QjX zE%&tl9nF)=+pHlj(ht_3n%I6kKFRt|{cQQ?;(NNv;z>9Mi>zW$qhOs649{Od8reh~z=esS>?%Rlmz{Nr=6{2Mf( zU1I+wtG_M~edw*b`2H>Y%g8;%jPF!0pC2P7f77x~!1r4V|KiWP$#eYsLi`*3+#`#V z`tNs4khb@{NI%jvv-!;N9jW3LQOuqHy9w6`*0uf_uiGBF{HH(49qHj$Kh!lTe`lU$ zzX4B%e)GUdAvt|8HO}M+or+PN={#8B6)U>QmdFM3C+V7;kjIXmb!u!;j&5T<1 zuhQo?Giu-1RsxTuFB_TsAuiHc7oB!p5#sGub=f;%Q(O0I?rXj?R#%s=}(JIZ(#G+Ur+kWV*9tV z&#CpB7_~ISMf&WG&2LP?w-WpdagL16)5i0+*#5J3Uzt(M{0;9fGinDr?M)$kdu}nR zP7=QC{GNQ|VO~$?@#>rC{Lq!k%$WQfA@xk0pGLb(^4>eIG;4R;&OWCm$a&df>+fax z7sz|HH2g){<(PFxB-MY{TqN;b7R~RORyLnm?~&^KUWxoGM+CWjl$Zx)yj=ItJ;Q3h z?JRF%>7zg5BK`WMYxhs$pU&^82{5mx^C{FIsy z^JXqS#gjfZ!uQ0e{Ac&PSQp<9+voG&#`b%BoA+(8TN1wW#@R1Yw^{yeadv+G&XM#h zFTzdh7_}=m%#UwRr~ki7-mAQ&ygFIC8qdLIa)!HD8s;nM@r%a3o`mnQY4(d?imjiM z_{Y3bs{D&T|6Tms@7sskCgCeZ|2h1J@wEXXNn5_z^}zW37}SppmT0djGF9u@eCCP_ zX`%aJct4Q2%&tE$zm7xyD|4ZBmu4r=5Eto?raR=_UrT%!-JbWES@kFJc?a3`AQzv( zy}E0{_u+Xr=G`w#e1mYlDN#;c|IhKydor1S=_iu;=OIGUN4<4N#`AYN&wq3HSJCFr z;R|=L<;&$C`O17GANWk#`r*Us#PN}T-TuQbEM4>`@i8A=d_e*J5f|ytU)^0d3Ey-F zU(E)8j(_O_`5QcxoWI0HdO@dGUr54Nc2s`(EyF!CEVral&Ckxp^1%GlOn24^$q3q>)SWV==u=#hq->W*BI#soe&%ULhpkdB~|>IW*>~@IhU!ot-Qk7e2;bC z0PBB@|D%Ta?IPulbo<@>PP%?y1-(`3XZ&=z#MwW>m;OV1b#nN8?0=#j2JuxqePs4$ zrm@9MKC$1byi-GWe%JDeo%7Deq5kVJLnMD=`20<5xa1qDCH=W`VSTOu)&<_?D=Ko(7#!U^UJ38lD<$(zb`C+?`s(+*O7ld!fSLN z_;g8r{=P~5FPzI-4*%p|YFsnp@7L^iy_=>8~wQ=1Ofi=>(^HPx2LnQfN8p|eiD0D6_FsWu$u|01~ispR?`!R83_h2QTK z*3If?(F4o>9XkJCOIM*-2Ow@zT^CS8{QIGtXD+vR>|42iih3zX7x`y!o(I$G@q+@C z?>xRtj6 z{GojCJC{;!NJp${_H|PE-Mz25!v&}>2U$-_dcVg{)wIMnJIu@*QL~m zxMj`ZUs`$Kx)q!a_to>h5f3kTo&w$1BtK0VAm}x%H-1vjH!O9|Hyk1Jt-%@5`K~FP zH%h*fy7+nij(fiAXz1thK03nSe7%qJW0@~}?@~8^_WXR*pltud!JiR^2KPqiGx}R4 z*Z({}lKdxr_k2sb2L;Z(bo&b~Za#bX!F0SdZoe6dzt%awalEb%-Y@cx`rK@tjGyN> z5`XS|HS_}*Z-DSwPqG}o;nb^b_(1_m+@v+9bhsg@{s{rdn~(ZO>W8F$wl`V&^ENX78`<;CIuXtl)|4zm6Upbf&O{CIf5b0fKLyqq5tpiDRE z1{b}$OOpKDF7luz=xzG}cAOT?&z~k0nXVtFPj8U53%AbCfA%*i6Z4(-FQWb9`yY3d z@M81PHum5Db<4-k>z`_L{N|qD^S$UFWFCpm56Enr%zsUn8p_X=+~4M$FUk8e-0{bI zui5;f`jpF!|=P7iqB0f){xYlN#LjAk*6b0bt)|rTZ z+O*Pn@%oeFm%}DV2#-bbli9vF`3diXJm4G@;&>DFB->e*!;t%;QC>WLP=FFQX~T|_ z67R=bhwJ-&;`L7?KWn?b&-HTUwVGn}CER4N+|Yfmw$r{<{%25r*?;aY^GE43qw{n8 z_Qmm^{hZ&OpNM+N-_6daGk%^+Nq6#kH4pMgyZ$mkK5$Ge@66g;{FFqv57w?f)_`Y8@^w9){Xy3YQOaU zV=sRGAKz|uy}FBCtI$Utv@lp%JO^PV3F5} z(fq1`9uN6W>hix(`R$1F*V4|pfGNxyn$PTf(VFm=IT^I;PaU%RZ!4Vh*;M~1>=o5N znIiFXoa@R@q5co=UGZ=(p9AlA>}UE&8`M4f!Fc;M9sTFqME?Exk^H1~E>3=WqCH9h z4*^Vo{G>)%K2!cVFTs5!Yr@a(NUvCY)>cXVhmFs%F^3N%*FU@J#OIq*$CSx^)nb2> zMTB_$ae%zn=XCRWqK9SgSJ!g^Jo&A*yQ=)l_x$Ex9S~kC2~TWclfOc9P5%qC^KYIb z|BuxOw(}zSF&&HJe|O14`4R(gg=yf(iJE7Y7npg zdH&R>l#CxwjOw4%uEp_xC(QGBvn@Xfp%VQQxBef1`&f#Vf3VdA2zaY|(_6>OZyM$I zz_EhAyl(FNK!3O5@Has@B_85$&vRcfe@Ho4_NZ;Y{Pm8_dRs!Rhb1ispo`-M>5h*rV!}Q-%@^W_mkp4M- zS*+!0L|w!A{1o(5+3u1Kl5w9J;%9rrdp_)2V|acs=T9gHFTVl)&$0RA@q+@C?@9M* zH6nZeX&ao672^CA)vrzUmPrm6e~)DO;rVvNfAuRCk9+=JZ`UP1UK%gITt5nXO8p-@pU-qE4*y*R@TbwwOgZO2J>dBFT)@t=i+@r3$@eDV zUnTg%M`Q9|B>t%=M=t+~-*@m&cl@sjKi@N-D*R)5D*j66d^#iR)4}5r{?wku@jvb0 zA^URY`Z(tg&T#w_7r%2U@smEX?!#%tKM?rKQU6yc{`nDpf3M>3um4!G{10IN4fhCB z{@rv@u3g-Gru>jzchpLw_{RZ%73QDoj1>G&MflC$#o_1v;J`V*u&t9W;^euX^uH$l z6E|tihWljK?^3|u8TG#}{10RJGezRBb>xA36Q!fe{JR814Bp;dFz*~epD^+PlxtUQPM!P5-SSKP&!b%nPPTGI zxn{n(lzb$t_&<#Eu}=N7J<|obBF;a{e|{fKIR6rr zpNu2_UrYH7WBC33i^K2M=j7i4r(84sXDDxI7g#>|olE(i^qDIUd^+C$=lE;O0mA>6 zBL15Lio@^XWc)5p%8x5=Oc%d%X$2feZ=2DnMESoO{Ad4Pk7o>H=R0N!;OF^-)d-jE ztlR(J66@e}C(gC)|C8@b|M)IX>-z8dOeg#QuSorA{#_z_pKQ5OJ-oR78_#d>PL=&< z2Q@QyG?MXxoCBGXXaB%vW}al7j>kiJ_V#aPE@&Y9I7S>#Yi2@uo+{7r`4inwlG#!A zLYyw&%lkq`KZ~3GpS^l@i;|KJDjL}On&ZdCQvYOLihTM9CCg9q&8;8uzc=PX(#}0U zeI0j>EGnSaNdJE{^P@4j`X?_;edIJtnIId*5 z%mW>J;CFO-wf864^U>Y)>sMv|Fcrg}!g+KY_mcAbM9R;v4j#tiLr#d3eEyv0b`?4Q z@8WNJRrhA``jhgraH7cnE7AFTKK4lxH!08GBmSli9^!B5xD$WwJgp+}v)*F3L+-0A zQ~cEbCVt)DnUV8npR5Zx=$b75E`Hu$n0DmLH-SSDCq)azy`J$grNt%D2 zIMjaO9b$3oIf4yL{ha>c1DY(EKTf?M`z6J?`Wn>3*SStLZyqA`XY8C^Js(HwTYsUP zhamR3b~Zfoq99XSz?8$C^to3~%HH2>aQ@&V=szg_;2P2Y#QBIRq=Rxp%JUH^KZW$K zQji}HdUTY7ixy+NIl<<$R{%GinKIG`K7IN19Yub4J{Q}sRByrmcAeb$g#Mv6AK0TH z)qS~oJ|_9m660Khd&C)Uu06Y3_TP$SdltxVwQRr4Oi7vA0*3Jr|9}Io%%0Cn@5KMT zL& zv+HMh^Ka$A-*KGk-$wZTBmNrxoq5mli#8nM=eXG1Y0EG9TL6A;{hjhN^Wqn8i??5t z|F5P0U|x%bf_=hH`ZjbgEIBqF;wG}^-tAGU^0NT- zC)=+Q$*3@X{$m0Bx^Gua4nOq3-TOtku9w-$_Q&m4#_-$kFU=^vGhfBn8T zK=QxL(Z^tPgB^GBaW(e86gz)K{Q=VRMowH2uYW3s9G8ui_gH>^x=do0O%@|?u4<+L z{zCfa>F4tCQ~q7O^!f$XE17PW5;y57SHAS5;;(S!I}(zZ@o%s+&G=9DeJRs1W_?vVf9dZO#nGQyuae(m_5 ze(#^*|ESgbUaR<5JNScjWN$k+VMa9 zFX8vlppkx&K4Pbag1;8^57%El871T2)9aW!aBqU&!{XY1>czXqgKi`4#4=a@apBQr} z^o~{mKj$q;n{&K=LB71W^9^k8n>+ixS_4mR+~2_VgWP^5lfiIEr}a!Ho)5a+KK6?+ zWBIP<4~vQ$yItmq#*zM-j(g`EBrjz?$ZH_;La?iQ;GeJ^Iv=@ghIJyI-kN_wUS-`yJX_zNUKFbTmOgq??^-9R|XE!GY3l zSIGTIy9gCIcvCVeY*oi})Ms%I<=K;3B|@&BN~z<;Ne zd(|_KmtXE5C#EYKNcj{w<#Rm|Q2tiBw=8MJpLghx|6I2`|9PlPaK!yvG?Dr|<^R}+ zAKpF*|M`>c7nw4vm+9i)Z-~5?`XRkj-K^z)l3<6rMy*WN+4^Y5y2caxg`@BM70Qd* zS^SE97wPjW>dJYTb4l$M(wvm3$LBRptxg?~5(JxA!~Z*(CgWKZF|JSo!%g_~Y`V_~XxtKYre<;*UQU!e41& znF`Q(zwEJ{_8&Zqe-}W1@*xS&+$D82=IvAcY&zKPl6v@2gYdS7f4Bdzy|aGAdUzeg zOaE+lsYgxsa)j@LG96>jyES|M#$1F`jrq^|(%zW6;aP}(Vlw_49Q>}HCqsC19_DGW zublXE`Wpw?dfLMW9hc<$C%>5ve!qHdi+?Ns$6@?V{i~jRWc+v!V;9;#8Nc=`)YMpF z3f+IV|Eu|USpH5#|BCaU`#&#Jpy_WYa*^n1&oe|X{HQr=FB z`W>kO$^7q%@W}r{`Wu^Lo|*DohVQm<+&#FvdL869-}C!temHI$<-ZU7l%J!d{~1=- zFxCfoiX<)?3fay`&-XMVBVl73UO{7}W;8TdW$U+>3A z9aECSZw3~}|0>8K`3(5RU6&;PcwQ{eIVOJ}gIr~B{xRi;-!a^9_xrb0{BtpWV|F5uC7T)X!P8PJX-DbC7tBjXMt0@j>jlsyhGq`qBB% zC+!C{X4UxD)(DF3Asg#UA*^DF$p$@0VVE69KDQ{#RR z8=Eo5V_!+8nXPBY$1=oA|HL)@Wn16+8(II9|8fQhI;P9*?R5Riy+84E!EZ9L{Vzk3 z@pJzp@e`+c-Nwu4djH$vad8fD+==u4*Yo{*2#D_)?iHU5YaU;}qx}4Mnv~y6gg;Xx z{-*EQcs*x5=;yEU-C2LF5B~xDGhZ%ay5P=yaq)Nj?3v9}eik|V$9IwbedH?c{0neCp>g)lUV{0hV6K%n;_QfahxtgpyZHAyuX#t6A9w%qo-%&%pN{aGVa4&k z74#$n?3X0FURY-3C(J6|MB^y;{43&Lh4i}p4W@(Prmpf9CdvP17YhDoBK(;m@qYrG zln2Jc{Zr&88E7k@)Br;rDBblb_?UA1&?FKbyX9<%jO%-*D*r(VgjP=lCbzUHskO*z4Cs{Fe$} zV))I7;_$cK$ks2!Lq2ubCf}X-S2fOeC;kd2oI?2L{?P1&B>Xp>E-^nBlm8;|x92=F zjN+ez|6<^m8tV+TO)V9XoY@h{`y`PwA| zr2M`Z$&Y_(arj@jAN4=vnc=$os))zkSLNY@MNT;6w~zP4fAhWndRgTM&W7^SQSrYV z;WwuhhkrWjb7%i1_m3NA|G2xa&;yYBpzp{1=EP6jq>VbBdz#{31o^3i{2V0s!x;Wd zk@%N6<&J!r!*Ys!j+CEAAwRC15Pt~&h444-aq+2&f0={-JE?zyMG^l~rx(ZnwZ$K@ z{Q^$PRU!P9U;9~=69h}P6J zxA?gKg*az@4nAX@oczztKcA299Q^dRY|Jj1xcqSctlmEt1RSNyT*O()^27Zj#LxCL z_{GLc{EyADIGHa@|Fw=g)3xV3>pz8jp}dqqq)S2X`t98;{|7?RkL`04MhduIe3z`yyyx@X|N67s|OTjKTbp6R)y+heVi|1}8T zL;ruy&f;+?JPXMbiGK<3_@#E;o*}TG=8hjHI^}}69zpvXLXVg7;vqmj@6_YQjTHY} z;OG4&y=1-Ff1R;QSvWhH{}Uvi)R6y$>YrB^TX`@;ET4(<#Sg4I%PDcyGQV)%6gvnN zHoDyUbw$@J-dFq~^d}AYf4k@pd&^7AgTLAE{RzqV_1;4@#QzNEsixX`&%QP0j(^LrenkB3eir_JY;yR`Ictgk(q#Mr^e|og zsjaPl7eC#J-#k{Q-Kfzc$MhTRo$ejvjTtm-bj|3IoxJJ_FLEE?4Hz@5U-`D)NyFQZ z8rY|%e|z!Pf8>BZ{rbyS2aX&$e5AaTU8#zxGGSuTI`6eTEJ? z(d#>W_|Q&XjTie?{EqBDYRu5l#f7Y4S9kE*_1L8sfO_MZp+(Xj<9|Cp>3*k+&z1Z+ zy2P}>zLWI1Hh)-Sk?Q?UdM{)-;@fPAm7`!o>z^srQ?;g>qiLcu| zD9`#noK~8(?tP*yww8CI2gq+sOY7giQueos-FaUdo+ojsEoAtHw4$uCG%0=A^-T%H z!#VH&%XLmov%Ah&Z2JCl$vKJl_uc^gqs$dn&fN5swzm8X4{B`GPTbT!XSy^tYL|7+ z&%Z8};QvvLjVJaZRfdb@_mw-^_vTPpX%;&h`NjO4T$LZ*n$pMjTRy+@4viAdN51|< z>m&8KO`onqXr8nF(h8k%EB$fz=sDA%#H{1I?@}JU51yBMXHSWq_51fUKBPC@xWuH_ zjo$lmS#$k8V(&|%ewRfV{iR%z1`m!+)Zd$YlKm$5mrbAUQ`|q|_e)+jU z+GS7f6;rH=pOo7(s3*;3xc7BV6xSwnjETaV}6A6W_g zj`c-1MGf`47frV5lxikxNU7h=`vURW{9XFp+`mV?b`gU=G)x!idfj%K8rNTE`fk$u z3Ez*>S9`%9r!Sq!@2~#t={wN2?`ujQ-;=I)(VffU>6?!HTXr&AILof77bd4~P4_RF zi8kG(;5zS5qM}Bd--GkpST&1OWpL1n!owxN$Cquk^Lj9qx4l= zvWE0M{ogHrX@tL~^znTu68=@2t+VGlrl8lx_4$+gh-{u3l|c{Z>~maBs`{aNe_{>7 zbM-*UUsrFGa=y0uq3oBYTS)`+y)+t*VYqbu;@hzeb^Xje|3&W)2+oR~e?8UapVX>Z zL#pk*rq#F3k)9~@_Tg+gay|?0iMFTL@Uj=xt!|C;i7^%mms;JRiZ#>bgUlgr;ii0~wYOFdKb zK>qmkL5!QsTQ(fVzZ~I*m@j0z;8QOc?jFJqiF1i9@8xhOS%4pvpv{K#$li}t4*k?p zw10~alK#}NNIx}wS#tWiA{?gA)k9^xJu#0H059dCH_}1qeS?0n#@W^Cu69{%~sd=>E{u<;A716XIunFkYU^#QjXn zzlP9L3Jp(LdJlySKC?*S`B02QpoxyuXm?+XCs!ofCnGK6=OE^?-}%``U45{x$vD z`se;T%JaS-=exINLO?r%dZ4%V-X-sRZ0>K>@olL3$(Vofu1uCs>i05zop_JWHTmuR zu`4aE)OFUKeC`8x_D3mi`ym`R|GGHtKGH$r;RnOtxbKQ={lfQcQ2sus5|_s#{V8)* za{9FWQ^WMR_q5ozauf&hHT{%LAM@{hxSM&loH3tjAfL={;yvAQ-fhf= z+jm#L`HCshWByL%RY+9`kYcg%NZ`o?da@6PnSzEi$C(|4#7zUQRJL%^h8 zwRpL!rmqb5zm(zpmP=*+AZ#ApzmS<;T>iDe{4@E^=rfKxdmin%E{XeVnC@EW^-(@c z@!~@2h2D<*<_Cy~d|(6qm(^9|qC~4R-&qVo`zPh;d1wYwxMtxPrvjTh% zF0r_nzJn`lKAGRFJL|1o3*6`M4fJQpKjt^%>5Lzw=gi$EyMM#O`gb|jUmx9H(kJ?J zG^uNn(?|WYN$^O0GXFoo4R?24glzv8@{j8TNw-7?_s{-yfzXJI{ z_=VEPa28HHuYWv!)c<;Ggp|L>qV)OK6_-92FJKw>UINP1T;`vn|K;9G!1TH2ov$f< zKX;$mCMkW*h5f;kQTn{=i%TEZ1(_dAUm^XlThTA2-VEjQhd0n(LeGZjbM?jwrO!vi z4M8HV z+jr_upE^L&w>U~)=EmakuTcHM`ZLwshQs=W=VG%SVYzhc5z6fBw*<*y3)m+B?uZ%LHCbo#HQZ*A+()kp`+CFRgfcV{LHl=(;c&e@By`)}AktAYOJ zSgBvarBV7)H~qErb>+GE&ix5)zB2z<4~Ii-JHz~Q<nEj8=a~ARY9b0dn=gfnBA@gMM_uuW7|IG7i7{`y!yxOBBGLIGu-=dAy5BU84 z_qRQz`V94Yn7rFBfb|JZic+?HJasQ)wx0rH&I^xXXZXJ_iuV4oQK*Hw;t z1B7!p^{AZjKKBQ*f6ehe(<4Xx~@ zj_Kq4UC0dpm*W>wo@w(A%|QBErKLQCb#nSi>D!a#lloOmUm^Xf#mGN{ z^O`81JdeQp#kK=X2lx4h(9>eOu|D-{aQ+?JjY8?`zvnT}YyNqdKV$lCQvIuyk^WU` z##*M&(ZBk$>GP-C{BzUiudwcJ`rPM_ydJM=`g~{n-YX^fH!0d57TjUeN4}Hl{8EYh zs{sRdM0pCF`Io)n9y;|!Dfj0=KADc*kWUZwR7-@PYgc9eXF6g3XBGVUp#3NB`h7P4 zus<+_d=8QM!JrpQiR2~LeOT^Db$(FS$0(odk8s}?qA|I8)j9u#{S?1h{yaSQae3!h z_X-5W{Z8alXSloV3*&Vu<)7}`{?;XX|FC<0gPvdI)kf=Q{#`bI$q`b`Uui0H`e~h* zzs~;4|J8X{OeZPRPx{1en+;6rAMpINH0F);{H4b7kMigC@78qw+rj7N_a7>yfUxaX zI{3i+=YI*{_+0emDvCG!`{;O>k*y5TvE{R+;rm&1J;-EqE*4|kW;!XXX%PT2O5 zc=}T)|E)zoBfPVYS%vi%|DNRZuR_Jc@OaNQ(}QSCKdfsJH|4Jf^n&T`;e(-Q&r;KD zJzWX+y14I``xUC-UWWG7+sxt|2zQr|U!>Q!JR$G?ofO7z-K4*o>K0r7xi>leT>nWU zqUpeqZfo0H#y^Mabg0Ma{vWLWaD9Y)Nh6%lsrUPTZ2PnHPkG@vNWsIFUmhcHD8r}o zXXD@NCG!sr-1={k6qK-8U8CpgG>Mh_E2M+OGN|+^M^ER_&eCqkJ>T@x-FeP9daeGx z`Tk#U!h6o~PyGn*1JUE1(8yfBWj>zjb)x5tymw87<1oMbKH2q^RDH`g_OIuN{QI+G z=ikgq&VR0tr4jBOBa7tx((trc`*)vBKl{g|+Wu)>=p(!jxPG@&zWgtxd++>y=yDkVQC5_y z-dFrQi}_pUzi%NK7#~+|>gB(0F5k!B16GbO|K+o++2@N}=VL%+Kk4Eb= z{{6}M&-KGJ!aJ=%`+uh6&T?2u_n)l%F@IiVexm#{|DU0M^e;Tb`;y~cDF1!OY>57E!0{Lef~^0Zeh{~stW{mUwCI{dfu^S|Y%sJ9%sJ!zSB=eUfxmoLh9-xh#} zbNvnJXMUdcUVgn;$pku-?&Nc$Q(rtf-u`j_-NxsL9Gw$O|Lo$@{~*#6;Jy+@pF39y z=Rz?5SK^$Uz~ReH4!_8kSx6`O#q>Yn@Ua6Uc4%ij^Sd60HOZbI*9PMo>aT2+5|2;E zE8kCPh5v&^qhAvUt0NK`gz_E*Uy>GXOT`1d?DU<$zS9@^K%@}`#^c|8L>m@ zpLF)9JG1u>ufqC5HRh)Wiui`H`Dy>bGL3lFcK+Qxmx6N1eZ5?#XoK)MUgG+b z2X}Ygn*74+9P#mseBQn4kd5Q=PyN;{50QE}Hh=BU{cGuW_rEj$-Tm)Ozq_8s^zX}c z(kWJsJfvq$>t^s~=%3+j_sofBYx>ie$K(Fb5*d%A4yFi%Q zG6wzdH0BB6Y#x3C^%>mRes1zbzPk*IvSwSj^ZYW7H+YUA``6^-IN;Aj9 zP(FGdyJT^;{>S%op+DoFAnjjl|Dyj;a{3pKv;n3OZlUr2GSmy47a+d3F<-~@cnHTm z@00Sn3^-Z;u^hkd?1Pl;Dv5^aW_aiATQ(vt|7nbW?!86wRL*wJ?SFhYIsKfUOCz=v z`t8)yBZx^HpCEsj&u2hCF^&5*$d}78&hfXj?I`8-XN;H9aQ6@a=Wp4MWcnCCDdmOq z;^3QlN#lP#e^yO^b7ys&8y^R>8<^kk>M4p$+JDRZ+SI5WTwnMX)3dFSXMIo8AO87# znA4AMxsUZ9)|K@jvA+t#=vV1^9rK^}Z=C6_F^(u~I(xaOiwTj8**pLJ)AByPK6W$kcoMf-8m61{^k=8tl$3rQ|EUQv?)`sx9H?W# zKN<&WzSz{*Jt+E{>A$x7cP}QTU-i$_1kgLve!dJXa`Rt@$$quGamHryQueoHzAMSv z@gi~>uO~X{YAsO={B_^ncjEo+!=(*3`?@wcS(d%dmy@FFY!dQWUT{V$8W#__+^JpWnG!`FDj z4VoCWv)kqK>l~?1vhO#P_hJVekdOB<>3`^Zn)eZ&*;r7BebIUUxP(u?N{`+-|JkO- z7`7K49FAK0@HIOA^BUTAp86Mh|449mN$&h@{|Q_F>s+rIQqKR)wa$j?DnU={AI|0! z)bn&F{~yA>3c9oY=Q;4HCU*Xt^*{H^d(YT>@esi<=(AHVknLPG^}x~Z*oA-!P!#)| z9>+F~Z#zfZ$4bltwn6)NmekjNx9EKA;K^kEbVWSm&-R!H%)FD&A9vog65rj5ba}^E z|DEAJ`Bn6r(BH3u`w2Mbmi+_k%b3|8=KHs~E%z4iylaGGxr)FN$UwM}UUKq?AL9Lo z1>jF8j0{eZ`+qr)IX{^{TCb`he_TG;x5oSj;bgA1$SEgxV%%?_k6n%r24X#q{VgBv zS8)Ci<0|rPgV!v7I1Ux~S<~=caIl|^H-LK~Lb)UTZ1DA;#QEccKd;F8Qs&`ke3^bK znLnIgA%B{J56oZUSOC3hy4S%AcRr>R?(TdH`8k37#C=F@;Gg5v49?&1;7)zxOlymu z{KxCx5g#s$Z<8Ju&W!Vi^AFz$f4s_={`1qt@rUcZnK$z#nS4v7Z9b9@AEG>RoyP;d z4w!!lezoC9anG7P=#KF>)4SWhAwQV+VE)%@4Y`4PCBi90GSY90o3}4Gbg9#yN6#qlR-V)2+?tbfL}lJhDk7gK@b?N3o}z^1?HBoT=%rG=;^*HkD2_iK*PD?p#@~nISGZGt zI=-KuF3NSe6AsJK5GNcD5sY!%DOX2w+=zH7SH$JgRnkw0n+Z+d%C7IG9r?L_qLi-_ zBl+>3D~>LbQ;qpQ?mz4{Ry;o+)zAL(#qlS%f2MCf zf8NA=Hp>g+p9XzgwmX!cF;2cyeiop;_8pIH8wjV#VBt+ToFNAL~p`&Mu- zM5^(kGwAZKD?U*ER5|+_yk1iO#LgEDUP$H-=LhE^ytO^w^*-{)(XW1Nu1y!`0hzB4 zI{qsW?`rl3zz3#pF7lo8j8*Voh%nzs+tq*mgdLSX*q=-JQT@Vh-wS^4%LOM9SJ@J04wlcm@6XM<- z9Y^Spkn-PLFz7hOG!s{`>)=`4)C?4l_Lu$p+V=U+*E{ngHID!H9RHPqM?>-&ihi!x zrw+;w?+%2QZrn`tGMkwL;omQ9X4HzRfc?IOd@nZT% z?3V^`FQl(TxgmY{t4HS~jn7;6w*dtoTE1vMIW9lLg#S7|Pmh)RKzB;i}yXWUO@3YH{sB6^Lt}9{5y1qBEZq`1tpY`vLlDiAUZX)vynQfzW|MNOX z{n$+Wj}iZ3zm{ShU)S9h^An+5gr_#`#Q%O58-D7?5~G$Tzz@pLc~gEI5br-P!u<83 zlVtw>@Vch{a$BF6S1g~%SJL`Y4%95N#Bkp<$K7x?FG5e$Uz*>4{$+^`-#r(!A;zb4 zZ-ap9U>uslJ}(dMlX<=Z+BMeO&ETKm`0(H3OB-(n;dF-kD$o#g>zc#s#rac%^0j+k zse4Aq_!Q%MZ*ekzR<*PNkv|u3d~~#(mq0Xz_rGQyvE_yQy#)RR*mQY*I1Mq5 z;5-lcQ^R#7=plIs$UTpy0`5OTPC}>tIn9wbAO7cKz9@uV6y=$618-*e1J@p_{22)T zaD4i&bEG}EFp{72Yx(IaMF6h+bR~b#k7YcEJMR4cD94@rIfeaXghTlm;kbK<;FfQY zFYwR&uZ277CGzt&M<1aB)8o(w=DmNd@@FN+7oDMhP^06E`2N4wlljB(#Ug}TXn*4a zblmmCX;{&I=53LIB#6>#d*M(mu^?wf3@u`?_ zSIZZb6J3HR%eor#wJdqX`^TT^JnNg0Tfc4cpI=n~vG<+P|6mwxr2oU;N>7&WVcCgMMc=_5QW;m4mp?3iCZpO*LW z@*GOV5)W@XC;T=}_%A!*f9-_-h7*1v{yj2k%LPgN%ZPre8h^cGvsCN97V=AAW{q3_ zaXpr4DpVhaS2r+fSs$h^ZD7>0KJ@QtVAQfcOkL5ys4ccWOkXD9iT$(nVfr@tUM%ZF zGesm;EezWo56_RxZXRaaSKLoP{odj2gm-t=HBZ*H<=T5Ux&G62Z#63|F%_7fN_VmT z;cVtYFOB^t=EDh#ZFvu{j?VgT0NP`&uX_mSafIXcN5|lv1G;0_YEFGKzdorzIA0-M ztT#Hqy%v0+`%Z8t;rGP(z(YHxlz-EoxA9Ov?unh{i@}k8To5MnkNR=sUrs*`{Y=K| z>MybWn1pyk)N|zPRJtP^;@$r{i<5eD9wMl6+&67{Kr1JY@AAIqX<(r<9RuQ|X!THZqMZb)7kKK@L8x|Dn+J$b|Z=q;+AUYTgH zP=3yk`Z^xp4C%kc`+t`WlKSD;Xg+H@sb=H;r?$#}cK5R_mH6WRx867Z`Cf@Hy-pOq zyT5Jkdinl6C%$*2%8Q53`8vAQ-#R}%FFD~UZ<5R+IA%cK8+6k%@&4ls^dE1OeV^&! z(fO3Y3M zC+dq@xX*L?U9;f+lH>nAxIeK3|EEzeGJUJC{uaQ!GyI425B^rcy{$8DJ`(P?15f%>8*eq- znLg4Q{1^y2pwk8W$K^K#{?>|qTX4Np0x;gk$@0tleaK(l?~`%v_c@X6|AQ7EL%tF7 ze&!DAPT2dQAK`sx-96xN@BJx<`}+t#^R4yo!+j%+i$d}j?pz0?dllTr0uSA*;qI=R z1aNl=@smD!z~qvo`d9T=)CAC5Q8{fX&y=r2JzIZya&U{efsUURT6%@eK|tnkMEO|w^>8J zl798$7KbG9SI?JKMDn_<#WicL#@NuN{KH8EJovF3FJZ zq?K=Myef(R?@0V=G9B#rOZ#uFV*R&Tr+>2$>CrT(31qOQG_$OQQQKSOQ}ZWyyhYYl zN;330BhPBD7X0d;rZM!v`Fxx6J~tk&mG8xB{$|6MzGNV_orpERRr($HYnBQyv0Z%o z-hZftQ9BFad$XlKDfT$LXBe+BzuuGY#U8ws{oX8;XR$K|+UHQhQd`KZCgb7Z?nBGyb$-82-~uTl_)I#rl%)hC^SB z>oBa>)}vkq=I_~VE@k*|_YlE*j(a)WYcQXh{@B*{TK%c1X>6a(N=s{`U#I2^h6DFn z0NscC0&$MRDki{w_Pf7q5BTDkdsl6w`ehkse{{V|r2p49n!gXA-$cHXy8Qpf(X(Sb zTX7u&?HFO!p?(wG$>(34aLDIQoR5cp4-s^B+{x!gj{X|?yrYAs65;IbxchKF`(HY)aCyL!0F2QX*>_s;r|BU zKmC*c$AX`9C;$68?j8VcvW=Bj`X~RVf7@+_7@=n74izEIAUnldQ>ocr>3hfW&{y46mlp=oi%Xn@h z`QI7+K_B}d$^SR0hq&7EkNkY^6)T?%pZs+1HT4lM?={U_V#6UnKZHC`e<6VXZ7~m( zg8y-F|B&Si>yT67UWladg7mX{dfp%B|8(#_BmMWx8FkHOzu9z!|4!yV`|sp`iPKLf zj@%;wNxTot|ezt*oXM|7vL=Wy4Vg7>W29kdP^AR{XZ;Q``_I;QUIT5=^#3TN_4(s$ecuizStWLkj-=Bo=)6WWCv8fFa-VzBT=dpU@$Z|5sx|nDb9M&$W&OT84l} z>>@v8{KNRi%d`Ft-<0u_*sd7grazRijo2gcO#d58e_el@FC<}NZ;|-)Irvh>S7Ik4 zywp1~9um7b{Cl6tct~tD!~TErRUGCV@h)TpCkQZO<$^u=%R`}2hVaynnicz7|DpI*yV;(2?kCS;)4fEFWjvSaCh?2y z2L5_IB|NdWN;RY5c!T6w>=faj`cDs#Z^iB);pwwCP~MBJmGBf#W^l8t{bn=!y@sLY zKX~?rh<~y5QJypMJ8R{8_2(ZY`nzIjJp7;>57===-uWoJpIO&0{0?>bnF+9tQ34lI z9T)4mt`GO2KiGQSUw%yPTm6xO9wP5~VgCP>b&t%d|9k5mQ^A!Q(6^^_pC5032SPvb z@kx^R-DBh5pDjO|;yY6I|9P%#q5WYQo;QX0I`W_M$!Vuw{VC=V*$=5gygbh!=qmy( zhW(iZ3?J@6_N|mB%wN*~K)CM@eL$|iksqVspY9{z|5NCxvA@KA&b!bXrF#ng7Xc65 zg`HV5RqBnn={vdSyV>!VvwvvVWRd^)_!s-h$ahkg|BE?q0DdyAmT#c{19$Sj4dy+_ z=Q4b-k>j8Jlczt;566T53TGTz4)<5!KaF@R;9iaKAl)nBJ_zpqD%)T3;r_NW9uH6f z_)fe7;a&xIhEoG~rkixrv)f*lRR61fx0CA-Jqj=_T^daQd!T^`Y?4&3!`?z-ud;Zf1LHNe$JAZsf#w(P8$zxmm&&yD`E~ zT`l;Pt}CIY(1cQ z(yiqm<+qizw{iWQx19OR(}ABn4qA!-W>Np7wr@WFx0UuZ9^O@3<-f0JoBzDKJcrVr zGW-jU$bWyeJjdUQs&iiaq0|#zZ2gw!eWdSiY}D@O#CMVOkK*`l5`6LSKbP?0`y)E; zmXGHy^&d;Wyu^_HK3a zceQ;V=ge<^FihH)M(w9rWhe`q{b~Q;U5G92bkYWz8JN zUAnbdGl}8g+z1)2Wz8oq+xCUwG=%#Ur~Re;O+`EFVZ6`s&v|&xpR@g{X=HKJ-9z~E zcs>EbDTn(UlkcDH*C$`29fW_jUr%7)1H<YoB;XjT1A^&DL`(t$*n3|h0pOJdowwGSk z)tCzr4)28~Uw>o%0}uJy0PFC?Prf#zzQ9|yKJgKLYsb9`?iJuerm@8n!2MI~|Ka%s z%m=(SDg0o(mtFGa%klnk4d(}Ce382^uGqK69Ekod_gOH1 z-o4-E8^sCSNd~- zU{U+O%AeC_j(j;OfAoBMHR0X1{OJDi^<)N^<>zRr_*J$tKgfA}Voy8SK8LI2{5Y}o zuz#EK=bqPBPsU^E<}&{z->N-PItKKs^iCN+#QU?ewpGVO!=u^L#-1Io^4H^{9OR+P{wDeZj#qO!AmvDeZ&sJUPoyZD-(1{VaIJ z7Bb{N>4Xa=tNwKB8k~>7^L_TNk`QJ`=ZmLt|HZZln3VfVs|BAL){6@cl!r~~m{*am z=`v)~@x(|OH!0QeQ`n@A*<=^{yoHPx)xXw@Ueh{e1D)@cXO^?qB)p6~-?x|W>4-Y! zqZ7n`mE^yK8;Jjo5{`b~T}arrj=5Lxq{V$-gsJH0$LuWOYq*-?C zEb5;JEo}cnmO-+Hl>PGnQRdG3#yl9jo1?JKm>FjK1+1UB&z0_!s{=3(=HZ;DHVEhd z=&J;n&nbudk&b%>+$-51h5t&pU%~z*^fP7pIcv6a_F)VAv!;ggb?A?xddi)LNBlng z--z((-Wl$9IPO|Z)bL)ZAh7+ZYU}*Fzf<8tdi^ffwTSl*=OX{kpDc1v8_l13EsM)P zw|`0iZoV@A+AOhxuCmDt7pv_)RRCyd2sK8@B_G0 z4zA<;9roK+!2ijPe#St!AHwx}+?P}X_oJa#lxbk|V;sX_|MMY>HwE`oiRUrvJ_+tF zVZ5X_HhE+>&A)-*i;w(!zn}CI8btXQwzByr)kfBkviyxh`E&Km89&c=OU<$AVLrWt z@h-=U%%|7k9y)yId2@6xM+EM<{p9=e?Dr#_O86gz@fYLu;a>71`sFwur!(Ad<9=*} zQw8^B?^^$qn`*ev#yFVn*iL3@FkYv-*7s_bV?0gw9@g1>fbc`a8^FB~k!Cl~q&jw~ z)cgBtocWJH$JZ00@pYzkaryft@my^4k&)dC{&=Y8=za*!Sq@QeNwbkP+;2+vQn-^3 z42L~|TOYK1raR>)#rY4!+Zy5A>G-Eyg`8i3f0lpFe=vLx;pF!11OJwApTvB`JP_rO z`+Wnrv!B8F7%#NtvmL^z7b0BN=y95!``}x?rzp1WMRloW@&ikC-uMMA}e#mD_ z0{%pW-==cU#^2`s%ZYikdHt^}O(p9R3?0F#5Vg{b}}Io3FpudKR?)F0E&e)?@G?g|B?f)o<`IgAF9)t#5S^RatiAD|@jkzSUt{~jwJX$p#Hy#6P{9^m=rdmu+po~`G0&sNwG z_MOM$lg;OrzqD~T^n8>R#2b0v<~vazN;046{XgNZFMJ4g2TGg1&wDrQ5|jZwU&nWr zcU9f}V{b?QQI_=mW50%Tlv9`}zR&v&Jdbj-p09lXbcOPS+qFISp*<+i((|?7#C4Qf zqCYm@>-uFuk4K*I&OLGdoYVb%9z2E{-iF`*(!7kZXFK{e`m*CAm${1WRQ>9J@;&pD z>T6Qd3b*~C?D>b4ucj6pes0qTyuWmGv8iEt~+H*kf zzg_P)zwL2_f9!MmUX^zhgKAG-#mq{>ir8ko;Htb33!*@|EdIhNZ~Vy`o|Q0JOQ_Pe_f)U8NI(P z!JiEudJ^yjy?-H5e@@}K1iYf~7pcGA`fGUdGl}-B>HU>NJ%%S+^tv6lhyK91{DWMd zD<55#`-h;Gx z`qQ|M@*%x{;R(2o^1JptzNb+BN}pf91pZ5uPw4wLE`~o8#qudPw%{D))z%(7yNU8? zJzsbV>PPvezJL9Rs1K!u-rhHb`cXcw?eSiK@j&^i zUQb&H_n!+t-saFE<;CJ}&jyAV-!?z9weMe>pYy|x zzukxdu(t7dKkSJ3`D5ktnBUr-`CjvTkjk23NydZBe{J=dAKT8&pKa&#Yuk4o+pldt ze=F!=Glq}m&$eg2-~6Cf)zh}<@v~oepf#@l-L3X{{$}WrPi*+t#;$Vu!BZ6R>}dA+ zLt3Bt5t92mM*g+`;p`d1-;&y^=I1iL_BqWP7}Nb74KGK}<2UWmc)Q*2=?exD@K%K< z{kUBUFMPu3f2N9?todzG)`_ClcBMQGw;hyR@I~D%l6mI<;Q}~FrQ~e+Z6uwL0 zrZ?QJ@H-Oq+@tW_iF)o+_`XCv+jPF3pnB(;&WopTee6*OtIv*a>pb)EIR30?{>A&( zU^hM3czmtZ;m=bQWJl94AJO-&sorDyy4CO^%{xfF%n3HbhdbmB_O&e7h!bzv0`n)js#0@91Jk>(6UF zNj$mfTMj=BZg{foD-OQ#4mUnCTF>?bJg4y5E_a`e!ZEm{bldq2B&qKPtYzFzZ-bQ2p=8bC{{ya_VvExNM z9AFFl1^k>Ze`lNJMeTKhZ;QJ<_0&I5de?O%p296p$J2Fu>k7Z~LwdjBoAuYz`VAkf zzr%m*?zeT3MmN8!`^9YL-Ml}j^*@+^Kcw(SlzwgeHx>R8&C@Y@d063})B7!d=j#gp zs=+^^d|2n>n^wQ}*W^Po56Jk&b9CISe&ZWgDcr`v{?Uyf~OaIw8?VecEb)#G-dIdmRwW55llgFF8wx(FZJ??z{ zwOdmx9|J?DEKYUc36y_?!<^>}*KAF(tm*x!c3ek!t)7pyZcVY&wEhizXZe;sKeij! zQMQ3GvA(rY)P>^dxwjwRQCL8;dzud>HEDNJdg5HeZM__6ULF> z7Y5LNlt0n_jlBu&L3t44#p`3Q#yQG6tiD&EK9q}8f7!eZ-_K}}Hyr25l<{H|HVjsgRJ3e^R z-4~q;zou&LiG@DLx2||eDz!c3Mfmkt`Ze=AHoF@3$YbThTb_q&{dc}Y{d@EB#`8bu ze0k=B#M^fxx@+&|@v-!8>f7=5ZKA#B%BSDFbxVpRsc&2U$k=ULQY<&a9*oR_i_PPA=()}3bBS}yW3l!be%^s`fe?9YhHL^>YWzX>T!6w%{>lJf%|a%9zQcGUteH;N|h7tYAW^1?^8LadV^8S zz`f1zR(+sb;U>4n46gpvg$^g5W)yyh`f+VP-vx!+x*4UgKsGOPHq2! z=0!ZH@XvqR)o;JE`jEo!wfDZ>wR2P97k)?EqwudQ{3}||n!>m0{BLMIn;WhklgHoD z`@Ii4I9QE**4004esPn>ojPvTuNl4nz3tk*H@p5WD14{+t<{gdrf}n%cC7xy!LClk z50k$iME>c$^g`_&_`LE_ttMqhu5X6`S|U| z8SpEV|1A90Lt9wBSAM&Wds%)^{MPWxj)vEEUVnZ5r5A76@^r&*i;s6vVB+IVIKE3i z3UPR=KvSvrm7Dqh4Umt_XEc8QTW~U*^JB*^ zOx=O|tu7v~#mnt{?4K@3UH8()`3BDKfWZ~_N4*ix^Y?)GjCaT5oAw9TcZ|C#UE^^fHh$~>{{^Xk#Q56v)aP-2N8^0#VdVWL z@adv6jqB@QxghnVS2oUB58i&x&lZK+@x~V&J?HPI^Y;b#+4wUjPx(6n*Q8z$;rGvj zfm?fd{AFB^pZ{v&{5p-F*gbnS-eczn6W8w=ZLaTYXph~?<8_!|DyM&K6purC2RM82=}A>YNEfk{yKFZ z?nilii>q%F&$68FV|Z`Jmk$g+>s_oLhe!4j|k*Pq>d9>v#i?*__m zB(87nYrg+Y7d4+3u4_JjiQjy_GuM2+j^|Uc--~-Y&g0{;iux9CeeGk2hoU6obrz3X z|2X!yLHV6TdoBKEeg1Gi=;2w7@&0mReEEC!@%O)Jy1Bij#CU%q@xFgZjL$a`^{*$! z|6S-W+N!vCLsmAilA@DCRMQ@{Jf6w6Jh{#^LKhHET_|Ed3p`%xYX|Npb#`v%&| zaz1?D{0R0}LU}BFw|Miy?_s|vl>fs2X8QVm@qgW+b;^$0p1bu+^sn5f`Rf&ppHjac zdsQR9c}?|vkd=JwXz|l~)W34R_^GWA8XI)=^5wEp7?U(h*7@6frw7=#@xl7@OUv|9l)0e&F zT>QTddB)HB``mb4kMBET`A6Tc{f%5&zgVg&m zJ}BqYhsJ&l^`n?RwDvB@W0db#AKJJV{YNob{3V64 zVEJDCpX+!x%enHuxUSjixAo0-ZtI-w+}1nWxvhJ)b6fvx=gIih-(x)D`m)8VQfM2C z#iKTZmK2NmN7t4xUMR_UR3A*_b*`g+C!R;S{dvv$)%O~&5+aEGF}kti^S}9{ix>l+|}WIkkzlu$)g$jlo7|c`P~g z{mLb4-}&T{T{pR8=ijefvgb`M+4&DjE?Iphm+bs}a>=e6-PrN+L)kmdML)F9y*nH9 zmgLmP+*^f@gO2pA0m& zW913W=i4rCKL5i0=JS^%?!P3F|MB(2{ihB$Kfk@^&ezkIrC9#)W$t_oij^FpG(Ps8|F zyp46fXRP`Dmw-I%T|EAF;`;C7+>7aBi|B7W{_@2{f4bmEh}U;H1W){YccMR6<(sd6 zH8H-gNVL!Nv$4s`QY;T8+WXnW`K^iZ_=dJOwE)CKDeC+!d}C{hWyQ{)d0A=!<+%y` zdbwU-zYO?;;wA942m!(Vj?JKbD7GKGjX_nfZ_ZwpVz~(GYwQ}2Pu2O|{37z}Q0%i! zzu58f_s@o0zgW@VAF|({eKptXyc_FNE#Kn?M~4^c^LBg$bkq$E5Yr`}9UpM=%lu6W zPQCkHm22uJ+M*ZUYw)X_f5ck)YorVTSq)<;cu{4`|gWV z&*^Mj=RI3cf4siWB;HSZjrZB-|De5_vG~>s`V&9D5cb0+_7}7JpMO>J^WIGJ`P6vx zd6K@@P=CCAEvVn>=JD5oFY)WYpBT?O63-j`ZD2gs#x731B{tuzFDbWw8Q0_exfJ6S z|9!t!jA#73H*wyM{>QI>F)_YRO^pB7a6R6iXC~(Vg9&=O6a8bm`PqEw#i`fF@o)0t z)YZ2%uCLWEPVJ1H^O?cK{H(|7OT7%pr5~dkJAP#1CvH8L{N(R%^Rw}nj;`*XO{I3G zx+3{`9~Nxzz4o#A=lXM@=b=0u_N-mwaRc|q<981vo_{cL{(G0Y=hv=*o`sUT(w#4K zL$5^nLtKy7cXe;``@W6##@}!G0SnK;^C*9;_1irUCEowCosc)zH1PjsynhYn3p?;U z%F8i6Jh$gf&-Jc=-iY#AJkNODLI>_gq5snEE`$CDm0&8U2Q&p(n|CBy|*==Uz_OPOrpNmVmz&{JoaEd zI(z9gG3xjfwk567}=v-{bX-qP}?ilzMsm`Y$EM^Pa@{W&%G7S2Xj>dmwn& z-nDHQZxk+8;CTwP!1C5ad+*cxtqsZFhyFF(AMgLq0iUQpdCvfTp&Up5;@2Npa@VcC z1Bvl_G4O%Uui;si^L>mj*zuRPwB39z{y_Q8&zj10%JI=uXT%@k@|SJ;x5!^U{~sxT z`Tn^4r3}72A%Fi%9z)&%-zkq-{=Mb#jR@>cU=6Yw#GpGv^j6uy{%Zz%jy#goYXRY81t0=`AzPfx(ND*TxV_%?+< zHv#t)eq{pQs_?54@Gga4lYkE?+}0r-P<*Yu@{9jpe0|g1y8ir5*e{#!ZtNeK$~yi4 zw}yP|X#8P8@#lQ|M}GB_&Ob0#XyzLie%Zloy^J<9^=93_bK~dT{hq$}Te`oa-9M!8 zU)K8#4)G$NXX^fZ2G1${e)VIF{i3UXP2pR$J(d@8m%@Kd>o@qi!tYJM?^bx1`c>@y zdlde`#Qpave7o%_$QQKS$j4W{(z2y!5>!m zcXYlC{)oc667BrD!XN*j`hT?j#jdvn_=~ijF}>g9+DUt_!XMK6|1eR{BMRT~4W&oD-{jzv zbRKQL&uz*lKB@R)>*t@L@PE|$*Zyo)Fu_xJ*4m@+E`>i`>))Jm_m3&u^7A%NJGk*D zMX%`4waa~7>37F>fAfu>kMpm!?{E zl-;GGeOWZWZ;L)~iRORV{aY3OtuHm#^HhZg_PcY-FdXsOrts&eezWmShaX)Ee^B%9 zHeTiKA5!>3mY3J%;A0B^VuG(7SNP<8u089Qxce6rey6s73i3-{s$C(yWYR~c2~~>Sm(~qH*Gw(I{1T^Ik@d_ zvH4y%o)0N}Q|D!2)7{Vb6+h3^@mbLEX;t_|U9No#Gp?R4g}2)M8CTDc!aw;;cfa>O zcN|mrMZNCa>OY|HhxPtc)m@)a_$yTJS@^7b?{S5{U&nKy$H8Z|yY_Edeyg^BLFw|> zbv$i<_Kd=lzmu6$_$&1Oh5KB;?pF9CTEF4dJqo|ebM3Z%-KX$xYQOCM4TbM~oV(xP z4=DVKJ>uki;vKJRDW|KHE$ zzv2EZ{4D6cE!?MtBX4}UYe4E=V?c#u7o2M<>{;LeBt@H zjxw}Q&+ouF%04~!e*DrD3xCgd48Q-la1E}bd=TrOc)rnr_n~Y>Ls-Aph5J#yVeP^9 z4U`9PKd-NKUz%dsj`866LJ#UgvEM`9+;(Y-WnANv8;{5DHKIH&;s4wI0{49C8|V*; z{hsjVRd^odjc70J59LZd-?$C+qx6Ta z{)Jyfdr&I+{00I+EML*~t?j_?Yofdpa-8G4@g+Qu(yjQh-jBAS+@tMV8$f$ey7hgj zZ(W*V`3-$O#f_0sepknH{YtbCW!F!-`p13){X;pZ?MuB5_oJNB{<01H%qjk@{{h~Q z@)B$RPosS(e{A#lQaq3H6MB99UAP}*L)*J~68MO6O5eA+h;x+B+ViV;9_0xTsC=*Y zV$3hfHa#DE5bZ^|R_S$f7oJD?nm)hw6^sW;r_uxK;O9qtSKsDkm_L-UX&vA9plvAI z^!nImP(Mn}@Z&j{AC$v-|Jd7b9i>h0_ijM@P)4l&i%>sGXwUCN{U|qUe>dKXbCj%( z=h|IpFUo1He|-$&g)(OR=nU`$rKs1}I)NW358C|yDV|3eHT?Jpo=4f#>kC&uImL2N zuWvpJ*HE6A;2)3Z{i(NHnv#+__ve8N9NhGgH^1+7pN;F6L%KfYolv+I?rrFo-kGEF z;J8+6N3)MxpWrSWQ+p-#r?YyeJDfIsLhUEx^UDdi>4jsePuTBmcv{;5g>Ni7dDp6N z(<4(Kbni7i@>wdkHt%(E-So)!ss3(u7|>HbzmtGh6#nr9d`02!P1sLs3cu3ctLr%K zQ26Uqzcjt!PKE!8*6*o2euKh4rS_A_PCrwVt~b-mdFbQqOYZ zaF4>1`oVh?zM}JDdc(a6zu*GZGqhjtRrprZV-)^Ah5v%}SK;qh_^_>`QTT5td~X8& z0fk>_dXL_JpTf6ldlp{j=KX^T|JB5MKcw*A()qG}{SSq|NZ-4u_ULaa{CSD~{+7Z& znyBZu75)kxH?uFz1>Iro)Op#^`|s0sE-3r~h5xwfZDtoesPIv($LfDb;a+0=|4iY3 zr}$v~r3%5%WTIbx?!c)7Pj&Na&!DzK91De%!`K@peJs$=`j-Df|MpGYuaq3eQ`A_4i9w6#lyB zx&Ea7!r}jI3jgocp0c~XrtmJ~pDm6L++lDVXW!Lh@*%SK6n>Z9eI zxc{a^{PZ%!o8r%3Fw}hhB%Jg2?X3RstD3Jr^pxiFcOPgz&t2Yp{>;StlKW@h%@8?= z)!xVamiYOj*5{x;yO+luiF2;kiC<6Vd-3=F;@7!eCw_igy7`>zcjDK%ekXp;^*izN z=Uvi#{tM6-;@7t&uCD`c;_<&a=4;`JjqzWeX@34q7_a#JT@U>zexA%P+a$hV{m=Tn zSbu|J>wh-zo#hbbH{QPf#CRS}T<3bB`2Acj6hG&Bq4;@neNb{g=zr__o?U2fd|k=) z3H+Z)oZk;WWxRbiB(5j-1KFP#kNL!SY=R!*^*sah6F<)Z~XjY@K@P29)CR1-;;^?d>x;U(bLZ-#?SVfw>o>2UhMqt z#Pbg(#^+?dc|50H(tJL1y!rgiwdV7WW4`0_k;VJs=S$CR?(brve{aI=)>aoIxqcNa8|_wBepKA(7rZy=SyA})_qz9PeoF0kh5xPoUO?(K4t|fq z|3TNM+k5X*ct^rdxS{ZE|J>ZK2NZspj?bFL`yW*J({vvjgFmG3ujqRXzNv7_GcZ5K z!wMhP_L#ru5ruzI`?a9)-LEM83L7`|%Y9wp&$fMabpIUl7d<}#hlwYjJ&E_4AL*a< zz2+Z#s@`wE=W6h$Dg2K$zro;7SNLJ8U)%Yk3cp6%WA|@U_$zGQRbP9C!rQIC3V)`; zuhRLldazZUd@lGCH;?8|ezwAg6ZLosf6rwOZ>*jx6n>+&-~5XBX*c=w>3i3H%01Vr z@F&`P4gVGXO~nVB-vbK&=(n5OIjQiy+RjwX)jy-~l;(eJ297R{EBtjjZszA-P`LTS z&0m^R_|vqVV}Il7F@M?{jZVMm-n*vv|FzEV*q=N29SX15_-KFc(7c{o6Y!r<_$v+m z8TZ~h75<{cysRsHw~q7X`y79`Tj4*Y^_X9AQ{n%h?cBJ~)&F&cKTrF+srX}t#3yz9 zH?{p+)WCSN?$5ohbhlOEkILgwc$?O5=-e!fBBGdeFDI*)fLeAL>h z?eQ*h^m17F_SnzqI4FEw@onu_9DGRO_v$#99LYVw)pOeLLFcQY@ZYlg6+gLdoFDt0 zCd+f$rt&V;(LTCxZRc&LckViI>yA^mzi@V{dt!2W=EnZj_KEgeyc0XTw$^NU=gwWb zt~!0~X#40jqn)GMN3R;aZS?f$Raf11+s^iDuWfH19lc_7=jg7{kyR z7kiV1$=YOnsx&z<6U?M1(zEHA%yecdm|2=wn#oTWZY<0eCyTSoGvQ=;x;#^!E#Fv~ zDBl=Pr6E!nh}t$5xwt@)CNK6vfu+>GZ<%}k7*+TnRSy`Yrwc6p~pTCTh9x_vV(vokG= zex{Nh^}PMra`yqhH0hV8s^#hB@(q5zyQhDkr+?a?9`P1Xk)K)dgD}kb{+X4fqTkuk zQ3`6+a=EtZ7Yns&J*cA(9^O2+S_x_>yUUr?*-DV!moEedr^feB92h^6_QN2Z^GiV? z43_Gpbhcb8pY`*#YT#$em7o;X{93qLN-yCVbaZrPeC~i(E_v72OTqQ^!fIzwOD~qo z1-xn~?H3Bm`BDalEJ`I`^B2R#>T*6)2r{V8%ZJ|N-tm38z^^Rgy`Eq54)~#04}*+X zUh>*J^n2&%=>Eg|Cr;se=w0jWsP>F{7?2UKGK#i#qx7KkqV%EkqYSiMT*S>4mJzQ| z9r2d%J&RJTjAA%j+Au5QwQ}CO>MGB>?KTf1+cD)=m&bGE;zZ6b9`euTC-Y%_Dv!Y~ zXY$j*S${6)=jSjMH`nvEUJQKu!P3&TC}|(_37lN=F(B1qxD?_~81!NedKQcMZj_!{ zz8HkLpitNe4BEBiV`$I#g?g}5D5J+-`}S~ewOX!bf~BB(aL?Z9xqXv|$LAI?9)1_LqkjaAC-Su2Pv!|S``iF98?xbJKmnQSY#rkwT%+(KPF{y{E`BndL=x2i? zb+mrYU#{lo{9?Y)O(Gf`!kiW{thp)>*~1L>b@NY8$jQVMpqnkAG4JA8`M!_zUORDW zakUm)%~890e|ff6tQ}n9-`Tk%2dDSviLnqyQm}%lyQ#bwf=tSJ#SPEf zO~l^r)ob~J2l_3iy(P?t2eR_PyDHV-%&1q$hqciiUY?|yE@y&Ku%S$q+>8WRY~O{y zmG)i5(bl(ORpBTV)nu5i=&_ufWQ&**;2V0Oq7f0 z(PU7o1=Z<#aWSaQt`--|h4HGtm{0Gn`nh6$!msB2(nQW*F8UMYN-dw>U#{iy=>s61 zdf|XiDmoB=sLme3nCJ3`a^;(r^OHdZLpHgZ#

F8T>sG+=M4)S5X^~BtJhH%;7xr z`L|x13ksMAFay8jAM;D;T=~VpE%{6y!=9~Imh%O0w$4hmobC*&)l%8(9qs~l1;t8j z)gxwgd(})WOjj!93NYF`>*G(lnCZ-x)78~VtqhKxDTPOgrXwxFA9{P_Fwlnz%iv{G zeuez|a3w&8$dY;3TL_9lsRpbRB%GYwyMKIg;_%cImKfr2rxr9Jto!_Hk0cj+KY{$5TOkEJVh zbQye&XP~a-Qu%Btn-*4a@Gv?F@lh|8Kte!GJ|tLQ%A%IwOi)Fi&z7spN2d=>A3ipn z2C|mwl@VMi)xaf)kb))EWndmLqeT!fZ1Gyjl^{KLQ>dYT0fuM0H!*Y6YxQm^7Z>wr zqPLi5EjM)mLBYQ=IP8$A85Jfr;_W}YXYcN#`@K>TjRQWH)5|zyR?%AEGP@L3{S{J6 zb-o@KP zZ+qA>0d7$RHJyPV@JqXc5~Ot=R7Gr_ScOn2*Y*Tq08X~I0IKv$dkd>Y9|Q)}tL1!9 zSiMv(AM#5jKjTmN%ebXF1+2s^BA0^F6c7+HV`>#r#IGI>i+*XNsP1QRm@{~&PR*N*}42;fNJLQ)m**i`-|YN5K<5ul_1kS+)uGQ zJUBpheh^Y~yins|x?J%gX28ixYkyGM6Qm2R5cQB+phTI|5if);$QP0|=Ft)I#2IK-bGdqz)H>@! zuuwdJsgZ1_%Vz?zMpP!p?N>m2)N-76kWx0NlnVt+W189d?)nlnF=9Oh`#wl# zp$ohWsvnd9z(KnHVgbB36anH@%3ujWb%*EZX!rOY@5uP{A&)Gj4(-j+Kcsy=n+>X? zUa11U1DXQD;ypN0ieyIH^!XEt%U&rs3tR=_rZJ8XNR+K0-IjKKT0r$Ru&~h+MC{24 zCpbhiCTBx^oK!HX(TijE)lq}CYt$2+m#0+>^_h-}Ukx#B-gp(P6S%gUY7@|Wcezq7 zmY2%A>sdLUfc61d4N8D^1v$N^UMZA;$a^6~$`w#SP_Ab2{Qmk)z~@?if4y3)FX!?H z@>QU1$-mw|19dtK4pC9T`5}MR&&^Ll!z=}Ub$(oryQln|57Co9T$rE8<(Km_IZ*%n z3}akZQ~In_+4I#UY71>-o$)jFQf* zJN69?^-#+pQS1Y4^9W`goEQQ3&5WD^`cxrm&O&nqVWczexTxouo89@DLblvl0~&`U zi(IW%!TDl6U&!D*fb1gi6bs8iaeIGeWP5LB#0yq{<+$b5#!{GAmkDd7$Rj^DA}kf^L)}Z z1x{xsIMZ3G7YcQ7m=aA8M_Ev-t5C(!#1ZcpdLW{3mbx*i39SJ80EbAIir1mBws7T0kR2C6 zgR|M0sflp^gx5+VsjbKx_JBaCH4DL#n&pd-Dff_ZtGUl=?zfuz zt>%8Kx!-E;x0?H{=67&QzdpZV4 zTZQ~BK^3No2L%TPPOE4=nKq9z*WCf#m0x=JCG05Vi+S*@utRWi6uL8Y8Ym*WiT@q& zVo+{?2&i@IS7{<&>5-2@m90bL&4R*r`(fzM-{9wV!w6pv>&y8G zj8PubQ9P8ZXZ*9Ek0~e(t0+YXy)4`hereiY1jmIkIpY_KtJRB9rwM7UnX-7|A9~1ypA*N^$8lUVwG2$0W_2S4WeyQYq`4Xn{d45?e_@!lj5kr+< z#8~AQSf!O5zks=72Jr{L(6A3Ry1ZEU3cV2BJ=aMF-QM8PX#>G~}oUOGm?C|KX|e z<15s9h7bD2o7bgImzZZEX|Nq_Q73!q+vmcWUzB)WJFLP#%8H z@>x793KYF#&TEqm$a3hv!8b_NMbSH9*uWYG7edW^Kuvb%f1vbr>RQ+BExW;H;Hm@; zLeMy-) zurkO@089L^2&&%$*BZ1U^lm?_ColqNMu%W%l*1hKHCQEi$V)JV!-dTJK`^y^n%`!C z81CC#9sWsy9bL^r)1Jwdp&imaFzbWSp_Zx-g^Zz6398?9r&iqIN)=E1k7pv5LhY?bP#JuryQ`-UeQ|DxP5|^9xD2K{TrEO7US8?%8kS47 zVje>e?fL2*SI;WgGqGl&rGCW(2uXG&{uj<*H@d_v~ z_LX=GWTBM`N0l=R#L-Bp1?MhoB+s!4agUM+foDXyqA)zs(TFKw?M1|JD5})Y4nn0; z#qaRaQkX527yW|hVZtMTDs^~jfwJ&X(l&y}brA|72_c&n%ZOrJxI+eJX&!oI2xbSZ z92yvGC-li7E8?|tmKpfP4$trI>Fw(ufO!RP zohc1aGu&6tqdH1G1l`DrI_+2h#vua=TLxdiWK`i325Ty!>t#BIM;rX0yYbZ=THp=6 z4K~rU|M1+A@rk{=$0rW8k=H>;R9CNszbaxHJG=_KZ~4*)8521V*+w)vS$H*;U_1mJ z@H|3aB2@xe;4rJ@=AFL~IC%!(d2s(3O5VB{@O!|3!uj##dbK_U&JIt02E1|F&(2TL z3tP=kgSFAr;@9BpJPokPdZ2tG1Z&_|^;pdK_4$c>Y5ss;pM}6YM$@d6JqDaFWpSaF z7xaXS6hc=pH(0@3ASyz4ut#6MOd+m2EORdNd}mok8zj=()!#knoYz!S zCg7j1R|C^n#!IVUJjMYSS_1y@rNmCmTn_9^ztSNf>>yppW8md0L?|>)iq{bKI=m;0 zF<`7ZNfU*zyUX36e1fdOZn!01*$d+-lL^E#Y2W9-Ey*R=KIj#}Bt(AIFWf+Er4<7@ z5x-P7(Ok6>dQa$OA>)9yN?i@)7{FN$L8r(G$JW&~FGp8qNyOqYDiaXg&Xp)cFC^?7 zH6cl0HmJ=)et|%ELb`>SM>1yv=lsPibfj814pjwmg+gBM$)?58D7Qkapo>(!^0lI$ zIgiJvuQd4(bT{cf5=%l>7DZmbazcF zSXRV3cr(0(qW`<^VBjH~kh{Iszq#X;RBpgMU~Pw;WQXF;H@@WbmQMO{;JxWEjYZw6 z6ZG;pO(m=sDJz79%xCcK8Yc2~$HqpyTW?2~=_tRo3h(9#wS4_t;V>Aj9XTb z1IP?aP`5KQH$(&_9MKlzb5*<%dKfM-ZYa?cr~jx$U0zyZtZ|^vMft#C;clfm41KMg zy>oh3OT>!6fDo7fi-xlh7R1>qY!YRVf;b-RM))$QNoNpXU|2(fTut9ypu@o(`@-y! ztIkhhpy`(_&riYI%yT5r$K=5EQAF^KDeAKhcGQekKRpCdLaWkq(yeH^Dvx#5TFp?v_2_4Da^b3d-{h4 zha|)?IM6fPJKQHuSgVuDEsZq41`96e?jqff7iwV0=^WG%a|^YB@?@OUJBwG83jB_U zB8V|W`>1!-D#bcXo$j7)7(_L=DZ!=E6|yJ4UPCYxf(ZWFAYBpf6TU+p`%CCzkKLROU?7%4L|< zP@2!e&f}2JGU!SRXDTR;i|VW=`|9NUf?a4+dKoN?=F|~sEfAFqK01NgFT^O^C*n%v znzIM@zv$?}xe~L z%Oz8;W1wJRP>~|r0Z$a3HOg+|1bu@Rh_DenIbsurqfn+AW9>*<9420CMAPVHLlX;w zo53-m^FhUc5u9_xJr5gzJZuSFFF1DsCYYL&`D4gks2GaMgy?@J;wdXIj2kEETsAr> z!im!5c)xc-6iUu72le)ri$(n$y|t1aL8L6Exj99NG%^acs9{>c4#n%y>ZNMA*bo4) z!AIj%>mg@jZgNj$wvI5~b>%es15=99+Oey7$DQ`qOE*DDncoj}9>x{oK7LV8pl$^7 zhw{t*avd)1%>02m!b%L$77*Dhc)dV;3|Fv10SRMu365Fe|CIf-u#rb00skQOI9uD#~E*0$SDoVxY)(=T9#4SbPh z7k;%qt9c^?OzoRP8RM(SQgSS?LoGD8Y^tKs2-l*M846lHO+~ql9u^X}h|REG0r|q) z0W}ONKU4;|1dxRRaw%lUa4<^g6mBQ$cIAF;J&7w1l%Xe5e$sY-R_HxJ-vK zn(^I7z-T0l7j{S$q7sa{PLkQkAVm}i9ih@n0-$mt*RCMbY`mrMm6<|liz-TVo=3G1 z(HewIy@F{f&~cnzGYP)%LgzZ+xbPc!MhKIV=`$Kja~>b~E+H|1dEzf~+6YDl2II^G zbRs;egx1pT7=Y>t98C|^`L<~1D4my>9Vr%=sA)Q{UK11Jjb~*G4BSrefMzJU~k{hK(EBw5R@Jm?Cb3w zh+N8hnF?|&pQ+{0Qz}P95y%l03@TKVU1>PF2;%NkrKeh>p@pzC+)E)c=`5xO&p-MU zc#G7yFj?-DbIn*_M=r=`b2Wh0+1=-M&W-QCgM(Pgs;^@F~Y zopvtf+Aexy5nY|~S7yi}9K*1){eo@9xW3T}(_9QWztARb8mB3c_xa=u4OLrQD-ls6 zS_=llh=U6+pm#`MLtcjqkO@bJ6wg(L_Zm$2_;4&GFsx^ z&@~XqfJYPcQ`10lpVLRt_Y$;_i2mW)q{oFOfuI4M7LXrDf&v7exKE0(Fo4Hd49^IB zt?*zJg4QnQ6@-oFFQy^u*g@oUMDl{(55(#qZ7TG5P*cdE^UEStU^WXDEx|!8EOTjz z8n}s2>I4lL?Z{c;7V?lY6(nB=gMozzg)xd)Db`Izf=l6C=HGl6+d;OdB9pUXqtk6k~?=xXd7F-njQRE}}z z>`YgKj*X6|=fTlJ809x2mbB>Kf;64kn~`G`SpjCx+jyE8qsg^E2hKm}!ufF{GX!MG z)C@89>1}a$d33M{2cs;Y`qk>(18qIMLw(&t{e#2ZT@pvK_kk@*AfZ8@<| z_RA6QYIuI9%eCoAO>P`f8~sYk<+DzcfVu-upd_89kyurU2x zya8|wVMQ^bL$rbpcpJzWp|%NY1UCd$NR&9{(yf=28$nt!mIwWov0&!A&AWbM(S;=O zz+4bE)#~^b-4MjCi6X+Sj**EEm}!7f3J;k%ZHMNDO+q}W_ZTeJsfT7p3F46&qdMT_ zr=igXw0`l=la^bAA>>Cyk-J#@(uvU<7-HNFv;)QLZvK%?q zP+G_c8HT0Bl3s;l*fBuLIN|j55Nr?YO-O_oQM$kZ*nM<%1b#$KTL56O zR_isix7x(uq9Wr$cIv4yTq0}P%~U%BfT?8!0AdVkF3q0?Xts;wJeM!6QY22$4V*__ zc9qTn^Y}yzODP-NL|GCUKRo;y@e;R7stdRTa#ILD?2^(;jOlkdb}R~xvsCy9z44LQ ziQb});}a3UDe(+wRXReX*I`kF5$Q#%S6qhr4kpgrDkBQl4!q3pIK$D*X;81md&~c7z#I-QIbW%$hTo5OQRQ z0K{u}zVLdig~$dOHQ8sN_!^!Pvmtvcu*Lz^VAtraSmfdm2K=eyJ3}uT4=MqOZZ_0c zB6~9c<`Mxm`^H+p+Mx=##64N7;7xGJNu0axgJoBU1Dvxu#-Hi><$KQ1 z05jClnZe9k{B_(9lJ4KR2)l8(}L?UZdWtO8xCh7T=1IEL(miu=9oa; z3Xng!J#6M>%%8H^g6c?S2iKAG+vE}y^RUKcSjcpUao%ovo_b<{P>d?P0kf^|Gi;+3 zfGm23iClK1viQAlzBEJTfKn0byb%&qcqbgdScD-d<;bX~SA^j)I*D$9JJh+71aG0l zQ#GX^E@uQnYmXrMG(tEH7pWyddnO~LQbN{d4D<-izL*;6@=4l6kdmhGDk^k^jBr_( zc7od>YeJAEwSUpU=;A}N9vEtkUNE}21w;k1!d$0t1R6bcZY z0wY?YG3Z2ZbdP8@xCNYtIYV(wi0;8!D(K({%0&<;xLG(C5Ku2y_abyVLk+lwCSZDK zmvBh9AcsmQlsqUFNdCf5xnzkEx{#e@b()!Xf}9)%034V5@Dw%F=v~BEVVcfXgn&VO zD98ZC;HXyy2e+H!Ur1fVtLa9<&@IyMZkP!;oIecYPxy66J`n%>IF=7E)fy`kklum5 zC(orH#YS{%YI8OEzSDyHKID3o}pj{vZnwp|-oq=>=XefttE+0WPNrpYLZx*UO zRPH61q?{LOWQQ0MDm%B>E9Ra(09Z zxIuh03pf}~=b`CK*0R#&J}xFSrUf&RX>&9`ou=e^p~_Q?vr}PYGI(b_tacXii=7x@ zaM#Yc8#|k;7loi1Bsts7po2te;1WFU`w(C_hIMBWeFw#f+=nnks71z*cq59*er8R{ zH;I)~4Qw*_kQD-ScOnjdB{fadrA887!we+XDlZ{%&@yo9r3hQZBXgE(5a|eMCE+xK z+6XegZJn-1N#ME0Sfa2H;7$m1fode0k>vXA6-o5QqlY^w6K`#(?= z0aSEzLpjWuhB^f}UGYs#jeO_u0K>I087zs}jv3bkQ;`f2yEF$~wvmZc!Qu%7KVb!m z06^X$V(R9ewviCF0R)871{(Df9<_sT?9(od=~6S$F(eVN;VhegdCFx{^W#_x1&2D& z?NE*h&hxXJiTT-dHILk8auaYT=u+W-o-AiE!01m~jBmnzkhnyfa3HCV zW~3NXG$Y3+k4z!v*2pUZY;G@Mv3DptMW@os^sSMpI&_7qX>WiBjBZdkil9X?vjI0l z{*o~|n^A@;G8-SIY(a$}d&FZBXQTHm;*FqI7&s9p6n-fwNDY`UOmexf0fQ$zK$|osSUFN0BmZ{@&;ORJX z3Z-)^AlqN=bcSt$a~)yG$K*5Jy9fuTXKM(7Go&(Nx~Efj&w@WeFdEu}JtCB+l#Tu{ z#R(YV7xrecOqnd_0JN@hwy;{sK}x9CECw?iS3-dL4slIJ1i|CDku&;Ysu#x$DT-LR z#CRT6KdcF-Q;?))-uuM>3=7MKVP4zPPse7QHra;d<-|sM)KGOsyqLX%J^ekyUC_?@ z2D*pc@($RxAUyiioqowAn?{=}$R5S>m`8fV3jPY^CF%vI$<}h}vuD;aO%-BOXlC4E z05%*tCp_m@5QrzP%HU28RtO0*6g`7ZD{Y%_6sKM!fX;T3>kUj0eFB5pq*2INOJt6cU8DB` zRNfZ_?O?cPj_9)45qKe({uf2^Fsr6eVyOd63(!6&&yWv@C=pNwEnT8B9p_#)>N`Ta zuC=J>(ZG0M4@fJ<46~p~Tv)R}y+j?MKz$OVP#DOaep^T>G(@Q$QiUN~JT-lE(pm?e zZ;Ic!?%e+TqZ7`SDkEk`FTYE%9*5442v;-PfbAjb2pU37$3^&@lT0-aG7s=2IA;A! zJG^VFj&ry<1=p4h4alCUdjNS5#E0)iqI|+9u+IuS6W|k|ED-`4iRFk26YP{tR-DMC zZ2?Y>L2`~4sClx+zWZFjo-_F>`i6XE8CQ)d#*`eOj$00r>K+>C8R+YWYSYu(HQeu( zh79+1!%plU1VifY8ys@0L~M{9>w|8?ls-%%B8kuv!3?m}NOXoU_97um<_o4wv&1xl zcXHx5w~vOhdV5tgh=6(X$_L2m)vBa#N9;oOGtyu>;6slw5_Kq(lh8%V0AVJ72F5uN zk7-Ln(ld09$jU2KTaI8>r!WuLN@f;HnnGn>C?cVXd98vDNKbOm28ZF4*11mhEKE$$ zE!9&}899omLl`)wTsK*gvvY^`O~Oa+$VY5=sz0-HurDEB7R$)z#>H|)Y*6qCr`Cx= z1$9Rv3&b`M9y3dwss{atR)^+Y@GBBp;Ge_zb4f6zkOpt*u?>*?PQMR02x|fh#_lg2 zgo{Ooy`OBk2x&9Qg9LqIZa|q5q|_7|vGD+a@?r{yx|5tpkJKr*v?Zn}#gr!(u?npQ zs#-EU;(vWl zlBVaAj@z^`T7)~}p-4_DmZQ06#X8{30jtm*ELC$Rj^q`>cL-$$VhQ(9 z2GL3dUO7-}Q=*e~O46R_?nS4!gBqGSAROi3k<+VrC~L@jnyEv3tp_fdyUDd1`NS|? z(qz@6)px03MMicQStUUrqyRzbQkvum^Px3CBQ3%nH9Z5(1sjYdSj4iP`jCh@fMuD3 zy&%T%;KJtM^o(lDN*6%Kedx=OG znP<%`OOv2Q5p+t5*lE}R4e=`QEa=${I%(0@#@STa<&;wD0JD~@-0H=#Motn+HY=e+h$2yK*^}heOuJ zu@F^7HGLcfZPvtpSKx1%oA;{JK}ZRFiPgqt)4c&mO~x7P-Ng3HKQ&H|Nc;K z*FazIK!5Mh!0-Tqirg;17<{5TSMD&GC;L+AJ6j&j1_jUHuP1THo>dWxAHfbaNIe#B z`(fEN2x3Fl&rzn?dnG-Yo-o*_XsL_aUOh5;wIzsNJ$kh>9cK}~eiO6B@n|Qc#Mj7{V@)Nf4golH z+Qg(NGf7_I)}#SS6uzbv0h2PE#w5zEo%NAw6sJJOdrnb==qa-D_n z;F`nci}aR)BB84~4PyU81tdlXk0#)p&B2MM5n5reaBwmZp$LEf2Z(jpx)pyRO<>%_l%Qtq#ByF}FEZ31 zQ4`_@Z9?7N61pedd|*suI88CR>GA<6JG4v>&nmZQq*IS*icXWh3CR_42&mc6M%V%I zAb^!17ZegSEI|<<@w==hJi^miygZ_4p->vDlupn=+`g=`kq6S8+)_KiW${G0hRlOr z5!BV@fbz4@(p5ne!_3>yagW}Cc|yFXsDT=|toS(mR~6y8xXo?rmW2vY#+GK{zIS;A zcJ0yLsfshogi|^X6=W^)=^zP2N;Y3$=Cxjk@dCH+t63N}x{euPtjxb9bME@Z5p3iY z+Y^uC9~Aps6(aPB7e^s2yUuWt@eVips(M6W=eX8!mYR>u3w_V=@Cnz{b}VHiE3gOYp1n{quph%$dX<*k}_=$>o-2Arp*V!z-Bx;Oq%aUH8-(VOkE2VhlO5*MP>dq6;#XRvWOnSycxa zODZDplvSeTTPi8-+hoKpSquzQwcO}tP>I(1Wn7#(ZHEI4A%?MZwH9g`Ml9= zxOJ#bP+ma!6rCQe5!Vi@ljJUYqsa`+g)EXqdS81Z?!t6G=#Uzt!o!rY!nv7fNWDQ4 zF2hb2UCKhOU;<_+>N0!CE^y8wnpcU6#Fc$MOem*tXK0l~{&EtbD8ypW;O(m98?s4< zCW%MTXf;wK$WC?0HV^~hXrj*y@R+N3#M|pF!D+rse{u9WY+QOyU$moW@Sg$Knj*afXi4$6mbGATd1=N=r#3k!8}}^q7S8s1(>4>J^xyTT-$?a$4t1Rim7LDAbMizySa0hTCF=4&Ev=P)L zv1@P}>1@RBh>#8H;=Mws2dQ)(uFi4~>BChs4lMf*wK;vUF~ZG^2ev7lM3_o=RLf{* zJeZ^gD5;&7z`EpS4r5H%HhWEu%DQ`vB2l(ZFbK;p;iPOtt)5;wKDfHvbP+o7HE#`< zj>9YiKdaOcd4vt9QjGb-<^T~oj?2pZ!Xt>6)P3kneSRqdkLiA%AdwlWsF zz93(OM}P}fs|d5koFr$ldNS@P5p<<^Bz21O4EnAt*E}J#DzSCi7tC9vlbv3Q>rD1? z8kyO_XBF0z2h`w7K#oStzy;hi)Fvnz(S0=FP>Bi!AwFYq>Q^D!Bwa2NgPVa998vaJ zwx*H!=u{u?;GSsYDK6%6!7(OvBHKdO&5_&bLS?8p>=@+*ae*ob)(fI72obD;rXqV! z?XX7Ux!tX5HL?n~(Ttd015v=xJf7k^saCpgsJV)@6-X*kqB)m~8kd|(+(d(<_Q!JEVIqfoydXUyjyUL z%P6Yd<|Gfc!PAbO(ypr*#tgU-$PUAWqLj8QK~$hG+R z-sywK&y@;5I;aNR$sWTFGY)zPJv_Ywy@SJpLqlDIFt!G}dxrbFVRy;WnFjk4b;s?k zk%8%1SlvxMBiw^f8$woG(njyTb9NzVy#uR3ron6B7eijQ_{I=v0_GtzfUjkQj^-P- z2(B8N%f%3MXT%zcnO$^nY(EocvF4uvy5;fX5t(ycQ~kUt{LeV9 zNm8OdSm}YI(6V$wxMmYmg*m}~^|*HI;Pk`+#HfMP;0}T;oUkmFFuFA?D@JS;)<9G z3b8*&I~&?a{E>JTh<&wFm|mE007a&2IMVp4=APPkssQR4Hh;=aq4VG|P|~2o5HX06 zV9iYovS@)kr))WYl^KIzoH59u z&XQ5oA&0^A;Am<#`Y!Pb9kR@D1;HthqK@&f~w-h3r}dKq>~NY z1tr3XW+hcn$zVeIM`QiIH7PuYRDGu6h4}HNn^q+TLcSf zcRB87GTD^T?xF6X;i2I^Y$4g#Kh!_aH`ou8(5+q>?i%hJ?i=jt9vtk!s+Jxwz3%=l zw~(cYV~IZ5U|BYv%nSDtp6Zi}*cmD8JTcyWqu+i@SNm|sd}sTqYfp9*Gba~gohQ%s zvA$G%%pBKKh!Q|A7Z(x-90^rScol1IJ6s{yeL&ayHSvDv!%$nfitiZRAY|yq@@PrG z(tdP;cvCcg=HSd;Cf9JOAxJH@gC5u#R?92f;k98kbjgqai5jY((mVzZoS+h(HYvgBT%10m#tC{__ZR?DxirGqcLzilfyE&7TG_O88@Gmr0 zg7eBrV-3O&5}6HKYM00=J;b)c4n1K!STj=bTO8-Vh+pW)VqvD<_R}z zV=krJ>sP25qXaG9+n+!a{%{YZg5%kse0YqJoFxefXb3Y~mAZ`vZK%!uZenR-Bg3~2 zZc6-gz6Jb#5gg`c8?HmSi~bS37s+lNOk0SCPcDMpAlw(RwP^Ta&LDB$(7BER zMdKRoGGhmLBc8}osR6HdDj}ywoE5RvKz+!h>Kp9s?;08!z}miU@X!81nD4SD-4eyq zzFOHAwt$~vi7U}IE6{v2EL#ZXEGB`d%+8!(@+LR zOLRs&u9~CFus6y0tJyr_O;X=ShA*(*#qoIAaY2!X2=O?Ypm5}PWw7x|J4)) zi`-J+nzPBVqxL>=6aZZWiyOJ-u=~+3h;~X{Y!L!iIhqFNIOaTTYZ$;tsWR1sY)7=x z2#KAJh0dsVT_S_TN@%@shXnh|Rf#A`7J%C!8+))(L;)p5O_kT9&o2De%+{Sj9_Q=y z5t>@+WCv{h2-5H%auY%*9r<+35#ZvFZvCLsFrnpI6ta^74%_-bB6U)`Ru$CbNfwig zEdNd-1*V7#&e|8TWh+dFsx3gqZ)?!Zjz#*MeuwB4bN(qsm0M!s&D|6;Wt-Tg1X>tF zycui}+d-by_@`-k+&C+m1*$Nn=VI*L7BYt1c0t3p=AD3!%snC;w*(qCse1AKGQq!U zYT02&7fJXwC&IZ{7#&tf$LkOW*rSc-gr1XNaXX57F@G!_d(XI~W1gDp52`TIJgkBlVkp^5fD&bNCxY6Zy294Z)!=kzg8Pe^5pMqK{ zLLyqV++^g18qIdQ>w@FU@8{u1jJO;>BWrJvap0Xeh1Y^7+m=?6Pa&&^nVQPg-EjPV zcYb&N7?^ir1j$z7<#2o5H;2ePq+*Sn0%MxpyZ;78DPjvXK`q=~ld{+%2P6@otcdeS z{c8?&z%B#VH@7`@E{Vnz-ila^k#0u%x!VM(P-$I$KEQlwE)pcca*l^YXUx)~ZlKwE zLXcu>JA#RRAH;FEq&rcJUD}c7b}5#_cA+p$_rxB9^lFh46E!2H06r#v8JkfsobPyq zkf)gU4R5-xjB(ybQAELR*#PG$0B-^cw{xJxj^zmGZaN$q9kq@b21j5<8wXP17&mCi zPe=^#8D({W3*gz?wVrZai2>-gVQ{C{u(D1PS=m`}BQBBY++KyoIQ8bS; zYA+W*(RS`rlPlK|w?J;eE(Fxtu#?NIQ>9h}IJtC7SslVCBu z=DYBKk;mW>xIFS0JVcntK3bKQ`Oz+-Okxj``2i*~H+L9uiCBCxvOu}m@!T4YX4!{r z;yHkHWp4brcmwgeHJE`GP`@M;@Jf{@@(+crN> zw`}x077kKga0LrH=ZKAak%(RD9L4UpVnlJqCUr8b(etnn1YkHUWSVW*!0w{sE?}wT zLlhD43_^2r>4r0_{ zd8u|5N-~-Srk%m0MHx}D537niO(IrvEp}JWP+w0seCvHkPQbq|>}}aM)YmsW2!}g= z@kE8A^U&cXK>R$YBErurMNmezo`@tWFZ{h$4D*$SztUNz$x~)Y)D$67Mo^VGQqjlS zJV~iNcd!&aa}1i?J-)imULiZEJ&J{G&$PvJVLSFCyb^P-Dw6B3#W`*SBRa8>hvRZb z&d=s(?70kFG3>x}MgNfXB0A6d3d#D!)#NK8Rm$0mkG|o%a7r-3?W@$6CJs#Qfl?y- zZjj#L0fB?bmJ0~4J2>6M>qwW*d;_z?4afJ*-Ux1ao_shNV&LC-*4SYvJ zI)`Vy6Cis@0s%y?5lt|oa6ycd_cXcPz&yp)YI3~+y&|U_ZaAlbr|c4$qG7GwrOq_s zx#!fsgnn&BO(Li(3YyD3Qx&br4ir`kx^6NB=_%HYX4Fu0QDe0Rp%%pgN#sI|!q*~F*jR(z7VHTsXRZ9;QqcN(XISPSIvK+5!?6C#CtyY#_1XrZdXaqZkDd8&c zgk?i0dJH+%6q0aTp2TAo&}zx?+#9I{q2CsuriLjO1QUdj02eIdUL;nu0c>2nxymf& z6m^q}|3QaKjJ7L}l)$+Qjk;|FqA}-)TZ|=giqXTTEA!k#OL=+Qed(uwgSaRaFB+K%WIF>BSvSQ0tEIDyD+^tqimMwM5-IA9Cu(E*@mV~fR zU=VwfVF?2X0|XFDfMMSW+j|X67#Q9R1ejru-}h{F@2&1uD`DpS{`qx2@ljQsI(2G0 zb?Vfqx~o^}N3T}Z*R5>CCKz5ab@g?1c*k({s`~nd#s=((`4KK>le1Nl2coU;VmHJe z|MFC2XPOI?<+6fX_SDhq=m}UeHkm!p?b7isHMC!OMvAPc?Bo|PMd~KF!X<`bvbCwE zW8M_udsRU_*bgUI}J>PmY4NQclx`)sP-!-FaF$`(45#tojbqndtaP(NYvSAgry5#Fox3Ugz z`>jD#Q$s!cWuq5z$hQ>}7sg?Ho|m;uvF70zSU-J(SsoT}UARmESxB#!sgA~-%Hjh& z@?>xh*e%;UA|%DB`g*4R&+>q~r8`C=cn7c~Wc0jBI| zHU|*VGjK$5SjIOz1aN7F#EjZvmoY*1)1hXkApj4=!7LwRulJ(%tU<{*6`D9?ET=Q^>@vBhz(r%(bt6SCFPg(x{2*>ZsyDE&G4O}` zWZPzA7$ygNnT`(fy7VrQl>_>6gQp*!Rqhg(o&NIBNAJnAb-|&UIoryc)x6N)v4G6b zVRKWAUILESkky6a>YHkp>|P>k4PJDB-2@wG_@mPiGOakWuGyZd4>o6dy9n~ro}Rw9hxiF2-M*8 zAjyWYp?w>~H4_E`KIw$cN)w92T=0NM;e8m9R+qC5*hyNrfWg;SVzQp zRJIY$a8saTAd;@7UQHn!)#IkZS*BK&QXD9cS8B__2W!^Lxq9}0)VEqmPX2Ap(4(-SA)oh*G?I>05Y=FylveQ|_0`J=zX1Bv3E4zcR+oa=} zEJ=|2;iu}z%M9m9>(s_g0~Z(I%?*|=aH>yCF1tWHUMQ7bijk92bO*nCWgY3tk}h;( zjr4M}dpR7NJ0odqtjTT$LzgJR`1CJ}M%unWvbk#r^i~?ql?HoZ-a6da*jTrk-tJwE zMIP^{kWCxXtD&iBRRf$o`BseoCi%dg!M*#2@Dka`eq8MvJ8t*r0y zn#$QhaWWuoO&wN!mzF?^ zi752?(8>mS36geUgv1xC!;~r_vH52T!AWC5B&X{Um6~KoVKaVs^UK2#%Rf$zO?JYh z=gCgr=0ekUd5J$%Sz$#zACfXq0_b=Ky90T)$@~ULw9A|YM&K7ft0VkvRgUXt5@Zv> zhGQA`yS1jf$r!nt53SUCtdlmhX)H5qX#$Bs1Lg3yVW9i_CJ&z4JCA8DmZ@mQOXY@y4ug9i@F1*O=qqyrt>pk{e zi(oCqW?9}I(UFN~C-p-u@Z!O~&2yBd|2k zr;}(k(bj4505@{ChrJXDq};qjo-2$J&rKcEfhYL`~a#qL+b1CDRn&c)zFA%A#n9z zB~D6ct-?)&)pcv?^aDdHaj~qvekH!I1I>HY>V{Qy4RBb)_lH&hePyG5?;|9t$fU(j zF!CNYV&n?0bvwD~+;K_g(I;=Mk`wL?Xa?pP2aP~ z%OZo>yKt40;^YpNI&IGF>6>6kAGSoSR=(C$No-zH0cQgHy&+li*?2y+=}L$ zB4j7xI&LgWwi%qXj=>I@?Q0hujFbYLPtxMSQnqwLVTB@XZ8xiq#2XHCbmhcD^12%* z6V6?UEHK75Jme#HA}maOvTZF1LGVKImNmnmcZ@91*f5s}`eS9z)ZhhefeS ziNp&HYT5;t-|m_M0A$)9<7xrEjY}u&B(`ar)k*>45lb5G$AUvX$O4$xbgan`Bzlqo@bQ8H^C*;Yy>n!-M?YFuHSXZl}6l-P&2| z0}6urH4^l-h>O6`#p4zYMN_YZ_hhss3btsy!M?UDpSg~Vi`2tvI&zH=9B`D`5K9+R z0)5&TsvUofhf5Z9nl^U`;-#Ko9SWb(xmjI0`)%rAD1^+lICY_m*!G2G?56^a(OkGm zL6V_Q!^f<(G{xnL5A_LEbst{fB6|VuJ<&ZUtfu6(qH7zkQ4|fG15a7d8x|BwkYgk* zQo#e@5uxWSmplbXXgEnx(U>c(NZal}$yAp;_gWEFA$l4EQcd3XBeGBdS-(`{mL3yQ z0;&3@obdh&Bbg>B9%3UsC*m;Tq>CQJ@isyCsbRymS;PXjX}teQGtqOo#2y*DDtq|ly+Uqj%^*=aFVmNV@uoC z>*K9k+gi5m>{`C5V_VDCjvLx`#5=mXceZsesA!wwg>gAe3t3OKXzw^hj<6#WbRf-U zWYf6qf{WNQ%pgKHT+B>|kpX$8(@I_(gXGe8kFa14RIy0Q!bY4{LnJF6FYS>f6Xo;G zX}+1`T=C@MqHAzl_f4nu?Nia|OiLHV$mibh2brH(jMPFh^5dnbG5M)7J)P0!sK^y^ zpY!9B6!>A7otqa(*tW^+gVlU&B;wP;g1rYXhuc1bBS-_zj+Wg-hQCi>8%b0yo2hBt zimx&5?&{dMX=80j?Ao>s;aChA?7i>}SEK}QNv^MT zyD*+4Qyt?3i!{kE+sIKL!L>2$ZA3SnskzHt_+V`oCoNcQAm;l_2(Uz$S_*LgT!Etb zHm&G*+~eXC&RbUcC@npR7k$ix7iTjfhJ|xkjT*B^zV{tbsy%Jl*`DR~{LloiA_?%_ zxq^xUl8CYtv9Ra+ys9jR)IUmNmqJ`mwhLfTbH&P&3TY;+a+gdrr(pXtEhNx+E{7~R znBRkGISeNSUKNCHatFi&k_TrJbhc~TPEsuCA}1S<uc_o1Zd z>?OB7dX7$Kb(l|aK-LY2Ry8op1|orUUv*Pv^%te7VOL}V$rSPC(C;#_aFA^T1SlU% zhR(dYfxZK)2dNdRl=8qM-2e|h@~Q;G5HU{2sH!z!w9$Yt#@NHP;fUrVNP)akCPbuSt zJRDZAVp3W?KD`aQFs{ntmIXfo(1>ebYZ@By7Tbz7_%wIZD*c4WYW&p%baIU5E4HiX zf<_bESLz_DAgNX~xeo={9o3DQq10irvGFrBs)Wmj28egqmF<=aE#YXaQ1`NnT*w2W z@=W5vwmdYIOyE@0da?LdLbaC;ZBqp$*thD0cpXT0I>opX>M!OpB-1id)>x01S;C`4 zJ$<=PX=jEL=!2}5Ty9Gc^b&kI6(gRtXHoo_Kv@r9>RVE=)CQv$P_0^B}1DvVU-sSg3m7oqJ9WXQeXn1Z{NX|Ok{Y9jEiBgF^H#fUl+6_JIdkWchP@%D`6VhkP*xVJmIX%i!AI#E7~Nk%hoR-k}z@^2qLVklPTl*|Z8rk>4Cg0r2`J)rNdT zr!|@Iy>hHj^w1~m8z8PBQ6Mt1h+_)~oV)q_5_2@a0K-S$v86$a%Tu(rTP9JPfG>@? z9&3Bw7+$%;D8RhH2Wm0qurGnkMILf*Kt`Ui^bI?w%VA>C)0cXsgl9j!n~mqNf)VQ` zpIU7K&t*(+^bkv)M3!%etfP06)xrlCCNcG4Wua>FIELDV8{2uY3EI#HJM>=9)MMW> zSr9qvj-AjL(Z?96_=i^-9nUQ1!~)EX8THw*i~EadOG6*akq=d3gxNA&&PcD#QL?=t zg$KRrHW$*PQ@Cr=btoCw?u3bTU-Z*JCvCG^vO3= zKtC)X%Q@SQ0-GD1cG_w|7R$rIj)>#CyEw#IP>LHFM^?EmMm zxhYN3(0MtG+dTdQ+0+LIkg)xZ7@-*5@Uw-Up7Q9DSA6i|1b--en(LzM13Tm+UlF?(6FLs%l&$l0E`{BChO7?w6DlE%+U~=JE^H23MrkUt zt0cDaGGgGV&&Lh)nMIm(!N7#cur3Ih@f-Fq_wvlGI%u&ZV7b6T7($oF#AvXSd5C?4 z5^eeXCKwG`#czln+6aI4iiZP9TA1Qwe6vN4w&pNi;RW`oCR>@=rmE9)6(Q{+d;6G= z_la}4494Oc&Esx*iL)bb7WzndlO;NI=)j5vq%$s#@YD^ar*9G$T_nW|fLjr;O5oA4 z_EuT`*l25t4sK7=$l`3oA7w$mT4Vtus`P_WX zr?E^@6Vb~gvQkDoJ|WWW6Hf6sX4Gns@M68j>l9Jf5%58sj5RfUT|VkY;#@eX zA~x*YGA@eGGIOpe?8D=R!JQDjbwa8rEMznVaG=I|B8udl8AthwJ`Eop6m59*Sd=vB zTQZ8tI~abJ(3J>2*k)frvbd2-B-;-?!)qg_*92)AfrUSEyeC^P9xv`@4Mtb!GzGoD z<{s5HY1Uy@%9||eL?<=Y3Ih*)!uow^33ejZIe3XB97`-KEu;{U|1bACHU#|MO(D@T zgzrlP>lJy1;w&5t@)ul51CDnsqi>PGc^*xH_aapncA`y1C%#q8D>!WCe2!1GAQd{S zyxItZ{t`M;Hla{n>2~FygGpb&%ZK1Om&WJq@vkX`F17=1hznRDCT&P2D_dFM>LJ=7 znVZpPW*`X7VQSK_O9!+ico(A8$-M*9R~f{DtEX0B_b@sj&a+q{rB-h$k^+Rv+P0p{ zrO6bs%CmF|^?+P_qIQ=QHs%*-D~2w>p^G^r)7<4xJE5;gBq0?A)6UST(d=3ZQIFes z&?CUU$}~JTG>Vr>f(w<5LJkOp^|hjF)9j?l-p$)N^L@iKBg+MDhO>B6-#)r2Zaq6} z8yVgNu%k4*6qaF@mhal~B59%cf@9PM}0l>*;J&TO0n6ShYys#JuBsckogk zNVmd)O1`JwO~(oeC{UrRuH{|kP8I)JdjW5y7N7Zq|Kq*ua3L9x%)7T{hP2!_z$yVS!U*JBBd4+Xy41~oah+MzLY%!Dr^SwD-j^If)?R*FE z>^7W6C^rpIbP-w4WWI#-0aDLWuxo--{3%CIW>cqanXM_%!qk0OFL<(aQ0b0MPquG4 zNI26KZhb)0=p@rYuo;A?DZsVJ9?691s-gx$&R~3#tlSNeLXHfYBx!=B40{p`ghUqs z5}}7Jk#C zOzqr&zyYd!DuAk`0X$50Q-xJI-FLmDjh| zTuTLG2{NdEaDX1D6Jb#@n$S5kx@uhBDK@n95Igb1Hx_gcNQX_Dx5RjgwVN6m;{f~Y z%bnVIkh~MK^o#;6Z#2@@#%ZXb;rUDI5M8QZ({4!zBoPw1#vOu2zm6PtNIxL@VRJio zuB?_dD&a^o!UMlUbOWnarFF39C+j`=lv7t?7sh)X-Wc;bgoYz+AE)0nHn_%W7r5~e z9T#2dj#gz%izuQaOj}`43A~ETG}yth;FHJ(qfwv%xe47S$Tr7jjyM*b#CqG z?C60ih4m{5&k{VuZ3o%QS+bKyT_+p2w^A!66Y;<8KWjUX4efe7N7^a&4UMV>mC^`3CZ@P;!5Q!`yxl26(g^~9B%KjC!%b~0HnC2{qchbd)n%eau#z7s6 znZABYkDrV0M{5diN#MOpXooaNOsC*3Yn3dtlfy2^Q-xuIAo~c)C)cis(kv^HeWD8u zhr>wLrip83w!!*mTX1)Cj_*R#hB7;VvBfG1goVC2i~ZoCczqq7(^<9BwT$cs&EzKQ zjZ80`ipeAT;d)^oLGuUlT*tdj{Fc7pwQ3Vi&dkn7&ftyKMd%fk)=S9B4hZyw=i^Ko z6r$nj!bih+D#!e__yi5f*g5CY^xUqz)5H5QuemGlSR9wM{Rw))Z7=!um#W>Mf;!-= zf=$NU$?hyvmIs{b&|+p&f|m@6i{KuL*U$nPSppMXw!Y?JeLFzolO5(zq&z!USdWA9 z!|`Q(>sXYKeujdU5mGHa|Et$KFxf)(1WXPn&tSq?A*hm3GXzrAISL0a%j87^jJ85l zhIEi6h8%d@a-j z6?n`Gckvrm;Tt4tR?r1sydbioaRnT`@$@x6J%Wd28}LXZzJ!YhNLJyo$TchLa4Qm5 zH1Jsy+`@o#TMfs{I^65WwP3tava$(x`|*S=y(w9buk5YBoBnt~j4ynw!S!K$To+#B z5Q})_7O(%{?OL!%&;Q_)C?JH(9f*qIm%OTlK&-ejklJ5~XuHj~*|AQ@@-h8#tZ;p3L_yUP9UM(>BdV#S~4Zm05M6bZfnhwra{Ofjx zlM2T>ujcT?H3FMoD&>qTocLrrr^ntU@yQ=6oqGhvjZcMft>1)(W6F1Yt+vPA*GPGv z5V}Q$;}2>%4+)%97<*XbCk0MCzLE2fD_`ShZ{lz=C;S!Pp?Ljm9N(BcqOZ1D;w6izBE zDvW(t%U9T}FsX1t>5gl7Qeo^PlCN3exWY+=MT5qd_IFZYvyS5l9Vg?T*YP$_#!swW z=hu+Tr-_vkpHw)0i{f9Z<4xy5^MuytULEhZ37z6P!A}kfEdHm)zeVwjLZ?~BckyJM zKOdF!;=2SU6*k|ke9qB)Kh<ro=Zjp8s~n!}QF(i<%G)QE|3<-YzC_@}kCom}1je4~;_~BfR=Bj8 z!?BkNoLDaNc!tErY8BqE^g8apgku(H{31o1so^;amnwW%;ZB8f70y!lq{6clo}_T6 z5<1P|HDgA@-+yeFOCJ8gV;u7^e)Pvq{0J75;Cc$+7w3OtvEvk;sBr&`asI1L!;2Lz zQP`mHLS^^^v&S!=iIOkS_(clWDtwW`hqZxPH2fNcN425aG`twJ=r>zHOjfH{Y_*1W zo-Ti!qG9dD*y4vi{Mvun6^nIhIZHY&;i`2g-u)7cb!d5iukq(7JWt_Yj?Lr0jvbST z9<(2^#Qy*;K3U?WRb#P?(tApxW4CI{wQd%UsFWzJ4tFAi`}N} z7HgiStox&#bd($Vo2`G%Abt-mJ+kw%osT}ekqzGO$eq#O>?6l{zayu3zyA?FT8xd@?XzaixP8{~ zmmGKJ%u^PhJmdDcs5|{X57F}h7vTTr;cxnXA^u)CYxZr60MF6?FGPF-e{aD5yXMTl zS7=t^K8n-v}t4?q0jpG?xRO*?rFaBvZbq! zjLaU{{OZ}Quiki841)BGg$qx9_^#PUVwl3?7cY#>c*EJT)iY--JQb4nwwgF5LGx`Z z&zKQg_}Up~&5kv{eun%#W5#VWX3o5A#@thHTaysMa9hpkEtk%}?NANnX}#@3b7#)D z?ce9kn{o6{GiJ}cV>WUeTYvS@8Fe#b^PBH)j@>n5&dj@J%!Gp(u#F!-d|#FHN4)e&FYME+7Ji^h_+euX zc)sj92{$YMtCfFi-_LvP{mVD+WK7dv-~E_`O^@CCDhbb4dLQx9KmSHaw{`Y+9=&s( zlJv7Q{|`0`e=9WnR}X*NI|SdhLeh=@2mVpQHV?n!@w>~T|D;E+ z*GvD(dxW0N@9%rz2fgx^yg~3yA1r$Gf9B5o@>^giRY|8G40zv`u*w4X&Dy?Z?TS9{?n zy!;P(>Hp}3ANRta^}?-Qdo1<%`I?9SeXl(lz4raJ*FR^xSL$oy>nSh)E#7#zY=_LB zD|G(!c=UTdD)el>dyz-KZHwezsrip}N_drqPwa@!&wHy4ksz4Xr-l$f03r2^(IL-`L_4V5n^v87_ z^}}DQlKyKiJ$7hndOm$W{NZyYzv(eQ^1=^!?eQD0zuxBcXWna%xYvFQXGnS0-&wD} zPv0%+q&v{Bcwct}#=j@&7XP4E-u}->|CoMu>UP05ed9iFer)#oziFG`+k8lP{5D)B z>88)jULfH(a~X?$-5alu=y>eZ^e=hsb>Zof-}KL4$0cm`qSF^e!}$#oUas^W|97dc z*5%%%y%t^2Wr&(!oUuMqkskM_Px(oJ9a#ym+k{qe``5^m7^fBmcA zn|85|h{!_xn@3~&M$qRpBezg2+u9C3H@3pffZ1eBhDil2R z{Qf?~=#Sqm{bT!|iJ3AkT)MZuTD-x9x<2{ql%>b!Dm{hqmqpj>nGR9@IHc|2_M=|< z$P1*t{_+dSD1y(oK##U^@wkh@pHqEPJS~bOxz_F)MUM+ zPc9HR@r@PtQu^e}Hxr0idhrTLf8+jZH&J|i_SFPpM!)#Dw9lJ=w)T38AAhlFIuwe< z>a@QXR_OO+qCB6?cSQM2E)l#vHK)Fo=r;c(nqJiO4_)&3)094L=~qg=@n?k33vavN zeoBvxY-eEgjJHYp3p<{;j}pf3mKD zn*L%*pZTWeG2!CeDF4Z&lKz34_HhG_8+~n`@vYL27yjE3UHrhY&xRgKZ%wIfC>63%ec`&Z&x1RsHgOuLv zrBD1t=+9n#9FNcB-OYp+iyx8sAHSo#97w8ssF<$vG=8S=xA6rJ$RB^v@oDq;4-$Re zpTGPMRBrNS?O#nVzEsltpMS0_y^FPfwBL&gV=tF>ocMr_i;a>mcD5F~>*~9i{x72K zGpXrofBNOqDScv9wEZVe7P=ihr|+lq$tRi#xc(V`M#_8FcV~Zq;)@?>Cg9SO=SlgW z{_MQ#D8Bi7TK*=9FYXZd!n3!1meOth7)&Z&vRm-Bz5Jh_oC>d~cn`hq>u(^u=J(2Y zolxlL^$5N9fAzSROi54i_CLLcRV(Amprf}_=zZ$qr=OaVp5p!f$R9pc7H_lA89!0l zz3tYooIrT-SIM{;e}#@8#Y<)d|MfqA_{D@bsdz;Xub30OU)_H;F9gl67CMvndi2Hw z?~5Z1tco?iR?_45NAZe7f_G%kpWaR7jw@cXkEi^t|A%jI|Hic3X0P0$mb!bW7Um$o-KDqmKgg5?1t;ZWYycY@HM{d~mb;f&> zq!&HB;;`U7_|lK_dR$bz*xyCz6_wuT?zi7h^pbzC<$8F@BSP=KrjuDEom9ML53i_r zC!P7D&k?=&o3%U-FF7vs{^POqYq(s+8~5;viuZ>tr~C`yO(@=khnKuf=uPzg;hlsR zn~-uRJ-njg{afp$KP0qf#VdMv$=ikAFW=M2TZVDPi)sHQZ9Ly4cz1T@4-mcB+qAxK zRj7DH#rx-%oyl9Mq~eV$Ua?*1#4i^3#*S~kl*rk6}+b# z|M9=5+zFlklivJK?i0Lc*64wYrcWqc$DiU|cl!HzoX3=2(x<2M|Mqi+j-zs$6>q}F zQ@L};TYfk|cyXQo6W;t!jtGCR{P^m-2rsF4vHQG!SGV;*EQFMaBE&JO0G-eNyozJ-lRI=)L6P?T3h7(fE6%$DiWedGS)&TE0fon?1Z_ zLFldf={3ASH7j1y!z(J@`(OJ;-s+7j-nfUC92I(R{`U93NBm7H-lT_DRJ`~rx=tg! zn9A9hCufrfgx)O|_RJ@=`0Jz|lOA4C@m}}9opHiTDqhjUOCA(@Kl<&@*u)gqc|WQ6 zZu}h*yz9So(xXJLS@DVU z%aguFcyV1XCOo{N;{Cqm!BYq?sdz;nPuHJoF8JwvoE(*t{waK_rAe+Dz_(1&f7Y0mC*aup5L$u z#pJd@XYYAXlU4LkAHSMDT7q9i-}LdT$wME%np`ZwuOjDt{A87NwFJM) z`sL$STNe$#sB%47MQ`)*tLbk(ezJ;uarlZ?tRe>uKdE|svC6trf?s7HQi5Mae*5^z zD*F;2zuNw!1i#8Y#mBF7`+xlB&U*Yg|K33CUH8Rd{Mes_u8*HQD*1kR@w*<5;QzS-{@sG#^&dAKAI5L~ zV+DMz$7k-ii4ApDe%!~`_9<==d)^2C?W^A<`o+i9&Z;o>F%91@d^F!F_&2`rSj0XV z|1Y(FE3|Tpns4GlvDYsyq?*F@Fg%0t`C=DMzDmj)pDpEm=+7^R*5~h}KVk}-6^fte zx7ns2+q;<$RmczZFAqKajn3XKiEqBQnRqDsn=y0N>^XDi#T3pzZo%`8KjFla3@$wR zlv7VT{fsjWo^|#)=bm@|1s58e5AWoeGiS^gA8&4s#}_Vqw&D1qi!Q!o@uf=)*3>S& z?DA!a#kaF(D?SD@$W;=E&dpB5B6t(b?`oa_Bd4pHK`Qux1qI* z53PNC=$CKx_95!er~&kIO4zTrANK3-hf#Z~{tVO|Jvn=J96vP0LbL-lM02%tzutb> zufHGm`K=cATS2&=F@ty~Ua1~b6RE|*g;WQs6V-=m z{MG7PEuH#~epGk*Q9IC2+F|~D>Pz}j8_@Nvm1A1?BnpTHLWp(C=?QT&@28cr6K6 zXxB))pimB%f#LG$Zy80=aa3tMQ5#jFYw=iG&>_c;Re~}qqvJ9%K6y5mAJ0@i(?z{1 zK`mbT8+d-WTKU!5$Ljf9VL)I03b%jhd@gMVDi_t_{+$k_wSGPj4Vs(`w*&o6eLz2v z69&h}eSD)+36|>@;#1i;MrBM@UbXfyI+Y-mHPug~jJ2!5KyH@Iw~`2&GqYyJV$Tf* z^^=~D@)PhuZA3q6FZxNpjE~QrJ!j6`x%1{dSLpbj?l_9p^H`MssQieI-}3St9wo|mdNM_K_@)@0qPz!YJE5*|MVZMb<^>Qn=lSj|! zYBjlxss5o>ovNKnhHFWLj$7-0>EB~AE?BN`@h+_WVEq-Y7yT`x_*twUM$e#)2MxRa z)<0Z7aoGAlIxoWWqZ&W6ln&@}Jzcm$y!DIqlZ+-APrlx7g`G%uB+i;5r(XU$B ziV*#drYBj$e;Ab5IdjTG8Yh$s`i9asD6{RDw|+$B2Gzmlmq_to99g}M&UE^!9FDbH zX}3%}M*3~q^C;ZUe*L5JlX#=Pq@V20OZzp3u|Pi>4h$=XW!$*_)sC@su<|&TmiOna zjV~Jqup%)ZCLbz?dHlF>Vg37D`LKCP!;BcH6t;24OoslE{;%Hd#%GyP;q`yGe`i83 zm%?nmI;inBj)@QYTlfk0yY#%ZxA8&kMSnYbCKtT&Tz_kwb^6Y>{t5Rx^)&UfLHaw) zAMqxmQN|(tjVK;T4)Sh<)(MIaK`-9qLZy05m#?6|qjDzH#Z&$XJ|pdJ{FLeEN>SWv z!Fnz8tfb$)ezATF+E@M}e(0xd8)@(I>$f+){Bpdo8xPuVwho5doBpOTKtCD-;q^P< zSNODXgpl;N*UuH>6>qxrti)#}`Zm67d{mnMQp>688SR&HgMct7{<%P*UVh%wSPaki z(ta5qr(Qr^XFXTw_zuQNv>sLB!~E0V#0UMTU+G76FzDAuHI zyt2L^B}l!gP3RZyNBWzGEstDDp>R0f@g0oUXgijT59vu@g7_m|o=d%j>v){%NewV9 zi1HXO1YJF}QMl2y-Tn6V+lkslv<7Nts!bUv(P)4AslI~0xLkt>P%8Z@m0xKb8y(K9 zv!zep|!icmw#Y>p#K)-73VC^lVAs8RDM*S^6E0_D_x&8wpq4gp<9zyfajT10z z^Tf)hcA~$zz3@-CALwry3-k;3gUvsp<;ImZhJ`DR3mp*U+O_OFQ^vx45kJg7@vi;p z!djVVd}urO~Wr&VIshUv~`a0iHN;ItU0Fi$Aem_@g522_1 zipCc@0*Mm}3rFSu4cCKc86Q-4`dPW<+udT(-r;%X`T^~&#g??c#tZ*aZn*q#{poMv zCg6wqf_SS$*W!sL6{SGs@J#M6DwXKa&&C(E2mM{CU95eKzsUS@{fqJ<^|O91ji-7| zRX^dbGJnDk`dQ1PF#S1ouPZVDwGaI$A3>{^wYT+f6{zzrW>Du_tSY23=||<$&oAG` zU%7UmK9by451U^zbe_$y`c;Hd>P(q8)NVo3OzSTxzm)$f?d2!Wh|ZHxyD1l%A!tvH z50_7WYkeZ^IMw*7MAza$l1nnu(eXY*&krh(PvR;3BmO9Cd}^9EUqbyBt!L1W8Xq1n zQ`NKF_@Q}jDP}|LL&u@7gom9yEuiH-C)Evxm)(ir>}5Jn_4l`@)m> z-cvls*C%4*3Y!%sEj}yhmOrNXZ@>FyzJJ}kSJU?iOlo*i;lyAxe{!yr|F0Juxt-d4 zVo1^_h6PS)IIiKChGX+*95-{ptmn->e$EMVPn>ts!n003`;>D|J@>TpPCx&Q3(mYS zUbCq7qNNvKcFE<7mtC4zvK*fhSktg}#TAWLu3Xo2)vEQe`3q+pck;{yr_6fZsk4ti zZO#d&&pq*sc_*EDR=noyMYZQ#wDjDIFFWs&%gV+#+q1>*+_`Dnwe8!l+m+mNeQNNAUX*_p7&sdooC6ll1rO(eiSxn51z-dG*R5Vu zTfgR_r44H@zHG%6mt5X><>F;4*Ik-ux@yUC<{zvQg+;YQJeT&Lx)Jj(sQXQQLv5YJKk+CW)UOd98rBLIE3Obe8m|;i zR<09XnywOVjQ_gT&6|xvONY_eaJ5ls-C}e$ZZ%46okUAYN3ZOn7N}oCHKSH&SWC5| zmRNBGaZIhzcqMU7EwXZ5Tj$Q3sa1@Bq7ZO!&Gi8fJ8lTL=)N)Fqvs~#gz8RtlY2%E zS^25K{fCW%-o5!-jED5T!mY+d-_Ym_h>vjj$vt5XQiEY0diRF8NbfT~g3?K(N&TsO z3P~Ff2NaTaARZ_rZP7PGf6I?JvA?k%V?+fZ;v@(WCl-p$n19^Dlg~OkzNn_Qu735J znX?u=@03%|IrpNAmtNMeV(k^P=Nx~+X{Voe{w0eqU)H$t%5`(+op{n2XI^mOrArda zn^s-59{ITokyV;;aONx?%#@jj>E3;_=kUO$?9{2fL&J0D@gN5Qt$%9I;K(87slI{7 zKyP~QK52zxD;jw$;KP-}(h|p3Hu0F~AIRpc9t5ccLX}1gTHzd5RYpZioOeF|CI1lr zRDG^}bIazAu3guo2Gj(Ls0G$+XuW#NH8#+)HC(xFW82j|J8!xfEigKE z%i>ED%U4MGXnkt@W-cC7n1iz~y115Gkr@CT=HZ-67BA(NWEOfO*-*IDDv}MwOKd0` zGZ1P9_owjVg8GN>lKeDO)(6;TzuD#CZ=~;zoUkd&)0JsB~59@-xr~!rnb%Jox zBHgf$M(+p)19e2xs@23e`aYT3GqOK_=rB)JFabATu#ORMeQz3HYa6@u1usE?-MB1jh%J~x-58C% zX*A!y5e&#%$v?f;%4^x$xovyT&TFr`9^d#H7#gPXXHx}^XOCZYZ>Bn2Laba)wP>Vj zTnQGMTTqY99jHjxHK@t1>rs^?b(*3O&l`z_t;9nQaefmq(#J0GsPCRZRCr`R*gkX^ zTpT+FHbO1?Z2x4FhwvZbJ;Zm2A!Y`3NT!Yh|9b|(|H%GD=m(PB#CC{fYPcax=EA5- zQ)Z0a_QCqGV;#))&ClO`>{x1eYNkW2YlyN!#c3MX)bjYph~f@7fopNPc$jk^Eau8A z<0f9o-9Yja{8B$$y@fggqJnQAlwxwd+PFVDxpq6{=EJ2+s4)`DscV{6F^6+_1fFI^ zM`%UJa5IwZK;Gl19rt4Kqn6>Jw^hsG;n$bpb{ys*=!72)mX%GIc=)wclpd7o{gh9O zrKZB)XPqtabEN@KlomWgn(zW?nM5OeWsc*XZ`P7U+)F!;jkfgJ&m9~C9i9yJ^EDy-B12!c2k_i+>YmjL}Wtj2j zAII{GenVOL)G*6BVAO z@EnCT3NKPviT(|m-m7qr!mPqkg|{fYUEwPf9#vS0{@YG&=A?%dzE9z!3O}mwQwl$? z@LLMMqHyxJ-ApHbf!HB#dF7M*j?nnWqW1tNHJns9;idb0{_)fDDTJ#(Bk=tS7d#>1 zjKZwKk0@OHSxMio@FNO+`lBzA{`!!@pDVoUsP^OC0+HB>sLc?9(r{X}jn< zmiC^d#oN2Z2L1g1Ux!cAFGc;U!t5-uC%tsGzzgOH{9p40{!ZhcQJ9~j=?YiOm9W+8 z`%5Hj@Z=f^uTnTvE8)LWxKr_8r0Jhf_zQ(ag+~8}ZIa*M;~f%yqFvyGh7DT!%eN?A zr@-dz0^`>RH2M#|NnR#??*jrYZ17i_{>{IabPNAU<8M@G_=acnTYF`kU8C@7g}W5K zO5r=au;Ck?LBlipv%etsRo|oVhA&EZ&X)wfSK*Ti=X_b>I~Crg@Tspz{IahKH2Ot- zU-j27yjG(0ecAZ9gyR~nvv+G1b}5|rmf%%-&vxAK6mHH5ewV&?+NI&5rjIE6wZd3l z`TDj%`;Le4KdJAl7ZpCD^d3?A|D@r#zH4jmsn=<^Sz*%X+xJqmfS-O!`uBGV=X_ei zXDGZ(;k}=cc!R4d#9Mkw)AI`BH;Y_OHp;!?{L4D(hy}YxY_R#Lyz6LTgOe{VA0OBF z2`}B+ulrHCpZxX@3bb$~_+iESzQUhZ$Tw5zo~O{K*QD`h{%jkwVsQ4qM8jumIN`-# z?S=a_e9(*kvll-1sVMyyw97lGuT=P=%@TgE7q<8(y!c;w;lFs{E0x~03I`M#y@%f^ z_ujv$@ahL8Tn%3MF2PGFyi4Ji6n6QaE_Fgx_+Gz)vas zSA{2@EAhL}6ZpaN1zd@3jS|`llp$}*Az~^LikVWyTkUry}ff* z+$?g~-Z`rTWBMLi3H)#3+sIt`64~FqM&Yj%Za*sV?^Afv-4f0z{Hns`_elJ`3V)?= z`%5*y!joR6`4v84;g@UtvxFxr{=iML|E&hEevWu|X+DFGYxpUJ3vZV4KkdP*y|ATc zHU1R}-|OL7zZm?}KMVcB7p4bq|Dxbc7e4+a!8iEwFH6|qr@tcMFDQJ;w2S`B|$p`}~B4BmN#=mk$*De!mGgqd}MKVA3*#eYiSpA?>VmC#w+Ch+<#QP`yE z4>wEvhgzffLmd)6qR{eN{d{N+EEW$7WaJ0CkROgju-zzxA$F%ALc&274Z8>nTZ9X1 zL=cvUP?#gaVTy=^5fKdwjexsY>?9B2L@xp+?g$3i?!yuMxJ)QQUYiLb^!XVVVRki( zaE3OG2rO?B5i-SbMA$Y*5ik}rInDXJ%nXvr&9R)xA*@k0EuQ(RvXF|XKWbkXMH&hB+yg}2) zDt>oFze8f_mz9ZNT8=|<0>#rt}s#T%YMi#NIk z{rnbhFg(})JN~Xa_`c)sADut5<;S0#_p|Su^|O)G=$_*S21oad^(NA};pMHlZ2#cE zhOyD1Ony1yb0dXi`OJY#zJTzaRC?d?zFa!JCzIZ{U^v$|-JHiAs7v6#Wes%=O?9j4 z8|xYySJkgx*3jF~unLDZjVsrzxvXz6KYIAM1-)Z~Lw(0BV}KGe>oSKj76}GN2Eo|6 zfwV@owr}6vwykBu*0zo7>O*m@o3^&JcdrY_baj=+?b=lmw{>GAs(pLQj@HfVQp0^s zjY_S3`}Xd2Lxb6|LoTAFb7NEEx&y|+fplRV+D?-ZN}ve`3xm1rx^R_KnN_L&zW!DH zbqy=(`!ktLQ&Ur2eSK4=VO5AyVsvmgvyNJBS>38-^^HAsjcXfMt*u{uLx?_FYOsGW z)3+!O~1DS-uu1yCpG+A zFWxV=T6n4UbJuNRFENl9YXSJ3oV7oz1?!k=#Z!=pm)>k5yJ zO^^O*2L`Z2A6H_y(o>RgeChJEi=!3U5?6-SY0Ofd52=_)2vD zSOLH7F5&N9g_ZI@+xRD{(EDSB^rc>ZUh9Q@K5qS%*qvv8L!gD9EnGa!{OhNQXXW2K zU3|rRgTfCf{H~Y(4_?^HIrW==Tm6lW!4)38>oi>O;tl^*8vlU`>4x{+D(Qx2@b`+p zSo_)H4Vo%2d5VnVqQd4=B|NDxewu_Q6vj@M@VLU*8Jb^V^O+KkpQZT}j-M^z$e^BEs z|K~Mq=`p2ed>EcVi#Hfo{AO>Qy;8%*pTXZeB6gnRbyUCQa}qvT!@u*s=li+uN&4xU ze#-+Ao~PlDeoVqAY50;)NqC`#XMRM&Cu(@17yd`D{P(<8@aHQ23164+sTyAN`e^#Q z9+mJ3ntp*tztQ98MXwh8*^0mG-4cGDhQHv|=X+lG=U#Y;$InKuytB1FbCmuwUi&Zb zzW@7auRYH2(&Juxq&@z#UU>f7rGEVJEb#DqkN=B2`X_t%%e?yac=c;|Q0Onv`t^C~ z7kKr**bCQq;g0)-9z7UFzb#()Q?Hct8Im09^wPI`;cL8bw-?^&g|G9%*L&d`z3|Om z_z91{-Clai3%7V-zkX>iJ>!K3yl}f0{;bE(pqKs`FMXevKJ0~aUUcf zE_kt@3Y;#UZ#TAbjIPl!X#80EgjcT7bNF7m<*Sw+I~=XYbn&b4=jdp=`r%6aO=vs& z_|{$%KaulogT<}le_>&>FB>$wvH5wJzr}R%C)Eya`OI!@(CAp$FUK$6@Qpu%mE!&U z)%YmFOBBOZVH!%ANSMoUb&`iH;jTY;-K%?|-A`1j*m{ zhpmUUZq8DArstUcVS1J6Z}Sz;^aESRO&>Bn(ex|R<4oT(JOQE>~EmuwG$F; z>lHRDv|YR0R*1#KyF3;XuijX!P4PA<6mQK~OsqDsn0)Oe7L(IU=v|5@R{K~?yzOE! z@g9uDWY-kauc*h=`#Khr*%6D$?1;rg+Qwp{wZ&qxTEt@4Dg9jvuUB}3LjIT~{=P}W zH!FO;!rcm!3R4Pu6{Z#TDakHSHPdll|eIHYh`VOC*I;fTWh3iApJ3P%-= zDLkO?pu$564=cPy;jIc^pzwtXU!?Ge!f}PSDZE|b9SZMMc$dN#D}0HO{&CWU{m@XZP* z6uw2_TNS=d;oB9yL*Y9WzDwbQ3LjGVu)=>(_-=*oQTSek?^F1Q!uKouM};3y_(6q_ zDtt`ghZO#k!VfF_h{BI5d|ctj6n7 zDG9~dGdbqTD+K;w$9xVCW=AvmY-(tEs&_E4Avc!oD{Rc9;Xe?Iq-@Kz71F5@FLujd zwlC2=njg##MA3T=k7Ty@N8@UiQfzHvYbIMhfvA;FX*)EM%a3OIIy0kta(#vJNISD| za~RH*5Vv?KeM(ZPzP?s+(a3mwY)cJi5*>vNL#gb(XyKf)Ba`a8HicFgEt5zXWuiBx zMpKo`>PdMG%H?cM6-pB_2TMyhm>(R?l;fyoDK&C!**>dTx@jz%uGmLiqxm3h6g{~% zk=dV!43cn5$I7GZ$PBdP2MQHZJ9<*RL0hFq#u6Rb!O_9g(BLhhHl+BGd@h|S6t<6y z!Z{=~ASewr%pBTqc+|_%mm37JDEYxccgBknv_wDJqCScY+Jm8iK}8)J$c*+Lh@v41 z&M)NHG6eshp)ysaoH^z^NW5|N&8{s&=`JommL-3d<%PqA#P)2a(2A)#+SC{jD2ur* zH`RdZXD8}n>EV&yT;JhR8m;h&N}Js-1BteLK9`q&gIZW(R|?*7Gy+PKhH?ip`O;|4fuU8J z(lVMGERDr-1`oV6M)vkCrKv3=BbjU;4TPa^BO7~?ylE(xDpOv~(!NZ3a5yzon`kK% z1_wgRj^)Q_8ZIp~KRB>ww0qBBe;J}fnf^*iBl%4K;GvGfR!F^`J*hIqg*d7}K7_G@ zR{B!r3VU*6Lw%gMGbA&tMm~Y*;B3qtEW_-8Ozlmhxl}0^{nX?u8hQsuLz3Ni;KZiJ z@`=M^LtAqL^>w=&N~!h^4pb;Emmf}zZXAT?VVUys)KcAhNdG95>9YRe(YDgE5WA^t z?1r+jyGmpGdUJ=$vui03ub4WbyjkM}_3wnAWkK4aaXZ{lSCk?Xp|0G)a&$&=2kYxf za|ro{-R07V+KyCqAXAPWCsIT19I2GNF*7ups+8C{HdKLAt^{|uu>AYLd8UBg-XfX3Y8M270RVjHP$rkggnbvYKC(0 zLE}{>%57IEbEQe6%{nDR=od~e-!D+b%O*ewX8Ouc4DIaFPVO5dC*t0r493vP(&SA% z|I4pK1xWazN?FP;M7*d>kyO5*er94rSrIf?0OOhb_WquOxfn#%p5-L{5BeS1d7`Ik;Hl~J?_+t#VL*7PcaOtHATyRhM{ z+~-gkAUn$H=UzKRhh#Q$s4~%-r6IBv1;}t}q>$K_IoMflU&@Kt@egEojzH{%mS1Cw zG5RtiqkDRCo~9c?sac8wYGDp2j6z(&v@n$E9vLb(k(r{R<2p?yjlJ;UmNL~0Bjz(B zL#cFz>6Q-ZFs36JF*cOr6}E%xaHnWXCbVHKhqtp3Hc^$saAkTs$a1(rsol}#E`q$L zQdgu$^F!?{RIxUt_iV0&M~hZw6jyqNa|be;2Jx<5#b#qkx+8-bn#rbNGu#($5VBNq zXNf%u7340f+-O>G|FbGGGn5JK-YS&Y7D0+Mmky_qvC;0K+~`ydTeH-)U~K{|6ts$0 z>b6X#54GGm(w7Pwx4dHgwj<&p^&o=n3Qlm>wGEGq9^RgZ5}JXvHQ*zXM=OS64r2aI zF<`LZ@vx{=xL^`TY7-dPQ`3{0R=~j&Mr*T#3^2Sdfk}2xC++CFQrWPj zs$7fpakF|YCiG+^v%rSEA}B3FCd5x@iiHVu6gKiy=;()Fsz7Bdi`9M)2}3G$O8Fm_ zVc~JSDOJGsyaN3)t{EFl z?_-??yT+c#u6{b4RW1Spe(Iq)O3hvi2^g8>UZILKoH~Trb8vLeRv3jUHU&@iLP%0_ zL`8I^9SHmin0rE|?+AOtsePHQe6Baso!MU@FHG~CoG7m;@St*YG$eN_kgHj$Ov4~A zXER+QQmf%lIkz3v5mYbJlN;_WjOL)oRwD|d`P7(R%{GmNw~vvg)K!UXtQCvxfPtr$ zPeH1npx+N>NnA~}A_=u^Wi>dR?1DmF2T{_|7upS!V_w$s4H=kgEArr53w=Wr3mT*p#_1Qz$yNGeSSMh%fDG2Ci?3`Iq%-`zizgwu{IkPUbH z*eDrDDylMyi}nEysedJfHCSQc6lSbk0#`!#gG3Eyk?L_CFC`#0MZyRKXNa7vRpqFK zIDoDn&Z8~Nnf#=H2TCc~O6uS%vo_f#qVj>pg1q9=UptUV}%k!K2sU(QEMN!JHc5XN5-(szWs0%irkXH+tnYdh}O% z^j3QGnml^tR1xdPO@l*_xZ4JYv&cqK`602d59 zv$?d6jbfJ+nkwOZNG#34&7~PgckLd{Pl2fdVR_~d zHl?}TzQm5PGA2C#Bw0^ZTX1Z0u-p#c;mhGKJVJ8itbXA_6L_RPlRubGjg(P4%OjT2 zU?PbA0YBd8*pphF$Arb^vU?OeEPvgluF2(Lyi06t6V`(^Mc(q+!-K6X5_Gr0u#Qjx zserv-mExl7dYDcxmd<@;L|+((tL(%%OFLT+_$Zy)D_A{o;)x}K)YuZFdKZOrZd&un zj&E2Pj1;vA2AN)nN*CY1qJh-|!|QKqjD*vE7(^ooJoO?mcFJDo3bB}g9gBfTw300f zQp%4CFQ0VE536XnZm0vtxqPTZGy=8oB9K2Cg9eI5aK)lgSu*=WOhscewCRIZZd?y~ zVYpS4^lHn{KnotEbXmk_!h$tRhYMK2*eC&uQ@#b(7&tABW%u>uHl@afg3hOH0ZGHw zp;V#Z$o1xOLk-~6ML2@JIF)d*uQ}RDBzVdJeG}MaL~iS^hu@3b;%KOF&-wJw9rfuqYsWX zMl-{hs-dX^(MWyKzP+<$SJ#g1t=%1@saQozQe8@_Z|_)PRP4z?W|y4K42C>b(7zBC z0lPS!bC@+t_fQ)4wHSa%2$VvKF2Kbi5D6CJGWXL4$(XHKdJqRm`)eWY_m5@9Ld&9J zL`MX4e>B?b8`42&mzFqy1EOF) zP;{2uY^@3oFOwb32jj}oz7C3{LnfKOy}M@*%_$ezmn$2MNm6zoM<{ztN7BmFpO^`B zjRrL1S-#<9$Sn`LKQ<|P${$I=G7B4J zp)3Lpy#|G-m$R2VTMA)=ve8VLO9TkI7RD2K!KfJlC!^3G2Gi(Shr+R`?BO)lsoXGa z@1seB*jYgj3VMwx&@RE@(MTZwX!v+^Q5i0QZHfKxB{wGFSC$KLSJ;-?=F$cW7lT_9cZ8#rjs5B~fLMOs`Xa-N|xvcrn zpJ9}+UEbfYgjHIc^Lt#ZXei-B`D^KRhB0T!%oO!iF)} zoI<0jX6YboT|IWh19F%st`?NGnFbwZMkErGJ`~R6u>;;s$U*;#I*uyh=-Z)|lonou zD1U^1JXHyk1PSZy{lT1(SW2Q;Ow-^>3Qb;Iy=c=LAg);EEYkg?P#?&2=K98lV8^#k zW0BC88ztgxWn(*{vDjQGx{D`I=ALLM3;+EfP-9n;Dt}tg`j%MqOJF7 zIN{{D?k*EQ=Go(jwZg^_jOTKR-e_iOv<>V&IEa(^DBTWf<{+^Q@p2em31iT*$npUd zTQ29gGT=4Rk2#Xw=jnnPONP?2xFMBKQFlVm3L%fC1_m;H+Ej@VugQk`v#{r49u4v# zxeWvIVJToXr}{cmS?t?Arb?5s&~Bq!P*V^Haax*RPDWgI=wg|J*hGy56NjP-Lz&Q2 zqL@*R+RZ%&u^%BIX=S1YTwEbDoQe`9J?2_mqv$`}$=*&@A@*w?8!3OwkRT!-JWjKxi;Nc>(=kG1X;IqtW@3l3U9crT4vB6BUgFNt!%Ld@}}`s-nB^{xm5k`>Kw;{6VL+8zl7 z9Qn8$NdJ5$s1Xh&v$yN+LI*(CytJ zew0&`E}|lZ>6x+;0&$HhrAf-w^64>AaWu%&B$pmY_Y7u(QJ6~aAA`%ou*1TP{Su4ITZ+COs}xkwr%B4JzZAO1A%CQ3qJ7+krbup#e3_hml|vnYnEbFkUMDhv6`!vuY$C8yMojUUCX|H9pweiBl*S#9Bbs4YEm+4__d!#0d$48<#tA z#S`)l#A_4nA@dRGM19h2jvi*a7?>&1x)Jw=jT@Ja4%-km8HW?1(#)lh(|=!P13N@S z7Cwg&Ep(^3m$=f2H8yA`vQc>uB+%-aj@Y~*f7)BwKfx-&J2;Hc@H$d~2ND*p_%M6o zOJfvEQX-Npl1jr9d*6eY0*-L+*wDTWseFDggFSKPI=ULZObPo-}Z_m1!NLpo}MTA7X zW7uV+B?0|Rh8ve38?jy&a9MccX=KG2(F$}pnCCc?WXTd;OJT@O6X&%FvMmIvV~GEH@W?Gl>SEznY0z(2H}EH;6T7}-lnzPX6XdAxC34KWc+k%2U6%v!c9 zsXv!*L#K3);9hlTmhm>Esj>Dw@xmSIX)J?0;ZRF;)Yy9ZmO+RHOBT^rB(tTF7q) zJ9#Z3uI+^Llpbu8nZ^{=K@#oZz0=vLGmt>R0_Ip7$kF+lXEgTtWkasZ;!?G#M#DRL zKQTJnT&h--w)u`OoUvPFxU^RuLTPAvqZuGnuO>T2SrgM-_2;3_4NJovW7#ZDY^owd zFjYb=u@oR8vdczT_xLSx=HS`@DV?E{6{8f|WQ!ca@dKEflVv21KG ze!{pxSCHJT~_SZZ~+!_8@^CGuzExW z4;dx~3J^16fkc50U&bv8DyAdZ4^=BduRVvOgi+{>0Tse=(OWaAkkU*(RgiIo96ah_ zu}fv?z`zlYq*6~uQhnyS$e&2f3yy^JK~E+>40#zj7Qp3XEMe?E2M47gayqtgHH;lz z|8BB`wI0SCckw8ZQaEyRZV2{Wx=##=K8&4)!x~6q$t25sXl%Mf@^jcY7`SZsD?9Z< z8G%nbZ4yj*%vUztkv}qR_uF$J<+!A>2^()b5LP)Z${<2s`(rHBYMkF6YJPfnB?o zdg(^BqZwo%_qq)@6%B9X&BrccX@j8RH=Vk%KckazuX)i3w9lqkSIR)TEgRh=$mj_n zh<(6jPtDTE&Yg~frdm&SV*Q3O)c1tM^dzeTTU^O~1S@T*L{ds|Sdrg{P7K*A8Epja zm%(U**T%N)mO^K@%gu91A98SWi3d`9YY(jX1-vmBa>Xr+j(rcEV@ypGa&NG(XZl1- z_BNRFKA&T9+dF9Mia31E5*b~k)Pm)8>Y8vLw$g<-+>s5Th9?|432!fsg_h@Vs!Yee zG5C>08#jzZ^EtAuFH4G|^{53RpNH>SRk#yHIi92IZ1A!VX9sAQHI9l_HTUDC&Bs zaHb@&>=3@gca{qwNE(J{nmh&^5o(owc-rAGm$oo2ejrU+oXyryG_S@kjHXW0qF0-M zV8<~fn28*s`RO#=Jp{5X>VOa$k#toNwz(3C;a)P}MPi`hk?#a#WayX`S|<@F&7Ec} zPE9fghYs@`^7RKhjTsyb)E->>3pp+gW5fT%zGL#2;h0Rw3&qVxdXF+`07KUZP`!!|m$RE3522e(9cVp3~G58p_l zM}~Dd6m(mQw>!lE1}z%o+YiED9e2EOj2+o3l*I^n4!gS0334PG1ATTPpZsByb8HzntI)FM`IY#j5su!i-2*?adGOPB3FsBQAXkelFyHcc1T2-~GYSpS$t5zwXV(E(x;Nudji z7NCjUtUcyC?A!KmKBZR{0H)ENS3c6GlfIO0tjUR%smtN$dCdui3t`O;VMb071Cj`4 zI9xr`c9JGc*kllI?TG|g)Z(jFF4TfW%|cVC-(rY>pUOSS6Ahl$h;$z`NjqnX7348* zW)vzEIfQFTwWPpR%1Dvk6gRoKq2UU<34TvvXLx1q@&2dI;&%$o;^d%sX4l#w)b5VG zU9nuXd^^k5`v7LGl>IEEGDm-^%~&P7)+bh#D)beV5XVMzf6|+Zy;a(NH<{(YK)JXO zCsmOmeBi=p=bSb6ykZ7i@}Q-?ooaTHMCIV|q1xrTgr^UmJ~?=LaMDi8@3=STx~MvD zF{DMmd~GK|l7PC$u*T}!mDu^vMr17Pne}O087Ow?y#LVe!F;HhNLA~2$oQ#B%fBZ3hN>#jBv{Dt(f&t`J~Ky zG$(Xd6NGHidrwuLKBE*UEn2=2&Z={ncKRu8J62oLjFJ!!wIj}KGy)$M9b7YVq4-m$ zxSBaVf*MuKbmE0RL7?FCV^C3_UpFIdXj!3S8LjKWZ?;N_}xXO1oStUiEKQH95|Evk;J z07tGzfauRz7^~=++=k-1Ip;&9;3tfpdG$^NeOzhJYcU@ub+fh=vA~)r&J1HPhv@A( zYLFq|JhdGGE3n%GL`EX4QxDrK9E$WWPHg-9)f%#%n+)3f#CeERWKYwLn{0^|FpMiP7Z#yXji1QH5i!x_b{fIAdqPtuPA@S5 z6bCCWLePRqrAY6+z1eMuQw<#EX5OVzq*MtHXw~ZL{17YNvbdIoCqVxjXtvF@KpY9d zvI}P&YQB*{Y>u_eVFd4qe2h5B@Z^y(5X?#z5oG!lZEO)mqEhZJm(0*9q}`S-_PVuozaNMpTH-uq%0&SBAt|bF#YLO$sxg7(DEkPBN{6RN!P`MK?`ix@a z$BYJ;D*!ScXOrQFhMq~y8tVcBun%Gh{5TwOGZ>TNfX_A{$;;mWUgOf$0Sw-?8S5q` z%0$!-70%p?`D74@XY$slS+9>LB}!2pDw3rkIpafYq2zJ5vSUtiMA|}+LTLHCvK@gj zCj=0?&Ge&du+U_<^vYaki#c7H%82rr&&%9W}g`d zts$)8-U#bPH@MHnBFkXq)5_LTkRMosCv3k`4T2)E*m$GA$5f8ltQQQdjaibnj8K7v zHF2kATXs(#MG76*(wK|xt+4@6iu_s`lSm!GEV_Pujp>eRjtv6PPrMIr&~zMXJsrs0 z2jO-^q>Az8lc*}{^%=sa0n+DQssRRiyv!_T^)-rceG@r^m^p}C&dX#U!jVqb1#Zy1 zwt6PvKO#V6kK;#7!+4-ECmRm%{lWN<^CqWbndP2Ziq9k{c;`oXB5{QADmgp>pWCQ; zX7_G{l!0V}P;K3vi>nBj;3uvJvBJ#MQuNrO!l~K{LHQPMj?DC#TIgoiBxHT_&JkJ?TC>VlptVF1!!JfXwXShb3SSfFZIGH`+JEO9{iZFS4 zRFY0+eg_?4$$Wx+iJD(2U2F8d6cbylR;Nt1hdi{9xVzejuf;uta?VH?8HiPg2}Y$n5ZG4w+CaTZb8k= zHvX>ENUVfVV2NLEg_|lb>#9M|B8*c6!$In4OkgTYuJ)>yOF<_yp&eSambRlX$+S%yJ5 zC5^PUO1$I1w?0DK*l{9{#5>;>guRd(eeouUZ=3SkX~c;o!1568m-y@`WjPF&F|tE} zR@}y|ZEG&;AuyPg+Z5~Dgpje8j7vj=K3;5{WnkeeqaqW;#8Hnav*m@hu(AZIl~&fN z1>MIni0y#MHlXv|!|Ey;BvN|SPqC*WknZ8~KxG3_=G;Rek0D}s!6S=e8tI^X{2hq| zbz|6q55wXVCl1RL$;O$zxDC0c$=5^JL9? z3y5!Y<@>M1>EtRQGwMCqriY8|cMY(*@@=?Hd6%u2ECw}G2ANhL~zga4i&Cq(4 zb$vs_bZ;3C4VRs~Il(EnY;ZFFOe`-6mYr%?7{B7E3dda;X#{1AD4atE93dgI?upvy zp{)WVOgeXuDo7TZO|>~cU@EpcM=H=4^`=%!(+1A%K6x3@IM+M7@e|cjx90Rj#7#DM zFS}S*pgE^t=3K40)E3clH@osBP*n{dF~~Ms5_84LW5V*?*Kv;$uF*Jg!R`TGu%%o$ zgAdn*JOh*lA}`E3IJ7TW<`CjIR%<$35&=h^2(bv=z;5XP@tYKGKl4oX^vP3NWlrKg zS+t|f$H#;AB#uA*!?eKnKrC$-<>`#eCO3pO*Jb9Fc2<4G0jT7WLu0<66j;Y(QI;49 zSSv&kfLLmX-8VQ!4e5Gn;*R7<5~ivJi;5#Vrdj+(6SoPz;Hs~;lCc4v4YKyt$YN43 z44Qrf8%ID`#|rPxWVo#As1N`%Ln8dg3zcHps3v$2+a;(b&nZC89^%xR;j z;wwT%4EtGfLZUepdmx;iBj~?Hr%RJElnM!#mT4?Bl;Wjqd5tfHN0c+wO$_t;^rnyX60bnAcA||1YkC%w1sxPS!W%WAU$VHukq0t12 z6O2TuP6h#-LB%5wf79y+sVPY?Dx;61Hr>)|Ah1(E)fruYdN9wc!AS;zCGfO$@U9z{ zF(cNTabGT)sc{LHbIeCM_2g#Oj4huIBwvw^lE;^Uw%ut^L{;T zG`+&ySFa^Bp44Bt9{6@DwNFsgVQ}SoO>nriyc61BbAKfIn^Bn%<4mrLv`Dr{;<&OKB}fK=#PJ6Mmg8XHwSX5x?2VHoaTy7X5ZLL;eH^yPuNT1r;(@}h379-)l1u*p}JOZX1K^oW?k zE8%%;u`fL-HbO+oia04LBi>&i{=G$$9xEheIi*JhS9v!L5T^>`L8UnCe9^t|$)(Hz5S9@o0OF7aveB47T*E;we%fg72=U1+E5KG;p;|rQA zqG*_Om-^UxsbL`#Dtgc49j35?3TQzixGL3yF(cc+fpDJN)xz1;XQRv?4tm=-TtppL zLS9!a0R#0$sH(5Y^%Re4javvKtV#hR7AM`BR#2O+Hz1x#ScI{)xsU>LPIwel51j>u z7&Qe3J#PJEBZu6gTN$4t4;~Er1#q>3TBolDLlDxpCg~o$LX?MzK}~V*|8ZnpuR^RA zOjqViZKkN{q+m1{twiI6Wm&OeZVY*!HLs=e|K3L- zQ9UXld9ejV%=_2+*+HGIl`~3hYBou6fZj*tim!O`A_Lkx=`HCZh!#V69mT~MDe4H8#leCBkL=Neh z975SdO4QL)Ptwr%r6CS~;4!P-W`P}>uaBKRhSiGEM0CtIFQs_;2>S+o&(kuDe0b5S zkjcxtrcAlQU;>jorG<$G%h(1K<8z4k+GzqLy$LxUpUnKNSgd5V5GMvf(?d3|ZFIp4 z1EH6lhpBZ89GIV6&}&#Rv|7G8c46!wJ+*aHV`s7$d|xaJlvHXhM=Dxf<}`#%dO~NY z&Mv|)#s*?*$z=z1b*3WTDAd85Qj5lwqRB^zWbh?Ix*4@%yrGd}Tk#O;x?kqSf*5H{ zq$z1FbKj|(-St3vujK5=^G;xSoFVoGp%{d#D%wr>C{dw$dea~j8dXR9iEx@-S zRt4vv&xWraGBM5S!D2Q~DA*X3XyN4jgbo;8n&|TTr|{6vXil&WP&d)4ICW>KPpVEO zZ$_P(1r_UEM$839vsuyP3=6GIt>8x*H*SVtJHkk!ZoJ1j@UlT6nG-jW!=?$lEjzI> zPZa`c9Z6zXe8Rm?lEeP`!91eKn1IN@p>8P#yxc6t=^3r&CVm;KC49sX2|Bs7E>Aq~ z+ZGI8W93!GRUWq==P^J-sKLB3`kPfk=A;1SAuKt5s}F${D~PcZr#l33O!vZJZ~7*j zS2Zh_e$;2DHCQCiuv?qp7Lf0sRtgM4ZYc0nh4(*Vl_cnkNf8YLocaWD zBr01J=X&Zol>gL3szJhIlMuEym?N=p8M{w7nHL?zf_D4-2B-v@jIc1iATLsyi@U4p z=*#pkH7Nj;Bu*3(L~;=9YVG6Or{EwK={Rst zvF=M?6`on7)F;SThA8#*lvv$^$4AG9j~=Y3sqe|PS!F2`lzral!7(wHNUp_{cB!Zj z9&``m7Ze?INb*Jy5Qb@>2!Eb5|8S2!qSQAkb2D&q2N;ZQbue5Z=d8F2$ur7)3Y)c~BA{I_hdpP)beE4+ldoio_yDprQ z(@i3lyPNg2hX-V5eLNuHW5h?eYrV^wNF^}!A4ig}Qp9w=%aJ}XJmu=&NEz+JoC3@S z&z`flbaqM5k}o7g)iP*k_|0J4v0(p=NP@`~+Naqvndm|r;xCGo4pZ<#czPX-2`=zp zKykM0G;=YjA#UWkJm@Fl2<4oRV|^Tk6Kt6~B(sWju>&6;>vtm#HQiOJN}-^WSKi?{ zEh!4io`xs@eDe=sV#K*dVvquJq_@Fii2WK;Y7W#jX-)-u)jls-O7xHhmgqf*s)zNP zQUI#&tGR49Gm6p;G`VHzf%#m1(>egB6I>@#1`A9#xse=&Di29;_5{WH{==iy@;Lx% zX<|X#bHFaA{f=;gw1h_M9v6-kF{#JcYAE~5q*fEio5dSQm%Yb(2hSo6hMPikX!nqd zsW~0-2Yf#EUsMHs`)10{%~BNoNyh<*lRm3iQ#30G7CgZT=^=(0H%>jPI>$g-pnsN9 zb`Fg_E;nYxcyJ{;{bH(#H4|A{Mfj@zP zE9CrjivJoSgBd6sasR8{uYJ|S%i_w#C{|jx4<#fcs0ApFpja#v@MuaR6G@LC<<$W` zHkw?b9=kePW1!p_^#+B8di1rK!qIT12goob;++`*YSd#>7pl0DsNDK`a>t`9EVI=? zj~AU#H$Ty-&Z4*CeM_-N2g>ZK*EW&Fbx39U7nhnOt0<9T@+KEAxc8(Qk#qyclF^qqrFIh*gmDIab)uCCI}gI`Qw}q z5WhgUS@VvSw2H{)CY7Z2`IIy7Fep=o24Hij;-4kRY3*3M|H4*9a4%=)X^KdSse+qN zbLZHWI@%@63nj6^1~p4HX9^Axh8BIJ%OzHHFiXWyC>8O4v(5GpldR`QgMErAT~irm6* zO*P@6jXcZ>7_Roi2roF=qzU=4d?8%NMa0GVedB_d0TFEHAV2=sC|D7t0Q2fCOPuuh zCRf^tp-8+AV0O#!v&36(ZpV`v;J&$w%cYRUPoqtz?nI91)TGPk)TGMDq@#^ti4HM- zDvKVvl_^Ulmt$fq%;U@=p)v%*L8-j-(_~7mP;98{)et{X2=P6IjhWm0_{K&E}dY*t9N&&#KfUP z<=(SMY8kG6I1vA9F1OD6P-fJ|$bZXa$oJLOks0SNaQ9%TZcQMKfhuCFhy-(Q_vpd! zQq7IITqw!Q;q*cG=-^WcFDdydbD9(|mZnvQdro&jC067r?p*OIX$s@P`!+3LXnV6u zzSZLnnG`0aE6pbNS7)*h<<9yX8!+oXr;G>SK8(zW#^*C`N~>YF3~7|r0G81`yxptZ zE$cY&=h+-*kIi%a;a^s zP_fYfP@!TU*6IM5Io;Ad`SD8my(ECOOr~@!4D}Ye8tsXLQ-qR#-AhE^g>6v9H%O$a z@o4!xb*k{2qfjFIM=}=Qc=II?7ytGV$+wPkn&=w;GBcrB2Z`o?!U}zWwpP^;N6oO!`9&loSpNaz60x{poar!s1|sNV476N!*2SSTS4S zt_9Ss7?zu>w2mY%r1HcTB2Gwu*sD(1^fV&tRqCWl2@rRL7}R3%q<1#F0g-)_(_Dlk0G7oN0V|he3 zl8#X2AD`2E1eM!n@P%di!% zhcs0vw6qTDog+H#_sNkOE)2i2h6hOjH4~o&q0C>q^9blm zT>H{-r`w}p`-K1z`*_TP#+7tna2}jFF0j%=1fu)IJL`td#;DAzkL*Sci%ucD;XZY&XU0uJa)_S+cgB%?TEzLlgqbv^40*hwn5*{^ah}Y%r_N}DqShc8 zUo||lz11s<^&OAgrl!<0XVmK?lyd-pQ%Gzy*pD+aX((QLSar7x0ow&)?^iM9w3Qa$Uuc}<4nWZs1Jd-4Nx$;NkLbvMXE#*{8$N`g`)DOEvW7S&35>^zUoQ;{#Qi8Cga)Ap3)H!p zj=6dFC`Gi}3S5`Y3>|3_(X)0`2x>^p23df0B|_={KO!RAzaB<}@e`Gv^!lpESSN4e zfN9w#gnQf8q@xLn^G#Cp1r+4DiYqJW5+5!A>#=No6|ptRf_6w|*qIrGF6lzP+L8_{ z{0SE-d_2>~iy8-ts5*c05bkF1RuH!fu$!1&LnB5uQA&8cRucIu)o0@lpe5VXJr@ly zzqt}~$c+*_;|EEq&Kxut+)_px4LL#{sQ$`|=xbWqR8rgS4nMKA^Bv*{l^VqA?Pu0B zU4_T{wgMJrUZT{X?#YME`7#T6mamZ}s>0`nn&}1vY!i!I@bH!b_#VU_o}-0FyYWF%Hrz9A^f!QgjSNAHAvRZv+;6&wSWU@N4h9dJX?(~2aaY+ zi@1o(t2Kk0}jHC84KyS@Ag5iqqI9s4G0$rIJFcr^YFVVuZJa@ zl_pH!8oCagvg33R`XknkwD=A&bh4zEgGwSQiFef-uxT`Vh;2cvJ>idV^8NuNB-Bfj zj+L{*-BTW_Cxaq0Xh1gPP9HvbblN>RJ^8+)hmlxFynpcQK};ke6TbB&hBI$B%qB+r zOv(9zR5Sc!brBh$4^lE4pavzoX1XbrkxQ4%QYWYjrWv-n44y%7hegLoNtL2$x^pMP zj=`={p(aRMhAz%^GO`4ah{L`v{1RAhdaP9J+KgZdww(dwp-x;e%aU=7?cWOuXD8Au zT8mQ)T98tWTaZ$3wIJ=rp?2Os=E^~>muqBRWxStuP8fp+V4q;CdJboZ#fy{S0*-yX zC8mhLx7Arw86%ZWcM_6Dth!4Ee}q3BYmuf@1A(^drc zW^QaZb7Q-i8{5s?*ly;=b~872nz^yl%ncR$G3Vh@;&@rK&D^-% z%#GX4+_>G$joZ!KxZTW++s)j#)69)K&D^-t%#AzE+)(#y^Z9kBnHzT!H?HhghEpHJf$|NqoA?$U%1xRs*|dM?U3y4a6>&gvvT8S5_%FNs87M(N$0B4N2yXC{&8o;aGyp&EK7F_p2M=(xRzzDWIoGCkFoC^nw zN7Z{%?iAzx)bE?+s6GHgW^9bcOBHGWF5)jw)To#5%*5c*j5jvOQ1Qf87p30WP2(HE zYcPh+`>HnnFclv1RR>2FaEr(N(Jfy|I1W|_{(Smu_)2AQEt3W)cxVHN^cIU=;VyP4 z!+`@n?Q?*fR;-*VMOO^vKV+~roTbD`<@3d=f<_~sJuDQ-(KDC~5pI-6+`gksVzIXx zFmy!?iYZQ973`>K0%cu+XiFunYgWlH}`O^Fggas(`le`gbP0m?x0`c7QaY2 z<&%l$ohl-W8Q?9_;YXLQ2a5xqOf@6%MT8bGyfkoys5!gr6IU4+8ljPZ@grwMgqfE=q)E+T6I%ml^OQzL1@>#FK z4HR)@;n-0zIgPmLrZ5O*03zMTJ4i+52;PxF)KNRe6V>An1$?{)o(jopx3(4m!PE|J zJh*@G1jojr3@7py3%WCfKkkV0a=2U<4+Dtb_Gt!wVe!Jfg|wIn3KHYYk_35N!6pS4 zq?pRpKfi6p0zxt#$&I-2E^ADoYk^yk6&fBTnY|h=4o3)~lv+%WK8E~z3d+xB5(+4^ zF^2X}N0YoS$z!!RTBDZX)=A#%Fah0@p3CK%6F63q2?;$l$6hz%Z8UwJLK2uTc-1ac z6AGETVHWOJZL!mWjHV}}`9`O@1mrv6&cl5{f1bO~K-V5MX&Zbjnwl{En$xt)m8Gsd zO@!LRo!xYXQ~vWAZgi8vF??jeScFSFh0sKtL2T3dFHYUV2V0Po=cng*&bEigSg=Pp zn<2P546zIN!rq6fIYtZO<_s2^_&4K zjh~83f~?GZ{AL%17V?|DsK2Enb;36LQYT1v>ICUgop4J!Rj0Uq)hVuPb;_-sTQ~38 z%52}+zNO4wQs3>}?R&ODw@|~|cWtw_Z@zQ)ma;4{>+Y?0c6V+jyAjjw?cBR}=VnIl z&fU9rw{tGz;g8+joY!}6-9&y%^48Ao_AL;wM7QzS!p`m8oclX?Y2oHOwLZAJb9eXF zJ!K81mL{=+_bRm}@Re8G&Bl>Tn9qTsm=S)zeR>I<41#yAuCgU)>{$wn_|fB2T=7eU zioL^zhchI&TEu}gH&zD-d-Lt#ihn*uGmqw_z3$UU)CE6|pJC-pQ_c#rB-m|w8dEks znbT}~>Q0-U>@zk!jXay442m{A4U8xvKS*_qX-Cux^z~Fx0o==#ktZ-{sAyi`DYn4R zW^|pZ?ScVx+j=ib^ckv>v8PxgSFd9MWO|6=LhGJ>K8PEfh{zA;8Woew`>t{a3~$AT z5h{yh>N5DyC764vCZeK|%W;BAOq2+eFHVn`0(6AGjGxQ%7do5?s!=)SOJZ~Z-IYQj>nwYt5LM!kwo_*mn>`vG8 zLmlBTFY#hl!yA|B(t9D}aIwIPEJCjSI;H@rx68#n7FowRlc#2jMLVkzz5j9M4wokg z)!}!Il6)`0BQJ1O3kFef-a3KRPA-z`%u$ZGjY^nyF`1J&5>u*%krB!DA);na3Fn=s zrAiWNxc_eTu8?3*R4rn0M8tHH0o3$R7{(Za1;s4lzQTbMQ=C4i){QL6J`{Q*LBtFZ zIA&KqpxVJ4YnKEN>ReJDOU)~+#BTRM3+Es13_l6Gk&b(bb*r8(TccX?ypKfyK<7ab z_vdvGoLu;(XN?jc10Q4j)BxvYI`b16W4h%=W8?2k%5`#=V|Y{#7jm(p4uy_DYhbMs zuaJ6%P*XKPg@$&Ip6=Hn61!kEzfXDCI11VtA)N!q)jH|PVYi+re#P}I zWv_G;nc*;|-h;RW#d|)tV9*6PRYQASzt^iQ(62Z$5aE@p9_G^79vXiYRSEDI)oy!eT{JD7G%KaZ6-s)e+68h|BJPH1c>?ugf1+_w}#? zZMjs^&UL!;1CZO>>h=3L4W+itofPGGfRNMAQ8~Jo>vTslxE7Q!gjN7V zo@g2@Gc5oba==&V${cRj?eoI!LF<-rY zh-Y%Hbso$NvjThNVyVyV5OG|`8d-{RlHE`ZffYy~`V%5LzQP`2J5bXlB=D^O=J_|C za>t!ePtGMgh6&pwVBeSOh{bF88g+nnW{`O1m?xxMJOE^2z+z&pGMoXOn}NU_xDSRB zSDSZMs|%`30t|!l>UE9+zQ3k9YVx_ox*->Kh~>g&^H>(fjUmXjzk!^c3r&62X6L2tS^!ExBr-aNSs2oja= zE8qX+?>wJ%aD;|SS~?X^TW~)olPonl%!8OE4n$ilV%A_!@#YGiI=Phb9*4`@)0*PW z)0IDR#TLNCw`$J28G&%LT%5GFEI7d|-n>;|kP4Or9(cGCc_tvw{2cKmH%(>K#79f} z>h(|G#V{!1HMFlDJyE|n9a1+t9Yd`y3AE{G`r3>DKK^BTpDI+|ACpzqlcN9RSab}X zF0UYxqu5w9I?grHqy?QJEP67(Hx>c2g8#T{GGPo+|(x;AxP z+?s5*ol68ujelEWv4v-FyXY@F&-AS$p9Z^Q4=+FQKAb(E-pBUXxSG~8bT4MB%fS&G z7}Qx#9c{t_j)#?bC$o;`sQE{9b@MmUt~@>L3NR?3(r@4U=!?5Ca%0X3Y(8Y@=6eoL zWpV}HEMHt9*PY#uzQUdM--C)}7MHxSs*4$s0Up`YOLd#fS5Ugq!IQG$VS6}>oDLd* z5*!1^+AuukCG!k(I(QUf0q0;Yb+tUB=}TueEkU}@K_@5V^T6OY2xNJz;(hwg6eS{mfSptl>AYucDP@1^?H|{ zX7m=amrNpo0%o{J)=JJEEfuK9anRfAlz|d`>iv_jY8M`$j;U&o@44&+Q(<2nyCKT1 zZ2Se%ie>Idk6th8w61{n9C38|s|lnC;vCgD>$gK9JUFi~Lac4jQ>>6I8z%^8D5QNs6qDEtwmc)yC zaxH^+mg4eD#LxxS#7E$#SUO9JjzLI7YsLBoZ_!Nc&V7TqJX#?;RQewAc8vzbROzmr zHW*^`wB+pE%HeL}hAcS#!yQ23KL%H{_8(o=U_SOMRai=RM>&CTni2#Zi<92$%3&W zmu7iz;@Bd|&&PwuV`vP%>;Ripr{Wih+r(46e=rygN<1IT#Q8KKMcQ3n%g3#23CbqA zKq?nC!K0z>E^R0;urCte>uDx`a9f}Z)46<~Kf-b7YB3Bqumgs_YWN7fV}@LoUTU1b zA6UzprI)gL2^}hd@x2h|KvZ0x3k1PX-!8O_y0BQdK7`b&X@H-EwuybV1KvSnP(25x&N~#{OO{kXh_Gkj4?tN8x`mU#{Vxqw;|vjGYR%>5${-Sv(mjnjMmAev>)H|yX&JG)$sx#=lfv>bw zB_-l+2X==kH_L`aLUu+(Mf_L%y4IN@QK8YyDED4cPKZscY6@r1Z87s?#|Mr56!Pf8 zGz7JNfZBEtGyDar?TC&h%gDVC9l&JzWQ7+QRQbA~<45~DI|%zF)ul{kt2`TD;Z-#U zz)GXiIhy(DU~=_IvV&#S5ci(s13oalL7FRcRd9g7I5^Fs18f?W`SBdB_PrcXBa1`x z@yLZQJ)~5aP+TL*>Ln!cKjU&lnj!T7K&qFR1|H=$|>qX5E7 zXXEpG4jCqul(w6v$-*Idxt|WarLuAI1qoc7(dFHq zoQ6CWBzXKwcL1;cC$3(igp)5ZqA%$`7%vVNUl{u_WnnQHUF@rjzx=STp=zB?s*x~U zRrwv77H=6nK0H1=JaGtoSZXHy-<9V8T`GA)BU<`Oe=)sQE)_+V1HV=Fwmkf>9PD4L zrd|qTiCiqJ568=kCk)ZB&*#AfbzD8*YLHYhN|EU~c9SGjEeD(rm|9VE$8ZO-H59BM zY3v#iQgydny&k5WUB#|mHzO-7hjAM$#e7L-N$_HhNw}bb2eU2e2`azXLZxX`aXZ@Z zA@4x$FJHqM7L%@)N}VetG7213K0Gc6eBX`$^tyTYgcmg9YXOmNwu-U_G!xIVn36Ms z2F5uU>wEROfe9CzfxbNuoeYJ2W3?RJ!?@z#$B2|I2hI&JJoYPtq>l4I@;|{t$E2}k z@(WcCL!0cf)X^=eP-IiyGTcS^CT(mK_qzKB2R6T3%MHBpd*vfqjA`K63MqTb**JbI zgC6J6vG^~0uSG1HeK$Aaa;-x4wlO<~?70)7G3n}cL=+YRVf2TBKQ9_c_!51D6SY zaDo0o<<76dcSCtQ+qS%&ZDn8!c|(tdn&55Qxkwv$jeEwVq+9i*?U-~>;XWcxRYR_E zg}4&w1BzGrc=)=1xnih>C(vr95wM)aKb>kpA@3}(Auog#HqlFw{vqvTCM!bBdy>d> z#}h;Zd^AG@v4AZ?pE{uvs{Y=J{kVD^{wa8ONUjeS zcyUKTF|5>A!i5%m+<&AW?)nSAjD4e{6GT^(7LV&_$=`m7U75}Clf@y)_H%ZP9+!4IPZeMUA>+#0x`L! zxR{j)W$Z1IlG|y4ma2rQoa4zsh2Jm|ft9YmiUbd!bKyELv|+?w@LX{D=l&X5NR^sP zR1O4^dgZ#h=3mRPo?;p$~C`0 z2l5Q!1miT;430Zf=*jg0fr^(QPoRZe>pU6{AsPaa{F0v=F|QIU;w4$xTm;P0{lNfxNe6Pr zQB$n%WQJWqf68sKki~(x8L31$3hC*JZAfvLSfR}1brTRzH4VoQ)R8BAZWlw5?of{N zQ-47;P>cOs2V^;^Crh+5&+eEr2Y5<)Q20n`Iw@tx9M^O`IgQKv7ml5=VHMq0jR;5A zMW}?a3sNvNRT8a)qrM>Gd}rGN9Fxt==P)=RBL#Lag(642U6NwK`bu>u*U_>=-le%? zn1C1VI)`tEBe$<@676p`1?ExcsbX}G5C*&jiTLfvLGj2q8PiKO^aliy2o^HvV`*-< z%$TZ>0ujk2I?=#tm7wfpGtgZoO#PEG6)n@X__$=Q!VdfvhL}aXqyIy76b4)sbkNsmxJ74_nI@G($rEzSMM3c_l=`@xPYp(eh$;;B>aZx~ITf>#0sy-p-UeHC zx)Se9mw~XBbEjncV=$sX3p#`1j572#MkFz>v;=C5Q|ugEW( zh~wjW9kI~Eo}Uy7$=4|?Qy4m1{mC2$cakAh6%~aWT~5?8Mo(5_+)yuKgU1ka1;!yxzGp?&^n(h~N$QMdPkY6~ z_dWJ5==c4}+;;t^=v7Y;$Ehyj2+R5^(yiWL{aBoTHLJS7%Mi=2Ccz3<{AFf+HQGI% zA#m3G4Pw>cI{FsAc%-tYWg*g@NZ=jBES7*sbMA7*4`56Fyn6kz_oX)ou@m=ud9oW> zHEhU4j9fv6O6~sO5vKN`g~rGjxwM>#Iw7a;Zp9tXZj3@S2Kf^@6?Wht^^iAd&=|sL z7JiETTF}_D)B~7#*=~bMaqH9Ix`O5!^OHk10B>E2GSi{NoRLAGR~XO5EWldLk+8UPLj4757r-$>&6q$GM1v|`*bay>*O-peOlYgAnBFR zS_Ub)oSkz`yNS#)1FRqX)L$hQ3@ZS7rkVB`y{-@>+c5WGzjr9bL`UN)$6R z;>vonn>e&-4tUqaHf^4#oQvCTMb5Cmu<`N3QlZSQ;v-3I8hTG)?!6s@0XdaXrf@HG zzYu_Ud2r3W>xwfn<+Lu);bK8|818&5hg>!u#T9bF9yy~L@$lf;$?`TvV=0-+ zd5xhBBRaP#_jakPB^1$AXM`p_8!mmT{3)$159e@b7o(iRm^>W90o{uJAdx)(Mgt$K z1~E;cm%&wz#Fb3T@fNQx>zu|RU!b#iwQ?`s=G9_P;SdUiWIR-v8{o{!-trM3N|c?a zV!32Cffil_Yk*-dD;w5 zanWP-;8sLb>Tk6&QuTdD6|l^tJ~(Wnfzl*yRnCP}3_G<@hO6RmHj)WfDu*|R{H1>x=XgVMGrf?pSf>DV zE+u}+$E5V0nU+!BKhq|{jYfRhZK^|Usg$^SK0xqprTGgV>3gOlUaCYvUq|z3g)rH+ zGL9qx&6#mLaRjBU&=f>vE~FBluKcznFMbOUMc;RXKYZ%opul^jCv^it9H%kR&@Fl2 z5R@wx$x7Y95;pn3uU7(TPxp!nVAMc)F&eO}oZzc+GX1}ZZtPS%7jg~(sU6p8L%OH* zrVpl&o#4yV4qX&G9NmM}m##w~O(x&~Jj6J_emIeLl zwJR73(0@4OJ)zQOt~H}DZTl|yj4|+eRo($120SW+b-vb0bkHf{~8}4vWQvO z42X{_IPdkQxZc4X7~Hkxa*4j71eWYk~NVQmo3fWQzaJ?xpfW2Mj z0L}~&F<^zLXVPIehPVodi;tZL!%>gn6r$#(b2&a89Xu%2i54~VOV=4(b!`I#_csd3 zC@Gdk!xphuRfk4NIJ|^{m`|vDyKpn5KswD`U=UQrb0`n2~=$cIo8#`cm_0&YbY=o?tNR|g!*WI{|)ck^p zlCbu4)wIoup?@6Q0%|q#+(LRVJ#>%v-)q9lL`V=Ya^@|hldyLr+_zk+f+-U|QVNT* zPk(cXp!WvTrkEG*OSb1B`FuDXF2?-;!vO+h#Qcq>;#LNr=*WtBID^yZL!ny~K-j8~ELkWAQPhOfZ6M}`Bq&I6j#I_}7P zSvswu1Dpv4_!VXyE-MV-_lBlc--;CA6=+n(u?@JQh%HNQ1S;F5teolLBnZ<`_6JTo0K5b zMgzVuB8!4-+L1trl~q70%08FwJE%OS}0(o{@smT0Lt!c90RWKJHI zOO%5fg;i)xf@Xz@fN|^zD+$;RHnFk^n1-ZEQ}!z$%WfaPxw(LYIR4^lWG4kh_}0kq}ofch`mw)LiQbKyJry$nhqOD}q$02ROPEEOBnd z58sN=(13gy5lAY1W#~_crVA5Hm-I1wVtMph0LNmB-mwxJIL`qDVk;akeL}IkEwAwW=-{N+UgKBt1*T5;$vKNFJ^mHY_ z5UWm-o$`O>I*Oj_{e=L%b*Ihx^(pL8E(^>^Q3SOcihg67xS?I?H>Pq)WAXg=QzjVZ ziq@mhRneY*m7))|cH%zyfmCMQ@`tvtA) zLt^HrEElpCyCdcd&_c$*ZPSpLF+dwKhSAlWIbakBWW7|Tks%exNL|@eWdaKPNE8D$ z$poiDRwFx&K=;dLDUC|Qa0@=JPSJ6eLw*ivNg9Pc3q2b3o&{nv&3}A+BqXk0=gMmA zRwQMTz11p9#|0_LmXkrc$$)I$Ipl~IO}K$LLXytMkg;~93$n+!+_;Y$!Ap+?TO=F` zJ%I+)csJD&_IkZbG;|C^>Vf~zftUVoiU|IM62i*WOQz4Ysrf_P0CHD*GZF{bOVS@q z5yq*~6p=VwFJk~)s%`FKav-Q2XdTvgi1%-!5o^~0b0IXMI- z^LI{FUUpZ=-vG|&IJaes>(X5LrlaVkDfzK8lUt>hjdF^hs!hdX!K*-lJ9Aw68!d)` z&-`@rl9?XOu}52ugnn23?b0RL{dwsI1(ZK`|G4m{=6^EoZYQJ$Q-B2b`O#At1Oa!=PV;OVSh}Mp7X_ zR|v4~gOwO>E}z1ijB(3$%8RTjaWFedL*C`}Np&O)`l#`-__$1j^<_Tzq{0$&$m5pb zAgwfLV~j$Em!{zG>3l}Zh`d4Y1jifY{9wQmmq2IJa%OLxi&zgoS@ka0qxLQjwA+7c zhW^D2j(A7om$UYkPKJXq?;3s#hu-NXsI8^W$kgptl(WUK_W~P!o@Z38m<(2O#GoXH zqmx&7pw5{zuU>yWTT~b05p4myKkU;l5T}N!Lo3M&*&aafwIZ3j6=h5_!Z6CX#9-7? zr@FtwV=`R%y}&9!xC9rH5m5w@2kV4r#4V+Bm%o28|&q^c0U zof;Fq@+nkA`YR<11zBuE zo)EPlelNz8xxu3?x|QgcxnLaE0?ycZ8AB)Q%z zX1x)Lhv?>uy0GZr7yK5lbq-fccn7&;5pn)F4-1aNbOc2>V?-egKr!91P(T!IBp;6e zI44-!B&fdl(RD#3TGFh;c3D8GiXV)t@sbx}1Te06=9RDd1%-TQ&E~SjL4BVvBlisVc3C9Fw*65ZYLcm0X8isy8GH29I$Z zw;imH>;5pEN`jMpK@ z1$ARYS$Q|Y&KBQwdDQy54%IHfn_;iRn#n@E4$G{?>yX0&yACg`v5k27z}3^$7#akT zgLjLg&MmHPSM7&gp3H?cPm@(OPsAG(kfnJlOzK=~@4o?9d`NQyx2P6V8)`)3iI{X; zCRV1~Od5u+oVXa2@**twbz%)5t@;TT5i z>HEEfdf?I@Co98t$ie3vz!1IU_@n0Y*^TAw#c=e<(NTJ-Lfn97J>?&u^YRX7dH zk|ry}@^Hr{{za6CeF=6{S0r?^BFp1irW!PIO>X!(|EmbAw=QjcZ{_?ECXBw`Iq(F5 z9(Bu>u}{oZAd&p6efRc|zWZ%9>I!(4k7!!wud`CJ1XS^xfnBIq;8#c)y1>zN>*n<3QH zb(T;GQMz4d{#t1yh=`hnY*LLfNf>^01~>U%)O+b#N3Qag3QhSlsp7?Lzah{ zPkW0uT?u}dEAp{GPEO9cq|ZYDxElaY#JG9R1{m=`8RtMw4)Sm9?Jq`=SPHxeIH2O* zRsq8Bi?Fywj!2=7$vzW7A$J04sh4D)Up&|hb+#PIFdbrJi`s0*t+Vb=e7i)WPM&g8 z=F)@GqLPBXqmsOSt5brZr<5kEZVt%wNCh_9m`cy>AZ%RS3c^&SbgKMTzpMdNg3}sR zg4Wbkvf-j-p!*8Eb6=iq{v&WK`*bRbbeE{{8J`@sVUbHxZFUK^xjN1L?HcL+*6ow{ z3pYj>LJTb6JpK7sO4>u*Xq&=F(l&(-4RySOifK`^3WZ4Y0td5Hf%+;9}bzmn{R21ldH)#QKT4~Vl#81fb$CC;uU>2vgC%rPm;LHqXrq)fYG@_#v18|3R(=I?fe?D~(24 z;u;>L`?*Anu6zk5WJwzPVUJ+JsuB!2PV2BP;F4zGaBPWfK^?<~tJay2H0+NjaEA8h zof32eF|9R{8VY360iU=SkH)rmh2)+{&=khidpN674N%x5>5n}W0;W9|VV!3@eMzrr z#2?YA86|f)P9sQdut(BqSti*Ls=_mH(hUn^ib?QgZpV2so_}}&-~USD)Ham#YK$Yc zou+CEbhiQ8MI{J|`$oMjEL3{VCqmk)v7M-e`JQjX{F7~pijyy1XVbb(s6kCs$qOFo zT|q_5Lnz_I7s1w62t}CF=0hPSC#@Y#RCAGPG6qQuV>T2CFBh(HOHO)Os^3(bR9H#) zB4R0n2bo-Q`kbN5M9b1Vp2-WnnsK1XD7U+J74g|knq+s3Gc{A`2LFB!k9o~;Qe&_m zUS5vp)fnC&COOr^BvT=m+SO7|a7dofpv{!VfMGqy5q5uw>r<;u7ng?mh=o}IiCLy8 zoopz;L?fh87w}z_^8$d6 zaTIC~Z?!`D@enWmObdYf3s{L@-{#LJszKBalm3 znVg8x0y*f@g;a?ZR!EOMZ-zhBOjql|Q3Ywa7(G1u7^;oQjwA*O&QL$>U5Y|a>H7+QbG1uHOR^&mkrt){#94q2 z8}|zDUO{iw(!7>Cgrt22%QxT%%HR|0C4|%KMue}R3cQ)MK^4A|5+I_#wj~TO-GU`$d>J_G1dQh2afVk|{AZp>O!NM9>1Ef{1 z4ib%`mYf!l8c2j`)GTUXza-Ss477^ym$~Lw`y>X^g1m0RhcBul`>1--BPBbLjyx?T97ES3k_tYIg){1UQ zx4H2Y>!eut5-u|9n@yMc5|;4)=yFx9>4AvS-W3L|BgU5sk3O~Zj`Xj|_FdRroDcDs zu=l7F13QQm>tD~_3Ha_I(onh>{%X9hXLqHSvB%CO1rxYfm&daZDY(Sx$#@#Tp=JAU z|16eLFB1gB${N=;zyri#=p$~q1THW!9=dI4i2a@4Mx zt48QXWIm6}H9XQAtYL@6+lVylAcyUZJPsHekxTk}BfaAbIiwMGFQ7@fKM*B~f+^e$AK2IspySJhBJ$1_63ZM$hrHev_CczOgQUE z4*fHX4=;zZ(Wo(8BWz0SgmJq{@+=S|!a8D76Kkm`k*uR_L^v2Z8cBMDjfh3dNF%j? zu@N~A+k#}yB)`U5M;6x{WD+{5uet_N_S-Z|n{Qny(iOD3w<`nzVzFQ#oCBqn6iful`YDYLEDJ1DCf@NP;RqF*oas#d^Wc_U~EK=L(Z8! zagC#yra{|?u-IS^7h-TdL=?T6R+9Bq8Goaqc-VcoK-`;`X*XSFbdI?Zc{$W+W{rS1 zB1C~qBYLAq@d$52tbJa3f<)SgsNY|%X|cviWXoG8>4$QL7Ht6A=!thgA-AY>JfDJ; z^OY+1t;&uM$F$p@pk*o3nY$>hD!OfunY zL^2%mHMZI#Y(%VGz7U$ow2UT;SnhaXadIDN=10OwWw(%wjwj6&Bg#eu;X%UC-PHS< zNh+j`h>}|SE;nG5$-yWN3-L0u)wv1NxZ4$$dxx0TrqJqAE;mzExdUi7(FBZ*$hDK& zyjJ!UC9gA}<=QNU)$H-4wPK%h0U~OrhFk#hMuGe zDpbXrAd)W77@$-5?jC5Eg0Z21pL0mY`45ilP4A|HstY)MA=XEY&k4o<)j&X;iQelr zKqa(F0}MQxwzZCwDK@NSD%Fc{u9r=4&z+hIlqg8;RL9?GsA-OOdqce44e@q1#Iy3X zxgAy(Hsi@5T47ve?R{sn>fPH6?e1o18}`M9U9n+LY}gT-_CrHUIdFraqyfeESh(FgATD*>7zn zR&I<3|2_imyYRU&=|w#$KDQDWu|F9^N3Kv>bnA4NpF=Y4WD&W40l%^Ca)1lCjgVMF zS4@S=c#>luvEhV`O<6Hga?mTjpMtfn>f;tDJp!^)b9h#^uQl!)<{9Y$nOK~)j^ijR zsJA$OnWqVj&iRbvfG?nBY()Vc$k)vZz!5aBhI|C2T%uegCh)ZjL+%xWh3+q3t8~8B z&@j%WBMT2=)RNFXd5vk+=c8F5j=AHfflq^>IhzFW1FE(AA?Ib;TfC*--oD~V#6!StW zrecgZe|rf`g)?nBnJlqY5(n(S6(eFAoJ|0$l%PfMxA{WCX5E@ToV55+PaqrWvd^zO|(DN`cIEhx(U;OD?h;e&9 zd_6~RPnW&d&XLO|DbKV9Ku!exGUp!3qF=q`jtPKo3#DXzw`WGB1aP7cf8C28u zrLzO>a}T|3NvCF06~Lly!J76bE4ab6z%gap zDqdk#YRSED5wG=F$+Q_;Gnr-kxJ?oUzXhjFwM1Exr(5cr33{C1NDzufD!t2oI|73_ z`FKrjMAo3pS5SG9L{5zuNeh+(mtA9 z4kWliQ{F=Fr%KI-wK^|`ObjvSny6w$YHKb=G^6JsxR)g$Z_Dh}hPxUTd^vvJ!YbTx zqEcqbru+yY4^8phF9K_@j!QfpS8z;N;Ql1^kEZ;K;biu5_++E93~sSR>5i-{KO&m( z{p#0LL!pWIyY>D}yb>I|CwIxckI<=Kn1o&?+ z$Nk>r{hAb-3=vwrsVkre^)Fh7eT5fjn~7)Dlo)GAay;5vTOWGF;;g0@xKd!#GWs%_ z*p_xQ_JyDp%gJcch&yN>rf%(Ue#N$abll#@^n_yYX76$gy)f^8gd3UR@r>T37>jLg zA4ujzo(Z#{tdh^&`y1`mlyO)>5ou8ZxQ6*t@rOY^ zON)KtDpg{bgZQi^gsD(1l`6MGDv7_JwKPJeWq^b}u^lIC?emjI_p%&xq%TY~`lB4q zn-+O&+0LViYs-=S9Dq1oXRzopkQ?}Cg@ucy;^Ig8-oa&+ zvpi?7vIOFhOqRUb+2$1;wMpX(Y%xh*ZV9ifPz_}kx!zQQn4aof z_P+FnT1!V10biZ4nLVf&!A~u>C}Yxt9dU~O)EW5B?-NfcH7TNIjF0Kn67k7m9b+=1 zq!v;y;bs}q`Ir%c)*nH)eCjF`AZaEIW*#GeP|2n|VTb^Q5whX+5i4-)1b2I{oeMr^pc)H(6_ z)esL6#8zVSy9!vfnPP!sci`ES6&7&ZN{-FAdcBnU*)S{#7*ZBNn-6M0E~25*bm8&s z@;s>AlP+DHvT6}7Qa(vwFZ6x=y|p7_kSI*6d6t^SmYqapiwV@=!uBhy=&&$jryB?Q zr1v_^@+1j6PLdRa(6Jwsc#A8rBUO%1fcVy7Uwc65r)WN1RlEbH3`}?m-F(XX8i9fr zpRU2zI(Ev+v2!q*Ootb524Vs(!A6XqFI#UHCa@w;x(8yi19|qYmjD*Pje{-nE1+T2!G8yh-9#ipmEkKqy^zEaoyxK6j=le~LOfl(!rzhao%8r@h6C0iGhu zPOb46wnJJVwzK3H?8h_6d|m+%X9VZ0jWwC4KMZ(|qj{I69u2@&P(lWKDtOzR?`>2E zL2XxJL*$8XU`>1sW&&1~Il-d7ALzMs=wT;RyAjb2)scF8PYB=UarN-ESVk{XpEyoI zI=Q>if0)v5gy5UB%(G1~f#(4D_Xa=5`1!B?p{=d|2mhGH-`DV)uph$DPvYkn{P#D0 zgG(n4|K0W9|LX4m&dsf@kMTYGt&YZz0`1x!2>HL*M#2F!|!t6-|@S*wtf)(^sjyM*4D4#XNB*7|1(=#2ft@)>!b`WccRSS1KMN!e1h-KBmH|(#$N}W--_Q8{AT`Lj^9!K&9^iir zZTMxRcYsgazkz!2_s97C&jass|A_l$+P5Q5;NiEUj(-Y2duZq1^lkdPDC6J${aaiA zwW>Swg@1n)upb4^4}pLCsPnI(%zwk@{cl0%kD<&zkDq6t8}e|>aQuYt((gZs_Wc}w zeiifs{9RRte+hs8u0OD~_0OW6|CdkyHk7x6_6_j+hw$^z_a(<6#~#NbY3cFD@Bh@} z@o)b73DD#m{iV;MZ#?fl=lT90f?o~`eD(QW0Pn}}6VmnX??wH89(B@b{QKK|-p@AV z`!e$V2+DdF@V}&Rc9H(O6;A@)|IYXIXM9;7d-}i3apwR1IpECD_dklC{|rBW6F&#| z`OLRs9N{P6o#5~P0{un#6Vmvbb1{5VUQj+zCUEXCo%51%gK~tjCgAcn=k^bR?w`TW ze~F)8!Oyq;qv#|2e1e}J$Ily#p`XL=@BB6=FE}6nu225~q%34Z4I`PcD7T>iV}=l?N&lm5@%aJYmKpLFj2 zp;WKmhrhocKZO6gpxZXazVW8R`*;3v$N|v#pFx}Xe*d>aetg%~*8ljOTU$4-L;j%> zU%+p|{(J{*$2b4}xj(qI_55>NTYnb6{}z7!4AOu2%GTEJ#m_I|=U?`Dh^zm-`i`wF z@`LUF6ZrcN{u7Yd_)VOjL79I7W&9F;z615C@blfM5BvB5>iId;nf*J&-)Bf?o^Qe5 z>{s&Ve*sSduSuW$Ar56+kg5FUKk}4)$-gOIgY4t{C9RKl9bb0v&3+;t>4mzptR7&$ z06g;WYt6Gwc=bKt`_JI#?|`2iN8b#7a-F!1-+vrGU8Em^r+*v$_RaYD4^a1i1wU-t z9K8Jnz~A47YzO~;9qFIB<@nFF+I`h4t^I5<-?%zkA&<_>z{RsM!eMSDQ;~VD! z@i*0R=K|Zn`tTp;1%HRJ{)>S9Fn&13LO;BZu}2*KW1HE2{(bI$^Y7oHaQMxC z9Lw&n`hO`et|AZR29&NwnfH5uPg*_v4t>OV z!L+}O-&#KX3ce{*LfPzl()!ka(*5Rm548E4W99RJac=VaM?7ATb3b`?YwNH0G{PT1 zj{kO~@$X;6-~65b`)i(*1ca-;eM+w2QPtojG>@H{j_tW8Hee_BE{& z|0~vyFm^tRGDE$8+OI2=YfK{#!n`MMIIhCDrtV6ek$O4xV&YS$q4$4laAJtOZqT%ZtCIGiG#jf(v7LNuhWkyf17k~O>i*P?IF`fs39^7| zZZ1ndi!_dHt`+Q0t`QtxT#G;LTE?-^)~7*cb1h>%S?|)C&vgBd>sA<>-*f}(4?3CS zn8Pk%B}zW4%Q(2{M2oHqyzHfZxXCwS9 zKzi&4=4E}TZ?LR<{U*Fk=U}_SoMD|=Cf8%?1))9E6E^7=?p>&py-ok*Via9)|UT_`e7`95=s?pUc zhyU{V6>I}-b1ck#w(SJvlMd_5ea0s9D(~;NnO~dCr!fE7Kb-&UFOD1Xneu^r<$R)S zV?V9X29C|Ygx|ztKM)q?1Lp{3U+7!zmpDH-SHpbxRlwPw-vXJ>eqf()9az^7?7z|+ zAa6N-G=Et))|K@n&&dmp6SjqY!ZvKGo4pOsSypMS3FGje!@5eGKZ@Vv%PsuoTKhlY z=eJ>#dw1RfvuZ1NvBHCmlObNCwt#lTvV+Ni?Dd9}$q4uq4+k6Kj~ltc=G=hCWF`MuLoUps zaB&h5zgMrrHOf=@`cxEp)x_oAWZZ;G^w0Sy7zR79|;Yjd8uGUyl{)FGT&v=?EcJcDC2hZ_K$?4mRe*1bLf6 z<%aLuWbg%VnB}}LZwAPJ{8(-0cxYG1h>NIr=;3XKdB};2)ldOGO-{aYut`3!8h#mY zc3NU_^{y`MtqZfm|K5;^LtG8M!0qZA{LeZ8*}s7IaPJ;`$?>9&`+H3>tjvtQPdDOU zYjPCIXyI4r($VFt#~1_!T_vE5`Ak_m%5=D#<04=?QZ+uuef3khr`}rNtnzZSRZ@lO zRYSft+g|j1EU&<~mI^JYod~a+HLS*=E)#l}wNt51;Gw zk9k_5`B)s=G5hDUQ@q%)ruM`_KjKa&oU+yugzCR$Ot_`2ZCMFS!SG&FpvP6@*0tU2wy3195_OuQf;DX?qPN1THI-QN+NZ!t}!SHOgW)KR>dcIa~CRjw;OG6ln z(>c8D8q~GGj^Sc4YgoMk3Vj8Kyiw9#;Al{7F#F+)e9^Shh63l1@oUC2?s)S0S9^^v z5U5~wj$ldcXp=o60A6#^rqNdttl76=XA7!*JC^0q#A!|&3K=zpF2U+ttktFX5F-&483~3h7@)r zn^5axMPJiA-SsN!DE&eur6wFOSjdW*$)*f8;pAqU2s_9{(Y zot>@L$jHfg9|5pmoSx&x6|6+P^EEVq&>QbaS#R3Q!@xOxIqAWY4V}8hRu}rxZ#o5Y6NTR6Z!nO6DK|>j)R%Wf*Py(q znokyDJC-j-&{Nlvn&K%y1m9{EW74f_J0nbc#2?#$oX9d>m)-z(2w}WQ71s-7sbk~$ zP2init<`u03nF&y#?~{2W~L1qyI$2_O{?B$4c}JF(Y^MJ%amHMnP=BJ`b|O*wz>V=S~woJa9j zx$rPMaDNcT;$@sj?;O!hU>(9ydW)4P$F6R)93@EGn;U{U-C&rza=pUg8I4HI7F{WV zUCfK6?SwqRwlzJLi72R>;Ek|1n2+bf2F)sv3njNT13QSzO9`pk+FFO^3AVR)(Xvr; zSG8~W8{5UTJXHQmq4rv0wdUC5n36K^2H1yl)p9EYp?Q5)`A-+4{?5+MJ1umo%f>Cb z5JD4MxGpGP!lmf(bTn%zC7{TW=_Ys#!a8eff27zva(r+ExL-(+gmSUS-p8!I!9`yF zQ%1uMKwJ$F#P6(eT6!Fbtx+ZuN)yS@pxOl-m`3LpP1~h_bU9o$iU~QG$8lk+>g|@$ z8;zpKudz2;R?C3WY>V=RG_Rn61mnFli>rVo=Vm+G&=*hJPpN#l?Fv^| zycH(2a|@-8D*V5JvV*pWrC2u3nTM>R=w%z!wT9m!aAG0cX~EQrWueL9RYL`OL)(ID zToCM-U9X{xozlvW|GiBvyj1h%lr1_Hd(|dQF{O_B(`DN^ZETgv^#VG~@bc6@N!hkO zm-ElZgVEsavoVhRc(Z&oB|#Ef=Cs%l%Jt0J*<@9WnWfYUu^`wZYr3&mLym+^@{Jk} zjBHK7;})I0hTC#LXmPQzn9epCYSKp3g1=8&m2+DFvTV)?LH)Q%j)b}9s^TWt#>7Kc zZk_=F5BsggDu#V;K4k^8dFTMRcH#hMFkZCO*CCY0n1jJ!(>67MgpEKWfgu$3R^U3? zRQNX;i9sN-KvYN+cJ5GMBJLqXe|sI8M;DqW;b6bX4-$d{`IJ1I5uHC-(Gv=-VZzS(mF zKu+Su?j>+d`GV5id4bvfwi<1wX14F%d-t|i?&~k_ zr6;5k(gUG|5{i^i5)dr(FQ8aZ0)!S?=tW8(2%(1}3L-?5Dgp{32+|QjzkmwJm-_ph z-FshNVkrLg%gf%~ot>SXojG&*Ih(q_eU@`@-L-Gb-rvI4hCW9c!h#Us5M}LWfW7$o zj7jrjt)FAg?gihF`nIqCwFe--!Sgme;XlveUh2YO8K0*4tp3+)NWJwxw~;_=jLg_) zyJQViJNz>h^lPddy#KzRfuS2Fcm^%`J@M* z&EfxNz0W~15~cz-Qv{BDE)Wl@R6aeY3w`zLhhh1C z2Jcv}Azx%$e=krWT_mD|z(PP~I4n{59`$-3*jQJet@&GDd&2auzdh7ONC-Y%S>Jt8 zt;UDwzNp?8fCtc-@Br!0`kQLhkS`>CHuyAZNn@V_IE`ut9P&Ap29QL9n52|@-|UM` z>+fWi)vlf=c?@g|2f#rF@dBSQ*lSl89Q2tY$J$lXDf&`fK-TpyQ!i`&%hYTn1pnN+ z1KFxSx7KH~nf14YlJF3ua{k;#2K8KgOW>@4FPn|Q0zUYV!$#G!dLBA%44k<4AG6QF zUrk+ypt?f(MXaan9|w7-^K$B-9E~lFDOvt=WZgiCF8Ruf$?+YdUDggMt=PxrXj8S> zRG1yMwZmGQex>#Bl9IbEO*Xr94>9s<{F>M%lqLFMl4KMyStH3JLM5E$`*M_zvDucM zZY^ic6+2crZA&9l5Dm_9q^DS%w{+h6JNs-x+@7~MXX%`Eou?9M%c?FXLv zRQlBWNtd(7zJ$ldc#N%C*}79H-K-qD-zYong4byqvQd@ud4DzEWZ%u`#$%YWM|qy5 z?{%$*{o#O>$j);fm+a{rdyxW&0ubI~ky3)m) zEq3zG*mw-(Y8Fqiur2|qjCt?i5a}RwppY#u)*~z)X6a!T4NGt691p}&v-FW2ItIu+`g^9y>Vyk>Mt;!A%{#5sv_2FflOPz z803&$L8d=X4|%{$*1bx1;_4LcrX_^KwpLSJw*C$Abz(;_myvz2l6U% zZX`S8D@d=PfnR3@X`3&h;9_zwA$=;@InEb#spz)%fh=eM7XA)*zV9d-?K_QU9IpQ- zigfH8>K<5Nxq?4e@9BKi-pAd`+1p)+ntQstIlH^NIt%p9<+O%_`|)Q7c8|9G4i2=p zgS}$`TMSavjrF2+;M*J6Tibis3qgD`LUc}9l6W@rNo7z5>!ch|_D~HfW@FjApkBWA zICKI#4k9$dm_ZE0-vH@Za&ko`^Z=F}ym71Zfqyph2o<%2AJ5GZL2{;D9CK1NPkbdUvH z0I~{1!OC)#wGqJIB4vSW;<~G?4=^Gq!E>|)!mWJ^qvZ~>x{c0rfJKI<8-Yusd#wpr z8yH5#ae9Hft+?B2@i@`}=sKap*K2DV3^Cq5dw(0S02TrzXlc+W*#pO*Di|jKP2*Q+ zL;cTXa^jjPr?s!X48FWOF52lR;4B+t=~-j28+}@{7qF6daAgDs?pbqPjHpDgZdeWk^Aun~v?ERt8_mS{W$8D#?Z& zh+Rh2m+N4@u^F_WI0$W74>*!vDM9nNOU?n4T~ z(m1L=$KocdNxCmJ>Ti-ALI`nYjR8>stLYLFpVV}lNG8tM;UGyEh6$FQAeWF^t}2%n zT9t*?B%pg`3#sQwMZgobjlGI2T4?EoDXAL!21^68N`ronqx7Uas3^PKH>kv(InJuQ zVXQ?}JIVW#qKU>)v2Ab$4JQ0ML5W@mV)?YzB^^=|{jYY9CxY(1OtYYE<&7ND$O?*Qpq)}eY5KSTzlRlPI6N#OIPL$kJ>iSEp=rN2|t-!gtXt;#zP z>Q&Xx*%6npEGjNWr53VX%zF_41tq@Sp?dMSQAmK4J?aq>PUG8pp+Zqr{}}-CH?k_& z-dCoSaM90wtej6&&aRoJ81p13>~w7}(*?8`v+uGU1}auQWLZOh0n`~Szf&-dUj+>U zpN~#IMvtgRg}Hr!+MlOAt)@eA`MjI+^0}O!r(92dnX*P#c??+lf?wD^{}p#9Z#$!0 zo9FxUXse#h`XRasuRaH(iKl8GL`-??&jM!$VXaV7dp2I_e9dDlYkz$L^Om%Ulvni_ z+&+$;VLB8Uqtx-U%&Ybh$PEO3-UU~gW1mR(D0CuSDSywvy3evNV(SW2$>A+Q8+=s= zP*v6=*x4|^?1EiY0k>f!XbNx+4Z{iwCfHMR;|e*bHe5OzIp5wRjci}8mgA3Uxhg$; zgMyTH6Y)&IVUDWu*ux?8oraVA0?U40S z9{4ecZ-UOisI>8K8Pw9d-Q6Q^y(Von<%`5!eVH`R-i`}B+4^7l7V|h zAw`qY3vjIE_!PBVg>O4eZ#fvt)yx~GlIS+l(O)Ta63p?3%DMvuzzYPz5BwQe zu-^5j6hE)R`&8H*wuNAE(cyoilaRuY5lU-0emLuJxQxQepm&S?`uYz@#WfC40K*DtO)_6m^aGBIOGx>Ppg8WuCeErkoX z8(p;d2pN~}VpyhP+tIR5X6rss>{>^M_G+qJ^i*C|^k}=E5}@)wX#SbzpFo+>C-ZWb z=6iMghG^i@dGp8f91t^h=5l{JHzxpWeoA^rc~v>S3m~-FG8u+W9x6&5h()$S$A##* z8)1u8CtkXY0gNmz=KaO`X7#BOET-RX91N=$T*>u=G4=hB`o6cmZ))sM*V|j}m?S6^ zlCW@()`{|=5qQeB&ZHq&srtLYkv0aAj;8Q5a*J*$D5_EcD=$zvC`n|X5vvU|h$BRAoc7#(U_!I||0Jo1C2d$gSx-whm$Tsk?qWzMHD z<@U4O^IhvBZVNZ}HpI&A!W1% z5VRX75ns#v0CVi%Vw>Jv-QuK+Y88FGuCQ21^@ADp{S?{rYMLN>K+j5T{aUrKUmtJ> z1HQ3fbGselstQFrC}={3+BHR0n{4cS4m!i3#*V%5?t~E&Cwbdt>oHHSDjEJm^lPk8 z)}o&U)ui)5zyR>eTNYi~0(f85@)p+*?o;)H*81M5?{}{654*8tg5@rDpzP|RkP{k# zK7j?nu}9nRuGVR~P51VNJWP8d+zqF4nMap`ZPonl*p0Y94^<;r@l=MG4vOD4GCmnd z&|6B{ZRWfk>MBF)$t@ty?V;Hr-jR2Rc5JnaE*MBZ#Nutu>mQgOb_`P!fL(kuKHIx) zepDhn<{z|q52Cu~yItXM&v?x)D4~$`02ncE~z)c0$uGc_P_GH9Y1CSo32tDAq%8~g<({e z9h$@*0j9f*Ei|6qM(vvFa98ms&W)nOUCmqF&HGsHL!Nb=y(Q$oEx;28+@puv6|O-U zWq>nX3UvvDs~H-aUBQzW3?7C`bm@N1?Qsn>Q#NlPKUE`y;viS)(HN6AZu@j~6g-P-kxU-cqCP;RTerfbibde_b(K8@%weGIAgM&BScTE8%huOs(lU<_fL zmeFtMbgZ52&?mN@b*j3Yy|in>e9^d(-EJ2_He_52&?6h|YkSE2Y>h$I!lpZ$F zcyJj?g`o|4Qv}9uhRlOw2u31+RVL@>xIr{g&0(IcUDtKYSTo*E+=8P=W@lp*T5Y$5 zQ>n4J*LB};%@8HP0U%Q$*j6^bbKT#&Zj))2a;U(6=bD$?g58bR_aI2-+##+ZaDL!& z127lTyM2H)1z@fgJ)sI;B75o-VJ);OaRn2lWx^hpb|Y;{Krj>q5VG*VCS2*f-*q2? zal~{e@^{|10ZSJ|g8zQW`rpvJ+jKoCTrw_VfiYi+u;%k*N}J zRxahvef(}@)%LL_z#xLDf^m)QU_iA#6`Dn>q^k-gvEHeUQC|Y*CaZ}?)%Vw``oT>N z9Q$;70OUILZW?FR=7N*vTn^jt`~{pV=j~hp?Dd%Z204?zlkuZ+D*p`S-2Cwb?%U5r z`Ek}J33r{TlQRG|#AI?$YJOA~h6erda-CeP=@Om$k@hdb^hOtJ*VgBYmGB&`&e!TH zt@8dcS{*GI+W|`x{8;-}YVVgCB(7zJh6zCUDz^Ws%*V=4DQnQ|&muOn3s34?_MGB0 zb&(DYkl+PcovrOZYQM$Y2_sL=F=uFZW3`EWo67%0<=)`nH7@>@)oWlO>1H(oY#!@Z zSiQ`VuZrqyJ{MT8PjpxeKfI^}VxIESQxiVi<`>OX8O(s?wCIAK>jI+$>2dw@N zy0bv)`)Y*AS~0JK32hQ1#s>Oq6-?Dvu{w)f(DCP3+Rz)CKeKucl?vc}!FsX%JewC- zJ&(2`J7MPu_Pfnbl$oB#yR@21b>sjeWsKwstQcr_Sr@6s9}wL_d@fNNU(O%=2J=lOoo3w;571rbkCDGUNX^Z@%U!B_y~ z@Ho(Z!A>B3=AuOIEEZJ06>wnZ{22H*SE#`D*A!HXO{$tyMwC75i!DCd@|!nqhb@v# zm+Dpu?@ZHRc2I3o)2pU=QVSH%tq>=Bs0C9>Sg0+dnhkic(Jj#XIi_rqyg|8&%(xV) z=l_kj1xzm*k^cTMJ2{uqv+J_mW(&t#warqQFis(Pxj?eX#rY6meHHo=tQXfr;jqGw3~q?8{Yfv7#qocC@EAZD>EP{ENUeMi)b>)aNSy9Hq`z z>O588yu-Ju;4(!pJYA|_K*SURKK{h!Elei>19ZIEe}pgwkIFN``ZFFPb-7AG_fn-U zRQ3hR2DqA=Is7R(p4y-OPINF<)zRc10*U`vYJQuXw_s^u?{#I~P?f9EJPg(9b#fs` z8_07R)Vhl~IEmDWL?@753I-|wyf%~hm_V@Arw~ZfZh?!c0&)SP7jp0_(JS@(kWEqF zyh`d7P_5)uGJhfUDzK&t^N#&2WE`MbvYX6JY<@%GecG>@>veQI)fEsfo$m=!dPg9% zh3{f&{*t;(=kPltTdNR-Gbb3RuqR;7--C zZ*R~;y>dRJNA;F_Ot0$c>Gf6M2_S~XPXTd!3W&2#q7*ZG+YYsAkC63(yaQyqaiBDv zV5z`V8Bc+5X6tn&aS2I;Vd+f^QI~IqhT~#7{=f|^o^RFWTQ{rJyf_2u!P)ir2;%im@2CTT?tKQdW zFB^Q8z58(K4D^n)GmK8w5bh_G#QGc3VjkR-r${%|h1^9qnT1$qhulvGZ)W-Pz{!F* zQw7{{l=3kOP@$;6W#F62kd|=xT!PwnG>Q-=Twi`Rb zL@A1sCN}qzdYJsGYRbVmA`eS<|F{I4g{zC~z>@D>#^y9OC3uX03h?@}-l%T@r-+vbh{uMQE*Z}UD@u7Sh? z!&}Ox%@r<(SV}i ziB!?>E#4b=^owO1R+**%4I^`1a{J#2ggY>!Av$awB+zaKo z7cgJK`HMMJ@S(76Qg#c3W6>H!dW^227vi5W(2rACbc0Jt1lzPHTLBFW6`^YhA9IT` zW>AOV^B{K5#kBoVl-tB=hjQi6A}~b+OjNPKmjdS~9RwR^a2(O0+=&lW=zfKgBA(qz z8SC=`-A&KSP`(XiV*Mbg@9no}n$>=WwoU{#YU21|z*6ov#E((_Q93~7A?N4#=Y&zU zF`m;hD9F>(3XTO9Q0X|HrB*`G#{~x$TcAmR3hpU_Y%oVYHi{v}epY>muYocUT+%Xr z0FDVVwY-t+A4;oFNq2M$!I=somS7l}Tvimhg~|6W;(p_+3ORVYKJq;wllfN}D=1HG7N zm%;6{gmFbX0c0G_qhSr{2Forsj~LPi)~DmcNu^+*-t-8DPU{jS<_1q^$1gNPq%_OO z`P2&H(Uk z3@M1L2}K?HeeC4`5rTLl+8qWYnD6rfBSrm#`W+*1N3Z4XY3&)?z3e$XS#^;K@nKuHl!VQX%fWx2<})s1jVtzCOP zGaI*T&v-ex1tmp&s5L_r!T5t30`h-)EDjZ7mBnuzV|>4kAl&-Cv<6WPwZs5$Xkz;` z9NJtTvks`W{Xzx4JOkwLrztrc!((|Tp^-uke~B@@kclmxYQ6PUo4 zzKM5EK#Sqs19=xqly~Lv{4B|*mC&O4NaNE$ddU!TCYcv=;73LLRaZNgidJ-$YL-3M z_l@&G`$D~5Pko=S@0;rT-W$~dOONM0QtW&rkH@~9?vgGou%4yv(Rq)K1sf%to5&UM z65>-Szl_?sEgk_p388jcr28iGjP~hG`N??yn3KSSGtsCVPqUk0B5aPLmX<)}$3ciQ z5XRkH)MA?RowJ&2UTdK>*VteU#s6owxvbBBE5ArY5P3IO+?~clx7@Do zvLRzHNP%iG{i1Fo8w&V_sm#uH!Ra)@(zmmw1>FFv1;ySneO}>oE$CQR|I7X5uv?`!dh6V{ z?)kb6A9<RzeJT#JXNOb&(^Y0(RrBhcf-_k6eWG-7w=J}jCrq{Ww&zw2LoKY0?fZw{C&kZnu8!0`Lf`%f7|kcx-1=UQTP*z(ww5|Eyoo(hF|;ZX zv@byM!1ZyV$&DbfaW3!8R-1zcYOlZ8R@}<#D8g3{(p?AmI*=i{3d;!=u@)go+41rz z{^FVD(;4RN382GZDHqe%vc;R6PNOWh9b%k|jqElv*P4~UF~II^>Vm$NX=u|B>T7GZ zRgwcv$z-LoQsS@y?}nQ}8mU+PJOxYEMU> z5AFyOF}RmfTGqTraT74_-G!N^i2W$TTXQvEr*IKrK?4tM$%pV!G*Yi5)vr$@xan?T zP^F3~I2k~idR8B2I9yV!99t|bDV~dW?F2({vf*!{tMa0=dS~Kg=5Lbz_NBj3`ddwZ z6Ud+LiEO8%gFj; zwAG^+H-3RivWJ*9Tgh3r;?;&GWnk zRC-%-^*-J-dtjO1(+|$;>i~}7pv1GGsoGTGVh50Lg-1C@xeG~v^F>;62Eklwfz^RF zp$tEp2>Ps}^g`MT9msr?|4E<9pf2N$>if#z{brW?CxPt_Y)i>{LRIatu)u}zVD^kj zrlDadS3l*pV^qobA)TPwma0;knk-o9h>&{05C11cp7aXJ+11o>OFMqPXyt- z1AfA2Tey~0yhMqmg;(<=*~8*eU1z_V?uJ^zeTnTJ(`|Q}C)heu5C5rh?@;mWD!NnA z&(*f8(>}sC7P8=e=wn{f-KysvRWs0)+^aetQc1B{HUCO&1HHhuoZPCQzL4Iw(t}2< z3ipU$$dh<3ZK1o>bUbT@R2dEn*#72CwwIyv!|`r0s3YkP8jDGl4!NDqCh73bw`|+$ z1R@d75&4mjkrV}etd5fLrn-|&H9K?HDy&~?Jsl8bUuvu?DQPkg%@K5=j9-L*$nNZe zgUabmxX`4A8CVWndnTw~UVBN@X4+>kZ|lzIcB4ZVHFx$Gl{$=Fa{bm)vD9KPqsD}7 z10Z}Xj8m3%5%Cj>TP4Z?nlN=D>}7B3E2fxJYvvQzoVkyE(;fh7%IAT#;gQ=U@R-)M zair6z3mA3IPxBJoE?Stnh4Tui)tci4mk_99X(LWJ(jDv(T>S+{hBl z<_SoCFhY%{Q3(uYL8LavI=4L#9-HGX(`B~Ff6IIaff$+#p5s-$g10%m7DG+ zP+fr#eHYXw&?xewDpvMp}~fjuc2u`7u~UAc?uMm9%!PchcaBS=J=2_-Pu0)M1K?78161` zAcvBy(7hu#sx6YOXx^H#jsR7m8r*=M`AZw6k660)|8*5*sw?=8~mk z-g40K!yuz04uUvxm+TH5!%O~3;!8;{A$2UgQ(^jtJaz%O7gDR^V-5?&XpLg=l@ysz=Yx4t zCP_7`Ye-MTIOEy7Lm7!VLEqqcWPr3yrfORBCM^W$91`GnvK5X1-ht{Ez~S0OfImEP z4E*7Bk7)%TfKrs~VSQpJvG2*LIzg*>9ZzXK+4iop=~`Rer_7TK75lxYX&zPjY*E%+ci}`4>IN_vd>|7`kQ(u)`6v{+0 zgiob46l_WdbOZ>jfFx?1qKj_ACEtVL&3HXAI+~*x9nI~Lj`ec74nv5+Uj^JI2egW+ zvLA1S69--wVLiqN%ay%y1zqWf+d#{p*G3=@)(apEt~lASKuv*r7NCw!hXxmLJ|nFc z*}GdeyGcF=4|fdH&y72;<20Lp>3Dy2=ru=O;hN(dvy#nH=yl@{F*q_<55f6~UUt&K z@-SGB!3b=0=ZjAG3Xb49lMULR96DOdpgk+sZT~85ex}vy#{0YRZq)iWN+0i{p-bJy zsN1Kw{Gc|zxd$UP(XRbmrw!?|UHZ8+WX^T@7r;N}*K++s+bnU^tJ+-5?(tA8dt(ah zZZ@zoR)CeTtUtgDjn5(8j_2?J9Ld6w^?W@r*eI|a12Y7c7WCDtK_r0BS?q~LB=dL>RJeC4Yw-s(@a^TXjkn59;7%@x^RF(I5SPntO_Q-K_ zXBl%N`}aBa$tJ=?yyVguM&SMxpii)saHmKI{I7Bfy8vj5uK8vZ48xGSs7x@c^THzfCHH075G9T#vU&_3r$_R@p*d2&$@lQ7HnFh?MenqR7 zVR=_epqf+18TWY8g76zG6(hbBK|T`oFBdTT_G_N=L0~`4`~rutVcHHfl>^)+qTE2c zHskL|pj)eyCvcNIj`gni;5ZQezW;%vP9`5O0vEKg{ho(3jSfREai4}@V_8jX4KZ$c05_{cI^V;ul`F}m{HlKdt zt4}=hQ`_8z*^aLg-*7C=_dHl$PW7>(ycCappt@U9@`y01ukr%!a#D1c<6kIQ zOwczs(48zMAUwQcityn4=#7ZOXgX|~A(j&iY*L#SZ(y{*0d0`& za@g@QinFt|8KK%*g;Ul#J9N!ihZXih06G9l&u7{CAWS&+ZDWMFAV+& zOSS#|2aE`RL?oXDCt7_8(XP6S+hOzq6eauzh){N(d^Oj;2+UtE7V-fAC-hBl#Qbi6 zd}4(gTOUOmH`f1XgvLU0?Nu;=#h{bv68UCoKR!q7$K$MgyHW<-gvNtJ=PsHL2;aV! zLnNT~OE6j(*s^k1u<#l864YqMUis6l+h7DtG5;*k$3y~&pCtMNsr$$*X8kc(SbB{# zh~mG=KORmT?g_B$*&FJ97{A-%jex3qfE4#Ih&O&ona4>#0XqQP6LH_k9OJ&naRHXP z=tU{oP3;LOeTxkmNa8|>WcUCo>2E5OCHh!`4)F&fJZH313+)6j!7>VALOXt#3!n{% zAkT&-s^kGaY!H{{6*&R06-}kNEE>1zg9qt68Km)6(hj=O5yHzhB)AF~?13FZKgc0U zPKRZTkqIj}Gl7RIFrEg@*sE}c^|Qtx&A=d)U{upj5&e**l9Oa2lW zq~m0eCg~wENVyF$NL?7Dh4n%D9hu+DAUz}Zoth33ie8XGdR~h5P>W=c2Iv^PxiCoA zk=`%k@0JixpdWtmAb}qmG)U$@1}Vc-^D{`gNd{@se=|rjd{r2>vq73|op0)pbQxom z;LLxO)<4tqQ>|8NvzOinZ}y-TNZQZe4MVg5BXl+EJ1|lhqpN_U&0UO9x?9zU=`=E@ zl7=^chChILRS7ViMjc0Cm=;UnFO*sh(&KFb&N1V|ehLq&bfCb73OfmQ6eIN`EVD0y zr*(%4w%C$^2&ao3b%>gsLewgHt|7A9BC^9%={JpnO1&Vxu%T6&14q+pWMXjl&|zO7 zY<(H02U?woIui~RZ|;RbPA%8L>Dp|RJfO_Iuzw>y=6H62Vt)fAngU_co(&Tj0#GHQ z+lLOuz#ZRrr-1gtNjT)V#RS-SlYnw9_J9IHM#8X8w@MT7((UMnjtQjKi#!~=P#WhjB)ND8C;=Ueg+e(Lo^b_b zQCcU7d!uI5Rq^K59V*FJGq!YNcV7Fs#1FEDClY*+9%AoEte_tN4B$|NcRUP!Q?Ih1 zAZ?CF#+g^iTucT${$UV=e^}AcQ2@8S&30;`x3}5L>;phUl?-Xki?%{rUqM@Er9d{X zcL88*SDe303O*#-+q!O4b?Ia+MpdL(_$7fkFep#p;Cd#8Ya*CQp??|5@?5WuvPzgS z->JgL3{>Up5cfn5sGv$b=({<3-!Se$wNxIM;-8T8dKB*=KHess;gY%= z>taodGLd6{Mq>cev-)SkDm4^Zp?#rq7bD=F*29#v=UScHU}S^#@fI}#(HRiE5ERd2 z9Xp%|Df%w)F#06`n6`?x^<2BJST6Mp@Ko=nLf?jbIoQEW>dUDQ(1V0?Fv^zU^ebLo zMT+3}!EWT_;OmiT6PMG`sxA(}x-Xbq4|g44kibDSaNU^cVPITw|EX_a;t>XbWv#@3 zrr_EfKvS&HI{-7BcOT+pS`I1zC!r+;bwU9aiDiX=qK{*|#A_Vyh}glMlim4r_O4^P zmf@{uK8XECbLO#}`F9>#``vvcFGz)<^AQzEH*rIT0q-OnSNA1k;LWsM*N(w*%EY1N zOg|$Lhb~WR6qD%S0VIEQx(b)EK9e#mpW|D=RSk#DT4F8{rvWb#--itiG%FDSB|`We zR<@`Q@Q2mt=keABE~NryVOT1vbX9{Eymu?L;JsVnw2Wz9^uN3i(|kzj;Axib!cf9w zk70x_KGf+Bd9!ic7+Yk&NKom();CCWw+JP&rC^djXq~~xHAaf_{6KFevyuMgD z=N9aDBVG~*q|y=n4ui(J=$vif^0=3|1l*5%G{f4UK_D*E z`U-8&EUAGtd|B!kfgBWv^OgvzOxN%(SQ|s>OoG3X1vS6K!ovS1bcBg2N(3}~h*FU- z%7eWK;V3Xf0^2|&Dq5Gp&1zFlufRvE6}~y9nzX>;QdCHSl6iQnrlsa?AsLU6E&ExP zp738DaSZp_FAX>?WxbP*a3MH=t$2n=Q|%KNi& zUQl#fBmfTe-96DD2nR7>wL&K=H9up#hirP#79f9;+$$mjIA6)`%E*7QU{-4X9Ed6+ zTf8EZ_OVP_CR_X+b71UlIMki3)LXjipE}+v;^5yV{0IWxMyy|kJc*I?Cz+QsJ&Hcj zrW-|%VwR$}kTq)N0wdDK`>Y<<9Z#TBbe_={8qrSSRW3IAN^!JETsW^aDAq0TTDGiJ ztZyOSllOISA%SDY?GWiFe$jgIBuvueT-VpKVlcqzih+bOuwwdJ!sb~u(^_c95O+{J zfWBjcZeZyi)z>k^?$%xTp}HTw4OmO7XkMM{zp3j72iEs6_apX=L+sXho|R4u*F*!_CS>Hp0)wG4g&(Yf_Ak&agyt(<7#RR zfw&?&E`A6vNBuryN?+Bvze28r=Al!at`+?1&U5sAb-m4U2k4pUV#jS2s+kIiSEjm~ zT4LG_*bsOvyEXRiHTv9wdNhcigZH9(I`Cl6we^)s{nYrk0Sb)ndL&T43-|9sfATIny!EKxYJ3dIe3ji>X8O z8CU)$H~by$&FWL*9b@y!u0G98`+J59Gt?dAzGwT6pV+NVGuB>YZ!th!{+ODsj%Gc9 zA7w`3qpFum?Hj?D&4%s{(PQ=%TZj|Rr94`QP6uowA)c2r5qPW^!i6W!^FGuVNO)j^ zQNXIh^U$dm;!<4nDxn1PRpEnFWVjxvT4(Fw?O~gO*F1Gb>~;CwP8SBSZTH@=$L;fm zz@-OqOF)b4j>xcX=c`#FDnJyJsA7kF1j>vKT@D=^{{2-Sc{apn4bdGu44d6!ix)@6 z*&dy0Bu*p!KN;=(4j)YLIuV-vjg(~1O@BT7jy#P`dfndjZs41YvdT*d)q% ze{>33L!bGS5<+wXRLj6paWJp$jo=c@%20lcFU4g`{~gL<=Rkn7#4`X(1E7VZNbtaj6u1$I1wX%`IPSqn z$W;fdK?uhjjimuvn3ABqu_z=2F*}2^4^?q}!CGy8cVG!sMRpqu(NQOSr8$(u z8lQsM(I0qi86Ni z0{6tA&o-|G`i(%n8^$k%s)_H#vWxOpg6&r!cts?jF*d!N(|^gu9L!eR1Gdh?+R;GE z=~J9na(GG&aWFl89|B~L&4)|#=&{>;5}8v#!|C?CzB6AqhYW&%eqnk5n}{$^-`4zH zAprG%edisY-tq-IKO|j-`<={zjEO+9y|g|h>F~UkH}~b?FYKE(emr#k6w)8UlrF=i z)!dYK?#dg)ts}Yewr71j3jYqtydl zBkU2Z$B!{%^%ye^dX3+?gTZ$ts)n7Qg)h6#8!o--N(WZU{kTu!*9N){VKsYIOzhEO znabAH^Pw2GjwbyFrp1mv1Aeyx^JTS-o~`Z;EDJt45e>wWiBUu3-Na>Snz&5Y;LeMZSZ|$Tix=nt^*or5;g&`st`J;?FBS|Sifk!`5{<0B zkGprbewHMarlJRUZ|0t2(n8H~d*4qZ!1}EbLSN2_p+7bcqnY&jCbXF|D{+9xV zKW9FU9PME?-jLH&f83;9zf<(Eu9<>0&;yU36JmE&Y+#?yv%LcxY_myuPBDz}TW}A* z2z3z8=2j2a68KU`i1xSPYd~ODg%L{d#t2qL6oH2CKL#lX5kFya--qu>mT71ee1_}v z_-WYI$60ziw+b`YT&E4MU;2;N$0}2Efcvqh$=3PB#LmH%0ncIWJswq;#&i4adg_;C?L~lnV>?^XZ`6me8x|p!^J>rWlk*V~8ynlsn}#9h9=J zeH@u5BXA>sj?FPSGiE>{xG0qf#_?59|8Nh2Ndy`5l^BBUpbh|B0tyrER&9XHQfj+^ zxDQ5^@M|Iji-4t>BZv~B!Q^!ISJSavXF;R-euMh{v9&IYv?{I8_%DJEQFMyR3$W$k zdFS|CP~e>wV0IBKg0jv+6SrU;B#2w_kkde=91Aq2aOQzH0@q{+VX*{bsa#jSlqv&s zyp44tCpGT_W&Te!rJDS1oqGd(A@g&rPf}_ro}yl5)vbQb(Vy9CaXJuAaD#|yZclS- z1e>Bn?;@$RA`+a`I&;Qm3o>bwRgC)7)5IsgE;~0@3OBe&7&Mlh%i$$0NZ+j-2 zN6F3kFVsajq?>@YDb*Nb0>tapJ=>&i z6EE;R{JgkJybX4$e$e?A{1_@X6J~fcA~g^9D(ju)&~GWkZq2m71~zDRVJeJdj%^rK zpu+HTz<2doo&f($jaiN{+i^}K3#QKJq1x%M&w34EdQb>~fWi2IP^Lrc<(uXzdHB*? zf)MF`SV;=@7`F)XZ~jjNg>q4nN8TasaM!~alSkY{0B>a1E&xCh?cImuGmwUUObi9- zsjNP?W=LEibV@a|F1#;U#A2yqbrp6 zh@#&r0g;#C4etKH-3fqV04N`@`EK-5&io_icc*N#z7D2yIEca)E-(oTO)uGW|r};`l@>|Tx^kb z0Fix@VhCJl0qVo>SBMk>E1CHU9~TIJw}UXr!+3-`McJzfmaaW`BwTYvATFY63%J*7 ze7(5^KYzg6Xb{1}A&_JO2n_QQ9s{rK&M}B(UpJ(y-dsAC5j)D-HWjQ?*i>q8UzM<6?a#HaOg#ucZ$VFr z#EX(B>8~8T3NcH+!s)(T%BVj zV(QEyz*L>U@yrUlUi6n@Lxpm&Mz+k_?Ii9SKrf^dD!^>@Yb822u*(97P=Bme?%m3H zl4|#ZL?H7YMCWKTsFV*-M?fUsUGE0g00Mb59kYBSl6fA(nMARZ`a0~8H&esLiNuK* zEwFuN7!*%{TR7BU;-OoDV1cYf4pdMI9t=}pcL|HCQY%9fBGW2Js%lyg-BSafh{#B! z8Emh$jXqYEG?1?LkG{8`#Cc(v3W41V9H+6 z=4GT{s!!Ro6g-UqgIx#fPrn6;Kb^AMRD7diXg&X>)H_0wuvEV%Gxigu4|R^fd>x<2 ze0@K{biv&Ar=&4mXDBtiHi|~;Ay`&o1-w}DZVW6!qTGkJs_c)goN)x@a`kEf2pjF!|BQM#^fuH<> znVa?{XKow_i_F}-IuCJ5$|@lG=se`o1Z8=QIv)iE%%6j>bePGJK|~eTyR-t`go$dw zBqa4^<=Vgt=^}Fx)@u+!8N*U9260%daW2UO@>r~tG9r<0BTbSl$TH5s4xgwJ@E*uX zf{=Jb?83}j1p$J*_7RzPp$W5_B7}V!^9RVoAqWSw;;?2QT`p2FJ2#UHkFxlF;zyAB zlhqYMIAHiZP^R}$(uX;RfNGqX$Mgo@X}Toem{^buumh~`r{obNRaOY9B?Q&pN>NM}W1# z^IJ_5-g`6J%ALy-pj!m$1xu$*jHZ9X`Vk0^Sd3M7bO0kY#!!qz#{$a_Fe1;`NR?*I z;N`?U+@s(@3J0xe2*6Jnk`{Fuaw=OE++qv_ZJ+jr=6!AC4n$Z-?t#}7idq6r2q|LM zg4o4Roea!RpfaS3IV2tq;1lD+|JV>BI}~D6+FU?RK9hXl5fgRTy@ejID{W;&Pm44o z>Wj5d_r-%zcSni{GSr>4Lc7!+1fU-d{FcEn!it{xn+LGCAfHME)NN0U&`~IrYOwH% zd2($_Z-nxZu;=s)?GGjs4A4%4QGg)tQJ;&vCw>76h=9090&#=q>6*PB#C`c-#N9uD zxQAJT=F1I7e&&2l`P})6F<;{_U&vMwZvN$vwoF*@i;%WYOH!o$-FP-9>#9`0W(DFEsOszy$Qq`r)Rs_ll$L=IZpAb>v)S{Z?@CR$u!6^SLL)GB+4fuU7M=6iL236ZY)nkFG?GKtx*Fe=*lbNGu z0-ydkMb%Ss$heJ67lNz7)dN>A&v5nO=9a;@dJ)_>8n_ycWB0M!1_>!}=F*n##yk$V z8Znmea?&P`wtveAOHFZgvpe>)aP_k=?_1VPF^zU{_qw>cRh^pR>hl`7deQ$cT)mu5 zN$vb_Q2kV0Dx`lE_1*|0M*=_X44%IFnebHplJGQP0EPs4dtq1VsHV@ zOJ%^4NW%lL^i6X}O7x-dG>EX}vP9YE2NV630HuJ zgLOte5xOolnLVeU1CS>1C|15F~MuEu7so zoO@N7kDyiqJY8)IJS~BC4z&L*GONfNApZGR*|~)20(Jp!H?e+?>0PK5%sXJO9UUUC z%NuN7N6fr=Lt4Me=xa<0Q2%0gDRMBv8$Toe|3|$-3^KIyKxz+}CeD|AApg%Od^Nz& zOd?I{eWSNZ-PkkQ|JBchr}BSE`zN$JZ7`X&!Q~yM5wD}GTXmW4LKpYyo^rR_h4~XL z=Gcr{XwZy43lR+3-qd=>DaPhy(yu@lX&`PO+6!*51NzL3MV~nm+SXK`xuYc3*AlA& zF5+$aH@zhQxtN3czPir&3LacA$tn$lDsE?|00RSrWGBFuhtGzCte2Q1ci$Y;TFBM} z0$KNAF#|pa~66b!c^{-N~A}DlrDFPh0i)|p9-=Qq5O);E(~@i(nsWA1YgEBGmhfLNc&o4If;^UbWE zVYq8zCT|yU7&8gij{*pvOUI-$={9B(`5!TpU@-0(tdHCYGr4QBCqj?) zoy{;Oa)01d*1P-yw>38eQxFbXey-zUO~6Acir_|O;+~vj*#P>F%Q%9U9o)-w6heMP z&(Z#T)WH&scZ<5IUblqZST=pEt6vm5k|GkH_}BT^Sh(9729T@rZM%=?g>_eJNpRCJEP zVs1SbI>(lVZ_y)=-SnfJJc&qNt*?NvsMS*A?&kJ*8*81P12DK&i(|}IfP#(9Ry|8{ zqOtyp3)ds4BA;Uy`Q*%Fu{j5UyKr1{55>|CuM|r2J1vyvIyg)K)l|(W1bINngwoN4 zQm_xKO1t|vWqvQY;>?wl-(lXy&Dxzqv)wx>cbM4~`ob%~0>$YY$!InI2wtf!Ou-uI zMD(*Nr93|-RF5He*42wALGXl6nWz^LY43}x*&g`j5cfm9ct1iHiC<=(3*#y(b?ag3 zWl!&n?}P|HGYoV1gU?Yc2KbIi91K<~rqU;{HZlj4N{~L0bE#NDQoA0wjX?v4FQ%9r zToY|L2sF7>-QqWgHOQrHBA3pGJnD9vuHAaOkTl8dDRt+&a!@pm=qn8odR6XohX5v0 zN9^I-0(2MI3kw$VN4I-zmae=Xwf{RppijfR2CwXj9-et+Z;WFETq3c!5Vso0TFv6k zEWKHy`X~wF=mIZ-u#Q;1{Irdwx3LIXdXa)ton?mw?{G_Ft5fk?(~LO#@eI%;3~Hjc zSM!iknP*yhrnMC!$m)NA=UDKLkw-6Duu%Lj^_65H%j@n)98>S^_hec|K(MKa(;~8# z@L7bYKBP!OAR_X*ya!^I{Yj!#I6$SFEf>EH?!9qQ_Jb=(MXB`3K#jpy<;t00SJwOu zzS_9=cvzCMzrk12M}Nn<2PUV+pIio0FtACLC2(kO{H^agoVBfEkok4+-@5grO}GvY z{7SngBEmZRTenk-%QAx%4^^CWuEqa^}oMoDRSlw{`)e|S%!?-+27zdkuiF>*0_?rW#jE+FV`Px zUvpiKzRc5}g%`)*zb|vo&E0G6Shv3PV^!~(>vFVio%PP;_pE;o8GM`E)L4X#7yM`c z;2K}9;rE9&?it*obQ2m5OB9f-SV7M(4jy8ZmhV@8ip zpo)}98)y&-iWb9;@u}pNv5=d>8XLfhCtn`}8zt|9;4AngLYW17g8bnF2(T;I2-ylp z)|0IUEklM>Ia4T-mC8$H#GJi zH7Yg=(u%xBqG*(Nd@61PfA-*nDcSyBC2ON@`K*I{qp8q|Y*+X)0KEHsWNI_f*v$jP zpCQMAM%rUUskk~q%v>)bn%%F#5eW#5NCXTGIaDcd=(EMo-`PHL@r5Sn zOIo7VdKt)=;x;`R6Bp@XG4P_^s1*tsa%PIdi{u`aY=PD3qi5CILohx*6$WqAT?#I~ z^8`hXF`alu(M&Y+k#wX*ZQHby$FtC4QAfovZLt(UqTis-Q8v*{frOyI#&99i{ml0f zA$0EO)Kj@zZ=&#tto_s{F0z8#fB6U4(z}pO1P=IYeyK0k_dP`Z?))Ns}wsfSA`{SCH-zxTa_d;nFrLCn?_B;i9kMiFx( zLMS$pdi3#Lu-u`r3jc^pK|N2PE1}F;fls+fbBpQIx-;5c^?h&@yvLRi^7KrzY~XY@BkhTeyil;dr_LL;*-h<)#Q$OBz)J=I zo#=i^YJ#tN;A2o?sE2U_=aL5wu@o@Yfklg}a9s#evJ7n)y_xzV|B;{`#5evb2EpwCrFf9w2_!ODf^SVK^R5#1B`rWXeCDjhr042Q$s%M} z%1VS$>Fn!3PF|$6!)GlZ9NG@Jsf@82#dt&vZ)_)HrVa%&1=m4Dd8vaTp2o51FO74` zsbeVPH>|-GCdUP2YJ{paYvYH~?VXY45haqL?O1e5@npL>wyhf zHSr{QxBB%gf(~$L^pO~yBf(J~&WFP@UiNZ+ByL6$_xi}C94GP@WPj=B?ZAx*qL#nL z_%`-+{uI0>^gHPg<)4B3atC z!!L53akK&QT-WI5MQ3%9?k<|Mi^0Xkm`md^K-plu1kz<$_(-HQhGe4VaC+g zkXdWntgS89)7EuleNb-;o-XUQ1!RG?#x&Y$%i5Cl)eC57M_;zH&P0;JJ~be?OqRDm zuo3VL%0v>FVO>_L2lZaXH3J17*Fpt$^ zo4x$>YDeP@0lVncrW#H-C`YSjqFX>;TQIlJF)KWLsAj!B(+Ex1!e1DUAC~pFONXM2iMZw%#eWW5JRShxnWd7j+AK<^pq zLN##5uSq+2O6rciiQY7`^ewNCByK$yYH*nYtgfTkJrT6%V0}JW|tVsz0++MydDegZTaJPJ(SRkt- zZMTMHwP<_mBILAhZLzBrguf3gt~s)}reZ|_g#)4%-I@g)^&DKX7ES6mhng+oe*I5! zE@h+ERo$YVP8*|@td%18hXbQ7`IVHpxXwsUd< zC3xAB(km;MY3igieSX&KEbAS(z({+6M#%o?K30~S#dQ^0emvak(CVX_+8jJoR=t5K zHS7qK7bg7Cg&FnT-JW0E%^Xa=1(FbrPQ(b5xkeJ zP(Qh9aO7-nFFghrN#)W@hSCaR`F$1c7i~W{r-^Tb^Dea!fS@X6E(=b2`}0+?Sf*F zBD=$2Av77cIsTpPk*T(jaZZlsSMdR@;O5u5c(=(V+uz9V);9B=~%!5EMy;@EduL#{$;Xzm^ACO`v$N3ox@ctN) zlK^qN#E7(2{PMQ#oE7!X{j@k#9d;~%2hZ7B&%PD!^w|b+RDWc9Y5(i_1EKDX16g)E z_J1?B|8>bz)CF8YkVecfBmN`~s6B8TZ=(^z7mQjsWx?o$ABY3I1H}R1fp>`oW}&;F zec^DLWf;eVBaXGd3P)_~Y{p)zX`--Qhne9YYz~q${iDf+J4*i4U7-mIWFU?$ohlF* zX0;gk^E_R9(^w|2%zW=yt`J(LXvPzaSwh}?`~Tk1f?B#9^xANnez&$_$Tn)ZJ=mF zk|AJ}mx)`07QQkOV~ERJuqbp`_Wc8ayd#KnK!rWYz|HCB1M?r@T_qth6N`iEWZtdM zRJpCp0&TTW6hLOjk>+R!)NbT@q!|Acm`(~a804F;pAbGly<2e*5}c(al%z2qPIM|V6enw%%8HNc|yTjQ;i1Uvnb4`>JUvhDeGSi-jFA>ztGlVQ8~ zW)pP{F4oYNqGNRG{m`dkdnyU8+gC@~eKuXOHRd1a4mm7QVXTf%ue{)vMkGpv+eI*+G$!3afIz}AOaNy7ddSQW1Jo0;AtP}^N z4=gNbUATALGO5Nbf#j5%y!g{(vJgq}<1g=~E`l6Um`mMs$+OiBYnV+p9A+**Ok8mo zF8PO7n8#M=M-L?3eo$gqSurpvLtERDK>?A3l^73(4G)D$k-65x1%$LE!wc;QJA~nL zsc$}pJ-1Q&@4MzboOsx6seVeZeNQ?m!1=H{tlIXD>3 zMWk7)w`9{^E>!@OuOQH4XL(A!OD2Xzu5%JK7GFio9EBBp4D1G?K1i`F7BT>Zf{7r! zCz76RNrpg$qU&IFhQ+X^wR#L$@xz(iA!u_L8=6&Hxz+37^N`8$lxXT{q~k}W*yfxS zdpa+{HsgU<1@NQ^AsQeE6%WG>mXxPUb_w=aBQc|~2W`FC*b+oEIA4J!z)5SDuZ-h> zJ+;dhDm2U2CIqw92q7+Q?AH*_h6jdA#!QPp)x_J83&t$meZlyJ?}!7;fu?_X`&2CGSa_>l|1cshg!-*MQ$x;$ zsq%O9CsSLq&Wz*TeA$v{=5@3zc(`7?f-O;*BHhIt;NKwp8L~BOBgMci{l#S*`|tXR zKWXzU$OqE5ZNI)o23}St=^Oq7`75*M5%Sl!dsZZ@4U)eJ%oQ*&=D%AMUXFjqSNDnV zA-mMQ9q+h-%5UFW>wZsBQ+=1NmsNleh)n{LiC4PQwU_`=(nGrSE>(}5>|fu=z90v1 zV1@gmlIu}jm{i}JO8RwW=aAn3AIHPKxz0D&`rcK(c+j(}ozH6LHsUskfDN;hvf34` zLxXj%vi6B5xN@U(S6MMvo24Ym_onQBFY>Id-%Z(n81PT6pT zOkFJyNRTnr*n*0$x+OGYN8ci6jIS{2~WkDk!&!(1JM* zbpf#_6+E#J&@jM*AII5YNh0ObGJMX~6xbF=md8}>Uc-`F+uE=Kw`^S9gR~ELF;w^P_ys}*@7>XpYjM*DG zxIA9r#@iK+bmw@5qso=(0P37Dy&kCq!6-P4DQ<##dvXvkI=%|cze4j36@44~M+c}n zdx(;MC)w2f6z{r^1`scXCu?(t_D|R2S8I2d!Nu_Sn5JbaPVKE^qddqii1pU#n$rbY z#e(=CsaR`xJO+lfV)h0Mxg1BG?~nH?OJimTD}0@^q8LvabD-7#{1F|_OTZqzR|D^z zK%5YW#ro4g{LP~o{B?;$^PmS|qV*sQAx$X`_D;jyf***bjLR_~rSB2MMUCjou%6aC zE2cPWL0RR$^FXx3E*jDf=a96+=Zx60`l01GQ z`dqdMv-|<>fyD##fj@BG;RNRH$lVyB4dFB6y?zJ*hmYH)q0zcGf8^NpVu+K`nHR5<_*V8SXcf}sB zidtCUUlrbKV)9y%`;G9{g6S09uZqNLIKBUbt<#`EiDs&56~KxA2>Dy#-N|ys3a+E8 zMebJN-GVwv$zgG;NZcgcA%nesMXUmil1IxQ(#vso*Qu*eWcGl)7stMu3@s9lebWth z4E=1y^;_2cEBcb$+o)GX^=slM@x3*@D)eh2@0&BdhbbrXmlsvBZ1*nw&w%g@_X@bB&EWKS@r#Y0R~ zGQ2j!C*e4U%NM0=u`6p0Qt~YZ{3i8KPjvan%vm_nY`@Gsa1Kk*l2*22Nfq0o6P1q_ z*hG^XDle2hu%E<~Xmav+5VT@=Wk;iP1}QW~i3_cz6YWP9b%Y|Z*{96n3GMijiE-ki_@G@AS?;VN;(kY~T5k$tgnic2eGd&+ajP^iT_R7Q{6z^t zA|fc#jMvK0onaMO>+Kve;8HkzG0(d^ z^WE0@L;#nVM%5!XQ*dSPqRjreq;*>3<6d%?hCt+Q_;^)HgshZ1NBFUYD>v*NUD=0xo1Jy=cl z;qNn1=Vq#{N93I-`zjWii@YKoM!O4Wp-OB0i^azZmn)2%Y}h-Db8pF7C=fRnXbLIp z8xQQ2xSH$@a%V+AgLKrd1(gD)h{@g*J(&ct{mFHSss4Bmr4HLFf^5uvZPx9qFW*^Q zv9mi%KR;hxv7@+rNAJb?`aeJPo|fDFFq%X>xj_^?RL_YxEUXBe&|q+4l9xc5WucN4esKW;4_-(ZXL zr5GJjHVOgL3<(tU1gWG99~bIjAs!JP_UWb4yNDX)o{#eG{Z_a`bB%*7hl`Y!n?jb_ zdZAqF*xUr$8h2>J1)j>2@6u9{o=cGlK6f%7w#I?hsdlbmghf1RrwbLqI5FNE6U}z_ z7#wN)+mW_|t`@P)Hy;(jp1C@H#wE)a+d&twt>U~_3aaW-(*|vrK%s00YXYTBeW}vN zK;{_Wjh@TG^gP34%ph|Y|WR-S(rN3SM zO7m8oDO$n#;KD0VOMvwz@@w(`7P?biT%TT~E;-y3IXQ&5p7C;~wQ@g6L4^`rRHq4j zFmjc>Rk}_A#b*)tN}RV+OrlzeP04TOEWfCL|I}LjvBd$bgb%X+%|!cJc2aM<&h9n3 zf$((`SI2op*fNPg=Y}ZvM}bbG=U}bWV_>w4J>?FKlaj<9E253kGRW4+vXyLAf(+y2 zHq=aQmiJ1UHI{P^5ND#PVjj&VCpFKx6W2$hh$9o0$*iZcGAC?YBClaU95}ecN$otY+=xMww5`LW^qN zwuR{^Qq3s|U^dS&_BX80b@$=tF&~L&LLjR+ZbtucX~EgjfND7|K8Cf(uPc2N}Ia^_7i4dxvYB*-3P296#mZ?Y+A;RUOd{;S0@lZ3p4T-W%e)gDx@-=o)`3BUPF zzAsPRAc8YPb4k(MmBFR|0NMsa*H>d@DHBdmRm@ z(Mg@*J2$HqiZxZqB5aLiS)DNWq6>M`!23p1!?xB;V&Y9U)2pPx7g?57BhC04SvA3w zII_xYHAFV`nr*-&PBp1&Sx%c4_P3gD&Nkf zPSu_CMV|HZx9AUXq$6ax!({&*ZcUE69IEXMe3{^s#Fm#Fvu{F?*0&cMDO_8+&9*BSgZ$+Q_x zu4@}q%S9Ve+nQyA8~kq>=AKD0zSOzWc?Zu9f*hN$9tyOv$<81KIg0R zba(;*<591=FdY&@2pC~SArR4a# zOi>&4TqJj=29}1Vm_A*?yAtm3sy zULw7>Q^`-xoT^vG^nX*;G=C~)1VOdrR5@)IK702FJ{6~mX?iEUb8adCukdb>o~oxM z?h)#4QTaX{A641b^DBF7n==YZ8$2AamC^2SKMzqO62o<;@nC3MXY|*WmCqAP#X6(j zG-@>Om&hB8I^WgPg9&`vN8DiK(?)HH|AD5BrkSY(v1V7*S+6}|<$AH%K&58ci1|EB z?XQ-pAz~8f-;GB6-RLdJ#z;rL7|+$@*Cwn1c~|tlwO6*uLRJY>Q{rEZgD7rdG|n3z zjSFg$UM*>LkR&4KR7nkfMqTJp!FqWy~g|*X-bD~Y|WY}#9j?P4b`%HZF8(Ywak}Fn) zY$XwlNkC^n6vv*e!Z4zZy zCpTv6K31itlZ&)lH7LZtjAztvxkPr0X_a!PWkN;FP-j~PB{4>d8*tK!FdhKX9b8c; zk;&s|l=aHFj_F(z3+1q6sv6NAn1bVO-)jG1o#ktcDMUF{{Bw<=w zaB9Bf`a|luy2BQHSIzcug0?7CxoNn#nDUXzdN~XDtfX<=99fO*0V(e{@X#VdCRv(+`1D*^0?!LIqxDFJ%5?>Kl7tc{53EI{Kk*&q)tH) zJraWb+!kbCAM9$UNEctdn;{*IxLn?^@gPYuYM*d=Fe93f7zP0n%-y!bH;7f@K06IJ ziR4qb2#%-Nt+NUXsKzP+6ce=ZC3H&g#3UIL#Y%qXTOa|Fg>VPCTgA0-E#vw(aRIJX zvgd1&`bN~oTN!VK^P(_iI-P+eZnOodv4qTY zAnaT^W?+WM%GAi8iOsP}=3)b~?Rl|pyXiQ*-Fzbyxk2BEu6Ub|x7*`n%DoktH>0-A zQ4#$Wh;TFQ03(LU(08k=fRn4BDa#6% znmVY3yp1#?0Y*M8tQNA3Q*Jz4_-En81SE5baM#e%5^_aVt!@(jttbK(Ua1-mg-(P z66f=1NN)HlhqrwmIgzL;h;Zgz22HmkmVAa4KY zJ468zgTqi7&LMy{0E2Rio*bnd4JHYu2n_hJVU+AQYFq_u8XaDL=m2rrk$ zYJ>CaTTvLRFOu>asfo`WFZFR!ZjkyuDc4z!1o@?a{7SBt`b;T56#4@)_ND$KVu|>e zeYUS9ENICmMfz=4B=dnZma>){76}*>iZyeM@E>GpFqAYiSs&#sz?#e9@G)y;@-mru zT;v`F2#))jSX6Z`%vvWjuxjn!C33$LsncY5s@$T@w1Q9J7)V}{ob_Fk`imI@=+_`3 zLx$RM!ml=$itr+Y=9rS7O#-brf%h78eyNMpF)vvSHnQS#xFxozo`MRPb2iH57%adX zhU&|)EV3L`qfdg`$JO1AbCtKc!>ryUqO1RgtHrUX7;RAnZ2xb68K_J!raU znZ0q}K=e&1)0{`RI=L52Y9RTui}@0#m)K5908~~!F26|}Vkc)gf4G>D_45-B=QSFc z!Nkjvw`ZNP+1K#vqn@9v+hsem+{f<9`gp4F*FHmeuKsBn3R2FPrnQKI@qEkfJc>tF z=FQ>6kfNXxzHIu*$WEtxBS27u@K0<-#>xVIQjAsX#63Qwf>unc(<_2;)bRpN`SN<< z+{!&sy@+TRD7Ehr)-Q;EI*#fz-IaPfp?kIQ@|#1g9cm7h)O zwLzAx4Sl*quJl=MLS6uUFfS_iRtDbUmueph0kPd3M@mdCY`Loy=I7z~x zP$#G2h)V~2XP1^Tz?nx_T4u|3%$Ypk={nYujG`1SD}4@^PtI_^@tFNeGG;My=N-+s zI8i%adO11OZ?-FXB3(Dy&BtC|818j*T?5{5wq|rJiL!eTC8XVE=yaF+*Qfha>Pg+~yOVHdp)f z)uq0=#LwN}XNpla8lAR!d}T&n6T|OL5&98Nv5rK5H|y2mNsqMgTs?>eeLM^)VMwxhZl;*P40I|`@_9hGAE*p9MY)kwME zL_X)+bZwYJ8F6uEp;lJzbyb|TzFFu8h1|75cY36JSBfni=W04@tJTa(Rez21H{y3%#n$KRiZOO1SK?Gq!1dqn+g^$zM7>WLl}jfiBUE z#J-d$wsT@HwMUw&f`b!(FFWx^QJ9E5z=_m8Rt&h9W(iTkMjFM5lD|y+qQTi2=$SOz zBqjr7+m<{f`Wdar(c@$Ihq5LqS;1Chj6!6{zFcpX-|pp5;R=T#Jfw(zDhmwU^&BhP z8W1=Q1F~%%DZI#+eu=m}PhriV22yW`RIL%IF4k?=Ya=l3`dh^B;T866+TGOF&UjE* z-SL>%=G!0Zhg~VX8aZoQE3b37K>^J$eC!l$S`eQflRv&nk*nM!ocmdh{q2Dty58LQ zI<9{}e5ED!Q_${j-@0AV#sfG#uQdS6YdLXUeBugtvuRm;$~awRR4%@K6#CEYiI0v? z{7bC(6RbCh)FJ6n{Kxeu_cS6 z@MJuXZFGxv6Mge~3#2>n&@g0zg91wKCbXU`b2fll87_xgo1sB3vcc1o?zevDUMuGC z`z5)>C4P_DITNrfb|9>Ee$kVKOu`0eZE`Y8fNb{N`kcYyJXYu##QS)cLmC3j0-R6W zdC5MDIoa|@Mf~y;yXCBX2bT`IPO!o9Ig$s)0S$NtS}2OgHJZt#y`#&Us7Clm@Q{UbM)=nOAE|(?UvIlb1q=mV$J9}a$d9x zPqPm-nthg~jx$rY#809s>d&Z=@eQ0QdP8PX?i%4;Exc<)@oJH}MwqL`FRl^Et5Idv zi`;R-TP4WEDxM_#&?QCj6tS-^oh}G&_iI4Feqs%1CNNXG?{Tp*&rRphBd+7O^Uk&U4Z93^TJ#K?)#uVET^51kDY!R+XK^X<|t1NofYBmHm~~e~nntzo4A% z_P^QIzRH_LyTu)@ro>fEb@g#-zS+@yB}z}oXmo0oNdEW7K3kp4_7YSj=y+MQ=Oz<* zRCaCBvN;YJHK@8owZ$Q);79O6{R6dKI`9erm28bcH@~mik4Es%wk3@y-CB3PC_*m- zfQuQ~X68`kU~=ttCIK3t`WWF4>)*4D$w8Oj?sj&dN}7KQ^Q6_>f0$@g8FRYKeJkX@ zM9I~ki&?xy3UN$kLZV^tzwA zQIIHnm1nN>%u@sV?h@YE?5Uz)fufaF<6CHxL0P~fA0vaS?JUm0hdG|wEAP4%FnFbv zc@jZghjF$T8v0cNJ-Z%VM7lNRw>J5d;&|{}P&^oLl*z>JvwaQ~Pp$8cDpIyTtw@}E zjErT#HDa;to}mwk7HIk(5-Q%N9~6m)MEIbXHovr^OD}yYoC|EA_NdH{$)uwYX(}s| zv6mTy1HNX~n&t8^?-8QW{%+y!<}gB1hnhWE9}|gb0TB)?;E&wW-(2?-*Zd9d5X-3z z0S4K8)>FWv(z(ztxklu-QN3yS&*cy^gWL2iW6Qcje6RodqW2qV{8 z5+NHf#?y;+(!vVP@}~h@NKcVZL2oji#2CNCYGRmCG$E_3Ra=+EQtPOA`+7x$Jt__v zLX#B#yGg1Z6u%NbH7gGJsalZ&BEQvXqUBVP=hM80gn3X<+MQ zI@glTL#H&4PT7%x3eszV)3LyLj9~&QFG5qqZIKI-M76|%$`Zb?5rGOFNwu@=N(Ljy zpHhvV zv61lDd` zvtTggH9{O07FLDsUscv*w@8Q~)muR7GMQT4i+Ei?NGn^FQ-jiZGwtpG1Cc+IKw91* zc1CFzJn7;rfv1=ow6)?l$hYv~B3L%bTL!!)w~D9m>n@wz=kMz9&AcaG`fnP6ne^|{hm9e^LU~rEYqvr+s4~$#G591$3zhpcnU@5E8!m_ z)g__7Iy8@n;-6LaB_$7xqUdKe@q3%38{~l05qBi_?1U&f!&c<_IuWjnYKA07Kp}mm z4o}jpfWnN0-bJ-oG8jT6+XP69jI54)21-dL>XNl|cRpK{O=d-u&z>c`*TdB2P`n9a zH3RU1u)q|-m4apZk0(BrqoSA_Qe2)Nu#~v`vjF6?v=@Zd;UG44>6A4 zB>oxrd-`usk+A=OH*vB^|5?v`;i0-+>#7@FN_`)rqW5J~<{sezuZ@+LBzK*g=1=#3 zqr)puy@M-N)m2JfsS4Mr^0mspQPq1XTfHi*NbOa zq9?P$Upajt(-5T1w4kX3#EpZ(8bN zlt#1jTq>8Nux})8iBK!Tbt#r_DXvbLjVgF06ffIcM6)(!BPz^_+mp$4;2O}8M-PgA zQe~JQ_420`@3%q!v~CafD(cn}ytcqPlc=NkVsm_JbDym!xgUtdEzYvfmGf9SC&!>P z!VCdzVw!@JCLh8jfjgxRoeVR``t^c#cSItfXXH%s@UvA$&XJ{LQlO_*R_SMBJ9Jxl zy0ZInx=o#_^hnezwOUrPRac6Q{b;2}ExxYRS(XE*CZ>dwLn@3$eSU9-KcBfq^q{wE zO2BvZlg|)S%;XgDk;m+jVoKxW1@~sXj@HkCXcIWS*77{tK@SgBwC|J=zgr^=m@lu(n{0jV7`F+7&@Q zudzdL_Ymum(I#z3(mE+LTLrIX%^TVDUS=msJtN0ah5e*GYYyB`Lpom^RzRuBk2NFH zmnXuj65>j7!ZLU-Lw^~VS()f4+#&~CZ4K@2INwS=l_WmdWnC~i{g&mnk(IvsSu+$y4a%Ast_U>%QlgleXkCy&9=k`|f9bY*>5ElxEyiii_^ z$Ym^A|JCL`?VajN^tO&xJ;~9gNA|ftRy}*s*wi15CML{GGdWMFx|uz=DWY>k+$jx{ zAzQe#n0qgwKT3!Xs86PkjlxUv{e5s@-oGvF-;qw;o=)7AuGZmAk-9k|ym?Dx)!OysS!f0tJoTT*Jd&4xaMcM(xyn{o8ff`@T={U`T;Q3LBK+rd!J~Qocs|+{ z_x>zwv8VE8Q$F=nUOqz^o8({@P%BvG07|8gO9rcw;)JAYyWpzGBVGsK!OfgNG%Ql- zp)A*x;rnpBihm>ZHiVvJhZ$lQ_?&*3rRXZNGK|g?(F{iO_j`n36hb~h8AC;l4LD$^ z`=ElB)HWbSi0GoEjR(PjP{!`os+qpA^$5-p8DJTihBR$xMa3EcwyffO!X#+^uMV2+ z_g0VAkRuFq%|#*+(kD}(e`(?`#edi?TO*^tO52Oy%_68es^KHD1_5d4LV4wAI^%jghP_pWr?8YZ z@fY%!;16GXa$}{x>eIj;>8{n{tAY76?J^|Yf6b?4U%I!J`P4?IeK()zG&_;T&{5s| z!T9G3ufxyxrFxI*pHCC$KnU8(xj&@!Luv5!%?{y>c>zpb(m)?Qh)OKTH zk=Y*GNV)$^nlAxf(}~LLZk|q=<5Olk^8<5ziqdA{+Emb4e|##+c$ZhFuBoOyKVZ^t=h5y}*E2U;uBw#$(#!z~zs0q%^HMy@ddSzDp8>UHpMmD^*+~0LUKzm=1HNUGecUD=- zC8B=(BmCti9?a=Sa_Dn8&;WMn*v{13$&j{X%!}#wvf+nW@j*6j)eo~wh4ZVuE2@(^ zeP-IMPD{4OD1A*%Tn*z^a6#5zE#$*x^GI1fP~Cs=GeYl%bd)l`&82S6iJLf%4!R+i zdGI^)sb8S@AG^h5* z4LbV>7BR*5!(m_XRL=dU)mploWjz@$Z7U8z<(n>IGLvh^12Q__7VN(pV{gq#P3pv^7@UW% zCOof^*7#?O>BS+*08PluTIF4isH?lNHM+M|Y-o-A##RsuTuAc=S&((BM5x&$F^U;D zR7Mg75r&j5yq?SFA3}pT>i}5?a%(sC)gs_}t((x-$RgWo9WjCjTQo$S}(t{T8Y*dpvS@!qlioSt0YA!ejn!YR0?(V_Fbznqeotfw?j&appg zIjAq&o1NlMwq{7wLZR=rT$o~9Ky8=8)lp~euGJfB#RIiSk%wwgkFzhOO_1u zJ*$G@|HA}KAC${xsV?Sq6!=tJ6u0wAaYw&-;vS8=*I8D>0$s;nrZ4R6+(4xWSy&_S z1}t;d0?k&pHKp!o!sd{Pdz(`0o9wVPw>O0wo2b4egJasoH>&V2WsYyRK?8Cit9%3G z&kpLOAU_W9z$&37!)A*zvrr!GbPZEjt4;-@RXbHA)I2Zta#JDkpi&RtZF zv(k&YR*cc_(Wh@|lNnkt_7kSv3I!uc+_O$>ivun=ox{NOq#)6Clh_=LZ3{fHp82Ak zw9XZ>(Rr7=Kx(8~FFeSXLM5S@93FdAb^lSV&aui5K_l6th?l{ZWydm@9edQ{u>{~` zwI@ikO76xiMHwa>OKl~Y|B+c_i$XM@`BOcQ0duERzmuuEn2tl;_=Ha)c(x(;_hA$a zoSB>nRRy1vV?n$uOm>3qZYStUQ5(1<2FxKq#Bu!znwF$A>Br7`@ zE(AVKBV^;P&4lHWi+ht?F4?!yGW;ZACWL(_1Wb`)G)HObK>9R0JO3<`Z`olidiaSw9%=h_aPBxB}xd|J#Tg9lG^VtEk^fGs+{ zqa}Z-xU%14PUX5iO;z;!S#?m|`UZ0ZAo!T1uX*a0z z{W861;nCoe&lPAyz&|~>(AreJ8W)a_{-E?D%6}NIzurg;z>q%tq_RBt#;8|v^7)+k zQ%*fVBp6`hvnt_hD*ntj6Vvx9{|zvHNX?Yh%dLODjcm58oTQ`q%-G1%&1HDVtlUB; zikZ&%`Cma*gJ7OIX7;0A0VE5QGDtRtIsRpL7q+_WYh|CyzUsDW2nI~+*4biiALkVCy(KrfL1k|c+D&|*<+mu< zpu*hT>6q5$3md6$y?=^SC+YZlgLeNU^z*_`xs!8!iEE{~PD;W(lmgM2`R?DKqDj01 z$-AHI^b7Cl%!gWhpo7i2z`AGts?%?1YNmn^H18pt&F9)Z0S;?^;Rf}8u}8Zc{gw_< zc*8f*P{Vh1_<=2h9wA6z6L~+ro8SY0YWAP&x?M!VeX*YQ|A){_oc+l@*iG8B2}_S7 zw?XXxO+w>i8M?DHuLO;qf(sx;;EE)PNGFD3a8Aq=)3Y)eG}<8DfGXXIFUQRl0V!s( z`2Dlh_#Q+4()?{*DCYO+@4E*Edg#`HH#ukN#I6RqrnS3nMlf?Y4L`QOGpgx~YC5Cr z+yQ?DjqWDTkTg5fWZ)nbhGr&FXG7z06LLJ}Tp(_zk1dvj#l zh%&F1B*=F*Azk%Uz0A|zKXl?Xt+R>Hj*GPaq^_#N<|8~G{45@AnGevmSwhA; zOMT?HL`TYXneOpj{xA);))Px-Ml-gasb>uDRei&p&4GUtnTGlXU*6^ywEwsdFT_Z4 zP{2(;mX_}&S<|)qep2y{?F&hhu6|SafY{D;CENl158$oE3yNutL(TeSxo>hn(l$Nh zm@xV#u!dA#)>08cmEDs=eG*>px|(3V_q4B`@dF_Gq-NQb(SoKe=Lw*=Ue#Uk-k@ga0yLdtz znrR5Ad1|a{N!vlIZQb$EZe>~5aWvS#j&;um&3r#HUm?e}!0=0BcEsJ}6aD%2)ym?G z9~OE@<;E=GuILNmZPMOMJ3j*1%rt5oDw#@jzo@2B3eM+wrW0ikGkS{tG%fy~_9hdl zy0XG+j7cHrC zyM1=FIU3hxV1v|=szC8a4`CRl{4|ktu5TN1rTC1vMvt>}87qvp>$I-0`=8RetB@-Z zIikjGQBt&WVDQkB`F)EPwgz*lkJT}hAMOVv>1ifAzxQEykyf) z&SL#s#t8D%G^Eg%l@)QxiOT8)&eBmVWTsdcmAgFvHy6b5P=%0wU&;LSjw9y{r&iS}+$C%-QzXHb_&d02y9VFkj|5`f_{p zg>W3O*2BTdct4r(exJ~X$UW_dPs^_u@1wA^tuU)WG3c|_5nf3va4pV>Xc&PF_>gdE zTNrtQTAUT-{$_FTO;$D7KzdF8n>%Qq9u!&GYx?SGr)_B$FJ9bDYk_tt&{pVWA5jGc z)^f_bg!fX}(>zv`PZZ5NMFxFQfdWeWC1>8sk=n(T31Cb8wX42mwv(n{2g%ok#J2_S z--Y1)0(z0v3Sprxn0E{C`DF2AepWDV6-Y~x=4<=-U-I~o>rU|fRYI1$cp3VbR@g?a z5prKFtR{J=Z3`fIvX7G^?DK#P(YwK zCyk0Vgsd2){up{shDpofhyO@X@tczH@pl?|3tEe)0ySAMcg&-_AoNHE2-Hb|DS^Sc zTBvITG?KH`)F4#@KUUbNn@n4R(_0onPJw`|TvY!mRA+?5Q*k+HjNUx!lsX?*rZl~( zU3Gx1gxx5JNGeyGg+cobWI5*&rVK6-`dq0fu%tbpPVURTdMSQl?=eVwRA zfL4YQsBG?SlKinnMjQ;huY!K^`%BX_{QylVbQYC+aQBpI=DRzJ_+8q01a(#Hhi8Wx z>9Cx>A>3C5wv%<#oFd!+MyU!oa;`)kHt7+h2e7Zg(o(|`MNR>@?8@4<*#*GKux-go56AwhYes(n}g0;OF%4&x4Pj?ZlPIs+5iD$KllN} z6*9U6W4E5s8Zv}1R~sU{eYm-$I{|FSxNHJv4Zb1_?@9wah!N&EcL{kW>5FzIEtVtT zGjJak7C-!eUTvK#n{D89E)Y@fsj`N=B9BIRtrmC!hd7J2nC;E#BpkoT{OpcXmUitC zQjGjC=N*-kO|EyB^nNG96po~ejrg^}+f#H4z&dba(O(7P-sg$znIwoepQ^e}Q{g)* zcot)pfn1E5v-LSOWZ+)c#Q5~3@K;m+IL;PWXPtnC_W+MDg^F1? z)`P?1`&~_ydh7NpI*ZN|?Ow-Nnim4shcv7_5Jw`t$dad#SpdoWLk*zB2JpY|4(&al zOAM;qw5T_T8mRb4RcGI zn@rq+s|xerVG@C$KFZY&UYWQ919_A@tzTJbP#re+u9^$Cqv%o{UK|)-dy{xnJ!Kc5 zH^kYd{|%G}1!sdOo+#u=V#Kz|>2h0tdbDj~y4W`L{h&ZY%?`VHyC>rV%yfTSH9Z|4 zREZq8{gH#3U3L=-+=aOXxrO2GayNJPYgPX*48QnaPFr7NPcs6TJ$&f^760ww5(j{~ zoeQV#CSg{n2M{<`4Q?oMe}T_JLpBPz%~+*(d^ zNxO3Q&n!d29uXaxI->O`h7lGXGOA6{qdx&*0 zo+WamR|OR0?m?YT6|>y%7&*yoLF$V7ZG5|Cy+~B5+5fK(9fwr@PGuyzW_JN9Z7!ktj zh+7J|9!FRRu;qqj({LRo%S2;aE7GVPCJZHDjkiFR-7QiBa_~B+_{a>_hpJTkyQamgQexEDk)hL_3rmntGdOpPb}uBo<{)Su zR!n&#E%6a7WXIQ+POXPcOP-&OE=_AUbHftvfgOWm;0fdsCb#j&j1-}+U*f%+aF44W zTqi+^u}&UMGBUe}ipR`X*oD@&iel#lfoP739(`xQ-gaq@pGC|Kzt>_X$T`!U?y8B= zgfw7)rj;T%`a0#T6;-F?q7!rO#NZ1r`%kC{$iq(sXY1g6<_4+}>Js@{LmAtyhf4~D zKk0Wy>C^;E6f{ik?AE&V1ebEv(<=>>6t5_|YW-2@6J#YOKzY5jsOry%J9E)fDS%~o znc)_+e;B1%(S#P$t;UgSc1yo#{srTz=yaDGBMJkgn`)eIMXt@{#qMHp!UjVuvsA*4hw72(l)U{tm0&M?|&i1X?u~9nL$@;o+cC?`$?0jGX z{`$0RKVAgKi32cWLn^T;+4*#GtIa{(>%rMV z|1eBrCS_Iq&vP)R4Y0aANf(haCL}?ceE}zQprDg{gR0Uh4m0;dsL7ij2h?cY+5YI| z^s#w-e_!Bn5iN8^f^6MBzs|c11YXbrz&DZVOm3B_OY`t{kgXPD?6M9X>#BHt=S|SR zW8k&W|GC`;`MSRpsgfOd;n7b3@JcRrHlbmmF6+?hBgs$|YJ#FEPte`KLDE+WMr7%G zBQiYSQprnrM)oIP`wEPF&teGi1iL5ztP;R^8zjV-IR6vPiEp(2J>ZzcuF(SmF20`- zR;Val_s2Ma!}K*uwA)}qjx6aGv$e~rR+8I0&RTu5j%I+p`PhDvJ z4FrOK0pjVJJA00eZg+P?jfD6{t@pS|>zF*%>4o10mwen{x-Jc${*y`Vn z_B=G?25}={3OfLW?te{M?tt#o3I0(+R41o9e}ZRnG)b9U!Odgu;itr+B#4t&$aGc8 z3R3_nC`~<3fV|3wohAzk^;QM40!FQsO8-Yz1Ic$sCoM&Br6rz-ohxKRlYTicN1kDN zJ|*v@;*bLxz%a`O3Ky>yNA-7S3^<{?pB)J24(!EL!vx{L*!-m1ilb%YfDQRgOtHF%^D{F(} zs`ULLd$$qa)L>DPy`W{&*ERUkAOQZxPhD-qH5F{cwKnSgSxgJLR-~SjJf_8rdz&Qr zmRK05$V_WD>wa33zP1+Ik$R;duvoYie5?3GLQ0q}7_^r+#yWl*vJxctbcGrbuW`>} znS80j;Iu=0GqJWqaf(s7Ge2@-@1`+U}G`1q;Theix!6r#CzbH!e#bg;9hTyfR ztFMJuMn;WoR0!Fxe`;g_=bjc^mmCz!Gq>zuLXJ3B6uCq9L2A?IoVP^(j0NI zXwKk2I3heUh&zUAJ6^Mo6{>$F#RVAE!THkrw=^qhgYvaT?`r9QFEM(J5%+1a*uBC= zIH-Mw@-jQxp8T1No}K&w1in`j*U;u#ZSDa53)73WxqmBnMUaaS!-j!~Bp18k^v|5F z4J>eu0j; z=o;$0f=l1~yELCmxd&C1)wxofBlUTVA-$t|TBg1g-lD|qh7oNZ^Tcf`*QPHfsf=Nl zd`O97?3?frPhNAVcln{>ibK5zSExr;K)~)jw!%H@u%-je=>F6|>pT5Ryaw(( zbDa+keFbh*(rVnF+20J8&^ll`C#1OqFql&0ryQ&BiKP)?)pU^c&^FRZ)P!O>)S+Jb z_3nD|ZGiZ)_9p!BK4mtn;!=>$ez;zeYsJkirj#A5FrFB~m;VsmC(;AQVsVb=Y~0(dG!3s=H@XnCvk_0rN^ z7j3GN<*vONPvw>F7tj)ZNnyb&tV-V!4?|bf64Bm`_0C5A)A~(DAz>opZG+b&NBQTi zcqNFIBwN~MBEp7X-MA3try7zqB&Js!$bApQu!Omb(Cn(6VQu}RF5R+av)fXpm3>;g z#NM#h?KX_QxCTI%%SbfcwOy5Q+38#p+`dAWIIIqS0YUtTW$5g)vs8o2IaH1En1bX&Xxwd<>eJixHm`f{y?*oK;BP!KWh zylxv+XDx<%BM>CM`5@*>@!)i^d;}g@7|x3>RWVFWZ8c0;Fy>cQ){2Ev^<6vVTPD#y zwiTk1e z-E|v@p|$I!vL{ZK<@!k+PDDN!y*~3L%VLnDKShku**caSORiRjM9#1(ByJ1RRUVnX zNQ8(FZpX^pAxBI>9xwdi;k)yej)fh_gi_goJ+}F-W z=U0lVuZ91ONPjJ$N!r8tMpnVW;ZI0RBzI4zMnzZ1{FV5o{IXjM(#^k-c&dR5W1Yxs zpHN}_luAP;Ap*9AP)2HSVC<{H;+h>f+_Wnu)ZmEdSmVJ$f5&y`?7-*JlD5OZ7SG&mz(RL;&A>A2DJ>2Pc! zZ4!YT+7phX4Z^W4ki+UE8Fe95$zf?kV5i*@q_Ei;-z&QGyExnCXo<2p!a4+U05_kN zwm^loW0Uc<=6`p^-vL3i4rWrULO8WtJaIVx?ArZZ%|bkVcvZKQBL>b`t@>Gs`*!3^ zbuf@_MZP{y`=Gi(c3(}!1A=g_TO6cQ*xS-6%qEj6rc?N_r8pq$fU>6s zoDy5b_m-Pe>x}rh^FC*+3L#wJb_UO}hdsx5im%7#I4JJRm15!17T`Lf`oN|G=8+X> zsU5`GQPY{xaDGiYRJ!ya`y^ut^OWsAOXzT@^(Quoc@+z!Quwe1m1K-F;#}c80@5>$ zOB@#zgm08hOvEaa9UTW*lC)vE1I31Y90oGYw(*kVDx>2{aY&Cd;v)(16Olwq`2k`p z>laWz(RQnjWgtMa9G}iA7kC3X-$XgZ0@4_V6V(qZJQxK9t%|j)HwA}16);rZ2(Fya z|0ef3j*wB$Pjr51o#b<{S77<*tgQ;l^?HRKFMpKLUt!gdba%2ps{uaPf%n7oYXk4M zpQJYpyq`7Gy?^li&U)S8`@Qs41Mjy#R9`Uge%4Cio-+9141!JWz!h*sel+l5duRsU z82B*jPT@W?_~9X;Hx7PyPUt%ZK5V~P=xYW(%=$#Q7Y=^-R_N0PKb$7@w}j^7N8J8G zso_%Xf8J}PyLs@#9a29x_+g{e4-I_S9-ZUHfe*9ZClz?`!66&U&pMANVlqacxzy{=;6<`sTq8?`pkv;KTM`0E!s+Fza~Zt{VIRl;ulQ)5>+$ zn7a4*pjl9J!e>n2;bvFAH27h?tI6=F9CjliU5L){;n*MDDK7MOWwvDW z;c$`|Ko-GX(XV`W=%6F!wu#meGeQ1K$}`8xBcVg&tKUytSBM_ZfaG{Xp&8CW$jqTc z_dIG#&kM`JoT!|blPV|YWyIX^7V z+jqy&^XKeb-f7ORwi(=<9gX?xvRHQRKt%K6luWNX`w8!?+AbRc`e^g5XtxUHC-%_?tO+1s*bjZ`&{ znf8E7BgWrw?+!k8lTJ@ZeB$wJ>u1_abd{oF)gtqwS@HhXczZGIYlXwB0~kY7HD}o8 zn9ASM>S;AYo#RzK`SxNDdoyoAhcAA@oz%Y{J6b-XqcHr4$O{quMMfXVs-4Z=Egrd1 zx#UW82XV5cD~V3Cc?`BwC)hsyNH+f;#@++mit6n9o>ivLp1t?%c6u)y&Y{D>Mp3Y0 zBC$rqh>Bv2JOT=8VxFKVmPZA9S7L*RVz1G}7Gv*XiM@BRmqh)3Yxdzp^S;k}eb>46 z>^Zado>{YIt#!Bm{lD?h$wdqV>F=!$&`T)tQmcCteAq#D7Ku2&uqWCRYR7w%LHb14 zUbUGz`yl)9z^OstM;g>B(QcTah(qPSl>RZwTdv}-3c)fdu=?}KY7`M|BtP8>tt<) zz(l!F!_m!(vkr|92@lO2a;o6;pK0qgXCvag{)4-)Y5>{ar2AkCQ=Uj<$8}O)FXb~*Q;X(Ysn3&g zrPQkizAhh>_Cr#BjKF3Qmqg}kg8*D_@H>}!nwh=qe!Eqns$-;fnCK!ktZMBBpe=vW z>T=zhb#|MS^QZY|G0^PmWPCkJq<4+X+$`aDagG8do3|@F4%^Az&mG%cs`syCjFXrT z9?YO}a{@Ch-w1@j9f@W+ZoL!Y{gn9j6``+DR34(f)*+&WSo#<{AY;I6D{@QwChAI( zi0FM^_cbm@DELLi%L~#)B+p)F)aalcT64vyl$mb4E!|{qh4{Vl<#H*h(UqVstd(_| zy9w)M6BLp4vVma7|M8+q#K5t!EpD@H;eoZ6I|326$~FjZqa2=(*49}=;_h&0rsq`A zX1BgBgMA4RqwpQm-^UTqbWUCNbn@SlYT-(wgr17g z4I#K5PyH|E(;}RGo#|pYc{9{<7Q^u{!`4$V5*kjkMjYAT{!kw?WCoYyt<92LPuT>H z7}|4|V|3z{^F=c=X=G`{B=9UpOKSl|@A2$Hv4F=xmHo7$A*Ee-oIFrQGjTDjB{EX# zOKOr??@jZV?JcDD3jDepOEfi?%-N@Jj=nBt%}ckVVCT64-itQul~aCia|=k~3FtZpjMguUJpP z?`j}uAaW~~W@$I()j{-9XpJop0RB0-ZaESsl7QslQC;Y(U}n5L)eX2>xK=vr3)uVO zFw^O+uw8P=0y@yo;Y_QNZH~NAj7ZP;lt6Mq5{`K=DV0048Ys^|zucZawkCWK`2UPD zl!`z+j;1l))THR9`COk;>+G7A=0@|OXqnD7roC$+E0*qBsh^g;J?_vc)<=}R5?ATu zTJ2t=^|dL|G}Ix)CGuV6zK2`Ar@{a+kHyF1XjbL|1Yl;+kf#a;UPF@Vswvfr4Not& zQMv`o#)T{CwpxXtk^OFKY&}l3K3*I0>Yx#$t))0<{3AT)NUzo~f;rB+f%5@aUxqFz zkIuQCvw~cnuo7MBxT~Bf)3v@o9su%dS=X497mg+RMHCJ!d(j7IZA0Kn9dH}tenuEC z$KSY&`pRMjI`_cNTdvtbL5F0RonC8f-vT{fEC}ZJrtj{2wV*WrWU;{KV8i_Fu9ubT zWOXaj{lXUU=5h;rb8ic^d6s>#MHO(e9!oNRDC)v>aw0dmRodi-jf@; zYmYZH=!u3NkX|f#LkvC|8|IO%`01S@&y^eJdkbXx3UQcoWls6Nux<K zy?2RO;Klz)_b92306gWLAd5k-92;s)ee`Aeaf;k&W+j+Fk`F+Isx@vdL_$nPrV zVmN35ds$F9B@ibEm2-l^F@d*@bC)mw?Axye-uu3R#Sz7`Z}Q?>J#h=1bw5I}{1kt3 zj`q$Jts9FkyxiAb=SC&1@AusY{Cp5(GP!A4`z*odl-Y!@yb;C?($kOe+!Ii90ao1< zm2U$t1l6A0D6lC5C*4CDBOLjs`nmJ`VGa%v790DU(D|jj0{1l<&DkNr?ZuIJ!j9gw z?S64_5X+{^0`Uk1mx6~4WkejGZtDwdaXxXX=rb?5Aa>7>^#!rrYOsrL$Ch>C?J#$_ zlfQ##4BsJea=G^Yq$S%cwOpe;l98qO&Wn!n#W!K@Ut#y(Sh5z%mNTJgOx2c>I0o2^ zWxXWzR7vC*B-0Y1cU5O=2g<5vgw6N5^#wR3`j|2-I!v1s`HWY)1aGtP{y7cyc3#EZ zE~pSpsDy=_Ck&E@)GZ)|*)*AYJ*H#;qf$GxAy+@K$!%OK5FJfK3ijxT+uOTxox2W2 zE9wsVaET8SBcl<{=)O^6Y;jCYzow`a)EML44fJ?>qh!OaHp$8S1TnF3f;Um7uaN94 zu~}|Y2ANr3=Iwc)5eZ`twcd$a$bX~Cv_s(T-=bhYBML_Av4921SLGKihV>?}#%^gX z%~Vh|9R={Cfh<|yd_2m0w3+o9?46)iff-2iu~GE37z^&O8YFpceUM~1S(nV)tL5;k zSgOa?r!#NU>t%ACY#+dkWM-5yL2F(5Nzyj4HMm}uu9G(NORbglPs^o(DR+K#=1ffI z&rWT%pi6Srx@?^zp3YR>$;kTvr;f>qzsJc(QRet~5O9*YAWJID6|;i7cg!Cbd$IT; zQ~5qatve}R$W6Q<=SSl9OzDn{{c_BhTn=VItj^W1AroL6gLqWV{+k(N&of>|)iiRC z#2THEe-q;4DEDdPzXaqabP9m-h`a{kn>cr5mICq+uKI6;-aR`4nqH4<`D2V6FhP_^ zT*#Lxe=Lv1qB1L9MQn;F0Xt^s@!_#B02dc*Q-F5lCzX6soLC6TB?@3ODk`d>zJ94_ ziW|=tExG22ZMoK;K`U5mU@+90GY@dqZ}u>3$73r$k{3RU(#F;k`O1m;p3_43e1Hq7BcvlU!LrnWBdbZ+7Wk60)8Cq?e%86NvI6V>z`*20RUUndyjS5gE z_4G%=?)T;#d$K@OXw}!b^#jSYZ}Qg2-@w{=FYCxw>Q~p8%oadX&5WawxPptyz*bXz zq)MOaGakiAC*4-}%?Pa?skO!?ZDJbos8-i)LL_7Z>((UMK)j!IZiZ_a`HPCe%kfe4 zWfYy6(dT4BCmiPG!=}P_5#%h7Ko%7`-Uz}lJL^q>&7|=dgBS+f%IMz^jQu77)85^n zdjChMJ-Gb5#seA91%PDl${v5{Nb4jLEyQuT;EWtJF)g|okPiND!gVaX5?>}2sR$A8 zhHgL*IFHs$?ei3UeR|G6B}eVC3h@*H-AaK`Q5D%M`KHMNoFyr7*Jwt|S!zYee$4hB zwe59n_VV%gQB2+VcMT-E>O7t`HEo@rZm+I7Ik!2G=XHyy&7;)1b)}wgXcOJl%&W(` zsF*|*s#TPr0Of|TscW~HfIsFu zl75|cXXD3)`h2lJ@ds~|HFjSlug5@sT_D`o%II|w%`d$>i6J6;NW|p(6g3vVoFzd)t<2Sj6?{ne@y0>Yzdjac@_^I6~J!3m&n(XV3Aq}4;_;J<$U~FUc5@>%Kuf; zUmk6sGcSkkd!b86Sv**3dZc8?vKl$RaVXUS?TL$}FR(~i13!o2W>h3rmZHl`;!maM z>XNvs6kT5;ROyMUipEWGZJFgwihm@=OK}BA@M0j&%!`{KvUWy7#4DYaT%$Zu7(i=e z0IfMNgVK4YC_gMZ>x#iAMfqt_rdx2SUliq+Mdyp6yRPWQz7{K0yap`8v0^B?htt>q zhE9u*ys3{j1&hl-a?}N)z*Md^Fd^Ocl5dlD3#?FfGRv^8WzGw}^UL4+-WPrhed!l| zBWdFx5J_*~{x2_b%{i3#;(Ul_{ z>dSf%sDvC;BU}Xb*+ut?Vzj#Gt}1Sbn*cBu^%#gF)C0H$A94)LB*F1D;m z++U)rbIWU+nN%Go2Zi%s7;Oy1ljYpnvUs{|w4!Ts;u?k%TG4H}03N8UeR7yr`9F!| zkWuTMHs^ruvaE#?_~0c%_7eRTxBGfag;H8lADPWRTxW7FRm#A>;}>+r?B+W5lN ziV|S^8v?rq^rAjO_Z~nyQo<;h6F`#WxzA7x#{{&=M8fNo$>vC1XN9aHdj~Y3(&ja8 zrL(T7_5#t6)K6)O8bwRgEKrzp9XNqH3q#oUw4x8OAQK~mEFV!w)kgNbF>)+c+F00I zc!j*2vF@1sM)8J^icO}v!I*<4E}T%F=uLQ=v{k@ z*-d)~6N3r+q;hxq#@nT;*7nw|l`gDK9JWjdrx_a?YtU#{#>PI{*w`6sEM%Yelz_!x z=9^T(i0au462iyg@q8$oo-lPYDubbC-0qxaLp@7zXcubQcUo8QYmx{l3}MbY{a`LG zhXNAZc22YE7|tXA`&|B$T>N=Xe8zu_ zmJf2&vZ{B+Mjl=zl^mVd$L7T`dA@mUe)2zaar(Q68t?HLdFN*XB8v>_bnPd5R8Ek8 za5+3A)tIv)uMIh4quKy*YTUPz;mj7^C%`g44*&qiUPM)u6U=&#F~@G* zsI>8B->(~kj7JWzvX^_@MJ)^6MRMA)dcYVF_bn(xIWN~BkLxcZ)0}^x> zcZS4=gmd|m`gm~zEa9HNvY0i!`-7I3)QXF1^{U$7Y>|gel{(vlevOM$n9c6`0C}*y zONtqKdxKttokd+r4F4iD#5D1e*eRVk3IPgNHp-;$j{y~AkTYd?YIT7H%TOqrg5lY1 z>yp~2&ad4bH)>l`mz2!{9p&(J>?{_~$UiW8pypnNZ(!{1Mm(ds0x}ju+f=JELJWIL zwE2L#wrmxtP{UU)Hi6-&gF9j|Y;(}voRh=g6so{G9|kdbTdmNxYbkPp>s%-7oSP_$!%F&Xj z$yPQ=J0LeR%k8%iLuT97T(QRX`~=Wm*Jj}Cjn?8O^x1zl{0El(;T?SyYUdHu{VI(8 zrO+XYKuy%&Dc*VpRQf7ry)H0_^~UtFBU?sr!O441immfFGsZMY(Z;p5HB|S5$b0-Y zXvUksFjGa|kDQhM>J&q!K6d0!+F4EwqeHA~2hJvM`cK^bnLC!x+L5I>HA_y5s+ZeJ zR?JMTDsSJUUMhe|dl-Eag*>%Ks*NwFc1AUT{t7O#mkoS(o%o~uv6;4AXjref)&pET zYz+;V@=E;3Xw;ZnXyeN6&xA^Vb zK?YHve&FDQ0G&-^X2@U2e&~ZBI`*MGMS&IO{oX04@FO zss@}KShB`;rsLKdEp`i2b#Tk|YGJCL2{JsQ^c!Xy7n;)jj`Xu#{;epwUu#BJd!~U^_q_&jetoo}ehVr7Xc)T0rFGG&I&o@)kU1nx>xl;>%xx^pAV zY4c5_E^_yyuncB{dD?H9r_Itei7I}lip*)khve=w5u7TrDZNW|$(orqt-8N^x}R9D zv?i!(w%2f6t9^VcI>4E&{u!;osjb0jtyzxw@{(5ZV6%BRj}cPw()d@sZYMC8-pWI* z;??xi_tHj^s+E5+9$B<~<3E+1KP)|}26^5_j z^9Jz-xf;nn${A;P1`KPuQHen)u^PffKmmcu5KI|L%Ge~lDrfzt{FYByC``#BQ*g#O zFRlV*yg=WJzsQHHhJ6S+zMn)!guP7s_cCF_u63c|2FBD*~=`dY51%qztGh^D|c>ddHs2h=Z zTCq761L$cJ+nIQ>ASXIe12v0A?vjqic2ctzi<*VrqRxfEBC${}a$vUKmeSy)5$);C zgCR6m-aFV&%+dQ38(1sBaPMV5EuCj&{$rVDXib8NKdru!ptH2--AxLOM?NDm7uO#q zE$S!TLfR*0x4F5x^vd1owj;fMvM{%(aiPEHXYjwrrx;f+sW>?@0dYuR_(J4EY+mf) z?`7lIJys^mWRgXzuHNsV1_HH#?p_ap0{u2{vpHCy5DDqk6LWRO{|d1NMmdJX)nfd> z`@e)KeY6-R|IDHq)FjgjA-&+h^>5zmx-{9dZf8wb*tu7i-TCW<*+m8RMc1&-ktQNS z27t({B^p8>KQ7#7g?Li{6Cv0GHu4f7J5;^+MA)C3BUgc<#gDJ@PA9Z&cRBi0N1W!k zCp$H#IU#hfW1L?(vSB0y-KPJC+THe0yEjQwcozmVh%fsg>d~Ti4J23=dX5@oJA52AwNy>2g6(oh4jfsJJL^=xY zK4=gqZB$26iNJWP0ZzLYLBC%o*?b`-pd6N^BkAMCVg&sp7&#sl5XPnZ_99`Oro$ZM zUaZY9l+>9J>E&2o5KOvPNRZZwQY0Bw#%*8Ar%t9>b;$8*1CSN^J}KTdM3fJi7!+4v zUKr>j?qgOmV=gIs9PSU3o6WYmsGd|^R68bh(V#LjWz)1Fe%dIV?mLSl?>kwG?WA3F zsgHyMCcCTp^oA?iY9AgzEK5O&sqqjf`z z+AK6((}#lBZj7yx^@s!fTfHGb=&KdN-GcA$+GuLX%!0dMPg$xUs_NC9g4&Lp9aba9 zB4}l4UXZdFBtH0Cre2o`+M}{)@F*Z)8U7=0sdiX3tNGAL-CVmkaP4GadC?{dBgTA0 z_hsp}XwhmKM@2SyrewH?v!!Xy;hs`oi82VO(?!}UAjnYv3wbL63z9sd7XX=g$Jt_s z=oQvZEcmDG?6bD`%6#^YO+sKzvavqI{%D}Y?%25 zZzlxIExj(6M@RINwI1pewpov%SyfZpz=j`H9T=0B$Vp7{>Dlc9tG}bc_StOaN#Otx@J34zAC7L5UXm$5i`6=)@tvLO(tFFh z({egzN<56OIJ6qlJ%XHM4N<%z=l<68^fHjhR)4v!T-$MQcu+g9IW2MXNuoFGYw7j- z_P1UTan8Ghi9+7w#b8w9b96}h3naO&6E8RW0>_QtGMSV4FM09fM7n)<(>T^*R=9i1 zul!w1MogJMkoHTA+&BHG#hC~!%eqabDyL=f1<~Pzl*ecaLOiqkLT`SO0m-*OytRKi zCT2}a^}k;q7+d{GZ`?PgH$(ea*P3EHJicsca7vllZ3rh1YTA%RagnX$!D!lycNQ8o zh84+&A<&Gn>Al<0`LlGoz1P&2>7PdbJADr`obaI+JU>Q_DIpjl@kZA8ph;Q_)p6t= z{=3}m5~Q3d=us~hr(`;&Jn7R6iD@hcj^b3+@)%z!QyxP+CLhp`!oS}?y{=F@j8}iJ z+qZjq)yqV$-FJp<-KOfGPRTjB2e6&!_J?(&m-|a~|4v zdIAP<8n^<~Y#eNh*HUiUd@MSMIA7WCiQq<-i@=HJKw@XA2yKoXYNwVuV@`Pl zPiKMNNDh(B_84OV4Nuo;&S=CuwZ*vDyp7pTu=@KCRtN26ok6d1%TPL?@EH4biLH*b zRZv4WIL(7N^#cvqZaX|y9EmkmH?4kFfxXh3xmx_{DkHw{Kxmtt(CRPDpi*eQk1bW8 zn;9+*o7LM5)?+p~Gn782g6Jin{h?BNI7R-wb(r_~!IEUof1xZO z0FetmG{ng_!d{F(H$RA;vRltNNL|LWHbNtJ_rc^27_Id#$lnH*hd`W`E)Vr`Z@G#1 zwds(w-l*zB1^@*?{gmNmggMRnPs_?sYZXjE)ubJfc4~_qJHx!!?_&eh{f* zSf+0>w_@jSVd2UTpJDI11EU$%;?taD$S?`-j2)mFP`Hhb1^<&qTcF z1P?jh1UQ`P?cuteT*jjPqO?~i2O$4=nLoz1zty8;KFqcf9ua{_Y85DSEasN z$SLHoR_it&A>^l8Ot!4=?02HyQ^eGtl6W6@g#f5GZs1$V|Msn( zfiHyr+ZTopd?EM0ePOcoj@$0!oJKFAHlvU6ljoI_owZEy(Q-VHl*7GjaIq^kbAPE` zu$_&}DE~pYM@q6-#CPfbVw_ib#?4Zhf6;ZHcU>~kNWW{abq53hzE*d-(Y>yJ5Y>>v zi(SGkFF5jPhw3@OVRom=c^}*AH8Q^ZET||a`-~kvZ;R(3cKQ*`$4{xq$Ex23hiy#O zA$f=-;6Odg!el$;9H7rLb@l~GlOGX&O>!#WT;~giORjO`O2>Z0;esu}lqmQ9rG z)Lt%oogLn2iyQu57j#-LqBM}ldDgn}QP+OVRW05(j^akvpXDD;_>#lC_u-tjd$$ zIwOey@}Z|f$6*)hpmFLZ^eO7rvxFej4NFM#6{0QMI**}JSCGSW%88t ze~|8?)`h4C%+8tV(cDu~KS_aP%B~RRkWWebNjaQPe_<^T6Q@(xcZhF-n>Io$o9to8`rTx8brk3ppE&d!PcZ9jWhWamI__Axi;rdV7?pj;k z9oqMX1(LyRXn(|YL3Cq)T+z;4d=2%3*4yedH+%>AFDdt^nr@TTgK4p$9ay@U60Gz- zq-m+|I@}#TQ9CmeCYM}_(Xaz5++0k>WX8G(c>p zXSPSL97eIk59bnyLdPMI2iI~q2vQHkE~eira@rsooB>!&{V9$P3MU8tT~D4tvxJ-bjmv(SBhp>xBb?!6cslN^(X6*i_h2t5XSG+g_;@MnX2vsCP))q4kH9(=XmC4s{N>4046sS3-O(vR{ehYvHB);~-f^ zT}byeTf(UOw{4Q1)@#$PQ|qIKe0q*EzzNnudkIVbF={vPto}S>=T>VR;=0%}j)b7u`iO|Id zlue1f25RwnFNzjfse@tvxQus7rtRcR{b?EJARgue>2J>qAu!7yS|@^sL+25a9;O4$ zX>IT-1*bLfU=iqn3LO4oo&6-p9T|!v!tBxz-nNGW?T^~Z24nR%K@#Ky z(IgM!wWs+(BgpBc(tb)fYlQul?R?5OJ11PB-sj!8=N(0DBhb*lBcg{2OtmKd1x^iw zh@+@D#Tu~vXOjY6YAe^5%1lzH_Es2}>o1c{xki&DVP>aj8P^=Qsa68!t)e4p-@juM zq+HnUb?Ek~MM?~I@w@Ib#83c@y$k{)URGfLU1+qztA!qTpLrF8E&U~!wgO&fXzPVs z5~w9g9i@VFYshy=e8vaOWRT8|dAx2uh`3hRE1{sy*?>^mie$OClu-DcEj1nhV=onW zHuflcGkc0NJma*CaW|6S8o6QM;LgvTc7t=FS_L`;zcF@I)@}*_Nnu(w$%|>!fC7Aa z%51Ygkn0WQE^15XP*Fcn#6^9Im%4;14Ht}{<#M*w@3RW2-g2MQ>!8;b`?A&(iT_|W zdY(#-6x;%p<2;dd9?v?@XK~UUmn|M|Xe=Gu60^}((h!rPu(NS0B0i#GSmjf^Lww`@ z)pXor;sN<6p4a{hX+}2g>)+O%*4P{LP2|04+rDY>@aADFB#rnz2aF=!yKOXWBJVc} z4(wuG4U8;9rBElx!PSVT0=un((GrgfBD|*E?)h2!ToJ#PgY%}zZqIbsn+0U;IB#a{ zS911YKKsE{37YP+`4M1f?a#9ITiIYA`y+&C@G?aOsB0;c&$IE_QD(K0*Mb2wDHr-Q zq*BasY=hIu%8p@n^(VRU_NJyV38bhB!Ui4*79XpHxULYrllLFNRR=a-)>5hQS<-;v z$%Z2^_JhC%Is2NhU(VSt;T8b?aESd|ymv2}quCP7qqroM2CVcCbD}gE5jcl-KFdX` zvdRy7?fu}T8%ecT--p&X_$=@LQk|FYq6K)}LAijPz;zsD84!tmg|P8Oe=6)-gnd(b z$Mk~@wTnN_p7bNiwWk8(SASUQOKpmtA8sj-d#t~q$qLD+Y=S)fsu+DsnQ0)GxJ1$}#lsrSVYVJ%C;630bVmM1-G_=t_njm3 zA5rzIEVvbQfo=NjE=snMakB^O7n-;|o<7KW!`w_{7KJ$6hirK#dpG0`>lm_yp_4YQQM6n#DGv6(ysK)l<_kKlri%K$eJU#?)Jd`si8t5Y zf+7)Z1obX;^xp#NkB}3%+z~gRPwVA%_~*~A)1>sAU8k;gSt-`Vzg4DPb* zn)2^Yg1&$6``ggZFxWn!^cZ{VSH=K$hx|gax*Z7`)HYPAOD-cYflrh?9+xz7W5`xQhQfN_WjlP z`UlncdO02DI^7;658T4)ZyN3m6T=N7c}K4@jO4x9;qEXsJQ`N+iwO>U>H6!^{e+mQ zlfxik4CchWW*IbO#`d#>|2zPrx5&2{c}+_kW_iw7OOI@GTy|9qLh zEhjG|FEYO(mgmRu1+jl_oI5Y37Es0+5uh&ka^V*CnH76!#eYAiKFAR$JhMVocSN0D zUP+T)Yw;RSaPBNek9fHw<3)Jw8ZqqitIM<^SzkWL6HsHfTTrJVDCC-yE-=yilNN$h z6T1>vd`lQ%vrey2(OJ&(;$?^Mqk&AMIR^u5>t@}qfufEC&x{Ej!w4kG0PE1{VFP#I zFLD7KV(5}WCmV`bBXPY?!oj_w#cuXd3+$HG=Fu&Y%GE!Bnks&oKGr+LGkQRby^d!~ zWc$(d<%T?+7I6Rq64D6dWwx5n7+;W$ zYbW^5;_XFVA$Ru9U!#rcn*jM z$_8gK9N_3-*=DkdT$jen4(7LZc4D=udcdA>WrJlMCT})%#GpOhN5MVNVe@$cq2F^1 z;DmfK7;LJyLAJ)(Cfw%vKO^wA8IA*$;WiAFO3NGIqJWlfZS{9aj|$j&nCx@p1}Ue$ zp}>X~au^9py?S^EVW=rv;WNs!=2$w8OI#v@GdvcX$f&PoSf_P)J^GQ8|6{>3rHIsL zvA(fFC*JKjpT+4A-qYQS5J+|S4$$zwC*4c4>awi5G#k8E5lcM1)YG?A!doly;R^Hw zhP(e*A)ly-BWmQx4DZKz{~pKx%FCCtT=bQ!d@-AODeL_s8^4e(n4D3hgY$ki`llOp zM(v;T#BM@3hw=&yPxpc?HVrYVkq>O)Zj1|Jat1XK-@#SJvI zannw51s+*l4oi^cps?|s3S1f@QxPo#gRoOVB`-TNsGo8BCLK{2Wh1w9U{zk7dc7m7 z{{dmWRi8Md*~l2MmSH=N2nDrdi)E)C6#1|9IN554RWHi;^jRe%+O64#TW_F!xI<*n zjThc2B%MsKsz+saL*=pqIb|G)^?zBj54BcFF;~r_p}QjBJ$G9*EuIc$hAKnuTyvx} zo9bMaIMmXIS{B2DRkVb98^gEXZV%)p{8xH$XGD`VyS#;-kA|{^-drdA1J5<$>*)rw2Do!=-Zz9{+KS@9dogZAv z-awV6iV%}MCH#|>`;Z{rSbaPY+-_mKfxvS@aztRje@m-3X}Ek|%jXC~h8q)Svi~OR z764(FdAUo$qJTBHZ!Ws#gLB=7=CbA6YvWQKj>xpSL$V=Ch4a_j;*?xs8jZW5bdlIQ=n?quk@B5?TH=(Lt!<8 zRAC`t?oPr*;1XL_{yfryiJD|ali|`vQJ)Sfkz#%2b+O1z>w;U%@^TAPfVtcGDe1Fl zSuN6Wq0_CKZgV4w*6d%xXj$#tnt{&s;|eJ9qP5gcq@qaSAC-juO{R+6pOk-*vd>oe zAUi-x$f1~4!O$g`K#x80Pg&|=F$!fRat6rQ zT5hb~V*#XnO zDv(~oiD6meoI2vM zh6IgA0@BO)A6ky6j;+ptPGQMv8|aiBc^Z3DABlYNE>#g1I_e@v{E;*gz#s@}CkPaZ z7|3Zna{3aMM|~+nfiCJ%x7#2zVEAj|3zrJ#3L!5Q2&qeizwwWZn+MYd-)FilU3;IW zt!)FHH;T?HVYgH;`i)BlgbS@5`L8POq*mcx` zy~>NP^^E@%Z6;0Bz}+hPHPEMiR`xhB(Rpzh6g;+ zKU3ETJ;~rI@st}il80o_Z39z;Qecq@?BWk@DW?pqQddfKPOX4tm)K5^Qg%i1^IFg@j3k zNKbVVfyN-v(@X~H0`Nv0Hmu2}dKX17uwGkfWaR!X)dWT!Ji_>-XYb4cBzCoVnSM6! z_KZ&JzA#SgY@O`6+t>H{;!O|S(|tZ!nNO?5qACJfFKe>^CeXMI;d zM4MVz=~v$ioy`Zs^>?HomU_8|+ynUT=Q8gb_HuH(s>hC$KR zO$~N0Q-^rF4Zl+OCRIr@&mN|pIZVCbsn;R!ai2ZRdGau|_Ane7+;vIV%MPsGz=YO*gC1ZT5a+kf=_CY58u#flFKK5B5%(lY$V&0&?A5anf^PQyNVqcXg_Kz6O zpQ%@RgTI!O#WRqSjf_haT%-46mnp0nY6Pi~9!o#s0C)iwM26BR)Eom(LY^8)@;W;i zY+22Ke&83nA(Npj9aAZ#GlfNVoqAGyY)ESsYj@!NVf7ye{(Ip6{vVJavqxcRIOuAB zH=v)d#d|XIt~^6o=Va>g!MTBZeZYVuyF%%8%K1jA#X7z}&<_OB{ekmX0Nkg`aCT4< zNH`__6KfluyjLCZ=fdYfZjXsy|5jaxC z51GtSafOh0k&L<#qoCn8Ij)??ul2X7XG|I=LIo!j{qhG?GL`s9KojN-i6W-J389Y@ z;!!DgkW)p!k&kuyE$WtNfeG@Aa}f+jZnRAFn|it+E){kMLs#Md(IlZ#Q~-)mvo6o! zHf;A}1L%|x_tG6^O`iU|2~Y`uI-{-GNpBs%g#?v1>hp2>7IDNnThwiSzd#2bZ9Neu zuS#S3A8Cs>Syl3H8QvRcn*3L}E>)plBhsYbmch4Dh3a9i?k!IaRXrK17~zRRVa>2y zQsa-zYkG)OV2_LfoHa$58HZ%F-)kSEGOw-YZ}!A7DStDJJEZ$mX#)?H?+U^4`;k0t zg^d1rmSOfp>Jy|BghKHtpp})uXfbe+miM#p!E0@9^J=j|4S2Ge{z}!v*$GU$B&x~9 z%DOz8T1L7h(9qhZN&{&Wy+imoh~P zB;G$vFTBCBCX)?~}1sMw47+p=uzuG37Ur%L_;IiO@f&-cZA``FZ z9T9mSgydOZ34PN$vJrY0-Z(SFnqKE>(dctqLyhh3=rJRF%kk9J$5Opyghcn$HgXjXenW=MxNFBz+pug#oEM3CgN|@AU z^LmY3Mgw=(G#2|BBs8WbX@mWQ=d~sHhUS$LOAdR^dvutIJI_Aaw{Ffi=C(s69{3|| z2zJiupFbw~t*X~8a%WZ04dh_g7(AxQF+lRRfhJldKv`&iQ-Z|R*wrhb_e|{y`Bx=B zQVZ`K-+qAea+T=NnM~$cl~!o{v=;q>Uy&MGIENEC*pCx*>|pVliS?f+kyUwNfdS4 zTLdPwl6Yt4yrnt$O*SnQ{8~1UNejHNz_}I1m;rKCI*Rz$x+@TrjV_|2pg=qw$hAQk z;P_0ZZ?75mBQEUz~*1@m2bB>sF8vJ+&uoQrffuzH#Zo61KWdA{Ax27FCtdu@3lmFjaH*Mv) z{2*8*C#{tERkC}fY+fbrkk(QsX)BVFQr|9K*Zx~tys7^|k&DHa>le7sY~!E(L>lPp z6GCx3(GN>`zrvBk>SQeFl=H=$%@{CLd=Q9!Q}q{ExhWtQ6egAPr9w>rkr+yrVLNE# z?o$D^Od+63^lQyZnN9n(vP!Cz(p@Fvm9nr(hUvbSZoi=y=|8r7TxUJc`AHGJ%60D0 z{`aujFyvLd)=^IzhqmX5CtUlvps-v8kvLbm7bx$1vsJw$+jV%u2E}h393;s0NNXX5eTx!uu~p2fzwyS zwYJ$AOV8|`-Yz4b(cYZy=U2*jeJ{~h9Djf*vFR##4qd}1H;5BOe3D>ms2FnZk+N{D zpOj1A+xCgXYKshr%5|Q5y;s-bwTA!D`V9gjCcYFs>A6pN`6s=2xv!S_F56pdeVg46 z`d!m};%B=!za%kHx+N!e_Hhm_VN^l2sOR0{_pDVlZ{bar;%z&A&t{3p-oR2E+~|uN zAWdiby@4I3a%Tk2YJ~Ja@15$IWTtMp3=E-AsrW3(Gg*PVnTF$Wt`1}2XvW!{Cy&bo z=1L(-R*MHD43EYi%3tj{0)PGuh6hGaZV&%X>wrnR*$Db_@`Q9-&4>8$_L{1}Y7WWC z4&~pjl}XyabS48Vw~`X3Qm5PBb#%9@j>h&wtj~kwMc@6%7hi_r#Kb+`0qnjG&#(L> zlrIO)M}ht@-STzNMqmomSnPVQ75fDh4fm1L==8H-edCbLr-`U!-gDKvu3DhxBeLcN z2f6Ez2U4T%krw4=@caV(Le-Y`{ z8-mzGfc!3!)QyGU8nvAYQJ@2>iK`GT-F07bKg_^>L?md*{ z(!^w;ms&`}dB$FW0BrHI(EU85(g9w8Vm&4AT|kHogH9P=NHNMmki+5>d`%S{WS+w3{JUoS)M0m3hH;JE?*gHW?wr47 z_LXnn5V~v&m~K2@Ep*0(!a5a6X71gT;H@x zLtda#Th-K`e!uZ{H1or{bSzYtXSU%gY5(YmNAIP*8r%#nLEyf~ukY3Tf$ltUpj|Co z*mQ#Eu&#(r{GElvz1bJ%X58~YEcyC%)^AF#iVHLDij4TP@BYR2j*i@Iyt_hqr_pBb z2<`g=bsrI4TL(7<;jMwV1%y*(iFA)eZkXJ&^#uk~8j$ay2_1COJ)io#=3vb2RSoA; z&knQ8%qK#{#!4hB$wk7UU7Nb@Fq#D!8%DD{iNd0oH{W9QL7M~p)>PY3RbZwy)3+m& z5q)$}X{AKGAdcBYU?_NA~0ojq}!w=+2u2W7ti{Fe{mzip|12dcCy1*MEvp zKSA*LnB3#6FX{Wj-{@B7d(yJ)FGBmI$SyI6-}dbXd~v^DxJ9U?L;x|1z6!!`A^W0_ ze>7wV`#2@fc#IOaAQi~j7BBnJ2gZG)o$kTOyd=#E+fZ&Q4=0l>9m@u&T<07uj6T_E zMlmwjri7tQzZUSJmvA~l!2FZ`Zp^~rksnv>^O^K{LMIf{KIXpY?+Mo0EC5qmd>HsF z;@j9;GQNKZ{2N0QfU<7VaHeFvXa}6t)xO@(MEe^tpgCe(Ui+I=HDA=RtWK~@x#Mf4 z_*l5(5x7ygA1cd_IA@KS?2irbT_4u>AM2-lD&9*p%xh0M@Uu`a(AT>n{4Tk%~r}}m7Jfp zM_B(Vfbu&o>nzX8^Rs$Y);&9`iFAKipj|g*rC!9>*{<<&gRS4q z>JO+^fre_4reRrtW{f+V7z#fl;7YT}wlU5dH$NZywTk1IJe(OIrZ=Wrv!r=6bARi` zQjGaq04ZA}S%&p&{bPof#LV)o0XrMnFnPoDhxO@p3vvsuCFzl3=;pUIM2-SbpGZ}E zED6e}eN`3k;?&RB1moYZ$wHemjCW@IoE1~1;2UYs$@#TN@}X(fT}I8hfQ;{3$DC^61M%{Wy5 z%;!(wBj?J*UXj>(x~znQ8VEKZcfW_8Q&m9jqZQRWPWU`%g>hzZYSW=3H%N7eeI_;h zxEbCmSxB3K7C|!(wbqzc+?}X<6Y;midjNhHT5xfazuvSUukTLmhZ4qQ2)Loz=T}0> zU|BoqnTkV+o+y96z6qWv&;;}jg4U)5)1NZ}D&+FXgOti~X8I3__H=nf#KYYmtzQs- zT4eVGflb1IZna*jB!A0^leII%zp)5Uh>UM3u{wTRloV@Uq!t&AxUoMjgr63~CyePI zv5XBag{io?Ifmit!?L^1M7nzhhL0~^PKQsA+z4Ki5ynkTkV!kjSM4y_kZXu2H{{GA z`P%Erq6UOap$0>u)uMQ`wP1re-hTF+{C;Xqu-`LcL_D%I@Q>tOSg*+Oo;XSZi?&JZ zVb#@Qu?#*Gevo1PspHkb5Ylq1py-sK6>{RYU3DJ%i?~AM8Q=;c`ru+AwuG)BkE70l zslXz)+R)kK&!NX*On@KMOiNNxh!3NvgHKEH`GJA(tsKxMi`IgpMEAx+zJT+<#v|?x zVRh4boF`tT@HCJeP8iDUmugfw=Js34f$XL}WS8e0^dlaWvr@ZjC-TY(EHW@n^5{KM zW5^#RB%G}S%fX~{7E~w}yP(uWmfg@oeSO1l>pl?nwvcD08FJ@f%%E26T)zWkH8$&g znaVM3YGC1?ZDcKvNEKjzqVBC>IGDq&)UH1x5W)Rw>mvdIx*^2orWPO9X|mp{UgMVZ z8n-#HE#0l`2b9jiLb2u`WNWoh)>Q|EcRTidj##47FE~y&;i&ZjpW#r(wHTTZl@UXS zuWwC+Jghb9HR?%dk`9U4+nJ_x$loE}kps}Bft0UpDANL4TfgZ?NVu7f}KsM`m^*lzJ%?ip$UE6aYu_I(mT4(t?8z4R&tr^ zU+Vg7Pty5gz{rR#>)&+B*Si$Py5H2Z3)Z@LCcZN_89e3|h;$S31c~R=ZR&Nhs6sdj z=cjX%NTB^5nB^B}3DHT5d|k;##Zg+KRuPymz8afq8Eh$A4-6dFgCFHd7_XP*Y>c}& zC}iPo2`b!xd1ATNtkDSu#z2tXf5mza8YeTZo?~uBgQ;~%dwjV6@g(!5iqo% zgypNxV8r@oV6f@<-m2^Ey;bN*9}Dh++Vlc2Vs0fHUy#<31UDINkEhpp%7dx;ZZEh; z$)oIcUE5Z`H&rP)<*5<3hp|Xpdk;CQCXQ5oj6J3NZ;tQpQ@gKDl1blE9rCtX!VIjf z4o{D8ug%rW{kH5kg7G;)_s8~2ZV(}U0{{P%gXFDQUC3n7B8$HtOxX#FsA%3ud?0%{oBEkX7R z<9_(k7hn9y{SZAB_yq@-;=lk~nbx##kxLb~PNQRWB^}ynlnR}$WNA4|V=pZO>rL5G z<6ww@0-Bb;BJOowHvXD*qHEwi`Iwtuuw(l8cL8E46)KzBSWjfXPBrQc(oZJdEW8V4 zv_ghAiC>u`ZtLh~zJXdRo50ibrr+vJw;sn~awTxw(jXiCVlHs6Goe!Z#xQD35<;Jh z+qltbB55UhQOh@UfH(0uKmLo#+^+1uC~viLu27kaoPuLR*M}}1xW@(2@j=~cr}1VW zNli}n2iFYy`@%XB-KdgrdgxuIql!y}nffpj1Yv^q-GFcGMo*=ff>+a-7|&H`NSVn4pjCm!LcmA<;f7aGIQ z;4na?Dq~hM6MUirC#7zdwYqyV}N^u4&?SzeRHXCVD(uGij;a+{bHQc-!LxjkH@L~#3(UN z_h-k2{c`kH)*U%i%V#q3NugjAep)!s3er4%b)AU+BH|Z?T9XyeWcWav4}#l8h|>E+ z#$fVezjyumaV}IpmbFYEmpGPa(_Tt@ry98<8dy(aPgNOhc=V8&x?82|b84oHv=%@E zs=-0cCe|=V@3)b)HWz;qXTFZb|Ad+l_O}#76@-I62*M0fr>YceZ5SiQa59d7$-_TE zY7m)u+TO^R9y`N`^>?g}+z56kSdbe=@d|ET^=C$_QJK*(7ZMDC9`nv?rUHu&w{Kyz zom$-;fEY=AT}J##sx>%&$r4ekGnq9RWQ-Iy zh5FV|fY!Ync1IX+bnenff1MFuk#QEgJ5YX{!FQFCH!FEibU0@1(IQ+b@?HQX2Lnf3 zmvz?)^-2cdId0XK;P{xi^-MPWR8Zk0xG3v)iKk;8i%Or@?IPf@Jcgc_xhAG&v-(ol zN5*_V`-0Gy#~|A}9n)_|G5wAN#>c*{?w|ECg&~cq&9lnj7e%|K2Mv2pAzj(5E&En?Nd_FuPUug^Fl2#GdfDQ=BZ z&(L$Iuu5V+{X(1^G%o}tu%LgSc}EFwk9q#d&QbjZSfI_+aYj>EWVAO5+CV;;Vtq}^ zJ5J10pYA}*!yUx0sre(jo$~29_l%sn=SMeid?s^%xrIk%;RS-f`tLDgNaIF$EEZ43 z>WSEUKda86%hg-Z(^CpC=QOh*8GWK^^`Y#uQv4nQ2eh$tooH1@OXQ<`*SGe35g(fqAI9o~SRb9MHh6JXEX(WDFy1kZCRmnYU~vt?CT4ITugp~lk%8N& z!s}12ik+Obpk|=Y58&Mli85hgPv&0ycgLE7SMH7u4osF`m{IK8Md48R=~6)YkH^MZ z@N)s>OK}oh%t~~w&^hBJsP4a0;vX>S)scVz5QJlGw-CXBXU0ROTwOt@vVe-o{{`dL zf)6m!idDxxs*Fkh`Gvc)*h$TBY6JN**6=Pk+4XD_K27vA7H`Yi(s)d{<#Pts<7y;f zjyc;y!uo)-nVKx-Y~CFAzYO@?sRVM1>ba^EeeMu?G!2%Yv19&Szl;VfCmGs|A z`rZ;fSERNLt{lHt^m}92vjnHryyzoOP$%3rS&s{#yJv9*^Qs|j_DFX2vOGbi^~fuX zq>+=G;MiJ2603Cvh3acqLnQ8;^vlvF>oAqN04;2n-jgImnH969HeFw$5s4a9MPEs$ z@jiMcIFeKs?U9sf+t9M^6N?KI(@V~~MI6YpSuDD$Z+U!lYa}#pFL3Dz%0JjGxLPPr3e?IKH|3l{2|_jUsBkfckl&SCvKVH?ZW%7^mckHwPksF)HwJs?o2Jb zWrk_3ns;w2!!e0|hA0Bn!03w12-7{VeGGN8SbPpq9+S?4TbWg+1u(Jz;b4ZV0;kiG z-pQ<6;UugeDp*1k0?>A@Qg^Ox7<45Q-cwL0b`{5;S7e&jZcjg1*Y3no9)QWOZNnwlFhc|9RABRwOAMFWCMHLSVur5 z0C3`4gM#9_7?RG293^-EUEtxqp5_962b-U@ACkjKvMFNYn zTKz|P1D70YbU){67A5Q>8OK-=(@oafQuur;5ojf-P;iP*wEGT9h!aJ3IF$2n?Q#|lkpy+aIrU8{NYXy176 z8I6wEkSAWdInyNFuq$A@}9rK18NY%E7jM^q=RVyr)_9$BW{(pR(2fP*4 zwf|?g>2rFyyofjJZufX5jWr-RYw8FK_4ED}=S5$T_4>)=dfNePqyAd`@psBTksI}b`i{qG zg_eHegYYih>Ky!4?w7xRUnxmRfVxYn*i&o6lxAMtTIRKNdMD$3JcX(LKz?x8fF5Pz z_~QYx*^){Y5kibGn-3HR4WAJ__6?Z9ZZy3$7OOlbub=Mk9>@)j7--}9>{(usa#@aH z!F~{*Dpc3taF~932He3$3I}rodT<8M>GiOy-bu_(cB%HMk)uiCv%0W9!BrUnX667c zA=>{~6mXRR2y$sa?>}Q88tmo!2Xo#bN@EA!9kE~kzR|!ggFErKGXu0Tp#Ln~dxZQN z@fLHBPy=%YA62vcof3ZB=Y%KlBUG7dx;p6|E~LPZ$Hkk z-5%@fw7OQuTe9x&Lb;C@i!GhLjDFo^9_v!?bc%QFt9Lp9c5V^+Zt349%?;A*Zq^I) zWteQG_e7{34aH-j_b^ioR<}ZU7#V-PxJ!N9DL%2^{#d{dYFc~|bHF8%YaW*8sMJ@t>wHRq)t zI!6W{#QKuF-l)Z0I=PN`s)|5jUs_g|Skp6Nfr~JK?$6po-xQnMW0M{}`5;uhDgS0u zyuzd&vFTiW8Z4_Q^d1cK zCLNz<#2Uj4*G~i!D$#>7dJNQgxKwABX+!tY7nrND>;R-dtk*5S=*IWS5Gu2CBTC}p zGK{h1bE3X;A*U+e5cS^}g^74J+2!dZd%X@f;n^4Gm*0>2KZrnt?i7P2B*x&1tG&_# z;M)@_8Xq<8Z$fy};`ix@YLkykk~ts4%oy(*D~f4%%0&6zytfn#`E=JOs#9t9t|v%< zZr4|J$)9!kS9PhMbpToh zZLaqq@Os0QFS_Q>E<6Dn$bVQd|Jj(IgRp{YBVfk7OW}^MqvuTK1tXrfOY)}}kk8MU zlBsZ%=f$?+z=5v7aFv%Exy<+{h2mslSiVL6Yf3C3t6HAEPIUGpN?xLWX5+Q_q!qdUJak+-l=|IWPA`z1Iw$ zXTHSQd|7-Y5ml-bNADef$?R>|pL{9Yd&GX;z6b12AmHoA9@uw4^*Rj;wqS|KR)bXzZx(t7GQ; z@KN<6|G$%;$RGP~(H=X2-|&_Q|2WaLOsJ&-)?v0iCkXF&QCKd#6GiS+5eN^$$&-aS zNfaC09~eNPD}*{-G@dCkX9)Ui{|{N8Cpu~$gP)iAzEa>LkF4?=Vu=_T7rq)F9939b$x zmM$txr8^l*vIk4DUyOra-`a;`zLC0d1-fM%+@Bh_-RZW=*$M|9OvtggH6@68FSL6WW9uM3tL2;9+De_y|p_h2g zHLtqEImNOZ{*v)u1X_+J1;i6RVay+hHh0jvDtyS82Mr{GbS2I*f>HZ0FE?G|nk!s! zCG&#CkI_za`Z8Bsp1#h&%IsEl+UAa}PMgm(Ny1LQv;{xBVLQ*PO#_F%xY(NFpBd7| zT9-xgCk*MN5mvtMK^wRiQ)G_@Q~ht6cZ;SL&k%O%&W}t5ci^oxFX&F|p0zs%Z&x?a za+n;26jk>5KCIKNrzZHD`8Biu0FOofn$s`&MeJE%XrD)QP496o15V5^D7QP~Dc|;h3#Q@FvwDf>SgBUKuwXW=v zmXy)Y%g==HegHGC2z;Ws2_;#D;a#idxGl1jVfAm-Ko+gtAo-xCJy>G=SCDtWpS=fj zz83C}W0e)>_$fHVULlzf@nq=zF$9?RV(7gaic>=GG**8Y4oF#9E2D+f5`BEak3s^4 z99Q!P$jc%=T-Z}R&!)L7$Z!tuLZ-Uyd|Y&vh&`Oktx-ZW#g1HJ3;bBY`aIV2+`;Ck zvrKjNkmRulHB>~$?`ko|1SfC_-n+9=7BVo3g~rxz>msX~%?HDqQlK+yH@u1@!-GMU zCwL-M2B3cEHYWqy?!l`mLUJ#8sx`mZ3+z-8A%t&Y1*8o27gvaRHg7D}ipvNFrcaVJ zgm0G!3I=Xca4mAfO_T*p9$?_pDsh-5Xl^H|J(mi33D((sl9>j2%_7*c1l@qulHa3} zOz4*NNv37$^a!!=n!X|MuoEuG%3(HY*2{%Kcay3DqweAIZx`#~ zE=&b}cP(Nx2AYE<(66+{`$qf0l++sX$C?UFz1N@R&l@%Izv83w{Se%LhA6;m>vUcs zhK03ENhLN2R}oW^#)?V&&c4Q=)BbA&cx;t))b2qK`v8}y?-zQrjS73K7SO@-f(72{ z8Y#j>_L;|P9TWe9F&2(76+f#Wj9hFf60SY$-?9vRD3ac7ityt!E;U+SF6Ee^OJ71t z<#D-w#B4IQtint)m|BVIhL9^6^lbx7E?NG(U?N13G))HVOjs0{3a-879H2Q?XDYVb zj#-9E$M)%#z+$$7^jOv`Iw<2tR3j5YB&bOh8-pa1gY-0Xhr6~1PR-?C&Tm_ifv?s2 z`()Iiy4jKYa+Gdvfw!M-BWCb9K^td@+kJRVj$XT7D#WSc--=?XFpk*Q(fis+oV`$h zQkGkY@GxfP(B)9nYU-0<#n9kCOROORu|#}5Lttsj=ybbtx-F#JNptjWM>?C`0-$$0 z6-9GA5I8`u+=0WQmh3rY45Osp6K0OS4EH z0fdU9*%V8`S7n(m%>h3#B(1BI4UqKFNn19HNj5?<9uKJ%O%j{YHoO$<%uR}uLP}#k z31}s_Lq29rh#CFUthB;n;r~(;Xth1`6FXXLXIYN3dpbBe5YQo*=XbdbF+TyTvqTWg{m3iC zmfyd^Oam_t9?cdCMqctMDVnjtK|aH{3W8u-OW#F zoD=UxXqG$g&N*VYZs$TvAMvKeLQxo+iKFG^@Qd>Cvbe;8j^Z~wcWW8az^{b|+k)zX z%)wFRe_S?EiN3+V!fRY8lm;6}Be;Y=ulA0|6;WB)g(CmRc!ctX;)Y z+Cn+bu_VmI&brN(Hq!J(eN367txbAOu2^WUo;Astv=`x>9_Jy-xGmKe-OcxqlWRm@ zxpS1-NGY*7%h`@AOS%D6DqOqOo1?D%*83Q$H!|6h^!Nfi4nlnX}f??&#NZOZ!|EIS%zN+=%c zL)Vhx{S_>N=+o`c-q@vUD~-wP7^a7nebV7fDh+sp-3#>su`t`8nJH(PQP~BRS!!lw zRy0%0s+p$Vg(AciY+K+jGz(@RmY6R!5dX^!WTAC5gJK`>P1z{}K2gKsU^tKrCVbN6 zQ)ESU@xEdDll0K0U(Jj;u$uKb6SkjUZ(Y#qEJb^pmmbO*gj|f0d|h1+whyT0htBkCIpWW<9-rv0#O{jYuM4 zkTt%)7BG;y+AA*iOq035PcHP$1phsIc+(@E_HoeF9?YrtE#I>Dk#Ekh^!X=8a%sfr zoBNGgk(%U~*wK%_E9fpXV$6x+i}LeqN4k-NN3w}-W{nSw8YcQyi6)-Kf_Ll370|A$T8mm$8`YRN*< za`;n3y&V3&p}P2$e%fo zzO2s5Y#W?IB}EJDAdIs|JL@uC)(w&8#_BA1{%r4M@?_VEay?{!LM)fY?g~VLd3{RU zbt)!(v=6l|UoPQVLtlrDXbXKJ%mBcUtvE8YgEV>8+XOh(&i(372 z>36YSN`U&{!JyXO#~ou?c5_O+95M{TYv9?98AjpeOncCn_lNs{G|cv<4-VlZ%0vTZ zzw*o0fm$8Q^Q;4PDSZqfBNd zMJCOJ@>_SV6?PZJ`P89<7SPmL$a(VnVzT9D?9%_qfQjTUSUvygEzg<_bVR-4JOMOs z4;xt+N>LC-tS2ZkvP(Q@6@3`wQ1oF!D<*~lm<#4oaUjLxR+}=o!9$K&&Bbb?zcK4V zH+X$k`9%k?B=kFzRto3YENx=t++5T+(w5k^3fyMSqW^>;;vi+Ezkwz4!W1^EwS9hx*bv~sftnZlFv=)rvR>S4H7~Ah zG(!2cgeHNm()(NOO-g28rGS;4;}y=vK+a=12E)Q`uLu8SKut0`s2z#;>Ubxf5A*Z+ z-4nA7xppCa!$_0S0!Y-5Ye?v9xgi+qIJ4RJj!1ue%#>6-gXwk-MY5B|w|Z@BDTygC zj`1fzlLqE*iMIqecfQiiQjJB3C)p}U|HIUgG;dpn?n+IBo#YqgxS9`PGcI%0UXF7- zX4F@#8S3FVraEDxym_eW(*^!rmU`h4+4eB>A(Lje`fbJWW;;9iO}2||lD)jP$Q+cu zI5gc>2W+3ekOjvh&EyS2!ZSuq{>f%p_`MXHZHI{L5Bk3Ekv@tCd0jb4M!U$(()?cb zvFETq3y}hJ&3oczG0U6j)^$uxyL@hiYF+S6=geYLTYIB!@J`A4r)7)(D3~QQ?P3U= zl(#Fy$;D17ZpboSlQ#;`cobbA-^83FH}5w}?=c))JibB$z~|Dn={MdgW}!6yc8#%Tyk=xH%o&p6*;#s@`Apx;V{!)Y%1AzJF!C6Vkrmx#MxkbIFUL zE#`Q(;K!~Ty(6MG1deh91mYPHJs_|pqZ>tGer19g53klgN`;R~;=>YMFtW8S7)@z! z=Ld2SX19&lK!uny___$5}ZcUY`IHo6XFo zJqMTyRx_^)>p6)!GEG7>zNQp0~T zSRnKb1wT`sItIWm-o)N1@nkWz5=EosR09$uo_5#_l$$WqZx*w?o!ni~h+mL9qY>v+ z(_ZWUV`<#03kIngvCaJR%sfW^fo%uOb0+P}ko-`1;a=oB#XvAPcU07$8|n3Zi|3OW zvZn~TN;F_%9Zf-5q12TC4Y;99XE5&(S_>P~$_QgIvqnd-0_}vU@`sXsswAE)1?#oB zG3Vc%=o_iICgKimCeUqvDnuU@axa#>KbGb161_R)W+@jE-{NX$L@D)U<=~D{;W^a+ zQh{89xF}CjDt@7Cp3Lf}vLV*eI^TUJ8`L<3ugtKbB2U)Tlj7v$I65)TERTu6{-YTF zli8B>y}R?p2lCh@SH$s!ktrt=<_#I<&l) z%Z{_J^~}{IDq?d48mOzJ7Y=ClXe!nXZJ*GpI{)<)xjD$)rE?pQzYr9$YuoV2e7l4} zK(-~V5s!XX*xAri?2e#r`KHxK-eS3h<&oR5LcYwLw(;6Yqi7-T^Y@56$~|)AQMn^2 zn1%-{4p!S8bDT>Xn7b|L`$r3zdx@6m-xo4l3Z03m6p4RT-DqMw$%GZcL&k4LnF6w> zroslDsxtbfe=za50^ZA-qPw<8uP)*c%S7WZi@7_C=A3Niwv2ykCcc9@i3HamJP=Ki zQMB`;6#{iZ9LuMn-3`JAEU8Q>ey`|$Ky{jd@+J4A1*O|bL-RXK$h2naN5JgFO;Xds zvuxk4>iy&=3ec8qf0$ufX4E4v5ztGV#9~@~=>x!DjXMQ1ie0E?yen`tM>vx@wkgbD zW*L8>{J+im)&=EMf7@-C9dMp)0)w@t!CTwlUf+O1c&#d*uLd7g$yny_(f(0UZ`0F} ztmre9Xlq41M@j3yRSj3=36@y{?(PPwd>?3{K=1vEwUuszw08K=kUBm^olTWv<>8`# zsQTj+uGWSMU|b*^3yhD)k%G=7YM z@C|3u-l#!oRiSf7iv|K@wH6GDY;o?fwXKdK!Te~G-qIv4t8lIQsU{-s->?M8_&}Tx z+w`u@pPy>k7sLTf>6fLmyp^z{MKUsB@r5+3Vf=vGZKWEBtAwsvN~BuA;2y#W)_#$9 z3+sUuFw88WJhNf`^z^7Fi38f4N&ghiZ5*{3)k$fYt-Iz#U7D321^XFut#&X#YfQyM z2{Ey&pm!$!mmX@-jp_&#&tlPWEJJEm%_CpXn@*iSSkou`Mg}*zV?nS`F7Ws}$hoqe z`;GCA4r~cdujpkJu@ow;U|Gcw_fKd&j>mCwN6gZNokmd~5GYrlh(@4SNtbRiP=UEp z?G?OV(O@o4sE9A4x+zuw!LpC|eY2fSANiRJE8+q)Dn96vN^o37E~$9OSL6v5uch>@ zcx1`qSZkN|YFcMCOpcMT)qacinY_apsz2eEKB!((#Q$b70}ueqHg=+H0FpD_>ksXS z$tNP577+4ge})`aM==0m?(x^m*r}n|7riZOGHN@v)tNM{E~AE2M!)@3MqLYbc0NEh z!H{g8uINW9;$bVBN33j~OeOPDyBIbkn~EP#U|eml$7X*DwxDX|vAII(22@QdkPcwF z7uX*4RwA!d#LE>bpS1r%B|1;U2Nw+4`kD|fRQCRMB7`=$l;liW#PObG#9fCNPC^Xh z?HX4TLxU9q^$1oFBfXF$JRDASVa)!FFuIBnLZ~5D7lTDS)-F+EPadYRKym$XwvcYu zh*T)<0=+O;FneK+5!1dPwr~9?Go+1be)4SRla4~6F)JQSo7F$kL5%rt_5$NO0pJCM z(u`qJkdDY>Yr){n#IWnp=e2fmbJ|e;qYnQI5Xse~_Xgz))<v{8DQ=SRfr4&S?;yfa%xYK`vFKuNjmn`vtr+5`A|K@|=~*a|H5CydzR^W`i+t zi_9R%*5n&CJ@>kWNix<73mfZkmfComTR;8m!kTiL<-F8YxTvvlZKL>k2kIyOMHl1h znKnDFF72`=nEluH%SOGaQQQp~SFouudvjxEL!-EbC6P1#MWfriZ8)5ib~drYVUe6- z>Vv?d_Y1O-{1TET3CuQ_iwP)VTHa#B2zocnN>4ji%Qj8Pa?d;FK-D~n0 z0Y7Zg%WSmgNk+STNJjV9wPgGo8QdfFpJmX8+Jwm!)HTkT%EVTwhlG7+Zqw#?R?PMm z`EyZI=b`#NV_+oH8?rVsaKrF^wOWv#&4EWBz^0zeXs-?1}CI4CP#eFipW-P5P!L@$)96c~g^lx;fa|ocyxWD*t=C#V;u>_14nx zgJhg>tA2cyO0H0Pi^`s3>WYpvb0vY&n&$6VWyB>N+%K!>-fj|qYDz<>Z#B`B>!dDw zOPR)Rbcxry(%JAzm%Y*4-G6p78!j=~w`@s(Z^Q1N7n;A$7l znng=1lxsY1k4Z}&QX9jk+A&tRNoo9Or=QW#E&Enehg4g#j zhW}u%GFjadT;Hs3Y8F3lw$g5nuV~I()hvF-E5`1X&0Y~xse|!4QcfDGvmooic%=|$ z+jvc=W3P=@PSzSfqS=|0-s((yYbn(ZiL+`rX|>mTti;n^j(_=Lnle16+e-V7!)!0d z)FA&l_PCf|o`+r2ntru5GxvAy7+Ihbwm4;kJ;Z4vxrUpE+3$YTXXjuJrtosI&Bg)A zhmF(AnYYmyG_`U{qfgoZs{p?_<@n){*mb*zR_k~^H24gy_;#4IrRP~ed6Q3Pv4JE?WdOD`Cju_Y)?{xg*6npLsuXDen`!`SsBEFCQr``^@|CP5mZrV6fTu^L&59 zNO8+&-p~Ao?~CV$zP)Lrxcf8j#*g%yocPPoyIV$z$3Oe-OZ~Ei%ChrD*02BXBgNlp z?|;B?M%baTViXlcr+iv<_$F+LtPuJNw^p*#Dz9`c1>2NQ7df8ggHC*YhBARtTY_PG zX_|7{6uUMT*_UfCbg{z7Os^PbKa=Upj!M5XT8v4*vt8Tv97$#-iz(^*(_9--kr~k9 z>HE95yQQz^iapcUdlkNvzW%D%r}e9}*_83uU^>GlUv#ZLg5kMX4Avf6YY$%S;R{q# z5p_<7#8R7Kh_k5`kj?Wv$u4j<4-`Vr^V?fVb%1f`lAVx3(8N*6as>`#tz9)A)|svx`Ss;lDNju?VI51frIvJMJ5Z+R1yr+Q+-ebpug3n34bL_>enNGnVL1 zM$YeIApsS$v!J&UDY?NsA!k|xwAFI_P^w}901|S?Qfe`Ix*wPl1yeXDZK@oOhG0pC zZK#$8lu|bVg@*L6hYTj7LATO45d$iz_QtWug6v56Ei32T;aO7mG*t?nNkxR0&+eLv zbDZJc$5^JPxoUP>s=!ppWP?-M_h^4>K) z;aZgJz{Mh6JPVW(O`4JZj#VP$(mYWA#YX;mq_B65|4F*)1 z7NYv^`C?`Id%MaBRO?es={Pg&xK-8)%6k1Z#rmp^bcp$5V&-D)T}p!j zM$aYMTt)cVxYSAIg5ylMjIuNF56xrg6hUoIutA#~Jf{QspzzggwS3EsRSW;2J7D+* z(>qwBCrsq&+`|v`y_WfNfY2e$`OH)VRPpkJj6-i{xTjlUk_S}Mk0(~w0zz+AANsr4_!fY959-3=DyiCOJ9BSUp9r~Ob|1013*J)<;-sY@h9O7>8!M7srL*=OMbArhH~bsn-s+Y%~{6Dm6L(LqE%E4ga6n?L*bAq+7P zw`TKh*c?m=bHQl7l_TSmAxypo_P*FbzQcbPX($(_m6mS=g%D$k-H&h^9}RPrjNp5{6t+}UST%TucSq{{q} z^0+2hxXANP_T>F4*{lF(KdhP`QsoC#<`Lell3g$SO+f=hrHi=QG<@Jyy$-&x)=MDb z+N$V+P)Zd<@RA~b^;?-hx^_S8w7$r!7V%XcO%{@ORq~GNep{9Pq%!Zqx>ki~-MpuI zH(0BnmX>)b4H7Pss5x|a7atjP_ZCZR>jOI2RaL9oYqdm^ZctkZ8{P;J`YQFD+pyIg zv}u|~LYTH-O55n67m!sI@NS~gy|%C=C=(Xk!3Ou4O--5Rq@2kl2NRbj=R@>xVuM#r z04SJB37H4wt^&o;^ks`XMMu(}bac0uIx_7$bi_d%CBcYP#dPe_j(!QQ}^$ihK<|r!v1yTe(h!Hz>1CasN+IxWi9-@dIv<%R|5!Px34NM$Sw5Rr)FX zF3esU;yG?sfk|#x!5u2TUCGV%o5Nft!ylFRw308V@OgR!$p!KtqTR&)3jy>?SBF)q zv#t)C#x^_~W;-^KCzSC9d!XwTUB%eS-_#EDxKiLk!bg<%urgaz_&5N!{PDscfCh>| z0weVI2I$m3je_MDZcw&|C z|LU2y=P|mjCoW=DwSagdBsiC0T7_=e^jY(f9AH8h5oI!D1TpA|+(jhtdtws}XkX=d z1VE)&ff?P_Ohr*8V?ls+RCM_p4drS84k&Dj8jq7rVWVjQqF04oESby~8|by&5LcoA z4JbR3qN%u@36`=Xm3FOes{(*-avQoo62mIJ;V{gW5w--(?JJYSG$X^lUDDY%|HygF zg#&+M!{!Sc2TFr3Rh85<@@SvCg8=aT9(wbs?^hHE-eTwTGbg@CR`$=li-GXc|0EI$PmkA{TsoTsk4Hz7vI?M2&9w zUK#&Z5=;sol;)ktj__BNSrwZb{K8F`-4+?I*N{52q+zUE7-{4nNR-D#y2W*cmY?Zd z@;RQ)>>D-gCiADnnN#E4W&Uu)J#g|m`oX;OeH_gWwQHIxnD#0Zxxqo3lD_z zY=wNsTBpt27_bDsIG92A9n9<>a^UZgLtEfHWx-CacS~H_V9#7MVC00yCmogC600$n zCdu+7cs~wOS+IniP5ajPo}jQP(7z1)jX@*S&54!N9q<@|>&xF3=$nIZL(uw<*n0uT zQd|}!R|Vb~iC4*ORz(!u>q&fv7Po8tR#F_*LykLW_)TDb9b_?BuTeC+Qj|EY)Wt1H zUKP@VM})yJIUWj<2ZP3k0{y$ddm!j|IOsi%1)*-VKae`RD!Z)LU*eXP^9#AkMg_-*DC;2**Kub zd1E^US;?wNR9nfmiW-!Yd-Zz=`FaPB1O*wKwH=N%BAv z+>&^|O5EeanrZQry)P$)g;T@ilu$2+uGqrilKT_ywnTgwB#T3C&&NT2Ntggy`~+PN zn|l}1zbuST3!C`dLkUemTCTS0S)Un-_kF$1mI&U+m_PZ+)uyi=O{u!yIoMKcLX8%>;nX(2Ezs_>a6Bq_gUIp?Sx5``9~ z4rpE)3qyL*Y#I``*qZC;)Nyyv6`=SU`O}?ayKHaQ)U<#UICnGoE#l3dvk+R3f98@f zZf$InWtMYrVc7D(f-J?cLIxzq;2Bey(7NO8idH!^WPH<*Mf2HK|{_w1>#Kj(a5Kcbe;*%B2U_DzO*y^;GDT)W<5IBxe)zSL{P? zr$*CM3cW+rp|sJ-Rlm*Ne*SU<8KgK`7J(4kV+N;dy+W(s*~S}%+l|7JJHY&h!Hw{V zl~$1(;rK&hZ4TXbs1-{6#b&f?hm-mzpF7wRT||r5PR379=0KmKJo-yy)C7F*-xDJz zuHep))6I-vyKua_9hr)BpV|%X_ONYQq5e7-s~K|l?62$Z?%|Q!NTFWQQAzzH$)35L zOinexJfz(pn}dz<4lui#!{*}fZ^IrwN~1K#nIli}f;V-%HkjC&c)Y@%66 zrouO@b#4X3cgP9Wv+qOzsF23Cu;j%%4q8~R(tH|j5PN)TN^76D9d@y!u$rv9ZrisG zK%u0P*>=VO<=V~631){oxw9?fk(x7NHYGRIZYY3`uy>F{_iQv$MA@VS%iO*r_{A7= ziHoxK#8x09_4V}I?}&-cl&K7RF{CQuZ0Xy<8FsB!D1}9 z?*B22-x1+xGbTSe9wSHlW5UsT`-D$)nXBl~K}pHT^F$+!EI|3(AjOSRUoWF)LA$~s zApa=U|G_V>Xifds~O7nu9ip9$|Sw3S=pA})mE<~ zy{ljXO?SR0?uMTlvsRZ`DsxFw*ay*E1K;dJ@@e7JmxvgSaHf>r6%Fq|W%U+0LyWC+ zM8hgEM*7ikdok9lJj70o;c}Wq(pXxfqb>Hh!IEFu3aFh@e>B*(ZFdeoQ8;_hu7lQq zRHQKxY>iw=NBPLwetYW*4|br9d96m`6^ypfwZkiVJhP-x?Luhud(QWO6rat)Co2qd z5}#@C`3fUfo46yn-GulK#F1qaWCiEhL_VP+pVloJPWb3k{K~Ra+22Xxu4Yo>srHH8 zEqU^IF0E1QLfp01r+cxOdo0V$ifwoWig?EN)uiu$|47>B~FR}UXVnge8Plkv83H9ZQBkgp9fW+zy_Aj_M?bwWoVW# z=|nL1#w0k1_I7U+?+wLA|31V89@QhKQ*6NWaBH7V=TFKJC_3D4MV;wXZ?aL)A9EW9 z$RWceM!+tF`hih3RZsJXhvm_qT{dDsAxTIVV+N2NpsmikR{FkIE>)6RbgT`j&IBvl zgX%qBjW~lJ2xj^Z3jb7sq3X+2@u+cLS=?^)3NZV?lG-`urqnNbO*P-eybKHBMwR&` zem4bvCS)YOE&Tp?h1Rbs?{yIXY>?_rp-~?}Rl9qI1Gvfe32~JY?`ypWT{l|Y2_+gg z97&Mayd+9@sD@t?2ig|6y_2C#xLUp~BunGbdP*%bJ5}AFb)v??o#dQq&R!upKICrQ zrOo1>uqTxqfHmA{?1Thtjt?*jw=GPSOTHK7AxcT!6q<{H?Ry4$P}oA2T87O&Evj_8 z*Ag`6yL4w)539b`eFA%)lCa(rMT==JmFN`;Y6#n4A!#$4IvdMhgt+V43l| zT0UbqI!esXr`y835zeAVr9%w|_(2+t(&IGLCE3wRMK;ARSxsM{Jj`_UUnjBy6}tOr zg7DfDUwMh3>tfoxsi1$%NV95qrF?dwId_D2y&}MOf>nC5teu4iKR4bb=qXtr+Ukrf7$E4_^lW5h zDWtdgboZu^G~zhlrmykWhNdz$zYJ5D#L?xn`C7uGaOGnQp#U~TFHL+=})LMT& zfm*TxHCrx&J8I2LLR>BAVEB+||3xozO4=keZx}Xd2_eca`5-R78q2q>VyGPj@>oZ3 zcA7tD7IkX29#_Jq{Rj7(~E8rsZd5j3)#y06T#!l_bF|_kCFZ( zz+Gy~3fjODAhAww7IBCFj&M(x6)e0YQ;59Sv7v6wpYv_G9ZJc@VJeD(9{|XU7HyEl zTcp2%elc?RXP%F9-qItj@n`!8fM7v#fo*(6OWopT>Hl65_`s7&S4Z|fFN-fp|3#@d z&>$#L*lbalG+2XDz_CbY%^!242#*Pb@JP|e8ROQo^v)Q^v>4_r`i?_y3_m116Z}kI zSJ7|M>m6FWceSNL-OQ56_Atn>tjx2pFJtE!#~AaKRP=@EZO&8z!uR3bg&x6Jn|oor zkSuEHfU(Fi$p$${bk)!Q`%Hh;cYGy!VJGYRoQh8@;%R;?il=H5o!(ti*cM;=I zfhv63zhI*E`zA0dIkk-5(L$267*#t?wSJtUGqrJ{zo6e)hOmG#{XzLpDf0b_THfvW zDi4he0+X6ev4n4Qv1OUzSWoNn6=_%wZ{6E>%}>; z{$!8(LiN z=2q^w*$>*VU`G6n%tb=&h8XTo$sj*)eX?z~NFe=2Fe7|Hkbg5WzjHjXBnL=_Q%#{O z%WSI_^>;zgjvITbbWf7vWT}pq(4TUGnGbXXd1Ani*)M~Q|DiqYjXIh|R{is*K#P^_ zD*0XPkg|aPKX{OJIJ?UIorEA(qx$pfO|9S@B)Aku$Y4HsoIB#_eG5-makDB0Cns$lljD$~lW&5Crc? z5pfc;a?_>q-?r`@9ZLTW7&0dyxJYlUm3Ful(hPB;L^QAg2}FpD9s%lBPxc4m;xyU+ z1Jc!vLk0C1mKdEODgZRQ&lzK^gh^=8$9aLd6hot&8q`Z_2DLlA;7sjcq+*C)3X=mw zsXy|5NTi+GliYEb45Xa_*x9L_d_+lcrr?%I*ACqd;0>@bjFpF3?v{eK>*KlNt%(h_ zI)r|#D?y>l`1B{Y(jMTsTJUwqY0TLe?9`(e{1;gXnW#0D(-Nqb5mZ~DG2c+g{R^MR zU96!Jl#6vEHk=1|-cW3BHDB&&n-@3FQm4tOpO~h>pKy1iTZ3DG(!#jKZA<3G>5_Rk z!JOHwf!pbNc7L9tQ6^nIG|Tzv>Z3_!`95Y%#ET;l9VD^{@>Cn;FkUV5&B;w2;jHy& zR>j*jtlIpOYD;|p2!Cn=V_>)RYMR)F9O@eAHqFl&z~MFcMDhmhUZblnMc(!Tj<=Kw zW;sbf%BOFz7ZCoPO1I!sm_Akr5VkJ4yX@r_rVuuWI}!Coh?>i@JO!Z*!HH?1QkqrLTS?*MnSSB7I_=-NL91J+B*4{^YG-$jM;${XlU>!E z+8&!6yH$I)p&{`r9l-%pI&RA=K+cXCX?r6m?g=Ub@4MDahCUGLSajtIp=%FwZ5N2C zvkujVh(oh)h~QS4YkWx_n&V~rA*TrE8n_b*WOA|v^8@{#;(IJ9*P7t$B=4w|}u0Kjyj9w;_yQOabTL$8yB6ZL%HBZBXGoY^-0ZwU>$P=|nwN z{9u;jfaSMAg@9q;i4jEclE9_xUDMiQ``Gtl1>~4@Gq+zBDRj7OeP?QBm7Ka#>W5_I zL8z#&3Nz0^77tXcHj->7*vDM`YEXHD=HTdI$JtZ%SR#{*KFn_V@g}f%Z9cW8jc&(C zsKeLAjIQ*#&$io{I%jD7&Pm5_Upkg|8XC)oIgf-iHX$zvOGmEg2Un0`BDnu|SN+Wr zKvPKinQ?8;4$^A7&unoGw2Za!ZuhVD)J5LE{qz&Ax!ChAB`{>uj^xxTYNDBhB@b~k zuZvwn3URTrB+^@LbeeqyeHH?r^O@Pw#cUyiX=jV>BGV0T7IUb+7m{f&IxLmQ3MzN& z#aO!j7_EUIXey=6XVR@U8HPnp<`ImCHu@`caiz+Wq91p4as%cjvfnCUFJJ`&Z*pI>o9sfJevxdAYjD77NC*O_ z_+H=BJJHR`73_WtZ!107_2NPTT^wYiz)LTobkeCF9TdGUq~ zewST~NM0}WV(61`*LV)*MPsLI4efwgIPc(I3PS zB8$B?GhJ~`t}W1eI2+<>DVxt>B#EEeenIi7xJh@y`-ry&XGfVg%ABlt-1Y{FFO1#( zoolzA9wEZ=5R8RF{X8Ke#r`S_48u$TSfWPj9CFwi(O&Q%I8*<%-tomsRZ|E#VpNKXmfHBU3VLF z@>=3oc+b?{i;AYr9V&u>s5Py6xK`+&h*9WJUBrAfKrGXWDdUxFu$x>R zk^~ro`5FWmF*yU{||4+TFv9-d+~QZa*}=|4O_9 z#whtyi=&up*l$~f{fqNoC)buS3Gr1Jk1B70Q>1M8A*(zW&0?^Tc6E>SoT&#mcQza_ zbd%>e7P^jybd%c?POr6*?t+Ao0vGGFMAT-W*&Ts0f z5YqL`qrtStf`&(f#%GD{`;nq?{4^4Sqk-vX1>NLi_;TRh8O*QE;UWYVwi0<|I%|N6 zmOb9-0^M?uoQfJC53H8$4wu11BDf8NGoe{<#r)bS$tUC*6vcMV)XSCgKvS0<%M_(5 z-tz<7#LJ+}j3~Ok{&7B>WCL?Kote(cYn4Y)yqWes*+)Jg!{Az2beiuM0`>;7M}Gvgp9in`z?Q;;NTg4U^OI{_Sp9!{^%Y?jKsLQMs zzFt_+&5c4`E8KMgMpRNCQQ6yOsSx$YQUUZA)XWsy6P21)VoDK~vA*~OIeW+#Kh{R* z{)@;Qr9|L3ZG>*dM$jqPg#cSwlS=Q2{GWw+PpIDsd8hC`5t8R0+4ez=?l3qyu9l^1 za9(V45U9@W?-1d0Zmx&yYR|WN=3&EoGm$@}0bCVpAL|g0%=J>e`(Ve!RJ?no+lF*o zYXcAgU7JB8zPIsz)2blZsax-sl}*yzEo94_rlGOBJ1&5JrdB-g~^#Cn(d92U<_(9H=psKf*mon%gZWcKh|@ zg%nJX+(bgpZsiu0YygNv&$C9=k-1AH0K2*g?~F*=v^*B=Vs@c<6*sfPoi2|P;TUj> z^>a}lk?pgIVIO2?I2_(WEa4C+j3-P4VyKz!Ahk*HY+yTv>?1EW_{-v}`d7m6UO`Wl z7y9A?gmS*WA~Jvdk^f#}cxGr$hxMZuFUWiIG-1wcF)N4_9c?yhyX*9pwRVW=G}T0P zRqeinY9dLg?NHjc39Q?8;?KSOHS_lZC@c(Em3&n9n2#TFJ-NA{#+NafOR$@1(tU zduR?)$c0#6kQiO4gYyUtiaV`a&N{dpk?WYACJU`QcfJrO=*&_bhT>GkDykne0gS%n z#eI)K+JhayRr;C7Oh|jte@X~qyx*FjQVIPlP3C7ttaHVGso#p=86|!%%)$Bx<~1QP z)GoJ2^ItdO1^a>HjQqZPrW+k54)<3Y_s83Wc6^$`fy7(LPQo&y<;NBr6ydhJyWu`;`8bzCF4O%F==-_i&_X>g| zs@ESGVPg4xwOcXf2y~H{;ig;Y1T7`pCQ(X7N$++9noYOd2)emfZxOi-qB9k4P27mS zCT`x#Wr5)#ir!A7g*~aBkik^(YXu!d?jq>}#PA_8Bh zJ|uWe0!Zxden|exK0Dl?4vqlOFi!lD&l>L0LqZ%U%`zF^Z%=hwg65~hrD@$}q2=r= zXwY>j?IG5#HFL+!wYZ(mlsI{{*QoK7wh{O8!wHUZXI9w2it?=-+ZVVoxhWiV>Du8U9q6GlX?K z&Jk*z@cYaZvDnJ%I3OP7w&fAM&Vu$nQ=bK?+Rq(VKGluJ*4)1miH6t zP2BfX?fQ1KkEM5lq;vF6H&HC!I)|~zP}Em)Fx3(HOPNE zt8Hj+LFOp!yI%{wGD{YMZNp$OO9#c@`b)J@U~wYFG&32f?>e&pvKcfZ2&*wRts!Qx z5BkX~$;@F;kr#8#UY6}@NBv#f4$Vlo#nMk7ntpmGXIA6H+@$iJVi$K>G^uBzo;2N| zX{l}e_n?=1#PbymwcZO*OYUPbS_k_;?s-o?<_*Y#ZMAkiXEUAd@6+wU2cddfV8i7( zQRdRghj=|iM@RtJ)2q>G&9Xn3os{DTiLdce-l7gYKf+$$sF}ZojBbm4c4RHd!P&@rDs_^>tsGfdF zn;L@i!t3em)_rYz%DEN(l0AdDxjh@^sy#P|x$&r^tJ7Jopj;sCK*T=8`5%OGWPqr) zfR9JI!&=bn*;2k3mIzW;Q0D}$)928E(kG=TOKFdkP1^PvIS2}fTAvh|_DRvV$KjT& zcXL(_Prow~qWg_meRWi)ae3Itw?NqB-}L0$Uh*d|c-PClS{X^bXdPGr!`AHDcuKbe-;sa>;8P9_!TIRC}EKTE!-P%yJ<)1*(` zXLP6IykIU>=A*;n6TeFiJJ|$ft@8`=VwjKsr33*ciwwt}Y=F|jqx?9epKE7I1O-`3 zRaPoxNfAYWI&ElDtR>*$65xTeJ16TY*~w~(n(R&qC&yEivq4fAX~S#C(?3<|;}x~x z+pF#HHO8qgffn!@QDia25iTRClaZU{cS+kx1;<6~DQ9-b0bBShPtI~+J*CBYiMXQZ zP|b#HKgcY?eSo44AvnD#dk6czVi^s9ag93V#55Gg zMR0>rb*>juha%EE3I3;bk``fvcQ~`VIW!^s$rJ-|E%rx=GpGA1>9*H-OlO9L?Xncy zZc`R!y%r0D!?@rxh5o59U*~7TtF#9P9&c_U<&Ojov&!K{?e$`j^ym@LxW?9Kw+TX$ z5RT=U;5Pw?S=taPw}@qXm?kD$!6Y$7;x~3aem9+umkMY0bYdo=;P0TOqWVAcoZi2A zF*%$POm3P|E%>$fxQt+Onb!auoM)*Ufw1jP;(y+))&gWvxmlQdk5a!rO8n+1>Q#UH z19jgIcx5&nrS3XPZ2WZJT}Op?9HmY=Qaq!=t;)S$sJledrC9Z#qosaP$On${??1{s zQ2z{5sP>uiw$DKKz8U1LEZMd)2(SZ0V&irE7nsIG=s~#CikHR&JP$$u zfr5ZJ?nSPNG&}WlXi}xDCx^RHD(7(^sroX`?8@Za6yaP>gdH>HDk;uzb8jicTt>{$ zc&4{|#^mWD+v3bF6vpN|Aya0cet+!IV5x@Izul};Ok~UMDaf(R9;@5tFOl<5hX)4f zw)cQu2247inx?qOT&B}NPx--Qe~RGwcb)q<3y6&@^Wx)1-D}j(WYY%e-Xfdsl=2Lv zR;z3~w{L0pYKo|N@< zQKjKi9yktaqCuE;?L}B|C@ z-8mxF1MYAl*v9NY_HYL@F=VBvr1j!EH6L%S7`{sS*DH$BIGvuAa=7y!8K7)_v%k#f zmud6L65rX=6bVvrv|JQ6%PPQBpZke< zN*v2_>QJfTHtNzCSs0#ioVoH)%U@4rn*E9`r(4`~rubJQgK0(6{QBb=y8h&Dae7k& zzi}ewbabvb;1yAL*@EYhL*^CXzl;k>v(;8^MAAf@T0sz)_dUN!CPjP+Vx^wn1%Y^H zwx=7NAJW`4o7YXC;pO&}CD7L*?v#Z&>WeO6wy{ziL%PA=!JnELNzQ{P8*8>_eHe#_i2rh+XSxBKoMvM`!-u+0@l;$Ff9 zHUS}@r;Z$*CwQk-Z$`#%xm#(vt zb_N=+fX)jZcfy|XK~Rse5trHFPHJ|3qS&68{e)>YX@TbB*!@t1SuJay?~JWwp_n$P zvr~Hf6=G)HP@A1T@(UEHUjx>bHiE2MZal$fm9_`7^dbFnCmZg!_V}{87X3DAz~^f} za_$6PH80H$*Byw%ZJ3w7K4OaH@NcGYaf4iQ4n%uD$SF}*hzGcIFn>?Z9?BYG@)-~LYFw| zGh(OA?DfLgA`4@{al^JK&ejvp(1QgWv+*A)z+RDm(^oP-|H=Uj+Jfquu+2zgzH;<0 z>WT6bF~t93Tagc7OpFGNTX8dV%S)%$fnPj;%Ua~JwbD4!d6#(N49ql(G~`zAK(4Qr zHeW1G7WQVY5J%M>ZmYkn=Z#m^Usf$a_$tvDV+qg{{?FR6ErUtNNco}+U*Ob`HHgb! zF~RplK5*=Wbj%~k$c)SCabp>5{C-;bGm~}Ejq?MRVu+Tx93sxJwvvhGApIsPe9EW4 z1Y4KWg;P>KBjqllt41Gl7SeuNT}iRZWhy?QIMV7@40n>?oS2pTm}kUju4+a!y^piL zOgdX=WRV*Y4euim&X}}xZE*7?jc#T~s&Pz1+{XgpZ41^BX~kn2A&I+2Dh<{vQlBl=*brJ%XhCI(>7PZ2ATBJTxQl4qP(dLY6%~#9ig8y|Tw|i5 zNsQvk?{jbUAm+`R|Noh1s;aB2t8U$U?zw0Ao^y;lkmeLlMSMa^0TclMM)Wh~8{uOmW((4(rE&E~vK-*4N6P=yzzJ*{0;H^TqMT@(^;am=OKjj{o<$fbp2ydlGuMp^&sF~PlkJ~DU zQ_n0D$kJ?UmI`8&(zoFa3F~u3x;jHu$2Kkxe#8wfGL0`oC90d2dd^|wOvf*~&~q1) zCeDQ!p8|9ix{0_wUboktnjvQfPKfAIM`8)vEzOUaf#DB@h5#&)=3?xH{2d!U#j!r~ z!XHWVpR#C?bWdgxR+5aj2mz;9C6>ZANe&37iy*$#CmvM=#08$1=YHvhjtcc#z=2C_ z{3f_Xz2pxqYnDvqvqSFaJBTDQjH9fZEpf9HoG!uVejur0%wH+DDZ-9O<2O;>M9V#n zzBj4YvGrfQY=J}|^hQp~23%o1<_rKgT;^NiUuj1RdkDXUBmDv>=!79tL_D`(w4P2c%-b1Bq{V+hjvqygrSX9&gdYU(ELHzp*Z$%wnfJ5 zwkh^hF(owBp5jkUBBh)_aRSo2#MP6z&-d)3F=777t70t`KMw;y2LAmk^VdXmX$J|B zXJlYa65Oq_2@o7$7&8Ds3}tM&hY@d6m^;3P!=1GRn@J>JY~#2+_)Q- zg*HKH11K)5d@tOtMcV`6Tyw#C!RijyFTF`Thw)5J1hI@*j4*_Hm_>4`@S(+r*{2D6 zG#$EMxOdiJA)T>m8TrSLv=1c_LT^}spjxdaF@mlhP93af`)u3ZWr>%($O0LrqyTNK z#S@V%3*`u}RtzC$TV&OiBpQj@ZXH-;OAvCvEcGy5+1?Ko@*+v`k!p3TPp!QR7b#kq zU9&JcfQq!fE%Itjdsl2Zb~OaUSZP5|WfG=$ya-ORS})PfCOK-nWH0~fbO2x@ACM!0v`_C0ncVA1)S8xG0a2r$Xc;MWpuVohW)CD&$?E2>qgNwbZfSwjC(7Fy$`O zVIoVU#oRkwZ6KDD}%##)qEX*F%JoRiwi=_PPNY( zvsbY6Agd*_NDzo_nW>CW&|}tuc9Mu{Xgo(IzLLv?dynjT9@1i+8n5dWQ1! zkCgvoYN%7*`UrJF&DB$+CU=XiY*$;R-)+*k1NWVZ!N@xfPs}=m!%$xdy~wQaV9seb zs=Fs(Rw|BANn#fZvRUX(v(3x7f7F?Hmstr94?;8o@bwk8+Mq`wieT#TOhMt$_Ql^SvGL-`t ze{skzPDt$i5|&*>0u>uGLzRDWH1rrV5Q~SE$rAVvpo7qv?@5q~fxU)~IUXk2 zAX@@*YBZl0s=f$Vh>+k(ia*cK%~Q;823y8@2}%utQmotFiz9vET;ndT?Aj6W%ag6`;5zgT)GW<>Z8>E?M2|wfr?{GZiS0z&0Oz(D6-Uocz zGRgd-k^nsmoDDqZotC`OB2Ls?A*}~}^AS~s)v{f+rW z^I9O0%P0nBZj|mO8PUkx){XLzO)|O>ioH8I2GS6B#*6NbWB+h6C&!${0N0iYRS)XY zgtX+GUOc)zzL&6G){D;%Eflsb!o;X%81I=Y zf%_ZZ0LjzBY`RQ=UQ|5?1+r~*4?z*;Etnxa1I*HpG5ZI`%5;@11Nej8tv@&fP=Qb)JxaM}cKKhC%#UB_+8XcNJD zLn@!gPhdWE)^KWR738q_m1>4RmyRK`lxjNS?JK9eHSjgE($DOn0GN5zxEsE849BG&@BRq-lvwAheH?vAI25k1eV zdSm6dN8t?3a6|q7=z++D=A7KQuXzN~1Ld z#C0XLN!3DiCV7*D&1np^=Jn8IROe%5oya|xk3;hq|{^rrX; zd`woW{zdUqd}XQPBni3_(?zSXDcgchS_Xu;#8XM>zO?fo*ARy%(U%>9gX4H#fcuR3 z0>qG$^s|1zZ`+O6vY47E*mXdwOB9R~ewiW*g{R^VHV&{3QIA!JKj0qi`td7~g_JFe zDR#(|#MHx$53CC3#MYFOcw~eX$f4L&)81*un!;;$Ti+!{os);)2|irkto`9Y zoK}u<(Q`0cZhNlezJc^J#`qJEN~%lAQi?Ky*n}eS076t@C@4>QAu z^X2@+ywG7Y4;`FOa@#}O^tK0yEj&NMXWht2si~$G)zqiNk?x`6!D5no@UvX_%bff; zSM(_fm%>(?ZH0$fSK)0rBa*l_;#G@<#g0|2EJdMM$XZ-X`asILW|^>&Y}e&S%KHhyhYiMK85IGgh+0ww7JrV>~#|PMAEg#8?)oa=Olz-RBeR&NI{THl9wwA$DcTcf=~|YEd=?LV85dvh332|@xaqVnNtnwLVrfFv zbvijg4dBJ(B@nMTU~iqrvZ)n`(CUO(1?S}lXC}RR%y6i(n{4$|n&i2P+I9fb8x8BTKZ!q1CD)y$$KD!xr(ZjRl-s8Dg68 zQ68gGO}yH!@otWoWO{P21l|=f@8-z!{1z{&MKC3&9HS(#W>6rUi6NCo@!Hlf)eL<% z*2Zai=8{)WJykskPC+g#ku&ZqL7aOtV!q8?qe@NnR2+{d)kZm<%K9Fx1De3%_p#9 zDfOwCMj%=t ziM6~GlJwD)g|^Kpw5`Or9v>{(6;AQ2g`QZXTDH*3hKspRpuo9{ywDe}Am&B2Y@z4m z>CJ$wFVpy#5(<^0W$7kd1s|&{G+|Dm2?gIv^#Dzn53)(^oOxN}XhIft5?f8Ga^);% zIis)XBx3BigTi~LpqVtCgylB`Z=b@uV}R3KK0y%-$Ha1NJSf&3gQK07obwBP@A>mG z#?ckjI8L^e50j16!=m1AjL${N!hp0)SPKcwcJFa@1y%n>Q(i*FZC7QSUCAnDJJv=z z+%eOnB*=V)b-*?RlLHcUP@qoyl?PYQ%A}W6(-O%lYW}8xw;re9*2pret-?Y5Mntuv zzpZ;dPL1(wtC-911;{A=!56z3sFPn#_xJfn>2HWPgn{AP1)A@@ShU5Oom?ok* z##7)d$yi@V-CCD1KUty z4v29IM?l*C_iV8X#1QoJH#-(e{w(7ny9UuIKp|N_+vE&@&(BKP0bVrk^DXZROwusE zt*I%FTOF$k!j2E%A!H}%ICAB|Gwi5H5yqz0=cEb)CQ(uhy}HQEBDC3Nx~$ABHLIW} z$Ep=I3WnFwVAeas+(tRVq=qaOwx$ExV{M|9@7lyD23p2C#hCI=@bd_I?M-b0iSg(@ z<3^Bt+9qvd91P4_?b5gfUXj z5C31AeY&u(6rpd5S>f5F)PK|pt+5zfpdk+-{);EnXKNM3%l(Her_{-VS`TLLSy~q) z^d>8gq!r9xl_QIUz`#rJssmo1%Y3kj>sFA36iAa0IpWL|>Vr%rgK(Vo1vrHeD^lH+ z#?dJf0ExCq?TTz8RVlr#YOB@f!fmPcO5-LwwY-!l_JyTlQK^esjR5YHc;T~3#c4W# z_DmB05<#U_)-M@wRb9#aL!Np-A?n|pY>6#-v{YUHre-6Hmve1C^=KYGT;NB_?_qq; zs+21Qt0d=@jq+;V>H>ML+ssGgR;A{8azsHa395CFiWLG<~G zSF9j@o>!E-PH%fw=R2z4xI1{=-^9S2mLDFxdR<$zy~5aOr*@Rc=S##3C75S;)sU0* z(r+T+hMy|2pP)L1zdm26cmWjkVqUFK@#3O9KvyMCkZ}JBOZ<*J1Jo&BZ;AJH&)kGM z>6a$2&qp`s_u6Nl(e~ND2zhK^n|+hFep0?|0+&}Y7wWA|*@?TCbT$kx$<6_;bu+X| zs0d1{V8WD^`;qJ9<<#kpeGT2a+6X1V8z!L@?z zk!wZxTyfCbBKv3Izb(-7O6SN;(%wjHYQtLLoh!=qwo`8p(%W8rb>wYP`e&@46>d&{ zo`H2usE70~Bmk)YxBX*v9**?+NhN(;C#tHvGeyoF-wt5ue0sD?dWDn)#N-;yv=T@EVG;JF7NwL zy&c&(lNU50ptB#f0xKzX=bnC@%D9Q>Gh_ZTG4A;sm*5gCNpv# zogFKSek=Y$#C|6tUQ4Lf?izG+x136uTkbu)cBFBF!#I-7Rg8~@K zg*;9bg-=<-%|}C4gDQ-nmcn6Jl#AhDt~&@I@<=4=gJM~-@tSz76#^z2Z{Uh@{yX_U zi2q(fup-$~ikwklvLu_ILFyNUQg%$DoZznRZ%fDO#dLu4V7I^Yt4?@5oJ#Xj zY8FSu6*}H~j#Ywnu!^UeN7;Orvu;Ja30`}E@lgg&2WMH(Xd9=aGL^SfLawxOtnoQ? z5UByrf*^&Q?TI$!#EF9PRH8!rclDg^?v8Qsy~4OdJ6jdkBj+SOW%40_JO*i-2k4Q< zjtJl*kn%1Om#8VRNqiy;2fc-TtgtUvd*X+@!sq|5edR_Rr|ZS{f+_Wl1I>dP4)hNS z9XRZut{uXiLCX3vn+9JSAo;LkXJ)Pc!^4&EW6 zFLJvx0X19UbU5*n7;&xc?`@*$WxQPkLKfMRqsv`$sY{)KDk`Mziueyl+#>nch%$J^ zN$~@i{R>iXh3ZlpZR?{T$l1Iy>RD)0TcZ9Mo?PRF&xn_N?)aZM;ZL3LCrPv{$O%Mb?A}oxg@Z;rm?dw69@j6{ZlAvMzn_of$dyF zWgyBBR1bus$Uf7w|0cyEh0lyGfU?DN%0LrcMCz+D40%om`PB_$o>hf7?gnPnZgYw? z-7pS>-zo)|)Zh?oG(_kZbUNp^1JKa?6i;sD$v-dv0$~(E9}d~KN_&GG;T0<%c20YC zNF;)tV1_1R3OIFHBMk$nmiU1dI<(s2ai~kZ0N!T%2A1N3KoF4Wcgy%c|k@?UrE3*q_b}* zL~jMd5g}bzgUy|2enHs(mVUpt1Sym*7Y*kL_`xV;`8r~aG!9ESanrt5I#`5xWPL2$-g_Zt!ZB?(9(wTpq4Ox~d+ygh#`ICKVf}Yltr~$`qHgRpgTDg`?^JIMUk$ zLK4`G(l1&ZboubO3VFO-4AbwVz-UTVNql9x`>x|-mujcy*$vY_4IIaF?h6#4jP4*y zZ=HEf-0MZLNX8e+E@KNCF1DuF#BeiVx?!9&M7i7`;#&kMJSv>(rXfc8iN>3BpaxDN z-6W@Tz_)J~Fj08jM`DfIk@qMrx`Nj(D!ldxV+ZZUGRS+qvG+*#Oe>cpY0PYVaO#zc z6ysI~(F#fWUVWQ&qEj)p3|Ez{mlcHXRL$P1tTMKUUf#^XX ziq~yM(au7qk zn$H~jKgTfD7YLs^KbMO!`i4I+w#yXx%*ef<;-oQ_r_=a_v2{i*MjO|=^Hl-!HCpwY zN?8dl0NAFo6|NGC-XREs2{?u)!3cD%;6FgOJZz<`Um+WL8uI+7GG{fS3|JsHvS18& zYlap4L*Y@(T{D_*474$im>y*-xlbVFaxQ0`!hCv8yyZr)GhI&T_j;0RkquVCD$7yW zgERu$#VNMx)JiT{YU?RcXIw*Ou_(U!QjlFHU@e;<4`PYYIfx+vwHS&iqaqn*HPQ!U z>_(J0`&y=bDK1Ix_v+J)d?ExudRMDYSEx^RS*}Fdt)&n024PYXJjim5=|3=-Uu8Pe z_6o#nwPIOGSpYdX2tbUQ=b=zOM-xO3dO;U}ykC%RUU&*V9P#Un4|zNHz{DZJ`vvIH zB1kVs{8VhNdzd&h{!RUz(&*HPW1~>>i}Wdw)|@J4a~XXw%OLx$3_oewPtoMPh@mKq z3T{x3Cs0E(#;HEE3yG@ctW|tL@c|%&%kd(H-MBSR+CO#=5(mb9>U@_wM5(c-^oi_C78r&&nW4gCL< z|Bb*U(Y`}eR`wGO}>BS6GUXLN!%%%w}szQdW&#AMawL4#B_Ij-XTQRLuHO%BoglkXO{?{C6b|} zn*`F$Ut2O-bpSJ6*%OMyLX1c%LbzZ4Q1-)8t?}k=5aEV#qBbO8-jXH@0?H4ud~x!( zWkdT#n*GaVtT-Bu#iLWHtwKJ`MrqBdOzjU3xT5iSJXj;rM*GPwd}K)Xqf^EeC3+hv*N@w*2E9evWjk= zFa}GE)A1=6glXiGI2LCm%OvV(zNo@9h2%Y$f}YBZO$znm$kQC>bjJc%j&(`}h%jX^ zrwgog{BDzYKx|a(YMc0nX$*RESPbWc2a|&xxo07 z>%Ar{_|2afZ|eylCgJTup-LVw#m%k)s63@=M{?e#cp&reCK2K}o46YL(`HbN)C)4P zAh}IngQ=7QQ#sxe@99)jH@RtfExx}yluytTw?k4BtjmSCQdq}`Z^>V%Nlj9|nB5IeJYk?f|%Cn<5FF0jSu*XwW>SFLeQNZXvf61q%HA-B=EKJqgm?p^;f+g^W z?gq=g-YOaPee^G2C9@j(ai>|{0Zx4b)2tGov%;lt9Ndl+Cq(OWEK> zHYr@nEc+e8mDh;2|9(=VH5w3`8&({jbWUo04nO#bd@0x zt2+J*s@}W!nU|@~Xb3liuGJom=iTOi$g#hWe$e}BZax6S`j8X-bxIfWQjHgKY+i5O639qX8_p8t(+>m z)@dykqJ^*3&8o7*p1oPS)F4{&S(&r4 za8j?|;kW6FW&R>ES0!f`8-EXZ1ax7DS}3!Nu)yH)0CQ)*BE+xU=indWHYa(9L)qY` zL;2@I;$A2D07{#FiQm(2Bdjsiw zR6aO2Y@dy@JiZzTlz7KM_>bKfCa5cvRdW9ra%ad^3deDrA_DGY3B=CWfEiLvZDqhB z@{S<+b%F_CQ;jMG{l}u6n$h(f+pWCKgBe(d{*&`6={zq9x%H&vCgEYZeerA%?jl`fTA}T1(hjtG~?NN^Klri`lV|#G( z4oqC5(Q1cV&Dfa8uL%Qa3=Jbf!iOgXxBo#9GBPYk+hdzQRCg}Ht7wr8A!G(FhW6J3 zXKF<^bTu4y)iEbBQ2&A~d0tu<%FqRJp0Op8!Qcjn^^bn|9zTq?G5x3?+3we07b&?h zVx47$&OuLf63Jx9E>h6|zpzfG;H+XaAB%S_mUNY7x`Xu7^-c*y6LRMjR`zXPVP$`x zj4nLC^h4qQLy*Cgt>2nzNsvN%lwA(2F;tnZ%2dXxLWDwCqNi<2Imkui!psVJU%*O* zUQVzX_s`Yia1P(LQyeljvt<9p2o7OmLA0bqTom!wMevpS>nQ{R&Hja%=6?{e!}x+9 zbdyiH#k?xeKk1$gI11C^xt9C{%&xnxBz)BmN>%5lVNfKaxd4 zaKwt}wKRT@EjC8lb~!m%lsL_^&-4fz4rQz`wLa_?m+%nvjg3|ul`h6wANb!MjH9xo zw5zN>-*u{*P+$0pmKVgtd(rH!s5m1UUL9?=LK)x6I^yB5BB=8Tg&9q1{gGCvI(b&C zOlHb4`q6N!v;=?7A*|Up^y?70xLml-tr12=$rTatd!!bn1x_YK3s83w7OWHY=Te@k zLO;3cUVlL=dQvGWADL84pEQOEFG)_(a;!=rg!ByZWXShZ(~~`9*=Z{($1ovEc%9N? zDq`g^QU-L9Z>+1_siOh)Vpz6OP@ib-2tKu(Bg)z-JRi%Hqz^B(%PtqC@GWJ=Qciu@ zGh0z(6)Ugg|HsC%cxubc*zX6Ob0czXL~Rwq&$TFDp5liE8DNnH3{XixwO#=Lz>a~~ zCXE?0sJ&TnSIqjZF?g`CB_1QWjnTktI@!#Rgy)j@W z#5 z3NTp?$}aJ;IfPkOaPH|!;y0UA=s#H7iIIc+zF3`3&j%(Je{gufFKhW3^8FUMj^I zNo2j;h=^f0aSWvdLinkw2CC-7v@jIq zXD4D4zgd8bN`-A#fcnDZdSA>r+q2eq;w=X7{ve9XyjYHJ+E=AMOhOIi*C3yr|;3+^c)z>V6_^eKr&Vvw-s!s`c zT?+?c3S25H5B4;KgocRc7sq@Yd@+llf3CyDhX_$cQ7~0nyS&KJ^GE&u1eP2O*SYb! zpQ|RYmW%e~3f37>D`C9)a>7R~jqYEa{ z(Na-#R2=CKkcx9_np(JMTwsZUw|z4n|0picQ&pA3s$q#yoGMkK>*X`E&88Cf>a zp|;4<&9YP<-zmDH6J33nm=);{l;f#gR2|Ugy7ac`E1~I~a%J@9(;gMF*)P)(FDyrgDU1`(I7QO6l84BFL{nv9O+;$S+Ey zZ%Fz#CL=E;{Ff72jK7`npCT8rC8plo#C|S1K#YGCXsJqAHlpFE+I_Z{bt4FMr4+ch zQx&LksV|y9e5d+CdTKU;qdJ@G!mCtKmM={cM~o|lc$-J4g-|d{Q>3u4TJ-#4fJF;1 zVl~ExMX|Zr!%!v>cfu8p zo%}`=-Mk>m%~NjRQ53=COw2ll7h0#WKj^utviT!WMNhXAo z>+dm^lie};bi~>b5ic@Z?Tc=GH*!bZcUN+u_&VmG!P$uq)7Hi!d^KOQyNgI z@<~`AgcS^df`C2xiR}Y=VRZ`2E6=UrS>H9T=UL!VZ1d?f)G*5rd2Z^fC;X3k z!hqErJYfY>f~uzCyP6R#5Dyg)1>On_u7j1UWp0)HBlUN3sS_f<5ib_yc4jgQNbJj| zS++X_n0Y5^TdfL4cuCtBM@l^JoFnzE`8v0MS$xh^QNjUUb1O#u-jM!7!R3N87@+?p)kTL#UC|_aTE(;VU?>zldUN%V`Ggq{A$80F>4V^x&oms ziq|fT+l%79%zYe-eHs&=uw=mtKZ-fSM-Fi`nhI87g8a7ZGCA2_P`+zf+iJ9_zud%u zN$cj64ye|hQ#=Y#E_8^HqRuvRmJUkm4yrL8D%L6NH)M0yXA>$vc0D#EcAPaQD3+fq zkV;Q!w}_8Kd08!!tK=Btg<@p}5`Qd8-dE(ePzw)n@c+pV)V`FCWNhAqtL_+AN(dGPGH`FxT6V+hJZYy{#cV zLm2x&Qh)j%xKmXBD3G;wiu;6rFK*9U^Ch=u-RH6;m*$i(kd;qo?O&R&q3+pM^ob(> zsUqVu4RdMj@A{3>-HlUzl ztm^4ltlP$+Db6VIFD$X=rADH{2WX=UL4c|SeK<~&KayaQ0AtT?3XclCBO()hK&xC? zg1~V(w!IPzdK{}25beUWGalI`yu{bUk@9FxgC^`u3OG(E?UHjXmb*ld^3yCUEsa%_ zme*8?%5Y7jI$2j*>o+9ozl|(wHb%8vFWM19NA47({f;0yc$;|4Dp-e7kK?x)EZBxF z5Y7ads!oQ+`~AW2j(}~LELp*j=P@1CW8EFLMdmllNd>}+Xu^tX!mf^3 z#i1x(e3)Fr;EFx!(`$K*h_B|9Y<_(y(Sw#MSYSP$vtOVVnhI=-dswPp$+@rPD5s({ z$Y)FQJ4(}Q?dbW$55=v>Kl2diro6m54}so1BK^pE^B2w`_Wlei-z!=4To#)u%|tK; z0|8U$Y=tpnV4@=!TXHo~_0l9InV*lAake~<+EHKQRu8Mo*QO~cTiy(fG-4CMzCZ%* z7SS3n&`3d^>afQsL|H}WVOnPC`ENK0b}qtd&Me1H3NBHmRQ8Jy?x0k;S%Lgp?>0mM zPuMuKwMFQERDqBHjo*G}V1h`a^u1P&&x|B>0P`@ohX9LFM-{j;_9|koRYfkQ!?d(o zTc=vsyOfn-aE7t1BIacZ<6i74AbU!s62M#5LtktXew%ojDNV z`%9U+^xX<&fe>exDzZJNf;LSRQy7XHD*TTsQcXJ6Nv)7eb)dmm>vmK83^m;$r8neL zYJOl^)RHuMVD*Q<4RI{c%!r7ECZoLcLO%)8*|?y!LApaj5lurRfv8GU_Sf*aHrBva zCYwZaO!~tc3!c2k?LA6WTq#GdK#v-%)OK)ZATlS0ar~FcuD265pt=8Z0iW;FU0?$y=QD3hHIYbTM4EuBezzkyk=yka5($aevv2k6YKYLFWFCQ->>M={lf8d+-bHlHkKf< zu*N^LCdvJxVR2Cv-5Xt3Q!B;&6{>TAfv(PrRje6I(KGW-9M{bWDP`VMtl1MQc&1?t zT2Bgswu-FjnEBG6K5Oi^g*OaeG2TeeT*Yjt1j>dc05#|p7;EEBl$B7J3eZ2KVj1RK zil-Jur=|R4AC{JAQJv~|87mcK<)yPVm8%50aiM({zA-pW(`q%_WGrj^y@ouYUNJ$g z;tBN*k*8`@yeqtIVI}X8e4xfjvW5+Dm&MwQ(kBO$8D$!LE@D>0N0M$8GxeWE3CHbn2T$kx|3}ag5i0dcfk_jIFh)R6HJ8T4Jp(5vxE9 z+G|PxN>jEO0=~LhweI@b^vnpJb@0+yc|vluHPWgDJB3Bv3@t6yF{z775yX#46Tn;L z@1!mhWf!CxbP|*Nr7Co=`#`n4u38+3=jf_xY(=FusIieP_TKzPPZ-6)CVGZ@^VsG*|V-Fa+d?y-IqG?r;D*efXkP zzI@!ris8mj56YXg8E4iJ;fZS_u(2;7Va`dKPgY`1uf>Wvddec97dE@L6%JFve;Da0 z{qGjJoN;+Q-eOFF)yWU4^H~sq7o;#Tj()6yq-iOtu_lzV9}h<`0ogwbFB0BAYgv4* zua#HU+E>-0_=2mgm*TGa#548cp{Ce7&EC7s2*Mi%5?kuLD};Qq#(Sm)VddT$|A88D zf6aebpw27@Y@xgpr&`Lo3(0^Sd>FQ&(o!tpTqW#-SCpgeMTE{3Odze11Sb9%717CD z91oL9A)WEDO8v{~k`KJkiDpgGC6!q0;?R?YzN^fE?Z&4KpbY+5c^_*i3SbbHH0N5VT-j9K9dan+RE}r* zql`qUv8Iu#&bam!Y(xd7tI%)ygeZp&Sr7Krd9v1grdB*%>poX2_SCpXXU?y2!*)cx z-;nsI0kqNFy>n^{0+(`*r{sb1e1VOFz;6{5jzUkKfUp1_Bqxo4}lbd5~0$>@6CC_SrG#;s! z_tx8w)z_n0i&q;HZ#0TG8lkHP2NG{LhF-1n-l${lJXz;IQzxFT`*C5EDoL*R z;xK=)bYE+b_c!Q?cXtEp>)#sGjQ)_CBjSR3HRs+K7QuGRBE7U04z#?sM1}t|aIPgz zk>aez#5s+a(!wjU;{M3!7iu((t%aUOTJ`cBA=U^n6D@H_h85$>>g!mL!c=| z7RbA6u4$dU212oH_WaTuh*(0$1cNFJsa;`FkS9uUkVXqP~?Tfg6);LCUvu8z_wwz zw1?r-%}LM{Pc;W8N7}e&xFSihry;SZ(Jd8kHYDC|5I5I{pQ=aW^#DAP3#XrCvAiC= z%a*h|B$CxPoD|%!7`u=x+|V)pI@}{}hM~HwF>*zt=>6)JpVsSv=vK;br)ssWRLNqk zMGxJXuET!cbE?#G))>82#SaH_h2-E~CT9tR!st|MQom%ZNe!JGGPIcjr3NQnI(U7}#Kq>oUJ}kr>QT~dBxxna^ zLyoy=PJ?nHfHU1txfY`>3v8{4vIZ?_&i4G*rH<)ZOyzaiQD-^ zAKhB#JX~jQugm?hE_Pp?xHmX^cb!uTlH#|ZP1qskYD9qY8>+ZB#bt9O+7eV!4zi0> zJtx`_#nW2mP@oR-|7$5(t^BcAa3M(LjD|Y99HrczIfOr10C9=E4 z+1xB|YIeV9vKKU?h}e;#Qe`OKTD&QR4a-gyeXnfbN${S^1|DWLSBg?B8bQz{9S71@ zq$rAAK2jDbbx4fwl6t%$7=YUXxb1jl^$V1PxTfboIXKREjhC{lgcEa8aZ-RksGIso zD@)fu)SCpd`TB&oG!aPWPqh}Ir#i_jmVne(#>3Badk?WXC;~iO`}d80EtHX86XHpd zI|Mn~KaO-5#$d!)*+w521>NV^zsO^t$pvCYu$vp~PCTgrdyOWU_&``UIt;-K>Z8Ed z)vk`U*j+t9+RnWqc)Bo&JxyFy1Eh!kLtCoOyRyN$qCs5NfYN<=18c~J7Bw)N+Ay)M zZLrU6P&K&#(BNz(t^3X%RX>CDps)1E#?X)Cg+2CpJ>s?zs#g}br<~aF{%@Suri9l{ zg&D2Yr~lg4FxQ=pgteqq-5A`&=MCaB7Fh^*cZ2gi<+c@n8LsYtSbkH3_&rVGyBiyv z?>d%y+X(yC5#p8+?$#0BC5?6!5VE(Dn_}yQeW~zt(T`C7IF#Fvwzc^EC2D9Vh43dS z*~-MH;NTQ+`yEXR8DDg}J?cLmQ4>27%j#{_7Ma^DHHpL~8N1t4_Y}I2VBWi?I2Z5d zU9_L`cx&i|*3g};N*J(jZMAM29=po7zlb4|Ujb@Nyy%f$=&dFdrsP~R#lCDxHer9# z9{H%fkC@fpr#Bb^&ZM(%HSA83b{JlUei;{1^~gfFWRSI1o92R6jq>tpe2Y5=L@ zF4GrWKN2&ZY5N%OYB?Fyz5%@}bUcLrI~$ z7)0&7L&&3XIpoA-*&Re!ZV=`s%L2Kp^43y}3@;%d6e6O5$C3n0;p%{IFxx4bNNhS5 zM^Rb^Y2ptsD{_@)jbB}@1f*_c6c>~AHWqm`lnBwKbyMkvAUjN$vSnGss1B$0T0 zczPmdCS`lr_Et^JO=+Lb(F`iiYK#q;JOhl)Qu7jUbA!Lp96JdSjK#q;gSqZ-d=kPp ztIk`a6hC80278OC(h6UcVKrNq5tp!6=7m3vO01|-KGZMUsPm|J*=g<8g7&d8aY37{ zih8IBA!3DoyVt?Gye?Uqa#>%3E_@Q{T%~Dfko$=<0WiqZgnOLA^BsXU0YAolm!N|j zS5^3!5g;(I(f^incuW0}!DN}Er$H?#@dulDgE9n-na0H(l&r^^8-Bgjeiv&E2oGup zw7F-tDQgL;I|ae_4&_NoZ|@+?z9U$ERhG>rhNBEoU}o@;yMjqr+Z|O1L8ZH;`hzJF z(H^!IJyE)hyE{_%kBl8AAsI4fx-X4Ny)nu|U=`Pm)C{sCa#2Ti9cZ3{M*eD>qSdQ9 zXj48JO}QkN3;O0AXaZvbqWWwkGft;0Qc;T%P#I|*rx3w~)xxPr9B@3Nd+dwmF@oYH zgHOtW3Srlo1=ZnS45)p^ve79gM3J+QSL{&{I#CbM5X+;6d&VfXEfuMeYJeKnBvNC} zvQ}c^z?^5_HVReZt&#GTk@mYI?SHnL@3w0*=Zo$B%kAQ&_Wz(oUOv21IzJ#Zw(yF& zR7e-GKV&L7N*1e-T2joLe*=>EB&qWPyESpICZQS1a{VuQW3(?wUF$9>+T*|}SGuvn ze!D0foFxkf4-K7JHgx9gp);=y9fS(ko;h?$N8yBD*zXi8AYOdLVC6_q+k^)sV7ZqC z=8l<~2%4Be{;aZLvJN9-ja}_9k)4|6<^`fFH&F@2P5QFtp^Gt#qvlR0|iO_cJhbUEdN-=jcJF>td1M;^sj>B3jRvnT1>)j*aZeN@Ue5j(JO&5w9M@EDnL zSr78~mM3V!Jz|Tj*esO+RB0KiQJ9eQ9eNAD9a|u$#=1ytzApB!u#WP9$%PBkg$wIY zS^w>YGxU9rC|q7d7YArGpY7h4?P!v*+!v$V#T}u)jM6LH z%cIC_K;Skku+@7=c&{)!awOBH5Q+DoX#K+!?`9T9adU^7?tl21|3#NPeX6^}vzGA_ zW$yDWXYEuR6R(ccGru!=x9~P~dmFpG4WpfpMtN!Tj8SEzh`I?57Qb=myBl;RuX{)N zn=Jcm$2rIG*`DI%-WTazBS0oxF?8W2z^N)P9{RMYTj5o`KOYy5dS4z#dXPQG*_%dD z%*l2`VS9lHEuP|i(x(<)-QL}uP2?3Br5g5DXL7M9rb+$s%Te;d4(9>aSu`SaOQ(Bl zr~Qx4*oU2I!ZE~oWBd$Q$E$-qP{W<>O-%cPFGZ?PbMhys!vnN!XJ3-t$K62}Lam)Dd*706a?(7ad+HE=ZleYH^A!Oo~aWpZx zbpk!``WV#%*G%A^Te|%lx}7(5sWd4zHt*ZYcgNaG9dD6iUusA5iArxt2mE{6D0#~$ z`_@sa!Vn7Uy(1$JjHHOh%_C#Cjuf|y{F?1&FQ7^b*k2AWzRFTn&%}zReIN7KnDm2V zx$~m2^0P7a=VPKWw{(oRoHWO|Pda0tcZ$zC|HECkwHM9uEQs%BT}J%NaY?7-sqWB| z-44~=#d}}t_N&Ge{iV}eJyyKXjqt>x<-XJnWnbOSDvP)8Y)LDYjWZXHvloq{6=#g~ zR*t0=d&a~TjTH;W{)blFH?oL=kK&^Cz;F247+^YU$1$Rha07Ab1o!j_ND`|Y?_9@T z>v-oo_NgXqUaM*8<*`Yp=)<1aKYARe=me4wJlf&iB52FqqvdU*?X9B=eSLq2_YieG za<_EEwswfyI{vTr5C*=WwP=z*-gyR&Y*gHCS z+dq%;{yK`gKR+tAW0ZJt)c_~Rl| z{i{p@x>t)tBN#M!2=Q$w;w>c0__drv4*BY%s#=i$j<6fOhlP7km~w=ZTb|NE9g~#( zjugDOx50jf!dh_l*MO9ayGpT=KJFfDsYPaSQ!Z4(nbLfPSME_k-LFH>s&3*_beNAv z$N|mjfY3?TXE`@nT~(1G$GHa})gDoO8H2>xe(l%gzmv^Z$dWjy*0^uopJ&G?s4+7asHR%0s{peg+1fs?TP{I9xMMijwQwZyxrS8 zA+%)zRp?)vY`)6;gzJ4=U|7q?`i__MeE=d5&>pd0DJzNoPOVPRjb()kaTcli^G7RdTN!dxKD+oZWwhW7|} zfwcBePz~w$LD7|&m_pRO%rySmg*WoSvHnwIRf(MFhH<(~_J!lj3&!b^*us781oz1k ztY=Q3QY3)A#O=NI9lic-y%}rlL%oDwhP=CaorM#S%B~&ncCo-!u7WQ^5fw|cdNzOllyE{El{6UYX6`vmibahVT}ldC2;t0y3oAOY}l6Dv`U+Q;c_MsK~g>BiuSKygs9EZC^^ zcF_28A~_eY?Q}MDTAMmk*L6C#j#YRCjO{Xh*Vs^*mlsb=P*T!U6IC4poL@`ED>3Ae zi704$RJNqZeG|R)o!$+d(*r#(CCKWD6=bbI!Op|2IbUY2#OnUCSozc0%AM%&@+nLt z?L^!%m8rnY7Vi$*IF2|~heafo@DfBw4fgFdQl%rqjB6%gb6L>o>=|t>?u;$$1hM{p z%f2?B^t&x27*~~3|32CQ*d|WW8PV0Dr4LvBl;e8ch8Rml!98cDO{#(FX)&jMfJe_? zq{3Up{0VwHT5q#@>#@ZLU$%qbI_bg?UKG{3H)rXsI!?qitRbe&Z?OvFkx8jo_>~56 zM#^0Y;z#ai!0~2fn#HqSs&8MIL_x6##>AMis)$t+RJT4iDGcq==OO$Ta)54Tq#c0A0C<%ZX;*<_V(lSrmeYRHr8i6fOK zcf4#>p4?iyR#T>ciudvL0yDL*FN3BffThBvxfy*qvJ4Wv%E6zcUeO zZ_`A1^+fxciAvf70DV`Nyt|8l$5^D;yRFNr!;Hr5j7#Bjd%h$J;L)Z~bw+bMAO=?RW&-UE`H2Mw#kE zmi6&?apQPjh95mXy#09j`0@Tz$IE(W#dznvF8hNnrN0h6_pXuR?*H&yzCLXt&rSY` zkd*j>@eXU66z>oHdhiujqe*wB zBuZ(I7rGW+;rHVOmf2))?Nn!qIbDChznHnt{r4AhID24~W<2xPTk|0GV@Dr@$LS#f zF;=p+20pcbcL%Q39!;()Kt8M;uC6B001trEd3%rcOJPJqc>$kNe7>+(fISL@TfCGL zd2gbE77n#U*vmyRITf7KM3ORc`?$njqK8zxE1E-6ek{ylYogt)SlB~q7%Ck`&NQ`A zH1NIDC*lY;s(Zl^5&>@)mw^TY#;%;ZluiJi0@_#XgAAaXG#)%1R|yaXm1EC~H5i-v zm}nF>EImel&)Qv-`k-3ZYZw1AWHUzSN!F_TAl~(|TYt_jOA?z1(e=t2Ff>#}w^S z3M2gI$@X)T-DfA8J10wwyP5YVdw-uSUzzN`Hd(wn`9H9im&f@pO_Enl7HcO{Typ0m z>*mQ|xoX|T-N|~d0el_dH(`?eSY#PODQxjt?T1xM7Wc?6y6rE!!!m8K0uhLhEf}b|3xlGhG(gR04x)a9om7LJF$#k=PBxvAA|Ont@3fb4Vjba zIpx@{$DFLaB+m}v-PXxVM7bK(P_5qu`7@4otv|~?mNkW?Bd^yLaA@}3@f%f!UiiHz2R6EoWX~vy;_I z&HKxzgit{k=TAo4H;oo|>UQt;7w!!U`^A>gDU~@h;P6YaH>sor1Coe|gnfw9i<9D1 zVIDT*CpbfM_>l0iM!5i56>a!L6B3K9NHmm>m_EV1=;n#2naIR5Dql00N|E|Hy;LcB zDJP})SM*W|yJ$c`sI43Z8=;Pf3O@T^ETlzft3er=4FrBS$6Tl=)OUX|9xS{H{DI1d z;{JRJDMt7=c<*tyP#Kct*CrGsv4(gL%Q8)n}Z7eaE`1yK^Y(S$e z(+Inbbfjch9IU@Tti=JMC*b#qV`1cKg2^ax?zon$FZ$0GmH* zKW&$sPpPkO1Ieut-@?v%96pk69qX2qVUG7)qD!)}@SBp9|7QYOLp*mP5<}Z+}=6aFHXhu>FOEF;_iT_`W zV`97Ur)jCD`|SNgGo9!9Td+jE3XD<@x^OF-VPtLs48{X9`U+nc? z?iDY6y+8MIUyX(cCj0tcv8wlLWAb^gN(JInLSeyNJRJ_L(6XKKN;MZX<=N&cBy?Ca zR{db|l{2|buxyD?Mu|fapX6afT@)}`J=Jmo&0=qNmIlzw_C?CWikT#Zi%G>4{aesu zwXu6z>fR~tOn3PddGZv3ELQeu@8h0ce^H-U*!S;=M_aD%n+WtO4@;?GS^1{$wRwa^ z#Z`=h=$OFAIMm((nlOr4M+J(-5Ddu2&}N)FJqCV<&Pg+!(H7}+!fcc_nF#VO@B^mz z{Ld^cyB&E9p;D=&y$W=1N7UV^u|7?j`6$g$H#sxQwO9GJ~I`J-H zY?_`rZLEDJfsyX2KKqR)t928~@CqrNRS5LLCpIRP{-Z0g^ajI>HHcWNd(`n=e zz|KA*Y*(c!Gjc?aU7dPmI*fGDbotpdd*$?0+8kqdhL=n;mrWz(pqHz$ubyUKIL*Fp zntlDW=!O~YVdg#4rN=ih_02=m>=&omJElb|!z`MQPc406n!IhAxpf+`I=4@wwC6+9 z7=$8u^E7AMG;!y&|1fhNcTo&JpDw8(L{e+aBJ}5KX#VHcczHE;R#WtSB zqMipU-fZLI{Z%}T3esG@_ef2)IoId}Qx8!cZNIEsL+rJ}Ft$rfZ!zQTuTJTiJcXG| z$fw5c={!_J5ol54oSBIGZ_ZG1jdnCXFazmf^9&-x&e;#J>Dkkj6tiQ0RRvN{{jk_i z87Xqe@tjdQflffB0X@DS)%L5PM$@sMi(_)j(#IthIHs5(`X{nFY|QI^(LD zIZ{htg!)W3;>-P0R$|q3d(Cu0&!l(P^w50_0-~}AJ!XeAlD{Rph~NoTUJ$eHy}E&? z&vb?t5=cZToTihLTZiLw>5+L=nK);yrO}P5wPpCf>{0y zO%Dj;ud}RIW;n0S5U`~+<}Cwu?2FU*=FIHr1h`lzA=Xt18HO1 z0a+`J^L-X`@=r7Ehi9_*JhQ*bn3<882lw|M*GyO^lz8>03S3DFw!pm3@?+ zHaTk53XMWmnf4^D#w5SiSrt*De3yxRRL25yQLQ=sfRa=gz>p_nX}e0dLB_A#-@kT$ zv4K|XBi`?opmZyCO>u_v>@Ev%Ap2#AtN&}1Dims*QCc9b5GTQ3R|+TC9moy=CV-kG zl`VobD+u2#W+`jqe~j_eY*hj>rHoX!^{c6L$840-kNaUE>-w2br}Z1e!M@efdt{oMLaOP}0e#1H5QR+TlYVE*Bq)vbI!^qMyv8*h-q|8?syfPM=(Q>XF zi#b$FBh&lf0m$(F z1Hf7?I)EX1PYu!b10qFk34q48s{kmNzy4SArNs}M89-pPg^3&O5=3qud5S}G? zJ%tlsrX96cj=T=iG>mbwTH-l8%=)d_;N*wI@EbwZDse!i#{ipa2Qp<1T314P(PYBM z{y(I$7o;;rQt>TB^h%Wie6LJdEB+s4=K(HNb@lzT+bMIVmpixjOSyDJilShph*CtP zUWha+D3+MyRk5Im3W!*-AePug1-pXAUa?_`BA_P52GPW*v3$RM=7J_~@;=W8&zw2; z%*-jfti8&A{Z|LZfUN0U?2dNVMfGHu_bTfnWX&&(IK-&+1MQmHlkX0q@~u_dnx-<~ zkNvI1^!K182*jb{m5F1WHDe$Z09)fr`R3m8%e~!gdvl)~_m*$$UH1Ck#_buWwx1jS znf3H0u4&^uljMMsrKT02N<5aoJZmJ>8tNjU*57$}OeG~ue<8*?Sus{g!fAWz|K3O{ zw9x6!<}sL*x?dj9pf!=pORDD~&Yw6#h?-G=AfK>zhQyOvsDmi(z{9N+U+rM>Zn_gH z)N%W@L&7a6e{Zb2br9hL19L~%#1qTew@6foUWpfEV-)F2|0K$PslT>Q5&Ojvc=ZQ^ z4->qqcL|6XmpzPNN+30nWTZ*4KHh%V4v0$uzPWg|Hf+P0!QSsHI^qr%a z3IAa^i00}y!wsngFwB;FD-K9reSo;?fav&@2e^+2f_+s3cPP;J1~&V9AOf!*Mtym{ zmMrSUkk7NaLOnzm?}wWQUs+T`b1w$0i%Ls=q9wpFVH)p;B_>>C9byUDNL`V1p}f2o z$vjCi;nB}(BzI!JGNLitQ0hez;99CW#XIUw|GFmCbn9tNp>$1ZW`w<5>DOH2Gh7G88@ubO{Zk92Y7>EBECtAbpxawl?BUjO(;0qgRVEWk%q} z>??z+h&z~=DnI^9BrwhudaS%$SWRJH;zWp(8r@O7fWY`#k17#%Zx)Y;_pP&IyLeu1 zgDERw5Ii1T{^W=|mPihxJok(JQsn16E3{L|U7a%{M!@FNKyX%|GBTeGbChxuz z)q^LB2Tn8(pNJFkkrU11C+ZiQ<`Okb;I!@c98mos3Z~8`Ln0N`wMulTs%~Uk$5JU% zEs!H3UIt&H2GRbbT(+#FrC4Y8M0%(zlntn#KAZ zM;>Vovf>tQE9wuWZfk(Kf<*_9(ZPcAK zR%N6_#Az&QaYcE_Uee~(c?^Ercy21NN%8q=P>>#MUe&~lYKqVuR`7_CRPR`l>U%nG zjUyTHmr}jEmFk#M?NU9Wz>7PN@-?hLP2uGX3rDT4RV5bC4dP{DTv3}I{fpuI??X93 zVtu4tR61uJ3Rv8#-Yc8bHBBry&yai>wa4>K?q!YU;zn^v<9{5VH#EvC8_k7{V%dND zobmbTSjK1Ki*eQS8-E_3H#b%P*zoh8zi$$k9&CGf(>S+bXKVj4awDx1`ueDH^sbC9 z#dAX1XV>Cijy0=8{I4+ynH1>B>T*V2fvQNNLxo-S<8?>?>kODni<89p8|RDhKIU|Q zxtbcHhl^oZ4C`>;$ZS21Sidb;xPK%vI| zjU7SsjD_@dKHSLbEne^NdY9KGUeq^>t&cUWi*XMdV)w}Qo##~h&gYdlcZ426DpiX$|E)m%|As-^F-)&Rs?3Z|WiOReEo$0=Z%}fj0$etJcir`kztY z&QKa0p;3Pus#{9-Z0P~*;sWK|I2q?WUVDqRsiECb1TAR>RSn3P#$OdbyG$=A!|Nu~ zG05ltRsdY|X2E->KzUPX-nM(*YXxs>!ECYH;QfNPxj;p4VNNeA%hl}=lUs2}I}Y(g z+?g$k!zg!hx;dZTeoU@Z`@#szVlTQA7Qk%c#Rxzwf;O^Ma#&bPB5$==VcI?H$3zbH z1ELA)4U8l3>e}~1_P0pCt2Z2jfbw$ROvXobf3 zV1j&z3`gwIWb{cs+TWGqeR!>v!1nBiWBKC_xVqbFU^grZ{naE?;=3owTPK-EC+UpR z-UAcW{SzhBQ;414PfXr2QQSQ7|FBHI94r1YCHvhJ@7pQ*yD1bz>7#q7pQiZp+dP-@ zPghO0E6U0?ECb!>w#WmP=Dl6uA1t~U2gN%N{*1=PliF^xWJ)nOta(o}2R)M@LfwLHbOx zO}J*N_o~pZh)!5c7eG;{1%k*7iG2P!*;@9fO@!5_<=ta7# z|7ErJe3iaoO8WIlFhZ}L~X=qY=NmL**vs>iI$~aowja`1~>)VpQjmYK$HoSQ0C#4(&J5o1iBXcA1ix=1lf}WV1;7`m<*nJMan=6jh z1#iNE^L*KIy#0OIaJYzs*{`Y+9RmPbX9zHwQ;~fBkK}cg&d0wZ?()D?!nj|z$!%>+ z_V1@eG0ab=gkMY%pHKNegvZ_E-CVR1x5$Y$3R`56vmUCS;^>ItwIUPVRA>H1XSq3Dve7B-nL+ETkQTeeQ}$LM&Y}fHo4~nTc z{x=Heg~M>C7fOm#MTVZ3~(=|501`ahv#a+yCL1zimSJGZ_|`BNW(1QvW9rA?CKSOeB1WQ43f7 zM=yOLda`3rnu}^MU)(KDv#|u)k0{HJhgs-d`Ia{GNt-P?8is~?@Oj)YG+Ay58U}3S zgsMu)$UR)eaSqkHLpEJwqD1KKv>@k+x^N&}NPN7+xKToF7o3}>CtaP^-HMg~29{3{=2lmWCwoWRS4!Wib=FVM zrYoPF=Dst{&z5~U&HZdzjO-2VXCH|rAB}-gaDC{5>Kk#O{C-;WOw%)j3-SXC13Z}D z0{An<`SA#>Ak=w4^8x?-V|x0#>E0ivnWv_SC#QMOOk`|jpf$#W!{c=!2yQ5b4Ne0u)rg3V=dxfQ;>F&TY^%z#d)JgqSYXz6 zdK@^C#-FC6?a5Su9@h=P&B9V^b#Ru>u>Nrt9#`Bj8dp`g{8u<9@P*@)mVTON%#SC1 zEqaU(r)PimMZX!5%rxrpa^?=~#=FeVu1LyIEwmB@wwve6Q4_=w+zB)6tTQC6oj%D5t#8uNR(fSPW&tGxkGp;_Y4#2kwm4c1*+v)Ci z)1fb=%$3dXaG_U|7tZAAo|=IM_UGu5pUe{X%&-ybnGEC0azxLbKFK_HlD<4=&uZH! zvw2o4P67&u*a|w|+QDmwbxeGM8fs<4Cf^?8ZY)oZ5AFhzC`L#)n?%0AW@zC1a&rx~ zaJ3!GQE)z}b!+ykC*B)jpOP)TJ7G9QxH;%Vdxkxld-Kg*vVGb16T4*x#AxZ(fu8;C z9@V=kKf70YU$sx?{c+R`=|9{ZHu4}oIY32dXfc*ydPwu4JUJsDQ(ecT`v}? z2)(g^N;y$#QaJ-9oxHC!V}1+iP{M-q>?lq4Befo*=B3%$H0a~&X3|0F+h%vc7_Z3D z#BqgVPa&Es(O46^nCpevhr@fQyuN&f?bYqG@yy}e_d3Y!q1hJZzX;{0gr0)Sq<^s# zmq_m;VF@|_=e%-w{I=PNTW6Y$v&286A3uJ0cz0ORm=n_fAe8qUo?LTycaqZfew*n^Y7~!#RM0T4<7(Z$5vLVir==mh_hu2%S!i$9Xhb?^_6M$pvLS@u8 zjB}EWDJFAY`=kbKk;loC0Ni9l0@dJY5>dr*8Zj5fS_9mdz+<~tlGsz}Rg^<}Bx+-T zA+uGKW3wXZu2SAhB9ck)aw4Dp^A?})ZuqlmnXa!>kM@YHjNzn$0bB-uABVK^KAGjm zG6T#%XP8wp4MCowPo-vJgemYK=}bCE*QKosw)CJ^My|r&QbXv3lE^wxEg%YDQ$lbr zCcM`ZtWg!j=Ank`NxH*Dv*E{a1Tv35G@ zU7-dB72hpxB$SLXRj^IWBP zwz7ov`0NPkn-ueEP^pcI;(96TArRO5k}OKGbB;IYF63Cv$9K|SqhT|xjp%^^kc~8# zf7cCd%tufQB%PTYwdAO&bT2N@lbmmkOu~QUihx{On}S77n!Tv?%*?W$nc<|al{_=` z3oVXS^mPAi%V-#gDDQGWVN?n}^Ba${LA*Rp-q<>fpOky|;bF|9Qm-X)6Ff#q*dxRbxO7hKeZTx-7wYSTgUAx0_*%%Rt zM=Q-9tWn&6&+7wuKz>9oi{9dOc_}^OU|bx3unSu}S?zp$l%>fQHyl-U(@}VPUGdlv zR(u=xxue1dvdIUt{q1!$Nse(J!w< zeCMhp1Jw6%FIgkCo37F;1f@_78T~QJLso%guI_AF&0cbZ%U_*97w1)#Uq2x>jcP8Q zc!v5mjql1Sm z0lp=q4aKKSL95K(=t|fOmq~Si-bamasl!ZZRXtgKFHE)lw&e@|0xPpoR*5XVj5g$< zx=@wO4Jm+__<)kcI##fhRwMJV+~r;r2RgXgulj?D9PpHuvPMQ#ir%QV#Q;O+-Z`je zkR!V!t+`FyMlFusl1dM)zSZw-t*>lU-pmquWRiZ=85MRPjlyF_?G+tCdJhPZUq|F z9)D?$`07aU<&ojqIq`evumV}u_p0pACcwLq8a_!bmRA2iI9diRm?Ta`3zkH?WF>3@ zdJ0bD#zJk>7NS~Ig|+dTp(UC5&yvh6>2bDDF7``Fp(-s!>uGz*2jayqUJzXS4GSt)a=8)z3x` z_S{?$6CUhDuL|#Fz|i8Qpp*dT{aXTD_C@MI&rLlwSD${gTy(TJ_h>t8UY*OB|7-O0 z_s?}JUDk7`TDQz~x6aKJm>MnebPA!_)m5wO5PUTZhd4?;r3dkSDvFu(A<yt^R{^6L+JY~MHOr{pL*g(>($?Z z|A~NoPcj^F`A&9TgaE;^ld4bjMoe?AJU+V;xn@H{5YJr;HH29v z43gxdd1a5w@TOz6l(S(ondMEl(V$?4H$6C9{)QtbdnZQmp_9B5y_3TW=BlN0#ge(+ zvbo~vdFkioiI?X9j?o?T0ogH>pZ1=a6R6B-cyqw1nu%F&XLNme#8@>}ULrw7b2O{> z0@C~x&%I4Bn z$Z{Sn5Eex*>I-a%p46d_S2&A_W)hrEyPnu~Z1T%v{R}>-lBUti&W)t(SSn53-+^R0 zDN4g;@IHe$)2NDQJCJRwGp>yly>9p1z`dL=PRP~=HZ>ki*N&Goo&-10Qms4AUw<4& z8VFS}LMUr<(Q&yejsu?z6|aK3((T4$l@!o>qAJBh_2G&`(2~hR#cb;1paIoUuVAkz zB(yobM7&Q`0kJ*(@Q$7Awsd!A+=JHfQ3Cs>5og1qmFytrxf5$-R~KttrXc}}xo)W9 z88?;(&r=ycZ=Sbkp6A!O;?3i&%qFLIjTZN4^DjBQ2|~PhtfQP>K0bY(6=TnwnCzEL zbl>4<{sw@M<7^jtv7o9l>g^IB4G*F>i;mIqj{QSVS@~tC{0$vt1XYGv{wQ!8G~+Pm z%9F%dN}p~E>LGh@v?TRI^ZZBWsqNDJJ2(aLg0hm#W|aEcy-)dCIN~TrALTeUa9TiY z*|2`f@8khKv#!PUk!x|(G}~pA3f{diuxQzcqadk|pU4b6lvj^PaD@ZQoTa}mv*c39$O0REV2+f>$T9l5)^!b@p;p)vxHvlU2?Nz8ACv;DMKy;04DJ>XIhPT`w3xd z#SJHzjVI_g?3PgZN5_{vc!Hk|rpIRCgJf|7k)%9dAFocx9_P+8l+A+iBOm-avTAG% zf**)cIL;~|-w?KdPnMy227Q07#b8_K6c5BJ;g%V0%C5qLkFgyx%8RxZx+6yAM^f7F zMF=2Irk)*qU1fw;q2ot)&oCN-L_odXysfxinkYEQXv^OEXsUj25Ia<&u-k~~N_~~M z#zst6>y_kxL_5!^J2mobOk}K41&GLKx3T)*PP}k15iPBZjxA95`BOt?4xKjSu%WYu zR1EFsTykm+W!Nlhq3^m$BD&j7$^Pw>K=-*LuaN`pQ$K z$uxs=(6JUn)lPBIsoBd;wde?S)v5ZXQ*)`5Yg6j>k-wEk$=qwFP{QTiQ(!H4?-VML zDKJ-P8I86Y$y295o$!YJoE~I7i$1CKaT`8!$^q6#Y0UGd;7hSNW7nUOX~^1Wc`4*` zF<*9^F)*&lWkPhqqB%?#)C69C5WqHXVWCj{+<_JYYhygW0buZsr#rwE@4vfRnWdCs z=hsb+vY%KUK!YHT0yxZG_yPJjy0XWWpAybxz$(NIk}EGn6P5Z7sV|UR`8z_U z+STXE_*wKRRod(|lVMK90etvag+|3=4Jg}bmH;gns}86kyRYs3zhA$=^?%o1WA<*j z#2SSwO%#idsrDoC^@B@y{uo)@hU+0CPjh*!wn}Ad$umNMlrDOsMipp zYO`1eFRR>JiV6g}PjaiWkq(l*%u4N3)lbFr3LRgjA>efrKCV-^YEuYC{s#>B5DMEv z)!zjTp+6VYP;vFELNz8CW8Vw)6E;%P`my}VP*VO2`XzmiBqfD{qz~ZEOfHsumsUd> z$|KY=6)+5a*?3sgCf_RmM@8#>#JkJ|GfGBnmAE66y&Z?x$!aaXlk#GzMr+UTajQN+ zGm-=Sq_2MMI8Xb}JT1&CW6ayfn3c8W{l?fADf4vJT>q>v3;JGyP&^SkLPoeA>i7!C z@BydV#fx|qnt>Gi+l)X|2%85=k{S%~Ugkj_G8dHP3W9<~$%+(z)!{Qcrq)h3JXr}< zpUh~A8fNmebra@Ly{;3D%&exYQLV`)64%2+IB}Yj{tsg@84WfQ4X~chdN=uiQV%l< z#O2Dr67#~PfF2rAt*(nO-smm#k1c0m4eq@nP3jYIn6nXOP=27*pS1W$>yJSZ0_S>7 zCqE<&2X)zZ8#u}S+6MZl5MV)_n)^*!f)*BmW9QCg%FL&$O79h=xBFG;{et%QMdGwt zZuutBJKd{SG#Pfz8>R%$z=XN2^v3MrP}%z;y;)EteyK;~!iT~39;5GN4bqpJ@G_&$ zG{M;>s8ZExfstn$v%t7#8@a%kg~n7>30SpT`IC+H|xEV;9EDI!DA%LUNAA<_=%GD!o-J`Cq z?a?KpU|mv4l?hD{Lwv;^G5ENs zy$GTCs`~_uxb8er_I;CCGs|31U3cwFbNWfKRZyM%u;+d9fhP08S;DMYF3ii&MM4ty zbawjH&x)=#-3GaV(ut25TLzCH@`Z85g0~;c&ln9zlT4V!PoYxQ{I!z^+2HDmVl{Ij zk*iHpxynm?&2+$gOE#?lJlt{~Nu7C(8-?jn%;i+qbP?MyLB;dL%d)#$rxGQK=hfmn zVZ)7tCErx*@XBnIxhDmFqQ!EfusiX^a@Pk$0S)&7QN?zanki*hlcc=ekBigq0pFBr@I?hY_ zk~!DXBPBmdZ$@J+E%`rDkY!g2KT+ukzqpksCiS+!pt7~NW7)FIkZ881*U=QI&a^^f zpR!#jk$FE=$x}j{QZ`>?@@Q)XA4egCgrs7_Nn?OEvB0NAI_|dYEQaw$q_s85yUw|c?(o1ldU+6I1#l_j5ql+ayj zxp=H=H@8qQ32f6oEW*^z);Kc?vRBDp+r}t0LT8Kxfs5THea3?Vmrb=_qP6`!$ zM^y9dPh5%`i&A`sPe;Yy5pE(tH^A!<135?#q$u|Wt6NIRRINz$xR;8aYQDHxoMy4q z8|9%7h>;J9F3xunmDK`G0eUL>fjg1j=X9nAIFVT;GoOH{baBXV1*>DPjiRaDtq+r9 zHtzBuO?N2PdY4En_nbt_iNOKeO6MKfT3M(V<U2L#On488Mn`Gf*h)^#aHjvB8L6>o>G%R1G*5 zUf?h96{~V=)aH2#oDaUy1Sg2&!>f?O;(k62?qSi!aTrifYbYFV<4N9TH%pz@({yX8 zgEgt$n4eyf_8lF!)z83OU~~o;?$HAD>$%qB#cicU4YxGG`NrPL_4eW?^ZGqTMam|& ztkULM_ATWHf>Bm$w}?Ni)Gud5{W41L!XS!VcIUUxF(x?IuA!qQM7C(psIY?LA7CRK zbaSQis`7EW=ly!=9ty>Y(0>!&Haa`$qVxLVcsq9wvH4s+EpepdM88DBmC!Zyz3XgO z-zX+I3u#eTHrf95=+=@WV{iM*ek{Hv=f$+w#Z(5!u`aw$H;RkJ3&K1v+MMMg>ytc$ z?1cEaCcfS?*Lp)y2Y*qjZA&z9n&dorFy2=t&&OhAAsv}_3@KF#ijMk6si$3#HaChD z(z!_x0z@?Bdc=CV{>b)ARNO1FzkX)^X9K4EE${(C#NzbKacHu;W@ z^SFc_maE#qFzrkowa>*eYM{5&fprJ1lg>(+&8KD7^-uC;Gl25+9qUIj`;8r z1@=2^%h~#pxPpZ2OUvt#*-BJiM;NZ$-jkQfWKx-cJ1V`xLb!9^WG}WYP#RX(;OKCi zSCsr?K&Qk+x3fb8`gInr+8kj5c*0=hpzEz zlIidWqDfW63`qlG!2-uAgY!JS&?6}B25|qiTd@S1P%g;AYLO?%;np8o1Kq`YxJ{n7 z0E6IZ*`T_NO^tlrLtUL$6TQkB}E7@LZi-y%(8vQFy0)dMAx zs;eQl4hx#_Wfy6B`F&8KdW2BL6$ga-Guemu`*%bBd&BUDkL?rPa25f;CkOjuSXH_8 z+JpVE^5Afs)l$+DrxnS@zQlR9^INHEiqfmh9 zapq#=$|nU04s+!uLAARCUuZnDUKccoY=q( z__r#XoVyuwH8xhNg-tuqBpQo!ll`p4d7RJcN}ti`S~obAot?L6n1n8OD$~vxOlpcm zS5`R73skdI%3+PrNDl#x5oaiKUM*VIIBN%E+uLgpzJo-wwEoyqF!-h5NEM~UF~XL|J^TDt$)&wch$OUv)d1&pd_iboVq~s46Ls^G}GKFXTD&mDp@m z0rOiB^|-C*fMp8Dq5m@a zLmRN(mpJawQpCEa>S1|CvN)`%3ap}Bbg$Z`G@;~Cpp1pjCQ+8Gub#iAzrS5m=$id)r&)buRm87485clwFblx& zu1JK;A3TCuDy&$wG})L^^PC*DP6z?)$w&1tJt=HoJk*(-&DJob@a2+^RYMJI)5%^f zcBPU_aJiwG<#t}}rs!%%$p&-{4x%}dmT9B)oA)s5G#5OI>1Pq)tQR(-btD(8b51TC z4X|c0D5qWA*4{=U@OKlQE-xJSS z-rxkPrYrVFMnh>PT6u?r11(V1N%8n+lm2aG`rZluwP3hM*c#7Mm&$2EnN#51*7hOAoxe+;cis89{Ke--MhzI7bI387IsK-j+EP=R+r*Uew)+@UeM~Qu z!r}bBbUWr>Zl|jKb}nIo?c?<_z5QP6mGiZz0VYT6Ngkw)8dctw+gdXs-C7L87ML?6oDGk3HLHlfpj`f3Tnb_!Q_-W zTqa$Z5LOtqRk&NkU>(~eOdt0=S)tudrlWe@{&fx_AJPF^E*WtB7-}oRszN_k03rM}){5@eti+Fji0dM(+4=o zxne+D3OJ-tqtsihpaj+Mdt##5HZbI?+xH)opZ6>9LefIge5A~F`o#tSta+`^)qMIT zvV@C$rObEuWbIknKfTm`Ivs;BYDYj(wf4{Q3 zMVZh3%avo>6lJ#l>y>{{auNP~?)K*^FCekBODxDIhRG3nx6b#9)IEY=P?OAEB+GU+ zzcE4CCYf3bbWWHnKmn9v&)5p@UB`N(&Avw^LDl6I58PCm5j@p@nh}3-)l%`VQ^NeW zDN*&mr^M+RZfG}IFt4LA7G);pK}KMXpxGAK8}mMK&0k#qGdj2iky5(BUZ=)>XL=ts zJT}NYugqQslyuCLQ5%@JE^ceDhUm=k+2W8LO6?1+ve|Kdqu+@W^OsAEJe4q`TqERl zesF_`9~3^Xl3f!Arfbx&@H~kUg!ZwE{ID~|sk5MQ^+)*9Mm+Bkq*-4VzI?SXD?yB| zyRr1XPCjAEA-8(e81e_tPAcY3A=;Ot0Q2u za^4fX7kJO}N*Da{L=hHbUR{f(yqxz0*=Ggb^SsiKNBd+GS|JT$q(Qt4lWUta@n~~StVjx z!&D1QJh{KK(gz370i=zGNzvc=SnhqHG$7k9l)aYGos@uJO4n=ks4ZHe8hAD$rtd{_zgW9-S3~u)@o@?57vgaNe`t@oJ2=L>6pdmHAkhZ8p4uI3Pcb!CN}^XLJ@LiwR}mRkgmn^_g$Lo!JcL(0D*!NhKPg&F=Xh<1%8C!%WAFwxK9VRW-`;YPq;j;M z?SrLa>keF?#?H&Hw>p~e{CQooys_d;Y|DYuHRJ9D}F1Ae#<3>M7Egn0DOz&WUGOx?9 zj~}nKOUv%q>S3fIv}v-=sOQn7+n9%jyoFsJixJzvs56QyGxA!dVK$5 z0zQV}6+UG2{Iw|Ar1jI}Rao|Ml74iQJWXO24$IK%3SbihFJVEON0M%0n>GfMdAwj~ zXhp8y=%|$kpI(ac-&?|CRE+FRyAFC$Hoqi~d{OF`lUFBumr9poQ$;J6Hv(~TgBR)4)OyRhb^Dp5dCK`qqfwzHT+fDx1f@g zJqxR?T_a2HMpKp0ZC15bcR+`;5owE?#wB}>j7WS|3U!SQF{BZjDtO4|+sv34ZJ0d+na zp~xiy4#TA)qZ+^ zp3F8!DpniTnEIlRBD=5ICr8szD0zU%r4~=28pQzDO0Yj({(P*egRZC?T`K@=BndN z)qm609OrOW_m_8AJLD@|2;Di`VokkIo+L7)&n!9mvLN$5mQPD(BVHkp6=*r!9%BG4 zafkjw-!fy+H0l@;jfuJ}QOk}yuX|(UJ-W_HqUfS)rL)-o|2>!WFs+uKi#u&_f4%hV zdmrZ$+2eibZI%y-_ho9c+|TLWC=;u&J>AzB{jOg_Gu9JpO=@_9@F$~QCLa+&F#tZ< z?(#WT%1Xz%R`88(hNF%8Bv~t#Fd};369JomrvN{CGT1Nja&3?|hc9#Og7c_s#B}R{ z0PoJL7q8wh8TH`R8okIS-?_iz*uTG5@LT&m``c=!e6<|z)K_-(8*(I-_wcJwW4pUm zF_Gw{tKuTjTNaWcv2R)=T16qtmX({WDU`AG3gv8rLM7XDBJy7M{wq0y+^SoQ(`)$C>!M!8L>Kp!8Jvg_136(Ig!D z%yR9;f`m?n1o5mZgVa8zT!G1ElId@-PA~xfX;Qr@JlR9;RyjZpFAkIAIv*0c`EMAJ z`YVgaP=6)nVXCs#vMOvgpabGvLVT>Q4QH$c{6M{3v=CHTU)w)_2h&N41zbW)Bq5xW zy0fZt%klguGby_Np8c(t%9*&ga|PN0@i(**j|CAqYtOlxjbTB9V_^w(DZW{6!JdIL zF-dX93uO=IYLom87`@*jn60)E_*N;a7rc@3CVG^*^hw*Lb&`u>%^k9e_8oPoB z18uuSWVg2WFpD1tq8{ENf{_V`?EF#9&K)MZTcBKu1M!iRb6MQV?W%}|1P zOU%!`PI&5!U-bIBI{01URDG%RS4p>Fr}Wy0hT=HK$fK0Eql~98?AMi8|frH=t`W5;lt;Wjj^b!R_yr?eF8--*x-@q0YqR zYOC!Iu9bH4u|`P#6Dsl zB*lkG<^liXA0^%2#Fx1KdMsa{e5h;^24b0f(T%q4Fek90@rtwLQZDh3_pEcg9Cd+sNmzQdZSi*_a-h%%jfv!)bKM9X4Tk8#rKavRDj%Ah7J;lry zV&Q-O(uzdb!WjeElO$Aoqg#n_kJsnmtmZGS_bPv1jpZuD7`(5-#r!0F&%$nh6}9bH zXW}~HtbvI-rz-84+;VP#whh1X#NQBjQIFn7(>2LmjXIv|e0K zvNun?LG0H4{-A8%X=;CeR@)u9K}7F-b6ooevG(`5?e8`1?|0FVy_|`!%4n1agPL}Z zauXd9gOY>gAURm^l7r&BG!0!BeHI%;Qd84~GJ_lOS|L^my+!OdC>%@$`;CJONi2P&9yMU3 z$1!(QXvND`5o{42TPbis?7YuT(SU7PBEqF27?jv~wc-435U=7$H#%nq7ba$^vpAM@ zAuKN61$SP&!c>~Fj=t_q$cw-!3L_i~x-~Hpg^K-nHrY=BErb-yO|Z}uFOT`J<9zn- zQ*~MW=U6mtAC8$jqr;c0Bp&-4l)O=?6-u(dLdB!4zEYWgpt0pD^|z%n1fNRzd#_%q z8$qp5nf|Xa^I<}KkkDVoh$a%q#oQ@C405_3p5==(eeX%-zJ#w}y2ex>gu349XVyW&!1q^p?>5gwu%me*6co%wsX@ zo9mK%HuN`y?wet8EAv`B7V7=nr4y2C$GLY0?x&&rEXuS!J5E~NIdSiN3(Z{{cfSwK zKvOPWj{C31%@W~tb_?0(W5G)?kF61}$GmgGsDU=cJeC}90wcZ`;iET$c5%YPvWUi6ya}kMgI09I=fyNvuM{5G3A=yRVXgEgn~~hZNyvJ_#O*yX)f_ z&%H0+e%qUZ%sSuw#Pr&sKD-7uft5=d2HgFvf!9dgj+or8sbbHnGEQC>h~wnx=;2Sr zAKs%MXf2?S6lZG!d}u+6Ch4=@!IMQij;bcSTknqsAXJy9&{#&6H5D?1h=5*I>{lH^ zZ47jR=fX@zQvcXhkebw`@^C}YrtecWA4?|857eRI1e>&ZRnU+kx- zSOxS!x`W*QvY+g)`wi&t^;3JhdxiV@`!w$#?B@*!!ZE}f72Vr`oyIEB0)K*1!RSQW z&MQqCKEs_J%!L= zF-)@697=8x;zPk70W)q35Jl(8L{>J-z4R_1j4Isx%kg}_v|Ya5jn9x7{xagNcng|Y ztE_S}y0+STAd$R3AudRWrHSBzM0|0gjJQ11e&kib$blM<2N|CVRS*7 z(+)*~pQ~6`aD?nBayqm*#98o|x3Olda<9Ku;uhHqoXRDML<)0aJdZxSnkq9H@+uMm zDc9Vz6~^`7mSU3$XCn0vm#5$pz}eGDRwT2yk1R`J1+hE3$7r)O-M(1Jh=|Lx*kXDq z`@RT%IyaKXJ;zy%Z1B`*yMMH`xpXzo#M@}M@LCZcG|$uoZCo_APhUNq{6L{BRe<~Kaak8hSRix{!qjg?Mmrkk| zFgb1eoE^1~GqGiKX3RwA6TJS_zPLS^S)HsVBohOU18;$hmgSe^l=sbf@h!(v*(RP<;Tk?5SM*DTqw%gCgor!Ic4EG0pFPv3yss}U|RgW1AmA!-0 zv&uG)_b8Sx^By970O}TjvWwp%!}5qksnWGp!}8r`8Fq{oXp4<_LFmi5OJ6T0DFao) zX~Svb3$78Z%!8sE*xhcOiHX5|2YI|)XJy_xM8vg;zSk#Qs9X|#Z%OdPz2qT|laPJE zEBCeiPjii$JCff{bDfDf*+q!KeFot_a31CN1US#lcR4>V9!vCjBH><;kD3fn^slU2 z&)4kz=Cc+KMnBYj$mQXbw#td`OssKU0xyKC9Y>~Td(CC+~4`2-edyD-7Y(&-|I$~dq-dHpknX_;w z3W-AAHyTHyo+$ZR+^KPA;*qkeP=g29=YyK!5=bAJxx*QyK#o9hOp<@hcilu)Lvd|# z!1YP@qrAH@A9tLGglw`@7H^5qT2OGhQl~-ct|TT60GaBlc&Qanv#sb%JXbh(Tj1m+ zm=^w-LRdJb4TPbq$^yyDr8YdB4n59F1)C{^6c=~}Y**}8I!OzkK9$Duz*=dVRZOHtem+~Sf(uoc z7Y_?}t* zi{vS%s8f%1MsfQ#VGIXSD`+?G4yni)L0Fj^B_JDFXSyfAD4KL_eGJqiMhatvnB;zH zf78E0hZ96iKHGc8Ek6oJhplWtaq=2mSQVNs2>CRtr^tI)wj5^$E;<{0KLvZD)y?Au zwCe4&I)=13_EfgJaGM_q=W85#xbxf`P=P$_Z4tL@UKR>FF9pUTcZo~Hz-j!IXgx;bz0 zXyx%>otH=k(PK5=?O`?YSoL>!=%PH1p|WPJj3EE=fPsm@hsq_g;H0m101lon=L8EEsETM?WN}mqUY){cNEVxGo83xnk!^;^mLtgy4+$haOcxCpQ2Cgn{G{wa(?9L za;ytzp6P6PtjrW*r~8R7rTHBB2a8qo#GStMya`H z&h+(Je&|*Wz-RNhSECZoc%yba>+1?koil{gA%@{@_Bh#nBo#J@o3W_nX^yi(Ee$ht z;yA~diLGfwGqb7_)h8~D(!fpkEOL=$H^741f=e++Vog*;PA(OD!(7j8_*^tMx*((-;TZE zQCCPSY^Qa?2|qqtS6MIWTDm0;*def)_mRRcZ62G@pS=(N9YCl)ZOU?R0%JkUS_K0@K-enb*C< z+dn6RzZSW*Zx-@)QF0BPE@)J1L*K#8!^c?j0dxg;itv@87&fzzCOsBbP;r5%C&C+0 z^oYeJ!LOs|dUVH%SL2M|D-{ft{fa!tuKkH(rAIoebvD~$i4NvVh?Zk+;wq)Cz{?bP zg(OK<``94VBJ7g{#By$iB8q$IX`&zHD;XtaHqWpLn?igxjJLf&%}EiR8?Q<%7#Usu z*lnUDsNB=I{?QOd$I<=^+(Dn{4i0qQ)mgtAI&wlLfPCMt<0OaQFX3+bgHn&;{q%Ig zE5?N-B8jagYR|0{U0bZNw3IA}+H0=B?u`KBz3^a-EW!4SdWi1pf@d$L`bQAMe)Lf(LcCpUmfNhoGG9I}+IQB= zpG286ezD-5;^|ynSnq+rsg3^Hl}QwiNsivH(Q60^rOQUsU>a3Jd1Kfh8cRgM?v)~d z9<%1a1@;UE5Mv^0^*WxeKd&}Wq*;7*IX6sZb6$6^o9<%!%D7I*?UQ`5eqbr z8eiz3 zGYIPCkR*cA$oY!LVTmGz){4IWQB&dBe@M{sjP2dky8~uM|ip+o$2vDtu0fXRVX+zx65f zvU?@>Gb7A%%F51jT@sm8Q z?buu9%d1>HlArilQLb>cwAyV2IFzb z_Ex>dMS^XmI8$C@N6u<-C;taI<0r8)d#nr<5ZQX5;gcjCjs~n&9Aid@UcrA>I9HGd zMj7UeU7#>j2=(UU-bSO}z&j{kH)e}5$q28;R8tqk^s*S{)dtVJ=$Z213Z*Vp<)j-z z>6ednR=x2S?aHUIbsk~7nEP1FTp0`R@Cvtj#{;}acPdT5*OY{4>~=}azFAc11FTkM zV_;t>TWiFU%^UP=AOQ@@B&|1^gy5U0zR?Za*sy8Znh;(gKRj9;Uj z?_(%W`7q4HVLw(Rb-j#26T3v1Jv-P^C9+FB(jo^n1{ulLQzNIk=L@$BK0PZ?v~3BE z@!*~({pHqLy&9igQWs)H2ol3}K{b&6z%fwjk7+HDmb=let(~3m1NP8+nmq(BvuB#MKgRp7qGPiC7-VsKn3H6`?#}i2 z-)g8I??3734W6zP_j%%Kt4x8;Mt27z>|UJkS0!S9^(=Ks1$IBk;0Q2)>jb*FCB9zj zIvC4WLnM z=oJ_zn>1pHJb3jhWIG|!(2$D?UoLt$^MTY3!XY3CHmIM>%gT;I1z`(tgz@u%Q+544 z@TsUI>p?e(1A~LEk>d)7)Q)oxIffPpXq9V(vnW|fiA6=mJ%v2+I8_8;EHaKw`weBOLi))H`&p%~m*2QB zAOggfT~Yg~5M>&GcTWbSSAZu*hDRgP$Q+kVnbY!xTrKWgfLx#lWwDm`3_Yzg0hBm- zfPFIPh6p>L9Z&z)z~bqto^XEhWu0`!x9p+zyhjXguYO%WjJ!h|L66A}NWCZMy#rzg zy&>8ERF6v^QpJw&I{8n@ao!=loU_wlpS8Xwu2#mAB=40srdvDFXwm;z+J87hkFG&AgaA!m&IjIS*zY!3wQz#QMeoqH&5LfMVs8tOeeNx3#?JXDNi&D1*)kxu=ik zIAey^0NyD#2`^G^GB*k0BC&gu=L-2NnW@Pf5#2o8BT{Xac?MM%dtc^S70b!;^K^Q# z&J<&h3PldfgQB=iW$p(eomOT*!iO@uudIJjc^gPRkLaXJ)FTVaqr5dpH-ua#C5-ad zNE&d8cc$=9@OpxJ_tpqYaoi-gNHr#Cjn%pb$^i^k`+s&tCyJ-y3{aTl#PyAWF;alG^a#P!El z0g1#~y+wAsnHA+v&dC4g~ZIflp*0V;+6 zOq<)u&rT6<=E2sBKSpuY&>3Gu*-NDNVC$!kNae5zk7qxgPCF0h$rq~>FH$c|CBDfO zi9;nW%%VE^%kx#VBI)<&*Vt;h97+;gc6a7;*p7E+Qw&Vpnz}qN(EG&G;xG0T@zr^E zcbj1)hshJg@+bqe$W15I9^9+%9TCp~3_hM7kK0VETZJ>8*N26mwn(sv{1NnR_`hH& z!0GR&+!$Gz;j^w>4MI@dNf5sLIkZ%kB!1=m55`3Z@t$V~hL^U4U?twjGUp6A!db== z57M5*y+oqG7z9F4;wRrOx>^-m&c~70u4~U~e}5aDyPRJidY1_97E|vMnY+cVcM0!q z;oT)-cZ>hW*LlE8QJwvNPMNwh+wbn}{nFub0TECHR74RKdj+wkX~dcYef0`bY=DYr ztf1HxvBXLgu^R=9y}XJwYHTrwC(j_Zc$hp^Iz)kQtr1Y_q$Z^O)4O% zooaUQGhn?Jqo*_V?`4L{+`F0j&s6E$@E+>RZilBgnFn_;%$9Y4d_bUGWPrL1f#Gwo zY_a1a>qX9$ zs)2`{96#D&w~5m2f}F3xw~MWA6Jg$4CI;UoqT5Akvu}32jjf1p_#NNW+$OyEoQ~T? z$G+iyT%-DS@q~z9mLxB?B`*L^SED>&VhB4dK9UL^OywxmT&)A_Rh0$!)a0C%OMNI( z->2oLYz?-`$8KSDVGi_pz{*MI-p_^aXzv@asZO)e1fsh@E_>%?o&NS+*_4y|Q&!%y z`KeE4s~{(8CPF8#&t*CF!B8%(oH9@j%7n5z>wTY*XT&E3mHTD!)&ehr8Y2iEQsG)v z$hSW%YHt@or*}`f`tJ12h~iXgZMyoQ^vN>U-}@+C{b8Cu$$gNn{w6(-@!J`HMY2U+ z$rfx`yWy|{BuN@Xt2|sCpxS~q`$(@jtTB^^ACg+fpb^aaHk=?$#0fOz3QaIaueQC*3)n?hVQ`ND`~ zjYMLdG7fZzV}KBiC&iO5$^f20!UXbWA$Gu*rZ(0jG+5UndW4A-A~L$gh|@%7TN;Ru z@(i-+28jvDc99pm7+YmD+4g)=t&fg>zfA04EUn!+fu!nlL^FZ3*s%)4NlZ6>)txzk zPnz|-c(+0ZA85Md2+mk9$ju)p$BV<0TXcxy3%5=SOv(Q&~EJd zu66qAFc{*qw-K>tLi>cBAd9V1P8XQrij^D(o+hJ0?Iw?cBbYDpFbclJ9UqXh$Gd0j zI6A)L)FXCd&}WqKUwdaG20XMU^HtAP9650^s4gN{;>jN5`52%houi_?K)95 zdb+8w-6qD#p~P|D*l`Q9YuAdM*y9sVa<}+EuspXm<9t^h{ zK_)UWSlK4XGys!j5b>CVTyZfjgGH<;@<6(-jGtrM$}==?_6+GUgB}a3~80lnGk@6|7JL8`GbP; zw1ZVw((=BPE!3>A%ZMdyV_6^{Xg98&O1sly5HX~|u)vZw%xs#vDskd_@en7+_V~U3 z|NUfS{O#89G2HBz!NE<8-&_qdSQ+;_?$TnxBUoe@t%whj3!g&OV?FTB38>-9il__x zV6bY<@EK+Ba)D8HlXo*vu0>F%lkaef8wNp`{#dfqh}7vQt(+6_k(v1%i8mk(vaI)n zK3$p;iDiwu#{|1)wjRTvbc-X+3$0rstPKR1?2%PkZt3limJNQV0gQM^Jt9%M)5N}c zd!z7|i`-RceT$8ycc;wV2HikXTJNH;VjRxZl{fv@GmWNxDyEmF%~30*yhRpP%1O7# z9f=O#BKxeA;Vsf%DF@#oo#|E6_MP4`ZMnBn*587hSwnt=Cpsh%B{%MP{QI=n`faw%O*1;g4Uq=Y%vrlz9|jO5RQKEu;u8j=?a~?5t6| zT2L(LM^9`EY-o(!9R!xUF;M?&Tn{wg4r+mZr?P$l!sR)lzKf}y7>3Vfjbi$S(5Fgh z4qp@+j*HI)B>LK~(?QF5&jjNP-|w7+`<0A#f)+bs z3HC{wd?ZHC^bwzbr&g8d-ftz+lG!D;ar)Y&cxg@Tir4-IVNE?-T3?`M zV^<*bI1r_zka@mnA+Du(jpQDw~67T_Pl)9#8Y$=ttoG=-;7Ud~`Z%tf>R> zZZ5}b`DqF&QK#k(W#0)~9RxH#(G=}!qOk*Y1C2x}OY8k{j4!KVVxqId zCxTDKKEd8~^W>+BCnNWXs8#o&h}xi%?Yf`2{ui$JN5VDog&X}T?L3n9o)MXK!r8M5K{W7s zp+^(bc|sK*R|IURu8G9T7W3XIuc-RJs=-LKT-pAOJ*gbFF{MdY_{IsobHukMcCWp! z9e+=~Q6yRE%cb5`oI*4k3W9oyq5e|+QZA5UtuSdGwVJr;@5C{r_*4DMvOY{* zTV;PfH-6v9Y&Aab6efTYVB~OEH(}^0wn$qH!y{OTokxaMu@KG3mNUEIFBJJ8S63nn zx?od(5Ov-!3#w^Hlvf{C-%mPHVW@e;#E_xK^rX) z=loHtZaep*PR%CLQ$v}8ffv}hbL;_T@6UKT7CG8kUlj*cpezw0K2NO^W%LA{Cw1)I+V?3nsZZ<;PAgA2^Wl!FggENwl>;XYvVp zp4evdlQWz=%9?tlwKh4q#%aXO1r>4c$v`=PMj8xc+T>oFD{PxwA6 z=FIKW1D&DS1m$CHK0)FI8pQeFds;YktdW&{VbEDbKV?bYoVr0;=M<@9&+f?HN8&tc zb9<^OODZ_Xc^HRX(w`MXlX%4%RfB`$(QQ-h5WTVT9MS<{%d3M~YLFhNVC8bD?P?|g z-*rF~uk1c{mt&R)X^_^vLYsV1Unl>Vx8*q7{$Zqd#`y8?IrinF`Q4Ur54&oB!L88K z3I`UM!vH5t^K$W@A@~Gy$^4pm+%Y^xx1hG9d5N%rHp!iCk-JY*77GY+TjL{Rk&o7h&o#UOQnjrGZ6FiEr0UsPQ!J zw3wYgdBsTRvZge5RSg^0l^(Vu22Snva=RG_XOCAAY~edyHN)`c<{4K1`C`>`#gtpE zv-PO#_Z8Fk7NN+c!%Z~CE&2_*k@VC4_E34eeNx&d*k+1V5wn9o6fR9e+nB>y0H<_t zmhkSA@^0wa?JYjBoi7VD|19<*=I>P|FY_sZL5=|Ja$}r4lIJ-gCR^53YLyPJWIwZ- zF?z?rWV<6_idt;J8DWq@FD4gy3v@D)CV9Bn%h;YVtXNa3wnu5vQG6_e+lG?RmQ(SY z+PAaEi)#&J!lurI+q-+gtYTRuHvX7BH_bp|%2(kVWki`Jwp)%ncE%aT7#1`0;HakL z$@Ikx);08Cs<$Uc`-7}c1>a48a>8CidZ^k)Zi&KnhhYZr7D{=x6pz`XAF`b&Z#cn| zC4E(lQ>h^$FkB8XOjDT8>N@72v7}7In##23hXJ7}J_yWRUpRSz+1g3%5!spu{4@PW_!d|XDE7J2L@uRKJfM?Y9^JXVXM)}FOtNO`v z;k>ID`Dz_KMR@}nV?^d`LS9A#ho`{|%J|d98QppEkTtUOpxkB$U?D6SgCGTC^OaMY z=cZ(rBY@&i`sPOwTp5b6g1Hx6uV6sqc;y?@?ZnJ8v+CDSY$q5y9vAH&;q02 zS(Bj$bxZ8;4wb(uf*qyD6r3|`9Hv1-&yw+g6~+~<$z{eVO`CAv?4USq#lJhosqs0w zO2nUc#K*}Hc`%>vcZ2(|W5K@P9pgXNDfe?F;P7B!-f3!mvdifr)*RadvSyJRECnV? z(n*W#M;=Am{mNBeyS}F{($LB~=a4gF7V;IYvx5X%X^P%q&n-8g6dO*cP@jQA$Gb?2 zCHefb>E3R+f%{n2Q28ohrlenNj8BZ;ScbCLC3!Sdfv{6s!L`rn4BATgzgV}t8@Z)3ho}+VvF{jnZ9(51H!}T=pc+yjLws#FrlqYqDsndlzK^~8- zwl@$g`!qd@Uiky&zM<;+4$>O?Qd6~{cY3Yy9Aw@Aw+0tvL<)W#v&{3)cJw^Qc2YMv z%(n3Szt4kbxB3Yn6o0#NOr0#%2FUnUo2Fnr#Z9X z!131NRKD7#4gtJ)pU{^+C0Cg^KJzB4?I%g~W$t-rrPwq6>{jIC^+DHBfQWtoJA_%b z&Q;Gq7Z{sn%KaB8bkw(x6uYM%@18ch=iimWk64oSldiqa4N&&{XWY%^hyQ@|U-!fv zo@x`b4Mf%cx0hZMcL&}*K~PJ9pXUPgI%H7x!-4;DAl~$nq3~9P>Ghuf zS5LeaxILo$k}%S#;h+NV==s$dz=|A_Jj9c!%+sl{GP=d1^Y!XL+#krE(>A5-c4GBg z@;8K4nlCA5Vy~!tCyvzv_Ua>tQ6&p#UmsJu#q{?F^!KCc&XTR_ZYd!y_hVigg+7hH z*RXgJ6pzvfG}xAiR?(-qe)K(`mPgiRY9<(=BS}IfN>o{(3o}h*mpP5=f5y81PQ5>H)vfn`5Oc6C|L6O6w{I-hp z-z^dT3o4tyghlY0Pp)C4Q}M{^@ipXRkK%nZV;;#4#(cTi*Fa&(%ntU%8r~aC?Ko?- z*&IW%+3pVA`@(>=xS8&mJ5Bx0zAj8(70IKW6QG4a#K%CImqNWUgwWW83@MT$-U*Uf z5#5!pBjr>45M{c7V6Y)@#zev`W##}WZ#eb~NLO}eUHCqzEJLW^&PZn-4D2<5+!1|j zv2CAii*szUq|g()({eTnq|p<*(-kSOibZtg9ps-5$A@Jd$_%x7NQFZBCTOwki; zzQ86&hjk>bOY0N;Wi62*$lyM62W{LJTcrlCUBFUH^ynNAC0r1xQJ~YBC=v*+qR>&w zR9#LO-DnSv-H@rb>r%~jlW1mlYr%J|bz4)PTnBctF%lmY$FMTH#n#Eo`pQ2Grwy5Lo5{EJ4u*#)>j$*0KSZLG zau9#Yl*;yZ8Rpx2nbhmRq?+ePYC)89(PlAbp<;5xO_3ODvt@srsWQf0XMSi_*LZ#- zvG*EXTXSJnEzPR?Befc`UxPX>I>Don_gIvEG@=Mnk2qYAt(qv{O?uWD(9_d!7UF7{ zD%VNuoxwJr=b_zu6ml84klh1T__$9!Y!j0Qp7IdCK0YnKACBlw@F{pya~FuBDk%22 zA<*5W>EnvrYbZ76n+C)^IzFb45mS>i%q*(3n3{@@?Ys3usgC=!M~ZdwuY4@ww&tDT zBS<=Omi2y?b@fu{BX{Oy#N14;+_^SOc6xt12TVu@KcxAVT;q~BGpdNVSF>5y&lkMx zg&BQGMl6cNnX>of*RvpKv^O^DC$6w__uKhGud$DY%1qo+?kaZ%^0Q4(T+=A29jpQj z1lC(DZ}Q)nZPPb2xR+*zBe854KJMzPE>fol@6clgXK^%n$+-f-4< zk-u~-q>|@N$xQDQx>CeieaPZJo{q8QG4b(t)|wo(GG)*YuRR`Kykf>^k@je{4PXEY zXcN5JB|nrPDzT9O7XnyKhKzKDn{vUboVT@ifc+0)e<6zJ3j2p#`rl-p=I_p>SLeJ- z(+)|4t3Wbkdpat$DeEm3a(zbsH6w1w^vac1%gWw;^9w!1ad6Npkm8 zEJRL{ZxR8pED*1O7>*;O=m4NHmb@Wlk4GyN1*mfZB9(Yt$)l{MM{C0ROx^KV8g|of zTg@Qb9b@|C`wol;wfRDmN}WPBFf2LQY4&OUhVUEtXqZ>`!FCMi{uU zUgIJRZUiw)UDt^Dnt;P@FQ!ZlU!$P};u3CUuy_mE_j>Ag48ak?K8SxUV>dD7LV#OF zZZ*Far*y~lJtsdVt&7RsWp)6z$4Sl)G=Z>;ta&L<{2=sz{W<+fx@^_h#^!%6ZYmZt zlqMI8{N=`7nm{^r9HTI8xApkVhBm~ObsNXLHTf`WX^C8TwmO^v=q1K>1YKiF zXOi@q)XU76;0|43Mq$QHiEC=y!FX|IYK~3ToM}(P$b8|`ju~fRO1lCDc|8G&hTNJP4Hy2~qQvG2o$8B>A zm~$)n2f1gDW8+K)Y@%s3lG$vN%xCt?l0SqE5-x!rF_k;Ynmo+<5`G+bK`Ir;$G;@v zAuQ~MN;;7%B&z6egx27nHGg|+UfE>d6?N&glKpl`Tu`XU-uFv6c;w;KlluNr@PV)2 z55;?7zh^ytUzNDEu=yiky?sPh8eZg1aaew8ujYtu#pK^gFBh^kamg7>`b6ffS&B$p zdpKT5GVOwXQ08s+NUrObi}^yuIq;i!SYwAtBWu%WBjB+54K)4kMUYTzEKc2 zRk3EBRb_}0<8)JfdO298jMn>kmH4cxM=sj8mz^qci^#7qD266NWsRnh@bSkY#IZ-2 z#u2A6F3(t~WZZl{mo#d|;$*fQe@q%~hkn32y~D!Eh1$j%w>DZXJR^p$psegw zB*5PpmWbhqIf0lRc&CTqI#sv_-fD6kVcz%LHRv;`>oiqdmf7yTo-v6pVXXy#qC)@+ z;-BCj!Ei6oo z&C%wqnv6Mmv#5?+D3*)NRYLGSeRyPjnF7%IuulhukEL+IWoA3#6XPXH-wDDwd zB~;=JDlra0KZ+O6GVzhTlKnB_vO6so!Bt{JeDU4myB4|fss0aei*F1MWHIFTi zpe@Z0s>>8i^2{Aqlex}x$A~0R3g>|MBz6wm!^bXzU;+aGv>dYEs_a2Fpjj|G^<=;| zJBNXOUL^E%`D@wN<^4|Ne<(2mfg8HJ(+^>aHYD_j_o!PpqerZw!EK!lLz$zgtAy7% z{8+#jbcsGr4qY#;H{4pNg!PNIx;JQeEYSA`sh2hX)Q?jUJTJ@J4H@R`_z`d(-#H2APqzl7n`%$6VUoLO92DHou=81Cf^G>oO; zs3!?hBb645vtuu6NITCFdxO!wN)TE3&aFeQ&U={>NLx-Z+}J=EUJVQ;+thvo%p$h| zaS7qWmZ_fEg1OA5G)Z4brWzSfKrKy80tVDkT+`fc4T*Xt6LPf6=C&u7p)=E02|HdBke0DBK)95zf^*`D ztoSBKU!SsnNP{WA77bav=CK4;pb^>cx#HN;%f^YNv?cbmEcQ)<*N)3XC^NNTjS&*6 zeeN;Mx+iDKK6yYO7%$u@Ncj@^0lm=(=n&Z<#v4Vp$O(u$AYGi>>lTklLPueyZ#+Ci%-YA{qjF`%%IKH7Xlt{F?z z_(u$~4B`Zy07eYreOm1qKf%mhu$#<{`d%RYC2*;1fXRm+Kj8RxI4Ls3Dwihk3m%kt z+)8FCS2j#-M_X231bK?MQ!nx)8_KaWVuy0+0B`T40#!Ld%2CvHRjuT z+r=yf<1tzvVVYXj)pDBH-t?a~Hatv_q?V90*NP8vn051iw8_YtHEN@J(16l6sINrj zP5XK^$yzC%6Vuf6)(eDMBHq!2ooaP`Yr=1jtBd3b1?{7nP`zzmG--0PKz91=!MZ^G zC2&fl4^2^%I^40C4W7>U+h+SSIsL&o$y%<{IR_KR&YzfXn$#nHmO;gX9>uzpaxA1R zdMe5>-`46QAy-tHiDPR>n`P5q{@2(C99e$(-U6d)fV(g>hAa$m&&k}_XqQc*z(DBj=b?_3AMR|z1 zGGnO|jqrJr=OKv?DH#v=5B1LL$J%f_=w|S6RtHu3KG(h1E!R8m(6`R>z5zj88jhA# z%fi(15Ih0UgJg5PC-!H&k84PLC3GX%30vBHnb$+`q1-IRBZggbG4u3B(|g9`ZlMQF zNbm^gP@cx=1tULOrN1kdcMp*EC9&T0>qhagti16nuNR6pMHM|f4qcwEV1ld@lz(yg z%hRQDS~UG!WqpYnjd4KE7#$`inIlNGzi(MC(5er z)b=Tv-@Vrh`ve#Wi|qv5^6{bzZ~H{ith>ZvY%Q@rwqDIypQ8I5q$uu|Q^casd3c;MS`{DN_~`7m1y_Rs=UTsfeYS8-wisqF$p(KUo!0by zmVyK%W|(xSj1z5FVDM%oaD?PB~h%0ShLArhb*WT(Px z>RvNdwvK1YGI5PCx~5nqo_8v5+HM7vzEb3kKVn*2TsFx@6q)ynU|Dg_m2GL!ErWCA zHQHJcv1b9$YS5&ess0c#3}`+k`4rlLx}cBRLP7+gkF!rEQ`oVO zw4V%|r-BxZE%6T}zPE!f$RHt=-D$)y$~&18oL%guT3G|nW&M_1==UVm?JNh!uSTYl zKTB3zP0A0X!fvUnZ$2cx-S(Nhts8%p+&bLC9^>RneWN3W_bi!v;oh>W`GP8Tvds{B z=K;t5g3b75H2llG?n36X>}cahOtG`JaVMjdyL48Y+8WWaZP4a7mpHl-W* zIw1TH-9oOFSSe~zY9bz*mbg-A3wfy-(P)!}>}K%Qv%6tAj5 z@o_+9g*7s!p9*VTD(?iKi78VdU0?=EkT%1HJ1FHuy{?02Vn_Y}qkC33)B^?Ato4*x zRqgRTy2aGfm^X{XbY5DmP1rhvs1)GnHYgmOsHJC-t|l^VS!_?ZUHA{&J71OcxA}iKg{KMrRQxGpxmN{Dzb_ia0%K0Ic0A_<`JG3|;;Tpm`jVrPn48MJ44;KQ;`? z>Z%!)8NE`OiJVN~;`F9zX{K&=`s8V)>BVUs)2B?!O%JBkO+Uf9D$KuV7oW469w1{` zJI~tkWjp(lO#}o_U4~-PuTfmrzsKqLlQZRck$YBvwtZdHtw(Q!DXOKS+IUD1quTV5 zFALc!FnIXFa?+)(=A zf2@sR8UQGp1{ZN4IEz&>Pwa2p)Wdb1BI5>0*6pp=Ke}cFa7dar+i>y{akU6nh#6N4 zZ-p4laf;a4T_OIZtS`a_eNtMy;D;~!ld-n+YreP92Q_$<_Zv@n7Y5$P8SEW*VGzai z21-}qGP9?vU&voNvQ-{1A}7l_Vv&|vCL^GZ@8?h$r&m19j>XerNmLyh=SrcsOyrX% ze+##P(~a*5H)kkjATS3*&5X_A(k!FeeJ($hpBXc{-_;>zs5gn|=%OvJv^6 z%}&Dp0=)q5kH-S*>y>q`$xmTLBtX*Hv01pSzCefvgek{b%Oac09q6lN{+ZF0K6hB< z=PIvfs>++1Tm3F>c#d!fvKliGcPydLJa4rC++oLigR?<^{kK<2?-m)YlvCD=Y8K%n z*WWvuJ~P%PQY)psUPK#27X4#GJV!PNaNf7^4;Q%i27zMYOe;@MPivU|kmSl&=y;Fm zvffRPb9QRg_ol&=pq{Es=AN{?JDpjoysO}??I$yjro87<-jiu>UPdnp?Z@!{!o)7; zLJ;w2+FzTt{}!naBIhQMRh9IB<&k%N6kQi(DQaaj5B|FX@@mAJbRSQvr_vO{aoSXl z(_e(Fz{`2V8@86i%?~4;8APsqd!Q-0EmD7s?8~C)(kOdHBrcEYuE&P019JQ_*cJq{ z>_89Q=I+S7Ckoz+d>ZknC_f?6kBf$<#17;Kbm6ld%k&zrz04$YJ6gL}3pA+#m3if` znv)BY8{hZy??C5R1xOs~z@ofVG@*OXF@ln%o;yVzpF080Y&T8)9uJc>AHW{yDM$t( zZz1>4r5bjje|UO2`XcP=*)3nqnl(93>ZgT-x~NU=k6N&!dR2*=MR0@kJHna_KW@-B zk%~kL+B4bNh45J$cpvv3$Z7@ip|+wvlF4^4&fz;unA-+dOwtP>4~d=;i7CD*t2asd z=_upn8*(z=hre7dO92#=7HtD(4YpgnI_;8HEF-XYo~H8(tFo7{>DBH3HFg zx-o`~96i}ul^u=ef2=G%Csmwga+Meke=Q1<6TK(Z2W)u(`Mh_E49|xOWoK|mJ8dlK zL>IhI8I5B!=#)Q*Q#IVjmbFIk>}hej!OvycqE3z*u|X_HgJOAY6uCFy>_d0hAoA-) z%?449*NuG(Es&$v3v{hCSu_ab%=AN(r9qn`MDtD?L~cFjZp`NYna+Qm#x?erbik6d z6J=_7WM3bt>ww?%V;1XA)9RUYdP(HpCx8WI?gV69Cr7SNyBpHMYcltSjQ&@aHp&r3 zQlFm5eVWF!Zby*(LGGjeB)AVE+LO;CqE|!AV(v-y8asOoe zLy;u`wXmXei85w6&QAmvS>Xt*6i@t$u$JZyMNmdC)WfOMBbI0%ZlZGpc?UJHj+)b! z$@2kZh>RJtk5GAYwJ4dbQe2&Byf!o3baNunP;cq~lQ=VNJ~UhztJs65Q7z<{c;^_u zMZC3VI8NnS*9hyb9LW~Qj1-(0I97};?}^_^(#cG^DW9YblsGmK4mg+rn|ah`$ApH^ z9L?0ryZyb1M!325-u6DWHw=+CZnmk#S~Xkh)8%2-Q@Q*%*@TxHsr5Cv&_UoV5XJfC zu8sM>0Ns`HhMfI++I}r<-uokQo!E8DDbgAP;|6R<69(7sXhr%pZ`6F`OroP8&_TIdy`;dP^a{HQJv)oh!y<&e|m z*X-^5{&V8%`6YPSy9>3qK_s+gldNaQ zp)%!K!Mx~o<-#z-LOEONGe~x$l9{+w!f5<^w)tkc7v-^H_wHj9sODF%r8c@vtOD3L z6!Y4#_Xa7K^NJ9lfd3*a)j%}oM-^6+@jfK_T4bHf=Q7NbhLy<4mtr4UQ#`Z#dDH{< z$b`M3nEy+`^kKa5J_UA+7Cl=CHWX~w>`X$Vc*m{&m%G~z&aZlv;}2rx_;5{K;iRb1 zPHI;@!%WS7)P)H|8_@UTlSP&=mR7}!Y-D^qF9~&M{!vR?h9r~V_~fNqSZj;aaAy7> zkO7`EoR8$t0wF8X>8z72xTGTc2(_R-GoK)E#`!W=Pw$e)bGKK(03GgR*!T8g69rDn zJ1QZyw#m8XsDWkGaj> zSHxQ!4P__f7_`iX8qoMj6?i#Ewb9ur z5Ob8KPYteg_eJp}L@C_Obh~j-!OMPrZGOw@F_M_0TNQePh(@qh0ys@vlXgko21ROd zxb>@N?&x=JOk8C#LG&#bE!?d2As=eQ;jF*k zCHrT_sMpqE4ChP@?uIs)guU(QaN`7Z|G5kj%X38LopXuc zvZd@uCJzP~O{M|{z%j~3$AoOYx4&BiZDY#N+QIIA6$k(-bHz_Sb*z~MJo6;$4Ac>P zn(0fSYD21Ug}4P{2;1wtxi{}j&G5eQi9>(cnVfi>wM^E_k!j2flkfR!6H8C>F^7)l zCmz?X-YJ?Kve5?+T!)h*>nbb~>cmA~3K*_@_ScODej2_{P8x2ICQx-Xf;ZL76vMe{ z_=rL`iFXeDqiyaxe%iPZTzJ2q4b*M6bsuR)UG3shnZJTvNna@$sdtf2=*6UdLTge? zQJN`~{3-`;O} z2lzQ*KfpIX4LzAY$vMvo`y;;b{!aX^cC{E)?)V-Clgg60z%lm6MEQZ1(-fcHV!wZp z2pLuTjH^W2jPjSu;?d5WC-wmA**nZTG0curCj3_C+V}}r{BVBtg;8lNNI8>VzCXOp z2WD(&(b}>(w)`S9g{&icL@Z;bUL(xt&&VGf(3wzDF*;kvN4)BjGLxsmty70#CkPQQ zWT#F$rgk?@aEbk3Mr;WJ9BIMZ%vlg~V{qB|8us5r6g&{Cv+a5(>SFC^d@~8tRH(L& z2h_w8GbwnU$=Yw;GZw%DXa@B*@57REL1q%Q#(hpu3Jn_0GL) zyw|Orj^2#~Og$UPKv~&F0)kB~}TCh|*#i}qF$=ey$M^aYL}d-vq@d5+;#k(jo=}P>cs~UI3s{F_Pt$9XqP5x~0V7`VH+^OeFy+C^NWod!jW4;U* z$Z)=FT|io!oDm-n{y)dP7RWv4%U{O7Q~h9XL=7_#2A+H>pay0UyebLe9wtn7oV}Mn&>v#fe{E3k$Oj{>9}n4I zP5R(pM45Ry{3#JWEW$_l1OfVrfcLPGoCG64y{LEP6*N^-U*;RC4acH&vv1%De6jZ& zck^>ljh_GS=RjinS4Ol)02^mfEU4cSg)>Dp_#ni~eUyRzD>co;9W3 zi)4|UMPlI+)yyOihZzCzKH7!g+vjC*rt>?*b7C+a7H3V!t&G6#kKz~-un1k;^OWZ> z%Jk>r8u^*A_q(P3kJrbA`Ct-vuZ`DCW|8t1E4fIy@yZF}Bkx-lDZN;Ei+sFM1LhNb?2k!(-VF(Md+lcE_>2{U=My9_5 zl$XOyA`j?HWiM2D2W=UT7DWWySB3ZkG-_`Mr!OUB56xes2&j6W3cId;6cp!YsnqYq z?=+`9X>KSlSNdAj_gUfY#1e6*ij)1>LS84`8>M(saGjOXInx-rM#^TzMQl|jn-;Pj z04s8g%{R6B6onh1O)bI%MODOWV}urv31BWbr%++tR13QY!J||zTgs%<>1aGzXeN9j z@jMwYt}e6_0QbN<)YqgMQzp)8q7774)=^*WQpv@w5zT&+tai(y#JA-nhj*EH(yl~@ z(k41|YCjPiq7Ka-8=cTDYL9II;G;XCMC=@JtU4|_wg~!Xa8lt-=_=1tvz6LyjBL+3vy1gVFYOlE4Fr?tnC&Jr^)vN{boS1 ztr#{`z!(gEt$r14lN+R7^}RQ#=bbV)KGhDIPZ#zT(!LU^YT}T~WN@Wa%P4;l-6ZR} z&Be+;yBMtJviDLyq9qq#3@H5G4x0X_aBBK&o;n_#NPJ2>SD1_Lzg>62YlK| z)sP<497IPP<{a+)Vq&tq^G11Qc5SW4C_bvzSF;VyT+y+!fuj}ifpwq-JA7rXKlAWo zj45&IWq7v?euW}bV+~5h$cadtXv~5-$h-KYps8nLgu^m1p)ylG>4_{x=7av$`Rdmw z)(cd5zDh4p)$>)bKxO0iYQ9P>P-EsRdx1KLI}tVkY)bec13-;Z^}!xsHntQ0#^SN< zk+8dslg;GTrr%M8qJ6$&KZN&P@#9)=fsoXd=* zu><9aMChg@W=v6a5Ink;RrPD;Xc?QL8lA{iSzyr$8uu~ym<~#GtKTD8$MPIhY5rQ| z>x*O}q@oD&$qc#9CWFwa>-C;Oe~Ric630kJ4mV+3LsoVbeMGko9nooo`1z`3zH%2R z5kGzlN_U(auEQ0!dkxhiWa>F)(PoL^<4t0C8~I-;6Js~%sckK*1zBKd-df@|E*8I9 zWJL2aF}?EIX%dE)sQib*`-n{tIi(!Riy@)TRN-0bC5Sci7u(*2K(M1LgxU|$?mXh? zdx;9dr248Iz66M&1?+_{ciJ(vCq*}G196TQgD1!#K&x5}3?@O^UQ9o}3(X%A3$OvP zMdMC|o(MxY^tqRrB8$bXqSCnIDzA-KqDn4Nqvo(>*<%r(=`&UCEY=Q7 ziDxQ4r!pGHV%&6yXuzC34dp<$XvZ<0zulxA+h02VMKRz)++*kdWTW9oKSji87kg^? zOX>U*^VZ1^z%GKe%MlM~|9)^jYJn5Zb;J`U8$USJsmhh3a*dRa_+k_rBQaivNVh{G8ww;Ht;*0Ov zK6=XAw#&cj#3}41HN;UYYg@e?EEBvj*=0aB84yCKAZH~hKep@B(3;Rk=Ku)^cL-mR zfIZ8w6$)#XXRRg5fF7U6jcQ{~&Z@P(lX{XnnF*;JGyH@jVSDAB*^D?5E(ywAiWckx3!a=`4i0DuI35nYOIjn(#^9guyH9neYho%Er2X~@-CvqI}@!xCXx zwozudf;FoqZd`ApgtY*d5^#h$(nW>7&g{nA_*Pr2N^X3IP1o6CCv!T78n#OV^W-K7 z^aj2(BfCai5xaK!TC;Z6UC4_&H4Zb;?^e~dN*RD&pJc&Af-Rlk#bRTus(o6V;ksu93Lo8BK;3AEXfUef&upw^pSBltP&Tpw&SL6K{p&? zZPH}~Z_T%=>pK`u%=x_yULH5N4@qq!$uxF7KNAd4F4V6imy#$tfHsJsjrf4A3BF#2g zg+qHJ^B%_u@;vTV`e|RvrzG9l+e>gTB;8sU|FU^N6Av*o-^twkh4nPQhM9@&10(yV zp54)$vjdxO+_QUCdiIgHXNOp`#vg3YXryhoHzT%tYO>?Sl(iax|x>x z-w69VBAyi81e*}=0~7S2G@tPs#+CS~xy&+gs+qxU)+{p(cC~JVOpuBV*VtXx+Bj2H zYfr;arrAEsB~C zikg56-Ll-`Oeb}gQ#jLUJ$hXD@?d=cB(1&k`ZGHAO|g0`(|QV1x&T^* zDg55COYvWclt!EzSp>9_lj@T4?DVYtIy+G4Yy_;iC1l)nk%g9-LhAUpJedmy7^2w z@OpC(16@w;FfV2~9RX_mV6h9}{`el*c$M~E!8}B_xIp$Q!#qQMWs;cbGu4H1D~y3owNoBu{gp?xU(vyDDu4zmFXRps8B3Lj@kr+tyeo2vxJ@bbIea>>r5O z?`O?o2RX|tI9aa|YE`EY&n~l7{Kn}0Q`jo_q(I3K)1o!7cRpyANsN0LY|ZLl>HgHr z@-eD+2=vc}z-0(h3_+o~qskLgLC1|{ASmzWm5UJw3iXg3thG62!_>8K%BQZQ#EV*M zJ8$WDP&PLNe;Smxwfn3qUv^V3xrLYA!Y2$$^X)Ls*NY{vSwca)u483`Src$fYmTiVp0&$|JF(mVrU^j96mV{WN08gG`DME95(* zSD0FCD~x5_hyWRTY8!gCzcuS5>jTf=?u};9YfkNvVD1Mc=9Dd`$EPe4$Mz@#_lWRr zrm{2hSJoGll?ZI{S10_7<2>Uz>p*3XlQGR)vOE8ek*gi-c!P{+E*Lsgv;iDkh$cvo zOKn_~2$?3CGuuX4c5fT?IYsuw0!lmso@C)v0omb-NF)>wYI#?Wp@5 zZ1q(De^iut&G~P}|4(E7x|to%c=>f+=^gy$_3yjz7yZpmJ#S*h$uis&^VHoY^*FR* zJ}v8ogk8R8Ar6Smb<;?y57a=f`IEW+)3BD&gi9>K_IxVW6nEhGJyGWK)~xI?#hIPQ z1T)Ll>j6buKJmgC=(3-CL+T;u#L=|ScSd8bCBC(TjWW6oMs{q#9cfuv)I`8=suKm= zujHw8i)#%LPKXfe3U~CYPAcKZ8koxfscai!Gqj<5Jd9MTn zH&12eDtn&#qqtWV?~@O^*0y;`&OI8i=Vl00i;MFHGl(B62eBF`A3KXbUPkycisQY* zsrUhMWFVz|ih<+KR+;aiL&z2vW!=V576+=KPOD3-zj3X!|IBNuSl0C`jKiiLXU*Su zxB(wY`v*qFt5YEF%loSRiboN+bb{YV)o*6}E@es>m`J9=EGB#FczZTQ3YDAvQ0f^Z zA~~srxPXdf@`F^*{RIr;Q?V24!OC}HS%Flj%e1HKBR{N9WrJ$}ETZPdN09AA^BkYy*u{t( zYTan~?Fl}Sm>LaDrc)$FnFw89*5lB4D7)EalReN~#M)b|hR#*qJT>wM(XvToe-Q2_ zK7E9G-+?M_)ZS}2{tb+#Nduw|>QBJgaH4x8Yh$4N6-8EfW7yMf;0do3D>^U?hSDt~ zb&JX}1y}?oFGs%NJqVadY>-REdU*i%yqLswy-DaFMC~Tw{2)ec62T8*!X_bp5N+`% z!#9a2{!KE!{5a8_PfD9a>IdO(5?wu#7cTtD3U`40 zknq+*Bwq<07BqmI)uN?0P=SLh2~-sHy{3lTfBoieq3-#=-)Q$qA+tX0Z&YTSr_~&$ zn;i`DZ46t;Ewq1?IJ#W@EV(l&>XpafvN~}=0QA9vH2q-tR|f*urNZaC0s6PdFL4Bv z!QNe6;RQqNB}0;9*1RXU`_A8l_iju4+1msUK>0_I|AdN?ja<`Chi z1;;Qpj&QV5sbx4xwA4Ui>iYzM43aKIzmR*wUo(G$Nn}^q{c%vJ{QfRrir^q0+BEzV zDzz17rGlIn$3*NnCPK{fH*vIVv0kqYsq-kN-d+#N|5+n}_1y*MW;5JV;zDAWTD0+( zl8sC8>Vk~fpIN*E(95Bu(ZG5Yu~3u9&qvzW20MT?UnArvLLTYz6*(5_1C)ThC{y#g zsw}f-%rdLuj$aAu4QdBK>y3BR$9L~JV*s-74wA}hS^ZP-&sT6*Sk~|KF0vtU%4`8D zGrrvCI7*FWLp;T)yk6Q9SZVqZSK4B=1mKujBcDUZMwzH&s^qh8iRf){zQ~cqW<7xh z2ZOiDjz~AC#@haqTyGd<`|{LS&kh7YVsG@+{{pTd+N-^KuL?9fLYL}7BJIG?MFBJ0 zsga~7MQwjmun{>o5eWRxRF*4%LpYB_(Zi7gT$sv*Kw`~hQ!-r>d5%=IitorD1bMrgoQM)p6(2#oijpv1yH*VBKTmUlsQCp1Q`9H>bU8(sCud z$y)g#c`8~x2yhyfRW}CXBzyZYW`GL>nAtXrbM^$I9pNkj@FLNcC&Xd#ZuuxqO4_hk zjserJ1)M)j2p0pfXuk@ zF>jsHNeITlwlVe%S=YxwhT7TG0lx6K*}^&!u=W?C*#u9Vp9N3ioa;Xm9g=H9c}Hlc zYv0WoOxZW0Zyoi~0a?5w((NR2cKL&7P$VA0a=Bh=HiAf-_Y@gISE4s!qh&atQxoMk zbR14Jf+ycOZtW^@;;rU^*8oU4CMyPu^MWfGWL+tp~XYOL))$QnP|?nx2v{F2wra#*1N_@ZXZhd-f+9V<(dao#kt~%yJ7)4QGSk-Meb`* z%RtVEtKE+Ld{4da+THEp!~N_>0K6K6(_7B2CUT7fUA4rMD5*6`Y@B%bv^XB#2jt7} zlt_<^>~tfvH2fAIaY$6W6r)~9V`Cu3A2`l99hZ{VYTbpT2xV6gnfhsEgqF!C9E0i>tK_U(*+wX;1V*O7c1X2u{#yAfk?OoHQc}wz@uRNhE4p~0q!1!g?wC^0)3*NY&lQKf5C z=30Cx(a%TkCS~8J^fd|=nLp%D0Y3FVpr^Ktac-Xyyhm#mA4~Tu>3of+m^pH~O3(fe zoSQN@w}Spr>TYEK96=1z@YriA-~1r;CWia}e$)89bpMTOoqC*{6T~wvKIcp|E$}~< z+n2-YT)E~#Gaw1%{kgbG}ol}2hUA^mETNPeVu$L4zJ02ZA{0pEK z_G3$8bXB-qQr82gS}i+qfu1A?M{q0wTa-v}*cR(SV~*r~lo2rQM#0b~Y!K!EUZm6e zp@irx$DGb{q_T7g%o?v)Qa8u`#4#4w*ElPMcdCLnP}`ENq)7vmj{_148|4{KxrBo_D~ z*E3Gxc9``NfAZ8{BZ0&W2Y$bcRpDHv7OKve0LC^I5-L1%-i^;Z+ zp%>ml-edkGMt~?ri$6Q&MCo^C= zVnkPp_vb2%amvWj{I+wIw@`7VW9P|jtr@M*?G;OHVAz%Zlk)B|LJdSi{i7;;3|-{^ zDCdRRhgIs4|Mtydsjim#Atl$UrWNM>e>=PRL8aIHx3dfS&q_R?aF_jEIUiHl>OYKv zp<^!6#fx>}Tb21v*-NB%flU3V*asIn`fNv> zm^3=G01Dz8*Jz*z>P~sOO=xV1@cF8h;L94>?H-YO!ARk~nAtk*nKF`<}atN;Qsb~U_bPB>x?9k1#;+;P!Dv|)aO;Lm@t2Ix| z9@+K({qy;LnzcaWzf(jlFi49d^xw4nQtN+exj|z!$a8Fcwk^AD{iBwTX#KF3uTxK4 z%X_rGTg!`WeUYt4+Mt}ig$oFry3PcFDr980wtvJCiJCV@0HfeFj|FIsNLW!Vj2ZO* z`-Aj?i1=tc0T|IhCA-BNJ!bo9^q~2(NMr<@G`zG66V?@^%YM zq*?C_?aiSRN^+|pE1iMtOP=_UcI>E+m+*RlWLNL<&l4HL6Rg$&)?$9jK7*Fh+7AR^ z4Ffff*Cu$H35}ZRfj*soI#Q29J&SyF_(YR7xSGVi$f>R8u@p(}e2P6GE{oJfQ4RYB zx3KY8nE_Ra0qexR zc;frh{4A$lA^_ngVYtPjY;;E8728%`ABvSoK3Ia=v&m{b>9>$Sb#!nHJ60-d9oaD? zsz?K*g^itHo$uiZsuf#_)2TNv(ra{^6a)DuO2&dC(jXf+bvT3CV7re zv49T(8)}?OGepVBQ6b)z$H?*op5u4Ao1h=?`lRtY%D>QXaK&+p?bb@mxwUC|x2Q8K zVlm<0aF;20IE1z?pp3g&-MdT5A!p?EO!8k<+S}aI(|GM@ z@6ftf04@@|$nkrRtFccys%Dw-YS#_^n&))m=Uej|2hX_+S&x zLIcL^;L-z7?g*q94#Av+Buls@u`~WK{l5MnP4fbPEytsV15O1(!U zft-)|7jfSF^p%V58%2%rWdG#Y zn;d^qxo~WfkV=jVlVj6X$0N7Om)Yuf<^IaCa=miAqEe+whJSag-0-Nq!K`<;&REHC zOj3gzOmb4Wu=G}9Xm&h;ktAb+Kwh}+&qIaGaOUIj*?I|u*xEEfuxz(4d#TI3 zc~?25>l|~X7q8Oq8}n!5y#^C05?=F&aUV72S>rxu%z2J`zGMDr{LhWp)L!A3UmEwY zGI;e@#W(wGJ^x}{d~1H>xTiVh_r`t9nCFfAf-x63K6C9~#{I&WD;;-@gRIAW5TcA_ z0}j^addIr~{xZ7J$=-z3&=|}Kb$BVR#W}Y*vmIis=G}l6bE75bx-W3u(-6fIu`~Jg z8iA`kFWt4h-wC6a_R^Dg4qNz-{CR%0{60_T^66>>MnSGB_d0WeFwmw7cpwjXW5(r_jH9A1q>#Is`BA;sgpBoi*S*1Qn@~wj+tl>+u0!e^ zl+)~@pxk@}I*R*!kdo%6r+e#kuPOdmVgZpCnrt%eN9BL7WT9a0PpEDFrMb!8%!Gky&Jq1-4XSey2csNf#sWw>8M_s<^j!a zo%1E8W*6oMzwLcB@jYj7Z||$B8=b*P-bbUobNBJj-)*^4NWh_TNC$Br(DOiyLb;>s zASW2evEkeDgBm4HbBW`J>tq95uyDddKcJ%w`8^3c>ZU?Af37KZy_JI+mscya}c^%_#U6-e4^x&R#!OZI_kSA0*}}DEy$G92xFM; zNcjc;53lDO-%t>;8{M*`gH1z(8_$;=%&9O?ClhUwb0)5w8}Gu&zVNuMls}r!9(<v{~5=7PocuN5o!;x2hBchixd!AxaphmL~6LXfoXcvl~f~A!6 zFSh}He6IKIB%YWqY>?MG)#FP}8t?-Bh5l*46LT=I0X}@f9kTQbq6kbHmKH%K$Fpjk zwjc-pEB}Zy<0Fpd)Cfsdc?@SV16>*c2|5@IK&j=8vT5ihvxOl=S1``OBy_MuA|bGP>H!rU9fO#);COa&9yqTe#k zGjysvyLhMP-Qo4YPs23@<#Ku$PgzEvZ!bmzi0%*+h0dKcZXd&&H+LvZqyekVLFbCB zYmNC{a(oHD1e<`bR1?qtk*}`95i%Rr4fk6b>TAcP#`DgGP1yuzvf0L&j8Q%>2=KBf zftX7YMjW?S*p~(X^<>*A{gWqZidY_lyuXvP*er4u3rt}j!x2d%Et>M{t3YNVC!oqz zQ85au>+QW|4C?B=RCX5_w^+9HDtl0+SPy2JKWTk5u&7*WaI^T#rp#$59Zq-F|4MtS zOTRZC?%;i}!wAdJJ)jSRVHC5Lv#o(ACtXQ`FUQ%u>s{J5G$FP{zKXZVttPmWy)_$q z*T2iKw*jj!4MD;BgmuO*4SL>J1Rq5!L-gfzKCBvuJG@%o1J0FFcWJDh4);iHb^nN* zXgadM9P{o#$e9H4&cGO(y}y!rL2TvNMl}eFyB3KRhS1?KIH}ew_Ck#?+$l>GR*3v_ zdqPB%*ri~*A*NqYnT>keSEZZ}b!T#P<(O0JoHMkVgiBahm!ZvB>)^qBzugxHwrv5c zjGZ@E^Y+Q!!fq+5xpDL#P3C1Y3WU@P&92~V&dt8eTdhOuS|92YGCvr#N}H4PE*O`K zTrB%7qL<1ZIyP8F1~Lw$yQ;D!iyGNyaMSnnG1Ngz_($S!d5sy zc$Cewn>0e29PGAim=Y`GlAj^MrR~tdoV-XRZ_;@S7p$++`L%)@o8jB0l+_w>`uj|R zA!R-X9@)oJ@|r;3;biW1^v@)WPUb_%mtPODkp(5v^F>&R8K4L&^E_367};h5pq;_! zn%`NTE!}XHLpM~brKKJHg~7C{>1JB}^#3yI9iC%KnR(w9#1 zFPHDsDS=dA-7NM~_(|&*?M{>!J?kdvpG`sl=w??>(vMeCFPWq-CKc=VwUhi-6kG8W z*@&f(z%sAVqU;(ioDYi#iPAM5bByJMs3NG?!0M56YYktg)|Ckq$_pcg|%vx2aInTbV*RDa8Vtc75#H2v^H+6P|uE8jFPE~4VgS= zI}s*Fn$U#O19%uc+L;K$33j<2b{O<@GEmqF5r@GHg}1pv{AVx2;Po*AZcE3XN+5}Mcp>Cq$qOxBzDO{%56+LI zgIe@H!M>S&GW%BT)4VTESfmuy%LM<@Hv$EtGd~yHfMBgor_nlOa99Y#5zV9ZU#;MN zz3(?-ksZ&4mEsCgYYqW(dDC0~b`b|jQ1}tK*e0hTr5XAe=j?h?~@v1z=-)Ld*D4#^+dp)T|> zH}LcyyvAp|2BV+#YFX;%HUD^f@470pLYP=ie%C;h6JdJU)rye1jIuNR?E6RdPaSkyhl z#C>}-JEYXYvJ)^H2fO|{^=NgS0O{mxQ}mspZ37-pD7*fBvENOj*B;e(NH3;iy-n)E zIy_ro=h9~M#lE)=mfc(n>>`-G{*8#Ja8BXBm`dexXNdUSzruGMPk_YZX>_`!#Ek&! zh{9f+WF+3pzVK+s5cMd!82LR?rvAEp884;yn^9MXQt+<=i=TO~meUK$LNQ;ewaT3~ zw>AMfuw*h;5N1{XaP@k_f)rK%!Rnequ0aAV6&Z{;jJtmOrb)JoOtO;M zHs<3!kfk5Pd)^}$TA=!Z&Ymv75p-}GLKSWlfib#9r2nv)8%{YuN&moE$Q;j_SfC=YfZX*rTz6A`E`D}e4hRFjQlz|UH+l{)mKul zks#yg!{pf4Ku}t-4#Xb`D`>fNS#rECIo_EZA4-l-CC81)@%`i|lWGtN+KEi7)jBPD zufB^Mf}$4(flH6NzKno6gmjE@i>If(GtwjMZr3x@&rWy4*axtOGGOQ${G==#W;}lW z)0*|~58K0Z!;`?W%$}Lz?cvLQ7+3F= zEvokuN8REUAB(^=?Rs=`^`4Eq=b}y3dodcmsd|`QY+XGhByfDTdZ%nvy-%p#$Nz2h zzK0o6T)pR#FX#?>JoTX)yyyfkBZss@Enui|#qSB#7jE#R>pw+ydj(rebp}zd z+8 zDpEwGT8atkHmSFhCw!Vb;beN$KB-on&nfG(=8mOQqVH{`_bh03mhfio5}A_ zlH)2HJRM3mQ}xYMtNDe)4gUcqGCY2!a%ZZwNuKq|@xJ8vSaN(RIli47KTVEWsGM)ivTV8!HGd(7tK+CCf_1#6nxH9Ed>uZ@B!VZ3@cLHE#S?*Y~ z(mS?(rE{#aGJ9-!WytUJvF^$(dGST*X<$icZkX;)i#R&~;(MLem+Ize5e%g>U31ja zg6aNc@x}33TX4(D%&{d3)GPCrx%U&d!v!PMeMt3aHbi_xlybZd0szD2?~jGbcfEE8 z*-oYf$lnk%itGhWxq#tFTbi)a2si$nQ{XF;(|?*__R@y~UB7XLdl!*Ub!T|L7~y0d zbo8Cy))x|PDD(KrXv0eLvZ}mt=F=84(aYK8$IrB#0Kv( zpyLiteJ6i~_J6;5GJt$WPt0&9(o&~Ea4T^gudw?SR3G#JVP6mm2m=HL2Z*K)eSz;S zMq5~8(j$6Pk0dR(MUSK!^9_D|vdwF<48)-`)H%=qwiEP&jnol~0EY|fQ0>;n+ ztmo;K>9Jbiuz}+fABH<4%DMJ=yUmy`~;8gZi zXAlipq;NUxU57kst~{!ZIQH-@Id|unaa#!AW(KAU-*%f;FO`bmaOa2un*-8Uq{#&| zgM71ZOi0O(Eh%X+3lZy7SDcnFgU&%o7SCG*Wm-1Yeh2n@5(Y2#>W-i4Q2cJy>!yeR z2~*I%5W~AZOes_0B#8mFoeN|T#}1mDd{Wv2dVqN<5}o{3$5QgUV`#eBoUb=YFK%`G zVMQ`DBe}4RAer8)TYsvt*}RmvL&Z5&x#Ad%akHF%N3Dk*fwwU;SMAl{=4Jn@yMyU$ zxPZLH!K9^XJ9tk-ITBB|JW%zp1ByYv@FlK!#K}G3l-*PKLXO#$`ycf0iigy2~y_XSM zq+b=`rTCqM`VhhH!_zHffYiF(vh~9nON&lHw1CyRV4u@AmQg0pnXHb1@-&xFI%gSy zlzGkXQgpk|(5^Mj+1p2-hH$IdjN(Xlt!8kd?F*(?bFvxmJdLAtVd)K5a+!67H2au`CJ|C{7*RdturZDhpDAKbZm$U}m3FTRY& z36ng-%oJm|68iD^SP$BJzs4Zx#>r=KPr2U##MV$i$85$ z+Q*x>fu%&iXdAiK0X-}$X1YvydX%jKm3X~97l2k_cb6>twd&-K9NX|Jbxv}$?J$jY z&;zyhyF9B!9expO1Q|eXLwn^LVtc3S!?FMo%)}OoL(V-d?k|9Z#D4Mce)T>#q;=vH zAL<6#{pavnA|;18xqZ+u9ucbHxi@v&8&HKka}NTTmj4ynCt1oEbaiZd*}S$1$zWj` zXr*n3tKm!4576j@b%8Jb&s~%{Obz$m)Xp2)Rrk8yYuW)WEbS{( z9YocXaw1k2OZl#iDPLw0H!bV1-xK6p9T<-29BD>$j4X^mm$aup!X0@7#a4%ZNLSsY z@zh%znRBB612Y0%o)%#bY@G#eXtmNO3b??lkU4XpCczsoF3I8GY_r|GDzsXe8 zZfas(SP*c_5RHgZMA11>DkbOO?g<79-tJ;yi^m&!-Q6=pzst^5<`8wD9?@!R)v1VR z_|ptk(SG)m$o#odm8YUk#X9D)lo2CS?8Dv0PCySZZ&^?V?h+YytC~LcGShvjaV|5C{T{f~c$b;rQoLf$ zA!0eMaR;>H3mso=6zSZOij)Aqabh_ae9 zaUpIL0Pd!y=BKz*8~OO0*G}=LmiW|hHF8c+?}&>QkRs`OteeDrj^3zKe?l$J;_N=F z0RY~h-N)gs^v62&H+BL7=A_@&{u{^w*)G4P{a5W7yXY!5ZqZAQ%t$N%5WHr4S-XYX zZ-E10A^ldo8}^)E(}fdR(x@Mna42AdM#i3xjYe(G&z3-_uCw4kC)n0+o7c*_0S#5H z=G5~ZX+GZpM+PWjAKjjNo`9x;TX8z^V!axoSz-`S#eY#^pv(fmghLVQvUZD7!@x+R zF@%ddM$K`iI8%3_IU+uRI?dBx82uMdAM70Me&PlHGG>+I{io-C>ZShfNy6!-v@UqgSq)WXsi@ArS36y_rN>K22+$)V%VDEEv*6z!*t&&(l$1?%dy9VZ zo-q-t9u5fkhvIufc`x%YYleB$ME1?N8%&1a5lN}sox-Mw(Ur=Cos7kpYyQjvl6=qn zK!#`0-H-Q5Iak1xiOOlq*CZesj@Rt^>}#Sa)eX3(u*IY)Og>YHXbL=vQbC@0TjWXM zqGFQ;SoAsf2vAztdBSQxCO+xPMA|>S%RFAR_Pd zi=wpfUIrvh%oEsIn($N;JncBIIQmbHyHU`)uQkqLrF95`uy6!|!iKn#?;%;gzh0P#Ba~gE=^%G84qpzJsRmoKZ;CK%$l5iO*z-r=Um7iZ0QnQGu*eo!-sPi{2Wx zIJKkgvU22bA+)G`#;a=xP1!C)FBGn)OSJl-J2LS`egm5>GHx*UI8TcEL;rUEoG0{l zg*oF!2cyn#)iarqc&Rgcug~~52~;uImQ4tJ%DHSNSIp;zF=z^|{&QG(GpwWSLMmrY zN(Yyr69{scdr9-`)QIFTZ>lDSEsYpv=COC&j@?96ZTzdM)W-FaDK;{O#Q305UxgAx zse{eKY`IXn4QBxyZuWGFdMxL|z(*V@78fJkiCE^nih`-1HRB15eqW-UIDtO41Wp(?>i{bJJ9gTh`EkFV%yG;U`Yi(o@ zP{#i^nbh@0-#}K>NH;Pfd0>84Wz1m&iowJq+HJ-+l1VDM&^l(CxRs>Pz~ZC=!&E*oF` z+c^J|aqiROYM&X0rO&&=-7kjge+~CnjnH2WPjtPfjfaVRWL(W-;MgIWHm+er&bAi~CEDLine*zZx?HU$@=S-FQ?aqKTH38nUI3a1W7cwY zaI>LlmK=EZU*O4nGHU7GI~Eq+tijweU0&xWx-0BFUVXSg+}7b?_%CB6iCHJ%x^G-m zxMV?=c~p)1O)jwzxr_U}pUh7!@b8{yZky-*d|uX!t1ENUq^Q|UYVuB+7k)U`m`Ryo zm;mrvX?+oIdYt>37WEu5>%}rJotuflWkVf$-X|L9^W*J%Y|uBm*mw&#*!1LBR7+Rx zSif-CG-T6=imSV_w%%Ts(|NI@u3ISfLO#BuUIr;>*xZqy;ygL8{*3v?RM!-qo@bt$ zr=Oh{ygU!{|ECuqN<3$Q`OyMz)sEho3!L-k`)1&H?>N&xx~00uX@-b|qst(61H}P( zAY=k!RX25EN8y4F#^c%ZGUw0p{m9Q0pmU6A|2%Q;B}g;k*%@<->zC+vlP#|{Yu#y zu#cL+z5Q?&a_{23EdRc=-QJs3FYSV>EVgmkt7po+A1~mYug!VneNq;}C z{?p^AVoFS(3I+{xidK$gNPP$NO7`c>!2i+yFNmJ4n|{Hi2azSEpzL5}$OzWn-?jga z)^Fi>oHFUxrKdvuHIOpU{-^;ap@cm{t4iS?Qbk1WmKqM~OT=*@twOBmKGkAM7q69w zq8Z@ZnMJ0-iLm_PiZpeh-c~;BRA=y5tOb|~6lsaMc&-;!IDk=Zi@L%{jOGlxP`%dI zC**&I;%kUdb}tdiHegYRjlJwRJ%`R2pijm7H3TotjG-9KYEa8IH%FAzi=es`cD@vL zfv10h))PAjTcniJZp(q^9Rq1)Z-e9xQxBo{9|*ngRM+UMje3o!Y`9!F5-(i~a+FN=zJr&#%s1~d=u6nH3Xbl(eJ75n`U zUH=0&;vvnu2TMD4FD!jHP#>n6U)8}o2&bz4%8nuZ63gId)`2F3$WwS@1jz{MLd?#F zvmitmr6YF7+ff4JIyizKMM}ZJwI1t3tlHdOHXoi_6V!#*6K#QBNsOESiF93P(KigW z1jXS&jl06Mv?af1GK;WLroTIAPby`5O5`35RCc_&JQBeNo*A-EhuTUQW&ck~4oTBB zI!ByyN}DDx7eVL1O0Hk~jt@GetLJuYs3>;m&j6g9JJh)3jgMmF;8A~+f*TM7wI z&zj+VEb!8tr19i}3$f;=MfJA92NcbN7!bv{<5up`&4n3w_{Z`Cbl>rNW2za;J!0XS zEkm*{!tp0AV^h{X$=XQAkdlMVAe@|iNSC$TmB%Flx*YRX>d_0XJ)Fo5I(01$YusF- zeL3K1#Ss0+rmEP%ink+stV4Ut+=zDJrZj6F?pYo~rgk$UORy=C>K+ucuT{=*_RX;& z775kcCf8BZo>ljzbDu>upR*}rs>QF_F1AfM2mvWMOv7Vm-a@;*Z|})!D)Kd6fUEVf z0TeyDMn4hU%1XZX^7P`&PU(r6`gC7L^Vz+*Ca^!!7CPi)D+8 zXAM`^86X&*V5*88J@3^3*U5<0KhvePy6o#Kb@N&5zBb8BuCl_{Iqp8OPU8;f>YljI zRx|zC3DB$$=*5XL=GiDY5d_g$Jn8GF8}|$Z@438F=s8;x5MWf^d_R4T-iD1@2J`$N zzfB?k?=K#VBY;zAv3HJ)@0_&h&Yda2DYV&(!}Dn=b~*qonS7DYXZrij4|XVArt{xd zZ^CZn>aa6AgB@Ht%Abz+NFj0y5ia;&8t0$L-u}0|vSWae=FUO!n&HlW81Ew!d`z?p_Kkj^t5)gk z#MFFHmcvJQAVHoSc5!&XBqb5-$<|>ct~U2dNt1~5bODw%-uaGqrW2e+_AK>aR3Dn1 z=!_8%oZtW~mG5yfwg@D}NfELSqC!aWa?5MOaxlv$k+N zLZOMRxQ(2qql28~hWHBWbO9l?R~RdJU!w@d7iItIIPW-KQ@vX~q4cCvhi9{V8tt+4 zshi70xzueYtg3F@v|acQRQnj(MrMKOz|g#&UD%&=N_GzJBPkTO2kZUWYAE$=dVMxC zH#0A@THC|91U2B-x%SuTjJ9!z=Bg2}!0f?$^g!D)9GlQFq@8VG*~BFx@V3c_KFVI@ z*o5~GSDCUIoI-;1?8K|OxtvAk)Iu2}F{n&CIQy3~B@fL0of|UsP6O8Cdbr^AJJah! zQi^;&(``=c4h>yiS1`;Qj-hh9-q#NNfnUcPoJEVujPbC@#l$?4rtDQIxdVhvndQSI5Fo~Q=2PASp7 z$y`l580IX3HZQ9=pp0$Ol^CIUvX&v36Z>sS8NgI3Q%8&2R;)7wRl-Vd=76h=$;;YB^}Q*^y|}V6fWQ-DEP&(Kr~4anzxJo-Gwz3(Q>h489~T!plMSZ^0gxK|vk*evtoL zFd?eSMi@S>eNpY^&Y^>oAvtJ3S0Pn(y#IC#)8))_Vtgp_scn2O&8cN2p_j9OMMf z{>P4=BQn!JfLYIo!q5$G&IRjpDZd*FoJNfk#Lr;Tu!ul1m6qv@ISM2VUf0#Xr8;kb zyv4a2pRYN>yMH@xHNzWLcoZ_%9DAci5hQv0xw`;GE<V`N?j8liX0}W#qSYt zu2}q=>wN4spaDdW?3Q6o*)LU9T%MA zFap!WBJ#3ZjJer#-C}_cZ!s$sSOXi2;h&1;%_3sMBo?~+Sb!-j`@4MQobi z!k%Pb^&q;WYU~(lL7P;)%)p#5XE~Q>7pS&n&ofXxi;6F{;u&>@Gf#aBuYH6D5SLKn z15@jc_Jt@1- zSvuujUARX#_V)BSz1gGih)BcpYp>|{T&1J6dNkhog>hM&M!fOkaUO9J2a$@&kqpx0 z6Z&J4j9D^PJV}y_-2fNB5PB^>A+&g4>~V2%eE9ZNI!n!Zoxa&uX=g=5Rbt1KGj(s+ z*Hb^X;Vtgs6~^0p_p~+iSzmmA?7g~p4>Ce2dsNA9D5+b5=3J1*iMIAK56p+)J)L@2 zhiB2${q4~zZB~h7<0H4KN&nKXf7I8P)Xn*4?d0ETeYIP-&P@^e)R;R3=EA*+iN=h; z@AVSjx!BLn%)jKN$GWY$4e@VdfZl`NUF!l(@SjffumfhI1AyBFZu4JQo(&PH%vnyj z(!Vl5O!9(n{@{C0`C@oo_qdna;5kov|ASrC*(N$ikTs(-j5*!J#f4`%=>r<>kmBC= z&0D_rwghwdvzL3_Luv6p6y{MEZVmysnXI?Lyvq&y^=wlT7+=p7X4U9t@pd!NB4D^AMthu40`T zC}n>Yh7X3&5V!CZzH=kKNM&&uETPG&!F;5^ENJ%o?{cGu5YOwsq-x(GJ_LLbd*8w- zQQ^X9;b(4igJ*7a+}}C+w~qg)ljHk$xb2r-^`h6Ih&YFw8x=1^-ASNLBAbQxIFZd8 z@R+K11AhZ!K3Nw&tCDqL8*`u`V%BdpSg*v?%DU?`q42^1us5PPW=i&aPwXR_5i5Pp z1U#jaupY0TIjJd#n(_s~LUMIa*2xhTyeeG={i<9nm21N4 zs4l7nUa@*uLs(yEK}tpFYOirTB5J3tVpND`MU4Ntaq5jfGfc>Y3q;o^8j@ zeoN1(-ERC2h3)s8=g!3icy5l**agM;BNs+H>V>0H{_K)nD%R`cZ$(%*0V_9r>CUPG z^Ba-QzR@Pcx2y)0p0+uH%>?T~t$VFj9ivrOY=P6F)j!BDnoX;Fu@X)ulO<(~+l7Zw zpJa$S2IErs_tmG_fb1;t$Q=>xF$~2XcU?&eLh|!^q#h{8xy6^!Bae8FVnby=Z04vW zcahE&bjmoU*<6(;XpDIz4X&E2l#OD@*sUC8h>{3qZqq-%$$^onJWKxV65DY5cI5nT#X1Dm?`uCRi+xo?C^Z!zp zO?m}di~lXlvaO5+YwH@>7L)d<)GKM5%5Q4O7HI3cDp&vAvC^_h`%9Uz6mX;7?p2Xz ze<;qo=5gc{O@v_--KrP?;S?A!6apAk1XfZhER~ZA4J{JiEg4A3m93BQ(p#3LSD`3- zs12Mi7UMx(7Dh+?Mt)cG+myeeDxvya+Z2{{*pwF76h?cUaL~2FK!@tlwrw%dNm!WV zT3GuPVPQh`7}sp(LhVsz?>R?8-gL)C-%Es7hRymq_ZcEuzegh`;mTObt3%k5*trS;Iz>AjISXKya2#Rg z>+edBV5wU9=Pq^)OjmI**DQ40Np2PZn?rLiIn;x`R?m=E2FN?q$(AAgwR1tDPZ6Cf zKw=ifB#Fy*#!DtkY3xA3iA9Q%G%L@u&5Ce_n^!TeVB4gfb>T$V&H%qT^J7BDVmv7u zdZAe`v{IT3Jvb7fTL?`h1rLP z=l&4SA50Q$#d%A)&gNQ*mv$h3at0qJ{m0c7$39ZpL|SDdSMYiQQTH7j7B;nSa%TI8 zO2+@N|6BZPwHCwo|Lr~I9Y=l4eR=y|gn|0s{L?g|u@2gn*g0@o_88Hx0{&#jJNn-# z@aB?XKs1%O(vU%Z4(cU#4xA;w?fg7KW&o-Wyf4nliVKEJ((h0VlDX~8JVcA}TwNj4 zf_!U;=91;hPS_LUd^?&QEBV3|GFQ^-e903}+!Zo$)9S)aDQzoc=BCv}Hl`Wa7@xbuFld2o_Zz6?2>7E5|qC%K^BC&w0aNUE1A@iKc0VfK4Q=a`@w7*I$MSC z5L?6Mgfs}bi1TqK##Hf~m0U($SQ3(gsSo&^JhfHb3l}7h5w0fYi`Yy)RbqyOQj$BRG^l4Gs~I1&M%A;H`d!r5Mi<25+bVQ!Zfw2A-*6)YRH9V^(Gf$vMnU! zg+@p*9%X|~w!-SZX1Ff(ko|ttes8ef&)M&n?e}Z;`)&J814ir3UtJ6vqzOND)i2mO zZ%tMzzX{kOyqAyD0xw}36(VfUpqtcWvWHnoBT}u+{|&fg@ed7_MwMI`&Vcw8b6u5^ zw>n}nPtAh1R;Da;vJHHuz2P{G2|ob2Qnd9JbfNh;iuwb+&!DWV{%O|pt|F}xOJ#V zoK8aWPc`D}@|~=L3>%iUctxak45YYSl6!4!Pl{9Dp1O~w1tNK6VE%r3l)cP`sT zlxs3s5WI85vfpk8T0<@e?safej8v(i-YMyYa5j+?L8GvSo%6d0OE z=+Tz{mFHG+ZFyCukNjgc0~7;qjLVx3f8tN3W$d^Qq_w2erA1^5A~|F;CBHWfMN9dp zqYy7?aru_>_^Fk5#%Pk*=L}^2H>V95p7!pTyT`0BxqEXpX=m*O<9fw2Sk7(9Hc$N2&9%eBkGqEEjPFhEvCpf#{gAta*dR67s6S7= zDtj0qg{MXe^CJcx>Yd8VRSFw&OgPCvBDvX$$>Zg}va75d<84jl*ME0JcD6+cm6HD7 zk6RBHj5-+*++W!Gc|*&T<`-?jzyG(ymj!Uk|Dk34@6UxM3~5KYb?CoLcG2K#Rb)AI zm-Q2Vu>AnKoIeFSG_&inamE5+%KZ(s7)9L{y z9L};L_!v?KbI1-4nQ2e~yOT-MEMc{j(t#b2+-P3y{IScSwCh*}@^JDndAziub@Ogh zpHNEWe@MfPv<-KfSCO?yf$|{vW>N1}Ymk*zI;wKX;8OqJ_qe%-*0r^gZ5xyf>nB-R zWI)H&fqo20iO;2)!h*;@Ly%P_9*DwOP#M;(mvmU%q;K+j z^H8V^07ERwK{l?*5|qrb_}MfEN)a)=W@U&=v4mL4vzuwqUWH3zu!g{1QwD!(P!?+Y z)S+nw=v#@_Q!TD62V|Mwvs7a*@35Ba#u?W0_r>3JmQmY~Rjx+#}1 z`-FfOtriGoT~(bSYH5FOf&#KO-6}U6?}Q>_H`}fT=6jmMHX@a@Esi^HRC|V%d7kAgG!q z0EMp0nG_;7BN!ITrp`t50$BR|Y{-OqYJoiQLuK z*2`TWY1b&TP`L{w>Ry$@kD$MtuVpj60*PHAQq#B zn_^3ik&WaEkE+7ok}KWumEqDJg6y6+VJ_h}*GHL=7$5SoIk$**8P%UOUZcI}BJ7J_ zb+oifoAnj6*Tp!Kc0QYT;*(@LQf%q>qZmx)2Miu)a*}gLJ7X%oggeB=9;MV=)TumF zU^C;034Qb8`oz!MEAEA9(hE6k1ow%nHHSQv@C)WRm()kDG!Sgl4ZpdxUMO^Fa_!3HDcABTr-JUHC7ILA@pJ{AihX zkp4Q*!tURl@DnFI-Sb~_%%9yz*Ri?AqNy+EEs5KnOx+k`Go4qAv8|+P=@y5OChToqKBA0azdC}-Lvy9K6 zPEM9!556A;rTghlLG{4hQmL!8JI)+#zHdN4`@UI;ZOJ-(9L))4ImY}rj=X~gaHO@k zck%DVuWGQu~LT~d->Q25;4GD?&WOr(~5higaJTdnQrV(!Z^9~g)6JtK7w*1On7DXa){ zLhmE@1kUX(! zz;jRC=@zfn!F32-aHoMci0YhdS=?ROhI^S&xepCUo(a2os=OD zSiEErMK7Cxr4&WivYZISC+_n0n9_Tx*WKca+I=5Ue}E}A*yrYaA~(Pi{8S_Vg;!-1 zUBl76UYncbNFYEMgOoc#{1~No&yz|prVa(Km82rNi_(AdAfW`TbFx_Z+rg@0V0DI< zJsr?}bj(7LM%&hb{$|BxR+hFJS#J8uz1)#!fKF7GizCqm#wEhb&#>brG^Lj;ef{Ed zi8B=26H@Zj!6m;m!FoolXmRxedQ@`s@5k&Z(*S|=uwXidO>r6SAJdvCC6k-!P03E3 z>x`M`k569km&psBuHBjO8$QBlz!V4s&IYXM1T*^>?E0}=6B4>dFAp0C?e_@2%|LNT z%D%Hks?0QNNA6)qPUmutc6puG^e-p;=sf3CVMGY5 ztN&Ba*koi3#<32jXoVs?w3>ARAp`Lsfk-O3RA zntHMLuA#V;2ICfd!CK|kV1{D*kfDXX<|@y>!mIhI2l#_LcKdh~%)oYwaRD8rE3xfk zoYjaMfefOmJPpirsZs(LA~&_iH`TySaZ^rQ{6Jx4?!p7+Vn#4V0_Yn_R{#UHdwgF% zy(24UWf7bkFO&0af0bvURuNP&qj$j&+s)l#GS4~YS!b7`!E@7h})^tEIaI1aRP-yXaM-OEy$&m8|MF@Z^82ou!$ zwJ8XpOs#V@egN=N`?=G_zM#jwnt|6(SYC<5nDQWqrcVhn_K-} zb}JYf{tcd5-UOw_{@UbWk!yVX*l~V_OUKA*9%@Lh3O}XH+_dCC^u;)-LLQOMr~Pyr zVWq(*nF&Tq+7Fv&a%Y1?Ad+go?h?lga=M=ja3aRoJ2;aBQKAV4keqOU(!M zpWPD$=E*dXt~rrPk2VQ)Zd=K_pfWwU~EkP23XQD>+8$R37;j_i8yyUF6qUTwPAU--3Eb-^BW*q}LutPT)ipg8S!=H_d>9WbUQ zmRA`UX}92Yo0_T&cVG*z73bwCgaXE@4WE z8@$^gtBErfVnlHuGX-c>F4yk2gXOZ|vKYqfu2o5ds#r|x2)`iwNs1+28Y3;=BRF3C zG9%)d2oE4LQM|Bg66oo^?`>-O5vm4i`#bn2h5&+q32q(!Y5p+3;xRA_c4`!alMe57 z7XoO96=oBLo?p{rZL2K)nV?qGtC}aZI?WVwc-%40x}e!&xP?2nUz>wU1;+BJQPBS#}gI8qE}V93-&hWy{X;5 zU`-4dv>VNBk1Kei)=g%WCYjzk8o6xDf=A8^tOJKIEC|8rtd@mie!M)lGY>jD`W1Xt$qN9Kdj(YsB9E56JHVSJk5)=JbqdOXMnS0qe5_$^)k)baR0}rSN z14Fzg7#T#hGxJtNr?7_M@YT(7Ba6xx^3E*;ocR}aaMCr~xz8J1d{z)&U3FpV_G?@( z?{HTy_s(8EF-~E~n;z#(2V!%$swq;R8b7NZb&3zmJhVe{dREm8S5Lv?#5k^Yu3^s1 zf=Y*9&P(A}9)AQTsIHz6#>b}e(G0bgs_5To=hr%Db&*$uVVYn+Vh+K|;7<$n?K*#( z2G}pa!3K092B(azBKQ;0 z3X2#c6Zqv(VcBm_i09d|bT!5VlpUOfZO^%Xph^$x4@bi}6(~$>OaxpK!W(7-o-EU0 z;I`N;A(}-UfzPf}b>*af&D0MdnCrlBGXu^HJyR+N;v=;q&}wjzc9vwPQ8Bd9)n!4W zLLTB*Ps7T=|3EI118Q9#SQsOQ;eLlPVp#+Bt&C3|inU zpq{QE(isirMZ4N#6s<_5?C*K%7lgKv#Wdwtnei+}vWbraIXDCqc*5w%1%;v~lgm`4 zv#(;xZ}i_x^csOLVOzG${}C~j@klk^r>0zDNvKUa`|G;T+^qTPjeEQwII_DmmgtP| zDglcTP?+1;NnZhLN8@;USGr!a&0PW0fB}&=FP^{S?93HMx1zLhCYq`K0d5dIn$hPu znNvYj!MZw=DJ8RaZajO(fHp>o#K)a!nq@jtC#_PGs>YeHIvS(S zXZhDe;#q?&ZB1F<;iP`yWWwlXr}{yMeSP&yj;RIMur(P#7baZy4yYNniM=)Q2&XfQ zN)gf!sTxzTF@(gm`%OeQf{0&nT=b)t=h4)t3f~Im*Bvp#3c+HcAq2Jv?p$v1s2*_ zVyj*vK&+HA@HGZ)wQ9;&>!?F}Ih`#K!92>1Qfm#NXrI(Vrouk&7=3i%`0%*scuaP4 zey4q9W4;+rmoe@XqWX}QhthP&W&m?r(3FBvaciF}3s9YEs>_yhyYZl6rdeI+5b96s zH+1=J3>>RM4{DYZu1#k`{T~$u!5i<7vV67=WLQk^2Fy;p4T*I~H+SPTiynf-bYUHc zYO3ZJMxE^D@NYp&MYq+1&Vr6DsFF3_)MvhKOfNK3D3C!zyhCP8pP>^7}WSN1Lg&DdR~zFl73H8>7{lPHYY6fYY7Xzm-!*!NWw)IK?nQ? zW5_;(F~l=$*X=~tjZhg}k98yMCgfv4y$m)|aEE8!Lbek2d++$sUw!u-_R=;Gpp1$= z;z>BhjtVAU4u7XwcMe8V$lV)V{P9^Z2ke^;>T46PiN7Vs^0|7k%B+RCrOE2Vnz)1Z zi}Vp{1McKaBt|&0>36*C-vHnwcva_K)9DYr)bBlWim5xxG$&lfz!*T0z&m3k+?^_TXB!N#)xeZeo{~A$d znspxAL)i+VXJ%xi^`X$l8bPFh{bYfri5bFNlfYG3{QX1p!=5vnT;oXny|fZ8gqmo( z`WqbQk{w)Omy=LGN=Oww?5MUCorYlXZ^2fE$Bc&XNX}F!xLi z7lZCdXZK3)op$LU;f-p>tqY=CG5qm*{1d}L4Vv+ZwSzi5Dt){5ey_uw!cTO#V|p*| zEUhWw99{KC?Y^utkv<-v5kI`xgnJiIWF9rH7JqW1Uk{`6qHw()cdK?T41*W_?nmK8 zB#MvtnP;eA;c-7(82hlG>C+hhM`s_^yFcbTKMCCnSy0nVsMV=q@~E0jZ90UYW41&fz!D%q!tqoAB#|vP zU^rBOC*7uuvweOX&SXJ#ciq=(r#0m2ou+K#?llaGU_$lC8nI>$gYN1MoCXdmmrA9` zt#PYIrkV+!m5qj_z!=QnhXtd5xhWnlyCDClWIxbt87?*gC2_BoW&AmPgk8qJ5g+PL z>{o#N7(Jem1jvIy6u)It#&uAP? z>pjvXYWylDA8t0nhtbMCc=k-8Wk<7;g0GWQvdFoU+RMJ#YM|kgty*czEnB9ZDU`xL z0Tzo%<}v?`uED)os!oo5c#SK#8)_G1h60sUkd4zK2h#6DGmM@z+80e=ZYH{&S zyV3Q3$sW+PnzNwqYb@OeYk@O#`Ph~Eo6uzTFk?+WdIScxD3a#8ET6K}??!$UPCroY z58~YWB~l)_s1fY}sweJIUMyM2$5BX|mYR${KJqCGfnNW^}9| z$pKb369tLruI!fP4V`Rdn&oKLAW}^d?yQ{rJWNtnB*$ZuAVF!{z+wFyl6C?=5Z$QAdc!5KylO zCtSDSHzCd1&Y9zH$7(x}g1ZEwj5wWT;1*lyU+-(t*SFQ)UU+GKJ>Bku79fmoJ!+@I zu1=PP!YvPThmRW;4KMO>=ND?pc{npa7%?pDBL><|g*+Mou*0AjKhn733bRZkBe;FB zXk_68&ml77d@nq*aEy2SxFZWkW{zw>a#?m3+u43^x71;Di)`Z_A&7~&o#-6qDml9V z-oiYf^=NaZz;`U;^EHz9-!V7D(?gDRtM)75tpF)4B|@Ji7?Iwaf}YfEO@uXSA^ z+iKd1?`i*C=sdCFOu98X)gWd`ezA~0tR2=AA%71e4f9^t-c^2hvaf&WyQiYes`|{! z{ljxU^Rl0NrtJODgr95gpW68xu|fW?I{OZbYAId*v-RgQ4S&(;g2?{DjYt*{mHb_P zzpl+TzJy7Z=D*sbWnow+(QAJcQiEDhkfqTO@+{k(&b&m5Fu4bD_RH6N8hL)C|y zqmh{8DwvvoWM(4=fkzfI`?AK*7Dw<0!b|h_hxF@)F!yA*gL1DmneV6H&ZuXC<^_Fo z>)c^R57aQ}h~FGPa(=jLXqx8hd;BiQHoOUXiq3m6qTg`=RbU2 zyD#Xv=LPScMf`ca*bESNPND+BG_mrr0pgwWBC-cw)p3a^81-bs+=Bab`j@(NpPrFT z7yK}l3ZsRT$20}2(o0<wBsMUB=VAwCw-j5~eLI%1Ve=flOT$5YB zRzxgtfz}u4(v8|{Lq3Cc8Sx2V42-r0ntD*Djw&6RG0x7F^pw*EgEiCpmUEc?R_@!) zGrX4&pKQK^U^(`e>j)#Z<*$P&X#Xt>+MJVrh9VNJbwAB1z!aIWx3ea*v7qD$KQ_DqAY8ZU=sul#T074` z*w{1=y4C-MS#imUsuCSF>?n{k@={X}o03>`TY0T-Zuwdiju z_nF3(Ri<=ozX=Y@9}aKti~zgMzSUfK%(+lSU!sHUjo&=!jgX;f2*0M=cll6%>jRbq zGicU1a-s)KDmk`%g}UDz4c<~Im(F(QoNPAt51k!`B(k9}DnF6L7ON6&_@{1XS@f$e zhDk*=-hG~SF3~toiB)*Lg&YRgn1_`8$uL*N)R@&+2;gR)c~7%&j$)Z4%z4@?T};#r z{|qrQkS@7`t&%9tE!(&Qg!(j%NF2+Tuc3pr!?55yhUEEScTKhTz$)D(5Pj`h@T$6@ zT3MIPUnC19mN>T3;izCD7xBb|Z7oQ|k5Ju?EHA_VrpSdo!Vw5UdMyeP8ANf^G^Q6$ zJVd@hp{`FdQ%^>VF+(PU)U+2lL5G&mv$n2XW`fx^u3_Z-ghjI1Ox4Tm;<(29xpSr9 zEv)x4a-5*tVNqMk$A@r4>JD9~&+k>J%kQI}afUr@+MeMd`ZL7#&AH5@WYu4iqG@VV-3ix}LsW!O!v1zW!cJxtZog6WnHzS-oG%+6c zLQsKm7OyvOER#?#Zdx>6xkuBrdlAX22az3NicH-}BH#pShoHZSsOa)URJ03=(rCf_ z=z%-kTW^ap1VR#Tv<42eMRrJ$h#cOeye7ODUALar&tv$Il!bWB*7+bHu53x`*q#(= zikegwaQ5QUB9gPZf(7y3bc4Rqc~S=HM*X&a6}VdWaUjf5@m}T@3sd0KQ)VY)umg+$_(#k}GBWz<&*&kLt;zaAQA^>9#P=IWg*IZpaGVaqi z44rxigucieI)Edy@^$SVBD}z4OmX|8>NHsix!_y@=XR=hQM32OV(*iB?}AdFQjZHc zL-#D3DKT*9Q|_VIkq{#TmcJPE%0rBqKm$;22ZN225~A6>1a6Q^wXAt)LfDW7w2J$- zao#erlY$>gHdGTCZJGE9b9jOsi)e%H1JmAMx2K@V);#gaXW)h%nz${P|R|hqHwGsU@ep3C6LJw$47~6p86Wm_v z`=A8vl8MkkdF_0f5xj#)Zp)@|isrj!2i=EHq?$LR#M!ofi>EH4N0;Re!0P7!HM-Vx zG^L?oxz?nPyTqL5=M+ZDol*-Bt;*x;(yVKKyfu5S_Lg z_TjC>vXti>PXsi^xF{t@iGI&P8y>eviE+WYOt0Hk>36q@pUO;Gt*@)d527o17k7hE z0|;g&oaa3#; zvqt~0Vx>@>SR)*i9LFTb7CCk)cjrQ}SZ+VhQKy2s6@iffGHs|w7e}!tMOi$|6(b8L z>_NNQmxrl9wYQVsn{KOTr!PJA0uo1I>1Vjdnp=%Wsuc4Yl;S~Wu(X|0JG(_)M#Djm z7jnf^dlp4@abyntfcG_IM@2V>!3on+Y!1z(&Xb~r+-Mr*m{#ugwt64oU?`Kt=-q9_ z2K5BC6|4aW${UalWZ4>G;Nvfq@gsYrrx3fCed0#i)@5B-skag2$n9-qDDEOt+{4zP zEq?Te<`3ordGw%@Nsi^O%%Lj$%pvbce=)6)aoGm#A2-vBgoVMch5Az0T{ zZWWQN!?ohW_%pwwVNV247>9tW(&W~C?>AGzU6rtqSfa~ij7x_Bn& zV?|^Ny{Gxa?%CpoKRe;=rto_KN3x_^4%1`|GPz?Gr~@%2XxSTx~h9%^7V z-R|#9;kR6u6t)%^l&}XkVYzURTX&zE+K8`2_^uZ|XhQKfVfRfrPdlPYCMX0UU#roA zln{OaKg64$^=Ki!geg>oEo@O4jhSe%U)NAH!%*J2;op%lx0JFGd@0qZ|H7 z%rH#m1vh+_vnmsAaKp#Rmtz!p54hnkIWN2HUv2@)8Vd#CJ6$u@4Z?}WTkVEty9j0e zKla``+ODen`(1OcIak|j@4a?Ey`PhI(t8gfp@bHCm7pL90tpJJKS4qZJqa!J5I_+S zB%ml@AtFc-2qGZT5@||Ns*0d;KhN6xAmIDnamTphj`99+ld;NKdzHE7n&m0q=lj5u zN=nqA-|Y5=8@x(;tI;?6wSCFut*z;M-VL6ChkyGgT}uD)uaCIFujN;9+ukokJvL}D z+u!L1XmzGgzr(F=0PUCQYYJ-mMmM_Nwbcw_O4yOfXVEG{+$8iC!rUlOj6SfFpLHiGN<_>M|)Bz6AM|40cfq&}Y99OS&gTJ~AKD`Il z1YiG}?J?E+eE6YVT5#D9FSPOHHiId9G27AlSF>ZWa7m*@slHN!iURI91yPkW%Aq z@I8FCUYl;-CfJv0Q@QZbS<;99Ktb-_k(m=596%Q(;1MzzbwKl8)0uVl0jGOUj=u>ErhF|y z%{B!Y7~pifv`Dvfr-itjrpvx90yE zPb2vrh~;*L(ygT_<9S%SnPyJHh;!#?ow<69y=qL?U#?O|ID~XDyZB;PaXAUxbU6uVr}M#F-9c4C%{?B$h`-= zaRAA5F#SAD=QJxKauD5AaS89#c+CuK$$+XkBL zm*Ofz0-0%gaftNz9Oe%CMMRZhDaDD!iB)p@m}3rX82=s}GWz8{5|M7Tj%3^I1Re9E zEk+ib3kz`83V&#n-@`dCLqg!2qv%HRwW=4r=2x%+g3L0-zk2oz6|V^FsX=r)e0YhM zw8uWAlro*bbxt~K;hw#P3Q;x1@fvYFry<~XAfJuIKDhuhyRb_}c8_#2Tdm(7vNnHd zmCP*bv@cuT*mgR>cnbKKnqS-k=E}P>EqI`!==q4OH#EbN*^1_h(u)8cz8MwYqrg2; z){iQoWVDr1eJFRsL^MT8HBl`zqePErVJ_rr!Gsy9$KWY+xp^?mxj!D3N-xWHTuNC4 zS6+646~qT-bMZVA<-DNWpQ^B0A70m9C*T?P#WS8WUr#^&qv{56s*BWoqi*bYo4~IP zztqquQ8k02FW{$9G~-rs8a109TvG%-p}>V;OG}WFia5)VMJ_jRLa5L{X~k3GRs4@3 z7te^F<}3Ba2@H4}WLxIYMNqlWGK&oPA0l16;VwU2Kw=^nPfi80ap^i@-RleoyZJZ{ zosjQ_307?B%tKYd`q9>U>LS|l{K)Hd=r00H;4MS^jA=JoZC*C3gx-3c8Q<9cT{U(_ zHMaTxhg(Fw`kihZx);3vLCOj#ET}f@_Ho3Ri41zH^1i3C-$$Mbf*xwTDPZzY zO=V1+m^v_m{zeraSK+LnGw2E?x|4#5;0j)5&hMdjo6-j?n`1)AgOFtsj z00t3Uwur&x?~7YA`Iw{()k>)y;{8f4IX%dq6}V@U4$123SwZ*jbh1)yS0AEI7uzWx zeI=~`tLfJIXwlu5FyiQm?v@_-qKRft!i!eX46e)u{6SP#poTB%s};c#qHwYZr0evS)tNA756afi4Qdzy3c^kF7fEVt;B5NXg7 z&VjH|O(}_lUGe9Tjb)OcW#VJFbgb$r=D_Lbn6R|ULcW^r%G1R~(mvbe8zaNcGf!%l zW1VQ>{q7=+WnJWtRWT%R7Lue4U~KYuas}m0Go$7EjJ4B;t6qRQh$v>ux** zcqBuEcrB}X7lmt5M&N>K1D8}2+Sl~vi?`c}H#lGl>rST%LSvhg?M$cTGS?f!bR;9h1p8I? zU2mcV68Iw|k8w>W0psI!0-0UPEx{x`0b(rv%7JfwCpYHJoP8@7yqT-z)JgdX9}+#9 z#WR*QwG7!mbuuxYp>N2I`L4j1@5xR4S&o1NWK)cDUhRw7FbpfBbMB1#EcKBGZkh1P zUGQ!^uk`iC@im$4|5>a0?bxpv5;{D+nt_D4p7|+_shJ!Zl1?|Hq7g4Y-^2eLADtO zw*-mG`_bc=jsk#`_{Unk=H`-5gA?1~4;t-o3-I+cLg_dgm|O3Xx$sfd+}P$D+d^a8 z-PmR}a!t!~sIcgY#3FbhEZMfDOxoF&LQoc$d>)OX$(Ay$VZoMq@H^r8E8$7<+9`o_ zw+HITE~knCWI%$3(#~+dzF@$fJ5Z0dSUidzFwSW?%=xFE!w^m|0smo}&tMUf8k$_U z5p_Y*%Ms$HbjoMzrx&UNhH*K_#F-PK@#CE5nHp0iLx;yl%=Bn|WO482L|ZR&))dG}8UpklEZu@kpFK-Ls?`h=LmK25E9q7muvA1Yq1)6&kt zJ3tYqGX>O3x9qoSDVHu+QGMf`FwW_!g{{Cmve9HBDiU&l)|VoD{9Z&|*1i%-sM8Vp z=PS)z;6$mobOuWqd8a6xmVs8re6}0OBa@@{p zmdoK9;T&hs@yU%eg}*SGNsg$=SmwYzHkP703}aWl#Ou@>LtY2$M3jBK@@`f$q}06# zG}&m&MyZQw$@9T*N(xKh%~IM8DsF5ucLCg_)B`|hve9;a^ohF82V=raG}pOP)kc@4*c04Q*)dY= zF$}KuNa8k+Nsjc6NWS77l^mD$Yd-jl~IF7N5>mF(*6mTa3}B=5}}JOoR|3Yd11$z~tG zJ%~s(BM9^bJhJ|{`XlG3k6fp&NgL8cr)$xt8hSq1-dP9!B(3Trc;vy!5#Eu>q26K1 zlKcUUM~d}d+6E}-)XF~1?9C%NxTx`d@{aO;+ounk_pP~t%IzBYnJ0~K)>_HFX8$Zb z=mnj;s=e2A^0M|`(aAG9|EvhLLt%~}CKrFsq3+uI^%9S+tp+P)d^u$O|;>w))1ko+<5{uCt7 z1^MTZ`r?oNT_|eO$e9)6VAeuEkAnPiq^No$Z?rfXdD`M8n*D|<@KGB1d>)M|m-emy zw7bP=7q0$y7ar;Sh}0}};ZtKC`#~l-G4@W1%m2!F|IQ@uX7cZ4q*5#O_oOS6PI0I! zbMUjBc%<{s+{a)43Ay7Vaq>j$JsBsziM_|-&vpR?cd4`SFd0TKKr3 z-kK-tx75i;a;x{_SWL4H%olQ>7=2v9v?dHZpS`i;2lA5=2$=`F{`?>PFIq$t(@@g*s zT29XDa6UjEO*_wh10#%G_`c)|KS zDxdw@GKg|sFnCvP_C_Ijx8S{3NZu@XZxxc43;9<*zFFg=U(@*LV}^#AqJe4Gnb&yb zPY*UjBiq*hJ+d9(yw9W4k?mfb4Cd#>Vu(qE^5qk-d#A|nCC{MGR4lHsSA-QW;yGtwQDLB8d-Q< zMPF6Pe!C)b-6S2IfknjpyOf+-_EwaW6U*L7<>c?B{QCr;Ay|B;;;pSTY-DT1qsY`V z!7RbJIK6HotLXL2cb95CU*@|Jsc5nDr$mcb_B;;`7r&?!OLd}44 ztur?%u}!M=Fm5ztW@UHR#+hfNvod!)9~2!nn?XVf=GD&)fV~ra zte40YgYJ^F$t_psODF@4ecESar~{mbnn)WXpY4(=BGY-*aD3JXI1lO z!yr_j@fwYtSl6_%k07UR+SCPwHw|IF-oxqx3r&4g-XzSodpSL*#Qd)_N1?%{|3IDprhwif3HYPvbZwCG4tM0eMFFOCZ_p;#x^FQ z+rLEv=U96lQMw_W;+QLoOue@OG&#i*KZ{#SZvav*;{!lwO`a>HP*JJ%{Yo-ql5zIZ zH1({0RR3)#2W@R5S<=iyzVj=uhf>Q}TFB9ac%)12S*a%+`QBuL6>tY&Vs~+z0geSK zE6WXv=s}+yL)g{OQjidRk^+HKX(6;Na6_zUeew=C7Pv7{LZLVugqNA*@!WDgE+H~W zYCYS`2QbM$;`@kn6PBrRV7E1ku8G)d{6Z2eSbT%&PrHOO=7)!Bx$^Q zgZB6jZ{2qk9KeX8Yrnw^)p)EO8xB$rEZZ(WM;N1&;vAm^)_uN1$Muq z#ehEOm^)nOS3wWCQ43x|FnE&Bmb-CN2m%K)1e~WNOCW}W@RGQU=cpUie$a#yM>Q-G z8l4`ga+-NW9K$7-<2{D_qcTjbH;=_P%P_UUcmgmsv#Uo|mR4IUC)#SUGOt>$oNS#_ z!u}-52LDrd8gG5{jO#v2=HenK@A&toDUPvqlif(y9yP5G0|5^SuPC<#&4Fqmqi~@2 ziJLMy$eSr#67%;6wt`9R|HM|H5+gQx`5Q9s??7{;Kd&c;sDBGN4BAj6=k$alf|1SC z_+(g&^itFsJ!0ILPF>yIDL5b<#1qtSJ^dd$`XSn)UFY zfUaAWSxQ>!9~z#VRf?mn;@=s`jJ`m9vC+g{9co&8HQL%l+3xF@S6pXZRP(kqecmhv z#A&uEn(t5c_o>e|C%It9M?20p%s24F%+vEMKh(@reR2K!Z3tIPyDOBAAFfC?hWj|? z_-aH_8v#kim1D_~5wL8utR__R{E%UpS;_Ku7t8AbXW43@@&mux#i=tZx#~C$RM~H; zTqpN%t67$Bad2pV7xpJr{;s(GV#8_~%S&L*E9c9h^|D$itIf8$ZRHxc4=PD@SB&b_ z?JE0%+)S!#Rb{QNHuH=vxpi57+L@n*4&*BPIJZar9phSuPmgAhHJ;?T@gB#XLVg!q zBd*8P=QJ(x{&(_opgDLmu~>N^lEr zQeAH-QXoF3f)|to&q$uVm=s?{0M~6McvX$#ckAJK83D&K5OoJ#rpL^i z$aA*(r?O+bePSHqR|Yw{&snOpuN=Qo+fKqQHYt$x$DRWOKuWcEH7$1XTZ_kf~a5hC$S2g74^QS8H!)eyMt9f$rW@?s}b$UsU0%64tglV}EOd z$1Slx@{$*2`d-6(9KLL0-S>*Mf3TlA18SjrEfu9Jr$|Az+CJ0n_jzt9$iAiGi?n;O z&Zg_`pZVk(dLb%cGK2Bp)u{gwi#g}Br|3}+T5ed76Vu0EW1EmtHma=`+Zd&Qk2mJP zrY{ADG|_6V)ZT%?LB8Q{p8O?inhs)To5O9k@)bFhI;5u>e6j=E%usGsiV;FMFo|+iY4ad&`yG+5dX!YdD;}6zewOHZ_gMJgf@0 zDRTBEX2Komfd^FK4i(&~!fMcJBS;1GgkPjT{6ZA~lH5%bn{aP>;Ag6EuL^#p!brj! zlB<+Gj==Rkd74lyHFe3}dSzR)uo<)r%3pxsP5W@!yABorDRK8W`Rh_;FIK~@^tb(s znYLSQ*I>6DcJ10N*frTLWWR0K0!{0i(J!ohEs8(1$@{=yj2?VFa{m+&bM?HRD;W!+t}B6wA^wV z9=$MNO=JDPzm<21$FM7N%q82@$K&0ZK=oPTraeXJ_l#Z>x-Tm8;~p{=8+>;6D7`~? zM6i`T!27Wxc^yV&_t(nXA$vryJ;#nIaJzmpPOsm_an7E(e88S`uRipK*q(K!y2X9r z_=9f%mG!;fX#37D_0l`D_N*85?e1fb%l-k5b39V3$T;HfJC-2Zc~<}TaRzHEd|{SL4j@kyW-IoL#OO6V|fWS38Eob!4nbSU1qh} zwrtycjnMGNtx4NF${m5DJyn;tEA30Fp^(`?4(9Fl`L&uMs7x_Dia5F8!oM6TKYuEN zklmLstulu_#-_nRcAs>LUhiH8lbZ-I?(f~Z@OGK+ht56O7QLfMxUpzQ3&t@< zwWm?tW4&r3Ss#=5JwNit~Ns9Tu&*zdMuVm-{*iNQE;Y%BPIruyot%Ah}4>- zO0+I#R#WLj%I8X^R@$~{K9({%p(PxVVd z+cIs78TCMYxV{ed0%Z<&Khl7t_+3y9r$9FFQLucT_sXI6w_hR(5utFszTey|a{dN= zIru}B-^J;#iGtd(c5A#oj&A&lF?N22`q9;w)+HCEL zth+87T`6mll)+c;GPA^2lKq27;>)v@%Se`;mmr_!s6$_%Wp4QiKSsF0hvNf{X1cQg zCxIf$Vtf|)jY_6bl&R3b%*5+PaMaE_*I)Hrk9Y_Y=`F&1`@FRr?J>jk8F&`=h9>BC zh3g+xAZ@n=fWZfm8r-!MUtA!`*gWss6|yGn_`c4V5-2_30DYO!I6TDDvjF2Mw`$RN zAfR60q8x6{5&4o6?BX0I{(9tNiH|1c6DFkkMKkLc<)O{wNCdlA-GaCrT1=GAD!79p z4x1{`N`pW#8uqe7P$Ip$$*h;!`I4ljr;N+?6;*jTX=^4p!A&H8(M`D>`07bEweo1h z?$ok3R*waG#jz$7xmjXn6(7&Aow)dbfOVVGS1wiy6P#%!t=@O5e?>4LXL#6PRGLYH zL3+ivnv#i{ZG|YKiaOXg=qwgM0TXKd?Mf;Q_NeCy6CGy=2eY(Z(82m9sBgRzW;uOV zsHhb7ws&;w=j>H9HBY*19!V-Lcja5OTA@oP!_$=wtrsU9rGx-Nud|`!oYv5BX6U1M z!KotrLWH2di-qPay`mo-2jQy(sYZvppQG_ax3HXoE+J8c`R43C@CcD7wSqx`zDWhU zkQXPIV?c0oCNG@D9nPh9ap{CEzjHyC>73&{l~KRuTNKKLtChLl`0L%$@L2c%&NbH= zw<=*gESD)YD^tubGR@>DUThr0Jsbt5glD=XZ#*Z_?#SE#(Lu(*Zh@-k09bQcCi9>Y z5BjR}Mh4V8c2dR@{}T_pDSgmL?ttZXR%XYf%Zw_-?&yqY3Fs%$e0QeTlpEkJ#95*A zxcWn3okK?@wF9WmkVkTA55WTPu7!2;!MF#-n>fO0S)rX%;%<*K_z=MrVGJq-kW!Fa z6DCa772MDkG;XaO%|>ifk2lQv@*yUQD{-#rrh{0OQ|C5r{d(ipe4HEOZh2o+^5B>M zx%JN*w$omO7RH7;!l}^wb4G;IR z-{h+ehd_ENSg!aY373H#DBTumG{pE(!{k4Nt^zj?`-KBtue^i1V{RGopE~)5do0Ot zU2mx?f1lujz7BI?66+NKb2UW|j zl{=3xXXKu-^bg{9(SSy7QlSWYk_Jr2e`uthM{U%gsVWz zM{RaW&?ZP{e-K=piz-1BDNCm>KIcr-h6QPW>Dz_?e)zPJjZGfxmJ6iS)dwqpYIFiJ zQs(AHc%)i>r=4qyLV_Snl@oiw>+L>woECmG+ zu4H$|v~hRM>x_Tv)#8Q;VfBzr zVMOD=dqW4ZjRVPDM1{3IZk!v1G6Jb2TkNNuNkTc#8yIePvLjomFAIJo4+U)V=us_p z0J2g78gqg6`j?mk42)00JqIHgk|R=&v7j>T0DUCtByPiay9Gd_Yi5|q zYD%xxqlq>N4Ti=9LNL=FvgI2(4lG-&4W@S4UssVoK$8FzQ!qJ+eQUKje+Y>9+o7FT zZ3Ck?v9TQjIW{-`{$FnOI^$hwraEn>c!UbQ3Ix>j=Muh@2cHaMRt~m1GpQLsD4-&Q zJr6pcahuS2rvhH-+e(X9g*c#jk*uIHND)vmL z^TUMc6$v!}F=+EZtUbo*eoxl}7P)sSSLPbFDI+N5#dwa*?HX#6mA!c~~IDd+`}vrYm6$gNN&ieD`7CFSSr zdn*4nu*SkaA)C>~3-oy69iVcwf5L?ukqrWW-&q=yd--1q7`hvEo=kYRE}YK{APE#R zN%<+2C)gQuceXhMsQx-J*+uNgKuIQud`pn+vm)4s9%n&k!lWXCOX+Q;Us9zPmEO!< zyI+;NC;y;{)bCn>U3Vkdp1J2{mAw~Y9wk~4kCYiYm8WL?Z2N;T=O8Zz6cPhed zE6CEN-agFr`5vRc^4|sL`KKxSKb3FTW8J9Zgbae%Dpkeo zv`TubSUAos)qC+~4Z(?iQUS!(FT47EMPxj-L{e&SVm}sWOiG>^?cS}ui)1vu5zXWb zf6cV-h0A}aRsdOFE=~MbR)@2!}oY$eJWE8aRseth;>f8(P};uf0b^qbvisl7RKK&#yBqp z&4fUN5j3eL1DJ7iZc-R{Wh9R>GwSC>sE?q*#10s?quu4g(0`=R`f!1D_Sc2nV+GgR zUl+nfndVBnS(DM<_J&{O<*q}t_b(}gXJ)F`XS}YqzeK}t^jh!pNQPc`DRN(o%<4k+ zoI-d(!F|}%Z%0IUAq+!MM9CfEoLaFvWEo)sMTTw^b1a`WgbTYTASQwQWFp@iT2@H- zwf0-RjH%JD+e8_9Kpz%+@k-+(T6*A=+>U1Nd5%>yI?- zd|){Icndx!^1W|5|8s0U$Be?%AmImP#97GwiX;H=hVUjWG>GXeqgiIKY*p8#bLJ1s z4>>b|a%=;N9C6o^{cRNxI+_viB3T2(N#}Hbxx0$&plY38`^@&Is&U}8_%px!$uI(KIr)FFy}8A0lU72F)vhvBZ;vLBRI4+^jR#YJCmACO2y4&-$<9zpcBx z;5NiyMB!VtzO8Y5%zB;w39|`j->x;mlbb@C8AO85!|CS zv5o1`G56?TWBtw#X}xjiXeJ;&kEjOD&ONU6?;6KvKBO@V2H#WgA^5PgWwN*FWN`qv z<3hyE${O9dPGun}(1qi9JyfN+c1LWL)3b}nI)99dLH!DND*T)n(UQ20xxTrxd6DVO z6x~AMWH&g|Rc8>X&sP|#(0^T_+1#neF6xf`m5>^k`tJ2MB;8`pKycqZgUIm z1CuN+U~fY3G`=6Kb(2!_@~{$N0Cof4J4 z-7rtj#h6#YC>LP}O4zzw6QyuXpLv-V5L@gG(K5*#ILI6e$!=7 z)ZXFPb5dAI5l#3etGe__9#9SpIfOQyB6L_I)NV*xbyxk*6GU!(met$nn@RYfHO+D! zdAbMKg=$FSJ_Ro z;+s37RsFwFZ}!Z0oE>1i7K;2X(i~_w+Rw#rVrwbumHe=kD%!6yBe={2I@%%ZhAL3U z{VabK73Q{JbM7{C|hhZiRlba8PZDUXB)e(O?D9SdTEtqKTIb(@Bh$Z5CQ zE{w7P>~^Z9z4;bRRHf>uKP+nX+e|AS`fk-DM;54TCkf8_%|QLHQm^hay$258YFGeW z+3tiIHN&oWz8VZhslnk~uq)=uht{RKnc{4=P4sT~Cv~T(Whd81_`|5?Ht|buB~b)T zlFBF@PVGi_m2hjUvoGn!&f>;)rPtVbXy}x?hfZ1A_~q!v_5|5ZaXL2W+T5n=bZt)4 zcfH!orgPoe?4~m`duJQxI#2jCdTII+vo%=l)_pVcv$A^PeRl5scIoWud^BRMCdV^c zh<=**J3HqoyL9v}lZtx>XDT6CJw;``yfA3S--wUPovXt0RQ4=IW|iE@;$z7k58+bo zR28m(L^^`K{xlVyuCgbJ;Fr5Z;SA2=pIC!2I)m!frwa>%DI#UzJVAA8Uf8u&mMLwA z?|CzC^p*|`*Mnt?3+_&39}weCScLZOC#f(_aHU2p-+(6A9dk}d)Gw}GZ}#)v(kSz= z0&0<9IcNiKI__0(=4;+k?y;I|-lcFqG*9AU=*(UjW6uHOQy0x=$I8_i7H7`8&F!z{bS0!shrZnJ?sqyW_*= zWLf?)7tWiMz+^3488=t{)*G+BPer#ppyG#fVs`yIau>Mg1B7`M$0mA-LjFK7O zjpFbE70=21RzWe00VUf;Z;45J0i^*kd!~>pM-W-qQVtI0EQo_#Q&`J3*;=k8Y|gfr z=AY=cnXUJ$jzYVIy0Ow@y9<4`cWOu2K5bxj|NnHD_OsORnZsxk9b(2woLjx(CTlmd z2kiwzeA=kzEt*ShEpBB!(doEeQo%RjSE#$cToKSx#8TOBnAwl2+j4e+A~7|xi_sHZ zbF==b-Xva=xAdj9v6F9XGoRefb~gf9_L&~c;RG*(P_+7R`&+S z*=!Dv8UJSn%OFTa0<^2$++9I_L*U;5{bjHr(4Z|W!V>6#;OlTCj{CDe`!7B=oP4&D z6~no>fNu6xH#E2@yb&Ar*MKyfK@bQLzGgQN2*>6*uLmxUtFYhQ027fnzceJ*i|`%k7{+GR%GlYp*$C z?#!n9qMi<}#OW;?3!+sMZ8 z&)#n~TYjRkm8a)(Id{lJEroQqvCgk_HQzG|LV#VsS!yv_C|coV%Xf1o(x=_#8) zerEHLp6m@ne(0TP79?95c+CwG>hY1D!4<8Og$mOflYsE!C*-+aJ;7_;jx-ZGx4;WV z7UG)usq!X!dfI79_ViZX7T$RNFZ@QN$L5A%Gwj1dB->~OB`!`jdX4wdn;m)Qjk z3VrVDtdS4-H<9CCW`ZoS-7)3p_VM&VXpp}FN*N+TuOl%K*t72<1cay|$-BzD10|u( zJ)`jtJfbU`v|H}IG_;$b8Lt1Mot{=Tn-D}o^BmyI)2i1_w@=d#?8}~g%a305?Hj)3 zU7rK=BR`yn`P}z6dv+7hy!1>zJ=1dL)80*VBl{gKXFJaM9wwG`pyk}(=h1)rVdu2a zeGD)FqM2oqt@*TK|7?>eJu()YUJ<7r4VH1or(&SVF&(9Li-}JfE&Y*S(VMV8NSvMz z1y<;Q2?4rS^Bogi-fXWi#lM$%r>M@$g`hy*B>ENx0<6hfI%Z49!3$J(oBGQZ)`f^F z?i*cgnqKpolA5GddJUVV)dPRdd4I_zf6hVaE-K>}>!#^Gv$dGI_ghgSDyfQoC+=|E zJR+5hkvB^kgm6F2gdNHukI8IO7443%e-8gQ&f-ey~VtSfCgGZ*C?d z>AcD5^qEQ5SHQr@TpF_0i!(cocGkm@0|6mUU9p*?uR@=m4Vlb!_E*}!7dr!Ez%V-8MP8_Y7uj;RQ$w>!ma5E*3B_IP1EfHF+~$jueDVeNeIzc1oHl@Dy1B1ROk_OdFy zq6nbOydaVlgIHoR6fkVZ=qUvx6$_sU%Q(!k5MFY$X1=ZuRh0C765Ck`DU$+DNNt=M z0idg75?^&2mPITTF0VM|Z_0TOtFNH*`O4URAkk+}+??c9MTL_6^e;v{{C5O;+N{On z$9MgMG8GwB{*1HY59&u#?KXC6yS0~A#d5XF34EQ^YDs-_aD6k9&3MP01^(Bo!Rs)G z=WWOR_c4P)mL_lZ8(j~)oNdckRi%c5!Ga7 z0WCmI65*yx1SWm~1(Z1KOQ3H`uWh#Z__9M+!hlWL7rn9+sw^sAIDo3F{4LQ!k+?Z4yPf9$sdonQ3h=5 zqvSu?{}z>;q{%?gZkpf6%d!t`7^aXS@ZL9G=`lMTa3U{nj~!V ziy$i#+w8TwlicyQsLZ!{U|Naz&8LWTrC%J{c~aMLUI#KAmH{<9qim1tnBOTMq{MC+ zt}L2K?#m2C%Rm}wJ%z%k=@5EOV>GD$X(5hc-gQALrLL&;t~i)#j@OPm+2BqwUN^mH z4|}zCR+#qRy1|pKdBQESK3A(>s;(#9>=W)DPr7Hr?^Rb7e&#Y{Vx~LRj8aoX+RFL- z(vBRp0h6n24TC8@Yd%HR?BQ}}FLqX%IQ<^$)r%Hu=4c>tbrbGqrLWUeLGud85 zpkq>v@>Ww@rAsL9=jw{rXPSSB#mdd|g7@kCLvHWQ?u_;BF{f#71(5}54L&XK=Qgz~ zzVK9<-G%^yxo`l@&_}{T!bvs!VO@5S_lC0Q?=>7XTJv0dNec8=Z!p6@hOvB>bEm0Y zq)P<$T=MagA9wR-rB8m`?ftPk<97F$RoYw0lSQ^)tuOUgiEO`4dsphuIq}OH35nD) zYNd7N^>`>tDLM(hGG?W)SS<9`w|U{082uNWe;pr4^q$WAS)f}On_9DY@-P-bjwgS| zp$m;PM(d284UrG&r`#fhO>QV-=a>+%xLdSz_Kc(t!G4`jkK{|`euPX!=ZaVOTwU6~ z$)`=xZI9ReH~=vgo|GEbhiCX*@KBwErrgRv@gslDkq6?Y`NWIJaJd}sGULI{PP~Zm zy2xaCymMqtPdqa)Ckk{}tJ8zPG@VMZdUTp9pIv3`)wcU8tFN`??^thMekNSN zM1p}UKqMWPhr9(kWiKBFxdfuiTYW+}Z-yMKoiGnvdYSHYYxC{g6~4x_dM1`8`lAtA zM#rND<6*jrI?e~d62?^5#f9UgmiZSj8W` z-Rn*M%?v^P)a+u23|rObnSIm^E^`W_)5+T9Boh7drI+ZP+(l-Y`m?X^pwj=60fW6d z+ShTQ1s(xTWmm70#?_4{q->XKqDbF>+7Dr`4Iom6+oTiumG#Nnn@dAqTwlvXE)hmu zPCSAZ4&}YV4Suy-)5W%IGfle3c1j~=PQn=3n+*s{A!SCZXOYsRWx!5eka2syf$}&# z`Uq3ufa84PcFcl%Gy92S-eb9pN2Y)5&h}RMV<#3$@R4y=2BbjhlUWe4bZ2{zY`p{Z z7>sgwOqhomtf!;1!>Hc668CLd21WC2b3x)>GeH(+PjHdAK0`9z>Q-PzA zIsmFG#<^Bps&K>Gu>kWKf4YgKL}QF$jE4M708f_!5*HofUkn*ns?E)Zh@Nut&;xe( z!~R~*9SxC}+8Ar2_nUrsh)0Mbl_$hFieT1y-1Cv0MTANjP4>zR}L8I=;p z+ZT;ktQ-K}EB^rJfch&~{{>nftu{?05{41EUKa=)Kz=T{h= z$O{|;OwE9@C*VOe#td^AiDu*KuX);M-su*$XUT-06&Rz2(*6 z(ky!4vldW6@gVZv{Clyzp~tT1x)vA1pVfsh($_!Vu1qtMytckn*vc{mD#oE>(t&7g zV!@xLSGagF9#)uPOsmtBA`gzuV>^w^K(J#b#yoYp9@wA<))t1pTtTCeu9Ly)>Ngh6 zr?zzw-+jgiwoI*a!^XC^vGuNGYBkqLqzOoBu&bDwVRsB+r*ywh3-od@dVHXW$)!mO zw`7dux1AL89TU85!gq{$(|E(DQ3GGxK*|^UA+DP+cVX<_PnDH0=-{gIOYbTBu9^)% zbzE$Ii#;>bY@RaaF+X=bwv$ZRn~Byd_WVQ9#ZOTCYgFg5WLHilfc>Bh&~K#4P(0zX zl-Q1|sHE@O^;KY?*9bM4v}_8Wp+Oj+BW|z-aF}ELY1}@S1@(|1{_E%5k3@G{tpNjY zYnsL?co9exmA<{tN4D-Zcs;Mw&O>k-d_`V!aj;Xk*xybsuv_Xf*-T2UO?Z3bN5bIu z8FhB!9iglAORKb5t>>O4luwgmdyyWF^y&3CUTg_Y-uEQ?(bwzmw1-{>Y5=K`-)pqT zE`pi_^K+tk>uBETqWU}eN{Td#0gQA+AjM3I5}RT7O!eXAW}A=XtFAU}jqMFXiT%RH zfw-~lX>2<_vz^rVdr4zEbpFuxLf!b`qM@B9;HM01F=Vr=0 z#SOooo|WY?fuw!{eXm8X_D&Tq};Q`Jwf zcZilHmDh?&ouTOh%OEF8AJOLn8IaI!_A(Wpp)6C>F4o^p%x73n1r429F z_v^;ah>swpGT$-I*`P{uUfxSGBZ18XIjX4Qa<{PHR%4I31YtRJ{oT)&hy#9RUD zo&m@ppOGl2+3|Gp+eWy|9;SkVZ~24H>0bNrWY|tkWzySsF>%V&Odote+$v z69cvsv_N=$H)AUdIS(rd={Vn*4Z5va;ui^8#&pz=q7)9skNMTt zR%A&qb6*3aJ**>m-Va{JA)@4Iad2$hM{L(6N?)xq&9==q@%6^N!F1iL?DM|8%Wvxl zz7bp=1b6vC2Xp0!AlE|y!<(&W*ARfzZ+#su7$V2@Ms>9xT;-!>b5gL$&e&}ACYzsx zWoqjb}_*dAd{?mh_Fpt7DjUJ~Zuj^KTRxAmu^xFgWt%3USGRNn! z=u3tT)|>4sIYw4Od6+i&o|sX=0&J@xqlPo@2b%0``U)4INq96+z?m)=wbS(;W@7wF z{Lo-@Z(>*OVz1d%f=<`osLob@IA7U2x3!Pt?2CC+!M2-sdztC;X@vmf9Gd>_9LM$kQSWER!|kl+(lVG=1E#>X)MI~X4rsY~>=uF&ES9|SM5L(4g;`Jd3y z){bqP(W*(9QqJ3OcE@zMKxq!y1Q#yEO9OQIZ>hml5*askENyRI%Un`_}9iI}L`Wk4e0X4gE1g}BL#991fmh2KI(na9KoGlv9Yht{ou zNR=llnJ{3Wn5~<|9yl3Z#J^ZF)H=&V9wEpgVc5#sx0v(cm067~oLLn9nUOm-S6kfX zd`lmmkw7m<2rD39@i_OJdF&QI(IeQLk#_=f9#Y?q*rEt0C8>?KpYxK=C45GPDuTDL zMD^F}Zajlt!SMzmpv%R4;w*eONQ2`Rq~BoJ+_K|UfH;ui(DR9{^!%C7FN1Wv!8g}1 zrQunm&zi59-zfh<-TZ*|HfRi7^^8ao>X%ZvZ419A9ucVQ70J{A7B>T#p6T3!i0QxJ znP+HNjT>!La;K}^=Br%qVz+)Lky;*)o)q*GA|fs++Qhkj-{X2A1HmlYkmP(&Ar>ryk?_k zZ1{v*dc>_jE{Z8x2F;rrX_cnyUG$iGTBV|UqB0}Jy~mWz;KtMs88R(V_Ui@70W(bt zl8V+jBujO`=a*2KjLrWXz?8pbAUm zGw}nH;Mj%~M~^mR&G?cY2FXV=&zOypvt)B-Wu~#ST5ZaVa^i0?=1=Jv?0ynV zfjY%w?_uLyJ$N|L(e}y_cHIa2}Wn0i{1C*piQ5j9knLA%Z1t8rP;v;`tyXA{H-?wbZiHiOZ8f1$Gtsj@Smg7 zTdMpp+nfJm9BhuqZHn#F@i<}jk>PiRuLcBFIZyw?6Y42sH>Lk+0Ey`?W{z)~%^I)B zp#HAOb49!PhI>)ofH!b1Nl23DINzilPl1N(NkeGIsnCyrxo;(cWS2OX86<6{Xz1T{ zi-U#RTqeSCRa+q^79(g<%Zsl*9^5*PWNVrSX~qb z1TtrcC@3T*G?Rt83Jb-Ed{PCqHXv`?j^_rELtLNpSmdM#(L?^;0{ctQo|z-jLsWCR zWG3rAlBG`N4ufiDJ|PCY5GS}Z1~EH)=1%f={Z92e%iqgZSlJ^H zU|y4aJ%_U#!_vfb#3#acK2QH#5sb5~-p74O=`Gpanq{%x%5noqYb5n?U!}+mMvQLQ z?M38k%0=kUxk7m;@9AlcIN@E1gXpg3F=#VaP`Ea91#Ti;e!ZH?G$WqKJ!M;Qa<@ZE zjZ6$h4uK`RNftrrx|afNk?CNzsj97z&eD-;j$4=7A2q*oHwt^zW>acxy-g-^auYD^ zM2l_dkeSbG=Y50~5;fkaE7$Aj25nC^T@10kEX0jH&5kzAiV*PdcNa;<7(|J+sx-se zQ14Gm)hzwErlp{@_kllrP@z4!py`NjH_z{bm^p#gE<^)|xI8a4tu&?MhP-m7?KaoD-Br2hb;Xn+ z+M;KeV!`RKZ-^>pq~HkgzZb|BZT?c(!cg&N<^4r@v&>`wv%0&TbQo6V9K;bh9lr2% z&bdhWaK^|5dYx=Baa_yRUat%wh!-#pASwUMwa>!sR0X|NE;Vo@R}0>iYPeB@P!kwQ zoB0`51wr{B)8Kky>`WJ2O6k^!SOF>BcxGS4=tS<_3|Y|AEqNj`20JHCHgR`K4Zfv5 z&er%3Mxd>n++6CUN1<7IhY^ahKxJGK%Q9JvVtGnC&t@T;dm=JVQhR7NhOmMAeD#hF z2E7}Ihph%pq

sBC4sC4Uq324-+9ZO3>M)2QwJsOB3~v{nX-Y1Ga#wx>%TUch?Z zcNIGcI@-TPbes#|X->F(G@A}JI_!*S_eM_)t9`b2ReVblJm0^r1b085HP2<+g^wmZ4(_k69KS?-ba+^BOjIOv#dQa# zQ0B~8xnNx`UuZ^L3B-jxD>x|ly=t9jM^5`?F8Eb0-xJ1Lf}LqiJl_V7W?OJg zlzGYz;2Ohp23S4{Zi?LRM@`IYM^A7^2MC{sG3P#-1J6LXcBHFsBB*uptoEmZBv&C|KN%KmnH(N`Irtyz zf@ydc$8E{C?*uf|jGb6Y7RbGb289fgaHZI2BZT#u_l!k>wDbw2T!>2i}w0k)N1!>vNykV*u)3c=+;xP_1^N5 z3NC*Ul7!IyexhAF*8Z~7zM1&{+_veXFK7SpZMC)IJOQnenvdo1^D2UZHSxOkQn z3na%Fj#6e-D^XIz{I+UV4d>V}Z!C<`O1rHSi5#&V`vK*Y)Z3mup>wSwBxG6-igoWY zemvbB0JJ)+Wu!aeyJ|2qDuI}3IoYku%xD+8yV}FNlQ;J!!TpJSrVu}0D4Bd$>5QVit~g@{&=WGp<0`1gu)mwx zg^5BhAQ>_v{}qh<1C0D+p2CJ~Y#Z1J4O}*gA_hRoMS_7pYp}Xmkkw?aQwP?k$>sHF zGMi45JI$Twml@G`&CI`NE9Zq$+bu=!hs6jOAvy-gO!IDHZ}-gYk^AGw z{FLWl61M8Q8TGB;N0EO?)?5l&rFOot-)8&`wH=?+_xMwTHT)K3wvc0O zM)DuX>;aR%|ypXfw?X3 zKGtjQ7-p73`b02k*?+Ixgzd2GeL!M0&vT7`n`iE9QD=?tS5zveR=nkv(rFcYL1jue z*|G#GC~x^@gE8Y=Y^P#;YQs5Gf6ERmEkev`Fgp5S86;Up%wPN`&W_Bdt!1xNZ4%Ab zZ?3d>%`kY=5}h2XbzA0+R`;i^AT}a{ew;!0fw@4eGF@q1gshQ5zu^3>t?Ay@;6Xg4 zgyDw6q)3wMgJ4s~8HY8WBTbTMrHNW!P_NlN(>ny|dQ!T+x!yvG=^xAHa^u;w3ITbI zWs&X3RIU=)No1HS<(!Do-Ivc~?}ixp=9~g$uQN zZENDf19nx_e(LZIt;DaN-;yftK%(guO+M2#h&bhdzFO=#%jL*!$(fKIzuI0sEViT=4<4nK#l8n^7=8A^=(!QUK6W>0a1cL?8nd8?q1$m2Shl z;S+lasCyzyNqvd(39VCOF)iGsc36bK$L;0g5`oWPw0I$FWZ4{p(J9LLVSDcU7Jp5P z29YQe6-3V&EV}ZY4?)6UoS2Mc)Gb!t96HfKVj1!k7s?>06PpxG-H$AB*%2fz(MI zP13swoX&*PMYfiE9m@Q|y+)Y@a-<0ZW!hTE=*$fcIA{rt;-|{FzoYG(R(Ex)TGi@Z z&>EeObz#ZbLlw3Mf_p3CniMG&+-vn}TbHUjb!%0m4drtc1e!3p@ ziT!0zM&}T1>dmpI&2JTW*i`=3R1eMUz0NkHE^Z6;_&?0ZJk)_DsVU}1uc&^~{HgY4 z@9)5wZNl$$_?LGCqf8TN9Omem-XGiSYsAk6Ue?Qu0je;fUw%HbVTf^4fn|3?t(F0EIK<9#irWgByKlKrN!uM&|Xs4w%T4y3Xnj=l5kV|{? z!n7ur9ki5h1l<}NCNa3DzCA!b&N3aX2xOgI;C*gS` zF?(O2oYRLJ+BCO;;Hyi0MGm*6h>wZPdkK|l?MP;kEFpUJQhgyUNt~|hCH(Jpb&RyDg`a3v z9W<*M(ks~hTsaR7Z@X+*W-WoGrkb{=vO1^d6YUA$gBMlKLOd%b(+-D@>gRyQVTg;WRJK~(78A*3KCVk&J400HT!`zH?oc1wu zSnqh}{c(H*9ER%eqrIy8(rA6|NPo>p?3y2qwr`;}2d2wpDkb-0BjGKWA;d^{5HR~@ zLF~1eg@FDJ7PB$0fXUmpIOsv$rjOq*ef%tW@N{^;e6WmGf6cjeJTZTGkFd{cbyrKg zvE-jOM*pJ4KG-61dBy+46R&POaTfNe0X;^X>1`yE-AOG>GdU6SBklBS^?_}ErwnW+ zU3+5-PQ29lVMtml<#r0XCr6|&95R+hTh;TSlVOKnA>50t^Gb+UMGSPsJU8hg4h?d| zc)s&Nm@5(V^|)s?BK+hqFQ-G}NX9iL;U1ha9LbqUGQ>*vHtv8E3)TnW=|-}tm@5Kz zEo!JF-lD}fx#Tua8x&sbQJomI#9hF->9c!zD)#FI&Pj3Z$DY2^v#)i=uXYxPh^|KS zRG%CKrZ+7+)dwia?M)#d8{B7y62eW~$hV0f&}2PaaE&(C>L|dtFi}33*x1O9lzzos z%^;EbsIIl$ z+Pn6ys;=(p+|xZhIrV5pqZ#F#Py&Gv5RUhlpxQ zhqf3n3+l(EuAi00jLp_dmwJ#Esb$ptF6#qnyHLQUGe8`FT5UF;QFEl0X`U855gB?1 z)2m%~sQnoc!(OjF9e=J(w4_SO?sQkQEcOy?p#o0>E|J{|zfS5E-}!k<8^q9M+=vM^ z4RcHg+R*J)G$vmP{+JB@#9T`zpg?VbE875xXN~p$m^2S1)p;g-)*Xa&tkP~NBW($% z2N$G*^HWI@c647*Lr|zL?O%{e#YfwF+!1dgL?vga4yajqAgeluEfmVOY%{2mb=wdo z2dkgaY8XLV@9A+G4AiSi-=XxKa4gD!68*h{9=zRu6TAdt65#HT^y9+*R(R`gsQSsOm*c-W5&B zd$~g@ez9zp?qmMjZ$lNwJ-hY?rBtbuoGPlZtU+XQ#N40zqan49)RRieB4Dd4gdi zo(Q|)%#*abJT(ZTqVm5q|{=_Y#|Q@%^8u$n(X?QQEsJ%9e7NM;eGm3Ullw@>No1lq9^z7P2@;FxhN@FH8AbvN6Rs)FVY;@28~K8W@E zHRPYFv%O=!bHunUwf=wf>9cC~%v$sASus6Q=eFt#TT2(T2IRu2^KJ418*H=5FUb3v ztu~R#<^gkWv%yx|p<&IGT9e4dvHo~9(mu7)F{VD2U(l)-!Z39ZvGPW3YSO>IAvtO% zNd9!2)Ce4B{%Lt1yd^}+O{gzoU6;)p6#}ae9`>1=Jz^it;>BctE*j}I;A08V0 z@Vsj5xpQ=n-`H`<=r^M~UL8H+6OAKAzqn}h$U_=mjQ;E+qhE~v{sSM~ai-bfE^&yP z&Z9Fj_yC9F`A!6o}jjWcpwCnTo}KUZs0Te2NXJ$@y*RtLu| zY;)_oflPP@$DNM{Hw`6kvfE`b}ynAVr^^>=hFfd#a zNuDj~Z}FK4@O(+XSYrDhCH*qn`Uk+wt!I>G;e=O{uAR#2+7h zqedJZB`Wz;&3^_7ko;y%Kfylv)tY{eJ>l~;??w6MKWh5rn*3HR+F9ebh3=)V zHqO)ka^6M#)N`HWPtH9c#a(w4!+VP&%8S7*MP$hbd%nP6QA1|H8#Mji-pK)oCwJ4k zL<{t+~& z^A1T);k$kHo)OeJAtLAqbsVljg+Z7E&SlGZ27zQy*txsA`} z?ES?}SLZjpm)-DganWZ8ScpFMXtf^C_zb!}akD2AZadt1tNq)c-c5}0M!X*PNUz<_ z0;0FpKRDZ;*{-0f7!LmICb_~)^Ga3pZxIZ5{9t-4!3meLL_OdLhc|>pXbB3x!NW@I z-6nklz3&yfR8_OPAmRf^46*)2=KF`pG{rB^l(djoI$M)CM2hF+yp%_;+32LO%+#=Z=kGzMyu9c6kCpW;Wh@FT3A~A4DVyU{qeq1w9Cc4wU-`jNx1$nJ?DX{aj|A^s zgjrjz_efdaRK`IPUoW_iBlB+bc=<;4RGASbD%#Z&4Mu4>&ox&oRwAcnp1~7YGf6cm zzH<|#)CfST4%-guZz8C_HfqvNb*H-1co0!*)-7ABGP^tGX62kV9hA}1x+SrS3)dhM zMg?D5SF*jQqxVD^+2##x^_Dobm(u{Z+Ps;J*j}x+!n-O|eD6TU6kG#93}nN3ls*Wq zvx0B1_+M^T*M9V?EMEz1p>(NLm)oxR3V#^ALJW|-!O9g_Jc^({8|Q!U1z{b|2F`kQ zOdACROCXT!%Hrm?VL_J?72<^a#eV>yA!`_n>}Ok=O5!!d`)BA|T!{R^9?qaNk-A&y z#~Xpnhg^MEsE4Fk+fYHzB?07T(G#6^G!Rn{#{}f$U8k4DtdUQ`#tteX3u9R0!%VdF z7l<>X{srbKg3R%U+3pt@J0Pg&0`NLpylcHi)Be*mK3oEpH*W0atyJ)+J)Lv@WZQ!2 z)#Z?C?>k1DHY7-06(~BGOnH#U+9MTLh0#f2e-?! z%5~ZhWpK8Pbh;&eaB+Mbc#A$dVmf{ysOF_{$bJ-&m&ue#M3+9;l7OD*P=)^Z3+l`3 zV-->S?s^XUHAa)kjgj<*fFSfQF-S;Bm*^N36Al2H%MerVqGUeiz0(uC7yQLM&v4OX zsoJgKnUl#+#^Y%T_E4R@jTMdnRMZ&qkZwmlq6D$T-2h%C_m*51wRySY6 z$5}kx5oj$_cvY{4#$L-MuhC^n4+YV!93jtt2;WZP)y=DTn@-${8zjX8S(GsLUZL%m zuzK=WAQN2IUaphp>Bf_PQq3Z5@*IVZH=Q3k4WHR`JjG`zRJgcy)>~EvPyECc{ZlN3 zx9qkyMjMaCD11ckaMwA`QB00zbG8gJY&fi!l6SQ@_ks4P&x>oP9P6H=K7g&GK7e~i zKin~D{Qp6{4y+ZNfU^_%b5NZW-IjpM;Ll*qq1s&`qYJ5KvYYFJrX5|f)VfgHUJDo{ z&Cg? ztkb_y2N1kruLj~xr@v!=49YwHkbfJ0m3c1doS$r~WOJ3&Jnuj~9`{3{w+V?JsRJ3# zLQFcrlrVGlVGlJg61FP=yntYMkjl{iK|o1zQ0B=9_H?Ufgj5o-(4^^nk{Td7lkQUG zK=w&ew{VnX^(=FU9wP|=<2>P?lEMEYR}JdR8YEP+^b4^k0B1lCDY+~*0-*r+z8G?n zafI(04ub2GxFC~%7{W0iPM^Ioms3&zcTgBn)37KEo4$CRdq>?dnyhe1@@?@8Y|+`q z_Q$|TI-KCm44QbSZVtk1;Yhna%(zAG=)`h&4<7Af_RyLh`54_pv26G7R&Cc%-=HVo z3*LZ&U<0CadsCn=#zdIqPQ}YuNsvJy^;1C6Tm|~GM-Ok1lcU3l7v@r=jR!yhuZzDK z`Im3{bO7RpycEtE_~4sMRk)WstjE3oYPYk)1Krj69V&H#J)X1fR(1zxp`6^MqC@Rr z(XEh5+U>Y`yB}1khgA3#uqlZL1j=ZGnjZY{QMU>9E*;*fGF}S74?)MhBx&b~sT=qU z<5)ihaT38f%6^)J6+-{@oumbv!>QqQLd$)vbW!t_D)}XnT0FwlLdSFzGh}|lpYdph z4gzWghVx4)*e0d)YSnbOa60APTgg#-GrG8jN8s-#*e`Fg*AhZ`ugAY;jlJ-==f;mot)I9_XjymTjeQ>kQ_8U~8AU$P_Boh+wY zVA9J*Eu^q#6qxM*oDq(rJYY(bE%I#5nIw!tGIhu$N2lnV({T2-J5)00rqt&XupLN6 zlh5j`&Yz)!t5y0cQagxlznCdtQKR6lZIEt?$Ba$?O zdr8uhe{=NAhsAj)qM;K7qxJn4MJD+y^U}sXg)Q#G<~`xs*yeg$`L))+8s}uv*_f`= z85G3gS>r;{Gt4|XF{zIf*Ch$?Rk*-v!VZ;p%nPn_2lX8cgfMeh7I422B7jAKY+4d! z#XUwjYBz~Ut$){ITRY$c%F<7i=qN==yh!rA_q!P73CCG0{DABO1nqtmU+Jap4Q@(} zcYX#~`z%~y(j7b1K|8nye*F~Z3SLxeCmj?o*VV$VqQti@PBmP|c+E`m4cC8Npx(v0 zM-69q{TsPdHYf3F+qjt^%VAO4671?hW- z7&>POvhP3e-y`48Qr$swI?T519~{soLg=8xOm~{EQ>*Ph6ZDkT4I#82Gk!TjsH?j> zXTpmVsS~ieQ-eT6(X@a#+y|oQ0`8P#kMorUwHOTPNr%LuXulfCFc}0s6yidM#y8VH z`VG`*B-;GzH!ySln*M=zg|Z59p!!>A{!^h~e_2b6ryG*1DT`PO{AV(u;Y27;A1VmR<#}xE|>>PVK?C-l@Fl%#kCITf=&H z zVOS*_M<|bV|)~PAIfBj;C&J{rEFf zVQga`(6IVGvB0;f&yEHxf~_JSx2v$R^{#_VDJ;VksxcHkh94g4^76)vgtm?bym_3Z z?@`DJKBYEzpCBVkF@Z@t!fMt>7`I_lH{ftPooD<#y&SXAo7!`syw z5zV_g72@#iX_Q<{5LR%G)hU zr;9+!vy`!-AXmCMm+YVuMQ0>-7WeCN{R1H8Xv6w9ef4T?^JmQCvMU1KJDl;yJH2Vd zh%hO~jAt#FD-3D6d7E0&XzaN0=Q@3O5ztuH#3){6At5a;!bl+ADGhmq*`}me0+lUl;cr_{ltDv zT^r2Qu0s6dT7RbgqkChO6qyw#e4#!PKY$c=vlTIz!ElH{mPNu$E8|}y9y$zL-RuPxytT=FknPT zQaa%?Ua278gT*FO^bX137T}U*@%yn6TnjaL+(*2){yC0Oq9y~J3_&sNUS((%|37@r zy?+dxS)3;n%bJ&u(PqIwh$6C6zd2f%r*DU-flt6_)%egN+d*gVp8m?1Vt+Iy-Jim( z+CFB4zq9>O{CNybdkS@_OQj6t$fYJ=QoHqB;Z`npi&wbOFL{3bJ3?!&KF@7`7r%1t z8C`iyL#6qQj^5Pz=eqrA^tzrwJ#LQQpRJ5h{iVUoKxVKs_M~aFf@qe%Bdj8gvyXv3 z;}~+fW~kkT+p)(~+_z9EdvKkIf-StD@YSmkIG(Z~_W5kbkQ;MEszMB=B+IudCAh)8 z`<>JJnG;SWawbO3$q0DCo~%MPs1?V>@5Q|;&fw>?vkgu*RsoD!W^_Q&>`DetGR0{s zFek8x5VYhM*1f9YdFjRP{hQjH!H2c; z8}ji?&>D8+Y!jt5@M)sE!0$zHI3VwNcCHy>Wsf?hdHS%~AA*&xC#VwM8ELEk)Ww=d zNArF{65*OHd-GWTKW+GP9~7yi<`?JjYkybHGi3G1uXO?Gbcvrq1rD+km2<$QW-M@a zaXXskQn9OX^_PU;g{yyAk^I_Lm+nhDxa9aCelL#DQd^aC8`-oHvBwqxhnR5j1ccv} zKTY_mD!!=VcG3EHu7(I&&hN1&i(9nHSf+iDy`8;WG4Bj6cAn#6uyC@jqD_gA8>Tgp zGga1P(awMO;qM_wi+4&BcWzhlU1fRibjIg_C8(azt&S;>1f6a1S_{0gEt%H&&hq?B zJ5BY6>p;ZMV14SNHf1&2<#iX@ymr8CEObD+qESl~=_LvXOrv^V%6PF`il61Fio}|S z%qGqUr&v`L=)WvFH`O56X6*d>;&4&D8|r}7x$}mc@p}@A_>OYUVC+yh?=Xq3B@VUg z*dFJPgk~>&cYHvEtxuJd&3*wvD#m*-jxF-Z7@l7nvF8B7V z_P2LuR}bsr+Qw~c)mYP1E9*9Ye*ZRb84v4?qqjkw-}i5$N;D{|7c>&%JD0_Ml;M4n zGv+$wY{t6?tuM|X0UEKm1GX|=&etJjQ{(p>bPH;l1jN=>_3Ub$5R;<6t2yPn7Lim{_Iu!#jLHh>aiS$(9*O9VNm-}&FM{;0MQvk;9%YP6rcB{{irPnjy#R2F;D=ydA07{ zt~#$%#qBD0Ic68xWkUDK!f>5Rcs;tBjjmUj8*svNtBiGt|^N_I@G zH!(%1-f!Z?wB}7ZM=A7NXa1`)HhrpeK1iY4+S3Z&!WV7tyQ=eds{F1>|4o|qT{v9g zmH2lw?U2rX%|uV&tz7Dlr-Ed{eEemruL`Qy2I`uib9>PHinX=Oy*6Mgs)A{G(z=h> zQdk-n^lH2>=3x_k6^qS&-{fC3VPAIG>mvZummOpKlf$;p9rE-(c5!C$b+&ey-7Pb| zWlFut|CT`YWjd^t{K9GY{h;^!xL)q#4|rAullynL5tPqNI$#bR;HUG^gE~ve!yHZVnx);DW>2VZtFIx-sYCFI z#;FS0*}tALw_8 zH>Lj=s6Pc{UZwsJguf4(eiux+ATe-OooJbi4W^ICh~FqI+Ck`OvDBIkEEwH*;65p7 zNgtk~s0MB)`eaj>=9w*njzG z227PKuS7g)Co+bPphO#{{GY<+hyC!Ye)3^I`=p<+`e8p&pO;@HW4}{JzfMHIVfTRF zlrDRTR}pAo7+tLMv-Gn1vxV+Cc;i0w({X1`q%#{o{ZDz2 zm>uhnc;b1GZTdlybK?&aWIM?jnyHp>$GtQ`n_iNvq|&IhZ2_g_g*7)QK?>)Z9vUlz z{PQ3+Nl$c+nMs^%wDYL`i|EXKAUeHRboSnfnI|zc!Zv?MSALyNKNsq2P1{vQU2QU7 zGN~(#{gNp?7TO3;Z`aO^`uL_`V1qi=ZcH5)Zfx2#W#55=8y<#x+`2hTif?@k zv%kySULV7-;_#qDJSag!9&~^Q?Q0C;fsYL0+0Oiar^ch94bD%qu-BXe7CLirevbML zMAb(pEW|kk5+UAZ?ur?>)poOJs~{}5n_6T0#ON3IsK%ZH8runt?c~NbE*3k++zCkW9~D~No}$0IsE6k^s3l2KN+=YevGy|Y%2LIW+fSWe)}o* zGu2ZPpHuB;D`*y~XRGuDs(PVHthK|zlt_1Z*kbt7iS_#MAa^7?TQjAm;imps!E8G# zIX?1I&G~BclyE9_c$V13)g_5tGSv>Ka;ox5C0lJvwKbdR4hcQt^-Dxa(lV;)#FX?@ zJEc06;Nf^XQXQYzDus{5CvtwWJ`V3y26xXA{YwRUTT-!S>D|o!?p<1jrDRoJLhKCw z;*zW{@s!*PbigeHAblF(fPUv}(F*98b(7W#Bg6r_J12Kj5y5j&%tfV|gW7>cF%#X! zulHa`56*NB$n0Vl%yZ7i)==9#_?o<3XVlLqGHh^@W#~-yq|IVJGo$ClqWT5(&CxLI zougsciOv}hJ!uk_!*?y-}CP80g=c{kAp!pQS_Dz+`r z-c+`gX1+DpKvW)%`+=HOU^v4XBq4ghOx~tPUY9Vc2(TYF?9SzA+EVE3be}Jpf%U$L z(b-HpHS3ys-UZe-##z?yET?s1?(*|TRijZ|>59=EOB%{ktTPQc%X+&i-NmkAce;zx zL;3dZ87)!kxw<9S8e*Zmp`5!_?}fT@fi7OCi=UHWccD(#W$*ZtQK4fsxH?l5B)_o3ro)}Fp$(>|x&h?M%8C#c4U$ZQv=zy!u=M~}8kD>CMz<4;_ z=lfpF>c^}sJ2Kabj0Oxl%<35k=ubkFd?egNAzo$f?}3J%xKrQwQ76LJM|UjQAqwOZ zdQxK>I~C}<`m;woyUe!!?gc#iW12UgXTMrITXgRmssiTz4Hdm2%F7!K@qe zy|Ce6xWD0j*_SF}dKOUoA(qbWpGM)v z&k+@mX|j2bO+5G(6|f1MWgDEoh2_}ws7KfNYa>n@n*xsn}o_CfV zK{PBaIzDEL2hQBfHEiKM(c?L@oBjQ9Rs~V9HZ!h1H*3sIwRuWBLzkW4Jc*&4z|$FI zi>7DPV|Y}3qW0>gjfpA+j^rno6C2|m;ZmgtlVqL9w4PS~xlZ;0b&+Xm#Xb^2FwD=? zoMneQ=kqgzNP<4#+(ZWmu`?64>ni|ca63CSk-qwe$&KyT@i8rN*31O>;HJhU1Ga{3 zkyM14L@4@(gA$2J-T?j;Hy`B+>{~h9JMI~>7E2R(-3QSHsrn{5e0bA1SZ=OVGY?K| zaE~6hAvi9v(HuK&L()rpBD+OZ2qd&UrL=VBO1$LyzLm+AO9o_pq9WD-5OVu7KiLpeBx*tI=q>qX=wBk(Z zf6`ay`rg?=>C>r`&5l4n>L(uY3BO(G`%hsBr}8Ux5VaN)5E)XyJ_y048^3A_BTZd} zj_61DUL^~noz5zwk(t+ZVIj%>xn=>hi9WF#I&+QJcP*}g&$)Hi`-Pe!zPRx8N_UD^ zL(T~AMAdvvx%UTVZCx0dEmvWpILcB30tUq3caLrk> z7ZrQbGIT8iL&j2Xef91pJkr=xiO&_)eEv@@%LVMp`P6xC>Or+^1MaDY7yZyQUi9AS zW;$t!gtysFU+tfg`%I7aPtJY1SNkXBJ~d|2qWqYh%HN@)ohsO&GCQd~DlRyY<-Igq zJq9inEk-}rw;lZ5fg0JNx@cg@sF@Y}z2n8Ph9ltKQZd1Pk-R0UtgbdbId^9OV0zZJG1T%6gPd+Sr19miDPlo596lq zth?zw5L8XvdmJBFWoBq(nzR0-c=F9(M{5PnqO{ph!?RFtUtx}y6bhE%5~a`MT3mIUk`;g>OjYs?g)MNT^DB=a70omdsw#kHVH^ev^A%bgDPZ&sF2Y zF^%nwqdVUJaFTpO9>(pAHopdmi%Sa)E>a8KCGCrMx*PPda3p!Z)D@J-ferT9f2a+; z$LbBq#w*7*h(BBQEu>Q4PZe(urJQyBcy#w9ln9~)I?G9nDNyY^X~k=Hs}TsK;A8A> z!|4~e)uuF{l;Ef!7qm=fQmvrMEPo`q7kx6Hz+Xz)lECy)iYa*rdq{O!q;b5Y9@P39 zBq6DPXzu~q7GLNiij~XztnxB#H!J%b{`87BjrnO({f7oe*rSr`^^wU9u+2!c@+CZC zT-hYQrO;QB0G22v8~Qjw*-{=hNw`=(nJ0udIQb1_A5qCi)xyKO*6UAFf6%18i8?`C#^GwNUaltUi+x$?9p_1lX9eg?UlJ)KP%$-cyDhnpY^x`^S14>^~K0w1#oxIfF=QUp*x3+O}+3&Hd7u zKh~_>m{yKMGABzE=vS%ejh`D_2a8x|cZax&Pgv=ESEY%oSzOGXxOXeDubB^0`e;Uc z?B@BKB*}8)Vd6Nf;dIVB>6G(vkRmdjFE+6Vkm)?dNk1aqA>onj3SR+_60S<@fsJ2l z$0w|VHXatWDrjaKvQ3gd&oWCj4~Zf1LT18*(+!eFG=>2TXxa92PJP>h#3dy=Ik_(0 zZWUXTSqvG|K`>V6#Xeuupj3GdOS=}Q8Ie@3$EaQwZwcmhnO77h;VO5JdLvAt5!CqN zNXY@Zw8w!3nn`Mc%C?Tbz<3-o)Gzcs(Z3(N%xay;KLaF)}(Yai4Cz2tO3xOa&exMXu-u^1I|w2IKd1{62T2 z*~wQi1M-bWOYvyn)x5)9(NmlmaJ?`PE&Vx zqD#4;a=QHPT$k>)U7g(-fV*ivC%X!KtGmq^D!Nfk>;|#HOOEM!|FhSnZc^cmsyW`1 z?^=P|9j3gD|F})uYSqOCS|5GA_0sAJn=rxU79_vD2tL?Ehy9_=JZ-yl^1BS5)c37^ z(I&qS)`-RDyEgG{t6#9@TtE7%ns}i#XIhdL%~e)EVC^He>$1^3*IRwJ^&Sx(weT+0 zeD&!5B+6`-6449^McqS_nvkzExqA9FCb5JNPDQeeSI@xdDItxYBV$?&H4iLO6%Cr= z2(aN`t|mKif)6o!u7)>cs2BMbL14;>~|*)EBz{=odQ(q?}eb z7Bc9Mg9zKOF9z5UHM{%9_72%ic5}FCx6Q{MTij4|7Ua|Ft8h=MqurO3eMnoNUYds_ zMw@|JEJQ=d8FhoJzwQRf@^Ey6tFCwZZgP9S=!S_f+|4J3&xpodtGn>{cz;sGZ_6?( z3h7SG;M|p0d%a1AumeMddyip%F#o(LZriGR2u*b@elDsEpaTyda*9f>(Z}Im@g)dq zyeaIdm@`?-7jtXVW0AU3U7>eKt3IKod}KSf@po%u+b`P==d>Ber%;PRoA*ZIhW@kS z=jWsLwL6dE{G`Goh3!*g%~05%pH5^u*K5c$iJN*K>N5zE9DdTOzYuk2+RF9?-M0O^ zYT$VR#Y*d4-T<2(WDeA02yuQs#^5!ZnQp7VNSzrFc}Y@c9xwonhPymP6IB!Us8oA$ zK4xXRb6WoR^oE2NInSwlCOw&?k^ac3rqD82&c(PLS<4e|p3nOvr&^evnAS5roThlK zrP^`f2P*Lr$ieh~!oKWU@_kWOf3C*W`IH1+6X%ET&ZKX$_}2<%0*T*rVFF1+7vhQy zr68r~4JX7uREghHybn6nPJXU5Ju?lOg*SBP#R_j;X`9NNi$#Ru5{z@Jep)z8q%Cey z+y{eYPhk3UWoN6IKtlX9$AK$@uQEc`P#x!-fsI~i82p>ZqR5PKs+GxYlg2q$x|Mfy z+izLJ`bF(&qk?9AF5Nu}&`rtQnd(%_+*dRArBFj>O%Eq^!0M}6qN{E@+tUC6ly^_; z+PqtMk!wkWeqP%b$r;V#hbd7v)xM&`zi4m{7?h|v)bq3C=fM((jUMl@mbeQJ5)f?V zjC-X}QK%kgq~02-Nh z;xMH8g9$U^>$B!iCKGCK7a2FhFi*1r7u*x$rrUfiN`yFn!un?J>9d{cL&mwq?}F?+ zgda~rYQnkJh0@nd*28^Fhj4DxaHylXwh)RQ)~oA|^@BB5#ElRkfHlLj-tE4P3F4ky zpX`Tr@KfVO)hRjEbUbqGqM^@BCxnwe(@&i3mpN;vwGxSoiJYekUyYqmXj( z7)k_bu{j#=`(}Z{*W#e{F5KZf^wP?k@MXse_cc*{>msWY*Q~~h!vbiZ;0wo zQHN(oJWIi;E^uCs0HRPgDI??qX_^%70%qeo>PzNrx#2B3`5xk?`X|e_zj z+t=A1bfq6G310WZANi#MHiFlTHVP@`^S*t?_r^73+}#Zsw+Jx(S3y>o4UR04$u zCMIY_t7jOarq^OU6-l*^q#2X}t;U@Xtwct33dc;|*?WmID4v5f1UrqTcO+hVohDS) zTzta1>{@zl^I^OXIPEL3*uSjyb?#LK&@xmfz~ANy)Z-f181ZdneNXrhWDPpKz6MPb z)=XK23WUQ>CCw7me&4uj*4^iF(Roh$=ZtfM&S%F(HG#a(5;gX6PiH>CLYN0QNZSH0HiSZ{ zNyJ?Y zo+%4rOYC-UT1Hw>o)@=!V!BCgwZActZBr!&dW%#tl~ryP-IA$&HTsRE;@ zgDG0#$Y+z{w`5LkQ$HDP^t{|z$!YJ*CG)n~R8_Os%d@K#hx{KYHS-HM`Ic+1GUi&N zt}%AljxFec?Km=pX#%oK^I63#&9*fvJ9v68?hDeHv3f;a7-B3lA;uUy9s@#GooAlB z9IIcQIJPlHWu4&}XS@7lJ5_l7l+*4;ep)%(eD_Y*zsp5;5{xClY2#e%8>fA;a}#w7 zN=V3fy^oDvwfT4kv)UZ+&LH}xg1DQ42zUAUd?Aw}IYYF05*0u=N7~0nQ1r;(fR{A! ztZTmuk>Es47^bZ;8Wuo1aWqfTQXdRM`ZNM_Yiwg6+(q+#Qv?D(AddN+?k{6V3E-2` z4zbmqaCeM?PyTZhmU7nUA(I-1BpchOY~#by#&&IEd)Me0@sSz4jMu15Q;9WF=ogP; z%dRsHo*B$=XHJ@7XLhq~XFImBjsHH?o@P%CPHQ?fahg7L`DuqPq-@bH{p0MgKQ7qZ zv5+!93xZA2<|<0M{_uroY)Wl*H;s#b2|n(0%c+~DY<^R1S~U9GO)ZDch-OAJf+=>h z-4txjZ7OoY^wAUYE$ydHKCLpNw2*gxW_ZEk_{XMWnO1Y4OR`4tG$Z^|QVvFsm);R5 ztwh_{?q}AhgD9+{+wx&^t{UCz4(ds_y1{L(dn*}7{dc%lwm2OX**)&wO;T?k~*-O6-7AQ(V zP{ViN?jS7rKiuyT+%JY%qAS(ub_g;VEd7U`$UP{1il(d!q#SP47tQRPHdckRry;u~ zWU52#P-QC%_25ygqm6ULVD#eFXnGXIZGO6{)qkt#hbnqW1#9BoB_5^{rxs6kKMk<9 zahmuG~c||5qZHOlh>4|V#BF!o)ol`TBOzWYVR1xT$`cnm?ls zq9|~H0@0yepBh9>ZYte;Y9%Q5uyVYqT7}UJUuWB)ol!^BN!1Sm z)B;?-L8bdU{N&4w`s z6~9l7-;=zToFndao!LNEf21=1t-K(|!bNoMn9tAd*ZMQYeV5of#I?`T}{F zdIhOSq(pe}aRYQw4SWl#WSx}Ex>vE_fVWcTvsR)vj$bi?CNMwXUB&O6&JnO19>WNV zRVq#JBuQ;)MsSF=7lo47BbvY_psT2TU4#?|WnY@7MH7%qZ*1hNZ`F-_^-YcKb@2|p z4LE9JPp@p7oFjfNAjF0HO^2DC2R_q^AJ<1oR ze&jW*132_(MjU%N%o1~=amA16gN!_=gN5^;e8(GWz3&Txxzpl{VCS*2OcF zoe+Fm`MXQ2_7f<32H(`rMS3r!H2qkdiy2&yiuz@}Fo*|!B3R`g9Uhe68Klu0T&cy8 zz&Rqnvaq+evbcAEYde28QS49GK~iGe&@;Fh)`k{3nmwW`c=!;Y2V>EFLj7$N zDcAZn(Rf}^quYY~-QgUu@x;zg>Jwo`uafs(Ei{uW^iS1{)z3-=iF3m1`!g_u#NU+u zvkLyA!hzIaI8Yc|=(oF*Wa$^#a{G1XKx7WFJ1IvJb13 zkE>cf05SR%HRSc)t0sTm4S%R=|3zV>q)q%tM9s<{sKwt0%bxgw=2?T6b#el4K*qufcd{2IYM`WWJP~VHnOL0aAW1n$_N4cTc!DGPofid`K)-HB3%E}DbEn!% zwn>uQXP>EdJ4F=T>7;e|sn#PLxTP^D78_N!DHDlwW)qa& zEW>Ulk;qHoN2!J3R2`@K$vkc+u!@=~Lo6i0%C8U5;SPSBP(zM04tGui=wG24xAscK zM8l?7#;jn_R~QblQE4f19}ASRu_)=}z16u)H!zh zL8-gzB^zPQ{gFa6+hU?t>`7CjY`Wvfg5JfGPIqonE1e249&WURw2?OIyw~L>2b^0} z`BV0!S;wZ6Rp5RTPjWw1If+7?t>u@S?SC{=B=0Phey)iYH!C)a$YMgJ zL+P#P7aF{`-R7p4$+?U{^t(s-hbdjqjf}qbbAbfxqb!GF2Sj!ZkhT7c3dy}*8 zOUmh#s*KQ~iIoo!swvYvD&rp%$U0ryPd|$Qo;<1qpQ8j~LgQ=!Yj`@B+or~_>2UVV za|U5O8dME*4|Z#;^4a+p-SBycQPgv;e%4Jq=c-HG?#tY6lvf%ZPF1X#rd&e?K+-w| zheT`~^zfTwaQ>gJTk586=#u+~YzlFX$G?H8-Yu4Y{a*g`p?m52*L&$3?4!|~Rr!b9 z@GEjJ_q+NYH$i&%nQq_NZr?rsaxWNtGSqo~xtE+QKs^{#V+b6FoKw_N_g>eBfW~o%;*rWGi=}nOTQ^L>tHLfgXxHE&aDeR~p;$dm#E&->LlkwC4F3*{3wkI!mpNZdQp~ z0E2{kEW1Ue4g>>J>*iNrbvA{+s71Ju&-R<23iWqFbzRsrfPe{>!-9gcHa1$HI9v~g z^Oqf+8XPD$C92u7#L;EEJ?1iTPpP{;_A+N`d_0ff6_Bb+pk(xa;pRC?FEV-PeNYZz zXFf~e%U1ly21qUA12-bVaosWT>|RYO*4%M=0Wm?EL!|H?++qQQHZQ;o5ok?nx9 zx^;E=!0Kvy;D*(yMtc?ZSh_5=+C9*&)(7t6oYXpt+7sHJSzTT5uOg%yL#_UE4K)?usg;U!q?Nl76x@}p%8)x zF}4sNo^Bb%7J`ImU<)TqMRp^pk20tmzK!w5qu+t)xC7IVci0VdHJ z^Y`+Jz(45c&uM+C{;^_oOal6HhK@KXZ@#SDvjamEy_?bMqL_{X4T;`j3K%L53(zoy z9P0ZJ&~QCK!zV|9hL9Y-4>YuyYe#{Gs{tC)`ll?31s0SQ0x3LYQ4A@BEo&4~*o-(p zOQc{qkiuBBtz?9?I{FlOD9O~1wLe+wGIjm0=uR^PC&XB4AAxGPP$`thJEpM3Exe~= zhnl7tKu=?WVxkX9*scI?j7|f<%2IqChUD}Z+n=S#V~_aFV^(BI9~92L`jxZexm`-o z<{GE;IwsdR1$X@bswh{NY;HLPKfS6X%ZmFwCHa|nolW9C)NXyJTi;16UUqWZab`s0 zMy0SS=n=_>7?I6P$6?e7;tA_0y@GIES+5|^^^}oI)Cl+emP#$$$x{q$;awf{ruwfa-cfuAUGd)>f%rn;Mi z8>?oF`zl)0UEcOh_L@yM+UK4k*tN$3$Jv!xa3i(^_C%}uuJRUG8en1)d6;x2rkooH zl;1BOvxM}sv2fq~Gqp)Xv6@xic&E2JgRg2bM=&g*nPnjk5>W_8o()?F84^#$mBr&J zDsIQH!3vN#-Q(2^-UV1EwM1&4WLMvPsy4arF8OO&GU&_Jrtv6M zc6~X2n7#8z#+C?PO@F*DO;0vcfFQZYcr)}tI+IwKnxa3W7fRk3ELkkTK8_cCCzE&= z1Voao9XFwu6EW_hFq}UbuudZ3EfN|_GWDj#4gZ3ANj)#C;2UVt@?pRkoX(>Leb=g* zml`5MR!w&F-J)s(eb=knu=55z(jAy9tc58uaji;u*YXepms@)UkBi6UavqhZP6utb zkPXSBM&;{OFQx8f9(iy?pkw?=-tLgMMgqk~Y-=3rKxFr%lF6LZM7=vG1NsPNGiVp@ zQuZA5+37r0V6K&9?;(ajRdsl`NNM`(l|NjU2gAsN7H9AP0D*)GHRRRCOIGVMcsiIg ztoe4+=~m-s->x3D4Tr|m9k8qoew}QQrt%b%%q71e_@p7{ zGM!I{#0^sf;L=iw826v`@|jcu79_8w$>!|ewEbW1SVPN;dZ*KW)5$+;^LHKouhv*Q z?`eIOTRzj(=eW`5C3F{k0YbN)?HHHQ^)Bv@JKWsc+785E(74V5*Wfx?c-8P%R3*Y= z{1kgy2`5ywp|lqJ=moT7_TV|dt03>>T;kMV?j&eSUVOUNwb#3#Y{$l)Q&0aL8b@I% zI8Yy`&!!HwnOY|*2;Fl%$9chSIY+^DMF1zcU5Eepyt0?Vl=a0vU>{!>593(6T*8r1 zeex0_cG*VMqsv33m2!5TGDKD&nAs zr%MUKCQSQmey-i0{Isi;IXJ&i;uhp5@oe&}*D?f?$;6ym>dm? zCB~6pv~{sdLkuFvz|n(l12CKS*BFeD$n%Qth40CE=ACxtX1F^yhN@VSzNHUvwLvgO z>)UeJm+CBxP0V)}dk5JyT=`&kT~0SwVBEn#phba@ax!<6{JdITpF!6r5Dhf^`3ebr zgC&E?@=X~&p4}j#e>8BMbNpLA3mtam36tIqajUYIb=#YJ>Zn!EYn<;7%?lN}si%_g4T?}2|Y(Ht1n?P|%>Jj=+*7s0qbBUT%Lq{0z z3?AwH05%T#iN5zxV`8OYd|hvUT=3ks^N$wnM%5hUZ^*lY(i} zK68;eGHy85p3xNK`LD}jgrD$j`eN{~bTL1zzePF0pnVItKD`nI z=i2BzOmy#E)B6WgxxjW^Y?~kenav(G_bnCtRH1R-c;Vt>XxaeZ*SDN z+f(m>Am~928UX~e2sD#d_nc)R97=kBRrXfK%$MDtG!L^Vp(gc{rVvs&rvg6r5WIc? ztRjFr<(_+R_{!QLYsGA5yPqa64(f_exEuAc(FxenN98tCj!;~fyYZt@-69^=&1$kZ z4&7L8N_mPpIoSO36oZk)Y2vz$wN2~V*G_Z33OtnBT2_D4bi8Pq-ZkxiGE{0QH58uF zN;u0HwH-7))!1YuwXx+qkzGyTy;=QHcitiL_O`_Fx0v%y<3pvf9oN`CMj4>l&fwgA zRle)U$KAeU%|Lz?_3d6O^d)N3`bxDl`cKq%jjBBxI6ojU4WW$ooOso!f2gk4yb7bw z1ux?U1JzdKYYJJK^(rIL-2RlElR%D3@Bp(H)=pKLf zd#ULV-RCFn_w%~%X}|Q0pMKiUKI2DE``4&%`Eoi8QJNIFgxzDTPT<3V*$$>Gse&B> zt~!f5nvGJjN01%wK{?z+0#?ge%71?+wTqJ!VRAv(5fd=W@`Ox-D9LnWJt7&D?#-ph z_%Rgq^+fyL1)Lyx+DyjC6Lna$wl^g4_Y%?Cwgz=AdL^r=J_H4Nu0BeirS*J$pHlPn zH^i@#?DYx^5p=f}{UX}wg@L}q|IJkU>#4zSrlLmACGDikeH`jk3bh5?^zKNbgq=p! zgER_U6kMZxnq1`M__ZVS;{3uqNaJSJM*3>bPVy5ftQ!fV9>Y2ZB&h9o(ErGCt4J+jc%-j&%g?G1H^}#JfxiH6WMi#> z(zcVU#OuZ0gf{n?KC4Ttr>Yg|-wbC(P)Xw8>J{&?V>W3O6 zgsXl<{q9J}ifOLr;`1HgwyQp0f&Xwny<4|YJIS*A(u25{;0f$QaT+%SC#_}BXJ7`?vZbfp% zM^A~@p|SBgWZJ0ZBa!>r&fQS*!wBn9py}bVcX!cznFIz#M}mc@VtT}qub90hE8kN} zz+pl$7=tO_bl(%nx=o)fTRLEbW&CIi&`P{0r4vMier5Z0a9+_pw}|$2k;$BAGUu9I z&glbY`*x>yk#R3I_7W4G(HH%;Q~#ke{rk?$Ri^7|6JBMatBre=`5b9!!6S^nO-S4ZiOwdoUhhZ2vV+`5l^ja|TmJ){e*}pb z5@E=gUBEtgu}2oC0Fy8c3brdYYTe*-cx(Y`?SW^TMJsi15+DQeZJYk@5ce)27G1th zw>sveiT;GK6Z)*-GPfB2W|O+js9Vjf zH;n(f8N9<#^+I=k-=tqOsqY*8vWZ?Y6Z|DN8TUpL-DYy%%7j17ds_xlS2cN0XFBdN zt@oPn9+SV;V@(^z|;Nj@jxcfNOXvxm1;w zKNA}t`ZOFblt+Va-FF8WT76Da+w>v&`^U_T!)91h#`?!}5$t*zwkR&)S zffr5A*oTE4-w!em(;tVGg$7L|>AI^0D~ea|b=P?g53Adq>~aTnAyFbPQ5PbxRXMjC zJt+eyfov-l^awf*UGs;UY!AayRvFg`$|FBInkUhX;n^amGY zupfR zO=&-P&b6~&b4L<7G`@A)edeDZ-8DdU~sQ#QJ{?2C1 zip-V-@i#SZpW*d}^!p;dDc4QW^%z4q^cQ=d)SL9F>R1Zz9?S|4$m2bw_egTRLHwQD z6-oFr2+}IR#-GI?_<}+koee}sK>&~?{o9SaCFt8lN;?6E2oCoX;l7Cyk~tuBS;@wo z;--@W`HtLNWW!FWrJ@>94ecfvc9YmF99-87$lC8pKSZ znOI)DFnl&>EDRah&T`BQF=j#HQ9`uLN{~-{$2!kpnPqPDy_oz~!>gU1vZuQSq zBu!uBAAG4FUg95l87al#MgE%0eD{lf;w+z}AB~*~0ZEGhp=P0ZMtJ6>J3x>X^&e#E z+#QeRLHx0T*ZB&SiyY;X%@G6zH;~gmLm%cosny|@^Q75#;1QUCkJM^K=AF0P;yTr3 z7S6n%30vbwbwd_Vyz4BSA=DUd+A>S`jndgQNbp2PoCGx5cKw}EHjbtz1y)ZPxg z$T9ne!&q4ocH%Osn`<^F9#*wn-d-fIvlqB=79`+v`@gHqTe6tYVl1*YPes%- zOFkH%x9}}r{no!hz2n=r{q?`|ebnd7Z~f#uzIxkV`UgK}5`A9tqIzF^Rr=y_S!2(W zw~x~yCo);2Q`Yku0E)%Rv=kHx3H$ncuHHya{8@tT;sRA5cxRz+?~h~7Lare`44m1_ z0;$*K0}1p|)S;)2^5iet>^_-!R3=LmRB>)0Dh?J@WeDxtS03fba4+I|OP8XiUSpb7 zRhEXq=BV1t;@sY>TBRc|rBm8$`}(%w&SZz`T-tF&41asW+xK;kPJGAvjc$C%HMUKS z?Y7Y`u2qda-x~e!|1fqQU~&{!yY5PzXQn6Y?rhR#?P`@JlrvF)Kr)CZf`~SlXp`*U zh6O|p62StAAdxW!BrsrdG||Rn97rlAfPlxKNQzv}q zJFg6G%y`djbM%9e^K#HBi+BpUeh`AQ4z``hI~z+mQ;*4}B^*8;LtO4Hhiz@PH1qQF z%>q!sJUH0Lwy{V;NGS=78T{HKV~n^Ezk}VbQXsoNnnS=#?xAPGyJ{u}b4Gw&LlGo! zS168f{Z7)0$Pz7-6<#Vj;hts>vuE)A5zIM(Wr4RixpQeGJKrzT_e)gI1N0?=m`O$c z*tMUh3x6c2_*wBba?9Ktf=v9X6^BP3@Ac_0RVWtspcW7kn(q8IOci>2nlvQT&kOLJ zTiJUq%W*6W7H>fQRn|1_tK8bg*0uF+we^VFx?w5NL%mKQ=ty=$;FW`wZrJ^uA(aQC z2f67tLo656qqyR4E;2Ts4|{PwGJ1Jnl4NzY2`_J3(}>0`nlH_(3-azQk#{qOY~kss z{Ae@`w+Xeba6si2!MP{BX=X!Moi{Qi`b^mj!MJL(92s?<8C914Xw%QdH_2?;Ae%R{#0asHdq!V$H(fD` zm;PTvKD;t$cir{f;s5q!a1+rj_sI~g+GJYwAHylqZA64wbtK==H6|O9UF3=Y_pXO7ocqm=$p3W)9&Drg;~gw$3e^m9F1pJJ5GV zBj8AE-~Zef6agO6A(?a=tY`#Ey4rhNtg`g;YrQuMwT%mPZQ~}lwsFni#)V03&keyE zZ?2>FtG#)bH-C=^3kXm@__sAl;;;^vVLtG%)NmaJ5hhBN17!NQbteKMPobMR+$Mfd z#!M{2vsGkYJHIC{nq%sMl{z)^iosJhZ>N(5b&|^vpkdxyVk43F0?p^xj$ka4ZC2B6 z1OqW4?pEa*e$bG9UkQ%KEgc-ljy+kv&jGXOwDq;~zv9-e_`2qs-t;!}T*POa)O*3k znf9jbWhE!BviCt1HnYP5P;pE0CBvU3=4qw`_qgFA2S+l&!{ zTS~2ImN!xbSpT|NUdulF`(}ANd*mI>-rcO#J>_c#~UP zHC3!3suozs;6IPCr;Og;{CpM>h;@R(D3a;Nlkrk`qk zgM1_Q3-T*`&$;(ve|?NBJw7M@70x~`N{)?!j*aveq4+%9^{X)WGK^1*#0gRV zg^^eEOa28>zD@DcTls#3ZkYb;_}n6cq;b)5LX|M zXFePI&&2Mtaq>(YJ{xz?`+AFJ55=)cR?lrLEp3#`8;dGg+SsN`SNQRj1XByGD+)uT zISG$9D93@oeC{V-K*#UDU-jP${PltVXw~~|)qkMs_ZI$9Exlcp>#Iej{$7n&#VxDj zWK~?ZI##QIlwBI=Q$(tNWgM@Fi|MCY+06d@ zrLnmrUdXoa|D12QE6(2?`*+2;n_{!1>OI~V&kX<4nEPX+e7TWU|8rw}L)3j^l-v;I zZj96o(d9Tp)kiR3E{A}bu z6HUH5k~c^5ejoA6;C4_e)%$I~xUW$@)L8dm7}pb> z_vHz*F9x4BzCAX##nJt-xG&yrd2H%8@}eNVB=#?D_CL(~A7G&B5A*V~eD#WE|57Rw z`0wY{r?3(R*TvJ)zkeOOH^u(17db5$Izjm4UH-txHBn=1pa49cUO^Jk@d)A96W zqd(BZs5!Pteg>YOc;E?5=4AHBQ<}`__M0=B%re&QSxpp_I=^YkMMH!0qcP=OXu#6a zX#VL@^|WZj*^xOVTC^nckB{6XQF43~o=MwmcurJa9*JK>J6ss$FNmUxBXLo*`Gt{T z`_f2U63t`#xaO%}CsV%;=VrPCj=OrfiN}Bc4|K-jC&1Qq1A&3gEzs zJWudIXIky>1;fGnv#}A0MOHEVi}efJ9WPo$f_1)}WJy3qVMguFAJ0oR&a#FTnGI;j zY+PYW-)+ure8v^IJ&U!%j3xf|imBg8+19$^-TTVkC@ zN8tDt$3j{nZjLC6trUPaQ&O~&WAV!#t{%Hxg3+lAokx)p zyTz8ExqXOg9n#*~Cfn;Mp4Qfpbk=pK&TG(XyG-|@u5f7FBZltVGrcd@EBlJQ`Tp)< zNk67p|1ksyJJSH693GCS3?~O;xEwWmWHKrkSskNCi!r;74)6tvas6W(#x;&j#*H8Q zvxzR%-TEh&$&>RZRVUA!lx))aFN;pGH3sKb`jzQ<*BJ z7Uu$O1BmrEJOm_txQ^a7w6#YFk*79hJ^F#wmaQhF+0L{ht1*?>XY~iWohcgG_U6u$ zc`RzMS8}M|W3)IC?zP~GQH1GJee~Pv*_jEdug`I*WqEZ*-aVDbr}fII(|ozi*GqkK zHuZz`Ilf$O>jVS5?0Kx+<46s^c5wiH#g^Qloz=Yjs+q zT-K=0Xso*`$lo4-K!5?RJRYaWzrZ7aThs4IyS;uUe{756(n4~-E$VEIM9}@V31G^> z-AEE}$U0zAn2iO@MhF-gcCbVMEX%g*7=EDT9)&x8j+$v;uK00E4B11|8lIMPNDn4Bob5}>DyL+ZS1AC|tMozl}`$S($ObN z=aB;bP7bZO9?1)2i2>;-7hUTVv>r>OTAwYne1P6kx`6A6@l3^h{+=ZhUUvd(>yKS6 z{tE8QMnLtVaXNM0N8_^6*!KzN)k5i{d~j-BpOT-xPHP$3@Sf1Cv7`)Z<^Wr!E>#eTLixugu z?tCG)iW}ax*5Ivf$L+cpv+1o;O^&Ziq&cqt|GL$kJ>28g1FF7mSd%4iuL|#h1Wf-@ ztPx#Ak;IAMmMzkO>QY>ce*sISq0RKe!GR4N%2sQgNq&@foY#8w&AF1@Y@b`TBx?U7_bM z1^>^5Id>ys@Ig_+E*e$;R3Uu2U|x#I;C(&{pNN1Pc|8mi?+;PA7my^6Y-PX(+^~=T zU<&BJ(fD_Wi0kmfLi|ZVd|XK0DVVnlKYXj;PxXUjY2u%p$a5?e@TqZfd~D8zilQ;W zK;oNaNf9&2gbjD(>+a0UoAc2_9Oz$`_g5zL05`lO+4>slm)Jd5=FL|kx-1DV$BP1Y zDpDwI82l%rh#NPscqhPb>|ZJs)vOH_k56Z0SF}%*0qH{1;C-TG5cGr>+2dsKQfZo_ zW7F-r6LD2VU((@$MI9&2C=#?ErT8qqw^tMK*Ccs4F)t+zFDLd*vNi4HM7@+0(@*t! zGJ;8btPI{r;OVm>{VQpCKgsJ}E)ZdfbyGg@`iT`?1S2F)h7JiVZe<#5wiODtO zICH!*5i61j+}KOWoRl*v< zhUJn2hIET0XX7lT)+O%wQZlKNRW*-@$pL0-xw*SgPK}m`_%2cAvX)`)4phAd+m;`B zt9Yl;e>6{#+QwCp_ud}n#Ab7Rv$5jx16wT68d7v5!AA#+N@Fbl*0|LKnwd}5g73~T zQ=ku~lo^))Gz7C34B*eE09L~M(Ze!_(-VqfF<b)r6@gEiE()=$IrUSv^q2Up_;fy=$F$rnYO@Z%bSmWjQc zXFvjj15%;8UYw`ivytrq*=(~nh(V{Gv2w8lqUv_(yj*J1^>JMUdLtqP@~-^GljQwV zmcI1OSANC%)sUeei4i4C>?ak=1I6&`WX?bla-}HeyC)U>fui|3iB2wpC@D1C5Ve)c z_u3BdgAA)MjTCarqY_$Pd<)369GW=RGhdM>N{sOh@$iJq zOmy_c%K4%M4ibPz5uY%3EcL2l;lg5gL2>4V#hg#(=c=N)uxKtQhO4O^psy-!b#+l) zRSd2vy6}glw{@fKaF&~`O0NWVH=cZ8%z!zzJW2zi^)qIRpAgdxiOE@x2OE4#wn?^KT9 z$7DQU*W=Bn=9neEdRRfj|Bx!2ra^DmLHS1y9fCo1CoES6x<(RyY5I2g1scoA-ay%` zjkj1DntLft?@;!B2*bn(DzWB;Q=JWkQwnO zp`Sr33-qOQwLgjVO&5zN3_#B?{iI?7+xBz4=dDp_lJmHn4KZX7WuHW;qX`XBFU>Sk zEku*t1@cmm!bUT6(+sQ05_iEyJ6*UFK(Q7q}9) z$~}6C<6I>yIar|Y=T5KU9>05AVR~D;(jwVKxb)o?iLAK1%W?|bu22d`YPn@cwF!AW zB;*CG+nm!uY!E58t*@2nd`U(xQ*KXE>AufJ2c|->8BN*AF##TaAAx(einGs%qzJma z0)aiCg0H0-P+pL0h#cossjalvzh``$DhFDoz2ee#1cYe21-RJ1y$ddEIa6Y1tHcAu5dST)fPK#7R{ZqNwnz(vo>{! zl3;5@yohMhrdc0lYwSdEuZZpun{pQ~OJ|!> z+{V1v$z15mZXYlok=K|)!4SxDj{tEYu?K@|sr0S5$Fr02!R}3=X|N9LE$KFS9lhlY zxf)6}J|0cczu*((<%p&59dy3~)be1L7H)C4E?EaMN_mB?1&shmC^Sy3I+U=WHTGGB8<%dWz#3=LaU8kry9lxtYZwE=i^C?ZUA+JUvKV3NRA?N1hEPj~ID#>?)g$wP|Wq_KxO!;O)*A`E8XgpO^PU^E^XBl?A|+H?M5W zuPwBvjd^clE?01zEh+oQUL-GGgI*kQ6pl%6asYkd818bJs4Nu|9hbhaRy6!j9poN} zB`w;cFlCE^TBWc@WtWLrgN$IF2VL8l!W?-`I9A30>vRp@H|Px^9~dJJ5L;M)B0(jz zf16Nzp+&S$OfR}jyegL3F1Xs(*J^Rx#qIev-QLiav&v%nu$w< zP2_S_YAH?znKRtoiL68{TiYrdfCtVqDKvn<2$&UfY7=glG)OGkW#aw8bnR#r;AUOw zEOhA3{tm->SC+Ul>RB&m;Jnot&!M%8oyP?~L)vs0S5>+^soR;uZ z6`g=n0=Pb{RS})QYY|ORWV3zj00Wq&Z5ua}XGelOPXc^&6WFzF-qtsC2In)|ov7B< zoBQiW+2^q79R2j>0@GE2St3&0lzo5!v0wIoD+YMV@r*~|DaU)yd=ITnNLfuUk4<`TjpA4Ee~}CG&NA9+MB(|a{kc|cF{Y4 z{~oHlNU9?D*^0n~haRhcAb#RFFN-S=CLProPiNQ{l`df!39HGR+SIWEkc{n#a#(Hs z=fS`+Jd)`b*%5M?C6-Kg46YCR?%%wg1)bH7Eh&b&Z+lPMaxtPh{1?g@knJutjiiai ztH3&wKf5i2$r4bH4(@(dxI^&;fLaK3(+u|Xd_@u+MQdqMzi5US5}~ZLo*C=& zWOXGISVMDeXf7=Gn4v$AEuFbpxt6diEQTFDJX$N36u+(`L&Yj+@456)-r?au>=`e2 zNZG0Ia&IE|zD>6Rn;0%10fYRx`DjG=*i}p{*OMbqHLq09qRkedz;3~q?l$}QLiPm9 zMO=+|sLb7R;UFIkos)K13+HleqhSpaUO%s$N6-ary{k677J(bP?KZ)ofkgKHI=Xt7 z6rbhmKF$a3hP<6HbKDCs>sJ8xdJ{tXfQzQX~e&qL6#m-D38PXLKNDe3u1$dU*48<*iz zZCBvL8k*btCYZNU0+$vudG!9}q6>(@3b%Nn>tEn@U+BgcxT7z0TP|=nz0mEv z%Mz-RXuHYqzi>A`LDXI2<$viFqUjfVR2Z(C zp1u9cYB2cs1hM!{S&NfAgZw5TBtHhVImge~KRrP@V*GKHnEJxHfj1 z*1mbbH%E(~r!VTT)>}RO8?WObPd(@rZ}Cih{Tjb|yC2-<7ozgHzB$LQo=P;;?H~!- z4p7p`QWoeFg+5H??rt5lrGM#m1d z!7#tJK4Wln?D&Kn;^-BUQNXmpLwC?Yj^VZRu)Repmhs|?aV%PH!gugS2I-f5fP2?Q zouqV-BZN-aGP!vpaQS86$u9MYa)D(*guTgX;<0SJC^8pE>dRoT@dqOFcF^%f5PlvU za~!1`2?V?DiYROBM1*{QTDZmX&?ZJ1K)}40b3%V*s8@vM@-S#HF-cjn{#TK?Hqxh& z-p*jc*|1!6oEnCwgom6Un$L}bbD~mIPD7A=XGZQ=^cDMFF0{#Us4)9LQSy#OPF^Dv zxl5zvqF`IA({$>6)CSDhCt&G*;$1mqrX`W!ojvzHS{f)LIP;_S)h zG}r}5J1wVOD)Z?q_)T_Ym$bi&^QFE5fiP&z5W+S9M6hhA=`j$a#v^1;b!f52?XGDL z58F#I*=$F}prTFr`<=LQiq#NE_>^)X28yBo0I7!B$R=yqX=L^xvv|q{QTpl5ALqPC z+yi28(x$B+o1T%5vXCeu(Gr&ey@PowXVeha-;?B(W|-@Wva0J@;>JD_5IFgmD{LA~ zMq(&t=hE$l^wXWy<>+&zb8^vUZn|O7ZK0Q9aJjKXmFN2VfKs)GQ6rF+u1wwdn|(TZ z#PtG}1@=84-kd>@gqh_@xk5Z)1>HLNv8-(@_i7tU-B<9}=${}iASU)1iU1c!02bY@ zvoU?Ao3YdCPdSwOQ2vwyY%<$+%sM_Z(AMlbswV!1qss3iuCix|IVkI4hx3DB{NN{I zvGZmTYMKx*$nlAPdO`_fa9TD#5criK%2VlDjv-acJW%wXE{YqHbU>6uvK+(u#-!ZU zct$e+#-tgM3mf~N^NoMW%V+Y@(|O?T5F7i}nqy?N{kiD>rKoSqeqMo9yXd!=o0Gnq zAYnAWNq%&R@Lw#7JF@TV((hL!+ufgZzE<>KFUAjKUo_b3cHEzY_az6OAfm^L!J|b) z|x1#T~z%aRUK8viWJ z70H2I|FNR@WnwZJZtrhJvfwN+?A9WT&0RIu)kDS1b+xy|d3CI1VO|aEna~r(4-{?^?$lDB8s2%;oqFmU=`2Uec*CR^OkE3%t(@E4PP6R3T z9prEvsH1XFK~xt_zKVo^AG)+n-CiVcOlt9)<0c{dap`sl7)P6+A8I88hJV>F!XAeCU zb%33>3R$w5YLt3sdM3jH45xJ!7zL+@M;$@}n>#z}(IDCxj6L=&68nK{VFnG2Rlu?H zmGwk0T-Ku(yl02YfO5Y^UXYzO!W%9|j2S-0x!-M~k8aF$V7=ySmZ7%yB-cCB6=%3( z&UNdt1&}aSLjRPmFabFBLb?WU-q~O=V8~!F+XF10nDq7b5t1;s)JKNrIGk(8xX0hFlLrDr#pz4#*z6Mlf$r zwQA~Hg~jo>yB~sb(jV*htnIStN9W{1$lDrpA)NkfK71fQ{lJeye2L0wqXoz z^=A}i+03#j=tY)2tV2&wE74`Q*8pds5DIxy zqg%~NpOSpOK|TK5bb~a+_q6lAZ|4mhB{Ht|mg-0pGEGC_u&Lrtg-Ws1T$HWhke2qi zZESnkrsx@Mpx)ct0jxILU}6`UfAvM4*P3om@qX<~BicSyLdVbUl7302-D4RnCrfSj zSPh(KmF*vIOXuF8X`a7%LH5k8{8H6ltH>SBUk!$m@GyAAUeSJ?imzAtIu)%|@;a5j z7Kc{#dz{uj{XNwHQ%Ax`J)K6ZN9IoE?>7aKJ2%ChdJsDq#c~Yv*orUqsr}7ClObqe z&*t35N-^bWHMM!l&!!$erP29q&_qC|icYi-26=E&5SCY$T zxupL2#D6ZCaEVZ-2LR_eg2XD(yc{|6e3E;nm|O3==LD*zx$@iPVrKe7H~rz54=@x0 zb#WlR{LXKueCLSC1HO3PAO3MMx-<~S`n6javRpJjpM=jPE5*rvJEUSc8(_mv2)V~% zz1s>^w^|XJ%OCGHUmE;a2A2ipXwUV&b)wPm3=-1cEGDakzJ9g^986`;e%Nvy>^O++ z`FNo~ZS?`-uOKR`a)s?0OtW)z4-%MI#j#TUPDq^Fhxt?F9>Eszm4Yv-1pW4s3+Tkn zT+9yl%kXu-U^8B=&>g}1pH3g7EEccCm@&R0huBW75W0{tOdwM693#X`LgX&Iabt3n z^C}DYFo%mN_qwXg;QVJyUM{smgt!|GX`rJ?#H7}FA& z?Xs~pj|8!4H1J5rnFU*09a&!twxQ~A&b%queO#Af49bJ;^vmR%x;FNn(W|W9GWBfH zu#=qRo-M}g)Hdl$-+8kz^}a&GdQU#@kzqOJ{&LG3CG{@B@P`C`aH*T~GtuoQ6HyIv zwzK56^BWWf>i%jEQ=59B$;H51X4Rlx)SMSJcZcMItYE6G^7UIG_hcFwO^)1DF-{Mc zlS~&|Ls^=0oMI}_x5?)3o_hmNz#qJCSC7#xf{J2UKK5FsYx@#5b8bo6o(atJLFKui z^rt{R7v!G}Lb)L|Tx!mRYilLO#_Kt9B&d6Kx8d(2d(UY@_pGE0sd>(qP8K$yQA|^QYBQY{H3v6Xw>%I>dn(qD1X?1y#|N}3C{ zHplZo2}lVd2Iodhl#NifP;UTG`&zwJtRa<| z9}e#M%ix~o|$YzPbVHlxEXG6g&j6&+k7Gi5bm*3qhrHD!sbJN+^sJ~CONx#d+_zKGJ$_*tw6TQ`!yMq3k z%6j*)Fho@S99bsrhB(e6-Rky$iJq+I!EurUrOC18fUaSEey@!nl(%Cr*ff$O5g3P2 zGU2!Yk+L`4r<bUT={K>N5NRfMgYGAmlwNJ|>%dP7dFS;K z(`$c`EdTz|-k9oWJ;oay3*ZmkF?3!yF^F^y9q!>&)F?|{emF@O1Qo38mD^Qf$k-e;15Wl_+SfrNG$$rfa zI&RQ1YOd`#L%bq)cE(*BJ3nhmCiKm%MX)KN&V5Agyextp%l9)L>1T139w`lrE9 zLJ{61(g3#&23z&1hXK&|u%Z(ELn=DW2CeNZ_G@cGU1>8`#_&r35lkB?-^z1B-bbgD zFecy~;AlA6%gP4bJ`32V8N0CdmF;sg7CTjQhxSPFAJ3kq%+w zb`V$bIa8P>JT5tdW85^vzUw#mZA3D9Np?+0%LgJ`!UjtG(Sa8c3D;z1`CXkHuJAn zwV6Mttz*0Xo-^)4?VPSV|0{%UO|$AZA@qF+p>IqGefq5L)k5f$diL^@Y7;)B6zL3) zJ04%!9D6UF`lnD&iz}HDvD)ApkS(f82z_Hh=+n&$nQ&Zi8~PzWu&&*|?~MDSqEt|O zVGBTsG5FfBI100?QIbb%o2lFZRT&&fpd;LduH^e!08`TZU@T{$|8m$FCvk3;ADP* zyKBE%w9!AN;+(Nznr<{2i}LujU>FdF|2C?AXlZ}7U;HB*RR?(}^|4u0{b==b4XliT zyNI%x={wztZoCg8uaGs{7d8USR}K2Nh~zJ9s6ALF@H0%Uh1$E*P&;|LS+m_M{*dCC zV0DR}09-TfF6C@piu+M9x=>7fIT}}?32{cqavEx{!-H;cKT$=3dnYzU$h~$eIOKC6 ztVZy=^cDUXrJm3`-S-YH4D9OpN{E6mZ@ye=xkMY3?hDocKSK*) z%*M^br#GueX$72t{!~@c-e7Tq#b_DKjT`E28*|_N%DSraTRbCH6JN0BeA`Q}%R1}a z^p8oq+q7KmQ1EQmXt6@q7b5}3NS)7jiVoNlJIOI_RDFd*&Cl}TY{C>_k-h%j_{k~f zW9gWBHk5uR(#5nvdk~bsfY>(qvxU6bd>3X1OS$Lw+$$&G6aFeiBN@D2n~-g`%24mB^JbZVD%@Ue(1XT$g(UQ zC4W*l+SmIY;~iF0Y3{74GYjQ>*_ClTOvQb11`T~Xu~u_;{S;f8qzAj2x-Y03`RKSPr-3zEIbnKFAKnbyELGb{!r9e7b7V$A5dB(f@g!%%QwY zoHiIV&n@Mp6YU>ugXj12G7GeyK`p9Jo#*559l$q_o&aiE4)Ni5t3pu%Z)@7*!nG9T zw#lEdO-|pLCUJvJlcNV|{a@uM{v1F z)6Yg+^w%&F^xtIu9qSAc=51;IA@$#-_YcdUH zYsikH>0JoBN5z|#JGYsxthoLN?&IvNWyTyYM%$6woPG{ZKiyf_Hj9%oW5h2U?JRRk z&*mM~!sH&dtW* zSvk>T?ebd00sVSAb*s=nS2y8I{M1`M$NaV5yR*&ws?PjA|FOQM z&YU&M@b?|{=JfK`)b4{hN3`o<>M-*BX5#2O$j^J^l@EvNz>f}u+;cM&_Z&!NsqVtwXJ$;kHX-xpLUIqM_IR_xdyP&QB7?)wx;pD2yHbNv-(1dK1;|yNjsE3 zS4)lwkKc=}b^=}9*i;J`DUZ+ysRs?O27-H*RZe}(%Q&12^Uv|QnXb}B+H0*=D0bfq!3R7vw&~QFCLas&5sW|%W zC6|deP={@n6CH_83Tw0bOJ=APX?dt# zEdXUu8j1rfx8yuC!+nc>Xg#j>=C^>_+<14Anc_`ip#r$q$x}3V^U@x@c*5?M&dWW_ zxzNCe8IuAOxE>R??b5T5_4PKDwW`=t)_c@m#^rFtrW5yFc%gg0eJ2yl5zOE4sR*4X zv&bi&Zt&E424BkU2G+LlPAy*2L1$Oq&zUo&dDS&*bmDs%Dxz=2--J5l9_Wu8_GxXIwO^opbA)lgQ0=~16l#!;z{f!2nrq>s} zWsA($dt!dzqaExOW4KX6I^|G;`fe}=*!54af$M48yjP)>htk?MZAr%6fI5O`H)`p^ z+sx^$BpDDEayQ&@R|sdo?U4Ej;XO$Lu?QYvxY7i&;`Li?cBHM7(8FA6VXK6>(z%Hj zfa)Sw%TLouYKG%}Ez^YJFnU!wH+tQ1UzFEmKo{h2x{#~u@r0ECf0GX(gV)^nO;^0( zhHtsUiC!-B&K2bvAZdRFJBUa5oXYq)_t5j@U!kGG^*WBh+9@|MBQ51)H{|x$5~czo z9^h@(JW z=;d5}8Y~)qpB~@Vk-cYf%L_I>dIVg7$er09`x}`o8uS1|r56ogn9HqTP7>BmZ-oSX zw<8?UoxeY&Q09m;?mD@JCD*UJdfdKwbQzOul3E;Rdz%$Cu!tVGYBB%O8m=snz~ z!6ZxwDK_U?eni=E<$IHP%M)zKNljNXb3EN44YbV79*&BI< z*I-5Z33dRqvpsYWIn84^!+71G!qPi}NeaUmol^WFySD{jDw<9#?%REclmDZ3R_f9z zB0N(-Z^d}0KG;Rjx57RKfA)1^nB5{kaU|n)M@Qbu z{)K=Arr~X%as8ZU+jQ_bb^44-pDx4-p|CFh>l@)Fm87zDZQ|MpgFnXT@o{F@b(L{j z!2wVey=h3;KK(@fwt@z~Hlf{tD6?r5{ZKm!Qtde(k+d9KTSa%2O(#vV7OA=#WP(De zP-zPd$@OuHv{Rjs*)+YjXw!u^Pown(0d9McXZR|%Ku6cTU19VS-&WUL7)&J>3Hm29QwL$NLMc$- zGB{p`M?+myiCc@Ot4_I%{DIma$0J&~^mmI#<`rKd^!{=ud8BH#khdoN6%H3$p$*rk ztnwJZR?xvZvC5UTF&VZ2Do`=U{iFl&H`zd};8e(;1=tE*YRCn;v{uJ!bZ)IpdBsGE zm=A0@Hib3l7AjHA&9I}`4v$nCIN4kt0Xl*GIFX?IwPlOO;Q0bqOGQt|ZSRE6rqk;% z&c)EFdpGMChSoLOTdOHPGu4V9%als`R(ezG#9z|^49j`+o|x+leMC7oQdhp$t%5j% z*3uSpw74^D?-m{UKh3!XbbmYUKa!bo@U*bliQ(2HC;@O@POE$W88Q1ce<<$NX#oH{@n}>_dUSe;3w#8fgQ^}KL@P(nGa=?ixUW`Y8Z1uq^ zY;bd?Zj56|av>rYWfj;cMv2fuAE2LbJ3mk*la~$%3K-iCW!c(ME-vSY{txAD=o3mR#qe1h6`w6KG?oz+Fibu3CscUubOqEQD|m3A*hZ17F}NtOQqF;BkL@~_(1anz>{y#3K-b+^Q_zil_QaPAni-F$P0dZ7Bb}{V@G09&Bx@H{aF2RGx~ch?x<|Qj z-)*hk>K|*jx=5dxGMu&`x8LVp8KrCGJ7$d?rT5DCyX%de@D11bS%1>kSL$)oJk233 z)|TTnya z`viT05n0RK>=3O#3}*);(RZO}4jMPghVwZt$~-pFr9!_>xe~+fetn0V_PE9C1sb|I zo|dUikw}ARJDn1 zZa(O$z0`l#n7pTJq;>7Ayh1B+mWd^U&Og^Gf{>mDc8!AgD09U)C%j5KC##mYLg!#? zCCWDq7Kde@p(CMcOcRWUqK_TJ2+wkvi-VPOF}fcN`q-P1t!QM z>&T3)brJ+<+Mm%7*2}>jeXLIJ@tdTWv(Q~9IpKU9lL|n4th(@{7+|^t4shw&$Q*qH zWHcj^C~D~usUDQYKVVMdS$PFkKa{i=2^+YtNb|Zi)wOc1fu0)YG+IYgOO#n+tHCh} zo)&sKr3ZKo1%k#d9QckiKMf%inT@)LMHB`=Kd_`KE8F?|TUE^a;Qz{uPcPqj{ zz5fvo!m|T+oW0j@!N!}5ElQh-x&51nO}l2n4~ZnT8I=UUCeb=}dik zWk;4=0my@smio5>l?o6uu+j`dwR1bdx~|H``VVV*qd> zdClMexF@xU#yc?;I|%w@QZ4$9R4ZGlCJWz{X;gkppYeMVb}JqdPq}`rVZu2 zSZOs1D-55Qj{=g)G|Cya+wFWR)4n|_lW7!ko3mlo&Hik~5)yU1d_oYVx)%9Higx-U zzRu*^f`8hJ(@J+)`IcSW%D41VseJ3^Caho`$=Zs{Z{*v@HTgE4ip+zr_q^=&4j|vM ze&VtMLKS3xQ8%3)72j=zTj^WjR`79>S<%)7ABU;O2P%Ey)HX{S3SUZtgh|sk;;pGB z-s)w0D&Bm=TT?3D%CfyC-fA5g?_QIQRvbgwtihgq{-AU_D7&Sl+!DiMAu&@$zDsPn z2sRn_%RVobLsTw3%HAPH6wIL^ZV zl5Jeu4&C+QU-CUG+XkdtTL*Sc13qSD+y4^kPGwv2jcgl*Y#TOf{5P`AW{aoNf)wSN zD5;GDwS`sO=A}X|=FtZXVmcLawtSYa&}zOF za@%JDU;?gK?${FiAK{?TA7)}lhbQXE;q;}trnI)FaLyqphZZ94mjOO^IKP$UlcYHn z>=EyRK`c7b%OBEpux)2i%2tzEwK;zNN8zF3ASSg#fA0KV=C6|A4#nF-^!V3E`GPPn zTQ$@gE_%qerG;UEfo`?s|DnfYlyvI?h=;6{Ex0+nfl%b|-w~lFT}B}l+MEw$ z>*b;y&0dPTwRq4iQ6TUX+1cpdtK>bZbft7#$k(Jf8WSqHAjm2u6K%CZPFpD(T3bfg zaoECmZ+3^`u$%ab%sq<&=)2WdWd2zT3IMs!-+lf_Xx|t!Iim3REwB#>1>_Xm03rPM zCT^2kJuavJ0c3dq3=!Wv`Z^T_D9t!Q8p_hxNe94>%tbJ<*mqRlUS|s!KyQi7l7s6# z{Vp-27)Hc*u-y1&E8TpOGStF@-@=ToTJN&$(iU|Gh@wqitkLlvGg&v84Vt@G-V2Ab zd_dyBQ;qJC2rD=iWi^^>`Bz#g^LH+=v-jhHmhi*_f^!Zum+xYJ4ST)pG)k5ebjU$jUkq7&&v9q-R>*1}H$g@KFQq#} z$AdA9B^H*g4egtVnbWpy@LOB$JZx z-KEMo6%QeCWQ(9-dhX!XK&QqHtFb(zON69^=dZAh4g54D+oOIlc8SLZ?r0^Vt@)b3bQAYD3Z#I>3-8Tc@#$`7g9YYVYcxJ%uN z`(}+kag5GaHviHW++b#Me4J`rm>9>bBJidem-te>CW^FloiDmg*JHxD7zq$` z25###&lMz)rIT{v#y_`J4e{eyflT(F)j+|O0x-3~1^dvX`SI!QW=^2J4z~bm`Na?JHz9YzbA4cxWXw_toX`uQBDaxUKkUn>symZVHtZ7LxoKp+gV6y-$k0e^*21Q7lpJ8_Gub;6%1Cq#b}aE7dw`XX8XqN*x;^~ptgZzFc>VO`aw<6zg%E{%c|A%JN2lv{JYqh%oWOnSZ7j%KT3;w z!g%N<&|B@{wIU63?)LaVNzoN zO8(mZ5-%?K$Zh`6)gQU_AG-YF13YN-g@3!vY{l*go;uO9K2E+m#RFWo%;RLjoZumo zn+qF-gxW$k_F5B|vPb2{n;v-9?GU}#XGr92zx`Ut9YHvaq8^C1z2NIKGs4IA_g?>{ zK)1eEn;W9=)+juyJV2))=QzZ}8mR)VuPs^nu#dD0kstx}W)?;Ici5X#XXpKhOu9@#6 zq>-!ty`V0M-0e2u*Za2!^E)vfzz75OQ)TWK1hfi6<>j>coWIFrJuMaNbPVp2ASOZ| zk;oAl8~UYGO*;4eGeDAeInGLqXgg*+h;bi_Xe zC-#_^7yB<&&FZ1%*rUzBB6G8vPXR*V#g(?lRa$lOMyq)2;Y zQssm}sS?#3815=D($Up=3IX=663$m-7Ko3f_z;rhf3h6 zq>CJ%^dDFR3=-Uq0azCb$H!yZL%MQRiF@jSOaC=Rz3 zL){TUDZs$O;wP;>^n8k}GdUrZ@&V;&yH&3o1YDu&rjFQ&dRMX7!rg3n$OzZtE)r*i zvmbYFXZG1Bfr1519-%g%E~I8Lcd|^CmlFHZujHIp-KL6P4C278#|3~ox0m`6BgkN7 z0*9#}@l6Gfnl}0Ae&aS~r<~uc>-V>g39_rh{GkwL9+E#$?qA$*E)kl}#NS3YhqEfX zd~?KJa&d8YZnVj-c8h414yfufu^U!wwC9S;8L(uO& z5~zX{mQ4H9F{r{r5OUN2r7&pG{0QE)7g1V*87zG)D@E8%Ouv{eS2G+%audxCK3gPE zT>vM88_m&w5l~SCF*6r*ovY;-RVq=mfEVfAEd4vBcL#k@BKF+dc`@)bxVS)Lh!aUM zr;?51JS!~GaG;;!jXx{a&EStJ_qrDk0a7Pb5L`1e9RT-=a|ZFelkc&H>ywQ7+QzWj zIWB%gP+Q-EI$I z5~vi~`MZO7H-6-3gzeGbUql%WJjPfPs#6wiGJD=5XrYxHp)H<}F!%y;b>`h2vvGgO{o-KSdO#!utVz{yZVaK2 z#92%0X;Wo(WR_ym0z_bBu~4b*(o?&@i?u-YR`O_kZME}TC*G@;JHnw``tkHY=b7aR&?P=97|@sR~ok6vm?{ zOpJP&@U58pr=+nNDm&VAx+b};VZVJwOQ`&+e7zApV7cH%Fs#=xtD#!jO0_-6;ZSs? zGCUcFxGzEb?c7cUWE3UQiM~{eU`?m}Q040Yh_Z*`eQI|0qjr8I+P(C%j?Zb%tNa?# zVe7zJA8>&)p{@~>vlGb{1Q)=1w&}5oJ$a}JilCG;;7~FpJxlPNGnU!j#37>Kd{#Sa z!8VRPqvqTVR*j3y#@V?Kz(Ln(gYgMY8206{6o+&6g{d%IEB_JHA~c8A*3X8ujjq}{ zxyR-n563s(L{1)p0ah!FXRF9u65wz-hUIfNX@jg)7a&@DKDO0syo(}rv8B0n3wQY* zN=a~w56s{sKRDITz2t_UxX~KwcEE8j_4SeWu^W6s`f1LKH+82`0D5<|Aev6yKjcWg zYfcD_J;PUldN|OJSlp3cIlw(un0AOJ!mp&H!2O?8Zjt+I3jznUqt2I<7BJhHV`X`X z#B{S?qv{9GiTo6`zXMAN?xD_e>V*Q z@wni|ZsnKd>x4O|cW!p@lOq3wP$S&Q<|e+XhdOGZIYCuUR*>lo{`z}xA#w;qvTK5R zOUR!a*rmMkWy1WBKV8`|Dm&LZ!u*f9#-8RP5&tw8!7&}?pF(xJUFvz^K0^o1pDy#h zcN(d@nyTA)E!e+Gl`mCt)i;-$WbPv<+}!|3)4fOpjjYK~D1+iW_M2n2GgBj%a!pIa zcn5DsIX_qz9;Tyn2LF0J+$Qu;QiD8MQA@2y%e+kjMBPUs_n|N}0!?PFQsrxux+*>A zXsH`LwSfh}1>?;P0>1?~zBhy!rcM^YSTs(ain`m<+-=OmH47-!IsUqB(9!$TCV@!M|knX7)|>)W9Qx0#IkN>Z_;TnlK+SXITXdxojI z^~*3>A0o5tl>2dACMh?NpG066X6hO0VVAU9>hf}goo_$EM*gU7^}*)r2_zs4X98<- zJ%+Z$i3W7N5KvkY2xxab3Ue!#pA!q<`+`-~ho{9TOtGIzf)X_HZKA$hM-9HZM@1Fw z1y}XSs;Nx2wQ2l*OSzfQW%Fi3;tZ_Tc1&k&tLu+~V%Tb^>3LA}m3tN5po;~-;&;V} zw&8^ldiZkDZ`vYm*=na_+D0R!C>zo298ksGiAitE^RcSx4ecDWmQFYPUf{_Jo)-R7qTfRJhuFZs<>L&P zjr-I2?2r$?nOa6TvYj6*qDuum5s7b+;^SDl2t9|mk9GT=!5(T)ss&|^pdS|Yq%-*? z7nZ{x%cBx-f%52aKbHq}9q8|kvA73Dww(i(+N1^K{vmn~IoDt*m-MEXQ34XmQ{=Lt zX0;>|XlX+gaIJ!z$V;&#K;u}th!%zTfoX#UC_7~^XV3^jY=kLc-I1dlUET$d@GjF9 z$z5`bMr9JWA4{n&Q*3wSDNt)e4S%e&V|uZPnOj(4Jf-ygj;oz>1s*h!KyQLV<+fm* z6sc2-u}Tej&Z)V3B&FjN=~liylKI6R+2>p>8mVN$k)7F*-E6I{<52J)_E274G9;Zk z-1HN@joIvS9I5CxWFbJnB2`-4m$c^W_Gf34+E5&q?3uwO8?y8Cq-PlVUuUZWcfv9I zI=6Dt;0qmm>Z;EOC3(l1K!Zn+=4I`@ghFU972DxrXS{>6@dQ(gRSWX^e=@g>(MklO z8zgJm=pK^_-L5^mcRQVy9b^{ihD3%T)4WP5Sir)_66ohbd%NAb)vmH*(x)Hxoim`Z z^7Pm(N^ItQ#u@ZIQr*iLuw(|$Fe*DkcFa0YJFl|5&hjQpdPds<4GyL0l$hYWH=Qx%nzIIMzIhpNKSx#sBOqTQ}v+G)|fd{tDF~(WO^po8x zs3)=#xrsg;9<}Bg<6OvZFJ@WIa=CAuD}88cYzNBD6=mnz)VZ4Tkn^r{_6%*5IxfplJIL#H$Mu~@eBXJD<@dhs@rL4X zWBW;#r&*q5d7dRbUnx7^c;`=k8j6!7=cebgvY6Y->mKJXeDxyB%Pi|yUggs1kF7=~ z+H1G8iSs(oLrg#y?DI6~rtJ5Vob??4KEL~b#U0{2M(itwzZS;dYhvwO8;^6YXYG2< z+E_iV)gLrt+`fAhWWKwJurIRj+uN8=L}Gq+8@^W;JbEjibi{?uk{pfwiuPXB*v4*?ZF2j&8QJef z!X}fxy=FDsN(9d`*4nd7NY4_cpWhk9J2=ZYpMEY<&r?*Z#GS-JDhKR2x695sBb#{a zfF{HD+x~3df4$?*b1vl+wm%oV)cXzfDnb#XNrQS_MHV!@dKVSOJJ9&MQr%v`b z#E#XXvmP!`eUDokPQG`m3uQMP)7a8hLe@sXLUJ!t!o}V_UzHGcpK)B;xY;aW-w_6o?eO*qH*~%rd0XF?SNDT$9D)(y z**8CuQrN6!+37hu>|{tl2FKz@N$r$brz>zuy3kI}amB3D>DPSkbs*B5VRUw)yk$+d z_s@)lr)aIZT-xd~@?N!ue2_XPzEGYon$Hs<%-H9Nn}xG486|}MHpH*rENA(B4b4qq zVY zX4B5Dt@o>~53a4F+S;wHx2>&zUR&>A*W5FnTjkDT`2ov8EVzlFNAukSaL-0;e~;}Z z2gYXW^y9O>n#jhG>=hZjY1A7a3n<0$e+YXIFsrJo|NriN_9?gbJ9qB%!py)73@|i7 z0VxC01QiuQ#b}HjHRg@_#)#Me3rMp|iDDP*##qqUEA|>C_7+94L_^~Lv(7zZ)L-8G zpLyn-b5GrM?Nz@^lU&_;!FEtE=h7+NONZY;)VG~tVmwx(NK9l2Mv2*OTmRs$U_Z>; z1uF*i7nKt{m39|8-sz4rB*vG(-{mX-3;vbZQwT^XaB(Al%C;W2omPCSfBfVZw)Yv{ zdOiaHz_P&GDD*(Uw})pEDs}{6Vo?kb zGf+OEoKUF-pAm}n4!sPnYN$zOl!5eznqL1sE-+ZYm%696Es>0b69Vz_Z=AqH^i{ToraqF%VFk=g-oOSK)*+WShzlMjlKNC{ppDir(ckCaF3NDkiX(SEB<$R@wX~`ISk>@D^xs^ zLIkw?G;id5zZ)fdy;2W7PsN|&ckyy7zRk3MBHuV4WgLCQC(wmp4HuQa=|#V#b!9*9 zsyLeGkBPHdRn6t-fbcc)qH9%rjVZ1+ZTs-mzA4>2%kC4tjkgr<(ma&83-8wI+vITE z@mW3egz)4%O{3R3a6Td`?cByJVgz8_#afKefQkTvs-$@xLf$9G=HLTFR zt})4Nrs`$BKy_c!;WIc*EE8a|pD?c|{rSee#CR7Q?-EmSsUeB)4VoHw{LWKjl6KJjz7YgypCO^<5%kNuFUyX{P}Wae$o|bU3;z+x9TE!`@1T!b9lau zN%|{eeQFMTMtd(yJKLA&nHOv86JvjDqW;#q#EL)Y+hHm$v+YZ5`!d_R)UHSH07q?; zRWG~OmHm?PUREAXAm>~1^m03|hUv;nYvnF+?l*Yczl8ZxF zfNfijhLsDAf>VAC#dbs_YSO;if9uD_yOXm!-QhR#U21~*#UE9%n7ycLjh0?6&i*oeC7rzPW?d_R5S?o^b`g)hyX{qmEdFVvHQ0t6+ zsqro|-dbbN`0?l6a*HjL_%o^8LcQmi!Apbkwf4NWry2d%wv`|J(LLIJReP^ch-O{= zs*b+~t&9c*>UnY~1=?H6?>Fp9;$C73r5eSea4NHgh&NjL3Ut!qO=hn*-W8m0(3R`a zu*Qyy|JuIN)XMW~jNgf?jeWWC{$RW{#{QEf1;Lmnx^+_&;vp$PXRox6$X!LevxtzXCSn z>_`46TCAkdUH)+Ek3?_V(i#}JE!&!XLiy9>t;~lXnwfiOyOh#)U4N1li=Jh<{t3lmwU%jxl37&{-4TSr1m}L-*+x22MfLF z(-i5=>IrM z(R^=|^7YL3`+^}SuX3ZhQWaA)lgBS!(>oa4W4xV7Q$9{+GZ8D#8v9A(J!QNn>C)H} zCjK}O=hB-)UN-h~#(Um)FB!W^-sm^mPv}>9;@Rc*Kc?EQ@oV##+VkH9d@!hmjI8^# z_n2S1YxK;kgFzkR{I#Y*K6s0X-)!tr<$m(M;M7j@{TF_zCaPb2?!V|CxU2cb=?70J zyJJl%+m%1kF`dT2*P^Zm@k#JRGag(HOo9 zIsY5&jnLH6BxCOQM zB9)kn0dAgsib_u?%}ut(Paq}*?c-mR*K7@wqeIO&5^ha2?e1v*ojb<|M9x=*Y3VW6 z`Kmay;SRZTP^39NCea+pq2bL{9AAx6=p5-McKJO87dSpZ&@) zN^*Uuf8Cc~cP?KX_Co+u|CcLBMMJre;<)R{P@`?n9&`;^mzW~}{sZvUHn6QkN{9Wwm;_v1wE z-#-NK(DDNX>uDuVNEHq%KX8Hna?Pyp@9hWXVcD+~gU@cJrF`$)^1XP_;+$4)lf!!M z@A~)s6S*HDth47#qqTF-8z%Dx(1!n~{P0X3ra`CpZRWS)tn!(5LZeYbC;0ean0db? zE-qKiJQ*~@6+yK|>p5UI(QX8wS-+7_kJK~D^{fSoBxuLWgNAvLvh(jZ%niXCb|%W# zf4T14tM|?wjkK2 zbrTtjXlZ$F&vM&K1|%Q7kX!Wrp}z;Op3egD<44xhb25PH2jb$Q`WO6dm~BJo7A!;J z)DtyDQm`=tP=Z=V`c*&r2+BlM=PY*En8W2=q`Y%ZCgDOC*;E~} z;x^^407w=SLxp26NM}G>eMdPPZS|Sk^aySOgeQu>g{}myBPLOTI8H@-#Zpccy(=^4 zv!D}4=_&ds88W;{e@G8+Q`<+NIPWs#>r#A4H@SSN>=O8A{N^awRul(v0G1U2I@b{) zJs{VJr-0`GQmy0*qAFOe*`(E2@y=eZOkW}*`kOX2LgHUL%*VJ;$ei1~lNXLQ{?-}g zhHd}=N)*E#ST!AxL+CwevYiP94ZtTW%x<{BxPE)hy+YBL6`_|gz>7oC>K9T&&ZVz)iii__LHsDuv=rkOTh#8@^ZR9_=D<}C+z0<$YpGV!{(b0m|E1$H!ny-%y_KW@A!VUIA1Fn63G#o?kgLP zG+oH4o%%4l)9Yo`k{M~X#MH~{A3?iztI>m4`4pnb{bld7P3o#1hm%=>f60Jgf0qdk z{)M84w%KII>XFeC(IkKibtqz+FqGyB*)tT$cvzEPiR}&#c6!R&twVzLcz# zm<*#|S}d!6%uo$Y4@#!tVqR<@TOmeah|mm}RQeATttO%@=T2I8BdHC5Tr^-jyN1 z`*v-*tm_=Z?0U>vzk_}DQ2VT*Y*(sNCSGJM%G#eazA4!G_PHcT32h=@HZ{N>j^fwh zncQT3MToe42E*DOT&5Op1O~&O(usgv$c`D>Loh1y^^lGFd?$HVXNR`fKIPaR7s~OG zajwx&j>@MXEqP;KAV2C~2k6I+2my(FX2-TNxga5xv3Sgl^&r`t4-t^*JxY%w$i0V( z5Yzo5@=@v5lhvR;+6h$1?0}A}u>(5N8thA-5w~SZcsedsnOOwQODdbKD*Z5tuG6)l z%bn6!CiS(+M8pq$-s!e(HccGjzGcu$#c(94Sg4Cc4@?cPL zUrW-fx0}4?Y?5r)5mMz{g$Iy#o>RNRNt@Ab*OfLQo=N8mNnt3|YpW!EqG~s5vrXxK zpfpQ*a>B{1Z8k`HHvRW~ll@U6JypU-4^PydVyB@)uM)NbFyv|2#92er`CklgzN z6&w_UeXn}~#x>|HcZ}j`3GX&F{hgJGru&3$aehzFPr2TX^wO!8WMn}$_kG5865mM@ zG;szY=J{*83lyw+Rt?kZLsRpS@jf((k4)@CQ}B<|9|6nNCsC7b|JKHq_=t`DS!(#b zg`j(YIshv}0q8(KtKbEi2uX1NUxn<48(3-0G6?YZ&KdojQ>!{d=v8UlfzVS4=9y|O z)?N+#WCF+;!eG6$yFifE%hv3z>Mj$|uZMdGTKs#(h@6BuzlpvZ>JUSl|ECGv;Y?cY zWLG#%uPf^X6@Sw1MS@fkppg=B4K|!=(4I@L*@NFeo2ve5*S?OUU`ne$*(2|_^H?7L z$Bo3&%k7#KHiB4eg&kgQ7gpHbayz}kPKWCg6@#&J3mIG`j^}$3q&5RT!9CS16uAOx zDBMwp9Eu7;_!VM4KRpjqzhcD_n94g9zuDVQ<@> zu6W1RZ`$NldB;xskq}YT)k4KGCUKgJ%{ta!Zm0M2%hT>}J+}2BZzOKVk;=)Tkwh}$W6mRl_JE{S*+?`Atx#k3 z7LL7WekbfCO+#jSS*VUaY@V!A>ZI~+ba^+Ryffupw7e6phCAg~pOA-*Ij3Gwp}p(% zpxV5yV13A$yfZoJHR8k~f$K(nl*zphShJ1$sFRPkdYKq^j7PG9%an?L6Qs%bwV8%8 zx@bM9oN92|3*ul<4JWh7!dMpS`H~mGH$eQUF(?LmslnU?%!4}m0yQrhx``zz5_7_m zvpb9F%(KX(YDf@dZW-8gB2RO;JuDZws~b`OSd94};)WCZ-7mt1Ve^Hh9Ae3pHL z!E=sJjlRZ$bBKrFlD+|2Mgr(EuR5eqgKr?nR@b`y6FtW@awgij#0>scL;|Vq=?d=U zYKiN}5@!eZBOp4!W=Jegr7X(*0?^UX*UNXv1M;{Pdc)}xyuFe(lCQ|$4@Xs<)lL=M zki379MDh#2$ZPAlX`yA6;dw@%@Hb8izk(>z+8Qc{~dN`(}Ku^M<$4b{mYijsbQkL*(wOtifx}P(_H}pGtMGz_Z z7llTmQH_^S$p&*a?%O_==mjjC!$P6mXnF@XoyP^CT}qB=*$?r!SUoKqs)Tq12Lok4 zC6u@d-bqc@y(3jHYPD7}(t&gIq|w#PuJ(NgF{XW@_>?pRp8bUAABaeB6jS2RDA#s0 zJK+%r$lr)qOGvDz>> zQ0$uNp@-B2OzYJw;H*ur8VN|4O@1QNe5!g+ou;f)RXa;Yo7Y?S@oF-W-1VyaI#?IM zuNLQTne0AB53CFJpp*cU;ORqZAY)>O=Z=c?4fi8KRof69?j+-Lxkh(ub*vr>p(_xS zFkAIv1nnUlX$fYK(5O&o0wn(oAI=RQ!8ich!$cF*rN^Zm!0fqH&RcpYk{dcU-z(EecbCUp zFGg++#h6(RTiw;{hAq)Yl#|HyIt_)8_ia^Q`|R%wW=vbEbxzxB3TLji);&X)tIY1H zJ?8BGn%cwKy={*@%dZ8>=xDfUNe)$HVED0m^ybw{&ygUg3@i8@*eG#w!Lj}|#dL22 zd{9Qu8tY!OTDoE!BUr7&1)^3-}2BUS$Z93S{6>u%|5I!+qb9rCckw>lXE>{U&k-V#OY`g#)LF?~mH9 zPpmzG)IkHt1$O}eI86vM$vbrFcJ17+6L)LaD(81Lfondi>{%}{ zF85%yC)|xJ9=Pa>3qAkab)=S@liHZQ9+zFT{S^ zbZSI&M_Ek9kKjyL@AsKZZNhrvb`^E3W>x8rDZ95f4$o^(Phy_;Gl|N8D+RCG)}LzC z$i+HlGsK)xE;0hF>K@{`zC{5gbb>jthg*G&wMn>EDf5At@S(X_oO?j)Q*Bi^p=wGtT^;l!NK8&*k%xO5H3Q6BR;VhWyny7DVH zWrNjpgB7{n0!4nx675wMh^I@Q<6m5>BbV!4FQ&HMIf8DMcbdpkN%mg&fiO`yMbEv` zzYz|8sh)C*j)O_vHiABo`H}-*YnzNA^2Cseq1;ikacT#CSxwVRl!#d+)7QF&8ZW?w zU(XQC4kAym0XS3KK{x@3PIOoDt3|@UPw)$>H6=O6@4=1M6+P_vo4%Wb!uTlcc^5hk zC^ERQUTfGp+V!A8kX?7JYJ0y-h>nMM5S%Yo6%Klt65Kbsg^!N_w1`~-iEHdw_#l~7>+Rir3z=^WIglN zjusN$4cUZj{F;hQ1^|(D=_;jvXZ6L3kHcRPG<$rY?_>TPPZ(M!nL}_iC;Bz3_jMWf z7VaY`zyk6Z!?+4DNhHM2qC2!xt9qoOkW&z3ly_U!N5S0H>&gX z21v)CkU{S81d4hK0j?2BR^c`4syJ{!rf)h@7zR`3)CKSmYc<54k`FdO`}bE>CgyU5 z$24FVpwgCKBub(AYTn5*nN9<4D1$a=NA8K1Wll{-Lw~Rj&?5nmWm@1Yhjs{OHVQUh zEl~cG7ZD8RV-Gtsh#!awf|;;6tPTFd9eSVg!x>n`y}_!Ghp|)94D|O)_^jC#%>UsM zwJcGq@+|2*{Dwb*P}Qi!tX7!8dYanFe|GxRU7163r~BJZw)xNlc3F3c3$?hCc!DKE z0u${K^H9l5PdH#VpztWdW_az4UHJ%dqfZ+r=)K`?2zV<~Alv$DncmG;+oXbsn}YPg zPLMt*@)J5l9&()(FpWr`a3ofT$vXi+(r7e~UN$ORl)N8A1-}xk_vCzHtoZe4(1S3z z|5A*8mfSECD^e85-CHHXaeDzqNoB_g??Pw7;fhkHAM0&ZqZZ*ewrx?q~*3s*`M z8^owq^h}%+;L1q6&p;UjO`BXsf|yTh4;bk>2dpG}TV4>{PmMCAjjfrbJncE<6^ z&`aPG{nmvY_$`v}Sb|267V_WB96_}P>d_>%-3s0BW?mvBvExOX;qG&l3+#ZItdTt{ z<})^)ut71-1dl7Z(CKg{Q;SgqPDn9qA}yV@KNMqwjD2wjViYxElq;751IX|6F=`^j zOCQrykSmzFyXvXxR&lb;{6h-zofL!-x|I;GK%~B)=O8a9DACncXoW}K3$&5RKRPtb zolZRi&rS@El4=o8m*b^L{PqqqBOQYa_&{}t?k!_Xw0;X=i$>4{m+R04Ugmmww&Oad z{N*j`G%d^mI+?8OS?C@I7$Epy#cT4x*ZH7C6<91;mPt7ii5c}j_y^idhQtYGN22?7 zla-0j=|=ll2b7c0SU!0VkfC1YY5C++@<|_S>U90Rd~zx2n}UOa?CXj2vT%Z}^($Nb zjePs>eA`2uK!C~F@qA)PoT@`RE>@MS*+N4f(F~E@@M)nSrvetJ$3k=&%cwv5xZG1q ziCXR7Ivb%yQz;RFUoU!@kEKK(l}iLj!fJc949AVSAp0(0SqH&7C3MSLVtSJ6+$MlJ z;%P4r?@u6Vxjf>mhrEr@S)u=+1R%^Wq(Lz;p*%%z zRDz7XFImkySj&#nZGt>C2!rGx`yA!WXSg2EC^;NFtZT_9AI_`dwTFS2WIJgH*`z5m0FZ=L~l z?dT!xcn2Ij?r~mf6<6?p)7gu2brr;N{%B&9%KT`2A9GGJQY-)46bqrFY((w z?;hBNdh?*Vs@cA@dCX|wni(+yIr5Rrpk)GSu|TVVSStV@X`=Z@`TS5l3n3>~Geo45uU9ZO{L(iob(8@T zVh$9Y5Swd5eLZRn10=1FPoCxX_VkIyaIG={3#B5F0f@yut5(6UG?Lo}_kw|lhf9bU(E z%Dz;&ZZZ-d5~1dzZ^^(v+4?ZYCCXAD%e)F$6o0-BpDb50riQz+82{o9(Cb6I!Nlv( zzPk^}54Lx=$!O$dcGPy-IH&`?=zNuful1mHNqr!SqBe6qj4YvHmV;p$gfxAEC$JLz z8+1o=yR%SvXR7uJ7G-JPvn-l#jcg9$1y2Y{`B(wz8%(PMVOq^VrD@R^TtL$*R;XQ6 zUt)j2Ypb;?%`9uAv$s9V+aKq#oPI>wxpnf@`d_>>+5Y?a(7pA+ZFq|1C@dei~+Ag3ACdOv29h_m0B&0v0XJ zt0CBI7kir#{5`jCCg&Riby=PEEc@-c6sF;KYHb= zSms)}>l*GVuLrmGNI(DTSq}~g7KmGVt{fSh*xGYPQBJgl%vmVCVwD(Qa!$=_@~PJ& z_$Ea>@^YOAcQ0^21lO6V4j|(DnmwJ}BS{?pI1k_oJ~QCM+w)j#lo{xB7GyhH@8>XF z!+O9DkyM2SBl+j(}Xovqv_I6lCR8!)GnzX*OGYS*WC z)w?-Jy#01Ed)CY}`#DH0{eEfojLbB9f>c-^+}WxN;2C(quL~9FM5}btnIs7D{^Ij$ z1hI|=U!q8;d#1v?{g#rkjfNXxbe14uSK_fYz&_czIV=eRCaDj?gdSv`mX>}>T3WI$ zx@)5waGcef+}j*EP@CMd!ok5)5jmI`G7o||SM_+LI*C6<1#xN7svDBktyLc=jy5Rd z#uo@qh_}N0mUQu-QO5MYq8)%)dbZa>F0ezwd)a3?)?zfmWS7$6QmR*Qo@^I(O|hlW zKi-+*KB6o4_mbm}w&#_M-P?2kCgMdKQ?trfoKm*NsrB+i0(oBPM`!clf|pL~dYiPy zWFp(qi0`AfOZbpzRWgAWB%RLcjco5J3}qQFK{k#gx&y!@69T^N&5n74H6)01T?B@D zVZNuv0KQ}QPkQ#);g=)H;n%KfaV}bhT~mD6kT;aa?+bWs6+9^>nM;+2uiZI1{H1nw z@m_IRaoF19!`--AKksUewezxjVDhK;#t(=TZTvAG0$MNAAk1DJc>Qs0{WI)r4>z0p zmD%Z(NY^zHJAMq|Lge5Kdn`-6$QB~uOi;&6D&d5S1k8n5yshOCXI10~Y-}D(iKRLn zd7>CkCi+L53UTA%ZvHdiY~@&WQSJFp9EHKaW4Ypq+EF)04*mpdsd7Nj#}jHDO1~0U z>)?4)#4f0p?ABNDRUVs26}$ndYgHJZy@7UTG$!hdY}O;qO1xy>?M64bhjRzOMTPPm z>Br;NCvoD12`+wFRnxG}OUfYLJGlwoq^6=YBF=WF_>Fi#G)W%!Sh`qluzAw32hg9p z+dD{zL>SwpOlJenjCI4odk*+4g43+?D=$U1#J-Y5Vd29LU=rL6%{^V`Pw67&f z%wHy!dulhm&W5i>D~Q&c_2OVuSx58ZE3J0M=c1@L3Y$9~dV3T<&{yopy-nnzE9x^X z)h)18O}aT0BC+}zTB6bS7mL&7+Q$Eu6&nf!TEaYiFqm)NM_MvXoTXr>^{dbYl z>be4Z&6~>ly=jS4tX4AZJk%=`daiNl+X}S45Hx)jpb3`sxLB9Tj{zG(#1at#3&5`n z|3OE(!r!V`JUTjtZb^~#<81}RkE6aM!$_vf>WVK_xz_9l3UHtes%TX(b6<~VK952Z zwnocq)+YUl4y2O>DmX~Xo|WNd6M8;XUc8duCdTRHcZnt^NlKJbXgWL???k4xMwUQT8HmY^7)B+A9us@Lkzge#qI zy{3YL?L7x+Ie}&M5ht{r@+4(3T}!gOi`^RWa=ApT3#f)lJxw1`kuoI|5uISf zR}g_OB?B{HAUsw{G^J9+gs@f@igJ7(xRhynCZ5=b0~y|A^8grp)=IQ5d(ik7gE*1S ztR%F*V};l~e2)GMD`4c4vPYbI5ciREu-rY9WDR;Y$qEWrECaS0n?aR1L)8VbC$|X; zFWOAB(kDtIXMU#ljkL<&lfwJr`w1DW!O;SjEEp*)6*`7Uqx;x>PMd>xs`+g`cU)yjWG{ zeq+M@zFC!guS$5~nBGCB{#F$qZ(mfM{YzCmJe9{i1WU;xPIwfodJDg8-4a2mZdDz~ z7!vM{h`UyF-otPgYty$W|Hp8Bq&k#z9Zb;{x^74Iz4*UQvpKFj++dSu=>2466otTW zeUP514-A)LIgWp;`y(@>XqieB*q<~O(3yHx{>0pPyCB?^@O1Z~WES@MatZ9t7!Y%k zIFxdfl@56^o%vWg;-m5iK&$typF;#~V_^v+6Xc>-Oz7*(ASx8qy)I5O0xn56MOYAt z@!emQXxFi% zb?O)A&Oyj`{p|(H!SN_`1molnR_MD-W=Wdjoty3%pwIM(oFjsP`h)11E%SVrWXob_ z_C6`={ptD^yCF-tWW*9spoc?h>_nF@b64vBX$mIznIivR8z79FNRrFA-b-ifc4we{ zq|+*~J~D(KWtPhj{;L&Qlg->JMY~0c#t@!wz7Gc?Mj?e5c(02-u4(5v&og)3OJm?P)7?LoOhs&t(v@pU*V0vWnQu zzd_McQ62?1N>0zQXs3An0zr_*4PPIto1$D7{SMs?1)ZwEGrTF6c{syoAIkXM&SxL{ z$!9AWq3=sc^=Y^MuoW6z?F*xWi``#h5EEd|HYemCM zcKNkgA>LV$gkY>AsRfnxS(STIq`1n%eT>Bx03cmJA=)Bcrq(2K!`~~~@$gH<*y}~1 zI0LmWZ@*hieo~D4zo0nViWAb+UK^eVV*5rch2DiBd|`LWN5z55E3vB!mATnKI!+b( zA%gcv_Kp1Cqtq0Uv3&e0D9X|LV10_xCt7>zaiEbt0Dyos$XTb8ZLC> zAo#fL@R!JLz+EI!d00;i(m`8jem=7@OAD>Y(n2V|wqWdilT`y1)E>e9SHb?4o(toH z6C;1N9~S)X`q_Sz{1&aE7rHCod|$R&$M4UQusY#9m-QaXnxd0WDYklW-u*$d6*ax9 zqlSJ@2w42MY7x^b`1|c(Q|;l|F}yeHJk%51r=-)TPwU{+U~BNZ*`n@qR}bJA-U}uD zUZ97&Mwy|I=V{EWopBwQXWdKM43SEXw4SoeeT8bd%|THa#Q)@}?i_ zCC^oO7L$GR-%7~`p-eLwxlG5Uh0GN>`sMOm&+OSEuAVY!^Rj1cz0wL@?tdR{;Zgbi zV>y|$1Pz*1KYaFLA&I+|7a``#G5Q4E+QaVr0~#$81y8c83Yoj*b9eE%yLw*wS9$4M zKYi(@Lgodz@%eJO-1++B9<|}>o&%qV7ecQV0wVr>4kA7u$2d{6i~>a$JPn=1p}Qtv zIWYNmP)O8W!g3t18&Gb{wOS?ERR}gpSD#?tr$cWPGTY?yUj)svMPFsTDb2D~j|=vP z2K&o==UFa{3{Gt8IWa{}K=n3+LklXT1EV^7Wu6&-Rla4My;C&eVuT~gRPv3XVmt)$ zJsz{t&IOzz8G5LduTMKSrH4a+Mdkaes?li~oykp3^lnFOLWWD~?0x=jvAQ@t?SoW6 zJzvmB$$u04Zd|&38j8I9vDiT8SvvzjayYP`Gch?F=mzBURAl8z%wJNBIM$uQSPN+N z8ikuF((W8yXit+)Pwg~r>ib{Bys4kvbpchUn)H@NgR+Zs; z!Q@kF5H0Uh6o$tjD)eho_CY=>k;a9M>vLWDVv4Rl}==ow#1(7I%30!!*L_3U$5iD_K#n zt}!D+p*=|LaLC|gS5_*!y^6lIac7MEzqER{ z21YWfXS9U1dT0V{_mqF+ScH+>rYggPbcaj(I{Da6@1Q9UzmSW)n)}hB@OCcq5uoC- zL||Y0JU8BbLT$-qKg`*a>)}8J^nok^unHBH=foEKWki5n0x(%LLW**2PqGI?t6T-SV!8ID@-wql=EA+R%fR-*0FAex?`ygu&jR_LN)W`p$V4brO&rH$6@uGoRG2j^r@ z&wYel*}WV?RHclkw61!)g6?~#!e5jfok>OPs?p1f){0_Qhc7YGjreY?MVj!GUSr~` zSsxN)trCBBB5ZL-7#i6Lyq`B!-(U=0Xn?|dQCdb;*ZqHJgrj9u-3x0k7JyCgR5Dp) zRKDPrYj-u-8`jSPB!W#**{D)VARc_MC6Z}cpcLxQEyH|IdJpVOf)s87ZD zMJD3~#d_qHh#rXrX=0Dv=+=OJJ;qF6tuGsm8m)PF)|AagPl1n7nK_GeoE?jcLF4JA z)&?Phn{+|;eCK5=bZ)6k+LAXHL2SRJi2h0!fF%}g^k`>xMX)YiqCw)EU0xu52kjMx zZaz~{B0z+jx{faGhT(rehnAHxSIT$S2jAVSZ|PYRt7L7g44KpI&~^TISreZrGXI|~ zc3?1~i^Cp1N{uM1LCw}}u`5(1hDo6W--_)JRDB;rmo@P|r4Pd*dYsF3DFC92zbL}i zZ7gLTlma{u6kv<~j$AB0_3xHFqvi}J^h9aoGsU#-^=z@pVhd_Z}gDw(^B?mfjayRg)H#dlRf)Bb=CRPGn`9Lxz$OprZge!wEO>^iHu z5`|`@iW+P!b@{7Oua%XQepMyf%cuuy!Mu;L0_f2?wO{mam6>Ig>O3sO@nx0Kj+BRy z_{p%nN>Vhi0KpgOq>B#)9iB$cw3*X;)g-~UBy(pcKXlHdhwZ;D?78VL!ro`$$W!6w zLOwenR~_zyf^lC5r&0K=bajjFbQ&A>E$sJUWl;~<+S6#?8`U30ZF$yg6hFd8@!&>m znW6Ww4s-ru={mc=8s@yNgi3Vzf+5LH*TRw>4vE09p(tBv z6N1>vUlM{ey#o{Ug9__$O}dxiUshz<1sn z3oWSbcV;Q0^9xHICVOp(R=ut?0H@{z!4PDf_|fpd8I!@3>RZajQD8>X68x zL@?9rf|Tq&2~!pBXi?hycV-VH5-JvoQL; zTxfB1W_5{nxvUfqomOqORk~kRmIvM%>ph_PXoro~7}?{s@TrCKm!v`zZ-0#|)1_AE zs+umJD`Qv^*s?1|m>d`7j+bTBse-u$4 zrTIssAW-JZV)&FwVogkRdr`}gJHJwYQ>^@Z(e9Teb|$WS;XuCc<5fl7aaC1dhuyAG zDWLEuG56}kT<<$g+@s8|^lO@>?R=$AkR)YYup&cb*?A44{Rt2&l(hcXf!FBet9lL|?>V@LBzgYL zLu8Mc_~K0Hf?BZ%)g2cXqU#E3H47z9Cu<6wA1SB@c?5ppp~5m;M|AH@Je=$kN#qBYssFy-$$AcHGM1{w3sm%1 ztOxtSz@nDUu2JN`^j~&~dJ<=}n7vc)sexH|p=6b=Q4RVu8O;4ulm5F#oWk)nA&#!Z z?Z`^91jbX8m+O?dU5Q$25B%YVJDZgr;J&UR)pV-01KIu<=EvBr?t!VXZl^mXvsQ)o z7WW~s6~BYB>%p|%GZfkvI?;hcr6Rx>Uz}0)AC#BHC$7%@HVmqvigbi8)1gahGdGga ztz%<#xt}+yJA1HQPw@e9AhDV1d{w{dDhO<>>MI?(rY^G~p8ql$MWp@{6^27l&Ns*( z5W}0|-iCN=W8D6eirl5r;-aU2>r`QniB|#&;-3lu$Ql_eY{5(w#WA(b}!Yw^n`NcT`Tlh zT_8byR>Sz*S|eu9T2^ShW$nY$fi?uiTuE&5u$Lk|9jfQ)lU%O(wogjn+dff+)MehT zp_SgMiHAPudG9&3y!YJNpTGB$y38rH+&jOvOm>&*b9xkt=_QmuA3CEx&=y@=yCbx; zwh1?@h-p|^j9ySwD_Ij6eXEKkv<;O39ehUSd0-bl*=$hya6%pf9^-O~xeIFVef++z zvu;JWW#OVt)u*t#WL=q9g0`s`ThhxQP`k!^yf_fs$fN{v7QA^c`>OERb%o(X@ zv3ly>Q2hu?dGg3glp{Z6{e3xb0NsswjrMDVSn=Of?pT%}-$nOz2=W?%0x_z66S`AY;{6g8V0;u2N3ytbu7M%>UY)2#r5qlWDU9k&qd6k4k4&I5h?0{K$2I1 zt^9$yxE_4aEj``^&l~kCY|dpa^)+Q+Q2Xg7-Jo_c1yvHS^CQIiY&jLr-SRUTl2kW84 z57jr-+7;qgXKyG8v1M>yR}xt9PF-sr`@z0+zUZ48|2@ocf4GxudJu;-I6w3-)a&7A z#ra_@i#t}7%NsL)tfy#q)RzbP=u65WutP^N=B7JrAzv5j(6fy=e0X_NLcMI`AVB(0 z&$B9s6~s5gL=Zxpq+n6esZgmn#Kv?(x#q9_S)O#tcD8E21$LOI1!1Za7?Y9JYP z>)`@~dl*2_4D3N%ACPpx)qYetYxFPaBau;06IVgpTxwB0wBfihORrai2^?1L-<4o! zDA92r0VKe5b+$5Bl3$Fq9_e!j>1MHr+>WYfI<0tjI5fX0v$BB}T+u)aQmy&sqsaHd z0xdOlvZprpL_;4m1xoyL8mY~>jUD^hd&M9Y_BU18@2b={tmUksUsvJdquVh%c^5m` z%N%tvY8=jAah4tf=A^cdL`V!%?@EZ@9&IjWBNJ(ViIeTd_@VQdzsT zx>r!+e_3c9;R1W(l`tK>M}lMnzRb~!2sz&%iMJ0ncWQmTQfCPZ^n3dR)fCA?@YgFn zNOYP~?Eu+uD?chxL4buPnt5PG}1Kl8v{aa zEwTgQ!*>7@)xRCu+#HPducT?dZWIX{2Ozr94)??K?04hd<}_6k=&^ifA5>V?dJ3er zH~(YG>MTb5wF;%|G!O+2!gkpd4-{E{fKbSwzZ#2ebLK-S(+5%}x@(JhGy0~C!mZ{e z6&$R^U*116RrYk?9jVZl&B1WIu!&M$)I=#!;mB~TWH`dVT;T?c&^i}`$gVJ>dB>Y% z@8T8X6+6o)g?A#$0hVdJ0|xX(?5M)2F)sN{2`P_>qJX1F#v%21L?;tt07=d#;_&;P zZyPL|AEBQ722FvvQ9fgmQ=(m{4EhW~Rpj5w*26Vg{P<#cC8wALCOoC8ST}TLFdo)Q zw$>U3e-oo%tQ@90F67iQ+1+uj=TiLSbd~EUSFu{o5T4$ zQ=c2W|DG|5MMflN_j7u|++Wa4VMMGylWcSvzhJ*E4=QsK0>}a-fFP}`Bl}pt(Z3b8 zT11=;uGzaR;tVp=t!o`U4wAj5C39;t#lEFE9=fQ-ENXTaH}}ZapSr;yF327c2iSB^ z-C&0EodK%IMEFUH9Iy*eflYSo2XhasfUBVk+2>)=ciDKl($q#Q|b7hX5$shqzw zdhazN7NeR*9cH4~65y^=T?~yhjt%rD@hxC5LzO%{Tn#}rlCapYR-3)21~SbXM(u?fo!b7B$B7e1Zf`bqE0U*){d*QvdGk<@ND+m|PCS zM1R2J^5@}Rj=w*DF*2|e7}f= z4&C22h!(JQ=ld-vn?7i1a&|&iItlG8`am;8cU5(lhvU1r7SSdJ##Vs{izeL^3jI-; zx!4*mhvP!oR*G`#AOZyj*$b6(wiOD&WlU8MTcL;AGOtNdUJZ(}S#NiQSHKojko^#t zbvN`@TY2my&unGvEo^PViaEnn9pO+E&+Ir)XhTK4jpf)Spv)q92`ND`U9ev{uZqRg z_NI9wibKraOMrOxr_f)N+ClFDGQzzAgwV==4pJ)vio70>`ic4k{S~HPwMLm)x^JAv zWGvl?nsORr=^iKaUR&lLQu6PlVieO_E9L7Dwv6%pC^2zikCVr6J<(X+FlGTN&__fH&9#g{^GWo`6Z#y4rE+YD8 zT6J3`QIrHv;BgQ`9S}ok@-USrqE1iT_w)LS8s6@5i1zgesPLnanK_`Vs zgll-%%j23ZBEnttriO}Mim{OKGE*Y5t3_1kREPQu?j~a9?iJo*v-OIvW}=0@^+Kn$ z2Rdrq@7mr>#A|wYcpk5c;3*J;{@XF+-8S5fm^u89)Zyq5JORh!K|*LuJW?I5s%tNI z`ePCrI}8bXsOkmpO02r9v$GimP|L&dDwqrxw+C%{xOjBoP%>8UrYqbQT}biJ3+M-``-jt!cRi|YS@xROs-B0m_(@VbJo1yzb?-od& z&+9ogaD3S6oa#YtdmZe07JUN2HOLWFutf=?*T4$N!{(I==nSC|7Pf53Y~vG3gC3Fu z@fLanWDL1VrtFx5J0bVDUMw!k3~k6OXv~;nf`#K?5SvxyVuyJR&NjbUNMA(k^#m5_{Y>ak! z6ns~yS%I(04MrWMJ6H?*FkGskME&4j4q%i5)6#(KW9u)Jnjm&ulC~YCTj2puwmKXF zT4(64@ZrvI=K-aEqjyOHwpM0Z)}Xb(-$|ht{#Qq4c{@$Bti4RFwyL*m5r>iazs0r; zra?RQt4p*bROP=wb%(OA!XN7+1v_L;40U93Me?bS4#z~<&w!Kp_wV6osA(mPUixf> zZ*O~zu5uKqHN9rMB0yz%+_s;voj==!2W!+E}1^O<9JJpv>up!B0@lWC)Lkx&J&pH~H1QXe4 z$2ZUpgwEjnf1t;c`Ihiiwt2-~q9h7m`0#g>`UT{)7ruM_851ln=mPL}{!U?j-Ul9J zxEgF)^sxA1mFf*?sLAtS$qcg|U>P}j?Dc&JW&=#nL3=PqJ0;7(a$$-dZW7A!r)SU{zz1q+{1i=sW z{X3anPYB=xdjzt~BGm^+W$JS--t59OCzh!Axj27$xDA{O%{98}JjD!5pN{6Ly{Dy4 z!xJ9-*O;fgUXeDdHQf@^Lvf-AUt^H}xFcg*Boz|Wq0b%!0qC=(PJ+5x#qROMm*d8fZf7T;@JQsk3siq*k>g9;Ab9lyHR5%QJ+PlM-) zz|m$H9o6hz9{&#~&-hO#ZG1@J}ZpGHLE^`Pto<{rn@Z+CRJFNkK-P z%A;*RyYNah^tCl4()X|w3r7FRxsSE`sn#D^)=LgZe6iRf)wo!Bi&SQ@;<(yBb{8x2 z7T!$tt@bL282Phr)NV&gw=C9$zZrL{(bqWEg(R5#FVDY2yfPpbTtmV1q*@3O3S z|N9p&v-skH_DzDM{;qN_f~G}pHtuakzu{QR8NB}2di}@JUW3cipaH2fjl0~Mfw+ms z1QIkhG3?ZB5RHj;O7TiG{H2OtrWV=m*(6zZtc#;4u>bE?m~Ri(o!6@T+ZI3{`YP8t z=f97iSE(8J;9z#*gPHOY+pN@=R`@R{CEGX;^(4bHWeLB8`prXn-OY!J9*9ZKe&6ao z+XmZ0?}i{NDxNgTp%Hl8qabQj*IMprR;oDOjgdx+wV0(brH=$Lt|C(Ry|(9Du?-N0 zikmF&Mym}KgQxp^t*4!3cQ0@%@)a;BHSh}6k?A^nhih(*C;w&Zeki-h0`q@Y{tJ5y zakM9%;&gv%m)w1_6@Rk4`_bKy=0H`);_wJ1rSG%y@Ra^}FXv^wMDlUVe%4AnV^!<= z$1GeFVGw##o)N6ocGCNkB|iq-V-@Cj1cTM>;*GPN`tfPhiu;d=5xx*5F+&T>MRXT$ zQj7ea>`kfphcoGAkm%{e3UoPxcth_sepuH)dFyj#;w@YlRlabu?mo?Ghp?bQQ;_n4 zT_KQTMTbx~k9-_fHZ~pV*>0V!tda29?OExIVbxv*ubLkIBdDEJXua~TR6ysiSFV%9 z-T4}oxw3qP1x*StU8=DXxQV5PFg)zD&T7(O_|5sBhwutB$aJ#8fs!fJ7+)^!r>cS~ zOj>KY&o)vHzd~o3?mJE5ZZv`arF(9IR*gaUiZ7>Giug52soECnX?L6M+kooet+$%) zRV+vq#5ymHdf&hc*I$Tp1YqGVx_l_)|K0gt%1D0FFKPMBEwt+@csak;-CyI-RL;Us z_a|-N;SXnj7~2wT=U2j(wPUdK&*!Fli_YMjIJMnxTh-SuYZq_4#i}^cK5F7`QLKn< z=3%Y&(pSsoQN?DfY~UDve1yrr$iS=A_sMzqi@hY&b1#xXvhkm~P7t9aC~bc@?shc3 zgRy#?>TtORdGY&d4!*Y8d?=@`j=~Y*?1h~2JM>J%wba2M`$ypu@myM_;&sl+kqQpd zzs||;{AH>rKP&T2qrGFboT?efGo=SrB3S zyxytNdTMLO(2`TwagiEPJ$i|%o~>u?3%A(s;GABeesxgyIjVWkp(BS)9x!^Kyrkal zJVHu)I_7tNwE3*8{pwQ~hVm8+YuiW3E;_G3IJJ7RzO`|@gk=Ttb6GEZaCoR2LEy6I3PR&)C{CCZ!5mq*Xs9(+A#d40L zrt40LxG1dt!{zV^DHm z3#{Gx&G2?RN6nbl-97#-wFj!OnR;&v!Qp2uJ@W;%XZOsr)Esa2|I8UQyOZ3Gi8(vY zzCq3T#q8Ssn)mhQ_S%1qn!Ee{-rSPfb6;=2QswSry>T_xq*3u-JfIHv)$ob9u-M%L zHrxFNbb9?qcNPvZ2WAd>P<73+x~=ZkJ_mRFjMFr~Jn66p)uD$T-2KagYP)L^NA&%9 z6C8e_I{Gd(Z`u*vhaXz(R=wvS2JSmML3|Z72Gh0o9qUQqPa=vOl8JTFQ z8d2UIy+i>tdb*D*gX+1!18E+&(Ox>FMzKl8oFcgf6JG={LQQ>qbo>L_aMk22AVP>< z4$io~&^6zzHh~@e<(`8j_z6(M2cw})Ky?*i%n`)HsZ`uFp$~4LA2XJXX%Khn7Ow_S zB+Dab)vk?RjfB4?dxcxz2ZbewIHb}IN5au~ti(U~ww71xrH4o3m;gDdX#rFR3`w}n zg11{xi!inD^k@t4WB^cVnag7>M0}pH$J1uAeEmhE4w}O1Lo8r}-iG#6TJ~j)XEV0b zXB7U1D3Mu^*meqZPK}u)0YG8vOmtG`N2cFE<$b|@Owg(O%f5HWL&I?i$=yqM%BXp@ zhdGCa;R7p+7r9I??vCC4+RL8lNl0aH6uPRLX;jz7dmM1%K%!N)zIMO2l@l% z381iewK`R0oWgwMeCHITUtuOtfy`Il$+6!BLq%*=QlSwTf7;9ABx@B=Pn^O>vNV4R zmkP|&GD7?ajcq+qLnn&S4CC1WvabtyQ~Ws}LsTyCfU91yLU)CG>qBQPk%*X^3ud=2R6r=(P(c-mJ@rh&w6 zRn%7oBYX-2@+5t)xLys1C}l*s(hRQ21K7u{e^Q09u;;?G{JUH$lp2A)H|*?>_TWHX z{!qA8$cj6kyq(19-0fsv!MLU~xsRw%N5SSwV=aur{p z_FJwF4sBJXyOp;|0j-|dq%33qS+#Cb@q5*No78ToBmKI7Pws0CPcr?~2-6?sCl@3S z-zui4>&jD1~;oQM};oJ zNW#!d8dnPK&et!Pz!UHey+n@+nJcW{<^Ol+ars}rX@#zFDxAOKD$JX3$`#WJf=B^P ze%>i*dyjlRjyk8Ns9;~1uH&FNs-SzYAwR7Mt zuCQ=38j96`!pc0FyIJkexH~#GZ)V6q&>my>WO2M6M44PY%?ZbI*39w*+7qUOt#HPMdoOY(u5emzb-mkM_jX5}WG6BzwI1xiid&rtw>jQ&$6f&< zGEV)<=C~novUjJeE_BptWhWwvgyVBhS5@nns%|pcvK|R37^nJp$%Q0h(3WFewq~l<9Lp<5P1JY=JAhS&V=a;Gfxe1$oo3l9It0j7m?!N`zcrDrVLG*bpYL z7h7`;F^H2n7N}1&+|~Fs6&e0MVBT0gMWc&?c8qh*RPqW?2dxVjS9eLWuXf51tQ(uu zjnFqA8@jcSn-e2Zw?4)@cGT?1oa{07v6}zlF}dm9uGRdH0ACHii$`_tO*^*5w%)Y$ zO`f*_J$Z*tziLNbv9s5C_O+h&w;+q$;N>=W-ZdCqOIORDbsf)@ob7}$X-KW`rl&zd zp&{ls`XD{T<#a2;i@)TuTnem17R5E1T-1^|)Em{J;waP8U7@FHdYWw$`G*sFgl~gL znyh496^`u)^v0|`qZw0Ci*pIw=Q8#HQ%;kxNev7-?>sv==;_uMf6}e^Gh*FZ9In#| zu*c(IvxrVB5;>HaIvTS!eM(xTfq+|)fwMi5%qFTTr5~~DjQgP%gGHBsof>+vig28A zFSZl$HH~9&y*c;az38vZyW@<0pCyxGJkBT*z#kJbLfnUN7=$o~73#vjv(Xi1H zc<>E*uHgowH2DkaxY7n#0g9OL`Bvo`D|(^TbP+l;Vz>EEx-(*7$7YR4qc(swiB*Ev z(Wj;}+Zpc+^Ov0beYkdUxYyYPDB=Smx9EMGjuCMMOIp_o4XAC;Sm~Nm#mM1@M9Mf= zitHs>ml(yB`U-G`FnsN#A2Rr=)ZltIfY;1o_|@QYljQb#I*-XiT+;JQVVv|^bWbPU3@RJ6F-*<}c#z`V zWZTWmxl=8#(v5;IeX0Z2GA+L*R!)zVlC11xXO0$1(MnmkXf-$k=;lUsyV}6$q~qX4 zKZ;h-j$j8s=3Trr4B?N}mgUtOM_lfO7@(fKMn>Vc6c4D)?`Wt)Xh2~w zAUe~{BHT`FE)K;-sE;-j`$as{2nsLPaX=<@Pb&Gh zsLvOa9&v3#a`nTm_q^MrcaOE0Qhn7a#{Iy`A&KGT=SA?w3#S1|>STQRw2va_&hpeG-vt(`scHTol@u zllbn{4P?6k)bp}UzLM163hl+=I5U~kqM$7*hLU#ACL<`i+leDcCYuuWwN%RksqFo! z)_YRfKO@i6KJKvgc5Cmk(cRYGVf#&TZmk8LLSL(+vwtF@WU|^CXH+A*76NTOMlTao zd>&`&yV@LxIoNRoTxmU*@CTT96lrm2UH9u`3mo{ZsVwQ_L6OBg_@u{(BMvTfYhchx zwe_Ofx>wdPEncK*J7Tmbfg_|FS(TZjr>9$p-%dv@*`{(pif2g4bdb(xTF6)1_zlm$ z7y#eE$jA&Nb`M9rNUP&bFZ6;7yy!v?Y?x@AqUU@nz#kd`K*tVjo{PW~_NskhY+NkC zC7tj~+~5Myew=rMWXo5ZNIgJDifZN&e{kUdUvoy0tX!t`MDGL(;oKndvhQ4!kp$%i zwL+~)dAFwQjVXIus!w}&ri!{zbOcTc07 ztJFAFJi2Kmx(x`C)78KVru7z8hbeM}>UZAdp;_=>z1)FN0o>@b0R4sJ_#s5YbwSX8 zU(^jYVu%SfgzJ@Uld82Ju%hZOVaE&sllLoSpqh#KGoX_>t8*RS0HWhP8&c{JSFe65iE9XqflG- zyrclw-QAE+yc3ecIS zGvT8d`(TFDT~B1lFRsIDGtqS!V48sG+Mdk~KA-a%O84jNuW}6E&t|MGu7?yOe&_2A zT@@P9ea)A_j{v#r31gA>0p${3Spw~VN%<^8a;A6Z*&iHkU-rh51x6vo5u2o@GT37j z9|T?xO}5C>@!M`vZ^iT!Okb0LU!A8a=c~+l>NY|!^LdZ_eOj%{+b8msU*t1S%`5b7n(bZ7JzpNIr>1BWX7_N|fmIc-C3( zZ4B3W)bs`~_mnr)F@M&lsLt*yRqH9i$*EK9$%I*`wo@u651vvw87$!Q1yYGHcF{(A zrrT+Kc_VET)5Q}Zx0@1BZblM8lpcQ2rvgL<)EGf9_vr&cGM zr!8YB>UbYwZ3=4o>4Xh5k;=>2K^Xf04jiXM)V7uFRJI7(ycc zYjx@;O$;YQ$41AfV_S|1S-+;7F_;h$CPFW~)eUcUJ!SkT3pHMSSQpg~@LdG!-+ST@T8n_-9luke^|m2q{M7W zrQubo6qxvPyvc>Y#AtnPZQ@A8lZJfmMfD4*!KH7gB}@rZ7Zi6+vUD%V?d&gT-g$6A z{mx~Q9OZSf-YcYER>j{d8~LxP;+v}bk1F@J^8cusH>tt*RsAc9(6s8e{ASH!b`;p6 zGvlNYc~}&_1YXdZUecs6GbLHN`IJKCPGpWdXnd7ZB!a}AuuAQ^QbxuhVX8#%8HGT} z%spzA9<@>f${vT|sUWFWst4qfSjA%U5KXn2zDo#fJwy6{tmq0@=TM7*Bh->cb-1I< z2nXa~GGyY7wy{?!|Ccg(%JmpTQ0S^%;bD*Fo^_J1dCtTpjFt!DL^{~(vq|({2q^YxUNlRz*(zedlgF8CgmvnaG z`0VUDw5N0AlD^K~C9qE~8Php>DcN)m-llWxlJTA6mQ3uNaOmXDN#Cj!`LxYN?XDGf zxY#59n_R4<^x{qW1M{Br;^nUQnONa&vSg~LKvR0JwB{^Y zN{&L8OQP79T;cbV8ZI~Yr`Xckc;7wAK()5ty zv6#ufLi=|rGy5KH#altESLATSC#o}Rso^u99o~3icw@ux#=q~m(XU;;xVBzUTR%8_&4a48XT|WI zuhn+k?bbF%JOu^2d7#(13kyr1$z7=2qyqGQy29Zyfu%F)UW$;`9N1H?bI4A>vqjtjRe>>s(y0CbwJN)|z z-_wP?GYq5u@ebGP!tVd;9ah7f@W0;SN?q8=otvDOL>$;5nD4e=wmBl0H`o!h2OR-h z0ehP|@<*AYg)z(=*EuIKvp6f%U+)MGLq?dDXz}Vz!7eki#!WPZ)G|r9WM_@)C>-V= zoGH|;5WK2SX}dw~WF~y7N}qsw-qrL5w&&lgeOjS12LV|u0}ROx0dV7OXyZjU z9R&L(_s7R~XyPg6i!z3hTGM}Cg~z9s`uVkf86t^ zA{1}FIt&jVC-0<=)*lNwgWP$oMB$*E-Kor-T0g0{vHq3T&#*oG`v)O9E}W;zzt*Kb zP#5FKPSEFFs`4Kz{i!Z|r0qk>8zH(}vuSgG*<%p*AM0HHkg}gVh&*`Pca_~xXJ5+L zt8Y{G-IKzh?&tNYNzp$>OcDVaMON&Pz;IYPm8&KMvTK#>npE9oSEwXjt^#&U-0bnb z{;-g}Qg)5rvMW_6#%FD{D_5vz6#H*yl?qM&dR9ZB?O)GoE`YX3c3!M7ez>aK9(2~8 z&6c>Pn^eBtbTqej_9R9Yd(Nh?U8x?7|Cn=Zm+2V?W+c^>>lvjAU4D0`DfikA21RZA zPa9JjeWBXsU*CG*Aw51ht~5TO=S&F4r^e+b+6kFabNcmUjDk~gQ>PW&E^jIXN7i=P z4!l~M|NL-BO;1iMPfzIi+qQ2PZ96HRG1lvI%sQDdHt0-kU8t>TdrRT`vChRVW+GDc zj9!@3C;nNo9{)^Ry4W+C3HAUFB&At0;h^AYZP>%MeNAn3M(05|)UIbh*P9*KC7iSdqd|^0!^B#BGfWzNba)rsoxGQEBi^e_1KJ^euT}bfccr}7 zkj|`@_xhfZbZFmJ^}N{U;+Z~o2@^Q4b)_0hBDEV`^If^mm1^KJRfb>&^V{%i8TW1~ zbIW)J{=am$Yj1F);a6h%Z_snpfuv)szS0UPWf8ZBU+EJfL4WP8xl9R$B|nvB}s$k8>1FD zPCLTH=W6wEk*(E(x0>{XW|MWUGnHSf9;t_o)sf*P75tWdNeI_VY7icG+K?!w3?nb8 z?%$&a_mUVZ@_dH-V%bfh0Z0@Wc}|jkfUZEAEJ&QN<5NWh*JwZI){}Y7k_=H~B*K@9 zdUtg!7`}S_7a?q57$n^J0j+TXdp@UC_;v&=JGa@P+te(npBoh?2UvavapZQZKO;y} zA#2qRYmn&6PH?OM0Bn8#{uSK_F24b1|#6Q(++vO9u&2qKRX@FJEgCQGmN&?zZGUo^i z8R`x`6jWbcquW73T9fd)M@Q2K2@Un?g^i>DdRj(eOnYRpqb(%75xlvG_;(TfBFVJk zY2^+fz}|*YI#JbChZNfRSnxf))#7}htL2zhUEQTlBjDp2>)hhzDN$z|Db$k^fDPL* zmZ!#a6E79w7V`6?QXrQMrnV{cP3Rz-r$$qxQ8!GCCh)Zh7V#Dc`d0!89VXIR?hubdu3)TJDDxyJmz_yR9z71rgaV*FL{f0)rgr<=Lf&)68Px^=p zNGN`hrOTF3pC?x0-U)i0MjW0C%-+OWF|QgNy8jtqS5e-3J>h`x&;3g^?@SMZSAD%7sJS+n>Qr zXmNV@Vu_qhFrz8vHf8bC*V@tZSSMp&^WmU+tP9SFL6qsxvrOs1EVmnJe6&Kj`sB$50y&!zbUehq51{ zCLsXARu&_7iC{c{Udl;%v(&u<44unIxYgXSf*^9|E|h$vo@EMi90rFOm+I|Rrr8O8 zs-0JC{>LsM4Uf6%5gtw0DOBni1~F>u3D^9B$%BLkI(*cH`H!5k_FnnL+4V!$K7ieT z=@{hASZF}J9AWX&8oJe?`b0{YLr=tt36tq$J)b#>!+CH|p>W63la_R^M=) z;te~T;4jL##LNFx-VmYmqknxv8nV1!8g?=Jw(Gs+@=JObi5srI$zj|*&KZA=!aJHE zgMIuCzfr^Qz(kCKOB!ye*j0qnt&|oqgm~IenF+_FYKnU;p_oH_j_a1~C`+bAZLL1{*?N|nAaZ%7rMn`Q5rrb)J=gi&4-ov0B zz-e(BKnLQ;b1b1(f)r6|2w}HLAHigLILmSPxv(|?b8fOk3EU4^F+H2YiaJmBXe>!!j-GDuYdzCogEX}=BzKU^gvhMdRzszl!P~bySpJX~ea5!~v3oMAS#knX< z=@05lCX;>SRGIu_Y(vhW#SMXX5y%8NdOK@th9C-bmg~Ig=W+T|7)HLhI5-nC_&9_A zvi1W@j{@$yxo~6&-nwwVv+j%5{T+qtZuTT^m=umsgQdfT`zlfC2$0A$c!W8gCrI`C zT0(f=qM)pB(^#Yzl&>wNU9L_&jk2y%J6Bgfl8FEbWQ{Ai7~?)Ljy@p0!NbDX8Lv|w zIZ7(J5%NNoZ{nC7Su4*t2AMXN2?#u>Ys4J$64?1VHM-;1rP2spcK<4+ihY&noi%~( zMo%`jb%Liu=ZT<0_pR~FJ)XJ~DM0!aCc)$zp z_uQMj(ckmzO$_2-B!UVdz)HD}d$*SX&ufNffIC2AWcq6&;ofQmAZ4VxFYw~ikO*;tcQA@h z0`OS}fT|m-ZY(CgCuBdE=k<>jAUJc7J|N^49YmW#gqqZUVCY;B&k6!*mf+w;c&Zbu zUBpJKe(A=x;#uxjVoFwKPp^q(EOE_ZO%Rc41&-=l1e&R{rLNtu9!tC!RNQecdib^=tD>f%u7QE#r zH~H!v9wa&U2&a16mxu7-q(P*0GC_X&SNz~*Kk^(SGKcHYpGJ^Qv}s&G1W7QSNbgHS zW`j#Yb9LwrAq)mlX{Njf;=$@Ld0m*hHni7;!Rjz$g3I7&4=x8aR_#P~2)THFP?g1* zg;@m_r1PDVuLZ$cSav5PD+Pqug|~;nUxHw}4wG8wAC%T@H2eVATZ)Pcypch^-PT2Z zGQkWunt?t6>%6ry*~(aduqCyv>B-I}&lzp^R)2tB+ShD`g^r++87GICa=*sK!C2b_ zK|;L8ABiPP@KHYoISU|{MC+B$n|RV&Q5ORj^T$t|g|x`nD0hnz*WY`g8gRE`mBNpto!N zbFIIsZ*}!fV2tf`I=J2yf-tqe`b2w&>W_36#q2WOZZq!Ohfq&eb`9OD?0RE2dUlNq zZG5!O*q=|c?=Q4h-Jp`6Jf-aKi9h+_eVF5pw%^|0f6xDpzIcPO*FUYMV8s_!2GLSx zgU=s{TV7~Y#Fl!S9GD*uNxR1yY#09rNDy=5`97iE5|vSTv-lc|K|&DdfC?Zd5w;O1 zNVk9h2P6#(+Wj5)*1e>N9!T~l-gVPSSmtKYQ1>Oxoy$6r`lrUHbGph0xhpk4yjpG- zu&p_A#s&GhTq-|3w?U3BVOb~aW&kj{dQDh_8UIW zUqymhlZUXgI1++GW(>WIC%9f1Mk!qW4ah9j`FU^V+nxFT4a@|)F%z5t4UT~DW)Ri# z0}|DUtGXrRWYDurvg=*kmU>$N6Xq`!dtJhQdQ$j^XMJ#)=SMbdH?1zQQb-k^wayhO2}prr`VWzLGjiXE?3&4mo-D* z@ci~_w1o1wO!uB|-igAG@ky$GME2vzeiTtu)_*6h{pR!k76CbH(`O{i*$H(PT3{Xy zn$1VsMWzwBiEx5!Ez@`xC!*#A(F?IG^Ev8ArqG3~XR;I#ZMLZ@jT6*+F*bP44i4|FoV`JMZq{3qKm(m|eT&(D05~vI7>M zn^TpRhKK5$zoj~x;EvF9Dt-}+nI2$3H?7%D+ZyeHjYmuHpwY#hcHF^4$;2o+0I(@D z6+^|$O8C6aKBw)z!9I;%un5|ev5irey%Yd=bv%hKvQ z>FPY!EYibO>C~cZoqamJd9J&-y62~9_uO>w&2;kIblz*Fus}BaR5aRTiCTGGmAh;- zSM%Rf@qYz-b2@ojTKynRUO&^nrBU9Rp5|pHvkji7PP z%vjhCrl*3!-l-)8o@n)s=Sk6v3wwT`89l@@iSMWf4ZN&>Exx0xLj~j6ld_3!OCE0! zy&w6ge=7_>zY#_7ADY1lo8yhj{29$3^wwT3R%B*_?bRDrEJ)`nbAY?2+09*OmZ-^q z`cZTM>rEwxL7n|X*`?_(rEYQ4C#TwiCE-^%n(Yn8*+VTQ656$&cf#1zaYMBVcp&QUGSfR(qrE@D{Pi)RDB9){|grkM*CcLOYkMzt;>@SvYQ-;1+V{rI3YD zprU9JG>XT&p9{Q9mLQgR2qEZtJ9_>MbTlMr3GyAwu!|GSs*toqcI2%Dr3D2^lgw9V2&Y{u)(%q6{3?uj%jkGVweFXmq{@Y zi2(PCkhw6>FEF3ic){2!CZvtkF?xgg&M>;|G^$yES?St(lUv*9tgTO~tyd2Netb4}i1Zh5dp z176gL#h5CWxrYYJVAb&4=?N0Z=i%Y-C*aN}uXkD7R+wtAI!cq{KQwl>XBEZylfpPRBZ@WakK(0^H9A5R(JPV?H#3-m^KR> z?el65h(j)}008<2y5`S5X(JOe2d=Xm^6UtaB!Gfr2QtJ9~UW zkP}`?)n!xDQ|;TVN_NMT%%V>>G}r8 zD3JqX?@o^*m(~D-H8Q*iUX3+F#2RtA?28m}sch6EbdRW7BHmEuNyV6`vsH|wb)UvV z_ox{uv&&9u2ZhhJ8c$c??(dP2Nd7>;}5Cn~RzlOnoDai^cEq(9{a_0^q&_Po%;ozKle4I7TW2m&2= zj_{<5^(abv=@H4XKCCY|^^(aQJqFIWvL6u>Bg~ZX=&}z}BY{%;V9I|?YMOKENOkgw zOZ>~rnmA?W6MNm1ch%FA+5EMpPcVS0#+Y<5;qD1u^jl=JM%PLBk5;vk!S(^Z$Bbh9 zdo;gTw@4aySACo0lcCL)k&_MqkQ*1~>y)KjH5B#16TH889GggDdCjnjGk6+zTc!4^ zu6AU#gA=UP&a3qVcQO9Ac-@T9P*w!nXXaJ!xly5sj&Pi>f-UQJ+1X^~xldMaxL!@b zCoe&VH^lLIZ0uCqQLe4Mr_?+rI7e0L8$Q#{@`g47km^-mP`cjMf7ga2WN%bNn(IU9 zmC0aQ20EKU?a6B-wFCor{CLvVd==>c*NP_`iLGYOIEmJ??gyh5IIym9Q|>P(K-A4tQPOn-h93ButDo;l8rFOCH=M1-22A&C$8z>SNv9ow;1e=t+KrNnp0s!^%K z#$zC`&FKR(!c|))=&S*b;<`-K)bI7C)%%rTDRby5@^LjnsgtU+dJucvU~A1re^xE_ zqs|TKxxH5oC?!fz?_)zE-L4+1kdDwRO3+K1=<}j^P89 z&!mB#A319qJ8)>#GohE@%X(K zK^kHkvZ}aU;x-Q#?{ckAK+oTqRy>g$&^rYVPGwz_gUL9|yPu!!xzLu+!eM zgZ*y(ZZ*63tLPJycu2?TWdMGhEdR5P|KDo=@bSAqRmUe3R-+LF?*wgG;?%v?yNvU* zrVhRB_bcYs3eeH-^RwBYep3a?;j;Z{#r~{fe_pAX)Q94|(SsG2t<@DX#3jwv5Lzqd z9@F7A8ZTjT(Bfdi)SWaQzwAC(u@6u_? zRuTaQ3hcyiu;O#I=%9AVJlQTY|3eBY*7Lh8+@Hi8JY|{v!I8wY4{A|jdzG2&1SdGJ zGwApd#^Zyx6SwR(;8hW8n(&&jr(h0%fEh_8czn`$P5iJOq=Pio_cYX2Mqd0)b^ zufSM+3DW!_%fE!kyTG}y?SHydKI+nQ)Dm9k#LNjiNhYN@R+sglr@BP z1(&+c`nEdVU9^P`-Xo$JVWLRRh_?|W*v3eQRG9(+l0$?>_ew;Z4WnWTL$N&iMbSo~ zmp;uLh;TVk$Or29wxm0j_Zm_Uy7I^g_$bL%%UkV8$`>#Ye$-}L33k-jSn?kI9gz=V zHc^WA=b0g*X|*#m@mb_GoNR`5IfBMrBqi&j|u& zRYxF~?aO5#wN7*{k*mmZN^dt6R4%4{A~c-Eh96^&Wosi@*`-=%JXp0d1awTg=R&61 z?b}ie%C_|m<=oIw2j@>AEWFl|db35p++ts8u>jE0sGy7SMJ5t8Aply2itb`A08+85 z!H1g=8KBPKMR#6Q-<{IuINKv!NDL9TjR&9Ws|reYD-Ry@2Y7J4tu1~qygEPX$p5{i z?Vm0BuPye&>Lc~RW+1FRPQ=i;)u)Y@phRC7|1q|@K!=={)FqR<`B(HBBu;rIcTD#> zpC>Pff)7&hT&0sOTjbYU7ZN*F{sOwZ7ExkT7V5ia>!u(iw zy4y=`cda{__jRy+Lwp{9x0_YzPb&3CmAOSQ-x$yRo|@i8=EYdo`aqeJ_(JT>n-hSq z#}y#t(gy12WJ4Qj)^4QcG3eDE_V@-9g*L3m zg=12^sg_g%@S_f<3bHSWpaWGlT9@`ioUL?~R#Cpl-(pjw8^D3QJtM0O5@)!4p|sE!^s-8)Mnu^JG0KC*XoSJ&0+NgmdAZ7b1s3fw9161Au%pD9DG;D{ zW;zF&;{&7P0}|tG<%%#nh423i@Pn?ECRoMLA-*dSt_vEsllrMnec(plF^S7e^pTFq zVKS<*KKhGm{;KmIYQP8KhwxqM%ZaUtEFd|O$OhT|=H$!TyrPRJW%1$#pUW8H@w_TIUSHE zol1A3Hc^=q}#Q^+2$LZfgT5k9Gs z6ZO%0Vvc)(GVlXQwG}jJ}iVrfsaqx1L3yTHI*yZ-c(1TU^s}d{oeD|UJ z@B3EgTb%U#a;20cht8Mdb-K2WN?)z*-=H{no~j=Yf(nk)`eW+k>{D5`W0|q} zw2CaDGMVI1{g5B%SDZg~MY>)#5` z6aRnCpb}b~k1>#qG;Tt@s48!&gsh`C)!~ye)7^~hds`)Boqk&#J}ooDEyzA1#AO|A zQipG!n*%2=`~IR5vX1_u4xgQw-?&3&LF3N(MeYdMw_Nux%)GP3uH-qMYsP;7oyt^pGT();;y%5^VuV}oQ?1z3{Y+H+0CzL?)rnx=hdBI z+>IvKKV-dimyWjFo%7eJhupUJhu`!AlYQST{lN6^pNo8hjg8<%7b zbtlQYU#$C=RR@K>|8QNkj6d8`#zRxfDBtjqLqFg0KGh+o`u6fxQ~t-g8h)GVo$uUo z=lHGv)4TuQo&BG_SM{#{r(bGIE&RW`U-7%prNlrEm~>?%EdnTFB*pZPo)`Z!CjMs+ zq)~?8>XBVI@`%DF^ofeks~y7gY)DDiAe_JBM~x061p@t~He&1dPhS?-N0_fJ*7W9E4M7=91`SpP+ppIbNA*x-;0C**_;U+nvYO4*feNcMKP7nW6enCQI1M z?vczZCeaS0B%nwGsjT>K2*M1oM$4hn$ofQGK(3sDx@@_*lr00qVE2f+Zg;<6eAw-F z1r)NcE8AHbk?mZk_GvpPF4KY8gO(oHzm#}J!jELid4~LQRZ#*4MAAL+>YAv2VQqbLZ9NZ3p1>3DzpbL`e+|{uLDf|Yu_@U@ z+jJ|rnp*#aT;1Bh#;dArR%=UJsdc0SItap^q-Vx>t$}X-f<7ra&Obg49F@d3K6~|u zY0>oEbWj&zUF9q6ow?u%J|+a@x@wv)oUJBkt+Z#O)d2)sr&>>5@wt=@5v z?jIXA*X)?W5GEZEclUJtcMWoWTorQsymFh&8Mur#7`mC`9E$!2A(8qMjzP&pKRqDm3XTa7r|V6 zj-SV&*vvyBJ=;U8&$m*Ts+0yuI~DS#X!at&3$^%h6oz8g=^?(N_9UkiMkZI3#n;u) z6w&2)?G_Mh7T+L|H9ST>-;laj*USzHF*{_>ah;3dtR}IO%6KC+%AMX3WlbD=A_GRu>OUzVfBA)8)r=O!7QWnt+-CIVTagBk zdsxn@B6C&)PN(5)a>v)!w+!z%cNjfWS37dy@Q$#y<8E8qxM>*PQ?BiJ$kaAI7(SAH zkASQEng*u@?}q1flMk{JPw-$+dRB*i_Lby);zh8xYczI#?+kF0c01N8L-lQK; z;ZKPrCy|6ZnlQ|MVxZB|s2o=v!~fkNQG8IMu)wG1B0OP2C$xpPV=fH zX}n+jGJr)AV|!PNoS>j$5+u6{b1k zK-T@L9VgE;+;i0kp$4Eek@US2#I4lj&h)+}ltQEi*q#t4{hZQYOw3BZr&GISdnAb% z9%z7e3|E*>j%>_YN?I{>?zKLH^fOo=E>7KbvHCD^`^BouagL%U>tao)jBQ~l@DaXB zh&3R@?i6~Thkg=Ib|*fAB8+twHv4;VNrr9FDd9(&9OH@P$qDR~RyB&@XhMuG&`BJm zI$2Dl9g{phb(}ul_flU#*(L)Ml1gm9DXO$wP^eu%92u;O$@4q>^DsdR`>}78he>++yBpzPv+U(NVlyZgQ~15*TwbTO0e?OkztUJFMJ^5oGWO zY9J0BsFMhTLFXg}nodkGSYQUtn0_eLhM7R%B%FY!DCITOGB3%%8RwpM1*3<*iWB!@_u?qgK{P-8Pv4po>ux;CRL4O@!eesMEwuwzh5*-Vj zU>ge{OdRS&-yIX_y}0ft$}*B&pn_vyMNQaa?J?cQGI$fXf#3GD?uL}^qMapqUj3=| z>oYcA@#WyO_yY0fbn}C(V-Wz(SBR1cAg^=;dME8f*PmkZ_M2+UrN;&5k$BJU3!hbY z(vxfLLY&xMRDi6|81oiiy#7zh{!z*6RSTF3*qih=s^~4%`!@OOxd?ngi?AuQm4t&Z|?UXmC@f{J$9diSZe9V zpS<<{g<0JppJ3O-t>Wsb58hD0n@XPlfdb6PJHxtYTCdjbHH_mU#s+i1lymeBZEx4^ zO#(NVz2zEcy$;#(-!Ywu{E zOZ!L|d#5FrjBudO8N>oU&{eM8${A3An5Y2lOhXCWt# zVf-P*I3Ko0HxL2Zt-eUd5-QAq(O*QHHg%th*~zgk5_fA!Co)<3W6+3cxrK3U1}re3 zjaXpg_TigLxaqlAw!LICsTOA>ngPE?$?nAV*$%9Jv#|t5m`r*zM}qyHTr3sFus)P! z5z9U-h5XFiZ(We$(2W70vi?{>`l>ncz_d}F`jR+QHmSeq+D21t{fFTlrP_{o4g7#? zD~Q>QZ$QXj1-R$yb_UHJqJUE8nR=7F5Rkb32{th`bAm>1*Xvw04f55GT_KUm=#ErS zgfxj>Ho*9oDra!0r4A~M=+gvpk}4_;f(&s7marTC?-;-E|YoZ7^4)Z(f{h25nL z@MnxBC^<$rT(0yAt#`%vJ=^_QdE>dL)%N;~{UkJMA-ZJFjxzi)tI*O1zBGSxILjqZ_U;9z{%N0HjyvLfE%-wg@s&w;Owg z3eObVEgHo+$|w42aw*%SqitXUt_0;^-_H6}(B)-ISiC}T2(7xkm}O5BWWw$^uNyfS zK%Wi9{a6J*Q)7SwJx1L(A;mSO!x6d$2yT|nLE+aKGr1a5yyxp?$tgLiQX6) z5c@w%EWcH;ep^xHjd(IvfHZK&Fy=A#fx=`=kr`Hb^ru~G)5XvI+BESCyISw%M7IF7 zR6qBfa}DVxkv)pEJH|VUrvgaXPWs?^!CrRnU?AuS(!pH8z|q?f4Py#WXgHwP>+$+S zTyd!px^py(cmu`D)lItT;z)lxtgT%^H+(p-mH^=CfO?o*gPz%?WO}?u6qY`G=sMW5 z_6#|14-$guAP4i4z`ZFEev&-0aE6eIy|y}c54*2KWu$@2Y*k9n?q?UL_X`$x?{5!? zwk`D8x?)`Kc{6*Q9b^{jj-N4x=E`_5qMLGc)VEu{1Es@DfW)OB{>$uD{UTS$0Jkp) zo%aQFv9Icqu$r=7z+kr+D>^8k3$=Mu>q}f17eSzyL-ZdwK{)dzh3B0q&@_==uWz_Q z+ZVr~y&JAm_N}|r{^UQcRlcYnL;5`^aA?Z0T> zfj1{YTqjB;q08lUC!sbGlJ0fEn`luxlSA zv)NK({|Q3Wt}q?{L<{xN*d+)lX$ApeAQ~N&JjiZa=&_?M!N!b~VIn-FTC=|rFT~3( zlipcUqdn*vyF=NsKL)X}jx*$%g-F}K!A$_3Ss$urWVnthHIIjm^D&&7*AOc3(vMVn z6~OQp-%$2eLX!9&zv_9&DHwGc>78E!deNcQRsGI`mx;t!aiX6nXBA)^^AQfM4%}5E z&B#qg1jd?TTcIoslqrXJCITZ0?zJK?a=47+1h#d)*?Krh*U6{apkEAX8%?$KjrJ*h zs1v=CVitVTb*}QJ(vEj+W+3lKFkU3xImtvRTQ34)`aH|1K5{%C2~`Ll-}wKTQ=hOF zY}2%9IkWWEGeyYAq+#G>M z_26N2OSw!xiGaJ9Qp&V=l7)RF0GXsmJ|;c#^Feeeo*UhgfV<+0!PgqUT2D8`eMeXB z)XDMb-XPU9)s`6)6Xi)ks&fHR8Rwbw`Nq54rhaSf&cUAcU`iOYC&N+UZ)~&?hDrBj z>%MN2uUY#F^KspNL26*Wos!_Lpvijtc0ceZC;AyuGBzyxw%LxL;}s6AHjR&^LF^4M zbw@r#8_nd>q}oPu%@bm^qrj^}^qHAaj)dEJhV%wq>Nd7Zq_fl)jB)_Frfyf ztoOr$k~gDmn~iIaYH9Ny*1>dlhI=KG`aAx`C)?$VskQHD#PI{r?bBufcj%)N?LOOr4H%kGrwouALRFoPkrFK^BD)YNV{1V~XxKlve@? zkwNbggi~8z>=n<&zh3ospuxEegtnyVU>Zj^3jy5JMhs!1Nb7_+>SuuDWtb4d+rgw& zU*6SP4VE^qXFn7B(kgSks%=~vZwxr*{Q}9C_n-=lBxNBai1g#g8dmSy-D$N&l=~t8h>YfsXSWX^k zj&xtknXfZ(=GR`S?aJNl@<#jFD7$=_|K51}Qahj2ZfdaaHQ1pdA*ptGXg>>1M}FL> zV{_HHf-RvTG3Fl6R+cd_003PwGtg#F<+CPX!GgR8j;urC|Kc-%ThD^q$Fdl&m$5a= z8!ThZThL~N;3q}6I#Qu;f@v;K2)-QumT-Ru>eujTsK~-GsLJZ=(zxbJZi{{3LlUT1 zKrD9^)yLzFh6fePrbhN3NjIab)!NR>o-`S~%CxRD^rX9dlB74&ZQ4L%QA)6$@U;W= z>sI4{o28hus@6F{Dp+E3ItZNs;fN`CIvT=EAi|4GjtI)YcqW6Pg7gDP3|v7pQifx` zR0f88p?r`pbPTgV7FZ)ZAB$xWiF?^(y6)W`$^a)dBX_Q(n3*-i7X z^FR}@)_c)g10}Os@7zWCFXIjK#aMsM`-_d#Ng?x zb>apx)!X!t3||-6WFmW&RaaV)eq3cqhX$`qi4bowZXWi1YbVnO8@v}JR!u74Dk1b* z6bllu74TS~+)PB<3zOk(S`32N`Z^%7a4rj%pJqSXAy~e>T`88m8RFl|8OcN|%iivO ze5}Adk}i;p0z{Ms^fF}x1Ti)-gQ>>_1Chg}k1YQ4hMFSx0_polv|wt|J~8w8td z6X?g?)X!aJQI6Ku0dP4gFNc6&eg{xA6ZS+=3jHO$hv}oaV*DXIQ1h9L=x~hF5!RnN zOh5rV{e&Ar$O5~vCG_G!Wt-A^KDllXS(IJ|2|!ajJ4_w@=pRZi)p9)T+4m4udvJw7 z(8lXmA79btNw+CkKm{15TXI3uY;aMwVbsaNDMS`&k|B&ISjDs7BPRNPxb|GQ9@@FG zJzCU|7=_seozg-O?Tz~P=iFmnp)gD{6y*(0`PbXQAMluYQ|Uv1Gx>Q8ew470E=ni) zDU*S1$ov*%$=(}pCm$zJXm@?E1}DWgt%G`mV)D3#$IMQHRT=9HN&NbfM!1?s=X$TYQ4b3M-F-Xc!Z(ERd>R7q zABGP-E>hVJ?4gTQH{esEuR3rZnz@qX3hIGdmHCAdP&Rp6ekSAsZnHPZ?Kj7%C)f;j z_wUpCWc^+3ZYLe*eB}}7`c+R4w1=!NAgt%bU-6~p%$!eaYK$*s^yl*Yd3OU$(27WSaTxS~YHXS5(^tMtb8{YFMQfgy)b5q)+NvLS?N2}Wpy zDrtM2@Pj8}5qFb%bT~T1lPD3QF1~GLgD4%sLnb(0KX$>8WjBWTJl6j#=9rwflYJYm zI)+Y9?b}pn+>0?OVJA2n(1+?_uus^l6X7)pdnr6a4e+MWtCbDHw8imk@|ctB7$<>Z z+d3rT2%42P)OanZWOP_0V-H}aOKlf(Neow94SEwTT>?<~3-th^x)BY7DKrUWdRs%) zA!CmJvygjx={J@8hVoA5>!rNOI_P9L?2WQ+2ss+fsTtl`JimxtZ^PB^g%heWH+JB; zsMoDn`5N(=m0=~Rqwiz80?yfwE5A=9cQIc5NohjZDnP#RYe3b6xbUI(yTzIN+h@p` z!c=BS;FEOo_zJUVT{&_iz70-NWl?B6yD!M)y*xw#x2k-v((7%_mUStSRz=4ndFV54 z1uB;$!EBOh)$sg1bwgTeBcMjl78hB!K8GBHZo5flcr`^VN~vBiEF!U?iN?Bww4D7p zk5D_XHccR0;8i(X&BsA!^fKNtS8Yi%2`ra4tB7D!50^QU-Hy!Ham%WA@At%c^*j5| z1HOfey&5(-_^#L=)C_O?7RQ@_yzB0c=}pK1W#p#M8}(NzY%~iVtamYYlj~1tkHy=a z6BiNX8Fplir|F^Sexy)vI3;f`){Kh!p9j#MCx~l(_qe$(ox6lbl5r|t^~b*+zxu@a z@%Ehf_ewcj?|ARHO(eByA|q8(ilxFr<`T9iI#*CoxG)OVrb3QH#5uG02xP$Qm_J{;TbTb*~IRZ1!K zhEDzogR=LYj^5TM2@GC}@_ki}k{gK?rJ1kQ>N@y686exl=~wy#-FxHpGb&1J9|wXBhi8G zE>-1pZY%d2tb(<@0h-caQ=0r4LE|LnOq^69Qwk%&Pj&idI{dK?9%gJvF^tA{*ZPp^ z&3B@<*mKA|W!ekrROx_$n&e#U;ao)n9&DwhHaT8?8#UHU^d|VwMYlUwaC`GNrD${? zS?_Pw|H#_Ek#D8O3){=BlS0LisItONr&=^K7cVCqk?rxFXN=#T;xF$U$ElD;B<7RT6OMTt;3`5>7foM(VnVx`1|2HY^l~^dAv8yC)~2# zd6hfL_xQ0U<0v$5n`^G8T5}_YYi^nt8p+eJxz?7>iu1$2*HG&3+mk6B8VbF(p-(O9=pd zG_<^|Fv$=SH_Gu`=SRNlJk0XAA2`pj_I7aImgt{2AU-b%$YPmfgL{#EN@S3Yu3&E# zJKiO}^SeaF%uBX0rHLZnrh-|)Opi9wPnQg%mOeY7K3ix`^y#2S=Rna^LJ{Iv1uMb>Ko;)t9?vg@HWsfFa&))a6Vsbur?Pa)W8(HtHeMNNCOKEFW^jPdE8?apRNmr@!0SM4kh7@qE9>;r1J3q=v za12$f=a}P}sWCJ&XAqhsBZ(-jd(k}l7%5Y%nVY7FGUHiJ5PZR%%o*3}9~FpH;%jbF zM~fgc&hc(l&Q1Ah@!I0zmFhvPN#bPbohMN|Y+Os|RO~4mqS>T)8`QIIZ4kw++3R>W znrd1sW>PRjrUO4-vp(3Xhpu8EkvG%WLeYU! zIjY@u2q=@N46e<6qTElF`9%5ra&77i?VbsiQTs&O;--ctFllgW$>%|V#dMhzvVDuy z@K?$_M&}C6w=lc@N^PoKqMovLgSErIesz1358E1zYyppx0KDo;$(y)vG&1o4ttjI6 zHY7GYPO9Qssf7{F;QrVI>RGnO7FK)PBBa&BCI5lY5ytO(r;hH5OAE@5(qd$llKRLQ z*DG@MP{ao*==BtFbJ=WMDh#jtQz6xd3@&0EgQMK#9$7sUSoE3Ank*q>#Tm3GIqQ;j(1X$s%ANXp7(-_vN-5C8Q4yqdZx_$fR!ar>lv< z_y_d1KOtjKJh*fqjMm3XHQ6DzYytQtY1c9Pt@2;Ut@QcQL;iZKgYky9+D|y9`F!P{ zr_}jsEV!NX)!g&cr*3^|xtjlVx52wi^|DG_rrN6iO{%WCzOEbI4KGxK7pMyn8ChMx z4ZQQv$!=238Rfb9F8Z+v9ya4H&$TlJEyNBsjv?6MP>j6RXc`Wf z{q*SZr5Dxw4}AA0p7(v#%f>n{al2|`t#=N8%9#(^os4f6MO=?j51-E6rYjbpWu_^vQq7SX(?1YL^ zRtFp0G2hVo9j$jDD2wpx0~89y0SJ%$Of$&I-&C2C^Is#jf1KW-u7&q@epp(>2W_T( z1Hu;5HvH+>8Qo7^!kZ_WJi&$#*_bXxXlEY9Gvk$En-FrFY`fBR?}kl-jTh>c!R8AD zNnBNKPdr_nz^7WSMpRc>5YmP~%n#9f#1_>9Sc#AtQ4P!P&92y4duqd9w3< zwf4klO%1QH(cKJ*y(`Akj&sbfRi(Az@N-pP)bed2)SR0DQDqU?MQaUG*SM`$yIH&U z-&Jp<=Cs@jEW1g>2nH}niA*Vz$c`tE<7BksIdx1wGAn;-XotI1XC=B}MIVFZ>N!Qd zxt#(C?!z|z0k!>WrCZhEm@-=|&y{96Wbag~fnKY%z=UfXi8WB6m}T`HbwvvLEV{y} z<1bZTsV~*tZ=APXw8IUO2>|DXs+15VP3NzA+2N;+y;zOjsEyX+jKxE0jqwFrhwmwCQUGMJA zcAdzB8{EoM$oFQG7|r_dum<6I@`Ho_c~VlGLZc-yDUybNl~L)wn~lE31UJJ5LI^lw ziysE_Z-{qza}nT3G9ldm(xP6F+yFIIX{LULbU|9e$ES)mF0qfWTRK0n-vxqjRkQu* zHDzA_X0!SVjUpgr(S0=4z&%fXD2ueT4d(x2?LOcusp`hzpWV%FvOSBSkvbqH^w0we z3_VgLRD&Q6JqT!|25Cbz0!jdZpol{cO@e|%L>&|*6g7%ykTx`p6piJ9MN!`G$=(Zj ze0ZPt{ro@w`S9brbLO1iDKq!x=H`}5J-cPhm2ba||JWlmoaFktZ@Tp!@ius$uG(%% zXU>`b>uD=J=Cg*HoA&T~{PebePFv=!X=}`wxnQ;U^z)%s`H1GG=EkOm*$q21`qR&X z=ElAJF{(+~MoTTVTIZ6h=Ehm^-XnhXug7}($7d>hU&zhVr~i6dqZ;~}@jLg}C%Hk~ z=Tlgoq_{;y!)3=(waLMnR8_w9JVfFCNmiwikvNy({X4^sjI>dfv z9AnP5gF{F>DDPvzim3s$A3_g&`&l%($Qay0IuBK!gG?C?lZRa_ImF<>S<~VAVHWjp zu4Li~s-`3CGiA;`793^CmTt#9?&x9RSCSDXZUf1Y%Gt||qs-a*Y4w=1GFk|yE>aQjTEA}v0--5}S`e(+L&nRQYYAx%< zu(ok9Ve(nW*u#P)!#djaaDC-0+w>dVK>g3rPmo?Fp1d4m>UXmCW9@re$v||A5Eipy z=W+752ODCtt@S-#{T=nmyu-soX1nR{1m%0m%X}YsS?+6{PUI)86Vn6bWD(E3=PvSi z4wzZ%(5oK1m|Ei@Cg#}eQDdBA4>NNZjr+#j`g!$?sgH%657FQ@^Ibhz* zue6?LI{sDb8NJFl7_K&sv$VNJUZxCZTa)Yb!En9xWO}3ZJV(Ak%fjkr^JaRhc^gym zO?|N77}Fu^Y>d^N=E3sY{vEyBIKH6%cU(8j?=e4C!`k%e^Iqd)exK`>-Vh5BdG ztbc|@`ghIc>|(Z*{#kN3mcMVB-y^kKTEEd{^~ZcU{kS&E7362O(zH-AXUo^rV-G71 zF;CQY4QDG)3t4m(`I)quU)*Q7006M zP77^?d95c86IM*w?zWP#pE<`_Fum41IKYY%Ox8Ewc$;Ful8c$NO$(jZYtKQZ8(5zk z^tYk)W5FWsZ=_%58|(K*d6~1^#5kF5YMpLU&K@S4Stn-g)@e{Zc0@OqkHr@9F??7) zx8;ic3|pB86Q;Ltd-Gt%D(>&7{;l@e%Va0($AYc5+3zqeX1f{}3%1;@d^h7_%8}^a z&V&1koZT$F>}Gnab!5(#AM58f^;vL) z+3n`u;9+YobISW?I?{&UM zlzVQipC!lX3r<7&5PzgTi-(jmdsz9yeAN0f{e^Xm{>r*MqWy? z%6#Jf)8_Lt=Y_q@pD`bnZ2h@@o;4qqm2oq9&bWV}KlU(vQJ%Q}l02j8v6tTP8%CM1 z^_Pw_XZi^1XbIboi^w*ObR52k-}dt%9s$L0IG z`7?Xn{F$@!H;%vIdSSlUb@5yK|8QL}d&{~+|LwXMlkaWwVVE&JjId<$6UrN=hc1@0 zriWn`P18fm?>J|A=wUureJ0J*L+g`VW_%3o#?5?l<9$l<;>Xp2Og+j`lDMIX2~#a9EY11(<97_S@-m?m^nND==hP-!vMpl zr-w17Y=Tugc4ICMP@2k|VMF^Va1x`|MzPio8rt zb^chLroTU_cZPN>zpR|;Mb_cZ`eDYbe|i{<`y6MuM7s&~*vI@b?U-C)oPUv*ISU^N zTe7^;IR2{q>+&%vtW)$F<$rVhTI<35dgqhr4a)znpBvR@!C{tz*89JV=Vs?KdW-xF zw>qD%Yk!;b!}50J3`6p~pO2JZJ?vxpn)Acz&(8NWP8dIvzZ(B^ z$N%Pb!|-?O%#!|qV-1a)$s5MUu-G~`xX)oX^EcIJ>0=FjIC#i?rf?6_X*0qovl%l& z+bsISWN6~>KJ(>fgpS$DSC|nB7AwsN zi^W3c40GlE(2UT4SATf>UX~W*3>U6 zjNDHMyxynXw&ul>VQJ;t8-H|%8KGpg!?xgXY7+w{T1_z18}zrQPlNWA;tgZ}bl9 zwYGM5S}*3`vR>=x@7u~*a*)|Q#?hgtm`pzn~%Xv*0+h z=7x}N$wdvJh%Tj^<@*{!$5z@cqnsHR$Ndj9gwCxUZ)pfaOg^Zb>2eLBD|LJYQFYln8snQkIa+-LGp^){1- zDMwkdb!X-64WXO)=El!*3+uj%d>=6{hAn-|Jaabhs(dT!6WvxhlkJr6rX9PPZf|{< z?9dP5N|6|H`GH-^RotL=3i}Ky&+0}Vu!O`e$)~VCD*~9E(=E0K59@_109xOQ; z-OD`ol=tK6v*ZYqF7@{^?)|I>E0#<@;k@nb`2Oa>aDem7icR}C{z>zWeo8sR!REKG zJnUq0sQEEFOrDP`XBWc}>ND$>r_274@-X|f`YeuCe?R-jxK5*=HE&iNWzl0EpOF7^ z){!Mk7RNgu`zt@e{8(|A#fipsfIKJZpH;8xo5iWFSC;Jjr1H~zh(Ghwoe!4mIFPye z%+FLmdX_w&;@RfG^gQ#(D&2g3-X1HDd#~AM&#>Mb$>&ui)pV5vPOBM`wS(oVD#`jtE*v;@A<7Re`@*exc z`eDvd7T;C=Ir~3!oiHi&ANRSK*^l*qtZ{IV=>x`foc*6V@6iYKAALmq=%eZ%Z(O75 zGx#EzaTaVnLH=Jkk1Sa+d(8dViTt(ejRnV8K5ku3(*8Hb#f&2?ne@u@q>+bW8|6czr{-}ReOit0ytMV~p$?`Spe5&JrmXGCx`OxQK zh6(2EIL-dw%s={f^Jn-k{hZF%^~2;1<73LEGnD_sd1LY~>&)V9>zO+qW`-_i(`E)A zG!pU|Gs9vg@1GgcGx>p;p^ss?nPHsi@-sunS;ogfdN*a5V8M>F)n935=x4Qx`pj0F z8QRWqoPA7NXNHRT+A~A@x#q`y=If}>Y<>Nnr+(YaFu-gB_2WLND9y{kY$* zexLDeJ~PDU-cpuKwwM{h7nOh5ac1me@e%oA`Ia+7>-pSjX6TM?Z9Ysn5lxNz0^?#& zbeoy}F2QZ(y->f~SvMv-&J05gJIxF}+Q-ig>%fwe&-HcaFP86S{9m>%yPFr2J@vz| zxB3@3&OR0#VY2Vcko4PUH!BV@d|W#wY`<7L=FB+4oXwYL$1avEm>gi-m)ig2%#bl0 zWIoKenCZdB@fGbps~=`P>R+Z`cCq-Jc``p%|4fh5|K-Y$*FVDvGyUB`d9QI_!INi( zURI|$AI$Tap=Ch-XIf8YXBjW6v(>-S{yE0Q^jza&^=0$;s{M;*hEA6K){Ws3>lw>0 z)&JMzWk0=UJd88B%=x}b`^(Ln>415B-8k9B{7Um+`Zee4YIzx-OATMwZ`{9Hzu!>* z8`hoK^~T9?gK-w}vX|jD^JPY_@dy?Bn19PSqIVnLwfv6pF}X*57EG>FJ}eKD@6HUP zEa|%mLwT?DWcEGvS+VT~KQ=E`517|Y^8duTF?rDWWcrBm zLFLR?a+u*!^SxO;b~9zkjNumf*v0&3)|1)KT`x?3q5M|uM&)72=Gz?qz4Ob0L##N# z{12|L+tp(q!z<1s)7PxiH?{kVbz=2*>&NtU=kX4C-f-R--js*czvUT{=WXMm&qfN1 zS+V_2?WWI~e9k$YF)NJO4_XN7JSESW4jE3|w^JN7VLZdMp&#^!s}TV9^%3bVo>(-mihiMY>> zVdM1yKJhv3B$?%JsLEG1{_k=X<7B?7`b<`z6*}+LzI9d@Vzs9H-_y_9`i-umUl!|{ z=Y86(H!Jip+0Z;$Zlb^MYqy#Hm~3I5%-Hz@3`ZLW3$~6ZXAiRzl*j#( zls}~2=hbI&igFfgd)WS|#=&s5d9q~3Blv4_cp)`Jz3U)cYWJS;fOaFINt%KO!4aj`tiE-~(3+GjVtDJ7K5 zFO%n2ywZGFv80bz2`!KDYUND6Ay3@D)_8txyw{s2iyN#rvzuLqkE?f!^TYgBYyXJm~sjF0)##`nDaXN`~5AB-dJ zk6WJ?__FnkzA6us*PO2x`6uUv6-QZ2==UZ2f6;IB4fz?~l>hhI|3iKzZ<&AeU*`V@ z{@eVSzO7$|X^o+C+_*T%bb4cG`lEUcjiH-4ONN<^q4{O&$1WC4jbVtnk6T#GWRCJz zjDthbxyo5AQvRyrODSi;#SF{n_ci4$%2~1bPx5_GzYNRimla$7Y+TDXh92fCG=@=D zD>izLN4}LBLoZ7XvEn#G(iqzQqCR_BaFk)?#?bm#^_a6*r7?^#`H=d5v(G-}t2Ty; zVYSB4{&)Sa?v1%DIKgC%#?bL!%3B*l!DLPIV#Utam9J$zS+3m}-(ToCvqrBOv3?w8 zzMgq4c6@!~W7xp>m~ChrZ*n8!VA$9=m~PtWoT|?OW}6uYlXm0yr+zorAG0m=_m=t} zRvt~2vt;;}@o!@sOm?!qtUhWS|K`rtm&wPBgC$$vR=&G+V!DTQVzQ_4h3TPWKa0Jr zH!HSIn;x=#jho@)#?73q)49KLRvcw|fbtpk*~jD{d04QcLH&cRYxEH7%98Cf?H{V& z=;7)!9BExrA4YPXbm zvYRPOmTd7i*NQz%t}=e+Y+l-Nb~63C@iXH%3#Q9x#{ni+>z^4r-tRaIR$R>F8}fX> zaSpOzXmOlfObYX0M(-^PIWrdY^>U$P^Rnu*o8cPcXTp}{jE_CcIKrIC^4hbPB}bWE zXB}2>oP8`W4O7|bGh2F zy;VE*GvhdOrfX`)0ft-5pD8=ma-0QAE@s8fwH?3J{26XD&voScrg^fs!#r8hCmQ(s zsdZt(A*O6vPkm-AIn4Y{_1D*)-O+DZ7lym7OPk~DVaX9D-?1(m$irS19A&u2x@@R_ z=1hjI3p2KDWdD2Cg#|07_gR;XwfnwuCM;R}K);*F!yYC-)Gsq8o2p;xmnlb?vt={& z*~4(Z`b?O#%g0_;9A)w& zDLc2(j)SZiwl%NEoo{BpQJ)2?xc`LtZm0cI)`vNV<1)2jv~|v5zGyhH>liQODWO;*Zva z71N!yf7!Y)=L9Qu?4tfF=Ema&V`N#DC5B)OX zC`-2PuKb_o#cX<$pV7)^G=;R24NYNyxz8b=V8ymQjAvGpzb~lY*yQgE>alfCd3{@6 z&UBGH3`;eI_Py-0pBYOQoM6S)y|sH^lfN^l$3B)VO<|bD2b;op+-I_n`s`w|tbEKl z63ZE11CuVNKNjp^SiZ^MA@s|NC0jnO{R&N?lR5iXa5$E)Bu|$->|n-z<{V?irv2ni zv}eHqRvclza#LvjgmQK<^Rev(lMk6kbT#X@zvIlAtZx0{K9d9VyM}SIV#&N!zE7&R zW>d&ma)|j_#(ALnYa0i{I{IPB3FhlMf1h%EJ>zFs-~3s!Epxn0|4cW~Kf{LlKge*8?r*~OfFEI7)NEk~%&jN!xP$%G|SPB3HAtvx$gFuta#_j@B$?CC#1^ZaW;|!nF|L4_bH!}`0 z=QsfIM8vXY(G_f_OajyOE#URK06pb^M zKgjjKaIk)uFwM2&04q)~J4F67?XzHVsOy6TJI|7jgRB_NcKk5smnnxB4mZwolrv+> zVU~>FG!u?6Z)Pl6u;o1E-Od+NjxcBP1^Y)@e`XwI!PY+YKka-m;}{FJeNn$hnLkTb z%#Jbt^VL7j{8@3F$?@iSf#V!x!KMoxXE*Z`jDyLE`umdO>|@D_`AOFA%f{Dh{aA2< z;beI)l81v#Pq9w@>a&X#hnSwKzl)VKW65DwY`(}7JUb!EoZE7UvBx-#b&OSTQj`vvo7=rez&Y`@a} z7p*HRjx)Q!x_s3>2bg`?^}~XlUsKM0mKRws7X8Yv;>G64{8ID$x_Zo5e8oKDJ{L2& zO#Q2sbCBuf*7qC6afS6|Iv_tYjx)c~cna;lYCKG@(l5(vou_NGyUuma;(Ga+-YEaI z+HsHt!*%Mji`h-a$%;+aYd>h5OgPMf%{Rz%v-81>B@4FPC=YuWZgD=CGPy}U_A=b+ zd@yJ0p!&>Nag4>?*8OJ3hs`JYUGrgazj5Cp-$TaDjPbRg#lyzU9K~7RP;d4y!kFb{J&QI6E|bSN^8i zA!D^*_T+12i{{y(`Cj|%X1Qo~7-m>X`S-MA7qj=x4nr*2bf57ptzRZB`en(*EIv3p zw0~dw{KA%=WvT`XACSD-K0h z)$je0vpJ7wuX2SLdwPQa^jx*cLd`8$lI}EU7 z#jv^j52??b;luLBeYQO;-`4UlPn}n$+gjg8jJL!2W3sb#d6c_a7nVKd&-?`Q{F(kv zHcyr;nS5UP&$VX{i&M;>;Z*bgh5YPgahh?&{nL$O)bTT%A6Bg5{+Y^u>G)a3&5~8z z|AKk`O8Y+ZWb#GhX2y=k)VsjAnP2F<{aT(&oFA5#8V9QZ>+!hu*Xobu4e~O%(YpRd z`Ayb?+4tmSa-Y1vRsNv7tQf}Zk5~_epSez${L=OCgm&y^cwBwv&l$(>9DiOOX6$3h zDwe;X-zVkc0K<#=WyX%Dl(S&T#Y|pO|7q*MoEb-$v-uhI*vX2648J$tXSHJoQx?oP z&YWqb9}X~#>xbDN&F?woFFW6?UU6QZ=c~>i^FO(Mnf}>&zMz~rlfOH!(bt{77aeCG zy%;-GEZ;Q#m(>54{-XajU#2tXgwEe{)|@cJvT2U@N9bqvoX{PeGbao(TY63ykNaEB z39aMuZZ#+5OtzjA;%nWLbWTYBsC=6_ewR0XhL`PcJICKO?;4O>g_ov^fB98epUy}nS8B${z>^?bNoR0|D^mN`I#SV{BfU6e|G$k zIo<~$FNc{OYF-oiJxqVBSTY|J5Bk2>Gurf(X-}+F=m&}3GJ`z@3J|epV{TsH|`IZ=NsyA zfF&nbeRWRgSS-IUwvMmyPkiUbVpi;YQ@yL5C#K)9F8?sD!n!cy5c6xS%Re2z&blzU z-nuZ{U|rsFoINZ!!f>Pc|4UxxOl~r6=7Z+{Z^v(Tewf|r{4l-4xZl=($heu@sXY2E z^9)`K%zhReXUX_pgyh@mv)}|vc1-sg;=7bHN6i!zd@d#S{D{0 z)`i(a%4fZ;?uba6&Ms!^|4yhL-utedbm-GnTB_vcUeV zxuJ&@N1{HhsCA*dO>;xeWcJ)J#%#{q$@gwl?DgJ_eD2&Z%5%$D{cRPVFTK31$4mQmk(LK5ao->*LN52(KkThwRrLG|N4+uyG} z`=iUw4dV>U&-K0s{j4xI3^1%XH%zc#M~ikV87He`ZdlA@<+-8rgXXcSPgi1CZSLfI zQPQ>M`m6}`Im~38xuJPEdD+cmJ?k0w*|NO-4Xh_Kjzl-IZt*=V>}A;4y0O~aJXchI z3-e^ok`-H4vcIJ~EIATQ;PMjqzd%fphbD_f@>jE5!5xWA+EucBXeG1+Nu7>fJ5 z&J9f;l4m#bV#ZonDe`)_J=#aEEwODlO3Vowd7$x%cGp%=rPXk+VXtH`Hl7% zCkuA0qyDkZFO%b(U#9F_SH0t%Useq3IevomVZkA$Ct08MmG@d7W*lb4X7BmQPqscR zPqEI-PIbOEu+JVQr<*@BCL1beFOxIPlLgy0GLEy%lO-!w=a{GW4prxwC$m2DWH{eE zH_@I0OgX`f9h=I>g5g5*WON6QoKYEq=?aCS7gA}e-pBXzhm*-mLthhLO zojhCU?|SEnCCB3a4aWar_1PD_$@rNM8vjSMyV>}e-fH~JZbM>d!46kwPQCc#`jVs z-*cX}v(Fxe`<*9dOtx2_y-a`PI%UDu9n|}=`7`4fbGGg1IQtkLFn=a&-$@?!GyjSC zvtrtz-cQY+87G*tvtZ}W@^Fw9!!C}Gm_IWPv1HS(jx%Hakohxx*!*{s zhuth$GI_-OKjt`lSaO6FlieMER34_kQlA-HI^|^#3y!d4vWNP=wl1uGYh9whvo3pT z|D<(c{*3uYUog+Tw0qHfSiEH1du#uD{Y78VAH!?%?&COnnf=LmVE($i`>OYb^5|ma zOy6{VKCa$BjDzVvjf2Ts>UYWaFXLd&ifNb^+V@jFYo7NzXvc9@Og~|KP4mJ)boRV3 z!D8;b(6K+~%?kyy_st87S$$w$=sZBa73PIOCLfyTIZwyg#ezeu*mR)dtIqS9IQ_0Q zFATHjm=~HqrF`dkp@(6Yd0`~(?>aBEX8PZ4p8HPucAw{SlN>+DxDVnX#?9hT<7RT0 zaUZPSk;cd5DC0Opy`%NV?3j5TqpJVedHzmdzh|EJH5m8j?M>x)m`HAKc_fIm9ZpTla7rI$}-aMF|Y92>wpU(?@%+4}iR_7V-r_JvI z<7Lt>?@_#1-smO9%W&zukQ{CQE7pP8*XMbSpS)Mk3vI_3ANyFcVp7Qa8RZ;^UhDiZ zz25vjtKN;)jp?9quozOmhj*&a@>}ZDgQd{%IeyppSaC6vd#%T@>i@`ku>7%cA7@-Y zQJ*>cSg~UAsQkxsR32u(QvU?UA2&~CW7d!9@0^zt<$cn5VfM81!u(m|K1o09jaKu* zDAVW6zgIo>v3$XNqAwc9$$ZK9nEk1qc$z*Nw zWWJtxUMNqSc`|Hho=i73&o61WiFq>L%sk_MyY>3A)eO7GxiuQY2M;0Hq zUd+3!%Vp-VpLJo*vADm#@m;R{0mjF0h;guD=M~x?Zaz%9}7tm^T6UH>-|;vdaXBeR!mOT-`DK3pB2X$K5xCRGM`hdE5oVty*EI8b}{7;Gd5o> zKYJKXGmf~=Zapo*J#)@s%$a{wIv0%lL?bpha8y{1SGiQ38;~Zc( z(>gI_$MyPSe6MiM#Vpx*gL-FKKPC(}s?RPK9Ae3)n~aAU!`W^ROxQfAKD$}4WXYDB z)jP-hnQ(+DlUs~~z05hvf~~h|$D9?%7|u2S+q7dJb5<RvFTgtebM}xvt+@RZ_CFXRvckC-#qV9 zpS?^u%8addYtNho$5^uMJKD34;R5qy!uET#XFqd}vtT-`J_ndwXr9d2@m=*;uwuAZ zzAu>%6Am$F)At-_#_Y?^CrdWpr`|=*Co`5T*z$dO`puImN0>ADfp+X=#ZiWf&F6>m zu#XulhD(gQ)Sd&(IKiA9_iN9B;Zo;^8M}TYKZjVc>BriC#kiSWZrm)cH0}o+XAi?~ zjgJ|VpD1Tfk3)IM|OzjGcKo;29hr=5op^LfU3V8L;w&zjFe z>T!U1Wj-v~@vwZ)nGXvtX7ar2?Gf!b$dchv<9We6S#gNvi{|+=`Cc+lroT5&CVw!` zpL5*#VZ}1;|Is{up&ok~UN%qWY#p`#ig_~USloZrJb$Sj`&hDK^_uzoO1(du55t7| ztl0LLdVf)$$=}px@n7oyTKPZBli@A%Wb(H8Jg(jJ1!0)!tOcR@H|jSo2;EGZ7I@F3 ze&#F)Ex%RH9+n)5`*RnBrZIWuE$~>!K8G3R%kzZ13l?~Pfcnh~LO+Y87I=Sv@}(De zKAkPf8J1n({Q>ruTi|yJ{jIpbVZ@eJ%ve;xn7-hccg3$V$_M0#8Hvsz_WA>2+ zq3wC~*~fgV1(TnFP_g|5>y?@h3yw#(HJ=xad%Fc;fXR;L&zv1E8UJqP$@F99$#Ng_ z{JnbnnkUPy1@W5zLbBh2(8b~t3&Ie?{^ma}&jIGoiomG0R_==Rf2dHBY9DpJfq#Yo1Kl&z$2dpO*hE<?u7^Tg~mc~~-j21fa3d7^)jhsj^%2@U?vW1P&nnAz*b zIjzC-(ZUWV}^Fq7W(X;2JazQ7{3`$-Gx3kNS=m;J~v1n zmaJwj3@tO2&t2$qgOqcG`J#oPb(Z7ISuVXWj4@eeVQ6bqe}#pipC!kctg_I3k#-zl z!3l;n7W&*E^;s}kXQ4k;smIPa_SawNbA#+N%;iQ4eQuC`ImC1`|NmaE(^mb3$`wlXZMAnkLjKZL&bva&D!m4+)VZ}ZiWMl zZ;|5%8XqS=uy`r;F0-yIIm~dm@x4zzb~9)EY>|>JOFMpr@iFBHb0*6;&R%*mLKtPr z*7rNkoF&H?uC(4CaGZV2SuuRgxLb_(D(8XWTH|KLjt^>oo%LpRqxELN&SllR$$XeG z_)L?MT}%e8H*+>Euink($@CWUWX9$dl;3KeOjt(mFrO8*8!{i3jGu{;-KBgb$M06o zYS=uP-fLYF`|OGSz`8K|q5Lar&u*p<%fp;4t0-p=i$~OF_?h}2lK)rgGh@l{xcaMV zKc+rQ4zv25^3}9|#&{T>v%YcvdF#8n{c-Ea{Ex0@man;<*U*kRlRvA^f^Dt#C!7x! ztXQ&rP33=)hbhNdGF{95UtM1;Il+o;Ya93L#>sSMv(F7Oj;7|&ypDRyH-{ePD>aAF zxW969Xj|9uRhvUU3yw$EX!dzQ`fY9Y*{bqzF-vx?FaKK2VUS_n=Frr}^_nL?D<)aL zISkuRHf;8Mxqdco_IiKg+C+cMHf{ELe{R<7wGxhhq&Za4Et^C8M(Sk{&0dqC{Uz!%xlDbgU$xF3 z(f>8pIeM*mGiU3T@?6*K_5JGKVBV~lZl(N2>m0pF-mT@iSzczh${W2+-c)_|Fx+n5 z%-On)cHfkj@_e}cjzwOtZ-3WCp>22j>|^TtM#fp~rN2(|*=JE0Wcl$$p=l5K zy7U*_PhO^t5F70OMf6iY43kmiLp3LO%;mFh5X#`zZgE`7z~U zX6)S8aSpOz{LCRAI2GDi9I_}3FgsKpmWQd|rT*dSv+OqR{nS5ZQRrsz8RKK_3w2sQ zVV*ta&Ez=ai~CIX*Y0@ZU~;1V4p7dF*-6%!Ia@v{Z?AbX;Rp*R2ReST`pnK*6o#Vb zF7iCM<9)`#@=NMRFHt|^W!8z|tBX7jF5lOjmxFkf@v&mX;_K#pu=?!g{hYda)!pRg zotYsXSw_e@x$V1z#@)I9l7ELoxOmki@%EJMhhLi>ek3Z#mlgHANBZ~C;7F7+{+!^}N0QeXi&eGez7kT0-Mjc;%9R$B&Dj{P%l} z`GMM)W7SmtkJ7Dga=Xs|ZxlC+xHfUSdkM4dNew1DR(824#Mi{sygjwNKd-H6q0R2<)brly-=%m! z)bn0i%j@mj!CRJtx8sKR7U8LR^Z&@3`c>c@b?SNFFURU)Em6;VRW0uU>=q}Ao>(SV z{rVdE&%7FcTi#aH;$|8izk4~1n7O1V+z@kEhaHV!PjR6*TpTOH>aHCTuZ5)MW0JfW z6WIy_es0RRZ`bBK!c#Wy ztczb=CVw57ZC>?tspnt1RJ-v6h0v;WBJ<(FYodF!{g zm5n3Dsv-_4ZgIS}Mi2Ae+2ZjYx$5V!e%t#)?Yhh5-ET@>5AA}7Iq~E3{zqO9J3{ql0I;YZH@$m_?*J6k;dzl}F|+1Mph^7;`H4i`rX{{`><3-Lb0 z)_977^J1axqUegMvMTj}Qu<6(@*O zt?`Amb9PnDdhXaLeqW52VZO6nqs@cj5fLxfn181wM;pdwd6}p15fK0FXUBc=CVp5n z#0Ir(6AjzNhebU92#+l}HhmjA_51NmyA`#I_rG!5-mw@v#RfLhpA3sQtIfab>r?l> zHDawW`TaH<$Wy<*yR?t7|CBuOXJX8gqTasltM%Kr@$4Xv<(=FP*FMIPQ}V13kI2)B zdi%Ps)$+ve*Ev|8`t9N~+Mg^=6)|^ASHE4HVdwljqOIGyrV#;`5Qa{GHh~tfU>+A4}vicT}zgOP+{X;6Rr~Tep-#@AU7x8xy^Lo}g zSgN=+zNxIfy%qnx+W)-Y`AcmbGIPt3TaEHB;2{et5}%8|T(9HYpdxf4@iG z`gn7BH=B}ok@_)~7WKUKb@)KcRomk6|LuAxzP%3I1C@1v61IO2Wevc|GP zZM^X@W^IicTc?cI+eP1V9bT`kZ~VTf>*cE7-s^ccoRas0OZxo(m3Nv43Gse1e*e^n zy!CAx`L-83iMXzDyzyGIP4^bacdo7YeO1+zc6&J%!`loew>VCxb;(IWxw7j{{q|U9 z>-F;_hPMk$Zn6I4KWjNF^{2TnZC!FWoaJDQbEni_Iv%T!VU-Zxr@k$Z|NF9fF}xjM za*J!TM*LSj|A(BDDfvI=4l~B_@s86L>rXayf0g<7)Z1wMcaO5TC98VLraZ~y-jWc{(tBp#^MPu8^F z>etWjOm`$Pn&KUbE!LmBG^}Ug-~YJ|iYB*Ao*U$;pZ9v64@}83IR|-$wD`|F<&rd$ z-*@(-DdS&V`xtB0@+_}j?dQ>Ci)t;82d4DQI?#1t&J8H@}w^9Erah`~mTFkrtl3b1c6c9Y! zAJ!JDiK*j#z>Phw?VQ^ETx|69DS6w~KS&%V>UnRi<@Ho^@HFw{=IP(?qFfWTeD(7c z^DZOGHov>d+q|TDcu4)v`*sG2{2_{cK9!b=BWM zcslf*y#Jg`8yb&@xon=w49CQOulDZG>9=a*ekbpSu1|T>*uds#&EToX;AzCk$Hj4d z-#>XIH2y)^-^2%89B*?zr>@2FF3vda7VEICh+F(Vz%?4*T@O#Eh0Vp5BHkQh{ykzv z>)|P%aE7>Cc)BNCAf}G}BeneX#{#iY{GP#VO8#rL84`Didj8MEit;B*xy_5M#X4d` zF*X0L?~y-#e_?#AX}Xi!F52uP_7nB|^WzOq{$DElt$1BLEnW~)^B?eD`M2;A!YTP@ zc`|4j@j+3)Uh0pNwpO-_h+9{5%6Y9{FL7-)u=eqL7N4Aw_Yn1a#POm&?t^RNzE9bY z#F!WnKNnMTpZXr-j^E#Sc+ zF^+v>W8Og|+xkkTrgyK$uc|*NZWHyq->>D})P=ci?c&^v%llc;D(Y(y-C530iF8NL zsmR;4q;1$={V$3yiF)4WYI%R5>`4)~7r3#U|M~m%!E&B1@(%Nu{qFtfpVVL5o$yYg zzRt61>)hZ$O|#fWtR&VGsocBP#=LjUGvz&B#4X#+{hRzyf5Sxg4{zq&1&sBD@h}(_4 zOTIVzBcu-KP>N) zB7P6(=j2T%YkT~!{+eQ2QP113WCeqxJ%wr#GH@TjMvGtG4CgRwTHYe z%gOCH_0JJs5cRyZAvRvF>>3fb!RTuL^E!D^&dJBs2dXP?5-ZzoSN}z^oCg5)bzXVN zp~gOUieC|>xJ`UlOwIjNZOng`d$EXHafln*+;{Vz?e~sviZM~o-#u9~G_I9+u1V}K zb`^VzsrldX*e9;dTXM(ylDOp>uj!@9waY8aGuY)tBI^0?n5-EZ+m&rE;<5mG@cXl+0N$|#MH+R>v+5n$6o&#QObMR zlyQGe{Ts#YqMmnrNxH_LC>s?|iQkH;d5^B;ooCFG=kwEk&zHAtN!##>`frJKR(W?l z;@!Wk@vqAME!Ocn#%!^)h(9;$*WiV<+{?(liilg{ht^-^udl~}+MFrQ74`LYIBt!D z%I*>miSLQ~#niDsRm)#rlh`PJ|LtlXBi8djuFad`U!tBrJ~p*Awyo;xdc`Ni4x&>` z&Hw6@{PpW4ey?sSfBklJxHiX%6Gelh@sh6HCp3OZ*?@@KH=^%xt*mBUHWcxDdc8#W zoxFqU|4jT+)W^NuWTwy<$Jij(I${~Is(8y-o7P=&jVxU==H8^X?(zG7Pm;fWUfZ?V zM|@JulsAsMtCs&UWzUL*t9vewZ-}Yqb=6w_&E?*?mOp;4@I&$^OLBzev|UrID`qN- z`G2_NSmO!GP7!fClV6Dc*2jPTEZR-(cumGFeqXVd4!-j^ywK))F(?`wkNNvzMd$TL zF<))_seeyBr|~uvxBBDo`2EMzJ?3tz)qhz1$HebNJ?}Kf{Mc)JTiHz4ce9uyrjB|0 z+M3k!#wWw#?+Eql}CmmKU2#azdzbb-riY5B zsE6gX5$&6M#Upv`IGOi|DOi(39`l-(}kb`QTV>ep6%?9r*?&(8CA1NpPbR{pKc_I|fM zT-5WAFFDrufVCJEn;7RmIGuNiUyCl||2t#;n~eR(weiRA8{gfXe*OOK7IhvFBch%^ z{!P->IBPxkH6m_Hu|*sj%T{~$_7?Mx$X#Fm_&w&w%U?ggt?F+fJ}TmM9Iqcw6~?VG z=IRlriIc?C`=3}IbJy1rsTcQ@rT9FMSa|x*7B~ozBLg?ie1HiqEN5?^Y%9X zuIGNDwl4Ae)@S&gu|Dn-w7Dv_6ZLVs>yBIF1Ik84+{QR{+%a$5>f?^z-`*;3(~|1p z8TF@G{FyP7#r3dcacf*b*_tA5ZQNA6SMGQ2JJrjt^cZVO{w=l1#G#^||CY&&q488@ zeIjlb@iOuMl|O#p{O9DaH49hy$9Ki|MLqv7m!xcbP1&2`LmRl?7t4zKto2B3y+>=t z>*eYC^>~%vDHgq(e+z9gag3<1`yXrhzozUaai6$LOvpFkek`u{TT^mRUW-?|%`JNO z_nL>)e_hP5;Pt#swd?$&%JvZ_i=)Nz&e1v|=KV;`=ZyC)kzC_%(egGg8B=)4ed(3j zTqWvx7uLpmjk5Z7WBm7O|MRx|v?~!}zby8jDdRpq;{GZb%J{S3U*2f)}BmVq8P1#v7r|k>T|1J0R-l8RM5-Zy- zRR4bQ8xhC-VNqY_^)_~2Aodj?c?^4`cI1K?xgB@e^ASNu(HpH)5VEm zZ@J=aI6nS3x|TPt$@Hr|k8!J?SIfMc_g3{E7He+yZr+w9KdKtvR5r6+UC|<5mFq3h zBkw%7g{fIvc+GdwRQn$Gr9Dp$d5~ zo|5;E>c1ftZT@cFtd{pAWoL^k#l@mau5J;>+dCz1T;Fua?L*#{CCeM`R{s(4n5d8U z3$?r(dO)_7*jwx@#^kC$ukd0m?>p!1PS0bz5hS&|z3N{m9u)PwchvIk=Hl2-93u`B z8@uMW7je9MbL#q*-*$g1Z*wj0H`Qo#+=!yOt9X^Q}`e zu5bLEqP*L6C2#%b%N^?9E50x4c~7h5y&f4x%j9rs5TH;I*PW9q*w zR@?I3ykA{%sPQUggW_H>Bz85%`s4Dh+IVNWcH?b2zsGHAO5T5|zi=z(MbyXpwOZc$ zmHkXSD;^h9^ESCHOlghzix$5J6;6L(a z_quPNl6QA)P8S2Bo_ArG+!~W@+!n-EqFo%nsoxJo-!zXU8OOW8I($&%_qlC;@ZHDz zhpK;yC`CQ*Q?*W1p>1V~1@%~u-C&cpGznk~^THYI#eM|gUd{4ylR==NIzWu*n59N>i z{b1R5*LUe1{QfUKCmQ5)^9!d>n@rreXh**ni_OHE;w`!2?-=p^w`ubwc{eoPEk*Hw zzNh3pU;RS-Q`Ga`Sj+pXoqW}d_?vh|jLB8Me;A*Vcbk~^LHB3!*4H=daP5dE#mw4x zeQihF8een*C&UMLwkPI^RugI$L+W%eUK92EwAd(l#Lx2O-pzl$Hdl#4yfg0Uv8Knj z%0@-p#yIG9Uw`Zz^TsXaj=$4ok9u9zl)TTWzgW!L<=wpTW58^U>nr=P*hOq7rd}6! z>7$-EUKiQV+~(zNnr!O&SN{^R%&za|U2DdYyvu*g{Ka-+Gx2M=>W>SnTHg9&q3SV9 zw*0&6@GJFS5Wg4obvQZx!*~}fo3Z=kzr!3({dqsR2(@*X{CV_i^O=%&q53O`twlZW z*J^q1RQ7%GxcHeU-M5X3_;aJ;e_My&xL=hwSu%{t2eiv{dOlm!^FC6`JFM&hF(yVu z=DzJ{G5Pb8G4J-SwcSKI=GvSx-uZiYj!%4D)bpObq|e5q_w@5uTq@2JO{t$rBHlg{ zP91Ohq}LBk$s6{v4&whI?M>iss=ojKeFqLw2}LDt^;SrcD3x>#pGY#4WQr@ZWGEy< zZf2!YQHWeaBIGTK5^hBisSKf{cZNtZ7c%{x>z=*b?fvob`F{TY{dhd>Yn`=Ucb#?i z*=L{WzB55}*I3<4AK}^qREN7DT7}~#Y(lpywX17>Wm{a6-flbb&)1N1dr;j=t*+!Z z@+kWQlmfS(9jNN->h+w+c9uK3Z{q(sT-hkC%U4P9)?oV)4#5s^bxrkib)!4EKJDn% zZ_FGIeg%#93#XxmRja!x}S}~e+FcN>ZYE_Mt23ab?^)P2yPx^{8Zi4?=PcU9NmaS zMEMQ>Yg*F=RJV=4$Sc8z@=zD5g6wZu=*hf(uho@#L~5Ko%6{YMX5zmK?rNLXon&%;LcZ1KIrS}xE?V9GacQ0{<@kT_{U)& zxVkL%hG2UYq>Q0CvkVDc67edXUx`2Pf3LG)^X)eZiMO|So$V8Gl$yAslfa)4zg z;0#DS(vEPYcsZZo{0*dBMV*)9q@GXt**kMa=1Zyb6Lgz7@#u4V*V*>>qd^z(zl16a z|0f*(QuqlsJO0l){?Smt^mhDf;3w2_{J(JgllTvJ{8hh`Xcnl98{NVWK z=)`;ya)T7f|5C?43;*97e~teh$3GaNkzL;?gTUX8zv@5g_&?|PM{)&B&Is*o(e-`N z@t2<+Q2hk{S47m?k6pfFrsLmUVzKeWa|g@~j{h(C3ELh2U5HpVsp?yDi-s(Jny^t(Jr`LIOhRHrmNfZpEp1Fvm{>S`{_RYF- z`~>NiwV{Z=%&Xpw(+L<0ZQv=05RYEdEX`+$^C3IekY3a#!vP_S^l8a?FUd_vT{vSv814mchp^4LO zsH1zY)qMqrQ)q7V*ED~+agC(j9IilLwns$ zpR@cMSPzoN1`q{`cLduRxTHJR1z<1VuYF9;v1NU`k;~x_j|5Ds>(leYYw^DsZUxoV z^N{-39s?;O@P8Kif$GvdrFaXleF5uW6}Y-J>-zDY)x9oY zzC)K1mw)!)|2O<2?I@fk%B4F0OQ<58H2;CW&Qr6$kH_hup<7Dv?k2GNBsj`{dmk@` z?xh*Nul)N;58l~?c@X0Nj&67dHYo?F-Tv2}b;~LlFjX9#U{9_C!zCd7LUdmB0}Nh) z?OIR`(TtP|m>;F zGZr)tOhu%4+24noj+XRU?PF4_uHj|z9gePyw-eBu9m>U=<0j$dVCPw|MuQm6y4lxSM3j(=*@!#j;_4VPVp9D)3Sum7m7EAZV^XU zf0xoB`Fn(dveJsVc`$ zK3_;TQik&ZM>jYAc_AODE<>IauOK!ph4_3S-59#V9Nnw%FAgO^b=f7Qc(-D!1X8L| zUr0BJ?pQ~+rs$D_hoz>y952dRT^Y~XSY5dubRpdcjb@!kx09n=;s1kf9No{+Ei5ZX zc@Dj?FxAn$%jzz{_BCvT@4>x)FyD@6dXFZ0E92RDbbq0p=AqXAL3dd;UHQ?AZRlz_ zfnMHcxqbsWFBsBy=jvG{k?Ss$b&<1o~@QuGX_%ycXKs8e4 z+n9ILo?$Ol2D5xL%mrP)MyQ$XXY=`Rk> z#> zm%|RB8%cSyKjFU^R)Ff-OFP~^Z2v%>e#8u}?tHd~=)R9`>iscviSp@Oyv6;Qhr=P*33)j=F9Nw3CrVRG+#iz%xlbCY&T+4# z6{Ttz=Q(od2s*y(#!dI?0M zQFMPrSGW5c_-8@J;IwXD@HV;UulpbO!y*k0zoW|e(oO08up{lCfma|*P_o`jYBcH!_;$E4Y^N&u9p9GJDW!X=2qJ4_Nd7BRf7hgaqYEnJ&o--cmW23yFJF+xb!$5 zL${`*I|2XcFcVZaANi(u^RO)eDa)x{U0GKts+&OfF-P}n{5QZRP~8lxn}zKUkaCFn zLb_S#K80>B-`yO=|B~VC-=MnXtZp@Ib)Y#s0&aibV)JlzKWxPPVRW^0z`ql81?lFp z-LLQ$2A{{KV`P$c3usruHXOvV*I+(qJRSXI-X3g!L+%&QguTR|_eGD{c$VA#9BC3T zdAQggvAPlbZ-MHN1DnLdM=4%sK6Hl{p)U*q{k=WeCi0w%)bcLTTJ)tvng&cs^fiy; zX!AbI1J!>wnW8k|Oa)iMHVQU)paV|JK646ATCGh7!-MvVhh87TZs-6J)!G z8~J+qsAG?FU8!_>dmP6nCl}Ppf#$1|uj6&W)&t_u8zjCc8a4UC+E!EZ6>SwTm2dVN z%D+?a{|MHB#>doGN;vn+JU<85g2Xq=YAuxbS_e!MN2dZlQK$#1v(DlOP8UvK@1$9F12ETU~ep8bd3P zxsE(*Dskn*S?aIoBdIw!?V{}h=4-p&BJ&Jw-hgqS>&@nu;;qKE38d_&j-Xc-hS~KN zZC&qVN9IvZ+(+>bjwEJK-KM^jcQLlYAf=epbCWld3Ry^7f7is^?7tR+Hoz8Zb@|WrM&&$D63DK2B5l}x=Qi>m-k~5=vH;&ZGv7G zcp7y3&9%ByUgdZFU_23 zQi89aI~Hfpa~2PwjdFBz;eQ1b1>LWBBt=TjM%Y@z0vJz>vp}}br#4>McJk2j97k^{ zzH8wJ&^&OdMvC`0w&1ALXOovYKe*3$XOC4pBmDzrIr>_zq)l-s52{}s{Yy#9GuQ^g zRFE=?TJpS_coVE#7Iks}&pA1I^YK{?--GVAcE1an(ezhv_uIsvfC-dIkDCQqeiM`d z-7Yo#ulF9t)&e>~TTmTY&wNe%{XqAt=-_~<q zLjp$L9n}5mF#boO{u^oC%dPHpZ~7lfQQsh+o&73ib@lq7yhLyU-F$u%vl9Q+upTtt zYF2lzXi*MP@0ZVxZrR8DJm@?witgoQ)4HKCbVRrWR9EwR12!q8sY}XdN4IM>-8i~s z&@G&5!L<_n>q9Hhesrn7%zG2t6j%c9!$**b-lwpTeze+ZpUnmBlEVY$X(#SYwD}E= zg2r9I>R&UKc%d?s2N@IP`kM5Myv_akPsW1Ob&nSU=4Esvep^!;|F-Z1Xxt5~?hI@n zf|M_)S3xE8YFbUvm!j`@i(g_yz|25j=Vj|?vmJJW#@$04*?;qoW1Ijf((l}S`^xF# zMB=4@`NE0&2HM>X^8TjAoe&{(E4;-yB#ego&=}k~c>^22#4XoAq(nvqQtx$Y+{*sQ_W01>MOwAXEb(w*GN3G(7*TAbU&15daj|}ZJ>GS;7fXqu}Nt` z-Aq2SJ@q)Z%*L+$JI2L;7LIOb{GW#zpmFQe_ZYVD1fDm9%itO~f}Uw%`--haTYu*w z`XdsTH)sW&(CQ0v9xl&m%l6W7Gcqn< z?ktzyPV$WHaN4{EsyoB#eu7QPV(NkTxqWPw)z$43N4KG)yMi`5pytH%c3SPrdC>&N z8Hht$=mx9N%d(m$ZGFT!zQ?$DlZn2T9ke+Bfl2>%91h=%?M|o;(yvCu{2Yv-j!xt{ zE;_os9>J$MJPx}4`2$9Z*AZJ!kkX&p-Cnv6==PEy5#Q(N4#odf7!9ghIFOR^-oZ8( zK8H_0&NKD>oZT@$R?(Gn!6drj+tU4DCH`w+1E}tG0bloLY`a0qL8)1H-LEuW?FZ3G z+#g0aU&@<)g@0%=#|}{4I)T(euOPN!Af*KLu~<4@)zyBGM7NZqTLyoL_bzJHZDw_A zVtW{*G^4(dZgg_M+~ee-75<%}8>nt?t2+?e%OGVmweGJPtJHe^J%R3nPP}j9{|W2{ z)m>+G>rEj}=mni1+>*H?h+c-Rb!>@F4VcmBYCju;{|uN7If$zWDjZg@>qc_NEj z(*x#DbR(&z9B1%<2pU2TY!Y`Ht2-Urd{_rdVI|1B&)S!lS#5duS)bpFzsLQw@>ZN` zKW&b|2@qM)|I*hFhNdx(0o{JmDoOkLwAX%nIm;uE0lMBc=Ux?TwV??-4DR@~!&&dt z^~sq5(+^!8Z{;^uI?$#YsBVS?KtAPnyQRFyvSHxvXGg5A?q_jyS2((F;QtQH0M)IL zQZwGi*p|V1_y%0vf{&j&j+%k+Sx-qLOzjx6G`#_N2yKv*Jo-N+kY_4;ltMQJa%?x-SRQFk{yA#_% zI0iERaN}*AE#Aoc%nzJ+FXCW*6%+&2y~^sA!*&lysV;T#|2#e>(S6F%t%ZLRXaTBw zeM-rn=M54)%FER5eH9rSq-cLg&Iy=7P9DbKp9xDqbu0N&UQQ0gdEq+953cSgCl9IT zzvc$`+lA@;mchR=R0Y-L5H7{5hpj0{k@ud?mj~?+=7WHl=jc98yKc}ERJTV;$#^ed z8x2z4mij#TRow)-U!j{T<<0Mc;J*+)1=Z#9pcHQ{wv8ZV3$+~6bpG#WH=WOx4h6BFth2m{ZzmObgzfGX~wi9n1^jg3mNB1JDYi6^Jpg0tU?r6oW-iU0v@lOKg z6uNqxd<6feU>az=jje9K_sK7egHa&YLi9c1)mHbooioN3Gta#vorhn=A9jK2PD!P~ zcqg!F*{4!_cKepEn%0dk37C%P zYAKKZeb4|x80ENV?~8`N!L}K8fx9nsYE7O$519GrM6A$X_!P)wjD{RmXJ;_A(Az$j z;{}xdfO!lQfe~mVK;oNkYxnm|6DtFzdBt>IN73dTNJ7}^&yaxWw+kuD0g(ob!j(0W;arpFx`?a1=D| z599+Oe=?sr2yBIQu!C3+*mzIcTE;OMccb63vF}Xx-=ZIK4Ho)<#$87~pj+)Du1iB# zXb!Ex)$ZHY&xzhMl}6FET!%ql^RkpS>)?t7Y5iZU{(fvHAY&o@0t&%NH051U$w?7g z>liHh@eKj-tA?#EG=qlV=3%PU*F40x2FxBO-d6Z`hHjv`oviM&*am?Vx$o>A_p-;EME4}R zg;U<-k9KdtG*I0oR(A`w-S7__1a}@d-^s7c-xI$COvc^m{9d+%`$KR$sP4~Jw>LH^ z1E`+^ckEbib)4T)$xZ11?VD zLtUDfDuKjQ+tw17{2oYjN5ITQx2${#rDl@;0?&Z1??|gV7u#Z31IytgT5|tDbaOr7 z*Jh$WPR4cy%vLAfUHBh@zd&`zn^f_<&zSFml&h(0qNTc`Ek)wJ6zwFshtc&nEpui3 zZ-%m8B)cou&>{7DN&wSPNer0|O82NoC-LI<9t~S(jbUAcL@fu-!45U0x?e}z2iyW~9^zJ4 z^N>JSekV)wP#OPv@F=KmPaAJfY<*xT#KGNPM_OIoucEsdx14z2z<(Zm3938P>Y6WD z7bpZ5gYI9l&AxNuO&!aA=Xu$C((&Gc|GiKLR9E{$cWlqXP1hi$y!Wjy-{g&`kA(bD5hZL50)+f06gI%^O2v(eT4xHSHCpfiNg zON}pfyM>pd3q_#-xVn9+E|AubFkICGJ|MT!QsO})E`_h*@e+Tnm3amzJ zi`Cm}YnfZhJ&NRkfEiagtsDG``6%2As{5nWO<Go@5>fvfZZIT69ytZ*(YN z7Ne`eobH63PoCq z&gS@>YIkmvv@xqTOHKS(zR$T|<1pL- zWuPlseXZUwTg&(^`(2FAzYX1p)$NG?AeauS`;pbXaSg{-s0Vk0T!+|X^>)}=`o&!` zPMqfc6}tJXZZG_Y!i%7JK5ccUV4DL{KB4{`&i9;y^yRbn?al;D;VNnUm9$w08$si~ zI%i7KYyKU%f^P5xxW}c8ZhoG1KQW=8X^O6vIruMvuOWm{`bSHDVR#?5e<1L^zwP9` z#9TNPe2TFNoi2_}K76i*TR?SMS)IDrnm{XXk3kveMEN5a!=3f)iO&#t9W;*#U&q^z z?F3x4mK;Cg(uR&=MMhtG&Z&>%NxA6Ey!gx}EVK2(N+a zHV>o%_m*J$8h(Pc;Od5-_G4Dv_(efet!g^nJ@|X;IbQ|M$3r$B8#eHJVBr10bEDMq z$BAVgm0>l@X495tk$ge34gGw+hRLK&5|)F;&8{cKJBlr|5nspyZrrBFx&1bB8NV-E zEgg3;{L4dS(6~=n-6q)Dz%$SZx`C@5vD%swX_i3$YV@@{N1GSmWst*$>=!rq3xiXz z%>nJpVvgqzn%kWAAF+HnY=aQXrTu;4NE)u##5^8Kf*V&^;))gsns?AC>-(Bo__Tvw zpzB%BU*;{t_8t5Qn_(Nc$Fh-jJ?~|_(&r>%mj}(a=xcw?y_x+Pih*vQ=dAwy*dBrQ z5CeD2`Yu}zBUdmVan}DC{71kCpmC4#b;A$-NIqaVNEtw#uP6H`WRa}0)RCe=Q@DD1 zznz26cK8ca?_IyS*ZL>MJa`>?!wVqWCKDYQ4?eZEo&!p=L?mdcps#tzq|GAu95fFL ztp1PKcEUl}3+^%Uq}A5G6uCBN1~|IM@GrQ9^#P5$l-+MTW9tpC!yp&|3HC3Y^X7f# z+#+R-Ctx2O0Xfgq=YES={jWIg$ect%1Jxa9b-QBg0Ry2g$n{9QZnEC$%08aD9*J(Q zn(6uE%lOZLC7`;Ct?mKQg1o=63|g}f%J?C19TZ{yU3Ap>?7!E9vb1_5jw+JU0=$33ES%+Wde1Bo74A+ zd{v$sBoDGrM{Wz6>geit@eckU!pESxrF<#x5Vq4GCD$(gAqScV)jd0ptPnJf9Nql* z-v~E>>Pjvs-oLQb2PsXYzJP8L-Hwj#=>CEKQ8*2%`*upnc=>j-zran90lNQ| zpufbj#T&aLXg;l(-rvgMUkz%2>Q1q`O|i8FDP5?$qLuw`>dF3=dPb#U(0pGrt=kj- zq3|N8?kr!*dk@=3AmuCSzUYpyacY0i-{Xwm$-J+o?<@a)i~k?6A9C=2=?j%*0bldO zAIw$Y1V}kZE&K6!t38W4>ye33t_g z&RgLGNI60+^S#~Z9OFw14?wSZ(EN#BB;`S0Ilz7odqMRw1F3~MZ#l%V1=@j>7Sx3Y zvP~f$$%#_Sc7KTNA`f$|ujTv6zo+occbIFUz*ncXhrNy!E`#lEs1B*Q{UBdwJarPC ziylbpJb+I_cnnl$n;&1e8@9eM5JYE|)mca#Y0G$wj`qJ7@EHdaA#CHR=zop32HTGy zWgGPh+Gih+weLmS1S{lXqx+1L&u;klg`uGNoac*$-@%p%3&8D% z>m{EZIA3yfKF4PbtOXe!WPe-d>jZzpb_i12ww`Y^9fRg0r~PS`=l%;H(DoZ~EktVN zdA)qt-57Mev_3*iQljX7dmi0Fj_wcm{ajuw) z8}muDqE7@(ncC_3#xQ*5!ZHXGm*nkpNdV*P-`IkGv+j@wT&*I5{e7g4y{;MU6g2l) z-IqM(oA}p;(axx8QBi_El|rc|UKuZ7`?~bcslyn@&>7(9Wa6_3mV)M?uCEhZhixm!v3VJ7 zrNnv%&09`;&Eqboz5Fg9CH0yA%XjY;ZNqKNT?=;UlgLfva7xneLcpzX#zzSFZi(xz(Q(*<`u*~W< zvHPq@CSPV8tZT)o{^#xT3V)y2X}>ZUFzaC>XusOx$Cvv3rCr!{ACYfO(Eg0mejm&K zfzzPk12r;$NZO!rxIbv&-EF9+{HKzS$))zN4mI;?+dYKc|*e|&V%9CG3vfd6Rt9CW?y^E=^k zIk|TQ^`Q03jKLsU^1gNC&7j#-KONsde8#{W(D?cj93}Pl1h-({4%wftuJp>e@nxZV z6kRR<&_?=4ZZDlrIo?o$*I+9N=k%{J%-Yd<3c+ z@W0fno15PtfTy56xcflfk>}_R>jv1=g-4$D#5KFr4+TR z-RV`f@1&qv;OJGyrydLh&0`mUpk#~Zo?8E8#aBcjXLKo2O#3eo{sozZ5gu7{9D3UP~CY}_ts0;2G9^{ft(lQ zecjJ(VOwjw$?04VLs#?r68^8k3{YLVt`u)SHYrD`56frzg7gR3r>0w7eZD0&gZo~N zZvIR8Jte3Ls(Y{19f55Oya$uO&BHOPD}R?po}-Gr7c|8iq_^8<{C|c&L3O8EUHQ#- zDJ7^g8ng=s8XxgKzd8meeW9SX4yVUCbi0wBx3j4s--DGvOpT%bd&1Q79 z+;myM+zt1G?jJS%h2iJ0y#V7u%4^i_xHW7v{dsoK6neyOApg$B=R^1&biaMlUmU(J zKl=mR0j|ypbWA4mP)FxceA+@cP@Q>JXDGJUVH}8#-aoGS2J<6yo=3;u#knSe&r(d4{qMtqb2=Fk7MQou1lbs&u?oA;$IS~gXZmLt9t<3Nhnf~@d*mT zF!V-2VVo0IyNxqXN_-SFna=v(L7V!}6mL10(tIK*MFGRmhnUO^DJ~5qAUGsD%-Fv{uALoHj3&V zwz`3<0_I|<2sgoWv=%~H+I>ge2|evs$uEND6Lhs4#{V<~u1?QCp0nqF7h$^sbl*v} zS;l#b(_YRWufZn*5{?{)d89(hx#y3xJ48F}&$r-T6`loMpRfFO-hON+;L;*&BXGyV zvTvogfn2Lhei<~mA5DE<>YwWP*M%5pKe4~N6&{G~Wf%>*PO{Hsp&8}ND>*vT@L2+X zf$Cf>ADAyUy@uaFgf1XD`pkFP@y5hgaD5sb9S^4C^9dXWUC-*ijyJR@;|ffIx4@0b zOgMKuhdZnYPyBV0>NBtUy;w7yO@s z!Jv74*Vhft!X{-7wVR71nw*50U(nI@{}P{{puqL%_1|dY>zKiBGs8F-2CsqKqlhH@ z7)#sw?6D8|_~u~hcWYFC3vKqoCB@VFT_w@1{|sy&!uODbuR-sDNDlTU()rcv>G3T= z(~_M-$H^14$$bO+EogqfvifzgH3ccHsryb!j}xLVMaN0AHE5o8bUWc6hY6s%hpq12 zHwH`%XaWy`t2>PEaCPHZL9+^7?Z-&sNFF*6)gYg_+x%$ zK7el7lsDI&@c$8RrejK&EHdq^?g4Bkp;SqJLkWt2`!_9i+n75uzV!hq$sKIRCT#1} z|G3{lo2jrIH134ezqeGtJOJ&W1-RSr*knH+dAPSL+c0Z)(6m8U`^O0U$H8{cxYt|V z0XNa_U=q9xqrmOY?Wg>E|48iN`7ZRe1WU8eLP3xe@0?qqpQcmQ<0yZNr(W7yh*lrB;i|M&jYpM0kJE54Tf$G+>xTb8Xqp?kbOqdStJ~-9tYP<<_P4iSdsee}D|0A3L zJ?@h#DdE}`xHbu`z>W0?n(^a2r;Lu~a|k|f!*L!dFFPm-#`Lhg4aRjjxi24 z(g#M(@N11xzC3w?;~e@rt{hH#O1d3MVZ|lKjQ2xF2wfHEX<$I)$ z={ONT6Exjhq>o2+Y10DwgX&LLeQZad;GN9LsdG`wyXJZgXSLNI!q|K{$0aGzK*$Vt z^lzt4Eoca;zuxN4!L|rC!&mSvoOJYa&Gh4!XTyVX&zTYnh0G-MOQinC^KG;_0eSCA z>)ZQ2-iO#egYED=Y=#nO8rn-<%3J+c^w=W$UdVjn#QzU%PDAkSbpN|iIwJi#f=x?? zd@la)$1Q!|A;JUR8`0HL0{`3LE|4{o<7rc0HyFn@0<`Z*n`GXQ`IGkAFUGKZHtYn= z>l7Q;_)6>#unrc%a%jN1>UN9S^>+J3gp-oOvGjO(**(l}pd#pg_q4ydUT192LL82Z z%~|g(t3A%Ps=bm{V`@+NJj!XZ%I0akZpWv;crT$m27uKW&xY_mz|rp^%xhRi~A zbw50S|4F#@-n8yst2-ClV)zD@gR5J1wy&%EVDj>i$sf1JVpim1H%k=AYGcSUbM zwi9qk74|=HbtCWly8G$7sb_?*3YnYG)p+aRKLDnIZa*#!Nbxc_P?v>&K}Dzxu6Efu z=f*6J;+zZ)MqiJ2U1{?+ECtQ;NvnT-HQo(}>Tnmh&l4o9wm$EdWH7t-@w9GR{CmR! zP~FGu{w&Y=-&~z*B5*f!C!P^y{8&wP)n<|JI)N_Ajjt{bVIGu`Hj-1HVg;V{lw}Xz;+TYufaQ} z;GQ3>c68b0 zR`HOTiLUmuIrz_mpFnj_THV6;`|(Doi^yju-Yr&Fe;Xp}hLHIdT`kq{ZvxFBh*8G# zCbDC5-Ki_KKA`gxF~)8TnJlOM0G7WA<3Zco_p*ZXu_eJh9z;rn%uy#_t607j{sCRD ziT?L{C2Dcq8SaGJz+JDtTvV2ERmVS5GGuOOo$fca@ox&fKy^R2y3??I088OxaCOIL z)6GJ+5xTk^*5SVmPJ`fd=X_L<97X0_ZU!c0JeL1h>gWP+E`{7=Y^)B+EuUEp>x}73rLgp?<_aXdSLT6Cj zDOOkB+j$ZDTQCaTd{)e+n?Sd*qdOh{d9W5#cfQrVq)xzG2_@k=aCO^f(~Xu5nO^AX z_OFS58yE|!`@QPc<=Q%wh753ZH(6aBmlOO^fH_XQP4I66-9dHB%MQhMdkxzJm<`jw z)gALuw*BC?konQk{S^Pzumw~%YITd$W4wpEpd7fmo3iO9%7@G`N4FOK4?`1B-QiYO z^4kmh^N>Big%_L~Z?rvCK6s!9Qwl6`-8fy95yz+OMk}Q`# zEJfxma(s&29y0aN)$#-Wzrqd>IoZFs1t=x;T+%-5?l_gCeRtaHe)Sj2bJXWN95k*) zHm)w%`oN1Y5ZwK$gk4|#jhjS8_Iqc2=it8ziawN{Pi?WfyRaRG0uOUf0CI!7jiy^| zovX{r#4CkNi+1V$+L<IoJcgO%kzgmH9J#2$5;KrTnV?U?bUn7-6<|T9^sir*R z)_`0F6H8W*%YNLteNN+_>9YZHYURd9jpOm5})vea&|@+SG-vpm7(I z59rUqwg^_j7a;vWww-MM6;@k+7c0s`d{?zk$Gr#tzaVGBw66S3ThYB9+bvK5oHn_iE(pdREKmv zexS{7a2!;>lhwbi5#ug2gPQOVxcb8u`LXL9Hl_cskU5NgME*nRL7Txa4^+R8)i2tZ zYsXL%%0p#v^>&>LhN6`QgF3JH1Mo4h|{&Y&Afg~Yog_?LmIpt>!r?f}uEyg)rfK0A3HV|8^KX4T?2{X{wsv+-XH zpM%KB_WN4I$iqL_ayIj|FQvW`+h&DM#h|9>>pVX~n~HD`sQ#Z;zZ#Ti<3CwbwVcL=x5NTGE@WAzr*Uc!}c^t=|epf+_6^U7k#;BEhSMmWIlHC^D=D` zkO{h7V<}JLoyL}@dB9u^1;EuVZ)4Z}$J7s*(w)-#Pb2(0!w^v2$yRqUww16JU2kp<9ag6t;dKWsub9 z>hVQ1rRbQEh3*_@y@%sJ6;^}J=kbAbdKJ&HZIHmh>yaU%wJDanmbVv4Ms07lJWt38T{(IuV#1^9dc$3gSo)Xtk; zdV={sybser)~68~)5%e5YB&E`okOMqx|;t3_=h@iogP&8RjXV0NzNPKUML50U$XpH zzFySU+V3LWLZ+@0?|A$ZumDu|2djGoo0OB($Ak?3eFBLyw&L7)ljyc_bPIK6ZVK0d z>b{mzGv4jks(_T5QlDo((S8_tit*UVLtXq^Kx-gvseUpsrDVME*rtP&52!zp&*#zB zT!>%v>5v(XenkF5`HVI{!!}U;&Hf^8IZfRx(Q&7gF-^mS&*ixl@g^+=D9ndjuC z6>WM!KT!RkFX_qkg?F(_nM?h#d_GV7nwykkPp->2`bpY+2VU2-{;gL34Q!KP5zK=5 z;Oc*uZJUaI;+c>McTM;2qqMoC8^;UK?W*VV6|hwSDK(|OKPgiOX6$$CrCZ7Y6B^nZ2YTtu5yupKnc zi|x2wtUJ%+!ENB`eoCClej#%Q4`k?ZvmQPzp+9IIi}*U;LTt-mJ*);-t2D<{iE$a% z4&?eloRirH?Smc???L=eL9j=<-(2tO2IcRNXJB`aYmxpT(}DK+q%q|tmRE+Vp!ti~ zxSqrI0!Vp-dNRm8_gTdB9nKP$6nDJKiqkKh^_J&JX3=gQ=z9NV_4Rp@9W0aQN!;~b zXxCe}P3-xQdBxE^MVs6`IS&EVEg&0+dD6q!T0j?Q2d-|e)#vv2E^`uG(H1hFlc<2 z$_KXB>)76g_uw6Hw^wbnL{sC-LU$&*kyKNTWB4zErJ#A$`y~gl9fdr7*+-~D)UI|j ztF7mjBAIw8WR^Q|Urw9iP!d$Xtc|+^wjS^T^n-!m>i4z!?)jN{C1iG@uj9gNw0Rfi zfa(vk`afaY1;KtiS518a+&qu4`nr!u{8{LGPpA7u9@^dri$V3}-8za_i34Cw=mIfl z5Ayu?c&j_z*5BH5DQOgWBV?MPUsnD@xirqc0uO-d>wS_!&-2U;RDrTk5#0DIuJyO= zCPzOyHe|M;ujA8r+RTIXAYn`YyUd@rd))?*cX$g%g3L=Bt@AZo+gkQVxxbwp&vjyS zb$?lc|JQIDRQG+W+i@Vzm%?y(9^9CBSY7Rp=IxLv*gdVA#D4?)1DcP|t?v7Sm@~o_ zSP9>Qt37r7xqV&oo1Db`K}Y|l!JGrZouF~+?_jsZCZz*)TNb)~vHJ#JTl->Ua>zV^ zuI9NXZHB-Lpt{w(l$5>N*;&+Dx2Mr_-`3=Nor)W^Yn&VQ86#o2AhdL^fY%o-=| zyJ=e+I)dsSxB6SK?FMfcF;mOm6qI)s%m3i#xVo*~>!$JPA+rPh5~(b5UO<}$@DgZV zD*J%snR<2{Ohju(gvRJX6y?S`!%ybdoy!A;CNz|il@Q%nEQbC$^L z5Ob1r9_HhpgzccZbFFU47rEvQH6aS_-;kSXbu|yM_e0EM(*5}f{NpePRQEHh`!%*7 z;5XO`Zodm}_T$z59Gk;^R!8?Z{+Ey7o+4CQ3@)>)T zaSf(`Zm;$i`SI3xjq82T0h+<%;PwUi9Xiq0oJy-0506~d(*{kof;JoBH_*I(;OmF; zzs@xZxB*<<`CHkq7KKb1N2dZl|AGdfIxDQs0BkSASa6RQN6^Va=YDh|Hl*qJd<=_0 zw@*cOb&B^Zwm(72aq3Ow{NF5)b<`sFDdpL~#Nv=?g|2R&oTKQ|P#!doovdyW+iLh7 zeuQn{_D%WiJ<*qKB+t@Fi6yz7ioW*y>qc{Z37UfHe_{1M!uC0Ag>PXa$UC3w(Jjmv zlV$bY?UeOd$h_<1#e0K!9Fzpr-)r@+f0KI?@G{&7kHN?+=0PBFPq+0h<|&8l{5$?t z$o%5u=O}IRjv+^&`c>?C&N^(rz!hWpLdXT}e`Q|>(H~}OJvNgblUNlpJ)TLAXM<^z zfSI8B9j*RKY#ZQr*aF+Y9oxrj^S|d$wyT^&N{OuwnX!)k5!zfej`

K0mb}#S4t* zc`v8|rJx*4M{^;_^^6tNvL3o`OQYn*kh!^6I{wfE&VS%0(0;kn>bJx8Gz^A*;P&yt zJACcG$-B%0qMJjeoufMi|1V%QXxv?72O{pOZ!!*+zfWG$o zDYRJ#>p}HrS^YOAa!w52!2(zc?wFTrrysk!U1Pt5%mGKgZi4ej=mDy~#p;)v#JM?i zgQn05#{9h7G%ybg-K!#NRkE^1f1gw>Y3tVLf+d=JlE^iJpHFm1ePoWFwVb4yo> zSN>h*8_){sKr{J2$8kB9OWu#|@oPD6RQ<%CobRHq@&81d-(WvzUjDNBf$8*dxC#nD z&AsXSI1TtL-yzQlNM53x#J`5F=KEUwD?%ku-QreP?hieJUCMvGKZNdVN4FX6IzvB4 z_fD((DYg~xBYX#Lu3Ou9Wgn7wBL{d6&(ZxI|IiHP$DnzxV|Bm8wif<@U*Hdr>)o2? z?vA#OThT)ya{_%mZanZF`!{?Js?V?{#p^PYYp?JgyZ~cB_D_9Zpx~c=uHEBCz}iKqQBqK??szYFa}h=rq%x%+YfLQ zvS1Im`rRFU$-R{5(U7^MZ#w?a?0|_t2B>~VtKSh@PmnT*`Zf7nJlz+iA4-w<&*~o! znOo4;{7<6IJFpbAKMu0`_rC9I*PyN@pB?Q%Hukf*KM^u@oVZ)y-xGR+>atr)@y1}A z0`I|b`3gsOzLOK_GYNDDJGvjz=41E*R5!05rWcswf5=UpLq0pY%d+d944G+;Zeje3 zz#X8vw^`liMT;_=da!(Uba!OaO`ZywuN>X+_`eJ9f$GxLrFcuQt%S|67TjkW!u!*G zPsXU|>5$3YFFlTA;lCdagX-=`$?}|WCSwywxt7|UyZSvMeXP$y_iA*tKa{}#4yX*O zd(`SagzYit0Ik8*EokG_{t!JAGPgRqUGeV^LqK%{HV>jZ1|~vw-HdFy33Tssbf?kg zL--U_H;>ho=Xus(-vIJ^m2SM{v*~h{XPTm0)?Zh%g*Lh8a!du)EnsyY|A4U;hCv*v zqt(FbwYK#s<~w;4jHltS>4&bCzw!6xaqR#Qwi#W>VIhU zCt#Za>tG>#3GxoYAapk|jE%JV?zkEE!sdqOQt_q!k>54gN4tX{BcJ5qTVFqTzTY)S z(!L7q^*DNhb{7#)QPB7{*!UV^dmQ@0lh6YspCe-adLOXy$uUo#H%R0Pn+A^lXxfa0 z_d&P6=MT}|Z`h>lquv85pd zOpv%|4e~YPR$JyR`aF-x8#XJ@FJbjJ(B>fIUy#IS<=p z^_Mf=Oy!s%C2~pFJl{V(K5V7UemD)9mr+)~{mb|-WDWo~g8c4+&G53_A2wVZ~IN9Fnp3Qf@uvzBB`yl=u;7QPY^AiwKyail$ zdmX!!3Dh&?Gx=VDW=-;;W2MF{ezD8K=6Ce9d`O#>@C~RwueeJI{*3K+&~k*&GB=WU z!ejZvreHjs*MC@c$tRrSg6i;Ur4&!zLwyGO8!!MyfP0>@K3i_3QL;eT+#XMlXR~SZ zF{}j5@74A^U=iI z&8nK{Yq^>>H^D8S`bB9=36{fl4``{*XB|5tSB6a&bSm0~53sBSbOF_Q(bw@NVVezW zU=e%;ML0Rp-{LO8XUV~}Y_D>%%_z~U!{&7-4_j%o7Y=~t_Z_Q$)e^3Gft0dR7bh+> zd$C+}rTop_dny{IKu9iyp*Mf$i$G1#hH#`X2NEipQA1oW@>s3cPS~P5aK}W}f zY505y3qj+%*8dXk3v6pZ%8#wiJ+AxFrRO(EbpJv(lJe&7_0et*>;u)UhsN^_NXOd?|A86k34l-){9^!ZsE@ zgefo+T>bFh=h43|%)PwyJYpGbHp9=L`t_{-*v~lkfCKO$B*7im%3J*h$hn@sM0nXa z>BL{+bIzxs5~w~hQoIJ(Vj!gh^;2-6+>2ip`dNPAYFXGeDd{wrWLsBRsb=S|qQgA~~xU0v

L*MF`-7l6w(=oWCf26^u{ z`}_Z zSCD4d1rqN_s>H|i;NSG%89n6>=;6Pt2fOzv^*`E!XBGM$!=B6Gb2$`9{CE%E37&jH zG+gVS6Gf{%Ue9_XZ{;7 z%-{4g1qVBlEkT=g|AUluvpop54nqEk1+jg|#d>XG?M=0>@m9dE2h97bQ@NE1>z^id zwhI1sRFwJ3yT{L1`J=&EUc5c>8Ser9D0mz6Io3R?zNxIJk@Tr_{zfuSAy_Oyeo#TYxc!7tfP?YIg%vmKWA z+CKC3tMBYeDy^2y4>zB=ef&Z>5d}=QYUd$v=XdUIQR7j|o4XIG?Y}C% zYv1uLdEa+ujB1lE%Fw?Zaw6Hb4$0g$@#hkr$k{f9y^0^CCG#hR)JSXO#E}(qR!mzt zZN=mjBP+LCF|ur=y*jl?pZ^lM(&xVdw?bKdyNSJvao{_2BBcCnR8q=+3fu}@ekV?! zeG1*Kjgs;!dt&Mf@LPc!`Q8sI^_@|~oaI+gcga5noXhKr5n?3!#+VZubEx^Z7}=7% zENj`55>}Q_4Bz>1s(wqmmvVlY45)u~d~VnNwO^Ipdh0Ob)&^<6d2#;rJ<@gVB`+tZ zsx41XC~ZUeXOYoNe*euyzEN}Z{(l?(jo_zoNREy7a&~MO7rK9#dZdiWN!nuk9|X^~ zDO<`LW3Df4j?s9@A>%pbyJiL&;S(Qj5|+_(+v7UzaqLCf)BLt#L3>=QJ&vo3SVwSA zdS%spw81&@OI8kv-@!TKVJ7|2xa2!Cuv3?L(lOv&ux0Pm&Wphd(4}u}sB_-xl*YVj zNs-={w6yZvSSM3k7rT;|_*n^SyM4C0)(NtH+(r3UaL(7lV#h~`)g{&@?eHwQ&vAbE zOh9p;b0+D$&-uuCd=~>gCh;EtZ$bKX2|o@#g!Fj@Za)b&28_XK?)Ho4dWO_*+?V>V z0%!eKpC8|CbF{*c^)KRF^5=sy-|t`a@wFV1@?NK9`R}05`#kPbr3b;U0_Xb0pDeKQ zN8qedej5Fo<>kAcWd0lGR@HZCsB@)0w#`#Gq+Q<-V`m|0^Fzqh{N-Mx*TLV7=A%BTX$U2_joPG75p1afk&J)-gKKq7V?;Xd+`3??cja8;4kixFY%ekFNJ@1lD`6cHEGvv=|kY3bN)d>dYtK8ur9EEXl=hcc`S10}f4fJ%#M-lrx=MSl17~}*|M%e1 zexKzidF|(tdyM_>1DEz+4=(L5vG)I@NB)5x`HUTp6F8)2Pd_{?Yct*yepto9_cdnoO^TZUCsRAX7N=?eoM-W&q(-|#6Krt?}O0JyAt+Z-E&CaoA6sMiTBo&k=_S>J?H%c z;%~fx^|5n+B>pMq5)Z)>Ynyh?Z?*X3nPz0Y)^+WZ#Fua`@$CiHmZyVDTULX!Eq7eX zd&|MOZn1N0iL)(^S8bWs;sg2_vIld{b&KEJgN?n+U%;2V?tz@+rGvrx-}O;ik@)i? ztlXd3Un2>>4!+}imxSL8K7h3Cao*8B-iw+#Gv;Zp_new@8@0(v(I+V9d}gdl_k#E4 zY&#|Ec^c0#tEmD!52Y+jlUNcFqU%PU4{gPHDzW3^+3&AIIX8MSIM0$GS{SqF- zvN{ZZN$x*pkC87SR)BL{g!U}=DkIW0bnF6>&rjHR*o|}<56+`G9<=XVaJKKmlozk$kb3#*bB-+a zEd^(N_fTG2eO^!!-`9h0fLHS0K)jTAG5##^%>{lGeSS}|FFGa1;NQWye)$*D(Ix*1 zaOP{zwK%QR|9XNcW7|J{aJ2okE146RP!^>6u3}E{n(>5CJHJH&yLa>2OF9tj{IhL9 z{6>cIj?n`X?t5Fr2PJ$Q*gfmxN&iLQt-u>4|Jk22!MQ)Lhwr*JrQmB%<||*~_Eiz* z_>@2SKgi3MvOepRa(&t>WqY4+qX%t~?CHgp-xPi>-)o=x#>3D0ref~|@E@bvO1}Qf z{NDQY7u_|+UzRWJUkJ|iZ^$3^UzYE+Py3w*05h?MtsLojVwagD0EB_f< zmhon6^mk{#W-QD+!>CZI%h1tdb6?knz>`~ z>lcm14--6DpZcG(-6(!7`t8FH1aGj{S{?7hxQ~;(m$#I2zR&Hwz*m5q_)K!I`3%k@ z9P07Rw^f~?&d?fDzj=RrU&h)z!VH|FE0IW+H)du8)}c`ZSPGz{5OJgd+A!}pVRAUAa8wB zoL>(Q`O%&yNN0O&&r7h^If1as{c`#GfyRRagV&K0=`H9vm*l<)-;nUagzc9HNaudh z&nKf-KkGy1w5s}h?TOkyYFmbMY|A;M%eHpFvCpEfKLO5rH{1T@9{JmQXZ%YL>{mVz|Bld}3PN6stVFg=T3w-UECh*NW0z!p}+@=5f{r zWtftrR;OO^AIhCV()R4mxoppV;EV8|^s*1e?~xygusQ?GGS>b5pZMMap99{SN_Hnt zzX!V-%ab%XQ)|FyKaXo?RefSrKccFWj&SqT@wWSpo_d~H)MLFo{?e`2z3*{2{P~oTnjhhw8;v?QHe`%l z#sftwS{o=Pw2X=#4<6uA4X)8HV$$&aCejn|#eYcrO+Lo6a5(+Kgtq~oN@M+g zOp?D4T=EYbKbC(GIP;%}{FwyE^HP1r&YbsWF;VD81(#wVL2 z%6KtihQoLZrU&2r56SGC-nwF+*67gzCYaGOPZl%N5YbKcYCOj>=E(EDtyJrAo6Es-M770J5WIoBi|Vz>;OQRb@jIDwIM7+!hdj&F-cYaYLwWV}j%CN@wK!`- zV^e=PZ-&38MCnog#2M}UMn5x~TBF`uIsa$>@Z(heg~=zCc{2aF)<(Ys4@D=DXMUa+ z20IfvhjePIhM5^Q>P+qob}nFUKmf9xALP6tdkES5JzE%qxyLNycN7~cLw3;lWPD>S z`ij-G5q?e?;?FS((Ia$De^r}T*+V4w^~Bwiwbg=2N0@hW`5d*jskE=02b7IvjQ|b|FmDD2 zRIge$S1ms44L@(L1;}T;75M))Hf`(6>Dt^@$Ev>%$#Eh75;h2#U)nM{c8$k!?8aS0 zANz>7tBSF52PWiLabBHDy?I^@J}>Mj>(O$3a$ZrsV6Fn#>A^Q=P{vv_q4f9rA^A0V`kJ>PBT0|2tUp-^)>Z1Lu)4TIeU$z zqFr}!&Uzh-T!wY)z3IH%U?ef%re-uD$c^u@+l z@?^fabxph{I?1(b;Omn)*5V0XbrdaZB6Fi_N`hAH9_A8IcI&gXHwA~V~PLWSQ0-%K<3ygeQ4k2 zYruFNGj{GS{Z^Kt`be|hY_6`FU#OZ7@xR_YqK}&<&3fJc z*Ym$Wx%uDxq}|Sc8?xK+l;>$@YTyRvwI7h5{Z!hod>K31kjJcpR-E*YOc|Lyvirz3 z{N3Do2wTVA2jFMD-aGPH9q%njWj$l`vN_tY);~=#^gtd4)2f58D&7tN*j(SiS^}HX> zhV(cusK;Fqr?5{7b44T0^u}7+$AoO32{bRq;HrM_LQDu((*xnGmRRSBoHtabcItZP z7l~xBJU~-Sh7FjNFTqgWT`>+(6#%iZAZL4;1)l%HIZ_M_K(5{n?5a zAYkvwIX^Jf2lAfgXGwYg&&~}UJTN_+6i}b{rqm~S%{>v>$2s(s*9|w-#{N@IlJ8;9 z4sr$CB zdk;VB*S-hQm+f^Au`7J{5I!S?>E3U}BLx+pma@Yj3F(}I6aL3%tqw-dC~0*hQpr;x z6&MA#)s-`qxb2i#uSli5qy$JRT=;ZLkcuVR zDXXfRig~%RD%@d+c`>*ZF_mh|ncUFo=2fW{MOqwz(FqBQbz&J)Q$nV49`Q3yq2Tld zww#nl8&ZmaP^3a(KNhKknYGI$<=hwZy4*&}Bfl*(>?fkW)u5!ARJ=|{NqBNE*w^ZE z+c_m)3hoYI9w>1;a-@344^y@}myKr`qyl$I!3}@Z0PNVxk|e9szQ}J>@Wyil&~;by zJP0_yx5s&IYjB?Du0(z@+TABgmVYxim;d#(JQE0hiUS0){QrP+dF4M0FUx<5`aS~o zJ=)cvBdjh3G`(DTIU)f=PJjtu? zUU1guy!>f!o|m=%F>tBxgpEh_-B0Ql zx4w1YT%YCtv}m-v@|$isR{juhDgXSf#>)S8n^F0b@YiGDd4<0wY&*96-Qe8+?mN7$ zc@anZFggM%^Zx&i8Tw(e>*EHwbU*(0nS!#vPfS=pIn8*l!0Qg*cWEBs4lS!{)e80l z%fsGlLDdSm>f4@_`m7<852;v}Gq60SfUfQ_d&VUPwRukiTz)6?)%YC#O9P5?SeK;H&C zcIJ@QcjGv+uV#HMKD)R)$!-ZI)VqH};A!BEz%PVv-Arpd=(uaO=gubL?WMq9x_M25SWr@%!Ot?6Y&b(=diduv`19{_&KEC}!J8gL!JQ9nBcRU_UnyDzXE$HqW40;slE$=%acS`b( zI*qU!3JTXWE%GJIvZPgwb%6QFIGU!PR1`Rb&~_J#iIdqeP3@YO(!nzfW? z3aySw<;Cw$*nN!IVGQ}FTS%M76dY*{h9SVXXa=XS_Jn$r!RH6UE92_~uzr_}ucN@m zmt?)msX#l7H;<~eLp>&lH=M91S+NP3z!MhuASBcm77a?z}VvXvEhbFIJu;ho2D#pS3hH(wUV12ubh9 zN^b^l2KSp0hUch$4b~p@g^KIN^W-mze7d%Yjw&RM*9k_!zA zvsP3&-FydRL0dB)oPw^?Q{IVldBy~sW6Njc7NR#lBd4!^1;3r-!?TSA-*=(QbDT?m z#a8><`QDfeaanJ4Rwef=yf4nrPqX2W&l;}f?0O=p|DT+5{ZB*QXOvzRxV(c1JRKa` zM&8T7n}Sc`ko+x#@2^`OVffw87r&C>h zJ)M^4AmeCI8(xv*iC1`I7&823g5p1}^#g(8!Yi zb_Pbtzmy5I0{+BtI{EvZ4{#^y%ws&Y}w#BwPf7y1rJjOnE zd`(9?U_jRMQ_j}YmE#gVrwQ0T)7qaeEcas3@qXXi&4bPaI~`se&{%9;uCYs*r`pwi z9PJ=wzIvg-{AHJV+|QMIjGYqilrUkM+7wo?u!fn(`*Pw7mPxA5xgwX>?lm+d+bv#& z5n`W7r|Psf2z%@}O(dRth}XWK+o{g&)Xr_!&aGjqf_;D8vU#MPviPK zRpX5nnJP`BJ>GA~_PqCg?$f~=3eJu8evR>(`S-xzh4HjU;{O3W4QI|kM(V}tKaug1 z%geuf!l=CM{U-5ldsUIz8!XJYs*M_~{Q1b0{$iT%mJeoyNI?ivelO0Y{E{M0^tJ)Xv@0=B@R-Ci)h85?u-?{=Obo%$$7op?0|?*}|5PhB@A-QpVyY~6NJu3P>xs#4w>t$&zRsGCOCypT^? za@~I=XV-o6aRqBM-+Id9pe5rsOZ!}TRn;14)?%kVHj%%Ng9$r@eD;IjbHI)T$8@M? zc$nXE#;2RjQ?DCKuj?eoxu&@1wu8IlzQ*6j4#KgIUW!caBY!t>ILd!$IS%U?Og@r# zFj$@>-hp!|8;xMxaLwgja2pQw7~^sBtEy9e6#HtGdC*1RQ#fB3P~`uObjjDg%vbl} zv`5`iS(kpuZ4T`Qn-~2(!gc7O_;h78uUbKFq;P#na%I9^PkxwmD`9_su$uJ!3H#oS zb4c5E>0j9YQS6z=A%*t^VMM9V_bs;qH_E>Or!=`n^D zGW8;rt)hg5<8L!A}Jr0Q;*+WJ7#oHuH@E zYs!79{A1u!-{Xb+hWIn6yVPg-QXh}sj?u?0zplLcdii%2eC?B8>RVbLt8W=N*RQ@_ z{>uu!`s8PQ;@|b)Sw)Noec;j`&ZoJ)ps$b@Usd2`*mF1de0(B#KkIR@_p>DR%P;j` zN3fUru41 z`}@L@|5wiO-c<=d40c~|TETao%6#RwV;;y@`KN+Q`IQ)0 z@=pYp{F@lZCExEUGr#d5>j3_^llnOYuV2lDR4rkuVnf8O$n+H6-pJod*7oK@hk-xE z`Pl*S?p5%YN$;BQYVa`1Y_s$+@a>%4!$~F9&mL7D0}c8GvKv$Obpb{E6Aa4uZ}4xS zz+d6h#9;pc2OJRMQXF)#ag5gmVC4P#e74o@ai8_p+6aGx@~y<=2q@-TmM170L&FRR zXwRSVEF9%d42XLN^Z`RP{KiwCdF}D7#q;PAl$Hnvcp5D}s8H%U2hn6`NgtzEBo z_TyTIpTcq^cJ)^3+5>P=$`JdoO~yBXecmU}lWV}AE&AjqVBb^w>QsIm_)p-~32*lE z_&01%NLYPu!RV}SPx!ZhPlnI(7a}a&bWZZ-8Ee&x7A)AQwfVyE5)GjBUd}n!t6iT5 z=U9>d=Yp?YE!vgsQvReAJBS5+H-fW1URnW)bf1dW=N1id^*r;kF z)8_1|hq)$(zXj*~zTk1cs8#$AzpWtZ2`0g*zfcXj4)h#j?j-@d#anFevcLs zVwwtZGcELTyo2OCvlF>l$9GQSoiCJmp5>tHsl$6|s{`U%f6w^$h|fsaJ!hMA-a~o) zYg!v5e{bwe8?VUYI}vbE*Js`jke|N?u>7ImT;BP`7|VU)d#cobEr;a0o-BVDevrPy z#4&^Ow18NXkbgeuEU&(s!Rm9|+7B09#0T_|U&eLgC+LzFVje#@qQ%v?&|}pld{N?a zJ^LgdeF}U9={d?kV%M$`AJc<>)q|(>lwaDzcP%UR*}f7#+Jk2m`p$hM`fxAuB=O^% zOYD8jjPHlfFzUYd-S#jny7kH5w}-!f4_|xzE=#if%QtcyFF7TJwKN$maQhm<%yMedii2J;FehN5HlylgIhvw#tFjQvw(H!aU2v?G-4sVUC zo~>;7FwxGeY8GGYEdZ?!fx-7FVAq@Lt!#1F>5HxCr~j*4F8P=9kh6>~J= zdEMI4bjUNmI25gF>(}`vrnR2J2kCVq%~{R0t=ilg660jAU%#FYQjI7+(p)<$mmKLP zC`Ey0P>963SMgEQWI< zs88XyK036kW8!YJXa}3P8jr1TM`B#9zcx^7)@Vg5c2i?oV^(7hmNYbJJyVHR=-ocU zzU$R!MlHn6Y-O_7knCUFjDfb608YN;PaE2=*b}-Jh0SJ-3X<*3bq0-IV~!ZvG`YwD z)a{%A7TNzT3fb7&z+fzH`)U@C+6dl~0Md{IGD+cZeu@l?PpB;{g z4er-KdnMhf&;XrHibGV5@OEDAtvOf9*%AdHq6^0H!6p9YGZ_9ly(~{+B246b@BRgVkuo0thmyw#PT}Z4wWf)1Z1b#FCYk7L2_&zPak*cJ0XnEKc&gb*0g;FD6c6`W$112Cgkv*DzrvJDJoBYnMu+AF_AARq1X_1|=c4NXjAEIJ|1Mxon-L3;e}V+5T`bkS>g_yNOX z#nClkkUZ@lwdNU3_Fe1NF^`S$EHhwIIyQT3)$EoQ*S4^VzyB-O%$io)q_(M15QJ)5EZ)9+49&9ym=V4s<_S7%*03cLOJjU*mor5b1HT39|%QgaR9 zPF3#KwXH^&m{d7==ILd=Ik}Em-HMBXAujW<2=4Xo1*H~dt9o3H(#_bbj4yp2dq$(v zwkS3-tR|O+SLUC_ANbDRi5=upfv)PWT+h6a+d`Qeif$KN8WhI<2yxo=Jp1(~TWcNw zj#i{TD}ha`_FPv?dBk3H6rRG;9FJ)yU1K9wo6u#f?V7=_x!`ccHPVo45F}4+-&j>^ zp4#03bZ0c`-D^YjuD`6-{6Vexsao^0K6eCZIzn4*{nhp61^lm#yt_8?soKa*wUIy8 znyc!~Ge)ki<#{Qt@oU{2hn6xEbu4&|wbN?M zDvfncuWJ{$)1r}Kt{CNqi-@_Sws$%1 z{#7L_*5=86owNPg6=6g#LtD>#1QlqplDKGi&4EkW)$go29n9Jb$z@&gyC z(O42SnH6%B_qtzFuvVu$8lDj{LNVUwGcY(be!_(32dTse&#c$$FNk@m=KcYVe{smG z*IClhL{_sobZRPQeIaXbaOia*FWQD|V4M^6(G=_p3dW6lW0cE+wy*z^l;<-+No?HZ z=JjFh_=%H7rc9kSedb29Z!xdlXPpw(4Gn$PyxjhA{ewdjCe64%$TjrbFvTb1(rLdo zPogQI{NV8LUt&(k8$j7G(hY_IgzM-X>frCs4o^yXdNfjB-_)E}#|god;o(hVo;K2- z{kW<*xY)c}pY7CnLldxvTilQhfsi3U#vhRN#f}S(IJlcft@;Lc91-;a1_p;wHfhqx z$O$1Y^mcR#4S8iM8$2I+ZeZZGv25(f;KG3>w}O)Y>@$qSoHv)x!NaiWzF!VgKHxoc(LB(VxS_ zZn&2iyFw#_6CX(Wlq4&(?q?w{K59mGXdt(y?e92-$g!S3ggW$}Av1(^!^3M+*&wRf z3?zToVcDQdFH+5rc?2%LGTJ6gq)Rpqd1RvA0Yeo-3(ZrIN_4<@M0bjE=yR0D4%s8f zDJ#{2)!rWs9b!xpEE6V;Ob*|l0?5koe>Sjn4y=(JayZw5Q48Z zFNL?0iHz5d>SI2ME;}pcB{5a-0*BNX~Y{SEkhCGe6Gh-!xH7`sqA-o-K z6T>67!7UBrYDk*Mr6bCM&-L^8Nt36}4|y0vQQI({5x1jxNb0!|;KX>_JYpj_z=?zC zJuu{92*socjMwL;veALTTTQ?$wfb2xF9t3?bx;>lOr(liU-fUhL~`UH1PLHAN`dE*ZA?i-#|f| zW~Q@5zh8Jr`aRKrd3H?*M=BtO!tWZWwSQoE!pM|qvu16)+5Ekf8<;R*WMt;1n{U12 zF1ziv+wQM5&yms`Vl|#TdFu2Tv#tnv1Fp{$oi=0UtXZ>fF^^%66;^w(Z!a5wDZZ>b>;%#@{^U|nqU~t07w3!=ivf13Z z^X7ddm96&=3=OkBO_{OL?0Z7qI1C$}$o^_7&6xEI^Js_bHpaM=P5M(TYg`Qsjh~Fg zGiMGBXo^HeC& zcKoVTuhXQ>vyU$f`f!OP1G+fY5gg^PkuK}0*8*=X@0CMi3cuy3 z)%zK&Ax7=rSzN#;>c*shqk44Ch_!DTw#0$Fup1ucyAkV%;p22LJaOXbv8+pCm(DUT?1bW` zVZww-lYBoa?O==Tw1HDcMy9^oJSJWzcB~10`B2C+Ke+%qKN0irpD~I<$4{R8rJQGJ zyzJiO+ve5!`km5d%-(p@dGqJb|7(;B%Mk&UNPk}`nkPCUL59ZN4D&Af>EOX}*E+7b- zb}ZX9#j)k@x{%W=iTVc*HZR6TT$VBMu%yp2IzW0((wBRkCilNE$k|i{gBJ!)40)kk z@EisWzcQ8$)wn7d9cP6+!X?C-9XC9Dp?OA-3vU=&lP0}A=nL(QT|pncC*)bJl`@K; z4+VY1Q0N`iO_=cMke7SOP8t~aLdpw9TN-2TiFs5`^?hL`pZ*K;8iSLj&1ubFwDpdA zw3jYBXovrYz4w4~s`&cKcY z*w@B33t&T~1eIbz76ri`EQk#eL@BcQz0bW92=$B4_xV51^ZWmvo7Xv?bLY;?ojaL( z?$k35++q`w=n(6E6>j%srH!ujMu|>K}cW|9oC3dvw!Yp zi+38`J~e7|G~(msrzT4oFzN#5iJRn$Bu-QW?_9rQ?`!1G<))jNKBKtA#SalTt-j3i z78f^0+-yb%p1f+tG5JV*5nX4sUUS4vKNzJ`*0UH9l0a#RijJOP`XiwJn<#7Z#O=s^ zCA+Cx92cLc)%m7BDfdT?1=^oPXdINA2ed!);iMqN$3JemNyf-w{7+9AZjw`mx}twA zIprno&-7syqh;cD+;PNBQi5mkxgy%1(X_JL*G9V;>d0z)H{zzBLjJDz#my+=a%Lnl zX5+DL#tXXnxUdq%mWZ3AQ5<-{ZAMthR34TJi?qRZX@8RUMuN$hKea!}1hXZSm}oVp zf0^mg*%fEH5xJSX80yZx5ck`wR8S_!egS=t+iqw(Zl6LQD;3xR3QeYQE4W#y(A~_7 z>u*z`vCJW6a<~sSpIp1pru@vIRpMuWO$9(denWJW`9FX*Bfkl*1L;r;y$!A4{6pw1 z2sCdY7a~4C_mz#0{d8IeA^%;_DoDb}eLsODesPmHR+9!v z7ikYjIN}QN3?bY@*eLMx41S)`j~sj-f3c+DUcxY0FT|pj5E$4=z9%E6Ag5YY@CUm0 zt67zwjSPceG1r2_IUhkj809!#F_->4A&_Y)opicDSx|Afe6 z|HH&HhWmWPxe(9cV*KA;y}+j2cXEw9EXFNVNX=nj&17ZC5~ge@mN(j8*%rJwVlJhLqFk!RUNdamU82XYN6Mh*oye+Bmsh+`1< zg+eU8@!=MLg7}lgI6-7tAmxJskh_rkJVbskK_(B})49jfq@kSjEhd~i&!v>T%g9eC zD4QSS*Uz(rCh}~Y`#6^c-ahdU6^|hO>u}?pDxO9;nuFh0p?N$9`5l@;+;PP99`Q^k zzLmI1dhw^;!A&NEzD<0PTE(@wJm)gv#D8Ed*Xghi-GbXNkdEQNa@_IjUrPKeKyu$i z__uH)4gOi&Yc=uUH{jyg{P8bVmo zD4S@9W|D5w;G?s>m=0+Ft%O-a7}6a=_FuvMFUQYT(jaA4@?kyKh7$)AdV%{8zi&3> zhWq-6H%OX%^4zzP|18$=&*q#CbT`l9-@q7VE7yqf7JPm>Y zA@q(9J*4&!4;Ww}bAU2cJesgPui`xoCE~_=uD;>=k6dGdyZxx@ic~daNYuc$i61{lY4OP_7Vqi`dfpYAnqxfTe^wUFZbxo zc^Bdl>Q2~h5cdgqIOkr$UYtuh+TfRK0mA!ncaxqFe%!qw;`N;cbs#S8<0H;uWS@`l z_3_t?FvR2M9zLGcOptT1NgQ%7;uGU$KGLA%{-6)^ zabF){gS&B)>yVQ4{>u5Ekh~YaaQ-t0i2 z%4imTFG6le+TC2|o$-Ti-W&I2xJ&$`(=g!3I}&JyI}{*3Mfvu*@J}3}ddS=-*aDer zLE=*L!O$(zs2> zw_juNcGI6PV4`1RKx3u8@6Nl->uK|Kyc(xzEY|)P>iYyW?$nrin;EX1M!&{V9e$2J zU#xMPMm5_E*F+^*g*K6Fb zvB}+Lxc(aFXk4aor^d8W(=--qT(5Dr z#JgJ#;69;fa?Yd?Q%6ji%=zdc!>(#Ee8R9{qel$8$}w)j@G}i*pX$x! zmy_?!Z{uy7*UHsA1ZvTd%%@dtA`JIohSL@I<%%{ZDW^zxy#x zz4~^&s9W#OL&gnn(@MwIt8d?nJ6}C!{58{#ICSmPy-lmmQzI#uI&5-h@=jmoESD@C zGkMH}@tva|dB}*iLq-lC*>4(Dr6_MX!5*|rzE?-^+np5o^( zG%%>qAA6Z`K18GMy-~(_SB;g|k2cOXX*5n?McV%|jm1Bkb;}6$|GmHAwM(2CB7%jE z0fxi=Hl}+7dv`V6-LlaMM+8UrA8ed292#>BM%+^q4QCa>X(P<%RH;7W!fO4Tk@L#P z`TeH9v-NZOHGZU@Go&$X)>tDRw?_YGR~hH0!v0sA-@U8Ho2V9>`8`zUQ{-H|In0RX z<{Qj(1ay5lQbUhmKwocTGrX$^`sbM8o-v)VrS+e41lF4Irs?P+c&4#O(tW1>PvwtY z%q%UqDC^7;K#5mmK_PJy7CFD+w-tZUlvcdNBi!Kl3FAiqbmWBhiyyTu{Iy^ccN4c@ zQ+HDXix>U1$hh7lEIlvESLfn7#(DPOY(aOOR>pbdGvR0CJW%`5+Jc3d(=!EqrPr1U zs?ux&1My4Zjq_)l8}atA^{~nLqqgNXH~5O`VOwBD;AsqhYP#_Zc5%{2m}N|n^Azo7 zJg*@il~h1-gk!pyH|B}S)#AH$XBhrdbqpp(;_ajm5E zFeK;5xd-`XXb5yY%ok@T=_dA9JyXMqb?Tj>$>2^QFA)~@8Yz5 zY3BK2+*d)7_=~OB6^0_`i)qup4@J%ww6Lf>P~=?2SX5u=$T|15Lr2cJPe3y#!=5NeNWS){44sDdP9-$MfjZ? z?Vof{ha%Ud4|adl|LZNgn4B71HdyCZaqXW-{jS>k;l`1WLuhY87ybN!(lw>*Y*P9u zT#f*F_jOeM74qLtkNW?&bM23)>t50}AS!)@q~)oo^aL_iQCfnT>kMtf4eHcFAGzwd zOf97f)5oP_StWf6+_-=FTjf}@EdLrVhb6fKZ;vne3b-5#zOkqmAoC1|;ya$fI{7ne z;l{zedqv&X9vmTr+K|;U?kT`g+8_Y|$AxX?RuDFUm9Ri7-m1{z7O@LuvOmwr5TuXx7ngHYe z!DP(9!24wOjgQuo@Vs!o_NT&Gx*0j#)ZH>6Qg|@*9V&acj%>~|9ixbTrYmy{QrxeIa&_n zy6+jYo~EmXDuR))VnP3KIK}u+#f*TMZ-`Fgm%Ps*{T&FS4;KHz9y?Mf^pO{PDPNrd zvGd?}#?FV=I8^6QR18k+Rzc#@9xTvuBz)yqY*0gTeK)vI%aQ9|VjKp^^$DO*RO~E) z#$KM*lWo9WT8@NQB zf#mu+P;A{rhgW=WyX$&GAvi$Gk??^8>?1-FrUZOZ%SW!KSMaop)8BZ;rw`d9FrYjb|z(Y%qOCQ>;zOI+#fGxBf317_l+uChCxaGL( zi>VWQtm_5az(ZP&gb#53n06}$%Z|IQ$nOlD=PpnvI{yNUQN03*+cNM=El1+7q&)4^ zWokEg;JEU|+8b(QDe>pR`^5K!`xC~J$B`qz|M9y1PlDjP$NfJ+bj$A%{Q`!y90^}E z)}mHI5@Qg2SId#>0sfD5`ah`zKRxdM36P(U={$V`6grwZ;zXw%(DfYAZ$i=6i>Y(( z(e>^yC=`8N(jofS{fpMSXC14*>*$0gXuL%?zVzvly)&HJ!Sc6mm+5m+wGK$SFOL5X ziL?jGdIa(8fNDO+xA zF1Ai{lX7h;E7y}NJvDAstOB%_m75lU+d<4N+=Jbu+N-=0UZvOLZFHwMhkMgI!hPx8 z(_>VR^uFd>nr7i2iAjq~v#R*CbYyqhG}A8R|TF}uqrTL5_94aoxhU*gEb8SrGDjs zq<^9Vm8f z{x&gsG>*&VQ-sF(M~gZSlDsMe2WWW^I9SW44$Kw4D0LwTp9MD8vKQ>B<2 zvsA6qs)HT0+yxw<<acbp1O713Gxf=gqj#&nI5{zrX!0@Ttj)ip-?N%e4m(Y`$)P?W+#lAXL*}? z>2dUSfbUrJoAE6@X$`2Nn0X+gUukU57pwt3dHtUfA~BbIx8i=H54ZdD7uxFQN`f#OAxCuPcR%k#E1$5FVC@~3I&pW_2T5bpS z&~hPowU$pv1iAcBeI0kyeTtB$=zGe1)@}_?e*e%9ly6AVwiEnW%fEuVw7eUv((>{5 zFHT*PN)11CLu#C=Og)JFcWM~EAoC4UydrZIT;(*(p%tE!lM{D*aAjFcy@__2+&>>I zgz6z*2wtS!dA*sZdGhqD?d$;zNq8^VS<61~94%h}_SN$72?$LfWRXR=xnKeRnyv3M zhwsNcE#Jw11j#*)KUz$_ZgPvOMobz%;_4RT#>u!~Lv84vX?Lg-yvrdU>tMPb>IUzA zs3*MFp}x_*H|ibBT8mY!v%Cv`&+-BMcgtRQz%?74x4`uvyx3I&f64VWx^S;+FLKmD z9Vu4VlQ46q9FTlUoM3D1-WF`9Wj1>q;)2gV(wb#(AkxDh@cy${LRY;dubmx6C-SvKvi2Z^7CU^6Wn;j6R9CM4J9 zfb$^9zuUn(wflVVF)cpW?Plk z`HtkL;m;s@C&0s12f_!{!SJE*sh?s+s@W%)N+P_ic()+&UCcZ3w0=(} zZ({5W5_j3T!3{}$%L7h_P8~bTUOr(I395_#Ltw3~rra9rtK|vcTrHP@Z)KsN^r>jyW>xFz*&&o)B1UxV)vSaC*46e+OYKR!|(JPQxy|_goz2; z`G3C;?>Ond97w!_R>)n63*h%8mcq*uUxL4q_&R)f;yduQiR9rCteO8 znCNG1(U8Pp$RiUcz^_f54nOe-*k_Utx7zQ3&$lmt-)k?0m)jS^m)c*o$I$+K9eKI^ z9r!x?dieYH58+$wU)W>Sm-eq^4VnF0Tz1&2;L*n|j+qYPciah|@3UatMisNp9@I>)>4_Z=JHm5z`jRc&XTJuy3ehaYf+;l~`+!qupOdt2}w$jiGc zkE{9h@_A45Zx&v5V;L^bJxz&Uymc-7{jG=K#o?9wn{S2J!QTsSgnty?3jZwp1w8uL z{UUouLE^d(Jf!8rV3n5DV(J%5AUt`%vmo)`4;&6jn`Z<#O1nqLFK@gP68}=uZlvWV zUd|9}_?CUz~mi6F|F`onRX+cK|y<@?Gl;7HHWA_JSmB zh2Q`!N5^k*+MIloor&-iXDYmgvkAPJ(+kgcwuHBK%E(hEXLoonXK(m<&OY#d&dcCe zItRiBJBPtXIrYZ zwU*n0?X)aCqdm1;2oBJ)#bKkw#$vO8{BfkhYdD&~n>oDjd`C-oYeyS+J4btXCr1}n zFcvt@M(*Y44L{G(2Y#Vr0Nb!%?zj?pkYgnBD92P}1<4)cd1AphEhmCCv|J0Uqvdq4 zwU*m~9kg5k%H1TMLa@JR?)4~hGYpo}w$d zCb(S7$~J+P)U7eM#qgwY{rCzO#a(FMZoSBU37TYa-4E;XuVsFeX;GUqL-21hcfxmS^h7 z7`fWW9^ zuI~na*RqUie7(qOhAXkE_OF?;56oI-%5Lz<4^4S782VZJ-;bYzTBbCgTf=6=QwY9T z-;|G}g?w)e$^E0py8h|^9^FqTV>YWGiBsks4Tg;8|B*UBWXL)JO}KYt-c|JY+CMEv z(S3tK?)|mCzn^geS$-g=faqgS+Dj;9cX+ zgW2Csa1cU;=MVV+5~1Tq$xKeDL(eg_Opv(fXxt!Sv((9 zl`13)GA(Y4&*HZPEX9_fCB%ouXAM|`Y?2jVFM|L(VFqGV9L<~rWe+%1VjwY)M5Hw^ z!=4sM57cGr7`JN3r?E+(8MkT8=A1s&J8&+y>!QcDPPD|>L%4OWo2^b zlt*h1j_>Kd+1*av<+j(q!RoBvtiDT)X?#s%t6JOmhsGZDW8>eDXEj~elv-xf&*6ug z*3WGe(=fMbu2o%{dnMfNtwsy9mNx@l&+9_VbUB<>^%>^UyH{CN@2bnIs;euj1|i$S zox`ov!0@o}k@oa4sZ(kYIYv7P6AST}X;`LW)LYgy=%bIUU&FsQX7~JR{mp7syRBhd zuCdLsrKnqNa}sQ^D_pBwte$qQcG1RgZG?a6`WpVL>o@peR~7sb@1vpxOKO);W=cHp zxh3=9S5%CxNKsc+EIrh#@Fk->bP4;yR`qT8+i>*z8K4~ftM;?+D&8wd!rhDhii|5r z-;0dTi@WGJsY@mKSV|23t2$NmypXorkM{fg{GB--=GU#dCXDE{WHhfs%Bti}DUa~~ z)^*o&Gd}6QiGTS{cLM*iqkdEV<FVAiAkfL-RqNKI_Fa}Ru4;?1-j z`X>#domG@H4c;uJWeVTH8aMLAG-s`RmR{t3Aa08LIye2~?z!+n&tMOw&Es#d)jFiX zBMq3R(jW|<+W6kal+NsX^6rnhH}C#D%4L32>gv7o`@%2G9}ExV&xJ3^Uj_G;wl0n2 zB9C$WK?=lJxcG<#6SbTIrfRtc*hI_CK(Chb!IoNX4Yt>EC$PJgdx5>Rd>+_G%Z1=& zko3(A1czz&k>J%@E&``$`S@f<&Wmi5ssCJKyB2=E?I!qi-tbs;n{AHGs^;3};c|!V zF68;PCy}4FZHMo+h2f2|nq|=f$QlA4nI$dqRawf_)nakg;>}NUWx?I99`N3-KJY@< zW$*#6!DtP?>n7xY>t*<>u6N*TT_3|gaeWT|($FA#Tz??{Y3Pwgo)HxV^CGD}id~uY zKu;E9?X>AIz>|vB{{(rP`V+oiEkkF8tlz;^Rzp&lopmLAXqNOTT$Ob#{JN}_a8)l{ zk8hZJx;t4da6js%jCq<XM2d^yI1pl~XONmu| zQt~PCo{})!TXA^>EsKib@R1c`;ObBu-#kyaLzu5-_;R>Ds`su=3%YtAcwzNR;r**$ zj@_awst-i=S2z3oq^EB|b(w3mwE8RXWz|>0gVo={=iAlSAg{0f34B|1DRb3p)Pkqg zxEwyvct-*?9zqV}Jdi`%GiMRJH0K5Q;+$9E%W_u2gE?#A>vKMYSLS>I-NCq%l?F?uX5AZhgL3ql);`_w(xWkoNCoH3In@H-=iv?zjW+VEnuB{A>0J zXrUeU-{2!16KIX>aQp@z>73w1cK!x8dp6AelaWail5jVAgbI@fB$J0mAEP^^DVoZc zdQK|;VCq9~bFN*gF;}IhF^i=#{Zm?NfvDLjg&6}f_;)g1hx?4Vt%aEbXlu9^HC;r^ z<}C6udl|AZGj?~`0c3N2qdChpHJomgu|(CFy{x;a`Ig6RH^kl^dvELmu}{S=jeR5b zHddh66WSzPny@z^#!=Ie=9r#bp1dNpb+r)Y9cNdcTm7!;k5`YW(X>WhjaD@})VQ){ z&Gb6yZPM+`xGl|$&vImS%<7UgGHXoM{H%Mjs<|dK7(8~>*vqdPdet8<{{3S3#eSO~ z+x-0IH#RTd{LbdMEw#2}ZRxP3U`vlJ7j7y3EIxErsA1@bAAb4aw;#ek#O!kKs=uqr zu9myn?dq_r_pWnyoxiJa*TuW~@49@~mAeM*^6wh9>#ALocTL-M)2`{e=IwfBSNX2s z?#kUO58iudv2``?_FC(vBk%by)?L(Arr55x#W63{7x#nuK5hs9>mTv^_+Jmk*G+J% z25c4*qux!JXfIVglh-B(7**O@=kvI3X(e@sTc>5-L|$hb8f{wEBU$y;qgkua5z*S= z#_XHW1ru^w!X8lbUg0pbllNdjxI-!f+L6Tq(|429cLdsy8VkIqCX>O zkt1?)6i?!G^y2>yq}~6`$M664A+{7xebg{)FKSlbW^0Aj%I;D3H2(I}umv+_%$Ng3 zVAhcX_c>fCKILHqnG-zaLA-NLb7%8Xs@#S9%$XCKF-M6wYu20~_nsA+K~he2`#CyQ zr@Hx(WYM^#{YEoZ9cjWcU)0Hb(IiH0Qm7AAV{hmh>}y?1)n=>HG?mU+O$K{+XE6@$ zQf}o@XQ}$CfziNiteU8%?0Mf@Wvd*O%gjYDJE!N>aKdIo~oDXt7=w1Pbg_&Y#0|S1{0T%7hBa|JlmhPxVThnd|U$hzq|V)>UP(=Z*hfhT(>M9U282Uuap~_?^a#D>VKdzPoW4 zuA0thO8;Qft?)0J9)edj4L76K*t~mldR?2J4{v&CXjOaL@T!sYe>lUL;c6-?To28E zWq1&+|-xQ4U6d!!4;@g7TjrhJRX!Y2_Ml)u8U+}@4UU#XnI|?p|zu*(sc|R0PE?T+8 z-ehON2CJ&QL;YCra%$n>Pq+M7u(@VnUqZ=G1)t^jn}6Swp9}gGZ-461F258!kkDvc zLF}&uSMMvRcxe5v1(U}PeQE8ST?PH(Hr^iU@mqnJC%ZMCm_yI2+iiE+p0ask7sSf= zYeB+bMqX#x%j`?+U)f_EO&xiTR*trg&W?eOS&q9L_c+QNOB^pd);iwfHH&dJb>=x+ zIR`msIq!Bp;(W~ct}`jIT4K}09*O59UY2-g;@yd5i7zLvNqjf)>%`qyaj%xtBk7!^ zK+>$FrAf<^wj^y$nwflS^6kmbBri%{le{i@V{-45g()jiHl(agJ*WC*)dx@yTT*>h z_0`q4RpReT~qZ# z_{6-4a&aT4R+N`ZH$uXt{rX9tKuoKaEp512?`?37bO~4|Wv;V4{Ln*|w1HDB_^~Xl z(b015Jq;|?t5uWFu%-Q7->MBCe4y^geM1pWeLD9s)$p8q)Z969xExSf>n5sEBS$hX zc%UM@B3|5mYW}zF6!%h3-=0gjW{Nm*cdPXiGu7-NY51+BzPY}py7f<)<(I0uUzeob z@h0MzzsTWGDP?xm?FQ+bNKgeo$El~5$8jGz{NmyW8>{AQjv-Fz(1}s)@8X@uMrx~; z=v14HIIL>mC@bkS9uYss9?@$qqSyb7q^3Usk_V4oHz8}33LtT>1V7bs^xBz1CW8%t z3_oCGO+)nhmguzqG6JO8Nro}M=cXV3*rRi8 zgUFF}7twP_K4c^_3`v~P^PzTsb97C`?(dKx4jU|TJ>2RlOY@170zf~0Vt1NPDG7l3^s zxz~l@MOwZDybO}~2Y^E$iDxJ{T+5@tv5+0x`wc8_hT z?S9)UwuQE3oV{*)*!G4^Y#bEZg7hb?wmofo%eKh2)>dYF7oU~*+=tIi_+06F!?qir zuc)By6MX)T&$szKjqfe^Zse&X_D!}wI9r5|VthZ0uP1R?NG$i;s>kHBrFN^BdNEyM zJTYBk&WbrZrdiCnxCSy?#oUtFC1yru*O-}^XUELSJU8aH%%L&E_|47?WLD>DO|I7C zs)wt$@;eJ3&A2)=W=`h0i~RM5@Oy-xzux2ZzGmff4^mWSYvwtRTw9~gU34D5Ihp7? ziM#7=Wf0ao9J>3 zyfb_5oBo{(vK}-})pdO*WURU_x3IlT;^Z* zzGt(K$LxU~Y4kv!tfxo%q@#O!%>HR}26*%e%VYa~WF^9x^!*gMr?_L(HOKUDo3qO2 zQd{+(q=!4+>##-UDat%^dc5Zw7zWasqSjJdmWP z6WCA7Mc`a5mx4hpe*+%WawgyKR{A@BDL7us3&2t>zX!@%ur??K3m6$k|F0ZBuS?#y z)cJn_c!`!T1xIOl2Kb1UUj<*+@|)laNdEVg;M>}L4Y*OuKY=!#pY_1DTD}OpO3Sx_ zPiXlK@MA6S0^@alo&|Q)@}=MeEzbj=)$&{5XIlOO+^*%n!J0bHYl9hDZUbJR$&ij7N*i&q(OuDBTGqXqVu z`X*txeTEugFG&6@W=qO8wCbVMpKI@q{iXJ=wMluMHg)(P(`?joW79s){4i#F=8u^P z>ZiGsGSkX$ai|5dHwK*> z=S^Vb*6tM>-Cl27cqeZG+#DA#_8#(Hq5k$R$h%M7o%aOVIhgmYp`&FKa(ezocsRd* z%K>UY%WzAs_6hePW@8+EjxmnzEp5-}WNz8UvL}y>sdqX2@r4D4Q>!+qYE|jhDX4Q!jFe@)f3@RxU1T3%sAZ{-i7;t@L~AL zj_C0>YHIX6tv+V_?F|catt_kH?^y2T|G(e*BHSExoNA0Z-k?VvZ?na#IVTx!+-GCe zgzXl-BlC<^P^QHRf9xD)aGkh1CKOf{yl7r{{7Pt%jGWS z_qpC;d(pS`=;a5vR7QxCj2md*H7krOlKP7q{ zjBn96#ux&N9)X`#GJ$c0iF(}fF60HL7`@zA@+VghmUt`L*z$}qOn=4b3jQzCa*HvB zY1;QV$w=nOiig5Jn`#M3>A41+rsa9y?ONVWi8us_A2 zbz5RbVKXFtqStl=##___khljw;(G;&90K=h+5a*B3ncDhV`C#E^2A@z=8(wGgD+}% z3HY*>Ex$5P5fVQwz|LA`nUG3^#Qn4f?{#GUUG)6F=(%|RbS~gOox2x3cQAS$pUfkS z%;WQshtqXFD(VT*bq}di%5zG+QtFf-ve*Nl%zl8CBqH_Kx;;s*Bx+ z4mgM19?_)szVI2wx`UN=(G8I`1s@=9wc8xos*6K(!%W9YM@O~F5k!91@jmmSKX6!` zZIsQ~#o1B$oV}RK-P?H{yNR67OmZjly;q?fRv$C#`vY9IIxUIKlr_R3?E=e6#L6R@&=*rvkkuOV{ko4p_{`K<@Y$(%z~`qv%+*IyA4RT(RZEw8wa&^q32IfHHRzyqb=Je{r#GV2+EiQR z$U|FybB0xQ$>_@5hHe?% z;WILx%y6ki870W&89!unRzGF@g1jqZPezQ|o6#UMPc_VJj<#!+*&4o`+FfnE=AwRS zgHmd4rGe4`>Xy=%OIxZ}O5euiBEvr4%(9ou^3*G3ZRT8a&I|l zE^h_zQ+`8vuDYrG=koDtSNU(a>?{AaVwd`^Vh8&o{7~^D{HKav;3qp4QRk({nAxUQ zH6!NESf}N#*yOl?N{Ra_Zln4!?r>a9RTcMV{C;)NUgVr=+3Va-i8$z-o_MS3n{-`L zGi6D!@n6+Qsm0D@wNvUK*G+N3TcxzaWo3$dA=c^D(i@S@8u8vov&-Y^E@5Z?VkHR4)uWNA$&gSc>?~V=PCFzo@e1Dp6B5&dN#l-J)7Vkd$thU zC!W2?s(w73k2d&`nzd^9DkEph8V2ES zHT(;%8jWv64W!X1M$YbQyb7*N8?4P+G^cjdyeGU*^W$sc-)H}nO$$2r!dz-WC#>N# zYv?iF>fU5kgSvT=!Zx*+_r|E3FUY%_I`{)o^>K4ePqX}9`NWy;&relD@~0!u%U=u+ z<{zz_n-&tAls2afwkd53Z(n+Cc^B)n^6MyBzQcVF^L;&h_;9YOGUhpd7v9Ny&0mdL z_TML~Wm~8>LOiu$yQtE}IwNGUgC_RGc2X?Grc(jr#yxuNgxI^>4Nb&dRxd?tYem~( zi?&J8kJ1&fF?kzu#2#iZG(p4$%bUo{AxY0laJ80w)p(mBai0QSqvbW=dM$4NKZm5J z?@KUZ|FT_m>J5;Dm9?wq)x@?XC+CBGA#uMPjJCtImh&;VudaoDg~U%+T8G^rk^NxA zo~YQL>V(#siF;?T3nYHTo@#fr7FmZqp`+_(zCkWPUk${M59|qv|A)axwfs1E#QrAl zTEtdsSM*a4Nc@ZKm5EyZs~+=vAaUEf z$-c4lOI&4P%$#kaz>bjk=?*?f{p4agvlfC8TdT6ZL)JsDz+C3+&yLy>Ib-`h|ApmG zY?DYCEaiDF1^>4!vNhZP<7Lt8Ux>`<{YuKZCD&qA`Ia{D_Lg4ob1l>0*I90Y-(s0T ziJfJ+4SBX@E_@zl4_Uisxf_13ck@jYhji#2_Wda?4s@;O((vh0G(=od2$Eq@~aW!aB>(2{Sp zst(qUv~N3GyTH3zyW!H^+7r3A^#bG`wjx_|HOV&B7Q^i86Z=8#rkCs{lC$+ z&1P4h*>>UnhwU#$sSnr=;(plHg4UEjCcu85^J0SV)iE33l`*-oR%P~^ME97Oy(Gu< zjMTfYo|TcmDtLk`1>I!M;%?$`B_Gb^xwyI&-!;wd2k3$}xU4%R-`~REM9cC(i3>$<;2p4{oNX3;Qkp-&ab_l@YHnp5KhM zaORqbFj~}NX@QPvX=w}ZVCfA%&vGsNddto5>8zEbzGS%-d5+}{^xi#|`zcEgSsupy zam$m)Pg|blYN_RUODqe}U&ha?me+A#L2oZ_6SD-+0L%}de~Xy`*m|;jf%})1-{3Ms zfOeMU0HF?9T?=3 z(mEPG#(FhZCs-#UPqJP^3^%d9&!%QrXW~BFdI$U->tj}@dfeK>R-z`d=EbV6wcUWe zz0v4>e$MtHWq670LwF@~3dFY3R`{n_r)K4wZ7=dZ+aXH3H)b$8c1X-E=+)a}R>9wj z`4GO5zG>RLvA0n#H|-ReJ<+D+YqJmfx~!YBV#I1iy~)Z}?|yXbBlVuF7pI{^1n(pBlIt~R+st`xQ1^*#O3 z7kFlQ+9EdN zbM2c{^tjdLI-k(`*jDE=xJrwq1rnd;Fxnx~0x|cOD6YGR)eIaZU^t^?gH=X?gsDWz7T$~yPum? zr0zk;2eSX>ds=1KTrXm>?*b}Tak;T7J~x3jvokjt`#dSRwUN_u)8QGp^>A_JHp_LY z<}54VF1hXDopKA{U30s!TCsa>U*wB&FM(UUHZOG^Mz~h0Dq~laq(v!T^+Z0W>U?;i9`m{kd2rPb_~@#!RaV95SNH)&zHDJe55w_r zM>v_Wu#|A!uv2A(U9`sC;ZEU9H6%QoRkI_Eaj~cZdz=_4zx3lUXSxMkW=GS0r0mML zsMyCC%*bda^Oc`e4JgSKlxwpr%NS`4<#{&W+sk!X7W)P(DbcL!`fn)F9a0*xQn@pw z`_`1ol=IZ4)0S>kbA0Xb)<=w;Zhnp$n?1IS|NEso)!o@vO_ysa%RO{imQs9^F_wF$ zF_xQ9-&vntN!C>JZ?mQvOA3wG!gsKyny(pas(JHRQ%xyrdKiAPH^3~{W+|4jT(cA> zu;Q9G-dJnx^>(Je$Q-%-|E64bIehU+$8V(+533qo6|2S?qqr7biXD{V#Bd6{Za4$( z(&M_Fkqg3CP?iU>Dwwaw$;vVs%PK^ySOCjl7cnw^pV*6f_zEQcSAjt-e+XvNr!xrm957e+^W=jqwcHw%{e3I&vmN|KyIawqk+rp5kP9G* zzbp8!*2l`)*rAZv)t0rft?4iN2)PZ|7Ls^;U{@{o02f17;l2c1s@-1)--IN8mV+y` z`)cq-`ki*+z8GAh`=G>z`kPu_33};!nuMP`Fdvfpb_6?VxeNFlG#>XCz!$aqtDu{2 z#8})tU?WK8rDpT3$b}@HcA%H9#(re!gFl&Fn9jKSAi9Or+2AHP} zMHZX5?fLrjL%s~`4~hGOU<_4>&9|LV^F8OZHQzfe_fW&V-|`T3)rT#QP;Wi9{##Bw71V;Q$JBz~u&kgiywaHY zu$KC-?U?%SZtB0bBlTaY`L?pQrOeVpIzAD`J>O(Vn>$ojjdA^xx_k6eq72Pt2Z7U3dz$W7-79%nGxP z{9X1h*$HYFGb?!SPFqLzmgJS7%}ORx|D9Aa4f)vm@?E&!U2-q{zLNX7YSx-xEO~{R z@@vP`oj=9TpCt!NV)P2~Q_a3OTAOab3aEHAu&jSFZF!ihpq^5Ta49urWIf0D6g^t3 zi{f21YR#Q3SlH;f!o-oQ~TDO~%u*W{uve$ml91hXR1F8%U9DA`zBSY>yiqR*Z!xBetlkNyv3LPRr=#-G10^INRnB!sQNZ5(vUgr2#^jfhKSBd>+ zj&hkZ(Ek0gt`lv$L`J`4X44o3De>BM+UfgYO?`>SG?_Oc5ZpWDdX zQ%L-CBef4QWWHaG^f#<2I9$tP!K<}A6P%^xJHRq6zX1NEW%Utt8c5=l{SDN|G8dCh zbMR8gxYssj0Dfx9Z9k*M0*U)LaEg|vf-|*zD|nlh`);Sc@(W{QRIGA;CDd-Q6-4}C zb4cRxg7<2<7<@s?OTblHUJY*4@+NSfmXm(Rb{Qn`>;SEMOgRd7_=sAJ^?s~zl)pxNq>^Q=Ia?%nPs~)R(8s}6PxT}kzMSu z$HgVZr?PuiAFQ#+9;b)na}vDlojQnJw8Vbi!h}2QVi)&byV$~g-7Z#eWxkqNz}?F4 z3+&z+R&TNJDfT^UV8yc&);q;^rklz4@SnQnYxCJ}6%du=*$uEReTd`?-z>(+_ zyQwv>kt!Ba#XhQ7M-|(sS7H-YETYc9`srO*J$=Y2mQKaaX}MD@oQi$Zwb(VS~v+4PaSGbuIRYmt%og=C*x_-QgYB8&>QgAv;Kn#QO5XNn&w% zZPI)EHZqe<)>j#pmD!iHfL%#%!IF0ni#lSnTd|wOMD~nOsj@G?hSbW`KGh4cm*lU0 zXY~cxM_PtOr1jNn)es9vV*g02AIVs!^u?>1kJc_`msZ&y)x}Bz*~i(>zK*gFo~+Rl zYhnu9JhF?F>>(vP{3_>>NP?5~N1D6tPE)}h=LSJCVL zYlT=L61&G@^;m2ki(P!NiZ6DsWCnQ_wZM-L%|9%bA2;&beK@_!O|MpwSbW4fve-rz z%gACES*#+5m?0%~z2iSr{}uJS{~PLb|BfAY*<UMTy6%K9~_8_F8w zw{RC5?@~`p0sbe}6aTkv$RBp9x*>JG$o#|Tx?uEs7u|l6wo|0dw4ENU$hwZ`{RYmo z4HW6$lQvLfe}Xe<0|h@i`8o$_3q{&Me&ooShyPdR^GD{@N7tF8-V?o+pczmEG3mmlJG!heeU6<#gg8}Cwi#%{2S z;$^R!pX2w!569O|NLO_d(&<6TNT?5Qn9vyBG$98*fcmajh<*b8p0*QhV^VGhdnb4o zW4*?O_RElm8v8KcVyxX*ZeMA)s#VAA3b6q{TkYR4g8wZ$L1ZY?`u(YG+7~%oYNF#B zM~pJ}iCE5x58^ywCx~y1Js=JmyFZva4s>D-2zK&Mv8TXLV>f{r)Q~%=RmZFckzD|` zQcG^CEQv9R^!O)sNhF?A?4~i)*g@kKW3|Zg#FhA5b&4H5zM)RdiZ1HZ%;-q6u?D1L zQYTpna?GA>eQ>!fX=oCwKay@qs;6ccyPuqDe-m>pNnUcRWSeSDJ)B;Sy7<%(o)j-xVKJe&x!?e?a9QHS-9MmG8=wp)V^!#G)8B1ej3NsC;y)*V>?92XgosW^ftm90} zRf%ayv};q+ZcUr2Zc8gmtFNMWkgZcUqpqw{iQXA@aos$%#IW|SGGa1VePOIjxhi8a zav);{{K<^x;XA0$vtrZObw08$z|kE6{)*ZWz}ySqx9s1uS&5Sq${C`z8+-OOGxiEG zcL$hY?4mnm(M^jORWkPS+r8*_WNT?$X^e7~)-O#{4N4oAGKNZR{E{OpT-M+cD*YWE zE^SoSST!!oDdXQU*1QDDW+K02taJIktZ8|7)y&ufy<7SD<#xT=<;L=xm_f0)d@0tA zUMhbX`L*(8@RjAO;Hy~+(@g!M*TPW0SKn6rR6)NP^?Lff52>netQNhm!Krs1L_f)) z^~-E#P5n>OFIF^#=ofZBv-d{sW51A{W-dBL%PhBdRI3gBvH_h^>xfRVI(Tm#T^+GX z+S#$}TXCL)HDG$5jA)%Q1E0$stMT)e)+y3=yutB}gV-Dg9d*xFwX{ZfFX^MC1og4r>nJbz3f1b2-~5RwH}kd!PWk5Nq>fU#sb1dX z{M5Ga_Ng7kKS~!w-v3)!v346;AYMI|I!pQRDO`@ci`l>G7(AvA=Ykx@l;KjJlWB?a1i2sUwE6l5IrYt8t&K zcak>s#R^N!`imC86A*2Wt^Q6ry?5U7F?dncotroQ3kKj+GHpGf6Vxm zb#A|9{EmBeW=lrX+Z>}`PPgw!rTYsvE8^VWyJOT2WA~AhX`CEyWIvJ#i>54!Ro9$S z<1{R-s~VMNm&U1gX#JmD%Up!t`E8r20lZ)2KE6<0wj?z9i zmM<=ErIwyVVO4f?a)Iv9rRaeyyl?D6em1_mop>ndtpfrqbVhJ!I4`dCyL@ zFHH*9#Lw~j&wP*jBHVX?4dmO&xJE;;F(m$F|J>&wk)v&q^`z7nLgGFHyj9DJ(k*jq zjC+ASwOj;FhGfo!eCcE#Yni7K0A&u2_?LM&Z)o`~P*o#6xLZIgBz_u$t+Xt2a%4V^ zxK9QHkj$~T1(Z2D;x2P^f?9qT{6NbxM`xp!Wv)(JNc?vJyF!xAufd=jDu)xQKrgcrv^7GH<7+o^vw@lsP&V;a}$Hysh139?mOz&W+5!32ONZ z@JlVrJRBb+>8t=>({dKtBC;pB%&qAFi65C)bF%p~vd>Z%Nc_mW8ktigbA!5pGPmX~ zWSLtNz0Y)rbMY^8YbO$f-bRlx4*MKy;T{KBETM*0=bZviw%3x(F^cT96g|i2 zO!i$m`y<{3NYbD_Bh8S=9l@)$d<{4Yk{vfrxwm(S85fX*{ipkv&L^Cg@!BT|n+LXm zB%T+(p)LoBKKT{=4HEZXzC(sYuH4C943Nm(e`FjF68ZT3r2Z%CUkiG(9n_X&w+GKe z|K5T>dCr%>SGD{)cqY2Ixz?dMU_>t;uZv&hT5IBe4P2@HN9$tI!!6LWe*AdBJV?^h z3Ty*OSr`2*x>?>6(a)lrA4mQcjMmW>t(T*9v=2AYxsC9DDxKS|CUX}cx$oIvcP)z^ z79E_1`%B<5?fwS13X=JWLGUd|(kc3RDf;&}@ef9H^m61CS}(5xPo}S1qMtix9o-o$ zfFw@Q;iA7~?&0&`Vo1IpOTbqkNwes7(d)7!L_N?2iThb#LoGK3BYM9DI=`*f`|YE? z0ix?WY27V4Uv#`Y<7O~gzkja%7<#@gw$bo&ynb(oyQJZC`u$SvX8;(j>mShW3&Duq z_a3MBJ8Qi!`d@Va#oX&&utd9;gNwDi6nsg`uYj*=`9Jb)knez4a+Lj7?}w!CU%mzM z9k`MQ{sWZnfaqWO7PNt+{L9Lg$Tz@;EZ+d*|84cpzX77}eZ;u{jMn?2>t8=ZT|a8m zQCcQH6XIw5o8HER z+3>l>K61qg>ycyZ?d`M~?S=Lls=s{*@+5lzekMD}u3*f(n)<^2CH}v*Z~s5+y$M*3 zZM!ynmF7VcqM{HoqyZUIsE{Ef5-F4^lp)Dflm?}eL`X%NsSHJ_5Q(S^6*7cEq(YRU z``?c`@Av8H|K7FUwZ661|9{)(+_wGLkNxPpuKVtuuIoI`3ASGR3+yj(VF_{UT=}o= zk-3QNg1Jee8@E|v3t9{R%Koxh=yg}%DkNT`{!a<)Sjvg~3%i!;qZeKkqpfU^8L*XH zCW(~-up_Dbe{x6CVo71CQJly>+0$2F%2G<1TlBXbeBGr~xqbiU9>ZDa&sXDKN>v~` z`C96Wlq~mEN=RCs6PA`jyQ!=X}=-ury`>yEwP)|IK#$mNAqu~!wvU1#9Squ19vevN6WbI`!gHCpXtQgkwrk0ztEZrjnU}J?%XpQ~%?%w3C z5J=bXZnTnxV-GjjJw1-WM)vp!`vv0|@XQtEa4l0+)PXfroC|BKxDIxMq7$sU;sw~} zifTQLxV}9n5KbRj9b8C{ik-Q649QZt;bEm=mv~K*N(z^i>I`k;nPS55l%!$ zO9%H+ZF@6E>g2$$*Wtl(BXefK&h8e8-E|}VqcQF?x)GK;BZ&;GY>X=GkeH#c8)713 zbh)UQD)@o1jj^k_mRNx}+;_wY!-~d9z)HpSgEfrX47)e(0_@kgM%b3P-*JLmYn(*9 z6ek%!ARhl|ya{ak&d{Fm=iyhxSHixJuY+xlZ-wO&G!k&Ogvqc*2{T}A6C7bTCTxY> zp0GOsD+MGZ!%t1P1V1g|Nhk*Am|# zxBLIzshY-Z;FExn8@Q)xQEd_A)LJxJ@XEC4!H#K}06Ve85b;SZQ(%o+Okk(Bq$1wF z!{?k1JABsvZuyO~b=cc;CC`zE|BDw6`>*ecjf*`i+q$?SkRdj}^J~vbJyy!~qf@lt|KrN!bV26uo ziQ%_EY>8NJ&KmncVAi0RBO-xf!D3ywLt;nZdx{?r7v}=R4~lo;g0WkKB9|(D0omk> z;+Mqn9T3liy(OLpdq?~(Y>{{=>=W^F*q7p!;v!s?I8R&&`zH&b_eoNss|0$_B;;Xf z#|bfRq{KMnl*eP=2|;d(gbCu)B}`#wOVA2G^CT=`ttD*mS6c~t_%0Ieu(U&k1V?*R z;Q3&e3VbFcG7-;{D8!=_NjyOPhZ3(4sg$5>*H?)qSlY)zh?AD=imQv9q&zI`YJuk< zIZjf98!u@rDZ!aYPRBZDrjoN!(@b(c>R3uHhFvOYhdTC>+awh@SIIqycuM+VT{M5m z1Mm+@hDr)^M!8R-MV3m5R;!5M%(+xJUXEN-Mo;+C9Uc-7xbDF)haHW~h%K&y#FKTmb=;a9O z+{+C%saG=W-Cjko<-K0Oswnlw)yPI^mr@^Yx6*zkDb7zR5Rqd_5wPc!l3|OKc(AjS z&6JUCRc=sr=DsVpz#pSB4%Z=5m6@=Dpz6iRf=F+RCusGR29)S>4R;QkwH+M z3OiesR&TPz&MR17MAZ#G?Z6_7^*7sR1JtW_!#sfRn2XO-wO3ooZBpB;hF=f0aO^*H zQY`}hb+sbcFKRqk|Gt5^{tZ$$P{+zw>Nc=jhB^<$Dm6nJhAkENKCEdNTI-q`nu6S5 z&0(7Ob<)&=U9GtRcBAHQ*dv+|u(8a=i=tHpyg z)IOrUkUNS^omO)KIzqS#(#|k8T%}GOd{x~8(Hk}eLr}B zU%=ynFlM{B9H4(&lVL}+VMt&Gr*2FUAWwq zhlm9IK8UMP{_jHA;@@?!O0BA`Xggy^oNnB@R!8{Gt-o7+xYkw<^JjB-*LkSVy8~Oy zdjR`{_Z0R8?-lHOUL8-2tLHVrZ{_h|+lwlP&m0#4dzRbQr9jXXyH1O8d;Y^$EMXDa zd;5jRbzHY(aFv=NIurK%zjWQAD;Di)bc#D59)K&*LGfT%+T%!!yYT0V_2-K9=Zf`j zUa`9NRO%_kDgR$|-I7$3;-u7MaD5u0HXPPg%@Ov`mF$1)O4jt>cO^r%{$IM1wRF0Y z@!MQ~XWUnD$QS^$)`>gN3~&O-=K}mO!!%x)=2+7FN&<}&roJP0LBxSbpctqCXv{E& z_8hGPuL;l`vN-_t?YjfHKt50ca6-5j1^9Ey_-lys*AM5=&Km@111kVpH}xvO;cBXf z>!%@L0oVeo0Cyk*;Bdth2E>3dzyt;Z@JS#RNCql^?*OesuZ(Ldt;I?iN?MPVK)K0u zfYzg@HRvA#A`-|K0Hc60z&OAFmF55fF-aA z*ajQ~`0Kgy*QDprikSxR*Er{|Z%*sf)3^ry{56`pM(b}zAhS9-~?;| zIP^&^1KfezKrul3>$$W3DH=aOV+J_1Ym9(7z#_mFpe&p_K zCIE-_46QF43DA1|)V>ixYek$v3QQ|zQy-HFz@K{;2|pG{0H}|Nc88*I1032fG#+3M za0*BPng9;17+QOlLraC$ouz&LXx<*JJxlEw>IJS{vUw$8*~A70f7Lm!%u75a*p_2 z0L%bdAB6gVB7h2j-{(*L{hSlp6y9JT{9gEj58yiu)F)$A>Qv;F8RmfJ0Tv8);8lPV z&~hHfUBy}~fD^D2a0h&VARr8&`Q5b6E{!Rmu>{(H3BaH0fFHcJx!#ym-ZsyBFqqaX zp}r=XyG`@9X}&gp?m`88+Mj`Y)IMjy7EJRMXs!b7F+lqZ@b?&qflqr^(H>N^|C9+p z`$*AR{8< zcVBS5`ikEefaaO==a}>7m-FYA)4Xz;d%&MZ&YwfhpFhr@JILTq0L^EnJ)pqG;55Vx#d>m+{%KF;9kKsaPvyoxJ(ZY6O!p|qU{6S%M3$Fk z6bo@Qrx@8;%qzyP2xb=J-TXhkr_!YBf3~MG53`(ma4#^^8NUPnW&M?rvhrM%>@8XR z24l{&2wSD}m+b#U4`#>xxc>KhGs_g8D++ToLmSuO|LuOvSS4ZQrJTrrpf_`u3LY18 zx$!HE+1%)5R>^_=U-fTtz45!zI|uhwT%Yc$xWZz#w*W`;y>a)78Q-`LU|mzxSI9-S9Tj4+ZSz{f4a}uzqP|ydylQ7 zrn{ybx930AZ>u$2Si4j}L|aFDD5tAEN*h;R^yH#F(AJY1t{nkCs;wvY7iO)aJ@)VP zT!G`cDdtoo^po zhna8OK;~{t^7(m-HXnB=l#?KzpO+w?auTWl`IMJ1Wd3CE zbmmi@!kPJ$s|aU)B$)CRbS&jAikLq~s6Bttc7EKyP_BY}e!ikDj(Zu(RgllmSCG%o zS+v!`9S7wr$fulz1VDFjlHgG+J{nB945~x<49aED*hxdM1&iB)w=&-yOt}uKUjhEg z{01=PJlY-?`Hb!W`D$RweUQ)3dyt=vSPqMG68K&c5SIfh092gI*Ybe13jJ9KH@>#w<>`l0D3)e92Ab^K&M2Y!_MdNCD(;1aD$KWxfH}kolCO@nXIYct1eL`hgFyIQ1@vGd}_x$9&4`ykx$xLVHe!9*dvX zX?tA6H30I5fVG*g3m(DzQQ)!6*9TMHM*;OI-?NOxDaSJspz}-xn=;=9Ot~M5Q~oEJ z`8UD0m`^z&$^~6Poju@l0M&m2E@wXFhO_{RQ;vvoLbL|%9&iGSUj|cdXd2=IV9F6u zeM2zihsdWK(NKVVetw92$`Mh1h~86aumV8w?%*EG?+K=Ua*DV2l()YZ{QMEcDTh?d z>bwTO1=`+gCH!U*P)7=^3sC)WV9GD`fWHLn%i`f+$~V#LoC>DA6V<1jlNdn01b8^} z4Z)iLUBowoDG$|FANN5b0Qq8Iapp^cwV7`MrkoT;#&FBP_AI^%yqfuI!M@C=+!f`l zrs1To!CwJ7zo05wU;zEU!eCi|;_~1T%%_|dr-uI-aRD&pv#1U~mqkA1v+4oz`8h4} zCym7W2(-nG;F~aib$fn`;*{fB3Xtyv&Sriwm~vfh$2#DB1jt_jrd${K{Crni9mn=u z7x{DGQ%)-dz5tkVTWxiG+Vfj&{(<%!SDT;Gp64Q;a$S_?>H~i+nDSi|r<@n%yJ#MY zJ(%)d6zAu@+Rk&eJ^$4fhfg^$^7(l%^7*+i@+DruA}{m)EIOUDr0px!Ge`5Y;a4qxe!L7{aKD6hVs6OS6x&Y)0gH@T|7u=8e z{M-_K*9Ie|%i<%!qnSSzOt~leEK&Z6a!)i5U^;jfi_Zp|0rXgN!Sk5U&r#9&7a_I` zpz|yTQ{IYv%3ZAm=-74OP0Zf{c459Ncqj9BgWUl-b`RK>#r?pP1Ecdqflo943^<rzvTYhU$+0w8{*z_ z3cJ7jXZMo`T=E5HR(%QXT4Vea-y0V7fP@`R)J8y(#s!+nU|C9Hx)X(~7k9UsypV;G_`l0Fl<@ZIC&+mUGpWpXP{%Eux zsQ;P#f3+>~>A#{aQH{?&K#xoP*3`DRgvqV~;6H5)B;4^j{D0BLkit7cd&eo`eW87~ zXdet}Yt06m0rY+?g>_?o3z*0JE&|9$090orSdaOEVA>m&a&RZX5iA}BE@FNw*iEqg z*l=(J^Qn*f74v_AdCXTwzIPbQ`OW~FF@Fcxjrk|RHvyWPe+zt@#Y@3F=AT4+Bm$u4 zoB&Q{{$p?%^M8SP%-2BMM2qE=?Z6wDzXR+CP#*RWI254Q?G*Sti)VmoML>#YgK5qb zJ??0<8w^<6VFB2N`K!Th%=ZGP0z*+h6U<|A5wtZ#0XmO3SP#&IKNdWm#r44xnZE!` z>jKgo^GI+Ei>H8JG5;I*2SCrW5!}q;D#$ta0qC*DfhRKG5bVbM%V3(TMRkh75120` zf#(U(ImN(|0M+RR?g`L5cRlcE79S6u$o%PGGv+S>+b};8oWuP0;E&921oN1$hc?I< zfF5fBcp>vQgI$;(45k@XR3{u9$NUs9&6A?|bd2wF1IWJs&SCyH@K5GzplzbX^4&B) z*QRTGeK&9dK=0i-a59UZ2mfNeh767c==@e-N9OMbCo}&Z_!aXT!8B8e>d%(Nx-9_t zTfw`Tp9RhZL=e9Trg=EAefcgWvg5?1E z{K$g`1B&oyB1@)YzeR= z^Sgl+0eYSFz+;&|4m=g0{*P&3Gl0%-1&&~T95|l&Pry%^Uj^nde;RV#W-Q-*8cegv z=sZ8cG^dPw31#>I`QpfRj|PUrHvyXg6kiW^WPT9%AoJtE=>X+kFN0~u8Pyj>URwg7 z|7$dOEI{$`;E60g4Q$5ZR$v?EuLQ3F=-5DTF!RH}5dfVh0sM;P%721+%$Gw>d^|7& zbtZuI0jh5WPG){8IEVRP!L7_c)*t5qsJ^2*`auEuyln-$0TeeHfc^ljcK;igW~EVF zdnB$Y0Qn2RyeaMeROHoptJ?jsYf%TFIyT_70DX5H!0TB&2Yi>s3&2GzUJI^c{tqyZ z`6do{4FNi*6?i!y27eoPCyNJx4K}pbIS%GAe}*HzrvM%60}fz*B={BctH5>4{|e?Y zzsVauK*yH)!w1M0KY;ql?S2FJ7eLR42kxJWv5=^w4%Pvv{s^!c^UcBYnZE$Mg88e# zj?Djc9*>pTeyqb)!~r_bF0dQ(eZhguKL$R|{75jbu)Y59B7A=VI(919jQKagJm&u> zh7VAkK@ZTk2avxR%wNy@6MP@tl3ZOcV!LOL#0Om1&;Uj#`0jlE)<}u&mG49y_ z>Tin#M*&plG&q|1vEVr7p9NG?DS-0(QsC|Y{hs#*j{~S}YXCL| z=(9Z)JRP9NnhTC8MV~W7Ecjj-#@E8X5B7hC{|!Il2f)VwsvikX0qFXY3g*3RkE_1I z`wUQ>pQ z^G(6Cm_G*`_@=#1GB}6%&EQt%b8qqes%)>*41V>#-G2|R0q8ZX1M>j-A8&oYC{TbN zw+zf<{>*B8egKMFfvuTu3wEk$k6!|FpWFS3U>@^@Y6UnoKn2J42M++~S~(D`!Tb^6 zF#tWEao`Cot`D9B(Bn=4n=pSGcqTySnFBTl=(p4Yya1s3mS9_e>Z}0UGk+!60ieg) z4Bo|jH}HOdey>h|BLO;3G&ljE_wFjVj>W%%d3Eh|hSlT!0;qlnID+}f;1uRx0~Z7I zI{yIkSp3`0mSF&jZ^qeoN9fCHI-4xG&V^I#tH=QpE1 zKiFKhzx7GXW*s;*lI>k((T{^|KK@+HWvvaya@9tF34Vv&6OPWz#Vs~glE(K7C z_dpYXrE5?e4+QVdiPm9KWL=MQT{q#05pM$Svzro z&;%-X+ldQ;CQvD8C+;A0a9ixJ^BsaFP~ksr2sD98Q9E&mp$W^FCJu!rP6@I-W=(C;bor5NHtd|U((y3l5^m$hAX?u0<0(4rZ zdg;&vD&_6OU538WsUB|AxU5dG9B2aN>ZlOkgeFj-uR6K6Uh_V$IG+do~fMXs}}qpbY^7 zz6MW%p4?XNuje-fnm|RLozDoGK*hM7IAdr6m8tE-nLwMh#r`_q9B6_ndtBnV&;%70 zBc2CM=)+>f=Fo)U?0FE+hbHK<81Vw=g}?|FBVGhe&|@*;#n6ONEJnNpnqYRO{huJV zg(h@7-!f>z3|5bL1vEj2osZZanxMhz5wCJjgSCQM<^h1dg{(6OF3G+_v!+ahG04#JSJ~o$B3#CR}6ni0?xe0@qoLxCoj+h5DnY6hjkk zuzJJ~pb58GjJO1v@PNgLOQ8vOS&X<0n$W~z#805>fR68FJv1SK)g%4_O-Nxe;;+yI z+JA@&@i%CKKdVRF08OBBlf}P76C#-=ZiH@XtM}J$=TB$?m7lC`Gc*?OMft1VZ)hH? z$G@h~z$qCTJcTl+oj7dbz-h6V8jEQ|n*kN<{KRvhZGevduPyW*pyT82htBB~y9Q05 zLgRU;T!${~RIdn{@P$1taWS-(FdgyN|E2@Ipe=^>0R0JN8MGHr%#J0FM5pg9>i9*m zrH*iv+t36m{MdbHLdRG!bTe>`I;L6q4UMMM-(ry%WLHN6?NEx3v~xZ5cNXJ+cAKDo z106qW?s!gw;P>tKD#UxB35QsWcrP^J1d9=SKzjlwS&VoeG$EYDh`pc*(JV&n4NWL# zF=8KR!VTZ{|A9CNIs>3$*wFqQv!HW2#auD?gCMlOy)N-CXu>-hEQ~@N08JRf>a{T@ z-5#ciw;kT!B4|R#*I+R;p<~P%n$R(315M}{vxQy-bbO4}(2kwzIYDm(Oxq7{<4w@c zzycN{-U{sk*s&P#HfUGCoyCZ^L+=2bSd4fl^e$jGixIm+djlPxpAU2(K!yJ~2!cM+ zsoqiOh)(q)p<_GMi-S(?R4)ZOwNt$d&;;@Jhi>D`&{qH|{O6JZoylTp?6ZFrnn0zI z#j>FZDKVLEQ1EAw;^#uAUtH*zS&!Ed$>;!u* z70|DNj>lF(6FOc8KR{OlRQTun2>pr0g4p?Lpb1p?*SBxbgpU7P6ZB73&z&9H4Bf(F zds*xkG=U2L{~g#D_f-Iu)9klo2sDApq*v{)>riL{l?)csg(gs8KZD$CXhJ1>Ok!JT zM^+D)jJDzg?FQ7ddc+>ko^AF1`VC7{$8`{(qSQ`YF?2QXjvd>^!|*!jofl4n{&mNjkQqo?BcqKI935yZ0 zf?fx7{B2(kO`uZA>TZB0Q0c-R!x5T5u>;TqDo?E1j}3x8)Tv$w zG~pkgJ=70{j_*`20h&PNDmz~yG=WMgizPu5s9a*Pv(N-8IV^S#nm~nrz7%Kzm0DIW z6`DY$l*P_N6R3P*u?x@yDv|7-`66^~TkNmT)lFyu75?|@7BqoM7CT=aG=WM!d+l#S z-))Qib-rTg2c2T2&`&$XzC-`$6f;l6y#QeQtNr~Uc7o0Uv{$#si2LGOJg)7Vj2u(j zGs5p1v=z|t{+<)Ud@+EE2CJt5Z3aAHza_-{wH`Xw3KXJeI#M0X-K(GAR7@39hln zAf~zEIRF*4Hj8@DG=IF~>qqm0Z2&52Z5Hnhv>VW|9w&T{M8{MtgKYU#DyW#>1?1t+P_+h+A? z>dCDs4L?r?%}YNL`_8ZDx0-&YwMUn%ICkh^wnosoms)X&&j;s>_~kyvyH?%8K*pr43;p=HbBcB{x^I^vR*dc*^L+Di-QG9Tj-($wFw1EB zo3{gw_Ymu^to(bE+qRUo{_6u8)w))Fuh(uhiwIq^uTJdzsQ9@{M`&hc^`Cn6!pfn3 zFZU|E8|A)j*x9W~7TRhpJ^Xa;CHI|EFn;DCMTZF=t~@`hpQAiPJ=^rvwio+mEdOBs zR66<8$g}HvmpLSiaMa)U*n9QaDnoy}O$e*s6uN~-^oQ+ zoW1rY%@mn;{&nQ`!o$9M4vB|6_*6G#v#QecUXxosMKwwOy!Gx=H`y55;}P=BEARf8 z?c!1~Q0Z~;n7vbvT;_gX>}PTKXo{Ne-W93-OE;^XOc`ZiZL{H`#qz5!wDf}FZuRy^ z7}@CC_tTD{C7Dw$$~RW_FA;FAsXn7Q-rgc1#o^cny#amij5t5F$v6As;}as+B|JB* z$-H(lZ0oQM10;;5eUTn;cgja6k!yF$?G}0sxgV;raOv7$5uq_xUb|UI@G&wMa$aS3)^R&JokI`rtX*R20zIV z{%E`Cm9dh3mm;NiSt9}ld#hh@Omxr|S$@4Za6v_r>*KUXXF|QMdS`sOd0|~om!rPX z(*h^NB@P}uJgvg}Wk_q{eWeitrb}i#eZJAZn`Cb{ziagoj>-WVvhxFypU$dWdak}k z)bv!UZnx@<<#U#W|9Cp=!<`Mn$q`99gM1$@={HVHMJM}i-m%+?txky|4GGgER%ET; zwQbLpaQ#`OVyPw1?qv=WpZ%%+&|Z`JeP;r0iP?V79ME^*=P~^)*Tv5M`a|OK*CELX zjvAuFHcWl+`rJk7mC4_g?i#y#mPg;)JL_{$e#C*Nb0!=)VlQ9lb~;kyQikXknJTGW zzgt7E+uY0Fv^;+LXY)R0&#z|xN_F9Fm&sH(@!`XORB^pV{i1}3r0V(p%MPZx^!D%K zEbVdlwxaslx+~wqO9nU^JuH5^{b%p9Mh+UAg=e_jTI;dAu;#dKjl`6ntKQBo*=nrb zBJkmcLG1lQjgwCF+y8jMXIH^f-(=*jZ*!hE#i7(_!ASo}#z*55wmJAJNO(w+8(R=*^3-aU~^lCoG?XOAq%FY=!)eBf>HDz~Sx`sYkrA{vekGD$jIa^eV z{pP0VJ~K28*IRIY#gn~jMGYrD&JJ2VyWbmUvx(jZPYHd9F>UJ&sxEXe^ogsLMp}yGDzxqz}56^a*<^?|H*3q*cPz@qp4H8@2D-mwDLS}(CL2hW!-yqt8R(QSk6W8zRb9EC+2Km(#G)ki~6>?1}={M zcFKlbP%OOpsPC*X7iBC8h8~~q78x$^W7=9v*BZV zZC^29iq17L^OjZ%xr5C<5tdhL59!z69h9*<(PEVAr4{L;oOcckeQ7yT%g^Haj8hW^ zcmyk_WcF|rX!)Fwda}T;w!cfi6Ca=7z3v*{eW{6!qVv}Mhoge;^yyXOd%syy&sx6Q z=jQ3@J65W$s&W5W=-JR?QJkwvm6G9m_d&1I_dc{dH(LCjPN1w$P|D?+^AAMp!uClT zw4U#taPj%OSXHk(Yq?d0g;}qTJ$`+t;$ZBmtjV_Aq^MHA3ib6%hGphgtT*3gcyRi? zb3HfsY;LS>ww$&)H0b+cw`V7P*UoW{9-FKwuyng?SfEdr(8=@eh=3KUFMX|Bbl=9d#7@E|=$L7rmVx)(qAJEO+2k`LnukJiCy%5u9 z+Q)0t60{opQWpLS=xtj(@R|CTXCdRiEG$g3c9oy7*HSFKR80TY*3Wy?FDWV(oZ4{L zPHKk#*7>VXtv~hR`K|)--@A&ewL;esPR7^y^g6Gcwm0>$>jA) zrUJKi+&m^5;gnK+IZs(U>cph9W23G;&huAMU)8jH#+@z?R|w=b8T~3dxYh7@?;`8T zD_&N(>MdxQr57T5qjK_h`Cr`^9lbep`|BxJLcWF{IMT92?@*AdwtkN z+1qp9kFcYP3Res^crMyu@kXO+;FfEbtehI{#t4 z!HR4v5y>-GFUFfYIBysIEYq_7%k5c(pI(P(E)*q%&T>7Fwd&TS?=Dj#pGSIF{E95Aud!90{xe}%rLWPZOW`-YdNhn( zemuQov~^NRVZU3>8Y()s$L$?Zuy0G5-(Cm3L%J(=UA5cTc=A!4*AbmAf+u*^=RRf4 zy5uEh9{20FhoFbs_opj0qn5|rUG;FsZ}r?2uQnCiUX9j|f9dYAzE9(#lLb>JZ~G*D zz`Vz@Xt8%&>i1o8^)a)R22(zlfaCuk!5iSCYDyT>R2tq&cm-MN4q)t#5vs!g7jX zrYf^EyT4F&POGooW>T^w$9hHNHmk?WA66y}Q9LR!vTo$g{2m*9TfDj^ZSNZ4<$gGF zmj1bSqpTmxFYNWuB(5SuJnG&eTaPWiWl0fUmJg3s&$wgYG$#7NP?3B6=ev0D4i>!_ zWO7<$#SXEYVS_E~+|nkOq$b-ImpYA^>epTJoblsnsdEz5L$~^i^s0S!;ORo~<1f@p&yK&N7+v%@uF1Q!%3Y%D z%*?8*y$^Jec=RKFrfT2&Gm9dY4z+jkyyv~;vFfTdoLcVGt>X>y9=>{<@42~R64&sw zX0UjX%WXx8mNP+?^RO=K>V|taEUtv#b1k}9yVCGLx4j#4!b%RkQBB&TZDBa=$;>Z# zT3o@H@Ak*(X<*Rs ziCeqZoG?Av>a8m@J7CeVjQfw21{uA$^?R_vzSm#s3^lI%yw*NEzj0?nz`I4YLmyn( z_T7Kti;!c5mc6u_wq)*oU#hDe&~4mxfn?PQdh^!4jq*3Rni}Tw<@&Kf1-b8xo>!&E zc9*gJ9(v_k)6#LWiGyFBkt>(KeE#bD`m`U@9(UieK&JGd;>uT_`ku8Lxp=y=+~GR| zG7BRd4vnnI=AKHY-fbCQx8{bo$>qthwT5PMt@WEF9E2_mwtOc)cZl5SGZ&?vzq|29 zMyW9{aZ|>}eedh19*W#teyF11!UCB!_N)4SUUb=K&cn++zg7%0&z*RE&1&t<7Mnaa zn;r3QQ5bi-=j2I!iayS^o6|olx%sHr&y&Fqsyxmt-=)4TseEjXX}U?H@vBX-)`g+D zGkiVL19bf}{2a{WzVF$2@noW%y{>^){05Oz7Mo5TU*=Vs)!N#1hq*-lK4))Zf!_*V zdNwxI!?uWIy`NVdI_cNZSfSDB{l~~n8x|RR`q$j?ZVzq=of+oU-Kz2Cw0HUn`|9?# z^m|{vdDhWm-=En?Tdqtzo$;ySVX^JR>lYrR%hno%-isR;CMx{%fR1WjRY-MFCU2gT z+jJ9`FTWohm-+o=SxLl*n7Yq?AJba%_nPnAka73+wLpjJ;b-hxcdS^gEU_l*XUgWh z)7uMw>uXNzJ2z%oj}x=Smc&R!Ws6)su%=3;SvhyP#J3`|=^LgE{F3|fP}7@l&G+hZ zPnY{zrEeYQu%vwbQI!g3E0e*YP4?Zyy++LQ&F*ih@a4#b%pY!x{8n9y8CpARxaH?v zk!!cqDW)5anN}Y1TxH?K+0i%RKE0@%W1=LVp-{PQ+45Q6f>(C$Q&koj`a!XG{?81x z6c^k3x^-UaOAij0@BMsBw?c`_?!1J!vzIPqEKpYn4%;LB&Nin+zE}UZYu0@}@`LwU zHt@ueTZwhw4_sf-(5Knpz}*WTztch;Hm9E7nHtj+sGSvAdDU*GN%4!9<<`YNF6>OI z?D`{Hdf2J`4)NnAZ?C`a5FUJCxLmsF**x<*509?9?q%d+yS>CN{7HJ;4$++38$bA& z?p!Bqv)p^r^s{zlDpTb&t&iW%`!O!Q==c+T>B^%et|RxlZoBCFDEG$f1G2q&rUkZN zW)#Tkd1j2AYdK`otHRdHpZm0iOgW?BV_$o5_K_PC2gS$eZx1Qd{n$Eqc|ZNl-j@ga zth}eP$7Y^^)vi$@VsQgU4sqwLh-w^Il=A$B=-qkR*GJm&uHLy+FZkln1>aw*c7B;O z#$ed5H%U_-Z&ORky!Kgdut)6iaOs%|o-;ybl<35Jep_)+@Rr=G$M#EIPfF~1WM6-E z)RZ43JxqC*6isFgk2dHLD)2GPcy>U}gTfhe#vUj--m=H;TIuVJT3$DnR{A*Q?%jTB zSN%+@*_nejZ?(13R z!#zLV+md8F)bWm)iNm@4;P7C1?v9`2_=3#0iXzXpryGq{G|b#kD4vz@Jls2IQB`;0 z-m+^YCf`f@7=L4a^TI&Q{_>`KP2wZ$?B{>0ZqmH)GcojezoUnyX6+vAr0(+bRpWxI zhlcLnwn(q8SKii-Eq+#M78A;6e_GhZA=0H=Rr9$o{T(EO`@Q>obDz)QMJKO3`&?rj zpqFSJj4UD*vHLvv4Jkgz}jlxQ7rq`Q{ zSpR;;nM0nM@9w(oE7x2gWf<+`7;w4jazxgvn0Z$mWaiwTS#W-!YOLtlBgL_?CJND< z+HS3FoAcH0E!~^1A?3f4dmJ!+K~S@%+mBPtx-wesobRT)4kKNE_PJPah4*k=q~TDr zt6qD`(g#Mh#^rcV&zJr2Mz0~|o$h7zh&yEsn!D~km7bzw9cl3Hb6%$OCRY{xIR`^_ zZSg6xiEkQmu<*!=nbFQW3#VOrUB2dchSKYa*~wmalm(CXdp6JL#_DBZg=ZIkXgPIb zQex1mlCQZ}3?_$ddeeNSm$*ZQ?X4q9k5}D^@V@_C# z?0@*ZP}lR?^1UU~u3Q;E?VC$h(2Z%1ONV~VOVx-oRjMzkx%f>)A0@yQiI4IQm19Yt6Lel(|px>cg!(G>!W8JUU3Z z{JDKV(>i0F$|i^IGC584V*7cP%60`O1C(z)dswTd>6c`n)lYx7$)-0h2fY(Ko6eTW zWUjr}`$^ZuA2UKe&da>#RekYBg#6U%qi3qeo*DGfElz#;g{fsn`x|t%^9e|;jCgo< zTx2h4x0(RoiQRwJ)}HoAQWw%*U1Z*CXn<9E!bkt;GELzLlXK&2(sXp}Ee53ApXDl2 zAm0!?S}tdzjfG->d$D9?w%?P?H>Df8rVj~Ejl9`4{M@<1wTt~E9@;qzz07x>XJloy z*ZAx310vbM`?|NtuPUjpe^Xkk-}7eLj?JG>IN0tBEuCdzF|&_zv{kXjO|Q!XC(L|( zB;l2P@T`qOBfiJ2)SeOXRKFzAZAWq58-uXHhOGfz;!LVSZH{?vD-X;WQJl3&Xx`D6 zI~%W^S@3XkouSeCzxeK!sa{@`?1NFnsX-3R#=nQNp|()vmNzI9}Wt-kR1 zp+j!UE~#8QXJ`7ZW0(Ek3N1diegBn!$>+}o2iSgdQOWya*z5DE^N;#08hw6Dy~XL# z!w=eg5P0RYQtQ@BlXVVxZ?0yH*IDM*JyL)CjHLekU6j|w@831{oRXNd#L^=*i5C5C zn}2?O`)Oa(ApcQW??auPm(1_>QN?He@MkWQO6Tl;7`%B+n7VpG^_Ak12a;7Uyj_ZO zb2QIBw)aWZn2LR$0qlG#6*h7!(swa{uH0v#B*1A!Cit z_DL=JYP#pl=bkTDHT;?~W7vhlJ!OSX-XTRF-F1F-TiR$d`P2cyS@EtO1EMC5KQ`)n zsNs-{m~MUh@9^%iO2uhVZ+7({@)JOn-!1#tOOig}h&$x_Rx6XIth(_CC^O>D^B~e*Jj#QAsY?POR#x z=l82IDwz#FXO5R@!M*hp`zBkg9B=V4;4jBSw38sH*WgHXg%Eom&-T2 zA2(lV%@$w$de+VCki+jT#QVCg&K^GVX;R9##+|)`WF>yg5EvaUBlBd5_^9XV7eoBN zoxJYpX|B-q;*7}(!(U%RyMZ# znKglp*(IN|3R~ZmE6?(=>T0z4(vdS4^(NUk`D$w)Zt{^>t@EpJnWvn~y+r+;8G1vd zZ~VSGd3#k!NKWZYBkIW`g=}Qo|<$k*1Y$o5zpO= zWQN-JdSj`W{va-TwxPnZ+(+YInH@N?LEfW!ppICQij|#2*=Z+zn0D)=f3H(vsaB^4{}c2kqXV_Kv0o@Jpmlyv-;mlg07r#Jj2)HWYii41r`+YwWoMU)3&h&dzdz?lDwi7iB7#lrVbtan`UaYv!qM2JMqk%e6*Tpts}fXf??a$|<{m!_QChgbJ2``Y)k^xC1l=4m!2kIfYP zgAjoKIL`+k|aj~_z1DqtQS}&HEPc7E_DrnsAnBu@eW)VU5A;TswFB2$Da1XDm z?|1wA?knjJ$IY7TS5o0Q^z5gm^DkrVy?rYly6lr0fnJK^TAzF(8Z7RuD2XZJO;_D^ zqh)}@?TrpO6ZQw?x~UB6@ojsZ@z~iWb$$!RJuBMyzrEg`NfRd6>$l%Gn-Ue)NPEHhODjIGBN({hd{l`v9)QX&R2|v z$_JSLesjUdIzQfS=A-vL(n2@JT`jjY9oPF~woGNveVta5Y75`1FMOh-&nfi2G$}jl z=!(Qdhi-}YXC1S&d-Fi^^X>_up?Nj?Bb{v1cON)4VSZ6n?>@ic&gT1%v45FTFk|o( zn==E(%Rg;S_G<0^BKzbwh4ij<(-Uw1((IO_xqtMOZR>Q`jM@=R>%?}lI z%e^tZrSX|};P&@rBGo(YEZs8V`R`{RE`}x5d!63+SwB-Fa?Mq_{{60%CB;b7{{!Ge2)zCYfioG{ya*@M0ayJ!bPu#|F53aef}z_jaoOxn(QX z%*@|dvi^|5o$4`t?)MsZwTsQTLeuHnEL-~Dwl|ENmMFBN@>-$h48`!RCk!;~q(3b` z)_ddRpS`VbhIp9iW)+_q&)G{KaM3YXM>Zcx*fmOBk@9AAK8!JW>**8s;Y4xUu#-?Sl)D#<%2I#nW`Gg z?#5diWgdARaL#zc{viW5{hZLvx%0$Cv8A`uukEs9 zR-KbeIPEU7=t)iW0VgH9T7hSWL++_fbL{%zyroxA>&QtyFP^(~J0L8s^RhN}_@CRb*4q4Z^X_M}1a8VjoNPY! z;`#6Qt2BDgjS?7DYLa(Zp!@vaulJm{KO;W*hToIMfs>WucUtvRwGlO0vuNS_W0q@D zst;^)9x>YYNUoM<)b(>7Dt4)*^Egk3T^Dz36aRWFx__3n|Eg=cD+=e#`eb~h!bC4L zBi*ox*CKF6ZKYz?(I>g%jnIvZm6s$rG$SAI2NsxOIGSu-9U*^YO+R!TtA3>Zb4g zs<--UY@cprt6h@T1@P?pCmRXYJs9{@YRcgU zheWQ+N|#MIUj9|zIyC>5`KbKcNmU^sdxIVQ8#2eG$4zejsi>MUw!ce3*|tlbo8s4; zXxU)iO=#;7o^;up0YwU)xf!Obd+k&B-ul3Qaovrc_6=*SZ`iD~Jil9TOjwDlR?g97 z+n=@=xMZ zA<(j$%7u5^?Rq^-%?})K?#cNLi{9EqhGj*Vyv+P|?rDI{UB}w-LhhygYxd8#l%95F z$IAiLrow9XhQ*#;drtOPtkQzy=x`AYUZd<&p=TlPbEAeTd-W4?=y zGq1;?uRbM{)xX4w7iL$_H_v&VuJviZ`TEatQhSE057DT5RMmWDeO&(P9)Ysq3zS@) zqXVyc8?D(Tu;HhLQH^a`@PP|S@rQGt@3}L2t;L|R2O6C!6ua$cFn^P|Z~5WNQ!XDf z@eioEw{6S%!-q06V&<=$WSM+^5O?H3{`N6z*A!Rh%pG2SQs>$);T>TjZzlEos`%}f zPZ!muthY6)Mph3KYF}tgNX#9$^{mQ=K_y?jEY_Bcmn_|q^5{wbHyiga*y6n0UikLD z>9ajoEztD-vF?FL+0seDp-`{6%i^rb}mCnvp0~oR-~Xz&LHyBhN2IzUf^m<7s!! zXt?_B%`f9OMjv=s<@>O;=HrsH*0Kw_1xTk(wHf9;F>b(?p3Wf-VPEFF=;hL=Ff?~^1g1Y~FBty^K$-1SkNWZx&V69nd0G)|qc zZAtZ8=h$xE8zuIPtZ7cN554eqiTQ)4aniG*CdH2J>9#XcWn`SO?4vo6;_`CSUiO() zc~H%F=tmD-A(KRj&!&fLt6>{DDYE3S9bm4>&IMJjt22CNKEw3Q#A_ibBY zwa2-K?!9a$JM0`a;3VJXq0M`yw~C%Gtd7zF|YSI?df+0r5#!IbwtI>2}ZHe zPj?<~Nj<$wpw94Uk2Cu}h=>iJ6h7Ol*7mT5YQXHXr^NQV9=!Qx(2y$`Ut_+UvMktN zQ+DZldFqx`Ym#Np*(>Ihev3I6Hn=XXB5M8JB!d?l?xo27$oV$pk)?$AZ^eL+{k-QP z-|AAni`LDY@$1FY6KSdv`b~!ee%f`HP0livF^Z0zIdf~~m(kfukCoPkD_9(OVDrlS zCD@V{!%T{t?p|A&%F z(-CJr8YCymXnMqq?~y7T*wrxhtM{ye!A<>x?k?_q`@FpD+`4MDiCcaQ8<};!a@(sO z^9MMn$Im*bbiy#LE+Ek_V1DC`G~Z$+wcO&ch92{tIL#JnOUN zRFGy_)t!w!TNFcm?R|oM?6>cX(b|3B<S zVeieusr=Ue@vX=_W~K~Lrc9BPWS%o+rZQFtg`!ezW27=gijd4hlzB)SnJXok3q?YN zA{zAVyq~q+=X$U6*(Y7D^T+S{)gQgw)4K0@X#-i6L5M7Ji~TR7}8zdpe0 zn=qZd@UBFagP%wm=HgQ$&J;&ge$)ZvyX8Lba&D|-}jYnnSmrH z@cE@pQ|r>-IWX^UNy<^uktW@-{gc*{*M648XBuBT9Z)1|RK45h&o$t2i*u2R?CO<} zva2tJq@u=0(-;yq2Xb>1&-t}_o}G8#dD2-sbK8N(PJ;V;`@oz+CW+46`%4Ok<##z$ zleDshP$;`!Ti+8rw3e*qML_kZXbY8{Je-e4oVkjIL{J@um8% zkH!JH!!c`1R9Z$Ot6JHp3dihO`^r`AV|MYJaM^v6Ch^wS1ctHBoxW6unHp$bUm#IG zYv&T#AP{~CFZy*$-?(zzz*120!qis0?ZVPsBgc-aeLFISy`1G!7QK8A+&kxBD)WZ? z^1IvnYzDqE_&!p)rF^nd*nw-fs3Pnp zRonSy((!EJPrK}Ud4=-S9^X&?qV8a_ZMLlnRY&&ls!1w!SzHaxIOdq0bMnGk-v4j!!!J; zL-j@++Ygwg@YqY&SCb8QE6HRe*O$07XMS1!D5}|e*|0X^f{a7(7o&>hnT2?RyB$3h zowx%riO;tso85Tu%$?le9i_i)d3`fZ^F3Z7gsR!zUT;_>xj87ZK zHczV3Y{bjae{YWqe9N9$S^3r^LeQ4%`S(CS0p3Bwac5qUkK*Nxn&&zmvwDYjL@ED# z=(1tkfZhg8e{Lgj%~Ip>#r%;y>xV|;Z#j%E^}Na0?5oICq|WG0Ki!B}AMtJmB+}Ed>Rn zUl-(KI<}mCk?&BlG<&1J;gmPUj;6akI=$8WzIXhM<=C~z0=Ye!o?Iwlp{9+B;g7h{ zc>9gcsk&_b{=J4Lc1+$=F29s`lWkk)q>)`(^tz0LLLa;R>!y=~wmq-T;Ck59|MA0K zey@q9bR5OeNdA%vrVp;e6ZE6+L>nyvL`V zqqm-(r>uQrrEPm;lWq9jumi0R2X*fz-nHJLBDQ0CgV@5ilJ2CJYm+=Rvbo+ANB46i zJ<|wusY@k48uOaV-p4qlA(&l&%qyI-X-9wRPL{(IpEEbQH5yE}m9K3{S94Qxx*@cU zbYRx|yqDUp_Sn$KWy0JZvVG#l2Mt-MRI74i6lXs~G>%nl_Ho?%ma=4Gs4;GyV?a{I zxAnl#K|OoH>%P^Vyz6%>vz{&O@foaie-Jkr@y`6xGi&aVv79!UbUDQs%h}S;_7zcA zZpAM9UumE%FU(IXsoJvLlXBNN{<-apZ@GJEZ|B^tfAV(Zim7>BYsB5mcj;6HJNbB$ z=0v7E?-$*CW^eHLb!c{`dcldT_PimokX^U&T$3@O;g_{rNRD2r-$r&wa@MojWqKxI z*P06j#rTl(e)$oTWFk`mt#wEGhk1`A_s4r>sP62HsyW3Mc8U3xYS*e*;y0{B-Piefl6f~;j%sEmx5zMGhO+!Q1GshFPmT$v;r_5MB zI{FC4D;|eWs5v_pD?a<0{j6gy_PFlP`(FR`Uy3dE_R>>;Jpc()hcUZp43z-diXZul zpAv*2!&wZU4qCeFKJBE0G1c10@AP0yCNC1cfdP+ZlJwO7$pKr+jl}9Cj zKfeV1FB%Wy2Z#r90@Nb`b^!4J2>@|xfE*wmAORq5Esz7m10(>%kpekDJU{|K92t-U z!~-M%#H|BzfOvoefH-m>2Z#qq0EnXia)5Y%1b{e7AP0yCNC1eV0&;+OfCPXzY9I%Q z2S@;jqXBY&cz^_eI9ebFhzCdjh@%5?fOvoefH-;}2Z#qq0ElA%a)5Y%1b{e3AP0yC zNC1dq0&;+OfCPZJ^*{~~50C&5#|-2E@c;<`aV$U%5D$<55XTDS0Pz3`0C8+U4iFEJ z01(Fx@{%Kn@TOkN^0ze!ukORa6Bml(m0XaZCKmtG%Z31$Dcz^_e zH~}CBhzCdjh!X^IfOvoefVj;-4iFEJ01&qY$N}O35&+_afE*wmAORpw7{~$Q0TKY> zM1UM19v}fAP87%i;sFu>;>3U)pzk5FTEg_ziz~+q%$^UiCm{Au0Ui7bvu6eRA7n9m5kMSTu%*4F&eH9xrqHT zVsD#|>BIF1=4S@@hcvF|pZR4#XkLVt1aw**);^qnf;K|aI4e1!Fwh|mQHJp|St zC1ky@Md)LIHoO4VISp(b`@1f|AH1QMoCMIeX8+Xt+aB35TQLm3X{YA z2Sg}W0_QXs7epwB{%s}xZ~ss}1g;Bc|5LVO{{QuR#sB&T5u<*7%5V=RR|O1+P>%nM z?Hk~E2IAjxkYBhzfC%M71z7&K0R}`UZ@z)a;eH1ql;dTw_~7{uB9sTGV*3+Hz*snO z=bs^h@qtW;&_3oNW)Jr>kPk8RCMKtV3{GQ`~Ybia$`X3Bf z5TOQM3A6tO1{NZe^EPAl#{dH&lq;oUayTv!p&ZuFpZ&pqpI?9S^Cv(5nltG7`e*)t z^Vw?m2Y>AUT9W_N7rZiI`2Y9$wFB%=$v|2l!YuIyWBUUwP&g2wT&WAY{#yVBL@38; zWBaS!fB_N8c@r^vxG#kW|fyi3nG-`(*C=> zq zO5pjN7C=;v(&gauE+~Jc^x`k<%~Sq)URr6pP;X5JW={nfzll43abEgWbL}mde|W$D zQ#iK&_>~=$FI8do@P7RJ-?S$dzrdxH#Sw{|CsTgYe+u&aG3__)(erK=Vvp`WVBR36 zBhTw7R@iT7UyMA@%ll3LK}h`-BKFV^F&swfr}#JRDXRZjKkUERf75H2J-p79|EB+3 zWc;gt(>~)4<{#dNBK)TPLuC9O{-*s6Wd1k*rhWT$EPiq@z>j{@{vOi*ncuYEa0~Mf z?>900=J;Ph>i6ky`maIa@BB@BV)wInSJ;m%Wc)}GJ3O(82l#Jeu>8S&Br{_F3v=9N zB>z3X+5b{x{tW!4eLOOLL%(VN5m|q}{ib~>l7E;l?iJ=SdKAk)J2YIO9aJZ4#q8nr zcjPzYXG7Lc*sjnD`Um4BhPJ=h=hY(hr-tN18L4m74>KY^ zgw*3jqPT|Jl{MQ$h{Ocb?{AP@Q7GvWe0`lL`i^Zt|I1p{AFne{thltjXQWIt`2=pN0 zpJRM@zK4j8e+rTDAIit1Qk&s#xEd5!T!fdNEx{PABgJujdK(RLc+ z%K$z^^nM0@wc~dW^8?$3NO2A0!+b#m;rtCL4=_FW`9p|*DATBW7Q|!u$;p+5ao8w0^*QBxqdCEA($mr2cwVXiu#FgbFNwaK8!>jgy%DyH)xh zTIKjHuF^k6Jl21>UxK*O{>p$<^)y*HF z751N4{ov~{|8PG55$%W4LriZ25J2S3#Q5-f4iUBIEnAr%)DF_b;vXV%et~unc`Gsh z@N=*bq5M~93&sha>mVvsW9>p3BHAAQf7E~c3fI3-BK3#HNsK0zf7_LgKUinr^D~IV z{Gt3Epw8j`03t8=oH^VNKt%0{#h*dK^1^-ox#e`4_ut|Di{O!JCKqAqR4ZLttJ(8Y0>ZvHYd1uzt0O)F0}H z7){JS9;{37dIAw`hnPL@3iGc7^x*t}i25N$6Z3DoLjT0<@hh~)f#*l?z9&Rt@%{%N zT>s(s0YFS4a{c{}ee6xF{^0cu;(z!d!WjC^`$uRq#PT<^!ulmns`VU>9y)BXT3(YezIv)6e>nlWJ`Y4}R{|T$iA8*#m<^?hT zDdj7xKVtS-E6hLdD(5dT|3j0BI`dIztaDxet1`yKVtRQv&#JOX0L4iDuFoRz5ybdCt@_Q_-$9%|97CD zu)ZJ?^M~?@`Nyx&KQVjT6`nuhiCjO?IEm3ItF$K?{|d*Sn0?AB^S8Ll`lYyz)i1nn z1QE?6vG@tAjGuj#{)JX)zhjm5S}U~2RbY9B_lF>&c_u~^%m2_S^N&ki+4YB*e_rsp z3V1z&i1ve+y~PUiN6h}n3hlH0NAsU|mHA6q;rihV`U%%l9-U{z=#*8i-(AS}7oSGn$2O#z zU_C;gLEb+OLcUKy2zkGs1F@Gx`%48rCq-#qL@q#u>GOhyQCba=J0f(S0A{}#*vss}XmLPisA04u zp!Ml7nh(&oR4`fs&|5Sx8om$bz=F~IKpu?Hx;B{H0LW3$OT_X6KVR?~`F`m=$oDb7 zM!v5(A`P>LpAR{bjL~qvvJYwh7$T2H>~#=-YV}xqaDJij2O#yd1F6T|NPVdwbURXC zHAsEcAv6zC|Cf>Z5{AU1gv6tT&=W}e@re8-(%uL{Pa-s$pJ}9hRPKj--z56Jt~Ju% z9AtfOM*I&T>pjzRZ2aK*If1O_X~_3gCXZwK@I9ceDU62iHJvNNXn3Et1hGGcTu)+= z_lHj-^8S9TJywvIS%fY^){m}POdq}vvKi?gnqTz&=s6@`O9=fEtY>h&)^EW4F@lD3 zkn!AsTo1dD?^B5QjM>BY0;#4k8s@XI8>3l3`{?)!A=k%)$oukz$b8y1fVBtnc?79v zG(ULoyH^B&xDSW_Qc(hk2S@;jn*nlwcz^_exLF_vhzCdjh?@g)fOvoefVhu94iFEJ z01)>H$N}O35&+`nfgB(nAORq50muR30TKYB`H4j8qZJwdWMut%g2?rd@i9VZGlaHB z?5z>GD6$?%A+#JqUqj+<CmOX7y^;M(##KxX&&lP_FdCkJJo+%21vD&) z?2pbO?M1)C^x^lL)Fb|bkoJ<1-w(Nt$iL@d?ZM9(u1EG;#aWmfp7%E*@+-*xP#>9J zq{x0v4(VSTk`L)F%pcqzXdv{d5ljyE?>R_5?jZe(MD;5%dpJLDAn|jTVsdyM^+0}~ z1RejzhnPOR9(N(@S1WS;Wkar)!^nO@0=a%aMAj46qJPFWf_z_02co~Z8qo6F?_@P!}naKk@nGgM``VAm_1zoERg+O9x@;9Ap8CM2u*@qZ#9s34&-3|;Cj`9 zjK49W?}4=EjnJnMS_T>K`V`C`ynYoS{W*u&S0eI9h`lY6pAE?P1tRU$BJG7D^2-R_ z7lXwMuQ#s{S`q1AG-7XnjOR5(?u_K$3~B#0LVF|n=>Fdxng7R-{2V~Wvme=?xgheB z2pxdXR}fkY$;S(1yhMtye8TI296~1|`FVxd8zb$HA@Ui7UP9Ux&nd2dM{YM1C&jpYtIA zq1%xCJL(UmOQNv$;C<$M2#q_8-Cu+9Qbb;k$d7pZQ@;$=N9b-q!{<)D2;Gm+FA;hW zp@$Lr4MLA1^cX^qBlILf-$ll!7@^A$dJ3`sfY7rD{Sl$(5&APiR{$E0PbESZA@n{fipwBZnk^FQc?VBL(aQUpBXvF zL%vNj<`7M`0uiSSu?v33MNJ5axK6UG-r_|2O!{${|3bv;dl z?{v7s z54_H}Aiui}+u5@Y%PXv3s2_^xL;hCeehB2-Kgaq7*Bh9(lL#N?;otzK&k6$f2Mu{3 z&+{1pe>ai`*xwnje!z7C>YqT`hx|w)?WZC6BmsUikm`21NK4MEG_@_%1~FUI-sdi~oRi$UaBqJvN`xBJsN*=K-!h%pVIF zX-C8!ecq>r)#fV4-|g^drK|DO>5>B#&x zLh`*6@qZcV-)Uri*dq2D5&yzSyg6A|eDHpURUbyPfP5Dq^8v8`21n#R(GqeW?r%jR zf1tlV*N5B>gy(|#C@e0x?}N>uzyEeJ5z~YBtKhsSByu0r8;So15S(_hhO9$-ZvyxKTP+qdV%-%vXU_x?jKS( z6(atL*+IT1cpd}SkCocP`n|MD|3S$7Mg7D46U$#*7nX0hKBM-mprgdbZzD2(ziVH( zfcb~}C)6H}KQaG7$at6k=J-`2*Nc_b4;;UfNd0rJaQ?&kNkOh}ziTgo|5<)ff7_A%3#DWIhtEgQxKa8V zGXGHfU**pang1aO{VV$xr2bNoc+hxJIv>%GMEw71{)QvhFVy~5^DhdSf2chgFG@Ef z^@G|I%O9*iDP+7+`(O261*sp@9`1k8`i1_Ze~~}9|01@2>Hot2ui{64{}7!&&_5bK z9EZEe`g0xW53&41`yQlzQF~(fgZ6cZ|7+3M{DsfKVf_({{{~X;ziU5+#E*{uulz3| z=aF(`K0g5p7G-={izq_x(H>kZ78+K;7f*jUPN$>r7ia|`DzeVJ!0)SjM6)A1fv@$cm| z9X)im`O*&7r*iykYe^!$YR&hWO((Y#GEC@fTKRIhN7maGrgzw;x)XFld|>H0O#@rNaBx4(CM z(RIq)f2@0vKck+XPVQBm^fv?N`Y4HgX%|1&^c8t&ljNR$T3EB_exEkHdw*A9#W9PT z3UXSH=bI<@?>^$o6RzSKvoLJ+Z04@1%IodwIjUxTt%988KVN(L@gqq?g&pS8Z4i6H z3Ta=G&hON|CNJjYaP5gF=GyoIZ1hZ&C?!dlMoITxrHuDaB-uiBM0GNS$!W9XT2hsD z+b9JDwyECYG${vrG7x;Wpe#LSvji@9d3to_mTth+xx z|EOvIyt}Z)Hs5@>UX3weaYKM)-9lC1G%g_Ttkb=qhV=~0KB8izc8~qTs@@W~ zW!E{_T}iwmRcI^VIDWR!)@AK}_p;n%)+Ad-)-_&cHR2spcZ$D0khV-^Y`SxF?&cguiP_I$^M~8o!_5f+Jjx0t`JlVMOqY= zCz3O2M^FAxXxi9A@%abYiLS>5KRg~*37K^l+uq$hQhSz>KkSOY=$(Xv$x8_u6xm+q z^3tVJL!aK~Ej@bbtZL^HFXutSvVrB3cDio@MyWf==cy-IdxG00;&P)iDjU^}x-1x6 zFUj@0$@aSH+>em^*)^9v`FS1(3N3c`9s6h$UbfZsPC~oplL%MC*uBp3bE%>~he#kk zLd956@)?Olt8J2hQ6u5uL&|i?<95Q2v?I-U9vLg+)Fq8bBpPQv2*gK@2CsKC6x36| z^9FPn=8sk}@8xO!bX9ci$87==oQcy1Vnkmqol@1cd#xTnLwHy*lVR)RV&>%fYW&F- z;qYCNr#PO}e7hAV@i~KPMBdzqv6`LEAfsdAX!`wV3C$R?8I`VdKhGXhN{Lb(M%W}Oxt4^4Vwzq$NzU%}WzMer;=Jj?4)#So0|#3%g-Dj* zXzNE8x>WS)6c+7j*E+CsJ=z+=w$Ya{NYjkf{?MUI`+K{#kBp27h8n!+t5y*<$q#P3 z+4acV^_fb=mRpg>^N+pVUU&8BItyt(wL^0`SG-aN9-SOjFb=(XExR!=*f@{#f#h@F z`_FxkOEDf-UJ^60-FPUj?zO1?-hy);Cf^k)B1j!Vb&W~~{W1rwJ?B0qsWSNRg&yP$ z{b&>+Ke1n0H?82mPfoVXcE)g@x1FlDa?#_!imA?qYw7ZN_eZ^_5^h=CxH>j=N@C&b z_W=QsI+ui@AI0ay%c_Pf&cy6cp7e@&_xYgDgW$FsZ|-Is>Xs9{MssY??@jZb!F%;G znhDGO=FW6`>?~i-`SQ%OidnzXbgsU2PPw>Xf=+Vl<=M*MXARFPwTfFB-%*~Oa^cSJ zlQQd+EzWY&&^8x~{#0{yX|nq14uP&?8$Z3RT%w)0o%l&pKKzFLRu}6wqYo-k@4m&U ze-qlWd+2FhrLWhiUb%}$Yo|m@UO&#MN+fGD32(;Tth#7$; zH4rvt8GYw8TG@QVA)N6Zbxrl73z7}W59m(magpeDk3^}J&^52OB4rJ^*P^+;Mvrn= zr^x8A8ol)gp$nRy#NSZeoNu%EJgl}=EHW_YuF;uiXC0qcTYh2Cx^2)sQeNSAR0uC+ z(mk?>>p$|UfTcg&YySBYAs!#$&AIF5%J>-T$lQvLT6d}5`h1hG;oIC;ThCiOUVLtn zFRK5<-qNifTV^=JI`4HIyl`~$NB^VNr3cyOqr$Gg`)>JMe1A-=A_r@v)|40rtG}A7 zU5-0#mAR#9e)zW&N`gjw{Wn}rL?xQ-k1_ za$M76!QIJnIjKIU*}jMJw4TX1!m47c`|t(N9Dn_fF}kA`%W-o2)Ga>-E-12hJXh#% zoS(h?#nxGry*|H8r%-6cs51r_^+Y2m<&d~I#RqxNDV8ut|~?1LlYyp8OX zc*Llwrao_BBm|H1sE%bEo^01}D1DxsS8c$yR8%W$7(ZpjA?RJe<#b=^tJT)J`4245 zXl$gjjB6jh+`r*qQ|~d^PXVqn!&I5d!U8sQkzT`gfwiRtWtok>7hjs4Ehud)%-4PH zcKMLCe!a`3a6NyQC_&1*oExL$kd9;=7v!} z?p*-_->U(3qO)i&we+!PtY=+v1v7`4cNXndUs{B zf^4r3ZMHH6n`8ECj_DndFI6ud-@vh3?L_*N@(qhOr{~Ak`;lC8CbjD+n9i|#Iz7m= zd_%ds$>7dF+XI7?eQuTQ#qR}^8aKu&`Lh=K6h@u*J}J3zQ(0Y`^UZl_%AvXCD7)x= z!c)OB+x@?WkatYqUcBRV{BlXlQrBCi{Ub{b7BbWaE^X@Aa%_5ZdriP2v9bhL?;8oT zQ;(-!%guQoeEhQ4CZJ_z$T*c=`u^19;{(Goy05;o2>E0kO5XQ)j^+h*>&?fCdKwH< zhFtxVO?lc5v}zkJZSmfFuH$`5-sB4o9i1-O>}K=2%DZ8ibQbX>`6EJ)9@TF8W>xw2 z_`QQ|?O%uZgHmYs1Z|5{qBt{RcjDwH-X5E@%RASs&sex;o%D>Z?QB?|?xbTfYgA(B zd;QKQ31(!s*JPY5u|C(|^mSLpV`|l;j#p6!)B8W!Z+_&aUsd4PfAeIvLTD)|K&^W(gw)XTJ|Yxjs{^zQIw;^R-cYM1@GhnX?| zm}&Sa85(6$2U14oToyI)n_H$s^Rm9Dr_gk0j8AF%8d2>_m`mS7<972aLomm2kC3p! z?}HP&>OR(;xb`IBimvS(P34y>GaH6aQPe(U@{J03c-#2Fa2sVgGoM&CUjDYpN57VZ zJ7!a1rIuXThr&dtrZ_)G%~VTXa<&lIz?H^#$cAb?U$9_+=fySYB?*ByL-60T*>>5w zbXP_MMFbt+@ZgeNZZYc-uc^_Vd3tiw2Q00R+1^mcAEkG=C}^r;W=y(|PSC+{%%Z?A z&aa5##u&vR&w1xD?pfC@JhNP$=~Whrx?Qa=rtyAppYDFKi{HVO;g@)c#UIz3ycn@q zGOYPcBZg;A^)pvwM2yjqS9;-xd1hTV_1I@tnbK`Odrm9!tFzt?Q#!%3p=~aoDae+? z?0IOK7V>wiC6m|3yVl7uzj~IDVX^Pvg#useHvx(hMLTZ4TR!CaB<%8w_c48U&))2u za8PI{pL(*CwKbxFbCH+Y{xah{A-c^fbwOEQno8@erLJmGev!?AWHU8!SLZ9GIUb3b zi59o>Bd==d-OTV#ic!=tDBsK_xW_}Z>_q;YSG-2;I6LKs`Xl%-DGHq`gHO^e!f~c0 z0{o$8=bMEqTmUrjHUHmOp<2+Fr`!m0)dBiR-*`&Vc@m8E0d{X%NZR8U{AMv!a zY+sM>(b+CP7x~uQbxd5GcaQvcJZHQwN!JzEC6|rWM?z#b_7w&ePD^$<$G+@N<;vKu zW4xQHbx6x5V#tG4tEulewScLvKjlDNSh!uvgjXS82jh#oj|TcoS2-r~|z zx9$T0?O7q5Az|s^9|Fw084etIUdbpeU@BVS<#e4sE>GyGMvtoJhI<#TvW?AN<(g{I z9In+%ZyxWQDtWf_z_5EqP?hbe@V#a4!rj@#Jos)_{QRG?#7yt~ckYX_5?6BSD|Q)o z+mxla*S^l$*Yv``i`GlV%BQ>{c5kDTNt~6;Nrq7e0n7ZMOeaC>r84)V6Zh?C)EUb- z63MgEIK49ZtepB-;~U~>>9Y)Fk^-VNGu9$x2ScYONZnDpI|0cKh;20Q)i4WE`2Gv2#L-cewxf9M7I@aVaV zhc0P|Dn!rKGWcB2x%S@w$ga%#+jLc`PL?DA0)CzKGWws|s;@aYDyb-Pu*9EqkL4*g zc2j3~>|!72sm+y^HGkBiPpG0$^P;ujXl^B5bksA;&0JQ)ZE7QFLR!O?+>?Cb8|bow zex4ZFPCbfEE-P81yvSJBPcf`I_JGvqTfsNgDfKlWBYrgDyX2l|8WyST5)1P@VsIoi zs=i3_sU~0Xr241&p3nBUmQZMCyX{N3)h;8=RFFU8Db92+q zRzBlPY(s*50ulk2B}4Y+WMxHe(`I5C65m1fDs_Zg;Eey)!%x!F#-r4@nl>MPsaY-R&biFO*rS~hqzG7dXYiVYqL4iWTWwG<%7R$xxP2L7J>d*ZdKNuFycz}pY+g>zB{o)D zYh5Z*tlEm?TblQA&n*V-;!$SjIpqEDYe&J{>yeArcJ{g3TbFYtOupt;=f{WXOXs?d z3jHwIm>wFo%T6TW;g-yvyd#%BWk1-^*}eTG^L}QxDP04X2SZ(bHr*2w4j-pn&zp12 z%1z!|>@S;*Yy3iXSIb*P_ha2fMMeDw({J`xS2!!@9alf-QM0$DD(}vz*`THQ$7fr3 z2U8{7-E%x_I?cZ?xjlYX)4E|gX}S1TO@+j}n=VH)@7P7%XS_7wx+zpv<63t^?7P>c zW9n06A17JG+}v9&w%^V-5Nc^`K2bO7rDTi5&AUvjc5b_K$Nc zH@UrX+MmzYH*oZWZH0+?QC_mKPSXwkXBk=1tzRA&lwGbk<@|kK>ZA1p7yrWH?{0<6 zW?$A{m~d7q=x~T#wqY6TlG8}d&tq}PbG>u$mMwep{SU`3pB;Jb%-L&oYpfZs#3?OXEWR=9bsS z(#u8?hRNgDag%6@~uHIX9*cKEu60c;SLKqpU~?gTo2lpp8?P4!b;4dq z=V_#tgmfH|>#7SM6P645UZhq)dO3ztr#NtU_xk5UySuYg88TI_2xsV2df!Mqn8F-& zz)iaU!cl`4D$DPwnm1)z$v-d~AkjIKNj~DY#`pBKWS4L5@kgS@6`$P5OEZca>)$op zFfa2`clwLvOzVi;$kAl8x|6+mE+v&_8HYJ{ixM`|$mg~l6p4$l9&)(DS+T2uBVM(z z;KFAbE%#02{9!JO!z>@TQpp`XCMLHgn~O$dxTL3;Hj<4zyV}m+!#0w~xo3ol$EU^K zeVbhELw>ygo0!zNc-wRDPph7bpG#+~-tDyZMpmq=amj1p+n3ND`@QpkGp6tmpt^Z)8razii}#N~_GTque~zGU>%`DM#0ZTU87+evA!i zjgEdixcL4P;geobcfAUkklxw*Q!OMdqt}x!c$J!x=wA7L$hy69O^1r<6Q=mZV3)_y z>uW4OF!AUe4KUxEyw~ftsMPwoU2JEDkBIVCkW_3p75(9vEv2G(;zf^PsK)$V0V;Ko z3Q-Tzh!;{7t@}eZ%y8cGE=}Z)S}LKE>#lMg2~0CM_fEY2P`vbmsockkZ*%-F{jfUt z!0FbQYp_S*v6*hFgNKHvgn33b`*0{MUXpon>*@{Rc@Ju~cjPTu)x%U;=}aas{Wie61<*0h6-X7Q)#Xyo0t zDdaqsT2G-F@H$h5jX`EPfpMg+Y3I;DoL#n#gp>VyZc-`r6C3rm&7`E+`i*J z({4}8d@b7LoF^L<^n(iN__9>ppHOJOk8X3JmCuNFxgaPQ>ELS1p&r^^o4q4}`b}oG z!HC2iic6Q7)2fVZF8sWcx9OWgb1*=XV2l(I(n~>VqwRYc*@7`H4GCrZ=!2!D3RXIORM8?OFiw5 z8IxiZfkwMirI_Nvz+E$ep$msO%iK9ED4p{{%DIMb3hw1{RJzNz*P|70FMaxv5}62t zjN{T#4hyligK>6Vf^sU=JX{rLa%|qlT#e9)ersiUKqxT$_{QqK@k9jQ8&Tw=utF{QQ_=#7@Br!wvf-)9-VpK38Zd8Sxhk)yj)g zIHFBfU7lbyNz3@i-^Y(kP2%=5?$_?4{H^IX!t!)jOJ+YCy3?Kef)5G1U#rP?*GlK` z=F-~eF7}d+wfwEa*=F`tyiJ-)<|LLTy1GxeEj%srd}znbGYAfwGQ&D2x*(Rh$#?|DdG`Ey81W<*ik7%&*r#X(659F#J&1NrK zxbezJU-hQSOQ!t+W5=A6HgDbS!Zq>W!1%22&EC{I+1~OxnNz{Vv)>?+b1S2DgrQ`2OF~-uD;N(tJ94mNfK5S>1)?6I0=A+)l44baC z-7|x}d}4)X<&`U*M)q#b`n)z$9 zO&?m~k~UA8XpU@WH(j{#D0a|0a&ctisSAfmZUkK06m+}royMl~?|Op649(b!d4)b} z-B#!x4jhp1vg0SAW^CO~+ZkkS!l>i9$L(q2#Gv=l>r}euL^esQzB0eD@!sZ*;+iM5 z(U>S46jbfk4m{ibgWXewW3Q*S)>Zy1 zly9^dy2Fi}KDfqZaNA>o$?4#Xhp(5^c15y541z-c+3`+oD9AT3&_Kl`tiSgG%41yYu_&(q}JnuaAs%y;iVDB5>#A znfx?O(Y@^tEuZLpdvr5d^G6_6{B0w0*O!YkYSX974UL0E?CV|_OtyBNH+`H~J|cG z5w_dGJALK1NWKa=QIfhvM5kn!yv1N(l0{nY%a4Ey_oZfDf1Rx8eM0Hqc5x(q9aZ*`8d-9jq8PP)<;P>mAtW+uYbH|W>{XF1Fk0lur*NjJE2%CdQs{$2E~oo?ulbAeR+b^<_kKPi1t;CP}lsdpL#zTUC|Z zz0B>!#k3n}UYjrpp1An&%q>%Hfs;3k=0`5a>baXmqo{}X)o)z zbdKsr;`XiQ7&gbL95`V_p=Kn@<9^ZV_;%xxTp|=j~W#)1t(gqk}seA6p3q_y)|i>-)&< zj4gW*JlXMddvo|f=jncvQ$2k>cJp&RiNE4saYR~HNoyJj1895)AdOUuXd2iHO zN*?X~=Wb0U@_$G_@9jLvp{z`*KcZ&t!T7$iPXtPFvL+dxN%$N<^@i>{ zX){Zh9LLR8D0!NM)Jk|eDWUAwKKOsLya%a!`$JY-HKJO~( zb&aXv_{6pR^ku85&aJ?Hs+)l+%ZOc39 zH>P<5J-3)+93N~`vWu>1IAG{cr6X0OB|F766x-#}vQ;&R*5&fIvaM7RG8%lhH$Bg+ z@9!D8p2%3)d^Xola(;QPKaq3)hHp=<04KEw-UUhwbQny#d*MS-JL$9MP4`>s>dzn0XiJ@HRl- zRmNn^Tx71vhx*= z=jxlSTaMD@Q6HDmqX|yG>1S9hJ)OFVvEu~0r|E>#3;TYHll(tC^PipgdGM-J_8ZRe zKg=;PKBJkCJ*!adowI?kuhFF|bk#lX`Z-yI06?PZ|2xrIN(e;te_<3?9 z>-2lapS_0N!)gDgoVs4;TX#aYFiedE4x|p)PpPnnWAv1sSUsM;XMIQ!7t-x5(S@hcS)M%tuGj ziyb4RQn|X4DOg+xqj2EgJT8B4kM>ztMwQaLl$7%}YStQEYXm(b5=xIcY&b;ltftq{ zxLI0|vQV}rV`tHw)W~+>LEJ~q!XulR(*ii1Z_#V?o@!-l32(Q1Vytm}r-e?Hdvoi4 z$#J3K*tg#!mubFIdCo_R?Dl*#kZq#kksA<9Sy+=PAU(V;DKDw@P3?9Ii@Z9?tOZHF zS(ir-nVf2*<) z{_~G4k8!^gk-^OJZ{4PlWaQ`500^YAz?6YTJH1 z)}@a1<$R27Ggnrp`nf){HZs4|?VD*I8I#Ams#R2<8Xw!XUw-S;O~KrUB}e31zS`Q$ zve1{MnfN`rY$d4h?fd74N6(D(7i(CW-sH&0t#z&tT^r7Gd#tcTVtumE?wUD|WO)OMXkS%QkP7P9FZU zYm_(bvi!tQx~TQo0dk2V$-&w-?lXelwkm%($|*XI*Ub%lWGX|{oYs&2o2bJ3= zG{{2-9q}pWTyNUj$Gz^idCFpvY*o(OXh`!|=!IruV#E)jpEsh^%=hGrSTCRcFn6r< zTYGebZR5<{oz}}IKYZD*FF*1m@f-iq*H-M8jTPu58V@P@Z1o}d%5B;6L0*KlVx{4SR-IcCg@9%dx@oZKZ=8OQ(+e8p%=4PdL_W$n;Mj zXo$#*HRtruOgp@K^eHIerpJ#XBV%sr>g(f#C`GgmlDPFKC*ftzfA%eTSZv2Ucj2|# zH1)V`>DjIN>$$$1%|CN{NM@lXR&O9crs>cTrv;Y-_v@Bi_U(BwTk=UZ{j2}WkA@p_ z^$Pa{&fZ}bHxVmk-9f4w{k37k)5eTp=~o)_?G{$JO;Lh1XYiP?PrYXs+X717u z5pfRFwYog(+^Po>Cj8C!FwW)W-ld4+yB4Q(F{#np@WkP#UMK0r1cY6a_Vx`I?6Z5h zcZ#EgnU7u5wq?mf<&&Aqz&mrhI*BbZ#x1-O71np}d}2=(I(mstVZH-b> zZrs-udn}|T?)dW2p#KMCK%2kfsvq7-6nIR1807lYeggY}tIYmIo_!+t8y<`sZ&%uw z+QPz*>`EI`zlU9HGSlyxRE+(6X;)g4sr03)blO;$l8lPG3}>a!SyaSSOH!!~C9!tO6vQ*D zzbok=gI3et$iO7YDW=`)s}TM(xdkS>-{fW>RR*T_GsQQkVjGI;G!%vG+=s21URS4_ zUiYS_AV5=_rxfGWVg5oJ!-o8USxwm6PB%{{-x&u}nUIa^DP!m~FVRbZ{*4|;1DzqM z-WC;}M^gf$5oQq&`Y?GYS;D5CbgM~yD7jWYkw5rlG6paC5UNN(`Y?Gisp>xDE+zpy znT+Zu%0qM?kd%*JvknFitairoeT`aiFD+3EPlt)SaVBW3oD44&3Nv>3r{f+O$*c?7 z6bbhrB!y+rMoAqXN0ezNNu)%}r`tQVe0$>P z5bn{3!H`cAJc*nL9-WFrIK(Bgszkk&PZRgSW51kRL{psyrKCZA+WTcqk>v18`gXS# z!U$!i??ATi58e5B)F1jw$r>la#F-e*H&Vi)p#kE8~ zL9B96W5eJPQ$JBE=jtcOG=+8_Fz9$+}p{QG_|+xD?IQAU$3@<3~R7pCpAz&Y-K zRcc(#6FlBu*2M=;h7vKT}1Dme)) zB_y!CfPSL1kbK9X5Syrh#8#2eoA0;)oRd>sr0&TF%?cSVD zmvHX?lm9()CS=^~<1RuMPW$6ZPJTs25!32qaIre`W>CJrw8AOw$`p^vU!bbaKihW4 zeZKE>3derCJMM&d+qZb#{ugK1|Mv)*J{)(y)%i94t-iNu5Wmfxm(HGj_0;e`rDgc` z9_uq{w9?=<)Hg@_=)$SSY!e#OW}V!Zvu!UYRrgn%U)_#>tUK$xsx6N;HH1{k2IXk# zc;EJR)a~sx>vm#=7Gz?Nn%nHqBHaln66Yyre%9l)w|}jc9xMH3(b%$VzU>s7b+*lI zX=NJ8&>*hDup0S#Zd6wqYH^=Jua7?ep`=`Bp^=yKO0j_@9 zKFxL<%?s*~{4&|^3c%tTy(w!LI*_iz8f299pzY2e<9UwimQxQR2xBUOpdMQ@5Ao*| z1k-On=T9nv)Z0@J^CuMw>FTHQXb^-!J!!gV#!(tpwH$kA3d06bhrF$vaubZ&`1bx! zb^2EwPWa#Ve=4O;f|PK;9xq}8-oYY!*bLQRt#%fvzD|`KyVj~+MX-z7oTAet*Dh*x zicY1`lWnc+Rn*U}wW3#1o?X=96pfc-?4o8CrQzyt7sXkWhHHRb)YPl!Si9&lr|2{p zXcsMaicXb5c2TTX(O|o%u~*R$yJ(qHG+vIgiyByzhAZDLTFRm{Tm^Q~l3qo}+eP(G z(P?smU9{LKnsF2};mL$!R28HtL{rf^&(Y2^7xIf#?Glj@bhwe{ToIZN=JDJh&${UD zp?PIziYZ5^8j|0;XkuLgOPeF#PxZ(VR{*jrRRXhAUUpT=mo)ROp%%fA+fy&g#pSHR zVpVF$u2hsen+laGQcg}@6!~Fc4F3^NF{pF3B*^Sj*(^}56CK!JcID@NFo#EnPUV^S zxN9fnT}c+u=TBR}g(AsXc(q~TKFlXW-0S661QK_{Yn%+39O(T?H2Vo1(Vb5oQlE%H zM`MGo>UYA<975BFjHj?fldrZ=-f|sADdeWqE*ibxcD*4trE2AESA>6I$lES@{TQ3% z!(<6e@XT%6-!A*cw~z9hzP|m){o%8Y=1k}`F6?wdB6X*zb$gU{a^I^ zsr~I}=iC29zuoq?BX>((3A{2QLX2sPCEO#05vA8PCs1p_H(o>fzajBjx**on%7}=B zYgx;X{>;1eo$Yd3B~mo3i3+6R*-%b?hc@B`CH(g!n$!IVY4fE2VVPZvFyy2FBySB& z$t{yr4)j)Ym;H})y-*R9L5EtcL@6g8M`+JH zYJrt&FcsR?gj1=rF!3snSqNQ@TVz}WUYS#iyTuF;0dFK3jz(t%E=!t3oMkERFcPk; zk<~8n!6WNa+vOcsVCq!amh!2B>xdCL`nM{Z7S=dnJhC{ZgE$Na&h<>{TILMgOo&ImTm%L@yLlzIV^ul*2>S^ zm43OPTsEeBnQ!Zje7EslSk)sb3!XOOg>83U%a~kd5py zcMXD=1Ln234<7skru-whS8j3#lrI^KCoohy)0PxgPjJTe2Q@Z1Z#E2ChsoD#WCNp) z@1RWfZXe*&CZe+zd8=Noz@6>A-P|E?v7C9Z`si9JKcfyJsa9Rso7xq z0z!L%e3|S~TZ{bKm4@_wYGw@ijq4q`J6S8w6IPb7=rBzARcb%vX;&{uCqQmfqf7S5yYAX%NM-<7R@l~P&Ak5aQ? z+>xfGpnTvu9G)lFGwA0%R|MvSP1K0h67TQ3-U!e0r{5a#zN;&vio6oukt=WkLZyN? zBvH~#p>YgEFP22f+KAGu1mKnSLTY}WS7sOb-qZZzrE|L%(q2M4v?-Nr*BV)osRc3f;a6uts?(iv*=8drgsZs4TmEV)RL^znF4>Co zzuHRc5>=oUikO?Dh<2Ew$}@1<4`f9(?Qu^cL=DYFxD#Gkwihy#hAUcCA&I?`TZ1^} zGd?Ux=MOBI2dlISahS!Dib+SInjdL$%!uL1nGwkIG+YyaO~m;z5elf}h~&dFAqMRf z(#GXTzH-QBMxq^7e4V*dsIH~fVGO*~@JOO|I=m}UD~mE86~SD}>T+TiWKparV{AOW z3sN8B0!|cCu|aWSRE=uveOMLi7$>%*daC3FC~j{4euqIqlrDED>MYia5K#HWo zNLEzCh-dw(M^1Gby@icp5}K$Zr4&dixfvEpRd|hs?eLsKYdSoNA?^WBSYFZQO3F8t zG4O`CM@Y&y{>+KYas=AtX*t@XOw&Oeh4-RWs^0KR&!8tAeSjFaN5_FoCz4#txzcN3 z!Gr0D!>di~9$#u(C5$x492dXU$XOux^4-!Hf;nkp7g$<-X(wd4~LYcd|ewiQR~4YQkuqsG@`5 zL{!Mr_I})04G+WOELm2djkRfD^>hcM_X!f@r^#|GmOr~IB~az@xz)VpSS~ZO|lxMe4@6j3WRVD72_F8c(~f>M_GJ%e&KXbkw;qG z!%&*DVM3dF6kch6S#l$&Q0OzEO*;xN{%{tVAZc9vmZq2Gn2&uzH~I+V<3vn;q*c=Q z^1VdV<}X>i%N8v#O+HNchCP7}%%H*y@3ID>P?8h^(bnHin%Q@{2b>Mub%MaM) zWO(P0)3UE~s_f2aBTW@T+&f`4$qk8G`BV#Rf&B2R{nPij>T59kLo1Wbi4y+p1w+fb zuzET0uC8%lxLl{hd?{wCt;3*;&s~}L?r`aOWU%BT$HDMIs}0sD29C4u|+mZrM%xkCNWDf31g5w5ZNpddB3ApZjgZdtD~03 z>UHeDZXH6hNh;-E9lPYmvIg=_N3Hx&%4iGyxMPF-Py%6a!(4`$>d5jPc(n>i^@QgI zzAx>y5g1?4(e+8U{JWz^*+rT6bee3C2;|>(y!kNd{MUi357H@>5lNMV=b?dn%q-<* zYQYv7-tVA|T((FhqPS!v{j4uXE8 z)15!45TuP2{jhX!C?Y$RoTW$Pp^m6LDe5oyKtM!)TE)iCgxpGT6Psv-kyn!C^aof~ z3%SotDem{l?Q-f-nO`gIKDoQ25b}cXAh*0)21n$Mj@fpBCC8Rg<~MOAytodgcCs|| zFiP#@06#vtMt+=z;^c@S^Y=m?>UdZFA(gTvGnGHABU4Z`DIZEiwB53yqgMVc5$W(< zBdC#8KH1z+EB}xP|JqBZg_HZ9RI+-9lPWmDTDmDgFy)Lwv>^bYd>|^^$_lxNWNy}Ou$h9-%8a40oAE}fL8Gsknk@n;hSx-R2 z^EhMn=H&4sB*}8R*nLPSuCt-wv)7QTJEHQbM4(;Nt@0LJ)zKrLNyLy#_Y-3eb!_J> zN%3Zph zNB|O$Snb)h@|GTvpS0I*VBFoHG8NbNp-#urhhSoxY-%sZObYutB@esoT2;nqCsPI$ zORNOf!OK8;Z3IbeflrQ8VV}os7I&jG)>4Swk=i1!xyqzrtsGY-4KX>P3}Y0^ryw-p zp0lN$41Zo&61B3>CnrY02+A=q&#ePbh1}ul!7QC27}H_O%33j$0rmIoTz&FOy;5Fo z&u{>H7Ix|D<>mJ5ERZaIqF2ga+Dl}IUIuxsT~Pv`y@s-!+cOYi{)HaVBF27M;4_$2 zud!A-Y9V79A#;6@@vVp}KTZ$i5uHv6^q5{Jd)v!xhifB3APWiPG~3jvjgsab;-Xn$ zNBr`DLXrn>XZVjiqmzO8VQEtt?j;LemXltR1^eZsmjW`c zT7K8QR$kU4n8k!$2QQU*wK6IqyV|32pB|B65g0A-$|X@bWv<$#$O?_gFc;1@VmI7B zAI5DkCB9u+eKAR{C6`&|TQ14jveGw27WkG+$84V=1CK(Y8yMOv^LL4{S?=iYL4GF@ zSccruu~*&^m1e+*NdIEkaYo$c+Y4nxL@ul~q__;Sv=-7YP%A5Z(`g-;Da#8o-ZaESf%FiAm$!4dbz+))p$BAbJNJM30XPi2 zN3W#FJ%(ic0TThf%MNTE;^Ht??MNR;6m~P8Tnr6sCuT5ZW&Rm<+^h#M( zt&(*bI|$-cD*D_kqR0eoYBy!S(_l)fS`x9vv|CtIRNsoBS~?PJWTP|EUpphMz-Y)z ztIFk0!t>&)61kJ`{4N8J+>z4?_0xkr*`fV1hteATt+a^;*)_+=fB+s>3+1_0Dv1AA zIhCc5U#}{VU$N1rRiklC<4^g`DjQ+h!9pI$p{uefJaHUTERU}$lt&5IW2*|_SCO~V zRHxZ*BwkJiQv~mir_nnY=GO%qQ=ZCU9A(RFI}$f@8okWH#%G{g2NMCx3fdo@M35V* zahM`sPB8 zX>6OPHfnl$DBtY2WkfMT+GsHj%MN#=yq4T0;{uS2xGaq!RF-%uF;gz7X5KL=pd%iU z8%7*=E64I_#!~sn6@mOPwO2tRTBTZK!wKxL5%$Z^l5Nu}5T|Tr$Q3-heV&Xe5BQ<2 z@XG9Jh(~>P7vdO$7K6GA)$Ha}l-42(Om<>0vP~6#pLUg{T!gMlZbo(Vtf_`qg4N6( zqS~T@R*bof*7Yi{5U;eag&6!`N;8-444>WFtf;K=sgm!eOQuKdvnZLK7gQs7F-z6B zKb5W$j>;1Iqw~`x=R~Zk!xiU8* zp3Ty_Oa9dA%WUM_LN3p(OusnL>XX&EWssw-Y9m>lOWMDg0w$een1o^l%tCDDu5}&g zkR-QeK)vi;1Yl67VbFq;dA}|5e$~73uT~%V^QPQN$Uj?2=poz+X8iENn3G*|8*?jF z77z=@%_=X0T$gU;A97>L$4O5V*jW8hDoU?MFTy05IYsbZ6x{Q(?e<`OoCLpmA27 zbP+M7V|b)dpFihXBO9rDJUKFrV#i7v0#7>1mMXT{^P=l0 zU1FZR~iBtzzhP^_TC5!uVWO-n0%#h z0z?>&o*>^AjqGa=ENPFbTp-H(lgWx;F|ZwSZz?*K{kLyO)A&V1ikg!@u>81}h&yUC z8c-y~YXb7!S~1HY-zC3%n=BR^Tr;=WzI&SQ0A8I3yof@66AC`ej_xO#BJn!qagVJd%o1 z#Y)Yu2MjGUL8AZ@$eQa^bcq*|ybm)m20?n=GBL>PZ1lsv4Nm*F=h5Mr_D2Rj()t6= z0L3S3nyjkU=tSn~r;WVE`Q)KIC108JSEQE0gv{fK^|VniN8>bv7#_?0g3359Jr87Y z8>=0+8>VP$7_|jcSv$1hhf0}stqsg(>VX(iUUmp+b1EWHc&ZY?Tv7P=TLOM;y4;0sb`te-?w<=_GE*uTtDiu7fH2 zU5#>ossu&kb(K7}{fb7`^t)E|E-6pCD)AjPnMADz7CK>#Q3|J-vU>$(A$hi6CFI@} z+ya!EL6On(&JFB;0{Rj~I37<%yipqJ;5921hhIGtU zVQ%V|GHK#`c&e*xNpVFsMEg2t$X{~E%r)RgoT0r&9W26Bp>)WwFmW1XuW>3)*upr< zLB=q6$MZZqQF+F)H%S#T=Gp_M3+Mz{J*jM0=2?=v=u@9>Gr5sBIQ`#pjLqa2t80WY z1KcUtV~zaYRYq@+Lhzn5r9!2LFG+(z{WS3TAyWb{<(H}1V0A9+b79Ht{Qat{Y!pnn zjSal&%DhvGHwJ8pMXIB&l_{@C)|9s8g`73Y8`Xp#^8Bh2$h|o<)c7IKtSUi9TPU~Z zkV>h#3Cl}LqE@x!1v=>RM1_YH2DT6<^OPxOfnvTN<)};`8&`c&%vXO@E->ekjdi7} z;Q<+gA@920;TBQJ4a1Om>SPk9ZJxZJz_Mp~Om)h~S@OuL5_wYn_RAgx#1fUxi~Gk+ z26v-@05vI4mQtQ$lpgm2CZu8F?5E+8Pz=_I8BSC6V`rMK>z|n>*5pvhO^LY>O~TbG zQ6mXK8%dD=kx^w;-RLy2E8RphOgzu+%s3xG3P0r5o?qf>Sjr{Fkd6&n+O>D}R_F5v z)1Q-2Ho@~gjNjO@;5~`^U~-}9I^=nchYM=>8Oss;BNr%&NQH#UIK!{HF^ECwco&|J z2z^1OyRMs@?w(0^M`*c)a#y1J)HIlQ4i+;eYCPvL{-d4;Nn_Iz6@+RkV=Zqud~3Qi zRcmw8B!7$3^ymFmswRu!wn1%ZH^$>ud$DSj2PGBFhyqnz&L@`-P!VAvLQYZ4#4PF} zj3N}C#tSES@Mf1D+6wt&w6v8#@*0&D%e+OF&xQ=7&${VHsLJ0WjlOv@C?g9&C!XVxg< zi6rwKkmH0!U!2>Nn43vuKc~J1ajj5N{tUe z&MKDaJ{i1I21KM_H^e`id~w7f%)I|Jh;|rWP;O#=w>fFCSgV0SZ=Fs~8CevkEo9G; zNGl(?H8;|HyrGyv3ZoEsokU16pa$BPBa$o>cQH*#D8^{0w2KzDDlZuew#E{sDXW((@3U-Pgs`N%YWla zGWXC$@C%GD|2eq(fvg9(*L;bb|&`AW682Pv?)q+ z&$uivw$&(pKa=VeKb}&|*8&+j)e7qvR0zg+n;WX6Ls892M{IE2<1~KzKuU((TPzf* zzy>;~1W~PdZGN{pTX*+B0^(H`dD^#`6PQfdguyG466FcQk^da$B7Q<1L~(q4_N$7lNQdcbMy z$LYqnIo%0Ma@J=YP>eC~j$&Fr5{B1L*~+Uffp`!m{+WI^5@z~cH7YKkqOn$49AV0; zsN!UvDr&x>lG94tP5N{oiCQfk16lQ;1Is;WSU9lfGPy387>KG1E>jaeIi^*beX1Ql zPcL+b@SFu+lBC@9s?rFMwoFw$@N*UC!`K)TCap8Jnj_O9Eu`tT0@=2TDB6-{Ox2dY zldTZb#HWO+VZ4sTewAKI?9&e~oi9Lha1my5XJ&R0qtf8U z!a&@VuWBkfowHo{VW;)a8M{&0wjjYaAzIw1CHGeTAwI3##*6)_@vhOpyb6~5UFE1}I zBnP{FVBl;l$4oE}&6z4YqLr5N?uF-4#HoSq9TMI3r~}bvcB1FYZJ99X93 z%YM7*`!h{bBA`fS^TU7I42UN+rllC#E8ul+y6Idg%U6zW9*n;Trgm%^8T*{~pE8G9 zg%cJvP##G6VClJ#{jS~mK*;^6YTT;l%CB7`wDd7{b@uaX-T8DLqe<))nBgLIuL?IB zhAVoJl-y#>l!hqe#9ry)mTsYLLSiK}wfG=hSIaF;fPPa86B+JEQxx4W1V*a%`o&ez(E{IVQl}L27BV7|S#+ zwo$HhK?7Zi8W+(il^Z8Hc@W>2aZ^6E)!4ApO8C539WRAwN1LzFpPILO^F2w(~!9eL=eGt^cKK-`BfdrunBXOVL3G;xv5ha>0mM)E3J2M@->He}3B zCCqfnMcW}0csjdNKTe)f>AQr^x^hFRK+iQ~kJhMOaIW`gk<2r+3uKSRD-dL1wu4T$ zjh&hv$mwrLB>Uz{zA@zd*^u&`GC%v`YWu~k*^o2WlQ@2yj1u*VWNF1@*_vb_7t*)U zYKCAs`JqFryA<{_w7Lu0&2D)p)k9xiYS;p-{Iy>G>x#%O)?9pBFT~RA?uerMT4-Co zt;e^%eGLwk-Bc%O)cs@z_TV?WG~{;o2-VLnXg7RIKl(sflibdacWGrZhj)(JE1yN* zvhXu~{#RsjvH!v?ue*6T`b{gWXOhQ#YS9WWM(P_w>*$U__guurB6aUY+ z$WAihy4fv%QcP$aI^}}x5Ob$2&Jx_^Ho<+@hNBmAI{N<%$5-ZL`?t)Am^&fg-GFc9 zgd~8H^ahccj6Mj!8T8j^t`{w&S>XQ_wP$+ngABeh%&p%t%q;1V&N74Ltn+st8_xgV zb(m#N|F>-8D~SC66|eXOr0LsZV5c@QyE}l ziGHG7M7hn7amD(HhSaL2i{?`M=7r|#=0`~yz_rng0=8&FVp*L3o&!^kZES^fwCN{G zZ8fY-N&}FrK#*{aei}hBiXqM032SvaLz@9Po!U%kDa?$01F-!YQ=|m&ZpD0*Y<3xXPZ@i z227ZsS|8SssLbXiQ4wW=st?&q_t$jjeD>Tu}%-sZ7E2U}M2v@-h zSNYj~oQcUGscI@j(n^5UAEX=ZCx)$Pq{-!GLUL>wWuL|5)nc0c)@i!y*{ zZ)7X&NcG4dHos1ER;9_mcQ22sV8yZUO5$aT5b~Okr{FAl*- zp_51BA}od<<5e11;v=M)-J9?M+gU4GMBCs#G*5jw3*KkL+Ntzwpabejhakx)ufCzp zbr!sL__g9A{&`_-I0FdhmMFZ)n0Mfn+f&t$Q)us#;x+Kf+&6KGOdy`t!K7iFavU3+ud7%fP!TLUfqzRQ`yR_(vUvm!3`Yu@O?FGA`0&(y3Y;CpA5F z%CN$K8+A*?;x8fLsDgDJywCczQo;&tq&()LBqLQZF3KldYEf(Nq+2>gcBgtc5^YNN zc>bkgUSd&s-4!5>z>)^uGcz=^h^h|R6sax?!64efMU6YHUVS-u=pth?1O=i>uk`}p#~fv>25bTjv}lgN-kzKR=Mp z|FYTTa=G2^FY=DzA2)xw+-^fFb$v6fiIWMWsim>Gepz%vye)2L1j+3yBS?KC)1bub z7pN>5?#5UsVqb0NUJz@HH`}H5W2iCKRJTCgF6VBnS4lVMT+n6OH#q8=TiGcwnqE9RN1}<`M;rMQ7jUj z-?FHWD*s=}GUH6g{Q7uwL0{QnoEmA!`h-5#2fVR9Yi9DrERQub^zl)=Exw?x&o?BN zK0c_AO<34hM``lvDXZ`}3@;iHx&I6g}zb5Hgn&E_^cb5G8)%%$ME^8}lk`DJc1)9vudXjmR< zX{>MMv%6m1OWu!-sLt|;Gv{^Q!ie*H%)&^>X_!CQ#uD|>F{{+~p@#a#mex?+vdF|U z*m(am5qzV3VI)Md52b07b=lxTuI$kASlou~nCALr>fL}Bmsh!Ug5!<&)UV0M&G+flU8|lyAQZQ124;yfEHe*Id`^R6iyjTd*{?T=kWCw#UNi zPD!TqOhNr}^?GGfeRFh$dW_UJIkoa4^-V0yTc}WXEb*;=H%3)Q{aKJjLLOnte#~F? z;M0%USF55;vCx9p^0q99d8DT7&;IIX23++^_1v`5nO9v^QS+!?EnCnKt!r#iBO0jQ zIn!e|o@p&_d3|JIq}P`#>*||B{HH#mT1s;pJ`ajFM5C(70jkMN8}5c!Y$+KFE4kA- zpK{WRlVyXWjS8W8nMy;555CEZ)-6~NwXdf=Zhp(cg?1{c{A^aLf@RB_VhdS!AQ!4? zFMrv>`o=mn`D$>{#ucGRbYWdfgKG5n<@L*>We#|GE1T*R)Y|-PKCHpc&9VgxZ4m03 zLutBWXU7p#r->n7`E^3Cp`FM#{NRLaj;o=H2e2@&zA+MQCEUHPjvYpDGq~%Y$(uEt zk+*+3M`Z_uspYzqJM6yqzh2^c@H?uGuE{5^{JiJ%S@gu7t!t1!xgz>3UdauwuF0QV zUHU9cz)<-~s$AC$`IBp>dc8r{pjFGCT-1l-{pgr1<)LMA)87zIK9PNnm{psoVZ^2~Kw{=vL#{MV~ z{(6s|mS@|hq7a(Y3_UNAI==fy$0z))70YHhtk0Cg9kse9mrGzOZK&f_i4PK25dqVy zbxmGnqjIq0D@L9R)DS|@s>JGHgOF$CC3bLcM--CWu9W4Sye0$kJTGDD6-OL?(n0Of zG-{R88$%*izyzJNj9prqen&p#)ZU;XetFQ+snTfoDMtzq=KEpJKr1Y5R`(3QI;CkN zc|qi?Zpo>UHu|;(VLXpc?OM0w9F|ojuvj8FN@dfc{0>*F)r;k`WC4Px*EPACPMkcd z>&1qAlJx1CT;mRCSsYdZ1)wZh2s5CA0Y2(kFsz}BBuDpMt!G#mVDGsXg2D_ z_VYwtlTG>?`YHVQWms(PTD@#6f-L%1J5A`CT&oAppK=v`FDd8N`l{bLz}~Afmpr`M z$U{?<`(z8457Yv^>AV>(bRhe|qt56oP^A#0RZ~{QAO=0&!y~rHKXKGFS!HyDe`E00W5uhysrg_o*yM*YANp3=?rCJVP-9dUvQfHh|MvE$$uW= za6HTRWoz`PQ0NboOPz5t30WIXS8t2C_wQGvUv%>eLl%Al8NM03hRG}LH`GOqMl&`leHA@bc}pt)yH);`ETLLz zqdOuWB@1LzhKkqCllPN_a)Uc!%o-n7Ys3TZI?SU#GyU`EBXT~hS@Q}P7<0y}ED`mR5DO~GjT1AeNTb<}@ znD*F`HL0G=I;eWxp^YnHZw?!^0qKn+`|hJ0`<)8YrT2M;w)TCs4!OhMPr@&GY^u@4ytJSXRdL)1|AUkZbPm5>b1R zr6^J>rf@@g3&A)~#d=$iW9a0tHn|`2FZWzn(zIO$L`LFXG(naXN_&*GJN?oSmEXD= zRfv=#UA(fIZ#McNpC+PsRiQB?N8RgXb&_toCgp@;)T?E|lrr+G)LKW`{aK8NN#{d9S_y+GIGNu6TEnUI&;3iZ=vy;i25EYG<{2x`W{ z)Xx;&;>o@2c9c`M6L zk6M74NmLNb@3pT`sMJL>i_P_S2TzaXQceE>m=sDIK@Zy?K1aRsTV|SRvJjCjgamIu z668Njv=D@J&{nZTG^U`Cjt#KziYTE}QJ}0&?3c@BE>xK3^1WzLOeeXQ_t~BysU9+m z&513}2-e7Y`LZKD#cRZ#;vlq%QrDB2->UZMh8clxiX2h@xCn!9muCg^H zSuJh`$OpeS0pno$xU>JhMOk8o9$G$Dp9c9=D`laLga(HECU=BAgO9ZCvgh=k+^6Bu zr^(Z;Z<6A21NeaVU!;R&4!rM-F&&SmZc<*lOY+Oq#ZJ6IvGgy~pv~qD zwh_|Iu(@@h_vA##ppUs$ns#wD4q%>x3Y0!J4ce@3SjM%6G~ZVuxi!ov(L@6azw&A$ zkL-9z+?zSiJ1`Mhe z1{3fYPpQxZFY&XLmyqh3yqR0WpSQO9!ZumImHQGbJm_a2l^>Qq9dd7Lxvt5xxeRSg zWL`k?bi>l8!H^qQmZ)zHdB=E3R#vkI*|G9IU6a2Xfhv8P+}P^F6!I&c5p!#3TFv+t zyFPIM|2c2%m<;-Jns{D6NB*{g>|lGp07CjX^5+$MNln}P?Ua6u*yXBVxE41OEhfUP zm>BmU!OXtaMR-r@vK!04oqqn-j~sq3j2Q^xNrbfeZbOFdmWB2vVKl>QJO*_?r#=PJ zxw25Nky}$V!o}4<<&}OfK~g396l0REUFz4TgmrBS^L6AGGlaWB7kObt0Vz#(_InzJ zXvNd@DYXCb?nH~j&>0yr4wgOzhOFF@md=d;-542Dbv85f9+ZadkmEK_W1wXea>5#n z#U-=^#laX~i^nIzZOE|7=?H>(ZA)Qk7fD@@jMyx7v!$pQKUA>>q%M=*CE9SQ?UACg z7f-=-m_Ol_uslmhtU#M=Z}zT3X=L?h=D@9()C4a#s`KI1$3cFl9Qyi0?o9eHL-(T` zLH?97-4E#~(EGy>US6*IrL|h`FS)Hoca`yBRZ$h@GkO{x)RBFqHrR($Mrkd~FqqY! zJDrauUknmmKg^?r(gQC%bl6jWE%y0YO9^YpRe78B{_hIQ zcOdh&=>27Q@hk*w8Ewi@T9Bt9$b1YQtY%+6mdS!oGWgl|Wg0)4tk(1Mf~EdZ89sU- z`|20e4^YUJ-1V}G9vQ_9Y_C?xdf&Af0lio@re;%O(KY#(i)OcC81h4w5#^t_TJ>W4 zCpOwd`yW>&g18fLy;!bJZCCoBqZpZCn_GRCP@HLBNm1ei5zBSS#blWDcpVN@{e{0sOYmP0eUtnwejlMMg zc7?3g+#PRjnXlB7ZlzVH{?C32O*~_M+UVEPSl3X$s4=Q^tM1kXix;Up`?T{_mD+YY zU6>T8eVU{CzE&b@zUliti!w8oAx~;#h2HU$(zkUxidOJC?CNhBW_M zOmp>p**2Aiy02cG$)TaAk6zL$@;=@;U#1b&(6{l9*GSl_%HP+jvI)>$JES*0X-(01 ztYL+18gR!K#B9TvERV(Oo9knC9o7B9jQzZ~X(VeTS&+UpBU_ZirOH0g+!R$08VQUg zx$$UIeO*KSD!aHYu51fpn|}<_6>IhDZR6^fwQ;2%d)v7B*+}PCd1(Sr&nxR1mhwT; zmJ=**s&7=CedR8VXzOxSf53`plWJsuA|HNvY}z(8aCu#`GDZx_nomeIl$n~Bz zPqBy-tL#|$nYP#~LH=svy-U>dLfVyjSpxIpSxaE%*@lbNosvxJnF8Aqn4h%-=J&P) z4oqA83KY^DSO>Cirz!Qzw)mwVv# zbxnRDmArn9#tRxen6o#iw%XEOe<_fcsGXdrz960ujp|Pdkc=7aU6s2ue^Z^tznS0s zE6LuCJgDpPMPfEOVR#YL-SV4cb@pbA10!r86^K+D@$Qswhmg&)yN%y6g3SBO-~W?( zvf?Y?O24_X!cj@@8<~bLSB4NgFLhzFum(X~2U8yfIlhMO`Ot>Sk{)=NE^j_%RPYjN z&ldWmfj=sg{A=MdiqCniu%xBhsPYSTN}EsjKt?}myC^SVaO+=GjGm>Bk|8xJ6enEZ z92iGC5Is+u9`#fl?hd-cF{uhqjLpg)vHmaEi4Y7bRHoVfalDyuIK|v2nDd7rhK2-r zhzT;?o-vhHE6dSf7dc(Mk?HE~^hF$hW73{`5#r@pztET=RaWsdP=vTPS@gs72zw>r zLr6a!hWN`lIPD3y_zvsGi=R4SubvA-d~;=BF(g*2?$m6dilh~tdXD@uRm=2CdM>mQ z`JL!gh0PPCYC*uk>C|)GK0!#xI_m`J+~eeI(Sa=>bcThPDO-%JmmaZ zViHoeQvoH*%2^r2@Jzm6UQUAxjj62YQJ*J7-DHI zH6dP|dXO=5wK=wYd*D>3omV&~#Q#ohuB!EFq833G-2IgaF{vrjN;xSS$4avN1@27kRL&jF>n%t9|&HB%| zM<^ifO|HcvbV^$RUV%4r_E}x(fc;MuZ8(Q?JJWwoM!|R>TjBfe{5cuf)iuHS?sCTQ zQGc)zAtp({Ql)K|E$+EQ8{|Ez|74q+3sQspJsHzQZgCT64RRn^&M;HMgE+Ji2YJu+ zo3OO=c}dbnb=91uuJK?>h@d_dy!V^fH{=?3u|6DfK#S;_+?Xh&nK%e*K`qr++Hjg| zgSZzArw!s(cy5DvvCON^9Ijkt&Jgb95I8~4yDJIP?qsc~i*^Bd$^DXAvbWIy4 zyOYfE8AM!YKxN_so%#03PqcB}b+Dwp4HHY@MF-69AzqN_F}dt`Dr4ca96t?E)1Qj;h{YcO^SjG;>RxNv*#kLZ`IKGG)1v&o+Dlb%0)%lE z743Bh`Wdzz!YyKb185J?1nm^LJ=uee_JBTSnfx;8nq>`CWj35^X6C$-Dqzyd;dfdnTjG1@^Lo*aOvdV$tAwp4s zAd(1T4nj1HTGX0K(#dkZFI)ZB1c%j&5FCx^2x(;p5o{)bC!G4LEvNaHSYL$-1Yvy0 zf4H#TMvD?wBvtJo#_xRdC-u!FD4+B(@Qzes#5e>WMwPM@%z{V7Z7@-a2SL;k-Ucq4 zp=xty0;nK(5koVrqm2$z3Qu!7`Al`^lN7y1me8bc zWk|p4Y^SYf?Y4p{{R^4y9-JM+7{qZUmE3GmY1rCnOYvr0)>j9d241Dl3-(|hETvqO zO^I5L<7BmR{;AQ*Yg`XYEA6HL!$3U0f!Q+1f5u=cLfaS`z7g6bhqx=8Oe38^=~x>o zZI0D-(6^cJ#u|k3?bTq-ivSXtetp zw6{r;xs%s%6QUJ+6IZ{f0Ft&?W)4@M?|^bST@~b?9T~)I6bCT}vbC=NIw*ha*p;2A z+X#wr5<-52nkJkIYT850@1xTF7_zE1vzn`FoQ^lEj^A)P{z1BXV5#UFL++)smvSWvL7r8>O_qTX=7^Lw+OK9^h#*$bbK|zW z8U#_HZbNyiWs9`6sZp$~9jSI4O9cfC#o2<0w7m?A8}q%2Ra{3Ia3h*Il#A`5ERAMX z`p7vBfDfu+Jm?JLsq8RTXKT^(T7_u&Jt{iOHU`Qg$ zupjgDU)D_p@Aevp3)P|3VCKFD(xG3oHo=_1z5l)T4cy5fH|k}~YxNwDP1RT+U?w4)#f4$ewnYWL5r!pSENg>YG306WhTbS- zj$H8;+iK&ffoY-*X)3@*dp$*ta*%S(kP)=J8S=+vFJ}n+z@-lU|Df=HlY{@aviPr> z=hRx0Lz9`!0tte=*S?knZsUK8J{Lhle&^Z@xi96TO@YIZ;~Pms0~kC+&aj6LG%a+g zq7cHCGDqnfETs_#GSgkS)!ehR|iW9?X4pd_d~e z{S@OaM2HikjgsRJL+am@xjsKaMiVa=CoK-`hP3-I8TAV>P92ZstiT^j=fR*fN8^&R zHCJ_GKJEmQ4qK?>hgZ2tYlasgnHHTYT20y#ZzRKH@xjk&*kal`L*j4BV5WCsy0Au{ zOs#=baa|cqM{mK(>@oYI4ua|I5|@wKGYsxp-C=Me7do}x%;9Rbr(p?Yy$!vm;oqDF zdl?W>6j86kIH5NJ?RzkOr{W1MXy?;ci|={!bAbP#7x48?t%C}9d!tam|7R72x%4)=K8MTII0ISF5 zA0VGo<#c;(w%Y^QTANf};??*GEc}8~^~Y5t;q+*4W4FeM5qZKDfjpG*A*kE|i;$q_ z2HBKHiAY=}#%Hi_58F6}nai0Ed~78>i@nlO4awm>ctMO|hSFHAJk1tovB3(=Tnx#t zl!j_}ALkQf4r30Bd9R%@Xo+nEN_TpxPndgNir>hVea}aJTfy5`Eg9dMeeoS1Gv|2ak`0ieVhW%f zD&^i+U`ccrWGn}J@h6Z|DtSrJ9y+(clG*kvk6c{KD#j#OOk?FhvD_ypR)+oH4VhAg znaY!{Vg~10D{Qx1Lw2Y3YU!-?tDBtZrT*92=2_TA9!YxhM)#9|T#QDAYAsEoGxFQqq7|jDTFW%c&`gqqX4W z$6h)14ajjHLmDgT#xr*oTdVb8RfMrNevOs>|E^80Z!)cfyJ;_=~ zr@M@?(FfsuK$5j`U#eDq>x#&ie0DcNLe<3i7UdECp6pEjkUAf{%)vfg*W~X~X%`pL ziAdMvT`AUPGN_l0e6>OO-Ui8Sm7mjz?9Z+;$g#x|-#dxo{^w|8w6L4YPdU{+l|nXu(6E?kdSdvrkx&$wi90C4QZ`b^Ha-a64mP8 zy`q)9rriE!Ny}GSn@NSs#ISLf-JImjrI1YU-(QsmAGg}WfZVO`g#5)-#$>w8Hx7B$ zMQ4p!Fh30|UCmV7Lx*vFko+j2ykcO;ds-Pn;J)JlMK+aZRkVO$w=AudJ5sxNZ>;1; zq`@cdH7b8_5i`ebk(`Jjs|x6mtq+o0JLtl}NEGD}X~NRZ796(QsFmNjKDOJSSax$8 zeUd&w8F`&4H!`oxyUL~Ez#Lfeqf`OppRP)Vi-&hXMn>qg=7r=2ghcS9D5#nCM#PKz6Ia?e)3V%&vZSZgy9{(y8@88nU0I zPc?FHYcGNHSwd#Wv76}#wh}WXhspHmsT)Xx!l`Sf?~Af!bwWF}oBvKGVA2{*-`T)~ zu}`Aj7;Fzn)urClLS_i9<=V+Ma>MH#;2u;%c+eTbQ`sTx%hq~94WXA{vbD9BJoGmX z!Ip;zMKdMKBA7hC+PYm53)Le^hT|;^7Nq$TFfnP44N=!M4n)6G5N&rLdNT`=>xWLQ zw+(w!qoPAe`D3Xkmy3C8fvjt#<7Rq)J7`09J%X4I53lD6R+Vy-58)vML11~R!W;^s za}b<5K?W7eGT(JD9;IE5#TNg0g}(FL`FT|sU53Kwgz@2(2sY1C<#g1ZSOKpz^P-ao zRY0BU;6t}7OC69X!18`Dy;WNGD$&Ht*bPQwC@r{Zo5G~sHovbrDniHH7JI9d_0V?m zbOxzcUeQcXO7K3Q(QUN0>r z@L95|KHiOo#n;aD zf<6IheDI*h%-iarg#){g!#1RimO?WFN!P6oB%AU`MF&=7sOaW?4i&j}IJIv6Iwa5b zhU8vCV#vTsMMXi70~K+xKTj2dQZh?o@7UgeVmiqDiBSb+djD!9n4S!nBY)ul(51k9 z$pQ2BESRgawI0Z`*)5L{3SsxIc$vg*6VS5+lLW*Aap>nDyD}jU_YcUUaUT_iK~S3! zdj8r2OSJLbH*Ug>S>ExS;vHnHufZfIQF?sIX+%gHE_d`ltVB;!UX52nZtK6^W@;fW zBAcm_smbr+ZIHYB?_|^iF_hLxrMVj9w{fa*jjbf+c3uha%Gv0IaRxU@KSHlv`qbr0 zgFvMk$*`REidR_suKv7DDrm@__}Yx0K-V1(0v}Wee9%GQQ&|MM?sRIsl1CHzosgfd zAU9Kr!8iI*V`&WMaapT`+_<7z{@gF3E(2_Dym)sj zGh=x{Cxw|XWcgYJh@q(dOZB{QMUT>-28k*UhRSRGve{_wb%y?GUcUTtMY+7xZ?49~ zF}$!n`}SzB1;Btj`Jjc)8R?~XJvF0-XqzSB8&|ae)D>vM74KN>R`tu0^g|K;BO-~PYt-?hhS`NyjN*PQ-u&GsM8*4m-^ z@3oyh*|L_)*51w@vim=YD~tLr<4#zs7@0&(BnvMjOFUc61zlRKUI~>Rb|CqMg5a4HE!iT3yRrHBJTZ;65ght$YuD;l_m0fqlV;7lDegLw4}29oW>!_ ziY=^hC);T!wJL3|Y*o5_`FlsXY?Tr8*P)I`{@Sr+j^d1+(7vZWzklTxbxMj;1cpa; zt5xM}BH_mzj6JL{cE5wMr?VK_m#y`lx+N#6Ob!ZTYg+Eh&fS;97{zlk)=p>_5e7pN zwHam>e!}VRebwJOr@!uA{bg(YJ3T|(4OD-JntQF4&STQsCj&o1Xh8_))xlER5|y}G ziw!`_mJ9#~o^k;AQ~_|LIkQ+-ALA_6s$V;`e$fAG+tEACy|$wt+W=gzkRE~x|^w6*2##1@2PTtt`@TQC=1j6sN54tOgPLpVJ66|a(F)MNE0r7z0L67VjoPHmH0R`!U|C@W)P zG(sDH6d^oJdUNkqx7PkLFS9Ma)=~}mMIJYUS?j*BExy#!2DvNm>0WOv*k)~crbTUu zROyghD86Y|+eeFCd1}vtywKufA+3oY*3% zo;6_R2)~RBNWD)vi5R8)$oLSJw%L6|+yPK4$k^fwt1~pP??q>Jujo&P{h>nxo3b=8 z@^?!V7B;d$E_W?unhllt`v zorWx%of&73U+{;qQJY226Du9aC#_pD$Cj$soX*z_;1qxCbbd{?^R8^IANJ~8$p(LlliQ|c zgP*Z;L$I0W3;T?0LQ+0vH>7`JP^r+h(u`*T&%h5V{jOS=+GxdwxEUC-vPYc-)7prt zHyl7WDnQ?I0KKUfpxIitC_sa@=a~E{UaeBK&|mOp{gsS2iJQxQ8+v;myPwd*Xi&?J z)Dofxj+((as3V}*lNN`Sjr}e+!IkG#8+30;7_z;8O@^%Y{lx+KrwZg39FXtKf;{qo zQ>$x0zWhC2E;shiN@dx%ciRIphB*^&$b)KFY4Cqd@M$%mE>DZtB0A6F?m!hoKTS}O ztfvdkDFNA_gzq5a$^K=KhvEfPwD1>^BZDjN<;61kAi1f1wyw#q)wR>JC|1mYSIMH3 zOfC5EooSS8DYKJ{gs_eqia}+GR>%{owCqxoI~5nou>p9cL0KA#UL)%~VLf@@1bS`_ zf?U29?qR2U*sYkZm~$G@&o;4bE}bB+;~gqr^mmRc`~I0hupCin{In^<7q1%N z@WqiIIkkEQzR%jay~TF$8HBFfZf zOR6@#hDLRxo~%te%5ip;+|;yJd6mk60cDU|n$qj&*8^(iAjm`jzm9KFZrbgI{4)w( z)WJ(fW>WQiT(i2!6Y)Y+jIlijAM8Ju->D*-_8;mW&_$k(r(Fvl=>HBE@sKigQK*Hp z5mI*s8EVmemzQOy@q2R?zlOXppeEx%Q}yo*)*!DP+nad9&Kr5*SZ)YEb+G=YEY|mB zYrT7Huf1?>Q?I@73nG+4E`0(m7}Sayl5#e_1OLeYA^%WaUFmf7S+=XHPn}wq541&0 z`XVvef&BflUJK*KW7Wct?&b|#H0zJ4luw%rDDu-4My@`F3n~mR&MIUW#OMk#I{$nc z&qgsJil6dk2uXgiiM(la7uQ6x8}fE@p*_d998)Q8H5bgG9CGt9UGy)tHyG_cB~^T+ z{I5+z^e*aWLo$fcE4@9u;5~5UoI&o$7BuT~Y=l^|Hp)2 zj(SeM%jfCp=%kHOMeTG6@YA@&ub*+Pk^53=zzY2RE(QM;1k5;H+yNfWEJH4Ja&3ga zbWqzlkaPXPWtkOr-LcLJ+n25NJg@K42SILcQ$Yit<-9{wzwWA(9VvyC4!&Kts+z8q z5*4+cC(x zCI=KsHaRHyFpH9rnp5kaUkByO<%%Y4P}U4oH2Hr8%1GVm}{hB%4E_X&wqw|9%oiB>Fi(0M@7?D^zTw;l=w7aXgWE)AuAm_ zTNn;VM-)h(F3%9mRRgmGldZL0UBG3Zf)z-Awn4H*)$IhyI7ul5rXe&7wAmP8)U{6> ztNf8o1;!MDA+1gXdzaxraSd;5lfOAo+?a*J)z7K5RYBopvTGAe4CRLzgJ|y{Xk5g! zT9UJy6qh8Tv}v-c2OeCiR;80W&vlH`+%MT2EjOZ(rT9|_+5!3gF@&hvOwROcL8I_dO~+#-4J@Pa*eBP7`a zi+1SCm#@_|`C?#Mk=kTUg+Jam*-1yjP13UK3h<^_6Vfl>msIR@&?BP=oyK&36E?C3 zIgeEOBsyXE;lbX_dBAn7Gt7Ss;v#zsvT->Li!^u2M*}%xTPiskTT6w;=|q~W9;67J zr)v9zy%Ddbm2p&%zskcVT|&A2QE;S>-X3(q*uvF`jp!6NRn(KyKGoXoZZ+%OG4`zl z1VcU;=m-a^2Rm^7Q_;ZX4h?*srGW$4TJI0am#xdoLtbB|@OIIhebvzlb{QhY$p_L~)L}l8B?5P;@pV#h@R9w4>E$ z+zkDj$c=owjn-nQ3!VA3_1xF+Fqe$7dF@ia4Vmru`h|x(!+CHpx3>o!3_sNi!`WK@ z>@{emzWB0nElJ#_f;EHH(f*Xpkc+70q+NZMtW#7VhX$;XbxqmLw|f8=N{d?Qroo#G zf(T1@huW#Hk~PxZk*&N=)J`2f1h0H?*;+X`AOPvd{QET7-=YNOb@C7U<1MmA{?Y5> z8-zV6MbU2eA-h8uHxpy!pCgXR2;r^tB72IZN}VLDqI7Ps(Feg9Dj(osnalTK5k58X-T>8_1`#KvIZK6Ef5Kq$M@ETVXvb z6h3Ru)k@{>F}|B@*TVHOG9n?LC<8d%9Xvd2d%8*Yci}?is85R)I^jVDR!DwCmimmp zfmw}SCu4Y!Y5uN-g$ABkNiS4Zdf@56bTy}5(QCjU6OWQ%XTdAl8gvf8 zNp48nYTussWNvztk(41QsViV`yf{3XlYMI0*;#1gi2On{Z^nYPuwqglqjMDdAQ z2mZ4OoyO~#?0JtY+mf-o8PYkVCWC~LWeyUqJdPCmk7XH(y}$LY`e6=^NWv#g zwYbE-S#nsw{(agdnEzd6(Dw59`G>~zY4eW3l}s7c$z7V{-swm1I>@TF^l)vPH+6P2 za?fAK@Uz8g_CjaEUs{1qZCLj_wW=#7s*HmnbvI|lBp$tLj*tJrb!rW~R=KheyTsT|nlQeFqekN|#Dfb+1yN4PI*qI%yc*SvwaIS}i+YrKQeBxu={Hq78kf7p&xxB`VKjc_}Q= zZ<$MN57m_lMbbt>W2F30sqe`kYhv+0iVrR%dJ7n9sFFx1J-UWkX(U zP-l1B-{MZ<$e4_yD)X@ASXPzZb1s)v3xYgGa~HH=5X=uykD;<+ix#jQ$VN_eK-!j1 z%KxJS(l3t7Qhv79P6bjg+TPco4lwrqyO$u@_Fe+a4Mi(CNOAl0mp~Iy5EZCHh>S~S z(e~sg>yu-4a{u`|<_PVOZYoVodidPwM@aO!bb>Q(sKuX@jX(wlWVw%ff$cM6e6G&; zq@mn*=p#e_G&K!|Je=AB<1IKzp;k|G#(TRO@2{Ql{wh1(1KC=g1zCxXBJMVrm*FFF zp9**>?d59BlI444U@`O6UM&)kR-fb+Q?9+*cGIvx1qk(a26qiQV~BLYWXzo< z^#zo1wW0P5S5-SB{$;PRd_cck>SjNncEHWJs3lZ@B=#amx|xEr>9f6+Yg9?kDlC^u zTlGtnSlU)i&B{jc1*F_PYME0^qp)bm9ZR=xA=^v*#eB+YH-K!1tA|o5 z4=|*Ju&t)nqV!cTW|EfZLriCv1Xo;opX6SdvC1XONmLd>(h&u3u;P$2Ag|bnq|hCaLeIsKG^Zld`RD zR27E8cQ(dyowb##mg#KtO7L7q>K9g~w;ir^@52Yi12RE*+o z>aK(rg_L&e>L@2=xOtCNZAC@7xGN`dwNaimWTvBesG9BI@C}8-%?=LV>xIK?tLkz%hZIBI_MT?aV-a5yL8MYV-Z?_5NIDZ3ZSy# zgdq8iu;^zUYzbe2nXr&Tr~*GwtAQfqLtI&fN>e$kn{HPfvuV*I3C@Ivood4lQp*se zKO(6qM9Bafmcn5)?sBEAu4QAU=%sajo=x3w}|mzxv33*ap+pzHFJ z1T&XvkT!s!eEE2t(Bz$}(jtv(2be5#Fr$!hBpKFlPf+LX^xdp5jkA2Y%@mkCoWC)LU7hy(m# zq7ienkwKZbGJX~|#)k?2-&|!dPk=F8 zhs>I->r&4A!xcz?9={fK^)G7ySgdc zY8StG+QqEDIgszCc=M>S36^oAjTZURRi@^KIOKnKqMj;PahJ`L%W7p{t1K^p9Lq=p z#yIjUZ~PVKa_zq8ZgiHJuFK|RK_({J)!<;^QDUJ27SD=awSb30k_8Zok)y5C%n*7X7LFy>toaeu|cIvvku1>q!;-e>M>CnZlMhEV{6Yey`_3*00 z(-M7xx>XDq7q?LE-=T zp6A{>1BUkfy>I`0U&-8OU(R!$^PH8g$^sv(9KB*^=Lyv zQdSp6l54|c_at8Zpd2$ic5^?5(7ae_uOO0uzOnkkX_`~yy zMI+nZ3M@UyLLA}$*S)w_%^U`>CS8mt8+9gdUa3=h+@yMZWPY(c`RpG551YT+o%q8{ z4`8WrHonxl41-pP-=e=Ja*e}i9r?I`XM&v#uv(r78i&!B8nE{(9pW~Q9?*QWIg$I{ zT8g{X$gmX4>Ea-6dT^mEDA^}~*|})5ev2 zF-XRKa^G2}2h0;{FRWob2G?*hs1-~z0H*Nv7Yfo70zb4$ZQZ8=v#+SFdu)EOk{|q^ z&+SL<$my=+9e`30vGh({;N@0i-q=w#1AR^D88rF~f5xjZ-Pi&ck zYV`iQE@8S>4w(4_NPm4jn}eZ-0Zle8fYKjmCFnHGV5@AypU-E#a2H#r@l?>ly^EOs zl*pw=wJA)Q_u(!ZxMvBhWcJpusMv~5&WTWjdxxXE53fU5jp9Z%>B&Sf(<54h{+L+A z-*S{*)z;G;34oUcI^W{wWt=d%(>7z^CG=Q)4`ztb{;02qRvSmxLvHpETR3YM!Cl&7 z)~%f!1$KLb78(YvZwK8*yY(r?VRVGtU|)6=^9q2=|M_fwtCyn3yqz4yQ_&Cd-(r0P zElQ2`Ypg8PX!OxEe-B4#U1BZ0qt%};bm9!gxWNbT^E3{dgXnjOJl@LDby9{h>S;c# z+Ub_WTKb0;VOpJlqfb%oHEAnC3ap^yD_qY}^P(EPaMuOUH>Gu0OCD=#I(9chQCmNDFGs1im60SvdwXNip%Etv20sJ5Q{d>2P4b3LA&Ai-C_xRw|^z71f!{e$A= zbvzF3oW>U8xsTh%!o$xpsV$E(>)HG(<~MX7Tl(=oL2cMF^QXeg)w42EeIRA+rnc$} zs31bOCu95aMdfJezmR{|RdBKAq_e0pCJ8`?bl z%A~Vlu*OUqt4Uvb9@}*RC}6mN{KkcLrc3qpYNcc&_o|JQJ-R`rKp)2;AP|1e|M~p= z8lx5plJ$b`XrRpt_S@uL3Amx4J%aq7P{{w!^NW>!`2Trw-?_-2ZcZ*!C+CfyP3bea2-FH= z$d)-Q4TMzs{aE<~f5HA4U^}r%pCpQD6&!RrcflzFd$MWxc}|T!VAlmqe|7hd?$FjV z&D#W<5KH$_;~uQex(mgVLKtmo+{*7=eD$33T<`@-J2>@mMXMN3ccj_y8o3av~P>P{8i5cRH3p|p^v4|UZ>Dc zn!5y@sX}i_p(_*iI(?lg)SW8yniTq#Q|OCSARJYtDQnyQ-#V>g`SW?T~495 zQ-wNHh1N@5zJ157Mm3y6r*NbB8)#e3W(c*a@9@53|^qH7wlgXzq2wJigjZK0DeaJ@+3hpnml zTTq_^OyOL%z-FeCH*+Y=G!{+x8Gfg{Wpr|c##PJhMWafcVRYZ?4&x0YC;R#BZ1IrtY}(|?w*tLA9Ne4WOKDXP&LxI zU$TnrGrhNpYeRaEacz1XB(BZ>AU;d1xw)yir;sQu2Mzqv(%M|t)Ht_?U?_7M8|s?s zdx|`R@FEAVFnmtyv_KEp4UMg_=EmBY=(3@4ddtk7gR8j3YNs~*hgM|Zx@PK!9??@A zmY5xFL{rOxa1^=|cto>T1c{W2)NaTkt0*lry}5SwMGX?CKBK;2x(a`kfytv5J3k2X zMM`E`n`Ue6)R`(UNyf}rYpZH9BNbphtD&{27PYcHS$h5tlO!gFp_4ap?Ira*|zzGLD0*^XZ2+2c0$9ZDbASStGmWdDc8esmjKs^zfXnQeY5{W`>GM<tI3TV;?wrKEV@&5*V#;KI6HX@LIN|wl{|r7o*OiD`oiNgGUye(!Z?JM zb|AztoQM5Jt0`dg*mD+*re3!7>S&AssP@pT&4^^Pnt-0gb%X(A|1f2+Y@+Sc$Jf@L}5C;ZzNio}aeYD3uMz8rer>AEY! z?fPDH9pHedRg7f6yyd^FVCpC*ion!P)CI)ojtf{m#F?8P3d(GmVTLzLKbvO+*k8k+ zgY3`SNp0owxf-9x?SwvOREQSb)mjA^ZQR6*^=2}5gM!fe5$~qnt@31#?be$X)K%0#=7#dJ@y9NHmwGYUVcPgyq- zMbrSzkvyCWAlkHqClz3S6+eOD_1hWX(-7sB{SuLJadHzQK*9H(Egay*MsLdaagzSm{Ikoio_a zj~E%WSc}-l*e}QUQ@xZ2GN>@pK0&b2Lm;q42nBs<>I}~-$Nt0-J01T~!aatb-tNGz zhEH^(7t^!x$q>8UuiwWF+<5UsZZLZ3XVBwtg?I>@^1?$hjFe6rE1dr&Y{ekXHhMGd z^Sr|r8tF{FYxJgt8p=z;Pl+J6@>R4TNVJ~dby9;2I3bj=b=p{yI#yAydTI{RA@$Vp zEL!A7kqufh)fe@ZJb`z@L(HCzJQ#XhPMbxUD#Uuh9*!ElOxh5C7RrYmK{$`5`}6@0 zzR5q-o#=I#C|9yRX{XGM^%LmM_#P;N2SF-hBuXOv=Pc|EWV5}Po}61O?}Lz$K@Vm% zBI%jAK^$^8K-h&2nRe=r0pUS}F&AKc82UL8>cr;Vc(2oo@g`nO8}!HM#dtMs(7Wix z_#)b%@4z=B17|xK!%-)FB_1gY-c@s39B+rJ#rry3Q^nbGfNSd!?$oZAhmPMkg!O#d z-LVHyLYLEeBZE!))U(jg>BeL+fZ^u2c)X^MbV!^(_C&a^aR}2=#~0+)6oI0vc{CUB zP!0)-rIm4ous+it8%)>15hZ=9Z{~V#;3`^&Z#?86gEs+9#2OOw+nK3l%|Y) zco3Ro6R{fLITzuB>~~(*(RS|!9g`z8bgO7`Sv;hWCFakcw1vjuv^9}y7&NcR_Ar8r zsDRJsG*9$p$G9yG2Cd_V@*{?xjrYMCwy5p3-5Ed2;uQzFzm9Zy__p)b~%%Qx*!vt#-S;qHh4-p%XvI?_HzgH zyeEe(F6_^iZu>^+N@c$Bv&?QMQzwK;f#e?yRZJRQ4Z$e>J6~{PxGemSF=aze8FD_4 z5nnvEVq;f-)v<&F#T}_1uigzH6puZ4URQda{Q~*RQ1#TfG_%L2#(;x7HELT968*6i z@eF&Q%3InS>v~9Ta7q52^O5}j9450lHf?6CuBQRI-PQj4r$h6c#@2>evEj37XZQ42 zYUnB21|JbY$TUF}S1rMa%>;F#{{XE)94DL7?IdrMtyk2#o354{{L zo@mR=hPqf!6R(>!yN70G)wW(Vd}>2$Pc`fpPY<;Y{(7`?4)#o(daxLvE-bbFyXT{N z>-8`oxBi^QmfC5ti(<9)v7TPBh+L>1l~a0pR8DJ{X+P$)+7=0Ms3Cl!8^d#UvmN*{ z735QsQ-imjUe`2hR;;mgR_$zjYR&Uz&1sEEAV*65s;- z$k?+aFIpd)I%m3+un$#qT5U^fiSK7gBTxESQcJ5mq_Y|%x@UHCOd_PBSlWxdmlIl4 zt8Y?Iad(A#UoxkuRmvZNImuhTj|8-w)2L!^_L)}i{zgPlca8CZLNlb&p*=?dJQb#9`BZ9t9K)9uNie(AI`oGP=X(H#No@8mGxL51-c5JWB=Dw0}mMr`45| zl#If}50|D})aVa&`o~C-yZ?aFQ{?xwme$(z$f1X}q#}npztvn&+)Z&>cM=+8e-EA4 z+|U}ED<#t-hdOau`%IIiI|A#CLVX%z0%(UJAr(=y560wnAzy0p_Rmz-{8)2Sw61A( zduoV%a2C<{k@NAZwy}NMoJIkHBkN|#D06_9P$E}KG&R@9nqv}}`bZm1AoHl{DNfGO z3PB*bx5KzOX6l@2(-eoMZyE#WDCZm;mDX0jRQ>)bZjPCbRM7UZ4by7tWMNDU9ZAO_ z_~}ynp-=P#=mv+L$WNs|De0zqT9>8L|K`cb?kf~A@&J95r;v*B=(Qvh5)VCq1H>U#Y-mHEu&t_-A7ld+0Ud|!=N3BVuR=!&BsMt z8DNW(pwHvwZ1LIdaDL?uXQxx|9};A7wbT=W%c`WFN}{==pi2K~JQGgA6vS24|01Std!A-%V~%h$LQ`Vti}Z)^yx zh0C2;cclt_o8D`8D*ZcDhB~EF$8)XQ@XiDC%2Ii|4$SLJ<$Zr(UUw?*hXeCG%iaEV zADCB`%G;AZ{+d+!kLl^1sdPxJ_M2CCDsS(B{diWmW7wD8UVbXQ(@5L>vQ+w|MoxAM zpfG*U@VEf4DYX%)3X9Vl>Q1FENl)LJO20Ba-E*Bg(5nsbL2Yo%Po*!F@(wOYr7x3# z3YXB&7qi7p&W?Ab3jNy1F${X9qeLB0FvBc9nqBU4cdF`mO2d zp6lId+-6VFJsV}IymbfWb*A!eKQOO5mG}Dt^E@lv{{C=aURf${y`ASScV{Z^4&-5L z!*I#Ter|X6WNWI>-6)j4U-_%tj_CNKfCIO208Z-E))M|4r%X z`Kk2P>FH&u^fl?}HL3KQ)6+Xs>9?e(ccs#Qlb+t4O7BWf-FN2Y z^jkR%bCspiZ`(Qh6KDr^8|COr_sr*MW?}oZtY))>MIeIfuTBLj{noN z!|Fx@>8GJAmG^aK8ZNI%rGJCLI)mvjOkh+k}ztZMc~A{2!p^ z;Wy5rwjf6hW-_;Ml=~WIG0n?0m}tGyk*eOycQJe|-mV$wQ8A>y)JqMf=aZ?^xMBlr{!7(_ov$t&W;lhQxvXxNQWw45hEg{iFd+Sal# zT!J7ruy`Q5G+sW&GFzMsq&%pa7(-xEcglB%4yAg zt4~qQEsYmbOSvP`>H34aT(@aBlCXI6vsvIk>Q<*f0rgh~WpL?gl3veIiZ6oXNH3*t zJdh;J;HXJgC)YCd-66{qeSzr%&knAny@^$9(lr|FU7+D@(p4}BqJ~vW?|9&#Yz9Z) zq_xSfnAT`3Rc(4cv5XGu5?_s#Qmuw*+9Ia@5vKZTrvCNpr@C!)*izth^oh3hL9`{Y zhb!r_J(e3oR#8*taJa+3QEyhrvm)>E?Np~l|VmGs)m=24uNw0X8s?nHq zM{*U@6H@+3O!X0r_Cu#VdS1Ja>ACnak*M9R!IRDmj?#mPWlVq2;Ra;}N4bWVo-&os z7a{(Y`~mxA%%a8sHNe}Lj)*wTPzj(&mUY4^zK$#Z$|jwl06A*X*{hgdN)6{v7|zxD zO0J}D;~UweqWjdyVHOX=5oze$63mNMYWAYjjj3VNjk5GBpfIMrpi|QvlADOn;ST zQTQJo7Xb7VXm9FFbOLa8$a<{dC~dOWR-~cOt&H*vrf0RK^k5=L&uH~b4<@P^8bkE7 zwv--81nEhnJ|d|zn4Zv<(w`H{Xayo04uw~r864d})!Udh%5c_j)I5wfV;Qb?Mr_hI ziB(L$aSHGXrfamNv?H;M-b=*Tq&GYeiVB$Ajv>F`6g3ZHdfwf$n$+&l6Y*v6yK2%? z8bsJLIQlR>h}HgB>cY08XNbqPzQHg)R&Z9pCN0qh*qdw8axqt?y21&O?M@n?q7%p=}k{P9FOS(=nZYRYVq$LkPiB= zy=>{_bbIoEB~gn*OEpz7kACM=T!x{remp8h=o@=2X(@&-iv0AgGwO#?)Erskj(Vg! zYTBGWK&Bz}?5A;y4qW(prj7B9=?f1#f;GkwYyqc=h<}HhA z@9o|C6!}H_JoR+90}}f@5w`S`sq-N7pI!YQAz@gJo=1o7MqjE2{8GKz)z`sFF2eLi zqT05vfjr!#-)jTdPp<>qI{pK=mDRAGuPkx&fp%{`ribD|QFSZhsF$wNBlKOoTG>9( z)q0T)O7vA+0rWchl^&t5Py|}wG79>Y4jZfl(=V3N>C2dQ-~lA7Jdm!|vCL&y=5OPB zXqg_NujAEpwO&t4_TRq0;N-9=7r+-Dbztc)*nZX{Fz!=8K%4Apv{#H&OoRx+&9;IT zYFiXw{t30jHn5-A298gw{<>XVcG6zwUj`*)FR;aJOhtCzSLoQ-6X^%23OQ$;uF%?O zz4nRf=n8bC`{Zg-;ISwXlw&fG_BqggqMQ;N*w0KmB=np*Q}mnU9RWGtVhh&O`DT;e z^K`MLm(fNAXB9F58$1rgGfn%0y9-@DrmIDBDY`;oh%eZ`hITmX)(udWb?g75!U%nL zO&8=)R-^abbpel&5tOIR0n<*c<-+~psjNnT6}Ve1;E(YjEyjs_F20P4vAmVVc1 zCZ(4>_4K|vW1Hw@3``HwpVZuaO#9-p&L%AaW_>QciiV-N@pSe9&8flBNrHrEWAcvh ze_ZL!veIFi@bjh~jt6m?*D*bVnA0{1 z*dB&|A8HF#D=(lGeKg(e*8giFNDr#bSw`PWc90gk*)oauaGn!@Fu1jen$nDn>I0k_ z*2{1zF?;(yI;Td@Q}+@5?&pUz$O+gFl=0`#YQv6m$c8EmxT!jY#g2_oUG;^c;7P|7 zIksV8rd#!;^lm&zzXb@s8wd3>gK4e4l-`5sLPFi8dLG@b?}n)+jHl?$cr`rSDgd_k z|G@LM-@TrO%_DM1nYMcB5l!JG&AyAbV#!!PIkf_`7F3plWzbs%(?^LQbves?Emln* zP5-j5OS|d2^`-QsAl%b2^6T~8^jUlv)k_eVK!Tw5KS9+d|DYQ>7R7+j<*HvrX2hH((rRvDA)7t9VFMU{QK3}WyqJXFRuo+!tc8+Rk(7yBy?M}}-U^X@1 zs1~K3N_^2l>K3Cld z`c$^T^o?#a@-y=BUj#$d|M z;j!=nC9hOJpCcOWuFi#Lc&g-)QZm3J;U>Rh|8iwcxlH05uH-_F^WdZd$@wR%Rx0)fCp{5vEN7>xfP9q@X+-kReAgh*d9-ayT9HQphCLhs=4 z@DTy|Gu-R-79!_Z)bNG}NL!P_;Xq*je5$gt^xV%rescOo<8%!kg>w@Kc!yMxKEUhs%Habp@fH>qdXJqL z2oz$H-s5oW#@-wNvhfyr@z+~*tY9`5%(jlUr=F3Me!e_5a+ZnP$L`&u)Zxmb9`Wlnns}MfD>7c6e4Lxa>LlOSp-OvZgw^gZosEJkYNejB=pys~Qn^H7GOI>YaW32h2 zrlyN~YGm51p0w|0Lr)yqpZL+kknF)8Oz*p;skx_CT{^~T`9GNrW9I*X-m%p=r6svl z`}aim*oy$dB26E8e{Jsu(dkW7)ULC2w+&a-IHj_kQUkAdtcf{IGnFy&7Ic@HGDtRM z50IGU>OE&;fsxe9QDE(j#Y4&=PF5fMNGaDIlyo|DzjD3ol|fU7iGsKMvhX-u)5s0i4G1oQd*-llaq8zY3oC~qc&7tC) zZ1_+BUqq4jEqYK9R$EhrPC(DfNN5RLJdaCGreyiLGO?7qibMP~!&i^R(B0Gf6U-9N zVtBEQbBL0Q$~bh4UaFcct8_+1uZp+UO0JcfN=rpA--S2c#64WeH;5e9c9z>&<<{G( z?4HF?s*nq~mP34p<78l~Qx4|c*_CjHjtF>&d2?Q#W7V5~uHBeUF!qLG?voI97Y0~j z$@|6S*tzz&%HitBGLB&SD~t@e3dU_r_a-MBN6^cjB132TQ?h#S7+%5?cmu?xVIDb= z!|Wf(GdaZj*v~f&mEU3>cf$~d-{V2hM4>|;V{zp% z*cn(Yht6fXxLj-uDV{5KOoysf?fj)Xp(SD#EY3{lz#g+VOc~GM0s}5Nrxml`IGjfq zIkd$y02a2x*n-Y7pP}s4#>d#djsxsJVF}`vP@-f!zPKhZs%mUapf=2*8ElO;a+r>< zFmwt98FMmk!>*l>@=IG&JxM(cbn4P_#84Zi!V?XHKKCFB0QHMdLmpO=u1!uJ28g~| ztH)A)mngy4r`is1jplE}!00!LawLAB-N(xHv96Dz-z4_H7sjVr1oc+R8*bz-js_?h zb66w!7q|nt9SY3spTo^yxvn{l^^$!lFF;#U1^*-?CNTJuU_2o*I!;+3Wk3KAF4`r=14q=nt*BfO)R>UV$RvRoQ??_CBDgc(?H7zo3JZ*%H z^fMjR92~!_tdOs@huFX>PqO~P7JH$ab3ZL*KRw&=72Qvz^lZnraj1W7fa$r8JTP)N z#I%tRnU1t6?5D>&@%ISzH zOjF7+wjre)1%%BkW{dho*a6N%+mNdJu)J{rOeipfIOT{NR=R-3+mm~U;h^hvkHGOQ z5RsYR^6;U?;j}oBOYe9h#xe9`B9|>Am#NQEL#JhWQ6Wc-!&x6lFD3Q>xY5(ST7+Sy zZieaH80J;ClOXKW8gXtC)igf{;ot1wDI7YQP5551{m^txcNg+OW$+yakZexm8b{HU z$z1l!rrM_L_rOt_*mLS9U^_Q*K_`bOk;}KS8)%~QBDcxE=+LzvQ_2NQp<;&RwJ8S= z#_E2v>?dTHxi}= zc>!S78sZ}S4V=fe10h=QN;8K{%2=t6?!`e4(fpL!*TwGeuZ0mXE{_EJtIlTXQv_FR zBLE%AjoiZ2h?6;n3wSuL=EGr0f}kfB?Bc^^9HMyjc*b<8O*|oH`e6DzScRFQWYZiv zqzL}7^PSzzpXqkKUW~~pV+xB4dt4}Rr2G{7H*f*;rs%9<5~RD6#qY3(aAJ(w{QR;(1p>YiJTpmYRNWdoeS^vdO;1P%xDHAa%G32w+wUe5sqqiobopC&{r_C~Fg3+R(XkOKn+q;Al#6JbEjdDM|7jlvH{ zg;ezO5U!+4@@&>79{s6NJOnRQffK!4U=H(M=Dl-xFpDbuGKdK01J@mUCOd${?i z;T1}v4**mlQ=f>W*1bYT5w1tm;xOk?yqu{QvZ&>iR;F2bVGhyZ72z@_E`_s_+c`w- z#bGjw0!*ziH=0Q6Wr7pwRn15DB=QjS1?nz-rY$nXi87%Hq6`?~lX$ebf%9+&6z~SF z0Yp3UaM3SjIy|zL<^&nQP{1{8@m)L)_n3r<(EIMAI(NtO+uZ(FWaMP8 z=9760`w?kzEM-O*f-2m>*6Cb|p6AL8!DkP#+JVI=7UJ&!ng#pll2ps>Zp#lz%cXn@ z`}rQqC}N8iG}-OPyj(CyH4gZMP8>lvc>8R9~Thhnig#MSuBU*Hz|Ock?u zJQw6exG#?FB(|udoU8ErRDHDC!tPX^o#}OWJ&H}lKX`JWZd*Bv-(@Nn~Yb|7kn&eUmu_M_K2 zKoQadRDqTH<9v8RUUND;$ZW|d1*mN92qNbJ=rALcRgh`GQl@F;3{5>cr<|$4hZ22( z_9k+aZwK1E#W3j71wk&LembX2 zF&Q1b@2Lo~N$ZluOjCl4SQc=X1Dlno!gPZ<#2+vXiUjFL_*8kv(@2krD`$F6TS)iY zgF(~NVyCc0Hz)Jd3cP`~>CWV{v9qv05%E4h=;SJ?X|MK`~d>&i0MH;#XI-q9+B^`_Z z2J|cKIqdK>QY6S0y(C39Cb!`%2Bxq@hgSrdTApQEhKuPCA5(KV(VfkDWC~V9GrNbDs*3>9E<)pZ6V#4wlWvR=yyp#PynNCo6Piv$448{B1i=J zdP2?jQEj38bmsfZ7##zEJcA3M`3O+`alQ}{=T&2yhnCX$dGfrvBLnLeV!d*g0{7iL zm%Gz0H-STX(Qfviz|mUL8?iP`Or2VUu1N-0aENw7t?|m_GI~QqxL^tM5n~6G2*} zH8MSztcD9_nkJxh#r$&NUz{Fb`aT2d*K2ShEf(27btRW^0e$3&1etD5#_%|Zsy3fa zZ}ZV)HB%WjldjStI6Xfk%4u$Jh0v>^bBt`J?F*XV>4j;v0U_lKr2TV2iJ{XCM(ODR zD3KS?ue2iCo(R%)TG9BRFe0i(V=!+eHr2pK^i%Wm_%^yX!wtvWwb;dU!(kuhmuPDf z*v}sv;|Oa#OH`Tc77?O{*nGovo0!UivNwX`@6&S?63xHTtyT$k(+8dkwje#dC0Wh| zNco3n3cgn-RhXr?W7gA|R#WI1({i%5I$3=sfR&#sbz4;JxytTtwd!uzLi9#wmm5UG ze2m!HU_Kcdogqo6kiIQ1m0x!N8~B~L)zVwpNs%6_qjy35?*z|kUH&*37vN+?ZG5`N*87IMMctt=!t7laX0)6dwa30wto z2MpeK*rL{A+`8w}tnzeER^1_|52o+59C^}O!cN8ejV@2L({62wusFfyv_Q?8M=@pY z;|a3=6WBj+Fw>85A)^-QKEc*tIw9zy;z|E<2sR@T!_MjhxPS++<(N`-hwTCMro&{( z!S!Wx3tN;7K4utH2zJOX?=TD+Qg8GInKFhg9>;xgV;2nI5S-Ut7{u4W0c=h%dQ**H zqE@!Hm!UO%$li5p=I|x#A56(&JVO1f58BCAYz$+|D!KAB{X!dGkGF?I^jA+#wm-oB zOL>SeKYWlC02;&GEPxhZe-)FqFu_(KSDh_+YFo@>xst1xrss0uInbJ#TS&PJLBmqc zdg|DidQX-`-2VOvcNmE9T0mwg!>t0%U1T>Z##~@^S2DHVfm50wIGy0@ICK>#T6yVG zVi69l`0j#X6P_Q#IP7IFQ+5~jU;#)Q0N_L~R{}D?)xntYUnLh+abNml(i!zFh4hkV zA=4enJbKQvl;$tG%pOzV1h&YiXG#|HSYGU0Kl!J+vstX?WcT$lynFb$iq8p{G&k4g zoB@jbOd0D7PlTIzKYNG4`!RTGBfWeEpG57;@Nni!gzp0=J{QBqjf^V{v?3Rw?*_JL zW*$?HFSREe;E_DsDUTNzP-GET%B^0Q#2l|rq|I>~bU%Nc$fNhPr8I95%~^CsYJ>7m zcc-)w>@kFW2E!Q~RJ{mJY&qP@p^@T{b|_n5mADBIS%jDtQ=odY=ET_5_>~w)jl8 zcmq>=9*W<>1$;G5;t2Ry)CcbZO3Y(Aylp7cjAA<4M;8?{9qk*^w1K3A>Dk!sbAYuyVF=duA)#Tw>G!SzEu+7h7KlTSIYu6|9xDqq_ z+_RAVNcnZLT%~-05Fcbtp?SqPR#cNmbBdXKKAu3mN~yh=sRR2%1kasw**cZ$#QAMh zSmKYERI!a|cs=&@Ar8%?M`0587ck%uIEPl@Wp)g*sb6VYMSg@ExHJzpIv&Be67Vd* zGUD%cnMM?$eJqAo$`G~2_Y!ulr!y@m276{K`=zXex_<+{W$bLc2b=PkvVB82N|&rs$(V&+N;CIB{D;?s zUb-v2TWoX2QpVqf*x*8@cnOnke^|6&85vzbDJVjWnC5vmVd+h}sELl2IFDEws*B;) z_3Ht(AZ1nVg1oJWfEu2V+L@rtF2oWN2T_ON_TmhV@^&5sHK0U@R_8yQM?++9J&ag1SA8C(9%dSTHIV%bUPY$J&>~OB@wP&je#GnvzF@yX4=Mu*@ysN4cPc z!4I2o(*(iK}3Lvy;1hgV5405)v;qaS>h=<1#UNw#vc}uE+!I zMQK5380BI7()V9L2_-tHOCeZ?qIeMLVB>5trM{fP=f%&>Dc=qKWtdWbgU0R zF=SU=H61A-?u`msP<^iXwtUYFV*4mwjdOjhcmjaxgJt$JdeH|95a4%%QBRiyhhGpL z!=(8N?Yy@o?^dIpGV5txaQFo^MlVLH=pfJ^W%F-g%dEPPLl`uq7gw`o&MP|}LL8hZ zn7*IQ!^Fx)OaQFa!uoGCXjzz8RqP+r^hG0w^Dj8A zgw%fvj|{_2^IOi~uA__y%?}P^N-PWTFN9E?$ktXVwRJ(YVNjP*4;E`H3Z2)a$Ly_{ zWp7O%I#RgZel8621nwV(+xStcP+6l}sDF;~N^8<(2o#0udQZHaD~&!pyr02*l+lN2 zoxa{+dMA#Eu5@S{oaUAw{c2t4-tTZ5UZoG9o$hq!md`Ab^KUoMakP=_TCv#u=mEK4n#bdNa_pwP|$3b5JAp?>+ zu^M5fe`ytXL%~H#0eI~n8Y-Imyb>8c_4oBNnCgP+Yn|REbAV-e`W*Uhp(}N~tIlWt zXr^89$xN5)K6*1=ZZMf`MjyISkBnbSd*VTwT206Km|oX#zx*Mwh-rhi9>bxRFb=v4 z#_2C5FsU_6uWAF>q&pMO$~h`vx>GA++L9>dl}z)C=_$=e)0(KCk6r{1v%Q#-L8zg8 zcqXKEVipx*nsx_U2BOuK7=6ea!46F>Hu}&`%|{pI_5%^ePjcwN*3+3bCrVJSh@MFx zqNBwUX#Yd5phk2TQQa}Uh|$V6eaL=USh_fmo{|9kG;K1|jzkGMdN^6kA?)-s9v`jO z2G|{zGQ9@7s`Z)=rjA!|fQLz1!#yiJ-w0 z3(C6QM|1J@Z9K?}jXo}`psU4&&kw~b1`atrs#PdQ(hh*qQy!lhWiH0JLGLn{w)_lA zABPbh{S9)4jfr;p1eSFpm|__0(Vx&wiE?^Yvw?PF!Uo!>wNiR0(L~Rn+Jp9v`WG?1 zCK61#H!+#%Z?eJnB_<1l*5X3wC$uvC9+3IBgxX9)ZhoLh2QWYM2xP8F+JL%2pCSW? ztAKRS-0JC)Vf$^^L`Sq)^U(u|a++FB0L5R6l$L&@<}pl{gYewrDWc1g#ats$4XJMxPmre!&N4u5 zi6#SEo}5fycm_~eE=w~BG{dwUjeOzpdGT`-TlA%;h?XZ2HWrx0g3aBho{F+?8D&<` z=K@)`Bmr8t=u4@s$zb|Iffk)IfX(OG(rwS$ooz0J{Xyu^QKELWokN0>&2u?)0-H4) z-~gY>(W4y=hnjY`-WDx~Eg|4&RtdCn+6FV#l|V#RIvl_71_7(a4{D=dzkYn2^OEmQ zweq2sligx4{V4$&tPcdrE1^VW(OKZLkhhf1&Sh%^Uj`2EZ5(o95|z!jN0LFkbFx>1 ztKnxlwt{9riDtXJq=;}kdDSaS(0c|`FL14yX?n4dF-2u1HwlZg(#Qb6O#GE-@G?_h zf|NT9rbMxkLD_QJ=HTa0U`#r+6!mFbaF~~eLE`T6WQW+_7CHUc=M8hGHnA0Knbq%vV}*IJfG1Z7^mMPg0v7|FQTQFpgUNI zcpl5y;#pkIr+|6IWds4@jG)agxe|kz57H(B01fJ3F8iT;umGrRW{^$|VrqStqBhkA z<%y!gEAzgR8c z9MIPN*qSy5S_y7PHJxrpz8vxQKUOfH)!h2!m@*FI2?S^|`vQ4SNQ>rnsar89Jjohi zJ*~kaeBc4Ll0~>BSxp~#invnbtuPD>neX$x_DbMwiDBw9_Hl^yzEB045av_WT9m4# zE?eaGw8d8DtpWAD6l%YF@PIEQuK@D7#e@4BhtYZ9$s9^W6~t|%6;XDCnu@_ZqiK0G zzz3cf6j}gFlzf&;*&H9>N|UN{smLeesbT*u&}_1N_-WGQRphN_y>ur>c^CR_<$|r3 zEuzFCN-m-~dkE6S!+mVgF+Q;LCtwXhb($v!xRPevK}A0BvXdK`X5)USJdMpbTl#P{ z#jY#dDL$mxdOL77Kt==%)sNUZfroR;OG6oC5}axQU`@E0V!i+OZ1G<>z$Q+MMZB;? z1_0e2^Dr63i_q~g!4@1i1h??TYz;gs$TYu+DV}#fw>T)RbBR3=rZrj)xA0`D^}x{Y-7uP6IVpss^k}L?!sXXb~46 zr7yz$YfRHt8NH}~kt$pdovp=e@oH)KblYBN)&ItdrP&S+(9+%lcl*Oc-)Z7h2h<16IsUR;V-eA;Gu7~aYPL(Xm z$!-~qvxVI$*9%ku&(&^IC#8;MBZnXpwxlT=bUITd$D~S9mXyU=h7N(*m-|A2vp~ni zxzx4^s{1dmCQKP?TV|<6u@_4jGv+T<)1hNv6F9sOCT3Mt$9k(|cP%@7UQ^Gq%#5Cl zbsC)D0nYB$i6i?StW?~Ru*RsJIsM-iaT>F?*9Mj0b6O4v_u#hKVq4#cw6sTKTQx2L znwbrav1oIwwqAKA*Ho5TE-7GlFTWdLQHvp`8O-YTxKdT zBVaXPzi;o2q2mTv&7-+llvG3fqzEBGJeET|fkPtk0#g4y2+IZ4TzR`_@j66R*)p}s zhE9JGJbfH_`1 z+*yso*k3r}~DZY`(T#03VSCN4x zb$kWQ{|GL>5_n}YSJJ#7Q!mIO%_s2GoVN@Mla%FI@Ctr+$iMSM-aFzx+0sgW8)e5s z?c}(9WfX5JGl&j}oPtPC6wcMBC`^=py}N$T3W@Cx6BSX1T&VKy#0;Kf#1;d2<7e}3 z{8NS2uL2=HQ7Z~-kShdy!#6u&LKuj-&?rP~3h=+Bu3P0{mz!s_0aNNte0VTqyB zW^E}l?n%i0yr9)H9E#cdv((w2>%y={K*3c>s6;s%^qFUXL3D%YrZr%Twt4EglZ)5{ z9S{{DH@!B@VoGPQ-;VjJPQw`-x{Occ3H&zuX~8NoBCK2A?^gli@l$eDg!R1dl@_l_ zZC^2zH*GLLtG9^zwdhE$;m}s0x%5KPcOTHy!(fUJ`Cgc(;5Yuw)5TD|qMAFvIwW%+ zb(DxLLP)m3hB80v-tRd?-JW_WJ@XC@F+~3p*{|nQ>267#{VXWvC_fMXW1`l2{7Uvy zb)HEe$%jQaN@pxGvY37=v9aTZPS;U{EjsU6N;c83A|An1na8MCz$R5dyj=n9p~96+ z=a+B+U7w6GZTD0#6&BHX#bC1)(-8dhF%8vAlffQ1~sRI9@^OEku^2csEnt0N@)h)k0MA z54Na(1=R+p>L>1GeE@6{pjtc=+H=WefYu~NMAJ6mca8j>hi1Dmkk>qDHN-$RN3>C8 zkdBYgnL&p3LM77MgETK#M)QKy9z2KQL1>zH1P!8VlfhGe>JZ(ZnrjB-R{ z8!v*p6hrZJP`5mRp<4!_CE+9B4UjHOw#=0vzTzd~!@$oFR1huXN~(ig4>WFII7-aM z>xJfk@T7rDv2d-z$)KfNc_pR)RXp0hP`{FT2%kcZ9qc!c6V5wpk0glFx-& zau}M*xFY;KktgVZon%C)BS;j15<GM14WGc#3^PmRc_+~I_|MCOug~m3o+FPX?}1F1TNrvsn^ewT*)m& z70!j%b-O#E9pGgrUo|Jt#M1YEB zl{>9>|K4qV84xcSkcGa0nc~1g;yV<4RM;56{p)YJlC<@_n3|za)7Md)?)-z>%&pSQ zA^*OaZZxx*7gIy77eeus4tY#U9_;Y-zwY^2F&?D+vDEp(^=|^HIH=50#P_iE) zo`%`aNw!X9GT;Ex+!tnR5YI6(>B$79|GZ()pJ5f$&7`#%nbhqjcWWRjsBJA*@&jDS z8=W3Ke{y?Vs4Hti`hDUKrZ=^Ex*bj||E{g1b#f=^BM5#PL!27UBpHs58%ZCp#&frk zNw-SJW?#dgcQ7C`pCd*lt(D}@4TH9-@yy4i{Wu`^w+UE!n1E<=9nKLJ$((@Bht(Zrc2QF?^^Wk+skl)JakOwvz#@?hu+Hbi#AL(IdcjVn^Yf^no=GfNppN@X zkS#%`^Mb&lC)8tZt;>X_tmNyFHn$pSm^rAJIYDX-p2BgO<3irnd)4&tniRh;Eiyqe zmGWanhR366+K<`2@JGXQ#-nLwPEQX8m_@rL=RJ`0Dhf~!83zlx*3?ts)`nTJp4xC; zEC0df-KOt*Xu-DQ?jgr*`=C+g{{M*N*Q3vanGHRMp@SCaaOi0EF#Nh%|I0_)fABuw zE{nZ#GZCCzo@rxxdi2k#ZLL$9stOSB2GapE_@T|Kop~{SP>UVx%4lt$txV~SX;PN3 z^C*&$9vduUT2u3^S~29ee@2^AvB5IXzH8F2wY1Ng+0ZEcIKNYwD2nD8Kip))1{gOX z699&ChCOZkHj(HSG15Y)WlgJ(x_%AtfzV+pgj!b5A=EOR9)&>?t(|3uP|K7!XESF; zn-#YO{i4AGLZ~5Wwi6C5YrnQo!)aZ99~k{CD=qq&^IHuA#oZK4Aw8i%9^YB>nj2bG z^s}t`hGw^v;Z8rh&i3?>?I!iYE~Bm9^$pGVYbf^+huERfWVKWCF#sK@mhq+b-u{`& z>LE0m;dp%LQ?GQQd(THoQz`&jADkeJ;?TNTGN;49ORz`wGe*GS(_^jk>QUU-4`g^w z>$Cupk4S@%BL(P@3XVY8X_LgPKD*K|Xs_l&nA?84xsuH{xYE!>kF`M0R`>K)yRc!< zYE2kWumtW*LUiA$MNW5Y1M*K-jT#312IY((?MReBPmXDk7BNnyYm&J}km(Z9Y`Ip0 z%i}!y%mdTjS`ZXa(}NcVlcwN`kHS=^fT^Qew-pDwQ(fE(H7!H@M^7;flkQ7ab3eLC zA3z^;pfYu8E1C8sa=~iAfafja5X!%;`S5vbLiA#OrEO-)svtyYi-;bqpXd{gvc)g3 z#cS9a$Yi`j30!gdzEh#N>r2d zrw^c46MNV)47yEgn>y7v1mE)2bF)12z5$Mdh*LNszRe4@}rx{u;{ zP zoncBW+gw(~Br4S=wFgI>q~0aaDKYQ7?oN~-+8nG(Qas3%0rd>zv0k!^LmcG-wx~N1 zqfH=v=HnrBaq!1eI7Anvq{NeLz&M2Z3H-=w7%tu{wz#zrtHLH7`iXG}%?`p6iQ?5l zB)_C9GT=_VM>4?h_Hf+w2rN)EozP(`#qV zs>Q+5W{gmOPLw}0QyF3!A&D&w5>!-ct#$tj($`v>8>UB_WA$_D1RZI$Qw0%dwRKG` zszj|*7eDMIry2b4NeB3)G96r^)lF@d`$?;7YHV?S&2DdLn6Ac9-!Mz6);G+G*0!kM zv1Vle5^J8;&?pflwOE^=B>eS78=KscSQMvL+w56t^3!HEH3_y+zub1G*-JI8*=g>g z_SsEpQ1Z(yIYSL@X1!BzX47;T=FFz)C#uE7FEyr_P1D_qGn=MQm4dUH1UcfbnoMJ? zt+jTV9Viu>BE_0xvueSLRl~)qOl?pDYH4V!Yf{_L(qOM@%O&<=wzST%w@Ag2l(w8T zCr_51Uv;|RSVN}__#j-)6NI$=loU)~4r2D_q-~Fm1#L=5!DePpuvu5z5=(ji(Nf-j zw6xST&qbQ+&j^o+&c60o4YKfXkHZs-pY_YMefnYQ7U=Bf77?YiIO{hY>E_lHy19QT zQZ49jPIj|9C)wERS`;N_&y%LN@?XvFX&1OdlGVZj~Fqt3@ zTyRo~E0TYv+vUzwmjQGMk1OaBOl;V`%te=Q$Z$OHuy8-A$n6z|yCNHe)Ccca6YNX3 z%j46!tZ=)Or+Z)&`yU_9WvRFp*sZRjw}+B03hl<4}~AsJi0-P;G%aUMwOkdhMx`omsLtrz}ujQi%RL*!y~l!P_P;F ztB7vbcSE?{t?d&#!yoQVE@Ml`r|)~I!`{)e;48DI3k*bI4>#07-(EexuTmGU4=FkVkj4Aeu$>O*V{P6 zHRJP{0wCmI@DWb~qFiTXHUiqVVC3L3qctO2O$Kxw5ml^n!pY9b0O5|p^4rS#woHrBF%I!^ z&L4LQARh8SoaHmv9~*D}ncwHZ{07)jODd?f+)>l$Dsr33m!?Q-g(LgBio2;bq*+77wL4<<7{ui{0k@HZzXygV*>&>zOXu#1;!{TdQDk z>0nY;1>8D}U^CRpemZ0!U06+nd<+**;;Mx|7|$VdC594(o;A_RGAR?G3xd?If?|10 z10lYsq6?}?B@e79EaL!2InH!Jkg0G7bbsTbXagGtNW83p3>OT`vBW2E=x*Wmis_39 zY1bKhnEJQTtXP=hu`tx~75_6$m!`~e=X$APu+HOG8I*L0A1NHhA@i^@z88NJWju8# zhd3eZ?hp@$SRf=cJT$^m8Pr}a6}@GADJm{0 zO5olQFHxOQdoj02qy5VG88jL$<6F?E1tkNg!OjtGgO94o01#e>?tTG>yhM=`sVz86 znE455j;NFt1j&q0d$5c@MkGC0LA}MHhnWaR5E|!lhceA9=K`LLIUHF5saGC{sHGV7 zb0eZLlHd?Eze@{(VWy)Zc$WZ_sVxs`)*ZNgWnpQ-v(zghLY#|T7x&%1Ns21VkO0=J z%!*;&@44F=(k!I#z}EVf?vh+mRprVyOBYE z(5Apt&mid48X0t_7GdZj`FZRJhz!?8#+(9wO<=Dl_Q2jIBVcv({JDPw1fQ*P>&}7nrVup}3gm)?aoex_bDUgBh znsS%V?suDe2xJ2L=Q0i%ygu4+eS+9f6hULgMpRu+B^E3fU^oV;TqBx(;cLTVT494_ zZWz<*E#vDcQO<90UxzQy6|g&GL2@831;f1uwSoPS+tX|w&4cX|x-K2Pc}Ba92zrB` zpZ&0#bpUpQl46K~-MoD30mv=?WVbOOH=-%~VYZ90!Ux4{jWs|RqSt;$BQ8|>Ei zLusC{+nz#c*!*;iMjgcnY~yzkS_Qb9kj8q}x)FjT|FuosHxAaPurcE%wdPlm_zT-Y=7>X4pj|LF&JLVXZ_(n3r( z*3LXwKB^6`ZEc#>(4)8N)>v~7l)uAo`1zZ_&N-+@=z|G}diFov^V6lpR=N9m@2Sb! zMdVe|x2IQ0YtzLs#X^EKqP3w(eYl)|z0MW}=x!3VHpkSXrFov4s5>tU18apRO-4(s zxuJGu!+cfNX674d%oTQ-D=sfSGsTf%wMb~noZZ~eC@-cg=jmkH&!FtaIkTp!cTBGa z+eu3AG|`LRT03>75>VlF<6#>*iH3kSZ(y?!YATt~C+Wv{UKj8aP?O4K>e5ykN72?q zu0hS9ox$J2Tzp|K-VHOE=Z)qAQiY*OSA3C%rqB zz7*I9IOFalq6WX{X~RqDH*g_})ZSp{n5372%6isQZ!lRAgOpW;pUu7jSXJp>8n)XY zc-MKvFz8RoT!ZOH&j1cp@eqTksv1uoTS~CibO*awQ8Nb9{fTOW=sB$(y+dT5>Rm4) zeK)#)N<;S#CsFcAPo!qA1P2AV_Jq)0A%pcZ=;7oZgXk$w#9%!y{fq8TLI>zsPd%F# z8wTB*a7S4qqulJN$1o#m?L58QVLqd%BzZBJxOzr0C1d5T25_q6>zEMMZCf0xd800? z`C2?TZ9XP+6ewOz3pK3dA1T7LJs#u+rfcE$S9n2V#leZ6#}1)S;w1tgmU$e*h5}Y> zA4~JM=tbM+@l*C|7K;F~4BVw9`bv|&jf*7bgLs~^8(d`&-K)V{62p3JEtVB=6W@?l zpF;xOr$r28E<)xX2!2(-ojO;@c8mxY$(QkBp;<%h4RhHHCIioeQ+csTmr6vz$&fXy z&?6k8Pvf~dVzz*e?&B`%53;BYyhaSTET)e`DrBlG0qgYmDRgc**0g8}!}eUk)I=ET;FL2xOR(mdYh=;h z1pw5A2GrHfBoGs|Zep`<%EqhfNOuYk7&+N3Mi$-HQOzNYF1L{jc(6hA7)A6$)WO-B zD*v)fxq;WPB^2K;alPlO=RfO_A04pRnqzmN)8~*)LXiuqRpwx}fDvPP3L)aK8@dRy zLTvhZES8$7Bj#vIb>_Mat;A6baHW3SPObt#{E4GH1a1qm)j0Eyvdd=D8&J^+&}Z^guEferb|<`!8y$*f2P{sN^VCsgf&cP=&KdUH#lex=Ah4tyrXYQ;SqHhi-D$ z04k>+!1!8@8Dt3-FQ$KZeAMNZ`Pn)>MDKZgbYBt+1w*`_FBJ8M;l8^{sTKVB5=ov~ zpI1GlbZfE)Xi81|1bWR=O213y{g2kC(pjI8?)rF+bJyoj(9@$U#B!H*Yo#zG&tn?t zgD3{}e^e#jDvxh;5KLPBaC33Ox+r!23DA9VIl_PHvoV@ zf4>?+9x-yw5Wt#KtyE$k*H!`-grQzsf`R!Yo4!1E+>c^k10Y~% zXB-EIuG7144KJeW^p!Kpz;ZjCx3hmFZ^vjSgrQ3dFiE&vnX-JlIik&a4u|+nBZoeX zPgaHrEA>VrhqlM_fXvZ6)F=u>#OTS=JDs{m(hA^(QjVJE{WyZp7lx)EY^qbkV_6@A z89|Z{j}rPBh<+Vk#UW_$3;)t)S=S6wLy;hUIHz~%M<^uMwSP{Cb!(rKmtT-pOW!|a zU{@+H$|kg-7wZF6lVvui9_kIlpx7I==T+fXFRHmcOH=-5W<;}UXZNI~<~}WIr#Ae% zmxoP)i+tsOQm&=FMZHoE>+zKWA|5XRZF+Ol93{-QMH=qIL$?!@BsW?gn>t5H!tJ3% zr`5K!mMHOmdeX>~q~Y|WmR5PeIBAj}YpJW9EkAWvUZO*Kgj{N9Y;A66Y-y;I_X>1} zJohP$O@l>=R&Jbi40n7jV*g5qx3NVRZKR{&?f~wtDsj9TOAMwXeE2yFWO00xL5PRI z6mO?IAJ+`wP|1lrkqfA0kwMfF1O+)rj^b&HKx+7lhI6IRN$27&vRDX^Hu-k}d<5iG z@GrQO!Ep_VltUkl_l)_%C@AiRs65xBxGR)`FL#57^C0RD;rx?ShUrS1?^vLdW{%iDM+HD}feK1$7iN9oNP*H8%k+KIx^l zyFjo~VeK&({)|n0H|ZkX~l^45G(7f^?0%a5@nTIKE0v?TYlNZBJZR_Cg$tTxwKc9o~=UMKH=W;+85b#E7Ee zKId_~TzRSbB;LN?mRxSgo_~VZBHf_2NW4wKzuV~POPjCYl z8X2^-14r*0iVViE{wXrI^wWKr8sD~#G;DTxMupQ<6g(Xr7WG8k3xeV@+(4WqoR>!y zfGzWsQF#3odry-aJ^c^1sBLOjcW5K ze+pBdB9xmXhIx7Q9I6pNqE+nYH=zzXl|zqmkS&R+5)!p4Gk^>_quQO+Q|_d8G5916 zY*y-rD~dAzX*<)TUxOMRHFCUx0T`q%D$^uG5c}F>o?+4_9)XG*leu6)yyx*LFxcZM zGEBNWS%Pcn+GH-%cC8d8mL#F(OiX({IG#AUCR1m!1WH1_49qvsiXlp~=o04FvY?tn86{qC7 zWHpLaG16gKE-g<4 z<%(`Y^}l#ZZM?GBAR33R?WH)mUTHGimcU}XtvRa!;>Y!`RP&s@B-xaelf9Z7xOU|D z!hWC;wFt0F2mI7ut^3$-WYdpux^_%NU2E@aT}C#oO$7US4S@atbxO8+B1Sf73J&qf z#Xb@-VIfNm|hNHW=1K~e7G~gbrWJ5DkR!@;D*t#dW_@j82s&r z82BN|t?WOIl}o`qcpB^o0(RI>YTveN^+q;bmnbRYepKIN5G~a)p6e1phOgbz&`|PO z^gj(M1R)21bpFjRz7k9^6*0<)6&aXq($g?AXL>)8XJpfQO@QRJL@wem zbb+scvZE?S8QC;m&h85cGqGJOMS;^xID~P%oRH%_*2tz)gOsz`Ah^+@jmaRrr(wva z2XWCG#Cj2phJxWE96|%*s)1I9RT$Y+4SB;kpz5-jh6zyz;LL^$CGA)(Po{t>8(zYR zY2Zo>@0T*XhuuS!&2*u{WhPj=eu1TIrgN(mEUif98rk%vN5Rqsu1Zk%3-;>i^aNO) z9N@RP66OjbF`xugM{wJhGA)=q6a#o1;TGxHL4~ySndYul!1ua_;5KEj{9m7_2H!^14Kl$89|~a7i`b$@yy=QKB=;CK zRF6{U_AT*oHrmkXcL_n=0|#&mnmWIjD|slq&B}m)w=1dHwd39Tk~^eZ06Nqcw9h3h zm!UjubS9&e9yJFTOx^Q}*>C849z9{g#`_!yliHSvqcnOcQG&vQyT%%XLl81_Dqe{d zf--9edCL{JeVNFGKSV>P2Qz^>*R(YmI(?KGq0RFE6=w!f7%|aM`*qKhQ9^764V@Ni zf=NENcinwh=|Vrq>x0;&=R6Ux!hwaUx>&8m;N5DS|LUpdkci^&>eA_IONoO9EP#I@8l8c8soUFQ%V3wMrl@u|NJ& ztk0u>DwKXgYeX=-Jk0d=WRv}*(dloxOmrPcZCtJHlSbC&MLmM&v4kJFH7-eS>pp-2 ztw~NsyB~RcP&LaFXMcXmSg0)g4IM^H2Gbo0tn|m8h!C^2GIiu`QP&3O2le35nO;fj z?Pk^6hjwqfyZ_~gOt@5HlMnm$`bb(K7hCaRTRl*HR&T@wAgt(9_L?rRWz6VH_> zkfl_Q*HGnYda0s(x?XkHx(g3=sHDHIAoF_omc-CL*GlPiPKQnUSerucq%HjZ;JH-q z3L8XU%X?C%YjlCom2nW&I#ZW=6u;l$Kbp zmm;SuoXQ7aG?wF0!tTNMU+GFJ&+6unU+r zCFKd1=HtnerFXsIZtnNkTzXl2J(_e^62epBeH=Q2VLGN)C_&`YiFP0wL#GF{QtaW& zYDMTSy)B;(@lh{~`o}l|h5bW=LX2$7gB|7co>rPdA%CUPe*Lgv8#{6tR^GVXRJLr+ z3yO=uWbB3kxk2=!g86@Gk?|bbiD$yvc+Ajo(rL|nTo3eF27C~oL#yW7*X=#>B*kc7 z0Meu1tHCn8u1ETdbl5WK!;A`AJ---(=}hDqI$bWzj-}2*f1~e!ybDFAE~0)uip8Mf zZ5zT*1ZQueL3C3BTzd5NvGlcE*5C`Y#k2xc-d)LMTwv(*7=cspc!xmlllWj-Dd+wp zEkfE-Ty`Lylpn+G2qRXgmho4KXYJMhO0E87YC`m*0;;_WF#d&xy|#N6U~P-(P4MFY zXZMqj{pBn#Xal!iInA34#n?Dvi$-&u=WzbpE?jisIUIoV7BDJF+ic%@2+p#c{nWOI zDYFe2c!fv?Lh|Yg*d(PbRq}Iyn#btU# zt%*F0Es>MW#Z|vfT)c#!NiU>`AFg;t@+dmBd@QZjKwCb-h%qSl^wSGsaxK#%M(IfI z$CMd?Tn3J5unLR8@$t*zP%m@|z(Ik=0N8R1Fvro@qwkGUlP(Sd9CyqQ(sscpPl#X% ziYl+qFHw9QFx`kg0?8pbP44|`GlA3mJQl6v{anR#Lz~4)74@*>;eLI{lFw8CpT|)Fq}>?Ko_}Hkm6KexKk+ zcR@^!jGq(Z45AfnxLm#zA}YZa6f&vM=QW7FZ^yjVxtG2DNGp}u2om@rb4np)VV5RB zeVnNeL~NKA(B8tfaz)T|np2>lG?YWMDftT1^MboJ(Gg3GnRSUeR3jV@K zZ-6>sjl^NL;RCDk(!6p*r&~#(d3`=F zs0!U=Lc%zd{rqc#=p~uX2BB*NsJu+`N@OeK%#CEr8=x(5c(ZC%Te@vQxeY(}WR$X> ziwvTV0cq&7NBFsvBZYE6cq~>Nnxc^F$&wF-e(B6@@XPVfIV#PJ5AI-si3`jdk@GwtnOu@o!87 zh3mv#Gh4*5)qSIZL?hGTe(5!u=u4?U&pY+U%^*tNX9e$}FtV%log; zs;txsz0+#Oq>P8 z-ivaC2w$EA5#EdGC&j&6m;@GmIt%#f8Ck;z<+*s>ye7I#ix|CV4SaWZU^v9|xyOAc z_M)#n@_g#Fd3*}ZFGJ%yJ&{5V!9y+d#!Pz8(`fXfI|QLLf&A{pbhuF8^Q#r(d`Yqd ziMu?w`xxU|fe5TVpwT0Z$bm z8GnIjeom5!F<)>BHV{L;JBeL-*&}fBlfcPB1t;s1fRjHbi_-w*P6%7k5oPF;_TiSwT;Po}WnugT79E0oT;U)Q?06{s9+V;$qXyNKM z43?OB+ptiLW1x5jYi&kW8Z5k~Ij{g#M-yiz3!Q-}-h%eN_Xs46C{jepwnVwni&krq zV~Gn5$E#^w`B5|+!L3cFVg|id(}Occ4ITwuQw=N)lj-F|xxCo!)JmB)dwfW{B2hxEL8ha+Kt(ds8j#`0`6M1Q@L7b9 zC*y$nM|5AEVbc3?0Qz2!ixEwxkEFnE574j4v@j_M@yRS3#toA?m1;qK6J{C4`yh!} zW4J!EaGVtvO!0S2`cAZuUkCdI?cJXI3h?-*XMkbS9bo$NAj2d>_^t~er12_HdRK#l z=64B^&@|hec~iyYAbMNFt!^^iDr_cV2zs~$DP74;ph0mleJ(|T zO&_f;7nA8dk8t+7u9bF-k9g7Rc zvcC?G7=vjT`ZzntVWvLya447!=F)44pkdO@8h+2MMthkN#eGP&vmf6z#Rh?&FCVoK zp5}rD1oYYmw&Z&x4R)dq30|<2zt)qpQGn2 zPN8RKM_$*~s~t(9=dAtEbJow$a~7wg=PagEOF$+54fO5b%Gd(DNM*dd_0{0_N^G z2YHQZN2d3TkE1p|HnJ$gCp3<1$jm%60%V+qi5-@u=O=eh9)k=`u&@c@9x|E1HW>8U$EbOefhGc#*S%Y#}*dW8f=$#=u!j?<)-a8^OR?^pV2A ze@WySS@ev;zz^<+fwP$Iaxn0**tvSaz;`;6rB)dEz<@6zob|`_P#qjdy7vO5(@nzwI z0N0tARSD#KKfB;JC4;9JS@eV_BB13&Hi{nXf`3t6@c&9ws~bLxg+5|>5QmZJSOj0H zE3T6^alPJ@NC&T{J;+}rBvBUACz=glFS~*}0kF@sdd2#ALqeCQ5pC*@&th7xq<3G$ z0To$vy^`KtD+(_^C_%&(@!YgKK8x{YR)_c-0mNnMHMkGLAE-5CFzsMOb`%Y=B-5y#&cy>XLshAu!f0 z0)i@r#(DZRzZjRGT=R?FM_IlRa^UM5*yxeos9t3&u(c9Rd1z3gSy|z7sFm6*%`T^2 zwyn$Hhvnu3RrhAS!pNo%<0bZU4m$28^@iNtzWHC$x;P5$jC#vYGC3xL00mX*Sata`S(mhN!ZcCI&f*V7v;0gMl1|NZ>TQi{c=3_NNGL zNPEPk$%?a?T2_rUNJ1hT*)(q%cJ_f}o{>#2soUo+Xq3otq6)KUnE2`Wu0^V zWHU%$r8%=)6RnvY2{0|bGv6_?>8g2PPd})ob2pm6;G(sOY9pKerWC1`h+@rNk*y!; z;}#>EO_~MwXdo#B?s6!R#X>2qhF7Jwa-4UZJZ89M!WzkM3t<1TTC)kal=o3$UY@Qw-G zsnEjy8#P3jiRTtW$%u{@rqUkKZ(6Dj**8kR=`sxuNMd@;BOCPxrI+_v!hUUMGyMs7 z7o;(-d1RyhD9Q>C$woab8}*~-U>k)UB9{HiriX>0SObP)HdDT^ktC2TWR=cVRqHZ0e(}F-wjmyLQC$7MfZElh1DS@BH8^sL zkxds=Q+trw_N2&&=xGPC4BzlHqOGcG#Wc)jMCW4~AcymQArhYT`0CIaXoxHK+w_{4 zBI>V@8$Fw8m%}jZPGcBmBdViKNj#moMZM)rdJ3#~=P{QpE`SH&xZB)NFHtrJy%#*V%xMZZ ziNyK|G<6S0`4J2S`N3|HgAj z&+dQS88y#oY;Bko8$P{9Zz+wfG4ZwHlxlH|`wr=8>KID2c2>P@i03#AjHkr(#CBcl$b6V>d-hl-cY+Z#pCg4 z|3l}tKU-C27sa^?LeAOiqL#8nJl1yGbIVp*4Eb6i4&_PR!yAf zWS1SO29GBuvYi5HMY^3L-)mCjfEMy|>=yo_OLh+}bU8(SR7DPG!INvZ@D`~SCQeMq z|GA^=bV@v89HfNjD7%e^GgJu-L$#8a*c!(FyRB_?%KoIv9x$A;qwS`C;Q!cE{xNph ze`Kn%KO1_NQ{p32mH0OU>+EZ{_Fnx4ibAG;EV)+rO#J}m;Gte&kwNqA2G?8kq(=Br3e{8O1klozI94V_B zQzN^{zI*<=*kV5{*`lz8GYBIm9QF?PdIN>y0#)Y*CQb^B^^Wp-14Fz+0;2+h1H(s; z@(u}m1!1hUM|a+T6_)|o?}y1c3+x3tJSW?KZcR&XOOLPYeG(a_Yx zjXI~Xp{}XE$5=S6|IVq{!CZ&A*8qlB+hY_@Sf!^q=|8HcOLyv=Y13lL%3aL|m!pn0 z<(H=7d(g~St9`2)7%mEF&W{X4-LTtmVrg)idoKg6)y|xbN||sS-4qZOYUoc~!<9*%K*?OkID)zr|f;2ywH00x#^1|X^AO4uzQ|<*Z--LBV)R4bYo#VhOu-E-un#pON;Ywb z=I7#Nm9qWc<92qbXwbhEmyXuyD=U~@jhE9Mx(|Q~SM|gZrWfMHbhj>+Tq_b^VN=+G zOl-S0#mJ@`pn=Y`O{*{DPyhj1VD@aW#PP<9aaSBiX0cw%m5(5Lni~kM>_>Yf2JOjG z+>3kI62sez+2RTY|4;8nyqhbP`kuJ7nGbO1(Ac|KNifa6FnXeV$X%f280OHpbqvq- zl}tujUX_SJvj~TtMDN9?nrdTFvnE@RQS(s|)($ zTqw#TBrLs}^$uR@9O7DzQsNHM>glaH)pT!mJvCL6UQtmd4l(qT=&d<>pksv&Zp-#D z#mnh1DRfx9Nlig18|E@E5EK~@;j5^fc!*q#S}hy#@1c!cNlh_IY%F6a^i(sPB28rL z^zhR$(RDTHS(%Fr@PVu?_5d$-2e@laHC>ZkPp#EtRM7l#2r9sl*L}1rHOM6x!E|*tmIUhC`bdP+D}7Tp1j@NMcRyD9BL-)M`Tf& znkTDv5l?tj(DbMhw%E((;g3bf);qa{bYYWuT#%`tk*)dTzHB>b93`8^QB{zJ_{6*$ z9*V;Zwxq=qt84|k+hIwO+%s-0C7+F)G;Yi(Oit-uL04OpxpN11!At!1HfFH4pPm=>mr@q2|xnU@6lT-p_vTcXE&PXpn`qb#%+V@Pd6#AYXTr@vnINPG*-KSMXmg`;gw% zh{(c9Nv$oHhAA2deFAYE{FV9;O3VSmq&GHh3=PF`4EEY_g>~ctMwxW((Pyi6`f<`z z1K3fivZRqLM4x-Svg8kipr*1M;U2CdoWpf3XQ!i5LpO!Ldppo=w+@%{ystURU9*qu z)552UZ!!Nq!JFq6gziT|Gv8eNV)4;-J^8gXF#8_zwnTi!T%@wkOhBv$O7QS z{EH*Dlt*ks_}3NmugpW%RRjuQ^dXxv!8&AQx_r>bq5*!Fy8iHSvp3_|36dv9|dK%%F$i zmio5+J$5$oLTWv^Xs`@`x$3EF)G#;`>zbk14a%_%&4C`cRy`5#z)QE-<;Z<&;8WczlZ0U zbL(gAr!c)8?xA&9F~8XgQzr4I*!=p0eshfJ^)u$QG}q6Vql<8@^bd;^RrZNsQWnnuf1o4Y z6l-jnsadGD08F9;-+(E7f?w)$}X4YE_?S8hy>^{ys9Lzp6 z)Hwv!jiH${v%&q{zk3){elP~;Y+b2;hpr#}MYz%d32SfvNBYc$C{IK8Fs5wq7hz19 z#2IVj-1T?bVy{ftxAE>N`u8v6n)Xk`XUvJu*AwLYw%}rMH^ph)Nodqts(&V~Y5#_9 zaZPg?tcayKGxap&+7U|!=s9#j&q=h@x413quX+uK{WFu*5o?Y|XT;~XXCTYr5@kLI z=uZbq{YChHQ7UKNjJdJ;Cd--OKwTvRjsA36$eG{RFtZ`ke$Jx$#+E4mX>8C9C+5at zdJbS+3`{(PHwu3Ya($;CGQZghsG5_Q+h}dF!I=s}oTKooZs%ht6J0IGg^%w?IRvX)tA)6LW!C*B>o->=| zuXL@o+Gx<~+NRvUXghssQd2TtJByCOIE;Qi2WuZ~er+GOlHt@RcFSIfClEpdqIdyO zbAY64H3n(~b|Iwtz?9tk5Jgm-LRUNpslG5q$~UrG8S+6_p*ltGOjjbH`offNWR)`H zZ#s2@*1)w=%akD>>(pEAvc^!miG7pVL=)XCbmf`S(N6w{ALb=w3Z3u$nUgv7I5*{@ zZYf$8b-)DToqlUn(iSs7siph5M|b_UfJR1 z-H_gdD4m+0g4qb+8$@6})WS7dX*O93Sobc<#bC!3blqj{%6?-bpVV+X38m(p6>ni3 zy+NLikogC!8|3g{>MnQdTww8Z?!g^&K|W&_(LhEU38}vFoK||ehMmf$R1mi#sw!a| zBg@iz5WxprR5e)+9foDfkXJn0kbn>GAV5VUvT-mOfmvq16GuqbyCO@Bp+DVX4F4Gn z4r7vGC~eQWIP{e+Nc42_DNcuZC;X)S4#(xHkE}C>agz`j$h%28^twd#l?S@P_zWY) zr{nNp4R@)J>-ZMu?+Jb`1A{sSPBMn>`VfN=`gH}&gH>Od98{;sx^%AIo*^<^F87ic z$VZ6r%>2@kR{>M9!V~S?ddeOGq6`@m22FQDvZ%xq8uWhWVG4Ij5&W_|ork*+#fyl7 zsv)Bg!g4}#5F*=+p|Ws~^avZr>%XgD97c}@era7R^b8>#xf%oK?QpF-HII7-j(x{z$oAz zPZNv!bkpn7c`Sku?wWv5Jz-cTbb)Y*o;Opz?_wL~+4i76 z)Y>pne2B<)7!P?ROY7Opi@77a!5!J(xDQX)_sL%Nn9!@`KdES^k+(|;!y~>uytejyt74I8!=S zjIb%`3oudq+|PPur8*DyB8plDWz+o4D2x$%5H)WXBfP;F|Kq|L8+f59J%0<ng_e1qHEmAbh= zE6S}i2=e&Jr#Tq`bqeJ3WX!&izm{TU$PKAHGX2P-(9DNUZoo;{C(_68+nweiw-^Hu zQm4p2sQjbv@UNv!8FE`H4-wTD+VbcWSwT0ZJd#%#U&6=q*S$>`ObAwV@l&cLo z=ANzk%69KCyOL&{UTLhcRZ*xQV)w2UL`>RqJNh9XA7v4_i`9OK+=KSVNouyjTkeO@ z&=@JB<{ZG=bIX1uSZ*zw3ObN4=|p?ef2GC_kk8~%2M*QakU&Tq?mwHgkT#2vckKQsuKMYX#Ks&K+1{3R zi`Fn~7uklB;B`ZVdhI&K^!kRmjZJf!>gQ>C$d&d97hAWgWoZ1R?BMrv0&a0mjbAzTP z7P%o!osnlbq*~S)^@%fDnj2#_$Z%#L+a>GZ{>qvkkLzyrj|Hudy6A5 z7d9pur_YVeY>drq(D=94Cf~BV`wef2*RynwMEks!`sw_cV^2`A{%C5{6l%{*zA=Ap z>#RmiKIb?f=Vb8s7MobknK!essb0gJGjEndZcq!$YPZ#ik<^Q`HD4Dn7PQ7&^uT(# zve(|-#J9cm?028;KGw!#lYL32$4IdAD@QN8&gh+y829${Fv_Rep@AbxWUr@KTl+>3 zMTC#tHQt&`0^~Wf+o$r%C9N^|9Mo{9-I6k7mxqF%-{H_Bm$$1by%tc7jF;I{8WrA$2bCN=$C}<85!fH-o#c~8FW_!NEIP$wcR8WqP zD&!!xPmovlsTjdz5>hN*$A4;(snnn=-I3lhL0)q!Q8JRG^1W403w3J|FeZLicN|5D z>}NxI3#Yk7JHqqRucEmT5hUca3_>*BT`C=8kWn`l!jJP1kknFByxTymhd$8kQMQ+8 z_bWp0?i8yEC@!6g5U!<^yks;sq5>86!FcV&uu&-KJrn;ZM#CS)yF^lz^?$T|SX*Jw zBgY|v#uJIe@9UwhuEB-vCxcXh^sRx+CjxGamh9bFh8e#jPI?eso7TaP!$&B{?fnZ7 z#kZEV?i+Ipsq}kWe_8~-J$E}j+lbkK(MmyfP!D`1&b1EDwP`v({JW<>b|-Urgs$~1kY|&H*j&%RIxIf| zfoq9SM@`vign7W|kYkC;mQRHH(12XhRWj^Q4oa|BDLIA~E7H4Why~*PXb*|YJbB*OjS0$>P01 zBwnR*<>7fjzM%5N!A&Yx-k4VlnY(rwz;!T-h~iWH(oiFEA| zX@Gdi!b(o$4sD7HC+fk zqnFjx@Pymc7c5eW5aZ6j%%Br;Pge;!dPf$ODkYOjRJQH@dX2XRAWEU>Lp(@9*A6$3?9KLPn9S||LQ7R9!c`|>z)FYE$eCb19{(D zz;WHEaSysy+o2VH{Hm9HY1r1KtN4Jh)K&IY7WvRi-^Y!#C*{iP3GQpnLwTzU?Pk5T zvt_Nelz!h^%tqEQBqn61x0+wqrz*8*cry(@U>qgydUrcBy3=V1@}4muL%@0#+C4x% zVh`FE+EfJ8Xvn{kTU5Rdy9s$fM?EJMUg@aeEzVT^Tn&)#lex0opgX;nlDRZkU7pSp zx>yO|63L~(4w#wFQ~K{b`j$VKDMkT<>XazOkRiYzrDPT}2Qf3jU%mLNp1+3im&po? z7zR$xHL9%>x-?0`9gw|7lT!Q?u+OjP10AQq=WPGsi`)VKo6aDWl9xM622Ld@KnTIj_{+i!%L6V1Ugk|#dr9t1p7h6dRbp5K7TzuZruG zl1DmAEaT3{RdGI||3U%*ZOq08@HU=^oF*)TDGRq$z=!kMhhPop1Y4TyGi^sXUEJXU zb>2YUvFl)rW-OsotQEX(j=h3^9xx1(AjW-&szV^FXYT>6h)nrw?kZwl#>3uSykW2O z{(vYQUBOu56}1~t9)dF$5J9J>vOX)8^YY^j+=^%gk_gDWm>j%B=Ee2Dweos=gD|e}{w(v?N^=nMa{F4@0HOxmAo5!K z7P(b-xS9Lq5Q-B9JA#+GrS4qbJ&?g8EIj#6SJNt!|H{AtIWH(B-_NG`G$6}!>B2-o zzMQ>BK`zZL6DboR4lk{F2wbfngepM|qNc&lGGvMF^d^Lgrqy8@;cA=$>23A1T+YbV4eL(&ZIhXqPje$_uugjJ zXPmAT_B*$;IAkHG*LUd0x5y zAH*?c>X(Mk{>&HEudwxHZE`g5)p3;OZlOE7T zwz)+%IYll=^J2<|{M%C?gR7;ntIDMC~Xb`Ab`7}UBbQH@vh32o3qMJW|WGF2;c+- zS<_V__j&oc^=p7eRxUP*Petevm_CHC5h094pn{jlO@WN&D{O^fT3bL{*mo@1@*lIrv z%5Nk^If=O$39RLaHQVPndW?QTC;7VN@!;6etIJoqlW<=)pC9R615*;z$TjPDA4t}t z+~WT5$5nr?coHEQ)LS1eemXT0uT#`pyqP)f)9 z?L-W#>M?erL+o-0DjTMJ0DJ~>F9m%kioXGJMY>k2 zfXYF1Henct%7<-xRJL5lioMpuPZi^34%Pf2x6Lk2sl18+_&}ZvAB;o4=f6WKa$F7a zru3eS63tLb{@qcl;g^r;9vyO>x2$&Pq0oWe|J6Z`!Ak9h=q~E-M^R^UNt5~pjv9U$ zup2V3P$_xeYDv~)6{Ai;)~D^3-|*b`D=;oBwIZULTXYG}7nSOHrrr2bC>k@`5LoDid4+4cKQkU{z`WzD*2p2BF4P0RyazWMeaxIvdi=>s$#aWJ^q*Z*RJL5%yG$OPlPiz1Amp*u4f0S9UCl)xTU&#W zr*iZdC9#E+i!89tSGv++v<<)287<__J_C@DTbgs_?cT-kYXekI52M^IBKP&N2oqV` ztS4k=Z}JT(CeRA{=}HT6HY_Y}Yo_AEee9XM%BuKr?*?LZhhw}_@@)%e&|$t*Tg;bJ zc-zQ}1Oyi$fK#AR!mnHG^YBPAS1EaY-{LRp;@4Y6cQt;>4yL0HuMaO$Y%HZN&Wq>`~8^H(f7@H@`9%AomH0YTtcN}cXJ8hl5=_&Lu2}qT#8!}LIwOtRB+3t zzM@i?bAA_ZaNF3;HfWAVcT8L-_}mQ;u}=TyL%QSp!*6%%Ufb8+36C_#!2d9b+~(cqWIdhd2ekZIv-tA$p`vOdE!w>kn-wol)}+h}dyh9Q#8S!&gQ1;D6^ zN^VZ%c4P2$-(#$GeP3ei`J>=hx$^mZjl`YXw+2g z!mLliZaQb|VBV2@b0lt;yC=bN&fYE{;>I^UPfwd%(zlr1AH-_%#(aG_$%ekxk)6dO z8OAz&L~NbPG|Z(8{L}s*uAwNggZ4v1Fhp;mnrjz+d8cV1JpHBN`9Ef z3vb!MWgNV3yn;L(FA)+F*>YCjFr=$e+Jn+B%#ipY${t8iY_ZCa->$M{Mc=T*E46_Q zUvg_|TKPvC9qzmB7T@hcefw&>QLBL~Axq3^_2|Pv_|klMQ(! znWyhHzRT;=K~7b^Y}Q>%KfO=xm}~8m*ZT9VC23{KOzxG0JUf>&5s^FlSMw$gIJ~9u zd);bs<6;GYdS>yTou^Ix0u__d~Y zxD|eEpfD4`Uo`L8WH%4lt|KasL%FnQr=&f@yt61RrZ(rl7-Vsv%hk?Q`%Dc$zDzRR*m_}plN6qsm7lfC{Yo;XR+fKgT=c!^GK{`1w0<=2z zL9!dPd>4=CyT}hRGI(KFC|-!9OqI0c>Z{T*CC{|KJBz_c{?Sz;S4x3=NyHCw(fpVW z2IR*X&hUoc?}GGm7PU9l!IXce;&P#O{d6i-me2M6NT$yRhd3*>_yM=lbzncQrb^^a zU4a^WlUQlU-b3gY+7S(THoH~M>Nz0i8rl|0BEt+|L`uY$ap6V|KkgBWBz8|89G+a83lSw8lJbGDOLc=EkZrFU48dpee66EO#Q^(`ddMBZXT8ZW_&sh% z=xJVKXw+xYf08kL*EtYxG5nIcprTy*u7b30ft=e>E4#89j+1n|^l5-Bq?0yoxKZ#= zs;g&#De@*`i7uw{sa%(00V=`%Z33c_b00{Ng=9ftIpm-Q$WQIHawZyNemjG&EXV_! z^tt&}OIw=@~ErDczF)lO?Ehbad)khY=5swCG+TTs&m z6i3*6`tmLIu(RbQt{ejT{Lkf-dsiVqEo3|)ds?UoAztYCAX)i$m@K) z_;zi8e-`BW)?hh8sF)xh=a6ET_81qDRNOL{n-6gj%*U**Ep1BDjz;@l_)z7*HvDnB z0527u-Mbu5Vs!`1S>xmkCjAL{#Zyh3Re9y*1-ZNuofE#*DVU&0R~Lj|dF9TurYHW? zhpg{><&|v<$jr-zZ0=J`tB9u;a4P&rI=~EnA_FGNz2e!YrL+6%me@Gthq-oR%lqrb zzMC7=itg9oE(~@qk~MaNO3B4W8DaQ5N%@yAgL!YYi{x-~?scSHo+oWcm})jU$>mOR z!mvwI9ox|&9Fan5XM1?yuS;nzkmce%3zfDWk_2T`zLd)Kts_TI@GGhm_scW?y zxcra)SQ0JGjZL%uM^m~3L+~G(pW3lkzX={sS$%6uT)R4{Z;3S==kYWqT&o^$M!C;x zje#0@hOIry-(FYI&vnxxHn7ZA^)2y6{>W;y^%JvZIzMJOKk8fJGj*Bzmblg)soz69+v!^87?$sKE3EKZ6`Cz$ z`olG|LUVzgI`*xxGgIdS$|c4js!SNi$%gbEilgO6&k|~JoRg+j91)SXb@F$f9Wds| zANRn2@it}3%?zC(fANItA;}He*S;yY=^#NOi@j}ZW63Yt*kiR(y9fRYx0&PWA?Xe9 znR#MtGsod}_`WAU5)1gKvFAGw!ncfBARE#fkWeBoc!n7@)~!EWSto`eASpK?x^Z=C ziW102-UbD^isF4G@{xB9^Y)}lAUC9Qm6&b;dW|(E$VcAYWGH{;{ki+2JsfTaiwz&xN_uPMp>sejJa2hYbv5Ffo=0rgK^gb|HWlDiAHN zyKLi~qMD?03(+LANPl!~!AMk4O2ZrY9`8q%IO4@rI}T^cCa(_e$0d9r6+G^Q6HG}K zp1eSF0?nxin7=+jyy01r-ZJTU#sD`C+Y=7Y+Oks8g*X8frldcXthQNOCrhdj;R>>v zHiJ%Fvf5^`^C*e6tOoea7L2SQ{u@I`I&+ObTFbq&w>zrQdbRm_s%%pht1lH~X;%rB zR;X;*E5lHQ5vU@hXLfBN$xSPoQb|@i78^VJxNRNlv=xAPUq1XYe3i_MOR_|U7f3V+ zs_dD*3ery+KaWU9tz^|ezSI)nhY^u`(-+9juHdhsJ^6lijHdEUAA#9!R3ktOG6HjN z@&Zoe^F|nEKtb+J235AaXcQoXgo517ShByWhRj?mD3%WTh!_F?Z>YXVdd6&|;INAv zXLA{br{eamT2?3j)BM%g7a^%Q0_H^iVw2{O zW5{?mhU_|qtZzR|+N?>3+nfGD2#8~oE2TeldoZQndiFd&20;PJQ96=L@%)j*eat}> z=FU24&jWo;v%-G!Tk;_E$+B38@%VK&$lH!1=ZL_0a`DV~&FM!q~;FlvCV7|;&(|KeiNX=wOXRiDv2r1#N84jPEx^G=Q zUGQNj*JIQ+_@%l;QZey|<#%yO1t)M}+{t~=o?IEW%KVyoDCt}c^pOSd$?q~P@4FC( zv)MnENUBou!&1*?k--WFS+k;X(z{6Mge?cKALd$EPZvDG*;9wy}G* zV>V-QCo!wX!uq+EMUUy^<=AFH&R@5z*-}4!u5P`jU8JXL?9@}|WsIGA+H2g+*lC|6 z%h+k3q(qB`sHb%j37pX72Y>YH;II0oc3SM{1lye0SZxZ}qq1n1pzx{iYIN08-(O-C( zIC$oNdXr#-zwjo}ue&>sENf`peRyQ)W)c>p{hYoC6-T;n=iO8E@0p2~`tD91`gQX* z;rzDXW^p&gY28U^)SedlWxP%F>+WqLV@}rJF+J<=+LaC9oU`%V2FoW!w&jyzAXk9t z*-bIM_6IW|>bir-Cgd(4`pa@oVgJlzb;O!~>6{|lHbl#{w@)`J?GV?XEhm0!-hl&_N7x73A3ll(iGhlpHY)WG}rWofk7T@ zFVR{M49)NqLI{NsQ9WS{lXcnj5%FOgdH*lKuX>ttZ8nX;KWq!a7`+z(7!Oytn%cdu3Rw07{nmr{#!(}ddV_n zKptQTDyCh4fEs2TCO4bARi3=PD5!?X&E}W-cP)%V<=*rjWyoVJFBfK7q)dh_l6ARE zp7t<6^DyIjuhkIb>O~h=u-vP{Do-Bltdu`fRq{TnO1ki{_BC#8pH9e*%UB={~4TbH-t^M|N|hY8Y2Nsq$p`qM!xv^Sbq=nbw`jBe3fn zU|mq-G*4RUmAyh12|2y95q*B8(fl(;aF1N8RqjGCO1^V`jh6dU^pPQd_O6mmTzIbD zlH?QzfLF;C`0XyH-qRU_q_iasgQ#N}8tuQd9lBRhI_gHNShLmLE;sAjlbdr{Y6|(< zKX{vD8T*p&y)`i9oK%d-d%R6@wocydt${J|yA~c;`^sALnA_er;5~FKOrFZgvZo`L zu4|WOwaJeiLCAOd#G1>bM;IYGHYnMf0c-2yZZn@{^HPbZDwuL(8;!e$LB5t9%8-ww zKvhB3wpG&2uzb*i{u$qtR~B-~@5wH%=A_)BwRWEz!Q*D=Y0CQ^QSEub7^<}$i*`Yh zF?|^t^CY*Wh&`X8}+mkB;^{d41dn;;SO^^&ZkomxD2HT;3O2qLA9|^ z9zz$w2P%achwp+<+O|ke1L(nVH=T*5wurapJn1Zywz%{TV=k>i8?`QjF;3d{zy~^# zk%Lzu3d%$@(`6`*l;#+ucLOiC790*yOZb)y;e3Z+4Bxd95jcjMUarSEQOuKnYP z8>P7x(q|R#db0&lF?^j!tV9!9A=uZ{IC2W*0)zbpci)YMkWsQ2ZkrwQ;U7PMY^{@O{_F{Mu1}g#6yU z@7KKQ&gmX&-9|?f+=(JApL6~bN7JZ8)YtWq4MAH z;Pzg%93k_J3Y6AU^dwDrkbX6grajQ608LZGpzXW4To%#QmERGy*1hg_{9um(Iguhn zP;r=%ZN1TpGr4OmEG3|ZKtAh=s}lw(LoSnslN>ZLiaoa`O>z&i}lQd4eDZJ`V6sBx4SyJcEXhOCfS z9^|lUM2)~M`Qrt0*a}uR4kMFY@;}mc0);&PZ-K6Z{D*1RN%USG!qJGn#6=LHkkH8g z8BsZ9k5;S=piYu82~+&;rAt3y)+nN@XRQxzePmyH&xZ|*F5R72A zn|%0AcRaWJ$9P83WdOn44;UZ)2N+3v5azw`SF+RKfAm)Oq1&5|53O%Aa}Wa5yeb;0 zPf1D-_^_YF3C7lyhQdLYj5O z&LA&S6())!U2*tRcCGjx-7at037W$zsi3sQk(6Yv^X}~YyF1>!bl89hL^aGD13&J@ zSd^j^^n;K>;G{hj$KxK$*SK+#)a^l3@``D3QqP~mij90}*aPFxy$F~G!%tQ_?mA~ z#POJfgtWO0*Zs?FnEIdNI3pM)soFmrk1g8YGyM*f}?%wr|BmU`WfVTAqb2?Cn` zJ)hB|f2xM0D(54?O=3&+7Jp&2o|DjbLls<~h+CZ;hWH}?9mcG^S}dxs{)7GU-JGKx{3WW6`B0MaJs}|`{~J+q3Clq|!O9T%wldLkS9`0aX4GvYKz+q$YZJC%@fET^OK}{ z0OmsY^I={KKW$MG(v|B{bmzGc=3A?BE&N!nVY^TY*x1(;_6|Rf5R{~yl<27T0s42(Hb|f9k$iwK z8C7N%sK6?*uiTOetK@Ev9SmW{#TC+7D>-4Jw^1T+G|$ojJMzW5TMd%$wL*#kS?=9I z@=6wNXYYNg5do=)1skMK7{(O6M|&|Gi!@ZiFFo3%IWC=XNpNTQ%~2D$Q^;53OG|!X zC57UH^*iY4VR$Zf=j2)&-?0>f{lj63wSB^s8?dLdQtgS0dFPUPcVwPg6AiNyq&b32Dl87zK4J zU06O4u1^Ga)ASYrP$ZoX=_(N^maaI_uUqV#HG9WL@eP~o7cXb6JDO%Ac zy0OQe6N>mF#Ly#%NPDHD6|{4eJLwl{zN)Ai{Di7>{xrM*zxm-b%!Z$s_Sv`x$K8zr zR7tWDB9Ed<^@k~sCZ|~U!ehoZ)n6XdgqilL`6nYRvZ_KlONhN&x5z`Z^d-F8yiKaV zY)<7_WuNxesQ&U$Di2l6eNyK>;(R{tUC#>wvL!XeDzH_Tf6OWHsJ8|_`g;mV%d?PP z_i_C?$!QHAXqjO&$pf;RblO5*5|Xu>E3vn;RvEHKn&7*Qc0=b+BO+>UoTd@-)8V7j zV;20dGf$2ULr$=sCwmW#)mup3l#i6itz9L0qr4|gtg*I>TT~k@z9C^+f>Lu$-|e4~ znBc&#RIjq=$C}y6Rn#_yXR9z%cX#rU(`@U-Doj}z=Gy|Cqczu|v$*0h)iTWtL-$6r61F|OTKGk17 z?9kdROt>y9e1fEd#R%#fah$e2_rWh|x@MrQhkK!AJXR|_+`Nr2uW`@oZRpm+@^0~)1?T#)q31$ z?O`V${=+M@!BIIvb^6j^kQh3bcXh!%H@fv7v6+e!;RnM+lOa}sh<2K1(hAncElW}5 z5j@jV=pN7E`S^Lax4|d#YauRKE5Ntmr$w8XTxus%x;YuqGg|a|zu9JAowsIxsrt)1ZSH#ClpUTp z0mtKyqcDxULH(qda>XLO!~a1zARjO4wu7TMhr3j^n+?*VfoJ2NmK?{F%gu&~O5`7l zf-q|A7v`UALO$AeC>J{|u=;n4YWWG{7+G!Z=3rpT%0+qHj{jn9$cKxTW{yx4H+7o{ zQ&yWiLVsNphY{fs())O)Rq^^oJVNgE_IFcXBv&uu5n9G)i=FH=!xs^dwK_QhdD0W+ zT#lEE^%O7V%dYorw5tWC{L@n-tI`)BM4xP0DR#}GE7;KcR;OR?3#~QSx2(K>J9D+i z941$!gG%HpPFKX9E)BPQvB-ME>AI1;)ZcP~IO7CU&lefK52g3;Zoo1m*!!DixEUdu zfHN3bV1#(GJf^4Yp#Ab52Jese&}^w${WlWYF7m%%B9PerPa@r=#pgH2sUOiCn-Onr z_-_TB9vOc8zqB{wjQSa8)R#8bH~rVv{+AKaXK4MP|Jq-CVXV1+R%}#r%Z&KK|5nl& zzyXxk+!=Ao{r70>+GVfx@518$UAHa!izMZCYqLG(Hn#k)7Jfb#Zq(fR>9M*0t@r5% zWYcu-ct*Twe^d9rVgxzUm1x&toknS8rT+<}cymK+zf3g8U$@h0tgW%-jCg#`e{0Yw zJL`WA#6K(E5S!jQEAii&n-wR^$6`=@=G`BMYK9&C-rAiRH7BnPNztshwaM~rE%fF+H$JOavtV?l_Rp< zFmJ|Bw%7KP&A*ve2))(K{Q6n3`nhxCGor`*dU~TZwt3vaI-5Tl=h}A=Q`EfX`lead z^m*q|Vaw{UDb_MSK38j?d7B#bc(R=FMB_89)>;~EXX}afrWq|UD@2rcetlEp47Tk} zxcr5Ud`7*q!ts_^G~RNCJsn)=Xkvb2le2*|L{8iKqs3YJrg+n$#-@h&qC_;& z(mGuOrjOy=_$+s$IE$!r?RSg6F(cj_=MS&F-=Z;h*Vz#3TvvD2Igev>a-wloOa1iy z><>cHZ7y|T4YuR?-Cpsiz6lc6-lC0~E@|xsJshhMJHfSN)1|22YI&rWg$;?g4Mn{> zznMf`yxs~Z?wv8emEYO(X2hCWnw^zP%&%`s#H_*2o7vc=cNxoh>l5`&qpe>p@p+9i zqVwbW>efj!X2qlPoITHvMB}Xb87+-*YtuEvW;&-Q1DCz-?o9BTSCZXebG)_NJ!@JQ zFY`=YYQClU>m>u67YTFp$K04TPK_mK*15fzG`7HEJ#^N*Sc`RBXUuPV}5H(pT&<+nEiCOsg{+=O?DOJ3;@v49s9@Mtc)2b7nR>aVO4*wYks88I6gS_^jso zdAhZ^)a0FE&9f7#BAPg((aP03k>zsi^~}*rp;L5TR1ZXd+m}a_z?NuG_erwA+9%0Y z*v{dV!6vLDKC`vOUbT7k^Sia?ep)TLpLQ$WdDH8gn;Y%*t+#@9h&D;kZO@BYL*jGR z6mLpQciy^LGrHaLGpw7j=e$`n=GV`#8=KeIG_T&;Nb}r{KQGbPVYS>eeSYKoSd{75J69+2}HZHm{ow&~r;w5E7de15EHdcr#4@ouYc-$pEAUw3+_ z-2yFI7mPl*Gn-=;yovcSeTsYO+gw-a#Z9e|NvnbS88Pd46OXr&+=ccw$6A`(twf7Z ziB6Bx{$QUZVi3)-CTkRl*ol4;$Bw{mKn;ToY#sAABwKiG0>E1+ao^?7C zv6kqS<{zj*SYiO&p77SHiYeoXj|zqy7iX&Sn;NYBq2H6(+?n>&E}Ru>;g*SaM;Wzte>B!?UCWJ4EzONh2^)vZ zB8|ZgdfN|4z4KHVdX|}GSitJvee@=^AEmzg6KNjgSYY>a@S%fk(j>Ej{Ye&S8ief+ zXo^SeD>#d^hVCfWQP}S{qb06)Uq454zn?}<`O?maHzlkCB>Q{S`typIF}FUEuu$2a zyk0UR9H?(lLU4#hbMWV&Si&(L5c_yBImgq(7+xCE76Lg5G$QG!qSZO6*QgxnQHF%- z1zAr8I5TBF$^WUtO}SjQDYDVdRoi4h4H*BOfg+_xfhv-l7v?Iz{G~^YDuUd^56DwJ z7#pPwvS}eT@1|O@BWGV=*c$CS$63IrU(5NHwp;{v4RUnph97I^PNM*suHVt+0-VX) zNwM!Z`0<#Nxh9kO2_>zi%$)=OSR7Ab@}N?-7iUT=+kc6jnG!Uuzh)fu;*Owu`@WDd1qi5VkVuKPM}3=OZ&|dR z99F4@Un{Mf-%1;~mV+Ix<<6iB)p-nm=E&1M$GPbj7z5yUTt5uYq+hJlZ577yO!}qT zLA)I9bWD>e%F5~wm4Jl zK0_-e__a0xeIoXST&A4^PlJ5!(aw42aJAa5KuEjNF+Y%$E6pwsxg9>~wnWwAA@H-Q zrA||OJ!Mpv)lIdtDVj@|A5fjiHaPKAxJ@mQ0Xf$kYr8hf=U*|0A##KyN~o(x8SI_f zTR;FufNG`GtkB%o);ub$+h=l()8c4(hFf<$nW*LtYM@1sAfGHKWko}WjCx$%*K#ZITG7<~@} z7{Eik1+x)>QABOCI{3BFj5@oYQZLoopj%I{A&ALg762xlLDC$_%*Tls?6hAVb_%cA^mVY6Bwq6DLS(38YUO z{3oIYe$1dkxMWckz$lPbDy*Aw(0vGLcTRHpCMgcP=YNvh@Z-F45x|G=;Tm442c77Q zW2;jtEdTNj$O)95juSy0M?Yr6hbFosi-5r;iXhP`ki#e&o)%vKDWrs(IVQ`8Km|x@ zhm;~TS9?)tDV38d9dNduXoDkiq&|%i+VP;8^6EU$MK4+UAtWgdD*ZiO5mZQmn`HG= zNmf>JQXPecH7B`ky~Lqu=Y7bh8&^JX9O5KNR64;pJXLP-kNLh}9FEcID1I>tsMK&c z^6g(E5LG#l)-6h;M;U)E%q8DH=TYA2JTUX9htOGRjJB3@mp+KH%w>0qsSf(8q@}-#yn*Rl`jMoKMr$Xx}1+YvEs)kA(=QK($ zRT2CA@z~fq)pLqHRpaGqy&Y)4;Vj|sOy+v(uWFr@p1VOU?+8L#%vcwc;s!Z62+1qp zOdU^Gz6?4c%1$0-EkNDi`;>vJ?h+Rc6G*gAdawZ{T~=`l<`#u6kJL2m9S zuhjy$(+la_WEXOgJDzB*}x>x|0)N#mkU=e|@v~;ZA%K?;*EiIKBI!ojYMImdT zv=qna$gV{?v#yl3JS80VS?Qn}FBf`iRFx5am z+YP-+@hQ$rKKyhW)bSe6Nod!ZariM(^@hwWQR8JugLbF-Btyao%RCTnxGOkRGmwUoNbu{FKalbH=)x;DU%lT>ecSRct}JY27QdfipM<<2y58|x}@x6*m4 zOrGxw>enJ4A#;RmWH7Rqx`IWt_w93^9>=4498X!}c<}$japZR!hg_Gn3RRFNyLeTd zqI%2KHpBr$^~Q(%-BZTfI-N&F9YT98q5V)p3sa2sYLaY7Wp>hLX&aGJM<1fm#Jk3Q zX+4%Ng$wi5(emWDVT?>hWVr$Xo|%Wkc@nNvljMVLZJa6A$=8Zh5f{6x`-8nj4tRXl zI3>o5j;TdLv4A=!L8^{wy+b}_JTFTTz*#Ou@<+Sn@v=*ZL?MI<=hZCFWS&Daa1pMt zNgO|b&v=dDcq%fDXn@RQPz&0Ggg~RZ#-NO7keXUZFM^Sn!p}Lil2srbQ(%P$<-Z}6 zQH4c^?F>Ow6Q~6Jil+fmS1ZkVe29BDAgbL;=Ogqm9ai#0yxJAx&2Uyam(P^krSze= z*{GIxlJv85q?#lTBr~hCUbWelk>?^L6Kkz!nI<;Yv#fQi0ytT2>*{{T%k!!XQQ|Y5 zL9W^hDvSUP8hLAWzxY>m>+5;dhLGHpu7$j3y}g%o%Y8+)!8fD(!~1d4IxQS!0B@G6 z@p7d>bdc|Glo#bwI2z}YO>lY}qsA{Fc{wb));fx;O?W zX$A$c=_;Jc*unAcY<6-XLCI{yZMlu22o*^B|AAAaxs5HzR({RD*Yx? zC)9qEmHQ@ZX2=n`Pr8vifjtm!h@dew6#-fW-(7+7ZZEa!E$?Oq89>55l#d!^L^x$( zyWW2Cn)m;JO9l45*C6L6H7>OynYrDFOue1VlXXV1ypzlW?W6p9+g5@)s^-nyryJ8T zhhb3O;GQ6Q988WkWW*-r8;xl57;~2Qee3rob-PQ9u=Upelq`hx)-N@7%kSK`e(OwoLJoLYd1l!q z#>+?Ahp@LyWy$58Q`C6*TyLYtI&)!fqiQfJ+B*-Lr1jwe zhc&Y%lX;z!`G%9ZGn09{mFXvz`B8hG8ZXy^p68|^KTl=JNA3FjUxza5G7VxpLU~8x zNbOtRukGf1IMKOR>&~!;n2eW+T$j0X=2@k`H>9Vi z7RYO!GMEpmEP2f{3_hmZo{q_UchQE=w&87&vq(J=bqV2ggf2Ut-M{DwTeWUWe^r18 z9V7&hLc|!nOJ&Imo-kXyCr#GtL%&m5Qfzl}N}l%mx6B#r@HuWbYqjCz@20Ju3S-nR zgm6E6DH?XP&<$^Lq5GQXJTJZ$QolseN6?^wk2P6k zHcx1=Q=v_MH6SNIA1RtCm9=Ct`9g=uQM=j0sk{{>*^Y?O)51y1<91JNax|4~=}B?q zY*hf+jIe5xXW9#CYHF^=Bqly%wy8FGbWtHc9y5ojHptdR8&HZW1gOw!9Q!j$>C$BU zUIb1eHS7m}`(Yfm*D69cq&;?%eN47Z2UIU9$`GM;?un)Dwrj{AdFF@86d2*+$ff_E$p^c|cxN({`roGU8^-6Cpq`~y!LyIhmjeZFt?vo@`JJTO zt&r0yovpPq)6ilPUU$#t9-hdZXj-&y1rrj|x(TFOvaF4@rq%6#8ClsxCa5exF)Zjg?8~yA&sNarwEm@aVH`?-&Q=OmGD0fIcNv`#LnZvmhy?s(zh5gKL{T- zYNoOu=4kl-04n2#CXt$Oj#c?0yOV4=VnEIdry~l6;|gISk`{k1dND4qL-ZzGN^i6m zd3Panb&Dx7j3(d{5!D@-I#fd)d}Oa;1pgjSwxC(gO69xw?@`i1pBEhsdOVe7(Y9NLq2ay|I zG_e%^lj<-T0cok!Mi<(Dmh@ULi9(}DdhM>8CW$LnQzyM6SVu%*V&##jLR4-_Uojc- zZ<-N8&Zq@#%|g;^8!L`>D&EBIx`NtPWujY6{^2Qr^k~q)hUC0-4En_?mfMIz|HZ?= zYI0MWXnj5s<_X%(!%9B7w~-;kvB~S623emDN~%`=qJQpTl5wc4*T2G&u4U&PLFwI4 zHx0%R!EVSU>0l5y^LhMbXC(;yf7zMZ4Y@QO49e%8Fnx(8gA))MaRoL*QoL`B~b)pmH^7rLW$ z;*?e(|AYz}Ra#OFQ<7hi?@GQCrHG{O&qN3x>gzc~`JUa@@Qd8G9yJE!e0n;fL;}{S zu$*HQqe`6)IWtLiNfqgXy;i88*Sj{5IwPrx0b& zEVL3nyotm~Fvsw+Ita^*cf69`qlr&5M8_M=*6#pAe5eAsgLYN)MErbv9R5GT@1P4? zSK5H5^wXkW+?*vytcJAZNjAMvaToDn9s=KCIG(;$w0QGngix&!)bX7D(Yv@MNOKv5 z`X}h1gpA0LMo}XO$sG3qUUQkj_+zBE}Va|-k1Xr{el75%=eP%ZXChLu6i zh~-IF$y^nY7(s>{UM5`(w;#ZfM1{Hy zDGwo*Hp7@C?X14rsA0l6$r41=d)@#$J6gTxJ)J+sj+DVppM<4R5AztvA;s{k_q>qC z7|R791B4-leB%GUlqu^CK*<;BJ~wQ8iZ@w=?c!M_)gj~Z^hM_=3lf<9WTZc zDgQ|w&}aNq9_4YRTzAkF{1{%G(!oeml0yq~9#<~bBh`+MnN8+ zS=v+j)?%|GGub3uggDhgp;tOA?UHzTMndB7JS&iZzN?hqoY%1h8 zd601hr67{2sF3F%2 zub0U|$ik)2ZX~cAek1Q^8DFiz{t#nHlj|4kWK_wc=_y)SA;5(~z}zW;eGBSwk#M;u zoyVg>Jd2ESAFZG{>5$$9h>B4r-Ue$HrEhq`IcIOeW|`wUoEv^qX8nF75>txMhr0f; zdWxeJ2uZ3$vqi{$VsPxwa3YpTXRbpE?R45$>XpBH2JjlvLEz2m@q}Jw$*bOB2&tuB z$epR!p@$=|k&K=f7-37N-kXX`W3I}QkKKY-rDD#VQn${Aaj91`jIN>kr#n!lt8Q-( zBBJPW_jZI4z{8a6`$$pp5$1nSV4TX5T^(Ck?ObvyVXlP#qzbTd7O=31`>&xffg+Oo9*Crx0et8^}D zJl7(*{FcmEZm{M%f=iK@2x1DED{UWR6prTk>B)HE zQ<2aZhfI$-I7<1gb{D<)zH>D;r3?Az&mKMz6_Q<0B#Zb6+@3B(fI5+{dCCqgBFd(b z20sRN({;-3xme4^^7TCPPK^+@Pd&x>-EpAwm`G7`w_C{X zpc=#1yF{ga2km!z3~jZXiY zPQP6L{zU)&PM2A(%PiIDKkD?abozxleXUM^FI7ThQlz-FR7K?JRIchJ4{0T{zVe}` zTJ@4k(ra5)L|#k!m5|7P1lw~vcouzp6L#4 zfK0b&=)mK6k`IyUCo8;RL|OA29iXQlLouj9FB3Q^xn;dT}e8d(*Ay=k_)UF z8`6cUuY5rxW5TmCS;+?_y*;eSvlkIkedW)3TotvDMYSB~bNq(m?*|>9OjhVnkl)OTr%BI;m-~isQhlXp>538s!$8)rv`pp zqDkF0SIV(9Q}_+5aE~%w_(|y4`;dih+46hbhQDE1_L~pi#hRLl(4Qx@J^hdlSJiAy zrpgOs(Q!~@<}t3Jbmj3PmxEWx{Ggy%ZSX=Cr-GCcP#G?vXOPKqO{!433W@3#;b<Di&KSGjZ$6XJFCXBRAG@*c(=C({;@hvY2R>zYLHjDa(U&*ZBn2bAa8bA z`}b8L;+@ydAU@Ki|6N!~Ufr-gn)7D6N-n?8otkesPLfwf;SUID zUW#_mlMg?G%1Dp(yh;BCKQ{8!;(8PzG;0(oDk4mD`pF8Uhx4Vakbw#hCk#2okk(uj zQPC-&uSq{%WOdRQercsBk?Do-i@XX+mgr0=ptz9|zWH$^205Fk?oTen8z_b+il}|B zB2rhb5v7}3;FmrHk`X0iK^O3?lx33rkQn4J*S9*kXL;pd z>dzjF1zhyDE96-gmN?m=L~qF?klw}c5fTggnH3~Stud7VJQJshnwf5(gkbO|ee%=9w6nuBq)XX_quhw-)B z)A4M~?de$En1nd(dTir$0!LErrj;@66iPRU?hzLnJr26_3aQYY)5V>`M|;%n^g^!; z(86d2v!Yw35OHAAYP?#Fyj`4fS0uQ#TeU;AWTgQPz3L2>>R2&5#!$E5z3ny?El9li|AP#@R?sk&A#T}(qd!?d8 zO_JkkFqj{qN+Kl_K0*}=)M_u}p|nof>LK!MRDH*x=!{3wK`c{~Bsk2$Iy_IhjbGyB zWl?HtIH^hUqbGc#-rBwFYavtiaw0>Vs;A-8d`&)Ioq6Tj_mH2;wlyQkpB*KMJnmtH zFiLW&Aw7yAi`q%0a!a2HKYooGiIzZyll_-o3dv%K-F*0~;V*&@qv4b4O){!j9!Y-; zd6H^c57A}ZGn$N{(@l9GOuQ8Lb2IqL3#zN$$2Q?Kp6y zw>(W;V9BKtZb%+Ylc(s{%WNT?>%BzfDT@q?Swh5LME7fe}g)TDODPam=A$*u! zPq{Iv$_`FICfxhScgp^te%(4-h|nMRQ+E7 zXCi`o5kWy3Q8}oMUKJyljL3N~eIf=PzMEeQ(T^u3lRa^l^+3-VpaXrX2qO;OK{;WF4OP&IiB}+PUkziXt zt2VhfrBMxScV;17ztyV7i%9z$hiY_!?-h0N9rVKfsQ5+Z1pTeg7e!nVgidrGp~bJd z6ZF3J&{%^#N2-WilANN(%4bFm$9QQnSB;g=jTI2@3RGz)>|zwmkncTVS(>g@)8*Ta zLN!*FW;HT9gmXG_IbD0Q+Dw_BCkL-OK@F83leKCrWUrTWi#dan zrbU=M!E8|T?4x+m=J4mAju6&WXz82P_euoB`;jJuwQli~guF)s{IW1!PLho?Xip?d zP_WGOrTiriQE@>{hrHH7g~_py+p}u;y}ctBrz3(QrY+0jCh+50szr@F9)aJeq4HHK zPmPsJyel{{pQrMyiMh;sA0m?=MjMBGdnYfQ5Zm}zg~>s03F>vYDP1egK{ZtVo(ihz za(34REOQm(14DAc79A=*8`L4Pyfc>o{iarpl?_=9GON~UK@FAdsh}Dw=X=>3a5nBrZ9;%uzv?YR^6ijZ>q|dFWZQuy-Uk4!gN~}bynZ#U|BxVV`W8ln6x&i z(~v(Eer<_*TRRalUE_6xal#0hM@Xn@XAJp{cgVE}%mlS6LbM|a;TCQ| zG24#QBAp%#b8{*vX$~Atv@jqGNVHeOFX>t`*h4Tz>I;Aa<6h;~Wy7YQlky}{R6Xcr zgNUNL7|0G6qT4AARHw;?&Js0N-cV)gG|2kSTufGDWv41rqvVxEamuSmYX@+c8Y|D3 zHRDjl+vBSCJZtGbMj0oT+-Rm>46;{+We5fCKKRrqxqML`m-$nZNf8Dpmfr^@9jxYkyP6V~ zIi;e?XyirFT}V3O((fa#7ag18W&|X6J!CFvuG1j*ID>dGOV8xp9l83>yHt&pD=lT` z(Z$sAr7i?jD*~Vu7yVw#r>S-lMi~kJ`|c`j%b|<))8wKKuF}7)wlCxasj>277FTK0 z!e6Y?wjMRsBCT(;7wL`cGDJB2x3x_{gu{M|DNpebe%2mm!lfw2ay3*Rjlf;E`k)6T3IWKG;R!M=I6;k))e9@t zSov#@u>O4o8~9s~0$3hzL!!dn*ACX=(epU9aiThkIc2XQuHNJA_7;2;dJ8_*Zf(I! z+31C6fE-ohEFPmMQaTx;)nDb=XX6@a%5^ZI@(6T{eZShl^b-*sp z=F+Wg-Dl|{^0~LhI#&NMxne^h@3n1FW95eIGJd?tOi zXK^Y}1-Vfzk@q`!RsCWau2noFqhxh!pisKzn} zA?Yj;e|UmKgEF9+;q5G@lF06T*3y)I!w@>qV*aVkUd-pR^5yK8!1FKbP2)NA^lwWc?)eKl4-)oc26%RXy5 zR{qqpW}J2U9$aXj$ESNNu~IhE=RW6UTaPkCUg8@6xJaMJrDmBvk9!vJnL69#if>ui zZN<+viy^x@KHkrY>ud4stTpnJ_U`E00W4Ev1 zb&MZ3d5phEbYF5vdWt?uP3+(qzAu!W-P*!u@XelK1n?UikCl_D_U}XF4>+Fd{=vd_ zmcPCSU&acMX)?I`rkCL#L0U;@J9k)!DBuKgw5|EL$eE9?EFdrJHXmP^d`J2A=nc=C z_kjc#?S)=7ngys&4I1j3LfJPoR^>`dqj z`ubjBwt7P%uRG2#MwVpNsIl@&b`39Yqd}b}|5`|Z$3iac(Znu3)2&+P^O7F=e6CHm zJ2&d$Pu->Xj!Qx2yzW5?P=z`6f8wRLc_Kn5BZ8+$?Mb7nB~<>I+s5UL62&&2Qb9Q< zF@?`)uNrDnsvu->A}+&g;3IT9dzC>_c`7KkCW7!Y>HS{e2`5Wdm_=XF(|2R9VjMn^ z-+xPNve3ZQy{h^B*F-K=f>ah{NxD`AWv_?EbsMQp_}g5L`)w&h6^q`UEadlg!_uze z{(ZVfgH}b-ul8##Q`r0MJvb{$RrceIRIL>EVC487Qb+Klp^L?iYU9h!rR8Qf20a^l`Fk# zxQWeMoi5713u&KoEc;i3#|05Spnp#hds^w0tG&fIp9*G}s4uIOQ*(_|bBugRqca=} zdE2{Q4V4YvGBrjX%_^fH%rDoq*FtVeEgeEy(agum+*L-dHPhwa+x?G`GdV&r%G6MK zO4!0fU4^G0%IErFDIiwcl?NZFhe0nVNAi~FM|qK@c{N6!@|3~HqzBS*HAc318W1Xn zJeE@|TUra@M~opRt^fr~&%$T)u|V+r;DVqRhyYxp0r*>2q3S0$=?+dnfGG4|JO#*O zA2;hh-n0AIkW(zL>ps?I8eW`fSo>Szezp;5p4n=xSK_DqSs1I#%O}>)wqH-tlgn+1!Ot>KxXkU0m9h;UM{8dWe3{f@(`i9u2&v}QRMr`>JmhMe5?TKJ^z8iXAE zxw@a+Df*dH#OZn2VyFGZTa5(d6;BNYV>BX!;l*T$8Y&MO1;3}NwU*6mQtgrCT8mIt z1(02y0$!)ow;Dq=yb}1h#rv*MS@Lc&SB;Ttj4}k6_K}|4t5`(y!enM8^x3p5YB$lAPjQYD3W5+q67);tp-H4*Ysa;=4u z-fb-5_lp{g+l{7oD){+wQZLj7W4(CSPdHvpl$VkuQXrd*u$m~3C5hqh(}$#~#WE4{ zYI2X;GzP1Q@**3PJB+4<$1#6TGTQNsOIX!CR_8zVuXgo3snl zysaCxrCvlEe!X>y#0f;y+1y(_71q5rMqU$rt@*ifG^OFpF7Ym%2tE+DTEK1mj;-m*Ehh48)MrKqm^jMJi3TJzLIxxM>je4-~@PX^3`t;xPL zxzw7Ge_4~gQcw0jjiy`mgj~V-f&9Z*f9pgwQ7*G*`U}dGIKq%K!aBnp;Vw&{qeTX9 zc$(B0xh-9&hRQ3R0{95 zssRY#WHnT#vz^gpr>kOlHaW%WZoN?h9aXIF5^1JZ>rhA?%N@RJ#lC4?Cdpj!C7}=}Jm?ypW>dUi|*Sh?rlbznAigCs$jJ%k}3@+jf zcl?i=1JqFYNAEIraz%3BnIl0xgivJoxCfDhwaS z(I%}F0qKendkol!fS+;De2}baZV*y5Q{f+p>&V`kB1SbEgAb)Ry#*(+2T4?tDwnxD zO$>eKupzc)yTE_lLn{>ds20X~{(MoM3@%e+yqnCm9-3P<-YnwFHw@UG_oxnrJtf@ zi}X|Uy%|Q)QIIo}OW~I@h0NgqUnA|jAYXp$%9XQ(2=0hd_$HAy_47Ez$Y)}>FnVj9 z2>HA<&$^RW=9KaKU#+>bF<6a(T$B^0Mq!We1ZfMZiSkoxP>qo#IbrD+X339Rxu*6* zbWsjxn0M&6t)z;^K+ex8({Io>y54y?O{}zwACR-GwtLgp3tcqz;mh_d^W?i8P6z+) z-obL+0WA)wK2 zuw+xE>K1Rcyp>vt{QN_XmG3)CRkkpC%=K$zC!M zheLkwltGrI3&+7PrXhC4q9HhzIyin_npA?~ zm2`CxCgYfue}ow13KYSAQfZNP4a$3~Xox)ASt45$-xWbYK4fFMP+syBV5% z0b4rw1+7k7Dy3%`Nq`XiMI&`*e8wjqgTNf*7Y!+uA3928NtT{3#n+7pOZ`}AtF4VA zdu70y{)`;mVxqS8(s)HXzLE~+H46wE98a@tda`w(JDAVBoPR{9#^opKaV5=_IMM$|(WR{z zTu*a^8Y<5k!_+9bKbflq>LCmPO>?uVAzmsRYNra5C5!%OBw4GnMXVWF8ive`lCygFy$sMja-eRc$bG{q1(&i zU)jCX$@4rvPh>ZtLo&!u3AKKJQeg1+0T`nFY*U#2bv+L4x>5+5z!7@^Dz-PiYO}vz~4s#`Z5u2p>R}PzQOti|S?E z8h$J;8b^)jx22tkNl2AYUY8|D4pSxad(yC%DLMnAqxBNHB`{Vn!-e?v(bz#L_4Hq2+7C-$Zvx@+Omb_ z=A+7_R{=t@C0$5AU&N4POS)aR^O%PXowRR5V<4~Q@XMOKG~422^(6xorc++clnYLg_NAS|_dwNEsL*&QC{cK9v1$)#$jylT)r zT^-~OeN{ZTTrVMKdJ=q-aLFJ?xUS%ell-|1X5jcs}K0mb(J{JChM#?Pw_<}s=FU5X}hU@@Ns=Su}NJ-uFpr{!T5$ z$f6cV6PJgM(vE;n+b5ii!JrmCS@J&VTPjdql8~!ivokZHg$w zmp*K*T-^v4-tRTM(z{GLg1o&7hRJVp^=!=2Jc#4aV{lRr7~tW8ntt~&-jYd>x%@#QbDICW`yQm zM}2RT!4x%LhX8i45KSTT5o$%0Zs$(hg(xEw>&Md^hmbi`d+o|c=o3jUm8@dv$djxx zN+GQ>{SYGg2sU7TN^mApb%GqAC}r zT+&X-a{-Ke*`;>tL^-c>JEAZa(Ql9O>+jikk=4@MYK_X3Te>%XozwVVoyPy_HhxWe zEkbPkaQVz>{4%TYgl@cKx1O{RcQ8T|5R&j7Y?k}exz1)BUgR#oTHXT~hp`Bp3pysG zBa4tED;Ge_9gMG^r)`Zx#;?9Zf(KB9RtMZja(6nO*|K__mv?RYFI$!x}&i&d^XsZlsFb_mh^Ih9x@>0IYt zUsG(uI8a{adUDdlyP}RaD;4Vll!ks}gw;T~G+Dxr&$JFeKn;Xknj{bIN+XOAKmVDe zr`SoP!fI8%#_9*kYZ{-tr4O~CD5D(+d3HgbqzLdMeaI4Kmq#Fg>)~VWiwoMVWxA&i z)f@&w{s`&-cQvmi!{bP8@Dn(^=x~j``?S0FQShMvKFYCV zYOVYDjdfS$8M3JnxQ!4m^>Q74Na=N0=A|x%UWe~fK^jgxm72ot9%9G^Vt>4G?@GQa zN0zC9^faupWK%Lv4U|6{^o092GNgZ-%PKDz)s(ytcskjtzzEho%wE?&PElE$$bll% z4>^ovF`Z`&ghcZ|ql1uqnW9F~#d@QBkqpWzZ&;I|a)~$0coP3g(ICdEP3$K8~sVc%(Tma#+)l=ITmXE{y2^-xiCAmsdXA!pzl4+m|n*|~Jv_c76Q z`O!1Xuq|cF1Mbv)%&DXFH%tDU%2NX&o4jERhMbnm;q6K3w6ndOnBA#dHBinWm4zcA zBg$CfFR4QK)j-H@51r7+QN&;;L2h&X{EVK9x&EulFi7P@dI|j8Iv^*gN`U zyytCDlVqvu31FbSFKy~*xoBJgoBwxsiaJ^@7&lDymJg1fLbaCb$7?^MI~~XRHS$oH z2-2Hspp4OmJiI(Ya9_sqQg_@JssTAK(5j9zc1(jBDCK&`Z1oIdZ<8t!VNU4|Yxh)c zCpUzz3ef;^e|E#~A8Ad84flNF>O<=RxC8Ymy@%7b`r zX4T?2_>r&II!kXjzg0qmah}SOtzCI?G##tua)REL8tCIcNAJA>!+5B0t{NzfwK3Ac zpae`h;|S3YuY0AAcUR&CMTQ=E_>>*`xOcX7wYzuY!-{)nCk>$>m!wO0$qErjUWxQN zcs~5R8A9aMzwIeN6?f&CT^Dc}f0k;8*642 zShVAv$vi9lHKPWNEp%L`CdrlV6**9zQ{0s|mFjEja5@w+654&m8~W zND#j7RDqUqM5yvW$HM^}OB+Bkm~7~FW}thT(3MIaO{PBWqLIx&$SMiL2VUNjic~3yZt8a6d5{1f)k83pi_M1U2VZ4he&HP&{eUzsXV{yFlx= z6RNLLYpKvB*$u3-uuvT$52tfEm{-aCK!rL)Zchi9@H$5i`C~gmIFU!Lwbm%JMzT1R z8OcR-l7eILI=D(9Y_6E(6dPV)7du4yQeZR=H<7XDTFhJPe`kk+V*4 zLE28Tklao32*~E4aP2N4*GC{^wNgPs+0uA(b!4|@TKIr0WVUdEipV)s{jhkB$wD!T z)gkg_vJi*zvgg3BllF|uny?GS=T;kj?0_CAR_Z?8qFXaXuhayrgOFH+9Gqma`W!d9uHY*rB=5LpkOd@lv$RDf>KWN&925xl8$b6$l{ zzB*8DKjwaNpxi+p!6$z`P;MUU?hq2#`|0-x=DvQQx_;)qc%a;0v)^Y9lslevw;rh9 z$34v6e4xtD>g;M@YU2iy0_M5u)O$X}xJ)M2+folI0iwXVJV zKz;Al*=HW8_L*Kz%WmTUyJWeSO>s31Y?+2=Vt2O7=4b@sUjsI5EH-Bh_9cI*0lgI#~=J-`}Y zYH$nu<3F=4KhswmU&1FJ{AadxkF3?T-|-$`3*4%+w;!nXT{`>u17-io;P!j!K-rJz z+K(Qn?{elq*vgsBjJll;)R6d_tt=2)oR&Y1h$u2%!5);UUA zo|$&~V0qucbWF)20pfGS-Gk+IGMA772y9--XIC z4v`TR6`=N!Z(;=z3Gz43rGVD{ua=1w6%`dz)g<}M!`^79Fj)TOS)sDzXAe>C!L;{@ z(<`5JEJYC#Ft28pan4VOn)){GT7HH*kQ<55kop`@#`^OrEt0Z~q~&0l_%8C#C9Y=& zl3A0f$UvwGl#=v)sT({iybTn2t8ms5&LM~@Cvb(!`aqVRxmH&Lf1ksoBSD+kLRx=Ekb@r>Y2 zPUBd67O{+j_|o&JTlgODim55OHx(m12od^GdNmc~{M_SR!NN!ER)b{b8cv4N0y_z9pjpa;(u93Okv)Snx9Hm}5ura)#omBWILyjpJHyZ)@O;E-ZOGODT zflnL!5`QyAtwD$ic-o#h0y#QdBDEzlBuqC2N%B@=kY6=0%9^)k9E8#%bCv2VCk54D zy6*|l1(_t@6{GlE>C|BriV!j@%0W&VU2A$*=;_^>s^sSrUXn*uYOrieaiG@JMX`>~ zRirvdqud@1CDKtMC&p!T7<9WB(Dn?b^jM;@MA>_iMw2j(*rl?_2^V8S5d)0 zZbhXSOMxm$H#v3*kyO=7?$L-bnURBG94hyu_Amny4`P{|L2A_X6kFHi?xyuJAm;_F zgW0dn3Oamws*-2KTXrh6gy1&s3R}||gE8F-+5MWgObwO$QhC4EJOhdlxyyDZuTY~Q zFGw*gJLDtOV7alY4O-mXKPU6LyT2U_ zxyD<@YM-zguZ={n&~}z4n<-1gD`xd-T!nc*8GSFP8mn`z!X6-)l*RnNt3DSD?LU(g#jE>S~?MR zD6K<8E8H(Dt)Q#b2%;y_7sX)Gs4lOme39G1lh&K-2i3fI@W@RqMIeu%J*bxDCkf3} zCl|(#UGR^l^-G|frB6OybBS4pTs{7!%uI7%==;#&^47Jv9sbob00Ep%zpNQWZ6|w( z&_0Ta%vq4Zyy}KP=EM*(=OP~w9E1NKYySe?RF&?J;2l)F-$g}KykGEw z3SR!tXYFLSbIzReJ?D4+&pa~C-fOS*u6M2VuJ`^@NNLo=# z%G5h74shrWe#vOVD)#%EsY|^eqf6!IzfjHVnoc1S&HDwet!lj;moo>hBvl^1RZ*#z zjhvdJQL11hwDsAyMyi(j)Tun&r2H~erl>GJ=?F_b8(*t*x6I>^oDyYs} zMKxIdJ~afd*rGg#mE?!n5$sFGCO+^vir;d07=+Xq~`2bIdE{ zaS2ivt&PJ>B*7fK3wqrp-94W?#A>SaB-UAqBJv!y@7X)Yc9GTfXO4lnaRy(=&{A=x zhG+|qVbXwxo@RS;$QPcfkIi*$L{^dr`C6iQ&*tSZ7ALTSbKaTY>nfFpdv*R?%*m<# zfBJ^ebMQa-hBcGV{5?^_>)fbj&kM5yW1mD%ZB-+1yOSQsd1AQn>1;B%uzT5ZrEVD% zO^@Fe+7e$$n0rt#FUL#YFVg6*W@q;8V&^v$Dyij-=ek z+^G-1gR}Jkc-*NEz{XUQJ^@eJiS%W>A5+?;Et0(;xAb(o%}FyYYr4d#usZTMN};lj zAF;gLs9x7em_A@S1XMjEfrZiV`dkYUuyNc zqz^OrjKHCE(zqht4wor3s?oESjs?>sewG%~$-(|Wl4Pc(rlRqIk%Er! zDDC9L?cfnjJAa%VW{ z2G$Ozpqq#whgk6G2_OLY(=HvTwLgFdcRLQ5yu0G4>Sf3NhJVbj9!EAQPpzMZhxZIl0 z1GxipKNmbTyT*wJoFT#EJi@#!xCZ{;RUR&J)=uW(-Z_(pdy-(iTB7psi6g|P@6KdE z=p?LHjWWS}EJ@mem$sMapN+Ddx&{U%#d+DpNnK15{58pYn9KzMJGaSMfPR$`)HT(a-A>azSEQ&GcM~U+`ySkm1_cxB( z(?lD!)S2o*gahT%@VO5A^Ji$T)65 z*taSN*3EQ@_P~81H$fcVJ=4YczMR{|Uw4?lUd`>IsB@C4#24E0i>jMET-~>8!U9!^ z*Jim?kyhH|;mW>jI+hGzR2AU<*)DvNqMy^bE>(a(kUJ&wy34Et-j~ko1%jDPDu9Qz z6GxA``>cO;cW)|EdAK{bS_QCurd#FVKAvqAz%w)T)?1(Jr6c?^`rZ0mubj=F+w{+W z@Ex|zBs%ZQt{jn_xJJTktgf@+Hn|gSl+$!GzsTFXi&1 zFq?f|DYPqhi%*A48|!seIFh;u+CGM}@vlt&<@`e(_sEY#Kd#JWdOU~VtC{4VF3;5* z*kCe03$=r6T#%-(q4BmI_I($E=Y6UY8(O)S&Heq19*8c{PHyv?^wy_uTby^i;IV#DaZWDR zO22w_on5fMJuLIt??Okdrt0RgT|)NZEiMN?#HzmJ76fm$x=5UQxYDbgnk)U>$_|!? z>zs`yS9yafU`RI})Phb#=U&F$Iyp}Sl`&(K$<=MSF+)uMr}ytonf7^jt*?1sI}e&H z_4HkoS{cOqI?Gsg_q2VR7mt+6$r7y4%G)9Vx`du-^oxi}IhM_KiHD?H@Tv26rZ1uT zfi6awWYG=X*3i%AnnRcJMnXrg%GTXIjpp{xTy|AzlHi5eYgHaE3I5PY--uhm15Pqs z5j6?V%nqB3(gqW)PtP{@(?TxLJp?j&AuNn`z8Pj#3yfx78jp%R^zXhCc}2KHPP$(n-gU^iXN3j&-)iR zN5PPgpuSEbA&zD6v@pYx^VSMU^Rivis=b-sF+wU23(W*@duM5p9Siz|*klV2yWo+& zA*q)*1`sJ5)g-((i_Fqv<~I*zzIoLA=3?`keSMiVIxTUTOTG!8wJhcAuj?1p{O6D7 zGi9LWy%!$vjj%3yJrDkZR<|n0GqzeB&`7T8bhosis8I$f2UezCs$B58t(HAq)7L9L zIp%C$zK6lHkC)n$=kq$x6Fhjp5-|nU$Iq`Z@&3R8QHi8*>I#9kmSphmF?82g4qQ4T z^VRp(QL;^r3&For`drgL;10mq-icf?s{zDi3r2Tta&H+>9(48iD6ZyU4o4!)&$m zPX&Vgpq{!vE*t0Ovpu8z_zh9s_`Jo2oiZ8wJ7Oexf=}XgsuCMp*d5I(dARd{E;Sh2 zv=|%TrNxGSO8-{oWH6Vah#5omg?)-`Ge5v6PJj| z!e=N;_iYx`i~r?Qmif8ue7F1$LzsTjpa&VaB$)pvS~QrW;6FiskuKkrc9#n4{uue> zB3c=XX_0^}w_6b1XhIa16O{uu&Zsfh>BIia@Z=mQaT!h~qMkD9T!{+`c4G>SgpA%I zlOLDiQm^ag>quR4(|_c*NoKey)%KZsDJH!YoF3DJLyYm%mflNg_6doYl|T6hfsAPR zLY(v{=KuYL(vuP49E|(yJPmO=@x~eVI?&t|JMXk+v!Am$M&fdTs>IdjbDNo$=NAWd zO;!QCaXy*9&J2^e?ttlZ#-EY-`HYThFuZ$}1NUVgZtqVQ=snq=m-kPoO6=1;_quyO zJus>Qf+x<)boJ1IBw8n`N?fd)nn3J3uq&l1u}42LzxJp+e0w0tArAaTRpP7jdSG5W zfSg4US?PtU60i08j6!|afT(ydEvA+KlxMgk#S)P@Ja%Q{Q~_R`@jvBv^YGLGUP{`i zr?EwEV5_uJ;W`V!4-OcZs}T$%sw(kfFL3YH;69)#@lY00YS9ODNhC!zr8sZlo{+d) zqa4_Mew)g}^#{~W)>7eo!7NvgR-o`6Ys61EBDL-GcPy4T%fM}JeutP7Y#HEZpQ;h} zH*5A1PY%%4$sTBK7N6PXi2+g7h|SF_n5%|VcYs$_;>KQ(f1n{BCV$obs6}*W^hi)B zw|Xc#aM3R8nUmoC0oty7RZky+Zw7S9+45JWlhyclq@)cDliU(ye}NFi0=EDO3UT=JHaWxcsRYZc%lTU z*MN#P(5IvK7_}VZg0vgI+c-uQelf>Dr{zc6-7|`5o6?${>(efCV!Lfb4|DsclmpAs zF7Xlik8RXPT}ciGU)wm9BF4W9jb|%%U`MX|}%~Yz35F%*HG{s~f+} z#?(=El(2Sydp5b1<%p_s?CaFwDi@)Ez3%U1LikC7i?E3RVqa&CV453$VqzC=C@20< zz@3`HBo@OS;Ai>B0Z~k6j?GJvU@zb6l8(+i>UWBZnWTuWGgIlhOipSlId+e*V)1g8 zqU9$aYA^4pY7#C+RP>_@%@DZ#Mge0kG?!a0_^ne@E}Ujzc+36PI?gj_9MmB)a-{fl z2niE1B?1B+J4}msIj*o1yEmm>!dQTE+IDNraE}Pt$t^a&fbm*FH-j{*oxvtbbC&Mhm))H0@zV00(drtxK1Phl4+FTQ5}t z`*fzWn4(=zg3_QIcqkQ6dsZY|bZ@)=!d3k4xA zF-~zyi@Yd4`4dL?MF&kzDiO4iG$Fi$G@rP-g|#u+)91D>>QyP`d(3|gW!~|&2d&XJ zVqosFGJf|HXQt~5D+hi|@wjKkFAIrhJew@YcKxgEC2UOhz_ZPk0cbY);m~#n(m`v+U;R z(=Yg27?lCRF;s^bN05z)(EB`-xns^lnb{4-qoi>miOVYaBPYNdrV(=KAEoGzP;AD0 z6P0mUX0n3sI;)j~Dr$+d;q_@|;KVdHcMS%HI0q-QQ1Ec-Kj{7xM0?Y5G8HYZEOWi( zVGD?lZ3AB@@hu_5}tN9fRq%5um|I5&EK2&6o3f zy+j|z9aDRSzVw(dhB6G1XEIK?VU1!=o56y&wTGbd3yHfmTWt(6h0ary10!fI9W015 zQHn#H_!D(tg9WF$$vsZfh$He?_ZAiI9+twk#hRWbx5~j(FX!d(9Blsieuw*;iqZW*>v*xwb$|o{aPL(R<6?7X3E@NgL-qF>LoukZm*Z<4A z5A?gQNlGP7e+#KL>HaHrFQ;`!s)h`lRLMf|2#Y%HkhmlzF2_H!ze*l6;2K;lv> zal?m}{ephAIMbccCE@rr;*$krqf-ob8;oz5w(2!og7lpA#;cnoOor4+GlX%viAu_z zV~Hlp00D^{i?iwkf1nSWM?CaRV;G8ld$dH3VBjL0*|+JiUT5cL5*dk(I-s%QWSXdl z%4Dtb(aXq}f0<&vpv>T`?{RwQe$v9UuIem72{93KjewqX+>h62{hVGkstS15x2>s= zR-UI8Z77*aJ!mmSmL_cor;)`pm`;`m+e{BLqKTMj8ACxfB9l+lPDSTfqS(%-EI=MN z$TR75SKLgz6eo@>n`~wtdNf(Wm3zqW3klaUso-3hw>@N1$T?fBj^5{WBD!MseOcc| zl5{En3{v$~l9X0ei5qm3H967|_$t(85}LQim8kxLuC!YX#?OprOuMC;PB}U|-%*^H zFk4N3%ug>OQ2T9^1(s!pQiJgkGXSX(;>6an5T3L7xetjHh9nLa>>AgsDsizj{9x=b zy6|@kD_gc%lbJ_ypGh4;n^CF6Uz9@84wB>~f=I<0D#i*r!%_w9lM<)%3u#v2mmkThYdYaXT$l zGF5!~zZ6%?%;Dw}4Dw3QiPHmPdH9F$?_|kX8AokSy&T6QLHetT@M@=vs91pnn(CNI zU{*5@j$%gO1UUR0@zqpV4aPI}s80AuC6jjJAE1}gA=r`(vxEB$UMkKv_*n0WmK8|P zyIAURo=cpAWKdSZDBNx#^(7+pSf*#FRrweaVn3$^=>PbmEvg1%5idm=66^^%Q)t`& zLPv;2T!z=&ZaaHA`;vZ~l;$ttX+BKiVa`zE?7%Nmsc7exO%bEBV=x*qaJt|uccq}L z8l82#Kkw~qRu1GBptx2I#;1lKf8?chaoR=M8Nb;0_-7l9>lc~N)L`t_K20M{(sp5b zsTz#mY;>t`2(IaDQiJgcYNe6_MST4Fc6$_^b%I?st?0`MNd)_tBe>M7!r0asvu3+k&-NR0wl^cnsrJ=V zU6yQCgYl~2N3K`mXm!gNmS)kDU6Y;cYvyEc|36Lk3~~Ad&)PKJKJ2KofZMHsTW$jP z0iqemp6cWx+>U<-*=wDdWmp5<-K(Adhh@lwoxUzrcrR5W!&Mmbl0CS4!{AO?lhixq z6QdXIUe()V*}uizhgsY$H*xpD{|R@PSjU53B{-o?R`yacylfGGpVUC@INC7QvZvTy zvEKfQf&aCmPEWH(99kLV5oel%_1{g^`BPNoa=&eKWL4)+wl6Y;_R9?lme1H~sii(3 zO0Mfa>g5Nc8?|G3eU6i$tdbT@_*%%aM&xwmz>}RW?APSr0fQxSoXkhpsNMV+pdXR# zrx1))SuozVz__)&O%29dj*vuDe_Y+EIlM0!Ij+iaeX@o??>1_+S>fh(y@2mJ$RyRv zm@&G%=rm@eqnj0*E^+9@erZgMr7){U=zPsW<0aZJN(WtB+L6`kjlkz2>h&f_J$qR+ zp2xYAxA70U4R7PY_|m}~i&;}w`Ri7n*9h57-RB(L-mJ>OyM3NSrK(XY-IvomJh~u7 z?+M&6PV4GFI3~e+eYvTn|L7P$e_cP$MPBFQW4ie3TJzT@$1uUjr(W^nT^d+`IF|6iw4Ujp3OQlOZaw6GDO@cmWU;3uPbY_J4q*vR0 zOpAzQFGc^HH>?S7;)K-*Ts%6Y24mm&Iwn%^NjXK|j?7jNT!X0GpepftJjU zrXfV9TRE^gyJ~Mbq5`RA!nC>KQB!=He?o~=$tpDhw~Q`e;5X+!jq+Yv z4aS?}sbqk&5%yX&0^b~M;W$P-{`WZ6`0v57DSRwCfzmK_2%OTko+=gvZRN?w=AU1&0*lN8i6$i1AI&-_EAT*1PSFDgLkX>@F@o^AW&3j z9H+~m`UL5DqD6+21lTG;8Cxbn8Ku>T9+|8T$6}+FTTaV->ToPEGNRk3$$)a;g*G=` zFb~JAP6j3o7JQI&s}Y!I(BjQ;56896YN_I$`^>gmg6eR=HR+ed!^W>B-QvMt!^mso z)X?Y!=GIjWiCs$Slw9ppKVcZ@`w z=o1no2+17&QX%2rty1qiM=qprGe+vwQoG=p_8Rl7KjdiC4<2jRhh~#w&0_KCC-0El zU}fh0TkS3xNqrA@MMWtyQ>B9+w3S+b(2C8ZM91RnF!G}~ zBP=+$S|V}=znfNqKh~0yl?V>?QYI3E=4 ziRSX-LARZI)9x&5J?8^!$~X5JDB9EQ#spIv4#p=r)$}u04zNIEL~u)*m)eI+cu2N) zSt5{W<3tc<9mkV;iHca965{%8ybxyn@hOB-ETUjp8(Ek=Yf}BFm*k zD#VF%=bY{bbcvpK;v&S-^P%u?A5C!0jt zs2iYd1#U_cIzJPq$E89!u%!2Bdu^d2iBFM8ns|A7HZlBsPM5YBMKC?gIKXql_=C<} zg>+2fnC`|wI?vW6vzb!@#aczQjhNR(JE^j2sh}}-AZ^~9?gVC)DrXY*7j02onhxW8 z+7VW#^=jN^EmCze$19C;eKEBOjU>lCc9uDxT08KwTy0aQZ|C~cBrs}$tTc7~AIxOn z$W~hcPSqk`AF?CPs~E4#8Lra!x~5MQrA~f1o!7gCrjrvTHxX`VY0->%UD76yyGz{YD&*4f^TLu zbF)6_B)`}TZC_YudxWX#ndUhn&MNWAMDdXdN|78bM~Y{J6r-=d2rU79cL#Nn!^z@v zOSkxR@tKH33blfeyPEC-jN5JypFGA~SzP)o$e z>nagObGRG>qZrgk$p!^c(E)?~qEb)Gq#7mI(-~9wc)vYhR_`KZoXxCpg9Y<2mn}Z+ zbg_OW=JgNJaeowkoDop@SkRx&EBrN&jjw{Arqlm0qEE-ms!_PeRJkk!C6C3rbPiSV z5$1=$8UG3>4oduoZi=R}Mnjw&WCW8fEYA7H!s3hlD3+D!(gV9PT{ASLLVR-NSVmuD zl3LpKSl_(gkMIA$vUkiqr!?@Jw31J`WG=yL%}{3!TqgacDAW+ROREj*;EeQo}8@iGVnnGLCxH7j3mNNEn<#J4g=WlkZIQ3U$^< zd^(5M5lNOYn2t2(nySnXXYDcHFY6N(hJhNLm@{jCM!%^=^40yQ{G8AGolKjkskMOtSIsBuR1a?nlw!OsStZs!lM2xwZD9A33X=sD&yMTEhT(!qG3d zUW~u&6}t3B#Ce27(Aqq%4t;CU8W!~TQWx$V%mm`j_j|PQJAbn9@?3vi@hUDSnu%%e zo7HS)THZu0?(7m`_vr-rzt{SP^0?JHsJ!(Ho=&*&H`cWgT`oiODub&3WsAGbQZvgW zBv@zHC*+<)4fpVKIez8GJ?vQUP2U7-v*=AaSnwP8Zgnej?F|;Z(YIFlaYL(HWZKd&hsX-GA2G{c3La$?X2~oFytB*JQT)XE_OO zk|l{ct}Q;zNyu}$Xd44w;*#Ra%Mvl=$HkrVaK5HtU-#vG5!ZKZHWOL*J`2NNaOcrS z>V4+GEfrr!h0q1RLh6M#z;cN=Spoz?18uA)GGfmDOdo!HPWKL;85|g*v!OFRGULI4 z^J9i5!(jfBZ7*14A1IjULV%lTnBbHE?;$x>A{gSu=_LYBx5cYdEz9W*eWGQro?#(S6=1gF5TkAWC=^6-DYsly`FSS6&>#*_*+cH@r^C2{8*6= zYjKZi;)vifRV@+h>1dP1W==B7!S9W(6%TF0gyP2WT8;7k=vwnv6LrYDM^lO?qjTMO z7eD!UbnW3>8n(H1ygT!Vzpfu&Bk^GpIhDhmP5&me(SeVgrbjz^dDIA89;_}$Dy;mt zYJ3>UdCd5HzJ=wTzgt*-NMjk#+DW!>Un+p-?cR|xv;udhO7N_Gy5OHo0-(8KUhEg-De7nBMq5e%*#rgIVnW#R?e^CWVDU>G$a{q)9c zt-(5)T1F;NLtP+_m@cSx$r;Qegpo9zjHgJA6a`ikQFoJ5p#0DgU(~%Q2R`j^DLrZ-K-^4Tf)OdCLU*6n#w}Mg8NC@gX9?bds^zHn4xiuoONjUQgoP& z3l8ok`%l#@c|~$0EfR5Sdv}DRo=qjYU*M{pjK-KwhA$D+#^i?{LSGJR$e%f6sd(g6 z<-lV}g8#6g!GDxL1e*-f3Vj|im&=f%_68r=*GP~O$g)&GMl%$I8mDB5@?)Lh=l#Mh zr~N}S;pH}E4SJo^U^-{G$f&~nq$oi4$MM&-w^1~Zu=6{B4?Q$b-%&*+bHbWJr6n2tn=a^U+;0?`FM z@9+3Sun2ydeuE3)kMdx6#a1hxY14tJ*_G+CrSPL%_*XLm+E2?`nXIz zj{BsN@qtDr(QILkg@{eGZZK;wk^!1yP3^X+ZXcxlxZOdCrj>z=6{-@C=t-F)+~VL3 zOsDYS;ycbfB0?*jlNYSs0Vz`oNKj1_G_vJt?Nt5o z(3mirJRahW;>RW2HK_lg=!^MYlO7I7NO2)F735BB~3Ca{MG=;PZbTkQOH(_?2%E#53A=qz^ z3JzW`ajo`eNP%+|`7&NNCrZ71Lnnfcm+30RgfvG;)iKN`--X9gH3jNpJ1%T<@qQvP z783B)jI5M;@>_ByKR$b{)M?SMUKUKD{-c5*6i%1==j3$p$rnP2o<(sZ`jTUck77Zx z31jCWIZrMk%|JT#FIwt32U^&?IcH$*GL?^)%?e?rSnC%&WRSUgG3Amx{=CahsrDtN z{Z)S4X`in01uv(XBsk&-<;NZNE?FmoR6brvX_@DKdjhEv6~{aD)Kz}mrM|%cFE0RU zkZ1}~yV2<$CoS3ue8jO5Y!y~_^va-f&^!+V5@@c&fG#xax)mK^`jTHIK1`=vyCua~ zK@QxL!~Y;_QqSp0jl!3m0h(d00=RGnD0R){T5@d4QZf5D)PgOB}YCPhT2_wZfgmQ^bJbFPQ`hVO8cT+R9 zMkwi{Er#?4nU5A1<;g)=PnU*2Sdi;v5~t8`vr?wY0`Z+r`g=lyyda+DaeslM5%b#X zu*cCzqh6{G$uJ{KkEc-hXlIG?<6$(KKf=AHz1LAIrRHPaJDcE@`cZnajrU-79gM~( z(sfAE-9<;~I7dp5qLt9D!>W>1l(%XqB^OJO7IY6%&11(xx^R9SRMZJafiPd2R#l^o z$8&-N{}q33;;&0!bW5B%s45e24Kj|0CWE-CnVr0yh+9v097saY*2L{RA7{C;>b!RFdBu`{5XYDL0bUgC*=|&pH+OEXZKVQF8rg_#jDPNxt{}!?=_Cx z%WQ~(bhvcn$dMzpI-1}GnJaG%H7S4nRqCG?Co?D-Wxq;&ns;SAoj~g4ZVBpw20kX5 zkz@39%3En_(>`U+F%s8rjKh9pS6y~$MU2FcIJ1d7K>6{y3h}7k*%@Q|H?h^!Q@qgL#7fhS z5KSm?oEO%5O77mVOr;GK;%@nAb{($fy5#W8YY>g{s(Wi6W~=2O6X6>-vuYn zQ~7w9PX&)ULXxILFkT{)SIwpQoqm@|s=6*sG))#?Mj__M*Eu1U#M4{qcsLR&f(sH9 z-}dG-st7JixQU8gIb?ct{8ro?|L)GPtW5_>4=3AqS zXJ-Nys{(x6!P35TbwAgoxxI+c?~eaBFC8O{S2HQU_Afa{>a|QC5#w$Q?;c0uVDYI=znP2h&rk7}&W<;ABA~?51a2St; z6Aqp$=dL3K(*iiykAuCm-I6#_4fU0P7I&7p?B~bdTyScH=v{|dVL=~1H&OXyPHayq zfO+XKu|{-V!D-DTo9JS72|UzcB1Zob ztWNSL-efOYqwJHNFhUg)DWY3Fis=DfrOO>u(E}K5ZWz_5i3yITwfF(466PLk9i#DX zOv37p{k+$(n^|1-z+V}gNW)VMt-Qk8e%~0=`SeoKYo=JZy`z~bH7@LH%5Od~gX9^6 ze5XB|0X8l{PViz!6nCX#^12Ml%CWXT^`P}W$}q}-YdQjK{jI9SUI#_lUuWr!G6%KH zdiWjJm)F{*?QUZ0m3B9q-%F1L{@&i}H)goe-!DZKg7abmm!DR0Myxnb6wd@Hj3FJv z%oq--mU@{WRazu@s?&`zZW`(0v@x>tZ=i*d%R5VOlpj?kGEyr>aYCJ*{CA*Au83+Q z<^!j{0BeTP+>B)4I{s0?)Ix&Gx%NB@&EQj{jW0kU1!HtMkBE@ zvyJq$HI~In_Ypl<`CSI)wosQeS$ro`N2(cw2u)UGtoh%{6jD^x4mu=zjLMJf>ELp* z{-sn0-rnI76LI8$9Qa3@-U8e7rE*(`3yV|wq&+RQrOJWz=Idwl>s1}P?OUo=g>gZ9 zouH63Qn16(NW9+C?v}9{sc)OP58rDKbA~rL{4#Wm#^@&&)xXxE-FQE4?}fZ(6~^y2 z-WcmL(RPyrZ-T{g!qPkaAsL&6?D_$tv6tIs`KX>Lugn>k+d`MOBIUqiZ8Y9+xgVBq zicCM&N7`7ziO)6*vrFWWIw}V?S#2Mc#&M?Bwk;+rC1?yX?G`(G4YOWjR&?3d_uJN@ zkcIZx={`qDh7#w^})HMF$Zh*s17VbrTadvgzuyCi<|0)&6 zRtshKn<#s#H_HB(RcZ;@2Sy{qZ>Tq86eZ_;wT9q2JNBrk3>ky-tZi5r=t1d+M5%<1 zmL~t-KbM)CtUghi( z;jBvG^p^^z#o+Q@BBRLSCNwxJa|jMPOO7m~vV}6&NC~n~444H?a8i>_or{rCs(oly z?ME%Aaio@d%vd#ywK$EPNB6+?W1oTI(Hh*%3AcDOjvmXQ3UNb1-+IsMAOB3$nBir* z!QMWs%FU&|jn!)Ov)6NKDda4|f&QGmDbsmUqy)8H_kv67h_#tp%qkLJ?pgjXD|s$J4D zUS>-~CKOYp>!fL3$6M!`N3XE7=fmsz(#p)uc-?GHTzi@+2d*`@#3yuK6S}RCXD%kb z=dtnav$NOR2hMI1b#%tW!{k=8H531dGfEXV+2W)1@LBV#t*mG4hcwXaZtpB}>`VG^ z>>o_Fq^nQu;mm`4tay-YX0wZ}Q7`DztvS3eXK8-?(mv5K!YngJfTOh#OIe##uK{1M z2Hcey@J2o0`?Fk`#p>2eTx^Z_?X2uPuj$iWB&?(9z^+-O?t&F`FOcj;OT~6zmv98v}F{%krD>`%H>00&k}mEJr{a{ZTR4P0D2DvZ@LdtIsb=kiK@dZwGj*srr= ze;=l{V>R}!S=kHq`#zfdUpkBAU-M}Hi(ndy{4dREBmh(w_JK^vbJ)-HzO*s!v`nxd%}dcC_{~Ni=rY0Fbn`If!2WEDMGQe^04CDS zekamyzc?41ETv+M+9xeCOX31&w;F;~D3CaNxT3R0$0z$_xpLseY)AK|n};X|p6~fx zf(DmzU{ChR<>_XNB!w-w-=)k;!^24ucQ%caGMO*Vht)8_RVmlv(G8~y;{?hCd+pR! zIU&1+_0b|)e)LFC$c0iqsn0x#%Tz*br*4PGPqRr9m(%EB9hb=X>^3Ys-h$!=(4bK! z<*E`tCEdy_^*{_FDmRv@5g5+!;FYQjwP6}ZS}H9<-_y%oy?Xh$rx#qOBl0HFFrsZg zWrCe{KdJCkX;35ZQduZPHm+Cs#4_9w4N!1p!H8X*VSaNH=wknIVh&Ee+VRfah!rm-i=8eEJA=l3sm@_3X9UIlskDXJ1T zX`2_#Y-QLD27OIamAI&9a)J-^wY`t>qv%_uL!HR8`pr%nqE;ujYH)%Ki1o>08Q+u6ZA(w14IGJQg7sLM)DW;H z3PHT0^Buuzlkni5$n`>Pwx+$|;mhc>&Ta`DY6I ze$gWQLQ{k%F)=0hh5t^1S7lh~=#nb5m+*>qW%D3(S6UN#jj(Dq%E`EonQrnaJ9s;6-~iKkLF0sn=WQNbzBW7bmYhP7>nd*T1(1q@D-U z5mHoXf2BPH$^^^tJGG`%^=}+2^#uLGPJ(`Oib!}*gZ`vMG;4ddy2g%;?Ey1D^fH6y z$7}3@Z<920`&1boCjw02Eiz^SuP(AXU8)juJ62>6QivaIQEB1ma~=D*Mo`p<1qF|H z&J#^z)`L$<1=~9Vstorb!Cdw#h^Mnu3p# zCh#F#`!=&lPJ!Mre2m#K-L6kT5gW`j8}uc&%0ilGp{KDE{R;#$T!K8Z(@wO}*c?H9 zEGz65o@fE~69MB*={%A>ax)>}))`{r_`1VQax7S^5-KkEvV%)_o${ApMv0(5*}gJ~ zAA!Os>ceupL}UyV7ZW5{h}=f{+@BK$PZp~AoH1o1C8A!j3w~~^G5ek`-^ic1!w#2q z64dX0YHQ;=ESI^$kr-W_7|Go_!%exr|8$99upfG!L)ZTwcSSm?bo zS$z1Tm*r|Tp`rC@q^>B6&Kg1mW4emt-VS~52%b|386?MwPl{C>>pDtQ8MZ6`U?#y9 zA9Hf1!eR9BG7!eaCqA6eL*-iQt`!GtO!mWUwR%l{7X50-4&Ul>(VY& zh>vZQriM$LpRG(YMN*;QEn7mB;X|SNuC$bNgZA8(o_zS_f3_gJmHEY05YHq6=BfH; z4!QMB?Jgdv%TfUj%tX^Z?KAa4J9ouB3^ElYW5y9Csov7l;X3EQ+(C2(p;o3y6=F>r zndGligmu5QD4+66C5R2AZ`wi0vTm-MAYeZH0+Zqp;ZL6U=e668Y5@IsDG%f)R0 zPMj(}TJENjOKju%{V3XJX+fKdaIY|h&DsE-wiTdnNN`8WEqLAT#R)t;C}R?;VyO~D zXlp#KRvzY$J5qFDpysn!1+hktUWnbc5Ig-`xC%cc+>@z2^zqRg!Zkyu$GJ8^*`iSJ zy{(aSn5DDX48&0;Ce7D||rmE-JwvScWf56&JIRuHG zKQs-Zwnk9yk~erH?IfGa_}6E)C8M?SfmwlhA4*6DaThK$QNLdNastzm#Q&Jp+cm^3 z5Ps+Z!HI|4>i(ZF)Co>9VOXbY8TsUDiExMhJbMGzKxc}_J2t-tN=&G*MM4<0gm7uF z3b7-V*=(QYOy}O*ndsS@SF`F9r*exvW^X09({Ii3OOWWlED;cFrOu?&t;%qhJ|){` zv(5d?o!%NdULt?Y-Ud4-TT{KF&p=g(?b;vCJOp|m(V3a_J@$J}NVi~L_vo=N_}9T6 z)Pp^w2YbTFSi;imvKF3V4Md}FFte=Jw9Wf3P`X%$3i<@Ycz~FU3$tBPCDR0N+X@6L z(_t~gTNo%>C8Lj!plGC;I2HWImEO&jK3^hPkaqTfbYrd#d-BQK)X|qRLlZ6FsN>Cu z;eNqsE`gV1J*HL5PKx_ZW>jyfG=`hBW#_5Z6z|UVNBh6oAF2s2{C@gh3+)U@n0)Fw&#YJbeS1= zBSO}ZH=oKCCvKj(NPo(MS|)fiw~?Q%n5jwUySbrb;V3{yU8zKH^_d<6 zc*{00cUc*&H#oCda2VO1plZN0H4|V6{^CN)1%oC?6nk+Be+qvW(JID2=t$(`>G23ojp?Uvmi=)#evEjJmlhdE*V&J>N`i`t0PX@S zr0!3;q>8;ASdDjVQHXc48i7lD^%h27s%j>3WU74PGDrn*tr4xjq;T(~C*@5R@Glrz z#~c(gF4u@pZWNz%h)0~gEfCau z(@jMZ69$)(i^9t~mb!ux7*o^1s9hjFx(<10>0oeG0KaK=kKn+*LkpJ?Ia>z~n4Z3; zDF+TLkO=#qy@I*XxR=+ZN|fV|DlkzzGRxF}7FKg_3F_OVkjqbg8H1Q-<$Y3QGGcM6 zLUd3%`Yusrm`NV%j+D#n{UbX`b}LQz*qn^10OlGYeHj^tG5NB-C>UI#RbiRT*5zke zxYeq#W2ID_cq|zcu-G^5O7g_?!k6HmrjP&iDLSkN1ox)bYOFnCc(FO@7CdiM(_4e| zJSY{zq($f?FrN>|Em4c&tB|0~ClMM1XMsc(NrYySE==Wls;5pmLtN)fwE+AM19Lw= zl>nY3CE^`^s#I|?Zc3BEc_&GeR6um`^&k>2p9Vx#Sa4M`Y}(}lf@h783gaJ1w+i5S zBPzJZ9u+=Mh0zjY>$#~FDuBxkzp(s8kdJ;!ZkBp}y}-=u^JCIQ#-C*4ztmd)R~FxZ zV12p{=Z3M>-WU*8xy1llZ|-A^h6>^6{drQLtw~ zwF%Vj=_OKCCQ}8c22kv$PZ^v4m40Kpk^u|~anMypNJ^C-ZzNs#*9g0S6v&&sVn}(z zXJSbG*xgpbuNUiRr7x2ue6u^JOMHC#UV90Oy`*b)ugb^n0R;`_i}$C~8+heGQ58T} za|yxuZU7U#YAkj&mq-P6+q&^VDu8S4jrcqjR{1zRtOC%u_ri$2qZ11+dM=2+{omLMniZ%<=bS$L9llWoyh1PRGHp zFv(*+*7L824`TYUfM__Y@Rx0ZQYH+}7rdLBkhtK{RyTIoLeioFa5+{tG5yP=5T>889jAeAE_6@JxJ}GPjk=$CYVf^Cf$= z;42+o1*3~Gi3brUpG{{JWxn8=gO+fnpG^zO$gEb8eYupcuMD(x`enEUdbRFgUKN;_Go zi4wuwR2aY7yH!5k;4Ln=!yYPKK(*3I5^0kPxr7wvrA`e3y6sWbfLA-4+53|^ke1t) zz{1XQIxMr*AlTSWPcd>`PdXA3VN3=eueBb(!c0xVtQ-0GOlSfNh~dSOw*3;p7s+PM zEWxTk@N|p*_7dyc9~@oOhvAGSYA&a-AQ5lvvC4tFwDBV#cpq!@J*C}OpH0?LBYJ(3 zR3(5L9eypSF7I?nTq{O3JA)OD=n$2UhqB=O2~QB5b8*VNi*WutoH0+3T1xI7=aXfL zP@C$cQNsw+Y)aNDEKIcRWQ`@Gg%4Yp7AlS}k~Jnnb(MB2ouKk@g+2vePj^d@r$GM{ zd_BG73K=7R#jaGdrp~>O5%#CT+~Hp-lA(9o$!fG}e|fyGrkls`#tx>PT9$p<$YJ%v z3FbYrzLUi1S=3797~U&)baE~zWN2nUu#VRiUg{*BUyrDuEsWP~(H=0qH>$BF8ICd6 z2*013YEl7wm$|BZ^g_Ya$*@UfzcBBrtNw3ym7@`&{Z_6@>$CbVzzEhQ!xAsTbDCJu ze4_&Ry}gczn&T*t2@OK&%_CEg;?(DK=vTk1%&RfxS=pRibh5-%K7PsxvA$=QIfGw# zu}QbNk;akOltm>{$^t=ur6> zL;4s>C_ipa^3O+&F2NMa+0JD&{)f1QBGiO31Tq~n4l_CXIc;N1;UXWu_8XYHOoH-+ z>CxS)88b?wI@L;K9Jgh^T8T)!q7{E9*X6OeuJ-?b^kVDC^b)|Q8ROA061-X8W|dgo z;mWe~c+=6vdC+AnLU#SiPQIfxAb=MgT`)u0dZdM(j$akV!uWAr2Up-@)ku4SpNR>U zcCfJ5|MOn^N%3C0PHWx+*sXZ4VTb)CmEUu%-FBW!B9C+1+zqb^;04++Bq>38PJ)ZI zf5a+%tep7Ls3ntu#mTTtAY<+tYlSW~UB#GZ(}_#kT^3LJs&+xVvt3KnFFB$(v|5vgr`x$Nuch~#&e7#l zVSKHWXg!VV6*n{LK}>pEN^TmU|rtMBOx96Su|DvS@?+N|mS zuBSh*UAv0}@TfUo6~+_Uxjtylm5yblrX2oXvfcmLS8#$Z#v8ypMk7w@F&JH7t;-8J z1MzbQ1*!cR9~b=Ys4kMEz@U`(dOPLy+a0xZ@Or78499&AIw}69U(9vXB2_{Ufnx;8 z5@DLTqz;gB=27(9rn43X1REXxtoCqAcJv6k>`c>nq|nr~fZ-rTv_hBCnii2kMn9A2 z6wb|n8^Lu{CkTv?Al)3IT_>X{n<7D3MFrL53W)@ux}X{{qoiF5DjOkKkxRKmXTUC;j7wHu+qU9B6X9Qb$Ipbt#^D?1H#AH6sv+Rw9 z7g^B!qM<3%A=4U76%sl2a4l|Ay|qvxL*%py@eP%6bOCOsjIH%bDQZL{B0u!f*V!(% z`dypR42aH?CE7J|7YZWwiSpxXTch~o)ND+(4xeoeFy`jsbd8xU z;(cxG8Yvz=y)o@petc*PsR&l48PmB{=Ql{1um3T=NsSOZoy}kn5o{Rm&OG9;e~hm= zMdI4;w<4WQ7^XcFB7)EC(KOpWIJ&x=lE$4Ukk9?!TIQab9e^tnASwHY~7u*=G!tppM5HMM`4fk5ISP z5QYkhtdH2}-~Yd#Kt+l848uGwTY5&lneIJhl%cg-hptd07(fUnPUFc@m0EZy(z>e% zmV+0i-eF{M7cw8IR&DXFjNn=@(>^`UoljCts4DS_<)Rb89Wt3%!qp|T}{W2>{?I}JUbe3<=&F+mZ* zb9zt5D{xQR{OTE-_1Tu5&%WembSTp}#Okyj@J*YSngEbMZ@(_A%zXQbtvU;3VV4Ev zk6bLFLr$0&d4Rg`QVBN6I0?#Itt@FpU3GSgZt3}Qz9K88Q|expT@PYTMer>vv}c&c z&AD?az!&*d1lP@EtoygRwYj+8fFknexz!Sv(NZOt%tgRRf3d`6q|mRGHAi{J1G`lO z7tO4Lt_c*cG;%XrZ;>^dC4}i18BLFo-!#8O;>pwlSP6x<* z+6$bY(Ip<4$o+zxO{x-aC0!~X&-WwADH1$)ewaPnb3hk+cyngm5p>-Cg9*o+%Pcr< zARJOEcS&&KWMP`1LF5Bl2zunNGDd$U7YaadFxuEyBcF`CNb@)%bg_d|EziWCrxN?Mwhb!;w$$K+9gfz#=y_H7yrNh!$6$MT#XT+sCM}SVRs%wyS)6=ZMm&CBr*zxyl0U0Ro0hA_%w2$0AiL zEozcDu{6a=er*piSmKJ5D=Tb1(it{ctbD;`j;IRb`*t_mECqnY!Rh)pYTpb&=qpMsl8C5nY0-6fF&Rv{UN2FzsS5Z%CBd0-sFf`c|;< z_Z?KPUaA^pxN_jG&Jw9t`PhuPa57M1ZwK{L3)K=#)%CDA9pQY?pRZr*(ETn|wHV^p zr}+{}U_$C59^z!9(hBJZdo9ft&HX;wvovABjY*C(&tilx%r3?+s#*pyS$&5tLQIhV zx16y2MIt7qRv3Q5^lp+{Mz0fYG8*wvnjTq$vYXJh)Y^oX?h`%hK^D&++)W$kMBrnePIjGz3bHMw)!_4o65EvBd)tRR#8TN|G`ae*Y5KnKP2 zU1<=URw7BJ6c8T^*}N@7%^x>Rl9W!1>4V|L%#tx<;fSIm+<;^qav9cx0zXc!qj$Fc zA}G#P;u$i9;cn*zFsxB1{seW3qU932^GzYg7m)~LI%D{a#>b`T7^#=PvQnbnKD;aP zab*sbYaWS^x_{6X$S@H3xHX54cu4PIRiKw~9^p6~heXjFJ_5;R7;|xMo4`wD<$M*! zi)}sU^b(7V}taqvHj zNF@CWRX#p78dW8pZp$1J+OJeTHs(Ynf-{+E0JCBjO9V4rM%27z8kSkR;}b>)9ZQv< zF$&m6j$w9;ZZz4jDcf?Z?U!sz?U-Ok$2)YiPg2G@kb0eEQZ0pYyNqG>SZSdDRfe6J z)6>C1=fK<+x;zc{l1z{1RX<*q$spqp6R@2qyE2FLpNZ9=Q{Zk|%!`U)kjB zeUYMT1e32)kDL-ZQTud|9iAo8!F>p=fW2DBbBmh}6!WvPT=xyuwAMJaPlHEL;vFfz z(WN-0WQ6Wk^FABR;h#XG44Nhnibo?J2T&7@8Fcvr6PfDTM;?jbT({s*hBEz)!a1qq zSGt&_4`(#-1rxP+7}&wt3r-Kq{6lEQ_hpq#wwo-_=Jp|I!&rMxd;ZlU?Nmy9PPBR`jMs z4Nv-`IgR2|qXkdRT1)kApJ-8$1bJdM&#tph%$7b;xl-Oxl~|kL*3$<}u&&P%I2r}* zb=1;3yyPcYu1fWTOFvz8XBYOo8viIqwMmkT6f?owKt(wfWe?pcnK_ zptV`MmAuX#C+cD=5h*HCmH2+PH9o%TvqU_9)A?uW*>J8zZi%e2_nHie2 zXBIVUJ}%V%_KsEgxJOuI9~Ww2AtLx76_)vQ(3I^m$nsiVWt~q3vn^wacGgSQzT%8G zX`$_8?aZ(`6yMkiR6aiFQ!B&eINFFxq?nUENytuch{q5rVqwWQW|Ez{EjL8aU!SRY zlBDjM-ZeQj zLz%V^eUV#>rHL>;q3-{Oj%GoZT7zp6RF|W7USYxIIkjXEBu{XGEWz(>Zt-D`Bm{HX z+a!qJ9SJ!``7wVMouBgsKlQ05LBD_=5rSJ7zQM=uJG(0c-?YWB&C!K6uFO=Iagup+ zl;1uktKYx0-@x4Mr7SoVmkJffTeBFHnlHGiPpxRP=i9R~BdzL_U}7pdKWIhG0`b9K zEk8*RXVu`)E;F1Po+`vgG&pB#z%FIw9;v|E^isiVwniBujM|8ZN5ygJEb^v5^wF9> z9=3XIWQ_=xrY-I2mOCsQ-o{L|WfCE`@_kE_%EzVscqYGS={b{M_YLv&RjqDwLO=J7 z((Xd7M>$_S)ygsN?W@BG#izrfU**2ybl3JZdE!@E|3CA@?B)e$V^j;orK%Div}7Zm z^07h(1+>s;@^q^!6Y|6~*$K>uS+0h6jmd7Bhd5y!^n&ElVc12IOS`km$2Oh1nQ;v# zk`WzedMCd&lOFB#F0eKJhYkOUvlc58dc(h!vk9vb-0*MaBm}Dy-0;ul_;FvN1aIVY z$*IbZyIL8;k}r6%Z!I@I&fBKB-iR=jXHXVMoQ^jUeOWs5WuCy!q|d_qY+TIeH0u+Q ztEe;`%kP%V(%$-Wk`!FO>^EJ`z-m1u9$@WpaSJanO%7JE=nkG>zDImN!)>1LC!O8u z48g|P+4PV3SlGW-aDPWkaE+q2ErJ12lZUx65f;3hLtY&Z&05Qg|1sX$VpPz9DH9`0 zt7(LaiemG~Zn?+8{?Y>mmNigkB$FqUHjF8qFky^x;H?=HJXiG(VNa`eVE=-e6v1u% zLs>Si@LsErhYujHBtb?7X~AHO1hoe~Q94n4GNr6RFeA3gs@iT`W@qw?mVeb^bl+!n z`I_0KPn>_yK^HzxC{cz7qs} zSk-Wn;1_*7e$CYyfVnd%&S|suuenhfBhQ(P&_n0iS2bu7o1s)2$g77{PD3we)b-4lrj610tNv5m||4 zGqT5J5;iI_Wch-HeWw%Vy{#_h+@aVZ_$8Oxfq64Y9e&C6s!6zDCRw20a=n5+Wboz- z{u~nw;BJXmTI>D~3p?LsuyfXb!p>_NJGb=J*xAu)Vds{K`$#kN+L9#XfMIPkcTcU<-fF;Ft&PvM7Ug6 zwvq!Not`APqSeKf{H|}cnuJBInH%uyzC6QN)Y^<6`ue3%#+es`R#IKonxO{Y_MOWv z7PY#B8SFXPJ)EpilfKECz!`Yf)@5F2dk)m;V=p_ehkks0V6Cde?Y$)-;MLDInLZ(qY!* zhP8;-^p9f63{qHpPI!stmCZfm`n`h^SVzCeXAFiOW2Dx-P>R9o$WJtT=m|;J^h)l=p0pv z-=}A{La*bx?jU_!pP$}yT<^~nr9n{5WJ=~j&3GOl0a50GM1^*qc>*}(& z-tvfr>)Q^_?9%&nC77-Kqr~2q7G(Lj>fr1qeIq-=%$d97;3zkn;12!mtLDP2=~BNHLdYlI9!yJeS}^QZ;ilYgLnPTQrPKR1i65xvSs<_oq> zZsvjEIohZJH<5JvABd!^^2_#^)#p+dZCy+{nQrE6e>*$daX#j{va|j496mL>`gvgQ zBS{K#3{__JOc>d_y6~2sL3VHuGC|II4EL)_TxN~ZYqeLn^lHC5ExX#4xY}N8GRfrV zR6ag&MNvz)s=cZb8~$A<`v&SxE;{?)bfWU{h^ve0ldH}RnEd9K2NRsT|6NaWOmKex zFTkNx`jjg=mUNXDNVW^TA2_RwP3~f|o1gz}H}kn<+g)DvGFDY$MYb2+L*~-D%66SivEUm`d)A;t*Wbn65t_u!F_&#-UEPTY4@tuao zocGsl(WHD@i}h0j>SJ<8#9-2s)*W|_#C;{_eGvv2Cv^;x7o;7 zbdq37^2vg!F`kf^|H`CXD*5{u}RenJJlr62bd zOg|ycBJq(sY@*kE#_RgAq+12?u#p%>4dYWu9S8rgk-(<(%eX5Q!%}0qZeB0zaBjxH zkPgd6oN9#~HoRaV=wWc1L50eBA2I80ktPU1+^rpAE|@G4;VG&h!PsEA#sqPnevesu zR3#qj^?Vh&;AB{!j~o5^Sb{!38CF63U?e1R__#2xPd3X+ zuEcR{7cIzlgEmc2xt6S>AdHKW0cjD#js3>H;o`#u$ryek zHk6-|U+@8;_a~wH!3g0~#_Zt|do^+z@o8#<;5z#z2^xcb7ANx!<>CDOf&;t6GrW$O z?gi$A-$<<$++=TLS zC}c$UHb_LAsbLb7TfoqxWYh8ZbF&U5S!D0h(Nj#W@RofEso-k+4hcH($1ePR5#At# zH`~`s3*BYrHDfm)tg~;DdKrxuQUSr;_QnP*O@d{_7F#SUMtM!+6%Ib{+!pXMSD>7EZTlTj(a-i@jOB1vhT;Sq)6~Ur(3WU zbQQoO=Acg^glkhSiQ|e?3{)Jy1X95UiQ}47ojCCcN7poGX)26Q?cLh&a3wtiu%UAi zd*6Z(ZcJ&E!y*rjVLkYe4C3gd&!*DaaEA`x-M={>n1wFqC@yO_I$ zu{L+e6%m);?E)QY8^AN`>*Ay;~L# z4mtjLT*_(9$LscjY_M_n+txCCNT;CEVwI1i%cNgmMkWvCc65e0Fz6MSS(WyfRLSI` zYKfyWCi9VUW%>Dr9af(U90PMd7d&gL6|7IMMTvKE4Yyw|l@U%Hw4_Mt;qarqjPn%ii%Rr;R*ukxPdq;`1;CZ!!Sx^M8DW(}}kb3l) zj>fh##+`uyjcBSvUbI0x;zOxl5UbPr(<-g|I+kVf8cr9;5~*h>HkIc-!8ILqybFHO zg@f^JvQC1yrlT2OtKS8e7zu8GACqlT&(KWFH?~Tq7}EY^81oJCG(RPq@r&J$d8rbC zq6f=&b}xQNhH-Ed=elw5bSJ*EhXj42f{$orICMHLVEQBMO2!0#42chp-Pmn!#K*~S z1LHQ@RzR2q7u}3jTHt6Lt7V2v6Lfdf;XT!8HJyw6sNmgpP1?-Ux!0)1!ekxyTTN!a zeFR=W9tLm1QGKk=yRxi(p5Q%4$a$Dxd3y~$bkHq1NsoHHk7vJ}p#ohp>sH@I`w8V92$Z&;%$2)R;R*9)Ug=Ed+l{tY}&fJT3YNnBHqkw_0 z+V!@$((#hutM;%e6epF2^*k4A9P0^6UvgH)O8c+0E3=phxBBZENgBR8QYBJ_m$~qF zq!!`bUhrL)ij9~e_`t4fMJ-Q-vD-w|b*b1Gk|04OjC1Rx1-GTGleXn!>!dxVlXC@y ziF;n*(I8xFRYDcw;f@#%W_V)|Yt?iat_tx$M~Rt&>q!-2t`NM?;TD|R45s1dm;X?V zkt`H!>tLu?P(Og-6(nNi6`Gfbh*7dvBEo7c+0>J5md&XAQwy|D>Fripj0@Upqy@h@ z5`wPwJyIn)t8QGLl%P!Ik-JI9y<=ypMr(G0c!#Uj)q4+<&@YfEKJN(A+`#m$+`QGL z_`WS55xU%z9==#cdZ{xiB9+uMeW7^HB}tUWs3RyevpZ=NT`cR1PT}I6qBAz^9lWJ!~UMRtv6|A1VabcEs=j zY37O!&2rq8su7>b_r9k>suZg`N_6bC&IPwyn5HLwyv~ml5j@(~L%9SiQ%nnqx9pT` zuuFL*f*U$`!|zfBsuVYAJiO1WYBFCUSl-br&iQy$Sr=Wy*VYof#w8;06r@dlV@X?Y ze&ap8AUAPA-ZvNIHgiGVkq|EEi1p$(KA|C4FUs%jVZjBCtrEm z2RE84^M-_QaR8ijk^FRr3wNdif*u9}>vFv0R4N6egb->IfE`06|&=Eji(MQYV32;LS)hYV3@3AF#lO|4 zRfh?7BxB;@@72Z{32G0R2U0cSk@@N{tWN8#t+l$w$RDY-Bcj@4q=H$YX3h`RxbJdY zUd>JnUn8C;d52MWJ&((mmU`w2ut!O?`@bYD>M%@Op@ML+9#D&xh2jKh>ROx<&Qn1= z#*|4N?vqCXeuDUzotzVrCG@)VtHZD&RYDg6!Rc)hFJqGn7-y%OMA+4xsQ~I+dFGoC zk|pXeT$C!|@0IB$@v+SgTPP33w7pG}IA(97%WY70@Fh+n(K<2-ZaRZU{!L3It-WC{eqM0;ESr@SasMxcwgdR zN(AdppoZY2MG_xFJRQlX!hZ)xT=1BEy*dmFQzbp%5Sn8`g8velUwFsESpT0;5hTPK z6(b6OMvk2dtHZ$1bf&AATA~W|1%_qmm=|x_3Wy-VU_URZMz=Z)gQKbt)0)&_aPcyq z7Gv8I-BuljLce&BE{Uo_Cv87imfoyiNd)$}9Ng^bbhltddWC+a4x>M_M{mkCX@(d5 zi<=e?4+lRg%H9^~Pt0W>+9)2Ju@s0R$4_(h7{Rz0Mn;dr$u)3C1t(IEVT{_#{ah(4 z#c~#%v(MVi|6t@-spgxUxIf*@9m~?5Ym@`m*a_X|DP6eYYW@&>L6MvbvxZ34n=q&j z!#k-O8N|o8o6X)#l^iL-Khe><%O2&-zfYBj_iz$Q*57qtrC!+YQq4l!99^8810*6p z)6+>6;-6`)^I4W|Hm9sN+lw~65O<}y5--|nRUy`=xfWY(Tnv7LWj(8*y`xLUaWU>o zH}h2%f0@Xg zq@GW{HBq<7eE)r_&UBT!)E-rZf*Vo+HhS5%gum`cyOCN1Dg}B?VFy9s9$<=P{9P}o zKeM3D_j@H5{?%I1ukAF7z#ckIPhn%)B_7$R4#QR(G3^}0Dq$l@wNjRcP5Ez`&qu?p z?YTkiLNRQ#lxmL}nku+N_wY*SU}B%Y8wI8ykC96i*voGF^R{jA=9pN0S6~Ma+iL5?rTBop{vns?oSV86H#y3K zOFN(-wM{(ow=5Kewy~y*&}eMc^cg3);g2%?j|$?Cev)39u14dpI+^XE1&}T^8dKVs zSrtaLF#Je!KE-PYkQUJh(Y~bq;36Z$JNkpNU|!~P4ZjS+?qrw^T?sarR-^xB zHG_H?Bdsck->LVxA{ADnaelK3!V_ha)5GR)Lo|zN4L2vHhx^^`XQMf(4NRf7t$d6i zCrWbVi1zM=0c=z&X$s+`r|W3JDKX7Kzde~2XcDLcJOM~f2=rka>U zFh~oo_=uJpm=ch{U0`QhMjU`aHF3c}zbZvr4OS&xYBc8ALyTFC%K~!5g4Q-Y#L+5< z9qeE8-(TB_LMLubWyGeAuvDqhtRNS}+x7$pTA5lZK@NRYn%upB5i@M>>uUh4Xd(aE}=Itfdv9(~zL5O+2a;%hPRa_a&`knhN7h&JHV5 z`=uUjmesS+ky)lv{BfX}9rXb&2?b}(Or0x1q37swK21@x?Hma+DKsl>bh-p8gdFeb zQYB2M<*X2Nx{(O?O1s!I#-n;Gh)2F)cXsNE$+2CdeYF@R5_Do_08A!kL|2P*FR4OA zoD(pU^?G{^DUj;pkf>p5ORq^X%5$u_d}xltGw;z8;wW<@h|btJ7Pkx{wIBBAs#)P9 zq+EP%Q0-}_TGsF|aWv8-MpsG@j!km7)bsZ4thja7@v>TcV*F{Zt~H$w%T!CVUf#zV zeXgC=KCaXWRT#PElcLh$e>`?19cqtIuh_YZOOe_vFqrq>dxQj!F5|xbjK2KbT}#_| ztUed-1Tw5g@E=u*tJ+FPL{ctIb_#^0t~?qkL3A|JkDhLdz!I4v=tC;m!VfZ3QjsK1 zkRVSX(>+d;2>Ovs_$0+FUZqEj9%*jD4U!NI#tRyZd;bF%&k~F*=WOe1O?ww_2$FR4 z@zU##f#D3&F-wX-C+``=CtM6#VsSp1<;miczh&33yQjMa3_X@)W|pPm`>Twjzrk?v z-6YJq*h*x4V2es{%)ed=>>pIS2t$vsBwd3KZJfQn5CmOmx<4`f^Dim4d7Lk{Z>0x! zP-p~;OF)8#)7(|v{j3Szts#1hQMeM+5s92FbL-IAaJcy1K2oU0^yw2bTD@Y&jui8o zmEuKrYXkFm`nnnY%z1V9e05QU1v=4$%)E=hwQwK3UrNj zRf(x#RRr3H3$Tc(Xj;Rt(<7OGBQPqFMq4)OO-5 z20F#HJ6=SbOms{G*D(^2)eccfMcZ{N30@*ZO#B+Uxq$N&+@@vT^>s+nT1y@>mkE%*+;e_>k8J$po)!LkA6#j&B zW4tDgKaP&#*2OyKPz$zgnxqA#p<=v|V?w^A=k4=^T#m(O$*^)rzPWr?8leh&&is6W zD=8Jcb%F)rBfUV}oB=VSJvi28K~x3!Clb8vrQSs$XONLe!P)&s3#_?np!n2U)`m;2 z0FC*wSXxv8mKuJw){ak-C5Mlcktm=TUmp-8Ys^-q(gL?1^(7satp(VgLp`mgH33e5nUYs4qz(%CqNYv@@PM=QD_vb5;^65xJ0p^o6J)JZ9yunVr}pjUQ*;2X7RqIkq|Htg={ za)pB;^C*ebourL8LAgD%LDzN0I7W7Z{?n|7y0xpM&SWj`N2QWfB7v)c`wCI90NS7$rCud{@++pZG{kl!mT1r0<}jk8JwheoL~pN8o% z&5Jk(iIricq0qwVqZ$Dc7aUMsX1Z-LTqP){oIOV3Vw5t}dHGN&l__Y92?kYbi3QWC z5FeDS71S`q>hN6$y%*wQ45HDI`314GBgaeKKqVvs7d%R6;K7} zwrek98vG}y0vf`~B+iKWD&E0b+_2BpDKJYb${1ai*sLbuom5yA;C6d-95*Qi@Ub%K zY#AZ+gW5h;A45Dx(+Tl*uibS1)j1`6a+NB;I(s9@J-F+8IlON1SYTd5+nod%Foq5) z)_GZuQI+^rhp&@|D8K^YRr>*b=q5;TScM!1$+!hcw0Z++Z(YKWk<& zHFAMCv8PXgnk4u&;bzD4a-t3T(sJN|+2&=wAa|~E;Dec5ndP~Dw1pv2H3@Uu!jd%k zggNFwzb9N;c79Xp+1J++6(8I7d>u8v7PPk^H`*&4!d7e{>~kWbR3d7GIPr8crc6}m z6@Mg`rtu}pfe%|Xbb=fD(xcOXU9C+V^bQ^6VT@w9Q$!|9lC<~+w8n5wOfaNca86ir zcM;}=p_St77}bE*$=c$zAi1_5)qwO~35xSEsgj715tIr`tVS30H%|+sQR>H)aQ&{= z%9H}55Fe?1Y6PzD*sltl_)HbtBS_WBC|aTFbs20A%O6GPiWSkkGrj+u1El_BagLOF zSuXW5h+SUUp{I+tRDn@#as%ZfEEsOez%WJoGkC<=DzoOUMY>MToF+b`-Qt&Wd0~n~ zj0SY<$DxVWq)0q6m8sm&*pziCwE3(q*XSt0V5y8_;e()a4RPs2s*TFB1r_QPe4{OD z%ZT*(IZ+mXDpIH5)lQNXGIw|AyN21#m}JwL!c0cY_9U1bnHj4PgLNg`7Wqj_PnE`C zbAnrXT8ti;y9{qKqp@Ihx(#pG=uD0$et&T>}X-eMcI4 zM~;*>&^Ob5ptmZ*c~KeKtQ| zy9Gbn{2&t}nC&Kmdw^H-wHZanSE)r*kX&g`kU9;gdgt6;>L}YN3y5`^ks1UK9L?Dr}?Tu@ev2dTQ_C2~l1mNvgNz|$N6TT}E- z>}7NiY_t0TI<7pEbmI;qftQm__>j8)ZFYvW5EV{5ntB-z+e1>MU5HxgRqezhsU~b< zP9)^`k=P(3$IB5XjFKuINQS6R6`yhJUaU%mg^7`=QoAEnf|u<}&>0>nL*VcammqFS zZN}^NCA{~T%8!^tU%yo0)>IwdwlBeq@EGkrO9k!pQVAN3Kfa2Fu;7q2RC`d4b&i#w zQM6ZHm!R?Iee#3OrRu|FRP8RySVi!&&ha!^Dv=JKJ{#vXhil5uYd%?^izymowb=o) zV$6bJao2@G3x^Mqt>=jM(o|3?!7t4UB4R2ios*@KOr@oH-kJS$3bxyLe`u{?isdfW ziAT;+4lFci?3yC@DH(uxRVA*sXKUP}Ev%;CcrC@-L-b1)M%wuKo)_U1JY{3zpx^A7 zKISq>v_$a;ZxMZ$Ou-FFYM2~MUCLo@N`~cF`SX#aYLg{WGn~26lmj0b3G;O`?$=-6 zqDAE?g6^a?YfDHXB*-*o@rruh@Jod6?@l%;2f9!osB{Us(TgcVYyQ^O48*16p%;Hr7}=9*Lq zc4<)N(W1sjzp}6eZcI~1@d>MbX59sL9%JEqFY!%n#n1ZV-uS*g9l+PN0$j-sZw1>h2WY$n0Bivc#_6K{@kd4K5HYDXm$(! z$jR)t_e|!oR0)n^-~T!n<-l2C&TMKJ-)nGJ5i~xT#{Kt-t-wUa9q9m9iX2Evb0i$q z&Asc33YKe(kmHU^i-nWIkcE@2re@GXmrWTom{A5(Sp?o=WKv9a_q1I=s$$l2n@Bcd zir}c}tkI3h+R`wbYA9p4Nu1KwXyxI|XhZOtF)*tHZ|Hft$T2WCC`@_klXc>gkEBu< zyOjak5c3`{JkIK8uCOGw1Z9D8;0Ce^%meWO=1TBrExmcDPPw!rmenQ=B34$~qY_a= z@T_8H`p1PxzN)i{pMC^V4d*)IF+1MQp7Cz#J>Hz`cyn~{2PvK&?rjdI+4vz?AW@F^ zV@Hg=&sDm2hT+s_d!KW>HJdwfX#1dn{<=1o8bVhheta!|2tE=0YpMC`Q|T5Dq_K>S zz^t&($N0u_U{6X8;+4ZMK1> zv^xpyHDsm1vq> zAMBO***G^KtI8!JS2AcL#pF;`EYLbs;Go%;naSD%a3tt!3ekD`BTU~h%bk6gn^1l# zjR%F)7_wp#f>A{3}Ak!A*6{#Dm$?5Nb;1(a)NPTRWs@gtfZt z_ypxZ-vTuhvv@lV70&`G9V~^)fq<9ao>U^iYq`a#t$b!&-qpABCxyM6%DieQ-j8Zw^2V|PnXLLtPgQZh`BHS- z<+|;MX4_@|w(W<}66zIjU0F3Jyg61v$0Tij8!C+1kRX$Eaba#{l4U;KZr?|X*hDh^ zSey7-9R3Uynh zHSUen$Y|eG_Q>0#yTN@9}IfaAQ(lJUigKKlh|uSk?+NsVf}9jOYyixH^ou4!j`Z% zVlE&4N(Z}Vr;l~N`qdm`%2=gh~kjzuENx3$=-PXrwm|(#* zLaX|wN&`E>tU4~v!$za3#)}M~6JJFI!EC9aaO6?d=ttic_LWf@*d|(i1$y;`>9k4e zFAm}tmi}-~Px~?aE4^QcKD@4&t)|7$%QVKLZNy%u46+{zd}&thrODN znDcSvKq;B%YOGH;;cs;q)F>FxJx)%Pb)!$Dze_WXs_HR2)~4%7VI5q8XKb~3RBPG` zR5hOD#TjFhJJNb>->@<381-%QS-88I{RY-Rs%4zilQuP>i0d{z+7h)bofE5)bmj3uDJxrl;m$K%@`LmwRIRn(zm@8^V~N`XX=m}_Jkm5)jebsow^j&abxhZn zVfz1rg4y&O)jA8K2#$S%_8R0w#fRpma*4S9MQK%DXN~k2N1_3Kn$(++he)7pwuOg!Uhq|fY~hQC5$AIfnb9Cl?hGE;#S)oRPTSQ=iDdKrcK_8H<6@B7l6!Lwpbj^~ zR_^R+@rGvKrcF~L@l>ZvO~fWJbaV_a7l{|0eU6#8&Qp;+Zw;qgy??`RAkz3@Z7>t~KTJ;*&`)oFs#3i%)(-Xr|Qj_`_a} z!L@?MI`QBS)o9o(EDlC`et40hQ^1_$BK3D{)dyy+9sjg%B4ML$NT(~-ZGN!%X_wWu zU-frfkS<}_oU~{MHQGZ-Ganz$on{p7GtUQ9EhaVT0QO^< z1$Kbc%NB_kSK5E7l&5%03Qh_Ot2r4*m;`@zjF!wS8@uI9Ye~MR;$gCK;G*_`nuz_5 zY90v&wGozx7#?~RIH`s=9yN4$<|B69=UA!dYV2=|Nfjq{k%Z9NWc0CVX2bUP%n-%! z^TPLHlQSd{Rg6bx(;eE2dnJmC4ZnC)vEb3!0p-OOr&oOH4ZC3J>_rk(#RAV77+&$o zPxL&iA}NVTq|)%3qipFJ2Csiv_d>j94`|}C3q;) zJkbU4ubEtPq@tx6WgTr;!R!rRc(&EocO*ci#|+U|e4N8xB*)O>gaE+a$n68VaBFWv zKBQ7V+n^pDJ#zm!R;PQl;*R__J-S&fGAI?taC_9axx7bEkcHMs`cyIcM)~SxTNEd_ zq@E27Z?Qy}oTxI)pF#f+9tYAD{>R)ZWJNqw4bk2CQVB}n*iuZjbbvd1fMJP^V5yWc zLj+l7QhX}ygHqa1N_VEXSSq;kbFDdOXBRaI2ZvNKngg^oA5 zqS>pdyxE%D+gfO()TmQ|EY5UWdIpEowJbWrsu%}pGyHTjpIWitpeW_}Taq>W@s7dC zA-xtZifGIOqhUCmUk-_m5xO4CqQPAd%Chbh0YKEgde7 zyis+jVuD1p%rV#NYpOhOPS56@VIil>F)()}H;J=#3_T|3l+1vnA}xa&m^ULF5_j5kZKS9NV=?((lFEN_G%d@@$5Z4r|0=MGLZBpLP3(FI_XM1LE`eIMC4L!Nsdc>T6|Kf z;<&0U!2R)s_{CYF;#h3{{*u4XIZ?=u(+1TZAi2_i)k!I7MNmpB@Yh(DnA>JsfZf12 z;Zli|Y44hoOh39D>Jfrc0SD{TkRo{`D9Hx&^%5(CbRy1(kds1R-Zih-8O%)WN3q~$ zsXk^TIYGg z)RHr`v~C&U3e?L;oZTe#(tx(6>=|!pw+36}H1FBBnRtaWUYX*Z`mWtO@@US{UMoJ) z(GH}+f@{g6XlJgI`1-?S39dF+K-G)yQ!#e%OR7Z0aZ`Ih72|z}KTm=(TzLhbgCz3m z&Jvj*qed5G)n%=Nl6xkAuw?9;oH zb>o>SGmal;GyJDmu+YiWDql)OM+$RG#fA5s{tK7uL{AZlH_rEa)C}F77MfQR&821H zyHzkEO44Nv#Ub1W!-W}PeR3Y>wlQ5N9;vg|DQR`^mecgZaq5#r2bEhBB*&ZeVJjjb!YT(?5aU zjaMXGlo}NsEF1BX?Oz=%>&59+#rQmj}gRVEb~<{ zKFBGsW|FpM@<^Y7xh+EHACm$_NP$`<*2BZ>>}mXRpMkkS^=HAavoyJw*C!#tvHT`3 zMlpd*LkR&%Muxk^{`@w4sMvs_x+QbecptT%uv#^ydpc5@?i+L9Z#WLPdXlENxVZIWli=^`TTA@v+5p9ZpZabR-%yz; z5$6`s3Rb#rkCA#~p?#k^1;1*-bET{owA86dnAhr>D0GOe(((#S8$r5+mvb{a{IxHW z$uZh(j`(D@_~bbf26YO)ZzD~4U9byu$h>(LNm^IG5E6AjHH9kPb&J(0`0>APNjfDu z;}w*DxMmUKY7)L_d07?X@_vlibWc{N;I*V?0&ku*k3cQy7gCjYLZgqme+T1;pQ?;bLc(IMQ+ui&sD1R4Emac5c zwmpgl4LaVGYZVXW4cwxt)lqo2Lkn^%6eT(RQ!BF=b9}OvtVS}6wwfzd>L`}b($d*2 zY^|5!D7>vxk_}rRqn!f|UvTFg(^ESru~RBtx0UTA~T7j@Pch% z?y_T#GuQh!MAcDRf5l=0Fkzb4Ntl@bLu8`X^>#{RB++8ZDYX(@E~BM_v**)bt2`&*$7WT#~eLp@M%Jh3{4CaY7K1z7M7binr=Y0B(=@MCCKMY zcH+^w0fwui@I_mom|nDTMp;v~cYZ5ziT6zEDr@{(>|~fukz37#02Z6Z7c1fuD1{{JAF)=Cyh~bNPJ46fVosVbzGQm;g{6rQOk}q>k`9-f!B^=o=^z zbri0)*Q!zYD#x$#1>g0Ha-6OfH@p2XL3fVp1~LuUQTT2eD<*ci{A}^!`Sa9KxW2sv zx6_Fb=QIlj&czX4)RaKHIHrJUWM`HjCyLGK07?rW`qAdJn@W9@?4VPJhq2uFYYBp0 z#7hK!DiE~9Q0t~P*zhp_21>kRc*&v0%{U=A3j}{*4B(+z7luhNOHLdmSd?rczP~lH z>WiarX|j&TINhX~g(@-&@tBdRu~5FmTEv$!Rt*NSlkuI*)c-v`U_A{V&ope1V5xX2 zDvb>5wzH?n27}C3si4gTl2XAmMhwRV@7c)IqP5Q40CDb9FpNCyhWMRmn+K_7HW~9a zCd)TXaE@EW@rW(TDX!E0Z19F~I`;^MM#UqmR3qL=x+KmP7a3k_sS^_6qi$pR5Y>pc zdo@vwdMnTr?J=8#bOcfaWdC}K9u!_{q39J(i`!&N|B#%oj>2OzbPceF`WMJ4R(+AL z&Hf&kQAdZARQB#V3XdAugypwe;fzP&0Ue7ujVPa>^6`2uUa;$qi{oui{U-i1vuwA3;a(_@Ns+pkU9#lo3P(T z*ej@#r5E&5CYgP4290G6q#sz>zgit7czXuvz(})h*s~^(Rw)oRxJEn=dLigFqf49DB0_iPxaj2cFZGMc ze03Dov{)W8wq==_GHzX~M}qV<+3IBW9A33GxKpQ}aMCY4q8xbC=2r|2*^@(e2eZkh zG>w7I?K=N(Tsg#fysBXmJm+-ED-vOFhMau{^&HB98N7{a1P6qu0~p07DUvz+TH5b(>SaLb@$q ztVwSZIK8r6g3959tLM%A>1{YoZ^CbF)e_M#txIh-L3zQxNlwv^?xa6Dp?k^xjf&$i zugvGKGdGXPe6uFC$o%Ft`zA{A|4cLE-Pz4E{2f1N_ZS8NN_H$$4Y*M!f#mS6zsJz?S6TfQ90=-Q< z!i+;BaC=U6kQ!{YQGEAEm3E8!_fJC$X>szhM?BoqpgZojzweqjYga*tr)s0Nd-;~7+m3ezZczJm07H@$fSR%7Z_a$T#K}W41M<&cgTcFjwNZ?c6?$l_tKG68oQxS7)J18+7y*PesQ` za*}woa2|0yRA|fEU+T!aV$j+04dR)$q?faHNpiqvVIWnlVw&Q|h$}~!^M8XSHLSA) zecL2Bn8DmhscCKc(+zqm*ts!m?@t!Bv*2kX$V`H%4|A59ZNAClj^5JI;*m#q{&>XJ zb1$_ZW=0N8(95)w7_~QvWTM;@RA=FBONgKeWK>8Hlp9*o^jG_US^W;(FQ!^I7qC73 z_M5-I-I{*;o$;1xMT9I`^7!{4#KX434JKIfpxMw~qi|4tW)+mxiA#P_XQ4P$T4p=K zDBPYd+)6RDSVqej^_i72HV@z|br#lI4*DSHA+z>tj1PjcNnAoZT4@Ryd!|IHMJdN(Ib)y%F)7pBr_0T5JVxz{Py)w9n$x`k z9kJrkn%pMwJqw##a*KIMg<08^SIP`b&b0M5rghrGW^FHXP+aWgr>DBUHvM*!?t1_0 zC5yJLo#d_zKXvaeq$SQn>|P;_hU?rC(V(yibf4iGCtj;pMJ^Hr11xd$R_ZDBUyz{;sJIZ?M(jj zNj#Gtt-tN>*Q{*}7|u=(euX*spNzqyrc#i%B0T}=5)2?}z_~@}T`f2#Q{Y}=7PG80 zE85G7w6GBr+!_zy3u~y>MAOu!3+~qwIzX6f6LBTu!n1>aSBEc)vC`W|pCBCIfW3OlZ!^>YkMlvbT z?8vX?uXV<|1&K<2ea}A{DX%_zcG!@#7FeHQ?wvDrYOaV>og)#f3~Y{zhZc(2;=#sJ zr^Wy{V688u?n)@0g91seMCHunpP|YB(*{ioWN$iWU~kpdp3$rT`~90GULrxX4$8+L z{zhrw=voJ9l(Wq}oVSAO25?BLP&~&yi8@t)?<^D&F}6;0^wYhG9jXAo>W2j9Z9Em( z*|@M$X2^}=!lgBG8eX(yOGG?asTE3(lqXLx1#eYB0()%o?`w> z|4fE}Qz)RBp6E_r${0RvwYgRstlcsqbjEU54x&(tMx*3i1Y&;WZQ)?*@d}nRMdwR~k!TkvipD;QHJ*IR+#0@-4Qr2vL%IxC- zinje|)l10-Ytt`h6VO&XO4+f$nKOSmxQ@MMmZi#Co;EA`lx5X0?6mk*0Tw2-HR*E; zjdTTAkSMB>s2YaPEbb%-q(JbAl^~G&cxfc|X^Emh@P#cz{MtoQMUpdk*ceTNK^jlq zv4o_YG>Yv`Cy{^1sVKRzAZIPe=7?aDpH z43@(LFIqyX0B7piIG%PNt@fT7;77Y!Dmjul+G&czHcLcoWxJ)18ipPrz8S&nHp9e$ z9@R8Ks5|2vK zZ#Ag#&u^!t-#(Z6cA5F@+VtD?ToG9P)V6^2X4~t`wqGN1hkhjSi0uM8HRIxw)e@A6 zLa0LeLMO`$=0}A4_@r1V!4l{ejvEsJhNKqYUX3WoQ;Ms@P0F>=xfE_xtF5?YD(_Y+5bRL%l)|>= zRGB+;851OKdC}~*4(z~m#gG;%;(DKa4c=ROxhlgBoyO#fM5ZdhEq1Dwwtfd_?%bpU zk0UZh#juCj*i`{$*xj_p{x&5bOp!wU6Ia-2{i4pYNz>C^wBU+M72rmDh~W(y2@sLd zr<;P%OJ?WZw$t0)uY^RkHq{fJh^hchp29U%JbA66`w=mj(ofQH|}*WlyH=o0hI+uFx*(VGBz^fyIN!w{L;iZxK>*Aub=r# z&?c?0h6brpyw;Ri#ReXgRteGlc?YS5Prjf7T{h(onyK7^-&!iAiZdJ$58uwPxm6#* zOH-T_N7b={YdiZT!e>8?pDq!a75H>U>gk^Gl?ExSw7W}7aeX3_eq!RBA{yXC&5D2U zrKO@&g0h@{6_(Q4epGh+L-i%1bL5E z$GuW64ot4(&ukos?;E7baHW|Jr~vz!;aac4D27{@J$Um}KwD zg{GjVn3_=6W1J^5JG4nuj+Yj3JSkD>&wt#825sc$==L@Sq(xRI!MYPyszOQyYM($3R_f8nM)E~Q=Y z)!CKY&{Co7__fK&k<5?^$(3@Ac+HYbp?%v3$zj%t6glR+ZdUnbhi(}S{UsuIRB=g> z2y+#}DSkdJU2-cMmjQCA^cUV=HOagaSlhZJfk)o4=o-vB1j>}aHOBzWnxoJ-IdIzs6!}Noe zWLpO^JalpkCIlo`W{9mj?0eB179d-2XpExlUrB|+pe-Ad_Yr58)JSUIG-u@rhYneY zh^=6^c%%nCBB|`2Thqm!H;P5Y5oZx!sz}LOW=%vjEf9Y|uvwoTwDA?-_6`+l7=D`? zRt30HX>{q{sdR!Di18bHr>;=}!L!W)ojV|+0+`Em zSuFFdcnQOsp#r!y^=!LTu&P^{NDeL%PHUn@1#rMZ{QUBSfuA2HcpntO0)hux^7;Es zTeh}|P&S#VFLYT|s)pgGsR7ccV3yM9yMAQPlakuCJX2Ng4eh=&*Ew^eHt0& z?1M_TYi9z(xMs+lQvL<%T50Rc)_2VYS9N5Au>0i(TBm!G`&hjMtV|FvC{%DS5eA&} zPdhA8x%hCBQw_r-%5NOcKPrtTn03(Pe6M2MUqM?1zHQkjjAO=yNkoD%qsd7c^KU0< zjt1}r(ZC!*!|*$+xxyC0r2kzt)05RShi$pW3AOb@bLj7K=>5bea|wp`Qjs&qJUcb! z-5utsVc0W;+QZd$zskjvlQh2MF#{yPdAY{!CYFJB7f~b|pKk0Uv#~vdzmZEhx=Vz< zkRK*5<+t-3^Qa3lJA|@h+vI#zfLV@tB!C|$Ck3$E9ZL-9nNJ^^%&u&3R1myFUD!vR z6rW64PkIZ zFt;`)Mc3au@N|#TdnH&(ZpwLiiy(Ss$J>(`VZOxCYD;EpUAxs>?>jOmEi#>SLuJz=&ZlNe`}ujXfk1h`X&hZsqFM1fO&S5j6ejDZ>ahCtRyT#=j$V?`HVb>%$vxAv4y=@nh_EV_(*VS5&x&B%kh*%9LydOL2-7axGj5u@7Z=tyi?dcNJ57E9{io>>J@K)nKRe+~D=;?W$Xe{HW#(_Pbd>PWNFe1a& zGyIx;d!j=<50aPoMe>ArtV4`>7EdsiW9=7apROQWN}{qLMKzY~=DXYVyM8CD6;{En z3CXczPN$GG$m!w}SL*1kO@FkQ9~GB!y6&3DPpF7}oDnLMjp9lLL9I=ff9H^H85>mq zUreA_b#JF?@$oQxbi$7G5!^{1!4sS~ncDx(46pQ*K`MX+6O+8*iwu3(-a3(ot!7NE ziMs#xuuaVokvYCuVqBkn&xEvy_0b`1$({T_19960g0~Kt$BnzRAxsMd-Z~_tlVLnH zA$>~z+^L?PvvuN=PlrlG4oDEkwPF-q(;nfSV4HBCo5B~~8@|QO>TYRBa-|)Id@s3j zn&uvJb=0C9rMg z=Lbyqy{B|8tH#6Fp9W6m2PO4N>$j#$+D=gW_ZQ=1cTHN_k4(TZ)nFUAcK2PW#TR^OnQ9Wi$+6 zy5y=sRl?*Orq^<7y42&$y;0mxA`c3>h9*cBV^m*i$S)=P5Uf6gb3m&a6e)!!NdB2| z{%MAE^5ld{)fpdH3EAJ#qBq8shg5U7KXhq2=#M0IXuUMB|CEx%fy2BM4K7Ram8FMP zNJN%vQ>E`@siGhH^6}izhVhBkqfZZ`Wp0zQken{hDv!dscBS)aJ)1Q{XN2dzDi`f)JoYoLI&P;85#JGhb9^L z(s4zq0Ph`6tH)%C$S=AcSF<#dk1on>C&T%$W*pjbv+*HlS1axFD%q5#)+;c4KKh(w7(*m@~n zlWh%SK%+5R>kiSI`N;k7K^h2?X2z|*m<#Yo7rh&OaxQT$ z5|LU}h7VKyPz6}jrOnVZB=>4nrpZwwAy~aCz#Uzf>xOk_7#w5TZnN%pSvLdy1kHD9 zc?#1Sh-12JfslS>@JvV(fCxeFH;Ic*Hc!WI$>G&1fCtApl^r#i+Fd1h?Ql2aIxs1KLn%MFq&Ef6v1>F~ zDTul|1;?hAZwB}HuX;>ez5?v*(uN@c29c+C#c$@sP3vlC3iRHs;M{gF=5}kk$SYmD zF{0Tgu&q}Lv&N+syge!^4>|n);L-51pe6;HIvvf=!l~3gCl!r$Ne#yLfYH(-CZ|A7?zeql-TNw$}eY z9Djo64vk5JiEXp|Zcg-LM{uHxx!@b>GewIDk9Vo3sR-*iNIc#}2d2-|KlXL05SQc) z5=u^kOQ>gyOHNEJPi?y5=a1-?v4G|lm+aIr0TCey~=WZg+Gsyyx|q>~r60W0q!iSyByaNZIk~C3<=Vj~&rE zfd*xqn`uk#%(Z`*5AMEPQMJt{A^bGty zA)tm}D-G@D-n*}hnFD3(0dqAT&NNm-*|B`=o!p~ubY;3sCM@DzZbZ5i_ogi<)zFWyAM2XkOAW#0^+{^@rVEW0ILwRj?9?3Nxqdtf9Yf+t z$!TjXr&;))D!_;A73q;O_PSKdPaV;UNtMcuH&RcQ9l;#?_l->oCSP>*N+hL{=2*?@ zcCk7cpd+$NNzsp7qA7aQ5p6i1CcJ-F;jdl2soqUXS9kZ3+DK`L3is6WRC%Y1K2?^~ zr%sjkySU{agwnCOZ5M0n*B#w-0)wp=>&Dx=RZFDUapI|hLk_4iygP=3V9>_>NAlR2 zCJ~v*?>{!axQky%Zq?PQ4683@X-zg*dL*69bLxwvTua6js=w(HlXB@x!|`?c1rH;> z_^wNgaijz>To6t{`f^~-)mumELz(_3=0}Li&_Z@$!NuCQ{&}|$c?N7D9*B zG&FO?VxWKc8y_Dm~wmysbR63eVTO? zSFxD>)0wHM=d=(?b7W{RrOhApb4s!^xHEn{(hY~Ziqh0i7g0W$brdD1t!AkRxj0&n zVydk&!H=VpQX)Uc{v+KK$W$5jjON-IE4^Q@v?j`{jaA;$EfiO|xO%jvl08SZv8u1f zgjE6NWxBZ*R~l=vuUjatN!r6Zs8gKQBIXE}aD>IuPafeiN(9YK)O%DJJ~^ldcOFIm z(HK>Rms11bU`^q=%@Gs)H2JUM^`fI%C1~7BzL-i+L>f-v^y$A$Jt?Py*_&sN>PA$a z&1%RKCFwVBv!4P(F#G-zS~0IXLX*gkmvBF6h{voWLPEQ086HY^Uhw8oZKtSV`1KO* z!Wl<|I?1iz_0?Rmy$U+D=kMC}`oh{01agcPxTwBDUJ zAE_D44uf=VIkH*}!-`9is?8>&hKDc7GJ#mJD-ER~}7KV@nUeQ3bEO!QCU4;+otF{8B?(!ABQ`4XgTnNAX6ffZ+3s z%)?P{mz$5$=H10(n2NMY@S43^v<2^lMknRnD#3Lf-1?kGd5qOm-*qNLKEm#&?dWQctQxCJF2?2G^r7DKLyKDig3x{W_2I1I%P-u zg*?L1JEjWo*wJprsEwhzctNGHCJ$!OJ4fdp*Z9E;Q*>H@H?zoI=vZ5sD*Q^;pB9ip z!(2_-26?@f)mF-o843a|daUGhW=6!?E@tokVDF^ATqr*6;p;6fStX~Tc^pmU;v)3b zC5}>}#)4dwc$IiCsY$?9?doRkN_xj>b%;wuo)MSyA-sfQv&~)2`)hNl6Oub@zaZ^- z-*q%~fg6oI^uy8m{RX|e9zHr{tbB(TlXC+sIa&+$Z(o>6)sn~XXyiagF%q1kB*5;vsD{O zzMLv8Ubukl;pwbuLwk7bf!#ss0c1Q$1yiU+EKw>1dv zNYoGnfp>efC3rIN13{lzgu&A? z8xg!^38g+}GFiN3adSzwU63ykb);af&2KRI-x?fCRjM-VR zPJ?3RW`zWUoDz_FMh|%ePxq+6OCxH?iLX9rBKLG}qm_qtl%MruW14p9X$sV{-@EGe zrF;vkvuJC$;{vDZiBI&n2wKdfj7#)F9lc!dbtl`l3$Ce4>Z!kU=gktUB|?^lJ+b7u z^ozfq7L}Vv7R0xiy(K0BGuJj`<2;W{}<^(xa(MsVa{M>$M@$aS?>+UlJz2^f|rxVl7mqNc*Ng^Ikh#p z+)wDpw+mA>CBc|49m~z{SXL^YT*)fMx{EUrCsnytR_Wq_Z~xvdnA^mIMUl!N9p~x`TR=CSb_(SZ4{4us_a;Meo|Rpdn~J_ zV{)=S;G+z}fyC%Byy|>SIJm3(Gx)bY$N9+#Gn>b|TD6zp8VwbIkuVtv?)7FU-Fu_}v!6qYS$g zOl}evCd}v2^XvsRrWtBM7LT4C7wB{S=B!ZR2%T3Wr~e(-bhT#5DuDYg42XuL zzGs|5_v%wfbF|ifcMAO-^p#R|_hxdhU2j_<50~Pp|B+noI;LKt9Kap1CUXE!9m4^< zNY)@&bxcU+NL1L>X?00`dD=1FRQG4pCA&*RJ%XtgA`&FjivOGI3=JkslHdT^`LQ{=Qirs-up&{JR$_8`nS$&)$5DCT zmF>rzku}V4h{unu#*60@q>I(ZYO??@Rdxy1ogYwkd|{F!_UI$$Q~kgca#kJ9v<_5( zMbVR$EP!2?>avW8$mVkLED&t>XB%G8R|~Nyx>WE%4i^B6qebF-SeWB;8-@Qbat?4T{Ac0^{(X0} zNZB#{e4Qh_0B;=YJ`-DWs&Pk@zyv0@=WYJPM|bn%_wKYe^y3MCd0kkrzk9Xda!uxA zo#+~396b(QA})DYJRcxY!?63~i1;{HJosXimTtc}KY5wWqy3)2zEMu`;ELnCGKL%3 z5OME6HsnCeiQLc`r6e8{gz$JyH6EG5J`G{>H?#R2Z2soDrBW`74WS6b0)rf|RwFlr zNLX+p9hDfW$<)1BT==5Kj9RStjpCcR>51BkmCNBl&Nm9VtPlO2*s)Z_aEUV zczC4tR|f@$$5a_^K4?z9-lW7c{14hb}m3rk*^6cuQpJ zZBn@XIh*cRy4Zsf;P1ph@1U>&7KIQ$&-QnY5(PoaBYh zZW$3?JvlO872vIGj*o)w;*m)S_JeG47n&Vlb)Sj`GA@tp5M#C4(-kdqGEIRL%OzFH zj>|_HLMskrYmwgSE@e0;nP?)w|Cu?Sa{8KmdC5s$x$ZbWo*GpoE}kiyM%I`j#oTP3 zk>8EfXXFjpAt{s*GJ*T>?osUgN5{FDR?q;vphGpkUpz`{)EkfE&KfQrEuGyRsJ5029YkVT`Y?QJ>Es{&Z6|NZuH`k-Ah>i>Gs@@V?4drUl9|HNU{ zw9|9{Dz}siUF-8}wWRcwvjXQcXo&E*yGEvW*{0$)+<0L?@XgWLf_=0ysLr_VG(8_b zoa|+)IhuY-B_esltFUism}b=*FC5KlYxXg*C&JXk9tWjak`A^3YOi`@LF!wKGyPISC=zle~yY<-i>xzuAQM38n$;0GE zJbCOAtUEtUOGBG3LN7sqp2sC@>+SzlTT66Xdvry{&fV*5E5$>JKjn+v>NUyv&YYw{ z_Chj6BI;?k8!g<-5y5&(8=gu8W@;3EL>zZWP;S(dxpAa+G(4UiGSH&IK@1-d++VA0 z^#y_@)bTVb_32u!t1+(oFO^mAZzgu;UXSmg%s2v7HnDkYR z8)G~QZcNXkU`|dOZyuwQX#U@x^V%*H`Dwij286jd*csdA33$c`=t7g`D9QhYQ$D)d zlgyQv-NQhElnH*&gEZFfha8$?%p3~s=?~`jU|#J2?y03K^&=;f4h97KqXCl}ee5JR zx~Ep}zOS7jObjGby)zpT@n$Qa8-|N&2=Dk`9RZE@T-V%A5i$Sed z@M^8zMk}0z&Ae5cG+RC3)V$}-+W!~cv*g&A7Uym=umIPoH*HOAwb$XQ&zXJ#9@yXz>q)gFXaGoGc@xm*{JCyRzdSA2dyW=xMsr zn5MnXkWA2MMCR2(W?QacbbvGaUTspzS?AO&nM(BYsb^0c<9|+%U+ZlD2YvsOW4YKt z;bnF?F`=#e)KVIslaRTRVv}4pCRcw~G>Jo>lf!(Cow2sIlAUc!q{(1z4$0uVs3wE^ zb3(Y7Li`WWunHid7xTuP5Vog6p;Q5G$f=O>3t7(+O%WeDdCF{O4Y)1GtpeCF(kULA zI&e#Nh=}4(MiP2FgFF9jEej;ca8lk9pstgZA)12$A9&Pye$ZTAx{vVmk z>^d?Ro}?PXs0y&L2RRv+`}k79OLbwvyzU`99 z_K>+0i%Uw)v@L7XZ+|B(6{||zT}#(1&3Lmre4q5RRT>G=^wW==esSq?POkG7Cyz;= z1m`jXkGM*aFr9wW{AT0V^rSrBuSBr)paH!?5|es~NN@2ex8VJl<~_%Fc>`UCdeRRW z4t^MsrsM-T>;Nq`Bt^mRIhs>F6XmDR<>+l0!CUdb!EB^Ghiqg=^nYL@ujLSt*udH! zjp|*oF{fSy@MJW};$FznEN*r5e`axicP#PFE{a!Q9TzKAZY;Zi*FO{pZp-?JzDnnA z3Y_|k5ZqH25WLYng!>PguOtDS_iqW{b%OxR6{sC(uE3{U0TsaeBZ?4ZBfNAXuNmMhEaTGbf$?^790lZtwJ+AGWOPoC7^a=^CGv@2Z9PaUX zsrmZan6I1ui~0Jy3H0CW@mKX)KKVbbw=x1X2Pk3Q?!DiM90@<^Q_wK9Q0OL47w zyQohMry72?fH%BKp%hEM;^Jbo6!G4gcvXC4yoy;tu2pti5hcU>J%?UTyI^{))_s0= zhO~ow^?B@Df#AiSA;H)tboJ5<(#eYnPQmULrhw?25)bC|2&vBaWyHVU*P)bn@IsGj zaS3b;2^}ZMt*2@o6bBtJ_aAznhiYEyG7}lb~UZ1PAb9i`r4*lZUmI z%nATw@A`zxU*}zv?`_?Wem!n6d^(dXsX_v*(eUuIcHe z8`trYzN(z5(*sy`9+|<0p4=%9>VI$UsgcPK{c{$2SE~Zt=JNJtyUDL?ENOhTRev>4 zfAtktcfu@*VogHFcYbtUKD8pjmp#8H172+O?ERiz$<ExgTj2mYuJLaOsAso$>7wYt}Qbcb$u?S z_NWvebSLuZ=G$lf{5M(-}qYeRk5mP{PcJ~%ag!LGb+Z0g2;QYqT$ z(qu9BpZ|BVD8Q^9u@qF%G9=XyzBHym=5X=uG;SU|J+*X}p=P;H|6{o`&2n$)h0_7A zi*(;Vba{I+B5lwFN>#~qC`o^?K3TDY1{&K9f9XLT#nVmz2y2{lic3?(Q*OmPZ2h0-14 zzv!o3p6cBjM(-Zdz5CBf$G`90k3C|%Jocd8on`j!?%v%p7W5Mj^Q;AR0AExH#@T*u zYAY7t*52GDrN->6KbP7EcgnTB46ok)bJIKXkzU*%+?gAzS%Ic~!419JB$kW!E%a*q zDe9rMck57bp*}2Q@Kxt*%pYHguXHh<=Xa!nBX*zIO6&Qw@il@2owEg(j~~bWwwSWg z+F|CHUf`Hi0K3oC=gu{~w8Xu>nrQh4bZYN_;6qERdA3~Ji)YK8bM@IWvsb8)0;M(z z2k^4~?B3L8&sdp1xIplFo>v=iQ~-}wCuwP8o~ETost=;2|1FLS-}Q`P;NRxyot#!J z;wJ43%k!upyj%UR1&O4c0bBB_X`FfPptUqCP}JLWz~al}0=deH`_9o=3%uXkom%Ji zbDcDE_GSR}Q@u0`-gwYLf5wHTZ3vEPG&-^C@a(^+nc6J*SIgy}ZCLYY8ac>@HRIy2 zM7`|t!s;TGR5b-p^llS$jA=WcOHQd4H}^^TpwdzdGuJ<-%3S}s`Q#4$0Ra!vDXZfva7+$E>O6#q8l>doZWo|Ae=FkD<3GCfu`9ZAMz!UcGvxAuuXcuszy6iNXby}?~Qn5m41i%(H)c!R>4 z{I@DaK(H>JK2TnClRG>$TyuvH-Mn^5cN~lJLWA%`A|QC)Qk^H|Taq?PDh)56lMDxW ztaqChmVLsMsGLF09@}WGsx-ug{rTFda(PvzV5`+{JiOKIO$POSJA94tXs)|jvQz*& zhv!SFkr&|KTI~LQ8W=KTf#C7H7?=QLBBKFr`pWFd{|UCi?zAC4uC8k_#btB=Og0@ya3^%yQ84{7P$ ze}n|JnkG(9$+kJ8%w_n4%Rn}T3Ql@H8#2g${{T1kj;$12*)?1KvO4%~EQ9cIdsjC;8(WFn(hDJ{ z3qBj0j|E-b_+o4&7X10u7h{R*VAi4=x|*0A{n2-0^SL6QR_T+hJ)eB+H^wRpg93fR zlza|Y=SdJ9+8Hh;2q&}@I-;eRK@W%Zg6_x_7l%j-#qPaH%^OA6Z1kd^~3 zFsFQZA8qys77L9ezNBu9+HuJ73!<6wVjRb{rc~ti^oOhZXs3JRpe(gp({DfR(=8*C zvUFK4G@JYE;O9B%=bs<^yd?eni-Vunrk`&=`1!Q-^Bo62Z%;q}^5Exd)6aMH>6Y=0 zvSZOOI>kQhqd_J%f{){Z<~l*|1LBh*a<3qa{!xm_CtQ zbu@1a{UsgRvUaT5&z0VWjc+asOSuNk@Q_E_p)ve&StV}D$QFE$|8VS73qybw zpQiPs5BgW*=gXWD5zIU^gkLYKlq|uV|E7|^oL#IZENE<^cFQ{!21vQkPgqXq`lqD0 zPvvY`EhkG=Tzreg)|<8@2kc8EC^(YBOJBj>O6I(#Z|57&JeoRj7&!*P7z^Xdj*o^_ zijJqdr%xzOTWFOIMdW$o$f7KH9BU2Y5|cStE=x{dU;M}`ESL?t6t+gnn~~C)NMBN3 zn<`m=cRA7G8!UNh6lR^paF*NjEhh!|)>ADFk|*WTFCjiDQDsXe8~JBmlW~&6_xoE6!sOy&XI^brONP2C8r^M4qV%p zwqpk0IQoi594zM;EKyq@OwZUWI54pi(=rI`ap1tjOtk9FlS}RF_le_hC4b`bNpE6b z$7=jBF(3;hV&t^L<$Pxp{bS-dT*04a(fxla$`+DE_fH&$>1NSHWwJt5hPU+MY5_(t zyKft=w)(LlGgg+%$Tyh`!f;utaWbU=4&6@Vyu>A{@uh{eRVsir-0^~(Y|(b!g?cpG zE0YecPe|4>QU!2ds*~>-oxE3f@;}?h7`7S^JkV0aSo}9_*^+W_{_&3((-jPsh!hVL z9~E(4KP$8YL>`uARfeT0npFjOyD!aQj>EC0V>KxaYbOQptcEaZqI`PNIIQDOyfA4c z9`9I3_yrEVcvbj_r3c+M=^Tq!NAkVHB6 zV4{4xZyP?hR12?J5T7iQ7A^eD;Ml|`*I-^ojGiw8NrUYZ1GyA(Sw{iB@c4yTWTA2C z8-3*?@0OS!XXrBHANqKCC&$v#5rQr&1S<}W;r8*Bsxuz0BxQZ!Susd;#{FlJV0U_A zxFlb2M2tJts)Gw>ou$>OpFDmxy04Oz>PC-=As*nfX)IwpJIV`(wq3NIm5GMw z##rck{oxCRetg|o_W)}WMS6q1(2wuG<9oq^lVc3+%B3CarbZ_-!B@yc7Ffyd3SKFU z33haz$3YChWMhxQ>c;1tvjah<7hXQUg{LQeVA8VJ#pZ&BEhsn zz2XvFL);T7)W&BFL1THQAvJw`?9S%O)Bx8Q z16<1iV1?hWD;Q;rZI^hox}1v+Ziz}Uzg)wDdZaQ#YukgR9LpL5=EO`b5?odzG*jU5 zjv+iXX(gHim=M6|01^SsGk=@bdq*6ln>HpqhfgAh8=vz+eRJGI0e*Jztbt-i9 z3mOBk@t}1)%KS5!WSZKxri;%xf$mJ+G#~7zrB|N>Z_;+qQ4&#|9r&?A$L7rI8`2)3 zuPU@$G{3J#U;bwNn$g#9W<+Yg-0aF7Cs1nSwRb*QJe(5FMhS|oh!RMH1f4R_bPcqc zA3em6Q~+O|nLgQn>PrXY^{F|1tgoI^@kxsc;Ejspye{jj=k@i9gXZ;r?X`HL4`nhg zc}CKfGu`ak6YN^C^i!SjX2m}4z2$u=%9Thl;yM+_)e@A&5|r91%BUW3L^rn#)#((fh~l~B|EthbL9-d{-%6% zaG#~@m^m~hE}hWIjr-}DT3ovQc+KIqovHca9mi8G$STDdVN436IgDp549ooRpl;0Y z>TaN!u+C2pdND2eLZ@XT|H7S4uF?~ ziP zg#j7PMS)ePl1&7Z9V>@w$C{qYeJ3y+_^Q-Q(I~14@Ub@}k%gmVfXt8qstnhpT9t^_ zFm`(h7`(@*M~hT#-g@Q$nlXe&?~h)cqXKSmX-Cnnp>L+WF1x)td(ZwMYYcrx72t}Z zHV*WP)HLn)&Xb7tfL}f&U*q5RdqYwxK4Fg6n@W@&i-%<5CrfoI-1n&y2+RLef3t6} zPR4d3@6#&~yz12(YJ10e+&U>=dg=s-LGhJNV9eF8l?;qa$3+%k?g@SgN<=m>zE}_s z6i6PIXU0(aA$~o9`#(>v)%=|q<$@A9MS}kzhDCyiH?i!KLyW~0-0r0_vkb2fNz#=n z!1AItWyjY;^eS+=U-Z_?YP{63TE`o1Jymbo_5mS0KBXBUejg zWf~sZ+)|4H@uEQDvyv&(W zNCqrE*(oD1W)?PDLKqc*3W0b$J1@T2GsN_y;isZDUWH0aSfOCD6NgsgC%YSMQvw<% zg&*znaNQIqHE7JR`o+cQ)3D$wYc^&lDn(zr(pCFC88VZL56kr&yiufS<)I-2{wyxy z26$1A!wJ?v42krF1?BR9tZHYA!6wfJS&^9lYCITt3VcHGmguizpBM4}m z?^r=o>6!G(V8hwrB!092%Zu0nri-|6zUqt@xwG-AHx$xDSuVtuQ_GylbQ^S}-NxEl zn#3jZ*}19u?}Yw)0{^}x)s3~Y&2C(C5|2S2tV=Xbia?S%<;nAX*NO9VRvW?Wa;?kl zI?*pxgLzgTZ=8R%bIghsoJ0ch$zp2zg1zNicrvAwsLzW0l0(hsuEAQI*;W)9bm9;x zsf`mJIhdmQ{Y74J3hmn-6~M=XlbyJ$NDCQT1|KA3{BPaaf)|dD;p6cEL3`&AJ{eEe zL~X#H#LpB6emJqU5RJ6oM^2})i^-@=7~9sl<~Ub!!kCH2$SLdVDP!f%`*lti%7;n7 zN$rj12d{Esin+v3=_USrSf#ndH=aoT9fGxb6w^*r5oS1;DF8eq{mrn`dcu=shnI3C zQ^mQ2=6(JtOD$)~O=e@?p2U>A!_U?W`S2OZljOCNzGsNaIjRhIm#0{Z{R&lpttZhG ziyf0{B!ZheR+AsyafZegZat}jzg{ip;yij{g}7|1Y)I^*f06wx4;#5f_MOEq4k!#B>&SG#2rnv&AEeb%1OHlcozY+)^gzbMGyn zByhoQ>KBGSBaYi7DBp@tY`qRh(B?D#{Gc9Lps!| zhkHos#TeGzU4nAA1Z9X;smkz~o*#o_95|^BT?wehrFTk{>8WHP zeLncITqk;*e`1UsJ&qlvlaXjhEp>O1pg0O8YPgVTZv2+_p02U6B+Yz|1WS04!JwX1 z2Q_*B$!%Dis7qaau=RFxWpDH)-2qg*B2qPUreHkbG)ampxx*}apHH)vh&Wy+pDY(* zX*QppT==9(@F8D_`BdOKbUI~~lwd;~Tr%6pRVTZLDmyMeLmx+4 zC|GuKBkml`YQN#OmIirUmEn_AbE*J$`8dp%&)~mToRlpQX5Id(Of!OczBU=on;{ob zUt-_LUXrT7+IDkHuX0S%kB8IxRMjlat-IP6;`0~yT#R0;0zBoTKa;^|%XG_|QZ2t` zw7lHcCfDfjOC+9_>zR|?3^!ZOX4r}N9n7K zonUh3k2$xPenychz_gPo#~#q**Ayf8+}9?U#Eo-ps`sh@@A}%{sGw3O#XQrQY}X~) zGB&r2a_deX1tT=wnIiO(yUo$vTHGz8fw!Y*#Nn8ZUWadho!He z*(ol33_^-ckWdKsH5Uoh8<*f)xG}f665k@_b|;h|H-YP#!`Osuf;j(eI9(%_H9N(J zsduL1m2(!E{eGz*5d^PT{0F56d^E9isCcl>;ubuW2v8P&BSc1T$3kL;c-e0;r#BZB zP9|((Cky8Z&Zn_v zk06_^x@jgH>eotdNLi*T!7G+(-Xq`=jBrW=a$}N37ofiA@eUtFtkb!71*Zl|fY8|j zH?8kM6Pdbou{i~wa|-$|)YQAUOnbpU^ifL4<;Yj0n%~%ua49^PFbDL8Wu9PJqOuPa zW5Mf|3jI^?h9!na)8$^V)C*Q7%VC4XEv4rO9-*N5ilvpX8D+&ze3gjt$nLL17=M`Umy;)!}4bgZ0HLdWi>c z_mO{`LeTyKaoMsA*=^eWW-mYPuQRd*#c^LQ4V9C{CGSX7dT|TG>XoM?N?8ProL%rb zGB&e6L_g28e$^7>Q7VpJjFS)XKry%xqndBBg#=%>WHPEbq*w9pQOz`Z=M6Wbns2hj zR2im+S&`;5_@qBiCR|iUvO!DOR%nc&WT`oZ83VfEX=^r~j~DeCJOl|RY}xGO_K-ej zZtWMtqgJXb*bpb!VkWj(2~*(O5T?NF0l6c^gZub;h%K3Ab#1zZX9tjpG%#L(rCIso zp@8O+>-(*zPT>B_UTykfz)0!v}pElvo#Lt%h%x7A0b;2n@({A;kId5MM(85A+Ia{aefD?iQmwkxv zrVBRV8>m5vcy0*QB?F-MXn)GCwDinSo$5m7iKfe|2l^$4no{RR86hKi1Ybrg71M@CWH4LWTas*P#=vj?iSnGyCteR;MQPMDLKVgr?`ix4uYG4buvZ@ zc$<)v%6L+<<6NO5y4aBEK0bvmWm_NP^IL*VrMWWZBpS7orB7fo##HG~jMD$uEx}3u zR2^`8Fc3IRo1r$I(x`WA11{hFEK1Mo_uDhFDw>U&*FlH<@#Fh=CgxcE_#>Wf@mEW|%#-l$h^>VxvifgfM5H>vk-<7-ltoL7S<;!eC|jY)rUnqT5h?6HKXIN}x$ zTCJ^IxK!Oc>EuW_h4h3oomgk}%7u9}xlxmK3HpSLwZx40QtY+HNEfr?HG*LNF_u;MespOJ{ROcTPtZI_gXZBQ}t|3*Yhm&$>WjUu=%m1g)jiT zW1|$EhsRs=CVa^j!*fP$&k!|6qkTs&o^8p;Gd4G#Z3*x>o^5er4GCjXKwOTaC*$yt zAdkX)q?DHC>zm0!Ct{DK72mMj-sV7(YF@UrOBO|TPW(IZaB}}WXY=;Lv%E0%-|Q(G zagGY9iFi}L{E%ichIpzs=H-`n+p!yUZLlbw1 zOC0EyEj~P*n1$yoUIg=Tir272t=3VBo-^|$Px|TvQ}^qg;klJmBiPkkM}A|cWR00< z70=L>C&)4q3E>5~;(@Jtr1UOCf(x^gh0%yFn)%CtTj56rw@`#%pne>AwhYA7z(Bc0 z{~K}br%j9-C|J}o?mv^VzRwf$Y?_oWXNx5Ao$*<6FfIRN^9rWc32q`8?X>yj)LOZS zOrlEXu=3fC{r!WPi%W#JiLDk|^F5A|lJO;|4@hl+^p#ii9MF#J69?{Z35X|O@CoZp z1kU5dW|=88@U-WW#J|)EW^SRzFW70xR$7zi82PFbwGaw}L8A1_&k+{_Zb3L;Kx9zd z$jf!A`0G?!eq8i3Ud%JQvzx}02d%7-BI{Bs`n2hrW-x_$^~Q{GtD(4T`d}$nI(VR7 z4Mh_V`oZFw&*B~3>SL?G@8*wF^VP>zoS4mj)7$M>E)5cqMdA_LfISj*Jcyi-#Cu9a zdf`;3l%qH##XU94^hqyC;Mqc1`UVX~_6Sp; zT^3H=lQHeZbW1Zd(~N)d5Ht6K zCY0p5erai=2uU}J&0wwV2i5wRmDATxN+cN9LhJYw0$dWtl@ArnN;suT&X%C8yy2G&S+6I?LD}6mDtV%w=kGG}BXR z%KAAQlC>ygam0p)=O;ZRW6FILC{;*;O35lJnA8Mm>e^z`vzkf4Dk#2`2C+6>>m7Q? z#pIu#*|JfVsTAHP`^F(|H00|mXtt$ZeArScp3~`*vxSrreB2VyzUm;QpImIR?d5`> zeVnj+DxWp`^O$RosLHH9;uRz zW_=r3pZMI8OFn{2bQZuP=yMuCK6BFUWCK2)j)DvJaW`kt-)YM;s%t=(i+`#GyE zj>mbTog+~h8keBHK;?6Z$bFh&MC5h)6EBg7oGJ|jzQ}#rBBT>@{^c)@4lVcP`9mGeR$$xzyLE|5e{;7ZQvEzRJO-H8VQ3gj`b3Xrm z@%&mcN?WV(zj=dHA8fR{bNd*VFF!Kn2Oj&c>#pm5QOsr@JU#irBmhN^=U@CAaegz} z_}{-RWqiFVVe+u{H_g%BKnY5GGHAjC*c&JEet;IT6`g<6Cj{(JQY;pIed~|S0W}QQ z(b`GVf>1RZ&2wzVASstmIns=e1QRO-o!k>Kl$Y&!QoLyETV|{4*=jNMV2+i%Vy3d= zRZBKPJV`xjSW@5P%^rhkt;sO<=CrrXI^IOLjBi9+w&F|a8#!Z-L}eK{?jrtmK$CUw z44tZ0qIm_{$1{XfYj;aA?Ff^_ z$K6Bbi$mOk3G=Bl+q$D8*^YzYp>^WHIH#ZsGo0@@P20z3ONnEXk=80E198bX!BMR| zBBBz+h55*CEk*4(WXHtuDMOb9(MmZFc_E3&Herr*k4z9>$%N-hOHn-zxv`Q792Jpt zs16`6hH9svSF7a7Kyk@JaY-(Fk`I$p)ES$p{T6a}7N!ocY3a8g7;k-&e!DjPc2Pz*-L(j( z)s|^2tK}oJ?$!Ezi?~wiZch5$^ZMOF@kl}XeM$QLr=7ZGWEGNLa|`>XdRCiyzsQQU z1k3x?FkGYDDi<53Y7A}a-hR7a+f-&8T4WV;As1tehXbAG;i9zmaZq(HlTQ(QuW|+D zjJ{oD#YrIv(x>vQCB&a4w09N~dTXA9i>xRPp~cDN5uXqzK9EMPb=GX%^i%O7Rfc;G zE`L&J0+kR-EJ0mnou!otc2e77OLG1eS@8)wrR*49lq{N0D{-!rb9@oH#5ugeYD1K^ zg;W`OrG%G7R=i=Mn>gh(b#Y{mCj$DLmn|%OU8-OFb{HN}jB;R=H#g^#%yuAKA17C{ zwt3Apn55OfvJ@Mr{W#fIKaM3FQ-ZQh%C-D4K|DQ5d3%(~#e^d9DZjuGDk&}De12zH zqG-!;(xNQEBWj85&J>QZ_59BFNn?c;7;x@e@|J^5d(P zBG~<^GZxvhl^?HDC*|VKv$@gDul!VX#d9{VZBe;6qloX;a}@-)Bm&}My<6i{WGOz~ zZuKW+Q9t}#7(~MYh^UK+_i3V={=lABQq^_h1R4<1<2Lf=g?# z$r8h!cnyxLht-RCjXWtcWTtqezxe7j2#F@W2&Otq=pZ*Zgf$eyVIh7#%^Jg50bRrK z^>Ug7V68x7fM6a5SZkU6w7-`*lj6bGmTF{%1pDKZdfyix4s#1G4G6xl zc=elU`h&sbEOX@KnKE3U+*ogE#SUu>&(g+nRU)jzsI(zYY~2r#0ge_Q^6NQQf-RQ% z0)g9Y{t}P8E9EjrJgkZ8NDU7fN2_>bHaatq!BH;9>njYerio0ewIeA~ssZ>|k(icE z4M@2RRRge5X_CBssuR;}UNu0l#pY#)hjK47Gmxv8+-9IKO_WdhF=uKKi|tZg33A$Z zG#3d9^rzcxq1sX^r3r>nxk~wZ?$iK_f5YNZ$R`V0bOoQ;yy#RRLCNLAeNBv2-e&PC zKaSHEV2sL_a(;QceT9@OKdwr35kJ}Ll^-*V-+~+ClplwR&w*_;7~W%TgN+dJ1rj+; zcr}JcS}5CZvohW}&g^#$oU+H_)6q~Q!Q+{(>azSnI65S#<7_gn@AMaB3?)zs*N)x& zMLV8y<_Ys^`D8}1@*`SA*{yV>>WpKuwGD$eNc-g7V)1ZLbw#=~A4V}DUua|wO5}Kn za{GE?%8#L8H30LJS0c)fJEv4~iR_$&FQ?Y10hq76Qp=T~MLEK?V7>FF=o#E@=hmjt zqL@!VHWua%|SFvjqg5VLBXxcTgyRxKDB6&8h{(k zKCy>?>yzH>)Uj#maVyz>JQQzIe!OF)tN4AA#o3vhq<5{%(DE*+bht$2z#wJE?s%rbK(Dbbp^1f6 zL?Ny8KntdZYmL<;!dh}mRcAC&+GINUX!4bib9c(dMadUzsUxLamqgG|BRC``E%F(< zxN9*sAVD%BaYQJ=)=KcAQmK;Y$;BgX5C=UzK^cTZO^AaUr_n?$HKir`8WsYF==|{b zVU3|FET=J=Y7BN*y|iDA(c-s9%O9>%E>ZD`I!%R7#uN*#j2FQkW1t5uwxz|G9S`6q zeMx~)`lKXTj1e5*c@z`;Y>ka6#x?O8{A#7|o1%@2Z5>?r*JR;+)>v&ZrpIfz+gfcg z@o5LEE>CkopCnjOiBfRv;^>l)vFO|G!C(D-~ZfgRz5eLi68!po|751#huvw z-**1Wcnzl6XgZ~o?J7Q5Pl?%WT+U3DjL)Mo?33@g2kaFRWtK+taMPrEG{1I41@Blw zf+dMN@sWjG`5OXWBG{{yuLkC*MK~aade(p?RtkUv1oyX$lX4Xi%t>gmV?Br|j>>ZJ zN$yBuyADVYdDViNN*ouGh;0aLd*upY!V+8)&lijj9K_5uMAq})@^ie_T!iN>|1&!$ z>-oR2^X>ncolj4)^PqM`H`NHf(2Msx(QNA^T93o31(#08nSoL@fQEQ;x_BUAIov9O z*O~*|gbyPo!I82|PeN4U<{UbL5=8%ML1-Mh8Izc^R}dQ~xIG?VI^THUj7!nHBXG*V z@t9Z{z!~FY6&f>bVMF(*-EE3`S1Ve#qVlc;r96d-YfrzYYS{4C_gho%S6J~I^^0N& z&g2b_;>e@N^aGn$t+3MQ&BQhz*my#$u!;kVTh<_9N^{fpB)d_7kLVrYiABtJI=kK4 zREZTf*q5OX!$ExG7Od5Art_Vik8wP*!tuGIUcyyyE^lO9*X=z}?y)Kv^+Yf{t$K zmx3D-0qIvN3k*ZS*A_zGa_L*EV}Eb4#*`gjTCydmR#?X{g2L64MxyHk^Ace?#e*`t z)Cjb{-sYExJkRfbXbDIVpI9nzPa;qw_}Jo>AQn*x_>f6I^qBX@^KrS=dl&9VIC~2n z5@^0t+3`iPIUPi(%J8B#STb&z$x~NYaT~X)jFI3T2{PHUL?l>d8(`3dWnXeZR#>rt z(~VtmnyhiN^%?DN^C&y6wjSVOqT`b8hJrOQ!1DXz`MBBY7Y}yC-&A&7VGZeG-IBBN zY@8s7MQmO_&m`E2KtkF=7>?u-W*6&kOqU>Br*iRZJX05b(%MMv<+vDIx-hJTiq7tn zBsheob14*`yf49rX==r}VL^U1jv>^YCVf?g9#r;dh+bjE6V^sd4dVq%1;$YJrR(2; zE?!lD=W?=jYipy^agkHNyO{KBKb^>@bLlRjV3#X>q?i07SB4j83_=i6u1CXBb44 zG;sD`vFLb+g%i z$|$KBZgvVX8tD%U)5Db|!KVk}xR_uRTfbM&poeqs(Q|K1IXw#c?By(T${kck4tf%# ziZ0C8A$znmMC-Oo{QXWAX0}aDW8uk^F=}Z?!O2vP))6vaD<@05R&^%kgGI$hA1UmIFL~ylJg7=MxMVtx2w@CUMfo&j{6>jN53Q^QwM`OQBsuXV!3OD;`7BQ_rO}f` zY`2AjcR+7UQAQnGXDSRMSF*2FIHM{c(;s=I$vEx*#&LZ3Y?S4=eH)p zZn~Bnhf9=v%7J)3tSfGlWfB#~dz=Af$1H0$&ZdKAB~Q#m9UAK{6vsBnN;zjN9g|Jn zVMRwag)Y_VcB@c0_sM;H+`{i~w~FH>iOL&)dh(P+W%Hk&yw4qD{qr*#U}2kgP&vo* z0&G9%fjDm9hw9)$;<%pA>?{6M?m9k`KbPa(W9abbXGrL$j=wyO>!%(6^0Y-i&G^gH zX8p9&U!G3YPY?Oa(<%CC=f6B{(oehS5ll%rzW;MPOaYg$0xC%XE%fT$pMVRDE&tjMcIJioiT-HMAd)g4wr zR<z0k?#Vzik@a8*k{(2ZA%Rk6)W)=<}A6z&G(=%YHi2EC|QJ8^5EJ;zEdcsbzF~0PC@6^Q-$f!P(K}AT4hkmTR5$Y zIgqPt-7ZMkKH`9FjV25l?4Sd2sc%!irVP4`#_V#--E%!qN3zS!~q;O~t>6;_v z%7a~T-lxwpTbidQx5DA%iQSb4vye^CTwiAFZG!R&gr?1~;7D(-%%00b1{aJI923ix z(J~kR3}c0zw-{sE)Jhys*#xO{CrHIitZq5doSW&YTZT{BaYJ*F^5A>$HV^h>NwZT8 zVOP8JDnYZWL87LaH`pa(&=T%L6X`h=3L8?+p7wOzwt4!kJq6t{W(8nfBDDIPHDP`Jbye`>7(-8&4bz)$LXNphmE!8MY zpH|WrlOPv0)ku)>)lAtaT(X_w;X<62uRItK60G^J>w1iJ;j*wBRA7!^Wvj)N+H%vf z%%QxghtgkOk=Zh5f&^)r*Ivg#rFxcqf@_*9@eBUN@|1KptC?o+ma(8eJuK)zlbYjw z@tlsy)8Pnd%f5#Iucrmw{DO-En5eIK&K)WqM{gYN$3JILcjRxKP}w86s7Y{?mw-*$ zJ#3-=a-C3KcIj2$Gi8eeIW=F1x4XEwtL}@3xxP>#?%>y_6#bPzZ?Tg}W9O8B`Kj`N zFhUn=+F)&CH4n#0Pn)c6{&*~&Z@h9V4<6HRbTQ-Kf(;D#Wx@5_88TQy9D;DfbSGcZ zeHbDKb#ha@lI(4HGd*&SV&%amcyotJM1Szg6t?}Xa0G%mO_|Dr6?VVO9Lm5BLFW*m zOg<@>Gih4J^yYDF{13EJV`*(BruNQwC7*q2ClTk$sj_OK8iplPGKXk2-y=LhJm4-8 zyk%b@o-#EI4@?R0t9R}Cth$j?B!6R&@7NhT98`7|P#)}L8#>w8g9s>_N!rdG2sb zQ!A7Qmp2oqDwsQkTkCs%A-QTe_90t&a3$G@tkkJ>f@-+nNTvshC=X$CLGjVacL%$M z&+IW}7u-B0Y^?T9`*!BpxqC_`&AR%^z~}o^h?WGuI=fPN@D{f*d!<|c!S2@oc5;~e z?R4BR{F2(a9n+@FVppYFUpV*`=Uwody#iSwk~1TPnwXo`gL}x+p3-sYSs0f|bE;1- z-N#er8?62=V+uc>k~~39R30ocC~s}*S(<4sv1bn_@BqUzOL1}7OVYi0Dyd+BB1g-S zq0)ogmnabp`drjZKM9je55Zb^F`B+$4_>hNB`O}>m*1y2dDQ>)eA}h6hhwp|LT1Pu zVHVbY{Fk!hJ!8Q4NQI_f*xdNYnvKQraXJW~mcMth^;#ow)7SD9p=1EYW>^$9X zw-_#-j&26Gx~I{Z;)@kYmioP=K9{VAy_qL7fO)bUgTrOEV~tgu*30a|dk#v|1LS5N z;yNLU~xdfNc%{oVdXNZ?!qk;^76&IRQ!lLXSE)A!T)trBrgS$FIcZ|$#2p(+Wcj)! zTR)}b!aw(tl4y6Ji(w(9gnJWA^O&zUTTrSG3I=ZPWAvi zp(?Bj@s2s#B^fJvsUi4DlZPW}40l!sJ=`}qT+Zm?jBIhG04nVsv$f57`q;S_E%o~U zr8HCJ7^=B3`9Sa})dLNOb-__VFQ5jh5RKo+ zlt}V`vf~A__>=J>-PHmwa|)Zo1InSVQD-Kax=E@LbFpp zS&eF8{#Er?B_y*Mi+h+05{;E62IcRMzVjcJc{%Ja#0vFav5S?|; zW;F*K1C7Cdf^1ubv8W}*$$|I5Q&!E{J+e?DB{E7pIYJx*Z@r|6n2P35nIU5(xKJ3- z(N}1qP<;e5$uBfdCew_IM?-M+lzGHhj4U*Bg9XtNP{(4C&9C}kb4w8`xiXQj`k>Y7 zl|oEm(62`#jK#(gdP~#ijOM^V!Gr+4U>Y*4{}Or_f=A1Ov<-G^KXW)=b2#c)e5o-N zxIW>O26lEG(8O0N&5*%~D%?`c0Zri3MkshKGOyVh?uc`utBK;8H?@!c(R zBua1T*DV3IFrU%uf-mFK^)IViPS72=D?W=4KG2jb9c#Oss>*PAoZU3~alqCldXb;#)GiU#2QN)1;+j9vsapTY zPYRKxgNzmZD$cAl^nUii@BCH<5dgxiN9RO8bu8Ytcsa>S5=Gi$YMdAuZi93u(HiR@ z#)V;tmyzIjZ5Kz5Yi-q1&IDCETS$Af$7Ps^%mU7h>Z?&vpkq2yE z4c{Ha^J1=e21|rHcvFiW_j10ig)@eW@@c7Nrn4BQ$>1_XD)_`_JJev9Ii)7OY~Vq` zTrP#;yI#=2t7Gj;OF2uMxm~cbfyd{jBYGcOlv2n&fHd?;h7J@_HoOKPmPKZ@< z(%UIevFlrnNxwr+y4IinZFbjxJL!0gnW4|8gE4}UPV@+o4!3G(lff4S-&v}Y{IJg8 zhpG?e>Fsx>@G{;A_p>?{tE?e*i^rT#7(Mn&bDHFDvoa#>c=6qg9X9X9m`5O%mT2Tt zRferCEUGD7aD{49H(3S0G&@xvJZIUb+`RB;MJSZAq_F#CM|od&HR z!Y%Gt$X@aB8lzL~@#)<411YFVu(^t{q==6rLb^$VwkbYfm%D zUWi}EUSVpWkf=0RLu0h?4r{A;)Cq#^`f#L-SE^3H7dGCfHJ4r)8_&bs;!^3u z!~TycJT|Ye``D%NzqRpu0X2V0xYqaoX8>Y2%To~4aB^cOcOU9^e4Vxo= zoFmo_1A9BQs(2-H@y!#oGwt9H7O!AoB2zq4D?YqvsStGM26yz=s+Nbo1_wH|57Yo# zX3q#Z0QW#zP{s((cH&t}1#KKY$r5Vm{GyNaqZ2Hb%0!{~us`k;TxpHv30_v&!^I^H z+I`+m9)uOzQ0f!hGnIj?KJk(4$gSQfl$qEO51^x0JX(dt3znEPh%a?=oI zw;F;&(5enHdeG_@Y>iV}($DU*R;Mg6wdoJrr5j#Pf4Iy_XN`|tdp7RG8mk|hG~ixW zF|iVBt$u9$)01bde!QA~vcg)QYG!M?nTMqt-6^d1;kXm8S^aoMe?!%r^}cTP<7xeb zsyv=g*HTh$j`EeHFsXo|;kYI9vFl3LopuJM;4hLT>p3?JW0?pWh-={XI zKA5ij15{_sZqAe}QtQ`jf?fK3YO>L9_@t){Vv~Xgo3ya{u5R&{sR1&DTM`uFeo<~z zg-tzYusP!W(k){n{h;R*iYGiuKJ<$Zi7l=A#XKf>G-Dz|tsD>fs+X>6>)>2=>_BTE}A8mB9w1;;5D= zuRM!N6pLE|tl$HiA3w&mt^0*|zA#r`RPd^eCD}S#S*)|A2Z;-obF?|#fybN3#YVHG z4H6=hPNF4hIBuE31=?<}Kv$yPa|Iv7Gx36D1y(2W1@~I{G+K)Hn7TsxNV#CUM!E!b z=1{$>xHQW&w|@f+^zAHoshL9aDlU`YOUw7?GrmBA=QFuQf+s*9DaTb-x8R(79bh35 z_Ahw4E!#Mar&XA1^?QeI8Q)a(W3@kXrE#rzZxJSnz#-3&@(*V|69*}t1eN*|Vm zs~W5-@ktX^Zr+A6`)@bh_Ynu$#jSy6ygQ1lB6t&~)bNZDk6c2gHHe;)@F-Ygq8D_z z_#8cmNfMijnH>*Uf5X@sbY*5m55~?C99=zFqVj=6+>jzFYMO=wje~`MX;u$T4X(DZZ zKDalL&mZquvITAN9}J0hzO_xF!ym+j0lA5BJ-@Kl%h*51PNUY_;`_+mtaLL4X{=|( zVezGmhim_7(%-!uyNOE*P41h1^FYUL84=#Qk}DqdtW~geQe9y&`zpAzqhCMzcv7Ym z7ScXONEda&J39IaZfg*aEtw>+_B^w(&pK*d-AC#;i<#GmU+9Cy4!UHR70Q8gsDh!7 zALlwr{k{Ckj%y}6(Yr$R!95N)6`35jDnQ6dPgf)P_RS9Z;yMeywzL_N)=h~GEZ9{S zx6b1-9U&1JK)AnnqD~Osh4=^GybiUTSF(!K9^vj@eS2D`(3&a-I~B zQQF-49P#M;5{?(2oJ-aBljbny!aV^yn=|{c$#!fXoFcB0k;(cmx8gaAHms5-dE`uX z7cJxH47D9%@W}Rq3cp7ab1^emEH`e^x^M)y#jTEZ@u&?x*=FuU;w35sJADMh*QZ3ixSa@VriKbna8vfW}ec*rQigU!?p z(_-nVnQzs{H=Q+}Ta73{4q%IYg}8K0_e^0J3A28XKo-a#0UCKyHrEIkN{%+c1kE|t zI*3)jJ`vU*zS!8L+<3&{E*{9@)<*GZAVgpNcGcv3E$Mh5(W;r*z_*P5<|$} z+)^h#U3h&{k+={qLZ=FuS<7OW=V(2Zlelkk4aSA}-8@G~fW4Dq^iyIozps=qp5*>~t7w|7-zk#ggY z4jih72~Q3hDt=>ol3OTQ`s_s=MqGH`azGejt|@7L z2j)!Vl788^h2jhO@3iEyQUhcs7j}qg+Qes#Tf`PK)_ff8uWrF|vxe8wHB8WDlpD*; zx9j!W(X9Vm{T3s_wxn-)>zFjfw9@qCmx!S!5D@I>CLYyA@Dgpcr*TkETC36G(JsYws6K z%@^3cdE%jU42RAWp98;JyizDViv_KTd~xOSOptOyf^x4dOzF*n>i~hpF#8 zhI`^FNB7qU4m@q(Wphj9RA%fcp@gmbHzh3ZiYp~ZtsR^0;{b-5_$X|P;~pw_o+mf^y%xNvj~gaF}^Oj#sZDYL(2 ze7b>0QVrCKi_qr_;zEsL}60D z2qTwH<@6`S)hG@mc1RF5@4!I=1qn)-PYTmhdUSxVOFY+05Ep04yONcno@tZPtu5si zA{m~`qb|tV^I&qFZjU~Mol+!pQmXZ`2;LzN6~2{6Lc+`TEcWDt+Emcnv!IuHKvF0I)@>%Ww12J?PB!u zsg}V1)cq%I+3ddiZ{1&&?EZ!p=efE=k0iSqEEW1U4M*787CORKS+U0EXa1R>Y|`Cb z(-MAAf3?ciCJ~96!q?WObeC_TNmG1-cuT~Ynz&$JA|82^B8jbCJmRKni(7;&tV-zV zDHIo@raV%`biCH;DmjHR;4XnOrOl)bKTNqNPb(S4t44XOeHFq4~|}A#OuAf@VE}Bi-VW z7Z^h15@a(>oUR%q_K8n>y&T07v~^4hQK=dt+D*@}W+k}EN(gXJMet2Lz}rPr0@~J8 zaW~#)0tBg&5fXKj%53r7FE?rKN-a0xqzXp^wAfsGI6>HN521BRz8a3-I#o!Nr`(JQ z^Ust9+izA}wohn77zm-np?zb9mt3Bgpju-UjNivE9B#o^b~iR#yuHMu)>yHusZNTe zr#KGJ6PJ8YS}JG`u;`(jg;I2P^Fosn!J+MXs|Lj-E@|PXB?0BeKrioFsp9YRGBr-c zjbH3B-2xvjZ=&lij~bd=xp53Fhrf*&U@J+oMP;US5gi1(WU!vyz9E0^Kj zrZAQYd*Kqi(-aseeZ|9XH>ensjjvK}JT{eP4F{;^O06*e5&r~hWjSXdzD1(8fjoTU zH8!X5f2>K=V67!aJ+&jRBO;)YQA30qMa3~&e2hK9>lVNC6qk%88k6sMr60x9lO5e} zC_Q`Th}sciE1**NByVVN?$*@d6Px?j5nQ~bb}!zZk}o}ZMoUPdI#>|#4HDHNQDBW0WW5S?w<)4&$4kP9m1UD}zmdI+MsdTVJdQxz=74N1N;*(O6L9Il1(}V5U-9jmSxdcZj-fK*h zN<_J_!5Y#gvPTe7ZftF)DJQCB653WH6d38l_eiUXVb@f8hH1Hv2&p-u+=4dc)iI($ zT$Gv8sw~%-oqWX3O`I!LXV>ZkEi{FBn3GntsfkG`zS08u2@=87I;fCLpzxPeAc6QFSX06}bwJOC}LZ4=pOX6FU8*f`_c%Le+k@Qz45d-b%&mI=$VF@t!0H@{) z9&L6G7rY9p#dx%tnWjj0K_(u<9Mz5|6I4605YJ4h_Bm~4C%)^@En_24&9!eNSaX=* z+h)q(_riY+f4$S3DOJji`{A$Vy;haN3?m#qwJhYds$qCq;}YD0=i%o!Pw^Y^$<@k@ z8MbyjZuJ5c;=_>XX#4@EgfOHA-WB4&J8`Greybbr#5V|*SQ`g9as{V51qEJZ$1P1x z<;HfY5SR3ppy2&@leh$TTc6?7E~aehz=v^KW3bG+gbyidj2S9HcBH*|rE+7Z(W|-5 znKIb;$<7hN!fcGUHiemgrGe3iXwHYtTPTG(4U2N)UWv)cy4W2}nH=FKQq4vf^yoPA zMBY*@ZNg+=ZOxTZ&JsVv%cieoYvR#!@H1itMD?r2I_1V~9V*0y+Y(`XYFUEnuwWoB zPj#T4Y~9voWdg5XxZT_1J0yxvtX{Oo-xPY$N*%ehXOJ1UN>F&+p)HE}@qN?`Kev9w z&T$3`iT$Ddh&L$?rPq_&g0eAR_-JnM3BB_nH4N*Un~aU{gwgkx^!gcne+)5H*V+0T z^lO=GlFmK{vkd*zQiQ8)OnVEPp9C~qu)ld64_LC&D-qK7R+MX^JYWCcb&+@_*km9A zlBU(Q>3XlFwF#fK6ybK8m)517$^Fqbb&Yc4C&m3iI3Ca6$mM6#$dYMGhA2(D(d^$d ztcSsfHYe7#>=Qg`^I~1gO2JdM)>6kYwEQ#M>FSm{Ii1gHFF0Y4QkW|~tymrPr*nPn zO=jJjJL+N#uuTpS4yNn1)qX(_G`0hMS z-ZN~m?cx=emM=bGpa^e;=R9O=7MDyRW1N9RrZ`5Y-GI|>N!Hm5d8A66f;U%n#v)$f zu6hYRn7C3r!c;h)aaKA~x@3WyGpa=w*fDV&xmpW-XyuAt>!P3TtR@3NYb5onoBV*N3Wz2v=xl=3o#9GieKxjcprs{>Y z78;|<7*X$4z3^q6nDw7+*%DE`#DQ5YJ80DWrDKI0P`&W-#7uFlN?##AZ9#JE|2|(C2tS$GyQ@9uS}tY)egUa^G2=9#fD*-9^b&qY&ZIL@zn z;e6sq79}_rAL>e0t1@)wFfJm_pJQB-U}a3Up!31C>Ot<;gZwx-NLzQ@-Lj9lU?UPV z(K1_8ZT{Pl<=kfW>VT!2M0L792>pS1f(^njx9=J=RUT${(5c3E@rPhe2fui@S}U8F zYKd6uk>ZnMv_kKZE=3)U-=TC=RAxLZim!bkP?n)H9hDl}$qUx`rrM zjY~3gZ3Pmh_NmX8fn>ueS;%rnas+v}g&JIOe{Rw<$^1c=A5)YUN)Y22&KT07qK6Pu zyx$>Pm@M+SNzC<=C-}tb$9o;z{goYSCl#qYKG3SPOE8gLD^zyOi8F3BPq0gi89^Ew ztQ9(D@&|`jF9fqD2P8<#g)il0&uKS1`4n|F+6_)oc1({uRUQsl2?)*=SVO$0FDOi& z>0+>ZvG{DK?mmO#C6=9XZcri|+gfSFTAd;5iWV-~(dJD8;7u;cbD{lCvt9cMR>6kmEfVBFo&mEd50;2HUc`cUrYgg28ox!#&ch}&GMq7)2DtVvv${`USd(h2 zPESFE+tY8E;bejIqdRnQGxM?J3EqRBOmna*!+kA9NgqHSKDCDMleJovVNna6!@0aS z%gGPkriF#n&WWL6b8i1eD-odo}Kv5}@Yykv*HU`~0Lzak1x5cl7s6)9yza4V0(s zxU)G)-&^4qObwR^T8QNjGK1SusfC@k$n550?56l8XyJS)Bgm*Md^B~wl(U`tm7h8( zSMi5E&E_iVDP64C`P3>hYqSt$!at=FDJ~J06wApHtdbk}tX84}%=lGy zf&k54%8rkx78yObOYulPU)k}^RPNIom0vtER@u=`1SmVX6<#bO!QhoCPQf~hUxE%S zOXTBqixkFe2T#2qQpBu+VVvaVJyPfyk_b)@ z;AFQrVBIT03mRy_`A-KiK+}&r}vNG14ZzVPqYM=3|!fo{`gsf zkpvz5R0Xa{1XLb=vgjYP5}6FeWM6(_av&`d(DJ~*9j4m27@rU>f;w(%gNd!R$0lG= z^Iv(}_4Y=J`#9mF!QxZYWv*;?l5c2ThO7x*wbY8+n)CY?- zqxQSTqx?+n8#X5M1YuC>;4wtkLtf~b7t39hon*`JQ8KkRfS&(U!JM$VIHt+L~eRDIj*G{aGab8O=9zMYz!e98`XE#7ROqFL6T zPX+9?hZvpP9L7cTmJ7O8l<54XO!+oYf*6^Z;-i*_%qe|Bx@9crFFwZ+f|H@$Tg?WRi#?M8G%CI+LN`Q=>py1KMOf<@l*PD_Ye7SIUUNI&4^LL}q(~Um= zp@W5HOijN0P4DEZrWSD~_t8FcNgyQ@oxZBt zP6GeeBB0>Z`GT^1Wfy$klw9gpr4d7%IH^LSGUf~^ma1gd@AsNW9!rI|tQP0Qk`iuk zY@YHbsvufLkWek)&!HZKi{B_6W;&z_tfb$FxP-l$SD#eLY^7UQsybkBj$p9!)Q;8 zr;zfm1@9Pz=fm0x#iLcJ%tkQ+IBX$aop8TqMRqiL564t0%qWhHSIo*sR*#5@fTHE~ty%%hx}I1a3Q1!rjO$_C>3z@FU z!!w3j^K9e4*!P0#93dSgJ}$sSz(FaeazVh8UGPF9iTRlhB<6S}5d>JH=j>qV`925v z8dWwNpZ1_Azs@7zxuflQjn3DgW6hgINZs(cdE*g^h( zN;u_3Y+q@P_kBHHN=`UT>sF{JMxuxhilv{BcrJ9JyZ0Y*ytrgBFXdT*^8z?x{h&do z2s$=WNTr<3gOz)zlnGQP2PkU`-gJZnSuwa{xHb{M&z2CLPQ1x+Tsb)@>;LA6q(t+8p6i%pY_ooFgd?{*Af zlyROL5I&4H)V^2%wNMU&R^+TU`|tw$P)wEQ z90?DQ<-8a)h6K|hdNjSoS^ayHc8Evx>Esha>=;PwxLtTxcTgOIr0kSaB!K5Fn!yTI zCjv4MFBw0v@}QiUPns=n(Jj;CJye)9k|{2m!%XG7Ts&u>c^n*mp%n{VDloN3pp%bs z8&rtTmXD@=kQK%u!!ABPiS~~?9-uzKvmNQ3I#qmENGV-p_ld`L94^|2qhgpk9m=bX zjEj?GV(K{bPL84~Ks_FX`X`2jZAn#r?bGHUuISW__Y(VLn)u{&86u@4 zj9djC=|$x~2|+A*#{6PoC#`!1#nFXQ3zzc4iIl3J$k1ExCH-S@hCcMI6?kV7iSD+9 z$^WUc%~*RJanqUviq?pFy)7RG0y z*&OAxHD;e5v81@-kA{K_I#jI2&+@0F!#YpKMY5xUkR2=buIxEgK$Y0 zXXzaUS4B!L+`85r*7j7dF>g`;Uw0(4d1zuLyUsh1vQ!@4>=e?;3g~~MJKv*i9nYsa z`ihlM-2-tRU_WJO!L@DT-&m;1!&{v~XbR)OgwdUi7PCL?&nEj*g}D>~g$a*5ItHKf+R)77kOD;H6rwDxAx6qyGc|cq5TuY*K~@TJi<9MneO7XKEO|t5p^D!<$!Cr6ViQfriF+R2g=pdmy;Q-X^O= z$N3w=4UL7@9j`+VH>P@`sxaS9KItIJbf%mvg>g9^lL8D>>JlO^(bq0qI13#^+PTmv zBshy{DKZRC#@2Poju&9{;ncW&It&9H+9phppfr?X0wI^KluxDhg=G0Ee90SXG`8Gn z1Tvi>*fAwvmT}5%x6e~{?3hx-6~?``>SPgYol+#_+FZ3*G$ZLgk3|FvZT#Z37HS}; z5NpC}ZnnE|OG{XYk`EH35fPgUNAJ~VOjK;wS@)o}4pYn|ezh-|{o74jDHm6KSIJ8n zZy~fA8x(YAbcpWg4of?0Fww`{vgAVRKc2*LX)F8Sx8^8s}XlxUPd+s}}D}%|sb#W22&HIoF`Q+09OrXNrd< z?^T<7>FaAeDMNeCD`rD)^M*F@3q6(`HE+ElSf-ZVvgFw?EnR#zU28(S2d@n&6SOwg zaqAo0s0x=;^x+M&uyGe{X-w`SRfQ`%Hqva*OV5%nJIkwPHa)$vpVi>>&`VgNMJ7+@;0ASRC!bgfs% z;$a(I7h75~S!@KsE@aM(`gFnm5vCN0W6tR*!MS8(vd@dH*rpvkzCjFIQ^yK!1$|44 zt%9$ci^#7M%*^q8srm8NgFfcvWzLqY1wMGg01c!up!%dc+<%x8}2I-Uxg0aw@d5U2C8VSm7 zWK@u&QXES*Uh;any6g1?gvO}nMOrH9i~l(BI*-7GjHJ9$2r7Q2hZ$K+BI^3ll+ z!lim>_{M}%8Z-z+^Jr|O?v-*2?y`r}aC|%^9~7c#nUtvNj2?}2f!8t&$`K%k$lfir zLhKCvLQ!%L?Bz7hr1`QGW9w*U;ES=lCHk7opb$jRP3Z*^k#d}_&kqt%*qFwgx02%? zjy;^k;uAQJs)F!LdUA@;$t}GFmll->!^nfUI4tN+Ul2yE5gg|i2f;<;#y-^;Xi zwR8z`vc8jc17>wY(^B!!JI#w~S0?hY-V#D$sc<2P=c4OTO*X8P%$J8~jy=4u={n+W@X-NWzuaF7PIK>wk&u!_p*lP887b#)#phY4AAV5bh{z@aZ_K&NnAdf zfx{0wx)aL!8g)>Om_;AL@Rl;sv)2-);rneKu;+HRQ>)bB|2z5PjoQ-!jh;;j&_10- z@3hpiRDAbR^Iqy(N-+;Lr;(P;Bg=hMRp7&WrWC2GeunDSK9IbIy)OeQ&JT^vxV?Z&njVl9Nf{=w&5QzoEL`FZR6 zXyA1sn~R_zv8*kw{#esP{Si|b%SB5Tv*>5S!!X@1U@bu}wJw8(22=AY=z3(pwuIWs zDAtT2E|mP0gJH?%fPXL=n9YT1fT|CiL&x~3x{UgVsjiGt!goRIb{@4o4??x|WLDSPRpCZ=-=r~$mrevC`f_ZjS^bARxYE4P7W7tq2qeDMrjvM`)S zvzI4OBYef+L~(HuEy+R)sL%Ikz)UpYI6srvoR8n9r^p6T)iS1I{fsyVi}vzzDv`6> zV)SgES)UP{dNNw|#Em`c>l6 zuejPh?B%ad#c&j12N=4aAm$kyUt+esR>2Fv&z>@w1B^ZTBO7+Pn_^k)8ZNg21s9rG zOwUA1*uksWmzR;pke@FG&K{3MopF?x0;R}=&jXeYJ+F^!WE@W#y=#N(#Q2W6K7t){ zuhiF{Mb}1FNhTD`sCJ$#Li?oB&MbuOctEOINc*96gty(*Ku=$`t%HzRWU}g{&uraD zLD4!C-MZzqGpJc9t4vkWvSD_o)qt1v*w=hk0LF zQ1@|i(!N<>CT5Y^4F$?p$U0^*?UkE@Iu`E@8$<%FZOze-!+oL{u83)Tm`*D@M#ln8<>c`Nvg~ zEpYHZ`8;`;VyDaFkc`288i#l=t%;?m=0@_3)qsPrf#T*A zxq%(WgQxN`xT_Fr5ZSNJ$3EXsNzqF6D5Gb-vk-4dOitRzx3UJ;$?9n8*DYq!-liPr zX*XcqshLb|S?H>DiJS2b`9%}ho@bTKVivuW5C*5C!4!cuwydJh62f98eb`hcX3_S< zFw^hNIrKq-zX*3a?Dgv4gB;>r9MawqGwCA)eK$0jJSfk z1i2qP3)9Q67?%n6G(!h2hQ{WX`+Q;+y}*7R!{_%4bwc-b zQ)0~&F^gKun5xUTifQm3s!sEv7jZh!pp{T93Q_+WUMw;TC6ji#$Q&*O*f^0MlEgmG ze);Rc=2g0_@(Uc62@f>mnO;ufmw7vmIE3eZLZR!L_kyCmT#UU*8^mx6;ME7Q*tJH!@q^SOz9m^s=_SzR(y|H zw5GKd6T*S^a6VIG!5pT9ZhA15hEh-3z9*mFiRYozgbtdK#vwYXhAX&$JFxA>R-HX( zr+gkA#nhC=l$Z%~CO&lqUtTI@BDL$#Ps^H@$%Az(r>f)iY1{RSIc=HlN=%m5jtaI< zIMI4gBU%)Qzng^#J6#XXW@Qk ztm?dOi=^8@lAJCtH05CY9!!LEYB$>dK@%QJ?9hF7v0E+!KWLNS)-u5CqkEd+#tP41 zS_~`TzQkM!^?sAwO`kFE7;oE(MJ8>I;b|{`>i%i-^ERA4#=IL$dz$olcXMJk`s2-L ztv-i0D=YOj{}U!QD7!_0kXVDcOoOcL>81j{Tg;;S5>wSoqxXNenz}yVEI{{3Z=z4r?nGRFWx07~pQit56?+3h5;p`7 zAK{E-FC#p&1JgNH!0Pye@uR&fUg`rm5;JLMV-9vcybEBW8#~{F8qBY7D}iM{O_nwV zd0U|MhWocX;Xa6N)Cd1or5M}f-HmDJ!P^u4`1NKJwzgOB>ZKO5OU%^pfF@?qTUs_m z7zCaeZ{V0{;%$ZLvc~uIuK!It$N}-TLYFnJL&yK5<u%L9q;<0;XUTy-fHEsr1+i8<{poEuycM%( zQ)~;2f5c4sUfvg0PPt_4vU1~c1)-u@p;}V_%Z#^3Av1Rik zkjq3roN>Mhs^+`^0F3{jo;8Y%Aokk`wF$+1+TS_E@b|_-A;{kbAlY+w2kag|ui2ATTObOZ^@%d({E@ zI>}42NO}q+!Ij1YcC_+19zJf`or{-T!_*H?O8dY}&87MS?B!?J%V&~S$^nfUO2+Y7 z?BY4>;xOb8)KE){3rr3*y`P2uBj9Iu9j{>*9t_}K#rsX;B+kQCj6>{X?>7w$<>`!a z_VPE>X!Trre+x}F(7>nm$t-QNer&~#a=FOHjcyy;%gH$eHEjxh7DT2eq~8l3R;NyQMQFzt<0vO{hO>l*P6G>d6@-|w*_oClVyz%aXgAw#S#r`our zV}OPCM&RWMd<%>>5IE-_Jc=icga<0v4ewt9r4JZ5N@=q;3*Cn*hp<-ye6wVo&KO-K z0o2i0$`ILb6zy4rZM48Vt!#s=dbjsaPO29Pw6pFYzi$ z=&z;U)njDV^wSHeYuUlaV^sJxcJPL{(@*0vlXs+1?R46K=t1m)q1^k}Y!^WFXC}sH zI+J59d)bYYk{mGu(Q_PPIt|=Bj@`6f$)(O{&UmIrl~j5>T0&1L#Zt?bI82X3b9gX4 ztAw?3#*4OtDOyHqHbo#nhZ*6BlW{tzxpYr72YlYk%1ZfJ$h1SrbTe&>=CB(-QelUt z;1T?=I401;(KPnbQ_5D2npVXf-=`;AtvsN&60!=W=M{OFJ{X0S$qF9M6Qr*gyJ;BM z9xr!^lAPq?D(NyyBelDlz3P$ra<-*d*e}&Z-drs*jL>g`#dP}FhM=p{AaN1XDVBDg zm`3|-rn2R9`qs9RqSm8fc^utZh?1>J`|m{m@0Z2`)0r++tTFj1+G9|@v2B(OLjV)<$rVGGuH$@1{FrIq3v56BqBMEwLPW-R5T(-4Rti|ey@X}DTt1n& z*-P)(K3CJ>~CTk!E?H<2py1Xpk0w1A)+&kng%f{cF-h!X0#8s>VH#(xvG=} zBZ@NKf8oN&$*v5Ju!GNI`wgR|3G~S6z`_*uT-0L*53w+P1&b7>-@%t$F5S*RfufX_7kw+DkW5#88*QWWl& z8W1A^!shAhFuSR1sL{Ax3Vknai~yk&&f-U;>Vk`Z#qM+@HWF~NJY&L{ z9H9CfrvABHh&-)fV{6iNaecyhYwd zsiqPSeYhFtafCN>h%aEfbobyC)9G_tCJ0;~g9_Jl`qWm+JH#%9>Bd+NMSdVPET*$M zjJj;y9FiG-H$dOFEtPSch{M3JE|!D!`-LqP&U*1km5av6T@gE>+!%W;sFoa*yH+o^ zS1%W0h+2E^riUqXonGj3z0hGQ!|m-b<*wJuAxfGdp4n5j@N~{+mzYjnww3A>YB~V0n_|oK6#V!#x-1V4U!;J;WT-lh zk58aZY{5{)dK=b9r0%2^>&Q$W9*27xaO~pe*dYz?{)Pu=Yzn&+x=Zc~UZ2RI_o69C zxfLnc!gDs`=QL}#?&yK?Ww~9ugoml13}6#Vi&?(L-x@2xO5CN;#7vl!#M1EHWy5>& z=_yQSpc1A}Y&9Z*ezBz@_mWr%JE#U6>gJg2h=1Cku)k7~v*=$@57UsXI1=uWM*^ne z8@LyX8B9B)V55-qu(FgxQbp_rgt75)K+K>gq8^#~l;Y>m5|Kc+NQ#)AvVp#9Nu^D)Kj6*K7J=qizb2SpJ4qb)2Fq<9`X1Z#9mCOkhRFnpHcImVUC z&_DoHPegOjGjx+)6MA9>(*sf2FS`*Vi#6%@a(&E0p%VJkhDI~l(PMt>VZf4${`g)m zbftozlD{gfaM&X}JEv@8c>l32`LCcny2m)`Va8AoMhdR@Sl$ zFYWuHF!i0nCx}U`(Vwh)HyrQYt3XPtjVm;4&o}ealu0zC{Zptp{wWy{M-t&x_#UiN`T`4@f;c z;ggwmM6)tD04mj$lH`aa*=3Qe(bODV)5Ua}Sj?-%WZE7};azOGoJ!BMhUCO#_=p0s zXf4};UfszKend>CEI+t()W913%>x(*rr%^LPEn`ogWDCy1U|N&UHMWZryONFc z*&&nu9x1~aSH$%v1Iq`B-@wr1fe3)9br}wd%4V}!w$brs>G~qnCzq-DbqG2NVbTSk z1l}pQg+eL?xf}RHH|`ULXt1jX4sg5mut*-kGCtZaRZ?(oq(mgpCMDG%{oQC~gSENl zjWK9=K_S?CivT^R;^pxLh3Sz<4iA=_PXf~mwqhEU4Y-vtC#rUzeEyo9;i%6g^ zWLKczwUJ5=K+*xz26)*UQw_1mXi9^D9NaXtNq>^i>hn%h4Yk&GN1PTI2(ycy<#g=d zZ`gK<47txI&;u}#Rp&HNNIVNDfBtYc&;Xug+GRpx8Z}wh>5j1mg&vxmY|7?3F zuXNiu3*!zYS)u$J@X$N*I1B0rga@ZB zP7Iv39{sSDgFi#^$aWxmhcfk;39BPn`2DS#%CKL!M0n_mNEzFCY>=u_isCJ3w}@l< zNlC^n)1yQ1Wm6`9nzRVY)-F{`DT!Z;q6iy=EJ4b;wonYT(M}i`gqr zj5}ly0S{~Ry0QndiQUspMVYR6vFr6>?87lwUxG8_QTSd)-S5~Si1M;mOrlM(5+r?K z!}QixP}I6VbYxpJ+^ou-oUzwvMFlXP8LS$5eCatB*qsI#b|ZE8uR&-L4%J7vBM$Yj zPMM!!Br=(4c@)7<(4Jpqd(g@@KQ zrkL{aypyep5oiS5r_oDR)8h~yszyITUcG<=T&~|PV-|3_%R={q-VXKwcnybUi2mT5 zgoi%0`K3$)BRHAqML33)9k^AM69PW&X0dk`Jh5pJ_L}O@d2S2&1<<2{wg8YX;DG2) zE3lxLeuZEIs98N8Qr}rYiWFd{vNq!M2^N~mbu{@>334*iy%BRPcblY4=X$oBFm%O> zUPXFeV6tdM)6L$>n`j}wR!2UE@8l7fzqdxSFd*+LlIyxPYOq}cz|(n{o>kx|0>);K zu}f+OfVcR21QI>WuJiGS5(KpV=&Qq+~ZqaMwF!Vj(P8@23=;29BH_BHlAo*Ac z>*DXvqZ?7_^@^YE+`v_=p8N|>XD_@z88g@Bv5?<;_{NsUAv%rf!OMg0gKc{;|EQgc z(Xj{Hp2ttts2v9!n!z);@K|#iwokI^+Sv<}no7U49Y9%Hp`-f6LbZb6*$5A4GZ1h| zdn^8u)j8S1w@b%2m9^v9A&2W$>>Nx#%fXh!%CP`-SI}0-x5w|d1lKmNh3R7*6Z;sP zE4>ww<9VAZ$MY>PVK|EycWc*YLWFdhR8N{j}Y9P^|9} zFe=}wtHf%iC*``=URtfz^1U26fOE#4D=2in#4ym3F6gaDK>n9e6^m_1Wvlr8N$taCAmHbgua8P@0%75YHx(EY&tRGU6v z9hBO81N2+Hb0<_DajfR)M=0OQ4)tjLu!y_ggWS z;Ap}Qg$RBN*s5V#Wo!cF1y+?$8@Q%GCW?XhsZB0`%SbMOpV|)D(Dtiap6*o^n@ z^l28h*NoxK$7PY}^R`;d@auG3pPRVkV)8IuMKy3y;-^R!YJRhAW3M}-M*r=``(Fn2 zOAIPE=vT-0TOkPW(BH*ojK-QaSm$AsJsN#WsklD!av!p;Y%Ab;;i1nkP(9-7bWOL~ z`41TGkOry1u2vZP&}ctHxZ=?jF$1hopUolx4hMCH)x-3ZD5d$za z8ujc{XoxhUbMa^F;8S@f;z>xSc>~30THYsB=q4yT75W}BUTRGf33ROzM#?w1RT2y= z*RZ3Scr8qPhVCIpm>!RnF^z;XFb`GM%BAh#GwCrI$$*}XmazkT$}$am+fIe)_r_IR z$dr@{Of|1F9hFV}irI@7O{hY0_aNBMGf@va*1#Ps_05*@VF#W0I*rPv@q5mmLZ{X8@$AqjXYJWju$QxgC$ekW zNNzyLgxx%YW|T2Kra)tJLKbLzIanMqnb*rK)x4>5cT$-{v_BVFuK|HkIASaM+d$gdKPH)*Vf$erf zF#V=2n|GXylsk=-*KB@MRLw3>LVt%Aq?rCcJ^Zxf0N2gB6nKvZe@# ztoVF;LrG5B$5J&az?(!S{T9Wm5bgomKt5TEo*c!~kE@bsMyrui}B)*VC ze$?${YIxpKFe#0rxxu&|-6JbQkznL-q8p#syy1vH|>pe0B8cdOq))+Xnr; zxt6M73Y)>%XP=|f0;NhiFNas)keWk-vbhkE+$k*Es7D$~z|^2vB~x`8^#7iXmZ6qM z@ajS5r95m?DTH06j)T9cURJV`FNQW-49 z!DE5>(0 zJ|V0(G}!}eIrZ%d8MIEKF*+I_{ba-b3eRJw_2oXuUjxBJw(~wlG+sMT zWjjxX@~Z>)kR5%{Et8lYUGhBMX{Z#bkM$`=+LKF`aexb<^KbQSr-}MSg;H>HIE68x zapBm;!+8n^)G@z7b*ezk);Exjxdt&WDl}BT%wsXSeA7)^>8>6SCnhIJ$12)XMm$g# z1h>0wenW8kqCy#d_)`8F7c?ak3HL?io9Zql6$jdj3O%SNJdXsNfgDEa7CrS1B^3+0 z_iL!Whxa^?uecA*OgSQ8ozId;yn9U@gL?0=vf@FH=`{51Sj$0MMa|vqCbe~ z^rzw%FXEKHJc_CB7SrfXOXB;YLSy{ck-t-lY0ff@nl|!5q}~!uF=Y|u^Wxq425dYb z%*XMg?PM>{Wf!c}nk@00ZGIg5O@OnDcZg|pGNjCS^L$aEC&Amw)Qvq!ajyi0mZ5jM ziD?EsZ%a6+jAr7HKpN;O7kL8aj*>Rm5R0N75 za1AD>qd}m2_RRsOJGonLc8xlQnhsFnN@{w54~iM|NYt_xYCq4IGBfBiIb%Y+K}@4j z=8Ty^ugD4G^@(Y;#+orR=sDX;>v6oxMDmhC$;nCe)iTVLoj2i}jf?RX7*)NbPsJ<-obI@HQBqS(v$RQfI@#a z3ccTRR1RNA44`F7u9!|gMzcVN+%1^)D4Ak_MynL4i~ShQ`k(98=oWody!Ss5j4E%{ z3%skOY7O{(x!l}-P>K&T-Fvn7s9X++0G2>$zn2tsDE%5aAg0rDbq~rfk3KJ^)2|9{ z*%v8(F`c@jWwKu`j5fo&fQwxsfoUnpp8peXVoVoMs)RX+@zxntlTTf$&xECsGM!KT zL8+lR%TzB|)t3~yKDvy($C~?M`uWCG8iY%AJx|~~x(OUUQ&+^}lg1`4Y4Pz51h7Y| zhW&p>yqpKh$OGtC1s2S-BIcoP8$MT4O12n8uS9ah0D3^p6ocpm`F*qe-Xp)Cl;7Ls z_oMQAhy1=let#^#ZICgNl6HPNvtGnXXZi<@5Y0PM*jounc|~2qJ4?gx(?iP+-yHB$mwk7)3{!)+1=~__s^%ZwDi#YG!KrL zmYE)z;eAgGqV+1|NSd2!kUJ0hP=Al6pyRJpS8^BZO15T;&Zi7IOJ{K!+xc{^hd7YhHp;2$V1k-EYk2wH!2w=~ z!wfTxgrEE%&LUk5qDNH(Gtx5XG~~p|ru)>D?8PI5nzx@b88=!vbG@Ki_vnDxOsXGo zzP)UQw4U3G?9Nt;?5}mQ9hv8G8V4lV;JG#Z50q;5kDMD!%@Go8GFbc@XDLEj#W zKL399!%%3jPmYkJGOrhvw6H)OX0Xx`i=Z3uoPZa7n8{6HJ7(lF3U&-ALd&1eDPf+) zv!Uz64p=A1#f)s1JXbSxu%~3H&S;t#K<`G&=yf$$45GK7SSDRv!hUc7WN@W!c1v_n zh}VYb=pK!xu}ch~r@BWd!a+Odw2~5Z}$-FrUpMQKxz`op%7l9sRj<=s{;y>W&Lw z17i4*?6}bClV8y%(mr?$sW8^n@V-8RLt+4H^h6|045FviT-pB-xgK|@+4%KnqyYW3 zQ>|gI7ytv>`=bXqgtV8HrD6bWjldaTkJAf`?*MvT4%Z;2JCsy0fS!z^hV2U2kq_l} zhx~p=es7ZBkIL^I@*8mw^;rZyMJnwLq8DV=XVEk|9o*?4rdO1eVgTIz^*BKFa`($} zuSt}5%5s=^gAnXo44@BW`bL@lw*3Bw{N83#jTt_Go|RdT$gHjM`$hTvsr=rcK&KXO z(iv=@$6>lVnntfkp$SZ@=&ooQy{fF0_Eg$dnjB_&NQUIWOD?>B>?2rKvI+w;UI=Zh z0)YRTs-4Atx^H=hg@qZzY(vX*z*!8;(dD(BU#X8(%6N65;mk%|)*p$DY} zcdXW^i`c@C*gIkXoth;EQFa(#IGS_9+$Cl3u5*201ms3nSP71(fAJ8OU7vw*38k@% z8Vi{E_}LE4Vy5pR9;PeRT-K->N_KxO0R?`mgcl_WP$F9l(&)Ib1|5E{^Ddv<5Hi@6 zr<1@7*jp(EP&o)3yp(B|P1*(E{PNOoQR}!aztULvyA>KG-3J8t?qf|UNJo#{(SOP9 z>XG{vZe=jZ@e7bKlMAie^`Uy-D*G3t3) zp_7xXP&cP@q4Yta!6$)M#CpKU854LUpUN(2A?V;w*voHDVEZtcroq96Hi!%P`U$X5 zp^6fAky1J-9-OB0s(57|+v2rBMGf;P14b?IxxseE6%&3eGPqDXj)xmLc&@2tyX1n9 z3kEZuW~EasjiMfE^YpCzYNPUVWZe;I?L7e`!alnYQ$V^1^06zO$B$qyuYuJ~Gp3GO zDy{6i)Knl}z7UWIJeJ+sg!S*+$csEW$HTW$$hugUUu$&+H1s6zahV%D93>Tt z0KF1T5$DjYa_gMM4z6<=VWQqtJH$D3JD%WiR%_W{l_7M7bcy71CoQt%Rpr-N)$GFS z7MO!Z+*k%|$0AS4#CPNK`1`yql#E>ytO4eLj~&ygI){$QrgPKinCypm1D~udW>Smc zQPy=*zVq@WTqpH8z1+p2JAJbo%9(gGyPP~m-^b3Sb8^U@O=qW(J)0kq=BKXX)xp2; zNO(R%AG_IcJ=Q$6zV3IIPmmGjni_G!Q)9DlHd8_qA<9ByC0e?i%2G`Jt$l;lxYzK! z!7j$83>zf+8n3cUYvDvEmc!!^`v#$hnARz|td%27bU}5aXDTl-I`&a@vp9!#$d1*H z!lt@Ga{exP_<`TIGn4}Ibmq}^qgDB(YI4%8m}Hn6qfoLD7i7s2N7j)jrX`45H`u&Z zc9=z9(}g*14#{Gqyau;fSl@`?hSTOWIHvDm;FEWgQR{08y$C&3lzm)efSG?yp@}Ow zAf~ZKxhutM3R8X>tB!+sCl=G_HdD650UiwK@qUUHSeMWpTGc<9E#C{}W_pnB zg7$;(&=+kvOzEYN-v3K2#WViONE%PU@9$MVJCSl(1nQ4tgohi%Buod$Dx_irw2Uf6 zkbYJ(c{t=}%i26_N8vvSn(AIi58KQ)T#rVpl~neMAl;)D1M|y~6a-xZzW>kqo3OL$k_%z^PN{nU$!?Gy7Vuj7ahue5kd8}t6UIGM9i!>dlVNLn;BU}mh8vpEbl}8d(VxDVS;A7CV9l5g z(VxDbnZ~X=#AsSG#?NXK_%LixnsgH}6mtz8YF1!-lAecj%jzYT+HmL1Myp2Cwd0c! zb}hj5)*)%T#mc>YBpwsoX!C(mGyrWLO&5(^DW*|3QV{qD&M`;R#UuUG%yTj?j^e{K zykOv1cX3Ep{QWgtD@N0bp}Arv(=Xu^JndXEv{=l<5B)jf$u^Ji95I@9rLDvch1YGn zE)ZQe2ejb!Jd+*~P#PJ{v}&jfrSW4p1(zGXmqSQhHqwdk+UaK9?Qpk__1fp21Has~Ya2Y`0rL%W$dZQzl7I z5$hwcb(+BRnfg7PA3~skSB~q<^u6kKq_LMPL;`&j$>IROZ&Iav3;P8-Of$L8cqLa* zvN)c8P*Qd9E8Ae$ah;MaCeZt6JhrL7$I|rN50JuVu-#HQ-)vF4j*_|1Oiwq{htLxP zlY>z+JujaATYouEU07M4Eb(xm7{YW%9~qtV^(FesxI_%0JNty;!4j|8&~h~9SZ5s3 z2T93E0W-ZTp1!Ofmh%KDEW=zX;(*B3=-0MYsA-kdmC6v=Oy9SqA!RjmI~h*>>!TtY zagNxE_6*0FdV6iky#A=t79`3x{t;#j7< zG`BgL9dYRQZOK7e#-;3_->*jUdo4wE&wAsKth{*EdxvC| z$Fn{@B&$81_2nU19r3L156S9`XYH4)Ha(h<%k)eO4AnK-mH=t~W9UFT?o!an!2eJ4 z1bU+738qd7psiuY44;(BI-q&-c+2}>6mXAem(26YQV;25d8$v~=^pkTW2yAsZ}rhK z^^l>8XI*+oR!2PRO30j_s;mP8~vb-UAlh zHylD-c|7ZuL$ccASz8Xt>WF9Et0s#CS{E%5$I_QdsWsI);~)=7kUbHA+@j*4#DeOI zLv25#4%>qk(a#)`l^)M}30bZLZW+)12HAmlN!vqKlYT;054zLiSqBcu%8O?$rDWX7 ztfgKa&$>$9P9;v^{BTqp7rV>SzYn0w-3p( zJz_QF!$Y#t<5`~{l9dSMkDW0qd6&*kqmiMfOkvPYzLFbWN$u{G$Duu=L|u|NcM6m z-V=2>hliIRYqD;(#|&Ie^fpclckluZaYmF~t)f5mlZGY#h)&<(3xrY zbo;5^LvU*3!CgOTrD&ohS)+spdQCVr0JJUYfqaO)03kn;B4xq@BXXI)xPS)>4<4i4 z|3|yf(X@FO^tSucH5DbmKMUSc$E7m0$vf=6)LdxxeNmpn)IXD{E=4p!@*>|Rb*tzm z+M}!#qv_3)Q|Tgsuyj#r@pr>i4{ocUOl$&%4O7$b>$8d3_;vkMiG8o0cdh>Gi;1P8 ziLRSkAf^$g3h6ROc<6iEN~;4W<_Zr@lO5=S4{|Tp3(sWP8D~P#Gax*E`Kv&9_&A8% za4q?_(i1-yqG$hNE!#w}r}whgM>DxI!b8cqqKOuI(4rS?rRcr~W3W0} z+-y;Nehz9F1m%n-rkIE7Jz_LH(I;CpQRfml_Al8wL=$a|WsO37F!a*4K7K$yw*;^c z_eq6#Sk8ef8$HN)G=^EQ%LY5~CZ_viXfC~EOZ~6&;NP|QFZ1A<7$(Axw!_Q>R9R4o z?h*az1)Eyn>wB_y6Hsf)L#O;oB>`bpJLX{qRRvtMthQyMIO^1i)EyyVW~6< ze%*#KJ=iDP+=FeM2F?-mY9GreJl#y4MHeMOkf-Pp%e;S+UT&rjp+EZ=BBEe5!s|d? z9C5Tp^&qh`4*hwb8tt86v;97i1sH9+7F?! z!%Uw|TQHp_z?Z;C`78@3=PofDu^%9y*4}{>o?2gLC}f0mIfuzEc06UEpG~g!EC zl?2y(G-nka21YQV-o`--rCzo}{!2rP*((CHF}h65hC2$5;1zrWdr#(k5ulskb`4GZ zSgBzzhae?l2VOmVEVYO>MN7nNdPm95lX(6S%@VWeZ3TE-46QId>Z>~VAO%uP#TMH$ zMrVYf%;lQEE|Jglg{?+zNWa^<@$XPo?7q#5oWqN zhDJNxma0-5cTRE=UT|n}3I|}z>*sn($Tk5xU#F_XADz?LMF=1#~aFV@~v%COqy%sI^;F!>@sUOgCn0^OLBc8Y#$f@FTaKGKg)kor7B#58(XK`P`U{g|>>GSz$J+m?^*)p^{&C-XM;p5tRDDY?OhhC^Np z9I_M+e=p5SV;WtGC%yb7oxDm=g>pyhI@nko9xe))u=mQm{gETQSF)yHLz=`R{h z?njsEoEIMc0yCiM4wV6YJ%X+15w)lzUI>ah^%x%cY#kUQ-|ytZ_{*>`H|#(2Ub1Sr z2eoh&U!@n2F{tl>-24-2E3g*GE(?BJLJt9Nx|x0w-3r&jFaUEf4csH|sa{Ioi2yd_ z^27N@fSpVO{Rlkn@^c=pExKx3S5uleiEc{tGfhil=^1J~z0+7APNLg2xR-=FAl^Hn z(dOa}a?yL4v`iX?l^2y!e7wAt15}Qnn0{W&Ub-n(09CF4(^Ix$^fYaa74Uj?m~m@6 zb{nlaiS{A(7@VZ+nPEx#;<*Qq3+*RuxS5;&vQ@Tykes`Y9=YZ5+|_z6HlGv5Ni7Gc zDoCC%3j3Mw@MPY@!G-M=3-LXAQ7_N1IA$|58IEu2#d3u&{pTDgNmuNcw9A#cLG$3?Ocwl~>*)?{fG|oG^}E zCom1pWCvBHF{R?w7^+$4q|xzBctfVMN@!H}O_I_=+-0Z^Lr7HxaZjGM*W*?0$Ne2u z8keTL9(e~2$!qVCcPrtfIEBw=>9U=@KC@3cO{nqoVp4LFOAMp+EpUBBui8p^FqGZI zc&3#Jxndao-jarpBYM|6#CSR=)-pn(K>ckP(`z!8?fVg^zJAmvmt9D_y*W*cr#GPq z%N6Y6Ob*b(G^V4_8&%T7hn*?141e=V`XHJ^jalrVyOc1`9*WgpRlxOp6Wh5epY3X2 zeK5P;FuG+t{g9L_hSAT>DO@kf9>$X92NH_KFnawEnwf4%fNNO|$AU2r%l~QMI+h+3 z$w}+^l)p3mEd3zk0HVu8E*M9xh-Wb3=(?bCIRu)b>bU*%OKXbQs?ZfmDk9^FW9etr z4~P^d=%!euag`fR?<#(gK>KWXh#t;#O)Q6940nHfZK+~7 zd_%H}Z)EwP^@%N445u4n*ltIN1p3J=wJMf_$5A_0mK$-~ZK-Sry4A6qXiy~3*Ji@i zNWh!Dj97_ddpLceAncsi$ByA}KY%Yg$8b(8D8qg$Sr0Jk$@+}Ud)I2W^kxKoi;*IM zo{?WQSV6>PCRPTMOgp4m4kxre9jov4Ry|0{JRtW)=9 zw2WnbZ|Yu=)CJi=w}SF_qqU%vq?{9rk#6WwAA2#xMu*Tx(KK$L4n@Y}xdbY7Mu$LG z3mOshA$kM=z3Y4jt_P*yC0-Z8Q5dtlV~;f)+vT$--tFWxek&56#njD`zz)GA5@>ZaO?rnNtYcaU!Nd~!CYr;plkq5kTaybSG}wT}JVbCX3tI~) zUt!Hm5Yy-$>w$PU-G|_hT(sDDwzcQev(n!sJkK3ygQ~)ChF&Y4J_GEv>|)D5F#76L zdI={H4iKo=nTJq^nLmnd=H#SZ9Ds=>Q6{xzp*Oy3P7|YOH5ap^dOqLJfzRL+o=M#b zW=tuDaj5`DM)K`g!{aI5Kk=^odMloxM={+c;7#-%EDQ*<2IGDyJoI!6aPLeg&4A9E zm+kotZ08`I1Hr=AxDui#poi#Xs`4-;;dvSv^?HVvzlNE31~f%BpxM*}{5>FWt!+V? zR2`A{bigGA=4`TkZ1m75S_+W>#>E#mGmGc0{cCP}Ja@gBYcY78@yrf0GmhByiB;{b zX0BB4bR^-QL#6*#{eP5YubLHa(ybR068{*XRDKE+`fJVRatU3_vd7z~P;v|1_ULWrrp zi)I1Il|aG{hPKJK(Xthw0e#3||LoY$GsH~VeO`eWO^+l?#hPc&lVZcilA&0$%C$E2h?mj zsvBa+2g`82QF^A{#p^O4PTf}~C9_v&_<4<-XELadTxFX$puuR%#cv~sL?4M{+1W;` z|7Fk4K(f-!+CSLK4G0Kk@pfNYOde?9cYiO3a7q^UbHvWqyN4kuSPP4h6NWXd)tfr=yG;{o1c;6r{CnwGFuZd&8f zqevXVAsiPRn}vb6Xb^TaX&~BNlQn|=C`+LWGgdsJ;F>xQ_3Q+64Wn%l#a@!z86Ep1A^- zWkw8c-N!zZ74Uz^DH3QUrIJ5|9UKsX?u&S&OHD&>s{9A50^IxS1u<=lt zW(G|7Ut+tkC$?=7k05$5hB*wE&q8X$fonJLcbWKS(q?)0b8$ZS=+W#*=Uk5P8i?Vj zrIuZ6$9O}PO8;B~U(5RErjcC8o8Xqh%iGw&O?aIicPgY-R8fE~wxac?|I295O!`42 zC+!oN5b=tc^u4WA58W&>nXZUcN?zQ7gY66H_(vPa%e4w^GHVd!V$V_$wn#nh7oIGo z-46IadboV{4(+ar^DAbTKP0XE?d;<*jL7%wQUiZf+GA|fd!*!OuzrNJ$1|@(rWizTL~_JTxHu~m$sd*Wn9P=t1gtxPEpbdErm;8jGU zS*!3p&0M@)wrRRH=hcd|rC;x6=NM^8q>&~c_F>prz(pB!pWGb-c)0cRyR_B#>1BG- z)^xln!0J@u2=7oZfRN24!mq{Y_-a@DNC^YcL1_$ru4r12 z9TN4u5HLuvSEFe%nXRCs#YQGMeBBh)+hBYge{h1G>z2>U6_T* z=VJ$*kwas$B{`d-1zdOjtR=T+eB;IF| zNG~dx2%;>jd@!1(cgar0UzEoaqz7N>n@h>zu~e1CtJy($8)D+y9ty@gtU3&jRSqkV0jhh*+m zw35DuG=~GUii%C~rY*@JZ47ncr2tGwy~#nRo0*R&^dlsIQXJ-$H@^(FpTkqBCNL>>pt77)kMnDUe!|-N8f0YBS74uJIdQdL z!LGZQD9nL1To0>3c5H)fT4g?$Ph`g(Ox?7VE`b@od5*~h_9BTQ9k++ znWfb~4R? zsJC94HPJ~pMX<)@9Hl3eQid-j#HT9cvzQ)I!noiFu*CYZKqw?AGz6HwY043qbX8(0 zd!^kcOcAtE>z-6vhQK%-?1r06hBfqCtj?3%_Bky4gY*g|C+)*TqG*X^5Fd-A zaDXEsNIO-$=Ufp(#GxN-r4WnJ<*@=7Azq+_c{ygIM)mJAUw(Hwd)0`F+l zXC-*?&*Y}GS_G+s{BSVb4>mwSR!7kC2B@h^FB}u_a}U z>l*;1Dw46ddZ88zO1^-}Ep2 zdf7W7Qeqm9%MoPyBU&bA(ozK^{Si$QGpSvEAC%ucNewfd(X1o7z3p|2+WRE6ujtg? zO@1yH9=a;x(W(4KHzr;4KNyq#8zT8^tFyuw1z#B#g79OcO!nLqJP`3EB1kD=%z@YB zbip8Y5@e^BwL#(vMV%o1ELL)$JcG|*-OrFVivw;Bo+E#TSUXKjqwgd)okOCnocbT#3cHpb(Jg{riAU%?Np(dP8YU9BMh3HLDuLu(Lw6kH5}p? zkLGXKd!0Obw1L>Kj)d^=i^%&-H>gb`&?{@?Wdcj`d*LS)>Mj{DBY~RSR)y(;)@Ho4 ziy&Q;;OBtqpq-HeOs}X-xZ6k5M36pIWQTV|Q_$otr5HkJrjBTd?ClSgOr|~%X9k$A z#*5oGYSX9{sQmX9><5Jga#~m^8HB}Wb0NlaljP!pOdl%JsIDWb59z%e64UAOwn~Ok z@+WGldX&EPm7jl%RnbRB-*h*m1_@ehZ7h_!bV(=AFS!xxFd z^mY^i9E(B9tBO~^c6P;c%6sHMqik;YG(5=7eqqr8i&SX*x< z=NZZDGPM}X|B}*fq$CaI5U)1%D>{tSc*#y9MOG27cwvu>FDdPRN$L1Y zO6Olvy8e=4t2rzM@zfA&gUt?UH%;}8h6te0)XbRTK&+kz} z!_-!XS(&yvJyR|$X$o%=oNnYuBGge90Uh!5Dvp?nG+jMY)e(3!EHv}V>-9R4>bZ*5 z<7FNM!e)L~&wLAGdP9#=`*2e!G+WwXWZ^{bO?0P~V-9bZmBP2eI-D)9w&{!Y3M3W> zwgR*1c}7msdJvp(Pa_ zMgyyZRXgeo#ot8A<9XWP-o$noSxI>L)()C=*qU@~veT_j%`;L#4xHhkJB$h1Ze%5` z$0;!1njv}3I-+=E%gq!AgUlW{I*c4SIp1POd~(`abS!_(DUav$=!}kdYJlOU{ciS} z?+)p$IxhGYItvu^=%`L3PjAJ&>OpM14*7OnX0zE6Y?>|4X0s`Z@_Q20;S>eGY>J|( zPTSbU^>t$x)XuF~Fm`_J*!sG;W9t^zG*m6Dw5f`w4p1lCY!&qjo%J@w)@1xkr^xai8X%h`N1K+`i-7?(*_-pD*9-D>~Kfc2Ds6eEH`8 zZnp%$pK|?=EascyD=I1q27_nnKYde*^gpNS|5*Q?rswDTP!0a*NK7nHZs>`{Ibn%` z;53kpZy+cFLg#7td6++^0z}em_Dg4`(OXx*HT^{2RQIgl*x-m+&aplpB^3iTTIlml z&DXof_#N+)og;!lN-7;0bQZZM z(lMFAscV8o8B>GRXO5jf?$ms@69X_MIK($B-#4s0=&SaX`+Ua*gXVyyk2T1;p7gbg zt3hHnbC1HaGhb5l~Tv)Uc> zS#53~Z;*6*LUMd`%*4AAk}=`sA1t-`zVs&ugT^oTx{8Z9XIY zmEQ23X8NnW)7$e6_}6-;=S?xvU+Er{@(I>2LK; zw@owB-{oX?#)u5(2y@z}n>k-_d{;5kZc9vdnp3#kOuQRXWm2-M-5GATGsEd5Ez{@A z_UQ}N>7MFyyQ{~#W$IYByV~t@JFU|{eY!!&(|wZjt4$*E%+y!ZPjdeSHl#uFlT3bw~nSVi2axf#`+yJ}G83t8f_Dc?C z_=>8lt9?VwQh8=(x6BOo%4|0?@93W#3_6Rf{iwst_^f~OkbJYDoo4E9{gbQRW({3t z>f1*o7nzB+LW8FFdL*Wsi68Vx%rg@|>XBG(CVtu@vE5AE+as~VO#G@xVyBt-O^?Jb zGjZ*J&*apEIT0?ejTDx_wiFL+BX4PjhNc&DZ0<4Ef)Ppu0Lagw)Jn zs^q$?Kly4OeP1g-&1n4XU^6E8+&*7$h{+^&n3?w@^DLe1(f{OEIB_NzSkg~7u>3kO zS?3q`P1M=lr}(hk^w7g`)AJTK9EQiPZ?2j9Z<5DWG}JDvI$UmD<-7%za}S5Es-~f` zuBKwa*orw-he2D_P+51lWV4jP@sC|tv8euVaJ7d?tgNf6tvej_;+m?twc*OKiyP*- z4^yu8aAhn?7S%3TaF{~%&GmCD4x7_}o62ABFc!jp)6rG6W9J=?kotzYxwSP*{v*bQ zx~iJ_^$V&RDh~rzzo2Sv<>4?dtY|oQ?3}8G!{yCgxacsbP~tGjR@3G!Y^blT`;XJ% ze`wC)n)-@)mFHGgg#Ys#nbX`*S+QWgek(j}vdxxTvACgjeq~K%T}4A>c#_SwsIID} z!8yOyrYx$hU4RdDZf#9iejw%i#g&UI<*$b3Me>7|R4mYwgqf7EuwoHl%zv#6fk})U z>w_CA<}8qS5{*KM^XqCC%i@VLFBGnvvv@uVB^pyaG_Rt*At(DUNhhE9m!$dzSzY41 z+PZ}mdb{f9R@4Aasj9_4n!X0`*(d&~glp#_iLe0hk%YEMsJ`>67F327*Hkqjz3;rR z_1$k?IJ9taL#52X4**rmLj77~`Ot!@n#E1VMR|U$t-rA*{*pc~9KtFJ87&4Z5YEF& z2ra6u*DLRbg@e2!T54-5t7_)S79A09tnnGDn>RNnCuf2Lm8eYwX8oWPxxESMnIgaE z)i+c$R5V!N{pxGyo>#j_cC7iWw*}xm0Y3|G}zP<^dFRIRT8 z;VLvhw~&h<8k1&>2UFU;5}9pYg1g%DURn+}cIWakBf?EM7RL zQdT#}*e6ickyxkrII0C-wRPdjx=Oh)j>3+BoaDI+Wy?~|UtHTD=^L~lT-hYkjz%E> z9W$??wgMl=R@Tq0(AQ8x)x3(ivOq%5r3|RSRW;$tCM?`gO+`c15(zb=%EW4my;rE~fvL1g>flEBBQ;S!R@3(wd4uV=dkK&@#|HaHfB1goJIQuhFB_Y7x;HpWN&_E3Ep-qtsR zmJCE)Rd+JMU`)y62iQ?CmDP;>?8qzED3;YsSKU(e<#yqwj{gY3|1ImBM= z_t^*{*yiz5%rjLRc;)!A##LH6d#NVHjK`DrvDG)v+LGC!YI>iQ$J1Z1C9}&+Z;z+H z-V?qfp8l4EH=biU&GZz?HI(V#?z)0c;_>XDNI}zN##8=&_G&YHa~AvaC|Wyqy40U| zj~!n#)uqu9#V50aAxniP3T+d^?o@_7G=#kApBk-5LG5ygS(_?`GVN9~MGDhh5ridG znM9afB8Al}6lyylhSDo)jr0`YoxxMsp$;SJ2K=T748)x5nt|ve><}u?)(c*%{33<< za5-60&LN>P^#4;>U9J3PARGf-5N*?JrnVCHiWIslk|k79!XkyDTbN=V)p)S$+G`R1 zrA_uvh_z8{7ei&Vp%kVEOv+;(oq%NuDcxcyy`UDu>r#qF4@cHXcz^k9lz2D-C2l9X z&ah~w#YW-F6wE|CQ-FR?IeXD5O=UXjixukMO^XXm&5y3HEb0!}pr0gdCj;`KLs!X! z0lpz4%iCuGUkJTPsmMW5&;rdqJ1=pwt9FXCF)d{O6l!~dV#_FDCEvy_;%;j7h@teb z;uk3}?#!d1nH2W$8aO)`%Ji_ZlH3#8B4gMFpC28SFs8`=hly92Frdg@db*_EOY? zh{Q3EpQ0Wg=Rv74>So8<(bSwpS| zydi@}GrX>!#&)@dmFuo)5^AW$(yb19HRbDqE^Mg*my4CogI z;m{8HGm<=Ph8vi|IZVS~AF=`(MhSlElZ(yCMQ5fljS4d@@-X$uWtv^UbbK~7de|i$ z)+c9^>Sq^)3z&vx^GNpbiL$rg;{IY-)g7@Jei+#OHIJCVW8id{cr#Nhi(Nd6T|5GP z1t&0Y-&4qibf$+X6KY#Ux?un|?dy0dtV!9$GuX|$QKS&9MdYjju#k1=!vH*PcF^^) zW%QXXldg}Y(HFK%C@f(T@CJ;d(W6kql4G~l?PkaE`7lrLayd_@h-cCyih1T^v?x|P zdFEuqkvhMYsW1Gb1ej_(G_-~)vM5-WfxQ8=Zr9VCrWk2BJ_j; zg{(Dl*0{I`zVGWPFGW2~-=Ew6WsUpGs-Y90`>D@h_*HZ8g-p>b&PLZcIK#<~`G|BI zEAU}o)M#ha!wzoH*VKcGUks()QRsciHFTeX3C>OIMdXl4JdPbVu$S6W%#Ew_C#(Js zjrwUm_RMVz3XaY6G0lUM2Zu(-Zm0PkUmmYuyl)Vf6y zJBwX3>vhV^)@ar;8ng5Xc=lhs1(D!lm8dGZg|wxpdsZ5a%%-yt^8k?#MrX@Oe-%5p zoxSRGT6}=c@zD4%wHBaIlAo3U!F^JtMvEbUnG7#Wk%9{+d(aVHnw_GWA*2sj-TMf1 za^Y8iL;STI&>wA>wqw}$s+dYoM9Q!kcB*UL>=IL%UW{PoXfBaL52$c>v7Wt1e_T%= zEK+EPo}Ld?MlWk{!ww)vhqB>$H|V-JdVD#VVbOtdDu(e*sO_S z`@^F0c}h;Ihq|DhPvkSPQ_qleWoP62v^0GiKdFh+@VglEU2ftze%1z3t7Vnk5l8tZ z8V-%db}l>{E$EUh_*taTEwTa2^@iyU-X~J%L75!Mr)CRZ`JWbvpHXtsF6>)wKACT4 zub9mARs_~L7sXPb=K}VC={9O&7=1dpVmvs248+aTNLvdf$3bqk*SYyV_R@mqnTD(d z1SzFdiS_22z;Ny3V0ad*!Y&;pH+Fsmme+Q`QCb1-6e?|L%fcy7Z&0cHl_T&Smfx#H zikd@jP-7sDvB^Mq(TpVP(9`MV~lZ*`;t9Lg$)GBH_K!d}i`f0Xg zuGPW6l4Qz=;TY=_oIFdG0kSuo_J>@-bktJ0_9-G&_Z!BtOC3+5n<8a%DY~kieK38) z&d9F3a#FTatgPa49?34xRP}^kwRG}&a0o}r*h>+MU2f+h^O~_5$1RTcZNc+I3f(Hr zNucty+zqD@A$ALux@>-Z1fD)tP11Mn^h68AdZ2*ONQhzCRmBbtAz&@SX=iYVp;8iR z=g^wj<+HgQ8vIe%E%~U{a{rgES=e?08@r^A6MbxJlCDBrtX`zhC$?_(^7-cGo!7@I z^tLRNtG&)JEX4HDy!cxkyuU&6h+EWRo$m4^tI%G(5NmM%59qh>mo`u@(QMr<`dTIa zJhX(gckWS1u3kxcKdZ>?a*OX#$-gOL>u(i-Qx0fWG>Ak($V~^+JN>hTO8;np?Rp~9 znxssj(l?89GNgONv3jlTaTMRGaLnN1dqg6&Ct-CQT%2_}9f;(xi`vztbTG0}B&sLS z6GwJW5-Pn^>!AaPKXs9sP2HHFsOGUFi`j*xw5zsKB+>%|VYpm~gcoW(O#34nIi%4g zYAWrI)Y2vDTG}7UVzuTsx)}PizeQ45JptMhv|RO5w1B#0{THb#WgV)YE>^pzS;INd z>VaP+`Sc?^ja;s7rXM0DP#?cS4KsZoNfATU4BDc03zgo8l(0rusyoF{Iy#jd8A4@^ z-iws6Lky)`)TJB{D!ms0Q@%+B{qm~tPQ=6N-~*UfqiL1ejk;h(=3=@+EoK*2iN5q< zVlI1y#`M|}kLXK}Cc{58?Qf`LJNjT_Qx0@mXdiTD>1uTk?TggX)#^^#hhAvL&ZTD2 zYGD7?#J)yiU(WOmR4v!2VV_8(Z~Ej4mDViDDiVow^FXM;t4w=jr*9fqj34jRmND&x z4l!M;?xDSrTDn%VRzXThwi{h<)(hwTqyb4f!WlO#(K2af!Re6Fhm}}3IJ0_t!YgC z^whR>vh$VAY}cq^3lnFf99-nEgwWulN+U+h9IC^?4j!12GG!1{Y*g4PMqqb`)Wacn zWVS9vCMs@~@#rCozecXwheY_0q z>VQ=Z-@y*<`J0rTsIN^*Q4&5!gcIXB-8tB*=v7oS(aHAfov@6hYq5fu_Nv*~)~>~^ znm$+kbX}xb9YtTN-FziGXk8?WzQht-i=_+zpg>>03o}gJTl1xjPa!X-E2Loy{h+R7 zx*W41kA76UVOcPX8Vb}&`lxmcwdnW+bl?s_n%UmwGz9cTd#_`8rS)MwJS|l6_+=-6 zQ<38)dmg*u5fUn(CFTXM%Pv&#MOzlF zqc9`%DcEt^Yv4bKF41TmWzrXITkw%Ol|F^B7F|a>=_?(xm#(93`rN`iNi}YS<#ubR zI|L4~z50D$}ovQ&@W&9SA2E0j7btMb*BKeWbRT>4@wR z?4a6Od=+tsH98;sY7vL1t(oZsotPZjPTf3?X*+(SI-Gp+pjduB%r+944jhpQff*{j z@O%%`V{IEbL{HNmdaSLMo~E7jSX&mW)d$hnJ1`+0ZA-xs_Y7fO(Y7`Z2h;+3mb%$K zg6YvV2sd4HJi?C(1UtkL&`gZ+tU3I}|` zIN5Ovxb zSyzbF^n>&xmgp)B+%iRu^V%W8`+^f zM*YIHD2FJU+M20lBRkp7yBlbXpJsY!jGu~8V%uz{XeIw_Xv0DaG{@?Q^$Bp8=whu( z?XUMzc|7x)zhrjAGnf4(vn!t2jX(jt(59bg)p<(-b`^4*l4EhAyc4Pj*>uABRtvP2@inNTcLy1k`@r(qp@ngC&6M5uIAi@Y3G zOKoZIDOv$%oW^!8q@ah6h3!t2ljfDsF!{+2cGDaWge>re0D-5M?bPC-B;+r5Q$y_( zWI=5C03C_MDkqjdE%4C59zSb5)KC9Ob+x3)Pd6=*9=rpnv#AzokHC(`PEijH!Otou zg-b}4pR#rrQ`;6gLMAwAQ7t9o^ARUim(bDpEX<&DOW+q3QV$0sn#(RK_rL{$7le5y z(-=sr6PX@4G8Z<1Kb-r7Pv2<%$6W^-%x-~GW!DsuNcSI!ErxzL*Yp1!%{8JF7g3++ zOE)LLUaAKp57|zfk$<}d`<adXzII!F5y#Man8TV}ZON-vtpj zdhqp@GMpsu^v~9}-FF)0wo9+J6bO}WO$d|7=Ewy4v;}d*XhTAn>64ZeR9i6)OEi+4|3Q3I2&}=jqsPgi2quWC7@!giM}TBvkqwJ%g0% z6R<}E4*X#v)4To6+Ha8{dn5>o{JqYoYM0ooUsboZ=3pJM z7X^0-tlC~l*FYGAY4&y7syJYeRF9s@l#N*u5Q(&&{X(VBnsK-R>nr`Xa%c^3++ANL z66v*mU=8quMt4Fse^tve4$;>M-E>vU7Wz8jbGoV}3vYGuMENEGC(4?Z9CZqPmC(&z zx~2up7JY{yyb?orIx>j-l3|&)O5cGl>Tg`e57gl@zPvx!ghHMyRO+tFV%piV4!7}# z5^`y0%NBYlVJ+>%aH{80=aHD2Pb^#|5;f{PvPr1=5BgVMh!tK1C*OvaY-2ntWS}kd zQnLpuki$GysPt5G7QKj@nL3glOXy~Lx@8Ny=&=MpKTl7$c<2!Xj(Qf<`)ON3H$BsW zvy8T*QBSs{X!Lx-PHHV75vB)Q$~5XsNTnxQwy-*kIup9t!G-KCXZp}q$}URyUZd#7 zGR78DC=zK$v%!NHi{bO8EH~R{xLKn;&1u+aZsDa&?=`2;-#JY0Hy=<((XHG~?>3jw ztz1m+Hg93Nm76%k+7PZ`jaoO-OplZ8Gn^RG7y2F4=j3Dc8$}{L+Yg;vh0bMqtRD9S zZ7j>d|Dm-O-NSUb$Q6mSJ5i3k&MZFEgf)x3qX9@eTRnU>hqziV@Tgb{)U6&~jk)s( zVgvT^i$vPmFH9?2%jjPMOwEUKPTkNCGxy{AGNwgx;WORaZ>dh>%aX?X<22Il`YfiO znlbGz<303K^A@^{Kc}CXvsk@cp_SaN6aP&@u};gHmK^$5a~iE;OvWFZ(^#ECmvcAB zek8F5^gUEp#tvG+ex_fVbJ(uY3f@Y;G%uqSydD3FMA|9EQh=nD+(G|p#`|odI)Qff z@18AGdaJ37K5PDguICQ=thtQo8eS_B>5smCy(Kr)=YVM+;@7A67yXPWer-Lb_*b%p z`V?P>7H+}9(&&wZT-wsIh2BV5OIup9)K$uF^m;-z_1Q{GN~lkm>Bg2acBvES^@MKf z6DFC8M0!1;hVE!7V|p!NCB1=2C_Evb9*n{B0|LZrv}6nB2qc(@mF61st(>FtCX9*Nr_dU8*{mBvPKvmDe9;v2=rdJn5% zx~b&=X75J{E17O=NujQUt#nh%7V1jaOgCZEX!s4bS-KGIg9Ja11RTP`sUG?ypqH6`a>RD z%krbXZ_Bm~ZxRXYOL7h#$_2ETUdiS%Sb zH*Ie@z#8pH*h5d?_)zoc@q})As-=t`Pbj9RTDCAfmCz*TVu;ltv`wFB&n7HodIZ~a z9zCBRr5g`oYBRl%P|EZGaDvpYjQkmPL6H;OguZ}WO%$Es(DI&Z|`T~?5sCfnoesj zZI>WVOYq0*A%u?5J*_3!7vC18Z0D2Nnaf^wP<3|v(o5|bH@ovPU`rEAbI zg8YEiwtCprPM?WPu(FvDtwqWpu$#gzz5)#Y^?=}whCM2^J&$TdDbrq&c}510VTUSg z3T|$;GP6Q@9}eNbUU0!Nk$KGQZ*1u||jwAhS3&&Ry z2eminFtsPv(7~o0c8Q_t@s?aahc&t&5!e5_T2uZi*oOiXBmnUXzm&~Du&+_uURs)% z%k)Q+anWaWIxS1=F5oJ*t4Hb7be>~T^Sw?@cT*12#fdfa+hM6$E~&Zg|3b|QQ1eTi zntZw>vAe(&v6qJ|O7hFZ$npVEIz#yDE7WY3{5qFai1wsgC9#yEz&FqLU<6S%T#6T|pKT!w2C{YX^X=<397+Sjy2qpK5Z@IkjGW;^MiEj;HA z`YGDXq!f!3+S~-$Cf@wsO7xE~)YY(VebAaB!rMp&yC5ZZV~&l);_30f{vwJL!WDrU zo=4CZb|F0*ucJjA_+lK@d8of%9rF8qAKXXhl#nw#nLf9L>55nxCHSeeU{1BTE@HpbX>;%+P>RyQ%b1pF=!+UC8u}q6`@HD~{q(s`PUSC~@GRoMA$ueH&!!)n z%4mfa-T)b|+#~2;jX3yo=*q-yJ^OOd*=_UFkB!af+ErRHq+zFWh;NVzJ{VmoP}075 z<;Pd(f>_Dfv{DH}uZ+X=Q`AEjD1K-b1~{J!F)i?d;$^pdoXBTtOrt*8tZm>B{T$6Y zyPRpIvYnRT0^nd;7V{wKPuu74qUvC}NKg3P_PH)1*)3A&rpDf)#XGbx)9Z~Xv{~Cq z|7`ToX03b99r#i+@J;`0%%aWOcKPp}S~hFcXAdpG1;&9<-h_%?MOQH04P37@rf77h zw)1|`m+48xj~-mHq>S#=w$p2k9*FSn)o`hy-6*9Fr8~85daZFw9AY@#r*(_I)T#J6 zgwyS{C1vuF5vqG}*~F7k$R_B;#seIpt=b-Xv2hh`)jp>e8?#tlsr&{Ja+a)(b~obm za53E{C9|uUo^SNfom!a0=S;hxz6Npg16nt|(3r(8dPwubIa%ZfmQ=eKqtEn9V~Uz; z^h=p~0>0YsV47RTldSqTN=)lx&wfv&$# z$?W|?iz|D)^L9l&YzN#kty_dj+k~H8cQt?&nLc*fI4+{j#vFFhquOTL(O9dVK#ywO zkdj7guc6My0(ul%_z^t|S0dQh+DMXh)$-2+fHn_kwsneM?@F}xMJbgX!hPKw*Xz%@h5xfwD+YG zHy0OCq!OMX>6jWOrG{Qpns|j1+NU`Fs3VG(t*@CrQ2e}}{*0ukriMqe)%0abauT>9 z?Cx5ST@yG1%EnXR1?&M3yU&)b{{r{nWBg`2k1~K($JQb7TODY1EQbTeZ?^NeQBeGT z9=lheeCi&H$7hGsoms(-GYsc$ZYNW7mR0XXI?8Sxs=b#hS;3BzJru27L@^IVY9~$N<)+zUdaKnRw;$3UJVBn)T;7|= zZ=&ni0SeYAU_ec>zA}@qk;&smT2!3Qjx>taPV(@rX05h1t5#_AVif%B%3!;b$1nuW zv-D2Z=%0uaiP|{V;4?K_ z9Y)~;tbN3;PvJ|`Ar%myjBqO3xd6>N*Yf|@5i8QQw0v~8YD{Em#btB~YxGm3fbD4O zWol^#qQTg?nxrsx3e!)K2YO@*wBLzoXxB5}?~$1xGZ95Ii?u>?_{!U@y1#~-d$9XX zYzpvwdlCxrNT@3 za)>-Q=rRz{P>XxPxxlJ*IL-iQ+-rYhhh#<&gNEDK>(nk|f^vc1hiT6@vv+LX4n7B? z$_{>or*SjZ4z=I`4-*GWthP@~!K7c#BRRnP#FP_+kH?8A ze4_A;E6Ri-!?itT#4-yh>qzl%X6Jwpye}r0Lk?0>E=Fi^7P>vjFMPBZ({~i7#g}K7 zfl7BDQ+|-|W`~+=Qc)ae_V;U4D1zrNs5Ur`W$6&1mc!%(vl{JdSY#ola6xolfV7jAExV z)#;w#c8?u`W`I3`DgFV*U;WgQxmP@jJ(kJuOJb6uZaze6!pWe5X3c7M(h_=(GvW zaVX-He>q1uoj#|}C#fhRCDmPIe9HlJI-TxW!BT+AdV|4{J-~;JbNigWBDYg^+Ssu^ z=h$GzEJ?2XD>y>df(8~1n-$a(^_&c6JWG!93IG2X%Ky!kR9(Y3-CD9&f0fTR`b$k#6Ksl-Vc6L} z)Bmt`_QMWmXMb3`a@f4u{%ReLHoj+u3!$bF#`W#W*rJy-+VZC z02bKXb1UYaTj8#&s0kmYcPuartF$TpPe8Txa{m4&khzN%>*oDCl*xy&@9$}7t-zok zHpc(e#9!75NJY257U*aBTjtc`GXZI#MW$)FVho98YR#B(092$Yy!=9v1)$6eTi=O2 zP3iFilS?IWv1BKdu&<$Pj&+;ZOh)=3Arm4asXOwcXo6C3NQ49odM%S1kIEZ--r z8_OFW4w4KTc{u<*2dJT5<@{MANY!hkSQS6LCpFj_y1%4Noas+#j; z#-gh5yl}jIN^Q;D%6W@xLc1YJ0HL1jga z?uVkU%rl2VX{@Mf2;r})umqL4R!NpWOBA z%KXZPMjbtNX;}|G;sA@P7FA~V_*thrtWfGI8t2y5=pHWWD#5!}ELadSMz*fDw#T@} zvrTd(fUHbHf~1}$Yies6t7^ivjr!`vl##&ri1&cLzT-IS8>;4>*Bq*;ZJ1N9H>tka zK+tR~V;xI#k3#b#WMX{k#WxnyHOGRA`i8i3g!z>9r^gb_JUS z`Vt>UEU1;PMF!~299Yp1GFB>b2QJ30AZZ;qZ|=DZYr_>i+Br}^*#J1GrnY9zg4(&~ zRn^S58a{C0ysDZCx%~T@&L0Lz-w_ox&F17EG`Du)qKdl89?l*5&8cdTSdXl1s*-dJ zIAr+@oHw_oA-=N?jPFuH65LR?c&;oc+i4MWgmIXH;-fH4D{Gd7!j(+^1ch_&s|ticV1|IU1eoWLuJK$InGF~ zZ>+4;Yh6@TQ=_l@zsY;K5>rTl}DQkrSGDO8hyI-t#4k~P%%eV8vjhO zTymr=TCjM2m0VG9A7bFGubN*|5g&uTwZ>HLIT8CVtXQx>UzdFsE~=Pc8SfDJvsW%4 z&5@Tan_ID@vSz-~8CYU^2gOUqTh({&xfMEr7=NQBHFFy(>*c`qt*=~Asn3YM4RsZB zD~%zPfHDE-7wh=t@5&{Wx*H%+vY=|A-g)>T%PgEfx3RWP@8AVh^$nqg6*Y^EslKpr z&YZ>ixSH3hrn*YG%B+M6=_z)8t*!6e`S4n+FOr(thRXP^EvHGSeo%om*Qc&j~aa z(@!Q=)xdRBebrpqTgTK_&4=He`0h8bS4zA&1N9T52Ow6Tx$&~a{-Kh=jTH-IZKA%i zMxL$~U}9sPzRD8foY#e%lOK`a>>S|bL2~O!1!mIfAi4CUX=c(RB8RF=csU%FJGdSqPtgRA z&g>O#5}d)wFhu7W(UOj z8b#Blae)7+4mG5hCb&vjP&|H&f5(H*_+K-aUbBU%pp2=yOyDt9s1(hS=$6CURxl+( zf3>kdFbuZjlcv;_Xi8%moJnK#(u>PDB;X66OsIUE7$ITpOzIxIZcYwUaT&FiA%qHy zd$l!)$j!@D2ko$R>vNx6+}1Fbumn^4Y?z9wc-zLrNT`cVrlwMgmjlcX`IV;RQ!?6Z>A9ELO()k8GnXy zz?Oz&9rQh0rf}2WO=bds16|8naMOgjcGy{ zZ{`c|E?55xG?iJS0zAd;(#Ll~CewCQyu-HCf~=#O0~}CSDpYiU&tWgwm(tlDCi_yB z{~nXgF!~snO|>4zKT<Kg{xRCq(ujizf>Xa=H==I3RN7S1+`RB%eShNsqTQO9b{W%tOylPmh~c|LX4o_ zZK>>S;E_V5KcXJhuoTHNLETJ8B>NaMVjX4#626rtat|p?O`+aOWg)i#PgH%F1~x(0 z(ZkdcOA~#l%a)BFH^owr`LWH9ssbE9tuE8iR(rg<1G3YoZ?5!565s~*GHN_Mg}uO# zoxOs+?38WxVx^qJ`4gdR!(N6n5oyaaIBt7XzSwHXdf4$}j~^viS_A^$06c_^q^+?W zdftXu=S;N)$SBGZOwDL#q68VqbV@cF`dG|pDK%x#4jVE_Ef!2+01w0OkqqmK07vMK z7=|lAPugHh6PV7o#+4uPmRO`c0Jm>$MDO?E00>NHMD8%$kafi2R!H|U6Ih$!!~6PR z_VV=J8WrV@7E(AN&_`}>R1V#B3VQPMDCk^|C(m@W=ZC1#o@k`P= zaOD;35cO0It;oKxG74>l@-!T;uvX2XulY*$l9~-v_0pe>m(|I?3LibIqyp_*qAzWa z!kW=XPb$Sw_IM&%%K=7*sJREBlb}(j(uAC6qOi|e0qtk6K8MDv#aZEFFS1X|VmpPJ zc^^fs*Tc?MqZ9kmFPM*Ryh*neutN-EdRN7c-k0f~NQvk}7pkd9eb$zWwEH7zm<+?{ zIW<*RxIpT|ksL9Mo>w!W>l5*?t}=;0Wy9!8_+SxzX=7xWRLInZuonnFQj2*c3a^hW z6T|3J8F95Qt&f!CHR$;U88<~r#4!3q%@pU*6K&uDyrM6?ZG%Okb~iwuQvE>ml%(Qm zHCyzh2j%yhDrS6NrcIG74vAqJJ*%dQzC9tC?w6pisc=}PgNkzyk5=@hS8Yw~BU?bX^P+RE4q z%2I0B&LhNRT4b>R>B|i0{xks&9}Tb3dGX|nv6He3gSQu4A;NWmtE=J_Y!_MdnQbN0 zX1RCtXZpsL3CK0E6#V*DPUojF;bIS1>RuOGRYH+wy^ec_t%D`*$6^IsC9>#g+e)B# zBDPVo$io>LtU&b;d*yuxJLpA{fiU;bIO1&}+RXvJ`&jFyaFJE*v&dx^0&d?A)nEQd z^oN$)4AvrSH~Eo{c!6Cw=yW>M;s3EeQ@KuM+E%7VqqREeH!HI7d!n-Owx@d#WQu17(fZg zYe~~JZrH(3^AwI?y~BqJUj#I^!JEU*B;svfIaDx;1 zMJ#PF9cUr6>#;Dd!YSESW*UyRUt&@55@EA)@g{btClGa0q&9yNQ6{x{c#dRd0=$g_ z3t2mw1KN!&kM`v__X=TPuEBkjgRu#~U_I{Bsq-?cimfn^7FqNZ&H!}ScGA1=$+l&p zkZD`g!^=f~*66YXXyH7>cD~Nscgj~Xfn*5aSZPw3I@Bt>+r{Pdz*|ZOm7h`X&GFl4yJ#!9bkHwz!Pah(aL&?95A

1gMJE7aCcMK&NJD?t#U#b+Kw3E6iH7rxgM1T5y`AXU95B@GLqa8KDy)R&a1D2lxte zd~9nBlmqBBY_x`TP6pf0;M=jfedE|$E#@&jAXN_sFgJ0oRGFp<)0Jhbl3()}p;4m!-3eR-BJnOgp0mmm=-5mUdv2{5 zK*yx&U4w+Gjfm|}M+2_PBL>j%-%}er4`9!+s2QtoFDl|g%aPV8SX5?C#qw({3ho32 zZg$|-aAg#h0Cq8eew1-IVJ#KGd2p$kiyuEnQUueHQc1o>-hsdnLB4_imx}>(nHuJL zuI9jSZh+n(2NuhN5;vrR-=rbt-PmMlakHGq(2le9QEk^-^mI~>i+6fF{Ygp|8r>Cz z&%gmpuPWJ6nFhg^;y_Ok7ziWyPI)~2MQrdG=cmk-(-F^nS#IN)D7w{@kGWcJO16xcS&IoSWDsG^QJIn9@fI*m5Uk@y8rsiq&Gg7hB_P+hDZLFE3W4 zL5|wMj-U8mEG-{9X7Du}f;&BjG`67@k2r$qD41|-1KBa$Ih-qaxKo^g)g+FftXzBs zQ-q(XUk5z%!7w1iknGq=+l;C52KZXmq8t!@*65z->qvcB2@5~n6V199!atEk|5Ogj z1kc3{vqcuYqT~uc-5t#mSsJ~f6!*?s`ycYma)}x)ORyFYi6s2OPc3B`vmu>OSF!^X zM+=Yx=Gw2GK&=O)aU_mGQvK{8vt^Spk~AA~dey7t<)wbvCz4Y1Te z=`2uDktngfnySeE72B4LZU25}=2$aXO&m+Vs2V73B|NgiRi(?0oG}bl=Sy7y!I{)u zgqWmuncdJ{vaVq0U%Fopz#PgJFAJGJXThN)(u|=8VWEc0q@ft`Hdtp%Hed2_JO+z1 z%xZj|sDX4U8bh56K+Sx6%~T(;X5R39G>f$!BUxC8YtBzcork|sArDl;&l4#G3x!kJ*a^+(UKz@ za>-7t*DG`A4sMsM{i;OnBLtYPA764Bt!cS*OLT!D`&E(Lp3YaJq(84rQ;gw|u64xI zi@tf}R*d2Tcvu(F+{PX&;Hx1#$Zl3>RNs>BAXC;QSa;v$Y|t|KN?z{P3i*rX?8wdO z`g8f9L>RQ?orU$d73cGSI3LE%{sRcpV<^4NKvs2J!_{UV)rjMKjFL_=#4dIZxi$BA zy_D(;JxrkpMKyANy8cvz(TXr?xqbq?Hn{ue5azCW1aPr7c+9hJ>%#AOO}*&L%l!Zh zQ!T6N*`(~B1`GFbBUMAP$bvNgz_aOYtVg3NkbE-hOa`EBjY`gYY1_f%~U9Z%9_@SgN`theXrO+MsJQS&&rulhLM_onGh z)%+gqF%f3^uY8i4tC{TP+`|aq7ks-+ zkj}$y`}-bt+CN+R=jF!Am_O`*qzc>)s&;qLo{p|dH_Ln3M5pCnEDFj_Wq`)fk$fJg2eMp~g zk_tgkOMZe*oyuR@`=kDe3!MLHQZj2UZKdr$ve1hJ(fz1{g42ZddZg{vU_Fm!?M{M+ zDA@@=Kp2`P>)eJIe&QYzYkuU_=7G<({Re-gIt_BGW;wU15_#7@T%9Jjr3&n||E|AM z<;mlze8l*MXO-v3Ls6%ha$Bk-lA*p!HT8YDP5sB{X3gE{`yTVUEz)#9H2iN6u1XI)aR^)IzD|%YSrm- zQAjmF2DU3mzu~Gumd~*to$7SRB6?XE06CrRbJ9O?%_7 z$s`B!)cF$6SEl^RUxpyblV7At+^0adTkw22j?W9{g|Iu5d_0?VlJ~jERb*PfNSuG@ zpQoxIH>G&Rns=)b`HO!zQ#PjxF4i39zxd1e`(}r${DHp(F;!*CmeibkQLp#(pZv8f zvQ^7wc+v&RuwGTcuq1vMF?TgMo&usH3a-!AN>RkfIKDbXjT^F-BsJw0O`&uRyFdkRpcI9(z;Xc znsX`b9e2ptebW(E^B5~a3#6sA78ZYhwVJIAF6PO366w>RE@u?+^t6;EgBidk3{%=k z{z!T!!Xo?efwbql^I7<`H>49aD+Fep%^H9)oMaVcWkZcY_B8L#lrFMMi)NYroxDTt z^x52NL>vw2NE6~N1YNda!!urAXOKx0V6-km1!zxQeAxv?$C?|lyZ zHj+~s{#E*KYMWlK4xe`4bKXb}*dxKMuyBC3dAxE#k9L1X0Idj!e=WwNK)?KgFkc{M z(yg#eF2c7}LGl`JA_3SaQ5#kC!@aaN|9lc%OIWL54~tXFN2SUqBD z3S@k-YLjy*x|#x0#=oN4WVVx4#;kM7VcA)GE`g=mbibrpWUh<>w-%mdk6tTK4>dbUF8uD!yhE;<%hVRPu;PT~N|jq%M_i z|8T_B6jR<#l~esgiW3N+j(5Ho-3U^6-hcp!fRS2)Z$+fGfRj6(;2zYx5_wBDs}9-K znXjhE=TeIrNcA>^r6LOXaCN!7A==T+-JNq(2M?SnvPWtWklQ;;P$6mqr?}(*pGOw% zA}c#4tEikqZ+j8M)pFWYt0{BT@&#%N$`Svm9t7oVF~sPkod31)J$fnRK7Rsr7~@=u zCh47r5JL(vd>a8G=2xi#UE>nX`XZw;hB(z`*i3u1CtUiay;Rf``GG@@eqxNUkFthL z-m}b`MDLqt8Kdmn-A=Av+DEtnsCvb2H8%;(tA2vvq@XqEo~26#Iz2On*zI(CWmSm` zA_LS9Sz2Hp7svAy@XL}ANn|v;3^CuUZu_h=57x2kB;7gt;4;pB3wI zS4P^k=GQjBM-OG6lhb=BzTfmH&s(d;o&E+V2ZN{~;SPO`lj=_V%|c&cMOGY>KS>{W2`CvnGmgL2e4iKyo%mgg>KefR?1YVa?^j|^x~nY!OeMt9wcN?<=D!)x{7I$ zin_UVqe>@NOo~+0RTPb?h={)|Qde<7U1?-?oi}HNmpGu@V`v~bXDN3C4Q}Sch8|iE zc-FXCPZ}Eikw{%>MNw&mi~HSf{$BdjDCKHkzTt?6eG8m!U+a72t#R|Olf1gpQ|n5L z7nK%Olorh@Dyq{Tb^I2ixUQ~lbhLDIBvLo5Lj3$$=k`&RaQb*#^6I<+H@KO)Jy`z-*7lxJ_FDhcK8&&#v@Y$4FJxHpW!ltL-()n+@wfJAC%d54iOAm8 zVaJb_j2)}@r7mw;*3z^%zM^SavbnV-Zd;PkY^bHxGbi#pv+5;ap*Fmk&Tnrx{K2MdBXAFHjVkBTr(vfy z$?k3K&6-D8d;7UES>F6VwDxxUXB$V^cKeeV+iv&U29(9U6pp56f^FOF&)9bRkF<2o z80^z>|BB^J%k?0PBiE1D^1?*iZZ4D5+`6J^LFT86`yMH+3wlp?PgCd|*Z6i}FALPH zWk*_4yCC3Luw`Y8O>^C4oa@+o<~A;CYSG4~InG%zo`}j}IlU(PdB&zWj=~QpEcJ{{bCxV@cC37J7H8~Eb<;iU zPW!obr#YV8X-=}kwL9(cnd{k|=4R|pbCPY2-Dys;x7}%uYs%Qu?ldQ3cbc=Lm))uT z(=+|!&&7*dJ-bsq$R2j5IZJ35YU4^bq)TV)PIFwl(;Rn0cjng}~}LHsO&$t!wMe%#8JDKME60avq^umB?w8Sg)0D;+o+{F{lAk zE+{}uiJV$Vov#ZRw8Hzb&E`0@R~xxDtEuW_yFDexFxO;2lAvVFHFsw!OdvDAm$~MR zluIS?Aco4Se7B2+Q@k$zM;4p=-0}uxOfi*n+B9v!_Ynf{M7D*)okmX(f1djmsd5ub zSd&6B^VB&gLf|^hD|=`b!qo7@JyZ)o7-x*v4R@2VCLJZp5EQEtS-tlnYNrr=)YDtN zZH6*r#0FI&b3@9Iu~9H;7Zum9*h>@-On@3+CI43?Wg)e@uXy{vGaM>rEwBB$i#zNqpcKlATkvp=HBfc^VEjkT9k9be<`9sXj(Re#8?6k`YP zCP$PNUPyhcO;lqlAEw;qpNBY&1X9~?VXfQTTE9$%RK7gm)_Osio418V(txRbrOr^Ly}qJ@>8kYPby6YIiMfJHjYqmR#mpL^c$8qoanv zks1o!nQXl&g6OTl;AZ!yoHAy=ZE_6XD5uf>GBGccT<9j}lS#s5Tm*{-EA%khfEdn2 zk{%>!17}J5I?0{~YQF^}yB5`UnMm$ zXH(3vC0(zZ`-87mE1Efy%)%0{&3$D5^SFC_xu+bmCX@Y-KC<_@*(XY2UhY<<D1z%#@?BCDLKT9NM_N(=!ycGR-Gs&)je_{$tDC@s(-OI@{#51 z?BBW0?^R8Rs}m)Q@wY5(Iatckb=AWhilOcz*ms&UsuN|hUT+p|;@pjiP98y7>Uq@& zFgE;T$m{~{*OoczL~WTFL$lTr4noeQY(>gi_&uB7G(=d)-YO_EGH>LFWO_BWBJ4^U zePg_ipQogeS|GaTlbxOyu;-J?*z?8J?0J44J;&LbjMP0}%B4aND@Fq0XZ&j!l@BTvTjN(&-FS!Ww2jw^H|n_X1sqoLYdSzTSnQLV1`(m5g^ihPRv)Xprd;yY_lZA=2uU4x(v5FDXw8EvJ zGPkq;*NpXG|0jFFgFIq??yHrLQhKv+>k}CbRCs0E-0)rNARGOaMPrIofBAzxytncg zMi*iP=V5A|Y8{>@D1kpk8wUp&&V8utN*|^XuF5kdSmq9P-#8Bp+IAjwz7~%6^4I&F z+vNq{Qz{Rp>`2!`UoS8Cc)jGwkJ8)p_40zxxn6#$A+#@wJjjl;0B%5$zjM97WYj^C zJ@%$~I886tF_kAjr;(Zt*kV>-6dvNi)ePh0f1?>D6`q?-8BnYG$#Drb*g}0sc|vJ} z&No*VFzs&DuKLLvIwRwGu|L?C3g-BtB7j@|;220`nOpslvA2lojiGI*zZJ z?BRXCVV^y{D2Fwf{Ld6s6ZHOkxwHEJYJWZ?n_;PZd0eAc_UMH<9HuSnJ zCy`XcW$$WzkUgS?lUjOywLYMcBCxxJrMWv| z90q+metk7JHs|$YWt+Q&VXos1XFP>4p0iKZEvw5BMvcmoKV?dN4K;MNzbaz~H^m#t zkF@UQ5u{#&n?FQK^Kz-sMXkSl$R_`Nz2>Z<*MYjlJy7iv`wyvnl`r<0+Kd=4i@&9) z&7WVShQOT0tu?F=&1$eIJG0A}|5E#5G!tRBXGPUu$aO}s-n|F9LTa#FYYZm>AfI+o zw|TH!V?LM``<#91KByt4tS)fRpTe+%wjom1*ZjNLg*2_(YMUt%YmfSS z-$cE!w#&tuzJ~Z3$e^qcvM04mFY}Sbst~3$Y;@iRWy4jW)D&=yo14^d8DGiL=jaDP zSrjoOqxRkXseb)OumiMS`j!zYu5-Tw(?I(1@G-qsu)bBg$Xzg~h$7o$SqK;Mu z)G2n`M^#jP5ArJTuA+E;AYpIR;+`Zp@0rh-0jiEyo?_#?L zah`B$2LoWJF;sG~a4O=sHH2o!r2P`*StpbBNVth9Q}#<(r%c%+Po}rf7U^l<9?1Dk zG#HcSdc>(k2Xitv&qLI*nbrWS6@oJQ_mF;T8H0ygNU(z^Gw#DC)X2hDAwv`T#VjYR zMF4AT&{me~vvv%lLF1s;V@*#ep%ckCq!kj zZs~+Q^5b-qyLk7_^ya6skHuSfwwFE8&Sn^NbMQ-OC-kN}OU`qB{$nucnwn+Q?k{vaNRiOekxDH`ZdFg=a6e_{ZFaUkpH;MfVG+# zFj}rm@6wBUt-GjynW|RqvtC#57B$s9PlPP9PxH|-z&^}Lnc1WS_{Nu?_$rATT2yJ% z|Jdg=<+``(nlU`fh9Ry-c04e}Y*ghc9SS}^Hhf8Y|SJ@@ixm~vB^#7s{jYPLIW zhQmE|9j&(EFgFYaHny;Xi~B1a{Rdps&8>*pOZ?|pj#H!5_OwwJ1~vF9K&w-l{nik# z=kL|1k%Jcw3Ired(;G5hqM&bA)R3BklI;@V;n3sfoi0s zkTZ86e*biJ226R^7geQlTe^H0=s_*6X2`St`_$x~N~9Qy>4>SItw%c9)gxsb^wF?X zQ0tMF3iU{Xke+&^rLG?78Cs9D6!K)c9C18B>U+tnnkJX+dYd34@U%A=F0JX$KQ@@NRI@@Sc(Jo;K6%A;qHU8YLs zs52I*(w@qrO){~zewNLQwi@bGkl=7(0 z@$sliPKhE@(LEj_1>iKDdc$Q#+Vj>e7tK6Nzkr8*kRniei@ zTG002Jk$5B$>0dWd|%?k-zoCn+{-U-Nj5HQx~!=&(X`BV{C+}TDhA1wjZ2r>?s2t$ zW=dzg55tkW8Y>zX+ahIuQ+r#}GVM}UGGa<`VA7IRaU`!QlW%ykOCuw@lr~pM!4-ju zC(V?e&=aH{QenfFV>EQx`Z>yweteO{$ZY(=AZ5t#$Z}Pxz5y0FkE4neBu;g9vLWXw z$X7%Bw1%_Fv;IoCE>+G$^bEt9bCmY#Kh~1cyEU>Gr z*Dl8t|0$0%9O~XX@+kyAiwC^$g@36W5A^Sht?V~#AdoL>3x~Tf_b?^X~m8pUPAz0 zjI6@1dHqeu6nUp-k%ml>@tGoz^(@kzDN>p#(yNtynIgq`xiJS8W6Br0odWwnTyvEN zO;L|Rr?Su{m;nrRd69)zJ0(T_&f^i2P$lgpq-3(A#Kt1fOv=JvF%#h--o>1$_Gv~G zxI2?dXG3JR(=H;Y1oE=445NwV;3yp>H2}#@NLL9gJjuXXuu$my&nE^=R4kY^(w2|A zGEPj^toOj(ZrJSnE$MRkp}%rG0$_BrQA)_Uu|L4Yaf3i&l{ATC6%8;4xx;bl(nX}u?u}KUIF;{ZF&&^5dxVW^m7~%8#Z&mi?UMPKD?pa@YxjSlc z$Bb#yp;aaOxW1|W@;}kVY+JUVwPl5UVUOzT!d}?8U_nzd+1M6$I^*@|cfM_Uh$)60 zxWM1o7N_!&8^WV+6+OeL?o?#UEz6f=8e=QT4xQH0w9;v>NA`l&mSkIFi>(mk!Q!fV z8OKuf@;BLIVYmLH<0$xh>yk0_1%u_ZF45&Z>fzERC%FeeN9eTJDvn2{dYUeNM?J>h z(z>v9@#5B%@uhC`7Jpv>9Q;dJ5?s^jn}G zbG+6r=UJO>bzdQcL!EMYZ2toalFYl21a0yrBMzfjy69wqOkc`k?2wWS-FP#8 zA}*_UA}MVdC7@wWyC;$gP4avsmy81UPdVOny|$Th&q=p*p;I~xlQyU<{sUdSNh9P` z!#*!SZ|^>scSQ`6d0M*d&CN({eg4C>d{*<*L3*PUr4v>tNCl^`OM)%-XA~*V}37{bR{ZU>h-=Zk+3o-ok}j&ouhw)MSKjJ}pi&x=UUH2Rup_jGlG>hS;gM6EEGnNB}-_cl35F=Q~Uz&)$3 zZYKklp&a~WQXGfV`GJsNvJH_Syh{MjsMG(=NGrZ zEesh$YB5N5tIC#s!|m7Oa(Zx~Vh9c!RLu>Mk$hXo@NQUgZYyM9F`4Z}sJa9j$MbP`4YuM# zgi(Z`v=>0T4g!^M19Z_Moh1-q6Uz|540v7Tt<_fB=1R?pw2;gO&tz`6^=CFK$}ec+A+D_U-wlX9z`!D49GVoV!nGB7}+_$B; z3^f!qKg{7tX)W2LOsv!EnJLfv?n7M83(1%$Za+w@G(xR z?C~Y$Q@GX)`5qgzCnF-i@oivA@0kF#2Aqm20s3)_@4mzsD?jrcf;>WHFH`nX|BSzy zrpe0IsdJ|?LcbB^e~^lH$T=Z?ixIul$$?aGHOxmGdIsa5V?cSvH_wiVvxzSpNE=zf zzoh6^o=S(NN@etGQ)F&vD#9{wxXb-4Ji*%zzx9(VX}d@%LhJ&~=+cT6{wOL?G)BLs zg1CgP3C(f(eHFu8NU8u{Z2jGt_CC=p#~`M$vc4uP1Q5h@SW~8>9RUI=>1xzSDxd0h zHsA8#arPnjao>la+1DXRI;XD#$u-+UN0h{ zhZ&uI=3lz3)eb@Gk`F!JQ_2BIxiq|T(ZjB@T3U$-ej-6LBz|T0FbAUZ;?3S2JefpZ z1>Fk&+c#Wa#6cypCLNk-ICt?Hw{Q-5>PeL?3;3qWft+4EYMNZ((SN%$1)m{xbGI_3 zBOjI$N+{+iQ%+!njp%et0bN6xGAo1t8=62h-y%}3!(dfShjG#u(zO#w4E0#9TO5dU zsIIKCWj1|R=RnGeU2dT77O%)pDaBVJtLl|$kE;!%RgPSn_UPOyw{$;wo4~^M7bVyb z(OmQ}%)cUtH)hDv>Y1(viSJuZ7yY!Nz*fp`Foh4k3IZR2RY+G!0dBwq1wdgmI9y{-}JO zDra0edZ`qnmh6eq@`;biTCyQsJ`uyv#zQy-OFElo%!PJ_BngB?mC5Q%gVI$lMj7O9 zzNp+tpY5a&5fMM%u9NsQZLm2VdG?E?Vc|lmj8Zr}QhwnhHscDE~ zF8H3_KtGL$88u=YqMnp_n|3`yx1E-jMqL)cLkQz;>H?6dUnCQ#X({13R1(U1Wh(!> zf<8wr*IuIGHg9ylnb!ST7PU!?!0_8qKzv6N+_PHhcYlDF< zSZ#D;_j})P)n9IB&^Ab0iR4xeLjdO@h&ebDleO1b3nck1FfNrb;xm;kzxEABQuUYZ z=@4mdJ)^4&5Ez9pgE_d4^}p*3p}+jamzUc$mK{zhR{bH75|u3>c73B}+RK_(oVXDK>t1363fCYDvL?s>j1)52PV+_MToyOVv&3w|CRi@4*n-cs3eZz>-_4*PXK zd8udG!~8zSOFEG`Z~58zt#loVF4bTDtO5k| zZ~CAkwHBnN<}z=vRd;*fJ)_r~sLCo<+(ZY*toe7}eW<}Gf{YnexRGaW6~d)enkby1 zME=49(7wNBVYC`3c~NQMz2O~IzI&Wr`pIE`UTzoP?6Dis!04HDk;*tpYwDLkjJG` z(jm7Hue}s3d;pTp0m$-dmuI`?UI$Ld`$8E3S8dlE1^GsrhvVb)4KDdn0`U-yjX08* zJ3|WckkAc!>MVC_72fAHwM|diWSA2X!0QNCK_n_48N>B#g{fV?sp~MQa^2odjK!&i z#2+$Pn*7tKh1}NFq_XA8G(G%pW%pNdKQG_LLx)#&1HxDaOS?C$fK?cQ813?|?nA#b z?JA?c8B2?E7^^wNYzd&sFz(17U!c52R)%@8L;w zOli(i*>XmuhaXZSaz+%JVDcF$JnH7^FpMK>RkmEr{SU~fC`PMnox{_(8F4Hg!KYBU zJmV|FBAiID=F)5%Qalf7SRk)zb-^?U~rf*A!=j_H-0s9HF<*9VOf;_FSs%*&S^cDsA zv!;YvlqtdCv@bn}SqD>$a$B5Gro8Ff!4_&lRQzt=1<5TdlJBeG2&!y3yh;Q2sxN`K z$~NWx^iBo2N|ixg)5_YWbPJ;n4ULo{{OVRtY?d_{H*CXNjl;0o0SQ5ectq=@hI8UMWpXOmMG-<&H^4C2Q?mPqs8gu=!-b| z2!gjw(Fo>vuU1jkycqKJPV%JWV`W z&>An0Te}K4-0UdV5u~F@{x14(l5cd9Z4Rocafz)8@hS5z{oIm^d%4P%H~G*bV0Y`Y zDJd&?r6(QM>s}eleA+YCK_rldq?}ms4EdkL;R`G{~1@6gnxoEt5|E}*oyK*j6t?3D&#Ig( z4RQ~7_BrX9_I*#-jp&kn4{nW9q;HUSySX;V_vPBWpI`njct0MK=aS}R(}KRZFyuh= z!F=&59wVR0$L0>XteY?48#zVBCOf{A?@soT=8X^OiveVhihPm`3#c#goX2l*L^?eb zV6z-RG{-2brCIaZk@WohWP1v-*={S@4jU(X>Eh*=+Jf{fH!sW8n9cGuX0tMixmg)* zj?&I_E@@n#eZ^!^ox_=KWylk>I@UG;7XD7h#fvJ)4yZs-N0p(@qa|t&&w5&5^L&(k z-TFj*Xc~feTysLGs1=40{DO3`e~*4tSa_V)-(H#ZFeWqqX9&`@fi%7?fv9;V{lVj$ zBGhP&`dbm?6J1olE!Bc<{xGd5jLV^4`QU~9mMTs&QzjEF5ks(uhe>{1X1gKCwr7ReGdYX z=#bSR$&XSn5|?v(@N#`QM)yzcBSIN+hvenHh)Vn$F|?@@WP6&l#wNum_%v7HYmiEk z;b|npcpv&}C!$83Aa|q-lp$~WqS}&*F7f5|^kH81LQntF)+GIk$<6=R*DYTsOBqER zJ>MpO~Wf&RJ-+8h~Fi$(oJ5od%b4glRU;&Dx61o@L|Nj=%i+woHU%4kVrBWgjX z70j50=}bn?4{4>$u^CncWC#P&bTM0EOzi?)y2y*ZGRnc2k}QS1%qDm0pLdlq$Yn9) zJZ9ddYhKFFu2RU)nDLlb?x*}oXF&h5W`>tdFU&NMgd+)42?8Nxv^=@*tHO`)N2fszatwDS)gByC{N~%2P`i zszHWDA>*TRZi$Q^jwEC@)ue`Ukv6?Af6`}%UCry^_dOENV7J@S@AsWp>U4iv*)h65 zsv3bRIY#Phd<3HuNt~gjT^8it^!rpPV1DVVcZVNRq<=%9N zao=?HATxu`SatPV(uZZVGlDaZ%r)hfbh(UlvL_yyE!)zEj~a$X)NrSY2FC5L=afuw zkA|u@yfuGsRu3h(hD`eYEIv50Ag`?|=gD|)R=X1U>8b+6nA%^jh3qewbw^f0WyxEs zd8pp4qM)fU-$>lgI(oa?JVR#)nnp;_Bp%d3oN z()&_2c&wS#)_BQcTU6)}qs9?JPM6f}A%67eR=1NQgo|sOnN)`M&Xc48bQa`0>AhMM zD5n=ApbRO~s-NdlMPq!s%93Y%)EYLZYf(-6jeybL=4SccvR8&O>=j~KKY9K$gFzXtGdOXm%FtB0fO>bYG*G{e&f@yY}fiCZ~6$$x6@68 z<&VBHG9E|r$$r@1&R0Le%(yC5fYE$lVkU{G)%6U)=*k*=zw^4ih28RSoJspFtwS)8 zMr_6~!b|^CLCCnZquI(PByrae4#PFw*q3R@Fs1cqN4!9a z2->s0V$G$rRE|86exFG{^OYfNmm*tjmX(An^Z2TCo+&3bkTtP)mLn@vnf^ypQUo-N9ny&i7?si z8}6PN4exl^d6nWdGNU8coaIUZx-;3YYvfJ709&Q5;(v=&(AftNBW}Ou;8w2m)2jJJ z>bks0>*QR>q0}x~xGF=g*D{?=a{0#|ANmg-5C=5a!PoH@R4}AVm}~Bt)Lv!CQ~nJI z&%7FUo#@tU_@h_vL${tuluX4WI!Fl5yc5rOrK|RPrT<9WDae~CGLf|Koy4oYAlc;R z(tXgNGWrvefi0LpTSQ)(LCmT^*c@Y)!Z_tK&F#@+{%%V9W_;D(e#z3Y7eNMW2K7f@ zlaBme7D^3&_C~dxB2+D6qy%fZ7F)EsQCjvn<+OTeGbuiI(G>p0X(3A<^j9i>&oFFN zPTtYA);Kv7i@esG$+XYO(xyePd8S3a9HZ(3yDObzzQZiCo3wQ82}fP~zP>e+zg!j7 z@d`@|m@m5)s2kY2%(MB;>g#fFn&J`fcfNai3HEz!u!KRT!Pu~lhoKBIWRsx7KE-+F z=7r?lCmnN!4I4I0{A4on?GmPpyN#4$*BnN4cQgamjPn|LnQ9f3%26Fcgojcc7$(^L zC+)5DgMt_yM-tbPa9A!a)oxP_FZP5zPZh{ zzLvgbg4skeSI%y4-Jve`mE`$_>hfpw8%1JGEb5idn}}38mdo9}B5z z*)e?fQ}eTr@_o9%Pul9HM-x^ag~KJ*w+ic$#wqmM3x%?81eja7S=zX)DW1`{%_iQMXD(@MTVOXsTrnvp({JwL#$;PYU-#0c zmZoLRy3K4~j^Xpy=*^znr3|^rUq)|m!wwwzw}2_;Gxqv?Ka~*-8+L8QsF=AgVlEy) z5YHmWqu(Nbk>*sFBRqBN(uQfqssA2_6bZCxUqnD{9Ao?e#2F^gDEt(gxEm3sb-Pwy z8E%t&yOq<2q5Y<8#hEw*;csevj#Caqu8K^c@jTT?gP>e^F)S1zGM$oqNQ!cdpfQ{U zWktC@V}iVhgSZw!Tn`##2h4)2q+=b{ODf;BLG6au?Farm1YN6@-I?^m{yccXfPI7u5)pBh01J$%r>G9s_FfJgu)6`#JG< z@)LwQ>T|Y8X;dh$&MK30siHoz7BZjWz*#c3#pcae2;%@njAQpSx?0^|rS<<-kOL?s z(dm$7O^C^WwVJU$8#P$Ii0kntYN8v%NiR)n^hd~Hon=$xd?V~3W0qVZR}KAj z_B#G4uhWgx!lFtI-Mf$~3&W(bxIE9AJ9?;1+co!mX-&GqkQZ2!jH=#!Zs?=tPsx<| zFG}dGwi0>`?r zV_fT-M`AloLxQMxFq2im?oN+HMMA>r>Ek(JxI^?sBcdO{)Mf}E??Tb)RwgR z7bh3mt!wyO>?j!iWnKUg=QEyca|pp?Q`_?9#HGE==##ArE?=-Dd1;T9yd)2tUa06X zmR==$nESUiFKLRmv@UGC+$I|NJK45u`2u^~#97O7$E87!<{Z(o^mT1zxn}*a*EYwT z-3u02>(t1_sv5>^6ZsH{BPGiHah zW4-3CWEE3ya@8D?Dp{Mg<$%qA&Z<-cHs+lgDpkfC{G6ozf*?+=XB7*a`f+cd7wwq-G`CcZ@F%5ijadjh0oBLY+iRmLLF zm!H{)7+%6ijMu`d;Ik;ycV6c%-bi?gLRJL9Tiz%?NI_d_C#iy!CA>hwE*G)zA07a- z%SftR8Js|vJ?6KtM`g%)o^Dn{ru3Csf8Ybq@-m`w)zKMm$VlDU&))nRW5{L6#sYnqXjD;Lxs0aL#WBg-wVbZP1|{E#mV zUhL+L7>R2^+4$lR#f)M*`102xu2DlbfHxwJhU*a591D8Z($(t_pH99lWJwbO(r*J^ zl*RdE>I99T{SsMoz=2cAYve6LM$Lm!C`%7RTGq*N8^Bgu#J~3Pw91voQu&CHbF#;u zKzxU!cj-wshjEEQz9G?vq-neCPu0uBg#5Fse&-C?Ac+RZKd4b>idhV!N>&~wheFpf zPeQYnRlk8a?m--%K)%Li9!S;8FZ~H=s&|`Pld6~R`4jS5YP(^{7sjE6hul(-&pYc; zBXop8km7uJ$QQ;QbFf>aM?>FC)yvKPg#0eGT@D%v$oj5&#Enw<%s3?LyAI18{)D`f zs+ULo37MGi%KtvKT|T89$u(W|dR+#7hH}Vv{gtv$XC)}Xr+(z);}AUUyaq^C0ySy~ zWPcakCq1Z?e4Bot?R-$UVje$Q%3_$0Eob9Pryt6D&X* z$1oaT$yQeUqnFi)AP&Hi8=3sKu6oR1+!xKLuR}o3Kbf&V#f6{{-@Fl)tYg{#bk&PL zI$hf*Qp--aj&q5RX^0zV$jAOekQ-72`SwffihuPNgL6hk|0aaxFaFJt&8hn7h#Qvd zXN7O~s_-r=+{UCZD{Q91(C?YHE!8>$LHt!$e4Q1)$5QcyPEWsLq5GMnD@yieY3Hgf zhCG;RrCu=kbTJsGa`3sekj@Tgf|#JUa1e`VRWt&V8TTZC@a^NY>NH17Oy1AdewC^R zkzi?pp2_zx`3-ih*E-X9AjEM_nv*{AGsNX)|9;5(sSe03RLy=nRS&tHU(fODF}Cm| zzn3CmE*`$z6Nou<4fW(`$*br zFx&^HQ1@@jb^dn9KT@sJ5tsgDlB~yrT8kl!XF&5~ORizp2MI(@6w*n{=LW=kVu#jE zEZqQ0KBX$bwP`L1#Py0Xi|BoZYv);lIT)5qs)hVm??TyVP`~3JT_MQVjYMX7(&@IG zUMY3;ro83b0J$w)4|&HIh0w#Ve88_O)Adx$CCf)^5R+Fw5?n7)e;U(k&e(5=?r~U{zI!8c_OVZAj`dg_6?Y+2{NVR zjw~t$#n7nlu`tZ@3DRS*)F>FEWW(yinjI0wC;X?B{7X?>Z~WU&;l5T*mGm}OtzgYy zui^WtK7in~JJkTlpF62B_JLBeMWV3O0QpmA0k5>Jw4T6v)nC5b8G?l_rDPwApcqL+ z&Ot!+m(88^Ec=eM^DLD#m;XZT%7%Js$9Y{ookiZ^WHk!%;i@@G$)>D!4k;E<1LPGA z!edIw1G@dUxQ3rVTn&)Dovo@rJ!BIC>VYZ9=Q5n;VREGn=NES0YbcwbM;$cb3wVL; z_Z{!S@FroXL!3bTX4N*O+w6V>Cs-Yt9_aLmzYnVAYm9qpX!xA?_6hT$rS~z zWMoag(_)^yMAp?L#PJ!z*ytK|5L~n?^e*>mL@*uJE`+5$-(4}?U-7zqkM>!Zgv$^H#XF<5s$T$?z{2dg z+9h^`gfNL>3k&f@h8k@+(QD;ezrCP&giX4p5!T|1U>;uq3oWW2ξt28Z~SuMz>( zkIb2JJLMH$JAq!{9PSbRFi$`n>vfPk>ugBw7l^aYE$QvB$TQJRz3;13{bVcMMY82T z`tE}zLu;k2Uiu|uQN84s$)b9F#x|3!qWa0EbO~L}=FvRXfrIuwy8efRLymXruiSo- z^kZZJ9vN>Upo$@D)2&#~+MoOOAjXs{(_8G6!%TtryVVeRfx91@RGvKQ*XlZcK8B2o z4$zmR7zq-pnzcvM)-WOw#MKZ}o=g=mc#wZHtO&(n%iibTu5J9=!N2Z53Es#3^(?9N zGuZ&*k@-|z9eokWi)$f%I%3~STgJHf=TRa+H!g9=D*AnBrasR+NY{2)V(j6*`$Bdw z5)I_@)pIaZDY;S=<5mKeC!eq0La8VN2c@>*E|n)w`-W@hwBEC1-*9Ik455L+)`w_m z<{z#G!Isj~pV1JxbR7Zai6@G#F2zi!fkV|GTi|^o?sMrw9!SF^ZkdWNk6#se!UMUk!3Q-=T(Fk2s31=Zi5Zjn&ui z!{ikl&WxeE&>KU5MiK+%goFzmrSU`L{fwc+zD!}gZS{yR&LtuuEkvpffqxJUbZFO;Xb2wkMR0u%z~sED6RFq0k|n+^X?nzlpe~U9$PCAo@bkR-hqeYe|kKRL~L zKEH^tee#^db$2;wqtr(COl$}^kPMK|eRQxp7FFErqapDEgbCIN?zPd7`3251R|a)M zhe#V#CaD6=%cS{5rX_81M61$8jIL)ka{nTTF7AacTfR#9eUaDoP5ONsBk9DL6Z;W1 z79N;iG#?d`)q*&FM#xEkn4cj=d&;vZ7)Knl)L_|>O?}+EY+!%hz6+KbEDvWFs{!(J zUjN1+HCTS!v(R(x?`t_#3^ej?L;z{TAgS#HFl()TAp~X7I>?C|)L{8WcCk&w5gQ-1 z?;52B%Xf5pud!44WBV@dU;TC?j&{WBSEZK!HE;T0G58A?FZ}{7^ z%qpmrfG(g;GTl9r$)V||Nzz%37;d2UgF9`zGnM~pBCUM>OsQm3weEo!*b8DJ$StGA0PV?-Xl6U|{f3hyP2 z&)4zu#9C@6yODH00=OLk>HiceCTb;a>wa?P!?HZXhdJHr^;24kGGKy^U&q(vC`nbj zY9?#kg8k)ByyvLHKr_kL_3V+_k{Q*izl6ANNLq7sInFYCW1LR<%RlU^IjoIgUjl=; z24+{mme^@kOLA!f=T32xo~y!EEzXPKb%gN&0$^B28fQt@M(-B3ydJ0%M)kTQp-;SUvgE&01$N3+ZptAyG!vn-4P20rVvs(0}+GK-Z@oK>y`) z0A&z34f+A!S{w9h(+=o|eJzL+$gib)0NJX6EV6-|oA2(X-QzqUf5Yk4xLgv#Z+bwP z$AhdNq=l|f21AY~>9UgUMXV9TURjjyn*ai8u*`ITD0ASP?fjnL{H}3+Ptq_-bk0~z zg@ed0y1eWsi`OBk2Fsw~pgo-#&XB%UWgf8m2`ryO&)TRO?O^IW2T{dNe{-GwP9t-7 zFlfo3(Kc5152>9)f{&+6+M{=UG^6QzSd=o9?0Zenod_l-wLV-%VJst0PFyvH* z0PPQ%*JRJiDCc*)iE|=_^EloBiB(9uXFRbl)8k(D$bp$pI9<(lx+-S`)ileAK6H{zrS}e zw(4NWHwYJ z@~qvtJfV6{ZwA9vlf9mA%GT?btWEn|U*(MUV3sr5b*r4Q{X5GU?NzI2;XfF1$W6J9 zk71^KqT}^C>zAw!tx`vIqcgoOA7z(42HSH*z0u)}_jWklztQ1ze>a@&f9s~)>89-K z(8!kWqVMtgD!tBMVdtD)cLP1^_V}pV1*gXyy?RV#4x>zu zZ`(b3C&Z6B91Q=&?eKB8!=Jj%|JY4=#!dN&-67;Da6P#g?h&h_JLC=WWwZCBKG*Ja z`Ea&_)jjPFRv*oFu=;$vGpRe>l$YBzRv`~%_vq4aw6hwfc-UN?KrVg{#GQ@tKHq_Vu79Ue09*--nkM*d))3xuhnr zk_b6q@8d6)&$01w$OZ077nILkP}aFA|8`TZv4Mkpnllea&}Kha-bA`hp3fcbvhvnM zJXpI4EBDn;oe4Rx+`-OOxej&?EO)STZLWizgUg+Lwcbtn&+;achq|M+xxFz&LfJEl zXqe`7t>oXDBl-arHMD_DYnl;4uvP|9tJswM9i*Vhv7hh}F+|@LCM_iy7oJQ-xtXiRT0kH^TRS)f$4~F$ELYy3%`&NC7^<;Uxp0$VK3X4JZbM0C4MICSkFe**3 z0=6o+FUKg%Pjm?XUNVMFFBsXMWnoX>kb6uk~{#;?p)~YOZlpK66v9c2hoY zvls4_{d!M}yKsFo?QR`y#2!&Ss@xo&`djt-H057D&JHcZsEJk)p@vjU|9%!>b5ZZ# z$`83ZJ%=aBAzyLtJn1~l>8%eF*-EfxOqvYmAB9Xefx=2w`(X66HrIC{&iwwUrm2ROCEEFk^*`T`z)yzI3;GsCwITpjB#;i<_F3^2_g_o!`>hvOsIx zs0EJeQO}iUmZx8(yf4_8W6kWgM#o^!N^?oW0k zGx=@Jwl|4PW0$rrYi-p4xcW(1Jyq3moZ0c3$Z2YCbArg__NBdKDMJo9&$x)JEMdKzO2~?QF>AGF&o*hVraDy4S_C9rEh|HeP#b|2 zTJZRM)bN_I_-7W`aZRFHWOad{1r{xOEa|EyZ9-YccZIHoWR(ZPnpzKpTNR~!u?1L) z7*-&RH3;)5DV-ZZ#W4$7SY-~@;v_0Yl{XOk6PIF!_ERC+-Y$vhT0mYyZlgJijCg*9 zc@@r;MNJeQyH5V9zUuY*Y0NLO<|#v7@8Vnr zB6QlIbH9nr)SMv5A9TzCJz54E4!6N?|xD7T37Fc^gmFdx*X0=Lheno`yX^| zr{#;0kbygd?)9{WL!2<*=f4keWymj5bNKT?f0_RIvs4LxKIZ4Lz8f*^9-)paSbm)< z!9|dz1!{oY=BME+JF6-=ELR+vWFE!>o)AOlp+*+2gXGKuy$i}`KE|sQ5{8fj&x;j^ zgLa{o`E$87U2lw#Kll#G)^xS}!Iz-yH=DjoOJJFDcX~VI4PP1JbP0l4OuIS#wtV2* zL2VLKKK3Q(A>`(CwS4GHTuhYmq#M6Z9}!*K#7LNv-;PK8Qn& z3-axL#>x$T#;}$f({pSQ-VI&cw&(D8cqXd_mNMkqU7X!N8VO9p{0QVnt3tLCDaZVg zv4bwS2S7G;QM@)Qll3=ahZ-Q??BZDaZfuq^WE)k6a^}qfwb3LLbpac3h$5G2$bfk> z5ySO1c>mO45Dn@vsR6QHFT#VVjrKQ8xr=-|?PNmk&uT#s-$d0S$jd!Je%E+P4Um7( z=g5C;iJrtaaq&a;8Ly}T8r*oM@%j3g{GlFW7id3vYq}oBI0+o$MH8dG2X~J>abMjl z6TXmIg8sDs3uVZ^QuXrHYOxY?^&2q`8S5cn?4fChvr)@Q8ZYAy(d(5))C4DStekcT zvN!}em0RtCYRF0R^0?#9db5-c+$_)>2RuEYN}-d7m*eK znKHB7lu0`znkn?3RK3ismWhcATu4WG5KKBGjTHBe83)TaO`h`|A{LCXl7C36Ja$2z z^?9X-=>>NZA8xY|lX>e1I$2TX>(sA(jSgg-`akg<0vmo1GD4?u+l3BIweb@0lFmE? zsSiPdM8R1bA!p8;ZHMH`bdrN+7^U(<%?-{iSN=rzNOFaFM5tF&S&b;D7gy`0;5cL(5VVv&3RD5W@Tu?2=3Cw4KZ9O_| zQUi|JDNm|a?pgLL%O*uBtLV8 z^r~(>A35TZ1 za%y>s5tYRuL9KLbrvq1rbR&jQ2*N1)4A%7*e{-rNTcv+u?8TDY2z~WY-@&|A7KP-5 zge6LyfPY|5f7lAn-8)snvh)DJV;wADjcRyAP?Bv~T;iA=JygH;U&B2(u}G9&{N zRkI%8X=xPyXRJ|jV9K=frp@{}X;Gu(^QqI%T55fBiBb z>&=w(c1|YbebtVnIu5dR^){{R7{?bRAu}YuNyUTkG_4O}%JV$1)N!)2V;h&+3n*jd z9UZOCFa2twnum5u#w*;;uOCK^V}zylvW`5`@ixp-(!9DmGBv}Hl_5xOyBZ)@`HQ*p zNhBO6cXyNwTY)fG@)LwFE0cw-kfH3%iHkY)o3DR^xW*`0k`6`Rm`Yg?okx@MHtP__ zhf?2U%(2PXhHD+9C~fDmSo=lbTPOe-KxHslQthf4?9P-e&C8APU08(hNd30r%SqB( zFcd=>+t5)=D7?;V{aVUMaVDl921d!Gs#gH!v!tv&sm;Dj`3GpA!8fAOPUh#>gE$L! zG1!2^D(}ADY5I6d>S>>-PJ(>ur+v;=b-Y}g;&niU5UMjsy52a+9lGMy`V-q`0g?n&(Km z05!Nik3neI+V-eosa+- z77nM;cZ1jQ-?Q@MCZ}VYhai;j_0hRH1@isWPHqU@EY8CePGw*%5bJ^ZI+ zNeN<@%qQZwQr>eXm&w8sSdv`^8QATDu`dJ0Vg1Z&25oC^!)YjzovW$IU8g5vPr(dg zE-9P2SLM&R;p#Y!8I$o%=r*>zGQnEReF;py^&Lf~h zRPkg`13pF_#m;hwaCT{lR*c}&Xgd|MtQ<0^9hMZ=LZTraH!`Sr66CT12K5RcC_kcA z8QnKgO-p{1ZsmKi4Az|(OIoQ2T$$Evl%Noz%II@bzPb_P5R{9z%g8cFc{llB6|kgw zqf9IlfALi^s~S>HFpD75%ORCzkZ7y+mSUL_&Bu7V4!tW#S1as+$rzfj>!!}#E~RC1 zXSzUwWf(OQ6*rL$R49QBSIPO+5RHQ($gFb6gfhtNR!CVH8=qZH#tvHv&ezWRbSv-p z)?TH9V-!KoFNcgNv(IX|E&V>EtQK-wv78^0(>H{qHYDXcLUMLUPTL^l+fWxggD6G_ z=z*xGF&1%LQ-okCnqkfDfhkL7Z3LZF$eG2kWLg37poe#RdXBv9D_eP$bQAx-C&mfd zQ|WTs%e;J-GqI29a$EXiIjKyhmQ7;}Fe&S%3T@ck099MO<+OpqQcT7agwY0T5>Cf* zoUV_U7-U;JchB##YxQfah)4P*2;w|gRC$YmPBb(pj#nRbu4QZcE}qK!v!9aZ+Vdlj zC$n2nNG^)BZubu7Tb%v}%CCKlkKioIh%)8TbUte69qaUBD&OW6^Lq*3iAnxGF^Vvm zp)q)|pbEd`wf2tPS{M(w+o2(od4s-UCSxjJyCP#1%wjwBl-ja*Ri=qPk zhkA8SLyW*(Pw&67J5Nz4pIu*jz{>fd@33^K9~b zHJ@y(7`3o478d4e`^}Fuf45fE2?M+-MO80K_x6>x^x_dnDcl*@H~737RUxSW$`W=Kr+)8LfYh{|!mal&;$w$DH zVZ{i`ynL##y2POGb`M8?F|^oQ(^S{Ns?ZFmWC0aBcW~S=NIH$gSWTD)VT?YA!2Qxj z+d<15HwE{AUOf074rq*NI|ou8I{tRj(?8yQhu7z|j<}#fOOSbb1Vwg`swmQ9v>xF7 z#QXOXA16evPp?Cje8vYAwHpI+m0tsAz8sZn(;@l0FG?{2$OhzXL)st)`8>6b5==IB zReC4npsyH=$!N;jbiR*Xy6zPr-Z+T*khUwcpZZb@&^;V~?pwR^$n8K5sOQ*PyXPk^aVDmSHD zk(Bp*-MCBsnaW2JLtWLbec$sYnW}6b*v2oo75qnfAxID5kg|^ul-UI`@h!;AjpP84 zKnOxkdy0Q!>kyXGw`5ufGCYBR3@wICFCgFGOpB3&<`C_W^)>EGZDBnDo? zCuuY%_JURIId9CD(K_|Qb>M_k{kl+Z9{*E3?ylkL9!s-nvuJc9H*n}MkA^|}dEM2( zGCy@Y{RpI@Y_NIe-AJI%+D?T=3v%xJkWzPQXNB}t2br#WMc`^@SxC_y1f_nRq;^SZ z3*dai<_JSf$^qif%qhU#Grxdqyl%{+&1g%6YXRpI1 z?n1g=k^6T^Q9$~blXE+el;X`YeH(kCr+G3gf-7(!i^p@dvm4`6i0K+a@sC5?LY>L+A zh$1W0*sm8s`Y?hF0rvwpB8A*PLC8uDp_$iXHOoAgRVf>#ShIru*~vGd+#q%} z$fGMmHcNMR7L~&X%7d%+O21kyW%;3gRG6|!T1d(7>)fdZ%Dz?QsA03;&swVn$}6i% z)Bt(LthC{L(gp0NW~IE{SwgDgg;fP|T&1?goP?O+sLbr%=^$~CHnib|&#UTA_bFNU zh?l>I0q^9B63shhm@*4-M*rn|NjeH3e%?~XXz?G?H$@O)6c_LkZ!74d4y*7bS;-xF zs#|FysTxfV6zJEKtSaE6>Qn@9e+Ao0m-p0x?0(b(?<1e41Mm=U)w4LyMQ8?1g{7jB z3f@6eCcFhxX4E4NI_K1RQ!C}EbOG!56LfAy_USpL2%wJF)FS?o=uYU`LgQ$b=DNlpIeQSqIrC|6 zc>dV=W9LtrKbDs3^0joi9Q4rvKc$j-JaWjFkag(-a*QNh%?2%Fm>l#S8cp6Q&&dx{ zZ?mhf`^)4XsR9=XoBRp+Fx9J`DI5JC!MsHNOyhq<+@d%6qw?q8MPbS}{j|uI{i!+F zlqtK#pOF2%%d)6$_PyTCe%qgr_fo_)sWKOMnDQRr&3)LzIv{)D`qsz+A_*1P<*@_O&G#t7NwKP0dE%4h{ykNC`u(zTJt z^`BE4A%PuowLby*ER~N2x-+<%myjth_{wBQdLws}%-F~|2|@U8WRyY)xwIZ(DNI}> zGwbD9Ul|3H=hGOD?lNGF)JB1}O?_J-7eL!C#H4VKe!9kaV##WX%H-)(lk6q{yHff8 zWi`p;{#wZ1)Eq9!NBsH{d@L2x9y8?8RDK2xUx~^>&VpV$FosFqAy_z9zUQx$9jOr3 z|F@z=MEw2!TKP??fC~1Nviz{7tQBqDjp6e96!#x3)y%<&%Xevx|E`|5uzW{HJTy-J z56AsVYM0#WPw?}Z)Gpa!f97+cnOdpvMa1M=>1xQIe3h~-RV}|KHoALZBg&)1+gru< z-XaAruTb-Vn`syZsVkY@Rwlqz(E%@g>j&OH-*oL>S~;Qr=FEViDrziI8ul zLh`B&m`N=~XYUW#151oz#zYxyv(I3jsr`tAVSLyBSp>A2jZxO6Ie`>ek}1N_N5MzN z{cc=^W+#Uy!{T!aCYN)?Bm`w(i?$C8LXJ-$j<=~1VmsM?3D)^$#FQ%vWME?cjb}#~ z`(Y_@U4$T-dBy$p8pOZRfMtkR(1BzHN_Ed+Oh9m|bkt9g%R}-^DkK+%UXucTCSsuHyJb#imWXx&`f9_S^C_LMrfJs|_b5?|g$O~w|$^pc%Nk6PCvWp=LwS;vj zxqyt+Xa=>fCF$vE(qL%V_By=h1@9r5s;&`zj?;00|Z2CQjw_4*orpdZJR@%I`_~ z8S+G0|9I9Hj%(?g6DEHgUf%qZ)Gb>b9Vc6tX7`%0Z&rPHVC^l2TW zn1hff!0u}Ov`B9ZBh51G=KZ_4llZql#l0E`h|*r@wk z=SGb>k{}v$=gL5eEls)zHDd@%R#d)|4$13$yL~sUC*U1l8DgS}Wpyj$?sS2Ek5IWu zI$I%kr3>V@+J^2L@*MoNtPgq1*MdN=Y5R329i|UOSPg)Yd~1jls|MzzN|dfjV&qsr4x zml~)`Jrwb49sr$}nr&QvBt1Src!pk(#)bdp`Y_fahBk2X*#D9Un@`#$&iM?MIuY_j zYCAC!fkg}GXZ%!1&V&46^&C58tJ;77Q{G=qGX614QG;ZwN(hRjW1Hp?XsM9X{}Q|P zy3e%t`3!u^s3-`n1hA5(d`W(}Ue_c>;6<&pMQ z{sF>d@QJ?+0bD7a1z4}XVoZ?FIuGl)zd_cj;!dc6=veu21gj;ub6^+tiLIP7vw3g7WS zeTtK+j+Z~J=Hzcty(YiGEjL((=@RzA99ohHtMFh(8Z-;w-l{*8CZ zK?IFc<-YV`U3eCP#xS{wzfRF=OPzDvn!^qvXs#NE*O27-tMlcOR>u2+bW}smtdto% z7O6Nu56E_J7NnV%*ExJ{%JF=`w<3H7tFhoBI%OjZ!~7eI&euixTTW>|mwB?9EQIzs zRD-INW_G}P(A34Oj=FzF(z_a9TH&!KXdanh$CL)^TO{XEXuBPn5~ohK2s+hERRBa%zD zzbUgj_=`=7w7Z`x`5`0uqT)(2*T6E@*ex@NQlBuul$mo7G|w2zI_6hVhGugvO3B|C zFpvMkl=689$gDY4vMf|}$CRlOj82*I)hV(lR3+zxs$|uiD$=m&P*v#sE2<#B@ZC3K z3@pgY>OKT;GHPt5(nG7uNnxIa3b`)5UH;{(gxtZSMt+l;Ly3vpu7CY1wFQz@MiBO> zTDfU;Xv&l+Q&8iw@z;FpEY<urZXKs1lzr2p( z+Nc=ojS)6@4NjIOY=VT|MOt?zC)^{)bR1B>*>_BzoW86b7PPjsHMRE@Q^!`e_Z@8* zKn3|el8<5J(A+|e^~S}=%4fB)jcu((yS?v~Y3Lg0{uYZGH9a6>Get*{4kj z^7}F+a0Xj?X{)cNEdd9_G+EW!($w6tuvPz9*y{SQcRqV6_GjY%WK0c~EN^Sldh=N; z8W%6uEuyu>F-UM@`XITu$u?XNH_40lV=if2%C1evS1FnoHrmzArsRUgrMgMemt*X9 z=0BGK54O>67iO334fJ|h1S$|%JMYJZ9 z&M1g>Tp6z8uef_`w^M??(e+Ieb64uVBXgSF9Nz&Ox(r-}nG^@2s-sdGGAUU$)N7m+ zr|%fn>mDw0_QD1K3xlMiJ*P`wtH||$P8@eTy(>fRa_-t`q?0JQ*O!_>`kk^+s-~QS zVD*_Kuq0hjrX5&bjvz*};5qIGF>7BBDf;*_Cm;+u1CXx0B==MNCVNU&zlyN*tAr;J z^&PY^stkGO|KG4QeCENj$&oz~FQ@W!7k_aDCYD~N4G;p5w0_4Rff^fSxA}Ps$~&oY zS`%IXOO_VU@X(Zldi1=~rN!Gf&yN2`dppmwm5hSfwS41JW)MTcv-(0#~* z>5=~}OrQBQOjoBfFwG%MvMK#BA^4k*I@b<3ANp)?DDw&voO*&2m*u^qi|#w@!Shce zFPC)Mbkt~qgAZ4VqG^gzgc?vrYNrMGVDi#wa!LOGBAuSez5`yTM=Z?hZ`9)B|t5$nuq9HI6z9YrosL+0-qv?4-kf|+GvdP`ThUD00030 z|7SE_XaN8K0000004z}g0000000961000000C)kM{dt_EMUg*_Ka&Zf2#BT!qPv#v zdZCCY9-zYWw9NEe40ANYFw8U$O-)Zz6h%>#MbR|XM}Z7F}J@MftrV-Vu@YJVOJ&Z~ZY{Q_njhGb1A-BO@d8**{5=yYIgHZl5e$ z*ngkB9=PZJE_r$)pZ!z*@)Q0yNkVT;SeOi5cWGG2LN5#5snFY$B#)KnBf&3||A!vv zjo(A@{}BE6vz6X8?z4c*Xb(r#pdJ*`P`$Xuu)p(rztNa}t0J>x3|IFH@ z{D-hAkL1z7JBHPoT1>JYPdQ6 zrhJkEQO{}qmC9j0-Lr&`$}1P#o#XPF4BPyZA+L$B&0n%C^tKD1qvdb@IPm}Y-uOZE zde$%O%_U@E_UI+PkT|U!m4m?NxnPro-b?tK$}^YekKteG`Bwg>&-?QHq5La7U(et4 z`9PjOh<~N$EBTwsX(-QY{3|_YIdvAf@+U?;d>ZOGvpP)bXJeTLvZAs|8xbVC$&!u~k&|6h_KDdwP zLwR1-FRfp42^VlR z(kIUX{nx~hhMxZ_ebwiqXXE*kjD81y)901L?)`Z#&o>cMZlB*sUzL9N9MCVNwbsx;I4r_fiW9~}Yy z2hc-)emwoL=gAB1`MHj(iad{YEF(MCK7&U~YPei*YLD39PKHiRa9W>%;7;ONP<$P`2C5PMSg8}tkAT#>6df$3;04ZDz9M%KEEa= z%*XwT{_4CsoWS$xqP%AOH&tFU)1l|KE55QE_{Um1xj#GZH&TlZ#*gCD6~O=JINr6n zd;NaP_^&%5&cBtF!2jPk-hUaumqh=evKqL{s4?6w^s@@N<4)koO6xHa{Da5&x^uYv zbNOGliTEtgKlE7({s)L*4!up}KU}luKdpkfX3^gfzn?1Yzh==tDgFvI&%!l}JM4MY zzHJ%%)^qGYXniXirF=2$QvO9fe=#OxcPiB~QT&vaY-0hougu*JP?j85g+-yw9S z2dp4x=HItt+ zMU_vIBy9k{Zcq9j*)^`$te;W2&YsQ`S(x=7v)|mO^hftY{x%V2&kemZ6XiQN3w*CP z`7+;@KTUbGPGiC>wEXe*n|rJN=ss@WCPS~K?dx~J_nWA$`9bd00&lMhy`6EM$j<>@ zQ*&6>LKIqyBDX5#=9T)}P4drAn?dMr}>xqw>r9;1lf^x3}&vCpdU< zWA%S2@DDAH@7!G{rRDDD`VB0ykgo{6bGi0O@6{;533B)U-0X2|I;QC1;@qXCMoteml1jnC!!A!T)mWf9|&_ zf4%nGl+Hj?ItRut>xFmxWr{~<68)x&!T;fAf0+MD{}HvrD^Fl16Z$2)r!P8&R_Yj9 zsYS2U$!=ve^xO$5m&#jE?%}3SESI|b0+*JB`ka1Qp7dQs<||1aPC6I8%gFRr==j`#H2J(cGccs9~@r}eJ7?TlCY}g0I$YwHV?u9A>H8l6z3Pjs*T?9!@c8AJ(A%W+=|@5Tn_|0W-IoI5 zcC#3_6Jgd}A9@a}_h`4%kAwaTM!%l?fNk!NLca~>HVfM}>o53%DNOylo3%ypiyP{Et9H5aDex1wCJ7REFny8d?=^eF{aN>aM|l}37$i{F z^6C)9_#>T)>L+q^F8cYS&!GGRs8hLLv#_w9Rh~ttdX-!W+*6D7sQE`}J!q^&{Hr$&XS!814doZ|g^vN87z$N{H*RHT(<0aOSs+ zJ_q{cMf#@u9iy|*1ey9jT5kGz(0#L5&pH2ew0|PZ`4nHXFo&LKjmf!kE$F+{c$PEI zb6tnQccRK;Ah`33^_%nS!5mSW*q(FfnMCWXJI8y{!hl@QC>WGzQ_oSD)c#bNIwa_@&wUi_Dnq3O@ zGltirKI*3h$h9@YG#jknD>ndF>i3q@*}CQ4!X&JnQNH~fLASEl-f_COF&%aG7~SZr zpxd!D9hMB@_^5r!Zvx#v7xiq`{e(-&!mLiev$9mm!YmAxJv)1>9{q2C-wTTT=KQm@ zpXc0XnKf42s)xgGg6?)|6zi*uvkMrUh4xhFb>ciY{1)(!DYm!cb_u?-ljjuEzi$J7 zOA$ZkUuyNjKoq%Jz5X3^-zm~H{pm{AoFZ>q%Ng7P{O!f|SN(-*U#bx3BDFHk7lT_t zcb?gKZvU)9t+Fud8_HqU*^=;hZseH!D?bLGCl~A6b+?OLx)^3+rp(^tw}I}j#4O6c zW85Q#vanK!djne_s4nj51=o# zwv(UV_xM!ie_48G?V z^}g!&L3<}c)jvuVznX`hY}7z2l4Nuz=!AZqm#@ajj8~B#i-S^mD z-O82LWn_EcBFQgvvAxOP!FRXz?u+(jOSD)0f)_*ob2^*aB4wLj}}o>S2l-bjhx@lFyATV;M{rB+pN-`CamEJ`A*D|P$`N;s;ydhF=<}gG zUy8o+@O!5p$n&M>lShC)`nQhU5G%ibAJ3CVg8s(Xz8mPP)_)|=mnuJf)VNk+*OO@Y$H0ZxZmEwMMU!}iVzx+TvUy43`%)LLaJoet7C;x=!OSM0j=S#J3B+r+s z-|(Nof2rq#$Km->{3{haUy43?Jf6>!&>+8a=&#DJFVB~v&z}JLrP@D~=dUNG;Qu=M zt9GRSFQ6~%JFO1aEV_TNfx|42B-ap8k|cwF1^zc?w|M+dTfAXf7b?*nn&m~1GYivj zEweD~zhstIBRA9VjK=M=G4OX8+f2LgHZqL@w57WZMU79%l&>&zH&{8OZaPkHz-3i(uEJ+2xVo-fHq;Tt^n0Q#udypNabLU}wEzJ?OXr zOTlpYp}_r~KoM6LeL3Oj^drSdp9S1?rdPag+x1srA4~O6%db2i_``{q`J$d!Q^$Om zTyWuh2%ooN2R zKyV);5aUFiSlefsS(OEG26?p~{k8lBsL#iVc$^;Ev?RUOv+_dFm;8w?RzBMe*S`;( z`hO$AmGT2xwoYs{SOQsSX?(18UWop~=tZcHEYmFhr*<(p63@%}uFos-e5vu0%JT=3 zuvlL3jFdi?=S$J|<@td`%=8rfj^lM8&mT??`8jXj8~>p^e*`_`=kR2;{E<9=8a?Fa zSWxKm%28;4)YCe_te`C)v(%$;bsq2NmW-ogIJwBaf#%3BJj{oWVcr>$Jp zgPy5sRneUhU67=r$T1%d4v^ zukJP&0L3RSMmdW`yVCTB!LDSXc?yM;b$s=Y2EN3N6< zbLR{K^I{maoZ)hmv(xCg9Zkv0S*i6;R{+P(K-7;G@(HuhLc^z(??~{`pJ%>Zgf}Nm zE|p2}J|r{MBc~If_UrIv zD1X1A-OrUwmT86`T_AWXhvk|3+aAEODC3jY0sru_-kAK61gLsbc|GtKn%ub^A6)dg z552Y4Kf^ZycWaSvL)E6?G&Q*44_L;k$sZl(gExcz68@Fs#riof`k94!=v@}(;Teen z+W315=u7*k^YACLFt0;y9`kn=<|Q;-JXe#x6@0F;cK9pltJ=@x?RXyN2W({P^HiQc z+uDJRRqfxtJU^V6ay!vq?mxM^vXE~NG|{R2hnJwdM;Gxm_uq`4R(%`21GsC8xbb+B zE|95*+ghK&yFgcxTi3mv`DdYfN+4%P%Ne{I_|ru3<(%1OpQ&1J_P4nhC)08&9{}Cw zsnN0BRomyTQWjEN&yECNj${`)X+ zICVsN==cXMcOcJ8`35zUSIu1-dYerjDj#L?F}sL7CzWSkp8v?k7u&Td-&T1}!S&6; z)bXLWP4yzb9DL(E!R={?C$(B}=@r0TPD1DQFs@5S5@=1Qxa5<-T}z;d>$q3YYC6uR zL&4$H1IdTSY1ftZhtf}h-)Y1w;&k3UQOg|)uEej6WmNQ|(och*=4+|na~`Ydv1SJb zf_rmOFPeUD)r+P&Nb!rC2t7&o(SA;^M0tA^{la-Q=| z#m}h)ieHYUl^8x&?k?~-v|R3+luyHL3B5B_e*LR~kLN1U9~%)~u>Kti4!dS!{f33! ziKhRb2fuP&uhy?G&o%!cpu7(3{6y$%#6F?olWV{)#!pZ`$;X0y*&g$N27)i;KXx4! zYFX&Qtp(wfjidYvD5qp!x=uGRyNIG^fkd<2>Q}iIbQhx=tUX#>hkAKaoNtGMFWJkM zW!|+mvc1%KZFn8{f6DYx{7MAMv(R*3V-==vSQw{N6_sEAi=Z#3D0o4~O0+9q0Xs z5AQl`uxA`V+!Fh-|4s1wtIZ?a9}WLYZAZiZ@gDrH{=b9n0P`PZ{`nc)>WNS|LjGx; z*>(OJ{1EhU-NfZ~ZQav_+ab#`YhV5&(EZ8A1=F?McV#rR+^@+fYdQICz+YdKd)<9S z@OA$+v=k#n<(U2_=zd$ItNGWUeOajOq`ooyPk}$ID91T+)v=F9x|SQhe>?E)BEIJT zX8hgJp?9+KPkssf8RhyM20YEl^wD2+Y{%Q~Ocsm9b^E^qKec}{&c&W?Fu4r{_hVwl{J8(y z?zPM>)7*F+FN5EM?}64H&n~gHV|WLi$9AwCYsmbTDz5Se;9f+9a=B;+%yEpH=YsoA zxu2c~Eu#ZeAC#)r+-Kn=C2>5ae?mD2Sbe#Dbx8uv$O|WZf;SlF>HN>2EBiS+8NDO6 zS8%FVB4=48Z8BW)zu@;csvNhM)&v`j-k%jqjs>JlVFLbM{e<4?Ypz23k6A&cUhjO+4qraitQ%%2^zUlsp z)rPv|*bIP3Ty%Jaz2 z@li}IZ?FgGKUVCI`FQSgzL2MtKLGghekr1rNz#|+M;JdIza7Mtve1zYF#4u3hK_pp zolWYFL^KzHMUC3q^dZ21Zd^b8 z7SC}_7x#mc09<+BMY8@^E5D)OFw4_;W&7Qg`1dN6NBVH^n=Q(%>Awqk&;XkWy={sg zJ`(sFOdi~>y5FYw`WfSX!r%bl|6Ih^{LR4gAR3eR;6UKNO+O}7Z|2`|6CyWBKqY<3 zLp+bwe+=l}SoDWy)Z59zjDI6shb+t>hC&~0SET~_U(%1`j5&kL>7`t+Xw{+}Y|%%A1ZHGiht=5>SG$@E`I_PAfl7+V4bD5n?Q@zQb2tFl$y5kT)n6mai3Aj7VALe-HE6(!|LdRzG{n`g` zC6lo{@n?W;u2|0+?j6cP&3{noYZ}RnUo^y1+o6tx)_d?w@a0Q%SYF&8Et#J-SiKJg z?$n|_R{b-y*l6HMOVrK{o&~xcrFz>crl#{k&2Lgx@i(`bwI|w#%5%VPpAtVmG-A3& z#M+lW5BR&Oaoj%EhnCDxQ>r)V^MPAsc7)d{Tl}4>{98^YyQ%URya4!Pi}GmOyw#SO zZwr+g{jcOjpo{Yi*QX=nWwZ9nNN}b2W7B_VS?H~a{Dwz?U&#;Zs2`;KDk*UBz5ur0 z9m!ir)t~MQ?(e9!?z7e{{#aM-l8qGE;M8*Z8OnL3(X&3akvFnn@~cb$cZcD)K25vd zrHOqvomaGD)^}%D>xk& zlUi;rxZ7?1V|#q@qW}CJwEv`bEN_6{dy4xKEB#R#En2B@-<57CVq58FwY4kVk3+8= z?O5^>@cSq=g4@e_Su;PUwvmdDdL#G~2+VkvPg~~qNtJu01HO9}^`L8qbh^g{I@+M) zBRw1V{fqdP*pDow^t5m1|#~zkwd|b8cT-)XV&>$~oY3 z3xOi8BkNehCG)_Q;?VOrrxN$K)BC__yZeGG&DZmqr!w!bAJ2zL#^&MlT-2kKA3TpJ zR2Js3v5x+KD)rV#Boh;@(aQ5zS=hwT*>cmtKYBw zcKRCdE6v|y`wcoj#*GB~1wyqw267E-++GB}*A>TMQ|}|lLUTJwOa0c-Yk{wo@J`(+ z$)lik$R|bKO}9E|BB_pp{Pp0oUM?z?dEj?F|Hb{7Y$E)w*9)3PXZ!x7Flccu6zji(*D%E_y?J$CuCuMhW3F~ ze?~%Al3z#j-8$}+K*mh*gAb#elHKpvbz~j)M$$Kx=kO!IKg{MyZg1{asY%NH`y4l& zKk8?UJ^{Kzihe*do*!wtOIXpe(A*eoU90u1d=m7(Vy+4W!JuyFzcf z&ga8jC@=c$j<1l?_U50%^WRu~q#yKvIn`rFjJM@i10U_Udo_`&+>_7adCTN3{4}oE zQA5^o-O!uWdi1XW-7|}H?RYM{eJts%j?>{6fInzl9{wRt?`u}R$q=}ksFG37nwnqU zbf@z8(fW@B|F~j3;^l8z{g%6dMupNPUqU(O+c@HN=9K>n^fL=neznt8`dGi-0J>7U z>+V<5uXXqrqoLl4-&aFKGSxUj@E&AKR>~X0tG>86di6(#pj%$HhwF6SpLSmfaeY&{8TgW&YuXhI%@r&J_1{N=zkW}Y%XvYQVVn4gS=gom z-{xNo&nOGq?AEJowhO)uvoXBYvH9$~sLxZtUe^m<1li*}mD~ax{uSJqAEa{31-Euw z?v_o~Ron(6EJ!THo;Jvwrao#m6Jw*q%iN&n=WS{7Q!{ItAPab&fA{U3n- zm1TP5YtZe5lFp1EE5_Eql_E*z? zNSlJdv*CXOe6uLOIbVSoBrIb1E;*!SS4~uL7KfuA{SE+P=ZxfG^qGS@$uvXKR#i|NnqfdCEGztFsto+mH{c`jOlP zd|db7{JQaz=ey+-jQQr2FQj%S{X6)*yV!5-c<)Zz(lF$Xl<^q0E&}71HnX?!FuEK3 z|HxWS_Jrl#6***juS^!Y8eizHAB*3QgtUoUCb*;huRU_o9qF)tBdVzYq~*O7O0sPT&nL- z=u3V`*KP^zYW^*0M$E$+?ul|s@!F2vi$V7q9UsSQWiQ})6EOBm%e_&=DS23`&&dOU ze>;I0&+}|Y)*BZ89|-P;1Y#WbR~y>|S!hdOT&7o(cmF})|Lme3HvFwRz8b1)je6*9 zQvDr17<8AJePDm%+C`^{FxM`sVqLqayGvQ&SEs?uYZp6Y%jsj|=^^0%>7xF%{8p_O z3F=J4rw;|bbdS!gA1Hoyn$EE+Bz<{2RR8yXSyBm=B3b6$DtkzFQzv^8f=V9v{ zfrr(ywxG6nDoyye*Cu5Iz{{Y2OO+)chPIajX4{1W&79JX5O)@$I6xWI(RfvS^FA z!UW>_`sC?i?JrO~P+(Q3?Ay!=>F1mN{-rnDx33KzU+?-lmRIuHA@KIGVV|e;+d3B* zLGwY-&rJ?HcZ+{IIQoi9aJ4S(rQAYWY+v?@O=jll3H$H1pQRZx%;E{9v0Nan91?wPryVTtmNhk|^I$=~YarBlLseWjyJUi$n@=7Fn5 zT!G2gIPytPZni7ya532TFz+G#9j^ktUQoC&%eoS*fLpg3^QiH}9HF%Pdbyv>Os`y- zuJ=7hT!jYP5t@=q7s=n?+}(X))_?N?R`eJOb11iyorCe%mQ9?0yOjdVcJV@}JH%2d z>cr?zxy$hPgP#rmYORs4DIMF9yvoyC;J`SkP--&qVkL|-@0u302*zksW+D{%b_yPJ zh9aOwKGc&KOW=cK+fXSJy7P_Z?0AL^YszM1x_mTSO;@s#2Q41Ae|HD89-eh2<0e0~ zcU0S=?*Uw4eaT9`)Pw%W&d;L1?#&FVypnryKYn$JY19A zaz;MzIP5uU4_`N*Io=`J3vb|Mpzd;P!Ns$W2Ay5l)YdslVHzjF9BAbSlAb;Le51*Z zjFkf(;R00?cQ~%2XMDbC^B*{_|Cc>3V9K?4_)62xcNp{V_ZfemkLikh4qPuUK63h>|vgI1jIqn>mST-7;MSk*uZ8O7FZYi$}o;KkJxjfCnRF@seR31hS8v^jm9p01ToCnH+cCm`eWm4ye^z>*M@ex&_E!g+k#4yN zr2}@mq6tpBP{TJIL>PHOU8~`O{y}&*Fx`E{2lk(KS`86u4$4~8qnDKD08#wiHMiKv z+RN4+;b}8RLtTl=pSbd5~S@{fncs0FaL$;-VeG8rM_o254`+K*FqW< zW}8i{!yWg|g!eB6;L9Vb!_JH8RLpRg7+=n^LpDm9^w)r1pW_1S*jl4K`{6pn7pq6! zRaCKR_^KJOo4{hG6{5td<&eGp3X>JbzXs{rPm9Agts-K3YK_Hfp%6|@mn2OdncVYZ zD}=9JE8O(iyFKcOJkaP9o*vZIwth|kRg@z0mbPmpxGXyc(I;r*t+kh^Rcbxg2wbKM zYJcM&X_Gm#)3*6d$@+h*jboDR!ydf;81BESeK!10(RKE=GLrNF3HEmtiW)~{yD0fj#921zR(Q`~;dw5j=)H|_yoA{2_0&>EU3fJgTF zuY0O8*9lylC}oF&(VJE`h=Yx&W1y(&hMlcnI(!-nTAZSAd?c!xWFNhN;yu6)B`ddC zQMrh*qIBdcte@#Yub?(|F*Dy6fw83GlR(0=vHMk2J!(L{E$9vVFH;$&>7JPwQn?en zd>1hBQz_C+0wqt*YpXm9e&3OMjGnrBS6tke3}( z2tzKHDD=b!eLO^#rgul5433U!))XAY$Jm-SMe5n08P|z&t1tg#!*$>) zCXO*R;gXaK(vBf&&U*L82g=_APQXCsLUX=|V?FWq`UVfTRGY;Z*syP(*a^UA^Xh&l z6+T)b_95I31KAh&%l{6a!TsB6SEUKAE7n5I|7f%RQ*h~kC(Dk8!VgtWmP`9|ZlO=o zKCyq2Y-KXIwm2_stFxs=c*8<>@?G*vMkUN(#tje<@KaMNUs}kDxxlzRS|it)ygBdy zo@a9)C(69G+qTHxf4?unjcX)2ncp5dG&Vn+3TiAZZ*4Kp1^K-` zsM$WDH#Tw|UfIpMU=N00htDwYXUsobUk=M`S@g7(Zt}UTA+GJx>a(qv>aUbeZ!27| z2~@H*s`44^Fl;Rhcryt(7@XjXFlz_>t~bg*FqTTd6+;`E%kS54T4I9=PU3wOp?7*q zTU)GHt$Txj?f>QH6>|RdGATiFkDso(603HhNDS+@0qepC3LU(5)6pDvWQ{*0y5rtK zL@NpxXQDUsyHE);q`Njt=JI#?=I;=T{m$CyCK(0W1j(YD;6yZ1BM-;Gmq+`t&Kz2q z#yYf-+*G(71(yKlkxBa0DS4!mP-@`U zwpdI89caRD<)NxIcD7g}vf!4H3`Ig)Y_QSZ^U>JLP_-QdDByLKmq3SK6_CYQHtAGS zs)}|^{_d&#G^hXkivt4tPi9asqz>k5ZoI^;N{lxkcK{K=WG5Ogp!ZxbP?0 z;KXwVBG;!oOW%$>vb6RB(02t&agpM3lRX;AL)vGX{iSnJWpv~L4S zSvck7k4%rKxxROq(N|=#i?Yy%3o=YWZP#g6Wck&Cqy$@+P>QSLJbwSK2Q>P zJ3bR=gIIB$G{h?2UEZZ}_}Mw>zYYT4JoaZv_3x+JWoMDi{!*L#H3wu?cl}o_v5&4p zx^U{0I^})T$p|K3o^Wtfv%iwtLchX( zre)k9+^PU1CqK&(ve`U=3{1dV9D*Wth?nhb_abgc`J6vU8hF`!k%AQ2wIV|n*#3Y) zQJFi1_&+mT4qBxuav_%{;*64xR^PJ6T}^%+MdP%EGnfj&@t?0hcY3+~wkK{>xcqAW zOhFDh+uj$3_T2BkEo+I9>#A4{Xk{rX|>p91U<~P-UluJJf)meW` zKvuNziSnNW(bhdm=jO1F&`1) zWMzEO>uU2~K&69#7^Ex{VHV}kpQnCP;q|%1QZJ)MMga!Py0Gv0$iDsGcv=@|!FXyS zX`4H)A0z!q5oFU@bq%>@rXM1v@CJE>Ji8WW^F z;g{7*Ga0$n#aThSNoGAlyfyURS2e59d*M!5OydlYv*3YN$v2Q63vt@d63n*jPTU&2 zy2>qr9=UZkC+Ug;+t^&8%Eg8oHBQAQt%{lF{G&7@Y%~QpP-6Iu-J>F%>XB3}?_wsh zq(|vXYWpQ_@RsV?*5Hw=TP7g#ht{)ipM-~M4Nwiuz3O-PDwC~074w=yGKTp!#JU_@ zw$9{{U#~1(4_%B}a=ncO)SpVcIG^>%CO>&=sWD!6J@KCI5EdqCv~X-VLbInUbxVz+EuYl^ms-GC!aiE@z@b8QEp3jUFF9_wez zIee8WM^HoZ*&Gq44D`%#~ot#sJx z%Hg;{t*Ed6?E6DQDyRLfHj~fP|E^KQ&QJstkD#`WbG`tsM%G(H+R)YE*SrI^0KEam zHO~JG!|v94<@*sD*U} zI>j#~H}?RIb;%0ay?Z!PqWg(CBf;}bm%QSvS+S@hk3tD|T3QUFfU%pER;kCUSa!b1c{-E2R?dAAX&pJi(6`#(Q&>|bcbZa^>pDQiJFIGCQi z_sY4@y$ zzh6m3z99cimhOKce4|-XFHkb3 zUHtjEs?_U7$J>r$xnK|8>V`%lkR&LlOIi9&Fg%$YSSXY@YhR$<%+cA6*hP4Vqd>Q_shl(oX3dHK*1{A4gb$PMwUYFRV402BCG z66d3XReDRE)~FjOg0FV$TP+Y_%c&JzN}b6GtJ6O^G?WFi_!WDtn)4Jsv)3k-Oo99` zzF9q)5hGhB-qlQ`sk~xPw)6n+AkZp3ikaHw=qlEYb)e_e&n>u-ik8{pU$L`P zgfT#{kUD9)rQrKfcQhCgvUh&6CSBdm4>>A(d0MGOs=3di)DPv?)|RUGf|-6&u~+TF zj1S^vh(Qbb2(0+PL7`K-KJcP2!9*4A4^HY7YE4BfO)-nAd0tH^mWLZ4BNcl`tn*At zBM2qH@z^Dq7`8I8nBLOcq`KH&5cIfm=6|FR33NT{`2on~44^bSCh*s;vP4AnO3h%n zFf($6eN>crwHiMEZ_dR7cgK6xZ#?u|nYIap?*nDPtQ+ZX|4nY+U!>Jy(%1v{gh*Jk zPhsUspr$4HZ@VtYJgZ@#o|wvbfrHd{DZ}@m&iPf^Q$-AyE`XK1ixmBuxgw|QH_SV= z()lV3JwXg4%JsKI|C6L%1M*epqtXhZeHxUf&AgTMeji#Uxv5tz>US$B4OiGQ0;l2? z&eiGIA5`yoq{AQhfGx35i~oUnkb?_M5y}Onmu<6|%^zonScJE7vs+1RrYq>#Ux)Ws z(QI9!imqe3+0Kq=G7o4@$c;`|Z=YVebgf|{*Y*8b1Ex6R%&N{ruK+`pt?;)%{*6bP zE^?Rcg28q;=m@Uib-o)N@n*(y$fJf=G@5eC8{<@3~xy}hOLD*gp-h5=83tdD^w0T}N#19#@EC|E{s z@lfbqTixiiuy;;rS?H5pjDuF+SOb(sG4RzJaq|y*Tisv}8Dv^CKoX*ww^t3cbGJ{l zeuDIe&IAB4FCCfbI!Bsg&(q8BdNoBDiR+^pU{0%ntlUy0JtqE$Lk(7X4)kpifR_)H zUOMA(@|vUCBlOy}uLb)7b?O5$9WF?$-hT(1&8ql$BtF}|R6P(~68cLrEauKBgQiUn zXNPo<+;rP(daW9Jz_}nOVVO_pXy>hJ?WR%_@^~994I$+j{k+AT*nY7S=>ZpVvwqOgSzhWwgc#|WaFte{&?+-FZ@z_gmv8RZ$vf_T;mLDPyo)tppydn7 zN$h(>`pByemyV7R$7z&SOnlV>JA8`VgkyZi}-7BG2m+F&*V-2Gqe}u8r#tMV>u#;NPS8c2X8QOnFUWHFNoB~=h zg{#Qk*NDX$e|E?*)vfSmOK)4BKVzlgbEn5kE&zVEBoyWG}- z$ur-ciCIWiui7WRP@wcTn1zJp%;g_EPU_wthZ+ckGP}!tfG-!Bza;r{=8l%3R@l7< z4`rL_vg&r66()F0XKjrl714=#y#H*;h{&4G{i$}<<_DwJHg&f)6Ig{u# z_vA-z{e?&6SwBtk9jqj31lYmrx}!ch&u()&?4iGuK9n)p3%{L6_3Yzjhd(`=r~V?j zwnqKBOLzbGF_!BG$)$W>v6I#51Q+s#N87l<4Kl822OHu)jA)FV^xrwB75B~87|9K< z?T^@}?`*&PDa{{r$k@MhmezR>XRQG7Kf9iMGgMJ2$l>F%FDgbQc+wv9`mNF;VCE3g zbIvgf`k2p^o+i8gc;8U;(J9Bhb6^tNdgm<4#_>Svcy$9%1DpIn_iL~mN+o{JafyGv zw)$speHHLnq+DX`;&SPgZpk|X1+-dO*XMHsCV_`Pes;Y@Gv-8n8aKDFyA zi=7eA>Vi7mw`*AkG$jamCeE_EFRusg^M5Dij{BsOBjoVNA?^DohL#d|MEA{~qvyT4 z8sF1cPl@paQRkM%g{k(1Te>@_QyO+S9?YCCx?@qFgYh>{t%g{DumS_6y1f)Z`=jBS zc@gA)QXXWPYn<|Xj-7V^vEYsKdHVjcIK8K?&7~klIOm0-(d$N!jfyUWkp5nuh2yY8+VWjpDp>cb;29)%8m)yH9|4D%Cn>buZE!w6 zF|`7Pe~x2nhI3OK?kBDu*5!IWK37zBFpNG9-pETRq4RB-i+r(Qu&z#xjAe8F*@;Ep z=F#VM^t7vRRd0vlA1&dT;)`FR+<^9zMG-HlT!UWBLlI&KGwMD65USm*ZV6~uGiyUY zoCIZXpfthfDxpH0x8aY@vfpPf(t{3|5~tGpY16LW)GO+=(XJzLgq`EdW+EDtyvUBs z$ML;a=TcUlj%E$Z_%9?!>q)8Vq;X+n*(7GZTn}nB#{;ZR;sxy)w$k(x6_3TO0eQpI^rW9xwB)1{<)AQY#V!ncJX>rJ#|532+<$dYWSLAbb$`bhp{X zWOpMrqEuIw_FggzdEDiT#w(o6u}Jo%2y2ICJh@!Mf0=eH-@ zGJ|1lSRHcc#wYDzzfjzwB+m1c?gH`KRy4^mA1Ls~t)mNsD%TTQ4M_<5o-^-tV|zYz z>;}Km6mmrvL%&oZimcdDFJEw?{O#E=sg4*IQsQF{G32J=H|BjSukd?*&B%sl{ZFJf zB+JB{9CfhBAqOeU#ZLz+(Bg)B+CepcUuqrpY(kAB3sIPSJ&}PsgeV!FMoNN zQUR7lasmFpY5}!sog=;#ZNb}}??`=JY<^_qwzG(c>9j@d*vKaT&IfF>#br}m^#2ST zG@Pz(?XTQU2fMwc{BD%q`Zpe&eIFFi2$aoI8h0SXQIP57;qp9pjxQy4Nd|%=*PHH_1-e~u- z4O}c~MAP7RTZ);l2l>WALT@yeiuU0uS6+^X6oIxL7ONBgSYUe(<5SuCnz16dv@eM6 z@2$A73--<@G;NYe1dQL?MD_J#hhr|efqA411-$Tj%+2t0J%<=-hwU3fxz50{)ulg@ z4`e!LQsOys3qq0Z9iVlShyDEBxRyoY2KNrY9*=pUgvk_VPHc(rY{e4dyazI7z1Wka0P z%#|w7js_1mI$fISG4d)UEjz0Vsy6jgQ!rsCPH?Q`@VA0T1KTf8&;)ses;+7J>8=F$ zlu!cIH-CVARS#8oi@8-WRRDK$mI4`E;CLOJ%aVL-3?(5ELEZXY&PlsMb`)ADcsg_ z7H=NV>)BU{GP&9A^q-kN$KEZcmL3t^$9;u~dZUX&IhNzz%BDXw2I}>7imJ3*JguUe z3#voK(X_8_L6IM@mACZp_$NyG18fDefoYrX90gs-t3_)bO0m1UyY`J#TBM#r zILr>39=C?mmA}nz`su9}u4bvHc!Hd2JMEei!}C6un}{xBzVboqW5w0L9=;bPBYm?5 z;-6_+<(&X;zgA zIW%OhgO;A67Kj>J_r}ck95yl{Z0tRfu7_lVvA8g7G(T&4!B&?oB-HGwL)& z`aD&Afxv5qd(_m!0<<5ez@^tx;1kgFT?^S#R!Ub#wX0BR$11^WUQV_Y8kYq~=*gB9 z&Ih85;n_`LHZGNJsn8HRRj?p!oZhomh)~5E~WtKW%6ov zlWGHgyN~wmL*Daj?Su0S!&XAEB#zn1K79RU-o$Q7^-=aya6?&$mI)cUbEGow75i`| za%bea;bFyf#-f&z$!J*i8$>-PeMepGR;01vqltexolL#3OZ=CXg47p|X?>1K8?`kZ ziVxJ!6CGA)QJaRi*X-dj7NJ6hGlXL1=u|UG;@e1XXS2Yq!1W^RCCw9zVVTXKDa3J@ zdrc#Prb*moDkLFOIXII_o(HFoRo-If`^3Nt^e8m~gR+{eaMR7Ysla!;?k3*5&rqaf zqxi3G&Mynj%5A>$_>A`*VD%wz3BZ<1iq+(H!)B?muR@)hkvn z@fK%0rfP|AH$5+nTQ9uurpmdXRpFCE&Hg0OpZI|~EumidQ_lPIv=W5Fbr^fKkV8>P zdKFJH4_`fn!7@b?Y98zSDT5bMzMcq|L1BjOmF!}a%9!oljo7HBRJkd2OT0r*Xl7Jp)*f9J#; zJN3L}__$nBlo!7+xU?C`_nJ0gOw? zq=($r1yPtT6~TKZqDxDBrpGk9vbIA8p-(ABf`!+vye=sIjNCPl$CrhLeHCv~*p6~4 zXbePNewMxXl%6A>4})BPS=;^>;<4^&EFiYnFkO&*NWQb4sYNKp!ml<{`Od1%f|9oW zSK1bf!$68O-Kh)UmSEZV`OPc@D)NN(>)21M%?Gx3z#Z#w0lR$7hjcg6<59e)e`T^2 z+wVpF6T7?SCOy)kTmZt|7n%*XMygkDzOwSlm^tFms;)o0`udVRtU1zQv}E zj&xCv;2c*Vhch5kevW))uwE`uk>4(7L4xgTypA8;qd^Qpiv6Zk4_V~T8I{>_fKFb@ zxZeE*)mTaQ8+uSVVslRtDFN^P3mg5PiyZ7ma3gYDNTK1?z2p!?HHGAfK`r${MMMJk z4$pU3CEc#qXeg&C2Wu0Hb<$%NFHVmtFKWbW=Z+sJ9bLpf6C7+&gjAK1v^0#r8=FWb zGlL?%%7P1*V4GLY1%>y#!i8GSwP!jOj(zy(IM|I>z*;09hgBj-!Q6 zPzfwJ^cp37Cu};{`?iQoq}#wfTcP(26;7H&bInuLT&Qu)D4iwsthV!)I$dPg5=6vN z@gd=@R-|{ar^7d2HE+4NJ-iK!fBatI5>$#JDzZ8s*sLqZ@5$K;_-7A`4t7g;_7VB> zl~y+bZzajpST*USkZdqU`$iK>*T;Vy$sI)w8W(k!;ASFVGIZyIvkP9hPA}&W=T*9; zfj%*Di(3jVSsD?pm8==Kx?W4kKN|s26H#CHHS_VJXI_Qwz~O ztn7U?QsidQF7qUD%(R|a$8gE5+1rYsNA0c#(AGX}{wFTIJo-&yU;J*+$FW+lJFEMf zkZE5}a2KY66V^snSlQ4WFz)j|lPr%v*?DA-zXv?RFZ z@ty!tZc%PDBOn+5^N^PuQhsiRAD>D6xu-Us-Cfhbdh-xg^p8^-;|HI7Lj2(XK|v%F zA{HZ%HOQRxeoy<1$b|DZLxkV^fKjcL>h(|15C55^Inq2aS<4msqffjiZVT1sN#G6F z3Gxzn)*q|kA7i8?jqhqlSIh8RB%sifvmCGTDU>I4?6$y6qm9`Oo|@eHz+{v;`Wvh$pom#vm9PVp(os4TxA24|<$=QXx^Q|HtyFj4+xU#=$b3Zr4G%T-g@->eq+T zagH*uHP}oyIX+-l*LUmtu6&H~fhJRTT~V>R0zS51GaYcC6sqw)ZMVktIusaj`^c1O z5{pYOG?^n`The-}`88;nS`+76K?{0YFsJ>KEkHq^-&JKnyIfwr<_=MCkDX|Hn@r7h zMZFVsw4Xyq#M8|a=9j$}0`9I_Q~A8j0e^=ZeT1Hg%suDRT11bAK(6{1hyN+5Up&`R zmLRxZCflbV{QQ)XO}&F$f>M%K3-Pz5-GEGyL{yC&?E@1{_m|{T;9R{5(X5C zelw+1hzQVe)0LwiVWV90=7uu2rA;U7m7ub8F3^{e)=;RC=oZV^?8aWtwObRr{K_lw zJH3xjDh%z);s#(C6x>|UN*nMrsPDEqW09U|0G-(VNT z-9--jdg@Qsu0nR~IiaX{jc!$a z5532hZdQ8`&gAQ^H7c8GhMuC>zr<$Y76}L(yoj4Z$Bk78r>wagi0MfA|JEv{eV3R& zOSp-u-Q&UBV&6D2lS-W$c00wRZbkAd>FD6q-T~g@b>qVsJTus9X<+sXn=b)H>7K)I z6J}LQ0M>^*VDUB?rhqI`oF!O)oA3xqY6?u|sqyi3Gt(zQO*!Uo7Tw4Ohns=UCC;ux zl0U1uj@;6PUR*b#CMfK>h@MkFn^S$|tKOboy1Q2p;0o}u!nFw&_}JM+nzrk|QgGP!+xu}7r0@lYjN_>GYsyZl3CLl2aW z(gFgRV#wYbHA*zwGaglF1T19X>I94e^9IL4PpyRf=~K!@>78R35rE|bMwHi8og8Qn ztJ$xe`)mPYjRD!9)Rdz~uE$mAh&Kl>r5_;wefJ0}Ts{`rmSWq3FQWf-xn}=r^-!oS z2zGlok9(ne+~;WE>)uFT)wG=WvenWN-cF~WVqHhF*753gV8L)ukmCmQ$Ot$3sYHhT zkNauv2~j{m^HaJ<-ALAMZ8?6d(@K!9vmseS+D%z?t~v#?Q(?Dp1_RPE)WNSpOPt~U z9D;fBjRAG?p;TQ?=B4ZCl?PpDkgjhx-gZUXksNGWdhD#ObcS!YsLlDq@e~ZU@>> z4Y@&aQO}rWlR^d1rq&EZ^${uS>$hNC$i7#fR2Mivx6WpZuT+5E37B%{G1%Uc(0ovJ zB~LX;uT>Lev8CDfNOF!fCX2!9?)^b3^jF+g!c}k($o=(>;~szDVD1IGo`ZnuSjmmh zEu=zG#u+_Xw7>59<3qVl=~G)`+8jw6!|Py-`H^;&Q18}pOuP&A8pdB!QNn0wRj}Bp zD!~1vn!VDg_SIQmhI(%kz#ZSV7VA$);=9&)Fh*3nfFRW%MtZe}p>0I`mTObZM4-b# z!}SlQ^uBL$D$vx$t6yRI&KJWA9ey)sGAPzf^I-u!Xi$q#Gz=&X-v)WrQ&_j}w_7F^ zr9D|{z1+EhXiX6R6n%Yq*V=VlV9v%gRAv1nZu$Dp$_d^r`4DGEU&K+pPF(WVR3p8% z&E-4BDmgY1J!FqcuW;V&?v}xb?{_`7_Z{&D&m{4v+me*Fd=RBO(=kgeHZVQ@PGzNZ zYEw_r-|)}dJk?)uB9Lbx2fRU9)Z)q-TgKx=Q_q6zyGb+OP|dA``eJx0AeDp?-RsmxcEO{AOrd?5}ua`FC&91$+K93wyrQ^Ec+QD zX@YG3IO&$)-%4cj=$-Y)xV_$;f8$V>mgTV zbbK<*zk%Rwje7rnEU`3~utRw}8-ox(6B$9SM z+I({2ix+Ss8b`XP3JrKZ1Pm7w@2jPwQvJH5=QOJgP12^_n=VNONh=^r4IscS)3j-i zU_}ZP`L|lD#Af|nq`dg7(-XZc+C{@S_CT0 zxx3CRi#_eCexP05<}tQB*S2lnZWmui8TwJ(<7sdX)t@^|y5OTuE9p1IhA&T06qc9O z*?G^&@7u``$4Ou5fnR5x4ZrFi{%57WR)fFD_vV?<9Xtr8ywYL0)Vlot0IG$wF{r!H zDuXGD1%+@ASanPt5R) z@B03VhuFpM){{DJAg}g)>6!o4{wgz$I=^wmf3-P=#^0g?e`BsFpc>?F`eNdf9!iKY zxfHiFqJ2x7#ve(y`A`E#*M0vOy=0lnU_YntYZ%4JLL^L8%zXd?qQ4Xt4Hn3}ePe&> z+R8V)zU-8I^D2+OEK^=l5x@5ote92kN*HoE$GhOo%cCr5o?>ojZu=(eRzR?yW83O{<#NGpid_*r&(-j7P-b`>;R^a1ZwXG;WN@r!qTQs1Rk;F(Y&4Zz}k6l zt?#G7-U8lBT5ouFb@`UPl!x2M=o6?%o~?G2YlLH{l5l6eVKLlH5mDyT(hA^GbDU2e zYE&h&eg~`@BD8Y0BP}!r9%~C(OYozMk%Ue>)^;nBeiMk#>JSaj9+2}DNeDaJm@3Za z(~j9}d6iQ-vsbez78q}qjoN2-zM;KI3^6`!P^fbJ0gu z-M;-?sJA3#$z7A}#>J{_w3&R(FP4{$LRI00p5 z(1v11`AYzf8JQ%JOo2xZDjgr-YVV}NFYKuoC&!MaT_U|Xt_!%Qba8#$!Keh)s8^#f zSD_nN`|-;I-&0w%0X<*J-kN}af6a?la^C){TM8bzp|JiwL4?EYcX>huqWbICCN%%t z|BrR|Dd7A>_8jmpJecZOqTVC$=o9NmMf+Ej_o);gWyjXa!C;0HfgzJo|3V^GS7_x& zWqOfQE5l(rdygHrk+{mx7?`z83O=s;k{0E8sVwKY`9qf2L^jQ5m~@?bvP8XD>GM*0 z=c~}P@NR({a0?pePO*C3Y zi!mc@zZ%27G|pmXB#g|Kz9lcKH(ZsE!4!AKn{g9R+(KJJw-thVn(2RsO;&%zJlVW< zqdT^=zzR33JVCWdUz*P#J>s@o`SVE;W~gGi{Mk83sKhBJh)_0oz5L9?qTzuYbqx`* z&B^P8+*4|}D3uD){rX8L|);0(z$gBiSQO+-J1psWwu9u3J0zB`7(3_o&z zz4{d3Xs}}B{<=p)T~1t%{2)2d<)3`|m)ZSa#>EF>;ex)JVQRDSAj(oPO<*;_Z#VOJ zA9*bY@U&keSm^H|Zxa4+K#7I=J<~IC6)Z|O=~J@3QvE_AKqU*Jec!`1Ckf+_QnPQ7 zA3h(7&QDA`HHM7a9j|$ge)hsi;xBvQc&CX*E!inye|ubkqL%RK8R?<*oyHff4^0N8 zPWrtyPLX3>-ivBz%6nNuX3q2XwotUYc6E>G_C4z4f#tEC)!&&dwUg2??4!7O@vq^^ z6C=2zUHJ%qFnBEK+~8vDtYWcWsCBp)^&uM@>Z09JZ)oZ9tH(i82UzRklu%?8!F>?7 zdri$w^Zj~Kny&fW6^bl{ACMU&7P`DdH@<*dgE#Q~;Twjfs0vm{dpab6>ka#=;(SbC z+TAn%WtoX;I+h^Z_>HJf;2-@uEx!!TUBnv>*m`TBByJGAdaM%sm=dcGzFmopM+s_j zl*&?0328nVr`jE(2t0*9E$$e!?Y``Ou!9l*Z8(7bYwGc9H6bjbDkp+wyZoovAw5Cc zhR!?XryZ_zln(+ObVcjMKD_akgxW;^2dor+rgTpw<#%%$G;QOH(2zyd`VGlv!{5{1 zP8uF4VC)uZm0JPviyyX<`;ig*3}EIxu)77YBGqR}XZB^-_aybzpst#JuPb;9PX0rp zRv2$H|GVps{+;^$l2rsx-OpRTP9!s)+l+mlQ}kB`&0V7(B@Wv^ppCx@vado!`lO{y=~W0hxkx4l z@}qax(+*#r_?Q7FULgh@KHSV2+`e7f?3CD?<1@|~f^xgt&V-tgAf5>!B0fScpx*iT z|9!Mt8k$P+ZC$!?K^ot^SM@?-t{Mg6yfb-&7ezxuw0mA=!6ebAGg~pyB~WV#BEw_<7{d)vESpZaysx2i)z;Wh(<&|a@i+9 zq`dUFkYBIvZ;?n!cRgsGcY-<_+x1ufT?Esw-`}Gi37FvTe_*@v5XP&SlbgBn{Bulm z+@Kh8M&**`acOe`xP>Lo_|mJ~ul{-gHkd#eqtsroHx=80es)i6UVgShzrgu0C0q`i z`vuaY0RpV!w#|wIN!v3R++2!J`_Xh?%LLmg;AxbH0nLLUP7M1-8~TXqj-`z${qkAU zhsLc$BoobGvHo5QQ4-HVIfc#PiOs%=%@}g*2&gylozGGSJL%v;?MWfe0IZ!4A7w!2 z2UZZFDpctxhQp&mbk!oCt=>dcS9Ec%R35 zjfJG`A(A^KW{E1YEHeq2luDSX z-v_2^heR}q75;;8ZT`gSeOu+HO5M6|gASiu$(ItL}b`!GD3TAs3MkS0UH`@cOtXEyT6gZ39yr0lwFn?>BrlryX{asE>C@ z;GP?}8~V@dl4C^S!9{?;$`uk+^kPlThGFTzy}d6mlK-z2(;+oz7~P|-0woQ~1;8e-c zz{jia0o)e|cZ3n5R(_Kt)8)U)Y08p?-@@Nn?L-7dv6@3V zbZ&W#^>LEe7CvpLQ(2WaM_dRiec1siw7{`T=xP`}h4YT$GT!?S80q>rwrJUZ z{8GE9Zh%{;Y^Fxk7A%d5t0NyPT zW&VL>`1Xz*U7S6?&SW?*opMLX3MQtR6fG~~q*Bq#vakd{vcM=oQ|iEAjIa`d0sXya z!SqJqJQB~=SQ4iSc7qNt5~=$_{p{f^H4GLjn25?h>Y&21k<;l%yac;;;gpWR0q|$s zdem%vteHm_pOVfk)`WfZV`!!T1r>Z=mcoDt4Y8H%qfhFEm~$^xJn80B^6CoXT&O!i zu=;(8_mN(>rS0Bwr1dGJ(Asii zSwchNxC<_Zamld~qLiB zXc7F##A0XF&WOmHcZ?nIQT3c?_zx1woO)W?a$R!*Q0>2c;hp`>-2db0yTg+FzpzU) zD^n}Wk%QD6`_y}c@6pUmN;Qsz9-HDfuZJ&X-lcG6UqkZgiQTn$ z_orH%2>%~QRT5qsSGrl+OsR8;&V7H_S^2?AxE?f6_Zc|fY*oXuOVm@VuT&D`Bv{*3 z{f5f)+CJ2I4VR#(twTDA`Ck?^s6Xj9w^Kb0sZ47f1ES>dGx>Jag=iP zH`_lSf2ySK|5i=Hmw%9{MvbeM_CDw}6U?;rE7b{QoAnAOv3O%Rcl>R3!q8boP4@ls z6XYCUMaF~R_7AeF4_rISUW*KWN?6F6;(Ob7N$WxBV4Ky(Ma4Vp)CS=rO3;O+RAu_Q zjphI+DH3PVTlPGsk8qs-(G-eT3YFLC=JZd(Z4>3vqwfx%K}D>a`PrBv+e&4$blx-n zt;CV90kDY%`^KMkHp`|tCt44FzDxjrX57Dmn{N)eKKcvTR2LWWl=AT)iL1I*0p)&dvf)Q^Evq3FooV16O*dZSVc_4#!fe*B|!rR^@BabhSSvVt%FQ*^s+7!}aR&z% zfl?FEA2&;6ZTZZPIdL@F+dS?9{JpjA3oxy>j;z-MBc_)IZ#2C1%@Ylosh7mZd3;TL zai*1(L0nyvaP#3Gki;`@Uy93=N;vnWAhKdB^Z7XkMcVdJS^%|RLWH=v)nM$*iSVxG{We^qx>ot1$J)`TCRjU|vn z0ri-7_B3F`0QlAj3A*U>Y-OcN&~W5lOJa;pgEiE6KQsw zL-+c-{)^CdWQVj^5<8=yxh9`K&f^*9M^n6WK|8VCcBB3Uwa8OC&BB%W2nJW&MbJ(3 zuA7pV_n}%g`1h0SLD&Sy9}aM{+fP6U(|F}W=FVJL$pT-gGum@7>TpFiWp+mjm&M`< zbB#pm?!K$1-Oaihm8ZP0&GhM%-M?(w`*pH3TKB!~B2n(iePGv$u^?IAPU|->XF&>h zgeWYZycV$Yca_Xv%e;=4M3uruK4G3HmWCp}IlO%YkVT){7kW1+h_*)D0CzMzre76C zo6btLoj4je&MOrde-u#}`w1Z~{EecE687r;DI4@MyoYzx@iYSRFaB0&!mMJa-d?#) zeS}at6FD7inZGC3j$XHNKOFwv^D?gDd$p?#?pzNy&Q^KHucElP%-I$Ep3{CS>VC2k z>calia-|(MZt}028mV=ilHT5U%(LcpmCznLDhadn(YA^F&*r&GLb@rLW@dYnb|q(%HYITZgae1-9_dtDd#rLs+6towIH){f&c%dpO8 z$cWQuDQ*75AHTM%`wfBT()~kZgm0E0|Hbhk1-dlXW$SW+b}qoXgSVP$7=L*(vQ}@L zdTRQJ^ z^qqvwZ)0O6*%?qdOI6;Cw#gwA7fo^$r0o27XIuo<1UZB~!7w|p>>%DhR-eco;k;R@ zF=HF4A;FYBzN7m#?|gxqDH*Nw)y)*u;E0MHTmJzvVP2-kVA(>t6F-pLgf!dp&vK+79>B#A!Ii{8i!C{TnYsTcN&Me+Dc+esh90LG~Jj*Ff;|Ay>n}a zv(C4e(OL28IlR9e`zSP1%4aiwUo;69eQ0P#c6y+EANiU(4*$SLVb(qGNX#^+IJuWi z2K<(+Rdt8y*f&8X7SNm9(;pPmsqRiPy&nqbhYm*3j?Scr0Tf)_t(WHqwbH1YviaTT zZM0Yc_8F;tDE~pu%^k`!EczPAO{s)t)6HEWh`tRxgQ6@f*1IEP-L(yTIB@Qp%63%` z#lj#8A-t6D&zLO{H(jE4xiDPz!%FI~t&5CCXFmlWMq^Z(91B2fY)g}`jEC2YH{e2! zOUdEPuYTei*p?MOFlP?gn_P$?KbxfBV{z}|583y)Qpu9^Bi#-yAA#7}uumWsvsIcf16!ViJo2dmln)TS z%W>zSGJV1G0*+31308%ojP>sdE2l1nuE^+ZWya;*5Z9KO371z(h57rWSR`&iG=I2L zq;17ypnjh$MX?`73xM8Nb9#G+(hg_KcLU|8t%+g+4bNt!P#4z;HBnNnWk;@g1k~^# zEe9#q5W2_qskdwnHg;uM5@847YOI_v9KQm-*M#2h%t8APj-g&GWM!?crAUTY0)CLC zum;-5d1$s?e&3N^DLvA+}=A=u}N6&#d0p7?Z)!s*4q&8MYJXs8kI;EG11@1 zR*~6BqkJ3tBhlc(X(8nUQD-vU64H-iCk&^4e|Y*FBEx3OZ5D)h6M%ssjN?sALSLVY z%6NRiIu26KczA5VDlcj`-M>$KE#GRTs%HjW+BVz}KjvN8?BV>%nIN-F8{z8FLMjea z4f_6@^iHLpq3x9UjnUtF9FLJCMruWp(oaj=Kr+Ba_+`Bd%y8&T=~mt2y_sRwUn76d zI?^!XX|7PGiB>9r9b2>WSWA$sm7c%y$(K+%@)o4l+S;jcEJWGge{|^Ksjp>nP$h`3 zBK#1U`NAS6vLWUj6hL;mtEsob1oK(J1bD&w`~#+JCT0?JvotpE>RR{BP@jGOzRmc} z1s_ooZ|!keG`x`h z>p6`>-9H1FO{gvXC2#1Z!+J*)JcoIre_@rfp?LuiNQv0n5%n0)k6L^3h#3`M3T>G^ zj zI|1)oW8{^(u7iv~*O3P7)Da}6?krQ`SJ%P|^wh4R?}0NyXMd)HOFgfiQ6ivs+-6Tf zt~)8D&w}Tms+XPa5Q~~Lc6eJHH`99xgsEevO`p#@z0@6Mo(m@A)*Gl%ls<$7Toi7+ zSpEL{B(TE#+0HUz5x282t`||hTOm(Md!k#GB+~11(=ZTOjH+{lq%Kuy(XXQ}f6Ox0 z|09^JRP#7J=%&~Spc(G%G#}2m zwP=*{Po7=x!4#)vDi-eFO8yT7NBx?2hl!JU$Bs8HCP5z4-t(2%JoD*(V8%6};(f-W zx!VZzjcF5ifbq3EhaDJK=(yXne1p0FC>pQicPjDpNH@A5$a_z(BVHxpa@_H!4c?_$ z_h`?q>hLuG_MMMhjpm5T> z7(7d2FZSj94XuTGFNp{BgP7Pxx^A6&@xQ}^-{g&;Hhni_q`WW*UKY%@4|?3o?H>J9 zO=C!6x&8UP%C6C{yr*7y=7LL^G}VaCX~6~_1r>15bwAZkScyyB?}wkacb{$OZ8F;` z??~++FE_O;Jbb(1$7N@7*lii@$JQ}=FvL65Y;h6@*G^_aE z;V1u|_~-Uo$Iaqi6W@m4Xf*0`fTXMA_;6wt<|wNYu06h8S(eR3_#9B4nY!-do!aWD zNXpmcTW>jF*5xp{6odJFMv%#~$Qy8(y?g=tZcU|~QQf)bxeuZ0ltyU&dvG-VUM&~@ z=*f|0sFKr>8kW}B9&)63bo6hOeI#_$bbpFGl!9lkznQ0(urZqKcfI!{nQz=(XXK$) zv13h3Ki8XsLodrw87|Z!QHhyRyXVFQ!kF^rZ;q{68T#PoE$8R8b)K`v_dWLol3M)!U=1k0gA{D4~DNH6pLTfVd@8 z@{?ni1tAMId@KI803*()?wTJ^D_TcU+@Wvm$miU;(n?$iiUe+5tK@a&IXr&!F8^z4 zz{`XHzzTbCU3J2J+W|lLZR*Z{_NvAi;P(O8FZI~Bo}-qk;sr3-YgLn>LCWJXD5)w{ zo5j)G2XD^BM_Q|}hPQDp)&J4r;_?&sIXC6fURBUAI*%kf~x{=ypE4{>5RfWAhG_uoZPX&4g}aimKR9j<;Lb zHt3(f^?OgSGykVh6*)S5PJ`w?6(vUtr3VXHd=+ry|6+`5L=tdO_t73Q5E zm~Fx@9oX-=C7@2xyn&jyeMfX+o5Zp`I?;6jx=lfoijLn`bOh4ZOn5HEHxRUi?eUKN z&6T6E%l-@0dW!l=aEsR|bRNuH9CyE4Q$QepwzbG(lV_+`#eAUUF`SbIUDq_FzxE*B zO%C)Rs+UiGe^Ea7p+hxY={OC%OIU1 z-qUc-so>qZz^X7VkgJp74@ym#IKSOcU*`cChQf+dAde~U#h&Z=Z`XCX-RDpIFLxyT zjAbEJ2dys%n_DlvAKLe8iXDyt)RQfz=--6!J8~ti*t0w`ejN3HHhblX?1A+EWt?sr zXX8f;R$ZH7os+V{WOTGy*!+3qG8GWFnrYu9tapq%{#CGv3>A^k&!p_Y9 zz4IT{4sN>`qRnN>s}$DX&Q8kl9}{{W9V#av3)DPEoBp6g;Gx~C5qlM;EYxZ? zZIoJ6DqtR?JJlLa-pY>kX$TC5)nZ3vv&~Gv(K*I*xURvQ!eQyw!=kzL`r%k}(cAXO5pi&u@!+J~vMb^!Xur z)MC`jDeAVD-b{G9XoVY*3MzwzP$$CTYohz<;(&h7`c?ae&9n42r6^KcCP zcD)w*va51wSGy^pN|0+gjJICha&eeTfBj9z*!4*_Udch&api+u zJ1Se?x4i9CteE7zkg2(Qb_nWw%wspn+}I3rye8LD$!*j15DUy{^Q|W>igU!`XKSYviTmHPe2cGUXhK`#Zb)TmI~_m+woGqIWcHmD%WajO@b~5W{v44 zG4^Kigg*o4VjX3|R;%?qCLDbZbGBBE2+LlNbiTFcsg)jGj0@m%%2;qG(y-^ ziX8!7D$2{o{(_3<)+0Xpf46QC+zz^L-@D~%$n)M{hgB@X5k`ra5b`Phu6O^|YD=&# zggZ^h-Axl|wV3}>dD^D_q`z3BTmW+c5%XfNd*7}vEA`=uW9_1z!V}jl`YA;l+df~8 zcU2%kUC12`7 zpZI7%6a`p!(G%Z%QH}}H^k~i;QN4oGql^A68NA;tDOxM(z^d%4?FiT*v^V%e26*r0 zscx(i24-XCoa)nbjtm#8Y;{S|{JmqQ+aX^alzuf=j#PI)2S*wJcUsA)FFF*DNc1$)XLoKi8m;B|AhTom6@Q=)UCn9F)#jRYW zUC&;v7Zc>h@7X-mn=5JQK=dt*7<_59)d$fi!oMnSYURes&7-t(W6LfgMQDlWLySB9 z20BV3`D%&lf|j+C1QNl%I}XT%*sVa6>>!i>k(nJbZ$NE8@1ZqKP04MwE=6E@X3UP1 z|JZpOy-J5)77^I`kfkmhwF40l^G%ia8OT|GJ77J(|4?T?Wrab*R`g%zi$=^^*<$US!J641P=b($8-0GV4 zYrXPxMOFwuv(&tN2_v-~bj+I2BVG@J^yyuSt#>>|JL z8Nsnrwstw=P{eriQp+90xtAJS`e#8m^shWnLN?_W%BGe4{dXdtVkb*@(aMB&0aWfK z+;$U)`0B4x64V7f3mQW&>n!4X?p+0CQ0SW%DjuT=)dV(B2PcoNqy1DOP$qi8mLwo0 zpy8cR)jWrE!g~#T}ZtL)2dZ2`tqGC*53OrLrx-z;Dpl9m6 z!%treaC%6rpZHNlze&*>4?XNq%ytOs*G*O3as3WSfzI};i?$jEfhYd%m$+)vc!4QN zK_f>cUW7c6Ub0l^_4qw)pvcMQqk{mkIhVuat}`qAZN_KjkG>|}#(E_rq`Lmqb=Tr* z)4fEg;@KBfJs3N(e0<b6+oq-~GptcaF9 z6yO`Ucd9~d`4^`+RvKZ+yn@qZu5pm!mk+8ZF@~cI=x}?gS!C)ESm3q{I1ekVVF~5?Y*fVTPRC`X9%LzHWLO1ghH{2ggxC4WT ztheXNs);_yBmslEg9Xa62ddkBt*pv<=Xrv*b3m7m8iMh+cLI-Y+m8CCM4!Y@r~XD7 z)8Blo`(t1~)||5E66a5*uHqNl;MQ^iI7o$Gj&ts!>bf#}8JmMgfH&H{NFwllt zq>Tq^x(_t$DzQqycIDPpx_NyI_YR3k$DhZU`(@$G7}CD{zNX9Y$2Ix#r@!;g@B@>p zVA|svBw+_Mh`qtq9aI)L>2h1<;BY0x-ZypJNv0?@?Tq+r7Ualt*JHqT%cR5qO=xnZ z^9}5ydXB3GKP^?S=H9qB`~_&DMd421Y&dyi)xwe0@$!46r@He&(sT3g-kVuBb((Gl z%%=WHb?BN*@Mk079v5$Z;-r6%=BSu10FnHu)D>ahwwson6{5^D+?53JpN4}2DDV=v z5Do*<T@DRHz7XJg?I+BVXB1&1l#Hru|% z$B@f#=^_0P@{P#qNPFq#lPm{1>8IAO1anZ?;TcY(?iH)jxz7t5nhcw7sKjw5sY+q} zHkS^j_MC-%+@^cK$E+!*MB9NI1R;D`gi|*))77FCn(6OFSdvkVbZ`$jh1ILCE%7~} zxpOfn(c2*-=RBiY-Rdgz6=TtVcQOw*_n4~wl=(4^@Z?9AQVd41!@H8;Bh9y%XuE0+ zw)r#e4O9}u=i14Ox1hbJDuOvF3hv0lAdHZMqVs`yeLCg_{e>GvNWI^vmEUSnbt^Y& z(R#7(X-_}4J9J~j;+nI4YJT}jw(5@NpywMv4>uHC*+ zT_zv(JcoMxW-DM33yHd>^`2=-@pFg76J&AWD}1BZ7M_t$a^PCY!rE{zSJR`slWmF^ z!F4CQ!^d9p4`-!d&u$_3gysJ-0>VJl?nm|!o5xFu3$}tm+d{X&A!L*y-!uW)acRYU z7BUFabDA&mdTAM!=gsup9trRmtOG>uD|EeFyUn7p9&9arzd-(5XM&iSNs5hypqU@P zCva*_KsSTmAI9(S(#KB!OOW5b5YXN$Y^Z5|*=92+s*E}m3~^|@+==}ckjrHGxbW7? zmoB}04G>6faf9hRt}Kovs$fj${aVS~6CTb86RmSSRlhcuceL!b?ZaN;!$CIebwFe0 z>18cv@byjS6%{nKPH0+C~~1VLYlP+PenkefX6>fjlNn zuhE3Bs7U)RDum{@m_@bfBqsjtY}{9fLCsx)K73ZgL;cyt25&uBEqPd4Dzz8zw9|Oo zF&p+D!W?@U3#K~3#rOAmxjh{ZzaUs!3$y+yG4Cc-jaTbO{MezHBL{=Y{3zLWW<5Gx z()oWBOQdaF^Z6+$+#OB=siZX0-64ha2%)@>L^zS7;u@d z(^K-Wu49atNvKQJ9c_Y007v!{0mC+zoLF?n-hhv9KQ*ksf9UeRbIr$o)Qc#dBcs;c zh6c8(4P`pZ1&1K>ro%;FQP5ieD20>RAgPJ!>EEw@ef;hHM-2q~%BPBY&S-i_`M{%F zBX-b6sKl+$9yy;E;}&yDJ+3Sz zfgJJ{TO#7{V~lWBMZLsA9#ymH0^=>`Fh||u=b786Ex+P}WkV%>)g&b~t}kb88zQkAzr--2xJI147 zslnqNk7c6;0KwL{mvMI^zt60`F7zuJYnU97qm0n%?FckL%rl073 zO3T~{J^n&T5zF0JS(Q<-{f*BnF0owS#>7lm$jYQ2{s|=jFK)3cdZ2I*Ms`z2&lel@yh0(BblR#Eh>W{2>0A9iqAAKa81n}%QR|NYwq!M2*h#A2Blc1G-HV98JoRUfM zp0|L8>WM~^CIk9ql1E}aew{duAdOS6D<}C4P%;4eO@yaQ<)W`01)reqm>bLBd=4#) z(6@Q;rjV<>T&2~S_vnnb$o_yGG3^ACV{23BrtYs)&zL+Z2iI85^N63WZ2P@LtZ?(-7S{^s}h7-*aQH3a}q`@ z^cpxjf7my-6w5qDSATooyvdL(Ms7W%OYGT-Nx^!GoUfzc@XMr~$Z5baE9Q z(BK*N$*c7}oCCM@tP61+jODosXQ#RE{puMSxb(8wVH4z>g9OTNr>fH1)K%R9E8q5S zIqZ;r>cSDeANS8Pxc4bXXYxO-V~(6{M*tkQD&Fasjxj52RX>U~d9wepa;0(QqTOP3 z2Y=o`;@&Bb)P-klalU4ZVy%hjS{5OF^4GRf8usg~~*r&V|Y?N*n@%oXNPuGC$t;%w^)I{sycDtfh6-g8c zIMVxbldo3EW@B9J>_jfWl42Rl2kR#q&H`@e*{EBNvX;>)Mqh^hv_~tlS%x2bN=s~j z2f0OP*2+rT^Q%6el3j$8XuWpB?>gu%wKUMUhsZjO5KD<16U+hrh=K4_zNZ%Hrl1la zsIHS)cv4YKA?!;eP5LDwk;&zUG$P-t$rD1;mxBWU<>7liN~1jC|Lo|e){ze2(V@54 z6}Vd=;CWU@(|>cT{KW@bnhw_c#g+M~`RwF|zK^qq$ShlYQKZBa98D~()jg_ugNhXJ z(IwP&+C9m$2}myXoay?_Dh(-;J~2xI@mX zW7jRQdWI~5i{{;(>bSp6uCCGD+iqX5Q5rQRs!h7PyB2CZ2;WkOyYMl<3k#B zQJ}>aE}qY8WhnHi&7nmLBjisRnb5K|?egdIce)?x1a_Lp=D#LxT?RMPq zHw zGCGlYb+z!o1Af^@(UC3PBN;0>9^Bc#5FYxxH4i`2^&ig5h%v)r<@-v-u#|^+(KB|Kgj17qxJ3RLYv`>(U#JFWOaveEu~Vz)$HIzh^%VaH z^pA#;OuG%(pMU<+Uf6x{_7M6jV3Q!cd*=o`Hku7}lQGb1jG7$>#YUebk5OAxm+qIJ zg;uyoP~W#UIC07gRsHI{MsG>rwZ|HY7z>rSUNZ6dumM23;dV$sNKHgz|j56#mt;i8J*dZurN*PIHE?jMRD6XBtOgK_?F#Y$QW1)_MY&k+g^8=GjG?v-FA z#uU7UOI!Bv(Y9^bNn`=Wqzs{UmA;xMzy6BY*W3WLbfKLcxvx#g3DIske^l%W%W%-Y z!4O$&J^1icIQ6&onLXbEVO#BX6Oc;LklR-fS>M-${h=OP0ke*u&lPK{J34C z@%G*~IfJ$>_^vM^{;;Q~ey!&|MVcD@4k$!k=6b^{^a{uV%QF^E)zm#H$36%6$aow- zoiCGpB^0slqgxg$&nlg~RJzwx7EQ^W=2aJq&%;@C6kJoY(!AO`bvn6fO)@NIr6FI? z(d_71?wB9Gz40iMh={^xPkwuQd+#jp2-I%j5n@!uiRt*OuXr{>iNO<0Zi`c3u3B3( zoQ+KX*_YcYLTSvJ*Es{Z5mCYFrZ)dsJyvqBy6Na-#SsV^G=5P(^{l4^#3{hm+x2PI zq(nq{g7=HP^-jqy!6?jXlkBbZ=4{)G7Q*P~1lH2KQ)uaZ*a~#FY!bsIze*3ihrF_j zbbv%h?HbCDb~ZR5WPxph!Ac3gBYrnq40lR5-~1R-+H@)yEEX@IDrm?n8f#zkyqhax zMa_umy)gRRak0U(JToQPXTX6yxAV>?y_&X&56UXLsYNlH>`Z;z4=%cA6b;%ijR*f( zYb>b(TL1eR?(3=Ebl+CIiXyzHNT&axs#uC2CvJ#a#L-t=%9F}-Vl<0Zcc1Lqfq$kII^1e zO`<@)Qv!PMjDJJ_ux&qQxZ!109Ymav@RIFetI7zAE)R z=QQyZxdWNe)Jwe~=xQ&~x#0P@=31bmsbSR}ueeXII7U+-m^mAM3Gl7#r+e(bxOo5!2i zn=Gf_#>7wkwAv__4QJ+lKkp7m@kmhmp2&q=R&8G}SiLqc0UkNyJFrS@qsi|k;$kBI zt;Zi?V!j#5c(waJ_5MQZh&RG7L}%glU#I}qP#yU2G6U&;i{lxC!-KQkZ8ulH3o79* zY<8d9Y4n`Xe6lCdPKJLsoW*VtD(3z$5EQqa*yCfre;O18l~<#acMJ3nD-LY1SiG&o z8s4At57w#&p67N^9kFU$Xwi)p$F^>6k8xM67JI`rXAeBg6-8tee_Qz*TCYW4` zSlCfuvGC-MrFTc#v|YE(-Jyw`%1|BAky(DV-W(wERgkknK4HSg3O&+RX?7r8U3O3?i{d@gW?cK`!JFqw^UmvaITG_wac{b9ldX- z4?O^c(p9f}2Riv@Helfi#Y%%DSx{(%f*1j}Q=p7Ig45KYG)2aWbcNa?peUH5lDonwLFQ1h`7gG zZkZUd^7<{P5v#}iEyE%uAa$3x6!onJ>BBiLYK6`SqVN_b_|%)2*%3d7eOTX4Chh@} zFxj>_sPf=@eZ!~Uasq9~Wsv$*(CmOOX@YyTjU(T>Z2!0agTbOy7i8Le3=#A_(J&R( z?PS@SN4aU`F1@}N+kiuDU!{d9P1D%9HI)|h}zpclyptW|MRxQ zkdi@WXO`~y0$2xYH{G`a!nm|;HvpQmxX zkKN|QPiQPTHoHB|72LMT+-|H9ckkR|&=*QoI2i+h?5!5mt@-W;FZOI~SAQW?DBVp| z&T4?kCm3j3S!nd~8g6PmK037+v`Nh%`bsnz5TSRaZ!sd+CDREvj0g(=uqA4;WY_uj zwVy2casNcpPD2yi1U~=MqNkb0>YzCub4@Yt1{4!}IsQf&4n@fS5a=A8cs7X8A02dy z7^T7xk%z4spB!zEU(-AnK_$U;>^ag$zw}`GTVpQj)3mSnYpu3S6A@K|Qibn{iy`fy zh}eC_#zO0kBBSDW(6kAq#cwh~%#td)O28t(6+7 zW4!v1`A*Jrr#LPg?F)#v)?0Y!97D1ntBL&FmW5eK8MGk*63`5 zGL6{6|NB_t<<=;wbNFdB$>sLT6*NzG`&C7Euo~Allk?MAxfFrL1F`Bn`Mn zjYdx>?KS*(0Qtb(jvBGK6mM~RwC;#Mp5=F^>tjaXGNRkW>5QoO(}L-ZCWAtdQy?YA z1CzVp8kf*NoqA50ZmYVLD@5=FNo&T*d(E&a<3rOOz|ZCafZqMdjdzHeVey>I?RN|l zuQCDp&AL0l`pQLE_#GpF%FBcNQj-`DUfPWgaY^y7!b`fo&?H%+;9fgwoRG7r#%7MMORCSNV09H>W~M=ANR) z$T+1fmHvnY@Nh`N+bXI+1FkVV1L!S#qaJ{3BREN(O9+Kf=>-vy}unetF!!hHP9gd4F zp{0XMCPqg!82_HyT1+`Jpe9#)$v7xi5q2TxY#Z-)+}ze%7tw>Dxk!PI-q?2LLl(Cd zJv{dKl6ipYUIy&!$VtqC;ZOWeKneS!7TL(&^f5m4rj}XvdS%5X{@Yfxm1=DGa9gsh za)|3{9EAVgaoR*xA(xgm$xl(cVsE*$0~W&~{zX34-Y~RIR7h|(_3a6j(PHc!wWHcb zkkTIvT3xrCV>dJ$D^Dcat9H;H70&OB`hY?K4)Co z1(@~s!Bh#%y5$_r9dGMg8hX`#(_4*rH*te$(5|tqp%3!!X&vXEPS?OO(z4rn@WdvG>EGItUz6vDf`~H;mKjc*T{Ls>wLswt!yG*qgev~pWLOty>7qx z-Vb!ZX`$SONJTB}Pm9;XcD4J&54aNN7CuS=UAw_i#4;s_votc>Q&zk zVIHOYNyAP}6!3qpBPDHqtm;X$-x>3LF3g$6?3Ebdwf`H88M3e<>YGgTIy)|VUoQGj zg*b81OqN$^b29P4fUxQU09&JLN*=Lw2>IdZzv|QyyBU{kI$Pn=#6(=;iLNWR@5mM> zKdR&V4ET#o6XPwAF+~ZK{91j-M5XCC!}ys0@3*i%_jJ>w)h>S;^XW~{aI@TBbc64; zr;>_b$x3@k#o*1WtE|d&Xl&kUTv310EZ6E4k80WXlNQ|+>9&YiCA;jLnG5q>-yTjw zqJ6hci$1Yyrk`nbX~O0k-WC`Hc$0jzJw-=bDvj9Jo{w8TEEZx?O3JB)RD zZ2$9C`M_OM^hxbELvgiF2x~p^|Adt+YnJ*um{J-}oak~!Px$U=^q*L9qTiX;t9N-T zMJy4e#|P1C7M(*;?l~c;kkvBg9JzH4Xq_q6LE8r+UwLQK@m7b#@qa#1FqK`p;Pzw4VmR(E z!1eCmj&IRXnvKIh1ZWM_U6%>>+AMxV75cFVlItTt2^dQgxg)ZhLdb9!Pb}ozeHdyC zK3!`<9n(puExVzZzbMnkS#Mh-+T75xi81UK#LvVupTR7%3?gif=u2uP6E$GQyeEfB@lE_Thi-y< zmp5z(c;IYlml~W_5)ApipMu9;Qh$Rd?@BGx6=h1`|gH8`RY4} zTMu8)=g@3+L(@1e@+5z$0c-rJWgz2;W=Cf#pWCBd?;iOa{n-mLM(i=)U?b(<`+S;t z%evK^NKaL~pXj|r-9fz2z>^}v(x$~W%JUw_9V2aIQ({S54?16K4bHWXb|YOxI`w50 zncK5I{oCzfgRa`22x=ra4to;6kiYIngAHpi^nALgCM-{$QPwJo#CrsA+?(6v**(~n zn{_lLV_*LZ9^8oLr=5gT>yoU^#}lJ2ymN8@t+Lv)Np^5d<@ObtZ#+#9{o8`Yfjx_0 zG}-i!SykT9XM>uf#>2ntNB^~VuDxU@Z2Q7S0o7NQoA%$oUgyB@n|hXuM3tQ`FkF*7 zK#*kmLNgPfw~^j2LGLC#xs{?%KT;4}M5n@rSR;xyWrY=C-qU764^o)f>@)JpR2THjU8@y?ReV-ZK1 zIHxZKN!{H1wybD`Jg?-UInwVLAphgA;bOspm8u-4WAzx<>Lgs9R_&m86SXh4NM43% zJ-aHia^d?8yUUEb3fEZ%xm+}{%1x0P59{}*>|Pqz29C4FNa=XN!Ntd~^cG>vii z1Fhb?nm#y+wMnb~EY6}GPDPJ>Pl0zscd;)xbtHVtF(Gm|v|wKB?ERud`jf}o1G zyq;=mzjCKbZN;4=bBh8FoRh$*Oy{xxG6GqKFiJf1OXj_v=i3J3TQAGdD}rVB`H;T3 zqkoWr@Hjx7x_w7OX<%8Okgf<#7gb>%AWDrVDs|WmgliZe~b1DO25vA)Uj%jnsuYLp%i~C@ZSB77RSF)KQqAxPXylcznPA@ zs4ww{5`6U};IFQiXG8R2>F*m(FuikCZ}O)C@5PH@zkPRZQ8CWne@ni>)4<1zTa`th zN4|EfwI9Vl6L@btn2zp-a;0YaOgo?oK6@7Moq9cQj9vi0A093gUp;qA5ClPRcJ%+_ z?CPT{tE&6u9-&ArE;-;Atv+2<*HWz7s!*$NZw#3s3=l%VM;IQLM~ETw3?Yp%j>EgJ zD#({u1pyW0X$uZ$WeUR}L&R$ZSEXIzN2yE3|0WIluke=iNKJB=-H0 z+;#77@AI|KKKp#_?NW8)l5dwua|ZI`E_y!HH-2Pq0{>r?`Hz^F5kF$|2!jfK9aIZ(^Aay^;mz_s8v?F!uWBL2I+!~j1b3_{eR-jUmHw@u-^*|AFQi+@G0>F9 zKwV|_^~+)y^#9^s`u6kV4gD^pc8P|S7$#>qRG2q+j|P3kE?JPEDs_&loe|(ZTJA3s zW&_)O0!#duj)ZnO26ThkTlov_n`Qpv=Dp-Uj+IPQpYqQ(tA1u_)Tn*Hnxh!3HL1wzW(^pTIXp&a%E_ea)?6Xo#2+;&zDj@FU-yHz{J7tS9Ia(>9QYZg8Q?w zoJ<7YWfL+arFNoEVpzWJMXRU7c};XNa2w10_;?rk9Cp|7@elOrfBA$IPY?2$T?Rgb z+L!WQ2=3mhe!7qixEVHPWt`|ZO6rFojBr97Bfd(oC;=9r&zO zp6HXnouK{ApX*-9&2K5kE8-f@Z#|HI_BWtgi+>@w`}^B_)Yj>rFtv5al5DV$fA@y< z@sDlQM?bMmik2i>6jvmbT@caWaf_Vu$nHy>vG?9R=8Ol)@!$K5kb zr~CQU(|JGCN)+7!+##~zC3a_~aauEVV3_HRhb-PH9WslL<`aWtg$Im>sm(aE3lF)c zIyua@YqudE)pa`d-$cHjSFZ1I^HPrcPj816w}bDX`X>L{F5o^>l@}RuQ(NyhzqCDj zcYtm!{>c}B`(61*yFoXIKjkG8TuI(H*v;{yzNTHTy`E3#wNP}FmtLNebMqq#_Vzru zN7$a52bu8p;4Wu-ZpHwYY-l-)Z-DN&>9MIsw4VNLo%{v2U)e4iGh4}jOk4w^A;`aYaCQFN52^KltLj;) zjwq4uH|n_K%QtFHr5uc!VM^erd7(baMsR9JW1PH4{+Mp`W2E~+*QkCyzz^%1|C)Rs zBuDHo9l^b!oWEf+&iWY+Q_kU-QG$lmiSBT)=!fGWuM(Xm)O!3cK?;&1sPrF4naE8<$2rg+}OT(NyN6< zog-|Yo)^dt1^u9WvK_#FC{p!{}TvOfMj!QEf3=TUPp#g>utMjM)b_6#_e!KF0qMZJyd5r0g!v4arr|CzBubw{TA`{%r zW&WGYYbbu35W1nlzxL+!@$U%k%CcP4gCm7Hc2H!ePwVffb@CV7!)5(4Znm+0#!)}w z5QqFbZ(W@~S~H4zf;(0Dd%ZU+jqV&>J>Ywddt%u7S)(o{L-e{4>+Y>mo|6qoKdirc zzRU5|!fjbSN-gsk!ZHrMdXM!^m7EcU^D4zg@OyW;9f!?#*#Cy@O0dF*NRXmaA}{JCD%72LgLIT;V}t;gd}`%=3t=xh0ewmmb* zeP?3z^jQBr!JVLXudD~@+UV}!e|2|m9;G_jotwi@rQYDydOU6QbPq$dMP0$YK-6$}Ow+ZppVRxChJQR>pG*sm+da z`_0r7ohk6WO7rd8f81Qn_8)id`o$Ux`_8p%%>JjtuudX;3)SU!L`c$x*5~aMKk`g>u>DW z(Pxo<#m`oY6a5xL!x|NPndR#V-9K08Xk|C!vt02spT%uR=Q7nNUT@XuN8LFd;;E>5e5UW!Zi>Zz zn(YGpAb*&|bp7md49G-bSL;7p>pQyb%0~J?P@MoJ>*N?3S`+b{lDVYF`51G&0t}o9NFZxV{0eA|2@!W~tZ+ZDo?G$eR)I2X`DxI%Chy-h!) z6VwmgA0XYz{={6oLz-$XzQ6@cWPYO`0{`6d`oxYr#0uFV2ZG%69!uixNu$#2$m2`A z>i0jEzxELLzS_Ul{<9S_AN)&Yg1bV;2`}H%<{s2*YNvS~Wje-ks?WOr<9-h#omZ*c zdVM%*E+_pchp16KDL9HtNJDls{)kkI%;p=c$K)sAJK$bUYL_N#dnD+;Lh$>Q%h56# zZ=}WDs zH&QwzP5EZXwr~-_nFV3r2D|N;FppsU^#u2da=8|`X0Qzfa|-ti%<9tE@|iJ`QotYx}@Ll4U`sw;fyM zlgM|DkD}N2x<6S6u5#~cNfx!WUJ^NA&T)(U(7D6C(n4_I9`^?8T>K$-edDU&&Q`tQ z^-jwSq2Hmk0zTVs%$M)J1N}dqFKL;Z5A@>3ag^Qui#!`G)MCHtcox7DkYJ;`Qo1?XbVFr)^F`=XMCQ zsqa};#-73NZ$QO3+L$*R_O#{9gL`Y<5;(?R3|ZZ$@AbCu`u6Y|QwRT}9Z(#G`nbJZ ze-mbZ*53s7Wl}pqH8*jrZO3kLuCLuXuK}OK%6#hP%S^t0yluw`+pTyV@WJ1-Z?{Qv z7x9xPI6U=Y^m^bc_fHo%eUn>6aq2SFm#?nS{j8j?NuxoZCr4atHTKKy;Yf%3mLmVt zvPpe1?ey9az{&DjWZS-b2f38*elgPP0oWy2=Sl7I1pFSde1+gE@iqJ6ZeuCXE$qC_ zwom8&O!g+^Bi#S+{cA47-wT1uojXohM$&Ynw}8G9|6@L;jL%aB=UouF)0yAsNYGX0 z)pIcw^IVK|b*V_oTkR;&J*Dm8^V`yOtCrbH3213hm(~m|ANK#+5ct%~e5Td*m<~s6 zr{jyHJ50mwPu&ATs8Jp}!{Ar(|Gvn38az)xeD7%BtL@8iZy85^$0%3X2=Kpj!Vo!m z@#S6=f8S@)4#+kD_k11yJ#IGMEk)?_G#kI4@61m2)>#hovy-+R*R|d|o4~gc2WLL! z;j4LE!*e&yaN8y2D?fCz-8;vDPvsuZTsT@d$10dR#S(eXMi2vP+F{Y-r)v#_#=YOQH&4K>g zRr;%$@0J{h8}c4)*{>NtJ~|Kd7aZi-IzL5r+o(+#$2+x2j8N^VP0Y>%q#z0Nl<0-H zL{#5U-$zC5{eW?F$R-kxz$NtGZ-mT>yv+Yf4 zuVxnj|FJTDk+Qs~3muEpY>VtFi`bz{_j-6or15Q{4}kyo%Kfrw4q<+ps=}IBvT$<* zjY`&}bT@TE*VGf1P3>~cc-nbk4*I!w8PW~wfzGe;kT)pD{oi=b|HJU3<5=-Q(9yn< zacmj)XHV36u3Zk?&a#}%8@&fNA5YqLM*ZFUYv53f1tU-zS&*FFk9mHnm#-8>P)Ahip)ca`?NiN7ZqT)+${?Rz+n zpQsnZgMumj3+fViLAy;rsnAPkQ~zT>Pd%YmzLI2uv zJ+^SX+bKofVsFVJ3wG2vj&?o)`WKhmbBcbnrs#;rEuXRAQ?x~{6aT&OQygzbn&C z>DW1iP3Ivy1$!m6Q?${hG>FF(uYpf-aX}s$V%|ix8<5Vk%KD+9@eCT~ryQgE?gOzR z8}S7`_o)r9^qU*WeI-YcmMgg#>D?&?sQBrgG<&d2FvRm(sh!k;Mvidxf5ZBh1MQRy zOrGRMBi4KL_eiHApUarlyKV}NlG^1n-9(&n5Zwy8N<1RjFGv}-_gzek5+u|cf@yh zf&b5as%{+i_T0Rhr1K|~JAn`Wvw$~WM8BZlEaJ1f zfUmUYtm>`V&3*u4|IAi^?`Zzr_;ZdQa-5;X`A|=AgVrgcFM`i}iBH}0aXTC;2ZF1} z!JZeT^X)MgUuNB!g7fckw|`3Q+}XB$(q&Q~wSPc5m3zI*;&x)lE^`{b zOkMOe4_t{`mLp+lABdjrpN8yMAJX0bSnl3eke{{6O?-9_@JFlu^Ll*5d=>gAwIlJc zZ8zA?#n*s8{7|1P&m(;Qd~+?&yM6zB(>R3lJ{k6+=wZhXuLoRA+q@f~&~mtZqTM^HTl$Pmh4_ zMP<2}F^8icr*`I8*YB^DbUTj%e~WB5ivCZ`i-}Lz;E8#qzSHIFgu%`et*?ZZPGWB7 zP?dyxItj<4#2gtuKd!9DtebgJZzR7){?=M=ECeU+@(_36on9^YA&>l`C%`YP7pFds za%#)Cn&3pN!0)8J`6Yr2`>{^1ZSla<`_`#@f(vn59PSK{a|fiDzwAlm?*VBanWrv^ zA0yp2O8y79%6iSB`E%CkV#A%=p?%hS3ix-6<1K0DNpk_GY!dcM;~n=u#Iv@IIC5OS z$esyLsL#{+u-8wS&Zjf8%qGov9w;+s={wwNORYT6o})hP`~mofxK8m8U6rukX9wc@ zzGb^*6W8%JnRD6yH;vf#66rbz3!UC~_xfehd<~QL)J~dzime6^;yj~!DCqvMte5KM zT$ZSA{+(4{r!J_+iEYPc_Q^p}1D}e2o+a_NaH^*F65#HZfl%6O!n}y-O_71Z_8c@K9zI1bu)#`4%s@*)H+6nAzSC+gw)nK@2$JF+OzuN#QX{PK2p{* zb866!i{^#ZUAS=0< z-d|X( z?Wc9ne_O{nPrs4NUK^>bH=08!S>c_2Ji&Y$amIDs6V55^4XAef(7#JECE-Ed)hSL2H(^+Pj>4Z)OW=) z@NZOo@AXvOjANKcIn1WEzCl!AJ#JW@2xq#{`QQ`gf6iX~mbVw(`JL2m^G98@p5)~E zS6yLzc^v*z9`E+x*$$l?d{0)r=x}%2_K@B7R*xR>f8&cBmoN_XI-q;4u7Alr#k*M# zo1qO;#@9vrGk>-BfqpmG!k%^-+lBp#!a7P%aHVo=uv=x(F|}J`f5V3LRJO1ls(Y#&x zy}T{S`H$c?_9F19##3Q=Yw|th$MX@td#SD?F#lb_SM1GYxgM}d_0Ppf_rCHuy-RZQ zUD{EX<7hlpnp>Psi(gt*A1m>a`P1E-I@XG zzxXuh!oIWb-^1o6+9AV}Zamd=ZUFu@<#cY%<0~Yex8~+mNXH#84|R0WWoPaxZLeV_|GBXKycaa$_%Yb#8QNZDlWVb#8QN zZDlQIWMVFGc>n?bQ6t|-xD|l+O zE));c+Nav}fp|?gJQf|8zOAr?e_#SALcee)U#lwVLDig)kkEh-JyMy#k^67pA!w<0h)8#w`>OSdfKgoA!y zVAm|OP$0=Dj zO(bNsT)JS`H`eyU<6bvqj9?db%Yt!`4AHt!zi@y#R!>torgcAf4#s;79{1ddHKO6g zug!yM=ogOpYQ(0euT(j1>347q+Mrz;{^*p}2URe~!%hRZw3}+PXaB7>o18r#$#t2OQdG%WKtn?Vwzf8wu+~pEfRf{zGl)Gw zhoy}A_UDQ_`~EFMn2jOU*l$>sfuh0TvY5|`*f5STaw5RlIa$cA$C1Nxnlx@g2LwX? zqKbGl5UPeT$1rln0$1i90Lw2JJ|SXziw4>u7&p0$oH+1t=N4g<3S)t5 zqAaigVq^f*)8(NO*QSfLjeR!5qIbA1jRIjH3GT*f6^~K~88&){nG;FhmlHCL|GgK3qWgWo!i*%hG^}FpMSM z2h)Jd*e0%yc7<^SLmHhQPZQL$X}~0$V=VE0ng(2+K+Q3vVpGb-Fd9;Y$!M?o)-8rn zXaQRc_N^APJ$8N@i1JwPpcNX6 zX{b_0|DI+PhJfGG*f2gw82x*iL_uBb7CUy-mfV^Ng z+%D7wv~qlgszVomTho=*Pix(`DXV=nmhKAjfmUBGR@1Y4H1u`_olFFw*YSZ+c?C%U zztqs>s(?Rgvbh4<{u*;xTNJE-FeoWYyXlb+@3dBR7c6LM$Rt ziO15}*{yW}`5KRP>1I(Dkgt?ry&}y&IjD+PV!Pxx!p$gMngMW(#%j1bz2K1y0Ny7v zfIe;@_r(lgNCMZ*P$SU|$+*iL+?B*74IA0B<`?kg=yl$?Gcm|mVib-A<`~sQSy<|J z+@d=#4?DN>41o1)94M`CUC75CO}(3E;c$wJ12?&@Ey}{GggB?SVsG~Emc@$n(%Zd_1Qx5l7DTTRm2HBB$8s!$ec$-VE2nKw1Nze`n#Aq4fvmydFyTOyC>A79R%a(NpBgW6lJswC>2Xu zH3ujShsN2_xByc86{@RME-MZD?U*1^szxObvg$crIqu}F)T&9Omxe>JxFAk!YQ!Kb z(k~jWi&O-|@mOzmSrn7vvnC(`q*yx0iVU*q2iOyOPl($J(U4Mg3Q`udYg@+n;?ZDP zZ6rQHbfijPhibA=u%t8$Q49q{4Wle6&qUw{3T(g*bm7Z>+D0Qg(; zz+MLczik%St?L26?+yf()ETGhkDk-kx@*2di@XQfuDgQ*xgiXTG) zNvT-}QWC3`clN|0$;T2Q6s8!N(^wRp5I91X|fmbNOTztxibc4b|4sTB;4>?V>@ zVojr}eZ8v(S<$hh!qKsIRDda+uLBHoeop`?p`8F!hb1|s=S?I>q+g(ivYLjjM$}j# zf6y+WpUTGBA*HKzv(Vavv(4ty!%;iN7ANZ3G>>U?VB2N^VlQV7MMz3B(l$rqT}SI; zw{KR6o;@C2YXw3g=dhMweFGsY7`WVy#sqhGOSsaYZH4M03Ux%Ys92y{j2A&iHV>H) zi`#U8j})d)ky2i`HK<4gPZ7GA2B#3$x(A7-?N~K6W3}b%~jTZ~-szbrL3GB*4!Ajy~p?Fk{WUgom z9#lS%^3^z@}QR!I2G^z6b<>C4Nx09j@EY)MS%#RpjtVW)K466&^cL`o+uUyG6_rE}H` z16&X|rfHm2#G`dSRjg2r4Da1l6x}kQEy{B-F>QbOXbqme1yk zW?-N;pgvhsT1)~l$g1ySN8&Zo)1)-&WDqCj*x9a4=~)t(vXH;RzDzKGwS-}X#!ITz zXUd-~p~^yj2lKy{Fnz*tzx-bm{?QU_NL5wLjt>uq2U^i;)tmm_61E~@`vR8wzWO!= zG{~wS8jsdmv9U=X-tDuROaNKI@z#V`Un>~1;c=HuQR}Fj#WI=#ZCRbG2!zJM<8HWG zt%h>-Aq6)!5b`t1xy%~*vRWqPe_Wmg1F_^)&8S@!w0&`OD9;3L+jgGdYB=+J$jt{% zR?c{*X`-lBR@O#Z!8)7Y2(p41mWi>phc&l$Syda4@hhmq_Dta1ol5^@e@nlUm8<&c zj(*Y1ZfuwpsTpr4#){ZQ7hRmF z5-q!EfX(%#I{TCaC?=g(rz<)QuqSkCqV=p!qP!`y(^VJ4=wjs51D|G?$nn)ifDNro zq?#-*U*qOvbDKzKzYSw!>qK#~$6{0K`+jSU>16rT~pQHXx04t z_f*TP6vk&+$+|z!qV5({R;ib7qPVR+s<`~yl1_Rp5F2a_ZuD8Bn16}am_5}m`h5*! ziznH<`#c9Rj~tRNF;&3n78MA^>}Wg?4zX#K)<&APtN%YuCd;PKx#gaV+CjTbdcx=3-x`6)^Yo2i()SOT=W<9G`cpI1eoGyhf zLIc)js3oytqp;SBNY4Qjv!D9L?JVOIM>0$xFQoQ39hnB?v9q-OID;w0X@KV+Ic{8` zSCYEHb7j68*J`qt=ZVg4+++Y;OM0X&;PGVxx9a3G;kh=OYuAwFs(*UjIRF=W3tDqO zRPs8iW4ljnAj3q=>!{4{ZxmWwfk%Iuz9tAz=H@4xJyGZ zf_4Zqjt~Qwp(7 zv~V#y%1g*Hz2x{1p!^9LKwfw(0!*GF$wQeOK#0k6DD*-ydSHQGG0}fs}<`Svfd?TrD9x3#^+k^mDKyAWRSqP$EE7F9G;8v-FQ-ygCsEayHsFo zVPG(fe%Hz6@N~!l+PYQdiv@j>TcK}pK_#E&B*Sxh4$x1NLlhZs$lQ?(rdEJRnWd#{ zY7KY-Ilzq$&O0LqIH48botFdTx8iE*#vEX|2AmHepK-|CT{%E^NA9;;?l(tp#Xbl4 z)xmkwa)F_gYvuwMiQJQOfmUg%bR!_-aSoX~Fc+wDQh%NWct+*|XE``;eJ(JW zavO4i>zQF$E>MvM9L7ao@77%4W>H7}e>A^9_;-*G&(pcU7%gy=BCm4D+%IxDP|$vx ztL?bYqwQF#aTkd6`?Pc~gxsph0u6pagD;ZQk94XAf2~P^f6N8`(BPo==+40NEa8cr zf%j;#gh^Jq^4vA>{IfH_O(QM<*LW*B17FbMeR*zVrz_9hb4+f#d^e8I)Vp0y)%-gQ zcvdcSp_ista*bN#_iZYFxI>EkJj$W`i*-IN{{r%9%2>^JEuYN-_7~vHiny zM`z%5t#z)EyR$RU&%^x(oqVxkZRiC}kIuYjCS@4sS;(Ka({UD}{9uSuoREf!iP-5MD3gIV~j`j$85n zlj@p=MIKdMyWCDoDVCPvP~D`ZxO7X|<$k9tFtDAfu3ci=Y*Mw*)J>!+9cm>hsjgk_ zFS`PFw*wvgvShrU#2CCH#IxLc-{o72Q?g8KIh=vGk-TUXmby1*nfO?E?~xbdKBVPRQ(cY# z%vPD)xQG?*omnQ%Wp4(vh`f-~pavYlmPv~0s+cJxfbrNMa&8v@DFW^h8E^-}vfsKS z7{o-p*jg2SXSz`s1$L&hs2?67Z^^DOcFKM|{mR^#PBF-<;wq`?qtn?Xc#hG!D6kskBL-C4aIJ<)sB#Ku=L%$Ay`3M1`3GaxY zqmBm5XUP?5cvrZeA1$+R$-CFWMKT#{`?;&!j$#sGGN}f=5sv;m>KMHdjzsP;K+;CI z)`4(Qg>8?OIaHbTOtAFs31J!zt}NsihAS%&E-H&gD{8{gxY`ckac_G?O()WG1_5?7 zs+W}<$gWgK*^s{QxZgW~9gU6%+4T|I7q|Ti^KCK)Cg<%AI6LKw)S<&K#{xJ`op|^l z^Y644X3I2^x4iozbwvSghvUpFj2m4>PE2j-&+!4=+@2kP-u~ElPC|0UD(pCnPYold zX1ovRm74|UAQPXHhC76phXV0{tiuDBsPMekFbeI^IN)B{YToS_X~_sx4ofj!JQgtXJ<{=hD?&4lV_WZ`SU(G^Jz4O~>j8}PsIlOyhIf4r z;JD*}+(&x=ml7g~|7gV93Q_AIW)P9$E`K->3dG@Bca*V&lNbGryr4bK4r18Au31=o z9FSLQ)tC1{jJ{q++V<5K<4Te{Nrqz;brGKSh?R`I0JFpi?;McOqqrMpOWL1Ivn%UQ z#~On|{?U;x^d;zgq5TQEo2JX^|8HV@W9>Bj72{-A4c`6~6NVv6W!c~ccl{#Ue$}v5Wu)b-+yhOs5rU|zs z5+2nFiCVypc%QqZ2l&g!dB(pXh|mD&dPn!Z$kMewFZJ zBH?G9@PJDAE0OS*PIyoyc#h|ro!)JgrM&yFN;o2s&`u{jq7qJELbEZbzfasfRUqy* zjO2bfxwVF+nIdgWlb-pKu35-CUiZu-PCdR!&)m4}`J!Hp>kn-GT3-6AX-x!X7H8pf zM<9t2O$9bCm{Lfo<*Ts=2152w%P+4tzTCE@fP9gMMc?ZYO_g0^O^`yo@;1m-giokGN+-1qC1XhXui}#DlVuf8CmAYXkHKd zT}E3&Lknf;J*Zq2C9`#thNR-DWaI^^9L+kk_aGe~%~x&NutA5e+P>PngG5lGGMYEB z&jngUvo@+~E$yQ*EqI}#zYdLthUUwn#PlAO5OWZFM-EJ&nzvY5;OM{81O=pOp!xbe zMC($jMmFsh4rf!*Mvlj=$>bWStAP|bw#be$gU(mLqFv<y)Ll|GylP7MK*{8-PgyL3xQGP*rC>Hk?4YK0CnqhSz8^(4+3b1uCP1Cmv=v+l1 zdwg$Q5*Wosb|t#82-)GW=q7Wh4zSTHG9WcZh)g;qCkn(_+Dd&sR)07&la<=!SccK7 zF}u#zJX~*{GR|qlr-*k7ULG42j`~Y$SYtthMsb9kkQ%bb540|y(3fjo#+61+v{-o} zC)!OtB#`+9wU)0Y5V8{i@RMQW)B@RenaH^e*tgb1wjVzm)7CZ#i9|Ll7!3Ph)HLP_ zK-`}lM_}6;la)7yZ-j)-kUf3~hbFPuAf+3|UoIoN77gz1>rAPR26qef5wgeYk71*C zqnC80Bs3(IN>$+KM(aX6SS0;Lb{v<|z(lq{I09p&h-Lg_ha(uZa@xXVxcx2ihulDU>_w?3{?INKjWRE|;&aSgz%rcA|nJp1}axQ~$ z@!d)4@(V5_PCF}6LlJ`&b5NvOnwPr230%%t=T zw#UPmWc>YXwj4GxsuDR8zDX^zOvV^v62P1gOjZ}0)1{VksYYV%Lemj z2STy<5GV0vkNjpqnd9hrz_+(J>y)b z%q(OArF!VzmTzo4%Dw%3J1EyQft7~krWzFkc6}tOCQ}k(@)O>O@Zy+v(i?rjO&--R zw`M1?UuMt}6&tn3+0mFij61r9ME!Qu_BYnEQ>~9DwrDKcY>F^e4SQMs%?{uRStZCG zgYEL5cFqj6W3dBe9WNoWk8&nJ{w8dxwfzArRN^0F`Rq`<5iyh^>iOBKqGl+=W;$su z!(b>YX(>t7DGR;jcpz^a2L-nJcD<0OoyP-a0awies3PM%e!H9JC{CE1FUUz0tuf}} z(Fu(aJPE&cP!`TKj6#lGW*Qv5{6s4%ftdzPZhHby7$8-+#zY<|4oYT9W4c60j&Wwn zblCV4WLmi^jF~d0guGxlRBgxNQ1ef7PXNpTG&BgcaC_GYKwiX$c_MF%P~jME5OJT8 zPVA&#V$)j`rij zuH5A%z?)3*+*<-H(g}~ayzi6%t}cN0;}T$67r^sP32)5=P=Re-E-azR|43I>H1obyVQ7ylxFePz|PlI6;RsjtL8~2qb0fpfRNqTAONsb>I zq{D(|aBtuNt^W=~(c2s8gu0|rx>7h5Q%!Yk&<4ZcGVun3pCNOoFaT_j-grGJsp}2W z1AUm#zd`9ws>h9D;putoE$c#;;Q@o6Gv|}$z|vt{K}Hl0N*8yl5XG8G%LjC=JtXQb zPB4l!XH!0qFP-03@ej&~ zH}H={ve8!6<$H#g$=$qwAO;CyX>XvNMto;@AMOoUL~QTP-C3;P#`c!@Xp6<|2&Q3b zTjlO4E^+r17u~(s3lxgGFvUfGttCVGOLHD2N9tgTgzQVCi5SY)qT;OcFn@~ zq==CAg(f$HWmqN1SkBY_ZPX-F*EAvt5S#pHtNF9$#xi26iPKw1DbF$Nb9u=CK9$t{L z-FY%#8fxdm6Qb(rlNn4WkQJuJ_eJ3=Igg~}H$?{~d{k52}?zxD=xJ{ib0 zN`YffNsb7P|MYi{^C^BUcIvCUrn@C5rprh9nWyM+V5!z{E%#nVqyikQ-R-_-or#sCqgwk$5&)&`~3}8J6 zp!Ngx;jMk1!%KlnbQR2Z=XNaxhI9owpHa$sm3Kq6PG08rzFq=M=nBY7;u${hC2@E$ z;OSEeT&|I$ykkp&LB)JY@Z~XC^VQ4aR^jvIFy7qw1<~Cciy1P6s?|OMxTXtE~e)ybqNEho27QK2ZuBe>zJ{ zK#m5SC4f8!P$Gc5d2V#ofIdJOAVtiXjjEKAs7Re8l3KniH1ORO;h$PvI!nqN+k8& zL6#sJd5!&jqIZx@wDv|LWIa0LM zlJn2gf&5@SRtg^Z(Z~xq!{fFY%wr7ywyWm5a8$9+5zPgJEiTLo9U`{%NAM?T* zT{3z|yvB~=dt=)LStw?1GE0JS{2;9J6|1+frn!i^%wegl(}g*YOe$v9pNwBuo7m*A z6z)%9K1PF*9BhrXhp0{fbMcbibhOeX?SG|<#eMD!r}&CSo_3pR0UKPOPj8LA)K!c7 z+~Ex-GSB43RNknHyIn&!n7H~(z#Jtd_TfP{+rg|e>6kEi0jRCH3&`>u-UqnqFx5+} zb1C{pO|N&sb5-gKqE0GT?Tal?a(6hv|5nhpG80aPFnse89ajYFl?Ez|Wa`UG&L) zX97jxvAjT=BVKelDS~@lXWnfh^To4)E;9F}76|TlahAXR8)Tp46F1)L`tEKM$GlG# zD_H@*7GSU6$Zb+5yIic3PHE==<_U+hYvAx@NL?ITMSGuf99~JZ8ry_7q2%6Ke*UqMX0G>xLxs+jQxB43ovI1s~Eos>ym%*J!RfZ zW&jgqk7tA8ts+lJoaLs(S#D;N%s_gq+-beZXeME zU#m*TE{#~ObR5|m5FP*Mt$p>523#e+@-m$|x>JPc_+0~(j(-wB9sLPVI=DU81>i2F zqk<5Y<6=k0(MPH(RXS>zP90H-5FMv!fYNal0n{;_0C+~10lhV1zS}#u47h1vMS%}|2-ws2>ba;k{TaD;959ruo#O>i^^cy2EPZq&y8>h?ZT25@-ieX0z&uN26A zy$pDj5AT%$?@|FWek=p#qqVWbdstuKOIjr(jcOUzCHgpBF5HNnt<+YyRosOtOFXL# zVt*`U-zInRuQIq^)vgav=*)m)l?*42>EpaOR>^F;-iE!(;AUbD6xEDKejk3V*;s9u zOH7t~R`<^#$lK@7aBU-^%Fe^1i?(jd;xPhWY~TzCiA{ zzCdR_%6O4+GbRqUrSm4>`p zd?rs%_671n_(h!dPG7+Mh4B@~cgD6gCVmyG4pbJYi(>)qbSY(=H{u$~6g5ZNkDZfN6+8?ESI-Ms^we_`uP&xOV475X7h^gsH+-yDNJKM$jFX$(6(iO&RdEvl3 z<|xh=VZM;Qet_AVoG5OTmr7kf@D&gwFNoU()j-q)a$NX-5+Ur?;3m?s&|9CNXnW1eIT=OnXd ze_!AkZQA`V@6UaKv-{I4j%kdCzvFR5!*fEF8@si<7hK*` ztK5k62Ryy1+}L{*a3p}sy@RXVnAsmF7+K{83M#AkZ?uYAxEs5Y`~ul&q}C<9Y6fyK zrfEASx($A$O>{3^W8#kf&KJ2F8LUs(HBsL64C!JRDp56^kF}AL-O_aK>#v*6^L${_ z+0(=gDaQD$P$@@O`s?==WT+~;R#|neSoLYbifd)+r^TYxSk7nk5}c<5%~pbDi=gjV zJT{xzG9&g|LhfuO*OOW2#<#ja*SWnX*16#>2fTT8ZkXkO=d8cn_}@|LXH90Lc`y0P zja&k%{&M4#a@KdE!c$5r#~yGiZ)aik%vE;H6}w8y`EhImbH%QKBss~5xiXp>Q7(?} z3PaKGEScv`A|&RUXbb9iiruo0OULXoT(51uQ`vl{`=T`_I-cjm?44qB=kpwI-6@9Zm{p1Jbn4g+ z+1iBFZtpoA+oAA0z+2X_9V|W!>evq9^MKq7I<~`A2Qexoc5icHcfGQ1y;wIbVa<9K zV=a`hF?4T7xeDD)O3o&cGl!*Qh-{J&S(FgFNs0B0de*?nx?G#x-r%zaZf9}g&ly4}C3hU4qES(24A2$LQ(LRrhPRHdPn5wORL0SKT`^q&Y zRt|9D@&&Q}frRxhh{-xGRU$VPydvz!S(5S2c}o&}7ri3K?{?FclosNck`j$8;Z`2q zt8CgUHtkE;uvdjmOVS#{@lHq3yGqczBIqL)j^X&O1i;q`x$hoat_rGE$W+GdS2FjD z%%2^Z`$Z-OI{w=){__kJmvx1q=oW2vqH48c`6o)tC!*!>gxF6+Y{!JyPgGDPT*3{E zMP0E5{gkm=(hYMMj~Q0tKKYe{&I6nFSk4@|6%5M0SUZNhus{zFzvAgg8~7@nljMc8 zB1Vcs`G1nCB*jVci%5k?aYFPOQhqxa7-vVxJAIRhc>_5_3HkB0KvoO{%nNB5+u)DF zyN{57CVnOniQ41Dtg?__^G_NCnAbC-<@4E*IDVHOfv6tD;VP#q>==GZ=d}9-B6kz1 z7SbnY(6)|)0rP!w12Ig^_++Jt!oeH~elEO9T$^#{N)u<0$9CrK2mGSj*@6u33H^Yw z!GQOqe!$4VKyFb#pz9D~8>8IuYTrPJ2Tm*E+}5Y=fn6)N7`Oqvk*Ss--pHhP`wZc^ zTXN~$L8L;YX!Auwz?Rn)#v7UaH*up()Q;5!91w(-@F)S0? z+MhWT$djuhu*Aa;zR^Pgljm^r#^6@5_$k>)@0^;C_%Gv~OD*ls+kpErjU_y~`7h_} zdvRCUf|yn4x8fG?uTR6kD?`=U_kYnPKai+|B91wqAIWmlqGAj>pG%WgthW`kLO$D% zQqB!FXzoxe8V~U3fbB;gCOmXLVCEjp4x392{EQk;B_A+D&<<6{Yao{|{Y6G3FfJU& zMFbo-49KeqgyOhp^WN4tn`EWZIlLxn$7;A=tDeZgOyczjaZ(m3D;Tvc|Ab^~;ML+}Ztr+zK|_1^s{-I&a8(Pd}gs`Hi*axT&Rj+la+(Rc|wlM8!$H8M@wP7`I;r zoLiwPZiajv*OTJnp-_`ZDUa&(Srq^`bt|T!U?^(FTgD8T4&jW)ED?5N1sH;gSXlu` z85im@US~)lH?WYBaJx>Js}deaBy7|POH{%WiG;^=!ZMZc0uv7OSJ`ECR!`g5}BA)wNXE&3MhF3cIs~!tOM-$AB|fAPd-O zu&|>@RXUW#qRDL9&O~)TE4VSk0dp^##TYy%oC)Oor8xV9b1iK*59e9#G5APW^T|>X zP;iWDI?t0Qrn^3g1AFKd3z#kwDs4sp^pT>D9>IA~YJs6RD3Wf;nC@c7 z#Gm83PV#jcAz?932rr2-xIu_=5@Ypr(D)HRzSo61p+7KDTYsO+dv1T= zX<9#^Kkxw`D*6Lo@ZqBVzz-vJkX@&KtJY=`32E!?pO)So=>CF!vA^@Yh34zP`b%Kadxe1>j#r;K!)0_aXokeo#2#R66FKH>2#wxIj5MYo_1&D-7KKNEoIG&L9oI#9z(QZ)fh-A$@W zELX`7uqe@RIF6%_J2?wa(B$4U*;f+?`f)6oAJ9nYVMl9cpCFCmmju5`^E(OOxKMYz z=7kJ&XFwVFJ1?IH_!Eg77@5tN(ER7+z|j|~xRjeuPa{zYMVxaXV8&^G0BvY{UoxhU zF$QhP7%nzRX>Qb3w-u`^9jnI*!X2LwQNPNj=j(0xWr7EBRFg{yj$UUXP7C-$Y$UF_ zu!UO=v>2HIR#OFd2ostJ<7CA&M;M744o5K|lTNfl{vlPvIm60*PS-f>7>|s}NoWQ`R+dIr2I3XGBy1>u3Bu#i+?ZT zuP1Aac9(`++8o5RrVggb z9`{_Gx_U`gW2zOJz|4cg@xcS(ac|U^CK5CT9`~;1l56>0EamsOFTG2h1Rs)Yp8#|j zJ55(^2qpt!>cV%K4~ED6t^VcfEvvF%V0-cv>&eH^(V@N^xU@jsTD0X@;LvBad211` z3TwPdmNVOgBH>6}xpPr|w+jS;2 zG=M)p4&Vd>IARp{5bGbVR~4rZm!ZSq=K^1sjXQxZOyAb9fkm3*y;TSYdd1g<*=S2rGVIAQo3oFghAJ zLEx&TJhrY5PUei`5l`+%%C503KaQ8j0RF)(jH&XHO%H`5FjhBOlU;>1%^H!MNgsfn z;c8k4o~OvJ!c13lg-FiN^=>(Mto@}<+Kb6mxaW}SeO4UCqm4G_R22i%nN!tGJshmW z5e{#RsY$jcvWLQ<>Zon|CjgunNR`r94^||?nM1>C_=xipCgXQM-<(Y!|DuvbD>2KY$Hzr8(8i{6r=>ZqADfU|g4! zkpZ`gCv2lOu9wXUEsF@+mOl`xRuhIWW@gB*ivLahIj?T4Z$+lNmw_-aWlb|5y=3I_b8RwP~* zwYkLt#+M!=CuG&?A5G8p;agAhS*>8Gt`^1}he@Mo4kP_D-vTg}CKV?~U-Xb2z=|xs z+EUG`3)R^5FjluLIm%BPVJBkKb;Bw;51m&KPw_KRbek!}!uk)sc`8 zf-&u|MgcA0D#lw87&DWA&1jm{tR{|GhC~v=;(4 z5mZXYT-UuDj0apIoW>wM7LWSEp>aih<+c>{D-_Qv?fhBMoJ#)OrPN3x_WZhV+#Vh- zsVFTkhcS(pDmW+5WzsiRBoka0C2j?1@tS}mjht99SU2^M9l$Y+fW+Bt5!SaZ z)Z|A*3Yxy$R8wlahv1?^0Sfpd5xp8SC|doD2u=F$a#NWk5B6oir7L(Hf%*u`9#;%+ zziboPEcPpn`h_C6WUxEs3!X`(Uc>Z+^63-0E6iddjF5)4#LC{})UI>HGS3z`N=iVE=_c?t|9=U#m~7rX_Cj za@W@>Ou-{wW$%Rs=Y1~Z$mpnl>rEOL()g4AEe3amaUoydFbjF1VHJF&djA_Rhm$b| zenxQqMI6|hVE+9XmS`2Hw!N9V&Xh6Tmy9KsGM_&_uFfLb{7M=zgz=! zxfl>%^5#W;Nv$!wmDd2LT?}-NUBm1u|2aCpCHc>D@?YxY=M{`e`NPTiT@An`I)B`o z*8ogq{$35hEl&QRPM_%#{dcA2pP|#oN&an4{@0!S3w65A|50lGdv$ufj~oxjs1N#&>g@9Ol+C4bLLcq*d-80h5xN~i1m7p3OUI$rtzO38njlYhFC{}`RF z^Djuv-$SQgE&10u`JZs|m+Ew#|K;TTy&Hf_b$Wy0wHts>C}4a8@IObuJPo)<1%Np^ z$pIAbfKH#J1muhcL_n|6+Jj$ffELg%S-`{wp!EsL1CtH!9Sy+6qXF-_1|UWOS6u@X zYQRoI8t~PlbpxI;nqlbK+5nuZA=3@-{sv$TW&F?pY$ZhEyj&w@8xp9`QV0Y6J!)a6 zF-!w=pnsEU<`|tmUzwSHsW!9YrBL0>Bn{AJzHq5F^UX`e%!v&Eub^OK&_(^rk#Up- zc(*hFrIr@9qN%XKmKJuQl@NBHh6KcI4HQAQEpS9UqtmrLgDSO%3o0ohwGU73_^e;AHwEfI2^%rtkNcbtxWz} zO!nE@(P&D})!GG$QT&r#RMw#rYYBZTmYPL@PMK!6zs&s4| zFOx9`@i(Wga4i-Z%H4k`+y4;TORKc)e~2w3NhZ1b53&8)D#vz(QtkH+ZBK(s+V7Go zK-%wyL)pUvDwu(9^?+ioOJa4di?O<$21LPisHItWm6RSH&2>$`*~IbHjwy51hkjla z=E+l0wXXTK+OB!(?Q>3b!i@(yNj`_Y>Z=$t5j5lupAJT$4RqML)WqO~z7E`}0b~rA z2+ZO}L2qaxFe;JWU8NsT56(BV96^#h$zzy}u}af&9+Cr=8~moVtM%|?xxDb}In8%) zaWWrw9cHSiCOzFXgPR1T4`?5)6#2aaj=73Hh}2qZLZw|A z4snj{2E3W3gzr|~*)76{iEv=Ii<2B-Qo4iKEgi(%gtpyMWY$bE-V#eT(HT*@8}3aNDS^BM5nl^@R0KOGV zj~FAS;5$*BI|lHqn+QzRs=sr2cTWV)83W{gI1v~qSD2=#t__6xhJ${Y#JLf=3;BZw zKY%|(%hh8XUn?4Uycv?7x?S{lg*pYWgW^-9H_qIJBe)4a=>u2mWdy( zGu@oS`!=C&ruyP#Gnl0w$LbO;*Cm|gmJ+re3wZZV1dbc4i&`+Y*>|tgZ$|BiZSmmD zqAV2--0mI$ZWMzCjnxx8!I9r{kvm3CE_FXhY!}}`NF}V6^Yrn1uuJ4O|DEc7~m_@*y2tMb0chBWeixEMu+{A z3^u`)X>5X9!%p#5iZ%(vHS+jgm>V5CsX}6{@J@~J4KRevaL|wYgxQ-+>5eLO$=9fo zUmVdPd1XY`#;pQnr#VeS?@p6W^HoCGX?~wT+^i7~C`86(x?AmX*+FZx%91tPC3qlT z`QruUj~B!r=U%4#0lXmY7#?-XuV`Lj6;-Y8)ik!gi|T}DMdNrajeWu@GSpUvCF!i7 z{BeSaVs{z`odJ^Jx;S1J1@+?ra}ymFz#AfkFPlNF6um2oN-rmer_|mNIW}P* z6BgqP{(i}ue+B)2bPlgSP`82nAysg}6||wQiWi7X5v#_M6SXl-sB5kO%*&Z=3>wl| zj2kG4!tNwDfLn$8CUM^iM-_2}WdDQg3vwH^J|OJED;u>wCY=7{L~U#n>OWTk=5l5m zg9k-^n4GuCQENgE$#(N~SJDz1lcVl-dr`pm6I@LWyWkIm_ZE4)zAbNzb8G2U%($Dd zG5B0Shm!@Ee~}r$|AhH3G9^kgyQud0hllRLrc}|%G%+rXK>E6+kfRC>Ma%(05-w7f<3AjTeR;PRCPXhi( zB;4OL;phgML#;b?!ZxKfr$KA&Igtp;{6HgKQ!=Y1fz9k&o$zJ4G_&YL-H4`5qQ6^w zg-7k$@Hl&*oxFZ_D<0ItwFMc{!z{>P4|Dq@j#F%4fviv6PclS`QFi2Hr+KMVnAs;u z%v55rz)zSAm?Owzf3i||XHBMUVt(yOs;ZV|i1`C1Yx6Ba1TjS;Rw=~g4q`45f3twY z)H>r*?A8T*UKQ|pDd26Bbpf9j>ozEoE1GydgG;S{BnqhzFqb$5dPB0LPhmZ=IyPu) zUsBc{HAR=Fa{{qVBi>SoGaN+!1maDNct;^Fa1hmkV7z>+5$|P4l#ZXG<7FBVsXmc` z5|&|V7u8+m;3IafBkqP=XNu8w#qfqj@ot!H2x?*kbIK=MmQ(Y}6+f4Yi}ezS1<8*I&KhT)fhqrR3Kh66w^I4 zZhcd>>@T=hQto4l>Lc#G%RF9lGVtOYAou9WfM+h?$({`C)PV0i-m@nIN6wYD(c(K&Dxo|S#|k{JKX!lh zNKE|dVN9GjSGoUJu_J#j4_(0cRSbs?0+ptM;8*bs-7+zY9bm;=z}!u@1TaJPR$MI> z9o(Rib~GOFS;5{`6n9{VAs=^}v&62=S+r{|rKAXvEsc#kR#xI({U&@oOaGqb<5{ei zrBWvTo~5E6rSHln1N*e^p33r8P6l3|3*^Qo1K&_ts^il z7q9C0_Gig}%%4c;)-)j`3GAbK>x3_}q>rkfr~9ZGM6_I5iI`!W9~^2$?GRSsVcnTb zZY>owxiu?jNusoqTeIuuH(4>}v}OgYbqX<8$SqWuQkRY16@6tfpB1sO8aHREU|6Yi ztrT5b=cyoF*_t8uG&M(ItZdCUk`tsVO?MY7wMjnQC7|3JBxLWD{Jn1g%%OC906SW< z?HA5xOJ{xu)StH;kmoHrjZ=P)_MeL{OA)5T=2B6A!*7Fa#SaGh*2utPil z=hof@lYz-h@-X2Io$$L#xLy+2us_!cn_El6zF88O;}@OqvC6T635Rf}Z0TZ4!5VyT zD39K3O6}cjvi9ztuRMCQNsr!7YJ5#Ns4_ycUz|_x!noN?cC^Z(9euMYb$7Nat64;* zwOFPb?^dOItLR=rZ82c0=-x~!N{YJ6ZgO;Q7246Qu-X$_l_wZe=5Z%yVdG7_KZhU1 z&xpu}Z_*cHv@TE$d50+%Vq`1;3V0#L!3v>vL-vb?>mpc(AGGscRt0!j3h<8w%3Uvu ziKmgO23|IoFE-I}q0=*|RG3HdR^)hX1aAp^I#|F#wZkNm?h$# zU*wprXy_S@>)Nn;{gKKlF}n>9qj$I&FuTy40Irv_4Qm$zW+6E~%xS~lY<+eyZAlH) zx=_Fu_S?hdS5Y@$y?&+Kld$C;vE}W>KoM_iH|}Zk^Utk;qAGq1CMX$6825;3m={rR z98U;z_$};R0*bX$SYcs}Cri8Q1<^9|7Qk#EJB}9x`8bjA+<9di%+P`Je4B!Yu51Go zJi&iG&t2IDHxvL_0C;!T!8_U!s<^5xY{YCm-~2`!=^Wl@!_MK=TU6)phS>BWsVMM9 z8@7ecOPsc#Xs0bGtZoZ$w2@vRFD_o0*p}_#k|i9malG}mI4MAy4xQMR{=Ai>4Q#O%xPv5>X5I_*r+nM(ol7P^olu&+ed@TIJQyUAqC&u`0; zj3)CC-coMbga_NGK6FJ}anp*nbkm?^%1tZUGWP9d3129N_Qi^}$`>3pw&lxl$uh?g zYs4`dNUM3Q``R+Fx04aa9U}Hc5;{t2P&M9`)FYMy<~#J1tWQ2HCXQZC|NTU+7W{+= z9+mWx0Oqrwy)ro#U0z>Ga^!}Qs%5x1#V8f1ShvM3ZoHVay#C|`}+!~ zgPGipA%VQ{xV{~uHR}!zXmG8tkG%sh|HXm?Fh`Pyk~5H;ngHguVJkdop;jbMQZ|hLL~gm z!bgK)O=4xsrRU|lM;s3*^$#fZYn1v2ME&Ty9Q7(S;g<(RSNJZ#{6uNrE}Yx$ zqCr0@)^1@vPFAWxA*mu24G$+erVo@QABZI%By=k}p?klGJ$tS6R3A!p{Ch26x=-P< z3_cQ0fSe=9sR`g?$x+W7!LX(#u9XVPST-4WgumUg#QWG}VCGuD`_yD$J|AA13@lme z_~5Vhd@~{Ujmf}DX3uzkGVmxbNb>$Q8F(^*oOT#P6v*&Q0UkrdSmMo}0=z_-#Z!Pc z`M?R|_tyfsB~yUUDKDkr$S#!;!~6Ea)tu4A$S@aROnjtaSp2v5LgENKPcav8*2-sct* zxd{=Mi-^2RT)|uTPgxIjYIVpd0P|ecqV%C^iEq1HokHjWL*y?osGuhm=v6>tf!qiS zxivOu^G5*|7!p@`0W6d=CWF`O-vU@>(2P2o5uXD5N1L(G@GhJJOk5A-uATziOuu+G zPXWRjvDonLngXmM;>{_*MnO=<1dUj(WIRL!WxOH?%9y7Sw<#GP5SOJBgOPgd-A+9|FGu^qruwrymffv- zR&^7=P*M`&FBp7lgzg5+%@X%r@tVlGo~$Q?Rg68tT6;IxGrdUW7gC8b#+KST3o!hU@WIoEF8`)yg{9k0$=4}V>4 zL{2zAiJe)>SF2qH53R3u@tDvT^i>2{?P5Irb~n^dX+`2ubaQSw?OGJHL+BXZ&Am#)m`zPIOrQX2I7!2_hUYeE4SNV+p$9e5aLQ)UkQyeeLk0?-!u>r} z9X_J!@DZuQvo`ZbeSk-#21ajAs>5d!SJifvI{km8k8TJnGc1@I_=)B_IMr)5hRYm7^Wo;KtCfPx2i!@uKPS<1-iq@X1 z+1r)1%kFJr?RFYNYX@tXw)Utk+S)U=Xlutdv3Ay$Mr*IuS$8UHr)x6F4q7``vo-2w zO(vme?Q+fDsjS_wrHQq>X$-C9k3sQes;%vEpSHIAK5gv_O{~4;K4mR6yr(rhr8I24 zuZf2J6hIAMYnay1<9@B-!uz#`_Fa=}Z|(h!8uGiU+IvQ6cJ$^z{hYGn-3OZ3;eJrJs<|4b?HKW(wqpVT z?BmuqvE#W1l^yiuHl6h)rQw?gn`k)VA+6y}4bvLVdq`^t5kL)pHPNv0A*G>mDsXhM z^5q*Y@0C-5XPASxXBQL$M*uuI#Ot#=J`5BzbA7gWt9L?%^i%^hnc}VCn*D|o3+qU|{PQEkVoP3#Cf+GxioI_q9#$G4hHvEx_G-mC1m?$IW8Y@!<4 z(W;xOAZ>^HF>OcQW7>|+-IDz=;W1?g>-Kb=^<`DJw=xIowyax|y8Y&{7V4G}ctN8K zjuc9^HnGy)s%wpBos#;C`?qQ<_Y%Meytavzh1-;s)NqT|uv_`z{B2D%)NRum?$$8v zho`n_4POvI4ZE6XIOlPtfpM{4XMIi8$CsK+sgEBu`!!{U^>`CIrarFi_*28Q9dA6Y z?f9Jl+R?Fla(xVXLhMK#vE(O?JD2fpLp+V?8OD-K0OuN_wU<2s6i$F5<~-qy z($AG|7SGhFKv8#qnTB}pp9*Yv0`P8|3cU0Lko(M3;7w}xyfPIyMA(kn8I6QTDE?W`u&S%Fvn2lZ_!(%x5!4|Iolnh z^%d9h%S#+5FWSyk(C++3uB*gDg5FHtDDpyhSWpj(_LkL`I=_?gtb7#H72CA|+ePG# zgaO;#Jn0WvFN$G@P`kGSo`z|FrMo-7pR4z5~d8m~Pm?YRn+^IbOTJ zL~wH)+@c+v2kfrF&k-zgCu_McD!H#a`1c*TNA9HDl-Y;I;Hc2Y+3`F!9BVA`0BEbu zhPP#aoVe3*uaGcTiu0m2j$-oJI|1`yvI3C%##Zdq{_eo!x0t+}$syLk(d2z4_Q3pt zY;sQ`_lPI?1=r>@ox7O4lb+;vjQaQTy=BgWfcYsIAs#QOBU7;s~Je(_<*8>ohGGFwTSgEf#Ym_VI@w%LZ=$CK|Mf1v> zEh|iXkPxlU{~aJg-EHD6;{Cq6(2<#=7BKCweJf0Sk;ty+20iaj25xaoYo?@);$ktp zj9G>w@UQk1_yfHb0REEc&i|1b<4_sTI4x37S$a6jx!h6a<@{#5X8?e4B`qx_t&d!c#$1^xDMLc`z(7c8 zYoC%fI2`I1l?$7g)486`F_arSE|8RMsb$a$&9Y}9CXj~Il8mxqeZs+@6;;Wpg^|8j zS=EqQ7`Y){7t~BKnMR4kS5p-Z9a2%Q%uTg692sa=IUAmCHV?El+++tBArn)j*IM=Z z&?CFcPg|v!RcqDDu~H`9^YQbkx%nGkiS+yf^K$ArCYc)=Z~1fTfpdb1%&ET8C+Z~c z+5Wwnv`gi!&1 zT#0b*H+0HHNTY((f-$wP6$py-^k&Q(9F9m@Ml)&jrzAF4W+oO(YHC}dPNtTGCP=!c z1<@s;3F;<7mOLv3B&F_cR|i7U?s%(Ps`CU=7V;+msjWi*B17(Rq>NPm2&63JPXJO2 zBY;uisK0l(F66hO6GTjE7a*v?;RA4~ok1w9s)_;bTq)^PW3kblF$S~RE2;i>Sdi)oao#GK&idrkciV3DWc5*A}ZpRDty}m zl7{j=Kjvz8K+^ejb}TMwsZlc|GR%(fP%ASYc0k5bb+nR+haZqw5_HZxGX02@^l)To z%&zl?CGmil3O7rXqt#;bfGA_iAW2CLFQ!yTN^0mZWk^+(q@~s?(}qTEpCqOhKV(-| z)C8*H(i+nB4W>?OutH6)D*g5|xsjmBRi!CVc--wjKPXBqZF}5{URE$Jp*uIHCWOU& zfq(N^b{_uPZXBBlrB90Jpmm&+akb2>ckZx4a##VY?o z)g{;ZnzQ)~`tcB$;;wY$p+KyW$e}>2lDUThu}(G~3Pfk`IuwZB{`OEHy1V_C2X|93 z{oVB-ph!3tsCNS8frA7J2Wdm}FN1pAL$yfGYZz$98*E{43IvU}`$p?R@j$J8YHUIb z9qQ)*w-u^eejn`t9Qu}DX4{nxG~V)?B#;C5SZTN}6z_Q&5HgnVR;0^i`s(tEle4fW z@hx;Y-^s}zsEON$lf?}V$IC#R_`u2%Zk z7KE15IVC~vJEadYn-?`G5b7JXY8!PPtVoBH7KjbAe75LoL5|<<9jyzD33cx#s7;^$ z_pIg(bAUZh6X1*mcinl*-JksKZXR9RRZy?prT^E0_S#~B-ShGDH}k*lEeKP#%~|@$ zFW%9sV;HxOA`l z+$Ns-TdhFyy_XK8YavDBqug5Om#GUqzhYc#7&+sC?$?_w0Y`+G560|dWW5|CXn3AF>m;ju%lcnyr>jU47_1gPCMK06lk77YjlgD`fv1&sDa4)@@K zo1(HKHjbRt#zb~_ERJNIG!`YlptRQSE%Ma_g8quQUyfF6Nt2s(2Q~4a23pbTaWG~# zhwuf%F}sf)^F;%ZcsLq^@jhYXMq@zbToc(E;SWFp5OivtC%P4KQ~Ugt*PZ^{%U`qU?Ur@OT*a8AeVe(7DV+PDtHdn_Y{C)J}%9WlLa;ku`lT0`!=7b<_l{O+j z_nlpdZ7xk)Hmw&b1ij%UnMsJPbPd@MKp)MY*_nunihVd*Q>zZHn0Dlfs z|Kjs$&o;lTi36?E9rI+E%DOAWx+`d1^|Q`|?iK9PfQ-}L0;YhI!rtL;0g(jYTD83p z85h3=OhpG{iTCQafcq1G*;3<429$bICcZCzowF7{XFFBdv^MqfLTUnFoLZjaK`h1oUz#IrZ+Ya$YXBrvbTWO zBw_7az<+eYR=0QCTflEjXsiM4fKvT?%hU0Kj*k!BMxifW4}9nzG}pw5FYu}*o@T>` zV#q~gh+jSwzeHbf{PLmrLiy!Wd7kq^Gd|ZU^|APCai;SB=WavA;^$I8bfJ5{5HXpz zzW{iie+#g6nZ9s)KYR;Yb$?u%QnKR zUex;q9_y#*X%u zGlB?&Fbf;B$L6QWeV6mo*hV4=f%DVY8B<^}jQME{VdO=|<96X+^Af43rWTRnQ08{Q zZF&hX&pw@p0CAJR-*x~u3E=0K0C@g;lLtezCvHkB`0FOFNFKyy9e=as_fhGX)oD5a zSBq41iHye@(U*C`F2*C)NTJ#n?$S+hjR1S@0?dnPpB;@BW4$mR+(nySyU~N`+NL#W z-Vbi{;MHA#_sbhS_>vE4H+kTGnb0%$01Gtqt~Bq3dw{cE26BCSfS4d!FYw?VjaZ-N z?XW?EpJSZi-?PaMW{(`m8y22imG99RC zJYTxe#sMI%$2U3-b|`f_MBN6e8xQPA>y~BWv4oNx$x3!8C3%r3UJ-uUD~yWqnmU0L zi}Z@%dcFdfkJIZ_cv9e%4&X@vT=`0KEj-m?9R+iokLb6YAb3lJpi3l*JtF>?<*xu; z#$%6^A#;Sep7db+~+K}>-84&6Z){Q!1AiN7d}Ynm0v>E1Zz;pZcj%!%pJ zU?--t!7fY4oR}_cRP_Lw$cw4Zh3C`Rn0M}$x0{67%ffk2a{?heC5+$62u83po#Ts) zSNU?N2?YHdvc>RZdbc7I|00)0KP4KEeT|JPG!Ad3^R4^TYe2qS_hI`nL$2e3`4P)m z9gc?U;(?G|7LDTb^dE0B@sHQVA}d}O^WnSni*GW~=XG9gLwr>T->09{(Zrb785m~k zUOeb$^QV=4xGv+e1tz95#WVMfHaN1E>QWb^EBXXYKavj5xIMs0ntndryI>D+i)383 z2RK6~yq)fSU=Q%PBv9f&oiHsONNXIV$)}i9Nl|r}->BVi1M)erJQ%1L^A#v*K$Rqk z7tVCUjd)i#{U6ee!m1GPgOvZ1*LmHH_R`PdrOa>1YvR%WiAUQTZzNobpVMEv$;9F0 zu)cnj`nu_jX8HwHAevE(o3LAtEM}$~U3{1&ftLBq8~pKUr)FoS|IjrH?caI>@I1Z; z7@@s2E8Y9<9^kV#fZVV407t#a#zVwtjhLelJ>Jxa8X^wx%Xlm9t0|4wV*wUqskmQ~ zA#uMXgK>ZTn>?1Gg8@r2-d|wi);D=|1iu{dPzFC2*S`tm^8?=YV|zxs&RLAqXcQ~t zKB))Z1k5OdN?yIux=5Unxl$6hzQqw;15=xLdAFn*dsr%tZ*JA4+L0mSo8$KYGQL^c ztI7C=gBcm$Jk~3DeA8_Y)cEEc3e>KAUW?qHA+Ee&k9O2`f=LRXviblm4kx}D7NStO zYHBMPl}~MDE;Mn^9;e%xDi;8addual z_`&|xo`lO+x1!5GBZEF(F6bZj0Oq>~c=29Itl!Hb|FQ@8uP*ZPR`49V7x+WdD_VKa z*b6M(3wV0(1>9#SuTFM*t-ZkAxCPVFl+>S;JAM)wo!)lJ`%^1^ZL#phFn*F^A@3yp_WG?= z=Q0!Lyscd^DU&a{L2vWcE%AhnDVYrP1#h!*ANvhhuT8o()BEOcz#2(lt#8u_zcjVA znYkpHp1=|~!{i?`4GxHY%;db%gKzUUuz?>lY4+1BMu^v7ao$>=A=KAkna|L~@Hjha zRonPY5J$etzGWX1LYO4;O(&A&nYkDERa^LTrgzg`;LLXc@AkbwIUkNbz}sC~er)PBM~;Av|2 zvJkcSx-oqGD-{*JB^MBtX85)O;f~$QW$WxPZ(I{RL$hjW?=HN4BjO)jfat&A2 z2fRn6GDg&sf|~vTYvaSY9*opxZ}z}5Y#(r`reE@SYxV(m5!mQ_r7Sc~c9Si`v-+*~ zIZI>3?D9~|4#fiTz&IQD+{2gIqaW}~zb-grfWvv792NqfODXn!AO-FUL(#hQpNpZ$ zi&^9Gjpxb!tAg7BLI<17?5)58+#h*Kr>L<{jh&@SAWZehB1^ z9f$A4E%SxK%q$Kgw|&Si)BIY&7iO`QEdK~FGtL6?#$b_f?)``;&(3*nslQe#G6XZQMBJEa0C2>b<#b-1t&uSTfIz9y-Hs9=WLJ*pCwz^+>DluakfBK;Y+V z`Y#3V`!O{qy7a0*$X`}(`|9Fy(adf5!euNm0dz15)j~oCmdg5A+}RaI2Ng@T=s4Fj zamB}s931^pzKI+7Ot&6Q$fF+vp3k0dgMXg|P~h=i_X}-s>?aJE*gnA0{1d%5?E|`g z0uSdlm071aW}QN_&ilkMOGsVgr%*rgIO&VC3A^kQee%w4#VtIR z)p#^75|3h1(n-GnZ+>|!Yj{qU&cU;KN3jmo^drehGE)mP%nD_Bi>YrR3ua#K@OqN> zgzzSl=MO}24sAL7Q(jy^me|*uyk6uzKpw@FGOPV5s|lWU`+(=Pr;5GL?gJuB@${&3 z<2B9i;XSX;jfI~A1;gsx`Z}j~bol&Bg5)tK>f4+=yY~T~=)C86zu5D&S>`!gyPsJ zGi6^bQRX7 zY`{O^W)sUDRU|gHq{`8d_-Lz;@8&1&FUC4lHnIQWn@wzWgpzo=sn9G(R#`O4FQh(p z(3-#>)#lI2KrP!E2@n^)`4Iq*yZ%|V$))@i{_3_Pg#bGm^@j;*XckfyjrNh`uFa|_ zi*j3JUv2<}$9--x22U7C>-W+zZ~@HOGNKm9&|%10;M^kiX27(w|IV%!owI+dzt1oodMxy-}O}aMpoRn0H)!|bk@`K0d zP{CVHPT=bXnDe*lP3Np(y`?T?_vX?zjI#}ADI4k4;ZtKiD-^P$>^q{-aFmO|-l7t} zAI3>WP6Rk}Bv;YHF`#2#6FIf9YG+ZmI((`Xix&;H$5;5m5gW#FMozd+e!(PA$Ho67 z=?U3I72#+cMqiO#I-Ibo+IZ2>Xdo1?g7K+gtvaDP!<2u4io3{Iw>bO@TuqcGQZ8qcH9{1ag2qVSG61hwCoi4hQ}CN$$wYuE#HJ zAHGl*R%ee`zOm&Yzg=HeABn=4akcN<`IPq!p%uhK6G>zH>JPX{)SQ%w|x|bQ?LoaLBKI`TTD= zV5r4SX>nWHjUHwhH)a~yRRKHb$AZj{MkN_E*dAZ*w?lCld(#a0xn33JQY>vuAk-LJ zS0rjf5G>P(P(<$hHGa>OUreX(vK8xpnM*HG8;Smx$?rtTqop?1TRc2gwnQ6GB~=?E z^XazDh9<$b-wyd~7&Bc)PB@Yj!v{zg2Kx{gf2w^z5^{kMBSrR{Nr?RArh(Z(?mU^8 z#%fMBHV_*=A!1jI55#>nCAw}_941vK#kFw9VSO!C)H@ENq~zTB1yMT|4$96TA9pzE z-pOz9N5+qul~f=31(N2KU1N0-7&%5x3<%Vj$O&2hA8qd)A64AT@aDpt8}F*ARr<|lnz$xAR^cW1eDJ2^_-b| zcSEw_?eF{g@CVsBbLN?I&YU?@?%cWd_s#{Jws+XMD5t~JmBTI!cFDm`{JMAt3(5Qh zrs6NB+{3=^tvWpm^^8jH;-`BpXH3=4>SYEO6Ix=W59av-={mG_aD+dv`x?1qrbVlH zw5Jcy-C5<$>80x5s!b_Xr;U_KB3P*AyIHulw(tzl?ng>HH zW-6MKC^l#wEX30y5b?;Q?D>D zo4=SxDW2ryOO|pM%hqMR7rFU-F}E6EP2e&(jG8RB>URLv3{AP5yt{-lUsJB`Sk^+q zA6)oz@A=(3^d%I@dhcnANv0H1xi!b-=KdTXzhs`E66V0)$i0s^?MF&Rw(!jNGi8Q;fgx}eouak+mpIQq3>Tn-8;ANb0ICaD7>c2?>z~m zIOUU00TY>#bj2y4k)cPBl$h_rT_*XQ=c;@c<_g=cJQwaW^yfW?@?2Oc^t(?1tqr}W z=gCvR7NKw6q|m|8U-TT#| z@`F55fk!A(na>XbV$SS40q!w9BIf+*AmFKb3OK}ii&r#{^ZK?jw|p5>%!9@!McpTf zUH%Xc?*UJ8l7HDDxdg5gHyNMeZ;JN}rR#AB+9A3d37!#$7;p&i9N(-kl=<|GK7~DF z92pvIQF#4OAs2b`khoaZDPV{}^w#Zm3P9by{2xhE=r1NKv+jZ@@eM=lY!f$~0+t)1 z-}Ch;;2l9vJbDTki1uodr_^cSIEjfBP6LCuBjc%a8c>JhH5jk5Y=BpA*qCgv-n|*D zXtc72`4Qbaxs#9Ka-#AQ0$E>@RDfx!dru2@9HwW4LYOA|OOKKxDeW|{-^e;rd0L$Y zI!Q*y)4)NKFQ~jtv^-CE@jobfSLdX@q*--xDoZbj9?&~pX=i& z$w}{E`A8%EXQkF=rD)UTu)c3nc+^VuX?u$g(*l`XypTY5fOXkj;v8!v`J4#7;52ZJ z5$ZkV*>M_p^)TSsbsCs>*u;uPhGChKSTU0f^oRwA3wgvlM2zFah4s*HA-#&D=1K3z zTA7bUne~VHYzFvP#QY>iwJ_Aj>K3jB>N&b;E~Lnu>k~EYQ44$7w)arijG#8j=VFoj z|K>nLjh{3MeX2Fi_}ge4`rBxnYZ#2i&y#@~_xrn$#zTk*fh;g3KGTrnS%OBKYeV)n z3+S<5gO$Op(kDcco>d`2LPZ#^IPhVUAn<4X@7r#~?~&c%3? zdlb+^$v79A?**o1EEy*^c#b^EP{d$9*~Mu7E(P0r8mMmso8a;sI}L24U}sJPyC{i_ zI5!)P`7Rl9{vrp5oKwQ_$!3MNhGVizhJ@r}W=KdqW(=BrccIBbQ!-HdR>uk%H0u}* ziiB)?`ziO z;;L-|T%zPna)M!hAR8m`rNRD6V}B*s10C$I1bYh88RnEcz7k_CV|_B!|LVf^rTcRI z7=`1evc0;py;9jW0@(ps?R7~UFTRz%5sr6WjHW51ubk3Irv&NSLSmj0F%OfL70k&A zb_Y(0Hue9to8y#AHaM(T?gmom2)*Rd+^zr8U5oWIZ)P`dAj5|-{3^akFv2Y}t`Tnb z)^7hw%L60a)B0HGPoQFPWMQZGtHxrdG0UeK>QjLl?MV5ld%dtpM3E}TX_;dC zaa1GL6x*T4M?3W7C|s%2Ky87GZy@eh5DgRXiIMw|miv&%ef@EMDuEka>X4gz7tbZ6~&j^t|(UQiBYlVN6{#DM?s4(HrM``BzIqPMm8uxJY-M;JtX6}?R%0#V$JoKw7M|$=Ih`EcJ|OvAg(#E!M_ieaf)@u2~Dn!NwiLA7q^@tXFSS z=xSI`CwT7Mrf^U)?mGiKXEOSi@?@R?+-Ct#&Kclx{^)TANaK(GXMizhOAZ?1DaABx ztmDjzI?g0h@weJ>-WBxtjw8TLeHl5Jjf2Kh29}b+U|=Z@1|OW2MsEN$u#{{>>rP`5 zDVf0x3@OF=(C24O^Kq^Jy^ww(Nk0kOBZW_s5bc?Mv6>Cek=89M++TX3Sxz`M(q9C z3cW?__>n6rcB~oRh?*g>u?}7PONkjq2wr?MnAf)%weTkPo1yxQw!;~*!$ijpXG-OC z;`WeC>PzYy7)te4LsDyt%#x!0)1RQi1|i76P5K zAqjj$&1Eir7Zsl*Ei*GS*o71>{eqhp%szcgFyx-tyTc_jKVTk83xjDj_g6c(LZnyr6?Y_KMh>I;Q< zIAd{X_TP(=lwRe&Rho|>u1g}^#u&D>!WJPL;ntO=B&(AYteW@A2Jw2Sw02nq>se9) z*eF%rS5|R0(UUYTqrZ^~+Gy$uQvEn0Whb(1%_f}8;8^K`$1S`gToNpUO>}VkQ+wVg z%t`uWs6v6sIF{)7ZK%SJk}>iO(A#A6F5_8r1~@7iE6xDpqZyx{0Vj+uWM{6GNV<*_+wydklSa86c^}S>R7Y z*jQRC@{dXHEG>#WBVuu`bIxRZR$AsdU6^s9PG|R$*pByBwBwa&>R6KT`V?|2*| zq%RXTjJL5QLHE2j%19`EqYOjoxN>$VeWMH?r$dKQld$Kk3(L^o-YBP_hsiEjB9zsn zNH17ahJEcD8jjlx6^*R(%1D51WznDF$DG2l#_GQ$s{ch%OzQuPV8+)!M)#%IWUqp> z?yE(2zon3>-;V@VmtnVl&a%z1I@TN}VO`Ob4Lf+gk zeiVy-LrTcUHJ(DVg7TPHdRaw85j<)=Cq5NCfaqs(@=}`8YZqIU6*w9=FwlW!$lVl}$ zSrr9Y2|mdmTnYB&53U4jRwY{eE)i|DST9%^^@40u)o*3Q3+fAAv0mWI?c~eM^kp{7 z@#W%O?hVK`;JZl@N8e3i9KEHg0`~~sP2w2aqN?o>I&B=nB&-0<6~X$XrWqD~WyRv< zFBpm5OOl{@h8e|c7%Ne%daI)9^^1bh$tzT&xk^;8tuK^|_i)e*6Wg_V+eN*Ls@V!{ z7X^(%CXo`sH$uL)nu0Z0Yxil=C!H)j%6hF)Bymysow!jK5=G_7M#`O9<(HUIvdWY) zR^`=Em1jl4sPbz9R;`iS!gh=$wei0(_WD^HzhMo!NcBcuqN6BKSm+h1Wg1oeiJ<8&68nfEq0n=W=vV>RAb7rQ?;yNd)=6_AM+@rHoi%S z@h6I5pRA#f(#6*UlgqOEb!D=fHz(hRsX|y-!z}!MHS&!sD_!h&kuSc=M!r~O*F}{* z90jAYrv)s&vQ0XB1ETGE3^jdhrq*_*Xj|$cTicms@5yo&?j|AHz9HJyxJW_X41BZf zOYJSxWzrks-Fx#S|1J`=`YS~J&_zc5<3{4yTKz>AmE7XC#IgE+5Y->eAt#(>mlgfj z3R-;qsk^h)x&b51qYNU7b~RL zOT-;Qx`ZU@aU05Vz)HQ?SfaF%eT}w6txN0?sG`aErmT!W4KGn<1mX{lKwbHRBhW6E zDZzPS^^LXQhfxcrnab8^3;rgE#ab{D>LCwk^o}(?!ss%36#8D9?|U)dkxOhB`d-Xu z%w-bREzP-3>yd{aCAZwA3^vV4G*gLR#AxY4Z$rA7*`5^oQACK|LJ5&Vz!L&E zfCZDDJqtWz6x&_a)AuZ}jv2+9s<2|QcG}46^HdT~frX=RJPP);z!hsJiR?VgD~}mB z;jrmx{mV&Q>0gd<<;P1E%;VAi<#>Ag$fd?Do--A_Tu$P{IjJaqe6TBu6?=2EdHY1s z7$7RuWOs`%_PxQ(9@v68CKL|WA`cglFR5v_?C^4Ou)3b?>Y0RYKOe@F<1kaVCMR^9 zxA`zmD0h(}-C(Tf+oq<`caV{Aq}KOCkubi#lrUD;tx;WvN0F%OE6$FP!cYqtMWne3{m*v%Z$R~jF?lk!h+!47BCo3AyWFPhJ~%x>!W_n$oAtw67R&tJ!YN1wgzep8d$wE@aD!MbO=%Oej6+J4D@fDRfv;vv<7>km0 zoLZ|@Tq`P`aa3FztD;HBQ1^?pV};8VtaliR3b3&pmp{puGiYrf$rs4PR$)uMToyk& z%ke=;W8wIc941(OE==vnWCGgPLh+MQfGJ@}i!q}8AjEe`l$omQK0Vm2*Ean} zGPnU%)@1A}XKz69ndilZ`eiwJ=2`j*rJs3T%pZ520j|HIWY04ejBSojqRnxwfnQ%v zn!_((@tY&vm*dOe3v-`hkclpT>Gt?b+9Py@UcLM!O22Z2?SMLM9MB}>arY5vi?^;Y zy(-m+b4VNKLlGyw!`b4*D)(7bxkgbm`r7w`7GF7zvyJ7=Cx0-2&+&>0`Ny?}$3?>f zM#JNx;lGZCI&CyG3EN5fTa2d3S2C37QSXen%}u1xN6re^16LX=++pNCsjV>l%92~S zkleAR_#$eGrcp?mV!A-aH-)?|*eaBsBOFObbZB?Si#JIYmk!BbXBmgfZ8;^t!UBc$I>FZavN7 z+$)`FKVN9X>(=Rk7RuC8sAGyuw{{J*0PDf~qI(Xb1i5-GPR;h72HF~9ylTnd?2!z1 zwkJ%+Y)d-ZZM95idyqfa*`5|wZZJG+SiiMode^^}ncgkt4^Hnk@CT=No@CZb_?JzY zw>12n$p-#m{vdoOvXc z1DpP15-A1fU7p?StE-JwHk!ImYO9=;y5q-8sXJDUZ=-7Lj6yL=RJ(?OC%zio$KuYy zclgQ-1_R1VSQt>AVd3&?Y()l$#6}U5NGZTzA=kS`!P>>{DqR>u$}?K_V%^eP_ZXoD zmY3c-iWw#7XM~E?@cXESKS#l+;Vc2WpoX#r*p2??xWH(w1T=b z`zbw#Ak31+IODXLPMbC}2_33^SRzey_q80*^zvZ7P|`{9)i`B17(F5jkvH2Y-c0bW+V{?&d0M15VJ6WY8woX}oRo(T2{azB#9&JP`IeJ1vqz*Jtymyrg1 zR)IY$biLiwn!_};Nz@5ox3Iw~-@sGY=Z~7qbkX1JF1n`zyXYPJkb^iL6OcBY+ zQd@lKSzD~!e@5kgDT+k*{#20S`(wI4H!nwa^zauZR?*TAt|*~pa7BieZ&MXg_4~ww zE7Ae~aMT%GQ7(Sau_l^GgBo0s=L(n;O{5fHSVhh`&Za6@18nacUy&iHYdt&`t=p8HKgY7h5@`?kt0qMQa>d% z%u6fYsaUJCg{K4p*0-eV@V7xQ{Ph)5df=mqoW1rWmvw|ZVQj4!^jmnBBx$tXK3uN8x+F+jRlB(RtgaN7E|COjeT31!G4fGi2ZaLjTztN zqK*>lcn717*WA=Fq@p<9B*BaCcul-HIdo$j!U;1U|6IG>=i+v=(iBqpc_VHZ0H0Un zVXviWc2D}eqAcH13h;$A(YI*|){7k!)8*nH)UZ&`b{I2?wnc zHXL7Q>ntM&k8^L}4_fC7vX-FDeL-%D<1qFcU4GKK{3N>k(a;wAr`R525;8RYDqeT0 zA)n=Vb8_&T=vVOuGdu5Z1U#Ufto98hHl1CtO9U#`R`Hjx?@ zU{EE7xka{mGmJd_DoKQ>cq1K?y?CC<7+gsr#8o#c9UId4gZ;M|Sxc})RPf9>O4<~H7vB{3hP;6cxgiJtVux|%5!w_Zv?*@nqsm|xU_>R(BPQNxH~xr9^P;9P z2{FxBG0nUix&D%PJgySs@tPZrZ?82nj?(7&Mr4fN`cWBUbv_=|c~caR&HuaL6{~Zu zw~Gv=IN^Bq>sr~@McJcNHVnL8>CGoCRBoh@+T9z7kicm4cq3c)*DGQji^}oyJ1DE0rvvls$z*W-WeD%Xd)ZyZUBZ z`Gb|@(jYwxFbQe+f285>xLH9zuQ^eP&+u9^Es7l%sWO?Sq&O~`z0R~RC+vF~r-Wh0 z&1PNxl@a?;C0QX{e+&B&C#gT1j3e5EnlhsV57PG@MZKpXPDj1xP!x;a^TdC|O2e7x z+TdSy{PHaa4u^4YNm$amBsY?1+Q3h#a{n*U%oe# ziC${FnR?IF2AeAe`|DN(_Tagd*@KVYYMXDaz7sAf_Z(2uRJ*A1)zdgV)6`@`onP5A z^c-;cZ3-s4c#)(9qgRKaw>n@>R;|_otrmgm+-8fgT0}A}XcE$b>!rbNz0K}6zg1?p zd5CFw_~64Y!r>()(!;(64?l`d`J|eCu6@Ech?H;|Hb{k&CDqWR_A@1J@sqegtJ@W< z1`l%K81hMY`KU6(OZVI92JCD18@sI0{xO&tB{X`}BC(C$N3~It^fqDZC?5OUB*81T z(Z#}iX|PES?^8ox^}czJRe$FM%YA7p*%o|0#q(Kd-~<9^XL z{>{{IOn2;wf)~Gy^@CCweEO@MrSzI~P8ErRbE@R@wJ`G@yN%~m*~OdmbQ_z57>5H-t*C>~w^F2Rd$7IUj2UREnAX`8InHd!e)xv#Npla*B%?2JuJLTvKB==WG- zJF@&B7RX`RUV5*q!i9S;lEP_ND@ZFP)zGBWy_{*>U{b5^Rj|-9CSZI}g#jbEiGp># z(1T%Yl8SF?B5Ud`RX6}W(1g~rZX*lNFdmRz@Dy3}AwEr*PeK8XO71?Ekto!rr5=n{ z>87aE)OO~MCS!|s=2}gSGdJW9I&*WfmJqOvm1CQ1V6@3P8~9aKq{;dUSo|gvA0DK> zGmj<*R}~)~T$MijYEv1S)ZnUYt(i>~tYAx^jz8Rzvt(bU6rNI*?EzQ?G!$*Qrt0u! z78bK+*@)|HM0&NV%!)Qh1|#(_lQFcaxa)V!C_!;n7uC8UUWsZwK8i#~J^G)J(lA(A zjP?~y1JexBt5s!2bViWk+pk3~KT0kyA-t+SH&)!Pt+-vRnAl7qH8Yq2Y_H05zZW%Q zFUV`iG}kAn_hQ}+OwcJ!m)Kr)X4qN8nS^=S;M1yHns}Ni-C@2JTeoGB$8NrpWM?MB zdAI?iENx~&$Q+~pPTeMFn$d50SI;7o@nhAJ z+9+y|XiKGGNVKI^8*#ja(# zi%(xKjeo_&H<9KKM!Y1@%*~s#4fsCzzp<7!32nMD)v9;3(5kr%!TJ`nQPtRh9ZB-@ zGKw%xSLHi}0aEzf;Y?KyrrVg55D~`NsthGV?=#ljV6;D>tvmXD1rINant4CX%t`Dv z!!e+mOk&@=-;AJJ`GX_q9*6ZC!#Y&6)@fl_Z{`oOKG=fBO(^a*D4D7_#*J;Oq0zSb z#Z+)Yx78?ti{DoF`2xO>U%#Lp~KET$ry< zVp=sujP-}nJz z^n*r?>D466EPbG4tHh`gYnS0syBv=KGTMA7fbs3Z{Xucz5o*7Ap0ZdQWw97##{;$t zFBS*e^8me*5n^$*mQgyixMf!mbZ#j>fS)Fg#d$j^lK%7dI8dPvM;yI{A}vG_p-ACfAzATV(Y8^n#YaXhes>g&7C$3sF&6g~@b32ruWG?4^|jd!7*bvF-Jc=V z=`x8edC(>p%J2b0s&mZh*phZ;6c|#SUPjZVL1}ha&8e@bJ4&)MTG9$nIn?n&?becB z*Ex*wQp>QG3RVtzt_|j4Vs*Yr^f3#<$|qIuUYC-;2{}dyy=LUO1&mhq9Rf?V4od|6 zj3e<9(E!#6f)-$zWT!tw&yGQiUSlc!{XSnn-fthHPMDEuU3KZ4>#DPJzVVPkG<2@3 zPTyNWS{AUb`faaR*z}NXv31oKhMW<~B;g>^fFlo-}Z4wF| z=GsCZUDA}RNs;cmx%&NK3->>)V9lg@61lg_XPf?dm~oPGhqsMKd{A9Fb(K~olGbWP z8^m`sV}n>f8yoerRZ&#>*&PBF-=NL&0~un`acYX`**|ED{vZ}@*2=cm57n1NM|6`A zd+ir{wQptYbwI51ER!K$MmPLYov#AE$g~VO_)~mmJPGz&nFobu0ZHZs!V^N-Ns9gU z-$^0uBT3d4r>k>q@h{W7%^O2%P{8Y2o0z%Y7~)55-n(0uY*pJ3v1T0~HS3lr8qL~T z(Bhj_Ogce*Xhx7pHN;6L)u5AhXw4C%M<4^3RAX8n3(vN;Z9J*Qq-@70O(G==uh*dK zzR;SlVbPuFmWyl9EnlV_;!S&ufKzISH%(+l2~I=-V^y6PRrTj65>=fqNbyx|&U>^c zshyTyFTJN#eNR+f=4kd_4PJ}Q_|yP)LcC{F4feK=S}Q#p+$?H+!=(0>Z8aF!{vsg@ ze+i1~5x%A5%gEtp|Blx<_KJlXHYtp+YShWMQ0EZ^>n|}DFErg-gP~wX8@uoQYjk{H zTWcdTO0X7njJ4L}sI|^Tk!Y>21j!wpu!Qti5Qu;&YJ3?rDFHxrm6}Dnp*qd7w~az- zXKx@g#|KpBeba|Xu~kHMs)%%&s7rQwMljEZ8vNWrC6Yq8sQO?FwfNhQIvindNLR2D zAC^yvW#r&WI@L4jjQy99s156(UEd&8?&7}xVStj=K+?Q(Kr551?fLi|utC^(CjCi6 zzq+ou6M@7$L%b%I_@W_RXA{3Z2fS*C*L#kh19qh=cut=K_7XqVYO&v62MTrE zet6;5Swl|cGHtb+i+cIn<@ru*WjO^*2Lz@-eY^(I8*UR_=TNKu|RY>CP z*Lxo>bk*s0GVrR?uiC2E3)1%qG!kj+LSBLyT5(eEBKK zU;`wZjB!d@!0%*SXEOTgjG@ek*EHeI!BC{VHzfMaP+yhO?K4HU&lG8&Wsf@TGe!OE zxA4)U3Mm0hm+PK)J*r^c*jgstGvqTM$4Kc$injYqvHMw4myt@l&lVe3dW?~oG}?Wk z&}u)XO)1etJ))JLrR>N-qm?(**-C76CrgOo>zj;)+VK9zjNxD44;p?bS>xHlglEiD zLyQ?VXftdOGraMbg7z?AgQ&EEl#E~wUwdg6FvT;O%L(}=DtG52KuQ?f#cB7D(w-EW zV27yd?m%^=%LR?}JCyXf3LQ+JOC^h#;|0U!HV z4_&&cf7d$xE;_dBV4qjU?}}^vtPTp+IEw5m$P3{QY2c|OE_R523h^DORt|uCYy|pK zd3ZW>M+XHt9qQ^xUER?Eu})oMw2-G>dw3xY%*4A+t$od5ZgA+GPdnYUJ-AqVcn!F*+Ev? z_Gp%|?c0VyS8|R8k#txoY%v*|j6Z&6(py~Ok5#jcKi-;c{PFp0j-Ry2Uc=f~`{PQo zveG@-rqZK^L09@43nJ+vmx9$!H$z|JkJU|jpGG=sBVFCuAk{Vu8mWF~vC&;Fh1*TW z5x2+ZQfSgy!ISG!@OM_ITfl1#Yxi|2L|8(Ee%KV4rmK311t|0^yDG0?&{ZvFK_m@v zDfBQI(~Qu4OnSSv`34*5HydfRVbDm&G}026!UB`A-E^XNO!_^ybfP4`Y3TZX)6nz% zwD~TV!e+zzwOfXtFWYH{U8-*<`;B~B&mSB{aoA(Tq@FdOH6}e`7_@ZPJ}V}r+m&mt z8)vJQ=C)^zG|xP1q!~?Kv3?!HdQ@Bg2eQ)oiCqd=zj7CfFU@5N9Mc6Z>tdSg-ogbQ zk^&5m51Rr5b$EP?1sEP*>|)$;iLg@cM-A(0-CYiom7(aO93yv!9Ew5D^%>URbkmK^ zF#%+CjxkQyFlgg!VnH3Q2b+vTx_f-bl9b1lYvj2(*REugVLhQM$1+QZ zP$SHZ0#!CZ-)NxQ{tM8Jcq0mQu>pEr12y?CKsVscDA1J#Xru;e`Cot@1I`Ut8pZJ$oUs~b_J6=>h-Fcn9D_4L<1G3QIB9q%iW4?CFKe6? zf)i&U!zC7Xkogb@%hexdoz*u%ai^+p0=GQY1$nHuM;_2OftPH298`KVd(N&XLFN)a z1kK=dFj#0bJ5B*)G<(ey7^n-l^Gty%d4&qp%wxQZBe4mge7O`WRDUDzU@h=q5%}6X zXJI%vp6CdRvTnv@(Vct_x6*Nj4Uq&~qR3Dbp3%scsf2!cOAig{!z*NES zoM)~go1MTl+#n{oN8}C35#liB$u;%sNH_BH^@cF!3;n9D3f3DGk5*nP7~YTqthY&& z#q4sS4htz*pOfg%#0t55e+L<1m3@pKN#e41t#E!#vUNGBS@=kFzB*ijS*f#JP%egj zSM5<+@$Fji?V@=7uw&TmqWA+O$kGto6PCBP@O0StM$^ai==iB_>V9F<)KmF`^US4T zrKg%-Ur4OBt-T>{ZWyc7HY3zmTBxr?sC|?n#~+RWUx`phY#CY^8NSvsxFbe}s*ytO zRy%S5yYP-5yr*6@8!g}K+P|0DQzHtg@>mDoC-Aw>BN2t9WVgc8ruMxFo(J6uok{1% zBeM-XS5~^OO64+jd%?fkWBHl_(Gvz z0Ea+$zlhjtRC{7`7t(y@t3^KF9pfh>^=H1?_LH;5C2CulRA0* zIl=r0)~m)%d9Ike)^w;Q`kYQ!N+!hQ>W_C4uS^V; zJGkDEm)FxYqlf5nm0~#3^YTOfV176z`>NRNF8;h$ou2h&MB4BVhngEZ`hw9^jI)?Kc!U{p~u=L#P2B^daPY?y#?ufg3(m==2*)w zrOQT*&KC{SBi>L1N$xVwca{x#K2%jPJRC!8o=S0e81wlF`y}_paX9j$yS+*7s|?en z9V{p`s{)jQD#O}UcCdb@e1A@6{fuBB%nz{yBB*g)RfVfgJVXWzeGI6F`+`?x$_MSH*; z*uOze4&9Lcf`zvjvLs&Lz#8;}f?}W^4n_(=sTE2;)Nd+SO+S6X!b%6LsbHmq(TqPf za@dI@V&j0cx+9|NB@O$ez&<&;r-d@zI6`trd6H;xMDzwS8;7#t?yk#wrM#D}U)?G1 zmGUWJbmEUj-OL+e#i-jVR7l$dBh~YQ`h3k7Eo3{W&l4<;RKXC1DrJOvNs7Njp(0N4 zm!x<~7`>#8N0lH|dXGTFTOje)Q&0XN(VVRqu2iZI7_O$gXyGFVTz`Bxj&L%ppmcxJ zlH-+1&G83(z<7~lhl4U+QDja=(xApGezqLecustST`)mh@aJxvpZf|Tm>`7@QVnam z;h8Kv6}sCzlZB^7cY9V?qy?l~-4~RofHGsvyG8RI3FiwyqwWe4ouM=V^@3gaTl#!T zB;?PCUeH;^=GxEl)}W3UG9_ADCi#yiYh zKHSa7oW$=dFExdiDbJPpZhT14+t0c2t|>Ms!SmEPH$E4=iuZU4c=RnKjWsWLexX#V zSPox^toynv-s-Ks5UZbN$`=YTO~aQii08Eqw8Ww`lp8pj-Y)4U zNze3D_}*0bs>}02Plfu={g3r{Bf(r$_%%Vd-6&nrD5=QnR5VIgqyx7}r0})ig)T;u z;ByMrPi$c>2FA)W%L&gZnq``le2>y3_3x>0$cVYv<$1lQ!f9swFP@O&D?r5w<`uh@ zTFR9oWy|Ur;XcWjvQ?pdG~?~93LPY)Q_YHa%4B@!^1NKLBD%bw;2B!8BKp6e zP1WiU&oVDK9u7M-z0&IjFw@t3%E}`J8I0o+jjU zF)|%>Nywqk$Ap}&9b!YytvwYAg`DoD@Nt)focjrS`#Cpynqns8(3PQsR9{o#oGy`N zml#&K#NwVRt}!H%IL44@Re7>Gc0Al|N2}qY=Ed2gDj6Cc{()^wZ zlZ`~<-L;SOR7ic1i|w8Y&+9mh;D@FDk5iQ9&B??G8XW0FO(1e*L0p z&%gPD?dg7rYKSYZG1aVd$MN8zYNg7`A`MlRngg!m-6}Ohzu$=QqTl5&@m?FzX}nvm zwz)|t1sLxx)7wIWhhLJ{swRj5vR+b1^1P_9(Filq?YZkkh0se1b(_B^vOe;n!cHf< z_PiGr2EU|Gd&!Fm3t65c(RW7gG#QD`u(&-EF_`{p%CB~N7)&qfWrAtzUaX>6509sP zLsb3HwCzMUojn3f6x9dyqUt>`Q53DTS(0LjiDHS1_x9q!A73^myE)>XVDdRk5=&UU zmG(z;)SY;WTReC?>Ga@o9kt^d58l+9l1oEYHYKLIHNqt({klf@*G8yS7~$GJ4uZ#& znC+IR){Z#>on|uTx^f>Uld;q-hA8zl>@n^R6 zW~16SCVXsmtJLnnP$sZhOj@O{JyvWMlfindqlCWgZbrkq`|=?gLtmb$e}`K_Uu(%= z=<6NLVCeHQqj-7l3${16b5kol1QUxQ-Hx?aRZ? z{_Fs79c#Y3pKTjS!WvD}Jcm>=x9i7oVlpYgJT%DdW8sXDW*O2=BvtHBt_36o(43&P z`YWm?>yYdCn^URgoJchzZ_=6<72Y+PHmmy;d#LB&iwdonTfAD{K&GwMMP>CCZX2;{ z8&>G=uaMdUI?=Vit&-%$0Stz0yo(Lq6N2{y@p>3MN%VH`BpC;<@Wh1^3Ns_T*9MoUI+NLQJTwFtZDF!IKvsPr9ZdPx&^uCakljNTEMK;G=(EVf+s<=W;g1i!}07>q}vFx}xjqx(Nk>m|W zP-6`5W`6Y{K|R#*f7v@?vAha;JH{K1)T>k1Y%F@}wGM`%TBzg<;M4Y2u`JvMQxBBD za$hKzpJ$-jsN`&bXZU6Fr%-K%Pw>)<NB_>pU3y0iF@)WsSr~buo3>cWN1d-qcKTQI;)rt4_~8 z=nrJt8!~F1QpsK9*fJmOIBa~D2IOkW+(RXv}Cs;ZK^0X!s`tRLw#>u#Zz9Hy*xT|rE< z7ZsvzzCRGTr8ta_nmQQw)hZF=|3Q&(o-d;$MS2%FLS*;&KNBL78!1VM)jb>`W<2+Q zB?Nb^OA_M5bB+*up0|L++lMOjLV}v)X*X1%5hI-JsI}mW3_#*jLlt^+d(cxbRN*cs z{{fTVd#FMmT&5;@rVUlN&&ih;A&^A)Qyl?rm9&v6S`Xl4Eb)z@3Vl&WP4a9Ss?fnH zmoB(Ttk(6oE|)G?CfAfJvwu5XafXyhg5A>Zqjm7tb*Abp7vA9Tx9<)FLz;}+g?a1Xkrfsx1q z>4V5DFC~2FFdQ-rQJXX~7rW~UUSSzla9CGx*v-$p?r_QTRr%%1kc6uxvA z{x%HJ3K+v%a=2iee-$mYVUB40Bkp~VTlm2#enc0S6S+4T!yIvYo*$<0>i~0)*PVuL zj^_R?28*eXBY80FkMJgHtlQ=YPr@UlJ4JXr)lUxN}f``J`|C>m-ZPHBu&?ix>9DDPmLDuN-O5{L>h%mz5E z0ZzLIJZ+(d18}-{0Q!3rWVj7-MuVJjmwU#-l@7?6A|UdCi73Db8{n)4IP0GBjDmg?aqGlXtWAxKf^h@At6;C-B{fb~T4u!lu*dkhp z@wOWMH9-G_rkNJ99f1Bt0Ma9&{ESExVSK5^4n|+0_rx)elLy+h<|0gFZx~$AFmc{ORJ8?c%TL z;;$v}+k>N=;;$7cZht3Fm!D#nAF9g_P2eTrlb!NIiBEVl~NA zahSq7hhe;Ckk)z7w2m2fx185HPM~MSGf+=gJY82jJ%NG#GY5CN#*GoYaM&isOq9_W zGc?AG1cvSJ9E=%7Fk-?s0cP0%Gc~}>1cvSX4#3PJ0ENRgF=q2(Lx%oY8e>)h!}ebe z#w?8?(~maBK(i90nf^V`Kr!*0$a8GzW^3fx35@3$Xb&p0HFAuJ1RxsE2{P9PnWI7G zBru*QIUsY2fW*Xe0=!`Z%+&yM6By5{H~@2t0I=^jmTxfWKtz-`ZIm}O${Puc=QSOa zHw;Q*zhMgV$n2RmOyO#W;Z4I3b>wKkW(D(cgZ71ax`KHUuv4A#^NN&@3D^W!U<1t8 z0P`ha-{b(yF9Hx7u!*qHMp&Q`7D&Lp+d)`R1fg)iCdMKgW1+@aC;|I^2V-FojF^B; zfWqS1Z`nO_u|`-d0lTAvu(${UJ2o3#FRGE&M z(b){A{98rJpBJ_%#1dPG7%deEM{i0KTWs&k`L&Kctcn4Q#8|+I^ss2o0pPX2I*#X#>AiKLU?tHITt~S%d z#&Ubu7?r4aQRk?{^;s5%ImJgMo4$+j@wDL=YM`DVF! zkseWim9_w5G{Bg|1=$v+I{;&f0LV-3`g%64!@DT0Z7^0tj7{X#^79;su^K{NPU>I+ z3iOROhR&JaI9+x<+vxU_T@Hh<|W7~9JAjY`w+2zOU^5YXvbhhx3 zQ+|Ar@-5`Xm2}6vt8Ih{8eu|W&~IU3_M+PNHD1FW?HCToDniQAsF@S6iLxd=e?PHl~_ z&PJG`5vC;a3h*Ni!jvKi_d2&|YlQVS!c>hgHIX-EpLP(Y7DdPjW^{?#@B<|gh4T6o9-m|FzEiMNdR+w6Jvo4WX$ z5^vi(#osJaJQ{CVe!CqI=IQeDB;G#ll%H3md`!G0zz$SaGK-wA0p?4*?d$-|F9J{~ z-V$P`J!ZYFA>NjF+tq=1y9h)ytg`&awhl{l`6UuopL5DDDN;TfR$2ZNyZ)uR{89<4 zeVy`4iz|N!kd@G{Q0otFJl;%ZebxhE*bbhE^J3g+^E*VRf{Fu%ZZp9adTT zb9*YkQkPySVRedAdZjL%#5w9SX2e>VC==B=g9?vWG4YnjU)ad+YUFn%-Y#~K-;F`e zHpuU4$W z1rspBeUMlPF&dZ&_!V+A;6@F&Q3CUB2XLbSz~a3H!CZH~6uJ z{a7OQAqVzj4I86rY{VwQH@2;IX@p%8u}?S%yNV#h##$nLYtKu+(+J;5#CE-6k2&8J zK{!8R6XiP_<$I0ty+rJC4$AjMP+}uC5x%!I*{u*D(*VqfbN-(RG7OvEO@4>rI74RAmrc6|rnKoJ1_DhA(7 z(SycbRM&2{ptMYq7nFV}&%!MZ!h+H=NtOxb3&zbBl|~Y`ru&-oTcu@xy74Q8yRU4c zMQi#Im+P9A=$e+4uHMzc15Qm#VrqKDATKE`Q`z+Mki{MHd`5+RTOrYEvh7t7aSQ4W(r-WQ1V5v-PvlIx%)4 z@&S8n`A7qQBzBtU0Dq)`W6Iy_&EycRJ>_S6c5uA3O3eh0mwqs0VWw03c#-1f#ztNI z7khSaLKi<#dSS@I0;l+iBE`8Pj#mGx9k@>F@+V6#3tM={DSuLzmxme)j9E^WmTk~A zc2g`hbn{SSlbEYGeQB=WY=KYf3Qvo^pEwns))mGScl2fP-|Z)QXLRv1qVG3O@iV%( z#P3x`uCt{je(w{xqRkjJ1cCpsw+8x_k#^`?hKBgV0q$EydTeZYe~y`>{%PyKMu&%QaAHer24ENDP_1D zUp}snaNXf)Hr$OSq{mo7zw@OX@(|}}Qf;4dk=Xi7IymIP7AIqj$taKl>7*m^jbRFh;Zc)38-^)ly=phyJVm2L&Ht!3rwjhZpy$-2+5l>) z)NVj69@YrH>RfqM>&EUD&b+E%O{K{KXiCD>Llj?UCM65sy6ChI3TZ7#0qk*+t363c z9}iRb?n!`kY*n6{hAZ?OqTsn}xWe%v3bk7dSGesp+N|Ahg`|PL3I(qzc=`-i zIP#i8?IFVzt{Q4{R(?u@))&s}h8oVUWcs)prH9*Sb9ChAWWdDLq1=+6aZ(RYoYZA3;{?^rT^(;S$tQ zBMfTAkp}gSkz}Q)&l%QrTGabS8cVGwD=n2UimX?RP#9rYKU1E5BNSSVQt-SwLSf4& zh1z3BC|IM(I%9;wn}+oZmnUhY!ULlfJe5Z(d^lR6_GKd#N{=BcQCAz*e>G~GF$Q(} z7=!8>OIFJIv0-g1je5^mBkHQL#;S)L&V7b+z1FJUIK%qJIK#SooDKSqVV&a=)XT;j z*0JLa>$dSWYt^T<1N0EiizXP(5fcpO#tAlOEyI~1oK+?o&LI;G=lY4{r26#@=U%OT z`AJ6ofs>5-t0yV;Azs#fTRmS_z68wEBb>|n0udZR;S+y6+;(b`IZDVx!sPfz2?^9f z?u$H%!ms}_mX)7uV3??J0T>-waSZ!aq2rPasaM)SOw_vokbUwE|DbCjB%WHk%SK}2 zz6&7P59#pldCKwWTx%PNi4GS)a-MkMI9@5NAD?w~vay)Ry8xD6Lg+IKIDv2>9r@Jj zB^!;2As0ZChgIByz)8GWSh4|6TbN{HF){A~Sk5ymoWfLBA-SeJV_}tz#l)5iU~z`t z*m-<~)8`Av2Up+NfK2>)0l;)~vH)k!YfK&~IAJ3(;hIvi!#j_xaP~Y8%0K&#BP&JUE^!7+}LOG4uj(=7|;hov$R1 z7>u)#n3#P5B>UkN`m1h*RODfUWi}EM?_U7P*_OlrRih9TpZ{#Mp_usi0#Gpd`zZ~{?>t12G+b{2HQ)D66>MW6kiry9LrVGqm7sa&%vNaCvD-lqZ1Zj`JX zewoVOd?kUf>CGN)3V!NeF3TXLO|vHLh2pY#n)`DizK|@B^Ye228QzF5j0x?{qv-ouQyYlWVfqt-6dNHj)YBu0U-Nu|L{ zB#PlFq_g{0C)(LM`;0`Qb9YA~t@8!&jGhTMI;df2J$o5c(epJ2RqKgzMXVRh$_o1; zty?#_>BjrL;nuAlZPw;iv`sFH58^VnX_4Nfy|A|z&UJA)TefQT@O{GBGW{{(UHiZA zHa5)hfzxlewL!uC-f(-3`f*&;$8Ndles4HEz1fWorT)Da;B4IfG0nK)0*tL&wQllo zTfzLc7}nMyf3C01gYq`i$iBVG6gB)q-hz8W`4L}p`9u+&Z7s?cX`Y9?1ucC6B)Rhj zJS)ACj0&qzV)wngg+j0Ty8C+nQ}?~9D&Wq@&6CT;diCnX168t=yrwvpV*m#sG0&kDp~vo`GKv5TKq2mN&H(xdIxTXh-V&Dc;-f}N&bJ*q%}3k_2v4y zI+}cDR#&NrnpimUy*Z*oO|3)Om?p6EpYG-j<@f?3{$-l&k_$J)6Z~Y=OP3~D z1@PlQD3#}pbgrM}&++kxzNZSRyGmwKUvib4>38ms;)jM5XACIiv=)iv&hbZlHo$gu zL4;b}f;reBV72_%DIWtVMq<7+q26&h5-001ImVoYHEhi{X#Bwd)M$6KP#(Z156QgW zMAd9=+OPPM&3P5t;9?4UGoQ^5M|_z8Z!d_&qVtFAaf%S~W%&!BK24Cjxj1`E&eJqW zh=O+eGyLZ@X#=&eluGWT8ItWUlS&=6GO(x=L2CK2xD-dXTF>Gw{Uf6@-YUiU8cg*q zz2S({W1#w|s0bN==5!j35_@y9&o5NENSRuGlwrk%B+m(U=e=UDx>a&UXP{++vOuZ) zfIlOc>8sZw+|n13d&fGeX%XuZ*nBqr2)VTJ^3?D|CE}vEOrNOB{Nc}4`Oo+qm@yyM0;kws3<4L?`lY&Z8lRWosQn>MT zd+}0FdV;;s5RrW;kE+GCs`;46rr^v(p$*Ho5bP3bi~rz==9 zxXKFQLHg|A=?W>`@gNO0lbI`-=?@^CfnoJ@S~=;eniaA2X?=0ZBc3~JR>ZF93Z7;) zE27d21Zhj@xf+=56N&>R~HhWfqWWoxy$oZR~L4WA*-tkUy5+@ZMcfh z=w_U&JjXXH{6H3d6Yf`Hl-r_kwZRzUmQTSQovBdw&MgY?wA`X_MvzKWGYe&BnTtIZ zXgwE*o@Hh^dM*$>Ymkr?)L+C~AgW$Nk~fqc1{SDmJ}HOWXK~*lCalKz5~GRP8$!7c z%V=L;s;gWoRX#e)?o3Ms9`#-fr9mx~>X9Nwe@7C&S#oz!K?KVsoiFM9+$L?XLI{(E zkYfVmN}>HjT8=-0z2cuY%~nWybc;fovGGCW$=RaNcea8jvPEGt8J={xao00Ic>td! zc=BCt?3>LVlhkL6LUU8}sPaspxo0cXUc5!2(j0}_E4L_I${*{uC|t)MTem1Qn#0m@ zY?Pmu>5ceW`UAcefvg~`P3DfYbJ|Sj#7uY3;lq3?k8`3}dlJMthLA&oz7_DC=-OwF zLW&!-) zXgui|gQFPi8TXQfJ)j{ zF#S!1+Ba-f_~}hHLm?;j+w;5%&+DGO$)!>`9o!_>^8Mk6zDWz1bjMbO&rQ9XU7j{u z6^;^CF0lG0n$dNu!f9rlSDhFO6+7wLwwcY1LMR z>%4kkn(6j@vQ=T-Jf)j7&Cp+SOOt-b0ub}xY;wlC#r*$DPMkQ%vEt$U+)lm_s_ZGR zn|QHSa=G!g2*v%QN=?aV8GD*`z#akkB#reEZGS~%g3*(hciglJs_N`3k=|$Nx zxkfF66l0oqgl7mT95_x2{E7Jrb!>Ys7Y3 z)LSOwv@S828HMa`R7&^dq3Sm#1dY;f7LJk^0jDgmjXo-Y0|`3Ip-$<8`yVNdL&eeN~)c@ypP z`e(CnhBwcLYHya(p0g%Fy2qLXc8`M#_~bM{81VsXM4s{sZMD`UaOg7bvsT2fu~6dY zdPy{3LY(J=gj;Ht#Uo7TdJ9al3zG%-PV#y#RIn;^0#Z0P{9Ft;exU-a8aD99DUue6_9rCw`b7%X4HQ13Gfs)=8ZV+(m(YpLUR{lo#-GNOlBO6} zicRt8BHQreO2zcs39_Z(V{PfCw#lXFWRVNi*2df2RCv))Gk0I3D_kQL4svBWw_jG^M4z2PQp@Ifg$#cUE713r^2nAMc-Nh95dB3bxy%jAzoqot@FM=;+^`ORaBkS}t&+^y#h>?RXMe;O&g0ee7pH6I{!T0S zohWz*0pc}>>@?hfOL)MFbC5&2M&3ktBII5^O6KO4Qn~4eS$NoUr z7mB3&a{YKWk?wQiEd{HW@t0MJwBMa?D_CPQI1li4=Z5mni43X_z0DXglXPeOGPX2x z9(|iv9|v>gSmM~ytjSAebHqJE2gmvP6{Vrfk!9#Qld(KeCfj4*Hk0kCZ=1>XmW)En z&^ct_WP1@IbYT9>U~EqGaO$+2IZ4g8DeQ@6__ir*lnhR`4o5Rs;v31}s`#wQm{?lG z`H8i0Rs5GNPPxoN;v6Rf#c?fR=ST`{Q@A)&>pHizXZSV+Yl%YL@!J$ocP9VWOxGBu z-xG!D%3_%s8m1K*sbR59cN?Y!nyFc_Of3!5yPD~-VwpM^rg@sFOA)5U+Z3`4)3(x{ z?b{SyT%zFlVw=LiC8ogw#zGtPzQH&$&_dI-g^2OI!PucO=97gO@7Nf93uAml24Z}y zF=*vs2IGA#>^DV(CDUZXG*UDDS%isR@}^-rm?&O?rHqujw<)}5GS((~j%-t?x>TX| zxorv^_@nH0g$%M5ifDRM&D=?PSx4Pb8>v)I8Tq^ijd&$#?ovAzHIiLg6guB)c+Ixo z<@Tx3I`5t2Y*txb3(j(>~5~V3Wdfu}v}JIGDi@u4-aX zI}&xbgKBm&Tt;ezloU&%SwuG|bFp~LAa7BI6So$wo)DOsKO#WfwS(C7q z*-fRlYm>OY`=z5P_jr?+DR{WYo53H8H!1X3#$XUv0(tUQd!)2R9#EeW3|+=gt^@TM zOUE+ttVv8=rjW$F=i^ST+<%_K%DDf$lRvos{H4@dE@pqLQ!rN^>76^{jwSnoSwem( zmdLTiY=DKq4Ny7OWV=#kFc4|s3>%uk#Un~KgIS~`x$}O_<_>~9LQ<$+FXp+YpBH`d zcv3hL$_NI!p~e)S!nE7<)7%8#|8hLZF1n&x>~lRs)m=va4|R!3_5t&5piB-x@-StMuWM)cz~qZ+EEsRI(T7*{E3Qv^Dv3DjaUx*&BfB<%&Lc3!6tIe)N{5c`hHcDkI}k{O@rWW|)KQ#VsT?ef%fivC+n(OQ0-aS@|d2F}Wc!2bZ&G}t`= z^;a=)#T3q>(Qjzj$sY+rRg#CJFWg+Lsf6>U8#QM|;bhYkgPEJ3(=wQy*5K)eP^l`p zAZ`Oi86WZo^255&jjg)*LN`FY;S#r^_QlkZ*(q4iI@tZD8=AImxk?P%3{Fsg5A>^K-F?8OwRQNA_l=%kf$M%`CS;!;)+4gnlyZx zFgKT^GUaZ=>mVrkQkSBnuqD;9=lHTBP~50X4*9b?o8QG$Dp=a{h_>FPlJh$I4O}N* z#H#`0lx*tDiFjFVN^w%eDfCc&j;-Wc=sU|-+KPTg><%j6)*6{B9ZSj>GW;7epdemL|7>__tPPKdQ)&oS^f;hGqi8X;I$kF9!d})_wz!J{W@FuYQ@gx8 zUx;qDQ8&II^w6$Wt4C*S63kjXahk1|(KKq`l3adl$vTV2Q?^eF%f=QgMz(x!W~O-ca^1z*ost8_MB)5gtSHF_ zX}30nx~Ncp5P;5p6BKg&ndVncQ2(fv>(5NX#T17>8{!iAnc)qEdf-z2E=I~se>Z>F z-zmq}I@rAt)HBf<^R$N-Qzo42&B*}|;3u0iSj8~;!>t)1T4lBE9)udHO~ye5rET_}b3+Je^+oF;o3-=6x&G`7n-_T0I?SWE9`)!)Y% zSxQEJB$$+z%p@GLpz@prfZZlNsS zzN27O^vTyoy72i#x#bGhO(X=;&{zDT#&X3y;2dVxTF&`-(nI?d9`->#!gH^u^L~XJ zm?89bh8`CB9i+#z5eJh#nB~?cnx`Lz>h~P(TTY|M(~fyE-ajJ*+e(_|U#?Kk&kOU% z(=vR%&xAHp06T=-i{kTpG)rV~nZsm$0INl}b1AH&I zotghE^D{c*fTH~euAu#kkuTchtsX=_{BGntrR6*&cq3QXUUf=Lft0YfJ9^8bwFRu% zk3KR0tzn|GuK=&eW42FLDBZN(Ow$f_N!#wFFw*8dO~xo!akA;vKoj!`i~iW1pe9)W zYN%9M7}U7FURnIMLcg6*qhX`6nEWmep>T;%gIa&jWL}8tgc|I)N11kfK}h9R*}4fD z>bw|gP>;ubo3a3sy6#sP-~(9i<(?7y71CBIcxLWbXv!Z8_bWWkA1n7OgjR7QgGI)f zB3DY0{$ya0_58siU-Jix9Ac4T+9hUT&{%Ha!vIV&$B`aUsb1g_u4LTrDe$fSN7zHH z_hffozGiymdkS?r| zXL@IURs=6&k6Ry#3WyW|N^uXR=mG>7_#U7XAp~i^w*1{4dHnq>e+LjI&kOvW>kW6o z0LApK_Y|yk6fx7Ejln|OOJS_9ZQ>{){z0Nh{)dr#niA3fWkxZga}KQ~AIK}p<=UDd zE)ji*i?XZL3Y2|_i-MG0&6vdrFkN*iRA803^O$STpY z?EC5hU@|4dD;R9N^G6N#qk!G?KF_9P0zV4cJ?|?dU4KB~J|pu1m#6gsg%se2nv?+GeiL`@XWW@X&ANGWfcv@n zUAV@MJoi6ayDXM7sUy$*bpCZrJCR37SZhZf!9xn?6KKKyS$3^LN>)w;4|Kb!EUsdT z15tYp$#t3HQdGWB+>9w%9z4c^1DVY91%jbmbRhQx62hH>p@=UWL2n7)vq&>X2FA(o zvDi?;=%YH^Toy;yDp)VmQ^RGw^VXF1(Pc8xmuv!xYY#kexM6;>?=DT@)v3*9Lm6LNSVGQBT)Z$fpZGH4Hv?i?GX))}T8ak0EI_Pv4 ziX=5+uT-ff85`^s8$`%2HrOjR7)*YdY3NE|ZDi|G=_68L0afsc!~QCS71W`a_6P;@ z1DWZzL%oLGNm`2mF2y^l21u{p#p<<*2gr)#7zwNm10)Vy@qumP0WO-j(FdH4`U7N{ zC>#$9#T$s^1hG&syrlRF@^XS$BrIVP^0|!D0eh?Li%t4K!TOfk<@>Qy7#EUMBO6G` z_2V-kt!3F9zgakMl@z`bfL%=F;yX$F!bCoPkiAhD?N2BinEj@dfGn^@FR7iH+{Y>EzYOX%yuq6~enY%rm3 zG=DJk&5=Sydrekuq#1@{i)ozEZqsE(yRWZT7H@B0Q1)d5qumS=Uwx#&#vAQs=l_u@ z@dS*PV<{CjvavX+8trCmyLhABA2b};DtKFXYj5N;$5pqT+>zlbTfpv+oGVm%AZn^pJ|Ckf4bRKhHbH}uK|neq*=L< z$1nnamDeKlOEAsfFM-WJjflE|`z3I2dU>1O!2J@~zeG%xFKpB^j zz`kk#4l*q=_Di6QYP&6?t`W54dxFh}c(O#8mcW7Kj_nH8H#BTmrk5iUI16jFo$H-~ zNXUzkQelVfY^5K`=f^S;I+G+>L?m_AJ#BS@tS(++MloK+ofa8NMj}&9ssQjE=S<*| zM{g;M;oFtn46^4ifoak35?W{mlV)7SCG0cvNpS{rVOqwDi+ZzN?@c#i6n2!=Ro9Ye zS&LP_Pb6*KS~TuXrlsmytojg>cGb05b>$rjDLdXq6J}q^L>SFj@<#p+p&7T1n)7#4 zbmZ?x_`63aA5W0$38r=qKojo9|xA)&Lk!>(G_)>F`K`M(txSA zSg<1tcE$B1yvOY4WEbRm3bt_vJGaFnpDAHHK$cIVEDw<7d$L$L1PLRZ9KS?4(#df| zIP%G1HhQ0;1^ll7DB^~X`-Ui}D2m_)BDnj=F76@-zt{WB+$4nr z`27C+_7BK8=RGrLX3m*8cV_Nf&gMhuY_&s>0sQ$p1O-0A7r%E1db3(x8FwL0@cw6q zpmn-{i=5MT2pWR~3wH>b!Wt~!A!wHdbX8G~bSp*sI&b+&&^(4g(UzK@?OgklpqG&k zG+v7z(D+CEfX1h86iVrfHwv=<@{^#;b{Ym`$2B4y|Z|S zprsqpGi3j6hoGT4kN(c2or0c5%H}%-y$^`}%$Xf$= z8QB9n1>LD(!<>tE3QFB1$obe#K^Nl3b2|lHy-ARL^G-o4G;oS^Chrn-?IuAT&fX=+ z1i-mV(7PJ&i|BCuE2q%vG)OKd3rVMeBj5*)9>MsY%r)0P3Gn3|9}W; z!Uv)sJ;;&<5b)E7nY{O7K@R(HqV$@sRD*Kn08r;9FLZbi1kj^EJpu4l0FR&$9P&ko zl~;$5_ARcwqdy=an$9a*qF#VlaVKE@0MMtk-$j&u)z&#oO9 zt~{oOT|4O$xVC$jpxZUy)7%IooaV9Nu}EbPs!6o+FCqsh z{}z5g`AtAVd8}xp5Rvlu@1X;cec*0EJ#-#Zgfp~T&_0OlckC8apau5|=aSum4xsc8 zb_+`SRFM7i-GXW~V61fhvs+M$PX%>oyGPJD_~G0m=t3Yb+au^sjr>43i}ncW`YHMj zg2`I2UJ0&%fXH64N6>67nkSs&_Xz6$sUYW~J%R=!_tkp@{Rg?fzemt=jhri;`}PQ` z;!HS?7qn!V;G{w1@#r2wcUXB$wDR~wBj?Jv0TkwJ{h&67HVEa(Pvb$2=xG68p809S zm!D<}e+UeA=BL@fAO95Z#?VS8UWJawh6dP)%IwzD+KQS>g{q{@fT6Jji@s)R2dHuveZ$l*p!iYSYr5P<*re~6{|}l6 z{j^Ot&vrpff3NAUG`&mHUu*goO@9;j!I!Jqs~cAn`$_X?q^jo*RnHwD zBO1C}INR(MWPT>ddEs6`69MhASI~4o<8)W0yUuiR2sxiVX(ARS6VYiryq^Y>Sbz$s zK#n(jmx5-CI1NMRb0GDyi{iWvjtayXu?sXmXq|>I-1a%Y|8Wr#H^=V)U5($Z@!RF4 z8!$k(2jTH&D(ZSgbybuB$`z(zh^ajwRFGYVTpk3Cv+85GRi6ME@QZN{~eh*eht{aW%rG)&2)}PyIaEvvWo&rEF2>=z2oet{~L*TTkfPZ;RD+oW{smik7~wtKOYqxEHQ@K!if8I0K$p`dH4%U!}WT^gn?hbuKF5rni~@5D1T-zGBgP0CYf$zok(#M!mKHZwSrka znKfIno?=!uSd?^(VRmeM8u>vQFT^4~j(m3aUa3^@rPajhM1ma$79Q{t!OVpdhZcr# z&e0pVLh2YP&U+T&R1u%`6mjLn^}euC#{d}@0Bc~eExuT9+2b^6(y<7)PaXM${jZLr zVeSd!`1m}Z8BLUd*Qit5WB^=wtO9%r^3rbkhA+&n57?OrVL5ey2rA}AGpjvyW_{g8 zh%*{}SAv{+bZ=B(_k^(60-Gg7MGLG;fU%0}(VZ1bRGU_XG=#4hXKqyWeu&dy zeDpHk?c?-I?>JT+1u*Iu@TH7i_+~YtKM;0%-M5-#x7lV_68`Z>gLI?}@91 z%RTb45~Ca{Y*xTfd?4qikgFe12gBz9N!QvDs)?p(m*~N8ec{|Cq54pT;qhGJarFw7P#1Hg=?mj(#v6O3QZ+bUqs|;j z3NjUpQHDG01q6xaVl?xSV1keI`1~Z!E=fzp1_ialkHueNU3ny(b7fj8Ee8?IRFah# z=%Ryve8mR^OdpA1O63gE1@~GJWgxV88TzQpO!#exH$ex?Aes(y)_c&d(nW%$5%n^l z6?Jq~x~MA#5Q0LPU~YnTruzNG$tYK38ZMHxO1a*m3tF=`^8A)nA?l4tWGD3Skzh$g zjov7c(oM?3kCxj6r3bpw6=;Fu}#IN(90D(jf(?KtS1q9V>a zX8Je|dSGcGqg$S+MOf{keiptVb}~Iq{y9qZhK7dN8#<4Zpe#FYP|nbtY}Trwpl$e*nq{mymX`F}`LI3z1q zRb>7Ntt+OaqMWRfoJ=n5;r~NAE=|Q$FP~IX=UkstP}0AjO7hT2l{Ba@ryxsJY4k}Y zC@jj!>Zb$3Q%|Nhf#<59R9}`xZ1L(7We#5~7*xW+w~<5Jw+FsKURx`^$6|w02(h7>NS#{>css>!$a51@19C;ZR0%?4o=tO zH}0mo2B1$6+#MUAH`1V6p4*FiL7&psybRO|@bSuR5e4|TrdD7e9uV=n8;OA^htdOP z(Cv4T0eucZ2e(=tOxZ37Cw0RH{Rgr>5xO`WqyiYn5U^Bw@JhgY3p`ZgKghoFtGEGl zY&EhAOS6@8%31ohH?Inzy>OsWUkU1>+{O#PX#nl74HJ1$+$4|@A7j@0Us=mMoB?W^ zNy0m%cPjtxM#2l#DBVY6c%|yguS9g^^of|2(+VR%PcTHuv68B3$9gPCxoIJbTYin_ ztYDDF@%sv$K(gb`)}8DNVHgXaz|!}oop_jd?%|0poH`*(054WN}dk!C#% z)<`oL!oA0|L!jfo0xx1FD(U|3t?H?=w4vTW!d43c<}i(~nOh8!&EWyQ#%?`mz0H#BUok%W zEOPL#f*iN`alDT{Zvj1Wxc3yzQ89>&hLI@Doy!Sklko2>1n?@26$nonQh^_%zR!m(_)#gYGwz`Ox&DU z@xg%5WP?77+CxO$rUwSxQ-8A>uLrczZP!CJosX`>n0@_kg3>Jyyb}I55**$G>V-`1 z0;%1xn_8$@4i57@AEF4A?iQrGM>{E`6nh5lPCDG{AS%OaL~;4NU`Wo zm|{Zb3Yv!NdMnPcKdo(Xrcl%KOdg>hi|96!3(y8JQ;nkOKDwV_&**Y}e!8EdyO+U0 zytItR@i+g(>sz!)lp^#xfl4~?NqtUhv_fm7b~!(aXtYAaG}j6>hh^M}2w+7-J@pR7 zW@w}A;B{8-YcQbR+pOMCO1;-kq+Wlw4_!&k_Sn?I$oJ zHLpU&OcI-T;sVhP1iCBgR9jfM_%D9{Z40;Xiy+XmTNwN9UxL^mf7S;1v0#gA_IJc0 zSxf;nihQEPRZ(%`PSCZ~VVmQ1UDusfU3YR_pZ`0yu8Q~D-&S4KTNkKaCW)O~9T43> zsJd3VXgAla)d3Y<`TVq-JEt=kKKh-dmw~Vbo8LL3K?ekNWar$)n#8_K>OP={&t|&f ze+uV4Z6&>MK#(3Dc_2Mqi~mvL4N>t4+l3>VLciM=rsfOvI66^kJDA8*^ZyRuB~BIg zYL@#SLD8^fqQtPd2s}MbTDa%`v6^rqPyT2%Y`=1-!8P^yX^O;Xw(cLc5B2)q#~>``NwLa$*d43q*#O>es$(e76Zm~F7@GE~s zqDzpd=!q**DLs;5k+QTv&>WfV_Xa#>*rb~7ckwHMjY5NG*N!}*o|Xub`J6}VnS z=%v0IAKov5xhHOd>oXaUxZLZzF(77_^r#-m2?h)Ndc?BZR)4N`3eo>D`=v*vF@wQ; z!-Ln@Ojmz=?8R=|c(Ms|eIpHz+m*x3M|RscCz}v0UE=rW`F&Mnx9vaKWVt@RvgN|6l!~bMMNl`s;l^`|5d~o_`0NQUf^-`hC zgSa1%HGNPZw@Hx!OwoEGdQeT@_NTi_s?}rsL&EuXS4neu&^$_sTA#ZP<&2@lI-FY; zDQFoNv@BAPqIE&bR6*&ZT=W>@-q2$-J;st9hlIMu{&ua!Bf`0>tE8s?3bNxG`>~p@ zudz=9AJ^DV2@qWoxyJs=e=*XNJuOqxT%F=k;lxe(*F(hj+drTMPm0L>_GqeTQx};Y z8cUn>3u-T8nZ*dHr&fBIwGaG@3uujC6$Su{dC$Mr+^0ag>MwHziJz#7Jw~Y7bkTZ_ zZ=?@FI=$n+{xZcTj%Ds0L2GG)pB1_e#&HCFP}!#aC6D!RvNKE zI2UhjPPHsR(l%P~rAoTeO8Pz{ko01W*rAgCzyj#mT?-B=b_rhGP`Eo9-84 z5kB0}PIOVDQ9BGry@iAwbtTabeoT(5M)0y;8hXfw?6{l(Bh*(vE?`?91wJ)vY}LhP zzz7;)e~`nCOOBG_8qUUu-l<2WuW<+Zxr3Nj@2JKKke-l_MP+$Bm_%byG)~6MHMpUO zT0b;LP`m4|<*W)uoXix%>6Wx6vf-CCB%Z7Gm4u*X%&r~jGt^0~(KrFn&~WHTMB?_T zyDpWW;qR!#?=!h!EXma>GcWD|L0cbbp&07$DmdL0que?dcch78R0fTT{75qOr$t8{ z3}kiljXE4)Mve-5rl)+4`)sZ8%NGZVT;!%X| ziJ;Mhy~j_V@lc6d z_|zp!?Y(+|pnXMiEbB! zLK2=EZ`yxhDy@&?!q145?(x%b_}HgHQhK$U_-(`OLXyK!BkIkN{)&;)F#;T~+S57& zPPFcBoFYyBpHL5~w?|dD{nP`^C|N2MZpX2@UeX%6Z-?oz3ion{XGx{QWTtYZBu4{^ zbkm(sVwjXfj%na{=|09(gB7bqPF;nk*5&q98ew^jTcyM(Ct4x?`l}g@ z&|0nF_N|YorB~U~gPA?(ae*cr4aI_&cB7R7)p-M&EruSro9#)~WKUyF!hUM9NSA$3 zh%VYD4>I<5UGPCJ_z)-G?MU%ZxZ%NiNrrF5$@T$>kHf3acnR?qM$*~iS=cS*Svl&G>{sOBaNdHQV z8eao-RuI|HVa{+TP{d8#DX5zGU&&4U8`=a-d=PDdCT^D`iJQ0+exQl_;s=^IF9{um zCcaYVa#(W9UY{h1TXqifyjsK6SR z0_uF9h%(eML>Xli@GO!PWfU``X_RpzGg?L&d9}=G7sK%|XEjAx0p>Ks6kWxfX)&BU zKeN7xNtPE0KVrD~Mjd+!hKeIc)IB%4s7j@{zlP@cVUzY*zV$ZWD*&Z@FE?p>O@wjKtB9`Yeyz2r;f&;}$f=Rgm4b z<$bmAf?+Zyi%P_=@kRJ(`;Pb`Kh}Wai=gh`aYg;yRqimBfY!&;qyURNP2-C4va$XX zU!=ZbYqy;hUyPNY_!2MKZ5`u_P`j@2MF{tM#ueq0-F8iU37UUke340ZTVZ?=nty0q zQ315LCB6u{SH~COj{3L~G;dv8Ng-5kh%Z8aO^h!>t)|5n!QSS@7rDu9TM}P{S}l(+ zg1xPbFCx3`rMQw}RBLs7Q4QH`>*9-GG8^NIpx~Ccq8s60aV5oMx9x~4$%C8hk1whv zyY26|q8nirgzJ%rj&k!G17x=~jW0q2wu~z(t_ZpV{Blk}k1LJGpDdThK%1NuH+5FE zAHsI=g+3$f_qYvT*+91$^jCT61JzKZV|;YbD0idJx+V~NO`qF~7-@#WEWakM zysv>#I0UmDm;m6dMP&*TNJAl`?0Tb`?6#o^5Mcv`bxVAy>8mn4F#qcK@@m6f6RNEN zA`l+^rF(Ax~E6p~1h6|mY zRqhYEtK2>Vrn)2nHmJICc>-~5g%RSsJmrS&^_B6V)kcliz#x!Fj4oZBKxhX2H6~hQ zT>^kVXoS2<)s68Xey`ULqui1}90;>fe-mF^>oeWh%9gy$u;ri;cB-(z<_~q z0Rv2buu7RmVSIqcsPcQVkfO`# z5&(R|4UbVa!0&Sb)sO%c^w!o?128czU?8{hv_!J1T8snp5{ccF?y@3(wcA%!kBTly zgsb)WG4d@>AP)ywioP_e>=!-bBJvE_<24CnSjDp22F90~ zfeQBO!uVphw;W^W&;(MSX#~r#5`4??0DZ}Bt4;t2A^SjlVSR^gUiQB#YS+n4|q z^kXh5%dQQE+#?aRY&kx#@htgGe6X9Xct?DppUr=N0-+DH8;`nw$43O=AoNkZfg-=w z6IOQ8G`_sv@OjxzTE>+Z80AJ-ck)>Y5LIRQwLX`MS=uGQ_+0KtT+=Z=#vD~vVz|rl zYSH9f6JaoD_KYvAK{H$vUsfBchA$3`FRgbQHKwnstgzOosIE23271-WoWi*9K~>cp z><*1D^^|2-yLrUBB>})yHn7%*Adfq>Iw2}IY^Y!|kPuSf4~DBTU6!lN>JlOg&7hY< zpoZf?@GwAj+r)&JVt;5JIz;F88dd}Dp9}+S=VKW#L?Cg(=D>8>0J{&yzJH8l;rdV0r7;iu+HoQg< zu>saV5+G`WMyMJW9oua!<3p;Apo)LaN+cht?73Zhx!dJZKG-pVyvjEu=ni8G$ZqSJ z0OPARJZSKq@#PUizb1h^Xp|NEy#bTka$o{bz294oaj7uA90RA0B!|XF)O-A4cUgf^ z#m|JdBmf272KuZzuDHagGCY3tcp#Cy-0<~HzX97sQ#Fk5OBSlpL?ez z0Mu~x<|UAN-FUWHl0fRK3ZWmDCluErcwHG^YF=J`{M$xXVw3XFLQ^hYidWJ zZnP=hFfhdMRaB$!rU}H@OfJiI^HXulxR@KvTiqP@oE2Y;!rR3a-DvoXa^qGbSXMlu z)(FBdJH`bLsdk6WGIeOcZtEHsgB>Q`S;mU#G<|Opc9^64I)R`+UBCvx!C|J&$HY;^8r|yVFAbGahsH!KstuF2| zai!nm!bVKbxRqfkT;-a?V)(+q#A5hDVL~xBW`-t~Vpg~%t{9bzJV!PptXgE5uR3ln zsNVo(XU}4WjRh9E1=5Vt+L)G|C8sh<@3KQ^>56Kj<=p-E^uIQp8JDuGEW@ zx^daD#om81#ZpX(jS|Ew(Z>1~d)yT!HPCPR)X-UcRq$E($oYLqlDc@zP>ATP$|46n zk|ZfTIFinGPisamfk5@?oR_9HqkSNC+n9wl6~Xg<`fPRf7WlF&H3lx=5$H2qz+Arno}?QXj#;p z`T}`YGSQtHdB1R8o=kLIGR`e5n=5IY7Ca!FAI_Cj0s+n@sd~c#M^mjj{LxKxQN7y@ z&31ECcRoiu8nlltMZNApE-DMRFNC4V??Yay$H&klsSZe`S~;e|U}h#u!bjFpk;N+@ z%1IILCrffn#rX|4HG_037<0iGt}cu{gc3=Y8FE*K`}s%tRB>bJU0qx&tGHGuu6+u6 z&QH_|IbI10-|uBA2UMjy7z%4~X$rd4?+?=%K$|I&94k?NMYY@GqBFr=lxh4*vJf%Q7@|H~`b@ceDBM3g|<;1Vknn-f2 zh8}M91&FjJIAgU@aris$y};286L5`ycB);*(T^#r8?LgHx(Z5_G*R7f6$C!Z(Xt>X_V_cJ!&$d`3`JNHySi`pc#oaDuQ}aDqS+ zrrA{!PT=EWxuD8PQ#XK8)zuugT@tQuQB0u{QAV6viV5ntSh|}gan?b*r1asM7z16E z`9(D4%T$!Q69_jf;Qs6dt^l2I-Sb7CeouxsvXxv6kEfJotLWGag9LtTn?(7G?kw!^$GGdkw#g^xSLZY zIj%xC4yX5+GYOo0#o5Z7m8tL(oUu$FPTw=@6R@nVE)SYUO`#FSYdRs-ev{~J?Zo>d zYVKz>shLu9Kj)JHsvJj5p>%#T4Do8d{e?N#H)u3ArRh<@kWy=$9E>KHV9 zF29$46Mq&th#a#4bGz#3Pfj`>NmqjB4_BK(`ir^Cnz4=AZ@yX5rVx$+6a6lnwKq$8 zv6-X}V{Vr8IWYFAH%t0bBmTn092gBUDysedkXZ;1R5iVaR%yc?hcArrj6P1nu)jv# z45D#-)b4bLB-B(P*H>ES=MV0sB(*H+FTMYMo_XIpp?$^tVGDuzqw_n3PJY$H%mHQ ztMr_7o;pm@_01(Y&mJbJ56#?9JiX=ymFpo1F0Zav>4;VTE zcm{=8#aR&m-A5axx<5KP`J<%Ika=YC{~1(d^8Xu@ntO?(fu=1QP5x)KkmM*p(J_;M zaSJ%1a;R!O`O{Q5&?0;jBs%Y-^wBNUfWbG$F9c!D`;Vh2RW{H2&$Wm<@2`al!=Qqm z_diAPjvB?`d4C5uS|L5}(=_@xMd=fr@}ZBdrP7C|{5Bx0DL)HD?390JOEtOoRWqob z@}JS%*eRK({4ZKca*Tvp@uysIYIJzyXrL7sY82sUAOkcHBODD31{sM4DnP}VCpj7z z1!1FT;9hVVM+1+XD#@`N`XN&)PgHCwgdlCA5i5^aiNN zL_Y$QYIr@-k8Z4~HPH{(bNf9?8#U2CdXzRs8gL#^u8WcWP0CqdenZ^^!^+4XjO|KveEQ@TB~EHcU-+6Grf0cCCQPCq_NX` z-&SmoJiS-e5m)4K;4p56l*5qEm0+4R0m8FB2)j!M?HQk7IQ_i|9>);#~; zR`Mig_E%f6g{ql-EeLC7{{e(GvtMw=F*AF{FiCf6-RDZ@fMJsQoFU0sG)&TnGcXqd zFNt~uVejrWenO2(DYn6e#pweUkfi#u)fpSLT2hvPJ8r>kVp#aUL z`}E`-8wH?Q=AWsWo@Dk2d|;xdnsNNV36;heryy~=+{*k5D%sCC(6f+$5Tl&!BlnT0Zya5YxS ztZXtmb}ICT_^H*IksG=m_a~4@6KMf|h^SkCEP%yeaU+8>L%l^G7HO44#ql9IJ{O6x zA|51U;uu0ME?yTqllX=Cs!h!(txhd~wRh8RNie+j!>u3H^ape3SXCv<%AXOcHUcKDq^zw7x4W%fq@q5CEu>EAZVg z5fEu%qS=ESlvYDjh(>^Uic#PMjG*ZYlel%DgWA{82>w6huJRFoOfV+f3cnZN>&$u* zeYsrDs$OLo1MJwz=XaUTjF3@j4m90W)nO7J2$AL^Lhf;pwE-7viuXh{s=cRLCH<7& znrk0yM8?S@WQL1WS#Jy04rM_*{2w2mXI6$utU3W)HD*w~Rg}%^cj5~XZBsOgFRbd8 zhIiDs#5A8dO8sh7w#p2;VsTKs7?V$39C&}X$8=`Ypvfi6(Ei!LxG>U?g02mN!VHJNqZe=$Dl5TY*lQFWFi`-Fg`t+ndqxeT(8tF+O#n(XGB zTWO;MK)vvJbJ|f$bOsS^7S4^IHz#>EM>HwV1|*H9W@3@^!+@k_XIo{3Q3O%S=K)D$ z$RQRv_Xi}kipa-`={XLBagpkD)XkRVa^VtW8jCj-`Oc*oxR;G+hQPqw=4?rk&mYX- zAhGk=lI*|S-kg5cs?QYmQ}1X_2Wr)ddxkUfj^=bFYi!TIy*b%Nsv6G~cK_|osntk@ z%j&S;_U4qwxR`c6O0jIer`GGkV1_l}B&FgMDY{e=O_5M>NUVxec%rQY3m3&;7zPf_ za|f6h8NtA?{xldBoWI3-$Ew?fTIc(uv*{hpX*>9+osQgrwikk<=k=gruZ%C3U!XgrrmOqx%R+7oCg15sBOB#6PLTndj=n zd4MAE5d1*ma{NHz+mM)!?T>&CplAZk*RN0?Q9W{mdu05%cqS$~BH_kUK}9>`2zSOj zFfj~?BNF4#gXc=Z%i0KR8f@r`C(e~*?=wPDPpx=^%{gp@r01b{kR;C0%eHoGIz3AuU$l43}AH21f;rKqgJ1bi4?B zbmKD|s?$9*&Zd0tg(R-q3rVQk<>#rke<2BNUldXKg`^mjHIW|h(Hlt!D%|Huaukk& zZ_-PQ3`1MTjbQm`brPoJJHWE%2PIYOn!S`n_Rl|SPJT_lmSn$ibaSd7Mbwmt26nn@ zbaNu-y`!7cTqGv@xgkjn8vRC+^XibKCFeAq1!O^7JuyeA~-H3azm{M$Q^ZcZz7Ca)(s z2aaw|XS9*jVeshY)V7TzuGurXW_2+&OXs5E_mnjY_xA^BGOvl+FiWZq+sqx-wT$VKt-Kpa}vhLQZU(BHYdSZMzoRScnMuoNndbp-N8CUjim%nOxDytg{BL2W$`aU zbP4-wh<*_(avU_ijb+fk@I_0M9-?3Q*Hly(^ZlAp>fYtQ1W))Iz{iCD{-{P1{$?&e zMghFcp3#-=BY=X*edO)J^Z#YR*Wh(|%_wB32N1BSYnnmdFn?)BN(ao^K zzuRC*Mn{*!aGL;bh)%cSP3EMwmAJWzcP*(5nA5?jrb_%iudO8e!jPmdv^foPz7~>n zA@0y+{x^;I8Q?ckRRx7XQ?GfJ251^hkV?~^(a1zUi`j!5ba`7f75>cO`oOl596zBI zs_7Swk_}{Se>)`Upf2)P;ruQnDb!X{hg~5_lkwv~NYZRe>1K7x2R;?7^#hy*YI9m+ z!J`nw)!QF7!lsJ7r_<&nrT1hhx`c@)OX$54de?(Oi@(uU>cMU@)07^d`}o&KXw^EJ z%EZ?o%4r%CKSN!6Skl>AtJ%`oF)ZmwTS?BYVM#5{$JEp-Ea?J`m?ND-!jjHEUy`#d zEa?(PREJd)!V2a}=e=P`R|7FKEU5rLmV_k@!;ckVNxt(Xai&-3OurSJ>74)|)B8A6 zDArFSz89?613*Brrx@{kSW>=5d@Y=xge9#4;>)n44}nnKcD;tom)vdJ&)40y7eCN# ze?uYkj$0#jx7pgE`Va&g3r>MRWqzBMEKr%B-A-rj#1CZNy`47X`!rH#el_yo%ojBl zTnj;Bo8afG8T6Gli6zP;mas{bwp0DEguB<(&N2x_!z3PJNw}S)^m=-jiMv6R(^4j8 zL0feAGOg5Os>7GI(;faCwBx>6sSzub(X0gmee)?JU=lBD#N)~&egFa{@f&`?By8;^ zu}PfXUYo?bI*B%k4gkO;E^UvlfJtoB2yGJCK%m%SM!+P#&%#9}1!8|IkR?Ys--b3l29HJPU!!yh*)s{-;#ttB@y#i4FLH%)hWQ zKSv{V=06}0&b(t|!OsxHGYP}xqM0;L+ro3o7M^2U_@})jj-ZI1YmR$oI9XNEyIJd395nPrXYf;HR)JJTXvu!fuG2pH%BTEl(Nx&s0W)d#eOJE2Pl zN$GX8fr)+{RFA~AIk)a)t=k6Gx&<9Df7>E)>ru~u88{l4NwcZ9ibgl6C&3MJ+yDoe z(4mg>3j`nr8au)f&D zQfmKNUqy6@U5M>H2VR$=DQI-6K@ zIuXqiq8;|+3~yKZx6nbPsZ7Gsj3w(v^9MUfqWbg1=JAqVL1ToCV3iq09zTwkv=yuh zZvgaf<0b8iw9q_WyuhrRNn&2)0L&t0|AT%Uu8CF`NOCNJuT;|mEbesydMx%ygX2N0 zt@2vXTyTIxh9SJr{ZAGz>4Cav^8L+W+#+rFaB)wWjB3rmVVD`>1 zM`T3o#-mpaXg-a=qYV+RU?mcZ1~};E3nXQ0y!tfANp(?Tk3log()Mq62dxTkSe%_21`@E7_+gy*doW^P_y&VZ~uLaZCZ#(lfdLHYSP1trXuQ8sQ24jP`aawx}q#pM_6~Vd^ZBqpbdUgR)e+~qAc%Uklk*weq~w3#km6txa>2dlH$_7v68c*lKj%VSjpK@$>7pKv66G5 zlA@gaSjo9j2^5Rb;Jm10P*JR)O;j+nv7~KOQarGcYUjsF8s*k5DuDt8gGyq{Y9E#6 zS>2Kr!_%G6A zE_Fs(F|F1q%C$QA;uu!WV9u^{l$EDhU81Z3nw1e{^~>p>Tad$PFNtz<^73*Ei*uEV zU8DTG!mOekWk;DY+`dIw+1GI%-Hzg_oG*=XF^Xg{w0o3Um{XKHNV&#kQEpMRupTko zXknKh#Z`s%jB<-}@^iBXpRQ46}b$US7$-qCuqt268vN9V^pT|4uBgRGav_G0XvKv|HDRRic>h z#V~XGa~bc)vhoWD6{#Amk7XB>aeuNHzV&7WtF3HX7rwZ8;!;MK~<@rU77&rfg!i7PzLhZIk zZLSm{YD5q-S6t@By9XsV4 z0cVEG9W*P#{$PDpn8X)Sqy6+NqugVX_%Ve(x93s-Hh?ZTGN+(KP?hc2{a7NJd z`bV1m`9&MiN8lB#Gp;#ahx6x(im(r2`YNoQ^amxEy9won>jOlkeWJbJ-mlKXJS6eW zoS2p~%H7HYO6miqGb7ihnvIV`Tp`lDVUn=Y+_DC4R|-EmZ-6_}>$IC%tV19{m@R_4HgAj>TQp6aGenW!? zt3-*9ZZj^Q#0*s|8t$Z0;`v^TjwZ53gG7nFM<Lp1%-G;`tOlr@{svAi6T`c)c^w z2vz6f2u-2kb61e)8Mk{>mntVHRA<3LB-RTq=zmy=iw?iB*xXP*9(Z#rjS7>*hPVkD zxlFAOqYuVel*To}H8r7#!YLDMnrB161u60+`@L6YfxV{8mdllF5 zxjAgqVhq9m?dxa|nx}oe`ah-?jk4|7DGZIA8D67qK+r!bT+OT8BE5DaOX!%Dk)r>3w>P+IpL?;-9y+(~$81$E$#pVbS4XGk# zfKTIFmXB-F0i861KU5|rrt-(DU(8Ni>3BX!;wfd$$8)_%JBR(=@=)0CGeaakNjhOG zA5~!gT91ds=O->tkIxnSX|5NMOu`1{Afs*96|^+s5Y$P zP!dL@@Dr%)@sBb?VUATwqG^u(Fee9k1?H%HBR~!Gm_F8zj|*bbnJ6(f&BVeOzqLUV z*~}jT!wU+L*?*Zb>asi@e+8ImlMk?db|((|Ph=3KtHsc4BVbgx!}YX`VcRZ{lEmxH6`bAPa&R>}H4snqvENsjec3H6#@dY*xgUMPtiUx8_z zSN<HP{z{?WX-4!@dAcZ*ao&3m3ThB8evg`$aP( z73li?BAq2OB(1+llJh?^By9!8ZqAT&gGP+EIcLp~^aBu!W=Q(&B1s*V&5)FuE~&$F zGbEjnF3G-XhNKZX$xqU`cZQ_&bV<%XW=QIRAOFsfl$8z*IQzRa_8yh}P(YA<6>>%P zn|6lw-_OEmHi7Z?9SCtta;tp3M8XQCS==TKX+PI_U+F-=n z(j|4_aC5E=HvcQ=8nd2gt_>59y`!~gu4u}*6N~jxq8o|1HXPufbj*vi#0EEL*HIF` z6Y>a?ojOXgH<>AEp{~|En=@mkq{}*Dx9jqmk{;56M{LgOnUb#SD9IU^Dal|2dhx#+ z@u-b^u?7hA;%FdFx*dwWh6f)I!&|U;2W6FNj8)tilRH|Cv5FgGHfXLDt>Stt1A|*< z6}Qe)k=9YPZk;HBrx4vb{D47gYPa3|1Y_UhwEA~mQfZ%5ItW_z@4O_KZL?02 zRR7LPg7vrRWLdwWN%!LYN$AB3I>E^44Nf{3L`e79o1EITSlnIjG4D?Bs%U-^dVX#v zNsj)v@#)J4IhThZwsLuxQ@jAsaDc$)te#-Od!5kpjyoW#!DO(8*`I>#7!R%q?t12a z4K7>BRNc1sC$W|6VgamVPE-IZ`K^<-l0%Gul`PSSXOq}UnqLg>HD*g%p#>Y0oKt2? z>VB~#=j_>%u4V-6=v9q)IEn437zo%=1tVZbA85qVB(|ebEPx$t)q)3;*p4Q!;E~yq zzSn}~NzRS4B|XIg7}zgb@I(?D*eVnT1KYp|7}ybwcru9%>^l~0oh_;P?Zo!}auV5F z&yjR)gmw;^Bk5NLqCyvF!JDc=|Dp_3sCj2J3MzEDM!cme)Sd;XP>vS7p(>Qg0_a_! z1@9@nuk0*|_0D4i^fol&eWmv;EP&pAE!dcJB1fqT`bU-ci`h@cQJr#=&y|~e&TbOu zY`Mwj>?U`1mSi6~M^c?GWOI`9jyaMhbe7awkefAtlW3+htN$S911dZo2o+(81 zjZ)$pR$^L2iEmhm#hoQ$sdD-@2?52^AfvI-p(MmcZ-QAx-?MXl+*y)i((UYAKe2Od z2WL4r7{d1^!NU(C39n)N%JeB+@L?V-Fa5=7+IQjVp^4wr)!UIo_K)UBS{I?62j@uY z+(nYpHdj&)Bw-u*NF(+t8yN%yY^014u#v4Au}|4Z9SdLz|I>nBl_^X_Qkd{OM!*z) z*NESgDLezg3C2jZ$UqZlrcHJGgk&BaCnRHZe6x$y?Gutq`=rul&}b=|kc_6<7ipTA z$rvn?GbB0wMRS_LAWcffCxBaIAQEkP2U^`#M~fKP2~3{;JKjO;T@#bl^v?oJ|CeaN zqGUDwXIRreBQX8<)rk9()$|VpPydW?%#~EA5tEXgm(G)2%I^6Ed|R^w|B*XC8F0-;8G8Ewc?A{ zQs6%17;-0Eht{Sn?UYLEx?;?uw>jlr5Llu#=$(|MS*i4IS4oa4;0;=r@>W(VHP4hp z4xeIulv2<)mAZpPj@uOP+m!G7rqWHBk{r{)anpAxaODPY7J~y<{+@Mth*Of|Nw7n- zGsT{rO6vf885{ujF>o&f`GT%@btA1#;S0K&c0-@xg02l(@MQ{L(A5P3O8I=Qq08{NxseN!S@Ab4b3ATY9Jb+bHlfhg^h zN@bvxhb|DPe}o-nR~*X{cXx;2?(PnY2G;<=-8HzoySuwfAh^3bY;bpnz}x!^-iJNY zr>3fVwx_Flx|A62q7YGX7NwGtzi0v?(64FBtuf#?^T~+Q?tRXK4%)YPL$6H+BtvKe zY$mLm zU)!ap437xi2D$0lj^y#pqu7i|ehoxrVdE8;i~@mv`lyBPN8zc_5>Y#R!90%M5e*wy znnMYu1j(D|I?4CL_jxQs_%Ad0l1XG!8e2j`>r@Pa5!18#>I!=_dPCYf*PfFZ(`+Ny z_H6}@U{RL|c2bc5HwT2!Ym79bhR`cA;+!&zRloDH^6vz!f2O~Y%HV9gBq;LcSMCDK z47FDFjL0U|s-Rga*k??^mo^KbS?C_wSr$ipm?#Q{#bP}*tW*%7T5iB^{aexo923fJ zHcKs!9<3{Fgjn2`4b3wre;IJ)AnJmyk^N>=c!C`@>39kTf2P=RrSy)PRE!;8U)Z_R zznm7f$;h|=WG8>Y8({mAv2{d{BoP6SZJG0(F<^OXK`(f7;B@8$oh{vkFs0KrMX;kK zG-R4eh(4gRtw)K|nGYo4B#+|5C@FZ2~*nu7egx`9)fU zRPih#EgG#u(5Pp1i-WD02&=*9BSc~V%nPoI`J8}^%ZsBffjy8K?8)RYIz5H?OZ zUcQF|a&R^rj-C-q!o8TLiu~H7M7q557V0^kl3gR@4JDpKz~8d_e$VjgNxQbrK)9^@ zexWXS2$ax23m*(i>Y#+;-py=wW_VdX@kfT^TMK$jyDX^RZ3JA7pQB7QhQY|-JTeZOtZjvJoZ{6I6*zngs1)a;5 zgs9zAMvm>a`_IGnS5}Xc+$8=?z5mj}U-i73c1eIG45A@51whupeAxP^wtLpzu5wD5 z>iLUy5$B{wperOzl08rPdsOwbSU*?S&p#T2A4;-o4zQBYH=Bm@rrJP(F}RmYqu90b zu-BuWnvp+Jh<>X3CsIAGHqWL|K2@3&e(Dl8Zj7RHg1U$VDY#uA9xZ|Xy*zdka7?9Xq3JsgOQ(u6@`v42#(0r?*pQXd* zAP!X`!&pz8B`Qs$Dw~gg3mwoe#2It>Z%e%Haa74`&6McO__FJva&x+;!=4C5{Ttlz zL+}%!2T?jD8d8+_m)=wIZxX_$)1UNx@$%mCt!nqnmgE3Qo*QXJ1BV_JwGG0l5Xgj` z7vwC@cw>I16l3%oY7y5AS|HBJsLcm;6%ZD`HmLJ!K)tJ)Cr{J~jXJxXfI+3cvS)b` z^GqB3`mlDdmfrayq_C?Jron4&)__BK;oA@Jc9(fU07FK+Td~?`MU=*E)BI!)6bh2w5jAzd7O!5O8*zaS&8;au1rXau@Ka#5qk#ixt0hU6q<=6KSS-xQ5)=G07 z`i>uI2%J;9mhko&rGijv^$8{6VA$Tdh%l(&^6R)P9Rp|LQsaA%MkAiom#TauK1Yv;yXv*OgTk0TBKvq0@NY)%G`2Be?>_A!Uy`U z99slXLqG|OT>B3NEiwFrG)=#!nx0o|)8*ZqPIrZobU*e1Jj*}_AIn>NQ#}nI$;(+l ztstaX4`o~Toel?`y(W>Y2DOK{y!ilpbprByBoJ5NuH>#$lR99pjiJ&qS8awigGQ?& zX|YX~k)(}k-lQpn)l8Pzar%y*t@__5jzz>(Uq0Gn`icVasu}HifM#I_)vQxLiL45t z&zE?esS#N*a!aB0pw@Ax(wBtA1$OgU=%NGhl=!XsWvqF}f6LV~Bbh*H;{LK8lJ2iY zG$G?H++BHlF*91!s3>F30%W(;l4#b86CWW@>uBjLF8@T~$Oo$}s~*Hy{Ma;Vs3ke_ zbbz$Pl&R!2nbb&H_!*38+t6=VH*hq#7J}he9B;3(RfX1WvH@9*J zZEyvsq2>iy)o0xJI{kA8+1JR=)|d2LI@8GH+(m3)(o#^TBc&eCtvWowdlhK29I|LW@z{#%$M(wH>}M9=J%CE(K0?ZYMcTpJ`N!QQgK# zS0r?Xp2K|5FgK06`oI__qN)d*@wqLa5N>Zsx(wIPVm^M{8qa5FWDrQv20Bbz9WAF> z2@P!K$%}czFKJXhK+u|5T61_1pxj{qX8f?pA|^7;$@r3FskMw?Z?GB=mP zCtjgfhG0EQRZI3!%z;g2Zh&$M(IH3+EH6FH5x>{0IUSA9y3c*lU#D;oYzAypo`t=^ zOazRWB{!swj@@0p&bITV$^6IBJb?FU2hI`)Q3;dC~5b@a1w%d zRGi6^6YzSs05?6OG9j9BTY}SFFwsFJ!{gdVf59DA)S$)nAf>V9iDSx=@Q{boopM0* zM|8mzhwOe@w?W$M&)CEVJi|RMe$-U&{9G&jeY=kSjhDmF8j z2PXNgTEdSv^p!Hd-4+r>#Qc^VU1(UqFa05X6yGIwj7y|D@$W=6pT`rya4G8l0~8DV3T) z<8An~-Y^t)KXHFRoEkNH<-Z3|y8XPYu&!HH|2q5Eb-M0}_J&@PBhsHxVP56ZQvkl7 zE;q2gNAqIgXQ|k9Ra%-Q1zH9H;Rc zAt>Pr87zBC0;H7G(p;cG@+Q?yET&q^;o|g+=XyaRm(i28p8B=12Ic#V+;nLEmU9X@ z_7LSwyTGcKv29ymO>d7kY>f<>k~Yr2ZA4?!DbXp3S@AYeDNZ$D7n-&mkBB`n<;a8*p%@A)_emaxFeoi!K- zmTb!omE-bT4t-E75$V1pL*qdU*z~_EdNN~n{)%urIJ^Cr(vNw;YxA}_30GWtO}>D; z9C}UWq#S-tX3l{~*3Xl+wH-*-S0-Z}H{*bCS&t=Xtc=Xkt>*GIRMRX6qieu$2`-I` zP8QEaC*UupyH)qL2|21-R zp>b^blNEKYLEO8eY~8P>_{#U?hGQh{se!n{efTdD^zDal(`pnlJJMNRj{PP#@Ecg3#?*OO7v zmP0Gu8{Me04HpVdkIMp^Qhr@migM9O{Q`7{GRM`hK+)BmVK`0|o>)%?so36C%Qq9Q z&lwp6#&G6Ctnclj6vFd#pT(#3s(2mr5JYv*hNKP!aW(SJ-F*4>suGWZWgiD#1$1GR zOsl&0$AM*~zN)8sa|RG@8uXW4n#hdnE6(SX0xR_X!6Y;Y^Ag}WN`|8QN$QP=m--jt z0#QOC#-7^_g~Y?$zm+heept#h9vjfm37J2-ClX7%4Nna(cgyp}Gl;?d=Y{wy0pH8$ zW|Ch1lFF)*^MW4`H)k3LByBWlKn%J^HR_2T>RKizL~=-0n#~oGpFq^BDqAuBhVPv2>-NM@z?rnidTz zILPF=G;`%=pGV@$JhND=EG+S}h?whv?Kk`U6x=j5KNf)PP2CY8!_pzvb7F>?9|11o z1WLM3@}6tYO2GS89H+0?ej&)>l88YtuB2gE3m;t1&1T5O-N5D@E(ntVI*3+R_Ie{l zu||u#F^}-#TyPR=wOR23@{;Pir#9pvM{$|#`8tmBxE6KQ6Ou46XJ#t>08Z&|+*gFa z4*U!xP<>wd>ctP(jXdMHF_fzfH$&n$cbnZ=98TeJ^_$lQ#c2LfCT ze+Di?u2I@nrOX)?(TF|_$5yS39UAbH{+R=!Y;QHWI|*&3(e{Dn{pJECG~*2u3S#pfW!Yjtc$;vrlCSC>-0HJ3;R8C&APoEDq)Urs}{TNksD zXI-aRljK zfX8FvzBeui6plB|!P1PlJ~uARXc2{Z#!w{n93b^XYyT}f;*F=Tn|i?LIaiMBpAzJl zzKLzoSWj^~N1sUuB5L9qXbvb+>h0JPt*O){*9Kt)U2cunIAMh>VZ78s8TWdnw~`IQ zQ&{-lbG%HRa+k4Cur{-q6L5@g(@PPl)()oqMm;C(G3XHvB&!iT%R6I}i~)!}HPExw zJ&D(eSj>`Aj`AIIumrb78-!LP5Fyfftw5bto`pnc$AjxuquL$9b<9Gq!h(oE$3~GB zAXn?X69-i64@N9!t=AL3Uu~I2sGCM!YcNj@deJH2c1Eb#Fi}FbklAa+Qfc9Ix&q4{ zww2XUEu~GT#CuSrxB%z1vVJWf&U?ms3*L+~eTTgkF_-Mrg4J-+!XRhXvvyYi(BtoN zP$y!!jTHuDeW=3wanDpG1neiDrt$WLeL`d8E3sYH*s-f0ZQ6k+loSJLcl_)dkysLa z)<8lH1|Y5lYm;5?;9o+xH(@;wcwF;2Og+i_8q4VTmkz8 zxQts&VXqLNh&;h4fPMZ}L)zo#CQ^(6kTkR3GviY)`cnUUk?1i2koiUE&sD_=&y8S+ z78ch1rsIefsEuH3${tJ^yBq4Iw`jah|2>?y;GJAE4HQ##oZZ)^ZaW^z$W87#Ssa8GXT(KmAI3bGsfvdw6N^oS7lmd zikZ6zC1pjMG?i}!!d8;-7B{W9ndb`06*V|@Q=OnJOxSkZvg`rmvS^+r_aKF@!hV7uaLqSSNu*4vxqoiu@ z%t(G7@H$Z2lhr?ZRzRk?LLe<;UP8k?6EdRYpLC(UDiYF<&tt*|9t74=6x@d!uQ-{C z6~UwlkGaqR#aOpfLLXSPb&QF|q$ha5GZADdM~QAkfJDnBLJnp8vRhfl7t;wh$)Cp4 z*L|pO;TfoUo(lIYKu?iZ7(lMkdkIWbs_rlRcuXsv6DQ+7#GE48*(chg6pL5%-qvQ$8>By^M4ppBZqkBzn%ZN;e;#x=r5!TaYr8)wvZ?Jk(tfvf zTGO-st~;!lL`0FuYI+I&4)(Y;wBw9RIiYuT^xYHdhN0hW5o*OUDV6TS3_}LB8SD+M zK(_3;$%yT^O7O^K`{V0pybd_L_mumzNAqZniSX24nrYIRqlVM65t3$Qc?XmDb&upH zyitE6vm3mu+Nm4&r;L@a{*ebHz&1WuJf9Tgm2rG$*6U5iJ-Lsk0y9kxOJxZ7O$H)Y zf!Oe{8Dqetsb#+<_Ewh;SbnD};z$MXDe=p)TxSrDS20d{t2Ss8nHC$?|Bn$=cbPWD zm0JHLDx;_XzAh^Ox?O~V?qkG>BMZV0b0q?vK1?VX+A&9<#i;9h9*4oA*i#PYNWV*& z^`CU1a>SQdp>PWANvE{A4(bV~8!Fj6-4#c&&3p4hejDBdCa~c@&0)I?Yz}QX7RZ}% zD5gA(^V@#SZFVHP%YSFz?aeLL#wy1_x3L%Oj~|pJ6h|q5*w9_;3uNb%R44YUcjGWo*5<9=!-Xfzapy@G~V z$y0|R3}|&&i7;GtF+#-Y+wuqL)vqrnfwcEjZXlDVZ@%G{Q`Qebkbt@s3osl(2E^=VskU`$QolWbq%HJ6)OfXqW+a_vS_q%}H z{M2;7Y6o<0S{Bas^jvGwhv67UV&)^9&XE2oiW;$*OG2?Jg0v85?RpXTqMYs>8QOI+ z9={S$)}eZR=f#yZh$e-cqVIU(4tF5?uT~(=Yv1h~yDvdlso$36kVc)4gBKe0X+Bnz z`Wv^*jQVJJ(|(T_g-?ORkf%`{mw*$a2dspNNhcjnxCKqz;S~=hpMjV-+4?G9n)gru z5ATX-kvRyS2mWEf>c-d(6GMIPXg-*=&Fj3`ce*UNP;}saE;Fm1ynS#= zX0~nB2fLGt&Os2>ZAlfo^T+qP9~|vOIKf^g2*}?P_29v7rhdWnaky}aO4)mGkjC** z4ul&j9fsUfF&Tk<+~I(bHrbB`nYRDyFm)QfV_PPfw(hQ zC9tcH=6VqfyR+3qILk8esCw+um@-5L#S~1?ITRE*SDW#g5sUD^BLdw`LiZuwN4Cv?AC6v@r^V=Uh>4dr? z$8G%qFQsVTeyROo!a0lU9|XAz98>IA@|S>!Zo$!hx?gm@YCVZtjetEI>36C+s; zYP82)#s|mMDMeS)$ao?~oKqsT>=&X}*aZ3dCoRcw zLg$!PODm}V+`wlHNcX9S<_JMpe6rLHwYtQE<$0C3*T`^Zdx_nqBq)14Q9^aeFsCVM z6`v)r;ZrzQsr)cy3b*nqSW{WKL(IiaO)IZ4+noQoF>3p>UDH~^{C;aNU_90KHJg`< z4`uMv^YE4dM+BaWI1ai&O^f&vwD(F0|9lG_Y>5{elGY_EBQ^q(jJ0eMn<_bDtFy|? zIS`eV2F57X47Bv}UC>u29pFV5rS21%k9Hygwm75r8@xr;=X+!PiC!E6Jr?nBdbOdC zDGV+Jx<$Qa{IJVXM=b$C_;x#?J*ny0jG5xW!K-qKoZ2J1!!n?{kXibQ_c?YM6wbwII)9U zpuYCbF5S07V>8r4uizaG-S7;p>)4JEAuOr7_Wm3b(8IDC!AAeKF$xi4HEY?=NnF-b zbgF~k84w7!xMJCFi(N+5IUfVJC_D$UR%WaOLC;xN@l<8|78S>wg4YPkBNBLeU z8))oYwD~B_ZyaB>{S`CLCxmeb6+pcSv?pMu>j@iSpZDvalvyA@KeZ&_5I`NRda(iy zT$1e7yiw?6kQ`xl1&a;+LixSDkMx0Rx^bCjI-~6fbf0{oe1{}6!DMJxvsn9r4ZV_{ zpSaY#V|z{^n5r$Yf91!P#1@*i*x|6DH}Z^-T19Uk*9vVX=nz% zRVRsNBj#xyZ>kAxTyA(7{c-$F5UX7|({6Y%pQw#0-FG=+J#>EN^KOLG z*H>=Sj|gh|Ct%s*nnG>aH%beZ$2IQuLv(CAGkH#yrH$p!xBMx#C5Qa$UT@j|o7;~+ zYaHTbhJeWvkgMqr7CPvWX9BgfS%SWq`pW?f{888h>h49C;*W}#4A(Q*8hhSEWK4s zJ?=(}oqRwO6VOhw5TQd)`w*OI!Jw!iR)}GNBm{mYVTn0{ zB=pg*6y1UTye9*?VMj;>yrvzNX4obzCgAb25Z!_9oXHHl=D7i!Ky;Ttx^L-B|MRAYDmhh5>V8d zmzH}69%Dp+-xU8E3ZG(39~lfDyTgkl8!tw~>6bsPNklFn3BSq6Trqr58RNYjJfWGVQI6f+ zy3uhB6BhgK5$maxtC;}{74vQ--Pds_K_8F1WEHBV4YqHOkKNb7X=LWEmAOC6nX+q6pqht>?KqHk~4Q-w^nld07ZQZv5T`HL!J!!@75!?M)(f9=G zp!GCRI1#ucLLPH)d@4z7vl{y{m`>f8cq>S3b(_J?>Q;k9QoAyXTUbzxpdhMQIQJmO zQMnIAbNKXBe?Z+POA~#M=)~CrkkO8V(#4MYm{1p+lfpF!fiz7jpkWyh)!4igAtiY? ze&;!6pWRj-l}gk+D;DHKZqWLWxG7&n&kV1DCu}WbmS3=3UbVp`P`TmMRaT)RnON+6 zSl@*C!%l-?rqJ<+pR`lxUj`JsKjOtjBd%sYL>`)^>?ujmgIK;>F?0dnOs%8KBNopn z-RSCTk(JkG~J-AG6lH5g-b{8pmn;UrbcWaN=>)XkrLB>CkrjL zUWuRD*CT6fPW0Nk-3zikkb6P68CEfho)yMnj5F=I#M_vi*9WOUPpgZks(*%B#%8XT zP%&=YNM_LlY}-ms0>!V+Ge$aEZx{zfXuW;DVr0y7s| zCZqQ^*W^&hQo1EcUYU>I_qmRfqbwj?j|lQaso5AzxkV6WF4)TN$8e9m@4N|Mc;BrJ09Po)+4QB=@~ zb6-2bAk0k(AEtvTEvi!sAc?j4y7GXHedLm<}gyDbK1<1Xqig6yVj=N9Uih)0}wf|D~5O1QyXgCzx zZFrJvY+w8edj>Lod*;wE9|3A;FP7AvBRY4)r}mGL{D=WV)IgEs)!*w}J^W;tq#}eW zFSlY#8?w|@vs^iEx~qR^6YJd1VqP|FeT$x)|5i$QBJ^?6ahDTB> zwh;;!Q?am`DP|FJKeHxzGCXXKdk)FT)kiqdU!_kT7%hBQTnUQU%c5m*70YL{IHT09 z`BS+~M%U%Aao5sp7M5GIYFSBA_k<_*!m_vqRKHXL-33Z@iqEhjWppH~Mp8*{X?I@( z4+!xE3w0>cD9R4jXb&^|681D)VoF(3(Pm}8<^BA26^e#3&vB8YTOZ;XCa)$gn2fo{ z2lEAlpRWkyD&dKIkV%&^(BwVt82Ro`TJP{OFbt-N1TdCBD+XjbHl>A&s1x^>$)Sf zh5WQ4P;OrOjj_ndy=_IH@H{Nfb;g}#nYB{PC~GJYffZ?`n}<B{DO-T@>5@3}eZCu!>GT98C%_^fbl5P9Q|5-PePvNUNjs)Ragt;IU$WrE5Cx!B7^_%rCGn zy(lTUm7C>&92cbfmF{oeE&!adVtQBu(>WV~DN^mMqx4T!X3s&=z2vL3w81IYa}axpGM|WT2K67^68Y z`D2NTRVb@ZAD~V2>rNjU2Jj4VGOJEG&*fstn>lme459BKMobV)T8Hp{r4DrDv3;M= z3~dxkbB1O8KH(7qPO^zTLNva=tHnUVQ7=sgysaC^VDMrDhw(fy37l{4Q8HwR3Du68 z>?a3>@sBoFT6%P$kbKh~Gf3<$hh{f-;m#O**o`Lv<{k*Rco>G+=qNj9do_xl+!y$`p52)>qZnQsTIF(5UHUR z|7Cx?ZmQyp8AZufQ=xMTM6JI z05FWqiA%;%ZsRjMuNi@PqK4Vj0%|W{A|( zsjHV)+rmp1A&~@rs)}CUH9a&Mm0%zYwp@yt4>;CJCyztE0baG2s%ahOb2bTi>+DJ~ zlrYW{XXf*vx1DPA=bv-FY#nWo1O(0mP;SK)j2^X>$e_Lgks)SBGl zY?4E!dPdF}drkV;>QD&gTVp0hP3-1!VJL24DH#bMQm$Su7j|#FDg7p$vINEs_qh=A zB1tfXB9)*HU5zAvF9Kv4#RrP6$bLlcGC%fRZ@)0D=ft?4Ld6F8!)9~l!iZWzbnRgW ztS#XtV1g9_u>ux2i3-%f5bB^zp_aj&amc`}>lf2roo5hay4qGN&4Z*9F*nXz$ir`f z#PMd}2n9nf`9dxc{&GscY)R1Ooy3M-(}uX*?YbnyPQf4we7gc7D+F=nG4!wQ{ss)OK*h+R;ml;Dh|t1{uL_*rdKpbAy+semyF*N{TlHoP|=L? zV6%G0id_Ho7Z1_J^xHe>4xqgEFy!FC6K-6uV1Uj2bqL4g;tOmnw()S)8f%LN`iQOV zyw!58>GwajHX5=(|CZHL4-ZVSvaGR?C;rDC&Eh(>&GQ4`XwDPA;z<1KrCU}o>2v$4 z6_;NP=)Wc#i9a}ncZ-$uH>fUoHP2ZNsvX~syvKWdWr+o!X0hrHB})%%;zm`=N%ER; zW>|Y#awh3qd#tcwobdpPzJ*<8P+lRx(Wmiyu#zpA?>kjT4k1f@^6tyxq4KNeux-6z z?rSa##asKxsoO3};nAT&-)U@`Ck?SHhFrRCr1E*me#=g?VQocwGMPMtXyZ*3o>z?L zR9g<7n*Uc*qGQuVsd-M$Qr;wICRr6;LOj{JK!&jzp7>s_ z&0&^NUWkZu%I}_4exb#EG})o+f?RYx{6td2|L|*e^b0G3 zq-gOR;U_Qjo7?J%OKMBiCspt60SL$pO@!Zhg_djoN32-1r7L0r7tM`wz$9~39e2K% zHYEf2jA&X(NBuHDQ9)1nG98FfsGM!2mgkPHgyXJgNtE%3(x!= ziaEVulj6nWo0ug=G}c!jZ6RD8hDNLin#%I>$CuknKHi`P9_GftSTkpdjXY2DvxGue zd0*S9`N%~aWz0fh=G5`W_+2#EGJr!We{9?5W&&Cgn=WgZ%0`Vf-eX(LHC=Us5uMKs zRwbW~KqI#^7|q``r+Se*Rp^KMqwCLxo*Vy?k>%4pIs$0w-iT-W^7o8q(B(Ci|>@qKQJU0!kf09hHJ0Rqsh3P3HG~k1+A6n&!miv1|tzz6msVif% z4RTou+d%G)9Q_f@Z@tC!IpQ;4Z%OEU7Q?908%lXr)Tk0edf@JvY&4ThP2W`2*j$SR zmJ2P{hMh6$PR*3vSrKSZ)}{cWI|D=%7il{X@sL|WmcMvJmHyB?t2lMVqi2JWAhXIG zvo?Dz8tqC33ZTwgT?jR$Gh-!cgrB&Q-gU&*so_VP5!&S)wa;U!xpo1}Sg;d$%1$1x zI2G$49C~EpU=_Q=&K)_T_QcHU$UU_^izoI$r1e2{=!tgWClANjTu~RilI8x}H7cv| zsPmQZB7gWK%lW3{bcK1Gzg+WOC4w`ZiRoX3$+Eqg(W)|eTpn?^a%{}u*AN1%kEXY# zNVhJy?#=BPtALpAOc2S}b=iOG8@@r=1wyf2 z!i^x9lq>wqmFas=ScCo`NJ5oUOO=XL!XAi736`!OVE9fr@3Idr-jv%`Ijg_M_}AwZ zsyNbCMWG)0Gh?u%EG~0=n{1G9v;N-X^Nl<<{H(>aOgfPPW!dUbAr=A?W%)EJ)cN0A zFiGe8_uQS)*o1e~;eO7pbj*&Om^dPH?oMC9aXLr;O3u6s z3qcG=959Mn^%yMRH4@Mb;?m5<+1$%*dy={kCe~NbQlCp+XI8i^Z&-HVm!J8PS#!$c z0cwF-0YUVW%P3R!Wh}(IPM?~^eitpP{-9C@bL?O26EuT4N1B~VtPVr>y-D-;Ts+Kw zGW73qOufo}r3G3xTQm+?wKe94wq{%`K-iii0cOAxK#<+?-nwkXweo`d@GUpyMG~GS ztL8R_V{~!e6dAI%eJN|8Qe<|XwgWbG;6hxjQ;rKPO6q&L+2S zV)`#p#fEmPo$ro>#r2uRiL3Vx`$^o8LCcu~o?JAmb_BCM*xcJQErwGn$Q}aq=kZ;N z#iCZ4<$dJqh`5%CCQbaIU|*Adx%|vY!N8%SvEHY1PGFlLfT`Re8HutO2tjp@K?~si z#`G6MX7}jSGBPD}Qb0V_BcIWsNo$7`VN!4GkWDJIsKZcI@JPj#p~Q2roL5Ihkc`gV z3(EpawWXKXZI69M1q)R!YTscsqLsBEVUMwFOz+wR+@Lm%XUVUV-$8Q|2DE1|cmJ>> zOo-SuXt1NTux=iA4!_q#L!_&X2}BN?ZvFye;7Wpcn~^{B@@2igB7=`amzN1QxU;mx)rPN}rIOCia#}LKe*Bes4$7&hwp) z!mCKdLPJaQTNtbAHbW%M{1Cy9kRRkeL^y=J%ne;l6BW(Y(<+J9qg+K4-cF{hkusdZ zpFf@@_(F+a`1np3Z38gP0hv$hjxdp(RODNf_l{7p9h9V_EE7Q0H>$-jfrz1x?xqFy zfmphGL?!fgz*y0+^AUsQa$Q|bRrA*UbVYU>#j-TD$-v^Bx&?Zj4dup-8eix+WBQ9N zzv;Y7?tIJZlHcQW%p!|jzC#}i8NtV!UX^XQDj7;<%7~$L0@yz{8no}#|h3PgTDpC_ zGYm%Hns%#@-cR-fvZC8l>fUn%5eSxYW!U@jk68M~m^LZ%o9_)K!+je|oL7g@cS;I_3x9l08MbB4v8&2GNLWg^MY z5k(?qmJ0IGFX7L!x0EfH?JjqU7bp~c=Bu%t7<{i_55qdtO zdu8(VjC~rOZ>(2r&ax*r%DU}_@pIq=%i&-(O3$?kBI-{g*Cf}ivJ1kY zD$MOHS!a^x@4ZZNhMH|*tV|FE3{49w-bpvNQ(vPV{39!8YDpZ zg(AYIbbx#g(u}d>E;_6>i3sdk016D_tr$eH5f;dut}gIH2s)NDSt@sWKlq6cKTL*< zDeIWAN&M{J@P6#-gIqribY_|NGC0vz*_IR%Uf^Z`{3mGm?u$d9WGWMaVWpXaSBCxH z;#iY#1d#-EXEE2tg|NygpnN7I)Bn*K-s4m7H^FdO1cTO*6$*w0T4ebBC`i(;V@13L zMGV=A8}0BO#+zk$+T+GQ(g!PDqtz_(PGg4t8)>jB?))$6j>0Fm3ZK!I`VbRO(1S>J zkkRtdYb_(fjMy3ZtXi4e5ozIR2*Ml`9gt?26F&3la7#>SdE`YJ;BaXEi{yQrT(f9ZyQ~1fQ@o?lozDbV;U*Wt%j<95xqB4v3^+YTyMY z-z+|UHs+N5?D;oECxxYTe#1t7_ev+_O0%+=^S3G{lYL)o=43&ty!s=i`S-~Kt;Le- z{3*W(#ky2EuKg>fG!hzd$f{BKvKprL@Eb>b=KX(hyyhV_5&%w zReA(GWx!-ngR@uGe(D%ebJ7RAC*(>L3lD}RYxc)ki9mPlf=~ZMN#W*3*t~}hs3818<9#N_t%IAD^^tFw4$&PmROEp%YvmcYcG$BP39|kz zncXq7nV`x5*r04k`w%V3l)y*5I0*|3E30wu6*)w3KD2RwQll)WaIf z)}Q4Y{fWFg8(v>gpUSZ0k1Hx+E>Bg-Pjv-X3g@+)&kFW7ITzi2{K>8p*Cvn-Nz&lF zXi*PDxel7RA1}9{=bN}*sIX>fnM)PtCw9TLg)9>oDi1l;bb`_TlsD@p*Fou#Z>(WC zaFvQPN+I`D#MnATuYm$L9m56cPzQsVV6Wrol-DQDmpR=DS5P0K6gBd_6O}jm#w{A< z%S-@{T8v!aefyK#QdxZq2R6U_7IMa}8y;k))ulVi zdM{qLR{iMhKft?hT4S12cdSLTlOK&(wB~~1WEW0-O6W&l9(OND)<(64b!%Y3r{*eE zW@kLTpTS&f1k41}rR$O!J$dvf0Yd3bj=u;hb`8v{jAHw?4ZEaL2+^@1)2w%p?<^nc zpC+pl{AGtvyQLNisQ5GCinGZHQ=3)*B&e8ml3D384>Lc(<0Bd~=3CR6o@4u^FO2GY zBxR(_nNIwO8ECQwpEXIKC!$~;BvcE7u_kp+h z9qYn&v2Zl=NBS!Pbao)H(K~4U5y~ejWD&>QW5vh*N>oR-+$-8lt4AX~2W`Qs&nLDk z4}alQr0-{p4Auxyq*G-$TO=Ed?ZPQlD4SONTDGe$RE#|LX^Z_PyH<5-*cvCDNeLFAxQ);0YiX%kC)4mpEY{0!zK-Pqs4w($JG$V2@ZUY?RgL-i4Ip}jEI zx8rRBw;sllMfDFn!UZdoVq<55lJ8n4Nyj1@Z(_M#JF^i$K5;YKL_wY)Y|pDf)Eh?K z0RC;Xh0|UHw`vj{!i7o~W|O7~ZAK39F|zG!tQvLuRv+Xa<$@ubZh>>hm;646{`vuQ zXrG~%wvy#!x%ce0={-oSj3w>&-aP+sEwR?H7Od*%-`#}n++@qYA#z4tAfG;Xe9R5- zFSjO1*QJdfo37KDt&cawNb)gGDy0oe@za1VhrI#gRIf^DM+C}QRB~A!C7j7*P$ijx zqzOke;#LGPiDmk@cS&i~a~~LN?{MVolI^ZxV|^r^=o2=S>_G8X*Fc^W=Op?)fSeJu z-<1%7#?6TZ_%%6Y@o5HtE@nMec7$-;@9EgNiv+%SCTgA*DcWPJ7=}(5%?HRTeDasi zMqeWPh=Ux`EI5*Z_q|mM7_ZH%_h`jvLd=T z#cOZ;-(kxENo>K7aLc>^x|(j8V&J5_CrmyIE0OR-(*}Ij>|{{+RUjX=*4aZIy>Dd1 zltJa9{Mb!xUH@30p87dKoBZm6h*`}-Fz>{-UkRimYk>oVyl&F?{{yQ)RKIs&b^qOp-Bf|k;|!#$PCZrnMJ@8Dt~!lj zMCki3D&sYc0=>HG)LW%r)_BD=S7{aoM0p{@YcjsSu9Z-P~2D$)tupaI4?*1xsIWS0^{O3+4sp0z^{BRYu)XRFV@(wx`{cyD5sQjI zvY6-rg|M$Ea$7Oc>mbBTy;@=J6}$|1uSFf$x^JTUmAre4S>CO4$@qipEj<@;t={XZ(;JHYPsNe%yXtfX=j4X1KJ`ZG9Lx5ad>YMG)fitY zy2Xgbmp=D>IrUrQ8O-=nzs=uOoF|uZn-7L8X!B1B+x$W<(J!*H%3+T$Jj0P{_WRP! z^sz3R`*!&mvfBgLtr?3nLeS9d0gUsPA{8fbd!V-n(#?xB3Vw|q3;*w;0OYzIMFsZ( z=-`+>iaUI#_H^i>z~8PerzaL^RFR>j0gOb?12>=_t5eDS(st(sB1ayp(;J-8TlP$@8HU33Ji4wuy#;Z%u4_;G@Z;5W?WuH$Mpf^xLwFXKy-*R{EQLIM31(bK|B%X<+BvUh z_@=`@yVG>4miDu~o#9HE0?<}~Ec%L%C+DJE z3cd!I>(cJd=&$R5_BB8jeaC3eGa5UW^ao@&d#y7&mp(%d+en$pcvITQPn>~G-XSVu zXJ_8zb-Yh)^19pyH3B1|Fy56IfA%oW%VGRUVSFSpOb??mhcQ@Td?GO>dl+}-FfLXY zpGu5JJd9_6K{@5;{G;a>u0b>DVIgK?z8@N1+s5%S|Djp5N|nA;h;Am)Qt>wm z(!cNbN?$54Hso<>G?H1h(-?#!wp;1eA}RkGp^R^hq^USQ6QxH)y%r?reng95^E1{J^QF6wy5@d!2|3Ii-k7AJC}lzfLKl!4E)fxz=GF<(5*t zF{;kaH4)aajYN0yqP6Y;te?B;^nl_F*H{ZaxC7zTCex#74tA>C&JSta&JQt@D<1GP z{Se>!q~JQPAw9)$V!2)&3)Aylf)Uqd@U- zIyI>D?sk!rkJIVv2Q>9h|F~T6B2?7diKTfCVisG6QF7pnBcr#q(SU4=q<#SPC zPzH*Q*J-87m{<}x@pzp!D8g5;;`q<;I&D$;*OjmY+f@EcorsFO6-d-bCgnPsZl@_> zyvHSX)T>LdweR+jM%`qmq}3%*`Tqf8o30FEpw%V2PAa1T5{QlW>Jn_c|M`&e9$)e|U7EK{%6HPX<&@=1Q~oMSCWCLlkR6wvFM(^cVk!KrKLKXZyZk}=o+#O+ce$2l zE!8M!K13viu650fL+_QG|6@7*6?jrY34Wi!n?bRSDFCLuT+Ri{aNe;L`&x$XV`vP} zbA9NzQphw4P!~}4TwTLohrfK81|K^GZ$XA+GM&*U0{s<0Wq~sodJCY3EJGx3nr1SK zxspY&KcE)fUy32&zGWII!uy%PgFeKD`8LZNz0X|_%HYYuWmo!GV1vX^?iwY zAuuir>2w)>0Cha0ZaH43ltLX-8hQ74oo41TMyre~OCzrzuhTq81dL^jf%B*_3S(nw z1P5a4IRiU@i7I1LDenMYT~b}KYuDLSvf zSPzUP3ghik;`9oYo+&F7V#IyN>-4zFxU)2JScOi11goPfboxL1IIcpc{`hfng-%16 z2F$l9nrme77Xt%IXkd&pDs(E+;;# z+>4>V#p0wd{B3v8!@8WY9}n=lT>DG?h2hgUa3*nc9lBq!jF!XI_+Pnd>|Qx zIZrUlvQ=nQteTru#(a6+eFQS3FLAuec`APgFIS4vF>xo&*Q6G|mRkIpHPdC4bWD8B zj)~|hPp2}MDxjZzte@m6tdNuRBkQLTDQvZGDf_>08I4(`No`G5a(tt-Gh3y9l-jut z67$MouFCj1K)?6;# z?xK5@{p>Ac``KFt`?+1!d@nyh@z007n#)`YZiTg=`uodZ9_GUuRj6b8G3D56rT}R) zk~F>?Dj1DqJV_JEVLxLYhQ;mlc-&MD9ut8AifK$S4asMXGRBv4_uRr6SbHCg>B;uIM7eX zWk}YisPr_+`VB_>O{Gp}`WdHI>h$5m8b!{m)ak2-H96o6PzZM(!DW9BO4(zEtDKu< z;l-WD$abZWVR%K)r!ktI(V0Gg_Wc?Y6)msRRC50CFhZmQJjf*ir>4w&&J!A*+b zkq&u#Pic2aGc_okk`EHirwMBJ`B(?GzQ;Pi`rI7P$0X0-td%^3ZDg4~K~1==KUKwS z>>yq7->CHF4%{t%Qc2~CFIpunV-!j3a+Q8cVjrcF3cE`#DR*oUm42=R8_AGWvJd`% z_JP&>J(tf`vyX*@=eJH}Jl}x=-xLvDkxNH9784b%Q3Klq#qk!oQ|q_}v$#L#N7I?+ z^Nl3kO*4fYtG0JgA0pV^0UhYKYp~)^5^e8*P8LBDgAi@+fG&8}8n0!yvyv$|Wff6H zly-3Ta1_Vm=nN&_>m4|5$V7%OhHOMXjBP%!DcRZy)n}BFArEM+{Jy5r66k6F>72 zje-wA7Z`o6?1bDQk6?sa2VjP7=>+{n0Se5n)aiL8#19=K4_4}w;tXu^UsV}Db(9A7 zmP+5!iOunIl~e|{JC`IrMg3W&r*)E^w33IVxsK^1xph+M>m;{7sHEankxLS_TV1Ks zB8rOHk(VlUy6h3Jf+55x|beOO*G{&ZsRG3p^fL| z_)bxLaW?!X#dmsZzVLgqH)S!MFHLxrafuwnD4fdR%g^%*dj8EB{Wk_ z*&8K~jm+co9FL8Mp;N%m@Z4b-nBr@(<#Xuu!{Ac5X|3vYy_C4mA4a_QK3An*JuEWj zc%9Y(4{m_L4@-~2Oz8%AaxHo%Q=G3T-ad>G|CK{*U4h{#$B3JrrQS#L)!aM(a8~R5 z!=cva*Lux0|8N){EcNcgVX2p|(h+??KabOC$$E|0v$clHYqzgbr-!Im%#Iu$(dqFVzi*3RH+h=L3FMF9OR2Zu z1K=N}Oh2+r&*XUgScL9FL47rrye|D*gplP|P;da{maUdOP1ikIcd>dVDA3H~N0#mmJ?GoyO*txMOTH;N(H_h=}KUgt#V z21M=Ac1G^JL8HK3we9IBCCDqqMC}GebXrd5h}jVw{=6tBz}R*; z@FbkGOlXI5mKfxRhP$a!$F*Y(HyohU0cMI;Qc@N;{* z+Ho@y8H*k&$6;mZqZ$SO0`p3bq$%Y%emwnAbU%xxFhcJ~F&&==4A-UU%)1Fh20$5_ z!6jU+Xl66bji8aIkglrQl=8@owe4yBqnbR3+=CxDi0t+l8u*^$bh=cb-cTOdbevA7 zat00s$Eu9k<$MRK2^lFK0u5a55JgWF@d$hu7 z8$ILywtXdTU{yHsc7Q|wYro4WqoEu9eck`se>%RLE(63iUE0MIi#BQ$d=QO*-CqrT z*B)K+ipLch(zlh-9gk}id>dGbKkaG%f8jFP0X&O-V4`o37@-oseL|yP_ci#C3;o2| zXFmZGr~_yOUCY~oVL+Mz2zH{^@gn#Npz#|J7zfwLk!gSX$jXRLv!75qqiqVlvpw&O z9$*?iu-&P0_P6Kb=Eso}0IN?_#&sQ-)pH)JJqoT^y$1rxs`wFE`1Ku_)gI2tO$_YI ztihKz_;Sr^dPc2gUM}aQz{};B6%XH}Q8$P09=*)n;@(YOi@nT7E|+p09+4}>_sS^% z=gJW({Xu!;#R{F4ZGv?_AJHkSGCnSkd>GN`D`ezdT=pCU>R4e7?Ggn~9<3}2Qq_~{ z?lKamKZz3`@}4}(olR6$A;Ku)&3cc}X*izX;G%PigH!`DKIr~j1{dX1s#ujA@mfjD zQ7Zo_4${yZv5Hd3C+2lxq#C8uI{FPtZ6sRO;fmrQU6dpAwzk;%p74nJNC~f^dME{9 zquT~wjIitJLdAA9vyJ80dK+MDkWVjQ+fT8@cDN0;s+VrSrkY!S;$aZDA;;NUw_{yD zuz>SF6lbjB^EqRfZqAtUf$vALz2{;2W(`AeV~+97d`v0#rH02iZy0GSit{l#A!ilx z#7V|*UIEK6Y#b%Y7|sb#YI!n6{qw4g)DtR{#PYamDu@e?t8N9P<#E+~2}Bw4xaxkC z;lJVKSuopyJR^S`dky(O7T%iX1M-K#W)#W9W6*|g#I2bjI2Q+BeGstvL|*MPL>#@k z)noVM{&ITh7uoT#6H7>&=%So1!3`&OJ3MYkd|1e>+^e8bXW^u$w-F=Uk!Y1si|Y)W zC0f$RtKFQZwaoLjCg7>J%;ZakLrqCql*{#A73Gy?4$4RG0Qu$Dq+EvhrPid}(-`EJ zRg-eNpUSZO65Nw}FswMozb1u`9ixDDIoNPZl~7Uul0}pjz*HH50-!3StN?gwPcEgr z0EmqN$`0nBtQ^IleIZnF=#Yc7? zew)j~Z4^NKvWA+`Mm$r9SVZ4yYRy#4gZh@!JMGqcP~UhEM~kul0xRa$6P6;r!FYKC z@l_gZ_KwMkf~;ECijHg^I+(M%6lC#jb(OQhw{TF^r0{MFxQ+28Mh4#%XSgpj;A(2+ z9N)nGoZ5OT?y}^*6(Uy^ztb0iS9L;=12Qu&Mt z_6t4=?tfuph>{+7JHg`MjU69DT`UXecU&bI9Q}HEUUt$zaAqGPT8~0@wu!^xJxYvB zn_?ic^fZOh)FwtO+tARAnqDELcx)A3W3jU-*J?1UFEQ;joVEdd%$yNiiEbOqNRa4| z_u`7<+R=2Xkvh-#i$-I9u3^0TM}EzVD;{Z=KM>({Q1HP+mafqxXFoAn6XAG@26A%glE}R&8mgn4_>Cu@y=|ltYHk(N4!~W>RsFYY+BHcu z=lJ<-Mj`70%dO|fkJWRWVTQ^#Qo_Az`_$B=Q^{uHmmR_h+sM>g(ZM;0&#cBx8zf$l zH`LMZsW_XmqUo4S2`=;tMAGQFQByBQ%<22ea#n(LKb}^ ze~j>c)YJbM(xMW*GI&x()?yZ3a+O!U!>wv_0MSnFQ7GEUJ$%s;d!%TW|60*>Pj&o0 zEzi8PP~E|(=RGDr>iHEGGj)bz64j$!N;hlNtqusW*_4)%}QBi!J%}m9S2L;l)Y%h|4=> zi>CmYmO({WVoVZ#sCLVA(oE4LE<@tyr2|ti??VL zSa0fdxk8wtMcy`bx_XO7T|Y8)TDS!+%)mFMPLmYM=OPk_>-2}GG>RM=*QxhYipQM_ z;bzIB{wc-d#;3r;He@V?>3n>L2J*omXibxq6khYIiwx-Ri00Dvie}j#5X} zkMuQxnjQ&bqQLLtI;~PNT&+b;jO)~Wt44v-;yP_s8}LgagW@{XZPlpi{J2h3RmcC^ z_#duO&yMnC9G)6&8yPAJN*S+_GG4k2I)=X7E<5=(Y*pFW zT-oEE@hU6RHApK$qS;*EDbINIo&En%-++>Bj;!y3XH<4LPzW~ub39V5EcW#dH0{IR->?td0lCOQVj zyYzXuN-)h49fRBNonFwWTi&d83}%!NfCW<dWBZi(Y-1F$M03>oipfep=*_xK3SOY(vbxPSnVlEGGq?4azn-TgiAfWbFB(l<{oH zxE2W|-i_-t{3VS7d*eF2qre-BA}1wuioK*!*P4V*m*dCKgie$2jFge=Blg}#fXDbV-a<>UKvqxW6X0{JMU}hz+ z6trKBGsMP*y?nnqO1P$o?}A@bgkp|(#gpP1x$vs6ZJJkv=Wb4aMZ>Y~{32Lz3w>@pfAL4(q+EOB1ZhMIC3@rp*lZm60?vzgae;7MM0Fs~Z{@Oa(I zR5K(f$4f%*L)ExV`ztNXmTkKE71gG1;Ro9EEBrv4c6b#nc2h#9e=3^!MUkxuosN1{ zqsWU1ovL5esO$R)oleD%FA_SPgCE}|bow_F!-z79c!?~~0tSreYWzTf)9?cYF3r)5 zS2TA>nzg_H&8zqUnvd}VG$pTbo4L*2Bl&W#g5yIu_6L^~`iL=$AMzRoJ|a#W^ICzA zxZLAVlX5xA7mc`q$~>^rcK1{9S(kU@#t*F}@-RH*Gt!U)AaPTl+=Bvo<{ilfrqC7} zMw1*4y%_-Mt!n2$C7fe&MSNNh48fx{>O^SvQk)N!+jVqjsO3g~!eq ziB+Tg01k--#e$0Y%Z*NTZQ6F>M#|sTR520w`um3}>}~MfMES7R`MrY_jy7b7R`m{I zZ*vTqm5SpHE)H2WSJlGjHDr5| zcrqaJg*R`Xq27UW}|64CYyerhD@Q!at3Lo9Mi^&Ww6WxmsIwv3o1v^p%E0s-&`>bX3WA1k0XqznL0>0Yuc`n zGup^FMBhALme&n(%+q$vw0j&__(g3qt&<+O12EUQSK>LgYTPL8PGdOW1;h1Y#e(-u ztor-&-sQJkqmJ&^;fxkpaHx@^hI675hv=6LsbXuV@@FI>Zi7#|psRSQf zM5=2|m#(CL$k&(fIZ20TkGP~)kp6_xztKn{4SPHLHE$;0BfI$l7)qnNiqxm4eipou z|CxDSkmK<)^YnN)7_O2=!lA42@&niY4qbGEZXBXJ^asuk(tmQqcj(Xb3UW-?UF={< zzorphDS|)rPR_gjHI0IgV^I*Nx%!)D2k8aY$#afQFDRWX&?9B8PH(=ZQPrXNf`cbb z-XL_oTpJCHRy2#_hyJ!*qw4fX60>+cQ}CNz5MovlrmIV~ zYgBOw-Cl%K=WCF_k@{^#2#J}wU8BJ2!2$YE)&I7l$g_h3G#_vT#eA`jC_qFXmk|Y~ z4++pNh4?^GWZ94a-M3w%$Rk4n^k~~PQuccd-JoQH4nhix5-t*VnPS!dEvst|zwfB}J{ix^emI z>Z=<^ttUFN@T(hOUp+j0h{r}$M|{-)RQu}`DHB(aM1PSsg{z1vF$ zLy*m)HN4Jz4$^i5WCX2c$PP$L!P5bYH_}r@hn*9oF8~Y!QQ~LR^DAIANP6OW3C}2;~Y1ew9V~A)}^e|Vak`2J{Z@MGR1Xt!dDPGyfuWsND0^qr#9Z;;X2`eG)ZjLFV^EhaUdPZk%8ZgHZ; zY)O%w2eOQOOJHe!uL`|SN^=?t<%}wo@qorQVb{=Oa7!c>u=ANbdbof-uux;p(y$@XKr$UUx3 zn|EpydBD}_Rs2}x>huYIY;<)hdPk$kbFNOuyrWUzO;@MhiuS8^k=?FNe+I&SSEu3c zz^q!=5KHvyX?~eh^S32jy>ClUy~I1XaBd{=UA%8gM)V3&6Ckp}-BkZ{G^*d#C^+CzqKXD5K|eFM)8ECo`VRo{ zJ-Tc70i2Nl2Jk_QdR4VuB@uiOWBI$9{1k-qDA6B?NPQ6Fa}ZGAl&nsdD~j(*B7e>5 z)b%}$s)lBDqQLAaI*nI!XGQLxqSHT+xpIom+det* zmpJ2eBW+fq-X%r7i$y*3{X9|cVgW(`8ANxns3*SfiF#KlW)>;xT*f^6eKl9#p#+&< z%8uz#Z3`kTV-o$Jw5~-`jzuiTT_9;CdIld_9Go&~GVN0{&QeLWl&S8`3AeNqW~2_2 zmMTekW_r04hWEnz8dapS4Fj!I)-fGg!*`)S05m<4US{gAk*YWFNr9|MPciHVz#Ll1 z^=G6*=VvH|=p}69s2SzG3 zz)GnV-c59jG?xtlp>T3L47D7YM*Sqp0-YbnUBGK~@iC71NTtd?_Nuyow;2?;EvwTY zCDA>4cnfhgqF^eXLRB%dAcpeym|&(ACa6 z6B`AY4!E1VnHC4d?B5X48A5&Z`gGoY2UM#2NdzZNSvOwX&>8c`>6C{22GJSV6i-2- zP9+{dB55_?MMTd13IN`@pRshDPRD)%cd+5~Hj+jvYR0G+nzE;Y4l!((KmBROs5de) zpJ){PCmKF!#$CiyW>Ms9;3v&g!mX!%0IUSSwi5L|&NhHDR%6GXgm za0`7q2Ow_6L3t6*`0``6mQgx(K!;s>7 zY!p{c)G79bH&$&_&0^7Jrfd8HP6>2{5wwLNcLDO1guKp>Eni?J32x+?zsI2W0m6xs zY{F=LI_;Q4&}|Rceluxzk*wu7&9m1YY_FQK*OS>^b!D&Pw7*}g(-B|FTFS@9&qb;Z z?~J3)Ly_WIj?)s?>U7bU8db~o6cV4RdFT-1Gz=b8k)-RG(*2T+aS|u~i^K?;%!xTj zjHD@?*!rbLmD1~XBLgV#WTQ@JY?K4UbS?6IqfQ@usZpeOv`$BTrBUQJqjd^@g*^#S z&r_%~B9qGNsqLj)+rD4R`A()>q@tu!Ymkzvp`{vJqT2xB)>x{&e4S38 zeC^qsq^H2KqjegkYPn2{3?8kM_(r41KSt}+6F=%k>vSG|j2Nv`9ey;9)~Wd$XcNT$ zRm96B@f2Wy_;LII@mu%-;@$WG;^4O)@iaxeLJ}YQtt$Bf`~dMN`~dNF_yOX(K%CQf zooyN;hZrutf9D)f@wd_&npFJPzp68TEzZ6{r`6v|#edDc>pi64z~|H#NU>tS7K3ik z>AP?7Aw`p?(Qg=I|F;?i7o&eRq+{7+)}dXZ@2O=}`ag{-Z6g&+H_-pYy=MlAf*XNm z#hU0lCOzbT8U=R%md5Uh_As=||1cL(;Ig3s`bOz(mxxRs8lV%96_`IXKtHIAJ;K*f zy=i1>)AoT!f!VZH+2!$`As);ukN?+=I`#aYRL=3}^yec{M=}vdf>m>T@#)VcI=b`k#(fZI{0;87CN9gr1(u~X`;hXV7px!b*r~jsv}aeA~O3J0Jx%u_nxHFiM!y^ zPN!Wu0>o$S(kOTW#E;fn$(W3r8ovu|ScDx*{zfz3|IsbpK(|o^E+_bhzf1skJKawB z9A)0E3T%6pLlPYOBJudH!ed{i#j%%_%9?{y^6+>o&Lm}4-zLk=2MY-vf=7|_;aVAU z>TBEQn#l}~WnaiYb>&Ry!3pU9c}iy8+P{p1%)+O2)si29&MKrA`)ENuIuR98@n3T!tIpnN!ZA1k;$sb`y0WTw)=I`q|6-G<=I`;rA?Y6s z=AmJ6EKWW+4jzT*gHOMb=+XwJeB(uYlXrybWa~Ko3@#MESVrvKj9A^#{()qa_+y1W zTAp+l*p{0+D9q%__5yj^r0HX1NSv0#Z4-z2N=g2m!)z_dFxzSvV8;2Zn#7)VzR+=^ z2KN;N+14e5@NZ9GobQP^up{u{=eX8)HISe7QwvEWM@4V8{!Y@daRf0~lwBE`VTjcYCw?1t>?kM=s#KKKrsSPz7Gd z1^(f?gBFOuGa5&Ct3nf8Xaa@y{7%MmCD1N^{mv^ikymKKFVs?n)^ni-3gs}WOBH+s zM^B9g+^@aalu6=?3D*!J8zJYBd>DBo+WJP6pCUPww%g;Cf8_4F@KSk_j)EYk?t$-- zeh1)R_h=NHj4{}v-y`!50PX>RKc4dkz#iL!Vgm0D2+)SdrBCCiNV|andS;JCkq!d` z^bs&P(&`z7@COdGqP-e%eAOv?!6Mg$ebU*KOXIoSkWs}|s6rL`??srR8VMLOf3H`M zDo8^WDe8eA-|f{X_y$C^s3!o2?8B-FVt%2d=*D9HZl4nKPy2uXC+9we(372<7w*$2 zvT}+}V}am{$wLpf_5}Xu1w_4qMZE%|zPwMi_7!ODF5i1nUIAGsSn>o<)#G?+68Roe zAB_`0J?DGuOb$bS(r{dw$|!?@VyUq2Boc5~Iy8-Q7Xx5BG=(moD0eodXtun5bUztDS2Tguu zzDdF5SLP=GUlLrYGNwy{7d?V&6Jo6m0qpVwML@}7_@)bPjXb5%c(#A6rmYlROJ9~sKio&U z=!VDn5reOzlF??8f6F__v_PvsKzs`qh-|trg>+d$nffese;cV~3P0|XkDq_3=q|5Pe zKnuKoE4(Wu-ck>5bRHgNp=%Z1*rL2{gbRJw(e{8;%CsWUt-;7-I5cQlQR7)bdXscQ zkj6Bw#b=~rfIf+YOjAW2-C6`a+$eMk&e_BbIEN3XX9^wfM9ty2%;m^_8`(D9#*l5u z9?dbxa~c0Tfs>5j*-!HGQjajwA(~FXIzVh%%aGq`z~b?2;*(NA^NV;u`;(><2Pppy zKc*kuk)ps2qz49QxE>m@SUE!@NqQE&* zb$U;wA1~rL>Ia4XA0pOuhs{#7r}K3^EIlAS+O+9<+M`8z;3P_YbXEv*ujkI5}Mb_=>Vz$e-bfvOCZ1GhF6?Ip5 z-xfz2rs{Nfk-{6K@SrO+fuZpBNPfq7c+CnA{Q>rSy~5j9oM*pS&<%yZmltR^@cshb z{>l>8?3E?x%6}`;31_iamSBlDvdGi3%*Bv%6))S|BAtS_Zy_0|JeFZIi*%Cawoa8l zwuH@XUXd>6&(*;2$4E%T!rVyv)M?g@QkWZAn5{~f8(EkSa>B@53N%jDX|pP7Qb}a; zRGoICs2Njr>R7B(*E^=_bWE{MfkjhwdP`yMZ5MfTs!mnKIz_fj)#)5y?wG36F#Py% zs!k(|VF|vRnBI62Wnm}L7A5QwDeMv!)-9HrTf)NLh?H9IF5xrL+loD1E@5p^@MEaY zqWd_xtXQYuZa{d&az6uKDAuXMru%t;{7wt0puO6R5yf%ZG<8a}v6S0Vo@afUD^aE? zSpF3JaA|s?6w}L*?ReCAq7>F2YNu21DCE~$^gQQR0aOK0lwM$@p6ysMzGhSyDNUjI zhstsBTPeY}e1LXlJDs}WkU*uQNONGR%)ge?$b~%f+j$z2xrC38*e+ek!5*JL+B(`_ zijFwAM5o}NAX)?MW#WrUbbKKXpb<2dDdG&eT7qt1(6uGHwAkx8xd0g4vmSm*_S9=e)1!n243BO>9v#+@s}iqQxjk=uHi}Chu{WV?#kMyW6_;znL z<>LM@pL@o$sb~)pp9Dn6HXZsj@ZCWEuCu~%tVGOAI;Kkq#%?g2kwj&K$|!8f_)#kM zFu|=?GSRDVE#U%b2wxYQqsIrAVZ(bHFNu6)yn0caF;ab!hU1WU1~JXnC1#Y9>=y{9 z(oWP!$t|-_SeH&Gd*E13;M?a-Ewd}D8k~%gituGQ64!t)(N}{Ds?_ZC<4fvdHiE8+ z@LEtfCBGJ(cXwG;>_o#&H(1f?%Bta3%00Dbq`FruM&eaXgtJ6}lglU^Gn1}CG_z+} zo}|fibR>!CLWGk#ZJ;7Y351)o4w^h2sH#_2R@F!Ap-$U~nno;UlbBf|;4qmqIiFEH zi(vYxqK&M|s?mn!j*3*r%u!i0Ym)e`od}O2YMNR`At#Zcz3s|Jl~Jgfer#7h3S4uM z<4TOe7C5;_1dcX@lJ`o*YDXIx5}yffjGL#HsWAT2x*`}KVf^^zn@?p`gV9`P4&(aN zCCwqO9jRvP{zzjzYy=Bs69*>4^B9WmYI#@sbI?VpgHxo4{x5}-6DMSMBFFXebxDtY#LYhQ zHjpyu42eZPN+^+`d(S{+52o@OyfG809*{O-Bn}r)-*G))>YkEQMkW7ObUghrr>6aFZC-Nn*{nQxsSptW~TkXrLpP+8Sb*lhDO5pKv3>35Y;xPhqA z$QRm7HJ)cS^U*zF3^U}t6WnXSV%{&Fud>K^M>zJ=Hi?Tw*d(ePRKU-+(>5MfF&(E6 zJI>hs=jCH(l7=OZ89bhsFxCrG^0DN--kOwK>)Iq1$UX~iCPtWQIQd!quoN)4RpP`P{M>jlZMdiQ zti#vEM9((J6#_mVB9Z>gBOU7NbFoh&aXydNn78uarV$&SGLo#-Q+twFEJtTxg+|d5 zea`&+_OW}C82U?WPVPZsUICl=`f_HIo2T&93tz*j9?)0zP!dP8*l28Dyaua@#6Z6H zgj+JORs0RrTQmq23?Um3wWhplV(Yz{5In5d3=YD(vEZ4LR*Zeo=91@F)MHshZmfl-NA(xgE{~aY+ zbYC$yMg!end;-3Io-=m20CX_qW=K?tFyi#trsPdQSeK8@AE>Ivcse*9C-Jx@!Y@QnlpU>D_LENP?>MVZJwz|gY+muP$t{Efoc9FpH)vU~C zY(!nF(HxkLWs|1EE8$Rv#uxoK|}R4ja`U-4VX*r6|>sWmK&`vVD(c0tEl0a z|CURc0=7T5V4I9Pcp-0yfgQjg5l-Q_hvE<6{vK2cJM)E5*uzs9#vdv$mCN4bBe_N* zVaAlAsxxV}2og0S>}H6@K9t|8l~qa0anCi4*gzwdHIfmmtOh{_ak>cCV}_=?AxuVE zv0sXv&Zc7747OqsGZiCoYq1Dt>~x&yze_O-yYRK}jC^1_t;8xWxBW}2VgBdeC-q=WFRZe56&J3uyfqfzH4=BKC03!z9J9d~ZHzRt84|Y%xd`Ka-AK2KLOHOq8)~FR zR?8(5iMc|wxr^mFd3c7zcd|NYF|66}_gCm#t#^m`T35?mXwkRd%Br~4WF(X6XrwxB znpU67D>=EU4P|Hvf5+3Ws?+QYPuU)a ztF?m{)z3D~!Ens9F3D$UL`P*U+iW25S`jbNw-*%}Pr`Hu^6*IFI+14=nGD?^X4aQc zC`vbqRR#SIUv4)XFvT>5^*ozWB11b{a8H>{F68Wo6IHRLgo7yHx(T`UW^c=-r%JHe z4cR7NseQWS>*LBOgl0xq*|VJVD-*LChhj8?&5hN$3!$xioAVkMlUS|EpOPMw#-M51 zBpxkhcL`GU0}LD1`SGve>$3_aqNvX&#hCDYzApCdz0i-)AbnGCmBdKgF7mc@5=WX0 ziAP#x<*25&%EEwb+SRx^{JjuiH%Zj{sr(+vyoZ`eSPrpqx5nWS<(%~B6p5eO8dJRX zO{AS@y%|en4LgQP+^FYOB4v(F*NrfvE{V@O3BPT9Rlq9cI8NfZL-I)DhT|sFi5~ot zL6h9)gqnChIKio1g-p(YpVmByPK%or9`KoG8(>dpBx^6^oyviqD(L~rcwlI4T z37x8KBB>&=MMjjt)UiZ40DjDBv|?uO=Dta@fxDh~IFC-bb3>zOZJ>|=;Y8(4^|MV`Z^*N+Fom(WWxMDK0oUB3*E_o*Q2;5dm@nEs`LL$*chiswIGMxkU6 zda8KAqh%DTH|W{ovd8jkSy_dHv{bEYxMuHk6E77>+@*7KcYhkFIr~sOs?Z&Kn&;NK zlwGj!Bl?16lt)LdHYUThmm%7g09(ZkKGM40*?0t6>_Os2=_NV;=`vW@RBj~72}&F7qm4tGok#|$;8q?IxU8um!;pW-UmrFDrZb>+*OvtW2IS`s}hax+q! z6op0XXbT$+RmirVod9e=lfQ0|ePtQyf?m_Y;4yOo~T)*%-ua8n$m54%u2*0YEA+fA88|Z^W;pUg6 z=3}cvpa#|8{nEA?THg0tC7iBP1CA7$HxJ^dXYwt`V^D25Fdhu3F9iggk%f3hEY_XG zEWZlAFiy4(vl*;)!NKzDNKEqc+fqS86b@Ky=WyIoJKD^+1aDH5X!bK@c*(^yGYK>0 zZK4j|Z{bCj{^&=2C$cYgWnOW7C(Q6l?8S#XZIC#{mZW@wopYm+Wx;xn~2tM6Q9Fx6p!ziH_<1eX!{G&_Q+n1 zhLyxxh{O$nJdDaJwTF**hX}pAef9|jJM+vy!x>p^q?$=AJe}=5{v40!i%!SV)>nVR zbUE@G21sJ0fU$aZ+U%kSU;>fnv3%eYGAv5+aL>CLYQQib8lARdHL)hLx%YF<1!+4* z4$^*Ua2sRvBC#UC`=z=&;Yq`a(#=Fwx!69F`1*u03QJrBLi#)s(b_1^b4??KedDJ( zX8tIVxvh-CiRfseHP7XDt=v%SWXz~#B>P#ZSZxN^x_JI0aVz`}xixPXpMWu4B?}(# zmdC^)IQM8yrx#wtUH}Vzx~-Es3cI7zdBgIH1h;byXHdFU7U_`K)G;@vOZD&`@5zqP z4^+CjBkQ!@pe-Gt(SvPOEeZ) zrBpBY{QQQitcuD;>y6Dk93<+fa;wH;?CddR93o$ORlY7;Qej9UvCSuGqkzBR{Fhg- z=u9M5>H-JB-@GUX@xmUED?m}XcJnY}q$w%a`jny3Sz51S6@5@etD}4M23hXl`0>0` zeD*hjk@Pp>*DtZeAleIu=yypzd=RIi0a|pAbjGkpdJg&*brFWPWne(qHVr48A}Sh) zZil_sPzAXr2Wk5hwXo@2W28yqO^wG{Znrw(zoD4p(hlvFmk-v2>iqN7w%V}4XzC-a zq`yOABi{5oi0xVOxKp0ZUzw*G<+LgEA+>DjI!qTsv#FGoN~l5|67!04#)89*1;ub9 z9N5UrRIC+?C50>=Xu+Z(W2ar-3N9!SYOj*-yMf2hm2bO;ZS0BA!eP_4Q)%MgA)D?g z;gJJx9LS%(gdFnX8tyqJ+zlk&EE3_EiHF^$?!b&lJBoI{QbwT|y;U@rBS3yx!-H)S z(|<|727Ac+_NXE8s4fZ*OFWnUFBjD-6(e!|FO_AbhC8O+3l6nD^;tx>AYR1VlQ=Z1 z1iLz4DVEbe&EvgkUtqcQ>8x9eAzv)ORzZ5FL-4<3Xu0;!8L-}*q&Nzxtil-(jsYUo zHO~2lZ5c5uO5#?y?TIE-ADkkk*3{#C^ibA_#poJdF8gBURM>;WmS5CiOUVXjT~*Me zyn@nMS6-r+T*QtnE_j+M_<*$>lx-NCbxHiB3mhxS8hYz4$8`HyDI;lJV%mMuDc5Xr zNh~@<9jdS`t4}w{b`M8w({Rlpeblsyb%2-fD~~b8Zq4^Yk1s6V$8LT2fV~vr8rYph z^5lU}!X#m?s;U+z%HuZaiGaUd&RsP**RNj|9Mzr!3j0RsU)XRVT3vAij&ebg*oqY> zqL^CXR8~bZS@caOQf)+|*@kS=aLxXGh8S7L9A@F=wcDgSa^SmV6pp#_tRUQAG!3!S zQAZ96p=c&cx0k@-lP{uM+nkCHW+#&~JjJ8CTta@5zl3z)LKsqyO&yPzP2MWrt4AW* zJArlR5Zi?JhQ!kL!Y`)3baIgxr{_WAX}hlxtsg>SeJ4>k%fwSe``^u16ucA(tjn_w ziIoA-W@Jra^pp&P;;@|w@`M~=P`*@%{E{!;(EED0;a<)4FE>tFQ*SCe+ zX7rG9HOLc&3~?lv&%UzCX?6yh4QS;^b&>;dt}W)p-x~#o0S!1Q`u8BS$?ek|O`0Tj zX?Ys0tm1smIyWtETw1B9Z8n%Gm)K7eCHnAvI4^9ok+$;=C&Z^)^tw#IqeyS^Z(qJd zbg1dzgc(&=)t7jtn0B*9T=3N&xb12{`4`C-EALY4>e3Q*NYMp3I5qI!D(${wdZ+IN<;MuUIpt zN6U`r)8|vyx<*3=9yJm;0C0#7DRA&%LLQJ;8sp<-03rRr2Pz{GJ;yez6gneTqo!RG zgPlx5mubDvX@%X-#^yMkf9=~M@X-^&Hd z-#_!?B;~B*4Xc$^4xAM15RS;Hj>O-1T$oTGdL=A-$Z%ya%CcR%8D|+J7R%t=MZZkq zZ2=ziDMHwJJk;U{xV0t6vbG^lk@vxUDa|>Y>jWX$SAOJ!Wxq$XDYp@e!D!{whA8MH zvFu?rv;8u8FUPSQS2DOop6{dbZ8C`917IeO7Vy9YY%x!9xo6SlkNc@9iRH2lE8Eiip59c}2m+9<(8TeHhb`#6hzScKZuM=m| z8Hh?^{294!3uoDFl0OPrYs5_w8!$$x7+_z$1*-wf?p7+%FKyRm9ejDJKZ$4Bp6j!z(N>DzHjpbx zdC;(N7yL@9kgy!|C|+=Pp)!xO(ct)3_HKb$oY#H`bYIF6ROyB~@Ta1#g zoJ17UTm*w%f72aYH=-Y(N!_9GDh^(~&}c-b-l;V=6-rh}iJhG!UF(zP7X<&DGCbEt zSrQxJT%(8E;@yo>t9J@52&!2sL;*51a zs|jbU*R{hLt51dH<>0yzLlFAC22Y3-9@_b*PuTtYWb%jrOL7v^{4;{E6_Yzc_UY5j zr^AOP&Gr`l-I4>G<>J;B4B)Yn3}&CszuE5Rw8?Ad9(qEatUfQOUYjojH?L zJ^2fbCoA-1G&VYN7(pQL*ZcAp&_?SGE7e!t%vdkIz90|T^r*hL#XtZJ*A5xjC%49Z zvzUiJ;DzdGM=|TnrMLLU!Di**h2C>sOb$w4(3`|tz6;&+X2P%1QhF(dlf**gD_;s+ z{9qvvvGlbH6*{m3q=guT&TA>p-aL7*jAUt~1G_D`REuD{&`iAAP$TRAt2Riymshg# z>$WU0siHQ$FjQ4+-+Wh4zUB~1oNgFw^JFiVv*P75MHurS{dSLxJ%RpO6ZK7H8zR-b zwHEK3DZ*wd+dy>Fp27h^79eqBeA2h$SK(&T4nH(X;==>rr|U*!T$_)Wdb1Pfv37jE z2OH0q7B*TK0TA&*8eB%a0Y1 z(EwXZA$CykF)u&}>NC&Aihi@ktAAaPKj?nr{p(uo0UtMCU4fDXe`7Kp17twSH)0<9w~#>Ey6d?r7BIY7TD6o+u z6n?c3vE>dMwI7~|8Mse0Id7kt+xGhOmQ#zZygb2wN-x;`!R6BE#Uogb#KG;koKL~q zV_~u%YU2Azu*O^RV;3u{a7E9?b{4l*E)!vwsKXUyglkUck14|fD?x-0g!oeBh?FDa z`(mGLbUmUqpoMV8w5@c^b7!^cm^q&~&eqt$!N-nsL^Zau+Dj3p1}0~0jIwf(I3|4(=b|1tf@NLox~UnTL;GI zA)|%c#*l+$R)kxZ;UK~}%TbKyw2ET%6`YR8ac!?UX*$lZdLu>RCfG@LqBDkCVR=dWnL#))sEwY(f{E1#b0XO zdQP)bJ-{?#Rx0ri(@s0MnKo18DDy>=4Lw-aDN>E|Pn*P2!AJ2g{D7ruGDgb5f8T<-6lBX-Ef0o#ge6E!(rIEOAz6bVPNdp$)Z%l$Dt^w7`I5F$5fAkPtrT%s zRUL7gse>uBNeGwHACo#mOFqs&^Cghl%2@z29G=4FkHj`#^znscet>c)kYM!yGrCT;nPBzt^j_D3cdmD<02O!E={t^SrGu}&$ zm2>XLE!scdeJqca&T7MZ>|<3s{4^S7MTh9l^ANa~iIPC@aX8NJD74xRVOryLRirwr z=E6R?Lc-1TbyFa7DC_iJmlEOHj`L_a4@3fE!N|X3dE{$F|8^e-R2|ssCVqog&nOB zSFZG*{xzssMCOj{m5Sj|kHm{UO(>eR>7^qIqr}j!Fg3tbq-73Dr+V=lASB*t%iod< zW%Ee;rS0Cl3HZtnH_dMlZ}aqiTB6_uQ4K}_PR_I!W%cPn7}vaSV1sGwa0iZvRkD1t4^IOg`A0*i4d47cyEz(cxT4;Hr)Aq9j@#s!q_VU zXne=73Ldkm%x96CtX}Jo&mzC}euS)arg!I!gpB4zxF&`nAHQj+nZOloWkzTI;@cFw zG;O&7z)L-9aUpjA7}mp>2>F*^9GZrULPSq>17BVx@xBbb_^E|mVbRK$(Q@vd-*8=y zqVhbJm7e{%b~CdcD2?!&(wq_E9Q)f+oMVR^+E-erU+h1yX6qGqO}n<)8Ln2O=jClL z+Qz|kyAAo<2lNB<_8Q(=lNcbvS;w^fxOra@n96bc3g{&6I8uaD98=#?VY%9&7jVsR z9Eq{|oUnPf_4EsZ#?LhzKOlBpn*p)wJEF<3AK#D*h<#KA#QHObjL~OL zDW4W_6-c}$-R2YZa_KHtwFu!R?vBpPSo(V2<%BOB)&S11bZxew!LXZ$%G(F?u(&rH z&7=%3HQ=KW5Szz7$vx8x6>t+)QiY9%5EVeWSi={(9@Td))bassyxz0+Yv z{TDCC&7$%)*rLty*}my-Eed7u*g7Wq7l~7IOhXp^3BvpMYLhc8JpfggGlICeg({%0 zmYW?`72^*}t5p|?TU!vq8`&cKR&J57ag=Q%X129;^s&&GVqsf2N_4a)@oPg#DI*`9 zC|hV%QQpm|$6c^f`hVKabtmzTuXJxe=aG@xrhY-K4D*YS(sSR6V2|A2PLKAsqYWa=4K7;~ zM}J~CPR+6nHL<4NSdye*S0M?I9xjIX?CTJh%)8veez&}Z&EN|H;DrvxKSCz0XmPXW zfTH#wZ29v=l@hUt%uNBLhzw!Z<=}W6YmP=9HMqYk$Y_S}O`|5P0{jXcP>7S2Iig3& zBHB{e)jW(8XiS3q6438>bgG5}lwSxjh&Auyc)cKI;Zcwqpv(h%C~%hC+j5yFd?3i94m>%e2fI1A25h^m6Y@2NBCPngV;;P_hKut zeI&82ZP`MNw7x~TxrZ}gh?DXoH#zV&o{_;M2*$v*@`A!6)%AwcCy^eE4Gvyzd8X8V zLiB>{^a&Q(F(OnMo^VUSQ*?F}shE))C;9Rf)8n&bn60Lp0tIP8%@e7nKcM5ZT z9&)Gf&jE<@gnt9S{6_c%zU(w3aeE#+bwpXn250oB5yvi(SX`QC5o|Ef6^XexZ}aZK zIqEh;IO#dwyeK4Jyc{iW-W(FwVh3xse0tEIIHKtkjvO3*6HQGXYCTujjlFrq9F;`? zDV}FJ$VB4#+py=UHQm|_T2Q_n4j{Qj+HA%5#TqS09SH{{KKs*>P_0CG;)GYq|WY71Zk<8F2sUVdc3EUTbQo zaF}7q4S?r!|6b#*;i-p13!WnDO~c3Ze3V~H%)<{aCwX~;N87M#;6d3!FG(RiQY3Jw zP)|($i=sshhs1ta9wd|9pG)TMk6%6$^xJ~E$rV2rE8Y7nBmeZN+SaLT1e~O0h}D@- zkZ+G_$&IZx@yiw&A_J=7^%BwFI^-+VE381woHKc*-bNc#R;iZ|VwMv%>=>z~6y8Gc zg-V%jCY?-XQ?gj`9Ly(1bng-66mGyPUmWHWw$zKPgc;jA9lZBKMBZmI^n4Kx4fzP- z6~1%C2NQ4e&sJsiijBxRF3ySBaf}D_)M+Emn_HnvH<^t%+qPv3S*duMt}GgIWTD1T zuX9W%iWAm&n)ptSS2e#BVDZF==MXv6c7kA!aUr`Ln%R`GY%@00G-BtNMl5NiO!=6t zMZZA8A1Cr@@aEA$XmDepFKRt8Uz`IEGr6N&c~24^LeER4CM!Agx8mS5J5eKdk~5NXkSt0N z1BwYzLBIrJM)a=VuIdEndEal{^{sW+y8OZP4z+97u3hz1+?6nGY3Kr`&hw?%%7dXE z7vv`xx|TSlPMQ$*{uksYi*MNyrLe<;yDZwKzFUS1<`ZDQ!#|uuD<;^A*=dyW%*}57 zkE`Da`F}sQ`TuPj9XnKC!mb@+E#u%gpDlz#b^bbmI~{upqL~T6-y6t0cFkHh$Jc*I zi$)PNY-Wk)XNl=lCxTzh56g&Omz9Crva(%1-fLSW#IX4@P*RkjagsJ@pT|#+-NuCP`@V=!vABSc_mRBju5l z{^|U78#!ru*-4U66vu6=Mxt^>u!FhYn25rd62=JAWr@qb%d4esN7adU3&zT@q8j}$ z#UJp8IwwUYqKH;y1ZcO*77_^=>Rq#mSC+BF(TmS~%8#B*Twb)pfR z@t&^+>ck>A^PY?l@gg-DdiOUa>mBShQg$f`bGsC(|Fuen4f|e}7}Jkkd)X`LD>2c^ z5TB%N7Y_G`LG5AuTN${svq=d{n5T$W2zHyJ1pn8c>cS=^mp8nkQ4{C#Vy8)QBY(r< zE1b)(Xws-jlV-)mR}>ds-uQ~b!Yi6KyF5_ZC{WVqiooTiS6orjsI+lm)5{A>{m$LT zhNUqx|2d}n|1!UZ?fyGnn&|%d>jd5Z-;XB#zo25q7o19^tXLTnj=XZcRZi&3&8cnKI~%6=c&QY!xd!zv&n?HJ0QvZ}VrQ4q zqAYBNW1%o#)rESQVcf_r-C!(+SF)CL#FW|=xpj6m}8qrEB^SedgTo;$rtT^Q{J z9Bx>HaY+0nHzyyB;T3-Y+lS13OY@e@h2lslwv<-#Y`4RYZIu%ZmiB@AG)vh#VY{+; zK`g~97v6%R!88dLKg;Zl1Tj~Bq&PFrBuI*te{&!qzzBgX)UVk*vtN}MizW&m3zo$g zkX*g*me$7cbSk5=uoJ3^K^;zC=#4pn%BTaC9v;EqT8FCmWI>&7{#bG$6#tgaJc#o% z+ny{%%d((p(9fN4Etu;N$@RlFouOVy9}k3_UL9`Z+wEq>4eC&KYC*Y9FZ_^wL72Tl zvct2b{)eX0q)BnJ!X_n6OD=EPtZ`wfzd_T&!X{0dHT9P^b}nzwpmC$(hE1C`ySz!0 zM$Q$*f#N_(qbr&fH+32`EG)ge(0_T8yX_hh)L7GiR~M$%#V%=_?%@@YsADRRPuv{; z$*@s1c;JAp)gn~V0h}O4lkS+RD8Gr)k;(h-6Gw{9xF*_xj(?k<9w?hN|SlcdP zGRQ)}H=fj&%Zy4nY+|!W##c%y6^r+>!6_2Kt5?>L`$7|LWUbiB;1(;V!og6PdEJBu zxhokGWNs5VRP{^qbgQL=24ihoL9IEF$PnWUanB6uOo>eFpO>DaUE!heInwzm{SZlB zK3j}AXCq^k=QzZQ0B2lPLk4D<=Q}Dx6%+%mE~H9ck>-_V^A76a9J$G7JTg)Ciq8IM z52%@^D2_#Eosu~Su_}z2b?pZ<#0?w;oFbYo1AGTs=&kx zaF`9$duh3x*bo&Gjb&ytd5&Rrv&XfIr;E~MMgUFvY=jF+xtTd5-pr(?|T zXk|#wS-yN_=EqFx@@B_h;zZLzBF;+h`|P!cn6Ew~$(uLTyE?gzpa}S z!Y+xJQ%CMXd?vqB6;@{BQAnWR zj5SfG8SPgi;y=e= zvyI0rEnb>xJu*ShTuaK!uV9SMK)Ax;1`)%qnPV%dKL78(Q1;G`$;U7G@V=1AC-ahm zgyBv`1s~ch)m5hoS`rOM%AkhSkq+nCI+<0%8I>7+PPY#iG-0nNWyto*YT_g*Ns%hp|+o}uqV9k z-*!9R_e@P(Ds9$@t(i)4DkrR$!sLb|~ zP{;3%lfx-VG7L)}RYe(Evk>Y#bI_I^R40b-tMLd*s`@g6!a%)~3LPPpkZJmou<6`V z?}iP%ROY2$^Uop1cVGlI>S>~R2_ zGGCs(;@ipGA-3P{H?K**LmV&-M?L^SY`um*QWDAnB~S;hkr0}s@Kg~0ra1EQ`E-o& zj>Mj7Z#j(f)_*ca2hnh;Ob)r_&`L6uovPlznv4;qC{$Eg4E3zJ6vq5`sE2=#%~wLD zck{UCqz#;{_IjT zY=j0wHt1PO@?vu!ih883XQqTLJw_Ns8T0r{O2j;|7NL?>92U2c9V|W^kucVUoTJ)9 zdfdP{W~IcGHc=(Am&{9vy&+X%KGw9k`2g_Ov1U!AwO5`VkepecCraWkFXx$X@UC64 zS%a$M4+PLt)-ih{%D-t#AjN&+_IceenNQj9HxU*&UZ-WzK5#|3oIm{N1iW%fzzLv)3h-jrc3gW_J90nOSH#(I%9X z-za|R1?Dfa%;+7iZ~cF%xsh|M0UEUVe=0@}%Oq#pl*1L}N(boCmNIQIIS4!9!?YO@ zBR}9=@A$}uCr&AI7!zrdX9bT-mp0E%%zvkOq)*Qb#FcylI2Mk^`KYrj9R&XNsayNb zZ&77QxGmISGo0mPzZvh{{+Lz6Jo@{S{75y&fIk#-D(r%R`AYJb6eMJ4ohnR}7)mMr zy!@C`(S_yo)sKe5@ivU`(oFGc_WB!YBo0x%mJt)QEG*M4s4p%|8zse@_^lmU@X@8B z%1GjEy;IW|^73QBG7hhN^`rjY@^Etin0#YqJ*Ie^vKZ89@^$`ursCeRD*2Cs0=?yY z>Ob<7^oFYaKk_OG%Da^RC?^(#I`@CbDUNU*?SIIL$kUAfm{&8X^Z$pKD`YqAAEj_N zpw9mg)371t)Qg|ucC zbK+g2^rXhgeECt&+|4X#+c)n;|M?C!^-S$Ex$K7xt`%i4!x zaYhvkxATWe%6SNYH)ojGq>5vvs@*ZY`Aec;ynR_H%omo_6K2;`@(5yp?YqLU%Ve*( zoctkwdDmcqpHJk(tn?tBwfu>X1RvyV5$h9TXhg2#Kpk?OXcnDrkzg5b7yFX-$mlr} z-5HnJBPVvFSg@>(6AyH23pLnWL&)sQ?DAGyQy@EI9bZFT7>fgscB~=0*b{2RGHfe1 zeeGn+oM20=H6*;IPJolTx3bJc(}@Q;K8<2~mMrE7(A7k*#@mAXyK;#f)!+o>HyWF{ zUYju2IS=sm?eQD;Tud;`ws?bW@lNZM7{(+DIz$RuCl-%I@IsADzm7Taq9ChVc2bHu zLk;965R90ZJyx75M<{IAZKgX;tXyVY^En|#U{Ai&&&o2ke6bpBnG%0|!XhUS2vmbohZ)V9!b8Wz_>mWGxlJS2Cd!=5Y<=pa>Gv*9)|FJOL=#lT5*BKY!{qn2`< zi&;UfV6?b+51{-WkIX+gov0JR%A8Dx;zg8L880}l%}I3w7bcU|5#l;YRVP-4^*J); zieQ7FQdY1<@P~r@Qp`#h=1(t5Dn(h?o+#*A0rljCsoc|9YKRlXB1?&alo<(!8>N!rULloF_4&4d26Ur2Y^BqP~* zR2CA>rxd~`rr0OfgCr8@etB8J?)n}uKr!zMekVMsaz+AjF0~bxoo;aYKpo_QzI@$} zU&xBc87^@F$fH@MK(TpNsJPrQpSYChsN=V%vY^J8TN^x$!JWGjyFkH%JF-+!rwT87 zEPSGlsc|O?3jUZh>wLll06#FeM|6Sj9VpOM<0AIvlV0@IWj# zanb@<$w~5;Y)G`kcqOS<$Z<+yvXRHL<5sge#9~G^zv#zl8A}v+AqyOX~_dj2}bM#A4Vad%A;P$6DJlpgLFc6OJsh`HLJmZlv(&Ftjr^u{uG=3pvN7MArE z-WN;z0(_DF1(4%oEuv*6ka;20)NExQLSb)pVeCHGALZe=TqPyCPH#-h=6t7)>Fj16 za}G6AXhWzmnL;yU6$j%nO#DX)ji8osXED))#eytVp;)IO)ck6EJKdgEjm5(e^D|Yg z$M?3S!E)!uMVf31YI~ zPAt)%dbe;}hEUUHXzmjyG^!-uDPNYJn1Lt%Hc#7kayOw|d=H&CjNT4OZCKCSPxClpFf_0)XiBS+UYq9=vVjv0Xl;Wmg zMd`*(#6`%A2Qb(5xA6ePF7mZ9pJPtDp*E&}A2@d8=QypSHxJ`+km;*$25yVZGj@9~ zN}s+)<9#Ad{mM`vTu~7YLFLJm=bRboJjKCytIB9B9OaF8Svq>nY(IZjRRb3WLN*Rm zswSgOX}J@Sa51b;s1X^*TT;|pLj0sdy-a$tSEK6O8mezf`eByh3WSr#X+$X}))Hyq zc=qr~WkKy4m1>->bOmI921RnSERj@y+ORMC29~bgD zQPh331_vI0RX1f%G}Mlj6|Ks`bU_)H*9qYjiE+wTJIAWbV_KnDmv9kpS$>_PPH?+2 z9*+CVlShF0`R(Wrg=0{Ym8v5|Oi9X~Ze=Iyz$$cEg+CIj-_hwMkwQE8BjEcibt(yLQr%ktAooQ2Y-V)+H zCAHh|elEOe?J(9S6sT{_)3qebQ-4s;{d06bdx$-Czmb!r6Kua{juW{5PB-I*cmK!J zyPOh7R*u_t>d@l$&Np{zRb--kx9xOY>z22)g#_3;t}6eJ4g>g7rx-Gonbj&aXsP~0 zx-!zlDx3<5pR3;C1G*=euO_&lwz6-q1~lkWzT+f4V5**lKQY#VdhNJG^f+0U4$$rD zq$TC|DMi`fQapxoBNqY07sKTxt^5(QK*=*(OutbE<8?~HmBr;E@O43?)CtBqhkH5E zPNiLXg`pnRa>ONbO@S-QsXHMNsNFd#xgKU$2tUusycd#}pGx7Y&o@UqF~rpl-gPJe z$ea?vzVdx@tA>va*(W)I_}tvHjPd#1&$F|}cp%{czY^9|5ljOyCy(oMucDH1;TL8p zt}Z^>pSv-Yap33_51{!Kxw5{~Gx_@1Wr1$~KsSFgz5-F7y_$oEafKSK04P-u0aS52 z59+x!3VK?gzFVVy6iUe|6?CG~{dpuT8bpB>HR)Vdo` zpEdd)YTY;507}5LY+~^!rL^&vmvdH+{g^r1%V zP!apP6+2YKYLAAgXaghHkLOhTP9AtY8o67H1ea6O5b*B4?JB zW1vMzITMbR6G+Gzic5@~$wtm(k@K3BW1vk*Ig^i*)3C6aQRq2#lJwnaM$j}7^tKgb zppTM*rX4FN7LOV^!_dwsG}FkLDRREFat!osQqIg{+<{$k(_7dxZ2%&<2hX5X1mp9FMAGW$1d_Hk?#rHgB5(Pf+H(j%eEHCC5*j4ts^ zUHs)`@~Iw)G1d?RwDPvw4CDqeTyr$_AXB)fkJad8MLnZ0TFcLO-K}FahLW863{zVD z26z!StI-VrY*A_7=)A<8{FoExF${@?+=@@CbP2bSgA$|gm&+u4KSveBfcJB_e=?0_ zY+N4Kvgz|?_ zk^`XsSyVfi8J#fHkZP)449`_#ajRGJYPgq;(|FuwGPGL$7M91oW1PmI%|JT$hKf0B$L$`>ASf5=1YGac@J?e3Eki@j zazFKIsl^ZCFhAShTqv1dd|Dl~Km#%TCtF zt#B%ED{Hz9p#Zv)tLw=c-i`F=V#Iem0)8dFc!$gdhtz1=o;+UT5^8q(#2NR z`BZisWxz^t;{ZXnnw2u!!-}%S>ocYnvG;RHH8e@VQp?$|Cqe zvmI97d8$S|+2;|RzL2qU&Ce+=DNT-7vBN0g8&Q~v1IP!%I_|z=9V@OHpEonXsYXiQ7%c&LX|1k04<+}0h%5DkXp8i2k06-Js2Y( zm-`234v{9;(#Yjb$uj~jq*@__w_)Q|Sn{8$z(=!W{hhyfOHyg97o05&u;=E%to%fGg8hK^%2+@2! zKjHzrcWedN;Vzc!Yn^6XbFKJFz0=tJ-fua!3P%IWu|qgo3C9R>ltu8l;5rf~{qQ8K zN-wMiQDZHi6Wmp@6P4^uRrq_JizKvy1pweQYJ8vRWQ z_S|pU6pOX=+=EZEJ@<=D%AWgE%P{!Zo||>{l_f6Mrq?@Y;gyMAPqg~YVm~%oO{8dQ zRc%{_RZkOvV>L}n3P)m+cF%d6?=kQOME-21)aNr#eS;Axv$t}8W5dZ zdWx2o{-u_lVmq~Q2PSFUUOpQMu= z)7{KDad-38X(#G#4l>VVcVmuX&PBku>^H_`zY&-H?X*NE^Nr>xBwdqk{!r8jR5ipr zoNbc+VUqqKNxi3Q*a6WW(t6G~J)^bQsbe&#l?L4r-*309?HI3!x1HL|e>Lryo%>u46c;uVBsNc5*%mfTJ_ zF(k_7kmyTdVwHh_6N_PLHZ%SHbPaEOn`yKkN;-W8n`uAddPcBUv^|+PX@oD^N_`_s z8e!fUwh>OTwQC#U4NL%OQgdvI53{66h0d@|st=RWc{f>xR)pKF=sd(Rj4RK`>nJVKzc1p|JBgXNvE@2 zU1aHxWy`Q?B_+!^tiTcmX3IEi4^?4;rf+48!`x@eM~dUHYi)`_*)k3*I8#H$VgDhE zjKexuj_0$F8;9Nd)(OX9F`Hs~cG@`Xfuss{RB(a@U_bZ^5`&>#SsV=Q5-+ZP!O%Yl<29a6nn?yjce4a(nXrXnA?DjT)XHpWA}h1mL`u)JU&@u){8CmD zWQ$pu%@*?*!PH^ZAi%#6x<)3w;&aM%~C8e?3iTI;EcnT&M$6~IdaRmEKwklvin{UJrSDnSlRyTi0 z4z=JLF-7aMl6|4{1;)`nwx#$vJ8h`H_jng$3pr?c|Hu{}=y;Zf_`oljK5!c~PV)iN z$%TqJbixu`WqQjYIpPXKa_9>8QeiXu9FoJ@4^ml^kbU8h9QIx(kV)%eDHo$?g$X&z zN|_*1q7)kdCP*gtXUd#lWU_*6k83fR*5=8ZWw_rcJ=Z8bSLF4lJlRj3o5NKAxED;) z_|qC`VNRMLSs!kQ<+wqOjsZARWK!Lw^?$GI0oX@hoK%*tAIWIpDsbmbn zV7YxIX9eDMsnKx&-DR__d+sm~USav-{<6-D8QFb83lCl;hF6);ou|N7ou%Qez8%Qx zRuV;JHAVx0^uqt%4p3To#*9=-P|uQj!o6>jMu7$IgZs}(8qF>EV1A>?Y$5-kbjNV0 zZ5S(YL>bMWGFz5UDeAsEsp(USsve*>@%wO{&EQ#;sTwoyY-um6|DC%8VZ$nL{e~r- zY;vD0xu1QuHa3~6#3wEupfP6QkEra*lZoXT`EQ3F3 zS-VJ!9AcT|ySZ$f#tW8wTbiUXmgyKt6D{lQBI#AjB$C((EVSf~LSB_dP8GJqDXuJ& z2*=S|8)7vV3R#Tblrrt*H+AFl9xe^yclp(k_D(v#q~=kvR^6OH53Io?rAGG#P)8MT z?Whh{((X>$tB#x}%;j2n1O6;MTf_T0t1}icOYJ=={_o`5&)-^hNRmrKRqx_R01ai` z{l2p`%sPC-tQS0}`PA7Oxs?&z$py(52}p47X3Tiv*&6QuOxAdJJ3xIK!R<`e_{f6I z;O;+JW3L5oJCRDaMg0-1wY#_;|Pnv2}k|$9eD|;fe^J6dOMAFKr6e!0JED6l^H5%pFq99mLTd!BAOS?2vT35?Xh* zI(%Yu`0gKcD8xogv<>ZXmrC=y$K}T7QRb7#yA1}&>Qqi`jl3lCRy^t2($53rg?r#> zS;_gk5+^PWy^gk~+=E=I-o@b_807k~fd|!3t*zm`^KBs4iAFKl)#OqSYS-rXCfQAt zh0C0{6RN@{*-yHkE~p9^iw15s$A+~NJ*t4nC9mhFaUS%f)_tQ5>hs%P%-$DXKl6&= zWTu=}o1R{Kibn6Z0SZ3FS2#uEtJ)gAE2n6bo|B z58l9@95uQcfJ;?@16+F3cn>C>lThta=7-#1DDFg2Kw!Z+8oB-$8WQ-9Kp=)D1g<_; z!}~b(tcaE2a-s&Gs{!P+nxgS0&j$GXQ#5v*n~;7Nd4QbmQ#3ZS7xoRFqVa8#UTWzh zrf6*8X&&E#DH>;-mq>q~p(jmlcAunRws>3d_{pYtbCi^Cj_NScgStr(bCk%)Ev<-S zuKb>Kohm;%9pv>`5NALi3wnt;$66>&Zi07E2n7G zeFvbW*DBu!Q#2-?ui^V_ibm%;8W;UEg_WwNYTRSlW~%&JQ#If_cdABl9gVsdPt}Om zNy-~$8P^+m&)2c?>ebcA-$!|AQs1@A8B#B=Yo)fYOQ|VK$_+g^3d-Zw+we?vW5xHC zDyRb9S9JIubv3-%?*h41*eRHti#RYj*`Pj>J(ID5I>Vqo5hKkJ)OiNAN48Ve3F=~l z`bwUmd|yzP8PxX@hwXr%ni0XWss)a!vRy>q^bqOohyK$$^ZyB5U-;8s5HCHi-GM8vn^LQW!0v7r)_e9>|VoSZjB}0?Z?*e%Mj#LNSmrd0epQQUbOx1WOPowVbQ#GFF5C2q+h5XTd zs>Y7I41>vgUZo{5yo2|(8r@gA-@Fp1s$*q&IsU~9i11D`wyItG5)XdP)9@}OfW*rfTd-;-^j3 z806D%&zq|8jYa?4_d0Dx_B2&1!X>464|}YpVO3BHgsH&G)Reaflz^yDWfDMcZ`{vY zol~f#g9lnS^!}Xrgx1UPS*BlCNlQ_=10}Heo{V;$tWbSwd zXV~j}Tzzqz65tGuBKHeyfiv?HmJ}Kfke*4V3-YD!mfwZ>8r~Z3apN7Al6W-{_Ygs` z4b7qBTbP1yAuc0RMLz4(ebzLMq3;1y%ICXyn#N=K8t%)cX^gh$+k7`p(|9Idqi&aJ z8ZV?0j<+27!avhOx4E-6orFd2nZv7dlG&`Z^ou2%R}$H*w`h~i)I>IOO*Z#T)7We| z>iR0CX)I&Hs%aWKEV{_|+%%1KOgL(q#+FpVPb|kp!vB?pirf>YX&kcp@xuej=2uI< zK(g79$mTDLHreb-WV6p?vvrzA&JJV0|M)(o;Cv0=-f0?tkoCK18r3e*xagN@VhHk| zlEGi=63c(yB^tt?m&VWfIotAIA%<&oiLIZDE!r6F8m4Cbw7*0$V#3QT#}!gPEiGi~ zr}K{V`k`8PSo#%Gj4lbax>7KU(Vah7j7sJpOLgTo$(3>r;$guv<4TLaN-`c`A(Qd* z85xuNWlO(WxaV5PaKCmO_a;kkDApL5u*Sz0ZLIM;b)_}Nl1_g-kQ9`E(WaBQ6K6YF|GRV5rI^QXmTIZ|H zAIzZMr5vYmL3X80(pYM_0r9Etwe8~?6()PR_fcp%xmME2wPGjN{L*A6*NVN*b(bdk zH33Zn+-UQ;P8wi`OEsk3ZntRD0B@y!Z0B7?5Aoa&EJtf8Q@2E!dXkk!yYJG>2DmH1 zpU(zsTI-_;=BHE4$Ca{a<76p6KqFJic2dfAEamW2DciA>W0Iv5&^X*)n|XWj-^ncH zWz#ecTD0-s+0=&qyChZ0Uo6Mae*jQSUATSIHO{u+MRi+D*T^Rqm$NSZ0Js@IQT|yxNhOO~mwjNC*dBA`^MHr^ z(}_Di>B`!biVrc;s(hL%s08F4%_apJ1>Guu)4rJGLAwHtdZO{^RJi)>)R;s6f3bM} zg0#`x@6|I$bH7*T=m|1>Yi0{^jv3rtYr*r(%F^{oFr{u@zE#+X`s&MtYkY*2+E}=Y z;^m+&?@jigC)H(S0iesJ^*wmFK*M|c2S9EJcTs_!_1V8C&5$9N%iH)^20FBOrHHMh z*n#!A+9EgTo|pN=@cJ6w3d#-Q37M_DLQEwwr9r2>1WyWfx@7k^`IVMe#=1%DkWcWn z*OY~)*}C!Y8nc~WU&EH>6`5zQ7d^^5hhvx_^7UmLdWK4{Q^1o6G8D&0!v3$zH1f)W zA>L-jEcNqb9(H(uI)+Q-V)0^0mCsa+y|GxPqD?O2#AsL=+j3$1kKo6p;Wr8X1|~1Y zCQ0mErr}*j9)Bzl4B~CUMwk@d--)+be<5l6kzMcP(2SQ7zY^n)r@(-p0cm;(lnl#(9>oLHVXk*I0X*hHvh4jdw58sJnE!#;zpmC6;xY z5{?52jz5Hhxm;m6J~z3X+<=`qb7^Y{OH9&#HL$`jN^*3z94idRWeJWeg@eNHupFz6 z@YW=xJjD8W2Y-~IgJN-iG>%WPOd0p+=TZd~KtC5-W9J4Md9jE;;KcB#>z1onyT!C+ z5dCFxR+1^&gsf^8jK#xcQGW#=Yz~B@CD?`g)aXY61jXZnXHM~;q5)m6GV1425D?_f zeN_Vvn=1o7oOsJ%9910AKa|25#2_MKmBlTE50A+teN+PtZ;+~$qZgau1Zw8y8U4sk zfO$Wn@_9zzp3m=Pv5#k9`&w+dWldS_xT2Xp;xnw*rfA%>=>|NdSh$%ioZO~-O7TAB za_ZbI7>i?|>NnMc%~ba>svE=*@xWc8@4D$4BdiVsmG6h?8V4F^_?~PD9n5WNW6KzJ%Ry{fYf54dVv0I<8uuWI zF;#wbYN+9To2qwb0M|=A=t|5^VocR_lxya*Wu>GWb%pmcQiE6|MeRxceZ+LP{li1V z{6tK;gry?k*@j7q^B4`r#M zCyDP8aVilJL{FdY!RO?zKozBYE&968n4xjbhX7TI`0CHl__3je@5&h(N68@rx(h8s zG_80nT#J$te1SbKQ=fVF82Qf=9?-Nr=Oa!kg+I0^TR1{*i zi2F{|63h0p3eQwx+FuH-Y0-$K=UDkk%kgS@i(onA8o(ZWSj`xBvoY>w$-&)7qo6bx zjl~&70oW`Hig}F^Zn9aH=n|{bTNHh&eIr&#p9r?frO{%7y|GQ*Q{ce^1iIq`apdO- zlvais;6pii{RZLQ72Jn@Uk$p{gCj&#IPq@bk{EWXA7dVz*;vCngeK{Mk3~ugVm>4$ z$dx^OD!KM;tf>{B)%{F#94ZK|p6wR+0F(JX0&*EP1Yaq}3F*>A!y6+q(xa@iKi&-o zggHd~1mc6GA$%{|u5QB74m;KVWCP1TGM>Fn`2yL%<|f)KDgO8oa0-C6E?H9CD~Y5& zj@T6ME1A5YDJyE;3=Q|kM$|s#+d4y|c2f=Cju{$_g=6;&jk7Grr^=T#Q{!48FzE%B zuuDmb>xIA+K1yAG%OrUT4*`GF}dDH4(2*cI8K?V(cE%;cdP@&WN^1v zwj|jA9(5^Mu;;?#<5~4*aJwh5m-2WP`%QS;f6U&c1dmJH(3hKPcyA&qh$rN#-xOwR zwz%)H`99`K+nIJgHUsdqo#`uQYLr{v$6a-AnW-_4Qe+SxvxI@>PJ8UbN@ZHk2$w48=C5*q z5mJV)n`#s=_BIjhUVkJ)ZaF3}S(me|V5E>wzg)vjT^_T_zT^^pe3xs8K3DJu^=W@O zeJ@j?P_W$Ug#B=gM&n${DlkrRxP$4E$pYa}RTmsU55v5bmn{KvX|n8cje;sdoIX}w zo@nq}1x9Xfd?3I2A1^T!X2pM<(BWev_G3}tIV<*KNjx?w*1#0IPbjmG7u%>1-{8MS z)!$vJpvqqk{4SBsS5Z!HsNW@RT1U+qGMjGr7Q?hj{En9O`gioI86Iq*LUG_7IV}A# z1<84xcQij;<|h2R^7|00iUBmRPj{Z_!70r+Z*h9H!XbfcH`8#xG*e@ct-UXF-T5;$ z8aLCZyK<(+HO(|GdVMBqPWWE3d(1=f;=_xJvLd-n3E-*F(>QPS3UUY3K|HQlf|a{ z=M@Qa%#lK)e&1+As5x22O#=Ry(-jMZbjFoz)Ba*C6k>aV;x}8fX20rzpRoAN2LhK9 zX8IWBX0@B+!Q)qIcn_P-aEVBKOIWZZYeK#U-(AUq)6tIDf^Wu6ccGac>Z zPs|79EyH(8bIVsdjgO92$MSuWC5~3FxplM#&5w7q_S}vxO&Za7+d*1TJ^_2O65h5) z3VD5V8naIX*dyjFBFsW}C5B#AP7JMvJz}=UnkNiyB+&o%3+I^Trr~wOVS#5_Sp4r7 z@xRwBsug~f?B67u=6`#$w$1Ti2eE1X_q$*(xQe~-ERDw290RlSpBDccH%lXSl}6ne zvo!i%#cCkmO_uMOY#;fCT&3ZAewM~m{$QFli8LQEP0A4~Ls7>c=;kjjcRI)*2ZxYr z?6)C1<92v?X)Nv!^zfO$m_MMe8r>hj*{VPud&Ak6%=O^gt27Ei;SvWpyL7GxN3Jq< zLTzppd9K#*mV5%x4mg*n)2?O_7S7TLeF9KmZQs^e8s`$9QZp|t`)~w@(bVLAQ6l$? znENGHC+h1Welg&^KatlZ%&YO$REEl3M%}I!(CHmV15(>CNB5VrGzMBtF7y34OQX}( z8gBQi8pAER$al%B8n=@@O~dk1O1{-!9xU<49sGzAqhVWR?a`Kb`e}jD)T)?K%GV&d9H1qDP6=Cdnl#sg$FJ64SfEa{ z#9$UR(vd|kYCg|{5maL))nMHT{&wQWGD~-pS2gB;0#Im?@2*!hrd_S!D}7aCUXo#z zWw>1!mM0k2li?qg4oC1aUR6qTzBi%sz0`SYvi|O+*2s-Og8IClQa?yFKco7aGSu%$ z{C;LG>c3^R3yO9>B(yt{Wcb)J^c04yYi#*Wx+bHW$;&_1=21sNru`x-HZ)M5L<#z^ z1ZQ4jtlo$EpMMSa%Eh`5E9#dgh^SK~xJLxnkT`mw;Q9&f%4@VK##dI$hn1+=Dxv0$ zR8tCi*m68#IBrRB+>_+^-E#CZ9AycP2su(U#bBwu{5_n?2!6#7rA9vkpthX+tj#B$ z`%q8bEkCDOT@U&(aq_dzwDM9tev{QzCao(;>oVyGCM}ELA|C#mMIaPI9#@FE?0@bt0-_ItsII0S5e50YZ9&gDjrdmbA}Q%?l)#t;`mFrM2aHv zdal**s!!RIhkL>g8pNyWK_fv6dT35i(=iWSiNi6{l$Rp zlwAMXgks&3iuIrkE@ze*)-y88@CP2VrmqyKm6ZCQgw#q(ElNtQOiHby)UsG6F z0MU_*EMiWDUkr<*=x($gsFav+pd7q;C@FNHiCN9Fg-^@b!l5+TziF~6Jfm3oV<|hO zKaVcn>O_O3eLBeJ?@xTJ)M&=QxJS9euWICdYUW8@ft+RIH2%V+YP4L`dG%U*QRhm_ zGQ!-JTYP*Dg?L!KSl!4SrBp#VFiNey)q~Y6c3A|YPx`yw%H-}ph;ZY0vRiyp{N&vHTD(}GL#=M&5Bp&2%c`Vpc5_pDbn zZrEjvxI_82zp8ORN$w9{)wstJK2UJ~^{Pghg}+z6^JZ&2*FvLiz1bRz_@nV`jWv?A zG*Az@}R zg^{o@3Hv6@*7&o9hKQ=xlKm}mxX1N~qFZo(t5!>UWn+~U|Cmdz?VKar$%bRD-4vpq z+OCab40MTO40O>kE^29R-8?NZeaaXVT2r!dV!eFiIIAoD#*p6pnJ(|ji0RQ&${YRJOO3kwW@~I_ z*?yU=;r`52=-V#eDRVS-5YG|yzdi$|1DNQN5%p(G$f?_bmdOz{;68f}Px%=MD_p+j zb2JWNA+y(SkrP%^IUF=6{k&-k9c8WF5 zZKZkG??Wl`#RSYnAD&4Ys~OVsu2ve}t3FG3`Jcjhe=B-#P$5@d*(X5lj+!`v~y^Sb@ocI820OxJlSAyH3OV9i`HXFk6_eBr<1rqMUODS#+H^ zwbb(IyGXOR6cy~tS-gBLu29;fxs$6OAO>MfpE@|!&ij?MkwIvMI(!Bdn0-JY# z{$TSSEUY)p(de9F?J-B=MIo?@xWf`A85t83NoNZOdz&)LF;z?U%Y;Cgm6k9`i_CRG zsGOtms3mOCzCm*|wh4hLp0YP4^~9F0BKCBBs7Wvw&q>%tmn z=lCNx`$HuygYg(1QxlaM-2}iutqO{X!a(tp?~+mmN{t~miox>h7iOAl5EcIN@^C;F z3?Em&RWrhdYn4|K4Dk!rCLHY`EF5e*(e^PSTb27`F>E*Yb8{J0MKDh6mPnUyhZ81j z5p_C+oX-9-2XC8ntu?&E=`BILBP!Qw%_cF%pbiV_B0)_iiorfv_LiJ0ES6d2Wvw;x zsw(_c32(^U6W#@64&nm=TQHNA#6+-D(sXIfa|gjt{6=np{h2j(o(E+K9QtLio#(-Q zOtoE7MV-=MZ|s+(k5L)+H=E{Y?Ai^`?i;dvpU%-3LYn*gIU4&c;hpUK3+IaOCvBaV zU(wC+M||~TePS(Wc08d*oNP?KCtLO-_hg^D(1TH}IdlT{NZ8bAgpw*_Pd0U4L!>|I zg#1zv?8%OA^5E^(8uhE7_GEL+jryz_LTvN!9@;I_h~EYLoEm$Zeh%bPHeStP(QC9} z9keGlf~E4j*m-TZ>*X)Ok{lk+y;3+z$q^0Wy_|{bJm}j-!#jzn@fe8EtiCT>tbR{hjr_gl+~8$%HU6~Z7jxit=4zbtg<*d$$M@h|jWS9Sf-gyc`|-IN zg%;kE;~O(qBTBiGr1spe&edpc$zSF8HqF&|jO6Wx%xtc+=n6e%vMYJ1f39Hg?Hzr-t3Hi-(ho2`&+EtcG8;xOr znq+&Hsnx_Yr&gn9)^4Za9rp!zD0*2nt`qr)nMF)_A(mHT-50iFjk!6zU1~F*Q%!<^ ztp37$0Y)erN#}J-Ut~hTZL@T41GqU3+F|MQ4E>XIIxFr=OMk7JRNPhVG;GCXG&^}= z-zWWNo2cX9N%f;P?e5EJa;NpnYKzM~Xw!~o&v;?&%WAuB@Zi7gOmq6Onmi>~KL+(> zweLH50CSeQZL2QPU|AU-MEJ5AM+nH}gZ^f7_^WCM>v<5PEs{Ne>21pbU4o%LcuK9$ zHcHHOs{&~mnCoU!eTsU>>fBs67dxj?4_OAE>oyI$FBdxvvrJFsyE)RB*G?lhfL(4D zW<3GMx%*6H?jjiA^}LkUN8D8UH&S8|e+YlLS-8{M%ZTQvn}u#npf?`zFy9XCHN4-j zu6yIKXyR|r{^GAMfV?;sdEVW`li2Qxc^cKfG;MFbyY8d&G|I{7erBG=S(dQN?VC7H zqpH0|-C6TA2Jpw?c^c0OD?8b`mh}s_H22v_LV+cGYY0n{gv%}AdqY?wgf;UtT3W&{ zZr=yb_w}45Q|di7 z&3unYJ^gwOk$N#Xj<5D2)_=!vEZ`4ep!(L<{#H+-_P2Ui`wg#8tj%uqu=bl14mnQA zeNHqCZ1u3xT3??SC2W**4i)&8kS=q42G^3YlO5ughOE%n z$iiQFe22$s+%R|wu>Si?maPB1HqC?@ zQvZX=L9d!Zj=!mYKE=>6Y=%>KTFuWfeZa072`|_s@6FD;A>jqPYS0VbydhEHyK1m4 z+6p(!QsKL6u)@E*;rI&wp$1*%s8DdY1}prm8ySl+c%QBCA8W9}8wfHIz)v+;;q49R z58>w;tnebjRrsX_D?Co1H;#xhgKpID{%9(Eo;R(+k6Humt|1jZ_Qphod-s^`;cyM9 z@aZ?&3SY+`tne+u$_hW*vi?{@D*S69u!7IGgr90i1?vtP`I>P?rJ66@bHZwFWE1^T zL#p}Q4jNL;x%|OuF60kZ^VJ=wY+$}d3!A3D*Vli(M!OCgzNhDF6!FKX`5Ha=W8!>` z{!Bc3zQzlZm_BlkO+4ExJ~ECR^pR!c_y-@c9x_P%Xgy@9H{l^mz3eA8bVzu}QZGH^ ztqutfS?W#m5W_4UvfN7#+27%K582|ShqyYDf~{V9$hibk9`cr#9@0dRkpSNJ(nDGs z&>zAFUV2Dp!d2MmrHAw+&>NqKGEWiU6x4}gxA*H!9*pV8PGXOA5<^Z(^O;I(u;pIy znYkTV4bn+i!d9>N%<_)bXWruv`pl=oN}m~GS>N`G&-{@jykH6MdQB(svW4IGiVtOX z%J8ANC-$LbHqlP6_)yJG)`!mF5Bku>{6QaT*on%op0BaVruo9_`(wVwRh=|^ISVvy z;g8c6Xat3oCxiA{*3Z4Z(0Gjpgg{sN-Vz3#B(5}sxzLrSlH+(+y3rpkbMTD%KFf45 zFPxNcpchV}1I_Q0aG)1Xq62Lvochqba1wpu<4y^$df}uruQC$Et45wgullBw_|Alr z=sVud>|N*=lTV^woJ+VjW{8CPoi)5iO~rqhUhz45O`kCGB&qn8ooPE({Ardj;UuZ} z8#>#Hzl%Ru@g>5_IGpEO*2yRN7>Kiv5ExncVoR8Dl0;U1QV2BaWtQ;1G3qGFq*12} z$N391uC^S9PV#kGps}#ChVPyQ8XL$OT%hrRuyWMX*|L6Tim*=z)axEg_}=JsSO_dz znI#-DWz#p=vYp8vEL)wMXa;H;v8=xtO&gJenzkWFs`?{Q$4uGF0@pdkm1P*Lme{fU z(WD0)6%V-Sri2F^6%V-crbJ~Qm8ycb?_Qo)E)SN4@RuYB9Fti%7SGIWh??gz{x<4l zRnQw4bu#^?C$nEloKeY-$os|fmK zfyN?Bn0T`9)P)-RZ_<#EPV23NCtPWfcHY^0TrekA&Th;5q)X}~>t>k)owHEmdn^6b zlk*D~5}T^35~rjx5N{ES1!M76QKuvr$Fu5gW4%QuCtB+wvDGOz%Pn)Vw#AZ@xyx}j zGf7P@oQgnsRE8E2`^ryDVwO847|N$rWua(C&4kz;HCY99Zq{He?WoCG%4a53cwb13 z1d#grP!Lz$tl|BY6;j2C#Ycj?kx189T=v6m!IV=ixLYmMsP&a;(x27@a_(KI@tnF! zjrR3gs8M-y!q>i$tkcXAiH1vq<&La7VVL^Jdhg0pO+@CEr?SK8YZYI4Dit3_NL0m2 zd4PO6l@DOmsqBx|+^o&y<6l;vRi{c%vh!wb#+l#q2V2{()ZN{0p+;THy6)68%}V{T zxYIkr#V8C{FIq?cgo-)-5b(*VoD-j3lqlLKr}9QDa(m+7soXBQut+1fXL+~`hfZzZ z#DhzUv{@T%WOF-ss;rH+{3>H@^y(tJHrlo*ZEbYaLXDejxW-rv}Ovc3vHSXk( zbqh5D{IPAJMg@QDTBy;RKfYh6@hE@%wov04YO#H)M&K*pK>)QfYQu@r>6}p9RLJuQ z4;@)6;YuTG(UnFPX%v{g!eYh|6YIk#e&fV_w7`SuN#l&H#hOE21TWUgt>Vlv>C4CD zX>aYkpsqGfJgOEWzF<_XBX4+6eSVQfJ*oTAqDRfOL>NU3=IqVHBorAfdR*{cQF?U1 zV{&YW5o)`gpiNAcbE3%ql%+D_EheiA7Y-8ToG9|I=#p@PiKcX1UteB}uIul@&G4jI zv7**_Z+dXQVDW))Pwb-M?ao#e=vEo(5yM-O_2Mr481PFIvlYL*mV7MN3V};54_di~ylP$-(S~3Oyp^Ju(D{e=HBYTm? z0?YA1EnnS58W-Q9;k#s!M#EdEDi?9qT8@uvrQO)tY&A;V*pmF-v%EWM<#S!tWOh|j z)TfrbDP7c8$B9Zg5>G9J9Dh{STYdG72an{VfzlfeIZZanhMacYn;tl~uoii04nt0( zL*Gw?t!RVkPfW6+hnz--9z8m% zEz-Ei5=NcoyK#|*_f`#Gmqi+9@yCA`Y4~o{=4wj8K7h|h-09=Zl;)I>X2lABq-2AFcSrUWZ#Xc(8u7;_G_15(>u2bEK6AT`4cwxUDq4Zi`Xe z=%lbIN=bq#k|30kpjYvoT>2QT&R3&{0+`2)d3bG}oGtIg%p`{HJUI#e@G*%ygsU99 zr0SZ)uO$+{CW)U+CVov44<#I9^j`yy$`BScZw3bZ<>hkrWsKUPjM(22Vt*5{6DUS> z`c1^nBrIYLyjo!Kwcljh`#mC}PFW22O>M95!Twt{yiMs7K|Cr~oPMJ!GMa3=51=7_ zS2D`gx3R*@7in~~g#IqyXjV80DZ|J6n3oO%IvK_H^E@z(xnE8MpLrWk?Zl(N zemTACyG@%s@3o>2xFpZ3Gesw#5n&#Q(MP9JyrLdaYIH*YRjMGy83C#|Bk0U*A0H9P}dVL)2*IB8~3*07~xVdvlS-;M;gEf04!*(mCYs zY3c8~WXL~@8oNJVq|rM?P>VHIFr|C3#%89hwOHdJ%kYNVcg13jkIB$tvBuZ8Y1D1M zSmQ^^N^c>5Q~p~*0j|9{B^av~TSGjd5|(&E(G*8nbYqGq#1(RGPn7)$WeU$3_cMw! z?!w!7n6*y?<^{0k1j_<)g=LcBE!10X*Kijt)_B~OVX*S`T&!`=?evlR7i$c%gptZO zda*{C5GF0w7-k8RlyCWBjffD|FV+}q36quY)5RM7Z`Y{1my*bla<9L!L6<%e2jf(! zaRatp;|KGk^v~a(n1Yzb{4!x zSZ<27QwS{9a!XiYiuG-xSU-~^RjhQ6mMsK~SDRd>G>6&hBYXmc74;W&FAr9*<2x+M zzkFw+Dh~?>%*wqX!n>BuTefYVky8P4?qnsgF1B0Uo_0ZW-IavJ^2>$s;9`w^mhiLk zowh_{1Uw0=;X84gC=W;_FFG+&JyEVLrlEs@W$mVx*x8V0A_D#XIAy#HedcSGV z^Ibm9lx|8AJeIJ~5bhKL&2*|Ith8pjC<%+F2JW_=8cL=pv>Y2B_iKN<}> z(aurlwrDW!V4~WPV+_+@E7O(t*X)1#&=%5_8+eky(v=&;4kFk_(O+{`n{$swZVUr8 zTYF6c@d##WTKSxNG`y|%Gw_W+?vG%w<~y6W+(SDRrO?9#eXpSZOSCkQ1)@$53M`4m zdt-@a0K_W75iHe5-}K-~NfJ*cStUt^kwucMl_W0{jzt5#u}}byK+d$(S(7=3oO235HpAnU-?jc<>Rj0ZLciFZhh-!5B3s_;d61F zLj>Xx91z#}qpODZtOH!0;dSyul3%TR>1wRWpQI+wBOJlc;tUP$W$(h8Y-|hqxv9zK z_u87gmp@pO!Fz2@UUML$CZiMqv3qMPW4E#U3#5p7J6gie+IPuPjaMj>cAid-lsS`M z3m!g^lN~(1GFff2pGk&xj{$#3(HGvU;qAe~7UNIN;Ir$Ad4QOpy$AD^$oCE+t{9JI zk?RNIrTsxiY7p2+fzSgLW6 zU&B3ism786Kp}vY%C}*uMkC_su^TLYw-S$SDT1~w)!3RM{IXQzCK66Kmf&d-vC0$` zGwwB#H)3QIH8P96$$$NcUU;OG*SsS4zSVSUmgMX(1GiqL@o9?i?`0YxzlQIsWg5Nw z8g*}2rtvV9e`J})KFc{b%lFDMjVH;ua+$_Z{@AiiV-z`QuOBSu3S+OS%*^WXn9 z-SMmdI);vzNqgD!GTiEV~UEvNO2i%T@S4(@@yZYeKho7>sj zEj+@)A6odO>=StkkL{J0%bHIsxpz5TonboAjn(B!;l}FhJsXzrLU6ZWpj*p6aR=B~ zokw=Aq;}PoYkXnzc)hysqU9Q`sQ#tPHEt9&lSAv|hb-jumg7a{{Lc)v)J_t1nml(( zp0|`FI)t5)8**bjGZYM!IKAhGojekLhZzFK>l@w*&A@;EFNzg@q}F{9H7hl{(L z0vMk291ZVZ)Tx3_k3ZaJZ}H$_hu`WZ%Qb3zW4fn5+`j)V*SO5l@RcmrXvQD0shtGF(2hUO1|RbMFhXr7g@qy^R=GA1oZd%7H_}S3nT%*)=g3beyvxM0P&BjEM=b( z|JX<+=pS!UCcC#b-Jt(L5&vjF!VUUpri;A;ezicS2F8R5~Jz7M!P4gSbwmr3qB+QbvgShCUbP#k?t= z*KY72zm(?X7`(zNHN_)i@VHe!IR?Mq(r0<3PiW1AX-cOiQ7wb<3O{3HJZpRB0X6It zYJePW=|bIPSZrWNU>O!0L@y$^s?n)bf;U<86GV$=U_cG7b_^-yeU)&u1W$_KMTD6S z1LZ`^YbG>;N_l*kB1)!@YG)G~IzHNT~;IGi3MeCL*N z;T|v7;KZmYS?plA@LS`UgKEemqyvwpTc)Z5v(+!QA{N$AX1cMk2B)SE zlri*CEDkIb>kK6<6=UFq0!zgh#D`*mcvNh>TI%3;qNGyR*5Dr3zq)C7AE4!eSSM0j z5;L6`vH51PWl1;o2ej=Lf%_7UV5``6L^t^oaEkw)E$!+W@`V~ticCO0w}dsu=1YXY zX1CuGHX4hr5dsbOgC%S=hTB3y%5afrxU5Uqw!04gSP#rm8|`G|&l;+Lbl^`Z^9S8H zuM@lcDMkFMTcYRtv&P%6aKSQ!zl3s-!*PE(eFpEy9{;YOhWC{3WIJNEq&Yyg0Nxd#T6a@(*efE=Cm1d*#S%%}y1RzA zpCm5kS9Ou3=}hcoVuM&Lm^-?&ioGj{W9m)b)=fR=L9F+~1oAyWJ}AiVh>ZB-aVHwW z0g>@EvkoP2UkmOv=H&aHV_rNX8o7FCT%&gn4WC+}(N8$2#mkmsH&pd?|6C2TN+5lO-vOL*N7#tVU3 zEVYCmj25$mz&zGk!eoMK5==5l~Izm!FujNpk3xu=YLMpsB2kE zeT^n-oL0^+Ew@DTExydn7r7eR#E-d-nS)AMeRepD1!`}WQHzli!L+K_lY*k5(fjODgw!R(kmXc-5& z;P$N0c-+FnT)xIDG}=|Lt~s(CW(hBuZKxs=PGp6sQ||a(vaFTpuu*$&{VHr)NDeaq5+W8e4-j@!_HIAvW zx44R!Ma0A~O-%FwG1~=`^obcF?m$Z1Y!UZ|6ba%C-`dj7aTzoHY~h72@qua~_P#n1 znlLH!EFnVBoh;cjxmx>ArQ5h>Z>b{>#BJACXRy1c&8v?FzSv2uj2 z-O31>H4kx$)&qU1;vGyEL*M;dJOI4^wzQ$rxJnFhs1mBTA&FGb%-)_CMZ#g$t@k?8 zj6U-e6}pdjagP5U0%*)Gvh(=7;CXT{VDY!h!M%z@#~j>?Tk;(~p4)p_lJVT${T6?h z9NSwQ)^PJh?8j~TCtSz9#5n8_aLkL?YvyT;vnif*$>F{2%mMB`D>P=?ETXOb1 zYxpLu(D;EI?u9Ef)>?+D{0~;}X4hvcG>%dey5NpOKqCOpEAxcgE(^b?e2pe(RF7!* znorO;jXzpX(D-+RCKQ|Ovx4U-G0M+Y#pG$mzbt*e607)_Qmj(_2V>-gO3czaV$E{q z55}xdxO^8))bK|%jA9J=R%$#?jyqOr%n%NCoINbZOUifY3XMhNU=O-QIOra6%Q4=VqMy|!X^MfC zKEasc14;PH0*#TDFxi+QtEV-^WGlg%qCw9Sm|{WF6u!_zjppR3n#k&b_{>@>!`h@x zPa$RWY>ED)GL-63ma6^A^e9`*2X2dEpK?=Ae#C(-^69#>r|IS1mKYO(o*LfmKLB~L z7``zr(0J#EwtR<_xMz7!>zuZxEh?oc6?0Oh#!B^kmML^+Rlo%@bmnK{8@hlTb1|@vY7}s0WWaL?nq@I`=CW9m zXreMYv-^e&(<11~S>r8HK0f1*^+4C|bv?K@s?D-f8(aFD;Qn=`MrR9l^_{v(qeoQ3 zcg`w}e*BTUN@G}5qi*3UjY<5`e3izl{Lyxm#$x`sWtGNi%H}oLyREQt+4Frf%JC1+ zKbIUf7LUrN{^!J}SteQ;N>&$EDc)yi_4MT|SVjalhr{tACl2&|Wt#`Tv0!C^UU*V1 z+vY*_m~GKLY$lJZi<+^Kx?4`vh#o$!H{jXX{7eQKSciPlwC>4BQ&((~@ywFj2;($O}cCNH`jg zVZ4M&L0$qLr*^Uhh**Zww{hi8jdrrBuX-1=u6QBXIK^be z1i0+U~&xcUE!O+Kd2PT+Kf5O37tkQ|$O>w%xl^W6|JYY?+QAwZhVx{d97VroAgpHN9PuR&H>=VA^ z5B3S)^9TEc-zklK!eA@S^a z>Nmt1RbkrWBBcu0QDBku6gOA#kT~ZRtcL1$35caqM>R{TG~ClxX-u=(FIT?xt28RA zG<@4uX;fwEQ5uf6_6NEZMVvs;UyikEzsqDg&7}(Z$eRe5=DO(}4<4%0@Xlw0@dq)> z#qZS+qTVE`n;);b7$9LJQ9lwD#9Wz=O(&-IPyE7~Ok$WXp?X%3(3*tqSnT4G*>+;e ziHTv2Ox?a9<~hMcu))Ow{~`sDe`4q9KbZ>HXeOoS^y26xX=mHL)h~*NBUq>QWU0|- z0{F;`1wK;C-|^tGUL2!vlJvP4u`l6@2=>dxotFuP&Eowxip^pbF{Ra_@GcRp@uP5@+FJu|o_1gJ6F?32D>?0ct`Io6-fRiq7=NiJ1RjHb z#}d9*5?!lJZw(1S@ZnF1g&N=Y<1|W{0PYW0Y3#Ns4k=%?*EAmQt>LTnn#Sbb8g=tu z(^$nHtzOgE&P47GuW1~%X`XWV%3ss?m>lufG>-DeW3Opc@1s$7@M{{U_0h)iIX?sE z0@!$pY@+hbf>ic&eeEOq;b*ecFQr$=;OC?s87mu z^71*13spvLs&pzHUwtRklRvOtJ#D>ci&h0afi3#bJ01+_qrnA^ExLL?561T4uqA@6 zn%5-0ClrZbn;zNC19cxeHN2%qKkUKj_wjnf&s^hS7^IzoY;hk=Nq6aIHQlPkU2YTt z4~so*2>@_FkH6c@p`}}e@ZxJ4&soCT=J?r*Kbw)m6y6==llcWO1)st>O8_xX~W%+rL_4(|sEG zhgQ>6T%$Y9QWxuduF>&dvKu(IE=wF!mmAby%Jc}|n!5Z}>hi<;65qCOr9R;PeYM89 zHiPfAukIR+{Z#OhH5$LNY>NT-ECWXYP1k5NweULai?7j8_iOn2uF>$^&pt~0`fAH^ zSWDwR?S9+1ulvO`krAeG*S%j-Jh?{W2Akrj&R@Ppu*~{qi+wZ;!gYs*AInN`(eM2h z`*@bL!|pZ{`n|i_B#oG*KbhsrpQO=<+VDByM}7e=;XR3~S1*M?`AhDVC~-)l8awS+lYzW=P%xa9#2U%Ry$p$9bTc3!LTq_B=$ zt>Lq*bF;+P-xR`s*J>16!s0C7Lu)m@6aqcGxh1U05)c2L!o|ZMw6|M2T872iH))(k zjR!SkHS)X%Me{ZDH2jw3^(<*ec@NrlbR}7&3+Q7xHfE)D0sVe89Yv}O`1|T(L^Zsw zwz*90y<=+c9jU$64{~LXVd*}|;tF6F!cOma)Nc{@5Ya0f?SY+HJpa*+unlDSp5RC=l)elQcZP8SnfvtM0T(8rw;ctj@NChqI-H z*ZIv@fm!{1bq1o2Kkl@RVUyySRSr*vW=n${n#~6JF>9!szskX|Y*y*lgn7Ll!v+3{ z3e$A?HuvG#rgyv2!p~((<#_wr-mQgI%l2;P_7&&lI%7MVVpulZJ;pVC zHN4Lg6U2^e_B*#SAF~-S)n;@k8}2XHYRtCqd)amWy-p*@lJfh#-r^@`OE(gu1ZjiY zEMZD^S{vN?+p%p>iu;A-otmBK%-PNlTI{rJY3EP%we5Tu^MKp8PUBC@axlBDf1Sq5 z39Y=p8~2%Qw3@~gqE&56n3Jwm-tQ;Ws;T9jo1xXU7CX;qwIQL^cIJ`hgUQHoZ}R#U zFYGmx*tiWj!v44~C!UF0s0}|_;K2c+suFh-<$?0UeG^~lhKZYrjrrqW582ML!|&!Q zU?b@wFMNnzmK+kq`otuH)@IdNN&b&2RZs;yswktuL*~-RqcY;ZhEP(UM->(7kjSNr z&4mv}F~r$j79OH}3~_erLp<6wPow0x{BL$*PPEEt!Jq_A3AU)C%BZr!sIo#-iAmt##4N%02gAg99@ePKNO5%@=4frx z9F4v<%@<1Uf?o2ly^h;NIB3VmEXN@w5#m}W3C~!j-zPOW@6Q7dQA&5-Lvqd1eD%btfdYvoL$|2Q_ATSApFr=(L6-clcE zlTW@BCZFtQJYvd{PwyyrgwYjBs)8{Gh3u`{Jfh)!L24M+ll>NQFyHH$@4b(3C2YK* z-$Z(k1pOw`t4Pl%GdI;c6=AztWQ%-K4Mk5gQ^T+&aWBCcai!^Lh@adJoPxq z?QGP(PDOZIJ!HyRCc?{@e6AHsCLSZL$=y%GUA|6ZuT|=0Exm$xzdssq?1EQa$ieco=$!;Nq)kT*QS#vB*{Z8`Hgh)sw8=&C2vnB zf0!hXv*Zub$v-8@(=B;dI=SX!39HSwn5*tK6 z`Cj*Ul7kUhfXO)uP=iR?8Pb!Enq`Nyg?T+*<8;e9Ov&QJd6tW_b9eT7jf*XPxXQnL zJu^rZ+$>R)a&_-Rb-gL`RHbCi;4+(Rx;>lJGzsT7pP+&K*8D$BSki#zfdhP`ZZZ;Q zbEho=%vKCaRz=f@88BN0CJ#NC7%j~bamU(|PcJAq1`WKCeCN^Z9D zm#DNlxx=b+Or6|od6%0yDYIOxla%$Nm7&z30eqtNxQ)G5E5(!N6%N*lfnI!4!yp2F zZnx3ljuKZE!RunvK~HITLq{23x)|HUyT%YTm8cLtQk=2;_>_iuq+zs+{#SdThIcJ!uGPl}29E1cMU*e99YFi`V-fFDJhZUQh6%`SEGWgfgTP<+bR=)pgY+ips? zQU506a7J&v>VWNh&1mcGNJUt;OW^lL2rC6}as)6$da z-?j9yX1nSWOPBO#X9IgJ{ZA!N!Omnk-Pf(x_}&tpa^;svgA(_1{bhCs;>qgAr)tberuJuRd+2AjZgQyyTL!Y<3EHzIu-GpLYUDYXqi@;e z;q-zL0_JM=Jbw<<$PLG_M6>6~dzzbKyiEMM-2cCsaEzO>ugksplBYHDO7W?cQ%X6z zL{6BTrEwh81L}J)ULf{wzXS(Uvz`UmCtC@y>Ej?NH{3-ZOie8k=aKG zeD3%oOE{|Kx#Q=Pg#DR>dC%B)kk5xoe+T&!CV=~i4H|h+@?{#3<$HO9Mzz5jzUdn@ zE*eZd=WozxYB`2v`99j9aoJ#vx`#Jt1O{uku~DPQ3Llc?tG7`jBq=9n1Aa>wk>y*L z4UD7g&Dp>XazIucx?ADTX34U{Zc>C0vxMgi;TsZ8+}PxJP9b)wY05OYky)yqgBP>d zn5zFWSfgI4g=$tCqESyA{Y7!=v(F+zTEdIssux^9L^zHYv!ucK2qs&?7)jLNiXj^A z`WrPKuu6`}@^#v%(SC@A?+#joKgu?0+|3_V8#OA1uvsLBDCwPr=-&{ZsXL7NpKGfB zg|y-7y_i-1jT-%JR(rK?@|{k+d1VIwJ_n^Ws3Wn-_R6mI!~e3~0td()1zZk29EKGcNWmV5Z43q~|GF<8w8{ zW_rD3dOb5;H6$?}kaab_o^%g|e@J0DJc{szI!lfA-8fg{N1BVr5snVgkmCqB&!*p? zD>F~me5syQYBUdW&Qr=e5DK|Lye4C=Q^@b;U7Vp%a@KRP%I9Sqz&&@P#z>3Zkp7Bx zS-_EZF|bFyYX!ffRBiz8sSclca5iOTMJq$`V1<)pu3r}J74=67u~+4)(dus*8saO% zkThH*TwdNL>JP+&;gG-lws5qE6K&l)7{@+256N;ZblGc83tgvN#7_d>>|5d*+1P`; zXEkz5obtFIO9j!8hzM4?Mt1YyN&+#bytGTO!oezGX!Wc%kDHCPgeeR-u+=<1pUwvt0j|kr6z|)fO;qoiY*E!am-P|1FJ-)* z&4s7cl&t!Igx~ zwT3Y{yw*@Q^tgK#tdvzbEC}*q@m^S+Q?;8LvEQ+vWf6Rl%@K0{ptnSmwy;)kMqvA5}r8z3db6yPIQIiEt|p~$3NvcDM-uLH9oa@ zJdtBO=PL_O&M}^I(89}d;NCY$Gm@k96RUFIE`43YO7Yz#uVjSxJ0A5(U(V!F19Hi zu6Eq@jLU4Ic}ngi+{V1BcpM3EuYO&lnN9j=HMsY`uF=B6!>Z-0O=1wwCXMSY_W5eY zm5MApwVLdaSN}m=Hs&~ z1DS$H)Lxbpd7CuGSdIpITV^@|ky40nR9houO^&K3iPq#WQT5mVHc>--t6G{w2eVbZ zvIq`I&^O8NXChxzv79b@mwhpVOw( zSXx~=jl8H6lX$CJt4lX3jdHfN&hOO{O_f$(WU&XU!_7Mmt1SFzbvG|Lylue&r^qFT z&s<94RV6Mt?6>f3^ZmvNsq;A&JH5JTCl^_GcJ+L=6VpfvbfS^Kcw|${wWzxB$ZIXUwz_y^ z6DlL(+gU>Y>IS~a!cV$0+$vEk;uDSWz3e&hd%Lf?b&7q}#VP(XjFandFMKPN)p?lx zg5GK69S~9#AE*`uMme4ZoZ7-*fy4#5)EgAb!yInzEH-I^A9xq~5&*B& zRP~~cKNb#QOU-Vw$}XXa}R3H9Hx<57QyP8u{%8fAIiQvKFVVI`#d|F zO?I<^00I`Q5yKM=S4FQC6_BQa2zc$+yCe@`A=#|E8v(r*kgimvBfaqWAaa57<-Y%$YN1&Xi{g%`GIqTuO$?H_0?_VAaj>>Cx3i-Z+D@_H!Dk zSVHROL)lKzk#ol|MZXE-JSRCjty0ui;E7Hq4^;*w5D~97MU2wW>r1Z{t#S42Kz2^Z>$9*! zd4bZ+c)8Okk1hEaw~?`2Ym8UyaB}6H>;^$v;Y8PJD1H35>T8>Ls9j zR?|q@eVq2|?uy*wV1x`mZDk|1=#Kdq3cFCsvcjncx+?@e;N*j@zk#uEp(5pY&+;@0 z(q-eMO_!yMONNCxXZ$O@28tQ_+1E9qvU^4tP%!R620@QObgOm^uFJf90Z%SFyos})%SPZiiF z@I+Ts@iN$v>sx^=ug`-4HC-__Jfcgt5I5+Ani4H^A;gyLfgS9Ku{<_j=0X_G1TxD{ zEBN`W9|5K11Ty@zn#=ne5Qqb9?B34g>P7V%7c@!%KrrZ)wE7R8y+8x?J3w%@g`E->ZK@5#!k|KLY^2OwQ4>p#<=@7 z41CF$EWA_Vd8vPnaJ9A(IRmQ|EfxBrcxRW@iq^&$gr~PJ+me>7R#dFFqNMe!6_vq{ zJ*yQZ_f~qavQ0R58m51qqUU=fq}&>!C{GA`4L)aGt+ygRXZ-;DFU~5hety0 zTtyWGJKCM{c&;KcpUzd(uD7C;7Xc={nX9M|ggP-re^!LdbRN8B#NW*SL9ZeV!T3F^XCUVVgUt(ilbdK1zSw>FhA5 zE)ms>dhnr_L;FO*gAe5VFjvtak+I)xw$D{mw2vaQN3NozK8lita4;i%k<#uCA#|8 zgRk%UC@Nbp_-fNf@p8hVM0CsDkxyhCbB}Ctd}$Tvno(DGjCtw?1OvT&Z+^pUJ!}}TJn7A;PeRTK z7ai+^JCP0`m`1T%IetuP=fQD*qKB^wsZlJ=|Be7{ACI*xy`5IQr{n z!ro*8l71kBfja3s;iMKgqE{6ETqs$7e2#9yI!3e=HM1@}-7*$9bggeoFj94CX&V>U z-&gz4_5}FQ4}BH6zeM5vei~8)lZ`H5C@}c=A{al61`=bKChy_udn-`&Ys(j+iA69T znGYg-Cy#k|0!+^d=#kle#+^plc<25ADgDs|J}_hSgGFJlkwQ4G?Nyu!r$#869wC^; zMk;!k2}rR(2!o68nnpP$AjR4Ufm2jq!h%_fwh3WK5x&Cj4JKecC{GCEi;(kNuA<`t zPcD-3&>F<+vTGF8?5A|Byb^2BTSSDRz_V)<-HE^{^}tQe&(|o5i_=_vRmu;*n(fyp z`hv4`Tqi0PA)BvVC;AEm-S0mbrvpn~5psSzQBgU8j}|eKA(!Ea;PZ6b=pZwm8AW*UV-Y_>7B{?~qOyKJEoK)< zoZe57yH=b*<drfET-Qn!kbd=ur;st3(th_aC0JF(Agp4 zf6@y&hvEt^=$sU|t5c7T&PTym%DE=6EalMevXoQ$cUU!A)yh_e*N3=4KiY~;_uc^lyqE1CIvwa*1qk5aFzI0C1!iLX32-Llb8s)LjPe!kz2n*O@Dk6Hbi06J+ zx@^j+9lXCTTM=jBvXvA#T(&Y%Fv^xBu$1kcaM?Uiu~6C2DNsvWw>TXPhZZ$b3nCj0 zEsD^V`MV-_d8Z-!D#oy?Iln7PZj5=ohQEhs_p9LY)1sn?lWmc%1~52*zP{+3^)4C> zHgbOkte;LZ-&*jc1CvH)isFi|9n9s#v_4BLF{Y@7Lj`cOvGsLXKiMYObwOGr8mU?M zY(Xs&@!jIk?_n2ek;tZZe~S$Le(IA5U9TfY9!0g64B90|HJvWbKQ*0;YZdhr-VTXQ zd|T`9Gzb?R?F)ZfBaUOkgzM+T6vQ#XjumXj2=9K{$8H2Cdfx zmbpyX{xX+&wm+;@$S3MrK`R6Y$7U#tTG>uY<6V?!Bzppu&l99IiC->t(QEzj0Ex>W z+)uDB5%&}P2dKJ0HS*BQ3UBLT?5fLzi%ScqS|{}O#iE+mcHz29)_&pbre&QFF32iq`wg=~wd++1)~ZKs zY%|4Bqly`+SjwSM#c<#3p8kqbeL;X&hk0~BI2LF!B{!o9Oer^jKO(2m)M8j8dS!qj zo}69~MaC90F*$vA0ABaYRn%#K(lgWk0~Bdi6|Wn@EX_JM%z6huUd&ZgY@nnmgC8|= z6}>nRmX7osIoC!DBSboVrd?L!hx(@R*>-*$VG~{2vN7 z^!mKPMujwNXB%r6tl>AT;WyAQJEF}u(5B@;MegKygZK;hhyHZj$la2!*6abZ@NEA% zQK_Y&muOxVxV2$o;bs6c&ReIbvJl!D=FxSEroh5y)+t(!!r@5hd%`f;mZFb@{;y)? zXpP$2x=T@p8eEp41`4x2QkbEv@($z!+t!nOh8b+!1Hi+$UkLtgrKzJ7`KFRU4YXC2EI9E zBT&nL^80C{fi5~9sCc(Q$=GYR$;f}lMOPs)GLzcG(rkm#oV4e>4c>dXG5Eu27E?ZG;01}Mf`AmAUivY+S?FDR{)pR z$m7efs4FMjFj!W8yNJ5IqMwZJ<2LTzvVcL;P~q)u>KztP5#@R1>y-KjhB61a%O)6vuY)u~6?@l3Zx6wTWveMo zWv~{P8H1zOMa>b4cp;&hz$2B3g@k`G;~(o3)e^!uWj?W9(U(IMnJMcPHA2Z>Sg+_S zX2r6@r@}f_@q)uQO!((wMIIqc(|4}?1R1z<JR0mzyJi$=5pE}tt*mQJVpl!2& zZPOjLLA;^`Y>WPY*;WhK5;IZoV91l@r-fYfMLlG?c zN4Y+N|6NC_)=B)LKN)DA2V+7w*r+8GSKy;fblpTsArU?pXK2Hcc zb>*3oOeyWA_!>-WHy;D#h0@Vjh=YYW`(wrcDjOBx2VAP>R6)^}()-E&x<4^rA zA$`nW`X|C5m?f7eq8DxWOaJ2aipoUz4y{)-XQ-m2{Pl{Kb0!f_&Pb~h;OiwZOTx$Y zAa${gwrdk*8Sa!K1|_F^@Frt(Jju8bn!f_1?`==Wqf>kXEA56ke3k3f)3_giJIt9m z@upx6QKvb-cX$>A=O618y)XE0%ttpUx`yJsI#toX1RXHzPE};^-Y(|Sh}t9=t%#8!h0oF&_@YrY|oo;42d2ys%7@Rf@)n=;a1GOaORfIVH+r3i8Btw1MpG z5dCUv?bK!5i)_-G67A&+1ltT#l;`|M!@PP-g-cW*2}pJen#MxOw>VFNnL$BFg~Q{=u0RGKeD=M3xyr{Ne*x?M#L zN=|D)e;BymC4RUf_rpN>=oYj6L$f^%oHXmMd=vYt!}aHcjyAOYs$k&+2u0@CLljjS0so4GXdowVtjuiC;HGyHUsnKvRM zUW4f-s+_Pzt-Q z+sw2Liq1upSSf@SidQE$ieO%y%-W!6m(W|PlwUVsbp_u!4vAw7u1I=iG+(%WQmo!( zkplJpY}0yvk1t3)ZOa@wwzXGsIcj?~XT6JVj8GKzg7yktP+}ynu~8p|XjcZ1$4kE} zED$~msF8>IE36H^0*KcX>v%FO8lZ3|Xu3wldmJ z%hkK}UG$GpirmLFswu5epPzBjJK*C#r)QR;8;LqB&D2*wI*S>6PbZHDv3^&&n5Hk& zmk#*uv8~*lQkv9dd0WN{x(YK+hk{g#fcTtmxN=JuEeS$s&FM{ zq#=S-i<}YcWy7~343l;!BQ@x6NVG#OTj`<=qfm{2&c5%Woq)Kh@8C*4IErs3*`w+| z;i4`(9n|!FZZCSi_tc!3g zJczCk^NWpElx(5nv(nM0>onD}1N8%*G@MHQ&5kbf39#vP6nrNne9=Xz z1w>$jb*uoGXev`*1~uJkplLMCj%ipGAn{HLGfrn*ZQvSYz>?BmFJ`=mqEo^? z#m+OUOTsWsrQqNUCQ9JCC0tWASA20TW*XuV)_(3Qu3N)myPg$2Ebtn;Id-C=B4faa z&2>)+;gp>>*S%2uuFZ87g`RKc&2WhT7`W=gUW7MDb z*EJAz<)FmB!4p0xfpsUp$dHY8USvwna;p@5FS-62qo3huEASSres@V2d3&P2(6?&! zLy*Mkj}Sthoz?FeR)3mEX#3}*ElUb(J^pU3H%d~`dKU81TINY+BV*Xer-d=1KYX)c0 z=pK&8U?; z1Kt|R{9+8}wpBcXLm4*s>=XK(82zy1d4XFvcqh=uki@fzKZMZMQOIRJ@-(q3WoGKm zEl9uHyt;pPq{Cf8G3axT1lqI|wy}a8MJb zLjq(HU|h?@#_vNp<(qA!fXmoB##`gF%VE?s7` zb`y?4T0-9_3DJ$ZT4qkLVA?;x)>i5IUg|JX3!2_iZXY|*K7i!03$175iE)bDL+{h) zKR2`O@1V3i(4Q_!EOTh@ohR@*2Yc_*`*hG{??q+h3VmaAWo;7Gqbdv2;hn;}+QFT) zYdjhcW*7T~u*pHroQ;ak2)x;m)N7-n63mF|zAA(hy1E}3uXL4A$wJj_aspI$5g|x* zzYrmm5rS0rn;_^CrH4c(QnxC2KtcVX zGJ=?0(m-45BD&_<#p)Q^E*9!lAG_ota(`6PpyYJg5{sP+ zdr=a1Hc)=Lz>-ct623xMfv-IwJn45K7R~k&@OV4uN^GBtF1iCSK!3zuy5J($1gyKH zVV#oN$6?lA5|{?mAr3k}HUYJcMTov)ulBLLjPmpZrB~?&OV#k2Di}uzV<*k{dYExy zG~S&=O^V`6X=hmzYbI|}ls!RF%Cnm=S7E^q2)T>a{Kv51CrTLw2gE9FQuMSi zu8Ae5wMo$n0-uW|XRl3)Dhqri)?B?wQP&BIlJ;&=)Q_!sVw0je!f_|oEV^0I2x#)a zX4d41&5Hgl0uQw~oXW6KLuO)GJU5u;Y zV*C(Y3^2A6#txb>ZlY9a*C@uqZJ}YnlVzdfw*oZCHb+JkAMi$gPcd7`3ZZ?ICZxetr$R+c|RljGp5H8kaIt3ggi6;Ea+ zO<}YL=;G1Oy-9G>!VeSTFIzMKr!P%#%^Zp zY+$`~E)I(r`yg;TFnEONDzlxCOzC_a+R7yc8#bg1aroAG2VetF(4vdX?V7~(hv$Ya ziDf6pMHw(7t+v&ScUocfp9b5~bwC;6lumYp6YD2fP|vG%sE=kV}czcsgebT6zs()FYqKMA6JcU|-aN|NEH zeSAdmdq93a4dY# zWf%Q8S&{q2(gs_QuChUgfhoHQU1j+bam2~}5m*|~02gB5954iFpsVONF1ijn?*X4E zhRJjC$nV7|h?KDCEFoMJi!P3WTW(gAEASwfIbyS-x27mcny^{Xmn;Dh@Pcss=Hdu= zqqOeSI0DYytjK=9uIa%p^WbJhji)Gbp4zM^;eNdVcD^m?{w<2yL!cgwJ|-zvxHN1E zyxT>b+$Cz5 zcX$6MtCe)QrHg=xMO%V$o?WANkU0l%4_v`6{UhwDwNzo-Z74fK_hX4mdO+ZIjPMyYU^tmkWO#nVx z!$6&Biro3Iv6t2{rU5XQfZ;XT4e>C0XCQ9^*_gJ*BaRLS#`%Cj$$r|w3FiUx5HJ{n z>|@*x(U8bgl&i}viR#L zr!Ne-rYkD2%tf|L8Q?fPU1ZBV131V7FS^LKd1JaF_mfcDOWoZF1a*L^3e4A@Od7+u zwCQk6T%tDDje>j+*qh#rmN9uCKomQd!8wr76B3$c2hyo0BiDh4ZQ9F?#q90V;k@L0 zVvC}259pS@+-<(UMbZB0ip-C;D6-8^l;q!{=;0ZPoZoFxH0J?>o+F}hPP6wGMdfBF zG6!u@RAGi9bJ`X~wZR!XSJA2m^kVg#Qs$F$6@3DRXXYwOpP}8qXYrYeP81McnW<eV?4E$bA*&gGqNWO9ilS1?=JqcpY%WlQd7& znJ8Jri!uUM^XvwVt+Wu0v`vZC`5tr2ReQ%+Z0(tfWBpq+l0GvAGeIS->qw^1biEJAG(T#H?F25f#$hE+4Y8MR4(^IZ?4 zYI%Z9s7(Sq#Xbvt&Wm#ur97zpB;Rd*K37rES$Gj)uA*o0BRE<Fsh2E6!F_`9a-B z95Kwa*@}9yh(WUzy(fgDhPiyUqJc<&n*NvI4;Wn2i#Wmh*^0g>AY7fT=pYEh9+obY z;|6=!DJTICy9Aks=P2?$s9kVcDf9LmMYlL9ITvkFlp`g%>NfXnQRJAd$UM45QSxkY z^zR=u*wK4wM}H0sgSIGo9SrdAwjx~oyBZjf`vs4F3qoE^3*+9pzaCzxZmD%uPgQ@1L*1R3+UDss<3 z-PfC`=!~#-O5l$#r9p^t_O!Qivi$FBcOPYI9jD!WV1kjF>1kkP5)Dkivk6bkQ3Q7d z41ar_;f4*v@OyI*=x9&^qTJ^UH1YcVRyvJOz_>k&Q5cI);PgMtL0f$g19Xn6BNG!OiR&K>iRflJq>GvhL#oKMYCRN^7+#Dfw{xa-k5iujhsEBJw18t=?e#CCi5A?-hM zOJm$z)GSxilOkh;uBQ7z;V*WnLKvA~{se!VtMs)ouZgH3%EaADuONX=QBzV(OyE&i z-3ViJ^vX!Xr)ZzmR07Iq+YF^Gyd?qO+dMv^Eo`$IbHfJS!sV_z7ngHJx;(~x2AmEA zM>!BQ1R@*=jxx_zVH5{~qZ|nSi_#!&eT=HTZ#OvmMzX+6;ZDP_!{|X5NWt zGhPT1ZJwW}h=a;Z!5=UrmMjp2#FE$NDdN^#4Ji;ya;07*mVAILaLQn-qAdk_qA`CC z605aW2>TN_2xc%LcdMeKLO7UUUf!xGfZT3vRrFuv2EDI~I@fiSYzsW>8e2veRH9^8 zmWU{sSU^CO>?nmJGpv1U1bAl7We z55$^1^CZ?BgND{*MK#LkHY2g-0)!Td6Zq&_-|K5$DKj%WEl6W*;SF3D5)AhTWq3q) zIRUe?Tk{mTKLI9+(X{v2JjSkA`X9(o%y->XiZUS zluJR1n!Zf0kGI=Z_J)FTE9F?*e~o_66VX>jsyC|v(N`-kyXf`#ic-@uJ;5N+S9$Nc zsOo$Si!Cet8!M1a^c8|rZDbSa|L>hgDA2r8+E+Q=fJNhM&2&!P49TjSfxJGNAD+o{ z8EgPgB#Qxp`qhhhF_o1*{B$53sXBHXr>^vyO!0cgXl-wEqL&H8Pa z6*qA)Ye%p~Yn}!3nB}vwzqSgD6r}OC;f7XusbSzj;ide}Y7ZDEJs2WdYD}u@q5-Ia z2F*iOkXG`3tdT&#n5(#elTdGMQEy(#Wro?n^Z*8NE=X$_yOP!7O@$++2rCWUuqO+= zN;i;=^RWqcu%fwwmj<#661agZDIi>(t>_R4dKj@!)JB7eR#{maY}sm@TK`P)`Q zD^NchJ6EtSKoe}g$7pk4E59FG_R*)^hBE6-9gi#C7Xq*pCS9DO4_O_YNPggV< z6t?O)A@s4aRp&6_+nI{43!$&g>^D=Oh;y(w+6 z4a)`OuKO^CA+&_Sv5@Re*QgbYng$fFp!h|vC3*#A0TWQR?}V^Mmu)2!M%ng3VU+C{ zv*v79)LB^9+RRSd6`cobkL`*|FH)2=X1k)t7oq+l{;R{$2RZx%u0JP4lWgN{+Iz3t zjMT4)uG>ajcF{A7u($#UrFwf&*mtjM-*t~ck$lusy`1EtFOY|G=5|FhM4e8`+_ha% z#v(=L!R?BESfnWBa^dTx%m;QT>IH2d-=S#YB1OEha zNsax+MHLq-awj}uP;!7aGv;Gl*y*%(D7xdFmHd(y+j#l{&tK1qY2Z-))-kkvX0HKn5Ee`v@9ffX=k{i)a{CekL6eL8g7#IT} z;G@aNFM9tZ4|BdKa4S1GC+|@7y1?!1=7t@Lau+KyckEEK zl_lIBuBeJ|bg=U|rF|g$MahF9%ach{ZL_7=1MKYV1MH}&V<_lX&y#?7^H#U%0d{yl zYGa@s^;2w#BKJEePT+YO!>GrBN(U-PWCG6(d9vl<}2imn)e0|vN4Nnt=(0$fJma6n5ESOVIM z5P*R827Vx*Rfi-5v=reC2ejt|=76U6a=a|4oA#8oe0Xo$U`1~}s=qo%eR_u?)r9ws zo%p%+S^~F>;rq?&Apg%ND{6wL)i}jx!hsaQor=;0ZWEI-0XEU!yaR%5uitL{R&p== z&D&=+<#AMLEipJg zKMXd)-h)<>`LdWO1NT~kR=NrAO08&b;VP_XIi4y&PqTcwg>OPM)7DG$JrrZ0 z9UWqwCPD|C4IC(PkH$nb-O-QU-E=v)PZi!{F)0Y{q>skT5$y4p=o2xE1$!clE%5S& z0n2*Z@}!4t8l+jaoucIB7$Z4Azc^sQ1xppVS3PQ=M`{+LPK?~o6%6a`ksR7a@7y>f zc8Rjy+?|R}3U50{%Kn1Nza-f9dc(sFNei3uml4}zx*2tL@N$RqF>Mw8=!A>*6NUb( zgPrhP*a>5oVNi!!dqg;T>Ku|E)6R_?3hYs6Bv%hz04zhZZBy)e%=5d0$8x_rFp+#@ zS=i5hcj&n9_fvn~KbE{qk^9-l3@T^&aOrCc>dV`W+Uyzk@&eHDboccPTn8 zgn7Udb#QbUR{s1RUu93wqO}gpq+*xj`+ZgeTIaw_Cj}r_^hA8UBkx@oy#ORW*<)eB zN~ensd>^U^tj`|`1gS$TKBL!Ij*csv=WQ1p-&R8+MhgreEa%=_2fgC^e;q5WsEm!1j2MoR*^kZCCq=DkpFBS`% z{QyVSC^XLqh$82xU5dJjsnh?R<(}_m{m;_ z!e$50!;Udw{Vqjwg|N+G{;^BZIVQyHRu zgd6zCShxqt^5>{n%)+~^h?<3u;u`B4M)53sR4i(K7;tcnAdP3H2|z@--UODtc!eT& z9vr|+vzhM@FsFe*qX^O*#$HBhz1%UE5wR;3C5N)B2dw6_gfYeSrH)wtFZzUT>7!zK zP43~9ig-=#Dg3~i+&}OGYjUrwlr_03D`g$qe4@~r+W zR<2a!e&Y#)lAF*T#%u=J zlb#-+eVl$D%IW?LEPgu4DBSz#_5p)tdya88kqo{`=eXI%u8Lku*F42n@tD8G97RpV zm|J7bfpZi+yh@Qde~zN3@MG;9MgLf(C}jtKh`_4#PfzGY@_BY%9c4P1j;P^-6@t!@NKceqx+Sgpu?6zLjM z3*H*_6<8WjE8gYQ8bG+xTQh1fP(EtM%=3`EcoNrf2ga-fnd|r$X5YLT6+`5H0bG9S z!`OXDR~Z;o^FYR3KuWIWfpLh=w*W_?v*wA*g*2|_cawBWysfLbM6OixllXyZ{%3BX zYEDZkRL!_#h@z_5YKC(-p&FLQ4-eN>y}&j|25%$cj8rxz(Foo+`DrfJXTtp?jo>1r z1IdLKL>3TS`}kHS$ggw5QBbGC*RhG5{)b#__o7J*v;)9ZJelFHfCH8%ou)I~Cs&dC zE7%ZB&(bW$js_PH&(Ul~OktBnf=PN#mLI(@?obNSLL1IBV*<82&S2vQ-?n@~3mkYt ze{URaHJJ;UDC_$T8W*PTWBT?mJy_502^6HxW9o%46{!m|>}Q6AHG0Sq2wKddH_g%k zCYA#+lpXS9f<`A9StWwR&?ZQy7+ZUdBKNm22tGmv=}_Ez-?``$oD*>W1hkjVu#Z}6 zWZ!L&&M*(Te*wK9n+q(k+g;gQWbAMVjPe{bT^*ij5g((3IfpoTW5W<9#!s`?gvVGz zcz4_q$PLm2C)|7w03S_cPFxYmy%UF!ZH#+#E&3xr&2}Ejb%jxuWyU3g1yxIzS)1npM;e{xsi?2dJFr{P z4rz1~oaXJ_ifXJ=l;qf>=!13A$DK;jecT?sc>SqPT5qPJ3zBrIlgCDBpg8fZ;JOgz zJNa9C78B0RRAhTnxA2`#v&1Y#ZIM}-S&GIp2ZmLN!g1Tl!>Uw)2ZUiryE>Rh!vq zkD|H|)nkvM&mam1^!_CbXI%Q~urCBY=i;lw(pl91Fae(#s?t0y)1oD|kq&K$mWmD0 zQo#^eTx3rGHw^|te7uNS^3^ThgCZ9RwNw}fwgV;H_nqNv%4u!jVzC!v&mKUo_5h?2=MTU*1AxE*02cT$ zdcU^lBG+RkV1#PA#PD~3n`Q@^&}DX%PJknIf1PptfkPU2R@G*HD-BNr-(uPX(6T(u z_&Ne~S@e?~{<0#B5ATa@Wk*Bb1aw$bT`SAu^g^4R+;L?MO17HusD^#I3yXDb#LZ=%Ksw|4Fz&vMm_8!X zlq#!3(P_E2`eA`D3jCzNm#`Ifg`%egzAW(bcfqej!El_n1ir2v=h2PgIOSObxM+3Z zxFtE(z6<_PV0^d$|K|eZ!^N0AiY$RQ+MPK6=PRonZ=Nz=yH4~n@*!qyDvX;nW9!0< zIMo#0(ciN#uzcw{3@)?HkJDjrhn>UV4m-kN?Tw03aZ-|Yu${jEEWvLFU)PcaOis`W zRLc&eS?OTJ=bi6RNxJUe4quDDk43Zr1u;#6A|2ow?+i3<7mSLRbb(2uK?-{xb>lOe zbAe0C2?Q)(2)k^tZbQGuAhfOkDLXSgg6_lUgBumOJHe&A)Gy}2r(JXlrgZlMiksRf ze!?*hhitg2r;2@d+c`!&vPr5sl{w%%bA;otUB`sQ0w1&M1Ae&zUlMqWz};dreeYfH z(I^{?N!tRRs8f`MFUWBSg^M+%#A1F_%cusYhuj2;fh8=HWNk^ zCQM<%)rpG63*lglS#*-3`4Ej2-MLR0G=_+V*^;J?Q?v?s&mX5~%O*unVrdtDe{WGV zungZv9&gC&%cx#OOuNE1+^$V~Q=9fCn>KF~wwC*eZn9M_1LUTClUtN~b9i2NQ@?Mj zuTaxOO7>-^Th!aJ?rRs7+pNgF1@=z2GD99(;y@o!0Y}34-0?vva7%|a`U!zMI>=db zucC7TPj@7B-K*%0%@TT5vi9aN4s!P0tH>?zM2ES3ucDfp6`2S2Dyom1wCIw;veaRg zT&d_wru@Cl@c3EyrM8I4R@#;;ZL+-%4u5+c@Ww`)#bkSVg}y03HrZY-a@&Z>_VQs@ zF_|Wc$t3wB$e4YY|x8yJTy|K8C8R?rH)hcVo0+YQO0 zyUwCJXR#Pr@KP|;LEqUu7K5-{_Kf9`!C9!p-NZy8 z^orGtGa@iEUW+i!7een?op71JeI((U2y9lkPGoFV#1dRvG2Ft{7n_Bne=PgMUa6Rf zKO7eNfLOkuqXZ{}Kb#W6pjZ>Ppp@S#S6^Hg35EP2wp`dB3b{eaa@zaE4QfL8|8fJ& z>2%H43uXH$*VbFAW{j?yF$(g2wQH>4s1mr=pU|>Bu!c zmd~GOLlGvV2w_5O%GinAy1@RNU?*wzW)b$6g)l`ET7d9ByiBgMUSk_2-RW#yj@eue zEE=Sy*RVW(c0`)ZdJp8n0E=;c7>h0YxO=bQMj-c_<#3HRTzH=L%&nN!20UpN&5dQx zgof-0^+ol$+7bRORl|<(?O;Wg(C5XP;|D7`%?US7Qxp)weC;8|HnIGTkO~k^tj|P|zEbP+22=jNL1T`CIY&)j$O`y8nY7mSo$fSF zYMY;oMdbK!o1*d=nCcrR*=kfi%j>Hz>jPn&dlqc#vzkI8on^+fZHnBhfDbmcEdSfy zU?`mIGBaedmOL=oEc)liYIv8xmt+5z$3!jUzy&z}b+(Dp40^?J5bPC)qU4|`-v^#0 zqZcn863_E+ksbA6#P{1U7qdKm-iR&8wm@ci{C+FFuEmc|F>e<}N3A011=ij``?7t| zr501^AoC9fA^U49;K{J)2&2XT#irGZnNtBbvOM|{>ub!D3qPs3TG0WqNWVC3q2mJo zF7VmA;41?6kJG{MmcV(@2cz#fiwdv(the2fMmXHbRvhkx6}LsKINXW&F2e)?ba_TF z?oTV`y8;6gmy8i4p4y{UsF$W z+Rd2e+hvAoH+A^h9sP*#JxiLFot5Pc(FWTcahIFApf|aoKW$f(>J9SCEquc#-QoTRp8g6U`)9y3*1W!n$CidV@)AUl7t^b!ASUN1ZE8u zB4I&L!Pk%K?^mxv8*Pns+}IUOps=wAr>!Tw*{x`~HA<_r;aSB1&XwF*C{=c5It_|P z_18hpKC3B>W$+W^&9?qtY&j@iUx59yz~kc0&|*amb|~Vjyqh3Jfsya2ZouM02!%D? zV%sGeFV-3_W{pET6uG;Fm0ZeNeHT`8HG^%CB`Y~Zlv*lEP82v-E7>`$WG|%nA4>Am zHq8nv8KkYYwW8%Vt>re>a?lP8P(00uw#B2ZjE2@T!dmZOHD`yl-p3$z!D_8nik5i4 z^Ph_qZ523AYrQk9_1VH&XGDEVsG4}RVQ7t=GRU|uMN4R_FXQvNyAsmuPtAO6`<|5&dTWb3K5MkjKUvY zM(~}<-|tkE8Zj-6Fwm0P0h#Fu76e!!bc4~OI$o}i37n=MlcKunDU2QlH2PWn(O|WK zb+z$~4992|lFQt)K!7%Nt&qp-v(js4H>Led%7r}_7%Wdd{aRjEhPR&!5-J*^H@CcZ7+o7VfN^z z8cdUViT-}J!!}i_=&+3sF&(x|yXvBoaOZ}UZ~NDeE+S{geTuq??6bC%2|NX#fq!>l zG7vS~ygL)WC(wj;+L~%N7=rsyiH0cT@x(5rx9Rp3$wT#hyMt5of*jwsyK1qbQ9>W3 z?r|~L-(}v^)5M}(w$6smeX7oVD(C*}E=BH%DF*2);FhSVetrZI8$ahshSRh{OQRLS zhWlKh&s5Q^d^dj8@6_)=&OwSRpgu2YOu+8^X7g@u|nT2ds6ag zUFe#)a(}XEFw?U9wA;4KuFJJimun-J>w{g2Qt?Fv^YD%QmFz#e@MRx~`1{{U{&Lbv zkp2+mGvc>hipqJ@El*~(fF})~`KUK9TT^nHKPQ44#JFilo!x|n@*?>{*z!_}LHOh! z2+>6rn2UnCOFfNMPU^&K=KFwR6F>U2ZbzH6iJy8ps?M>mHC50V!%S3^+L`%VYj02YEwEH3+>oMLFL7_ zjD_q7Q+OqU^7=!MJB zAR`=OXkVmhx7Q2A?PF@~chU2^6}dODT6(Q4ow~$8`AX0Z`g1$z5`*3VyEn;s2Yt2V z-aW>wkf*2~)Q+w}zbC`u>7j|uCfvnQo~^4**V>R61KW9r#8kiGqR)5Za}zI#5e?zI zn*bGTl%12A&I>j)B&Nq@7kvwK!|Xts1q{A8b%oh^uBsDKxkxF7vLtdJLfO*1G(6^! zc`h1+Qb9RfTroTb*L#ooKj>awKijb1R$Uihbc|8TbV>si-wgD$4AH(XF%Y!nJF2W!1`mne4Yg{pH(E;09@x3`QMrt_w z${9p+IQ4PZCycJ@!KgwgS3zORr2_@i#qLqMA3ZNsxj06{Hw0c1L);C=Jfow}k{IrG ziwYR-hD#N|`g_vDf>@)!CzVD%X!}n;^XKnLFFd0|S?ha$PlCPf@}l>B79F%LkJa_C zM?2CUHu)2KaMIdKw1-Xp9KfLE38XbbWz!xudL>|a484bK_Q9U;Tt&l_oaJeT%in`^ zh#5S4FxU3_H10Ix0(%s>D?Wq!pFBZ}uCU~v!03a@LBaF~TQjin4yPNOb`Fr^fs~r> z#LM~XkXmm7>*lEYp^Fae!TzYZU~E8r9Th)xQ9e+l`-Ej;f#OWhQ*=NGS7OXId5X&HRb+O`Q-p6~&R%(n zEaBC5*EkkfTa1ldZGvX6tUxC#ki#djnxvEmk;B5A*(dXl2A!>qJl zQ64Bw;Z?60o9y{?u82zoNzk9HIS+itSTm{&&BkGWgMIzoM6z6;%=x*1=j> zeQ-cn8gsx({}qlQ+DgHFVx`uid24N@?~ym!`Y5Djr|DH{BDm=&)_3Lx-i?4kI;-=(eN74HsR3b)w?XZMKp-4>t4q zyjeNSi7vM!<1oL!&2ZVguqAaGSwj>c*-Kq{+w@0y3U8kd=GEe_0etfu4T(ivv;c%* z%TNY?0ciQs1)K|zxB1Ry@;-(`7?sXp#ECpb?$fCT#Ou#gH}Vjb9OZFCA&uwk9s3oz zlYnVP6Ih3GT(9oufa7>r#|qTQ$*>SYX;mzWT46udkOfz%LH5@ct>!G>fV7X1GEA*( zWo9>}4NR@clAWt2DQZ$)N0?5r=Dtaa(7?>2lN5ac7U#VEigJWwNUV8uzoM)N;d>#B zjMa>71)iuGn=vEu=puyGu`K#0Cg56w-a^9atQPWgM>(eI(!{CpoViP}Cp- zo23sb8jN)0eEguI9HFd?GwUBzH12>Rv%x_{(+?l9R|aY9)j2q$HR~X zkmVeBP|*M(?2a>698|Olh1_*e(PsQOa!}De$V53OOF5THW11uIO5K=FKnZM6xdhqd zJbzHpQW3r*&V1;QqB~$oI;6;XQ0WG_Nn~u+GD;kj2KmTA?hvaSQnXuStc^4OeMpfB z3b)k5Lf9W?mN=lO!a>|!azIf<2#3O_MR>T$UJ+QDY>jYc^&s-^e3&~tI&M27VJlxd zaXvfozYoe_JD=Sr1W*RQl+S+q^FbV0NTbtnEpMVeQ1y32`O~`U9nWf43s-$&1m>#$ zjWu*;98y$TD3{`#!wxBWOu!jVz4T{BU|vJ~ofH0D^9)!Pov`8FQY=v3&?URUB^!yN zU>b3QOEw=MdNHCKT&}G^go~bsZiI-{; z4}6LytWh5+JG z?RUb`(rLc4Ur{YkI2imagbq%Q0UyJQ;bi@vjcWZE7mpCepS6TEmazViqKQKI#c3Lc z75N|myR_$vgq`{g=jKT8cU6WfrmI^%I%%t@`;hKV?nS#h(Tlc%SVXTCl3h=&a7W;w z@D|CA!xa?XEsVXK#CjePxVMwlJ1hL6Uf=(vUeF3v&GLtu(<$2+X)icXgCz}CaOfdv zFGHM&@Z;bixTSTdv!Hcc5fz3yIWW?5g1oSAm4^Zm(g5?y6`px(NNctn=Z;l$-?bns0&@z z7Dic3QC~FFg&yfJDgwH`BAHKg{au#aKu_D&h$*K@j?*~D(<~lsGDtLybG*VR$#ELz z=s2v%`Q~9oRV2qng>&?K3r@+H>|S)n)=5^V@?88qGtYJWri+Rm#wTtcu0EnX7Z$=E z048XK{MlY#D2z-3(r*R4+38`_Gl#=t6rD~w_BU?|xi$oA6#miW)ZxR%1x^!=O= z@;S&zXrG*|F-I6v1BL1}N>ME-)KQl?dX%D%fDhrva|XGH=n=EcC`JD{tSF@uoPd8o`)3$AdLwH^nqU_ahPakl-k%ey6AI8-TN|6vuO|_$)_26MHV$2KQ5!ZZkeE1h22|(` z30iHyn!{nhMmTG@&T!vy(FDK^avIVmqry2CEr1e{g|%`ick7U0u@2{KeME=TT8GoD z!vWNzpN!M217ShB;EreGG%G;v0nZt{Stgy%unOl6D{_wo5_+6vJz|f*=6|P&Cq4cB z292$>5S_Q}5@kB+?@gU-FvufE6v>gzPBz#i6^H;)CmUV?sCa~@gPm>fo_A5LBZ}OM zph9!%$C##2z=<~=)<0(utUcUjKCoF)OArbaYvA>H0?q63K(ju&%L_JKS%m~MYO8(IJ*XIc$I zG>6%*qA&q(Mx!vod9?68g)Dr7)Xle^-{Y&69pIfPbkVlgX7sB-ME@~T8xj4d%ybvs zcQo7_|8w?z7v4U}AP=Hb(ose39WYZcjT#Jk*F_b8u|JQ`G-QGKLu5?OfpDwm^_S@e zDeP6`OvSy6g3K^KnXf1V+|HGU6}>L_H1o(|MNJuhW}c#Ig7=ya&sWrk@#=`8`hxeF z&m2)S`lzC$myRe}dsOMnGlgDFgE<1$z$(uXMc)e?OhIy;HZPpEtq>(`7XfP&?s)M* z>uZb6XqLxn!6jbyfh`9cMyiKsu<`La7hOAw^Te3|-(2S+_TrB?mnugT zT@k5Q4c7OTfa@{sK|R_lXlH0?d;3E?Ljdqe<)sOFWyI?)wdYo#^nqR(V@ zvEj2!OK9|11>Ck%uPMGej$yUBLI|&1z9!OtvqjxjRJnp)B8|Fl2j7Hi3U5!_J-!LE zv=4-1hK-j$KaI#C;;k8JLZ4~ltr?jD%GQh=0rl1lUB47FEW03zq~d5SiP@y^*&cHo-ar2X?0y>VRWCbdVXJq+EF4hh^xx1{RFr6tut zcKRymlfrVx#&;`StDuiW^K-HI+~;^fJ9!typZh*RO6ONc6crW1OK`?D)@g`auu1lT zqfi;yKe-X4o7!3F58Jgzbs4W?LqjIfb(MJAMaPcg1OrYX1irR_#L(#c@o+o1&M`>7=`=Ft zTv-=+fe8h$UA&VWyS-Wg5%l80_|f*pw_P;;#NFG!?%IL=U$!R!feirk;{_A!c)Vcu2}N%Eix`!8g4MjfO1|{E*4N&zt#q2gn=y_e zh2=|szhT3m6{4vu<~&l>L#j}gpQhR0t?!~DC!s+@ApNwA*&bt5JB`}PsHcGQ@gFBya| z*xt_Zpvp^8@c>)z-Vu5yJ8!-F_$7lX5*2K{^9a4O-8?-_(P0*h{r!!F(ACac?~0s~ zt#{2t!aW{8ZS#^rF+@=}SMsa3zex(&Zujyj9#Y_I-(bn(H#>jss{#sNu`osm4}LOBot5Veb(|XN7>vH}Q8H-CS5*M^52|+HFzk>w0hy6LhA3&drXCht|gj_8DK)&2A{bar(=ixbu zYP_s#Wm+i{k5v349~RKhM||+IuD^+P6VFGy3X&5;=P!kD&`!=5jw)&-@LoGPgGUv8 zE$~dc+3%>Ls+}HrYUdH`>WrYoVg?0w1%RnF|#)&R3Ka zTBxWMezabws55@xPUJo)81h;q1zS;+>uDJ0g?pw~3t?qZB4^WSiZ+YzlXh|rJE~}p z!1;DF_o$);kciqiDYiVPYhx!%L~UFY!g+lg_+cb~3dSqC`VQzvMQ(EfRFkWKaCNq# z`%i15Z#k-{#4Fn9r|srV4BJmDO0n~R4e#HSc|~95vmnmI`!^Lq#j_xkGL4UBp~}m? zqH9!M2B{&!QG)U!ymO3+XHn{b#A#j^Lf;tk$+?RDeOlba8{w#0n4=XFoU>&J(r3pMjlz#c#}qBckDOzQcHzhO#}wVf5qsSK)liDFGhV9^68KO&s}Xxf z)F^%i2I463on$v9MhBTT0xyr@Ak$e2&w~!vJVm{PemKT_W}c!{h~ z;lgn$#+-Oe(Yt39rOafDS01KlstD|>c*E|$Kn=f}jX}*~NqsWLd^%5&2lBC*DU;|U2M0%zrc8ipTZGWt!5Xz>Li2fwjtQZ!!yGa&MGnkgB2AytMvJ& zXI?dUAH?qlm*=o8`S5Tm12rodE^xVzgS3q)&DJD@58%g>tN{7@7Wk=dm-lR`!0(6@SJQztt|Gq z9DS8<&DZ`kImSe^j__X7SNVP=_B zCtb7>h;KM|I>VSfNH+rMGA&<5s1aS_l;>bd(w*W&Dd9c`cZxS)C3Go^UekS?bc(L? ziikVK)k2U?vE+GqB4dZ(rBi&86QEN(P(VPZSOEkg?i5c-=6Me86yG?nqC3TluNCSP zYk|t0B1e*&uNCSJKNhhFAu+G(rgOugL&p6A;|x6B&w5JW6GDGM;4=>0^ePMdNA&CG z=~jA9T8J0EssyZbZ;0;L#@KZQca1etF#+UzYlyn?E|#?O_^9K_%(V2XBR051h(Dgk z)C!9?l|4akkOuJHm;u1@QrJL-XNO_UG>DPQfb?0o=3k%T9n9Hn0GdC0)b|83tPoA( zlf9>b)>DL@d_b2j+&#hKuvtgS+*6;{{q*&yu!&gc5qd9uDEGMw@CU@gMndSL59Pjd zK?dzXkx=MRZj0CN83j8FuSCH#2-nMYzl-z%a;SBTzyo9X%cu{WyuLS82-7v8d4w=e z2yNEdXAWIYcfYZP>^&=>21wqijj=usgo)dd|GF6bqZP^h4`iuWvNVnuCM zDd=1XkBZ82><5!l-PCr) z^4i}&1(dbFiUR7jKP=0>EtrE+pYIBsA4|MXq^`iHWA(TDPXxXi%U>g}A>-&3o(y?d z#q0BisD*mZ=vRq|@bXbp{5NO4i)-`*;gTYE19*gwP8;~z^717N z;iA54g-aR=;29beww2mt=fz(D}90nudh*?vj!)(}hE-P|7-Y}$+ zjI)-Pf5V`1L7L7>zU2M}HuKUth4y>|4E=!dSxplIH0%Ru2j8&5{f?NxQ{5Q~&i_NgE( zQl;*=C@vX^B5mEDBL?rFYHRNOitmNp&(`|q6{Ss;AUPk_dw!ps>O{oHIdcSt z#}vL5c%at0rKEz^PL!&>&?jhmk7zpN4G{YH=(%vAQc82^qWVi&hu96g^FP#%4?~Nt zC~}W`lc#3GxUx3_GY1$<0BAUWD>()ah_YkAO3MzUGecK3OzFAwK)aFpbt9sIcDyum z`wG6zgrWPcV*Eyf?3h|t01%|XEV|}ZMeY^I&qpIzgGL}{XQo%m%tQ`Bnr_cq=%Qvo z;~IrA4EDcTXe7vAB)!@pluo?VyZR|jwF_|*aP9f!qk!D3#TP$oWCr_*+xpJxK2CubY@+PCk4;3ss0w9WD5QWs6WcK3A6{n%Ru zCHop?=lIg;GUs#Unj-hVfKJm>(_M@Yt5bcyAr*(DZD^Qk|uSuJ4sJVBx^vGDhQ0EM|IHhobSo{44w=Lx6cKHL{FuK}w>dlzJz~~mXhL=Ci{DCbKnbap%f7)MA$)IG9mj=WR zTk4`RHxPF{G>{)~Ne0B~Ve%`drrrk9%k$)+vCouu(fdH)5;-fKhB2n^4Mpx75bULK zdoHG$a-Om-8R9*fa= z{hKHXO^@Z>AMR5ia`*|-3@-eaH@R-`$9oY}747|fVx#sVG`=Z2L+-1hr}DBFA&A7h z7vUix^fAl|Llu306L{)N!jY6tI&oVn#R6v8^4akdENjL`s^34Nn(0IN{y>q8Z_ zksR*P0Dh}-&jv79Qb+^13KjI=eWK*CNf&OG=zzlAqk-t9+a3zn4I(C;(JkW)w+!2@ za9WUY4;1=s{Y({|iN&6a`)-9>!x{Dy%x^B}Uw@US3~_p@uXK~V7;BVmL{~ZA zxQA~kDl1;3Uwlb?4ydPsbTJlFg8QoiEYRaRtMORzXoG;f zBJ@`Z*7EprJekx>{Yxv@8IP3^b&f;KXaqBeg4CJMH+=Xm-s9SuKR&QpW0>I;?K5+;)^8hvSP~SMb7q#}5BKN*3=-jCvbDsg`EHGaB zoiR6AYaUd^y)CUd&irn&BFAmaN3F?&QBpi~9C$9a*Pv zQELJE#tLLx>HJ31G#2y`upDn0sh@>u6hZ2jCRQ{zFPTS(mmo2!B=DTKK4? zze!PFwOgvUos+wyc22lgXB37njcDgY?NPGdPd__x{z@fiME%r!x3>LCt;21&s5k0)GiOBaq!R z)QHwFN7p-w%As=WG-@71H^|4mX`>T85F2M38)q3(@;x2(v%{yKX`%}{Zv%;sG)4%M z_>99f5O8VncD~TA1lcKk@4+=rSsoa@38{5FHX&6e``!D&s-X_jXovHDilm+{c>q zL9sDtX+n9d@pvEt;VW1Ua`IV7?l!6##H<$m#@DAU1)9C^zN$JtY|~!2p9v3~RP>M# zc00|NPbxaWggJv1Jt2fWPVSt|s=D(=|HXamvqInJrQw>7=5{LO<+G$~vj& z64@!K=}AR*B01C%jP*vT(Dx}`3cTFKx1B7js&}D= zZ#!9602AMUv|af3xyX4gSJ4rH^IT?$HHut@ol+jc^GjygHHu0acCE%mQL~rgX_;x* ziJZ@_QFJpxNU4Wph*P{gL(xmZanohKH$%}6 z;HW=CQ3w3^e1@X_C?&SAyj4x_H~Eyen@olTy>F|gi1;;Lf3d48@NfDmzyDObYfR`B zdUt)5-*QOeF<(FkJ@r+72az+zd_RhWdyM%yRntBp_l)004TZM_@%&bj%HYpwv!epPaZxW&R)7-TH$0b94B?Wy^FZ-n21hsJF^Cxt+2Q%yO=g`HM%D5Jo6ybp z#z`((isa4~Cl%e4N*WdK9ClKXs;<4_JsGvRs%sw|7tf=%^_&jdyY3gl#Q3OPT~7(J zuZq+fws5{6=xOn0znO~iSO|7GR20Izc;}jvir%fRKW+SEBXZW8si?lt7scy6WnTz< zGCI>Hf{e=a>Pbb-1-&hvc&V$Uz?b5Asp~8&fpz+yg>X|7?l1w5bN*I9sJ&HDQDrCd zUt1MDh#w8MDk_T~c%1WDWv8Scwkmo}+4Zn!lBB&7!=uA$3XaNUo-LFg-Mm@w15ljU z^0q_>t=$|2J_q3*u8rXV^;eg~t-HF}t-HG6)|tv4Spw_ohL5&Vc3DT%Fo5UC=<3$v z2Y5tZX6&f!c&0Su$*iu&AHOqt1kgBVG?2kf0QJkQgBY;~h_7iE1D62k@xoCz#tU(F zJGs|X$3XOJ8t%qIYYDrZl09&98qSFx0nb(N=vn!b&B;6jpW!m-Y6K0jU204CrH zllO(NO(z{4PCAV_aAo!v!ZFfK3^%+B&W?hSRWpIF>8ut)&^>$zOYSnu8=%I>ykmR< zd(!v>cv7xi2gvaW2#~t~aey43fB<>Y{-<$Z3)mHdCW|H|;Ap`g$lHl6g55-^i3z$x z=`HZ21m1c&q{dwx%4nfaPT(cV5;5q1v4}892vZYygZeWucH$0Yo=7OP1thmdxGRao zBJ?0Tg;#ozst~T14~~iSSqVJ+I#=Va;n#JcFGz6WCP!OMO>ceIC6{;Y;gjjkKs7&B zPcas2GcRT{*NM?)Ud(3p0Ae#QW-|w4(0S;N;!pybb8BF<@1ICO3+obNCwF{Jv@q@k zwkDt#=nJ-RFR+zU4iBTa7ucGBUSJXm&&&N4YijRamcT=^w*|y&;M{6^AB@Jw(-f@e#i z>`dU`SsE19ql*wOYdxM|0{W@mLb#R?)lZEOWK@^&=qW|h1bschta?h(3l2M(wN5Fj z>abJNho=;M1P%W&SnUTf5bDbXVp3^3&Sp+V~3 z+By0b(L33Q`W8XM>*cVMj5+!ifddQzB0T2MsL@agMa`2O#}|nz>Ip#>6t$2N7$m*t z4Tem)lA8vrBN7jm6fsiqJ`~ZCA`jJd(G+A2rGbEQD^R595)}yZ;s|z#hNwSelD{V+ zY!3_DSs-i=3p-dym?u3w=(p0mo=h65I?89I%|-bG+2*3?M=r1cqRmBd1jvZBQ!3AK zfkEF^EH>QnZDyGC2f{5yq50#nc1q6j)1IREF!VAY=_~Sz!pb#(Y2x*z)Bd7pC?5mn zQ&LBYZrtpm#(=G6-e4$5M_7DLtX+S)xhVGDQ+HHB0j{%) zc}K?)xz2775|DG(0!0b$=tg;@s2RIZ(WF>AnZ*|>T8STzE>yH5)=o(&3l*KjkAE&y zbQ3?SEL2o94*CA)l%j`3%BiB}cc&CR7-y%X)~6IbhaWvoDS9102A)z>Jx=yEmzN|9 z^cj!3EDK9pF9~5`QCV+(OAu#@a!jl#WkF2jXj@n4XN&UpC@-?Y_o(I&S>QVXz79TI zEpbzS4vxyD zRPkzH0#-05Gem6@;X}KC;Y#k1h)O;UbKq-SV<|+-M6S|n(4DI^B!qT}T&0H7PF$tm ziW#Izi#a)dp-NjyiVlffrH?zMN?*ngRA~*TRO!d~ftqZL)O=d!H%Z(zkx%R7fCHy> ze!&l%*6E2KIIS}nnjk!nkR)X7pVqDR9HfPb%T~Imyvt7R0E0k$zn$-d zul`)i;@)uC#WB_=^X{;q~b`L1rLi?r<$g^O(m2P!S}b=rYia3+}FqzGYCqWRTKMZYisqm&9l*rBc6 z(`DD+aYr);^s6Ks`x4pZ-jO_cDF;1NJ)!3%at}2P63{~}V+p8nk8teQS~nI6(7K>L zb;~TM(h&-mkmGyF5nZK6xJtLej6pie)v(WH*X<)HIh>5P;Wv^`uL2uF-xk7qO6z+u ztZ!UAY6SZJEFAe--)8~HYRBsU(xDgv$d~a_rrx4Oi(*lJF;H}gDibswA-t`NahsYT zT+o>PVusK=6yv}W*vmzb>Y{%i#2$ZirL0!DHXk%{5~1B0`^|4PFzO6c{VxPsSRp zPRsaZQP^0E*ar38aH4_&FX95Hxx>!1h|4T-XK69SogfULca5xM>VJWdK4}$8?FS6^ zK&y+P2O8$Kle^4&m;=+=V(6o$Lt~EYWu+*qit)gE5fjkGJR^kF#kh-E?UpWPGfa!Y z!XErU&vFWB3W|^71n%;dF>0Me@Ka#}oMKfk-DQANYyg!Ij83}sEOgUdgb?YbdkdmxaSkbiMRWFW z#Dy_J?^T@R!YX8iZu$g^gb`*5$M40X0@z}a6V;v&lyil*e{t?aEGp@?vy4D4tn zg+8@7hv{@=Qc$>zw2wSZa1(mHP$1ivQ7w?2^^xUiLgSRz;Er-l2}3{4v982aKQ3E@ zevgXGwI!lz;VH>EO1~m_%~^QYl}LJVqoOS2&x*e!gbgLw8QzfOP`p6DpcV25vKx9c ztp+)1O{@@&SJ=j0hKPPI$)mF0OTzB0iejn>YrYgY>0Sxv^RV_b+jmV&c>$+*3O>sG3{EuL~1caCvE z>RC#uc={PQwx_DCJ+D(K9>lq7hy9a?+g~xEcP_>4Z&0G0xc$vw39#}*!qKHvN@-rL z!O~Qc$SJtFpL2U!c#lQb-V4GTReNap6@~YBNzQp~IOju=oZl6W6S{uuiyYLi^O1Fm zz7TqTN%OsRimoTxDWyK%=GV$J6!PhkT=Z;79vQzj6Z#pgfW4R${lQ}4(9=dZ&X$ZS zdS{VySJ8V3??s*4AmNJSHd^SHbZ*avbE_7~ZKiNsj?Qh7$hj-G)xvv2=eAk6BDw7m z`c0kN=i%G}k=#xS$F1nxE{dGHa=R(Ktx82T%9!`Vu9Om;hg(N zaxNnrZA!5#l@&Q$tq1|-h2B0ox0i(LE+=|RcsuCariOD{9m%b>aQv)u`$*(Oa{G_a zf7K1dEA)sZ1492z=deGV!<9%5KMF_p=myeW0oZYi&!ZC{E|qX0fT=&yPF3S$bdLEt$9&Fl z59H{51o?cr^Ar$zOrsGuOV~;FMxAF4_k9=>hw%8r9UHDFei#URmet_1_u0u^`~xg} zQ72XLLl;%K4`Z9hfJ&pD3Tf(t=>uQ_)K_6J)eubj^QP|ugP)N(ZzKMYm?Q878-KI> z5uAK;{C|aT$7a59KvDY$p<`h}A12^3=e|Pdq)fcZGKLB1d5T5}VVvUUX6D{!C$m$Y zqTKuJ55&V*p-$jxYA=K z?Ia(uH>&pYT=b8Uc5)wq#l5sg;qv8IONN7&t*$nBu8L}f&bnb=j`Z4Sg^9wuMV~Y* zEnH}YOn*e^Yc)MNnx1?>(X&F|qqOzjh=O6X>H_C!qkRagh|!R|j*!F2KPiC!!fNsc z`gGMhUfU^O+bN&z^q-QLX?U=wHJ{IZeg#DMqn1W}3lyG~^JWm`^UZjzfZ|=VVN53& zJeWr3*}ta)vck|xKxvIUz6>j!2H3Gsd;-)IB_rLy#e0+ zz^74fJKAB@(sm+p+v*vVoJj*Y{YRzk9VHTb-({MXn=iAZ<3fUR8 z!cSn0V015yrqL{C8lXmAffhn)9Z2=kIHn&3CJUHgP8LnD!w6;Ww^MRjBX4GU!1B>} z);jrq=t#QB|5i`C>UqUY-UAvtM&Ag5xIqsW_$NCz=qC3|gZ}URcI|lch2e;en{6jZ z(n(hcrK?UlFr0K!IBA|RNYYIONskNVnhqlu!%6KANUl_0>n}-5J%F+~Z=F))6v}A3 z`AEK^au3+aOvzXD9)48HSM)FZcqdY1eG)CQBihV*AkvB!@s)(Dfe5!EjoR}-c+{xj zaIdnI6XZXDUL}o|v0GjNWQC!)2SM}Fa(1%U09j$EHXz>QwvwqWAGDLZPJIJjl;dkc zx%Lh>Tr~4RG^a)d=#7kC0_JgyrLCOtRxoOZS}zt_W@k@31`2!Hw!(z#Ou$nd2ZgZQ zZsI8p^$_AK2xkftN-_bx4t=P-VWY0UM;{U=efA-7mxqNx>aQ|VO4SP`S0}9>PHKgd zRuKkC+Egd4pRedWq3p0bTjVSH^h1MQ#w$RIoMZA8r3pM$nd|cvwTHkR`HC_Hzt?77 z%~$l>Lv~8Kldot1OV(QDi0ExvtI=Vt=0HfVJVhOaL9|+qwCs>Q3J7q>jUZ^51B9|$ z%iI%|c{(g}t}uwq$I75h{Y7tp_jYRWlg9ig&P+AZ(EfZ<`}0Zm=Xz!A;hWP>+A)Or zyiC}6HO%M4&f0Ns!zyDZ_p%QSO8%Nfo@amdm9Z1HnV;uq-xMnGBI+8^^=$O1<3a;O zXh^fvx>8!NPWmKnCw{r`N9Yx9R-O28Zs&+*8kS9UonoLiu8kTK^Wf7i8U%eX1h1Eq zMSEfpYo|n^aKdgcGad#u%}eVX=pTwbY^UVLwBCWJUj~4FQ3(7RnG7UfMWqj#J`Y$k zu{rkfNz-Z%+o@bbZy*?|hAZM{$9Q7miQL;@woKa3Ie+l5o!rg;Wl*wpSEqB3>1mK0 z-RT^PfmU6BZu~5rW2Sk4xIe$c)RTaDJgebH9gN)gh%0h?i*lfOba>D{f{DtkC8)8 z7A@jL&oCd6`-?DsGvi+Z-WhjV(GMT%;BY?1G*2t4%!Ep(6?GKC&knP}X+^ajwUg;P zt>|OsXntDJFyZLvFngR`Kfp!YZ-EY^C*KMvy{k7We} zs8@;!$YWgr0eL(Q!rufrIoUT`osj9lsu&}c+bON$*znBb*zSiLnrRhBlB$o}sq9k) zjdWE^d`vvWee}4Uoaav~Iv@(Hjv+4FsVErq3sEr2en;SS!teN0943Z%E|zc?T)F`M zi*oTmgyyI|GL=2+;2F?lqVb;&vMl1{J5RUbD0f|pz=Ia2t(0v>JJA3=FG?K zrBqh1zAnyM|0^e}x7goO& z__p?=;z-GDs+|z-=r&d63291w1%Cva(f8yj8Y+m^vD%j71RfA;zO!FZWtNDc#~dNF zjQuO4Hbg+4t1dWne=|0gZ8|mwAW3H$MX2DeS{DyOz6u5#K^WnSRTuhkYPy@Bc~@x#SRb#iIE$SQa=JaQYgz~&Cq^D zCz15O`xRZr4?F^!_#{FGa+xHoi*+tfJ}J4p_@v~rR2U?e_n&0z)ZedYtxy*0T)aq% zTtfJPTsni7bJ-@Wvve*)z=65O)Nn3mgh6syfRx(QSA{Y|n|d`UY*G4LSI$gr(LGE^ zI-|%bgjuoX+h-J=L1yorQFI-deRxJu@z3?3^`OlRo>62kYbW#DGm46q<+8ynkBN*` zTHy!50)?M0Yu7{03c?^uI{!pc9;CirK){MlB@oEj>WreQLRl4SjyR*}y|Q+4w#Zjh z`*VX{rvJy-cgHtfb^o7FJ~wUChK+zAGD<0_76BKoM+6m6K?DUihBO_}CLu{F;9~E+ z_bwaROE!Xn%94#BLqLY?CDY&QeeOw`0?+gP@khxS_nvdlJ@?#wKSY099FzVwshLgz zEt*M+U$qu3LRti%1xCazg+a_VMkht(1cdUduAGetijq({#5J>>86UpnhbILZ;{~Iv zM$VL!3{RTAN3hDgC$0RTZsiBLl^;(CxAKGBg0BG)YULUgT{+y!4>M0mAObEr!VRuG zAa@9=0Vt3`N4c@O0l7m^+scaUUww+k$`iCdqcK67T^S>-A$jOij9v=n{fwo*SUU7MWm`VeUL}NcOh5xJD1@Wh-L8iTkLD-DB!-$+k`PYm+AESMO{-#} zG_AVAAhq`lQtI~7NGN~mq;H0jHVY-q5(Y_{k(acMP|oS3Uxt$Q2_@|*43cy>lJd}M zP#$6DVUs3-Ks@OiEtK=oJjt8!nQlKa$(w_mG09sXc$wraOO#384>~8z7gq?&Vv~J+ ztEM3F29a?wnkR;*LE%QQMF^L5fv$!MWUV4*JR=NJpqf?Ciu0U1%k58dH_66A7@pHz zZT={Onw9tY&?R>oi~->QnD;a;2?`UQ6v75gusGm|d(WHnq7eRwaa=xcQUQk|$G!6=mBNo0 zyjKm@Jd5Rf=$&HRd9VF{UgL)#XmUF8cVY4n?w+P!}tcwH=D=^-!uzdJDyT z+kw$edPZuH-ok_{6AYh$LFQ@nHrTSk)`A*hhp-2J`{`XQ>NKA&kcg~hWwS} zaUj?ZEHJ5y;NMNUyuc)K+*)ALbcdoO%R-YVzVJem7J~V|7q710n?q~On>Jm%6fRy0 zinkiY;|U?9K($?f^>9TajziZBJmON{lj3em1Ngnnt0-h&6f%`4copzWlA?O#NVWT;R*N{u7Iu1<2X6rq}M?pvaP;g(oZ5~g5fxE!K8PQ z_|gTF{PQs7(IGmt&YJtqt~Wcz%wNw)=T z?`SjGq(#gIy!t|0>`TV40iJAiE}B$82-6KmtBWT63=O`$Xwo_S7ItfLHvNx|AIUi{W5;Q=yyYcdq`Ss^q6FbgAoS` zUK_U<<5Bmc1TS?kSwL;;$H6AXo-LGF+Sra{T$s9O(mVJ8V>e4y+Go}Xr>Nf|SrMz> z6+fW<03?C>qwxdkPeoeT?X0BL>d!|Cm~AB#VSR53gXkOW)V`sMwT;W ziX87RHR(ecyM&ecGo34q*|%e<|5GY-m2D-z;5-co=@m3)IWXZ}_mu{A z-8VlK9zSp@N=$dQaW}~D&=!V|J*5QYY)e}ibsH%34B*@o<29 zmERd#tD4dS+NxrUZ3a(On^uF%Bpx;CSs`rKgmfn08|yC%VT<7i9yO_Lm{3m$TMgYS zd?fHT-7EC2CcVN?P64+}5svK!Up5}c1k_L~Asjc@6^Bd3JfU4;lYrI46?X{t34^Qg z@O|WSLO!X<*Y6|$o1Yxx3OfP&TM3u;x0Bl6rlAz@w*~kCe_I7p!r#idBK>U>3Zst* zR*@`D8~ok=ouJrocJMhN{H+P+nSk=YE`$qO<;HnBMUGP*bW9$Ktv7oc+A*(b$Gpal zX{#O{j9ufGy-NWRcEfAzh83!Z-0&Lv303jvd$~6>nCPc}3=F-Jsw+Lf`a)Fw$Iv6J zB#f{khgVNmN5i{sGFivzN_RVC)$IopA5wgdh!PB3SxLYfJ1;}K&_po-!>c#Kx-lrb z5&E}1&BdeVBrrCtj!~t{*@m9L{fuV+mjVrGgPChFSc4Z>gBPH|7m*sgfQ;LQHDFLQ z(7zKi=tT@+J3)9B9vt`&g!ci+y1a^!>{OWT`bCpGE`w0w7ac_}nKZw;B1h>* zD8Aw)llI}q6PHXn`aiVim)dEgIZ|om8?y2Zq5K6X?;~o6fhyI&)^`TIkL9tV0DKwr z0kn;;p~(KVw%tcSJW~U+1sFjzVMiue0MMne67EKvJ z--6Hkv?6=Q6a)KZT@6$dJ%ehR1C%o*#ZLpddBy?DRkBHx{z`+p1RSA*`6J8+vm6n^ zNQ3QC?is0+I?qU@+{ka2hDfOw*#4EIV+>xh{0J1=vzJVYaqHR|V>s}+6c@6}xMWfZ zx2~lt7DvxZCV7xR_Y~zM#c17Av;&2cR1v~hgOhY-0`#sfgf3d|evpA`Z0HX8kZ9RV z7`qx;xi19nZ8*NTWYPj8gmQsA3pENykNjijM5dCOMu}5VeG$B>+4Eta(=P>vl{*%kzR|6U=i*nXff0DwNW*c@AxLEV1+4I#B75;v?)Z8b z=w4m~=5b)!QcwQOb-m{lRS8l*9W@d&sXzaE?>U4qdlj%|&~#4xF%s7TrY+6j#F>!i zqh*|AE`V0FoPk5&{S3S4mdnbcpWnqm6D&OZxefzi_*1Z^41Y@D z2ZlctYr-MmRHr1(6bn05brAlS<=(;fsT$H2v#Z3Nh1zlp*>W$|jBtX5Y`NEgim=>5 z*1BQMkP~QFEGK}Jb`i5StBG+ZTDyi*0ed2CsqsB)DzaaKJt$0gK?px;~isLC0$iX8)G8$A z0}<2J!eWB|O-u_P{bs(W3)4%B>BVBc4vXn!DG(hN(~re;3yJwu#Pri*`sWuD2)5Ez zqn&2o7%gP5MJi~p1r;;`6~t9QgSo9tV+1N}umwh33Yg}xU)|3)kq|*>f zm*_b93l*47Q#hxhFXA*gEwG^8-v!WuHgSrN0XQ==J?^$a+G6RxJC?FuRAhIdo%mdo z%jw&`h>>s`;9AfkPS}}IV>N0mqvim`-w*m;Y%#>5FX*ikc$g*PfcmDi2M(wwt}|(y z@Q$#M&Ard0JpzxjICA%y^al&UN%q4+m|)@SF{dQEt{9afqf0_xWFcFTD<=Ib@M4Rj z@)eU#zo^Jj^@>ReFDZ(D?utpZ@Z;4hCcXU<;vw>QEM2?kS}Dj=0}7?y0j?yi7M5<2mmxMv zIU=qkf%jM8?QZfV{x2XF?hN#Mixm zbhuh)L|__{HW{D2S(Ik{fvBd*!dOq5Y%B~NwHbi(I>)) zI=sJ*v_-0>W_w)KX|GvDn`N76B=~4Mn;~Y{D~b|Y&~`3W;qed??kc6B;DpvbbEDMo zZj%R>yE(!1R}_gAce54e!!FtZ_OR8~0g>gSeQcsvR1k z_E1*){XDfbA`^%}s|+8}P`(J$6^NYl3|BfZ=*p-5M^R#$kH)LON3pa9P?nD-D72yj zfVi1V;?#ftN9m^_)=9x9AWB{}X{*4K71=VbnzTCt#`7Ep1zw>X_&!hRSLNY~CtpPc zhJ7&A_rBlha<_20S~YU|gBi}uH`@A~o)r4s9ISMq*DFH`w4POZ{#87xL2Z8`mUh0X$bJS9%IBi( z3ekdUDYD16#5p2oW@e*0w3E@cT8a|0Q)#za852jP8KT{)uq}?BMT&+<5lE%IDlImS zUaN(ol5Ox+lYA|8oZF)u^RJrp0Z6tLS50asguTjf8ho`B*=}Dose4O<)(}w}Tdip( z4QOdl6(ag68Xi^gnn@!i-9F{0bIqjQoMD4&CQTB;0p)0S&7@%<KT5h`*8icA-|h1HQ$EnwYY*{9%rFd}7S?PUYqqi$-X%hZ9w3^= z%56jyY(W+H{O&fih>?E)c`Af#;=*_0R#=-n5lg2~eZlmMfJUxlcl&r8Sof0Cc? zzq?7MH;0ax z+bp_C+zgxMCTF$>#>n!~JuBknc|fd8N4|^^T^s9j?Od7e0QHPQlPLjArZ*52xIAF) zX!=Hh{z7dxwSkGfvJH#?Z&aZ8wMR-2BQAM5H|5oaW)`KlAGh=V(wf@#A3 z@LzMFKh421>f9L0U?XR631#=WTA=&c7zb-m9Yx9QGTfOdL>uEq*Nvr0b#RFbRU8O9 zgV_Q4F|KBOEIn5T^}GXk4p`gbK7A*aUah0}#nz*7@UME{v9;Q4l98#y(T{PCE}Kni zQAZJvq+&7+dV+|S*&M!ACbdQavUR&=QXxsPEzYs@nn|5QDdGh`CYDnS)hXav&kN;f z9DCL@P;6_jne>hjj>RRJ_~c|#0sOVyoov#_LYfkrgh>x2y)gxs(8*Tnx=Ah}9*;|E z%qi|oH7Qe&6JnE|o~C&*V#pTs$vF1j`E|s5e}NWxb(G?LcqP;Ea9?pLR7ID#iuRyF zq>3(a6`g=7VARecvxl9HTJm)UdqO(BVLC(P#B^TyeY z1bE&!I~*^j^6QEc1ak@Q@W&+ZZsCNN~TKPIweQ8VqOpfZmp{PnWjVi$L z($@UCNu$L8!wW>zg^nG6nNy{0D3t$L6^NrAGBA3Nr z-7SZv7HD%cmcEBb56#j9``k=}$Eb5y`M2K0vZ{~1W6 zR=lamhA;B25aTQ>;23n>q=RoNa*V!i()l+PB~5|jJLceTU98+Jy>8M5N$`CE$FA!p z6$K&B#j~8P+_>JT*Jn?gEsQbciKv1hM@=iB8?ICrhmrYaj7B8a4OzDWPJ`m0Mn(L1 z4w;8T9Cj->->QM^7D2z$6{IufK0`}**+_O0y^K^1kbMgQ#)h+In!d5MB~u@hc}0Uq z@<8mFpAqm?eTC?%fUjxrUVhM;rL(FNVT3A4VO0Z;s{F9YS#!83de2}@?->^g#L;4? z8a~Bxk592|$XDq6d0}U$Nw&*Hf17J1zn&J(ucrn1?LvMKPSleZ7!QSu-;>uUDY1n& zNCWuyUv>Fw5?$P&d?SRB?HCVd9{rE?~=6a2G| zN6(v-1%26Bx`y$1H|1;K|7$^>8^*cDvSlJL}ySdix2;4`OL@J*@E1F;;CO z0GHR9=?=Kuf!Dn`9{Q8D-kX3* z3j8Nlb#It-Lg3>T;@r*)+{d)xxZxcEtNr)lx-z{UcYROLOBc*lQd#Rv_SSVKy!8YM z-GT(V3EPDmdzGYs&*^F64mzs(upD}kBej!=n(!)5lNtr%D5gI84WcG^yR~F}ap$Ip zF^Pa$c!NQ2mPWh^M8KEfalhmC&`02T3n*T#ppV}x7)R~vE3(IWaBl&8)Urq6I2r=v z3qX3@Idz;q%0kjDNa}ItG-1Zpn9U!luQ0>KDZ_U>20_)2^wTd*1We@-;Kv?4PV9>H zbS$(vh3w>2qgFy5fps`!mM!EIvb}o4q^|^Q$%~M^1e%A;a&DM3LJ;j83vZZotG?2U z{Zj?K6nrahn6yX`y$nawe@rU=mN2gO=r3}NR=fnB_!bum=l!-zir)IX-;1E|vfq9o z^f9=6e@Owje9-u!&_831Zwka3yZ$lB;?>5|fxR3`Lj;c3JdLyK0 zqTpwktmp?&Ctu6U^B=E|E}1hd2D{HNy`479fCIVTQV0mu$QWk8he$674>vH#^}Gd# za%N--ob#5VDp>Bp_wPqA3%Xi;v_67ZuciI@FlmE@ zN2L9&rTuo(q)|dyVmK_fOuF`#B8UB!N%v5t&#gCUnlN-Q9l`Y`MZc}c@y&XZ3ct-x zSn`%h^Mz%J;dt(rNsof%wOb}t1PgoHGU3=_u)D1jFzjwW3*t9T-xuj`4Q`oqQs_H1 z{epm)88H2>Aogi`luvsv)8Vg$1aZhng1_qKS4xmG%p`0qAx`vMZ&C$8pEZ(JuE%tO zn`V+=&lyQg|KSgo?lb9WpKceURX7KH@w*3P#-MdbaAHUl_-_0MS)*jG;qmKhsD~C+cTD zS3Hh-hGq0K5!Wa&JxKle=O7pahs;Y$nfjZd55*%sRS@hTljGCq{MumnT=f~cW*Wwr z3PiNSVnnJMXcuVU&T0~L1|2-Ux^7Mt#=%wt4-^l!;)cSMw{b{=XfUs=&VgsQac0sG zUO8O_i4nzjc|C!QK+x?8)^j_3$UESu>U6cv&hWeGhPhM(^oZg^Cq1GL7LTJX;o|p* z!Z)8NG0p9v!BJ>AN6>Prz~Vk1meSH==`>K!0Tpn!re4f;8EOy*hSysggu?cU3IzrX z6dDS4V3cFaB$Hy^k*Co=Xst&Sve8uJ9S)c9@=qnj;HZ4=^Uwmyw^QjKvzrt!R~Ims z3t0LcMfOx^?DNsoC=?SBvAN$tJzc`Q)n=Uv{`ET-jOKnb`5VY0ed8XGC*#&xmetESBDX2i5J(A(|0A z@|jrr9B`To?{PLt$Mr;-!Jmgudj~64PJgS{0;usizHFMq349^K>+X~cmow;20qr}c zeG{U+i8*M7*W=6taV``4goyQ1GTlJWWArGXagshy&}t^k2oY+hfqM-j7s4p`R_iD+ z*5YVlc%r~d1fDMNQi10RyiDLF0ZgF%0Qe&XX(wHhe0?`>^RB0jRAuOW47fLZS05b`8v+aHX@{01d@TePGr zjGKha0zRjQuJ90V4q$JKmK-mIXBlu#zuV)a4ifJMa{BYY5c<7cV+k zTE@rHe&DkBLy0$yQd?r_IJ6?$vnx$%mkH1AHtBpG0iUuv1~r=Q zHt8IG;8S-0;0HcsXTGcScR&lii#g8%li~teL-~~5qwjM3#J7Kn2ehfXTKL;Pm6#It z^D0R`Z)WD}?tlxE)E1c;f%N*GR4?5%KQhKtB%+aU+!Xvj>ybEm>Rrt0!7z#^3^f6_ zrD+Vj4P`LhD;qEfX{Q)^U{Xn7jL{L&pAdM4oZP7)@N|80=c9M!J;2DGm8MAvz&YpZt^p|#KB%T_@^i19R!J^yR1`2yCw8v{+;t!W{{Bi~hIe>s5T zpg=BXlN!m-SVh!h@o5XP_T_PG5SuKKve|1XxS zVY&l`!J?d!@OML>mP;4-4ge%(@8n zPd)YREqP(;d%v6T#TrLdepRT08gFQ;&#>^Vrx})`CE{om%nW~-VS&H=3d5$R!0z)n zP#lDhU?4C^#Lm{IG{1%bQ^ShlX?Wm&~X3@qtZyL!#Z{uta z(RuUd!Ld}Z5e`PB0E9tG0?hKJxPf@5S}c`s6dKo_XP6TGX>`%Vrh%i8qQsmK^g<&= zRZ`rUK_^|%oVH@OP1+~QUN#+1-8QLyBSrD)w@qr?NKvK0ZOpyUB>xt+J&J6jPMdU1 z;6IgP|7nv_8YxQp^R)IIWP4BO*L1etP_}LJXIn6+TY4zl5&}!My&|)Xo@!D#q5oq# zDo!4qkhHcWy{(hZ3ng71O8QRz zr0Y3po(oHb@#==ln}s*6I;limYXcRwC5Z+q*!>sOQ5t&dfqcegSGbA>>a$3Rej3ET z4ng*}w@qpy$_-aZ6WQh%Jbo<5*;W|=Kd4QbS36K=m7+BnBbtn1O-@1+Y!kS7gPq3k zIhqTQIwRL4rwACU9IJCp`UfWYDc2<9JyRds$qYj!9nvk8n9o@cprB zS^SPkGX&8|IcnT7sS65kd+Clz3xv>BIox+l>dyqv9g|k%5k}rIX%rJC-7#r{5PB=e zx;rN2f}k7X7NN{hjvc2>n)jZfB(%s-bL7^#OPJ|I1yiCg zg*Nfe_{NIt7lQ^RX1TLywG~UsHGqrCHn2~zhR>|L1k7W=_)=&sCv4Cd4y&W{Q`tJC z%(wDd@^jgtzD+)Y_=?bfwsM$%UFe9;w!VLu^tRA{uxw8fF?}8WGVWMxxvA_jsuUrVN>l6;*M!p$fJa@x3McU6X>@ z27$4pe9y{L8qtIab{@=}$0hzH8E5{P^vzNzqL( z(*6CeNqvMf!BOp=NfnwXihuc@NzZ^GuLeb7ug~qF9%`te6|Qb1r=}29hq`r}NLN%H z_136Ks2-U}i9sJd(`7*{ebhvks)jBVG#D=$JjWWe2x*WB4cPZ)2*WcED&)%a2HezB zwa^N^pcQ%n3bhHVz#!Z5#XPC=B-58z>bD`OJs|aga@Y3bV_3ZuPSTKIkL9(R+B z_HKF$VTS-x{U%Su64}3p_j%|Y5C$SUK1;DtTzOB0^qPfYJcXY{J|9Ir#k(eru=7flJ3`?|5>FvoAacXwZ-8PWvcKfK0T3{Gs z8W2(K&`YPa*M1mFtKL_X+{T$nR2!>QKLYdwh-#xcwxQI)05wP~6-Q*tx@XeYZ45## z4IRVonY0h`^Xix7S}w0D%`_8hlf>DQfB_@(a65 zM0V2G_ETT!LVRu{@CI*lWEo@mKt*VQuR}KappG}&6QurXr)c3e^et64%H`DYq9 z_*4xU2ZF6=mVqGtDnJx-DZ5i6i1G&9L0W8FZ-CG@;hssO#kNa~q#y2~cVX-#!LBvP zw(p)vvjqMjvZlidiJ=Cn)>^BjhLl?irUdA;jCG1h`9M)Z7H-Ev8l-ZqI^T0R!QfAG5uIcHZ$D6!?DVI#0phhsKA1&d4J46k(XghDVNd0Z*bOfXQ!ba=glwEf_15*LCp*<{cIRF@CkLAy2V(FKr zimG_Bv*6l4TY5~vLCkQ?dIQ`+4^>ZTc}F8x)-kl!FJ;m&byFJB8H<5K3TG@hBDDwQ z{sw!eXIM1rcaBvm+AOkBX0e#z>J=@fj~TImA8-c)8EG^kXByyx!Xwp(TI_Y5^L5Vo1by26$2XZ9TPh-@HXr0wPWhAG! zC%VV8gD%amn(d>1Ipa})5O?NTxuJ29-EDj{+uF2r98r~EMwZ*3kwUYWPWBt{(-5)? zBYz6z(SyM=(9Je#tx2{VgZqNcR$HItCKb-nyOYx~(7ZXtq>@7KYOPc=7xU=axh7Q* zu7yTY8z4!a$$vt4r&}F`=9?7tq0-028|3I?>vA~1$cJ(q{jm=fRocWiRCLGmg=8?p z$~{x!hiKa9vDyk@x+c_M0@Uj*gmsbXjeJ18JiqW~dm6d@x+);k)MNY%1{k~S_0DJ6;1vI2#&8EqKB1r0Qyp z<&hjI?o_v*M;4RSHbXNUwHV2WfJZGjja~3#h3P#Vv%rd#0Hx3=OK$U6O8)o(ZT$E$ zO(5tDx@n3!AQ|4Y7|9w(H#uxSpD!Wn;PQIfxcx!ORliHBJEoDGQjO@230buum~T$r zHQ)Fmmfi)-M_M{6(3=BJp)L$~KgJddoF}C^^yg!#wI-Ep zt3%WG%29NkNxy*Mv2`XLgc1=h%q55Q`6Mn)RiEe@n4pa06ru^N`3aOP%|{b?h3P!9 z2)nVzox^$1GFH18-rD0* z#tn*(w14;sjIn09Nlyr2qjKzDZjzG;SQoA#gr8Kz0{07TLyG|61@83=O{yilyY(%% zmY>L(_3oS-mU5d2$5zFQ1y0Eaiv@Y5_IZ7;!*6N2T4U9vJ}S#_N7+b&P`DI2#^oLZ zAj?M=xrh1=kk3b#xZLYLQDkoknf$2*y2>ebg9rEC1XiEo%`b4J&<*BD_*9`M!6ks+ zz!T9$ZLw;gu*HT6;gYu4i%ftO#tWghl~3-!@u{NtqYF*?kU3z}mBP`{8e!9oVvC4t z&#>55;q9WAR}KnSev7e__}#&5zlUb1cG_lxtVW`b23rR5hg%0Rey26)wusdwA%XZ=dsiQx&Dn@+t5xc28T0| zjs2EJ?Y2HrF^>KMDl+H1Y-gzz5|{tb+5W-VR{AV5?o>%?w1PA_ z8Z``4R3~F{G%A>b{FG<}`8m)#5#o6>cwscAq^nW14Eljb7+ax({b{hI(3WTf;QdHc z3z$?7?c)58gNtlG7>XK$Ktw-8JI)%4ZZIVr#`2fpO}{hCO>4q80yFRz4jyJ`f!u1%S`6^dwFCHAjPB=IQ75T;IGD#U6(_&&QeFLzK)9)i1 z90NC81|#t_X>g3L+td^q!ld=kox?%xj9}p1)KshrjE%t*V_!Z}qoAM0#gwlUOMe0% z$n=KUCo}uq&lTCO8j3tpt|2k;PgxYjG*=Y=qD4^={CLx%sC0AmB8@GIdI{^;7>CcI zC>|W`EQ*rxqmxC^^Z3!c~VNb?hjmz7{?WYB5 zj`;7K80nGc#60^X-Y`t_(RVRuXzQD!6Q;RbslPN=RK?}=;Jy|zIIOGgA$g1QE>w3V z=pKn-=RL-m#vE(T&U>D7EqoSG<%oQb#IO_JhHQ`5)69=Au=%-F1n5KzRzBjsV1GUu zqy0Imy+MhobSehdxGR5w69w6HDhBtsYk#509uImTl}^Xt9(ThpxNo%lX3|R_5Ye$1 zN8)cLee{K*q-wwMQWF|PZ6W^^qi=n`E%2!rzV+P#8S$;}_l0mehHriQzmQwsE!s!k z`fk-;Pal4Y#*TWpN`mQrZ;qI3kxJ9e=_i|!5TMOAbOJG*ASleA>I^zFX|b9l)wkcq zhrISP?^KlDM+a5xM0~usZ+nC45mDFh z$BQGXm}QHuOO#*h`iBiKR2*iJF(p+ zaLxmrO1J;9P@Raz#Oec#(*#}~8`{1NmxS%gjzG&*P@A<+oRJ(P>J!)PomiUbRD4Uj zZyb~-Xx@*1E@b&W>d$v0SHeIK$yKWCdo@#>W_TR8$Z?!1=2s_Lq>ILJmW2-j4EO{r z^*0JM(xPad6kt-^{Vu^H6I!7rO7`>OjO45U=B4xEVEa3w{(Kg|>M!7*))sm|vXB)i z*aAlqye_{pkWP!@U|(X%OGWZ;50@;(TdCHF{H1Y50?S{<;$up-P?S(Pl=IR!M3};f zK&JWV7nWV>d4N6_{lbcsuM02$DlA^585C`i-J(UNn|_Sj(=V3NS}0wwt3|mraSzlh z57pQ>&9i8g`dd2lQ*jb;Pw6ru;+|$L{Gm)YN~U*1nexDUt6=ZNMGU<6N{h`Kc;~r5 ziZ>*EwaSgwjy2A%+laoo+PQ@c7{}RB&_Mt(VAS9wfKqH4XGgggvwWF>L@Dt8-KN`zM!AVqXQ=fGu<94kLXVJBPb?TDlpKR zU`G)AyM-dM&9NxD2qF@lnTlHBMQlu8(7eyi6F+=&T+OWmSc<0>_WSaY=JL9pZQe9C?Nbq2E3it~Qc@>bS@CP1W zhKDwA7Xp==@<^m9RK5)TvV8Orlrh|j>}9^f@n|1?3}xcna3HL;B#6w9SeHi_4{vx% z@GV%Ea&GZF2N)uC@rm)WS(l9p52`>HFYDs%9f+l8ApT{D&!7OJWu5$)=q&2GgP0%v zsO}iL0=_oz`sde`D#y`B?vSf|4RceXo4)zra4fZO<7>Bg#Pi#em13zC1icMGt?=}2 zXXC5*SPDXzt(29hnG~tB;dtIk^feRaZ8Yg~A#^hwTQ{224Tasa(WL%vMYhVzO-lXB z;2W}|q8%?TH)$joYA-iw5`HvYZqh7px)+$_`%0fdUTt-Jy}+bJkP#WK0`4HYTMGT8 zW?FSYXBb8@T#07zrtT^?T1|!rFgmMW!-b#0Foq&d56$Gm>IY$gEFUc~P|>#mg^#X( z&kOGMRCp@a5~ioL+9;hEM&vTWRp!nAON*&m@z6`$~5*ayMqHPEpEK^t+^3Z8%;w75xE< z?G01WaUrZV92usfyG-z#if#yDo#7Z}DtatUkz<^x=%qA8wyv{HvVN`G=VFUv+-#GY zf?@h>lbmT7%iE@zii!!#4~F9xQ_)vo*=Z{3o~9`NcT>?I{5WMQ8jBxSO-0j@{nxup zsw`>8S{x&HnY0jTC+;$7HGa(4WzuH+SiH-mT}Xn{`7eB}-D*V%KAnFU3{S2!=?oZf zI=`+k$m#rRtSOOADMgJ$-bRCLPbozo3B27%`dFbB-AYjlL3Xet^#U?!2>!-T#@}=< z_B^Gim2mxJBpm^TleQCNmj{!^>7>x2yKwC?$aYpK8X)j)(Q2H)$0D_wEy#yxRYGSC zt-cqoKO(i-B*=$oRY51kh-Qy)oi=zZbNFlRW?1UwFnCJnXAF*mPo_&8e1)?Jj~2qs znnxiuXp^d~+x9-gNC-E`{oEj9>ZN18i8j2S+i>CcfT%2uZl8gXeyNYsu~eMOYe_m? z21NcBiPdQ{&afiz{v0Xs7cJ2b0W9$sE%D2U+%->^e7RRi$^tv?4yF3tfpm^pI)41D z=2~>wR$vc`Xocm%yRp<4Ir?a&1<_>~0R7FD^?c}Ie7Yk0^{)-WW&4QCwln*5$mYhZ zzR@jjrNx29yn+d3tcnT?VZFuis#Vd3bVaro7n$^!;3r!gjTf1;C0$X{$BVEWqQ9dR zFZA^m{<_aT(DC&t(lO#GA#b;Ej5x~j5F=^|;WrD%h%@ODBd$O&V#I60ATc5;LlMV_ zA{pFRkjJ~ivPCJrw&d;x&8Eu+9-8! z0CfOYq61tFH8T_?i`&ovwtd|UY-GD#^t*+s#8ER1rqV&nj-9dO%TQ!Hu*RfR(dVGW z5xv%=ZYWUEwRmq*QGC)`yfmpOzRp^c)}n|uY^nq#%^#MC(R}-FbQ_8o&7-At6y75i zZfQM*i(A?kXH6O?^ph6H*Jn-I3~61@nzRo;hMhI(PyCp0)}-@Lx!NR?rhKEL;+jHy zi|8ingaN zrJlyO#7fuDuqj*qRt2wyV<+Jwezh!!ql>dzDm>5R_4(W>l!KAb8DN}&b{XyVqgF^;Bop@op9Cs{zQnM! zbfzMECm;g!74muphyy@qp*3hH53}CLj1XIccJbAy4}tW!-6^j@LE6n@Cl7LXqyyrf zH-}CdP^A+DBLHFkR-=PKFia~xe*Z#;h*=xRwS@c?KMvM6Q)YLcNAls^{#U}cL2jFM z6&RiEsi`LQ6ZoV-wt7}Y69qnPI6k*3nv9I`l-k@51|<{GKNiQ+Q%qWtsVM(JV9srs zq`q!wc%8ui7-Tyz*QB2XzA5yb0^c#nmTpyaP~h%{qoY;P+Dt|9y{wA%Kn)c8jFfM6 zG?)7f@F?aL!Sk#ZjCTaFMl({D7|7Z&&yW!w>30XRv)pxQtJ+~|hwO|d&u1&BvjuKg zJWG+iU`O6y?8Ofz^v*(agtUqsb!GLkur`heAzZF%LhobY;tYW{NcV~`u8!t(ZweSL z#k+!#QcOoW6!$~HgE68M?2O{xHE5f9UKeGRg-((#!9G~kXK6d141bS^ z{;(K{K`$2Nk65q-_G^Cj0Q+zgXR5mqX1%mSL( zud{76vCh`qqx5ndCQ-Yh^Docsibm5WyAxHKnnLUORq7u+sM8TvMM0^vfu>`=RnbuF*V|Q8;XB#*D#^;V+C!%_~`s*Qpzv@$znBoou>D}b6vGf5zpN|@0 zfg#hUh>vX8I~jz8jU4-zo7C9{6)|)uCirF%BZtzRbT<;w`IwVUsvxW%*>I=PAx!!E z8mQXX9SGua-JJ@b+<{QP*47Vg`-pluP;Wv=z3P&84y(5q>g6??h)j80U!8WTCk@WI zy^-Ma(U-_8W;IfU+gg<*Bx~gMH7BW% zWWxqtPXTN4{#|lwrF9!D=*a!MQDFs>@MZ-63)_=-;4;0gRbMUi>-a z3kyz^eBX-jr|FV!o&hNes_nzMJyz>2B!`d9mE@6XEs^A1^VAA!m6qer2)b#%!f|p~ z?IX6@N3dFx)`}86lmYv6#P2j8eGV5K4QYQ^6|E9!ZpRg?qFlCNIBPC&z()t*Ysfk) z;-EDXJ(=`-h}immVhgV~lMbqe+Em#_avP#-#M_+^lV3_|rq>yK?io6S)722w!C?Ll zM*U}F>0oQQP0`W#>{*=DZhgX_A4T;}M$(`Y29aaT34>0w#=Zr>r0@9ea{P^GNvt+Y zd%6bwq1;-z9$H!t3m39Pot>=cU2&5i%9DgDecDpmo%3bPwuy^UZW-*Rsk(= zfMMXeVbQI^| zVb`&`q+|K2QGy@a{WO`+rdADQGs)m{{kA(+MZ2WflZ~XxQHsb>HA>O*el)fG6$l~6 z)I38MZ<>}ejfa`FASIjTu*i1-WY7W@=?aOQA0hI05xF2zWY$AOrn}pEeZc_zsm4mc zSZUys9Injl6nC|@L@RmZ+s2Qx${C)NjI@kk09Z7K4#2hngiC0>v{q}FG&ZEwY9oy= zI7B@krRcbN*%;$!5T$4~bje@(*4f^mJB3cDWmau~UHV(Iy9^8q7W)<1k0Dn1X)m8H z-i9n}O`{aukkcj=qEJ-dC`Bi^nA4&Z*#e4eDEae}{+7YTFB*8T_Tgg~^ZbR>a5KF7A%%LI3#;&XG{mFBlAy( zEPFekT(pdjRBvQdpUwtVX-mIYW_=ioS=)?hCJpVZrx(i&+lFZ-_C zBlJvsp3bQ%ns_FXnCkVr+-a_Kcc#znr}L_-MKhhZ7(6?DO!T}f-=vBc_;TbrM^YEv z67z-zd>^K|@LsX-?TwmU^r7?V1`%I4c~$7wEfM!&>Iv6E!{Ny_scleEQX9D#vw6Kq z?@6K?mZbA|9x&-P|1IzXFH=Ur))!Q1V@#fL(!2pzx;v$QYVGVmJG!Wz(Ip&i@(gbT z&%HVY71M8MSFrOApIWQ*-IlegYf>Ej4bkCN9^$S+S3~T$HixS)8<_pt{p@~sYNp#2 zWD(a?vaY;MDq@t2JiUH5-wRBuM%OVCh8|m$k(frixJvKcpKU}64p-IbhPr6z+;=M@ zA&vHM!kFkbk;k0#$>P&Jne>mUpwk^yhV5>Yq9?>|$0Ab(ax#Lh^!L4Wa4<~YMY+kB zx}fSmVzPhK=(@2~vW>!P5pVA`6Mk&a)K3Y*7$>yHo7dGFLbbKWT+P^3C4py?&iBa^S zz+J4w^e+VN8u>DWGcz;InUX@c_*6WKG|#H%+Vl7uDQ`ecEPZ82>iJe)$@>I&bV)wJ zV`+;WHAfJOtq~KrZ^Q*7qIB2UCUq6wWmcI}3cNz!*BB$I@;h#-*Z+pom0p)_^TQC( z`FE@K+~2M6+}3Rr*>k(?1je5c{Fu*%y-CsS9h6BuWd(wjGbc&x5nFf`Afyxw5ki>0`G}(?EcB5^_=kWttRyl!jY(?_qSruVry&q(+9xS)MUn04 zSVcz#z8z(&8>{GQH-i=uQR(>4Vih%OrzqYRtEe3^hI2%B*Yxu28@)MSvbBp<^hkH@ zdPAZeLt_;ULyGaSisA)7GKLtgF7PN^#YNxzsvw3(M})k3-5=gnl5hSf0dQcI>aBMjYN&x z%5J#^McQ}Iq-@D^YqUOP_|<)I=R7!X43O2>9dP^Gxa+@89jr}s``8~XQDQ&4Y$P|{ zCG&c?J$1DHV%7X7qxD_;lhGKWZEA-v_NNe?b;}lf`iMzKILg*U9CkkF=0y>rrLg*I5Rk}rV zMU}EA?h$&Q81}@5Py(KKTJRxHydf|=F|VGgBxO0O20Tt*Al(~$Ei=mf_@ZGB; zFe}C|cER%)2IKZ(f;b+-^P>wWo^AAElgbO>Y>aKmVv~}381xDetwNaFvDl>QLO&Pd zIJelOe>mZd#U{NdgbOi_B1=qqFyk_KQo28T5+xvW44Yq!@i&g4-zKZu%wvF z%HlPMHIh{)Tg2r2$2_B8a-KIcM~W?yVrpcHJ>e8QonQ5(3Ma~QR+lr7>i1?fuN!bV zJ=j3b4p28M-o%2EYi!ze*Vy2?KYfW~B$+9AJBHTSaI#WM4#F+oU$ei~v-5Ih*Q%&LOlx|d4oM9i;u>1= zRYVOP;u=~5RH%kDYTH+#xOa%FhwNYUH1H19Nd^zY%3NJOQRk$tu2Z4v`iD7wic^#$ z9H(p?I6C&!)m4t;M$Fe}q4|6*OSe_SHR9I4wup5WmorfJ zeQz_oQtC;2)9Y`NEyuZfTff#mcr#Xqxtpxa>)&V}B)Z9(Gyv>(I|E)1P^v*JHT_1B z?bjV9MfEoLddjU>$ITrkHHU(>@^(eVgm5?3@seFp`ZtOkuiF*1#*c<}MeV_wuP}Ar z_sU_ICN8Ik`dE8O8}AaQ)$0-mTXlvy{JK*Y{`O@b!2J4?hKE8ow9V3@LXS9Zo0WP; zw#{)Yp1roJ@b!$#e?%(M&~@MRd$UA4cMA2jjuqX8iEhJKw`tIYbsNUI%>&H3X?XcJ zp~y2#-@dcg>}^o!Zr`}LJ^f;7Jv3v*UKPbg|2M?~L9g%qbaylETKie?EEsD4PMi_0 zuRC#5-if7O!gBA#;S-5G%)ZAeAAq?&wJUm4r2QM`Xm3|^oYi=IlSv;6;ci^gbDJ=0 z%(G0S0^)@It*>gQ>R>k##A`a*p+w9TWEr+PXT~S0j6enG6Lz8%a~t);S}#@WVvZ7BM)n&*XPUdq}6Hk!TTW1 zXVMvvWb|&w=-u8yQDO^c3N0vrZOViWdg7Nin78*tEAjcLOM#K;vGh#`MfNd3d0SCe zz8BWB1G-xKOdx$e>c@OTfV3|Y+!Dsk1&+t^KZ-ri+IcL$v-f>t`2#}#+sQmH z@<)Ym-tNFyerE?6%l|DoKz)(^C0x^4tax6cG#FcTC5D}uR)5Q)|Tj_L+d}0 zH!REbdFZM_72&;U*VBsU1io!|RKf;UM@11s=~w%NbP8{8b+#+2CyBZj(0y@JfpLQm zU21cI2N%!_6X^mEFTk_dHliBOV!{8d&~porZN6Pm4}qr@aBQ(FvUNnG#p87Yg|Myw zZ`O?x^`;w+CCg1J1wL(($-?+!fut>y@QNL76wMa75i@-($}AS%p9(P7>M$3PZI4~i zPeLCTd52JYu|(8xOB!mO8=A@%Fp|*}=m>jqd`CryRYwXSR@Ltq3ILkQ6V^WqAaHf; zh?PUX*A<|%1+YLkkP+4CB0J?6Kzxjon@RtIXlN%G$&=in1<_0{c6^{+Z0}>>G^bUa@`Q9mZ2*$fs!--5c?j1hQ1K^?bp1s+?A$!-^>#3 z^|QE%Rij~6JYj^<%8vzkGyJE57~I|HgxgX9z0bC}ASTZ-ofX;R`WaLufCsR57JR=V zma6X0vN{d7hBg8(>MSpDmZgyXk$wi@@uhx+uu)f`GhF^YowBOY2y0#41CK8hF$BnR zx6KIBNNcVHfmMZ!Q83yD7d8vBJp&%PW-A3>P)gZGm=MkRUT5F@ev_?vqp!)*tbY!(0PNd%jRa zNNn2gfp&Cns!7d-w`<|ZZ>FRRwnt$O8vQEC$e8I^L^6k9*@DXC{rZ&Xdy! z2MZg#34XBfzsF)}sJOwQ!f=BrfP6msqc8?7i{TVk*(qw!DMtMW)7kGbj;=9k2cx3; z8OyTR>57fqNCv zMjj&Yh$7mB#|k{H2>Z=c$uI0TbA>*m2v_DZp|d>1q;*1{S;Vn#p-GjyNaT4QrORvO z{%lY9BE*{>8f_gdQ@CYC@YdgQwqflqN-MQZGF?|B!XSG@^nKoTNO*tL3Z4)yD3~YS znVIQzWziUGS8<&~Mf6wH4zb|3yU4R;hl(IVeGCvgBZrD$EYPxxl9l>HMc`UIUO!O; z5wm?4MfP)W1dluC9rXO?nWZ=I_5lccez!Y|E--dBuvLJ?6aI9m2$mX_0r?h?SW}`a z%(~cSZc(nM)1i90%DG{6sGV?J zDw5<|g_$PzaNPxarwG}8E}&>Y80LDC60ROaq2ALA6S(AXOU?4 zu2HuWFjG!Gw(Nbf& z>Ym~6qNul$fcU)8-%L#c9Pm-cV(8SK1*AuOgNk9qSF5W+ua}nP478#XMX&So^f>FW zN{Y0Jl;Jt2R(q?S1k%v?u2pJn`Tsk}>h9Fi3l^ zOgwDeF$UF9G)Z#UQ9Povd3w+TQ53!J%fh>}I7hQLgbUG(2bT?neyBLv#uZf5OyD!c z9g7PpDvB4I@vPGqfS2hN&653IG*?i>3DM77TK_Hmxo&xO|ov4 zzI5p$MzSX()7#3~j%ev4h=3Klhx)FikHFn1F~j5X)AvlQ-d&OX%R%^#XJ!hmd<0>z z0W4#yd(@;+qRh%i^ixz51^zLlGaq!DF4)bFkPV-Mn=A0Ik2vu0sixh-pM$ggRZ!7V zA#Zy`!)paz{YXTENplCKEl;*K)v^8PBSzIM9~nn=DXMZ9H;!^Kw0fH*r$58$SqdrI zF4*IbILZ`K)Ew$mDugzUYS=5(J>fKuZ#C%;!R~#8KMi$rMWOi2;#ri5lJS0B+k z`&U`J*4-5)W^r$RjS=6X+7VMuNY2+E;h53`IkTF73*m-Vb6|couLw22nzsZiYK}){ z5o&teIa!oz?Qd!W&M2YB$}>t}gfqQ6uAKUaW|Y7ncRoN2cxIHqfM*>Sz(-3;z-4}h zml%WfiN56}5T^cwEFSDWF<3XpMJ0G_a*hd@VLvN`r6qWVeVqvy?7k|5jU^(QTfM;# zG&k7mJ>mVi1ludB2PzKj@M9rtE5Ys1CCRxRVziSf^qnPmv{Q}~g3w+Fdo>{mguF-% zn^mW&)?3n`4wTUKdVme_Y!5~D9xy~OKnF{7c_ogTAU)qw7$F%SDZ%~7=OE-|%=7N| z-C4d&XV9%boIum8_`(z>;WtWfhj5Rjr1enRwBsemd)l<^kRz92wh%g$eqs$rGOcgt>@p@69)_!5Q)3QGoe%2NIX+ob+($Q+ZNoUw1 z;V~+9FtTWdb&w26=9T32miZ;ojIN=op_5PYSQV*%j!25oAFlt6@UGGNbQLbv2ea!w zLSI`l9U6KRNk4%6KHw)o>qz$)=bs}ttD6m&}@96fi zt*5l0!<<|7LW)iaM~71JbqXmu!vvWBnh++JN-8-StKhgpaZkkL-AJ=FETkxUsCM&N zr5x@;ic~K}@t#78D&t4{LW-*6N4G+XUhakRA^%4t&A`a~A0HZOAfcCiH$7 zmhye1vm$SMDGgtZfYXTRZWvCQOhlA42Y>bFnWKhjzuQqNatW`HV0V{_2+*a5Y0rvi zAW*-8@a`$a>L(4$Gly+?Aw^FM{d%eRV}%qI=&dOJav?>fdMo{H{x^pilt4s>qc!}I zz(=ATk8Coj2I`5pqFP8+e@Q`G34FekP8p1V(LlZy_(CaedflV|9REP?FZ6#jeZ>9r zi9$c6=`$ng*a285^nImt-?LKSLz;hM1b?1yBg`Y>VL@V!^^8pP7Cg$qe&M4C_OJBT zTe~>pw)Rm>e&6q{$i8(LRvUfv{iA3C&0!Y~_ zNBLZ3J1}B7=epo=n#;Cri%Dv@_KF`Kb)4Q}QWqA5hhz%m5%7>qe^e%pCr(CII9XOg z802KxQs5z?oZwjm7^?_EPL}-=VyrHBFy^zG)6b6*z--@zmjt&ys!yD3WxE}Q-LibN z?NRg;rvUkUw2#eo2Lj%kZ_K8l;=qb{Xk>5l-Vx2IX9v1OV8NH0vxD~*MT zU>`;K5B>78L|0L8UTI#I7(85uRbH0B8Qn2LpI_R6Gr9v%AH0^3D};rmc`ac!jE%K~ zg_1+Q{jqgoa@iN$1PiypdKKvr@-|5%%LzLnCBi_d8J?8J*&dIxMW&nPTYDwwfzPVa zM%6SQ8LQYzR5j8>#ws=uRSo*vHFLIdHwt55vDIv`KVT!DkA5zVrhEYqwyXD+#(1V+ zU-*(YGxGyaFe6it&c2GO@bk)z-T3KR*WC*GTTn%=G1*27e5v z#%BYck&@~5HE;%6g^ArBOWhVrrTZyL#Hnz9erk87y87K;gZb<8|AHb8c!Tx-8?+x9 zuIG}!vz=%6Q)E{o3=;P`#P0PI_k{Kez^D1>G_&5|^1!C2*`}8MczodwT;DQi1W)$I^AQn^pl=!2`FUpb3+oVOt=(TymDV(*OyXJWecFeBs=uo{ zy$l-1XJFuc|LJ9T-{1Z-Skinni!*2sS-SCjR|buzAEc1|l5nkOuGQd*)M!0xv>9kF z^!hSzq+Nh>1UL-9hsZs$Kd46kw==3ZZL1>0gCKD2*V%D zFaf9&K&AQU2y?B{IUbQ5$!-}HuKatC!94r4A`am7SCPk*MbTphs?dRpnPp-4(m?op zw4^MQsWmWk{93NAEFx4%)ifo@}oGr_?l zq64FJ@A*q<4*Ew&MFf3p?wu0)&!u^DZ!sstHH8a8I8a&-Ja2?y&X-2(2q_yVw$XX{ z>hV$0(OU48(t6NeM&PTZBf5`DqaWx#{w<^^S$MCNwq@@ysg{8M)Qlgo!=%;FQTHni zg>t<#_bbgLJM=5IM++UJhtsEtZ0!W>QW}@ z9)#MK;S$McgGvz57J2&a$NS)I5pa(mOxl+R>uNeFxeh9$tLcKkgUj&T>>sh{2rM&T zm}-pC)jG6H#LO#pjIPFrnHLTK6%*cRW!MUjjfpq_6kSA7LVkKxp-;7v9zs7KrjsqP zh@x6yIO(GzY}|81R9~<&$|RM?w1;f2sU|fR?94KH9`c32s|3!7fK!Sn@(aACjH7E2 zMLkg^7!-Xe_=Pc{{Ro^o=pxufF?{M^6g=VSX}Yd3R_ZJCUXMjM`!KQ6eRG!a!rS{X zZlTl17-S_1t@!6^FM{dk3uB+h*xA3A?AX~cb^Jl-{U0N?_pbtvddz{1(Rs*;%eq?# zV;hrK{6#!$T2{yhA7js~EXmn3QT(Tbe&{hB8)^!CPK$d@_}N^j z@wbG2SzF;;$O=sapTEXG6|5Bg9+V3e9=`4t`jE10d(YVWd_5;Wy@Sx%*Zafa!gR;- zB8qH-6(z0HPL3O&gM>V^EZ_JnK3HyimK%&21BTqAg=2hKeGqesz_ZH|=P*a$Ic1Y7 zE`X;pc8OrW)A=Ta@_m-`MMGL69COR+0I^Bn#bvn~c8FQI8c@pzgub*ad+DD-XR{-} zzlFZ4taip*0{>i=ow5F4*(o;1X>So{{1^riZ-6t}g)H^q202t8qZga>h|mw|0e$>9 z-CczT^iK-?upZF+xV+dLd{ziY^?-f?^ud6>j^yx=&B6D^=_Y&M7ISk+A*1>25TVPQ zB{FVl*ZUnZ5Nz5AKELaID_AM&-}e`_htTgm#vS)C5gRV*c%gSF%X60-(1VLQT?n1Z z^4ukHh@44YB00#mdb1%9*;d~WE;FB`YzdyosmyPZhZH`02*+zU$PtlxRJY61<08TU z+VN$fpLk3g>$bqBwXr%tOBhRy4>?GrUlb6m7;7N(3i(BksV0>W`s%XrGpCv~2DxFC zp_1Tdy+XvNQHd^tYkdt47`;EAkugMTR3!?(9h8ZJ`5 z*9H6tFK1N&_hXp=ZhDTDnI3t+&lo0+X!zR8ig$uj-zd}D!hF$$ICq%1`nV_BJSQ&Qp zLc_$wB_`-f5);2V>>(zuG$CZ-e3q>tNyV~n4P(o~$7+eNS!LMAK7cUzSi=xLMoKn7Pa!PO2G|Kv2y4S7 zhlhl<+`Mw8rZ=xV7-%{ZcfzI#GN=AK?n7r&m-6C(7#JQbypvblXcC9yZ*P$Mi@E;apmacoiNHHbMsIN%vP^)?Hm}cDADiq;L?Gg zZg7TYQDeyyu@6SK%9eg2mYyA<$UY1h)|r_D@A?~Odm6gi2J6yoPUiyGjfwc?j3+yb z?v}OOh$XV8O~Tr84eInbrpFz?v*#P`b4-I`Bp0pGRP9Q;= zk0w73Gpq+kM#QSgWaiv50$ywXM|fv5?>%ra314%dCIzH|gmxE7>X>FsXh7+~9yo&IlL_wO)bmm9=40 zr|o1Ne{eX_*6x5w9fjWMak5?BV^S}Hhdl0x-D{F3qLRq_TUHR!R_z^^WZKcWgh&!MfaMt1|m^{pE<1=dL)7$ENPtWX&q?jZA6Q#vn_fBboJv# za=t}ITKzay8F!Dwitz)hjI{c3EHl!m&>5rE>}X^^HyJLRLTes}4?jK%OP@7p4O0_G zDY6%x0?+i(dPY?r1^3}9NSdPEWUVgA+oPlkJ_ZZNqZjfxu&L?-2Q~w<@B{Iv4SsYh zq^JX@!IY<#q*?cP#5A)06y1A9Od~O@YAn2)9_MlQC&I1G{FV&~7&T zUt;*(Y~_nEd_OSc&|Xe|69&?DA1$TYqwQ`PEp{(58m^BmznQ|Z_i^6xD-Djzg%rh) zmMy>eQ;d9De#-%jrdEc#bzO~=aVU*GtvMQnB0Ys0o_KH9^obRB~oi7yyO zUCP58GZ^Io%0oR^{34)uJkw2#v9+Az+o>jPVgkmeeTA^Q91qZk=j!1#k54fK9w+oY z<#=R&loMiro-2eu%JBgG%orJ?` z#`zS*CL9#2>ncX$H^j!+OZNy*jEVWBZUkL zCr=8sDr7QVcrWNo25}~69&?0nRX2}WC^}lf62VI=*uV)u*dPRH1&6|f--I9y>N*H| zDdUJxuIaixEh?gJxd~qu`ejYO9YN2ld!N(aD%*pDH_ctN!ulUw{lhEh(+Tz5JxMFQUE%fJ-r&ie0FP0huqdTGr70?m282>;= z^v(ZxSq;R<-l*twTsia5_Z8N4kEO52E3(%C%G-)oaAA7@r!#gGf)gM zp@I$Dm*b{K^gQSSa)myt0(Svxkd%9#B|=zSfqR|0rt0DETZVV$Xiw+-Ylx9!~{jQf<+bG5&Yl^Ny$agIB}9Z zc80;%dS_dbicHrXOUNQZsQ^{kGVcoEM{St~&=i*WOmfKAC%2jrGDyBvvUb8Nc4&vpBm6MU%W<%NmM@c5 zS*OeS%AMkjJJ}h#Ou(Uk+(-1`86Dcm9x-@=j*q)4AU;l>pr}e9$fwlyRKO{<(7BA= z>?w;t|6d--KGa>MYkxbXp0bzRB&`Hs;ChY`WIESTL{N0IOY{qG>8cpG5sNgzjW>F znkXZtzeQ{D+Y*x=vZQ${Tv@zoTn;>utHv=iwU0=xRhbm_-V!sl=bh2s`}8F7-b#Yc z=e;#%KGb__32#2{tuMTh-iz+3nJ}NNz}?dqGqszAyQd7HU#t)@y714`(J!KV`o5^5 zFNOC~1;@^!iv9!T(Q$MU{H~fju4({0T2x=bOULmk%)o@vLXeK5RhTeC2-0!12SFnB zQXyTgzyW%#sK`ABjx%l+`o0Q$oU!L5d7N(qw81IGy}}^J8D|3zCp#i|b}}%Y7K9vU zToGctEO;;~|A#P$GcN-k&it3)#q>XE5lC@SDB{%zLMd(v zUQ(Rr6#3k{9X>1CJd4&@r^}+vDe<0D>^;U5-IbiFh_0kCAU(=B&CXL{%KgrRo+M)U z!hMHjw)WoB+7s-vBRpZva+8V){Y*vfJL*kA}ljI=1Xku>u(ci<(c~BCGIjiL&ZroqGYV?Ek zDII2e$Lo06J09`!MX=|ES$td3?`=mL!jC@;7xv-IUME+N(MQB%jNTZK&qpKU;lnL* z71{rqZBSys<@D6?yHhfPv?LxYj{!)r9V)6w&Cwn^Cf@OAF-70x;!H^~Mg3ueFDIE) zXpUZO+#5{{mlXK7XvcSxOd5%t^yIRnPo9jyZGu}w{xrqLZ$GzkAxr&nU)l&`r0HFymm1ZpsPs$M4; zQVAaQC?KDYrc{DcR0R~|gR`qEp)J*&`hNvB1g;UH?37Aew`o%mxNt{dybxwoay(x^ zk&g*j1e_y;)s?t0u9y=M3K8)(2z^Z@Zj3!SAp+Y`Asny7jd8|Q32gTyhkSjM{X6Y7 zG6UN@^}ZQc>F=~yX^gudMW2bS@||}4pDXc@vbtn6-AG!poaaq^81qHp+FvONUqjCS zDP$g+))9`Al^h$^nsgZIV#Ds8aE6inQ2zSmM?;>WpRDqctF4tHZZAHB^=aA^V%_k6 zu-2f>)}JMOF0W)Hr1|K3c88cVut7M&JVZ)$`Z=6*p-#F;C%uv{X{4v(T0xU`fh@0w zezAV6+eohjgO_za5DWEAh!~uI`rQMAa}4xd!rLc-jo326h#Zky3%zeb#Ooeyg)3s9 zVoo;cTj3p$z+>%hA`xTlyz)mDqMp;kdpmgWmVUK{35I@lo@j6an#>)vp)?;2 zNkIFGpQgy(_dD!T_-JGT8rd_`&^)lDHBodJ7FqV`qDjQW1Z`}t@QzI2HddE2K~q^G zgmDSP@2ad8cw&O%^@55TO_S4dKMB5H6+S!p$+Ym@9pcl0+l4+Uf!IL%1)i=AbWGIx z?*?jtr6_jVXK9PIp|0ku2?n>@vy$7j1g@!T((>{(*MA?ZDXf#&=H_dqsVMn>siQm< zo}sPQ8{*;T6O4owKDv;A;27hbrU(vyf$OL6x5zH+@R1dsm)X;_Eu7h@1S28fqtiOG z9+KHfAl5x(sOk?(Fy)W(@6$O_eduzqj_C}d_AIjMa*`xGIt_% z#ZST`x`tsocOr$Squrqs`9KI~Dsw0D#B}LIT#|!~=-!;3Z$#I6Zm2g&id+c!RuV}k z@-C!AR^xq!twFoO7TQ?ZNT}@d(Zdsc0nzu+gH>*P?_7#Xc733 zG5m~&tGHBBh>Ds2UB&nP?drONjcB)ZhQzlSi3VPt_7TlUL^bA2SJ=R=MuvvTz7bXA zZAG&avF6+dncI&5=kw80PBRoZj(E4EC`%HP@?Kgs<~=mp$IR2MVp$^how+av`p!c0 zbUny}H{T(19sf&6isgwB@xQFF-xvQY3Gd28j{i@J4hV0yh6NQpEA-Wg{GQNHkd95> z{|J6;6&bGT$LQ(`dQPHF-bmo@bn@Rq$v+bOSRI8AO^=Aec;v2y(B~#T+=peh-^GB&3~Zr zU zKo~EC#PJ?@+|8pXhiGjSfXn4&czZj2*7x0s^0Sd;L00&=)Ntxo%_HFbYF)?wiL z3u!ctbBg(BrlN#A>El><;dEpa&d1}<@%g;JEcWoLE?#qUL8YOSWtYDSOT`;M-a9s7Ix4wWSnCl}bUD}H?fr(Pcx-Vf6G z)axeXhEuP5M=7d|Q?I1gmYx;9F6kbuEgc^vYfINqUaT$sXJW~D>1; z8ZCX#1d;O(eb2m!I+`X#NLYH6q>#R+Jwzn5Ppl#}4rKcx(O@`2JFH%^lQBKrNN6V0 z(-Dn2jE+U8>FH}e#iyDBq3j4POUJp?Pe;SIX+b*T*kAzOShgWr$NWD7tJ_|&$T{g3 zK6TL)km3pGS4Q3d(hm{K)0=$kqF2XokcrUJ^a_oV6HAeo8!C*_PHUzNQnscW8KDr- z)^s$x-D4E-m}M&$SLtftcD0dvg!kZ9y5#*%H{Ng0r%ude;YFttTAbh@Lowz z|8fmlIZj0_7UU4zNCDSsL0nDb+9F8iGKZS9R}k0Id3b$PB$n)j^K$ciQQBoKmY4iG zSJR%-x!O1FTr_BG%)>iZgU9n5r(g5W32>3KQv07UY6Z&7qHmh4EC0)CEc*7zy08%K z#7&FxLho8l!zpn%9VZn@W7GeJ#fnXqV7paIFlT*{kg#F{-)bbhy{oZr{T{2uCj~FQ zbqtCV`&MhAd{T{l>l`Rd_@59y)r1>yLO=*#Yl3T>($}Nj5j^e@6^|m=-rW1wqTR7G zMWd?m^nNs3F{$#n#E(=LC&;2bmONtrolfw*PEh+V2||V8JRj|~F3S9Ifz;^&uG1#t zR6?`ovfSn5|;2Z1aQUmlR_=7rmgawz)N)DpJzri#o#z!1+<3uD`^n=3Aj}kkw4V?Nx+yLc$_kxTr&v~N1TR^AgcO|BE+I%(Jweb- z@sLn{OZ1)7fA<|UvP;6dx>`b0v`x{D&5aCP$%0su$aR|_nF~$v9zm?F#_gf%l;ZYK z>>B#4S<5!^g5&R2Cp}=BTAj~7Ppgg=_!UaO^HxPQB+J>=Q?A^qXc!kVK3Hw*&C%Hf zBhhwYpErm0#nzJMRX50PzfIA8tDG^=iC+yQufx@e?B#D$bbv|t^@xy;fK>lBMF*LL zUylpvC`d2ersxop@aq{N9Rul&+Y}vU5`H}|q~jocd7GjmOv0~Mg>(X>S+^-V$|U^C z7ShS;2?mS!^FrZZE*-PhCuviit8VbF&$;U8#m0jCD6Nx+=|G3GtThCKwZ zAOtD~s%6G=_dPfReR+fN3g?#E)At!o(9xz9(svmZ&*2u-8&eEQ&CUz9%*~}C%-nW7 zPHBG%eAJuQDjKGZ8N(X8s55fZ3UALqRrUp6PBAn-0jCVa$sn3Vi{ zb^TtzD1m>>Am{4a6ipU*QHJNxZHl(X6D}0O+KdE~rKN{Fnf`!3O2@6P67u_G>X6?j z6OxSyd>ez)|e1tW<0x^@J7s0K+WNYZmL(XM!R(P1Rv( zQ6>yH6xq04z=hg*BR*Q2iCMyEpq*!KQ&euMZmqv&dTzR1(K3_;!KsSich~3Ov<~<> zBTT9#c!?<6IU^7r6oN#Q{UDH*(NsuFwTu(U3o=>?USwPZ9$CF2c#&aDgt0*I3qfQg zgFxggce|pnkPc;fYTT~qc93{f{k9N3sKI-^6+!rCyJqrJ_u1a;c0TESPFk-U18Wdb zN25wMb()^xC0#(W&@+eP^ao1z*76%1L@)q9S(})P$dQWunbAMOMxl z6HWS3l-!f)d2XUf&rXEHOf=~~%z-X_kZ|nFOfO!N96nVC$%HN)p>&M!9?0ZSI#swZ zv?$gb6ZNo0z`P;$BOnhH{Y6DoC54-&T8%{VpB3l3zglHr4?_>V{ z!oQ38PXfoY<`L6%fcm-y&zi?iPnb1hEq0pF`_))>EF5#V6!_)e9MY+=ydH!>|qOYbYO3Axj(a-qN@peUXA&}G5lQffbn)9(V zDbp1(YlG>Co5;SUuuj&jq3M$ScQMw<%!=5NC#+LyaO?<)zK9*puA@!rB=mVTJl~Br z=@_#5akNR-IR~s5eJUJ_YUm2=EAVf+0*B7{O9hS=`f6Q)ch7*HDOu67LfESnJrYy2vg9C&+GmzfwARd+qUnh{c#lXT(XaGO_B`|r&xn{a zHTbg1i!)3OxRqRWukuB@UmvlThRWffJLr7L{(!=BCnXDjmbEUT!=Y_1b% zRaaOBYOP)Zg$YfC&`%S>OgJ{uq-TXNpr!{mBtDB1{wstLn$VvKkkL*EBXw3onSdtP zK?p-@@}li3CS;XX^u7>=*W_2Vw=e-Ix(i{qPO*;((5kl(HfiA}nE>J63SqMreu)Xl z>PI1L&{>tAgUW~S2}0PYg{Oj0JRb38zgg%H`$BZa8gA&($l02D)P0t_gj#drUE-fL zF&bz%=dYsyCze@fikLrZa) zaSG(ntbc5zXM|T8X*Xp44~2Xt_#7W!`@{0-qJEU6i~3O(`qN%W79V34v02VqKZ{xV z3vYks{SIcy3(+@O7+$!cGN3PJDW^3Oam&IPEfH}a zo&ArM`HUoz%6t-15^NPKYpgOaSj%m?Hs{8QJXeaG7ovGwKhMuqgmKd^Ovs0NXfrR1 z+P`Eam3E;}@-0bmr@`jEoLM>$5OCe-}BR5BQ(tupuj9w2?PE))U0<9U=+` zgm-He_wj|og(zHHll)FV4wgm!w1(TY=-pWchV(V*A`9<{!h{P0bd|xra}}lKVaSiq z8FZ_~gKqabvkgiu!j1UvYr$Uz&sF3e17s*fLu2+4y9PRJl)Jnf2{=I-^;5UIxd@Bq z;Vav7_z~YCy26Q$feAU`DF^zoHr)A+`HI|i<{FeL=hASBly20*G^f&h%#VE?qx1pu z-Vfeam^a_&3sE=5HlB|`gZo|J^`pk4YNKgCJwNtN)Tr8%LoOn6_X1CpR@C0G%td*~ zZQ@)*zIgnbFv&9R^10gWH`hvt2W#hQxBts}!4~1&R*U1oZs9^aU>7|o^v$)Iej<^M z7aPwB{You;c*8bN%f4ER&uk>m)6q5ISTY_axGm15=S%kpe61FbVyn)J=_-evYY6>% zt@K~!W8de~879?_=S_MouyLGA?>;{%@JF@(w)@;h(oQncG1a5^XdBJ)RY})bm)R%U zuuTwe148dpo3$+xI=>!yX_!eL2>r{y%k5DtH#WY#XH@ zuzAQphx41~Yu}kyTl>;o0{!0g%D=^j#f50~R1Cu|3@jbd4NM zwCAl0{$@{<^)BJo(ig2N0dJK5N)W z()?IQ>(fHu1$DUPy&^KWk zv^x3>Z93_zFITPUG9uhnN00A!)j@Uajo0R`Iu{!z z$KG1n#ir+@Kqu;S@Ve+C>Lf2jf7C(8TV^4;Sbf;%VjXyaXQA}7V??Kmb-15x0zCTJ z$%5y8_Sp$0%@V|kIv#v1>y?G5=J@Dcx-fqrPj9eg>hE*3qHETtG8X7n*T{$v^{NZK zb07!tWuavIRoz6JXe$)wCIjYHblo~2cKJbP_XB75@j`4yMZHlU(GPV|z|$zQ?ze~6 z#eBh9^pA7Cl_Gz5U7jy&TJV?o!cL+8RF~%q^%lkE3kQWTsxHqL{EKA1a87b4G3T=_ z)G;R^B;dGAnT1-KOcMqmbA8F--i5m9jH%0`$m#-qo+hKn1Y?EtvjE=we7a$E(8KLn zbqzgpnpGEVl2XII2+ii-BNi!g*IlSrZ|Bs7Q_W+!@w$`@g8?6XU|%Y=x2~>s!*!fu z>7rOrS;v{O=dG^`&s)1l@j-^ob>Vs2VHTWNX(T1sUYGrBKk)FgW`buwd%{xGLJ-I5 zdS15_od6>qhJSvcK^a8!r!Bq2!|=s=N3z@ba&(n{X#e6?ZHcpWjf@;$)a%dpK(N8HaLztJMCE{9u8ZJ!YO zsQY;>>IhPD!e@oBMkoAFLc(Hi$noWR3-hCow`|e)rBM;;G`gN0Flz(<|!XC>;4t*38wWs3^S>v31|hNuwlO5POu z%6eS3jzZ_MVW{!G&?nYQsIczBl`sT@L3<1Dqm?j&9xdz%F=*LBlcosow0h|$7n(%rSNLzKMYsmYy3Q4jIf=S1`Ma*@Le~iIJYDWx z!i91dSB;*5>G~+HAL?SCB352k&q&QK42NlJJAb$L;8NzfaE&;JSU$;A5gOO6Tki(zM2cu&{kVdpEq z;>f`Wlin7*3_EkR_n@R*gz|?j$!DTNyrf?XeTSxhpFmHjV+3Q}*q)F0!qnA1Ln`-5 zJtM=XTOnPkhwkZ3ROgSsV8%?H>!Zd$fHrKFMI!8KqFI)U$ONUCX(aliioA}8G*AjlZ zYyHZnL$c_T24MRgs`Bf2kHkvZfM3Tu!3123Xd#524Lo?N?_$jJUJ?9$eJ<3t7(*(! zq+bYfO`=qsP$UGoCQ%LqExfBxKGDKcm=d=jKO6~r_pncq^Ej&-=yA-d2I$%|7c0uZ zNC0ph7d2TNGv}%Xfc4ztOA)fB0na_2T`Y4CAAVr&5x@`3J&GWo$F+kb&4vbgb~;Sp zO%2G2(>r4Y-rRss?|iUWkq4)DzC~8wZ#HQdevH~|(m2ku&SsOAOPZ|>_>|C0q`@hn zJz&Ktp=0=gQ$iOw4OSWtNt*2qc%{);0%K!g^1KjsG>{>s^YjXnt_yZ&15cHeCf&Y7 z>5uF<78~>k5%o98S#zaHW#Vvpo0Z&Cyt>k)I|Vzy^z>M1QUw-fzeH52m{9u?k!Oh_ zPs2+@wZM_!vs__$z9@ZSUoXCTw1G@#k8+JXv?NwTN4W+ux6L8|bzH;?c<_mtb4!YE$dz0@wK=)x;+4g7ISDKo1+Kglb0&}fzcw7{`mv3OAT?M2o`88pW3&|pnvKE zy0J{KfveF+cE(koa!fpWe@NNr`}wu$b%0~y$z1P=^n`s7SU(+ z(bCxWi~jpr|87t?FGRGT_3s6+9U$oYEud%&8n!g%W&62kSTs4zd}B~99ZwHDaQ7q0 zG;Jw=W$nX;95LO4QA$6ZVCF?o(mhh6t}$vIP+a7hQnKs1$UB*Uk-#D$bZM9{He9(_ zcRqjV@-_-@*M{8X?GsSCyfXq8cX^iu)2$(QdFB$GYgb!hD-=i2rTpC9UVGkW4Yf0T z))0<%81{OT=(C0mkGbd!tkRBpH-srK1Bg-|2FzuO-0mgZcTnGkaGaZ$q1JKs{>~-3 zZGPU6zg%z^6W|UNh46Jlc83%uAVsPWzS1eGGXWn+%MwE0hMrz)O{%+05qC!qgQKLM zcbX(+Q*n4z%&L1FQl+_2C%~H`%g-lmNjJGAF)iuADKu0`mB(b zH{||x+%g&2y(D<)MyDe~wrX1;NH@A5PRJL6^vKIWAePZVCpdy;a+2%i#xg}2+9l~^!={fU(@o1`m?wPR z9AM#n6@le1F0?L`FD=l?hKNtKmd6_PN#-Q?SXjOtoo4XS<%-gxbcO*m_&@kpi{*;k z>%ho?>mt|qt3VzBvLHm48e;5L2-GE@@+lDm-zVU^6PP?2 z@gUr1pl0J`lIlx!i@4m7mq|u0S9&%#LjI5>UP z2%X(S$giz0HyHL&-$pYYNv79<$@PaL(Po8#Y#Q1Kuf&c+;!ly-Ps19)=CdH%Jq##c zAcsbAZd*7ljcbIj)b9fjYM)2r8=bD^qLV9dCcSN8E=_FoT3zg*=`q8KnAIDR^Yx)7 zZ4`KDBTrzcNogw;c{&U=>FJdSap2e`9K$uof0=-V&qG2O)rg$NPbQrgcxoe0`JYUB zW2K^$sy~_Z4yOP|sb$(XrfH7PV;qCQQC#b3={UFFq%hZ$ne7d{81_eft$o?Sa1MQG z?`aqV3yJ8AVPv$$zXM;nXyQr?f+NxPKw$Z6*2-8zIb)#mDYb2w{xB9k?V?{+DoSlz zL}wXV1t^e1S2)=wKtq?7BIj3S72UneAgJ(%LC)DY0wwST!?UBT zqCZg>X7mW*tT5ITSQw2}F!6!1it5D)#PGucUork~t2|c})P{-BSN6qXnVvSbOivpu z<60$_$s+1$gK2J!VQR%NUfK}TF;WJ_UkHEs1%ZxCVH%`#TYA0}C+dmtt z2>wHT?Vq@{=Szv>R8J_(_^am1bEZKowU59n3>MaUtq6N7{DJ9lmQyqW+T2`D(Tuf<(#w}aXV2+2311gex3S#` zaB4Y4hXww^^gL5e(J#p7rE-ckL-Icd^88@LM_=2Y(T(tXlY`XvCW6%OFy5ncOgbak z4mR~v?@xh;ntz+>CG-*6O&{wR4ST5{7MT#7f7SwiW&y|6Dstagu4ivFntlG9X3_DdMu0UI%l<=bi})aXad7?~$y_xs*3s^bB_`qvWk$Vu5kTi6E}~3dFc&~PGOuKPTduPXPy_-aPuA;eLQ~{4|=OA%LQO z8pF`!b&A~gtibvv5^UrQ7YoZKhE{{+5wQ4aGh=qMf!xmm$1&`X*`}I{&LCM%BuXc^ zxL3i&hWCr1*PFVl2noE=9N1^;s{CdX3-*;iL`X*j7OtGC7X@v|i%a{PhyYw#Jek7tUc4p3Vy# z3t!g-j)gDBO6`3UBz}|;c#Mu8#~=y8>H-R_N7nZW%Q1fHfi)I0$h2sJO^2SQCY zC(SOW=rv*8X?l8=QxpK9xM798fgHY)_>KLPWegleL{*Knh|iZp)&F=TnaG{Hl4mDb z@ap$AC`!$ytT$3z)B_p0gP;cJX;8n~pePN4;zz4z;(F%Spmn5X@XN8_)=Tz3tuzR7 z5?}EdzfvzWBrIQiT~5(7VXc`m5pi^bqLkU?6sZbpU_{waXVr++*%^Ygd zYGG@`s~THG7*;i$Z!9ZCdxhLA<(p-t=qxAuwVa}Jf`2^yFmm^tE~n@^Q=yz~l`cok z1li7wqT<~fOT;e(EqpYrwKtFxETC`gR}5|JSB#7>(JL@m)s2c$JJA1NuE#ejawo4c zD3$Ng<-okp0(UoXergBAt1N?O3zbEe|0Psy+h8yniH5x)2&Dn`fg-Y#?EQCwAYCQZ zB>7tjD@wIi{jEx1s|LdQetPd^rHI&K0Vu+TZYtCd47T)Bk_RkZ>~kd)Ywcra8;Gt2 zUeUwQJE(0Wr%#Loo&F>FCAbNy*DJhVXsPXltEAL|xT_DcuN70wHuUz&Yy(sDB2)lt zGsmdj+(q4B@SryMT%M)$=7MG{D@E^!$c2fMh_Ejj?$k2ySmVbVH-Cn{vwvY21IG~2 zO-2UZD!QrbWfzUu7@H5=^mI+Ml8+%E8ut4lR2sE91yXwh=?jMgK`H~bO%P1Zrb&vv zTV)V3z0LDVlA_&ANa!b{{_OUV=Q@Raa@F{I)&kC0fhW)vk{c(};f+dH{P0x%r)zqqfGJ$j3nWcRlc%NU1#^6D3-g)>vOSs21KH061CRQ6-<<~A z4;TjPHQX>V@`#2T0~#mOMbv>mkWC|u!Y0X-yh)LJDU1>D6*UiJ(~m~aCdrh#3BmSK zIYkFVjS&Xly*a*0Z<~IuJh*#P4}9c&5| z5qVDDsi^rTMb1_8O)B%77BEw#-?G3Y@|0g-(#twE^to43Pt;;kh5d7txR@nYc_tY3 z=XRnW?B9tcW*OM}?9jBGH<0JcA(~}iT;kuPD7BD}9?)!K@1w~S2F4fYKywVNMs$Ob zYW{{JJ2cl&{aiE`3OO&`si@v>x-_%3K8+LfaXxdGqNjvDSJPW3(2Ko_CwY&B!#v&@ zVt-rL+hN1V;Gq>AHY!$j(UMJ=4FiJ5ZiJ3`Av$hgJ!n5vd>Ja{=FlkvQ>PQGBL=4b z6CF+(YHB`XbTB(O`i;`~EsK!hYJ+D!h?!c!jTB&`A4KyQY0%7-?_N zw?=cUU!}c~760j{Z;W^9xroyIS@EB5(PjfnWt3JxgN#+fT|`bi|29R``_9JCzpX8) zR>&KU_*xeRqW%KkqX+~qc*7C;(LPyB^tEYZNMj)S+JrOjgRSPmRvqXk^LVpla&O^U zBBB){Y@C@;^jv?yA88lQy^Swg7^0u-1Ek7-GmX>`tv1mt%5G8Q?0c7@4U*AX)3f6) zMOA^1Y&B`Sxc?C48MoD>`yn|&RM^J_;*iz>CHdL@iCB88$xWANE0?0#7Devgbt(36 zDGHF66QwvS!hbhCmy3VLVM&$z)p#ChV>o!H`$Ed&BSI0%YnBy&Q zbfAF>wL1Vg4+JJa-zh8!jg6)Gj?>IQ8XRnc?Pjdj?G&F|u^+ih(P(>$G0=0@-HLtz zpFQPnMPuw$jDeokcPm=OxL590G}i7h272DQThXR%u@3lW7s^UxKf27MarQFCKu@XV zChd+h%yS|B64~c2Gikj2PGg{F?=q7P#~GFgLvh6MMfICvxgnZhFKY}eg=6l?GU7U% zjKD{!xgk2jKhHqFc;dA5a8W^F)Ys9I8OGT@nrM$01BVk)Gb1BhMAYnTRx+vWikwT5 z6)jwC5QtClJA2Dk8&sKyD)2LVrM4@W>}V-P>xJ!^bbZ0--{r~moJsbt4K22nQ6*eN z&q8Wa+3kwl+fYvh^fE?ERUyKO4aq|y;aNWGc4l>K+$cA2{uJ`_JW{wJshJ`hC|KfNGOeE!s0U7zUAlt`~FhmN^S6{Qdbwybirf=L&aO#SfH?~xT#&(Q3__-9 z9y|$R?oh-f8Z9dKH$10?nB?98Co7?pSbeH}r>K=ttX2lpx_w7UwKAaAGdmQyCqWfI z-H$PFM<5mfkxliW+7~Q}{bGmc*3g4ncm1JT#i1r07Tvnq_-lSYaDo!L;rYz$U_pUD zO4IE9MZZS+0$L*sQhwfn$PmgRYJ`0voRz3aMk9^^d^;? z0~65AqASnfW&jhdN#7diYSse^a1#2F=_i5l=I6KR6v)P)ihklTc=9eqsYPCYw6)J0 z2?l71fwxv41vZjLHw-wzOMtTJ0~>s#Gl2H=p$#?~3m~Gubo`MGyvsC(w~RY8<^(Wr zhNz1TzGv)Kcy702G(=r(nNKBCc_6aA5kK|dZHPw%rcYSHy8`;!6lQ1pA`#M?O;cm& z*1mk)p2iXceaagz+dx7cw0w#_pKSK@90;ps_XwCKSxi*B1KNKx2IiNK}{ zGs7Sx$p9uuJB-s+T=b((vXhfc0`LayX5J;>eGa_sX)j~8a*pJF6Uay&&1Fj;1J-?2 zt%ZbcP;$EX#A8bUa%33ZsTaHvW3h47Uve>I zec>p1r-4%!N$TM`_3N?J{#fcC|1EW^VJ1zL)QfDM_lB7iWu-nIX3{(%EVX&24m0U} z=RnexF6e~X@YefLR8vEPG6GvJcEau^vXV^PYUeYpsTv4;lTlcT%;sUdR&sO(n;TpCG8qZ zdbwoMUYzvr5u8VNwP}XEz7FGGD5Hvu7`{+w?MVanDXLQ3vcFJh?iCjyzxWt6;?w;B z=T?hm#&SDj#&bJka&E^;=61&9+-}{k5_H3|Xr~wb(RLh|X4$_tjDeGh=zSw2Li9c& zWyAf7^ao~mcZJ?Z57KtxL$s%nLHi zMaZJr_FDP?+wZ1Sn3mUbUw{!1?U6eY;_=LU)TaAz_P2pq!j=lg(b+`>hhfPR& zeGc{EPDdTk7pT7Eg_XMjMQAAZK$QW6gTW{bGoF4bneGQ1tx3bVvul1pk@Jtc72P66 z`^NB;DzE5`1Bz10l~*+A06e==c}3-gW0;ZNq`V^XJXv1R2qq(g+CrYLGuRr-zNo+F|B@3bd)9~K#1C2Dn?n8SldNlaAJ9GtB^Mt#I<->;O)8=KZrA)5yB3GxGpXW zyg%*)=1`N&O}fb*)Kzfvrs68#I=)NjU2N=~UmlV=9>{W#Lxynd);Zjtn8OR@6*Ut2 zcO}oPM0^F_*1=%Zllf+$uh2*H?ERB;)sD9r8C*Ry-iCHF@{l5F!sBgd!V`dqfQ*nd z6OeAu<9Xz?0S3?aMxr#68Fm2gGlPf$+{j^ z3=LvIEY)kPy2GCw7|Z^rt9x$yhKO2 zMB`ARjzmXU<_xG5qT>uK0?>(0Ft7?hTRO?WW~lam$ZYM;YZs-3aiQH*%#7U>%(xdq zI}vqLu-GwV9ir|GoCna6dN6PUKwJ8R0q2p#?l9tuzR;raGu{FpEwcY=GX_o}qOt}) z%@K|gmBq~9)+3le`vQ5UE(01{DIENDG?MAqCYfcp9o998TT;au)XQKtWg)g5?+N6hEKVnsq$7eHzeqX}0c9C!uPiu?Kms3~}3j6XR z^oxCKvN7;`A}Y;G_N7NYolO2CikzR7SG01IL7)hz!e5^G?>UOl?EK^&MYV*#tY`Q=imJ!>8w&qD%->M+kG)6Hqr!iO zXW2c9o{aIg5dM3a|7Fd;?jA)i2!A=x@p}}ti}C+g_$x4fk>)=S4&lGkQ~F*--D3Q2 z3V%iB@2mOC-K*#=;lImM`(8!EV*H(j|32oQr1>AbSJ9`!f4AqwdlfB=@%I(}O3c4j z^Z)N&Mc)a3dC%MTD%um{A1VAP%zsMrcez*5c;Uat^ZmVwuE+Ri2!CbfFLjLV|06UI z{(C)(?p0L&nAFz_;jhB{)inRgdlhXE{tBK$_bPfI#=leet1^Fc&42n{MF)kyq9?h6 zqL*U)r-VP9`SUdYZ50&#Dg5_&YE@9wA;xcP(f(PT`MYZVh7}aKwrKyX}bcRCo>erj*739H{j2vU+v2b9V)VnjBKJTgo=~Lu)X2WBg(?|(=~v& zqr-2W*^le9m`xDqN&|?5s40L7#}%=K9}x|ku!YlrMud4%G}IQZcbsb+E$CU{Z|Xq{ zY6gOH80tpw%{{+VQ1tw9MV^%v6y@N@_6mvu#}%aVh(J#NlN7Bvr;mY#;Nr`+z5kU>Wb86N=m;w(x?^`>4OF$iw+uMMZ12==T~vHazVrDthdMqROF)kl=i~ zqM|KA?qPTaR#fy~PB*@yqSHe7!tkuDsHoEkMJXF9D*6%}#mZ&p`@G>c{=9%U{|PTX zTpEth5_=P^=chKqeO+tynGI@vS28i)w)cm8v=pxZpkTk*4Ck(jima^$0bXrOzY1Mb z)P0Jkl}wxyY~#;s754cGLQz^~zi4Qgn{0Zed6Ny(%lRi1WuOfZZL-17H^EZwtvE#4 zp0@F*^56+YIQ9_ArfoJj^(hE)-gKX$TSbqpHc$2Y6kS4v;T4U0wi@&-5uLU1^^nph z<$6fvt@>&Ju7{BG{`(YFlN`3$JZshv-|rv1-GRCNP-YA-C#5NU8_TP$ zij_i80Y*M<9#>3OS?qP~z< z!bDglc_tWmJV-0--$+a9p~Of%6pSUw#DO@q!hU2yL1@B7F zgB-qsf7>?Qpg&Q%oOcWSx#DvE7At3^ZN=sMX9Zg|rIq%_bTtlE27d`-utKxl4EdgI za;;#9!nFo@Q?90n`yp`_;LUlXFcQ_VOIO({`%$HHo)9bh1TOm?6cyjin4qv}c?2LT zTPLFls`E3+bm^4B{z*+TCMX1DLN7UyRdb%kY%LlI(F}&mYnY~~8_y(D>S;ypdN5oh zO3N8l>ojJrT`MViQdFO%JfkWpYIIsr%9KiqTH?pNN{U`#)|HhMwGq}8%JWAhMY&8s z93_U&*C_9QQF_P4(Y#W zyKcBkEsitJ?b2;=oVjDW^j2tR$gQGquhO|av|YDm&JFZtLf>s^=`965p!r`)f3P4tV_!rH2CVq5#fUQWQmnNL=7LGbIB6acWeMxo_Vl4xxlA8}zvRRbm*ztI z#-6UvxUjI+f*oMj4_UpE0ApP+~H2o?|EW!S@B;Y>~5HilXiUZ?T+n zQWW*xpE{^uO-l#WU0^%C`PP>k? ztLzeIS8*7sau#8gXq6qK=sJK9Q&-s$Qy&G0puftF2%2*?))8tlxu4(3qk|2%4! zyON|hyOL0xvrr5Jh+Rog!*(85%R)rElHg0XoKGCG6_;~^y_bwf&c(7j$LT8}eKyg# zB$PAjydvi{yP~U7hD%8$HOwu_$qUj(JD#(I)p|Kaxn52v*BH6!;YBYeh8O<@f(O05 zoETmB&&PbdmlNGMrREmpGz-vIP823`9_K&vy?GJp>x50;1tKp*3!P{;A45Czi{>sJ z24*_hu&!M(!~Vsd`smIkdp9Zj7cL{i*U=xvxPZRkLz2Cb=iuum-7IJ9X6$Uta%!@YL-`B49olDH|oeSpp_BFBz ziPALJjc1Z+HVTf>ZXFRj$Hjx(CFd3KAa^YkD=uz=losAdd)j6{Dpp=Z!OAXr^n#*{Xb>MRqf~fI3m|gC!GdDci!l^Y zD&olh;>Kf;Qlr5FUjd~digZF%L0%j)2$*P)>Lcmo3yR!_b{Uiw?BEOM<_C)?ohyKx zo%-46!Y+fLVFS;=el|M5CVzdXNwizzAN1hKjFT7S$qeHnW}YayQy3CItymE3;A?~8 z(;hqS6(Qr9rY`$T6NSI^qM{7kv!|K7bdm~~%RQ5ic02?)+ZzHMwrO)Q<~5ohQ|K%* zG&6u&aUeC@8-fWIn6OIrMMYS)qlGLd0=?t@AJ_AlU{i01_S$!tx}LU)vfEhM&QOMx z-Nu;=0L;p6W925tmD60u))J(gR|NOJ7YGu2nLk( z6)CH>!F`uvHfSsO@}v)Yy&)N0G}*@+UJ@UF1}Tc2B`+K-;x^r+Fqih(KUdmSuA2sY zqg6Cabe%P9cL_JId__;=7Kpx!@g`8g{2X|hpn3rnC@hG<-vCB%xXwN|1Yq03+=P6m z2`VAqO_yS3zHZh?Pu5>;1idq_tnI#}ogZSqWX$19;z1E9^p}b~$aYyg$bDHnsGnF# zTd(ZpnDqt=9@azP_^CJ}M2`EI5s_oO5C$kV>-``UTa!DTP%xP9#nE}%Z^tKCs}s>e z!_Wtq@e?@60yuvLg44 z-P|K@;45xhfmsVoN7~3d$5b&4zy{-J!iVV{o<*w5JvF5YRw$mmFPn&m%u1+7Tm2sq7!ee4RC=M0zU z^(%^;d$*f(Lqwf1JlD6IRCGmAihYMkAArF((WJ6_3{(j1usrWhG^q#c;`Gii>7G5h zTz?pRmY}jQBC>NSstNs)E=3G~ah33M5IN{T7Ej6Z|IW&BDAGj$mUNe=&3#{cqW938f=lbW2b zi#VT)I0rh9fX>=4f8k=T1$G9o9ceL_Ayg>J9#g52f6K@XB(|X z9)VhPf#sb6)RC^RY3{wQ$o&8kWK&lY4d$8a3LpA;5jY&yLiqAtN3;%k^L*5gd%n+s z$Peb#(#ZbYv;KgT?k-3e4STbFG{J1L+(mPNc6P3;sNY`Q;`^JPZ!0U>#ss+B5FrdO z6Rww!+8b+A>9|CMCEELrm^4{<2b!LyM@%}wnc%eFLLm$`xk0Uv0d$^M`!pGrC3t_V9xp}Hdb#EwrZ0erhbq*yy_E7D2y*5{TZi+8_ zH4t9;*u%5PT>I|hlKY1yN2gbjJC4(~`aNbz4=fqfDPXggB}Hd#vpivBo1rHO3H@V} zqt{1B$%IZq=&1>xf$$fn=kDdGy{q{AY7^(v+7qod;pP2rU>hSuYj{WUS3n(TEss*p z0tnDL_O!dm;?E`*e`4AF(eF4S$sTr)J*){?MDD&oYq!5(BGA7^7QyW=az^h1>PS~j z#Qc$Dk$V~vWYfnAZa)Wkkb60B5&Bxe?Kgw#3^2v6K7t1;=a`#)!?{n_^#SpXG6Eme zzH!$+U9)lDxKHSZv~S!%PV5_LLO7y*<1WL}zHz_gP{KDJ-52u>{z!0L!z%uG6mA8! zmPFzt4;vQR&))4O{ZGVvt+>Z-Zdkg$yrU>cX(MV~9Ry_;bMeYj0mLqQ6bIw9HU6OqY}JQUkZVOiZ3G zCtA^c!@F!yiF1m8%L775`; zi=2;)G-okpq>aw^C+N6+vRHhMWn^d^&9R*4UG$`B;c&N@cn+KRf2KvL!M1Ni zXs6{l@1l_$u@{Lf~eF9iNowi`wJ>V;S z06llxH|UIY?hh9oLteNw@CR?#UI5tE8}ZRu&c#p`rH1Gt18x9$+5GaxbqkeuhqB0B z9Xa~x2J=)>Y+UEi%8Ke9(0;ki^31KQsE)G8v$C?HSCmC5n<^{H!H+$a6%`;Ar)eZ< zKD2Y14zV+=tv6{dINGc?X&HXJzTTt__~Bn~(n0*_ zu->FUk@&A|gwH^ou-DVgqq|)nlIm`cyzC;=O022wb~FaJWoe~f5e0f^rEj+^VioVT zEYciph2v|@ks9Nu368(&k>krnOFfANW=sl)h$cf=lLjR;8N!-0u`F`uqaJc-q<#2* zUGx+(W{bWfqDN@a&&5Q)7U$?J96xG~+!#kN&heRW{G>TL#yCEVbMzCApEbuPF^(_6 z@z(-I3Uh*a5jtgmPMdnN6mT*ZaA1i7PUZp*M*)980V6ccjzjHZkueu=tcaejMNf-~ zo*(C!E*vv7$Fdm5I&cwHtp)(uw_Jk1{hK^3eO4cD@U+o54$#Fs;~mUrNe0^!Y( zcD$BVzHC`o>ZwVF<{`e7kxiTJxM1qCTa+5f;|6<@^QdaK$i0w@m`7W|jZIL+OD+1;WCoW*lz2J=G(Vv{UBXCY!-@YW}KVawk+xCM7U!RO$?=Evt zH`J|~en%o5UDLfn-)HB+U7vWyRfKR=C#;{C5Q3Wt{gS4)Or)b{dr9b*?R*h@fZZbQ zh;t9>e!Q!VZ;p?Ez=VpzIxkOK>5TonjQzSebaUnXB3XUyNV&C&qB}ux-cvV$+C zR;@Uw$9O*)o~biT`VvZzGq;MO4U%G!!}CEEMZ=K-LH&2ZPq1@{o1;_M)|qr#C~F*^ z)O98;by$>Ma~(R`kU??$CyZa7gf^K1LMR&@=XadLX5cZfANakF<%A_`8v#v>=Bdbj6!G!*n zqW=hCNs?!RrKpe7(x+px4;g$2cZiMmfbtI+{DG0_PETl#NrRA{$l1S&qC&~xQj#9l zbQZX?Q|I)lz&n#Tr@kd~n#nowc<4J}9Gs-j)r=JQ=Oj;`3np!LTI9jen&0sQr)y3i zEf1~63+oR_L&caS)DswXlKRVE=qw8nw zcI``}oe6uXdBI538;;_!oZJANv%jf%COVCbydXS+COWNF$yC{8QATbDfZacGQHIN+ z)Z73~;!W=RT^2cKRZ+B2l$_!8tgoWzQK+=DilP?yaj=S_7hD#loT;Mdza^E7vPS3)%CXE2&xARRZC-}8a zjw=-o$KncU0ab;*TMHPEbP$knIOdT=&XsFTsuO2SjQE)7^FDW*kT(#a3-(L0LOIA~ zxSJftkd_ytzUSTNnJ9lNV0jJp2NxF0_W=1ikP#ZjJzosoxU-!kj4}`G!dddnai*jg?@Gs0IGTM?oIO6}HHVtCQg~--=^KR$bH?Ikk(b>x zSP&|V!n9!=kkBSZT)b!>B@3jdT}CRVi2+|uG5NX+4|WbtMySp9#%U3{!Gv)jcst}# z&t&k;g{^kMRw4Qz86R_4f>QCLZHGnCzR4-WZ&kDggklZT(j(FKJZ17^dc%25Iz@dE z`qTcjG4MkodLllZdIGbl-;*sFaXo>C@$cER@P?XWHXQKg(#+%y!;LYhNy29bi+mZ2JZouk$`~+I!)@&uT;eKFekPd|x0w>pcha6!-&e zT2VfE~TX3_{s`Iz(0$@I4LI67Um4N7P3I?kVsy0>7`> zUyXzRY;t_o2_0+;Z-_42m%6o~1{rZn4KiS=DsGE1_$4~5guoun-4E4u~CMWXEsydj!zOmCG;*HMA)Pvfkh zY-dWjQWzAB1tmo14PJ;TWs!R^Faf&ArF{iVy3Te^4o>q3K^SE?v-9@W0I((v3~Rnf<#Eb>&Us_2JOmR=pX<)}ev zL^RXIt0PO06S360CFyxBbsdC3>Q4NC)WhIq*80M_U9+AA2UxG;2Uwjq!MUMOGhscf z6}s&vQRx1gM4^@?6?zpZiPvjhlB9ncyk3(B3K!Zdgx{qJ1O?tH@Vf#pOMKxo5^W!B z`v#6-(G~l0L;HPqn~@5~`Hc6sy5EGwuV4;+ZhN)Ai+bN=k-O(ngZR@9A^L)`V_1z5 z(@p9lVg@EY1dtsJWP9;2vOka)p{w@mrZI2^5tTQv`%P57=CjE(>n1Ec5S2ea#6`c} z6pL}?G03D;e@;ib2dg`^N?VkgPxs>Y%lMrgEDS`c0^kC`5xO5q-ofv-bU&VXo?6-> z_xDiRPZhz~vW$fty^3IbsSF%*9HV>Me-T@kK5(2Cu`NVw3y3Y`%xV&~fY|pL z$`a^nhH42ko}t_V1kF4U8s*2+fGCOCLLa5{oXk;Vdyunk{FMFW!MI88Vi$%yv)! z=K@!74-^3yqLns`8M;9qoD6$G^jTr^;B?$zXoAym6TtAmWRoJt5>LmigION%DVW>&hkfPYUVQ&%KLzkqxW1Ey@Q@kXbxFk1~(I!|AL z+$OF8FhtwABu&a$`kdbqVZiGob&5d4#NoGM+iPvlChG} zPF<2AU@R^Gzi*70MN{rDdpNK`hOP{su89zR&#w~CE*Ep>?@j&k%zNQ1GQQ`Vt$J;j zhV!0qxjV5ZOdFZ)J^+OQ+G=7VR2@(#SmX=SB0kUX7!U=tmZ_}(_`+e@Xzr`yqBriu z1~MEwKqEP`!WhFyX87Pvxc+=_WYc7p-4kin0u!LAoaU=onyH-Td!!-vHn8|<9V_uO z(hR}LLlP)4c=+r z4lv@)^%Wn?y9y-_YYp@p(0ANbqH*8~L#Ig8SHPoc>gl-882CINq~?1Hr;ix~@QH*< zOiORZkCk~c`D2%#Ixd$n24d*?Un3*iPxRlf+9Xq@yDX9oIOD&i+ay!%yDZAY8Xe%u zh%FbPRw$eDo~z`dhwj1(4;58vlT0t+w=WP4ccPA<0RBfDt{L zgOAtOqQ~`^JV4IjRTaG}V33@%&Y9Fr!0v|g$~lw1Id0HABI>|NhX`?r1FL>to-=8b zU`s8klIKzb{GF%~CI>SomP1+!sK?XTzS&DWF{G;L7 zXek=c0&4tZ(&=JCi=RxYS>B?Qmwqzo5&ZD}WKu4Eyz!GspO#0v##ZYkNwXkvsP5|+ z@&}}8o4)!y+J*|7SU%>qqiq$Q!)ei6_86MN;DYk#6~lQn#mvNSPOD!2IsmE9M0uc z6;(Z<-C?xy+^DK()jhHiQRjr-h}h}ijfX8rK+dkCO?pUDEKup+jW&rqKaMtOAJgM8 zAT3=N3=?oqX4Ka)+BhdCOkX&9+O%z_TSi7f4$*WAg*r&%hZ2fo(d@b=7-UZ&)u77V#n+q0N6FHY9DQYE#xNPx<6dM0kYO_LoD&#S4^SvEm zEo_?IzyXM9b_9i1@qDN8HXN@9Pq*LI&qXhzR4<}bxqg~yzy4e@wS@p@sZ>R;i{u%0 zPe!Vu_Dr}xRZ%-3%&~i(PgNAX*P@iyQWd?6AMH{Vb;FNHs-my(`9chfp?6Wy~4I(Bvcx@~n#g zuyPa1rYX$&w?&t<4&Hp4mc#%|g78s=J&#AWD z2X(TkKj**iJ~$k?7l0|)o@OMWXeW{G1W*MbTEUrLLNY!qODmHGKA%jgl11*)Ck;yV z(dwl6&nHvWN;$lblx;u+Gm?6;(T_8*H~E&(Eof9%MqnB$FNxLiePU&XY`f zj0res^{5bjO7d)(WYRO0EK1os$)p#V1A(!naEz9Xla~aZlBAza%oTWy(1QYx75H6& zXC@J=(o^6ST9vje2oDl}BZM_c&Ou{L8hNtBgTw{UZ0;D7I##l%^3pNb`_l&sr%1YO zx(J=Yh$4K>Ib$PWk#Ou!(#tk01wJe)ZWH*Jz=s7sm82zH5coSS;hUI*A&^kq3J^U) z?ejw3Xgm7SG1|~A;X^04gb$r)31ce7Jo-Z?2a8lcb#~rW%|)v!VPxkm@X<$1*<8ue z%BoYkPCs&Tb=)N2l_VnW>~0stM@|nqyFZ~EIy-xcMcmm{#g8|BGO1Y#yeA&|pe~OB zzH&?uU3+U?d$X>&DHzfC^L>FJQEw;O!xt$r^?S3DJq*ecWF+U;STpxu7{H9w}EPqf>wwOjVD+SQ`|jvTGs5v|=3)@~idMzwZFSi2({ z6VvVpYxhT7l_RWxbOf5H4V5pdoY1OVDXB^%>I=~~jy2*@U0p^-h^VUzexj;a#Lw7t zb=jM_Xb?aIbL#3E^^%K50M5m?wSj@VjIUx54iSXN&^b_Muswc*NU4P#^s&V5d}Vh= z6|`&ml!0XcLfM-BC8N$)vB-HiRZ&C=@VU!FX^I?GE%GF#DS8|~ZcS6vx~fGf_oOL$ z4L_=;DQbrwwbK;6g&z;5De77ko{a21m+ZdQ+4Vv$$Zi9EAiLd2gY1st2eLblAIQ#; zY7u9bnpz@aq^0`&N^G=$g_J7p@N2&11f+mG++vfW` znc4gqvAjss8!e2`0LKB-7+95vs$uaGEJW2deeR;Sp%J#btKo#lmw5t?1TN(#}EAqDYQ7!~h znnliTX^Q5ZG6?!L)ZhvMpCI0d-6CLXCr(ElJf(Mb`(v*gd#|U2oW~o#*My9%SAHkl zep=`4=V!uiO|vL{$#Cu}<6$=K|2E)XUJW1UsP#{;hF49q=P?qd|_xbR`9gD=COdst+sS40dTLNr>%G_Vi!uaF3AnH)bje8Fu);N}A(~De#?R zuAw#PP^>`*XwWRpB3*6opxT~~DO61)7O_J0MPj^S8VUJbu9)URhC*C1t%UqOSBwva z`v0WpU#jE#f3A+gf2@x8Am#t4_X2OHw!Rm=?R`%Nv)lV}XfXORcxD$~{MAjTivgp2 zoEB@pUHCb6(kB!87+9|Am1dFqrPBs~v7{f}Y{tMvMAXR8 zdjXBGRyiY$yWTvaMwpo|jVs=$%S5bHN9hs#*aGp+aVAAi8-z?6d#a5yX)o*j*maZM zj^nehn{+ge|48sn7=IS{VlC6sqy7TK#lldIH|l%B=MB*iM^~FM5GDNHW@JQ(zPH`< zzKgCxG0m1k#`pXZBBe$nG{pAa2QIQa7CEPwdCglM4&Eg$y4*nm)^7SIjj?Rk>xVpEr4vA}ChF2if!Lm4&*UbM|;ZU4cV?5M2^ z1C0^-X_#ZAp$)nX$`Ea1=|vuk+&kfgfnX8s=LO1c$dSM5c|b(%H_2)9C^|0iVbgPu zN6{Bh31R2F;BOe*%&$v3Ml=6^YQ`h#EE?`e*XkWGjVe(($l4`+=dq{?G&{(el^F@u z;_fXb_hd$*!4Qpb{3_(J1BP+upUmyp4P-lfsXdViI7oHqvbd&nS z)P2fL0-w{@Lbierz02)qVo{aP-u@1iw0X))ii_Gj$B+W%sVaCePewcgEc(IC>IlOJ zD&}TT=pn)OQsk`aQPfP}uau{$N6}?u-(pbM<@=((7XAQ@bexuI`a$Vd@q!vV3W7QQ+)nhPcTG@DiI zmTpl-Q9E3!pUqz;90)|n7xo8p!1GNV7fk{x7tjkIxM(>bENIefRkyl}_5zOh-UN)O zn^Z04sk7NLr9<7sK!s|Uq>1NlW>jOKyg4~^oWVD%S>#@D21}j(0PRyy;LBrvD}SdJ^tPLHCOt6P+Ez@sP#7B=O4;pk)O_PR{quPtt`y`cq4v`+BS zUPp2UXs>&OAno;tSWLH9w7x%tp})ngZ(=;<6(J0;xFIivD17%$oz=A_$M&})!N0q@ zgyNqZFKB2*4;zS==aH4Xy3`@t6QfIXjeW1mc1s>vWD=EH020GS% zYH8k1ZGDY%a_DE?>O;4`#Nuv$iG^^GmSGW={MK4{L8%^~XoS{Th#QXs;&!;lg3G_k zu(!RB_VNRm?`2rzzWb~}u@E>%y?h;6@jz+SALW zE7~Irr!CL@>55)Qj@L(+bW-pO4efas1^z{U?S;<8{2f6COSR5(+BMHu9xT-cP)e+G zz6V|Y=86$dW_G^M8+ZawoQ`tbFb#IbkLyc^kpuMXdQ=R^q7P;>@XW#=a z!|m|apFocdQpfWQ%#{kA%N07jhD8~Xa5f1%72;3eeJqi(#?BvOURuMVbp0`A9z@g> z@>;v+u8AgX1sM|v(&Pq0UT2SCua7XPiD1{;W1pr2_9?+`u>Yg_UVinN#yGZG+9P*L z0d{f$en$Z?Os1W7#K5zFbA#b*A21l@UaetKs$TQSp<%pFWYx6D{oHv2E79Rdln!#z z2Wn!(;04-G!yQ<=X$rm8=u2zZx-xg2RBE1mNdr-f)}Sv%R+lb zbIcHeIBmlV2~NwS+ed|ArGrPewUHx=_oCoSj&A=aSQ*_u3OU51alcR|JO0s|^vB-E zI)*FlOlKTAyq$3%ytT~2c5SeT=!^r-6ag$9Kb>))=l?OwqRcRO49!EC_z>vxfv7*f z7!~#g0KolZ<>NeOxH`+C)VG2KZT-FoeZ-r8`+?F9+l_bUPGwo-4qrf2Euub2(Bm@7 z$F9{`ig#YSmQ_n!%Yz?qty;CjwLTNh-45-oUkS_}b$EnH0|ar^p~rAT1pY|&>Bb1$ zEs412pDOTYN!;^44MA|Bd4iXof2mZhcA+UFOj;`pgC*l_2{1ameF6_p;tnr_j1d^l z2!5gAsW#H2uWH4d>9P={=QA%RI@7TE)e;aVCTSO# zm;@IXR4e8J6WR2m0mocmViH_ncCFZCMYHH0>h_CT=Hes{-xUOumasCeyhjMq5^9!E z9!*xSMTws1}YC z(d8t}4yiUyp7`FRtGoez3qal|xW>t=0M7B{dppr}M$`eq8_uIENtjGNUfUvfuZwy) zaXep53)Ds^A1b)t8TTP@9Mh&s2|stnVjA3Zo?x;0h{(58;IHFcuswnQ z-)_N6eSgQo5cy6BLF|2@guUVZH-ur7lfAywpW2UN!@RNri?dhwGtt@6{?deDg;P&k zp%E5qvV>FaZcTwGX5cwSPRaIzw= z3n+mgPts}6glC0>;bKxkY{mj;n|z-yq(kTg$0S*-``Kk=z89`Z#?LOqK#8NH7}$s^ z@ARiZcxq#u>zj5iIu2A9po(ZJGo9C(!bYEpucdCnf?;Eux z#5(K9O7tytB*gw8oUsu5qre``l(6qv( zL(>WuLQ~Z`7G?N}R=6-UsZqzG)OJ`fUg_%eo{Ju?gEbJ8KSUduZ8-Sg(NV!mH}Li)9Ts$BL-+oXFpN#s{ZkKtrzCUW znv9Gv&*&%kSpP6wV2M{_C1dv4|3}GX5oId&oKXB3$yh|0$)!(PR9DusXL5ndtOT4* zGuayDHo~y+CeaojTgJLXm<>A3(MKA@!eoBxa3Lq!1rtVT5$Ash09FKdCzr15qKhaV zrg_t(ILoyCT=(N<^bnI42wv>BLW-&Fhw#5q7&axxIteUB>=NwmWL}K8>wZ~`NWUL# z4IRW8;n<_?{161f&Nl=fvvaA-+KI)^WiRUrWIMAnR}hAk$q9CsH@}N*Gu?r^MX>g9 zZJXn4n-=$5n3bPk+q?iBV2m`$@}xFKF7Pl$Ey0U18i+2%#&|>+F2#+3qCPIzE4rv1 zkR6Kptl*_D?8df1JbXn6Qs%ZIr?||1VK|dm<|v*%Yn;=;8_4#ti``E%xQV?$MBmtr zDtW#D4d646Nnbz*6e)b!Ake?HC)`hdM+EjSj`-npMV*CrfSnlrOyKYB!dye1*@eCiRaMc$EmbY$X(UgQ${F;Cp{FX}j=Vu{_WHX41%b1^q6B zs}`5!h$Kfz{txZy&@9I%rdDsLWmKtJ@LaH2eqp2?4Yle%m`q7i@3)9+X(}sSX7T+N zxldn4_Z{|ipr4p)GmxdOU=cq=Kl5_uRiJ7B?1RI{GN zPbK2sf3qvP&PQ21kZy5B*Au?h%0BU&(5EDt=(Q`l;U$;|b($-@v$Z9H!u5YyA{c(m zo87JzyJ$U{?P#kHLd-8?R0-=Zm9HwJTDT~wVLgkgMIEKU=S|OsbVc9Rv&gd}UD5D*7Ns0aS2Px!7t$5=ykgM9 zL^Q?ll&Pj@8WiTC>mVUaGh}^-oOf4KG)i*5XnJ0$rf5F$!LIKdVV{j{k^iH_nOQW~ z@v}|)*H!&7`ko55N?NANm`7L5n_fz$GFt(|24C^EQn@22Yk`lhv4t){a{FZ_EfbA; zD^_IPmEw0F{-Q{0U!Fe_^@X4Iw)N#lFzw-*jL%tdH5rKFxE4c^(H(BpRk8%#p(!$2G@s=6FBGahy2@ zg5z(>dUJeXn(t_%Z8bDWM$kj~jT&CL9mYSW)wjs`b!kQC#S+7koR9A{>8gOUl89mR zs%}w$(ZXDDm|NJ*R})$oB4s(D&raejncNKTDqtu1mspzlz-JAaAteDS5x#~ zpz*L~Cqcj9={&=vAkbL(_~5F3i4*T?lCyU;MIQ@ew&$m6iaN4>|EgXyyzl+11J}4A zGf!)m2kp9xc6re5Ysf?Hy(RZ{ocjo%YYs7~zn}~FvCOF~^q-|-^3byF8@}wQHqBzk zMKR4=TKHQKz8J#2IXPjXx1OuyqTPU_okB!!9jxr4Q;<8cnxgMT?%STV)fC-;T<6Ye zibllos=A`m51^9%(Fn!ruql=}-qZE;zE2#p-iI<74_L&~$BL8>3>N?3 zzl(W17!DRj{Q7@rOZ&orxTheltvBK$`hp*i$N>U(ZDWYHAHWln z{9sNmqv?N=0J%U$zo`#2DqUUC6w#=c;i+9+(LiYAY*by*5+U?9JZ-Bhngqf>Tco6_ zY?Wm(tMnB``?8|Tp_f*)FDtqQYCzg=BJFD}?NCW+Y3YUW!>yQ4HjdJA$1b}u@I@l( zYVi5iuEwHsF1i2-q3oJK!}2#ZM2iW<;Vi)U;W+#};5?i zYG_faKhmaCB-@*xPkZ>)kzNfgO5@99^rJE6oQuf4@hYAqDh%h*$DGrEhM227GSZ~| zR}F%m%MEfqvBsnm0&g=s*=tN14n~T*T4GVdzDO{?gD?Ja%?igZOPBeYF7q`m^IRzH z4+MPS0vx)hYpmlY#>N#F>?ssSYku9pOD>my$P3X8)>=J?6~laQ9(`gPTg^o`F-#xY z+Wz38%m*!fEhiKW|La?>7hs3{aI0vT{@`19*$=`H`0C&dDfj{#F$*;PlF#*0(B!pk2T<;0I-emIE@#6ejDRTV* zf23X9V^%rl*|f)WS6rU%3gyXq$l`IzBp%>B@Q|e+oBK(mO;W5@E2u^P=$VmD1+ALW zZ&=ZRYyYY<|CKX;`Jvd#{jWSe)W^!lOWupszhs%67i{Xy&&NBcs~z}?4l-V+GhW9T z=RL$%0`NT&TBq#z~}UvuC&fm6); z^urdVW#qd22d0t&-(pr%C;_o{`IIsBP?*S&vI%iT> zAzV;=@s}FO#ozwd^+f=EllX`0x+N{a0bsuP`?I9Gs60*2n{;<0C}D;R15tm0FEa$k zZye5x&|1fVByGvwcnz7Tw}og@wGsNrFk)|S3ulDu0ujmv9g+L>MmUg0eJt;*$mfe86&K2LTp1B&Da zqsV9hr)ctsMea#3a*%#uOb#$N-@wC9Z_yS;b$bLQ<`<71x}mM!$KofMdOsphGJT65 zc=2c`c$u|@u=dleqrrj4k*44WSm!e9%Ib<<6xMB)=Lnqk5sN%$t1CK!A6Kg@I)^l_ z3`I9JwkYM+3`J>;EppzMq38!mJH_%moS~?8V~adbWGH$boG)Z33N}VGs`0Z)dxiC9 z%c+)?qEj~vdYynJ0iV0kjohFMw}Y4LnsC%4>cv9a1I!EhbAZ4L6>meQe7r+2z>eF5Jppql z3}sV4PV*g5xN}GY*eYY2$SuekqE{a~cTW$Jjqn1)l_UxJO@-dyPR`tUCOs?g0K2El zJd?IGvB>k~Jd^g}$9MBgD%BKDi5~tx!aB&V`;T@4f0uZGh1EpFj)uJ<+T?gwmw%ky z;6O5twXfKehkzuY2Vj0U2G#tnt0)7lHM>e(a;&2!J;;_2|ESS&}F0>!$>cZQUJ;+9>SeuPR zgJBx!=<=D1=0jIr6Y3|%Sy1B4&tSp+631d$<|n}}v-88BtD0K+#_&Y4$xE?`V~b)7 za0AYwEshc5WnCRcMx10!js)VxX zW4>En<~qPgNWgNAM=h$79~Q7;8Gw19Vq~6nCqQkxj~y^w%}S4AcZa&Om}&rUqWc*^ zJPJhESK#&Yg|Obt^%{`Ae1DFQ`Y@v1qp*K1>ZL1y%vk>wFL*85>gaW|cB}~w9z;#x z(tPwN{3_7^6W9P>GM@az+)e^C^JBYrk41r3lOK21Tg~rm5nhS#mM({ z@a5BDzJtF4#fUvfxxs-)TL^xHk;W1Sk2IK^?+efdR*GRAd7>P6Ku7q+BMMOj0&>rX z(-r2@3I~QEyCKwHNGlv=oXJ${F^k-_3>&3lUgY!9D#w~?E^71`mf;Xhwy~He0Y`Fa zr2_+%=K(X(&wV*_v0u!uKyU>}X~YxhI0hi^0Qw2gVM! z088Ya1w4emM@1ca^6jwS)}v+li@=%BD-~vg?3)jZtB`!ig>*5i6)+<8h1%NPj>5eVgtn7d!a->F&p^zkfeH z^>K^%`{}iilII5_B-yVH9*9501dQ&+31O*&M|V#!0nfV35yA=wkM3S(0!DX>g|O1W zqr1V6Te?fxWwY@$Pd&OjZqt!lkM8h{%Xvw+)#1T2E{8b74>J@cnYu{p9iHzq6y5iP zMV=os6jgr$p?h+MqPvA-o5Qm|Ls30&oXAl09)A3pp=j0<7NwY(iWYMkg!|f(=BPu5 z`^EwvbC45{-n10>vV&NQmju3|wb+KNp~V5@NOmZ?&GCdWFdaHlI!IKdD!0nXjx%dq zlyv$Di>g#bv($((mlzQcu$-+q=(+`Jj*7|6|JLU>4rFskeh%Ab=!s~%v6(2d{ieFVtE|UQA#}^iTm3R&Ei^P z#3w=@mZbT=EQX6C8;@1~rZ+}L%`v#%;W#P!k4rLexnx`th7oTymtn*>)~PQvnf2a$f?h8ldG#aIcDk0J6WWVgsd(0V0%*O|?}? zn7r1U^CbEnT9L$G8z`=zJW+>sIgW}V>yq>))H;@R7IwIF`F|4%W)h9rKv|AnV4lBfHN^+4aImx^}B$Ftj#jEqPw(Y7SS^Z!CF zhBw<-ua5xorTk`iXbD^x5%dI_%j9eRD3ItVzKScjjhXoV#r7oJzZmpXVl!hc3Io~v zQKCJLk>Z^DMUnli$Owo?l)Rraz3pk72EnQVOWx0tGoFr_Ml<1ytmsJ(@JZ2nPh(Kw zE%4C|cI3uS>jukRf44bVDq9Ac;eL(bNAB>bpHHp}yDCa9li}b-U8x z^jH$lqQ7ARJi5FPZX}Vj;SH101^&e8dHse-L%~>FSN_Oj9Yeuz)Rz+*j_q~KmZhIB zoUw`37f!Uzt#Jc<;Y9sVs-M2$=T7>xz`ACzFpxvNg%r;25T?GI?uQl@Id92SR9{r- z?ex^mRJ6Z^MV==!6*-=ioE`4ZZJ$6ojB~X9w=d2 z%KD#t#v=E#%0{u9Iv1TdY1*VEMil=6J|Fvs5xU~+{(3UCXlaqV9ngNd&gSU{PF>p_ z#02x5T-y^{;)7?VqUHEe+ElawygcCkNLUx@hwyi{lmYkWs(8TdeC2LM-wNYer@kHg zqrjV;`b~lf0v~gdGdok!Jb{lpJ>4=Don(nPWVuubmz|#7BTOpQ3YL!>K0dOI1Pgq@ zXgjR9?Q`@HXZhS^WEA*_K6hc%U9J@(O}k)GE-)kin@pLl;??nm3&X_6fXFVySga4H zd99VDZM0U@_`=0DinbCP^~Mj_=vye}eEWh)+lBROS9+fdCQ&**@<8ds@S8vHFchr+ zXBi}T?{|!ok_>j~m^qlWn%T;tDq77S7*S>!FuH6bxoG9qwX(>)4>c}+GmIYt*$&xU zl}AO*VJ@CK?MF$m$$loWDly6WQy6D!#+YAqMM(^LqR$YFLhz5zdA5&y*c2(3fqIvqAG*5lA)&o zwet(~8pQtHWkjmj`k>>2^iPNM(=CTMrvT&>5FK*u8{wjNpT#*0*5fd%k@Oib(Bm|- zml;w*7H?TZeFgDdB|5|#epn9vAX!)G2gz{GiI9`)?})E5eZU9O7CdWVm8d2e8rGwt zTgAqmll4sZE`fU|6Ysa*C-8t|CpJjaEgL?cs86(DbD_4-2PNxB+&B(%U|S3Ii*3cj ztEPFu;t}CtM=x>7?xhUf5r!i~-AjGb)kPPd#hP%ipujJk=9i_O`ybva#60AyQkaL> zTU+FQ(!x}WJ}HHoySX(&R%?yw%cyEVIWbhu7WI0R`m0tg1HKZ99f{B7hn3PRCc`+d z`&*;iOwbAV|0UC7z(X$@R;u8C$@F~dn7N0Q;*P{!0F^>v8p&|`*0K4OhNG+_9^!jP zbevd9zd_Ym;OU7vqvLLx7mQEa!gSQ((_O?br3|geFRaMB5CnGmwbYLPB~!Q75@SD= zd>5CN2hMzPR;jNb%EQR4bIGjTdJ*B^>EQ0ZEzAX@~A&ImtMfCURoQA+~1-$px~?6 z@~zzlV~&BDipE$rg51{5!y`k@JBXij-ZOf7d6M&)l8F>yWS^cH)b$%?@=g#6^F>@V^v^vyd2i z%JHHuS1-e;QniSB8C}{YQ_`K!Vahbbq-0U7w~>zf^7^v;?RFd9!lnL3`l%r%5s~x% zN7;A4M^$Y9pS$-i>~3O1pS>Xu!Ulu%B8o4B5Tc}*0)i#)X7^@U*~acB0emW`6qTaV zL_-&l4kAslBMR6H_TGE%sQ=IR%-pgGhTq?hAF?y&%=er*bEcPz<8-G=-nrtkY6r=c zc^t-RTltmqZ`(fDMkvuFjN8Q8cdjxGDZ=b-8x{E5MOC;kT|Ag}DDbw+pe;NrS8A|P zVb|*2CeyVpkmQFH|I1x9idDfQ;d2#|@Q5Icw+MzLJSqq`Fah3pwIu9T{GM|(npNc{ zcCtIF+`=zc;0K&+6Mn$S?za-pm5Co0iT9X^p9d>E^iBLg;!p4ciNCiJ-z^jG5sCja z6ML$qy?lR{&8+(p|o5`?4a6 zYN7C#g~DGhtd{<=R|;6<^q1$PCp0^L`HJLSA^hcS$pwGm6HOmU`YJ*H%0ahPl_$jp z)z|sEHt4+Tm!|LAPL*oD>B37+bwqEvaFTRXHD;>u6vC*i0fZY6f*(by-IV=P8y99I zZ!!JaL)c|deVsV?`a|2*Qp&fcly6ze450FH!EasYFPmVU4d-Y?ZACRd=<>gIjz;T% z&SLy)AD*MpIWjmhcSU#1pi-}?)JF!8*7Ft6fA~BT6vNv#7o@2!8Xgq%It9DZkR*Gr-=W~7Z7J_L#l%nxJrhK$` zxEt>|VxhUQV>F8>`=Yik%4wuE+=i5mK*to08mY7%P0&(TTktiY#Zu`pw47W2tq5}iYXoUMv%G+) z6uxRyJeamJ;#(qW49!%Kr%y+qexe~-C{4RrAr5bn;T;Nbv-6k??^L+8Iqni!=R4yE z>ioI*fjVD!2{6%A9gu166KTr9fkq~XA4qc*ejv>hE6ryz&HW8eK75ITPyYK^P zp0Ls!lxcQ}G%tVyX}-V@q;ZXO6Q?<1q^a9c9^r%!h%_gH18F+o2h#M$56Jls(lqm_ zg7Run6Mt?S6+X2`kxsRTk6&Fh(oNZCd3efQM^7qf0;*a8lC9h?ZBqhnucCCs2y8#6 z^jtnt9&z8#=toCJ%2v-Wv$4UHxRvX|^Dd7l!kTE65$tJgAnm3lN0G3eK}FKI%f zmyy8)(aU^Z>Z*|#e{c{hSF;gJaB#tBAMHXAu1PN|7(l)}631?g7=6L&pF9dnP4Pzh ziTl(6qukVabTCQ3E1S3?4Taqz@es{$eKf~MLq?&{wry4EzcL306w!EvWcU+>8?T9; zW{uZPlK!dUXuRe~F1zva;&AdJ$@_)kPrs+q#VizE`x;63Np$T`cO=A6uc)>``vY#amKD;_}9q9^r2qA>;rYxtt~`g!19UN1r{CHxYNIq= zKt!Fznaj>Na(VA4H|2%mI2T=?BI>-V*hjA-E|H7}tk@Teee~TZH%6e{Na_4H7wd&y z>?kG34;T3Z_RS6>DwLqJF|E}uMLFY4|7@>|AlUD(?4r?8m&!@aLaz&hbw1MXeQ2jj zt1Q0PcB*tDr%(0NXoDHgcH1VCty41XhI-++59BQc|8!^L8uP%nb@LK@;UKe1U%F^VleibCo=U=vVtl;dl*@f>Tl#qSsz< zsp(u77L3Yr&Nt++tVB=vyC&+>bg(TxBD9xywwcyzi7q@XmPN||$DKP}h>g_85KiHH z1wz0lwg3#!;K|)dxe((5${DSvMpG&D&@Mw$W;B+@g9eq4No3J!h>6n0Q(yMcVEhJi zaoR{y1rmfWb5r(qp9_cMs=zy#5U(mLIsATaWBH|3-v^uL`?`6zI?`ycd78Yv@9f3>X^%3&7Dg*r=tdP^^N6AvJd zmHEC!kpoC?o8O2|ma(@gxdVPf8{EPcxRDc&<>M-XzpIWv^mkj_4%#Q4@YRXB3?7?B z8Ud6T1# ziJo^{3g_?wrK3)RkU`JSmtz}POO#N!d@G>$I#W1o-C>~w{j zvMWXYnBM0Kc=i3uREkQ?26+!GQz@Ng4o!$SA6H585Rs4TWN;|w;{ry(4F5(Me<9y2 znJ-Z=bm8J&BFX>tW4chr$#4~MgN(n-kDG|2I394@WxURC4?Eymw^}e6PtYXKMn#zG zN(ByaCG2%2EU*_A2-GK&Smqjw`Z1nGVw~`@6gkGx(Z3^0)zQ&|^)ty@?_mACB`e$@ zD_eNaSYd~DGMJKHZ|8=mLTG4mbrR$;Q_z0uX-y)7!e#F7s= zvMY*5^>G-ZrD&SxRayEA@C0y#Xn_ko>|0l0i6R*fq!5EGuAiZkua`!%q?|ikx!rqd zXgLolq+E;vlWDrqgB1$6$Py`I3Cn0xg99E3TI#|e@VFYc7|6|&_)A?plIvK5*5mwM z8ZDHB6)u0YmquMdXiauJK{t77h0Cp$l2^0jzBR~Qf@n31E(FpcGf`9^Uj@I}GhP5~ zkw9A*sI--om1$&ty5|XL;0I;O2RY?s$S%yeM&|0F*3DT|FgPAFXojiBUWvAs(dz$E zkIJeMLXnxC^)8Wx=Vj98IqCJVg}gOP&%5p#=A$O)c3HMYo270qx%?BdHChKL-if_5 z+G7*$?xoQ#CLlKlEJCZ!QCT&Dvop&xLg@6W)ag~$=_TO(LxEH_8b(57=@w5&r2a^z z{)kh*Fa7FMF5KS^iAGLa-2Wf{t+@`O|H*_UdU8yDDiu!Qd)~=3&Gz7HqR9LlDQXUjx*6b5-*tp&;^(TZ zmTHj$ne#BmEZzkYcLC$x1?3K1yzv4)KTdN!zesOgB$F=Ur1zjaVn$<#Xc6B-I)I2o z06~mJK1GlRD%cQR#8-}fhsBHrTA~gs_K~K$$-B9iMqZhz#VXH=k3B-n$R4$?lq2h> zNv^vNlXc93lWCggxlii7M(VwW^*%vI$CjYAtaLYo5(!$Tz7X=!f1nW>xK2{m29+DQ zi*>jU=C<7=VWTMA00{qNz`|IN=9_lkE|u8MN~DqQAMB1*TDsjcLu$WACfvgbuhZRR zwGn&NwIx2f6H3EC{iSYC9L_-HdU6ac@T`y$o{9(<_mMV5I+ zt(&-Ps-?^WDsi^|YlT^db81_jP{0Ta8=cW`x;n-_Dc3~qkdGY3~99w#tT(uH?nK#fI(t8K>3JvB;!5z7mcCF7x% z7v@RYMui_`_+PDjlwmRwV>x7{WRQmmDqW5ktOz^})rjW=n~)S>iX4h_TCT4IRL70c=86rsEMKHY6F3(p-L% zyc42BXq2!tw_3x}TtCD)bXmi?6a?JFUiGuI$wG}++DZ`*uTqZ`4Ws2%M;s}7gM}J9 z)4wGBP|lPiX>zSiutnN+3){6JfG=l<8w{c?8Wt#S0N5c530OsOJwi)7i=|iWkXSnyYc?#6 z7t@$)C&S%`yl>jC(qyUgPA&J1{VGw15B96{EQIm7wds<)tHrHM*`Anvqhmn^^>GY z-|7~06Z@9uDB-WBZyhhg&3)_NM+rB6L;6;p9d2fUs?kY956bM*a!*=hdp$nDnIKxv zF9;2Qe9YMfNSyoJjw$<~qg;HRYKxMKwg1e8|6wx4UT2C*JB8dNXiY1*dUKZt-@8Ji zalc#X7){WFtea^0)7;(WCg0*IT2nEzXZ5=LF`Y zI?34%KfpP#4k`lk2g&(A<}3#TFl+GxoHH#>^9V2h%8#0RzDIz>hh98rg`!~z* zZiP4Z-ySVD_dmlAY=-}VAJ`0U6NVFFbAP!^^SDTJOjxGrfFDTH8$XcdKUSLiWtx2= z%|+nAru*gifi!XaK$;1hCg%~AUX*E`mAZZ*!%ql|$w&c=W%vP%_4omd9gG28+a2TL zI{lK#X@0ZPbd+iKiZt4lGJnV82hw!L52WdNB@Ati8lw6bgSS%n zE=Y=2dseuG^Sq8NbU5`mPM_Wy4UyWvsrbu#Ym`66O&zZ2tx*ab|D-Fe z@%*F+Rlhb>{hC#sGR93^>xjNqj;hQeb4B=TWm+nWNVq3`!=d?OplOW0SHA7yqudBW z__q6R9IlEu8-luoc-^LOTtbfpX{`r0jZy!XyOg|ODowQ9g(iDSgbjrnE@M1V(^Sj( zv=r*pdj2&qinHB%if_CZ52g(+T)LTxSf1l;YCM)K2)_ zZkPYY-Wm-DiSMhOEeVgf$UFN-m3qtYewTmqk1AcsjJP;9P!gVU@h!&5F?oye;&v{_ zEyhvpTzvohiMB-Ijf#Lw_q5Aj@RLeQ7!WE&B;i@1(pnJ6@?E(FJ0vdd_0c*HjUyw#7{Qi!d7GcU@?89*2f_(dAkx=q;Cc{$Yv?zw7F7j!UCwVs7H+A6~%^ zJpb@+rYgLfAh)6$li{?%%PpAMtoO`xDNO^3=r}$RdmNhH&tm8$;@E0D4x@wiaU4+L zATGspM=&LB&d_m~8J&xmsI@9abR1@K1&HPLw|FoKq)~A*uPn%6trjYZnH-cH5>J-X z2G286(H^X54=5Ud1kB}nU@A8sp>V9SY6MXaD6rI$#@x833q0zBIpo?nwl{lfbW1xi z-tEaF=4CRp?hpqY)=An%alm045HK6tCF9Kz^L`n2j+ikVdQHX;;j#Ps?d(yI?KQ2~ zfi`;fD59`NvJFPU1`i?EIOawpQC1%!Xco>$Wb{YGgk!w!OEeOO`O`8CLpa2nQ{JjL zH@lXfZ1T*PqLa8F!e*o-MtkiN_{3O}D2W#{Pf3^soP=XgPCAsLG=6qW;6~5$Dt#fX zFj?{c_Pk166R6`>t+9qp$#5*>7&mR^<=p*5bP9iS>6A}XS=0}*xfeJEi|S7CM9SeWnBslp(>%^N7&&b>mdAbhaG+Diy2T{r*LE&~f&at1 z%YU~sXD38F@M&|bAP*J6<7IG|IMe8t!4e+zbQ~*t_}=(|9=-@a(8E`ZMZb!X#CbAF zDJQuc3@4wXQ5-*zWDH_C zmN)@%ujfWZn0FMLcNEOKYAhN-j4(#Qy!Sy?tG>Zl(mS?dln+~82Jg56c%H|`O7FM= zct^irnti;~{qkJ9BivJ;c7;i zBD|#x;@?B=>XOFTdLtGXPgDk{`4(Q0G6Hltnt4j%I1UGgb@S122u9l;XaS;h?}*j}y`j#=jM4aJ44<0R9I20RB$Khj$(? zlhkpN-C#hHSMdW$KF1Fv`N>M+mq|jLgi7PO_Amu!nWHcuk3ubK*uBKg?0& z$@KVy(KRJH-}^mrrRf;4yp|?9^OSWyQXAaTh0jEhQBI25<43y&H+i?LQ)$+}T!b|3 z{Rh^m)T04~WqG!MPmBpA^z>-j<#}Ea0t(on3m{;CC7=Mfls)fXE=-jMUyaEc#DQ2+uKW?H8GUWH3=q7slUoJX|h#uq53?k+wNiPyQz9EB!tYaxaZ5=~K8r#vS zF=esAMif)Z2Rz?NJ?mJ{Iym%5OV2ufF9^e_Bt_w&qZ{0m{UOv&P#VN>i1;26d?0`( z^K^JV%k`dnuS(wIh0!J}{)&55TE-O1YArO9t=@y4Tw%Vc3Od_q3iR@hIt7Qfmj+0Xl6cX zz;Y-pWa4)S#N@i#9|+*i!7^sdZgi9P!~0b_TIO(};{WS@m5y&jbpqi8Nm#A;f4*O( zGaB8L3l0+LPM743g50?oxuYcCC&)c)vLn;=;Yd&vDLw4@SQR$gBUT6Zu+h$IM24|e zu!jv0Z*)_3*W>YM7`>@{Fvv%_E&_OVaq#o(5r|9CXNtGL zM^libHXIrfHX=d#Tsh9~qkF*TJ*kgIX{q@^#oxD&M&FNflmCJ~8XY?xmO0T)G*NQA zuK4kM{i#eCKi@@DCE+VYK;0t4zX+(I<0Vv>Q$W}P$?>t^NShqDg2T3yd@&a-GTyOz z#Pg9RjI|Q;_H?p1RuT`^M+~BsJWX#J@20$XT^+)`|Lvm{>WiVhgNNZh}-R`3w5VaXmNh3w;8Ah4FmVN-S zF=Jesb}_3D(cTODXtZDEb-T-plcO)n-~yMU^MB*`=AA!zNB7a_1IfJ8#e?fFWpKHR zM*}~}R6H7JVKwxWu-c=%Qimq+$>vsjl5^g1f@!rUUBmzFqplN7t3ByL4JKi=XE?h9 zCt#O0NY8REM<4`Se9Xku1UF^>Wm)1m=D7xz$o8Coe&0yZt1NRmI8Q+w+w4u|TntXi z_9Hq?AF%NI5XW}xbAo7-UJ-V@Kn64HIP`==+wo$_{F<=iC>fM?49HZ??Z|x(E|$ZL zk9l5{HT8R(t0MZ|h3?^T%Xr_r&d>AFGnVnb=Zs3@{mSniDhGx$)% z(O0=CJA%BkNq%RZQ?A0(01b$R@vc+Rp8LUhGvb(YiVEL651hhM3uN{tsqAq}WH7^0 zt7M+-;imAo4U+kKl|62|3`$EqEK@bJRANl193ALx4_@nlt1VX*93)?^qS}qP%5tXdZs}+YsGlv3@C8*Qov@+7PV=2h!}o52SevKal2SPBX2KM%szO z-8QKHb$v8?_bNAeSGkFfI8k)wZ)pCf+(cg>fur)lXCmR)m{b@ik{|c1$Pz8qR#m~^ z(%@SJJJrO5EczLlPvB!NySN08`5&qlH)tukUu{_Dqx1gfrtITS#Cmv;9$>C35#>iz zIzkVtm=IorsPj0A9#K(cZv<325>BP*NwxEYEV}D|+)9mPrYOCvezwF%?;>4@qaySw zL;ZoMdXA#k80x62-IP5IF#$am3@_w~L^?H@YTn$~UF#s%W0(nF(1m_iEF<{^C<|lrttA3(|D$e;s_Z;%Y2xr)iFc@!AUmk@Y|3eRdrm*MR7D1`VJn#iYfdP614@ZG!hqlucZydB%eilgkENG(UYX}Uv0 zMZ5r+lyMDoC&&Ho8nieEz^$igm4?B_GVtjQbT@}KGslPE2&8GP*5)=JJpztE1FhrG zbIkD-IO@{0QJdD)NAH58u7Ngj=o^I6;TYYk!9D**u)zwRb1kkJ$LrH{ACqekZm`2Q zU+bpq&L{C9fURt;wbw%HLJ@U8M?H%u%C6+NG(D=_mFuG)fD~?^$2jDg=%#F)8E79T zYKNFKV$xCCuRXukM;ASPqUP^MfSJ(fl~$Q##2l68KLRE#hM?M!Fmch*R`9S;&|xQbf!YqccH@Y*GrCjHGguCN{>u(Q-=wARC*5L z(S$FN;%8|7-EN{c0D-prb3l+67^^ceeljuK*U4^RS0={M*SU!?&b-czW^a2RjUJa6 zNP_T-j_|#ERC-T_@6-Hm>`|%9b#ChL!yc8+MFM(4rN5+%TQq;iCsZl~G-n|D6k+k( zMFy%&;Q??Ega7LkVR{K3Gr_Mh!Fxyy34SAzGWdTaL4q$Z!B>NWsLlI*Gx@(+95B$p?e*j+P0tX~9yF5mF@v7=%uJzUH(NJB6c$Mq+inXDY2!o!M%xOe`nXJK2V z>2e}SK`hbe+^e$alIz`+2L>9w{F*GPy&hBNG(|A79D@K)f`;?=ZW34+t4CyTe2m7v zbZr)0kI-mb6`iKcn3zQi5Dvxa9Z@^4$IE;|>CjmtE~@=G19a~L5AHo;51hx9*){w} z;h0Wf%{17Ma4b07NT$N^7(M6tND+qGr6|%;yA+tJ`wbX)7)e~t{$^qp{pSX=SavBW zCdvsKb@Yhx!PQw*euJC5S1ea)$tf;^)t^@UvE?dV1>yWk)+$MOT=9S8(P$|MnOc?W z$&?`;$V$=ko~dnwS}$5^y~t{9mTIx~^dhVB@C|Ot-T-TeoPWzX-wPSpuOm7&K3W_L z8sq37Q+@{jzfN_@Yrm6RFtlefJnNrzlIuJ#cz$;Y&0bZMJPVj!W#nTgi<|Q9t?+Uv=4#vzp>hC56eT33AktAg{zXnHLQ|WlZ3fVZkA(9_# z&|?Ad>Cqnail<3_itt`d;bQ{#@{#YXDJbd)ZRO*(r%w@s>}Y~^Daa{#aanWRsV>4- z=C*2lNpsq%;;<_&X?k%Gcb24Y)BKfPG`f6>JlnY7RB@VsPvqj_{&LB#<|WNh%)iPKv}fWzBJ5x6NrSR6G3{ zm5w+~nDu~`i(AAb9OXC}`-;Y%a>{AKoiaTo6&P&k8p=yIAkn(=5KKDe4S zRTgd!8Nb6z#ILRPml2Ql@lQBKqmzMP`($G{X(XhwuVbXpg@_h)cMKJbap81Id=*Uc zy@7KD;9Js3lth6Pv9yz;BrcQ|a+Cz>=EahCSts7Yzr^Bl7JoQ)r4dMnFin>--}L;U z2t$5!1}~s|bO!pF4pZHfT?0Es6ZFX$FwwxN=(ZE|`58EHQ;O_*qgzzEN(%nuj1IV8 zJc0?(XqqH^dWJ*$S(aWI2cPFj-tW&~FIXtK;05f~cS-sWXYd{2|4x;6gcB?c#{f1< zjxPnmea#Ublk~3y!c`{1%|NirEug1D;s^~Js0Y1e7T&EsN8w?urE4E%=}vE>y+XOY z=Tf@z$ME0d*T@{OQ9W#ac>5hs4`J{PiUUwjjgJM&lZFvZqF(xdL)XZz?Lh|GRdMD1pdw>atp5w(Z8 zengaQ;?($5WjLe<(&4yilMi6z5+YimIaF(`HD7Au9CW7-JzbQh0wTKCX}T0{wZ>y+ z)9?}Zd_9S1y{hCSjfkPAjNqUUZRSPKzv0GaY@r@9l5`IfJk#V}`4^|T2+2374!`|g z`jey96}_j@Z<2SjN*t!sMcR8*@eV^<8Q!7#@u0*>)6mTP{kBR+O2SS-@G}8^{4Ytk zPvx3$>gk7S4?E|k0(yfH3mN8@RoNl&%z1bE*i)}G^(Ue)T|9gE(uJbxF%83_M0Z4E z@~%Z(~y;~aJ}O*e5! zpN3T~x|!3BMZky!X*$y;p#<=vXou5X1R*!6#Nk{Sp01Mjs!b|&m*HDf|6Q9@x@nr5 z{OdNUGzV7vKV_vSed_5itTb1Zm3FRJ%kw7RR;j;~Fkkf+?^EeNW>6sx7ujL*?jWL4 zGeQ;NY8k#=hA*?j|0n%=(Py5vLcbYu~#TCD1?L~;z?Yz6rS^iXRJv1_Yq27i0JPlkZ{#BH}PTp1Y$60 z+hmpZ-(qBz!)N&?9{Egzk9JOTQ+D8VtRN@ox+BqbJPOg=jz>>-5mdYFNN&gXPm}HV zOW<&72i>ZSWHcPpt#+bE*Y5PC=R~36hd!n2HHmISANuZp7N0nBWbIIid(l^Xe-_ej z%obz98?(`sy#==$+gGDTsod=B+{Jx0q7JM3YV_s*MYCRAyVKX65kj-+*-FPmf@U(f z=NF)(JG@z<&&YN(E4Rt&?Pyle2rQ7iv$DAnSR%R59Ud;9z3CfIXQ9Y<*^b6E#8$!8 za#`5ldg=t*Z60Bb+dQyFn;YF3GWfXwPSTUUGmZaI8wWC)o)ROS3|rmD_vqqIB%(`Y z8C^Q_6(3Pvygp5I>7RG|=(rnkSfZ~+t4?R_#-7wVc5nLG#BLPWjljOi!fpii zY!mx2i9MdNn_9>2L%*2V*9h!ufW5-Pz6RJEOzeFUd!oYN+gk_kOTU`n_!MtAhEL}L z{$UG#vI6|QCjRphf2zQLp>_Oz^qYx4T@l((XZ$xT{OOGUp^5*h#GfhfziJ)7KmBgv z&zAVJ8UJSse>UU)ZQ{Qp@#hMB&rMhavD&ZZ&fdKn{b35YLkhTq1srpe>F;;2fRk@> z6FdCJQb3as(BUuwy3;{Zz)~q-DGNB;60np7^fm>2B?T-O0tOyNKo9!U6mYi`a5oDm zvIN}C0?JJRKS}{>gn*HU5zv$VLa&DgVWSkVkpo|RAlJ{7Fvs>cqW}MqCoZXDGv~`@m zbe)N_U*hanP{-C-IQtoAOY1oO=z0_91&Q+l5Q%sysB+e&{^Sy=h3FG|HI!+IoYU1GP z7uvF~8ArR>tg2r#&Ji~|yV>SdzDG}*X5#!L_4$c$j<;}rVw^Kt$LU2kdgrOafeuQb zgACN!0y@Y*eQ$PC&S>o4|EXNJ+DAng5i>E1h~-R4Q4c?|TM1vHO=Jkw3P z&3D0WCr)=$_DN@0cDs}9)&*Q)x|8kJXF6tquv?C_+k6+>Eq}VS+r`tR-DZHbmHhUj z8D@T$Ni~e+*C_5Mp#hg}kP z7vp|y;qGGGUx15mAq|wc54MWilWsHheN5s$#<(=YEQiM!*E^%Ndf&4b%{FoNNt}I* z)6T-#$2h07j?0x0>H`KDYUS|*#<{q4 zoc?sX_f&!Nxy1RLaYk7rsc#*pJKbTH-EUH# z-x%i_3+Fe+nc6x|54zLDnW&03b)t$k^%e_fqKYo|RBiK!0`A)?%uGtTE0&T_{2p>>>owA8dS9zX-m8pb(j;j946Kr_E# z9QVxD+K^uTX_=|dW|^#a zoQEXNLyXhI!g+{s2DFaTgI0J43O~dXYp~BA#u;qk>|vae)^U2$N>iU_v9^Xqq-PmO zwrS5Y%J9}vdeJHq<$%o90S2kDv^l^yqg%)6O?R6(Z%LfD7-y`7^A_VwXdR~ytu}E! zlsF$U&h-|~hm145b)3Gm#>DwT;(Wn4b1j@N7-v!IIQ?j?iSxb0`JQoBSvcP_&ZgFJ z`qMfS=QoM-8{_P>aDHQ)M_a||(~Z`fea_!zssGJDvef@(l>M!vbf*m_$_<+A4{y-W zs7jO@G_ikY$ zjYeCDymr+Q`q~3$e%PU4v=JDCClAc+vU|OFrT1S%l&j?FVWQj>yM5GkmYZ_)q!H7p zi|U~yIn#K{)+jvPN zfxlRjzZ6(_T_YR|7128!cO~L@lbpU(@W9@LSXBND_Wh_?W|ax46YAf^`yls`IJl`_6F5XTSK9AE8?upZs`qi%L(*MDnCV5>m+f z?J*i1kYavOI;ib5x*B4RY^TwOXNax++3j=l+G#}IFIK7a{TVJgf{50+a*w$ip9LUq zKM>CpymQ*;jzG}cYo$uwGX?KWuG~>8nU{EJ|AaGz34c`_OZ#V@DR%B0OZ)e=)5tG* ze^dM~w$o@Dlq+~%r5;k?Oa1(T=T(}2i<|soo>yrZ7$AIrWO(;HKZI{aewk1#3GWNS z!xmwLBz!0c&w?ONT^Le}-^DjCEMp#ERX&}Md5nVgSL6MxOV*RSxK8BX zii_+!=`hxpmGh z565Cg(%-e*It;Phd%n`ti-?9Od10aZ50-RA5fI_F058l=A~e?_7)p_^w0c6g6e znocF6_puX*&FA-hI6O+;rsq_e+TKMVe&FM`?q{}l(SNWZ#b1G#D-DLPKx8P04~-@L zUF%~w9h4snR@9r)c6t@1sUs1+;+5V0D_(4?V;j9YVjX+xuXuUi+s=6~&ZjGCqT;Ap ztsWR7zMCw)_dahMr3qgUy%|}-c=To;T6yfFcO&IykuMuB6%LKoW5I}#JS1Ruy8r(Z zP;3rXIrdw5Z#f-L@^cbpwKz5;wCzK?yqAfM!yDuWl5b#TkGRcE*-he4WM9@; zA03a9wABvD&BTIHwK~T25zpkYIeOCr-pz`T@TL5c_m})7?_5Y&E+zcng@pc) zki9|1{mOA85ob%S#7l{c+`Wahy3>RIpO%V+BjH%uNRGyN%gI!+B>!!YTfD8xCHe95-{Aa&)>!seZ>tlW)UeMB2hPYG>Z&Chv;*F51!FMS#3t z@jpG^Me{RrgS$&C`(f`hnvng9!gsP?VVEV5ogjLJHF+GN(Fj44A1qB?;V@-C3d4oz z8wEF2y3KYIW$#CnPCqHQhEqKoAGAhHn11Fo6Tn2-e;_VJfABTm`H1729LJs|bpJr% ziy6C^fFsH$OTt8#A4inmvk09f;TLgs`KUQ=@;5A3>HIlvXVuix@n|^ESWAz1<4RMI z_`yq@!lyIu%J8vOU8)ZU#o9o-iREHz9CMBAp}(0;0r%2m<22mP#C?oOmQiV?ar_056C~6ME9fj|H7# z_INKAnx>_uX^6QRVt_?yfZc*17d8j)vZSV^A!HGC4TRztBGVIIe5hjx5lvB)yt)|v z0%!+-@OfjJ!r^Buq$zwboL@$r%?E=&nv2Wt$z&`}JDK*=T)c7!|8v|H(Z6JJ79 zlSW;{2&B6PM(Z)$MS0SDw$d~J$L`uFc>$uA+swMfN1l0R@x9#Ux z<)WcP&LJ>Pw-}OjC?9T#NhTh9g4`&{;^_E9Cm9#EZj|Icd`+uqUPe0+h{qbL`t+jx z-dcq-eT%B(HSkG#70=A9LYBsnatmK;cJvaQFeP67c*?s#5vj4B$En3N;;l0E@cg>gpI#|?#_JK{A9Bm1X%D$CzCO#T zZj?tup#VMW{mrE`^(LaV9z}jZY^?{aef#-l`L6Y#fCnNRGmPK_BN+!fium&RrW>yH zph{5AIC_hJ{ck=zK4L`qt7LC82&i_ubK)JMVwDsr0Cn@%_>M#%(H{ zFJ#C{*Hzpkt0^@a>3I`&(lHWt(lLM?V!=*2hGCuEgQM;`pk6ScrkGGu7^=*Inqor9 zJR*B~GO3TJ7rpZog|j!`Ogx_xUvfKIaH9Fgpasz_sQCgaCu&6L&ST&US0a!9Y(^pH zC2ubwW}7Ky8;eOvG22+o|12@vgcy6Ig%?|+dZH!;@1&QpSbH3Q?oAwu?oxfekH|Zq zpGHreY+C=(kbig}YY4T6(r_r3--Q=IvPostSF}t5eD=ok@sdK;I|O&633!E*LeU(RhPFuX)EPO}7!zJPhOTP}V#i$h`=w z2k{`wJno!6MmUuWfDumj`|WN~m)<+eMM!^#!gcA$1*kG@n)+$gMEC|s$h1DU z)q!|oJiX<`B`l!M!6hsdz#JE9`3#^0Q|WRHcjmZY^La9A7@h){!{xmOQK@9W!L>z3 zIk=u!U^YY|72esM%jut6;HDgIVt4Ve>`xZBDf@f0ory+{euSg{Ko)F=H_Z}=BQkuFG(epl@ zTRrbXOIC=~NuzF%o-#l}T&avJtE)4kF1f=^UHR!9MWmyyDg6AV%tzEUUVCLR-%K=# z*#}|qR2olByzhJXA|KU4FK?%vDrI+Y5!86W=RbF+N|8I<)M3z0mFn?h_)e9sxx-Cf z;~tfc?;zG39(4P!zDK30fFQ5FQ>D`+#``{AfB3g#T&@y%yDd|xi$(Wev`nR2kkb49 zc9nWa!Z$v@vO}fSceu&#-J#N>klAjBN&_UrKCi$34wd$UA%BNTA40q09V&eTEQjkf z7|C$m_|kZ~IEHU=z;EC8hJ>Ym5tjait@=Am$n(};#QFnUW3ZI>hp>ivr?f^ke!v?4 zx>H)CRAy3IafFyY@P6VF8vwgBB`>B&4WeBd?w;h_ z=_Y(hDTs&%Zpflxce*JjNDpcE9`Mm+2*k(GLmI|4acJ>!KaHw8h?7YVXypC6pGKF- z@Z*|y(32_|GT09$!sMr`bm$sWt@3z0QV=opSbc&%^bQj15+5I}UASJQNgZ6Y zmT=9q!@cWOdJ2X3;Chu_zSB+resVpQxS8+POun~GzE5pFXVE6&k%(nT1S*YWgOTKm zsh@aHRGQ8rq64_YV>L(M%1Ba{Fk0nM|{NF57>AWWRvbX3xl{U*1zbGQSLx%s5;fG{+qKo(vuU zGctB+M(isx_9iP9)1!A~>`WI=pFWeSVfy5#T`lZc5Q(P@`iy5M$l?M#%@rhC;DP~% zNkc8<-i8geRQ%*zelKM%bcyh9GQ1SWeEzu%D{wu9KKG_Y8RBFVL_WqMYnt$~IDZ4; zG42XSH<^Vh!dymp!hm)&eJo02!ymW?D@tj%%fJ5*l_oT~slz*esB}FTzWhU_BP7El z&F?#?(saZRen6$;Wc)0w+aGsOrBh_Yb(+7&L6zpBT)hJhs&tklOxFCyL6sIUA$CwD zzfD+hP^DE&SawjQZjx}b=6~d%N}E6sMc!9Z_FBb=A|EJY_nWb;72XIvoTe|hM?~2j zkY#s(4Y|`ctMfhgXClzc3B?2N+<;YRMoCsV$Vpye^aR zmLUT&LK^b8g>H=W52|#fBuGP^#snC0tWAI+J23%<9486VkmrCvtnRgv@~%*~-$GgL zL!lPby-hMmbt@5%a=%l?Tk75=Bc!?k$l!8cF9}lJ7!#oGHk$x-$1?%yJ|qcJ-5Wq? zwJfV++(por-W95-7rQY)3KH#BQ59z`bW=_;L{IUD>=q%^XofZ~bW`V`5lQRxjJOTP z`;Sjb9UfP?+1ibKquF})-x z9#!eGMQFC|uDUJ|OGoG{Zx5xZgos{Hl{|DYFR*1pi`Blk6(lr zSd26&f}gsI9>omiBiyVzHYr1bVd%hCnASMjhO` zQl&C*VTGuTFw1ZmeyL3^%p$)F7xq-+Tr>w zD!qz)@GA=ACE+oZUr~4;8AnSzQO5Ht3OL0vRYp9e@`cbZ7rTi+!TmF!Y?CzVV~hm- z;=Ru$?#@p?NrA4np9Ec%CE{g*J5E|K+DFGMaf`13&Xv%!P9krJh?=Z$?sB{pn7bbT zii|9mwA)YOjPzK7x^w?Bl{QJjohLcgwYSR#$Z@pe^CL8RQ1UK1Dfg5kHPkCKUVCKh z(vx_+_N+|HjTbENs-!PFi7hZ-iL}5)tOF1}mK>`E!Z*zkewFm~0%5p`PzMCth6Wb@ z&HajBy&Z)mCv{YE>Jl`iBWBWLk;1A2&IF>*`pvu4Es|~TsK7mTbVS26VTqeMCj#^s zgHTQ?LA&|q43tc5f*$A4B81o<>9vkHptKq3u1R*Y-(NwNW}4$(`58(9r=ZqE}dL- zK9M-jfpZzXB>jhue6;Cj$Z^=kez}8w_fC}-ncaykGN%(Pa{N*>#gSlw9_R$8?22$A zL62~#|57()pO35wYwYd>YYbTmr~7lcO65}g=1%^ecd4W=byMzuyHujwLi|hKV~)`1 z63O&nr`*0ru(#o)N}Y_|-HCISZl1HNEjs5c!ZM#aMx!Z`Fg?fr@i7`rWkTn@D$SCF znK|4qq_CxCwS0rP4nUywpuz@@aItgt@n~|6e|hHXwe< zUn(u`@JzX&Hy(9Hwk#6JL;M-=Z$k<$i>@F$LN=}{VeEyFht^czQMbPzd<9i@?bnVULH zI7*`<@ngzS8lA8VW3o2Y{WY58>#Q_+U*D+GuQK_Zfn?V@JZ?qT`NB#QRxFk%(x6ND z%ZR*HyMniB&s^rFoB*vfk{93s#SOgFF&x_4%9~4SDI;B-2x2j5D#{tU%v6-T zdJ#u6m2QPuR0BKVDZKXvXHgV(8rNSVZ;p$=f2-nuy1zyZh)=zy($P8MjM*~HzwtGd zu7zOdG{+&j)MzY@1xn+w!A6~4A4$_R-_=5WY;nYzQ)!;^+Mq0&Ce)d)+&n0Y=0WW1 z{WUs4s&j`z-ZtlI)Lw=cDE?9BYP1-9P_J{QdUs3p%+eGqjg>~aDyatyoWG(QeHdL; z64542$%_~bMg%`Gw%rU>(zIE_KxgkVH)WrbU^Gu`C7)1$D2UvQKeCxCv@eoXlYb*wunzi6LN&4TB~@uGZ+e%0^*^LIc`83DX{ zk)q!?!STy6B{b6XJ0}U>CC)7JBUe+juItRVfdhJirm&9Ok@8!=GMwEHS%?Pd4-Id3 z&s>4N22UlI=C}w}_*LVll2?OZ=cd_v_&57{h#bvu^P0Z>9R3V92BG(?zzq{D!_RPI z(scg{vq2H`mdI7(6a4n}bQ5{8Tggkph?wC3bGL=Lm@%KWFc&kOyzi}3=@OZZC2s%0 zbt)ZL;U>SfUZr;qnV%|S96zx>!<4$gmb!saKeeQ8V5#3(QU#qH)y}zD*vw!vO#xe* z8*D3!`P~w;mBpwlO@j%#!(e(aSRr;LvClEf_qa3Tbs1cjrP58rCYq;UL&oy+wH}mw=T!UUogpdzdf2GX5F`2FL#Oe+tV`b^KLH& zt5?gk^8NNHG8KlqPMc+{PgWXHJutRDoHXbb-+4;Yy+m}8lBWlQNurA$zQjl6E8X1Q zI{Mg3BbpSCJJGGa^F^YOW}=ZuG;$@*;o(h0cqD)Qt`btTccl;kr1{6)^492s;H`0YOt(&_Cc;j9>{BG}{yr zFhv9)Viq8UhyX;~j<8ci03w$DA4Jd`Q^IId!e~fX14JQVG$d?6*eQYEhTX*yENe9{ zNwZMq`pyxCYA|IqK*riD&n)VzOw_A@`U*6) ziux)j|1P4O%3lTZdt*mw#Dc@yD;K?{8SlqQUVPj$Sj zlM06tc-xrn@O|D^kZ)Veunezm>wo5PmCjn_rVa-lSLu96!d~c$ zIWFo(M0d31z0jdxz+PwoKd}2311I)E-^-WJVX zeJmZ08eMUygm>%dPTv!X(lm#N>XbYqP2wv=cdx=i2sY&FP`;ZHL_a8k_pLJ9(>nAe zl!G%dA(ZB0tK5`*kUK>qN-;z|#hT>*Tcfs}T?9c1^1gPiMn}qE(xF!<8E+JNHTga| zLg;mmqTrljIZh1R!$%QbhB`5$k15C$+}3qk@hR74l%?d4-PGai z0UFK3k8=lTv|=@e8aVaUNv3&T@#ECj1}4Nes+1=Q2NeI*jVe6>u*DlydLGj7b*ReD zE^5MCw)}CZ&p09CFO%`75;2e=f!-8AKbk;)n?TcL0s(Z)8mI=KxiTI=!v<)yNCLg1 z2;g-x{Fwkgb&Z=?!<;p4@%^f2B!B?!VFAA);{lAUzAJ&g6F}#iKs6?i%kRwU0~S!0 zj0eya%T+qgFI;q{i%(QP2_PJtegi2S4QcK8w4p~rT}$*aMrnK$&i*a*VHpkny-CH; zH%7FHmjHiVV>;RerA+x|*kI*z}nHvSE6 z%BxGpqh>@8M8pt6!!rP2s@3B0d?2W&b#YdsJ1zCSair4JnTWpClsr%p_=$o1;0<_w zB$%Y{wOj7=(Paq6>TvM)51t4Zh=_(`bPM-k(>SP)qgy$+oP*(5B0#rs#CDF*$0Y(Z zn`VRpcKkus;GGR_%ASIly6*J1R=d9Nti4MPg{h)Bw?x`d<24B7C4YpS04+|GT(leD1tlNiYNTT4% zbED~QceX`lC`S}eQ(Kfyn@w1m4q(8(tSx4fMUyNBT!50InV)tFm2#K9s+fB zwX~`2l{aQlKLo?UakQC13O1oC4$vq&SLC*-t$+FejjA`fsl(g>8eOpob#D0pjgFNZ z%i8+)4A3aD$xZ%e2WZp))>j8;bS-{-FhHYe`0@1sjc&sa^*oIhG78$7vn0wUXU7b) zM8YwnJ1zHpsR-Mw@+vqNv&suo+`Y+7d1*ZvGSZ0v(JHJd*Wk9%ZmP#SNf6}}PT?%6R)SA3IKIc7mGtRnCSdX;0?NL{1&Jg=l=56N{= zPHlZ{ZN#8<2WI+c`XP|@Se#b+h6?ERa;>U8Lt|pkEl9?hEMd-0|@b+>SPt$olhei z02NmxKDCNvvijwXD2p^r;a|TZH^NM*bUY#SxZ8J`P-6+sEfOtZ)?@B5%XW!)-qo(# zjrbZqt%e02C!*eB_qR7Z;@|hcKZtsx(DM+85%q?l`&f7!binaazI=tA*7z2+6R)b{ zaR^otD^ElRSc?npaZ?WVIo{;Hwe%i0b*{6%$h<QkfXHa8HC-Xfau%$=6Z5cH83!?Ua4 zK#2rB#;@j|w#7}9Jr;542z|zH=Xd6~8)V#%9Cr!F%|~1`L92?E{Q(Hk1U=XWxmg2V>f$1(_)r_HO>bpB z@99sfbZi&#&ipHCZl5P{Hi3^aoGfGCRQ>7qRC*Zv{00B6lCVVcAKgWx{Y(JPd6KX} zGjRs)RjE+M-mB&6dl?;**-{z%j!NFexf+d-;oX}5rCg1^-r^?zo4FeOw#7{yKF-zX z)O+1R{FPl?G?0k4Dl9(dUNjAVtyF28By3l5d#-{Y;w{%HT}1BoX}nW;A@l#7tI-@u zcw6M7nh7{*w8|z_J)_b%COo=DrA?CXr^Y*v*Wc?Fd$04E1G`C2OODUPmk{3Q;@Bs{ zHRTT_{Y&xPf@R3mZ+EG5P%=(+`TxB_r5EmXQ;QE6_|6t9%3Bn^-~SeP8divmLc0^s z7Q*E9uS6{=nE@2nAR!aR#BVI(CCd0S79XrRjp51&AjTg=Cki2)ed5?IxL&lCT{Jpxt2~gk`)uJw{OO60dTR87O!1jpREl?Hcv2hFnc?D}$=KW4 z_)%4AkQ?^0?2{+yJg=(&L^%Q++gNtJ!o54(^qn^q^Z>xfMhC1nuE# zNt?Ec?dK;rM4e-_mm!_gAlaRs6V(%`u2^2K6nDMW`OX&K|1uJ&RtlP$w{`GjXFHPK#3>mR=iuL!eh9 z(Hh@l)3fL;EBP89r{~XDoNXyJ;S`NNZmyI8eMCl0tv30F0oNe9^rPun^o<33sX#5b zTcti0s(!ahzaA1bKNw6JsZ=KTW(&N|Gb4+R+GhGdodCb`Zk5hA!80sS8?TQAQ*1a> z(|ati%}S3MS#+X>wpkR5ZNVr%U|nJ8K_l5U5RWG6(?(uhl(zT^l_q)Pf1C3mnr-|L zP5W(b@*Z`bMuSbA{N2yfsM|I-`TL)zQU7gd9~^~@JDF8_ZG<;I{8-e7lzV->VA3ej zYNbmz9}Pt^YeLAoS9lpltWR$Bouf3dABl-bdyH5vwzAfq4RwgrcvptD`8ryOgW*&{ zPX|U5MF24>L#W);K*f#Xp3-(-e=8y13i*xKrUKi{dqBVOOgDmXDj6UdZs2fuf`JG~ znTUv_5lSKA`K~^?DMM^y?V$QPF>=}AYiCNda}!VDtyJ21XxjKNJ~VwFR~sV233IdJ zW_)0S?mtxeT0Iy=ercD(NOduyhqcMMSu`g@QIoj`JJgIOfrbp=ELoxCfbJ$dm9Eu#}hm5+>qlY4f;yB^bogOCD(yz{MEC!EJ}re-MkdmdIjlYka%;-ncy45CXEpE06gl=uNh|3Q_+CD z?!MobXBiwiKFr!E+ubDQS|aS*ZnmrsyHF&K7NZe!40;M%m!cN&u~?oM9San5Vst73 z=ESIzg=bET(953N)fj6|WxLjh?Tn{=*IN1|h?Hxu@KHBFjg^6cfJ&00V08fV&GCt5 zKy_G>d4~HpuI7w$@_Zkam^cUwKO9aXFq9j7de%2X$!q9JhY;m~Ts=>{W^jwk7P-@h_63zcQjOcM)%`G>e{V9L%tnm^cWm zJ{-=t3M0hd8KD;)eE~`^Z?cc>F|iQ1|8Q8LDolq3+DpDvhGu7;pGCV(Gz4Ba92!r( zD+8mAV1<#2*CzuK`DI^Y2J-HaS@fQXjKDXCLyiXYz-WUGG|TXgh>!jiB!%eNa zY&4b7WAuve$_$0RDf7|MJKV&skHG1N#i>l_G3-^+tG*L5uuiG)QJ#r~K%c{5g#v@Z z=@h-@^JV~TuJF+XCJ+Kc4+oS=7=f@Jq1S!wGmtK-^3la65(1+RhZN$hz0u6)_s#ZE zz{EiyayXoX!@u72t;($2jWe>S-h@NohQq23!$*+vm%G+x@wZR+?}KY&;xXD1cA+&^x{f89?_x>!Tee5CYE~4yZAn9D~`{ zyUl!k{5T(dVIm>$Xqds1@xY;Btxln6MXci357tLorkG50dezk5GGx+t$yF< z&j7sx(}bO}4k2*j;XtDf=lH-^lYzE-Mi#X<(GbWz92z%1gX-((!)AtieVUJYnotOw zcQ~kMStWhs>zSd@Co{6B&_qF?^l&IclDIVcv2RB+udmFa5hf4t55d`@Kj^JciNnOU^X#6@81;c%@*+DEtdr7xN}%8{33(Ss%&0#6(c z4r9^$RLV%=l%UY@%Vz!i#mjy4oC%7+Ylj0(gbU)abTS@^7)kodcSEN8e0tDF@0)lC zeECm!m-e{aoOB6S{Mt8J%_x`riY)rs#6qC$eHraQmYE)Vd^`@u9-zmH4s;_-C6_++ z`U~@3dgEL>zB|W1^uz;i-v8D8ek&d@6*vbL9W*{|q!?|YVv*}pMlv7ov=)r6kBwoL z5`CQDnmAEwjgRHE!c?w@49R4xpDC|IAD17A!~-nX#Iu#tQ+mvZVZ|UgD4b@cZ2JU4 zab6RUk1h<+!x2(0^ks5X7^(V5+M?OeQAiGlVhn1l$Kyq|I*k0SEiGP$naU;o`V7@m z`NJ<^@}vJq?!olk|48rMU2r^pXpX{)l1fH+`Ox%=!Bv$7<;?MBbB_FqlA(I4cyRIX zd}es0IYUWtd1aqomkiZYC6$8Z;pQyE%F0TM`t%yAr-oIEthUCIFL@l2^oDVj^@&70 znKpuKVcYOYBN2@^q{@>q*1nA>nZ%bxW#Pmm7xBir_igQqTmbj*W@M8-@S01Q-;L zN2-$b2B)@jXC?-Dh#pA^y4nJ~I40!U_0LRM9hM|_i$p^WQE%I{px{szvf8!~A-e^EhbVkd9SM(UK^KD| zuBBjTX1zs$ORFk4jcwSP!u+EA;!=*ab*w2YEh{N3;aFQi#8!^1A&X;o>VBxVR2JiKN|MWIm5_6m_|XmwFx zd47=~9_dtL@bH?_vJCQ3&Bz61!-nOTSBkVJ*~H5Hnu@~8s{D#7w$sFk6CG6&)Uwjb zs{DeBOsb9ba8dDh_-7tqKk(Ki5aRCRaN8*WV=>_Ie(Be ziCv`;J*Zl^pk192JEU9~)=^@W#YGpH0`1C+=<3Rf?wl37)*`yHuxL0(J8D8@F}Qnh zw4*9i78jKlOObXJMRfkK3Q=(!?onA>R9SV=kYU0k4p*!!E-Dy0OnB%q8OAOslXi7f zV1_9ZraCr*yQ;EEL?4$KT_vmbznVptRda@p&xo$BDB{=?GGZ?&C>P8pW=0RG9L3yD zPcAMRUS;L~LHN~Y>gNsEmI~-Y3%7zOi9nK8OkYQFDhd)b-na1JMl2TnNO4i}ll2TD9 zeAwaHl2TkMbaQyOq*PW9VnaDRd{A{|P5$7D{9&S9bmT`;3M+)g9QgsIY|w=!#gQMl zKUz(beUMR17XF9X66v zIPy_eGor$ZcOaG36jT)Ei%RWmmCI_XDymCGALf`u)Rdu{9E7~F1jn!nP{Ycsj?dYO z*XgNrBpxcQkMfcox_sN8>LPJH-KSTHo)TllzwJ&(k}5}s>%?fPmsK#5G$^c#3DMuS zvqgKeglF&iarwdBv!Af*Umf<>E(*tjh4Bcp*!HnV=0M9fkwq%5(*t6-XWQE%7FtBR zaMOCIP_`Jhq_iHAZ^Xe2wiv{xM;pnCcwFSw7LwLOm@;#M4D_OSGG3n!#{|iCo3xIl z?!Xu^frT8~+-W^jt|#@VFq>U@(|Tw~IHpI!6O1G$u??EmL&Z3g3n07ZLgC7)(MdxW z69l_^O6#E#BZ}p5A;j*X(t7CPdZXS5W{R@=sz*g$fL_`?U?!{{B>#R|zV^o4IodPVa52_E0 zF=Q?$ItpxjLeTS5skqR@Q8?kKF*KY?mxN;?xm70|7BqSEam{$TSvA1qsjRPU#^X># z;*{1$EjCdmE%ia|bY!P<3qe)!v>tJ?EVI40t~e$Pi=p4di4%YQ+xB=I8o=Xewk2)h zdLSKcFlth`)eZMLB&8-06IH_QG^6!tW8AQKV2qr8+L|z>GGZ8sa7;{#Y;y=&A{>jE zG)JKcBA(lK;5t-gdWqdk+4VzE%6NT&b75B!CgpP`A=jSK+8J%eVp*wKX3Oy!aYHkd zX4$UN!;umC7^7UAT7^MvN5_I7PX3tF-u4+QEhe>cd@34`G0_IMhylI9h=mL$+h#S% zL*mJR5ehKXZl_Et-b}Ag8zuU<@?<=aVlLYXCYQMRZ88-xm)&@oT%zJ52W>1jHEETN zhLISdW0yh*u?xy%$xq>7XKslY#4azBqcWY0$3jDr@#qLcA7gXcRn+7x5NrH4i{09p zEUXa=vKu;+R%N8p6-=|6J11=f)9hByqzw-lX1Cyb$J{T9c_8`Tiarp@cwp)S>B7@p929s85q;aVgEiQA|a|e@y zhZrzl`xcdl`+1PgYC*EEZwswDwBW#^4YnT`;NLCC)#gGqMh3z?I<{cql_Ts&K?!?> z##EijVnIu2k<$WUNLVyqb_ZrA#^!USkw!x-#M^7^CQAwL{>cqtsF2$NpH;wktV*wC zmM$$=ig;_97v+VPXSZO%NTfK1JrKsoJ0t^d95TJ@A?YPXRP-&(bIw2U45?4oCk2l^ zd@yrdlnUs=VBK4!=iV?8k4G54$D!%Na7Tt2dbVKTnmWwTMPp%)-c8{nFu+RaF=3_N zEz)07VTjQg~B~IJ#&@^XJ_iw>c6p7dB5pGf##NMkhGr-Qk zv;i$rGmTAXddhh%czBbN)1TjhX71uKd0-22g&r`5gkxbQU(kZgT1P92<+A|H<(S}^ z8Q>N%gXs}_~#5E+IEYY!#C03>d zusu3~CUHr#VC+#tO`l%1a(BxfG}Zh=uC4e(WxHlbSnQ|qW}Z+ZV`($32gY#sYN_Eg zObrJ5U@1!mabO+xv2%gSfGuZh!eO@tyqOk}a}^BWCpwM939-fK+;efvhb%gFb;SH4 zV^=W}$BKWV8HC-JTImPz_a&Vuwvkb`sdBm3$vJbX$X}`)*4@gQ?Vp0u!=l(@20`g= zFE2DB{ZkUW-Y!P_*vr8Og|O8qtoC24BG#1X@LodsQ`UkfE^w!J29Js>HUfOnSM+JAD!LhS!SBjcKtO+(>T);-t zaJk-Rdqq?aHiT0~bu5*!HELS}j*QVwYOs-@vWy8@6(IPb_Q(n z5V4lWbUPa@=ve-Uhmv}f88foQLms=F>}pXLj)kgYI1?V`MXDg-MzU>s&uDyf9sk9!G z%Y_+jX-!c99`r$zU?;69Dv0Vy(casN%h1vNWC+Kj@~6vUBnb zHiF>*EL4J5*uZBCbMg&IVqGR4(<2t+p@kL)BZkFdmt!a}NDqv`qqQ+1YGX5%c%^_7 zg5p$yDeMFm*(tgz84iVvBw9S$*9=tBFmYm<6IRj+#s?yT=mZ@UD$$dc8G}ZJ5gZkd z**&aXPR`ShrSX_SUuNjwB(rHGEVJ3_IN87=mLr(SR?Ep`uDduGZDTtbA(U}!A9j+h z4(-sXF{$C+qq2)nc4reE9hwuVGOb4wY=L7gavs>J3y(8`m|t2oO>|ne32ly~VHELT zMX=cRu~_8VilE!3vFX+U5<5f5cs$Mi;~cBl9b8l&S5_M_(oU*fvx7-J9OE-dSlCXD zjz`4W_L3QPLurmfF!w-CxlTGdlu%$WP^x3;aHKqG7|}$U`d;L7Oq5K#x`9Y>N@3OESvGq?W}DcpmF+OEsw_dThK!c8V@Y zLf6U&uAra=d(K{03I&9BqWakk({dc0Sy_XT6ijHT7{ED{2^w{Ha1nL8BpeGz zSXwke6?!@xH-{=tyl_l5Hq2oTbnFQ}=0gq$lfj<I9!EH{$nqsOQ4o3rT11XSQb;?QteAOMaOecRDT-`ZxdS@aaD zGF_A5;}*F@A2%eTheRE=Ymr4~BDXp)vpr>t#6xKISc~FVbqZ_3%wp%%!jN=x1JNE- zV!VT1nWtKE{CtbU-!0l;H0Db$^6{YAc4}te>TCo{OneOV?fO;&U&b;9Zb%^uj>bkF zO6RG#pgAV7(QwQ(zn%6>tGb|+Wa-%CmUMG&;NWq{Fx#pM4BqkH1)Ec-V%KZFm4Vd; z!ndRBrkdl~woI^nkO?JvtRDCGE^&V$(=&%Gwpk$t3$phOwPLg9G;xGqdJ! zVTXwZiDy@!w7u8iWT-R(c*_+Gc1;v_aoD*;$BHSMvuzg)XoZcW&0%-T30{0*0MXh2 z-{GPTx=7A+r>jTeq4Gn4*ty8$uwm@^U8+7B)sy3g;W^zyjFn7sH;ZO(yEqg~ITjo2 zjhhSx$C^WPj>>v@%o`@O%LvVZj_uCjdPE*do#jPtk>M8qF{^GxEC&t)fOjy(+ zyPm=D=2_;!Mj}0$bMNQ?SV5jx@D=rb9eC_)FRg{lLmGeyM~wX16b2QS4Rem0L(Q0q zW97+s2oDS}qixUTjFoyioT>{OLFTiKfL5{65F_EjSUMS&y`Qtd6FOM1QN&v!c+!!p zm5svp+5aJVV{M5(PSVPaByRX~a@%LI4OJQ!7d!y$aG7`n_j2%6FLNi}&Y~n@AQ`V0 z&Sq;QiKX#0HX5zQ(=OsfurwTDH*$yz;%S8O9P5x1HOSgBY9v(1(Yhsup4WE&E=p3x znLuHLmI{{^j*tc6yc8jmR*tM3UMUZ?Pi(1jWnop-Flh;g+sed3D`t`h4Ko*}gzg1H zi-!%aDHv9mUtzPg%wlyZo5##X%X|nNXk-aHLrD9syDC?XtgNXlEGQ@|5y!9{f+{O(1{YW6 z4;m&i-*@IA~#l-^vOtO!RrP7T<;z{hq^SURGm&NQHqV3~jHlN5sIvEb6 zD)E*!`0SB)b3U;(WHH)v8=Da_*{$#+HO$a){t~FR*V@b#M#@O@R>`nY$8&&qH^Wr` zfIxr0CABmzHl0ic+h4Ji7mng=Kvg&}27}y6BM^^?CE zHK{2|h$V6<$F3wbMG@g%$c|ki|92JilmEj4-|D*2D!=oy)KXCYSyVDH?9o+W~5;bWgfrQmvc2Ed` z1ebBaPWmQXNxIwa4vV8>qqu;8pdedx)Nz?{M#XX8aU9$o7gQYgeP6&))Ny;C&#Ah7 zZ-++b`+MH!_q=cTgRVNKPMve=)TvYJ6_7`1T7%Q74_^wvqeZ|m&Q{%!*^SfF$ytK# zNzHtHLW@;<@-lyv-mMUb=hp}so0QL9v52qX8k|<1J>=$vfPC=-VN=a_by>iprr{7DIC-M2YOiy|bICiAoZsB-L^B|t53=ePoB+)Oyo_;+rhhrxpM|cFs zvlS0#Y%JZxl^njmAYXqHOiz`+g2}xc!Secg89*#ci?u7|?WN$3@ki9SY2t98Y z_o49CgFwBp+k=jr9!pHIn{8*NUFWnhC8*xWU5Lt~<9|ZL7x%#A#PB6J-jVS_95N&b-dxT@;L+oe$%J0fAtT<(XCab&q=*+h1j}3c zEyQv^W|T+t=5R$3^LSohUx-Ir8JkXacoyhQ{yatKNd2|oWY-Ss#yhG_8h6H=E5J(!{(R2^P zn;SR@ZlG!#^xUL}$;k)3PUCd@xMaFbYr>o1c!;u%&MPGnm}aDE@ASHdC(6x7{X8Jm zp^?3V>|Kya)Q9JtX!r0K2Mb~0Lh3%CNNbIBr!Iow9c%XpjUCBNrN*Sbc*52d)QTd+ zXzM&?Kcz!!&pYVuk#lkKguJ8fTO)Ptf!>+-;<)*q=$(Au8d3WO5yCtDzBL*dEbJKG zPPvC|CUQg;ir#Vf^ekEKpBS61`;FeY;5@+_dotptgzNH&{!Ii8m|{226o5DOX@EP# zvyeCDW$gCGSW`Z*`N11dGj@AS`mI^%$M7z-wa3K$_`zPCvTQPH%mi6G@J4gV9zV8D zvVC>jMFOP2m=X^O2%o`K9*qsK?Rhk8W-R()E-M@o1AQB$RLa!(gWV< zeS3Dwm+y^iO-_u+BtLg{-f$DK#E?P$BSk;@?*=AX3W5HMg9*E}5SYuIohR#ZH?UT? z^AupXGx^>?Pwocl^|iSknM5oxu-4tQ`PmB{oJ5P4|D%_muv@)+--4!0ZW`o;R#5=* zj0$9;qtEX7mN?}Ulf;7qq(o7We&WG*BEc)AMJWmzCM+Xe~5$GeDI zm&~Nv9BrCcdO@4O#&*QgdU|oCr&fW;@FDcNXpi^swyoPSJT){aF@|3?q3v}kT$hxA zp$jP6p3>KdMs#>re7$i763J&^vS9@a4>;lNac{}Ait0@y7-X0$^ zXd5VLC(}H$3)H(LJTR>5z~A)Tf;UcN3H8 z3|b1t5e;u}+Ux=ZPfHr1F&#@uNl#b}IJ$$j&oxid^&F(ICacNyHV^1GnKLKe^hPkI z*sV@dAIFiwPVVb-y?fIy-XJNM0v>B8?6lL2^CuRp!&9FEACpYmGwrm%yJ%A2b#_)@ zo_Jna6JwBcv8wYE0wQ=?@RgsF(2RLAPY=kbhy$aP4i`3{a7F})9Z24DWgZ0`?CL4F zAa&I>7vIO~nW?~iojb1|?f3F=tKfBM5uszE0bBFy4ay!Rajz1cpFgpOZ;t6<$eGo# zBS$CV8Nu-;nI4XwWRik6$@HK_!dRkulS~hl%4ZlW2tJQT$;T!c{=260*R4&*ASCsr zT_SX`9gW~Ag(#j0wIy4f<`{2KG|yKV(;k~WrNg|_@yjm{dyXa3kxnODV_7>NA*}UG*#nvf9e;Vy17>w> z;E~Ge^O3$(;budpeF$LR~t@f;4@;=Mvoh% z9~AN?lhf)Or%jktc>Lhv7@I< z8#7_-v=PJ2D{ej|HH@p9Hnq+z=rzlRyTf>d!WMe6f@(QWW${NWQ;@54KMPa z=N^eNYED8XYlKTw;4>`38|Jj@NH8O4z5v4Gjd;h}X`;Fd+M1Nlc!^VRwoGGqJ%$J) z+LFn3(r9Rowb{axr!^uBPp4yZJX4oHtB3odY)8f(ZfE!)EL1Q$?=VR zJx4BqK?QqXq;YnO&!viUX< zD%iIuKh3SlY5Kz^DtP4+twQFS;XQn{C7R8rA5`!$LxLAjJdv7tlPJ~DoR+<86+HC` z&Gh?SxZ(QRq+_6h2N^Pjn$cwV6r2hUxImK_beNx$=42upa}su%-w;hFn=^IEgu4i! zg8hn9?OFyZ_-7;Mn&Ez}&dxtQtAbTUX=#ix6Nf_utA7Qfep3C&x<;sA|6f6BXc#@H zhN2e5F`s;u$Xo?$3=X4hpWe+wA1b)+F5Ui5FY~KQUKy=-80#Km+o`DuzT%^TwT4)s z_M4I&3G;!YG3{Au>C^$5=$Y60iE6w$yHy5QgZfr~jT*VfZ^mY(Gj`IHNt39Jqc&*s z+H_C>!49V_ek||4CKFJ>`l3kYg|ga4*;!S=-p{s(rB)SG=pSrmor)C}R|3M!cUy_V{O{r$2NWnisA zxp12(Lk1a?B}Gv*zXoMxaTKy^Fs>|$!7~YSh@syo*Q*CASZ`d$x*Pp`3$i?ozz5(O zW;xmB>28VM#<})g>o3ukY@SgkGeZ@8_DyZE-(2m-Ncr!5sNh@1oH&4aO-!VM%O5KE z(QhNlOL{7}$zXC_&m%eAj-~j}c!O<{x zb~@P<%dqWx7bV%+<~_5af+?ft`hu?4;r}$Ai zGPc}@kSn(;IM6Uv=&#JZ@iB?|Y+4S^svwqYr*Qa6KQ)7>Ct-Qq?G1Co4)No*Hk*}f z@{bEObEPl(QDWwbxg5Pv!HB7ISh*ib->A-TPY^1&{jcE|UoxnukcJM2EYlUnyyUNk z#}4H#kNfPK3Jy41bG>(gQ{wsxZ*_Zk^+oYooCKdH!EuXmx`3>B>07BH1fbGAaenXe6bYC(8F;ymQS z&N09cDU4KFoP<5wZtmbTTm^>}#fi1GwKz1+qYQW}Cgpy6TE=eEvj2SBA4s$|r>5)v z)MzwVXdSK1BX~p8PK=g=LS*;&Z6NYwfZieGb!!s`(@9t9R(^D{zhd5JqjnZ*VD|_7 zqp`j~K1vSWc4VeYwI^+(T3L!<-9(299&PZ-AM#V=%R{DjK?UzJ4ZdcqzfGHxX(!Pt z9+!NljMaUe@guc1kF1|6S3>PH`|$$Zx^H~uM@lAa&j2i=_`+k{}aVq2BUW!Bb7I zIqLlaF6cd}C8y0!$Fl5Rry9u%ot12y79vhBia0TU32Ta`xBF$f0Sm|ZxRYV@JW(!S zlTW9On~EwJFrBGzfNgd6#5F4UTxYz_J%xIA5|dh5xFtc`F;yQv)h{z|_2*G4i=r?h za4$sF^GP!mOc`nK-`Q`_?edL9nW5ya(j9!&qkcO`*!c(cjJ?b@gbFRyhiB6V$4zq; z4tKnrqd(K8f-rV>@NRyFQs!}C6 zDRi^3j@dK$tT4alrGmLtx)Ba&_bVl1H+Q7<6Cx@&#E>a8u*{rH{0`Y z^3=g6l#=b!;x_rNFN%}udJReiPc?(cWqTE{<+Nt(?6g>08$%^yh+DXQlV8KhFb0>& zEggwz(RT;=)g+e!T$E>vqUdJ}T%5Ox;-q7VR+}TNi?(UoXmZZZ#ls7_@d~*Ta-(NY zk9B0ScHG6?e%rVcolM3_=o6GKdhep>DZbd8aHzDqp3rp{uAP_zuEM1}{>lNV%`|(L z4npoy0~*ba%6>RU^v#+=C~Q)%P9~Y~rYJ`Z)QWkuKx`gpcaID*Shr_$CGAub+|GR4&%&%^ zx-Fiu+c}5c-3*UiXHo{dcTun$(dW|l%SK1pb$>z{;k%paZWr9Lar!6!k*R6S1b7ZmCsFH^^1+DC5ow`+$7Go2v%wafVJIMn@_h%i8Wr zJU0hi4_dIQuF?4RK|0x-VSiX_4Emub{A}^QobUN@qp3}%>cXy($=b0tc|wy?nn~Ch z-}>8@eOR`L8KD^Ky89@9dnC=bvl?Uc#yC@3>t8SMLEeehL1d(F*;&L7OVA3l;2c6!X!O{?;;BqZ2b(pFuhGsUj$K_N?)V=7Noy z-3|W60(^0qV@A3X&os?Y=vHFs zRu1Di11t>5W9e4%(c1_yd=J0D@W8~hGlmRe2R>h$LgA!N5M~QP_o4{WNHl?qbnzXY z_A52s)H*XJ!Bxrx!Y94phkHkIJxAR8Fx}2q6<|6U`ZOoeIwqNJ=*Xn(M4X+o_l+$w z2tV8fnP*nV=Z`HjzAlOwYin!g5}r}c%!2uMYtrW}<`q?LqN9Ce{ZtvqJ5o@=3yWeI z7se$@V-5Si=+{ERp2evSJIlhN1Y&J%DdS(H!#vNWXDV2v3B7-w zzikWArphkNN<*-)v10MlIx>t)6Xsx4?f698N!!gdhG)&#`(y!^;!<^x*J)_3sP)%Q zZ`9zlW_c7*1qYa3+whXVGZ~zYjI4MMGdR~z^J|~e>N%P5t%)SRH>!eHn%W8_AeNmS z-qyzZcbcsMrnR>ePQgX<>&y)Pk^*)zPOEDP>*};6^nKaSuN+mbPdb@oVq`K!(;a3i zDV+ES9+$A`s~79GnYuM4{d~R(9<@TFr2p-&tUWec=x`$jDmc!>Qib;IA~oCYid%hA zJc%}Fcs%^cbrGoG{zZqeb~`&gsh^snfsNrY)k#gK(cx`x)~I^D;^)&zWQV6)r`R&1 zINsD=sE-s63dmAbdrbDfo;7}JcmbsrC!NW*C*vJ$c0874Xny4-ddQf)#&230CDXv| zT&mC5&E&uNky>IiZ2C$fm_{lLGG)AG11-@_eRTmZ0v#To$(MZ1URz~ReF6Gic;=pOr))M@-bR?Sj(RMb^SzB>NO4Bl;Dd!A3?Z@uEHMV;wZ2PT2DI?%oE{aR7zI>2ndVjoDdUXQbs0$Q?6l@|GLs?uwG1u|5xr6; zI&W`}Fd3*)wp(~-zy)fZqn=KCJ~ z4axp=uGMxrUFWp%xGcr(u89iXRYa4v!KYo_mV*UYy z?Y7AbNGBB>+#o+`CvM9VB2dBOjbev<DXh{f1m5pO2j;RWu8e@~ao7?04xoqLI*}YqnHPy94ss|t1 zJ8iednjE-AmmC8GO`^IzmZIZGB$FxLfrMpsS^!Ed;QJoM>RqrTgi}qujsK^5SF+yL zWNT6?8l)?_I|u~XkEYmJ%+2L+kjW1N!PaCZ#&7+}B{}J~(=u{i3g_f7v^#}xDdH^@DR+;VZ!D305<#O0T)4tUYY^Oi3cSS11F+gP0pNK*ZhJCqiz#DGE{Agsxvz_&OiLu2v$M14%;jM0 z_NI`Zxs=n^Hay*$!R5IeZZfoP^`mqoJftgpNYD6@Oc*6P`(rMLPfT-t8?sR1dI~~o zhTzIv4q58705Gr?R}}>e8HB5g0@zLdl*?g-a9u!*UFDiw4p(jsVt2W=I7qt8b;V)Q zZLTj4ldkjUTn>NUx;p7Te<=>rUFe45K;4c0S{$gm(%*^$YX;T~7+Q-Pi$iON)Yc3d zgqw;(2iFd&9X1R%7l+mi7&L6~&>>h`99%o#;Gs2xYjI0)@SvK52MruB2!AgQ9yV~; zuptA6;nw2dnju4n4y~;jg4>G22M!!Oc+jAMwYa@Fe8|w60mFt38H78E!)pc(s;wD1 zw00QoERIk+WZ0mAg9i;Bg1d?%3?4XS*w6t7*VN+f;s`YZh7KG$sAgF0Al#G3$d993 z<&yYxc%~iq=5pAceFS(j?CY|Si*>miN;LFEKUDlx zGam%UL%AIG(@ma)2!C(v-ghz5Y9I7#X@?(ey!y6{z(OeGuXoR(;J`$}- zd$yCsW4Ro6wi8iUv3+37@qU+zVhSc zBd%j>@q8|aEyf%>{eeXuNlr@e&6^Fm9HLsyH*fD#v$WO-xkrK*aygu?aqjlxwA$I0 z6kha9|EKLO;D{r9!EZ}@7Q4<_6T+2u=z#l_|0(cgv2k@kNVdT;)eXsX_Qcj?b!K`j zWmlhgvXjX6%O{;g_GDPwTV=C>x(|DzPXaq|ISiqWgwvdi+x}z#F8J(c;6dTs2 zKwe@GTQl0yo{d&#(;W$Zt;((c(STLf0z7zF1TF)85_mj73HvyBLVh5W$)=l=iJ8^I zQz<(UpWKnm+OW>H%Ho-RIav$x7E^%6L)z&Ud2ZPnl1Fw?3am~`o$;#8tH^|{)s1sf_M{eAANH`y9LU8c zg!0QAu_h;val2)e#WY4Ao7Zn}hgCI#^IV@5wX|m&X2ZHQnCHuF|FXC~xg=f1Wmd#) zY0r+B4eKsnnI>a9g=JixkBzl;*wrIr3GR2vO(0kg_q57p0{8yh6X=5I!+OrcDsx~B z?nm|u$+D#~ux<$W=uyCIGO0HYthWNKC|L6H=x8qJMF+6@+j9+Kk1}FCy z=Oi||PwgGQ_Ccu+|!It@H}L<9(C=cMdIs_oOOGjkHn{bSi=yVG24J{o!=^QyVK zG;%sW2i2B68TnbIWmTmB>%fB}*yElMs!lhFvU@_PPQ#KG27)vq_V8*h>(*c{YOKxx zfJ-f_`VZ*=urAg1s4?wyI+*Dl+KH0t@-uPN#7YQNF(?gh-+)fQnfdu%I`6OuF1|N}$e)J?-sQW^wh^1TWI@)!{jQc`}yh{ulhmr8i`$Ak-Qz#8$ z-|7I!`~K1L(je9oqM9ct9ANSXLoL}@ih(9s9sT3RQoKntt%Sg{LM+3G-mIIY~-SV(F>*(v!&l)}=FU-RHS=A1|ek z?|oPVr{qf?U%c*2)UEt{&TGi}NmBeI7H`cLKZ*LzS1yiGmW=CTan4|H0sbAZI(Gpu z!m4TkMsQ?K-5)|#0vN%zIs5()DiZcA1_k4oaTzmGu{d2CCNZA5kvUBrEf_Q7kO=N# zDrM+TWlr4#Aw&+V4xqxpu_STf18hyP-Ac_Ar&1SUZ8y!!$->LYrbnwAVz1(sg7+?KV*%VMt7i_MfQGe_aUCp%WF3B!(c&F$j(zJm?}kpGR0| z5LyIb%0q^N{SfQuBCLsr=3{e6i<}gZlMfyi!TS$|P?Z6aZ2E5=%8Q(($b0`I1QBVq zsVyrK4gH6a=#+ni0Cm(vg})kv)1#+MRLBvbWun58Ji;9Y;rD`Yr;G4J9^sz`VYVP_ zb`eS*?kZ4Adv-)J*=ENQSb*cTKyxjTXs$((4th9*s+quCaa)5(z^{;&_Uu$0QsW|A z8`cCCXaWm_z~Lm&0W7e1RBFP*Ayi1Dv_yutlbCj}MiNOTl5KH$Rrdj@@bAo`fnH?M zjMhIKLgabcqqe1GQtl^mrIHgB-ZFAuWkFpsQK4IZZCzJe(VHhK?D)?j@-rN0wbNLL z@0I3%z2<+t@ZayBA&~#|!vEn+$#q(+m%4Mza54=}D?j&$^}_WkX3n(JP0Zl=va6X9 zHv!Lji{^3fKc#oJ##8;?l2(E1Sa3Ro9lD6ku|L}9N;eKkxw_)-!_GePY(|qfS25ew?VD2DMga^VfP*Hsh=iXox1f#PnE)2yFUIA(7!VVA zG4SAF5qz^=ck~wnY@(mnyUtgq5g9KvV57tw{T>M+atd=Cyev6KGbh8GSxy|UOP=!x z8w#rTUfW@fX~Wk8(Zl!J4(Ufih)&#VJKP~SU5v2-i}5c@H{<)7$@hiHM;_5#^Zfvo z|KcMdsC5$+{$hxK5Qx4xQ6cF>%yC*@bfI30X7S-o0)22it3&8SO|Gb z(g;^QmUlEiiuPV+Ml)8)lvO<*LWK!{z7lXbb7(cog7ooKkB1PskNS78TBf_NKVC%C z$ykb4gId%FgVOvD2HE_-JgznSV33;a^+X6le0`AYKKn!nm48SNsOD+*N2PkL_&o>c zp1Ce4iht_~qxdhMFp59y$q+>GCq7BP7^qViXv#bujP6;d(D7sl(f#Wb&J&EPI)x(* z#-qXL#5#o=h;dwPldgU$lgrg(;#2pSk06ijl!p5H-BP=c6*-+ z&wpcvI4^^7ABEsFXR`?L^iv^3ng;|tr}s;cPOtnKx~w(=rpGd)>}IFke6SyDN{BG@ z8OE`(S#`<88Fo53ik=mn0y>ePI5RR>Si*t#Z02NRP8(L0h)q5dLM7AuT;^8>ot ze`(}@3G&U)X?OT98K)k2jx!-U3+rDpLV>dzCM4b#VSCnS{+_W!#$BJMqNKJlDPFW{ z!AdMQHN9b3RkMIMtlAzCG(I0feq!{7MVFLdR*VRo8qI$`gz5yWH~dwq%ZQmEU8kZCn7 z5mw{hriOU|5olh30u9>`0=b_TAoo)?Xzu4}SE>~^FCdDmNa4Hyn>gErbXx*z^2Be} z#BUbj^9=Euh4>YQ_|1OeH|L4372@mi#9Qs`7{_jlqZ6m;Hh(E#(LKBr;IhlJr0oDN z3AMLLTePB~sF)dR!$!gUWJ3t*#L6J{Fs=S_K>cI?AbQsX(2ZL!y#RI1{y;?@Zd6w( zrq_{}!Ov}T=?a(QZz0Xh*8!P`e=S`9KxSqFUrU8OUI;AAt^Et3>_y=cavJ4}97MxT9OWVaCp zpE7`Rf>8HNQh3v(&kL%JlN3I$37{u{k9tHmO;V_4K^5FTh%I@5nVkHRFDNQFL@=p> z-D-80JwK>x>}%2&2eq!pn)HQ1t=oE&o*&e@JtdzO!VB_*XBxl)gE-%$7xB0YS5dST zn5hi@h-0;CFAa(TTpDDbc;!W^7PwRfn0F;5ioR4vs?S(kA+Z6x$8jaj(!{RN#I6ux z-$-%b3K^z@FNILmX2&=!A26G_9HJsGv9nK)rBnE$WbE>i+u`&4x>Jv<@Mcg~bDgf{ zI;m!V5}pZMC)HFj<;^s%6QVNOeApvX*)(-B0c}(dVHcAbT zFhkd{QEGVer4S-3YIRUh-`0`AYa;4*tXVAWA!7iq8-sYoq~F=fAk1X_8vJBr|5$VO zv2fO7qqd2UC34+KQeqPy3nTqDhM>ar3LhEzTY}NO>lFrXWZYS=aKy$C`u3|=fX4gM z;C-#}j&t#vJiIP8#+8^1uElMoy7_Pt~%~0i9y-&MAq~^EJIf0_^su8^8r6x*N|k>3Jo(u`V&`B_&Wt><`>v z(pQ&68}$^;#ICIp;!6nRay|Y zAAsvhIO=^XInqqmmC%JxcrApA4qRW-Sk?n4y=F$b!%dBUE|HOL>>w??jC9m$oq^w4 zqMc>Tq;E44B=c!$j@)Z(4z|+;25`GUTy4^K8c}aF>3a)BZRX>SvIUIm@pKO@>Qh?O zr$p3eUt=7SZUvqy;XcWmOlv`(5<&mV41INhIE=h{ydLsqe|m0-$htuRa7h_Y3!MXA z4kLS^ZWBk#DGv7OW339=Y`` zYVBv8^=RnKp*`?`WOW-#?c?zf=k$+D*7iE<$xzF+J@A5L?V+=t4sj6wQnJc))-xea zvU|Ku@(1axjUnFi*+sGj>8yW;_}XD_$vRwTy&dB6%0ZGfMrXYnqL&;ZS(9|u`yqOg z;gWT{&iXLKY5Yl&71LS&5j8AemIU_6p}NC-7J^FDE6nz#SJW%aHR;bo(fjHZK9_~gxR#mk7}s(xf6%ooCMI3WRR+_zmR0Yt({m)d!2pbFxrPAa z(C#v|KB#NGnY1`4K4gj*hqmLprq+G=gSAHA4MA#s#$cLS2fgdo`mzC-T8|_EdJgb` zsr9~4^k0({jwUTm2EH6xFd4X!MPxGYT^>-lP9WwgyYRRP7aXofk6*OG{vrl@_q%ir zdZ7Fz#DVe&$q{GqiW=PPGjy<%ysY|A^6_= ztOSvtbmlqT$i@yIgn&r&5DCRDlB{ZGiOpsX(Kb6btZnuTUs`O|q|XV9%^o8KIc=VA z01Lu09<4YeAfup+M~n%sHSk4Y?elLn>7`+)UCV%nOnOBaYG@hogh{UoL#-_XJ~Qbx zVW@-3ft?Q3j9zZidzG_6Vhs3oot!6@;Q2Jn*+y~>1z#RV@-O!p+7aB7S+!YMyQc?19;RRE->jQX^fK; zE;s3?4dJyW{hYynz@(qogrCe4e#rnf7((xv^vfpwl}Rr$67771mT;+2U71PGGw@L+ zePK7<3#OR#*WvPK%YYp}3PIX@&JnuJzuXC0b>|qwdkx3SP5O4j$e&I6PLp0|(hr*S zzfAg}u$hfGiR_qkvYqk3&G(OyceCzgB==xYEacsDWE>p|QqyyGeBVZnu*Tj-d1tpEbTKELSp1hxov|qN35v za+u=CXfu`Qppj?XyfZ(c3EO!y)uhC79pqCj$&N&vNl_-X_L2O&^pg-ObQ63eRb0*t zHiAxGPr;;JwOCEDxNckg9haKrxJ_EDO(NDUWKl;fo4PT`UiV2zha=qFG}Budr-mC9 zZtkY1Z&OVAt8OxVd-fAEeQP%PdiwSj8PWvi7{GtJ6==R)Kj}wDa4Rk{JZ{lEZV?_g zc|2|r9)H;uj|)u|-x?k-H|g&*kK27}c)ZEvYaaLel-3|Z{?h=yFXS&q9c7 zWJhsuPIubSDa^TScmNf=gz8|PYmg+$~gW;(b+k$63easA^8#TnOG#1TF0F;e%q`Q2rtyGsDvR2yOd%eqJB zO;Y$+01RV}G=N9C>jC39lRii3K76i8Ki^&Y@b{mG5M>|k_l4=bWBG%<_f-C1?@fPU zdhcbXtm(aLzMv>l>oo@QQFmR-eJ1^xuH`zCVlDsX5Bi9&`Gd8Tei?$)vfr1cmKRJ} zQ_Hw7rIx0>w!=FH@>BQd1$%9W1{S?|ukFyzA1n6S4l9W(`q^YqJC$bedy~H0r1u)7 z6?>)9)0JT+eXWw|$_-?O)0Hu!3Z^UXO9kA!n3M;YZgsq&@F!D4%A~JV(sY}pB!iF( z4d6PZTWF0*-(U*fWYXVvFX*4f_HjGDGoAA$C4TWHMZY+56a6A^lcJqZ*`$v`%`}VD zH!C`@`I|zBJTxi*+8T%RwPJm@5}DSwR;=%NVtqy|Cu54=BE@&yEG@wup7POJeYa?J zRc#JI)YWfvfx6mRLew=l4*=BnjPddmv=+vi^liKh>@BPqsoN5`gWDvs18~2V`+kvo z&Sow5{UY~;n?s1iM|%=JAQC>fS$BIpAQHYIY_ToQHnpxZT&ywaf07HXe;-n9pU&N% zYA)yKQ=xa_OfKobJ&e2V&mF4yL&cGw{6V3L^~8W9=`|)X(PR=CCfb~KCu=hP{1s2`#4;md zZLvhN9mhzTz^f*=K9&c^9!J2O4m7RPL2{)M1+C$5hy-p5p|Ep5l* zbNt+7$<4C_w%IM&JRk3ozc0uiDI`hn=l_U3HcnRfadZGw-pSE(CM&3~Lx?V#tZ)#2 zET60}>gy27FQ2S%GJjk*S>X>~b6U1`vck?|blF7o$;k>!n2&s$xoRrjYIozWLEUQe zt$eddt68Si=37_g6xMvLjdZ?6zBe${1e1E5DXmYF^TF3TG|`!sE`;hLy0YfWVLMbf zxJXEU`E>{trK6$`+1Nfr`R1&bY zwnm@c5!0_MZgr919z1DjmEF7zmECN;FjryVH(F&ki(HeLYJy3f$duNO$%%hcpfX*E zYPm&U!(Ja}<_QoEVRD(mMXmRFj*!kAlh327UUIGCd)9>%R#h(lRE%_I^@wUSQ4w zo%5RHyi3j_m+P$eCF=`jX)$j%Vm_tC#1_{q?lXW7G(c?$A-aJ*C6Doh!FXL`?B`~j9pJ(QM~`$hqWbILl*?x{!=UcCt&)|1%bEERT#WQ8^Z;1++#XZO)#nS zmJq77F<2UoYH>%_1pzuFRJ37{l>7Y_2JKiXiFr(%hD#)I4HGkPsU)7?5<;cEO|nEX zpkAA-@UjtkRUjIfqVO3--ffD)e&14U#Q4BqtkxLOZ$l7_lkynf8;ms?BjI9PMU1@K z^evd;8oM9sO!v7xudzapb9-Q?^Av9TR%`5bk>E|HnqX32FxBj)cKj}cDlIN<5AgcT zUf+ex6$f1!s^1ia$XM+r?+8R2rzjloT?o->QxuNmkJc#)vv_#u*Qd$tGhMnL!5O1Ik<8e!$i3lvVEv@xKPZteF>G?~Ojl)S}BXR?SAxQz0( zCDE4&R7`hp5Pw}mnXaKs4yu`P8+nf0rgH`|=Sk+|8!qFtWJe`uZKLn3!|kT;>{^`b zUF$AX_<)SIC4pT@zvRCmR84nGs+1|sw+8R_-w-O&$z&G0?RiiS^!aZHkw?j1^K_>z zjy;$;{J(S%j5OXGtGm!X(jAV==YMMQdrSVQ|26J*1`+bIIr0IOUmb8BLW^#dNOAch z)$xYnh?O$q>_v8Mg{YBFi4*v@E@Z=Z9RLpAd|~ z(3#g*|AE`gTL=2+rd)s6z}k6*?ZLw$cd)<-Eve}pt@d$_{#bi1 zm&=t%u9L`);4AgyZ=EjI;Uu!DY}%LIgVa(feh8c|c73iN&HCNSp0MzTqR%!>e<_5c zCh1$`<>LaV#{c?k)2a3Fo||a5+nd|cb;)sdEM?AnWXL=|G|xk9X91@d<$x!9j+&x5 zsQN!~Fue;0?a7(8RQhhIp1G7;z|5kRj{A2AN1dQ69r}N&H07@}#!HOm6U|cd`8{;a z-M1<3%vVA<^%Pz6@c&cIvsttE%+a(qC($umYBf6UW&yjO;(I3`nZd4azY;?3uY zjkx#kd&_*XGTK|8LFj$f$*`*BF7u81N6;sZ0cVy+3@P`LXk}kxMIOaWHr>&j?fv`S z$xL;7M{lWkVn^1VeJFF9I$C=7J@I6AiD8nFV2+c>N}{QwCB;PVvrdjy^YKMkhsgEZ zcPszjteL0$VrhGLBHl17mVz}h&qEn!kGQjMMD8t{UyN2#JoUk;qO=EJvrS~D*v(um z<>L&z%pfl=2smxW;^PxpSbwwRdOCMi%lKHnZZ}!5(?2^P7nRDmgr28vicc5~YrT(v zR}9`Qc5d7z({VdpJz?}z`JN{%m9JE|(aerdBwAVBN4aLZFBgcPhRnbb*|+@=|kl6tcyw` z`sW4KDgDgP`PSD5ZEXPK6WM{a(XCqR1Zk}i%X*sD;zB5InM42Dy0t3%@)aICli@cD z+U#g`b6YZF>jbQxR#|E~@NBWDDO8_MlBuXU&C{5UB{GhfRhu2l*s$)kK4#{~qm}*n=?6P8vwD=>66mDbKN_ zm<+akQaD4aBAKCI(%R$mwsy3-VNM3teEsmrh1Jwo5hMy?b%;(ijw{Y_F^AvG$#!I_ z`QS6V`inuUY!>kO2Y#`Ac)TPT;|CI~jlYGNO=|D)@83WinM`DzLS#~Fdi^&r-O4}s4LquoP1KQr^`;-!-#pRkl*4Cu z1?yqI(I+$24xj3#M;Tw&IHlGbhMYw9WLOvTC6@#+sDA`~W@2feiBIIv(Ja+>JxHR` z>uM<{&PFuv6j(=Ef>3AAYS10P_^pv*^?cdRm^3MR0Lnl$zkZId!r1BT=!PjH$H7Yb ze4LQ0?90JATFtK}vJO75GWx*0QEH&PIdyETjlJSqj_MGcvSdnESwM*+0<3-Vl**d) zXyZQ1BmDV#QF4kMi*uj7+Wi4*on;~9B&+4AaqHZmRVMG)@Lo25DO==)^$A5~D5DG7KCLE_a__1!sqbGkCSk1(=mv6Y zHmx)=nMlC8CzRKRwD`Spd{Xq5uxCw)&C+O9R+(3!KwWAraad#WGz2s$McK~_S_Q$C z7^`l!ksLZ;?d&UN*4xLXle0YYG$D}pj#Gz|$PPOh);0Q3r6IKpF|=p%4d=!q_3ubH zv#ZC&_}O^*3geizSSzfZtTMihy2F8cnSu2JuNNd!c7ih0CEJp%ZU>lW z6m069n2g)74!6o2U`Zr`vLviw<$U49N%n8aRI@yBs_X4^JFFiptE^pPiuPE=C?{P| z!_};TLE`@#A*BxIj*>BuA*BurB%EVlXYrSCTG==5r1`}O6AZwrw94YZy%naLHpJR( zN(*Z=?WYEKrZR%E7N=JK>eG^`!I;v45%fvUsKFQpZ+%)awHRyiYB831Qd=fZY;UWK z1wo`TqRTHq+Loi!(YnvqJ;qAu>y91ULtDPj*QK0zOZ>QGdPYVbo)XH1{;#FL1J0mR z=o$rx^;Pz5a9a7nwUJy~i24RUShZGJ258xl4kH6gkCMg7)I0GpqZ;f4KV*@JwMld; zOqvKd1AOvoPmv>$M2}}*^$)mX?W}|i9Ju5MXWf0$1Mp3d!GlOAj-{SryGH$2%j!eM z@i%MVo!FjPr`@iens8>r`Zi*fW%#(2__sv;z|cW_V9aiY_NG#s{1nFd&9Z{7vY*9yoD4hF4cS;$-pfky zi<2_RD`NrRsn2?LbuNDD)YycBk9H3rqfc8J`>gLFJs$h$@_Cz&H96IzGtIG-Z|>dFk!Y@Lb>H>t z+rbeada_KkW&?j1M$;@HzU-m#Sw28tAl6G?Vfv z$9dCo9dh^Xo6N|Iq_#U3k}}PFGo>TdJKd4UvZstRX)X|~vn=28TAo{eYqomKD46H0 z^PAHHca7kEcbSceFAA60f*i9FP8M@DSXRY>aST{j7Qwgw4MELcsBqG_07?Oj zi>_Lz(Bp>?`d+=cX`#ZbaRJlZ4 zvvjqGSR{Uk5I^MqE5xg7Fb}ge^+SdFp+f!W0_wEx8k~n&`jkW;^U_xzo+v`aflVDP zDDT@df)m_QZrH_c7I)J0C>flOv#rhp0gSe)7y>h#oc@D;`Drx0{pml1P_1#T(cfI% z!@XfYTIP(>dM;r`$@Ewk;K|)JQ~iZ#e-b^z5baN*3z=wVu!H{XWf45aw5g;&D|v+( zdT}HJtADgIf)AL*VTBp(l@WZ!3{DKJ{^aH7A3~^zqlO`b`Z0va0{+8QlzFv3 z^2F)&k{N5~!qM!8gL+`}k6hB%D@isp>Y0(80h=CX1`||eoNGuknc~xo4pSd6MW%5k zlQlnu5IJnTzL1tkVk((h{u3*0XRd>@DEhmSGm|-S8;h)2r4fAbQ%GN9TO@OcgMMbA zzY&GXFnZb|g%Q7S{~@zT;c1gUEc(SFg=xQp z(09us1w^q};j~{ui1t{laF*b2KC={W8T=!n-Onn;g};QLb~vjPUyKi6e*o2h+GDZ8 zw+79QRxMWe6VZk(RtOy(z%T$iM8_>w*a=}o?Zpb`A`CT)IY(q2%|3v15ocQRv2nZEwZ9tFIE_2g;C!9VuiD< zFraq2SfSZqEViNtT&%Dl4>;WbR%yVu1fWEQSH_-E*P^`}UNyK7L#$3qO+2#{XPe?j zMqAD-MLZCON}gGY^N-g08eYEo%u=)m!eo^mN859qHoo~NvpT7-ovkVw7f63pLAS*9hHujn zx0s}E3E_0C{*cK6Otv}?0bpBIGweBl&Bg9-@;pis6*JMw{9eJZE?wEz9|pKD++Bnw ztCLSK43Q`5hH%C4fS@bx5K<^!+`O;1kniiU{4gm$jO7RB%MW93)8)IYf{xE%5#BG+ zb$3|eG0;Ku!-8Q{Wn<}9J8N>T%hT%+MOWDP10&++f?<6+SI%agYjwFjbgnF=K@GTA z;jW_ta${yrblk-XpHe4k^S?{+h{-=Y8h)h|yOx9z?e$7229(e|XdPRvVy4YH#?b*($hzhXM#OQ_QkTsw#pa^}V2K$}*^3o^Fv(=}nu`_M zS@%sBE6n7NyVzBv;G-8S1dh=KPmg|jvBHJS7v>W7EWKW9B1T-yLoUJBSmGEPF)m7GoWf7o)@mxm+*GckK^6=QX zrP#^vaGeEJu|#1{lfJ=wKU|Hi^!EpsK0!l290; z^U@F-UaC68px$Z$;ggmqEX4$?GkX3KgnK?9y#&`{*^_2sitQnEo$16TG~trQn2>aDv~H;Pti~XZG9+5aw{B01

p`#>(x@5`Lb^khd{ zd{jqD=EOLVjwDLJbPQ#0IGn$23?;R3;V>dLb;BC=W7dLj7>IN*uLT1cIo%~W=Q1Zb z10zW9VP>iKXe!6(6S!4SJ1@JIbpg%mwK9!#cc&$9SR?O9yY@9gGU z*I86Ey;BC~Sp0o$w=g1iP>N;-e&>m|IK4aBSiMx?QNzYuD|*LLg)_T{p&neS@SJJ+ z1;OYmOBK#z0jPJED!gn;%(I|+UZU`!Nnd0^4ZcL-3zJ@CL7j4m!gnTpi3K(P5`|w( zda(s{`y~qD30jpGoAk~my~KjL{hL>ucA+J0MZ+wXP#9D0}KIW62_?kI1=PH)%rNXE*9`>-$xtpU-xm01ngn+zjRuTRE zr3y`ow>!@*#i|Jb8Mhv@05$JYg)0r-k>!8CRAG?{qx@cGv%sU5D%><7fGDSv0YH6p zslt7xz{qInGKH5FoorAdI^zTuzGu%Z1)>+tEyc_p6j_w~jwv-= zlzcWzQOTS9O5S~$!uJL*8SS@B;ZhP1;kr%Kjnw1@#d#Ixh4V+ot94}DZ*D2JHzix5 zzH1$P$p6g@|MW2em%p8>^o7< z;LKcXLQguV#$^fzOw?;4i>zpJnZoY`Fn5_ke*;)zMVBvANc0RNdigSibNJ)hWePX& z$BoMr?qL~Yj-CW#(#dvQE|02Fikr0*H;WXn^bDga&128p9ol51xLGe^>S5_-;T;t^ zCW_-$i`}#=5~g6c3hU_ki*-U<%h+ls?6lL&MiLSK$O!-?d`e6Blt_3+L`(RT&^$Nd zcDSefWS`Px)r-p%CK-00wxXXcQ&=4dBf4do!Y%w!vRvUF5kPlGt!3HQ!j(8Ls10R< zW?+Lb@EjRv0yc=Dd`Jcour~M&WrME1!p27V)xR{1$g!?IUy!`!Qdgf%hQSxKK2I0G zcFPso3}B-b-G8~l1*Ks``z=?voIeIFS9qU44qLA9g_Ie)T;cbo%$rv9cgq#ZdU0C4 zTwz!*cJr--Y)s;+yd}*K$nwkl0Q*B*uP~}+0rLagaXhD&?ho?=Tv;`iG+)Pnc}rR( zuLj@NODt)T0PpV=M&wdg@&%Ij5m}Kg@<+q$f`D|9Ed(H(SgvrjXGyCAeFo$$X|-@; zENQi2Ml5Ny&@QkfX~xDR{^T0cby~pdM8L>)TEOdsUEl`7}8%1x7P=v z?<`a3x1BMhk^DhJny{U#<4I=k4%hGrOfllsK{udW9i(S!X7ze^P+#9Xiy0~I(_wXx zn|X`!EUgZ*MJRO*tkpsB`4uhbl+j zVgThgE>~E+y=(CI8b#h4l4k$20PbF{u-*V32t}VFv{dl>;+j)B8W4NpRXS^2BN_i{nw$EE(w$Imjif_p) z8`S;)_!2ctNKZUkaBEjMoW{@zq8Xx+`!LLQaPW5MLC}cCrvxJ zZTLx8x^LtI_Q)0opN6?oIK$=iQ{nWYJY|M)R1;6S*okZgf5l72hPH&QDpst&HM2$N zF57{w*^b45E#c>DBKT9j;w^a{*1*~#)u2KS$o(iUmfT7fWU*vHH;%tg?hr;~6S-`T zrKZ^JF(-kQ-S#}F2gdFgMnwV(B@ttS*1E78TcT}8nppHQh2C{~@Lk<4dg5gYFYFjb zwD~fHmv^GJsWt9><8NrOI!6QOWmTnQTiA~I2kab%`u9tv7*Q7hYu_&V=}V;;y)zxk zOQkr8Kdgrb|!hHlXnZk~{kb7$1aEF_5UWsOD3CGwt%-j5ByM$qwS|YQ- z8fMIJ5`uAUSp*Z9kw_*+v?ZHoIEhx4WFT|WE^gZ_k>MH@+%8Mk8BF{`u-bMBv!^Z< zl=GS34jK0`u|^Os+a-)heVvKzbUbkf*^ivUOk&fizA9t+Lqwj*d}`n|$$N^(x+!RC z>_&CTwqz^T;{Bi&d5h(`oGl{bMv6rJ0$U`U*vt$)By6!bBv`w;!fg@Gjpc2T8u?QA zFH&xYT}8STGR_^ugpIi}k`38440ZKo3iD0F%nOu1beTee`A=V_u&ho`kS++QPcBoq z#-N=Si2ih$!gafb5e==vfvSIAAK?U=A}rQjU6n-TU2 z!^zcJ*yET#V1>d9hWQKla40#`d*D%h;1qwCE5$V5TNyZTyuhu2`3FXD;cjj_+$uFe z8vY*neZ_8JMBb(`$Y#u)0d6L}xLX*Ae9BxK_X^&7%u*9pDE!B;cW0pQ`V|U@KC?n$ z!tV5CuP{AH_o2H2(XUo0oJfG-mZu&@IcYn=?+Eejs9QM^BFB#et*SWiNbr){2u|DG zW%m&ol{}{jJSPMe=LtOL6D(oR;^70W7~F~HjDfuv zq?f0*fEOkBS+RTG&AccCu46`aPKpTZa1Z4xcriGuRJ->YST9O!go=*1jhBRz=XMYC z#gCRG-U)I{eV1u^gLeeAW{)sbeXr-@z(=FD@Vv)VLz!S&0vg`Q! zy~2n*N^A}(8MJe?^aY|&8SN~v^WI@Z-gHqghn4Kdyw8~z#~Ea8!roL2UC9qC6n>Z# z0F_c5?YUARy>}SVT~;bQxOW)k`>j-XpFak!RM@n47;4-~g_8OJdI2~ldi+X-A6TMk zr9yZgl2z?16?UxGG>7$FzET0@SFBXnVV^L{uV1N9M?6^|I>MkGAqzzFC7+w0$C~`3 zWzREFulMk(`_`Pr_zS}JT!V9>u>H?{4BLC{YuFyoA7s06U&Ho&1#C~-Hww0(tb zZX!NmXikv5!wsfhy?5B5(WtT44B8~AI!8j(*iEdF8he31SoNE3)$bQn{RvA@W8Zi* z|6^!gXbDm5XXH6yKO@gt{vgqN_cQYBH#y*IhDTU}M4#JF~U2WbxLZDJhzgx_HlM1(~-98c?u49X3DEbhfO-86p@F zfl4vMU6yvZEPV!Z=(A>!)bc)I--hmtF8jGNNE4MZ-cOe!j1ptrY2=$BA=a~f!cdQ{ zR9HXR4YAA`^ag_$a}A9P({G#1r1+hlWmMWHD;2&p`Lm-Hs}#mCUuKWRwCA5m-iNWA zNpidJCqu%PEyI~YfK6$k#7MHoE@dql5 zx*q`Z+tvNq)YBDZVZF82k-^#2{q<#j-Ks9SRV)Klvr3`I6m7#7TG10%DXcBy-qb3E zyUW5TPp(pUoTA7Q^==+2*Qj40ps1QW8U4z7z*E)%hSK?#Xe&@2HeJ{|$BGAWLwBv6 z)$RvRR_l;lugseS2heL|N4aM?`$Ia7YXq&L{I@j_shwgbBX>%f^Tt%2%&a_+BtL1DI+s{%VPN2KEm_UAs!5d5UYE`#-QsHq*r( zPdDh-Sz?ff?@xoIp`Kv?w`xFK0Bo*H4B$@PTz}j@jJ|9x-B$Ms9tm7&@b1zC9w9*5 z%G0pFZPuZJ2N7wo^-jvhL-^XVI>!SjwRl0elpzYLXTkkNJzJ$>lod9%mmdd&QJF%o z=U?w>`ru!t1V9=)igaTSa9f#&AFBu89~f_S9t~heOKRpl89a<;oq2>+)trpmz!7wI zi&>cLRrXEmOAS$3+rdA1NbeW`ds%#6VXs94BIrDTOAWwYO?yRf^8s!j+Do_;|Fa)| z-gQ72kz3rx-kVv^uo_uLy?06gB)hjPr@hX6sh|6=SdYn8=M(@v-N|N823#NHtLn*c zi-uYQt0xKT!Yxi)+Zd-!&J2%9C)+uuJc2KRR%e5#x~hdogLy9g7mC1W4=5$+UI&Ju zo?NA{eo6pD-ah)uDun|M3?us9Duwuwfz-Y# zTdnY6p2U%>72+f@ZnZ)?e@t1eFiTLivdL{!3;ifww5-m)0Jf8Lu1-fh`&AL}^wWXu77XrCd+?B+tP@&)*-zQvpqTA6KLMQ0(XP<20tlyIu6jqT}5SB6rb47#_=$KPa8G1_HNiOQf7>DR#L#~p}0d{k-V z6pQE{Wj zz^MRRSbe=(p~;}_5-nMyaB`GqyVfYoCLOW1E~?Om_at7itj>Og`nWV2b{EQ|^IaX? zwm!rPd$CRLkA@LRQ8+qB5%_6eE-#6&#z~RxUYZQ9)OE3(r3 zFW%X21hAWCWjC_2cfP9KWO*B5*7XdR9HgED^6=d`r*}!`cc-_$%z$TQ@9!wUe{`Zc zPe&iC)a(Acuv=(Xy&HcX-q$~v@7Bfgb`#6fq2jJys5rkN0M@pf^rm#*Fx0d)3Z41h zWQM653|^TGQ`h?xrM=&*w3FqQ*K;^8WOY`_fW>p#JJJEZ);BC$dOLDQ?^6mx^ek`C z?I?=dD(&tOTRTb{c1_Dhk+mbG4jjZ)fR;FR;w^$+Ou08cc6xtM1iLdQ(~Ld1MKp$q zG)-?`mTfyI40X{Og|yfCEMT;g|Hp z_P0pdRrbDL59op2A7UOAx*rwV`#G}0fyi|Y+-Kpqj15?2c<3ul-Iq=MNV0BQ-d#KcPDC^p@O4oHL>l#oM z_LvqasZXHP9o1Uu6DalB)qbf@pe(-5a)M9l6AGk0k(leMwbUn3>L;qh zi1cd=pmJs+>26@Ra0lG#L}XB702MPaopruTwnZg}8(B{gm2~fKR8raBQwe*?D1+9f zH8jyAXNrbui0o;|F3`||{&@{?;UL-8HfGfDM7++{SGr!p=K*aMXIgw!`Al9Z+1TIp z|7WuOjI%tGz5sLtXAK)1!9fGKfZ2?>7Tv-urr0ay%4Fs-CY^LM&a#KPu<278=!|FT&zy$X$ z*C1>f96^bBBXux#9u`5!q=sN@p9sPxH4OcSMbNz}#TPFo;01-ds2J`RCOT5UgkCQw zJjX1)eTxZuzo76AwIzohC)~H82R8sREdD!s{m*K6yf@t{`yD5LuzwE(YQw0Q!9B}U z&MfbNQYPgLajNeN3d5L`&v~CCYXVJ7XHu~Q&au9n)B}r{Hr$Lk7M<2%Wj%0@WRBo- zBbQ65^^(!RVwX#?kC@@aaf`(ZAw36%5y>oq3V*cTeX<7*WAV$G6^qByxJnSG4CGLsP2*Zgp3HKH{FPWPy9wN9U3g9p zOeaij-lFh8V?e&}+7R9ITZP|C{sEl|Pn-P4=*gW5%OrpI5b(0eKP5Ue1Y9BcZ>_u%Dk6^63lsQZJcG0+P_P!~QN#33eqVF&`BXwnz+=2c6l!m%dfehVo1 z|EDf!;-J@g7Qw1&NdVIBBL?Yf1%O!XG1Oe%weXpat$d5yrQg6P-J_qdG`%N;U}K)( z6GHK1q39nB{8xzZCNCfOoG|bHw2;KD}rsWqbKu@P#-|D2^nP zSLBHvDRV%X8_#ozYFgW1QpmlB?F^4clE>?dk-NwxCsXaUzse(3iuWyk*J=kkPz#`IXd%y=Gz8;oafQ1&h-cUgQwO^x8Gb=*fwcU|?Cgnq1#vz;Z z?+KCr&q+}%q1gF4nIB!^>PQaS1qO#90bl1-cUlCQ4P9r_5Ae}X^0JM#FoJ-b*JIOOxF$@%y}NCYY!NJnXXMHKwD8Utx0r@ zkMqsFL7KZ|a2Rav4RSm;Np2IxkLUhcb8Fh46t?#UY42P?1@nKc0_u31oHr)%DaIL7 zogZLRuO{jIncF`Z(#6i){wD8@NqmMK^Fd?_Fh9WNyQQFtdw#77a$nguKMRR!r8Fk- zxz8o84!rNV#MJ?=EHKm`z_)-nxnY8bRs%BcQ3;;%bj@R{rWLI>CXEOC!t;pf0TDb# zUZo%SJmOP@vfaQ0j+=%1@dZ^(`L!yx!M)#gZt;6^>i$#`6bs&_>-@rPUh(7| zLyRZ?&N#+A+qf+^_4%OgaWUVIZV*&L}R+GEbP%dFIM;T=IpN zloOwt$kus{ba5J|Om*{0NT^}-=wqfe zjBXS(;YV^tPSy1bA<1#;7mlV)Z5%&w^t4G6$LoSW|MJT(L6YOrg?o0KN3Mk;GxOJ5 zm@8D7E4%T`5vt5-NH))q9FJU*tA~;&9P{O>20Il?$Fj+^u-%_EGkb!Q$rgeRA&AEv zC&p$s%xQ0P5;HPVMzk1Dj!#TUCbM-(-L)F+bi0#?wKcTGGSdZ3ICarRrtMhPNwkh~ z(spw;nVusk!n%txylqx&PG*XoNw&=_LQVwWOIdtQiyKS1TuwJAGl!>Ab|Rk7&m)hX z-Q3oZac0_ikkrW{jdpt~nU1CBHYPBH-%Ocg;GJ=@7-NxBFu|9-LxE-3<**?Sx+cx4e_U2>Eii?=xm8!EWA z2!ab9J-gYq<3eX$5j5lI#d)dVv(IS-6lzOQ^Cr4r?D}>9T1_}%45zW zW6jg4ktKi7HC}VOVMR*I!9+fd4iy|{=<|V0DL*{jnxQUDNuDm2e0uWf$>a>EV7)1G z#2tnzFKdh}*wInJ=}%}Ke&9!Hki9P2h#!h0LO=*scS>TJ)j90SJ1#l%Abp=>|1Vzv zNHzMt0FZH7Q|V+&T{1B?Nxh})G#v@waA9!$b-;&f&vvqyo6B*Noxp*Xx2i^1<89`=*d2) zRC<0chdnf`#Ru!iwApqF7vyq$i-6V6_CZ_iY}Se6LQkame80}hxo@+VULbMY)_C0bc6|XIp2mODxRgu$$)muLWSI-A+$y<~U(v zkth1STO(yCN4t&1xg7S@r2e@zR@`p0voa*`j;Q6-AOd_;qoP3^S$VYCt`^t zd8)zETn=lwN(A6dKT0~Q&8fLPmYIP|ayeA%ivAYxX+52tmT_8R&HP#jF3si8TO-}& zM{16>wT)~|HsleP<#HIL5g+y=W}McRS#d1S<#2!oKhp)AO~=|(xGa}9>R0^;%~FZR zS&_?8z0%f;gFcosPHWoEcBB*2e5|j`<#;lMT6m`bc}`|xdn|=jxg6>>u@C)lBbwl> z&gH;^u>gMYhSza*z{;z{Mp#mRu?tt239w0A1G_KURAzK9fd#c`k>&HT*h1 zyrm;+&&CzG94a;R7C*GPjp6Dab2(gYn)?Ain622B&17TEGjOHH=FbHmIds?XRepG;dAc2+)@o;CEiF6?IR}68%<~FA=FC<*o0e}7 z)!>?3j%OXI)#pMMuwN}a59+wj*U~Rz*SGcvBexgNF9HYsPkvO&t(*y{K`C7(NJ4d$pbn`KGI$^gRYo{3`j2$hn-pi$W-U$q(tuOc% zcN`eFYk?qAx1E+qgcl*LzE+u&8RN9sdfY8emrh%geeGAsZtIa_Cy^a8=ww(^tTJx; zj>{6WOn#)p5HyZMVQ`vC7&zfB}0((1$NePv_=npM*UNZT!`hQ#+kb zB&F?ku~-WypIvd>N9EILSXrwqZD+Kd{D$t?TBGbtbCjK%kNgj?%2IJ)>Yl{}X_zAo zNkKB%baD=?9W6e={QEumxOH6D*p;(NUnQI#WMLirYn9NMs0s&-V{ISe=J_0erYx8p24|v-lL0kUM=w$2Iy{|pBJ*c zm$PXAoP_iHJ70Fw>R_9d$t#y^#^0n;btAy7)xbz5XQHfQS?8s8- zQj3$w|4g>DaLoriqgU3P>_}vF|H`{*StZ{#7d#u~q-=jh2~p9KD5aljBQ|D~%6VnyDvcK6dc_{@eJeDQHotOQRq zdaqySU$QP3t*g^5=3VQ;>{-RLdG?x^z0dNV(SETH{hS-&SN1hWMkaUI9d@*u*UiSl zIzMEUoepf?&;xy@$7b5NAT+GJM^_2BbTB5FE^!dRou9m->y6#gj6+2jV;56Om@sDpc@_SyEm}jIE+ZyaRJDY(4ovKJD5k;2D*8NGOw0->fucaV~*2u4UK-VNnymn zVW>@;6dI2UU>5+J_(tGfn-xwpc!x$0->fj%#d8ea8^jyCSs`ukjx3+MSs`|C80GUf zE1by!%Qh?IjtlTQEgH-3*{tv|;s4mI@CF$IN(!Auf&QxFc8i^!m5!xqaiN}E{%`0t zn6J^pPj6OOz*UXD|Jkf$mwf=N-8UW716ws+W#6u=j1qf9O(1;{sYC$Y?y!NwuGu4k z0}gQyd6>%`T`Ya8NN{)}&hXsELYx<{I;romRux0;v5dK^^YrvbRw9?O4H<}!XP7wj z5ZbIg3w2C29TF}kL_VfZ&*GCWScJPxO&z+X4%Rf|5FX2BObL0C`HXzcl0-#2Ck7*& zEM~H zXYQWQ6q&BEC{)>@VMK0nh0=#eYlujp?vNS|J+x^1a28>vTNiVoPK;m!Pw~aMi%b8| zc&KYu8*~h#e%!2ZujzO%Smn{L6iz-gjPikBDYR_6p0pi{PffHXoBu!D{b_t$N3lN+ z*GRHFqc{_p#EK>)WVqQRCoz(|M8Sz8TVABZi?Hm(!5Hgk=4dq0%$dnKGqw~Gn5-B= zz+AYA0|5jVxMnxISpp&~*X&_S!Y;OZ9k_r=923?&pKn$7IekVWIs87)tG`~@bGoa$ ztE;Q4tE;Q4$7nyTlcxShHT6H-Q~`x&a4m3zXtlQs*bEb(dM2FwxclbicD!M3D8mBfaIv)g0d7DZ6{_)|J zjTC$L&8O0rud5?edeP!f-+U_3;)n2W?CUq5O5eV&jv9!lmngRCi5NYiAQ!h^|3r)) z0?spg93ZVW4D<%NzfSP(5xjeV_cwsIys*#%Vf_PqYb!zzR=l72eUUx-McDDK1?)e7 z`|uMn`mMrfUHdDZh|!r>G*bJko`_NB6-pFGc1YhQ+E4vcj0Ua%AI*g_b|~~l`m(}z zK=2&^zJ)6qN#Q#H9LDjj@f`rZw_c%{Z9r%be76Di0Pq36QH9U;cHsLFjqf**kEP>W zl`r`Iit&x@fAmzkP-Sebfj)Sw-^rHfKj>|d$OC5((PeTu=rXXxUxBD&mxwNdv_ADp zgcd90WZy}b0rMqSYRq}nlLc@MI&s;RGnG8qU!|3O;9i3JAR65yjc!7toBbL$p&F@i zD}L^}(!8zqoT}Su&jG7a?7k;r^nx9AglY#U_T?vHbh-N6+Wy27F?ucVnmLjng)9sA zain#W-zjMA1X}m`Xzc_pf>stk-+g5x#s2<8jCxf&wk+nG)aR~QS{t-Wen7ATFhp~k z6Vm1c+WfiS<^&poe_98r-wUqYq126=karZliY80B_| zYVoy5`}mVFTCl2-&b#%=7@dh9cRv}U%=#4;)9&{pGb7*?Ogw_R;k;xZ)b>kSAh`FzJ91k`PvApUp-eT+3>%L zK&*b<`(%ucDZn>H+NYk3(Uz+ksr{=@#>nNW9(^)Ke^C%`kF?hxkI^lFSa3W>ufM91 z&O76Hj6R4T=NymGSJ6uBdvRKDy>Rg_=e0lgdvR*$X{7e^zZa)g{J7+MaaxWa%f1(< zfgVVwSo`r9ov#YLGeWT!ACJ+c>ib=h_E#T|(cOTI9XKAN6)NMsk@im=kI}uT>!IT@ zdKZ3t?Rbn10krn;V=T>afAbvUejRRk(gXClCK>pn2v3$KI$8$~|9X!M{LwlXPkz*+ z2mUBWNW<`Uknz!p53oCOf{%+FhmLWH1*?^az@3k-Ktkkfhq{=T7Hqy=&6~%$ri)fX zPv5N*f6s|)I5Cez>~|aT7kU>pH;&UW)>(*&kGNeY}oU`>(E6JoAa` zW&W{h|AXT(`n&@CeO)^}6{E*iH&T1-sTlo@s{+p)Q4lBUm}eT-G!pa7S!)!}+=w6G znLF1sQY`uCsq|x2mp*zbO`*sYkDf~3$B(s-o=O+@Hd6b>M^B}zdVQXGTot;r zo?>S{6{9EA_g(eveNV;cCP2nM@yMz4HfX_-S>~Ar%@`e|KiXdIb}WHqhwhjc zFhjOv4bvU-c)eI~>WdXSRM_PDMeY;i=yO${D)U&7{;XFC(o0_~1NpTG%g_JqZ6ubT z$G9Zq=PCsO`5C+RsTi$ORoyY~yjMIGqraf4S3eb_!57P}48b~T%2}p_Nw&AmLAI^d zUQA4yr1vSpeR`e{?$h%?xNFuz-6Q(+yy53Apck*zgj3OP#gd^u7K~`Je1^$#!&=Oe zvQGRwC*H=1x9h~OaNh)*lvGn}bS~U~is>tI@&vz-n&(CA&`O~#ZdeS-w zVo0$MDu}PlV<~nDGHO#y5y7O{+vlR0ZE1tA-WVK)G`pQWgVP^%Oga~ zAfe7(r>VA#rHK&D|J_NEWtt29-wQseDYP7UF9Y%mzKk@7UWi)mU8mNc7b5>K@|gqw z^x`@KKFgT_>((mewkW`j_+Ck31ElU!%x(o{G`a`0?YXVzg~TBennPsTdVD_=2QQ zHFIVA!0{Np7a2T!FH-5Nc=SGw^jSvF9}aT>|8tH3=$-WE`p5%G36G1>i(~Yr zHuw=I;?Q8fif@l74$%?q!+a3SbsXdH{60On5)xMiSAMtolH~L%L2|mtkr(e&a^y4& z;tTsQ77!z&JL?E&oyLQ>y-y9|O=^gg6nSZ1qezhq7sMdmtsr<1Aw~XO)pR-wks@mP z!&5Pu-1%&Th!vvfyJ}Jt2M_CU6#H)KmEaxEV~ZJ#kZ4dB{rs_*_+eP0C2XdgIbNq-|P_^2N7 zt5Cr;{g9Af*J*2!Ho|GYLRxCH?2OT76n;&ABceiY#qYNQg7t>Bm(D|qkX}96G`Y=5cCaQ(_>iztchY<4 zY8jm?A{U62`brE=^hAFnU4YTK5}j&(2A>zgcmXr@6&Rk@=+!!o#1)7mkzB~%n!;Bg zjzrs8SI^usY7BarfbXS2LEz2^^9QN7cFwyRqYw7DlU4dl@U8jd&ImAAjwFv6L||4S zK_f|b@}bp+tHm{5AQTVZ$=d>oEjkgS7b)t#D$;)Oi5LxB-AL`1orux(__5|hjE3=J z%ZV6`;m6JsF)HCl_C$e%x^**5}5?iYXlCqA_W{`p|@ zj{;%ci3ledY_7gFl_Sr`mfe_*@-5Tg`QX@}T+O_B5r*-9@w-U>cGlSo=n4GJIyje- z%!X?kX~B+{C~JN@;Lp7VGOvWLzod@v?&iOp_qr1?x&rCdEGXSJ8SwqJ8L)_u9&24I z>(B@2FN#LjMlQv>?~wD?qUp>v7=AdO(6u1j9(+S{m+ZT)(Sn_!m0-&GUd*N%Ry;C8Zd^pcHAIeGHMImXL%{U)GX zrJfqYVvgYl=NQ9*a=u6(qTe+No4+D*sSMaFFktab*av2dJfyDxDbGQQ;y6jUbdw%M z2Eb@_Q1H8xBCi0|k?#M#NKcJdvRK%)sgV{uqerB|^ZHiwZ$a}ewS3>fi4Sn%c}R3f z3=a=&Qe!Koho7RVbpXKNKES0~H-l6x&UfsRDNu>9JYTh04e!XVDtVq)fOkY#pl{l& z1bPv5@%Zjh5cfoQfL{g(4Dem}fdRgEb7+7+yjczKH@FH6@Exj(H%DZLcaQphAi|5p z{4Kz{<`84l%n?3RbA%mxFC5-kJbW1Lz?l6H>iCimM%cOFq9RR2AWWWv=BkWD#d3*D ze}vM)AK#a-Cg0~07uG0&HsQhWQ7TD^Y2Ds5m!Y)aNNWN_v(@QC6CnQsIVFb zWtZeyKZXmP=*6D|k3VspYf!8TbKp@ZaNpG``Eg1KMqiFZF7=8dL|=~lt zvxr&}HoD1d17824Q$P@gBEgSm^232f zTJRR|T_|?R@c}4`??bvDyW|;wehx`S?2<(<3dJr-z6g_a!8ZVgV-g%MiWFFyJWR$Bow>kuPBJvCEHZ4j$N`#ee2jIMfLqU#4h>GpJOzk5+1|_ z=l^d^L?v@RSrye}-qui5llWF>*1E?j_{$4-pVT4g|J93X7agW8A|S%yQO@)+lkg}> zpjNf^v@NzxH(GuC|0%xjfs_B%HUGAN+P7+npqvR#35(6VHQrk=f}?FMl$|s?sa2+* zd1ih!G!EPO1V~^aweq*J8#45hx?0)S`PmJ%vbWkJTsAsOCLegC@~3gDv8ppbZ!4dZ z1ENx?)NaDBqf)8-{h4QK_ToCTno6ZoyDw%s@ut14d(I+t%QgQekWAFCgj8#r_UaA7byM)fZ*h?> zJZ9T$uhds4jIGV4eG^x#exE8~|88ap;T9-dQ0*vIPk)wid+~u&C_*>Cpgy=FqJ%27 z{Q8BBG@a?g%{zJxFEkqp$y7f5f>a@2%;xN5rqH>hYsHe~E0eCBv4*pxi;iALRFCUY zOPs=9urK{IBKKS35jy>fvf~x)RCXk5r&rN)%Z_J_*h>Zq+)0|Q$0;q*8Re`~!l~E% z=z^g-NqZiHI986GXjwVxNYGk%I}*jg=DUg5d>J1oxoaj$wntISdi;`?W zjSrSwYFmDO6LI6)3fo4r9$j)R66oBSh>!kTlk{IN=BrMXM`ac)A^C;P*i1u zD&0s)l1d2`0J5CBS#r;WovSTO;!Bd@@Af3F>`?Ud$?a0;G(@}Of126viOzlYwY=%P zCOU)btBXV?)mWY-9?=AXwp2dJ997j*T$Fb39!}#=$S`Ihgb8>WWi@iH@0UQX!tm0QP|AM9}iXjW-=0)*>7XO72fFxlAx)aH_ z3QU~88S6;A-{~!sof35%L&Nbc<&u1N@ply>er5YEP<-3Dg67x7CKVfoo8DvqLiqp_WGY4RtZE954@Tm)%sz@|Ya+yTk ziOR+rgM1GVcN7|S4P1a;VL z7%Uc|9(CW0uj+<^${wE45`+Ln6Unn>KE*|XQ}X0t4PiKvucb&bp>7Lwn_TBZK6m~;n*#5g{2wX zQM=oM)z{jp2d*EtGDobG4BkLuy4G~9BJw7?G+F?a|FeB2b;1>Pwa+9|f1b;OM1N%p z(FKbG5`E`=7{_NrB3(~3F@23m-O{zhg!b{kSc!T+OAqWLwa+qKFM!yZ=#l-9l~~tc6RPk6PT5W=)&pq zWnpBOyoe!(GX={{jV@X3rbgFW`D{+sA44Kz4a4_z&E+cof_AKxKgjqaN0?dnQ!fdrO9Q$PJ3qb9E zm&U@>)*$=q5|iInl~~75-ON@yvnE^0TSXqUx`jPsMv=NI-l#6}$O~qQVF>$s7B^7~{Xm!j z(_v{B_7e%t|({iqZQ#=?L|CX(N&<9sz$;W0z;^|nAVh6oN=*M$Ml8OYXnt3i*J_t} zb*H&Rn=npxlqf-EsnMWSHPA0RK`@`6bhcG0@WUJK__~FvU;Jw;PiWK+*5Q7aZ zXODMwbyIzF^RzN>oiT!CV#P9Qh{lKNrRhaGyOyy$mj$&oyr8z40z!8wZKtw%D@P40 z46ze%TQ%6>#z50b6aCu?u$Ggi$wuB3#nVMPsD3(jh7L7C=uy1n!c_TT`7$P3b@lIB zj#aC>!&D0<8^hh0Y!r=`=11oz6)_g=T-s%HJQ*&LtkrQQABVPlV(zX7fX2QqZ#kvm zEY|FGOagnn$e&U99L`#v-X{iD8r|EV#>o}tJk$AVOn9SBZ6Sig5tl&lR-fKU{#B!y zP&LoFtVyxV(k^OfI5nwQ=6O!R%4KStk!xgjCwIzd6ie>P;Bel^)}&9~LdgKx-9&%8 z4BWAsXiYaJ;i8}-R!1m2N<@nU7r#PQ9A=E=xz$i-cZXz)#w^tR>o1#=y`g4eeigbo_BduH3cH{yda+v)5O6W~^IPiQyF6)%Xm#pLCq&*1X5tut-FATOg`7@u5x#Ogj zF9^7RTl0u`KM-ddctiIK!41K*IB9*Kx*WvqHYRv9Oxq}{g0fN7wWTsJ5iU`&q9C-D zP6c6MR8=3Ys@@QORaGHAB)qh3*R<2Rwv{Hjb0t`PB(3d4UdpvfsZnZH6PEb)D8(In zFRGyqp0shhFhbodB5Tk?^#Jgy*>}89+aa?~>5}A5=|+1}KEaE{lG|?DAkoZez@eF) zz(SVDIqO)xGBl}XCq-gq&6!nIpm$)qDL(hu9Knm|I`BgL#&V%#tzWB&SG3)1A-#U> zObJ?})}O5ebF47ey`F`%T;>Gtb9ylIOzwG3c*viFbyMs(GIJM&^B2)MGt^NvHe%e6 z$=KXlQ4@9+3x}~esp^MW&Bw0*J#&ITb~s_S&Ra!qNvh=LU}Vu8U881(+hi4K#VXWy zgKSoVgp zr6dk-NF@!9W=Bf&d`W^!BCJ9GCZDB3e%LD&9DAVPdD-EdP3Q4sh{MUp9kg$xHpZgH z>YKQ# ziCQY_gru|3T_BT*>8OAy%8NxMWfiSdwlqO?@||%DdrPAm?U9nUz~l-kP4Y$|Xx2&F z<9Zsg0Q9K&w^!Acw?^krtTOeG5N}8=TM-Gvc2Y34O>GiU8fWVo2{+_yCsP__zlj-( z<(&1s=_=8^Yp^*qDjRy3HGQnrzp0YD)d81%nSgu3}MH7=&9itY9nUUBGI$O_cRj_O|rc(`@ zPfL$)x$vbSCfmAvu{7bE$m!BGMn40@Yd{*h7VuZNijJU7wsW=gd&V>bvAN(>q4W9K z(U}QsV8q5IwLfF6r6xu*tGIa$$QME?I2r!h`37wa9sqIV{D=v0PFroTIj0dOdCR0S zu?2Jwl_|P~VH;94w2|?~w4$pnjmZ2}vZQ%V0qoak_hJ>6MR;i!t9#AiRkXqEaR{yc zlI_y*wMM6B!Jh$#g2_E*PiXODNAZb|ME)-RPH zi%hWSbO?aCq;-pY#lw&3apKS$#C!NYtQI7)mIg4(Ng4y(4z6gn>Brrz8jZJ8NX1@+!klJ)M&&Eb&IIqODX(YHk&Z(rn78c>C~P;YSKoTzA@O z--aftHVdrRyNi{{9UaM;bPCLAOS_V{n38loG0GI*(LvD*V0rz2t$aJ%MdzqJ21BRG zM5$3LHEMMu-0>1Q0sU=X6SXAMvP1@AW+vdFxB|OnZKk7Ab+M0Fn!nm&&$)w>1sM?x5sa zDO>*C)3t;*-Mo~{muUF-3$_wfz~k6%~(C{8_gC&L!}$@Qr4bc zTq~7|Og`~J_S$x_H)nYsJOa=k{Q24W!J_40c?V{hCO)WAqZoUk3k9qb`I z<RzCRP|0OY$&IH|R%_vIb{CJs;+pGpW4gj&Vw#q!hD`W4oL(ASo#F$0&u>ml z-y)d-%Zy}Q&*zz(<&_lA1XDODf5q0OK%!<+xvVn=?R$Q7K~kw40S9Mfl>ZKthVBqK z8Kj3lNnt;T0u+?I^?74WyW8Yjez6E9S23gf8fBho_LBYHCkUWL97+B{gxcBd3_ z=*-;|NzfLBm3CGL`9Lt&7z(Qzhj1m=q8*j9gs)^#G%>YU)vL8NB^T)h+nOjMJ9OqC z1AE-&qR*MNRToZ7D={CGssdTC&EyxwiuCbqP1G`_RuCUoo!gp7epX?-n?mA6_*a`h z7~eQwplw!^(cRWn-LTCVIow;_YB|_4CnkTcS{TOL|8%8rKh!^p@<-64pxD>U+6p5h zEXtyZ>A$MFEVYFS%4(q2?IsyUZL0{j@YdS7l0~;)3t2lXY~)j;3TS^UL7SA&g|lF` zRD$uJ-6rC$owF?*21MmM>#!S9v;G>ylQtf;>Tl@KYsw=YB_*YlbtYKN6IrJ0EG!H- zSzB6y6aiF{)yrGC90N*n&)cr`g$aw7=>`$OTplR`cT^>F`5^gN1D6k|SVfBQ?bwv9 zkdq>{=bCI-*wZ5vWL0LZArFL+Aq-o3KF0#;WNT+xeEnA@cXU==tXY}d(PeD0m*Sv( zY1hi+j%EI@<^Hb~49Oeqj=&lg+Gsbf2c>p&>cg5HU3zWYv6PbR^Az8)jLuiTmQ$Ph zwSq3;HRvQ=2^)x|L(;kAEo7J%Lr95E1*CY2oummE8JGl}NhTcs?n?TLgr}dpDy>ZJ zSXwJRd5h^i5klpCJ2ZU|O_`WJk4V~5O7br;BrNS>53!b>!!p8WDO_03ZK?RFzJ&0x zqMg?p`kX)i41i=Xc%HReBGtHRt|LVPbSZPJXYF=vuT*etSKS*xQXb~pR-Od`UmHz4 zy~7j`8G6A>;g+hF79Xb!9jQ-DeOZYCd8mqVF9nJCBU85Abcf$8W<4i$YNpyIY1o8Xi>__wizWJSMD!~4Jy^3XsX~A@Gv2LMkT z^x4R&t5MJ?q%t^f%ne(qF?vt|Vrz(2=yO#GIA-{KgqKerNUR!DimqmV@={M=B*u z?H{XDw48M^Dhz-}KT)*tvKg9IY~tZXsuKM=B61N2*EZ~cMp&u)(n);;_hbe(rK#S|S<5EzqG zX`BwLZ*VHk(x>W9xe@TGOrf_lUZNv)YhH=(oHcCcJesbP=~2QniFC9s{t9IBbC1`J z+72C)_y6O{*Z^*Ox=tofrpkU;QKeIlk4- zc(lKs_9GKKV$*^8?fjKV3G>N?t;6-ADeSRw88_>sS)=G*OH=hs)j+0Y=rz|HIv3At zY}zlXW4Rp96|~?S%_@I|ps+x%dZ{T3mB@PiZXDA$N-e%XRGFiR%CHiO=q)Y31pQ%o z(JZ2l2Wg;})W(xP2L~uAH1~?sCcknnb#Ra3BSq?#G}p%P%5Bm(i_A6I61(>I$<+og zSCH=kT_9E1W4m^mc8J`;(_BtAHD;&jdP&L1Jbtl!ai#JgBkh!=Oo3(1`T-i^N&_OP zKEEYQC9Z-xhoD%i1K@y4lG%~yIYUti8kKs@F784l#%*9y)6OfZfr%GWdMz1osP)Yo ze5xj8$ry!CRol8DSP*>OTebGZ-5A9g2Q?!7_0{m5dO4OtyXdRjff;sx1$MI1(ZtZt zMG1_TiLSwFM(6&kDBLkL*FKFeS@5D@yU_gygd=P3*VM?(hC#Tpe-43Qs;5ix^p+8* zC9yi5H~v`WX)>M|`jHyPOb3y7J%%M;a9Qp}W!X+=_v8y{>h9)?K6uqNo2DKm&%A8L zv2xTWCHcKjp3gLJAFr)mHpBYLI4pe>$9tER$cH&A&ogJlp+ga2hg8|k(BX(wm9om2 z(GtY-lv<{xsX;sC+9f&?QRvXak?(SKjy+x~(qrnYkV_Y7T76{GbW|-i*j^M;kfFzv znCJBs3CAOMZAACg%8tuTPef5pR4rVhVq3%^_MK|k|&<@>Kw~ANatdq(V=zz-4diHq9wdj8TdmX;} zonCrVb<$uqLvL1zuz6jF2UH$V5*~<}0KH3MSLRW41b#D!VW-y#k>o3wXlil%~`whXgvJsDU-g%H?bq1}gf7!XikehwJXYlj&}` zWAs?v^Y6lkmCLcrovt$!NlrOhCu%}AowGONeCAl){jBDIcy>BNm3mR@;7EZFjn%m_U_?+XltG_*>UMxNB1unkN7;8?au`;;#|z&O=3)$eb-i?vau zD3`LSF?wU8^aLZ#6gto-G~?l;$;Q!rplB{Tj6o`<=xC!XODe@H(y?$#hMsN|8t%?|e1t*^~APg9B9I2fBzq2YP9r`c#u=gYD4%`Jz(DydAKeG|vf@T1@fn6fs90 zn7@zfPUi}l0o&a~lTB~B8^)ykmO+|q>V6G=t0Pr9+=LTdil?yh;GCC^E)Z!1s(O8P zE)6HeV+-I2OF<$%y`W#TEIT(s2ja;>XsyZ9>nuat$P}RZbtIt_`ioqVTFCvs{Ok|Fw6*W52X@{fotncg z`IXX5pZrBSbaP_pGl~VWX?1rDFe=Ls?|6A$s&F!D{&3P60`E+9yCj=1m?(d$wN|+k5EKHJbd2W zoF+2uvGe{=VhBE-pabVO?ZKzsXKcfR?+4G9ZAK=w-o=Kw;8;2AgE{li`Fn6lOb$HM zDLoxN|6{5ez`?MooCBuLe>Jbjrq{qA4xqTMBdQ?~U_) zyrw)t4`2PBTkz$U9p5mp-l6Fmgw`-h$oKtbUmk z>>k|v$5f3Oy>awM;VDe8DI4_(IhhmM0^*vNwvA`q)Bdvw%vfOONER z7IZFM5r|oyrhGO#6 zTb(BASvX|EHv|L^!!{=>OJqdkfS6l@vF0XQEz?22!X-C22LIvsSVT>0B3V%t%88DM zTA`h`%%-e8zMrh_a8ShqX3hEQY-=po=1smtRh}n$A>?#`UI_ApgFW1A`#n{kzv<2I zqK_4@g4t60tc!4sg3-kE|NB-qzl%zR@KP)raB4ks>QAyBV}~DC;dOpG$L$Kf(&?}0 zsu~oApPb1I@RRFWZm^o3y;yxJ%?p#48=O|D3s@(^dVO;u`2r!6m>sy7W*Oe&1!E#5 zZYzen$SWGPp4sz+^bqDa-NPl<%zmRT5Ghha)P+RRCrO%-ByTi9yOli2=&d={7>c4b zi}zj2UHt=oAewNf{hv#yObgW5#ss6#zY>X0NzP`jje^;vI_9gpY=5%69)m9jmL zu9Q#gMQqojRpK@vhE3{`wvoyEj=tcVHH88BPSK8!0kMFl(!aJFjp>)SCWdX^?m%|& zm7_#bA2jbN5{YiTr#xd$&n)>|ch-v8F5a9NIwbrNpIMkd#7KZ^7=p`}To#L6-2tyk zkI>&rbYUgLeZ~#Xq#od$?cii@rJpcd9!c&D)yRT2c?<1}CZ^<;VHYOGo4m|6^tXj_YRF0ZZxMcWqkyioAvb!VP| zHZu^8!)@wGOxLT~!#d+2G>NUYS17wF1wvcP*jMHU<aN3LzQ_pT_kf-W6ym?`dxy&2Fw1^v>UdeV! ztd3w_b=2_?tA+C-R)1kg69RZ1fx6GOs8xGmXnlx@5b$LU zz+_@tD;W-qSoFrd7~@P)TNLut$~(fKJ2h%~I@GTbuBkaeooW<#wP2S&iWke?Xv!(g z7ztJCrF#tuWm4Gu(9;(rhL)>26l{I>4wpwdDLSFHGv$#kYL*W;tldbh-@-cu1tYAzMQlyDu_L0Xi&AQ*Iql(QnQ(b)VzVu2woBhpshA@k zJ=S~!8ZgPkWe@H(hiY%Z9UCr>(2vJ)mF6xPabMi&+)8s|@>WGVUxinhqiL7uq6r9$ z!tf2$dKG#Zw5p)!z_>w2m58FPiAjG{jPZ6*mkKWE>ybvWW8;{|UCWp9jMVm+qo*yT zmC^?mf&YjEeZe5`HjpNp6GKN;Z+I)Owotq_tGyG)X^Z{}eTf&#C2uh6q}1~>`vfhR z-LektZ(e*;X!{nllb#S919hx0d;?HD?WQIuV?!pYmAb%qq`>A!7fdQ=aX%J@=j1c@YsutMT|`HeNOO-uniKpn9#i~DVV z<0gaK;2sMhw26IRsX5WprAD9IRNEMq3Dx4bs_08!Hpj8m8d#Vji6Ok$gS$p$-&b+A zVc-%Uf0;QS)zE`OT87kgJZtgJ&JGpK2JEx;X2{Yf(FiL!W*(N>O3%Wn5Nkzg5nQ?S zDgwt=zK#GH1Es*Djkh$>rv9+j7}M-c)g{^zmH$;#1l7H@w&U5T(80niW)@^@ z8NMN$r#Fg4%kc(_mK&5((hoT(70wjD9%Q*UP_H;AEWe=;$2 zo5G(*o+*dxifP3JeAB7ml}q8=EtuHLJ0;8xhJ?wUT$sE~BQB+F*jTW^iobc%fGLr96!h@<+nHc>Oyt&Ft_#Gy6e5o)`ZEsU0%p$_qd zfF7zm7!b1X<(!Xq>u@AS18|Nc-cZVc&ki2gDr(ThuQ0-z*gDSVB}pir#gcmoWcrF_ z?G!zINJRua4Xtx*<XR%oiwF>U(-PqwQOJ0N&EEA zF50huE~Nwd=Q5hqKbO-%{c{B!(myYw!}2pc_#Q32-DFZQ1k@IrZo3n^;LlgFX^=nF zoS3{sF`KW0x^~7>EEjG^>fC&%*_Pps@f$QoUy{cBn|=lWD*<&2E0)ZS=ioaTG+{t~ z=1ya3I0YG+Lld?c{7&gpzO7G8Mx-Ll;M~L&jWWSrW@4UgQ;^H4i`CaCD)u9qp0|Lq$W~1 z+tVwjd~GavC2fQqwUo~;b;ydG&hkM`nmYMAAYrKa_uR#bj9M5Gvq+iIKs#+l6W@QR zRWr?Ka_!$2k(n8iHOZlBqo+>|3V~092NsLh&;uVQt>G1~G)c(DE8(@i#PmE(K{v}D ztR%Z3?8&3ID*qH`jM~I=#kFn3ytmWT!ONJ0*T7Mg7};>{&3;?r7u{1$KcnscdnLH3 zYuC=Mz*@^zvo+-r`p~{61RGo>{bo+CWBZriS0D68`*0z1^2!ispgs6-y|04iaHp`L z&!c{JrP7d?yhCz>xvI0(a!((A6?6y7bt(C~SB2CD4M~69XAoPbs`AOi`$qP2UTyTZm@=G)_SGk*^t4CJ7wjhJ z9qdn(b+&spRqCs{6)N8UYQ-Skz8+-euX9TD=&PHkQonGjnonjgF?4qmO+^+CnI)n@ zx2qdyO$>cb4Oq!?GwdYH^P9waDwAN3m7@iGJcXYFz0?d5V34c2+SuI&&3xY~N({{) zw4Zs4Sp?o!t%;t;6>4yA%jS5@UF`^Crd@00vT16NnGH9?0o&a+ieQP#!cOyK&$1_D zm*BWn$cuasa|BCQ&(2$FTN1DV@HlighN&}9R!8CIRY;9-@S9J(rimsa3n$Gb!svSl zwmC7hT=fVJV|?>Y5!@y zj!^VLzI2c;QnRcW7)hHQJ7wde65!W)b`^45?~>Qf*mxivyNt;*L=2tA_Z(!K8N#=n z4!qXv18$s@Y_GINZbW?gbJC0`q@K^c9_#?H8)-m3)IFRbxrT#zK%;Df2}mS;dH;Tc=wOf= zAqp=RKGiqqafB_Jf^stmYLOy$zrHC5)KSb?S!bQ=7F>ivRTsG9985#5vjiHcT&!Dg|aEI8SuM38+dcF?Vj*Nj8)IqP7=?}?38*$WBtu@X@ zTc-ae<=(da@k>^C8_57Y=G!4!40BiXs51nPJ204(U$2qJR4-YIaol;(5X`K zvkc~uS&1vjSqE2UXS=;C!UVT>SzH*s6So++ceYH;mv)1$XY^(T?l>(&isFmZ!%6B~ zxhkG>#3-LCmem?W-+UvM2KDDpP6OcBs(=TW`IWi3;80WqUapX#=HI*#6UWAt32MFY zUVJ#^JYS)p$5wIg;<Bkz8RfHQ$8*XZ|bubQ3^zRA4bps1o5D7(quh#tr|`6lniQRFp9yA)URG_o*wE z!8PjtWYj=OY-OwoqW30d*K!u^?CemF0O(Es)T)J22Z`)HI^STD0rn22H{1*9{Rx>T zK7**tXks!Z%&DA-iSG8AO!poIc*DIXjeno2?#XDy?5D=W9Bs6hYj3Wst6ss z7+mp5=~pmicEg-Viw~ePw^emU@-9gXrPWdtyzaswEh4<_L8wc8#Oqjjehsrhb_es_?tn-4+@~q69&M;4T;H5%tp*&N^PTQ|C@m&kOV>Td`DDn0;dr6 zl9C4>;QVZk^SULkm;&H{{>V8cc(l=|B#a=l68W_%>7-FR(hfv;Gl%0XToKk^)_5^R z2h~>z)Ax}2u=(q-`f>`zlFOZ+QYm(jbVMa_{=@1+NcEWd8umPzR=;h09917&3lfg0 z1gRG(PpgzvVNa^$dj7R&TPNsi(YRQkFGXi$zz@_(cQYx}q;Et+7s735$+P9tzYJYq z{PkVvOaY{$DGdx>1tE{91dzwGQ~Vm$!*vsH!BC+>SVTNJT6fl4k&?yeWSub&MsZFl zqLKskZ;_8&Ig@pYR%w(D)nn>Xyf~IY3})M-srrt$aUD*!RIZ86 zib;|xS!s}xqn5{7`+)}L|M;+#ru!RY*%CtW<;ls0?@pp2CKjh0QYq*Vp4*ygc$^{F z?0KZ&C752pY?8K_dM`f^TB_ z8_geO=n`)Ws=4La5Gkl6n&@d$R01#S7ZnksU7msr1}!M`>$ir6O=d2n2G~jA^ss@` z_Iqa6sC;%ZYH3R(Z&FA}s-PyK4T2CR2yU-g(i8)6Qc`po-%(9!;H>etG2Z?T4Ki^X z2dX)TFY?wrIq?SnETez*MWXkuDZT6`mT+EUyZal9E5#4ojF z(%26VXG?qR6atPkCo1iVLXNg_!h4a$XOy?K0R@6$Z=P(TMBXay^mlb&O6+jAjEq#V zDpF~3^{KRI`YocQ;0;`u0Q|mT8naEYIWZkkqF0n6I_o|h4gj4ZMXMyeU+m(ypH!h$ zBda!ofqEMbO2v9F$DJ}>r3%GW3O0!%fx~g9SZEq!>R+_N*<8zzGP?w0o<>M>To}L3 zwTi2uxc>V)ur__IYVc>mH7BMoQv;XIdPRPVN7;4Znviue8%U51#&2dV8{ctK!r{1V z4&wtq90|E1n*>N)bz+AZrDYpWrCAn}MLSpM!YDEn-UT%p)B-21_B`9gqnBccdHg@2 z{JvWF%IBvVfNhE7LyBIznQ8gGI%Y$PrwR_@EZF)rWs4iJ)6@($g_`PlStp|&s%-_D z23c#g_OkypW*Y~1h2h=yJQe4)HIe+h!Y1!!h&xX4noCHH(y@2)PC@M-<>VV6ddeIp+m%peEkCVC_IHC0-+?fZl zMHNiJV|d|Ws9XW-nsr6q)kJ5gHv?BJqx$G+lm07tmz%7#zbZn03|^PrylL;I?iXTf zs{YPeyi*_Jee+#Lx(-k-G;9dduwe!b!$IUBp4yb8xx}aBs6C!8=Zowe?zYb{vtIpf zY^CKq`y{oH@hCsU(rLd!Suy6Htmu|^8>|{a&U|JjHEOwVun3Pz82n>3Y6?Fk#tg2c z6n;yHq^PLMdkbz_5|n>m9w9QCnGF00*#xyptPrdQFytgY{$JQA;1lP$?NSduIkv=N z`7RZZc`?HV45d)FUHa#{c{Z(3e1Sq$FMBi_GAJnb*8d7I%4OoUE}YUI=9GS;0;n8) zS+7*cxK^HCchIQBpE+Te{Y`=KjLq^M(R&Y~=Vd2ti{-4+BxW*g=c0X*5Og?P=gNc9 z=??~M$=&SFo#X@12{mFoZ*mkNWA@@k{VzBATVt@MUaEHQGz5Ko4 zoaLQeRcapZNU#s7B*WZNX`r(f*Vw%P_SqbTYz=NigfN*!bZ({S^^Ctr&Y2B|q$QA0 zg0dFmtKJ88Vz$$d()Z`>(r6(~7vQ1psqa@YkqaAzDL8qESj~t8EFw@(apk^dD*Fpa zFM^)yljf|&JA<8u0kr4+#<=70H#LDxnAS6=jthpUQghjo_d|Hh#$}=20)0`rXz2%x z_JSMNTJcv<#^H)wFsFeJptXLuI8pSSi}BHGIqMN!LsonW?ow1$_CN2RLH+rHq4EoG=9zpPewR_1ClI$#?&TUhH974?hfa!{RP>7v)nK<;D9UjD@1dsZr<1CAZuY_kbq&S?H8o|K31#0~ z#e}oh`uaoCgRoff;W3>FLSe=MDI{9$!Q(OkAELD8!>w}|t&B5paJP?w@FCMXpyI5P zV)kMIMi>T-(fwe4F4CR*Q3C^CH>v_MSOr%)l^}(!DQo4jH{n55*~zxBKqLrNk+9(KzTjJ5b~Nwx#Dw((xcK~YQ7Y*~QV97(qDQ5*S~c0UV8NtofAO~yVJ!4LQ!rJkLv=$Riksg{RzmyXmV zndC(Sdiev!14B%dKv@&;`$N@x6W%79{W<9$W*cW{1~vd{&e}Y}`O*2Gt~I2Rci>0! zYG7zOeINplN70KugQ4}`Tba5|4oPrH3b!sjI&xdX&!+&x1^U@bc>1=6Qjj*tF&>WI z)*zcmhU2s~mY4PDn9krva6NHjc8@K2Pv6!6p9hk>0X$1HVDrYFDz`UaZ-dP{M~&#` zr=<4Xu3AyCBzj#toh{M++Z95)>A>v`TfYE&c}jTn*zFBB8sB~8jLq%P^zG{O5X9ui zU?eod(c2r=f61=^^V_3+cQo*XlS*m-9SX!R>d~P)8g_HBvVP}<>-6Y|&fxy5#A%%f zGlfcfTBoJTE+^6cI~yM2I#bwPSvi`#v*D~S12>F~Os>iA%){K~d$4@rTlGRG^A#!q zJ@j24)J|os+(_18f$K{4(^c6j0JzjQ^}TS}-cdU>wq92tF#EnAhS`>NCiv2xWItS$ z4ZoOdPT_Xo2jQ|?ZM;o5oKr7hOjl(OWF3CY!d6Wmd?Z}_I@=oSvz)Xpf2=BB{7(h1 z!;gl`O4wY%TEz>b_wATAKRdJmLA> zbmWKggjciqe8DYQ2HGC&`_a6296`}Cu~-h=qWY2`lsAvXo~ z-`emh&g1xAhi`2-%3q8Ve9h^=Z4FmFUCjDvClNocz8E84=SRT zw*h3JhMl`HID%W-F#8eQqMhBHmv`-2EdPaTA}vNOV%iI`ezNv zt{SKTw(qm3xo1YrzTzeQVk|0#51k|^IXNc&o%{@ z+>AQF%~eQ5t1IBfCc_nEY)(B{aRv5^&l)au%)tHWaWdZI^m`4(X)B_ud*(TuD=GAL z^iMpy#a^s}2Wl=&GLHuM8?~)`kd1J9B>WtMYa-hNu2~qLooi-B@8HMQd^^7$5MK3y z5FW0b;}?h4WZ;cDtL3#=a%YxVXJu^nWW|!Vm@h~(PDEp$$21PwrU6;~bqd!^J2){I zhENx1AP`18cplMRTx~wMTEu2^1HoE_9{v0raYwdi9q<6$D&`E7&mz~@j4RGIjri~{y>!Z0VFZ~i z{xe*%b;9|hy6G7ZHVk_I6cg6prAhF$)-y>(KK$dBfR-)K%t1?kU!N+Lm+;OTzLW!2 zntB3kcB`A;M(<{TpZ5hU8J)Wp?_Ab-`Ld-Q%L3%EvWgD&UtgHK^i-kJOW!NjZ}^&$?gJEQWv+8X)w z>V#kcEL!R0PR%FDTj=I5H&Nvqk+9mduU70yUDv-*`IMn&>Ec9Jdxc^41LJidxNK-u1VY61Ru8eR3MVIj2hClF*K(kt^i&@9+wTfD`5;Y=u7k~pS zbu%yfN>e}$Su!AD2JO-y>e1#$W0kc0M`koL&0g%!Gi!&va+{USv2JD7Tb^a*4Hww{ z-%T~tH=YXE3VOkTqn{S=;*Dj?wH&;?jp(`nfk1x00bilVNC_Zu7kC0mGl7z~m}BF& z;t?AnDIRWwqIe}1b`(o0q*hJ{h(2@o2?=Qs+{Hyo{jiUwdF@iUBc>ruJqYR>8tB@u z))Kojz`6t0Go}I?Er_2nC4`x2MQj_2J9y+q`8|)o9II{!7E09dfhCx1KF%{5`aPo? z>=~JukZ7>w_-1^6vS##K_NK*Fd=9?GJ_opcDlx6%4#}$qLF+;3d%p@Qg-U;-Xv zGn?i6otS=j+%OjR7$>6-1 zr#Y+L%vL+ICd+pqVjZyfzrM=l1c&oV8hPd#jhm@@!NQ(UjYOPpAE*w)leraxYp_G8 zzBhaw9HB1oK zzo2@*iXWh2r(oqWc+6fjj<5$^z|s<e>uOg@z)tZxXd&wRT{ zqcsC;;@c*Pr7+wA6)GG)5DM) zkoxTL&95vsd`IRSR&02Nw)A{TnEb5T4bcz3ZE$NK($tzBK9HbCzGDFUtX&)SS!f%9 z`CdgGP4UYu1HHcDQFc-Tz52RUvE=e{-ccp;Yqx*xcTPGqn&VXkyfpiXELi5aV9Pwg zt1oua<_!Z?ojU2EpMQ5QqUCJMDHs0*YEf(SHjH~VtzI$@__C_uyT7YvpyI(xs(NR9 ztD@~X6qhg!sd$&@;c4h_C?40pTI=7wYY1Z9@#e&IPL@pci0#(q^b0zt3*7xZNCkhG z6ygNze0dn~v0^a^NPX%LYK=q)Btx zc!~J2!>JF!6A)gje*?oE(h^fu8Ak6qkEAA7`L_dI(bGhlNfdAam0p0}KFdj7YLs6oD|vMIlpB8<8ksO^AAQsqZXX$+v@{h#!^TMpN zW%vd=Rq|+m3`0tY5TcU~s3eY_#D~%R#@VEqj5qJnbkIyI6L(B zS>7n1+N4+}wJGbRkkBCsh0>_);=5bE(T@!UE9XBEoa&uGV9d36W?aRy(rJ9cm8OBg z@Fkj=UA^*$1|>8jnUt75EE6Q)GP?K2p-3MyOKtd3jY?@pqH>j@>V{rMLL9>3klJXd zEu6C^!|>|aCJi4{)GgqC^F8vt-LqXT*eBmX0SP1)FrFq1Jz&y9P0oPE$;7n2pobww zTzbuH%zd1oqTXk6g<&hlf%i4L@x);mVYi_D87;m4$Huq>Lcv63a!QGC&d%OsyZY@z zmc|HYrQCqLb$SI>xT(cT!>ie#Q+?=aEV&^TP5~aveqtaRh^hdfJ282t;-w4^fJQH~ zwJd?x6jJ;R&mfIYW^=*WP*7OJGuK%XHdW2bOfPHdX+0@R9A(i{Q!*fJEu4P(lhBa~ zq$t+hV8e;kSFha9nPcS+w7ik5!!A*@<7c%rJU@H-++fS^n?Nn~(lb2@@gC>Hp{V>$ zIVELpjPIs15E+06mRg;kg;oN;fj|EgYE)-Or>`OKuz^45Pd{s-Bj<*dB0Jbc1%Sp8 z!H7d7_E`9dM&W>|OtWIb0sEDd4GgB)WR+<)sPuuKJ?rg|jjI52*mbu59GwrS&+v59 zB_`?TwjpT+fJ=tAT{@}i5_lGORrGzIZ4*V5TE_cn@z;R+_<-yWS0;BX*A~{~E#}TD zWS!z(@cvEx>e44GJC;(Cx0vxA%czYh8sD*8`PfnmV)nt~gD!Z{sq~y76|51P?UVF6 z>y%b33-@+!!Of-dl<6EB&2LRZH-VY=SNJ7r^onJ?9JEXwmYrHK8h(|u=NIOPXqpH4 z#)+tFTVBB-dM8KbVm~#gJ%u7~Nz@WEl6A5kt3xVXy_n>w@7{s!Ebv=d;0Hn=XtCiJ z&zcD(I-Jib;rNepP%8)q@CYJwo@`8JP-PCj*W}k_{B;WpearN#L;;wa33ORRI@`)b zXNG{GBT%J_xPxrirb2w%ut~GSGrz<<6x*MVR1w;`@C4Cmc!;`MQ7^XBPk(8u;koP{ z8>=zHOE&%ZXsw24!tJXM7UoQ9z;@w)Ky)8J$&+U{jE#6TkD_~6YlQ;1 zDeGkO<-Ar{+_JORnjjUMFja8)wKqzNzkAN|O1(O*?XO2cM!zAr&-0FuhtgnT+kyfMk{A(@xV4-ZOB;e)%Cu19ou7r%@?{Z`M4E@(pBAhSSES4AT6! zvZ*4*8aVF-iThNdsod^YX=noOMs}JGD9aC$&;q|kHyIJa`I<7P9#pADjhuc+r4MIN zfw~TGSS4DXm-S>zGNqEzdPf2jcnvtBaz%{PnsYIMa4f-#ePe*vF zgzE=}w(H?RKDKj7$8>EfSDU*Own)`?AfAp4JdWX)ez3dhfb9Z;Ds_?-V7rW&ZVcAYOG3yurBrs#Yd#l2e!E&7-!! zlf&1>W-0XC$D5R%q+N?{q2F&jm7bG4MWp-lE)UC%>US&$tTYBU@moYGsE!IS^BqbB zUTH|s3bikr2}HDNFU%}OD^1C(e%oZ88qb7QRet4hCStc4w`ID1VdX062d`4o^(R}0 z6q%}(8YmmHE%SjM!)v%9-E$Cx`uWh0;f#Lzqk@gE<7LF&ZPblt40ZH!JXuK5mJB8V z-%D%eosGduQvB#|LxUuV7yZtV=*Ee^>Y`>J?JNu5rIw+O$e^6%6M`iyzl}$4za~_n zst5c$u$^VTUQ2%Ve+FRC)l@ZHU$B(0gv7yEx`mWSYpaKC1}VPxyINjVBiUSzH%QoxXnLotqLs>)CR9dPdqD|p zInaR0asV|Z7&Jp|0RwBb<%gYfIPK59Rm^gH=;mNdLmC<%f&PoLkF_&7h1H#xv*qM1 z=9Vbb4mu;7MYS92qEW+{!WkPe-zuS?v}4vNU%R5#>wg!L zTMEi(^Ugo~i(4!v$Ftf{@mf5`oYzYR)=>YH#-FIZ<^da)ZC+jA9HQJyF|VMw+3p^z zl-*;iU=$qNzIEv_WaG3AafXuenL^n6Hu=pWuH%|N0gOdlxBSKvw;uIigRWjL=zG(X zVJeoa6q^qPwVVHF%0146c7SHzd93D$qPzyF7`z&crUB81hkRpy!cv5r+Q|!nF`36T zDZjGoj+q9&s!D3Hjq!9Z$z#E6&l2j@ZUp#z?iiN2uI1sE3#LyC@3;OAAALP%7@IA8 zU;)ZJ^ru-V69COl8y^PP(8W*q)VcbJnM36R(~Wg~3eMnUMv&JVg`oT{miS(=AKW{WLa-bFOK9(!_^H~@ zd2$vknV2&LNZHv7?=?J1s_h$4)blpc2aaRXXQ;1*l^VPNR~j$TfXsOWU$pJ@We4HF zcLd?UJ-U7b#*_d_zljH*4Dr?2h>LdmjD{Ve;kTpJVoKX$Qw8`S7gO4fm~*usi&xY> zEF(o_M~v^W+@cN;Y`K{tRfh)lbh9gtn}qUlOddBz(NL`*C9rK1VRoh|u}mn{Cy>sk zwPBLrYC>ESSR}wddTH1ES?hw9n5KN6lIbQmcGpm}N2OIf(Z?9`#6$To!l*Uls_srAFOP zJf&m=d}HML%vE6-dR0{~Fj8CgI=1VLW{ZTj{n79{;aX0*kYDG(*b%T`R!a%Ts*dP)1PaR(u6PstF*3!SE^8Svw6q^4ox4>$}D{4 zpJz7AovSn3H3mCn@e!r6DbZh=sAc+)Y$<#iRRQgfB&LRhYt$}4+-x!`0;_rkr&*rC z@g}@{!MP5P6}O6tU9?=-QqC6DzvyNin2(fgYpdS9CF>7Gfo#?qxQE#kBY&rnRC@LK( zm8e;M@kLYh(;C-Zw_Ug2DcKoBS5SSoU3beK6&X=IKbduk<&vM+$>a=h4dHY4U$o;2 ztE=szwNmu-$z>u__(|qwF&BwrN(k^PetAsHV##e!>R*>gT`-$Z>6f12Pv0Doe|aR% zWdr@}WgGvh@nh7Mc2V^7p}3&d9O1Q6s?gaZe?6(1u3BUJwXb#IrXib;cmty~kra&f z{poS`C`GxI$sNo1N3n!6u#P}#gtj$-FX;xpXNzr(#3sNQn8d`#85k%5&0n|YV?l^? z;tQ-`${H8haTk782zH3Vjr$r9npx#W5w1(u0J8WdvA#Hqo655S!E=F6H@Hz;GWJ13 zQpA7>$R^<#=-36AV%VvR@vlx2GPa}TFR5 z;##fgL|3#Nc%|X~oL^&r8k>HU6a7`+GO$01AwcsUA2Wp~MIP4JIkvEHUzOea*`L5} zq82h~diteUQ%g7Zbi7Fj)CE+d2cG{ zq)lIymQGWk8f$WL@5#-vH|Ji?Ik!!~Y7|DQ<7j6TtoRmve8G1VUzkU6B98v?9Z?)a zAOD#_Mih1M6%+=3pYK|GpR>=oH#cdE%KU!B5A~k?vi90*uf6u#Yp=aFMw(B}S$MH% z<9@Sf6HP9nHv}5HqtXB0g%@JQi(+cf!r(jf4r(-r6=BBL>7rtW2{tkYNFim~so`VHy{=lrD$@}3VRLK%pwAIZa8{wfpAGVf3sgbU#^O0qL86ShWM%?iae=NYGq`j)>Q%B(5vc9Dyhsc(h&{S zSEE-&F#{8orxD<{E9DM2{3NpD>?V~K9*@j6GN@6zE90YEVa&Sp+7`F~U6+SSToMOH6v?vzwg2XO9DVs45O- ziD{hdsK1CBum$QXg2L6WSpp^>g`0lU8iW^$kTJo1cu6CkIOyr=jBXD}K0Ul=CEfq% zlK7tO{zsP>^H6k~!SV!0GYSP}T$rGDgs4AZ{sPiaAC!ec4mbA0kD^2di7qm8@cm?V z=5P&}+_xLMp;YTys{2*E`KCcYZr%}nVL3QytQ?d*n==0wUlA`wRaY%me+=OJ0XLdL_3^RB&>Es6$FOIghy zuyRhS=MtkXn$`ZU!C*VdxL8|94SdG5jnZ)odp+Bxrt?mL5C|8oMAbVQFiv5V6+IYI zDu*|5Xx}LYpCD9>1Z1gJ^np_v5p*XRJ;sdBVnQ}Zfz9@g%|v3V9j3Y~p93u$FGXE6 zHl`nyEa9GOusf?Lg<~Z30HnN8pX{b|;OHp^>3lB>v#?1s*sn{(vDqnXv4MB+6)k8) zn;6lkJq@;LCFmKaO*l?XCM6@WWs(FGTr8_fa4P1}=yzwtukferVu#uDVHqP{prle`>(aF9tz(M^>iNhVbj&XGTEeVqxu6pmgi-L(2)4U zL=UZBiEDhGM|AZnOgsH@4K5dhj+xbS=ELB4lOc4hQOd2y2R7>lu>)6lPAtHdOz zJXpG~gEDHwI@Lx5Tex;mka?|-HF5A-Kl7h4nGiTa1uaBa&2TP7(=9B)K?Yk!ULj`X zr~o#fux22-PnG&ATW%lBrp%$y%o8gz{fx+_WM&{5j_q|4wVm2Xb)4nX^wMvg3dRZL zwOND8DN~Y((S`BQuuP@7GN0&m+*HZRQR|22Z%0GBt9ElHn-wJfIR`+mOO=Xp? zSg+m}X@hp03U#Kt&%A|tZ$cNpmwkdeqVP*%0o;jLKl%dc`ld#z^5jW4B2}swad}D= zL3yf_U(r-a{P`j)m55jwsOWpF!lg~-Vj)eUQ^}A`hz?~iVkj{byJ-h3MT?<)ah*SI zmF#sDDtaYLbVmCNWcrz*+Jw#=-cOILHhKOpjg2vkIlMKNy% zZIQ!#PD3}ZF$YGsT3OCuT{gI@$O9EZgGIc6e(f5w$MBqT{J?g_x14V_zp%MlUHg0$d3-6R$+zrb;-SiYbO^tA?2606*q&^S6;%I(7Ha);UxK~0s0VkU@VO8 zIF|G6%XBW2clsZNR^lC#N(SC3OvX-&Y^pWYbF9YA9Wu2>57ng6Qz z1p8Ayd~lv!aNP3bx-F=+<)G~bbc*@lWAji)XCE&6$c;WVQ)*Y9UKMAc>AHwR0yrX+ z?5x?-;NY-tXZ2O;;NY-}Pjw+DRI|dGzc}5bZJ7M5R+F@~4`r|!>*{3nm|vQ%aZDw_ zm9Q`2?WT@V4hZ5(GMxwrj;(af)@vCsCTd`E!P#I_V8W5`a8x8%;Pqic>J4@F_H}pl zbgQ@@*w{>^4catUDFD5FdV0FjE-*b^M{BvA-fq4`-9jpMQ8?)x41vdkYV5U~V3?Qq zgI0lfYzRqmgQ*E)WlS3b!fd)Rg6unan_1EbPOH<=vt-Fu29Q8Jkk}3u%8?(uU=R^{|tx@YdJOtA+||A$GgX z3kwM=XKQOfEFZI+#S`)_qA6J^Tk)+a_*kKU$P zy?UGGb!b;NuT#mxh<;U(Sp5`Cy`hd?NQB;Q`u0;|d=;icMouTf&NfvOLL%=Mp%-JF z%HV+W{BZxzVeVm-N~HUxXk)A7)w)u)GHuM28=mJxAhAM48|LAhJ!Tu`eJCZoJ&w!5 zL?3jMQhPtt@ug=PWI73T{C_kN3{~o}*aiHLrp1G2U>?n{djAjZ9Ibtt$?X5{?4xm_ zkD($GB{P&rR3{03NlWKa=#V_-QtMl{VJU~Sq0D=S@f)&*+O~{9W2>7(T*%>UifFjaK5-InWQcR2-l)c%UI8>waF zh_XyqFGJ~(PfG!8M6NwMrX<9{?LHfebbEAjDxUqwwDE?-z=JP7+@lgLG98 z`PJDAnT*4Ji0MB394>+6=dD)z-PgCZu=Jo3&4q`dyI-7Ncf5z-&^K2crXEDInf|PrPPI2##?f1dB0H_s*kSRY@(%02 zE`lIF(I#Yk7nm)H#&`&MFb%_%&=k|3CZ1(3tD1L=0!EC?&^2k2IB29H9E=JVJj>V^ zl^k_7#Taw=Ka_O5YJ6N`6?DjI4qtr=B2vbIi`@IWXJK#+BqjN)W*AQ@XLP5c5~YVUxOBT;=8kmdSK=B z`=lIW$Ij6yyxJR$#Gt$m4b)`Th*C9Ng_1YUC->O--L|)zo_ZymBQ06vnuj{faGkcs6{F^`QG4S^e4PRvk#rGdABU z>bh7s3RSNyMH_pr{OfbTVPR`{Qg^TAAE0N?7~&%#q4E$;B0PvrWpSAhPWf{vd+y>_ z${M4^(2r-w+u4&_-?5>q$6h~b_l$N~9itoU^&5J+dV2asM>mXiuJ7K^*}0*&Z+&*G zE1T=ukX=8vVMDHKth=*!edm~E@24OAwMlChoQTb(1|+#n4Hff~Z}{YPb|>HdOa2m|Xc3f=wSSm3Lu!-l!vwXn zQBXpoQr{B3a;Z$beu>6qwNVMBER|vjqa~VD3BiG&Sn^9WT_*`8%d;lvNS(}0v31}m zqU_UA72KH7=Oc(W)ro~YUv#37Hymz|_c}9mEsPi9Z269xwIhqW2?1oRn|Bo2t|s4*~(%ZWFs4BSX_-26o@lIfr8B*e7iBIJ$)@1*~u zie`&m(Vlby`m9RutgHYk_GRLSOxu*#2G*#mU5Dv0Mz&{G^i1BT9cmA>5 z#Y!FWoWLF}kI}t#;$`AH`D`&~x6^dJFr!N7pd(R2DN9GympGqoW9F+L#I_)nFP5@2 zqw*~`Yx_ab^XdBf+g^vRb5OlfmTpibFecexl5SGp;7ddvnXPZU4CVDD=3DF8Hz`%H zM(u)6bM-Pk*b+|n)~gGQh#r3Fxb4#Y(W#N04K^d@?Su7ldYAOP%F)C1@VFvo7zCJ{ zUh-rF%}a@6IUQNT>URq3zfVV(&`}@;9mCxPaQhA3cb%;y1$_XK}l}8z~Fu$lwZ4$~%>R)O(0i746?6KSf)c!Qg z%Sidqct5!l{ao}K+tV}J*V&Wn&8_e4>+T%0+Iu@YdwTnNt+8%)Oya+H1FWbdIg>wAT0Rr_Xkog!(f!d~%EX$#?wxE>JpLgijVA-M+yj zAH_|)&$G3F_&(r6Vqb0?B(gEIsuin%K7mCf_GLe zz|xeu19Gd9#wEI~?sf);dmDJ3^?aI|%1xp8>(rNWc^to-j;a*AuZLxX-lT%8u?M@IqifW+ zYabeP@~nZ-wJMD-hGUVVH`mL$>bTi_k&dZ+$G0Z~&!V@4-&^p#!yTaOl1YP3p5Cew zaRq>-#M_kY#v2a|YJz4|nS47-*Nxe1*+bB%cd2xi&%CO?yIvM-t57Hnx>m^_F9vjd z{R{EfPzrcr{ij*Aej$NwRn)-hVCf3a`V*A*5~D&1E9mcL`VTiyY>v;JwX#)qXs zDbLj#DkAG+_tuL{M3}x^#hi_G>Izf=@$h`b^b%3n%p?9HwqUVTtfcN0+~v=aJHh11Ecc-n3kL zf{|tl9a}CmN<~JkBTvsg$LAm-7;uQYn6k?vJPB>A~ef!$Xd%nxg3y9j^tP zgE_xAxSOU|2oQYk9-t%YQ%xQ`fOT|*C<`)gciV0b)8Nj7ZuQYkD}S~fh-7iDfM^hO?<&!oKq!B^UC80F z%llUe9m7O=aMcdcpWp^_ER`w3To&mOCoQF~>R$XVoZUEJ(qNAc@o?^{<;KyxrsOD*wONR_Gp_`dV8 z((Cq07*Y7HU=eDWyIRa!#zpxFeh{*XZaJZ%M84yKMr!F_Sub?faCPp3r>19gSjq{a zw~t|74AV^N#tSewp}9$ycQ3%k695LD+o+6Z z>>d@foAJUeb~BYZ^W23dt0q2+QHXmR=PiZ-FxLM~ctUd_N@|cY{TY)Qmi=hTGy01K zj-!i%7S3xrGO-p#%2Zr1iFM=1s~}n-W>o7smc22wdPmCsdRO714Sk;ZmG~7sJqNHp z98LJ#cjC5ec+rK6Bp(j%r?uy@|6Yi@U(OZt^j*&|lCC{>sH-z7q3lZMl#C*^g;WS! zUXrXKqVUF~*?Wob!z=HV1q79y)qU^i+z_E8yT~JnJ8Q3mW7<$>Pw)Pa6+&{wkk{GF zd@x;^qDw40`T*a_k$QTAbz5JDvBu$tuY!t3lO_T<-X9ZPUU6(Ahd`mPU1N|@C=De0 z=#t)8Mu?-6J>cUd1-fdZxlgIgH;z8AEbFZ?3xK_Vq8uo7%0&1C4LtH%4(G}F- zcF)^rb|qiT*`wwB4mV4`sfv(Mz?jas6iEEu7D4x>rtO*^=BdDl=n2SB*v!#&>p{j_WIiFYIk>oMq6668bN#n2ic zJ*TgmNS~g}Z3xej49!>7ykRp)#vjtudCH^V9BSWUP{L%Zs7S+UBTqN@ikU0MR#DMq zThP#nj7C;;cQZK$=y86lSnTAr@iV@NR zJU5!Z#PaCUZ6;=kOhY3#1u1XxsOdxdpjOC147EO!A7jYbW0VoiCRAKiODngb`H;SX z6%DSQX$Kphy^YE`D1#q`tB)*U+GT zgP7g1h@e@^w~Z*EAKB3uMgg^+4{g8taeBye0>IdcWQpFuhX~wFxpfe6l@x#Zjz%B> zRi>lYX#M_Yt_)j$d9BuEyyv0EP^i&yYrMag8_gZPHEzM5zXRRH&E#49GPG<4!=y2m ze1$wvZlUnOrlH=Ro~}rxl$tj^-uf_=Gu1~N!j`B3z$xV( z!jVYD6=4mc@B&B{qv5?cX{6MJX8$U(pK)O$%^r?-@FDY&cw51_=LL;a8N$XZ7K3m* zsZog>_)AtU6JE2(95yeGpe8X{D8<*S<-$nwQ0y6r-Equzn_T4Nvj|}PN3(+wWmT>* zlN?-Qqf>W+ExBgJWKwm$d|`}|PM&KzI}Jjb?QpIcA4kd&kxkVl6!*_cDvWvYY=8`o@sPt4qwFLjN_IT zQhU*e@Cf%1v#t34upj!z`TnppuIN#+a>Lntak!mUedE1Yu~8Z!+$!941@8M}_^8B3 z&3>=ti#HHkee|jK$JXy~mH`$!m9)_3WG@|=kw%^1pq<4L|Lt&+ntO??QBeUa_tLT- zFn9gpqG|*;3K-kZVj-vB3CP)nz*0R-`T22&l%s5@l^7sCcu{NwilgN*!ZBIP?9EBk zJ$noX=R56SyqM$XkLlR%Y8X~2XmW=eUhrZ(m?$B*zi+l03R;zkGp5A5 zLYZh3RH0pe+sF=mN-4xlNz|!_L!gmD!vsmaNOlHW40kGNG2;EIn^929$$c zfhH~e>NTfG7I3Cdje9X7V*)!Ag(~yjy7b&Ff{ujq_k1EbtiuWN?g2IXS@5K)OvdV??o;E<&<(6J;Xz@fR3BZ7YC;%MvDdK za@*VJ)8ahOwcVl;2|QN2tO=W1CD-PG%)ly3e8jKsR`M)v=k#bm zD_S4jYYqd91ddyvt1kwr)n7+FfJKm*v8G1!Whj7VH?Vhe0Pkm#H>E`wk@#|L{VNk&(lC0woiowH0r{r#m^|k2txK!% zUA&B;)bd3&x{J@j`9Yrs{vGjAyyi8Rf}4hn0|uQ>A3I|3NF;g6E|ht1s42A%0u?OC5&&~DoRTJB zy8MNpqxv%*6p0mz-Vy=XwS<*6s!P~t)OgGWv*UJdkL?%BUKZZ6flYhL7~~hrDgh04 zeTX1efiyn-MFw)sL)D55yr_|mBrcS%jtnW-^3WF4@veIJC+D*d`D67e#IUai^}*~8|92IYEb9k9zKYD!>(0_gcfk^+kSB2@{{Edo=M=@mqgNK=e?% zJf*b2!XsfPJ2z3xJ5)GpA- zON`N}G}KpCFt(pBhzzr`GZYPo&Z;;RsRWaL2`ie5C>hB{;HqWgPxfQRRhNwm5M6T+ z_@KhM0J>OPROB43!*oFbeIZ{KpJB1(2K@XV86}IPO+Mvgs$CNPrQ3Or-SDle1%C?P|g04av zpW`i#`V-QWUEdnBbySk`GV$+oWDrbx!JCHvX{uuq%MozA+I(QH88NJJ*?f_mec&ky z5oqu^9wf3S1HB{lo%}%2O(bi zi|Sn_Fk97lGkDCmw>tu-E9`Y9>_u0yi(@s*!rf8#W<2M?fEg`kIs?02bwFbx6j*s5 z$+5{4;p^?PCnHln2*hs+MFn(+HkHQ!hBt*#F3u)G4BTR1Bhb#%#*C4xTt}W5IP5GU z8a{po?xc^}%h@0kJ=5^S#KVmFGfq4!hc(vpGI(M@qIvdbmxOff0aFk@F)mi{xLBd+ zh!Lg3BX$p^)FEnspD0Do*EhYo3ksHA0kNc0tEAb*G0Mno5Vau3jn6;31~tKPwEee; zzmnpGmPT&j8(A78)V6Uci-e&e;mP)dHuIO&X6U63+eJDh@H(zSU_(?9qI1!< z3Ra9amB$vj4}(rGn|m}1hja-HqT+y7n8@O`sx64ysq|^nQdN+BMA9^67Qbx*Yl&7a z8S9-^iH^FaNUO-c!JJuefZ+#f5cI2I&lfNy5Yu1RbrbFJdncZj{0n zpX(-fNPFzOQ**47ERdi zb1O(-Wb-XH`gn0(dQ_CH{!|xtG+7n_wQY~+DJ3|OKyXsi=29hrlJ#h3u?DpmWd+(` z2OJX;F*W!x^M+t{Wd&~}TT)=YTg3F}<@ds{IS^-(1)d4xF7LETyWqKUUuj+n>LS~t zW4ADD|j|Z9|k%(YLg3eOu2TBV^GOj-259#=sR1Q|mIyyTxFKyWO@B)o4C@ z)n+CktUc#?ASO(REN|Fe^$_0#GA?~pMS;LT$J^Ih7qIvSThchdzCq&R_MkT};~1q( zi4<6)#1bsY3`Y4|y^2XMC*MbWH1`!TQN<;n6v(7Uz91(ohRXtMh&wjxLogg}@7S!o zv*bir4#5)4DFD~|l|~!MiOe>@N}Fw(eT-dovrWRrG8iDRpU`n%fR3rZc*o3QvxaCl zMJ)_oYMBCko3KJ8`(wgs3Kng%WIi+M@=S=hT&{n?*a3zY_n8`Y@_U&)U~bRNWN7*!J(EYMnPag{~fBtYiyym1L(I%B1w;&p1KC~g?Z&_Czkyh9%q zTGR}RiZ>oyaC}2czcuQtLrv}%`vSvV)Hu`Hstv9C+Nt3`p8*X51IP{_5wDIq!9dyb zi=MfvK~*Czm~xeIHkxHojn75sM!xl$^uxha$=+=_9-OCmFMSxk_9K4~SAuH3_TN9m ztF$;7EDqwbL-YFHS0JL?@b$I;uUfWFvM>Iux&&3*7k@DTj~uETLHOn`rfzF`?m}Ro{pKuqt?)NIY@IxwQj&0>>gP-FlKrky6-EfU40!&Pgtdz zWIendH#goX*Z>c-Z69$)B3Q zTH1Q{%P@QVsR>!!e9D}87%ACt%WWbohK9O(H*|D%Z|Lpl=?XYw-UIwu z490DbmWAK`xSN}#<+#tm`Eq$nc_jJ4FiujGHWu|>wfj#m+(18+$Wi_pgLQMmU>c|B5;sPvgE{47UysK58)RM@er4T2 z6a8Rrn0IC>6vx5buvMN^;W+Tcdrye~5*q=9=hByB5cG_;3u9Zxa~}Q6E9SwTbB$+8 z>|rN|Z9jYJQ_AKAgqj3Vdw9aij>9YS$vQ!IR05Ht>|ycj6dgTf50}OfL@6VCOMBSo zPqo#w6;aw{=GnvcII~x`23{Js-GGyNqa?RHL4Equ4@*2JN$6y8DVyZv1c2sOR<6u}(qOA*GY2xH;)-ECt(A=fcC)HF(=)sJ>)*qfp$^?x zd|rfae-9H~e*{882OS72FiwectvW5$jAE}mQaRffM5{YN;rJa66T6+SF|kY5W6DV6&(KR_@QwotV|Z@$>m4;P<`x9w z7lN&l)2S-P+!owz7X_HN_s0QPk%bSA!V!R6?_z)R^E3Opp?30P^h2!9$aNUwEUuD> z(nWb8vy)nRjp5Zs`J;DJn_R+#S3KWQG&FJ?DsZ@GM0;+TQ%`9`W|vaIa$I?G>f8Ug zl3GSyC1Nis0Urv9&`7vC)G~8LJ+p39!uGtPCx&}!+qIHf=3bcu!bM=7v3*~a-1Z(c z_nBnL(PG)n`GV2T_X3!D1S@K9qL?ceY~BIi_D)SbHg{RP1u;k6nf(uVgcL?=pN26s3ARal?eG1n>N{CTQ?6vQswLOf@C6@I&?5q z8Wxbm`$Y+{!Eqp{>DcQV=WR(KoprPk>IwT6<81TiGLX0}sFjm%&Ov*uuAH2~dJTub z>Az2^f+2L(&%b_ty+*3`K_mK^)C800n)lSGY4DFIZMc$Yd+XSGOdtJ6tm)qqkP+`x zDcPEyd8gu=%~oLPH5Q=|8Zg|H8n8;##6OMUssbtZkB!t?b=vTV^AmrWk4RevB$HRT z;J5w}%1Tv0!WfV8#CV0U)7o=cVA9>)E2(An)6!#==!-B_Qgr5@8mVRWMZ(Hwa;M1@PUf)mb+#bDRA1*Sds7nH#qJ@`Dz%-H zVVD})^h7mi6=j#dF@alHVrYL1UZys@sPx`9VmKfvwM)vTVzEHKdt)QD%q^4QJhLKu zX`0TKJZQD&z6n#{pi&#@tcv1aej~#COu1njZgHSknj%V5QTMw_cH^6pxb1MU@p$8# zfSlsB7;=)oG(A%dJ276x8j|waigs}CqN|hs8x75TRC*d~NEKL`?ti-EE<^`a;pg}e>uE8^x9}{2|O~E{oo(m*5YHFD11J@|pv#}%IJG9x`P3x~oP~R#zdAGM45hbdU zU+2H(8qhzSssKqqw!avmbvyYg|<5VQ`dqv-1tR!pTD?#8Ma9J>xpOG|XdBSJo~F7NrtWY>-y?d_Ti{iR@MD=9-WuT=mZUEq(@Ykog|##3*^CD5 zIR|mQo*4I(KW=$;j+#F3mMSpA`fJ}}!XDt0+@^F!!-N_^bTdGx$PW7wC`y%sZ;26w z6Sousde(KI%Ra$S1{{3|^V`!SzGO0GHrtn#ZA7X$bRB5I$8i~MF;(*HgVe^q)nLW| z{V3KC4JVVHK1+c|Pxe|)fmn3%!$&?f{KIu|;^>OcyN-20p0DaaeR?fJ$O&icatiDu(K6R64avMVa@V{q#)*1B!B8!8iV>Aa3j0Tx zBQ0}kC6L@CwL*(&C}J5ez))?RFDYPJ{*{Cfme<_BU)2C>FR}(MG(PZlET-y@nJn4T z;|Evc4&N}*b??ARI!udV&&N+EI^V8l#p4AfdhRqwMBwFN&`z-&Q@>XHDTwZlP*Qz*EO7?q^`!{Z{7v8hB~?>f+vpXzX!A!CtfAY zEEr^`Pl+?{QJfRSHx4-T-|IQJbrFdIE`sGabH(BF!eKE}_tOLKHhGWp!Y#uI12s4Y z&kEZ);?16%KI|;hQtWUj<>8W1(=XoxF?Yb8LUYvm+%g6(kEy zloPd>ual)p7A{QjS%6qcnNW_Kb38j6oD`P&>P}{;qnEXng;!IiMaWc+&p{m3;Rr9$ z@n!GO`!L`qyzIqWdt#{U$8@L${`b6#`xAt>3Nq0i`#C~%{UTMECr05H)$zM>IAc6gXk8r1X9zkk6<;?=uqnwA7vB9 z6Jz&h9lMu*z&zn(Z3IJjT$%{grAPi<%or)9M5s#{NsaLML4Wka(8=Sn^MuqT>ij57 zc=tk)r=;!v#2_B4OJ^QbI}`Nmr1<`^=;FIR0v+J7QU7Sm#~Nw6ZgqdRj4WHqnq+Hs zlA0wBNj|9PHca&Tk3kSTMrx(vKdr>lT^|KW+V@wnDI_Q!(|+mSfYj=_E~E3+EfY1N z4BvpmS*YQCY7PLCrB=NXQh-f&ufAf4nOf2U$w+f;{tlan{B z^2SPVHnxNc-b@T047WOhVH}01&VK+PyIzDH)ItmXp{NzSVY+P7v!pQJhMcJkde@QOT^61x16Oz~*E+DaF7*Co99TJhV(J z(YDy5hIog-HIKcuM)P0HVxv!<;s~4oXCw_e2kfcp(kWSxFG*G}io=liea76toX7w@ zK}{cuFQ zPt0yTyXlV4nWFLu)>}O5Mc2>4PRFgVJwfV4llrBf#RlN6z;VA~ss@{lammY$wp#eX~k)IqtgjE1q;I**<6I3YKr=iaZzXP7AX z*Ar&x1^aNz7eSA9BSaULo`ves=YY~`GJ9Uh$_q5kOxH4Zjj(ZbD;3kND*5SsUuvY5 z%nyZ3iAf;a^BR@g({taJnz0F>H&fKG<;$QsTcE_5n00f?@JDqERE_4=f9W{vP4mNn zbtz*o#_Ji$ldvw;YU-{pRppEYN&5$8jTzGo7OVlbs=b0N1bIJUP+BspW#I5^T6K37 z?$zR_G31!B&M%DU0(>okp=CD2b76?m^{VUkJWgKw2{zJ}S!I)*pBN#~d8`ugql5i~ z!&HMBAuUH8-_8c>c3MGp-1g{96z9j4PU_o%-Okei88%kjW0EcWH2#%@*ApwVpoxN6~t| z`jyCQ-T4}zSHHek(Hnu2o_m+-%7o<~Ah|x28g&9+g-}8yn{pu_b@e-17!|e*=E|=u zBneb$?l~s>%zIU{!$f1C1AZ*VyFEz`1@XsUNzQAtMY+^nEVrEn$GZDp40>#$qXQ|l57IyvtI?)2>Xs`4stW~ zyd5iPIvWxH#!_VeDDK>xw(d#PJn}Xvg4zbjalfN08iFF4_Bl1CmUSq{?_r@K>y?@9k|V8x4+;JLDGucf*j?xjavvYN3yCHNsajA+IH!T^XD^*a>^_8k;{1v8F^)+7N3_v+h zu?=vaUssgiDDzf?s6>DQRdY-4%CP3Y*0>C}_T2c&6)IV0&VO-rkKyl~FXrsga(>;Q z9Rv;sO>0WeJt}mGLci>xh8?#Ke#;}Qz8lLvfDA-JZMnNb+)eWdt6rA12g3W_L@SARzd+v)}A0yMIEc3v$lh9SN4yKp9&m%Q92!iPLx^}GijQt177`l}EqZxIn1H*e*!!*=G(@_Z`NxSK+$miIi9!z-PZ(GoIC+d8##~N2*Po zW;U%>nK~*Y&tQWQnCv5;zd7kN6pUcYhOSd$owHg93V`; zmIu|gp*5BO%|c)X6{yirz;v##hk=(Q=zSveu~+6W^k5`F$j7EWi@0+afXXvUCR}>ti_FhS$_GdukzB{o1VhXOqvt3WQ z%OpgY+#XHgVNwAgCWvmni)C+E?6=>qFrb?^=6KCex>5WD26oSt5+`U8xA<^c!w(Pu z_(|U4tAW!wcP%9Ku*viJg&f|{*Ek#d@^(;4JVIkliUXMhrbJT5lXkd~7bw?%giw5kxtP)DGE@uwY_z$6E{Ztl-C_eOK*g{)+ z=0i$_7$bV?HiQTRvRWf!9BB>AFO(`#E2zG3xD|d}B6G!Kh$u7A+;3zYBHbB_<+2}w zfoiDaScI8m>h3SY5}GC#-lx9{u$qTDv0LFCM#6kkk9~+dvt#UG@J5c_ifl|{ovOYS z!Ktk9)^4wu-53NOUHhZBSV?3Xu_8A+o)(5%+=JBgyLV%-wmJpdr?yR3<705jr~VKB z2z@w9b8*Oj;P6^23}Rb5J&K6Ox>%E1D&4s!L}kl@uBn=NrRf6H5(vHr@wt ztO7NS&Y|nOIhZlE3eODMf$!uf9e$PaPL9@wpV=UoqNm8`t|EV(AzuT?$zYd9sjWrN z&U*+JNo|t58(`WccX!UVf^px;Q{T^i02BraMb}28L!bI#1f$f&E{B$pwCyU*$?dfG zjYFSy|C({%W+aVQByC}%_n;jBm6A`>b%M*riBZRPg8{4L(~&wEii>@FfQxP2Of#xn zm~efaLfpx1-Ap&s@%A+uGL!P(ijA5J9b)=B+s=(^idV2{)4y8A`r6RUgLQKyb?lvcVjy7 z6OauT;dcas%YQxrLB&=zH23h82VuXGlcS|!kh-vCRgdn*P<4jfm9nUADu_7lxa~OspJFv|Qmkv-?Bv}heIQdd zdU>DrMeT?@;S&l%-?oPD6!Kliy*t8}3gspw67*9jlTM)Yhzw3RIEGyIfPM?b53K9~ zX6|;$4GKQ>$xq*AK>g+y7u_x?Sr$CBo4<^1g+2Ju-R4pdrO*7>Sd5~@O0mla{{y*d znLut7>rlJgSE}U$Wsd_T_jaG3*=bFx-BIK`ocd#hI(gW9JkSi58z%bIJ>c6# zT6B)5nJxE#L#vw9=j$o;{^ue$Z}UR9`9DokEgoMpUiUmA;W&Vm{u8RRnzV?lf{@E) zpH?hgIXx$W=Zp{>2b48bBuHpTHfxG%T5BVO1j4GHG}4+7YC=^HB_J>v4(MoIIy0`+ zl+E@*Ju!EEOHEM1vdAqsv{nb*Xqv7q*ai-v%!wYJ{$Q(0S+br`=yHyTWBM?f1~jSgw9 zUJIxTD*nd2`2}Y6+^=N-Ay0)?d&<6*w`uskMr!F-(l%stm3g!-Jv*To{bD>7K=i)* zz+i*?(Ig)`tx3=KDZ{Lg+QA=f>LZ67#lAayd?@DK>9}KsKr`=7>!tYGF12>~hpZCq zmX96oDEOTA$>&97`5ckYoqpbTb2J`)dD(+hlCNDp@1K2|RNn`){vn#KQ(q2$9+A(8 zgH_jaKTFI61SD)q&sCWS7tc2lP{qFwYhdL>xba>?)<&bEW&oy1cnlQfUL5%R9MrL& z8lk6o}W-=SuBw;( z&BY1JaT&swBq<`CZa)2U%>3RS>}~rvO83V2gx_fNNXeaxL5*q6h4UYK?Q4haqQ=e| z@}HxO3X}Uz9#3=K@|g}q8Wn*+l!8K3)M0doY3U8W0C9$C)r0(Fx054zpNr-78WGY! zwd_-?$mn4@BmbV52sPR|?-yVmZJuBQ5Ag2lJU=sla8eFpFJ}&$+5{KUD4~$nUz>;6 z+oP+KgDx+PlM=DPwA2y^xBURlkE@ci9X+-Rgnetv-0MaBt-&N-x3lO5PYgX zwtXOHO;u)WE_;>=9lU(*QK=r8F~s{*yAr{AY!$swyy(5t3B8IY_Z z2x3c3|NToy&9kCjTCxV-4v)bzps z!bk^`)Yfx9e%X_O?dGWeet!HQYh}mr!h;uR>BA{o+?*Ca{QV+;8uei$PAA!)69=S;&b!Z&V`ineu+?+j04LFtuPJWQ1 zQ+R)$a{O|TrIq|)ASlqL?hi+ou?Ce|=tf~iym)Brh_}X>e{018&Sa0T-a4tPQvl7g zVBM;@grfJ z#GCa6P~`pkCA~nhB|C1pQj?KszUWExdx>~j$t<`5uLXV##nx4FeIeVe59Aj!}N;_!NsRYHlBMvGh1|V zIJeH8Cb{7T0c9C!PI3vfZvuY$Fw9aVwUYqKW>ybDu=bb8nFm#+czhe)C+F zJGbmQ*<#LKx5skx_FlFRe)3tUG!s>N-~sSpm6FzjU@*18J+n%IzVyhO6$|a@=p~wZ z5R~2nimd(veqLw=j;o$Bm*WjOs|uX-gRIWPa%4D_1^(d&BcVw+Ih*9A>I7;Xz4ZAic%gHr_ba^K^oIzq(M99c)k&+;GuIk;fo&Ks zWzSW3X;W^jS6!WS$sc0$8nAqu2iRc5Xa6z6to%oeMRi6DDHZ`So)!enlDKWQ3xP!q zV*nbFEUJG09~!AyW1Qpd#HzSpSQ1ss(bhkj+!ujC2g1GS8c!auT4#+qgMnSr`v1tI zGCRV2&REf~f}St@9cB!STQ1HVmo?PSs8uq|gWVe^RR5fV{t7rll z`oKe&C!dl6XC`yo({m)Nm0JF<1?9AMt)2q(oy+a;vH#!zUhG#dXgHpoS4u!?48P^Y zJUT1c&c=s8NHf*Gj5a-tHQ;-Kd<-@FGTNS=y+?9Veqfh;qDvkIr?5-iV1WHeYyR6v zVf+22slfKBU5*=pmQQ_H(giP{`uQV{n0*=j@F8Ya6S2T9QS0gbYKH*wrPMP7XFr7I zs3Zhp8iMybuVpT&{! z+}Uar;Z8wJSxR|!K-)oNkkHB=7_bTj9IHSpqoWdx426^oJf>3ol2a(qjQ&E+-GS%R z^>wrV4FWjs9y`w|H`JZdj%B1+4s_BdBq>H{MsoRon;bCe1ee&^py<(>M_{PjFEb)! zf+#wZx~QI&s>H6_o09Y8bvZxJem%}8E*dgLS0ekve(8V+wG zuu^3EBL>|su@G;oHJ$m6fWw;|^S>x}-yd1U(t|0LU;c17Xk)b`m&uz?G4kRsCFugsps;APTt z|E$^>bBV9GC`O_N;RMUeUue5pGoE%qmKYB)%?6K5twXrqo7DjHCA0EkKJQ^*GkrPIm(MSR}D5)VEv4NVG9DAV7A180Fz%JKZnhJEH8#Y(yaE+Y$lMzkdVC3_ndpH zZdLb;BqQGA%^yT^p0a|^{RLELjL)bT zP$mW_1Af@Ct7V!jj4fBPw9~5D8s5m^%7_(CYLl0hL-A-whA6wos!;E%`KKDbD*R#_ z`yjT8YTW30?(v$}2xv^LWVINY*gr=Z%Ige9!q4vw92An`rf}YYjto6XmliM}CYPU4 zuYb+5z>7FpwT^p@5KsK)3Nw0aPlR~)<~Cl=vCMY<=xK>=i)($l!{DMMGhz326pDIa zg!+NU3E!&O{D@TN*KddRvc}=rybGEvZkPdO;XH`N0SQvT(XN-ygWP>v)c6u319MIH zr2|h9LE$4`3k->JTy^Cv6ZhW?Mg1+;>`Rt0W`k{s%Ji}o3(W~3S?xZiSc7yucXO>C z9*-c{~K73&leGovstIHmhBq&l60ibiLTdWbxgm?zA^ z-MIkjw7pRmALwX>_LK`ViPd%s;;8lU0W9$0tngO6o?z0d+p;rnCmIyNJ$YemN2$21&H0M6W)(WWYv$hs(iI2ddzQ|*+l>JOpnAX@ zx_I`1ns+>XYMV`$rtdpuS0R-)DPlLc1*W=<-Dw>S`*d@bZ@Id|~QoN(y%q-MA2Z z*hx9wb7IPq(0<5B#AVpe9`df4Z%V%)$kEIgOZqC?~vFg(zu@X3D(cR1IRyf&HwQe~+ z-k31Yj_B8#vq;YY93H^Zj*CRCRT*?wB56Eh7*m%!-Zc|J4+6tE!0Dp-3yXu&Q|VnV zDVelXqO>#YdPN&^XAkro-PL&^WytY2yP=CcJ(JeD&z3^Cb3Rbz=gA`Bn?JzCNGH+nMvlY^=%*(Te4CSM; zp&f)(uYy;k<*f?o22HtPjkK2hdJ=7Gf&VgbBAUjXJqDC1lG8xN!O61YcZhXz1K=r{@i4GCK7WIVj6>jZQsp#C&>jhL$8^SkDt^ zDqfnI^NGjvg{OI`(S>dA?*CmxBrV~QQFFe?pSmO~ZAL^=z@j-IiPS zYQt5FJ?wg*87rAYg;A&CxD(#sq*E=^^2-dq#M)=}3RA{wK8Qq$0-XYfqn0Gz>GhXo zsN?ZQVYP2(g6vaI$jnBqNry3rn7DR9S+k%s!3R2Am z!%4BTKfI@^`Zn&DNgMDDGcfG?p!Fb}dxnST zS6%Q%d{EpL@zB-T{e_tx$;(cZ@vQ&oQh*#i9!!*V9L(tP0CouF-?0?qwO*#;Tkbm!gGK3ajDL9@6{@<2XN0kn> z0?rJU;U63xNr5g&M zt9eoyB5ZZsa8*$)Tvrt3vxTpV;UQa$)u%Yi5*(fb!t^rj^jjf7sq?b2g@Qf-LuX&~ zL|p++q96zeXGZBrT}PUYRXfaup(K+Tt`w&gbJ zl>h6m@zzwb)p0G_bVZ9YiE|aqe4%+t;qxcT#PNreJvvd=ahJTwEsal0d<(F}$s6>KJJ_+1Ze@o09NYT9=NzcyGwm!w#_$Hj$kjhtFFDljB zGbp`KJV75=ZqTwkT02CR%K5@$#K^{c6Jlo*jo%+JS1i}#`Aj(ci85G_=I7D&$q+Xb zFP<>f|Kd_HqxJsp5#N<<-So-+d%Vpt9h7G=(tcm9q;Fq|$?^9F9vv0M8ZC>^s0%c3 zBq7R;+o*C^JUK&4qbjrP+MJ)>Xd_(zZy|pElhFamW+Y9m2lLpMRaVL6UeM#)R=Mo> z?A%?@De9Vtv+BNAvV#CFFFBZt4E&*fOlApdb3?!6R)C}I^}v}OR0NBQJil@ zz0f_6tE;)N6;IHMo(lc?Jv0jE$_j61uv z_T~Qr6Q5XfXW2Q_dD(PM?5SJ_*Kb*a&qXr1Ps_~WUQ3IC_{_%C%K*k;o)i8*KkbZ0 z-2b0Cm<`OdM}Q_&mnRI#nWv!hO^<*lTQ>Bfr)Q|E_*OCSm+REd!t{Iv2i|+4S3f<2 zEh?S={HH^WctH>6KItl~V{ee22MkW#U!W%l*lZof9b69T{93Zmj{Bc z6jkuN$o1#gr|XohJ{P~mCPs2y9Y*4|YZ%|SigylW4=LKSiZ>9CUJ`p0uA0N6fLm~R z-wT=?Ofz8I-yOracn%n9Uv1c_+6;j=r)Sg_q25;;*0~?)hGfAtdFJamyr3s_{kIqN zj5j8VdgFHk62LD^-25@#nBZ&Auru@h6;SQ!Z|hT0WvdjX?T&j`l0L&|Zi&&vSp$Wl zR#Wk2_O5DK2kP#$k5W1prR|s$gfO1QSGr9A( z0G|z<%8mwQPU8YUO-1(ut1zC`TAg~8hr|ma!26z|I1EgDAK#OEOd(c9Img(p$N3hu zTi<#WUtbT9npg3eQ2y~5JP|;Cpki^Kc~dmr=BLN%yUsA$$Nw!`8C6D=XaThh$!LdK z0NC^h+A^@Jg`Zd+;MjlDRZPXLTn1Ac0d?YX63Y4wzKbL`{D|(t1cLYX=w*M(Yunam zJO0q3v^OwbzO#3c9dRq@zk4#2#{lDNLS%kw-Y(K7qeL?HUXx)lae2FfW0|NhW)?JZ zUaShk8rkQBlYBhHl3JaGnRg18vPKO$bqySB+)d2t4o2P%z+DQs>v0s;9uId&ztx~P z&gkqFq75**PG@22&WH@1NKfuP0~NaDnqDQ$zIAlab6xsEFLaVIY;^`6D-+_BH3>ly z*6Jef@6AwNZ(r1p%oKuLOis$yz{c@Zbd81{)9(8U3Pn)5(0!13^~5-hV+|0Y&Y+b!492f!_*XcF+hD-qXzBJF?8!1tYwsz0pcjf<27Y>lty60|k1jGGRqh-(Ze8ypX)A9vFT5fRw#HJXQ}LK0s^Tb;Cb%fci- z=cspb%^6p#O4HjxFo$sd(KE1+N4OJP2z-SDU+499T(&dzM(OG^i~-&nlLaSh%?-S% zG46R)+0$@zuorfYWcSVR7)L`6gXJr-fw7u$Y6GK>^1Ok;n;N|3K~GA;!)aT$Lb?2y zy0L4P<28{6VSU8vV@z#J#p;9eu2_daSP-ooO*`%IsOKN<=74SqHs_`Y>J7yauUZ`* z>R!P+IYvHjG%}{*5#glTs5l>RpR*35tJR_$agf4ApScnWjr`(Iqv3ac#!tL4TpOc z%iOSRmS0g9m1p@}wmNB=ov4L0 za6cFEZO<>;zFnq!)ZNS#&ns{AE4a(!BPywGxlV}#Wj?A>SkprBeM}`B^{x75-w){H zMnawA2?DyegU>tCm5N;d+6-NR-{Xym3EPM1pO-$k>8bI9L~|MqM(t-jDtdLmqX?$~Tp*`*w-c<=T!L!h_X4y#ezQ;{ePTJ`0j# zU<7x&NVy@o4`IX@^Oppdvu}vMvc96k$iBKy`*nN0>Keo|Msj5E^qEvW*YcBbm`1fh3kAc za!ART>PgS1ORj^}d{oMCGvmBsfi6>gt_2lswAj8Mt>J+_F8`eknuk$ZKy@H!wnY%& zLjLv`0?NJox~PK;aDRMV25v!?O?U%;Cd)}I@3kQ+^ZIPdNsx>VzaL|awn#sw%?}hx z9u!b1kN22BDp&*1>UB0~3@ZRG^*$u5!L59=88FYk7Q-F}3_nkRsEi_C21t2;9rpa1 z72?$OmFpJLUmWxNVA7cg z&9hs}R;pJqqRhKY@_3ifaVtU3riN23+dlO_8&08&5*M+tWX_^s(P!oC)xQ*#~oS8Ze^3hqePhc(<MKU(h+P`Cl@mmaXJ`=+sd=q<0Kpf_#l)Kq70hFtb9^v)8i+MLn&- zOPx+}!tvvwWm4}XSf#LGRjGK-0N6AEk*!jlIxW~6TqKwjel8#h8)?-o|X&Be_R zA5%ST9u1aus|6$<^Q7WU8$sWYJt5z6l!amv>0bvh2CG&@&WEZ28#z*poRN(Ybs|Rs z@(vK$e2)ykCvkZ*JC~pStu$bk11Be8vI2%H_5n>T^mMuWhQ*k)zZGtNy| zsVJ#%nI+~8o^dg)&&=b@K2HqhN|(D9BQbe&KC!U<_#irJe_~0i1AqMHhWS z`e@04HF9oR7L4+WZ|V}h3np)kC^@k3b6`CQhIb427t7)N3|&qCKhm0{B^*lqeYU3q(gt|26%<+FtrEA3q-2 z5}>lHP769N7`sq7vTUW~Y!b`&*3GcyZx#)?JdxF1D85>06U-HSvXZZU(w1x03c}sC zRi@&i&1?=Ost;`D(*)Oq-eKGA8Sw(>?E#uju?N|lwM39DkFrL*z~QTGy9+b_ zB$@02X4S2{RO)gQwdcFtacxcApjU0wTxD5f5XY1V)X#6mNNUCQ#9_>)%5uP&XH^mI zQu+omrw%B7MU^>kf1&xGicFKlaRitv0@#hqJbmywwK2uOEf`s1nzinD4nV%Vt)-_?|P zHk^*2Ub7{^=_nn9c1``c4E7YKF|A*{6+N-29kY?$TNwLFKThAeTZjaw6~bKxt^Y{SasZlNyb zGw1aenmK6_3=dwNG2Cp`o(QQ^e)~>kGNhb*U`0>)QHVqKuzj40BWOc*+^Sl5PqvrM zu(W$DGKKzt zDK?&=!f@2K33SQtHu3-A%h}gUzr40M5#|IUkffxGTAJ9ceo~ zEf^L*j3jOG&t=V-%hXnQ9~#N1P59OUCCmVmHk>UljWw?0hAj)+@sSKIhAXW70yi4U z=Lz$b&w~&~jg}?F2eGngj*2C6IbS%2f9#f5W@XLHQ7_yUEEaKOdXLx_auRRZ)!3a* zI;>V1<=5{q6%KEq6re;lrhv4FqYhY>ON6NvBq&V*!FOR`mFDO~A zYx_MMo_tZ~MNPFDg=wtw*x5(@g{hkKSr%(XUX2mnFrsdD)Wa3a>|rt)lGA z#_9r79fj$=k}YPwShtA(*4ilWOO(e+P=d>mdOvwR$mfuZ{sE5Evv$~iMcoC}d6BaCqs(37 zH|Y~W1KSOuVwhg7hNa@u_GPH6`8vskK$)5O!q~Hf*6e823MPr9*Y@xOLdXsx2xhkuQv?>@2g3ruXT!bqllu``B**Ep6msp8IFv!&mplBlNB# z5bO3Ml)DNb_=F|x-;b5{>yuPU)bz+`P_WOj_^BKCw^gCu zFY!;!?S8Hj@l3#W>`%008y;PT_eEU+`=R}DJKk_M?GON+H$YRoKB8RR8<^Mi1{AzsW9z^m<^MnMiU?%Sf>mJZdDHUL3DX&a%@CEe{2%Mz0Y#~ z*PvwVQ$o6?B+l+GOut5vva4>p*t$~v#kD)XdLzV5-}6vpq9O*wU>Y|jQXWxm-Mw+=Y^D+KElfICXvvzauQVO2_k!_8^ffeg;^YsrE#<#lqO<6dI)IwxH&S!q{sSG26#|gl#C+itz0` z2oCI)oRsXvKz{jrmc5FMS4Nv(I-n%)g9l^D`_yd!*IrZS&FW$dE2^WmGUPWNG*~|9 z)#~v3+vwb(7oe%B&P|jUC^WT>XPyzuj&6BQq<3=_Tt4^$kg8hVD>>WTl2@x&?a-!v zHtr+J5?KD}pvev%Mfs(q*a3`sftGtEaI|MfG;xhszU?v)It1bUY_cok>|&w#I^C6Z zRMK6!UyYIMZb{B_Ya-fX2%mX@!P-%N5ybNubq%PSDb$G)`9f0X)AkZ4GT@>DH_pNwSX1FhQR&>BNBA7+`@Q zc_6l#A~sc~w=n&8Ej=kRs>UKJXp)umraBTO477(WgLQbKgo)WV4$l3rB-X*9HCMEx~LYNkkva`T0$KT;$iEj^MW zxj`nk@U`PcyRUaG|2QZ2l+f_MO*TBvE*6?vW$daOHqfp*b&AEapK_l{Sc!4vUzjL2 zIT6mgfwP&yY2^17#{RczTO_A~U3L1dI^_lX4a(Y%+G~KZOGb|9|+Hy0kOl83>qx_Mg-H+nf?6ntC}(>1RBWfSLiYuv8dWyX3Nur^az%>u>3 z*qaoaIhlBkueFO>R5GX>Oyjt%Tv}lnoHUz!tnPD#A29AOq*|UL73tN8k5Qq| znt(@bR~mJr16F=92{_8_E)?IaS_JXa6Qszk(%Ef=HG+_LjOJ`}OG9>v8}tD1HdAW0F-KFy9`7(_Dus8CcUVmpQCp4rCr!K?13X{Pc(1<+?fp`+y+-~(p{a-J_Q`-q z76S^in9um4qD)h}Cj;u{G7%95u+E!|#v=;37SdmVfM$vSm6t1wJzKGRi>DD*tK|{*XOki?BT9FxvR#WETUTW)ER({oj{?<>jn8Tt9b^q;5(s*Y2GA0nfy z8y<4$C5i##OD67Z6O8v1@HSI;Ro*~h`lkx#wh4`In+rw5V?8_Qxn(uAi(jFe{R-L5 z)xf4+E)$86f;m(*+COLo_F&a&1U5afhW6i|Y`>8|P?-LEMGI0jHCSXQZYzUFmi3Ap zUhqdGprS(eC6kQNqfV&0;oTsknIgl;?=6gdL6IS;nh=vMaHfjEqsU;cL}W-s=Kg5S z;07jLBX6w>jy#a$NUBV4q4>o!k|Tqc^4uS7DM~^8CzC3;gB8<03yPX4ij4gJLQ_)% zR%_Ov1Vs{qc}wXWc10CaedN_Ny1HvHM^@U*v}-&t=Ko4E#>meV1~zJ@@Ty-E!uV3I zFDb!r|J}ql?1_r_B#<>z$aLmFVd`fJ)36um98(m`5i;T-1kdP&{-j)JsAbP+H$M-{ zV-j$JzS}V^^v5vO&u%79g|+rX5**;){Bf^2d9_YVnudPXn@+V9t#s$>owv z+0RUZx7F&NACA`T68#q_Zl)+U^1BOTKUeHa?NLxC`&qL5)I=`1FOlbciR@;#j26gn zkH(e(eY$S2ktcK}>Q8P48^4xhW1Kxw7Os0xMD!PtnXRUu~D^^NsNf%LX3Rf z%?3?8>cFS+=}&-rTU8IjnVBoQE(mitT!H(6yi zS?>UWV_#45OlRf_O+DPsXoxd3$2XX;#dbMyZGdk1MiPb294Is|YGr|%2bB$qc~I?Z zC|`$aJ(?9zaccnYWP9g^#`7iLbakR4_8in6-Ft)B^ZUJ516X@kXXN=s*RtogsW=x2 z1ZTZEFxUXsIrHJ_5VDZsLzLTHDE^{VI(OTpBihT(J5}PPlzz_}ZvSF(1V>=Mo*>1k z+O)I*GFo;Pt2Rw{6lh~>XN*{-!&b%Cy`#fmDLY#7 z>NX8HTv$ePKwJNlKd*OvJMgMU>@tnX7A9s3+YJLcHpII?TfDutA2^;%Cp(hcT0lbw zLbHEC7v+}@sQ$&$PP?){@EXwCzJDWEwvhTsaB56H?NgDJmt^G%Q=3$8?P}oQA4#)h zS1_Q?FQHknRB+Q@(MX+*QXr)gy`qToQE!uRf+k|u6UT*AF<}`CSbpiuKN0`kT8~Bd zi*p>zGvFxBs=e-|QwkEahGtUFC+1>OL{J$T5$ZgO6_8*8Y-1|`oe02=2^>6;%mZvp#RNpG)VU8GiPz;j5t}Z>PYL^?;+$1Ds)R!Yxp5G+9KI=T zcFWzk>{3Nyk9YxYeh6C9R43TS>ONq0ufS^z(V?rWkHy_^c#dvp|CG${LIXFOMFD?t zwA}e>;}_2#?{Ec48{Sop$Gltg`{rGOhTjA467VlNe%|CR2y0;*-o59Rn0I&m=j?;_ zyvSXGhTjM8%r*|*a^84XwoBDEy!+=D#=Lv(@0)iC8h#JFOTfSNg@*m1!>fBbh2}S<7%z=^+7jhEYn2zj zNDwkB+JB^c#5XhKs#YTE=|vRD`!QkH~nLiPsA&CwQJb7od5cF9)Ti(d>rDh9PB zLKQ3)X!E(zpek;D@obD3J?@6qF^ML8!mSzVDyrznwse@K^Mz?mj0);hC%AB@qy&Yv z?-~=xmtQRB!dm(d^Y@752eywmI`tPnj_K%w4I$jMFv2M71n~NF^Bz;S?giA#A)<2V zv7djpC&<9{%v)RIJyZ8n@VWarF7?`ow?AeXxCW;8fZ3{DEq83BP|8y!tNDT}x!$Yd zwXzIDL$3T{66F~ask*K>YYo1QT+@+F94r3C0}Ju8$!f}}UwxGCdDchOe_pG3aP8Mx@#m*R36){D`piDzFD1$$p|#*UJvub#c>!b&N&X3k=3 z;}hrWxEIcfYs?MYL6TP-T0=#ZwwAhCPO{({=PGW*=KyfAN9Se2DM}mzU{Su3kJ=}T z|M5%Z%rjpo5l6ch|68CGYF0fyEy>3e4)SS(UtWO~%^kvcIH53x(gFG@nXGskjbM`l z>qy3`0&6{CZ*(j|CFxgok_TcEa#wvB%h+nl{nyL+SD!w83Jx;gM8*WOB7h!#In>vT zER3PPlG)99g|S;CGZE^}gC(F&1Y1*9#aB}iq4OkR?$aHwcq!-zeT1`}?f`diN}88d z_eghSOCCo^ZtQS`gbYRsc5%4Wgk3H5QP9*5M zsd?xhKnm%$c^D&RnEa`EQZhL1mf)J3HogblkWSBI*~vl=ZMTomJ?h(WcTWa%?>yBq z_8$f`Gfx)%t{sFZ{h*X)C7R^z>t2TW1%0hMp9bJX5xFC?H^wce>NP^j7X~g@a~X8C z+DgG)O2*uwu;@C=UJ;)nir0aBoPL!$eU-Rz!U*u^(Gtm`KH4AGvR`pVeUg@Vo&&~y zETg841dEJMJ1|aRViF!K-kz zL7lyST-;apr+mk*K{j4MaIbAU7-m zxl5GB5n*Y$Dka^|XEmibE@oS!XJ?r! zWEREsQw@GYHSV>#7vL-O)J-6KFkVSc)d`j6NQ#f4ld9NlWlbB8X!h>G9o;qXW$CP? z20qxWC;{&--ymYl*nm+D$UG z#?4^=E4;2=08x;tHR8O>*cf-?2~s@LHTU*(tNJ zF;zze#tPF#$<w{@_33uXC=fARlxPG`IKHHr5bwjT%-+B3N#Qy4{_^ZoyJ)Bg_ zfov6VI8s6RyF<&b*x_hsl@8O^pT8D*1M5r0-iW?uzLr(Mfz;^DFP%}xaDYs!fVHoK z^)RanNWnnOc;Xb*9GzI5b;M}Or0d&GN=vvk>`_q7(evugS7fMb=0hULxQ@8>^>ubr zx>og?aVM}#VNcmEH|hsz{TCMD5lWfJ&rq}CmF@9HrH8NLJV@XA+9K+j%1PC9JH6l< z`#?&EKb;_`B(GSYypSXtDB>yMHEj+TDe^Vb zW`$3@o^NrNBwWTQmwtLaVvRniK-GPF!a1ganYTo0$`Uny{d$ZWoi$i1)00kOTG${% zV!4@f+XaQ0mq>b+_i7cz9ABK1tK#r9LAU%Ia(o(KWtJTc%Z^JUH}X|+qx_-|jmgDv zqhT3D*5zySvCy|*z6Uhb5j|>v`~NqFp--ne?*1n{cZmcX8=mgqd#&|1?*F#wbjNM{ zl0hjvM)!2=IEfJfN5PCd-I^W5RWen2pyTOJMAkmb35V>eb(|jTcV9C95=Pm$!S~;myZF+r@@gK+SpYW;g+M*AQT3 zmuc#P?fe92)YItB$v0#uU-I10J{I;2%Kyr%^*zzBbY(ib=On8f$Lqn-EgLs{4t!6B z>?cpg9@4(KJfv}DcA+(I)yU$EcL^Gv2K2S_`K40|6M9FhwZdD##rA5g>$+!@CM{Rq zaiBF@FQF$ibAk-~)7e^( z^{4Fn#{*~N&2!ow#v2UnsK^(l+rD|mk23IeeBAysHPrEX_$F!PV^Ga5o}f?u$=SDZ zRv_2@$(fosYt>?*Sy383VU&v6+`pRg+)`W@+HgzJaC-U^4YJSB$vld5-$rU|G_=A- z@W1|YHFKTIup6Uzf`0TC1Na$wo-3XU@O5uF6R*x0WWF%amWK!b6xsz&pnt_L>N*2t zdfRiLIn==V#-AFRqm^yIT2MXbH(WU*E3T0V#}7hi`c5b+W4dnx<&A%uQFJl)MbAwu z<%Q~Lvt~H?F12R;V6Ds@$*(pf*C7eH;?cr9;a3?HZVe??kgPh<*K|5!+!No6))@Ll(e*)Wb77;zQ6sMF2I9PrcgsdhUa zBU~-UN@T>u`NaY~M>3PP1Hp9Y&_;>AG*~w~uK$eN&m^5IS27FmfJmfFgi2AH`PhGu zVEiMuYhmOrK=?!qh%n_u7JJ-qG5SUu6BEv{QR|59)Bik$jh+vP?vEJIT5fBBexRgt zr`}bOQmXaYfT2=R3>5j=H8G*rHNjyAb|?+-`zf*QAwW!$dQQo$V&Ytv`7PP)XszaT z!b)B92DIjd(wey0u^2+~x&}Thvk+e!Eh}>k?M!nojHxz!t!VQu(t`;Hsp z4%Yy9gc&5hcwzd%B)z3c%a@p+Y5{KfcMD-KH{N|mhL+D(x>y)^t`Zs?OVDyts#-xn zoy*>V7l5yvt+IUwRvgJ(w4GMH4V^qDfK#}+KzE_}70JahJNn%J#7NoI2x)%*Q?Y%t z(XUXa{M_AeaUoedN*L64+YmA0dlkAHM9gFaO^OIE&|R3mQ*yHmi9Yu>kTD87Twlex zvr!wg>d}R)$+j|-iMO$Zoy=i)`K2?DNzZ{F+5rCS9YE6F0A7}2=5Cfr`uv?>=i7zW zR7+HmdSPb0(t>!s@BPfsVSc?~-mCayv@uSd|9mHqk2c18skrj(_|5F?X7=*$UK+T8 zGj=$xzLEzgbJcA;V1~MeheHL&AYqgi5k*w*oy?l{jmj^jUki6Kcg72mJKh1J+H;2; zn@K(^M1atFX>qd%y>f73`r;ef32Uj&OJ|0R?0IQE;z+&2SN+7=yiPO(kw`Z$Dtqkh ztpgy+eDB*0n<~|76TVd;-+M=fp40{<1Igt{DO}tFMJ0{NNBirKw|>Kx9heQ1~kbNw7xsH?oNYqxbc;ay&J#NoKsDB(>qm! zYO2cwDaH!jyabcSyQJUH3?Swm;92XeUrTpgdI>FQ8nr;*8LU{gec67M`7F6Jm9V3D z@0JZ%Q8sDFNoh!Kg|+0J^?M`9n!e>$aFU?Ve4CQmI?>l&#a@H9C2xOMt67;WI2WPk z=&LlJ4G@(V2d{4LjUNZPYd~;41khZyZj&9|)_LzAv7&|NWzY-CnMA15i6xnD!Ovb=+;nQy$*i zQZF`P|4d)wZ6IyFH=5;o6vbN$#hVo*zQCX8&(H*@eOz6Ye~7<)+rm>b-Ov6rvv~@{ zRqsnd-GtW%uvx9vS^!4!f`HbjQdbI|NY|IAdMH;IQ++1@L}}^vFmhG$(`g8Jn83y! zz*t>1&L;{%eAWs#@7km8LSR10UGYh{s{Vh!FGKL!V)9T)?71DA5}Cpy?Plh_KZ~Va z2n+}k(KU0ukfG&RO%?Re`(fI=N2WvF!7`2DoJsSrc3XPuzYwwXUrdewi=q^lq(kp7!a?5G(@XV{0 z1e7aIncyAzi>cC+q@IAT`& zU#ByaS0kTCiU{t&0%>tnNAfQHKt?aUd#ctg$A_y{1y{*7w~CxcV#~!vE}$m5#`X%l zWC1l)pe(wk_q8jb#x0af7o|&tlRm8M><2T{HIwQi~KB0BTYj>627)$sFeqW7})s8gqmyqkL|ci~;=%bQoz zfc#?lub<*no;&PvB(kCc1xYFe$bRo+YSBWuxQlG^UAwoxmVG;IrhH`)X?Yc2UXhcD&D zyi$XPVUwA)<^ctPzMCRDT5G3$3g7-{JOe-UAJAFths@$miVpQg=+8mI`&nHS)u>sH+cV*~Wvmsy`7w0X zT|(IML{@*HsNbf~fB#mt&Z(D^&#^#20G zs29UX9AC+<#Z0;`%Ir>NE}$g`)*a*?9Kn+R##4*vzK+&1ee2fqU!FrP%ETt}x1y+iv}3DuxBP2#_iQzP`IowLrGz10Vp{jlhD2e4 z&m_@dXN0rsUOWh+A3*c%i7MiJ$5~J|MBm3CN0Hh~nnUCIo%dtZxo#Ea{Urxh_lZfO zdLY$DQys>D)B!40uXH&2;HU03M4!Ih2<+m4D43<{9I>wtY=5I~yVl@j!#y0Aov<3! zaL%&HQ+&Wn^y^W0QyC9+zV!$AU_eyl4_b0y{k7}0<-;+5Q`7TPay304n#)vN>4taW zz{Hw^6IIW`w#&A43+c9$bUwKaYf{{(=51CA$dXFa&O*Y1&8Uej*0sL;}D&k7w3(R>=+E_fq5V2dh7$?RlrgaJ$B}u2FBy1B(+C4gLhjo11-raCrZ1Wlg?o|b% zn3e6eb(m%@cgJuc{2i){)e9fFpa?WhdsY!m+6%9 z^E<8+I#zY7ZPm9sM{Js&FI{E@ffIz!W53bq`QPH^21jkXj>vA?59q%68)m?RAoM-A zf@`bxfi=zf@8aar@lw?e=(YvY*+F;|JsZ&L7Hmg2HT=qwa8f0Nqkz80_G@%%f%JEX z*3h*1#rdao3b=NU`lwrtz}`7Z_p0wn+p71{%z{ytKzyyH`;4zXdO&@Z>J3C91@z#8 zxBlZo>YyuIM%70@nb55&5)TR|(ri3j4dvzAcAN(pKp;SzKi&wAx8^4g)dIdK0Fv$O z&KK=QH=-`(`F9%~gIY0UJQ5sZtvW#%<>6ziZIyReZo@*@Vlh@70HRT&9Ccp#F-!=t z`K6gqx7l`=X$1#NREB;^b(7~|`cW*id4QGmq@+^Io@=L)N_Zp+K$B}dg^lQ;7lIQC z9I<^vS->H62$lhm+QMoj8x4%wkmAzKQAULaK+=dtP0gB{sq?BIx91CrMQ~CGz|knL z0>MbCe$>?{P?kDBUT=?O97R*C<0Q@66y`Qf>yCS!p=l!kV5n23)0-(bTRVfg<8GV? zZGX2_so3RBmhU^ZkDe3zRT0u&9DJKKn_V7i*n7ObXI^{l8g5MS1kH=dYL7z8KpPlJ z9@=z!r8HvuCEE?Rcvf{*BClr~J03PQyXN`Fw>vfG-0F!E-Q(2kSy63+H6LRdw@QaA zzSnTeXRehL%S6kFUbzP2BSkoMN^(pW<&LaH!6aVFb82i}u;wpYp*5S1s8DBc0|3=! z=9in|vsNj@q;mP`uOJV6_pPewG~QK@aSj#lh-p`eG(Xckl>{6TOLvz-Cq3cEF|t)VE8XU&dS1@dDEK;F6IXJU~%8 zyqinKIQX0|sR{ z4_?wq;`h-d*HIJLcDWdB6U99U6=;|=rAezaY4!V-TZZ~K`x?tjmW<*FT;LN4x7jXW zp-$dtg60fu>V9M^x)YV@L9yr0Jc@WLGvy_FoCB&osJDMHb7m@pfX9hfSAOc3&H|G` zJU6r)*Y<0c zEcw#~$}kqJ(5_kay5m+_^PK=*nQ*e+QqyxopuEKnC+(x2UoEFg*b}x}Vo^1zt(3SC z@S&tDR7!QLWcwkmifYXZCVj^}%+tF!G0`SJ^y;&bQYp0s>bOU&s#C6qyk;_~tXbtF zXrYTym||*BvW~O`7nCOLa@oeog4Q~dcDZdOPQ(%bhxmig^IQ5r6v}KpXu$xI2?QSi#nx2=RGSt&AH@{ZE!Qcz4vWOul;;kG{pRzj z-PtC{6c(lpVk9Q{+|`OF=ye_OgrF4*5l>}VL!r=om6TQ_)F~N|EmMI|Mx{rJgK{dR zMPaC^Gb@UM@>0%F5Ojr3iWLJDby`v((9@!HLlIE7PGttsD*22DKJ`k9IpArnq(uXr z`gKAy!09?8NnopY-1!4NfkD9onuerogAEQnkZG%=a(~AIn6^u@IdEx2(pm>B?U5Wt zY7A7`Z=@#%C_UfEX)`csO!AWhlFE|Wb|BKEWXb@fDhzLgNIEj|bjUGA9EDP}1dR}n zG&&~9+>B_1(Tmt(%jywCQyr4PEQ^K+y<8=8ZE#-30Np0(SeHf)it>16uZ8ONe&c*i1I z{Qm8WXfZrtiJMO!7wE^n(av1QQYu<{;UiY^H7ht=Jg|oQz?@=_T5ia8d`pf~aXr6% zmT#Aiv;)QxGplA#ub9d~<63;Xu4havWVCf~=-oNXH&)d=I%h z7tyIyQONvSEXL*JysqMecD$r!lLL|8+d{h*cjuwvfwgjXR)6sXee}UhOZ>z9Hp|*` zhddBZ!l+EN@0;N3A5kp$57&35vQ zg<-^|lp}&Io&#&vMVycJ)ru$R-uZDm07O%QO4RvXvSdfB5#U($X?fK(vbxbs`L zVbWq1NICg{x}$vW_n?9kI*t0p--^ntv}holLG@TA(N;-GC>$DLivs6^+h`h+4Gs=m zfQq3#hZwb1D>Qbi`d0dZW-j;$rzqt>GZ+4Vzh#(01JLxvOTG{K+;sk!hFCo5s5M>CpZ&<#o9reCPcitW;48R2(QYH8|{Jx@W$Xkn$> zE|IRY6XHm(yF?apEN^u364|Fp$r+te>4tpK^d(FoUu&Y&pbYU%4Vf3|{(Wt4=hE{B z8DN zaIs_obTw~z%@Q>RblO2zqn!IgC6;DuaJhL&pfN0aJSm}jUXfuAw zOXwD-03Q`aF9I5{XtyN38M<;zV&Sv?V8eAvUfI5;5l-~?Sf!F(5BarP3LeU&4~XPw z`K-m~#gtY(;&^MyPCC?a6V58qm9tiS)H6LD2L9ty{H_a`MoIIDh7- z_NIq0&UI+Jx-D@krCz6aJ*VjFneeLR5z8^XcCUFj6P+>GF_-+bz%Z7o2%IItZH;(C znC9`Xh%GVNeGjV}gJcnb(MQ)^0KtE|2tJM`AZlef_F~djc_1cO&+aN>*b?gU5Ye^& z2V?UP(aN`AvOhvRiioZ}8&IEr7`*JoF$^~I6b^du2aBl9k&xAE)*O^3FvSm~9wK-} z2NvlGy_b%*C>pC^?qdX=>xxi*0Q4F5F5G`MvX=S#YZE@UCUjuEtVgN}=94|47-T#Ol zc`?f96q3?-tH9dzYt(>&@ z%jwhfh>Wv<+4j&HghWL#*jsMZOZ|eno>Y%+>ZOMW4 za>z-|1h=KSX(%qCHZIcE8cMA0yOw>%5+nAK6pWWZvGuJri~KrOx(4^-b?%C?$-Mwf7>ZYH^L*`$91I5)IW;|rt zL(Ij)W|-)0TR`3JhP%rhww!9ix3zAK2Tpr9Px-l4K_V0h)q@+skk*U%GM*a+GvV`qXXmXR+&0p_AInb)uK*}ZX-yPqcB2x za9zxgiszKEYE_ZhShPZ^k_u|Y@9W*rsp^PqBsgwmryWvW7OHR;*mgNeJ0?B}zv13YQyqN1Agi|Q=~Tzh zehD$Gz@<~V13J22C!ySum1`TCv-QG zltB|~G&K(!hLo+8bWGuG^Tbtv?R%ur>*irGfw(lU&O1;i=gAgSa6G7aav<%LuEa@P zYFd}FCT#XH4!d-E-hY1&xTCavIL&sCMxaaX^g^5NRrRsHb*lE{Ei|LbA>Ploaoq>@ zp6R}M(oG!Y%P9}2lu{!Iz1o&tJ2vhg*}ZFUlvE&{qMRAjoF`mF#Xa8chD#66d*f*k ziB81{1bQqZLD!6c&r*YI&YHSJvV!m^T%U;DLi(0Ly6qBylFHeIxMe!EG|JqA*ko1b z^pjhYrNX^eOAeE;TgEn4SP>!jtrJ3`LwdoWJOn}ytm6X@#ugN!CqmlzXght;2y8#4 zEO5Cz+)&YKuHA_s)YHmAS9p8}gV^sEOd-j-FhNVspWmR3u%RwSB z4Pij=_Ih$z&9>c|z7;SN*7TVc!k(urq{UcaFUF|Ib>Ls6iO&w!Bfm2F?!b12^^V#5 zQ1WvS!SUN2-1bx6P~2(-8#j-tzQM=Pe&b_r@?-DLo!b(*eTlDit6RQ@(**{H(kYwv zrBjBUmrmKcJ)N>;I7Q03)qQ)DE!oRyX_8TH(~e{_R9Xx5o3`!QxP40+_1=+PBZE8l zw4rijaQlwyw?EI!*|cNZ>KMSL9VU{^yLT9zA0FMkBQ80-V`Kc0Z0xSl{i7TAZjQ6t zpcNA1BD;t7j1G>(-=kX%@S~%f*BDvp&&_L%7L1N=UTg5lVENg~T=4|Grz4)d4-v_M zX9(ZsQ57e^Uqkz8Bd-|wYwv#AWPa`4xpNy0nkjuWWPYw&-A9{K3Bxp;N*NrYEvckU z`)F$_Y3O;hEtRx)J3S|rgnpvurV_y-+MZ4X@jKFqn|5rYooy2PXjdv#BvWsJfOR76 z((gmh)7u|Lj+RZ@9l?Td(x~~_M|+}Ah$meieL_BIZ~VDqBkha6xaIq!PbH#sLzEJu zzcEhZaYP5A1d&pDev~k}bt4^&zeYE&p%)mR_&#KOZ(h5a#uDFsWJTZH5##cCh)OJV zW()=#{G%L}J+yD*?qSnT4Z?O8ZO13G#nGIbXc?of*UaCx0@iZ6zW{*aC*opF;@^tWuKYF>6-eoWb51^ z$KTBNVII9CLtQgbu397YZ1axTCEA|HO^}n~q>Tp!JJZ+n(OZ7Kh`Q*04Ox#F&R)Hq z{`0X#)HS2tTgUxc;$s~>j_VOi+lF>nb$ZQr@epGS0#dqp{X*)R`YR2VM}iF>I{oGj zApEG#QDa{AFY(sL;Ef4J=zMG=4B2(sg^MKgUp$6ORoikK^d|g zks>Hf0$34-nVV!}GBeCfAgCa{D2UQQ6fB5^V%c3?U2MB+T@@=}WkuKCUDty8d%d4? z?v!LEg#D~9_xE~z=bz*`=Q&S1&vW`YR}~fNDM>Y-W9xm~kYL)2uGNu>ta ziMmJtM^vPt=%>2sebGu@=Z-pyTdbQWj1D`$R{qe|pNNGZYlCPT4@DAjwD}ko;5@mN zmB3lBk`H&uD>V)NMDeA?{f1?EiyXhk)i%3UaIo5lDfd1Ge$D;Q?Vku*~9WIOf~k~ zdAbs#*S}=UWykeXcIVeo zqAxq*9qB}y#bMS17>vVjwHs#Xp>EuVVm6DztfY4FaE5BGoAxz=ufs1>^y0~Qbsvet zF};)+EyrPtl+N8JdmOe{s9lGh|5lt;91fK2Bk9T7NK7`1Lm_uerXE@1@Uk{^xz_Y) zLU2?jK~#$A^-ss4AU5OtOUGda6;W}RU4W|A$6@2Oq-&3OOP@p!-Z!eRBPac5KQt6CqBw_3EzuMv>_s>E@6@_GGA<)H8NYG__LLB#G193 z4p(`qtavi^-&Z=!o#|g*%sI_#4Z-Pcv&U*{%C_q;#xagWEWbzQ3}a=(vRU_;l`6-S zJ-TO!+ei1Mf3_xWv(nXdc(zoM{^{t=itotrOUH1CYN;4*QI4wCM{?tSwA8N=$t`N| zqiCvs$#`zDNIz=g{5nchw}?Nd9Yaw6S|8gI*~lH)x9v}|&HCJ|qR`Lq8b8UHz2D7R zC>7WI8vOne)l>f)QC&P4=kNa?#k9P^ImR(cvxw$l!o7&-Eb+YP0D9^FDV}k(RE+-Z zDVlr!;<4P5D(xYbd+tpnpLQT^^gk8JJ@K??segNp72Ft zb-DxTFjqx#OY=+j+lNp&q>sIG8m6lCU3ZTTG}*5a@O!f7-J-AlC8K^%r3~uh{5nbp zzNaF;JD4%5f6d}QbAqFuJ>k;T`zo@sjmt0SNP^9RJ{zSq{Ca=(emfIgM?CM{7Ei{a zj?!b}C?!P8v*nfu?cXtbOt(~~U5B0TDZVO@Wp=Cr*}2sq`xL1Sm`rNNP>C$j+w~B- zVr!x|lb))R57H}MhioRE=KD*>={r*U5~o@DSG7JkpZF~;@@oWVR>^Hvkn>AMWLDJc zDY^6OC}Eft@4a-A&0ySfR*VAT- zP&^s!50mw(hg%haink8oW~3G!YB{Rs-urA;>fjDLKhQ>K)}3}dk7p2?Mxm18m`qAp z;_&{%=yk1$Lq)M^{nSbY=%0>6h1rbvFCB{)Qxz49IV7lReKek1OuPIV(U?Q_&qO=@ zOU7dkis$$X8q0FXXFbJnno~yJD7jv^$Ypv))iKAC*RD zb8#zUG0D1kGFEkxI6UpQN`RJoLdDaG!*nu-b!trvrk6Ol!x%^DX7Ts>X)VQHl1i4? z>rp}<+nd-+Qp3N~Yq&|=C9!__Iq8Q|-_rjndmod|y{h%`_Sep|#jhD}X;!Oc#W=ra zv6hCono>Kzju~;5hV@=LxtuYUaZpQM7zv2oAAp@Z^;p@iNmZ#5AHC=F-)_7{I}fY%he$^CzmBMw;oAv+?&X3P8I>F z9{p<)qRr8N`B=S_N@d1sHZiJNAGFg;X{KK@XtOC$cof4z|C&W_wi0Jk59il0BaE}5 zFHUEWE1p$zh`Fu~JO8QTC0htDD5I>o`b$k?S83~_R-to2sLaAt*M4jFzMo8zIJ2x3 zv6;j!?l8ttvROFF(oe2%R1~sA;4m*;YcC>DQ9`L0RR1!APGS7=aaKstGvdtQT-Ex} z+FDNif5p&pWWHRq(Z8nAhzooKz}82U+T;zZF=Ha<^`sDC<2RKDi(OV8E1Q*0F@8GNf+ zA0eMtQ1f3SLNX*?Cz|MAGCnd;o~5MDucJgqM*iXH`ORV@{ZfH*?PGGr=ev`s>}?!A z*?ODfkIfo8d&8kyWzN{jN=AoT*1Y1$n0>7DRF2Rs$6i(sag8KkyZ5Y*2H#JiaC5_X(gRN|8(qUEuTxyG&87!=jt^3 zf9<^c=i;R@r`#*Ks#3nMz>ScB9c-3=F39rob(Yq1$#FDdYuruI9hHqPtVzw?P2uN|WV@TZ?j3wcg#%Jf4>N zHQcR54W1KC^)KmeEfzVLnmE6X;%+VCpVy;>)=f=a^nke8!22t*YL$B_I%?qk(HYI% zN#$!kzqI>oq}a-RGWb@t-d%zx{#x#mA@N}+q}5&0Ju*Pqqsvx{)%)G%?92I zb(GUy)!T_!&@UfnpX=%{=6f|;%r?xvxi(7(gvrNC3Th};u(I+1Vx0sLGS+R6)w zZ9MXXU^He=Ks)unEEpa9wcP*o`NuZ|W9sF-GP%dnHfD!xUtA?ssiZ{EKh93zgcJC} zb=zRP+79t-)G4xH+&13e_uKI}PE{aZ8MI?@^i<0-Q6E1+kJA)yW`=^{ap<3d`DITG zRj?oD{yrvMH8IC)?b@ZZs|m*93E-pC=_h=05^dyvJ|)7p6m^N$)2)119l!agbD}9) z;=ZXO-?~(tL-qVuphV*alQZ3>CulZST(OUbN0`}}@ zEh+c_2|7RRe9o!m$^VJ3Z9a?j@;}=sbu3S6hr>?fFi8LOXegQ6GmFptB)X{*AT`Vp8f6b$w5S_F~DPYeYm8Q>O1Jl)2*5Gihl20`MCk`~@i~m3LYH2Dq zZ<~%9%otF9BL64-B(0b=DBW47)#tnNf6-IpmLx#grh$HxW4ijrm@UO zqIa^f+<3HCAvz_n(%^iwQw^>&R$S%DMM;=eo)ruSVEn~pluQ7ESLei*Bj)1-d6-dB z1MHD97ZG7hbtfrzs=+jO3&nh~m~T?A1dJ!$MoCnC#);P81^p5`l#tJW$+y`{Ce}@= z_SM+>jmGRo^#uYjcDquf8uy}bjPv@+u&>0oc!| zh=+oH8`zJ*)ODDN$|v$nv8fF4Tw=pRmN5#KxEX1MJOuCy%!8p3jyV`>qNqSf( z_2_tgAvQ_UvpVU-zh3RZHRokIO@UNuRXbg;R9;5#H6yT?k1!W$dfdj}Z~CW_ruDEf3|Mh-vtn zq3XPkQ4s|Cu(|mC2on_-YhcR=6Gz6;_rz;FX!Do=!AorPXMMMOjxfF9OnSq?+XVoK zKzF~akK#<$fARYxOq5RWg}R_W;cqqA6$1#i8EK;6j$sxCYuWpIpBZN1;E^W0FAuZO ziT}JY%tAR4zaM7dTy4Fl+}?w$Ep#J7akYh0MzSJ>)@V&@fRN}*43Ze^kO-zou;e*X zvK5v(0n^b{8R}Fq)TuPon32j*0t82zI5HT=sdT?KF;Z?Z-lPVO#|(5+bWakxCz0;8 znyvshYq}@V)7xxp9o-(7iDMPrBa z&QW#{pyN5p4&52QZ91Q0w#L5QF&itiCsqpKN)jHZ2@5cSgyV5kvaM)yQR@hI!yL@g zgv*6+ISJ3zgauec!qGU&*)FwNotv=goT}w5eauC~SnUSzFTBcQiFqsK z53a&%hOwFoZZM1r8`xlcca;Z^CV6iVw?n~GdBB~z-MiDsWe#Cb$&txI{LQ5ZKkqUs zCIHX7*o8lxB>cQmN_w=mr&o!vA zzfFRQO+%XvM1)!BrL`Wn)@o@9!zrAZNZ+X=%#K-lFq*jY7tA)(T&`m=;-nMQv62C z^P|wYG)X7f%5mm!Ql&kVs<~Y~Y1k0KE6$DAw|=Z0&}a|mup|W>5Do-mLTsv$n_90x zKqI+wBk2z-aKbw^Z%=6IA$$gDVQy3{|4v|8VYamj{ppTl8^XaxwDyi1q&u8C~>W?y%=^cqq>K6>z!+had z8^+y+v6^oyv^6SH3RRzPq9P^}{^Kg5;SCQ^*1(k* z?7QM)4^Y&7j7z*jdBf+FtLS%3^W)&2XBOf+rsOi(&|sinpCM5@jJ)y2>Vwr%K{OZu z_M;%~3rsk5CJCMkobGNv&KI?@_EW}+1_Lz#buR9J3zFvApA~n=1sNT6hU@XukHG-) zuQQC*#Y%!;K-NYS&(0JgDbmpbg=-?fel`0Sp&McKwcxlea59r(4RK$s4eZzNLl1hV z#8#rJXcE!RqG+jBCPTD_Fi-6G62oJ@s4TV3No(OUFe6broQ5|o7hcTv1)9*jG8bAo)6YNu?9L&@kkLbX4eu{#Q>UhPeHj|nurW`opV_%M4;ww? zEFqTG@nujt$3e(N;amqHtsBmuFgVgL5(-5o_LXjeAy<||w=;$f?lXGukin-99MbzN z^w_^BCr!Z|)@yK|A%g@jmvG@$^N!hUxzbEFHy6!dyhr!3!Gs)8%cb+^-UIuL?tAWl z;eGpnZFGxxXAKxQu&;8yTs(zdpAmzGYP?+DA$Y@w^&09R=BidftR6ljiI_IT%cwm; z>^)@g@BxEIXy#^)>hnipw)j#`x8(PZqjo@$e$Lgh`6J;(Fx=pv<&1<{I}!7R1Cjb< z6Zl{*^ZC<<5J~jMa-mCaQEi6<)xp}ZFO)2BYc8`(fgw>loJ74l7piKFyCxC;kPC6> z=%E9YQ{-|U!RV)O+=a zPFtY%&4!L?%}`XAJonu6{e<)-e|DGLF`K@}9W$BBR`!n6M}0B*8k(`vEgKMATY_70 zstksM2_RwU30cARkcIQdsM+fZqx`#&MI{~VvT`Y=rbW(jhN1T!2FO~*fRT$ls7`jn z12`Z~u^SMF>uJ5vRAE$bD2NL7)EBTTPxxZBc0#9ImZVW3^T5(zJWZLdOuOy^6C&{# zEpb;b1zyKwuK3jGdG`!AP~fV!5OVNR5(VRM-=41)k$Px}dQhUjrb{F#Z>CbxBtZ{~ z@@-OD0Z|m=$gB}3zq81LeJ(VCq7^FTcU>2I&|6YAtCT*|7ke=OLK8*zGJ!_vO9@^k z5{e#TVk6FC(r1!XD76sha?*%!ydfHm#1eJ@1@5UYD4!&%;a~|e{RRc@&nMThKEYKn z1Ak9IB=fsW8>@ zOnalE5omwQVh;*NnW&iH3jytE$^A!h1es2PYegf1VSe=*)3A@@s}(*@M^SC|E5sqB z5w<4+)f}!KG0H?`Bou%lAdo>%Ri51|97v};9s4$+93VI<)1$S5w` zZ~+)W%HM>U=2;iY6&GfsR3brzHL?$TBk4ZAmq>@(9jxM)UaDu%x*&L_9Y%naflI^(^_IZx?>Is zGqgN#sRvg(#0ad+B!-|ntr1SP;0ZgP2t{hqzSmhM#{5RD3_RZ|r*?|om(d>U)XIU8 z+FCmX!)tU3)<;7qKWyJ3AV0mf%F2hT-Q29tM-=z23j||j>SCAoGZGrAz-e$4|6zn(I!asD&Sy|qNX-Ho<%*L!Tz^_G4jQOHnVDvCn8wG(E!`fvZ-nad$N;ILHLLvX8lY zl!>CR*i^EvyZzL*2v3kuL0!zkcVpCkZ@11fV;0^d->YL5e%8t5S=rJ0aMvnkCpyed zB(r~#S-#H&VRjOk?M^cD_!P5~gxUTVnGk0C>E!IpSh>j4%uaKdoknIIFEUYdki)DO znN?lH?Ph9rsHWOWnDuj*b=JvbmKw`AhK#0rMS*+k?2B2Uxb=e~7|pRm%FPShYcErs zhy5W(JP)OJ9?4*%^P~OHK_;dyQr(Bw*P4Nkl-tS9BZE|BS^1!bgx%<^3`P9oszZ^9 zz`T6bTaPv>>VeUZF7;sWMJ7slo2EM9izRsQ5o36*=R&5(6TaAlV7OL&u6sO_d=n$% zZ1uhFWrTwXI|e@&Lhc~Q=03oQ#=|syH=3SJegl&}WKs>2#y8jv_P}6G1lPz)b-U3f zil#FsV22VutTl+=aWog>(%qS=rt}&Sre-isQA#~vh*l36RO^V*CWP~&Lh2Zj%4MGh zp(7S@@nitEq@Gg5o)Ti+N1ISR*Hc2RAH`ilajEWek~W$gGG-ECe`UCLT`&}g+2Mha z+O9I$$e0GDV@Phh^a)LRt}JZR$on?IsAm-qjQGddYBG~CL=XE_{yC9xwqlSm(QvX^ z^HR%X&{RNSz~v`9mRfOkjkl7=cz7PI)F>GXtZ!R{5e!2Lh6;dD0HHwpEN`eq;r}<=tjJ^4JY2c0Ds3Bi3Lobr|VyiZBw6nk{ zAj&30Lfpgb&H6)W3?ul@Ul;*_NFoqPsDvMx5QznAgJEBYCcx>W)@_W5(nv!B!)LZF z!sTPQ`Q2#Y4xbA=7Ih8^-fFb)lm+~tA)HxcQWuRdHNfv?{o@b!oj7b)zYWQMBb-4oy)lH%gx@-RjH`Qb-;vce!eBT(y%nIglfsYNE_G=PNwI&%g*C!Z*%Q<}ULz3hVLUMPK zq=HHEM+Hv63M7m8Qv&gh4(ty=}>0m~v!_c5JGB$iNyHj3+WNPr{Ft zNF85g(~9;phMPETnd*JkjBR!A)9ySycx&D`pJtTQ1HNS$=LpHHIqCz3;IjGd#7;vs z-D*@=SynzI?6o`R{m9lnse+G;9=hs!xGg)%j;z&tR+L#C2_=>gzA})^QC8V|XtHoqwA}X2oD~G)eZz^^B>lQ@DzU9S@w(x$pgqVJ-7A^BYTem5%qXc#06*N& zyvEpBbnEJL7K>H0$rYsk)MtK~stwq_Kt{E4eXeQ!*Eck=yhLA9EcJ>++LJWm5W#RD z7_kWa6WZyKw%WYr3J1834OZ@J9E zG@N9t_TGP)g(*H0-bXL9Fo%VnzRbcO#=1}dpts(VN=`om5m_gkjwLQ*H8BPl6%k+n zC!<&UOjOhW12`jHNmASr__HQ;rfdfMMN3oZ zvDzp&X|jcvbg4n!b0=H4SID(oybER`xvB7)E`FAn>|u(`O@+6$kji9F3RSfaD7^>w zB!@O6FbfYF#%jJ8>X+ll{+E_}@B)p{2>5x4?lmrBgb=xPg$J&&&gNv2$QgD5v+?nIumTfT*2zvoJXylkQ$qVuU$&m zwTjPL;d9Mc6Y4PES|PVK$#<<#)HnTZl)c3}$t%R^dmJ|zoTooB) z?*a{di{YI**+R^3qI|CGCP{XGo&9^2J>74@%k1k&p@0O=))@CIjEyM*O)54T3}Y_F z8&a=a1&;zxiK(9OJ5}FiKfe^NfxjylmN}Thx zIIk*kzHtQp*>9rr)sro>32^OS_MVgO5)Fo>D(B&|JSE>-sw&?S`SuGq^1YRmuL@~E z7Xn-)(~`fX0CA>w<^SSUqIK?Ujkb3Hv&}LiQ%CVY+CVD8_)$;q=I;gCi#vbQT#ro zVieEP0;nkdLg;FX^5{xs6|O{?vg55TL+3PI!D)!s_2+WYe7vcTI}bG~0>IESR(tS$ zz&U;}lrfrTI~6c=UtV@Dl{Kfcxjyt;+f+Ab&u7#eX`3jxcCv-}eiwLz`fL>Zb+U!U z8XV^RXtIS$n~TiW6bq|#da%6v6m_UZw~%SeHr~o;Br2jVpj*hv?5KzurKrazWs6c& z?Ez6GC)ZtOOURvOn<%=8K`64vDSL#n%gR-P9Ze%a=61ytW=|6_sm*;_%(&9#Q4J4iQ4Jv!bJ&wLX@p8CuJ_ zo3}FQnhWuQTh;gLhEd@MUN>r2dvHRH8WRPtPhmr(1boNvF1*~r28tsY?RCc2D&x<|j3ac$zg5O_%*d*M_SdU% zkrJP~1%BWM5&!KPCzyT^@pYa3pzADv-6H2lH71I>23#nOjKfcoSy;=h1YZb0Nx=hZ zSzD_vw{W5sYzFT$rbUorQ0+w5;BM_ib6sN3xh~qXyw(wDt}88s=DL&<1u)M=%l51_ zQFIyw3UtL%Nji^7!#a)A?LZgeWqHtnK_bS>x`u?6bzbb zA*A7TE^om!3ma=qcn_FnVGI8`bee^iq$ulff=0dFRn9u(ma?cX&0rTSLaDKu?aFZm z%wwimSS+K+{?jbHLD8oLT?AvnqgFM(QulUy zUaiSqEo6T~LL7pw)P$B9G6r26&^;3rpY=L>h2|sL99l=Wp{{r7>{W(j9L0?0YAP+U zOfJJxmM66=Pl_zZ)|uRyd|ou{S!bf?J~~7Y+a&k~lc;ceNOOBWU6_DmbAbPt&VJ31 zKJHnqit6JML~~?g-yqwl4N)w|{d({>&1DpABj+gQxj4|goMnpMR7ndZX)cqfVchQv zg(~ZOaqfQy!?nX~U%-yVu>u`cHGZIV{6KVET<1i{2NH->_(M^6HEUuSJxGiHp^?5R zDb83{{(o2!z-5)Qv@Owg&f_5kXeChsixrM(bZSkdB8i=A# zXyS|Um7625m*@d5+lA6FzIL}=Vc{z}h>f4zhp(`(TWX+S%QOomwo9I@_}Yzv_R}pK zqv08O|5XdBJ6)?Jk~jeSBxS;`Cx{8BChgJnM6uX3WsgtXhpn{m+n@=@0-v~#U1{Oi zAji5hEF7mL{?zS#aE686On+jAg;R9;;XuI`%+T;>?*FQ0c4O2R4&Yi`m8Z^Qtv4J^ zj_)d(_1DgFd^f4*0S?$*JmpLWJWkx=EC)PZatDb|tT(<}X<;O75D5ijc?Vc;v{_|g zG!vaQA15)Q6Y23xpyACL{_}sg-QYIGkeFIlS&i?Cl!Kh>_(zX!;vc`$RoTWz6) z|1(QD-i36#eoTvpA_Fw#R$KTZ|4(}PLLRw=&j5Z3*Ol2v*0@j>8HX5C02FnraiMeq78%s>)DS(5O~_d_%014L z7GzM!gtQ>%>*T||@6WJsA<I%)(FvSzM@ zGM%v8@ZK}m!VN63Wv+#1g(kzUi^f=McvsG`@BuMym}4O?OmT>DlEzr2F!p6e+Qt9> zbI+X?f$7ux>-g}F8sZGn5-c#hi!QTJ9yTE+>n5V4P9gnQM8WmA-mO}J)0|e|xZ|Z2 zI8n#yaVJRFpX7ii3V5;xd#K^XsSemx!oH^j_GyQ&wQx$<3GCA<*IGC$Y(nj(!Z_{J zwH8nr83*IEePscGQHj$Tuw%m#uzd!uwJ?tVGfM?*Uk)f{hfNd>uayDCfD6`IxSHmX z;Azwb>?Of-ZCD4-be-&Uzw(b4^9wUA9>#m7CsG|D62=+<2SIEtk=6CT}JdQ z#E%r5r_=A(f*&Q3+%7`L=jh~do$f`!Q*$l6sKGAYkLOxAB4R?Gae2Mgg#!Srbj#Z_ z$FevI{x#RayShME?^Rb=IEfk31%BnEqhRF~7Itg!`0_`u;1uk?8C#C+(gSO4DzNhF zRD)6~an(1X<7zNPZF22H?K1K?&HltGA7|C<~_1U9rp=vZ}^ zDY-c=n@!0R8p#cLNp=o`qywWyVO^7}D@z~t;17-f1Rl&KfDqanX1Ik5-D&TseDR0} zk2|~wY;7GcwHGV=vucI)Se{wo-~H8t9S$b~@8#mecD-e@?uq*-+}gyZ+aB}a8;3iA zpL21~b?QNMP1;&EiX|zl`lE0gI%jxQ`Qsk6iR#E9uwS%=$Z1*qJu<(&iS|<;_n@Q0 zoIvN6m{$%vN6wt!4n6{x<}6&fImRJF;J6ma@c1e=pi_n&-dyHEPlpD9Gjh=o>n07Z zsyunNPBI9P*69rY6<$!s8y)JMs{ikV_s> zH))GxtFkxjvAId;^PtS-4tD}`b8*iV5=r*Sla5W~%shFAJDbGB@lSYgjUxepRkW&syx2s! zLNdtL=q#Ucyq1Q*%SUI#A`Q{g8~9hYCwVezM1OI)w*RK z7@7GfaBrQWZd%=QFK=W?=}0IbrFn@rJr`fLOFICctgNxYI6q(1{_+|VJ0IxJc^Qi8 zT5}d&mt1>3knem9uD34~;+moHcb8ET9~X?OiytLXKXCdSo?LIjnCIes34fg(^Hx^Z zMH)hZp|M~%0pn$toIk(n2@gtw0d?p(?aYp1o?g11WYlMVV7!r~bf+NRlxOWa`SF%3 z_%u&m>`|J&VRa>*Px;oPsW>#a(_FXeq?r~wX8Y}MqWFR?T~8QwLHAJ&!EmBS_q4Nk z8m+!TP7JE?SeESKdSCPcRe03cNF*djw>ZagE_>ejcPjb6C}sB3$&^=}PVWAkN1YN@ z|1~+C+(NYt^2Ns4u_58mBp6Smyr8-3^omC9a6qBMxH8Wu3B(h?F_ncWhwH@eUM_P}7+hH-^Eofa>q0K9ut5@NPQd#460aC7NJI4p9HIeHt)M@! zNuI((4UZUX2K1ibBL*KWKxsW5ljI+x+-p&5W1q@SMEmh3O2@L%{!Dgok0;E_oe8M3 z4Hq$CVlaR&WIJXi!6=>(u1m+8C~99PXI#FN>|QYwMP*F!<77IDvA=up7Fma}L0sok0%Lj6>uxs}684RoD6PYNZVKg%n<$z> zv4i-%pbw1mV9wP{3gCYCvZp*4Nu;Nk62votG?7RsxZn;8+v;3$O>Tp`JbH%(crU%f z!ZhX=%(}zE+dBJCZtq=pSXdo5;r-Jc7H*H5DEP}A7ObEuzr*GI><$ah5aHiaN zqBAyF_=&VoaKHu&hilxI+}_hRSlBmV!rOm?g+mjXSPzZxydriQ5lC!sLK7RGU?mg` z+hAds#{IJ!1>bJqI=vF)5qJ6eja1~WjTWYp!UG#EEM>uhr#4y`ukjvpd;hi3!Ww2Y zuT<%>bW7seZK(Qu%Wbd*-;x^Km@rXM2fQT}@qEIm&$rylnU7*av(x?YRu6V2=)L%d zn=R271o+O!EH#_l18yxXJ5UEgF6Z6&EaeU@p zQtiR61}e}{gAYZ8ZyHRLMPqhNuo0g~ih7*xXDR#JiOJm48*1>eyY}WnplCtRh0=OH z1oDM=e6NWnN^1yIdoXIE31x85em(vW&2EmCLHfR*=9>?Y3FBEQV9r70Jt4zEr&!`Ca5@z$6a}hPe$rH@?Ut8iK6#t zg9&&ykLM3gyu?J&Ja!3VcaBQ>G>`3h^`%T&sFJ>v-l|cOmaC+%^VsD~ zm!vf+>6<*>$C)ol>s8XXd2HgBNz!JO^nD&L$*+~9dsWhI5%hLRdPpVxl*cCL_mcFu zN}8JguNw>T;H4&tUSdikrsY%8T|`3BKbSTFGxO=|Z7!qq->Rg!`L)k`P;r@wqP%f( zlyIJOI75hpqWzdQ0rT_MKJUSK#5#;AjaZOR6{jeyqnS1VSLgHn^SQ)2fhmo+CZAew zR9JnPHUUfWZ(Uu8dx@`C;)Z-$Feq3kxP6m_jpI~9 z^;Mqt$xRmGlTCP^-(+FNWD}itY_hO~$OXGLS-4-LewOETZMLwEsD+y?{DG+ZZ?^EN zppxq28ued_>PJK+)gOpTszp;wEx=0}^#_G|=oBqL#S|?-&m`(UH0qBEb%=vH+Chyb zQ9sqFKP%K}4(c@y>WzZ>+szh!(5T<#c~9PK;U1#)-fZD7L_KS>g_i_%#AXX^LdsZQ zlNyB2X(%Kx=c`6zo%=|>G@K>>xs(xy^E-< z-&X{c`ktv#m*tDi-Xkh)_61RCvmcVE!!+t5g<3S#grK&cs!dZo)iKTa8ucnAYZszE zzsbVMM5Sr^CQ-*~)GHL~NC$O{gL*Mh(X3}GE06kOaa-Ph_VU@PNDTS<*|5#|@^0AX z`~^>YaOqU1?c6L4N>*9{JJ1mIR>o~R40Dr9wZb3g%UQvX^Euj?F;#VRA4_;%lO+0a zzS@$JqF)HGcB(%Ada>5+lYH4yh==s~BH2>7TlA8{JC|v^ukvLNaE``Phj$(kyle(Y z6MA4I9-oALE?0v8palOx1b$MiMO^Jv6X*wRPX*&K7oW_9?v zxtTu_4xmluLLevKCDZhRD1q{684IGRYyEnz5UHt&+le0CWxliSvAH)qv3mV?XEj5M z#)9>>#=2+5)TvX8v5qe-q3KtvY9j%AY(p*DSBy6?^)>~9NuqfuptLIOSmyAL70+Mvy4{`)Hl0)MoHLLucz0YLJ{>ePp7&d z0-O(bsz;6b8w{Y9Cv$FNRJzraMI6rRV3;vJRXH`loYy?*EtO-Cw2B`P_79GP``9(U zhEM`i5mGJIB%>k@OrrC5oo1qd_mJ+2(IVUcx3#mM^Z8g$1Sl%bLmchUmY*(f_S9 z{ipre!ap_M%?1kEZn5x*hSwS8r)-g}<2_4OS~#~Kl@%`&p4 z-d}6dYn0x%Q161iTP*yfGu9g3*cJ@oAo_c7Cixh2;j({IR4ZHW;t5 zAuNsKPWkVnX(oya>Roc4d!s?8&702i+}J3MfHj>{f`f>l9s3?ZI$a^%BS?dYRB-7Q z3+44{{I}64UqK^zZ`@*G%5)RnOKij2R}p zPd{j35&zltpoM$+&pQuVc%PKAn34PUl~t*aFYPdlELd_^Iz8BC<6gbs@TTFs2KT0z z{i_+y5a~^Wcl2oXx1{b5o@t`s%Lgs^wbXAJUe7}o%4SMe-pu72q5)sR#vELuYnUg2 z19lDYfp8i$(?o?Gp5VYS(&tg^i#7cZjkK#miF$PsA$3*gpoc6>(WqY<5O|J;cW0ad zbYfpgBo5vcbFp2UV0Y34yTvsYP_Q^Ow0Wjuklo@%I5H3n;78-J{vNdXgfg>!uhxuz za_TorEu^vUf_c0+Ch_%UlKq#${u|9+K_#;s_Fty4|5~vhGRs8Kayq)aWdD^hsBa<8 zoyGb{eS@Zn_GvFCrd^O)r{(`hU6At4(l>krd!w&)v+2 z%gXg0Rdpg@$70^fb7Fk9Z9eK$-QDFfDyKxNfV*5XU-keMWBD)FCElIw)Z1OcU9Usm z<&velEY(w%8Uto@j1@KYSisvChPv^V+BxD6}wqVVn8JfFC8h@u_B+-S6b(WF3<5zJtbj8)^nXzxrM!WqSJzOVn_?(R4dJ81g zDb{N+GJ_ziwag(%pi8R>>ftpOVSENjcDW}xBnkA+Bw5(ZBh(bBz&&P$+Cx3$RS(i$ zwRDVP*GChRP~fhbrqI^Blod@i39@CoLO+wKwrrd6jf(@Kz+J4jcHel}0|Vi#Zw&hD zeEvG$34C!K?O&T{V&}2Fz~52f)=XB?i%-2EefU0hQo@eJ0(Pu&U|;2aFuE9gRggZP zHt0?xLC;F~61KN;KsdJ-YYz#RpcOE1y7lxJCS71FCzE z6#S8b{YVaMeh12r*@38Z8fV zfYghCa;d2Os!1ju{-{3#49i*-VN!0z1$5qo9g|TUaHi8Vp-@t5BX(mjF_f?AsyRb} zd*{ow!iDo*1N)ijqC}3ZiKG2*xxjCz2SwMkN|u^9)=H3*KqWV%2SoyQ<$!pfU<}6R zhRo`&F5-$v6BPAu$W*moE*Nfw!BHuu;$Bx$Bc0JN607$m`UGR@{>wCcm#1!tox<@# z3^-+?RfN|WnbM7&!tnxB$A2pSH|BDi2tC={9LN9bBLQ1I(z$W2Nqc5$q4%+;W2;;B z*e|I^YhN-bZ_zxblYU8tq$r)JFWVh5&qNuwqh2xCHlXM>21*dyWpj7XJg$vlyIfog z%;R)pi^|_6`4N@BOY-M2ALa*tw=jb}wAcNNg(XSOpQ~XV%%W#3%!FyI_8$3+h3k?C zQ(Y7_saje2P+y`hW36)*E>p@~>5|3HD_vJwMYttN;Yt}YWv4JA%vZEAo9|_?0a>6( zED#dEPm)-m$1Q1{wir4o3+BlC-!jgSmo5y-uw|a^{|Wq^)Kag;=P3$h<&MjFwa?Av z)j`?T{@mD2cVIbj2W_hY+Hz}hR6~2dD@M+1PEtF-JoTl*df+9Y`Dv1-uK8?b#lNq> z!TdI1JuuZpY5tuosVk;{6}K%Z4J!{1vafu8xx=v+~li`ZoGQ z4e{UvJDKZB%N=glMXhi{HD>7t0hRLwx!Cpyrh!{D4@@u5AeU zVmdQje5oy^*4ppV1srO}>Luf6ccHRF-&kxwc!Dn!9qp) zY1wi5HU{JTSj*7t*@Ghq2V+cjjNYM0Tt2N4&5~a|E*Pcb6u8IeWJChtuV)-u6?cn3($Qnc(luR`m%|?pyW>{4f2PW_4@{Mkg8dC5qDDl5UC{PjKxS zMr9Hg&2aRy&mEH}$!DJxYIQUeOu)Ft;CpTS1|oZbl7MtgM;AgJl#<4~QxJ=!^+js! zm*Z7msJ3#TFP<0>4%m&SPfFOjNif>USW>9?)pOXLg6dOoaEmIvL$)sryt}WlIuAg9 zL%%THpJfWJaQY4bQ5wTYju1v%!8a5li9jTw5*9Kc(vZN2u|-ALc7=(8pI@->epr3A z^;`w!MHDz*frn@?uE4GuOek=G1}{~ht-;GtaP*57rfG1Vfr23~T3DgsagJVeDr3A- zN}h)i!@ea}{6|tP1w)=#-YI$irtFuzXkoLaxYO`n@uCImN)z6tFIwn)rHRhBzi8pa zD@_#q{zVJ-Y0O22_l*}V^diD1FIqU~O16-|P2Z;tVf4q4(Ejr2CW=2+1F8ojt(meo zMcZ8HtWEPQdB29RABM-^dNdcaIt5_Wy`HvkuFtJ|D~HJ|0etS1PY&>;x?18+&9>!U zq8-a}h`4t{tXQ3=Jh^y~uTlTsYy;(+cNAlFW4 zba-SCPlp+g7)FWT7ljOkn_!4r!+0t!?}wwAcrPm z{bG@NCoX#@2DG12k_xUog}V zvn7%nqA>oQZCqw8FnHTl0(|Yfs|}n5vyK?1aq$gYiQfqeT5jgif(4>~6!8 zEE%YRd1Zl7BL6su^9!0G+8k;aUy-K#=b(PwoTlW@C@@Oo9|v(}6Poe~M1E4tXq1;A zx4!1#W8mr=V#*ht5R%V;_T`6XR~SiLxSec09h#q<4wW7ifR+Ec2cy|e-t)4Btr4{z zd3gEXUgq{dX5nOGCTrK-Fb$*C_dE_Xjyx)W14*jQcs8jSJew4&?1JgIR26J51=~x( zse3M1$qk`KRrDY!dXN-d*u1FPKAMTGdQ0taqv-93oEzvwOJ9E_S0&Jit;|DLnkf2= znHQsknY)f%NRw+9 z%cd!=cJGIG_dpngAL={t9Yr|7nQ-q0^@}@_<`q3qb`)$u~=7Jr-&BKlWL8{aD(*a z*Ip%o)q>slrrx$nWwP7@Ca3+DSVF6 ze<%{RyWxA|-gi9s-8Cl4)Q8`93rUpvV>Y)M$L{o?nz`Xx-T{l_C*gt846s%x;%CX5 zL_h{BQ(YXbEFv6bANsAq5!I~%$L)kBp;G@Ysq7UM{4L>zV4&U?#dlKfh(&C^lf_ix z1}4^~qkYSingG_iIHvV4Hnrz{rOaLy3f5zq>-M)jK$+hcjpG~RQvss2u_%5}HCMEp z{u#uLvVk^bv5C@#ngDKe(Z%O2=BnGDh(QnDDC<*8m{{=r%N8Dws_E1$7Yc^FVqvR> zH@eE}USS7YF#Z(_J9O&&Jnvj0N%6(6Sa>^?amOnbUSmc^VAT5(1Nsc|MWexRZ5&r( zVZMrr+wzTyU|bK>8xzmGxE_SAgx5;^Bl*(c5+XZO1B<+kzS2iT-j7c;RO9y%6 zq$?WJ#d?aW0$cDD&A(HR2R4}-`j1Q zh4YDV$~Ft*`Om;@7Vac!6V16Yr9x=|)@j9`pyIqV_=KpkYndER@Qn@Gz!P#n^5bQW z;!lXwqWDvSy?YtsqP7N4iqQ^SuI=!YARb3h>is#XcmHw|Mco_|ydpRa%c&77w3pWC z$$anDS1jBv8MIA*o$-{i%{|LAZ1duBZJUp!0Bti|7kEY4rsE0|Vw-OKhqmdxf=zz1 z#TTy_5e%Fm^{ssSD%`5O%AJmZc8bc4E4Zo83DnMfc4>1~IM&%I3ZZB$HEak5YVfvL zW%&vdMG+>_MRp0+W|5%iGN#rN^%FsTnW#&cNYoDn^>d;Y-RLBKDv3Q;QUkHuom$(s zmEF!`j%3`cGd@unb#;-md_wtrl2HpWAPfto=2V8q$~cE<97NbgK!Tn&C5 ziwi_AnFilUt_c7ynRlF9h>0tmzUd`%cuAq^)WZ=NFPYMmGEwv} zEf~j04rT3CjK->xehUA~H*jM2=!i@9k++KIuD@K_E#un6l6C0x*`pvFNK-m%I= zMOfqTqlgHy<9vUWDP1j$ppuh4BQ9o%Z^jak`Q05TX>0nOEvK_1X-lJ!YHm* zgN?E&v8u{o!Z#L{_)6Ktc*2)xh-0zw30DD%US};y*^fn&!t2;#oU_fscjH~4pImQv z8@5?E<2nkSrwpgFy6$6s`*^yx=LmEuXZzw1){MB10NB$es& zpC)>zH$6+$Jcug2sR?<#{IcyOWX~7E-qjS9ZZm{&%A_$nWc%VNlP<%{hBE1JWzvr| z)e&hX{YsNenl#l=Hldd;>hhGR-)o{HMb!C@s772>l@fJn6H&QBQdxx+;5m&B01h)s zkK!Ql@a^w-aQ*crirU2WFrt`E$R;N3A9tZFOtcaiN&*G%Z?o{*xC^9FT>i5R9NKQT zaPRddydAb%c$}OIj@WLYvqtOWowVJ;R!N_^-9oueuPDEEJ4cEsgL17>8tSyw%9Z$o zp&kgYlA{+@Y&Uma?{tM#Y;|=TT}8n;v+mBs@5#{ZbSuHQJnt~bt{-d1unOm?*LG(b zMg@oCm?`bkF>4&UGxdZ-k78yS9A}@jMvppXN&9gA8WRN%Z@17j?gBNr!tj2v-GYCO z3Ga8?EzBT-YlnqX;w~HoV1l=5hlOjHf5Hw6cdaqe`LrDt9$LdrHeK4@zGxqxf5-$o z77GSAoWiv{zfCR+oOJ~?H&tUl)!IF=#zdJP3)NshMX#UF@3-S|UjnP~#6C*(RffTd zA-k4UqWtq~_!$D(s#ql*!Fx(wI<5q3H;F*@jfTa{Tz>5FJ)J(Wmh@aNxWAQpO(Z6naFy2Qz-9dV!?nN z79!g6e=)ol?Xb}H1{0lwJ1lg%fo*AGhlR-+<7vY?cZY@U#8|Y$!tVs*x*Zl~YmA+S z_wF4Q&LqZ`9Tr9i#uGa%EYuip8{XGLJq-?idCR|%@aGY(uOs-T#Zjk?X++d%}_kPav7Bq z12Dc)M-Ws;{FTsPxBD;Q^f{^Vu*KJ|Z<>+Q9=--|xD?4bZlkgQUO=J0HW-M*nB%6` zYoc@HW-y7)l?&+K-M|x~SnA&Sfd^;YXrgEZYbl6pB|CT{UE1x$-#NZuqC3{&V#VV} zw~XX~9|bvaBQMtL?ifG1kND7o$xMqx6TwJ0&NL2Y<})qU5ck#EOzQWc2TN}>Q8|(G z3PaJ-;{K?_Ez?AQa=(_TxmtaeV;;Bx4eIstupI9QZ+*>!>q%FJfnl~dD7u5%#Sta6 zp32G4_wKk0{CYrxOeG#KUkk~AARYD=ru>R@fy z7jh0$+~ml^GyB{?F+P0FgCCQnH%NG*=uaY2B8E+pVBSQh=M3jzE!91Sh;=A4Qgu<2 zYz=Ofiy7?z6d6uqP((u?byKn}D5Ap05tdL!5nF+!e?6r-(-uOc_;@zrep!|~NE)S%$EuUgol zF@NLj`l^M;n4U$mu2_d>T!yH2NK&;!sM=PlqMErwsM=eEm1>7jwQmUPMotQtH#@o> zlG63J)TRB+O4m-*_3)cpsq1H2gF{8v@|(4;z4#Ax_1(;Bq^?FnS*5e+I*sWmT_aID z>`UMlysP!RFsbK-)N}sL$tt{%dR|Ld>m>+xGeIeSAr*g=dU9b;a&;J8s8qJQU@Vn< zff}=}M^XPb2*s)}mKFKW*6QCuYju(6k9AuAgZK~iKYpE~|Ir%L7X8m*dP;w;QFg_8 z+-In24oPDhdf+1u#;!}XwISMK+&ZTULrHz=sZU~^sobi!W)%@ulQUVJVJG|(1GtrI zvf@$?8b-y~h8o~OS+tu?@?q`~lbN>MgVKLNto4w5%w^L$zKK$WzsU;Xy@c#8_?ygA zwmO0g*MdA@h$OFOO2T)ly5lxp^$O5pOyaUxLcg+c~bd=r?Nm&%4AfXJpc^@rM&3+=0h6{mpJg zf3tKOLvP`_czpmGK98_3R_nlH$)8`VFciL4eY5I9sQR7qZp%2W`kiiyHr)|zt`_Yc zw}^ISrf6r_iGUqW#IYe+YumMS+eNx1lt#R1yFA2k9i<7wP`O%`?OGPb-VQfEVDmQ$ z6RW~oBHFWr>@IjqM0?K>ZKW3NZ6(?lnWCK)427@}zt={4J5P7YZ_6VUKTxiCuoieb zkNr>HdZ(7&&fC?!kmHpu*p)|9SnIVH+@blsnwy9;)TP`5flJ)?!%rG&aWQ>YPgC+AMN%*YOM)jqoAS+&piA9?U+3L=Xy ztM*CO$+i1X>%Tb+-qH-N+efs1Hj{xYN#d@gZ*JK~sl8<%wq@J2+FSPFlxiorg<+^X zt@akpm})<`57lmSt5W-~`>Uk?WH(>id?1#=E6c&&|553g{#Z;(T%T_RL za!tyVtG*%3y_$QHF|%tQqrw*m#DHBwbvi`}+2L9qrBg{)QXHwHU0Mda3*Hf~OB}8T zXs-WMT(8UI+K+=+{65*$z1&9C(aUY9?k!{~7`MPWQrWT5P`L|`bN8AnvGniwcd3 zNCP(yv8a$@w!Mw}Dq+rVRl-3`aO7T8`0UO?6f?;mX$U8rQr_D*ornb!2|El!71W|H zD%>TlUaSg>3+dTiZ&N+t;zEjk)@|Ce`)bjbDbYt{iq7+vejE4VM=kgRg+_(U!XFT^ zM^mI24TlFr#yTcUq#6ogyufJ)moS0Bq7h~g)&o6NWImM&!+4;Om8I2rAf?WqMV+Nu zoj;2@n;dn{(ds;;)VVKHof%yN%1Iop;M9)^0G+m+3)^U&t|-QLPEcTg*_(j$Y;-`=hVo!$5k z2c5%jcLtr8YSc9z@w@~xQlrk=N zwnkwXDqmaw7Oh#V3hO;|rfalf>qW6!Z`aPWSW9!elICtDO(b5~WJ?A2Oa3ezW85#9DcdF6Y0W4%XfVU%Q%oqjxj`=qE)ZHD+-{=i z4-GDqsR~_{wD^wf(_OZaIy zJ{`eN$v4Vs5$xAsI<;tWiPAsOpgsUrBbw8cy-fW;9ZZFPNEiMgDEwnsz+y#DtMF+F zKTY7%5&X0PpO*5|W_&u5pU%RkW&HG6Ehd&gV)9QE^Ft^m>_v=Es1Jh_+rCj2VrzZf ztR_fgPmAmU^OacGVnt6k;L{R*x(%O>;HT|c5KKpc@J|%PLqUxBbHU5h57lQ&RCKC~ zPNC>0F#E-do_>u_OZaIYJ{`eNZ}}!P>Qa9CJA68lpZ*b_mhsbvzR8V>C6JK(6NOB3 zLav1&`bX*|cCc5@)kE}^b3w!aGS@>ikp_XZZW7KLU5W9JVIYu=Gv#=sjOfQHc+`W* zm2<(bo&sWSz{x;~vgN*hCC5l64_9AB2~PheIkB(K1HC*%QAfdRGown4|BsjFsOzC{?C2D(>X6QxQn%u!4+gn5K&tOUEvEU% zLmFE~Ru>y2-6IBWK|aspBmt4D{iZX*#ffVK4HIqHMo(g9Bn zV8MmXQ}}(eYBTWNw7;cb%-Ga5M^~EY^_b{zo3rGvdrg<219C}XuhHlDHA?r^92k1F zIzw=Iw9GP0BB$z7vRexB)q`j`VVg?%Je|n(69)4YNctkz;SvkA@ZABQYf-GmP~0E8 ztd>GOVmC>eI%%OMC=l{^y68fUs(oIwmR6gt6B({T-D+;)RQp_=OQCvgAGMa@`F5gG zK-x@_LQQ>lpxTIncE~C$RMvL~+KH}gp|-v|;DuG4wop$<9J`Um3pMoJfzZfSs30_v zs~fl2f?kkioVP<%t!<5)igok+BuMS*cdB9Hwb(R`^`%YEZx5zbCviBSo49SR>bQ$_lzTNaXOVv4ndmVnSv4J!-xRgFvCumMdX(td}AJ7 zdEDBGkzq#fFsM^con`~m{6m%_5W}$PCQfrXLbEI=?nC0+EMn3M`>FRB6+k{oD`xs% zTl|Adj>KFnQF@zgHwl7-3ivyjpf~br4YJ+Yl3sPZI%f3uHq}SsyCkvZR>w!FndVBm zTMcyIJXq3UaKKzl%Q^Mbb6xkS!n#Agv7T<)@GC1=6_klpz1V{*Q#L4A-NVvUf)f6 z-L{9^2jzgK=aZS3QPQbHiYTCQrz{hMPIWnZ!oRZUeOW6UV$s7eAc6j;Bu6#sRexg< zgP2-uj!kVRM79Ks1|#g?&*ib!tvXqsf`V)EL9A%RN_gMnpPZu9?G^s^&ancx|M;%UsS|M8o7cWMOxorP<8b)4B7JT_%;EJ4@7bFg; z?27#|vgiNGUtmbXK5`&e?vE)=XfAnak-@KfzSpbQ9>Te^O2S%=MEqniZP~*T-|4%ExEjNk0Dh~r+f5=$i zQ$_x~ui#ojuNAp8Y57#4$dFB5tRXndFv>=lLNz02AhYeQMO2R~=M>C0ilcs7wwzYL zVvl`vLCAPHyRuV@koIz7(#;hBh@9M(LRm@M_g(S>n+kanNJ%#r(EfmD?E8wU*8TQe zQ($jcPiY`D!zt2w$*CKIMQV+-V;UH#%{JPb(KJ$dx&5HcOr~iUR`Y1;b9m-QAp@E> znlTS(UW+=uou|h|iFF<@A43(hd5>|AMPY3Tj^Wv;Ex|DjYI0i%$ME=L#yc!5=6O&~ z249!kjY}WFV49K?W(p*ujWsuB+`xAD?E$5gZ(kni!rWv&$S<4yp{8)z<>}s_* zu8_~tZ4Cr^er7AJ<@tZPG%u!M&dg0v2$ucQoNR3}cv~u;T|=(^0r}gUt|M*&(TYxYj=e>p++!X3UY|sovb$DskNPLGDudJ6LCjB9-7si2-H1dpSreIgqg>*$E|ahS)L7m__H($od1t(XQ25nDle z;Ja~OV9GFxA-GLYjvPib%`v(~?x>ax*`gsC(&Eav5<`9vk%JPJiO@h~GR%oE5M`;v zD1oWcYBO*Ld6gk!K#V5MRJ-JymQuiKJci^dhgd5hCuA(0^7I40x2erQMBUt^FAdYh zM;>()TJjs`i%b!MWi+|gO=3XHu#~2KqV75sN2Wvt5OJJ{CPu#%D+Gp`R~vq!QPPc zx6dr4DMc0*c_Xi+Du+f)f8`W`pF{y^$*gc0YqRUydP_b#v$!%2h!WMb5f;;U4t2=W zi;(Z6H44p6?8~oYX`5Nf3 z)QyEMnJpm9M4p6ba`C4X^bVmR@Ezy?UM$!(EiQDF(L^~o+aMtE#r%ShR?zDuE)9kz z0K{0>jMElb$z6pK5p5ItlL8t#)IZND^v}>~b7<+zVk#54dM)30VHjrh%X^D34AYvP z@cg2fZ5XCJZxq8K`Wb*?-ne?Ym{1!_-g62=$wQI$Y5yq)6f7*RQr|hF(7JImph?On z3o^t$FQd(rmvT#7nixHFcV1OlB<=2k_LIo*njCL=rn%Ha&$e3Gkp`;g8@I~ z{wGuf*+U>RjX#1KKQmW!?2+3y(b+n0Y1V^?d- zxVJh|Nn0~BBSNatmeqW5rY$qJ5x>?}flmFwm>RPWuy%8R)~>8$>;hS9*Muc8C#l^t za;da-&78fS#(i2lk~wjCIG09~WK%e)vUWz5>TUZvTgf{RX{u>Uui6Uxm%&y_!u?lZ zbtkQ-HK$gG-c55$BPOG67`as^Vc4wn2<{77u2ZW;ZcMQUV~m9RL5*XXMo>b6F!5Sm zoN!omW@Zoshi=qz{A@oyFLVqOhnf?SjpotBZG}O!f7DN$#Oo)2A!hwhvfg|#hT_%h zsncw>+RcR49m1_6)=q+!Tl2_C%Z+J3d!xXqRUK|`sf2o3b9>v=A!Y6BX>G`NTCA5% zVmN^OU`)>9eX_CYY0HUq8;f29iBR@T2oXd8&=2&`V`;e#PJrA#HLYxV08@@O=dy!S zAjh`dHfdL`x1g{vfQ@qei%v({OFa#PD2aIiR7e>GS#Tn!lc??co==*znzNq9O^4fA zOu;}99c8v#Bx&c@ugKd5cTgqIm2VIp>!k_S(|+Gg(!N@Rb+k>wcUrMW?pajcPn~L2 zcOsFO52ly8{jSdkC-#|5SpbtH@@PC4Cgi8prW40b+840h?c29c7<7hfW0wt|fqIu} z)22$R1w5(>IVanmr#GmNei$6?b0IG;Y8BheTWda8n7C@ z<^qt$Zj(0Tr4#VeTHq&XJ!tAFqjiSGBLjzVMeilUN8XH2_EWFn2N90~Rv++FFV>MQ z2ozZ|X?LY{F3xOtK6tFpgGj2p}&26N3#VbYf#6$A>NT9-9XJZd5m|V_9z7Zv}0AHci$n z45J_kQilTXN0f02E|Dbvd8)7LZ)tm=Ix?dT%7AydD-z) zu{<}XWJ?Me)+49U(qsMm3$Wf&`^N&(7lfId#R5IO?JRW3f&#=V@DCPp^>};FL}9XI z4OXWxNSz~9u7eaIL!x73X;_Ayf()&M@_Ve9VYV~(PlZ&WN1@DTi>dUYbZ#M0IPo826KqiwaO&W%*Al>OSFRpP9Ss;yBH_3fZ-}Ma=S2Cu!HhrgpAp z%Ch>GrAw9^y+m5FYygJ)g0SheJQ~KNJsUhTFfoj2I9#51KF9B+NpR|LIdmg0;N2Tp zVdjVuJxeg_KFl2^)pZ@2&ehAQ)nMzV*Nx&nwk;EPqSWoAPiJhFBM4Rd-0JeUO?DzC z1t3u^3c`HOCcHx|!ZS$w>t6<)(dcriXhXs>Jub5$FO1!48U{_TI)w8jbH)lwJSKpN zjz5&mU*BP;N8Fq{&1s_PI{j`clbiSjW={+zeXhQ(gf>dWxDNGcC2b5Hfzw8zO-PP# zSS^6Wpp_Uo%yGRO2cOfCw%xzX%-L}a#T?AxAI!mb2a`UI(3$W6Leeg!yX{|=hOMMs z^Wth+qros|wgTqyM!FK2K8%81n$+YvMwZ2Z!&&6)H*%}}(vGAD?q7zm%llC#R*Ut5 zlvbCOBOWJ}W5SWPsX%h6n#D!fbjYKMV1hG9Y>V4+Y5`B_MybTcrp~a>ES4NKK-C9JJ+M5L8;7KzZJ^3J(p?Q z&)L41RDm-3mj!;4I=k80L1eHVwWKdFClS4{liw@ganO#cZr+KRqm*8l_CiR78BrzX z;H?*?HMj1xn@OksCso^lFG*;HXtVKLT+Zjhj*iwGWYr9v>vE{DkF*}SZm-8@Da1-C zgw?0#^O{w5(4xPUjRWg4aX?faNbwL9nx&2){cYOf+FDaoICP+OBfV?ditAn$mXcGT zw8i11TjY=pP8Zv&A~jI(#B#h7t;k+hOu8is>lDme4n88amS0Yl)1Y2&IWdJq_kBnT z1;H&n>RVL^BCk=46BymGI7@q>6UQ-c+R4$va_4fA0)Q+^jslq*#&RsBWDdH+5FkPJ z-m-HWxU>5=ct_`t9$5SKIZ|WbnzI>#oG20Um(&JHBNr4w7AYq+2qt{m)tsC57~mc& z=frR#B@@KXij7;YQp2L-mlL^E7j5~3By#+iUhYxwE`c1^GfR`>a@wX1e)b5M$Q-x# z!h+j0a|wF4ByxL$AW5sOT3U5#V7QovY1z(f6b$?I#n;|vtggV>=QODrS8VyguZ<=P ze9N;_5x1Z9fE#5pKK7?GzVH{ABR5VQ9&(>O>ul2l3fVFzooU#0#yw}7 zK2hL}2hzA5hb}wTr`|kulQABPyX7>zDxH7**3DrZPz_O_epYmE3wh8aC%nD26=$7mk0zIMY69X@zx z+%RDSVc^AVGfx}SLa^mV4cF;ylIz-u-$)tEuG<%H=GOL{%(24d_3!0}lnX5`W2 zp;o}JCfQic^@mJUP(-94A@rhllBrTe-vP~DnUSgr)4Dgv4Qd8^U~fdhKwQ(iV8XEh z2#u07$qMBQZ-9Z-agK7Z2gr_@iEto+ksG@a2k_*q2+%MH+s!QMnG+|Bync=uRl3BOs1dD(zF z77|quZltY%^<*`9+(`W(_8LBS zRm)i7Mj8ZUnzj-{*QE)WXpFc4vz0+waEJ~NH`0hVNMtvP8)-a5L!XG;0@cm6b(z5Ppwhpi=1E)?i zeyc50&+m7dUado?ic`-zlAJTdbh#VJh_u~qY0L3z;2_Z8q&tk$R->A>c*?xV+T3BV zKWpvpoFRsZ7{m0Kq2+I4*uFF`)k@2Uy=RvWsax9fgPIqKG}0ha-)!;Z^2%Oim4=o2 zf%Q_dIV9VP(=dp=L5G)Mx#pG5%<`>q8r8DJvDLg0uMF&dkVbA(RHgu$eFJH-Y1B$^ z_XRb&Jtv&-r<-!xj=iRi)8`sp?6lhUN3jV@MoYDsaayee)V?SH{i2LkE46*Fbu$Kv z41K5N!Xg$EiHNrE;%kzfVhBdd8B@E)KGDn`G?s1Xr*0Ini!_pJu4>@>ZZ%=t%)T^U z^P@zciZ=7842_C$SYvjY%dJL3VZt{nm^Flk>s~J`YnSr|wVCA^hR7Yz&dJPXG~94~ zSHJXTw69Tkr#8*bkrox;h0D@9?JJl`RF*id#&nj#Sc1lu2ffF*)g*1>rZ+aD8KX6m z?wh{>(|JXUM-j-q&J zj8eJPK8n!ilepPYl)Qi~C#lj@vi=53Iu* zQib-4%XEQ2&Lxbu0`dTLXjy=mCEB&yU#-n-SXf(-4n!U1FBDV$%cC#zWCJWVi_t&B ze|c)bO!Fjf0oo+%jJ2fGt z2;ikUKAz9J1j}0S@dOoejtTly!{lJghYCt?W(NVadpQ6@w!|UAPn6k%vq{6T>JmS|i;1LIoULk zq2;a{R-KSK;_N&MOCZeBj0Bu6thr9o7qk6YO$>s@ZZ$hEW;W_LEndsw_IkX@@{W9| zun3Rhrk*>Q+gLa~oc883x@JM3F@EXT?DjLz_HiDGwGj>}N?TPoUGDKag=SMuAarjR zrnF2|r_>v`$YH4><8Ymbcd0FN%35Zk&cmgj9f)sVvfvsIqgmIM; zgH=Dgqks*Z%a)U;Zk1+bqKYE-G}aSip&g0agS^l>Fj+@l&D;(#&-aq7YG$R7VUe!3 z8A1?i28H*2k*;6N%CYNn&^hrViVo|!marp`J4ylw&!XB)2W5zSRj#H{lJq;|sEjMZ z1aS;kF!S*j<7*J>c&{TO1D;>wcjSc;CHsqt1ELjR28<}F);YWw^Ys_j+fjtW+fkkf zL5dI^GUy!%D>Q*f%ZZOg9a$Tx2>E=ogS7#RNWas}PEm;UYLwI=$`;{C<(593xM|a- zTZ{wFcmiLqsAXmGb=SZbZ-Pmaujc}EusbbnzMfX$rfFRtJ1HNoWl*-g{no23j(967 zCuqY-+yRcSO3SR95T9L$=O=Dd&%)g~wboNFV!ITvS5OxygST|7@C9Olp1nhUc7y~JG02uT3b z?PKCr0x|7#S0UF-(RQzdEB$M*i4gEr%y$%08cmxB5*Lb)*0kj^TadFbL-Q&dCpE2L z-q~Qtw1Sz+Ye=_(90sr~(F*3}4o)Ro!MquZV3gLKme=%n>Y7tdl(ymq9CM_eovUGN z3_I6~F`Yy}cVO0JP+;tmcjD5W#3Bk45Q5|g zhY*~RW5+KAN36wj2|1TXz)wi?a|B#}>@-~Za7n}` zQpH-4(Cn@R;W-F_#YVwm<7x{|AJpgoIdv@4wtz-nqmOq;OeFxY*LUyA8p^`-GRlnW z7R;{^n|I#gzIKwbv6~t&wXnsHbfya7yrAmTYBhZi`=-x|8WD!W89Ib-i(B;=WJ~^3 z9!XkGM7Df-4yx(l|``L zbU66@*&^6CkjZ;h5%v6^B3|hL@qNaZbb{a&S2V&ebwGL1bXgI~Hn7g? zfVoMwM83EPheieeSwzi&*RK`9WbjyhGVZoKnjMumEstat_hcS1`#)PdLhKsO$bsOp z;Xpw4;=~iV4q#59o}Eh?Ya`#C2ZWJdRK(cGZ|#H_BmZI%mbUu&B5Z8+t3}W>l)U#7 zJXGvSTm4EgY2Sc-;ONF8OE&*JzldpT{!Isnt@+YUP-e|v?trp2UtWYVYrdibCaif| z5f;|`og!+i`MM$~toimlnpyLfJd#=SQxXZP%VFi1?aRpX7zk$9(wHD0(HoIN=Uc@9 z1-b3-_#1+B^a=fjnQS4VuRSqyK_b_v5Hnvwa_k-}vNEwr0+YyP*~GvaG*gGSbw4RZ zZl?NcF5=rUz+H2*Ps5yUC+K)x4J7es)+z@7plL3bHOqM<>+esTWoItxb%u>-6^Tg~ zWCV5Qy+gaY#hYD#eUQI2wN+-`at5n`PXQGXpo#GSsT(F4XqL!;;f^xA<)&}CGmG6g zz&Bu$pyu{_{DPHiGwt%_V>0aux%D)8NHspeP;q;1U7>KHUJaQAp|DxbQash zE&y@cG2VWODwWoqMuTvn7hiU27WHvJCtKhne{e?+EF`K<7Sl43E6M2k_@W1V5YTs% z0sR3>6JXd6v;8K5If)4Deod>$?1p7@qaqWkAke7Dga!yPDl$RPIN1NPM?f7`Jp$#K zjac*q=D5G`-S8cTY@boYBjeP|#u^a>iBqqxzuX`%NC&$9c!LZy1Kr%{CR{=4WnXX* zv2`HpZ#Zlc?|TEiMZ?jiC#3XVJ<^}e5Ft@u2XBi8wrP`a2x_NWDRwwau%u5ayFqy?V3FyOCz} zO{!jC=tjV#D##}Dq#D9OsD>Lu??&YsM@}Gna-&=z*W5bXHB^Ox5>uIB0pRT1j`8w9 z#)E!*G}w%O8u4mP^8dy{GRRN*DI#qKEWnx`j6Za(fzcx%EoU%hbCycL8)ODJ$|LWV z;WV&oV{R2S!!W|NBlW@6P5>0S+#S-3t_NkCnEPaeeLb7_Uu?bp z>hnbhgUn#Z0!`v8`7~ZNixm7Uk2R~ylc?qKJt=$ga5l$3w}2#Mw$~K}iQ=V49f_h` zlTQ`9k-mW8%LR~jT5iXS2BRgv+UfON(@KZb`TdFMuRzEr9C`u=#A&hRc%_{d_hE+bYX&Gc4Jv z1_m$CCuegF3ZQR_wzUOdoLzZitBf$d642Itti8`wITgg&>t^TV5jTRsBfl-MvxvgS z47f!f?ueSe@gp7ZIEmW)!rnt2-~o@nxwfka#;(Zw(GGZ)cy|$m>*2{9>_&qLEA z@@ZHF-@W>LIe>UUHMSk+-h9H$ah_K|5`9Be(jAfdKTYi+Urzx!*q%IdfM8f?f*jy-vfhMVyDIC7j1e9aoK+Q8t|X|1-S118of zJ3GK|&3a!gV$Z)f&jAgZU9tbuuUU=P2DFiVt^WQFs21$*4pRlb+ zpk8kVytnjVCw#!?RsFpk&=9^2&kpmR4!BU+t`2ZAC|Y!T2L@ZG4_O@9Z2@rp$oQ85 za|{~*o{N0^pwHnU#dOU9KM`*=*2`oE#OOWSyJIAp$vTDsJa~B@0de~^B7TrK z{f^f}@E2yFah+N}(!|jP*QxtK+z#;$0Vw)O$=`rYQlOf-z3Vh#7#c$ItAe@LsgXG5 z1Ow3O$Y_=fNUI_7K07tMo&aTuBQwApA<^8einL>^NHt4FpvKJvspig8x3>=W3PP^t zvQf9U9h3NGtaGc5Uv=SaL*V_B5Ukn%Q1loQxG+%cA(RyT;v{$NgkFt z1thNtO}VuosRdM~I6vmrj%_pb4UquQ_DpHjjv6YBF=@z1#G9ohqdl zXLf+x>yQj$)eB^ddw~jeirO~4UN}nuwr~UmqKWsqt+;_s8_18y9N_RPTy+hAI3MOhG&u=^X5cpv zGXZbcHxBm=k(KWn6Bm~h0^M}(U)l+z=|3Z(tYRj(>iU7>laZQ>ob`P(ApUbQg8=Tq z0qT-0(&oY^lM)B1|J$OvG*p<#tLq1F855)zLl$3Q1ynQOx_+?SB^Uc=O8}UK0;@T4 z;`%|>HsXkv>*H6B+SGsk+sXuXIw2DiC;{%6+Qb|zbm6oynY9>_T|Wqy6YH&3uDE#( zXZs*)@f`%$58{yef!Ra=BDoNA5iii#ub7Wm0C9+hZ?kLQ`auHGU?|BPy#i`gJC_$M z*%F8a1Gm`_0B*MxCZuJv>jQM{c3!tL!S~(W2wxqC%uW^V#SapU`~v+UI~iPZ0OZGQ zGM8-jydaOZ@6j-GuVfx%KWf5&ZV*C=?T~u5%o?uB!6W!k<~<@CoT$R!hsYKoJbb+i ziISF^*2s@a!e`Zx-z>9TY)yGFEv9g zUzW^4&~p5t$mPnuB(cGymuGxt1J`X=o32A+&})JjmZDrAbMzjz-XhZCUcoyMw3{`0 z84u(UljK3|Ki_7Y>R`Ryq$!5E+dlRhPH&W`=O3LTx(863Q46VN7R4_|1FH!I$6lk_ z*Q_Dc%))@$kqEP4$iRrjcXR;JIPlnOz&EUcX!;bqzu0Ud(M+6x=#%_rQ~+XtjK)lm zMvTS}#9jk!778*;gxG7KK>*b(dVm^m`Bt`J6x5N|OfG?UAVQ+C`q*n6+xAEVW2*Y4 zbtudJp@yu{HJ@{YhqxrvJnq zgu$zQ$Zkf)*lP^JOPe5tnScSc9)AR>X2ghx;uO}B7zQ)l3djT5H_U|n4aI5pIV)jo zLopojiD^GcH0)3eq00nw7X~{Nr*$}~jC9ciLvh;7=)y#Y;BHO6`$P0QWY^cfik>qR zr!9R1gv%m;EmQa>qU$id=)*%Xd|Mc0GE)|&(uSy6!UNfSzS_(_ zfbKhf5I0?ZH{3)I0Bg932O}rv3P9}o zHC)Poip`o1p`g0lrH&~MlR^Kc3r;bKnc)Kh;W2(8$Akm`fMWO_N)w|20PZEL>+klN zr7=K|rWMm^1hYN{1QKb)ERq4qrczKHvup(ju8l>qnMeS+>BR}ZB48F`05n{jgu^lu zlbPi_qj1RG3&B zkj=dlAI#=GK!?}>zdvl^a0GbNs%FUqWC*h^MOn?F6zDivfGU_NA&}ddQp|D;=&_r1 zKd}U4gg36lDv*IH-!LO4&lJ^tQLPoRz zVkH7dz3Q`MA}E0X2L3=TB4&p`=F0B2hu1n>pOArKl?AErrbT^Cw^+ylR<}SAzy%Oa z1GqkK#)=gVW7Pptg$O4BQtgA)ElB@hPDq1@AQ2>qFcgDnL{tfo)^eShh(ZAnwKO1t zgaF`mshE{mO96mk2@p%HNr2vl!;8xi5o-ZJ;vtGNK_an;1_(yMEJG241+3cF;_F;Q z6bgX4LB!e;kZPa)ih_t#08lrGSf~QhG>BNy0n*N931S@%K*LR7LH??K=@L1Ay)!!Q4bx43LJKw0Wozu{1#9 zp;%vpAOi1zG~A@YX+&@xkl5rVqGycgG$Qy52;8uwMG&DI4e3;3r43N*CZUGJdKDlT zJ@xP@mbn_z=gGv50YKpAxl$sa&PbF=C<5vkrsWVjI)H(iqM*%}|A`GOJWXnE|Ofp?3RXzlafi+(v{y0ilUI-0Q55p^EswVSqkRgE0`TUBvng3w{+N z>qBCvz_7?~3W;zTFkpZoF<0J*P$0l<5CF>-fg}K0%YAlLr`zkYHe57LudZ*k5!gWv z;9^BSUUP;Gx3eXe_?{{h1$4eN{gZYQT)i=LmJP*2F$15n0q9TiaQCNe7v7ck#zy#mvd zz``cF)CS?h6MVJ#Wj2yc&@Q*>PL&TbU18JX{CNEp8#iC)xY7pNh|o&%t2Pu5I3a&h z>Z%S1pQaIKd7$so2jH->U&|$O6WI67=IdWC!1OLl#_$cB!3#n<8~n`z9b#?J1HNS= zIKOkjSlWEv@EV%|uC$WywKmM(xo-to`s-{4xXYH_zK01QjfLN~S&nVH(U8pI`aB*a zj<&iRY|O92DXe~te#b_^(jLs9n`{VgO4Y9X zzibSri!{amo{hll*Xh%5xPRXUV>cOel7!Z+Kd`Z;1>S6fbqoBV4K`%1KeDl=1&Z(b zgYDKW@YY;PFBZbymIH0{b{nnR=p8mnpO7d#30v@+}_0nZ~0i@$V=udXoAar*+A!e>3-D$Hl1NaV3TB`=Za*x!z z%jR%lCxcxR7P7k|o;2a=Qe@cEi2F1qr9`#U5 zk9T4~zr<$##C{lH*I9p{<;hMwGz?%NPuX}C<~EiTzv#purFeQj4EomiXFB0_@b;HB z3!HF-PZn@rc{YcJL9>b0f))5xCsYqG&)Hx?8+0(RK5rwqNFcL%!AAP=n~UVoU$miC z788BR2Ef=_ZcE(p_Oi_Y{my3iwaw5v*6a?wQh-F%<~Icp46O#iU##b=o$<)6y86Y~ z-xgT>AiHGjcLfmU^KOz2a`j@dxl{N9El`jAcr zziGqE-67rFf3OiRfE5L_24?%;9Z|jP{bLR#9pHotQ;SP^U}V)e$UTsKJ4jr=BblO> z;E`{H!+wj`h@3?FHE~E67+{x>w^ugX8-*AjWN1qs!n05)`KdNUQ8i9>S`MRrz@U7S zekg{ky>PY4sC*}VC}x{v>H=bbo_^iy_$ z6l~;_pUz>h%M$B4o^69+j2m#vP;uwvFmOBwoNEJZA3ytt(0Milo*)W(+i`+BCCGBV z%>uq4&mwPq08NBV{aU`fgk&gA6PJp;z|IpETQpqK*&XOr7uqcSEs^U*HU?h+76a|) zY!q$8*9!c+4U%^bp`&A|U$9~NC~2L1(-&{1O0Puef42P$WYYlHes(jTQ#fm3Zo-jNzGU<(v zPLlzNlL`e6a!q1q-r{h^H)0_&Vs0_C$Hzzv8Hl$ynq%W9tQp=oO1cuq87wY;bb8I$ z_z75;IM0DR&9U*-oZRS#ATMl9j{YmA>I{t|me0`(Ph6HI%!|~TT7BFINh|hsQIhIf zgXNWq>JCqs9vfdZ(Yes^(dlK9Azv^`m9#ybfjG{9rNh-TCoZdxt(j(Rz{P`XEp}kKRo+{ST-CQ%&~+DqIDt@1i#y5D=@^m@Y_=Th~RKJ_tw)uZW}G zX?h_d@HR~7@GU5&7XpUo^kJfGx*3pduV%U#V5nwHBNgcHPk{g!Cn%NZi?)(#^mA@b zD$}=Iu~ev^bGK5Ze%cEkn(GUA|3K;#q8Kcub7ug z^;5mhG;S?Q{M5QfUaH$~Hlh%2rK93yCnhNCrk3_NRTi|cR7fDWH>{GSLc|if8`IJt z0$$j^6nv4secRHb;b=wKtz?!q4ToW{6e<|>c8;Z0jW3fzSo$>_LI_LOhQkO^)VLR7 zA(^+9W-hW2H+vg@9!ZX@BF3X@+^@mLdZdr$8NW`GC4Y^W$C*(^fTNQ%$;+pVrW>Q< zYo}<=ZR|p)bf$UQZyK1OXnMbpw+d!oI?uc`-YREgWKyH1$#k|Ymc?jMBmU@y>EkBW zp&{ne#S<$}5Oc+j@Vdzfs%Al?@rmiNRU6$CM|s6!7*Z!m>ot8|ZJW8s835X9(WlA8 zi|GJz00uvU(QI=67SSo-p;x-e*XEMr8(nGUZN<8$--DM{!PlA|-jA;{0L?TZyx_&- zx#`mV+4hg=%KdIYqm5}}ym=1uGu^gd9~UtFv_Br;{%^Wwf861ckbZdm9rH6iupdsP zAkFl-ewQ!SGrg=oa?O`zjZyT&$0+p2Ma(R%f544&t<5B@zv;XDjWRRVKv@(7FwN~X ze0|Q|D6%(N4llNVc8wyvh9B~!Kt^q$6SerVC1Zh}A6990B+7}C$fL@eWsT=Is}w31 zM^wFr&qQ(f$E!v@ElGqydF^VGoUt$^Z;-d_#q9{*pySh4nYazj8`L}a!qmK$GpIiz zA}^)$+DZK=REYcpP!Q_byU|_HthPz0u58X3Wc4(f3$hv+#RY!ARX2(Y{AR@G!j0nK zTVA9Np}3%4<6H2B;(8B9sZGb}J(4I!;@%I?n>xqv5yI|adyZG~!ti^K{D4-@W+Q3u;>Aa5 z^=uL3B}W{t6?Cc~FI{%H*7|9JeB|NqA1dK=Nrn=Myj75oUb0wAa)ux;hCG=4Oi4!x zDVtA9x+wK5L0=;B`IMv!{!a_~5rY40Nf-R*2>MdNf3Bf>`W7S8#k{KHvs*H~Y_O{R zwrNJU+83bqOxFMsjZDVSfJPqH6bm%=k;1V2px)%m6NP0Z=FTf&S&)O?8xy7lAX$BY9;ffP^%^;PZ%3t&2nwnN`hZ`k(Cwk zsO}k?7>9|3X^@G@vDML5;K<)ji`p zM(sl4>5+-`)2e&Maa@lA4C{mL8S6U2qmz>^T>#WQ8EVh| zIOy7l?ip|0AIHQb*xwTgHOUIA`cq@8$A{Md{+n^-@oN?>mD*N%a z#@3E5@`uMKrm#F!I(>F&{LC3PnABc)UKkLaCp;npx!Vim9QI z;f=c1Uz=6p3Mr`2{I#m|H@}^u=C8#%LR-umQ8!_Ij0l(k=Uuwl&SBp1tJIHX*#(mA zt_2HLrJu|~)5TIak52NDlAp0Nw-U@>GdjFZsek;ftee&jVx{~3l6K~8Tsm=rdSDh- za^vE|51%+e?c}GW__PEh{2+6E?87;{Umnetascn8+*qV=pDn8lj^&( z`0nHyjQI)_f=AEQIeE?)N zZ{6hB__R9v0GNNw8&l^H6j;$KY1n7?exi0qtpKSwW@T{%+mZRrCxd8f#e*i$F3dTz`w?U31pf-IXX41 zO2{~If-13S7taK6-lV#CX7ljO>5ok{p*c$z9aNf+rj6OoTRS{;g1Y!1NWt=hOY+85 z>5~Vd9f1oJ2?SH`=&FgyQB``qJ7b(TJaW8xqg&(#a~Fuz;rO=*|Ef|?Y5pput}=#o z=wTzn)5BiSvuMTG>ZPjWVzWL59c7%ls;S^QRR=fAf|!((=;b~rQ&JVzsSocb0cdYU zmSEnbTG^3t#m4DTRT|6~L8jvmIna`6NTdXQJ&=r*w6C2vrjEB1Gd=>Ap-NA8mFAy3 zF+Mt_)YpGKN6jA}UOURoKe1}n)aW$TWB%9_>=oezc;1+L2L1oMlhrd_|6r_WH5_*+ zZJAM;zk)nGt7-M<^b%D%OVTITkK=@)5#T#8r6;;d^QP33U0_Z+)x_k)1ln&rv3_#p zs48`r<`aEX%gse!TS7ld zJpw(R<|(T5!i>`Vl@lYQ#5{kT|K(nIO`> z2_DAOUHEX>HDxuod}5bcuzrcU5t+YtOTcxw9gw=; ze6XVY6T1{h`>h#02XC*aeHrjCHt@f$Eh|cKJOkHKiX$^%gAIfku+;`m$bbuMU~2|^ ziGh2ljPo<#s|-9qz%~G^Hh?Lg+N>VzqDI&>6B}XEOlX9wt}UyDTQA!ZS@ZZl4K*LkkEnn<0D{9&vhq2lB6n=e1+w>!(MVvK1&ir6-;*0tMv1 z6Xn0=`m&n49h9?XVx@X)CXAQI+z3tbk?j@rI5)}dGkd1DSJWB=KC!)`o@3ySnLS_J zUQz3BEUTWcY_F*QfFIXxuc&k3$A4|Fs4Fnd9osAFO-}R3%NNFDHr9Ql*L|qh$8RjFg=>a4!XjJk zL)9+3NvoQk)dCpUx8OwR_?yaV!3wo`78v@Lo62hLU!T;a4h6-WHmm*52g0(Id==WB zgDX9j;B@s%w!m{|p#`2h3oP)bHMAZTt2TE9anpB z#HRG{{1QFSeaA^%Y5};fZ=eh(gAD5?M^}w)P~Si)&H>8Q`c;PV`mJR(ci)CCwP2&V z9aEik8;lxn+t{TRtX216vg?p^G?1p$9wa@6q>lsXxJmVEOnJcVkaCJ?uOsbXq-_P- z@QNvJug{fX+UWX)??6@9U(Y_7y3m(qVSl{|5bUp) zFz~}!*kA9tqfGtv=kNpi>#Ohs`s<%C&Eg#u^;=GJ->ja#9Tj!JkIU-4;f{(@hkSHL zMJ@VqS#^)@sHpe;TbF`<{AkxiOo5inp3^_)f0a0jE&KUX>MFb0=5q9Lf(W_V=ey#dcA} zt^x!LI?4c0(D&_v?$iZ+q*FoLbwR&{?6j-+*Yy+Aqv{NGO*grRC(EUUQ%XHq2LCem zC%X63vqC@rR2f{{;-8e&+>=h}QVYh^(`Yv5-c?o$R;s7VuyDEIuCkhY5x^&n!8Ged zWO)#%Hv{!}^%_#1z6-Rdr9syy9amJZ9&yAGN2@c{&e^4Hf2EXq8#>6hfqyLhl>Fn{ zK%T#Y2b^0d^)^^cIX~6HBhD7S7`nl+KP_jD>|h|A1q2v24+b}OF+8E$dOLvMfJgFL zZ;xJ{qy7_~!D%6S7d+vR`5s_?1RlXf;nOql1Re^X-u!7<&3*ioE_En4j6;E)yV|J+rCtCOs?g>%Vtp zVB#pVsIIxYtQJm< z{;N{oDZz^7VR#-HT{Arl6cFzzli9?&(Q$RQ`j^tSw<)FGQCf&YhN$C5MRnf~4Z_;jQP7d$=}~pQ`Voux z!mQFloaU$(aGrDU{bjWX9Y*N|9D>y%@)xBSaGIkQfxFPy0v$blaTdfR-+6yoE#O$+ z%NQH{`}@nP`_!EkwT?x5aaPa8J1gq&`^&25t2-;|==;m+kb8GlR4@G4y|bd0Lz3U^ ztf*5t$>prFYNWQ&A%<|C6(O-o2-yE_kr4dJf%F zQJ2Gy!}nCw4e;Zi_Egl(@T0b;qV9UItPW}Isi>Xsqkm6D{Q-Wg+*46=x0lr+YxY#s zySIahLIIn(fM;hP1_e;=J=@C)GyNd^fJ|LT37LlQ12SC)KOoaB@B=cv05cukQBhyu zOrM|K1C#elAQzawUjwW#f4?PT{XVn)hFG7~tgma<19pI@kn2;-`X;d+x}!|1f)DKA z$#ZYU`UhrxidYlPx>B>Q2UcmN&d7-RoZ8DK`k8L*F`wy%9&_Oi8h$?04efmM4&APV zDjH}$+YNo@z8$dogg$gZH%x%{?kKCd^FGm~7EF(-OOWMBC>f_^OFu#V=YsCT{=B^c zvp^W3{)wrVcOM2L6b(-v6Q3>}2E!BlM?Fk#RjeMJR-aenrEQScM@tLWDD_e3*Dq!g zL~}Q=o4KE_&$Ev_f9!Tsl#rAzuotoa*+C$Pjo35{i;eUNEX6js4u9cRL*KF zXEl_wFDqv?cBc*^u9=uPVf{MwMYU@tCBLwQ=`Son1_$iK8QV&wF2rGb;m)$sz5(}0 zgm1v@6Gc&JRU&@1XmotUJW#Z~bRq7ls0C{#)DJM#|K3?v3yvF8H{(;Vv#jQ>geJlz z@nxk)Uzwwh+gVm>?(slftA2!h{|c$rjIHHa$SKJ2@4zu}g4%&)oB=GO?7ntjs?Q(^ zW9MoIR_aSg0YT~cYJ4VHDVrORf||V)gA3sr5Nh>vO2qr$LSA z=bl5E)Z9;j*e8#v-{A90kp0}xG3`yH{RwE@C-14KOW06eDD`}KPesk%1-3!PhZ|mM zoBH#CRO$s?xNN)tHz3}+3nNui(+TbcstdZHgS>6GZen_#zdLJUN@kk)0t&9^CMJGv zV*NmBD_zh9Ydy6Hw$S+Zg3)oDQtrlLm+US>Kb`h)17;7h*MT-QJtAqxGA*E8o6n&L z{{qC3scDP24Tvy_Q4b>1WB3d+JbHcwpTQGsM+yF$o?#P3?Lf*~_P}rp1Q@M%A?<$= zZN!HF)MqT<6X}<2rW+_?Dl5P~6c<=VA_O z5$&ZC1KGm4Gte#;jE}BXpT*z5d2iGRei&l(W8+im>-fAB zo~K4vPN^I5`9lwvRrj~|RMh>f(l5{Gxnoa79rJKm9d_@Yic&pK?5U_vJX}^i&+nrKc4 z@|yW*Sz%u9epKgm*e3GpH&I?ak6L;CpGP^bZSVu~dKj{Ryq<<1AlIKEFWD4mQJ1Li z9Zc5o5H-X@*bv>1Y3q1s23R3j$KgsmEQSYYGC-EV12xIS3F>F~^P-=bFw9xF-*5*| zCe_23;R8P_tGOTD)TI_251s3AY=uXE2JZP&KwUdAuAW8WFCiHm%~3Dm^B>?D(!7d~ zm7hbJ-$NQ8{t=0P3q)+szu8QBdxG@#-k+DLCHvq9wB#q?2WafuKj)VG0sH`s?a6X+ zIG0~hE>A)lu!n;mXT8Vp19G|Pan9v-_yM{6{BhleYdM!cQ7+FtZnfd3p5VN`4?iHU zC!gTFUW6Zz*X$>CUKem)FH>G`dy?z*argoCx)gpuE<2y(Tz(EeAeT3@Tz<^C{FZW= z`IIHm(ND2N>);3Eb@@}A*SFvYOF?fP*%IF!t&~``MurEh@aOeM`tmeMH83OAY4_80LyuSSl*a6$PSlxz? zx69!Dll;;pQ`_^9qi*5@F%_in)e=lw|OdKxOy{a1S{>Yule&3t!e&-}d= z_190A)gcS_R@A$IrTc?>D=J`)2WIxfdn@YDr^}S`V_Ui~BKN5SG38>N@`I34b*FnP zY8@xtHS>^D_EwY&2$pG}lzP^TRN4plyLZ$(|EK2qA&bLHNO8hKjlsRuhD_iJFKiSxqoj(UHNob9kypLEU+HmTT#~m`>*y^)b-3>?@F^|H0N2|ky|l2dZKy^DKSvSrXb|} z3nW}ag!R)a)w4)=9SEZvreS9K5>7jp{Hm-L;Gp_4a$E<`RLmbsaL(loAWUyi7k3@` z${aQF9L%xQNq_&lIqI*U2g^{Gl#<`gQGW*y(;KG8){ai8oh88E4V&a%>IS6#$Ma=1_n&|`rfx;bCxK7R9VFVHkajU}T?Leh6V#uv{l5wt zS)tD8f+G&sQkwq;jxn_jr&Hg9G>cE`QVYh_m(WZe1Iikt9Hp-8f^Pa6CLB+t2kNo%_{*%bO)oGO9H+Z zVem80Fnn1_xRu|(!2SRCjMhckgI@%FVBT|1r;>kA>H)X#AwUo~gn^v|9P?sXp(ko* z93N(mJ;ZUU<~S$g7-WuzOPKWT3|Pm&W0dq6o%EHA<4opwoH*Y75{%>ECNE{+7XOtmsxpc_U4^`A12!JYo&cLQFp~^WgvnpR_RH}0E z%c#oUhbpRjE2;9#uESP<<38+o_*wu$e zRh{|w&V&h*gb8kU(Hg%)8%G~Pf-dWB?X$%M9$`sBO{kXLE!@o9B)81m8Sl(M5`E}s z`3PWzHn_>-Vv7n^L|PQO)e4&+p-O|+#b-;#+AUSPuqz}1311*KWaJH?-7drTPk{hIh~3Ig)fiy`CvZ7>s-5lCg%8wGt}=5aHx+l>J0T+lm+keeLi@a;X^L}u09|9dcXtz?miz3 z*0tib zJou8T)Xf@mfgXj;utgECsR5TVC8(PK1JwVz2WguXZbTG>!-MigH9$Mi`As$8qE{8a z4AZTkfi3XoNy0$8Tba_TM{z$WK)V}XhWRHgBZBailhR1L*g+>I9_&InDD7^tSh~zn zz;(0@Zd}g##z}k-nI>!?wh$I^b?Zga_v}dz6uh&NSFAP@%TuTD;rx*#zDmRnA|6Ac z4m;>$|AkW?D9~5o{t7ML1ieJ;IVFZ4@BtP3ut=}ogH%3_WqhjPo8&zr!51DVX~y#V zRQ_u$Hw2LITO!cC@kDIgb6{@lNmT8fPX~*a_~!MY)>i;Y7LsX)KsJ8@Dh|L8x=1u_)cLJ zoo-t7eU?;+`8B&U!cSo{Qf^*e`h z`PmCE!|%s)C%4qMllo6>^)Z0<96UQXg8ExQX{UXCAoj@5G)<(Ci92z_6?TXt^vZ{V zdspLUl5lbZ>Am-i2MYcP$@qCdU);}-vo&Y9|35>zI?v#Xrl28>a}%k!`z&*ABF=A~ z#U8Z`8QIb+#CGYd2MS(6vSn!-S^DxhmfuG5_2$ zxj#Ie4_htKonoEYi|f#P*0_K?r?u$UM?B8u=eICUDW;TWwSOqp9xbKU6h0GSCoGg{oDv04a0%?Q5f4mx zlnWEpfX1SZ4G|ApdG2D^{IUKpw2{@g&Z44kaimcpj;r6L2al^w_m+`fD{luWo~O z#;WjqBkCC)bqfhIVQ95lsDY?S#U_fwiO4%5dBbY+!)ho5_;wk+w13YCvxjxVq9;f9 z@A(7M@#W*NXxT)%?HyOp9MwpuW(%FLWcgWIy=l=nQ&p-NXd)&KU`Eu`Lqy=5RjESB zI1$U7grO1ak>!xUb47VZqA?MR69?zER*S~9aJ^;{(JR<$0`Z6>RWdxZ&d=AXh(+O0>k?W_GI692YeB;%a%&wF^bL8OvfYVe&L~w;p2-ceZ6cn^dv$t`9w{=$X09!AK4_89GWaN;%3fynt5+o z89sty1im)J2@Yc&)-{<4D_hviUgx;g`dB2Ch-tyh7ct&PN0;k zi_B&YYNpAR?Wq+{CX>nU3BROxU1SEE5o{NZzjR?_baa#}2v1#SYU+Py_fa-xYoW`o zu|Fh#^v1rxTSV0^Cc5 z%IS|I4Xe#*IBKRpR*%ODMGcZTM^>c=Oegsm_mV0-6w)2+-OIl&Vik`@Qjy&7`N!N$ zxrvcqJDz*{kF1?q7ZJNZS@G#H_5?pU9?%WdZ26X0;`vrN;LJS>jfJNXESpOx+N4rT zpy=_BGY|=DjRK*#@sBOylIfg8NLLNm*q<+ZB~mMEzD*>yjU@Vh!4{4k0NL4aSZ&6k zD1J;z^H#^u7T4lt6r!`un5HeRNSLO)K9MaTd8QF0PFEhrieF!4&ER!!+RoSMoX!VD zK%t1ySgE$)9uvIeW#S*jEiyQf;NT#SB~RH{9u-e4peZxZq#Afz&ToXC*@rAkw0ePU z1ibEUzHA8FIh&bZSAqBFupAEe7)Zneb0Yz~45(CGK+`c`=@dgzue)=sSSS)uLqc%V z@-c#h)))c2_otih?zy|e(u;FDIFUOuT(1R#T98*Az3xXI6RM`Xfp-L9#CQqM11i3N zRm|`q5jPG{*?-h!PYu_#(xRHzy@)k+*qWjtHICa@7eov`5RO$c&zWv0c7uKIP9S2$ zwdOcXQc@o1J}qvwd4J8d+`A)1k1PZj$AwZY9F4bB#G6Yi@m4A2Ek((K(Nt2G6RKAO ziyO^I!U&=)57CqZiUMw_8Rrck33KJp0X&DUFN7z+t!yk^7A*sKOPM&7FQ-=CQa(7H z4*;J2>kHvY7$=#!oJ?KfJ{9nIZzzQC!vx86KzYR0bbvQ*2} zdU@wvG6Q~*f)(&3WuqcJjM;jnhgn52Lo4BLEXgjXq;%VoOwS%=eii1$GV2H@i`g`B zcDoHzX34i-!R<6@a(uNzw##XIjN^A^+QzuoK&~Thhv}<}bHiB+H(MGGI5o(+%#+m> zz*~8O{KPreDtcz(|MEbA_2V7gBw^?{8#6T#Z@3R8P59UYo6d;7(sxaLh2*}m2wO0pBqhOqCj%MpjUsQxthw#T_OnIE8Wtt!B{N((U!|JYUd|X2#Yq z+u#%_zgOsr2ApNfq6yq-3WAmkwV}vTu+IH&Q)n7s8*LxBkw@*@$So)per+SqprrmD zI7q&|amfQE(K6UUrMI!v46jk47Ynggc#~v4#8Q1Z{3l@_Q)wFPr_!G)22YTZ)uSFL_+K3wPJF# zS41&Y!6@pB3gJ2i4!QiRiVETHlw9zyD=LI}_@kq!5L9H%a9%TH*Q<^gGiobl&xV{c zib(%?k^b|PepAV%&1~n%@z<1GY&vD2oF`|Y;Fh(t!)(}vJE`8xVo9Z&0;4K_%}N_>2k4zX+|2=xK^bbB%Ivgz8nW@812g7h>L&glwmV2 z>?M_Sb@6FrraO}?{;AZFOtQEVcrcUvx1{7;1{t3?!s%=gEEkRigzemP z0B1nTtyE;hjNmj2%utEoJr+2ck;G6WP)|W+Cag(kperNVW)bSi46-VQ&zUKUiAr*% zM-vlS`BDZ|q$I<`n8-(Q2Ct}!do!rhDVEH}CN3}T$&xi{_YbthH8C|dkP#H-&SDXf zWTqpHMTE5{LrXMnTH~+rd1?KpK{sP~nI{|+qp0=2#4$h`iy8=M(fC8E(Wv34`=Tv^ zGxul#D6kUjZxUByWU3tVPmKjs!_ds8NMvygCY4_O&P*qN-sLp$_Y@8Vz3xZ&Zqs+k zlVZi;iRDHlrkQ5MycQ26YhI=>egn=nmZ%{;h@+vy&e2dd-g%lC)?>5_)9c=GRrZ<9 zI#ogURXM98amoC_RhcX3LlV61BTiP>;TUV#Y2tgmrZxtyB~y(7$hQKwMN8+YjoQNz zGbnmua(q^%Dm4^}1Rm7Xpyp_m*;#c1+wH7~=@gB?%<;;Ph_km2n5EH?Qpyi9`Ts%9evA=M?7tY)hdVRWq` zq{d>JNO@28fGI21B>04^+N#v%n)>hJY-DXz6=}JQf0!4&RoJaY)xvgOR<(7y(SqER zmx)(op+JbwWp^t_>q0feQy0OXcs+2JcodyGfe)>0EfN`7hF$f#7wr^Mo4$4pQkD9W zD%zCmbuT(3DS?U0U09M;t zrw&?6d&@2NYW2-P%b=C^)?U5WYioP8trijjFNB1U9Nqu{A_OD^!jLeBK|m$U^B{u? z5siY(2#8|!|9sXt=N%GI^xpgLy}#${BYF2)d+oLNUVC19?R7e9K4mCN;XhKWZlNIG zQle7@pcS-*D5!{-1NhaL{rJ_n_09OrQ>?CY1K;UGeYj6w%H)B+rhfeE$EXiK86xV( zA(}?ipQq7Aq5+DAC|1HXU$N?f)I$}k6f+pMvcndqq#6=XG)%EdKzt++Qmh666H+|z z50t48h+ratNR$&8u2`iZ)o{f>c@(LJD{lXo7idpe-2P6=Qb2e8Cgms^p;&zlDMl#H zd=7*o6sJc5>6FFkKSGKTif_Az`Y0+;tZqb#0>yoQg%kyfr$Kz#64}keb?Zi1+^shf z7bw2t$8O?(-$E|szyCXB@xPBDmm-fw5%pCxQn7m0lhL#9X+|(?g)M$hYch=r2{xG@ znJ)Gt^RnsDUN-Z6jzoEluhHjFIQ;6#%nDn5!WP%lNzKR-HYc?v)3j41++?0MUG!-) z#^E+jdFORb`C%1 zv?f!xr#MlI^_{w#@8;Gv~yY@Y}q}Xe|%2cs3!y+07%}b zZ_yL&$73*C^f%0S%o}Et8JkG*xyYZe;mBsVvE49oL>{PvX%Cd}2(!|3(2^jZ7D@|_ zRGd%w==S+2eLpF^ZrA5Z`%ph2UP~Vm8h)hWwX_z4V=ajLyTo-MK5bHeMTLsh574iQ zyiPpI3lu9>>4-w0J9^J(#i|1^P9R%RiDH!j3<5U;gCRS>?~Jvqu*Cyrn<@61!C}j; z$Dh){XvsXqb+nGC53i$Lnr=4^;v?E@69MH#`XB}LoprR1`~d96L1By6(P0Wm=XBu1 zbdnP7y1`M3le9~Vr8uJ5dQ6FI-PSFqfMJVm{Y5V_Gi>pT`b<5=E=N(14hmcL8Du$A zzr-z&m-ug-V$Y1H{2S*RE;0`>l04tABUlBFl`*mdHw@p(V1xfL!CtDWbc! z`dle7=FJer2r5MO*OKhMVGBLdF3m;DxkP=!R!-RJ8@5~`i~x*_a*t>+y-8-jFyzc{ z(oqW7Mh~hE&0-bVrfxcAN?R|rJss4eENn(iN^ND#$=$#TQNJ9S{qWG28n_BDkrNO+Z z^}f~=;6Ip3g6&NuQ+-7e4N>g#r1hk!6@v|{YrvM z{KWzKwFIw>-5F>MP!?}(cc7gxI?yf@Wi%#fN)lv|v_DC=^Bm^$lV0(}yfJxKvb!4W zO8z+6TO>YC{=`G)rwmJRD5MDQC0|T-E3iFfzZ=8*Q--8^X@{f^b(d@&nOfuqCGE+S zzoococckq}bCw?7la|-YOPklKpjE)G%MDw0u)HFe{+I0`*8(6xw(|hxgl8=@)eiTP>uR> zgMM1~C=SzMq8vU8LvbJKg^n+H;{OGLS?nwW^ zkJF?UamXM4R95mh+)p1!fe>W5chf$QnH)hm^G4>+lVUKaA$DPBG=Fv&DKYV%(JpC; zwiULpTd+HXExx4X>G7C6{k7ycjI*sPz>H9!zm}}oog7R(s$DOb9)f91C`+VFE=znp zNw?1o;@6YjNkV5Drudh?)$Q`Z{M*GkW%6RZ7Nd4B*P2UA-Od}#OUw^_68O+}34>rT zUrKr{8A*ikfL|i`IZP;%FCdq(qyk(|6Stw z?QbR1-!9XrA1~8T_B^NTSFgD%nwD}LM#G5)@Ng<5-99>q3uyx22?Vhn9V8-gaeJv$ zrvY55m#}W{AH*d*pJ@OWnzgbQ`ETq1SFho`I`_2tAG$t0|_3ucl3AT<_&g zW+={DP8!PL)zpwCz1hX|<<+z&K|^nLG5v&}X5Z!to`eq*bofw`t}6n0PlmRstMZ@1eeYPq|-u5a6CT zJRtC691MmlzGpYqligamU$Ev!!=*fy z*O{d>5lG51@JY&a6K`-6H!D=HFV1g`xyGa*eth`x&9rp8axl-d%0-oc3SE1Np53ic zrdz)?PLT%h#_H%)xz0hMRDI(G(?AVGL2jT88U=ZSwn#@?^CEqvj=jQ{E5$4NXzUk9 z8`B6#25k&IV)@y+EcLhA`Z)lc1cOeJz*Mi$aCn-;1mbZqLjW&YS2hInL)PF4cGG6y#lcCF?lH z4>bzB#x2#y>V~uZ9ILO_EjeuA2)=G0)UY~qTYt#%mH1J{L9mA!lFz1;NtmvM2o;lwPI2s-3qIkY}G7dgz zR{1=BRlaIpEN!)Kk`)V2vSwKx?JTR-ax=Vaz3q=Bd)q%bAr_vTP?g{&liG~5CRu2F zM@O>4+G!+lSRROtULM#H8@(g&ZXm84?*=XgT4Z@KFgc+)QY!V5f34pLTLZ!tuk~N> zn~yl*3;yyzz}|uW2ep`-UX|PgJcx?`oQc0l+5F81HQU0yfV#n(Om6sPbOIq(T|9i3 z9%g13ql0_=#l!t&kgEY0G*p(koUp}1shC`BF;(jz#nG}_-=xcIC|cZ2`YMh>tGIzJ zEIAU_z=cK>Dl}{ZJaCa<8`BJT!Y}b{_eU9Q_h0h6M7Y{`=ogg5%W0EN*%C!rz~<=< z*gBQ?-nVqSB$wZ}R{OC5qu2@+OFgo}78lb54LlK^pjGQ`otB}jSRtW!ld}4yGJ#)vLPdGFq=#a>A0#!ss!#Xn~T+Su0E%&X8%T!#wU|Lg?j7Lq>8qh zJ&-Hf&S{IHYP>ReK?((VLCSk6n*BJxmr|7KM664BFNL!By_C(Vl*OA<$FBhOpS3Cc zqC!Q9uQhbl`du~RN(GPNqM>NDJ}<=B;RY3c?}OUZV6_ZwvrM1PRKYWOE`H|9k8)$P zC04U7iI%woo7^RG`-eTrk0{7LnrvW>0r(G;&HrE%64*3f`T)?qDT{jpoys=7As1sn z|BU+Z&n6q1-9e_d#k89!n@`fGgbwg2Ez?BJHbn6Nf z8^&VotcH{7S#7jvzmd@xoZrSsL=PvTucY|F7>x$-7_GLQZr9`rLns0A71!xYb+`B{ z^esB|=Pmj^UB^yypZ*C`fBu9&ZX>YW&Ti)hs@hS1VY~)34-1WE2ZhA>t!f9|LcZd4 z`WmK8UL#y)=L(7L1ghG(Ip;ww6y*8*aT|<5yIr{_x|-xAqF&EeT$4OMnX-9)@|YCd zeo6L|Q$Cd;lCOAj%DXA9SQ}I8W-(R{QBD^mcvo9rlnt;M4oJiE{o_r#)DCvs|TbK4pnmaTk_^_02P1@!( zH{}tj=^KjcTT27)6ttVJ6cH z9CxDU7kDcB9kmqpe^YrnTXJRqG@WZWa@}0RDLv!_s7MG|Edz{UnWUZ%_c=&_nb9>i^JwU5MjP`COqBDCLjVsMrwqi-@XhvNO&qFN zO(yE^vf1IX=`Z=|_73IbwA)N@6*{;u;oau`C?XiPc)$6kgTS^7h&Ro*Oh-B5Vcs&2 zHp3h>k2k{{H_tS~oH0v$@q9{r z4CIBzy9SnkccnKB6p~}w6sV)8=r1rPe%`_Ph6M7B@fHFuRY*4bnPH1V`Y2sC^Vn7L zDE$SFLbbdw23pADtw@~kS$< z?4T6u15oC~P|jk?iKD2+<#3Rj=z@kTZXT~!VxqO04F(+*`&fw>alshk% zXPP6SZyzb;9)@zi4)}H7$M~tWUb85ZPg86BjM_mvwM^$8l~6AC5cj5J)a`V1BSj6%tBoB}2vGRW6} zNp%v9fYsax!E|siqj3ZoEtpOYCXBO3STH>zn0_wiHo-g`MppohF7y9z#ZNpz{rQQ( z*!vAvJe0yXsD!mWKJ;tbLK%XRc7uKy1MD&v`!u^R7yI^L6s=6CNz&Y^tu%{#l*O}s zbA9wE?*hT2+~l(@Y^H{*Yv9nV4lvrx$B{H&uLwX~KvZG5s?sY0A}(NZD2oS%A+r&@ z1>NI3FG9C?)z~0Q2xzKw>f@&B;8=scPchdh?^Bf?w*?W}IE<633MVut_wPEGfi!>z zp2G$FIr#HD+se#*kR^^`RRH`8PMRepd~{)zz3ej^lb)6Szk>dciUq`lHy zBT`@En9M#Avw?>qYc-iM8ow}X%R?lDb*y3G1mdh%(#dtf+Hv{i9!@LuCuNmgOz=>v< z6M^vwPF^0L@d>Na;>sg}nr6(#DphBk!m4q~*q(}2MxxH}c+C6b4G5(?mlr4OPr$6b zKVfAeW%J6!208yUBtix~xi)nT^m%I_iY#F;&8P!|I^#_Y=Qo8K`uF^&=HeGG8_6VSd%zlnPsE-jupM z6}yd*ia$c}AC&|rxDryVH0muKc9Qkh9!tj}zsH*4mw@!JpxeVP4HjWyMdtkps}m{6 zs}mbw*p%x^BQKY0Q_Uwq%cfg14teL80ELEtZ?~ zk%|}663hkHQ1kzf&IR5qhRG;0S^Zz0-y$6jJfBa^B3IiG3|sieMZS_4OmDfq8rKXn&NrbM zW`b{WGt6Y)=4P19zBjD6+(mTgI27db#%L3p&(Y>d*@T|-y5=}1BD_@5ZT4wS7B=y)eOARg>|f|JT8`uSE=!RK3D zmMcc!Kf{6LGyQxkTt1y|mERgE5s{CxN#+v_rAJ$On5sc`(&Tjhah*iW+p-I|+WL z{(;=Rl_)O4k+GjFEYzQu8Xua}kBfX`edtP8j_)5EUt_K{DTmjZ>!B`LZ|=g+5%WWn zawMzf@!LUt1W&>;CBBkBgypkSt{nz|%E5|C6{~?1`Q-j|HyN|Buwg2RKD-1FU5K1 z6h$8O9dC&|?yK=Pr<5X}&{4Khr~D1R<30$XRPj>loJ`lHDuT5Yt2uJwL}F^q<;K9tKperzKw&~0qA+1=a%_sN$)i%@2u7uh zi${!0ITnvNmU6jOEQ`ynwzQ68v8DBE@rc)2A88Xuaiqi8%i@(AHr^0NuJD~e$nk_oQ-Y8 zkL=Sh9&N?2|^kE=gUL8hL)SDs@|`AEr!l-NoBd zcc&&epq#gOck27`h{CinX_3@p(#EGrYR5)#eA@K1M5MMa4R-iVPpeByj$j;?b!m%R z;1;KCX@RTla-vHDOl!dmTcs0SKI;oPPw79N^DwkvGeKp(bvY}bihy!}C?4@q*HA_rMJS^84WFP4H<`<h_XTZ7#NnH15SV!`lYz`dsu& z%*eyr7PU=uVLJ~sC~8~P4D)8&H`_)SyxI0lTbQ3YU18IWQ*QDHWv2^nQ*L_krfB4g zH!Zj+l5TaUL!FW&BQ%ucbg0vrPAP(N>{JDLrc++$W^{R-OFGAwv7~cVGfY+I`OPr% zJ1=X_Xj$iVF(_%Tb)DbuoD2noQv|`i-}!V4-099EyELPdme|_nR2$0VQ*El+>h?Q> z`9i0v&Jw8VJhBS{LIs&pkPmel)tQ1ks`LELy8Xsrp5J+EXSb1tcbeVF4L078C(r)l zrkm&*6`g{?LtOG}N7l64*S<=-au0^Gw>88(E|C}{bOL=4tJ$p- z;0@*mlwyNsTa19srKLh`2)Brc&HgyZ`T+6B*`6uMoRD{%-& ze*D$cl)EB4zLiS~5Ig~Kyj^*ZT&v}WIezv&) zy>5Z|k{pl5Dt7EfPnuN0C(RKuj>anf<*z8nzY-(R-E`9RH8NK5UhN3(&5mdxJQoh> zI}9i(6{0R1d3ZaV%cIR%IAYB*j|i-2oMLrSP8tY(NH~R$SFCQPAP>xk(jlKt;^!oZ zk=bOeUZV=G*Oo(bS)`Xj6Hy9RCKU<^cj|j^u-~JH43|}-en|{L$19$q&lEd>nfj~p z`zq39OS%{JnL3u5@rq~BQH+DV+5ypA9MJM~XfX1SS5Sx#X&-BD@PKy63wjxqD^|C9 zWB%4Xk=JDkF}MCB5|%5z^;TyD@U0JeL*>D2QRAVHbM_vJ0Fv-3EGNM6h?iN$@tDlM zO3Xw|S12F?w?Z@%72lNMzACw`r(Ll03lKhy^)CMi~OrC*_3=ROE@ zMO202PB$Y(h2mCSU9MekcI&Tz{@nN%6svC{Jp$hYM+Cl(S@Z?PH>5k-MgHb}UO8V- zeEZ$*^R>J0gCbHK=uCF1$+!K8D)>i_fg@0NQ8wT8Bj|&E^eZr*toSamoPM6N`1zrv z*-!FNvPDfbS#bf?%Qf(1#X0@mtRH*c%X+dx5|{NCaG0W4eFvln+<~m8C{FL@lhrnC zakuYS62v6B#V;txzj(xD^^0FnHlS>Y>-iAnD5~^YXR2c8&Xfew zK{HkHO+Aows^V6VC9+HJ5ow*Ppr~YFsCy}! z@9hma_Z}$&{zb+2_NE~B9);Cr6ipCOPoQcM^^1xpLphkE5PbA8*(*TL@Vh@oB=kp{ zu*H^FV?t)*^?gu+d3c!bB>ut-rYlz8pdf#vA60O_UxEWr-$J#fEB@AxUCg(nqQHC) z6|GXNWEz+e8_h)L7J`kK zU@12;<|YNH5}};IOH#WBo+dgBsGr2i+jtk#-^F}a_&kvhTPvh@*7+L6J7}gx5A#gz zIAhDi$2n}s?Q7VmG6XZvSnFWc8gLCUGnbc`<9vt`p82%H*@f(g2BzR%W{L&|<+(i1 z06BIgUVe}8Ozmxkml=Lr@~g{r^E)%x&95%k&9BbO?~Ie*B)mO%gm-b3L61lYW@ zK*!lu06=H)pbF3L5&C$|u)-7YRRFgP9aS}rz93@iG^ z(Wo?h0);KEG^(OeQo;s(AJ(lAyq?iVY7`&V$FuCKY8030`*aO^GPliw(n47BYLwI` z!ufw&<#?X4GFtB@<6^9YE*hguw1ji`m~W2rMdT$y8Dh_o>x&6*Sg|q=K?D)>_`76S%-jct!U5i2rDLdUq znS9@N7!N6$t60fGA%RHFfF7kj{HS=jo2$6v9CB=L=P6eI6qEHo-H)uHCPg>9KNt%I zs~CAB5<_*K;`Bb0!+ok)gNvJaif_HkUB&L|gQv03r65|Y1OO-yg{c}obg~?AR#P>> zXB(~^aTQoir!;ZD<{?gLpJ~np+rxaO)#>q=I=zZx6G=Xs=^dH2YZa@X;#imEyg>Zv z5-U!Ps2mE);h+8q2aG>85anGtGY{*(LDfJqV+5v-)l6uMGl0Ss1$CoaKVp7AQ_iqfG8pDa;or zZqteSaHqW*Dz-pzrS_5(eSzZTw34VVH7j^6L6)zH0Bb?N%EG61&MD#g%>Km<#splkH=A{}QhlPqCJWlke6be(bL;k2! zhA&@iDcV;}99QnI$|SxziWVtWonrb&r~GIK~Wm8?JbD23?=9Qyvk?``wmz zrz~FH{b&!}zVtjF?QyyXPQ}9%Z@hlz_2>t~6z6v<=!UJzFvYKSIou^NGtAi{l0ISL z!(HC$lHg!aed4#e9P1LuL@o||tjn=3{#YFLk9XAnkRmny@J0D<(ai zl%M<+lfIm~C-o~PEonWi^;b;#R@?J!zhY91Tmzlq%eN~=x)J`nf^TifS9sQ&e z9_-rKl?HHQ*VA38FBfHu$)Eu|K4WqQ77fh4SL|LpZfLr}<#lC(vz>-@{)*B$_J3~v zc|Cn`S67@z(wow005_$dPp7^-s%sd+E$=!7KU2C^b^TnSP0m=D;m?t|8`JK>jHMY? z4(1F%OEZeQ`2=#i4Z4Cm>CeuXo8fX^o3TEF`t$mXJsFhECo(<&bSdLA{Ct*C(Cu?4 zocI54E|Oz0vp2GpBHwZk3SFpQmqogZ%RXqJFemRc*W!@A^zlj$cS1gMXK@<^I zw0>dkALapJ;v!l?ZR`qEzY>4S@n;+au|z6$rI_iwiQ~CAnO=cbGQFhRY-LH7VPc!d zvEPA$Vd8N-i7kl(G>NCPPaup2wA@u%bcg5yUKJ^GuvuRnT$$2Y!GQ}jB~42)2$en&z6UA0sf;2+|v`-f*zqb2Qwau7fB zTua<@LntLm=+F(JYEF(tqAjds24*edJpB#b2|8~>()5f)^3 ze=sgqIVq?wce@`C^zRR13KcF_VBCxhuOEkD4jD#g* zseb?-l8Er0?3Ktv+2lqj2*(k1bSb%_d~W^L4tXdpkLy(j9{ zV#Rmm%c&k#{V+brRgF)WxrB zh{Ts-cp*(^)Mh%*fg6N5ydR)gfvF|9Z^l%v*@+H8mP?Q*1a~w*C)OYw1`6i84H)bW zrmtW=w+PJ`z%DGCf}FixucWOqhQ656son2TyWhFB6Bjcc z2N(;X<2LI1ShG`kAJ_WvTk9_uyF0}Hm9qIA{UBy#J}B`WocL_V?C4R-;$!++dHT3k z;yXDJf2BTrRzJ*|-GdKHL=PunA2;62alYN~8a0s*?w#S6xrsg_6F}JF&uFjah4*U5 zwFuF1xZ`n&Li+2v7k*to%n>5wDPE)TzMgCS%lsbMGJko%&D<+Wzp%Wd--g`Xa2_9K zUq9ztOfEBgm!@YJ%*q2UnZuww5cMlMPVr20hmRiN9ljbrZtQCOwSHWok5ioSSIU%J zD3izVVb<+cxx!omBKJ&Tc?kAj5A#J4U{FXjJIJ;EMSj@rqh8oY0$~z;u(ZhT8-w| zt%zw7jK|`0f(Dpf^!j&){v{urln38Wohj&Y^!1cAt4j+Kw#!ECGudy67Ef;t@0nm|2M-|5F}g6KcTsIC7z zn&KY4jHYlrB1}i(z5#GVI~Ds)l~dYmJ%9^$SOSDCo~_S|gXifx{W0-M3J}H?1&r}L z`iQn%ryO3c@AS)#Ws>3-9Sg{{`dCJzN9_iod$4Hu_c&NS_-;7wT!>G5X6rn{9$h@~ieUbFOsPMrshIW|NU>NWk zIuGzXy@*!$>e*hQ4qs5vtK|hN!hfeAhp0eIEVzKGoj^6!qL3%GAvy(lh#qzvb%ymJ zc%8hKcjK=6ZQ~fGhl^%Dyy0x}z3+o-P5%-Juo)8xl$qDU+upHsR-F z;%AAJ#Y>YmB~d27n|wBzGPy2gL>dM8t+bb0Q;-YVtZqX=-qvP!8w&EfZFaS#AivXY zc6-X?741K3PnkTT!-Ni$#XCE^(}6O1ct^VyOpboz#L3UYO~&${C|DSy_zUM%$>lc!=v#Zyl^wltVno_@|7 zsr+0urHCn0j0^2*S{geZmTDuo1&u#>%B~OH5YHxb!`K^|r5k(0u^VG+SC5(;yK&}CEs!&BTGbM{>ZXR4 z$cCG$yR=AN-K8NtzBCQ#+tQnrW?TBsW<)#Fr*~~eG`(wG*LY5KUH{e$^S7=;GnyqE zno-gmRgzJb5znbCqb8$8(Q7gmHBY%HV^2o&hTM~JC@!sh%J5J|Q%hu1Ms>H?T!gZ^ zTYZn_NU8X;ZHkGx}I`)P5QQU%8`nJw^RlksUKek zn|@r9HoCRgTaIo$w>5Ueb6fA1-~FxM>InF)j;A})!!kywpD=i?g8Yxlr#t(HEv}$y zvK%mMaWyT}+{j15a94g(OK>9XHG{$ypVY?bG4bQ{a*ihclwUUjkA^K9A2bMCBEI3(?;zv-DUB&sq!^7UO(`y8L^h>d@<5d1WJYzjXg<~5R&)bxW>_Lublcw@ z;KL5Mzx&bdQQD*3&q$<8d!~DRk0`B(Lp_C!m@_Rrb#2q)0Ec?1_P=`uY&Lwq;uQGW z_3;Dzwd?<$Q{dh%&1$u`%eZC}-njIN<`Z5;*K3*sUu!l8zIKgs;D2RuyULU`XteY7 zmeEx01mdQd4THRC26LV+pLMBFd{PTz*SSV7#}TNUH>Ak?wm~K_>Fn1&0xx8Q@Wwzs zt;nHnW4Z+-Xv>#D#&nz3Ehz_|tHtME1vRZ3W@P94r4eLxw>91HrJ}w#7Vw&G8@l1> zDZqQ(E`h%jbE#WJ_b6RO_sQLTa)=IFJfr*82q0CM-E9T5kt@3G#n0Yud%NlOjzN5| zTYY!RqVD1|+64!>^H z!v#q$*PEyC*6x(K2}hkPjFI>0V;pGzM#IE@^#6&KuXMoLg5zK|mn7CYp8RTYF3jd8 zoC||jnp0j*b$kg{C_b8cE)`0z3iWxz`PEi$w1SrH|24oB8{jBT(%C$_{pR*~QpB6v zf7YI|`Lp&DI#BRR^IqlG7Jbc~DgWO*(Q=+Ra?__bQ6K*Frb(UTebpqW8u}5TJ&rr@0;3FSvNCw}cOHzYD*5VGcGzMVclg|IDsT;jGCV-x)v2n%{S(j{JY!E$ zoDJVA_-Nx41w6EKqm598m@H3G+|c?0^k!A<_qK7`E8hpWV`%WH!r<050aVfK+tD^E9O7)Br2cg{D?8@S}at;~62xM}ng z^ao~{&ke4zc3Ez4THvFAAv;l?+;(PLH+ZgXsGUm?>M*8*FPo&GCZMikul#0*zoKkA7zxf;xle|8HNhS#-ZL`+>*|lJG-x@H+S9&Q!{Lz zw{|}0VGnjb>tW}nZ%U8lvnf545d%wM3$;Scd9Tcc+Bo^H8d`gtHVICl5iHjy>P8qr zNl;`=k1IHY9>bJpe6@-RZ#1}9(a#Zr(2i<587&1h!sNDfZP5S-*R`!{>(-~P?a{Wb zRREv3;nWQ=l^D}uRtIcIrzjrNVM+(L2af45y@T8Fzf4KSbQsgY$dYydU-yYQFTd`k z>)aQ6+ppVxom;5w*A;a13e|YyksF;t@$j2w+~g2Ts4%(v~ETM{#;tx&@;o={aTTRp|kNoNxSBrLT#D*Q9Ss_fl?3-<0n9AJ~-sak~4S zk!N;Y(ACLDO0p^aQo1XiFPGJo*}FV9rMu%)a(0HVM1@nsQFmPc@HSK)b#XX#duq&M z%I&G|#YDcB`hIHUa%*DRlr&3vEJo9mwA!>t)SByGxjqsV$^U-$(&=YBy+#jTbov!=AebDA*~_J7ev(?+$5MviJ# z(kfEs)vaD_6)7{n+G;1Fq`f0~xD{wfD{JKzlFM2xZ53OArLCI0I7xQ(S?UX?_DR}l zOy@`RB79XjSJ(~XNsJxD6vgF9vy$9yJu7Ls*HeY+%AGhG<%}ZqZ^!9YpRjdJvsewj z6da6OV0I);N~V51DS2(ID(-PRtbJ;94X<)5 z6}P*|87zEL4*hh))iQ(8o z4yOYNxHz7s@X;Z!@*`<<%$ICN(}4teb#14@3T>L=1>yo**nHLo0J5?%o7tOdNw2Uv(t=$|)uU9Lmb*QKiSs7A1ESLN~u z2CpiYs-H_$?lzJt$wUR=LxJ{@4`KA0eKgDc!al~} zENz$Nk?pc(xNVFWl*3CTh1pIg@da4ybxzWUgdr@>_xMAarTOK?u^tWpk6JSlqTqiu z>BT^4g4?^iARMFIg9;PSBl$=8H#`OhSY9`;{QA#?-${c<%_bdR;;e4AYZ>iX4PuNgPY{+Rjv4$ zCUJHEA1yu6J_!86YoA{XjE=s6J2?vMu9LwKzCIcIM5v%1M4G`Wxck>ogsM*g3caljaHz$ zS#g10jD0w_NLc%d7lK{T*=(JyY?gTCq-< zTrB#9zCvGU7MtiL#pX1Vf;`Qf;gj>`OvR1nSrfx;rg9}K35rF!5)`RR$dmOf#p+vV zZV7l5>etVhT|RaVWRHD^UmK>1^>QIjK^vetGhjh zcYn`e$bJ9l%MQyr#D9D~+F72jbEh>~ppf()zmqAJ(|hi7E^iRN5B6QoIrhOn2i)Qy z;?E(9a|Og9s?*{yjsulDD98^Mz>>CrrpWk&la;%?lHT=Qx1>)MQKYCvG$v*_9Yfn= zpzXBFg$9N#-bLr#ngBYlUD7O>TmfCus`MySrLTyAR_Ifrqsl4h_hTgR{U1an@PnRm z@r*kE{5ePfw^u#F7C$$>nFPj*nOg^^$%Lemrf^G{RAP1tI=SBE_TE1hMOL69ni~nv zrHjsLgk9@JLKWay25Szg;I2l(>Q95*FB$9%HrR}LU975c6z*cCw5| zjp50cBcE&WND8zyj+Z14fdv$9l%nwaT3oL0YahiCe5B>;u?h0^0zEE4fnF4kDAG&g z5v6)X9E%ElQyjcW-xr@?pZ=B}E1I|TcjDl8^kV|UvKM>jWBO@bI=Voo^)il0EsfH% zC${Z9-Ny*Vg1dL=m!rI^>Fcni!Q{D4Kcq{as>442kY3Jy8*&n`oU5?k5!38i z#c$~$#`_&EXU*=Z;08!NNkOirQ333t>lCY}ycP4Qr`;8^kj6!q%yCrXE{myQ=+Z|8 zq!9o){QelTy#4Xn=<@dLUu2kId8?&Sfo7{!o#IM9CZ34v6tAZxcv7@PJLI^$Iiy#j z+?8DB7Z*5X{y8u?p5q@C04y0-@_EK$SEsm^rpvvHFntTJW@-%Fl044Kj5kfue$*)* zM-`YZFgI3Ht=E*b2s(3JEzOB+N#{gAGX(7LW-9u?itLRPqIPUk}0yzBzu6AH*zV@@1?# z#UE21B!J#GMjNlW3OsyE(j7QedaaIy0ZJs1jHrMFLY~-n_Qe`ir+A50CAR)`iWeG7 z;cCxW7M2BPMExxjz!6;2ld<hhBAN1{g!Kt-E>ZwA4Q{=VRiiO45bZBKFR7!LxF-ooP5E_6-J{G zj>xwtP=-6y985`W=B`j1jbRa?4l~29tfl6SW@EHJ0Ej6f^q9fOCC*v%VoVV)nwKN} zA;QQjlsPma|DnDjw}pi2YSYEP)M6)7OK*z7{ zom!NJ^QkH}7sQuA!CpplNwYifT->(waXhO{!j^uLL|pGgINsa3bfHY{Qbj1&BE=65 zMzIzt{>fli*u$CHH)3)eFd#B53>Xlt{D9|TXr6m6Li5~nQJUvQ#}*yVDV#?l1KsbZ zR#8<8Of#9jL=ny}(JLf6UT5)pg*H>OT5Cp68@QAiNa zXCzvtoT}u>Ru%k__u+b)C*OiVNzhP>;lcSNQIJp46iu@q;3?WX+1@QttnP>r@*Q_X zL~+L*Q6b;4FhPawB7H}?8o_zf5hK^Tqs>+ z=~pTTQhn8OELB%32b|139wU#(ACJi6@yDa`czj%pJa`;7_uf_qK$LJCosFS%yxDb& zkzBWdF~Z@2{}K!R%h`Cz)hoXBHtNf_Jr4Wadd0WhMwx&z`SCn)dz(k&M4I)Adp?M9 zRw_}1~dh7ZLrQ(U7h(lq-gyh!Y^e!>T}@j5EK zOz~N9<c{2q3)zorXgmBFgtUzs_2VPjar}Isjg>ERE>}E*=HmP6bMf;C&js}W-Y&0rehck0943ozjoP&sM#lUz<8$UM42@lD++hr5@^db&b!cf1qmUMAyVh2q{%U;$bo zo+kP!f>XyQa9Thh6FVjZZii}PrDCg%tDbH19G==^ga2F}IXFcxDOPe!UZoh9t-<%Bs|J(1KI7O=!t8Bz$JCVJUqDt_cv^%0++f93s zeKvMis}){sBNI22DO|37Y@qO6+Or>gqa;MtytnwkPmP_T;+IkHcy$U6636@8N@YPt|c{gPWKcNC+3H*MX zi28HNP_9kXs4q{0*Xq8K=IRBhK@oHKbqu>4MQatS@1wE^JWJX9?4MyW`{y}$-oK1i z5ujD{n*6>-vvl;awTfS(DYAO6Rov?V%Hr2(qDEOf5wl!huF_U&Xo64K zP8it1^cv`BTO{{>&r+6T`Xv8(2rM|A%$}6UXa7t=UWE@31qFs0l!ClQJK|-23a&}| zDr)c=twDK>w$A(RM}ug^959=|(-08HIO`PO`$OGs9Lzt=k)IqJZ_RBw;1}?KzaT)F zTo9NP5O`9cA%MnQr}#M=1$8K4U%F1QO}0Bc*rurwBgU!PbWdk3kC&!vEA@b*>=t;X z{+8}_=C|~>b$4(c)sIGlHS%4449*&!13e&uC4q4`?8tC*Y8FJzp#EE@xQ>Q;<|{+B zI6&GKlFy*FDEJwEQ*L% zJQ3f3R@rNvjDt^FMShR=jQ;|(i&v@8|7-^9@u39@@=q5ePzA3@cn3f4B%Da33O*rM_qckH^;tNpG!o9+zQ z_0Quy;9tTPH{Ch>u2^{ZT{U-kwBftU?{-+I|J}J>i#$%;cKSA_GJN{Bx4-Sx@$GM) z`*y&tgFNaWk8|G+-yRExZ(n-5M?3M3DXvJbSss6%T(3nQAARGKZ@BXKDBSv zH$&eF*fSxInUF{5TQlO|8Qfy>`R*&+VJ$aPh zTzzxEE{8nIA&=^tH^jjkZaxvA-Tn3bUw2qsvpoJjxn7Gr)@5wWa4N$aGwQo}@~H2& zzFWX9g*-|jkM-S-#=!u4K!m?XyN&AZ(SFeVQg?^NHOu4glk2s}wgEd2^2mcc*0nw9#a(ly{|8wg@*To{3ftjBzWEU?_7)E7RQGxH4@)E3bzwXtk_9zM zwR$5Cexp^WwMYA2>l3XV7E+J@y}4dX$+jeKPj)K9+ml~S@#^?$%C3}vy#eyr0D0_6 z`5+GdAZ2{2NBeQ=XQ>X0YnI2~C)aC{$MJ+yxGlu!JeBZfqF2W^6Hg=t>@|?b8pz{B zVsTO|T%0sN$)gP?m%AdpW_kR5a&2nY)Xp_OXlhsA-a8xDw_n~qU|&LAFQKl>+aHXB z54JxSp*`3Be0zt5)b+og@%px8Pwy`>nb|N z!WA7GI(oDdyG(HxDXGW*-dwMxWczP=-F;oiuivz*lUK)Goep&h*he9cqmaj;PM^fV zpLD9~?9q1A7_K!EN-*tmm$6Yrx-4L)FA&*ALqv?j>H^#!l zZ>+h|qYd9w?uzu9`^VoQ*A0r*?KIwKm!Gc-&d z_z%|nD6d2|D1J*j1Jfob8_#GV zICQsQ0mC7ElS|a=ml~5|ph?D(C?uJDq=oS2D&MF!VBKGBEWxito#7AU z1^Wk_Z{Q_+zA+h3*e4sc0@fPN+m#K9OO0v+TG0)P%Mi>~w9zy0->A6#b(FqS}I z>j@YUK2aii-;IiY*bB1SsJPd!5ZI*LcOs78>rIL~-RWFtpu%_F3A;~tPQ~{&?_BEG zntJe3de^-@_Au{KNK1e@s*6xy=)6PupW{CpANacH?qmH`QwJ3MHrleJx)7tktW0x?P^juO}5=hk!&LG^-$( z^+^Ykb-XD&kh~n9LtCCQH&x)dshd(MlTW8kN)vce+PJm|NaBrp8B>tAwk^C)K99Ra z@#MCX+fo)!Zo30NJKEN@6P0^iyNT^FV74fpnlu#>n+gZ0S-dG}dNO=Y@$}@K$u7n8 z)VZk?mdj(02Yn|7|O>w&2XYHsjf7b59_PV{nN%6V0oY?-u_DH)G zPn9UhcR!3l2T>seh@|Y)IakqP1Gr)U7WIFG-I7Aa2t0P3lDR^+Zx17Vzi8|RQ>)heD%tF{TAZ63I` zZ5IHs^ATwI$cwrU@`iTczFyufG52cnd0~gBm)}W(R_@j03&1QFmPE*PxZ)5#y%FU1 zv?k{r-*Ckzv=i7|fbj{fIC6bgtdGIoLT==SE1sxVMU5uL8dHr#n3aneEmrBN#w;T_ zf)O;&GUm0w%`+OrYBCFz;|AlPkq}80w)mh?UP_JgQK zDE?U)*4{FD2li9)VVqXqz}Bch@pa#T(5@Kh)ZKko(ES@Y4~Xe8K2MVmX8E)Lo9qSJ z%eXDSWR8)K^p8~hk+wz;NIS_LH1E~-qt9ae?AIIQwFANpyoqDUHt`fQ7H%|~;^3wh z@CWkx7Q8+%FTsdeL@`ov&M%xs<6nftKprF^3R6Jl9p|A}m}bPmGvM?=tRWRx{GBUN zs94?ab&>n~c$x;FgI?dSMD1qSAAMC76E z@+4v)&oydgsz*d`xBvJ4S1*HqEkL(}@D>{@@aWmgY^N~{18;XFsXByHa!NKuC0vFt<+Xa80+L}Z98V# zOpKIKil=MKGzb7u%i^OtVoAe9a?f_nbj)t0I_ceA(RIHEDMd+Z%kn>0S!*y{D!70K5+pMa$jid1ZKT zVB{(E!1rR__`hd-5NYNQj7#VyGEa0)MJp;%-0Dv1!*{~_oPb}8IJmjf9e0Ah^G=u3ol!?K101h6kB2QD@GDPHzk13! z^Gm9$Flz;u1{hCwK85}>5M8cBeZ@Rt%a5;8iGz!uVE0<8xI+hLapMj>+}dyt+`P&f zVk=g4m&c(XkVRAw+jYyo$oUdzpXgWSS6E+t$2c7fvF$co(g@X?(G9daSdB`ZRprb=j!Q-MTMI!DaQd#F8Z4o;jGyT91R@ z|G_-2^@nYM5vnZE$u>@ZkIc_YwP>hK!s0)-HIu#OmVv#DT{ABOpXGgOmUZ6DVuKv0_u-4#kYRj z7l!o07JvJnp*@4+BCIC={7?eEGLY*$*5-$*C=RZoWt5l|ORV0}<0#3=-Y-SLW}P28Oi@VT>t*eFQx^B$?X1;f6?emtF$?hH65r)^w-??1 zJ@g@Tt?y-Fc7tLtYqu*fW|3SK?-tkoLDXb{5ifvH!dKn z-#Eo9^r>R#JWla`?Fe=Q;E}KAd-jp}dMI)P3+bg2&ccg1z0@Nq)t3kw`-Ua@3K(Dx zh6x#r?N;dX&43++=bKABSd8(OnCne%1_b?jb4wh&#hl}dji2LN?2F~M*muB(X&!kW z@V$%sY6LI&a7T@4*2!j}wa@Ydw9jg?T)FM=j|;?bmoJ+&Qlt0ExsgHOUL`2+I3?Alp+3i*D@(DRH z$b>Xb@nQ2_)9oVfnkP+k5p=ne<~b8DQ%g~*0{=KnJ_1N>KDF}wZdvmE!~Jeqc(}g+ zc8=0X@U65ojAeY4tS1GzXN^u3T%*s2g0hUm2G+!K#l4=TAU`{sL`_$&cndz>l_TFx z>($FGbg$KR(YC~bTeLSKly7KFu~AK0jUJP5 zGKY;QC}n8UnlyKiH)&PUBQb=k^qNTHT%i)pEA_K}I2@L%XyB}NNpt0XNz2zgx##OO zI^$2S{PcxSUi%qx6&siZ5!HJxN^F#zv^d>f>Xn4nbbd zl+&c0(7bw`(9XiQh>b5m@FkutoeO{z;1r+p>UEAUM(TBuFGcD#QE{v5upOVM__}XV z7JutbJOjJ)55P@QtZt?t-#it4Y^pvJee5h;epSf#&A#~z1^Jn&y0{;hq<9Uj@kZks zIv3FkoTEywhLz|u=uBaY-_Q<62IXOGyeleUd=7@}*<7W;lXYJ~#pMOJ?1L!CgPemT zz`WRR-saKJW*%>b((q=O;q;o8D1HM{!=mKk*R)10kR7&w!0xwEtI=cO8hx3bj18Q# z4oP2HrtfNj+okVqf!nK(HJYa#Ym^)4^^Py(a--5fwhmNjRHBc1K*;oGi(ed+D`d_x zokx{@-K)G==8{-~C1#TuW!z-G9~=3;`5~U}x>ijenzg=|I?5Ly8nt;kn!f^%mP00G zNsjPJ!L!UJ(~bK7O9NbpYmf`>r573~43BBGK5U&+u@Xzk(Si_^s}^h2E@+U0XvQQp z&V~`{J9|>5B>UGfcw;q&Uc*Bb!8EH}fxb*`+gzdj7aCo-kHI&j`$}+`-h{86H0fgv znW|RhjQ(GXx z$%<8XTouTNmsg0wd$QuEpEjK3?&$*AhM-3k&{%9k5PVUaBcl@GIocd-GMwNFnRF0d zp{?-HE41|y>h;=o&F|>b;1OlJ7S^MnLe}j%`eX_VTime|mVU=!Z>M|xnGucPz4!XO zef+)mV(xWRv-ds`vxk4;$wV23Z~%mb>B*<#;iuvA*oP`b)b~;)5V!}JecDCMJHTAjK7xqkj>M6(M?IYse4x`YMp5^W0T_L@P$;t~zf0(KpanT0? zD>m&x>yQQcAnuSA3bN5SS{MB>G#CA$06MnQ zUr@E?DWra*wX^ahY>MJFe1`GCN~k`A61hV=fWGr^*y00PnT|=vu0+XEfPi!62Q0*( zaDDTZ=>>*QqA@ob3k*j;fSt?&qu7i@6`K`iG^)bf8I9U$?v9DtZ61n&4w+3+LMXW- z44cg3E*-XT$D2Wy+&Gluk~zW`u%WQ9XQD1pfF(m(3q5 zA{(&^nn9v+7MnxVx&?!52uzDnt?Qk|)a)nC2h{xuZ69}3Y7%eyR6AS=~M-70XY zHc=K2h;5=);i84==OH;&W2OqxF>;@@;ZBW@!I5>Q3`rq9s2%inmj|^o5r${93z}cN z{9u{j3)%ra20Re=)bJQ~+EVeUif6IBE5yNc4zFeJ!SP!DjEx-3HInORJj`$fJj@tv zSh5>LMMfLw(sj_1z>S{}k2Y#V(|GMtx<+AMBiXgd{J)dxONr-yh!|d*`%{qnZxk0V zFDl+h`(?|6sc1hm2QqpTqWV9D+4n`obEtt3oUT~)pdk0?hrc4H|9pgZ zsGCW1+)WGbqc=V5B5kQVba{ie)eSoN{N9_Eem@ckF)!880x$SFHF?3g+Dgrr<(|V< zYOjhqu7fy!+bY*wNV-)!1nzRNl8^n$>*Ojjz{yo*NX95=WE(k$>cq=|vnJQk8rei- z%f3>mRitnz1~hocxp^tvtJm6)1DRe0cC6TjDh?tHQ@EjuKcy464nLtG#XtqrN%{!;zmI5^?%1{sRa{7gQ9%O0 z*l`3|NYycdwd0)Q<%Em;=uhG$#$fGn%cRwy1 zp;WM=`QZZ;|>mv`4oX+0-~tr*OD-p-Dv zNTlD+J8@6st{=k`kENwD&BO;M(t3umpJYE)15oD_zeRmoAP$;`%t)U+c(x1ZP>BCiN4rV4$O@nq98vsQI3!Rb1;!eAm)UTGf_*#J{+UR z@wF`!)E6W5gNU?gK90D}#=T0bk5FH}$x%Shl}FGj}4i!_6rou~rI z8eZetCh;2HK~m@i~UF&j`b2KWuD+G3_>^+Jx0wH5~S5DX<%*uhS`; z*XdJPjEg0CHcPr}4ja1-%H-WfwJEXHW{rvVYgw#(suuNCvEmSdnZi8=TS({FY3G)S zTh!?z=!|oOMT@vkKZnsIeXD%Jpjh!_1RWMJ*cbIoHd;) zz+B~56y#rBj99NcPTBnUVtM1SSbJ06c!26DZ`btHA1!Y}pn?@E23Oq@k>sykO8G4>(E{t8@x-`XQMR z0Dhga`Rj)u4khqyo*Ztw%h{>(_rLGf>-!_TdhrMv>Fq>E)97gMr3l4K(Q66$PLeaP zHPD_2#U469awvvckq^+wm`@>$)G8u}$_i}?_JML#gmucdDahac9aZq}{u8q(PR3yvM*7{$1O=UazBsXK&svmc#C z2ff|2OrM^?5K<2j_g-Ta7g3QXYq;U}4hxg;0R>sFc_keo@AQ0x-UAykUc<$91_e1| zkCYVPjg-wd?m;z`+;B<{8SmXlZHFIFiTD;Q+pvSYrD_%~^y&^1+E5d#^UvVhtj*})D z9_jzXwSq|h2m6@Zrg){ORICahr~*2#<46m{^OVicua$DFrENsnyp0Zl=n#!Y5VMfYEDAYW0bu6I z=^rPzc{HCQ(<#rVkQRkP+S168bE%_nLz49fI#b7b?PNqGC$$T%NI0ZV!D$WMZ;HMy zdf&WGKck~xg3B5Gg6{e^f+Y=K&_iYntWeGwJloq>&E}54z3r8rjyO*`5Qn=KfiQq7T9l7-+_Ccd2LcCnWecO+Wk z77Y!*BXKWYx1*A1ZQh%B4zJriSQ0mw4W^s80Tw6DL5feBXUu>N^By@t^BHrK6$@{& zwnrR5Y`6AA96+E^TeNa>#4NbB%jA{X2}8HXx|PsYdivOv+J(qCxuAXQjuRAFc@E;(=r%mC_YYeH0sN9wA0DXsy0J$ zVPHZ4uPX!R6C8ce48@ZJZzW*cGDC5ZzsXNQZt{QZ*X_Jq{@7m_puSuv+A(gadZ{;IQ@o zWAD%7q%5w!ak#3kb9Gs4@qRdwjOIG2FCXhva6a4NVy@Uaztd0WS|D0%wxE@R_7_DKSRYrCdzGN4RU# z#gyFCSX6Fm0#KZaFKN2s)Z#c@aq5E9coqv%kH@08fl&oAor{lE4HsRe(~#s9$qb`s zAi%^U?eSQfj<+ZH_3_DRg0`wXnAY~FwU!mC?8|ghXer4oT1vS#PO>sCakxx318IgJ zF#!Wj^TKTTj zY5@8I4C3zPme`7dK4&hw1T2u)oBu5HUF<1%zB~Im-<|zG`EH~9=a}!#6@*Le(_HnX;P(8TaaF2X z$?mj8?Z@AKRS3gPAqcy>ghO9p!cjDxtk8*9XgZCsWd@C~YXeqj#w%1CXb5mbL*SGS zoC*vM$_yGDj0QO(8l0FUGboyj@6OQKP2%h>xY_lj5%xMH{yVMX>@K|GW_RHgon22i zy9=*SG+2@(d(zQ%r*E=CC;m>SZ$iE&ba|?iHYLey+LRPchE-v{pjT-+rDBs-JAo{N zV*twF?}aH9kFwZXd;y+FfS@hDZN4Cb-5K8ItMf+J`NHri=!>`>VTZ#0sR{5@f0^Ht zTbVza5FPc8b3D=GoGK^Dd<@xDIUhMG1`*1^#P*RhA&@{bAy5+VxIX(UEbE$onQB%_L%RDsI796RI$Q zO}EtDB6~3T^#sh)TbJJIY9LE*J#?#4i4NU*=vLR_bLiG%xB9YmpFVc$`B?b;tygX} zz7z8W9c?%GCfS7s-*g&(r*9hgMVU?mzgYPtE429)s{B&qX4!=zH?L^V@QU_Jzbw1Z z(k~C_V1;(QLIXNX?0`o!IHRlWu&_q&xY};8xv60AP1|om!(zB@zv(p42sV7F|IM}* z8U1gL+zjavVn2L*Dj3RvhZw^v+DE^v3Arwgw;Ozu6{>ngGn_@IZ;G~OINE++d$&%9 ze(~ZLp-Rsebh>@cmrW%^za0ItTV>HN=X5YtmeXNC2e-;bcbL$@P*3Pk(!o3-Ury)I`p=feh3NNI~QfgAU^Cok?g{=+Bw-AXv zwS~B>AXoWW6%RX9i;EG!3`0!Ih<#ro-(#yBS-dSR3V%P@Y}o zYm8(@P=jt)&Q)__%lbKLp1Z84HL8ZIQA^tz^|lJ~ZkvYRRujnsbDr<2593Yrp_)hm z)=nW&IXaL1Pxacpr}t!z+o4CiJ%Df9Mfq5 z|zw0*=5 zaJ8Z^wAVj2zH}bzoOC>K;{p{dxHFitBG3>_4q?5_lU&%L`KcAWZsK@;u_mD@N@God zvlVU&h3z9|Av?i2ZdQMz1ET{j!RSCJV5CtfFpk5ptB(sTkA;^9Dgy3&iFuA$^TM-J z=chvYVqrNybxAC|Bz1YJ*_BwP$D#Yx-0O17Wh%w-q%5jeC-oIiC!N7~u4_T^qGXmf zi;_{*4Skt-3y3qRUWNU9-nTaS-DD2D%Tzg<>LPrwSpd*QH92M{m~8E|T=Y&W?Dw;~ zDLe<3VFR#%y{484Dx($f%UwZ7+@<3(K~Xb6fx{AWnV^ECswA0CRY~(xtx&@&%-?x? zi7z%lm-xc|05AHufg6GYl3)dK?Lz~SMkh7XS`<8)Ll>a^j!r6QiY!Q)pW1{nn!2$m za%1Y2rpPVVN1jV<#wG}DL*wc1T!@4m7{gyvcX3G#{MS1UWcuZd2skw3TTd4p*jCq`CDOcBmq4b()_goZG1D z{kvdU*yTsp!b)qIpn3i`fO~^+Rl2`48Rh7c?lg^l35y3@2)J*$c=XR09(~jR+z&oo zKdny+v0coy6oit;C+pROix{6gCdIRw7?Uz3B_V!F%CwXwZ80rncGEt95$nkbohN<_ z0=X+eUQ;{g$&H6CUr;R|vXBqoF{Jw%56S7^qA-Y^V>@C31Ls1g&_9 zuHmj97G7AUT_YTLj={`9V$-}~8m&?g>{aPBMAoueQYk2E)RJ0D*GQ$HL-LsE^vC37 z>99hHZ(o)<%Jp-HiH>qqt>uCFv8SCHF3uCxWBIf%9uN0*$+D^q@k%E0H1!N6%=Xs?ji~ z$#l~|X~;cXCQKPLr*E1v;JqeSM;n_AfdoWE z8c&CaEc1wrQ_7tWNnLkOVDn+0KK`u2ORb<-xBn?TAwf;c*Ai$ z4kdQsMK9J1L#>(Q&SJbjhn-29NplSnhAEAlOLYlI&aIBFl6Q15@+#%pO^~_v^rpz^ zc9rd6rpn%CH(_R*y}K!Lw>>twF{MD6|K0UE%eRA1qq_Rf4quHwz#0f^M>TwZ8pfU* zU++KUH0FyAIr9UaL~D~aBzgAFuGe@`(^K&9(L6}fd2$=hac`p|?5DR@&_Q|7jLd`b zYRoa?svKmrfRSpX>AEA;tFZ~|RTXh5_~EE`)FF1ZSu1Fl^#RPaA6VN+PXlWOKO`l*8AbC4ct_S@Drau3q;sq{}O%{oDpj1@R891f$n zVR@1Vca@+APP+3?lgRa^mT;-=5F{HSr?W7thD>nRSko=NgIF!-g2bs)8l-^3y1N?d zsXa30S-eNSCvk_!n0{k9I z!mg&+``U~p^(Dy8ON_(!HVfM0JBU-`2YuBJ>@otlmHu_mxYzlCgCS$Hpi%y@es?+> z>wnF!opaIcU-K{VyT$@cU$n#zrvQT(985-6)FH#1-Etzs#gj%|@I)#X+&6bRrJ`HoqJUm12juZf|K)1yj-%q{&QLz`f!FT?Gr$ z7NogCZb91qG&2_VryWf*3&x$Mm+y-A@{ogG4#X$-@{r@{<-5?!T|GABXtU%l^ymp zE{tK!>Kaezv|dFlbbYN3Q^Xoa$tO4lv^gOTlF?N=*Vwt^NEEO!r9fd#L&q9LSKRgE z##j+lYQ#eA?d{7%5i4R8yohx$HVzJ2hpZs4$F-6CkTs6H@HncAO>A{^&YjqV+-*9{ zJHmAZF2ih6CRg!n@(#Mfc_WR_%YvAyipOzHue*NQcTLuN1c_Wo`CPe+b-+E)o}wn# zs5}#s@n_^k8RUB9rlpG#D>>A&hEJ;ru_8~f3S&cmkD#OSA|9GW3UoaIT;gZ<8iw`> zGP-Q8jlr=`&;xMn!35MKa=%GdCrF$_InK%Pwk)FY_FO)U4g4W#=3FexV}pr~$?=}6 zL&w|2vD*!c?bo1Fu#K!vP?@y^3jPvnybUw80B$9$)9F;NfP*(souI?&aD1l&0IcSE z%jU2;?cIzztuAw<)|W4<%kgxVRUzL;k*#ObLaWSb#yYg83zu2r?Z!yv>J#hWdUf-j zsl4~iLgGOD{;O#zsC*!1#Hw$Goa3p!IqXl3LEoJB-tuBbygZd>=7YS1)BjTqdaA0A zQP;zNRA0zOXVu5(xmX2#taimt$nLW0ZFj`L+Cla9xma7Bv(MSCAPu@#W$Y zW~ha^zTvT3DTn*U1C0-i_pOPc>x0L!>j9Gxf8cnqJlXrf^5oa~5h@tbUQd2A*&LQQ zAgF-m!uxD4Rl8dV2L!!Mm$0pHiE-HDJ0R#|-*~_2hvWT21MZ>bvB83%pDoT|hYEs= z;=rQd>+YSH0_n}gWbuY^Zz_u+K5dO%^bN(9Ppq&*17i~k50-+=lCBJJ<%Pi*Dptq7 z9<1m4?YQ1hkMXGE!Pk;tD(9%zl0J2nj`vskv7P*ZAm>ImK)lynZ@TP3LBc&+uqR0t z(VnC;?B#k;&}$g_nKaiv>%(zO0o+Qv(sYtad!wywGw2%|?JahYEj60UE%sTT2j;}} z>NxfRkE>(E8{g%DJxK^~BqraK8qrO z+1Lr29VidTZd4w4AJF@Oq99C)R1|!VPwXEQG!qnEs622k0RM=Cg31Gz1F|d43T_U{ zY}y<=6_i~$>-YUfvAQ|xj|8;RcTmtp|5dXXyXqhA#EqiEoxB8(@jNGD97iGIIm1t? z@$2G0G)>hYTrda0 zRVr%GQ8gkaI!0KpS?(ee)(CpdT9g1UY69oPL`#mHYkSk?+7X`@j`(V05@eWvjNeEF zl&eC@E>s~e_*JN_04CR-2z6_s9r5YTb4buJE7z7?IbU>D&Jc}vNKhT+!oLrnv_e&g zs`g>&aR~PqqX@7W>OLE>%S`7k<7b=@h0eXiUTFsz(u6CSf5bA(Y&C6>CQZ~BvD-Rk z$*%v1`A;g>VKbl)3wJ;tF}>ud(QzWsaUyaN>p0iPeq<6I6C~W-ok=Y)UjZ=@9v2hk zq!xTg<(QyLazK1~9iWD|26#O&4^dlGik@Gw|D73jXp7pd+}RZ<-Wj0XYF|_2J~gRD zV@iQfZc+OnGWMw*ev1#X922zOK4QyEI${I&@hePML!r1k!2)|hB7kX1bGg7?Z(~2% z-7H*hulGc*w-1^~tc(uYM{L)a3dcqEFyOB?MluHxYo0b#hWNA&n(iTjN}u7FDsyjF7he_ zAir^r@p$(`@rmG}i(X6F2|*7%FguJkSAk(K3VrU%Gy7jfk$tPA~Vy8;rpnE(QIejxrRv*?dC7Ee~^vG~q~4Kr8Oxb<;f7$-O0cg@1St7{ZSa(D5r^SfZabW!MQ zBQs`THk~1haYs?HRl+uYL_TJgB99eHt+r61ER*nV=H*J?6sjp!J(l*o zHbzcmvD=DtnzmuS7lw+hdcGu*FE6?%Xo!sPZ7!IiuvHrf;q^tBmN;P?6!MZF@w7~* zr_Zqk;F6%PKP@xp>5(|5(U0TblA9$Chx2~oX1T{b2cy^1d*nfx!nT%7_ojL}D9_7O zM&a60ZLk=j%DFF@qiX7PmCQ`_aWC9`UF~j!*{zOwlN?hgxfkfqo>V#U_pkD-N;Z;p z*IwL}R@6dOXwT#w*1I0)nl*^xaf4_q`NNu!i&`Y#;srF-2fPQ@RT1I+EK z00&rkd?F5%dDh}sc(Jw8vh}HiYHN!L4yRG1u|i%JBSeJ{7E!UUoZr^CENG5e zfeyJs75nrm;`f>U<)Ow?TuUGFX?S%qP-c>l2vrfr4zE68SJ%XF$Z{vW%YqhIE6@Y6hTmrmg1HRAVKm+Z$J0zyArE*e zr?s)8e`{%jvAkhXLmLRJ@Jbjkv+_yxa9#WrGvGcpi=32nV@l?yKGAk{92dU!V-r-^q2ubZ($-s+q!6x`Rc;gEO1TztM>?kC2H@Py z`L|e=G(lXDLm_cdPK&qVK1+QFdCfFLj>J)4sG|stjjb-n%9x)Er_8?klq8|p1HF8}G5+&ggjOKw+CP-RoX)y zud+RKFzBv=c$8y2F-QH?Y&a9mR%+xw19=6i!4+AN zgyVSvxJY0jjxa9_3`@d_nQ@1#Iy3SkzJXYULmmwDpTON`+#6|@a~M0rz#n!_@VQ!a z;uFqkbKG`dpdj`XLqPzx4_+si_6s`{2@Fee*U=0QORB)LH0+!)P}0)C8-bW&@J8UR zK#)hB9=LA>HV5=x2-gd~x;d~t;Eq956-zhT9vGI?7|Eq8Qm@5@!fR?~!s>OV+F@3& z%lhhBXoq@7CG*H*6kbeJ?>EA{uj(j~rjCZ$?lRb9G|V1ljLbl>1&c=6;iky2y}BuK zwY}XS;T@%uZ?{kQ-L4Wxp73AvH~RKP|HuAB20!)>bP_QGox_bVhn=%dfQt^bfNO7* zRg4u^u~p}a-hq-LSYmN1RrQd$SO!Wb8)RbbT;?akW<-SD%m@}-hw_|~Yg6Ng~ zKuKrqOU3|m$u9E6mvBWs7>wdexQOqB-@Uj%52ovNd*gZ-8wVp)5kzB=I_p?`|H44| ze@Cx~wRODz{L5{9HnFX_Et=HSY-<%-dlk2KzLpOEqto5H4 z%|FP9zg!uc5o=lJ&6V+U>9y{;^jsM~mkt~huUttD)=JDND+xIG2jxntwsvCf*=Yd> zjU!h!J*!@OowMpq7#VC>91@=%moGkHQ!7FLy@GJzPY&Y2a<&0xxSF!W7^WZXX~W_%5B1$_gFgSz1COja~ZDn zy%XEuddK$;cCx_mJHC;AFpTg>e+V-mf~Z$tx3Gg_k^B)itUrR&wX7KONBXOkn5tK* ziGG|lWZX(s1zeTF{d_YtuECmt&NhP>*N^F{olTfrv%?N;a_ac@e}s=YCk^_fbJ0Qb z0DaNf9WdeDfve^=3N2uVNIL6Wblkh{FCtktUJL1DZdfN{<0ibtn29$7wdS}+ZD2Q_ zwc^>;B|d?3pO|f#*ywq&j@$&X6OSNg(uZ93qq;MGsE!&<>ZlrR>0>;o=+Rc#3i6>I zJ(q{AQ{;h#9BKy9FiD~s>#S-y$dN@f$SLBRIfqHQdyk{{#)nDTfCpHzsNT20udk%| z2kEYx-*EH65z^g!87WB=;mbvG8#|oU|p= z?Wi|eQb|*d4XZG%56)D1ma7kfLliI1%C}tA4=61$@~twXB*u{Z@q8=aXfOHJ%9zK+ zN-JviwNNz_wL;#Lm=vOtn3G8fy@skq*Bx#TH>%5UdumJ?PPL~SX*k`kiHYDEdz#q* z)90G0+_%GrA>J+Q&<@`Q$K5kS5-vi$RUbE$0Dvm3tEb)?=snsx zkcQ%ZWp~v(ltyD+ul3vzO(%H1=|=)+I+cOah016SC^Mi3(lPs3d|w4X{By_bBF~-4 zROFlDi<=Xt_@?2dEzQ_8-)vu?JHO6^#n^1$LLX)xeY3$rU%AiErk$`ZJt$rAjtX#9 zUdSJo5L^q5dSBnZu8{AWZ(MG!N4CwXhl*2gg~(#RqtTM9Ftz~s7whwS-`Z;*!?bM!;!0RKW|3Ylj{;TTESDov*fna_$35DOrd7RY>?MyeQUPggswHG9Y^)^VzGPg_o9IA{K!uHvc(C6Qz~G)BnNIJ@dcPJ+Vuni(1*4MX2z~sSB><#Y7L9!I1Iv`Kg3iulw-q$GgeX!)tCU0KyJU+7i%at zwl$v%xupfcOnWY56&s{c840x$HuaV-Njzb;gP!=Qc8{YTtM~$Ycrno`xmub>OlY+% z^u>TeUr9{uD)CKmwK2hYro(iUFR4_ng^Sx-IY&QEnlGtdje-(B${I(w^>Q3d#mk{GH6A-(7TA4rn-2!_5WY)v5+7;~I6*)l0@ps!?aq&Cf6nml2Pb zbW~l0CVNp0w&1`=!)YPO3|dG?2Q%Dwsc~7fkWSmMEK#mA*1=5}4rq4u$#( zx6T^Q*Di3g&~Tc=6IZqd=g>lOZvumg%5yj^q=CLB$br5ZbH5~nNsX_rDNUX4KvU!a z-$kc!Zp`J!_CO!2UjuyyVW~XmJMCxqwErAGi;bF0tmyG_yxAZfFK3(nBIE=!dSH- zi&ZV|LFgxdTWqe+1#Vei#;r9}^*h zX%a0b9JzPz4p~k^on~yQV(T57>}aSn&Pib;9>;(ckH$Gm9gjVDsk5sw#V)7LN#;ah zH=8=AERcvP3)BZ1Wn3S)7VuQ)GScR8!=s;D98}1geG;4@f$al*q)9q}pUn zWH{wU18=Z$Q%SHsD6?r;QaDLwQaA~X2-8ZF9#L%i%4A968#0}~QOI&rgINGsZfZDF z!_5WY&M(V!db!ZSBLz#?YTrv{Q!jmOj>cyT;J@EXb_1U4eTt;9avl_$d2)!p zvwMncLNZB~NY_YKBIogDHP`-iQcsm6o|5VG)c629Mly`OCd_?L{Wh+k|2Eg7yXVUB zfmoDq6LsO&;pnNqI(QQ%bYIw^zYdUbU;rojMwp}AM6xTsY=tU?L3E?1er1KK1pR7! z0RI|4K46qThNsG1Qa(ewWErc|w8+0n2R8YU3RA~aNxS4GOhKD0P@%D=O4@GWO;@^R zRgxZTQzgx}=i6G@<)BeY=i7T?;XQVp?b!2v2QP#;_5&@RpTm^c2i(&q{hmlWLQJ;e9RY_tJ2JR%ei|1A#z9qBhTf6kk z`l`gszS-0%g4;JE5_f{l=tqla2caXsDydr!jHy>8Jr|L(JCpD`Qm;yi$UTsEd(L=eM=tf8aVJK7 z`ft4^N&Hl%(@#fni8Yu7kmb0BGwG*$Efs1`d)W{mfPUhqGJ}5lYY5I?kHTObB^xB5 z26npMU=KY z*V06sYk4^yak*u2YZFo2dUfkqiq)-8#v)F(z8ni*Ze7tPMpV%zx2;K?+cw%Z77=Y* za-)eTxpC=@v52KNPWY0EnDC{2Uy4QS`_kg}CSq~>tLt@U3q;rg$f`ARIGGhdnT)fh10tKqL3s_@sRemxd3_3P0%5dHeb z?;EO(-+%Y}F{*dJe>DzV{eJDEhN||_eUHYd_C4Caa}4O;c~=)hwX4gAU1AX*b{YOu z3>f~@)MpIU)Mpkv6N^~z%(ghN?V0({8>;!wzwvyG>W$~$j|1;NU+@bQ7MAqMN>JG@T zp?_kYPu`?!XgF7}04aL?{967k-)~_`|R^Ao4+ml!1?x+XkqHO3m zAMbhR_nmya7~D1Na2_#|9SJXTE*y+g7OHPn-`2 zhWMz5n!g8{f*7vuzPTwZ2rcKZ~A)Zs-5x85zNSDFf!uXk#B1nPV)c6sq_ED zsq_EDX-rW58^o!ILj8*V6Gdj6s^Etgr%76XU^=TRR%r9z^}zg8narUD?yK0efR@D` z%U(vS2%@C&k70*$`ZV;30S$ffeq{juPEnuIK3dRFX`iKijO<_9r=gE)AZX~5%SlQh zK5~DR_bZL()Sr&aadw3b)gMJgFr9TQD|F#+pCOZS|31H)$rc3DSs$}Pm7k@)DgtW) zb_PqxHGz!*?2o|nVPjxR0JYM9`kLAEWX~9IvgiEg4ZzHpJ=T~AYAbv^5Q z>UyDT&yD6JC;lFGX!P^b;=r`$=RdEBIIB-rc{#yI&@J~k1k+i?v_fM(OSvZ{SMYWJ zXaNM%Ssk@Pr8<+@snJxdMy7pQEqqsMZZkK*Sp?H5w^?;_D^#WP`*bC%Zyrj+UeYv4 zp|r_qGMy%;U2b88c72vi@>+&lx-A-RS=!RHXlctxOSD@Kw1H`lAALLq9DRJoPYuA$ zQ1SSh$K4iP^Z4$^O^fb+eBa}`vFQ9y2J0laP<8N6C&z)wKb?UME4Hb8>dKqYrlO78 zq6-jAXU*FRE&D9xK6%608{C!E*&A}&Vm$^oi=4K(ZBe=t=*iWOEPONuEPS*!25`9# zK63aGx7>#x>HnxHcmGEhKI)cx;iFMbQiYKpeYDoabLvmm#8cWv+qy+vf?zsfEn$Un zK1)%T-uNybF`p*s-5VQjlAb$NLMJ{81KZnQZSQ7s62Wv{3t6H0pQS3QKTkz?*IjjYxm~XAu5)*x%fWoz5`(7*5@L6j8 z@OO@V$2IL9`_6^$m}dztd?)`u!00jz6DaQnU{Wtr5oh)3hRK-+hJDxVoChC_eD5<=Q|WihP1=+H zIp@L8l(wK#Q75-Wi#om92`!otcIeekkxrY5AWh6Gaxs1JzVeNIrXQjkcP*PKJH5OqmQ3^+(`9vk6(Bkyj%cdZ$2^W zCoy2wPikWTe`o&_2cB@bJn+P&Ck&UDo|yF$m&;i{iRvV1!{|?HT|B4$bX@LxazMH} zfelE{OPA@Cm;OeE6)N~FL;8Hi|tQgRXArKInR+t0~=)t{-(pfi|ObA9am%Hvsdus@v*rZs}Hc+ttmKZdbQq-QCg+ z>t4u7=A(3l-6JlZQ-8YBo$NXJSyvo~o}K(Gl#ge_&sm`vpQUtLdTsCJmTr5mJ-tln z_Vn7<3k9k}>Gt&sKW6~uZ%*$8z1`9+=v~#@l&-4x#olh|F7_VANh(pgVb6u1(|94L zOG@R3<7b$_OcN+GfmtRn+XUvAz+4lUX9Dw0V1WrNG=W7Xu-F93O<;)$ER`f~m+5r- zQMNP#yhUcwEk~7tyA$BV=pR1=F}GCGNm-^Ks+y9#)Yl~$FKhYq*D@JYqHZD(PJ7OTDPAt1)kUbV{7 zd(7-%7BM;*DEv zL)o{wi8!2YT?XD!^6tH5&}U zmjFgAdxkH8e1>ni5B_$D2mNy2yNLwvvU?0p)G!U7+@b@%(SFx?0SPs7w0}!ey1q6P|&6gjU%u8g=4l z7Xq%4i9U_z);dEW8+*jdB{leu`ppdHAM0QSgR(T%nc(iK)0*HGcuBB-J#7gdi~|RQ z9|z5lUoPp8Gc15!zCx1V7thmW5v5Orkzu0T&yRTPs4V(sI=XlIeu?3sk(rEaPU+*| zsX0#KHS^}2kRR{UMCtVJ&a~G=9=t2{mNyNR8<|lJXVL%KD0$>*_#eh+59OR*mn425 z)9D9;abkY3wG=zLORY*kmDWh!m;+6Q%%Y6JIJHlMfzA?){uD`nkRj7`(oUZ`%|%>` zrU(1SxL~uZ-ufP74aV3E!MmLDtdTZm005lvR%?gl_Kh9ZQOop=qt-FFccPojC2hc2 z)-UYPD%y$xtbwgG5?#nIUjDXx`M)U2uQ}t{@QviB3abTE=ZE>DF7_UGrPx_j>fxE{T*YbBzOA zt{iI|*vzS4ekMSXz!PL&?1w!*i^R=l>tTlxYGAS{qe~I_B%GHu<4v>(kB-o$s5J9q}(tg>14hZL&26;+5 zjLe6KJtfzx0EPsENci;6WG4M=yM%8LjiIURBt%oGoCBbE`DK@xmrG6Opi&u;0T%Qq zF-7EdFF2S+z!#23`)6RL8HsvKcJx_3| z>Bl>zaiG+h?HH=r&dGoYpA4J}#J(?NGv*aO_~24zGJgQU8H8aoT5O-NWj39#i~K6| zD3a`O4mvV}4mx`R>=SuCnx?7dd0*<@;kc(Vo90LLfujLTa?QPhc79xf&Ns3ZQg^wm z(J_6(4%NtyH_Gm-iQH0Hm4d{W16u>HpKc;gFNh_L8L|S8%l+G ze`au~9O~voL*?Sw2Nuiq61(wSkoEFocA!C_z`Bu%;M@q@=Kr>w(n!pYonM%*7U}vx zms+HXeLO$00-r{Y<02dQq^HsAvJxt6CH^v~QZ9qf^)huzVH%-RDq_h@eQRC@Ra>KR z-f=WdW@oW9PGyBQ_l>7J#}}^CIi?gcjaI4kN_L_3oZ~L!SY*j;DzXk+xEGQRTjwm8 z3|z`=q&XtPN_OKkGM!GT$M+>@Z4;)-IzLUmx1N|U5+>a6<{E3-< zAO|SEQ@>Pg0*9N_aSb0=7x_Jv7EA&~7MBK4sak~+Lc*+4n-m0vj@YDXJy5MW9#4a; z^kHwXGQ|6wOY9v*#C$~O$#r!*PdT>VUC>dEJ>0z^7Gi0*J<8|a2#b>(NC;|u8i#4Y zEIWG-w0iuMy+(~ ziK^5k6TGAr#1|C{toQg9DUiQsRbyU3a69c~`vT8Fw3l$)83(vEe2U(;y^prNZ=Z^t zr$1#6KzaD;luxdYy+)T$EWVg<{p$N%$Pa&VtD&CXQJ2uaQJeY{VN2Re2TgxFNaxAn z1ApjZ=eff8_#gBHB>&%9@vTUF&Gf^s-J`n~-IHkqB4xf4laxZXqUQ?XQ(7n&C>8qo zr$MwPahsdJkge&qdoj^9{%=F#C6|a^`kgP#p7->-9G)K_qjThJJ#he-Emy}PR-@)! z`W&Ti$6=z^)SJpgys0k4!WYyvHg7S}HMPPrL@TV*vG8f@QtUAGC2JL828p@&G|;ZO{h>3SKD*1isJ#m_dR> z2ha=>^x)ILl$ii}t__HEaws zf#D`F!URSN677*{q@c8pNHtPWtB&~AC_&;zM2$AYd4fc1V8)n0$OOikK-dKGO<Qq4@*$q&0 z zl0|e^Hbyw!&bc3PyM#MtcAI|lj^Obw@Y;#)E_m&P`^{bxwa+xzeiNuOf%iQy` zwf&dA9+Cb~C+*Z7k%z4S0IkKIvL=!ToJfm&aZn(atJXx4U1=h%BNa+#)DHU;F2_G* zFVaWZPY60d^@PR72|-6_tS!6ISbMq6#*^jtTHB3UBHv(J{s}x?*q=85krs1YCg;4( z+RI0BPY8O?I&6a1Vc{Qqq%n6V1&LHt$tgkNQ8T+e`U6+Hdg2LpntLJ|JLDC$3vUmG zHvc{Bgc{)URe1Z%+fBlmx6ew5n|1rj1bF4`hhnscZa;Rr`67;xt0Nq;Z^m+`fiXT0q0yv%s{jhC_Wf}N8$UOw}(-aDf+FNZkEjJ{!qLVuX_ z2aV^{pJUPY*@tb{Y2dJ(<8$~10+?Oq{I>S@L54z`UkPhIr~G!#Z{0@y99f%RY4vFi-*SYe+uJR#dyt_}m1(*y-S&3-{F|<()z(%n z%UfIRZiS`;!@FD6wL$~2&)vDKquDXwXm+@Z0l4XkvP-jF*-)CjG~39ArP)WZjfPe{ znmvq@T!5e%)+OBK|BTj}+^(#hTlBJaOWMU{L-hM4kGZk|e&t-s<=>Bf|MPFH585>t zmK)lgYKPXsKs(hg=O(nt3{>!fhb}!711>!j`Mv?T9P1z2^pHEyHa+ygLuR0T@X(=$ zbgR%u4_{%2!etm}R~|0p^b8b!Kk|J|#94ig0;l?>nw#9FtGQ|WO{fR-+U+;haXpMd zJybln@Ovma0}H>mI|eZG?>~6(LATc)eDLE3O|Sj+~m3kMr-2a(V`$ch_PMosA)<#OGNL3p$o}bnBtKPC0rTyrklMlJ2J^9duhfHZNxRR|DrM>h}l*JSP=C`_2 zO((Z)YdY0;GNrBWRP?ZJLn?ZBIVYKq(k_2E>f$-|=UCd3M_x7O_FsLZ>=Bd}LcQ#f z*^i)Y8!)10KN9I|0Ot4ONBTeN%JKe>7CdU?c)_C+-Gd|a(W6%$MUotp_R6D$oSuQg z&XLZ#N;s>}vFO7xMj3zXQ5h35P;|)g2^obMV0}Isx-eruJ7)u6e(N(1Ww;G}C?hA+ zG;~hpfJ|K~TAmr@B$X(7G;@0#*q*uHCE~0;$D*I?dA6t9$Itf6dDav?=h*?zqUg&| z^a0OS^)dkSTl4JJXWgQ2efH3^rs#*BJ@Twu^r^k(a*`?(eQvLcI8f26s+T6>tUkx0 zmpwQ4Ik)I@pDTaP6uta8y+YuVUrV36%xC!kFu#MIANsso^r6p}Ja39#^87aUm>+F> z{v;4F2C#RWm)yE2`=`#daifW9ZQ=zGtz(fy(}wb7kFMI@lRWftB2 zQ;xi(&Exd-0sL`*_sA@|XMq0rWkKRznNIhf=V*Z6ky-Se^E&!UVrqci)E^s05nx8I z3KI8#bp*ID*9>;&LVMtQjy-23^j*Y1sJ~Kib#CRY^}1J=(kj;Ie-4gt@W2O*=VY- z8N;2)KYp?mbI=(7WOhqZ|C7y8W+sX}cz7GJP{&DPlV8k@~k{R_|Me(~#AA?Vk?^CNp~ zzE6a+Ne)gx?B{rx~J_!^b3yR01BpH+nL^@uoQ8O9RG5z$zlDaCW4MBYNwIETr$RcH>H^-RcnbZ|RWwSfQi(>951V zDYHYvwb(mfp&J^9ls2(rHzax*#7vW(Oh+Qs! z4%Kl^mGdT9fbZ_ig8Q*}&D^0yugRH`Wdq7fGi8yALq)2=?6p&aIs#uDUTFsC8#AT* zr4l}FaXn1-OeuTdYu(N%i=U(l#Bsj`4i~2eN!%vW={7vD3$JG_{v%q*21(p$wh8Wx zEp&q)IQx|<~TN(T4JbAZpu$@(FJ$*O{62361so8wp5 zn{m(aHvdjP!#n+_bl{YK25%=O(NjI}Vl4F-j}AMYGal2A_R7P64|B%z`_W{zh-4Nm zqLqFoU+J&*qv?`pv)ZA@JC5eOr|Olz3;JmocQ$Xf&_4R`?q;iklHhU~g2z_ap$b~* z_aflTJ%onibcH^Ug_rjn9uZjXjG}^gQ~{L|u$r)xD##rBLM{Vo5&Tkmg&kT%6@()g zy>wfAa?E6_f@C*lO81Q;lV+(r6L4=XhIvh| zR**%U28l{#9X?zq*Ev?Gv@fl5^4Py5nM(11X%-#em@$ZXEucSNDl2*K&qH&7EYKX_ zCrb+Y(kViI1&OH+NY1Z8(>8E#oza(aY|zd~r2QnW8l?7+Nu~z*F*Z>5(OI%Wd41_D ze=@HxN|j^hz;cy10#?>y8xL z>{8sR!bOQ=KV&Snij)6&0g=r=Ex^B%D1}72XRc1qa`>uw%>G%wfp0R#HBFL}J#*+} zSsI&Og-oFbo<{AYP_7KKhJ?^)mdO8(-2dnNeenVCmr9}~bm7MT%}8_tzVUx^GH+DR z#6z(&=v{P zDpeO+N-J#Hg;v=6Q{d_iN8fr(7Fl!{M}o5`SItp8hb>cEEtySQt)&DwMwzK8vt7!g zeQBAhg}ZpIg*=bO^UNT)kIGES;XKFmqh+evl37&EdCu=gOKH9>vuM7(%;9-ynX?^I zupe!A-qC?~oYRiXpy7cf0j5|ISQn64v@U>e;a2n(6ba4=x_$?9f|rx@;XX)*%Srt3 zQopdiPnNDGtx5^<(LeWo*%mYy-o@D{Tg0j4DYXTClsqs6U7-d2?hj}g)Lm`k0$!)g z1AT*iI?ElGIK3cMq=Sc4C2yGLav{qh~|OfBj8U&;*nP8tP5Gl=%WV2Jir*W^%wNl{ zIz={>1I zqv{f1_{@6f!Roy~vO=@_!M!t^diLRPpTEm&MEx5}vB%3bbLA;yoqFFJ{k}TtEi*Vl zwO|b2K#SE?^e1yTNY9F)8K(IS?sfWx6GvHe~FxaxkTs0kzL%# zY`QxeIc5JcmQzW;=?gvkHTz9ewqyT53^5Ma&a%5p_9ss^hX6U}*|4dguL+Q|;)7FQe@3 za2tOH@QvZ#jlO)H0yG|zmn^6~%MkH$<`@Af(iK`MLzMUs# zQ1Sx4Ij$XzOPP^!ed>73l$5n8=mzcnb=JqW8rw>@2#syErj;+9jZd_uRkT%*C4fH4 z5^Xi9wHKb$dQNMX7A>}^)uh&%+3HsLtGrzPs3CJJMVWO@jE=B18j4R%@nc&-HhGdjIcvri(Svu=}+!X#h)5t zzWBq`Xnx!Ql%rJ`b5{n|pP%Jpw~+Sgz6FeC3H_gm|Ca4+?Vs0iL3> z1D$x$n=VI?_yS4{PyKRbD!*KljEUu{%88x+$gzgF zqm{;6#U}U~4aNd38|B5P)-j5m9DDM>_rOvVJO9?&+`}* zN1z3DpbP!?9tGp<9vqeIB7pwyDbUEK$SMh=XO*l4xKvd^GpkY?c|IB-=vV(OGj!^w zKQS3c3{aC<*bNjUo-{4~yh?AIpp*S|H9zx|uREs$sUtvI%{4HWdZ z{=Bk7=x?qK@o)XvhRAP=4HOiT`BG+5zFdaCw@{8us+DIprN%4t=1Gt01dzz4=?m)u{ydlscaPpI0L+ zFZ~EBWTC_voH}F`THbOLTBQ~^&)`QKsnnXoV3r2wSW!*gTf5(bsX*isuLf zI?62S*imLs$CogV3>I{2N0~_-XYxXGu%O5I`Y@1k8l1|~ujU}MhUd{Cg4*9AGw7DH zQfAN_cvUBZk8M@L{@9HwWjPN!Kl=f)>B7O$s+6Z5 zFss?dA+kSXhD6|uM4^WY>UfqLd#Iq7&#<5wD(E+CTNwb32FTaJ(d!Uy-RTSt5_h8< zs1X@7Lv6)z^sUgYGXxS2kbLjcOt}Gt+5qYd%2BhF%%oYM&Y-Q>$I4{tN@S`NZonII zT^KtH_fu6HC8HZ9)v z4fDhNM#KE&ewj_@{3{&Dz!lE;ApXY(m-Cg@NFG%XY$F7vKP@xp>Ao_9`p(7m*8TWH zPajvQFiB=oX;LH!+jGbrS@fiO>pdHa*9bu$``>WT!AA(1 z8>|SrL0#OD_GsKmG8!kFvZ>mxg?X~pQwLrCQJJUEx}XYm;_^WOhBAzq|1eLo%ld`& z3r=)gjWRb5;08S!WzFZi!dU0Q+0qx$=5AZP7?EBt2i6=C5M{E!@gf9gQ3k0{CNHsG zcu5VgtkBT^MFXrMIxxg4(}6N;g$31dh4lgde_*XAnMLdAT_4cz`lj&S9Jnfjj)bqN zQ2W?Ny1JMz$1vSo%5&c2>h4qN=Icr)(0yg+PVrx|4w$Ja|$KjENF-|2KR#q8Uua58&j;6 zCnXjGCXW^JC}!!Sa-x#mX{CBcVJ8MBdh?)0=gB>|oNkXb505#{^Y075_JQbXm^Z8C z9=@e+k97j}S(F$V$Rb=lF!gJTJ1v( zjutf4e$AG>sLY<{$HHc`pbru3&RoBZZ$87pe^Qqhd?kF$69xMxwf>KzEBzZyM(_FG z^UJREo`0_6mhFuH5=Y{YcEYIpOI&^Y%PTSWlvhTx*3O-fLb8B0whRpx$Vm*k<93p4 zV9<>{CP(sY;>M0t5e2y*)m>WqEiZdCZBi_g(G?*VE*DQ{)OKnfeQhSLf za;3e)8@aIbL1=sj$eQ|zjedT^LiBXlm-tS3R z??31DM?2>q=)~J|pflKswdiPPqT@+8(V6S@!kX)>cVb@@+)DkLjtuJ;rAA7<&P~zmX>>s!E`_mRQ3GJ_j__nd-=Fn(DlTzqg!S zdIxKlvzI5orYQv9Pw?*^15xi7h{{?9-R7*75grom2#Kf_D&EUis9JAit=g(|XXRVL{`h)-pJi@cia{N08Hqb-Yw^G!|PVi41W*PU`XJR z)okkA3%e4%Uc#gg+>d2f`Z4yeZ>Pm_xx|8Exvb`YeAOiVvFt`ao~IPFkg;$|_LSqE z$t;XD1C!N4I3a0Zp<1hA?h41$S!OLm5B9U_f+yJpRmfu5jjXUvF_@)kPgx^eQQ9Ny z&wlrB1`R6Zr=h_ZP%NQ2e95A;z~q7`M$YETmqcyTjPmb;~T8S zC8EarXZqnZ=yEsHzru)1#IEqK^P@pD>+AdrAue6OIp}y29&`>HafyV7o%61^1a#iX z4{{#@FgI8i^dzhcp1?B4{r-vI**N9p;P51Os3GC-q}gU618{ayeNvpa!sPkMZaX4! zesXYq1tztB$4M9)wsP-5JFT0Oa*`Xh>rPO|oah{cg5hZCjyf{ixc07x4S` zIsBco^L>oY_bu~54IC@zU0IG*d^z*jhx7m45H^*J6*N#zU|n^rpiok2lI%*QN%i=v zPby5dLNi=`5=)8uW!SQ!16jfiWST%16UY`4chJDTN@rwE5b_9!WzcL_QV0*DQpi4m zS&U8u&ax922+Coft)!y__46o!pt&Z<)LA}*kK_xQNQJmYqLB0Gq)ECl$r5`ZR)QtY zhYncG7gXXz9G9gT&RhrDYQCV2&QV9E)0=^4K&DewU_1M$5VM0P687nEy_vs_*l`qr`IR=%KxzBN7-s&U=Bam?T+H#>5XT{#2TM7hzravBdW zc{GPFZO5n3%=&V6PUPp=KCC~f@tiu3@-Q2Is_c=aynfI5WX4C^g*J?Q|G4Ms-uJ5C?dty^n@=v`r%T`8U+i~>@JRo1UQb~-#J@e#AL5lJ zx~)qvPLRO$lXOu<0}wJmyv=q%gf_FdL#QV@<2XU%sE#k987F9~y$2Gc*uR=TJ5Er( zy%Uz2V*jgbNEjz*x_>K|e4L>5{-}eM=r}=RVI$8F2wsy73ZrVApv|}lvkPNKT2pxF zj}tV~D&nC(PEfsli5r@OXKf7qae_Yfjped(a1;;yae_uW%UNWB_gE=B-;E

x^dnaoa%}BoQiJh#QAx ze=OB-n&IB$!k-;Z!!eq!PwUC|039*kJq4XJn^SwRAJQrF;Uje1(0T|w!LV z{ipfL4fgs3o;En(KjsGyxJIp`Os9@D61@%JH_(mcH{y7FUu3O{g zMIaTV69lz>+>L7YWf$|+yOH|@LHB$I9czN12Oq|ahfCUc#zo*ZxQ)XScw0xC7rFxI zj*lU;0zqHsphCT=!=L#IV9=X{U+M^Lw&S1qmZ<9xexZXe%$F`xhsR9lu|NCaQq>!~ zI0Yj9k$e9Pjtd0|TuvxB^a$VPHe%Y*V1pUo%~bU+^Cy@EnPm-XgHRPDj8 zO%4r!1#HhuR=bgL(yk=ae?SfeZ!BwmSUMz4(2yW_4!X{3Ccx6<`y%iFRc zA+|xDOEjjRlNS>a7v)OJYh9<6)_SwBLqXPC>*Me906-bD*ig6Ls`XOVS|Rf0B$)La zUZA27T~NYeK{=|7J2r4S7B@DAz02pY91By4ULw<2+_lPXH(`gasZzET>hhLaE3ose z`T58`W5*ZrXY7l(M%fid`V+DXO~Gzz7rt*<_M{v;&qiY)dNA9W5!%F>G(zw4Xr3%+ zid>4NQ4Rbho}nXHz+_Ol8iD=O%hqrVFPy@V&rptikZs441r5PW)?FYN&;6B=JT#Dd z?2Aj~O74ycNH-d{Sei8;8YDS2)&hbfQ)L&rp*>1bqOJcB040LbTFG>};Tf4l&-9kv zsrN7(1{|h_!O%7g?&evXewd2zx}Zc*@BX}NTOue|7E6e<5gXG&`>mPj$F%H5N_rCBF6O; zLCLow66Oma1c{pix)d z(s966w08gb#DFCIn2e-*p4Iq!o&^I6Ii>S~(*y>-8fW0E_xQPQVIETS;GcA|o4<|y+N90Kv zU{67QdE%rT2$$!Kum%UJh3sQw;DxGEI}N$~jY+hU-XeBA(n-MM2y3b(v#8SA$eOw$F@_sW@d3Il?w@15r(?&;Vi`pH<3MQG zq2eZRe$W$dGU&<?cQZo0G3NyrS}8$jcU&5Wp$ z@f5+sd$`{d<&Mx+!cLljw^AJ?bLkAGju!b+7=xj~i5B^``Vxt@`gS%Z+Ubk>6N#e! zjs8YCZS-$%jN0zs*%-Cc|6Zf4-t#v!CTj4XY>YbTKiwF0+CRZb;0hH~Y?tbp9!Fmn z*_&;=C&L=bW_y_rO~s2#S{5r3H+|TlsQ*2GJpMiZ6~9S}e7%D$afsmfY8K?Q_<~1N zexXBrgoBk1jp1G%;$D|!BK2kYu~!B9SPt~4Km*lKk3d1@L)G#`09`<$zYN&I>QlC)%5>V2+K|epiW^ebHp6U9bewkLJx!mCT|MtuD8+aN78Cs{yTL z7F}+AxwVE{=khHsMDNNvBXsLzj?#}KojrN5=Hi^)$&U@e17%tITpAxttGC zisRH&X6ot1YTGoa z-`Y0Ynj*Kg+1&&Q;q;m{-AZOxJ9x#%Gr@JG^g_lj%0 zm`oCqVXQSK+SlSp6Woy&Ls~Yb8`2Ve8mC|5AHbxPzy=C--pLKb=K0*fxPUGg51?^@ zH33}L6L#g&n!vh15(KG1tP7k9CIf+jagtNPNLm8Pyw=NFCm>4OEN+v4z>rMH1Z+V? zNSyyQU+&C*D(C@E1uq4IJT!FlrQndHq)ZQDNYc7w5B<92+GH<%ZE{_50)1WboD>iJ zoRsnuFMWARG$nyPnld`oLq9rod}>gyN15I6sgcyAY!4!mI>$>tCv|NC{o2$WshIq* zV&x2Wq`v2+e=qe+0{xlP3yJw(NX>2LWgxfN$Yu!)jBGYBfnZ{@ONj)Rnw2(B((jRL z7D}5hY2GZ91217*Y_E|^n&+i8LFT1J(h@!vN!!@MQ#%`53~AXU(U6w;t(ze8TVHPN zNeBh02~BRB;Z2dl+vK%LU?Hzfej9IvAOk1Ha} z+4yb)%B1$~Wmjsyjcva+b?OddwoQNfi|j^!S<41_oBpzzy2^=p%89rx3T? z7T*K8?K`o3lLsGxeu4E69(;YIbAUHg80h?z2YBj_4yz@g`fGo$MWVkPjGZQJj;FzL z1S)~09Io>dojp8se$pvIE?CPyxytr4fCu62b+(6Won7ODBEVlnCQmNK@q?xE6v0vE z6rCZNPQ~^rn{QF^)01T^A^jwtgucKZZ}Ndy4061`Q|yYhPEVrx!wwrC{Pg6L?n9kV zj)>i-H$w6YnpiC!v`*oeHiB2^n)}Eia?H_pHu7~(v|JsAl?M7t*rCJf8qCIkpyORr zc@~PNU)j&ICRwf?n9kx;v0!jVZm<~mDMw9LxNS)FX9KdIS=3PpRahruZN&D1qA*I1 z`^3~{ez*~>Nt;pHBGy8=C!Mk9~^TWTel#1o$Od*Vf}L6cs5DFJ+GmF0zT zb)NWrypHMjtE^;i3xVMG)sWuRavkpmuEY7QbjFWkshv#Kaz7}>DBRDMPLmWUnWP%N zoLMwZm9k_j<(MBLakZ?LZW~q0gRw?BC=bQo%cnzfgknD-p0-A)smi_gil*ZB9Bxcx z_K6%`m-7@7Q@s=5R9V@mTUN?7jWBEE2ui3J8bM=tiw1oaJ%0=x#vu%VVTTUW@r2mp zG>NCg_UPCGEUfchbGc5ApcG@|W@|R*A8!~piR{LtR;Wra0rv7!NKEo2Hfjp3lX>hN zl|mcUhnPdAS+n`%{%mVE{*m80iR(0IqXMQY?Y0i_?1Cg4l^zGQQ5{!icpO(JJ*{z4 zO|jx_GsRkL8M?*R5=^l?Mf{&p*Vn6`Pbm8*R7xrdpL-byUg+2NncXXk=-v{(EUp=~ zzf)$@o%gCxFS-{uAX7w^*ecWuQRLfIgGdiU5cp`63`r*(1 zf<)Wc_Y$E2!h3O03D5A5w|w2nefPPy;N16+o17lP6CT(jc=5O9evttJgzRNO_q}Y! z)XV>EM$|w2gy+_xMj!voF#`pO&W6v!RoweLXZ{*!cm1Ng%3D)+(IF94P1{ zf;}0#4%_KnsL(fu-#Q;CsMe~*;j&t5C&?}}+86dE#;>!EuyfEroaR0Tx4vW6WVrQ} zx;GjQ6x8|0y4L8&J)ruqEuMP(EPxv)H1M;l(gR(UgOvu^oHtnIsQ|>62J=+08w;C0 z72~v6Jf~W<&hmiktZB9S01jy+&1P%veS2`S+$Q%DOF<26mU1@DFf&&_nr1~WI15ka^=wvKi1`3+%gm8u- z6etN=q0N1%An8gn0-W6vr!XKhsgNV9`cf%JR_Vw^_*MoT4wMApOcF`DlFa_20|l)K zt_|We3O?K2{cIgR8%>70)j#eNqVp$q7xAh3*#D2cH;=Efy7q_n+Rr*uf)d+bTY5XC z-r8EHI@F4^RctRp9ZyaYdXj*ot+c2eoYATfh7&><4~Ia2OawxhXEi~=h=v&%WD=1E zZ4kr>u!<=9e!goz&pFS@1X%C=z4!gR|D3b;+H0@9pS7p8*Is+=7JclC^0LS2`wRHr z%RU1UhHb%9+Ol!u9r_KqoF%$xenTJ90cZ_6~Q%1F4<*V@pVCiC_HNLl9Q6ajo)4opj470CO zb0>T3ien*_XaUqDm27m}iS?CS-%k=(@~(X8&InAm#c%9k)62y8(8uY0DVzKDqcHa?6XQ`IU(%1l!0FzP^6+om zy(K8di}>?EY##mcHV8cTtM5^eZ_ESh0<3;&{<~I5NdfNKpF;5Xn$3TD82JMHU*dBi zz^~InafuM%LOoVC*@^797H_YKrBo#nDLlti(GeRAxA|4HOoM9yu7as`2EPW`H=F+< zUU`5qUjPU-Ae4)cQ^Q2@N5pA;+i7F<6sa2A)!k{22EMblnC65TR2@Fg)Y&LMSMpN*L0b;1b*$%o1pO6}kA2GIkf%i(OC`Cm{>y z;()}Yhxp2VI@+E4!2>qe%8s@>@1g@}*aP$tA@L)MX#7VsTnGxOev<1?lc7eMEV+8| zF8T=3BUxj!V zCp}97Js*a{GbDs1e*1lt#rGi|6fb4%lvnTW&m$Dx%MbB&^`<`~F6ANK#gMrU<&99> z6Alr7KTt=*Jg^L-t&D&b7OdNUPg#-}XV>B?v7LdkfvZu6BE>)LN?C#xn0Ou z(!=4AeYjO-Awdzmo+VbCfw-DAAm-|3o4F(?ERoD|8Ht5g(&Q z(*__W*B3@APQQV&`G$cQwQmSs(8dc2nR^FPF4s%O?gF@dAceV}c3@iDAsNDw0V8ju z;#yjdhFcGW9LaE+0)96Tc<{=$H||SwFBF;RyYh{VdXIKm_ci^R?H$!PVl&qvk^3sl zD#ePg>ShOS+l$L5d#M=;ux4sBjBV5#;!qV)9#=`q;=xi34D`}zlW?e|Y4jXLg*odc__^&C< zzefB*Cmu5KG$)>I;$5705`O;z@UuWl2pWvjl+b@5h1~U@N((_EsgmwW!7Ivo1X zYwb?W*N!1Os0<2LbiqY~Bk*$y@y~QCC<52rb9lnwQ?XBasqQ<$P;esfGLYx7KD9vF00BzDn!Vh{=Hgbz-I!^I_^`;E&ZDxGgo{fV$ib>L& zCyA%wAg{y29bw}G=NhL5*KGGDY5+es*HDPB$pUw?$}t0#(@D5j=98Y!Jz%84$>wWr zqM)E;b2%**W#3|6%`&D}^HH-NAN3$}zR8?z7fo4GfXSW3<+NG`+iKc`^RBKMFJFB zpW>ywpb{rLmpV;(>E%vK^5y2N(I^_>iRUT`@l`cu)kgek%I2#P?_!8t4OT}L-}nd0 z;y)lEUlOjnk23f^#0QA8leSA+>FUMsuOg+bG;1W{QX1l23=t`9g5n$Rpe(-Q0Su}K z#-s7a6R`3H>$*EALlOt@0~Kh>3P~Jb+@W0NeD!6kNsTT}1M$xk;y*u*k3CACV2b5WM8-%HHycJcnW#AZM#|!S(l+7bHk{iTXA!rS zK_)4qV%c04>zENXVtShipjgV|W^;1%rhW^txA5vvP|D8O1tA4Bm2oNPeI(@ze27%` zi)MDd1fSUbixNrx90gYjt|g#beBS6*9&Z_g)E!Tnn1@K7z%YHHT+5OJ-wfR;o4fxR z;?tk;`fQko(sY^0apM>Z$kPPu0S=`s?v8l66AzpCg(jX@kxo|~5J@wcqzZ_4apGrB z^!Iq=m4`}Q!w#8$zplT3f4&Ouci=Roq=WmFl1C*Jv+zkG;HN(&zsH_t$avMnxR;` zDdQZ0!~q$-JJ|rEgzue`8jr{DC~dKBK|>1r*&QCEmc8Q+Tk(Cz@0{=Z-J{+Np}~(1 zl8dTQDDVc=QX*1I^GWQHBxydauw%VqeqKS(xnj@J2yHNtHbNI`yWrx)+#)r4U=T)k zfwBWb6sr_KhALL62n=)Hzn&~FMj?7DW%8|)wK#?xruh4}Qih2S5M9+_Ixb3fD3z|D zAYTz<_%K2AVanu(=Mf%+oCg^qQyH+ML4J6i>jBhxbX3%_ILbIm#n_u=LkDdLWdT`7 z(|I06WezsrumNAl^JtRn8;2{NWIrG=T=9?KE$!hLV+OO!rfid?3(uos*}n}}ywX}L zC$rE)C7I*>FmWvK!%KZ);e|Q@Pj>w+lXGK4GbocY z%HW_(^dCmd?T=-ve?(;HLdDZ@a$xi$WAp|w^(s_c0N*xwlI!~!lwqjkOZ)>pLF!$o z_%56Z;@;n1?uR>cgzkTu9DnF-)ZqTLgwa!|`2K0wflq_ifLt!8>7wjI!2*$jp3^U& zLEy&j1-(ss`-sCmNm{G7Y3eJ%t=7w8|5d1XtM!pZdHj*}u|@s(W2-=%^cE^^5{Rf_ zR8RCcXmRBECJ0Uzq^p9TK4XRVN!tWLGjJ;f`L6rnw#<+A0*9}V4eYCJ3*+=m0g(x7ec3;We1I}yBMBg-jmr7b#J?Z1#l^mDVy)F{22Tl zr8xb^HpB!*EBmoX6UgN5JussG{3w1O#V*#~M$1YmkAFS*C_1*JrO6ii8=sM3>}bW^ zd!QU_i=Ds^FZLKSz>6=1*)t4nuIS-}?zzXFJMX#AnLF=`$~!G$d*Y^J2#!^p)ep0N zzY($qk3csLn$6_hcHl?7(JJEsNxH+pb%eyxY@F#!{?2phh+= zX$_MZEvopW^_e(li7MW0H92{YSjPp5J>Inx#RZ&_SR{IgAOQGCnnEsKB3+Ab`e zpm@EtS(;;l;#t-r2fD&q?Lb@7de0gqjWj{=P%dN))(MLDTZf#y$E{DKk+2KC0y6*t z#u`1QxLY;Zux@i@NsK8TOHhBwo;86O&-){JY+xm=BP)7h5U-NBm~Et2M0^AIrxfC!0-VP34ogV(x9T>^HrQPZ*lc@md#)pL*s^}Nm8kvQ zOU^aYcU-c*q+7D6ZMJvaAO)2u{%$wa0ki~yE!VX!mqORBvr@1yVws0nCh3#~xE#Wo zc-X|vChOWh7EVX{Y{LA!iPl+&%9iKaJ~(0NV}755-tRflc6R3iy;@f2Ns8|)!YN;o zNidrcx!w=Ic-NvA!L!_TPC(=oI86H`AP98F`T#d)8Gs;=4M>546Qm$tI!9&?M6aYw zzH*M4Jxn~rS6)p)zWRC!@%2adi>fM^08v^&Y63=9{L0o6)^NO`+ytO&scinr+qPO&1^Qxe}22U<^qZ4_S?ZB+{ndg+wCh2gPizEy-7Ie#5X0!h1ws- zi#BM8;sW|qgmly~`AZTwEfU)KmVfD|WNHLas{kx6u$BsIThktGEfhmaq_o4CtUg zffbfbdkNJ;J7_ZI3+SITRCdrP&?))C8_|)6DZcm?yDk|yC@81n!qqLwU(!|$TH^fo z5QdhZHwC%(OR`Bc(M&`|c1HYid>I0Ap7fI0A`Vxa)tj=oH%>*na{)S17VoC#MVb0M zwrp9v9fllPqE~oVmsns-i8ailq3j;6_#}LI=5mR(8*1>~)cE)1UbouGA&flp{eyS%UG;yEJH5^>VSG zdPz=O1SRheSor?X!Iui!Tl|qoS;JMEU#og2^R=xHXo+)%CAZAhGJYmSt;Y*;=0jR$ zZ>#NE;<%c+WzuQ0Ls|32vR zoi7p~L4l0Xk+@?|0dz;2Q3~}GYpWHIU{=t_(4+9jR3s9ND0SB3IluLiVsuSa0Oi@B z0YYv)HOUNEsJQn^F}N&L+%CT|~)sTaZE={4*wiKd(fOSxMDm zVN`AH7byS_L+-caz@tdbm5#@t(^IJ+-u(6{4yz%{U`yV2>jRhgDJUx@H@y;Q_b)H#^U$TKN(l2t8+K5g*} z=2Bq_^2azYFXL0t7zKHzu0v0*gXCEzmQF@>K1O=-7#)QKKS!^Y=xTk!wCkDD`qSgk zHqsmsZbmA;_kPOYF^FfJRav6V|8lBSrsv2)ItPO^#B23-iEal2LQ<)jdJYuMP=T)1 zYn?arf#@|mNWnTIUN%~dmaRf;w6Y2rS0o?P9^`!t1C}P9jDr?!FiTok_TZ*Fk-pA==pk zz%jvLnDMd%`Yl_`8>P7K@1Z&vrTF0|oJu;SefJkO`uFdl5KpDWVqRnl$v35kgxpOi zT|(`CLcEx>!F5%B2rVYcunSN6!gh;vy zKoAVmMmueTLZod*E4yuAUWT@rMoXk^OdXd6>_ z(igT{q$~GnamFajYZy1lZ8KNe2B|IDX0mL=ks#bcphep>OWTZ5+;-cHfhYcEjkX!1 zxDqZGjM?6|nzcMzFvb}-W1O}@Ax>##+>B9X+_Y|+W)UUED2Lz3+ukRbwmD1OH&8@| z*a)`MHXRk|%H3|Y930pW{vPuN0(~(g5cr96Qu~u$=F*H<3H~ZXVgAc{42JdePq`29 zPdbU{NqR;ekshn~#t`N3-(Q4G@uDDw4N}M;xv5N1!&#uFT6|koh zq?0rXmd&HIs3&69WKmd*RW?L$;#H0lh(oH(N|GD%^J3kgy?HSSH|YJ^W8an=t9Th! zqCUyAM(N|ybzpp0OBCcqGd%_4d#i~9Qnp^iWgYVh~8ryF0Vc#Pm_#Od?kv_ z7lK3ZKufMoF)W}4e2abHP1AmQYLqu2JubK-_#E%#6LhhP2v~+ z5+tIE8*nWv#0?OsLy~kFO7Wa6i*S*c3nS@FIb#y1$UL5Q$VLH&RO7K40w7xjK(0W^ z2#m)vXp)T4;BS}14tW!0g5pPaSTcQ2Q2aVg5RVlmZk_ znm5uAyk0%TDzY%X0DlQx^d)+apu2q!Z_U~-1d3HVFklHO$7cv-@h-tl=l5uX$YL?Y zU4QNoFZulQ>#(Hd#Qc2Sb!JK9>jpZYfwl2VpfSaLhRW5~nBv=qnC=$CAYVkVAzeg( znM1pAxMbExDj;S%xe|<5??Tb0#uR`50nEYe)TW(EwEOip-ei{(>VvH|*zi(2j2hZT zo!doDe094hZPJT3Mtik*Uk`Dbv=spyK2F2@I*pn|QELM-1t7!5hJ z4h(r0E!9|c^|Qu0_F0UFTyDlfp3BE|g{W7#!qY6e-HD2aQ?p0ZC=(T*qNSp*M|Nn9 zKe5&@{?~AY(H>7!JQhlb92+IfZ&-&c^t(eAP>jv;SUpuPUrtn9!fWIxWuoFzPlXuJ zgJBMPe$n0L)8)3Q7wXbozATQ@f;%1a1N=^IoWIH~6n9QKbSKD z`|8nLk@@G+7>3$z3`f~UE5V6!7Eh+Rrjh63!~*9g!^|)lCJ+DD4dx}*Q*xA8f;&1O zGe8dhcjGdBmIVJn!*G_192)(-MDf%5McFBqC~nekXm3z_DDWHl4M#uphMpk$9Sq|M z))F`<%79@&3EoN_E7C)W;wpS?h^u&s9B7m%KFA+B!IwQR%20g!PAaeep=4`eUSa#g^(f*3sk@4c5`vZFjg4V63dn3V%UrJ zo}ff=gI?nBKADZ}@~&kOALtV@@sue31n2TOQjvOVr$e`81{bS$@+%Ij_whj|=xTtL zd0j2>k>?YqQHFU(%gyl;qhm};fx03L?;fItkR00^*E6pWA< zg4_`!%Cr;m1(K1AdpI%d+zkEzWBMUdJ_;~V*-?B}1+hGuY(L(WB^iIY&XE{2%l!^UK&MRlHVj7CEd`@n+p5 zeWVojbf+xJ;8WINOg$%gz89CCy&x0j{r-3SSnl5Oua>8ZOBKIOLqyqAs`vvkub!1E z9-@mJ=xew|lr6P;(rUunZcWxZIC}lex6F^lsT9`7$1KX^V}O_sF*uT|NfHymkOU|4 zRM~cy;&JH3c!&3S&x`nb(Q^QQ2R!q=6lPQNUi^mCycfUYKODfuqEzw6z{unI-i=-g z^2osE03^0j#q+)Y^in3D0;(x@E^m}KM@y9{#e9y*DYY?K?BGbBUB~0z554F#ZFG|P zc!xGaGPpQ+0IIOCKwWG*tltq6fKtUVaL{CPwb^t)O`TlOrTmoms4G?O`mf+s4)ksQ zm#h$Ib)Fz=N}QWghbqr*2l^VA)ge2D;U=FTXV|=V_nPreuW102T7Adq^9e?W)fgX$ zcg>L)Zl*@@YpM0OQ*PGL;<&N#JW2py6PH_Dc%# zFC(JJLiAUZ$-jyiLo>vGLm~bR;%N%;%f$LG!d7(AU;*5gM?ua5LQvxOZPpaz%^Hwi z0+~S1;M(sq8o8h-n5uXo;XZkHUP!B;%v+@w$}!_Y$N?eA^%4P;FX5fE6LauRY~V6^ zgI;Kx=}lE!ptsUKY_C0{!D z*q0&5W=mb)r&ndgnWozM-j+1mU`b1qmhsbN!P~PvD9Al#;m~-NUV=tjW|@sM62+Kt z7PO5#OD~f%6oBQ`Pk_^S7ETaDl1a7zWs2{cBGwRPimPG!kszZ`49TcpH#v!;J zoF(TjWr~+r%dpNbvkqG5r3bAB7*;j#21axPJa6XmaXhk|%b)Q)+11Rm_vB@Y%Pj1J z2ME;>JdUZK1jlg$Q$L$bn8$gLF?_nDm}j26MhjNA(*kXS6P#}c!POuM+~){JK~kw@ zXp$`9t=OI=wPwd%rQ<%)Vcu4a-eD_uNGf8D6x+Bm#g*0qC)id`tFzz$rx!PL)Z)UF z4hwWOc87RpUfgzmk0E2C_1hhs z9G;%ih`+{^ohcX=J5!FNV38_UJi$yJOY}zEY37Z3zf8mBiYHmS=c; zdw5U!J?tG6Y`#Gxw3nPn{V5;0!-qZJvv+E7&wzkIIc%I0(yIQVzAwTN`(G%qr$F{odTHYd;eRxa9y~nV) z%~D+*rfr0?Dx(NqjQdG(&wBTI?cf~mvre$>GR_8i0s|qholbZ*gpLM=JCj)ZH1Uo) zG#!s`f$C-p4p)La-`XI335mE^cjrLNl>@gx+rnGuRcsed61<=L&6Dj9P>3HuavE>J z`WUj4(|A5E0fq!?P`L;_6^du!7(GLP3u%jplNE}eM=(>MLv;l52rjEcbde|@5iZh2 z+BPmL(o;mv0eFfvAIe90t)xOhft1P1tcWOaD->r#p|l8bQ{-*AlqIEXu(mp%S%>qI zT#i`tWkIZfnd)Bg6IP-4b$wVviBO?Xx*3&Ad z4VHr2h9QaccKO~evpf8*@p_`DE-MsIhHPve_;_v6p#Y4}^@r>&R8M7L7$ zU}MT$skoMwiM?{A;zeL*NXl4^V3q_6^+@z%7*>wdqop4sJX()-`tfL8F8vtba;qBs z7{NtGpPmVQdZpq}9%XTZRVuo%O2xhND1%oZo+0JjmWTaPrQ+SU zOIIp>1rkReNjwPUQ=SCNaW~gw>6km$^|Zh0-{5e9cO94I;%p)d+;G@6T?QVTZ%?GR z%k48^afcr@QI|?bu2eitKP@L#mCD`FYlPXt&khN>n!uIC)v`{oO4*lsS9qz6S9o`L z@#TPGLcVSV&X;(FcbgaU3&1^aw+i4iUg3RS)b&-0|2zu9>nK7(F9k@QXN89{c!;+g zD&TT&t@wtm^{()OpH+&RaosJ*pAvje4dC%G4+%=vUFbg<65OvpV#?r;xYPq(PpN0V zs1&OdM=?X@aiz7ADUVm;9!o#TGDj~nlI;gjVrTO%YlRobyOKD?Dnr+Ycv)su%7{R? z(yDZ6mrrFfMER^>~+PvA%+TY~Lyy)}E=L3FXMb)Lf-K5C_$*Y(RX#@lSVcA3;J zXK+oHTXmsYYn}x`tO|GZw_0b?K8Gx`VMkAsoA)bPbW0bnT)5*n&iR=*05m;8xS!|Z z{%nuU{kCbJExxNRXGL(jVl{|@JZJ}Gp&gKOf;`K5URHc0V(8szJaOz0S!f5eH<^5r zW*L1SkRGBCKZN8o-r>kXNKWHf)~B+DOvkQrI$=~zS3H-Vl0{^?;-$Fq8&U{1BA6+` zb{A!rFcgy^17Rp;&B90$VQ9K73@t#xhL{LLa}duE;zk&nuK0O)A_M@xw?!V9dYGTKN02t9V9D;o__->q=VfP~z~| z#ZQ5?=967S+m(LKgtZ-hmm~dDC#0X`23{jfmNw{+&?^bnyRx`i)CtZ|th!N3Td_9)vg!BV&kJi%948?yPgPuRek$z^V(?~xv6d%MLl^~y@DDEt9)Rul`sQ3~- zL$xRU%xF*gnW1dyXYt@<=?9vq8Q4{RQR&AivOVc%hKfr+Gn6Bg$$Hva`kCR9erBln zDhl?t&GpvoZ3oeje%fpjNBWt8jkb|~+Qd6c=?B$rvkN)W&y0lhbGr6%B${?*>M0_#vH(DT!CBG~6qv`S_>cz@=S(yD zpd0=`zl_(*UbawTcPY`n`-t7fBx?$m8wAnWyup}+%P=~{8zGljRUQXi<%xJbf+2LI zCb?YJViPh&Oj2hm-eyggO~_1~gh_4pJGF)Q%d^%q=-gY~*W_UY@ z&M0iNk(^ODGcgL=#5)sqwacTn``1h;Ao|MJK4)!~?MTN>)@+S-SlKp37t>t0qdDFJ z(|O?;Q)s&gX}mnC^l1?s+!{PHh(U$GB@oCF_)iQR1Ozfmv9cY+z60s)9XR|9@?NV( zOtq2x1ZDCQ?}+sF4t)q+>?&PjjCPUyC=BegV}5>gxXa<^aC*lTdxr|*?|!b*do6M5 zgsW3hP&}qUa5ygB1|_%%K4mi`_%y1QA?V^odKUa2zJp6Fs49+81Z|Dpq*J0*umguN zxbd`;6yGl64AS0qYp3N-+iBH!TydfI7ksy=Oo5&t=V!AN7en65;k{Or<(MbRlbCXN z1?;23S<>!SIZrTBy{6r!|-=}30U#pyv0dyG| zwegVwkQo`Zis3xm)w_AO-rXX;KRz<{TL+Rx#sO;8Md!yNkNAhIzB-vzc@=%_g2%Cp^&Za?p7&)`;#HK+~c9bWx%T9qOw~B9$3v-)2 zO&&Kcs^E$XJ=6qd(o&IJK@l5=*|^fs1e=B?&up(4FU{ za$k)PrUhK%+hhWpeEWQq$NPNEeoPYF?4Kp3%d-`4WpFeogl2n|n72-rNMW-FbDbYK zV3B~fZo3Q2ZKFZkL47{aFm2`9Z@u9(;dU@ROBi9y3)<;9tsCO(7_Z>OrB!EtidTpY z!ED7l_;n{3mA=$Yk0`)BlfEsRN!Z$U8K+@(2lSSESBXi$Y~}6+JG=)RXw+AO=5Epa z9n|HlGn}UKZGUllrOZ)moNvxmto{Qs5&}QO3^Px`mM*9ya2p_s;rp5IUL^Ow6{|l{ zCjV&>L{>$_Fp9SSGx?XZT;Pxm&bI&Umok3^>O++6HGimLbuR_^v3(Gb_fa`h8JFYK zC#WRxACQUvLFF*BHVK)M@SS|h;K_t*=mWT!@czjFu7Oc>2A49>2MAur)H^J?!^Af0 zHB7O}p&;knLuGu=IFb4Q`=QJA>JPIZAcy4H+N>Ox7go->#~r(81|<+@&}{O_W4bsd z8>Ub~knb5TatcalS?cgMY64gmyr9FWW>${haRAFX_awsi%peB^g_?Kn74qiXlPD6T zS{4bnY(J(T|M(Ir<4cT7Hi0?xejKsl<;Y8lRfL<%66|4LI@&IF=G$=sYZ9uc%B}=g z(fjeby-&yO_a5LA^f-;z=Jf}}#_LLP_Kwf2)C*lH3-yY4$_l-~e#Kw>wyEJ1Ft)VF zHk?LKN?A;*i}(l{nG_#MdnjP1$Nap9_PTTLrBCI3acMCAls>1#0|;DG-tid|5F+H`7p!Dw^jt zhUyVI6@Fo3ezQjd?IZxoh~q2q&h`)m`JoDozgOsO{Jl+6MdpO-wyT}iyZV097x?~1 zJo3)6WWMY%%HYQ;#I-{Oa%b?{^tMEWN`_!PW~?kmD1PiQo62L;;%zyNDx4->L!0rI zB3S+=y=@1DM8~yk_Y>fW4E|7YK_4>vXOq@bt8?mC|vta|Ly>JzWEy@hw=-trulTYn$>B7WQgjQA(| zu`MW8CP!bcXJGW=kA36(FhU*&jJ`s<7UnB`xSl8a@pPWRCIXgg!)gtz0E1`hU~#`$$id4P!BGvleiCwkqI4PK@nBo|s6Q$o1?uD>P)F zV%26>S07-}z`}?zjkikE?a}O!(Jmv|0gvSmJWlunPk|RxjNlh|51nHt$e{Wk>v4Pi zP5wADn*0a-31%Gh|0|L7FaOj)GBes5&u7Vu9VzxV^Ny6JlsGe*QvPo+1D^hNk!x+< zMf<3eBeG(y=6%%M0@6$oPR5DwtDGQWoB*C5$ckaw&x!f@{F~8P!dU6~=4SHAYdRuU zMOgZRq=1T(Bs4})F`T3n!=xgIn+fK1K_0J5;C-n?<5jsJm+MN4a=6mkYUyYeZ?#^P zYrUftU)_uw@u;ni-XheovW`}KcQc%&n1o&?Ay*14MuA~dU|1m4x(3(RYGB6~6o|SR zFaKaYySbS>@+Csbi#{Fm3poQ8^eeBXjP`4C_0<&QtAA;e4&6<;?N_e%-IT+3KZJE_ zwBkN@Q<(3*oBHtG_oJ?g)nhnk!?D0)8!7%c-9{R&)d{|V}r2HDn6=@in0KDK!v~TsBX3>i<_-y zSX6A!;Dy#Kj(E1h5e9Gdz9#mQ{F*o7!%kW82@uP*i9sO*V$C=pZMI(XLJ|<%Jk(_v zj&-v5nD6aWvzSA1Hw!+;45(%>u!?*|B5M@+j`=8;kNLLxv1V`eR|P1Ss{%t(v6K%< z9h(a9*wnXE(fJfl0;wFE6jpL&NaXP`A8>;PS87t=uaFBfinpe`E~-q$Z&^jMiYu=2 z&KJ|y|KToyCWbmf@e=E4oC>3BHCoM<>001T8?Cv@_oC0fQn}rC%$LAz#cg7BvD3pZ zZjASE(R*C%Xk{;MBuuYeuy_$)d=EyJX0DLzbcK@)lMZ`vy{dpmD6suddsZzp!udgcT*Oos64*=K2%b%66sSObLPw))> zgejXpVWbtf(u$CF5ElXuN?MUC?fu7j27F~?@?sD2z5h69*3OnV#k9&LIH@6kuK)3uK385k>B z=&%-V)Gup@1k%@D)_ZhHwBZS<1oR)e$T~;j(Wb}EmaWJdXLU}1qK6)j`FWf*sWott zwYfELv$ee?#qC!8*E%IAnri*aD(BA8Jx|2^(ed~x1sBS>sx`2RXS4>+Xd77P3FO8_ zggQ_C*IE_<#vbH%VYm)i^Ifj<_%mYu=m~sfo#&;_DbaPP4&uPA^VE6l2CVb!_BoTq zZr?tiJ;hA(SNZMW#FQyGzriFmywk`|HuQsYK0e0;L2%qx*8LwV+9W;aY%22qb-I=r&`1exR6aSQRZI2fB!! ziHDz|Msf%=(qVf;q{zdn!FfnqV%724pqlV}Zd%MpO0_iKE2|Ke6JR!AFCRpxks6(u zsFAih)Oagxcfe2Tm6%w>&evn`%>va(yTwx=zN=g}0!ii;55H)=WI@@ICu5FZvZ@(T zBc*dSFTtMBjxFIe*b^G*b`5WKC2i*INHRn|<_Zsp*fc9VYdsM6OyXM4s~)2Sfd9UN<{}G2dLA;)E4&f{s`cEKZyvn-t0dP@aMFaxiGuD0q)U z^_~ap!_@Kk&<9qNJGz=)jCYC`vGT|g0m8vYp!N3hBL&Xq7tjduN7va)*$5g(DH4kw z!X!S9KpCkfUhJ9bai>r9EKQ0p^%SSL(oy75`hd)Xc^NS%AU_~!NfTM(==Ts^qMy>8 zqkGVNCopdp;M1PcJ6Z#G=uaK3CHl^%y1+tvn0|#8lp>H+U^QFVX=aPAo|~;Y|G7}j zM`xp$#VDc9-{3ztis#-Eum*pl4XcXdHTrkBVOafnhkth~*lz#6Rcg$=%<_`7*H8wtwz^HEmm927J4PZ&DN5DPlgjlotIy-b^{G# zU^lj9VA=cVB|uD(At!N=Y=ED4j5hnbTvD=WI$k8{B_yR5o}Uy!JqB z@NV`xLvgcrrwvBc8@#WH;jWL>tq#VmA!pcg=w!eNE8v8{Z0vwTCj+k8-p49LSpdou z;NwsP2Llm08L*;NgOD|XX9$8OG>@=&`FJ%Q7md2DzdufuI?-RaQrBv9FVn$l^&;)4 zQ+ScyE+f&-xLv>Q47$Y_iFIh@*Y%sNfp6-FWslheX2e=x**zPF91E<)_V7e(v9&Dz z_7g9&{^=f`|Fqt>I!6m&+$hpy6Uu$xI@KC@%Bu6X!mRVJ^mi6_9Iosu{i_|INP|Li zwSQX@5K=U6^Y3U4+~IF(4Q%p%-WvG1f2lK`@tsQpCuKYvmZF_@(?P=4$H&|Cn;4{T z>ZJjAYCs}B-DAXz_pKFdCMc}ZD|l%j#Y|1JpTI!;cY9Wir^XS3YdlNEUpB(`dQ#{k)v&$sf&+nP(*GX{#%?73MO| z?jn`dCGLp4qtOfpz6xnSa+E$ly2R{30lnlBn=_Z(U}xnUqV@pe>C|io1$C%g6-_;> zJZDP26RTPAFP=rU@pAval5h^In<&UPjS~~QbJ#ppIL_G8!Bp;63i7QR#fTZvAfDFS zXl{uNQM`tRiWR9mb=)%XwDDxxC-h;QSsk{fvK2ivh^OL$TaHj3V*8qFqXvbZ39@9v znh%C8J!`~CDxx>xedtPj3Rlt!5f+Ck-Uyc;L2jnCvO*12{1&|ox#VR%#j>JL59TRW zja*M|pGG^RTU6jP*W}DaNTo8aNUaqQaxk5{l`{D$>jevLkzRnkY$lIny!Gwp zIlKpUhf4556yi`tDtul`_K*ReY4$V3J8ZpeS<$V7_-$(>OJF4YE@bgcZZz>m-osE@ zpH1D*u<&*`6l(L!tLRCb3^b-xq*~FsLBfpS%GPue!6}K6udYipgv|$i8d*74mj39R=oExrK z{e^1OP$dIhZsZehHz!q~DwsOPhWSSMN zBQd;GMKG`}5>SHyRXDy4Pry3ygq~+v(eZ!VEG>#GTffKwBAGC-O9OecKk zY*X32zPEt$mf&nPu(x~#a+(xT{8DOTr+5i%G4J)xuXm;(zutL78U=Yo8u(ge$h3uC zdv5KycwX(?t@zt|ZcS$^T58bSXzT6zLx+85om%fbB$tKT=|!zOmMcRWTyLv0eX%C3 z=b;{~P!Yv@c`r`Y_VQ$LD;ZI37W2g#w#t9lZ+F$_{m7#T!B%Kz_rL=0@=pwxE&mr-d=(12>cY;5s>UAkZr7D+rcSPXkkZc z8%BlkLuoFgonB{8#yh?H;>x6b-ZyXuT6Ry!e=n?z?PKP9M^a~_2*B*uX_z3UZMbutNs6*g^!SrZA43Dient$`m8k8}CLFj8y!1p|~^|scaA|SicF5 zBk(<7BXB;2`20TN>Uos1U$KR0(rSB*he)XDwrjbN_-u-H>?F7YIyLtS&_jTLcdJ*4<4 ztYblWB}G*dWpbsYypNO@Wic&L{Eb86upMvJ7+;gv!bNmL+@h$#95+eVE>Zk}9xA*l zQ9RTta)S2`l@5UiPF7->TuBRLndAj&i_=gCq`ZhayeKIRNO>|1J!O*O3mVVE9Yf%( zj1Rn(^dhB1>nP@rHc-qj8QpPEb_VI8A&(>$q9;)1H7 z**+uxog!Q{t%J`C^DIsKWwqqf;!e-uxE<$f&vlxT278@+=+Y)B-qh*1og_RtYmT;4 ziOGt;@(pyZQpIWmy4?n9OhHcqpaH$Dff{iMRG#}#jZm>P3M8!^NX#<}mwtJcXN~-? z@oW=+ejwN?`(mn-SNZA)uLOqqJt%R^gB-1q+kmvJ@&um16ygc|4E~! zS`+a8%>?Ud{5@@b22b?nn_8k)1*!sgcPg+Rf9nHaNcXl;OZ+8RoJ;(x@VCkz3Bca2 zZQRMe$vz74WZ$#+d)7D1kDIIV=!d$@rRcfrwuBk(ZQ&FgJ`FHdF5w4L&_fW7`FS{v zf~L`^-FXy^H=4!}y3iEG;kzlwcR#43VSexlOdClsc?LuMfPx&%q%zK|6J@|O#XtTP z1^HLgSOnH-iu=EgZt^;f!e|;KFDvxSry%D8FnbV>;%ST?H4RQJ0mI&Gn&PO&n?8bH zWzLZ?O)j*WE+L&rd|K z62wzRTQMBhnmm=(tawDqnuz^vNP>TVQkI5t#lv+}u4uuVa(`zY?SEHXpt|cL*Qo=L z{+bYc_^&Y5g0jxo8=s(vmhNK?(sDa?QU$fKhd zwi(~%+}ECC9^tG|oU}fc$JfVly-b_gpNDaAybn|;?*CVGRCnO7#@S(o;&pUb^f}4F zI=xABI&i`JXA1J4qvvBfL-an%7iQhokd;{WLBtEDK9leR7 z=UdUbzYFN$*D)i$E}#>S2&j#r*8>L94 z;(~JzcgBFMR9tdy$yabcrc!Z5=jok2G1#Z@^v+w)gHk*%=I5>Fm3+kpN4`4dtC&2Z zrH{n?Jm#wtzY3vPA``z_^HnED%~vB|w{xuj_O5Toadv&XYT57ViKH#qRn8h|7PPi zZRqsxEclKceCd0yrN`;Lmi~6SL+|bM6X^y=sCOl_5lU;E~+Z^yG&{l`E4!$w;C)yUWF;PYPvzFopUC1Phj_Kor` zWV}6(>QdgtZmG!#W=c_Qbh?If-ap4i>^Rlc_KVLg>TH*@?c8nWQXX$Rx1ux5rYjYH zh>p>ZOXREeJi?>C*_>`6(42lE9c~9I6*qJqlV*3r1Dy|aroMcj^RzTvpaOyOMt%h% zJ;qgwarW7HC11gsUa8vb_@shgS=U>xxcC>oq$g$YF5Rqkw3i@=i<&At@4rfnFEV0SS_Jp+;-#`e z=Ibgv9g1z1q)bFGB*9?_8t5Kc1uJm@zfL3N6~ZdT|DuRSGgRUE@Ho^#fMeLC1^W8< z>dn`WN-WQFX-Oion%2f6N=S4=3DXr{KSQ>^(-mhAm)E|hE1p6#s<~ zYi>%2Z8znKT^3Go$I@Jvls1GhmYH}qt(K|>ol3uZn>IAu{o&+(%Bvr$>MUFH< zevfW)A)+1QCBLnYyONIU6Y(S^mCwhAS1Z2eUbI5B;-0r*R8=d!>0Zo5)r#-F7j0Fo zcr2|E?o=x-L(sSoU5Q{ws5Rjk*h~qYLeM~4la51N6yr6C;z?pdx`fKe4!SUR(lG}b z&*Z@11@T;0dz^b-qC1@T6-Np)Zr3hy;azlfoSRCVsU`KPyabWFJK{p<-=?Cej3hUe zs^S;!d6)haTsA2StmSbTj~lGDiO9>=-gra`J-dSfDGx89eCR9Uqyrp{5^_XtF_BlL<9NarX%Kt~|t9ih)iNAndxRWwhA zI4W8Nm7u6?;GyKlu4@1I()hRYrCpsNX8e}?%!T)}UnbZvc(`kH52vO0IvK)><||g; zNn}&BK(V?i0pP28Cg}9MHQw*~_Lm)v>0bRukt`Z9+3iq``#wCBc?k;hX&DMP*JB&ug{ZW_!Bj6}PTp0p7Z3b^Y53i1O5GU+Z> ztbXB?_lq75#U2s4;)P-&G&-&Y98IN;(yY>Dp|n_W4{?TcuZ|Ajdk139U#z(A-FBc= z;u6Iwor0YHH*BbuD8AqVyQ&u?DszhgDWoT3e?1+nTB=xydSIDi^=%Z@L0~y1AK)xk zd`&mX;BEu31T0tl<4Y;T-5$m?xLhhCos2KI)Zxm#!|ZQX^rT|-HBfN}zV;(Po>HuS zn+Rm8mXM&LrSq+>pG}0md?Mi`MqUV8$1*-h>%|D64v)1h(-h=oy2ecB zb&C7nZTQ4@Kj?#~h_-+52|t3^o%4Gd&T8zvI!CPa98Xiof66-L*y^9M#>!(BATgFF z+q-9;%r$WnqB_Mt{|$JBz|ZZHfBs(%um0;dHv7iXM7zszH7$%YununXj)(zga_|Tp zv61))6~wpm1-cNoD^Q`?yxd(2^)pWlV;mgw#QbG3zi`b4f^#+$+%rM>+%Hz?_&1+P zBQ@Y##Ef1_JnK*UcUyD@-cQWn#WZIiT?eCl0MuV~>MWbTUa`8;Y3wU^ z`y6eNLduoh?EcVg9r?wZD%x!w?e^IoC1I3jFt4|7(p-O|H`{nKxG@vE>#ev;kh$CE zgatc)9R=-2aM zZ%a~#y(hgcl#|}EK7YJIlYQmBKxRBz?px?eT!=D|CexZ-BG#{&yCSvnJvV_DZ}lmLZwf(G(5;iabS7#}DQTpyqM2o(}_x!GiS^ z9={6mUNpNV2by#L~e$kL#I&b|M@o)~hzF-_|GXMZJPT zudU>^VC|Q?Lb1BlB}3dA#QY*s6$gKd1z4n^KKHwD?w=)Mg3*G`qQxRn*jn?&V#6pa zFtlN`+nu1-aKI*$*Jv zgEG0tCbJWGRWhxEY6QeJb)#Y>D=-2VW8q!nEX4@q0Rj|f*80&LO3YeFpb%hEjzqIf zvMRpGT);JR5zujj7a`9SJgqQ-;N4kn6 zPQQYJe8ulT^mikLC~K7&Y z?hUuP*vq#j$NDF=aQ{&)dNHb<)Z`shz0D6=MK3^@z-06SZIKONbelMZIYLwXatQB3X_R9Fe(Yf6 z+JK7$aG#^n;`<^LNcfn=ZA46V;3B$MgldyJ)EV|Uhdc_~pf_s^FI6>KpTf%KQ|pu$ zaild`M=hML`FLeZPW=0f8D%wC6m*pluL-&_Wwx%6pH;fua_9u_K7fk*lNML1l0V>u1%2as>8Wf#nEZ3yKOC)RHElY_}^?&VDyB(ZJ8syL8l5 zM?Oj;>^TD;4p&Vs4#o5wSK75k7e?iKm6r@i|nI`|!QeNsLTZsUxY%KTkAGXQnh+ zIWkG%-Y>`@feB>bLSZ`v+~E{(N4$V!N}1)H)TpJ1DF34Jb@plkBEZ&5q$y+ zolmF$8rQe<7|}JS3J!4ZnkvF#D(}>L#Hcitue{c5)cD$8!E23d-&6S@y@OtWe*X@A zBK~ablp)q43q3HE_wcK7M=TYbG=n_-Vi%21tzl4Ng2pf&#jccZ!uSO6B>d0tf_WAX z!NXNqsI369d5AR{lV=Rx<-`0G?udnuYyb$g{S9CYQvY}tW$|6h?Jxi1U6jptJxC!g zplU21)wEceDb)rbOZ%UXry=2AO}{0F@~H-p%_H?hT%fDc4RGt$pf}p=H2~0TpB>|P z0#r>C_$|3vmTCamJb}w$#yOK;U<&gK{F2RX15mhtDeCtTqUGqs>MF|Qt40_lM}gvR z{uqqHg+aNefIzylQBS|h?A?u*esL8z%sEBfqM_3mhEwjzWJL=G^JJQ70yF7d+58Vv zd>M{EGh}w)9z8n2{TA*-0i6v3 z-=<9d_CunR8Ls%MUjmNXGmle{AAeu=hloDvFyzq!m;1j0df$?xD=Z6gC+Z5Q1@T}` zMDct&=2|8s`7cPW8Z6=K`yg7}fa0=--olPFvy@N&Hx2X7{_TCa_x zt<_uOCkxgB+vZ#0M$4t$DahR?nS;4P#ovM@>kkkgAn8B2l!AQeB+HUY7Ao%E-Jblq z|IwLz{x~2dS_%#AY`LbR81J&;?9Dr zX+GKN`tj%-^XbW?_$q2niZ|0??ZTJ)LM3`7c!#rrm3pgq&OmspK5T;pt3~D9QCuXt zfr5NPV;bhCk&3UpkwSc9W11XCk5v4_D=EZRHm2b@2Xo!%_Y~yc17U!~8{t1q)YRNa ztK$80m405Q$d`!|Dt=zi_qgMu(_(4vcr2|nDPEdZ8NWzUnKlciogxB^#M{lA$zz-^ zY^E2rKML0;Q1`s3*XtCCnFFNtx-rcam+CgB43~S-BNaENG^dz8&CMxOQqk41fKEv* zOSK&};AKEAOZ{h3{GX|dIytzDI=$4%kPzZ6dDAl9`0v!bHL*tYEa-CnhZx_o2LIjh zq-#M>2b@Xu>A;Htx4!Yk!2YE8{=msN?#aL@=L*rb&U-qWj@o8hb==W$bM86{@^v4H zV9;?C_v)^vAYUJm2?5a_PLJsk(XLg{B-uxwk_7E;dd#ovBy-+rk}iz-p@5g99@8M3 zPNN9kffh)M65Bxdvg@FFv|IBQrQ?3#XjFJK)yP#K0LGESlW{c3B`8dy5BzZ!@dy5b zfP+^Mhy;vOEbhM5w74E*8r4uj4^kr(Y)A4|4WePVAnv6R z*zu3BitSr8qZNMzu39UCOMj{qgcGK4;N1gfO(N7b)ZUr27iMX(O z0R{Pjby5L|+7(bHmMB*M7vS6hlki19#o4e3Q9r#lvDLj6Mi4OD&c~=8tIje5?!(F@ zUfhSpMHPOA_Gl{OJ$fNrGc2?gqmwS;k7WfPulRZX91mLm!~1cXC8zA;6)&TgWJ5My z@d|#2(Sye;K9mwmr7S+0TGR=Wj<`4J*R+GM zf$>Rd7pShvW7Rdqv(6*qvg#!9(0+?NsI5sIBTWr;}6au5&&-2V4

OaPiwV|Na*DiFzX$q&RXNQ3OBaJk`IA&jEjkizw$MY*@J)W0Vcrrib{$;e9p{(8IR7+1Ql|Nl-M({vJLMSa`8-bzeD6nI>cby-!I55)|1(bss^sukV8guI;g@B*@O`X-)p!_I8)O8OT$s8&xyk4F=lLm{=lK`O6B~>C zs}Wu8uT0U=?p&ENJB6}&cFMDe3R4#OUjoKU{&4}y=5c}ba&4K{2cAuV6%*VFTpQ4Yw?)b;v&%BsO%qH+NZ?hQQnK?!Y>1Qx(o}rJuIMDyt z+bmCzpv)pU>p*Cn+`vKT89Y&Akh>b>T%l4#&p?}LQt|~90VvxB4N$o4p8OdNuFq&7 zI7>);#*0*Mxj&=cT4g0ZW0h5t^svul#cDl1V?EVd_>6k1MwFRIFrR@Cp6xO9SdY&z z$XyL`t|S!EdVGdS$rn%rpllm7z}zMOiK{h!a+SNDR}FT@27l;o3zPRM%Hpd&1hbuZ z*u*b1@zI!PMiVeD7syYpqHMmZJMIH?AB}^m(e%DNEAze{ZBaIlwt$;2xIgQT3+CNN zU;{Bi(8Bz_J_dFCNe#5HpuNY19?W)yo*EB@xyCad)1oB3tKWwTd5SdyH_CX1)gb>3 z)*-wQa>#m_b+i}1%zNa8kSU7Q=j7tX=d{I2nx}b-b=XQEnEUnbi8dUWFT*hs0w?j= zCuxhNqnGm*>mTww_Y}pKU2S9h=5w^n=QIHyGeHBf7jLm%vF!9)mlE~kr9z>*luG^h zuyq7e*b(bp#NM_3#h7TOD9%`c9`+7tbbbQ0;tK^e~(nnd|7*+@dc&^1NS%Xa2CUc=76L!et zpmOM4s1%MTO=WToxT^u@I@oytThRt(;CTk#$7`FP_Q_A|yYrh9dJ4g|kxUl(TwK#^ zK^R{A-(k@h+JX7X-3c&Crz-x4=3}(G+t*G}{m-0H z(-f;7t{&VYlvqhZuj<6Ztw4NL4%QG#N7q512Rh3%1tZk3LLjd%`pGoK-TG1n|MgYj z;55ZE?R!~qTzIs2#8vVmE0ZTjB^VD-7K=B)bQ8ZG#USgwl*9L~#EfVXS|DEk2!%mX z^v`9A^Byx?GbCFRjnS0HWAr+WZd?ucq47^50?v|F#jUbt9F^_2p7L5|zbOdK(-d zZqqX@;LNnswdmRnO~MK4$UTOpC(h_%p=2y$u5yi*vW6E4JyDfS9cQ6Sob zGP%c!_$j4IM~}kcq$~~aIQl&b^7l*zL@&TrXDIGD#SKp`xD5Ne7{n;P>^7HK#%&qK z<}e(Sy%cBkPLB7!J2`%Lf$J!b3uuLytk{P~!xS922IY7Xo?M+kP&_-T$0*2;O@w}9 zqMjz>Vz^>8$knuihEUSvJcLFiweBdIofMxG6J;eZvjleU2r_CoxVy&oE+uBHNTH$| zLHmvE7kUu@`{^Jh`VAllsou73wQ+=MEiE93bqnYK>@W_{c8%zET_C%(Ld8R|Z?&Bd zCfMh;6E0MI(M6QiX01EoVr86NmC5V^yD2kXG7ezxcN(sM3eBZiC>^+vX1HQAs4i~U zQb*0Mlx7;K9m8fGsrSbta?Yu)ur&^R#jkBM=U?9vH*>z_b|>}r`|VT|BwaoV19?-F zZTu_*r_l_#eG5Fw5CoZVM<}kNJ<_9-KB`rX4$%>0JOZBy89Y)R2!-&nU)GHgiVM!{ z!=*M~?&sk=Hu1L4LvgM?v@|iImeTfkL)7Tk;@sxfbdBpa8%W(mA%#Gdca@hyyvo~T z9=2@q*7)qCCht)%7N#P_MO1^ET$8Ob3pcK~%$j0fy-Fk=q^Drm@{|V7V&Ke#HO@qy zhX=LiaUJ|%4dyy-gsn;=kMdx#E>e7uUc)}-HC<+5*Ij0Piv7!{INuLRK0qZ~m>YQ= z+tvH~U~}%pgKK0ej>@^_96iMwfL2`>(Z!q|;a!QC zQ%|!}p`Lzccyl$?#9u+H!NMWxR(_gRqR!aftdv^X(*YkK5Vm7BVaftcC>`+Gl*KFQ zRf)bzyI5`t!Ezvr!W13EAdK{FkJWeBTSc=$12MEi| z0V=>mTA-aB`Ei-mM=BmL*gQcMj`?};U@Rpte?prMt~M))6OZU!Y*rE*A|;H|?@3=C ziL1u{>sv(*oLw^6bvL7Xi%i8g|H(0s=0E)@0sfQAEc>AZ_@PI9V$mM+^Dv5F#kO~U z5gMDYLLN)+Az})6k4E_+GntEzqx@6i&vrX+i95ab17Kpw!5KD>@>lrn6hZvcUn#^< zIKK`_`~Z#e8()USif2N&4-0%K7qflhiQ@?_=Cw)jS9l-JYH<9skGI8NrQ7By_qnre z@iiyKn|&vI-rSf!C+1gFto|S7{sTZ3_)x}#TtV~jU|a95ha%R zlwDnlh=sTs5=(qFHdxA1mbMQ|XOTr&dhfluR4LLC5JXo{6p$t$>i_zjxt}etAj$h) z-~aErV4pMRoH#bN@^(P&RL4>Pvyct+2OhwCU5(2 z=dcs;|1#s|@VQjD+7?Iz^|z$Zwnu~hCLZ+#KY0l#TVHxqNy8{54rzsvDO*y!1RtpGZ16}kJ^dIZ3%So;Xepo|$wPy}&IWtz zF;2n7UN)!LY>;QTFFQ0$wZ)wchJ}vNtKPBDz_6FdZ-s&3srnXlXM^sxSF-aAx6A!Q zPR-kLyOZf^3h6#(4+lBL#1wPZ{G0mzSy=sMDg5TNFS0s93~{y3N-0As2o|OUNy`gs zHIm7`fV=y}7_^-zStAw7tkS?N`M$)S>wEiS=_2VzyDXfHqDfqP zgG6z|pScF=VsOI^62lFRS=KHFx4s~0%JhLOVT&%2epaHG5!kIxT)P-_m06q&lxYc> zB3L5FSc%8%+<-Rb+`xDqyR-{03p1>&8zhIzpB#@oeOh5|U?~;9xysYW@pQ3+lg%`k zR*uer7;?P#ycBk1XJYZ5SLFF5l{`K$H^8x|i^0c%ok{P%2Lelie#C=rxd6=tp6y| zosA@lMqRn3Kv(IR6!7f7*b`{ca6>Zr8Z}oBeiLi|u%z5m(}4%_WZJL^n%@BYMJZu1KbOMdKvYcv#YQc$QlqsgYr>LG2-` z&ZkYpeUh&6pLZulxd#7kD^!;8bi4H1dMf!v;HkoDN!TdUv&n_pv(J~V)1EJ^RuXV* z&vVbt^^THCUJPS0&r3r*|CvzJ`0Qwp7`{hqE~o9IWzF6*s19HqNo9 z{ZwTf-K29dz5Ki}=exlRW6oc3evpG=UKlIR-{Yf=WEmKBBI*ENWv3Ww^J)-7RheQ4 zTv`r8&6v7Gbuzf@p>hD1;d-o3 zAV{g54NP)PVDvs1Z5#D<6atmVLvuB?TObf7hNG$S5KtbDb!z8DpeA`}@bwGkkidn+ zuvc7241r$~!{-hzC5FHa#PCgn%ZMRxBQZUVmRoIA%oW7YOh6lpz_rBi6kIU`6vLzC z+bD;?edHlIwGg8`bcTL0nF%N}0cGxMaB-5y#VWz{GpP3f2l5A+@o%#h zl+e%MrT^ji*Z*|X>4P^OiRYO`Od^OarE+*F9TrCP++rmCH9D|jhR6QllmDuZJ`6Bu zn91@CFz6v8b&Ab5sHQVyOf8D2_Kz|W0quYeaIUk>bDR$x#y>N7j*EqN4X$`tqImc@ z74oh@wTCI>U4!ZmGw!6kKg!&m`|wc2r)y#pYEed=>8r$1rIiOriV^z?-^WHU!ti0gy!`< zEq}xis9v8@-!rILpBbXd%hx4>*LOH=_epIHVh1uW17(NmyN{9(H%f3X=e=)GV<6Xi zjwMsQVm5z+sSGiAxVc2oyqnlWni8&ln3Y;+VDz?;58zjSBtM-`UL+A*v|0~57`&v6 z*8Y;q-Khl!(aYU=MmkNlh8on)kf-p%KjkUp@O`$Y)EQ;%roPbHO_^n%&8TC_S|klK zFg;nio-#q7xtie3Q?KSpF)wh(c^b8%%E;}F5tV}mTg*1!wh=L zyQI9UluYcAUR>7>rKwQ_AKD2XYkQbMdv8Kg))|s;Q8k+`y7Q2!^+i{izhYtNVp2DK zd)Qoi^lBN#1jYpHf*9QvX!l>`nNQXvhhY3OqIDT>|9yPhF>d;SrkeM*QqXkOh`7;+HU@>6`=05W69n{si0JuV&V-s}zt&r#qYbL7 zpU2TUw8f2#F)&w31XtcH`MCKOiQxX`l8@$7bW9mzaBoB+=p@{gJ%?PGA~x}yM!Qlk z`rT|3naCA2Iz=xfXPyiB?1`o|@$=TC8G*6%t0xis?lpd>4C#bTfbJ=8d`&lSV-2qV z9kcVh*L3(ES1uMq*HajQizSAOU952i*OZM#m!JAHQ^&C6qhq+cE@Q?U?6leR1efj6 zxnu)F)c2k} zGT?A=UWvyWOp*3#w@^NXvWa1*su0E-Y{rPd=~+nTWA@4bOGxw zj6&?GqJt^f8c7U|$W|2-z2!XdIf0x2zk-|q*{W)ai|s1T5UXg}8AWmO`NL6x&8jQK z=J1{>PH8&XpkLtK0Ef+Y1G71Ns(^O`>%tPjx-d}<6qQIBp&#*NgQb;vROV8l@~FyQ zVp=ODA4#25h4a{CgLWu@#8H58dX_W})Ah2zWTR?PK5%MTf(Uk^7(9n9))Gck4mGDg z!?LLIkyJmaHI;{^a+GA%oI@=i^Rkjz$wIp%c&>GS4hftKPX%>5Ka{6t(o>S7;*{j5 zSOQEm0F~GD%7w+ign>P^|TBW$cQ9mgp5go6-b=z9n>YtwB#o=E%^yeS1)-Hbu8*!@DZcF z_(}l!39U&U2gKC{p>q^C)4*Ir%q#o0=KkbgD7~# zD_rs|GN`Uk@zF{((=dF+ZzP7_Fx*VTYXTqZUULx-)3bPZN2Owxe1)K|=KBhRsM8>N zP+&+PsR*D?#AjK39~k`dDlWaQS}8hMe_+s0#%Txpz~HKOB27(s=$2cUyR$_sGPtrn zC-gzIPc#fyug^$Dx@X9M5+X|Yjczi?n5p6Vbh;5`I77pa&C_*q5nX+5)166?IgM$| z8Ayu_ei7$ZG5&_yE-W^v`DpWo01IVHHnzXsT@a*3-@Tync#;YOAjm`)|n{K1`(5`2qfW_mZ$jN{H^>VkAwQMCKS{2CA6^rFypdB6p;1C_Fmk_>D0wcO%A6Up zp@gzQ4v4$0rI8IIv!gWXBq7?@P|MRv68>>DL#479nju?C8MnxR(!c>ZtXU-2VL4F( zpI`+fMgJt_3jM#TwB-gyADb@@a>`w9P`|$4H1#8X(;yP@jT|D)scmIZn->Qw={=>y zQoRGV+@N{#1f+RRNh{_^cd4XjeR}N--KA%+Y`AA|dN7&F^x%AI2DL4h8+7LtB|T0> zcUf7|;w$Y2TS+y3dM^$e>|B%$&&BtFq{Qz7Kl>DhgmS`DlVPymiValdz)r^!qVE}$Q|CN8vq=SoS&d7*isQpW9}gP}4BEKd0% zg~2oz@r#u2QqI%U*){AV?C?Yh>?%c7Bn?GX zmRF%FY?VP5+u4&R(b=P@{cmHl_oc^&qE?yzed86EZM<`DtLcHF0L$&ya#3J~23<9v zd`qqi99E*wdpIyL$f!Q=Ik$6G<-E%JN}ew#ukw;|;U$&3raH%pbfeCm+BJ1(YUKny z`xBEF#?aKUr?8Aoo$6!QJs4?f>ZVj@G?T+3TSo@5emX%Qlyb)nUCsYamsfoY}C~TCYqd-qRG`r8|ji<*v=^RXY#ciO=91( zqy5Dbx_SxT`sU0&)|;LL`|?!^=YQt2z&HL>ioU@@f1bvQ;D#i4oG0~;cX()G$bshn z<5`O~k_Z~T=q2)6X;xWf5}_*%>Y5eBN|Fdh+ajylmeo9mJxZ>lLfg9r%Ed~P2&Q|y zW>!~GtPqJHJJdVmbPB5tKI6Tzr?Ah<28~{nZws{%PodbJQ0JS9TZzpGJe7w$U^9vl zPV{V*ho|y@V!B<`5Uneq%>B4Md5TA_7!nv42&>KMQ+Z*G3#<-Q(vZ5iP-bmtx2j5b zy*uQX&BZYrXPX>WHq*W`DsnUiyw0 zS!+;0ForBIUtbJgYtZ~3erEsCOWfL(+3h7WZ6%#2ba25;J3krb>In1g+H&Ew_Mr7$ zHYoj|9T_Ye9vPewEGutDkPCIrLn>eM*1T8JFr$}@k&sgJ!Wg4Q^JL}ecd@j#C8XB& zpmljB$)!og1ZPD}vy{pdlMyw!<@R85*?rJvc_G~iJdwpXH`xCwFwc-khywVJ6C#BDS+Po<(>5g<~|;~tv7i6 z9Uu5hizLuQo;DIJ5`cwKlWWy2ZZzYDVOe?0*Lql0%ZM=b02CLY#GWhn)TLcB(7(G>_9DO3| z{|zuxb%dIoIkGZYlEw02vV4<>b=9EQi1L0&tc#|V=dcxno8)*>?kDs{>4bg7Gh!#< zD>S2YYjGQ)am zGrPrLnS7%k#m7l0w@N;4y`3pIR2+5s@$)wf*V58`Y;e1tGLq21$X2Iw!_9NmU8n}j zXk~BSEUDBhC440=Hp?y_!~G5KGVLn4H<~(l{A;VGOfWF#FD&6tmtQD0_kMfNks1Qofmvy=}d@Ub!T+{8@Z~ zG!4CEELDyeD~I%3*=ArS=|{26AeYw%V}@XsbkbViW)N%0&amCU%;9oxj@_F|eHant zt^&`uoVMNkFyAgJcX@r0-J4oQ^KBTrZ{=Z?`HgNjXcL?k^udDQv|y=HXuCmH%Gwm4 zmYb57!jEgaK|!S*>d=D>UT#3rksDa1hf>P|ZIZI`yc7CWZ8tuMj{_%kf4JS?$Ka2& z?fo(6ANObT$Pn57fh3a%?Fsn_ZzCAjTtC`XJ)4v6USdpVr7LNSbklEtyTJrW=%>Bi zU^vErI}@x1M}zGKLx_0-V~`t=Cp2bp@JNsynx#qUoh;aql%AFRCM$yn~k}{z&uF|fd^TN9R@XOOB!y7a(>vMmeWz((3s!q z4ui*ED8poAr-5lI5i~8*Z->F=G<6+DGY%yWqb*cA4$3h18SXS#Zoko^iVCMRPvVz&_u=c~#Psnh)dd;?(p$HMshuT9#9;VYu1f zS@cg0?rz3XeQNO1OT1b7rjMQ~GdR7@kcB$^d`hFN8S10uQ-l5l(~Rsgp!Y=w)MKR( zQ;#Bc83gN5@-Bn(>-o%=UoPpmydL|^E`w{-AIC0(-_~QFby4F*Jp+liC~3dGE{aC z89+_hT17Qb)Hp7iVi?Eg+4$_6GnCmQU+bs-nZXR&q@*kFbL#4`MBwKJ<^lF12gD75 z-~%kj=LXduU|oD}aP`%ahN~ZtG^OAA089S4!3_^k>gNV2Rei=P7n7&hz^q}$*YI9v zKK9D^kmO^0=wm(3_sMarkx$s$@QI8M(FRQ!;)V=wu3;(HD4~HPq$%ODHC(xoz&)m; z#FX;-8drPcLmuxzs<5b1+SnZTI$e%kZ>0&=+wX&3;#f<3AIuF&6Xb?Qg)}@WG+tE_ z#Rh96NAH>C*yQhe`UqfD?ti`ywhc*R7oo8x(q7ik{ff)ka6e}mN@}@Auh?)JAi0v$ zbMI-H7uHT$stHyps#;=iNZi(DLB7`V}4+BGUDdIcArBN>li$$Lw2z_OS)&y(V6?; znd4-myBZ)A8+^!4=01Qg?IE?tJZnY@X+Glk&n!PLP@vWk zU7z6o#^4@(n|wRRr0w#qju`LS@j6L3631Fuuf{~{=?E(B2!oj4K}x9V2r(r* z^MXY2LQl=aK7;8ppQHGEWppyv@c7(;+i2?Pz*={P)yE-qC3pUr*K4_Wrbg+{f6;@j zWbiLr^clKjaEtc|SGZA)tT|wkVSQAVT8#OUV=2wQii;fE)t$2?5nb(S6_^aK_STmT ztH>FAYp0QdOSnVNK!0zjnpCo~{^L5@U^j7>zmv9s=|=V&+N(qy&`{!N$m{fBp> zAK!1#^eI}JKJ_yHzMRb(&6c6G;J{FsOD)4(+fH4GwWIDVO+~%jos(I2t_UI+N+$|Y z#UGU3x;@=*FxPJ2XurYk;Bo;w>~39D>^G=hr?ffh+{p^$fXbVech=SBNCxW`YHcNh zh2F@r&2hG@Yi6>AhRO=6;e3XIo4IaG=60?wo%b8`rU#oO_UFoQAlZuv@LS{OqrLdB zcU-HLgdyz3LxhB?ju10S*e#Nd-Abt82Hf1!^RPkfo0v#> z^brGRuSDQc3OZtN)o+=`5re-(ec*JS63ib}V}8`YJWugQ4Qjv0SVs+hcOU!kQG+M{ z<^!kmlwe|w$@3i_-=`b`cQZfV8T_s#1%78x|7D-2S<58PY0M><+wS$5OE3?&q`+ea zM(vZ28T^V9T%B8Oq6Kcv6`N>bkWn9XI%Ey2MCU%cm2@ zzxy&lXFeB{sWj)S3tA%;t1 zG<0b<^jW9*tPOqEX=PX&Io3w#;B|(VnA!@RF;VpxS%OBdOVs6|G4i;zjN&lQ{~F_{ zbm3)d%~2FRz1f~L#%z!GR`8kE8PeFviDDvtgznFNM8|+cu{5|Y$U!PuPZ=%)8Jbs~ zDru=QG^={(m?hX4_$nZc@KxYDwad;DOyUkVily?2NE0pi9{E-mD`#mrKeq*#=yG&Q z)>KT#z@%gv`GNNXeojl8l1<~y>=6}E|MI##uJS(gce<^`?_woD8-a;)9cYj1 z_}518t2#U}sq>LLDQP1Zptqz^Ad@&f<$Le*IAN6ck;h)!MjRoIao$utjYwi*m~Z#; z=wQDc<53^L7%@Y7F13VFM~`B!Jx+}dj@!0+$)t^-gV!esUU>}%nKq*Sy5bt0p1T}W zr;Tv%ZzE{Z)MxuxcIbH0MzD}zQzLB!=1=^x2z;wcWkM%aAJJBD(ftxdYiX@okJc=0 zBP|p=!X)Z$8lj`@X!WOu<=U;Spra~HkmarAG010LZ$9we8-w5{q}A0(6W`D7no$PC zNQ{J}V2+t?ZvWu-B z#n0Cw#o#kKib=z18zxTfrdGU7npp?DRh4vAQdsX6YMx zm2kPcNUyxN72Mx|mCrg&R~>4+z09A+X{yc7M+LVH1; zeOJ4Fd%;}$ft3i>a!DOg_QSToV>c-9e$WotUVKyoeBkZUrC)o&XZA4H&5oH5XpyV0 zehuvflf4g;j4lBq9R$t_YXlf3kiG>{(|A*DdSVvG#vzeD$TDX5foKAqK7RV1l=kR zOO+;Ao?4vh(OY@v%yYI48r!L8 zhPTQKYu?sS&lkm7`BB{9D<5&Z{>UBRAqUk>YiaX7&3%b4I?9mhKe`r#S_eB*4c|GK zA5?UH@O{;*bP()Bc0d{;JHQwnT`sZ%i`6>4gP>nvU?32u$`=Czivzs;-q0@}+e|aP zOx*cm2RS9bN-bXmMV(-CxqeVVo3j;t>IdQFVSW%Dq$0+%Q_tMK9R<8ujZ25BcBP}> zx!3r8bQHXnE#;w3;@^6sVje}_VeQt$KFA)+%c5b2jvJyM)Cbjvi%m4baG9oKagM$ycA@zi&uSyUO32+3X1T%Kd=#V1b_IGr2R~RR4z+a9yq;T zW-#rh%H;~B;653u>Yg0I4>DM1s~kbD-D-IVTw(6kA}c^aodu@1j)jD{d^8HV`yic5 z3pR*tgF%6Bbd}PX)jf#SJ;*EKPmwa*uaWP|=4v5ZF%cIfO$p7OmUOh2LE2)S1>@N+ zF2S_~GZ=|es|wBVg*MQ*+u1}-976!KVZpI-zkVw4pDwf%1M~yLr;YF+?z&TY@G^nCdOn!PDg+^NhIa-Slfc zTajFc=$h;hXDUX6bU*)PisJIGi64@&I!<;Kw6P=fW9`b$`@>Nk0 z+Zmf_eqg`0b~l0H1Uf~EIA0dYe(3&__!lLP7a8W;Tmtj5#PBl1RSoICenX;oW4TU} z%e^k(F0Knm&s6$-Z%7*6V7P&X-K1KI7RrWnLRx*m)%l%8|^V23RtpJN_u+aQ#odOUEt^QR8kR1k#aS$%iHU5@a!ho z%WXs)hrJGZ=G9Fq;vbCtD!seF{DZSSfu|^;yWsJL5=GO0@N>%*dby9F`93PP_Hole z=Uj@76U&cwpJeMnnnTCX{7svviZ{FJvMX2cX0H;z*S%z)1ZkbX_2z#~S}FTJq`t%qZ%P@p0qg1a~m=S6n603ZwQCm?{!Mjk?TDFG2d#jM7W6mpj6za7=QoJY|TvWSX`~ zFTr2bQBp6#6NAMkKK;BO@3lU90Mbj4C4IDIdkMM`%up$F_Eqdk8 z0Wp@Jm>5gkM{wD-62-NDQVn4rLA7g{(>{Xg&UKNX=C$PPD=@zIm9aG97|Urlf+5}! z-rzrild6aym#)(bxw9;kv6kDWv33F%69X`a?#wU=c(sr^AtyHjy_JD4)(G;b<4MDO)@K@WEmLlWL*9H)V>w@wvpt31zy1YbnVU z;M}736PPz8f;Y=4vx%+Ch9yv&%|)QCu5}5u*KeFwckQLK1o8+PQm%bbqIhu*KRTxw zk19I$j>Pc}(HWQ{%k`7%CwRs8B1%H0GS<{DfJr1%t*d7a{RBN_tZv3CjCZ=EQ!xF- zA1er4&Y}^xLSne0iRvZ>2#k94$`?3S69iJpIWUPKP=ZNiwY)1lYL6HN{v>hy=`jwH zk2PUD66;C~bsysp`Ph@m2=yc#^&Yc{8hETZ+l_n=NE#m4NH@+Z>*XvhD=ByR;(gR0 zfw^8Hxc(24k3Z;uNYphF$2EUo+J8_VU&NilRv`X6w5@g5%-|Ig#}(8YhK+_VrbiNn zt7`aGJ)&ngQ^W2V+cQVk)BjTPDZx_{D^I@SI#yYM;KrK?3>KJ1EIENEC5|Us@VjfF z8m3(7rNeJ8;XXZ#;q;OaH{?zIHM`tk!3{S{6n}V9q8c+3E!fwTrNvv4ra%dA3Gk;f z{BQY!O4wg~iw*dmsF|)&;8uy_)_Ym&_ePij5^t55;;Q0a^-lku;9foEdQXu0OA2*d zr^PJcy6-V^z0V$-n!MUeizZxDt8$(@?&PeBT7RulLRQ3IAM^S1T==oaDyun9GWb?% zOl<-D@LSn(o*u61yP+x}Tk=oC<;#0gKH_^aK`N^~qAzKJtW*{?JWxR^C1J~DHevH@ zc`13ew_;Q|rIC8uezu(4es%y)bXjO+7+{B#3lFhF?J0FI)Q+&JTI!gexe<1>%SsY4 z+Kw$JWvrc6E^wsR=2kz$ zG1qx+eYmn(kNLreAFZT8M|||j6iRi0CtFmCmWEpVv$FGq;E4ZxtGw8^S~8rLmz3MG zo0Q}4CNmU4f!c;MWQFJ**%HhO*-)NkgKU>n%|e>rhTCO#d6wPMU(fbSg!H$wY%0xQ zOE9zSXXRNwvtL^$wy`hvYx}k98l{NU9y^pPvF4XAzOjh$k|J*Lj(e<2?YOi;JnpT8 z&k}XDv=Zy!vuHW64jYmzegka4X1LGOM{LGcRATP^@K$U`X{#7*)2BIfv2kb6IC6%* zJ$Efud;Rrsydi=Mp7fi)JErIp6GH@@_zZDO1w8$HQb1A?E8oYl+6fj4%n@#`j&K>6 zk3M!Fbvgs>0xr}R*c_^Ma(IIZs!9vW}=bj1$^RXL}hTZA_Dnl8w&{b==P_R=EOBCD9o5_1jGrg}peF3&m z9IBCza@8}6_0~iq{72RLM_siS3YxvnHf2TpC#}+5`s!J3`D)wAJ6bOHW%5;~cpCyc z159qHz`P<6e8X*E6gh0AD7M@0sjX}6bySrOna*RY5*Wo+9VJWX9~w*K2!lr?OItO| zw)WV%t-T(4=12ZX+Nwi&4$ZB+A(+iW+6)EvNLKmgRBV>*s(#0Y3WhOD4YA68Pdh=S zZk0VkT_wezOXmObn4j3+-tvKSiuU_EScTaYL0VbJWMb~R_j)6m>?GOEpTJaf^I%Qv*s?oA^qa(*f_%k|9r&a10luzv7er`Y(yAoU_Dg!UlciU%u3ms7~q#fq9Km3FrcHgy6SNvr$I~ z?#Q6{5rTTE=NKWl|0T*9A$%gGp&`&o-V>keUn4oKuVAC3DXsZP-II+F{G*FjA5%#t zSM@>G!3aV4S1jKMLF)Z}yk93X@T+^ukwyy4Z|RHbLCMF1MS5gG+%0s#{2)im2Zw8B z95MzXtKz}Gv$`BEU2!$=V4SIs6f}8`N%#P=XgUzZ0B@8Y`;HV8N}gp=M+(OAdy5-_ z3nWKBr;&mwvN4$^-3$3ib@m2((g=eoC{3fRl9{Sv94XjH&C_##@y+@0? z1k^N-b6KA4ua!SqP`xSjU|BTrLYB-EiDDkd$~cPUgkn!f2WlNU*g{=mjTY2wDruBt z6E7f-=rlw0t#?a0o_mSujuzCrPtx(~S31~@77UiJICX!eLjQ>qEJlV#d%US1<1@0v zjEqT|yNnUkavMTIddG&q%RW;na5||mSBt{cV&f-tDWdQb|13fO^W{?X%l{5V^TK(O z7skKeB08?{TkYL)l=${CkpUH>IlS&hwimNgl6VrRr(ToC2%h>U8)J;n+i#l2df}fw z;PO6JU~Z5IZkPtz6S!cULA8H$;g}0oHGVkVg==W|6<(l!9N99`+Qj21_NKum9#>LX z$>RjZ*GwnW9M4C@Q6vdk#2UriEiv59a8(z+Owt|Dnj=GNX~*u-jymo%6iHh>+HdP6 z)S_sd;Ii62{{wGJBeW)8BcJa9$Ja>3IXl53PLxhc14oT1wNTaB89pgPaVMp-8k39@ z6xd0$XPaa{wY2c~l-5Tsm-`7eR{opxF=H0;udMKKf-4?mdyNyMvk=NuMrbnXc+rbY zc%YcxHH*Ekb-H)hI39R~W7I3Vx$N653;cE7Dl7Cesxf2AQ&o9lK2KFFAWzKra?-KP zuCi2vtg^)(e~Z1NY7{eG(C`)EDCS!f_q0^|^|TB0%Nx&yU>|-(gLwX$fkEWUz;5Yj zy~OBNjxj^i$&xHuFK3a1M$F_G?{lOp$9$3+YGi5{deVfaVJW4NPsu<}8uBz!%6kMG zE6Dp^r&rUny3W>&_SYF>yp%+mAaE~!F3}YNgBP>rCJ3(7kAN$v48!mZ^#i(LNBt!d z%+p87j7)So;3N>|EwRR27{qbi8aBxQJC#SAQT!H8OF2CEr6<@prh7T?i#Lx7$8;4G&G3OE!7Tb# z$qMxf`5EXG>_Q70P26SaWgcX`I$0HQOzaRp`h0IL>uIU?1%I-U1Bs$HhVkbJzUR-k zfs?v|W}IUjFOJFg?5xA-f*=i3yfsu8ui;M`)-azL=#9aU7`8BK3?~EGdT>2au*M}c zKJZCEqWG4Cs1{|7+Oc7BU=6SJmW}9&x?I}nNHLM;gJ0>~%nY%EXneMa01t_;V1*2^K6X2Y+$cI*M$b@zv+Oz@ z>zIqvQcDu23fw~l1n!hL?(FJu*zD@{^H>Q)|50N2BhgjS)q7WWMpFfM>b;jIXf5;v zi5Z4iy_z0DFFC2>{Yeh;bSx|A@0%%|Sz;eMTu08S965V&Yk#VkY2rJ2J)+a%G{MC! zB!(78+?mES!EaxZC|+W?u3`9&KXADGLk@d*ju78W@ki;IA)+9OapXubH)trfN43_b z31T_?&>g|CzLCRO&|w;A&kH?-Tb-JL&Z4yJX=V_w< z{2H#*l<|t&B#LLB=NX@3GZkC^G0K_YwD!2`+py&0+i;H*ikcy~yS@)}v9vEfL%yY>3K$cZAMj;;6#P8sgNK5-AwLUK>=H}oHN23z z#O8ZJrzFcTchbKML*$`emC$Bh02oW;&IQ172sF z&lFr)myKDLbSBI!@m=!H68t`SQ6v+Q7?YVLxZwAcG+S`HUV)!2Xe)U_;vB(4G3NjY zvB%i0qSSoM5p>l1{6^*qObdzND>=^N_T$o9Hv&ZeQR3Jy$MwL6c-;|@K+EF8N~r1+ zsyaa(B_*Bi5rhYn9p$)CNvk2H7w{N6Rtlymc!uPAQ;QZW8z+aDG!)1tRhG^b{P`8u zN(KB-eu-Ec%XQ&Q)o`tN}b=f(XwsdLXO6IM9`!iE1Q`6*Mb?9}f6Cs|7tae*^R z!NdQSeEd6`OOb5!0y{lP`sn;*?Yfg?y{?`dI!0!zPqhr-!fycfFlb1=`ri_D30~RE?SaG8HNKE}eIPJbCFlREt_$leSB`+!(lR@lD(UCwKU)uHDyP%7qaQzgm;VA;rnAPmWP6|; zrn=b=1g)u3jcaBH+ljiAKNkr<*FL*!o?5GZAg45mrc}O_j1&nBwUEe?E;>6Cku7CB zgk?)xo0{xGT$Q4&-C@fx?6AAk{Z$@kWbCrv+K?Wiay3vSxGkICP`1$cv#ut1Kh=7f zJ}OgDkN%Uk^*jiS;9V(Xr!16>dg*4P-Z4j8ZZ!CYfnXsWHrw4DmkAv@G zDFtrP!@$LYXcLK`$riU1s31Imovo=MDG4qSn05T%*4br2Cb&fKa1SdD(Zena>NS-m zf~PYj9ho0er}&}Gf|uyq3RxHcUb`Jo^5o29N0^K*R6BGDEDMs+H~}7?a?adFu`hK80Ua-n5-1d zL0l8=O1B`56)ccqD^2LA-)+{4u@^jhT_U*pX=$oFB`K+#VwS|oIZNc-l4Zkr;l}z8 zS+>}wJfU#oyfBJw8!y%0UAg^M8}D7Ol;P~D?(qhwKC7Zu8q4$Pbd7&2KYL8n2Fp}T z8RF@!c{tEB$nq{tDjQep9JW-@%pENe%2n0mQo*fh9G{j7>b}7Fcc~zk*GQv=;N{oT z+-x<6%?iV1Scg;99apZCGC;R%OQj-kSxL5p9deoA_wHnEnc!))&h5f^vWu+dsoX z(D+IIeUfo9HBKo*4<1oBRpe)OlCFoA3szaW4QYlQ_A?z!NYXEBIj>iiuyy0=ys42D z$s25sviJ+Kln(`bA`!JBl*!PQ z633Oi>Tfi7Ee93iYsne7R*L`7D}k#dj;ns);?-#QH+%ty;i@iNhmN+=^1}3@%C{}3%l2hR*Qe0c|b)lSTpF1hEVhJaME)oEpD`q9a%% z#q97XmIM4XvPQs%MkDAU!+A6_+#BbyEBN@h;w^0=y~(OLS|h0YkVNs2duDWvpinKX zRaBv!tRLwb!PhpC6!bOktj3LeB>uaG)3ih`7)SkSu2Mb{)PIR-6L^vl)(YJFwgj5` znBV-7JZlAY?qLnC6^!2DVw_;rpZ%wQclFy#_1Y&3ip z@`j|I!U1vI+|y;4;mea>*X380d{MZnr<4Q?*>2WsY!KXhheYt_$2k~0PAQp2Hj00t zbf1o>E*MAMeNNxZ@D0gCZn&vLE^gXqO9CpT?h6vf3p}rEhLK$1#~u0&iQo;QGcl6e zq==DCyk9t;B!+G%y2DHCX{n@@SWDbm9O2Iq zCGB*i$$=SsZG1*x8-KP17;Cd54Gg}=Bc1nn7!yNLkfb$^)IQWXBr$XjjpfhS5J^iN z>6_3&;tqy-g(ZewVUp%M()#cg;+IsF>I!n3J+FMPgW(Qp}&?6vi6wVhyb{ zs*=Pos?sX{tg1xPa7XG|xrci#Zwh~=R3@pwkq%crPTcXz`Kb~^ekw_Q9cg>&F5-5j zX7iQw>?$PXI@01QD~MZBWgma`DXF6)jX7`Pc@o3K^EU8j!+DIA5XQN*93Uy!uMk=kF_`9ikWg=6_M z_Ck`DI?^{69whGIg}r{s_WC7B^BrmZFSii4<(DVsPDzv+7qQ4R@rjHG0&L7<$y0!k;NMNGfoo!!?c*cf3Zwi&&Kxk+k$J zt;0`38(wy20YqQ9;i}_Pro3Z9Q($K3%UCkn2 zy^24pt|n=^BXzx|$2BbSHBQ_YN;H{B6v=qv#F} z&RT-vs{i z>-y{)c*XYyl5!ns+YLL3+j+zLzmXW;|ILg$yhO*hG2@Q8$<+7VaO4I*^^rG@;}fjo zZd}cu)i;tk%gO2d+uYwu47tA@&!6$XCFz*!T3`S6TjIX`ZK4jdUWcRujxMdCSOVfvL)oe~Yh4ymy}``PkQw%kvVs@3=%_nuwR^`wkX)<2b)@f9NHS zy^YCe7f_&GU=TN{?_f}{&;d+a<7^7=bVSZ}g!cD_1#VLBD zbvqpkO=l%cmtye}S?{1&jxjvajuqC_-OMhGbwenBuXw zaWw2os4*9Li`ZZ#O_QZ3l3AgNA-2iHP`fiU(GJZLXNB#8PJvkgX^d|J-|{CfWfUj# zDJe5k*uy>%n0iU=WWAT1k*iVkP6_%J+%!&h&nPOT-d3)7w#rtvS}SY~=7e~p5z0=b z&H>q}T~gU&Kau}{vzYh!BABS2ax|4<>8Yj)pU~+|?*Pp?0(n6%(Xkcsf@|4TM}^0S zH9S5%yOIL4D-~7Z(DPr$neX)uNE%!^xvkJI^i!A`63x$#!PX&3N9#~O{`3nC4SR`W zEtPcEc*6q|)L{M-!5)gp&?x6#hcEG242?65c8^g7OOda4)_vV4g8p2Io=QH*xAS8f zr&r~^l_i3{mA`jx*TsFhF2>>iM^*gaq%)hYA6*&FTGMAGo_mF#JLg#w{1G(l(whHo z3cWM%y;=hNmtFaPnWXFGn)xKSLvYhW(hv`gbUWT1g3BM03>R)@7{2x)Hq#ElZyw_O zwnI?;AxU!_8Om|5Zh0voqT#3LCsv^svh^5lhn&Vk*FotIF<(0H>1N-u%ZjO-HM()cCG$4e`Cti6Ih&FLv$&{Kv`J2FHcn#jaho=L}z zd?qlzB8vk`FmWTF3m$)tq+&tsnB_Aed~3FM9~$y0$yTiONd{3uC=(71}anu$A@+dW6QQ<;y<71gy{l`29l1rV(66wNa*FxcNU> zJ0#@jx3FLEr+fLu>=)dtreOyJ)o+&=Zuhl42Lw(2CK3Ft9Uo{j@@@IT928u98wDH` zRJ)D7P@SRTLBZ9xNdycwGjd2^9%Isn1b?J)c{`!LFB2W9W~X^c@|`bt5vYX!u;9`g zZQ^0vIM1_*hYb-|-6&Dqcq~FPJaZ46wmyfIr;k- zeu-m*-tQvVEnn#&tq9&=h(%XfyI_*3(c_FZb?QercHJf{cWM8 z3cpajFJw4B4pEgcL+0v1>QTDsNR8x)jvJ~sf3<^LnE39kJV_jTCoi1HYMB>KbZnUy zMh97QS%nlsF}d<1SMNW{n#;Td_wPpq@A1)(2)=f>mdf`v9iT*zZOO-l*-^o$!1MrL zZwz$3%+n42QNi@UJoUk+;7Xlij|z$cKP0jFDa9#)Xddze#VH+9Ly66AYoJ4F|J1Ms zVtIo8se3OiA?>~N9f!LB902iUp(*PfHU@)cX9S5G`UI) ze`Okq)PH)LVU={O%DD3+4dc$6bP;zDitAE!OI3+rOV!V-N;>9WaP$I+;OGT~ z)x1QFQxmjYWZWF{_L`%5LP{pI#w@yH6?o_*iOEfkE3Sms37a& z?2CPgo!JGNYH`lm1ZO37#Sr*HmIpTk{p#5e+@A#7U6{B~;z(#!Pyu*UFgd(S_lZXZ zQ^Tv&I_jukefaYvc=8ts)|ZRav6berOr$cL`@=apgJ?}2{DogbWw0m1U34pcRB$Bq zWU54wRb@~Wet$;=CsVWdLUdM@eso7uRAoaIu6d3Mrkz)Gp2Sh4J;~4YIN~Bc&d<~= zZnN8ygLfuo-x{*g8uA{{1EF+GKji!v~u?qFj0NQyWRD(N?mFn?!} z_H-Lvuzb%eeIF&kvj{BUc~Da$KM2ed62TMm)JWh5!R5_)_}_e9(9#^^2i`eaOS6Hs zc4dGj%PV;+p`pgyXeW3Q!31w*z)K8orMMw{7b1$`-UKei9BGgvb;npLYsP}?v=aD1 zFbI>lR-2@_@s97b9E_AzTBILXx~aOf{XwvwC%LW&CwSQ+s_FN%1$yQ22dOZ76=k`% zH&}b+8M2cfn5%p29|VPgrMedTQE<85_syZ|%P?I17DVI39@Uawq;cbtGyv`;*{}9?F?zaaDbZpuXSLT3cLo z7nP-Ypqh!%lIsrbTU*2%`H~tnEs@mPB8yL?M2xht{_|&TEPnGOKesj(cRtCAY-6!T zzTjr%3&~?I#8>L@Is?b;xPab!Z(}h^#%s48FAMdzt?f#S6F%gp+o(1c6KKSprfE%~ z`h|Xyt^evlM_NvHM0YSVZ7q)4pY&+Ht;J&B*04UOao+`aNuia@wXQVWLxy(BOx&i~!tE{01>Hna7n*At-(TBN9QZcSTgJc+OFo*G{ zA%@8~z2ns0;yr@tMmkvETRefg_^6We&Ga-Inm9d=CU7A|cC`L!_oI@JNA-$2QR)Ke zQJVN%K{HICv%SVeMNMno;M$J zY%evrBmNtHi(Tz{xP7)r8Wze|{OMtrTQ4!am9i2rWO?9G ziDIFA&gu4h8Lam!2ixVe{#tHFdmPf7e(?Sn)1aT^B3Ek5$*j z%J5^=)mRG|f!=*BCdq7(#u|rv510F9$~A}6P((rIpe#tw$`)rX_()1^gnX?NW`#MX zi)D*+k>af$n6cN8+<)bUy3FacM^5Mmk$(8tI^T5_JKa zva?0yyO=;{iwiFEG50+{po{e_9|+vTSPqEco=HOM@JZtIOGMXTjdZbS#b=ETp%PSo znk2=HbhR)#f)dax2wg4CtH#8;T0Gs7b9Grv38{qnR(+T8EYZ6qdoh6>?1^8>A(~g< zkZ>OwHcH84cDh+yb_EmfX7OsV4x?pJCA1QtB-+z2offTBz<&sJw`k92S~Ji|#_Jf- z-Qwl(I!t%BNXv9XEl1wWOg`?!2_iEujLh+tE_?{{zajUv4cL*pTlApggocWv4o?~> zSO!}L97~`5jf~`4)N|U$T#Lr9a{|n@=tQHWxKgkD4cj=^^0k&U#Y7(WftLBY-OaUS zpdwzqj2KB+)ZpRb`gpgV0ER$$zv^jm9ba|PaE4*{*L-zG!wocC|8>c5;rbdbNAG2QC!+*@&ukL7 zlTAP%jeU&3FWLCLEPnZ@57bU$mG-i@Q`@VT#qS@HI37vkF^MK(pK`JGtx60Em1ehQ*<$Mjh z3qYe=%D!Wt-U_?$HE7`6$6|<`PXlKfZh48JtuP~S zQ~`~5&`zNd*c9(w=+)GBF#_yVeJrv(9-EJEg)H7ek5$OCmB~glS<8;p$5w;3OvMaM90V6;+-MmCJ$X%bj3` zVs3w&8S7`!rP8oUR66ql+ptPGl|yRnO?_KGiywmnLP_F)P*ymkx9fc3w_X>$ddHYu za1x?FwaueR=0vx^v|_nbJjHfaz!PK8*{SY5~sLG-oC5 ztCUljLi$@&R|Q{xi)t6M90RO>QZc~#Cl&eD_mDl1`_+N?P*+`!Vq{gXEZ634>867^fSB#>8`yT823qbjpi3oLp|Zw}bK{nzUYEC$LF zUTtwABG{SoC5?peWeVd)kXLz-K1N@_BJrM}A(#~;HB;e{;aRHJB}X_n#ZTxPf{yuU zxSKxeUtsZ3rG1q+AQf1wAm|t>ELG&xV*YOtW%9Ww{Ee>a3hWv3*)1hEndR1%rt9Rm96_sKQKgTP#rm1D47M;YN(3*?(mgSQYDztepP$k2ixMMQJv$G! zxba2FKo2|D+QdVcYbSU%@sKj!MSs=3mGGcXcu)y1z8Xl=+5goZ5~A{mHz|9_P|=kD z@3>*8bakr)4gKKFLJ3Vp47GDr{W#cSCoSqDitQ?6g-tftVm@ExaM(TG52|+@Y_XnT zOnKLMpL-ne2U~0=wvmzdEYAOx#BkTM5 zq^OeQqo~q{+5|p1j&-tGw{M%Js1o~m5t|`y$Z-8Skr>t~fj(_5hR8Y{791{9xt7sG zOhe2McT3T=O}CVyN(7WxcO6v_>*O2e!3&@u*>g}w_(8pf;m;jMh})G)tq@fzHasztL10xKz?L6eX-y;@>twsCH@9o0G}AJ6 zOLR0JVpxl#3}prS z1=!s0Tdbmvp%IR80*GJ)HRBOXr;E}E=3^NnEyG$yT1%%xF&DRy=4TL?Nq`G_qENIsSXR_TeRBgIiaIc~1gGtVIwx7U{#>JMUP z8YJBVZ2Rtk0Ray70|F!UcVu9RD%OWs`e2DVA(@8Z&*^q34Si|;8Nq71i=+20yO1td zv5@b=M6km9hzsBK-j}TGgI-Vd3o^u_gYC;r!Z_6}VK<)=iXhMHMYfsVLjElDRxs`g zPOuTI_x3TQBGNVeY_F5YuXKoYU|g|I%~xS9Oyhb!?dQ1K*$$Q|6k3=O{5nR+0o{!g zF{sp>FvpNdI}sZoMS^D(s?=H~_f?l#H5ZS^IJ=wlK^<7XuU z&rYI#Z<0Q?kcqMOfKI}N7R{cePn}6z(>N*}$yzjhRvK!ghCaHPrk+KuR3prkBAQO1 zNPgn4l6J~Zy5lV5zW#`+;1xWfN}{0_W;&~6x*XRLo`_kjl38-xjq$|XCNbQ`a8;w> zB7Xiw%2A^PljdV;Ddx7i5=Gr~iQ;9|`3<$|Wly3wBw3bAt}I&!%RT&1i!8gIeeDO^ z&10YK<{i`DV;qXRU0cEJ=7}9)( zT8?3kx|F4?5-7n@Dyrnce8MwB!I=abDfsirmdG*<)x#%OEe#v<;86YFpz%LS(EsQm zrT88)M^d7B;l_?_j_grl<2?HO+#^SL2&Dnd#}!xm+5Gto{ai);p&nUBm~n3hQcpqAO;P=20XEj3DcMq+p-JFIJ9<&<fFZsZ!9H-^ow3Ijtqxxuy zY$*|jIYx}MF#U82C#24yM_P2@2`POSTXdyPEoz9(=Ya086A7j(wu0zoP$jZ&))A+? z>{4o(1YdbIL@P#qTiMb@N&;kY-y~H*-6g-2lrM!!O4nG0GM-lo7foVf~bprVPClSqjaR1<5!Sa&D91y174>`aQ~*3SF%y zqm8n-`zhi^S=7^$^ci&VVHl=6VQ9FShO_xNSKJ5R)g{De3-eb_1O(zF63F29GseQG zqw_HqsptEc>UCLvV=QXc^)U}W>I0Ack56j!Kg5i+ppST?fZ7alPK)48!@6N1T|5 zA>+F;L01#wELQnm&c<03%TC?SGC#?T-SkJ6yDX-J^dF=)SdX^GStM+K?KA&LW(&O8 zULcQO4Q6}uJ!c-Q#Te#|b`F^>Mthr+;9jpaeE!zRhSPb4k&TW%TH`MBw(E_$aTZ6s zj_QwSy!G#W7jZjX#JBV58|t85Q6Fz{Lw(l8c#HZowC=}ST&wpJ$6G{O_(`^SDVf3X z78y^l>Bn0z+())D zdt3P;Xv8SKxx~>`dgv~{hiv7q5?*bq-~WFT^-O8C7W%ux9@emAPKXlxax1E6U25 zXiI@JF;B8^w>}88*9s%lSsP%IMXl@E>XR&LU&8`Tvbg3(A9&^&T1UU&(@P`Q)n=b$ z@xq&=P4;b|?ogYNncAI*yG7!-IdtDs7o*7B|y^MS2<@`zLp(BG)aG}Gb%?UMxbplznbr4O*CW^x1` zZv)QsY`mRp^=Kfh@q2M>jw;xnc0vvu<1I>#zKgsiUUIxz;uZU7jnGY(hYC*fmU-+S zv#h>>X%zUBd;2UqnjbMn+ikiJ+eR1Nab>t_0Q*O_{mOcY@h$O{-A3JBOKb~fhgiH> z7InJn*h1)THufxw{kDUac$P(XWT}p7mc^_8W~I%t=;|+EW>KyAh0sgXEQ`$qqnc_v zo*GAx2rdb_h3+hiVg5n1g0pp>sNj6v8I~>7x#T&S(^8D}?hM8#Fj5BqqIAJRU^+Lr)9oS44elXYP^2sGJ^B{W zY>P*R>o_~xqQz)6f0@nMOW)aa(VXmY{PyFRL`odfE!}(374#wXJ2RVxR+EI=3IC$l zY>SQ3j)y7j>~wwAc(%n>#%`?XcObTrf;>Y~;H-K2&3!C6i`0M(KieW#cz4~%oMaUc zs87vhHWyTmpcj)!xJS})4+%At@W*@DJLXv2^N0^T(wF(~D}0Ku0fx&A9o6Po%;HAtLVybWEN?5vrLEqM0E0UMV}rabhq1wYy)}pY z5OYx1$!g9Dnrrcok+cvTDc_0O`FtlsX$vvbo}@-aMK;D(Z-LXJFTe`W`U5Ml+X1_= zBftun%T>lu+DZ(yI|4lK*JS$H!Im$f&$SqAhgzO-lCIjLxfY|SPmW=!$0+nsH`n4* zy@y}W3QJj@n3l)+-I;5#)#GI|KluYKUGfo4N^_E-;9weyH&$?RU`IfnRIpocY*3;Y zt5@8PwNzYDuvpbnbFF(+A?{;$>Hx!b@jV`%r7_!T8MS^zIAx3O{NSzLIhPpZd5k%3&gr>m43|IMP#v$!pTtn<0SE}*Kg zfOlS_SR>gfULyAeLsEB=(i|zxClxqS50c`J6!%FT9jO;d>5i1{llnSRUy?E$DZ?ja zInqvkSrJY4OK+ckQS&V#1>z+(Kd< z=S{EWj^qSPATH+P3Z6Hzz`{LVN?P^vUJi|VDU^5$BiO6?CjYN^B#6Y z<32Zm)7>o9n>Rp_OrS;@^Qd=;VHvUms-RwAu}!w|cx@X8%rvyKgPfu7UN6gi9a)&5 zfJ$912gQG+Fs7DHI4DPj7LICNPP?b0(y9EDYZzp=or2kBKexY7yBB8!R?sR>%_H%- z{jy@hmv*gJQ4G!11ii$8E`imo@zsGnI#lcl9ML#2XLN-1wiYux@AdncQvkzd)b7U>4+tPQeFj-FC=tf{h9r>U?$ z{T#JJdo>L?tJpJkjWgHAK-N>5k%boK&ny9f-|zz_@J}v=2$YbX_esA=0;Qx9W(5{m zn4?q=9JRxPoF<4EsFO6I_jO-RDBby14`=YY_yo&-;{p@xQ5#Cnqs<%)S+CwB^0Y!4 z9q-$tmX`wU@St|!MHaEog>Q>5vY25vsCHqI#XN73w&o&^uALxHp%Xr4w{WtK>ap1( zTai2xBV~(_l=Xpyd0ZlRe40LQ@qxu<*U(t@nrWUI%YMLf1RhA{mq=ZCH+{&_@bAc?yNzTweoRWU-Pr zm!H8}dEc@{i!8p8kF#Y2+xWu1})xUm8sm=!{fk zF(f!V$SD`YgV|vM$qbe)&u{Ab<=jr=vxt$!7AE2Y&-K!4V~Z_#4O(KDZojuS@vL%< z;tO*TjN*j}7ca-=uqktFPc6e@8eUG9lkSYq)Z)v7L~GT>Uik(s8^>O3fq8(C`or(YI(>=`Z?#~q8AgCseIKmJ={ z_&1Rmikv~!7d^yMHOS`~GI3mbGiOR}ZF6lfs+XFOYx|e6l<9AKd*MX0Jhhuq-U1rP zM@m6@khQq~lmw4UYi)t0))|Al2>(es{|WEa_xp9TpRVwm8d+vx)H^AG8zqh#-((BD zIY>Y4Wfs4>Rie1n*;xJ~Sv-JAB3sYMnsQnK6`bvx1sxVt=ai2a|y2|OO41w?;nD)oAwL?qgC+;?@HG}!T;p?I zbg2)#UP3$J+j)FsQL9$K4F)JGPNyuftUS~Szs6$eBNf!eiQ z1k`>YDdU0C_i{sgyMWg`o6Qtmk}_aqorS4H0qZPk)M6IbS=^q%L{7)7PhM|YZ*j$S zWL|G^r*8F6$81P46KEuHG+HS-nQpMS;y#HXy%G19ip?~{-t;g#($A1LS`=|MjhGTJ zj@9xV4bK#H%Iiv*Tyy=mgodn#jn;n%X`@B*g{Dmw#yyTo$gN)p@s(#o=yom3CW}AE z`3Y>YSSlwi*DISWa=AE(ZvNs$u>tq~VR|>} z6Z7-JN_9vhTde<3&g=Y`KTd|atN!(4i~3QfSORQKe)~mgRpf$Cp>{)#Uk#sTTRq*4 zS0Cs<*QtWGT0Hlr#PBBZ8HQmVrAWkGE{~wVe!x3I_`vSe$!V*_92%oNt-Kq(wz>`2 zYB5n33f*%G`5P#8Cu@f;7cIuhN2*TSYTcFpxRGti;?!f|wkOrl{dJPwPW|OHjiR8t z#{7wesVNcEbT#maMFYJsM4%z>Ll98Rj-(Y$LPsGNjN|46Rj|en$8htXIg0<8*s4iv zy5p*$;buKG4?8THP1bpEr^OXKMX2MP{p_@;R)=NWX;Hlni?!3DW*s)mPK(Q~=bZ3q zvRPJY(OfW&+AH1q!-ZomT-7jq$o9}3!Y&JwCK049R?QZJ`WY^EdM$?e8Q#ZmRioiM zBpr7!TtmZmG?H{QS{!l;-dz?A8cEC{Xac&6>$x%97R|FO)IMy5{n+hZlr)74{SRzU zPjyf|y^sB?NV_b)=58kqN0mRKiM6H?XdFY3<*v=|ve<+}+CeIgkk*J*x676S6Zq5t zos0c^$xp3`p9`m*wIUaLA115340yKa;|;;A&OC?XqRT!@(0tY!dv;!i=>N!D72cSKLG#(`^7D zlFWYreeUcF@Jcp~YqJA6T3%vb;^#x)X^G+K>9k2RrQxUfr9Rz)e_Oo5q3o4xYBf~? zkvW0V7%#mdalFz=Xa7#LM~`EykUgRTf22OifkW*|-IjlD@wvX`jpO!59t{+D1*+pM z@RsnB_!93s4Sq*|Yw0RwF&U%it+!P&e2xr!=Y0qElg}->;yXQA|J-5)wn5UcmzXq- zK1mkq(DJ#(NlHpXH%+pEOES$D*g%$_H7%Vp|H_sjn{=TRi)QAFl*>=`AvU;r3w0 z2jWQ}mITrjsC5Tx=L?Ig)ZWL%a?B31+l>oGfyYSNZBePC?xS~G+|pB(C%Y}`#;C8| zZE=508Y=rEG0NU;6+p9MRg3Mms8$mDqHlH0S58hguU0ov0VN_!60S(dw{j>crPv=JFy-L@<^&o0v?$)4mTlDXW|%$0rG z+lbYVV=h;64jng&ewB@}$KrO~4D7KO$@874kuNRGn-amB(|N2t-5$_XiG4@ncxO7N zRELf`=Kqlx{)gzQ4jpsoY}zkp3kfwGAzcZ3sXK5y)qn3Nc&{3poH>o(-{muYER%Fd z`qGw_li>0!a;o$)2@U7qnr`GP3-c#(eq~Yl4vFE8KT+^k7QazLy1iCU?1Tc??bLMLv&0{H;Jz6(CJ3LwJ>!gf;t~-WEYGxs9O*hj=6AEWv^XFqNwwj zMDSQXH;DPVLCnNb+RR3=LJIZ6_|_tyN8=HVWa^X=a?lyW;P$>EarBje+>&6REYRNt zv}=eMpDT{rxem4guv_XI2L$7J zpdY|*?NJ+0Pzl%E$Ub-2;+5A}2p1<_o^=&ij=u~zkeABSlwqE1)LJ|4Txb{q z)$@ePrsEcQJc5iXGRr1(3OH_2uK}At$)l5zOK^|AM9C*CxQK`tg?t6g)XTUhoqE~Y z%P8}N#jgiyLMJTh4dll=P^MnyCHl5>JW-7tA1IQBfwJs!PhTK8VR6Ft_oNZ}d*nX& zjp(UKl%MmxT22 zFE5N;vf3sCDkN7^;lAmF#k2h66}{Qpri-%^7GHav^zi!xFEo~5i+S4T%0E4jAEYOr z;Lf0znBNlLUs`w>0TnbqFh9VXhGcK(Fqa;^)UTi)0)6yk^@K&=@W!xutUF;bOW_RV z9&phBzPdMn&K>Cl^7zGGVtPv)zxc;X{N%If3zB{xN$N;ayGz)BCoFcftf zta<$6ke+-}aeKm|d!?Ryo@RKBJ$%MwPmSD*XsD!#E=t{|E_6>=^gDmU`F=wAznK3E zADnT{^?UA|@A128s_C!eDU)l6GxwZ|y2+Wj%QPrKy-~v6F#rQmV#_`b3rhnFu^lvO zZKT%g+tD)+%JT!$1BV02NSfi#y*(Z+G|t-92V)$#>^xyHnxOjt%7Dz6U%_R-GneVi zl#!vyAwQ|Ep`{_e=Zy``3;k@ho>}Og(AWQ)=*M}&^>d9nKD;sPGnD~94u6uwj!c=J z;xkO*GZzg}oYJ|Hmndk7&Xsyr@=H29r6|QO|C!4(uF|AR9vy5?s`OI#iyOIPK!&7yIMZ8A|iL#pT!0sW*LIMhwH%FP8`|XE?*i$y4Yj zZF%|+7S(hg^H1tX{@IFk_oG{I;qsYk`S7E~VVN1!8RSQcZk8}Td0LFN(=3mlF^yJ5 zF%;WecP^b9EDZXhJ|-#ZlXy@4M~nBp@t(vm-Xr^%XxzXWmbI^2*zQGi|e z^c*eWB0Z)Njh440ucrhz%MM*do-U$252>AqB>0nsc|am~V2MaRmT<=r!AcpW`f*2$ zlgP!0QsYY19mY>IU|eG9N!+eh9r$WH3YLxXlf^gwHebP$!iA2LcjmHSvlZ!00n1xFxOI6mWOM(4Kxb53p!aIexIvbYjPE_c2)k7^lg#BCx zkqA1F7)4j<$93>~T%AT8Yt%?vk7uV5-2H^)I&BGBWpVJ=DHi zqIlp5i8|J(V`YaSYXisXa$mr%)X*0aG1AV1(N}Cg)}x_z9`9|$aLb(%#hv#{49(R| zG&Q2l&`CP8#EGQmSC55x(z9-gI5Z; zs}vnPJetOQb@cGty1WI^oR4tp#tEbCX!Q;}n(FWv*4S-&V6x4Aspv0l7xmcC#Y=D~ zEac^^h@qs>yx<(cCS|CLE?#$CxpnkTjjP;DSAjKly=68#d8no@B0Qi*yg8n}f@?~F z&PhxO(8WVdJ(Vf}x_U5|NCZ4_&o>NS5|;?#Z*!J-d!TOJx_bECldP|99$L_kU5kG+ z{qCMW1kcvK)!oDUbR!xulI!8p`ZU^km-}E1-*OL)%8aWf&&_2W%%#)l2tKfrb((g>IEkE|lp4neyqod_ zmfIzs#IeL%?L6VFMzOw;($m8u&q>rp;-SRkpn9A9F`E@qk`ri&CxFfEVfvM7|^ zHb_T5d115-^av!Yq(@*+z@L~j&OkeYH*;foWE^3q*px2NkYXc0E1R zdyX^FSqgtFFgfV6oT1d3owLz)^16FdWh;~G{k(zHM6o}jtuAhQdgzA1dhFTLJ8Na0 zt)f2+>{0*gy*wCwPgsG{IR#fQ^k~`aT4JHs8qYg|@33tzI4`1-}d?`_-4heZds=x5OSkU9vA&94ZZJUbf4zWJV{-eBmQG zI3|TWMk`eJlDxjq%R^h6qlZ4dJoL0fZ8$I7ME_x^oncd+r135>n88QwpH#SsK5Ad+ z{8?$&r9_>%8Pep(%6zG;^LbV)BGJ=MC?k9Vg{PMno?b@yZd)$$Zd-_Q2qst-p=oBZ zmYXQe(|06#d6?`C;4*rE7WtEw%D32CN3GX7vNuvpZxrhH-^)WG7A3)r_*BQ4ULJm@ z2Wr{~lk}ulIhSfLElaNZEO$!E_n$P@f7Z0~L&YI}O1(W8)nO8NmJ_c7Vn+ISxbl99 z;Qn+@CFxB#Ui9%$?S6?XE`zwZ@>Rc|Z-2h5vtu6*m)|ex%JMi_(v9@>eBG@B;z>-b z4A9SmnWEDbq2G~-z!V{u57Eh{hu;m?>8qcIU*9Pi$l^MaZZtjo{tptxA0CzrJe;XZ z&+h!Zx=SzNq}tEJ{SQkcJlw)(Z`NP0l~H&yy%*mmt-t3Vzd9g}tJ-RkE*Qf#H%TMh zl%rYe@8Pj`{75e!*6*dihj&&n<B8T!j))tgUd<;gZmLe`4C_*Z;i^W%Z%VqOU!dVXy~(bU&o$t1nj_4%8+lV=qutvKWhGr7A~xk6Ft!X?>(dOQT}~zO_Ctt%KFNR*#M9U8`@c?sCwi-Z)p|(dKLn<@2^)^_6qD zT#eIQzqge14puu@&HDybB`s`IwyM~jeLa0_>bcrv()*ZYnf%Dx6Xa_2@=uIaX#0eL z;@R#Dbt^54?S%Es*(O$76=-LxfwS?Zx)c30!p_xLRDEl8HuFImypE5%`^g%RsNDbW z$1B5@;18$}9w1)Z;7wIBni9V-h9?=kUJOq$c!L<;!r<2m-eR2$dxJDKsn6tCXOPBf zYB$2dFR;HA3zWGNLE0U1X`By5rM6_=&~Wa`;w zFqo}NI7%Ghf-iuM&SB3iZm`C~S#m{cutp$@gYb5Ww!je#b~v#P=7MkpZ`h5HP(WCv>$VQDP;E9r}(1v2cfY~$%@utvoG zSia<7jqcozn&|S~F*5TH)|lWfh=HZWFU$FjPq8lz*2vQ%WUD$@V--D&w3KWu;5E?} z0>+{oVkUAl9V5ybgNBL9C~xqP!E0N@TfWJiM=* zY7}$z+)}82e%+&0PUCeNsEg1!W64s(#I`+8$A#L&lk{YXpmOBrQN|A9$?8nuD_2Q* z%1|wL$t(fH>YtQ)oFj&5SWl_|UU^sL;@uMY*rat~&*`Fg`Q2}+k2Ne=un~A&h4K1v zYFI5b-0Wp=O?TM|6TLx&aYJ{baV3703gIf^wMG1fRw{s2Yj|lKYxHLMIKwr9G`$dV zs))VvmI~o5ilqqtZf9!!IxAA17Rpfdk<2>7HP)+d*-E~($$dt+kG109J6z)dD$5=t zBTX0;@iXM--0An?RpQ_|vN4>)Zn7kNhJ_#h;ZJxR8Wivh;VM>GIu{77 zEtRi5pC0o>{X+B_6~;C5jJ_pb;~Fuj=^_5QW0vdr8qI0?Bji+x<)yb(2yau29xyc) zt3@=UTx63J5Rq)PO;*DBns1Ss#P4}Xh42t%(nO{reumU5rdBc2?G=^I@hL`WeUmI{ zoFUFWJU&PgiJz1)D$CaxV2_b@bN)54-R_`Sx)B=I9V&o321sKkdanxO-T|hu8$4ui zdid1T5+xg){yhaxGB~|^YBUv<9mA(t41a_VLD5mC#t|wf!b0sL79E&iccea2NJB^p zV}ebERw}02E5v4QgvJR*(OQH$Qz$546;bT5JH|>?F&pLZk=lEtZ=`v0n>0+K&%`M|p4p~rM4CkXqCsfJ)n?|1oiOQFqWoA2rhah-u z%fpimUN43x8N7kurV1H8O>kb8Qb8rXNK!De z0+z;B3X}$G@~{fwsdU*fjMfPJQ_+Q8EPpGcQy4UiMk`FG7^Bfh4t+W+JJJlD)%VQe z_lj)##?yE_NS8xo^FiHonpGiPlTTlH8h?IM1@R{N0W6bn0gKTtQ$-x~i|i8i3Y5?Y zBN==2aC$Z^zzT417{d+i*R1)SdWGzo#%NDQBDp`vIzD$MZ@*uKa6dDVhN9A!xtPf` ziRWDWbJW3^%Gj@sXfgK!^^@O8M4rus4-6LP({8}>__fcgF?&Tn#+LG>^-sz zi!VyL&ek3~o9@PqWL&vQs3>ms7X>?NkWcrz`@#=>vfDh%Rd~~7Je!x;w zG^|&+n>oQ_;}gu5M}19&@!AQ_nT8xT!v9bq{Db7$h8&8KlMT6^AtzgEYAovU4(DNm zhVjaH$86F`xQEvb#yd9G2vap4lp&1*T)j-y7)^Ka$vCbk6OcH!kkrB>H51YwU#Spp zC*6aetcU(sGlNq#N^~}l5VA2+{O66tSZNo`!yj3+sk(A3m2y)l9aD9s<%>(NYVgdt zI0I)|Y!)~q%dBY{4`nN{TAHTug*r%+`-3Xi7%b)5%Vg;`P2+pA0+yPtVU=+GP@?)* z=T{(sp1}<3TGkFpyJZ7TD2oSV^VM!;N9tp@q9>I4n4!Dz%xNmk1d}9av)$C}>{k7& zi#5=6jn|fO=3OQsnqY?Jn_VdKQ=o|i*@JG53Spg-=jzD!ZIS1e0-v}lgiqY9K4EP2 z?eM7(cKCi0Tmo;>NBBjL=tas&IQ|pzF2d-4CtXI2L0+Gm3 z9Dmi`bSj$7Rbl% z7Yo(TBs0*rB9_+^?kSg6$o@Y?{W#@z^7*5zFJhg1QJ+t+s2@?^KwoL?OJ3vJd&RC$ zx!NjIDg`=cLqDfLr6?<>TA6Y_AGEBfzxo4J%2Rr^>}u43PS;g|Gc+u^YC(Ium!AU* z37x2D>}2=yi^h`_8Q+Q5wunF4Ugn}18Yx*+jbw>zKzRSivQ-kY?2Wdlo;TWCh<9{m zJA%)a_B)g9x0jzyZwC8M7QINCSei*Jy|{-9VUc1q6Wd{A{#N$fpok+5GxX; z5znIW-*V1u2fZ^pp>*PO*a>~a5~L5d`gl08)wi9`SS_wGvL?}yH9xJ%`ji0MIa6;} z9D@tnVyiF5uadF-f|3h(^93artVkqa8DXX;V2=M|c`|O6Mvi}^JiItdW0n6$ze>T6 z{@er}kBa11qy+@*%v(w!Y+4GPa}YlM>}=EL^SjJds@MuVkknqgM8#ZNUx*3<+> z)?}DfreM?bLOz$ZP!EG@fnkzBb~|jS(V?cyR2^zERCYUzta+lQY9R?om=G4~Z)tn; zt%RA_7F|SiVq1)?IkzU)#ItA#Il*>h8o&g56({Ei%~r6=E&KCQ{SBluJr$YQTi zB}pYz=#hD{1r%#6B7fPZSeH%)erRHc@E4dL^sRqyi&j6jP zRRD+e31TPo0NJBaY8_)*rv~u!0|WFB8YJ=rmj;+6dH`LVN_3rVKHP}~_Esv1x7rMl zBAh;I9Y?!$igxM&6v_?G0E+Z(Zk(~3FX7Q?wZ=NWTNsc)>v&I=uD~_gc9Go(Gjm>9 zu9$_n8di5(1<>6-BqjtTWOHqjZ67j51f)EtLU@jNZHxGS4U$eoP9@nz+&w0V*am_v z1$;ZlRw>A_hlvJup3AsWh0~p`9Fve^&k_6RIkeVH!dI9_YfX{#V#}vsOD~QT;fUH{ zuEu!vEf4U%Rg9wv=Gfb)pxEquNjI7J(qUXpBm_tKxf;{ufiQgROqDf9l?AC>w6hgE zj#sfh&s_F1bGp;3Wk4$EEal$8DhWy5(c_MY|Bobpf@Z4cO#W+1g^;0#X``lKJytAz zTziNED_3r1$`5QlDN?AomQ*#hQnGQMwrcQa42*sIIIvPY=iNNdTkw>VA!^{c8eb9& zA;Zm=Yg3k*r(qrE&~sd!lI}>tFC1llQKw9IB;{5W!mY$>OOX5DW3!&85y;?9A;Tt% zUeh&RIY=GFK{ea#6lUA=xKl_+mf0y}IZIs4ox&3Ll=QQCnr|Z6s-+i8GfAKez0rrT zP@f`v z>O74+XN(y5uwp6}@!$BQzc$Dx8dl4MfH)`&Mg3?w%ch>dD2-;>i@0DE#1c^+-3yeQ zYqP_CqLDn9`+$5kOisf|h{}P{CmQXhDD?uSsQIG5{Y2yWx44`pFhz`^2)(CT;=L*6 z{N@vl`Zuwee4;T|t&GV`QKhL(DNARHG6~K1%u^qETIJ$tUK+7HT3CRm|Exmz^9iNd z`cKf6Y6$J^snShE;Lk6!A?Yg`<9~!6eshAs-pV?)Fl6 zyF1C}v=EKlB;N|ZFEY_sw6F7T^T*`3`Ahtc1eI9NBRfCQZBL8;b?FXVYW+!)iAyn# z8V8<7t|L`e;&OW9FlAZEU7bm90zF?F>KKl1tt1y!%brKl9q2PXN#ckiSI#KT@5BF~ zJHQKg9?AUM(#P~^P4nPF9Un&=H4Z$Fd{kZBER2qoWeCBb)JJDz#i&&aoJV@coL?Lc zR)rcJ-E5cZ)bp#}ssl#dNwOO))aXO-dCBN6PBcdC;;eAg^H|{&b73pos>7T|-oJH@ z#q$2YDSg2CS**Sbb$p6()Hv`w1`sLp|5tKHd_Cn}QK80ef@U;4OwjbPIPkpkxIn|& z$fepwwF@d2yFAyGq|*r=daDexVk1S&P>9#I1TW#PuSD&F9jRx6CJUog3FjKaNW(7d zlYYNIKGqL*d!QK@%jXx)7~N)hAnEVT&MX= zV+&tsPnLj*4OI{gZ&1m&fwz5{G*`)J{vt;)rdAs3rQ&PwGtCzgL%2bn+APwr=mZz5 zRev#lB4InX0^3!8*i>Bq*^3|TB#t`3n4`aFTG?(0(i;WAotS5dg*y` z*juELqbJL^V(b-@yY?aGl$>*?TPY*6J=3rvjlsMu-%4^*HTB<#KbG-Dv7__T?1iV% zo~IA_&OEvco#$+kW%MGA)$A`ptYjk$VuwC0R{IuN>&W6GTr26ibEWPNHo!%+-u^*x-u{8m}ynWoJ3a9I>BIJxFY(N(3y6Z6dwawGv_+SjL~l z%6eY-=aXDqj;jWH(UEQoi7!rIm;PBZ7oTfbbETk!Ohr zf%lwpF`75!0$6DCO%=@0=5ZxTHDU?`+A!ZsH12M~6qaZdFlZRV?8UYUW3jzg9Ea?+ zkBLd$QVnaSlzyp3tvV`h)-YNbV%34#23c{3(48@*AZq_aRp3t)qwc6Q@7d&s z5VdE>#&D^|w<04MEzNPA`&gMvHU7r33$M;~{OT-ZjAs&#V=mL;C(-hNumLXR=UArk z@&Hk1mJ^EcE^VMfX!5Kl`J}kMU#?+omhVF7OZg;({QNaaFwIaQkTVrIaB2I6l|s5)t6!^eFFSC`-&6?csxL>FzI^K7rIytFf7%tRi*O1hu(4T2;A zOZX^#0Q-?`lnS>g;rne*b@%&YRV}Qq-3*^s;N5N)@i@1ZH{kPQDv^AA zf>>goU<14qrn)O!4_x7{b9d-mLL~F}dBMVGZF3Gel)^`JBbh z8nA>ujC+k?DhoW#6h_!E^0`vT7e;Nv;6?Wy#xj*L_E0JrJw%|M5lEJh509oo7o&xf zhTa$qo5k6p5%gRzGqqF^9?eHQ0$8bd;TT)_o=6ab^-wmUp?Wxnmf?DZe7`Eg@8Mf{ ztu6J1hV_OD;EjB_Ba+V-;scnf)+nk}*QoIl1*LA_-NN_jZD5S%C8RNWDi3t0>eYg- z)={}ZOwnuN2J~y*j~mbNeiU)2B!8{AV18c(@%|V&D8m>=6^t>HaKrm5$uK97IaRA9 zNmdh=bdyB*q4znnexdP(I9O+FY}sFEtWmkzO^*7LqCl=5tQ`R*P#4AG@Ld&+Pt+Qv zBjeklkKI#yah)aTSy>}w3;Bh{9{Z%t+2Kp$G|D1SCzTETOO1Q)V?noSSZ}jo5h&qW zm(K3#s^b_vIfX4UZYz<6-&T$JoX&zmoWeDx0iXKN13ql$0X@`GS@>+#n8x*zky|Ru zP6>UGdw4_bz=#ZW6mRebEwxR<>c-aJjhmiaEaBmT*W_}sj&7&}BGr7D+z#2M(fn1G z>nn}ly~kXCrE$3&zI~<9@I6NVmBwA~sTO#zgl*j-{_uM$Xz&!luenRLz+L30T57un zJ+%igTur1`r-{sFKOrKN;O=lzzj$4NDuuyAg_osQpHu~geN63sQ3?fT4#_u{hFEYX!gSK9=-rjr*S9$p{%~mik7+x{Zu)jnW2BMdeN( z(aG^{^d_sQF6U;?@?^wqQB>Q!E%&X))p9@mTaB0GQQmJgI`M(M6iik-_>r)KuHI8j z=%-YL1XV~960>`g1r_!vWeJw2{ByE2m$N36Zs*Ir!tXS!n^XWdxQaXn2h;iL1@1AJ<&ZRcHz^T;Dt)DN48nZ$$3U zu==n!^xGrxaaMsy7>~bkf{$_Ct(Yg!_T56}pA9DEpb5y=9mNh#yuF7F=GL(SG z+?c~JYbecxa%T?jHyBEqP%g`n1)(9O3MuhnM`{NTzr`~|o+`hUqs%d*2%Jw!mGf7D zvP;9dpJNAshd9I$xIea}zyG1w(tS5qOfm8UO$-@tWb%#y&qgy+YEP_t_mw>=(K}Tbck=NHzW1SFUBLVjD3pcU4;ppq zswC8v>BL|us7p1(O%Jell@l!`)&09lLb{5`d{`#3H+ErhkECzVFdFS)Pqv6Rl4oM8 zU{GxpFIW!Wr(vb408)4JID5B$zZ_?idW&ni0d7e(S3r=OQO)HA4c5m#&F2VN;(Z!J zxm``N2=e6t)yh))HLTyM0DhOEa*@(QBuRTjh4Dy=%q#~qtcEIph9hLeB-)s(>=E2Q zSj6vWO6MWX#=F7Hy;b zwaqqkKx2^oDR&N^+T^5S2Q_p7i8RVZLlRc1Z)7g{MjcS}TX{gyiA4&It8NU~%^t)} z_#g>y0uH574WFCrMt3a|*Giro1S*6*2d8|_M7RplXr4`ngj=z;%Han!tU4^&L5=VS z3_(Di0zIgaE#}e|!I5;35f*Sd!6bZSvmj~cW{(n6kAoVQUBM6WgbLw_r&Nd$nhliDR)mZ)xX;|;50N!b*a?x&}G^j%w zH_B7~hcq64pRpe@d9}&`hV`R{RhKpLqek5a2po>7i4JRADSlH+fuCc(;|vf+{Sl_4 z{j5>HsS2Pe@ia>viMbShQsv^wzcbn+8ZZ5oHGV|nB6;HHh{kodsSy78A>Uv5a0Xv) zk)VHQ>IE>sQ4Q;IQjTg|^an<9RO8xPsgrt&A)n&a^4Ba<@A-o#XMkfG)&!{&Lh_;- zftrltm`2S;DukOvYkf?kZX*@MO?PmvIHvKNMk)z6J;MHbOyjCXDj7FTQ2Y$XG#;5C zBJhR)PwtW4cg$KI7dPd!#xN%H>0SUstXwMegF6vC1G%%(xE$#A*+looCs_5S9I z9HqkEfbDgLY%ovic#wJL$1h(eaq-UQgLxrI_?$JhS^q5O9w&8tuu1q%&dh%ihbRGy zKtiGlAyK?r%LA{!Xxx1-_4-Yj)-M{Rz~iFnKc!`FV+rsU2MAIUD11tz_9ZF_H~xVy zWxlAAM5sX{5BSU9Jb-**{XvGNbVwJ){*NppL}T5wah$ z1bBq3cuE~PvhM^WHe%U30d?eXEd#KwB89-WvW_COQ?i=@)RR&kQKw~&KCLE8X)}P2 zSVt)q!73tXPvujK^4vJuIl(K>l{Usa6tnFd37ccmkVsR9%S81N&LUGjrxL6pDHE{n zVx(tNOXMJRUsdXgpEqtjD(*FA`9HbStiC`Vw8HaJqr7d>~ zPPzMivM1{bjHUmDFvi=RdHt?4jvHI<<4$*1g^}-;7?bW2_n^E0)fE`e5FryHMM4kdDZdBG0fMC>Kw^lQiU4(_l|+DN#W`Is zz`B{aAaD=!)eES5JrnH(+}xClyL`vycDEO>fiC$1;v|e|=7}GnfJN3vw74-~Q?W_v z1sqkqxJ&p^ccMldov@$(A}*}3fV=gN+K!~)M?D!-OJOO9F2yc6$&Jrg{l;F#Oje_S z)gVq`(V$U+r{0MA(dgPZ;QAyZPk@0_JUu zcgQzb7}vied(T`Lr^k= z-ckX))kEpXmu=C_*V89JPhW`uB0`UZ0UUCVxH|G(TO4u8`_AxYs83`h%mt39jj{yF z1%}c>BPf9vb4zOSHG%&B>1`FL)lI3^=%&WG{GQ|7=`IyOgMf(ol*7@dYMjeUlon}y zs1gk$-zJTBQU|e*>Pf{(n2LfSfOW4YVG&EbmjUxkGH6sR6P`iCMCJSB0eAnNMb85s{F@5k zZ^e8z#UlRf+bWE=i9aUzQ(`JXys6;9wkjEIi9ag%Bl7qt@qpmX+Nu=8ZzlMIk0eC> zQGZkgq6&{Rt8O%`D)M+#q1m%F>1vJ&M?-k_Z?#B>G-Hts>2Gh>j*%jdd9=6NR;INr zwkr`W^|6_ka1T9EA)gl#0zyr^hxPO^gcGpTaCR^P`G9qc3g8ywuR9;OOkO~xn{GN~ z1g@sJgy3|_2>hWrTS{{Z(A{Dcgo-g##4E+{i0G!Pipp?CKsuO3phioUWF+wSkEwFZ zr-fxQwyN!Htzz+zY>|CsK!p%!$)T|2RxVU_>r)&jg?Vj21%;W0mSeco?Wo7fao$)F zN)w^PfS1y>*Rl(Z#M$GV#+li z9xY91**eNI%_!{-1L%*zyzxC4bjE~9;FOYrd}qGHZ&(0CDc%B6J)LvFbP)&`fsn*E zUNZ&(-^rKWR=~a+5&Pk)vvtVM)-2E{px%4titQ*MO&;eqK-f~FA?Grf9b);` zS!J@mGgU8sk_DaI}BQC zJmj?(+}Df8cfD+LXfhtS&;&ydM@BG8N{`p8h5OnMW6YchBmXeenGDR|Ub1odjHUBdc%{JVVM!z>Q5jN)yIyk@Vu{(&8rpFOH7I-sUZ@q%Wp<@?}{| z8zq~%J5LB^HwvFOkVW;+y<%1_B7 zQu(!~0al_nZzHjh&s)r)(J&Q*Eedf1Pok7>8t_jVx>;&EaJ3j2O_#LHYc-c$Cuwms zx$e!lv}V9lDiUbMt}zp^o>2ijQ{-^Em|xS0?t27V|>C6TWqGfas0r*TCz&Cb&_Cdt!>G~2-}z`Bvi%mNbIuno)tYPMnI zZQhmw&jzjysUSjP5n~Zg45@&@Qw6^wq(TO#rvNjqS!xbY^G{4;4p8S$Y)f;2-^=D> zKF=L2;)z%A1xVs)f?sj13gBAeymAj*dz%X2HsZYE4czv76~OO_Hxv1YDv+Kz54fZ; zmjI1_FyrGVfF+Lc^2K4gLBsfv#(%sED(sNKYg-;a+2HjA|Ay~kBnh~XU<>5qW0!U= zLi@qZ7q>v40Iz(=b3&e!emGJYKO;Q$#Yi<#c^nC1eR$3s1egQ1hfjcY`Wvm1D(6Gu zic3D1xoa)d5d>+$nD66-8lnCAYADUbe6sfx2QXxd>?Z06Xv^lu;fCumdgv-W@2pS%fmuqhe6M z2uOX`3udH0hqw41EdvwLJ5(5Vj5a<(J_qjjqY9wK2Rd@JEk2+xt)p#m4C%7$`yBX( zm}Zhr$JCz#gY04QX3OWmRPL^W*ksg7KdW@(<1pRs%`ecKcTssQ0{GNs1T-1@9C-Ny z*3h|A&Q#r`nCF)4rh0QZ*jq6bdcP~5%@ITomq0Ax7^OflI~KZz*uETx(ehjO2PQfO+B?vzZ8)`8ht=Q0nPS47c6Mvc@w@ z#jA*F74PSnfK_lyLms7d0k3=jRvQ&Sn%?&DahLE?v%C^EBl+Vz2YM<;nmI2GX8zakrovM=@ zq*st%4p_SsOGc) zkVoVHutk2MT3sQPV!&#y0%+c)n#x6&YLRNpSTWH2buM>a@5Z}6-R%7iU!cN%=VMo; zV7wT~bR?%8#yW+L&L*w>3O zh>zX1K4GktxN_Q=xOh7S`0MLj!@SGlEn*az%M)U;v}_H*BEau~+P zlC?C+8k>ORENn4nufMJ%xh7{x=w>gl=~oU5>;tyY8KD4-QCL#wB#BZOrnvpQEG9{$ zFTPGK@#`OPHTjX$R)JTxkOU;xgezdUgFbfsV(_YtDP!<;E={DqlF`lXQjMrY-R?_n z_X?ashg+XwV3K`+zE_x0>F&j-oO=oRB?Xg3P)GV0+9*9s4(`tQ-K&WG!7kN!&VR-r z-}^rDb5j1u-=&(Iah$*83c&iE(H^T%RN;3|R^wJAsv^%s6`o9v$CBTP$KLrMF4zZM zR6MVX>QfHyqgLxUzQtsJm(2FC!f1KeMDi8Q#8ZVy%}+VnN}zrtw!%htOP#L*8r`Y_ zxRpmouUTp}VDVjP1C67J=}bkQ-%}O&G2dAz&xKMnPv$E^x3ZJ2mVISV0+*-_ob)%? zLmfNvD26&8%L-yOP@*=o2W%Ej07IR8M}@K7$#-q;16BiL^$$9>b^Ag8tj$)dS=5i8 zbqADT9WbKwmdpqg#4gW#hCQ(hGe6@*jGF0mcg&tq@;92x!XyC`-}LgFW%rX2Xf-h0 z9xX0pRs;PA8p#};tEqbkMuA*Cma2td6cWk*i9G*bk;WRp`jZOaPrZ3`(Ob=yDP#@s z4|xWqw=~$^o*rrqaC;k-gf=9np*KCCCs`!lb~}N!fF+y8S5z)uF^{#Z1+Ms$3gJ($ zurt3x&7ei%Z?E8BwGOCrDd&du;PX2HT=U;t)2|2a{%k) zfx$e*4q&JJOX;HejXlgJ{(H1KeGiWIt5>AtGvXA+7F@6bH^;s!fr9NM@%7ATv zbu}s5fU6%T@D*S+bzhA7|4cp0b{>SdFGlg_DA4FS=fx=4Bff@r(e-QK*2fujDdii; zv*!5iMA-`wy;lWr?-ME)Pn6Q0=qT;t8{n=d_@%!Etc5}%G*y-M6&4}^fa33l<9yi@Y5`U3sYedt+T=l>s{et6?nNhS!?|CX3{Hf0Q%YUEK7QeO=tT zR#l6dAx`vIyMUg&&la)>_Ms|2WU1Z2O?RpQ?i}rx-0lX(;s6!#2aw^@k%D$2vj7Vq zE1Ct^!(+fb!lZle-N1TxyYa8Q-Q8<|y>5nRJ$AE77D+oQ5BB531ObWqwCZYmYO$_% zzU|}i9E|#rZ}0IX5D`Oi5go)U1}0Q7Hp2<>xC)zb06sb&2uJ;r>jWZVgD#==usi`v z?Ex;RM_?cDXok%h`~Xn$7szqT z0!?0oG!!*%zy9`gzE9`pPVK2uL+Y9*2PU zH!BsyX2sVj0v0J<)n>8(F|;(H?Y8%F(Y4o3=T}Te22WoyWE+J+=qiiCu1>bYuYU;G zOYs)iYY(FBg%L7TiH>-YP0C))4%$pG=6P;C8(MwmE!(w~4=xBb7HSxnS z;Af!LHLR>7K%y)iXlI;esbev9(lNk)8ztg__va~oxl+<`WBr1=yvs&2#9Fax>IuO5 zjSAp5IWl0J0REWFLYy>bba>=n9KlZlH{Q>&_5Od!(&i-4;2ti1?)jI^k@zHVXA?G) zCaL^Q{TDyPiz*4n}r%CJy+toM9YwJ7I5#N+yMokh|V-xNOUJH=Nh1Jo(tz4oy}w^uz) zK{=50RO_po(KEo==@gLT8y^dk!&t%+Ap@zfh|2(a3K*rv%Spy~HCz5?E92Va6tJC} zVVYqA9eA1DfbVg=;YE=qv7UFP`s*dKeL01AaIgQMUxjecKQ}>zFgIarH7cYrw%VL( z?DnUCgOmv1pg%jo%S8W#q6B`wQ$S~~q?3^E6q>v9r-1JE`s(a=r-0q=Nik?X4cz)9 z1Gjg?01bC76ICG5+f*30EifK>d)5LUr{v8szRbdfb&N?IIx~& z?m9ZMp|?~g$6GJB0Xso?NhFnvU0LqeI zVeb;c_uDLT*PZw#GAJ{Pr;Bhj7&#Ng>h4n)Fjbl6-IKAPi%n< z9x`|hi+I|HJf{0_4b@+3)GkFO33ltfu}1B*1r@=d2z=+Bay2zHr`)cx7(`cJk*I1i9dvX0$r>foK@nDq57nHH3eNAc`w}Z zfUp66M;Wq80WlaNMQq~;2&aaJ)U>F82GJJss4!gaNWSX4VKqmAPA%9QEU_=GEg+iz2PO>x-V{ zM7D!~Sq)}8Rq$r>O}W;V>g9NLqRrVKqYkW#%B5tf-j1B-;>IFBMS44!qrRXq-4|*g z_W>B_AM0mSy&arXIn=J@*aQ94{z>4SdcRfy?AN4a8`{qpM)k`u=YY=`-1K(P*%>M8 z%-#-ubo#j}fPOA_6?yHD;mhMYPkFwb(w=%dc;@BU_U7do%Ht3K1w-?6AKdn;v$$C2&<@?4*rQ_Lhd&Xis^9~x zG@anoEG0#yZgU*m(o_Y>5;bLxgRa~c1}%d5JcOf(>mkvk98yO(^5cjaPkr2Yd!EcC z^XxV9zs5d9@-F;HB`ki#1T)3tILOlZa6t6@!0HzbhuVfME&##Pc!WIggocXUXYEjuW5a*)n=I zUJv>kX)Q@rtlC0+Bga*J9MpV=`-^unSfLgPt^TY6_%rc8S*ovt#Ag{vUk6z#Dog18 zW}L&_gXq;{5K{?Qq$b|4Lb!hrCqY9F33)XSHbPjfy36vVzk|-Yuh??*cd(l;x;-ay zo3LBH*KRSpOS9Afvu?t(6UANo00)oK0b{F)VuLUIr&}@ittQg!RtPK9cVZ4Tz`+4^ zh%36ERY%!}4RFvykK?>EPIq9N75Q;`sdTmh4tDW9h$Nw2eLH*I?TogW5PttO3sY4N zmN`2eR?t8PS3F9gT*ot$c36UZhk(R%P!E#}Te%KydzjhG zbJ` z2P5nSwi_}7-2!`&?WeAXm;SKGj-V8iU{yr=Yl8n8*}?V*`TT=fQ=O#M4{`9Dn|P&w zjmIL|q$#g*Hhr4EPq$)4awLmkw(i!Pjon5rA< zU<#XC$Rc=O^Vl5IJXl&g2o8y_sw!eQ&tT^%wvUboTT6cKx{u#r3goHOl>VO zWSueYf0ip%h2luqQP?K;w8l7?NHAHbGYFcDUss_Z+wEUu3p~a-kJu{)PN%N4wWY>7 zo@v-TJ}91xWoj=~vwP`7JRs~L7!MW1c&s*K&ACHd{ufRHV;wZ=B3t0G4sM(*bLUtG zoiRk_jZ)AgkW?;#quA_l?jGkL@hR0BPw~oBDwg648D_^h$WtR^$uQ2rQz7PboP!tN zqN?&O%BEN(^rhniT7WyHeRZ6Je0#oh-}yEr(?oK#O$A8+ON15>+Ih*1cVOMl^v64> ze~${`o|m|8cu9P=j(6~YD38dj&u&^unc$#KD}I0p4qCm!=ZV*|Ia-3R7nQ?A2bP$K zc9R*C=q)OYTe?9u$`c)2AuWP94aFTSuvbWHo#@~P`-B~v1y0y2b*U?l|A4pFTTxBq zY_n3X9!zp@<;^O9o4YjP7TO}=0kM*q%!LysyEC{U+TnKLIl8d_HHrOul3J>CB)u(` zsuJS6)hVUIIHeYHfxXb4?CQv>wwUf))tNQ}n zIYj+9Sp8V_1THq@)f617o>`*?(MVxibIO@nV_S_2N-2@WZKHl{t5H&kR#KyH-3oG& zT4s&DHGE<%9rdGcjS)4fMd({vC>T*=T8)~5M<#mdO{>wjZmlv>WM*4#D<(OZR^zj> zh(4>asz$X4of4UdR@Eq}QB&|p-iIdR%uuZ|Ql#KRFQQ52R@vOTtLm~dt*YDk64^CP za_~jny>(;Du)TE;)vXpe&^GFiWPcd-<51nsm&D;xxZR5PWj&BzSHLVigp0}{da&`c4vt^m;|k`Y#})G% z#B$O9iZNHjDs#*g6R)Ti+0I;~GZz!DnBO1{mt1`H+m9|+0ep1%7ngHMzw)Y;SJ_bGWOItUB|1h({=JMq8rMK*f|gU3wf6nU8V^XU6%7(0urv* z#UEeH{9R0`>~=W#n`6Jx1djcNQdG?_H<$LmjJ4eVvV*^g)pF5gTP};`aLZ+1T~;lU zPJdnfSj%5scJMcGxTG}Uw{w2W31gCj2gGU2BnMmVEZI_$cJ`5NqC1&`ooT}O?&^J4 zdu^eptR)|FawwDI4smrPvn__W6Jzat(beBw?X{RiR~N^^#zk|MuxDZYq|;-atI|+i zbXk!&KV|h@vi}mVZ3}2RZlw^@>Tjv zZA{#ks9H=ow&EKtC;d|#uh=5HULO`Uwotptan%$D>Arj)ccB7i#)7eaSoc#L z{I(&d%_$BZ`j;p7_Z<0bQyl!A#uyU$X}gax0`;Sh9-xi6hj2Pmd!8a-r8=E~xqRJu zpL>K>=v8N>6K2TsFH;;WclXJRD&Tr?)jq}XLQ4X1vT@)cWIK*=V4CgpcH;7O1gBzg zpJKyEvD8!tdwzn5c5)96reldz-vOQ7&w&_q^!-oGvchraE{fUD3tM zH0s&nZ0Blc#AP}|b&tz5MeD?6x=#1_Op{wrwLm?3w`|Z|l9}e9!3|7#nuA-CSx3_x zq`mJ^tnOvmp61|&dp!Cd)8YW6N!yw3piL%=pDA}`Q!$XIH39snj*05%n3^D(p$Ya( zo3%pu?%X?e7x@$;A4W%;2Z|}kv?-s02|Qj2Ta;hI>%IYeDKVzu7q|9<)-Jt@wBcO5-cvc1Qthrt}%R#HxX`@41f*`u8 zagyzE{H8(7RD4{;qLe860{9k(saU~bu#>0Zl#?m#cb0>Nd|)PoJ^Fj;h_f6#7>I2e zo^9`4ugv2SVSCj%9__61edYj>TuJTefC}Q-GiFR=j_bLio0;X{dmN)>-7#=L>DNx! zXDn~?r`h}eqwJNalcGWWk0SZ^Yv+y!*)(Q3@l_C48|MT^(R*eW8QqKx$sWOfd&KA=dllWg}%yD2{#F`>dkCk2-m>cU_LmaB`=Q_CT4i&^5 zL#X<-h=;_=oj9*bJ9wx~tXs4h;>ghukAy{ZhP_2jKIb~vVh@s&@VO3V>BXf-w2O7I z_Vb9Ar|~G(hf#`23}=b_EUa02mQ19Qn7Ms3*TIk8smNRhJ(#i9lESaa&99MNgsq}4 zooB3h@L+))cN#QIR5Xe69Nh3A8{>loRN7f2BxNZ#$>@r*R1an9v`N&D9%_#+!}jRo zIwp5qXTuS9IugS*H*ioeX~ie~pU3=vM+^@pvGvb$@SvDS%yW=#_qEv~<~bN>?}>r5 z!{V1=SEyW@{|Wbi&XxsXHu&9B<*QYQuad|oj%UR`-+|Sh({y{4%d085GD};eC(4Ob zq2qa2`AT|mp@R&SU+RTBUwvwu8ER%bE@rBd=BcPf&N%{(Qd?y1ICm0xw4CPs`$~D6 zqrZ>?rZ4nYW|XNcvd-RSt1!0Nv`;Y^t18q=iUmBeG)pZo2aC9=KrXT_aPUkUcD6PJ zJcSVcoiD_OuNT^s9oV)huuBmUd-56fs0GgX%AaSn=P6dmXM0*pM!ry4(mFqN(D*Lb zyC!m1Csk@E{qHdvb6)t=!QVQ`=Uf<@Dn5&SEo1lanS;w3s~{TFQX$nMe&cj=gZFIGbaveEUsxjbK(OI#TFSoiyT;wFlz*wvC|TGii^M^2Q{8z zr7Ut_z0SkS0b3^l-*HF}hgN2zU*az%!D*OgMVN)%#C?-(~%%&MhZ@wG<> zBlY(>)=s|H1AOMJKup9WU`k6*@ZXN%Tq$(dBV|ro|*fn=>m2}5=TMiqRJ80EYR?R)tN&bt>v#nU=%N-2z z+@>veFoVm+=PXt1;I5~cpA`-+l}quo<7#FRPZUk=$_k8?j>lN-;Kn;t2zM|;g?KaJUn?=LiJ3XBb$FvUU=e5_&L-D7X!=5|;4f@crm%8D>ECBH^^%Bn z#B~lXZ9qlDItPiOE?(!LQ0&w%r3V1 zDi0kV1aQ<|!ey=qexbk6Du^%i5B&QFnBg7(nZAz_N-+uc#H;+UUpPn=!}Twmv!qrr z@4NjUC3v9=(Zf-uM7z=1@#?Np;j)~GFI|&*s_fS1lji{NmWa>f>Rjg_T%8`oI&$uAcq#W&MWIN@> zB=XUAq3w@S`NoS|g?5q6*!#&T9~C1-_6b{p5tARBu)FG7vg{OGe$Z9#*A?XU>*Kn7 zWXJW-C`Yl>R>!#COXKw=37#qv?B z({vwsdZo)zaHac&s{;7KJ>;qo4!OPPd^tW9LXNMPf5pBdJdnT<-&#LwYmb9| z&HzWXKpqW!TS$=e&TTiIP@6DE`L=8;LuqAVId^US;J_Nd!F+(qkOoG=5H5~~s0?Fb z`GbS@c3(an%TC}t`s=nz!Eovvo2M+n00BP zcx*V};HnUv70$X;M|!u#tV@?(%3uc^?DAY^9dNKJp;t9-JZaVj?uM?)thajP-TD5%in7`-$$a+dWZ* z(LHfiJ(`kWR=pkdc$T)KUWfX0=u zofIq}1!HWIr_{G&>)W^AGk5oS3HQBa$|o23sRudW;HceGmra;Gbx)av#7K!h=&5Iz zsfw8VV1}NnFOc0;8EvlafeJLqglQDt`=n8P@9XB*k%G49Ml-4)R{Iwx2);OBU4jZ? zRJBpnQ~-;sZ>p{W$hu(t1uBT?Y!*TEXMF`Rgx^1iL5a%}>CNtveV3>pw$7A~zv8GQR$R?k!HM}CimPp^9*0X7Ot;xnQ{`e$&Eqvy z0LN=)T%aSv+alwFRTroLI@DTQOC@1Tt&O!+61LUea-mAX*B6ed!`CWV4x2%T{j@9pSsY*i6OM73c0_c5dfA-h@msaey$7`Mz zw~YrJ%w`fPu{PS)w9ypF`$@7|##rni?3Th}lU4yNxp?Kp+#eoru>GPQ7jwuy;NZl? zBkM|gmyT=tj^NUBP3K`}_UhZT_dr>DXNL_)GJWb#7dI#e9BKAm0Mk!I;QZSA`ALmt zg@z?s0Zj^1x!`Io)Evx$k1JN*44Z{D;6hc7U9kqcz|+i-pdxL)e8rj{$77ll?83Kn z`emBwdhCK_CO?w&XYMjSeITEa~su6YhB>{k?mF zk7;>HpKwpOOnMdV`}l(sZnjU7CMG|Ubnk>Y2`Yd&35&UJ6H;k6uc~AJ+7A1_E#Hgd zooQtPnpQTB!=GtoXB~dd$_%A?u@%>POUytU=@`JUtcGr@xS4xsk^>OXd zwM(-zy7t1_W!YI+dt>eM%Fd$N8*7&(y|MPj+Dw`T)AECjwfEJQq)SPX^oR?`U09m* zxC<9uSeEpn3%6W&UP&*xaLa{dNpHDu%Y{suHq!EgEf@Z9p(I^OlBCZvkPf@3_#$uE z9CcBTi`DZIU?Ra61T0-%94njUm#bNqQYU%FW!Z|vRa{A|O5B#{HHlS;-;?rv;;uv$ z!Vifj`FAq0yWFBaV?0$Z&%A8);9`mMK-}UDaT}3f^$blvPWZF=@^`j$C#^JirqH_DuL7fMwiGGkCzEdm`EP2nZ zl;2hepB$vCzEX&v z9V9-lTI2aHyat9YW#rqR=T7nY(KL~<)DZ{PWh#KnTCuQ49i%On%pY|Sp;1wiMNnQ- z3kXd!u|Oa(GLWWp?gTvJK-Q@CR@WyVWgrD7%o-9W!TH8xEYNi9yFjxSZTug zlIC7ve5v;G>+Mw;T1V!$6IKTG2T1~+IqI=`wY<1+g7==j&{T$;;792Ln$?|jV7;#b zc>gQ;64e<)G-$vr{V()%QNs+BA-X~UZtOUN4f6VP&baabpFkI|zPGEQ0oUlECnQ8B$yIU;pexX=`ZE9j%15tlpdU39DYv20vBy6B{$a*z}C{(n-vXgtx& z-e_i~jxO3!;u%lk85}f2XLpf!#!{VJ-20dc;jwA9P4n0zGNQ>l>;+e zPp3Ug>@6}}v?^jpEK_7q9n{3Bb_8cy+hU7HQB*BA36+ykxm(^fFsWmWvx-=H@@k#b7lv=4EfDnyX@6 zEX&0Q^c`mr%2eIuR58m%0UxSM7U~XlG8XcrN*5;#+?%A^L#S$%eMy#!g|rMY(X67^ zhM*69^eJXa?U0lpk8)CsWsITLL4N&7n?cc@4NLnK#NnVT8cd?*%Jj0@Nb;a5d7d^%= z*VV;Ex3Kedb7674-&p+k8!U{(hANDPZ&HgmOpTVWVOaFj&E%7A2xtaigcwGLJzdX3 zZci5t9%MW{U1ZTBA%Ib8y0Rlln6Bo?>Q*?WIrntYU5%BAx2KB@Y6JW41~o|9Pfr)S zXpWt15iE`M!RNf_&jQ4SJ3E-|ieD`>9w}!ZMCpweQ`Jaw_Tf=N9;LPwqa=Hji-mHR zyik(u;+_Xo5}Hhvc9!iTbt=cUscN|_GM1~o@`O;? z+r>b8l+6WAdAX`%jhJtM8;WHqPxNMfBm&}SEaKv~cdH=oF6KyU5x-l`EFvyaj4yzQ ziC@8#mZ+p~b}6<=DzT5qk5jD$Yo z$FY|yEVJw9`SMD&Ue1?i@&uT7sj*&VB#0iMl#-DU;o3MXhth~7^hprSLx^gYUM?o6 zDV(}2!VA@UrMb>tFVC~&wnI9dek2(tuiJ+NoNLdQCe_Que*1`b_=F>NC+*|vikibt zx|dEMVvfCg>6K0yDv_K|b?mo0@kFwdUg^mGsh5jo9CP_Ht&7FZN=F5-*ISGCa!=X+I)$=L=;h*L-unq+hHsUR?Yx(Z8NM03T|L9MRBrY}U0CApjldK9z)=^~Yq6wJ z7xk`S>7y>1zMz8mM|&A9qAr5%rIAHlyzqC%TRBW`SB}ap0fLN|l=dP(YzoFdUvqM?LqSf=O zvtB5duBfC+ipnjYbk$o`i`0wyBMrDXmfXbSMfPM-0ej+;og$|k+lf|>$C*x9?3Se0 zTP3uJ`ddc*t)j8`Z;kpR_egq0c99duHu06QCBD+o65khmHXu8rnqpDk{_bBudB9CLu+G>=!nkr zrDRX8o{5k5A}LqT$R$gB2g|b1v0CqHzpk>*vxoIgm>4T&95^IlYQnGVs-GvUjYSmK z>Z@oJGkuH2Z)4R>CgLCDXUctCF}1W*Ul(*_CBS73I4<;c(cmr*D5W$KNZ%|h9^*viCQif z{rb7)T5C&0=y9|q@~~KLF!pn?0bN{Ad_UGYRBrckvDMk`r~tM*OGJm$&&769T3|ab zthSJ3UQF}CwN7J4skTPGaz7W{tL5>GIIr3!*|qj#e<}2PF=zR^`+ah)GU`Wn{{X*V zkd{$D2KYNCBm_#)&Iw%;YDhnCX8Jn1CJe7Y8J;jTKFHLB;|bI#$S{cG38y)&2L-d3 zk2BVk#n&dQsQIeN>2`*#T490jxKFjh@v_1lqr<3{nC&a}d3Cd(3|!~?K1PlEFoU@C zY9+agqZZmFc4cbC>{rCQxFcfUGVVK-lj`qcv$J1r>GpRq-PtS}$NnyI^eEme9;K&< zpZ_WPCo%Er&-Ke;Sugi@agq<&g^=#_iUm7PO0q@fc6`gJ@LQS;hJ><>lq3Nc+G}Ew z>@SONpp(a`Aggew1h$N(4joKPIf2e|032Ft2pfQv$2 zlWT#6s#vj|4s?<93bQlFg>}0M;P%zBRvqNxH>=I7rGs4Dd^RZ)(*VT>yK?4$ zOL~gCo+f+~+Ip5X5jfe`zyh}a)i zGnI>Gb0pS07nj|pLU>Bth|J+46LYwI;!EW&ZhMM6lG7~8z9KuIJQr;wr93x2ph(0; zWT~Mptfv^&P#2dat0W{FPgJk-lMHon!!1q=nO<+XjSq41F7n;UF(~;ZqX{JSr3`tg zGlk3Hp)Rhug%kTQ*E>o0fNBw9H1A3LK#YQixw!Tn9%&A9(dHe+7tLK*_m=@-OAUAN z+TZQS^Z0uNHg>@zRGpxC!T$Q0S&+w611Lzfhx zySD=F4Zw=_KD&FF8y-Q|8wC+$2$oW34ahH+hzf zuwuMtUo!3Pc1-EbJo}h(a?~$5H#gyEqAbDo+L_wKf=oR}vuar(b99k5&%R`eX|rZc zH;MWMm4Kaj5Eu|J^qdMJlM9%j;CYxOjdhG`z_3vF(uln!dN@m5aVIs##U^L4ECK`^ z=TdO23+pPzJ1(}=8Slc9ozw&uRxPq7y0B!PndBnjLKVP;7po91mJ{yDMvZ3?xcGSv z6jNMYKnS1_yCmH*xOgO0g^=2rqoPHAIee-M>j@RW6aV1wGu1_d>p5&sb$JyyWD$60 zm<%M-Tv*q}%_P@8pWyYss2|U_i9_0KjC(f9l7KgsZL)Aj` z@f&{bGG$zUW2-7fEJ`+dLxu1LYcvg=)m9nErn_kR1~WO`#b4jxhbskU7+tqT;4XQ> zB24}a7uTk!5K>Y(U8cUy>Ym{uoZ>M{fmdGlCO z^UlsyU8(hFK51EFq6$e=JvkW!P^czwu$^E}y`J8@gtb;}QaX~|7MsXy=`pj*n5vaw zwZa7Zn5`q7+Txgfk}J%Uc7Lr}p}$_IbtI!L*6AbQvT!DsZl@g83a6a>>vg2PiEMX` z^qT4g9ICsVCYQ@EnRO*CO_9;COG5z)t|_^Ob}BPnY_67FQ$3H&S~>LemQ!ox#o|Ei zME$v!s+L&XaQ$_}CI3t7Wz<(Kkx_qDeLCpFs`@ADb9Fn@#qvu|T%zfg@x&!3XhU(L z9%WWhCi6;u{CJsh4YoJ%!WA~&(pZJCrSa~@JpID%#zz`^6`6lQ(FJnoRdhj4E!EP? z+RnCEdGYp(z2G}*p5V#UiJHAG(2=~h=yk!+3slIPd|_B3CS&+9M6zHL7B0=D@MB$!pj zOcy789sH^lI`|LB8SG3KUHm;0R4WWiIFR6V)0|pEXn8y2VsV_3PtYC^-s4ZUK1(r{rzuUl3nIlA$z*qAe`aiM^-T+~VQ$x<@vN8+VaC5YE1 zTzW&<Ps+-oD&}0X#~J}fgvXeIq_Z2 z>Hmo5MX>j$$$?!dk`G6@ut!lN1orNA?V!1JAX;<@?m%+uf;&?k*l1nuvgPtNOL2 zySq8t56koG!~PpVR%*}EYmYWhDa>;*NY9{>eTEc-Za7?UnNvk|^~PjzYe0!#pWQ7~ z-UOwh-u+7aYky*FB`g7QXnd5Tezw`ZezqrxjUOd=NbE6c<7fLLHj|HZSIuo>SIw8W zYfB6-=TPfyVrXV!Xeo>tYCFH~cJ-ZYM*_&vLp1+~NLZ8lTwW#&qeMiSNT>xQg@j}- zCVk@K2;b=m3A?L3Q4TRbanY4;zb6T`pFKpZ4w!E-LnT{zjf+J~5wTL!gs(0{RW5m?H;(B9X@$Fg?u^)q{9ay}Lxfb(6W!AZdaHI?q^rn+6kBk6n>qv`Q0 z2{UO<5yS%3MO^#McQKwiABI@K`Z576GD_3!?=EurrRKX>~1F7#H=p5y}LW}Hf zYL#YJUEso^^EpePkHz9-fs0GqivnSRi^KwXtYCqQ%X`X+->0P^2$>L{mWKGWG{mQ+ zAr`u@2C_j6w&{+nrDxz=oXO1MlHu^uEU#PNV&z{>}YEUeH@q&v?by)`=7=;D89QO z*<#uzgWZ*}qhKL_W%`lx4;q(rxm1=?3q~d2crgk$Xc&#go3~sH9x`}si+J;wY3%

gHFgJSL`!MTFjJ1XOw<8J&Ea903+q09 zJpvD~ZVV8z2n2&FfS_?kw#>!Nx3WJicVXScAjPpJOyE^TGfne8hrvU5m3VE7_%*L; zY9e0UEq4Nh)REPgB;dmoY$o7o`*To*BZwvbQ^+*2e5{rm1IJ<)9qman9T&TZ>Jd`5 zD$*USKc}NNiS3jgE6zk$@I*lcaOZp(sSFw>Dn~j74;j3+<>AQ&uNT8hgRd-8_I0hM za?!O~3D1NV)%c|bE12wT#fl{q6-^|e9Ho+xqdK^Bkhkk;b$9vrKPBN<0_n#R zx>nM)o~wX#Fk%-H#wY$`ejSGko zZw&$Z)>tIhlvld=D4`o)CH}JdPu1;6GZEpxNQ5MKW{qAoJa9<$nbqycqnKHJq5Lnb z{<)YHt#px-Fo5x#MIxrvJVU(~V4`dp;;Nfx>-MQ<(4RRn|H zS80M>zV>1Zv(iNoIRTGj>h?3=MxPhy8NbYwYRhAvVtKU{0qyh=9m^#nhG42N1ZXOts-Zi6#Y9(fh!b}|Dn zOgC!B^FCY4(}A%`uJAACXu@x)syXn1KteBuceA~7VG^;VT3t0J$B zjq5*1W(*oeqaT>8<>4WN*S6F;*LxT=TSg+Hx2Z60%Qhp?dKcC|RRDeLK`hK5dp!Tf z)4(8L33r=}ER@?OBg=Xhjkd|&WW9^~w#k9(dKc}s$)K^poMc;SV{GK!=;9(#2yJ$e z$V2-E$>zce*t5xDpnu|50JMWZJe*;ZE!2rL2*1UbiSbsI*FVMbLrjPDiS8Y&V(FOuv$y>Y4EXuTcL51*==z}sPhJcW} zt7!}|P0?y16<^UUN&v?sU@9{0zMN+J+DtN40$Ac<>?^l|sPJAbAN_V7(WwCLX{~b6 zxjKzeUmh0$AF@%XXNZZG%j$Vj(o`67(k*hj0|ki^tzFfSPl z7DkFtwyVK%f$M7*-R%g?4Gd_LJ>} ztoXG&D9W{jy@)&JMQSoT7ba5^5*EHp;|zbZ3gKq5Yh$v#Se6UlxVU*SRe*~nT&fo! zRbre=Tbd*k3o8X{R?X+k=4JTVT9!BZ+mS1!evBr{n)FXx}&w=S&5 z*^dZ3s=|1*6RQB7be85P);-L!jO=UqEeSMd9UCAC&0F!tS}XHxyCJ5aIb*rj#F7FN z%e9urZXv)84|&lok6oTU%Hab??NidszID-NmvqT;P%pJu#we50uS@K=Z-e zlh8EsEWes*)+D0!Atsx%O~rxx?+5 z@;}p_FPZ<&#W1#q0E*QXj%L{64SwIb=wbI@FX_QM1R;s|7kQOkz%vI+9n6H!l42~D z5*Jo8ep3RY*v?0(c^nxqkCt~~i;N&|;$Xar<$H;=aE6Elz41|wrtuWR+F^{8aQ_)|XbJT(6~<$0Bqbq-h5YRMTp+y9%YTR{vQvZ}e4pCP_lL4nLxpaldG=-IeTR$t zA5#GnUz!A{h#SH0%?(4m-jO}MqxZTjsZXjfp6ni|MR$i<-&0LAgu2H$ThSg+|cHhHx_{5!dYHed^alAh zqfI*}FBa=A7girue;+l9l{d=%l*8mAT})+Zv0m@0T&#D$6vLKXE)oaIQec;hk!-s` zWax2P1u;$!<3atNda;44x6wnc|wKK9?2IE*BrOZbKqC*`6)R`duz2+Ve!0yvsdn)Mrb!Glqdn zv0W|(IR&geeg(M?Q#HxdspP~|sHJwhuu@|tXsLfT7G+qYOJbH+o80ZLF~Snzt6ov9 z@ybfEmR+fLYt!02oVWk2*c$v6K29Z1PHT8M8gaL z0cBDH$RHpx$UOZ%-?h)Vxe0@`ectEy{_*|+S<_y7IQ#Bl?X}l7(pg42!ee<7WBiyT z(xwE}U!!!0;e5l$rE{ED$t&c%%GoBC|6LCMwL`-7t^;kR#Dns?9A4-5#@XnNvjZCf zcC1eu-Vo?6y>XXw(V1ii#+kj+xByCk&|AA4-V8+<+}#<0?#3gWW%4NFE_}%KSUhdD zj$7y~eB3Iv0Z4NVvB%1}%7qJmfqK36SBi?JV%jV})?E&tppi1T@50oxUZ&KFRP{%U zxVs$QVI9ZJWQv52zsuo!U!w>b8y`Ww;D7c_KDW2Xtou_fF)1(`JrrNY!U}7bb1u?3 z8h^LLN*)9R@Crrwl^nB#0satvSO7ZtFY9n8nquLU8jgiL#mZqPF0g{!%~NEJy4&H~ zr-{BDO|j#(b`j}M4m6m=b7XNz*a zH5O|M9&4d!Erc}?o@Pz>D=IU=&C4hz=Xc!4nqmNy4Lx4OFQBQ(i(bB_8TR<|V>b-( z-K-+;`Y%C=amK3cA)RGHtfU;kW)4FsJr^8%#RZFb)rA9!zs72qY$# z1?N&Xs~lBG_C6Gc1#C}%n+YthWTy)_#2PQ%a*xAP#T!+qlQ0J%G^N8cKy4({5)|7| zr`bh}_2(Xki|t|Xc8eN$4AD2to+jeo`x|WoL{$ZVtD(Tjtn1`5>0aYOuLNj= zRC^t+(FQ+ouzZS1o=mCz2oxq$Oq(QAn!gK~9~@S4WX21zD2%w~tafQm1qC_pnlW4=)7>XE;q4tH3^o#{opxGKW_| zd4$hUXUmE;D0u=)yFe??O?Nc99?byuL=OewjTx>7<9nPjwpnr-E47+>@C6git04z3;WQr^t?5uyF#k@b%-amma>N0)A!hE4|fM?<Y2QXbkK6khI)LOTAw2jnR)}RL*-cj{*Rf_V7D>`0@uFM^;ghupfVIF|L zZ1$D8SK6_{)|@NMLetu;y6ycxU2T?;ttTCqo#Ry(^D{6JfVO1boltT{xfW2(G0(giDq^gG; zzF7>0haArH?yy%#Q=Zy`4m*6?otUTjPVbML(5^Pq`fA!J>-@tGH+_R5{01J3sIP#x zYE2Pt{Q(YUKA=(9ZH$uVB*Mb&2vSA`()Th7@fq4^;di>x`c^7(*x|S}0p_*|)*A5~ zT4QaL${cohAUF}9BbtAXH|Dw4omQ*`hu@%dQ>GRd<{fdkj*QA3#Ts+O;rfr_sG+0m zXOB4id~3Ai5r=C%if?tq;XKO2_?SoIqy>&TtmNf|W8Qr5UlGdZNU0nx9&>m)trXSA z96pKXztXvrwMv#vTdg_RPbfO>T?T#jc!2Wxc;F;fj3eE#F6HxBcafZ-LFOrZ^5YKI zXh7-Q;CMhhr;i7EI+V^mokgj@MOzLw;bHDX+p!PcZb5WWYaZlGc5DEXMR<`B9!&kw z$o;L=mW)2Dt+l{UgxaSF-aZAI_Zi{c);4kVJMQqNCwZtz41vk`~m5tG4=Y+=E{Dh9V7{HG^+#@h8K%gVqPK>Im^WMg#P;r@Y@ za)Uoc^kF0 z5Ogd}u(np7r6o<=Hf(=HdBX)m^YLCN-}2PuOelrUl$l*up{X7C`aAu_ob zS1&S+*e@xQe|bM;@`Kyt`sYapNwfIDNzxTgVhON|yxC8#dTB;Ry`3L%eP{&NE*bmg!3QE8;7a@hZStBhl4K~smFU;o+I^LQu zsCfaF=UaP|WcOMJtrYCn;%;mv%5l&dZC4q>-{NJL&L9tQIpBopM;!Lk|G(OUHa^{$<^Od_Kc} z!13zvK)ry}P0?wGRT#+tJnAQVw4t92)2zQhCXL78pe@4F zWZ9p_#k7Ph>=vL9@5{FAjJc+>m{D8sIGO;|NVO1^_sM>xt!7mR1p#nBMfv_lD9B%0 z;r~`eg#3SsWvpF%e?1ru(Ch0xqwz2cz-Joy#J{xkp_Z)@>{hLOVyhxFWfUJ)@^j^4 zBz|)D*9*m6D8oOl_e_eXThM13B{TohG8t>xs)A^%R>{m(MYt0am0T3EtoIC>;X}>p zw?6Qg-vJ(bPIANe#Lu;IkaOJSR`bXMl}U$-0P@S{-#&()rWwv2s{rGIfX_$|p(<(e zTjBKQl334GKw5%hf{=5|Rwmd1?w>Y8Av#k;Dns9 z18wNnvf-2EwS4k~l|U54Zo7>#__i=*aQHRMsjp2V%HS=u1sl38Sf6BZCkqGQVV-C$ zz|_6KIw8heWO5rmxr{WoHE{E#Fmaa~gyqVjT&3XfYe~p!g;Xw9NYj$AX*5lKNumu1 z1kL>m{2HLd8;6RiB#Bu_5QaVU{pEP#=E^>q9e1qr2euG?SK*xwT(E?(#A^?L8M+ zAHTgE&0VNR`2^O3@=2~`n;9&hrg`nuP`)8gqf)Q``O!B@>GMjI&*`++a-NJ7?>En4 z0?ET_^3=i{4+Ck{|JFqZB(8qHq z@--KUw}hvJPnPH83*fNnUsB#ddk?@(h7EJFHB&Y^9W?)JgDHCl%~PoaKgkjabJ->wp&;O+oivSy(N1)O-M)JuEZ>@;F31 zj&PZ6;!k(fJdtM0j;y2Rwb-9z@LKBtt}h+%ZO@`8TO2q#YIzRG(^+6mwb1uEYR>w* zm*p-xEbD`gns>n#6qVdpL36s%jPR3MoahyG()@5k>|PqSq;ziC(_B*b*j)EvE7n2; zT0kId1X@V48o!_j|FR+WH4R(h!W7bG2`ihrN)ht3cbI=X&5o^83WPh4r@_A?Pjew+ z7H07m@Vv<4ZB&qA%Z1WB&1>~u#BJNFK|9)75|;2bhKB}&R%mG31Kpj}D8@t1igTkl zad)SWb46?jE@kGoj&rOp{_E2^PTa>?tIy3@t9R%sMvKVDiFfEjI#u-glta28B_-~9 zD&r(&IwFNBGld!CjCAD3%{yQ=(xMv+jTO`F-UK>pKHj9y7)_r!}6AA7tQ}{Q#G~-onFn`@QkJjl_(P^&#owwXD_s?NU97!*+Tm;SI$g| zc^e)vT-jPtSIyVmL1Dh56AokrzxQ5>@VzflgkS1rhvZPB zo8}t0i1kiC4DtO4mia6N@+18S^L=-J$N_LS(stK;)7=#2yX(mTcT9V3f)@!~dmTo> znC99Mig2VceoDY6$=t66w<)`0hedUk;-&;TU;AVTD7t2KUz5DFFDM{+~rYuQ3^0XwiG}V+qNx}BR zptzqFTG&J_wB)724o-msw7}V$g1>uHHj8gHDpCu}6964CTXeLLum&%*egvAWr)hY7 zP18tNgZHK^sDh^Gq4~)y%H*{)(vm0$Bdvu7kc62$B``Z6jM;&`DFR5+Oey1hL`@9y zZX2xZHbOf}*)WD+v~)S!%Cmx4_e#tc&a--2A^9O1yr(tNs)9@KVl_ut7|H(HSV8iR7c?m!SUe#O*Fe;Kmc)c9!_Rze7w~4oS56wgP z2@WP^fnY@ppG{p9yrUxinB9w+#TMe3#;Nr9}6=H47(5J#=|V+R{jINbaHe zQ~sVk_V?UJ-ka^Axlf><4$o$(!4aw)5*{k+LnEWtz zJyg$-e7>2tYS-~+tvbIlBt<>3QS;S4@{}nr|KSx6`0Kj{FoF`Av8U!cp2A?*Q}ZL@ zOW9b)*It^{%f656+V(eneH7Q0<<&8oUz#OinXRRj4K zs1bm>(0_VszDqn}KoM4-3Q2GElY*S!--@K5+=`K~kLFv&j}a7+>03d^HNFmz#fu)m zFQEf~Q2J?BHDJr|_VYDvbj4nS%K17cZ{`l6cPg+%H2g$|^} zqJkxEKg~(XlgbpcmWV%3Kh0fHh%Am-ABnF|Kh3f7@(i$sSs1taX@21kTADxZ@*n7Kyj!YQ#_wWn?feza)lA)4!FpvXfsXZ+CvZmpjLaDBP^J5;l3 zOkr-kMr>a|@1Q8(fsd<$Hvxuege8dZUk1x@(_ku*N#y)wywZSG z_HfPWP73p#yQB~XjRKYH4F*qUkF_Srwts|XCCAlWq`^jL{@v@SekFQ==4w9&y+HG2 zKS!S!saeToV1y4>K>PcSIScW97fK}XH-uALEbb$9IZ!ESCG=C6pdym=5T4)-R|b>i zM`>1P(0k8NM;MDbTFaznqcs0QKHwZ!8%&=d`M*Q6gen&aJ9n0VYarZMz(4;TpJcQy z2hQ7QS*9Yln2H!pyR1W&2OhGH``~$6c!9H3e9KL%W*BufjJgadO+|@wex-AM(x0yV zxzim-dqyPda|_H1EDunGmj@0bvbzXYCXLZtO*X6bvE{BW7u&{YzN{`qxNd!{c!dX2*TT8>y9#%jLlO^WcFIdI5Vz@L7W()q0g!aZ;zG+9Ve_EnHkCe~^=PKA% z-XXk+TAcj(kDV|lcCxx)WmSM>Zax=V1u}LRnJB-q3SV#)brNT*PF6Qq_=>DzL5r=O z7({p{BA-Wq#$s!=%-NAfJr0^1%%Ul#%i;Soxon3BN)gW!6Bnj+!cYKm=I%G z*qIb+?u+2uFYs6PA=|?7S)t~&fgJ%{YS~JLd`4TL2L>-kPFzOCV^7} zvm~%_p-zC4H9yjTqTIj>S2dNyb}(7Sc{p*3=4!XeuE*uux?7%4t%x;~=)F@ltCvt_05?&T-)oD@ z;0I{11-G!NnydZVcdg=IzXYSYv9i3>JeVQo2bdz7zmbr6qdg~t6wj_!yfepZtZZDV0`&`fy$6cA1JqMI85MGrWV?Gy1$#6F8iwtMKeqe0#s{&2Y`EEbP;?Go+e1=PiZ$(p>Fo0JEho5v~=Hu3HJ6qxt%qD4lQWgh5gPul5&g z;5vD3WWGRs1Q6n$v|Rjims{Uq`L!3Tu&|`6+Y`TI!_PAOs4zyujW5i_^sVtH{uWP{ znKV;ri3|fDY5rLql=UOcm(`&RuJcDJ>qnYzs)N`wf0PSVbIl%60jMDx*}0mdJz(DN zVXZ;=d5yhaHt};cPop)qEiUYHH7~LD%lJH3m#6&0s~CinDMsnXnyXz;8GJpiJY^~1 zwV%ShZQv~g|J75J&Vn}-{3fw0f*)2iPqTV}!u)_);Lg*0^Sc<7-W@{tGlZtfFfmVa z?R$+`lka^W+b0QhH&63i>SKumNgu1&05ZKqM0E)*CNI@u%D0l!ePtn>9$$lSzfyDtdHzOx?;_@%iMl8@QLY!T&*d7ee+>5rZ8XqM-RKY7W$?6QuB2M z^iyB96=Xlvd{-tu`KP{AEBU;Y(9blh+dXTi66^+w@C|c}n;f{6aS1bCnNgxy-JDPZ z?B^8WpXV4gKZP&QtRC`G^Fv1n-fm$`IAGvSk6*$wBTWfjmom97@ahJ?5PxBXVgZw4 zwU)(3C3KNyRnIR(ocelx7fKlSQH1ZyLv1*Z21-|g`~#H94}e_VkTXU4_4e`uJHNoW z)Ge-1RA5O(t%NSotX9Byv4V17amaD<#Nq&YSBwZhjn1oPsb;ku_1I3IGUfB9cu6U&guWZ~*iC0JneZ8FC}U(pf-j`?mufByOqZ3z zQq6y9M{w3%s`=L4M2$EHE5k;-+CuWj`HVG^G0854nRm5JqmARPuw`X~&caE zIA!)o4tOseE!DirULzZs3#FG*%aD;N;A(4^41P=Xg*2Zp(`A~~;}qt{3(+oxJPpTN z^Ld->fR<_goq2t|5C`%+BrraJX?c8L8~!Q?9H#-8D<)ctWzW4#^ZgR1VYxq?FV}qE z0~F!ky@;eQ&NCD1a?Q8OrI;0(6{5)8QV)Yksb=-x_%ZolH9bFkZ;!~3xf zi)2$wN`$Hl_>ov`}R0Q~S}zK(ioe=D3>SSd%igmUC+`YKpYN)X~#C=t%F zN^tc0HsU3s`cY5yqoNw)$|}uMd9j>JuM&R}lj_%xU`Sl0`R+$N${*gq>SvYamhXG4 zH{SOs|56rG<#U#F2X^vJcn6HQO?W?}4H`-vR`S3EgCh`i39!Ro-l0D8pdn$@rU z>GIcm#b+4qx(b|UpF^;-$ubRouKBmkFnF)ltQvYL6tLIcH3!uEZXP8ba?PV{PPe)D~EPK}PGaafFj$A~qHyExPpZGUa+FVWf(^ks?5hbNd7cVqRjqFCb}^%Tg- z#Tw1m$uL(yvf5pnv>f8wf3)Rr8mX0GQ3O<3K8Pq~8oavj522f&C;n(#=+8!^LXv%S z%sa%F_w5qZ&aseLi@3~1qHH~$T}T)3;uBRa!53Og5K4gB_zIx>63bHncTlFHFEy*F z_&rXgxv+f9wYo7zV$gfRsME`uE3@!itE){>?rO(mHU+;QhLL^*ej3lUx`-7Cj9z#) zs+Tnvu_sLyy)4QA#lk{jt`%eaCcf0%KCm}{B}zgn6H+GKI)5uVQmm@$G(RY_;z;Z} z6!2P)qf+ZM-}*QzwNCS$kE2rSH2?B(5jKpdsNW#2!2<4~_NYO7Yl|3Ww^+w4=wGi{orc=e)csOSRvsZL1Tpl0A_3|E z43Y74z2+Y9H;8yrEfh$zK*|)79ozJt(1zPzCgzgw?eU4ZWPG3~5Q-grFYdZWVe2(_3-%Ounf01?^Q=H> zleqhQoSVkEah!Nope%4ntPJ_Bd@s&%c&L^IwmTss1zhy)cCtOUQK{bT7{yVeaR?m0$ED5nORyyspQM8+>3WnSlk-Jgb}O$O*{%3g z)wXHq-0L-WtU9);_t^x@k~)qiM5I4wKgvVjdO@Um!^05QxobZ&)KU%@ve-yX;isVS-r`Q{hIsQN)E2fU%AsrQ6#WWEYN@mvsJMo@k(Mk&Cs2!bU(M(ZinCz$of*P4}_r~`PJ zqWtnMlIaHct4TYbS6{EN(c#zsyCVMIyQl&|i3U;qjb`<5s&ple#5prg{BSr0)*>^GtPkgpVzZ_exdTH zyT5$wPQ9hrc(t=Pt@p|6X`>Hrq_0H+UZh{sHlMtWcKF~9+Le&lMf-j7{$y~h?~2J| zt?^%Wq(_<|m()J+I3d89q>!xEx%Da$!sC@*d=B z!2LAcGK&|ZQJu3X#wM;iowv3AhnwXhax53wqFD{JD9i(`fWd$JJ8n_q=M!yfPNdVSBDZeS_iqh|cokJAi&Y_|d90+hx$}EYxzD4sr5(4Dxmbhl1 zcwBGM{0q6xajpjZiK=wAzOZogy4ANLjUmeCG4!?AmJBt@uZ_V-$zy1n+}z%(`PZ*e z2FT)NEc6To`s1%r1azDs2st9;+kZ`w^QO71KGs=VHD7zXCw?w1-)dIRQJ9~bB&TQJ zYOZ+;GW}L_wdauTTg|_E&ZAV4ya2jQv-+DqZv3qzd0G}0f|!<=Y1!bJkg~9W-KM#& zL@+Ip`A>mx&EF^k0%p$Nu35>mDTihA475I8TRCht&)dy857&PSCdIe1Wjfrh`4{ym zokb{1(GD&5SNX;xq66s76y=*?(RYPiNQM4zS4hheB{BoQ9NsDVW z#>%WQ8?biIn-z*p|_h?r4n#mFgU+PoLvRX= z-HjZC|7srG0^8^u6XgAEb1C z@L?PxBWD)t;dMo~A*T2M)64`rv%4P!2=)Y2Itiw9y9pG%v7< zY_!Zi&4;Zm(ro)Q=h=9!PLvhe!^9x6PxE3L#Hj8*%|-S|_L6;Ve-+BwPk^FM_t+$hI9lV`G zDd|`}db@`l+L(MPVWV}*GHXqbf6D606%usi;cRXt6(Ww>%r4@FMqOL_b8Br#+k(!7Z#F+IGqpc+-Pu%5= z_9OyYMby;$QHaY*xC+#G9Kv1ML=n=<)?q~sHNql;nTkmmXNL)TMKrpHSl zy+hh-MlN=XUBaIeL9bEYdYhuW(M59J=oSS%EyLWczLsLQUC=AW=)eiT>577o<)Yw1 zKS|qQanQ@SZ*a9FIjmV-fgk)~na0D4j%fZ_T}tP=e-+#K5zUv?qzKpitHgmgs#%SJ z;d2ZPgV}f(LdJ!aPmc;6j_<>8#V5)o)|Y~QX{}+IW<3QFPcV&#;Vp-VuOX?UB8ODG z#Ez3Y%yXhMNub19!xaQX$?wPDEEtKg9vOxJosC3Pri7!Kr{E5<$#A$m)=nyYmY3`n z$qD|RQtDeoFRGp43DhtG8J^x634u&cpt=#r^aQFaI;L6O<1f+fS!@Ml4B^GrAP0^Q zvcZJR9PA6`SpG|(LnSaA7@x@j*fGsDeua7BnC2mf1)J`vMm3IUzOIHxnNN!e-fG7* zkLAg726P+_ab6LWU=N@jK)x@jS?{|a!;Lvdx&PPxIHu@?X7w{KIsdE{N}UyVxmLb- zZiuTOL~23jN!W=H^z2E>=O;1X7ttqJlz&1dxDEtvrzqe4Bs$BJ&r+286OLnCE}#?W zGD>9brU>8tBvxck7U0yuFw=y2_mgs*_zBjbqF6fYNzE@0guh+^at!k)l!sG^JnJ(F zg!mZ(?;zBf=4LNbI=}o5rE@##i208@in12`2~L^Q%QJcTWt=U(+zTDQmlQ8cn16nk zvdY8G=Hcw!X?1wu&QIV;j;{(@oVw@!V zmJeKh=^vD#D97crS5T!Km+Q1Z${d#iPh$(1%zFAYP};k!Qv4rI3eIGr*ahUete)}6 z3RvA|Al<=D9w^qyk4r`eFm9m;-?EOxz}nGe^_xWcjxN`{2_xQ3Sa`KiAY4}yomk{h z#7-`&T8RX}s-vYlS0LxP<*s3T`@-_eI_*^?vOJ+wS3)sn=3Xwp-4^3f zTRLLdu}N(d^-k(g{LJif&Ap|=r}MqD%@En!eIKv=kFp}N&AB#pTCQ#LO++)gMP&yED%9yA24KahvRUX61)y&avk8+&&K;#Xu;{8 zUA7^9NW!8BKQP_o3H(0Fo9gmSTV$h8XK&!a%eIsjLh0|ZKap|rQV$ckr>%k2@o zC0(e!tW_4_&a2A<5D~PAP;q!4m0ZN>f3TbE?FmeL75^@S(U7F>!L@EPR&y*5ZX4`5 zcE|!@h|9PAn!;>e>%q;{u=0tDhPte7^ecK}BEA5~GA9hH(CemKW?10q)@EswW^tD{ zTZcTdg1A{L4Rd)0VhB91XgK;Ksyf2uYSK|luzXO!>&W$Acz@UDk+`-M7IKSh{LHcm zjD|w_YmOL{3f#n-+b6KLIYC3DZ9(r#6y?5jGH7Ay0mWOsfRd&_d8hzZh5|YvvFT5c z+;)#yrE>UI;PRNjd_?Bm75KoRbpF7Zfj{3l-51x{dME0+6EzD9PLtil(%;@XR z1LU5V9^>n4%Q-ANPn^Vc=boG>Ur!#upq7`fkM09~lG^B-&uf^%ybhnsP^R*9qYvw; z5?;<)41;l(m-8A1Rbm0i7xr0F)pgD~hcb++3`HYdR@Xo$fSZ%7jW^$cb%lInk-FoL zkQ(K(s!3t4St2VKptn$zrQ5p-_-k)gFp&xE?#FZ@Ou{IaA9@)%kH(}7odAYYYQiBD z0egqjNV-g1nP5r5j3#}EN79&c(#O#FbJE9CPUu{EazdR#6>?Nkj7idc8^!T4coG#+ zDt3ynh{k>uce#jiLKP{{gC1{^h>{|_&=nRiZspltRUdlV1Qtq@g@*I1PO-*=?ozEV#ll_AY)4*t#hv3m9+-!FF1O5P}mk)RXdnxl7NjM)A zqjrluTI_}*K2B_mqg_6v4{2)5hjf1l5kA`G3Gg6o!oA%7u9xy_FmdM{;{C;tG1}#E zfk^>7*1Zi+3M@0gvcPc1%l>m->v*ZV1co{od`G*yDsW0{kfU9m=1g2Si<0h*qMUK)ud^LSbRbx1ki>-ve)H;NL`}W+# z)4mfmIwWG{oRzS^DhO02N@)vVoep!MjpCNJ7TSMa=drGA>$v41GBFm%x_oT}H{f8A zi@O|Y6~e6VVXelKMB(BFr&l1R3v&iGlQeLK?#&-KIQ5j4WMegItTlNF6~ zSvA1NHRB*R_){?71Y?f7{HI(>V&zg#871POh$Pd8aJl=03ETDpD5Hnu-)9>7Jnsex@t@ZVeuVO$OUa7;l1pigyzT&U zbBx*(T~?m+4mu{Budkh8rHIioB5Mp@WGzR8J)f^6&0skZL+W7`GMwmg47Qc9u$#Yu z>P>Q4HLO^Nf8tucDYV(&?r!`iUWU`BK+`nmhBYq z+MX{A*RJhgCW^aU`w0yQ>#ZlYvkMr*po07>1+pob>cW7QDWu9ObFEy9GB_8PlrltO z6-}4VG!>3Gvn*6%s>`L=gk*84HCv7^r@FjLlJG8Xc{J7K$yQrA9To92Vq}?$0#XKw zCT9gjuEfvhI$4y@SH-UiO zNm0J@q?Xp24mbM#7yzb8I_c! z)-c-xD`&KucH;)jZtnzmy33ORW=Xo002>QfYMu5~tg+W%7+qr*$!cr5%Y$$^G(+Ty z>|8l%n~ss~?6MUx5^)jtlx5O%mrvVU7myZXIV{AVj*y!LFI^E?GfTnfI z0ODe{|IM;wQ#;dTbt^t9fa@VU)8$)hgEGso_*T57tOTtCfmts9ra@|Y(kLR#t8YZ6 zvt3qE3Ul-jo=7{SXNY?esNo6=e-1alwBkks#*pTR^f{=|QX#Q|!f0~}BY{+7w#(gU zkNkFKyWISBVFd$O{?+Kk`JCbNteESnDLa#R!+;~+7e_c$jU^hQ46w3AimY?oJo z)kvha&~WjxnCV6!+J;ged(s`S`K)U5@my2)=+eFH?#O@=W2(w-8!Yjn* zz+@dYS+_7*M@6_7A7*s>*)EUcV}82sf$jln%-sVEWV!=0Fb=(H93B)(mz4YY(}33+ z-2>fafAH@$`W%;44GMFOx8zuFj?1-bc^<~K$}cEAWk?GAYBf;$k6gxU|6v8_jlW@% z{mA7BG(|@8x&9QrUnYpTE??T1(z)?|5+|LxF4y`UWpEF?%pB&=X(u6^-A;r)&QM@~ z0MGicfbaYRz{jo^4DDmr3x+n&Wt9lTn|ixnLXfYf2tWP=W$_bDF~ES-M=p-cbNO~e z=2w8Kb|XsXZZuemJkRA@#!2s;=W^i6)$9UmaXGTs zT4Om#7f1Yx?d6Q^*6wm-x3xPVwc9#X&NyX_@Vvuir#-@+X=`XhJ~QpP<;YxnyY1zp zP;{@NGK0^wQ0enma}pj8Nas`10AWeK&pKs^DcwoJcPE17bk2?+vJ^8+*yM|3U{-{iTh?Fn7E5wzV!|~1k87Az!AX)8fP8|9*3*G z5h>|Sci@-xFP7>jwSGz42>b0~mk&u(jBevK#ppJsDNODi?LN{fpSY}UK+gw|gZ+FC zZ8M9UPh7qMrl`NQ#*NI@bBsU#CoT`C8K~3@0;z=pDIcV$M|xaH_aIc%Jrbtx6PKI4 z=4CR&S|VR{iB%xIw!oe&y>>o~$&dlilA_$QAYj4dHQ(hMe?ei!tJ)~YLON_pGT-HU zpQ8vrC;pOnExjS*K@ik%zRUSEo;-af5c+c-V<(+N@lT4L77DUISZ!^1kG8eTX<+@VTmMFug zE*Bt`QC7Du0>eq+KE)A}XLyE!7NWM$`czu%Q)`H{*bsE+u%gdgRyTXVYuPfUeCBdC z9#hKTjyRyr5TPU9OOKzq$SZ^Ec9xOoGnem`tg}$2&s=^qf_12<=p^(+?4L}MqY`_i)a(UOp$5q0-NY4VM%Qa;zy|+9F7E0kRA&~nF&Qg z8*VRYG&V$G9vgz5?xx6v@itv(ZrPTy4 ztv2;40HQn3o*?Uz1uh=|n8_2kuV-F^?x*~Np{Jhp-wH$CJ}f$v1cy0q`I_~Sj=I3* zDLjL{h29Ka%(B$O(;d8+S8+&YHiNI?zJVlMa@oim{lpu25BufX!#}b=n@fQy%;zu5 zPZaeh*fG69d!{QMarvIh{VS8OAMUw)Nwp+giaZPQjm*A%vdHg)y-^;IHS!5uzG&^Qw6~k)3>H>6N%9)i~~YvSpCXZjFg+fy+HF|KxHz zR@|CDxqQdv6yY70pD_4|%ZFZpp<;o{Yp&dXr92h8|H{tQD9oL!jjAU2sA}USIMYuz z=?%cv4=NQz_%o zdTk=n1z44ecg0%2*Hz+FLX!n6Y5(xb$ya(ksWPiF?u#yQ*}Q1G%mR!tiD0m8Y6%*<8n6ZZ<+p&W1jMj>5rM z5GC4vMVZ{Pt?VwK{8yN&OI=n2Wtst09UrmO`PQ%}dh@N6!M9>& z=Wg`1>;g+&-UQb<1ZWw9J5OV*ad=96oV7x}yU$POGRlLEB+ri7)QDsDfB>eLQkQSN zm7;uWp$yceu5qr5aG7|CDNuS_V`LXy>he-PBB2LLU0%bd{2WRHX95^jN?raYkSFnr zS9tO0MXjB0>KtCdG<0+bG*|DB&cp{b?O?ZX%fh~APyQ=^qTxR!W!jaw> zISgFo@@)P@z|YNLj1r(`)u?on%s6MnIV^h|gXA^`jnT z3Vnp_r%}*Q(Q0#6ZGb1xK&xG@`ITI=R~B=q3&}Qd=t!!Qm9QwetNQx)VK}5q)jfvubZ!^VZ~nN8sgcqm8{sy3anp0LlJ%k zcniTZ#g}oD%Xf=#dcDbxBNAY&!fY1k|JA>i_mpy@k?RLw7 zo9m&4zjwVy3JTYNgk(E&3oIaK8|yK1zpWYVbrgjbtk|0 z0HpYxeF^}fRM0?5LMLA*9<^3_xCje5X}R83IL(x2U%SO zJqCy>8Yr2DeITl6kgpklXddj#7$B->h%W;`WQO{h4G>i{%$ETmGQ)ie0HKWVDFB30 z5cFPWH$YU;$RNh;sG?E6FaQxA?Na~sX@M1C`Cc<+3uns-_eZHx!K#8 zGh22rb7oPH>->%~x!K!DJ}oGBnfcXHIj5c$4w4xsUK z=Qs_r%dtWBa1TQ;?BVukFRB`_(e{KSY=T|N;_CyRLKav50u{J$UPuF5xi~-n9~13o z_mflIX+hpiZDlPsEy(S0W$gtiDlUE}HI~SS&&8=Ecww}kJ=%86Zto`>>tB)WhSvaI zP&7U0y>vcJ))>=+T+^(hrdjftrw2Lm-|&Qp#$EpJmgehVkI-_Ol|V$zb#lezY<(A* z{36BH;(*qadmloazMyD^{3vja=MM-U1^G%@9+@{$p2zZPZjjY=c;jg@VUaX9$aU_g z2)Cmy==|J;dduJ5h;tNC;Ab_a2*2`{6>G+Cy^H_fZ3E7{puByg1b7rb*ksC;4bfre z1wEiR$m%f)b9d^4y-FV%iV1HP{5JFX2m41k3V_gmQIus_4oA|XI4t?ZIxeRG$E_a_ zmcU3yl}KaJKF(Suw)mh~3u{7JAJxco{q_WYm(U*uY~DW7Zq3SHEYqFk#sl-B+gKB%Gnq}ZoHFCy># zl+XA72HHTXNl~tOKeXL1?lhpuTK|4rmAqf>NPSkJAP*p^Ateg(018rawwNKECHBC> z(6OLGiJtUHNhNv=YK>TglS{NP$V#3Ro`#>rG}-+tp*~4besUU?r92JSHlsqm<6#Q( z!yva1yghZp52+i0^s=HwGGm7oE%t#WLGKlV?+`)xJKiTD6F?Pv&v%R_`;HHZtq5ef zE4Ce>QFuF?sUr&HW`ChDccCH3Z3to0m&KE4CeT$h7DrHH<PUAw@qawUQ*lEHpAX&hVr-^8g67h%QWwZj=YCMt==E2qo%p^PlvE;(# zsiG!T)TD}j21)V|9>g$QFK$-@^;q9BxG-yzuh0NdL1M|ofWGo(PP>PtOMnZm5jufGc$GMK-> zI1E6dLwzW-@rTq?PK3V-@-0m$gPXjLdHD5rJ<%tcK;hSZi3|``^o>t3KvYp#(DS%` z5I;a**He_Qe^AaVH=9XO3D8^Y%^<}k>&-!KF-Xp$L3<3<+Z^PpZ^tiubC4f=)&ml( z=LQj_%gs@&t%uY1Vl&?yJU`>7lP>V?rECuJD%jW}inat`*#&& zwxUb=BhIaN`9lidwZrmZB|>r!bBAT&_q{d9IrJHR%Affz16zaK9G)DCz74W^1ley3 zdaj*+7qbCSY1+R_({2m$^>xq=V7E}TJ;+(g^7(mr_Ged+)mtbofWM(5?F#afjnKBB_$=qr^HLJ5 zO2FL6ldLoalGpugQvq`D^-C9C!8vFTnZEIwSpMPcQ*~A7mwm&j7AQ zKL8+ib-xett@ogd7$Bl(FNPEU$M)Foz3Kh;uOz1TSKjb{bo|D93Glrk781dWZHP78 z3Yv5H7KlY;ZE(s_$smskWed7D$V&<5Lx>!>H^?P;u|F&#CDwW|cKv{%51PfMzOMqd zzXEok0(P(h_9NDMo)*5Po~e|gL;f6+01gLPEtW+A8vY{l;dcTdn zwH87vDNKwYgKu;!$c1ohjL6|E@3w{pLgGv;ZWWT`EFJTyhb(%I1v&hpm-hvg91n8p zOY{Q2bcn@M@DPH4y`Vs!hk)i80+tfk@Pt1ep8yH!*Z&hxnN{@$1YEamJgdX4?>_-cDh@{WY1L+J^WVnc`lP?9N6XYXUv( zLo$vi$_4iBCf+|hhQDTZ&q!v4~BC6E@dFYQgX7A)@aV4lg4^b*eG-hpy8y#vz% zsd3{f6&nrbplN}xDp9@)oC;KFQbFicpvWm#QsnG$kVBR!+8*bKQ#FS0qp?NsBf`Z< zKH~J%XA%4AF*+&X7`;-vi7KtsYqb_E?(#l;Oa~hah6*0jCpFxaOib02y0e>zD%RN@ z;QCD{O}dSCT0VhyS~F~H#WE#U8_%%k+1`cALKJl-T40{N;B4XodoZ6RIha>+lD3sx z5HQ<0oSYN{rUerDqQM~fqRF?&DG}5wMu~F(&FNtWoFk6x1fiv`Uao`2?+fU1y;h%9 zjJ0~-*~ESNOmf0Ax~+?ISaFNwwr*$FzYQ;qbjsRf)APK^9?atDHJHm7hy9&Ge1|xq zb`HU|9#$R@Rg~vb3~)|L7hlEzQAJ&SiUFdEx`o8wm~SYN6;-zokM-XcUqe>xPrQbD zTKL=38i`AWBdrpkl5jLe{-~nvAu-t~iuvjd5cMe$MLm2O14IqwXJEyBmI0zl0Acm? zSq6wI0ff~nB%2de4)peOHvmp*gc4EIC*+xd`imX2e~7QDfu&82UD}F;6$r1jp$ND6 z7(r_V@5T!efnXs|4%o56Hat17O#(so4{;$_k)M(p!iC~p(?7(;fiJ|Rrhn){YWK)} zBF=G29M}aF4G76mwgDbSg+P%_%775xATL=D2yv!NZ}}lsO(@LcLW@Hb<)JAfQ;-7W zePXTw^a6?vK;AF`kQ>5{w$N80JTUTA=wOI46c{x=5pUA`5Wl)D^3U-CMR;fG&Q!|cov8&?ysuOz;+=*Hex68aEKftdpCx5^}D zL4L>s%?D{B%pr*C*I2-K;FRNKoCKBxP6j;L3pSak@Fcpp2qeJ0-1TVU_3k(L^Nsth zOHKG&_b9NV?g?r46BXM%7VH_6pIy&jKLeOAA=+2zTnYM+AF9;c!aaXa7#NZ$gkc_o zU@`d|v--)RVPJ@d(i9jVrjQqG=mMe$WC#^gWTot-;2+OY>C44nL-ey69P;j64VHmu zaENQ%OkuvS9{OB8&)rR^fjA~JzOSAWmm?#tR}MAD%qHGt&EIjc+Y$JkY+1bsjOcKF z!feVZXXH>$f&sUogr-h3*k>qH0#{0a1IPR7A$(o4L_sQG%_W$f&uspVaai#2ce1Gh z9|cQJj>1(CKmn5lP{;}bC}@&^SJ?m8h_HkEt^RK{V!h_L*7*($PwyaRlcFIqeD!+(ZE#7=YgqTr9yIOh-!97r>+y$O(y$xdbgiD60?`20GyiM<)lY;?|PoXMtk@O6OxDKHAV$2C@;~ zCtKuZ8d^3T#A)C``hxA)%GUe^?`1qWlrlX<@aZY>Q~~0t15;723smQP)jXE`C|Msd zLtt^-$Lixn(BeMU1bOuq5iurMU$D9LiXbIYnW>=@Av?CHHJ=C-r{LY;l)Wi}?@c)) zt|vo7Ti+HLLl56AGt!l*>a8| zdWKmga;tuLDCu$8dLv1OHVk(>k|rcV+~e}8Z&^W#2N22*!N$^fBo&DP1?2lFlkW$) zI*+71ggJ3|i0he`(GWsR(TEVM7M{7rU@uXGU&@tGh`AIKT_ZwVzXh5o8F&^lMng?` zPH04kAE=K>bVP{ntnZ1ROI<;TFa0_ABSU;;UF_LMg}nCy`pAkL=&y02+Q(Qp4IW{^ z)0Dv-Z}al&K9(y{4Qk*R%ZO%yY9R{ms1X0!I{}V?%t3y9B%*!CeA90-;zjcB(5; zfF6NjCkdCNdz}-GFMq<>rnPKp@iE4Rc$vG*Mc@RtZ4h64Y>2ait0au{*bwgz?Mt;| zJ56zNQj29Y9UJ1UX*<%;k;aC2%B4###U0hLAudVXnu;!bagAS+x;xeTau@Nb`r3o+ zi`TscANB>Q{6**uBd#O)(7bGsO!N0D$SFR3?4e=6uKhr)*pK|l1IhTPtF2w2$UfYWTDhL!Ou8q!6pRU`+~ntiq7z zlvo(ztF8$c8^|?xI%dpJG}-4*@ps!(L%3`cBp~}<{Uw%FEuS75Mx8T!4tZHK{ zm@XRf70n2-dLRLa79q(QnFm$(#3Vk=M}Eq=KJb|jl!RE_4qXC>t|h)*(*RNB0dPMM zR;EwM@BzHDEv!b0mWCv#pASS8Eeo-_2YCn}d3aEoqUBP6FyH<>B!Ec>z~@D5g+EXN zs6{x153!OHXaHHDtPF|w6W4zg3V{8FqWqgzMZu~Nt4s000EmC;=a~0E0q_VEtoB>l z08vG2q;#tC0uqfC1tEgP-Gh2dbuqfARDa?0Nen|M!!-3q*9wg-t#e|WanehDBm;+UMq^e3b7LV3IKU@ z{p%1biNy~E^ha_fGSP9fl zjNp4itOjGnKA1Mi$^ry=H+leVGHZ)$S(zVzX40>j#eKlB$yoQ zaUbhDPR6G@JDp^Fr}Mc^#y{5sQj>7WEM^zr@-cR`lleOzJj|T~I9&o6g$$Y%2Lj`C z4~$GkM+VwD-qyUWGYpnuIV0d<&UBwXCD3k+7iUBDrq-ELz+>b{6fJ+aYM;0+y%k5bSvt zt!Hpbuu>_e1P7#6%2p~h%jxP;26uHw2JP6<);uyeB}f^(CbT9+@HHs|QZe?nRlLrb zqG1PYt9Xts(*Zd|;W8a}^^0+FTIRUB(KU;Ee1MH^b}+%p4vq}MkO2m?d$1JZ{5|u3 zuSmSMhDlDT|wf z9OilOEXYzIe+e)m;EgwFnZM&M-*l%dAY#ki*&L@^8K$c=Z=Pfx;pV+6nooMs2&!nJ z89^Ua6#0neC0kf{9&Mo{{afe&VNWZ$NvTv*vjIbu@PSagdGx)vE#vR$fP{U-Z~6eO z_qNB9GTWLaw^2JNR=6QH(<+pZWx)SCDXQpy|2YL(F~Fd{fBt94N8>L4Gsj9sbF2wg z1?dUaoQi}wR!K!diB+hRR4C;CjWyP$EFNo@zuMQ#*kkquVGsK~E9^#bXPl>bM zv2o(D-q|eC%sMFkuQrs2TYJzrmBVY25U>!ieI>!`T?Un!mc`klERdhv=^plDfAH2LlqpK>5CV2bbp{xl$; z=OR;fQr^)f0P$h!tk{IvE0DYBK%b*1KUd($g0r*YE{MGp;TZ%H&TJKLrC~Tk+lru% zjreoiE6C!Lc2~w6%HE$Za5(k_Zv}BH{xssPJXfL(c2?XoFgHMrcy3^2z=}PtK&tVA zPLCV+gcsg{As>ijZ-!?aS)&vo*v#TCZlFlI`|48$KlK96+FodB#Tp9nkaYqBGj6H0 zw+n4^gIH0XV$~jtxb}1`h<*e@M;KQ-(p)hj&86)?Pgx(@)RaH8yV(@warXBPMY$VZ zzyTqk*Ug92;?E+Nf5k)vpRHX4-LR2m#jAq!oK_W(!!7-7zmgf?}NE(S)BIFmi z<o=<4tL_Nh+x|&?sC^ae!$d*X9bEqs%W|?2D4R+js>mQi$YoI9D*(Rkkdh1 zv8LQXchOkIC))7pkK0qVLxSXeW14wS=wGv7lj>e*Z}t>O|ADm=)bJV<7teQ>JJQ9 z$cyyd_fa}ORfM)GB0O~1jMpMcg;Dz0Q?MjHeZ)^&45&tN^S+KW}-z3{;S9v=~ibSjMN_&It%Wbf~vAt)FXYgz;7n;pK z1{0Xc{DGjcCSmw^;8Cp6#9N3T-9`QjXkJd$(X->o=^H!2nkO1PmeIJ29P`G2m+tPk zd6EEC^Epc;na7c2&#u8wVh!O{_pqeIc|Fol6VB$Pm^LJtOds79?}al!7N2%<;ggW7 zC%IPaX;JmSE^%P*u6Tk~h?r(^IB{{IRb;`D$Y4d*3M=?x9L`@&5pdi(lEnPPUTG&W zx7p)42_4T%xm;1NKv5uxSrph7C}+-bCh8>SME#8}XRdG$x(Q55e!$K~1Yyp`oR`51 z7?sN6N$x=jei~C=Eai>jZw&My|C>Mbw8rlr{}TjAgW{99c!3Enlj$HNYxYJOC|=^pa(fwaeqB#SuXH`y}jpYh!tzRj9#V z2a@*YLc!G&2o`34rwFI#rdhBU1AmG#`KjDAJGQR1NH$A~+SIIkfNT~QXG3r3jN85K za$aw{pY0EyJi{&#M?z1sgctE8*e;28u`xX@;-zQNmU4-%ELWnJ>ZI{{sa~PWGhLxq z=|rYS^zkItah>fZLQnN|2e?M@Q5-fQv>XpOCv9Xf6$OpPy<(0GmIN!OED0_;i?%5E zO=@MiZ&D{zsiud1j{DC$>rX4T44 zGppvNm47$sRo_{IY|7w4_6*yOm6)D}FJs3RwB`YDY0894Q>x(Kq?X8$Q%~i|dnRpplm#yNyZENZQYib!fx;tBkvZ z8c9Rg;G+R>oZ)4f(ll;-exHw{zibEwo65ulbVKlHFzB)4E*}l{4^NlxpX+gCsNUf?ev#NPP8Cl_Mw5O8(EtbOp zZayrD`O<1f(Q3=8VEpW7;y;`oclk`9t>X`l+}4@wfNI>P zCp(Ls6fx)`++*D3#m*1qY(>2ls|~V>?xR>eLScTSy_oHRHb`1GHfUJE*wrwSWXR&k zTglj4xpKmY88z;5F15GtBTd7KOc}lYI-r3!`D5<&Cx5_iPw`*(A%Swgog8v4UNHlnx!u)nGV|(hSSl#Vs zbN2!&KaUVj&}4&+@7)Wi(s@Kb#dk}9d_0NKLIHo}4HLnN-*`vEc?t%ycm8Qi(OCEV zbAjh{BCqfDuaNorq|Akroca37nfF(Gw?q+JZ#HWK&Z|o}7t}SNlCFI0E0RYqAz*Wv zuei?Z$((_TRZ|Lc)A3>y0@^I8FEx8970m#90Y-3ssYOM+#Z>R9+7@vmFqM`_mon|n zu)CuX&DQR7TAQ@dTT2_T(KD>J+=Mn!rxVU2r=6}z zW?Js5Cnlp4^%Cv>3YO^Q+OO(hCGk3x0CE@&N-b=`hbZsxR4&^9Yk>6|fSW!3RShVe z8@zAD-cmGFvHA_n1pq|S01?A#fZjC>eHbzT>SNhv0C;i9x-p_?c)9(kJ9ehs5$8N? z=mW|5L)`si+~t9^DQQc(iB6IJgZIYQDe7)}ql_f>k{Au1A!-v@vFf~uz9;03EIsp5 zcN=c)lBX%l8w2qY<3M4&s%V5?0|0gW!4GkH%*NM9)InuOD6TJ;a4#e}01jt(_7c@U zm%0MQ>JK?f#lJDL||^9LW;S8;);agKuJYHNnnhVtYVB)C7lwbZ774=>~!U~I#O|a`WmLl&el*%{2Yc_)5V9Gr|WqV z9eJeU3HAhk7M);kOw6Ji?cKKVl9pL?x7|5;7VXR<60_(C9+j9yM=4g%P?(=t9zs0@ z^#|W)mWPZ@Nmi-CqD)Z5njkoWuVb+%qBY_&h$yh0dB)7E{LG<*xA7s$_7)cWp}kye z2xv534qKnuKs6KV=J8+>`eCR;$eXW4b0N(jF9tl%pfU=iV`LPTI)Bk$ABX$+BGsxN z;VgQT;+}BBZd8d_&b~lS7hsi%eV@zlGEchbR%bQa#Wmw-#R~Td2HGXE`T|~`qWsqa z91|7TlR|dv+g1wnHbXG5W7{-@rV=`sIM4D_0AxU$znX!Cqe0MGI_@E5)Ws^7>te-V zrZsXgtEe0)vPzQVO030JNcNsabg{MBPR2LelR|zLQZVG{J%U-RH)zQb7gl+L{#tt} z1^-%i2qxnlf<-}S5@u0wLjn=CD59r!E^oyG*xUi$%AEt)!WgV`ARh2^$_?RopxDn7 z`2VD)35rz*ggWYAtqxH>uMTa-)wXsii{#URy(w{uu!+i&mTYA-y!=RjhX=n3`ai(0 zf@MMPFr{l~LdXMmhQ5c7R3z^5;m`>WRFXy9qD+ok!-H7U4G(UWQ?dz)`?&=!mUj~r z7vh24KZYZ?pH8uOTNW z-V)do@YJ@|dD;U{agI+NY>%`(>SSl8IPOhQ{INaX_Uba8~_VUHfcD+m1 zLGlCVT{_3b2%H|rv7Si(FEnXitFJ$1^|d}r?2$gRmZJYjgp2>3Z#&x^D3|%9;;Y;f zE(Wd%inqCkTv*2N5zDDb;QvA+jSe0RTCw_4v?;-jvd){JctP-sAV%5=Dw&!j@V`*B zqruf7F)vM2tlDC3ZA-bo!BhuAPVxpkhdNMIV>T9FKMWDvfx4Vc>_WM}sVu2PVGkU< z_n_S0$b^n8dJtuKlv_k*^yQ;3_vXgYmruFeo7#BF8 z`G{y(UuRPtJ9hMa-c;vX1AJR&b6tw?=DO`46h`|8`#y*T`9#GzLhH~*Qg*4iuBIK^ z_dc(yxwj^z^WK^(Zv!sOQ8!P*%}E#)Cf&U6W(-1r_uYK*=1>ebugukrlQ;LjB^mF3 z%iLQ$Sy9vBszF!bkP*A`L084D4#oQ7-ieIk^Y2-FPcpvvp1e9qxTOE?s_g1+;`(HE z^_=Pw<^ekJALmr>S-naaK^+pLf_vuQ6HJ#F4j2{Z-?RFjs$v?HmtbP@bj<2|y54&h zvFp8gb*dVJcS4&KqW8Tc?zLk(-{%qKz`A=W!t3rWxlb4+_bt88YvK=TudQvz%HHR- zwZE@TVg9~$!9Bo5)3)16Z?|LX-sjTW_uo#9c>nFY?*cB&9@K-pzR-g{PArr@rV>n= zGP+DuJTf>k=s5|F43-7`9#a3$EFjkllIB?rW0rn0EcN>phLr zuHSRLuW`@yC$INr`C@21dHu*5$@s_`ixR;P7u8tmy#*lc@ITb$O>Y^}n#=AjxsM|J z&3$=wa9dN+B*kjGRc=M(?IsqAcU-m;?+;>XmC%V0u8G~*BrHw)5^kAbuih7{TnT?6 z3OCReIbENmc%t=@c!f<;{CqcK9G#@N`TH>XPg4Ak4un}EnUvu5JbwoN9_v$Ut(2uu zvAV+lHdpvv;Gsv%hvY{d^FHAd&l*4>MU5I1;Tq}qK@}>Fyoi-EfH!=~OISwyd#V#! zU!o{?pziRv>P~aT-i16~q;&316QoTGm6U>!F?WV+gu7D-4wxm_WV)2rPd(ZA1@R+) zqI~|-3`7>4L0APUVb!51KmG!4RJzT`RyKZzjCtTwySANU_SIFlV)*d~TIf6GadjW(Oz-Vz4xas)W34sb^=pG0gK+HSjloVK0XiAuRo~Pd zc(Q6wYDpCe^O7q0mr#WBFIjYnoEI*-WN1~2aB0;YRVmDSs;D1 zDU~9;Cv|oe$>xiy=;@{wc5Gj3ZilxC(|HFCVZn!RPk0#jbnwXDzScb0oeICesqSf) zqI}xzoMOj@wBgPv15+rZeMHu@`junDawOxEVxl}EEHILMLv?n#J`mpM_y~)F>pQug| zK2d$~b%HOxZuxZ-;d$4WTn}7IFsJ%w)dS`f@U!Z9SG%%Q!yuV=_2TP-g30Mi$@L}I zm!pz&hw-Y%Ciz2aj%DlyJjdE(IXFv$ z!y5eg@`g?~dW9Wz!{;|pmZ6x!o?8nKz2VCnD9T^n(CtPHfknzwChA9~jZX{6zK&<4 ztxpR)k2z5|>(kEQmv=F}ZGBq1ODW3j$~)bE&{^_-w)i^PHxwye_p^0BGjkQM`&r(# z{@j*#ZT__(W46LEH0NLYX$Ab#Yquq2w_UsQS~CGEnug>;=rxIj;r@YXXGcgBsLD9^X{ zN)*zWiu(mN2B-;d44|G3Ma_QLroxHl653(@I6zVUSekH0e9kI+ly zng5xJ%j^P1E6q}@Y9{rzn)Bs6RMwO{pS~zR4_$BVviu`OCF#b=NC6FXP!Iz&5?<{E z_?A2AEBS@YQhcuoaWG49^aW4&AG5@yK1*>2D=zUzW+|RztrT!}<#H`8FP9STQdxUL zPI5OuBjMGaBMXk%itn96*c;7OocRW_ovpZ~vEfx>*6{KvG%+8+OjDMU?qiZJSna%##m>{;+^pJjgp>?6C7(UCt={LF5m z7o|{gREx6Ei>3_!da zKsq#1K0;aC08f&0HjRS^#5j2$oTpK7Lgr2MRtOgp`Uap532Q%cFy`)regiy$j|JI8 zsv1#rK#FHhYm@~Qa=B-o;*8fQonPyZr3Cl);xNrqJc>$iEXXCa zNB-`iuPv0f7#EV03X?LeyvHcR#rhXw)1(u4P@@EsQ>sxWS9_N-_}%_^=dQo>8sXP? zi_-b6a%#FzBQ3m~v#G!IqGH9}05(zdN#zmlmBiOD%vVqxNWFpv`9yJ*s+7)`OLU}9 z6kmQTrSq+?Ag50h*Z)0o`b2T~_fS4xv3d_90f07GoM$U9KBxikyrAN5co3$tPOTJ1w#h2j@(F5-a zJ4f*~61lmhptt}oVXqAkl^f5hD~7wSw6wZ~*dn<~C{gZ8Z5bzCZ5f;8m92RQmohfE z-1#ya_|&WBUM0ZXtB|&OLR-YsRzoP^rPYmNe6Hf=fQPgZ`ac09zILwSJX%^EOTAph zh4eAjYai1$DAqUB*}__(Gp=Q4@H7iK)tB@YC4^Msl*xI1uHqj8C5Wk6;ta&@yfqK3 zI;|=_?@9HPQ?*>hp9K~g-&h>CFAOY4DC99EvTAc6;z#8HIYiP{w%P(Jim2;9|8$kloztHNfV{wS}yUR;g9C261J!+ zaZbazNs7UzoevNyIV|_@`2*b(p^^=&r!JH8K7*C%xxqv)=i-!-lyYogm1R{DnB=jE zH?bLHc@wt__~xZ{ft~@6Jge%$svbBXZBm*!z=jEGQd;NBg2o~(ZZf%whv*`C-8)zD z=HT|A*}3ud;F+K+2N^iqI1_9e3JE5AKyDlQI3)>}QmqND4;rH$uMg&g%&{~MRdPZd zLLoU}iuG+1ce#Tk9*rvtg7>>}@|DT_$yZLTfKR=$U9}{>WVS73SBh8CT`3=?x)Pfk zCH*k9eQHRsSO;X*KDDGu5-y3?rF@m*mGrBWj;SWDHcHwtH7_+38-kJ{FgE8&;&S}s zYF|`K=6_LbT?KqywJ}#E@g=iO+!HHqd&!2F_e1 z-)?YET)45UB|wSU~!)mbBmNz&+FWF)@y9vAW`FMqv&g|v(Z8) zx5ZXT^^7d5@wFQG$MG=WzsgR3RZ7%wAWP6~w;7&uTZ*AzlX!834A2$7#Yzc-^f)vJ zX4Fp@B6{K}T{`{oPX-t)hnibY8Y)Yi%g_>8WrQz1BhZq+;KW>zeT)(YO`&Si5}KYk z^P!~a{8lJf*mPMUy^yHk%798FNRuNR5+L0z&*O-DUKSGU5esP?`)oiaKdHL^D3hO9 zlN@2((B%la>_N!QV}YyLH)f8YmJebZ=MWDQ?2nDEuVgDj1aFe5bWe4D*fkM*lrCMbki-U#Bf3FQcz?p@Nd7thI6=} zl;0o4-Yz3KGAytMc0(c1@_qR*ww}CVC;JRxfPz)Utd*HZRBw#Bi;01%+JW zu@j!`p5^8Xl3DI^3~+W;vXUKR=L!v`Ql&!l5gon2y^JMEoK48yn}l4&&X%RvHQw#l zYAC!F81J6rwzo5L+zX)1%eTe3f?jyREZHwCbSC>kxfEX!=KT=Qa42uHVMwl^qt+=) z2Dp+7-0!>5p=jK{rjLHKPeT86OMf)`YWF$r(~-hhaEuf*PL8uRE5^wK4$C+o4@+&L z15MMzvRFk!#j4EF?ANwy7^1iZ4{PO)<-L(s6hww zH$FST+^v-iP^&B{3n@!xR|&^$^9VQFF(M;u58`* zcUGO6BHv>H@_QW9lVe)7GMnmF9qd`!;R$U4LX~o@k$livc|>}!zs8RHh&(CzRw0bT z%t`ry<%BrTpHb?^X6 zUV(2vwxScAWh!-kMTNce$|An7A1!E++<*btAp5cNA13VB1044fxh#^4?AeaA_6*!0 zcS)m34Igm3WIq)R3fR@@eMW(xX1vdE02tEo`Ls}wxJw48!{f4$9-qf+3~=|xNJs9y zFKUi<-!r`JV4hPbC@sy*j?f=(cCvDSQ$X2wk+Kf1>nfI?Dico`*Th z`TuBbV9ytn0SZpU$1)MB;Q^tscGZIuW7Kvh%BhZsZ>pRDrptVJtf1f@WGW{O2F;fq z{1ZNZFy%kJYEYwOA<}S9jTLlX(CLYb*96vRY%vDl2D?f(+^joT{0RD<-=Zbs1>JLx zCZ>CSYtjogV#CYHk1fMn3(M3;%xYlT_H@h;KfO#vuhf>oc2H|Dp+zfH6(WOLi=|41 ztmqUd60ii&-dLWV?erJ?j7Iwp^m^~!N$RLm`0My}h9d617hwUH7xWVACz3J`t&)YS7{y*%R z!RD!p3{aQ3SOe!;@9-K3?6WrUv(GvDNA%p>sLK?ZYn9t7>r`$n!4eOazr-q!y7^%P zE78NP9s5v^u~FCZG*(SCA)IF>suJ_8Jwhc4C3TPRriA8V*I=^H**A@_%9A!7YAXZO z_Rq4A{`?oTd5WMLA9Ow&7%bH#sEwK`NHmuLYJR&cq}v}sHWxv`?&L``AZ#=7ByOT} zNZz&`TrbJhLNU>X>Y&3#xw&_VzP`d9Q1Rpa!<4 zbOT2x^zvKuaZzwQo9E6H#>jsQ;k=1p2boG8wvY;Y1&7%Oz!QAq`~=>$fM9o~pnIQS zR)v~9@q{k|7FPrb*%LuO3n6tVn4z71wl{{`8E@h!p29A<=*>a0X6zuDQwx(Lw@?il zu2Y3vqGT#9Q9BgGS3A^czPFw!XgDqt157kr4mbTp!{xh9kG?BMVDpK3e`4*nJg{xW zhIY60g=JQF1i!F`Q%rC;jUjt_kD&>0;L9u4OhLg6w7orgfHL0H5?JK^<{;_E%rq?@ zB=c*8^W{nvhxjx@uu`p2HJVCm)aSJ@pQ|rb0urG-_M}N)s{JYfo53h*zdBJHbwW+C zYEezG_FFZ}+i%UT+1WIk=2ER>b7>33)|>k}Q>}sK;2O0*g34pbn zAw4jg_iMm87S;E(iSo5Jv!nYN)`z}W(g%Jc1N58OdJ|P5=#|+LZ7dP=04wE|2Zg zbsF2&)9QP!&Rjv&@{9uoS&=H(GV*|-^#nmH~H>yt{^-D zr9X5E$=S|tp!x8S!@c; zQ$MEed_fl5*+XTJ=M}Wznj#8{XSc}!-L_s~2}Cf;ch*PUziEZFRx+JhtylcfEfmyh z98R0#Brx5XqEwdJ%`cUeP9vcLuLljAl@$^%=3wR`G)j$j8aY~x!5Fap%0i)Y(^J1x zE^{PR%j61d3-|!EP|ymwnm?OzLBIdK>HFXJcgpTBv!##kulOvREr+R?;4l?-N)M}u zDV>Uxenkp1V74l55KX}fT=RYN?Yq7CzKxDy%|C~#HL*goGge&5{j|0z5iFoPzxKMm7Z79AhIW}CD{9dx5 zoDTV5+psn9%S1EcUnUMr z!bb>RH!x{Jl23~^+ef@KA!(@-wKQpLvay30n_SElLPo{OQrKem`X&ubilG~rG&VUVxVv7RnJ^=MM!Xq;8S(GN+avI9{Cn{*y@N|M zdM|!#vJ=Rz7dH1OT(KGP@9~>L<$?~zpN@BF4fWIUMG0Ou$A^Y`QNq~d8c!-fn=qj` z!IWE^FfYL_cV5CugXY}-Ro??=_S0tPyYiepJ6FqZSuj-&Ww?uBm#Gbgr_lzrU+G;l zhGD-tqWrvv4zI)e#79(dgP1T^=Y9BE*UX_x9ambRACu*{I-{Z*{B(vtUpCC_ge#tM z@y{gvANukyxWkTbp|EFxCuY(u@OykjJ5I0Mm5m159Nw2K&>#$BMX6 zygMzzUp3fibX+wz)lr=Hyo5-iDP}`Lb|Tj5a&Zal&*Z#6gH3;0|4@Cj8+yIh$^cyp zxd&_aw#Ca4-NP2EWGxcZqX2t>0y!D`eVQy+@xBTgxtuPS4-^PqFH`CITz$#-uAnvn z8KA)L(7tyC1=6EHs(@Ckcp6SdPVoa3iv>Ns4aIDeUuzM<*Zc%Mm02sacJ~VF6uUj) zq)&g!>}Ro{PvN3FKvS({s4p$EPIEZJpO$_6Xjywr(n%pELYgK2I#RBvN|Tn z%A2|_9|(G(0>fCYPO<=qPO2GREeS&03wq(E7b+dOMWrlPK3))cV|-Tiu?MY>m2c^# z5(`JZHPMQpn`q7OMuV&gy2*8t9~VT0PrA;!%$RnHc$f=E%QN&`o#B0NuG-@ez5Y zpy0DQ2YU8JKHy`BU;OXrJoxX`u?PHLl0f{FYTXw^NB->WKfY9}H^sF2W4qOxbgMrW zl-|X(y35N>t6zR2+Uhqp#kTsFB)E91YgOyMbhP?sXJ2K$kk(Uq`QV^EeOphB6%$km zYTep2we{on^msf)Pat99gDfy^{qObx@81#62l^^OFO^7lmxvc<&=S7zH}@KxShSV_ z6p62>N>H~RP}!*xG(cv7Nx<)N7L>rcMgW^67q99n+XQb1Z%zVrO3vv^31MGFMW^532&HXZ+?uS2+434OOg-oL>5bnw0o9>q>I=(xHuecv)gN=g3 zy)r=eJ}(RD`Tsy(jIw9Iz0XH44xay=js0B@dtPi3BwmsMdT9?NvU}7QJTHK~%O<|7 zgC?d99n7TY@JGZ!AMlT_nb&pqD^{CI!y$i@pboFe6nbrs!i!6LQ~|#fq0vE&?oNBu zL4J#Ulc3k8@N)R$r3%E~b`LntCPCBWG-(*wG`Zf9POg_bF#eE4?2sq5?h*ngGp3GE(A*Tg6 zSQRTz&|G^L;~^LbdAWzrsB=z=bE=<(-sT?u7iKKv7PvXF7l1Y$HP@#ZYPRyg)fA+^ zv*8ud4$N1T${pbkf?o@?lUAuiXcO;oIZu;Qo9I^A&it=$m^hST=QX=VzBTgd*wL&U z9bd3Zd*LOMMXp>fkp)J3x%`G-!Q#L-@`w|0M25H=o(Ee5b$l744ZzN(j~o$AIzr|e zRY~NUE8mR?!6=sd0#WbDB~BSjV$0YnNVJmyYWD}M@(4X7Q|X~U@KJS}AgzM2idSs} zpOvZf>?$o%*sdRsqZY*+t%Ioua_Sw>GX{$Sz#IIX!n}qO<^%|~ld04$tP|`KB-X+6 z&pKJ@gSK6zZzGGj5OKQ<(iAzw&q^ggY?Iht?Gm(3ZqyQrjk40GkG8uop>r%0zDv+9 z8L?!LBGy^5!c%+GS?Y)Ld_UJXABV^J=CELGm!OC>66Uv4td02DXq{zk^V9ASgcua^ zjPtQDV;3yCLojY1M(YTw0qY2)0h;Ps?Lv69YlK&Y145H-fTi08LiuIAX^yK>djzO- zjqvg{_6TpD7m@(9hBom2WS5{FbOc2l;jBAR*j3;Hhb`bDI&s!J=s2=I&Lr(=kSp5- z`?hQ*Y0o4fPpL-+sMNE^gDU~r1FtT+V!E|VRYogWp?;U3ey##ne1P{olLeKNSSy2*E&8jLc_(^!tb!2nzYR zy`^QZ5(u@xX(8nH=?SAvFT(Ws=g=W zK06TrUu?`*g2e4IKy4m|+lYt%!biWa1l`!t>~MtK55|d3+%KpROnjf}4cgwtY+1iw z(49}29Tn4Fl%y{5fL&PzVykq}t}K8WmHirLcGQFcY%5se^Nk>p05kyGv#OAX?M^&m zcj6Jd6OYPNq&z!+7ZFH)Md`nCJ#P(Ot}T2?GTECB*z`05l7*lcUuVG@S%cS#p@I z$a;%)1}o$lD__4J zolgsS*%~Nli?zje9lXW5V41IpE?6P*v$>2uXoV=hMmV1qk)h=Z{12CahizGV9;R;% zF$uF-!#+qaydhKQjlr0)G+0i9WN@0qqvhT4mO1mxY(Xub#iWG&86T(?v6KYCTV*O6 zo267DWu;uCc*`(UFa~~OfYA??f+p3_WN@l0TgxD|t;C*RC+*4TzxLzZ&QL)EX6f}jvjcUJR` z55YDvmD)Ul?cF0!qM{=NJvo}cc|ha1rcnrXWsT4<05^hO13|j67z)NzEKAW@rE;|5 ztzksajfJ@JD3l=RN%J|Tr}*(0JQDLGS^iiw479k40Jw@82-1zyxr)=_RwBqoT{jk? zYDE$eJ!zM$)I!T#@gp(1Y@|qz&FW%kSRe6jzMCwhZu~SNP*KIgw&qO#hw)M$^Vuj# zKX)@y#GGGjd9;40i^b`AJcN0IQhsetIlumsBVYZ~t9+P&{E%MFi{379`uo_uCoG+K zW@szOQL)AS#y&3nrU&Q2+_c9lQTUbrHWX~GBW}W!$QP6+%UK!#u~fONMx*%P$(BBb zrdnR$>6I_2_3Idid_nD>!>55~t$N4+^%%f+o(Mi4T~+D%9yPq1P>+h5?oOyeRjLFW zJT+Tu3jYmiZ!NDud#wSUnnY~XGfB>~`7h0rA)H8=6&DB!sgNyD3#t9ixpluf2r53e z76_V1i*Y(wOnWp3-b05F-su|43tEAou{6<0^JpS1BYky;MQa(YAfLYCgVxmw8sLcr zxpuX><&X@)EnP_UwQvHN>?(2Lx5PET!|!Vs2s#atASXUyox|F2&Kls+$FTxI<*E`o zpGT~77CZRVk@>wj!Nr@xQU636{*P2+ysL!I6qsE#CtJ)=?R1@Sj7!hBF1YNE6J}hT zXo(-p6~P~!p-cQVrmR4UGio#@#%S8^W4Ec>eM?wXu~6tqsBhM2o;-!mhh=(&f=(gG z*H3gxe&<{eekZ3plMoqL#W-4*Sr=F=RVZi$?MG?*xwPTExdtE5YI`ECrX!>;{xK1c z&`C14!kCCBX}d2P<3AZ!4uYKl3h&8 zG1m$OeQNF3woedf?zb*j+N1zVOLV~+Mt(LK(BWY;ni8P5&+n8n33@RRch*syK(_zl zX8-?h%_q9&^I7&{QvpxWF;@n#6_TF4@)%@4bWCng*b;2O2|bnHw9AvT9M(Qdeu}xt ztQ~3XOf)|qXY=!Mf{w{!MuC%#$t;I=W~p3d^!o4!DCMfDHNsQX5{Gt)TINh~Shn3S z19bmP3*R4t@ECp1OpEu}MS@=KWq&}u=Ae%J{S*nBBj?x^nIqRY-_IJk7F5i{iv$&` zVw=?$tEEmAmZ}ebqzYr?9DD?GxgOJ5ae(?PZwn8FgDRE=qX z&VlXUTpS|i%60r~5fBT(OBc#@`o&LRy2>DRML1bMZ?zDIMorO_G0&`v!$yqZ(<)@i z04<@g%fb^0VHYBcdU50cm8Z}lsSz*bsrNAi%)O=xs#eu@tE<&%rzNM=G^Zs~1${$@ zNoLSV3cJu-Qw4=x*}O+ZMQgX^W0(=8P_Tu^v@VDuL8b63Wn=a_`2jNCG+^+^>Xi`|)*#5jnur$G=x~ryck+pGr`#j8 zuwI72slsY2yZvMvxW|#E6NBTdt$fKbQ&8_Um;-y{d&I(_nc$_Hkam+gqWF^Gh#GAZ zJK2s?T+F!G{8LlSzAyDfbLOHKd+V7=AJ8i27993$=`uj+XSqoTc9E&n<*aTJ!rf(% zx+9z{5H6Bs&eBjO_hBLArC~N)WbCt-%Y8D(nMyfoxHI8q!xRinpwZS@BgmR9=sX<4 zYk6kKDzdb62}}a4z{j#C-dq-2&_JBlJHkP(&uAKLT0^60EnoFxmanDtP<7y0j#kua z)jGKk%kMrpP2muPO(K3r6B^oyGu{r8AcM8KXeSI713IQw?_~aK8<$0+c~ynQ9{X7M zngyf?rpZ)F`&tV~5$-I5)OjD|C$vu;P`ozt^Y8&0XB`7i=uOAWH(M$UO@41Wpax<0 zKZt4aL6gIKzfw_asE;^9T`K4Zg8F1}q{hi&sx#E3f@WABf+u}wow9iLp0WyAz*s7% z*qUJr7-v{jF(Y1Ot&JV=wbn6LbONwh;aXa2kN8^J<&5|+R~Sbw9&z0v0gCq5c6kH? zenfu2171mMdBE2ay08=HyB8!u1_xo0(O~V4{*gZYpJ{Fdd~62Ubgu#X@$9O?J*n$+ zn1Qg)!vh%CwULF?rV~)}1l`PQ9L(8RRP!`;y)b3FE9MH}uC|T~Gr{IBy^ zXp~xs8Mo4!>axPadecEpv5${gE!d(C% z(Z$BM$Xd+{(2Qp1$1O&TIrAigHlC-$cL2^b1JtyE9R%dj=bKZlDcK2e{KsxUk=H-ll(87~p z-cP-W&_{{lIG+RF<9Kpc=X2b9&Wn7unS9Q9b9|f+5G-|}9N(wDL@er29OqL(ACrem zk9g^0S`T4Pc%8{-JyjFu14Q^JY~8A9j!O%3931EKzH2%B>gxI|cYWeQeO8)$K5;tbC+gq2nkc6pPVtZRKt1|u4Q*k7R0h2Dw9J<3U5(Qc zHlSDE=F(H>w$?gM-~t@BK{k-ez{QfbG)Y_DWhd<~NZf&%X&_Yqh$g+#F7?WrP12k1 zu#@64{VpWcfWB3aCXH6OZmGCGXEq9;C6W#hl-NY)OifzbrM7;}l=>P!U(e@n+(3u; z>cv3XLwGdx&35XWpEIeS3t^|osR!BDidvOmkf0VV%(k(`12(UI;NLY$Aii-klmI`h zTxgac(E_c`64Zv(X?x;h%Mx^ROBtm5|0;t5p%yL7;ig4PJKO*2=PUuZCuZMVLj-mC z6OzPYoT#4;;Js+BFM!3_X#Yuv;DO_~9~EiS8Gz*XpVFL1nsnsKPo{v20GFC^@TscbEGNlUq^2?$ePUrCL;4Bi#C>aRf$I9s4 zRXBsXL&m|l_UJWbd?)d5s?fhd{5IghSJa>d@D{y`=POdELhiu%qgrP2^DYLDopl*Y zb}dTPD%BQ!BG{p{LLrwJSuAEu10V@B8VK^zB>2qTkBw&Z zildcgumx*-#p%meTmnRwN#=oA5{n{h8u}Xx$Eq ziP)C5d(5^tQFQ%n;N#Xs(^wZxW0^E`(KK|?G-T2UwtokZII;B&qOIG?L0mg`c5vI)Y!D=xGoIiBmppBYOgwu8}=~yzF|J!g&VhhDT)z zJz7M#;VGio1cox3^UMIHj$X+ZK`Z5UslsWrU1lo$W~w}PjwNWV`jj1)3Hq9KiouLD zcb9Y-GaCiQ6`)%ml7;lplVBAJLikj=^C2ASA9_Zn(wk$Lx73aJk3Y&(R7Naz?ztAr zO6iy>R?0)l2^>;CIO4q@qQ=EjU7t3zX^_`2YlMYYxvf(qgET8HGoD}R%#1&(fur$7 zcnq{CabyzTYL84h#m{pJ+OH1bG{zaE(Fp4Yl4-QoABvZ06pCM)WQ8+()7qrz$p|+X z+5mh`{7dWpDn>6pO{a~ncBElD)8zk)`W z8|K>VSsV3i7yV&Sm%rMmzrLxdFrIfkhi_Jqc*u@@sH3ZpcL5!rH^B2Ddw}qDHECs1 zI93ZWbh<2%b#$Viv2%U~mS)U+z*%^kkSXYLo=M;=mtg{FK<|#l^}zHMB%Y9|^h7G= zRO&3&_3A6A!xM<@Ct#x&;C-$3dD~wY{s88}9()y7!#^@qCiC1a&Z#TAjq5H!C}~Xr;p4HKIEsZfYe{ zbhsyn?|lj%{!{!`Q9phnsh^DS=QvQ%Lr*sI_#yd?aSLODFPr3Tg{*1YTwJSUvejrjP zTg`-u8_iT`tZs{FRkQJzBE<>dDjA@w{#_Q*zw_-fHSFs`@Eb@h33 z`C@R zM#M|~O-Q-*P5()doGFcfl%4N0ItFJRz-NU-6IU@K`-gXLT}vo>t=`(z5;*HH$j<3fldXraWzX|!B!fTbSOoRWjF5)D?9 zEw%+3CTKq^Bhm#4R8OXg$%Mlf$*6WJoYMFVIb2Y^26#oR83g;yTFVq_{RqHEeuEYb z7u32PJ`Mn_%}3n&5x3sK3qISmkOBJ5Z)G9-N@(eU&$2u)m*LJ z9~N{sV;}t$;$qOhN<%4OLBINyDdktcF{RLN{$RM%U^xU6h}R8}{sx1MJe@MSbCoVp z#!LSVdYn0V!HL)ljsxHniq^EaTNcvYe4_zWL+~*iO!75-1wUwyVan%n)a`2W`tECRm>)evZArwS;xKJ=^s2Fog5~v>?%42B`ZuUK0@HYq)W^hGTE?qPt8-G#`aW3u@V2rcn2RJlR+aJcUL` zkauVDN4sMqGg>e}`SKl%8NDO7;Qg~LOxTlEDn)CU^*5*sAqfktQ);T6lGCdMR z?KCbxF=TKz&q6Z*?PQSJ~LotzLUcp zx}zt?NZ788kwsw5eN~86{6Y%Zv}dv&V-QmzH*z0rl-v1tyM(x)I~|fNsjpB66&BNj zsy{9eCtGv)a$$@x$-iLo3_2u{aRz6+N`5ABhx-}Fb)o{Tty;-hb)thRhu>ZuBWMC* zbfSt{<%1gisr#cw`)c>sMlR&Jo>lL&orEFx2tKM73JO_cd7cys`pTE<2jA}uRWfvbt+99u z>j>~Ko91)9FW#2j{sD2aGYyCv5RZFA8W4Xr9((;lLF?5XTzEeh@zNgkwemh6(TcI$ zCw{)eVV_t$gk#Y8=~QVQxA?eo9DS6|Q9LendX}Rm(_8{4x?~^y>`o1PE4;ERRd{## z_*#CK?<=1fh54?fF8wMzEp@GT>02kXuEIOl@7H%w`Mph_e&IUmG8^uru8`ZyH%$NP*KZP z<;=Cp)iO3w9Vcjw+=}HAow8MaCOz=qjZZyW!C7n|!Uh-mO^MrNfNsm>UCVgrUM$Av zzF2Ms2W5&IQ)G}*x`W4cXSw%yLHW#RIXVWcl%KHlyvXjFBD-twzyL3y09dLBwMn+U z`y<#CLbuCQy8Vx=8;h3(IFjvS5xNO)UTOPSXw&fq20#-`Q8@NzArSx;5<&N^9Xc7n z!=RaJ+mHVly7debWJNFTK13_({-(3L=d1$mWsv`==WcjF@Q_|gqoI<0XHa?5n> z7Oxv+xd(e>I(^|^&rVhiRT`~vh4_X1U*5jSYI3v>Cadabpjypw*)69zt_3b{VMOZ) z(*jqO%f}x{S#LZ^=bGt>3C{E!j}0F8z}YOmC=jC$*PyFXX^m@xTc*+m_fbD{@1tm4 zDose5&5}|>I_^P&(%y8`KPwK8KqgE`;s{RJ4JGV$ zf5y+o3fka3!#;zh@$IsU1&xwKJGYi+P`h2On8Sy}TW>{*A&Wzq^4 z^`>RAL~Cr7xOTZP=_I}SSD8k+a;;>Ry_N}}bs}l48~~R?H%x2EY<-E zS;zys07)UN?LkPG3an{RzL{n%#l~u>^*JAl>2o|Q%ml}2fGM$EigP!Wg39;AVG^vr zb|Zg61q6G%v3unwBseZl!X&U#eZ|)!{~Ja2QT=ez3#)mi$XcC*?)%urdo&W(h(eEp5dZ&cm(KBcfLA`pN;=4GxgSy!=@t z(rmVs_G`OU^y}zI?<`&}iCq_}MM|N^Ntm~p1T#M$ZDVT**tn6efoZkys z^eACZFz5v;QBy3hu3-e)GPA5C)>t0AALLGrCHYey2$w#M{crU^N1%6&_qKSMGj5OuZzr2EKf|}YNy(jE>C>lri-@Z{lv<; z$jZd*WK)boiC&tXG(E}a%T7-!O|p4RX;OKTeGO~TbZfq4h4bE~(^e@q(WNeQbKcv? zpo#!PJKU;0YDe{#cT(!l;Fk?!$oGja=F0mM-wt0Kcr#jo&Cm|tDW5N*M>682Q@-K; z81mu%h(9UJ23y&1Ig3pyZ9gCP5*L1jQk-! z%O3D3GAm(3UF3*_k#&(H6Uvk7r#sG&OrcCy$R*Q>pMp%Gd00hL=$LDO8|OiH1%7t9&*EpaXP!r<&?e7e{0#F> z_sSHS<6VxQ-QG-}OrZ(B3jFNxW%`lazX(4|{af(!wSQooOrc0zDSj&AcH?J%-1qny z5nmE7Q)of_D*Wt@&rFahG$>&#e&!~8f}bM^gA-*6g%hXXry_B8A|ydX?bD2yJneNT z0l+2v>$qb9kS`a283J4lT#TjBvcwX9dTd46Rmu{Ck(JI?9CA0jDTW8;!toyLs5`8J`p=) zqPds@ntB0b;ORVA^ijgbgy^`16Y>%?InNVKzDe$Maz7p)iXs0X{-bzJ&T~nVAD3qx z^2zb@;-k4Ai#r{s$!A$*mLV^*7Fu>?j(bDk3#RVxdOz?Qa?DAcdzo73bnEy2?6_#| zRsOYpP0rI&ldq$#PT$RSSH|?+ImlSLpsV%wzk|Okg!NRQBMCnw=rR8~;YflE(2<0k zMC?k*q!`MdHB$Vf8CC@C^3GJ`U*d-t#m;3l^9bakCm!wb9rNjOKlSbL$pG!~h5WJQ zW;1g^3OyNV0=$5w12NV&0VyW^Se zQ+&Y84Jq{GrcItNJ-Uo_o=wo>-sCyKG739Ih`AzC=#Pa)d#0Ndd7jZoG1^mJBgGjq z95{x~ptq(2r{V7{T8_!054D~*UR;L|G60_Oi9`XGM4 zA=(wc8$`Q-;F=8LWdTItgm=xyTaqw0L3X9NKrm6*Stbe+R~m+}FtH*L@-QH}LSIVo zEOWE2Cf!lO!hJW1r(`NURif{E-Bcw%#}4^(3CtgabW;oV%Y|T11iythg;XIuq`j_q zNUPF#DEV(#sXWv^U8d3t|E-CdG?4*nay#a?hn{>IOSXsFo5&|$)#2a2Ak*oES26#* zMlj+fE#b)2o=NGR4ziFs@Xbl4pnD!hhJ6Hymt}xn-UDaWdm!D?y0jO;;)4GkY3K6{ z2>aUk^b^$hNg1RkD{(Qw+C@JahKkW$_POD%`|Yy=-G7*DSb(VOi!wk(a=5}R_HcEW zR9Nc}{Hm)AGR3c)JE>pW`Te@9xs&>Pf2`gRqx8o!etbycL^<>xne;i7V;c?S&;-Y5 zXac>1bsK5lp-Mx+X@60HPIZ4$tB1=XeVQ+l`EbpVuf}UTsqxkXwx{hcmJ%t>U;eKRa=A6Jpr8h`wQv{{Y*G{z)(SN4lstxz+C9h?rD3Jpy$!t9^B?P+Y^Lt zUKn$X9w6xEZZbgKaADh%-E;lpL{QcU*f|GYcXEC`95W3;^tvr3emzWVmmF@2rbCJ0 zX*>PX@V$)*Gg{hbY1Uj8kJ^bJecVY)kHe2na)dLYJXyr*B^ZPvq&AzJL4w-<8Y}@y z4&Cj7y8q71@4tnNCJzmYxqSs~x?N;?XPp;iO4hzc2_xhvGx`F=LDrlejK?^^OX?~f zKqvZ3$Rxg$l`Osjq75buPHb%|W93&v1hsiY2I-Ll;DHAu9yV!DVOzK~4>G2C)=7fw z@g()(Wlg6^iAiI@Mkh;HY`xjb21a30Ze>GsddWLnfIvcRM>Jui8SJ+ z2z^cl<`kc+Fhm(c=yPI;-Vi|xtOdAoTVUnz{ml?jhX@KDH$o_3lx=Uk4G(}Ob78mL z4*2Ts@e>qFh5NpQ1Ia)%A zm%DJZJga@_a_FqgQT)bgI`=E(s8K2r(xot*!h{Dw#5_tB*1;93%~YFiGo2+zGR5VN z!?TkSuI)HkVJmJ?h1|+8zQ?U{hxB3kupEGP$bGTFee!H<@T|-=T3T$GqFwl|vv6n9 zSI{jjWeTtIUIjn;we_s!p=!7bNye)KWZfx>OB?M(RRerk{;JGyPv`;7fnscp0R=@dx6W zIUR`4Pe3mSnyO}D;pGg{XsH?njnuEbAwM)w{gDKg+eZ@06J#14NjRy)CliJxa>TI2 zQHl5v1a+FFFZ3jdn7bl-(;`XSuVK2MUxQ$Uub)TT=6=-pQfV%0gV;<#Y1#Pdvt>4P z`*;r5ze5J-j^~+w!RzM}GC)tf$;y>=oql$oj^xwj0^YMNz-$T7duknmybpNkzg$87 z@cwH)FM5zP%$Ez4!!`R0di`~oO0So~^thCB()*T|UN=c!FXf~d`cgUHsENT@3^HQ% ze}uTW`EmfOM`KDpXfu}wAGQad9uCDYmyn>_@uY1hRx|xTZshCIkf3t;8SDCl1bv2w z30OWxU&yamoR00z$LfOZ&Ss`H+t{#kHt-)JgEU8N=lg?@pziFvae%GjH$YG`w$yNd zfr5%+nj#sfM#;ch% z!ZXzx6;r?(HO8uu;TUTyOj4Z!##+0Kb1jr7P~k&(UNgeOc~s6+?#>$KoG}{V;ozie z)K^Z_SL!>ngmMO;#MeJi(6elnHOTIuL3Rf@02l)+`!Wz+DtSjE(tY|72^Nzu1P4~N?K;g@#U&i6-mxV3|z|Gzn zw+JHeMe*OqTjBh-===DMR|DY4g`TMpT21v%^;+R=Z_>K!Gn?bv$`Z5`;*d1@B!S6$ zG5L%u&Rro>=-d?-uC&6#HLl`{Wq7ybBSfV!)z0Ljc!@T**_dXsGi|^2)U{asvji=Y z1-N4FWv0Y5ok6BG)&<3<=Xkn}b#1*pp6_|WE8hf$v#e;izM&`L?E(a?Z}?e5ENnXT zS;I3<6w^*PX+5%OeJj@{@UMf)ED)4B{w7*rEmY;8M zbU4$>w0s=qtWawYpT8nr8tWQ;8Lp$sxyCg5vdNeEgRsok;mMbk#737~w)OTXHP_=T zjdkI;psP97b-*3Zw^rc_okLNhMU9-&7B%{)5!$2$vmZ73#EIg(#=6G3oHmVhEpsI9(Goa{`YxPvXN z@St9Fu;tdA6c>s!`;$;yUYxzo=EY5c{2A-?v8zv9 zZBtwmzD9$bjh;_6K%6k|h`E%yqYVx~dVtytb2$M%Vzqf7iFeN73bcPEjQ<~aBo?&| zs7IbKD0T_i<6wQ-M0DK-W5`uGz8PQcklBL7-F9E!-Olb)pl|U7xgt2K-f~Ag4v&yo z;Fg{4XjL=ZYOtz-;EX$_$pED-Uwkl!Fpp+Cn`jqm#Jt3Yqueb}uzxbl5#EW^(VC2b#wqnQ+ zvKWF59=f4|N@WE*FyY-Nr>~F|HZ63c?Xll34@8HM4#*RB3@37$@egZvsb>AWYF{!N zv?q1} z1OrU9QmwRijw@BQy>sNKcjPW>gC*O z`1LzzQ*l)72FA1(awT>Z0dZ3En0ep)CSRd`hbiKvn+hlzVsnpn8LV5E0qas4BMS&Y zj#(zRNIk#67q-YP5{_6pMfl`KTjX9oz&MD#vVh{zHXFm4w9BYzp_MTPd8V;pKaG(` zWXJg$2C}QK7y}UZN& z1i>q1DqRUj_d2@8gLuOEKV*RZ<3*g+VJ#D}rvtmd7ZDl5_9L=7z7}6cl3&XV`gKIg z3?|@1eMHb~xg6*A<&r%`(FE@#zU_<%TJJrIt>jT}R=mZ^{1HKaH%ed;2$xU}ln=QI zncD5^ENinR(`d7G*n?Y&!=9sju^AC`$eIqWM_*2j4HoBjx ztG{<(&1!}GA-`ekA^!@tYe4mn`;Xh`&wI}Yg7u=4D zG*g%eZ9np?Os8kFEfsD`+15vv75=CfePnHRGqBmc*NvFH?hE|O`D@b}@vKZk)+*dg zqtiIQkFA}S4A4&N5KKL(h>F0jil~CHB`XwK4K7Hz?mWB^Kh~{X(iIAN_IcB3&%fa-sI52+lxRqX9xpEJAfA2DLvm2%I+Hus`Uuk&$EL0B?NG_#5h@h46bc^!I^*iY zemx3Bt@?7VHJiXF-Hh6x&W*7#;2GB$7UCBQ2OKL%+!n(wZ@UBQywPC4<8E&u&YWO9 zcc(+JiV&rDi%HP!cTw*8yKz`J4Rb}#?3HFL>`zT!+?{SdbGF8L?Dy#T@q(JYA_Mfw zcx}@*UM|pXbQj2t8rUc|>!{6gp9c2H{aDmisx{gb?i%%}g7}{8V*1LF&?Fxz_pzlR zh+ujK8mzA41(m6CW&%aRIMe{pOr}z^7uYHV!4{y^K)PV-88%^`07q1sKT*qexQ*oz zgmn$aPsGVh2I%g=yq!cadZT)Obhh6=*m43wP7);8*ViOLH{NQpzx6&RdnbOfAb4e< z>!-7h3W7J7kA`kQLS6)bzE!5vtOb%#Kk)^jyDCsB8V-C)^JS`yxp$p?T&vmpzo6Dbk`bP zQyosz;bsEir~ZgpQY>f)^b~`PyF^xZ-DRqN*Zp?Y@Bc5m>cs-_dMUZT#lju z@I!D@1>O80y3_$+hIM_+=Y9RH(a-zVJ8gGm0(95kioB)?Ja{YvG)!Vc+ntK#r+jop zL@qZz3Qf0t@BwI!O*DYEr~!cH_|m2eYR|S%VL6pMXexVs5FC-m8G=MZun4;b)tDiu z#eK-f0bm-&p1A;AfwBNJ100L@Wd z4WtVI?b8fK12AS|z5?K#FqdO+0bGya zULfeMff%BJaxAZOW3kQEY3|DAF9jqTfs z5_I#MGC*%)%io>yWF@y8XuX6+p?3v6j@R&Lj#Xu0A3{~uIQ9cAIBuMTk7#3N_O75R ztIFIXQl?+yQ$@I&KZHAN2NbUK0}9ZvcsKq_)Z}|(4H$b z!1EoLYtdo=SEI!Mu0V?cG)0R)5OjMVd{TYnC@8$rD0zrS9T5X~E=HjW0Y8laA(sl$ z?>GYZwLM0^?(A&vsPhRG4V+Nlvic=|4od~y8;~g!IH6c#^9!i$Md#2X=&z37;beBar&(+_e4i$HYL2({4iV9$>ez%cq4_ZMac!clWfj_YZA zY;ZfBq-fdMu6eE)+Ig-@4tCas40Y$ZV`B5%A&-~kXecz~$?`-awSQ)IThbkezwSLT zjA-_+WE%adJ5GGv2eDcjkTHY>aEUR)z11xJsFs6fs^1LknlwBA%Dzhq^F zOhE&!g>bpI&{}W7_dcz+`Vgjarl3BE>TIHlOjKtst3RT;ny7pe)s>?*TiaNNEK}&7 z%3!SSJJuQ!e~69<{ULTLMP#vzi7S@HQGp)<(J4_Zx5rX$mwP#wqNl`O6Et&euUr=+ ziPLrXn@p#_fp;|JQZWypWq2(<=RShcLy&`p-552Q z_xgPWb@{DKp+EdxrqBjCM9B;qqC!ycX1YJ<4SQc47W%`{M1M6#K~sK=n$8AVec|%# zYn~mt+Cj&1c!(OJd=bZR7(qV=wWM{38l&RuFut%cY77V*5h;p@i!|-bvM3NtSJRQ9 z%?1$kqck%()731{2b>IMsY(z8>;#o+drgAv5Ug?)KtkKq=Z0R_@N=~X<#BrSJN%g5 zA2TlZk5BO9uE3VI^b>Ud<6y)61TB^$xr6%&ng=8KR2rnlCur$5M-PR<)=uauPnnNfNlD8aG=VftuwJPPkj+YH1=AFyGWoC{UlpOj!C%9Z^ua z3PYNWEgT2GG59szv9x{>RtI+n7UPE(CWo~Ayon0ohd zWii(`8E3ghbI^S8qg|t+oS|EcK=jx-+EvDsCSjSY(p96JO4qvBa@M)FGr7rlyK8@J zaKCGRv>XJYApp5NRH_q@zNsS&YJN%eaC#YKZs+#Q+05seCO)m&iS(A zYp2bQA0A($0>k5{)I>~)FNu$7U`hOYHRIoluc(Qrh~H8Zu_b;>Yz|xE_ryb|({AIQ z_%CXNzlc8;OMWbVe1gy6zs$o5z13csLHWMvJ}evPGyE>{o%3Nmk7bz-@BB%OFk>D> ztMiyQ8a`O)Eks%Wph#$tXYm?u=1G>!mhtxbimMIEmcwdcAepI2vjQshF>OV*xz24> zu3RCb+Au5RMkfX$Wc$?DU(oF-GKIS4vIAx$vaQbmJM0c+;bnbZ32BGi5slg*ck^aO zbHd$nuM@?J!QxNRI?|tBtJ#Ft{#G;mw|!O(gw7!|_RXbC37V!6*76D8gjEq*&zTas zxLqPJ0@`PJ!$z@G+emeZsX~{~6F%1G#e!=`r?bcwC(AAyWeraqv{CMq2~K(V(rBmr zqBiOa`L#@BD%^!?vajWdI=B<^yiCLh$IzXZ!|T{x3|9jz+;XQzpj=1;tQ@O$vK%X~ z4ld7{?W#>T+x3pYq4NBX-f@-3;!tNQcP+1jTkbkt2Y1>v%+01GsSzxIG|XM;=0StT z6Rv})(p}}&tOIr`8dv2$+@Ln@aD$@_bZw(_M;n~4LwCNx(1x|s4sAHI4sK?{c@3cp z5zTF0!^Keynoo-xe#jU!Sz|tIxVB*eeBwt@Ya4E=joQ?3ek0@^C7R!8Q6qjvCyH9s zD7$g(ie@*y(55!-LYus{y5Z5Zd2I{Z#&&CA+v2u9%oP1y6}R2gwstm~+D>_(Hg3uT z(;m=SM|)w~10U9*`|yFyb#R*>I9~^M{(*iEqTSKl`aL)#is3#T@?eB9(Z)m`EO;;h z?%txPf(MIhqlzC4J%qfYM4^YW9;(%+Sr09KsCFY4KQyI7ZQPU&(>l~?c!v+`(0$lp za~<5~4(IFO&Ufh75tWN+c*h}(L7VlY9?~%q#h?`w=~&Q_8_q0qFQTZd$Cf@;yWLA43q4T_XSkZp5WDnK4nL%RYKT#xY8&y=5H&m| zG+Y%aAC7L?6-<$u78{(VF2n{es3OaU^PnNNY6ZWsJcxzW$T!w8$8_+R)yFm+q&@_= zJs2_dp+n>WoEGuYA;PQb?QNGqC+R|)n0j4klhfA8JEv`4TQ>@dcxhhSm2G3_R<;GJ zw{zi6`R#C=d4{We1r2b@SD_~Wa9o$+I9(2B)JlySA&29rqjAG~Gg*;!44xQ|Sr^(^ z;flBUTb5mD%6%W*$Kj9eL!K3HGjX{pvMfAE%c-6>sfv2(RL|2FZ9xoAL<0mZX5#W* zn)o?GTyBV;qXSG_uB*13iC4a@i8~wOm8L$O=`a(oj8;QtXwnQiW_{Mc3YYbw&l>D& zV8NB?z6M7%aJ0d;62^zLJ5b(wC+C)|)}rq$g{L#COMx^XuyVVX=s z)78*q8k(;39(R5wYJ;3JbmbbI z4iZ}Yt?s~M)>%v6GSXQqk8F8I9!)X&Ikc6&B2TyzpZw`7Iz!qVXb=iHLt|Yr!LhC- zE<1-Ma5>7ydoKH*`Q*-8eQZ}TKjUNi$KT9I&sum}T4;MjIv509OD1OkyG3~BfzP|%84WGH-6%xk(B)+r^IWnL~*XxNpz zuaqft_L|COGKGd-x9vKaLf>9jiPui{UO&6JOrhc%kKQO#sPd-aH_H?%yE*d~nL?pk z*WD^p=;*DBZ<8ss^R_81WeQEWbIP4Eg^sj7*;=O1cdZBCB~z&Mu5)+6ApGv?yJZTE zy=VVDDCpj8_re=hn+q@o$L>J}X<)nTb~1(Dc`)lC_^o<0gm+fn>6pcj3JegmA^s3L z;#fkzM43So6PF}f;qtd>Nn&mi1Gz~BNhm4lUHrVueKJV%xXi|*8>93lQ<})}~vYz{H4e|Y`F@;O@na8Y~M8V(Q_?SUg#5530ZT->&ztpPQb-f6cHvvy;< zX2Z&Uazxbl z9Z$%yA~p2Tuz#YFaxGh~7*XL`xv9=MY?C}+$JYHkjdsCq#Uv|qO?N>mr1#|0T_rBZ z-hQF0%Ed)?izWFMH8<)_DTJk?&a_TQIhAhkRNDJy6gGt}2%m zKH7_WN_Hh32{AK#jyw}{Xn$s-hvgy>mV)cp=$ZYQjh-53cI}bm8QB>z3OAsG1PyX6 zaLE+<#I?>P(`lXS7(&Nfc!xc|H=Tv9VG8wekAp|xaqf*Cn8tHPX@8eN`a2MCCp$>c zGk=%qK&WshCiwegz7`!M=ydcK9D;xl|Qk`&Zy(2{T~UQGq2ZlxLf@kcHGDh>Pqj zK`n#0LV$VN)iOX=m+~d`5J5Nby9;<#q9@y=^(^IvXG6`;-q76rBHZC%H~!+wHtyxW z+glta1>e&^I^F#u?k->aJMOGt33Roc=IR!9nxTSjX@v>_xW#CK-*TUQwR~SY`||&v zO%HRI1}F&crnHvn*d!CzEJM_qn&g7p)gE_*!vwYA z)o7TY_U%m%w|~a&;b*!TRJY&ST|G=tnXHngv;Hv1wwfxFWl?aAZ6-x)%2I`jdy zz0qDr!h)`94f3#{sd7GF@WWn-wV7iheU}-k+wViBVG#xH>tiRoSXOU;z{(wAK^aRV z>RPiTyHFVKaG@gvH7nt!j1crjw!|L&;*q`^@$HWg)arrSzyqlUbFr+VnMR?7u;mG| zNl`S(7$DOaIT?MUA8;*SVVHu!@%XnHx1pW6UaP#SMCdB;s z0A(swLO(J{D=_&}sY(uDHR=dHhjQ*Uyw`KdGIE6}V-A;*E9k%HAlG&BG5cuZSwr!L0=(felTJp+F2^M;%AFH(}UhKg{AQ;LVp{GubBOz zt&>=(*U-1Dw~{C5q&1La2364-jP4p5gx!lCWX>S$nh1xx z%v$pVRlsF_3ddAn?9-{j^@GdQ3BzJv{NxEUG?eSDVE0;ig7%}&gY<(Z?3HO0_U3wJ zI^}w|dNBb;L5nQr>$&-UOa;9YzW>3fIyC57%5-YERk2dzC_#@eVD>Od&~Fwndl)5X z9b{|iY&|5{UDA`Xke*~aBA5s9LX1b8`0>LO8K7J_n$^%o%hUXOT59!6O_WMkZX#B_ zD-bjV?uycAmikLQ$R0_QpR@`yQ}~fUA@qJZLI)Ifu zGq8)NDr*bDt2dk#Z=tbnV>^1m*T-+bus;HjzYXpI8Km|X{On&}htqYqDI513aZd&( zne5r*gYp;S&U&ZvC2ygi9iFpZa1XpJ#on7f;P)oVdeJhuL$L^Rhst3uHKkC&(V+#7YZuz zZDQd_p}1%}+qc)dWoqBqt#5>>b2lxWFNXxO+fEr1!u_QVPJ?yu7jm%TnT+ z*(%E)6PxAF_S;2d`*ScrsknnJ(wJu$)g|WZ-lMK?I`mpYK zAGwtG0^LC!Qt{bj$$Y+6=QB9v*RWRQ*Dyh} zQx3KC;INQmsP&PBTOV9xe`M{2$Qs~YYrlo>jHM2=-zp@VsE|G(n1DkZL7z}I^k;M+ z+r7{YX9D;<7rG0uZU8Ls%=fs{wUm3lXOYJ!lrQ(JvcYWcK_9Xlj;VFfcZ36+{}ErV znMtTDTfM#Xl1!tQ^06}Sl(~K@e5M!UhgvgO?{b`=d@BpKi62w8o1MvJyR-0_Pw;$% zpMl;ZKA<^OwtJf!OUgJw1)j+sjLbOk6FRqMFLGA1+9r{%CR)?>FBQ^LOV=8@M70a72zc25C2=I?r(povfg?o1Qu6O!rl z37sS6jpwKYdyx{?9GC1I+xOdDpJPjcnRmc-)MaM-B_>qtbm6vUW3v}zkV_15i7MQQ z&e1I1$&3?pj>0Z1%i{!1aW6ELrG@T2JZI7FJ?<}TG>Y)?DH+-coU@)Dw8^s@Pd@F& zPX_JwWMjXR?Jf7R-9owdIKs#Ax={w5@eXBw>^!;t(MK@OR|*gIs7R@=!iROv?#%+v z9NxN)6S}}47YO$N<=$_2BQ{P@xpzG;R^tWyliJK7Qx;2Gx>77>Iq)pGf^}|K?6N|B z??ikr`zf2NQ9l(?c1|@O-#YI22BhP3)P>KW;?t2WZN&gX$d5mKOazKzkqM&CAvYMbw1G~%G|s1Jp*8zDOC8|!y680+8Q z2S0&>A===d9Pb1s$4^gicZ)#2Nz)Um6HG5tb;7X(v&mSPSeguaUIa^%=W~E_nxDKV z*{<-SIQnBYhvj&Hm*0s(2Zo=?P!p zd4NU9``C5octJdQ2mQh#QB*^Oq_uc&XbMwhtLG_OF9n8%dY)!$R! zaF9LqkJU%-^StJQoOW|5K`sUJ`b51x^-X(E)EiVEce>*REs*bFsl!ZLA=lc~|3;pY z_I3Vp%qe}f&z+F#$@R!?lyD8>_(IP8~iez zHu$sStZ-&;%8pwUC(~(BTm@detMw@|2f+pd-*((-_!+_U?GryJ-pra_!6<7beOKT9|k`5%)B7I&of-%%FKmWuCF2{g zdr3sgM|`S9}Gt0V~|a74sQTjfrPiJ@oDPB~iHQQFDGP)95=)XKBPHB+oo8~ngpX@lR>0GC-{4<&q< z=q}{mq7M^`l5Mys`FuTxou04Px4s?GxBig&F7_QlL+bar+JJqo9&)uqKIH1N&7Hv6 z<`AmFh^%yu`Z*YAXr16&>yqv=aFF)IyfwRrm-+(zjNzl5hhFl{9 zG~}8i&2a?adJMT{JG&N`BH(JuAHJZQ5J!IKn0Mmo(<^ zlE%n=+uNK)h1#H?_s8|54XWJ2ZVaCxM^E-uCgZ>g&A`g!^Y#4NmF1wfp;}Zgx4s>h zTmNkH*toOJb6c1=&S!62WwK8{tpz=CWR=98G{c#AXK%QjUknYhtV46Qc~*-k4QE}Q zP??OyEhXaReEq!141fEUT}7iAh5TaUc&v3C=QB8|l6frn5$fmXooo20lTSB2nRPzc z)p8uCtxT>=*7JiZlf(7wX%ns&sb|pR>yuss0J;5QgrQTkY#adWcJNMQ* z9}_$H>LFMA*=t;wV=-N0!d&|Pq+>}gt*m}5sWcg-BjeKKxyc5-1ohJtBkSeYGhku8 z@do5QTsw5VAa5{}# zb=A7M$aPm8XuMFL-Pi_#V{g-Tmg z-(bG&DfKJZ03MEbUX?-4Vqc@9jj%JCBxveo2QQaFI(YeeS6JcvUi97-A6_AYbo9z^ zuQbFPFW-E*e2yvLHvfvvSIFl$7o@>~X_C-jDq|;IGmkyAOcJ!a+2m{SOv826%`H~K zVq5{cXl5{vjb0g?d@b(5nDX#joYC%P6R(w>4Y<3R`6`enrYjbfyz2_D^RpO~9T-#L zb=A#d!ko0|`o-6qT*RyBPQ8e|`Zn9Rfl0kxi|76z2P&JR(Lg9*r-8Xaaz8{>I8mJY zMr*JAB;J=a%mrB+d*qoUXbP2(y@F8*%_ZcZ`N3TJ(uv}1Vg_)4=N-Q1nyYr-up}vG|RhR#2@4anxf1s13lrW=@M%Vi;JXRc2{`ewAeOT^l~A0Bt?(qlpojZ4 z;-$HXA13Nf20QyOad{%Hz%n!+Tb?*L35-hLXbesooMfltJpWZZvB9zimpQdKZ2j-+M`y?P^-CMrQCzWQ4f{8;r6v6v4QynjCE-SE z8kx+8HXYwoV>!WqhB*yA+{%cTavFvk>Lx=X9B#PGiDKG)jrKK?>9HKa;Sy^aopQ=O z)#!L*T^OedHyYi@DPeS@!bZ^&3LC9)q6C_n*LX4&qna4@Q*rs`%iYiGUEZuKmt5(39$zd| zox1G%%RC&6c!ID){OrUOV|(h^1KL z87#^UaH8G6oHv1&)#ZYEjxkPb->p!>$`J z@oWZkqQ&_Z_B^8VEq-W$#&BQL4=v{0U`Gi#S&+EH=BdFn&1h}3aTV1Go@dY*ojdDz z>Kt|I{DPqp@I)qFv9o%my0N`Ywqs0guT(d76tXz#m3eSoGEZ)DL+(bK+c#*x?JGvk`AWI8#hm4E1nkiUn25uUOiO2|-`UO>W~A0h=n% zG%xsp-pEe#=J~-ag1U?H{D(Q1p@WD0nQ_`~Clems@sBd&RwUHMtw`8naO*&af3zjx zvpTrX6242&n+A~ZKW=VqTqto-!`iq-4L3K8)_Zfq3k{=gyov>VgS)T*chx#N#4aL> z1x@#qdayC@WJ2veGj35s)~R3A@N7fy<6=RX-b@HnbQE4{E*7-jmkG&=#=(}QSkN@k zWf&ZcH;M&q0Isva!3qQU`MzVda1`zv>xYjHraX*0CjCm;Vc#*I_Lu^B-Z9@m$c}Z? zK!0W&usVba_#)mg9x%tzs8~=au_)0rv%22VdIr4oaC3*ieWGS#RIXMi^rDtGtx&6t zp$UthR;$C7mee4~Nk_THR>u*qhLt7HIBw!~Wots+{ zzDr=n97W;ltUWa^GF>_QRY~iTOuw&7`kYr`ZPD|2QgxC!oUnyYby9!(XoD~(4%g4K z#n^fEi|cc(8j~*IuVMJfr@~1~FmwV_2Wp2>1<*-tGRosY>_XYd~=PGd6d6 zCa86V=#MXHfSm@4M{U0L=uWT4=(X#Z2Yi~ZVK@1}Lzt&cd22=wJqrD9c0htuPJok* zk>jP_*3)=7l{fyZJTVQLf>WbRYpR^eSIaCpqp9-USX=aW<@+3|$L)Pt>7?T_kk%{@ zQ)Q`RQ(h|P;&6fbvWkh$x=L<#80u!Z*P-4k58BiN)i|XU50G}8nx}kv|BX%QJhg;n zK8RYPSf~VWjarLujv4YaL5J00Wj=tzaItKp>1S1@5#MmdnMyO}!|Jr7v~pU7a8-(h zsMspDJ&_e#^BqrQ^R4+ddcL)k)mlKk)cV*?_=R=K^74iP5vQzkmXAZQIiqvdFp3Ed zqdc;wMIMcVpd5*Ey?I{y%bg}@m}{P6A~w%eVb}z>qtaFB^01x-WDTxL<{P@ZD_z@S zy>@JK?c_*3k~>{rIO&{>%t%(c*4QTvTH{)W;?U3V31UWazw3<4UK-E12D#0)fCjmT z;|dVeGu)MKtvrBGrF(~4+u4JW(GFbA8e!EQ_W?W2K=0t#W>-=rIs_cClGZzBcI#=I zL372o(OxHNFMVY+s^~Cfa&yDbE}%?T-0HvgEgbV`p}9=_MtV@8x3+5P;0#v!KJy@3n*5_7r`x4MmHW3n`LT6 z9TKdBwX<5ShI(t^xY(c5g+GV(N4xufrW0ofvsA#B>QGh)0%YtOs70}JuV1QG>x}~h zaI{)gn|D1qSWSH#R?x>a0N*Cxz|0hs?;4Be(7$x`cdKxK`nz-ZH^=?88=DuKB2@rf zt-i&C`&RXZYc1+)ZLkc{YIT@BK+nW`d}}df*UIe@H@Dm63;=aNioa!uisAAxm7TeY zbIw)Nx%hoeHS6V=eLjcE*xM#aHQ{oIKxF@q)xmki1c;3SoizDX>&q1SY#6(-5zR{V%OIIzX604f5 zZGu~onw9vh$q!u1*@7CRpwR#xN0R|OErUYBaqP8-f{#}Q;K;QxFmnVozS#gbw+8^9 zt5+JJ$>mz@mM*{FFhKz~s-iXG;bHY2lrvw%_*1Dy#AK0gG*y&Dcl%p{84!-8u(83Q4ZM%H7XhyrzS-Mv(=JlV7XeU^Z^&FW2LG> zlrFzYt>c-?B?&2LtehdyC_#~aBu$EM^^GL0OnnX-GCxE#%8G zN#b>zyT1OG-b-<742ZTE5G^qv+F?Mn!hmRl0nq{t3MrjBO1qBI)KS`Xly)7ZQ%C94 zQIU8kW(askW`^U@r&$JwZhATp?Xo}?20-^1)cX9mqc-7u`M&f8BHpk!;*I?OxVmDM z27(~EZ*~Ozh=5;U6)YsAF}C7~h5ms}AU_bu)fOTW30Nzn)#@rq;elIOnBsoH#!jvb zZ*K24q{>d1yS?{z_IS(9?(Cc1qNrmd0-|#)_%xXp-P7m-vqKoZBgm9#F{{;N*S-Ju9vvgUO&yN z{-~QUqiOnk`cE2T;H$br(%b&-?Nkyt<8@5{%<#0OuPgj*S?}^?)5$y??{dsD)$dsM zVb|OQ00960s9mwK0RR9100000EQ%sA1$PJ%B)B{LUgyjw zNZXa~^SpkqCx2wlIdf+2-21tA=FG9VDn-eu;21!9=-PWun#EZwVPK;MD;guEPy? zTA!d>OYWcO4z=DQcVvD)40#!2^3FC=-T zcp=}b&>XMgwz=!v^z5%VdcPSxaL%D-od*6mnFtLX+1C zFRb?7?9FUbI-Ck*;BY$-)-kRlk~?N}#ORJwI&s~^c3`u2g%9d{X8B;A&r%-@^&RJn zslH9VSnRvn7cqVl{RQ3OX73aqjPdticfXJKf5Jb)Bo@ilk~<8O(Gol5UWvJCnZhd7 zqR^)Ht3Rr|Ku?yX5;No?dc-?*KWAl#!YLJIAlb+?kYmi$H-CZ79Yz?*1~QEt1C7R9 zO*(8u1FcyK*_dswv(aK7 zuyM!^bs)?!%z>&dtz85?%1ArS=8Ft-lsGWbQRQH)!LibT7RNCMj&-imoW~sLPUJhs zJ29#AvChnO%yG_vNu3)sHr~0wiB-;RPHcA`cH*cr*u`9R&dE*&W;kaP!#a({xkkHC z>6+(4Sm#N)hk34pE*y5nyD_&@SUYKn3v)Xy)GtcBdxRTR?#XUUbS^LH2N?1$8P@<8cPY7 z5P^55pw(8zs>AOq1q6;z|9OSFSf!dav_lELhGk&}3{eaL8z+d8pOIQM1az z3GYN7=BT!UorrW6J5k|0;KB)4nj1OpHEwM4KH<&t{c`siZw&DX_d&YPZa)v{h#OH} zE4;AQ>tf|_AFTKDa18gE=ZB?!>oxx;U!cj_>A(p`q!V$@EbO3Fok+^x``#`8WZK#SPOf2@d_4~vF(xn zmTiV?k_c0U3Jq!o&9es;j;NCg=hS%vL(mMYK`YRPQ$VO0N%LI2iNoeGx_5yv6|Io0 zhAEWL6RJ13RSK}@j~WaS*dR|SgcwmKO3YCv#+hqPgj?16YmTu}EfiSA8rx?dwh`qR z?!Y9+VFx0enXdNdy)p<5y;BDWDRI*+csfU7qAUigP!CMSX&}suHZk2wv5{%#*eJBm z+K6y8Ik4QZ)+wY!t})s`n`0UyV`yQV{#))?2i7>+9CVReo~Hjfa-tMcA>X&w7xliA zd@+NTwne_pzF6+N(ia$o3@)2|7jfC_yPV6Fz8kpQ z>bt`iJAC&sa?JM>m%IHA`B7(6{HOclV8GD;Le}_i_NOu@U=7~@g47n zseZHlu)r_PA36TT{ut$7?T>^0MFAKUFfIV~0Ve`*I-s!w=67iBfMp$yb-=j};em(^ z%nC$7U|Arl0w)JzR^Wm_EDhWgh#i6Z193F)R3HjE&hLokj%^)rvSWECAwvXmeX4vg z%cso;alXmEhz(2%6f#60nSSJxzUO>V6<8C9=8h}$?7Yk`&L7knPrT=REB&yCMj%)QD-f$ZRzKXZf5(&h>g%k-Bpv13*x&JpChc?_aNw|Gq7x0y4NmNEmbx&@waA6l zu5&K5b=f2(JR86$Fkr1xHk^@obtg&-|fB_ z?>E&CY5qC>sP>=lkNN%w{V~5|b4TW_@|oo$WT-$ah6Cl;XClF#Vl(M13J5FFSh5^1 znLJ5GDa5Faim`bzN&~S>87lC}XZS2x@@ktb(80%i4w)#i zMp}q<#yfe5+#?T2#Hitlv21&UjivTRo3S&FSSRA0SxyXhRyk4aoZ#lAt=n^WFIgg0 z&QVyPY7EpH#|@k`N`R3x;qRbXG{l@wzgW42$<{0j^Q`4ITJ0@=5<&E>+p*~pZv)%_SK3jdT-{*)A??Kbl5rva# zrGeGPC@?8g9Z?KK7%L41*0fiRCc$R9x!=SQ^R$V*_6eJJu4yt$B1_V|A0x1fUY7&% ztmL|(Myi2SS_(>y@rICb0xc@vK(SE;G+;H*f<-1;&AlWP##q>Dx7m8$3UNj`QS7X6 zqS!s!jWVxlFKqJK;f49W%Y3mh;7EX=?y4{zSY)m+k#Dt-EVtE0n|;hiup`ldd`Ad< zp=nOkI_Eo);gjow0^gCoXbRY<+sC;YTxfKiaN&%r*p1P&dzkGm^Fp=PWG~G2TIYqD zfT^1Ih*!QhioI8RW4(8V4@UYF_+qT@9AA_N)C35bAaF%L6v##c!|Z%p5TVhSYGICb z+`fz6qu9w@149+&sKq4VL>s8b zbTBzp%~4paLJUM3Ee57zo~Dm6rJg>bc^b&Gt87%;%{GditM}O?;e@v4W`t0+;Hs2He2o4DAfbu@W`k}GkrhYim z?_@u2l;YRshhbL^>xZ@dHfhp=b`mpe=o@k+60c0VlCiK3l^rl5Ft`(%dd}{R{k`M+ zptw(YAFiwpEbfSDL9=^fXrFjZ8rsoAVurK53WHD`R2#%t!xeL`z^W@EdNTIrJ9sBm zB3))m)XE7Y-bN^-t4xK)0gLrbH^^fWp(;!vRi!KBtK|w+0~*^ak4V(FV+FddUf1pO z+2)H){f_8c+UIk~2Zww{`l8&o!WUJ(V|~%qUOCQ}S=%&gWrq=gi0@OZ@20ZD*bW%m zVP^-lb=cbh`#T)!fXw#F!9^$HfYv#%{sgH!roZed%u3v z!}=BULqWgBenKV-JpMF3D3RF1s+eSf61hiVzsfXFW!Kxx()N2&jWNwYgR#)SN~6ja zGF9N(8*$ft3?<0nq=%}eT}`vZW;seBj9=zdfedqkiHT-|iC{ZSx6Cl}P2`)UCb!PC zMp;6p3FN5p3a#cb6Q|8B7Is>DEg{ndZd)#e%n;~yBbFF@4V*Ae85oLiAO&ea6~+J! zm;o%tJ_wm1(CbDlG4}pP&Q{I&Nt8sIvBVH`fiD;#^-+dEl-wyXU#01)GL3~9h%pj1 zX|Hj@z$s%W5RMce4OPGxGypTO7(!+W1YL(a{vu?Sz}2}@mjm$^0*49Qcpn~qTF7jH zfDY(<1+KiB5f79jaQl5i<_di94=(=kFGR{zDP*3&9S`B@mxU}4=+py!uVRRbB7tv` zq@Xg11dv==E`=-;P!9=NE-*M)B1E27h&CnwbFdpoGE+?Co5dz7%~lh!w0+C6$}EiH z#kgD`g!FjHax87oW=PDH%@U{oeJ6`ew2<~8mU_C-$sXmoDvx885ut%t+O@4PRvAp5 zKwFpHNTQ`G)@cLwl>GGh&5z^U)s*wuiYMjD&wL&pZ!X>0BnlxTcmRN8}BT@p56?o=#ZgG&N zyI>WnnMab$Gfs_HLXH#2kmV8^ zs#tcd5xDLaCOz~P27iQNStS{L^(_p3m!U5c+U1fO{jLaEE70j0JpLq}{~D<>gEkzq zHMv`F^!ekO=ikB?zvaH>&$$0_?(XYUi42)9g&Z#sa1-uIlNcroHJ&DiNfeTPC{AT6 zAtwm9JD}5R_%Ko;hSW&O#E~s)C0D-oAs3M{hKvy;u-6GVAHn0#;Q5#F>W6~x?!Unw zc^uC?FXUtazxy%hMTV}v3wLWo8)_bH-=+^IMP8^tw?4QoOK%do^}(Q-r0DbD{I=C; zseQ76*~WYWi;eRJA`u59VJvu)QDf8_m~SkmcRCV?LlV8V2Z4Aq)#RPVE)`=S&MYv| z*niakv4|k z61yO?OMVwD>aw&8_IF9?irlVayP~1n!fx2nZFe_Rb#Lg7^WDRHprJ=&4~*+Ks~M&c_nJEoPDJrwtd9*2ONBZ zLwnEc;{mEQ@XAW90)6FmywN6cNR}#8sb!iNW5nqP6Jx|1NHFq%QfvgaBU;nrtpyHD z?cdm+JB=sFEXgXgQERu_*lQoPan>$yaOEaPfgAPxr)t(sjx7#sah!4@&Nb168LlQ5 zmb#9)n6<{e-y1dk>oseQdx9Gi+;hFK&MVRziQbvs$oHP5b+sWr)BRA@zecl$_=Nc& z%x9P{Dty=aVvBE^FAn*p`*E+!{SrE$ynmHuUGBHa53Brk`s1|!$N*Fa)CHg+U|RsQ z7IxU&5ykyU{u?S#*rB)siaSgU#KOQ+fe7gsP4=Gg9hvn=$KxFl+9{(m@;cXbMnmVw zE=cT>*#-Gs7IneWF8jNnvB$g~$nIaPFMMf(LTYfJGfs34zR+rN7w$KuYi?JJ?b^@{ z3%hOXhArK8bi?j$x!qCNy{bDJx}Wck@E+woaK2wie7r)1aaIp6*<^ zvD=nz$n9R(9pyb5dSG6UB|WhA%G`d4>z}O0w&3@q<||sS;MRwG9t`pT$9m#;&#)lG z1xWtW&i6xP|2TcsQNJg( z4mdaf5m&9f3a76M(;r>(MJ!CR9LGvDI8Mi25GFG8LHIue*m*Q&fAeAKV zP-BLHRmOUQH`u-V3mGNQZ4d@clUOA;Nt}}9q<%iDcn5mZD|kIbVu#wR@h$R%M44Ji z`lc;P$asM(AHi7_ZZQ1FllU}DqJr#mt=JD7!f|j-yeyMgs<-J$nl$(Wlu7>b!xZAk z>bcNZYVh9h^{-GOmr1OX8zk?`uDlQLea6sz@8PptQqqsrHTOM;?}8;FWtL>Ax5lV5 zP;X>I$P|HqUI_XWUsOtrB?Ie3(%CPP%cLMll`6+c)XS-oCDdf31Nqnn?89Lo&)i{R zk9p8Uj+Jj=q&3>YRC}f^WQIWJ+i>SSxNi`idXMozkK;Wu=VuE18bb0}ltL^o@L57@ zVoGQUFPAk66VyZ{7oxqZyfMLhqYt+GEUc@_}Mh0OK$jSb$^re>t8kUrh0x z>x&lOR$q9=GpRr3UNWfE0mvTEFaYb?hqsYFaDFPK{YPEOn>`?R07?c_55U#|I|tzC zfb#?RDgU=ew#$VhuK)bpl4zWbG{n|^7}meAKkD?Dw(3i4C1X{jl}5isw2cgVgy#pz zbWV3-o^yo@8~e5PF7aKE)FrD6Ms%6m4NJP6?1q|t%lmOpWBmSYPa8U5ONX`&INpK#tO!JP;KV>o z3C!t;;*S6J665I-o4cW{+x|zjgX+=kj?Kr6; zX8zYsPIk-hj#=Gj_rRhaN3Ou}D|Yq7!JbEZ;zZBJURcs=OE2u`wZ9j_gHnR9I4Hdj zO8bQOMSR}{eUZ?wM*n~*S8&s!o*310PERcExvD2N^}N_qW-sLT`lIf~^~R*$i+f{B z@1wmD*(a_KQu~#+_nCDC%5=xUJ(1f^=gxOr(s}3~b}s1QF6evqN(SO(xaDPFa{{&#=*Cuds2@>xdVsyeD{LqtA99jP$Mc z#lrq8`eW#TSpBZI$)O6P)KtaSYH%+gUxoxPWOyC)!V$0IUO4X+?ah_b{bu`Nw%=m1 z36Ui)TcF;5xWp!nW4a)|OHvnPbs5ox zS@XM(=#CNHXLV<6c8^6pu&d|6o;cd`L{BvKTG9(!dhO_i{k_72kP@^w2zh-<`yjk; zd|yGDfqQ>JxQvj9l}QrivPxpREKw*|m7Z;EBB@CZ7$*&!L82+BO+HP8mvSTOHCAC7SrzB1g^Edc-HU;P@YpB#qChfX zyqZS#rMa{l-=?rj<>|In#yA5tMmU%&9MM2DGE7!!gwZO#U)33mm6>BqEHKNwF~@s> zH=4bdc%#Ut+6N6jjXp^8EhLrj1Yb<_o#Bf`z7qm4GhkK#sym$RjOZ?PK{(xK{gvEP zKCM>4u4osQ2hQt=tsQrE#Ih@5dvfKxPRlwWnm*LcU3PUvXt&62Xza<&!}>DE0cWra znXciav)4501y>8Pa|~#QCQNU@ZBEcm{W>12O}10&%L_uqzPO zx419H_RYK!HCKAZde|N8h13fj{{aV+8vADIdpobMlI)L+9-Djcc$3?&$ykEguTW<+ zfw400Io=E`@NV|T67M1(H2S3ZVuJ5PGJ}&nJ5OK&P2sZwsyhgoFK~T?fjA?_5VBC< zqrc1m@W87SGMy4vvC$n9!JHySS(;7>03sOhL$;nd4Vu4x>Qe2+XTaZD~&LXH#|BgadW*qdy|^67nUQ+pJSt7HQsjdBCEMlcX& zrCZ3eYAnnpM~@X2+5bk0|DAr$!Z0=(juco$mesYYO<|8Zu7{CK!grc6(m=UEW~Pw> zQHUiMwIcAyYODzsCTNGU6_${r1R`1KF69Ta`cwZ7tR!!DPMH5_L+U7;Ci_EYrx;!2EXL zw93@#w$m!qVC7b}sxz>`PIY3mbG(yDRpthZbzJ3`K@KLvOyro09a!$z>%dvZc?ZIr zbKE$~lj#_N<&Iq!=tEox^QK95j6kD#$ixs=s*5|Tw|41X-+m9DPtXpdSSO1}&DTg1 z%Myi?#yNwT_d3oxaNZH-WNp|})e?`pNFOvw&ev+J>wopYwE{m! zku9}SvBGH#1LFlcyn%N=XMK?esuSoOERiioNmdkHbscVd9 zDx1{-CFCrDXFtNtc6hQnO2#x=KV}K6lNk!b$VYXonyiFu6qk%| zwm`T0@o=a_5?K^VXn)ft_es`mB35N7j3wE97M1{qNNF?NRpJuV?ui%h=BN1bKR4ZJ zU@x_w_xtwuKaAnBgmyzM68mUN6slqsveZ}uk*?wTBJE6Li0J|~lvd#u*(P})LodVf zNnBZiLl%xYBXuXEQ4MUwF5n=FOjMK8=|b&NaVZ;f93qYjEeq{6PHb@=b@GKO?Xfl% z+iPuXu@fA~c8qagykn9B4US9Mm}4t(=$3N?9)4F)@rW)y|BvksQ z-BNT5nr>Nf3pU)6a4Yg|oqQ`6-0G=hdJECRZugK5NK%5&5jfZmr1RT8M4P@X;uiOv(HBemdMcT|o9JQvJfv}Uqm4Zsq63i}*w_hq zea80Te)e=Y&;b#F(SaBqm>Yz$w z9yi(tY#jVOJ>NM>GZeG~Nv>iS&in1@!0pcah5Do1zt$g9{P+9gynl88MhAE*nchJ3 zH61*pk*;wrZdle1Y;^5)A=Br)ACohEvVAbcXRZ&LeS&?F=vz$c+*)5u@%3|kB8LS zDXTNeI!ATk)~%h6cfyIwNHtxux+Atvp8hpvbeY`+ZC#Fb!PzcVT`{fe@~+s{^->P5 z4DMRh^uhX>Iq`?mWzO?LcCW%w9~%?vdXEO+8lhz=j?PS0L|-$yZ>(6`o3_w-7z77m?-) zy#FEo{sZQlEv6uJv)Z8$OtBKXQDF)>PoVo3T--khPrfQ-lR!Xc+{W9d4YYIGBZZtV z@L{~f2HB_>iKnV9GJ(7cvJ`Svk-|t4Jm#xrCFBBufsdk?cAInTc{VoKS>8-7zl0Ry zjZ|+Bo$U&RjuICtU6<1D7>Gwd!B>$IIkH${l3XA$S~V!7b{*E0du&jtKsJhjR0>om zHY-i!Tg5iAyyyF1k>24G>p-T<_ASloFGWd+~A=epq?QHPbsXN15+v8cV7lvNgvJKkUDR zEjaKZTejZ_KWz5f=7$9TnE_Z4ur~mE+d0Ui?khyf9EoB%iAOrQGcUT6p zfnty~Y=J4cU}ZJltm)1J;kE)wwSitc|BvRS~ZgOE!EyaEyU2|f>#LM|2X>VhtB z#|{`S+YNy(wDfH2iTp|3XDsR=WQZU;VE;RD&qw%nsl0?R&_f6(*R5g$`%q@0 z&ZHekI2rGX4J4bFl04X26S=(Q2p3puF1CgCVz z?e_?l`?XiyD<89AV4W(WyEqKQn29EG%@Px(W}bzmR;zBuq><({^CD@UvBbb?+Kc63 zJLzO|DVFPm=I6>aRN2~2%Cl-M)LIiQ%(RwTf;{6UnUhT{G0&J7VrAG&noMq3XUrj% zkgCz=Mv-!Z=73m%0r%kH$B-g(BsaY0VLbK(UPz%& zwOWGxk|xXLx^gEu?TBz9 z!kOwso^ytF7i;vT0GBj@JKn?RKd|v)qMRx*i+0)vyU+gj%+7JI4hm(6*G%$0%s|d zqu3}nm~`(TeEKCrkA19*C-Ibqo_d1`PrblJxk27JnF6bg{)% zm28#RNrr?&GEO0bY-4N5ophaX$Y735q)FJL;ti}c)@f3KG0kAb-V9nXR;ow?$E~v# zlS0fe6J_KebHq%xFwAPDM@@kw*#h0J!S%P|))`tQ8EGUNNH&I(z97UzikYT0c@1(N zh1u6CPwAQnIQl!;%cl;SIeZZQxMzu-_()FyDo5?zJ zSYa6X8B8}88CXxdq;Qmw=jZ{7!kBDfj%a=fddJ0{HaZrQBXX+~JDq!-IPVP8SJ>#-?ZByjQ+Zeo)0)B~ z?LfUT-M}JanSl~CXoc5Kp6l`i4j{~Ab=DmNxp?day!Z|NN%M4pzymMg!(Eb{s2bHV zgMoVb<&GJ9fhaSBy!{(Y%rIkZt{ja&rbn4czh&+70ABi#8|`9m-2(F6J*6*}sOlA0 zC8{(MF+5maJFpi~Cf8?BaAJcwLt~l0!&t+1-Q9TpHGGjuE9Gd3dGe%0l1fordG}xO z*QfB>7YJ5KnvyDW$uFl^Vl=%@CuOi=&DnJ~;>K6nm#jGL2k=`IjnE5DXP~I87o>jZw(JFrbkfy%y6Zd<|>mh6=p+ z-x$(loMK!4NExYtF)9NXhDI>?JQ}rs$3$zU#gryq6NU5MA9U%~^RoEq9Q+Wwl z6e~IMCR*UO7x4b4`0-~9l@Z#Qt<}!lrj(}@Q)C(;14%2-e@3i{A?Q1A>cGdn3!hH zGm&PI_AicHzjl#t!!e0;4r7QD$dvS1#nCH&kkqm13d7Y7#qI&I!CYHH~%;mRVTIQcAo)o+>3% z#z>l_=4+P&Ce2qPwc|j*AYPplWh$uwGbJyTcfO0yA{4JYPm`BGmSDbN0#9d4p8ly> zw!k)-rlBAFAFohL{nMoG1tg{x9ZIZ@H1m>&R1~Uxf zNx4Me`O#9yQvJwA3OrdN*=LomR4(w>c*&Y@LPvYh3e8+8@M@71q}Qg}YJmmD8UtsI zFklz<0f)56I^0B+dCEk*6;4j}8*Ci3H#yMiIHWb$`zTI-b)V|K7~i+PFQ)cw>C2k! zUB4%tFwPq6fuj=*L|O3`>ibUZi?+TKuEgdm&s>R7{Z{tl<{|C~H}-Vj-yKK0pX-kB z9%p)>=!%n9U`WrTo+#`&wkIa`jOm5+UP(bH4Vn;yxk1Zb)umH9-@CFsyfBZ!GKM>8?$W>EIQZ z*t4N0k9tVYsGcbAS=AFmf}(;@6;u<1MVE|gSZ@^mc5uu3aMN&CybE*PC)_wqv03F_ zd%SSO>x>s-yi>eU=w0rO>E1KFvB-NmB^OxYgB`RjYwW$SH}>>C(i?ews`_AdpGAEz z;mT=OV&#<^uf&-vWBZ|~->7~UFR@l%BHRmEUZtcM+4cvQsQ2{l>A2L>v8T_Wm-HDW zw@B{1QO(sZyeZy=-Y6%3lREF|-k9mV$eS6eyz4a3%u$5?qXU>+95^-*hXQwWLVb7g zTdNj08hASJBG%MpPB(;iukX(63%e}qauGYzqv#4I$Mj0?#Xw`w+#oh<&`Uj5;8B`t z#_3nSMqn7oUA{)(jEq*8qJ}{bHm4nUff82KYWDF0i{%OJCd(hv1Wm6KcziIzR1$4` zIC^4(1N$BEPV98Gl9@A@p6D=dj3%RNz0Xu1Eb&?I&jydj2V;y%vHv&DND58LFmery zGXAGF%Z-gDwsRT{J;*F-yxaUYjW3KU#m=`;Z1Zg#bnrlV`l}OYb?M_S+U=e0$fTy}?x^aWRqv=w}=^CBkL1$`omeAv$CA3>#i8ac? zC^AkqPz?QQdzS-s?lw1DQ0Pu(3na>X@&v3^Y#;dXS2QV-!)6OKsM!j+23b>Q3tV{v zZg>*EhD%Jdhd5a21~)6uUL=?5d3pp*o&n9*=mHPAP@{`HQ}JSrHVd|ZV3t9w;KrJQ#O^!?_ zQ;%A~Hip>cHtS&Mrk4slLCsEjm#F0mjjj|pWQ19Q0Dc)(3d~Ro$$Ge7F}1`! z%8gO(8aEo;^T=8EfH#KtrTTH@Fp5$x_Mhc1Zs1|p4Y1GQe~ zbk!_U^BlFJY{c5}Hqz~UTgX;@t?dG1>D_Kp%N6#~4mra-Y6+sxqR`>hY9CPST<>Pm z8QSE=kb%39c9Iw9aYVX+MVTok*4Y$kw_V_dJ8|cWSnn?I;x1Czb#}!JB$!p5Zh0rh}k7DifrCfjim-c?Af|%snG)F*=J+{ zg&0TaBREWlKIz^1f_pr_*Ite86R1>G2KE_ACPtXWCT5u{Z9(*0!$W5*%#lnMH;RS# zKkI*yw9%37#s$(OXS$o~3LK*xDD$1-i)P;?zBudKq}z;gG&r!{yUZ6&{);u~O`3`J z32Y&Y+&-D7xPvP4!kuC4GZ;%UN0=x!XX&v_p)3YVe9!s{xnJML0fE2&h@mn{B86Kj=;8A*qj|%LQ zC&}@bf*OwL%Hy6F{DekN3FI3^hLEQPZn_8eyo?-cy~Suco4(IzzO(uVKj)GE&e5jf zjKmp9A<^eGPq4&$KME=q%Ow&k*;9#!&85lSgU z&PXJvM1{#J$3V3)hTNbJ07tRH#7=V;?PgjWh;o;^1vOZB30n&g-%byvKv)m|0g4fq zdSVZy@g^uFs>uomcrFW-$T6x7j4?JC+~*2&C*=g8jm%IzvM{Md-f)dZ(DR(D5Mi7L zBFqF6sTAB%M#|l#*N<2p% z5U~=uMxlX1ql6-lHBY?6uluB+ve8&=V2yEtwp?X7wipKt95#xQ}^Cb~<6Yjnb4}XMD zzr;^@fIgobwds)BgW7?UB>S zwo`~oa1W2Zh*v+xkG~*LLSf$&LC4(l)Cz?air$hD5|6xu_kPi$aETlvF;0?tXoSRjf5UfwSnQZ$&vz*&`%27%he%O=;)5@WPvTJB}7pwg4q7rr)XQf5*=ks}7L9(^G%f z(|GO$y!p1EzS9P^J&HMxt$K{HhCy=&p=HpXLD)a&*dT;IH1T1~c$hgBYmS(Q${xa) zhuR*($w%5A`=0JgCiUW;~1rDZ2W z;ymp{uq(rj!Z&ul!K^v187?%r*1NFNHPnq*cZ!?oXE`Nbi9~`|x)+9fReNLgi@7gx zT|Fhj*y?rE3q!nfC<(@BZ>DE@4fkT8%xAO@D#!R>^h<=Mt2?8 zmFc-%3c4^bq1)Q-Xu3ajAY)s*g>^?<_q^^H)qPHPEbhLtJJXY{sJ{YB?<>9^756vY z&!o{k$Mr;A&*ol8`O}&|F=)Q|E3Fp_dQItt#$F40F}=2DT~7w)1vLj@MbLrX zXzf300FzDz4eyPj-nG3kz4wORXzjhHH`A8}tq5XZ>(y;nBjoz(>rr=o;|)xjbknq( z(0tRfn;5$QOuK2(O;~o*ft%5IYmELNPTn;9W)$6Ado!lryy0fF-n{2#Zj*j{?(Imu zW9}U|e#e3z(fe^28*X#I2Dy=b_1?Y&GY z7})w3297*_;&DVjvG_^GHa;EtEGl0(@&aSg&s08x@z2bC2Fss0@C;5obN(5o2S3;N zJOiU&YJM4qU#oweu{AH9ehHy3r@f4Vm#4gp#+Mho%=BHa6u-tm(wkXtqV>%^Z{pya ziEkt2oi*<;J?pJWZ(-(JE8fE9x6ZzWu(xCNteEv?!JF9k=D|0aYwg=9?+A+f@VQ-3 zh#D1Tl8bU(jMBwuT~z3zQWsUasMf_8U5wSmI9=4}qE;8I@A z??WWwX^k5#$4NnzAtcu(82b#wU?1A;f2$uB(uU8KcxIm5&v za~lPWo;8K+fXCiMFsGIvkO+yKxu63k%DIy822VMZEyW!$S&_l00}iV(2G#FIq=`5) z%S54BXQF}kcY(O-8r=LTqG$(~LqgR~IYtQ?h)<&^O+pSOZ=o~|ftby2dq>>&sE{4m zfu$1;8$%#uC&WrJ6n8=#=OFHcNYW84S78QKHmK!F$gbpm-iMsUyQ0qxxM?sx{vQ7b zmI$N0P@XKIy;OxnEjyI!)Cno{tU?4Rb9AUcR~?>x??55L1Uh#|&~*$2_2uH3m)Vzz zm?H!NIIwxw>$X-cOcXFIK{`TGcCOIGRRW!R3b|VMvRT0CC8(h0 zTQqU2?q!>R_Z5N)s%sUv=K)qK1zf{L$1Z|ZNgY`)Lv{NFYUL4$W_7?|g-o^@t1y-{ zS<~5x@Ble>Wg9qT)C1Eo2ds&C?HkP2RmJvrVQi!zN%WPSHG) zY$C(VHc?|n=g*TVpjIp;)xD^v`opvkc-oEg5gxnQz7xvt9@E#nw=j1&I{&U!$5qxjh zy@wc=G&zgqh$8eVOD70It$$HZ|Bd1|F!#-c zZ=(6l6>nnX;EKVh9$Y&ZYu?-V9(KLA?>!v);P?kP{?VC_u<+xhA7k++%Rj-qPZxcP zvM(yXz?d(_e}Tv^e2?iZ{;mFKd^O=U##RNk1Y+Uyd!EO^=Z`&) z;1^O}WO`Wl=}S{s31V=pNhyNAJtJ9|iaCx*v^yDc1C5 zJz9Do?cSOIzd%60dr^Py)O#`e-Zl3ze^|fReu%h!@AWu;{o)&#H1V1Z*I>&vJFdb0 zYr?K$Qr=xN?!uhA7T<-IyAI#Yq+|DI4@AMhl7Xlk*!UMFjeM~AL9Bjo*k3W{uf>B9 z_E7XgNPcM8LtL5mY{+v+eQwipjGcXR_ggso*4(!l8~4u2cd+iAmUpo8ozw3MnJD4a zALP!c=N8&HcUj(5NC~rF`-*mPZJUjDS~g{J=al~`7-O1R3jao-3jFz`WI0I!ZG zHAFE5#SEpKwG%6toLZT?i&MAouMHyh72yUm)I-7|?a`2c6LdJQ@g;)XPn z7IBo=qiiZi*;BY2eW9GhIOPNs(i>gwrvF{sm4E++{_j#l4MZ6k z2C~>cF#u)c*)t#8ft@%>POwQPF@{><7L{8Z+Z`x!mO8Q6xy*^Zt|T{7C`)>YdxD!5 zz$WmUVHyW!! zc!e?1z+}!?7Kq74gF$Qb&G+M}ck$s*2$o3_nQ|EEJr+uAmRlt)%-7zAyQ8I$opJpw z0yZc7Q&$wY~na;ieJT1Lq|jw+m{B#5y_ zyn%d*WgKNx8W=}bmu6B29x|eUG8_d$Xir{5rjtf!%y(tDQBJuj7r0Njk?xh|jd9+^KB)0&@xfl7 zXkX;`=KEqS**>=Wp72G2U$Gw={F?mG>euFnvwp$;$oH@E#~lBo{y60y8h{u|vD*;P z8h}FqCj$`Cp|%4ic9_`#^L1W;%0Mg(Tpx&*z=V!S?U>$?9?MK?o`o^?PMeT?b=fls zHpq3hJFdNfDj#_b?|;s~(|GnZ0)8GsDyE^5-~`f#=F?8(bjR>cMB&^b`pxZ*268c7 zrpQB+kVb_$EG=|Lh!JZb-bgX1%@m{Az*1hjyCcyoA~R6ANi~P92=a1?=W(XH%3K)b zs&-LLhP#~Nn8&yYIpI$CqH?HLj2Gg(G?L~$&YOq@-XpzH?m?n`b9|BSTkK0UZGLC{ z5bPi3Pe@U~C`wh_5P)MHPxC{n46F@AZQ#N{tPgAn6tWjO2jS|QgzST$t8v{^cr%5< zbVpLy`g+PsHbfzcy%hVRLl<;^39o$6KK0I~4`GPFX$nY8A;EdO+Nn@ZI@5W^b^~q3 zao{A*fwS#5X!?8u%XQ@uO@HTouHJ66kp)Je|CbmdSLlqspA$S)vb*42f94{ObF795 z{GD^dB#}z6T(a0XN-mNtcy_%KH~$&;zkzg~j>84Ukizen4AV(-a%j4mKp*=&3PjE^ zY7Ie>>QNc25JnPUl0h-m5oDPUH4tXdAtI3iKmAh&s3y~vV>E3{>q&&%VC*v3TmOhW zE)l7c71GpFg(a+_j1+kA1FjA>W*TVZxglC0=n*{rKF-M)oon{vFVINp^&RpIS#t!w z{0aZ4rTjsS8vo%^JVs!sDx{o3OAPimJZq=B7)Y{~X;=F{-Oc#pFLRM)jxrgjWq~nH z;L85E@eV}GR!U8COsD)=WUM!Ez^F1Yg?#uH&=CbS)(H!Fb_1n-*+}W)V<@F;A?0M9 z;6RwO+$qR|@5uk7R>5|jjR_nY94|2JGOWQ~U}K{lfHqdC!H<`5CI82!z&lnVHs7dUB-iRm@@igU);F8GZNraUPgX2f6Ha9?*9ePrKyNW|fJf<_VKW9YaD= zoFmVH6^?BV>~QRN;DF<_1Lqv0oTzq=b7He|yKbIFk(?QhVGguh;63O#rk^Oa`No_!9nWKheY2RTnJlh`f~Nt}`A zB|>OhSgpp;(tKWFC~L^m#6@5|n*q}Vj#@dkAYcQ1UXl9qDyD;G>K#nK?O~i}C+IYR zho8lBu@bqYVVg;w;bG2XCv#Da{+%z7=yy&NNR~OYrJqTL&g~RWb4KDkx&8z@DI`CQ zT$rlKpw+B!%n_`+8*NN5kYg5_-1!7!IvK)N(r*_H#9<^b3S)paewt~bonyI&;{sj( zx@iK_Fy9j+$6AjTN2|WO`6LLh#2VTx9|B@%vpkFKXK6xLu4=F3p)4i-9jwGj6WEF! znw(DQ;vJnd`CCAc@cBE%EDRzu>V7`L{%rt>b_Ewv-eff0c zqGNY1dJo{@hMNV&wD|Po;+k7<>k}NhvVb1Q8Y4u9wX~T>OdK~eEUtU}O)lR16u~6! zm6ED*9HlUwNck<+SQKTIB`%Vf`+}r_<&u1}vjoB^%srOgqvh5bOUPjYLH%*hy?Amo zWnEY$nbiLt-1{UeRy>uj;;r=(Llq?=9WL7Ia|A7nFTRYAmPu@tlMF02$m2OjVBm{* z`6CWL`SBM-(7L({`+$Qu4xGYF6Z6dNCf6sC1)YQO%gCFe5xaCCOA67;NatH6cS|g3 zr+@hkzWJV8{t_WMIK@8@SN{n&pO>gHC@)-|Akwoh;lrsCbJ|JgWhmL1*OEw4V+iuk z7K6AL^f8(^^FqGB$K(%_FOb4=LV! z5}gmK1`Ca(COKd=I&j8O%+eX+-PpDzyjp7F(b-!wne`%U-5JijG=*zUK}4# zm&+u<^VAZ0BF8BuezJizowhSeo9mDZ)4b+*q1d~^8^Lr6QL#_G52pI;@xck7vp$IS zE%C)F-*vv&=X=l>XME55Vzpn39}@hN{gKcqwG;I}mHp3wG{1U3O!u2dDVtXNp~Y{z zA9nhM_#>=SG+(jMZ@eEhSQs$81EzME*+EDXSKo}=_DCFMA4(ISk0dyfq#*K}GV%F$ z`1Nv{g`T$yY2m(?=>N;#k{)1igMm_$^1|C_Fb+`=Rk}$PK{sQHNz;V`0YSKvq)9h= zU5S2oMJI5h=VXZtaX{(*C#wprNUvo3nex4)I29ia*@zm#tK^v%Y z3u|G$QEJRFXp?>8EqJh8qJ~mKW>S8?e6`%bI%9)@RwITE|6#qxS$&XIhb|nke>{2)k0d(_TzVVY~b7h1i}crmGx*2XsH87JahDJ~3iF~SzEkXy;y$l@HRg98$*LXX#W_yw*%2X(NEsx3KWwvC0LQy4lv+de2`8Fg^MM< z1pb|nLaK%qPOW01-z#`MOnN-yEOfdKe|ij0{elWvC+Syx_alUo7gvNN9|9YJoe=aI z-h3D7yp^}N){(hE$JR1qq0^J{oJ zg0hj(_GhR-k85$u5XmYJ{vn1))^Dtnyo-A7HM|ibF`R^kLb+a|RZdozOJSL-RhfxO zbGwPd<_QyL*#|64-~jESBFS-Sn2|?o$|?ivjm-vjk)i4kNeuby&=o1r<3`+`sF10S z>Mhf5YMV{+?CyC2vmWQ44c7%Sry2Q=UP z5FY+FRpdb8VXl>!Dwj*Fky|NllssCa1fG5e?|;X=3?XA%g(L^2Xv*%CDY1}K6-86H z)L4lY8Lb3iW63EgMo~VZ7=a#l;?Ac9L0|rWA1EXyM(EUdrEEos69}MfT%5pPKEhWe z_ zs8=%-=BpesC9O5FgM{aUX1c}Opv@%h9Uz@hh!J66Ds8~$lU`yq9g(q(_DAtZfljB| zAJ_5E5~K0$v|%o$Lj~p$UpPE;&(E?*VKv3n<{O@!%iS;F=YJxE-lQ^mP7@>rGNuaL z|2UrbcXgMtPokLT9TErSG0CF#3m@W>pBW0L-S${HLC1UzCHJR!{I;eEq|)|fJ^v_a z0+r;46r(6}db&Wstt_ae3w-t+zN3#nU7&zW)aCr}_52$BXEgjd?Oy(mWXzlNTB8I5$V+j@CeYbx3a8<;SZ6AASFoz$H=i;9-Mx69GN&Xuj5F z6!4=;rg^&1Ko*BzC)3V?o^!Im6tz=vo0F?2Q3=gsTmF%rwyK5qG{43T6CL4-t6ULpvi;*-rcN4`|=~fFFa&QC?u8 znxe2=ZB*E-b}Q^rmHMRIlj^KOtl`0y&_mv4P*TDn0tbzw28MEq!VrOgPAn39{WJa< zED_?4QcaOqM~nPU8KQWOyBxdfS|(om5FUDrp(kF% zORqBY>Rb5gXGF;~-RaN2B8@jnp@OYn%rix~Y-X6>;`B=`V zlba-V%P@r^HA10UP1hmhe?W>gnhc&+^RNL7Tz?xEw>`s_xuF6ty^X=|G412eu>o6v zHXPEtpMQ;b`Y}t`pJpf>zcHN5C?qKk708h#S|r*;OA!fc+)WsXXIjh~N-sze>BFk^ z5T}!3jMi7?oTrv*@;bFiVIMh3M;NiXjx)yVmvE>+tJUk^sFUX;KHRYn#=4>s^ktXFFd?&=Wj>&uL0ja_*a6H`gZ&E&ZuM&O}`@%)Q; z^CNu!3oo6XqGxZ<*Bv9!`_K6EK(2h?Aw2vTLr*`CSKnml#aFrb=zA_m^d81DdkneT zOq2*ylpZ2RU?SOrmr05diV>Jb=NrtGOGryj-g_|uZ8B5|%6o9xm|_KwDOS*!(&cc; zES@pNiuN(ZiuN(Z3LaCe;4#Gt9@B7suVV$qli(SlNT`n$m_#$0>c>@N$)6Aj2r75T_jmOFO^g2-EZjp5*HH zKjGqw@45K?XD;}i8mAf*X0Q)gyg&+B;71$e(v~3b&b#>GCw9}v2(pVc$s8I1xiTiu za(yXw+r2Di-TMk&d7Ys*-@&^d@Z)Cm3%$P^Mtd=mvYGhPFP=9r!ShH?(4u&N#hnB? zn~Y*t5@>!}pt!+ewOV0=+M=lts;HumBo{|I#*@-hrpqj;-WPxx0iFlbv?jggZ ze%l&k6NNjikvJ@~75~s^RL!(p?5C{(O=8J(@%9F*F7WQt9BEpBBtsS}t{q38 zz&ctPNLJL_nlKfoD_bdD73b$Yz~_vn2)%2G<9L)5fibFv#K1L|JgnX7fD*Kw{#OLO zO2g@b#pK>pE5V1bucV9d(vU*YjniqD*-A%GWzddcy|LFoEaE61&wOA7nKzH)EHH#p zBBhxn+O#&}@;)zicldwqDOdMYK?D0gx4P}me2@1IUNYbi7z`#QA(jyffysj08MsGUS-e$JE;O3)E9>|FgX&jB)?Ivhg7m!H3MfcL_dpW ztk6uWK}Y7K3M6riOPavTuj1{mInqCkrkY~%I+-QskQp|K48#rOU9v)9D>`NQ*U8FB%NV)p-Wo4+lLhU--fif zeIOBJw3_fAhkt?hkM8Y4WeOGoYp@>JOmh4QgqVmj<0;!(m5D~HN!#|yFK1(pJhPBe z8eYn_nB4f;;VhOC!z9x|DkH2q3sbE|-O-x=%He5LsrdtL;=SkBzj6^yGI$d2h|*{+ zC?@ZX1~R*DqGVs`in+#-DR7Qltkqc!B=~G%`7w>Mfsh#{jr>k#Y3^CPhNcOuP#b7H z+o~{{x8i96dlb1prU{(pH9SpcW#Ws}8*4PM5Nqf(x)g24U60Mc7FHvr3G655h7dDK z*X=h?YarB$v=C{<>RXH_@BTC^Q)8J{wg$4T5tg8HIR6s+18b&(g zVo71%nF6PsVJ^hEGF+&3CA*Q~9_~iIyUdM+?&WT*b8m5D7x`EmcTe{c)S&qf*jn6M z+*~>6J1$n!_Wp?EJa-8s=@b~4Xp99WqLs1??Ey~FOOs6J!B3^|=3t$qqs_uT%B--` z-eO}H9k_hl9_PSD%8Gx)anykjI(j*gyaq=(cj?TCoAkwKlFt-4CrOgc6j-Cv>_zK@ zhdFu(JB{CT&BJXbdW*fqW-J=N8R&Vm4|J7@wU>-`lZ9=1$mc2RW0d`$2U?;#ZUJ9r z7d?fumvzqc0{tX@-}i3EUOn7~-&bc=vkTnnP?A{#|EC1J=E*u%L4G6goP zT?)GtCF95xNHEAdE>jDS+*5&3M#;0t0V`9W%&0I>YfRL2W7%&vQ=pYi$M`?&Dy7dE%q)tEBlbXu|xK8 z4Xkl&bRf!^sPAyEYh#(xP={~GgomD(sAXG(AUWzo` zPk|b#Fp@P)!v(5Ut>WCI<0#_1kxXK1SUAb1q&0`=nUK;UTOfn1Z(}HuZ89nFH&QZ& zvvg=_7Mg&?SPC3Qgo$X%^OC_4+}Wa?ce`;3@3~9Z$Zs%P{1J&1JlUk~i}Y+Ek|e3W zvuX2^P0r#~k_Vng;z*sGrm^Xg)VkRMv*ZFzDWUCZt)jfX*#af1jCQb;4ubBGj+WX> zIZzvnMgvX8a)bLktD?x4l9Ykjl;tPG;O!l6=&+nuzifeVba?9&_QIxP!AN6$z&L3j z6sh2DP8w$oq=NL<*#hT{P)%;)LmaaOmg2CcM3~VebYabImg*hSIWIW=*g# zna;OaWF4_^!iuD0-lp1^PUr3|vX|Rvp~dQ)ecnd0Bb7p-Q=B>-V3Bi|6X%@;E>1Pe zgDOPj{}9g5RFV$gnM&TSO2g1l4x5qeW;533w9$K7{NUB9jkCQ`dR=R=F#yErPYWaMN9DzE6 z@@LUoK%dZdV~>HwSWcc($ACCqopJ;sDI#V+uX_aYU0v`{aBhX|m(v%|>CF-W3 z*eNzrINxKAz*Kv>jV61M{xRC@Q#Q`qaSo(93LM~dY9bx~IF0m5 zbI6jtkWxjgrDWH;^k#>9ok|?@FRx58@^s||fTp8df%_iCQ_pgy=AUIBxe!NrF^F2 zNY6^KqPYSSDdJ$7qTJBA0&~=SQctg-Lu9uo9tG)u8Q8_bdM^3R(z}#PGcbjTRcI7lg41Qr`xG{C+>6I31LNt#LzZl=O)y53^7gcKwj6}Ho)8D&h+ z4Q3F>Zz|Ia%Bz|uE&}xQ^7PYtj=l7rdx?vG#mP&x_j#9T@ACvk$WpSPOw_J@lX;fU zBZV&cQs#JJrOMW?Ul z3G7u-`mQFmKeTzqLhT(mk2IpIB`Klu1qx^xnM_ZpnH>B!sx2gl?k2~!BsxcS1}zgS z4Xh>m=}uCR95fCaI8ELv36uqSBx*g|h&F_qh%r-4WYX7IWmZ%2e@756Aahw-M!fugdf5Q~o@R!l6IgS)T{9qgD%h^g>k6IR~^92@? z!f_?NE84u2FR+Xb|J|Y}3tqlpWgYjrPo30263LEP{MF?PP_qOy0j6 zIj?)Zz)CV7uQN7kuDvv|9%qAazQAG54xcX&jRf#jh9Or2xtvltUm%>0GH5Zk>3d5t zGfhugoqU0jw5_i;>vY{hbEAoqoVBW;{Tq7mHIx|TBo0h4Fo}hR0)Z*)QBm;UXP_;# zD3H5f0lk~kF3e0@6k?1lorC-WKwnOQ{&Job1kt=xKq;5mdo-Oic69V&0ePQ{pwJrf zFDeiyC6h8KJ-O91{$dIQX0Ufk!DSOqLHop0aM{FDaM{FDaLL5OUFtcfKwyhHrzz#E z0xuwcZE`6nY=2%ay^b*?vDA@}HP4`UmO_E~23d{@#ebc1b|{3hCcRKxHr?z{NH7Ww zPM&-LpyySnpVxC-Lo-d`@1IxUWzVbdvgcLUKEu!j`FRyyHq{gg&s0+=E}d!$>F1oG zJW~zbVf$3W1JScgp}-DB2kI3H&oW;q&}hsvge)S#ezn9po@I*uznNv)FZ=(WS*A$* zhgqhGEauq~(y6*d zGDVloGDW16JxESRvXn>kDxUEB%O>97-@_*FwIzK zU?Bw#tz$Q*5#pjB6nEZc>@#qLlNgQ=IA9#nk$H@X>qBcnCljEr^y$X!;xjh0$q9tN{N0zk`z-Sa6p|ByqZ*a3ZJDmU=(PWm11d`=}-Lbimhn*ZwS`O-tl z){!BHQw$I}tCR?okbh*AoGh7Pw5*b7zJInC`s6y~om)D2bFm`stPkWKn*}k+kP+Fq#aU zHzM?aNAQnWB9Mf1P03>Eqg3F4%u|8@I=B>Rw0R#+sW$TIAf-y$In)^o=){&b1N)8R zlvzKAQo|MlvvC&OlpA<>=lqU$31`PC6&C?|ex>4f&#&~d=T|B&eSW3w&yV`y=T|D) zBP3QSv>E#ioH4@ncs8rO3daqKWh*5y^)xMsNd}TA#jf_BEhQDraB@`1H;{r%-LRM< zv}-6sF~<|dfLwA*X?s9XFQo!GDD-fGk|B%~I)P#hOTr^b`H@84dSxW&Or=9sRvFl6 zv>4cDL;-VYGrAo+fjx9CiYK5kicW#eGcnq1ps8gisUNZ|6zRkMYb-R74q~;{YN5@V zXk(f^hw>hkIxyEUkHYC%Ng+Cvjx!qT#BAqWCl)w2JNca4C>qcI>&qVazh0JaFGt_h zqzg9{>$$1*myMmrxkhf3h)}5tN#uK(Ym|~ov%)|%{TL?@Y@*d_vzWJzzEL`Whq0-~ zbOWncwjC+h>ygP@*@u9B5&GPdXky<<%IH&+B`M3w)m>F$BCyvyWOAE{m(DNKfPDj^3Y z5HeJt`_;I5AbGb%6D#ZVuy3N3tL=eZdAG_xv|`x?=6Te)san4cc}xbH17l_7CTot zvEA#K7t*|kX|^5C{Z1Tkop2%8o$1B~_i8V0K7m%0UB)32a8hXujda;cNxb0>@Rp_P9=EAK++G>V{KBn-Gf`k2><53~X}laALV@ zi;J-`cO@Nrx!f(tE9$!}I^AlSL>R{e#8M{cM1>TUrjVm3@pY^~(06tc!ej?+34rHJ>~2I|axCW5U{3sF{_g)+OsrfMc%M%hQ%k>adci>f`y zSVkHwI>g36gVnnR9=p&o#(_jSHEo+? z&mT39BMGO;*hMEkw)YWi{@?m&pmltvb1skPJvzq7LKZtNTZrNB*+Q(RoMWWs5(nDklOz&SZkZXP#LW3@VP$Z?8}XCLdNXt`DLoJ2S!ovBj)3;){xiR+JUb&_a>974#?p&trRO%qYgwl_#287 zpZ~BxgX{Brs_Vdj*CF9HQ?jg0=PyJMu!VL&r1?P#eX1m& zBa0S{1`@Y6dJXr+a_^NiA-8yQt1@a;WQ-!!=PoVL|K|o-bYkisbd*myEe=`nHcISD z8x8hh8^O+ECnmU0xl!Xa-ixod<=@aLkHc?R*OCKeE1mvO>^q-MvsmQEU7RGtWfT_`&PvQNK@IAS7MhQIiK0f*e-+a#!PsgrYTyp~#H{8aD zoyG~K#|fs#iFSItzypKu+)H@-Q$a|lu3S*MyLf>=-OAXY=kU_o_=Q3e;{{8W@dA%O z!*!p2%kIlQ{s`!Tp8w+buUqfu;+&8 zhZkPqYPT;JAAF5(e`e^1pV>V%;A&iZD{dc%2Oh_hFKJRIE@PP)JZTVoHTyt-cmz8WZGt^T<>9Dp(?(Q?6!;%aLf(*JqN~-Y9vVA{8hqAd>=r zi{)=forAc$`ySvTn%rXYDHqr|<1`Rz#%tfBMs-r*v^uBVnU6`k=7%}HXSl#i6k(Sw(4!Y+1-XtkWjO+Uug6~=#FJ0s)xr4mGxAvprl{R$5?l8x z%Hy6R(4!B=C^`fpN8tLu;K3*H^s6Kre)c`veXqZXi=XL7%Ml2d(UJ+1D5j%;p*?u`T9Q9elWN%x#yp6@r+AG7_>`6DhM zCji9(X9Ez{A*>VjbxG}p{BE1NVN19C?%314tOv&Q*w_PSdqnj_T+fD{$mq4P7xwik z4?2fNxnAKxhz}~i1R-BHZ4KgahWlT zj!Jq=Y4qqD^>az>fX1%BfAp6=mtj{RB`9BC;bQx+4*$97njSdYBkd2Hp1I_L`?}#^ zxBTun(>;rRh~Kr!(J#l?uKXNZF2mM$-qsoWJD=~2j4nA{nBn+k*a}CCK8AUPW3z+n zi^wOll(Vtr38c9yTsY`D<3h7L--{X2TsefTa5HwmebkMk?vol@y*X{yqmqT)O)37TGkFk`6T%u-RF=Gj`^hc zVz_UCFU|&pb-<=>Te=~kcd`DkQhbN|qQE!b4^#bT`{P7Vf~KGI9}>V<9TE_yfw)eY zotTo@DPIE_YPbAuDC;q%2iNC!-_so%dz{r+RL{7c z*w|}(FRp9onb8a7K~4I-SlM%3Pc~8a=ug=>pLiCN!(fsqFooFR+2upHLN}*>xOh zzQ9p=O5(IUFZoJ|igL{s@MKM4Y=YoNpW@=F=RkpY1p*)aoe3Z7;)j1QMs^$_3kCWP zq`^G(G+z1?t!(Ho6!?2QMIq)=1VMwu5}qv!1!l|jlr!Tj;J$oSxbtV`4Y?JN{JRqz_MHJC7r=3N~jvH zkg5~g6)KEU6$<0Yn`SyK;ET!bQDW57i82B`25`6czK#WKc`6pT_b*I(_z5olF-)S~ zSfIIChAF1ykixEuDd3SaD=n8gJZB5JobII~m`Oc^bd^Qt(-2#|f4rF0fW z9T%!m3KeR+LLG<177H};Nx=-vQ*4yE?Q<@C0uazqkdjxg_&1U;TPCoPxAg3`P$uwA zFr~~KLy8cJ_bL;(;$=S2_vLrF2&Uaw7P|?Qk#3W+qLv9nOOhYT1jg`|w2T~W*Gq1Z zLSvl5Sy0OaQdEXwGL2u*5yAB1j1su|cHDWdpu>T0xr2*`pXA~ZUHm{QjS7JusjL*Z za}YlG9>37#EA=l?DKO{*&udEXqk@X3U*O{VU%1eLos|M>$;EFdkA*RMdnyGd@Zl4Q zpLiMXL}~Eufq3~1Cek}xB{1j-KIrwXL3rwUh6X)~N1xy`UnxbzIC}8~6+Qu6kX5io zu&7@v;NvH#=-6A(`L2I`M9`_O#91eB@BR2CRU%K4>sg(^m%pHr9Cmio?z$)MJ;0GP~Yp?oYl(8GS)@luTtI*||5#KWaUdG6HfJn+A60_zloe$@*sBLA>b z&J}(U8wY+$lu(pUq6Et zy8*Y{=|T9sS-9E_DSK}dQsM8D6z20uB?^D%=+ioRfpCO28DnVQG25PR6T64fKn@cp z3=i4B75#AaJ-B}`KA$N`r>gOR9^6Fd-spV|uKN|o6=|1DPdJ%Qy7g1u)v#26WL{$GNLO!A5j zvld%eOmKb_htRN%24618fQ*68h!`zS~?PbZ}Cd4Y8=FMX_w zce&U}(`hlM*$WrAIfasqha0SGNn!I+xWEJkA_RKei}l7jo%H9XOW;r=lBS&svYk>G zWrV={KjE09R8bL>Glv$WNI@B5UZT92A(GEl!BiQhkVNlFJ}ueR>cDsIwX@Y_zvhNZCOf<&G5&lsjvj+y^_01RG%ndzGQy$TJb< zm#HsMOE%|;Myqj=G}^4EgFgkPnXGZEBdh!Y3kQ6|ben1B3==cywZ1?)O39i}S{rR_ zwRh1$`ehDm@IBzm1K`S2RWu_ zu?Fp~zYCctFj`g7TC+f5fiV<_w9{;?a_w|+nk+G!6LusE^mrQ| z{)!Mu_mM16A=4FdR4rw0ql5*i0zLW(Dz50qYO|+5!gs%bqP#O`lAlGsR*PgEB?maF z5Nagb7-pZa5$1??Ac4{Z=eb6@Fxj=(g%Wp-8#CN<+}zVlGy~gEOm4H&bYN$lTCdPT zGwotm2~B!SHEXdW&xMh$$u1!?1p=R=GtqDYaogxjGy-afaP`jaEeg@WTXt4W+XfCP_5XH>*`S!vyxy{B&Gq($k%! zu#l%BN_=}aUVjts{R;(hgv3ZmTdLs#*W84g|G4J8zu_Oh<-Yp~JpDQcbN#D;BJW4) zu%&=M~!HY@yE=sh8_%0-=D%98TN#@;DN;M;ItKrWx()dhxSt*dQhEUHIe| z&id228-iZNH$Ng(jZ{4826RNH$MD71IK~O?!UP6?fv@?jkwO{=oz)dC5KCIO#c~~` zpI)jE&e`h2=}{L+@KMa$FQW(aCX??A@A2&2AQzK6D|vB52>g;uDHVCdl!YZi;Fdel zDs!}hMJ{zXj^+PIfybUkmUYl#rTWLkl<0CY-T4UviJ&hyQlO9=1hdtj!4p+0Id4(Ye=Hygvy#4@ z6*Rt3bC`*0YmCKgM@W#3qzJs_^cC%;NP-;lR6AkE=#H2pN|maMq@6}3Fv_a7FvePL zVU3kzV=+fRMGH+IOY{q*W~=}<;2bc_9A%-^K4J64nchP53#1&o!bXKXmP|&AZJt`Y z-HZoEDoi0kyNRBBC@nY%Mv{SidKeQ(E?j6VrVO3Kfdyu!g-B)s#VbJVoJMAT>HxJFwcZ z!GZ1UM-?m3=M{YO9e#+=IfHJz8-IRHk z4ZXP|NK&dcYfYTB6E#1DfFO}LE|55l=>d~BlU26ob&nOAe$Y&9|0rSws_aG^jdqib zW&BBzJ?>82`zk*BLTAGbmxv*|&Up5ZjT3nFGkozA%LxJh#1K+;6q4a;zNFkD@tonO z?+K^%67XLCF%s2hp@NCC~xSv^h@{_$Im? zNfP+vD-5Ayp~!Cx%W1k!h0wOpK#l&2DlqJZpwnh@cl`jy2!HSu4awxm{zU(oy9=rdPQaxB6*_ z#3Tv^o25d4a<3_x%%nz2F>--aNe<{Gj!Flr9BUoe;+WvXUU!)0XL>c!FOZg+yG`un zBN~zfrdf07+dfJ@73DT+>=FmUyfSrbu3SKs7f5TIo1NI}oa92IYb<4=-s$G?GJT(O zm}`|&IYmTa}K?1!KnbV1-ka*IA+RZnoUYGHm(KG)KefZ;2}IyrUWTUzh0%? z!(Vs>uYM|Isla(fPWGh&KMavfXyg1&rNWcHx=i4Wcd&wd*vnj-T&&Yu=3M8*4rhuB zxvnxz`rDWI@}Ky1sAPr(a;XLuwgcNqUz?+f4U9DAlXo(upDQER{+R|hIbno>fs^gP zSZvXhT=rus6Ub`^;_1aXZq?e{Vj=~v&af9;g3WBl!ksZrBss@BnUk^Pc5IzJMv=L3oWdkNoU20Ms+(A;dDWk| zpp3N@0&fgvESgipR0zZ{P$|&o8bJ!jUISRo7$V~&l4XiS3#H0BMDF*KC@ArSQ4Hn) zk3ew0C`L6YJqCh0^>m^VO9%F#Y{b@IcPD_z^-Q1 z0&~ojCO2y{<17XaS!XqHxE+YG8*Hv>(9`!^jm_s%II0EOY%=#(3+!f~M&PK|DK7+j zPxlst#gqE}2r0LQlBab#)&i}Z^KIPAa?$GP8yPWZqw6lW5`3aIW(Pfum*=m|%a+OhIV6t(@V0CiG9=M`UJJeG{eXnD}mDdS5 zNuWblJ`ZJzzyog~nv#+%m1{`)4_AVy@BEXCUrCKWg>>0VCDurCYMUYuq3F#0sRB1X z3Z33}Dy2x?DOn}jtq*S8B+<-+nI>>du2x*JL(!254SLdR(34(+z=O}Q*7UEsc=j#E zp3}wKf5VSIGvV#OaZxI3Bm*NEm?20l9>O`?W(r*QCqcz$Uy_2A!Ay!I$YTxPEb{e1 zx4Q*FK?87=hOQjIpZP3-TQs4FEPkb|+n+_-L7E^M1)9lQnihOP*m_Pc*+_RsImc!T zJpT$_9W3NrfzEdbIZxpJP!c@&mpmYGiVc4A1VUv}`_I`#yCFJIauGegnFdyC8FDOe z9BJgzea=L_RYcJnkv2BiEjD6Z4DgI^%_k%etFMQ++H6bz^Z5NHa%K#Pksp z8Fn6>Beu>)q$AORGWHz+lvJf zSg*5~(jt=k&|-n%oTOy2K%14Sn=Ceh!HpW#QN=(#r<_P{&gj^!fHH_l%naBS zQYA0q-!igC@v+Nye$7SKE4b)$gD$QH`Ms?W`0`t1uzh0%Su82sf2F`xH{hl}W8fe( z%T=UC*euaTR?dTTs>2x>Me3Lmg>uq()zOx8rkba)Qmvs_{5_;(I;jw4#2HBC98fC- z^~Yk>|E0}C5984%1hw`Q4?l`0o@K%#7a$LTeB)LMy!Z-Nzx6iWd5K>q8(S~%1le+^{6)wO0wE;F9dk50k?zWLq13D1i|LuJ4KAd6m1=CR z+Np4uRB=;KZKBpZWunxv(t-8vBW~uOtD5Nuj~4p+;tixwDB~15x+jDZE%3R-7h7#} z@6oM}TNG-vK_JGSNHKvsDU8QM8uU4LTtT*^R!5tIu@lBfpaN6C*j$P!++ZEI7;ARY ziIp1!Hn>uC_YLl5w~!kJuDegjO#Id3>H*;PMJ$K z3;Y-&5ynXwHVgdB$T*4dtnS?+5ZDU?9uNd|>d_8aUQ8f)eyhOKF%nB@Vk9pX?4;yp z!$|d0!W+e{v=10AF`6W#RpeYlt}TM-hvhIOk`xe$2}?+#46?p8r3 z-8Yktj)NJuQzTk6eSvG}$(&YUKn6w4Rw2biKAn6y&P*m3?o!f5Znv<{I!#KpYMXoV zbh4W!r&AIss*H9v3+P+krT!mwcYu}xj%?jUFWC{&40^`26WIG72UcR!QP!=rm~NE1 zlT(*8*luF??{A0i4aBH&U-J2v`yfmV*YJ3u?OZRGu%YoL^m$vh;;GySPI`S|$0SL2%7@c2_g9u`pE z=+YJ4u0YW3f^hFH=-SN#33)`o=NkOwd4{gNTgamVgP!HWCkS7Vi@;GqC#Jsng^rBi3LmLaoKi2etxmp7!en)*2EEIMDXmR_u8 z63w=fV6|TzR5-3`$s1z><*8^hu-AwM5=f_#g*=MpqU@HzzpWHBs;!!z^ai049q+*1 z_hR779<9(t%0qbOW#<3vM=m)0at5WqU%-z0p)@s-ARH=@OmRuWRV{g?NGw$w6*A0h zliRgW=Hr7rorFr%^2zF<5^cs_@kD#InRDEHS=wMEx&ZU?r~t~P}% zMCF`OEnK!^^EBsFMMr0ZOKjyVRT1=AB}=Tcwpch|9kh^R*V&k5&$iJ*>GEP6ISv$) zqJ5TQqXYZsEaFgSB&Eq49Z7W0bSf$(5Ad8C%E?g-uIX4|W6R5|J$h;$~?!Pe89 zIO~dVGutV)t42s{bZmEE7>D|JFs@J0N9L2?dW6JkcZ*w)Nd4}Q2$QjNK#Rm@m%#mR z;_3mqc=$!e$dxxz;-xnjBTvvssl8C6B~mC{aV*JwbfSzP(h($>3 zjCg}#dV}I=LL&E!c!^mw?Jid25fU#^Zd4fybbb$C{zDMdwHK}(gcsgw$KU%> z(5Z|8*W%637`o>H%H8q&>-g%Qf}(!A+>LvmhmP@0lZ-xk5q-0a#L`F-iNBX41h-m)vf<+C`a~ z5)8(&jWP}7v;*lVrL5u-+d1QJro;{gvLx>ME1r83pQX}SFzgyLT?(RqMnZ9xM7OK( z?ng}d>vQ<%Glo)G3!FtcN6Vy;xe_1zgk-w4BL3`iB`6JEuEbBt#FR(BW04dD_;*Cd zE`olo&UbOqy%!g~uIHl9^@4N{UcOxP>dnQyf5BfK$IEXs^4XVy_AB^&ZUM-0hbCkv8 z2$WNjf(Bq7wg9JDFIp@ymi%txNL7(RE@rbRHR>{6zl$ZVeH>5zz|F7yGZ$eplOif8 z$LlB!l(qw7IN+BqDapgBSR#kS&$BAdKs?E-we&S^G4@bQhr}Tx0w~8s$`&z?j!xL& z$?O|ulBK6udQ!5L(AmK0lpMX3&aazC%9RZYJJdl6(U7?FCA{(vL2P$E%0&jBKvg2K zkQ|}YNlRKvr|{3C+2SDYAWJ1~xC4dS5I{a=r4qOOmhj{Ug6KhgamPIj^}Cu2@^L7Y z_(wEJx!GjkmG~DUaULX8m!UFR3OQ1OLKH?y1pEni-@}A}YullqYnkxi!(2T4CBFWK zp{M@V4h{aBpq28iZ}5G&WYEix3%?t<=+=`D*(sBF>?tNZ^NOGs=9W9@ptYmwjKX;} z%3#_Y+NwsYiHfm_iu23OS6Iw8)^Z7l7rZ*6^DQ`|&TFPYk0DsnzO7v1u_y5A8+iL& zZXHQWN<2>$<)mthrH_psN4dl~8KPTlPlg?v&yRjP56MR_Hihe?7}wZy~E;)Pf7_pk9|1|4%#NvR$hXqw+bM}3~A z@UB$K9zRJ54|~Z4CJx!#L!l+dh%@>!&YN%NfcS^G+54Yxq3s>jH1F3-G*C3x7Sg4h zrV|WOSphIs0^aD_A6MUnd%wcBk@UG$NQ|N9x{P*p2efE)RDrT~Ad_T{QN~^hV~GT! zF`K5kBPNcUQ5Isg@rpgY8!fCQZ--#Ji1I>=v{A_+I%6gN`U=+4E_k!9PbM$scBYzk zrspqb3bO?@4Wq0>u~vqKVV7NtEC2QtzWoucY5lya>BXgAajZoD ztGVW`d%1{|6ka#BeW4mlTj*xVR#vXx!?u&L5|n0~DH$B2I96gLCoLW;F&p#1Rb(S& zpxIicfuq(54V661L&jNpub33^#QWgPsxeVdR_ZO>8!|n~cq}&XGpB*5*`mOj`SU zQVDsJR?x3pM{~?l9)7(<$Ijeh&~xm#QZG3cuU_KSH<tFVt!1r=kIChg~BCG`>!d>TYODG*8& zMk+dpg0XzXW6(yidWkt|slqaqK|yvBTS&kpcX(!EOz&3eB@WQu>{L7Fa+u(HcKRBA^R`-ba|ExUMM@SG|rf-i#1@v!LSEyScb~AQvwX1I5TqmFP@~^#nmz zr<1%$(%4jqn;&G_d!GqXeRR2!i>|u(Cw=(SBz~c?fj;>>`hkwwIB5@epw`jgK&zwJ ziRsRDZftdjc_GiM+zU&+61_3nd%LfoRw>5++8|LkNO1h7^HnZE9i9B`1*ZBi{g{2y zW?;CZ*1`~&XfpX18|-~5zRU? zID%@X#DlNl?R<$M63j-Eed?@?B)jqN7(f2cTr^wFl=w%yL<((O{zHczR(4nV?`)&# zC7MA-89GPj_rvq_wwO4QFB!InPDXL$sUjsPt5h(ifq_2{#9y9a=*73V_}lkfe5Q*Z zqA5as7QJ8;(Kn0asv!y?YP!Nff28|SeUrq+c2^0c1Lvk#KAbS66*u2pw@t22~@X;5# z_!}30{}$i>1|k`lEzz|nf^Na>j|&gdryu%X!^rJ_<>I9`xF99TY>79& zWbDgtxcG@QIJ2cE;o@wP*D3SjY&yGqIOQZD53bqtx|Wdcs#0>R8vc>yNOB*${t*nW zr$Z1LXxd*x&vdVWLlkau(x{^2Ru%y(Y5r~Ho#h--?zT5zskY&g21P&xs>ro)C$O6) z>|^b%`t-+u>+#57L0ypI1Pvt0tdSE96m$B+IT90%27?*)vYLF3L=Bz!l1jeyHD-g! zbr(ss?W9GN+p~aNytkNpOzbsdEM{G4ZqaR4nrlt0V{ER(zmn+zrAa}^mDh05PZ!tT z${5YUb0yyY0l)kU$?WqsSK^0XxRUfj42)#8;9QDcBVYKr?FVkom0*x2_dSbepU3+j3c_h{^CS;$p2W4cGx7HOxcHIG zbMqvI$au+w5C)ng0z0GcAUyRn%E`7ljz0ChB)^c*fN=)pYG{&|&@YfW_Z3t#=qWs1 zP9pg@ijX4rj3!CMXWr)Ow?E-cR+A)%_E}95--KSm8cMsySV?PMlf*p5tNu8H8#A_? zRlrRWTh(5LeQcy?$M&~lN7)IcN#dM}AjcKzV7^5Ey9MdYuhzvqj|ozoJoXYk38vRS zgWmell8IN}%Ee2caG|%m3nemmJKHSr;$VdG8CuOWdliu<))C3sBCwhQl``16wM61t zTGN+G+LQn3EkRJv{?(`@9AgIkr2PGQqi+9B(A@U3D&|M7ZyjOcOrPODd4+HVOCB6(C_f7C)pvCWm2Ily0@@GnA!0Z49GCEXsU?4a!GmwED zf#)@_sN?pIOqtMWaVG}yJJ)q)AfiiN7Y6oq3GK?jlCFC-Fs0jyZcLfbV{s1#@~^17 zf`N#hc|93u45I8st0YGEp4FQv8GWkyFc91~vo8ZX`kvRoqARyw$&?BG7WZQyzkgkS z1|kOJ4PYSrstH$N>Ya`H@rPfXdo`2yULAG~1FNptuYr}<#$AW{JEv;K5!csW&-Gz9 z47-7W?Khm(z??s={}WS2-Z?u0l4cS#_!g} zIaV#KkvQKD#2Uj5A=gUy1ai^kPeQJf@a@8dpDwyyCCKr`w+9z~y0~o+W48|ylw&8A zB!GF853*HOlS-mRVXulZ5pRZDNT8i;u{F-d3_Hw$RL3y~COTI;xoH;dFQ!m~cw-Z= z1HWl?%);qQnyzx7^*8NH6f%sl2F4pTlvVVPI@xAn=YQ{sI+_3PJ6UC6{r}ce|6BOh z2I%6GpBej97ZE(OZ=i{TRMQ)1A)F^Up8>N?;f&QAB&yXE#gsAaKnvR^Hb_om&s9+- zWwF~J5pE?|$gqkn9CJ+64|beA!)B&1N2)`R;;9wqfCx$}pKlhK7-^0%nSSiw(C3-+ zDSRP?a(L{epCR04{>Pu@;=^j1&?z0jMu`t&XqB#(y5+meDEo>Z~z4yIml3;BhxRsVFb$558-cvbMs;7GDb^;-RAPIyZ zf#4*BAR!PWKp;qhySoMn?hx#|?zNw3>CyN7UGMkTy4Tt=^2{@{_flX8h68yR%`l8Y zU?Nr3)2PImg?W$zxgvra6yj|gi)7o)9iyA=Wsz@Zvxvtsi`BNHk8BC%+n~b6iLUD| z2_D#>uvb(N8x)cPIyY=o_>OM%n-p%n$D_08qi+hSevyzbS}KpxHr1P=*>!?mf7fFU zz6Tz4>p%AZ>{592X}pl6q^;gXLY{s>NC#PQ?c%DFjz;AQcYc7czjY}?2hmYws%9S8 za_+qowIrbR$W66dEPBvqYCMBF$1^0aWz}BQq;a^D&-VWiHMlkur{ADsF*+RL(R(seD$@j~iyFtj` z`RMH9$GiuPO$Qa)1dOBFr;x)(DmBOpq+^cc!{0{>8r{72DNGQP*S<&|tJEOJb*xa# z+_6t#pjcG*DeM+Q|2~C8G4uh#q7P{TVPwucnY#ooJx+5$hb(q)2BD4a!DUa))-c(ot#! z&b4rATuvl;!Q_0iZPd+d@ptd1*-!=AYIb&ye~XC03NI$V$yE1)Fy{H`J@t+SvG zcGo#o2c7F?)Wwjxz3Pd)!R@%?13@2rCgj^T3LQkrd5jyg_6j}J0EJm%#pGF;0)8G@ zOiZ{DMurue=?*NRr{88X2qNBZj{QwnwG2vT9~DvZHgNksCcM8snl1qcJ7AG#V!=wW=(0?ugp!2A+=U5G|6G(Pa)4 zR60>fBu6WkS3!K$woHULpei;u*xf+nrLptfPc%PvnFGsW*E+Bpc?-KO%>v-cwLHSg2k5wf~xI}uqr_0{u4AUs>rk+b8pH9(kdE!Z5p=VdY^N~9ohIZn)Mm0S(iw$pYEOoWz4r`1XndKSp_9RWg#)TWdE`zh zrXo2*Yxg8Ak|N0pc1GbKt&;JkzY+04aTY&ABlv08v9;;untDhc*)s}z%{hbiQd{_p z!gk5@bcSE|z7~D$Br6k5VnF>AspxuEVHh<(Vg^~q#nwojuRY4&{7}f(yt!wY2Z?Ia zvkEiROeHO>f*@e7VrcK#-#6(@Zgf^*Gr!{d)Brc#cD2j(&eu#-d6pLS2$-T5Xpade zuXqFBr6~t*6ms*OLhig@$V+eFJ8E8AYFzgoe&jBa@D7jUt_OrX@R*P{-lJcGM|boa zoF=Cf<}QnbqN|{LQpE|js%VMqSr{!*bstaDv{2J z8plI0Q1kvKXbcJgQ-R1Kmum)|CTL8OeQ|<__dm8@m-nGmorvPgF5!`f3x8duzmJe_TjBSnvsG`dnB*Gpyc zGnuD7)kdRgHN;*bh@`DXv1`b!IZ`ir2~-u4(J#=%VlMaVr* z-R8JDV`o?Qk{%$ z+Y*-l61`~NuA@3XY!v5WreVSn#iy|G-#ZTAYf?;#=2z9i)Jw}pKAl@Qvo z(22^QJb7ug)5v7p$S^aGw%0Nvz1m4e&-R-6-*39hi=dkwdgxIR{1Q)v8dv)5wJ@!O z>7Wr?9W^iah$7_U&+z&8BKY_-eBsbPS}}zQAD?!#Ycqpu$aM(0G?mGB?r7Jui!8u8 zY6MXevjX{yzi)i08y1ZqDrwsYTZG{;m4m8=E--3eDJNOQZ)5`wd)D0 z*95yn`Iw?{^@AdM_#=GuDZc+vnBVwXO40a7gmx9>+7M6DOWjEk+NKWYfAlN+N$dX*6q& zw|_%B(a?3$c;L@$&1N2@&EIz9bs=)2I%)itOg}x11M0ZKadp;l9Sp6FowTI!@lSDv zF~Ia-b%0HhNu`U%6e=it`>TCy_V@bIb$~zH$6|lA1V4js3n!hKclX$yz(O9iEDUlS(E5D1zMG5ug~?Wyh>BY0c;QK__@Ni9lDUn&Jw(l;#6qCh+wx@*~L zV*z#5yZ+AxtoqM=i-D4VJ;FL}+9H$ZGPUX^7XHpM;VI=aSAz^)2rT*6@%=cez#g-5 zS&@tB!;8s>h`Q5Bez7@VP$A_XyYn^MPfIyc>Coj*+$O!<-J#7P$TC9=hL{o~z58Ma zuoCOs{R<5IH{7fNGcSKd>I;T=#WH@nxc6qzet5)5dLbJa4Ek4RXpBV>BC!)8H%0Pma3;(H=7&AI`B}b9xrX@% zclrB5ZnFdNL4vy%xxttKW5pJop;5w0fAfPSu1&ZFA-6=L?Zch}qVl4UA2rt9oB>fo z9GDu#j1?IgyQw2RE~>x`jU?s{ONs6hE$1X$YRGlr-l=yqm4>{#(MO|kJo>cjxifmd z107;g-ETTJW@-$k#UxgenHI;aioxob4X#bNH6gblW=9NmO3zG<7h2$Zu97n~;<<(z zE%}dyV@zD8MjO?M8T&NSWi^H-t2Q!&7~LN2A3@_~;91 z|H|2E`)K^q(mAwZ=i3*CT0qy(7(p-1oGQ`yF}d9pT!k&dfhS6>?vVT(yF3$r^hVS9*Q92yYuc z`F;6fOxNft3fR6}r}U-s9u0wgsjO#)asgb|_ocfG6)Jt{d_;%%zI5#)=%=yTF88tC z?;Ie53D(?KsGmk}K9A#~#z$cR?b!0qUBc{9JBNJ9KaEZj3ffOg=}$TIVhJ1Qr*S6e7=@Im-ccgXiy9Y&@uD~Ar*SIkEbFf& zL`z%i=uXk7h#nh*@iEh5FgIpljL1h;8t1MtKLqnDvovHsjRgYw)6;=_y8irx&Z5;X zk(KJXe50wnKfie66ejUL?4bTnR;)K+`T*&3u2%*t=fX4kVd1|0WMpR}LMn;W^!UVeMBu6L4AU!4{ z2E{QYG15bv#HZ^eTKuNa-{dh{)ObcfZjU%!$J>3Zo0#PzmsW#A{&63t{e%E*gLFPN z68M)FpfH#mU{uUFH*sGnvNlj-kT`)4)EFun&VhX6?`5FbN+t<7sc};GH#qK}_R%pa zBMKRk3u>SiS5Y~~cA6T`ff{*cfe}fb8Er6{)`ZESXrHaH(zYVl5(roswKXaNHbr@A zkVYrfS4oNhv~hVbh8v8c=lM3Kz&&Ip0yELiBFpAl84z!h4Z1RSG9A=K^wvj0-ge|2 zM|iOq&EI((*9Q~rOgDb7YNMq)Q%ks2<;hUAM>0JP(l{hKjzJm|F%zE3(uf_Rh29gP zuea7n7SGo#jc*g_?$esfg1)ZXY{^xVtr457F_=Dn^Xa(XDokR9pmf%6H7lj zs|g%yO8B~HSOw`eTH8Wlx)DU&|mB1^d7lJX1nzPJWQ{8 zw+_nDxbp##zx6IY{!CDW3thO2%w>@AQ6#cvutvG)0dlnS)9uDkqn;QC?7~sV=oEBjGB%CYX0gF?lj6A1 z42Rf_+`wZ9^kyO42 zm)s!esdwP)Nh3Law{P zQ+XPV?!rA!I&__ocKi#`gr19$r@gT zn{M~Wy!s~IZh^mji&bia63LGpX&&xO!^B{P5q$M6kRKvnzXbRmYuVp9Cl8YaCKXous>xz#{G)M`>L5s7LbX zGeXA5qcB?I?q@}VJ6fZDBafu<#X_EaQ^+Tud8$A&`sMC>@aSLpOeUz-G%+zY#kD;8 zBD#fa^}5pko=1iJ^#>t8B`CBOC#eD*VHoo|Ml%U}(@Sy1Yxw9VB#UPlg%{!82k^v; zc=3AF_sHWyo_Jcw+n)(}$C1x|6fT25ntQp8)hH1Ug|S?CZKI#r9(SlS zl1po>##sU5G-@^VNNPJmKl^bS)cKCrygusF9AfIl@fz=Z=#hN%nUK%_?x{kJzr2a} zKftHSTx3sFBBCat&@I^uHETNFe4EJm|0vYB_etU2eBY6Ggd|f_*Ik?w3pFOmB@{Xh zfTt#K*&(a0Wwd2xbwo+FUKx0V3FG2*Yb{)7iS(YJo#|A9cSh<$jYPC_-Am=0%PW#F zSsuX*V3Ou+gW+5~O*iwn<~(COHBsZ6ZuDV0p|H;1>5F73T3IZzGkq-b*EvyFf2IR< zFF`jhBbe_%I$v^?kn3+2a_2orlnAeh8c#I`3${$u_}e$qcv5n)P1I-w79O0$4Nn0upjJdUl`Oh_lj#-^)W z<*6c#9;zRG5ewnWMJ%VNRaPVk;c`x zd1|so-3g3s-cJSLX@#zIoygW3Ei!{4fpqxm$N20!{MK7Rk{r)bD;XyBPXktS6Lv)7 z^q+=~QWNMyyF?+MzvNVQ+s@@!AF~G7i1QD#1Z#j3tPa2gnCN2rTMV-2_t2>jzI2Yc!avgeGD?J?k}2 z37E=XZLC5fW50Zgt_f(D6NP@JFL7@W~tTo@y7FldylA@jV zi1ip+)95)NjhhI0)^X3jBOFz?(=_-_na(ZrER7|4jmAd3O?wm-@S{3~fv-Ew8Y`j~ z-VpNU2SPslQV1jOr)&I78_;yxfap&7OI+ljjgDA8D`7c;ZaS?!T4<<99e zy7?I7uMV&yV8l#`#%0ZPmu@9ma+pdFr;aYs*eW)_5-tS}x~7Ss zhgXTlJgkCrUWIKAY!h#V5{&~m?Ihj&LB8}^9qb6OGf0dQ?nnq+A=^@oj$FJBrjz3~ zx{9>sZ@yXY&>kDdP~KWg6z3dX>l*%7BaQTcDb=Xk1eaYWz3Vj*a>H#xXpt@DXJ{M$ z^L$a4Ql&3kxx!w$$(#}SOlB4=V5%?X$eXFfZZ}io^$$Ig-uyC5RZA3>i!y1Z#x(iJ z&D2;f3#OSG1)9Nnvo!9yA55IqMdc`TGkuIl;iY#8dGbR?o)<#vfq*iGhaVAT)+{cI z`PHAr5LU)*%+eUkz>8^eayT4 zbm8u}UkJl;=V(0lHs1Z42%dXY$XDM8Nu<58vl!UtXbfPOOs=R7LvCou<*D&pM$i;L zS0k>WN7AsFkelun@@R8U&C|HyCOr5!UU(6o`~&Ueai2$1Hg3O1nyJE?r}4}Sc=0{F z_o2u>{6vV0-=-FD9xdCFfRLeAAvZAO2Gg>hANJg-jwnyf*Qi<@4X(vax8lAxg}>!@ zRHK0iZoSV_3p7-ekf>@xs?`+2EyDtCtUR?)gAp5xG#X!qn;*wh?|NkX%0jBf3Sl16 zMH&qn3&-v5B6sr_X?*{)2!Ez|agml#J`q%ioolhiJe8B5o zsu5EKRpao^2hw`Slb%|pQL8o@-HxYU!fT~U1T|`*b|bv>nlN`g?WyI`squAq=qbF! z#2m|=eX%i`za*_UKIEwtTFlQYG^#fdj?QH(bQq0D#4Mv)q7heUeDrsG!)U}6?h+!= zh#^NSuFS$0ZzLLVg~meBEw0qER9>m^@XH>_U)~ckLC@6@Fx7#nnz2kPHP-8WPU5ly ztfa<*DMwcEtvQ8BCpF^gd1|#rO-HVI+*4~bF1-xR9>!}egkg_0uE!cJuf;VQ55FdD z&%G?9#V2BjUZaWr_LZmBYL}HfOO0UYP%(o+*D7?-J?W}hprywWaf?~2(Wt5LjU8d- z@wFP?{v^UK+&giLCS0*NUaZwvE1%M}8pl)zH(O7g{u8=qMs0VKpMcCU zLcEZ+XuSBE@cfHx(a7g_W{SMjx44fXHc@NQDo6>W-xBJ&sG$|ELQ=wP(U_}OYLOh2 zM{$crspRq5qA@cB?J&e0I}LptXk$BC8Pzrf9c{KnwjJTb^TjWFiw47=q+>h3kGlu6 zeX7>BXv_)05x>GU9Tl)u?)R^txVxDO=G$)Wd=@-H{QZe|3GV%%pFpp!f8>QZKJOEER&~p=9(nKpr4s(u-cRx zkBxbM;yRmdEYQB+IPdX^m_^;kYG55UP`$ksGN|NFauGf8s=RBqX>`)L?u3@hdT<+W z@M?Fk;h5-p&%#`I+`ZIzRY=V`sM}c3T~7#k^>w`QYlyhgEYtY%XHRX{xa3+PRqLVg zC4%ZV7IN*4p4y?&{CT|kBbKTS%wt;4K+KjJJ*ZAx%rtE~7&mxEGpFwkjo6EE>5V9p zrNIu3>NRDG`yUqaNOK`Swqwv*KSuG7S5ERPe&YvWN91jq{-;(c&d<;_^rJ`bc+o=a z&}b*i+a1&x&{VU78qLEB8|Vd8E`=<2a1G5mQEZb~%pDqsskUvYQ?wkqrRHmA2lrn+ zoMeE!hj(ZUlr6~)jVWTw+Nsg(1y9Izxc(+VH$5*TQ&c58wPe>2NiN@)BSpMR!zH-5Ry; z!9x#wg6hjxeYZyAdqi;0L-HQkt?^k`C6dpmh}x~uf$OI<(Ln9dR69KTyr=eZ9UxvD z`!s6bibtOC1T_v(vs*?0kiz zigx=08qa=+ui8>S_`C2R-vwhCr8r95?5(_iU|>v3Omy!bZtLNvp=@@Sd# za~MQpK#@EIhxPwSmy55ES+BnjAN+)$X#72_nHcWv_eI`~*4bP!?jGi!H`nf%!X zX$+RQoWnFp(h_-?`9>Mya+qrUj#?(zAXk1^V~4!Qj%YNw7)|fNQy<}rpV3Cq8S#k5 zhY^;`^CKFKn&9H59?|_z385|eh{n&fl^@l(>k)kVji`UnpMFodiYuI>8VxS-NE$lw z$Y1eIibA$%HI8ch^;2{a?eH3w3iHAb{x?j%nmcMfGFc^YIFg(auS5g4+Bvg>EeBdXk=}qv?D!-i(9C z#%^kq`hy!4_L8=Xo&(FJoX}`;xd?83R7jfYrcfYGk0t~39uLYfR;AhnGcc2I#J8* z3XAnj&vMe9v55Cu`bhUPeGK=<`IzZ%^3k=ys0J9twDZnnG|yzo`De1U-l}?XCUQ-3 z!t?&rL*!-A<R40#Ky_49KV2OiYjmoC)irk1KysawIv(#M z-4ZJ_UVU4JC-WcGLo&=%Xe5i9PK8FXny#dM2SZ|xsX{GWYggES6=W*3<2r_18WY@R z>PXKu;(=D7(bM!cSV!e}uFZ4LRTeAGwvX-{jrf?P7$jFpt%T)OH&jJpwd86@sFPd= zQ|r#Gi+%Nu)RV&wbr$}yMz~F^54qQjrgPmiAgf`%dl@$2S$161U`yB(M1WN*(t&7!tZ()*~midATw4C0++Sk!0-M*aatImw!+4N=$>wZn0_(Zix; zj!DtQ4oDrD-Z6(`a4x2GC1h60t|T3Lu)a+1nA{lQrpC;0U_qtjuDzggab;;56M`vK zmR7;iDm$x)_*|8Qs_0a;Yt=uv&LNjjHPwmtS36Zr+7mBGz5p{WSaktbU9k585p}(A z$b}ekVey5+&Al)!R>1PuU9s2|8(&?x(&}p*I8gnF14pV?RLAM+9cxJY>FRAA=u~61 z1H)<;)Rv~HwWm8UxAp=DI@Re>2Zi;g*2lE^d))tiLY<;ID6TWz{d;yWuxEFjeU6K- z+orC})V=OthH#Atxqc4JtUIqRj?_C@53TDb)yJOtXWg8e>TY!%PS2GnQ_;Brt3RqnN{g?v_{m+52B#|$)bf=A48hPs_}ob2spN&2a?8YOm) z#az3?dg`3UjrZY!M;*FD$Sbc2`P=vSfo92b^x*19<1p7tA(t9*>8iIv9~J4jlDmb$ zdKg1`=(fhfzUQbf-Q*;P#rxo#MpxS321)u;;WCXJbch+|z<4v=V1{V}5id0Wra)Q0 zYYf(!O|DHizE-7eli9`XEqlfrG-!yX*Wl(`aCegOC{R^}=m?1tu3=Llv>L}7&`~em zAW1#|2?mcof%jT7^~G8`3hoc}D2WEK$;u;5R)ZBbin~&xLHeIKm(V29V3TZ>6AgBW zH80ViT$~LP4faW5&P0Qu%qb$_XoZp!C()pUx{lRqy}~wbCF%N$<(htri3a1vlQGGl z@e_FJ8&9<{xcCm-`J$j}en;2dB7(c_6Y}u0La3E!W5gWZ*5L6s@ks`k(0de4GCrdR z^Dht5i!_$$!%P>L$dvRQ3{p*&@i^qa^yut*%>CElGV-STkY&a>{N^Vj`l}-u;uG7} zpl1m7$jY{@!QK$Gmu+!dgAO5Bq?a+%wL!I-xaw|Cwf`M;FrpQH)Ke)&%;_mc9P?8Q z?s)=#ozHj-gL@v9ayTglU;Tg|ewNNpzAA)87E+B^_*0Eo_)`rS0g!4W=|rlLP_I;j zf5g-Grw1c1Oe9D()gYefT4-hUR40RGAK|mV<6GLmIvL#fdL*q(XM5>C|1ZrkD|rLf*7-uX7JpLp6X%{TMK&_#Cpas$5t1EV`8)JVvvmzcq-js4WHOn zCe5I~$u}rudBtKg)nKM+2_z#0=#QbyCs6_{#G*fq>TFOHPPEZY#Gf|Zphi8J{hkN# z;Ny7wd10P^TT&0F8$ACP5q$U^&e0>U1ap8gl(T|Dg2h&5T|8t{ed*Le^5mr((Af$3 z;_8xaFon65W{TAy^Vcvq$}?ljh09TTygJogG1s%mu`^8#8wj}{ZYEX zR5R1afv1Ha1^wMsFTzR(*2}6V-C#oq%5fYxiLDkpV#my(5VK5_5XVXt(GF|q{sK7d;rvr9>Pz+ z7a{PcGn~%>`+q;pbAg;@xjAc)#xkLk@lPjLVo~<51G=&A`B%Dbq&#l5S+ zXn(AeY?a7{t_IsezzQEo4_3Ns91si%kQ?Nk#|;g+JXUBZ412DUc&4rfs|9p7xcEAc zAQnP6i!;Kbhv|r$(lqH-~Swgxvm>OV9ur0u@AT3IIl*jCe!I7Bum5@=Xr#nOD{?9ac z>wW1!qfe$0qfe%Z=tDCNdW*Iw(@5rVoU7EKvh-f0nX4t!U~ve>n^Fc`@ZA{!Bf)By znFjeGSPn)KWg4u*4#+&~{{Y*Z6G7UQ09`53@?AQ6}skVWpM zE%H+XtP}_COoK)KMkn6r(;q3*V2_^^$Whw{sSXqb#STmjRtDH6xd$>0(xUpfyOtc? zD_Tahi|*#YqL`I2B3U0(9)mqG2SaX~0|#S{IMBXQMkVyDwBFt8A(ci}LVl&O=W(M# zZfvC~l~61_dmF5x4W|dyzj->JW~Z$h4R(W0%{&V!$koT-y8`NXkI?z4AHC{EF-~|9Jypx-j&{nR4fexh*Ta9} zN@xKsQ?$+YF(?l~f{|&48yS+}XZaZFm-@mryF5>_u-}OapFDZ zumh)LW!=Xh%V&mzz6N*Pg(sTh&9Ct*Up;-f;PObWz5{nX?9fd@UVBr>*S{iOR4RRq z(`t7YztWKF5ptQd&Sr-_or7&(BURyKp2K3E?`v>GKtF@n#<=WVB&+rcy;WakGZ;s| zwy6s9nbu?n^BiZ{@fK5U_rT+bi!T#$i6ifRD%_`E2>BveNy#nrRl{hko2)QZF~yzD zveMxPuKxS+xn8HRN%n31SiWejk><5@FWxH=-u-w>w;AjUx#MOeFp7`GE_n$08I0ok zt5mFS{S3z2sn%2d4PJN!uf7?gzr5+GK?V;zf=6E#^fPxggA9I&&?MGy=4vLOUJ^)Zd(x;xE?0}O^ps+=r?yYI&X&v`^2 zex61LJw8mWxs8mO0QY?X~vwn4MoJ(8;(;etKe$bvoF;5fq!PE+xo zq!|^NZ6YS9Y=fnI^K26z@oesAG8t)M&?y9&Cf8u7ndQW@#nmj^M10N$yASqYBOmO+ z2G`w#d*ASgxRn`f@Yhc~m1FS0vqBzpPa@j-NWe?#RdI-PbjK#<`NLF(g0${}3 zDA(ZD2k`XY8F}xip;Xc5K)`Kx;qIpdJ@=ZB55E@jkt2UkQb^_RJ5$l&aj3x>ck+`p zR!jW8cY!<+o1-x>qkHf?z zawr$<^o<-QyPeN}!LL1)M~>ds!;IuOA7*gt!y>%Rk!POA3-5YrxRKb%;RYAf7cLST zIoyD;k;4rb8#%(D!Id6KLr3m!!PFl*k3< z8O))1=`g)l`^m>4&mhZ;V5tH|Eq4J%qX5_>dx|`RGHj=1q!o+lF+*LR!R>e8rI(SY zn4lofAm5I%m~R(YoRBas&O=v>EI-@Fbbp2~r*p@nLhf|r(U6nbgVB6BPE%AcTVj{#os2+ zpg@-}2E$-X2v&+6EYDz72+F8OIHI|M%roe0`nemE7J@u8$w@|rV3L_*FjqW0^Z2|T zb?v)C&_&X(m6ykL&Dk6ty9ONc6(ROk@MzD_cZoQY5y^iil!&EwQY?s~X zNP~;+VSUl&pW?Gbg~d`dYox*B&tN#ehg{8#^`Mt zdv$w*jwZ`stZckS8f??MHAa}lTqEr^*lQAjT+21>NP3ryWju{RZU|OmyOXR5!Ey0l z8EJ4rK)yjs#YzwPMwB)APFa(0@Yzou$>%?LYLo#3g-00)6dq+5_$Siu_?Qo zLML~$F6a$UjWJkDjqyQsQsJyh&={fT(w4nJOCw)|W88~yjKPQBi0~svI!iH_F$QTN zVBj`7N-gd&{8BUN<Y84=NehU0i#{802b}DIUuu=zK1FSMdivWRSpAheug!Fe$2i zl*b-4ykiPe{cfhq$q}8)_|b6&6Qj09;Xu^UC?rM~L`&Zjtl*d!o#nVhuG31Qmq%lL zbUBS+$uSb>ioBRbG19;1|LjqUGGI6V#y#vrizRla#W}k)z$zBn-yR$dur+G8JJbK& zy?c1|NT*#HJ4Lw{x_EkV5~u3enjZKfJH1zUl3j5uAg%0o6E(1 z`>38#=od9H3P+<7T?dM!!+f)h8v#imo&Zz?Nq@+tLm9V5Eo~2riFS#_PJ7OxJUZUp z#pTiKqmdkw5raN4c`;ZNv);**V>&sI6*Dx(Q{(txZsdQxjllr^f+c3R5%~Z$kiYSI zu3AzwGWoX}he^P4bYPH0y2WsQt(H^IlHrmrZ+65(nOj7dSMoEu{-W2lY zR~RWOig5;C{VcCWk^kJ1mWMQj3F2fr&Y%|)01l*!@p}G0Qs}j^J}7s`W21~)Nx!g7 zd{?&Nnsywc0f&Ol7~}ZQ(g?)J-y)PcVirO#QpIbM+Rg@PmRWk=#A0XAAK?!tz!}^BeimRWn@<#S=r-F%+vEV7U?xC zG-J>QIly$R1x_&$LVt<;Dm2K!7@!Olz(5uf7-C0Q%%s_Im0fRyWk6w~srqEzEi#DeR83B$~uBeQ{D$}Z9T9t)Wu&TZM$eAM?C2HI*ciP(8vQG0yRj#uTgM== za;oFfEBALGtxEqYm>at#7CT~FR+q`QS2^s?;6#Y@!H!Ti}<5t8;hZ%8;9as^!E)ECdPQ>9%T$`GnnqW}pN?duhpc`)$a_gfs zNxu1^FwZh_(tx!#CK!DBIX?eN33(!)&TdpJ*_keLX|am)>IZ{LXq+r`#B zk*3eHv{NJ)nI;}7@YEz4lW=WwK||;dGoEX-U1pEL8N-#(BqI^=;;N5zR0~jzfv$QY zgOIjs9M`8b68U16%us;7LXz zx#x?&=OlxUjH>M~8skX@-D%{`RU^15XR6#u2IHt7DyDwuIFm*c`Ez`kjB)`TbyqE5 zB7L5=>*E@wSmLgKqMqj3PU%DjYx3JW#9%0O?<;7}o`6!VbCTx!MedxoixP2?!EjsPF8&zWIdD7#Q|vN}&9=fK%g=Yi zrr5cz(^;G7d#cD_DxK38x?iBRL0hSQQN-OtFNUeEWGV4u3Ki4@?KjC>b9V+Nx>ds( zpaSjqe;;o#n+}2d?P>Y~@^D24!^HwR3P?sL z=A)Si6#28=3=~P*a9LLrMV1q5P~pVIvYaR~m==N^VN*Lh)Lqd~e%XudZ2DI1w>V96 zpZnR0j5K;`vcYSU6qfVuR!D-A$p&w{jrV@RKSnByXC}%&H`ciUH@zeSCov=RO4-v- zrh2do|3qW8r=}Rh{(#?7s53pK&{8~Krx-l=D4u)<@BX`{AAUoM)Z?0BkReq;iVa@s zK?`nyf>b8#tOqf6VTQ(L&G2egQ_Z6Wq=Z)BA^un&#r}LBoBS<4cCd(dg@4XRa*!Wj zb+9(Tf#7(6VNnaBusW(N3guA}XKV2K+xVi#|31ikW|~W&?MaR_>wh0*0FP zE2Ds0@g1tOMgg~rWBp>^<0VHL=Q5S=3H48nb2(@iQwX0>%+*tD(2Du0QY5KMu|Zp% zqGg&vdb-98y;+OT3(BI(qeNc7f5B`$&-I$XUi0)q$F0(99ayXB4^kX?Z45I5AY=Km zz%Zt&S!*QUMJu4AokKc@^lv)Ok>wgW{bi8KXpARHkD%Y$Kds5lR+zV1iBz{ zuq5#>EH+3+M|b!x624z-&^PRp%lbtLc8HHW+RQXzf5|)G!D73Ycne z*E1f;GcO5w`8AA_x8qcU*WW^CmCn~TgOH~heDbBU=u9;dl{3|#ryi#aQLoiC5 zIHnqmqEE|=kXvB38<}mPm}920!0AzHR?;BibYueA$aP#P7I7cD_B?KtaMKKGH1pJS zg9a~nYKB40C-77YxTKvW27h@S?ZcFoq9po=sX=pz~l z{Fron$AfoIT?9>yodOi^NR=lyu*FVdRC?^qx1 zc-xweG%7I-V2MEz-SQ}sUL$GznxN)TJGEY6mto1A6654j9&GWSuZp=Y};BU4eEcE%GuNMaR9)Vlpc=cVPU}*`^<_^<+*NAu`Ogs(ZK=V}t(aG47%yX)LcT4sUPLUkP#)J( zgQ+YovsRX45l-5diGr)tNP<$4BGB|=V_e0yqit-I`9q#&7+_vXrwJx5C^eWa&toa8xX^xDN-OR$BiXIwD94z6 z=#(V=C^e2dE!<3l$DYAIQk6&e+GpY}NhwSPx5)EVVe$!)o~St2XVIR;C(8QAq78voq&fmc0_h-W^gu9C@qjzOa7 zVbD{uT+TIk^J|Z!MorXgjJw|S)I0;P1$yw29l?dc96od|27I1DgKKc(e{OBjgMTe% z3!G%E{!)ETqYFLz zhf-g5%1;c?B^VjV$W7)Tm*QEpNz4Iq>C~~*-{4Cly)u_NW%g31%wB5b&AgOGr|wER zWlF{VrQ87xagv!-3oX)1wX~npDSR6aFixknfyJK^gLdxlDW;3TDt@bv`KR1L=bBYU z2F?pX7C*{!umb2Ld!(htEz(xmO%_>xt{b;iK9frgcH4tiCOBk|I&e(314|8DspX{x zr9R6SFEyAcV3|SnyCt*SGJ_foJ(7!W6!Q7cLcVZB%-PE#=Imt#om4MI&>M6Pfx8{c z!rQUj;IilO%B%RPlk&)2%2R8cHUDWm&1iRnm){cETVDuSYPK3|GYRn2T7%24!rhPH@mKM;C0zfn zRjyF~XnFzepe3e_N$1OXDD(9cG0)vfBLn|)|5StQu)lQ8;x1n5|DQi?s+&=IEK$oD zFHf69H|7dj?8MvTKem?k{T;5I)(;s`$mrMI)F>C3662|L234PMYLG#H3DGs~d;J*Ld^!VraY66whrK~Jwg#Q%@s-0uo@#~Stw*`Gl$Sez$SMgA-b`N>MhR~ z#6UX0#hj53%M?WyaP zEb{gJPaZ{ATrZK$KgX)R<#emEc*;%uVwZA$6v*8=1|>8MOGW61IL1dC{H?EjEgVDGyk~*-!}W`9>u(8 z`}lCqQ8Kc%Nij%>N_O)Imn7T)gNGl%$DiQKufWVKlIElL?{#Yum=1J2-xQ^i8~gy@ zpa-a$kvh8!I6q);$AccpBTor=)RCv2!zW*g;Hl^EsY74=Lj){%9*LMcU?j!JAKU>| z!F;3%41+d~I~{Vldb~!VL=_*Pp>aGHkSqdtz@SJo*TDgUnR*^09hlM~!pSjL>Gck* z4#9f8S!0U?*&U!i(`JpWA-7L_zz;CQ;-p4}a0d}7?x8U}B@zBF){u;h- zuRJzZuPvm8Beff$@kJ6Je$bG)<#uVk`g$SvJ|yHmM;?A!xJMj$x;fr^A0K`%vZtGe z=(YDm;Jn@rnux>OL3*b4W0*5@ZHC-{kQ*#T91hZTV-z#$j&-M6D9`sn6M4`N@=2NJ znr4Pzo?=OZg9iKLRdvu{e+Z5$rr|wka7?1k4;erlQoKUs=*0a{hcJyqe+Q{tv34=toOqm>=)gpA z3Oh};_iFl59^^(Up5ZGQfOEV#Z7@r6keoKiM*%!_#^9o+LTXFoSsOKfp35ER7;>iBStPsfxlI%l@=Lu zD+^d9NfufHH{F46lN6FAZAnYuJNn=&SPNolXvqI_%#Jo$`F z_VQoAWUDQKcUyR>6%co+keZizDglUn&{K)PN8e+V=Bqgo{CNG`Q6ZIT{(fqJLKask zW5hksHUH9*k#W-V*9dGWAIn4_UDU>jz+h1uCjwJsU6BY};g0qAdvZvA+!KN0>YRd0 zGLi&b^$g;9$lZ)o>n8~rlE4Dm|3(^5yI0S!x5ti5yp#km@lq1-Rtpin?Z}t$3L~hQ z*dx&rNx%S!LQ4X&)d*U*b}LV{0b;KOL)!%3`?jch1b0+j6}obpJ6A1Io@xtRb}gRx zT+p>QdMX*X^a@<@n5WtScYTVl_&RC_#9ra4_COz9Or1d+APqf%0XPUG*hGtD+ufos zH)Q*1lIi9j^ku+U-HJY0;i!@SJYbdmrvbCYeY-ud>%6XMoO_kUQSmWs&wS=oleGs9 zGK*$+agJ*boJN9`!zS8f>!}XFBhB%``)Kinr&58Be})7?x}39}fUDp4NV=$*jD7>w z%l%6OZtSCQ1oXE`1JO_B5c*#U2U&HC=!vSL5Z6@p&0bQF7CYppTCfS4nVV;q=B{BG9lSrUKGKj&!D+OrQGqaqekGc>dJ&cL%9l>L|3X+ zTKY!h{m&E4qIdU3hF(f$o1GHnnF-`^F*QjqX2uVCP-ilPZVH{r7&#wuQ-$jdDN4{A z=t;Msem=7?_5ot+qv1; z@(LEJ1InW$M-6pgo@C}30X+V7#LsmE@bw6VjpD~jCXrFE=SvFJH0JUK6IWkzm#0Po zon?og4@Pg-zmK)wx>KW7!QjSZO%qN&@Z!sO=kNHgJC#=b6bA8kD>3Vh$40)(@`1m; zgT8#c`b*VPmKrOYauU(@jyG#;7kC%{>4)hfe*j( z)Fj}=_dQhv^w2q4zz{J<76G{eCIipEh>r*J_dTUO@{c`_7e5x1z_r38tcP%!W;;Eq zcL7rwR+#7~`(hMAnZJkWeIY@eD6~^8y7+yasE1`m=E=Yyu{uvi#M(U>$QO6r$%rVk zCId4?nKc<$=9jtQ%LNnzwwgy$?-De9K+v~td!3-D#w!M#D?~Ansp#KY3=~kGI9asQ z#c+jrcdA61K!9s+@YGa*OX6ujl?yyI9k}*7-0>UQsJ8svvi#R{;Evy<>8fkN!k5#5 z-`a2k&n?6ZAhs5+`OPD0bTKZuM$jJ}N`R}c#m%2Y>RXipO`4&XVwS;DKKmZYja*NZ z0yj3t^M7}ehdebCm}XMxJ=+Juz54+^{7z7U%23E-b}aelr|NW#Zc?pmCjUnNr7=TJ zdnV8`1lf|#bS5xIEuofol{5LuaaPl^xv!Sx9oCzoD??e-{ z%pkqSh1~C8wO;4inY~pyZq!>H*vU88UWwJ83CFp}{h7cZ!@SKif#Hm@&Nl@{#*Q_G z1{2J*KXJv5OGR&>kJv_M!g0=0IujU(5$?_o3c(0^O%!1bJT(XC&qd8J$q_IIs9r0g zc$x#$zaBm04?PD`UTF@PKeCGirqAJuW|)#0CQCxRIlyE!lZx$~PP|*S)6%}1VWTI6 zn+wD?M5D`b-5VYm#<|Re#JS7`eo0m${WU^|@J&2lwPU(0)-0S0jFL^`TwtPXO6LKw zH4xVj7rl(XedUpF#W!Yu`kK#^TGjI)>I7*^mAZ!WfX$*~oQH@)e;%+;omMy_tF?JR zFL{g112P572V$F|*;8m2lNsZYedx!7n(K`!Y#~v;Keua%`fOc z{Zu{*nd0XdFv~8o(&@!F@a=zYWgbrHHcs-x&Ih`fA=DL*qr>=W^ zi8deTEOz?&z-WJgFC7>8yBtUidIcic;<8nrj23QZu-}PygLWabxEr49_0?73)0Dg{FXsI%cN2aAHT^9hYLXav}fCWG&0gK^mX1RKfMt@o8 zECz0;>V7fM;%^?w2ac3T_}gMWl_wQiiSBnXP^P;Yl-Wa8`tFj~$6{cY-lIj*l|h;V z3=^F!28J0i1fDWT0;?4)1{QO3US^IN>3)W;8ST&y!nL$*E!x^N>!~Hcb1w^drG=1J z9r>PN5li4A&z1t$+~}$0K*OtqG;-wDhw<>6BKY__A)kEbsTIIiRKJn-;VNml!YX>V zr7%Btp{V9oxEs3y+-5%isSNt7BX51`sg=MD_X@f3UQew8F27mG6*qfoHLzBdQy~x3 zzr#}-fJ+|r)MlW;b)MP+-14}m%7EBLxNj9Td;<)InH^MA%z?D5l1!Rqh}^z1V23$q zq^XQ5pOU@kIFBT+JkfX*S<%{Zwf+uq6q4 zB`SdK0!{%{tE1`PJfa#+h4Aq^1qo|91qo|9ExoR}4R^gF`iRrO&9~vMhb7tbX`se6 z9?5NYN!GeEK#i+#^GEn5gX-XM3dOYJA6H#j4Ia4nKeoK|A6u@v+2g#796AGJ$YXE@ z7$<7ovwW;Z2OdGaONCr^gOIzQ74p`XLIy}&##vyhVr=VKF5XrvFoBV@AEd$Il=v;4 zEyqPdPnz-#_;Hw(b8c*&hW{i zi{4p+ZWi6d2jwiViP>ikiq`UMxVk@!$m;$qSNG+cE^}rMvLC0?xT-;T+KT zQjdfs23uM@@`6Y5s3X5*P*rCmPLeGxQbq06(qg${LCTgEyL3k*LsCpH2U0^Yh~Lqj zW*=Sg23zTLoG<=Xl478x#XPL%j%E)$)!L$VBOz37wYF$_1+KhF{!gtfo_rOry(O(r zvS7PKqUxxG&!Rod<=bg(#WsqWiW!kYZdS<6S1ai1eB6!WQ;lprUCS)9xvyNPSGyBg zs8=}gq7XO-tkxFHEa0g`i)RuQ(k0DeqLtkCi54}QNK>M`4-+kt1SDBJ{+dVf#>e=i z4K;WcZ~p-+oMtcs(kEWbSV=aLKsm`qZfBB3C%Lal7CmiW>K6(F8R3FFlPvm6v}ck< zoli;YwKzey7Gpzs$#3KPf=_pmTuCASb|RridvHN&=Z@Emc(iyIT_4GZ)4&po7$9 zY-`aTy?`7#bd+E@uo-)R!;)d3t;GQx21eL?i(%<(Nn4m$U~5fLuGm zBA*G2M*8{8K|)`SwiYkFi!YhFp)+d@u29Gc_&R87ktNEOwierHa_B5&b=q3&lh~b1MU1XmZr3?(lVy46wifx4 zPO_~ZS;;=)Vt%y{6_O~Ctm7kg#yVQl4eo;N>6pM@=8y) zSfX1psC}%#LUD>nx5)Stx1X!JZsHuCZZXXswnz-N1RlA%7vavw@Wivi&^VNC@hr1y zS$yynzNVTu-J%r}zccr^bQ7+CqO2sY7k;Dl)JtciI(=*f#52Q} zMJFl8o^B&`+0!lh_)H#>ZqYXc?W4LeDV3ExnRraN2}U~3lsep9EmoM# z^ux|#o+^ujE`Z~#>m*!7$elH9n9DWNGZ*8zVP)2`ZWeLR;JFt()!pL9p2|}h7IVbF zn_+R^bHdZTCjthmNZsiS`v({)eg+v9BgHK^!=kPD8fI85lQ8}ai{&9WE6T?V8>w@d zVbR;!u<{=va-S=$$`<+VwU`SdRpXSj61xGZ|`X%@$Ee= zhDdlk`-EVuoncX8w^&d0vSLc?WyO@(%R(|Z^s+94L#D<1EkJ$sRI}V*lNrDqG6g^p zm_#Yl{`)p&tI4!j_Ag_A1+4PX!S=Hrdz4AsK&Hjj*W-q}MbzSJAs;xBU^*Cdke@cw zV!7F5FaX(*E<-WOfdZ+in`trT4=~X+F~~>P zBtuOf8!2<#$6}s*Kl)g#r?=Z-DXi4T;#deenI241WHFTQ-EmR~yN^XFfi^WuOu2vgdZ{b*RLB?)i z5&)+o?r)L7#0~xQAa~$F@{R3pF^V`J; z=>8V*lHakv#SF8?$WcoStL65$*k-uS>TgjdV1T7{?%G@M$fIcSAre#)oqw|FD7!#; zY-Rzl0T#DBBHW`bgnY;^=>RV9dbnQMV!9q^aY18`>6(Bgf+U`#h2x9C_j;;a+YbgsPw%i?680&$0MALK9@wkYmw01ii&Bkz+A} zcd%H#gb_|Ank~QT5R0e&;*mV<2vrM1tf&@-SaC&Yqxvc7;S%2twK$~Cuzcc3ElPGQ zXMVTi`i%D2Shpb>T_fnWhlSkk$g?jZonFlY4YlP%Eq?7zlNx=Xhg!*`Aidp3e5l1v zE^m5+g~Es0NQu^=Hd3N>D4%&crVO>17=oF4xyA~YjmV1ctjyTfq&u+GtfFHKbH8zZ zu8)tK?(ozwi`WM-p7xt^wO3(c13;IKJ*09>^FpDIK;~Hj>XPByYm_?D9Ze+@Z z5_3AtVx0tt46~6)5q8ETH{-|Oy!rk?Zkas>8@~$I4(aAi|qDWRrc@~oejI>y)H&H>!Qi#H>(H_AbsWdXu;uID5 zZDh4K(xMxq1zc+Gkn1anx<^_JG{YEFHHTJXE=?yW6vR!6!|b@Zaaa_0JPrvpGixHZ z=FpnhS2L-Wr}8cSYvWS-E)0q*h?A}pXo_FTM?cx58T2(H4Z6n-a*fAL4`8Hx$@48n z`lEc5Fzi0{;>?S&>yp!#$P}ym)jqcSodWa@Mg&;XWPcN!Xp(v{GA|x}vGhob8WM%+ zQM02kr}2WuSkZW8V;pXrbP)z$G~^MMAX>)zH6MK{b?AOS%A~E=ar(X&0tnh@@JX zwJ@vJ+FICItGpKW*XmLmy=oWK#Sou)lDa$U;@HJQ+zlOA zZFDvC`nNrLM0)(U#%}-P$i3>w{YkvAh-LLqI$*kP*QJKJshmpu0DFy&!~@e_0QGE!i$f&Tlc^E9;`2?IH*BZ0}N|0v4L=R zKkUeZLY{m<$S+(!Pt0n7WzQtp*tIY48K=%U{OxY~ zH6iE}^bTZ>&LJob7C1?1FwcQS!MYGIm^9y_EZE~D2PI8&zQvHJf+(4%fML+ZQPUlF zGU}WIEu-5+OZ({Pl@3gdp6kH8P_m+OS!L<7G6ZFn_c}>g<=qY>ROwVj`m_!~?YwmMgVa?*2m|An@dEB&+n^|*F zO)L(3X4abJzBt2bO>&?pl&r0_vlhy0?RVm}wYE6WrFO5{a>#<((^v;6$-Rsg*Irc{ zt7~s`ZNjYyxsA1V*2b=|=lnWr+>iw!NUWPuSEkIayTpO9bxR$X8A^84-Cq|6>UO9n z9mxskS#PA1WQAa4y`p+3u25yyLxLsqkZyf2l zpz(^vSlRfn>q$-ykaSVciv*;Gpyx${FT#+EMmTZLi~2jTC9+weveVPnzf}F7D{w61ycxn_46I~U0Fo9{2SkgyX#MYIT%dWspuL^qY zT}R#)^8Oc&d?Ms~uBk^^bd@i{D2pNDG&#y*lz`C|m*0(dTOgmQp{J^H?&&*F!8nm= zDi-m}a84tY^)Uz1Z)ZC7aLMREPuv_}96fLr;}DQ+JJE`;!D1hC%cS@dd>r+&!VK`E zEv~-q|NjSA{%^0~kjAn9lgro+>^|>W=2$HJ9~U&;-J*Xwz+f8X3+c9eg1I05>1O@w zQT8#p!oRs=f81=j&qw{l0BJ#1;PH0;8xcR0*vtcr;mIH7v;+MKzVvT!IX?PS(B1E% z#YbRXq;Fl~+tC)^{(^WqXO3m|(}JMX9isz7t5fJ~IY1BB$O{Ubd^nSpyNuwYxu&4q zOTbhuM_42gilZ&gagm>7QVqH>onuyz>n1p1l7S8wK+DWHV2YR(M_Y6dCyvn;qr@gK z+Tsw7L*_h=vp~E}j)YxI@Td5mDzK=36|TP-k3NlGlN3@^Dzye96^a<}u|l*11++N+ zd-+w@uy?RXcvN!;`2AwB45Bbi<-62_eCtqNc8c#Rw({9$8YJtK+38gKxj$0IR%c;KF z81`&0%i2QTjiCy|)krr%kvxZm7V~AZS!l5!1Z(t0u5U*hIrKI*UuZEV1RI%XY7myV3*AH?@cCHexI(`ACSkhcN?00r7UnySj^a{ZN)A_H20HN) zta4z3!hCNQ3AR0-cgg-{(N^3y3N4mO4aP!?Wg%$mr!Zd} z?MY14SZI+Jf0^vfx3WTu;j%I>v^e1>G9jGBNdXi1TrX4}!9EEy zm_X|#<9a7poK#6#nkqujMyEST+Yl7W{$hf~YKc3XU?VmECRl9OM>LL!rDTFdJJ}OV zu*jx;e~1}rWa?37jKNq_;5OR%CJ24IT*#!53LP@ho0?Lj+Ge ziYfGp!vDdv<5) ztt>s>jT_)N*6c2_j>`_Y5n-nh)X?UK+zioc7g@}Zd`!qf9i!Ans;Iy7<LNS#0secOptvX$ouP zK`W+hUm|Num9&j?-1zgjf{>dOcACVbe=ey&u|*jJst+m#-51k1l%&x{Tv9@=ZOC3p?#|H-kf_Sytv~a+xQnj*!c)6mrY`c%Zcs*!&eKbTQ2m zvCzddi#I>Ohisl4B@=*@yNBQV3woa4CB=W%%iYvo)kRTJh~shTj?qW&eGkS0PdyHUvHjxZJbT#Ngk_S8I!M_$J3KOupZtogEl znP+j?P11C^BQL)$+)sQk=UMa?--~$`gF`S*oX+NjHk^5(4QIXuVo>R6kEl*#Ty$xO znmBanwYctSPc5>Djq}t}i<;Nq&in9KqCzLtnYnZ9zwp=GiTfUw&ez;5gfEMw+=~AG zM_FnyfP2zh2}TLIp&^&&mUa9~Eu#@p%z6>-ym8ASv$%1~?D^xCThzY>)6_i1xU5t- z$GrUQBwgroi@WZ|6R+dF5AgLr&_VT7D3B+4xy9X2cqI2Y^7?ziz5b36TI`owu#m@c zi+|8xeL1a75ztc{lb2fz3c)K9BX4~v+}nU+Rjp#~9UgWlQ%%zR8FIrzE}u4!iDA!mvLIVw zu{{LGm;t}FxGk-quU~?WxZs3bq6E^du#qhH0#Y?Pg+qF1<}F!46M6(>$=7;?#cFXV z7qE$0fh@|zU!TVhK^wEk$R)K6L6*re$T4|NEPv)PQo>>dU*OXWri(pig~dj*$938y zV5P;i*W=c^aqml>T5Iv}<9OmPg5GW+BwOCcYx(!!c4V!^9#=%8f~j>P+|iJ0Cw1M| zTJ$x83{Fxtv78C`w?(y#mgyKnB*0ne)>=%$2JWKEfpRGtv6ivMo2+!2U`riX7D_hR zy%ziJ5hvbccQ`P|U+2pR@nswm3=f1G9*l8-+GlJEvZ6$MFgU>s&1YSka1|kUHfR%t zwo&Z4-eS0#%f-(Ig)%OD&Z$I=cDlXBaGj@7pvN$K+j@<1zE$(gTy8^HB4j)-V>#aC(ueWH)>^JSDwBC9PmjZS@&8uY!+r`Ucy+xvKr_o+B_uYDnH23N5 z<)#}XVVvtN@^k?eNsN|QPkX}@W=CN5sP){KEp@%u>v9J+gdj;Cn)P&{N;YzWb7f7x z-eRt771moEH8jYsw>TzXgT>#!K?dIhWBKlxLT7<>vK`)FQTH;Bq@E);-Xh#x4+(kX z86hwI&5;&D{`Pl#!@#W#)|pl|Sfn{mLZ%qmU@=}zp>z2(zlG=|JW6i9O~{>p5%SjiXhA#fW{balfiJ%m;cxr~Y_=|;QmXv@H(PXbM`t+1 zW*b?MY^Iw`iJN$Q2sX=}V6(+$v4(H9$d)y$fFW8Au}C6TH(M+gu*Kq$C-CIoJ+;ju zrkbb99NF&34o7x6vdfWjM|NARQ5`kb`iTKL21^30aS>bl0~`-nkaM@ie&kw=qH$=t zztG42;CSFs-r!;(OVt`BUv+jc+>(C7-C4t{R4>xf zBTMIMLB`uy%v3BPqLSe0d)1+YjGNFt*7=|)NX>u{)(ZpKHhK9SM#UQ>? z%Su>P>1ZW%t-Pu-wpZR+83!t#tBj6SQmP=mZbn_1_rDI69w&m+0eZ#^h(T7&kQmIU zG^-L8Ra#XETdHJLMQYu2cY^z?oU4M4RnHeKt+u8bR$j2-0<5`k^Mx21J1Q1qW7Dgn zsCsdA%&0!UI#yOssevIi#@4{(8VhS+X^mwyu&T!P8Yr)Es0NPIIa$Y32P`(krbkB2 zbfb1v$G+;vsw1gJN)3!~IW>w$?Nujjim28V9^FCKv#^ShwNOYg5Cw>)h%#8$pIV%rrBi{YwaP6+`4&A zE?>>L{(2wVSVtqPZmyG03l;`);?qO0BRCWwJvuuYBcf+TOWUsKJr10WZXbh=F=;U( zJ{z6rz>t_>4iv}Cci>P=d?mE3G{Zekoho&&gdUZ8pT}i{T<=QRl`uH$xvKK^%Gg<% zw$%d`t154*EJxZ~`G5oGDtD}clqxH$h&Z##z$zG2W$1ZaR>%#lGNuZ~hCOFhU0zj& z%nre+s(q^=yW03_m{M(NH6+$;=WfWFY8$H|_ku|mVEP3sFTmM4iB7)Zf~^-|_=Qt0 zL@9j@PS!c=9@9RtLt|y;z9C4jUQ}Hq#nopxFu(dr2bP9lSqM^UbghB(xL$EctC>*~ zqie3Ji8VDh)WqhRyJ})j&1JQ)s@C>e*jMXZEiA3QrZ(2q+3JqG?!0aX+~b&0qkj!7 ztFg*G>HTXAse$b^${jbh#^f4USYxT<4%ay6z_}W2;?Op(gZn2;jhpSj?6@rsoQX?x zb5E#UT3arwwDyA9SXg_h;|ABsbElJ6XIULj9ki(B_U%NCMR4_XLhgDLk1^!!pv5bH z#ar)-@Rh&fZHM0f44BZPR3#N5BVbT0$ndhgr3R6+) zn$}3h$rDzpWJ&Wvy-y1`q1(CxrO9kK}4cie=||(t>3|Jyl`x=u?R2zNZJ*Xp)L{2h}3SRCkR` z-J9N{6E&vl{j9H_#1rhsI&LeepxAD3$Q(8}YdTROIRMDRRJv?0O}!cSTkmMup+<~mg-7nWvO9NC!^%NHvNwyra-!#`OoLXC257l ztUn!I26YH}2N)Vm{I{ndJ!byvsfoOLQz49ytgyKLQQ@wCSO~pNE39~(R#+6P6$;&T zrk1vi^7~g%JxZfcg~b8cD^^(a7AQQb~uJ~+M(4t2}UIo|SU5!lGCIsE2 zierUE_YkZUU;he=RUz1J4!Kb~LU34OH7YCyAkW>%fgzZR1x_+81Pig5hS(#(Y$+MV zbG2Dk&LhhX4*~P-R9MWD8h#ZP`y>l*g+)&>YDk$5`W;nR?DY4!U!q9j$to<0g6V-w zI4fB0!0ZsLkN~6#icT8a!?Y`^GM(vX z<}%sqVI9wGY;%}=I0;BWD$orhfC;RaQNl#=t8fS&=X&ugd{?3{hq)jAu)09>xfwK4M-u#b1BA#tbPIc*VvdA(ow8VLm{0i>SH&qnDi|$w%3=g20HtCA<3U7Kd)ngm`#q979O0|| zj72k6Y4p@ti`yQ-Q_necpAeVV^elZE`Y|^o-G0x~LOYIr_B7LmTw%x+Im=3<=PtER zVZUN#p|iAQ5uCHA`mBUG$NS<2AMfL?2RxF`s3(i}@fppzEqxT)br#!fKOY19{V^Uz z3Cv(Mz|Y~!W??jzMVG~(JSNgO(ur0_OV_kYiIoN9SDsKAi!1l4f`L_5$BJk%i)AHN zIbU?@!bn?_yQK?Dw6^r6L~BbQZ@eqQ&wdt?ptxym=|?g%we(S8S_4xs8`4frKx_Ui zJ?sF+(E7rOcw*&Q?$joQpjVZFRitTq>|u9`I|L;7c%g+y@}eW3{UqGyj&zZYOoET} z5M+s}Cc%%yMJD)>w7CgB#z>yK1Ro{x%1ZE&D1O@sK9WMvg&A}Dit#GJkAT)b`tku7 z&JF(zn#T@`cD1!HFU{7zyfj<;xb#MkgeuzBKJK{}Omx`V56L&&j#=QLzz8L5r^JgXc7^_MY zX3I7p!b!(@;uoIiV}1zMsa>vVeF#!@SM8~`K8C7c3M)iO+t$Zp&*H^b@RwhuiFwAc zQnhv+)2O>Yr&>8~kJ`__(lI4HPpDH&Z+p&hgPcB-&JoEzqXV9K!6SO{6Cs~`fiJ!l z^m8iHCU#foLkE=cbU-;N#^Gci)745Id?R&FM-`YY7yI=|EdyCG25CCOaXsa8mh5Aw zIG+gMcP-h+D2e+?_Ax<<#w7b#Abr~Tpu>ARA2&VWkv!J|Ek46H$yAT`P$U)JN=8$Q75`c0P{Cy=m{G5hH7TeBFvJTYYKbpkqP@AAkM8BS{n|td2h3 z{M94r&pc-%sM?*XW+@T5K%0&}b}E(x@91M!2#zxG*(pV>M@Jv=x-Ba@K9-5eD%HoD5L|w@ zG~D}xkQZN(K#o+O9%CPTDzZ;M#~0rSnxmE}l&c-I1#|wCSixj4*nN)9%qV|x5u{-&AKI~A&=#nMkQqalg()`y*i%0%X z3}63lu4K)!t)2LP4X01mOgPZVN3voBLnl8HL)?k4rb4<8O`|gk7f)$E?sy*We~s@3 zDsj8PB(;!si7pyh)M`%Gv*;EoG@s$okpbJ8vy=JE(tK>E zMI%lBX^zP7jZxSUwI@o3KmR_y{!Y+9HCPE)C}xQ?A6;~o#uRaSN%JwwF66Rzx{rYj zpFbwmQqz3o1c_1D6Ll=gQ(b&mN200;cR>vywHpa(#Mo^gw>;pfbk{T8m!9dq^i21q zXSy#v(|z3gq^G+2SgqD5^ody-BV3=D!7&&Ta;!yyzIw36I(yJ!j=#jmO1cHkjG7mP zQ!xpZWY9`}RF|+gP*#u|Adj*CbAx#SHUxVE911!|p?B2eDCzs{&uFFE(9Nqqi>WdH zXjdQK{wPxEF^^B;8nsJdTXaGUl45$fQxiEe2}mzje!r`avglpWA}NpF=fJ+`gV9Ke zNq58YnbvZlUZT+}rcVqG$DE2m`${S9%!_HMZpTa;1ELF}F)n(Mo1$HG$7rNPr#Wsw z^hgJ0MbC3!Uf6M|Xvn+z*rg9JR@z5ykQZQYa43+I8XwGcU|z7ufknXv2RcXfj`CDD zA5||DQnR6_y8EbJ1GSstmM4X|pt@x3?(XCATRhdnXC{oBZpD3%NeDCCY24hmU?@ z!06#)x>zH6_*fyiL8t}oY^bGN1DyCp6co2@%Qj)2Yz3f#H6Q>j1V-r%~QSHTB(;i zgI+$Kc@Z!DDDt1$D4{=-X8L0N&h*9lo#{(jmrNf_>(bk&tHEXW;o&DeGOx5ii)`ho zK0c~miF-d4RO?FI`w(7q%$4_gs;@g_UmtNzg=>1JkoUh5(&8&m_4Cp6Qe1N@?oZ=u zcL-IT`CRBMWXQ2EDe3$9@^JU_ap^U<>wXz@+3zS#-kAM-q^VwfUGV+c&quzR=w@&! z`1<>}_;!z^dOfjx_xDlbcU13UX{vv*rv~_V=UX99J}2b0cRV%7$Ggc2J(+rOr((^W zLHwpr^)!fU$ev75%a2Qu!VEsW?R97EsVrYo3uXBzk|pF|AFIUOD#yp;?G;jFV2&@U zEKd#b@t2Q__G4cXC1Z; z!S29ghi2E}@mKJUbSt19xV!%!`@YkjlPy*_CSHLN?gJ>5WeFepeSA5M?M8NT$$wAmI@{@i1rr0W{$qr0Esduo&q20oM2KwM)HG;Zdp z(LOUvzuy9%ekV+WrnvU{2oiGZ-9l)HAMJ~7aI}vWpNf#nmC-)FOQQR(kH**H&Ij>$ z3w-h^28hAGz{dj-iARQJ(E?wxSrzzr@Np47xI-iEs$#$%u2 z%Wv`1`3;|biPnl2G1iyL6XSebbS1948MoXid6LKZh^vnV7vaig-tUZ{X4kQl!K-hE zOa$F|p9t=}SI7&m;?1`sNXW-u2%%PVypL3>?lRRNZncXQ7OP3r6wK4uqWiFJ&Ip4U zW|cud%w{^rwiW~Vd*@zRaHYrb=_*rU5|tu-Ot!&nEC$BfWd8C!ef0CoeH`^u0<^m_ z>pu^eW@pm#^`yn=|28xw$P6$z*cG5v)Ttq*Bf!Z2 z*=@tW>9O&OL^sDgy;x%eo%t5CXjD(?1IqpVJ~CMeyMNWJsu*5%bXAP6T2vLAs_v?a zQ&rbh!`y8Fm_Tb=EW|H#h%#x zu^3-{Vs*@_KBqd4RXN9dkAYtt*vQ!t6>*Dq&5f)|Jtwa+k{JR(Wt`my%3u&JaHjT zUD!4j9b*T?A}h8q7L#J<#d@51S?uOmY>V9!i~X^^s-s`^@zpW0`mE}hQ+;D~Y@sRe zWcB14GVkFU6*X|G1_Q^&`;I#ua%X^bIdN*;E_KnR z?!LN6s+V358TIDZ!}@xM>fw03JjOvSt&dIhJ2XIggFX#p*8U9c%xZA50XjGA*AQ6^ zS2x72hVhM%*r=!x<~Q2h2wNK^HAYI~E{$bCL6hlC1WXP=-etv?q2#jpmx;LW4{oB5 z2Oh-}KYOak$2E83zGnpe(w6oSi7FbeP$CZYMLq`V9E~%&6^keDHYmb0NcRB@i61Y8 zm5Y41u=gS#>0<9L@-Yuf`A6RfY>~LkA|LH-I-OE|bQPs-kq?(=ZZg+z%QV*N^%||1 z5_k$7fi@ZD^qkDq4V^IEMNt{Nvm<5Je3?}<1lV$g0AKOEaFJ9+Ue2io@ z#>HHlk7GE~ald8YQGV}xLgq^Xq$xhS`r~{|@JoHn_80k{D)#Z+34>m?pGB5k;H7V;XNU@2)WLYgNlpT={^n#nBk+zEuN5@g|uj?9A#YB3?F%-_7T8pNHcgB zxd9i@T}$6Nntod|e9V!OxHEjDit1j#AR~Piit2ubkA-HNlcXXC(v*t94lKdW5bSWk ztukl$NV9{jbY5b2hJcPxZ1Qt_X-e~1gm#9HCH_t)S>o?-AT7uVT%TaD151LPA>gW= z^F-xDxjv$C=R8rnon%QA3j@#akr6#ATKZ%}=R2@2`a}qhJCGYw8Y6vjV@e!29Ftl} zB!^?Trz`PM>oVMUljo3-%dQdfBpqo>d_4I&-h1CkUKjGWFY(n65hUb?U+` zq@(B+OMG;c>hPsLZvPoQ)Ln;X8Oa`lzGil0v zAAJ-JVe@@-kvvNCePozP@YDhypMHn$rzlS?^wBP=V-$u)W?7}PmC(9!ugVxxxwNv3KNWR43T>i0ME|?S)|I=uULF2< zvYC}+^b*+vEaV1rjTT9gVZN4yzGNXom-9Jk&tMjrkw&6E#xW2^5`{6_=t5p#f7ffi z+}VXb4jNWl6mZftCDMYBf*hc<@;rBTgqkK&d@q z(aKNqQ5NhCq^&*Ow)^;fxeV;@{~_vkJ}2VtejnB`==TRF;^F>i2bTD&9atKI{r(Xj z?SgLZNatiTv(U$kV5O5B4%$T_KWcOo#zYlH;ZW4cD4DWjRA&b|N70>ap^xt3h`G>5 zR@6|}bULb4wCfz*)q%q3X%5VeUK)ZW4y=jZ8G`N6*l|85b99QC7ZU+p92g%nJp{!L ztd1#*!Je4CG1wQg|2)y3IGLm@W={XDhXKzhbY-{T=9E zInRN-%3~^fY7u|eVqgJH?TfG)D8mqo>6Uqx7x@@$g-i7@Kwk5Ud~8yT7F$I9IHSb` zwAM(}=W#OeDc#9LK&k`9SO6@Nm}FMqGtH$6Lb@8{Td(5 z?!sLkc|@PIQfS2-*sIhAC6WxaM0skhk4NaZxz+40tQMv&1N4><9X)OsDoIN+tPx|yHePifg+uiAtWamDEawtt z8&^ZeR48J3zHL4Rh;4D35Bi0A1ZQN)ROTbL8LoZ~pL~IK3_X}FS$E5P)NAIEJomPc z=N%c%Rq#~N!EE>O)O+~gdynY;ryO}g$a^0M>7}UI+RpPN*x@6QcB`J^7revA-@b`N z{R;L-x+`jccKBEzR=6EL77EzuBlarX@;Sa4O2rmqs&@LQcNOk_08jptw4I_}VW*F) zZt+N(Ir8~8!qNJ&lNP)Y%2T_1ND8)MF`(`8@#>pcjsX@qcD%(ryO^<~>nt|eL#%Bz zoEGcpK1%)Nz6@UaZyM*yns%3uH$THS-=Qs?t9sEOCI*)2YO}&VHBe))9-=W`irw$> zk<9>rF-$YK%B(gr`DfqYJ7zQ7`fS<8AuxSeLd!2!e40lR$19Spf+ z<{aawB0UFKDp7a&7#M=_ETgkn5_9eHg_9`{S(bg??qj4LqeYS*g1r)pQSM`32r6`UgF%MH^2>b`oB2jYObx+8 zv&3Mjc%7B|SSs03%Y9jONXG&@feHV8j0wRUyWC0UhM+4IO2hm--&4DNRu#MNb-eWf zK5b3s+ICDdC^h<)Dy(4P-gw)flv zUtqV7*WVJ&I$jb5RGr~)IJ||uVNLZC!R!$4}@ojeLk+b7S}x@0!A0SBj}wL_~18B?f2ou zG6BKOw+Itk6Sb}vbp6e^ z2!6mvnYc?F;MeY)Lb7hJWddee_tZfj@v;aw$khnn;|G0|h7u_@nkiW?4*FQ8%QPnW zD!9+ky2P9MWX~`sT(05!sm{;JSj{$a^mEOyx62?Iv zJM9UEMV_(fCE278`B)!!s1{DvYFFDM*QeT!YACO^yavi@#K$2au5}!S#W6Y3As=(1 z4o9J+^0La`eLCu>Vsh=M}0j1I^O&UpL~ZOhAFJpWm*P)^0gyh3i;t5Lbwb( zN~fuuu;(!!HEN;hyZDsxf5&`2t9Sjuh0-L|iJRbg3X4^w<1WQguE%_wP$e33bcE|k z8}S^m&>ZtotEop)+mUxa74AJpmdT@bjIJ0vlr*foo#1M>u(^uZ8qluAj?lRgr42aPV0 zC*Y)y4SKuAc6nQ$^fA#)XSm)<ROl64$t_f9smE!|)hjh}qen$!PV}i5 zbg4A7vd12>4p?pm0uxaL^zpNOO!kwa&?hQ4T6*lpULehm<91?&MY`mzsPNI zcrViEQ|e1e1mqYd_pR_TP;xX^_!u36adx`vnC%boF~pxtr&1rRHjd<|KJ*CnF)DgY zG{!{FiT2bfAB~?D^88=$mlpWj51u;hqt;h6uVTEJ!%Dtf8MM;qpbyjIxs^d1ljGza zbf!i>ovksR6<#*E9%nS#n9c@$!fx4Wl=4)|0GGaqIr4+H3UI><_~;i;wGJ?m?qRFx zT$ax0z^S^F&SwE)FT;&*qs2cwl^7tK9!-1IAy)by$;kV;+EYmZ8r&MGhSMfMY%N^+ zwpcscbJd$k@1@gHT%}EbTki2l-u+C-d^wG_0Ur1XzYL@&)M$mSl6JIhfahQHNF<(}=Xd8tgQ5#~gJtnJ?$B7dC ze;QB}h1LPjw1# z)pefg9H8OlLaJVX3#to>YlzFA7sQ`5Ex?sm;g-kn2MWDJyPl1MkjNTNEgkt z0P`gEeOiF+x?H1Nyb{v_tTtPjR_1__AyY6Nm?56+X#sYjzeTpVunX7yJT9LmhKc?v zca~-TZU=hPnJXul7RYo1qenzzS~N@gqy)TI)-RN_;c7GO=~ZIw}0IiZTDx&%zV z(%?#m;)GoJn5WVM)Or+8y@ub~vtC93wxtK6dF>jYgUV2trOwhnD!|jt@y_2o%EvLM z$7Dqx#clx_UgD|lj`Rp{(Pf^>2yp8IXh*NU&U%1G7PtK+k|ZS~Ku0cRC)2HSru$Rx zRXCx}C{Oha@c5H>@&!Tfe1^|{^i;0^jc>+aQBL#wsUz7dz#M*Ub}4#%ML6j{ zm#KT#>y7$%PQWJJ)p)9RfVg@>YC6KoM7;xCagC??$V;tGL)?11Fm)OVdFUCu{AvUV z`3uue_Y2VcO^@W_yM$bFxsWTa_Ei4>*WN4S@#lqn@D*~!yJ$dwzbA3a!B^FQ0P$kG z9}u8ZC>bG(#sL9VD1Pz>x;r~CkaRQ{s`Io*&VfMz9-;|oP=IS5@<>`Ls%-`Z5&g}e z00|<=4p8eNkL22$g&Q_Xhm z?h}(8h=-?)II2!La4ZC;R6C76^1jaw&{x3V0OzOxY$tBegM-M*ad3eCp=6ji?B)bm z%wKdh|5gX-M|E1q8;|n&tgo=m>@nEKaN(n-C6It3R+yd!GtZoLcaV?$XAYh z_bYy*k9SV+JB=47jGO@D<;#;3V7a86$q7)d_c4O&pq43)>eCvN{rNr?`K)uB6JUxz z-5qR^yrFXfFh&B2rk}w;lVvc1X{1Lpi`94reN8hZ2Aj+_gISmlq_Y0ja9dzeX7^Z3 z^e6i$6T?_efHJYP!gvVmuPI3T-~_=YSlyitEBh)p9^W>$On%6$h(*u z;HL=vIYJYu7)lXcSZ;u6YMa6i`VAhI-C1scPVy}0@|W+aW#V4Cp94#{dORRXtK0xb z7&&)B)}OfnPKDyrAxJbS2B{{)$Rw#I&4DhVBs~NfOvRXEN|?PqK$BPTb~}ZRsuxw8 zSqgdd$|~j4y`1XCHo8b-p6!9(Kc=J7v%zIrFy1U4Qa)pzs8<34LjAfbx>_w7AcT4-*@BrWZgx{ohZ+h|Nt1#jr z9QWtmbsEe3S3WG{s%wSNuXK2Tr=JttE_(3c z0lFa@7=sCrjy=%_=mWaJ3=h!%Pi^F+Qwg^Rb7|>VE9UOu0hWRl-G&F)8cLFEck8JU z0ll(@=>_y{;8$owfY@ts=fl!ey_S&LjfFJ-K*$H5;@fy7(A8xh!C#@wN$9&EO;m0O zI3el9Mg%x3>VOe}cw(SLO16v$Fx$*C(s6z$SrCF<5@(thpy>^`@h*?(nj3KA&4O-m zf?FN=^a~NjD}D*`0<;W4s}Pi`ISO;-Va*F1H%}hsydd&0=LM06IWItK&FGSm0XmuW z28Yd2gA&nnj0~{I9=C}1JJa`&mH$TuSgtm*#(aP@c`J+zP$2OQBLmFg_h5x=<2lxG ztF%YX?e0egSQEDI=SJy>KI__#NDRTq04GAp$q@9Gno%PI^b0{giXpR(mMZ8xhY$>w zmHNm4IUyJlf}MVa@2UI%O<%y*3@6AB@HJOh`GL6j<_8jtlpo-QuchCMuM2tOJt3VH z6LsYWNE0wBz{8K@xgXI^jZrwFxEvc5;79%{qxcc+q&C%cqy~-~Da(s70Y-=7 z0s-S>&L>~;BIv2#(bEpKl_DVHc$d2I?K4GTfjo)hxKx==(-vQ=Ay*>q1>*wD3dOTS zut#p`_yF}9pkY&wC_)-J?#&NH_~94$@<&0Ret|E)7W8)~prLI%7foCl76!Qd3S57; zM-(AD>VL=g+b((FXT1x5hx6>R9?k}d^z)-JRuN0(S!hX zntCLc-Yn#nhlSkwu%{*lxbYU;_c&gVT0dnppzY$?<%ItCjfEPM^?dd??0S5WM0NN! zg~<&3+!u-;e?i7S-dsoX4GA?E;DdG`<-3J%kr}DGX3K$~#Z=${&(; zbUt&zbwvR#z8crvhliex7(9ythx^f8iyIQwFPO|d1i_R5vAN14%~f->fH}I{c&a#n zy3CO%Aq;RS4p5`Ma5d@*Y2>;zcI3K8MR@(Ao|+cO6EH21CtzBDdmb0zy^nipx@(*6 z+NKA1sf7q%ZsDmJ0czF9RX5?zXM~|I?Ti3--6z~lcjEnzJXI3lvO68Q&QqmS}x~UibtZpEhkTI)I$^Cx!k4s!$aMSny-d2<6Sz)B#?j-=xZxyA6* zya2mZZ;b&o?u}ry(`?!hR_T#c=*@FI?tMr)KJ~1S-rNEX;d`Z6&!%FKFY0;0pX5v! zJwK3v3j$o+6iu)8)WSew=h~_MbgKy%HSo-~;(w-o-p*J|w4vkm5%r3T%2>iKBx zqqCpkqdzrr`CLU$^-JkvR_?ozN&G+jyOD_&DYmn9Bg@Y3KS>wU)YjKvm?!s93ZwPYBoTl2Sh2bIKXqS;OUb0`XkomgV;J&7hpO>;-%Kz1G@b%FMm@^SiJ6{fAYa zviD)P=UMB$*4kmt7etC^b!#szcN?hVFUD?Ki0n|XgYEje4b&^=6rAJDX|2JYUSyHWE}R!Wwe$?t z0~c^Z6C@?^YpvD*1#hyZL?Os)t$`AyoZiYL)fq@srYRtYH+CwARh(AO+a7D2MzDrS z+G=v(pVknfhmp^@NJoXfT}Pe1U&mSfrjBqU!oX}}2Sq)FTZpsL2>L$P!YZrU!Wk>u z1H~RoJuugExu^K$5o=XCBALY-|KA<#;c3i@>*SX@ATrn`#c_aAjb25KH%D~2ZXy2@A^-NsdeM9eXM(K1ba>N z!g{Z!qyGGCQryUKZ*$|a`;Og>&nucz5iFG(C8klH<-_V}6~Wph4OQAM4Fw*>9^7ps z+gIugM3J*5SDB}<`aEyX>kM31PXjxQS_5fTwuPNuhwbSnA`FNFRVk}8FcBf(al5E? z@ph_1wV%u2)EPLfh3E*Q@S7sNLg!v5^|Lx|>fr_=jM)altvHMIbFD=d7FnxosoJWw zP-~sBr8-Y4I8$dJ&$ZEoD%W)vZn`4eLhd*4`Eqi9WhyLGFd%xr(S+mJZ(ygg+it2? zC{FEw0iRA7mo8DFu2%)gue}KZX&o@|+8eBRd>k?6?6Yc|EEQTT728tali16PwqpjKejaBe zMS~qPFy?1`7UdUSA~zG#iZ1+2g(u3=%XHK@PudeL(+MDb%)lY@gel~413trf+k4!= z4^s*3WMI%3Ax{{bqV7~TM2p2K$=ph*zvTsAL^WeXWqhx-*Y2zpE4INqX{CHB9Td+qaErY zmGz71$*PcP3d+?TwyKayQ7lzfD_Bpcl6h)50Tm1m-?~VvXY?B&Y>o+Kh`ngwiRXm8 zWZ-w7;9IhvHnD^>AVcgvi6ioc#62xi=YIFeMK@7NQ*c?kr?G0fl1 zG8_x-UWd)&CQg`Tl=v{iA>?%fuGfXUVW8V!Cf#i^_7!~aS5}ODMaY{5!qj*bS+oF~ zN0Dud7|3?hKww91?mLvC&h13<>b&N{m^Tgd9gMI4$z6s&iKkv@=0@Ax_}4Ijy#O~2 zq|j1*IRyYv0#Vc|2Plqg5oO}C8+q&;dTQn?iz$H@`2`BeV%sDgpoo?u^ohBnP6Q}3 zHjnw0elo&seS;E0D~gNuA>tV0s|O$^AEgT#7!ka1to++k-A95Hua2(v$T9j)aGb{CVI3#2ED@En3wR9&GjF| zif;%xc8feB(ffXq)JOZ_dQSvAM*P>W*}5JmAaw+sYpiT07_5b*CHzYuO42LjC z%E^s&j6b?dHZ`&$+&9qiQ9-2JKp`I(7&{KHe&3V^=79m9K-Tu^Z;Sgo$>KFnOdmo_-Cl{XxiR6N5ew zGS-CuBk2D)Mm>kuKEeYTst8hk^cB9DOsQlFC3pJj8%&m|^zSdH{3PU#OEB4emtf*u z@-I#?(SL}LiT1q7Ci)D+V{Z%MUa(WQB%4^mK!vF$e)l!L{$3E5$JpUi6ED0*IbJ@A zrh@n;Ui$<7@MnBUUhs4iAN+tHDDF7jL?~}|rK$##0`5IPmg2nr84r$nt16Q zB-0nXg#DY-OuY9oK1n9a9c40Vl0V}ivt<$8#!dQV1UTQ!2>WR!f|Z#BEiP1q%rFtu zl}Wcj`0eNT{96{jok8gaOmrK7!7t;Z&xD+AV(iPHYFE=u{DUkXL_;ZPd6~ps*`(oB zMhv|`mdU;L98D@p`8D0d2HKSGY;NNk4;Lk+KALVKSy`qu72=p~Vwti=!4&ca6{;nw zkXa_DZpt#*{WjA?KoB}VD~KC33Iz7gHsSv$`VZol>!-LOV+rd+^~tl%=C@_G+5EQ5 zHu32VDTs#9(l(yJs5O-GuTeJXXA^)ekF2|U*k_Y%Hmm6V$u@DE@}6C2Zi{6jd$x&E za=lS8ULj|h@aklfHe7ycmWfyY$coqgDCBGt{RsCy+r+3D60;cuKifo`e%#jPQ6{;v zSTZx0nH&?Je}V6QL;`^bIG@uU+9QXUHI|^(FTO*Vq&qIh#NU6$C-4d8m{h=6;hy{@ z-p6@Sa!g!PZ>yMZR2keh6?m|;<9 z^rZ%(tPD%YJQKU*eu?Yy0$6&D-Y^9wo_rCn{1waTrN5qTuLCkkK?<#f z7gA!JN%XNlPqv^^tOq;E5Js@8T&+mM5^b4=HQF}HDNMyX3QVpQ^^5TlDq{b)lT`g; ze7U+o{g21m-+Y9%lv<{Spz~?=?%+20LMEvwA~fMLZ4IRcy`c#@nsTS@ zn{YQhEeKX9TxPzBKEpBm1#Wxgb-dBk{80XV)3Y_-L@Ysa(m3_|d=r&&i`{EIGYd>S zJ_@5=#fM)Bx!Ao7lxniHVNA1(6_|jD3|QT0xYW z2<(o>pTtvdV+W@%DmC$!A5m%SFa+^GPLh~R`}I6|R^pOulqfbT?Y3|wojw8O3ioW1 z3T$bkvPHpmdW9XN)1Au|3QJ8~P_EE5->V|Upy1+C6MNMIWRNWbLX8xA<}$1x>`1DH zYkH`yN~I?#ODok-PQ@Zl=+|^1m)JjTiOD~0iHRqkXC)=TT57`O3%}ulIA1>|V?M!u z1yl7j6Y=^C9ZSh3U8Qf3>y!y9HW+(t{RDNgiaeESc`Y+BSq&$wUmlsX8&s4U z8|+>UWLi8=X(3{0g_~oP+WIPNr3k$1z+Dt+i02pUG808wgNA!rJjGwm)-g|CqGPfV zZx5QS&!bSHDjl2ktvW92w{#(woAB!(WxdZ3!tIY7O4U1fq6D6342drlCE;Ezs)iC6!M0;NpBStUZn6#kD@&}Z@AR6$+v*RSzk zoQbGba*{k;lyoCjnCQ|CXXHgGi2uziOzdSKL{KO6d|eP%PWQ|f z`t0A86z{ag#4*|~o>A&m?(klS|XqNi(#zR`Y0~4K1qjQX(OY4jc z1`ZfU4O}-UZCWK&ZMkP5#1UrCeDW7ko~)2Ut~b&4Bg}Iyb21-I$doyl3lw4#nOed% z+;fE6jp156rM;n~E$dCB=o_g(m5GgnhK)3$4J4J2B`1&QbSJ73xNkyGg%ER+FQQwzca`Y-Nk{dJ}WWYgVq*5d`N5t+-B-v+x{wxvwZT zpzO91tYV@Xsv?{t2iKb@S17!Hy@_ao?PXJ7-5Pa0N&z5UQziRvpIx~j*dbqBxYh0_Sj6l9%&%jNHFXaKpB)=|3-_uEqGjvkzg>BKzQ_- z#v%j71|_XqZ#HGGBgR$c!gAMY7xyf4Eq7tHYlAJN_|EXf9pCsCn9?Gn1!lI`-2$up zD(y?v)JUb%*PB?_qQpMvY~Ojl*xlkx3!H0lqXq7^SlANF{8rgxni>z=U1M7&v=nly z3G1d5a+`_Hw7cA9Vz1mMaX`*dkVh}eXbPpgs6WuTQv^jSJk+yl6RI_4s!ezn&O845P;imRm6yHX38! zXYTdC;4kko_g7jT)S8GPgv>;R^7_@9;2_v#{A#T=v60};+a*BHyKI3-`>(5FwwUkh784TKEy;hNg|JoRh3-+@qkH5#`+Dx&?f~6PyU9 z&w7*hto0`PJ|>8a{}YoxeZu6^@0d^w&M8_x2qM3EkI4_@12}C$`UoZ_6T*<3w*N(^ zO$LaZHqp7KkY`P}{L!H!bN(IB@d+W%oA|?D@Ym0fM!VZd3S||)U^05=g30Ke3nn`s zE|?(a!xa-oFCnj*a0Ln3Xp?I;xo(piHo0k&TQ<3ElRGxKYm<96iLkIvIi=vda)knE zEV7x6$d<^JWE_mPuz}u)R~Qf%{j1h^3x-R`1Pg|zkjXY#Y{3{Rh|vFHu?4puOF`Y3 z41Gb!5)0!A2xj4xxAD%0ta#;3CX}hY3BOumA(SCJB^DNveWyZ_9i_x#3>WsWNv2t{ z!73#d_RA9z_02se+B*}PV>5xQQ&j}v=}(7oU{*elAJnc7!zJ%;U>ciO01^HnGy>j>J$|=_L!w;mCtR7 zy4Gg)s7F;CQ^`hLVu7l;;+FcrZe!_ov-Cg>2O`*-T*}v}_Xs>bMv%~Z5R-O~Fd6>} zzWo=zCva4$g}2{DqNI5GQVW^3Ip`dv6SV9Ij#d1^YL+URrAoW*c2m!D@)m)@qZLeJ z?_{Zk8@7t_dN)gVnx#n;IQX#VBqc;ah!U*`S!O|cGEtg{DdY+Zt}#NETj(|fKW5S* z-J)=mzx*iVDvK7_UAhZdVIf7Xrlqt6&Nse*KFn(=+s|%xT>K~fNkV~H*h$%u3X~NJ zR+FP6QC(o`+dsndu25D}U=&p>sIX9>u2r#}~VStw;7N0o(h>Sg*6TIm05Q*n)L7UnY! zahrvD#&2)45W<$}Z5EO^Tf}w?E^l~u7IL=*S8pL}Eoi2Ydu>u@!7mVjZH3%#!QDd0 zgBF>N$Nyf)qZZ!#1fPXV#K={WWwQr*y=Zf-m{5gi_A&*-K8pR}p7v9G$gfer|Lho1c`kVMe1{Gr<)Zb64ckt2Yf@CToA1hOu zdz`i~XoMg#*d~vSVd=HsG5P9SCf}2_`83_hv∾p_ISKr!CY-LJFU@njpgs7Fx9x zM95u##)9;QZ(sBuCrD5zxq=1NCc1-_0d1Ic?#6`hdS@)W@kf?E{F{(xE%*eX(y7d!8y4z$L#Xsc8HB!hM7JLGjw4oA87DkN3sIeIL z66+|g>V}1v|H#rOv^2V5A%gRZ-JpLSfgWyHnEHzexAI5hhJ|g-%sI+&a7WT<-mb4BxJaQ%v3Lbz#Qqr9juRVpp@f4A|2>778#W2W2RE9qe?%f z3(~gjgt4y+8BG%i8RtMi7bdN25@?fD4vUO)Ag!56XC~RfrT9}FaCH(g-GR?mQskcl zQJlvm-GMrV>U^d<5UDOxxl0@tP`E|~u#j!4=?+`9P}@UUtx2NbjdTYtYn3_=S+55h zLQZqw#oysmx`C!S@Vif06D;XNli@(WK^XKRPJ2Xn3K9vMo8iEh!4i|mrB)#iP(p|- z1=-4c1&hg;U(WdtG91Wbmsf@Zha?rz$Z+5?Z6_zGWJjMZ6Mp@s!ou#SoPS{;@84jp^QG=If8)t+H1|LP0}Ch9Rd zk0~&g7+6L*%aY9l1Z}uvVxkpmVXO0slY8tljv34(n^`6^Ax<(QWIE9M1AO!Yf@K2b zrkP0r29%IG(}5?(3L+nU#bgR!y%`P+dIDpAhp#D|VWtD$T$H#<*4YSJe{o6uLRuDG zSM~rIj#4KootYkjx@Hnwbff&A58&LnO>^9I@*G#R83yJW^(IRfDV(fP-jXcck`W5m zI>c;3L^NXP&5wl4alrAckaHa9G+fAh2lC00bC=@tL)Azs+P_4_F2*J0J8&I0fqP^rE!QeE z?te;ept56kbVL}0I?Z=rg?Yo|wj1VJi<#+;l@4rn)HqP4zI&rsP{VMh56pwyiw=9&zlGRQqQW+k1=`tX^j6Z zRysC2km{V~WL-YlnM=8XcD@5!7~z%gz)6`;v3U+0=YW8G2iSHJNs#Cz99{I2Dpuv0 z)~VZ6Y-?^iq#mO{=xcUc1Y&>~Bmi^SA(8LEG>*E-cVGwVfE>apRvQGXH7**sWW?J4 ztOl||Q>}MC1XV+2rbsI%%+MqqF?t+D5lz!szm@86?9mR`SAiueF2QXFw0aFE|9#9p z{gjRdooa;TJFrhbYEN}Xk1!BvR2w`v)tF%*%b4>sX=bxD$0(v4(oH?%%o+BnXPJdI zGqaglXYH`Bd}T9JU7YVgu;+YFg!n}H@Tnxb z=ee0V%FSHu-R*e7Y=*XdvRN$caDAOw|UojW1n}3kC259c(kSX>LI_y8=neU z#B%!qLN0J1u$PbvZL-(_-$#WE4h|L&gxO$b-J8uS2P&#O8mGC1oG5USwg(|<4lqXx z(-Eha>a4#dCz78pl>l-fDoXWmC*qxlo!q#Ba)58L^&wO}IFA0gdra&%(=5!i=2%E^ zoN%DQ!K1S1-?PYxRn6nGj64JLjYJbU=GI@1s&U|gW1@fpM`DO9Pg zSYauLL;Au5W|M>L5@o`;DG8SnF7V`7geZFzB=e0CF0jj%D9dEHz{`KcAMaAlBf(oi zgsAg?26ldg3ml<3c8!SEg^Umw`ZyY7vVwFzZiK*?m+|s($!)uo!<5C9kXI1`+2nvM z#ad0sD1p9DVceha^#sY%YVvPVxhn)Kk(4?ljdp8`=pVhB>O#=+EJ`3$O{Hki1u7b~ zTa<1>;F)*G4fA7y#ByGjMGNea_oX1_rZK@pnwe=L%d9emj1lNL5ToOpjB~~EhGb>` z|D+r}7SFzbm*2*_ALFy1hAfp>D-YUeN*)|fOSn0V42Tu*ABd5k;j0vh3`xj>cwrY< zzDQR3nY2*5q1;svtIi_F)oK-6X%kpasi}gon;=#zHLRwm`jWPu+)mXLp}mtbD%I-P zr#Be5Y!p#4)+9^F1VM}Xpb;o0oA7ONXcnrARc?6abChsIO@hEbX}vH-;E^tPbPygJ zFJz)X|CgD3NYKe7fqHguBne!S^As#q>J_A#xegRLRylCWk?w(Pk3}BX=dr^Rb)E$- zEOw>2vDjVa7BuRJJs|txfaHe*&Ugsw@x5qI=U(VlDTT}sY#$@?2ut023z;djUn1;Oq{6sk9EX(A$lND2)} zK_i5mE)duaeILW)-{D6x{7n~x3(1#Mn7os8c~XY&SmHlsmFSEdVOXfrfq5lsHLc1hzgA$p9C z2rI!tgd@p;B*#GqjyM_|+&ERIY82B2X6XxblybVC=>psJ6FN@l=X6{r9DS6LW^(s5 zGlL$TBLsrIWUCUb85Xjv2#1if1X^~+qkqN+U*Nk*5~~SH!Rh@@%1o*jS)?FTrA(-^ z1SP8b;yX-|t0ij4)p$UjlsrWytxSuQP*up;0;Aq!GL0Xn9Dz8b0Q0dJNO2T8P~td1 zZ^3&Gq&Rb(sBl&}(dfM86x8=7y{qH(R2{SRJROUT{RWO3sRV&pVB)eFZz0vnvXE~T z5l%-SN>b=uj^J=VTqP)GqOwBe$teC9Thurp9rMAe#aKds;b|I6vk41QL`lhF^mrYq z9P^tautMLhbB7iBhGu3hp?sU9`#NQL$q{zN^Hg(|iCF}KSzul^5pSi^f0xoo

m6 z%PcIjLLG>3P?6~zfkH=#0|y+Z9XRc{>A*cl3YCklaH7iDX#W>(IVXEyvd3-@?DaV6 zA>PNo(JpC<1%ms z+bGAw8I4tS+Chrlsn>8uqwG<01h(jhbsW~`Qia%JL&#i#z&B7q58QF8c^5*j_=8G@ zilyo@6*tuopolg|mnkR2bgh6=de&$N*OLiGP^aUL5p3cl)qbBrSFpjlZDEpwZo*vg z?-Soq5U&1zHanS4a|Pb`7lJvsAXkvVGFVQh7*To&P;0PTw<0cpbK%IY6BM#lBiB2 zhY#xy04FHc={_cD2+`s-o@*P$>C|X-8V+gUI+FGII+p2sbsW+u8&j^pd`i|+rytUB zT)$yov>V191HtA=lcz|spL{ATHdo-QJc(juE8QS_Rh(4Ms@P}6IxxkN>_C>I$RVg# zkvt+%VO%5F*8>yb);n|4m)Q5W@SgPAi3u{F``)GQR3u9w*}7pNOl?z77X zF`3CV7n!(cW?C#A;mcA;-vubgi}si;t3k$KM^vBkV-;%c+B$J}qL>j`RimceX= z0<)}x_Kbzrb}FOVBrUO4*y{BZSFnW(rxglZwUQis{Cn0!o0;f{bqG0MAm6jt6RSPf zdZNbjm?uJAQ(c(ln&ZMr_a!$bdqsO;idT{sYP?Q(;k;LfHzK?vy>ZI>k~i*p-}6SU z&q^QE`keAXy6+NSBoA6K7*RuJ4Z*e{HA7G|bjeVZ53L@G+M&~iVg9h9VF(?bG#oRA zXAMWg@C(CnYxwQqSU+O(2qEVSr~qbah(%7<6!6d&bZJyybE%=yiturC1R{SOYn z%>ls!5iu}oAd&{A4aCfWa|WVlVDUgy46Gc8tpj%r6m%7e|6fcJ7myTy*Z~Ls$45Qe zdubo+?sKpYj`ykWgP6X_eUaLCQD0o^d#^7h^^59(s@I`jIM=JO7lM0- z^cHfyz{h_T^pn5*C(rvMr3IKTu!FD&XV@FZQmyin6sb<7n2Gh^5j8jh9Kkk9Cn8YK zWi;jsG-?q#qVzOMil47zo?b$+p4B=+9$WPo53JW4X(1A9U?T0I5{xw3NafMjq|CtP z5g~TBDr2W%_h;bPe1Y3Wl*yV5esRnfs5Cd)nv>=v3n5mz#qD$K4{N1`-PRck=dBbc z>rBc4ZWG_T}P4VJENnR;lNb#!i!U?bQwkpIs!W)s^r@Xnt zCGWf5xaXbggOxtDJ~-u*?#ueAEwWlPF&Q>f)#6|a9BOg01@5<4(Gu%gR<*>wmM2<-`|#{$j-;7Y*l08D5V(F$3u z7PUfgtBtL=@l3##0A#i+Y=^8K3wofo$I%`*-s5r)-0Cr*C+7An=!qr0R`ue(HLXs! z!s%9*S|KE9~|s+ybtR8 z-0OqnzNvk=$CftR+F)Conl{+mW@1~!ww=)y1#RcIMQPi0ZMny$wl!^0(>Ajm*0tN& z4*S}jYRCF>?XKEPMEj}jk=j15J*!LFZ)%TC?d#g3q5bvtxYa(hBkMCeW_84djypSI zXUAzlSQfN42%CdygSauJ)2vRI)oEKN)OL#N%&LUW8J&^Q`Cw<%cfMe&!n@>jL2j27 zUARM8*DYO9-SuEsobP(KD;{)>v|mw?-D0{SrrTayy4Y=EcTDWQxjT1r4>kR=`m=O!z|8>&9vCqYQ3I0(B5mNzftWL}XdsFQRt&_hfzg8m zJwXQtoF2gaqX#7q!n9%YhoNX#=x|o87`$;XHV%#&f>}eh4PjNyki$c8cu3JuEE!rp z6xBm(hq69t_>AGm8s1sG#epJ$WB-3l`6@w$iUj^L zQ6iKxVHF8b^|&H|e}0c2sBl0LE%j0*GC3f=N#YZlLn&{Tkl~mYz+2>Q*@T`f5;!OC zki{cHL6j0pd2Uh_WGQ(H3OH1_NMNlUd%1%${|L0{jgimbm9J6C!7>X3#{N?5JrZA+ zQqCcPIfP6tvzLY-HG7cP6<@WKPH6mQgfU-QO2?+_oP_*A#V z?v@k%5a}1^hdu3U+v8@3$d0J#7!riYprjzA1uY8_bo#&l6aF=sJkv=MDP(i5AU{Iz z|KZo1)^SPapLEy2Wb^;^?>g%Bi{Evgz9am*E>MZRu$G8xS=JI2EvxBgo^Oe3E&oTq z^%`A|O<1gUJwE2&@Rij=(*Eh-;nH8Y^4xZH>m(6WU;Eo3u6vZa1kN z;@jo6Ls7d;?J&Q6ReK!iaH#_ys*&#DNlFx%3+Jm?Nx2>_GMceiAdmB-6$=zvOKB%v zO&|Q*7AA59nqq;wj!-9Ny7Sz)OW)@PughLY@y_-}ws*ZZu6f_{MvPC24<9MYneN1F zXQLBIL235yJnTH_#7XCQCwFM{40d6HD}h!5%U!5&O>ncmz`e|kDoUyl*|DZ0LV_ag z(W^SH?}+sst2=V9C0<*+u+^*1i=}+O<$la8_uD|L*u8!@NUPWc|1JL5=6}Q=$Nf+G zbC2BtM+0yyAi5RuS}kjZRjn?!LTwiM9{At8af@ofqxK3lwD%U9VDE!yMLbw`kiQtN!d`vq#Nr}KxNgmn~ zdIg0k2&3c_naUxu62z-W<`Cgh0snt;MlNiZ=OwOCu>1rL*ewa;d-z zFXGj=nEUc;`YaJtjl~J{1`p@A{8E9r^vR?mHbO2FoEB`Ez>oAzST5jx3BO-KhP=xX zjbxCRq|8;2uPml0X-a#sTp;deDvDoOE*QmvEk7GXUzFtnFa2H+x!n9xWNEIFPo8KB z3tSH8n)E})-!niCA|6u-uyt2-1=AYGtc9tSDT$!RG`py zY#sM()`dEnIjxz=*(Y&ipFDh53OPYw7H1}&AaIDGXcGj|Q2=h*g;g5XlkI4~M)tli zfmq5_H-}tGg>sifojgDx2xq0B#;IflJ4=h25~WhXUJBx$h;(2f+4z&l{&bP7w6T=U zx>Tx)|#lJEEXrp#(dSBY$24e74glvU&mS)*c|nhrru zGv5}JmZ8@`0%1S?2CKY$LAbP7fsVacF>nZmJ}zXOz~CnYxzz$YFnP2)20eu_uOmdJ zO4bY>#$?RPO!^PPpWk6e7afIzs)oMHa?>Fa1qU`K3G$eIyISJ5PO%J00-5BR+pBH{ z`>ke^f%Lq7TW4t{10s_IwjhMkuBB?2!7hL#fg1h1F354!XAsU3KKVMAflC%>9fY2} zxT$pzlb{~x)dyK>w#wq*kxWL8#^`a(J^LFbpMB3HkFp3YmFp;*xnN{DYRSTSjGZaT z*8dlLZ!Wm9=DY3Z7N? z(B~M7k|N+6gswfYiXjmx0_}s?DHkj!((9IjD^dhzlDn-))<|xtff^SG79oX&HW+W5e zHW>Ldb5B2u=U!u9U$-Za&1U*cfezj9#CRcR2m}lgGE1PtFsxzMa+ZL92Mim{+R@M8 z+20_7VU1Y=iEu4`-fb&pb!KzbF1quI)L3aP>X=v8$xt zAK8%Z8pO8lC!a%vjFm#>3HY=ZGGD+IfR25IED-pxk`A|x(0JGBn2`$RQQ&WyI+LPB z7N{su3xP!_1NY~ZQLw`9gLw)TDzPeNs&iBnViAO#C(xn?Z^U1IlXs;t$_xS-(O0-g zV1_cAw$Q5;Y$W_bq?)dBFUA&M{YkYzz^601Y_&I-kG_sKW>NA6ijH3(Fk}QhhHr$B zigG?Tsm2T9?4mCV1%E~qBi~)>#%lLkH+GTR>|Ny_n@Z2u!0JkNXLLbFuwy5hnESD1ZP3%pKv@#)?5O0X|Nf_J6O9Asos znZTiDW{1yt`#-ajnWX}6ZdQ18?cWg{yYO22>EGfnpEB2^TTbuevl27ZJ1Q@IXV|&h zsqD~lf%yc#i(&uxa)C*R0+MhB+;f*!tD#n#uM1iO`}o1HGkT2Vb?s-d67l@0D;LP7 z7i}3QUt1}D)^C+S1?2>&(#~tB&?g$aAf3oD(yIgpQMKq(> z2z*!|12-0y?hw=iz5jqBhM6A_c<*oc`*g`e_tN&kE{1VHAVi5#a8iu~GEB-6azG$PsZ*Lh z9xN5n$8C>&hA|ulbwFT?cAa+A6Ld`CmG1$8YHgRsN7$vE)NoQet>KDx-BwM~BXn+? zMw14{gpL z{f96&^g|&}3$z@DQD53z2PRK`Ddc&3?h6m+zW8wNOZMEC?YXau=DCTp=e{m@?i&y1 zCa!}ZLUY@DzP&!p8@zjTF9r+ve2rikBazG{)g}u#x(OL7@RxFl4RRA%RZfugHH2VK zISMu@I}}hMI;5-FDoQCW$yxQPiZG-CE2w(WZu+o9YEv{6Q09@%+ExwQX@j^=yR6~5 zmaX#<%IUG*L>D)Nb~ZUmzJelU6J?sMS8$ym8o_G1ifpx1#RheYiX8+YxJtQqQ;|uy z^A%KOXgAe8KMPz!BxPP%p<%VQS;JOsJ7GljX}HW6HB8v`jb}(qP-$%&CUBO_IFv*T zltzL#HIIzIi+{i;6nhaS@XdFutds}Iq?4|&bejWE!-Q?GnX5*C)pIFcYqh$EP*{yB zg9}@X!*g%q?ejJY@RQkO-^!poR|2m_NJMi)Pn>|)vv~JgA*TrV_#@yk<^qD4y!Zw_ z{2PL0sKiuG5RfR)a|A|>#rUrgLUw>6N%JQPjDL~09n|_9Uj8Q{$bL{O(-c;}{3??? z4u+Y^x0ru_LEKX>;Dz7wGQ3kS^d7++E!KH0K9xfNQUy9qm55cA+bi@g@BYMp_JyEz z_SfHHmYgTCTs>y5zZ)JdODnmoeY!ve?XZtg)|-n2RoP58N&^9U!fBhGMo6{!bjws~ z8#G+fYADJZfrWFQ2& zz+zqlrwc@DX%tH#FoP>~qzf$3R%zHk0GVCdenKf-(s+B&{Bt%ajg*8-V6QwaaZS?e zG(+HqvQtH^ngZOk%@$i};dGtKPsZw)rf2IY)|XPzzx|YN=&XqZi?B!;{BwTa^m8(r ze@=$LX?e|tE2iKk5UnNAExf}%nKVMT6{7}xYO##^&Jf7fi*?qVH78okOtca#L2$jP zavD9q2PwgqeeI^n9EqJ=Qe(QH3;0U~UB&5w3kcw#%(O9w2jy9bb7ZxSh(Y$zXp@y`kcs`anelHb79{;d2PJxlv*RZrhs2 zzCyt-6!vYLEfA~BA)s)CiX49Un^mRCE(JBT^}Wa!I$K~fhel=#99GZSh{G)U*PW9S z6$T#m%#z3<1H}||x!vCT<6kMh{+4^5ArIn2<)A%oqEgVbLo4TxaxUFd`zViNoPy12 zgNh3(rK`*pD5qK<^~xCqAp`=RtFBRbTeuWa1~QFZ2KJIo?2Zv?A_>(T;&R=qLqZ&-n|R5eE6i!YHy*1ox1?2`~zWVkvh=PHa; z+NSJR5J?XyWt2i1w%VAhP=d;)VLFx3q35-iA?3~Atv=*OShC$UN)^j(p_Zc3hc(KalvvOT|d$(>N7E~n_FdB9Q%w%SH7 zp|iNG@hr=2RSj?!dA5qq>5ur7&Z$V?+kbMuW4tsg5(uZ1n#>bV7y9mugOvhWzH(rZfhtqD{a*;rCr83%BXVRz(g~{?l62b#(srO9JN*| z@ZXaq!r3fbDv+q8C|JQKQ7XVu1_=b4uIF@fr2^}eG!+?Yp2~+`r<|pA-PC4jpY5f% ztxBf)(ky52c`^x2;G>ojc3I>i9^mi2frM!qL-v1om{tG`$B2Psw6;azkw#^W${Mf+tO0B6BT&Xf4t03^P5kK{{QZ!` zakAW9r)^J|a!|nu%B6EjNmVh2zCl~ni+n1%KWj^-wn7yNu-mc-v08;)z;4zkWRLpu zf8&SThrcJppMJ?ZpCDeQkz1!oqFAOYSVU1U#VuB~pyqsazDo2ErfQg`Jn@y%d$DuLkVkrVo?bB6~md1QH_ z(I(u^xSH+y2YXOs&uuFEdOyVtl;@6+f*ZHL_PUP$)J_C}pgJ!`VP^SzPp zo#KNupOrqS@~LC>4&ORo)cIcW#TDO(7D#F_oqtS3iPwR_ekqwuuNQBv|rf_K!DZBy=K!B;(uH}-vo;fX)voe%LTZDYa&8DyK;6k7UZ z(2BjG+2_Q_>4{{|ehkjv@z!UcK{Wj98ro_O|) zX6`wgyQ5Me0(uQ}yE)gFz#)Xvq>gKpvlJ& zBjDeT-w)jfGZ{XPUlaZT2Zd0&4) zs^O!Vy!j5^`HZ?murvEiT!FmN=ra%lpJKm&yFU{zoAe)oq0g}5rMGzd zG3Ey*lo)!dz>fqXol4(+Vp0TLZ}5iXjVgOTLZ+590iQt_6(%u7CemYcj#Bpu3>bt_ zWANN(`0A%7UL!WO4|*Jrk7D0JqRgOpY=M^jdB4!opGp5Acyf%8)5xd1o_2f-6qHa_ z$TQ@ki6u*FzPeK79Pp`yXc2Zw~b4sIv2`Yt+ zP7`RP#D&Rhf5{M_e8E^r<-Imis;}+xlEhVtHA=SML-%MYI8DVOiiS9*o+t3rRTbB1 zGaN-b?`8Dz3DzcQsC4XgAkrDM z)*=UrohvAiTA=GVeD*I~;*Vm6;JrbHKp7#_R?+&pT5gxPM@IiDN*A_>F*F(U^-Q)m zODD-_wAT?yktan?tZ*K;CqCdf;y|vm$d;z5i&QLAD^)(Vo$5ZaB1GAnob&1x6<5{k zDmYi#CT)wxy;8A=5|GpCDnlSti`THoQR(2eEo5YfG}oE9U|u(I$DC{Liek(Jk|x>G zP3?faYf9n#ju`@TjS>Ub%{wNltZf$ignT;lHtMs#-MI^(B`IyP8_HL)WMA?8_{? z{`;nN?+k%d#tkq-_v;LS9J!c0O;mY*hCs2blssrDrxnN|-%In$_UIGz`rfF`a3b4z z)CU)QLiwe?M+?yrPO)9IfWu0Ci-A2xHn~C49GLF-b^k4PhfM0Q$V7#C*2F|B%tDFh zOgC=&-1DK&^4p)_AK&1INQwDcu|}E@HIkeUi7Ha)Be`5%sbVwTE&FIYcZ}}dV1n)y zQ--p$6s9td_v8{2$whG%H$c-o`8p>%Cw3dH<=4=z=p04H-K6{Psu~RBp%~bX{lIjM z7VQ$JXybaexjzkVl;H#mtx&KZCxJX|9-rlPd0XPP-B$Xmwn%k~ibR#N{!2T+W+`nQ zR;rs-nvw6>q2o{FC6|g^B||0s6ll`~~Bx zfjqO^M6eZNp@LBF!Hy6ImO82(2%|9VBhE%A=6kI1K(J?$C$@U-@RkRrYhCT<(`x?6Jm!S||(GLt($XB~j0D za^Rc`4~0ZZeK6lFH)+hGp9?9<5(O(A)edg?xv+$ymo8}c_=oTOxsXm~$X%Xy`P?|L zI>a%LC!j)vsI)FvG+Qh^J|Wh87PhLpR9rP^I|y8$=cmj#YH&9s0{8VfEHvO8RimY% z$-q>N5;Fkzv?BgzRq54~jh9}4KsiSs0o9J%eCQnKRwqr@=$y&_nKd34nI?Iz=JU*S zZF32!lY6$^_$H=1Gq1dX<7|!7i9Nxr0iO{<8W`~c{e9uf=J(Rdb~w^*VFz9WcJ7Bk zBWCC7_<GtGo4McE+&q4@hY3tqOI1d~eDx!*6}$WfuY8Jc2zU}{uVf?bm28xN z58Js4RV-Gkfm)mZ8gK)cpiu;Al)%TO63fZfR3j6bdL5=-=gF>R=?a$e%TeI2T0|xJ zA~np`)@xYms&vti_1Yx**=OP^*S-?fz0(~KGebw<94bp$C(apkjmjt~fW+-8pXhdbAjc@vjooa!B*ZvQ(xL5H(ofnF5JLv?AQVJB7&t zkChSxW4*$6@0Vc`2?Vs8CTA;HsQkR`f2CT%gF^)BX|p?DNmK<%zxjtv-sYQ}b~2%Y zOG$;%qVKNl^%!ICj>f#fH#c<(w>w3UsqLVGJB(n85ST>3B3p_S$gpNxIAu+8Aki_+ zfm!rP+3h&!z?oi`dhrzwamG5at6f5Smh!nUZlu6@M~IU(o7z{~O-UW5b>Lfk3)=&u z$a+ae*(iaDN`k_Btry?Nci&?UXVQxn_?~tV(Zaryxx@S4AwyEyg%}D8eux~35oq@) z@4H_46h(|zi4iEKo3xTWzOe!$V##+zo2OWT_kS)h;xSLgD40R(lN-teRZypgdX_f+ zqOIQuRuasHcTzsj<0ZQE34-99jj~q7IYy}`3QV(RStzwOP+<3bC&~#%(cp~q;0;$S zK}54;p+u5Lx~;0C{mKQ()fDHEWUHzvU(*rVIYfHI*{U6ErbrZ+tYvFF)e3Ewh6P5s z!P0zZIo<6IPC<~h_G7SsQh^<&jM9W?W^IT6sEy;bZ<0WKGgBrHOPpj^RTAA*n|~%< zU?4$~zy&UvpCm9vp`tiRWZ5Jp*?w^*+b_6nUB-%LZWQk!ULkZ`hQMm&s)A$sS$nIHpe1TpO%*0? zXqmQZ8il@ZRrlDNmkTQ8=E@LA)K=RYm33TeVTQnR+63k(C4`)+Rs>bSwUEitj3M!18Dlt^TYYOeI=5d5TFvYpdBWHOda0~Zo?GSET*3*(EdN#!H1qX*%Ddc>AC(Prd?dfJwD zbB&B(fvI}BZM(168+2ad5uW~0y!B@mo_GpRjpv2k_z&@q5S5p7v(3pKi1b+D!P4Wu z!8`9W_nUX{et|@~LQv>Q0;R@AgBwbXN}CC1r^#f2fv@r>EtMhx@6%rCsJd0dA#JCQ zWBMrrappqW(yleJ)!bnsnl@fDt(6uwS?is+PkAz;J)%4@&2tt-_U`aRo#%S`l23Lc z+I`#`c|OHHsPL)u!5*K>K3L*g(*g%toM?gKmX}+ivE>p!T=YBdkDP${t9!& z8JIZ;#|Om>#;(DOhv3$b`$I5iSn)8d7#1-cdBYbD$Lir#!?BZ+1w0s@FajZuVSR2m-g?<0fT#5B44D<8$&ZVS5MUiXk5INjq?5A5o>zbDfA&g_d*{V(=MWBI)~+~|YcentII-oLUx7LHyz8VASKj}tOf z;D+(QKty0(AQlF$48+>NbAgB)yMHW7$88&j+HnWRp?+NYGst|V;2A-S+SxzryD<>U z$88(;vu;_<-O{X?7FJuEEX1@;Ym1Dwd2KPTZFO7zA(cLRe43bDHnTEtZ6Iz3-Va1@ z>-^RzYF*hH)vfDW;|4{+ZEIiC9$BN#jY8z;S))-fdf{j+9erUmE{_g*nkVA%75`yW z+%E?-j=n#d2UNGc(H6n&^4lTuiQP|N!N`>(v2|qDC~iDzH-@xBiLH+vg@jQ}jYaL2 zx5LVIo7-V)yNm6(|HXD$?UB=dTYJ<{oO{mD3qz4GB6|cDjR<*+dz3zGoNDW@jKH-K z4@L;uAbj*4{(BN_#_p<^K=nJe;tsGxi?>5Yj>@wXlo!fD%PJPq$D#>ylc8g_-qh_R zbqi7dQ;!gfcO1ElQV$n+^GlZVmDLK?DO(9I7Of&vU1V>&ry>{JVJc>W7xXQ<3mGTS zZ8Tnchq-qqlG7klVgW79F3SlNSxozfIDt%Fu*MOT`m!A>;^>UWf6I=N&X3!qKd;wi zZ}fiw-%lVvJXszR1o{snnOl4J#{@Z<0AG}|KSAJy?^z!q$#0NAvEZ{Lo7CA=EBj&4 ztN7iUEDU-KFTToLzd?BQb$mzDPZ4djk>$^3gV1$qs{1$jkbhr__ZcxI=>2}$*{rwjZ&m;isN68Uu2XUIHKLg2{F z%6SDBX=iuQx@HOLx`c|ioK#P%$iRN!2rdEFuvkNhwoyZsc7d>T!8*=Z7n=s?<&-q5 zUPq0QW@5TI-^60`iisO$jD;yyG1-8t2~b3}&}RsI5KNfpbh?}8Ni4Oquuk&E9G`-w z)z3-#eg*qZ^<{U&B3dril8>X)>b#nTPDJ-wH9_!oZclX(}BZ|Qw~%(*Eq4q zdBllOk8ls9cvN{{yT>^X-1gY$iLIU!Tv+GY;o>xc*y`Tp#x-|{7ZSblz4&1F==rTx z>r`A+FRMr-@4;+b0XH&mGF|3MO!D6DjosdJd{98&no6IOKDg`??2D=FDW5^XBDGX> z-3eSw`~N@ilghrYku@xbangRc+yuVs<mvibPIBTDq_a3hX1NIj7}KC{{^fsPQLQaC@^l3qMR09 zYy76>dE?dimu0dZy>4Cg{bzrT+1dfWjK1C-lHwm$JO8Ki$;$3d&wqZdPEYDSa+ue- zlK8Muuh)m_|NGni_u-E_iuF%x3~zQwH*T~nr0SXX^zj$RN0bcz*f_SRKCER`UGbxZ z6%J+onoHX)z4^J@e?hhyZ5Exr`66MywnWq6_J!sBR*oB0>xyF@*V zom#(5@mbuv?Jd3i2d*@J&)L0mL9@AqALi+v8hoifFgT)U-9(!|HobY-$$#R&i4V5E zcOJCn&D&)elO1kfIiAP=1v2j%cdq>~?YaGkCq6YxEjvhNFW5eG+#yR>|9hA8{##S9 z)#B34^GjP?e)4)=b5p%R9uArsk9DtK96hge*n;Ac7{8N~gB&&Er|#N0<(u!Y;Rcb@ z%EsOv{&aZAJ;lMt^#<*aUmG@H>_aMDdrTaHI zAN(HCy6Ly&C(Q`+bt%IwkfE8>bvB-Vq{3$*>*KCHGkL7>YLPX z{NuRUTB#pW4ppX9-n%lZrlK*gQ;oZ2uQ#WcZu7C-Hb3{W&qb3V+g|;0o+@6Wcv^K~ zWt+M0vo8(1GxAP;Md}sp&vp9>ZXf?+li#}HO*7kkc6j!$xJ_^Ob>{{KUmyGW+s8}% zkMOQs=y}=VSNgC1=@Xvn2c2B=`s4MO7suy27OwIYnHRp#w-kr|=P~reT8B;#Haz|` zDz$&oMx(Zqrq6lVKj!#btJL9PK1+*wt{xqG-DFzm^PHY5#+a1fvogEfYE5su;DQ#d zleIQzwLWZX658wJm`A5=7fignvg}jpj)IjVI(lRrpJuiqGQw8>MC(O~;tIQF0YVCQYIx(}DGdpqsN zsn5GdM@0{t^L+hI{U}A_ZkJdu=}8y!lGeY{#s^G3b-2S*zl&{FOMYu6CC^#Wc+jxJ zj&#?x<13~uIMK#dvRaZq)#<3==dS#p#`!+`L`hKVx=m|-l-xP8{MfP9{&`P7v|KW0 z?Zuen=vhe{PVViSyL^4}l8M3MV{<2V8dui#^X9)tdCGHJS}Z&`(%$Zo#m9nqhMpRi zAD>L}{@cTJT~XVl@>BB<`oErkYS^%N{_i8*@b*jZohw7y^?76XvHgJZITMpaI! zt0}qJ{pQUpc@A#F>m)WF%VWp94v0Ko*U{0lefmN#nP<+j1H;!FxJ5c%mEKNRu&hc~ z-?{ng%Z-!mcPGqCH#oR4pnq&x*C$)YFOZHtYI^nFQe{_TZr!3?dyR%ovAK2U@So=T zd7Yf+ZF|0C=ZQxD?R_sPGK&N371|AdKJNCwqP=eKW+$$?4t1Pf_QbIF_Q*jVFD^y> z@vD0F(2jrE7<8L;>*9tlYvbp2SUzdsz?)HnqyztZ@WN7O)Ur2g516K{-%9n(SaK^Cep=}DJ}GN)NV3x2Pw?=kM?x|+#;T0tke#l3ww=)dIAoARY6Od||y zic3POG$JdiBO6X@>~H;`bw}4nRlc3l{G#q}*4$@Vcfb9g?G9_4jx2hgkv(_*&`DVa zmy~Ory!`&q-jcAy`RIT>5d|^)ceds|H2U~MPqtCg`r_RkY5f{@XmDI(V~lIy3I0FS ziB!eR8i(AE%QDFJ@>x8%!S``WqJQZj>-nVtUT7(1#hvYZxDR~;9S9n=x?U}Ryi^;~1zlZN^oLqM)!hHVO>_LU!*KIrKXAri< zC*u06U-3q=jboUU)7lki|jWTO81SiRtqmXG?!_wnD-wxCu1_Q0w^ z`9o_D_Pannlm>}P4MZ)mejFUYTL*s%9ujyDb$Iv2MutJWEFrZTWZ{9|%X`*fdvVWGLR z(#QAtZuH|?d{jV5vmXJb#z)f>TYDxA&56CY((&rlDA~IH1)kr0ViJlb)}73Ei?q9u zYWg|D+~IA2q`=SnXvOx?`eNIdJpD6u_Z|D(-PWw4+m9W~vKod+oH8SJ8dkUzxIHi~ zobxtnTRS6@pp#YGkHnrXs;^q8S0g=aakP48hn$gSZd>+L+r-blzqvF28T#qlV!NIu zc@F12OyUcja-1^yRdgHO;BQ#B+S|8Fg`P*{na7G+vk!LVc@r)~dcXT#=sF`RXq;2%lIBiqGk?$yAgA=NM9uI`i+m=^4HS*TmL)p6>BnP$=Z z7QKA@$$Z9|V5?q*Ix&moA@_%5TX<)s=oPtn%)YU6OkQ=nA1C9o?&#_j-+!a)r~jxv zrzX>fE74RIL)erM4??vqL>CnArP2S9~7Nti@mR&Co$@{AF;o7IP`#&`; z+)Z+|A}Q&qB95r|V}1?yStSK3`rLpIPU)+`0YlCF69{KKuDt zwV1!~!#Vq;WcNs$Cxdz@QcQi^19IHV>|Xb{kZm53U~IGL*wDN?ox@H?e^rk=&ok&lW>^ED%5d~@$iD43YveqvqU zm#rf5uAb!&lf0|1l4H!HXFgZ`S|s1FFuML=(b`F=dZ~}bd@}DDnV9;ipM7oD>LK;- zJXiSbXz3o6<4|y6m3vgKv3>Qi@~RCZ-c`MIdos1IN1R`$4NDVEPMhra>l8RJZrA}c zt+Kp)*Q}(rsU`t43pS584(}V_k@w`^rJ+6+64#?M&zGA&`Dc5mVa1Z_Lk{N?zk3@8 z@MAdnbX<7fNW0h35_z4uEC1@GqR_qpF$oWkND8dSj(0t3SmAs!dr0b!s0~Z`ms5Y( z-t3X^z<~dE@&Y&h_lZtkPu(8$glc_hCO}T4LHk$;($O zef8|CcRZ_T_ro&&;pTwP33p~*NZjkTaYPI^?OMm=Za(gXId}SJ%yQgxH$gX} zk7G^78=F3X>slt=kMFa)#L=#2W^RMauP#R2>M!UFavq~y=I%JlW{hTJ;_%WTeq$xB zC#(yTKlNCatn+SF%q!`VfQqe;4mhq=+?@M%kI(R0Po0F~(|s~u#oHDiob}pA?l-8R z=5@-ECB3o_I^M7@Y+qlt-ZxP%ZhGP2;I-1lhd;UxJ-wsbyVd#gGnQz({MCE!#+i@) z`BWx#>f!0m$Sb%8ZDE z+b3A`oL&lc<6khtgP zz%_Z@FI-L>_{rF1dci(v=tjd7qoDY*ti>w6E`K6#APLnJ(+M-zTH>1 z!M9A$$h`RMcfVg6VIeu=r#5Q6v;TGM_pYUxnhW0lD!Amh;QqGtWecBHZaryPf9v$A zCr|aW{J-_{2$wGH8ynUoXU&wxqqkb6w!IzVbFBD7{Zk+7V$JNO`5o?UHLdNN-ywag zj!)^nXNK9Gyn7#z6wLKLx_v~E+qk_~GnZL)icEY~dZemtN>Jwd?ip6!wi&&W&sMDG z&v0#zB@{ncy2F2a7oTI6&(^gmxZ>z~J1BTe&Y;sp2lz8i=xh60iTBA}K9*q@bvno= z4A#HbFVe2G!-lu6Gko`qa}AZeYz(~C*w8J?C478~kndJz=N`}eI5z)dcpIsaak!%Q zu98=UziZr$)?^si*Ip@T@pe|`fJYB??Bk-hb^P8p(fwPi^1P^Xg_UMe_rJB^kIJYg zpY^h{^PTQ~GYNbZcRRSGUCi2LSw5XT2c69}E;B5z|KrEA_^6#`eJYk1eRN6F`ELHh zV25Gs)YRtni;^`e?X9cZx$Ez=wpeK4ToV+ZHQuX>PhnTdUZaF81ACv+{#&*kHXN6K zIq)(6e;b=w@WERzNb*5vbdti@&o(76z4xf#HH%Ms21yEh5ckZ8MnEne=7%pK2vU|Te|&*;8tVbVEIqnGRQYo->qaGBtd zSA8K{F?r>f&i1u)y?Y0h=)~lOL|2SzyU?w7Y`x8=LCZpY%q8cdW?e8^@t50)>2;gS zS1hw?@qI?%<+z7=&-1RHpZu~_qEm<@>45iJS^cX|H?j&%*Jh4x^=?+;!+h6Sr?ZQ` z^+~+wSebsS!?1W;-~DSsmhI?WHsaBsoTv=r?^Xq;GW&fG@xCRin*GVd`FFRn;+%%y zDu-Wd6D{NK1XZ{HP?x_#TBlWZVP({^qh_I>qihSey{tRv87A>mW>cO@I8xXf5Q_jYIXq22qSr%uN4^~1{ZUY(CLD$DVcB=-rc z%C!_1c1(TL$$QNnw=O>p=ezFN+O^ATk(lncGb>DKoy|LAPh;d`^hD3|2673*UX zvVF8uCH|7yjoxo$Te=iHj<|8UIJly{RjUo=FAeiQ-{nuR`eAh?nh_nG{aRKmvs>8b zLU!n<*~`K!+*8H|)NgWhQdD;iD~)LUdvmwCGRL>~8jLgQ948!#l13i*s$ZVx`6H(0 zLWEv@K)%}}>&&q$zc17MIdJsHOh+y?P`lK?vu{C<`^JU;dP_RnC-wE_9|kV`5i1Q% zFHJbHq|XNJ#G`T3>Uy0VdNy`fe6NBzfg?@bbf;z>U%C1r|Iy+S?m4-t<&U8FhxvPq z^DLuNWBQl2G%}A4dTE>*XjU#M2=jh$#3Jl=@clQfvn^H@Iv;f#lTyCFp`BgN;&b(j zBgQN%53JS;taN_etx!?)$vC^_(~ zW6Ncsl8o5vwrLB8)px&cbR)0I!fxT9i_t~Xd-Mz~-P+-N;6?soe(C7wBAc2PIejuz z*H|{AZrGTe8#gsPGxz+mqZO^H*5*c~56Rx(9sc!JZOAw6Uw@tmex2KJaAs|`ch)z{ zl;3)hj~1+~Ytj8!p3{oTwNgL(JN}ZSO)vDN^&JZ{^P~Ny_Bb}Yw883p(6OreCoAp` zsc)0`bZ51-)u7rXI(Z+W{kD6waW>lHwk#&#%npa`?L0>YzKG9u+`T4mU#{P%u#Nm1 zBD<=)EGxxKGS#__QRK2vtK-#X5iYqI%cd0{Ou7>PAgP^aVOGWaS7y!E%zm|V%wL=S z{@uKG*2*z1501nKR2Rin2H$B>uv8~udhx#74~;#YeE5q@)y3lWjv?8*bK9r)duN(b zuVtHVTsXV5c6eZy_>+5l%ro4-dGjZWaXr3|Ref4;+5S2`mZf!mH{{V?pOG0O9it_- zbz0@Gmf8JnP}a`-cWe8C*cX;AsoL2C634{briL3QWY>1|_4{M|-iA>Y3oqn0Xnjx& zD*e{gr)S#fckV_{AFPNUx37Ln%ntDmjduf8m)9#c^-OqRT;_ChK|_ysjX7h^8|mlG z^jSE;dA560o>`Y{kHwF+MwM-lK04rOoVX>Cey9o?z?TFol8V^b}+N_z~yN z#_o^r{4(~;mB5*`m%OtagNzgSzq{eI&T46>pH9VU=f$?|GgI2vZq?D17I(~^y57Yj zQd-p2uj>b$^2KM?`dj<-Tzu`7=lkl2ROfIv%L1RwMW%N`X1=`rX*>5}=QpX*K6xWo zvG3cQEjs68_C50%@bau_aK_fQ)h@Z)_wd7=wY>7enUg!W8(5USb5G^$U$%MCW7(2G z!*?IOQ?<&XznR;WhCh?kcJmJP=~mIM&?J6I(9DAC-X}$C`3q@-f;Cgqv@3i9r{{nE zd%b1tIL8alZ}+X6@Un%e+w7Ea`|JA#?u(zWt7Pu4QAzF*v(HTMcPLo<-2Bvex`hl} zVHQ1Mc43=u)`8)sEoNOT6;vBzxk_I?v4M;SKmmRJ=2 zS#$UG`z0&COCJR^475sH!nsUL^pDSS+*6$%H)HV$(N$Ta(^YXKegR4izwY$&XcN{P0uX$F-Z+gA=*&Pdug|AL~@}FaI)19J% z+vQmPZS10TQunmyF6);wOM4$k>KQh7{f5L`oyF3ugn<<<@gesUx@Ejv?`x;JGG0+$ z99BHBvCsMP)MsD)evC79D-8XdP(GQz%5TwU+NPc@E=KFmuw2;TY}r2%34JEMI-3)m zKDJL`tNa~-6$6YuI)_SXx0E}a|MC6x_hwuAhS|Q4b~Ld`?Hn0+`O`{A*ZP4)Zc8T@ zUf0nal;gl(iY&RXVd2#ak>v@qTyN-_Mi)&>DLoDX!m)W@+U9z8^Lqc$`5 z9e=~6`mdrZnGgAgF~{;g|FiwU5PP4V_Q@-1oRjqnHS?nfR+zgUHZ0ryX0@jNnTomm zK`|kNzk#bB83&#nybYhRFig1N<>OMFApUCX z<*-lrojr|G+Acg7@@_2O$KNI=<@qgC-(g=#uH@fK)h1;p=!LA!OS^h1uzq0uov>0J z6Bm`|H9ooBF#A`pj55dKBbCeUgj8t$=umQDhxt9T%xg{mxQbm3dWn^1Di0>> zh85+uKf2FlOtboFMww^yL#q254U*Qi3Oo4K-ebc3_5FN$ZuR>+_}2J;3mxz5+h}>m z*wFWMc1>=L!oY9#^+f%=zL(1rdS`7p>a%B2SpU*dts{+Wo=HA@^*$x5c3Bwzuwi(? z?7t8BbS{dHva{@YA#Z!H?yud(ogDY{Z}UF(wXeMo8`h7lHmKM(+AZzS=N>M}S`|G$ z@iQ{BpyW+jCvnaCInFnp>K z4;v?B8Nbth!XI&NzYl!xXYaGH@zIuB`)8i__S0{9EaAUbw=15+?g;Ozeg?91^Ab8t z{i5oOCwDLP^;*gwB%ZUMTn@agdbIPlfPYUt^`AtR=he7%Sm-L*`*gKYfMIrcsd4>K z?*~b}CG-C_NKHJNFUeR?T01h?ympAAoBquqsaJyC1{d_och#F(qq?|X(t2BL^L=hw6`cz@UpMNyyXt zw#~Kc*<(X&){**;<@~KyqHU>hw%e+OSIQq z9UWy5rKlbgIKky`g>^yI$Ef-4&tAVXS=ksM2}|Q25Qdl5ZZe9M{?@!~6q_fhUG4o~ zNNV6KtIFE%*UOGaKCZQLS=h$@qlIoP|GaubdyfsyS;pB*${qGD{m9?EuJ}@S_42yn z#>bgm)=EPg&Mzt`OiT-~&ZzU&``NeXqrPQX)Mev6p3BMuq>J08#soa`oNhEZZijZH zOL%f`&uo`aH|^1GG1Ka@A`-4lDqQ6lt-5&lv|8G8Z?Zv#SK@X4amv0mWzLe>S3}}= zzL^s&E}XW8zf7I^DZwyf+K)q#%k=!+HY5(qapRvz+dlE^y*Kensd;z%y*`bjeT(|I z*p#Qrci4PBxG?@yV2QU~>53dl(r|a(kiLZr|GSp^hs{79yuGoGh7O1 z^RphVgtPVTf-Cw^5A#3aa(!~va|SLFHO(i$xxVCEX>+-Ia2cHS=fS1@D9^_K@Bg`K z&*Qie==lhj_ah$)uY@b%gW#?B<3siSiuzN&9lSGK40qM07y7^zgDL+QdDU^I>X93g z_kmlnyuhvDO1KsB^WdT()H4b01eXcigY^h}D_lIZY0rMR96lBOVQ|if^32b{r2@YO zR|xzbTr{j{PcB@xl-vXBt$@p~%vB5jHmR2e)-Q0?c}O+SIdH@|UEVdgwwzb~3N`8A z1!MRjflr0U349?uN8qdBUj*(4@A$gudPCr*0zVC(Bk*f*MLG3|F#asKmmvQUen{Yr z@Hm0@(4zUt5x5Ebi@G%i0O$9y z+RbTu=LozH+)Ln=@IwNh1CJB9J3L3=yWn309trPQ)O7rba8rRlhR+fB2e_BO8{vlp zuG50%Ax_|C@En29fPWFV3%ujo6-~}3+u)`G4}#AT_$l}ofnS3w1;_hixL5ItChL6* zKP2!k+d^o%t{K0W@_IWp0?QJ=(g4QcSezMy6gDh{p zTK<5~hRch|`IV^`2jVxr|I_Yhkp_HNqEP9o8}YXrUK7| z&k^_=xR=1c!Vd|&c`NK!0@sD-2;3C@Mc~%(j_;a|e=*!t;OpRX1ilaMCGeB*Lju1B zj}!Pqc#gn};a>z^1@HL2>G<2Urui`ycwhJ&fm_181U?gfNZ>B;IDv10=LkFm{zc%? z@Qx)-$Dax}6?iUuj=(>{y#!tlKP2!jZLt3c+z_54@CooQ0(XFS{Lpm#tKt0rL0o-Y zvFo3m@HqkxhkFV93jC13@5AE+{u-Vm@Jjd>fot=p81?7!$EM@dg_{c83_eHTHgGS2 zOW=nDz5yO5@B{E1fk(l=2>d#{gGz<0BLfgfl6C!6-ivwnf6 zvwnfUVf_OC&iYR^?QhLLJW|brSm1r&GJ%hTD+E3h&P6rtcV_(p-^%(09>V$seu4GN zoA%#g{Q`f^`UPIf`US4RU+}2rfjix_zdKwkaAUYk;FIABfiGtLXPWkVv3`N?XZ->{ z$@&F;o%Nq>+MmVx1^zGV7kCZp7kGzGn4fb^`v<_q0v`*P3H%SZLg4PKKe}oEPS!8* zFxD^dtE^w(_gVk>ru~JiU*KO@zrb5|rg=~ZTo2A&Xxcv#E*AI z^$UCx>lb(+>lgSr)*s)rKbiFlJeTzg`~&M3cmwNCXxiVUJLX5=L*X)kPlhW5?g;0u z%~xM3vFjx-xLDx+aGAhQ!W9BffOCoSoAhVF#R4ye%LHBnR|vdq51I$=dei;^aIwIx z;4*>Fg)0QUob@L)?cdJ&1s=-!1%8?J3tYkaZ#3=CXZ-@NVEqEu=5M%E=M9Cxd%?Mz zP5aH^Vu9PhWde6%{Q~!9{mD)H16jYoPqTi3C$oNmKVkhTP5VEveu3Aqet~!CiTM%u zU^tiBv|kJt3)}%N6Sybq7x*sLf2(Q#an>*J1lBL`Ox7>(V%C4VY5xz_FYva#XdYw& z?+aH5+zQU!Y1%&vE*AK5)-P~h)-Ui-)}Pk2|1Z`ra0TmGOL_irnRC!yp3tR`T6u2?`lfb9IzX*I0{HMUZ;G9>}@$ZGV6!-~vM}a56bp-wZE)w`#_+Wwm zfSU@uHUABJ)%j$Uz(sJez%Ag@1a1ePBXDQ9qrf-Ar2-FzuN3$>me*dO-VfOK?{2`C z3H*WD+i>D6dj7!jZ{ZUK{!Q)t^Wm*4oAhhysph9Gmn-njYH!ZTeCfGFKL4CWwe(ke z3r@P9T!aS}Bh;?Vd10KC=C~+D&@ zqUwLwsJ%TW5_n7g8{ZmSdrn%gx=Fs*|L`II!^iv&w^6$`w;k^~>0VmN>MuU>k=rEvbSiFz3hm%#(!j&MC2jJo^l>Y*cV&0Y9nm-g&OCsyh5vzYcQ~fK)<-oa~vki8=UJUR?AYjA6yFmiSZv}t}j+6WBBL$s^yA^#v>XcR{fTHNG)If>K-w-Pybbc>;G7-hb+Dr^f{W(CwWwzUTs)tAFvfovE^{P*i+mhhDk0B; zXRsb;auZEXy}V&PZg7nA8(guR{4>VclHXBPp9>04a#wW=|8szF@fz}3+VsMBxO@Y7 zI>xgIF5680gyNhJT)KsP4m=F5fcwC2z{OiB{|wue2N!K8uR{Ja^Bv^Fu)VGL6SZo) zq%!ho53 zJ4k*A{+9K_+2=yD!8ncrD8CVT1Go(C54VMj0x8cv7dF79@FL`o!Noz8zlwRd1LqEr zcg6c&!upSrTd{fOPo(O34kORPiP8ivK0`hd`9I*Yv*gJfEj}!Nj(is8KMXFvK;9BP zsc^+#+Ibh5394S6-t$I}ca0{zP&^Rh07j^)xRGDkAW+mke8@m<+yC-Psw%B{{^nh zA%70XQr;6Mk^Y9g}{7L>B<7s1x?W!eb=k0-TuD)r{c(|OK$f=e!=wAdEX^}gt zU*&%ujOF3c7-ukC+Jf@2@QbXcHMu|L;XYi^fqX9dt69DyxedIh8EuygJ_|k`u7tmU zFNG^QQO^YUHaLer?{FS|iRJrIJ_Mc*m-Q!S*E4O*X*}`)M@o;9>AVaG5FfKY-i8rDo)n z@O8}1$4|S6We?KV7Jo9M&_sY0o>>10Rok9b68-3~w`n zwpTiadSc+ZaM4)ux$vQInZU=wmGB?P&tg7~df4Zh6wZw&XYb2;xCqYPM}N2&-V*&0 zaH$}F87_nOLOu;Hhj)eNz!mUr@PFV+IR9~`UcSLa6KMSGebE|;`GikHz8hQtXY)B2 zE)qAL=kahEJOMqk;NpptXTB89O(H*q{2I6%J`e84@{=jQLxWzp0GCZ6XZcrfCHy{m z-oq8vlwSd_fs3b-2g9557m%v!IwhQ)XLR8r8_JK+pf4B(mrf&>pvM}nfd7WCU_PDl z?0n)6m(L(yfP563vn78DzXMmoo8$cal;vkpUJv_}qvHSwc`@k2&yc2N zU4JUzV)!Q<@VU%gDbMEN6I=!#fqAZiE0#AMPsdR-Z`=xUwto(SOW|WN&arSgob7LO z;YzqK^2=DyO6s?Td%+d(KQ!otgK*I*%GV)(k@;$Jw*NeUi#^GoAz#SyYseSCzrtm3 z_W9eA|KLy^N8+`V?}+P=fpF=1^2g{I!}1%*^)={)1uXAPz6JR;a3wq%?hlu5q&&Oc zI0NT=$VZ_68eF`I+zsP=1y^h(XXnGOaFH)Ln}^P$X?taG_Bk>XE@$3?25Jpg?4q9b z*v}Wkm3!gH`@p$i@~#@x69^ZDkRQbOPqF?#$zLHK3zr`uKZbd`4Hq9JFM($<4OD4`lUz{ulWq^jN~>a5wbWz(toR z&-PDOxC~x^_i-a!dX@6*c-aRR$C6*gdQZZ+IPyF2Yj6eJ4W7+<;wirx{+i|CEMLy@ z36x)g{BO7%enf*_=)hmNs^=$>@-1-wG=fW$$R8p@;B3F0 z&OD9s@f!36ZgAOMa%c2xhI9AG{o#RdIeZoT6kK$l@^9cttmkiX{;`94xeph^d*Qs4 z3zt4)&3xTOuiWF?G0DJqv0drvL}@Ph2vrx^E`6Z zpF>kE&T#o_a`t%?0GAe!|IncPdFF4((=pCexVV^H_2*_)%PZ#pl8?Z6e!*oWr)LUgNxw(;i`{C^?2Yf;i}WP%EdL*GaIftEvQ@$-w7{d z`Ja@(3D=rLdF~haa`<4l3_e|hUYG<|)>7Ub^Wy@S)|0FLytHcB0atMRfAC8vdd{$X zGjeucpn!`t$v3FKisK643OLJild-+34dIu|=pO)=HYe|fo~dvdd^GZIa77EsCm_F* zv{X?0LBA<@;eL7q|hI}^GyByAq zBWL^nKDZLjuJTz6!n?E)5}{(}7mt4_BNbcgA|J!o^YK?D@|VxE#*jm(Q$UPI>nJ zw&x%0sINod4j9i+IH$S*;1`yk0~f<5V4hdNWzm#Bh@L%g(FO8YjQ=cL31{QH0hj+p zdA6TFgexwRcgAs-&w8$qn>3>pe1ePO$p6E7HSB16Me*eR7-v_wB7yuS+yE|1BxmDv zfQzq_$DrRI&Lxo_gvexOkNH*m`UT8rjQ?mPla=-J;ELPiLz+=h6zfrtXQBTFTnX1l&kL5nM|pp|FCXCY405*Kde)Ok9*O=g z{5R%Q`=RUs`7rdGz!eY4t+BsZ!$ptD*?uK~E8*$dw1N$+=NaV(W4$48?m0RA%3q(t zrEt4u^ab}=&r3?Wqo)uqenmb64(fxzQBN|S5KlDt8%i(eGt#IiG%I`o=6kIuy zoZau-XKq2h3O&zRk0m+VpUdE)QRHm@?Bzh?8mCxHd277CCUE&A@=3@qf^(C}k7K=?S$+yR z>knZ4*5sX#SN(Bp^>Lwk(7`V@=zk1Xz#k+3p7l?oe1;}{f$EQ+sCr~}V4ssk+b(@BwX%H{srT=W$r@Gu1gog#i|Ei{KBpe{oqPC+i!ze zekJAEbF<5EnLGK<4z%J2%(sxU>)U$Pv$d(4FT!^DlC$ei2e=$QT9f*{;mYllABy8E z7%oyhxZ{_@6z9&t6>vLvD$DPpd`rypbGUdn`9t_OmiH$wKu`O{82?`KW5^GN%lDD9 zd6)#3?kDG`MZGM7E8ywqSGhibnSg^)*My9U9PhsZZ0KN>DQOzwpDcMe<;N~qZtE>0zX zi=Opx(QR@ocpzMQhr9ygJkLChd=}Pw53aaN&fdqjaM?X_cK_7?=kAlUB>xNJ90`}cA)nQTUYHG6d?aVj$=AZgrR2vk&Vz7e z8Toom>Ny9OR+4Xr=dk=Y@~L>=Kf?L{O{ltH1YBzwjbBzp{tM@UzRYXMwKdgW#!Z6D z>&XL%ITyINft-ClZig%312yOij>ARV6gBk3_FiW_&BzPjuUKB2{1(>x1FnSIYtRc_ zoN2qnEhzsPKAd?g@;h*QIM;^!IQrMXjY2^V!GPey(^TnWDlcVYeAD4&V#+6q4K6pKd^r3G z>oFx)z$@UK8F?98XF0aloLpO*UNDD?EXi*pKM$^iv+Y_1ms?Su-FNR~`O)O;x?1(u z?W(Vr#*(w`z0G>yC$Qf4aIxwezWjpez0SCX9jr~ z@}&5sP8j=U~hI*am^nCGF)=aDBMKOQc!CujFf^WX~j zHsn3v;y)<=3@&3m4&;&8u0L7Nd~$ZZeTnrfAdklRAqCEojp$#* z^6(P8FPoUVP~HL_3g=dkv-8XamWMl_KNT)oN%@(WpIo@i9gh5axDsvy{|OhbqWn{M z>(w-GqSfT={diub*E#!{q5wrYO z@`2c{<#72n@+;`s%<_KZ_2@aod~qH*u7sOloPlsr1oc?MFT-W3AL!zjP4Fx@7fEia zO)D;hi{<3(=VQxQ{~2;iigOxkaa_RD;T_@Pvy>l*_t6k8J5SEeC!<-<1#))(G7HZA zMQ()tm8>6r2)+}pgtPBcM6mu#)Wbh6Rxg*}3OG9--hqoQQ=WYuJ!U;IO~+FNmkYcC zu7uCRdK=;5E7Ze2U%GnHe9GZ&$Q!~%S1He~izc$Xz#UmWmh$X#Z57MIxGbK0Eb^z}3iwUz&(~Q#v1vYwii>4qWlmo z`hqTSSqgbS^ccVuaQ^hJUPiK>RLT#APhmZ9ZOp?WxcnC7dm+Dy^}|QNWpM5`<=J`l zC|sFF-WJEjC6>QW&dy7zaIwH2!)5ScSnqqd0?v+?I@bR;^?yNLhyQ?3%_o;m-WNUs zE{3z~kl8GsL3#H1=meK$lC$erFP48m&aNl@;W9Y;IgpcZ`9sRTz|A`(mmVZfJg8Ve*ugKYT zxGVEQ^8b+cWB!Ib9s9!}xI#&8j{HS9_Ye6Y_&vBB?gxJd7yV25gYbIR4?hX-!GF-J z=0W<7^6dKAi1~Z+3CP>P<#6`>6bW2WLU}g+EpYAwIh*H0tRK#<8~M~qWPkDXxB(wfT@+TN) zHp_F?YGL08DT0eM$l3fHNZzxY}fvtmhOtJ6^uCd=xo*9@u3&ZLdO3J`&?GhjVAh z*>nCGaPe7kcAdNcE`zi4h6n38M|pPN?GG14lV8Vr!{EyEs`B>&zls^SehfA}` z`O~0!DS#{C?ELT%E`CJ$pA_e+nLj4i#rxiRC(V!a3HcYeKJy%M_Wh1waQQQG_H!M! zaOHFINUV1yT=s&T{rRAsaM3IBF4(Wa;Nn8^{^+^Kdf)@$t*M+i>&7@`77j;;o@TQB6v1jq$H1k z{{vURgSycR-&lV&9j?Ebd|F6&92h91tJ=0V(x+^;#k&;_m#kxMZDgW#e81MNj=J$7R5! zaCYBR43`^Gp52esFds&K06p#b0jRH+jLB!i`@!Y#@z`E-xYC63!;rUwi%iMc&)qr0 zVRvE3L@A;s3#Scnkhg%##*+tQznTsgO(OS)FNQ0u$+a>5^>C#P`3U%4)-!|L66-w% zm%`b8a+USK|3LmeTx?4{>^krbTxLgJg>imnK8JirTPkXVE0&NqM}LR?G;c~c{}^Ar z41`N1lxKe~zzWVek#E5~&waM=dR`(i$Cu%3Ir~2Q zRk$dCdklPo_p>ed8v)h+pn%7tM+YuDLivH1e-oBJ zO74vOWVkqtd^y~a<>9VyPnHj-{2cUeh07zz(~&<0mmMQ7LH;gt)nCxTFYNlK2Cjfx zqeqv&5ms%l=mh2Oz$d_!aMrVqoINL>4wojAU&HvNa8U~R zRP=0t%TmeN-#2muuDDI^f}U8o_zpSS{~xoSG;+3|d}TfG|Hsvx$9XmP{~v!x%hWVu zkc_e%YeUJj8e0yP%GN|Gl#Yl}YEqb#98^llkVp&164{4B8;-itNEl0GKU|`+mF>#f z_cQ19c>Qj_^ZNX8-LCFEJ#EYdpktJiTzYLGroBU+HU@=JA#IRNQ}4@_PMx2v2amZ(pbWmgIAfQ_|NqJa}8Y z7T@a*_P5$>{y03wFXDLVi+k@&{&V)*O5A-Yz8Swm{bTWyndhar|B1NnZ*So-zL|0U zp#G`kmoT2)?v(L|iTKd^@*gzA-DdG0>FJ>UjkxyrQvX(b5%~a*@n0E#rTSLM=N{{& zuUWXiP5dOr`2ZgNApQtFD>VO;coo;pH}T|u;yvmAM)P&Q5GnWCMo)v;Y{x&v_2)R+ zsQ)dl&*e_Vy?^MT|6KKd#dRKr;t8(L->$-9*R|7;)&cv8KQcw_Q4 zxN9t~-#6Qa`%T2xlHWadLy{hMb-w^A_xfGx-684);(A=1s9q?p?-Tps{vP7GUB=>W zPw}Dj--d_yllVj0vzO#QXPhtLUNdp|U*|Sy4}KLrKjUs6N%qJ0nj`BQ;9c0Sj>e;6 z$!{coHXiOLehWSV_gaWQhTn)M_%?i=dP~Va!*+ZIj}8{UlKfijKSX>i{-x&ezMLO+ z;_h(CAIN$Y=N?R@+qXnq&xgn239ipS&&9(dC9n6-BXHMRyoT}Iu08m9_+z-=M)G=H zctiV-79Y&^{Y87)ia$e7vwLLx(J|u0-BEaqbGW;nc!IZ}XAtg6rAOZkj1Dfucq z!q3JRX-_-p*@XWGPjKBIzS5rdlGp3kF5K%NKAxWaa}WCJwpWC&!^`lnV>W*-?mCI< z@6V~g{m$b3>6xkh_~rOhxOc4N^*-}W?I{yqNB#%RA1A&P-#hmpt8V-WuFEaM{o^IC zpKqRr$0vyE&)1B>-AUrwGXoFs0(OW;@UV;I_5SKr?LS$(Gx^W8{}gfE59`m9@du}h z|H^tDqTW?Jclk(PKJL1S>;30NxPO}XHRLDaF@8UOulDzl{3G~FxYtvB5##>~PkM=u zBma-~oG!i=KQQ+|zHYntXNdpJ^}U^Xxw!71<#>#1PX!+Jk^B{$$EM<5fAK|}m+r%p z^TmH-JkP6NAg&_$}nW#$&vYd1#nBai#lP-7gr-z0Stl;{L_ruhDZ3?hO&o z9fs-aDm=#5;dkQEC6YfDUxp|6Wvp+42bW1c_qZT^?Y259WfY;4~cZc+J!#m<3uK9EE*yP7*&z;h9 zJL@}D^RvZw(toe|UE&Mbua@J%T=C81-%-C;yb<|rc(_3PI+oiwVt>9*Ja@a5zFOcB zo_kD`zS`mb{n_Q7p&p6rb$kRK;QQDkoEN!WqVrUA+F;u#Us2uJzenx?}rc8{zs(0BVMWfxSogS;K8HW@l@jx z-kP4*@dVfHl4$>8>A9MGg9q8ZkBRI3*im?lA4k5o=IeeDYwpzuABTJR-uP_X$H(B+ z+K(6G@8Sur*Y}^b|4CV{-X}DBNX8%HCG>Q}WBfAwEZl!edUUy$-~q1N@p?SMwf`PG zG5##>JuUs3e?$9?Z`OX}yR_fV1({l<%PH-2^3iwK`zPbR1X?mwUHIU5g*5645}leORY{dkP;!**GLCnmoU zcQ0hevmN*FB6{*4mG$!RX7~|!fS-t;f=BpX_&_|y_s6fr6I}O)J8}17k2I;{c?$Q8 z*WfkBEAasD z!g_sxM<%}mkBv9Yy|GR2w~e>L-SX@>PsKgsgK*z?B_0@`jfc4ICr{(C@z-&;LdK){ zuW{e_F6}qo;&EBu7}xplgeSP(hnM62N?C5MHhqo4-74|kyNS=hgO|ni`xTGk(JSI7 z(X$3m@Iw4+?T;nTX~X5^ZoJd`PrM=dQrtIwJ|5r$$U^bB=-QYZk%qdxV|50iHCR@Jw6`eXW*CM-fPlxGCmOxjNgSvcpvgF;BKAt zY{Fl|6TA)n0q)gEUi}w5!1evh?oY8@-jMtddiKU6JolI)eYL{<4U*4YKGN6mxO-DP z4?kD?as6JwrP}|NtL(Vn-n`4{m3&pp0NUp2U^mAu}^evA9Ko`3$qLtO8N z3!awwN${rh?~l88q+h)Z_wW(q&%z^ImperJaotZQYtOsVulYyu0Kbd=mvQ%Ac75N) zedE94A$~kPg}EE-y8S=Ki#dP~#*_D@|8nvt;=x9o{6NirAbu+O>v8`>aeW?Dg~zxa zr}Nb}NnY=VW9`TF`ww4e|HqQo{c{)YJ`o?scn+$T^$l@d-!6FcDLt%LfCrz8>wWkr z&Eps3P9b%#Nx1t;^7=kyI_?`^gon89x6AR^;Bmn_wX0U562VZ z1l`0!Xvy4zZXyNZJZw-S9d+r@@bCM}|g3I4JcQ@`g7t!zGJd6kXitGL15lPjXut7En(v&=->G^09(o?d{bMB`;j8e(_&a!5md$^Qd&gz{ zA3Vkv)4%sJnV;}@$*UiU`zK`G$K8op?~ljEM``~_+5A-P?~?WVwEyI+zo7lb-`0LV zo8O}Sr)0g}a#>$@YSvrevGI<0*fpC!8~3|qeVF!l&-%^UZ~Q*(KP{VIuKhi-zES&o ziWjjRf5JUnkKZOMI6vSG$RCXdcy9MdU)^!9m-O#}_tzer%eA{gd+>wE--L&_-apL6 zV|;J&i}3_+fiJ_|=`x<<@%6ZmpMZaghxh^b&v=A$8F39)%KXImUgQtJ6FeX9gu63j zJnCoRp7Ei$Z~S^ZFg^zljX#A)#@FJp@z3xC*Y8E|z=N}8{7150MXO{UB76*f81D6! zyl(gQxQ~C!{c~^ib0q&??h^*9pD*5!9dSG!TqLgh=dHLKEUxco7vLV=l5sB8eq67Q zui+uC`@<)AgtwsQCp^aY!|S~y^ON9uKei9<1=(>PiTn5=^qh!?_&)f#c!cY9_HsPN z_a#38PjDUo9Nb+j<2jIgHSXbh-dKVeSU9Zha$sfBaB9#!K+dxVudH7vjCN2iN5e!4tfU{57~&_YWiHUU~Qo z+{bl0K8^=?CHa@NAO8$rhsVRDe?0z`_74{?#{boR{4~5}Eb|lNXX0hJcZKw*55z;` z$#_!{LT{s*Mj30-GxXw>6 zJTm!9@fg?fT!*_WWjyM4;6AS7c?u7VzmA8-x8afTdaK!9#+&1b@z%H-l^v&#`*>^S z^Bg?Hb^Jr|$oK?2Ha;6qj6Z|B(K4P>Sne7;z>mg1z$3gpzE%728}NE-WPXAQ>DT?d z7?1JW$hX)07|E-jjk~MF_542^_i(-bhIoYQ{y85{@Ubj+86J$4{%i3sHIHl0AGkM8 z@>h^A`j4z{gzI&uH6G)~AD%@Qod2S!v6WW98`@7e* z2ft3&7msmW-#@kgTIoNFe6zJ|UtI5t%J2vuO#VFFRZ5TckH&qx1Nq5#h%dwEYkquo zeOKTCuH*R-kMMr<{Dr&gq(}Xb*H|xH$9Xay;kv(Ff_oFBXEOaa;xRs@p8Ump?Y~~~ zcQp`ShP#`^bHhttpWq3u$KAiUH(ByJZwIeq{J5UayWx?^UydjET$Xz)9!`<|Dfm;k zH&uKz{Uvl%6vDBs?@e1ds7%h)-v|zQMgYvfLBN*UwEzdcTe9@pT05-<{2$fQR_;^qhgm zcr$kN!FY0y^fVic|9*});vC% z`T0}x_hrY^VguV9FJZYy;0gXY-W8AUm!2>1!P*mv|AbFae?a_Q=Iw4gd`SEv^3`~P zKZmc^o`)sh3jaX!xNi3!ac`02^}65WP1YCJ^V>nV|A^%Eywn+YkBaMa`yQHKEUxb> zFUAA>K-RY!4}p2uGfXU+zwN>pSvaE_p#jm zc(hdfF8p!af5G(BN>7M4XP)=RBV3QiGw~R|i~OZ{@S^lj!YAViuJ=m|aJNkI+W$T7 z;kuuhMvpu5Z7@o!(&`~8oVz(3BIVY6zzvcYo-5F&I8BeVU76TEVrNf>*7uG z`yYwt)AKkU;QD)1YP9EL$?N-t?{M!Eah=b`8)dx$T-Wy`Jj6$` z+{n{j}yk7uV~;2Y7;yV%~nlgD)ko`$NMIWSkNHBI7B+gRdm7 zzt`8t!>`3Rk-tduo5k1T6LJ3=@y_`D+JmoUoG)n4R>=<||2dxEdj8D+P{!|VlYAce zBXJ+sd>=f-yO1A?$GC2<#dw1EBVVKa-^p@y|KFxP`03<-#l7z(-<0!Mz1#%Wo%j47 z#Pxm00eFN@pyveK`%&_h_=TFs_4hxF!rgYsH(;Kx*PfrnJJWLy9^juc&PQ?o*KB?@ z9^(Ha|C##llJCE-EZ`43Dd?5L?Tlxyk7ORgB60nB-lOnnPjUTT!6|sMm-u3qJ4o}* z#C5yhta*GY>$?yS_mO-H#GT|iM@Nfm{&?JL zE3W6yGx6XUasBs(2IFz5_)z*s;eLDZWsGMc?mCF;bJQ7lf^Q{%uX;zxKY~AsN1epi z;m_k?XL0R$P5oH$rR3kk{W9^*_}A*kiGPdlP(NN=uOqu~cY^p<@&%tV|0jy;I1j)R zT*uP}k4}=j&fD>L&?Vc`1NToB*Zc4RxaW)i!+0)NKSg{X+v{39JXKt;gVXV#tN48! z*9&lWns`h4pV5ANZ+s2zES@ED(se~kw{r2hwehk8%(0eE3P&i_whx{!vM{nkf!+lGp1+6&{w0FQ@+j?KwyMe$IPK@nnE_8}e(l z{{nISImb`c2Z~QQOjhg{JPyU5<_-D3csND;J;uNP=Q3}>bny$BpVoMcpM!V8y;~)( z`+rwF!Ji`E2aje*ejt7!?q-U&!H3~KuIHI?+H;%a?h70mPBn!iW#{po3vJ230^&uFgrD8_RT?%gZi5kD3W zaQ*!Zz43Uy_yvsTJ=}Xid^F4bR(oC)f0Pr%?g{(h8{&)TISBVQh!5orMrSeAP0Jlr8ZSJ=IQdq0bp z;2ZG(?}~qi$HsTz-Y?QKk^H`2vcKU2@D8~9Rq})J)9?V-@m!=mcysbs;W2(Degp3P zCjFdd+#KA;+1=dZcz_qsvknh&9nS}NjO+E~Cp^LTp{LPTG7s+e?062rJzU4*5qs1ia$nvIPUKfpN?OnJ$P%5i>bI*U*3^zraw||D9-NhR%$=4*TFY&mnV7k zukg6B_Mg`SYAky(~TX6qsalKED@C4tT{4(5K zBl*$z20X-P;y>WtwUU1Z|5N*M-LLk{y&+2Hp;Gc&*nf^zzfOED+r`I&o5kDGe?A`J z-5bbXT#38sl3z~#W<181;rHX=t&(rae)XdE&&>9`iwC!ff5iB=;r{L7|D&hg7Fl2a zPVqhWlm$1#gNNv+rxork64&$g37UUI{0Z{CHNRMVFV<@a?&Cx7ad?d9G0s_d^0@Tq zee!*H_(axUz`ZBMSJD5b_TV}{|Hb2{C4UL|ow)yu_;Yykt(<47#rxq$;{m=O^Uwni zpOw76FS`WymxzBvPX+ER6gzJ8OFdpNr=|2^B|B)Vj ze{=!vW!^cB> zGvhf!-JOvxP@lv1)t-9d$Fe^U#{J#I$1@M(@VLHsE%{sVsG)cs+xLFW;|=j8c!E#F zH{d}d>1m38gNOK2_%7VflY9$&-yhj7xbFX@c!U>|?}5kopeFJcm*C#s(m$2_B+cVf z@VR)O5Mc|C6r#iL^J zQRHvLz5T>X*}jYLpoO^ZKWnugUr5hac-T_%EAiiOe}D1Oc&prvclvw}pMhV92M0*L z62Ajaa6NB4j(Z16p5ePSxQ`Fy`1%5m4wn35?B{>s!C~U9SneS^WSo)lUU-5RkRO4& z!=*=kF7DwC7-)?9M@arSJi)_O;(yb>+s`tdutfZJ`~ciLQoK8UqUMbc#1nio`3dSr zNsnH~7vioB{fu)J9vm%xKRp{Y-&Xu?d&fuFUiQaMw-pwai1|Z!-R*SGK1V_f8j=tB-SM z;URu5{lm2fpUrwr()?N3{`>G4|AYK8_3~`~Gu-tNAHjD2UHkiH^DTat^@{P4jI$%| zpC|cC@zXVrkHZ7a_mlkD_;q-MUxLrWz5bFP$vj{DKN(LnQ2aFVZFh>hLE^pf1$cn# z^Qc$x5I>ImCwPqObKU>qNg(}W$sh8EEH}7V{7L*0+#4cZi9doz__g>_&0iw<8}JR9 z$Isvb{{`+UB;T3*Ke&${f*1TL;|%dW_`Z0855Y_EV2t$ZeZ}e8gAZkY8;rYglGpuY zg645OU)`?#S4&=fDehk*ekSAj2#@eZ_*U(?R`PmZRPQfY-vrn93wz@61j+Bz^Q8Lq z;wRDH1$UFgza`&SJrti$emEZCCo?}c;>k^t*X{K%?%gb|^Sl)I@g?;C2X~Vt{}H}P z`|+dkpR|99C+JpCFJRfM!9ny0d`OonP z*YnR$xVuyGPmynsdoY{cr{VfNnIb&7OY)nU|AW=<7QY;ChX-@T^?Qt`;%=U}?mq)? z56@>jqj4YS?Ub9M{dh<63-Ji=!+4&?-2z#ze!uQTJYFRJ9QoJq@KN!*=zkaY7K`h@ z54BDGN%0=!3;yLihF?#AYur7Z&G*Fv{3up<2p&BrdA%>1fG2qFa-Y6#R$n6dUifXe zzf@eWUvuyn*Yp2k%|9=BJr7so5w8C}!aDUACBKp7eu#(5#Lr|NzQ&W~;(hU-aet+_ zexBQ47xTGF{A2nLz=M~>^YM0?$8~=@4Ucdx*X{y5#&v%ig(tY4e{R?QS7f^7EL7Z*jL){3G1Cdg*bRye57nzAqlsh~Gwk8{EAvuKUTU z>g&bzI(04{;*V+`&u60h)|2tOcOA-@0*@B(}p9^!l8A8J2-7XFL&zc2mTv)AsjULJlo z`A&F@>-=Acha06w`z!GT*Z#S<`#|zN>3(@b+oAoq&Rao!8NdHwcHY|H z5w7FufycPc+fY2gb-hCE-;|xV`|tqQ^?FJBab2%3v>(@bu9tfQUUyv!Kazf(=Ob|c zV{skNsd$9zdR>gixX#-+-1|g&_F1lyS_$s_L9{el$Mm#V*84nwtnI@~qpN)Hs#B*Z^~%qa`HzdGXB+tg)%O$E?bQK~T8igx&(c>9_5H<{avWWN z2ZxFeV}BTpC#}TKV!bBg{?X!V@ddcoLHtCP`-=7({|b+cH)t&Dn;0*_y^hjf!*Wl+ z-SOhL94HGe$D;w_*D{}jwdVry*BR$k+H;|JZg}Zys^$lZ&&KEB@gQ;izRELrFj#!b zp3<{g`^Sju``P!^$BOIwg)MkAPF%11yKwJn@y=|oLz~FF1>?o_xm+*Yn;`xM>pKp2 z6UEPCy%uTD_2Q+R$KJ%F8^mLJwrf5V*W<25zKqAeQT!tMPsXF0#Gj|{4#tN zp5ROI`?Y7Xz{Xua(UOvO!L*mU?-=8%9u=wGPWdXbJ;3@I-EO(Cr_LHZ@FTh*j5uT5q zipRJh`PXRq@>IO8RPn$E(E;XUA=eyBhJoCGJjBe_gx=ABZQoo`7Tv z9x^{(BCg-F>W2qkiC;thRy^4(el_Q-=QY1Y{6oh73GQzbzYxzWV!M1N{t{k_2S14K zNB;mk{7GD&OH|@9uE*C5_3e_^=gAM^{toe`%-aiifOluPZ)ndilHW=GOZ8vHf5iV$ z|4m%CWAi;_eS`mr>viV{-2EZmf_dnIdw+`SetRzN|0SM#jG4Yhs{bv%h3#IczPr5R z(C0<7@Cd(<^^I}YQ1U|=&qsLJNL;Cf=?)DPb?e#4l?JeG!@#OC<>y_ZS z$4BX_wR$tj-+`Zkhx>>x#QWf0bMf5A#OZ6a`o7}1+tlHRSKXgF_@=M!p)4@X`1N+&fhAWAJY^ zkL&&aZn-xab<6b*lYA5MZE+tz5ATUbc<$rW^mVTK;nJhmsX^L*gm~^YFMVCD{jJ1% z;M26HL_9ZL>1#e7A1OYR^W;<7bF{dAuKKF_G2+M3^D!Qlinn5W{h|Hs#k-T=vpMtA zQT%1R6`phw*KwBN?pX2LWcaQ(9^tw_4^c0Zd^!CU+H<_Po|h)!-U;I8Fb^~Eu#31} zU*_SlFMbmJPiz0F;$4`B8r<(DuJiB-9(5OAPtW&w*hBmPe5dAniqB#mn&eJUb^Dv& zOZ-;+06f8u!;ite(LxSu2Hp9LClJCuSIR+2U7yp>$o{k3> zia(EEragni7qQ%%@dWSA{qrK+A0qjl+^4O_qszrVqUUQo940;i--)~7;zRKK{bYSZ z{3^y-in|e#Z;79Udn3iaVEc~J{8(}QykIh(;QD)Y7U9t~k{?I^f3&|+{7=TYS$(|t z?c^KhZW!veSA3ngeqW+3?oANa{rODI<1f&E1s+b6dqW^}PL} z_TW?Le+T!bOa4Oq2hHPM@%-F`r~4tk58euQw@Qzm2fE?G4Ds3IFV_4_adsgh`SK#hWS+4fKi+jeu!+pFP^RwH5vc8eYABe}s zJK~A)GjKOs#=~jSU5tCU?&nwIK7JbGnTbbuG5!!9<8ATfxVuZ1%iCP{KJFR+9`|v5 zztHF)nTNpS55hy^C*YCsbMe@C1)dnc1$T2~{2f@Y`*7d*3wUV!Z9F!+$;v?#-3uYW_pq z#~U&J9e99iPu{`o|Hco(6XRvLcdsn>RQmhiA+F=OO#6*b!eit2;EC~S+|A3bZw>Al z{|xty|BeU7_c%o6AvE3wkBoQ6W8)X$iSco`o1Y#3Ox(luyzwCJhbN|Iw?k!py#+EJ&F_Z?xZd}+$3wg~+x-kY!S#F+;BKMxt5@P4uJ0f3(0;rx z{f}!uJ`!Jz2lq+;nfQlzjBEdP+`C`$db~G2Oy(glegq!j+H*4QqHNCq+&4Z74~ zk9hQ$_>uI~&wap=-uL2-Pm;eV!rix$*Uz;}@Br8MHC?m^-%S5`>RY5opTmsOo~`2A zbBpG2eIM}v9&VHTSo&Ya-FM=TWs&@j=wh^{31Qq(Q^f!;BVqLYR|8de+plKhreZgCGP(&{sH;-aPNQOf8al; z?-bYV-tb8FXIzi>gK+N;$?JV-cihL9(LVxre@gxa{0=Gul`DF4ng_?iY(6$@u%=VGHpleRL_TsvIPsf7};^WvK zuELYf;$!d`nm=CrcYKk07x8l#=XyNGFJgVa$30*2`h2y~F*5!b*Y7hNiif92{zLk^ zS4c z&dla7#AEz1#yMVl&d%l^#1s4s^6PQGJe&UqkMLi~AJmTH<(zE(Ox&F--hk~p8u$8T z^9%71Kb<#_Z{x|JY`$rGS+0MP_-OLS;PKFGeh}_mCVoHjd86isW%JdVA1*$W_1%a^ zS7h@II>>n3h-|(U9*)fB`{D^cgY)yXn!hTWU!-~bfW2jh+km^N+5EqFfOlYhkLbwu znwHI*D^nEY5%Nj{x9vnU3@zynu9tqZ*#Nxv+)2wpYe~z z<9XTqeB7HauHPqFg+~js`7OA+PrNttzei^oPw-GSe+nMsZ?nEb@MuvsKMQw{i0{Gp zt8s5}HvbtO;(PJ=!tTeiy`IkIJL2vc@qKvX)F1bji0l2#6x_$hFrG*8`1x%A``Yt@ z_@k`v&v^1;Hs7*L#_2E1=DXl-MK(VY4{)8&+1j%zn_r7Z_%p2UH`?=RHow<#GM*Tp z&iFgx!J2ITV$I`Cn4f8QvNoGvf%~tCPv8b+oA%UZ^M@ZVC9PsaUEv-#1Q#~X5fn1jb(Wb?1#ULvmh z;s3NBe}w&f{}W|A?pw*X;Ck8v_i(*FUWJmY<_o&Wcw+ny`j1iHCHc*G zZ}oce#7xI|9q#QWuK9)P^|Sdm@DQ)1|0g_Xn9U!Udqa_aE{VTI{!~25%jU=6u5ore zv()p&f7kP;dZBm)+p882_ssVHg(tY~he!DAZ+nra|8zWPmhBmj$M}A%*Zp|1kK`}o zIpr zmv%o@#^bfm=G)*QuJd^w9^rlI8IQYTvptLP0DqkP8@P93Hvb16;&(9*2X+*7qhn?3>L$fhTxx&WEpS|ApE7&)Sdc?@`R_F5`>`OJ09}(Gj>mM7+D6pYaI) zg5%;!JiJu$cQZdTaBsNyCf4g|+>I2!4d0;sqgXEe+caMxKD3hzsNrcc{&11_$&9lt z9vkn6yGOG5Nw{zP5$!krmi8O}UHc!+_8-_o#_1dHj)%ra;<54BxLcgW7+6EG(31gT)+QWfk${bJ@?@5Mak=PlBL>%YyM+AHogn@mPwC3M{038`zJnx z<#xc`a>?gzYtz^1xW7VN&$mPH0G~n6_1d#i^3CykaSzw?;bZErNd7FA8{=Utemp&& z;W2(E=doY#;6IXILcU4v!9v~rfVWos8S;nWNsV}KmfH>Y*Nf|O!oixyf1>9G^|vHH zisdfCgSW-I;mhzCzn1&xGx6qJ z_s_$+ijptUa40ufLD(A>7|0uAd9k;4$8i*r!uY7efTUp%V$ z-K0m)1M4-9>*uha;R!yJ{r`77Xed4F3uOiN$Q@91+tJ@gd@xGXX ze<~j1GuTfq#e?IeN1umJ!QDyX`tuZzsdo|A>(mC^J6Zf6#=lklRPh0LK_3}s*iAfl z*-c+Z<4JdM9e)ozI8FRl)@z7*5AkA-uN$@hOz|JdFH}EE`~sG{3Qx`!pMrm``Ev1R z@ZWI%9PxKJPMe=2>*e(qFJu4dga;$UmopC+YkrjYd-!d*8zVktFIj;H@aSgo#~IH` z?VlokFaCx0+#>!F^V2YQ;;q~NlbPcG?>+&KZxffZhjZn)H%ojeFxkbMRoc z_)5m}lJ?9I*Zb-(asOWNU)WxGec7MqiI>vT2@mIsAH;G8;n70zapZ5rz5B(B@rQ6f z5^qM&D|qmr_*3}D+OtT!Df3zXJjVIB_;L=&R=9gsT-VE2e@=Wf>pKt+aXr4S!J{RT zAIbRd#=Ymo^}eDSPmI@U&kK^@!E$$~zbJkW{rUY^ujS(U{f#zwuu@#t>ooOM;vxM3 zp5S_27>~P`Bws;(HXh-R=J*Zx@i68itretaJ5TijpP*IO<5 z$M6&IWKFhb03Q5DTz~)eXgq#h{MeSV;HkLVEZ&Ig)Wf*9Mf`Tgxkh_%UEi z$I-tx?za=)!E@0P^%KPVlkbX0xPCvOA0C`6`L~(3;o8$pyaCs*n>0T_T>t%}xtbp+ z&Sr7dn#b3&pTDB{K=QZX@8iiO;zuwKTXAowxITyf8;>s+f1mZ;<3gFYXqfnS`2Om{ z#i!!O;{FxldLK0q5Af5;PsC$f&)ajgXN2@DBmV;KMvBkEYw-xz<^HPucrWsM50v%t zu9TkZ@wRw`zlEQHhodAv1;0#tMvF83ZU*ife*zD1J#Vkmev{vfM|cmG`wQ+WWVv^< z;5`Phy~c_!BHsZI#);={chlD(Jic1|N%E8N@EY;Mxn4i3`ATv9Jry6~?t1Zg^zXu> zN#d{3-{vA2XLy5n?sA#F2IEO6uD_>ZI_}*pzJi{oHIHlm$9Ozh^0_~zuX=;o?o-8| zr>6u@@XPSNcyNp4_4}(=;2}Pq{8Zdcle~WKeID-N+W#UR;d87mEMM`D!2a2gUV$#}Vp_#E&801$U2&AILoS z!M!KMH?!Em>Q9P4ijT$b~2J%_{5Jx0E2lFX;>=P%+tP0#Ci zwaLGOmz(@&sW)}Q%zpkeUSZr_BFBaIZuWTD2d^~wBk<7pad@fe>52Qs2d19yJhMNK zOTEC=n(cclo*0klDK$OMlJ{FV+~+IUO6*7#AW=eyu>IiKh_Pe{GMdAG>;YZ%a(sTaEKQ)R!><1wJey&*l09d0aM zZsuol>P=l}w#&TK3*2@y&rfLoecAK#iqs3;GUhFhajvJQ*6g>NwBPtQ^ao~~zv0nS zvfNVLFhgaYi@wNim%Z>(<454r%zk@(>V+;g;Cg7o)}+= zSD5}c@k--g;6*pc_SN&l52@#l>*r*BefHa3sTaB<&2?d~%j@PjcmA0n$8|{l2;5B* z_wdfC=k}|cWw~YeS>%s0{XLRm$jw4@V_Wvn(uwItyisXbcA8&2?pTtXVk-W~s z%Xk};|0?ySZm}89-{g-r`NCl`KW&YB_%X&i;iblV;q8nMO1;3v%Va()4w4DIl6-rU zzcuyTeOIaEtC;@>@#Gls5Pu2x-^*TS-^0s|Z%I9OeXQkp;e7sY>V>YB@#N9pWVp=F zCgUwr&m9+Lo{z@kD`cESTu8d&ff-MKyu$bhJT!g-US)hX9vOcm^#T`~<7+uS&G-hq z%J>)fT;o6Ek@5Oh$h?)C{q|toGsj)m)a$$8AHE^L1~@Sp|H3QG`tFhYptkP(lV^HLQqLV1Q)EAh*xybd-+}Sy z{cU;bx%WqNWWQA(PQJ+WPodvUlm4Cb&!wj+J-p3zPvJ$zU!}jJ8P7)g7n|+A880>G z?SJud3JyS1q z15HnB{B)ehU9KxV%glWC$1BYC8cC14RpzZH^LAtE`L3SXKkp(R-XZyE?6{BNzBv!9 zNWH*$92a{2-+;$A%KCaN_ha1cJ3N)*+@I@STT^f9wwv=ty-~8i#VofZO*_{-^?VnZ z_X{O>V*CW$dqR#!?dd~*PqRM^!^@3N!Uq_ii&vTR$#bdaw!7J0Yw#N5@8h+`H{+X( z|DJlG3(Wr0c(lx0V8(d}KFs(Dspq?5bDwz*zMI)k#-!fV#b!UhmAq$q7UCtwt5Yv@ z6=poIw!zYq6}zl1L{ z_j_-pUg$=e?XnfGF#Z=l&1~QNt7N}A*3AC_c$LYwO+7bnW;~~*p6|-cJO`;4IG^{+ z<(&7fqTid%{=kLd7JRN*?gMyad1+LUTJ(5?sK1}@5dj&L*vik4liLpe+@su%)_U6V#c{O z^?c`><7gN8EhfL`)phgM)YX{du_X1}{i@l%e(JgBjizTH`NZ7kj3ytN?Q$b|H&M1@ z9_u>?uQkhkj2^E_j`!ThI_YZ_exjM5jd*01`(OIEoBr*1Q7Gfl=N0v?k>ke_OoB_$hd?@rzS0bUV#_jv-%a#xp7P+s$;-T^7^m}GJuaS2= zht%!zA)aS^3m);DY9`z9_tbOG$<1}P;kB~Ac_+#|>-Rss)N|{_bKPU;ISCJp_e;IN zm6-8gl6s+=Y}WT0e46o@^pu-S@bTH$vY?}nd*>wQ#Tyo>S6@RN;K;+`4L47|kneW~ZJ*PCSf#$9AXK11F&{cmXh z967G@^!tanyIs7#UQh8;OphBc^W$#gen77a_+0XO-fowA?)i*4@AW0Wz~qOfUf@d2 z{x%*jGkzOAk?DB|FE#VF3XjeGXHDw4`=zrvFEy0;{D^#+>Dht1S=o8m{W_T+{~qx& z=DB(5`L3tAUbM!`jd#TlGv}W{^cR`;7n8^jFg7o=X`JU)-m@n1zx>6h8}eUtHWb#BF z_jkSVQsYDMfX@*s*uE1|&prP!%bk&W?tEqT+Xc99yc#bz{t6x#e+REH{$=X9&q2)i zf5Iz_|AR-y51AzUVYTs7QZH}=%yD#S>iMqP%)@wkDz;|#w;AMPlV3=GVEU`^Va99d z-(;>M@8OB@&+#qBx8mE4|BCN4z6*D6$a>|mKNQ>`^Ok447%wt@C|+#5J?` z11~jx4qj$_5bhhl9PerTD!knI_4oke)9}FfY2#-G4TjK7YT8sCJM8Q+Tg#{a;3 z8gFu=Y{zor#rOc@N8y3-GJKfvo_K}v3-C(gBk<7pb@(*nx8haC=i_sYKZZxf*W!zf zzmHcN{|R4a{9imao_~|fbB*!+@mk}@;G2wh!4uR55fcEBk^Iz zC*l>xZ^bK(&&NaK&*IaJug0s4zlF~={uv$_{|#SkyuoCd=W654@MXpi#be_g@fzc2 z;kCvGN^$3g2mb1Mc3+?*E_RdB(TlMaKWai;Wjfk@@tDABC3~ zFT+cX_rS}HpO5>-hvGerkHyQ4--Hh^UWEt7AHathe-5uO{t8}c{4G2*{uw^a_>Xv% z@qh8T#*3!P{71$;e6jHkc(w7a_%h??=izmk4!nYXz1mA9a z3%=9%pSXKFyZ<-5MdmHfcyqkS_z`%q@iN>qekNXGJitqhkHgE1--!FhZ^L^UpO2Rt zUx5!WUV{h5Kf;F@{|T=!zFY1KA$8A5Dvj@thsKY=ry1{xR~he*&ow>o7aP9^ zuQt92UuJv>9vfeS*BIY~*Bal3Z!-Qbo*3U_y3FSmnejUSKiG~Nq$wb}i@Kb~iN zI9_CYB3^8KChi$ufR`A55-&9#<7LKcao>1?_cZ<+UT(a>tumhjjPHvF#@pb-jGus4 z7(WBAG(HdyjgP>m8J~z(8NUsmYkWQ)8Gj64Y4f{nyWu^JpNp3p zAA%1sUV#V3Z%94&J!dn{JIN0-`9*kz@fYz*<8P*(?`q9+&QHlF=K1Q+P{7$#&7t&5tEtZN3NCBlQ9|&8+XacoE+p(4GLVGWm+sbKi5|^BVo0 z>h*YioR5#(jMNKVH}f3+e!SL17`g2d8r=I(H7BdgOr=IV&oBgx!_PY5j zaEnd8UFuDpXU5qJFExHK?i(MEmm9wu4~##DR~UaE4~_3gz0f6Q9-36i`7JcZ^&$8) zdVyPJ=J_A;zmY|qql-@h_FgXuZV^xT+wzT0B13k&Fv%{Z6f6=pxIp?@*``hA;UQ_p>m z#hmww=g9t0Yy1>EF@6QU-S{22`%vaz&krl{BI94{&GuS=FE;s?Q_ub02D9Bi$7{@f;^x+kC-*%c;|JlJjGvr( z?&ng?cDWF*Hhvu*8@~&$HU2D~7~hb3eK+?8=9BI9Exycn<9qAYE0@1l@@3?Y#Y;XA z*Y9bJ!^6qqdR?B6FE;)vUTgdte5djJc`_bvO18f(-qZLwc!lwC_$ITyci}sYzlcX) z%5wGk{t2E`i0kp#c)pBtyYcqw*Gpcnn-}74Otxn_USzyleNwjPL%h^@!v)M+D0z?V z*k0ZA55`N4--Y|e*Wl&Gf54;nWw`@b?mi1;JiZxEDIOR<3lEKtz-!I^IYs+N%X0Hr z?mWE0jPq&jH@*?CGX6h2GQQt^vR*ySa(%qopq+3vmZx#qYY zgU80_;9HEpj2BInaq9VMGhSxA$pbRZz<39Iu^InBe45Em#jA}!jc+o(5qGy_$N4v2 zV*HQ?Wt`>4yW^F{N8*w3*?5idm+|e!H{-?Avg2&}kc`JSUWyMh-Vfho=5r!mW%3c8 zSC!r0Uc<|be}^wKJw*@8IER^hXMC>lL3oYvoA8~+pTtY<$d0oXA7K19e46q77s)u6 z89x=@V*GNv_|EKd@5Fl=e*v#F{t3R=_%3{t@gp9Qapuj=F82()%=lP*nDKe|T;s3e zHO9ZicN%Zbp2qiHEaR*+UWP9= zJ_z4rd@`PQcXqkY;AO@?z=s+C6Q66`drZbzW4tTA)A$v5$vxTe%*F>8UxiOI{uRE= zc%#Qms^haG(HiJ&2{H~yuw_6x8RA%H+@3J<8GAYdR!k%@M*Q;J@GSf z&*VqozVTb|ym`{2_vcUHfyr;gL*xJAi8&u0^rVbGGWjlerJ1)Ocx>{M@X~8#oO)le z2=|R|!oBH|*XweFr(`@;X8zmY@yC*1#(Z9aCuTe$?rxI2ZkPGEXM82@8{dKl#v4B^ z;|z_rQGZ32>od;t@Ywhy+{M}aBlzOc;(CAk5?*cQ^F8f1{x@E0+%6YV$KceiR8&oZ;zqj1mkT!5DvpN#v)AH#!bc~hoxTV!iD@?75R?jW0UWPC&sT$J@>hidG2u|zQy=#e7o^y@twwB z#vQ+}Pxt>%@I2#x;6=vkFRh!00#|JO0NgWPntGw@X`VZEAzxzh=i#Ns2jgYNN8rBk z>+qh&XW`|>A5J~@^W&Sc&k5J1UYPs+in4umKlv1|HqXa?p{LyRGn-f}h)bkh3x;j zpDe}Q&Eg)%<41U<$-5WicyT-zDkk3+4<=@hyAgPW@rQBG^n9#t#v*FJkuQyKau&-`|x}4#EjV?O`D zhne{~JeK8pCO;_k+|NhPl$3gV zX}|F~+Hd?B?Ki$&`)jiOo3-EgF6}qo;y-L(4$Aihz?{R(`oqA*E@%t+(@d>Htz9;#beC{9Px8eT7;(Gu5 zApH^dvHWw6ZWUgI^Uor=jd=34jOTaW|87k^cXwYU{rWwD-^oui_sNacvE8fX-vMEm zt`HB+b4+vtsLhrxw2x&=u5}DOGf83{eM>uy>jT7^#2VX zb?MN`|L^~eA2&4p)6mL_i$`60O1}Y}+O;3t&Sn1CKKsWG**|v7{;_lRk7e0EwktJ% zHr?$^TRT(N&h)i6eeF$Od(+q6^tCsA9ZX*b)7QcL_Z>~Xqgh@@)8EPTbuxXOO<(7Z zxec7#zL#A5f7HEOa~sE!E~=m6hx0%&)`rB3XnE#|;!WJK#< zPXR5 z^MkIMA9U3mf~O;ou9_cwepk1FggA%+SPPn_ZbB-ots0ol@~RFP?!Aiu`&PnX&40ww z-S#q|gOuvffzn(bi_ybyv3i)blXtVCeQw{iPt|zYI+=dn6ti+r*H=X|DcMj(8w!yTHOsgbM0?pQKKU+5?a1svLx+zhU&}QqVgiJ!4t(y`rF|Cp< z2{c=`gKXWDNJ%(k>!yTBLYu7{#7Jg59AxVTWivy2m>rXc*}5HO>jtGY$2VKI!|Y@` z%+?KRVUBOMZlAJs`;@I4l;{lKPuaSC%GT{uwrm{)Fhv@1ILLE2$Z#;E9UP)v%3+@IVTQ3GjTj&0IUHp; z7}5?7QPDo<8Gp_&Hlz{by^nbofTt~QiBl#ZPJybQqB1MaF>t@57`Xv}J$iNo0G=s^ zAx?7yaSSva7!A3-TxSEAFNP4utzn4M9M=>hGB&7U#6UA-;xgxk*PbDci)V&M%p^CI z_6%{#B-8$eIIg&GPJyaP<2nj)1l;c!x`3k?QAI3qRAxn-0<%L`5l3a-Hv=rrF*kHA zahzjr=vv}5$8^kC;<%NBa||@2F)nj%obMarxXcC~7f+a^z--TgIqDJ@&y3Qzc)20H zZ;0dK32_R{_pA`dWj37C;$_Ng#(7-k+zi?`#BuS2I0fd*oSQ+Gb6n=!3_9qTL4c<- z$P!1zQ^YASTV_QZwX@|Mm01zTz>ev5kehA*s$#^&Gd&x1)YE8-YvW_{FjhdI#!V7BQLaa?9Y92YMqPb}xO zc0;<$LZxoL^xGUw*zCo>wOVgR0Ywp@>spw!0N^R5r^wYC1(6 z1I^%%%bc4jpA2zaJOhtQlA9Dq9g_m^w3RGzl%pa}f!S74#8KHS=cqvxaSSv=H)^G$ z+@t`|Op5_^t|Gg9F;ofjG936c!7!5rr4M6@?(9Z$v<3|NOC?5m3hK@fU z{#cZI`p=_*j9blEj{#sYoX!Db-s9DL*xR+F zV;qwbM65ZGQsuRuW%SMLT89lkZ6zE*3SuQ3KKOcUJ=Xq*aPa|U0vXmX!)4>8PXPYO znQ0SK>&Y-ENEv-khC$})6Ybe9n`%Bmi|V!=mF>{h4OG>#1yXF$^J4m;c&vI~a9TZT zPs?FFDnraoeFo#nB7**mKI-))pOAcjp12){u$^5(-}kP{c^+~0eNi{da&%oTpXyN? z65YW3-MehRObZOBpwNQhpA2|VOd@Fcnv(A9vLf%ZHQCuc#~|!1`Q5T{xFzcMZ@uy_ zb$DnR_1k<{&t~So6VIF+}e&<)lT7nfBrwHX+| z!%NXj{b_GlUD6e%BOAf_*(CK5iZ5ukbsUIa%f)Z+4n{snmRGxMhV}fVcgAx?_1Cqj zLEh1|fW6*$IH4(p%Bw$(+)9gZ+}j)$MDpckJ#JO@_UNj*&UU`YF13&_u!RL zO+0aIirQ3@r)8fAvsGE0eYT=e#t`rGlh;G>+kvE8Vuxw9o44o4Gw4SSzK2oSF_a= z&O_hmrjz3<_@DL#PbZ^<`MCOCj`HO_m*&lnU4_dJUKxmMP@?CIs|!86K0rNPeeazu>gn{?!e21+gtwS#t{i!q`?Bx` zdYpT19E#<-(rEmKM%Gl)es|F0x*HKf1WJE)8HxtM&MroJ$<`>F_q{otR=dW_&aTI{ za{|qZMccb6U$1j2mmqg`fqM__7@mXEDYV*Y*tk)3 zt|wlsmi=kH+=3Fr|8-DrO(?ZmpZ94wg?Hq7nvu|~%N12elSof{3x(-qX_(cVUZ`y5 z0rnni2Zi5|e%qYGg~DHm0{*%`V|st_*@hl_sP&DZM?k$=qQ=rDELMM0vbbE`3FhVN z`hHuo5#RTk5-z@-Wz|Gmj8{#GZP!ydd@e_KYBX-*ykX#It_!p|JjG^@?XreQ?PPk1 z?cRIYN^T(G448AQP0QH^(wnRp(Syr2B1dH>BTdz=6%3k)C3BmNVo?ma{dN9$$hc4% zt{#UyLWF4VVXTIBg4xeugi8+LF~hj;U>0E+KL|zFXru{U!IV4ex za%CVUk^H*LG7`kd|L$$Dq`k%}uz^H6F+((g^$AY$Eym`!PK!1fiXRV_k=)8*uzk4t z^l_i!4*vP2zEsi8>%5v`Hr!NGb^9XP2I^k@V0c4KNq9#|(5P64TP$v{T5*%>^7c_D zD^HvRo8o)eUgkd+&Ej|5E`bnVls%R3568)rtNf1jv96zc_p6L9>SKGOa$GjA@a4~} z8F@m_FqF$LF&;e?!>8hNgPSZcu=JP35^|IFDpzdaQ~6#bul1VFDR+FS27@U0YT@`FCH(8b z8W6|?3?RmK^3i5uAg(wD0xwmQvjJhzjzPZM;AJFOYW%vP4g$03P>B$LT0{V(4C!UZNEr_U$TORGhL0G(ng;p3v3`A*_E@!^3CSL zq+}abkC22UDt17_kB1+W*+PN>FO_8~ZGJd5Oo zvNQ>y>r!MgXA&pu0{;6EE8OG5&TH;^Se;3!yJMq`?8*E+fjfy9*wXq zXtM;1DaN(G?=mSLX^?Dlm<9BPB?MVDeDMtF0xjlmL(JfMM!m{5ouFW4C?Qha2oMfj z=PjLVHO4qrGi4Z0>)KNn>(SVvu!wLiN|redKiKcW933W@r}Fz~HCy~zH(uU8FzTb7 zU5(`K{1MUt^@u0{ z?*3<(=rX(<8m3%9YEys2hFl#K+qAG~jnTKm=l8t@MnD!`y9qHJ&#}??1;?mdX?<#p z1soiXu8TQTq?B2V_IT2$7A9`WS^eU;&+BFRij{Wd%0W;&Ez1zH6cBuL)S;{`9;p>B z1DaS^TjCm7z?ACoFE~>izg_ovaBK#rsLlR|lclS9fK;C`djD5cC*XFEBYJa|ZWz

i?z^l7^Ce@-Tuch*n z;VJjKmffOmmwC*n9Ib{+9@;^XYs!(QRX{Wkr;QYCAtqv+4~qKhEebGm)sKJrdKIsC zLwk^7*!*c2LGS@?;VcYiO3W0COh_BSBUv6{-Qul`&qX8M3*9B?WoXm1O+oAR#Iy#A zfyuPs>m$#4Y#Co4ul=dklw;~tRH%a~NKrLX&1I9?JpqxX`QX4}a_YdtwL=;3HW5+` zS{gqOWq3E)1Q>P$&emQFZ!vmYO`mln0UQ`fU;)cEgX=fL+xgTDb6XA0H%`Z3Dq1XO z-+GKP!qyFyA6o#MURFrMUPx0K^bYp>(*L1+w_GSPICGWx#57UW$|^p(#aLfz2M>e8 zEn3}oHb1XXP$Pez#t#(i9iK~@(h(7D}gm9eX&jivHn(TqUt zv|v&VV3Rn6Bo0M|LpInv;OrCamPrYTg8fE`LDPTr*Aphk%x$=sN$xa^1?deI7HNvj zPJCc+6+P;N6JQ3#%Bef_JxHP0ms_aK8_k&lhfItkFL7{c+GDUorRS@K%c7ekYVS>i z-gXKn%V(&3e*xzRPxaP$(@Ds!(AZ$9BK^mzTw#?d=YR2styhd6!Pc=3FDh$iYAOt! z$RX6BWqIM+hHVqc_t%lnIVgrt|pz@;yNM}F^S0l`VRZ{})X167Z zHt~S-=v2BN3zetrqxsJbXV)qHa%rJ9KOZRL*6CIW%3nL-s3AgvN2#6)u(RtBg0~s@ zn6a-6O+w9U0x?0w$|f`bSU9+ubmfZ>u5|R9K&%2Wb`?|X`mp0VgMHd#Ie>T31p6>? z#zAvQ)Ffz6!FsR1rCAQW#6lG{mQU+SG8uBEIK>&5m)w97z5(K(D}~aA>|NMbg7)Tb>y1REb4mdDhemEoBnZo z-M8E@EQZGaM3h_}khC287bgSg+$~&t;T>z{MV1^RqiUbFr(cONc|A`>bA?@^C;YRy z<5-ctWZ|YcQz@9mu;%l?wesw)RQ+KNg;aQf)&YeCp2{mYZ@UVIc-Up!x(l&((e~%? zGVy?9pmRMO4}#ovSQjl|j`& z7AmD*synoUg4&jt49{t4`!b2PqTD@WKzmJ0$e00aUS&P-IB-9At-Hztp9Tj4*dX)! z#uAX9I`1>1hL97CBxo>@hn~R&N2j>UV8|v-`4(+~!5rqv+i+hz8M1fM{jwICFdaxg zxCVlY6uR+pPM<2)hdYa8dCrk6o44cPUn?AU*g`^GC*}Jdx2=w)%M58wd5#OWB+&Iy zbuTUY5RLr42cnB|NdgZ^zM`|xs^!MCD!oR8hcN+)83#QRU|}Bc^yUDSY<9eY;9knI zsof?OtuEENyLQuBG3x{L9!J=L)f6snj>@H~ zFBN`_FuF9>rF%8Wu7j-ceb2s)P>$?LMtGam;w^fcUCS0EY zM-f!B*AqqC8lKW#+&ca6{GUl7O4s)=g`25< zFPwx&uFwh?YI2CUo%66sF!dCSGZKneG{s^xk8{0R#pr0G9-~8pJY-swIaDD%;m-?L zWu5gkCB@9O<#?PJMi#WQyMR4h)+i{KI-B*_NJEfg#XeF(Cms5dBEuM$vMg_9)eB7s zEDhC`Q`qX&;TIXRD^6fzj*nkVamDV}*&`Yo7^GY?X)NW3Em?wQ0WqdKNewC>COqR}GQN-$O_FFDfTww7<3!-=c1zQDtGlFvj9eui9<`oP)0?z+{ee zBKV^f&08N^oZ-{JHzGh^p(s;@;)^NwWt#Ni-uV*0)>bCg&!_{c4uag@MY7LWVf)AGG7jCiP5_W$BsnK zh>%UBZezNx)5;*WHQ4X`2EX3Qvk|BhAylqhL|V9(dBjAE0N1c&UKv#hBM1HNRVze% zDH!P370zIlwwX^ks#+XrIT69dRh8kfz;)h0x)@C8t3$7iU@jRzEVN+d3+Par@yfH6 zqnJnLa+cDR0uO0Q^ik2S@ z1rs=uxY=RHqDF|&NSVd*MROByR7}fJkm}$&WeAbRk?-0gOm+j`%r-cY3-Q-XtfpMb zTQVj=iejVWF_HB5W@uLx%ckR-`E$#M-WJGeU=G5Z4B*NEU-p-hsj1plCX9;KyTev0)?}jcov)PW60p z-qf>SVUx5uBCS46eiZi?i%?A-9;#rEXLiY!jw`ALit{F};CZ43DFh0m>9^1=A<%WA z3FIj&(OB^?%H}PT$ecv@L)@cGw0aLG0~qcNh|cT8qlc$1f};wYJs*dMrV&kd>SWG( zDJA!gq~TiaCE|t#B_7qYI}9%D%I*Ru3OHv@%Ki#2uZUdV(IPnexeU)BJpMpl_%}2X zC2AXj40|~+j=cudFz`_~QF~}yeAea_SXyyV3t^O48FVnnb6u>EGPAnTi+VAfXOdGh z*4$NFd(JsVb5?i`p`chUDN$mF2rC^D$f0sd;Ax{_=`rV&E1Q?8n%uNlyQ#mkYoIfK zO*6np2Sh3bwH#+SOdmgpAu$JwcWz`v)Hht z@)gn3hn>@@RB$?{vf?7n7EkkEWMyKc-Yj#it5O0=;xJfc4>$ zmzJmx4f$m`aeeI_+E3&N_W-$}fHHnKt8j`M}lPvdA1i zy*_?fjm-s3(?UVu=e2I3gSttI z1x!Jr)EKmQM!~5x{9b)`*8;%ZXo7*SY#n-9v-2Qopg-A);XK}JG>jJ9^RYO_7e`Cm>cS><*^%nsQw+!f&|}J0U~TdNRMhL$C_@qJD4*>2uwx)@@|O< zR34%T8IG!#$~#n(JB2~JOTvb_Fe>XEkP9Uy{ENR^vdJ;Oy)#4fonTzn_2QJLUKSwe zro?LLh9r0I_6CLP;2dmc_l~WDOP_KN!`y2%qiJXNL8_q-=WVVI&J9agq7Wxfc66i@ zTr?_OY7QcaV*v;Ck!0bj!l{n%ab7!ENW^dX1m!z|jbVay(pSY8Np=$jv;qAvBrc8 zQB`~V2;&8ekz( z1ve{0xSPRH@wlFIxx?nVeG+yJ_Xu7|H3=4QphZx6L&kDIB&ZC!UBOZT=OfDwxxh!m zeHZN;_+mYSwat~6!?x!fpwOx$>lb6?Qf;|?N4&c}RJ#Ch4_Sesor6U^yR%CMka>4F zOz_uK4$Wo+>+>Baw&f%v8Y+)ljsz0jZkUAkdW58PI~Vz$yQw4JkMQ*gv%#gRg3;fM z6cI83dY5Gci1nS}x%?ZrK0M~J!cCBnYXZP6Cxp&(V?fve7$*B`g&QPp>CxLV%TCUuf1`hZ1@`y=Ft3lEs2euSo;v<}31>#~*YZnE` zk$x-(6@eCfJa6-PUeG40ao%7>ffs`(9wvBo^nuZEK`okPCV>Y{Qn(zvv-^Ni0C(h! ztklO{FGmn5lB`mofv3Hm8tv2wp%fz{BR7`<-=#*>q z8C8CcQwK)^tr1!oT+M8r*i+w>uV(~0g?iM~3rE7WK~mX7m_<Q zXv(;c-IXO89!|q7mH2w`e9S^boFL&}?M;0bLI=F(pMvSgadF~PbNhD#^+=qaEDwlV z?4#lasph=NHlg>Cr4%6tuU`wGzlK`pA3S{kKu>`*iwU~Lrqi&LYO=z0ta9Wb7D@}E zf25cEttzKJ)uiS`a3e&0yLmE+z2Ip2viy(*XAJg=!KxL4WnLV1q!FZ(fSHtT>B}Hp z!To~JSrj`?tPVC;AN>_uWA?CwQ8W_6ClG^#l*}oOdAzGu9`9anhm^vV4}vDxYU}Sjl}pCqbc~~R%zZBo z`DE;SflkH{dp2+R61J{74(2$M2cM)g9jvC?Z9fuwP=XW&ms`bDVG}%H2tg>iZ^&5* zM12B1#zC);Fpu$;wg*!6FE0=m<@|I-RTc4b5$oC0riDZfH(}wVq~rCID}Q(J@XKlc z)@BTa4Gr%617J5xj)?(@=dX}ypzKoAy}zhILn_?AaP7)ohUD|FYHJ1834H^&spXu) zmiZO##Ewe7qKvg#?1&5?W`+G@g;}gt5u1Ss`wPz+x6NmHAn3U~B=az+ZurV#tHD0(?Gw=WhB`zFrJJ?)lQ zsydNL7)F96w#_Q`flVDix$E+F46_Vt9J*nW9A6w?-dG+CO@bRGyj-4$BppQWa*jg{ z{6PR9*z$rnSegRYs1Xyw@{~4%L6nEW78n@ICw26RfI98NYF;@*18?>vf>&gQWeLr! z<+V6UUkQKk3jh`iB^0MH7T$-E*B4ciSR(x(u)IqpU|lWC3OiEXvl9WyyNz&r#NHJ_ z!r*I*2_IZ{?4q@aE!S7LvESn+c0KRGAI4YIJxta1VgCx$p8$ITEk3|vno4 z`RA6Blf+gdfOZ^UF`9`wICSy?FfHvJ49Ah6?J-Op+bMZ0hWo(zKsd->=g%J1I zqzZk{==c_ovGmLJvAik*vB&Y;<28?_^bVMieKi>_zw;nh-A@Zml$0Z&usp?r(ic;a z(xSalPKBiM!byy35Z*y)hb`7J01<}wY~gp7Qe?tVU}OfdD?rcutzyN2FKku);8-TX zxc&t%Zc8zIZ85~&54dmg8dW6?C5pMF#I>TfgpwE$;}Zhvb{-ZYOE-QUg|!XOJ6Gz) z7#P|-<*-hb!wC@&7-s4rf{+l1_s8yw`5+_I8e4F0$^sTdeUnoNIxQej=n#<|+&;M;yQ^YkNx^}kU5JN_6cJtQ z@)7Ve^cGo%d62;!=8(xW$WVf`mPp)Cz0i zvznLPL+=DAGXfpSts8m=ABT>oKAIypSi;o1S2z@hn&bq~f>8;*I44ZDc*bceo@_9S zA7S){3jo+6_3seB+*2wS@~m0N&x5&D-2=Lzh0TN$cLkMI~C$1809?b;NDaE8G%mm>9u`?4L$6HyG-z= zM~&f_yE&UU#-2mD$Rary)D^#O29BnajWv3S^3csHqzl;X?5?cf<}f|>r0i%rFHA814Xo|j`}EJ zz=6(8Y@6rNtYY9(tIQm2#CxK_mK%JwUPJX>AmCQb-o%d2)V9xxTu^q^;Z?#*k%_aqI5I}@vOtn1)ETs4SHQigWk@|ERyX7 zME`B}So1khxAW$ZRd>Sfya6iZ6WeOj3$Ho^7`ZWP%jToP%QFcks;`fac8Vz~N~@)) z7=&Tv!_fD{f}{p2bnX^tAKC<@w7j}y#)lxXKseN9co=9@Bw+(wUv7_t?W5(fG^%Rg z5HDWi-7T+^Lm`da5G7A+$>dJAWvLrS;Mj-`I1TY}~TtJMP z7xk<_oLijSWYIj+!J_6}?6kE(^g4yjRTapKlSsMuQ(l~ObGTU=)puN0z}wjmt2M$&@8hXR(?hOdp^kQ6YsuYk9hYmL39>==fP7=c8#@w^>Rs zB{D?lQm6mYayp1Qo;{+ERlgSA1DYO^? z4b{JHPL9sfU}YEP1Em)vdD#Y}9c*0-hWMywa$KZt{m|l;qsuNVDxEHmP((SZu>hM) z7)~MtM`?8KJnZbQsfSI53UR?mX_kQWFwp(uI|YnwTCj~WoK*XKi(}LoOmMD?VoX%* z$7*@9YFfMsElq0E$?FJ;r-kVa4()KaUPKBFX88lK6rXlIABvL81FBZ_K`I2Ldk$@b zOxlLG6e0Yp;cDK(TVFMae;kn@@n%He8}22Jk23tU8t1koF>(W6g?7ndMT5$Ny1E6U zoF|}{Q7g^{a_sbmmKfJ(PhQ}1;?H3?#PbNPAA6H$W zhiCfrEKq|SIF_c#b|A_@W{Ph~i8gLN>cEaK=jIZza~?vjX+8h6h}!eKj4+X7wJQ{N z^}VBr+FlNDnFjYtB64?kNDz)WPgJ=-kg*hRDO>M;UBuAc1&t6A$p`*H5g10?C}5XV zi(7nGgEd61#A}FLZ>=FZv|Sp7iwu()O-Zsea{A#r|@&9N;hy}h$V-^ zjU1eDPvt;$Fex0CzGf*<*CuRm9o;*kk1?*XV@x+USFt#aD{zc)Cd?S)F15rM_kdrF z`N?){jKOQ?Mx-YwH~JD(cQfpDx5Hj{L+o|8g!c$xQjG4l*z0bLz3$f7?{1C#?$+4v zZjJr!*4XcEjs5P{*zX<~``xYKJvAA(;eK~(9CWwFL3e9-7t-Rq4!T?8pu05=x?AI* zyEP8FTjQX6Y#emA#$k7B9Co+HVfWZL>~4+2?$$W$ZjHn4);R2Ljl=HNIP7kXPu;EY zsk=2kb+^W+?$-F!-5Q^|TjNuAYkcZ%jZfXJ@u|Btj=EdpsJk_ex?AI@yEQzY^LTz8 zb+^WmYYo|hp4gXEq6JUfA8B3S`-ibXKR`-CR|R*888?3;rtlenp&Z6W@P+XU8dXA| zk6`_S%ZSF_(e8zPL(;GRb> zOiko@eM)IuM?l>eKC7A}#c@T!1_YXBDX#$A1)004;O$-&O6B#@y?LzH?hgusO(!mq znzxFCA$-L?L`2Z04GH}hOj;PYUD^QgT9~K5-uZBP5g{TzPA~f&h0!K(P@oJ!>b9%6 zMsVxrN~I9;lr{Y({Cy$zHGF{3wgg;zUIyO4m+xqYtzdx{n{qvZGc)fTA04)qA1=UP z98QK_Y19GFhZ)`gz~fo=K{H)?wSj%ODPO%LUIje7X#g-Onx=U35=40@w4tYg3AsPC zESy(Tfxgq1hWXHZXDe!)VaVab2gy`?L0ypmnC*)W3cu_DNsyg5D=FW?C_}s=*U=J& z8z~Gk^^V$CJ5pWO(bGvyI@=})S^>8W`)(Hl(At`5w{3(pP$%w6%a?K7)0sUO+#TE$ zPw27XIfaWaf;!UT*w?39mOU>pT0Z>f^O|#W$y14LBF5lYgFcaK1l`H+d2w+~dhz}4 zPOdG?wynnqALj<#L`A|-EhKwmmy>QVHAy0zv<|LdAt0E|T3`{K;W31}=xWhZDNMJk zue!BO`dH#_ZyA`gSwQbjBwZR7wl4lPyeu$u-t~+TsIXYBZPs5TYuHww6V&k-qIx~% z5)Y8!ozifiEpYOK#W4k{upeQ&nbC<`E4)$@wW`6wOPfg3fV2iVN)1*0C8)TPykqgs zYj3%NVTh#JZK2Fe;vEO|?n@2@37NeX@%P4u5Oy5k`lf(OC?nqVjZ1jVixx?0efQx0S3%!z zz`IQ1(rqk-AqYx0mkT;q@Iw+^(6JAx3ew?T1qKNetKfzJzk`S<*1Oz}N9z;r*wfLK z_fM}eac}A%uCEP&;f`JC?W_#xy0h(qrWPdn=D|gk&Zue`a5@!N3RA1`gC}h?av?gK7w5)o4td>{XOu@WVC-dJ`K-594+wD2 z$jXai6sC40AsnmrB!mwO1j;bQ-d9;oLLp_qBZC0Bij4WtRRpL4*HBd=eyUt4 zg4DR^*hQZ~&59A<7z_DJK-Un2@rJ{{pmk9AVv4I*G{}VrbmKJADC$25Y(1j|5Zb+-U(26f#(nY!luFHwW8!|A^l-Mg{ngml^ z2H7N9tH{pcFc@K*4HJta1;0WXGdO{5oof>E18(Ml2=Jg8m} z>8s8pd!ju$00rMb*8~79j z2Mva8O)70(ib)WYJRkK?K}T_68Mx%_wndtc|JH7bg)&65T2hEtKp$~=JVCUmC|~JJ zF>=FhwfI8W+Bpg~b`Ec>Cz;M}`zcVoKU1)1YB$wXYk;7pAe+0Yw082GQjIS#+?|6wc}s{YPsp{z1uV&f?gqpPk% z%0bvqn@K)zCi!tQ$l^3lUW9f9Uc>XYo}Nf3616ZCy|K9-`ptt`p9 zF0n+qSFBv59aA+ypOq@FR_QuCL+gmIPCOotC1yME)-k$`yPdu zydKkm|E3<}>cA>50ZAXS)yXvQ7S{>i_fBhNS>M@J-#9X1=&^uC!EiSmu{>U(k?yZY z?-?|Y3=zv6VbwG{1-QWZTmZn9!Ov7t@!%$)0w7C8pevisT=c|`hQR^_IV~kP5pO%R zPh1T1$a=93C(p9zQjsaHU{?qUpJQoIDMN>G?4-Q5;q;-$``&%nWftBjxZfTYcZI=Y z>SlpHA1Sy#$;B2^tiR9#c`yp2ncC5KrgvT4uZWdBz?)>(#o~9^!|}vB{P<-Ajdnc88xIRCIYa0-X8p~L0x0yZP&?B8 z8E&quU0r9nwaaETT>kKXeu%Pd&p6h8KmbGI1#4_?s$!bS1SBfO5@~;3pV&zQRBS0;3PoUDtUG3jLL4ZEwBaR`_XXs zMEFt9aV3XEU}ZeDVZ}^b1UU7L95&aWaSF-#4_9pCwz9Je-xIF>aokeNAVX<9!`8Bs z{m*8Kcmrgzo7VL+9L|zrX#FmM!%`P|*d!DxgZlK<5ySgz{!-z^W=pBRbENR$V=SsOJPG0a;#A#Ilq(8wvtoI9 z3Vj?qBZN~lS&Qws3yww=*TRVWTQ$08< z7Nt*zV|bj(9Z)%jarvSo2!N_Q4h<*Pm+fE~XeY39!1cC9HB1E0l}fvHB}pTAE~yqS zrc?|lC^d1_um!C6*z#&|UCth{e3%p!A`mQ2i{UN2t{S}Bhq_wac`-y#qPB35I|P>H zmReN}W9pTAQ~MS57q@AL7LS!?UiW0ZiD0mx7$!Kali4M&8Q$2;!4A#YOkpD zaC1l$b?B9qM{%xX7!HU;YBLizTJwd3Bd9j6gg@hO+0rf=F_62V&O>jD{Wix6}*?Ay(oinxy@OILn*QF_U_UCw3me^)H$uHoyDg zwXgay13I#>m_~m)0z3x3u+#{A`3vWXrc#GQtsX8wYWPhpgCa!l?8hRNRhR6LwtS0xDW)CL=Vo6=cmGPxT{|{A#cku)GJmA zmz|4|M(pg8T#j@5kW_*%9^2F6t?j|lQZq7;x3XydYlM3aLdTTok=7;@0IYq0DGI!w zA-8O_IWne|&ytB(KE6*<8_b@h7px*^Pu~x7WCJKIDHSO{@2!F+J`FCr0 z%TF;TOH%oSmvD%`=d(Z>-{AMaHZOM9xG8XhzZqSCnA57cZGNk8=Ejx|aou2l4TustMy3D?!U1v4c&kEhz7j@UNth6} z1Qv*a@}TIQJgw$9;3LF((TYwZATz+iX=9*aKbnyd&eEOTpn1)7w;G;g^SAV>Ib60N zoCYEqa!5KrNt<`rZ7}YIQpL;%(XkfDD`{NI5K0&Hx*jHlUUJPR zjs`SiTBtqFKBAj>lqASGVi@4KklOO@>;^b##crgo4_;(oB#aNM<@hs31ApHmP=*-7 zI&hbBl{Te0mGoD5eUCie1?fYa;StiPs2ofSP3yRSa(NlzmFx`g?Xp21y!7t4jpbJ2 zoq^zKiOPN~)#_rucXn@9GnvI^u$g2&27crWmS|9q2vsg=9E1_wwNS7?Rm%U67c}{h zK^DPEWRPdjqHxbkn$Ki=Qowa|_^cKZ1H5d-4B!U7L6~}(mg5~WnF76!DQGVR?OV`g z3y%aCl5{ursuq{`-3LyJ+{fAX;dDh8)+@;LxkccWdP6g)uj*IKO7q>X__FDFjaxMa zBq9at#gm${`uH;Z*x7}nP`~_3)-!mH+e;<^;(qvo+h_WYfx}??$oOLu+^|V-g&?3Q z+*l;`=Esi}qORc5fu_d*qu9PLUB&HfrP65RKpgdShY0wLr^TcvzNffphqN9i zeKe~NOif{ahCR**K?Adgt2mN?`*Ar^)ppgA<7`6>Tk{<2UCIPQ7nZnz90;HDNjzH^ zZf38FHw5R*fV2t5u*c;evQQ5k>(;{feLka+TGn4fnL7(NII#k#YKXF6;L@tL!Q^-~ zL`lSV5s3y4hdYb`L>((DY^!VqczmTYupq@;&h|}W1qxe3!7k?`zSgU2s9@}z2*eZo zkO&(Mh*jAbS`06Df`$E7>>xw3B?LTIB6I&Z%&xC==n#mmhLB(}a#*h7K@+OtV8*j& zGnj7@i7L)t-9pk0L=&qigB`C??iL=jqlKo;;ZWS$CG3Nqw6tNFD5edu8g|lhCm3q6Q=VoS_3zFut8TS2!)s?(PudJda)1=_ zhn}8U%CEyQ(WFuNVS7d`QMHgfBPLZH3_mx4I_f6bsfC&?r<@UWy(ye2fT7a)j&=s? ziEYSrd0_Cvc(z1jwq>u6Kh8R7pb(QVm3jxK27w>|+LI$qL{?gS$sKFl#)I$ev^<$D zSU7iH-I_xR2>TyQ14#Y;{RjCc1oFVbFnq%t#*>TxLYC@Xqkjd%s)h&h;th^^@X&aN zuX}7yj$u-<{RP-ng#eoLvJ`Jnz8=w&``qv3Csq<9{4mxoI_js|cmpM8I2zAw&o%T~ zv+!tA1HEh=D@)2@sgolT2C@!xMa3aNXjRcGKZ|BlT3#jxoLhML;vEfL96QlW9uA?( zWJe_uupz{|OSOv|u|Dn#AK1yGq~eAl9TKPY1ZBpSKs~ki(WT2_{oSL@z!1V@M$2;o z4{ysGYA8P5+|qWQ4^Rxh_rwU+i9NwEViP4!7GjRn9K@DqOA>JZ8FRdx{-R_0n1sm8vhV+;5k@rn*#R#e>xXAHOQo*x|L-| zgy$70W$S2p!EthDdL_lVA>^H5ts{$zS2hjaf~M^jdWE(thc(;T6*pVl6vie64=9$S za4wtiFS)`JG15M5xZMMRi-Qhj7>=1*y5@CC2c|XnRpkAqb2>le^CiqANlX-NG};R) z=1sI1k~{FsfZG=R-ea8Hq4hI!N&b$4Hu40`{4aT?6?0Zq!lG4sfl|Ec=9`kKaN;0d z-{{3GR}b&TOgtDMM!|{;MwSN=n-WLInO@livnjc<*yox>Fq@LY0N-7Dh1unDD);qiQM(tLgTtw^l1f$SdPj-BK*hB$pJk^`>EP0mtI zaoy1KcaZA04znrw9ivc(`Kr`JbSH+<;STEo&)A~WxVD>tl0Ky!F+6Ymmce-Z%?4V> zUVv?0$IEd`lhr@76+ynTscHZHhY+vtas1F|)|&4Rp3h|m=Vm-2ubAO$9!%3a$*K36 zy#D`Pji^t!*V(pH{^v~>cAmJoyG7L)NS$gMteEGg3??Glj{Y~N;z$nMro!J!mfxNC zKVSqv+N0~F&ijVV|1df9p#OLIi&A7*C`|}oN;6lB%BX61mMbB444kVp;LJM$`BNNN z5J4uxro{7Jd~5w!()HD8XrPy55PFXR49+CVX8MNalQcL66>{Dd#8LfML=)iqbtX^@ zaG3Q9dZ$Pfz5aOLgJljWzUxEkGn@%RJ{1Orw?#n_N6xk|_bz ze-yZ{j6z|yqJe}U-1er<9aTcz!Hj?)Rp-K8@Ti+iCyMb;a^-rZm5S(_mSD1-qmDRT z!luAbHH)tH&!t zj;Lv73a3GOG4^O>0_bUPh?Q11z~caFCK-6R2?i669PG@_PqC@Q`pWyU&fo>SsY3v~ z!m|t_{F5ze3`7}D9OAMHsRNHA$7;j2RLt6HC`Ga2qb&c%be;~4& zT(1OaJk8<1LqIXF^`~}-R^r4fl}5V;54hUIx&AOov)y4+8f+#{ z)7tqg4Ynhp8C~6p4Mm1Q)Ju6D5mAPXR8kH86l+}2rK8U=2h^+xT*QG31Wh3Q^fHly zafvJ6;Y3F*oN8CV&yp7=#)8?|)oPc!K|zWDtTp!tj`x9;WKZEi0-&|M?~a=dSjbcY zfg@&E^r>|kj|M+^VvSh1J}IEkci#balkPYA9Rl?`#ueGX(K@Y@p}aM zkLdd(`u>k$1UQFR+)`jr(ZuP+7Hxq`DPz7|t4hjGHB|V0zTiC>)kl5rw}ML&^>eCP z1*@|

@pQ^)|;l$)Y+sD8i-Syx`Hx6gcq+a5VV!@jLEI2avE`rSP+*s~*lnS)bXG z$A(j!@dt^6Ue$zj^foQ7LFO#nrA4<5pX5--W2jbObqMTp2;feK^efUqa?r)yaoOKY zvgeU3*nf2Kadi=poSp~}cnTjwBUe`Nf%AGgx4UFT28Lc#q#oU@f)mhuV)&^J8P#`g zAO#>Vr6$5qvTHZ9x01n}$}UEK@htha!T!A*IXfF_Voz>S4a7@_XY6)V@<7*S(qei! z*U>_F`n)#5@TrDca96$5>*;3Ys4CVM^RX$5XB>m_EWKTu=@UZFY%H01x_m9CYI8+{ zUP4dNM-M$uh2_f%k)G*arDt3QLzj&V7|x;yM36GVjf*T?$*N2OK^PxEDHa^8rWDkM z_ylgLuF&EV6wt$7K+Cry`QJ6e6X>$h-^=_qetGu0sb=?hb76T7iSMWY4FFR(c}lhc zbO18tG-%k}mk5Ri?-cPjlijCYMCpHq$E&17GNa`TNYTY`AyO#Lo^zyy&{7=ufy1Hq zyBK#6i7-tAWJo)OE86WA~ArSOPtRhh_rASrw;OC*q`@u4Z!@aU4mD8#==$CL_Fc z2$TN`PZGl+A<1l^3m#)cdZHxUJFUYxMQ$%k#;sW=VpC$%s_@`)JOaXV`n<<*Y? z7+@vlrOqz}Vku+2@vuwm5O^5!s8HV)8D!0ko-BJ^$g6U^OmWzcrN9<cZE{( zOEoW=x4!f!7gDDX{{DyMFx6e{!ZWnSD^OivQnomD-y9b4AAp6<@b5oxh$xgAM(Uu{ zaS@%<=7Re=Y;7wIJcQ{Ri?iC3B{F4n>aRta)DGnv3(a+GOU`O|7RvyRk@}A7PfrO8 z^%LI;7^r;@R5KLZh)@q?q^}3k3z!cvYgG;=%TkPpRv-@@tPLLATZBBQT5mi+gEwoi zMvIf12M%f+R#ttPda5s7Mg3uF7kx^_JXlmGg$b&oKweE0KvhEh_RBBsn;$4F=)R~< zj`_=hj&Zp#gwQ~pLUFPf(fvs+7efZle{&qZDf5apvczD9$dveVSp?EmH-xq8IIICC{!#7 zv*P$fh)>C<&L*eTgaJyul2z>$0(4*(9>9do2YGd4IWBq2x*AtuI*(|SWaJ^qLGS(j zT<0&v6sN#=SIC1#$<)28H3XtpbfdHBjL0=CrBihaSPQLgEu|K! z(tIfpRbv5-JfN0I5y8%;(`wOHupkGd@b#{SR~33808_O{p)@m6B`i}Ec7)|TQ7 zd;oSmAAtRy4-kIO2ME*i0TA|D)AIq`@A&}X_k4(OJs-eL&j&!i=L3Y_xd9^X`2gwn ze1K3QHPdUh=L2%D=L7g9*8XPMUzE5c5=?tp{4#JUZA$L*2{Q2b1aQYE0AnO_*hPi8 zDCZd{#bgF-SpK)r4IY7K08~LV^zaNW+zbnW^PPu*7Jnktp5qZuG|U6U%L~eUA+^GU855Wd)}?m z3EC{k3BoSP3C1nT3CdrV6Qo_36O3D$6I8GYCs@4>CvdY8CkQJ|6O1QM6Pyv93Bn1_ z6eSB)0(NpKLCGAoYf^&Nk|u#$S(9LdA%q8aa7yRUGsB-nk34w&Fs$b-%?fjF z>EUj!WvCFrVhbubU2depaTgE&QOZmSoxJ}xUl!kGqipbV+EvWeJ{T5{O zjmec>8t87iYBw~ICE<9;a*~z|$o?19!wKG+&E?xgy`QD7S}cv#2tzxIzNpP*X1ZiR#{fYwwy4q=HomjI=;&jVLHJ&REj)EDFm4<6vPSA z$!zIJMz>g)nb)Mo>)cfqUC^CwR^)M`7jsycWGn!se7TY4MuS7sR*~f%l5A>0p{77u z&(Bb7#g5BvchQL5ip_tlAh2MRA8lxkkZvp1EQ2{OmlmMmT>Ze68cs<=u@yU~*md@q zCE1>#m}_q(R1JLSmg|R%@Xw^!DmzKXtxb2YS(2?7dircQWG!$F0yDRVt>iTxHB-=AYM3W7(QCS{J(?WN zRxFKyvYVly*ovLQWI>&%WkF)(8l5AoqtxkK|`i0j} zY{l+NJ$lO)O)?{PJ2u7uxrUb^*@~f=owtx^QoV-3dPR-8=)btr&|D3=e0~bMY2eEjOtKdHSug;vv>;gWGN|I#N~l^o%IC zVlT$p?xqp+R*WcnwIhjid!o*1f`5kD`gy4tl4vWY82A{f(+xHDsT|w<7DXzWPayV! zd_%yue5Q}4yBppkTDSG2#^95}2UtCPxF&yRRqY%~mSn3I$WX7z-ZR~H=I>}WRopTB){1w(D<$so+xa#z;yEF>#O0q_1#H4G+nmbS#7)EKTapHrLd}o_ue`(w&NSvvf3Du{5U~owe2kTQS=p zBp^Z@n>7Q5Y#d>}Z>5Rdv21sHIGU|k%8I#uuVzWMVu+Jj#>b)F)m=!BXe*}Vw!V;t zBF_#+SlDovkxfd?m(Go)G`T)#URxEKB=Y%2RxfJc>+KhYVk>s*S#4jc(3~EZ8Q6Sj znzF5@FNhTvSmP0SM!{iqH}~88$>y*_MyZff_n>tn0y#HbM>Rt0GgNavllBP?5x9Go zw3W+7|LS1yievq&ul)|JTu)qw^P28xOS(^6(j9I|C!WQ2)pPZhvU}wVB~&+ED4@FO z!eft4x}UbI#^>$Ge%y|1%f8sME4J*3Ejwb{e(0zv2dvrZcaZ45NVZ_EkH`dX9E4|D zAzDn<8(0kPXtE6rpdpvUrjnw)AsW<24QYL#;FdjJkMw1MA(OMPE~F6Ig>EgCS!sf6 zm@dOd+@0Xd7E3Hy#^Xm70nvE)3P#<2DDk);Ou>QIKmxXL0Tnre4&V(LNu%$+m?Qxz zN+!o-FyRy4R71LynM$og~`D114Tzq7hqWWbtu_yo5PJTirwJDr$( zHYO$dD^B{#m|hU&?Xam9a9H1j&u4&3A8|r@DY?e5^#!musoA{y*%TVd7?q|^bxSej z7^{6pI--(PuMFvd7YsaZ4CmG{N+cs4nJ&n@cttd{iyC(y@Me#MwOohJH_`2CiMX_0 zK@d`UTz&5&vOoS7FjtwFEUxAmk}nd;#F0pu5kFquBsE}p3>XiSa-U;!9K*kkPjIeG zTsKt*J_m=e6Hk^d9E4G2^jOzWJ0VTR(y(rx8n8c`Y(6UPkC}hQ)5j!?FaQXedY!Pn26}2@tMGd2BZtsU05V~K(e)w;f(qJcMd|>1+S1rP<;uWRx z`{Dy`al)TT`AdW#&q<>L5i>#iFQ^=bE{sb6l=NDEDvGuQKc|@vs?*{L_+MOD5k^p z1iU)^wPe_j?rgwh1Ic2AC&s%9F)Q9488{U2h&pMe$~YV0;q=6J!sH5G7xzr>nf7VQ zMVaKOfS1Y_E6UGn{`JMhkYf}9gvAPrB_RxtGvm<|X^1e8#R5_+Oy@Gj?I5mNUFfFd zD>+xNRKY7o`y*~edoN=s;wz=f!L&T=;w< zZ#^qEl#p)2lQxRc`ueJ;2$efnSU$SBonYibyuTe!E3Bw-tKq(Ajqq^ARBRz(YTUx=1{C~6*=NV&ACV*1b}N~Cb&jGV<#mf%?-`g3OS-TA4M-T0ew zf+o%Oi7HgC!4yU(%@NFnYc5yuNo{e7JsI*A6OUbukQ=jM$H_ACZE*fMY81K*W<)QK zJ8u_V>lb1wPOPF5<|BcRfxHt%G0JRbmwey%uBqWNSKdvD(<_p!*c;((1?C;4A(*Km z@XqeN$U|spf5FGC6MJ2J$NT7=Xy7!>VR8!sJ z+H$rf^rn$YMkj?D4CeW@P`hxrWNK6}ImPlt+W<8!{(j?9f@e)JLR^Abf!*L7RqcYeO9TM0xm$7uaM4gk zl0(vE6Pkwd9%h^;)H0Vc0tocA>FhFfZ#udH1h>j-aR#!xQ+2J5h4 z!S|Oe3!H031>;ed28GGBCLNKxDh8t|(!0HWL%2+nyGzThps7`bxJCHprG5>%UbPb2 z(rNlV^{B1J@9b7gp$Y(-aL{7`3Tx8|Ro1X=qx4Tj)bGtFgCYl~%wy2@qnxq=xS+|R{Gq?=2{mN4D! zh6h|zM6g>?>5Zpz@IRj7#xa8zU4~tAucdTK6Ao>cQ$X2YJw{R?%g~T%o-N&a5I49x zV&}pBb}>71bh6;&qFBbnQT&|^NxUdL8z@zHo()7noSzM}Cf3jfG82ty16j2xh9}!8 zS}pNX16Gp+Did3c)CBiu{pg0Nmd$~BF~dzXW#f=v{PWKK(j!H_WtA!=h+3;CM4`Ga zn&%N>2z#K58s-jqNf|mkNx*<|?WIpOzzT6YO9(0-{R z4e2lJF7CdO6>bG23be|ITT_WOx%}s3{EY!s2)4X43GEh$^oMPA#QZ|i_ zWUgP_5q>}84G&_Cft^2i=%7GI!(TE|e|3+?U~PXLoj?Z?#)6e6Ms68d5A?X?D9r(@ z7@ixbp9$mhXjDmf$a^n)D-C2ET1lo1v#20#(Wm9Kctbh`x2$HR zmsCF6<>=#gg_+if6^3?_-I5>)xrX-e;Yo)E15|MKoqy{45Y;dfX^VH8iAaP2y)P2xd#Fi0~FS?g?1#n4J(4N(Puj zj~r+L8;Ok?K(N!EVOyf#{qts%h9EM^aoIxG#NJJVin4`_Z6Ri`71J;h0BFCF3|FfW z-%@WcHQ8`de=WG^HN~~11@Pfb4p0rZIY1ZznB+Dc1Ag^~joL&8(A%FQvXi@S4uYWy z6#$~W!1_`T+nX8@DkR2pH;u)7|9phv9{=*65#;>(ID*{W-ksbGB4EFNc8HS`UD{bW zqY)TeZj1?2gT)G^8r$zt`M8?gRSZb?b6GCF%@# zI*z)%qcipDy-rKm!F~!mIt*cIE<`XcP$5WVp+uCKn{u5p`s)Tq{EgF1yu`MLarm-3B4|tf#c*w0L@J?-18q2?G!Kbv1!$VjbeC zLbO}c-qh@|q(kfUXQ&6{7`!j3E>g)f$^J$F_D3Go8o*?V?)zbr8uJzPjp0zxagM_SR?7n* zcB%jE+7`&ae2i;QU?9q8eoK&eRj#~x0Ya5)#mm~Jy&xX}wx9ToTfgW-Cvhgj1>~~V zpTjSR?T?_rXLB9|I98J(w>`h&eY3LRb8LO3n^@lR@|nq35mSpjN9YEB5tzUQ67q|@ zM9DQN7EnZV?^>3RHSGp6Ph1nCoA18K=_wq#O=@HmHxTF`*BfZC9vwndzLauCVCJy~ zI9BZ|gsNpc<2-qApHRZ)vRs9;ax&y}k;TlFbcz7K(?FC9q#w*f0bSJ-PFtOJ8iYYTv5WyH@$;B(iZ zSk+??B@njTN{n!?XU5U2oKX7@_-SKnVO09Nk?6&schFSvVaQWqd;U`>2nxkb8# zlxRwMQ_+yMZ|&gg9Tyd`5*Y9bhXSK|_Ao+x3j>36A3Twze&fp`@Gu}w10H;xtmRl2 zmBUhriW`E^>geSVCZ`dU5E-yMe3XHoeSbofKFGfe?pi$qlu3%QPz~pm8w98**E}JW zyE1M#2rcw%uN#;ep}$P)j4JGJpRfQr2%2gd%u3PSaL^BDCM33mvPFVjhN~oGjJHg{ z1!xj2v5<^Qp0V(iRg<@bE73r0ZPj8cO81!FqqY_DB)cK`~A`WoVcGe z8RG6+Q$IjcSkeULs!r`ezz-wzq~%30D%kidm1e?;Ho$snX~`7BK3MxE(D6MvBwy&0 z3!4Z-5PFH%fCRW=37SV3x^?)C<->mS&l ztx+egS1zA+SuX}pCDzR8h>MY&59vf$E~lf`*Fh%3;1k6D21tG4;AH~;H&bv0r0K;U zaHvi_oL%|#r(zHQV0N5+<=h@Su|SU;tnQ-|I&a!MAZHv2_Qt~!Dg*9#)Q$vA(=4e4 z*+eS3xYQFbb-qcd!`10<&^=LOyfwY zR-)uun9^3M_gWAo83Fa|9KO4rFo!zs4Q2Q(x{fViD-#2l$!h|I2wF|NYt-Ox3s@Lj zVKo#^kG2pRbW^?}=38$2$pMd7*-d_w>h=TUWQd0_hR+Y-+T-9Tyro9jJ(1H)90rDf z<-^~2;LhYC0KRx<08&Z!^*DLKEmiwXV_$wER4vCS<_51KT+R~TWB4Q>;A5IzzE9nV5& zN^8-W3)iCrHE`YcKoBd~a(h}DLid)-U#^dRgQ3ZG{K^-rZ4Tfz;$r|l4C_3$5v^xa z0fb`W1TEI4tFn1q%ly{NQB6h{(i2iW2ttk=#yT1E1qcMTtm@Za_m5uqH!YKA42& zrKp+qe;N?5S2B5{vgW%vH1q$R~KSLG(FEFc~po<#*(4es>VlaCE2xvHmztet# zA6CopXIyH*hzdc)aEQ&gq~;MOo`Z1~WBG(NhQ?8`Jkzv3sB1NG6r{vy8NK5m=+Iko zuE+4AwFKok5ft>|-XLc5*j_vHHJ-M?GeR!w7%^{QfLTB(uGl_}F zve)p3fm@n{JMALEDXF{$3m)i2^=g@ZK7(g(Jldlwsn0si!y2v~kz%9rU1b^EIj(oE{&yDNcWnF54(h7d zcMN`Wc>C+h&ZXYf%0hp0)%tDWpsoNo^uUcM_kBE?7B0`@Cq!U14Sx*Rc8Jen{_qtq z^3;>*+v3Sf*xImr1y!#a4-MWBr4GAsd62BQq19AkIEm@ zwg^(3EgDuQMdMfXq*!6wC$!T??9;tkpF9jm~2?h|Lo6|`8_j3;l{+2fepCct<7a9z!7zff-tTEgRli*k66*rhrx5g4aQwV#++aJ!Lg?yty22Z^Z(cTMlQ)#MWB8n*rCOhO`i8x}tJ>M}sj3$q z;G(RXiQhCAa0A8g^xNYC_7pz}mc!+fE8zt;>uy9{tp3EE)1|B8#cKX1-UxiSsG(rm zieIdn+3NYp0k9XgNc^6x+_=Ce0%bnj*YHK1yt#}4U(IVbGQSpFsU4RRj#jVkvue=x zbC(=fRjkACzda z&G7RRHdEeL{iiqCe|}nxaDUP3r>nxX?-jb$HSblqz*fg{!hyh}8^iQIDw>C54=sQ% z9-#He-{5lLv3{e7u%y?;Q}HLpfCqTSD0j8E#`t=}|8BxwLyz;j6yFs}i_MJO9Z2=9!53#A_wgRxq)LnOM6p1Vr==1a8pbku5n=P z%Ov=Nzz7-2DcD6G21WI7wQ^Me%ys|Gvn$384xC)y-n>=V$IK@WcPkj?SLMT3h~9}U z)9u6;-nY{S7{9y`c{?3Fd|hFY3YG>!FPB)joMa>D1|A|$oX(H_@F7N2(2y7)E-tPh zAnVtYVB|3=yihur4pz-`RDy4Blc$wy@Y|;H5>v}{$32T@`Sc+e zAql-!>K8bXfVA;es6GUcFTe2p;x}x+8jbuuh6!O#rybe=Ok?z6495g^-%&^Ov4o>1 zAhG>K^;?ats7u6w97x*!+q7O*4;ba%n%l=ZUAQ{JVp-6JZ;FC%XdB+pmT~VofS&`u zJ_P(ydF%Y3c=oaz6f+!cIPS1dyLt||(m4%bP)=79*RRONUkC8%B*CD1Ed7odV2Q+} zb&B4gYG4BJvZ|M^slIVS`D^?y9_wGQJUy@ea(VsAN1R;ZU(w%~&+wylB>x3_y(g#s z%VB;)6&{Pfu^RMo9SDJ9OjF3ij1M@^g&EnvcnMu^Tnz}C7S`#dzk3pIJYE~K>7Xbg zSmYzzSxhpb%~d=L90Pb2ez~p@q+=kTt}pm`9VESWvf~`cXq_cJU2#1%lb}#pBE)GM zJVfxekMcRGOPI^#m`V&#@9b`sdv(6C?e?Sz3g&!X6oE00ep()-fxs*+hFI_0Qj5La zAn-QN8*SL;d(P7&^U>mV=#%{t^DlPq^YXyLV0C^DGNKm?EIz~IB~E<|9|HSuu8HB} z;e0tgIs{7G%?vp*;z3}*SHmnz?lJDC)vQ|H$Pu?iJTNo+rTlmeW9`iAeZs0>Y4Q8) z_~Q8TCV*Vt{BnF1KyGf&;A>`>AQiku?I&!WwBWklq#YGf2+`Rge{bisk$z0EpqM~= zvmMRjZm(NIxb{U2-G@UGSCk*^yMDPKc`77)@r+m70t{!KPSc+ryU4;PRv@TnuF~f1IIHPqq z!A$X%IW$T-FC;iQb3fRZv)w%M=rE5|4rz<}btKwcnq1c0cwQnCk-}$BbOCZP@2G29RhJeb%q;9*iViq!brh`O1K~Lr=vB68cyhU zO+)@oeIma*X)y1wStc)ascIdew&Uxd3AQ#-uHZd^O~EF^9@}3$MF(}*6?vK)<@=Xp6mo*C?z)&@chp6vGLw8iZ$q@V z?~!RCi)%nQ*~sJ|#|=5@?5d|pW=@b76Gqsaj@$wz`J}$D};p`OA8_K_0 zybO^h&|1s~*qT@0drEgoxKdH&*+~z_WMGzZu>>gcMGd2HHw!s~S%bf*)y;-(4jVFn z16}>}EB?xT%|{D|S_F+TIsF!B{rA{xp|>RGXVGX=d?n!U5~3!rdh- zZrlUI!wn{`li7mn!tbgB7`MURm{!#0Ht&6Mf}eU8q~ zJWr7DARjwNiy9;3H6!h12X26D<6%wgV(}0D13wJ7)eUD0Gfdl?;^ucunm;@s1L-JO z_mDRC)+K2`X2xXzxmsZKn)Z(>FuZ(>~=Hd2tuMWM}28sUs<;$ zlTgg^Fsoi?P2qfIH`vW2#it-fz$}wtmd3oR2wPb9qElFuF-X`Oc_n9}=^qeZA(mz2-ep-^tTSGk-k2ZSej`mP z%(LZ6Buro;T$$SJ4Pu#m|-$|)jQLUDfISWkE~R=&oSWkrGF={;GRGx+K)a7*4a zMnDAp55{3ec%VtBZm4?x1NTOjJuBaBMYFWZDiiEvl$h?rFKYP20{;H{A4sagA;GYQ z3pnGNg^3`cY7Lu^x_S*`9d~pzDnxrbbL5DE&+B;ehAknl`f}rjr1apXsfk(J`s^w= zt-9IWAy~kG`}}`PyV~A1ZWx@OvX5(#xwVr9!M<(7fDGHZp(wBcMqtEAoEmd&!>Jnt z!~Xjok`hIU)Y3CWZDP7)g zf(NPj=qV{%3^6vaSbk#iEV)^oqMlrpN1`GDm3!UZ-8=yuTc2iG@8lj9TT0u*APnWY z;RVd}p1z6eg7lF!L3ji$pAv>gc5G~Yhu9YQ48A5_I5`k6JQ@-G^x|5h4@4-Ly;Euh zmRxa%@@Wjh7&^7xNI-GwC?d48$ij5$`f_b`C~2j78qAm_!L5gsf-<+m_-Tj6Jnoan6Q(b%kjr^8OT!yq zI}RjeTdu9h8D#^bAn+5u`o!5NW(Z6{R34YC;dZ%ro~0&C1_Gwid`4ladNYGRX^Nnx zDUp6@hWMxfhqIb0`N&wxHuVAN&1SbdIN`tm$pnP&pVlk^UZFn+|_ctnp(3NMVp0ngO~dm9c?XaIP#*h z8Xa44w;_|se{Syi2jL+Zw)nctRb~nhLD-nAJVKCZp@+vHDi_yyAa}Z4Frj zXv>ZFBy^ytq2}36AGAjd6$mGD~kjrD7AzS{r9#owJhC^|fdPygPUq%bjhJqRZ zE#zrY$&kt6bum{1XN62HFcva-G$>@Naix&O0aPKEM^i&K5A=p?&fE}kF<@uR4Ixtl zKZiWL15QI-$UtsZNHf>{o?JNlcXSM&Aoh+{0ai4^I*#A;*XKxwE3?be7dMS4n*Y&p zNpxUWoOveEiHcp{u{wEs|A_zx?+JyYC(^EoSz9-AE8HyB3&t~t`?s0!Jj7GWe^kHm zp-K$+^eXa9^f-wA3|9?X&QMUVY6~_QV5nE6IES%n%cIK^7|ci|WFPXh21bYl-d&M1 zN0v~yIW@Q*jSU~wNK>{ABJSB0Q~WSzlNsPnvN@>;X9o#a%euySug1keLM!UBS7ZG8 zFr^hX?mlCoxH{d387t*#`MOqsC5;@F%OIQia?^T)6W|td0MAPWXvoK#=2PHQgj}8Am<;%JKWs)) z>n<0p_fql=eDO!@7(UuEPx3?=~o0@}wX>mnCG9z+Nmn)S;njp!l7P^saX4DFj zdWt;xJ4b#mDdj89W;nZuqjVFw!b* Yw|=PZDLL=S2v8zF6Z9|tKcuUF0Z@j8lK=n! literal 0 HcmV?d00001 diff --git a/docs/spec/unsupported-folder-refusal-plan.md b/docs/spec/unsupported-folder-refusal-plan.md index d719d92d..de834e96 100644 --- a/docs/spec/unsupported-folder-refusal-plan.md +++ b/docs/spec/unsupported-folder-refusal-plan.md @@ -98,10 +98,9 @@ Two independent critiques landed against v1: - **Our own docs say the same.** [status-conditions-guide.md:25-26](status-conditions-guide.md#L25-L26): *"Always have a summary condition. `Ready` for long-running objects… This is what operators and scripts will `kubectl wait` on,"* with `Ready` glossed as *"summary — True when everything is - healthy."* The installed `k8s-crd-design-review` skill agrees - ([conditions-and-status.md:13-24](../../.agents/skills/k8s-crd-design-review/references/conditions-and-status.md#L13-L24)): - one high-signal **summary** `Ready`, and *"prefer Conditions over state-machine style `status.phase` - for new APIs."* + healthy."* The installed `k8s-crd-design-review` skill agrees, in its + `conditions-and-status` reference: one high-signal **summary** `Ready`, and *"prefer Conditions + over state-machine style `status.phase` for new APIs."* v1 made `Ready` control-plane-only and parked the aggregate health in `status.phase` (`Degraded`) — which is exactly the `phase`-as-aggregate pattern the skill tells us to avoid, and it makes @@ -141,9 +140,8 @@ This directly fixes both critiques: ### 3.3 The model kstatus pushes us to: two layers -The updated `k8s-crd-design-review` skill now carries a -[`kstatus-readiness.md`](../../.agents/skills/k8s-crd-design-review/references/kstatus-readiness.md) -reference, and it changes the target shape. The point of kstatus +The updated `k8s-crd-design-review` skill now carries a `kstatus-readiness` reference, and it +changes the target shape. The point of kstatus (`sigs.k8s.io/cli-utils/pkg/kstatus/status`) is that **generic tooling** — Flux health polling, Argo CD health checks, `helm --wait` (HIP-0022), `kubectl wait` — reads a small, fixed condition vocabulary to answer one question: *is this object done, still progressing, or blocked?* Our highly-technical target diff --git a/hack/doccheck/main.go b/hack/doccheck/main.go index 84d8a11f..326036a1 100644 --- a/hack/doccheck/main.go +++ b/hack/doccheck/main.go @@ -32,6 +32,13 @@ // Only git-tracked files are scanned, so gitignored scratch notes and the local // upstream checkouts under external-sources/ are out of scope for free. // +// A reference must resolve to a git-tracked file or directory, not merely to +// something on disk. Resolving against the filesystem would make this check pass on +// the author's machine and fail in CI: a link into a gitignored path — `.agents/`, +// a local scratch file, an untracked upstream checkout — exists locally and does not +// exist in a fresh clone. That is precisely the reference this check must catch, so +// existence is decided by `git ls-files`, never by os.Stat. +// // Usage: // // doccheck [-root DIR] @@ -47,6 +54,7 @@ import ( "go/token" "os" "os/exec" + gopath "path" "path/filepath" "regexp" "sort" @@ -88,6 +96,8 @@ func main() { os.Exit(exitUsage) } + known := newTrackedSet(tracked) + var findings []finding var mdFiles, goFiles, textFiles int @@ -96,16 +106,16 @@ func main() { switch { case strings.HasSuffix(name, ".md"): mdFiles++ - findings = append(findings, checkMarkdown(abs, path)...) + findings = append(findings, checkMarkdown(abs, path, known)...) case strings.HasSuffix(name, ".go"): goFiles++ - findings = append(findings, checkGoComments(abs, path)...) + findings = append(findings, checkGoComments(abs, path, known)...) case strings.HasSuffix(name, ".yml"), strings.HasSuffix(name, ".yaml"): textFiles++ - findings = append(findings, checkTextCitations(abs, path, "yaml")...) + findings = append(findings, checkTextCitations(abs, path, "yaml", known)...) case strings.HasSuffix(name, ".sh"): textFiles++ - findings = append(findings, checkTextCitations(abs, path, "shell")...) + findings = append(findings, checkTextCitations(abs, path, "shell", known)...) } } @@ -151,7 +161,7 @@ func trackedFiles(ctx context.Context, root string) ([]string, error) { // checkMarkdown resolves every relative link in a Markdown file against the file's // own directory. http(s), mailto and pure-anchor links are not our business. -func checkMarkdown(root, path string) []finding { +func checkMarkdown(root, path string, known map[string]bool) []finding { data, err := os.ReadFile(path) if err != nil { return nil @@ -172,7 +182,7 @@ func checkMarkdown(root, path string) []finding { if target == "" { continue } - if _, err := os.Stat(filepath.Join(dir, target)); err != nil { + if !resolves(root, known, filepath.Join(dir, target)) { out = append(out, finding{ file: rel(root, path), line: i + 1, @@ -187,7 +197,7 @@ func checkMarkdown(root, path string) []finding { // checkGoComments extracts docs/**.md citations from comments only. String // literals are ignored on purpose — see the package doc. -func checkGoComments(root, path string) []finding { +func checkGoComments(root, path string, known map[string]bool) []finding { fset := token.NewFileSet() file, err := parser.ParseFile(fset, path, nil, parser.ParseComments) if err != nil { @@ -199,7 +209,7 @@ func checkGoComments(root, path string) []finding { for _, group := range file.Comments { for _, c := range group.List { for _, target := range citationsIn(c.Text) { - if _, err := os.Stat(filepath.Join(root, target)); err != nil { + if !resolves(root, known, filepath.Join(root, target)) { out = append(out, finding{ file: rel(root, path), line: fset.Position(c.Pos()).Line, @@ -235,7 +245,7 @@ func citationsIn(text string) []string { // checkTextCitations resolves docs/**.md citations in a file with no parser worth // carrying — YAML and shell, where these paths live in comments. kind names the // surface so the report says which one broke. -func checkTextCitations(root, path, kind string) []finding { +func checkTextCitations(root, path, kind string, known map[string]bool) []finding { data, err := os.ReadFile(path) if err != nil { return nil @@ -244,7 +254,7 @@ func checkTextCitations(root, path, kind string) []finding { var out []finding for i, line := range strings.Split(string(data), "\n") { for _, target := range citationsIn(line) { - if _, err := os.Stat(filepath.Join(root, target)); err != nil { + if !resolves(root, known, filepath.Join(root, target)) { out = append(out, finding{ file: rel(root, path), line: i + 1, @@ -257,6 +267,38 @@ func checkTextCitations(root, path, kind string) []finding { return out } +// newTrackedSet is the set of repo-relative paths git tracks, plus every directory +// implied by them (git lists files, but a link may legitimately point at a folder). +func newTrackedSet(tracked []string) map[string]bool { + // Sized for the files alone; the implied directories grow it a little. + known := make(map[string]bool, len(tracked)) + for _, name := range tracked { + name = filepath.ToSlash(name) + known[name] = true + for dir := gopath.Dir(name); dir != "." && dir != "/"; dir = gopath.Dir(dir) { + known[dir] = true + } + } + return known +} + +// resolves reports whether abs — an absolute path a reference pointed at — names a +// git-tracked file or directory. A path that escapes the repository never resolves. +func resolves(root string, known map[string]bool, abs string) bool { + r, err := filepath.Rel(root, abs) + if err != nil { + return false + } + r = filepath.ToSlash(r) + if r == "." { + return true + } + if r == ".." || strings.HasPrefix(r, "../") { + return false + } + return known[r] +} + func isExternal(target string) bool { return strings.HasPrefix(target, "http://") || strings.HasPrefix(target, "https://") || diff --git a/hack/doccheck/main_test.go b/hack/doccheck/main_test.go index 3e5d516b..6f554641 100644 --- a/hack/doccheck/main_test.go +++ b/hack/doccheck/main_test.go @@ -25,6 +25,12 @@ func write(t *testing.T, dir, name, content string) string { return path } +// known builds the tracked-path set the checkers resolve against. The tests name +// exactly the files they created, which is what git would have listed for them. +func known(names ...string) map[string]bool { + return newTrackedSet(names) +} + func targets(findings []finding) []string { out := make([]string, 0, len(findings)) for _, f := range findings { @@ -63,7 +69,7 @@ func TestCheckMarkdown_ReportsOnlyUnresolvableRelativeLinks(t *testing.T) { [broken with anchor](also-gone.md#x) `) - got := targets(checkMarkdown(root, doc)) + got := targets(checkMarkdown(root, doc, known("docs/real.md", "docs/dir/nested.md", "docs/index.md"))) want := []string{"gone.md", "also-gone.md#x"} if len(got) != len(want) { @@ -80,7 +86,7 @@ func TestCheckMarkdown_ReportsRepoRelativePathAndLine(t *testing.T) { root := t.TempDir() doc := write(t, root, "docs/design/plan.md", "line one\n\n[broken](../nope.md)\n") - findings := checkMarkdown(root, doc) + findings := checkMarkdown(root, doc, known("docs/design/plan.md")) if len(findings) != 1 { t.Fatalf("want 1 finding, got %d", len(findings)) } @@ -99,7 +105,7 @@ func TestCheckMarkdown_ReportsRepoRelativePathAndLine(t *testing.T) { func TestCheckMarkdown_UnreadableFileIsNotAFinding(t *testing.T) { root := t.TempDir() - if got := checkMarkdown(root, filepath.Join(root, "absent.md")); got != nil { + if got := checkMarkdown(root, filepath.Join(root, "absent.md"), known()); got != nil { t.Errorf("a file that cannot be read must yield no findings, got %v", got) } } @@ -121,7 +127,7 @@ func doThing() string { } `) - got := targets(checkGoComments(root, src)) + got := targets(checkGoComments(root, src, known("docs/spec/real.md", "pkg/thing.go"))) // The path that resolves is absent from the findings, and the one in the string // literal is never considered at all. (Spelling that resolvable path out here @@ -150,7 +156,7 @@ func TestCheckGoComments_IgnoresDocsPathsInsideURLs(t *testing.T) { package thing `) - got := targets(checkGoComments(root, src)) + got := targets(checkGoComments(root, src, known("pkg/thing.go"))) if len(got) != 1 || got[0] != "docs/spec/gone.md" { t.Errorf("the URL must not be reported and the bare citation must be; got %v", got) } @@ -160,7 +166,7 @@ func TestCheckGoComments_UnparseableFileIsNotAFinding(t *testing.T) { root := t.TempDir() src := write(t, root, "broken.go", "this is not go source at all, and cites docs/spec/missing.md\n") - if got := checkGoComments(root, src); got != nil { + if got := checkGoComments(root, src, known("broken.go")); got != nil { t.Errorf("a file that does not parse is golangci-lint's problem, not ours; got %v", got) } } @@ -180,7 +186,7 @@ tasks: - echo docs/spec/also-missing.md `) - got := targets(checkTextCitations(root, yml, "yaml")) + got := targets(checkTextCitations(root, yml, "yaml", known("docs/spec/real.md", "Taskfile.yml"))) want := []string{"docs/design/moved.md", "docs/spec/also-missing.md"} if len(got) != len(want) { t.Fatalf("want %v, got %v", want, got) @@ -201,7 +207,7 @@ func TestCheckTextCitations_IgnoresDocsPathsInsideURLs(t *testing.T) { # but this one is a real citation: docs/spec/gone.md `) - got := targets(checkTextCitations(root, sh, "shell")) + got := targets(checkTextCitations(root, sh, "shell", known("hack/thing.sh"))) if len(got) != 1 || got[0] != "docs/spec/gone.md" { t.Errorf("the URL must not be reported and the bare path must be; got %v", got) } @@ -267,3 +273,30 @@ func TestRel_FallsBackToTheAbsolutePath(t *testing.T) { t.Errorf("want the path back unchanged, got %q", got) } } + +// The bug this guards: doccheck used to resolve targets with os.Stat, so a link into +// a gitignored path (.agents/, a scratch file, an untracked upstream checkout) existed +// on the author's machine and passed, then broke in CI's fresh clone. Existence is a +// question about the repository, not about this disk. +func TestCheckMarkdown_UntrackedTargetIsBroken(t *testing.T) { + root := t.TempDir() + // The target exists on disk but git does not track it. + write(t, root, ".agents/skills/notes.md", "# local only\n") + doc := write(t, root, "docs/plan.md", "[local only](../.agents/skills/notes.md)\n") + + got := targets(checkMarkdown(root, doc, known("docs/plan.md"))) + if len(got) != 1 || got[0] != "../.agents/skills/notes.md" { + t.Errorf("a link to an untracked file must be reported even though it exists on disk; got %v", got) + } +} + +// A link may legitimately point at a directory, which git ls-files never lists. +func TestCheckMarkdown_DirectoryTargetResolves(t *testing.T) { + root := t.TempDir() + write(t, root, "test/fixtures/corpus/a.yaml", "{}\n") + doc := write(t, root, "docs/plan.md", "[the corpus](../test/fixtures/corpus/)\n") + + if got := targets(checkMarkdown(root, doc, known("test/fixtures/corpus/a.yaml", "docs/plan.md"))); len(got) != 0 { + t.Errorf("a directory implied by a tracked file must resolve; got %v", got) + } +} From 0e51aee8a455891adec99a1d15822f9fd553398b Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Tue, 14 Jul 2026 05:11:46 +0000 Subject: [PATCH 21/28] fix(ci): the lint cache assertion contradicted the un-fingerprinted doc check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Second pre-existing failure on this branch, and the doccheck one was masking it: 63bbcf4 deliberately dropped `sources:` from lint-docs so it always runs, but the Lint job still asserts a second `task --dry lint` is *fully* cached. Those cannot both be true, so Lint went red the moment doccheck started passing. lint-docs is exempt on purpose: its real input is "every tracked .md, .go, .yml and .sh", which Task cannot express — an unrooted `**` walks external-sources/ and has OOM'd the host, and a hand-maintained list silently drifts out of sync with what doccheck scans. A stale "up to date" there means the check never runs. It costs ~0.2s, so it always runs. The assertion now exempts it and still fails on any other task re-running. Written with awk rather than `grep -qv`: the CI image ships ugrep as grep, and its -q -v returns 1 even when -c reports a selected line — the obvious spelling of this assertion would have silently passed whatever it was handed. Verified against the real dry-run plus negative and empty controls. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci.yml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7ac0ffcf..24f5e7ea 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -513,8 +513,20 @@ jobs: fi done - if grep -Eq "^task: \[[^]]+\]" "${cache_log}"; then - echo "Expected second task lint dry-run to be fully cached, but a command would run" >&2 + # lint-docs is exempt on purpose. It carries no `sources:` (see + # Taskfile-build.yml), because its real input is "every tracked .md, .go, + # .yml and .sh" — which Task cannot express: an unrooted `**` glob walks + # external-sources/ and has OOM'd the host, and a hand-maintained file list + # silently drifts out of sync with what doccheck scans. A stale "up to date" + # there means the check never runs, so it always runs. It costs ~0.2s. + # + # awk, not `grep -qv`: the CI image ships ugrep as grep, whose -q -v returns + # 1 even when -c reports a selected line. That would make this assertion + # silently pass whatever it was handed. + uncached="$(awk '/^task: \[/ && !/^task: \[lint-docs\]/' "${cache_log}")" + if [ -n "${uncached}" ]; then + echo "Expected second task lint dry-run to be fully cached apart from lint-docs, but these would run:" >&2 + printf '%s\n' "${uncached}" >&2 exit 1 fi ' From bbc53808469ec1f851e176bd2d9e7d67ed1806bc Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Tue, 14 Jul 2026 07:21:29 +0000 Subject: [PATCH 22/28] docs: distinguish planned support boundary --- docs/design/support-boundary/README.md | 25 ++++++------ .../support-boundary/support-contract.md | 39 +++++++++++-------- 2 files changed, 37 insertions(+), 27 deletions(-) diff --git a/docs/design/support-boundary/README.md b/docs/design/support-boundary/README.md index e17762be..5c08547e 100644 --- a/docs/design/support-boundary/README.md +++ b/docs/design/support-boundary/README.md @@ -4,7 +4,9 @@ > > **New here? Read [support-contract.md](support-contract.md) first** — it is the one > page that states what we support, what we refuse, and why. Every other doc in this -> folder *argues for* one of those verdicts. This README is the index and the summary. +> folder *argues for* one of those verdicts. This README separates shipped behaviour +> from the target boundary; the provenance and Helm-chart detection gates described +> below are not implemented yet. ## The folder, by topic @@ -43,14 +45,15 @@ need no cluster — see ## The governing rule -Every decision in this folder answers one question: +The target boundary answers one question: > **Does this live object have exactly one home in Git?** If yes, GitOps Reverser mirrors it and writes edits back to that home. If no, the object is expansion output, shared context, machine-written Git, or opaque content — and the -operator refuses or withholds it for a specific, named reason. That refusal is the -support contract, not a gap. +target operator behaviour is to refuse or withhold it for a specific, named reason. +The provenance gate required for controller-expanded objects is not implemented yet; +the current runtime can still mirror them after sanitization removes their evidence. ```mermaid flowchart LR @@ -169,12 +172,12 @@ with `WriteBoundaryRefused`. The expansion boundary is separate from the Kustomize boundary. A `HelmRelease`, `ApplicationSet`, `ResourceSet`, KRO graph, or Crossplane composition can itself be an -editable KRM document, but the objects it materialises are **not mirrored** unless they -have their own file home in Git. The derived-object gate cannot key on `ownerReference` -alone; measured Flux and Argo evidence shows it must be a provenance claim over live -objects, taken before sanitization +editable KRM document, but its materialised objects are **intended not to be mirrored** +unless they have their own file home in Git. That is not enforced yet: the derived-object +gate cannot key on `ownerReference` alone, and must instead be a provenance claim over +live objects taken before sanitization ([`../../facts/expansion-provenance-markers.md`](../../facts/expansion-provenance-markers.md)). -Helm charts are skipped as a unit, including `crds/`, once recognised by chart folder -structure. Reporting a chart's incidental `crds/` directory as "one supported folder" is -a report bug, not a capability. +Helm charts should be skipped as a unit, including `crds/`, once chart-folder detection +lands. Today `scan-repo` can report a chart's incidental `crds/` directory as "one +supported folder"; that known report bug is captured in the layout corpus. diff --git a/docs/design/support-boundary/support-contract.md b/docs/design/support-boundary/support-contract.md index 81ab3a3e..d2d06772 100644 --- a/docs/design/support-boundary/support-contract.md +++ b/docs/design/support-boundary/support-contract.md @@ -2,22 +2,29 @@ > **design** — the single statement of the boundary. Index: [`../../INDEX.md`](../../INDEX.md) > -> Status: the front door for this workstream. Captured 2026-07-11. -> Every other doc in this folder argues *for* one of the verdicts below; this page -> only states them. If a claim here and a claim there disagree, this page is wrong -> and should be fixed — the boundary has one home now. +> Status: the front door for the **target** boundary. Captured 2026-07-11. +> This page combines shipped behaviour with the design that must precede the rest +> of the boundary. Rows marked **planned** state the intended contract, not +> implemented behaviour; other rows describe the current runtime. If a claim here +> and a claim there disagree, this page is wrong and should be fixed — the boundary +> has one home now. ## The contract, in one sentence -> **GitOps Reverser edits the intent layer. It never edits the expansion layer.** +> **GitOps Reverser should edit the intent layer. It must never edit the expansion +> layer.** Every GitOps repository has an **intent layer** — the documents a human authored and committed — and an **expansion layer** — the objects a controller derived from them. We mirror and edit the intent layer, because that is the layer with a home in -Git and the layer a careful human would edit anyway. We refuse the expansion layer, -because expansion is a one-way function and its output has nowhere to go. +Git and the layer a careful human would edit anyway. The target boundary refuses the +expansion layer, because expansion is a one-way function and its output has nowhere to +go. -That refusal is **the operator's defensible support contract, not a gap.** +That refusal is **the operator's defensible support contract, not a gap** — but the +live-object provenance gate that enforces it is not implemented yet. In particular, +the runtime currently does not distinguish controller-expanded objects before +sanitization. See [expansion-boundary-and-corpus-organisation.md](expansion-boundary-and-corpus-organisation.md). ## The three questions we ask @@ -37,13 +44,13 @@ templates, and multi-input ResourceSet templates alike. It is specified once, in [gittarget-granularity-and-cross-environment-edits.md §1](gittarget-granularity-and-cross-environment-edits.md) (the two-layer write boundary, L1/L2); everywhere else it is quoted, not redefined. -## The five verdicts +## The target verdicts | Verdict | Meaning | |---|---| | **Editable** | We mirror it and write edits back to its file. | | **Read-only context** | We read it to understand the folder; we never write it. | -| **Not mirrored** | It exists live, but a controller synthesised it and Git has no home for it. | +| **Not mirrored** | It exists live, but a controller synthesised it and Git has no home for it. This needs the planned provenance gate. | | **Refused** | The folder cannot be written safely. We say why, and fail the target. | | **Write-only** | We can describe and replace it, but never read it (SOPS). | @@ -53,18 +60,18 @@ templates, and multi-input ResourceSet templates alike. It is specified once, in |---|---|---|---| | Plain KRM folder | intent | **Editable** | the files *are* the objects — the first-class target | | Argo CD `Application` (hand-written) | intent | **Editable** | ordinary KRM | -| Argo CD `Application` generated by an `ApplicationSet` | expansion | **Not mirrored** | carries an `ownerReference`; no home file | +| Argo CD `Application` generated by an `ApplicationSet` | expansion | **Planned: not mirrored** | carries an `ownerReference`; no home file | | Argo CD `ApplicationSet` (the CR) | intent | **Editable as a document** | but its `template` has fan-in N — see below | | App-of-apps root `Application` | intent | Editable, flagged **cluster entry point** | not an onboarding answer | | Flux `Kustomization`, `GitRepository`, `OCIRepository`, `HelmRepository` | intent | **Editable** | ordinary KRM | | Flux `HelmRelease` | intent | **Editable** | shipped; an ordinary KRM document like any other | -| Objects the helm-controller renders from it | expansion | **Not mirrored** | no home file | +| Objects the helm-controller renders from it | expansion | **Planned: not mirrored** | no home file | | flux-operator `ResourceSet` (the CR) | intent | **Editable as a document** | `spec.inputs` is the supported edit surface | -| Objects a `ResourceSet` expands | expansion | **Not mirrored** | `spec.resources` × inputs; no home file | +| Objects a `ResourceSet` expands | expansion | **Planned: not mirrored** | `spec.resources` × inputs; no home file | | flux-operator `ResourceSetInputProvider` | intent | **Editable** | but `status.exportedInputs` is live-only and unwritable | | flux-operator `FluxInstance` | intent | Editable, flagged **cluster entry point** | it manages Flux itself | | KRO `ResourceGraphDefinition`, Crossplane `Composition` + claims | intent | **Editable** | ordinary KRM | -| Objects they expand | expansion | **Not mirrored** | no home file | +| Objects they expand | expansion | **Planned: not mirrored** | no home file | ## Rendering @@ -75,7 +82,7 @@ templates, and multi-input ResourceSet templates alike. It is specified once, in | kustomize base shared by >1 overlay, edited in place | **Refused** | fan-in > 1 | | kustomize `patches*`, generators, `components`, `namePrefix`/`nameSuffix`, remote bases | **Refused** | non-invertible; the only safe route would be patches the operator authored itself | | kustomize `helmCharts:` (inflation) | **Refused** | we never render a chart | -| A Helm chart (`Chart.yaml` + `templates/` + `values.yaml` + `crds/`) | **Skipped as a unit** | detected by folder structure and reported as a `helm-chart` layout, not as silence plus an incidental `crds/` | +| A Helm chart (`Chart.yaml` + `templates/` + `values.yaml` + `crds/`) | **Planned: skipped as a unit** | this needs chart-folder detection; today `scan-repo` can report an incidental `crds/` directory as accepted | | Helm knobs on a `HelmRelease` / `Application` (chart version, inline values, parameters) | **Editable** | the Helm surface people actually use — see below | | Free-standing Helm values file (`values/production.yaml`) | **Refused today** | not KRM; a `ValuesFile` projection is proposed | | CI-rendered `rendered/` output | **Refused** | the next render destroys the edit | @@ -89,7 +96,7 @@ templates, and multi-input ResourceSet templates alike. It is specified once, in | SOPS `Secret` | **Write-only** | not schema-conformant; the `mac` binds the whole document | | `SealedSecret` | **Editable** | ordinary KRM; each value sealed independently | | `ExternalSecret` | **Editable** | ordinary KRM; the value simply lives elsewhere | -| `Secret` derived by ESO / sealed-secrets | expansion → **Not mirrored** | carries an `ownerReference` | +| `Secret` derived by ESO / sealed-secrets | expansion → **Planned: not mirrored** | carries an `ownerReference`; the mirror-path gate is unbuilt | ## What "we do not do Helm" gets wrong From f550b5d8494cd5da58aa2612b30488ba1af0ef74 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Tue, 14 Jul 2026 08:38:06 +0000 Subject: [PATCH 23/28] fix(ci): quote lint cache assertion safely --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 24f5e7ea..5161fd7d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -523,7 +523,7 @@ jobs: # awk, not `grep -qv`: the CI image ships ugrep as grep, whose -q -v returns # 1 even when -c reports a selected line. That would make this assertion # silently pass whatever it was handed. - uncached="$(awk '/^task: \[/ && !/^task: \[lint-docs\]/' "${cache_log}")" + uncached="$(awk "/^task: \\[/ && !/^task: \\[lint-docs\\]/" "${cache_log}")" if [ -n "${uncached}" ]; then echo "Expected second task lint dry-run to be fully cached apart from lint-docs, but these would run:" >&2 printf '%s\n' "${uncached}" >&2 From 34fffc9e8dca0b9fa466835156240f149f044b0a Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Tue, 14 Jul 2026 08:55:07 +0000 Subject: [PATCH 24/28] fix(ci): avoid quotes inside lint shell block --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5161fd7d..7091ba1f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -516,7 +516,7 @@ jobs: # lint-docs is exempt on purpose. It carries no `sources:` (see # Taskfile-build.yml), because its real input is "every tracked .md, .go, # .yml and .sh" — which Task cannot express: an unrooted `**` glob walks - # external-sources/ and has OOM'd the host, and a hand-maintained file list + # external-sources/ and has OOMed the host, and a hand-maintained file list # silently drifts out of sync with what doccheck scans. A stale "up to date" # there means the check never runs, so it always runs. It costs ~0.2s. # @@ -526,7 +526,7 @@ jobs: uncached="$(awk "/^task: \\[/ && !/^task: \\[lint-docs\\]/" "${cache_log}")" if [ -n "${uncached}" ]; then echo "Expected second task lint dry-run to be fully cached apart from lint-docs, but these would run:" >&2 - printf '%s\n' "${uncached}" >&2 + printf "%s\n" "${uncached}" >&2 exit 1 fi ' From cf80137b6b3f013c06a5b45638831935fb8e1376 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Tue, 14 Jul 2026 11:03:00 +0000 Subject: [PATCH 25/28] fix(ci): the stale-baseline annotation ran the task instead of naming it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The message was a double-quoted string inside a `bash -lc` block, so the backticks around the remediation command were command substitution, not quoting: on a stale baseline the echo re-ran the whole analyzer build and 18-fixture scan, and spliced its stdout into the ::error annotation — losing the instruction it existed to print. Third instance of this bug class on this branch (f550b5d, 34fffc9), so the site now carries a comment saying why backticks cannot appear there. Also drops the 3.9 MB `doccheck` ELF binary that `go build ./hack/doccheck` leaves at the repo root, committed by accident in 1574ed4. The .gitignore entry is root-anchored on purpose: a bare `doccheck` would also match the hack/doccheck/ SOURCE directory and untrack it. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci.yml | 5 ++++- .gitignore | 4 ++++ doccheck | Bin 3905521 -> 0 bytes 3 files changed, 8 insertions(+), 1 deletion(-) delete mode 100755 doccheck diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7091ba1f..51a0f5c9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -554,7 +554,10 @@ jobs: git config --global --add safe.directory "$PWD" task gitops-layouts-baseline --force if ! git diff --quiet -- test/fixtures/gitops-layouts/support-today.md; then - echo "::error file=test/fixtures/gitops-layouts/support-today.md::The GitOps layout baseline is stale: the analyzer now reports something different for the corpus. If the acceptance boundary moved on purpose, run `task gitops-layouts-baseline` and commit the result." + # No backticks in the message below. It is a double-quoted string inside a + # bash -lc block, where backticks are command substitution: the echo would + # RUN the task a second time and splice its stdout into the annotation. + echo "::error file=test/fixtures/gitops-layouts/support-today.md::The GitOps layout baseline is stale: the analyzer now reports something different for the corpus. If the acceptance boundary moved on purpose, run task gitops-layouts-baseline and commit the result." git --no-pager diff -- test/fixtures/gitops-layouts/support-today.md exit 1 fi diff --git a/.gitignore b/.gitignore index 24bb047a..ab72cf9d 100644 --- a/.gitignore +++ b/.gitignore @@ -6,6 +6,10 @@ *.dylib bin/* Dockerfile.cross +# `go build ./hack/doccheck` drops the binary here by default, and a 4 MB ELF was +# committed once already. Root-anchored on purpose: a bare `doccheck` would also +# match the hack/doccheck/ SOURCE directory and untrack it. +/doccheck *.env # The GitOps layout fixtures check in a kustomize secretGenerator env file on purpose. # Its contents are placeholder text, never a real credential. diff --git a/doccheck b/doccheck deleted file mode 100755 index b9258fba1dc725fe67eb966a2a5525a089ec0ade..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 3905521 zcmeFadwf*Y)i*v95*Q$G0wx#)WKstq-bfTMBT!}}firM|QK_JyM#YGimXypSQ34E1 zqL~gyQ)|^$`;=O5eOe!F>w};flblWS}%5vsA_(7)lw%*C**hgE#g))CbS*Q2@&twNnXP8i#{k!&G z{sp3(%>BJj$M@#=Kg&R9`rt3c%x>Y+!n1`>t2PU-*7slplFR?o9G8EZJA=kvUDgwEo7#zl=@LjrnQ27y*{I;O`hGS?=~9bsl}ERnUB2fp>EG^0YZ3 zr9ACi@g7)dcErqYf@OZ$K>eM|2bak44lcP+t*@UdRgAt z8GKvU^4FQ=ds+1+=*=vjK#a`L75>sL<(-ep_MMN)^3_(o=G)oj`^Weu{8sy`&GM_w z@+Do`?^>SqCzrSVQnqjVrELG|@l5Ub=j;fIPzcZD@}*nv67i*5M~nC3SHvsva3(@B z5XOsh$%23X0}DmM{s+d0cR}CI9dL@+j>p3YCYN{C-Xjv7wHJxE=Z5cw|4HN$Iao>Z zzo2Ztv~zKpH!0uq2=`RJbcHN`;2o=HvQU@mY=1dRdGD-CM1diVvYhqoT7Eqey2df@ zoPn2$A`%NCC>~w&?nJDJ>(c)fX8E7p*}J2#l{YEoLo2RJ`Tl;+Y@4m+-0$xH=VvLu zGcrMxfBC`A5O@Bv+0LA${EEQ^qWqt-#VhgXTD~75I#Za;ns>1*U;V5s!D^NxXm!)7 zb}-^P_fVF9@jbT)jB1hPWo-AcI`1sy-+g?dDB|i|yvMP&>i*CBKN$EA2L6MA|6t%h z82Aqc{{O`Q*G<>skMHS=Y_=<>j$1f$!ks0Hr~agT!QzECx$iBzbnNtd#xE*=;JWEQ zoqF3;-=*Gb^DccLZ|qO+x#GT(nK#^h!??TeRPSC?Rk+~F8^_*v-_)wxD{sAXy6=h~ zFUl*+yC!eOeWGrzYN=05pY^ zIK0gpI-vNPPN&BD%a4)xNGq<}7Z?^gVE2X&+STyx@ae+v`)YVsad@*D+L&?k231cx z^k0K*sy^aR_YJWb@4wr})}V$9T@K?OeIze;_`M1(O}N22?FtRm1aL8KTv0 z%{2t8&m9yuF>B+e+!B_@*8j7;L}yRst@f-)>jy_SH-Xp9p=j+=l@Q?@`-6Q9~y^>d<{^&WEb~nCEy)Ft7#vvIqJGt5a@O z9&3uF>gmhKI04Nj|{onGXNH~GSQ)uz*Zz$%ubZ~lS4(8+#_Ka9SQ zRT%KYFD3LgK16=haJmSDj2gC~hWVKjeeq^r_%yf}YB+=%;{J4B=oD*+pil$DN@$5F z&)oW?L8`tyWtKj?pE9x#Afm~^vvk)v*XXX{#Xv@{(DsyAFJJf@HT<-zo;|esAFgrD zRl|?Df+A8PM+4`m*21%0rCL~XEi9^S^rHfYr{3?nMhh=+m4nmW|LegvEesyK$G9xk z2Rur1m3QE;Zj16@8y0m$_mikuSu@*pO?`%{UmFL2mN+MCr#jccK%Pq+Kr zM|_HQMAhfJid1)-e}v!#M~$(QIMlKp(Tpge>T^;sH6@$){~2GnT|My;1`TbWQSF-uXQ`%NV=s0$6^EOP6|IS#n^@MM zy1xvh6}wwwHxt1n9E>2UCd#YT@T;x{wi7<0g`13g0nlt@Lc7(f`&b7^vXE%S7jE^1 zkz@iMkyTU`60%U!w`%x36EZF5J=J~&q6FC3N^CT;DfgHD476u#yebLRD>kl18fM|Z zD;+kYFCVFRaDE!6C*bQiA4mB(%*UsAnZ%0&75 zSpF`Q$4r8hm68vb%~nC)PSWj|!ump2u5rOolWjm^x*!~x1*7DI#6T9XFIO(>kG^r5 zV*0HAEcx?8WsL(u`t3GI=g9aqe7UzSQ>0kVgjm)FI%4UR*@_w&qDE!`v>lKDKj&R1SjQ_I{lQv;a@^+u?7pkG9FxMw<) z#~OQ-`&Nf3KPt0DFGGj3*U@}rjKP>d&&h^(OW@dOJ2x4hu@wj^Lp4qw6NAT1ofiGfx)RrblpSW7LWobG%VSXG;Jdg6vy+?WIUepYRX9q7+R^G^u z+-<5}0S4HGMTJhL);zMJ;EwXZWr2qvSJBc2)xB+Ly0T_mwkLRIa^Q0|wLvrmf-X_P zC&~%iD#85R+mwgCN)}%YYUp&TvT`4VmtOIWFMP!0iJ?zYHRvXqo|&h)wzz`Zvj=j;!PvPF;k^RqOjBMB!@=wI3eFJ#%? z$iT1}Z$F6$P{&+ShtpWYPd)7yN0IJi`g3M_DbrQsahdL_L^>L>8Fh$IC_jyftU5w0 zgFBQ&KmQhk41O|(q`0uG!FWR#Rc}3kqB$%&!>oFtB+QAj>Ma4Q>WdIz{EMYJYJHNm zM$(oqK*u5jf_zaL@~np zssZGJSUo2DT+~TfSfILhDIp;#BUuwgWQ{9tQ{h$FcI3L85$;_TKLO>OkFenFBOwHS z2m~g^b;vjIxba0q;NdTy01xM*JD9)5lE)>gN+qS-$4@=&RE0I1^AKSSS;b6=%C~sC1$Qc{*HVW1bdMb>66i~y?pMgKMbhe#thpO2M)|^x5^Y&O zMwE9`VM?|g#TVkE*u7)%{~8an(iM0#7)uze)4spV=*kd)q67FX(6ygn$u>O`J; zG1@J`7ZJ$~8x&qwEwZhaU!^kJEBtB+ZpO<5_1I#Otx;yXN@m+3vl(~+6RhoUy~ws- zemP{eBm8Pf`)BDGu`hz)9y1u4ytoWoPyTZ-eb*t*D7?r4>W7{^6LT=_c}BIOKSj!% z_yR35Zd5yFP$bm_^4CJ`DT@9#%odc@kx`9|SjJaq1Eg5iy$rhdR1`r7t>@;fs*mqe znrSnh*$*WtJYXKuLzBO{(`-F!BEF4Hxn}Fvv-L5oBHRoD(A4mVAK**Vr=Ip`Hal#&?{Ev0k@ z63VskhsIEJwKxp($n_3ixFVxCd`EV1_+H43C1cS2JYRTT!K}!tlpva!6?rU$BWH{P zfMyv@ACOv=Wt$aFPeJg7doDsyOUWQ;V@M(bv;yjn1J+^enCL`!g_$vr8C4=iWSlE9 zUI&_DMh`OHWM(X3#)XND)gt3%X2w!vyxh!KKBJ{Jh4g3Utxb6nA0m6I$S(VW5@+rv zu&YFuLhZd2y;+W8%PnFQ*YYJt@i_)DiZhZ%(R)iK=I_1_#V|gG457)FF5obpi(&WU zTj;l^M<);E&8#OelymUaX(&nK9Ygui9jxvDW+-QkNes*X@lf6b06T{A@kNQD+_3OF zhVoc>$51|PW|Tvj7;`z4@0uAolq=1QawroS)bWM)hZrHPoNp*->v0+1NW zi$w`*C{q>vFLEfqnJ!S?CfqKxAc-XFD<=<{VClLq{IOp~Is^ zG)D=fp@Y)UQ4ST&_=RZX9LzQ`3w_}wn1xd@3ulhO%*?~AEWo1B5kxCk>^V3K1${j= ziol6-s-E=?G$1vMM)fSmU1amK(KdhrT}bE($bhmwzn|G=10+4`02m*`;P{0O)yjv# zL)vyTp9kUB&3xefg^q<*K8zjG{>RK$itsPYe2@aQ4o*Xvwbt<@!XkIQ$ZhsT&$>et zcuaIjZAo=8m*E0+bY`}NE=OIXQu_i(0bEyIi(El9oa!=8BBoo`aN0$;pkJsCbYL_7 z(L@xsEHRdJYdO`$)++kqnW8)@OqI1;{8{)+t5ERlEt2{uk2Ye-*eIAq38IH9k8a4> zRzKnr*;snTAdWxu$G*y%w9635-1TWcK!_TbGBSvc+d}Pql$Ae*PFz3RH4XarbfSc$ zYBVFVE85brjLv`_l!^9w;m?6T!g&tc{^A zFT^+y^P~(ClMl-vF}X+vM<5s!!2^BK*)`+m;sf9xhe|mc_1rD9Wq6cFH^J)anwE3I zQ$P7i#CmGuO6^8~k7j_7G?&bIK7!}T;2;DuMDV~sWEu%H)~DHIgo72L{$pUQ*i%Ty zXA3Gec!HDvAefti3P>O9!mkjchBnTHMWNf%xWA9X7M=Zd&t{n5}-F#Hm`$yHjW6Y&=I3!h~_NmxO~s*#cmvHo>mpApEx-b!}C_1S@J z1cnw|KQsU%5!m!Ft}px91mr+WXM@Y_y&cGc=7mxpd%RP#i4UpY=VGp!FgRhrfSG3 zIX_$MBxDyBAlqy+juwL6LnZv4f)h&JL|K2z+3FwGy?zcF;OtcYR~%}@b*q0L5&(ZM zv;Ol5fA1vt-(Y&A6Z|ilbtS|9*jehY{qdQ2Ja)fW3)8q&fFZ&{f)>e8Qwqm8k7HZ_ zyNP4z4P4u23#}oNiS_MptYS3>)chSr10*F3^vFCLIbbqqI>_Nf!N~B-89+)Z0@@IV zu>g4m|8ETZGQTmFM!vu)=u9^1as7L`S2CGJ{{%}#g18XiPED(!zWyWgpPI8n&DpBz z=_!JqqABVdSD63QoIPqzn`+-9Q&LrXtNOZP{$rtVtJ?G#w*FdWhKxkWiOr!w*g)z! z`Ova+5vGege42-I$;60RYLHW3_-?y>+k+YQ#PM%CI?jL}~>hL)i z*`{EaWBu`=;A12{&Q{RuCMSFC4>*6^ZNBghP0=>^LhTM^hhcFD-BpHfJ)_P)mj{WMsttj;}m?<;4ag zJC>z=+VSZR zsLEzl*`nq*smkBBsBMNC+K=r?v+xW({cQkm!&iwbXw{%;qyk;sWexLsh6DEerRS;|!9CyixFsrgsl2qtwp zqh^V(g<2eh)(L!jl+Zu;p%9d34S|Gz(DnC|3hZO&% zu-s>`aPA&oOEW3d*LKR+b`S*}CTd%?oSkOb;;?fAw^ZTiFfF6(4@VUL*m{;D_e3FI z=rcPC4(wVmoUy^zf-IPBXKzkB|40wzf|F}*0 zmcy7s_&C+RTY#0|~^IDp5^zp#Wcr5$_xbPJVSRy5~=eUJk{PLQ3j0 zKf}(BrWd-#L{Ifd7gjC7$^NsI&t`dN^!4v759$Fkqc$MuXyrTTO>lBwQD+7BZ%AE& z*BKaR>_Y6M#;@ZQ-3*4lzUuvmAi{}6LS9XP)o8pB9%&Q{7fl(6~X&XfKDP(db{ z#3C_1$lUgM5`To=gQDP%xhKFPy9r9wy*uDgTN*h*uw97B{ts93`^G4>{t-@!_?EZnki^%$UG#gpVB31S>_lHVtD5;jV=(mDQ+Ec4?%*MZs zTqzoxpOo!zbeGK5r)mlTw5z$z-pG90Hz*^rcQke+`bT7q_zS*aTjwTKvMc&?S&5_S z2gS0ZC)LQ68hiGINRi;iqIb)DO4Zd?V?H$2&O#!8M{8e1Co?aa!%(BW7n15}i{{9B zGOF^w^n&%VvZJ8rb3w$dAlzf>3XBMJ#@h0vVjo67BaMXGM^=?u&9iu+?TDzQhYC92 zIT(Ejg^^``0U6(JwDM)56>cqP#YTv&9C1Jx1SZI|v z6uZs>hXo34`$f4PiuCU&LXkMXU_WNre$241%sMlz49%EVzLs8Wh*KyTh#(|_(!pA{hfWA)ED1ZyW97}Afl)v&rSW1Yu`Qs5 zgv@24142{ao6N-y6ch;I8%+q`p(v3MwkYA>?%rFm)dz8lgd}+y-qUul>9Y*x_!Cou zlSf}ChVFJ$pAf41I}237Pb`u_(z*MvHwpa|aQiVB zNj;4nhomQo_oB)Bx}}>Etv)H;TGc1560vZ^;-JQ*b~3vdi@yYw(xfO?c_uw{SSCO? zTxI5Qr?sGS(JHg3M;al_qT&U*PgxGMwA-=wg)mU0rwv+$-O+&!}MSLAF##*r0Bz##0(OC8TXP|=-0yS z>(mdb1`8+853x%^dW+Kj1g{LGE)SW41$jyxoi#z5y=vyd+F}oFbp}t}9)LqyNeWyf z&Un|NEnDm^kz+zb@YJH@G}@wLGez2YfoNd@5F8&JeA@4XrG~H z+PrH;=>gugFzG;ZC5R1h=nM2&?_sgtYAEihs)WAYFMv+Kad4;l`mcW_{tb;?$wgI1 zJPPn%Mr>p;t=bQvb0`8q%lU$m`8$0l;6PUb_vFoRy7az*4A4*y!G-|GSGZoD_UTLF z`CE$e_Z8)T9OK$WAMr>LEP48XwHM(f%uOQpei{2{Zl~BgWUQ8m#nQGo9HTp&PJ2j^ zvgVS0Wewiox3>a8b&UaR5Psl&lVHUDUZgMGfgyx_$s3IKtsLwPz3W8WZ}By>>K=st zP*l)TF%$Zi&)rsWNwMgJ;ILA~l@=cQoJEJ6RY#TfJ6gj``uB)A+?oEbK(ewX zBY5iKz`1H1Ud4Np{VI3B6)7ip>e9e@J*2%Z1|%haCm~!2BmZb446e^L&W+fNSvnPX zg$HJzw?sZSI|HW;unB@O28IiaLH20)xc>r&^g~BrkYWZstB?iBPN4EpCV6U)`xOjA zXrqT-(OE8$4wq8Q&9^)t3RNlGuEw{Bb`lQSakx*Cm5qkoKF|-o5*1e>n!ziM`0BDn-raScxX5f%`G*J&CM>CZ4()CG`QdiCA_F=CsZu z_w|vUN3J0{FNql^Ge$Ek$8Q@tnBdf?Kacpmp8N@{Q{8&=?ZW|?fEbMhqsW-vjd`oQ9Ih=;>k1pT?Pb zIxJ9)s=IyZDA-j~dwWBTJG{a6zLk4K)sM)ktCOnUj0FH_2cy$uB2%2%$@#MvUa|9*sp;LR)$tgHUq1rd2izziKICP*uS)ba0;9yYxod&#-XG zTihE@cjXXlnhm9k`+H7&-?lgl&$22-R2$od1d~6t-x^2{oyiNF^VY3w|2SrkIsOZYk!l)c{MZ1n`Bt~X4<0)WZ*eGOQDu#+N`t%fE263lSz=RR zulN{WYrAmvYry^tgc7OU({M~d7H+ayWv#lXS*pfjW`v^Yp@r)~n)ygV86cmFmD)d| z7($mSwNDcudM)m$7-B&;htM7S8=*saLSWPMtL+?L&AmZc$xRlV!BKNtHMoWQPVDu; zC%ibPxmZt4F=<52K^pAcIK7eETI_Cy1qOI5CFFCZ=X89F7H*^;S>J)uVqGes1rwT! z{c=~yrqqm!W7r&r11B5Pujly$pS!ikYK6~$Axj#OUV2Agz1Zyg5 zNzJ}HSLOvXTL}N%lYJdF<10L%x%~Scaq8#70&v6wzv}LVjDdrKjVC+^J@xQXqaR}d z$HHU${4f#JNjhLiMD`41Cm)0XpV^Vg6MaU=jD%LCr@IQ3L2mrr4|{VArvR4ZdFm&n z(^pk;$+~@&my$cKeb=0z!vFpdZ0@~qWCLe&CaqUzdWr&3g6`{?^Wg0HbH+v15-(aLbr(+Z z2%33_o;_d)ySQxLm4R`9glK~CYv~BpeR3(cY3vY|nSCYyFF5AkU)jqS-|W*fq1aSG zXNDhtd^=P_Y*=Z~(Q%^de#jQ?V(cKB-~qEwHT^o+1V~K#w49Hyw5N8Sn0Y>)SNxPS zPt#q4aWv;yE%#HOoB&G)DWP8M1x9CTeNF#(?B_i7v&y?^g&drfIB_VN-YVxuWigLV zB{DN|9_^Bms30F|LP)%FK^boia0Tv@%ax z{y`c1Z;=%Hom6vJyRr3?WHuh1*F_;pR*p>m1Q2V=Ej9^n{{;!|g7ZNuP7A6HwE}2R zWp?n?_y8A}uvQ)oj0~>jsM!Ke)Uj*;mhRc{P}2^~f>=M$X>Vj!e$fO)2S@8>#$z`% zsNpABT|=xdHRY~+_`GC3%o**FeE6(08vQ?=f-#G4p&U35@Y#c>+!bHMo9p32M#&>6 zD7Jl*E#IUbP&V=l>WRH(&E++yM2=?{^x%BPv#x5OP#)2E6)u@#oL3yCkBJI(C9| z+-vknm*AA5hEs}|p>3ZrTO+b*;i#`IriBlP<&xTVkO}m;L4p;CP}5a*|`f;w+n7W{`|Bay*Ba9t`(=~+vrXW3%u*4Iz*rRk~tp)XZT zRdKY8+8sgP%!5xaQd!-kfhY^gBn*@ z|E!CQ4vX4bEXXa2Nz5=5P*&9e7H{yI=~d_8S>)$)dSEe<0N)MxxHEwHv&#M1fB!{Mr}Bxx5pxG^sC#;)9h(xLat-Z{^`2KCCqX?Aoqdq2*nLKb(`sh!6|# zm2~aKJKGHJH^aWjAZpcNsQa;^@P6ap7a=c(h_i+#F>m3)KTd!SU0)J5bPI_+3(vmr zp&}*YN?`d4ysL=r3Oq8ZvKh(-0rBkok)rT{@Gj#)_>?C`99=66f8q`AzybQ=a1_oR z$P5#ekgvu>j8szAS6u~w21G(12llnf>T5>VzB-fo%5ZXDfox;N2(d(2C5QkgkET}* z#VAW)>y7+dC4Rv4GBeY|&$*^DH#1c-gnduk5>N>*2q#^f%zpIh$W;bkMcCm)Bv&O7^EZ@INKP&zl`0nCg<6*8RN5(a)sa5 z!k@#+iq^3HKPM>#E1=lTVg)qr;vsVVv~ShfRzY0i7aMqc>M?A17uMIhj^eF>6}F4_ zV=fywrv@qDz?&>`KjJABc8hndYX{#tmYVBmkj8)&;IEovSncEkYG0!#z9sOl?nz@r zIW4@+xZxP}hgGtXNMDXL+oho{7tT^*A=_r;oj@)fEEi3pHnEmtL-&J3o)#T}lvh?2 zfwV9^SBWl>maERgv&hfqbX?_7w-38tb^D@k176baoq>EV$k~davk3?pVg*`dM{8zv zIP4hJQ4Yn*{MSLhMBuJKA*vJnngA<>@Xwl!lXVu@Zc*ndvra6mtsYo)a@`!eig1l5 z66)Eu9S0x*5cG%R-wRO}T!1N*k{1w7)|K&7$+j4hY>WIxMW@6B z!LaTJ#LAji#RL<&gPcRg1CqfsBAGg;WjX9Hi+3E#rXdH+U^Xoxut(3+oP8uGlF*p zrqY14P>U>Zm1~jva1R177eq-7Bva3KIMu~7sScP9c=^kINH^n;6n(;pS&{o2C(E$4 zFRQ#usiPWi)x-YbJl`@!bIa5E%hRx)jP=F?mjqa?6zg}yVb1pc4Hespm7;$@v;1ah zAD??i4Erm^?t{xc2y4nUD6xRx-bZk87lBW&h8=m5%Zm#M$ZG+n7XG9-Y!p+y-D%hp zkR}(@T-C+y-K?%ScQ^Kyyz9{{+SMRja9+)jhO9{@x8Rm2}`3ZCkjpdM_K5=rzW6ve;Jjb<%+t!pl_|33+#;losY9{dz#6~>mB6h;y{ zA&exzQW)I?sUUNT`S;Y3;f zWPQ`7Ej%&2`h1t&Tkuh3f3d$38_V%WLV8ib zr~W>&!eK#Nk~9RX7{nRsXK@0SLywTE^ExMT$8a56o3%f5<#iAfJAV&A!+UYqJ$@-nvd}a` zZ;A$Nxc>*i{U~Kq9()lvqAo>{FjYwYYf1j9eiK^WQ!$*^yG*lc{@_~FT#cGBT@Z~l z2p;exnkEGO;zkzbVPQ*>dsf4(lD|hu(5EqxV3{Sjb9EWj=OZZ29V{GG@hR7|!*RpD zyq{o-(RVS02_I2}@;-OFvhoYWaerL}6B${od!W3nk~r1p#Bmt{&;?PpP+YyiwMhf3 z4{s3a*!c65Px4iaZnoDQ(wDE6(V1(A*VJtByopAWWeRpwu4Q0>L#G-QDn&mY)~jDfAd_I_GKLhd=E88fNzL64uiA=p)(SSpov$yAthO|a z6Sk_3fQ3DYtT%5UvFCC7%6&{(^&t)5l0rV^l3lgPq-GXiI# zzZsIhy$LEZjRT~5&K!Xh@VCwQCV$%@-sarIQgOfd#@ZY2@8NG4inH>!ImJNIvHwD^ zlKGp(B_M&8kG9xXV*Xu#GQ{5-C?Z;`|3{L)x}~&OcDbtG3I@Hm;scU^N=gg2T2wRv&={@1LA|6w z+(w2Ru~%sYXSUPizpDv<-OgnfnPfQBDtl@s%KnmN&0K;@Gz3NGTEDMErpIm%V0cWMZTZ+PE!^x9LG*AgEujK~^V>*-wdqOVB zS@TEE8Z1l-UDGYVy#O5cv!^>CCx7Om1eu~$*z_QLPepO(;p2FSNtD4!gqfuAF0)SN zGfpB8ClO}Se4HDf`VQ;GnO0LFMu{$VG)^K9ClO{6N<>?G^7fVfEB`>R%=I%y4y3@z z5=11W73qVMqre;)uvOeoXZ3R43=Gflrw9yUiAhlosA4&e6`T@IyoHsW%@{ijV=VDC z$SOaK<=3D*vtpO*O;Mg>&GPESuq(xD#+apsk?uWK(fvLYT_T!BEX!Xk+v#&2N`^M7 z-Ru#>sgvN3A;H5G0cSSj>ruI>B z0DMvfd=}zL#f_MmIG2-x>;JGl<$DvsJTnj5OMMVHIVTHqRc>w3 zy4r}Uxbo$gm}(4G)}UYB7+FrOkdBvQj`aI;ENhQ2c$Ro?ZTRd%Yc z*SGMZ@%K6d)cKmClZd_|-J2&_MAN}kA+14zOJ{OOrh*RHVt!I5ZeojHKS>&b)zs>V z0KRie@ynve03|A0Hp{F>KrY0zK7KIkd8unX9T*WxVG<^wsutnmv|*?+d@Qux=_xoC z=(DbzXii&KLS)7_lr<3AQ81TGOM>{tX=rIGTC#wonFN4xfA=d2QVS!$k1cXm2kX@h>N~LhN$$S)GO}GZSWrt>`hTmtg+%v_w%|!D=Nh{zkr9#;; zVKoW!3c|Ymag$8QTS|$36X1k;*Z*4y^ckt;0r;qd7nBHi6I!K!w|CDGc2?o5>>Gn7KI(?onW*RAxa7T#}>x zn>TQo;EOl zy#xTz4<75%J|&XmjY&<$g!bT|_5c+E5{!aUEXL$@sO(;n<=sfz$YJW_i^#Ep3UOAe z`{1Nqxegti`a|U?Q+IHxp)<}vy3vxx=}zxt++QuoxAVON0>TbiY*cON22FJc zTKACDUk0N=69y0^SIT0O1m`D&*O<6~0xFDBw-}s2y}PyVGksypX+B{82AlY&V88f_ z@H{*5VFMg;&b$WpQt7}IpY#v72oXFoqJ&n1&T&ITs(SaSZ8wPBe+75mo*p~eHX|~w zw;FGuFF@1h6Er?~nl+o`PjC&iBNXM>lEsciUi+I%$TU`wbKO`rKI41TYFYOhGc!XKMP?q+cp zj(Ldz7m;no4hO0UiCbK#g5q#M8TOa65eac!qUz}|`}$BLZ2lMm<98j|?{1Y&6sO=s z@t0@l>obS`tC zFXGRKpJOBLJ}!n6JkTG9(bfUg=}M3CgmsyM7zf%iIZw(-h1KNQm>Af07HT!;$rwtS zY_f2ts;9!XP8%V78gS9TemDtc0LN%&FH5Q>G8y*ZY7Dq1!{OBUls(71$Hf^OH;b(% zJog+RAqpeNjs~$TgHE8V8cx6jCQt0)BzG3$j1ccOh(kH#W$Ip>intBe=#Qs@l}8a$ zuDt$pKLi?LPe zUSe*PFNa6=6qu7?&a!I834`GnL0;J-cldxQgD;r4R(0TEHht_v9e~@8ue_Bdsf(~tqaUbGtu8-yoIUC5{1juM! z!kd88!hpBcfEd$nxE$^&pmXoKAHpP~0c2Bm(i0F@oW{`Iq74p=m^x*WfpY)MxaoK=oADz)O8A(G2kgayC5iPt z_D_uoOv&#^F^Uk|(8Xdb7_QM@93tq%`30|y{spJi&&FTtEz@!6FlGlPOJa_$IBl~9 zal9dj5f>b`>iamX#bEo8!6x(9AwBZfr!Gq3uRAdBO!f-hYfl5#8^e?*nw2#>sXvBy zL9`C#?dZ91Ew2R?V|hh#d`<8_*fTBG3r}##db7{UdbOPGh4xRtdW*uX-q-0;PihC* zTrgeF?2Erg<^G8KSjA14P3K}(?8dBsK^zTELW2obYaYh4`@$z%`Rf{g4Wwfm^J_9Q1X~iD{e1_U z#lD0TYJCKkjg3nTANjA8ZcE91y7AW$xdQtGyRueze}>}2y0X@Bs6(GL3_fyDO~5eQ zK85RZHh-0%(RbpXzVO!&kItg-7nnsDx|7bLp<4=ZOTF^)37_&ZB=Hwc-gtxE_NLEs z5>s`%oT^6`_`)Jf?g^}&l~o%^XJEV8SgwGh&||6X-_j{_XK~IyyzXx+RqziSzsxSe z12@!R&JFO!x2#_PvWPa}0ldOL1;6V_#A1uG3u1+BO$gX+uKT1+0#OWEjs+IE-;a3?L!`9}N} z&Eoz=bsq;V6We$&PHZ;rI4fK}_FTZ_ZT)v)?iYpnoHXy7CWRjKH5~?pUgDar-}jQO z$i8JdtkKi;N$ExIe+2Gj7m~nlXaL@ik(n*ztZDoF8a)+&djR-u2_Kx>Kcq=)Dt}ey z6Kpy_B0*aq=#4nQQ`Ug{xv+s)w=hc2 zO&Mw~)+CD^YVHO#jIR^>@Vg-Rfr#CzUC0NIYCjs9e9=I-XySsQh&*3xoNny{Q3>13 zJZSGJC=X#e!wHN*d#3zb@(-)e9m>5i4Y%-hQQxDNW6{x_e^UWzGMq4@s7*1vHet4H zfGVTBya)Y36t*Wo174xJIuYa&$%!kJaFzxJrzmD*6X1p-)St7q+c9^c|4-|{-6r+K zAxa2f40E$V*mt)Xm4JR!T^6g`q$1!OapFlYQwDzXguzNTN|ukO^_NIHpqDfjVub9$RP-HIL2es{O+A( zpS~5%bnbg`jVC@NGo^uoT4X7H z6C{rP@hl%qNt%A?_6tVau8Gvpw$=ovT_4nk6NkXGhFBtCW-oshj<7WgyumJV$cLjo zLvho8jo8uw{^_tC$c1*vu) z!}-KA_+CeT>ZJBu3S&O-Q|x|QspF5bQaivxr|({zkrF>ga}1w8{CDpRoafVj#7#*+ z_j6>O8JQhzSL0qM%G2t16Y7MI!Pixb$QHnz@1t=T9gd09W$zpB^VkAn%oxAu|Cg>S9HhSP5z_5s2DIaGA@eJ6QUnOO)!SAkwJVM#;+(Deb}7TF^$tZ1ZZF73(#(kXW0y+R74$+ zQCBhQABe(a@9v?%Ss+XhdB)HABQ6*jV8gPr3!8(mvx{Akyy&G}_bBB2ez$`^W65>8 zpHfGgk60gu+80z@fjcMqErl{Y;FI5BZrPi}9#9P2Cd+vM5qkR7oR^>haOTaxId=wh z@Nn$uNk4n8Vv&qxZVT5*IC^IK52EJms+p>;Vkx(kt3I4(R&zG1`ux;9oTdk%*JK^(=caD z{$}>S@htsc-L?Pw&(?no*4)lWAoLLYa2pQuCzOr=6CHRtVI1Xpi#Be|iKUq;++8?7 zLZ`AT?$}hAI#xJ!H1oS^ma5MHzP5|sA|bxu13f=e;OnT-@2G_@Oc}58G|shKXxk!i zW{jcwn~bum?V!xXcqHTP>OXhF8!yf45DSTrkWceX+<8c$CA8*GfjQ9JzuZ%Ck+~6% z^|ZA!Q8$+6ze4O;4O_uxkVINtDEG5Yd}L6G#DIFbZ7~VMo1l7G{;5}z!IYXNEp3A8 z%W%Iy=kZPeZU*G|Z|fNUa&FlM(K@6M;DhA`vq4-YWo-h7;tS*nKsi6+VrFE$^IxQl zQ^JWQ2A{38-XCV!V9uz1i!%e(?JKyI++k{0#rdHVuuBf{amb$aHohfQFsqIEQ&K$V&Xu*!u(Sn zdK(~eE4-d>s4}^rvu1GAYET(}0TLwEj>Q*uAITWtFAFh8FF$<5t|oMI<YxNKPE5X-s(; zekv^--?&Q&{Q{-w2Mra;^>h~fC@&c+=^OfuckxTnGGu_>h72Qm$qd6s3i`+Xl2-{$ zL~_HXPZc%EV2e51(=?@)37_Je%+#SA9 zqZfwB^;oRq_d};(OBTK6%z)p{)2`LX$I+^$c3UnzEpECP)8lLWav`UO;1boQmxatN zXDbJ~n#5Di83JxN7L*JAX-s^VCCyBjDX0NCX&b@L2FDQ-1~68^v^!&cH=a6{9P_BL zCYFXDu99q2@KCEP{I6RYy{N^wVhh?a!=sbJ!;->EQn;54yIA(b=05oO!kXci;XomD zW-PP;JWjY3<5vMOyccljc*ZRUy7J^Zek}%Y(iC%iFn$|im&4YK!ONN^6EksF;VExL z27VK9IL8c5Qqe-%D@*_%M1xlN0fzOoid><9d~+Py#$9v2YZB230~@%SE1&os_DACP zJGBnz9>^U1b64GiELcn^3|j`21L~UKUXbPZG1yZuSBwDtU{zncA4oFwONh|5Pd@kR z1n;foVd<4NT)Vs3w)NK&ae4z6F)P?dn~2S*Mwp6mh>iR$b?ICzzkIERGc3^VghIr&)`SD z;BmO6>d9zdL|KJk<=G4vm5@P5^{E(&wBD$N74%l&dHdj2BuLP(yr|2BP>TL9qJ&3a z_!uZ1`?!lW>d>FBrwtVom}Z($_nujhdkVKpX!_JMP)4zg3S$R%z#rbnF9G7vyc;cK z_QU+Cyb~++UN|VZ1WNG9suyBlq7`uzgs~`0aH>!OnJ4vugM8&>%#1ngvGJ!cGkM)X z#TizGV+cnp`vNMMiH_Wi{cU3&ehbjJfsbqX(C~mlU4$11h@Cdvj339xSUkEMLsr-2 z42=F@W}mxS(4)<2Q&R!fM#I(hNwE+xEx4Pz8SC@S6gO|(wsFLlSj0>H6Y#XE>wdoM z^i}2C>$#R@CHVQ=#i{E0Z5b`Euhn~F4+=)Eskp3o>MnI%?)*oZzaBIH5i{!#ku^nK zZ$_ejNm&yYdB|F)sBg*J!hSVWb#M15zrbRCYLiDJ< zlPSwD!_yuZxRy7zL1Dga3Oqh$F(oi*Ew6M#+~s+QyUNlp@H=n=*Ya!}QnJS&#fjXh zh|7?1x403Pz7}Q?=D7V5s2M`druo7H{s!H(3(if|M!bZ6rgrFOR26W)1bk3NtoSC^ zrrrTD!qXjhoblapWUcT54exnIL3b;$Q+8c)WtASF-o2GK*jn4@s}8bUg*PL zzUV4iq0fvdMEoVu@*Y$%0pIuz_+b0ybs}i|BMHS?I{|3f@H7e=vyy@7SPoIh8;?Gp z%!t6`vt#&uLQ%h`qyFUnpGN;h=fm&iAIIjRk9V11i2@#U#GuGZ^t+>}4u!(V>C|9{ z<{6754ZwG_Z%=C9!Z=%B3(KU; zu<#S0BaZk+L-Y(diWh{kTq4TL<+%QgjMyR5Ta(g_RZZPRn=$9vZa9oyAn`{1&;0%4 zst)~cH9(=hLSHJX*{_JV`8&wndhIlBc&S^j=ffEQ^A~+lR{fh~4Hv9NRs-YR$`tC0 z=6Zv_jU4##Z9rdDH5D1rmR{ouywwZYLAJ*3-xDXe#gJ+qvrw(Uk{Snbi7^;iA4er5^dnP$r?q+W}6&93@7-*l0S9p8n#pt z3NYbX^$|-0mLT7}kT{#Lpjs{_IM_cTV4`EDBbrfou+y-Qe?<&?poY{{%_2Ao`?LfL zMOcq9sB@7N6rujG&p#ZruyMMemACOy<}`v_R%~32LZlP?QZS;9smevo%A75HZ$75n z(j;sg;?A~?tRt4nYL@j-&4}A%+U?!aM1x&xx{ZK-cMlD(>xu8)7@YxokXwH&z~x3552r zRv}Fi*A_`=DD$GIOCE4wovWFSqr{vW{Ks%3-k48uC}{9ukkt!m4|dNr-s4WzDfot5 z5O&ayJIy_9v@MW>iC%z!aqla&^e}J5qF{c+f8<=%+x2zz_ zx=ax(VFQ&e1;a5X7YK^L3;h~DhoG#yS7epW(D;Q`q@!vpy-8U)Eh$}y56l^Ga&wP!iYB&?j5QkkEFPPy~Qhxv8`{&OrvIFqRJgSl_+xW$sNx>k;@Y1H0^vq|qC1PuY zYn)sNP;y}1iy2-BKMJU=jPWE-@*RTqg;%<@h$6!lFha(2hF@ho^

pz`8odhx|+O z9eSnn2XtKmKDfR>@_Tst;h_Nne%g3)Kcww=p)Yqg7J_HY3toLWfJ8#TdtR|*PEl(4 zyJ1+Trs61Z`&j&hB{>Fum7FFBQmeK8#7~{W{{|5hhv=QjWMBa*k>iJ>MFEYrrRw06 zyuj7S4|{~FT!RyrwSwNskZSMZ`3&^D6hh8$tfx3IQ-OAP*vUqt9%M7N02KVrDlWZ{ zS*%o!P(gGAYclf_zrer_G>0E&m&d)xwt|G$z1N?`u_+hY&JN>I({Z5u4b+d-WnJ4NCWs*&ScV)3XdQDG-lm>V4r0x+;@~Kb+;iHygwyC{-M-ek1rvsq>3*21b+Us7OJ2cCaZxJXwXV5%^Jrv=c)#gV#e0>@gSQYtWU*%vK}@0uBA4cT za*DF@BoDvGnBQX5@GaF1Q}uy3+KqDjN71w&Z@?eNwKEV*vgRE|8c#TY&PplqDB)Ch z+MlODx;QZdUO~V(^anB_GJ+zCp;ESMW_*zu@iWW=USP)8k&#lUUi>~sQcgwKmnn+o zizEpPMbQOhAQE_amP$yWFSrW^F472aVvut3vser46O+}jWuDV_SDj)r)1Jn$D)2zoc!=rk@kdu7j<8ztcI7?);c=^JP0yDCYUQKMjxNn5RzR8!L;~g;x>nDiel-wfN<^5|D8AKXxrv`9 zN`)c6)@2iPMmCVF6+4Z)es@+x@CG&xT@Vck{U7?pL*H=xO^FWd?1jOUF#r)7zlm@1 z1M{R9hBLGQ2AYo&E)a0f!%aMd#@(($^nAJ zWpm1FlX`*W3HmR?t&*22b;YEHH8s6baC@0ksrw;5Nr4N6%g3t{SbZ99`JyfpYC=Gs zmFdhgF%0F{j6BCuWz}#xx9v#PyHeFta?w3jXW4-=@(+TGE?>szafrE zp@DiI8iyEuL6d1J*024B-fr^RU0=>l4u+&DTq*LbP%?_`2N@(YgvA}dMnv^SjDM)T zcfdtX4a2lVPh?#G6=&|aYw@B$y7HRVKecSd$v`>IaDyk5a)?1af_XxylBq@u;ekWW zDo0d;Pmarx)i|^CtG|(mBP!^ID^VfvkMof|;iL2T&Y*rP=#z9pjc%+-#Y^!nG$qjC-I2jwC>wRUT|$nS_D6E>dAJK95xf%qj;c5B>}*ir}(dV{!jRE$r!DkW}<< ztVOD9=G5T$UWg=V)f0<;2kuLYnkv=w}cfkVP&_3g)-spZVA`O zgpzIv6J)}bof8_^>4Z$dsAJJ66faX2;X};a`9|-@dYZHlOCBx?QS3vZKjNBeutTur z$E11%&b4Zjpn|>1%E`clsm+?aBX=(+78NpIcyBSzCE+NUF9(rN3#|;UydWPqF6 z_R#MSBwF_f;)xCN7t?YgN3Qc&4V)kbQNb%IAt?yU&(`rG&o;a|C;V9^{H0sMlQQ8~ zT@v)PJuuwA0Y_n*@toIMzf61y%JT$1^7*)gkI{I5?Ef(n*@rTFC9)fXn3T>(A3jp> zfc@lp?&M&Np;XMHgvR;<3tp~;RL;2)u7&23xtALC zkDz&wk5gI*FrhFUEWrgi7ewM%RS6eFIOv2D(FtGmWILh_Nvw)Ucx-cwxCtEdo|kLa zqGK2&_jcvs4IQmVgE5_x_ailGugQhC)EUZsAn@Nq%qAn2`(RPI(gTM0?-XT~(ql{`wM1^;d)!;9a#cmZWW)=yagWG$2a&hXYO%{!;R!@`l9t~mE`XoRtja^;LQ_h4+;IheT|d-xy`EK3ktL;L zdu;G}Zm$7hxMvNwoQ{Z%#;%zAOMfos17-$oJcbt&jMKnF?W#m54x9lXdF1iwlcfB{ z{_=y;*L}wuIL?jHFc$ucx`#>M6#YUzp=MRq6gqj%>*NA3>%j49#4c{haV~-M{J55f zt9IBln=x_OyeNdZ2kQeD^Vt461iPVNd4qA^e6r*qiW*!RfZGz?LcklWZ(5zi?LVm z+!=B3OeXm|u{zvjI!BDpLEQojJeA8NeSB^annn)IE!ItmuvZ zp`bYN2X*IdyyX6etOX;O@!gvr zB45W2hFNTcU)C4sQlFl-zt9?&6<76unZq!Hbj3`2hdIgGwn)4s|7qyJ4{X{HgD?zD z#NQJ7Q7xe#)snn*9%6!9xyC~W#dHd|(SQC>%&;n)cH1B`=-65`rX3Poa-q0Cam0(4 z3f%kwFK7rM{wN7Bwo}HoCCAENYc-}nXZ5VX7-n@SdTj^SOn`5W@8kb>@V6Y0@J~v> zKeIFZWu4$RE)noY@v_ENc0rL{$iOQ(!R*Bf?0QOzpK-%O=BPxqE}fA0e;RaW(&t=~ z*g{$mf&$;zZNMQX2mwrpx^qaMFzV5a0ucfE0?!ySf2HnMh~oAThq9xzs0#jA2EEql zm~bb#bG7DftSaN|1=}_)`e7_&5f%m-VQ#^PtP3Ozb}!sVVc+s`=cS#@vYh-6_v^Dg z!AlSa;lcB@g2ym~^M4Qg9-L!*90z3dv>`WHJYr*C@(8(=YRpL$JmUBNws^$zNL|Z* zVSgHF#soVa*UCCxtnS1gmRyPIcbyT{zjmWl{hgwENC5mkyr_G6qV5@@ZlY80pM6L- zcG>VaDl1Vt*FOyP%TXl0pr#4FU^zSrTe(qH*KN{uv5-eI&oT$Of7mXKyEHaPBG?$D z^-E%Zm20&aQFAjEga3*-(m;?H=@jN^hKZ1F>_ z63&INwsfda3%jUL(GR&%i9Hr+lwpC;;UIVdASfl0=bpXnODIeBR!Rb#D|SO<*~oyE zxuXI2!E@KVj1ST>@zs!bXAEH-$l* z=FiRe?l{{n^apEdkH9=?;0z>U6Y4*v{wX=X{|nSXE7TEDrL3Cs-4Nfey7r5=X|o3R z*v)TH#T}rE5HzS{sz@VMq*+w4XP-qC^uiOi7^?at!64s&NsySyAqbx|$eN?ij|@=G z?_QIX(qW%mdlD`>;PxE|?tpAoo{S#2X zU~*2*iL)<)4PCg=7k=N;H~KG286)}~J-hY^Aui?L3J||3|2!-KF;bmp^C-XBq(wY1 ze_%nuUq(BE?UnH6|Bt#ifv>W<_PZ^-6<(Q6H*KQBpG|W6`M0InD>&9(SF2f%Fw>x6?W1HJn8y|TDk)1|6XV26KY$;~` zX5V93fl2>(idoxGNttt^LmD~OhFq#;MF9Ow zWgn04VHiqaatecDoTe=uP984PNEr`J(f!KJp_|S$O);E_04P{DZgX9%fxGq+M#iqc z+C4jK*}GXk`jP4JkysVi^svPjM*pS(lv%CKEOT=3&hVq`F2=SOyNGcR?jS!LEfj6;h$!i)m_S! zr!a&?cln#xWr%{fSwD7*3SYD1H2-${B9VHL_1V|#+dEQk`Qj@3?CR7rH~DQy>2>{i znLpTnboq=f4XV07zroITu=_G14Xk~JE|Z43k<|u_!5y~~PVH-;7Jn6B=HV|(NO`^> zqb3Q%c~ZJUs6J1gI4t1KVBU=L5F4!9b*5V4%86=+orGFsZ!omtbp!sjPS;Dh@`|nc zdTH$)`d<;+Y)-`k^#nU}lLM^$=A`tS6&~oszYg)UbMnnY!E0?D-R5lEp!J^D%yKy=r6VYOHIz{b9Y%aTxxZwOVa=dBV zC`%@6luz8if>$1W;6l^S*o_ywBV71;9)Kr+8UA?|2Ea(wollJ8lqoFu=j#)&E_rYI zx{lM;+*#i+`;_aWQ-VpN*0wD?JyP`r^VJ|T2}$G54?D4o3f&WIS-YoMB*5-Re-!S| z?(%V^m;T_+TdWDqT9q0#uzR~OssH~h{+yELf21&)HL#+gB(!|IXxxw?;I9xg!onyA ze#6$GA%|O4G@ifjvjY4h?#yXwUeJr_(3T~o#S=Csl6ketX`@q*;|5Dc9#R*ZT$rej zwJ;AhH7F)<!Nue)w1ILl$=8-hYCpt`)LiW#smV;`eBX@b{>Wy<^3xas*VWowPUk$gu zR396%%Z%T&JffaqBp>16S2I83o-q54$z*8i{6H?aTp$4$EiS$}+ohI^JlRx&PWFTFeQn=q>J`cuXq%dL82 z;5+RH!N6}E3liAn8QIF{7IhJ-p%dwZ#$zQwcxIX_L>1ER`@0&5*(-NED=%C2VS!wktcaVSH!s z-Yh*q{jKgbN6{(ILgGz2&ppoO&QzDpTa>b>cC*@|kPtKDuie}&i~7K*`va@Y_d}u< zKKY=e2cL3P<%kd)HE-gIaGcX4FE8c%wyQDRH?4U;G;d8ncaJxRT6wa4SC~9hWE6)n zv2*d>BtXxJ^gWsDOQ__4V=4NPu?5*ff07)spsg?%8ZHn6dU1Kq0+3R(kg z3*S4^{I5YxGzrKps=eI@GN>gW8>aVhkp7GyU6O{hSubkc4$NEBwf58k%K#t!+W^0$ zE;a?=gU2QshY%|J_R zev8R-MTo&BEHG>vVk)e3gO@ui4qGyYmh`Lc9|2K zQtm!-*dTa$%@&xEm8Xt?S(e0fZji~K`;sGr?tt4omb{qW)EpU116R8xsmdf1+vn~d zmKvZ%L=A9{10qTv1k%%568ND8`hCh>(4gKp9%W6ga4Srgezn=_k^-mbi|LYoP2-0K z-D~i*q@+a6p>%0UX}Rf*VNFoc%3*|T)q!6cF_IX{LF48SNg2X($~dl{*^^vJ65wWG_kPm?vQA} zDE;RHpV)lE+QNveT#2j5zF;U~%m82m?Ck8JkPz$7@CO?^+FlT#Tk2w;YXrf%YGUWL zB)~FOUmlh%$ghu`U(PU4=;~r$Y^u-M0W0IZWo0m*`q(AqhLwSdoRj3l&SQ=zAo_W@ z)roGA5HTFV2m{`?3JK_~dzMKoW%_N@MLOR-U6hBZd=krSM$WjNbx*}b9I3i;V+yYs zBNUMwtBqx#6SwFYSH%QIp4UcCmF7|#ol=Mzh_X@cMA17oPA*o38zz_VZ*;P7)e~h2){8Lye$&m z{&uu&7|NNM)d{5dD4icy-+P z^s0j$*Nq7%^>Y62j`jz(v&4HJdZ2m?aXTxk#{l)ROV`1nVZ=G}2Wk<>k;iZxX~A0h z1H!gJrj+8h!$J3hk$p8Lx9ghBxl$jByRYg!Tb6!geDi3S8IXN~xoDJpYVqY0jQyjP zfK4QkVP_`IU@W_~Ct)H)RTW@@@vADFx1Cn&SE1MfqX@u9nf#PCKxhz&9ZlXVI6B#` z(sX21f`NvP%6bbWs}gjm{RXFpJ5^03q!SLV1 ziGfn;Y=qe}je#T)`dBU^?ZH4Rp;Fk5+>;CKWHFwZ{6h%C>rstoHfez6HL+?*vyo?V zB#z|IOSy>!qa#(@*NN*DK+k6e-I!@5msZZStqi4=3iqjyYF34!`b1(wUU>&IEQ5jl zo1#IxERtek?Qd80nPv5*qsJS0D2&rux|`E6x<#TD5Vc+6U`aNvw}%%ADF&vpJRie zzs;?6POO&bX!v~Oy5d0VcxZH3_=624t%sR4`;+d4;%D9`!+GYO>puX$v>J~YLEyhJ2&)QM`;H_z23TO`_bjjVJNgVEg%R%dD>8AQJD5S_Mn0e9(RP_T zo>1|J6jGGRMGzl#Ho*_>Q~#4MAi;Ok>!91|SDF01FKYY!wfJ>t8owAnmO9ZeO4}z` zH3U;?ES&me>2zjM@VK_wPmR?T2CFOgwc$&d-lP-JZAwm3l$oxg4n84UM_aWzZ3PH~ z0r!H}HPZ*N+GCdcy3f237EDYB?+N$hy?8j}0uESiRFX)bO>V0;&fZ#`wMq81$8w5kjl47+5vjVTeKm86Ob0}ziBGnE81jDy zzT_M$B(!n>Vv_Ns?YykLg=s=vATgl_xNQ-)XC`c?|}S;U+y3B z(hu+c2;egr7XHtt;g8nA+A-zf_e>B@=fH#$TWnO45}kY10S^n`h!u~sGiC%QY<^h6 zwA)y9j9Lf>#h#6Su)T+)+))|%d_p4f5({kQLymMo&(I%cnnRUH5%Y1^JIJT~!5h99 zuGr9)^n*+5DyxG;5bxytT=)qr##kv^#pbEoi5;y-v2T4-1rJ&x@UZ#9qbHnxccf;|F!JpicV>X<(sSUy&$@Zb>fJnOCMs z@>{hTQM*6bdcMD{1SYo~;7nvm7Q19(kc=0IcyuwS-iR;8?f&R1Mrs8yo|r*t^ia6o z$MX&)Yce3VffC;Pl&~@^(GaYaeAAe8d2faw!Pkw9gK(#RyR_uhG z*x{ZXrKGPNWs7IA+N%7Fh@Q!^RoMdoo&|wY_7Nk4wjqPoo)^0$SZHh^wUxWu9uo}8 z%oz0x|!RR&Okjt&D$3= zJjMx4-r_9VC*RT{!a>AL;xk$8gnqxp*|-*Bl0Rw-CI#PuF8I;j6YjNU@(uTq!J9VE zdFikKfd$3CL;*XM1wcaeF}1!e*Cx;1cUhm2nvCFve!54{VsD|Aac{@pogP1=Tm$!_ zjq+xYw<7c)ev$568ErHW;di0dnYjVAYP4Y~wb5zCk*c8&YElcav(k9fMyi_uQUU#MFZJ9o=6_S_MFq=R3L z4WRC`PVU8pC|`d_TY*kBeuQbo3;qHVDK-!*c+o&?;4gq!&QN+7&)@%odGzYNJbI@f z3y2zEvHMU{Cj8XV;_kotQpv(cI|w}dXb^mw1fLd$HmXK}QJz!0{$_Jc0O?`3bXYIrOoT$fZ z`*vF?XgmJ~NR#YkJzw0yT0+H=j3re4bz%oM$+Hh3Ws-;L(X&{ySw`mt*6}`grN#zHJ@P#tD(C zb-xiQ9fbydI5Y9AdnaBS;}Mfh?h%x-!-L6*!a_&vuF2Y)kum$+TRt2}$7xXL;E3HB zLvxAd9w5wWRD(|LEWW`HV(cpH$U4(ER_3bpskU|Cb|$UwbdNNxdltc+w0LGvggK?c zJ22x&zfGfFnwCNjI(a>to1;!%=)qu5S2H$SI#njpAP@DqEAylQlpCUL+-WHEvY$es zb%$nAXj&VvT)p7Z{^!+l^;3FHZc2YtengLcAzf`E0CMfx#@QjJOHg5gU;LlNMrxBh zknC`S5d9lDPz+Lr%~?`D8`I5F&V$&PCS^QJ9vW;H8ff~{UN9j=Lp^epr&hNBF}7+S zO7bl2kAajg7AZd`;LJ;DSUxqQwRoFTnJb!+Mj@U{4(Zm*48qmLW<%9;wLfQWDX4XY zCGGu&dLiu>g<}f>ZSWZarsyX zR}d~X%An?7GuAVV|9x?*aie1o`>eHx9c#Qu#_C2)3@Gld`iC&y>~N(8pSgs6<|42) z7&pr_dm6QI{p8B>cB#71S}-kkK8v2iXsI@O#I%hyN*|1U?+99|a4$~RZWy9=XvT)8 z<&bqep*N9Nymb@0)3fBZ)@F-g80pUJ2t7D6uV-y@bY>pUlKFb}Vdze&#Z6v{1b&5+ zh)G|r8}-*9Jn`Qbe+0&(pO5f0nGB(xacTM6bRuIs{BI0BIB$RxKYJnnZfx#)H@7DA zV4!B)Mt;J1{5m+iaKnTTJha<{5Po%>7m?LSh zsV=v+&=cQXqLEDrN#W781d(^S`2;!Tg(ANJTs5)tI}4|Ve!it9%0=?06iEJ1JrT&9 zKch!^IbJjF0{VB7_y{T_viUF+v^IP z_>7#i|F_a%@|FwiY^d()rmlU|C4*h8?$*N458hjFNa%s8nxBmeB=Ol#*VI1lpt3mV zC-kX{aNg~h_N&HFVtG&NpxsVrm5F*1C4&#;m}?i2LqybHE_$73h@3BW{Z#q!jES{{ zD3I>CniIwKaNu|)u|`w8+K%M6Y;(={XYhBr59rUY z^ygmwBzlpnyXb;GG};}p5uld-{tkRS`YY_j4fofddx~;Hq5CjynA+%wS^|umC=r^{ zmHw#tz(drG|LZsA8pAkw;PH!+Ee|;LB(XUV69$0!YGi4o>JGokdByIRO_hVSo>Es! zM7`xKS&H5IBh*u^JEPUsKX6vYlQLm{xx$B5&V(foBjj#oI8t?ns%|4pj8uCH6PwxK z=F@_?PxbsFkTzUKwRl8~Z`S_JW^8W#fAodavwfv@nt@sPtxv-bW!qn$XjpW!q1gJM zwweH%-R?NznMn}5yiMnU-zQFj_y&gR+QqghB5-UoYDK8C|7_n^uXs!RyI_SPBflhp{XpBl10P11;0XcSw$`4x)b;j+f9f$EGTo$SN z)lWQ{ndi7GOru9w1aEL?!3jM$ZGZxjWAoT2`FQB&I{85f2-b;2kb87bSYakH%>?4ia|39d|(DV9l zkk>yew8S|53xjpBMyEEiILP6JhtnlbVIGUrHtTaC>N^shpck_!I_(KJB4l!f&HiAP zni2;c%$eR`9AcyyP^|{^=X#iQq-yd1cu;F^a2xR1)N861Ga#qIv@bi)eBejhY2(kH zZ76jDR*~Fl(f3Tci6`Gs{_xTJaW%sw;RVM3r0Wv3^fG8$v(oh2R@$>-{^-xzVGBTz%38?F%S=R?t}lUEMshN zpZSVWErqY$FY&^}D9C)bty!q^E?5h1jESWvhSse157nnMDR;4Te8cQcjM zM?roq1!ohUF^g48A+keJF%Vy*YK8d#_0@jRXj<<@qK3JNsjeSDv8jNQh8+4k$TUCNYrZb} zf_tRtfwz9NU9OGpu8T5-ey=rDhSz9J(UEh_G|q#1IqU_=Gfz}E(NGM4>NKSq~f9%~vUGm}WlcjSZ61?tS&1Eb3nF9~LY5v#{Kg zJtb1h$oWlDr9j@Ikm3Kc#b+ZjSi0qcw7Kjh=iCeYibYR=3Uf^IM@GU~`L>Pe_S%@| z`1`K>bXnd;D5Tmz89Yz!*{C1l>UXR*5&U+Sw>$AoCc?@>yR9~Y}`tS*=DI;A8Udg zyfGtQ%KN!C+7iT>5t|DaWR2gV1$|?!;Vdj$eDlB;c)7!_Tgsi~DAi_hucbt&hE$YZ z`XsHgg?26Jh@=B=34axD$S2{HmR`{t0^OxTbWXvc7_yKED7!<`J#(unxU;lFP}w*+ zNHGO#%)i_%m>3C3Vcbdv#Lw=${q zBJXAfQ{v9A?K8Wf2W4`t{CNFdXPS8Q-=vLNorA^yBWEf8k6qC4@7^}Mj>TRu{(UE+ zsE!8r++XdJ87Rw)CL^Dr6oT<}KA#ti&% zx9$f|Y<#hyhRM8#`LR56KwP3BiB zsZS2g2?C25M}sWSdYu^_8@aBK_2npIs`})DE13(Y$uxoCa)+S&((BoMGA>=+XRM&ad#j zd?o&P6qBLx5L7W?=hO+WC6B0$=jB<#+gsbSUJ8M+(?h(*hHDFl6MJm-h>FlVSS85 z#0iC}J6@mVvoVCp2GzG)FE^gSI+Sd&vjlZW(bjRZzxzAA{1Edi{AMBOk5q+R(Yqnn znh@m5vaZh8;L^5OqjnoxY^YPw>D{+dXI;!6*$si(RCK>}pfJ!s`vcv}KzlfTx9ucW zAED*{1L?}Fx(_Gj@}7sOh~R>$PvcN~m;3tA)aSc9wP1ti4D-{kh911YSm7_o!vs&s z7n>tD;^iZM>xvyHAjwMwt2NZ*?^R(5puH;JDed5)0IG>~PkvQsXG`McZi;>0u#I`J zjR`Pl%QjHXE&OpKCA!Z>d})TEI?we6)?0|Ozo{->dX!P~jA{oY@&3(~2HND1!{8^T z?J4E%=`Rk%YIxtb&^(lt(Mw3cbT-KimvPJN5~=*<+1{EUwKc_3q(9lU(e<9gkgy{6 zqE|8pHNPo#eT(p;Wk!6+K+XitT~MQGZZgi0U%a4>9B(>;=LQAW=m+xL_}9?Qq3&Pt zT9{RdERcEVQ)n4}P7QAxO-Xp=X{;o10vHzw&Z3#P3J;U7gvTBR_vDz6c#b3U^0CJA zzxSrc1T249&9R1laUrX;bvD+GiM*e)a^@JVo>I&pR&d)J#}gdCxfSkC#BprY3f*I% ze&+3geXY9R3-@8@-SxfFdwcO|Pcq4#{(@eC{<2LoXZ4qjT#89^q=0$2xHzCpgtK5U z!zFarVVd5t=gEYOJ@Ony)&{#TqCSsDV1LlMm4BF7#JkbrP-WsZrNex6pQz~+KReit zLQjX05M{aVaj~tDSC@iB72*kHB*`P6b3FeGV?2e*!guzrfp$ZX45IP;Td@VB-E#wP zgC|R=*h)UVy4ZQ*U!L#dFmGV~UcfBxXF@K+WYE_jq#KN3R}68z5augr1AqBkZ0=xo z+KwD-G}_9)wLO_E>&+mvv(WdY!Uu3b8Z`joJFkhZ4Yr-6$Is!I@NRN22R)Hwf?A6! z4{h6Jjud~B)k6~sk{k?nh(Aq#kP`7m!Y4>_Ck6}Vu!;q9i&_7FqV>xgz47CzG=6OE z2R}+Jexx_G?Rf_LXm1R&kJ2EBb{zlTLy!$=1bKZaxKSZ~P{!i63V42&6gx)Yw)k<@ zJHij6bz1O!6&rE-HZRx15thZ-{xO3i?AZInI3m^Ypg8i6Pk|#xpidec@s&HZ%Rk{61JAg)0Dnp6WLP+^*wz`Yn?%k)4<#*EGw1av+{4Tvx!yfG|)(Ct_!)u=6 zV6DnVfRC@T?J_ExuaP?)k`LQPz~j(u4)E_ykz)nx zqWb8YCZU>G=wT+*B=q3?yq*os(fN61;e-VwFVJ?X6pFBv5ERd?Zug6Vrkw9gOW4et z>8B47se(j7@uks^w1F>qI1CB1)Y=3GsC-6N%H-!1q>15vw>s01I5$e%xc^97AnfDB zl$B=}haS8>ujkLr(d&`#XUfrfCfiRrx|Uer&)Y3;poO%8c>elVe6)DATWI0+5`*1E zVp=MU;0aX#qvEOBm__mdU9>Co`6?#0$moAx+nUs?Lx z(wl$xE8l-;sN|E#_gPu&TkFRP{Q+mQXqNqf{}vf9#UFb1g#2m1`8sW!98G`S#cq~- zzZYY%m4yFJ`930Bz7sAzn0+OGYulMfj{8W#ZYBG*THp_zE~y?Ty^t@c1F62^Ch#SD zkps7W*NFCRCq7wLaLeAeecvCMcu?lbebwois3D{)?#=`2g$Z{4U+g{q{mSnjq~`x) z<@cqZ5CQ(>`OgyJn);LsmyUORu{ZskuLiAT$?u)~LB9gr$nOV9c%0p%|6}=$_2T~}`AtibwteOIbjk0!|M%th zxE=k@? z_t|Ovy1}f^2YLE+ll1Er$=-P>;tW6MjludiU$*qwB)Kq8G-8S)PP0UHg(XgCmO#UU zs@F~KTfeiUU<-Q0c}s8NY;tRUpII(>g&L*{N~q>rOTG2^Mis{X6K>16R|(s9fV+{dnct5NFxJh!gw}eLkL?`!UM( zF};-QGOJt*ziQDvQu=kcKm9tiLK{f?QIVOn1&!EDt&U7+$U6}Xc&#I5DBRf3uekbi zCMZYw#R$acmkh&+gR9Z#;{#J_H2y33uH*SPY){FTyP+k6l$w5G`?B?D?VpGhEP4vM z%P@;wqxxULsjPFB>-FNh>NJ~C0JR@ZrGny{;mt$odYbC3X(R^{U?U3j8 z-PPcs)z|FbUNSk_4;>(nnU?4DUH`cqyG2EtZ+J^dTfJJ}t)&REDPclmR z`X7!%M7dc(!Y9&}oN0ZQ#qhuW_by@av)h&w4c(6K5$6Kj)R=T$#_abLD&cUpQeHWn zwZWrpB>Dh3w5oNqbcOZWV}k3VN%!1SaGI`ZyUJr)77{{mV5UB@-U*9Y!XE6j$=6ZQ zy%<{7l{)ybo0cqon5|2H7kw9d0>CU(Q+rq~#1?)t1=nnpHGX0D!q4;}7t=fOm)RM{ zpx(%vT7N9~X#71ag};NiviSRokn{gv`1{o~{^qk&(#SXA?_ghRx4=H+8=kgrZ+|)1 zN8|gSO)X{Ys~7LgEctIlWl}&|RAznpNpP8%vxDOD^(Prz{_>~9|nBZ&@tbG6<`_ zv4pXnzCIe9?*>-~-4lLe^`%sCPmlYB+LDFo7*-Pr6H@JhVekN}q=vA(h1n=P!@%W~+7rd{z^j z58?$cPCLNu1ZvUN2!F+!9qN?h%{sGv5n}U^8(S<}_Mr$2viqjT>INZyY6h{Y+uZgG z`M|N7F42BfFME4*oq|U6%&dXYN@Mt-D4tDL^Z0Gv+xeh+0O_8971 z*<@&lvH%epO+bj=vsB;aJ`*HT*M$aC6CuOCt4ijMSqP6~1*0$3G?grt+ zPP4qXK_0N6vaI0PH z^HSf@b3eG&(=Lb)?q1y6W1X#J82$WAPd``gz19=R^6id2yl)<;)3Ersk6xND4U#NI z?&zgDu|XojUFdfqd0%$*#(ui+_>}&yJtvj3%1o5?p%0ZZBkuL=2=J8tl(=!n`W2cn zB_HZlYx9J-w>B#JgX6cOYTfl( zl#cJHT4gRuJF5O@E=F`z{nA_<-cj{kbHPTy{BLumW>)6c&L0<8XXkgW2b*#Y2icHE z7#MrStV;t1TC4z)61U+n9j;~TopX( zUlk2l={*}&LAD9=wq(xxH#qV2b9VpJdAuty=l!dk_)~LszwJE!1UHvE@lEFMw#;U1 z{U7+XjylP&b?hAfYW!XPRl!idrJ@@Ds@$}>!L+%KW-fK&ug}^2yz}_0-28_Ve`n6_ zr=7=la&v>z_Nd;sJ(w0C`fdJO#&; zf(Mh*@?T`Ate>Ju^?ma7b+=s;YJb!*Co#|gy7?^Cd zF!_OP5enLFD5&UgsR#_{$-hb; zr~7pk-RobC8beNI)8^Q_{Huc7{FcVA_pc`H_ph?xcO3Nqt~C7aun(AI4}Lk+YA4x) z-#q)kgJ0;wbN2SU)C+#Qa@GtA9Q*0vcY!~GQIGmpV<+G4!?fKWLD4V$t1SAs&~_}1 zpBwChG<{5>F2-_D{Jg+#tLRbxYSiR}58qY(Rl(JM`{RG;Url<>zsiE|6x(7NzQ48) z((oNkty%C**asebd)D-vv#TeRjh}&Y0&7BnU7s317y2V8y4SxN^@@Krw)kt_NXOsi zUlr8&qndQRe^qtAuC7HM2Ig$L!HKUil(?1~2DQTw-8OE3y1g0IV+OPhA@h=@z^kd= zPJ<}W{`X>fgu9_Y`(KIoaH^re$3B7rEq}Yf?|0Fo{?(|-cckXezbZJ{AItc;{?(*! z`&ZfXXSJ?zkT43Zz&qu%^9;N{u$^P6bQ8Yv-ipQ z=QsTk6b-r48`Y?r{Hw8h{i}j^e(t>;U+Rx^(#8H&*7zc}v+41@Zy%(`cNw*2jc==c z;E!(*?(dxY)7WXoxA&Yt;KTDiHT^x18o^usRneGl_#@rnkE-Nfl@CXz>bljx8av>d zUi}5D{Q8Sh@XO+#NAV4i05qO{vBEw`^UuHA2Y{x3{o+W!t)g4~t5E~K<+VSy-M=dM zrQehBulZM#hW9&vxzt0S((^apK1k2s%k}}C^yE_m&G3moe}=uh(QEz;dnx|Z^LM&G zf}(rb^2EaUEgTQhG?~m zxv@u3M}H8u^6_-Pg`#`?t5IXV{`ge;lOFbak_F%6YR%PD^{+-%_#-I!^!!zJ;$RIXgF??%9es4_ zxTmTk{|GLbvc5X!-JbK}CvBbc1WHkTV9xI4&M}+w&WoS6W6t~ktc`8f^QA-o)c*B- zyQhX$^-Rq?1{io?(y3eqGKJgDl17 zZ&S{k_x|ea+&t&K=bfF~1h?~_HGf~x>!m|V&CmIz6yx@i(gEgoZfUOeg>!g0t^BT3 zXMvE^R7{s06a==}?NTZ0*hgIW_H!b8g9<$u^QV1x(3yWa*95l~toqVr;{r>*%+CMtjT4;cbI!N}vVqMDJupG% zb)L+=?&_SHl{KZ~>*CWndk1%*MY!%)@a^_vGIIwE>-UgJ>&j0zK*grsQ@E(*s;=~; zy7(+wz)Cpb1ESiKS2-I|b&Qc!Zc(=X;G7~+WKJPo1q_ZhNwZ#MmJ2;_NUB#=qH^VA{t~-tb+|X>{}Q@=xqLpAPlw`5xNye3&jFaVgvsxD z>5JPVMNYYvY$-wU6hYcOfTTL_g%Xa;41a%9Z_|qeTm{CSLZ_7RZ@BW^C@V=mwK) z@h&rQBI`%jEWC}Z;s>^vPMd@jiy?axrAHbFX&n2Xiu_%(0fg)LWk-``D z?_|Bmya}28;j=k#%)LN=X6jF!{(O!<*0UrYT9~%?y9I;#H}!W9JBXXh@_%sv&qqD<)4;vd9Rbur{Vn$;@xr6}nC57ES%i z8n4U4a;N5OB?DLOxc8ymkw-A#XQz(ap-wFz1hZ}&FV{PJb~sFRZO_`e(OVHgb(OCh zr{%d~TjlC(shCt5eXWbW?EY^M{GlhAJ@oe6m~NJuZc4V0u!Rbgw&HwdHjz}+rwKCE zL2o8wQ<`GJ?0<95#1-mJ;!nSrV?AIWFDVG1 zUck7EE>86!UU0lBz8N-@Z#LvGD`eZxFVs_mPJ9e*)JPr3KeR%^uZE1DR5Zv8fUZ6D zc}9f(c{;nn*XUYjnv)3iWwwY98;nN4DGJd^zci)RwC0hih42F(0Lee7u3Yz948rT4 zR1dw^t&uquws?fYD%ZJ>Pv!`FbE%$~{48e;@TSgWnd>u6xPLjl#JTxkXUN<42Yqe* zvwr@rLig=DI)IZO2WipK^_oo0#Bu-2OmMa=GePeP>FAGg1_hGRsD&R3mw3Fzz|!&j z&aGl|V2W5_xGug@N;sK%$%qq8nB_?HeiK(4U8UthU9`ij7IZExoATXKX}uE38*kED zMgKX{v;!r&ivGHUhxDb``hCmXVRT4yR@Ti~DjC>p@mB=y_c4}Gh4J}$(ff4~**~Oh zvJ*?ZWa_m&izQrpXF3>5?6P-uS(A_w#~9SzjUB1ZF<&62`98K%PmLnI)t#+NlZ2u~ z-^u0dM8B!-NB*E>-iqXr&7AKpl@P!+h&@%9?_&3>d$CpORpp*VgACl0 z#WnGBb84a;dRHCY6?y$wCwAJdn#zp}A4-0|6ZP@_0B;gCp~8tYdOE-Jl?-}eA%Flw z$+Xg706-A#N6#rN+QWY0Q{1z92AYWtb|2Os7`#yzK74umyvvkTfYV7hUHIXv=a!tR zTav2J+Z=d!;`lk&>2@2p+X4@_US4vAZlB|JXCOMHw5JPzO1Im%Z5gTC=XJX?U@)b*E_C&q`tv@$So#~G-@|$QX%2n39>)9bOO(ClAI;UF z`FjfW_o+f2y!!@!cwepebl$!n(#-2&ddML9d>u4j7a#QNLHhb=^Y!k~(l3Rn;xTog zTOIhPKDHfr+H~Mub>K0T?p6ovdv)Mx(}8#U`Py{gY14szzg7pHHXV3Z6S7*MpqgjY ziT7#gn%61tHv@!c3ia@B>ccbY!~4zNTlL_XVaV70HU4?(Fc>kStvuUiuAb#;XFwe06}kZ% z(`8bZZ<|XI3>-{P|EbF!(br4->*gOc^x*-X!Z`TznEpJYKQGd+FNOJYMFW2pH1TKg zJoPTp;q@+-@Gic7k9TqR{anb(5om_9?X`-8)gOv|+5FH+h!A(>KR@gn@pr11y)S4Z z{x*7I(8@ohJMroW`cC9sB;CueuS3;~Kt|{W^As3Im}FH-}E{YRhX* zES?rRc}?4Z#pK9fS?2!YH|mAbUQXELJT&^p7ku@5SGNVs%^$yX`|2y+{d|DfV3aIr zrpmP*a39t&Q+70~(jV+_9_ssnQG0ApYqEOU{U815J_4Y{|IUp5zi<2BtO4XE7Ek9Q zV*qdc`qK;`r~&LN_*VuH`FrMkb!#!(&-7dRKRJazXwfB|0k_#Gr8e|MA6r>fex2KiDFRxBKh<>tC(>m}$K0FMc_+;*m7`%Y=i(*SB#7 z0LdjtG2OZ#^uT<3U@?0y=LIwI=2=jcq`7X}a$0#f10&WlR2>By>%aWegOz8ar2R0u z)!NVQK6PN=pw!2e1A%z{wXYl&aNoKoD~z1{LAx`@ z-;G%^YaUm@c?t79=zq9xDh6|&&B2P;`0Rrhhy^P@>hnjHMEs*l*!L!!+k|+h!?|sj zMeY0>47JdS(A{05H)VBI)WpBRBB%Zec;7pDTpYo_*?FOp*ZKuRCqELpbFC`fGWsAf zgkJqlkc%VuH=Ee;bOl_0Obv#Ap5XH?Kaky+qBwFM%pKuYe$bCNea)oBOL4+g2b(}s z|M+zMM8_XtYDbKMnz89(w!+|9AcDu{WV$e14F89_IJ=?#=x5<4ssB`=a4(^t`bT_x z{h<{deC&|vNh2!64l50UCbQaxMx9O6_y%jEgA#{p^>8y_JDs-Y=^>-N&EDTl1g zl08jUs~>=@9yuvL;Qsg)pQuK1;Gp}h|H>jNW3P7SkT@^RSR_=6yJz&GE}y^m)BiBQ zZz#q;^RM;4^OU~*KY*FX9jyMp9`*Zw38y2v+rQIK|G)q4C-1)!82CKCqw32>4LPQx z>IQRB)KS%DE`}sF)cV)E#U}55d`7bdQrR%&AI+OJ1<$+&9Qc*FDF;+Tiz8zi+69Cr;)g41On~ zs&1@JpTj?)BWK1T$G#y)h2(LO-WWhUzXNS%RAaH z4}?0aL@qI>1WRIpjsvBw(DI}75b6nI9XvKi?#5$RI&(PBphS)?mE;6Er|Z=Mc|hYu zjpvOE>~ca~9C`nUJ1f^edNg(swR&aphfv1dzHfkmV3@R)Eqr*C_n~ZiJ1?cc!u_cN zGx_)x8hB1MqfKSqHx!zD_LpP)gsB>;1sq}i!uZKB!KdZtOC!k%oIU8~C&?#yyvatc@Tf17hvM(@P zOw8hr4fLZCH_RnCj+^8#m@8X$1=wBcZg{gd5YRx%ovHx(@q)oJsEJ3l;8-UgsDAa8 zDh+CIR62}Gi&g1J_c?aIWCN7C0R1IE-F%yku)XdKeO%;?5`(VYY{c#(YM76%gN|d} z9BN-QN+$~CbSQSa4$`ouJ1WmH(~5qGY>EW_R?Wsi`oZLvC-gyOl;pKMGGY43~Xc<%Y{64%{y)^xsnC2e_ zK0pBmM6ZJ6ckHJf7>T=%4ko)E^}cMRuyAOIMi=S~!3a94_MgpiEwp?9H{evMaH^x~ z6+LVnQU{0uKmH27hdNe`)?1TF z!!WDg1oDKO^O0G<33RYO7Ciu7$@tm5gIPwt0`tC{n_yYap@Yis?g6l5=LvYx%02{CjfM zS1>m^S@Aj=fcfj=cWA}Ebl8JL7_7LtV_aZ$0Cxyt$-S5jbPh36%a>6oQuS*Dcwp%T z!VP$tR?47CnS0uyxdCC7tcZWPMBv-mI#5GRewnN#_Ucj=0|l>_7HRcSbQ`~zXSci`It(?DtF;Mt za&18G3g+8)oGJTm7x(ymLWMit4_&%8RJfHN(nlxpiRj%)Yt%+%SLnP=M0lCbtJ|6? z=H9r;*)!>G{;M5@VSAbZ#3s+XC-lbv?f6~*`+Z75Ed?Dpow0*K2as8~g+h^^QKIAe zqG0Ie+qsg=C~@|@O8i{M6}o>oLFGL?Tvcuj-Q36{|9i4O-0GN5#B7M+>in*%h4YoL zx()_fX;)Mb&;QygPGBGMebsL8M^8bb5);1Qe!WAP$!|TAS#86+3;OG*LQw&SCc6Le z;XrGR(;a9&`(F4WiVEB{oJnIGCgk@Y)z5r?I}ECfunQuv}W_kaDuI;CVLea17& zMX)yZ&6NTUtAJ6Q|D;dM7fo&?>x(AE^jXr5=eygCiSB#ji_mWlB#?4seEhoS;&pHN zhIueWDWc2)f7kIKA(&cBaer!(-0RlJ#r+=t^w$_tsE6u1|kE7$4Cw;B(+6f2<$d8yxzdYY^ir0ye z_K|@$4$^7}N|h&*cY8R%!klB~Dhv7T+~&nNHi??6esVfcTr`l_n387nll^^|u2hJ% zrX}HVIjGVi@PrfYj5hU>E~rI=AED*40wycyhK-}74W-k3NS01>Zr&eIodfP~?=(>V zpNkpIU_Hpy17!)}a74-UAMmg)HaS=iyPq7XT6cz~`Zy9T6>^qYxGr`vNeiBJA3HFR zXu84m(J4VPhH>`W^y1o$VYP*aJsj5gL%L2L7pYpN8WQAzh=uvwaom~aTh3FNu9F(u z!yVV3&HHh6h=^#{gf%t{XxG%xuU58$a@8_&92=PGN2+iFE2y8Zq8ts#F$_9W*ohtH zRL+FxT?QF?;Lg$x8t>fJb|eZmU0+ZhcTz#`E7UO_n;km zW@fIQ1Q<%+@!3e#8dLNH4v^$b$2r0J*jE~L7W-PlCN*l*T}cyXo~MIB3Jcg=KEXx@2609w)vjM4GQsXgT5EGbEHV(A-bGMRGS1r zQ&$YHja=6hXdSfrL>?#eSK~<#XBkjf6o@|iM@}dW7*rS62)paQ26_W}M7&s8fDqv+5XJ^^z&Igj z@%&?yGT#^%K69cKBaT2z5!FW2PK$(B6B*h|RNJ{&V#nxB6oH=zOC@aN+=~1dj z6Hwz6qu=76FvuG&2B;Q)N@Q?Xbxtf-y#YR6NBFK-EabHbUUfvvD6`y3gWC5|m+%K7 z^z?>=o^P03#d7-k@<3~;I|O${uQdYVije>kj$T&%x@%D+P`v0yzP7p;y(qKlI?E6G z#}c~wx!zSp)>nYu6b<&$83pMwH?cEw;?)dop*fnMCv(7f_T1^t%>P(#?kKLTCX<6k z@3Q*Ufg8-SPxhAt9ZEi)U5A~2QJ_}`ts&(%a|kj0Ov&bA_cvEb&Lj(stSMm_J%?E8 zqMH<}3@oe^(L%fxnS|>uz6TJQGO?KzI?X-G4>GOo56;Hw3fc`Mf6K0eqb#KqyFb5H zl8y&P#nJf$fXi*8>jHkTTc;ak48e@Q*6TYnU@Smd%PEaf1xL9s7cU6B{666h{aw#zcOiJ>WbO#RFz8arJqnvRiRa>i-_uSilo83M% zf`aW{_z~?d{`mGoD-K6T@?g+l^uM>IJTR6fRAqF&&8?$rD{nL8D^36RIvip=pl5uG zPq5_L-@!Kq}CDU%#(essEE2fYm#-SGuo7&D#hb}Tk$82M!4>+i-Zu#m%S>yQ`JCk5j!U3l<^y8Ge4<-yY5VcS&ViAt zf1E_K9B6^5wl229Fu5)GMQBhe8Tw`SrE<$gzutR_Ojrq1#M0H9A`r(neW46%luXfg zRKKQZfu^XzOwmtG1HgH9#uQEQrif$eH+niUQ*^2MoGIdQ?Ak{6Wb^3=&90`XK`L@9 z5$D4vtYLCiYjRA8vv=5#EOY9VIuDFPrZ$eny13X~52$LRBWTQmb*B?$Y77%+dl(ew zPR5(iFEAm-KENE_nalZKCmLWrE{Mf`qeev^rXj=yM@#>fHdX-lPp$^S|-+kURRmW!>WVW=P%k+Z=sYUSI5XwP2B7Q-LE1*WNU?MjB(!B;Gi zHR0&2u*+?&XZZZVUn(CDfWy*pPN9^0?ikB7Iq1j#&Q`*Mz31Z(Rr#2Q9YWxboAAo~dcuWd~FljxK)xunD*ecgip^psxD zv4Q*qh<(~l9y(zSvl20`k4V)A$AkEbY;Okl@gK!dfV}>QvQj#MlaT-T?#l%=+Av0f z{O)No+(s$_ZP!?gb=+saq7oi_=q?)_yzc7z*>`34cpWSK!KvOQ>|#Fz&<*dii~WsS za>Vl=p2mEb#r~0cK%=1*Mk9+gqJxlrE_C0sPOc6!w+m-Y%rRnlh~_XXmEe&l-PPAx zL<4@_3wIOhkk`j-m4#)7RasDe{Lvj~@%rz>)1OMl;Vsi0_ZbSM#$=Z14eppr!J&^@ zrk9++th61fq>CMlUurBX^(0;u|54UrT`TpsHIc1w$Ogy#J_U{7u}gBJ_jV45RBbk8 zj;V{8)u2}LJ4{KI)mpL6vNAVn-a64je;t2^K9kXaxl0abRY3O78c1Qb=?@P*vq>EX z*4OJ0S*Hp9Z`umg#cmOCaXz@Qu4F7LBUNYGE@K!7y6@uCp_=qs-Eoxvw>nZa%#`|! zx7KE@-bB*sox-29Y@OC7Foh-hY?kX^V!7^cUCn^Pj+X0Bjum9a(hQ6B26EpwssiY9 zr)`s^zGv~7jl$tC*TZ3bZ}%Hcj}76 z_^3%M`p;d_h4|rQ1Fe~~&+@)6Zj{E*Hi-^?93dQF?sg=FaK@8zUuA?JI!cxup zX?40Yd={yCvs42G=grzb;oglWrr*Use779`*7D6-(~GRfae&z-yQbgJn$;I$Cit4E z7^A|s&0J0~^^WLeCeZS~#T0}oH8cX>5vE+9^*_jOmJgu^F2T-V8BsjH;dUt6ES_ty z`qCXLK{%iS{19MenD6pT8@~Aty~LXDhSJ!<&39?lq%=~s_Bh~#{YLgXzQ-)}HGCdW zlyAQ?%E>3Q-_4T#m~Fpn!^_MB1-dUs=wf?dF>Y)RjZzPqG&0#9ZY}NLxy%oZ*8C9X z*1*N%Cf@qT=xMSLxK}=AXC^3iRcMR@-NkIK^yOXeUnAf9wGT|5OUn^sA6WG0$Jhtn zL0o$BGc0OoP=^?ba`&R;&-0B0Vc$q_h8?EAERW~sz2M8vLq}NI*&ym^(l8pez@4Y1 zE-qXY2oj2-4|Luw(7>qOyWW>VmQ}9X^7)2}n$UycVvc~=>g3`)fLR98r>CBR6!T$!(@~JQy6LI@soOCu$u^Q2<0X#Ed+zW2#SjB+YkGRq@+6miM9EKn!+i>e; z9^qJ&7Lo=H)wpM7^|yEYiRs@6ul^FOlMJQI{qgHyoLnrK^k@2KbW%fm$@QYOEcz;z zbrTE64k6Y}e>ZiYi)M7@7Ys3@iZ1)TpWoH^qR%6S3hoByD}jGVXBiDzlOLUFWBxdD znF_bM$6a8BP#F_246;Ec3|a0wNz`b}1FJFE_`PsX@;i`RZdgS})iWc6!z7^{Yj~=X z(2n9tNoYH&J`|U1h0hfHkYbU|IV%h9<^nC0XZZ;|+caQh{>@yZRPHPmB>03@3{CS7 zScl9K@DEtWZ%aE2f-aFF4$>x1c2C3~*bBdn8AB)y0k$YVius6%;-j?_*1%mK7&$JG z_OAr-t*o7j=KSlLSiyhuYAOI+(mBA1JluFJ?JYf$t0rAFCl=w&dbmZ`I&FKad#@G- zTDS3w2P)w1ByPS}fAY^b?*!(D5EauQxVK|==;~;0k)F08x7T?ZuRFXhFOXmo;su3t zh0U~PIhV!>4ZJvmzHZr=i6Xt}>t5CXnE>`MmkP|PlNkHtNcW9@^y#w+7~risQl#nf z_Y_aW8nQ9m+0zQ@Px|py3@m>3P$#}rTfEWloMk;OOV}G0ILkiN#eyYH{JI=Keiqw= zYollHa^inDnr%0n#qI2Qv9@d9IpU#Rujkf{ew-5yG0*RFLUsF`%606C?Rq0uiBVb* zv>F$oFh&0uE>zDSZyL@c+=HAL(fnh$O%8H;@<(w2@NQ=A%wE-vYt#vM1xzquz@YOF zcG>d}loZ8)W7%8MP?U$}F8yw_`m-jKjhvSWQeaU-VO{(`P0xF_)JLDM-Sd2H*K4`8 z z)u1~hyE#L7YHrzj%^61OpX)p@JI!|gOZwiuool$gtQvFIdsNc>(f)JGe=z&{`U`3S z#u$V~JpZ0@;um*bK7nLm(E~?Pe!00?VGksek8yFl`x(8QKmK2aM@#kHAc$EsmS+OR0k*i;bqdbnH z$&CA+@SDxB-L`VCf6GNRQz^C$wfQS0Oj$6}W`Dvl$5149(R9N_gI`84W`+NN9Q|nRs=Ctz4w!zeTdh7M7F;~qk z)QgG(C)@c6Dj$c3GtwjQe;XRZ{~d(C zj=+CovF7$WGqDC{Q4-_S4hX_MsyLs~8xc*s$5z51l|l$R87?)E4#ZGK`1k$Cv$a;_J-EqI~P4V&k z@$a&ABJn%R<_cw+fLRWSer+XPK*^)|Won+^Thz9jzgzqi)A@!DTxygtq?kqd_Qulx zV7~Q7Dw@ZVKzNG*Ev^o9(Q+cOOC;pzXZ}y#85U4#A;X_mzb3(I*jD~|t?<@2uctYB zNAbc))#4+7z1DFskz|28e!GUiwWd7EPD%=v$?7&s<+OL!23d@yoY}p)faXn*1^y8_ z@sNRR<({@_cyly%roJMYyV2a3fkw9igl~GlxZf1txJ*C#Z^JS{BS+x6hYOEE#q(Rf z2)i7{6ZfsF5uxr1Al?14R7t^S;gue2fJtj9F>$vU{YmVxmhLgNk*cpBuKtG>#wlY9#~`DL7xK=`0D{F6A%(o8x_G{^0x&tqIi46M?BN*`rWzQ+`3Mp(W6Z!D zTdO9;JflZM>$=}UKG;iD5p)N6hzR|5%Qx5$Uips<{QUD5X=rk=1KW3r``SREjV$ME zDsaCES!ORHBH9h3^~C`I^AYE-Sonwur|_39HjrLs+aV{genC?Sbw1-ks6nkYqR0P% zcUrBpAVrOitSyu^pz^&?{J&H(c70GmX_W_VxOggAtBR{T_Eoj!Po?Zk%{G)PI>5Mt z6;(7WLpet4HSQ^YWG5U`4)9b0+@vvDG3$SsK+CJ6T_Ved=S6g+9_9hD8Yb-yQCis%38a&T9S&Mm*vSN}9lFMf2k z5Q`?Q%Fz92ul14E2OZw|Xz1Yvh|AvEYXH_+Dy3UOgN5_Z)raU|ykJAwFxlE=y<`33 z-n|drtWkNTX&EpZ2S%9lQ+N4`Nk) zpje0LlR(OXoHtbH&I#1s%B4`kmgfP+A0V^Ai>1qc!~I*^eF^VLy_dmOk&T zvvia0Df$w>iYTN01IO5+J9JC^^!d)xUFPOaukUx3y4-8&_#LyPddPel{j>0Q#BQx0 zOr(##mAL=CJ_b&XsA--c*P$mYhy@C_`*$DW#%jZotRhU^yzZEJ?*p+q=>BN0pl)mg zou!HFw}tM_dP|#Tf5x+I#w0>3D(A**?Z?tv>Zf(dqj**O*MrYsJuqtQH*QBGqBzXSTu08QC-cL=M z-^^JG>REi!ACI#|%`8DkP5N%D-eKertaQIgzuuH_z>mH=ce?$~PT94^xaJ|%PCILS z;!=zOMxXR2%58fuV^j|r%rf>98YK^B{^ZJG*iQ=hOnKX)J2lm#X3QCesJJ@|9)>-- z4|pWU{CD5ok5b_?M}7@|Jjvr-a27Oyhvd!6*iF5-8u{?l`*bjp9fD)z?_$3(O=n^M z`_n(V{t>FbwV(Qp>f#R1YC!l>oU#5f0-=A?mKkMT{D-CY!*eW)VeRz)(Dp9yQ5M(# ze*y_4+%`ziaMMI12DO^trHP1cG{CdEfuK~Q&~ItQNUd!#BmucdUE{aUVG5>T#Q0w{u5<>KX8)(habTwC*de`cQDB!F$d|JUo!>&51I=9xJ&bLPyM zGiS~@lVCCHnAU#Z5?m{fX8J-;@0KK#CuYn%Fo=!!q;{wY( z>DBP|n!vK$TdS*oTz#2&omq6SsFeVOM71q_L8Daq;v{|%x?9%-OWyEBzl5*(La(P2 zP7s@|YX72H`FEBrVw$mzTt2k4zV&S1{5L5P3_odt7YABjDKGiR7qWH{&*y7al~HI^ zAoP#iITu4eBZy~5OxQN37>-$6nCK-( zhvH%TpbmhUG^)V2M6HqyS+(v<6ykIbosdMTDi6PhOc@Bj&Z}V&^YevC9i~hbmlAqM zESi-~0MV2f*HCbNb9ZWa$r0az4Y1cB*JT!x<0_(to|@{f|7yCgVK3Ecp)>nDd@Q0* zlMujz40X=meW9Q5=7he=ol}6Kt@f<)h7W5`S2rh{CV4|nQB~=Sf;q7{vtzJG8 z>Y^^3ykqnvNOW5@&6vEYg9a61z$f%?P1&if-yjZS;Lv;VUcvCkJjT1&zvBPPfD(kF zCX9fh_&+19bcIeYW7-qY=ev9jAMh&qV~3B(W$k0xxKvf8 z#BVvF$7dGx2EMxzOBU0OlZ@rbx@__DuloF+`fU3O9k7;qeRYoOYy9e9_^Vhd2O5T# zDh%b1EE`=%3B|!g;JIp1S+)~kyXGM|5PnPAG{H3T1BBkK`W$E3>mE-G9Qx2{-rL!U zrk%q7`oNG^0->YX)&CRIhFg!m&@tf;E}lV(nP$NuIMA=j4j`(f0Ka`WuoiyxU0qau@C$O8 zhe>=gKppT5e$|WwekTaOftLT@@OvJ_>;^dPb<6lM>+3MRU8k#t;8|nWFLsoBY}zgO$35Ep%f|`PJM`%kCn@V%dC=HnJwXOcGn!-R zp-D}RLz^wux`93znmipiGy;7&>-S;vF6=jky-5rD`kdQjr z?X806tES$zOnsuJ_a*MznjH6OuYhCVyW=s3H}MT(JCrNh^PX>bHT`#6sS3BoD^=k> ztpcy|YTNf)TWTD0*z~HJcia>^^B?lXsroETJO8du)m=^qup(Lc_hPBI7gM zr`hMk#@Gy3B-%32%Rs07u6wravLF8KE zRGP#13`hAa1FQmff4+xFrLxJjwBCm<2|6aL? zZjs8p#%t_ZTP8O#d{T2*@|x&go6Mg|e&ll%sJ8_!v`DTU>k(ry_!;2kFLpPnCwK4~ zA4h|(ra{!Nu)$~gmfH5XpPywrG0}aJ%$7f>z*+7%YT#t?b!CXAXY^oC&Lp7z@fQH~ zR8$XN-mB>6%q0BY7XHwV@W%`Ose;d$M_c=EvEZT4j_}X7@V}je zKOhPJSr`Ug+srk{rfS>%V`7I(01{h?@SVhu#e4Cig z9v}uk;_nvzvzo-w^y@mppDFm43jVNm@GbiN@RyZm*zyxCeu5VM>?HhQN%&(e`~y2W zw10r$Zv}{5A3M%0+CRP{{7+$eG;&Z9{thJ={Oq^9>8Bmx8~LD4@MoGe&eO-)4iw|x zb9#sN-)rH&xF><1nI8ON_kIh1Xh-X)vV#63 zcFuDlwVEe? zV%@!~15~$Lvb|(t8Fu>#;PYgP$>__yrepRUmMeXdMt>RL6n6s&ZiC5`7;ALHl^kTO zbESuHGxaT+zBF0lVU@U^)cE)WeliiA0(k&<9(+% z@};{HuHzmQkmJ|K$Dio9KAu#Lw(|3*w7Y};KYoW=m}}JaZn2=#BBPNnaM!EG`J|cl z53ubIZcnsd@~L~PDPqpO1ZD{Cd>Bh^^KNC360E?X`EvjDR-yLUP=T=em&r?HY^xIzY|Yszh^y=l%gt=XM(q zccu>J0qN=YKRrRe|73nHkgfjh2e2ql#b4>s-9-Mnr=mEaNxp`mWZ;MaGriSD!;gIX zt#mA5nz7xoH}}}n4ks$F3HF!nj`vYavSnGu5J>m-u=(2#3k7cFA5K646Tv(G$CCBl zMk6_o-y`J6LyelaY zAil@EBEj?WU;rB|A&&FhBNr6ZE@M+2EJ@`+=iJ&qO1JTtpbdFL`%fupoajhyC-QXB z9BSB0ID&aiPU>N$Hz|)9V$St6#6#SfPoK~^3El|o(3UFqa)b)wndlv2C}kWyQt<%pbVmE!C4O3}ykmwxZ`-t7QBZxkges*O5TtEiJ= ziyDa@G$`Fc&39Oz$*L{7$?9okq-)PLc^>fYXq#{JZq~lP@0*tk+yhpFLRP;Au2_Eo zSHa&5Q*+-}yW6Y|NkZ78M%};M97Wmlm6hAU*Fz=HFC5N^-ShZYasBXH_ZM(xepdbPZ<~ky&WZ~s-CB3y zk7{9Rh|+7}6z~~iL|qu)9y*rk zYcN9wR`By-jshuzxq^Mx#^VlP;V2v+`co)hty8bUl2tW7C!mR`kXj1d-HMkLO&|UQ zjPpFfxRZ5=Vg=4EO>Vm7s?H63?5B_8v~=^e(A^6!b3e-Q)<5@{1=H&~a^@)K?PC~$ z2AlfHTvE?eYId^x)8d8E^uv$vX^1`@Vb!))WIqw;djReJ)|Ov3HUTvos4(dB-Sh01 zqF4BGm5Q(M1i(VK!a}|&lTV^Q!`~M3nRcJAUR@~o=L-G^3#Bp%|M}4%+x`4e275?* z7HrOUW_x3sLEL9TuC62A^CbQ@)&5uGjPWLn(u9^q5;oVC&rm$&b#<4qw)Z@Y9HPid z?u}~9jodA9!3K)<(6?9kcEDGuh)g{t4=Epmlfk*LkYXS0uaSc?-0Nr?xf$`;Z7c{0 zeXFrQZl*}0jpXTDWguRFe_ma=t+-{{AgW(g+kHl+FKe9z%!4mWfrP15?Qjz9{XOsn z=9@M_;i0%aQQ3$me>c-(ozv`Ie0D1yK2EeTmC4b_G0??R&vDXUXBRBCi+g&w*-)~x zWe>#dclxb&^0=CBJICRQO26rVZ^Ej^j!i(`%W!XBoam>}DLW9?& z9*$p+v0?;4;6OZ}^az$ZssAt<=L5PX>SB_zaC?uR=Uc+xH=Io|Yz#7pzM0`0?Xg+6miwwC;Vd5Ug%tO z$^LzOj7-mPias#QI4jpX&Y_QK3wc0v^FAj!m8y@Lulv-$X|JlOw0l|KXb0e_ zjsQmeO8}OC>jFk^{!BSRf6L)yBShjpi&_-MrGpId>4}o1^+7L_wNmABq=&;!@9DbN zX1d;{7bYD;VP3hiC!HvnmgEW1^BR^PpI4HRQ9Qu5BUNwOh-g<7P94m8eRUw4KX z<58v#Cpsa&5D}^|D&?ExBLeVWT&)nhYb~9!h8Z)X!Lc8r2!L60%OEor+KLb27s~t$b>Zk7H}wIHbj&Ou0S$ zIVy~#ejU)+A7Cy*pdNr?Nz;w%p@77b!C9{1&*P`7F@$aVy+MMJ!LxM&pJUzhA`r8G}uYG)$J72HS z^r6Y`Q@!uGri;#yb?z>^M*Kio%pzMs7Pq?qhhA|yr~*%Ys6CQmpB#^$IgE#gA6ktv zOHHrz{L7$;`sq0-wf$UU8A~54)P{*_D7eCF%(tXs$b7E7>! z>Qcc#UduHY4Li~6`e6x$Pr`nS|B@{=Lu4wIYgpKRccW(x(4h`}PE?e7U{S>oXUHM$ zE5zf$X>LUxJrs=g80HMwUw<^K`Z7bnvYaX~*U&oA%6=wV8P|fkud7|^!5Y8(9XRu>t5NvPu z^GM}%cT3GF^v>NUx=x_4aFH{_*5?*;r@`@rZOp$6eLc{A=K^7tgFeLi{oUa3FEVi<*--8 zouml)+)f(?xA7~S)GvAKL?@>@&0h?6Qomvc(3#Xl6Ee<|RU2Stt&t5ED{5%hJ|a_T zcvyn;a4uHbYy3I#xlyEnX!->hcde8ajk{+A{fegdNG5D1!D7Mfn&>m<7yo8`m3`Sx zyZJmfp~Rm1>BDBOTH7Cp6U)V#{L|rgSMdLCalgC8{qB|#(cL9Qt#S5Rm!F>Nw65ij z|3%~I}5Q@=0s{$V{I0il=Gwsnq1Tx`<(5qZ^`tG)KS z{a!htC{7Xo5&vBj z_E7E{(;STUz2M6}+(Y|LO^Fje91L&KMY)ycQV_4pSZvr`Na7x0&w@%Aw1B`@CaCiE z*O+D8cPBH1ov;5~ezJ!JOV-Z%Ah|ycwPyK3zo!8@Z!SKsJUWmYYR3~^)3!elI!61Y z8Z3{d@x{NqTt*S};U72x?P*l|ee=G>_tDX^fv1lMzg7AowWY)_Di6O?8v4X1bC5+O z1f#=0JOlp1?n$rQe0lj5qZVCW5NLfp(7ZRzP(XRZXS3HS`dpW*)&T6>VDzfNR6qlC zmKKa&_cwfU0*BtUUP#-hF%1MB?F8yJF~`K05Kuf?NQSCzN;1Tlaa!2-RrwEpma)paR-K|A(fH0?C-QGlz(X{M2( zZ_-E^AdHO7X71xBMohFhd{66bs30UOYdV%TlDOyt`9FRL_8|tp9{~?xZh3&eZlIf1 z8qaJoG$Sj;+=np033bYkaZrWI9XG#)jC69jG9x=D=S`8 z-MK6b7qOBIt;YjyJnD?=V6ojGRJ$-wPqZM>dibLWYwaHVBYV32{NTA{`uI`1=k4vD zUvKx^%rpDzb}7&B>^|L=ApW~pX%Drfx%coKh)z%V=ZU_f3RtbaT|T+AwFz6SrgE;% z#euC8^m_#In#ahr(f2At-$$YEO``8q-#odFu%2;adi<_LV-3_NS( zq6s}thyA7n)~-T4ZH0tqZ%gR6xZVASq%rV4PCwV&3Lu6Sz)R5Z585~TM+sW8#J-2t zvS318fe*^V8v=*62e?POJg2W zQRLJ+)|6%603psO(d#s6~|_6|uQlZgaJ` z3(4iKN;eW>-De5$Z!D6Z+d}|C3P$RzZB~Bw-KP@0b)UJ{>t1X`VwZ!QJ?mD-_u>|3 z?HZAm<10hCSIvt3Rp#u>qRlTM-lnig46QnXWLHp~)o3F9m`f8fIB;A&pH+PHKbEUv$tjoeVW z-YFTAL4-1-$U<{IKwEC;j?DsoY4_c%0WjVVHTrr3Wp2Q` zb@3`cRsV-SO+1FzS(Ig#(M0rI0N-h$de@X9tE_T${f8Z2mxg)ci>pX_*B-r7Rz9I&g5+o11i%%%@NXY(3A*i-9l-`{ zb-Va(Y&zih&Rr$#&t>bRk@_z*QoYO8WiW~C{(^6i1{e*s?R=`vb~}iyvVv+9lWl-?>eK{r=h{?6iF*NaA*=J#E&?#`qtc6%TG5 z>~_B(wUkS94eAn&okKzvxJ+~f^x^042Er)m(!2>KNw{?b;oB~{GYh@BH7{l9{7Opn z*0nI^eJt`>jpdOP$$Y**NlxvqK#7x4i%8K#^rhqU3CH8u;BCf@`B}P^11%PV>&ri2&gJ z@);m<6nd09)JZ+)gjvroIb)T+Xb;3^KXdbLRie!tW0(k(@GcDjGun{K38q)w#jw;j zG-Yc(H+y(ZIUpPsyDPRUJym(rko_6p;;-P61|?sUQCrejKYYR8>>M;2`EJzdero_N zfpOESo=0+N1b+UJzF+8x)XLZtu{Ms~XS4m_(t;Fsk~I1p#hyZfEUn$^Nw9S8E?Q`T zN&gUA{IBU-J0GTe1Xrx78OSRa-M}z!FwWOV$*Bi;kwboDR!deRgWaOR#`CA9r&!hp zfrT&(f5z&sA7t%sw%Ps7pJ8lf63zYeG2s-9_?C>#KDa8iW;723>|FH)RGTsFGKS{K zvt)t;DpU-b`oH%M@E8@BQPKoz7DI61$j=)8_I7FejkONI$D z)E1%;=mf^MkV9Gqc)mFoTJ)&5IjWHxjGX$Rpo!XeLrb%?1}?oOOl(nWPQ6tu9b<)EAx1Mj#mZkw1C zH|Vp~n_2zUV(#)&NAs$_e@b=XsISD=qf-zOIzjIt#vAbC{Mx3?*8>{Z4+eg^Mr0j?=;yR z`x@U#ufV3vi1e2vo4WN@>o`VaosH&GUmdeX9yPskw=GJ1RcQr8zedv~(a&GB0GDp! zEQ{91sJvDyIJ%tIYrcn=Pd_1#;&{(QqzlcAZctI(1TDfcH{0XrcyrP zibMygIQEuyH9RFd2D4Jfi{G#v%axy4Uxi_}J1cuU8G8z&+C(BjM=lBtui6fO5LBBZ zPRqTcOgK-DTkuP7$)Cx(S@uQ_WS{(QO%`I`0_OZ3HIQ#*j&X^b`^saCIXn!k)bnIC zMr@QG;~Ab``xr~+6n>CGHB;P4JX>~xdq$Rfi4MT&3^SJ3*x=-Oo#o#$tnk)H8yex; zTMNK0`bl?XUscxg`PTU zOQWxCdK-Ohh+{X{dNG}^#6=)>k+hzKu9Tei z$9FVx2rK%6hd+OFtsk%E1u^9itf%MbV1fIsBE8wa9lHR`*KsCe%E;}PhUXGTkHR(i z1;h=_ivLA*f+tX~I&<9LVT^BvLmdPQq{Xf~X$Nfk?`>;8m7597nq~DfO*KCxnu!^O zELs(BR{V!6)R_+$#FW|#1Rh3YIz#<(N;bXg(3zThI9I+p5_l^a%t#sR7*c1ty# zX~u~)-`26_f7}02Ui~@4VGSu$eViLb`*ymvFA_+P4RPJ5Q@|}f{nigoS(XN+akl>3 z{+#+V0mER)oM#%*Qhj`tp2Y3Xw^V7)p(uVgVTOZC&a3D`uEKpZ0?s&V(^ zUWO$OP+Q!&ebqnXCTc8=2rqI2Y~s1evao&m!bvYqpERiMF+|nCvK210FP(F5>upDd6w`9BH!k1Lp7hyn z+>e?VGd#<65*#u?Op*`L^uS9H|C5)At(vtakTE|sG<>Kks)hbKOo6{GUmC& zM<}9x4n-5ZMDyPrKijs2Sq&?R-Eo|_XvgR6w(%)8JAzdS{iocO@BNEm%;LA5)dTBp3YIj@?xiqLp(|5r;)omZ zk2T~K!f2(0a#(FPPEXgd$A58yV>L-^_mNMV&06hj*=hIio1MHC^%B{1o&JL6Rq~v4 zqF3c4HU()p>NcE~4VxG(7H0>2_x??7Hw3cMc4LpP{uQM~am@BQpa=;n390GGk%fn@ zB)sHVzz)wQBxEOThCW4|J%X4rX>e4u$}T6ttb1|@gY?g?@* zI653mWVJ{fssvqBoO`kAeV z(n0lP;|;Y>>A6nHzS-xg?aZ9A<}4e$`A*F$(Eh5L?G-UV!mG+7BMZwTi_B!jSjch) z_KMvC%M(*O!1;Li9fbCPIS4NgKdju19%J~e8T8)m;841Ehtgsx$CVC5PJuD7rC@eT zUMUtCbE*e*?stC!NEpP7HIH83Y~IF>pwsy{%gE#Ah?V zcWh&7G z*Q9EH)HeU2XJ#t%f8Fd}qG#eTpJe`f_lf)qCScf!vt@Tuk;ge0s!X(jY=A^G(X{K( z4g6EO0o0SZ3082VkC1UZD>$HTSXN+r1S{CCG|LK-{7?6#H7gwmC$a=}?CV$pVUXIf z1Y-8Ag(HX`3}vG|2gmJZ&OgNtKDs76t~o=wEA^D6r-^!k+b0-|sgYd;N_#ea;ry^n3$l5Q&wK4Pue?Hh)C@LSy(7dS+-1Ud0~ClYf_S>U#*D+~ zbscqHrv2p!`N^^@RwKm)WGh*P{#FYSfx}K~RK*1=)fe~UU35Ys6Y)c%>EE6R%JPM> zADxrfmAOyUdQFW#+7V+N-%R~868NhpIxejE|R9nn`F!K<@sU_Q-8_|Fds_ z^bv_Rdd>Kjnt^>;RlA04u&N!DfT-`*UZpjK;X)P1?R%!x1$v}w#B5J}*JNIcYDE)S z^MtX+M%Iowv3~-Imgm@(|1g=*HQ93fgA%Qdjb&&$B9}Me*SFwj)X~2EXelOn?f?FX z*zSEoDuNaX6I7>8rh>tGIvf6#_tYnuz@$L+OzyCY?5N~7()jhwxbhu&1?9*w_ zs&2NAiOw-Ckw;^>bSRR+s)6kadn0%J2lFM; zccNDV;U4E66AJH6UuiHY&dTAohrU!XF65i-;Oevc4Xy^OWaJd~ze3j;9nrNO_4IKb zA5xA)#a6ub$_cQNGsu-qsD%gY#?;CS{r)pdZ~_v!rADGmme7{K0kzJdS|P{PHJwgBK0Y zDd}BzXMouj8iK}g$Y2?!#dMI*+5zOGPh&< zx_4|}Z05G_75NGZx zeGGqTgtQiS>Q6*@QcN|hpVhKV0BA897sK-T+g4}$C(B>f(VGO0h)exum$Or_H#hc` zp~Gdq&|i%rABU$QeL(ciw(ANS_{#n@{Jw zk+7A#E%8bG^)vHv%#SIjYaZNd__)ldBdq?E@9tKYpZ&ImyB3l2QgT}Q7%%1ZCm+qm)LhLbVLZ7FJ;mQ@kC()=#m_$yM>nBQ zD?~$)`!gV2jlVW}8~EC~Ds0lsR%}7W!RFMOVXA@6PmLJYe(5LwQ7rvu6_8do?kGYI0(=NCqot zdCGz;l>WZ?f8bpiBmLtKD9p}fRFTnG%{^5B-=L{Vj2nRo_@2$q2hOYN|A_gY)pQGn zciMwdqQdN?g^GC5*TlXnBLK!}g4UNncD00z9`u84gRx)R=4<#9RhKOqmwzf7`B~$F z(f=Yu&^BN6A(Gvy6PdP98DUo}l@9`>Hnt{Wo?&R%?f{5iYEx8=zA;@w)wnh--^3(4 zgu3`R9{PU-HwSP+xi9n@h#)q4EmqV_N#s{f22OzON4jJ)#3C8K|6$=Z;xEL|B3&UX z-0+Q>80v>6wdsjzv+0iQgSQc$$ex;k)iA<`YY8#_Fz`Kxjj!AbWL7FpN#WH-eqJp%8}l6f4PJ zCeB#QX^0q!d&4m;Fs8`>4XqG--N4J{T)FIEuqh+lrf2u1ryVKY= zVXa)WBxE3jU!ob}xXaK^ABRG_#N}cpZFZ|vt=)g~Tp`d-2Ma~#cL^|e{(k^t_80HW zfTLi(p5peBCOMkE0lQA)mIQw~h9=jO)C#}vv5MHo;KOo=f6HHvp+@<){N;ZjDvw8@ z9?@Ps()Z~X3XuO9_c^*)>Zb74K;-Viz_Nt)CfIo)kW<=JFy&Is~}#OTHCLF#Ws;eO_oRJyDBZ6lXq-k>pjY)r^rwB)UbJ0zuMmQ z%b%r0if&gf&3a!3VF|hM1=$swb!0|AGbRg9BjGeMyWdv=2lnA@lCKV}(j2I{nc10H zJ&wh%_G~jV-FYbakE5y{2u_lc&AdY^3tKbvv>X2$)`NZ8$@a1I|Etg&os3iy?@@Hn zzX17jH5h3M9|*6d;_$K99&uYOA#T6h5@c~9X^Dly`)k*aN2$geU)Tcif$Iv}Y3Mt@ zWJa=`mj1BO((~(S={@}|qvnK7=7!D0eY=7FBc2T^6{nthY9nR?J+}KqCT{ zqs#XYbcb?fR^KXRTox+0fbIOga^JJPb)h2{Io7o3=7lV6ILm_2o8>$hD~j_p$>?DC z4>tlIQ;)fy2s@FA7{k7{9lSJ7FbC1x(*Y-M zp1B_jT(D%TU}<}MNZUOk05d9wv1E@I`&R7As7`CxEJKG&&e?2wS=+UN6V$`;Zsw27 z9#goUxP#z z#{Gd`(6Tyq6ZHzGt*ZkTlE8c}!wbYyqn4}DGSO&3yum$F0s9gN|HY=+KSVi8-EUMh zu`5wpIGc_HQ2Qp99bM+;-ZxfL5|~BZK=7Kmsy!kN&0tA8JsewCyeyc7DPU&DcFqkEF~3gj9mKLPU`i>K=Xp&YHR)V!2&e&Kc3`*mZ zR0*OdXCYhEtaFrO%g5GJkVKATF4?w(yhGBr>krB^qeO78U5uzXk{{aA{YH3> z(bfGuJGly+drJa2qOboXzOiq?N1(@Re{of4`0e}hQ?jgl?Q2-dH`x6}Y6U!b{zJSc z&0}=Gg`Ayz3;QS=FPzKx=KWN(gw1iq;kkP=tCs_B^P%hWMOKZRAtdip8i6c zfXhdE`vWYCsJ(WLW>61PD1Ff=E@IfzjJ=WUORfe`I6a^4C2SmUMV@uY-F*;C*Kqpv zYV_Ll3jX+M+cNF^+%BTY=AHeWbmm59v00`m_&;QYy zLL2hla5C9pX=a3uUU_#W{lAK8;t?L6atcx!<8vDwv)Q7dbJ!wfH`5(+Ne#zUkkD=S zLPFQ8PtTnK-9*#(%_KqF7x!_KfH_sT@5tvV73p~;e@@WiZ*@v8Ih_x+TVme=E$%(r z4Q>85E3qE-`%sfQ{iwSC4MM3=$(@Oh$S-@K=OwmG_kNVY?jyxLo4W1(X_);q;t133 z6n)x20l+;0IE~+qzZr;UBp|v^3*fD`)bvgOG$ZyFhfnSo+f3dghdo$k{4Ka~YTZvP ztWU>KN@J<-kHK)w}a;E*h|7EXMcLU$u1`GA!)I|UOH_MEk(cqaq#U7h*CGI%Z zA!;)Tjc$+cu=(uDV&<*??d<;u$8DK_XaDD!;mO3UiH6B3Mf-3VcC<00Qz}z;wWuE! zu!m$s6xpqmY^v#6v^iEJZjhcuE}0&2vOD|_>@6Y6F3o*XN{tnQTbjoK8@vyJ2t)iP z@)`ApoL5wj*+p5?yck{Pqp@o7F8yKknL>_$z~d{$nN=zly?gt|2{wC55UGFinDD?2 zT1KXiiT2nYSeRO_0OeR$JxqSVni9k{0e_~{^??=igXzIuAazrqIo3Z&Jd=f6#VnY3 zlNI*zFBB?|{9;>bDrU4hd<{~FGe{{IxeoebbDxyu-FR`w{D>m*<=kh=dhW4a@%rUE zDUB6&<4P5DSKX=js`2jL>qXT%cYD;B{;8R&QJd+7jjFUm!^J3)t!it0>HN+fH}!>X zp{DXk{ua)sKJ+!nd^gDOOb`zOvn19ShO7FMT`?MBJg6{2Zq zzl9-P9qW@~T&dl+rwI9pS*W|9q-jh{MNOlL8i|UwigdQ-k!c|OzY>kF7p=|jLaP+7 zR@02m?sRYdG3%6^YH}=NNnAh zU^l;dp-;+7lG)t;-}eZt7_`dL)-V8O1AVm9%t_bC=+hz{7dD^#T;Ur%$Colq zFy28VsL&&2P41cGPBfY5uEN_C&h5%}d_F+u){4)d1pY^Y549xwf8DC%Ni+MKhtZ$O{QgU=x4)1&E zivn5taxTB+zN^0|eOd3p@Oq+^e|u=Q(r{r|j{{@vP!w~FVQ1MYwSe>3BKEx+LyTg8; zV!w~KE8S1NL51)o)_?PTettbK!gi&*j1>3!E&Tk*R`$&*GRw!Y3jJ+nLNc~u60M|T zoQAupl}uV1f*dCK2^wb?!-tsLE>aireU5K|Mmj0qOSEGV3^ip)K3IH^N!@543Yopk(eon3vS!8%U``f*20_`%f z_y_7HFyjP?P9BH5^RWmpjgQ^TV0nxAN&eXV$vQ~iYk$Ff1m=xN0Uoa&bx<~iREdw0m?NqkG0~Q9DZ>cFhK_$R@yi<5}RY~bk-vX&ueM_6TEoU-2!Zp67cTU8; zp>t_YRrt<{zNL3j`=RRIRV7=Da%dxNNk$`6g;MI&Duy-N?e?Z2xL>~qLG=Qf`wL`2 z-_kNQx5@n@WCEj~@Frio>+4MKYqop8D5wV%35i|Fs{P|Q(?DcbBug9K(#*9!q2l7(vvd4C=wd%cU8T% z$?%#VS0`v$dtnd$w>(0ymft;Kn(fKJj{h%^pS}kp;GPAf!Z$0uG<5#_)4$ z8?K_Yrz10dilQPFp(vpGHtGnK#=cZ6^0W)&~*x1&4{ zy~n8Hsg z=wrlxW+H2A2C$ftO{S>?K46wqaPq*xEBr>Qa1V-JQW@osnxMs~GJ9hI?_A2*4{?xORbvLjNK!X)wy7qgorw!VAp6 zw5HbfNeoP5O-5p5aJ9}qLt46AEf&}qfA>)&0B(})?!AxwWwMH!P1Q1w(@=sjL_H|l z{n2$EF&mbw^&>Xymj>y+xdgaGFS7kI>~%lKLT?PTmHKlG>?vyt-%h`DK7WDu&H#VpSsF@Wm^al z;Gg{?2(+?rR5ZUo50gdJAJyGFDmt+Li0F7x^=hcPC#ip{=^9?AgP5xVocXPjUUN%~ zA|G1f-i%XtdDtng8WFB6B-w$un|X02Qm=@6S9#}&Iq`G@L*xy4iIO1HLgYI`-%Ek-C;Pqp*Zq!4i`ZAO^?rj$WPZn8$>=S-w!clm)1|8lv2|Z$q-j<=Etxf zA%35Vin@NdkFhv`#`}sCSdiLi{3)XQh*Tl(q58Q+(FIn}xNW3}&qi!um zrli)R>)6}a?368T$9N38iQWz4Sz+k=tFNPPV%KpPk>`=~ykBU3x1;YnA4yigE(F?^ zOQOfQ|9S_6y|xL39P*`o7A4XD#k@7PO#u*=_byT!RiYWQ)6hq15^3NWT zxrs0YnfEyv0HnWfy;^1Nf^;hROd-xKBD4CSuoIduyz}jb zEq^9-P83Ih^sU$!|LjTK?=8$AsNOwSxoUcLQO}lm!I> zn=B4pz{s2<@zyD=p8*A5j3Pf6cHNmjuw#XP4!_>ox| zaRQ`pAoc+}u^`tCKagvgW1*9J6?(olP{~HML18_G+lWIW$*g=gpQ~z?rqN5N-F*%1 zZ~gFBf0LX^1G8jwO($8#bsm0>>Ssc6m6usBije)u*Eg7%9lUP{JW?@-){KE32&GqpfFBdYDR+hOWmqpW9T6%8WW|x+`G$Bv76A~sn zB6A%Ra$O)H&R=b&WAF{8<5*3{4R$$UI&L)6@pfj=O-#r9ems2NE+;pPj1KJAZaL`% z{>+ME4)(2_w3qDOQu0}O-rn-?SWU>AG$F?_Ay@G-mI*ml6LNQX=kJ;c`Jv__6Y`|1 z3CE$##ntY0U)qTXMb(J6n}uXMYl+BgqIQ?LOu;kELV{X=DR_ZhMBKxy9-1;|h!!cX zx{@%YyU3NJuixmx=J#Wr4Gn*iVdEq?5J}5-?_$aX!UF=~t2rbb$Pw(wtU%{dSjR|n z|KCJQKQQ#B49zir{qQQ4K3*6*MJIc(j9fRPx2BZV08RW8S1BAUFB$k}PAQ;&vr_ff zB4tY#yHBHr^-61PQWH^Y7l1&c7?5R&V|KKhD29 z9%cTCx}Xii?F(gb(cKBn%;0*q2iC^ZjpdJ)fLu_F`w~vtqrSn?yVhTrs^5vJ(8B}2 z6g?nbFOt^B9r<061n0YKex0@TO4C2AW{{ix)ME~O&}L$v^KL{5_7b`Z}I z<~O>Z_p;0uC~6PlIn>FGnQyie(L4Ro6Vc(5}3e5TK2ZmP>O+i^3y2=1X?ipRT`!XNEMJ>C4#!EIw}y~HIwnrR_Qoyc)j%|%XV z24?K%JCTQ5gfzy3{p5JFpB(hUBaGL=`;Bfba($N5c`VqxKFiJiwl~cpiv*QGB8^1D z&|E$FK2VJ_Q@y|wv=|bmCz}WeA;&#?WP7Sp?{Z@IpG<$Zmw;&HbQtN`z*C^)KA{7-pf!Cq@5Ug~vs<)Xa&H*XzB@75(|Q{q+kSLRiS`%N z4?iaXzVBcI9?M_@K6Q}Z>xUnHiZf&1{AWx9jfjkVTt9rLl54vZZAMjmrZhlk=#USt zh6_NYj&UqN=j-9!uc7|2H?Q!kfP@ie_PO2V8UZQfMxLvHY8o33)^(4LZVlg~H+1jO zdk9F3#;j<^f_~nf|0c%zk^f|@{h{G|ekIiPVpxdG6WY1YoykEmc$GDGk_4=kKwepU zq#3%6y?&f}#M)nu^mq^J!Du*cc$qN6!3BncH4?&&yZZeyw{eEBf45J>$YONXx&3#V zfyLV2G{AlOYOmV(6O56@r*5VPKNo*oPK!DHjbG{vf#q*=qHtjl#?qLBDo)R6e@XC- z!We#I7500uBDEk(Gckww3RBNXY`$w&ir^LS=Dr%Pz$_|lpVQd5V^-US6*nu zbTjSyzWNZ;9)h`(r7!RIFgSTkL@qg1j|~TFdpIxA82y_QXQ5?H(|Lt4frhyl9Y-+V zZ?Oc8-KO!mWu3<#4MQ|}-Vmb5Hq;$47_D5$ICMwTua|#LF=gC0zD#ewKv_CDV(^yO zZCN@wo2Hl<<_xD?*SoulB)SrDMW=hMJR3?$x+*%I@0W>`vohhWXyRPT`AGMm9@=A! z-EeX3FT=LhRf(`eiY5&`Z6Wny%pK9NVKuFA(rljzj(K5d55XLp*_sU~ox2lrrW6h* z&o7<3>o5&Sz#t^I!VIl*!plt)qCMB6d^m8GFDpBf&_ffpa}7r&0gfiTd%$@W^fvcklbk#^QW+lwyt6x z+zg#wlM8KG*lv#MGwWiwlO1%o;Yz&Lyz=Ppf89>LFhe+tgd~4wT3(M)$`)V4IFj+D zNXbn}sq>ldu|ksUfhClH$w+9M>75BeV?>S#M1$zK(177kg-eo-5%b3#D{LP&6NR@3o-Gh19OwNEGB}W0< zOAQ45kLf%UoV@lkwR!`A*`n!Z_JN=1EK2y9`2{RR{gtCwAlmq}9sRF*OFe-BOslXWQyVqWR0$%KBYR6|x)MIYDMc%A$ zMILToLnc%TJa?Up@YI9-?k_%4cp}6a_e}y<)0hsjmmQ6_hn-MsTYQYVJ|6rGH)Y$j6+!z*MW7jE8Fr3{vjXK;NUuNRcLsYX&aFb zpI_CaX|d~iZ(pv+hmV@HgizDg*+l>9hj03cx^^ymG~*_lC*m#ix+T1USLT@^!9uSm zz*RThr8m+Ci|;nb_Q``^ENFB)8SesRIe`>%oFQ8xQzmdyNla@Dkg;KPQXwif?v3tu z>4f%q9>K%%h~tfqxHJ+@pk(aiTDGa?{u8AJ!utb5wsTxIG#GxveN_ulVhudLP3_+k z{U-|b_hbv-fIP_(Hhr?J9_#LC*^7d$heUTgBSWh*;yoN}bCreV=?cQ@X8RAW$-+}A zQk@$|r*D>OghOVfyX!6(7foZeH7Uscy$r&*^W1aX5?^k{qr$u!T)Xk4V$gg6!6(g} z=!4gOg2tHk*P_I_o{)1{7)nR3&&589Mrk!<;ucW38#Im53ymTfPa703>zENbSED^4 z`A*3cB-u3H6SbZAH-SH~8OB$m#ZwMvpW#ix@J8&@*83XRwSzDM;T{m?5ZS>kXMq`k zRH7oRs_q_)bPc9bWiuDdXcyGtl&tYBc#h1zB{!PhfZ!W*W>b0ID#AFl1_)6ZIz|G=KwNCm63kl_>!SrOybh4D3?AE|4hx^- z$1aiNa6skwR&FBLzW;F^dX7*39oh+c8v*urFze z{e;nNhbv=m&*{OK?9zkHOsHUFOs-6S4UyImchJbg{AlFe1zrUZxiY{cm}H5nr0CC* zgGKY_U4lc{9LTAEd#N$*59l%(9a4Wt@N$N?{H%dRL9JvQB5V#4CmKwZm#kCt>rKHS z&Cc9rLpRN_&ZXMEricK->xsxroJ7duT?>p8@73ketFhZ!Zz$v_6|67MTW2T)hOK3i zQI^kc^XD{%t?B+!vr7zY*%h?&L68W~8_3%)=y@B;OIoI0L%Tb+!UV3w&ON|ADu=cO zqX8O0C{*=mb0F^k&J{F5hVX=nCao!$x5hcN)yX?Re+-|Y4aZ~MefW+}DUJV{{w9hA zX0Fn$G>2BPa$;95gLUFRg;_Ox^FJlY3ldw;Q!4R@_V#Z?zVj?9v7g%8 zl*+Lvo9%HKS>dDEOjIUeH#TX9*&ANNERACXoA_RfQmyZ}y9b-RnZzE_&Ly6%n3YXM z2V|JSr>$xjgbj1$NHm;g15LSF_5)e=u)E ziVdgbmlGq2ilI=M3u5hNDvn;9<*o;K@(7#VyKjC7m?odD;~28lSlyOKvx{VhTj^C2 z2)#lS+L9+Ksc`B7&B+Q+8k3frnv8tsXrB1pk)@LKjrvgno0_1RLZ>MvA&Xr}m0 zC9xuLG1IAFWS;F*b0E~55k&Dsjll?^YfkJ7^4T$A2a^{T60HKaZZ;=hGr36i_`987tDVe^&Y{(Ie#r#6 ze)zBjW`1D`(w=HzrR-AqS5I=PCQpA(k|9kjRgEv#H!vAqewwCQ>X=Acv!ZnoLK^nt zb~{^htUSUNH@uDhV}{ct@|hyx#h;iVTFFu1`n7B)CWfNEMGrACE&>uS7QX{H|BdG* z=EEbFbl!tnaaa9~oe!Di90i;(4ORh4{w)V<>MVhZ@XPZ3*m1)Bp{4SOffhjQg76

--8m6T=5|~Ag$@zv~^4m z<_FQ6H_q879OTBIRWpgd!TsaN<|Jj9DSiSWBJSt1ex%kGnffDs)S-V-b)2rI=ucaV z9N$QM+4tGVapCO{(=O~qXmn%>BG*RN*-WXin`2#wMD$H7}COttU*T_Jf+?l0*BsiYGO%dAr0-m(k!Xb%ZIWH z-`3a|hz{Jw-4rOmTK#oFE)ZdXBq1B)r0bdjks@cy=SJK;l3agv+njYJW7U=W&{=)7 z3T)Xe(a-6(!^vai+ZxZqnB3X2mzCQH66RJqFQESWPU{=S<7{8Yz6seL)gYg@7i5`1 zIvHyxna>gvKkWYLhgO;`@B|x^3~MDfTS9`#N9NGAuQH&Z$SJHAT&5Pg3~B-Eolo#A zI$)fkw9%T9!%eFDxNl$z~-b4&FZv zX43ZUc)@bn)wDNbZ?{uB%ZftZ z(kU3)Zml`H(Kqii&3T5qKsL6R>rO95_-`#;<|jSiD?1#&9FjLmlPc&To1j@>pH1~V z&1nW6QgBq{h_TY-aO{Y0DS%`FoDKhk&TCJL-s}(UX{suDf7;5b@RUNN2m=t4hs&zU zO4ig(3<^ecOe(f)(Ses?@n*$Mu+AJ-x}Z<`p7yn(tozQ}=;mbTi~eQ@EY&b0w`E9z6|G64+u~0;wFLf5;4t^YjS64w zhg&w)e3z}PVU3Lm-Z0*Ft#PmB1k`JHPO{yj8Ium=;ho08HfSg`0f*dK7)jxOGAMLVL={`&F1NT$q0n-%;`xhOU zGz*iB_c*t3HhWGzcficQl?v_pG2Q~*y#b)cQ*SSUKHT4uDpRa;xa&p@LIyONLuZN_ zg&YW<7fqu7wdEH+P5GYc_|ufPV{PrHX%&sW@3(yKq3`#2-wSR1$GAI+?=zC$Z}+|z zd+Xb8Y0jxs;y(MB`u7`tx~fhZG*Rn+Q*EvegVxMFlRn`Omj0`2S&pwr;Ai~ybmB)- zlrP_q6QJ?VOZO_7=+3nDKedog0Kot6X$yR^hadZWzrG{1;s3yQx4{BDJ4!0*Ia;Hk zLe`w@-o6)Q{_PC3*FVlasCqZ;Tqj5tR8svQ?wbohfCxe_WYWVN_OF|5xNT#!qv%-)h(N>B0+n%yK^YxIJja z{4ORy5b+N}uT&z{fo8-1N~UM{7CfuLIkZ-csTQmJC7l#LxO3?ym!JLQ1=y3)M zwl5g@mAYrpXZ1tDl3yA8q0m4xCf1&9WM;EZG)EI|zl*#HqYE8F;1pk_bznb-L-upWhou6M1 zvXFm|iR;w;il6&!CF6ThNj@LF`TZ8nil!gSCDoX1?IodY!)Di~Uz5G#OqEh8dNt3(o!GSzKpK=-6_;! z`fHd4w*vR8YOFu-Ijn6IOv{7Z$!E6bJh74! z7Oi$PZhA#vI2o-B#QzTWQba*6%!~J0)Q1Ii4Oh|Z#Tx~J{3>JWr@ke{jl{ADeKIE) zby7urU8}Q=Y8PWLq|h%q7d6ES&Oe=`TOo@=yXOSL zuOV!saSgOKQ=4QvV-}g&0_;6qs~W2}27S*Ux3!i`(*-S@Gb7v}^nM{+4dGtV8!^4! z+ZiSq;F7-~TQEJ=mh~(q$$1DoTtT`$umywW{Sr{4H>Uh5s_$4Fz*W|^JuBCAxwmuX*&DqY3mUtw0^CxEA%ZHV6Eh~ zeB!jesVKL?qQD_ABd>d^xV6BEJ#5yCFJq17?+3*?EZfKq0O+hmR5iELhS!4K3{(MjiH!8naVE8L9o1jn%=0WCsL~ zX+-RKE>+r$8ZK7N8Yyk4BzPPv-`42m{hh%BTqc6M+1|Y`{URPw-$c2*Og$vPH9kd$ zxV`q7b?tXU_#}ZM?S}G>8v1!NmI+$S{9LSPU4|~VgYQ%VG?#{ULYGtwUG8k7OEkti zgPCg;W~XcQ>$JhH|9Q03%#`NjOlep@?Xz#M7M0r_2;?2i+}xO;AfgzvRc}RwLVR4} z*Hphvja`Me{kdavzB zNpf1J1;!#Ew=;1@#{UI)(e$!Aunrh=3uCMXVwga@nY4nGg^TuONH!+NfllO(K5y0? z)FSRGx`%%2KZqacTW}>j%4-7wbx!Kv=_3oBTF2h5dSX(2+gMdnO@P*2%-H&4=^$n8 z{B={(z!m>Eh&9hr@izQfa~k~n)x82tDmvdem<0lxhy%X)8^|5G6LA|niH-H7%Gplm^{a><|QGi;)WGX*z~m5_eVxEIXy9nwjGCBO~dZDVotytB#~ z!aPG7lV2HD2L6`M9p6g_nf?3Njr$dC?NsXb*SDtEVrOIAE^aPRa%BOrhY@NF^nrpt z4d@0o@x55ICqPBMXW&cGzGu%ih9S-UtJaoQsmrEwiRSkGiZ0RI-tOD!e3S?^AF%9@ zaeJ*8TJwEjBsbD`S|@tGs&lxa(tHY6ROzo#2`QLaq!Ja;o}Qc)d+odidQP7=)7by) z7+_6;{WLnuG+KrXM$$&)IZ&8fI}a%ek#RoFc-<`d6Msp9+43BE%_O{>%<-{JcLFGXG;Ni$xDkp*gBDk0=q+ zGnHe~Ioe>-990WR7dD#wki;pBi}Et{p++ZilO4Qh`lh?E&0X)F+g}4l3Bx}<|LLi> zC5SxI_xmX#noCxt>Q4{ifdwiz?G5ct<@g2L&XkmwM4OIp1ed3Avo8I~b+?|O_CibO zO4xp&JXV0Lurmewu!K)Jgdpn}Z_FlL${^v#yf{GvU+QKt!c!#^c9YOfssh zP8^MDjhj(U>@pVe6NWXJV8{2Jw()g@=t|m|CA2}cenYj9zSXVgq-eh4%X3hN5v#Qk zE5@2mtk)OK5e-CUZ7akHX6+q=Irvyx^R7hcLP_>0X2vk*|XJ4*9#2)!5fqv_)p zF$+r}16tp$IXEtg7fHxGj-1fG|v4C-wy(5B?R~0{ZQxQ_=JvFQnPs z=&Qbh(|x$Z_uK0qpPo6k&3A#Mhlh5Ukr_ox7s%Dl?_GLqR)OqP42VgpChTOLjj z^T#->10#zQn`1vS-?Bd8n^B!?u-~%XU3}qu;C}6oEP&>pk;y1|K3ba~ez$+JYlR(` zZbRd?e>EV{>)&MGk_<~(c7BJB;D0rW@9G|V{Ju~B9M7F4Y2C1B>WNL!0M5DUhd()E zu(6%rfee!Fo|Da7v_ z{|lK-HA)aZi6;lvwo;bq*7h8beDK&gDVt)N8KGV9nf1%{ZH32YIIY(q6JtR0;W$x$ zhI{rPPyZuPC_VNe*^A(Vtnb80YtVUa{qUB%5`9`9@9AFOhfW~(GAw@e?R$b+fw1S^ zHNbYSqOE(~6Wwc6Jj6u*h*LS#>tHn zX1jexF=I(7COGm#N-DPM!eQ5@rZBIwjgJc*o^#9K6!&*mrD{AiR_hOBsQuFJ*Qf+Pg@kraoLfZIqwXx8)@#oiQ$>bILNHqqgUsZDT zQ1*Guis_I;EIPPpZOK7q;)%@4iRJUN3FySUH@geTD{Q_#+wWhxeV9 zAYDzzhqFYwGPHqiVah0O-B)rf(N1h5+W&M;e$A9r2dBG1Epv<>TLCRNSX?~V9D9QO z4yV+XCOt3kCpgz^R9iCK>ADz+(iyQICFAxc7GTStnn87f|5k-&PE7I5*NJ+h=RXgf zlfsRsk*SrK7j}!@)w*ydPw~v~hK1KwhVjp?VO71JSu}N`uthng-Uz z{&Fy)o@$;aU-B=jN-kS=9P&PFni* z9r#Dn*Zcv>=wt9dtci&TVoF+OvlL!DH*zT!6`$+1tA+A109U%>da?H&b7Eg?``0k* zlH-Fo>G+nMX7$JZ`Rq?$pe9;3`S0hXa0Zt?6$1W5;LT|6}b<;G-;(#{UUqARyxe$Y2!FfI$*)F{rqS7)>DP z1Oogww1>guwrL2*)yKe;79N-*L6km2eksnP`OtK|!_ zVtR{PXq$d>ka_y>11dAbF_tKg%#(QZ6-qBM{UXEx5SmG-&^4kZ$1uznZ}LgK zt|kgasz%{&eKmd8YF;N&PK>Uqi|>|ww~chH06D+*Vj7dM1B}khD{B7HWNFquC*ZTj9wDqc`kGYiZ(g%V#6Cmdgn>f`m0TE|ThB*xWY;K)rs}^*0qe}R9 z0jEdMN_fX~qZu-^-GL0Ft9UUjwfRnFMJkqU`g5SzJWPqvsO|8GuXVbBq34A!Qcjj> zIK*woFZt)Kir@_ogFAag_gk1&X**_b$I=HhBiKDp<$g-|pAbd-|Ae(b%E|y0PyTM{ zGyV`C;ba7OC{6yr$vj{LF*IDP0Oo6yd_UoSOJ4b2>Q#^j4D<->=v!#QH3urdoa+NY(sR5;?Y>=;luF&t20&pw{POEo}jz@!uLN z!jGdM0<_}1aEru+xOEM0kdx$HuEch;IQQm{lc16n{s`(0%5u|iqj#1>P;breT$>#X zKa)RE!kp{S)V-h?tDKA~z>gug?uP7kwH(>sJ!mWAYtbFJ((I(D3;gT)?jE@r@nQz+ zZZlhA#1@WO;K<3{6=c)}g+!vwDNrzO6}TkY*6~|^eGOyL@{g@GhnbUa0x8$l^E00} zX_U=aR%EsY;h)rOy_R@yel<_iK~hD$f4haTr9RMZmr+bMO$9C_l^x$R?D(E~l{=En zm2Oh03hmnp8!ndYaGbw5G=i@03kRQ!9~0M4DHLG99G7y>t|8$NPicwDA7s8O>ZjGN6jYJD3or&Y@2FPmp;rAb6yH|I(SCJYlvB5d6ZB>?)^Cs`SA z3IvY_E{y!&3k+Gn5LciTIR~}gLW{)-7TzEKNMQ^{kNG}q;b|+tqO`)&=T?b{cwau1 zuG0Bwotsoz2mG;&3gS0Sh*$klH$JF9MK4^q-UMV8)c!pS(6Mt)%u2H%nBqlk?1FpNV-8^Q-ps zZ+^a~^K4Hq_}upNUD7b{e z;FNeTe<}ggNqX5#v+V4vOXD?O<;KSQ7&YB`Gf4Pj72Rtt2WHC`YWAMsl+?%_!Yv&B z1=i5(C{4QAOiwAz#AND;cxw}|E+p0jq{O=@(L6?O^O^K_24QtGnLy?K1@EzasCuy! zcg3?_kEypn`Wt}skw;?0m+SPRBw_{S?3|gs!m9HLH7MpoSrrI7CtMWBe zI{$Yp9d0;7WXy49%?w4sDPL0ee5w0yMcPBS8Dn0zJ#qPXwLPcii0XP; z*%j4CrHJZycK(DalpFZOx2%Tvn-DOWn%q-*h)Au&8Ila7DHqzZ`SP42IUWljP-+xCrOf*o2-i>zFCO zWBYupXoBHjK7z8OgZmS6*uh?U3$X&(c=o9y7CtAxh;34Nz8G|vrnPFspq@2 zhlD*;cJ+hV<#l`7)%2(TcODSwZhg!q>tT}4qCq~{iEZG)BiYW(Ik9FoML1VE?Rb{^kjYKqy<~J zY&~E|zQ-T=5#&@knQw5E;Ofu&$x(tzd&IyW`cgU@d<5lifeeP?@_KF+lDsR#$^{X3 z)=~_z@gW}epr#x?uM_u!)ohau$s)Nk>}Z5f>>VyZD8vITmIJHQe8D}XRlezy;q~v< zU`BzGAJc;kXFEq?TMTFAFiah=W2cBaxV(|hW!iL_LqbbDEHHKJfVGsKbScIXMBH9M zS=jzd5qM#25HDDHL8qwFnUP!Ber7)BTrfSLek+hXTQ{@j{xfG0LwbD3{tAIW6vwfv zY>C2T#1Y?eXS&WmwHqw{OH=rd=vJ;1iYk(xfU>uk!!EWemy09>T~Khkwp`32qph<= z&8zM*z(%n-Yq017^}J&xyi3MQAsT9SNTNaoWv2fEmQFTBWPu<{C^Z)nvfCBzro}h7 z)w1&O&YEB03>JOLhqav$%{!ucEBSC*pmwW#M5n$LV0!PR#_$h*&>t<5n?S9O-ivG|E1tD!`Tz&IAo4Lw2~sZ&7v|?`f0WF znpwtZ3@)%(S_&>hw(z>z_`l}I0k*U*e7&&{&_K>ppL2b;W2 z6r){=fA;xsA?pZAWoxD+WH8%pDn3>!EnC9priD4Tfi|ffI;pNE;m)o^v11 zk>MTDs;~yN-n3o{iFk*z@|5n*TQ-n@mqZLzHKKX#F|Vhk3{@F?)vljIyr)c;XYFw@ z)RH0EP`SUwSmn^M?Oi0y-X0Yw$h-IPOc@(+x*yIwmY9Y4jl^)A^?N>L{+m7$UR{L_ zq>ga8T5r%!G3VXL{b)?5RpC#>-j<;vv?(JeVL*hXoj{$v~GZxtMUh~hssv@gd$_c9$?dVj#BvZ;vwR4yL;J z7<==7+E+HWo<6eokHevd+)rdncFc?q{Q8)a|FIJaw=|J@V_7NM)q_iWlWFOyrKAC z&N@YUYU1i)xw7RdgwI6GX@v5^>fC6oxH1BLlJ%TK)))00!%gvw&bhfZef#R%@VU9= ztIK3R(i57I%lVfY%&fsDZVp)N+(&Rd_pj8+2o(O*x>`;*0=*i>RWr0aByL&AK{ts1 z*qO-MG;2&Uudpl`#FuFi(pww~B|k|>Y%Lke;>l%rO_D{MB?hQKuDYqC5+ZHj#`)je zfBho^4^Ps3w0x6%{hU{K{kpZLkUD>NW3tZ4@~J>tkusI|87$#F!bPTYz7LTLCo&md zS7Gl`g8ypv8p`UC51WE^^v%gCcT|E9-clY8i!kw1%w_h=LibE$5${uCBz+QJX6qxY z#!l|u0sXT49LEpvMF*R)Gd_}@LtC3F^rXC7{vu})T>g?Lnf2DXCW@C2E?J%0=*lcG z^3hq`6GT)P^UgA{kDJ=#B}Qs%uw?Jlj%v}0L{j(-eIdRK*l9S`8GL=Pz!Topy#MIt zFOSOD-@Lz_v+N^^XxM2_?U(yU?I_%jrQMmE8#Yeu5{2z7_>_3Y7elFc_`O|Q2~wyD z>q#sGvPmK$kNBH{U~|p!Fg19IY=1#Q_~{8heIH49vLV$?j{Cr@IOhm=s*d!UB>?=*-4iAkNsEi_@u@k@ zKNlpz`sox%Xh$9;vZ$=sQ4oJA(iicmh2i;1*$5FCo~4#h7T(7EK$C;CC11}v53_Eh zm1m>~rgjztCso2WcjUo@cE~Qxj-pU$A4s0|)hys#h6J9sqlo3r4g{5dn~v=Aj0_(m zCozy?vh_5RUOU?s2b7qO1Gx+Jgs6_Pw5BJmP5ceBpuKp|1@Cxa6wfrj< zES4E|(q-I0RmpIVLs_Q+uRg(EQTNN6cOs)l?m=25wgp!pD6y}e9mwO5i4#3jq zb99vpiTZPj%uXw`WLz)fqWMUZ?jGTphybgOHnu7d$Qs-dC z2Uxiu!HlZT>UwkJ89_(yL=wytVwJBNk$183gY~>>ilugxRe)eHRV}WIO}>VySS_MX5!1UhXj!Y>#TdHSeNxK|u4@(Be(*CK#lf0e1V`cDC zBE6{ofYz8L`()ATu9>vcf-<32Gd_n1LXtf1pf$NuJid_~sreu^xz5()fUeg7w`N7s zxN4~x{iAl(E0-bed0y(n&xh%*uV8?*zJB8A;TxbpANK40xn$&+VxT&{XO-}5N% zdb#mt#$;4)Cr@nW;WBc_kp17bX7y6(Jd_-V)DAX}+af;qGrbNWHSL%DI|+{G@834R z>bCIPqKsV%E0eyk2t+^hGS_VC@CeBvp|)7C^!Y@Rf95fM(C9o=j%&Hrwb81Eb^eAM ziLPpR)!#6c7boz{=zLr{*9wD))^vhWz0af2VcgqX84lR$6P_Hy(gck#w>ot?K5>6>mYGEEdc!4

1EFQt}a&XZz9>cjE^hc!%?7-!kCUOOjV)>kVi%hGzp8tRPjbpUx}oW=(Ph| zFZ$y}t>Uw9UzeIwf1>&ijiUOB`J&Y7Kl~lFJx*%7?0>ZSkKai^4+&UIKx*~3#L}u? znL1vTe_R}|J4%@Dr^DjW1y=+kIqieirpo$YToddKzbk2;TBvF|=)zh#E3xS=?JY;Q zp|vCmTuhEkt4eIPR?QBznDgCLcE znzMhTUI@I{a)EhQL!H-#WtoKHhyAR;7>@h8`0GESza$?G6kZKR%VZpvi2iVE?FrHX_^r$! z%vxhiKUxqfEgHr!v%0`CO=14Ys*Xm%hRw@=(7B>k41AO}&;6rp@lZ9h_9~6)UP+YB z7{zW>(2Sa(Q8||oCFfk3AA7oy1!jTGw>9YIQ~EUfB$RUV%mOl-`Q!O{!~*|J><2~e zG(GMCoe^*6g#_pj^%9^Yb^zuFn4iG>ttnh5Ng`rjlTD0Op_Cly_QUM$%!nA0Mo$4p zwc~;P^cC6mEX}gvQltFm0JGYA?cifQ6@vWL-m7_)s8H#drGi+FX9q?RW)9B~jU3)Q z&ZV;6Aq2Ue#ymSt4~DaKM<><~OBMksOS8aXq~Tg7?$lT-Zl25i{qeipHFJg7$#M6~ ztX`zqcM_VLi1&q>e1^(%U8KJ!zuYppCv|arpAm^|;yd!-Aco_8Mczu@oia=pM_5gM zI+0B;)~9BOG$ibMh6JI~$f;6uaZJCEZ;c*ik@_-qR%e-8+0Kwd@sYrNhoM{xS2K!P&fq0} zZKmBdYiPQGBW3gRKVq~|+_v^zLDIbzSj2Y?7Y4r6k77-ufIuyx>B8Be(y1w61|+~N z_ysUqEST%l!Cc5ehL`#anBFcJO($UdDPUgSA8*Y~zW_#bR%}V=-OWZw8jE@v|Sq7CanZeZviyg1*GW&(CG@u_Re=d#@lmA z3K;Z12kD|NDTU*4$6)g3)vWCQHG@`)4`ZC6=t$_V{_S zUTgt%P6yNy1CYu&PcFA;({uvpFU3i;otFS}WeS*s_s@M6(EXk?#GQ}XmmNPr7m%hC zKqsdFitUTHCxfe$e{PuGWx<@14rbWXfD!95v+a4?9!)1;-u!j4J@pAN4`2cIb6}zt z%%;}tRBq7calj}UTbOL6gf{FJ}&jg_Iwty^aM=rN)r_lnsG9A!@r{eAD>H^Yq z0;u)mWP6@rW5kld$K8_car>tYpgIdEqYa=(0L1);e7npdPSXjXJ5m6hl>jt51(1%P zb}|ygV#&5=x&?F3{xrmW_+-326h@&1{S0My(yiMWHcXQBnP?#HzDypGR~m()%BwJsn{CxCvhfGmH@ zNr1T|12GthKZRucYSq#3UqS`4g7)>W& z3KUGdf41(5x2N(K00k|e{^@}3$6D_tU3G3)V%wwX1kg(-Cec=t0P_X9i#R`U`=?Ed z$}FJfeQAh0uMR-Evop~Jr0E3E`6+-7NdO9`0MhFYNf~-xf?pdjAwzFyHP?Yt8Q$(;DS(_dILSrs)Jsqk@U|&yWP5wd|?H5vT2G z1E|0PnwJjfi<=;)O8y!Cy&Jy)iHar>tYpgaqxcRHZ!<^xD?YhLq= zZIPxEKuZQC5qDJrP^T0?2WwBR1@ru#G{jAK05Hl%|KNhrbOPq=6fl_yFpv6v4sEi} z9`T-^4x{T0zz|Yn{j~3CY0P;f6A;^rk}bKPofS(0XQzVjA@Ev+ss0acjmOCO`PsHL z+jpn6=F>Sq(qVd=!dYn338>iuD(VW?gA=e~UD`CK&8(1R;nb(YIdnR3bd(No;b=O6 zb9hRV)N&r1in6^KsuOR=wVfsV1M$T7LFzq zIDb1%u!0F#H5;_p-zGp^_Y0t8Q=3kF^t&{qUHBrPjv>m7b|Gmxfpoe;a@T)sf!G!u zkpkx6^u68!Do+P=<+A`%YBB$?P11A%X!C$%M>`2X%Q#~6bMw_23+BCV)7q1t05jVK zqv-_9H7Q{76JRcE3#JW2Y_edcq=T9D4y{o&z!5GOO($To6ikBtzlbPa8l_SU~rGlZLogHv&jK&;?yU znoaP;=DiMa{_=}<|V+M(~O{LpfeZfIMxC%D^dU!~!p9FHOv4^tks=&qAiNbUY0wTsI~fkgEd zWyZ6aZZk03L1M zhVa_7U?Ko6P6v>U6HGgXye@!=3Sej7WD6c+XT_pu^e+Gy2Y?^{o7RGhngF0$(T5gW z6pd2=x2FIYkpQr}-OslGYX|SW=>R6n#H(CjmA3tJSzCH*O-q&|s~vfYw&tm6N6 zt)+D3FEU_p-zoME$iL}ut`R1yqI3@d!hj8GUv^X|ayLO1@*5`wE&87HB+z$kdO?r; zIo|HqA5LlaOMO5em)Ig@%7#kp81`XKI*e^2*)DmIaz}={$0M!1I2STU0;63xRpCGf zQj_WPxqZnLF!I25cn6#aTRGgJuE4&ui7Q6@k@rDYRfN-g0IKk3pD^6t^+cYNvw4|< zORDV2dGeMgZ(J7NbxKj)3;ER~_S7yFd*m^^%Fd6W?4a|4mV*Pr{5-OoD#(*8s6-0=(gGrURnua-ZQf|192Ckg73|HKj7 z_=6nI=6*d)a4mdWAHj{ZRjCDFr57y^fd6>=oM9mYgV!Qp=Cuz2% z!PV_4f&IZ@Sv)*HVc)WoH17T{_fHQ25Em4^DX55V>as1YW@Tz%R+G;e1={%z3C-T$ ziRFfG6YpYo&>?hP_GPu#2GN5`F}1^%a=ZkwNP&0e$}ksWu$NuNOLk>=iX`VMz3`MgjyM#^-ZuAq%^>BlVw^;8P_t{^DmE0b zFHX7PnhnL60Bp$PrtPPDxu;`p<;4WJ3^}?iOL{62Sb8KTbe%f06E1e1tD7z(*nG=) z5dvHKy1RKC+_eqi5QpzMw~8Gewj7bb#lI3?G+ppy)aw&St&!WFb<4JF=F2UpLB*`I z7Tu2Z!BIZrC-$(d`PwCG0eBD-0&BkZGF$ah5w&k9b!jKd@%_-Vz=MyLzA|QfU-6*_ zH}GrK)gE;a2|`Q6kHZ%hyJWg!J7JWST~i(nbc2Faatc1zY)bk#>W( z%WimBq}MAXUnVv-DMw1KyUz9i8EuX9=5JxT_i6RiEJSV}Ws*`%)CtT7FTlH&oJ`8_ zMfs*$*Xctwk>cexa0TC*zFN|6QZ`hPurslxTmPJID08R&&ZKNiDvQG3#`;^ay`s5T z+RrdPDZFd$b=iz0#y1>5Y)NV7Vrq!{**S7?1((!>_QP4eqclo62_w@bV$d_L3gh$X z@FZATMvCgKb&8gavaA}2W{2EK4$(O zyy8x+NNOYuWt<${fN5}*pqe_D!Haem>8*rgsfTc;iG1C_RW!)kv5wNLO7Q`0>n=zg zgI)7(=Da224=b-JCnk%ny|Ygbr!~Bc1*ncQNJznVK|4<3YQ_K}VZfrcjY^1#4muED zik8@5@Jow(_#3uT2f+gM@2~YgY^2kN(`xYdeeX+SssDHy8yguuBDxH`3M~&hOgIZS zZ&mEh<&r3os&z0yd)Pi#Fs$@GfFtECPYxhV*V)pneZ`w@Jr-RGvxN8hKI}n>y|o47 zgv82V-drPj4s-5phl2or{RC3NV8w^b%;r4$zPZ?3M-3~(Co;28!(rJiLnVzICEq~% zS^}IMVVpLxZDVh9zOt6#7V!?t?56x_5hrnw|E2g^>~`eDO*kk%I;ZDaoB#J-!{^iO zlaM0T|62wsDJsK<#NMKe=`$%*SBwEE)SZd0_(+6}VJpRhgr}wF0WRaxIINrxTWpP+ zE@Y+aGQahT%KH3|^m(tVgq)whL%(s>BTu9ujTc`e806#SCg)Z+xj(T#r?x-+8z*hK4K-)8n2`6d*EV&Y{mJfD(mFY~ z)%lilqZ=i%bKUiqAqJgJ`JvL!Vg7tHLL1V{bTt?HVqR!wTnc75pE*D%)(FH%V0Dhn z4Rs2?WP`tcCTt&c79ErCX$kSp9kX&-Zf#C*_6&PbZfCtHmxKIG%rvf2wq!*OGKIi$ za4sn}!$(Uwq3g4#NRGaql0CU|3j!!r*L28>QUghg^B+&$^@nx$H$2;(AV_v1p0`h! zuxk~5CmTu#n-IFbhzon)rAh8Zycsnemjx*x=3ORiG3a1S52u?X*U8p@LWqCK4Ts_J znr;Z|*QlJG&DL>wW-v0USf-Kj9M4aLj^yJoTq1qNiHxjiLl{(57vqjDpIhF8!PxQq zmcouwb zTa#0M!O#t59S`K^VZ-vT1hX^tZ24$<27XGoW^+Gr9iN8;n4K7Wn-t>NL!eE8GY7u#?X zRsb@5kPPE5RZivx@rn=_5joW_#~$=V6&6zmC zpcWn_jCwtOms*RcTMIiH>+|oDZwPFRRQW#l1I*!J%l%+D)aO5;ANBcL z{m#rc(SQ9^Q%nHXW1{<6N|CWnGsxKvfKD{m5xlIAgt0EuI696=*IP4OmSJKYS{dem zAii%Qus^ejV$S%Xy~q3kp2qorgBP0rQ-vOVutF=P(69GVXcu9WpZ|E!imsR7h_Cv$ zvYf->86*BI*%dly<)5oKNaeS&xofVF%0F}sR2p87|2+y_CTeYbTFA{J5%1$wk~5ni zZSW6hWX$b*$umjvM7+QG6s}!Pw6&j+0 zqC(ot%xULvn4ip|7l02P!B^AHzO-Dz!M6DM{@Z}!t^tBvMP49WkK7bx1d8vG=dw3NA0R)TWLMa#JLk!5%WvjN`=AZG)`TcWlPU07p^BPoL>Bnyz?=vjMf)0}^Q&wR!(%Ov) zceYftQe0j-i)7xC0}DY8EO2k7;}kLd5+0OC;d|U^;s5PgiCz1R|Kc^@__MvezVGh& z#(#l#7R68S4_xEF6Vg$o)OhMm`+vzls-=&YQtDq<`uQkfcRnZJ?}Rc858NwaUR8r} zmtdz*>A$li+Me;D?lKdPhh8&kOYmbH5cSzij==lA87B9$h)C@Z7QPxR>9ybplzaC! zvpiYL>Q8IQ%&1SF6vQT8uxM57j#s&(3gUUOTzwjmv*0MTzvBEl~5!W|P!yex*@gbM%W7u4PeN3SQOdIAxr zAXVX=w6Ej@fBi<#=R7YtxP8li%St|jI7E|y%kqWaipZI*(TcD-d65gcy4SrZSNegU znyldJGqOL}%Nc6t4pAKl|GQiiYm13Tm)%*A?XPr}NTm7i>$;W}&A!A3SI?1P`NISM z4r(v{R-cehN)SdQij*deekKtv6_W;KNTdioVC*FEh}ftZtNui4x2M0Ii1 z1Yex;B*HW8(R7@FyIfWRQ8Jl5&q&OC{WzGn{QtiK9_p(*vB9P1nT=I z279LSwW81&-?6|d%+SRWDJo+7hTADA#~j0EkSfilF!|mjK{7K;N}!k#utQ2k=$PIj z>P@o%NVN47mRYtd5BU?=;|Ts8iHt#k)P}#yA!S`)dRLMHycUaHg={vlh^p2SBHkVDdi5hI z5Pci+5F2Lt5nn=6?fz}6EwHPD8Qx~8V1{>vJR;uZ`2E&q?)^ub+L){&2-9-Ti0>GZ zvxS7xPW%9j_nqCI_HmyY!f0|m`iu^Jx#sgEbLC&8xuQSjDqdKyb@KpvP5bwRhZ#y3ie z$`Hrs(bhU)NAfDzy^nZP{9zjm1;=}Hd|*-L;{j;xk@DA|rynO_8NNTrBjQ~_F;c`D z1>tHB*1I3tbzAhqO(7I_&EstVN$V$fvy8@!o^JWrePnYQrIt9;iiV@|Chb2q?o^|u zTil<9h{@yNj@+;pe?!KxVKqJ}{k0Fl?XR5CYmE*O^jnvSz>!)(vZT*m$O)NaaTg8U0p}D+C7uSO`O)xgy`U z3^|C?*A!__<-@C7`H<}kyCi1qz&e(e7jffaZYAE$DxK-9%qHbR*=ywxE=Y!e*kj;O z@JOdDtE#YxvDX0vS2^vf!ro6i3;p1v!+SksYMy1tA<7gZrjDR9VvX@CDEwj_jli14 z%XrWew9!V0%e;d|-(9Z;!;KO|Js+T8=7$##C^9V|#Xs6#VP6W!`bQIj8_E(Vb*dgX zxxFVgI=H%SHzXl{f*<925QfY0go(raCJOVSeM25S$e20JZ^sPrJ!|Ex^~C-CJm`8W znZ=#Jn5>lhH3FybReL5o@K1K2OYl}S$O#-pScT*5$)mhv{j>nFPDklF?|dFyQTrSP zDf4J~An|q=Z-bCa{PiD$A!*)oho;L2XJ6aiv&y@eQZrV2-{WE~`6FTAWYveVfwjtt zDS5*GwhDu`&cT8aH73i+H&uUY(_HqBq@bFf0`LqMpy^w~06w|`+X>-)^Sr+&4HDDN zsJZIBHU$J7JNZDa-t(!Nx(Z!ATc&g`)eDvG=8iQrSY9B#VjgAVLk(iQwTDU##i#2} z%~<zOl=IXlAh4NB+nfRDo<*oh!a)_bf!#^2~Z1heeR(byFIu*OM;jIu2ds2VW zJt@`hna87!|nkWsB3?v&8xy%7r=V zO(dpZKW+k>YL`nP1*_1eSeFe8{z^>`=3ip!LHIYLive1Oe)FQA=ifsp^_Tc}{Qg^- zIT`L>BbT<0U`jfl4!db7kfbHqsOj}1{vM;HLs5*%&I|GJgofv ze|7(@==xmzXGfhz83my|nYHKpmoz@Xdt~(2b$i=QJv}n|OP=W3oyIZ{5E~I{j@9kS zoQCkO0d}$Pl;@eg;)6}6Fe{?ztFHE$)l!0V=7XYwlC_U?J3UuEE^0oVVee;Vyl+iO zA1^`>V)yT7&`hO6b}Rs@a8!pqAFmKsUmmfJ5K|X!pAK^8>dm-W zCSq`v#N#&zx~U#?UF-=7;bwTQMV2?L zrnpj0N{~I(*QHyXUfX4{R`RYt^rL)JsXQw6rUW{fxOJAHdVwwf1z^6Y5fqW|AIjZ+ z{*b7*DeEqcJ!z9vATP0h`=&p%koZvPjy*CDFmAi-Gq13frF-&cG1gAnN73W8BI~A1 z;QeggL#0iUUKD>d`2{hi&?7gPo5`l%nipfT@JSokqib176@%e7TR6Dh>h#Jad&VZb zWpKAyV3P;6B_jGQJm((nzqQF7ZJ#u$e#&g+X*SEx2Kjl7pQ!okgTlWkO!=38&Tmrs zkNVw6S&8=fuHdWYc+*YMRLdSg;J1VX2L#5*BOLgHJe-Rvk9iN2bLH&z#l}4?%qKJ=)qACEpvM>QdfVvJE0IB7tGw%{)?T z3>`v(L-UZ2X8b|=Ug*pj%_!Pf`*F(vL9?d-J7*jTQN)N1rDFbKT&7e8&{p z!wLMAXNqd3gX&UNGzKn|OWTmu5LuC6o}r~tGY3U++U%rDJ1CcBHa96zaLO{zPWe{W z=|W*18H!PnYE=Kr{)mV>tmMRG4Z-XNuZTUGAbyROQ)js>JKCgCMyuvf;CF~{)JWhv zS}xMuT~Y?B3aNv9-=}4|;b8>4tNzla>WDz}A^s}aER-B9fA~Bvzps20>4zIA*^g_R zU4a2))lGf)1-4s9Buyjwq>lWBN^jz_IL410l(TZ@3GA~-N32$X(4|S1-d7C^+ z0?i!cLq@u1y{q6j{LgJL8Z{H%Y!d{xgf#4izFG4&T*KqQCy3uz;~k5BK&S}ZkB(Ew}*T{vvT!rut5k`M#G&#QO#h z)qa@2|6QaN@B0!yz`KfvyCKj-=q~-#9RRfd7mHIPZ-^S$%h<}nICZxlr>1@!kAWpI zb)^sQ>&x)y(CV#}Tq3f*Oo-W41Viu+(zbY?mylN$aW}BUKO|qj9t=Z?c&qFCdCXNS z!C%B%zf(r7MXPzPH_M>`idMvMLUE>Se~3FAG_s)o>T(j+ry9*f&KKxdOZ&(ah9m+^-Nr{ z*Xvy?{Cby3)~hvsFyaCT+x73FHl%DSamQ#r-KA)5c-^*I2L8An5Q7pqi zzHC@d*xuJehYKFfoL6OtpG5^c{+s8sP?5c;Cpjr8dr@C=To1~u&o5Re75T@a3gsG( zuG6#3<2f=*djGsf$$QsV5D~kfOP5^n$A5bN_3Js-CcOJn*`vi~3dirL+&fR<1mW(S zndfQJg!y=QQ*hVE5Eo7YPwK}1l3?Mtm}%wuLj$vYu{s~2Z5|tq~4ofz!UoFF7t=C_=j%pRZt_25){`KHqjf z8|~*C?q`%wOwcCFg&2h^f)QxKUUvh74ZmY{iFRLJu_3A80;PWM9*9XZxtqmXDqg_f zz9Xss5{<(%8BJ3Oyk6C|%>Q(K`&mqYZk+SNYg$uw$<~lo_b2`Jm#M&HhpFi-WktMW z_J9kj?J;)?g!5eJ)!HzdTlJ5HB1>)Vs(B`N1HGy%y^K75nSV`BGDbn*ZAjA~XrVp= zx62~~ca~1zR(Xxwn?HtqnE)V}dzZK$?=}UNAM7$tJs?%slkYLAu~8&io4L zrgnk3z9;AzEC?WGi*`U$VtC2so__wjj*uBxlPBlKxzq{((gLkGWA4`dFkn+>}|;(T;bu zh@8zPN2*jL_;S22s}$<{)%ReyxrLbd`FR@S>yr|cYl99;3CgxX=V_5PW0nND#e3v^ zy!YYnC>Lnee4536ZQ7QOPz!vT`Bg7JWqOd<5yB!P-VxFeWeA76u>#y2XJd~`#O^!X zVqWTD4z;oO%QzN+nD%dVNpG;!O`)TvyufTbX=&n#Ei$K?}EaNVH$ld_$;-$j=(O z%zVOIsMIh+WZd92gJ;T~&Zr{)k_B>eS>(djXye`TR>x-Vp(?4|%DrbMf_+G+bU(S` z_SHAPO+C%quhH>^a*>JedFC;O-DCRbb=;@&HTYNZXlN2U2u4`dYV2IQvg5grYpp8V zN9BeV?veU%#E`K+IiwQni!Qmq|Y zWZ-`NT$sNUG{H|w@8+BH51>i40KI1O&G>j+#PXi(b^eKO`O|VM_^|pdR+CacDFwEH z?zUd1BmuOBu%MG+rpc*E(&%@nnPsw@Mig|eO?S!qnJ?4nuYF4|U4FZ)&FTc0-1_V( zn~LGIcP+=GRTwF_wT&<$63u{J$5>5m=ik|l`lI3jdoF@i$&!rPI8O6PRlDwgks{u4$n1 zk44W4m7*DKdv6;u0`d_WA%DZ~nU>?5-~Rg1e8o4wqbS#+i8L3 zfbcI32Vvufb)}QppE^ruR(EwqbB+5=GLOn%sC1kbg?{8I;r*tY7IdQM6~~ZH!sIWC zktI9RX*U5%7-KYk@}buwUv^{u6atBO$Kppt7|)nxN0M8QF%H^ko-L!6>?cH9ZxRNn zud=s2rZQYjN$1IxOe2a$I$;s0LZv@`L@Tv_{Pn{4|7F00H<;Jwg8_JZKNSA#gh^(v)KkZ(baR2Z5_fPm zCbU$FZC8uBftX^sRisfZI#<^zDy4VLR@x+c&Z6y>Y-7aCI5AejcT0DP+O%7IfFy5& z?!WiUp(UyCr|%6H2}7zJ*b z8QmGdqN*c5m)m5;awZS0BKrAK<~l)dmN{g;407IDn&bP6{y9^qq|4vR;(J&!nZVpZ zrHZl3bkh9q5DQH%C~~4&F&bBMnpoD=9L;Zgj)qD1>Q3GAjspDf(~$8$=FJV%1y&}3 zLO(5Q6A=Qd*j~5%S*i2^d$o1T)Xvghf2$;;+688wS5`I^GG()oqdP8`G}Wrq^AFam zrlpr1vAI#kMV@R-ohqlH*apc)d3hfN$sg00k<~5How(TPK7!=x+rh8ulDF4uJTd~Z z{zdefnV*drSRP5NaCIiZ=HuRaCzI4!#rzYr&VsH?(k+uP;UD`3gRzia-xBf8jM5_m zh%ptX(j&@W!Z5|D=}a+Y3bym_&17-=2LpTAt5W<*{+`=}{^a%t-=zO&duj_E-}{Jv zPGBp)CF`c4PWM&uiqt%k2U1`kVG5pDH~UDnWVVb~c4kY~&+>79?`)?hD(Ele)7_%} zHwA1_ViNevslTNs;rl5yx39MTk!1aImkO(37CMKjh+$jn8pn6CRJ6H9uDrlfTsoJ2 z&9U-pJ0R#^ac&u#Ew|%-?1a(WXaxeg@eheqT&NQQ*1pC4#QE=R&0iJ6~b( z^IdZOofIma@m@bqJAcFL!tKM}OK7Xec!G%$+Wf(*KL!g-&)gp*M^zdy*aCh2xfk=~ zj@E5VUaT3n(cQA{36m*Q`pv&(;%2t>UCXz5=suaY4`JDJF`x2B%+Z^rT)7$53G~!= zCPvV7q!8#h6WuDQV3n@n0m+CLlvW8jm$5~P0~My;P-&jlfzzj3%n{6&u|qNEkA$j$ zWaiy&?GeVr?GYsJICI&oW=MgVcAi1Ug$I|QOahy!0qJMu}ky;L)WtKKi z?^ihAi)uiX9z$I?L9<1u=Ua&fEc0L8L@lDJ2A?KnZuT0R{iQ_q_KECwOZI1oH)qSw zJQVciVVk_moz(hx>S1zz?e&=BZD^nNgv#`%{3na#Q;CQ*8NZF+*)Ao1k;I=*M9amD zbZaMB#Bn7W#SG_tYnzaah#`)5z55O!cwckh^LSt5zUP{MaMKvbd{|hH$dkyALnvR` zU2UGUn11jJFoa6o9X~zY_#!jNa-wj0{5~dZ$zNc)+W5R=?WKRVy757Ct&QLEqubNA z|CYP)%>Ooidq$%5I=jE~ezuvOcDNCW^m>;~2lHK# zS6V*(0Wuep*@One7X))zW@(5xnvm7<#(HP=LFdzy^=LvzQ_F#b;YGrN9Uh?hcnHqL3E*3 zMZ}Uaw9@Tr&(L}gk$O)JFr}^bK6V8_`O}C#L_ifH~Q0y8_ z{Om?}S`nqxl`iAeQ**>B?-TL@`Q6Vm?w-Tf*VP-<6R7nYOZjo52*D<+fi5ta@?ukd zl|Yt|G&?I4Iq#Uumbm>dr#WhOn89!_jKKzepiJz0PYK7$6;J#abIk!owfw_`Oqp=3j^A+evj{E@bK6|An zGsE+uuw*8kq!vGquNg(b(8{vbH){W*g3+2;Ao)nKH|YTgyg6_p)q{_RXF27Mz5Dxg z8-Mg%M`jUbz}GiXUW%`NMl`ei;hQ@z{SYXaI`FZTqp;?&R z-K(QGTMz_mR1+0qW6KrG-Py@CH+NGk`+1Ks_m*dAL&KcrUW@e4)vuw_5nB2uLFWQ% z-?i^99eJ@0+<%}^GKIf^^44tA7@5MC^C^D{=uwGl03-VKclkQZf?doz2Q62Z=SgCg zbMSwGj9Zb>dHDZ?0zEY!0Xfe!Sg7bv)`v=;(+Ghpd!Xiu1l)7^ls|aNcjFx<;C1EZeZExMtw;VVsb z>W61X?!3BNNZfL2DunxuHC^O5jwfc%M`8al)wilc5q+dDmGl#j&=T;b}f$S~|p-;A{%$*d>au-?j&-80Wf=BuRR>=tZQB&XZiIPw}kL(N5JGOZL?MtE%MHsU_vBDvDYM61G3~cS+V82Y5w88*@5TVI9G8 zn_D@X_sWIR!ARx_RfQ|n{(U(+(`JeMJjoB9hN{AEYHd0z{Rc}{&pbT>I7 zaC~(I`;hAfZAE?&DP80bYtI~eglB_f^)0!d*)Q<$)G-zeR2kf=#Z-O-a zh{qMhxF~IX-Sm#0+B2lv#tAkj3Y*TAE9#@=R>#Z@peL*qZPeWuo4`Sp3T}`N_=ci`YUW8B<=m(1i z&w@m9*sLdL)|RvBwsPk-(Y94YMzltUhaGv3s(yM8JUp&`^Vi4tO6sTI=L^bSdJgoF zC-m`X|8)9z5B#ZgYY91)E~U_k*+FMg7B`w>KpQN4mkH^H!B_}S{*?^04AJujAz1v& z(bEVo!OW<=p?XeN$9F@A0#9r6++Z1}u-DGQ3B?weRj}lPX=tj-?Bt4R6i4;9R2J@* zZVCg58P88)cqEmf9uMF}Ecreb~mE z{~F_f!M2{kMkk0ZTWJ(Sv_Hi!@AG^V?EP-=B{It&`s-c6PH!rc+`~)~-%fs0aE`N& z^}*(kODmVz#H~kH_I|grlU(79nt8{LD$L>H6Gnu2jwxa#f_ZqK{=WJXU1a+wWq&ER zZGDS3`5TsN-w2pNtx*4yr;r)h8~5qwPDzRcSGlJpTH<8Pg&R+;H)HxWKh zb=r$hewWL%z=>1(Z)`uW$4;71k@=Gx5adjySX0RY8vCE!8LE!JG@!{G`mIL)^cFcSS3G-#i zDnv>v>mFwPjG(Z4nAAkWMzj1Fe3uqqdbbq6m8*_LL9`Nbn>Dk_>GDBzxU)b?w)<=4 zT+m$G4eweDo*=9|wBqaXy1kvJ7F3q3neuylIjj|#H+z(m(`25Eh$q2A#FO!;aF?da z)~47a*uSrvazd!|8Jn)k$ysm0$#hlWF6+4|w}sOlFv06_DDWyhnTNQP$zHHs|3*Qr zd3y@0l=TN-FYdnx>mlVYqOQAXy&%s!{zX}!BA+**Uw5+51ZBl=B7j?fjnZEHf~~*d zVwO=Gg3i-hXj*W<)9d9idsS;I3jXFVyRkqjgTD+OM1iwJHD915KW%L4kK_^gvrQfA zMoWA7CFO${1b5&ib`Q09`$AS=j&GGb!e0MaePr_pmEOMw)J650(yxd%ljo~O(Oy&P z`?ut1{s`X!kNV~9%flKD zf5P%lF5vd=m33fy?>_tZ!9Ki_Jk*3T)Ayn#T62!HJICqgDd4;F zQ<3A#BRgk6`JE7D`{H;xgD;{R-R=9kJQ!bj!H5hf-jEd#D9qEM$I_J>VL5Wp$HL!- znhExi6K*n3ShjKJCb&x`!F*8 zvI@#F{P(!gxn==UE;;-En`n_eEdIv2@pE9v5t2)_qje)7xz?Avi zXh{oXTK7vG&hH)P&n9-YSF4lNvQ5~DoKN0j52uWxPm~B|Z@-UBvX3u355Fc$c{I+? z7b!+)p_nJNtCL4buMw~H^-L=+>2(IrsYMLEmSvDB!d53vdW)4x%sXf!TvkL=i~~3q zK4@pl22i8zE9rHpwE83AF21^y2^y3^24W z!(ab7bqeikr!n`v(iewE#5jS+UuA=6)8rl{y&mCh>Y;_3%nG`Ilgw|E!3iwTc>hga z2&JUgT)zBs_7KBtF^`WzyyAV}pYySX1SSy@baLK!bKz}EjYGRRYYL0@ep^#vO zGct9YO@YimEWkH9%-UG{fj`IGb<+0~h>E!IFa&G#FT30#q43Ckh zZ=88zPv-(=y|LEsGTH9iN|4gl%u`EX_hRd5t!N0hv($tqqa6DTH(x* z5m}BuED_PsKemVU2>Is8s+e_^EN*2rUjercaQ++ly{9Pmg!VXL1u2EqUYHz8zgsuq z*>P)at*&?Lp4UmD_BtAL7@{uzgE2S|eH3jfFmKAfn~t~)B!H^?yj8O$J@2FvF}Q~` z`!KV5i}36!fzLq9k?7o{)q)9f+MkK1jOmA%yj426$b=*z5%1BW1nNq;TE7`RMLrB% z@iX$_)C=NsdocV>u=%rY!IE#M+1+kAzL~LuWmT7|$Q+L+6FCP3)wh_|qu^t~!f`kM z&`mDZHem==l`l;cb(PNb(tfr@MPYs}JLu6-$SmS*ZM~>PpHm^+e6e5{0YNwwR zz{LU}Lu*F7L?Tv*!k&5+(cT;|V)uUqcz^0&L5^T}o|aB|(4cP+L5}Z4e%r&O!@fe^ zv~&+IroB{OD{Qu0PUmit+4{ggcm2fV;`Z@$ro>0i7UuLpuzBCkeYL@RL|J!M^GcwJR^ZMkaT%Qt;8ynai~ z2csfKZmP_9wUW)BJjOx@na4BAIr6>e@Ok6MC-j5(f5$+wfj9v$rmnPf8O*x&h~dt7 zCYUnZoBUAYtB73Fet5}te?zuZikg>IMus7)z)Pd%2((v1!(~Cose?FT2pydg<%MjqI0lK2KSZWwN)}Rw#=02D)jR7-{IisQoLH7^nuRuV_t>#i0o=sf^P~x z$-IZR7ZdnMzlzLj@^vO(<`SF3{~bB9CC7#yUM!z4%^zq!e_som_#RPelRuTh1pYu# zLWHG=Oo~wc*3%aA-z%Bv)pBbd#ROM3c|Zp9huJz?Kg$HdoAzC|_*U{R@ymIlJczR? z<6KJm1Ye4_EEg-hpZ>GsYZj%)d8k<4ojXwk+)JxiR0qSWn5Ee?8MLu-*VmQ)e>RJE z_bO*tZdC^JkGOfqV<|jO2!vtrs;NBN_7fc-!I3j^t$(-hn}{b7-&L!R@tFS{MH=O> z=9GKIIZC1dQcSLSWqfKYq}Ov>4r>1;^8Icr-`~gVW*hNxop@%%@f!y>52HCj@x>S{ z8RW0OmxhY5Y-kxnTl7EvTS7d8p=BQVuD!0(xw(-yVQUwPg)intTb9a*@)8v57WcE* zz;+5g4hWM*PD=N)*hocWrYIA<1T9`zP4daTa#AJMU)J}Z|Mq5P+8(GZjtYjh*TKB) zFSIPvyv(6Jbhjc}HgE9Y<^AOFD)(E!4Pm6t;5%3L^Gpc(uU@5J3-}5;OU2j=7Up^a zeUlTHYrd)SAJ?o2MLl1FP_3b;=f6hL-<5ooa_AbO^;hkGQC_P2RjYJa zmjWx*wI~IWbx*Lpg~h>_u)f7Q2Q&0#WVo4KIJ~r@Rp$8V6RcoRUpD(k%2fw+x0vlV z00&;gj8j*-Y8BI*o=x8vJK9u^<7~RL+|~qIX5L{p+~R}{%i2z>>O|R?5u4@C-0RIr zS1^^sDFkh+W^1f4fdc2LYQa{+&Z&n)&S(waBwsP?4sXIeo$T*yos;XR$#Y~3XF~1~ zst{MD-Qw!}q%|$9sBNtxKF*pbXB;C0JWiT3F&GgerEq4xo!@8tzU}%Z-Vmoz*GLU( zL#4G#k|Y*%o=|qzhkYZL#8%fyi2T*~%)DpdT=6nOif@lU(u0cEEmdRIngOCq-L#;) z@`o80%SdWVPc4rjzFPhRw-fu~Mgm&a0D``$|0~bB(&JfQ#=9k8p1RoWmXyvA`?^GT zc;x)1xU?FV~)sba8&HwoBf9vf zs_*I_q&FVW-nf5dycHW`0h3QF6a^{0k=7TJq%VqPIr#2`gEpo3|FS8J)}QVPGwshJ zM=5_3K5st%oy*-hUo!;Pwm&^RS^rc$-MJ|nKlA+K!?^*JFn?sTn%{eo*Av_FQ$@)9 zHuXUNcTY3kL^bRBznhw(noan>qugKie@FS)pXDPSx^*n8N5T5=Q&K(_Av(m(Z*BSb zy^D`y$G7~Sa>xf~$o~4bg=2#lW>1Vmqh|5^16YPcil=dV0HYq^J_nhd9m=4i=O7S+ zOC@&^OSzuG7m=LgkNu|2oR|3WH0Fo7PwGzTYa4}oP@G*50@-7xW7n+C(VYLs+PTL^ zRb72Qfds-Oo!b;rKHz1zUSV(zGGi;Isioi-EIC0c10rm#C690 z+aj{Bc6&FPWeG>IsCn{oHfG{CoeBSYTKtbtLNt*oG(TzBU4WS-qntMIOL&W7M+Z;{ z0GT1UvEf)%3@MvP9`t`a!^%z+`#ac@rnPk^31EfRf{aPdYG+=1-@?a;tMp{CDbaWU zZ;Pz?V`L=W#WE~i6BoDS{tP_w9(h+qB;mF-D!2ZDo7&8_HE7s9J_!BQY`{DDVV?#B z=0NgU*zeJB*x>JtK5p5~*`VcYpKkfPMBe;-o?`{a^H-*ku4SXxD(3QLnuM3-fg=H} zNO|6|HNHPvC%L?)J!bobFNt^E^$^gHkJdQftbBMJqwxDsY_@Q5>agqEwvWE(BChuz zMjKR?Bb~%1@Uq}8@(@w++x%3-@@Mgr2)8YK%=C?1#A)PH6>{dls_3Ux(Vr+Kg?VXj zf}1hNnZh8rUe4r&_#@_1!OhQ&R;l?H5M}ciKH-w-@KX`Z59p2h25|5NiPCIFO>f^_ z%7`Dpy&P4EQG08FJP8{j-lwZcGgn={lt=q7LdaR(ZwBOMd<#*Mn>rp<9hXsunNeGf zc};LE?J<*!3b@aX zj8wX|mY8X%SngL6?saT>nX;=@OY~J9M_j>USMF8(HA>z2r}c!(vk2d5xEO}gE*iXv zuZ9NA)MQcA`}4;Jp=Hw$k$I78bIrK(l6U>v$zgta#CL~}zkx7h@VxOONrDp73;9jN z5=I<%+fvmD4nYB9$>$7v0t6@POw_bzT(_h;;u->;c1+dsSvX&~gra>bkdG zKan}pvrzl2O-*T7{;Ys*Uane_(D86w5R^3O@P5{@0ZlwbhVK1+0~ z1ycK}es8XyYzqHigGqj5FUeBtL!USJ>FmF?I`Sa1ZwX(CeNgJ4!0z^k$FXKR^1yq@m{D|i%l$E&Tm$Vi;9U(#G`Cg_6hwg z9#h0G4yM0oB+8RMe=PpcWDH}GIfc6SC(`0?=i~XmSY}l{>P32@y#bEq$F`lWjOh&8 zvO%i~i09vWw6d?`vXL&E?reF(_$*F8Y7*nNYw0RZI$9Oq?@@*JH_5M{7+aEw4k z6`D-~x~`t5wwi4CZa}$(&uj<1OB?tOc((JN&h9NmK_Yw8-RhkxNVsD<^lWm$H&3pJ z^(rrIsqZ6`OX}|xvB^1;vfEi7DoR^sq9VSsFtx?ry7zk~B#(`7?Jv;-vbasoOR!xA zXZHU2pAasuhzDLG<}_O2|taz(CL7VH_Ic?h# zJGML)9_aR7JYG}Z+rp%3YI$DMHmEk*QAwm8bbyB-#!O}=$r)sb@u=w=pr+&!rMI=5 zsZQ>YB{!a%qcA9i`Y@w+E}S=Gq&_-*erKH_v3hJ3mOej!qX&K7p_h2>!4(<$+~y}6 z`ux~Z-2u)^r|EO0pT1u`SWmhaevLo3*k-a%qjNzeZS2+EIdj8BhHaRVZ>%*9?~-HE z5aplRvs;@m!qBZ-(%s_zC);ULw#N2qYPwh6Xi{0y$3`TMx0USg=^&P4Ly{~jORS;$$cwER~sPd6|=zv1rU-m*dQlIl~woH1q9 z_Tyt8|3tRhoT4_TYg0X=VQzpkIa17^4tJWRsStfi6Z9*dp}fv};aGZ^KoBe*dlv5#frX zKs|=l;axyAQXQWLr|zeRQ?VutP{q^NgaX+qoS*C?oL}y^{@?f|*{1*D(w6xj$(tWv zql(zTK5l$qpUT*k2V`BNg&&oKx=v znBKQq`vv2{$(@C7^D*p9+K-j-v4xx!95}WsYz`u``YaH@W{48z2w<*&3>6u%PJ8$o zc1Q8wYLis3gr7+a`~uNIq39q;yV>Q=1FaP@$tLfRz7Yt!nwlEn6Lqc$bEz7011(Uq zf26(kEJ|i2X62O|Aue@F#ghEZc%DqcBAfnpY*Vkub5oEek@|krDpT@WlAY!RgclG$lqPeKLDUqz`qye@YVN^x$PUfNmS)p}X%>W*Lqp$t@4KD|u-N|hM@ zuM2)omsrCj?{X@EzIh&NoId5Uz@{!?e=A<91gA&dQ#30^se%2-7SR37%I2P|;iDl` z207ohvuVLERo|fTZpa@xYK(YcTZ)MQJQ~>sMpie3ZaYmEXsL{@hD&&(fhOmh^wRDP zJ(urH16q!aj?cf%gZM`Sg9KoXAq*<@-n zd8w5A^NND*n0;LIw;-(1SHtqTu<0`{95(zy?AkvmX6o^6Zw4L5NAc$%9m7T4ShulF z)R8l9P19hqKnd~^F%?kRV$(19`B~ZmUIawU7ElB-3m=09lRRd( z7bT36nMl+x`ew!ud3lQTF)hMAZ_zY37QXPBr9-E)(2$TpV)!%^m!_t(MNJTsy*Fx1 z#gc+0?8@a|u>o?jUytiaPODNmOuy2d=G(Brd3#ZGHf?j7BJ?1-+Ei}Q?Yg&oXjrhe zfEo7K9dMLM2< z7%rpvhBYz|W`0djdxB=h9xyx^_E?O$MsvlJ0O2+~XRRDUK#pEw7#seWF^u_(gVS`D zDz<#w&0dc)i1ULJOY&+z(SaV>qPIl{zNmEaiei&}n}#I>TI&*%!aQ zcZGh7e?n>aQy%;&`6s@ZUU*{*?B{{-w*+4;eLnhi%e^>%?H3cL`?k0j$V%_M1Jcm4 zE4VC{fAQm5Vk`K|B9gE9^X4Mop%libue^6)cTJ75QU>qrKeuhN*cWiKv9ZYwAljLX z88O{(Kz1WX-KKxT#%lc5 z{lHMLWoYwsAfVu;U;9Mv#(roLdvc{(CM`a2NGexY9PqiP)ATxgBSRn64;%VeX?ThB z!SUR0{|X}c?=rQj4{AE8OXx5Lm?q*mgOH)*IOKDS>uv_Yx#2_JriF~e^FBM20&4C( zgaZ0enH4@V`oB{_4qyJL*33=mmW#zgS;L<#YM^TQu2%wYE*My-4T(7tva63&GO*l! z;dph3PpQAL1g83hyIMPUg(EF_@*%mWT_+}2JJ0RRn)N|dd~jA(>{!89D<;l%aC}J< z5;w*vI>d;|(jl`8kv}U-ugR-tK6Y0|HzKq?c?Z)oxsq(-jW~PIJIH<>CUmYQdAy)C z#V`$T>IaG-Zt$2(<=>S6Jtxdc*_{Km5HL;)z>pW${+UBwcC6yGbHr(p)9GIFtKwl+ zgr%o>f>6K+n1WDH;z+Ug$BTMGS{*SAn^`0^nE-1ufcGD){C9RY|EUrDr>k~EGA%oV zdKKt31&jG*3I^a@$=M@)<$M5B@i&n>^30^}`RLEV!6A%4ysu>f*)V65hxr+wTE%ug z-0Jl%k8JO2{CZk9?2?znF}V9wM%Sf&i7$ouj$I^-_q%*5nUM;Y8JXZ}I!c)ib~HwA z^M>7Sp*UTmog)aswQX0s?`MPCCod8Fn79&T6z{(wIm16-3{KN0>fy3#;14IFni6-+ zp4gllIiksS<#o69lOU%XKA(Llhs{Fri%Omh#`R~H6xq?Y+$fLAH*PO)>Zlu|`TSpd zVqHsxF3g;ZMq|2ZDV}4lUI|G@*q|O6`Qy=igI_RP!-)-o7zZ}96S1gbu!Q(A|3^ra z`ODk?)={&*1(ex3&c$;tdkq=~;nBZ+dI*glj)& zA-_+lCEZkD@qa3$==Y(-{jC&}PIH+d&ugcH?7I`V$KiIIHTyJiA7W-##x5@mH?}sM z$kw2V8~Zp>J;8~50U3d^2&7krQpb|VC9#UT=_zrkzB9a#hT;ld)eu5C7<8C(TSM7T z9?<%496%yvLw>@`{F5u3WtW#!mA213foemFCkF{#;w;U{p47D3X_A12K-Nny%?s#% zVs}LzXEZMdp9^-Mf`?zPumlF&7U*JjJEeybUt(IqIJSh?a7?F$$+5w!$QV^}puBNA z2Z6FK#xc5=LNkE&`NDT2%aw23IXOOu%0{j&M{Dz;@%JYK_ z!sd$TJKn3r%9n!U1F~~>*CUEgTj#yGj0WPlOMU}>3H;tIxE~vo_qM`0Na}o^ByBal zu%G0b^>L+5PX3H!hCuvpKe^hcADce*=cF?|$bY1Juc$psQS?r%w#Hd{`OVnq>&82U zd2Z}7bIub8UcrUupZ|-3wfVEyc2;x}&Z9hl6QI`X-N*+&Fj%JbFt#wH?L+TNV4wEU zu9JtXmZ#kS7Phq*XG_)}Zy4|1rln?#zffGc5$fcvt?A)!d%+}aSeYLFWIu`FYk#uR zrYHY1Gk!lkJ${=$R`9XoC*6C+Huz6LC5Hyhnq_2r?{|8Q=eDW<^KX(uZd)7dv&)O~ zL8kEZ#UJt9tZn3zuHM`8F_hS5*u6IiD-V@yFJeF^EAb5y6T<(aE?h>V&zV1wb8hY zy?nBXC=wgINlLuqK>GfTJN9=83l8~-t4Pp0=`VJQSZ-**`}0d?p1$!@z+v$4 zm->K~xq&9Vg69ExwO=A=7M&Qm;QeNmt#+2WH;X6O)j;A12lfip>q2kEv!>>Xr>WU^ zOS-0Jl2~88m9z$=KluZxCN9*eerkIDZTf95lFm{B{`=`Z{tROorTl!URt90))x(P13xB8zWrp7aXsnGf`+cH&;oOtZzyXN*fo}Y1O*zjq`x;D0acms1 z1J(aX@9)o;flU^1<&q2g7p-{bn!Zam@e#(&?r>wEF8&_g3R~tv4Oax|xgu#`?_*x6 zrSK0QA>CkJv7cTd{J6k!)>DL+qI9pnpX%esT;|_fswQaK(2Eg(O55vj&~%FTSW_%Vzp?;57gyVF!+ltw1s}Y6}{>FS7 zb8j>&egc{7Rl^_b!Y}<+>#mbI@v23?sdvJ+Pn(5*xax=x=IkH~KenYB7s(~M9;bN< z3??S+t2iJ9BkysFc0E!H6quE@@x#RKP~Q2-lt#ozOBkn^Lb2*Xw{eweiAY?C7hfP= z7|xu%*Dt2X1_cEtYH4?MKHX<*YDr6bT0Xb2k!IcM;_XjP)005sds^C^rOyuSv9kNU zqQhLvYSwk&8*18Dm!p1Ksm#Q;m3!6w4-aL?z3F?@K1Sqh<}YmC#aA<7{!(y$kLNS= z9M3(sie=#}dd&WMrN^of&m9`#)9HNje#eJQco^Tm<}W1pGYQ+sU)DSd+AvaZ!Jo}D z=d|oO?iNvKToRD0Xo9g>CfMJHs49$(;T^++B$AX6aVjlYy4rb5D}r!&wiF%E;lx5K zMLxQP{-rkJ<>yoD)A7sErnJ;uagomHwLX*y0+CfUvb8dPZ61e8`c^p=t(E<9aC{=%Lgy@Y?d;u> zy-5npY)i3p)Ud|xw%f)gyR89q-Xm8WY5}}$oDVB4P=Vz2$UWWrg~Ok0|LedVA3uW) zWm^{-P9vwso+5`f4nq$SIPwuVt{T=u;NbkKI0;&E1n^O!QOia0BOkyz*o^MUY&V^y z5BAC$n9cU1!)f}hDYf4nl|?9HH=YpCoTW1tggQQUofkiYfsAQ`hg3KbR!Tfsa&LVD zPnOugr_9E)H5sItX*%H(eLeDFUuW58Ab9kEwTzT+++o?zY&C*H$&H6Yp(SH2|0{3W z<20X03Zg&ex5*3S<~p{icSn+j@vj2-w5k;ob=7?>C$rBUIN8nS;6(cN@rdFbNJulg zzkozR1fLF1*R{(3!f6uq8xm_`k!XSKq1JGgp#zm#vfry77dk+>PLqVwNZCEjG78Lr zId1;}Y(hdt?Cj{i){k>plAVQ*naT>DS6Y1VGiZSx|9ob7Y(R8f>*pu7?i!ZOZ*Fu` z>(1OUif@J)@OG;Dk+M(yEX^WW=dXYd%{G+`e0q1kQmawRma>fo*F>rrU$#*VK%fk; z$D?tw|-sdtO`n>dG`)t1N*Vy2?9sn@}-p;|Cl|t4H$AKh@MQ@R5C+ zc8?ruU?aX}xf@m`^Wgox3J|rkSM}cG$qwIJUXp7^o;>CVTD9ZvLsQ-3&xr-1>ovQ; zvGG6_X|>0qj^;|r8$0s4LOK4oOHjGzF^xL17PU`0x%T}gfvBxPN%|M7$vLgCGZi@) zSP|gWx#TU*gV*1jpmZTw2m@un34#}|Y#@X8TmA@lgRv`eVq>G5$LviYM5-6V=>{@RfvZ$JYSS_(6HL?ucPhc6Mkv#4}a?JfzvZ?isK zK=z)sWaKNa@k}3V7GX9VMLU@GZ~YsUr1_hMQ)0-q8wPG?q}7|LI%ylM zTuoLgp&!W4rZ~~z^a{*XT=#ZH?k&>FkCgX z@N21GWty<_)Qziep5AjT$%`}Nu<(DmyZ?chn^T%so0t3<-#D3W; zJAC6siQzgp-PV}qyo@KFd#O6Nsns|)tlZio#C(1!$ z+L6I~^w}?LB-LN)?W^i2aZv986o{sx3<9rD>?CAfb0<d0 zjPd;CXkT73+M9vnwcSAfBVQO8JOLshX*D+~caN9Npm>J)rV{+vSmuGHy%doA? zgT_}s-ya*aY_{*!C9#@f>j>6C>*MK!_vv}M8SEpWRvofA`LxkB+1(QFM-$BnA-645 z0;uS+i|KjnhJ}L^x_OaXsA!gM(EKfG3l%F58<_F*UUR0-dV7o06EQtQ-Rbq`74rLi z3>w&fon4>RKg{Jqo=Dl^x$2if%wDAZAiSq{B6YmUdMY2hzr17+#7LSZTJFuTuDsBa zI|GU@nzE>D7+E|w+w3S`^~#w!!@#`F+APHKy?TSsPwOX|kJKV`UTJTub#EY}Omf{=dP`yPi+~U5@r}0|?fYf^a9=$0mKWySGNS%5xA)W2@vC=V z+E)DRW1aJRf9Q_gXEo3=xe>cIYSLr*1LrXOu^l=#B}M(%4f|M0&gsKf0{u7rl26gi zeEclB!Pj4uZgLjlbHa$Qut@lZz|UDf8$0>9hs3@M7I0PkrM5@eN9-f7yQ!N&5> zjL<9@qMKWH<)-`BiG9%~=aI|?ksdx%0qSl z=h1kbzQzYWy>IjGk)@KO2=hTZQdSom{7gddvY%mvGOGi>UNKf$ulG&TprQZQ%Mks! zf-l}cJzb)wiTtsA%G*3Dm*I$r|JrRivm~tZ-3|79_iVO{hDaJe+An~yi)`FsH-z`6 zH-z|ue6|LMm{RhxIjnSEToaD$XNNYN50&xB6Ds2c$!AW^y2M#Fc;Y0Y<1IX)yx}01 zNqpbbxMq~XK}^H+ggvSq9a9#zbu?2Oz~9R3brnnchohgGy=psKRWy4nf*aqT)bv{2 z#q1AHs?7eO_I;7ED;CJ?GZ33tgWJ`#aSk8L(MeHvmGh^qn9#8DV=#JG^5IW%7)#^J z8WOA`^T45tfI(YCLCx)X^3eClRLNP1?fl~FwcwSLvnIyIEp%^tCyTnJgL5gj#iVln z92PWz{})KhvLL8G(y}bj_XX0jESRD{GqhlHchMCL5=?QLE?2v;pW0Ti2ReT;-rS}; z*^4y7hO%Ao0nM+|WRcf8(6gGb5ZyL3&peOEsjD)!XuQDE zlw};P&I>y)9-yVI8bG`9H?Gl`5()W|$1xaqV{^o>9`rr-eeh%(zmQ1TyR10b^EveQ zegE9az$lP^wT32C# zm^Oy%WP(yJkLNT@?rLhAPGys`A8eb!udoH=O$$J!YdN~u`w-97|Gi^?IfR8&8~|3@ea3G zWtLv^VEKPNUGmpA*l)pvenzYNBK3nyfQfTttskS+bsN8cZn4&mrvMt=z0&BC<|~W9 zlqTO+`>|9;MDvi!C~dK2f8K4eU4>c~Ypq;gAPW3qu_-&t2tV1{*C@^SPAu$#0ks@l z+#omNRNu;MFzsS&Ani`XY+_B*=-2iKoX9WeYE?X^wJH{9>RT1Nu{9Ka9=5B0Sydz7 z2)|&T_3}0)q^x_J|KAAj+fX%fYh`qBn_O}7c31Ta;4t5d=l&c<`n1YfzACj)3R{E| zb~bVk^@jfoM7RC>&Md9MBuI2Zh-4sgmkA=BTmEa^KDJmn$$PTQOsjzC{eox9V5g~O z$pEy$TIPK#=+B|E%+#y|Eq%$$jt~*;{Iz$_UyZs6%Xq$si33%PF3ycVC1S0Nm+!{l zzFU*$T#UW}jh?x+nL%yDAd>d{aD8ts=Y`$jwiW>{>{RS#`u1XA$aABHrkR}Y&eY`8 z_8Yt5Q`cGEk;2i4?V8s-yF5C0bvRC7s?XLkMZU zVS>A-VSn3YXqqz$a1Kk*d99Y9nJq)m4OE>bXz#RlBo(L*(7=_bT%CqRDh?LZu!yu7 z8aMdiJ$iw~2s-KA$Fs!TliIhsC&) z&`0aTr5l{@-$shg2|jGvc+f=rfH4%5&lsIG$&%IkBCGdO1aRR5dnHP~hfercm$S@o zpXDH-vS3iV`L+F!H%~ zAir^=sd6s?9e(cv*`T>!`#7gmb_rLE>x*N6!l`*vxvz1jvI}kv`jRq0MA-U8W5ELhA(i3ttn7pr~PdH&TGL%g|81%^2cI4?q*SuR>hFmQ(41e`x@ zM8GrLVTzGRa7y<)u7NQCG85%fD->3ZrW^|SOfZ@e9=SWbuS0}4r*h<)O6P@^a9gX0 z8MfDo_YBuG^d#nAeAf`O;d+(M@|M(T>cezP(*HP~30hik4|y~%wpmhPbB4Ud^QKfX za}9JKGC%gR=!F~H_~qH*u2qzqM7c^1kHmi{NI1`LDStjhMmq90m{4W(t#XXQ5Yfi} zu8Lo{7NTb-P#+PqHEeCGwIYaRR=)8j{-QF`F7(&PXmL_zwKOgpjC3b@J8DiJa z)5I?M`GT#YcfUHYQtcjss>!*4ob_Eam!W;{zs~C>`-ge%LH5%!3xOt}*t>3MPuh2u zrDqK};uo=|Ic5LZ*e+J`)YmKH&{u^MD4FC88q4ntj;{>56WKd3 zqfk$ULSj~L4(^DZfX=rRO|OjI4jo2XirHRNW^by@-d36YVO6$=Qr_@y*_Y=1O2V^< zTfDTv{MuvHT872T#5m`8GwwI;2S0xZ*-fr42EPtID%S@k4|>QZ&mmdVVAqFjCf&vd z@;?5N$ucjUh4pErpDu3bt+(md_eg)VM|mwtbKLB9Nw&(*qxYySQZ|oP5dnyQN&#;a zUA676OqeD|sY;j*`YXS}23~0Y23tNk+wZk^s-G@+kbZ$pZ_A|j?~$&Ks2+9XSevn+ zfr|R_&D-%41fc!wW3&x%RXR5V2>!BnZ%$5d-qYeMtm#0|UjnSyBFK`JRw2k!iMV9YRUAdT zXu}EB1LO<*!cX$*?=wJ*%JJkF)s@TGeE5=-szjvU`?!pgIo0ala^)$vh2}j-A>$d< z@d&jrPLulH4^5RH){|=H+ti#)>Lfq)38mK9)c5PsWk;J-AfoxViErOUqQS5J>gOw_ZL`zt?q{*O zX4<=0$?@E$RHGT(n-BNstM`COtsL@CKldS;24!h#_Fu~oZvog<|#cpjVx9U9`^ zOrxKcMx3*LYf}SRw%1lVE7x8YANZCr7x0#CqYml!TGS0yX6gw?_f$pK zRmJ*MjajARhQF_hzFIY=wUU_bkLd`*49S1fCF+8%qN((zh2C+zVT&XU4a__KU9&Xf zt5iXLc=H@l-VCch|BGFpNBHZr3TPvd$>lxbhg1rw(0DsmQlVbEM>2gC+n##w4KTgzub72xIY%m`);TKG__7c| zi+*c`#_=a(@nkk**tWCHO-z~y@4UA(2gqrPk2_|oIy6NB4bxR_?2lC#Ahm`}31{!- z8WZo=0=VFuNKQhcavNKf7mt@{ryl`^o(`+kvuI(?_ZY%ytI2smDKT^O5Y69JYBI5*nc~&0P)rP4RzqJaDUi_g=9xW>7aP=5n)yG)zpVeRuba@VI0046Zw*t0VIvl3 z-u9dxoyx85RIVo6ImGQm=2+t{AF%oH8D;%9KW^_h%XOpI1QLtBf)XQkjhw6J?&2vqsVl!@VuHC@zsT-WY*1gV6o#Y+$%w@`Z;~NPMtSx%#F+gdbp2$3j zz1eSC0qj#t=BYjN)RB4G!V?DQ?fMaNL}%2fsSjytnsdg^*~jSZPW$#o{TRNz6>@&O z1~-7uxX>uwNqV)8UJ^5G(BeF}2QI9b-g(f!NSUt9%mTr>zsXOzAM8bvCo*8{oP{@; zP*aQeL6H;GH77bk(3XkEmC#Y#MfaQA)w@=6RB9flD@1de0Ydy{bIUv@OZ#Do`yHno zQ-x-c5`I0Z*M3-6H+l&knO&7I^tx!VM+ZID8+v)A?&frUa0)NvkzeaCKqVNh39BrN z8U?FyEQIV#M59#R5mgd|a z`gPVE@=%jky~L!QFHy)YKOyvY5(?>0i8tu`Ci$f9WSEAx%}+1(_TaHi)qB26aqulI zKlth6y-u5c!u_PnR%hjlNB#6dZ>+6%eMtrLga5SUd)j2k{uCZOu=%r>bO_q1+-G!d9K5>cdzGqKj7l`Bf8B zk5H~1m&S7f%IKVG?pv$5RFr*_;RvsB5BXlFrd`QIYvr2_C$@+9@kDopA#WAwpqoR} zPS2!NEL}5ySh`)NDu27F!|Kinzbgn6Jqa7;>8HTqF{{jk1ywZwJu8E;YS;Z~l zh9`#Lh!fx?-kbMA^&R|y!8|duCx5yj?(>HdYRQkAzWbpgjr_IEGQ7Lfg}hTKuw14I z%U@R7^zjiYMY6{KpLFjPHD%`CCuc}^3Z!j7&T|dV2IxFj^V~p5k#{lAhE{nFazq70 zW3%H8@vEESRodpRzs+ZI-lO7rv{d7bwMi4wNk0Gc)2qEfHvPQ2DXNn!HvI-aotCA~ z)#h1Evtj)vTmosb~*V(|Ifn@MT^Qu!;&eFxllPi8jS7LEOPYv7#dMrz2Joo(@ z6dpAMe*Fwl)Z#27L!3&>O`*lC0_e~C`h25XbL}jZEn}5AIAQt6e^9s2{|lL6Pd$T6 zCwB7yYgoXU8AQ8X!P1TQd@oi|Sc^BohT5UAf@AHIiT! zY-My0mDHY$&ryjUkcZ7V0`*_-{bT)@oq_0xh|tyJ9=jgTVO{YS*`Mpge?^yK1#7Px zoz=B2x*^Pcn?&TWz7ZK`iR>@J%hQe$;jz0FbtKAP0<>?(H-ht+&Yw1DIBwLGEbUy- ziwn_WBfjCJs=@EFJRqds;20{r%pc3tB5zJNNyD z&xiJ9Q(M<)$X6>SBY~Hd&pmq2paK>1l2V6_ZK8HG>xnNBz5js zEdD&$jXxowOttE)@#(8>WWuXE`>1H6oIu8KM^L5Ulp7HbIHDxbH_=Omi*qE`YR~@) zAnJhUXrtP`$nMf9YcPxoIPMf#sS#(@o#++Q<8*oX<$tVtGFjc&50x=e_L$IIL7@L^ zpm*hPLGNt0En@01WhR0MNTUs9FMn$kRrf)gjMut%3G$A#H1O;38fnn%3|1lpWvvjz zy*_^wHzxu8-?rLsDkE%yMS5(Pw=O_o;Xu#O_m_1=mzY@V$DpS1W3B79)Yua3v*LFW z`~Dd{>6+uC#lAN^p}}HiI^?_h@N3Av$NV1C>&W>%Kg|jAgba+7jk^|DTfe>WDS`nBaIwV(?prZ$ zgrnM0X5bz%M>6!c=l;X1&hFX!GQ76I%Mp*X$6FtpKtkN54hYx zS2xsLwYIpOK^bg>6}Flsl>^4+YC7|wgXGi@^yAzcS71v>9QMA`7g$96GhH2usZy-Z z4?cY)yD1tM)PpM+i{$o znZoXw84%A98uOASv~3Gd@agQj%pDW|p3X`%Mudw;t^lPIb%P~AaLzZLJCZ)BLtHrM zjZ)Mui^hzyhg9UnzBm$I^6%_PbUmKU{7%cvuka4cbzQ+t`aSOkL6RQHEoK&nv{nH@ zV)MXYf?UyDO=!~^?r3(MOV(q#>%ybHag`Pl+%IOb8ls=+&_2^nxVq}?`j_9qRD^y| z)8e3LI+iFlKM$AaXUtZYpoAnoHD0f!@62S!`l&lctedZj7|f>hRa!BcZ*z$kd+*ZD z`fGFDcn_+ksG&i?#boqs0znQI;EYor&wvXwDv>+WDo|xRm}-G){dc zHQJ5?oQdaoggMdT-#6)`4?{4Hy^!}`fZR+ZtG=zOqy8?b4aaav^v8r@yl^T1cX2zq z`<>6q-0V#VWwf=GYkK*4*DaG8QirYCjkI)e3Q7Iq+IJm=Q7v?JD;c@Bv7Mh!fsp+n z-v1@QVfV}eBd6>J@+IQatJ4og-qPfO%mGnCp*OzH2<^X^4l(92Y_DyBmY0g6z%=4N z++`AxkKo&GoZ$|EH~~MEe=LyO93r z20xwqKULF5xQcmwZHL}g+PTwbR@S~y`>!%L;lX>2vq z%7<890zK^4bg_8MGU3?6W_K5R%FKz;*05*qG%DTJ9@w&Pr$LqMz1(SobltWJj>CMG z2i#KpAt!cl@&*aIu|Y^;uTw_g%l&bwcHY;OLmAhh3);ddcRuGoVL!Jcb81iDBK1Iv z_VlYF+u76aa{Hk*F<;RM*0fNAQRNJxn34DTN~PP9LYaD_34z|ioetgvcTsuaYO_Ao z|3`-R#dAmf2jG>Y;AKz1GvDyv!fB1;zc;OJP{W*F)9MB+H)Ao(V})k)rJ!Y*M?qsODg|6fz2M<3$f^N|Jonfo;f+uH~=p_O2S?a2_+ zlYncwLU$JU?SYQqWCb``G_kjlZ<*abHqpC(ra`S+X8EXP@o(5Y7FUrGDC`a7)%y)d z=&iEZKl}ZhQUevL67JuHib-n!;at_t#uKFFL>oGC@qn)4U z$#K+?vh_yd)nFN9adbmwgfMPKs0Hxp`@2W@O7}e3G2vf2!*sc|#vhcoWN!C>=>IS~ zq=`5BL-M}ur)xl@9~9U4jJfg#*&+2$56PE*ew!ivr}m{u{}gb>4$zM8H{Ihi_uHeY zv@3sROx#{EPmVP)tcUEdS~-r+(xq)V*a!F4Or2r}_0hHILH*@!J18>? zu4PZ(yCFTKACqdt2d3yWjpr1Nr`%R@{7fYEy&Z&+Gm?!EH+gnuNQX=! zGA0rK$_>z&bZ-kK=YLW7D@8zT5>veS@|J-2Z zA7oCXhYtyVFPgm0$eG^51Jn_;PTe;G^+)+|fBJH!`!km_4UOGz_6ye|$C%5Rh@XG- z4MRM)mu-KW&L5a%=Ke`ymbrVsF3~;zqKpJDT^ z8>-&?!I9A{2{*0#KbDX#7oNYW9!zykUx$1zuHRu^7+7+GyZo;{epqp)x3N$Z{NobF z6(2}st}ypkZgoel0|NQ?8BmXSSU;G9OV`aBDCwv)e+}8|5h|_oEk~dVE)`s|4P0{b z%u8T(kMw^`Ht9!*KmPvcp>FvHYZ|s`rx{{q5ByW1W8FYq2@{aa7?3vI>-}&&}cv zjBxb0aP(4yIU|)+=Yh7dErU2;ON3G%m$j*rmZre`C|;FUOkr~+&{dQy4M;6{+`L5ZE~B>6j-bR(-L*3M9Qu;MG$Tp z_0j8>DY2P5sX2kHua<++=6$chZi32J{$FW!d45$5|}6XOQO0hmU7^ zv3rl-i&Qkj<4pT^`t3tVAcER&CVqu@V{yZr;aRm6=3rgnn$U2z(d;3pJd59ee$8f} zt?@BE^DkjGE?p$LadNW$d}28_M?Jm!78_kMtX>Tn{}bXLr$KXPPrj4xpj}^vuw46n zoT8#Lj4@=6db%y*LrU?AO5HrCc{7+VY4EKx#jXOl#6i)m^?71pub6L`Q)+k%VR6CM z1fj20uU#l-Mpo^Kbo7Ho8a^&4;5+}DxYTY}XYv`1&|8fA{v_wxF7D?XhZm0oQxhyH z1XiIer7DykTyn}5YS7rVW4p$FhJPZ?GT!%Y(UuqY{q$shh4^JF2IXVDrX{*MlnZ&9 zYH@{!eBP@6|dNw@*|EK9h^O=0{c088GY}2iP7x=_SB{Rf;!T;pSFI8_^`TaB>w+tgJ zH2BZvM!g5;M-YC|dlP!33wb`~dcRUEI@0q}FQzf|=)V?!ks;Ig8`SI>8Xrj;hQ_7% zFqk`mYzgl++5)IZ3VocwDgeN6@&^JsZAP4h+ZnqVu%T8^PQ}yPt6p6lXhfU;B#416 zBwR5E{9P`UKo90|mF9ZbSk(xS%`ZYiFv!Ux8)!^uKBQOK-5nzvU`kRCd-(R8?gsPK0SY zO~*q)1oT%1iXg3=`zF35LY(bICZRgOfqg05v<6DQu6 z1Ag4$PsU(x>>n+)-=m|?lB)VRx~hrdDX1BtCaK_QvczcZR6Fg8sleVrjhrIygk3p@ zv%{-#<1;bpTbRpqF!kxu)&GajE>UH^>>i=OHa11iP5JX=wv_5dp*1Ofl9{#)v6=Zh z&xZ}d2O9m@^#~%9>Hgik>jZ?fEvKFD4Pp_odb8|aw2r(h{n`ceKD8oK-{B9Iet+6c zzXllN1&k1puUv2LRIP8he~`=;%l}XFQ}B@a8S!)dWN!r&PSaIXA;1MKl<5=UjDV3V()i;ddQ})wCNu$BHe_^T;it(ZTh1& zz3CgI8~xF@{q#cjJ1w^usxw6I&9oVJUQR}1mo6tG` z{;gH|7-N;btc;CTxWVvZfBxouw%e_p^86S-Ei3b$=2%oflto~z}< zuSYsDJYS5)Yu_pzLUw+{p&523GOxrh#9S@Ev*r!PV$VsTjdIIW)1uGPSDnaz8_b^N9FF}`jIOXPN2$z7pULr@K5EwvwbPrL>P*7I%3op7zsSg%4@ao3ywGbaSUl6w+8=f1>ELi+Y$UfQnLB6|>;C&n%#`@63_Do!x{+c!V|D*;+_e zqoGs2wiaQiHxt{XcL#qGVv~7>ntfh5uPErvI^^85x&fCbA$k6ncps+Yd!Ua@(>Dvx z!JOH%_?un(EzWPqVusB5b^o6`a+UjH<^=_Hzg2EOOc$Gy`vn%tI?aQr&3$pU|IZz{ z#(ggHf+3;b8e78fw`8j+X6$W*@S1%SRpb%J{lx|TKT|yO(xZ41GzS(Ga+-gsN?z<* zVE;2kGA})fq^>1>Rj;x`6*xJ5iOc;dF0khUZ#W~on^{JDfL1UScD*^n1Lj$-?noO^2 zd?h;H^cmqvU@pjd^AHUA3ea-)xC1Ko7>+Q-djtZc#rCw8IakapA)aL253+~ahw?ic;j*53`Y-yolDFC@i7M!gdmueRbOf5xAdGx$T;hKR=RvnjE}9- z6z_W{JaTVB>6N7$W}Z;Ro_OT?L}lrknR#5T;AX#$92{M*i)+@W;3Vs1UEuufZq9*% zs*Kjl`9jxcgz(SC9O^B-&PX%wdFVJvP&?r;-Wb*{(0% z4G&Ph-X{GlQ$9CSewfNXr1DSOOnq7?KQdE(80C-7@yfUNq?jHYue}Gyv-G1y+ovD4 zue!seC4n-|%-@E2+!}GtgB2$e-G^*;dBKB?lf76_!p_q(O04;09q`KJAUTmRSN*XW zgk}n^QU%$ct3dU5Ti{(jU&!Zhv^rG2xTca;y+8b36q<>;v>1_07+2`cB7&SCO3(*= z1CNN&!~LKaz-gGC*vosu^dWe} z_ChEe^pfu!9j>V#_GmZ#sFq;}aaZxRbNIzQAvOqM?H=%ob>SVM)}}PvBLk{b*>S{Ii#{YumX>sG=(RQMmQ*K~sKGsaIDtt-SG{yR&B< zPd=_ycwcc{?I$j-dpYGy8vA~#fA@z;P4Cw>RF=L|I~Kg#jqm^fH_YQ|y@#^4PsmDr zM~ucklg?>$<7+pFAatpV8b9pnn&8X7yCEk0cch2Pmc}3mHk>gLBtbMyW7%E=pQkA* z>)d94;L$BByBMM-XA5P=GI8^Uhz&(|o7`!KzU`?u_?mj%yAJc`Q7mhAhAjT~u&=S_ zLyyg^F_E9s3o(DYS<|(d@xekGSOctfSAg520hBxeTR#r!3cuD*hDJV|keF6Mq2beD zmS2JI1+^zFidCb{<15BGBK7oDIrtkZ2Mh-(B;=OvoAp(8x}f!NadRPg5#r@g*(zIi zV)+85Ir{iWr^itV#pa{(P9-a#F9MrsDxt2KMsKUG}1l( z6ZqI;{7|7Q0;v9XkO&JIJ`URJbB1z#jsXP&%78-mZx+cp#e(9X_Rj~kBp(h7C-P$f z--m}*M50y|iQAjYhN>@*=VVvKLtSCE4e)-q^}`{R+1!!&0r1)b*ks~mL(-lWh(%Wi z1iV65v|@Q!?};JSr_%kia@^?T5EDC*nP$BMt5}wu%67Yc9GI2o?t7QAcaQfWpSK^D z-J3t)_faIxwOfw>zLhkOcE3>jbwje|__G!;YIN=O%>FCJUSZ%{RLoHknZg4sUyVB~x^4z{)94E9A|HOuVr-7$ z3iJVM^AbW?ovq0ed|sW!-BFx8t}M!7%O}ij{Q%K!eR*WZ*TStkhK2?4ox#d}EY&$% z(in<3XZVY^4J)a)NjGk#S>hqTN6;UUlOeQmLo@r&FXRI|`^-`|r?&63Xmziso8v6Y z%YJKG6azrkH0-Fo>IQH>MP6jb7YXj5ORpYSK7@Efyc4c8i*xlY>Baep8&MuCt0>a_ zPu|LFOzQ2ENX-NK-V#zpJ0-UNkCN^Uxtc#?Z9Nz1rizou>8CF_1P{zw)n;O{3pGT3 zTB^)7euoU)f3f5LDb@KiX~ti=arUUg20X?LSi@YKebix|b%hzoZ4xhx4AP3wV20^! z{<=w8T#+8*uSqgvYa<_aBJU8R}aC1)#H{%<3RPOTH zYiMLq>)wdkbqBhAjIV*|SWRmFiY|Js=*wxAZ>F>4ulgIR zVa4I~Kj?=JRldvb-}aVsy3$w|ZlvgSoWH5z&`eDV1^M)1D*b!i33ngw1pZ3D{%&6T z-<`+rTIwmpylNvwt_hW7({8Acxbf6wyhv8}NFAF=JrV=#{J+VV((~_@7CMV$C^Gov zme%As3pHjpUR{W<12P0wP&ON|3`xismvAt=$ZfnU@K18pT?O50Ur~!yCKTjLR_a)< z9(A@As6j{y;t^FIP#P>2J1DYw|I|>gnp_x3=TNE9;bsecO>Q|(m8tq!0h(@Q`@;uG zY53o^wJO2;R3^%J?y?{I*yG*1=n%v)inTw!*%NWBV(s&zE7lI754GUK2OcfG5n5)M zc1xQiThV`Qrs6Ju(e8vl+?s-9#i@zN=e>wVWQJP%M$nCYO*cY*;6@e%vg*Pd0Si{K zxuA$(nck-4NfNym!+>bS6*NkG=xHCrdX4Nhhq@Nfu&M7MH+F4+ASu{mF3~NM22{jb ztk}%yy!CSOh?sl6{HZB$u}Ym}>er&$Rvx5(M57^ml+D-Hq8iNp;!*6I3A4_4Gv4r_ zm;4|DGmAfRz0BYb@JSUf<+p=lYXOyjBEY9V$#NOf?+EK;OeBLEjlKspjD36I%R5v?2=jNO?N ztsPpFV1|blyIts%>{h`Kg!jGO1_%Gv2@Z~-Lq@)6;+vm-Iq8%=WX<-55+G0WY?-yX zQ<(hqVes8RWj=h_jG{>RwT26tO|k3i1bK0E9?+NZ-db2;Q}6WpW#Ug7=+G|sVxY{L zyaTO+<{&<9fE%w53irU^yE#Sl`Pb^`%T$8L?hG%WvjcUEiDZTZ8TY&1;Ri)A*me&ZJinKl*#OzXiiP)6f6J z|C%5F4GOURu$Cp_1?1m6(!^^Wn5xj*)x4$pC1N8kpm5K}32Z}DYz z!rj6b+ejL|C8Z;Zmz|PD0P&0Ys3u~0(RB!SQqryUy~-kmq!F`OEqBo50NZ3|!5h3JFhSi_GMf5ywTC(K4r1kgu=Er@VH@Omm!8LvoFo}`%Ziu# z4&SUT+559=WQ^^2Sm;7#<(5#vT} z|HgCASVr!XHEwTP0}zkrE_k0WTxE;>j1QJHpjFv}27CL~`?Df(POH}7!}O1Tqo9xf zCEl3cVuky=>iz*91Wp{4wNFvi7C6n1kt>$}?Z2ENvKWkg{!Z{TWVCki5q}nVHCFQ$ug=zkR(FH>&lOW4n2(kcrUm*R<2|{VFJfVqHHad9!Y96%Lp4FS zOm?Apix}}Luu<^;8`tK2HceeNAd2VSuo+OCPBsJIl?woe_m98gbsJz9hcf|-pSSkF zPvHy4A8zKNI_kH+W8e~;Dm8@7%cmoll2f<=sHgi_!P|Ug>k!Xzp7#g33uKX!IFKn$+~B#7g9tNYxo)6BmQ9xck8byNT65o2w$4Bm8$5MF2r1Y31%}@Q*G;eO0lap0@QS8#1 zSXR9H3(aq7XWf{%+hw@Kr8SmK90ONb3DkrVa3)_aIpm3PTo?sShLX#B_?|SyXn6~G z?XUXXGuxk}4yN|#(V>qPf4<5VFTK9X*U$tR?=mMQf#z$&V7;x4I|NEjnVu**h>uvx zS6JI|Ry(vMRxs$9Q@9Q%)hAZamnR6N(0LG*OYI0vA4_7mq$?`#*R1nak^|I!j#YK&TpG%}JV1TKi3~*KBPBXv_ zbzh0DX-J zadvK`EM5dL&L2VQEngf<7x21xy!|k*i$r3Dne%u-3#hsXzl%em1|gP!5C{?Q#36vU zh{+CmD<>NM>&lRCuwgO`TL%9j+!+FYx#1F%eymHn;m@a%PF+P_xlQ@n1X2uV57?BT zH<}dhmlfIKPk#Ns(M_OcT{(5G7}70kt^WQ0;-BR#9L~sm{3=%b`p60)LRMWtWW{cN zjfX3zZU#BcZ}X;wnPoNq>Jyk2mR3Fq?~39xVJR%AOiL+Anih+E9kGH3|74J_U#wsW zPiA2UIzTBPBph6aj||JGcZX~p;7lQU*x{Mggn97_nKj3F3{fr>GAK578~Qz3@0sx> zW&B_t)kIJOa(?^se;qcFqPk%0q8jEekSJ}h?Hg(B&2@>JOabBh<4*!htHI!W{#|L} z^#Y)T_-$TtO@^r`zTy;6&4w^ri(s?6t z)S`y6DW{KOrux8+)}}^!@4eES+DS$HCFValB)denI7@BGwEQj64(l{ErNhTw8Dz=D zw1ddij-!*e;x*M|V~lqn1?=CoKKe}h$n7(}2YnZ}z{Jc!+xUE3=*`e0UmV?oUVTe< zrn`@^yMvYSB@J|lNcM}K#Jel(w4U$Ap3^4dxsleR)E~{rX03h<|4^sRa1QMU<{?^ z2I+5dgLF=jpS?1BXL;nmiR%4YWi*+I>g_BYTHds^_S@wRcLj25Pe`Ok62=TdSWFEj z$(_qxyd!qm4{`hpP zT3+=RyC-5o+oS#GWt0=R{e= z8cY^#^7Ldr7dn-(n?piPt{^WOSibL#@{!yd*|&VdN3vd>qc|CAjrHXMF#722NlD@M zXf%w$JUO^8bhT_UH$b*BQr+H2RmJe6F2$dJo$#VinQ@wIpLJVhY%=tbT@@RcO+BN& zQJ@Id@7MNKc$NROs4 z`Y{KlRg}K&Ec#_GqBs4*@^bf-X>Aircx{_Fj%BQD*l6ayc4QTcU{%aSIUzXrj>_1# zr*pH#N9t_$Zv)2)B$ENqkUN4yJ0TlttY?zQ*+ z@Q@BILXV*(m%`u`5yojotj&sDRRdWSam8Wt_w!F$tXyvOfE!g87};xW2z z(WNyFb8j{L%V~NYwBe3-vm7*`7#vgNGn6yIi9cnsvMRsCr+<-F^8-`;3uzkWig>BL-mMHe`jW26qV>=$ZD2OQt z$Cas^FWK}P>xRo+w_{rt${F_-(I1|E%T))Sel7Zqr{9sUE_&&(Ww}S?roYkk9ZBww zgjb6|on`ZwuI8@U$MqO1{5u(?Vg#;XYc9G)?cUBN-Rt{T;~m1Nhv^ne6T>$0b}#i{ zAc}_Q3?7|jS95dCvJGOX3F?s0$?>Ax(^SDiDln7e#x9+%wNE+BLE3o!`6I3K+Mw=^ zfR)AqH`E>r@}b{AnJnP%H2p#krI(&ncLlx|b`mbKy{Y#n;Y|Sef0%@iUtuvg25>;! zO{!k;J#2*^@Rb_U6*k!lahVS1{o7d`1bsiMDrHvF-s@wiSF`q*YG&4+&@boj{!7Xl zKL#$7Xp?ieV4C=qFB~?HX5~oZNn&+3lS1|(8PGn^5Q85_POQcWBg<^1UVk1)lFQ-j7rhq0_TznVgK__ zx0KyhJ_BG-i>v`}VT;rrwBQ^HD0hGF?2TV^r6voANw`Y}i143~UVKPaJ$`gZdgGq| zGB8RnscH6}lZk z6_z3!+WW(ijP=++Ud`{pbL{>^he3~1`6VGSG@DoWbG}J`_$<=RF6G;Px++lnHr>0F z^nl7wCLO2*y>F7j{GG>M<}=$!`=7}K%(J{(=@Whel|^51mbImO<}5RvRK;SuS{~+j zH`t;NXX@XDvQ=z?|GF4>_cw>GfKpwPGqdyyZeDu(#%jSUE-ELZwk*G;VgaL2q(HHLb3`MT=pw(I^Z-N zD>98uo(?l?cY9AR9!vT)XK>g6&#E-LaYk!8$Djrut`df0@mqGzo-h2-_kB`Yb@Fg+k*`Z%au? zOco&!x8;<6^5T>4fJQl$rSHz%omvblkhtqTv@3Ytb!=jW-*`V5Yl!t%(u9lIKwrZy6ggXR_0Blgq@Q*M>0&mdAH2Y( zH>iPQZ2H_wNEfpqeH-b9-Ry-ty*tk4&tlukB?{CbL%z4~Hp3FHUBHLo`tSiCfC*cD zIoNr}FBf=uGro1nyxrXjJFB0&k3zow1V!3JU+NZ=_V(EJ@mfW&nt&26UVu~tv0kw18OADNYq(hR|NizqXJ!)6KF|C9 z`FzNnbM`rVuf6tKYp=c5+H0?TLh(dM^6Fzt5KK2mb@p zdcpq>ed)pPkO9?P`|zKdfj`MI(1X9<{}}$J8$8@&)t_9bE!3#Bu|n;^W822A#)w1` z=UFoAy?8Iyp+dEvEVzs}1VM@WDjD5)P@j2l?s#}v@BgRXA8&!uwpw2LB}7soBI&qV zhPF%ogiX5X3z2N`tJC>B7-#yEt9$>6S<1ycIzv#hatlKo3_JdHL+isb?G4pT1Sho6 zxUuE1z#u+nym@WnNr1)boc%v~0H()#^WVv){G?3zIcd~(>6h*;UrzRb~4`CqC%(KzyUxyZk%LM$NV7puC z{(vYw_YdaQuY|ZU>E_A|Fz_iVA=X1JO&1?C#|&y+AN*+ttA|kpj+DD4`Zif`?%|+f z052Qw^MQp~mlCTRt*VK1Sv5>M4Vmt+1nEu&lzFW-HqhXa zU&ulCex9;^=datuaJsi~r7FI{H<%Or{V^AlQD|RYJ_ji459yWgsLMo8_z~))JK}J5 z%c@sxEqhuTi!@qxfYSp4YeAi(Cv|$G-n?;$?(IMezSI#+T;|34)WI_GBnyfpcO_;G ze&=54i(2>LM?Eo{TAhi&w*1o{joss)D*06x-F=MGM-pk&(KsNO_&Jq{X~Gh#PRoRE z9E$FNB@_ojy42nJu!PoDg;NNlVtGdaKy$6LP~igW-3ypi?5>^0=2wUA*30DOUe|j&xTd5Z0FHuK*NMeH97iar~1_!PjG+o zE`uXCAi?Ox!&SojnD?qTHmppYZ6@)8Aw1TPyZUispDe!?GP%#}l%)7gcN; zEZs!<2a>r^jPQL0$Nh^}8o!NzA8BYRZ4{H-bLml>%%Gh_?m&@~k@y_qY+{^vkwO~u+MA8H;?i~O zmpRKE@LUp`a8-a@#Ek=2x16s=;U}TMJ5=LmI8@tmh~w)2?nNBzF8o3j$l@mn7kl_| zgqnJxrA9Tf<^mhUhn-~2mZlI?%y7?=G}B~)!eKkXQ+2uC7$r#~$R2#{!HxzdmqbUu zOawefgmIt?LBaha9lOu0EnmZloYB#w4ZudUT?oT6I$nsb5)k1u5NvR7K%$#=e0<~C zvk#1>6IbIz8{(@0m?{Af769XozdwpH8kxUaqtWnaaPeLI)+U$q2mb=3dnpNDeW_J`bIRcpvI z3R0(j@c`TLeVU$l<4ax4ZX$g%zk&P4VQ!P$jsnsjOT=aDhb8FGjZ=9QRxm69reO~i zaMU|+DSzPUqJI41qb&V_hZ6T{go&yv6gO02CN4}Dn%F0)kVZYd7<_({2p;Vp*5J$@ z0tPo~n$RnjtPOnb3Y?A>9d6t2z5b{A<_DXbrC%t)tUc=d{%vZw(uv&w$Yf&O;1U^O zKnoFUV(j}PJXn2pCfX7P(@P3rZRWco_h;rKs!b1d)Bg497Q_BTOlqZ-m#7>mrJkeG~C1(DAma?&HTh}&zD=~fKans9~CJw?2Q087fS2(9q#bF(bHtn-8%=3^}!&XjwZ#o?A$9Y z9fbd?o38LTaE5s%zOWz*s+3t8p1?C+iSKMrzJ=-e6vGKmIR&c&^UUqouz^)a}t9G~r8K1_}ZeMQM1D7C$V> z{}E@vu5r)xMhRlADfIY0T?us*LLH3aRWjj={(YJ7CmOH}fh>qksQ%3I*L+`C>O1di zfqJeF>c3qd`p_P3$zB;KEeDX4vOPV5|A!`=k;ge@3)jvWqLE*skr%nI;)Z0N3<$V8 zAKZPjf>04~w>Ef3d;0BO^V1)*^o##w!io7-yJ%;9pv2XqxOb7gJ`e;=whPfD4*Hu_o$OD`j*Z-!E71w@f<6%ve_o>Ro zu7`AAu zqQ;dyB;@ap+4t*zn?Iz<&recfNrQw6ia{!H10eI>lQewZ_UTI_elPOX3t_3yt!B`K zjKcJz`)g1J{yz0Lc=d->|LM8)A9)J(OB}ktx+qisR(kN|_1Ad#5e24ER^6*qDYSl& z?T{pnzNCEa5#7B zn@~1_DZ#HdK^b#9$?w`3yOCR+aYmwr{{aZEz&_2RX^^GV2l(tu~D^mtQDFjukaf|pkOSditLZ~{vQp`D-V2We5ktRj}I&R zD$|!AP$Tw@uPIgFj8Bh2Js%7rF6U`p<8brFRIc575GF>sfMsa=KZF*Bm^fT2qB6#d zJ4fQ_<@@`HCu&I)45b#s34Hyp&#BQd;t7V3aQ$h!9ZYH}bPu8%s<$vT(GH&%-+prz zeiNGLB;wZbi$X}OP9dQ>qnIkrR5R#9#9z_Y-Lysjjso6f!MG*DJ_S}9ynBQOS1QRj@t{-#CJhy&)}6JwlVx&)A1|#8hfRq&F@FRGB_I>1XP41EHON=Vj-Ya4QwJ zO(*u=>VMU3b-KP~peNVs1m1Lq_T9V4? zF$?<+`T?8oOJ810NKii~QKU4alFp1s<^a$ljFKA^O{%h@wwuqtqGfM@3_5t;VJeXOgTl%SCit_jq@@2M%h>~qfX9V(AEY*l6i(l_j+-N6; z=SPo#1klkI{7q<;W>DbjMNG;l!efySr~H;z+{?4&Ro76yo2lI^pQG}#vgOSx&-woQ zDnBw?-rlEts>=Ii%L}jV{ryQQ-~LVpzB-kcW#J2|d}X%$E|rI}cU|xDAFKSVZ28PS-(RirBeUhp`jk&qdB1FVo$Al&-$^Rp zzTNBp>Xx?{A8?PEEIEv@nC%0W+)}cXSY{cdZPd)Xcb%k`fJoTl)QDsA7{>SpW52wF zagm<6VrNC(3N1CfFXt)6QWgUC^KGtF~^9tM^o5IYkCOT0ZA zPcs1o7v+PAXyUFm&_`rv)5($QZME^&qrpl1yjwf^b<%D`@6BRC!Kz*t!70Y+`cm!?6^y#z~>RteMPIc1{Ya7Gdt8UV>DJq<5wz8sQc83 zA|$^*vWQ!mY@DII5{-97PP~ zKzHTc9$9EHR4?MJcR#$}4tBja*jKeJ+|=~{Y`azKeGhK=VmmJbYB=4;u|mMHzzj*7hatC?*Cl@pUw1CjX3 zI9Y&>SVGy(bJz)nrLr^J+SBktV!~T3#H?>h4@ykf%$456*ragvipC1>{AKIscl_9C zuSp0J&qIZYXcH(R(N1G(OOD%9JNo(BxEu81x7b}9TyzGMVe@1Zb3#XO(Rj1GANNUZ z;^r-)Qv7P7hNMhW_tpmtSK)MiS*$7E@h$@LDf13w#BHgdo#-ERLxI8%H z>$QZr5?0`FsfbtDqqh3FIsI$nZ$;zRVXhRTD}K6Orz1nDPgg88sI$StGWShac9X** zJ%3(Cu@XCCS z=Y?1b#QrHx0`ZcAidksk7bW#8lM^F9l*${j>xU69ppw%$^2?A3mv#i8ykB>jUwlEv zC#Hz%7M`SMW8ny8ykquI)Mn|)6G{1dqSj^9T}32kzYT0K!6D}rJvK&sW~;xM4)tna z+#%hY%Xb=sD4glHB{|VdfMvJ7Gu=p7lEn`sl`bs1Dd(oHQ^<6^;!81(VV8_fg~DUaiddlRwjXK__o1GyaP|g~1i_{$J`n1CKh>YNH#0 z!PP^!m7TO3(KXovfJxi$`^lb|Ycnqy_W`Buz4u9E*c6Tjnj$zS$oHLXTl7E9ukSUA z{JLbc@G3QG{&SX>Fpr7?-1{HX%IaSJ>IvN8{+Mg`Wk0__N-any$>ir!C@% zSv1YkAo#=$bm*)?B;SMYR}0_opI|X?25q}-m^E`oMm;2cXXAeT zOFx)xL_KSTz}h4T(ea<5BD#SXO6GqBDR(#_|GPE#vv1TEd1mU#iD4_r2c8~U)0%f) z{EQ9JHC?cJhCf$gf4j3MO^1*a{q7KqfDnW^4Ehe7+cCWlM~}sw+@IV78TMU z=$QWwf|=9-+D>0ga_C6)mYU$tR@DsZ%6xAYQ+fGKgSD3;Upu=Dn#Qq)Viv=M{>ZJW z3`ME^9PI!(iyFNKjC_q$ubH!+dYe|`OOiqFTi?sVQ6>~`cJL+^7WzUFSzK>wBX^F{A}96h6O?s3ijc(4Va^zS|fXA z<0y~#F_bb4bDRP#;oRMvALfy3;x@hLBrj(7Nef@dKcnB-%F(*fl*R8hKbE{Z+g0ig zmlGBtT7a&fXJ29HLUHyjv8;-06;Sr1JV62dSPD$LcNu|;FJ^D%a z*ZKCmIe6^a)YoAqZV8a!1Unyu^uam>V3QcX(7*C@8mk&eB+h81Z-Y(Wn7R!8iau~^ z$Z5*{jJ2tSLWwrll6jMfTVvq<5oaxm20M}bB6sgG#y&Uy zxuv{dbz4?EeQIsAwFX=F8oA4~F9{7y6Q!i-7VNfAfn3oXF=Fwq`C*?7xfnb=4Jh00 z0@}45lNJ&6zlXzSU^0n*L|DSan~!LJ|CqdU*q}R5xZ9R4C!gLC^*hma16nvmMt4Q4 zx0~G{5e{P`-5s0aj$ZRF<+0Ct8m6;9iTx!Lqlpvp`6il}P|Qzl;9uxzwbdWY{z~oW zccaxQQcu1}2o~pxZHy*y1N~y z6<*xIFI*C(W_8A-kg5`T`WIW402~qw3 zQS}c~eanQ?K1Lx9wzkmimI=q}CZiocM4oc3hOd@vT_U_dEqc){Jyu%o9p+&+-2DIj zILua4J*w?eT0uA@3qHDy8S^-`dD#SJ18;)))9-rCm{Ogjy&Z=C&fk=NcM%4i%9H|G})5gH8Vcv-Ed zyT_t3aw^dU$N_UGE%Jr4q$FmD?=hQ)(WC3Fe68Nx5M;r}c+4YkaMG25bb+~)LEmA2 z*Cs68os%l*FnjPOoh)LQb46RtG9b>IxM)Bs1eq#aGqU76m&f1OkVZ@^89GAt5GOuq zhQ0~pbxyie6{H*3?nREMeG`MRXZbFgEO`CUqYwp8=F_uDGisC0PIidyq^L&vPF~IO z7XH=-&s`Tmi=@dpCE-t32XM5Iu$f~lBY}^jqt|GS-inD6YfPkj=T-4ZC<xj5#VV zG3=iBMVA6Xl>wd&gmh)RBuMbdNj84fl^tBDL6+Az!6$39Gx7>?yth8R*OY@BdJ}dM zQ)dL9yy#?NT-Q1MrfEE|->RRB0zb4$U-k7N+%mMwf1I62o3Y+t$%}=@QgP%}OL4 zbdpaPa{`JhyG4cKysr0mh6}&W;W#sph&!DLLhc;wg897Ml2;VSqZp|R0U<`Sx+ zB_o$}SV610knxe2yjm$Y$A%O|zuIl>M_RR5CGxoz!P?f=PbNrX#w%#phQOM?s)yb= z^WVwSq8phRO%@$KH94$MNs|@aRgUu9au=V?BDSXm*omK77hE&|%92QtawX1loaB;1 zRi0c{#gF@>)F%-cseO0>o1lHSHnBvNMafP;=89ouk$9W#C1+=hZ8!K!{gXN)i59^c z8QsBlZVbQesaDexbBvMdLJ!6rGC&ny>C%tnglAJj^Oz(-?&&`>l6+h@0`ldb(7c4W z#t3tFvfv0kZoWg0J@91)$G|Eu}kU5JTphMvgY;!^Z86l|#nz$x^NO&8=t~cAR7)acTpvF&abd zXl$)5-^l)l+l7flK?8aYF5K_xC$L8C*7J0VZbd-uupVAZ7JPp`(pSRBePECfJ(1M@ zPxaSG6^s}}5xOY;Wv{4G-LI!Q_fGptefLl=$ospzV(EJX726CkAGCaHm6E?=9Belo z_l8Z^RkiUY7N;vCC>A2>nGB~fz?rq7#_o6TnX&8ddShqwgSkI7emnl=XseKltPY z^(OQ1RjAMlzln%S%${ETu(Hwx7fzPMN?gDeZ=-;r|2CC+6s z>D(#$_VXVcN4Vc`wr-mlWnyS(`fyAb6X_4>D;M5KdsoHg)&uxurs+$dB9VYBLRdbM z1&!~B(bu~t+)BrxmKi9LU$JE3y+gvhWWm?H*9Pz!x1)B!J7r)ONw2R$RKD`#W5i!0*gGbIm~Iyo5-5rDLqy(SwXljpSV1=b zI9-&36Iq0LOW=YxQnD3&Rd;d@ygM$J)jcOEzHo zaE@Cd3kZ{|y-h4xrlE?OT*X zJM4e*$}4U83d-HDp%%I4TR=~lLC=}-Jo&z2tm*#S_wn>p^F0sxXe;jKn|O&fb2O9G zSw<3KI>xGOLuj4&bZ~FBl z80L*Sy#XOzAyQdXNECyW5A31zvX5{>=N6Q@7RXdSWy_g)})4DXyJ*o`JCV*_la&Z2VaDz_mvo z_uBG!=KFPCxwk)VF1PMC7+UuS7Rc+10aCs5+CQn+aJoZ&lslAdse8XjGFuzA#s4O% z^X51353*7J;oHV>PHb*rUgHV;5MFwWlK@}f+U&|0NEBXS8=3mz(|HPEoL%DS$p+IN zZiVC$i{$e^HJChBN5qt8;TL~^j<9MM#o)VR-|*c&VVoR^E0)Bu)1x&41VOMegwN|mUkj`?Z2-N@*czK(t&4fyB0 zsW)(^IL$_ANYu6Um~BEv>VdmT_ngOatRiL3ag)K1aEcVJ3qBDkp=vfY)6XjR@Sx^l zCRQ9#EuckGKO|S&a9O+eI*HSi@pw!$F{uzccH^M%_&FsFC0x!qxbe+4-8F4V4_pRZ zd44`5+X<5yy?SnaowCW3RB$Ns+Rg^!5Id%Uf{; zV|NQQbI{q#)~)L;!IUo`IqWpDyL$PGjFjqnXJ?@?GOCAnv9V4)WWQA*U}8)4POoPD zuK0^%YFeH#;c^X!L^{tcd4tmvH3uHrs`x3hPU12>(0kUv1=CTwz;qds!}sHRH%`3E z2)j?tg$|AYVCZMX@x3U)XfW^JkV_3#gZbpZJG3l++}W2tFy?{B4i@|F-mM;Ke8(e= zk}oHXF^}YsMoES=JZdN^Hu-mCmG46ib-Cn#b$U{v=ASG{1T9HyGZgVknjvO<4~Har z2rk0}I}Zx;&q2O|VL$D%FB$e6|BGF5|Im*8OWvt*cKO}$p~fC-L!Ytl?%Em3jQ%|( zUpV^6$1jY(5sUR2+iCKNvI4q*u?;b{?%QMhk!3VW+=EGkCyw$q!JlpAo*loxWXF#= zfc>E2Z+P1nlXUhRYWPeP-(rkl{4*}$4!Lm-S=RU(VpNu!fjVfMaIM%4rCH-O( z#=j&p6CsDJ`?QpwsU^$w^r==KosB@9Tje(3Ju=U0<2bxHI9qRXQ4)#IMn>`#7okXe zF17+R5BRj+iO&r=@e3-QI2pC6vJSUrEnZ(8qxl#Jh)vi9G%P*t<;K3S4UN)`9G-8y zD_-DL@QDj9k0hF^)JI_X`3Bx@?T@Ws`oXAdpRNpO;|&WYcPJsxcIiZ8_sQMDq@{MYF<{$&}#^(*p_wXZ_ zSL&91n&tBrXj-Y}(W zyGs;+0jI_M>WD5dVJ5M#0pb}^@*{-+kt`SkWbUtVTNodgenAt=`9X7-sauSBv%iP63w!|Jb#6A~dXWD_bA$Bd%FsyO` zvCp=|?$f#G3WBdXK-3@%V0&kF$-C#0oF+Em69CL>V8Ng;fW&e`*aOLXC&Cs#7#cQl zl@RjmEl1{Y(%}auS?OEVcP{!uL1dQh(gZYjTam#P$YqtLR&bY^;|>o%in347Z8$I? zrm!bv?BAa-ZW;ZHiXePXTcsT{WiyeRLHUP9@BIO0B!9Px>upcjkqnvQS5#an@g*%{ z_1Puh-e@uBfp-J-c?^^3$a$5q2{*!u#zNk}7~(>{pvpZjDR{Y$#J_3;71HMb144Cx zX-8w(r&cInwJ`I0Cbg#K_bdfl2R=z)<#UJ%)>HvQz z*kSwwn=CT}u#C&vV?KHvjJZU-f_^c?>`gHH);Pi7Fu7L<+2*{S>dlRVTIQA%;(o2( zJZEU*o4RS*${FcGZ90f2mplgyzWMfJon%E=JW~HheEVwS@RlEyaQ+UCp6YLxH4Nhs z^LO>DC~ccm()5C6X!bY`WrqHgn%H{0GyOt*Ttz{D$mpjpFr5FFI!dMc=|FJ|3VL6u(Do%_f$*m=?zpuLQw-}}yb{){ z?XQZ8zut~WJ+62lKW&KAlXOcidGjL*G}Br@rJ5o_`f|2FuxPY@JKK%7;S%vQbI9{_Z@>T z8Ul$B@_*A_p3*&CB91B!FR3W>iz#QBZ+9 zT+k#7u6~B=!H;t-Rxri+D!xdKfx|KcdcNqC`9T7mia=cT$I=NK1^|wXwaJ3H-$q3~ znkF^>tQh5M$wtt+>F?!^`oG;@YvKP+)_z+Ve1eU4J?s4VhS=Ug!Nn&~E||v?WVoZ~ zki4FX%?A2&MHSU}qd@hnKO3GnogeYU6}n9nPc%OnRqqs2nk*>hLr*_K- z%Zhz%uH@uLP`E|T`+M(4B#Db&6Y^f{`4?@Kp7^xdD(zlj+A1BT+eB#|Kh~WPFNwwr zJ~pMvg8TL1KVaNcy=lfNBY0==P*dqbl{K46i#H0?z) zQ9d;C_g+;z&{Q0T@z=W#PBS+4WWi`&!MF_qor7h~igN!EwbuHy_4}SDX5Ze`|g+)!t=F$)m3i z)9`cZBI>fZ#^NV@Ckwv15~`o_eGl2+<5h2bOhcvlAQOzgxZGm=pZtRH&E}^;^vYCs zN~bAJ7M!Gp7SIsze*m2tun*V6Vhi@?`tG=5`+mImBU4TB2J@2vyThyPZNPWO3GAhQ zT`%cT$G;2;E>~xdD?ZM2GG2UvZWG1h%ulASqfKeD;HUh$F5Jjb%F-7^W9!{HIBpG$ zO)9>|);mo#99KNTd>Jo3Tepeg3iFexw^XH~&NH}he=Ih)noqJ|^&TvOvg5gBBYUx^ zeZP-$3OQr>^Do)?e>^~3gyeOSb!Xz*7@!G?fULuu;`5!ge{dHeaMj{`m$3(XtP}cuqKy!HP-fnoX`1D?I2wZyVR{$Ib zsbvd?`cM4FAT3{jB@Jo~D6jgU>{9;gUijJT*AzP}2NVMYzH1QBuE9WiD*BknRy!CS z=>nri>u@+)VI%V%HGnJ~*4?-Mb(#AAsOpkM{e1klCiDQ(DS-gKf%ueRoORE6x?CJE z<8hM2@n9oxSlB{|GM$Oq_+*6tNxYzhOY?q@q~B|XC8bkm-Vd45w~hQ-;T4Dc;x*ny zvf%K~pm4U$ILf47n6Z8`=KGEJCYVXSU!K0Nd z9jN=ogH6q8iK*2R0Wmax=^rc`zKKPATjM|2$BpV-?D7hgt>vdJ{Y&?USFzjo!rp30 zMnkah-d$CfGd_a8sBZl>RIvAYq3+Q2v=b< zug50b&-9Q-epm7Hcw|?itxPTbhw+c_D6_tOSkIk;Wqf7om8=cB5474vZIu&PP{|9j zpA(Jt=vcjMH7#_*GI#D@X+K%8`|G}0ay)o?Z`}^W@i+PN zD?T&&!RhwSy&Fa zfh+f$K@@oxN;%o(vp0XtLpFN+GeacO?06fOTIpMxFr!sqJ@STmByP@t*0Cz>D5}~u zLco!^)}|X1jGNa24#?KPM|JE#oMXmF(LRagW<(jNddYhfIR!=?>fyTC!!_H?TWAyF zwuU1e%}n48^Mkj+km@6Wt!93*XMca*!~{mLoB)NwI7VQ&2`XxfR^PmYr?Uq}c~6S#8ja!#P1TpDQwW| zkRx;0g=?By`+3&#j`s!T5~I6Ygx)ix&ECYg5wfP6@5DqQzS#w3Yyd-ssf2%XEVW{ymIyff zLni1BL)$x444=#}E0UeVq1iItaF0L4NPp8I!@qOkM=R&E^y{8`*?y#(nzoq% zu=RlBeSP|^SI?|1zvbMcS^wbJQ9ow3=Cv#{-EF*Nb&D=Y#}7rxUCjTv+9Wl%jPW)E z3R>%|+;K0y%2QCss=61tRUM}nIEmW~u-cFAH-tz!nM{(Hx0yLX{<_NVIxourJ#1?8> zG%>wC%6^lj6s4e{Jkr1+3yyMluA^5%VxxbtSPd_EykaXa$(a5-{VH)QBQk!nWn3sZ zIREXIo*)dx;Sx<5ZY9RLjrX(ogIO2-h8neL($o~s->h8b?YxDt20FQ~qJ?X$GryiI6cP8sFxw=XfoV#dyEr3}7BmDWkcQ&)3W!>^TcA zn!xugcR(G<|58UyP81PZ-3riD>tn50??9TBlM_)yTYv!x&fo4~XsCPPDXKyq1Wv3v zR-x$ae9d0J8GgKFw0d=L(MpY7Vpjd+c>Ze4hM6ssAWy`gcO^)c(YZXM6!TKgnrM78 zTiQ@yg13-KB2Q;-T&9ZPqq=CaxOwxDIJ}C8T-@b!eOMb`73p%L$)n48OfvE3;Hc}^ znVOu?X5O3EStz~=le);v%aQUmPWelbo^}N_)}w$&jUAIWWGkqr{xZJP{sjx6&1^vZ z9k1xIt@;#RkxXp%j&#Y;hkBi?hT}w^)A2rYvd>6rp7$EQkCfB(p0>?SuSF8E3GmX2 z=1A8&Y+!y3WqVJ!_OP|JY%zj3x$tPo(=z4s<6; zV$Ye8@@}m6r-=%_iz*?(4f#E8MuNU}KAy0%C)S)3S+bw*oB z1%OoU^-A?ff8=uyAt;vX!JqWN+kX&YhUnOFl(+t}DQRX$ zA&yre8+HcD#q$f2&pU1W_%@izD0%ZgFq5?>fF%N#s)L_cyH&M2dnR1A70w!tye8-(?a2+JI} z26YkP9}a6P(UT{tds-ZTa0DZK%0L*6vR=3gyQM~aSr?;F%FyuGtdC3@NV)dy?#Qat zkpY3Z+Q6O#UK@Y=fTz@{)~_1Qg%m6W=f7tpr<6HgGZdf){aZk<(NIkQ!<;5(K>{yNf); z9p`Z508nZ5*#-l^g~)&Jh-eQG4I~Fc#cmfECfK&PEh8K?e_8nuj8%YD$>mD1z6Jim z&B!`4xL(9j$NOmc^9;&Jq8SdWjhVhiz3F&$7_iAt4dlWssuD|z&(X_V8vse@ zVX@tX^FB%)raRuBZoxWArk1>r=rCzeCU2=XdItgt4J|nTeLIR4Bx0bX-@6e3;!|6* zg#>EjaCk#%4;t>zl3Ja8{M8>?a6qn9Z9cH_>p00_Z)B#*E9zaJopXIE*L{VB+wU9u ziHOvPHfew-8}wt>?=AG$TmO}`Qq@!38%2#x*)7ZLk^#U<2TYJ*ViPN25?vYiv^YWZ z&K~D@*{uf2W*Rg349&XT-FqQ2Wt(wNC?zua+?F#}+BfJ6AG>pKb>_hDP9i5=R=TC8 zGg3Jq_qx>imMXU*?khxCdLk|q&?vNer%>KkF`oNYYCYxVr!-YhNa!d2c*RmWst^i^ zKD-x2)S$=gDd*NNe!QZLdlD8A*Y9+8(q2#cXsvqk^cqwGLsaR~(-NHc=TMbdpT_nS z1e0GyvWaqMvg7OK7p0aItx?{L_}Us{hh^4xy0%YER!p0cxbCeIbd|sH)_I9DUY(Mt zFa`u)7g#riEj_i>F9sJJPqgq=XvFJ+i$`)PwfABAz>b#a=pD837jx9es9nWIy0=B1 z>1`C=HqVYeN!(*cHU)ke%0IG!#rTjE=?4maDu1y~l>A`Ha&fmOPOA6=YHk9>X z?7TsF^t$MEEOm{tg>F`_q;G3-+R3j@*=aZTnoW=t8mFnr{Nw!PgjvS#vBvGLccvza z=-S#y*IOLEjIe>=q7GnRe=h*rRt&hceI9v(zHfo257K7p*4i(@!+~!R7CtIeXwTy_`P8=ENyQ zt{Jd)N8@igpkdMPP;r#0$uJ{5#{AfU*;ey39nOn%{jIkAb|hR7RN?Qd2nM>OG$XL7mgfg zo$);qt21gzG(mM5`P2!BsPmF%9Qg%R*|(%)sqq6;y=}O%Y8=4qH8RrB9TW=IrG{I?%sot5^Dmds9 z77gq(55{I0_`?t|+G@PR(k4rM^RLBOxSs0}BYMs%$l&cWgRwDuV4tD;hcvlV24e$w zXlPHWQJK4owlPFLp+ItDbf4eFLJGFZa}RyV6#e31ia;UxTPYHBLWR5MMN@jx7kKuKb^Q5(ee=KH;LQ@=wBK*bW3K2(jghuVI*y&1F3q;k zQe_u`=Y_%4b3ArSuH)6t_Ph|4D zI)_($0^g5k-t2_1S-!(F)m_0wi@`lL2V1W*bi51epa8TYS;A%EtA=$=%BA4)?T8D@ z$|J0bQYyXL^yvLF5%WZaMB^`OTB$RO%h?05y~6l|;h8bstEf+oyJfW*;QO|NI71m% zV~_WTpXIgNz23ZV(|`M8c&>Rtb~JaJEt{tCGsHB;E1T|(pDlm)kN&rVz4AJ5{B8O3 znerVQ)HpHrwtSz4wuzy2Zv#yCcnfPF1M3R&x<{&0Y-MGgG&Y2RfIjZ^%0({je^VJe zu>DVz%ke?^T(4Z?<{rfN?jSW*p>{I-*&++BW{0=**6*G-wOr88H(H+R)nQ5>gdl0- zjYnx?fL=e$E8VS|Kd3vu?c~o&)#C9OR@tuSrFIk%X6YRSoh)uKkMeocYO;&DC)tLt zFY|l>;=dIy+iJF`_LtV0w*Rz?wo7@S{(I#BLH{XtN2~RTR5i98|9TyGAqDMy4-@{_ zj;H)zar?v&>Y{0D0@(@?4te@ixbXmYQ&{rmLyluJ-izQQXP zb~AQnwzQsYU;UxvP61`^?dC;oB>9~c6w~}#+&Ny+csFT_PW6k}KkAiL`SRszzs#d= z%H2;_Ss<4P2xa`e#ppwf59Y35GG<`A!%Ue@VkEwVH$35!!`t0tScE+z!E?4ClioXX zcA?cA(j)B3xzvh-h~yQPtZ4kDTJg9wh-q0oUWT9W?7^%wLwTv+OVD+EIL3aJx=**s zg4?!&juN3`)jsx}LO&yLp1Q;JXDEMiwd}Ve5`n%AA@wL*^Lwe*=EklMY9JbKeZcxm zXP6E32OESi*vT_UPy6aDwk6aQvgtg>^jsU*NUEyZ>NT^FVwl|X*)kADMAsCikIXUl zCiBZ`0~@fW%pzejUR3I=-aA`1X_J|hj%$`PQy=HEtfWrh0-w11hYnNqHJPeU&s6=0rJc*4q3Xd@ z?a4QYrS5jDG8KbxYL+ra_xQn z+z)uws%J>49Q90}b!=w`?YI&-4lUobNRoW+1ooz@-9r=}h|7!MT=`~VY-+`OT>RYc zC03c`ocPTW;@Y~dAbS(pu$r@Sjo>ln3^VDFIK))ozViX~nGX|>8tLyf2~dI0W%&)^ zk0HLJy1NPA;Q~8BpwdkQP*Z(QOKuY%Ly%8zWWa;;%Pr7EWC(JE6?xxnr$|$lyF(O8 zkvBi?6Tvh=Fz#)tgaXG&c=Hi$p&OnFn%LPcrOz$44Xyov+B5+m|Gnxe-A5#(k_E56 zMwx`GrO&xud6oMyQ-WKhmX5WxT=@!b8ewr~H~Y>z+w(#c?zkLT@h*RI3HF~0dJ*hZ z8DE_BzlHl}=o3F1u6BbinZ(Rm6D|8Ia5UZno+LI~XBnA1v>Fc0D=kr|DUGhY?p200zP=GiRT#K?{4f zzffODvSvSAEm-^Z4bK^GM;qW3d+}Y`H~g1MYhw1g_v7zmyBf>6p2Kwxx0xx)U2qdG zLr6@vzKK6|>wW=%c7BfL@ZT44Rx4tp4`U$)_y?YQ+x6@Ix4h+;nMHQ}-%_7%*Ejw5 z{2{^EeI9>>#b2m0#C?1Te|e6R9HahZlisJvd|vM{n^~V4PnXAU#+F*?zHfH2AtZ!4 z#3^n`_b02J9v0t{=?^K{5ZM%cLw1cHvx?{>RD!VH;l|71q%xL z=s4#IM z&bNN#BgFT{5)#IKYhW9uM0T*GheSH_J7m(#*v7?zp-6IAiIbd07qO9l5x-gE{~XS; zXcK7Dsg5HI^H+M+Azx)||GPPkLoZO9;k7p3zw9#|;!=@B{x-Be?4QGQ<1n*(Q~=%& zg#*7iLLKxd0Lh`ze)lr*zx=tz>R##Ifo&nRB!?IKUz+8`?n|=QX|DI<#V5Wl)c5Aa z1%?+rt*lVfGshQU>>F+HUV`eh{miS{W*=u3z715kz~=y*aK^W z6FZ~TuPGs7qmeaX<{f{O^Wr5aGWA?BbV_C9`ks514SXgT! z0ZOs*F&zM+F{LmQ2vXzT!_@LE2HB8XUWh~3vNqCmd9N;^)|EyFt+YME<~GI|v{@N% zV%j*x{DmhoHz94GC5V-8WGnLZU)(hs>ZBCLK(-WvRE+Sfl`Gruau5sF{RZSKH+*}v zoHd=CTMD91UV`QL6V$(C@h}vvXN#!LZJ1`mtYCY5g*xm5FAjQ7)8x*HD+_r83nzp* zB_3VL`DX>UALHp~!B(MhN}_0`yYc@h29n(8=M|($_eE4^N z9kGNt!T7&NoZ*qCVi!wNFZ5YTSo}SgpTXY@XH0hFiYdGlNsR17U#T$~MWpL} z0w^|@7%y{dA7izxww%mbf6Xw)%Qi+L8c0RU_tchSiF^6RgCf;01Q#gD5I}D(B&Fyn zw~{hc=S5OkVQu`cxJqi1^IoLso3y(mQMB1q`zCoogNus!FcMfxYUFA{l8E0JugAB( z15%@jXYOJZ5=qXhu=9VUx+l2k73MzCPrZ}4(*%umyw5hCafd=HhZaTyt7{WbXdFm8 zh+oNB6cYi}wFBH-^q6onjEu({GxmS=*!+ud=#U}N)uK{MueIgRkwTwT`_c0E6de*R ze*3J}=1162f2_W=1-&FVdA}puhX5dVEGFgJ-ksW00adro#?VEW{LGiK;zp6DjR#%e!p1xp}2F zz9Z88*V=NI8LmJ1)@sXlDD_&HylY*`yH;ENR&DuT2(At;(ux9+Suz>d1>*=Bf+ozX zHwHAke%H@S4hs;vhLxgeP#b{`(b4PE1^hC}C};iq%m`+-)B>eW0S^xGH5-}+wAGGY zXHo=ffkE8Q8Ygk9!VJ;i$#r)$X4hwAP;jRbnX6%_)B4leSG8tRrVx3fd045m+~i%W zUYRD(sP3iQ8h0(tIHOnFoun(-p&sA94*!=D2_Yo5^*JeSbwb0^%MH@i2hvnFqFjJCRu3B z(sCa&iZ2!1>z}lxG6t*1e80^rmnd?lQ0`vyD1TaQJq60-aiWSoaedJz?W9D~1`h-F ztyA}(ng?dx+@Ab{0lk@e=6)+qU;Y{Ik}v;G7Rv$}|5^kyxg`m1aX4>*&|=V5R|e;Y zLnQgz8<*%vA-8p4?c`(;duJl>)>>$^{9}_>c+xt8bsGj_1e;wDjju`%;18#za86_) zrWz9ymst+`oB0)SLPzV3SQSAr)Myzp119q~G7%B}JQ2KXI~njOW?sb5qw(cMEqs#s zcvz)VB}cAv|D?CLGi%X0_n5D8YpBNdZdd?EzbHavy~P>5Dm{?jvD=XEB5X~+hOpH> zge@BdFAr#ojBXcQw+n!<$@08`uE{)l7l?xf?|&NFK8R~~_Bpw<-G{9Cwij6=C%%xZ zFXy1@T(Z8$FpV;KD7U0E{z~zN@TY4X$x5L19Tf~Cn>a2mOBZJDC@1`C>+C~#9_qy! zXtBARB2Ea4DIIO%&h0r#=wS+$v+kqkL;m0Uqq2@68~Cp9;46Xebl7#nBy#8m8ox$Z zFM9UV>zuB1?45uUd<^YD=|9<^YOhPolDB`M%^$6uNra%d4shE`--f5a6uJ)3Kg9L=$D)TX$1GOF}?|M{CM`ES_F0N zaLQj5fAuu}b$OWY(}yXpo~1$8hfX;swm-e;89hd6-z=|-7nT&?`V7pNN8l(n+7fTN zkCg9>Bxf@BY}E7eZi0mi9&I)Id(J`d4E)3iF6&93s4iA&3>b(8b#^!Mci#!0nOT8n z$P4q>#Fke&-J6~AnT7n%V)1>4PgAhb%dItlt>iE)S6C_@ZUn5^t}4@}5J3rJBnI%-S@|7l5y zQsf7iq4g6aUKj~JKy(Z8GZ_0Z=p?|Hbi)uIAQ(S?Cb@rz#2!V}Kz)#+Sp@%y9fq z+D*Nz1#+S!nn=ii%TXjHnEh%|VKCeNM2{%6`>vk~1H#xI3>AA{);B0EvJrSvLF^^m zcedw+5N1D%A{uY!kN;p1*KIj8bEomfXE^TtjCtAH-|=*I{;qEYh=1?@I9v0#@6u?{ z4b(I<5QC%4iC7-de*j2~F(#WAD)`(zQK9*xq>+Qfw$MHl8^mW+c# zp+CfM^{XZ3HXMmR@7wM%nvPu67U`Dpak#u(^WV+O+uhTK68v0h2T%}M_u1|8V~_^Q ziQg$io0PnS+r-QUl6W^`d=!9qu9gJ!DLQvR{LW@GHH%1dBND^V0)hsD%Q}B-Z?74s z7G;Z}z3I5_hFgb>;#x`mi?d-sHbhhQn_#RTMY#3IjvC=B+Kt5jf{s5t5__v1MVpgp z-jb47M@OHFD7F`^si%h%vGVCP-6S*$tPwgar8uPc+$sg-V+Mo`h>$>q=Y+hP`R{7+ z$tRJHzaP@pcHW?2?$q*2-7p%nM{h>>xr<*^lzQpQH|hK{jvWP}sy;P+sDP%Fw1K$n6p^+Le23{++_f3s6vENBHgIW>!%+ls2RdJ z>{HA-PB*pOj{%;d8rR-(J!Ex?}}!EG3#@hD6T_o zlnPK5P2_I@*Q~)|rkz)0=C$lcy2xixvZgOEk{b6>Q83ZVAI@!JTM(tn|@mzDAcmP%ywYuT-yQEI==%_ z=}WxT{rL1l2c!x>e$z>Qr^h*J`wu-yG7q3;D(2Yf#6s88Lz<}mR+}lj(E&e+GuBxB5ge@yr~lR#4L;o& z2|&C1dLqGzTX1$_17@l8=U2U$Wpv3`dAEa2X6Zk9{(oLZ(8xG^)-LGe>$4SidwwQF z-yH1N$G#h~=HQG)x6~Q*h8J(vvE4K8u5vPaa#lsy@dniv29u9jss(bvT4RJd=4y6s z5etp+>!WCLQXsmpv*87!zF;9w4~-auV0utw^cwVN0%ciCH=WA9wb{eu#qIhiGH72U zIX4hlxUX?r`X>?TTvYg(Dfvv6IEp@N9AefOlu{IpzaQ!TOC|F{1 zC-4$LG%iGbr_Pjg)ajQ0H%PGSgQn{|-ep%8%a$U>t|K)dU18(H_l4&SaT_Jmj8g4h zD>gQl47Tj6g|pcXHEfN87=-?Iu%sEF)d98$a*=gf&yBS5+}wgWVrK8r`_mfUNsrb9 zi8qr#U-^+_#12)gJu_6=@zedP7AhD8II}nX8tajsMh0fBU|}R*oy@5QB%q3~tqnfC zp=L#xZyDCEh!o|MOgr8H6;1;@oYRHdo^0+dlmZpSF`L%4>PNw&&_J6 zoBnn)KA%9K;aTG%!9VZJQgpWyTMb3OkqXl(Y`6m=qw#Wpk1pw-JVUN@Dd25@3FzfI zcL~y~|9)uyU@(t+(2fsu8+*)PN&70pq#i1T5YB{H`djmLV2O)tp zN1(3d5k1vmylg~$8;eQs&$}WPEIPC^nmo57l00K9zQh0rbfgzSliGC%u!9TBbI#;W2(cr|@to=HOzb3fqrT~b5Yf@&>kUSU7X>E#(hoE4$ zK}hu{O>Bk9V8wf!i;zContz(k@aJ}s71IaqacDSM7nc53=8pGHXk=0_u6v5zzv)?a z^`AqJ*B-SWJ*MyO(`xqCv_C7uKgjw@)x}Eho&I)wb_W`9M?8kTP%-bxnV&->fjK8Y zbAY!K(`>T%<)z2uxhHSe&TTEb;@AhIGIGIe>Kz0555-N7pb|I!mtK|@_o*Xu0Zv^D zI{UzPiU%LnI+bYYd-C!*WQL6e?XlWD@e#IHU5c(&H;mFfRi zGxf)sO9IN*@8F8cU&B(bDpUKo=cygXGWlt{{0=Zb?JM`7|C0Jo%haE6N}SkQiGcoJ z(9GL1ZJA~+%QWNOnQ7#qEa>LS(_dJGdTrE6Ppj7$&X~Bwn#COSk!DfV%r;g+zxJhPa95{OiF|EhtyyPvc<0_vrN%@h^Skbcu_HeJhbCvpkv z*uJ&tQPIS(k81<#jB9lJ;Hk-?LyQGt$AH?gZ1-DDz}QW%<7y{>$pqKDH#oC5azJ$K zODJfc+Mt^uxRxf8sDE)JFc;?toi66d?>4-h&4ab_HXq*kYW{@gS)v@{<>LH76sIq#c#e^d3 zq!J%&_>(E?e5d+`lEx36>RDxtu2X$+sBybl_~Dm8f0A3lhteF zAU>Hs$d0VoLPSbI-Zd3E_FTN6+kkG_!CSC%24uvW0E*3y>;q*SIa%0-fK}Q!XR*!P zH+hyhKjYp%S=t)!p+yw($&XHO5@+mWKG_wi-rbP)D%-!;;Gb-OHox88AAtH=uQtgo zA=%b;X7AcqJb^)=`*-6k{pMjqC0aV!8j}S_eFBFQBf|1EO#JN2zA(wka4~F1bXGZ$ zRP$Bt&yEmAee;ca14{J@!$)2r_LEnoKFRuIaz%ud55J~0PdozO<^K91BTZ1--FvtM_9AyIK=6iidG}pO8_9<|^!BUVfgW0N|1gq7 zNRzTtfQA3|9Qfg8C}#FN+adz(sjHxy%SG{pP`o=vyM^dMi9L(10RK!0F$Gmf27a4B z+Psobn-dtXi%KWZT&N4u5Ml03G?zL3=aoRT&5CdMI{#1CSo6v>8O9s$_P{*4npKA| z=@F&p3)O)OHi8+S}hPVQG@hOw5z z<*?|MPf8X=CXQYgt!@u4PJ!Uq%6{OGji$E>J_Q)cXX32&%qwzq#Uc8~c6PYzttvAsaU5{6Fx#yB&jLMIbRS>!JKqZM&s%Sk;G2Zu5Z z1}+_3W$C02`Lp5?-b@zXVX8F_Hvhu_hf zSL@H^{6VIOtC%dI7P!hif!ywWI4xCuz=fkX#v0$I5!w0uVuo z7zt!wJN;|D(BuwLsyPw7J}hZ7nsBck^}dmR^HyVgV*BN-3+Sgky6CnU1E8&EPP+2X z%~u}Lv{d^Mp50dY_|lC(>i@no_ElLv;u|z`cXPV|CBI|)sAxQ{uWSWRnF?f&eEmwL2&z&8gX)uI0KH=De z1TzoE0w^9sc-DkAAo$~*<`(MK078oMv|X1_%mXC%u8K`KU3D}b99yp3iFr2-YFU1m zE*h?gCKfE?LJsYdr7?^rmq-JnwA?jJ`KY+rN!%_LHRd-nE~kJZX-CuUl~XZ{s{;ecks{5JL&DMl#?^YA&;0C|$zMr5n5620{ONVPS)xjXlUD){rv%dTL z(p>(^&h@ET8Jl)4ky`qE5%4|wtXJGw3vFoAy>x4HRvs$t2<<+(b&jy6n1k!Nh$c9o zX<_?K2b+y43-lyT>_gAW^ajc8kaD4n^2iwtFk&_qu|jm;`zJ0r4N! zwCp~#@sO51gBuQN*)yzRP|KcRaN%`Yu`g`@QK@nt5lkU8Y5#N!zv;356Z1V0oGfLDfnLh^N6 z731C6ZW6@3%(c6YKYiz=tU~A}4mmJ=7+o;+_r648<|p4iR%k@$vW(E}Ki>$^|9)2A$u*H*L9YlkH477d-PFNMc#AzEwe`r7qLQ#%II|G<$BNBgDU+Ih%v>|hu%pafo9bXXpr|%-R@9j|>Q_LI~y6*hne(OzD zIp5h!wlm~TahXI+hZv6RAvxYZ*4)foCnECHP9pVn>I_S6(7F5ycSvwQ3N*@yQ4P<>QL*91gLL9g1Q_x=OxrPYexdp6UUvd4b~S%2 ziy^;CJd~t{0&uQqHP_1Tw817nVQ;fV!u$_@C%6)mOGvebk7qK@R{vD_i;)VG>CP<` zOU*meDwRslDAIJHiUq}Z{x>U*x>?D7n)RqTtUq;Qduo=MIK}t>8_`He)m^5F8!#F5 z1ZG8|D3)pvZ=BP^zVw`_RbiGw5woDx+TC9*rwXQ6Wty^lV#Iy^QIy`s4J8s+je4wPv1+8aYrf`mk0Q6<~_fM$76 zh^LxJy-kg;rEwjujl%6bRbt%c5QIdRkND~3=&OmDWm)@D^~b@*+VvvRnjzAulaD)W zXB+A?rs$Vzyk*cv_xE~NvxWrxDUjU76A7z;n5qmx;)msP)_$6-Ahs$UjZWpC+Zx>K zyw7LQFH=ulVu_Rk=?U>RT}ewg#Mctq8gkWy>EL$AaS+%5{#XKYw-x*J^~ixZ&EofM zTJ`X2mNTf2tf16KdP`gd!fEU_y9RRyv$4|sbz1WYoidB)NtdyRK6$Bhd!?j{?d_-7 zEi)6Vo7G!?G&XoqJ26jVI)WFi)$jUU!EcjQ2fb-maC*O8!J++}z~sWTlk*j;xyDic zXT4tyKD6Gve%P*HNx^C79SowtBsB%73GWW)7Pg`8JX{Z0`yMc>iSe5Dd^scrhwptO zhq_qhK3bG3n^YrQ>>D{W<5!vRnJj6VD>J{H?ct77SH1xY+%9n?U(R7;w-Iqm4u|9^ z`Qd}}+>`X&tZaa;y_C?u<9Xul{=@vg1>mrGNNY>$8a*xy`q2HL=|T z8p`=Qq=Eg{h%A|H7(Q9A^rCuMhg-(Bia}0aDxI^p{^!enL^e|uSNNSD;i@)qZdF@N zPm8F{T%+cWZLcvdyPXq*kKC;9Yl3&IM1MGk1nM)*g%R)T_cJ z(Co5HJ)R??fl4?H*;>y@7}7pRM+cr0ze^2g;A3;>!n5HWpXAvp%AKzqrz*K|5(B8d zXM=4Bsxtf)76`T}+e+#)X+a()zJM0o-w*y0GDv-|FAv%A`7Qwa^OHt_0U#NaMq!3V zfn7@OC-3&l<7BsmLUo%2#Pq}xjbMxeddce3JcAY8W|bK7*a#_+0WAQ4bW%o&30RpqceQ^=DIKT7UE9^@b|BIJsFVEey+~*RZ zv?R;J?rwUc&zYT6km20_seaKk&6j=A#598Aj_Ap+An{UH6SgSLuV*n$Os=$f5lXjF z#%6?*)CMcf^bvKU%Zfs)1;s_nZ8Tzq9kVR{N%*`5zbo;U_v`owQqD zWASG;S(%clDN*`cW}@g7>mso|`EyQml6RN{W=vH!SD$l5=^|dhzZ%<{A6#tC^GMnR zwdo5TOm%OmMs@g2u&vO5qyQ^h zm(q^;N(Bmq9n8mVJ|ykc%0R}&4N@#_(4!lqSlobOLHu{kGCR|eVoECzcfoI@AwZVe z!gq_UiFQrR7!Q{MxYj3^JgQ}yP2OX^+)5wbTYONSd)a0!0=;eJXe$ZeYWlDEt~|w79sbVVa>s$Uh=d_ zz@kjZMOsX=1eK$zRtxQi&5K@+rJ;sv$U2nkR@3~sor>)O?-Rq5O6+uB+$Z@p4bt3)&byn)mU^43eOI&rN< zYym;Z|NEPHp3Md9>pvgZ=XvIO=FFKhXU?2C<7ZgWgFv$yyK_nSyRomR)Ex${G$G7p zqS=zhBFkOrl2GD&Lx!8{3#hAgxjwW9peBw~6HAw#Rg8Pv+bmdKx~|xxccr6V5Y>-* zeSvy?!ARWTeMolY^n^7#Ax#q#LY~;7=L`YlsK_!ZPNk@!4XPBPh^zHW^^qJ=Y<|(b z3%ioDU}z^kW5R*_z?)Z@x)5PtW{HppKfbn9lLAY?(Q)CW8a=J}3Rd!G zjs&sCHYX0Fl)TE8#an<!ic_peOdtkG$fvK=!~mnp~!-*R~7S9FXv za>8G_L9W7uxFPpPX|82&)7*-Yt@IqnqI}%Xriin<+GhlE$${@k-dA6xywc`{f`jj+ zfzO)FMly^uYLcaNKYqIn|bPqPV<8KlzQ7|gY2(5b=MvruKzmd zzoQ*&gwrE>W1+!a%v)v-s$wI!ii?mZG9iWuu@?(kn;Za|RY>$nMDI`ZoRjr|mlL=C zST}n=l$*2ZDmdSc>;cNlU2a=u^-?@mnRB|^sCGMo2WK(o^`dQ7Kl6B}=5?6%@;WuN zecH1kQP5DeZ}u!7zgAL!9%WzA5-+fw#og~wUS!(NVB6%bf&F-uljTXv1-Rco2lA`u z=nZ2_w@8kTnJ~Lf_S;VVx@Mhqf6M41TV%qTTtJxwYt>(q*Re-hFGpevzR;~v zLgvJ;&0wJ`<|TfrBVlRMd#PStD$iM{I;yq_x4wAh_09g+q z1gzB!=hpC@NGSsH&Dn6CH64nS{nh&G_Qy*i?aD9c5MvFWZM9|-BiQ_fpNzPP-)FyV z)8rb+RIU9x_F1m;cyaB29Yu-X{+dqXXMavHs42ZDn?BvdEgH$!v?j8;S{RemZH-u$ zKzmkn6{|$1Ej1r9OR9fZMZ-nyX|I`J2Aw{BC>DR(T?jl5_l-2H?i3I)AMRDQJ07{M zIg5uWo1UQI+oZLqO7&)!@w!7Ji3iCi#TN*{mL2WH#i)17K4dYoI*YmC^ELplr@8h2 zxJLAUo9QmDS&uZn!plT{Vl(;=_}H0 z;572SxDc%ySjm;lB7W0!h=x_rQVTg_Giv43wza|jE<@%9`Q~7R0*_V!kl9E^QtMbk zX-l0BIp|uy)hwu{-6+j5Rd%2IUZTQjgy)^ME|QJjU&X{gtD6% zvK>*zFtT`S-OqAA2Ck;&A_+Uy0+l^`fgIIIgQkzepf-l(jpLEeKkazr40t5dJb2dv zOwF-{A(F%_e<9#&JKS}A6Cv|(XBUvqMwIybE(V^<>bg>?lox>kPiqxiCD9VOL3Xtw zVwNYB!`6AjUPA#_*~WQPE|Yj4EbRmV&x0a7`2v3BFeJXUa8P{A35y;S#CcUO?kQuts0Ab))FF0F)jOK^< zQF=d7KVQtE7r8|9Hh&Y#&JSkZ0zzrEXTG@B#*dmxJfunO%pYc|A0IaxT>QMw@uP@0 z+g#Dl>dL-hWHpyOwCAjAGI)7w=ZWgHqD<>9%so0X#4hiSKi*E6xj8sBCF+$`7c4kg zEU(0$jmNmzI2DK1#&Ebn40}S%QCiJPM`@*&(rliM+~o|#F>jWwn>m8pLg^B&&$QQX z<2J1b9VSt)dXcJEaZOs+N7S!HS6cQ3c78U0JD@Yif9$J{t!tIaCCA?vFg$Yn-7#wJ zsA#09RWWlH+#8<6m>He3ujmr)yR2$7KbKr5ayK4FheZDh8j ze4`z*VW+4ShX!j5&BvT)WF0`8WFb@bReha=>S`~Ye=17bX%`-*dEzN6!bHZh=&?A` zMhK$Sddv`(W7A^#t_TKf3X?GIiW{VaaZtnVB*V_s`lbbO%Oa?dQNKhwZw+jjky$}L z9iCf7X+y-)$?qxJI<~Q(QV{2k`fVgPR*1I2OS~xU{~13qO#2tmFC%T{qofg4Y%s=$d;y|m*=$pD6Q)%so5C;PPbpN!YE&1JhPmdTW@ zn|+~kSTl?WY>>*{nmtaj$uG10m39(|tjFC}@jm>flx?VgI(;qfl|P9kw|Tv|!w@_r z-$qyU=z7>@Agdm8pE|Tv8UJS2;cJ&nh{7vg z9Zydk)S!MRTHv?Krlx6|kH^-xzI}=3#_zy({0SSK@fTSlaZYrvgUR4?ypnKE8M8Fo zJeJgTCo*2q2>*bG1G%nDU5fs^3&;Zm@}<|i(W2BA*IVdit3;M$kEi=U3uPGn{x;i{$^JOyst52_EFQc zp>Df^`xR4z?m3U~yKt8}@+tjrROOu&A?y?wxnElm1dP5s>lNrttz2U4n{)ZAjT~DiN)DjjkHvYBkq^+ab}L5X`}jH8lY>}9691O z{RlTdyPBT|T;`kZAqBqUpg*pU@-Z~&UjfNo>Yw?0aI2Jg|LExAc>7r`bl zOa)Tpn?-ANAAQsH{dl_$GuD0+V3*hXO=A9hnjIzRHGnz`SC!bjFL78AM-*WK@ zOdsR(WbZk1Kz5AURl>{?UIDaB9Ge%pp-_@q`UoM(b$i;Md6%!vFb8>gYg|V%ar85* zue9yr9E;!XGiRe#9ZSsRBIdu-OLl#>%cXle2}_n#-|$t@U9^2inp--h0B?eI2~8OLcshOt}TPEwz6vqvs`oapK0 zVIjp?OWC33RmZ%%+LEd~uM{zQUoX!a=^Zs_@d=6kC|NXOjXk6r+wu`G$BZgut zDn>%80Fm$~{1X&F`F>4oK6vSjEj9IsEp-^)+&=HFGh*0R_*ZIC|1?pO6D6P9vjcZi48T&`)tcSCe?1QQ_W~fq@5A)yh z!Ya}H4IT=t+D9P?>x#52{Mb*o1qAb7CHGN*xS5-6@mjsa#Qag(!o9`cmp#3^4fB31 z?`XG=Mr#*_h z@nek1yNzvZuKN%5e-2(UTjB*QN+uxZ_CNE@p&<^(KkNE{dh)nc^YeqL+v?YJv@ec* zRvYnNs^3i-rxOjlPRZ-&_o9gqoj4kLL zSw7`Q+n&#>J6_nU!I`w~pvH}s z(qt9zc6-*=-emCYkDRnH2Us3)r2aON8EZ%D2UYz2RF$pHa%A(MbK@kkX;~$THD9r# zY5t{cO#;A$G4B0TFam$|Bb4$r-u;>C??;lJVhdW|`Hv1}BFnvz$#sdf`Cekh{px~9 z)rRDT#5%;*6-D$qh15hNRqJ%5G!kn1Fxu;-3>U9wduCFTnAEnA_k(V|(2O=G*K-13 zQjt3X@If#@AuIVeh+tP;ORzs!kSeS_ zl|$5P>raBR)8RRBgp-pHXi|kWF1(+4Fbr1hhJRl?2*@Ej$d?#5{bt!;nM>d^VR}?VFUreF58-fk~X@ErG>dx0IEF4jLzcp33g~cOTUpjFMi;JiukUt989%72scJ<7< zf`wnT@>*Ze*geyFA8*57Pkc2e7o6YNJzI|0N@uZ2Tm(VgeGiFvM%$QQnEeTk@_CCN zTtF~@LPC~*C%4d?2_-)LCvcR&0+$uW8tZ69%Zzy?DC``6)6u0@P!e~u_X+8y`nrAE zs*3ZaXl$0EaZBqgF)Ul?lo;$Nua3)cDQ=y*fmFos;Wyc$+%flsLUfrXuPm`!|ZT-12Wtmh| zVGj!Rw8dxRiCr`6_f=50nfn6*>x1rsWPb&9=XNGlkUf}G3ip%d5iZFW!~9j6`vu|p#vK`Dv}F~R+}L?Q7K2qh z?XwZ-^&qoxx<$UFv0w|(>rZM*54E7vmO{Pq1CVG?jBe@q0L6cL1Pd)vq_5|Cw0zXR z4et}3D1ZNC?P?yxmTf^TcTE*2lX-}vwd`$9Oin3a%kflIrEvXa66FsoOQdm*Ms(_# zg7*n!r{4l&W|FfqIm)_MJ=+fX^~?{g!|W?#!)*B2M{8?KJ2oBuWP0x7Z`z6>d_ZFb z*b{2g0v)P$(AS#b6<@a{!-tNSvI(LsBw1#K_DXd_VL<^6eh=*ke)ZUHH~A#C@`sZC zH*ji$UBe{A6S`I>^gs0^Bx#5(?oA)mQc1bfcUXHZ?X9C7M8;SlMr%hS#KyjXc_@w_ z4JII1sP>SP;az2v;hS}{4QyVzP(_C`e}cpgA+tH}aso)~ncC@mW~cGfVoM#;5d=q^5s`r48x<5bNb!8Dj!b(JXNzc00m*@4^N_NK2gOD-bl2KpHO zw#+5{Vhu?TQ_|kItEYExk%gg;p|T~H2-!%+SRZ9(E~{B ztyq5fkN*fh7JJ)2U?H=A7M9lZRA}AZqde?vYN?HZdbEeTk&}n7TDgjreCa*N{IZ{R zQrX&H_<|t1VD;GK^QrL8aiX{Li%(wJKtj04vwBvbfPeWUjo;06M+WX`c57>5v+w2?Xr?!v-SY+|X4$G| zBvC{au;SUN`A>{xC_Hhp4w++ub~4$qKpV>=<-Txd!L`8U|9yh&%d!t>*@_{VM*>1` zQfRRFgui-a&lJarq777oXNJh49|Axw31U>FaXP)C7EB|d{FPP#n+Litq>BdLLLfZSxEhw@(RwvRmy9>9@STv8{Vu?Q?+{}?d`|IKE?my|`T)LXJGQ!2n6VRZiz-6cHYN3LrtK<#kAchI&T zX904BkVoB}+{78%fXJx5iZJOnHrJ?M!cV@;_$sDB<_fqpwpBs=ybB21b{;={&$THZ z)~!V&Ng1*Ffq7c-x2$SV*4Mt)Ebz->9XT;KxPsg6B>6##?MuPl^zb2L4&!_^rBdtv z{D{axMgHqY1W>Kb+EaDjK%E-@u9zv(Y1yfwHx*`Ve_Q!u)O$XAZSA|ag{IHd;>>y1 zL9hA65Q&utke2!&Ab)7kw55K1d*97n{q?o7oW=jPX| zeJEqz^wCj48fD`i{zr?=yt8dj&zwpB^`&~#`y%x;Q9k`lv+?7n5N{8Ue5wHA{r!b` zQ^_+MA~3h8Br8Ok-vMT}QJ_>N|6a*?mO~-O8&*=hR-`Hj*?0-;bRzeA?SVrKq!+zDe?J+&a#oMjb57Ucs%&4kNaq4O!oV)qzLl-H z?f~5E=f|?WlJ6!y&db}nKHIpt{>$v&7QOD4L}NFwpP0+ivP$KdJJ~tSn3=Sx^_Z@+ znUgQC%gfEr(}dPqF9nX=on&!QmL}0qhIYZFHL%`@Gl7s0shLRIC89se9skg$E8V5T z@^!9Mo-iNRTeaS5^~Sj;Nq?_%D=A;a?X~zNb5M!i5&*d>PU~6)WfikD5+zOpSJPLi zVDwz!Vy`&l9Th%C4;NZ$yt8Z@&iNFQ_#VZYwf_>FCmx9KY*-R?%0r2 z_1ZfDuel@;GOhe}u}}XDE9f7i9rP2Tu}B!C+5=%463`dR@bLJz#U$Z5uKZn`V(P>N zfK!9Ez;1t*Ua%UGDDeVM^XMjs{%3m`f04!WX|E4MT<4Ozp%9$D)k}@|QqHBe>g#nj zeQ>e>5}&4lK;!!dpGQ{2pSrWWyj7ms9*ry+ps-~4&JsE$8NQ20qI~ADhqoK?VI&ux zNih6*)R)2uEG1{jS6HKb33uqY{J5nB?mOfem(7XdvAAmwGMXKaT|iswN$7Mj7{XgWg%Hm8ogzeuzpt6*MRA zCHr4+gizQ2LLS&Zevgc@9S@(vw`u*NJ5mDrx$yNA1A^Z!O^py-^9Yg7WtlLbwIce5M`9mL?*7{=At0>q*4vjvnGv0HrYkq zdKcmq|F-&{t(51}Z;{F=Rkz`!8Ts)LG;L_C&Bif~&e+3lvW5{Qs)8Mlmm-U`eDPBK z)>vWjXZpZ6)7Sr%eHmH2R6!t%v01kU&GOD3lJHNM2A+{#B`PZ^Fz8Thyn=PfW^`^@Q!k>iykz zeNryj71L9@GGv$7Jivf4_wkdlv}w^M;EGJGJ&+I}PaTAP(08zZjx25iykPu`TNfkQ z*mIibM9bGV+7bAMnve=V%~y_K2nv~%U9IEkKf10_ks-v}n|{ud{y3QdVhhiWDXE~$ z&b?&Um>Nkj%3|)?OM;QCQ@$@l#OWNz0ABON-*;(UQy+#GT_;5vk;0$1Xic4Cg_6W9 z4O+&?SMW47TQz?k_XhLlKLWlSP@3h>hY2@k1Aa)7;r&a{qszX4fp?kS4<6l}>Dzqy z7r5(&AY1O~=<|6R>f_gvW*oHMl>n`o$l`m5Qzv>tOB@XUl!(q4J_k$dPFzI;&a>m2 z=FUE!o{mBR#mPR!>h-vtG$@Vzd9!SfywjP;?f9UOVj+0s9!ZEP0a>Lwe{vG+#+<-U zS9?Gtxub)DPY&WZ9+PDb04K7{&L z&_^Mji9YW(s`MDX(Y!VrNL$Qg+IR^*!9bqK(OW1+eclsyt3R%`MS zI|kPsjt|GW!SL_2C>I(__1afSly%RMUT`4w8NB{$x+eU~?VV{*0q)N1Z7Z~Jah6ZShhPSwuNikHtk zZ`nP^t{AIp7`A8e{xZ-Tw$;0Qt6T1UDMt)m2PYKHB|`@{4y!oqhAnvI_V=A1ipU>z zr(MjG(OYgIX`MWLLU^!{tQ@ujmowa&WxXeO9Fh~<@`7?d&nhsf25EVHCr`#sj0ZCv zOHW$qj`i{4AD;89UX*c04(oKYG7d?`kxJ<$!n8TW0Ek&aHD|Mx-3iB5NMPVCd_i4# z!D?_W`G{IoB((+y>O@L}YJTK=a@S(WR)p9uI*$c?l(fC;r5B1A{H?CV7;yMC$3>#t#Mk#Yp1O#S+xYaRvwt&V zdJ{3vEY+I?n3=2*?ON2jrLi8<@Jl5#2)2Acy3T1fP=oo)5wLM6+@FO-^A^9_>%ijI z^=&;TAe?`RNaGn= z@=tZ~mnj~UV*f|H`Dm2;zHEs(HYVck-2a+Qt7*CGnQdZ?y3_{4aCycjwB#!jBh- zv~Qk^ewx>QE!f{OW=UfRfKjN*NS$|dC zfJU6$yZ}SkJ87CnCf(53? zyv4ST@)X!ron4r8wC|riq8)blt6w|E2r5fuU%E&2=Jd{$m^q!w&pz0W9)Eo}6w3GO zs1|SxO?;PH{qKMW1evSqNpQ!|m}fV;Ss_MeU5bKb zgANcEBh#GeVi3EDiC3lYLnd>7)yrw3s^Y_`+|$buyi`K*-QrOQA3nwX6KtU)f26~o zpBfFBWIY0VBU_o`a3$FlW-jkSy5)PNEKhw{|GW@bp*!qrS!B0zZ3)Gwm(+9Sur(b! zt@ZJ)Dn{{b7=qdC zLo+&K@3;B}dt+yHhdspM4?DWmA45}UbKi5YyRlJyBVn=@cbEKToCFKM^<$#q+}?J`)zVfb?y6ed;3b&QE|+F zZD-LDwV=1IxTrav7s4n@D>ZEAQU_ZOX_e}fzTVWG+dYKs)O#ww1mx7=_QbBFpU=v9 z4f<1SA$e{A{REYr8|6vw)6*y&{+=lR`N2L3utLm&SW5!2OPL>ae-Hen2-^@x1XCOl zBJk#r zm7}$g7tc=G<>i=C4a*VcwGO-hts zG`yHK^gaQyeL-7&c7&LZI59TwuYmqZp<{ zBq9J)ayDFWx=!6BTbg_3$;({Ao(a5~u?Wa-?_k)@^)`H}`LAqpZ6v+c!rOmIDS9_; z7_a1;!?LkN`O`&$cK|l(R}jeo$e8&98!bRALm$k9qE*T88Oql(Iwtt5QWbNdk6Lby z@lq8tD$CxUb-K`mgM=n)#fLMdp5GLPOt+t_v#oc7@pBX9XWELQ)H=f)K@Ik%W@!UQ z&%oMN2|X`)ZY}-~l#nx}PzYFjdx!aIv*j?-9kw1qsQTl{W7$1$`>W@=PKn#PS}%o- zo7101)z!^1bl3m)!qNQxr=x1H{!ElN9Y{SHj_#$V6q$Nghu1QuNR1>6-27T8>TpmK z=M?LNn8~yQ0&*B3jKP*MF=c2N71Dttr0_28(}bEhzEwqIn(L-bOnGxBmU*@HoZlM0 zHq-h!5p>^-3sxt}zh^6Cf(eg13zvJgeY@=W3;roa(~9pc7Oc5s?34@mFof`H;DaL zCTnZO*NPkS66GKD_ZxUk%sgcaz?;Xcf~sU?to2$ER&q`2OrGMU)pl6~&*WUgF^uwc zXF7uNB(U^9iy+#s^4tViEhnJo#yH$jMil&y;{EwgJyZ=3^!XpWFFB~65>a%%ihj*9 zkN~x|FI#(vV3#u>VAJA}spkS7S;72o^+!9TKbn1+Bj6Vryfj(^y51_VMFV>{8dO+K z^Vs597`q1kdw%Iw??{e*&2d-C>#?$-`s7@orY0VK=*!B%IkIv(UCvh(BPeH zE1e19a2tgKMEB2i8|OuX94dHI|{Zi#{FZw?Xaw16z`eYOyc* z1N`I3XpPxu;gkH8njCGo_FUipYGl!7v9D{-3)K%X|2%;V>R7|vsZ3`NP=2C(Vvwx5#2jXm!I!3x%qvle6npnl5=y9; zohU!lreS9FU84N+XaI$0R@>CbJB8$RQ(lECMx_nn?5f_mxEERsr^E3u3BFpVA2md~HNX0;?Vx5a@fO zu*#lp+!IQ(^y+%E7+W%BkFx&PMNF=_($9FE}Se92!Nnh-+V+)+bq-i*h3fVki*$Cd~O9qPP zS6S2{p==iYEa~t$|LDv5`%j<`NoXw88=+d$_evXZdl2Bu4_D--meQ3z!drirL$mNZ z`wE}7OX0E+dTVZJsJ_s?2Syff!I=}Ep!$z9pzjnq zupP|kS$0-&OMW)GwA!s>K z*Ecb*4;axQMC(1zy6#HIS0e_S902T%H}y28>whV!_0#!67OGMvGM(?bY;)6dChov9JpX}Ym;!nfq|PI*9+v!qQx3h%$GI- zD{ae|#9zodmiT_D0adVrIs4M@u*6vE%syV;^HQ&SUh-@huV#V7&e%b(vjXln_$|Jp zc{>y3m+V821_~3zo=KiLo_l~qASgzx=;`q3+-$uxU|OoZ>^gpg?{^=gP24v?f%4 zjpZDUy#T+De#Y$<$3>jL=ChJgjW*aze(|N~_aE!ROd96Hqr`w=Ma>m8h>`q5Z(%Xy zvq>nT{mqPg0-~R?cRnNjvcm1p{vEorjac~EDgl@hf03`j!1wo=z;v72@en)sk6eV^ z`_HoHd1n~|EBq803Rr>vAPq7DO41r*K!q~(`aj0djvMjraD4= z$kGl3HPT*^v4%yo`5C7?0-of&NoTSgOm+-H#?oRB!9F7}sX4Y(O20=@Y@XUA{{$#<0McyWB1R|dC4 z{9p9?f_D|Zf+X<8EO$MV8l}l3hE~QbeH41=?wFvR|IYPkHH~r_OGbyKitn4%)A-~aScq| zTAmiuSAm~A0Yim~{+q#b|bsa?7{xd4)|AdH%G0N&g> z%p&sN#|MZUJVN^O%?fVEWFHm@<}$*}e}hEEzx+ixT$=SXDSLBgcsj{1)ZLUtPmYr( zX#$XOd3n9=bE!kiit0aRYG?gfQ&9iE&7;rF%f4ynueEhUC3HQ$mDShhB^Jg*KL$o{ zV)wU>2bL2Z5K=ROx>DJ*~%;4A1jdnf3^dL9I zy&6sl#Ur;jqZ`~NEPA@AKR#tsWh;oG|n_`=5!HFj4{R@c_I=rsVjZ;3+RESA)v{$g8MOsVS|FxpVZ`PHbVGB zh^USx%6E46r&>0@vuGOZ9{4S)$Bmz-*&oS?OA8e){{&K4D=jlsTOB)bJ%q`TURle` z)4Z|;1v9C60gQE0+-o_lMlh?l(KN5x;w4X;=A};~GT-{Yc>2LE;|yZ0mI!tlSQAUX z8~AA43`u-5h(s^0s&SW_|OGR(!TJ%D))5)G6K24^nBPSZ~V)S`p@%! zz`yLO*y__+5XTcM|3#7PrzRKbg^JJ8gTlM;FVHBi1@(7WKNNIDDKnL}11Mn+j^xJI zEyVedK-TVz1!K$cAO;#+a#T^;Q2w{wLy@xv`Ue3t|4M(?X|ZBjMVxeZsTJ2Ol?-n) zQ&5~C#P5??(SyoN||6WZ6 zVECE%eA<_bSo%VKKEL<$R;r;hQVB@P%InoXbZLwemI9z(`!6g9)8QSPrLq(G#%X`o zEFF=JqAdXQTb>U854PiJ|pamQau(QlCzyy9b8&4Fzn zmRTuIg(>5YzZq&z_nQMH-YPy=)TjFw-!AtQah6`udbYB}7|x8sFJVizMsZR*zLRg6 zJ8g$TmP@Ei-NxY?l2PCFmqFQrs25J%?;r=ZF+%)>D-iIMA&MqCBS}Zk6VGGG>byFU$Iyb%cto zw9?A52Fc|Wk=vgi*K6I_rMPCVEDP0No!H&&y1o^O6{@IP{ia@?p|C+N^ ziH{C*`E2Xq{Xdlb`wRb5*$w5_iFMSUF8Yvvjl(5ml%Ya<4Om11(A z3tzUVIXsShdF&PqI`K_b@E`awcIeIjilO(jlfP*TnBx@E%JoUx+B$9cr^7!|io%ip zy}M`eW$AO*_wDt(rHS|P9q~e~FTr+I0rbDmpYgk>05Yvp|FeA~lPn_j(xr4R-Z}Q1 zExPQsV|e0k@z)*s9e2IC$1~-2#dqb^4-G7}1_mO={$66GhFPc{D=sn9P~Fh<6n4_> zo_Z!hroG(xNTJ-5e0PTAcux9fTU%mRH}o}$YiET1zX1Dg8~2tQ?ui@mLGi!Y(|z7o zAjSVAX0y_Ur;5}RNd8H7LC!OYijV`1?8<SMNUScE*g6%Z63#oX%VFn8nB#67$_tgeUAC0U!j@L1spHh(7^|a)BRBE%>ixZmB(q2)b{8!sGji?zj}_JP;bsucXk*2=EA zYMl_(4v2@F>Xx{s5^N>n(XgILuzN7&-q9e1U18(|J<3;XV00(mb-Q8Hy!6=O8Rj;4 zvoI64>rS(X3DNRz?C%;Et0=+1o$!pes9na&{Gyxo&o|9FNwT6BZ1_Jggu7c7U8COB z0+7pE66J4f6WZAG=xrWk*Cn@giLbWv3b_A5(XO3wZMarpb&;^UGYCy~D{BIzBfAo} zw&_AjZ{M>gDdqd~z3cybX+c0qYGo1UbBzMOz0b#b3ERP;`jbSaLj|1G8X>xGmx^GR0+>_D~&d*KE&D;ObWpP(@v<--@-;b(!qst%>^NL|rH zQ=m=klc3}xROZ+ZS;rq%c4u9Vl_OVEX*8-c@GOSz*k+N6q-@=F>_peXKDW+%CHq4! zT|*0x`nP%t7fI4ar|?a-i>;DCWt5g=$npCJE+pR$${;nhltb)m$$>wK9 z5Eqyue(iS{>$~rCKcIHi{Qg6%hD~AeX(#CAlMigzc|cvbVdug1SGyC}O&u;Mz!zrI zrw7Z4p&aAQ%*O{3))ObREgFjVLNC?tO{;&v9d~Q*g&*u_6Po(;MvBL|85=nbKfT16 zpQ&d(NK|W&k{gscH)_k88cDO%i0YlUxq4WJgO9P!L*J`XWM}LFg zNo)@XM3&!Vb*ZwBEhQ&_b-W*kRh>6iWHY1d5Fo7DjQfk+SKd^7j~WK)6nRJai`mrp z^Oem*`hjntUo5r0>#WXAsu4>!=)UkE`mWV)yA%Y02KziO=avE`8sC-W@9^dtvvN7CF4ZzjoVTn(A zlF3Vc<&@5Bp5OvCe&ccCOEuD6P1A+F7wImf`)QE;S5K&D+*02=gV)Dytxpj)Cfx^X z)-46>v=!d3@j@F*1b3+$WH3oSS>k5z?y?5TE}$rmHTi|a8^5UUQ?Y$LMaSTe*=a1Q z52UXPw+fY%TB}k)ePeNhLMZq^eON(~52C4MQP)~nNFNxg-(LpG7v&*m(y;9t065kg z;Y&SXwjSpcSJmHf(s6TijwV=^--?Kfw2puNiIzxXH(DZH`4L2Vn->r%w%Jj0$ugf% zrJ#$pVpsGn`UNXr9Pf`^m?&#=UoFB5+R&6YL%wEBKPDWzoLwq0QOmX;fdcUNY^Ujb zj}KdZ;NOlSRepQ18h`4{ge){oloI#u-%fIy4`Vz7Ow}6yXGi{2ZApmzpb_kk%~sTN>ZO-UlhBgVufa2j+8|jWZWoksoOchkA7fHaK9)j0k$Fb1sK#CxTCQ1 zD>r9ccZrwk^So;OR0KQHZi)#P)T`mL=~%Q6nzUpSt^F4170hp*qC* zGqI{#DT>T#$GGkR;UeQD71h}oi6_~_Q7=8FnrUIMO=O|+mW+|*1#p?{4y``KrY(GC z-d%oAw{FxNwFpsNbl- z*{`&I#D|xq-z)OO=Gd$u zaUSmfvKD8%gtJKEzle~RUG^Ine&X=f?;Wx={S&{BZlmEivU! zhu<@F;_JiIiG?42G8Bg+g%9xnZH0f)XR7c?`>+~G{DAfUonn>qKIPnT%r|XzApqM5 zRvx?(J^5i++Ht^T>fm2~znC?TckYrq?Y3pG6lqO%>=E#f|LFa~IsSm@sJ#PLIs`Yr z)kQO@TeXryqZVm=10_hn+~pjaV?o=jDTl1q=QF0;T7s3n2(()20Jc_Gjxf^=)Yvb@ z@1?yubX;>XJ$ohe-QyD>X4(NT;umhWgU`d6g~z4`t9LSx#BH#V$z3^+n{ zCpD~iR4W=gl&W*myB_{O)*m^3hkB&{H*ux1`lzo8{&Zg{sx@)jdKLz@c-HP?u z`3>}B6*eooq4qF;IaO-XNTV$M0{Aa&X;3YBc?f;B3auQ)!e(SrkEss88s9^39Y~f&EV4e7jl~UsW&2UqvoUp-7oUmJu68bx2&N5%PWED2|Q*=oPLO5`2a_z#kY%_<(vKu$#6ic7<*`oLUZ?G%{ zPRs5iKdOBq38NgslI=kVZHCH6jZ{C#j9=Xa`<$gJu3We(is&E;^-M|E6q=npuPnd# zx*=$cdsDdiZCACw@aeT~Lfd2RU(=-q^CkxMoqF7_Q(e`1A9(_d_#~-5ih2v5XDvlL zs-wd_6_KX4w$2GzjLcaZ!zP$!zj2&`Zt3z-Y0lk;Lek+cwU@P@U^o3$ zzUu-rRUhea>&~cef4a`bvdVJv=VolP=Yv@ySj2#3s~Cz{*ww=}^w}F{zUs_pItq zbIb9x-w9XtR~=j0xno&8HfRGx)y7===dmYB)A}Dt(`@hd78+HqA5W(d-|MTOe?L_K z@qT`eHz>Zx_k66Hb$)z_%fDG&dp2EbuAwH|zoi}fw-ZR_A4rjucGoZ;8uasiai!)9 zz$5PZ9X=$k{HXyr<{Agdv;YzpKPmvnOco?B)3xRkS4(A((wtopbf=_yI;O8l{LJrG zE8%PS^ld%1#PYZ+3lQ-J12If(&b7^Af@4V*)9&UtSZVRZ&ke>zYRt^-?a% zo6ZPtiX%i^{pDb65WkAS4d%$jnU)uco)(+?>iqrysyF)yy{YgR(wf6H3hq^Z85xyR z!IiSVVW@C^Iu5SP#W%b2d;gbzQ`bJj?CrM?37ttY^;jT3aC6?Gdx(}kQRrFJhQf_+ zezF6Lp6$*5 z9{gu(Qpf&}vQ}W&&ST!!Pd{t%JnySIgR*JofsL1k}!*c#bsnz;!LBd$?C3lIYn4isn z+U_CDzSv(|RToZG=VuR-%#|I8pg;Z1OP%V6vrLH^fyZrvsk8d#>r7#R&THHG9pjaa zX2i#AP3x@oe%@2uH%xb~uUpUMEEo=a#jQ04xtp&TM!k8??~JjTt;8 zX^nx?S=fY!EAvDAl2^{Wvh7!AMMkI^8j4e(zMeYC8y=51HsAFvVOCaS3vF?D`%%$$(&xrrJS6-_=x?}wU@WZ||q z#cD65Xtf6HTGJ)_hT3S-(k^n6su)yP8ZCM zMT>vUKGcV@Kz0*oA;N0D8SFBnxi-tGH~W_yQ}6I%^Uu!ZPpq)&;X1CQ17_O|?`#J1 zZwwHYEmhp26r3~PNjR4ht=1zs=rcW1gI=*;tmpgN@Ro&6+YF+$8vGft=F>wdD$%Y` ze+t+f)@%3NUh?fPCenGio&d6u!YlLww=?GvmkM9Jd1wf=s$CX%A_cH22Dd7Ep%kc* z<+oUKMvl-fy~~<2a)j2IGoJUqEKz^pfI^XsN4hv66Z6(gOunc)V!0&e`xEm_<-+$v zOs^A%y;zkz<`7a$Naqi(!sUEf%Yy%61-uVI@+=7djw}(kuSzep8Mtg#r3_w!1DC5% zkW9>5FFUd;b-gTXa#%}c@&#|$dU;Q(8vH&Qj2@L`UsXlUc+K+nD&3zt1H@D%FP3Wv zx}Yk#3R`wFn!zl7?pmvh*Ndp34>eRVhU2+V5*i6VKTVUc1 zt{U8envf&lbv!q_JHix}y1|x|y4#k^1zu%qW)Aa` zH`-6j5i&mS&=@%TP|c2ZYsvnaMgJXewGN$J&90#xY3-d1f8SGP%ykYgo%oAb+W@@G zxIM^);sdTzx3R(eANWhapOpWor-J+y?fIAg=lmlB`ojz(i=A0uKTQCj&E`7hg- zz;`|&5Mh?}pF~0n7`qAu=3EMwrlKJGSjU#RciX;G{qn25G`uCS+eZRfSwwlyU8X*5 zX=Wg`Rji1shQ+_y)n@L6OsIyLd26JvD%z6h9@-j-s;2vcnr!)1e)*nUeU(uF#WCIM z<;%!kr27T-7u#XkYu$ z;2~6g{2rAz5W@U>8?`Uj5V>{a~T0xDWE>JnDCN;FqAi)qkFke=H$!Hbec^+gpCd z-T`AzV6Zi~-c-MZWSH2|Zw~JCyw7xh%J$8=yV)DO2Eg-?Za0~Sc3Dh}gp&2t!6%<2*swm&MZ(l~{$q^Kd{RVQ(D>~~9oc#UL+s>@I>w2zGkIVEk=5f(Gu@}#p z+B~-30El?zZu=SM^Wajo|4n_X+a~?8W4FCZ`$wQo++_aE6&CLJI@93A0A;5C7hUGR zpVQ%e0`D2|jSh_Szy_a#v@_1u4;|mM^d0PPAu|u!|1Zb^TuQ}^C;hY0{sEXT(z;Dd z;-%{YQh7nRR{qH13{rznA2Vdv*g$3_p9_6+XChma#fNF^6kE=#1{KpFyFLnwqa%>| znGhFlX2l1eKdX3dWci40iQU(88!3(vF@9&o1DUtJC+jq#bqm*fxt!8$CwBL~{>;Sg zUUf0v>gQhympbhHt5ox0R@bbW9{`~2jfy(t{5nM)l8gEoQDz;dQ;lwVwDWW81rSwY zcVVQl9HyPWselq;1sFhGTuDq_eo0y%wa#^gTiF}v zwl-~vM3z5hCEx{ZnfTJD^lIB5Z`d6O!jm^3URCw8;uUYJj+pg26`l?k|1W|F_yxgn z>{FqC!4WfGhzF&^q4sFxOEb!kFESfkyxE+~uJ{4On>X!wb9-=j&||NGAfLUce8<^4 zHO)zs7tQO~YgV@0^L_;J_bu*xV;B&0kag|a5`Idrx1BJjIlSx@OjT*^kN?M=B`{Nd+GXjhQ)ZdAhMO1#dgatO z-M+Mea`jo6T)bYzgE^#z!Z+RCo+;cAFul1Gc|0!SS-?YA&Z$rAZtv9bsP+a&9;(Yj)?JFuO zY<$-tD-QG}?+gxQv3hLq{D#9GGjFR5I4@l8&iC!REEl$AkCZ}3*xYKiY*XR-YHJos zeXa^V$s}D}*}L;Mu+XXhZFBfHLI{xLuLd38|Mk~mZ-F=(P2%E!G#Wc`s1<)iEi z=hMRT?}yIP{p)$Otxts~6QQ#r!&kK~q3r85c2q8sFF}4zsa5?8X`Qd}&;CU*%c28R_!Yy*kPc6qK>*Fff36Go)gc5} z4Y%h4$`2rb-2?FB0(uN5;2;GY?gBoP@;s)1{w`o%2>}NxAm0VdA3}hw_RA95X&(L) z&;+P)^f`yq8OWbGj^CM0TK?b9vJG@k4Ol&f&C&;jSW_{Z60`4iPT%#*=D$$+6Xj=E z3Li>ue%{1zPZj>tKKgIrVUB0R+P6!^C5l#(Ykw!!5`JEZ(&5eAWyjYu?(5H7`N-FD zzJTN$Aj#g|wQBoq>mT6r_5#Y;hjPrv%OH~kIx76XAFRx8?=>@lZhrU&DD}%INt7?K zRM|({EHMdMG1<%(KERkV6WO&vwUD!!?SC7g*~853T`9^-4J@`y9dyYSa=DqD6TKfxO?0=%`%0Mip5c-D}nS-c@HOKB^z6z=d`11>DfGd1jj?mZ`I&h zaHH$r&n^9xWSMo8&dPV@5<;DPq+4hyb8!)bq9uu0cen^8AF@{d)?G*@--aB*J79J& z{bgRpouS37Z|)w%S2R3pEh6fBrwZqOFoZjPug9b-{Ez#{b7wA3$DFQGKmWIS?R#nk zyF{V-F7EmkQ-jIt>GV_8t?@*&zE!N`?PS z9oilHDu~}a$`2e?-urH`b#3?*{*6OK>W!q|wLtWL;(bPgc>1e+ph5r6Cluqo8 z%9#I)FK3;TE0=4O_IHmoP~U@Ei9&((%PGIgEC>?!yfoq@9r>X1)1cu z16PkSKt!5|w>EYVruQL zUuqSQs-9-2`bAvI8LCY9=d2mOkwr%;Uee3|;hC^zVrr@Sc4FC5;k>@LEHNVI-01};!OYN&M&7lgJ5jZgd!KCk>qTei$d50`t%AE^ZB zBkHAQ6_^uj5xx_`2?ecJYZN58zo+#Q@n57=h8CvPb_}ffU&g?gZf*=XH-vvCC{ezz z%G5ax{0wHXxWem6>V*GR>i!ln)(fwV?cjwFdK|QXG@3cCQrgNMDp}&J5G}i(n%0Bi z@}`slNupQl;Z8@`0?h+1V9itlBrch|T)^^50%8hS>H-$!0_M1Y zY4YrUxKdo|0>u1gr6^XqXYMs{ft!MR{k(k4-x+U zeI-(8l%deE?RpO|FY3+8b;v-$a9R($A0q#LT{Cp~4)C8r<$zIQy8p7}%#q1$x=-G} zxR;e>U2#;W9*zYHvkt|3m&GU186>=EWcA9vs4o^U(Q^UD(*MdZhn{cinoHLJUMyG- zzPn3#%Dv=#ax<7Y->ckbcg>w62-pAejTQ92Zz<>d&(TR7yZZ)*$BK@kZ+#9mPk6U( z?J2x)B@m|uouP-O`Ea@3VA-Pre*N__4#k|qelyGGQX&)Oe^@2f$81;_<=f0_%&}Yq z?r&C*KRIYOk3{+PO6iV`)da`Jsz@%rQj-&bCD1I|Jo_Txcuu*?2F0En!YNDa;ZLzu z9U#sZ2l4{K%|5%Oy|e*^+n*r)5^N_5)5@9d|Ln6U0G8;;MLPTd@6gx0Jh)lHp6ajF zCMU~vt$DOea^rIV^riW)z?9+&PlKSKtN*)sK5k=5hshd+R8hL)e_vZn=G%tb?YsUV z`;H+3{^2;!q_RD<32HWDus3d1Rf(@pC{l1#`h+)a!C(HF?r9ELpkwl1WI?{D{h?NWy-z#+6`?`tCRIuQh18omVKZc$9#M*~LvQ*vFV%0WB;xnf zC~S0kQ&*q1CZVIODU#McD?npT+<&Yx5Bild_t__1NoEY1^6}|1wm52fKAs2i8%S-{ zJvS}Zi$x!OL!R1 zT9B+Y<=mF=aeT_2mwc;Wim=VXEU5C9eg;-dVeA`Wis|qbP_Fq1 z9Xjt9u0fN-_<}c>$KoO}U2B_KXcaq{Q+z~c+HHfT57#*K$HVsH`+S&gb2RXzYr|=P?@i781RR?+&%iQQKi&-* zL4Wt**X&>Znx+S7F_1~Dnwz_Z6|K5m^;pv4!(HaxOd7&4tsAc}fg`{T=oq zxW6Hf--hzvtbpUy?Sm$1ZR;%LYWUB9mal2w*y7W$A3qS3KmRJzTTk_K#RGIP_e%oo z0d$Rd^r3IsR)pfj{C+0jCc~lUG;jyy=@FLZh_J7pRap2N9u4K8wS!e1^wDb_Z~UeD z{}VFO`foK~QnrB}uG@laY7@`*)Fr$Ouxj8K@^K*ry=0b+P`7L8M&ep8d53Hvd2Hd4 zD1U}lT4sO8`+S?57x>IxtC+4d|`R51a z-~5Qm|6Wl31eI@tHqQr3;<)>5fcsC}E}UI<+a8^huSvJ?&GlesiFC4OZ34|!pYhK9 zU$?E)+jB8~%uCm>mx_Jiz8+U7_G%7qrP#deKB@3Ye}bqcUI(?9-)e4XBsGwtPG0nL zUMvhZQ@$Ct3&Km3ZwjM#&D4(o`!DgTE=`o*1ZC>rZz}vaVV3@`vnT_kgI?AaQ}}Ko z$bM}P>gD|YaPnWtyZ#d8Rk{3A2vh!D>{77WBvrYeDyN^L%%5DrTqarE9N(XG>3ALt z|NTd)A=Q5a57r-VN7BC`L1l84*Ytiq>z8hDw|?DldD&ZY_^5Tboq39n3|)oi(b|~f2we(n$Wgd>!(e# zDu64HM;>~g^<&F%-N9sGh(w9+MOKD8_p45@>XPintukjqG-HI{c6%C2M^B#(pY1LgCqmJ4w*4{l8)G`gPb9 zhNoGlS_%b3X|L?Kx9BR?p`TL45 zQPhow)Y-nK)B1P7sFU79K(Xg0RKor!Nt?XxrCq4dsVFmTS6~EhpooQ$bhdz;D=b z`WxiP{N%)QPlyq&Q;$`v{@=~@8#fEY+@PS;33tGnaNrqfd<4{|&kp925{iB6JvWz} z@jZvs67hOEuJc?{s~WX%aC6D%ppFi6$#K-tK9|HOdcI%uzwBXHbm>9Sou-lgLD6m+ z`Gh@-T;JGf1d<-vY4dmNg#wkSUlbElE5aCZEhX=yt(sOQ6=nRBZ4(f^Bw_)6Yc z3U=7I)P^Yh|8cbub^jwJe2afiwXpbp)-wu)oB5zv`QZW|knC-p2A2O}>mRQA5vNwD zu0;6}wi3K`ELCx46B`uPLwSQf^_MF?PW`#^pZK=&Ba1I;AHUUhHsDxJCPPW?$bwuv zW!e@OP`q9fJ2Cl}<)f7?nK%#|ux@N9f47NwjGNY8AKsRYnv14Fpt>291C>lLT6x4| zZ9dZ4Vc1zf@)5$9`T*_b=DHb5IZ_N@nj~zPS zPCtg02L>{{Ex!1a)MEk>4SptR-K>FMuBG0qM-NJjV`S;}m^rAaS*X@b+6X?^M${w3 zcP;MQ%1X!vP?9<7xsFGN81=c+OeN;AzgRY2^=}w9M_G{n#Mgxx^QU)h)VLRjvZCSP zepCtmr#9KR({#ScZua%|<9z>)1Bf?wyvfg_Q~(2n?R`5C$2cH1Nn0ZzI6tGhmB|cu zP&~KVhr-Ek%l!Bf^XS_al6wM3T>LygzSP`8yy+uIj&QY1kWVqYxp+q(n7jxJcEWIj zWQxr5=lO(hN1*Uu)Oyt(!_dty>L!1FiDsPf16;4{;h~|$+~)G2M*sEsEJAcYs|029 z;?k}XVnWu(LG7F zEzXQ1MG#xoH5O(BET-vPkn-L9tNcIS-UU9&;`-xGfQ5jp8<0p8kRY)J@e)*&h^YaB z-O!*=ZzyW1S8BCIO%Mb%VH03kRu`)l#kQ#RT3eA?ooHJ);&eYMSp#6mct^_PfkuOjFG&oW;HIn@4 z7k0X+Lu3v|tTN(ndB;^nZ&tD%9bX&Yv?KC#LSs68&UT3QS$My5a`PKcY4C8WrQPuo zldE6%*=8ewKa8VekESTb=Zv>K{gk+!+b!~;jnEI4a=2e9Ju#7Zkym`R+vEu-(UPEq z`I(PrQ@dLt0(yyyNZiNNW6P(K=rp%AK_jV}M^!fVT@TW~b_Nvf{wgq(DX8B=)v!9C zYPT_nXZxz)+y1&i{jr9njjtzyc+4M)Uq!q-ML>*?PC*FA9F+qILKf^sQIa3_V^S>ZI=$}5syL;#w_cS$G z{}dd!e~$Cey!rP48u*{;2LT0ch==6)=K@GPe2aqkZ1*%ofJU-74T+DR5ya=Z1tOB} zg5+plOQ##@iBr`-_jF0~Ke0bk`PZHous`V^2)temJ(y|iC!#(7gPWwse>No)P{Of@ z%Pv>pzpm5NtmHYnIE{PLFvk2#I$zG1KX%_S&q+QeajcSYw_R|#9jgpFzhtcF&{wQ! zXX_B<00I0kLs3Yf*AMq(`O`YkB14J8VyL)dMfIk_WSAhE|Xe+y<*h@R{CeY?6RG0WR*ybH#n|2yf$MrY!Vakl= z$Kb!RG+_sR7`^9xF7AGf_}2Y`(3a)aT^KitE~3zvqa&B?w`xbeE~+$AR!lxJwF%rpHVRa;IF0- z6EjlRY$^vr&lN&TtW9&qw<$l3OKVB|t=LPMvArEDPi3F?hRoQWjuj_V70-VdnyBm^ zS$4x9pbN4J+Bxjhz$YWduwLJHKum{T*1rkSi&Q| zkHfEvwFQs+b=gtV#Uq)Dy=9p{t){bU3nfUBg^I(&~>r(nWy*0Bif$a z%E}b$U)2W$IBt+Np6&63PWnr$G8sA>i=cb|1wU1u3=9g_U*o`(8}m&CGUm0-#Q)N< z*)oNy@7+^Z?+1(40-9{yog5_m{gG>1GgZ{-UhYO9P@}RWPoz!vYK#T= znK~(5zr2{9QN5>YHbe1L69!Fon$Ki`4pOYgim#b<#!97u^(|0GNA6mSAO826fjWq7 z_vUy4{clx9YfvDkUe2A>3KSD20nQ2!&Ki)$sIC@?MA_$wPotMsNT+evF3W7~TsrM`2uz;O=6vrhBWr({fR^J%GKkY=&uiE-VO+>7}&>B8@)i?jDiYT|`LR z)&X}WE_2QvNRo?tK;_+gU_xLCfoc7?hh#gzK9bUoGIu0{vH6;xxeB7P>-2!S3$&y# z4p0ikm6@<0X?A|M&FEz%rTAAzQB%Kf+ar92J&H^8h{>B6{Wp*_8hn2>MjRBFmlXqea}R&ngnjeJPYpDC z6P_X(LvAOlmNFt;u3n!c|C)=H^sTYpfHbMafYd#C7MIbQIY}m@d4UOOSIO)l3A>{< zc|G%CGbSBiJ}llDGw%W!kvq;o_0()=irHVUVHb#d_-)py{Qdw;x%=p1iSWz!GfEP@ z(5&DR@$ga44#a@v7nhSchwwGKo9px>-3|$%A&xJMChpusQ|d={q9%gN2#G61-ts6T z8eg!D6aP)&x3mK#5x!s{5AJB1YpMH5gLJ$KKxj;0spuA#S`^K0 z1$X3Qn%^VLD_%~oC8G`IyD^U=`7h4T$K#JpHlm4|{3s?(>j zoKSgM>(L<*=^eGzb5~JhnIAvuTKZSc*HF(&S~;0TguR6Si`^YE%IXc%xo_>d_TZqA?4(;w5E&GGf{Pd2Zp>~YwzH&D(Yzti}i7w*Fo{gj;> zEbCZISBnuH^5O<=3FzZXRzcm}@EaT1{sxo@Qi{%J*Dum!3X@=+u%SIez;Q{TYUiq@ zZF;66wc0xtP2N6%M~X#v1=D42?PjR{cNh+%^>y?c$0uDjr%xIed#(iW^@G7-KdWeW zv~$u_65VsBm!gBV$|qQ#=JBQBw4n~Z=lU$Cp6+~ZTt_>?d{q_S^EhO{I)dlxhmG=l z{X!c!ZVdW|U?@o}@CyQ4rXG|W*%YtV7hXY=)d4%-GCMo*-}(1;Z+xLLu~N1*ho%m| z|CP89u{X(-^ntRQs9W7{{+0I53UOr%2k0_0rQ~St{_3cXRt*PXssErZ^~XJQ7- zAsX*SZV?Fa7=)15=t~`eRf{l8vbQ_3eBgfiF+iThs_*CN z{aHmlBDGH#O|i|bEPg)Bi}6zyKeNO%S6+s>3rgD1kbCjRHvZpvRE$+^DjHE(*~8tg zg781q9Gtii8vE%I1#^Upz4kiVh5w_L1W3=KHM)CsmMGg@nG@lahX$8py4T0!C9L?Bdw{u;{o{}mJ~i}EN_P`W zHLdPIcJ-V$2#{E$5g>NNK1VrxpPIqiGHuD z=3_jtx;MKlJ_?e2FR*y)_qY7nn^9<~U1G}ym?=Mnm17$^B!!yw z7^tUJIm7F{!Kj<-$~Hw;lS{B#JA;DUGMI6+DfFn`ulZ>Z^8>z+uZTBI#|z=)y@RDI z(cheEYm1F9kLi#F#F_bg=ejoI!4E@f`-vv8W(FU%)9-Ja0YST6Y$7yh{`PAiDDco6 zX7z8!_k=}lQPg!n6R?sq3)zzqGPdugvh7Adz>c(+u1cXsEXmOKU!z9bV6vGlVO|7x zIU^9k=rBM;lTF42O2kD|jXzGHaGMd)MLthdfEAFV_r<=e0-9@_QG_*}QU%Eg%*oWHm zdK9cQ{70flaYRy&oc{K}3p|$LjykMb^u{eH&ZqCdEk(uOYr1$h_N8;?OhW5!e8*j| zSmYO4{seU1iE9|S0AY2-8M0jnk3+U&xVTqI(<^Upt1(k_9#uHd6(I5TOB%(v5DIs{eNFw8&PMCl{;2J{;Vb6@I4LIs{SWM&^=tDF0sO1k5PQqC zXyW9$n$C&m1W2qYv+@&(Q}kb*$7MI{N%sRE%6>883XC&@iho(XQL71H|JW28_IF}? zrBjGOt{e*u7mB}3`~Xf(;5c_Z>Ve)&+XN6Gz<*yA2~V!waO+@ZXeZ!Sm!?djDW>}= z|0+li_3s0zf1`-dANL*WP2)3C`#VEXIF_)kso}viMr*akKh-oim6{f_re#!o*m#2x z{Ckg?e(|a(<)09TF_!RFbPM+gi!a8|LaU`}@Mk%mB8MAeoC_`czdp71X_X0$+q5u# zIAys<{|0|dhH76Yz}CF(@d3BXVe64fQAjAvKltEV=DFXbq;v~{?Bb? z@c;DmuML5DLmi4=&ZjgbO<2~pt%yW-@GDYDw-J}Tuqoc}RbHgvNd0}>i8 zyF+8eSt$*Dv>$enq#DC+1@m+JP>%x~)NR&QsYmQTX8o?J_^bJ%kCT^6({<}F6$#ee zL6Gf_g3=o?N}E30!_A{O+gzl5OPP&BmS>dEp?6uHr1D6B?wjR;eX<|{YdXY=e_-WT zWMl0vbVDr#8@?t|=otFOniZBY?n2%I|S6{JYsjLF^Q~|1Fq(+NdsYG0&$ofCFr$c42Pm@?6 zAsQ=w>~`S_JLSFlb~k@7z=uGuHaSb_6nSob0ptId6x~Z`&#fwc?&tJp@)Pi-q8l{)}4ZZN1t@Rx?Z z^eE#$8NeL=^~2E7Iu@{+H;9E65@a;?)USve1H))|LS{1Rq)BN#-t`z33{doq0Reat&HRI%};^XyF zIau=W-qT`Kc~xWBx~jt|Aj4gB za+@4(JyUMY@W;`Ahz89AH#GLGD!y%z$j5(%U5B9%O&rsW3|1{RWJV4G$lD7KqWl%m zDCgVW!*01!qnnkNtcOtLB6WwRG|Yxotu#0)x)#axbH1m=$aqll%qI3uQoSanvw}(KhS^z(SvFpym>A92 zsCDD^PNfPsU-8_feT3_nO!h6RRWtvcdRAIC;HUz9d(zyaGUjB~uAbV39szZO5}`7J zm^p^ru>#rHIRm8ARm{H$fRsCN3a3+k(fXTQA`lNv~q?_qG=Oz$FfkF^)ykyb`=a%({7y4g$l&1fdyd@!2n} zB?kw9R9-ETFBHjNV#C-y9vEPTwHRQ!HEoQWHAbYqARzVavk(7oRVYE)G_RMi=0_EV z?drP6K!gqvRTbC%Oc+3Lgzw^wnbct8*G<2GU!V4(XDB6Z(-@R0vBXalK5K)*DR|v1 z!zjFWn#nm>*~iD&?6{O(oOpbj`7zv4sB&w{+VCZ{9(>x#C%~GXy{>A2x(eI9M_taq zT5kh%*fnWMAXxL787|hDJb{qq4L0O$X1M2G*0#2o&McV+v&B<58Xb7&?dI?4X5C zzkXY@71^gNOE}+jRhxWbyAjD(okvW$yAK%uUE)=GObgm=m=~XE&PAv6P)TXXx5Yf< zSmY+tm^AP1SLMT*nkRF%(K=3h21%s8+@);|m{wZqNtds2l5351kJ}oS#5eki74Ds= zF!MjMRp~berMD@trD%Ke{P7Y%3~Hi-F}SxfD`N}Og=jiy8O4$LOaJsElXbdyYMZ(# zk@E%B!v3a_lzxoV)LZZv&96);dsg3SKy1ZaN$yH6vC35!UzLi~+{e?Xe&=koyJOc# z1rE)D^O^n@sd-A76XET|8k2;>S))1jQBPP^@p^vI=hlUu*9*gEHBYyeMGhc z_Z42`&f=cxEb2{O)D*v0FYG_Vk8*p$E2b4e$%h$K-%if|m=75KCSOLT)m-#$daBe) z7ppyfKV7Wh`u2FN@1Iud_k~r(k!oS5rWVK;$6R-#;ixqW#!~T}(_uA{n!ELt$ciRS z7-`T#EmF9X;SGbSTk0iX{+kiww$Y7X_(F0<|eo~Bcy~X=cXJNAf=%*L&+1W zZ~t#-O`1Mik)~dyF${eJTK5A#821|X$Njg8iuJXyqm6IFf6xQj9ViIs7u(T~jqd*Y z-Skk7`_-|Sn3(_nclS5E+tNPvhXch&h)h3!?ejbUgu32~MA&p&FjDG?b(gLEs)_l@ z3F|`j48Kg-AJ+1sKP%!vK7fBX$tdtizTDX>7!!QV(Z`zSEWdXmUa62Jgg^(^^UkoX zc!X{-ULTrBh?Ps;?<(cTj8ch{tW@KGH2d;tt28$C=SFG@qBIzjD&J~c=oUbC4c(i2 zwsrr0O@@~KZCRRT|6HxjAA|XIr1oi2R;^&oKFuF$AUxf_oGJD=^x0tDr{Dz!JWl~ib9 z;(mN2;i>`tv?@3b@jAZEII+=>a6MXM&HG`gV!hX``h)MvsHQjLMd^83-QfV+>dM2f zO4V$S)b^uv|6|_RAv168Op$9*tIEK&bMAKwBpFWL4MVlVptCx ztkjRM_B9q(E%*Ic`-lpREtfQ*!{_j2b1jV@T`&3$!2+zHVK7myp&r7b$XqLO)!h_% zK1JF@s%G_a6#|!AiwBBmWHej=Snh$Y@<8vXe6Q$@NbNHuPp{8$pH1zr_(t?a?vm)My@#)=;-2&Q zz&}x!m6Vgw*d3!yE|{# z;NA3}rJnc-w7s$pEI$qeU|CxN6FEsf5<^!_W9j0RqR%Ujr}Ul#31deZynO}lvjLAO zFeH}w{h_Q>g5?E^ftcsh3wdgdKdihV`r|h0`&?Wr8;r0#_xZwrjc-^$kyivoW{cT` z+`k5h0@N{9>my1sVxL;Kvg0b~I`vPmhX?t7Zd?5((FxnR&3$ZFNg`BA81a9xHC$j@0(xTQY7K{^cY-Gb*~dLn;}YqF+CW$iK-a zDcn~K9!G1`cxu>B3^Gl(tz2eb@HbM%x2Ere%B(!b@9XkX^2O^#lIFart(0U|$PA;G zyX<~rICZ)hO^fz!=OcD5qZem3IzM1>uVts1%In0rlyZPp0AZCcQ6)fx!xFW%V4tIl zd94mv<+?8xS#b-rN7~jiW>cI>VrIDaVT+3=h+`=j{uRUp`=@6tw)okri8paQCWy}q znp%Tu%TZ1=`i|zXMiX0MQk&bu(EqZ7^@j>-c<2UC0ofQ-B-IcJMjFhe-O<0r zOGSrWG{+B>Wa!sAvy~&r276Gyr7haF7mib_e8f++sVjIyXNJiX#* z8LBxzf+)KC9Jzm!eQDJpp8l|NlGIc~*(NWql;C6i!_0GTXi;FBv;+6j!Q{H&+m zd$`;omLfPuJ`SCBJBj>G<`u9j?&sa8inLN*KkG5Y@waZ4^nLpLM9vT`2J6xI4IB>e zcJ7K`oeD#eF|4OWmQ817R~3JHy?{F-R{SvHIkVyve8;~R z*mYgC0x}!3(=lCq2ut#}(Kkia*&q)F+H-6GUsdt480ZT2cXe|`=*J##Y>amCRDt`b zKw$`x78~RLb(5E`A~|wcG|oCje&4plXBw%E6X{)U;1R)CF`cX7p9dJ><;h>=FK5=_ zU8r9JcQiVw{&Y31wq5G%beP7wJ8`wzKi@u>3<=rua*kp-8+qE!-LDw=MQSWgvbV|XO5$yasm4h}~k z?<2KeqRFaIh3WzbrHmDKnWAnVtN^PGb%pzWZehN9{$XEhg2MDs88Ku9c~o+q0Ao*r zvLtTE{^72ipLMTmzF(>O>vJwXu~TFYb4aO}PsRZ_Qloubrf3xN?WR2?o7Dq~s?^PW zCo_qz;R^-}xEplRW5HtOkLO%RFe1BBK98O&>^a}ltud3X$7_L!q2)J-$Cl8TT~n`43=Q9i%i~>ByO?6zcwAy=Cjt`1 z4^sJv`0l!<{&jypqBN78m>p`lgGjZEh@7=shp+Bjr(vm0&^xcE(et_4LR8jX-2i>v zGe?4gQv~s;(fG;v&1-<}kQ3Vuhy#{l6Cp5KF+lw<`8CA+B`(!mLsnxUS;0aM&_!yp znYsJ5hsHx(oN1&|OjB<)e27YAy)%M2KNK==j!62)){XsncNf9wmse4m%TAJl8W)pM z^u2^Yb-UPQ{15r7c~~|#n`|-D#5e<>#K@)EC+W}wVJ0y&_d470dvIdtMfO$_`PsSv zdHw507tOvTHD(Z5-T-HA&jTnXYGy*r zEg2f5a(-py_|)zTG#&Nll7R3e(FA#}p7?{g+OwZ3|Ct$lX86x9ukx|7jgWY6@HxSM z{?k5fH&}Q_@a|6m99bj&;wIuHZeIA`d|)VnbRc(f##Y!&mHBxeBl&+JQC$kPFx|q2 z`5I-h;^Ab>z{#_*zPoJ9RjoAbP3!9LukML{*`$f>&GegxN>b})DL%7#DdumKZ9Cg- z7y1W$1s*o5RB4~qmG-7m*KoBO>fywH*ZN3p2J{0(i3h5)-PPK|0zUO&;Gd$BHZ#zb zPke#v1qH<1bMw#8t+*`LWduqmyp@I}i!bm{o!ayYK8fZhy9FhEiU4#+KTb)p;xkBs zKPCp`q2e6sV%I51_X6omf1hZz27L>F*0(_6`}Pm{zEhvcS8tX>KI%p{8-7N46~kCR zze1xVpsV!IO0QxqrIr@dJ;v9ZZVjJvV~^vyhk*YBRdGj(qX?s~c3|+d!T}>WOq*5? zbQ0JR(=Uf-D{mTW;7dcV#u6lkj+|^af9}zfjgHT8Htmd@uCbRf`E&ERCAS{tzaCRTBQO+x=jOoy;f^CA~`qSc>D3 za?$;3WK|~MG@cRvzDkX^Rm2DFwHx&EcW{(Z(LWmdgO!(2*^BYF$Xp?NM$m97b1oy; zS~7Y3uX@A}IwS0};(!M@lOPgHcM0j-ZicY>M4_U>nqg3(d;bS~fd+wY0xB0OkVW(i z*0)bQAW40n5?e^>JiZ{QU;Yd91T@%iCm*tuaMWitHF9yV*Grne1>s}FR23gLZD62? zZ@^*G66_wbQBjbhg|QNQvX`&LXOsJ(sWlMU4S^XKw(wUcaAdLr|jqlKaMy{$D0d-A14$BTmhzr~AH z(7M|N<`k;&%G1`EdX!z)gtS~S=g$B#R#Ps~fSLd@;=#GO>uLdM2L~URCh_x4kMz_QgcHkw>D>S|e%V=~|V1 z;4*7s7RnGzeh@yC2|y$35BhUnm;uA{mfPX{WmWz=(PT&?&M6161 zwRAZ~C<}DkD}E#hl|Z;qF8cDCzP>LN{J-qWUg_<(=w~grOa#c-r;VsoX)cZZuQVF> zO%|DN5t-k&7(@yAno2o^pkU|cp1q1fw6E-7fY#)yt1^+LR)81~8_E6KBc$UyyH(n!u|Cz}g;%m_3NIRQ=#H^Gd@h*Ogc2o?C zEZY%HJoEWNKDn)vb*GhzXL?y*QqxqiS@wlp4O@2TBqlE#crpGu;~?zMQ@Ny}9piJe z{dqG`1oq236rFFG*bn=a5Ibzsc+hex1HD>=Pb@IV?iFNOSz=n0SYcrPrSgNKt(7y- z87rqI!XI7&f7wtGPK3X8soo+#t78_t0riD-@bDOfr=3r%7=;G@%+XMm48jb{T=A#l zp?9pggt!S=o`k!nN%+qcEV0lECUfKgY^{Pk{m!wL&xU!PcpNuKTt30 z?F1dwW(L`not@?J_fahIbJHo3tb>1zW%B@6*-U27bJ@xhuK44$EBZ}cJT`N4*{baY z&n(`2YsXK<4tWU$nfqmvB=kWH!4()UiK`XO6Je6fQ&n1&NE zS`4xefg|Eu6}~gRrHpfYvpW)`b$~+B9i()L?hAmXBd(`jES-C8eqU=nZu}3^HiJ?o z1No(l)`C(_b{|_BUq3p&hZg0Pg6I5F5M5A8VaKvs9~zBWZ9vl+#g0n$I>?|((ZUh& zy7(poji>^ZTEq>>k($3_(wvtwXR5bOzG#GylQltx29{dNi`GPDmm7o6X}n-y#+XE> zHDyIFL~5=yHGNOV%Ht3@hmm}AeC>!j7qSe8`V3zxL$cSbM9~;q#!lY?#|+i@?@xd@>R(+B&nFKiGRFlA_yI=g^q)1r$3_CP|B;6@qVTH?cdV<<%uiu zClE+)$UWFATGAL7SkQAi(>B9U(C({J)^Zu)LCCx3w{AHm(o*V}H3U?vu_bCO4sYZG zCBC*a-cTNYm-)x`8uGH25oE!EOW#tDZ@fCT3~)mlmzA_!d>JJ}XhPW}yO-(aasCpi}%p z=md)uFLOMrE4~kOK&K=F+*jhAXT8mc8=kVZ{zbL)i{mnNwTHmHF|Z@^fBkengUNBd z-a7C``}clZtAbE;mP>W+2pY9~^(~Bse!TnjnYUZ`8~Q;h+w_FSA>5zDdA#HpoL#?k z>%?e$V_ie2Jke=WwCI({?8WMoWcND~T_X=|zEO7PlSZ)cNJ~a1=Bl}46Dg6&=)^*O zjV^kr@-HKbHdJQe=zyk*)5UgX(%@e-W*K*4f2-+3KSb=hUoHF!Mh*OnW?KJM(6c~p z38G5y!TnOP2?7P_oF^z^BN6HH$iM2yj_A+I+p_&pt)q!7+RA@>p}Q#*AV#t~TfNCD zqmt-cxoif74X=Uu_Bfu>AGb#V&lHkO~oRlq$v7nt19@!asWR~`k+BmhhH0HwG!w@Nk+Ogx{&&zZ3TZ zl97(8>?6$H$%mKU>?WzZwY%%lAO9{P_r$Ue*c6N+t^N)H?fnP;K|cukjy;1dtH`GX z2EFFp^R-kcsjp?^nFqO%)Z@nnt^MNtv@Z2sHZKv-OZPkUr_0=F1f*OAU^L#jKLL6A znT=o#V3-z-aY-pGmbp9GtBMC}iZsr7$`5-#bCbmSDJb*}{5VIHtSUAH1WX>IwpmX_E{it7y z6n!3U+o824G(oZQv2)$PjE0AJCvUzHSAr0??x&t;houm+B^ukO<4i_akxzxi%FG`` z^dhN^7ewPvFD3{#0P&%ZDKOseaUPjDzvkDfEu`8KlK9b-Pq2-TRg6>$>U(mJ46w#J zS56OJIrMBD0cV_LKz~@5sufiz!%0Aaa*?m@!OsHDM%R z=kF{<>rYJ>r*$5D2>uxd_KOK?yiZpHfq-Z<{zYRl8k?CPWernN8U<76#|hv#&(L%2 zwV>zGJ3V^F2|diETF}Gdd~5VPLhAj{6IWoo-#i|fIrI5#(<_?mhX@Y%&pn2puTC`l znN$&a|0c3{&$Zzb!Ou<7Ny0-4a4=Dm5KjM*@ z^9jH0^x-5`v-fVcW=vgbV_72yjAglXUyJ4?4;v;ni}L*kFCl*XPC|7I#xEPL_TArn zqSQ+858qr-g`CK!=;u1WrQv3b+IBgy{q3Z86hyM%=tM;?!(YSuWO3)e9YkVS+C&jG z9oEg-ge*&2x)BJml~M+BE4Vx@$9w48U|NIZ>pfB%`%bmfN zvx`kIaCQaULFQFtM($mLNRW_fO};r@$fNk{oduZ zDfB+SR%@AR{V?Dlxeakdk%bRY_{-^V`3pLf{m)xy;i*eRE~eE;w~H-TA9?zZ)Sf|p z?a}D%#;F%$cA|of)sh%TlFS_@ZzbHhKA(VW1!Vbv+TRe+TLEAEMj~X$R~<4M=C|4B zVe+wGKzmZ(;@eySFdCw$EGr;s(-qujdjq;Q1)*_GntrQW=y#k5#7{!SkE@CwpVT6M zdb(r3WO`#vRYFK&A}xVX(3i-@D=vn4c~`}em;}%duT+LWo{&cTSkgqCEGqfEy`mrc zcd|Q@GqEyDkNEodPB$vcgF0yyumzq+@35_TOa#@bXA9%Q5>K;BtNGRi`;g1Lr}GpV z+`8~|7GT+}3tk$vf8|18ZCFliLv{&~*V|C$9loMa)d%bg@bo3BV%k8nXz6O(wyr%) ziF;+3x7Iejf&UlAik-Hn&5hWDtm#WFdt#+hN{qF| zsyP4q0|O;Mmi|X~gH!OHr@kt*`dZ2I9|k)HqZb=;Rhmh z&tEe^RzTwjIixAfYZ8ZXX@K7q>q+(NOFWh~pa~uBs=sI^)i-sPm)a+2AWp(L-|`ed zRexfa6Et;*)QT~CChcYLhKfQw%JzhUVI6+|+MS&`WHjbL3>KtDnf#wYuodm;)EfKA zLuxGNjYQvDD!!-pR(SodSDB!X11vNJMxqvCy#Zq7u#||^cI=5gO(H-1DLgOd(kp{) zSF&Xggyj}xM#M0|ZwdO>k713M8Jin(1#GT%o-uXEW5T{H^)6x$#8Rgy&a>3(cx?*( zgkLLj*X5MCfZfSe#Yc|O1SZRM{B;MT|5dwYwAw?p6t;Y`wvM(xV6f5q=hgpY4v`6^s$T_ix*OP*F@iZ)NqwYN$b$dES?ykfB(NlAJ{&QV7+mtrQY{5nno8TfzS2Gb}H{_xJ z=+Jg6F4)xm5cHFM+jCI5J$7ZA_y?|?WGoHfpP*(>hRjk1%=`X+5?Fv_SJm=o)ExHS zBuYv=eJpw%{K!ap0r8P#;|A?oL*h?JC9F;Mqh8La-4OV0Rq@RiiU-;0_(twOaC<** z#j8uidVAOr_#v3b(f{4VO#EAFr*7iT1CM53m1^-`q-WnJg2Eb_<}Zxq#9S{4H*o*Z zhPZv`w7V{|mL%LVyT||F{FBSqihWFu*b~uCC>8h_9Y0nr3A|YhbF;1`MKaXmBZ!nC z&HbV`2`IBRa>AJVFD?GWB=H)pZs$};`$?Z`@2!NgNrnA64};%i=$ZQnu(gM71ZcxQ zXV_YgJ`mK*3JP4v7xPQ$Ojh_^6mD2@-Sn0WEu2V{*npcJL>0I@JOjB;W7cy3@E^n$ zy6cH`pI*mL7fQGBA3ZPxF%Fhf%?ZsA^b87$y1A7Wb!amLUnl^~6u7X5;HxwQ&~Fe| z=yo#d-L1-v^9k3pmQD+|+YSVxGj$jX!QXu_g(Z3}{DYBJ(>+*B8XJ7f2*P=K4{~_ND zof2Rr*xXN@OgGb_R^CVO!dm)DDC5{B1ss4e*B>pl8q15VjTg6xvqN z-@yRm);LGDJLW4Pgi`?R8AASd?j>0E!}FFK_Zbk!>?(oL__8zp&@i#7eZy$b7US=^ z0qj}sI1&70mdGh5t@^v&e-ALxxOqPe`1XI$!XG{T7)L^>%4?-y6?h6@u?hR+B2UpJ zn4O}7<;E3Du9SWPZePyKG@3je&+*UsSDeTv<4st@qSbqv&dA8P;b><0;fAwWMZ=9@ zQM7)x(&?`;te97Wm>$Th?He_}t7!KBk@MGy-V7Hje!eu&ub~3DgXF+_CX<^6>LmFgAX9AqxJC zJbqT~pb&sjk@{N~TcQUcDqVj{G>JkL#6y4UVw|zZG8X$#5B_4syGjJ)_-JgEP4{jc z3DX+d0pvv!781E&_2<#ZG4)qPBR_uS^T>sDd>y+33>W|WERXwBslf759tdJ@9zPw0 zDp@RanO-!pOmgXY)u>s~ttgsP3;m}$nBa5jX9xg#F@}augW(|k@tgc(1tTk410uL9v?yA1 zL$ui1=6cqoXzbQ;*lHPkS~3Bm<1VEQvdg%WJVX~fLx8Q*A1R2^ z{zWDUv?=1t)3hg~iX3+6P1QD;Kc=$!Gqd0MvZ-mry4lYXo9T6irK0D=)L!wWy%6(0 z>`sMohG(U1!S&|eLSWg`Ke+N|@?YEH9z;&j7LzJ++GIt8X__C@qJj85?-Jv*>Z)jB z5N6&Xl3mJ-cO>>mR*@zepEfO8lzmg@XwkT=8%Hsi5AUQ zTbm^&lHiA6bD-6)!-_;PDV1%2w(&{ZI=2S|Ei$BfG`j~8-yV+)6h?|;E2t<-m`Cgse!#jlt>520 z_V(GifqU!;tRt8^7oD(cXM4`P(CsKYph)*@tvxKD@>!pJBRZtt==`+-RK}sxCi4)$ z@MSI9i%OHPebQVYs!Mwk7iGIz^}daA_a*f-Zre|=wwBNP=O4WXYV-M5eq;WKImZfM zV1x(;Jlc8vElW>`ri7PL=7x=vz<)BdN_?iDI^ahDC`|uiE^1Vi29{ zHv8x~eEYIJfD^vcx_vW(XwKJqv2wJcTiQ1#n^Z_rH#Y^$l*dX4!^uPI+-&B7+6E?;7W5kww=*;LQiNpmftj@S0eNT z$?bgY1H5ST>wN9KYR3!L2gq48p08788ghp1W9-hPX9O9e1*1vBmUd?W8cqN6nezdh zeFQwCH7^MCYp~GVKZ%jq=4TTe^Aerpk$s>MUFZ(G#E5U`Mu_i73UZH$&S@Ac{EWXV zM4y-XkOJ3TpPvMuc~@b7xZHA&Dh&pOyC%pToPXc$<9jGxo#n;^@r8c;uk!I%H|IZw zc=yr8R_Z^dk&BZe*mv({K)BD|XE1baJ=njw{Sd5rJrQkx#M6FX*9CH@LmjHkuEY=d#_L9Z!+89gsnW$&-NeCoMl2WA-V2l zeLfm|a({zcMF1`BI5LgDV}jgxuNC}@eEjASY5a8y;sgB6@bO1C=l`oH^kEOv@1~~l z*XyUk-*4Y-7k|Ce{8MOikF!_Eb3(yCgDj12wjOf(ynFm@Z5e+chB7{)s||iL?fq61 zyz~Suw5%EpXRPE8Ks5e3K%A1ET+0}4wSDNMpcu*OJh8}21zLfpr{1!_p`sMD*ce-_O)`Sg zH>7Q!eOPco+J(#+%%#!K-#dIYh2B+I`k>_9Yv!Jt&(WJ?=t6?s zKT$TD>9dFXXpraM&lO-8*SYa0M@uZU6AE35Ap+k_(wsT$VDT|wHj@@far?1JhhNGT3EfU zZ3~TQDpi*IkXqEiS&ctWSJm#*>OUu_KhN}+#2Bd_SwotJ>_R`72t2LqPHYXgG0XPC zKz@vqSUvVwSt>&=j3+~SFb^GP4d5aFe$j5V&4Hdi7I$i0m)m~v$fl=IL`l!{(}<>$9YH<@SH;9dtC+2k9R-d0FyQ8yJ6ow6UZJR=KL;A-eq z)s%3K)6Ct62K=+c9n1QR@KzFyP0IrQNX_REOR!QE+tWExyV;0GDH2iowC>$#avU4s zdz{Aqo3r(k2W_GC&aF~cCd1RUP$9S7(GoGt_=qUT6Ca!;`d`%1%hJiLMJ-eY_#o-# z;#&#|1WVhD;;<RwSrXEq-cU|4hstPnOvZa z>aZhjnmmz3pds7o-`|=2{itS!e@&@p_{t1W@l@zIix&shrZntWE~sth;2Qq zJU&N3RmB%>WnxefNu@@Zxr&=_W)iOBG12Aeb1`KdtL&i6iuBo-vLPUwb4zQ>zIZP> zWK&suq2lMxk!}02mg~Qxi3_r#gL}(H6cu14oVd|)#n@!89%JJvy_WGBP2TBOIKFIN z;mGN7DpvOLNL|me`l?nd9OcRI-%cT>EK=8_s<>?Uz(8!SZamDr{F=JkF3L$`)@s&% zj%k?Oa_mUO^wPO^ECI|Bb|Z6R=Mlk}v(3P80*(e$fdJ@dY*9+stsImZu`-(+<;i|! z618KwK5A_8qRg@Jg-Tf#TcgG(X_?O(jsMKZExvn|hCpe2gUhZK?VpPrYO-|`KMs;h z9wS!@!p8TY06=(8!?B}Ll-z+=czbc7D}2X`@j}jP*jhF4anfgM_Ys=o+kK}}hyUlo z+yi2e33ZWW_iCwR?n3=Wmc`{8YVKV90{FZ1mk^A1_$=VYRdm|8ctB6l<0NlFuip<_ zG0Xkr*$miZ=&|O23kXOVUlm`td;e#F>qxuC!N(|TJ=kdnIyaJl4<+-lW z1idshs}V;gL*Q}G}E!0y=;Zl&{{1%r@V8p%G9`iJnmK{&depX?iQ^(N=mx0i%7Tvs;C zD!uhz92tZr!@NfI_zTBW5bhL4umqPb*RCEy^$94)eZ*3+A_a;A|E(qxnJQDncbRf>x+YSu@|OXvNpC{+43UuH3JMvM$6tHE9Zj63X7*y ze3KO$jTL3cGbY>UsW*t%{$g#MV@vxaCPaK8W;p{ex$!}z%x;@9TPbtXDRW7g*TAk2 zzw7v%Vzl#Jm#IrtCi!)}ndv?yw&@>^GcH(V4S$=&!A55#CqZ~HLA;L33=dKyuPC`} z-LQEUU>2y5LJAp{E~Me~eF`B#_zi-{IV>~$8gDlFS;dRS@2ab~j;Ia}1^HEpBbrfu zbak43j3c_rR|6t47TB<^nUXyHJO+U@>zF8Bg^h<;CFfI#yO0`0fQ9LP=5%W9E({kiHn(0`vg(z-!CS*;$At+0N-Wex`+ zKS3nh%!*y=mXs;fR>GRXuk*{4tMVCAZEh#kA1&4ML8{xCADrwvQXAmfB_Q)fpvKS_ z3=mGHZK)WgtCzTwHj(q*kO2&lwiKjPnkSSwl5CtG zqwxK+UABKV%^dcf07)NR?-h1C^M~SYa?btgPid}j+JTJ+Xz@0G7!vd?l;^FKS&2{= zS|<9Lh+Gy`!lp7?&4PXfbm{%+Q%?!hpRsWCAFK*bv9Aer<_qymCo6p3@fZeVZJvdZtX$t2Tb4 zeR=9Z%J0~9)x^AZo-(*}1Figh;;;FJ_%YuQf6O<;cl(C;zkkw6T)7Og6eubUNgbBTV&l_&j$s3TS~J!jppM-l(0XX__VKZRu|i6hVwKa4#W zRsFYKUCur@(x1yMDU(@xQBLFm+Wi`&M23DRD0Es4yHKMmHU?9M^C1+p_d( z4C&mYO31;4$PX`Ss+84D?jGWFEWH_N%?frjw!0)U#~d7>B&7sIa>{BB`bEF^OB7`_ zTKDxC(E&T6$@!h6bxA4|q8+0XkGxT{E$(7fp3F7KmB<}QB_T}x;m`L+i*g?5dsN0v zhw-wQm#OILIiJY>p^MQrrI@!D<=io7K*o()dOhAER?A7~CMj)JCFQ9gEAZzuKY~uw{vRXY9RJ@5~eoV86pInz(dIG;tQ1-KHT;-i{&pIK$3Q z`L1vH$k2+H{yllO99*90{!$8@RQ^rhH+?@nNXm;|l1h!QBQ;ZJ&);WGvmRTA`z<>M zq&P283`(`7NHY4=l1&!q2PqV-aZy&U9?fVN4{M9oug>G$ZDfrXIVJv!Xvp@;2-8{&z9eqv;{XK#CPFIb1U-&RH#4qTs}|$->_%)`ytgl*Mo4y6tngZhHo@4GmkDtSVW3 z$rN91$+SEb8t0b3kPdFS>aB9sDKQwE&XMfSh{l4(Lj9rua)M^)rre{%5+XHoEaUaV z8hg6#=4Z-e=ZIlS8{b^_W&gUr_DOc?QMWr3UsLyPXiy!-Y+TTUes&1r^ztpXV6gQA zt_q%d3Zc^#n(UO?(G`6sbdJ7=L3<3H5yX74b;kf5!_U_JeW$Tj?1t(m`zrv(r_k9* zFzu~3{byBWy1Ud{?$fnF_aNl6!B4}C*3vjFwOXFOe|pjjLH|r>?A#Q(rx2lUPAH1Z zBSpn19XYU*rpq=!SnC(kp{U50k`9%i^~5MVhA{MXJ+PlvF2!r|8N74490R9%gi(G5 zd5^TbZ8C>_W<5A$L1a!xUYkN8h1XZv5m@UCW?R7`js|ozxlo>|xwS7@trvIY8JQW0 z@b7ZWEl}+`gO)7O&=jc7b@`c`6x+8^81z!IDg)W)eshIK-{kg5GFChony@o}71%rn z(j-rdsZH#XaFMr_n;1Lr_gy2%Xxx))eU*~vFB)@IBGF;1#82I6R;4V0^&mZ{G7h(tMujL=bD)=nR6X$Q`#fmjaUWwSRisAoEnr1kDzD3nhvV~o9#xL9KGBi z&vo02NS6#U4}@mBnn(SlHrw6&GQcN8TOUSge&u_F;!WaU z7>fod{nMulw8;4wMMo|$otmkQtKrmU)>)8(N+oOc zRT7q~0Zo@6u18FMhc!j%2?}eyZwIjE4R@_g+7JwV(FXPld z;eU3AW8Y;>F4}n85z)&(PwRg>BePyI|HnhulcvE`smnK-{y_5~y?fV&A)A+653SvS z++3k8QG6$-TZfb&P;adFgjVH?@%d2s~pgJD^1b5 znc=aQuP-lp<;LQM4^hIwLT4h%F5f0QW6A?N^K^i{35UKx4f2jf5$JWqm&JFQ_q6aU z2dR-mU*!=ij)GUa8e`~Fe7nN|x-33i3I@G$zfvZKzG#o)-}2ZOkn=qtKPMsp#0;Kn zB^wSPpRL><5XCnGa;3_R550;9=U;lH0XdUzx8U{GfSjb1iJ_(9tcl{|co-mMm#@dW z)Q!U$Ot9g%gopr;DvyzC1jv;wfCw2DWyoO0-_YA&_$v?mcc){?*t0cDWeSzE}}2 z6SA~N?GZH|J#Uhlr|B;ml6P(9wlas*fD{nX#P`tn=b2^%kV+_VGYR_hi4@YB@tyU5 zTApjKFU2oBD0b(Rfl@!Rka{y33+hL9qVeELH(|v+m?MU{aSvi@UPHt_nd@gMf&S1c zJ7s~c$n3XROQJvj-bF-^iH>gtqbVqv%jzP`Zth1?e?C$^70zMuCSh=;`f`bqWv&%6 z=G#Zh=DilDN8Az?I6cCfTq;KB^Dh-W?j^FW}vchr_(i z1?bZZ=uU6CYBVQMcW%>ajhdoOx1c_R^A!sRD|+*$SEb)K{57N#XrbT3nam?r{GRZW(iKEG-yy&)WqxXWRzjipWF<}HTw;&nGkNR_!y3987={uNz%T_E zZa)PW;=kV?hAGW3bX1A)oK8Gq#g_;M1L4CEAe^ud2%8B4g!g;uQT!4Q1Hm}##v4y; zIL(8wl868VY2pV7gw8D>XofjivvmB}$HPe#7SFkzN38fS2L-i(T!dmIu_36yI;gonjFEQ7C*w|S`B{~9Y-{+7iqr>$;sR@zYGc~PvmUvG%#cA z<=e&u5pC2|7E`>#ebg3)xAqNW*Jv(bkIRMlddU$K&9ADKd{vJg6Dp*u)c> zc8&JeP>wG8r1CGLi{7q`jII4!Ww%sWd?ed6HZ@j{OcxfM zRXVN!=nXhG7xHrvFl{yd+wc+dUqWsm}r%5ze(nQ%l zz1$Ot?H(@X!dmT*r>i419A9l}3ilwwF18aLDd#?b`1%^~w#EH^jC6MyKboKG{e1n5 z*H5{AzN4R!{187}@2BWzh<=XM&(ZtWtTJMVt{42PoMTX7aJbpxIAVa zZ{L|i`_l7A_c$L_#Y+!`cmn?cl8+}X@$&IPKY#7CRKk(zV2fn@KVN_rOJBU2GR%E`uT4~&PtC8vNNON7F50iwmVlt%U~;EA#>E&v`!gX=nWhEnrd5fqDf7z4@&f<^#8}Z^p?yo2Mc&v|%4>!Zdk8IArF^Er}&pDO>asDy< zT<>f8wcKhPN=ZKd_DLPISaStr;(h{x8c5oTV0`-)l04m0RmFeCjM~b-!-c=`l>H-X zlULA9H#Ym}_NPSX+Ay&+?P)BWOdA6H`HfkDiB`esLEH>T~yj zx}}Fa{3n9B0RCZKE4FnC@Na5=Cei8``b-;|66f%ueI|-8+E_U{HUnQgXV^(Vx~d@z z7wZHU^Tus|5v;hc{?u~?Z4_qUWK(xyl<#yG|CaUW{l}(zJa>ri(L#57p+&uQ2vOS3 zbrt8&6r@7k^*(ZKIx^_LAU@lT_mnXHXfk7v2>N$b5YPEk5kWab;I8%%oOCrQ4A1ec_bj_oXca#>W0@ppD9-h$lv*V=fR z>U({JwecTUq$%zSR);ORkD{0P=vB?pqlu0-t;YWw^ETFs`qtHS#7)Pvp;TMJSq0gu zE&JPuS$C7q-nfX;!C8iTWVao0o51>x9LNr%3;Hsma~a;fT-Sj%$ogDIYO`1`WZ*z@ zxzWp43rozISv&|nhVkAjcrW0+FYm64=cHE+p#-yupRb`uY@z#x zr3n?G*q*MH$Vx~(+9dYN89M)~8K@}?RT34#Vzzr=fT7}*9|5=Fxe!sL%-QZt&w!pj zk|?n%mlH(gy1_)bN9ZC~M}F($-MzrVPo?)KL%Xy%XDsT-i@<_v%5u*>8mJl#;kIJH zxBn-dn%h6cihP(N1O9m$2n=md6)6^1HA3d`2&E`o)I zOp*i`m)S8uj!wE>_M8C|>z%1eY z*y9lHVCyu%ozyTu>vw-kfTSMq7q z@m`T-AMpCyTGe7Y&mgAErScZ%_tz(Lj-ra$-K^pxDO~x{^kHY`9y9=;ncEuP^r!0+`hcCT z%XOXw?|5CC;a6u(0ytE(Wau8*2ZjJi`_a#;?xn-1$i3XQhk$+ex5bLt8s3S0&@|WY z_KLG6flv?=$Z&W6VZUA!UdY^$suMZWcO$s4WX>Y7sf^S0l3Y-A&qA$U-+CRCuEiA= ziMI5xCB3H)p>sJIH+&7Oj#`7wYO5=X#q5?d4*dNw6L)JA67M!Yn7-WpJA~;@p}sBm zXO#kgot*>&lVio#n&`|^AK-FkLB_`Wh6BdTUhY^BDbk;e*;F@jD4q%@By#5MK2o<) z$&b+0yt?<728+Nh7lH#q+d@uecHiQ2?DEgl?{cZ$REJQ>uib*loU$XMG35}<6!9nX zaxVGDk#fO#rBO@?A8s)6Cg^W{bKnmo7b+{yVO9h(o|smCH$fiC9lQUA2@{2`{(*qA zeD*md77Y&|N#y((C4u7rMQkdF{%}jl$cTYEE}Hq4mYt!-HzMzSQtCwHm#f_( zSh=;SVH**88`tm(Z*I*)#-C^K-i9Z){`CB5G8#j`pC_p^J(J3&Puy@wUVMl>L)Z~$ z$FSzTP14VzMWOLDB69mMjp{_s>3l>Jy|i7a;-JJuopkT#-D?{|Hg~AmUb)g}Me6N1 z&eA7tV0+R#71{BNnCo4vvrrcy5gO0bLFQ=nTBAO5r&ILK%;UuaqwKD6>qDx_?lje5 zmZHrfh!TY$S14GxniBc>+PN3!pPi%iklRn^4C=GVl=53Q|eYsgAYuZfNwYHR17^OER+rk6AF&{d-Q z%hD`7Phk_=$p zPWItv95g*L92;8_YHAf~!@?mwn|FNIu6%Nl-xWK5w6mJC{5=spW@L1K(|UE8;Va{m z8StCYkdB?W<-1x&jU&zDehqa>UvZmX9pqz;bwW+R6#qCiW!{d(q$@>se|Ge#lh!Hy zfn|1Puw}1!RRM%0wYKxZT|CS9gX3ASSyMxzI`&|Kznr9gUok?fqiwu-xPOy^Y*<-Hm)mn7BB>%s@JB)7r?-WMYc3CY6f3vRiaaX3C zRX!g{bAX*oY&;lK4@S&)u{(8}{>1|&%~{-OQyh*i*oOAok-L>WSo)zuyc$W>mZype zA&?>yPC+4l&J%tL>3vaqeNV;6A7(ecLp#T}CyYAu6gk)@*z$oLGkf5HQDFZEL!;gQ zY2{e)vA7>kHkba$*98y&$T23YZ33ex9SNs1ejovGQu+~*xuAkV-<5N~)2gGJy4_6t%c3!odK^>@Pjig&4ZCmVLAIaYKr?&=qhW&{8$pmDGt-UNJCx2c8V$(I-itF4<;0XKP9 zCm?S8e??Ir28v<3lGQ5C$3&>&k}_W{aW0;kSZ?tu2G!q?;FbikG<{@403YmAf9dK4 zPxFEO!m&2gUZk=V$)C}1>gq;awvd?^(aQcPanOQK-+MnRdZM5y{(mldjWe@ey8d7~ z@IEf)saukI{&oCz-49dzR{kZltzL%X-zr|~oL|0!?6#e3+W8bvEN(7t-dnbP32(NA5`AULCCVNwI z2dXNHPUN}Hf37oU=Og6tT+D=SWj8V}9p|L}WHae#n`FL1k_{OAD2@i0mo3^{tPV{@zjo;_3?v-{;{WAWJ;$w|4iwt@&n+We4tQp~pFZ8CZ+GdQ zmU?!re6pX8cWDjTN4xaov83aClwtb&=@VW0BQAYL9_jdgVE;VUb&c6g<>!)amJC*i zg}d#5>Y}$7$aq)IkiEg-HY^Y^1{>g&N2m>2k9&M|Mgq-BL9SqpE8UvZwR zcprmjp4HC=KuC21_MdJf3huXCHF%-jU|-R}P$!P|;?azAU24#qCDR?2Cy3z<}ytYR1D>urV$QiCp9-O@n?Wxx|lU^{{9?*-xzU$KR#z z9YVSre?Pt4r4MoG>-MGE{bUH3`kA0%8)z|*_yVh*I|-YN-r0j{74n+K)v)8D33tAqa$(#;YG!#u4dAibXQYrGm78O)CkPC8Zks4?obGg599Nn^Pf0jV_RA2Gi{!oO? zE#%}x1Sae&_EHpyOC{*ayjb=|dlfJXO>?y^q^F=@{S~if96vt&Fkohh&7y*wx&XJX zVrs;Gxc-h`nqGA&7Oa@Ea)Gg@UP&C`CC9f1%ZJ_g{wK#2z330 zS<6~|C3AfeF%Ki#NFBD9)NEyMm&AKaWyqomWVkK14!gcEI>}FLRQ78qZyNZLJk}iU zS_%mdYKifed^K0{-F$}ejE25@fJ99qu76g(p6yqt`Q9UZgZ^L{B;a7vgL;MurkSTz z9@?5_zAc)}q73^xL(D_2-q-$->RySOeBb8w@it}gE?bR5OlP zw!%ur^(ijcD3jqFo(KBhrw5lV&gYpcng$1#HWuiyruYam*g?^7c#6+{BC(u8@+cst z?;|C`ECV;&RCVTICns{W?PA6E4Sqof5F*!H6V#PT*SZPr9a^!4Ci1-H=VlA>9hsPmp0sKf>jpdf}H=4Wu178Qc{vb9NtA9LF{LhZnId{`}ryX8QiutI7?G-xB z`8XX6N1h_m?qI59C1Z^dufLNjKZ){pVtqQVzMrFKngp1&X~W0@t54dXgw9z97b6-*#@Lz7nR@ci~)!1d_~GM)vO7W@S$ z7hh5Q6>5H138O5)e9#@eP}HHJSN&k#W9b>snX4-(KxBq_aIE$tHYeC9j34YV#%_Hf zle3S12Tj3;(mrb_JjsGYeMbn6THer?-!IMp`h0sWl;6IOX&c`6$d^?%%D!Be_YgfF{qQ>LJY#HwI zMRRL;^(~C&@#rj!g%p#8u}FWRmZ7Bdv@qJp16~|sg}FZNbH&cTQ1=_$XA9oayCt^O zBY;rzZ#vB+z6Sd&(=AVv-1TbC};$&aa98Txg-8F0NmMvr}&KbZx8 z;+GSqm9O)6jfF+{5nLDW#jcM}1g|Jm$tv6HQ~7Mx@GZ&cl5MEopW_|;a4y6BGK%?H z@)CT_jK(uTF6Ln~iOeA+{$ z73Ds~o~ik1Awn$Y4|;s?JxkWCI5m+4On{2)l0Mny&fka9ralRf!u3(R9&nkb!yr*@C%&;;A7z5$M5o6R)mr<#n4}#@Ea@mD%G+O zpAsAOjd$6d*+?)J9i;n^MBVruIoQ$Ach9yFn-j@C5A8V^uj90T&LGOb0hg|K`a&%6 zD7g`F`}P4M7R&)`oP5T!{&nPj!Bc!fNAfrg1Sf5Yc4J2f7cl%~u%+j9tY>_&mQQA< z{CDJrmUh>lNC>J&sQ^#3AM0B!3aKi7FkSJ(HtQOjOHC;}6L&7R)(^x>KNNjRrIQbZ z6qs#faV@(HaW6L1hBgk!j_05-FTThr8P@lXKjNM8C69}Vc#A!yl@4K)oW-_LZyfJv zcn=ePi;gd+^xKw>V9OX~#gTHD9m9nActtOZfFNKLV~NEm{UD1t4_r5GPbOyaHz&Ha zZAVV&CN#gh+vxzSxBYK{)+xKKpWl{`Jt6}wTv_QC{(jGT zX59{J*4sJ;KE10SL49(MW5b0oHB4A-2}~71UQ;{xqx$oru$Bogc5gWc$h@{sD&d-9 z&xVdf)F1B+d&>(h|Kxlaa*@ko%|#;Dc+OuIBIZi~#XLPGi~GAD=jUVgoJsYksAYxUtXj{|amd&V9IRb4bro{+ZK9AoQ-`_t z=b-*(LdBRxdb*A$hi7wD)JJjq|8&Q$!*4o%a=>VQ7W*q$PXHH+)V}Or|1msc5w~l* z&rV8ZrfN+t*GL`upBulQgFt`$ir6K-P8F1C_zRO9Q_?efP$8E=f%Vuj@nUp;DdM9l zqiMes`WZnZ9~IVLy7w1nyQ<*Q4e_f8X!1jQ6n0U)fqiH(IvIP&vS6-qL=v5bl>w5hgkX_Y0aKc=l>{?jCk%DeZh;YteTqWc(vhu5^vvIx?$7bnmQWE8*CX& zHLP_Dn=|4g`_t9kIAQO4kdGVzf32irWz&A;oAECDzx?Iy#pqgWrb~o9HhtO8=0esV z7MB14rXU0~i&KFEzsABZmdM@siWf`#Q^W2o;zxE(uLBDzCDky`8r`MQG|`5gixcdc znwOcjl(|rM8y8vqpwj9G^%UuPJ8bScvfK1->cJCyMLqa6e=-Yx!!Nx@Y^PKw+t5jT zHY<-!-Ljg7KAv;mM8t@7a=Dw(gGBij6bRi;pRTbfJ~s?-LqvyI3S7>7SlyAuwLeaefFQ7U7neIdAS~!%1aq{ImG~i^`vp%2vlx<`4PME~ z!x4$tQZ1%CcRNO`$u5=+#Z)}gYc>Kx5Qo&$ups(M6t8fkE>VqcWFwfEmQOGAg;m=) zDd%I5ILYg)oAx$R<1DswR+G){AK?ndK4!A0xlc`e;F05kOV?fE#|Nm1=O51d=1Zaj zw{)!LbmENd)$x&eAt`{ns{Ns5kA=zpq;T|ADr|opE@|#V9bPp5Wjh6e`7S#xHBrp~ zDLvKB-(ox=d8qkpK~K(8uZFf?{UxkthtrLpoPkoDVCROIpp z5BH-!rl?E7;Lvz}AbuH3o6og;2A|LFQD*k}>QAbPEfVe4l(xkOX2wGuP5U&H%q&{; z13OosKl%dSf3TAqQwz#Us2nLHMnwK^KdYOZ(X3$lcI&B|6Y$DT%?VxU)W(-2$;}T- z5U#eL#Fqq^SU~aDgU#RJb7Wsuu(^pgW%w*2agD&mOZA~`#VjZS_?fL^ldmjcZoqfH z$9_~!3z^XK7TQ1gxEUepT{ZH0=eQb_sM9VRZ3FHQrM3=Q^&X#&Yeqzp-@A^MuJP1_r508}=G08|GZ%L#-drrYHdnLT)D^CG_3<%zpmu52 zemui9o1X$t>*FD6d8=}FZAa}35x}3(*Nn%WT*197y$r!+nH3>OTXI zrnZ066VwN~@?!f!VI{J+aOPapI(oozBYv%Zyi^aymRh z`3U%}!MH&1ZzQX^Nk8&mHf?@M35)hA2u1U~hhc-e^wYwR#jlym6Qf)<8j*I4P|^Pk z`{CUC`EaH_>^nUr;mqmtd=cJWbHIr+Nh?-{2nhLJ4(AbJ5t~z|^>^E+!%IJFdoQbP zUzRqxGxuQ&n$NZIUU^OF%C;R@ZTtDY*~?t-^_f_LnF#N?nOS)5pr6=NahvhvJjRPp z$|77WK})^pey?;xsA8KJ48NiE@Q+&Y&mPgr(q{LwZZ+Rkvbtv|kxYDvLhXR;<@u@Zy1?qMV&mWbn?Kfm|haR`$}?)+8(r7e^~se{d>3F`br%GO&9g6(k!q{ z`C@f>Et_ZOpb{i6lcwYDTnIDy-VL2e+COfyk)pGKwr(Z`SJnrMOad!)RJ59LN8SmX zajfHHg{755I5xSkJ&-M%$*jKC`y)Ayv!kY&Ee5QZolX5`tsr{*MsOS%l)(Sp)6CcO zqA+F;E#|3ROCpv(r2jP!B~J)J1p$SkFCxh7(A#t!SwAYeIfMyq;it&HT2xmr96O~p zdg{gy>RY+&4;))&7`AoNOs#afQ0A6P<3pjHNm;cO+vW|obv)|VQ5IU0tr^o+SPo&a z-jffYN|uK?EWGGeoAYJ`8z-=PsPv6c>6UPGZ%A?JcJv9gb(|j>_J%+xxi~)bjPdb& zr0Zo_oc9eb96`~GqgPZizlG%Bxp0X65UwNwB-UOpJ|Qc3yx2g*vN5>eb5V_WW5N48 zh0&d-X##B|UA}jC_|_dv2b|86w`;|#(EF=epH#ddWf%tuEgB~){BYYxsM{O8=m9VK z8S?ERCsO8U(KuPuVygv>6Lp%nD~W{Z`?PTEF-s)2XI^|pmdA;j1s4j!_-(u#3@#X{ z7hGOSad-9rj2VJ#Z66b?Zy&+>HhA&u(O%?W7AJ#|LI5LUbt*>LdI{+OjkWLQdLmZrd?D zv(4+bo*c|+(JiIxQ!;5iOwh7!9-{&wd6`H+TzlQircXR3Je;EV-y62t>-V<&Xpt{O zwSW5B;z02JRn6P$7qWl7>5ij?+Uc0+-Yc4!8$#`9q>#zVwp(qE@J;>w%nIMt&yD)I zo*xUpnWWb%^)o>~Vf|dBp9N1IwEhEnp2aguD9f@4$P*&_JL+*UxdsD_mMmJAem&1F zCF-{&kLM$S7~4MK5QuuOKUfaELT^zWa+(6W%+EB0X|4=O64W9Im>j77E1~G?U5ax_ zW;klp?>fJYSI4#dHHkU6m5kNWL^EbxR}=k2lB$j>Mr;p9-;;MIlTOuai=0IAhV@hWTKdp^97OxUeMU{BMYu~-^kc$gu2(6!HrS?bjVqQ_py4goM zv)v-E2>o_6Q2J{&c2mN@eLP=Gb{cF`kpd_AOz-*C)_<{`b|O0iT1an$3S>!M55ct$ z&Zg%mP#wl#eP&*f5KiwGJD$)LhoAa65 zr)*`_yNv0la~C7}D(Z-T;X@>K+m5HftrLM2B~K^FojT>MS;fMx!`ud=ffMEhf~YA$ z|FpC(($c;z%ya|kRhMqAhVQFUifX59#(3o9FRtOimM1Adw!Cpnf&}K)BR>;4p_|eE zdqj6ltgeW(+20KXm%l%3=CQTWw|M$u82TxFlC|LKfbNXNnwdl+J&;*{n#+Qvrbia8 zl?}Fx25j5kgy#@gtP^ce@?Z{ZBm!?9u}zYiJ;Yb(sW!$TFjW*uYuH^G)Q zNw)J3QWhn1+=$Jgw&ZX*AGev|)upSd+umnf4lpj;HGMYc+UmYpm+s#l4XBh>+cVpx z?R>KRK~fR^Gj`j=+S0$(M*qe1>`%>f#tUceudR50UjN#Pp?g4gf^p$Fk z-gR`GPmTehwvUI8%Y3W0-y7lRZIhWQXP;PGv2*qi%aNajqaW2qjfPXEwKv?Lnj6@@ zG~d!5Ca0#F5eQ{8ZoU}K*GrTX(oYRP>c5%$OGJM>=aKu!I7S)QE8~eaxrWyv%6+7M z2I(hEc4&8k2>5CQA*URO16vz?EyR2f>R1`ld?1>9S7bXOFLl-N%Mg-mm2G6LUO_tw zaU5NnX#WGobx=8-I_GG!XW<8=K|d%8HyeQ@f#0@_WUK(_OJ7+BOm64GG9`f?(w#=+Pa!^x;q^G7E^iK`!rz8 z>;8^xnWQy3uhRJ`49CbsPfKd!H)Vw@KAAPDCc0yM^onhHg2Ice>JzGXYsL^XXD)@W zTRz;mWH2wKdCa_ZH)wlZKO6P)vVK1Siy0OUcd%1#33i{)KV) zJ{bV&&>3f*!2|v)eP1f(6zq$&u~ShP-!{*)gHanjg_TS4sc>{hcoA}AZTnZ4$)GPY zNlh*JMQX3ePGaUO-|ad>wa;eO>^(KuFV23q9Rc9a5fjmA;yEpUO8IX*g5+FS)b+b~X%b4b^mQ*CKkSmOm*B=o-4!;9|VBlmm^;=YeOUGp)BYa8P^ ze}9EjK8tQ9j&VG9Ezf*+7p8#MZvb3I!|>HP2dOgC_VY)|UYKJiHyv?~jv7rS^6C!^ zgw1QOpvSOZ!ru%?Jf4$Kp;fdIEBF~T#YX*<--@lX``Qz3$szIEGozI;zD3`N>^L4j zpKnkAwR2;|!C9?daD77aPzjc(4J&9Xmb+1ZBKrb1csIu(*JFDioqJdC%|-n&N5PpQ z+&Y&dHtN49;p8itd~iXFKrDTgC`1FQ3GQ@D8 zA4u4sB$RM@M(N9;=$oNEZ-!XJgodpPXRZhJUR!Gs_vOgR<~r|>sjIfU5xcw>QrBz| z#&V5De_jrHOOlwkYo8AQj^>yXFAOft?_V2zIfNJsMPDJbb}0H%Xv<&6jriok#rgd; z|3u#lSFF2pYx^A<#)$Q!lZMu*%$lQb67}dCkiw)Wxa~RQ?!y0CWcdAe@f}*$rTPC~ z2gLs%IHREm;=f1yZx0#_dmf=<8RAZIn`dr-A#(30W1=GWUjEGbP?r!EEZ{Nn-tkby zM6!9Yf%g2T^Wr*A1s{@b34D2gkBgAG;YJ2a@k#`s)n8Nh>$yVhYblg%!5U@3l33a! z?^6rbUCZo*mn4_u;{m|3tp1FOo#ymdc0f!P&HQ`+97i9&?Zi)&=%Y@NALO&+WD7$z zR1{Ngv_CHlmy_$2Lfu+N$Lbi~>^t5zWtP);Z-z$}m*ay=+~soVwpd81El&~sb#>8n ziL+bt5c3?QJ@-ZhWvA4d#>o`XKks?{7U?Ovcp@LosIT}E!izTPmNrmXmD1IZzQG^= z_A^qW-pK|QztdA=ufCPgn=>7~z(st>yP?%!V2Ki8=ky=+Vg(AQ!wlZO{CO4&&>7^n zvSX9FEd|}Jy`l5R|JH82X-D&0FKBqtZw~A~0DnK& z3oe%GmOG>4^UP6=|4VYf)|XFxCfEV0J9)^~zx~_)7QW!Zm*|-fqx>IZT#X6GgN3#2 zOGwhE+>@Uf&Tb@v?E7}yICCMA5liiTVPJ-tiJz#@f;_R3g(Hx-R#@*+)a^-uj!luu zPk%2i z|FSwZ(&Mz}q8%9XG4rpb0OaS8Lybyz`Ux&<>g<2HS{QZO)58fSMtn5>YNNPcZ7fjB zjoZ2^K5ubb zGs+@=l&5*d{D8GNBtSDMx>3qVL)*nZ`K@7%F`~q@bd9FBP{>{Kdpp>iAqRqmYISQ9Luw!7BG`dFcVS_$c zbX_ZS{fz<4sCRgJ@eUsXP_zgX$$_j6Igl_X6U)vX1W(gnaN(aj@q?33P6V9bc8^+{ z)5xR#v3nlR{Vp%=1SbZ;LGl_&*sH%6QXHN5D&-Bfd|Pj8axU~MS*Ds~K^$Zah{5Kw zUG7q)CxR_Uy4NFkNDd9(p^_h|l8Vn8>b&JlVHp|POrUnYaGEUlPNjAxRBURH z-<;ed;yJf`h(eJ|5%bVsMkk*0we*L@?!)=%53}8e)6*ZO`bFAPYo)Kc4;|VWww2bn z507Yv+MYT&%YC>j{b9KKa9jGrAopQf>VuPC2aeF7k75J8JrCt0#TTi+jz5OeZ=XNP zSjr3)D)?Kdzv;D&9*XpZzj^*&In=oLn9_LimkYmm6=|s5`a|alp5ZG|uky2kE!gQ* zJU?5-&}=g7t(ATWnXcepn>Rby;`w>uW*0ePIq-M5ylpA_nq4;dWex^gw9_H*GWqxX zF0#u-Z_utl|3>_xAg@1=&f}oZf-TRu$0PXq3->sfN138jff}{Wk-Lg)S-ga&`(?>> zyBIWj14DAfBX4aiqsdIrHEf9F*2@IhBrWp z{%UssK!&QSFI3e~zoz?LLZK?K35ERPDx>mQbElb;F{mJIT)2=n%MDw0XpMFB?qQ$f z{l((pj`thRFvI8cPbo)~c=vu*7>=eK=px~$W_s9HVhZ*PtV5EPX>*FSdMkfk(@Xd7N-RSWuj*K5 zZ|9w}*IU-;|5L|pup$-#%}6c=YDOW5Ou3h^32qyV`2fW4wj*Hvs!@pLtp0@^_%-^I zO4{s_hV&Osnr&!urnr3jiu}?3w5*U7>*w9Vsd2Ra`Gu^1>yvg<#H!(53_W&!08Cyu zBbSPQ=-S+O8WsR9ctZb9RV$@jdL8ungdWOpe=i)ddlCA1&n(Hi*e4V+yAqCRxrWYm zQq8O$RMW|SUHm8hoSMX%cFJC%PRblCpR&jKi>A&E3=m#h@lHq&eA}2O*|VCLC$gMI$Qi&EHqX{ORyqPk zZx-k25RL-Hx9X*|&3aV5s?BY?slDEomM;wpo;tbi2|`B(ECZ)|QSB|mMgpVKe0W_i zFgV|j7?_u4wd1<7=C z!l`03yS`Mu(gR)x!sRXBO+YHS=MCFx^WrpkxCo%L>F+aMLRyiCXJQH>t<%n{yWoWe0S;%;fl{i>WO(3mVv6-zTw%11JA6810MAc zRWLmp$in`?uCD2?pB#RC{clq81|Qsoq02W(X3_Nti!n|&%@4Z zBFO_C$%||-XJA42)&bAG)9fsK??nB9JqsZk4+Eb0D!IiGh32OBu=k2sbecu^^bbgj zSRj9w9<<*GGjxLJ^pjta$A>TPdD2;h2qWthKXG0yVaqZysv`S3>Sv}CPi0ca;hz-~ ztB3b^pQOC9oeUEtR!Y1i(${>8hDpL$iIYGs3` zVEmE}b!{Eva>rG{=khNlz}zgN^b1BUY_83Y57+th(7cpJM&gI zYWJA!(#6^VNQ~IL5KGD8DoDuMpJLUMy;#UYH--keGit(Q))y=5KbCCR;d&fton}gG zKj=d8PvmT69^z}l4C3=LF^ubtum{UA3g(TvuHd#$>oNe+pC|I}^yiTUJ|DUJ=bF)q z2A=0}a)aeVa8Wj?Y1I_fT3VsJV5RBSEN(6qx9T1!dBqA^kC@Q${EMY5J!-+KJnb>0 z{OoK_Ib3AMPU|U-Vs2Z`(`0H3pzzo>aJIK?C=QGokrP`=QH2}IF-YT7Qf*^sCUa`B zbYxn0FXU6GVqGx)-;}{`BZORMQ$CZMTY}BscG9e=3~5D#5(_R3plFT%17DCYvbcH$3_2C8=GGiialqyla{Bq zE^)G6p5D3~@j1?bIv+4%Bi_})C#~CGC~C{3_NUheBZo0FB2-SjJXFEk7aUTadSUd` z%cs^vi!blQNNUhPLTz+?djmRVr1HQ|HLnl8BzAKkFfRIz`8C@yI75t!9vHu-CJ+Fx z8TQDrYF>0dHOuQy1Qd!quhBqj9fzZ3pnAoryd)2+UO^tH?b_lI<3@bI`lX*hxvn<; z?aW$So#NWUzYtKTr2U`%6pW0bOsMTcMB%AyQ~cToE%Q4t}Q;B8irnH@i!tI zbE%=|-zBliIUoPQ{JK!QzPQ8N^l3g3tN>3nBFH$WtU~s;OnF z!5=@k@L@i9@iEVM@jC(Te6M0dFw&%NZ670<$Mg+XteJIWFHT{joa@JX@())t1taHE zn63}JM*JM%W(MJ#u8E~Di46?YRFo31qJF|9!FDS*UQ3ZjEm63$v% z*{8Sj-y?gq<9olqTzA~9c?#aEm;2}4Rs>=1IZV?lK5Jaa7uTT~aF8EL)K;tvM((C! z37k3j8RB3CL~>txthiO!ta$6re$~y{#qBR*C$7fMIuslHuXyHe1L_M!57fqPF0Qgd zNs3BsY#!kjI_j_F{@X{zJZFbu-^dGTIt^Ou28E1Jdc}k>mnyq!Hb89E37ltoKQemxbd7MOr2e@;d zLe-7)#$?o=3_zd_XGHQj8M|v-@ag}a0}k*WTQg1vH+A|BAByOzbe<%KBs<^6jrglN z*m5@J9Yk<3#NRC7AeWojNnZG<#^(W+SkUC%R>pJevi_tL(IN~){2*=;d1~YL+9?wY zSw?#!pV@cRnJ*~kQQpksdl=F+t$@UzHvM7!($YHr#Kl(>pQ(wdPQtYu|8+ZKm^puQ zVNvT8;+PC;If~$4vy@mBj@Lm7ieV*ZjkRHx*p4tDkra5ACNgD~V8#*%!RN+Y?D!i> z4@Q2BHB{}+kyK+tlg-JWNj*2#)y8h8nm6tFM%(rU zxDwywS0XqphfyB)XX=o0XJOB=)ucgxZt@{O_w4*3_{T*mU&B_{1AfoJf54UfH}HGO z^COktvz4TPM_SxY9dDY4Qmua(@Kpfsg(9~X;Z2r{DMdQoV!DEFGv{w#6IrJsIbI>R zct?*ZQcDeC`(_LRjK2i}?A@y>!2dVY_rakxO?ubAQ2bu2{U%(H4{nx3%?jV1m%)vB zgm)P6f=sb?<526%xqHQ&_gfZNZ9`aFaLOPWEit?LFET+3ZrwJ7K^?_W^8 zx_V3od~&p{ZD4I|LZNx}>wage3p3i&XyEeikTd(A;BF z21sLmmkI#Miaj26_}E*sTD-?j8_9>Kph1*q$Q z551r!lyX<7ZD|WDd2Aa{!1OTFCxXvGgWDk1#n_y(;L?ee7~XKl+>@fva1;;mjqN&Z z#`TZKr#|Bx9=zxK^aR!w<0C`@o%0ilSM#etEhYV?NaZOHX&f)DMcCpH^EGB(-9~Fq zw9Uygx3B?)b}ONXfTO1LoP2o^lBXm!GO4ChP}hPIN?dO@Bm(WXWB!d)wmzt)MoT-O zscR5KuBkk;hAj}=%#?sSKUp$~nV_&|^&vJW1Hew^>n5h8RXf`%wm0A6{!iP)xwWzD zVc2WxQY{3`^|l41`%Sd)EwwP^OIjG`D;YP|rNnZ(X4TaE9;z5y$HqTj@PGJ$Iy4Ni zjbOdej~~2ZlKSGeIXH`r}SaMkRV!jHV9VNX4a!3gZDCeID+c4?EHlEpZwS}^M8XvmwPiwGwA$=5WYNltiWBy^R=*}Oporbz>ICYoh1jIm+ zGk)*&e)=TRb+oWV=K{;d$HId->cgtB5WnBILVaXjDSXFG zQLVO{SkVd05S@YfsYczM5l}>$v1KG;h|l^mxYLu@Cp#tLo%Sk$K4NqG`TtO73U(p5 zG&LA%(%9_v|7HlS*kg971?(@{j#PS~zWc&l=;t@Ez!5?p30?ZVQ(>w{SV*-z;2g|Lp38JH7s+)yv5sFccY6 zoH6@5ZXq`{K}^5Tbo==g+5+6xeIa7kmqU`GRgzQs60i>nX#0qz?%j5Yh%;x2`67$$ z^h4nPf-k^7bWlD%cE#WTb21iHEH&$N(lrnN1GIK-zjASmEuC@%%*bI(wI>)D9q4W4 zub=p`iK?Y^(-X?Is~qJ|#RN;K)#YS{Qi-&jvUPRmuoR^_{u%vAcXG83E$wkMFerAu zDDeLm#b$oDJH@(|2h*}S3{hk<`Qd&>NY3om&u9ACsh^Mavx6VW7d>y)&nEr6qMtST zS;>#q4|-mzpQrWnYkn9eYY-KGn@9NY<>ulVoLbAwRinGwUnR(xs#8XBR=nhCp9vmi z@bB@@+K*51?Z;T=#|F6j2fO-sYPh`!hu0D=tSK|UGvGU79WBS7OTgW=scQbi@(rEk z`}ZzC*Kfbb-sD=(5*dhPS}uqGF!=Y_aCc^0GU%4pwbIhdy%?f3_fioS>tI%X>_Vu5 zLN9Ku)ND^ZQ{J;8yXn)#jGYH$cE`l-Ewq0Vu65@NPW0geC&JCxfZY{y^!do2ts|}u zCX`ixnO9Soaev+Z!^fyZejO8aL27Mumv27|SJ*WN?r3BoS|@9Q7_k}Zht$N!A{Q0P z31dj6b)CdUAJN5!0(lyf+jM`;|NG)bI$pKdMesN42#u*MRU(9GF0e-*orqa>QFYbK zd3PS2qfOR5@5$L<(_0*>?d#pJ@_S3=u+7>)2#PT-v~w`9!)j#=Y5&%QGp4CjMc zmS`fbIl<*0L%%bxVs(s31+%*iCvmY^&t||O2Mm>=+AjVD7o=t@x>jK7YAsdCiEk#z z5KY-w3AB(ovxfS=uKH)4i=%kM2y$hGt-|4SX_Ne)S* z_9k`x9&I@LfEmqYWwuH7Cd;(ZHB7xOQM{Je4~rXtN~av*GxM|+`T%DxddbqfNHLyc z`mlj?1KQ=Ox@Z=Up|yw&1u} zARNy>bDYjy$VpuANZcaX%rJaz7rc>Ra)O!@sU>2sTG;RUR+v>MsdCS9hM611#?0 z_})~;oF-IVDKRhxp5sL~*!vO*%(H19>f(AYlQVt_?qNp^5mSYIW4j}%5|NY(g(oY> zWXzxJ079e5uRD4uGi3rLV#9lP{q<|iF?BY$0!~el+sZQ=-qYTDvLIUn^REHhZ$MSw@9gJF5o3^L!V)mab1N}T0fJ4Rqwd01KN zp;yc=-zD9i!;pznr=Q>APf_z>`2X8nn8p@b!wy&4>x{IuFWE8!YNN7_U5sguWpwl& zxBNq{}PI#yL4t>*IUD#)^$#YR;X z_J5mOeXBC}+3eQfONJ^k2gfn7X!iELTz!|8K4Rd;s3)G2UtcxE52fUVu5mU?DF!8 z3FR|~dleVw!D1B`2O5T=0GW@OFq0d2LO&jjG)*clJa8iv?*0uYapK3mggMvgUvvMG zk`2}uL2}#1t1L3rWxj;4>YSP{)O=jjjvqr>6?XDLH`Dw2SqYAs=)luCil*~qL^)Dm z^*_N~Ui6)C>_QlDl^D>AUzwNu3%`LR(OB)AFG(GlUy{*~&2}Ea<(NFs?=L!}I;2BS zPPDga>OiHM?_o}4V?&s0$K4!mKCZ=bb2ye|{_cqkMoWx%(Q{*0mPfCm%#|?lK75Yt z9?V5m=2e@EJs9P>iov-OCf=6LkZ1m`_JJPA{YWE7SzDhHSpU;n+ni@`*3et+F~x|27BSq*v9kegc1N zD|u@!a!mEyl`!j7Fzf!zS%-D3*RvPBv_y5YVkz;W<4YoyA4Y@|PC#DiF=TaSsjEbI zLF&%;lDU596X;538)HXmN9ajg>S%7VbVB@+D(G)6MG-j2ZmcXeL7e5Sxv)xq6Oqc> zY$<#%uPijDr+~e%P^ofjys{`#d1V?Lr2K_>=A`c61lC;W)NFhuw0*oU1(l@>F_NVe z#sO3}aE&xKZ*bd{RtYKh&p_IRSSe6puRoN%(>9gmagp+)X6cC%E!{l0dsXaIbf3+>y}h>0qeO_yK-Xt;x4+L#5NYmms&jc()Uxr`sV)2W1Qv)M7{MOrQs2BW(a5e9S->XuI;P+IU z_$Bx~J(Uss_OTfcf!}^MQyRb9x&0=s=8X68`{AAbaD(6FsSG{v`@x^Uuk5sD8!B=_ zGMui7TmvWn=lIq6gLj>CTb~pWH|>0oYGpKA#@|Tg`(poK^IN!{3xc-+o9;X71gy@ zUT&5U5RL=gPjyNqrEc`!g{yGhDPLYJx<{i;-D!n}p=2vy~$tGdCj$|Y|nw2s;R6MhEuu1T#4 zD4{oD60W9A2_GnDzx8WV7ITj(`=u&-QF*(AWygrh8f|44xXNOw%FO0pxe`h?RruKJ|*TQ%r9Lvm#3;R<$e`;<~OQh9Y{1EC{q_o2tH?BwMXyRuw1XX!t%{mn6n2>#7@`2t3;a2t{iM!#V@^Mj;ndgviYz_Z;~cSv-QdWK zAN&5Jf+KcB0&5jUe%|dBE;~ShF&g2S0OU;+EA(JjS|6X*Z!8_+!H5kjQP{qvNp2# zL@;vo!l*x}Ks0|f#);!1d$VRAtwawrEA9dpcf~75(;&;)>l-VV%>?R(!I8bg8V)C6 zI0@EDo(!oF%~u8mT>cw`20d)1*1%!JQ=()!Gxj@)|Omut|D_8vv_ z6iz$as<=C7k{8QgEvTSgt<6;9FYvb9C)xjq=CB`iZaKq?1 zwFf%@K^@wOt_375mFyv8MOUH)#YfHIrTy1hlEia=J+C-pO?H#hVUB$}059DZrnE!H zCCa%#Iqf(wr2hDE1G}PzFd8#Usbwm)faj*z5ddl!f&3BM%?MXdKIs>do>br*wuKH& z7pbqJ|5+7&D}h+<&N&3WSpHt_jNr0dNR#t#L+!mt{)J8Uqv?ykIhAwrjQBmrV`qIn zRb8*Yj=wfgRf@kFmp#o}M#J&&SQ)Ickr(hCY}O&{=B&o$x~n~-{*D9}s_@XX!(Q*c zKda$J$C+>fmIst+pFLxDJxVs%azux@CxLTmYyD{WDZ(O6+(F(R9Jy5-e2mYG&!{km zQqs&Qkqua0nceijP=0U1Zl6?fVtvtKT^mo&WeXBlI(>cOab1IhLn~Djon|hfAW11r@_J z{cEdeO)rssLmI+Lova~eecZH9pX&!i_8n{(;9fYtm`v@kX0T1cQcv4pF)OPR2@{nx zw3SjmvhS#de0d`G99%hm_yFKOsaTLuki0e4W z9vxV0e$umuU$5(q8y4MlV70&B-EXJGxh<*rwFW&wgIH&-QB=!#&g8Wu*>D=AQXxKY z1wMY8uR{dk<(L?Cp<$1IDXxtbZ2hjnGSr^}>m}R;VfDFF6OsMG+x|wXV2?PNW4VUm z(lt)pp@}TI?3Ut;MVSCErXlbVkwE4hi3#;5pbS~N3f^z{SYMNU`Fb~BXM=z?dlVVC zNB?9v=Wj3Pu;tS@yBE=p39yr%0@a7FELL!~gYPt^p^NH}pdhBmx_)Rkkw~;Z9*)So zwz%kdC>f^OV5+GUu*&{d5$V@IEfud`j4Se`_BmQT&(Ty@YpA)N6$=j5Fi{P1Uo$#&wowv zAM{qH*#Cv17Y{puQfT@;V3T(0&~GW@Www!I?sEmEYtytyU$fRp zpt$*eEc-itPbPUJkhI6Q8B(G~e^ho@u(=Na zYJS*zRKo~j*-mF3Xeb${p-`}Ff#TyIU(a5!NY6WhEwK2&5aO)-EY#Y8>(NoE6RN=} z1lCRf)d|So{q@J9u=SaFRO1WJk*v7Z6@SzMx8CIk%VXTslAghSF+*dCyNM>j=2j{k zvqDt|$8AA|6h!vzZ^&*@pj(vX;DUD%m@VtzzcHF7_tziB=Zu+03FxWpPcU;ye|eT% zsz^Aki_HSO-SvH$9}ezsI7L~btJ^-!;ns{k!N}>fg)-g5#1M*)d@6Q!@TaS1a>!SB zSJueh;~R*lNIi+j{6JH8>`z)R^*Si6+5xi1TSdQoiF$7RHJaM1Xr1P-~)l6`P~hI7klVY zGDvG(CrCYW`71z_TPldw%`f+*@4e1YK`r?GqkJ*s1&P@AyXnQ6cJnzNpU3~~rzo#P z_lV8hyLVbF_l>ElvEdRNBaYp`i8<5%6PU9FcUOnM75BirTX{`F;!SGLnD-s9RbK3Q z3xMyo$r-tIBX*loAl1wU0as<1?fCV9`!W$lFe2T^&ia#S*4LmFjg8Ah8gde7(}QBU z<4A(D*53(dol>xcKe18$_*VKkca3B>Z%^v<>&a$E%!--&?nIyj1lFxffb>)#^)Ej3 z`KP*v@RP_p8C7*qB9{Bs^~D*>8kann(H;XZKCI&dH!_s+X6Y@Von4WgyxIK0k3RG+ z%~>|{rf3Si*E%56$vP&sJjmx>Ii2_u#P=U3vsM)M$}QRA#r)!Lb_GYh@J9{Zux*HB zrgmyi4FRV%B?m}{;$F-~Dw3p=6dYP}*FD83#t9u043fc$z{A{$A}Xps)^C1+nrA8W zD1R(9nf_j?aquM4H|6K|K#_w7!7!36LXY`J&n)2TN8cj+R!#B9inVvVmRN=a&oGC> zxyi?&>QgCPPT|FD5Se8?3sdUUoH_V;$8smC5~gll{JrUUwH3UyExM_tb=C>orB0&a zgUu5q9J`J`+-*DsO8A1P`afJr$Pp27BH3gLPDkaVT}C5i2(gBJ_Gk051SM)n${Zqo zDrzSjhE`#2{y70A_UE53TZw5Rd5}Iz^j6CcFdG4o`-js2Ep|nl)jy`eU2S<{>N-;s zl?Y{JrgrPh>-RyM)1g=sBO!T~DOP$s=d;^V^XG5L;V*%rt>z^zLU!~!T7|A8cVp#C z*A*kRk4_C+Q)SO#qr5<5x54O-q>EOGi|x07H${dcSl{1~u#`cbBGxPqEVkgBd@JC9 z3*xr|j^Hmc4}Z@lndzydetr@TB31bR0x2D7kRre_&kXYk!If09%E5mChBQm4-tU|O zD(6J@_H8(~6Eq;MvUo$W7~mkese$?|O+D<_S7`Ep#9U0e`DhV8!|uYqW=1Q&-|@y} zh45HL{W!6zgrMTn1sd=wStdD^Q9siBnv#I~^M6u3*ku2c>dkI_O=EAdGAE%JSBY>o znPUWve2whS2KxPh2Bbm3yWbRfrk1Od0?mEkb6F~MUdoF_QV6DN+)Co@`9k4^A_wwj zPc>lXmTRGDFZbuR#2Zvm>2O^<~(_NPnC=L`9M8iZgxKXEdA%F1{vU*3$R$-(Asm0lwp z@8Ajh-y-uo+l}V$<3Kj`_hc|LH}}x|^;5Tr?sHY1=*)bN0cGwfimp$ekHLP10r5?t zBcAi*jUY6h&C$h0dC`HzZvMdT*=@mZemS=1mml={($e#bNEsX0X%%)NFN$L4XzEq- zr9Dfbzl`qr&6M{1l48hR_*ZuWmGQ}AeAcv9YhZ6J?Oc|om3b$Bf{?9`sY0v1?xld` zAH>a!!*us*@;K>x1;1t$i)C-UOrTc#8+C3eVsYTBGDOxFh^ESMx10|AUF>*v>p0)Om&rB^H_>${~;+ze&RPFmCS`L?v>q^NxW14mYc|GCF^=I zWJ_oLNQ$1-_jT1T)82}#tY%5N`hlwc<7U5l=<|S^NU9~Ct-QR^&&%~lH5A=0iLsjk zW{|5j>tuRbk)kg%m(z+p7~A}!Ul)u^TP$qH9MoyFOjB>#{%qw`k(FqTm1kTF4b0XBH2dgtRS|p?jD#T*ytCt@rrs&ek(W_wd4+WiE?qWPhTSMnYL$k}CkNeEX z)z*PC@D!om$?cd7r&)^!514S4yQ%1y#^u)d+Ayebxt+DRVp%JFO0f#cBxiJFF~rtI z;F?Q&GLXfOE7Yy<03d8QlMR@_%mH2U=<87N2a@oFk&X?_HEedJ3-@kwd(UGjUFu5} z>xuL(?ox^qkuyn}W;V%?vL1HO(|u#wLoIbw7{@y3=-!)`N7n>H)5bbsk|IIuoU&jm1Ed zGPGA=92`5X^S!Z=y7+{01ZXz)9nk^^bCG_8WsAH_RFJ{P!4}G8>U9u2N%OEV&7eKD6y=li00)-iv!8 z6Ue4rWE0@7&Q7wai(Pwn5yx_Zzx^W0Q!>^`&R=L zTT0z1ylbx;msy-Pj9~kUNv#eoaAIA;Hv#iLS*Bn9PLs(OI+)Hjb0d9AR$5YHxwE@2 zk7EJ$+A1s^dAG`2bvhC%yIA}q_T~QPo&v)G+zqPEmlS+}gi#lyp}J71bvUD9ltmq# zW2hj#{4T8&|A(!(@s~x$Zz(Ubck;}0qit;1qD~EBhC-cMkg)MK*qANh17?VG5dJ@1 zKVxY6P*Tv!IwqLZU)c)_RwKq@BNwQK;7?zjQCQ8nxhGzYuBwT)a_H$ycPj4nWI<;& zDd|Z~ETNZD9^=bUDvjstnB}sz}c1Hif6iF@!S^jjM(gFkp9AsbYEL2 z`4nRHbdpW<9yUXA5LOL7_y9VA1iIC~OY>weR@iF0yVLMnUkfl#F!92@f%cV_pR9Z; zO5u(&r|hy0?ti~n4(?T~|9(SB?$<N|Hq`>5! z9l=J~$UHf7@Q-MF{`qR`TERtjdBDwxcW)$3vZ+j`iIR9=2YA3EnM&4by${7oSYQ>* zsJ~L7J*x0BwmbJ`CXw@~lf=e$;*}4xHAgL5Syag)?p zCTT}oKeb5x@A25*#{UlpRd&d~n=QlSVX0I>WOR31#t#lD`s^4u{7ZxJ$FNLZ{6jh3 z09AbBGN?Z|j#EP0aKIpfloh9H8@$;=&-Tcn-O$2SJAD}4i2NDy2zaGL ziH|}LzswX0E%#z6HB0zh zt4{hWXB#Zod^sO14Q{1do4ls|d+%gAT=ad>7s2G=!ddJ#-X5^$zuxegI`*Qw&mI|$ zU(`3m;l6M@chy}*85gnY&J0EN)&wJ?sgSRKjp^%i+0~xz%ihcS`Rn2MqC3%1Db_dC zw09pZ1S6R)_X|t9)$tB#)bY#ibua_Qmv^8#6FFiQcdTtB{&UmE8Sg4A!CveQsG>g> z*o*&)s9<;Py*L&bR#&^4a{*Sp@b=#r4 z$R}<4jakIaf_vJbAp}!E8A#nFnvXcnXC)5bY@fs z4O`7?L)1qrJV?_{_cUdQzC)h<;!n%J(rumeKhi(HPLkzj&O^<%*GC`pnhx3#KQkP^ z1ZHlBnG1F=w2U~ge<-q#5tQ|XuSL)S%sgL|1G`+iNS_?x!EyIkUiMcpeL;>DkHl(9#gy^lj^jxq>1qG6oC5wrA2R&1Mpvg6`X zZnu7NbtpcNX$w_)t$FS!M*vooa-zthRIKkt+#I!@F>5}JxAP{)HOII8n!ZfueiB=UoQf%7ItmWl?awH9jYsD|Gf9%*EIj?N~RS52AATP zwm;jg)`@V;$cB1y-9lN-6*)=${&yGZ{~(*Lg(6#rE0E6VKRdTb|@WhmNb3XQ0D+Tt^eFn}*44x)-~s1YZ*o zC7Zo?7F=2qd~WvSj@476vnN~pk#*jlevd+Tj`t!-~xZ7qUYO~A|O0MaUm{}$&Rk8^t&)%?G|wV#s#uvlXITEpFOO-roGnMYZq9I!0sRc5;yVytvee*v^T3ME2|D+Y}*1tBA{D$_5!u3 ziJI%;dPE-0exQhdGZ{bjbDB-%Zj>u*i28ZZKlohU1v4Ohp9k)v;VdaY%X4dYqha9( z%WLge*iEY@Fc0|f^s8NIxITdBH)IIzLSHt zPz&kO?gkvUr_-Kfw?=Q9Gpoz|+e$iqu3a*NIjS2>ZceeR6q6$>I2{He!csv6=`SYH z@cc!?BlEXh22P}MP76|;uOMmg;RbkX14gMs{84L-d#4k)_itk5rp@G-_w|W6Gvkx~ zJyygnF4n4ZdJX4CR$!Rlmot~mo8jBP__jec-}YJawE&9qU3Wn-V-d9baAe;j+sZkV z#%)ud8iuVrykF~0UFR~E%I=7VSf6!m0*(6?H9TE07wm%*cZK9*X$LILP|qa*{soa` zf=>qikrkV;L;#fEX&m55sR6~Hr|cN15woS%rAXW_ByvAkzTe+Vdx};(>TW}B9f0hh zS$$D{kU*Z-qg`4qf$e%5!0LG4BnF;U*CvTmV3z}^Ggceqr2X5aAVcA-H8{!=n$~*% z(1%4!{GgHhhpyBQ52J4!-V*|D0SEC-tMvdF*ju0T^9Oe_^Dias{)$aq2;@PrJp@Gn zD5@=^2saooNbb+pdXAYs4Txl;=W6Sayg$!|X4-Y~_B)rR~sz@OKMDxbi7m!sT!qNkn`8bv(=rn%ug-qv7r!X z8zQ8~21zP|H(KT++)oJr6_lc0tufkSBgkziFL%rmfAhMEaM0Cc4oY{N(i=Iv{D3~b zjdmW=N26lZNRp6||7E8|S|(A9@ulUXNXuBh#wUGN3H2L)iL|@{Y>2*H&YwwQzH|F0 z+9&Mjz^o!$AS159qBB@uP^~s_c6vwp@F4Ps?U`(pk%~VDorqzK(SVSUC@gF4xR%Tc z$M=ql#Fc7WFF}y*5Vx9q8B3EpE#aHg z2BzUeo-Td)SXzS3c`o$HHN2(}-?7GfEnrrr9CW{F1?g+>SC&lXO7FGUz2TYjI(1Xd z*q0PBtWe(6m^$+;4Sowp~+fk}D@h91s z6R(?oEC6km&sB&p8*{mykiWMd+AVi*x~(6I8&IT^_1{vbGdU!ITUCHhyzGX3$CuAc z{#K{m2@je#kgE?8x9L}!fd1PG^|*DyuIRD}$=eiRk(z@`^0)f-MHf)0zf9D|1||T6 z74`1tu(K{B9q0ep`13f;XA}O+&NW+Hh(D905zPM}NdDGr4}@M2i1fGuKCm!^Vj~h? z%THL(@t)lbeh2hoeTQn6wXLooE{Y<=*$q)h@TJVv%ZdE%td zUQ`DY>?yhYch7&WVd*mTsjMX9al+K0pfSIePa-YF6oaVoN!Lj#a|$f3hbw-zcDQWnWS`21AZkYA?p|3XS?hTcv39cd3f^FQ$(77Y;4}U^K>K8oC zU>PotvPp&W;ZZ0^h%zZir&zr+KBrQ9$AG1;dG%=Y5Y(f&v%FFyq~gxxC?IJ-6Un`E zYewO?=o_DPc9^X~T!#bcg#wgrE>7kC64k{$*woD{;8k0Kb!*_9B!jKsexubekX0HN zKevEidSN?Ndn}|vHy>Nh})dk2jDGMiG&-TOAh70~x5iaCcnC+j;bQ5ZEQdaWQ-Jn{j z+&smAm_GZ`e{?HQC(t1LcFVh7KLq@u(D${#wLY-elPVA?QG91lik;d;u@5smDE63; zV$THeG8D^s&+C^6e$c6e)iG{2IUv1wob7%IF`K>J$aG#Q3n&u(iYL)0N1EJbm7CC* zY$NMwlx@B%5%tq*RJdBA0Yk7j`jC+$J;ANZ8E}QNF zE(+Bb{GRw>FLR+gkthRolBY$?N54NLS#}XB^qC)7_9WOC(r2}V5MqNYP*UB+tSXb_ zDfbzJDrb#ST2^o_R^acS$f-(QM-c9-k@#vxq#H#@bnsTJ{k^`GeP@xcaYa#)a;wm$ zvhow*`eyxelOs=lTAsS5sIw~j!}77OPDzd4N4k8$Tks&mHWj%=VxPJyV5?VuY*p%8 zow23t>7X>SE?j{m%WAk<$$tyex%Q{3Y)#!gRb`vzevd2d=HYO~wo;i*o}z6a>LaIT za-nhiaHbo>AIqXwmA&=i#OQq;S9ryv8WBg&fjm@em&$k0C;3$roR8co6;KTziK;x` z_}`3KhO75H$(kGu1l+qIcDTyaaXa)A3vVUmIV#^6mIv0qo9N3Qn?iXXmH#3vFYx7~ zz6n8`bsZnmd{32`o_zTe*k4;UraT*y7y-0Kgq!WtvEOxs`wPPdVIEqliUCkD`FHmp za$9}?e&jK-5I<&<1F-;6{|RG7u`g=U-=vZyRdb^NN!jEN67nR$pGB-Fkwpz0+Z#YA z*1-9eL}wm3{V&L`%tpI{YgQCBJ^_fc+=S6;5u3eb!{a%WgF4TIYShw9h7RXid~Psn z3&hq}rUjI}D7|hDQf3*tJsgd?6(SjbQ9^fqkeUNcl^oqQS&NBj(aDVD`BA-Cqd>1F zMlhk1=+(68@|pTt$VO&N^!WgE=Ake-9aQk2Tr<lV-V~J86l>BxhAh37D1*VXVue}h!>W?XWHK{6TyPfXMu# z7(d@XVrcVU;)~2u^PW?T`-bGAA%kLlSCvwY>q>@jT}fWmtp1rE80lfLR8=1DE30|@ zQt+C417hvzeiueoj6No&yMW&7TONP&uvp@`%EW8sFQ&_Pt;w$6Se3eF45@6#Rh1n( z{}00Ns<;6g7I#!0;(b_96#PwdpGve)TIyv~VGfx0R0dSQg=F9%Eux(Y|}ywRsM%Kkbt?Sk}*?#V%A zp8qPfUr1kIZmW8f{cl(ouYnX$@3_+DaPvRPjGL^RiMX@Nvg`=Mf|*QXHFUla$P(cK8P)qtLj3(FPzY)*#ML2y48q;nB0=WvvNH&fCD^`?zWaH_< zc-uh3UADN%#3zV0_+i^#+sGv}ZlcUtXA2%4Y$7%AX!@)ViC5nrPT$_~D>#N&Z=2N$Q-iGY zw^Hzk8HM*BFz|cq_oIGxwETd6V>M@4Y2hJ$={f{)mhz@BNOov=8-s3O&g%HHa1jQn zAt{Bk-~v;b8!5ldE^*_6^A@&GNdC4Uq2`7aJez0w-&docBU9y z6u+R*TMePBfwg8GIN;&O_V7_(GdaDmwUzM&WqyvF4CmVeG%}A2h5km}O5IjFy-&v+TabNsll~BdqvLya zginzRjXKfZNOZ)|Mjh>IB-x$Uz437*Uf_6=ODtv0aq976*Mz^XTbT63{gPwO0b(l1 zYIv1(-+GqTePnAF_!!|%^_y6a1qZmn7;(pi62__A z_pW6agJ}l-v!9zMcyzWdUO!$VdzS}26dHHbYdsl2$H3nDY-Q@FJ?`%tFev1s{{B86 zVgy?wpYYNJ{?Kvr9|vmqkA?|#>_kg|{ii^9&Sh3D3kI-bTWLq7z^_P4DN&1@sU4At6o=V9j+_SXCA~r2{{KuU zUZlkbWKA!L+XghNVOsq0k5sv#B4c@II4iVA#24peH;^XvyN16=i~~>q^d-+OGULVc z5dII~Ke5E&u?a9491qWAGK_dzX^xY(sKO?B`zWH^pf0r2kx*cD!^7^Ti=c#;(mHT{C;NKIzJoh}x z;j6^|hUFS8<@fpW>%U1kyARGsh2_gOIJ zAHFZ}Y5p_q{p-F&xt~Af?yc#561~@5dUaW8(#!*tAm44DLo*+hku{Zhy6QAl}jc+NK>;%x+rwTfIR1 z&S1Cqo$j%=`mMx+Z*)HbZ!EG5)CoWx^6ULU3`M_E!~096vs9SX?h&MPFl&8xx99~S zeVoYN25qRi<0WBt^303N3;FY;Cx@k-?~B>Vm{Rsq-Qu8Z#MultX*9gAZB0;i=Bj96R%F>u zYXSSf<+i@}YS%cHXKu<@1)E&7X0sp6xXQ}ky_#~kC-_gfdrNP1!QY7YAqs&X-@_a~ zU-KO7NOI@Y+QtB@E zo%Nl?J7yAEbGw4Xh|jvrx>^Ns`uTm+8q59Nd47HiYpi@g*C?l`xm=nv_?jsPllXa- z!}=xe53c*zBS&JN^t+BBTH93ajyBpqR^yvO$2@pMzSUuRP{xDS-WexlnZOzHz{|=snf3YgSm#F|J9`ijTaxL_A%5B`?p1V#J6;k01ttO_%|vXj+Wou zK^6CNVCSCk4L$TAmB*;)bWTtLmN&k~gCq6eSUvbB<6Pd+~2T zrjeFq%x^;5Dp&(OjTiw(mpni^gi0nm2go!-SOKKs^*{+azCNJ${(qB1?$T)<(V75& z38L48$PA~=`o&MAb#LPuk zl0RYj1N?L!cw{M62SNtPpRimw>7MuH_lk-n%qX82mJ5B|uYLJVnITXUn<+C#07YOM8zVQ88 zH`Et4OrlVdEaZ>j`x0mF1CPS@oK2O?{3&-MtNkFoaEc;D%&Mo=F;q+5@3&l_o}*>4 zc1gYoyMW(!gl)Nd9-+xX%G{LYpd*H<+1jbjOa?h9tJ@TRP(nrMtW6D29u*sznZ)!} zQ8e5A@f0-c@!Uzaw(*Tx_UT z(KV)dnm7H_xc9EGqTdJuOdT=)&OFtqd*0*E7V%|~k=EZ{^+e--?aRL|Wk}3O>mQbD z5bh3N{>bH&ii4?o?v`QZ`(+x=8SId`6YoW^gN!z-XY-&3)K|#v~Y<2Co(=Q9p)Cy#p&<#?mn~+=^mlbK183~ zlhAxMPeP%?F@-^O<9&)2zY!p2x}}&3xWQ3LBF&@uPCR&|Wf)(~E@C;&rZ=rrU_h4r zh-J3(_G@C;_R`lZyVl;EhN8%dwilQx zQooan4o_Jhu9}^%^M?6?<5uCHE;{qSdw!;J2Pr(tT-5h88+QDtIfEUy>cP4;+X(N_ z<+rKa3Z1nxx%Ew7`|}_00E;y7sXSnHSt57Gi{WB*TpOC8y#4Mv;2N&aOw4CTcxO?K z)_37Iyp^liA2Z2`q_n?NbA(Oo#DT_XaS-a!Q{;g1SH9qCw<}+O34S8F-t7K#ty+-* zFEt{es>#X$7S2eV;D&mv0~4-~-!wC;;RC%=XjXL7#1t5H)1^Lmsjx@z(&Wc7zQp~N zl%__UVU1$;PX7{XRPJ?WljcqOxtl@HOo>Zj$~kVcXWY%RHDqKfck%4x>4@{GiUQR~ zod!X2c%L-7l*IvI+&A(3k*?(W>ooO~`|OHi89Z(s3tC|P7OH<{W(qd%Uk*dW3i)LE z4uF`-eHHtMJDV%@SmT+*!VKC1IinJ1$T>dgUr!XRaXIjaoyVx{F|YB5^y#FcNEZ=* zmppfM^I?_ATi2fn*!w=##vl01)A}nHgsc+;Y;*RJ5M;k$aY>Ddo2eaClbsn=mODHp|4T$&kPYfN6zwLh^M9K7{2e1zN z>G4w*!?2G=!rqg0xCWYOlk|C?^U+j)Wa5+d&yQ*UUmxgy0J_t3LU#wyaY~fUh zE5FD@@wj;~k`bEtW@(7joGAh*bnW~^zlb3%=lQCaeTAy|s`}Ovt!mH4f2Z-%IOJ#k z*B)?b{1;zTk^v60Db{*HPScP`BB^97U(|?w@j@F_O1^a))j8p)W@}W%?nJM~wp>NI z**lI3%LCV1Wv|XEp(uw@di*oh3YVyxhB`#;CZlHD3i$x9=m>l<#&oS zZvp*<$5J0caCn1Mlhp$zZmP>ST%ODEwSCdGl%7voXnq0 z^LJdw_wr)r1$?<#B2MjBImO@TUx^^V^!bp`H6k1i9N%_-i&oVTQ&CeDw!9@uxOK$$4+i}Gjaz3 zkSH_WTwfule^>nH`Y&re?di!;g- ze~M)W|Ct8AhQaTMb#AI0`-mcHU9de=kWx_5{ zr)P<~Xgty0=kpPpg~c8o2fHQ^!u{Jg7O0D#8yg8ty0eIFCyAv?oo^)m&TObr#trm; zQ8nYKb&q%^Rev&Nxs=)b-2O^mKHJ^t%U_e;CB?~?@38Vvh8Tz0peL!^Z5L2ae8Q~^ zn~1toV1^VuGoB)rT>FdrD0I{Pux5!V8I$;*1=(2=hM4OZ_snp9-#OOLua#HDCXrVe za*Rb)vD*E2x%KdS?O=?(O$^6p?=Zd^H{Or$!D_0Qsi`0wU$wgfuEqGCET%}pfbs30 z$|Es#H-|!Z`vrXb%y;rrnS5-xBN=Wu*4pG(Sc~=Ujj?{L_k?3L<}F$cGHa3TTbXeK zt(c*yHSDU^{flRs9Vb$xrEm>l(QG%+7gb1oJz7OqTTv!65I!3h=t(N~N|~H&0nQHJ zj=Ep@HM~F*)B>>nl)0Cp_Qo4m^4KOc`KIiwa3V*A6M2B@0y>Po3+Skc0{Yqh_2^~1 zZa`lC*k@d?xL7{0|EAS%|SiPA{Ba8%>7uo2fNyWH*L#)(K-F*d#qX7GIrTnVP{R zTYD=LTQQYZ;s7uEc=2hl{mSHwJh&XmxaHIRyfX1Zdh^uOxkq~YeynV7Ca-27e~BeNjYTfm zk8`yCe-!s-$c{r*Y7TR%)`kc*%tEo&8`$=`!EbrYLzOUhgoOawxKvkhS((9EFtF~P zFYUNi#s-^_I~ixFE0#x;dq~A-$1rvG7(Br{n(SpI9JW=J+!FxKQRG3G2(3bRZ#Zk96wV5J z4Hv>b0HF2ZR>SnfVj%~;0bv*cB8T+`1x#Cb1OTc9fSQi{Ljb_f9~)w3{^cRI>76%YRy;xZgRtlA=Hu@7h_)$HbWDaQ?2!M7|vC$i$)Ve!r- zOL92|kbYOh0l{pup0~Ja04vl9)P9ZVfWlWap=zQ9S=RG7jaj%v*8qHRxD$nqGxg!) z4+S{{!sd8iBS(%>que$~niDiZN3pVx>K-Bst~3>nJ}6~@du2QC zh6waL-&+qL0e3Ia@oFMZO?U~~L4G%{PnbVL6yTw^Stl;yMhN zz_Buw(`y`{gq^Wb(|{N>p(hzCG{YF^b!;X8d2({}ccr_Ov{sevym=s6TO_^!bWM-o zcG9~3TpkSY38cOr{cIc5Je`jN;cf~H`wtl70nqpQ%Pn2{OJvzH1`y(ZF^Jk=noG2G zrG%t0n}+GM;#o|5Pfp!MT1tSlSzs#+W^KjB`}k*_U?$m6R_QG<9*d9Nf%61&ZVtKo z88xecvD1$F{`lo=_J7*#=ep@fihuIaV-oIbkM|sThk~#V*1I;155nvG4XPe!m=X)0E;vswDOPg5alzD_s6wNJW2lM>B} zZ!!O}P4&lmD30GAWN(whp%}<`NU4smE!HpeELB})qLAJgCIhJpcY&@nJf$85E=ncznE=EPIMlflmxZ{9hwY3IwkHIs+Dsyl zzf=fVXPoWxdT0|!pzZ(xTuDIA4pI;INCNUnb$8{tH&gMo$zerK1w8B{fxFUv6w1{A zJkifdMI%@iisB0(YSP>rh>!+8$p`MBoaJuopFA|+ZdO^=4I^?n#Q?0~O$mS{rBDb= zlYjf=Ukm~Lp}wbb-;sNLFthRgsV;y&{Fv_|uj9ckfP4Hzu6ENGqbu#+-;$Q8c@)Lm z!_v1iRkxY5YyBh3wpr^HxEA)EA8Bb5`_^%pee*BlpBwU}5Y-MS?e{#e1aCz23kQ}8$(M*o)3 z{@fn3KubB~M7;j=0jK$+ru9ee2PiB#VXTJPc9LTFTWMM-~B9jf4bKD!HaFrkdJ?>XXQhD?;T%! zd0t2dKE626CKQAVQg;=V@E2x%$eU7mz98UO1e#V@6UR2WQKE&du$DfN)U#}6I4*=8 zg}uWm{7~e8-#@VEgSor7fMF9xus&Tu5lTow(8+21=cVD3b1?o|UMzJ}XJxW4$wXMl zS`OK4k55|MzX;bTC+iB_<+xGo8rm5Y=SdM@Guejxz3(p8ThUb&nn--og3rf7qRkkO z^{c4Ueu==v(QDj|hv^$4-=5%RN}a()GB@F`C@RTIXVq>>VO$}$3>(mf8M$(fU(7!cC8*U?M*JhBo41Ss!@MR_ONmKIx8MdtCqt-zy zVljDHp&Rk6M(Ll$5~u4bdG59;#C~x+tTG6j>o`h3fNi5#GYW7N{}ypFdNflwS`(D5 zk9>DE9vmH&1HVzJOutiJxH;da4<@F)WA`T7$E~&Ox_N>$@WXNJR3xKC=)*yA%P!=5 zMa!;oJI!0ZlJ~M6*T)n3NS{CohFJu@@5_R~BJt%yD-tzSBrhMzN5#-VQmTix?5aq- zSit~;n=SowW5=I)xdKP&Md;#{wucB(nNjUeeC&P>E~XFHaR%&-zQBE-XTqZ91TPyz zg&*++d7#o_dqmEG#_XW%OZ9cFEjw;LLcp|%>ei0Pih0H96VZ%0(eP-|1JrNsS2=5q z;1^rE#}EGxIV?932jprwqaRY^h=x&-74=0I@pV9bKA*$u2k;q*w0s>F7$g=Hq*2&e zS_Xn-s|h}_;YxQ z_g6bp5LGbXM8}niK}mU63bfvRPg)_rZc?PvO;LTIG0TY_IHh^(O<-Z4L#(U3d-gPgmrx6&k-E! z_{g85`y=auj-PR6fPUEjdm(}I#TcPR~>YHy(-+XKO=39f& zn%2!Q27j`6h@c#`Q>~Bb3{0lYAIv_hsVx8-QPV6kz#gz$u?cNq^-*aAhd}j@L zyg}ooeSl7DxNKM8@#(Q_!oNljBKC{B6mW#{w27?s7TNdd6##5|jXUj%49r)`|S*=7{{K=vw zz?h{pzEmFU)M|Gint@4ZFl_H&!o+VM=mE#be+``iWeasbghcel=TbZkWR6 z7>}_aq#qkZOMbFn@*T2&fF2JXqUfWGH-^d<^Sh{Seizlv@1nZ-T~s$e(5gzFa$xOCQbO1S&(=@Bl+zK*eh73)Z}L5L zEjDYK=N|pJ$GyCc+j@oB`2F85&?3~NnMLlp(Sx$wE!Q(G-USAO?;cQSo=`i?ZYFJ% zt*oY1B&I~0;z+V=rO9eoD6yWMYbr_UT=vS`3r#27k`YIDzC^1x-lTDul$=7MhbKQD z2UI!H*~fhse++`CDscg-7j`L{G<|V1QMJTSRBqdoyt9!0%0{^11TVIHTWUb^&SD;M zBrTyJ& zEhq1FzOkKQV=U;>LN#`NcVm(znpC*h*`LHGz44hQHmowaltk89?)P|O2om;_yH}66 zh~Qy#(T`#gt`q`$YIJQigU@Lok7)INlfit=Leun>e zS1+9CxlIbOq8RRxY<*ZTNZwmOr(D&7Rb{hjL#}jXDSM*r>WzWz1 zl{iwNST~JhadPX9v0#F~=uF(e_E~VnrT8YX9s0#=f56ge}eUF?kfZ_ zuX!JzD{60lk;@K~0Z7uI? zlK9aNPM{aCU8zb<%dSea>TCR+Y&ORYB%OJ&;~{=qWFC(DrO&9XFR!Ue*c+3R%hkqY zu5f6boM_c|yatC%;gs>ev1$1anjj@fO?hGiKK{rpXVL*m)lMEuyg$I-=<-Ls9*%V# z-*R}C6)7a9D?wudCpi^1ciGI!@u($I2MFt8S6VrCW3r@b{Ce%WXIl1)FzSj8$6wv! z8S6bP`waLKh-%jfOUR;#h^EpDqs^o-N)G;f*Eqo~|G?Rk5QG3OokF=WY%S_mk2Xxd z?M9H);@GFLRTU9L-MVog@#{zHekZrzSNo$viHsn=c?C7rBcPlA7&hKGQT3 zXCBPcpWjt*u6M<|kK~ChgH`D=Iz9FLfcuO6l!(KF%hVU0;rjI_cFO3BXxm7$%(tHD zhuc4$T8PgF7CJ=T+PPHg=nr$>DP$lsHwR-@*;h2KmM4Lcoqt$)>a~ApymrjI2ZFx0 z%m&?pr*{-T`oNaOecuTtU=G+Sfw7zKo3WyiLIx9hVUQYrX=`O7Zq;#U;QH%)n)b5F zSGK9y$mBivLCUI9P4~bQ@OG5>zju`>M4V{GvWNIvl^C?SDslPdysE@CoAY7yXP~KA zO=h%{cKD_GiMz^v%Ae3C?%&n5*wU9e6Pi%cE)OI-T5IAFO&hhh;qdaNryijZRJPc< z3-fhMoOL{-3;B~H-ufGe0VEoEBeKG884bS8L{iQYctP1FT9CYB-`%d8ca{bg z&H$c@RmEq8kbh!JB5p**w)q$-2^JN8nA%ZJ|?x}cHTdbC_};#`U6i-3sRT(@qorZ_DBQ9&;d*qs~Y!X zL6*TR7S>$|Z33s{$PiBM`zm6b_F`TkQyw?U=TDocR=|ed1JZaQT5|_xvRoWUuU@`Q z-1E;8?KDXPKSuU=1nrI#CieL=F~ z)j?B}*Swk^Th}Ba(Z6!f>c#2HJ*WQyM&CsyCaOdL`O*^1zZhMP5!yZWAEERTA?CBN z1?FOueW|$PoWBztn91MM%y>c>OM1?>Ffrj^4hMR!yo>#u+cHgj;t=Mef*peA)K0nS zHz0u*M{ww6H|;yM;X~a&z)q`d)8ZlXM*F9yG`!F6I`}<#fX#zlfO)_TZ55FgfTpuFTYRaF<2(5Igi` zr9qfwIM4m<9TAB+NHZEmD))x1UA2+JN%--9+C6^gU}_Cpjjs4W=>Ja|0_zU#ndHI{mRy+O1VPZn2`bo^cn%Qt9Kh&j zTSa1x8~(qVAD%CH7a4}pTp%V8mE@X)O`d-~? zwTy&X)Bo{zI;Y6`AOH9JcaI79HlRav?Me7=Kj=B_uKtaL(?9s)Fr=*6< z;vHFb3opu&o)vlg?Zf8wXP==%1nE+1kppq_3xn*l1Ku8w3W%4t_Gruba+CMXH>}USmT$?^IeE-e+=RYkB;2T6(r3(O$mw_0H9k`)?sl zT~os!m9j3exq`d8J3a%y-AFYul#hcpVV*yHkLhOkbIXQBwX#Jt_X%cgAR#McQ|3PGk;3f+=v}_2tf-YmhgMR zF7vp@J98R1KzE<1G4cHz0VYa_#)cmi|0FwI81GawodY>JS5`B-A!luLPIl1wJjTUb zSUag!FE7G7TwhdxUuk6NMy!yeFxENVDAqoB+@p#$EjB|)fX9tbSyH48i%Xwu> z{cw)v^bb0lnrM#Ll+NY)!eQpdtece`H_{(j!?q&J#op41QZ*4@sXAFVlZq{O$xzA% zs(gH=T=RD`u$pKDg{}6E+jO!YMWMFBXUT1RFE6P^vGgfYI>D&bYLK!=WK7zF3$?d* zIuqVcPwjo+W24j-h*3f*+HVw?##OnTzUk_Xy~H@HSZtt@8d$;hUZ?LPg=`7 zTQaZT-B*f!7*`0TEBStQR{Hs#*c0;K4F3nCD~bx5vHDzB>}{5~nVYn;ZEbbGJ&8wg z9YzBvR2WTQ3V~O65vfO>bE|7D}ZSyRLw*Ll+e$}n!9o5Bk zPcKn-n)(Ml;FMSnv@kQn8mMxL8(?9Id14F0qa1&K@Qm*ryf`H?ap#^r5RA|+#Ld4j zvnuYt77=Y?U-_JsKbQ9j5q zgwbV)rk9I`wFKR9ORLnufk9bNy@*|6v<3w$n5h~RuIC3&dV%|(A0Gb2&|pT!3Z|vf zhN5^lNlG7Kr@!KM6~tZo)7teZ7;?JYEd( zH!Lr3Lw)(i-sKC!@rP77!)(ap&H^mf*_+Y`{EZ6^Q8ozfj6vQW8m1%iOo;xMe@>E(r zpQcP_e??{^P#_#yg050ixclq1oT@}+US53CNZ&*(IXus$aimzfkIQgMaAQKUhJkHz ze=86M$dY0UJcfKOl*z_drgLD7yEVAAyaWatz^O0%6+=wr9zB{humf{{BEqknoV#3M2~oi70$Ob-?>d0So9#+^}O!d=zHH#|7UBXV7sKIC%ip zbpO=&=Z)#6Eic~)L>B*C>;sL7pohmd z^;=%Us#XWK{e|ML=H_SMj8hy$fc}59nvTa<$43O6(I};bSq+1dH8m|e7I*1P!?aj9 z`}39!KmwN>*EN*Gq!kS#1XUwaD-Ge3%W@7 zXJZc{^n1?C5PI!-86I9LNBX|&> zlzv@wjN@Ti5b}2%8F=Q&lo<#xyaIJ`0W-(f&xHAbRxc}RiEw^y|4I%YS(&&Hiu9hSE?~qHnM+ z=NuK%h{ZR5Qg@jJ)V1tdJj!s#@E&HobfhW)e`Cn4tRNgYPYk)*7&84O#gMC^YFrS9 zwc@hqef zq&gR8$kjjs$*Ar2?$Grc5=pm5^@XD9&>CX)4Nm*Xq0vO=_L?=29C0B`4Kg1NckV?X zQ;zlog31nYyNUelNgvgYduqDqqZ%j{%Jn`I7}^(NBzDzT$0xnM6GY&C7~Jt3=hO8- zjf#jYb?^RE2tkP5Lf}UcU-DU8=(ZL}+od42C4@PaDnLMkrXXr!l0Xh#K(;g%uz`#s zV53>(yV|nrYs%y6`&2BC_UBhl{TR9l%2$~voE&Kn6ii1^eCK{uQDGJ1;GAmxVX{B& zSvwv!86jMjiv|38wX{TNB*6w<92bnS223L zqI+!k-PeBeGbKe!~*S3Z>fL?6r-oh>nfM3x}^9JE-wZ0#ozTCbW ziy9J^`T{P=CJ8(&81BTf5Bs&a6L0ii&lPoto78~*+(cRr-|KFb!5&^eMC1LDyR$pqZHA^lQO&yrVhe-Qg(fP}%%4Z0Os`it%^Jb!r`AcuWGdhEsy^vkJv z!{MW29*4W~^C*=EJ4M=Gorm*3dFN(;gzaVN>e**{6xOv_q`3Oz$WZXQho~Ov4NqZ_Eys8|E70u7|Jq-a2BD?$A3$w z==XE&34&hxe{M;_0+&2vNX2azTK*q#>_|(TnkHW(%WADU@hwT??_Rf<%){HR%G$HTWNY^$R~EL*WkJ%cb9^Xj{IxyHgZ}YJ`?kYy>e-(Kf&0x5CE5m}1e&hn zZ-rOaHE4)a(6gsNAUY#awtZeLznCPOYYZC`LUrX=na0kY;J$8+O+;Opz|a6Hq+hnZ z?(`sWb$$kmT5U>uj^fIq29yUDo!!O3pYEjx&^fm70Vg~DUH0GLKhnqK$C(tZpa>Yk zt6Wm?e84TQBU|c-U;huO-pzxinu!K`U$>#bc-v)pSRIFWMx)#cL?&Zjc>d-agXB5Q zhs7tou+2bKnY<`)&G(1O*hK~^#Oy_0dJjNQ@2OaRQUCOlVyO8h1bOzEo+;e!HZ#$x zYtK;?8syz6)K1?@RNX=X%Vzn$An80;Kwq{j7Z{k)({7zwWZK%)691>vp3zQ_4+VCV zfe;1_Qj@P6>PuO-C8ygHK2R57ClMKW z&_84df~yc_Dy{9-pu{VY7PmP7P|ALqx&-SpM?T6vj-=Lt{oF1l?ZA|0BPi6{39+&$ zO1RX9$+rc0<-6MZ)pHIM8Z|4ni6s*f@Trj?Hv8sq{fB$139&mn(u^fQ!5huOI?|Yc z@9*)Y8=0#OnT3L$1`MrJSK;E?9$7Y9)R~k$1NZwIsP#FgBjt`}t9^M~lx^!22A2~v65TW(L zF1hFu*PNXfSy9tJ{>Epv^@9QV+Av+dE7QzK^ed>J0%fe(W%B{ygBL8n!ct?+0Te$mX z={hMF)<0?7Mg+5VB^wJ9m~1{If#~Pby3yTtX`&?xpd3bc6&Xr(5PmDrjmu>N4H*1p z4E6XQ`2AgfQC`Pt!y(?r5OEah8Ll%OAJI7y|F&7w5HZJSyu7*~KTGK)H;WUM*hE|( zMh$(l&3Mrc?F5laHcK}@M%1pi6l@nu&ZGJY)0z4OOV^stRQ5^3xyiaB&1ymStQHr0 zsTX!)+7S4&klmPXR%qyllc1x^i;jWR>CB!QUqiEaE<^1aC`hYxi5?uF(6^7vpwNY< zX5@h(i{Z4Jb8}Bj(InB|J9c#AO1D!pS!wPMLWRxH zjF)Le-2;`4j?uEQmf@lK0b3hwz6tSW|6O(=d{5^FqPH#1i|$(2k5K=zt&8Xf*&2%Q zc@e+J1@5GGp}e++R2o^bnW@WO<$L#bo=dUSHdI-E#vgHa6)ZlQtxR5P>$0IhFgZ+3 zF?Vb(1(^mIqN`&FW{y>p;So-2U(`9QCV8CwQw-HI0i~M#M@>|RkXt$z zpBzg(1BNSC-MztXtoYU0oH^ZxL-|z1Rq(WS)BIaP&Wo4R+-3jFgcp?)X||%MTD2lT zd#0pJwX&~(s?dS9L6*{{G$!@8TRVUHS*it7xIUhqGW7> zT}t{bT?N=F3&_$~5ck*I8f z#!xC;gh4M7`EFD<ym+~`717GXU(MD2w7}u^?$r9Dzc=@ZPf9)yD0O~QFllLPO{3)BCg{1-aO6nK z3rm7^x7b3^LOrzG>gop4sm~*n%B|IPEjU}SFPvcX__hMZWx91!{DWUA7vWevDC2=> z_>#g54Igh$x@4(mkKg_MK_m-&J7)a7-F+s$>__wy(r-SS8SY5(xWqIkzdT?Z-tM?c0JyEd@ly?#?R}CC>@UN`Wu|hoXgqUj~AaMTSWYM6&%8}uGD;Y{D?yFY1>#K5uycYa*O!1RKt(1 zOuSg7sJ3;a6J@hSe!f1HY(I3%OEwml)QT z@q1z%+vfb94(+kwZ{I_{z4j@ooFTE)f=&yPByG)`v31I`-wHFREI(HE z>CI=y7=aGCBx!g3lA(+KTw$wxY5u$sV)q4Asgv%nO8qOR2N>+?^wah*y|PN#V($l| zy7n)zvgaakJ*iB%So>Q!QX}e26aLJr z3~`6$hBk3lEG8&GX0CWU4wH^PB=9z;g%}xlvB@ptZ83PZ@Mh~RX199tYne*$1b1zw zyYvscaP?4MJpO*h0)%5gc3>Y9uL;b4cXBLwhe^M(sWVA5p2~f20W&|57d(7sw0pmC zRMID4Ym09)(()kXF!k$+AJ63$d-wYvAGE6&WV?!}buus%z3dCCLyukqcH|n&eRk_Z z+4h@9^w9Bs*55>h8PG;7peyZN08E#m6}A|72&RmZ@QiN7aMjBW541{je#RT(co#fC zmvbl7^;)QZCVumP_>?-<@qB3G;+f2UzmHk8_@6lk$ESGs%g5e>e-xU;YPxA4{^4SH z^UPS8IVS2y0snuwsTcfrJni%MdsTY9J2A(Lh0s15X>OtI&gdYi?<`GyAr=GLF{ktJ z_-p$yl7V$TcL{38v?5h(m4kYWuQbxk*rAzsb-MrK@Q^I_MlZ5`IRZUYinqL@hv$Wc zI}DxXsrCEUi5;M7m!AF0f(+TjkIm4BTglRxBFg(^IhjdoDqWMdx!6=LI?V8kH4~}t)@cdb zxxX;BYs@)aW4`)8k=u*R{P+jcQ5St-SB$^L`5A5e#C-XJQ8}_=N`LS7U zRv*TY8hi%drCb#T$>9S~#Um}hVa&FD#6ZCg3$u+*Ve6#R>o7d4)UYUsPwIGXEHv0K z6E$PRQ!mmAR;`lsG|gxoMeghUY?30PB(yVPH4jN#!BV6K4|yL2qy1(yXH0?oW%p^-#=NHdE##4L8~kJ zwzrS`Q}NN0L)gK&vB?52uLfml8WXeOFXDwdX?d2$dMnt-7+!yNEc<)65dH)HNke-0 zU!lKW_gbFNep=tXKGpOAIK*4EdxfzCazm^R;^!cKWathQic0pRCgulZ$iI}s)97t> zM~V)L;_Ovp1*PDmX!?1_<<$Nc1fM5gZ~$}r6>Du`F0A*HZ1N}N0{pc6M*~ix0FBb zAH~P({Nzr5eo|_i4P@zi_t0lE5EnMC30D5{7yh5FBHI0$F3{mno17^eW=LI`&1xrE z?RyM&<{{uaJIgIKUMy0vnLCaN9}m_wZ+(bz{p)TowtHvTSZusv$KyfjyK03{@rqmf zv?lvs--=JC!C!F*H05qKO+?~x#~K-dRPupO5&2X&(c8`{;Xq*3Rgn$#^P=f!8` zzosPPzrODq2g%JvT#g%Q{*~%-{>pka&&ky~TOK4a@ok@5YMXfFx9iK9{*e=53z@nJ z9W0;KCWJ%ApXSP%P4)K~PRON3GpXVC1*y@SxfNksd{U`ZE!1FVLniO`;aEQj7ouMO z7T*XAQ+~2}uVkK_M*3UYdcW^H@kHzpYN|TGL zRYTJzKgyNKdB}Y8Lh$8MJpk$1-?t`P1?;7->rN;xR*tN&6W`0HBePp&!(2Z7I4>)9 zuV%nm8d=uk5A#7<#nrIKQ`f^DQ-hQV9f*~9`}8g9S6m};KC+c=%<3q6`O&hk?0DJh zcf~!Z=!W4&MfkF?kI#mFUpg3YApv{%_3&TM)KqF2%<5~|DsMFe+eF#fKObC!+O~{@cR-Rhv_)n|=PL z@>Om8Hp5J6@YC>Iy98S{=+uaOhQ}TY6#v-egu?@C>ZPk5a(KX>@ePgKZn+dvBQ80) z*Z2zmsqqzj@%TR6*fqW=E z?WE~{K+EKaIr>w!v3|g9gTKO8)X0HIuH@isMk!moJaS`N@gy_U_cs8E9o*Oc$WdI$ zf+p0D=WBFt%C_DC*(N_O?9v|?T_KxRHyNM^1Nc!+HV5~oJNKE`wcl>t?OngJ-49gN z6bL`J0hzg_e*%tM` zs+T{dPPoSx_2)=(TpRE7udd;u9f7B#5D(qh~gYTvv7vEL z@|kFs+mvKn8W!$+Rd>AOdKE4Zw91ITB#w-JgHxhrZsI?aYj z76d1r`F~iy){5KCpH<$(#RCIyFHiY;RrZE-KOd*1Q+K3U8Op86Lzm#_jte(5 zoG+E-I=X5pRQr@P5;B6hVKZ!*k1fM0fbsuj4at_`7Sx{|3$9g}(0IF!Nf$`F2~ zdX))awC*wXd$06khd;sBPaH9pv2${rA;Dc%-D0eR;aYT-Mv}PNMuHFPz>&PbNpJ&g zkC80QjKqd>(1(XFdU;0vg#0rM80-?-lJPyp{FW3#zYtPA5xq?`!Qiiz2vFu)4c_y8 zFD#6kJrxRzmk`{qKSRw_&PdB=#>;Nb4?P@8^sX&)wI%~t=welK2#4S)na2f(rB@jo zGEAX+MJ$ZNt^WE!z>w{_u%mxZh}imM^uI%|&)zHixN4YQ3oNW_daGIvTATNUhjIBA z4_uqm4<1hXmJEI?fHlOCs9vl_t?M-ZWYDs&fwOCwK+YaZ@bz$5Ga1$gvJSVuO9sji z>a&B$A6^XBt!03^x%wp~CZ()&)vaAa&Vcb8KjbJwPUZf)uIVb)YFscZvll%Ou;2LF z7XVi0W)DQLe*(VuUfvDg<9beH)$*>vipaI*DbdOy;k$L_L8B6UrC;CU_3J!H*?_$C zy`3~ynfOHV4`(afY5{)Ye_zQ{T-N}GRJENA#pYk;P;>(+FfJypbpui$IlUHFaB_N- zN2O#SOuVAq8>uv!!}KAKT8_4g<;`KvHcR8DYv|z0Z3#-QGHZbrozbJ6#66?+(>3ObOL{sQ;%y~^-ZtLQCXed zo5M$bof@3OurpUaJZg!#l$oM{{+HiXv>jN=#q$w=c|p_Ei>5T!s#(j|SF2`gRak4K z+F8^_^{iUopnrj{4B#}3k|I+Zl%dUFx+}Y~mQxjF^JgQSWh=5!jKmhl4xHq)&+MdE zj?}KW-G)OrN2KL<;ehg0BXfl}PAY?|Xs*%KN)=7zMz`ad)k#9HzrN=6)7ft5t5zJe zQ=DVPl3zQlyxG9-F4m7!ZlRpJgQ;>o`7grv8{LFIf7a>Ae0OOPR&Fbaott zWTAT&t43zr>VH>zU+%9D0SQdLI5B_Mv>CvKe`Ejy7y$N(2pE&f{mKmx_DMW(-{b*W zPA?f|98)5&xPqXD61VKj2N9F;POU*P!jw84KQ_mfmmj}|WqgW0;K_8V6Hj2@cZ|VGfB>sa|tcCjNu-zE~P4Yza`e>b|N1ZP*uj=g)MheL~n!ZCqUnP8R6p#vFH=^q&8}h?={6$ z$tKYXSq4cjSgnDjzbfA~4(#n#k=PrUF$QyD3$K_YfLNj&^z*CogqUDwT@8Z`#s>*q zYg`9C%z+fY>q(FlLDQ<)WpITOEoi?}>*Kef^{B$JPsJUdZ^od_+#Y1&-Ti6>{Cd`A zIbmnV`c`A1*ZpyL>Iv6U3v_2M(uBFaTM6{aM&(-44vT>Q8FkQ9qD@U3EQ% z*1q*)^p!6SdF%_D@1b6%KKdWdpGN$`?35K{)V{|UPr!8enVPnT^oxYARTs}?mD)c7 z90+?#5t61r{t0D@!v5e16^`x^3p-ffzGdjE;bTK*MFB5aSkhdbY-P zUh#i*g}OX>L2*#Fpd`|~&Dax6F0x`V0w^om)H%F<5TAYP`|;VYVQ^%{f~(>$9Y=i))n)+#C|K`KetkZ_Y2KN z`~%ZQk1Bm&t6Z`Gwa*Nai%XiG7FRcO3bvW1CB?%VMsV~Sxyes%>+<#ZE^NzFN}~Tm zbs&2@{*_M4mhxiysN`3%AEVp2^}iKHsBQM(>eS0HKn3%-!|;=pk7f+`n;FOT+!iHZW%eIOevf z7aC>CK#xR*>;%EvM!51>gy4$n9sf{Y8*sX>W_omnjND6f3rx$cM(UWrc2!b2E?md9_Lkw8Fy1yRN_8FZnyy&>v0E; z)xgLR8-di!vhEg^nRYh3K|2w(GlwCx8s57HuMF|MwPVyjjNi(SEWv%Cf5PV~!LQIzkpH`_#i`Wyq4ta7cd zco^in2R$XXZ=uK*ydf+qbZNid*OJW4UyXQmSXAIPQ{>V>#`ROvfP@jTjJ6H;7aJG2 z&9==G*x4d92<9SXF z=Ypyi8$JvlGfOLX6L5@r{8TsjS~r*|J2tob@^G@<`&v^+;Ex@n4zcOzu?bOr-F&L} zEx>h1ns5s+Tcby7Z?wN8SGB)k;(LtU_vklDafvsjqk0{f`XAXGC8^>1hBx4a=Xf+j z%4{T`loU2=n6S0wYKZ79Ymhv!))DFh3w?i)!LaP*$Q?hB2=M`q-!W;T3gqMSKvwk3 zT}9~rv;<)8Dk`oAQyQM?s9$Q`brs^`5FxIdhW43x25N1+1 zxp_weC&4m>$}b<|l=|Q8UrBk_h5j$)YrNx0&5=00W-0Nl}LBhjBUY zjN_|=A}dCZD{taH^YJKCU#}@|`gB13 z(R>cCFW@s$&-IW0ZHpF>eX2tNAspCSJd!(^GbJ6b^U%wGjc*xU5E*j=X9xY8mn5!z z4#iUE%Q_zO??+l5rjli!T&LND2*GWdvGE_rEYhZLjGG=R$G$+sUFG=gcJGqLOmadY zJE~x3VdPdzwqK^J$6nBml5Ojn`e^~cE}^c%@|5)HyLfx86{>-ETA{zqf>fvWlH}+Ct?0~obH}#7 z)3+jZLtFXoS9kvy2>W8a8vP4j6%%kJOS`MDIkmgh6`dm?ZH~LiSF}}Tuj78c!}KJ+ zlRq1j_sYUu$bMDP{Bpxo_x@U2?IF$KYC>O9IL^upqH8$?m2tki^zcJHWjyoym8a%p zr~6hUp0~{+xBT|$kXsc5`>cMBtuJ3c_r5|c%_w)HAHYk$%3#8NR4KQDr*4`rdQe5e zG>;!URDQRLdLco$YT%q5ROomg!gdkg!VTRm;2+TY(+_&T8(ndjJ9AbdT;#+x-SV5IpkR(XjYdP z&2U?;IOq~1-Tcdio%urF(pak6fKdOu9l1+WdFmBa5ur_Xcn4ID%cW;;UP>PhX8_A-bj~o6%sP*apOWM1DM^#<@{|O`z zZcfmkL9hmmZLnH{MNI^BqCrnE(Rit%=v%6-(%RZ638Y>F6CmR_HdbqG^?hrv+Phkd zqE-`75VXq0*BfoURo!uHMcX15YyO|_+ULwn0_yvF{yYzvbI!i4z4qE`uf5jVYZnV! zUcTA@|IWjX`_W1HIO*GSw}O=Kzm)f3|Kk!eno*F(+D;5sT-J6;>sP<=mCpsWC2ci} z+Dk6_X3Lk_4!dws`{+x)+V+`__B}3Wo8-!IMr0>)uBN--ad$Ag-1+*N&;d91y-;>x zb7Zz!luW`aLIo$LWR5L$&#dwk24f(>eT5pbNGx|}hOfx`NRIAA)juR#ze&s{Q@Y>G z%J1|4L4Nf8U%E^GQymq|0o7dXYCcP)crbC&H*u0zW5_v&&F`P*1u8rHC8KOClGDM>^L`8oR1B|o2C3?V!q?TJQdPm^$6YxKpF3T6_(uX(uR1W6M2+ zx-LX`>8?*L>!zZ*MK8-G2ibP0j=r1->3nfs;*Fgls#^C08yz;LYgG@$?S4PbCAZG1K_)Eb-5|F7=LdFq|F$$j0DF@Hib>tX5GpfU(;j{s!TK%yGGa1pX*A8SWutjnIiHBW zMx)B3LAc$1udBS%ejlp5%YM0%hF>=Y#;AR(DrWD`WC|PW@5yeXYkOkXDXx74QFwpC zpy{hEK$V+Rzxz2X(W$C$mEQ@;e%a$EPbck$ljnXq-Njg_?-mkLVL>jhK*uX%%W+UN z{^8(4drr5VlVpNbFR|tR?y)IrA32;?_~RVw&9=j1*Gaq673eR@ZK$bYt}dRY`$3q<+%oZ>Km$>@wFzOtF zf;0??aXC`o)QI9*x;Ui#?>roI{z2g$3!TKsYyew}MgtsDiYa zsIIH5318UrURN2{3o6>wxRZajKPRadfQg3>V6<7^B=wi|zBMHAu+9h!G3Scd@z3gh zh|bEn6zsaKa-PalPrxq{*>p|VE^^!I!1(S?G1mW7+v^$5(ECc<9|#~By=Yuim4-uA zvu;ffRbS^J9tsJ*?^2J_te=GTsCnsr!4Y0fR{QStTK0WxrRLL31~s#w(<%?+GGRUD z@;yqc;N$jtov|>aG4<4vpm|H8&Gm*I*6*1FbEwkF;B!cSmApgk4{8UEl@73>qdK1D z0~OWbQmCj9%A;0pzVUU>Or2jeGxfDfwu7ftWtzC{WagB=a}r9bt7BC{4cB!JX}sXC zUcc0^Xs6d-6%UjCN)Z(vGAK_>eRHMtO^C~9-dY9D?i&DQQ=qWwn`F84GGM8zum_J0iMHT1obL65S54yYj77YggY8=&|m@ULU zaJ@gg$iO={Z_4*C?;2Uv8OnZ!foofBZj@ zxOjzXJ(6182A?#fHH0Z<^5q-}id6BudQJ!0Ip$_n93JI!HGD`RP$SX0C*h{4J-mqYlV~e(JmALfmc6W=%Des?WER zk@aPQhkDb0M;-d57&dJvU4m<~MBs6M1gvIdjT$6}m_+2Myl3J8V^G|SP-`yvt$Q#M z)4LNpxOMu+5F74?)f!n}Z5?~AXj#WClIL!9>H0qyY8GkCB;^UdJaF9gS~j@FATNEV zoqzImxl4Td*t~RqJ}RvLWYS$yjby?1_!F$IlmvH@hVnwo@=+74?-Xc^ z)IW6mhlz_aV%Psv@)5k>(J2`4F82Z^wxKGP5UQScPoy@^uAoLY zbiA!En!o>0_7GYz&MvA;t}=%Q;i-e<%y)7O1doJ>fsFDY@L|#!bQ?Jq(rGM1`%`ub zSMOy$9R8c%VCNVK?|unTy!~&&&10RFlF#6ibGy#1JXE6C=iGwd+qhr-CUn8pyucMd ztTDtE?5=o#@w!d^niy-aQj@}V{j?!TV^;OCz&D1=XGZ10HlV)IE7(D zMhhUsKf50YQAiSpiIqOF4cK-w6l;1bDC72!-F8in>Dh-(Q-9FJy?VEe$*YC1 zyNP6Qmzqomr*X?XPr3L943~+7XKLP!y~mFk^_thH6cJ!0z&eM=9-2rwL4udrLP>xp z_*K`)D2=dOv|dH3+&9N-b&#$@N)h9)OgA`;CHN z64^v{EQByo9?IxTftQRZkyVrvE& zrIoOB!-5MoW^Dt)fA)IpDnRf@7$LvZ8G9Gm9nZ{gS^|qQrRmB7t85&$?Bpho{|VjV z7PxRR!drCD_*;mdZszZ7z+Slx3Pdm~aL=rO0>8~ycd$>IqkGwCv%sw&NhB~=sH=9r z)N8u<#%%ic`2by11Q+zWL+_=AKsE5C#;cU#ZsGOf3L)BRAD=&KK{Q! zZU!oNu;hC;&06=G4I@7-w?7v@dxhNC7x?RzLw|0AN+;yR60#WK&)s@j#Ab4I;VwL4 z7i#Du`uc8YAaDQL14McIS33uZw|--4R)ylz-bFIcReBb&^Ng_Sw{Se;v*-7VJjeBX zJ9*grmIP_`Z!Cfz?HM_xzwUma!@aW!Oewp>Fts71-f6!N`MoF-@a@X^*h|8Ac(WD` zRngwhJ^6W#BYlRs8Q& zj$*~ozLXI+(Jxyxc0a#!9nMW{doulEbI98(bYwCT)D8~$=T_8=wf6`n#cKPGfFhJ; z+bCN(ptp+iR&is@%;e*)MM>TYA~?l{n4D$tF0258vO>{T zw{D+|eOr1+@TUr7m{r+A0I8mPjs7DOrpqa z_p6lRdGX};e`aVoa-gB*Gm)X?Q=y@SBlH+rN)_cSi&k^K0uLH(#<<87;%2G(ocqkQ z!Iml(qVj?(VWP^M*jaMr0eMZryYNmdiT07DZW#lW@tZrGufx7Y<4ME0$58(@U?|m3 z8_G%IPZOr>ZXksLKai99&fYC!3F*)%4{9mxHn8{11G~0_5WhOu#mYz6^qnQK#YK!0 z9`)N~LU{iLZo)V=@d^xN{`&#f{bYtu>0yfCJFlQfvhG3vMaM9LpKI&m+m)B-+R9}* zE7O=hq0o;{W9`b=;-83cC;u}@pZ-28MD|wDl|kVSu8tpifjgo>)#;*e!YVaN7^ z+m7VvnEsCKliLmn6085ip}j0fLxRGmam-C_QVhEtQ~GhS%swk%1^Szj9oy?JBmPpy z_H!0a(#kb_1$`^X5MVZ@q!A>c&-bVl?id41Prb9(Becj zH?-|+E^kqu0xWm^nI_lrUxSY#rg{qYk|IrazrjSV)~Z*c|e0YUH1 zV}r?Z^yc6N_=aa+$)w4hGnni4yu%jfN2JFzcgG)@WT!pGeZOM)Jx%EddY+r(V~xUl z&%}!Cu6L2K&=|aKVq!a+-sJ#(A?FKzZq?oc9=*HhtWaQ7JxbTozEzn9)%{;uh%|0E zWjg(Uq}lH4zPcB$r#cg@cS+*X< zg3wGxksv?3Y5X4Y70_#9qIu1YC?^~#F zRv4)5)!R*&P^;`h4|KylfDiu|0F4xGmf(1*zDB@_=bHS={`MI6>`$%t@#`XleZ@pX z^0=M9u%w^fLQ)A0xLK;JIKQsM1M5jBXg$bX@9SCj7@4Ikhdw4KyVaj}LjSul4 z;>hD7(KCF>A4etKYmyd$a<1EcCpFxp^r(i!19OF0HcrKVTXG<{Ekx6(m4e+6KBbG5 zifXKc@e`F3IMY0Sj09U;-%qSZ$4O)4@h1`W^VR^nM)=uL?lGU|t3rs8=^4rsQ=aVM zdt|&Wpa>GHDuVPZ4jeqMA>uT{hFE%q5@-uYP46tll$~(UHj*e=LPOx1 z)GiaLL*-d4o87IyG-#i@7D$Yi*ZoFW>QzeW#4AX53#^z_aOr?V{KB&IMc6EY$*`q( z@5ffrx!H;qQ4#Uyvqe>`@6*b<#%JAMS%qkKCRyEBa++r%;`?EI4d>?xk^JuNnj9{* zeZ$Zn`32PP&t4&WD8tP~{z*rC{~qyui50tJ{7?BCo0BGPGK}Y8p>LfnJhe#ZXcvB~ z;kt*oeSp`U#^AVb2y&29?KoG*Ip8o(raW7u!>#6Wy>+ih^j0OXIwW;!Vx}D;aakgM z&e*`UG&9cAIKXOa)GULkjXiBQ(=3pzhrXvtf0r1zxphBhH>fsBRDG%Wcn*?lqgRig z(V!v34-m~NPo0BIdt3?k)k$?yyCrgW?@rw%j+*#Tx8;2}D*9}|0oEY_JG$h${!LQ# z+#}F|A-IO1B+{N9ArX{*kN`(`v8){Fe zZXMU1`kq?$i>{QSoQoSeWn;Gm@kwAdZ~Lt4rYactL&vi-l}Cx~?!@iyw=A@jZ?f zE!jwz5<;@tuf^COtQ0~V)GE#pOO3))wH+wv*3AxE7GmSxqU0*~>mOPlzxfbT!wz0d z)BL1s74B}o>P$_Mgs2nFj|pLV+}+^QH;I#q@A&>1f2Dl2yVR%Ou{4}@;rtT+CB4R- z>eJs;x@{3Wen@u<1QnUegW>{h=%Bi)V9}}q&>|{_KiyEEFf`nB7{rU3qvgK!~ zd~vRPuITzUoKT;44U}}9zF1-z&B_ws_ENE@^fjT2GSmxJ1h|8H;lO;<^o<;_7xwh6 z^)>82y@lAiG{C8jY6jSiFQ&YlM}JH%PJmQ(Y#-Y?x?_8>;=gxrHK*SmmY%n&WBZsaW9T156;+a$htQ9XWBv0eN&h@drNimRhq?Y z?smINvU3>JZTmTX4FmL})U`(lFop82=jUTf-^=xXuFADw6Bv8RBs^G%qn?=YupV3Y z7a__8Ww5z|fZLM1SlEvjMM57O6>_iMYJ~CD(~OYmMS}Svb!1+)AJ?Lm=_*Wt(9_6g+yx=VHv8+0D^KO_w?FXHrotwR z&97-lg6>(6p5d$ercb*4tWb5S^=GG+?d3`kD3aPF zvYj0c)Z=dR#bM(iWHSB{+{_&q7V)6CdnKBsi~l>S+WkZysIt_pU?APU7;SfofOzZs zKIh_yA$%*$S>xW(S~yaDIVcNIqP>coQeC{(`yKt;zpT^`?)~~y5U&bwNWA18>>E_z>m^D0DsIwW55%EVMywEo! zxAi~kXRpmHcR&P7=GGiL-Q~&J=f3vj>p|je);vVY)Dh2J1`t~pmdcf*k#N4X4@WSJ zJ47%L0%qLtJb3wf0hR*rEFv!VL~I%%=3hx?3$`a^mXX_oQ?g$ea3|AiZFe`;ACEPo9%n zo{_8ScAHM#WpggEFLhQ)WBNEw-i)qnO0JU+bVG07(M^RLcpTPPyRIpAJmuF* zW+!jpJkYk6`(eY0skEdphwaC8oiQ9DJ*zZGU&bb3VJY>EBKAfnu;FqM=3ll=FST1@ zi{Ip-F@=c{L%uPb_Up2O}F(WvhXjAlL;33(w~O(Zbm$ zr$-NON;gzYLI0@sxkmd5+Mmen$-ND|Z_)ntkyrgbYJW%6e%XkV(?x}VU6{F9GcPVC zQLRb9*&@4^@^?owx@&sWl=}(Kn*X=vefxIabAo3yNa6T~Ty05zEAd=F<)W1p2s+Y) zp)&j7%J7zGgwZ{^&Zzv18x|t}GX%7=0&ScYpF)9 zZ$L1NdQC?0<)-1*HZU$L^B~TUFhf-&!a)r>n}n`W9teQVzgbx*B+-byb<_4Mmrp9t z{@KT0Vn97pW>0W-iTfKuMYnQ2NG^Bg?@jokc9#O4%rCNy`1PRx$tT;!?t8iyS&VV) zrl;=AeFt^2+x_IEL7&1Qhkq-^SZX2)VFGgRJT~a%@M7UVdE_Q5WXa>vVsZG{2xN`$ zWQdAK$9_H5SbSKUn&aK@yEQAB`yh|$Sl|zh#~V{8lt%Oy&bLxT;^S7=53Atb@DoZi zr~z6P!{CI{XoeA`Fw8MUId)B7PP)!1)|}AQIE+O*FOMclI7ed3t|1?d`}wOAcgyC5 zC99j#W&A%)K`)s%PlWSkNdCMX7tPq0n6X2cF$J12+)9~)NUcTnXImA2u*RGo(xYjI z8A>}1$&Dd@pyxeA=^4NuuupbSVEzkrU1fy>TVuPg?IpTq`sT5?>>Bbm)~;UI1_#<3 zz`_<@s7tJc1HfU_0%IZ$G~V<_i*{Q5o9ntJivLu@f8cWLTBS~i>TgUQ7k)@8xbT2^ zA^slsQ^Q@aqoW~%Sj;o>*A;o6zR9!uTJD4R$DG`&J0_fy+PMA6tZgZG z>JglR#W6W%G@q=Ze=eY+>zVACW9|Jl-qpV=_{8c9km>!7y7@qU#{Bks9K6AW&ZmFc z2VAWPlAb>d^BfP>FjAY;GV-}+*TOAa%Rbl^KRa+C4SQ9J6T=wEslETe7Xx|XUF6h} zSA8D+kt zg5fk^h{pEktd7z14|q0HL6&FbKY)MkcUhFfe?F(S8pmsd7T-Y*q++f}@G@R{%y;>+ zw9r#$j)2^-GxCY1@2r719Rxq;5;o=FFYTDI@QO){-I8DP(T4i2Zz&j{yY!dg`VoMxh;7C7eAYjy? zA%^|&IEZTRk3@j{lV8T&EOaqPFJcr&2wD~}Got8M8iWV5S=e>=R;@D-oPT)TVrnAN zS^hC!Zdb>OdLLwZ6}X#0iG{q$lv!-5^^M6j4Qx2Et;|(^1@QTX9uhl=mU)4mQl-{E zuJVa3KFyML6vY+?mb+h9GHz`fOaJcl7{zJsrB%d z0b*vpW%Vyr*CPJS{3(ttUZk?gud^VfPut*KL~>UHS)4D947j&xn@LT`kMZx+Lx~U zvxHF%9QHNwwT9I6_3WlnI4_K z?CP%iKlJS@fWqqf!z+e2az837G)wj@ew#-jJbMtAT}&3crs6z3q{~P?jdRf;8`Zq#phq1K@ur3x9tE|MZW6|A*kv@N}%<9XV9YbYOJZ!1xOo`-6*+z_87cZNcan3Xx3dG0g$;duifa; z+P^SQ_OiNR06w;Td3Y0n7sh_~jY-^p{v!!v=pwZBDs>Oyl&XEwjY|96&m%!CJ?@;# z=t2}}K4F&^p8}kjbkwx{dik%22_3@FE*5t?z3rIsJCJ~Rw;W=&6=nnv*WOqGBkJ7P zwr68HrN{1We*}Lfx4Si_#&lAK3!`J5j~T*3;~>0O))g`LTli%Udy4q(T|6uLNlSpQ z*PWKZx6SFbyvo$!5~vUVwf+#YR5 z_RIV0jy!%BX!B|_u&4AirVsj`mPrM5e*}#MTV}@YKBSTraLr7dH6CtEeZ8`!F7Z0y zEM_bs(<$jg-sx^g%~W^VM#v%Sl+K<^9n0acDVw91x(YpVyFu$M@;W3Vl)8&<(B0l3 zxs%J!d<1wJpG3Xg_mf^wx2&jAom#w0ryy=9e83(;W)z$XWx@F!c08L)MtY|HGwqf3 znymF?>H9TjnDYtD)7L9G`fAn$nj56L*8>RriE-f6&FZ|M`Z(^t|5_ARKl$f|$bS7YmGrp5huL<9WFl7z?`(E(>Ynh_}2jCWm~9AZfwY2Du9X%V7o$K zIh$0!?BJQ58;P52^~E|96z_uK8!jM-=kl&Xya)(zh^$oDfJA?C>ZZM`Y@y$xb5+mQ zA>$;UbMGJR>AE8E8iGIfCZ)^ZKHssN@?}X}K|g}z^mSs+EgGD-h9vO)^G#<)=f4H1 zn?(s8|5I|E!TTm3`G0Ac{J-35z#SrXuR(--Hg?ZV*=YP#NPnA}xKuQYk&mfiN>3iP zPj2MsjA0u*zuA<0y)N;$!dYuN-@H@9!oOUVM44%L|MiF{1^~tBuli*N=$zI?LF#*& z&uB&BtW)2UY}Anavuai3qFJejJ{=<0P`eh%Q}>e|<&nF84!J`^k8fpYGiLi2*K`*X4NjFIT`db8|)m#N`+y^}U+ie=leWd2d`*FhMw6 z1`Q`)%+b}GG=uwANvy_w1CDHN3DOw6 z->ZR^FG=kv6 z4YU)&*evr497jwDK<5b@)*tSsb)~W>kig_QqjGL1CpIi;6RZaRw(*>>+w8}kXrc|h z?iglPSWwKe9Zj@sTY->Ga<_C0J04VAI)n!W>6oNkj^R~2;^FA0BFv+upS zTat(V?+?o-7nLsWTN0V_JpLC0X^8(Sm5dAPfk1@XaW#S3i@kt=Jx&*>Ve+-1Fd>KW zAh&xL$`wi~9t^0?y{g`;F@mT9uGL3$Rg0|JsP#Oc`|?6c5^vPxpFx1<$lg6G6Ejtp z2wA1RR$1?DVe6|2X(@kQi=NfL1;>Pa0~83I&ZNzuQ=Ke@uG+tkm?Q_CGZ>L&vlwKV z?N+iT0v9@MgUg*3!I1e?RC$(uwVw#v2=Ko}x_@OGJIH!!ShRf$daKy7KY@;Gn-x6N zV*8?8E)^YM=iJzOR5v&k0it~`d?75d5K9>8kU8olU(5VU{Is*6iGcunLQ}Vts_D}h z$rkDpBSbeP{#u8tHKH|orA5sip2#8tLLB=iun)8!sP}YS^{?p>@NVHG(4Q{;(Ff@B zK0_mJ7|xk|IPOn;u(M15{sSm9JQ?A+gYZPo4cI5%Z-OpAhrjUtsJK7mkI=$^;gjTh z#$gIQ)O5SWH+wl7+Cl{fs^USC8@|@IezRL-QGv^hP715F_zRw@*njV^@k`ulI4&BC_oESDO^}pc4lJ=y z3qAXdUu4?R*YU4;M1qLtum1jRgKmh{ftjM-YLrT)9?W1_3sikLCwmgBsaQ6@rG8*AfJ&6Ic+YMt-`+lT3?&r7mqal47 zaR{Z{JZA)GXZhkw56_^l!zY_tl#^Q?^j#WrLI?MlZMWNOY2WCPkeSfz);1*97RC1^ z`rN^JCCXG{O}0d$r?i_Hwl|%y(%s!tdX^5M51fkd(`sj7NGW~t63m-f{&A4GYM1ob z^5S1!IH}+xv#Hk|GnSC0pmn%Ym>zk6OxYaS!4Tq4uI}z%#1e&C=!EKPyCieN#m|CC zc=6ko2X;?EYQGbxhpkrI;q+tU(y^&76~n!;JK3!#&PufHS=aIK-893kybWtkDE%v& zTD3=SZ<$TatNJ^d`3X|~?MXjp&<}pMXSaQ@bYj6!X35$GBm37T?HOfx1m6DxAiHV7 z(}(tUA$`nMi!E#fJNTx_+?;nO!&96cSNd!vXzOB`E(Vkn;~XneL9d|+IS1Ly4avs141A#6J;=PyaT={R zeG+9NLh=1uM5AH{ZT6C4%`(ce$~+Iw1QNtT?^ijRG&^F8e^8i&7woB;YRrRgg*=`kxbaW-_g6OO1MY?m0Q!^k_X~~;VTY5$zdew`qvYFZ zz_~&pt)}!(*{UlfX88uI^BWY)EO*^R9Lk}}R?$zqzs=Uq*Hb z^p^v~9U&-4V03MBrD6RDO8nZnAtf@UM2Sc56M|_YnHqQb`C$iCpAluVh%&xnKk`T8 z>i(vg&|lo7%n3z#S8f=pR6bP$y3$vhM~)F$W`92szjL+>#P8-Wh2X9D6z~kh?Nt?{>Ceq&6-@Y zeWj0h|_iVfo;)hjJR^dBpaxryv_=X~&Dp{GjOKPiCqapyhDxGa zMf~7tYv?Z8srn*u)AodYn<9xhJ9PG7<2Pu23Mw;BXnx%K59a3t!5PlaUy4){IxUxL z)%|-%ev5ecKd&F^9MbWC!4T{G8O;QV2h={c#csX9blSra zK>*F0t;=*Eo320*=Ai@Y{HWRb(Cl!i!*%02j!CI#T;qeJPWcrTYK#GnnDu{1cig9wzuYeVb|n692Twr;16?2sF8H2JM>=kCWnLeVb#i9Q+mnf@$`pVmt{ z9uOo2IzYf$nTL$a-v(B#b)Ns&LVAw@$~-{k`cA2aRLjeXNmP&};`5n{>SNsZv0(LL z8wmzql6$)Nq~A06tg;1ewhX%h%age4+LqtfPv%dtrJC;{4K}NyxyEMmI`M~0-iX39 z)r*hdzi*v6a6}(qQB|FEH5}2J6$jGZK-SjEG@@$*mQj`_voOm`uAGtyXUl_<<%S-)e49V zXg*h^mSK4}{Zok5niblJ3xFWY^_ta8;?Wkgh>wjOu&TN5{wp7&eXFx5{KWaOnW#=H zn4;PFq4*HAGH`wzF`)ik=Et8YAI=YG^P}a9OB6!Ns7HgBCuykjo@g~DOEzji3mz!v z4*~=#JJ^T+bXW8#J#NuyM#db=Lqs@ZjK`MIu#E+B#9?QVqwqZqZ;cKz&xbb3-cwt~ zv2O`lN{#zZA)a(m;n}D9=`IVM8UtIO z#=C3Knv_0biWs-YRsgof=CD;QSQwrVTg@xV)T+cFEygP}u}s=>pTpMLt;~Mj3t2Yp z-M`=61!FejyZJR%S!nau;(z=t53h8{JAm$ci z8R_|&D~8q_LUWAN{bWl%Msqy0Z`}Yw^z?UNj(-}Kng=abD8hsH-;B&V$q$0b&tcf?DjmhU4-v3+F+T>?g7k?Bs<&8-?KYtM#v(ydZx|ot~5cYR(N-{fLgFlB^w?fTh zR&tL`4E1wT$xX~!mWm?N3~nU@%`&Z+R`Vz~579@z^AU*7)4x4IvjgULq<=`YfNwKq zG$fzLaSEpx$+pRRw!w1qR`xF_#wkgxtKNLHNfm-O!&ut z&j-vi;Y$WV7ulcwk)!{)g0V&XqXQ5O-MgC%IRp5M4U;!Qp*KLGGJrRxZcr!e%8Ovl zqNqdlseNanDrJtC+n`LX;q}X>H>T$lnyEEAMgH6*)97oOA}?r2_3x9WhyZ}R z>zD1TDbng~H^ht@%N$7#vSnj#9catGUz5XqmYFfoUOC8?{gB`=duxay)<-B3E0Nu4 z5L&Kf*4RHtTt1JeIQL7_Vo|3ve#`C$exz;R?K# zpMeK%SA4qb5wr%4a^E?-@Pr(8BmQt@jz5GrPIXJ(%=*XV`J32UnPU&~kAXe>JY2vc z7YziUUUE*^Cp)+P-|n)! z&JzK}MTJbM#)?=S^ZybOiewAGwfVCFV|s;n_qs`j`jHnuFQ4$ zKzRA;E~*b7^x((~@VX&*a1Li^%6=q~JEi{ElT;NT`)#qcseLF%3@`XRDY z5$8NOSoH%<9<8xnHrMtGUjxMHP=h}=G2{F=N}vn7W1ZhsRyojL$3r()2BcJ|j`QN9 zFS|0@?AL?PL&Oqh$ClqJY~%Rq>1P^(Ogi|mgD_^x#senTVv7UJ)g_KVLJ1!|b9NYa zH@4(+q7U{$9aJODiNVOKFxT%BG0|cS0#K`8of^$zr@C%jPl?2g+m8kE*pegR8J<5( zNIVco#*KaZ0Dd|i7;i62IJf|16HiIo_Byk06=@HzL zRv24)wPE%27Ou`^!8*OYF@5rf;T1Vt^jq3g*xQ&s>qFg7*mu0LTA@$-LU9%9cyKdy z0$(dj_vtm#OY{$kE&ULXa9$xtDWB(3?SFFBmiub|Go`0*wdJ!6yKT2m4AbPyzO#99 z%gxApCBvLPg;SH+$Yfx(Sso82h4!zTvbE15mbFsLD`eUbYcvAmA7Icw+X z?WDzfVKlPDt0fKT(VQ+Nj-a{lMDZ=B{SNw1HzQ6A9!VQS#og@*(q|%Fv&DIlSXakd zRTE1M)a3haUk=ZFOa+X6UF?UwI18?AoV<>=tH%V12gNW8+nAW^2mrDW|1=KiqVGqE z^S)av-z+p2i)HLY2-TL#$?gE0heX>ujX9oRVC8@;9vSW@a5o7e#llqQp(&+ z!Yaj0X=Uc+MnXk4B`5YWeDtWXcKuZ&q#qS&{tfVl1Oy;iKQNQhm9aR=G&J*qOJSOH zOZhV}Z#JJ(WtqF(1!OV#n_oD|A<4DunMTJFntVit5CX)5f}r;mcvo@RYZZKkg)v9x zF#$_>Vy6RtJ;#p2zwt%1)sooU*S_Kp&d>Gpck`Dm{nKZVK0@iU!t}tW&-tRIUw1O; zY-kGH!C^YBu)Melyt?J*@@Io@=?}v>Llh@x$RBQ`%*~-?bZ*}i*qtB)JjsEum2x-x z6?JKVY}i+XgT45?tuKd!ysun^s&xQugdNr|Kd*ZgOHS`ALtWVmwyc%sTYaqdQ2+7r zE=_p-N9KR>SCd_z{rYkn-N~*m5fh!Q_2o;W3Lfkrl^C0D%kR{Plw0_|;KDIRK2Io? zP>}U!_Q#uyahyG+ACI=W6)MBYZv-sD<1FOGokpzAk6YKv{JIWfbjx0}&a#NGKm5-? zx<&|J?{^16&8n`T=e$s0Hgy$T1Mok{=D8(+~ke(@zPCjd5)nHGlv`UU93he8lHL4MIj2~FP5a! z{V%IEj5Bl5zBeYHXiRQsOupHe{D+iX*U?&#ddTwH{Hxs-TV`jtQnz_9eYoOz?#BWX zdSP1-t~KeYw+6j$48;)$n`!7R&-g&d<~2-2Z}*K}e@2N-vz<}OoljcLs-^QuL;U$9 zORcAc=={U z1#rzIf)I1Q2Vd*QIf+|z6g;Y-SLb^^wDUv%=>RG7b-w4Q#`MI)o6>VQKlH`YhVo;roPCbsEY|Ya5)hZ zW|cOkPAlhl(|y?h6kN_)5_nNI=CraIjspgtcXlIe(Mxykh;i{`Lvy_ zt4sU|%pAfAz?JF~Dt*ucyCYu+5_1pDDd$>0l|A7Vos9aUN}imaxNp=k!yNKMgu7b+ z-*C574z52;_5V~4S@`YH*fVvBCxO3mBzMXxz(WIv(qie)A=&G2 zTU3A9NZ=nY`1^DjFp?zetIjPJT{WvIJ@J|Drql$^FSfoVq&E}(8qI-CIi16JnO1c* zhvu*a8z$uNDsI?tx*yS)qESlbHyoF`ojl0Di?)$9JTBG7vunxw@MWIO{x~P^<0;BD zEB8U`<1~FcGWX3LtPcm}eHfqjJSOkCkY~<^V|jE(9?hS3dFmdtHreW7?u(M05ukC6 zley^*nvfqcodwOrHtk8S9_=E9dWKd}Ph0lE_sMTKMD-*_q>+eo;FLCzX zu#Of)u$G#{jP}D0#L0mZ)7M$0nKE~x*;o9l9VI5j8lc=_V_QNbhbo>JyLdJ50%Z%K zMC`ODZ(N-a@mBF|mIyQWrVZ#$L*w(#urQrTi(qEYK5wN-1SGP^pl=fl7tO zs<^+E&2FGlp|L7nszPHgGhU>jaHE8G26dk124mfVBzYMOud`Ae%bc&{W45EoT1alI z>>x#i)h^WBZZA01ziW0;3`8~MV+!1j44oD>U-m_W1WwzFz$g^jT3F#aDBPHy)h~1A zNy(y;lal9_@Tak)^rYmKC3dpnB2<&HB@3CsET4)n%US5 z{?<3=ll614rPPpeOHWQ04QWbu6ma(A0eul!iDrXe0AGQ3 zR9ex)BaTY%Hm1j1brfg%3!hR=Y++$2D0NJe`Q;K7Hg6qb@c4m<8X-&tK~$G#8`0o& zP^V2{^|U4;R^bM{_dco&NuWYXBkezxsfs-W5|$d7>;CYpa`4nQYT$m|%ZGoD=56Bb z_Gl4{&JiLB#yY!bK1dwf-#SeKj~`>dxHTxEXWou&pP+ENB%>DFeu2d){j9yZ!KBSD zfX(iq6damZ)3yH$VyFBSF-uV=wA~}vI|4BSZ{z14-0J&A!t?Z~Jq*ysuUJ#ipaU8H zZc$EJ5ofASCQJPKie1mJG0+&@Sa0jzM<|G0i@+}D?rlReet z5~?b+KVQ4xQ$&nm4e(b-*fBZn)WStOGb4J^2voBXy?Vdc(wo(wIB8TYNKSpJ5!Fow z$8uj0yEOQ};%8rf0=acYaQ{BJrmE!{cl`YVIkf1^^|B@dSRq3NaHA>C9IAyZu1pm{ z+H&f8uD8(0gojToGom25!ppg&ocH&~lV9tTj=bpp__*C4-=q8E@gU#`UgHH%DV_K( z{{Ah%DPY#>{`jI21)~3yjZa<2wtd?6>exQAb&rniWvztWj>VRIS-n`&vtS%()#B>q zBp;48GbQ?Bw$-f_xq_HMMTev~Xq*FkQ-LVuKQlo(A zenQ*deIwjkmD*UiD*4-k*ONNhKRcYu*4JkCPX!ZGja>?ZHZ&Dyv=c;sylEvalF|T7 z;!;RrU8hDs;+&mHeirO`7d;L5u8)GE%Fttmb$=L({WCeXG$d_Y)Yw)b&TiTfx)__q#( zt|w>Nc7D=1Z0F_fHvQh*_{uG^L`Ih{ReDaQR^Aof-5I1@YM~)8A zGj!|&U9dLfYuZCY-p!#Q4^6x2nzmr2+tV!BvCda$DM+7Q=q+_-(rSp+6Wn#93|4Er zb&5QBhPsCLU(H&wWhacPM_XRMY|qr0MHtFXOYA6Y3mQ^4tXEMkk2r#7O-QdltmsaC zM`IfWza82(+)Qej&zp)ZbBO;r$p3sQv14dkz5c|QA3Ap#-j7#o_O{@Hy)g#fEMp)l zuR85uAD@}r;6AUW6LRa}gMUCyn=kxojNM*~KMucaVxbKYpH>nz`jz^w>nd+hrJ^;c zX1(o&9v;J|kjx~UY54EI%M*-pNAzL~lH~Y@_YVs+=jde_1pslj`R@is2zQ(gpsL#) ze7YwX)o>yDhbHNNpenb)=lt0wavn^g@h3NJ(Qf+{QBpMXlf4Hi_CLxmTHY~o;W;4Z z_Df?0{gvxI+K=)>Qf)}iOeREs+y1fTPoNY#Z2lw;P5yqCVyllHiS>K9&r@s$*Kqp# zkk)R@+aQdCRa<~@8ZhFY++kn3Z{y2;d~w(EAxG$beNT}PLKZjO zvWtkHmeU(~pHlN+?(6n^ie|`zgdbU0O^o|w|I-Brhkaw;avV^e!zN!B!X8)Bkg91& zwUnSgrS62qP#A^wJhL_$KI!L(-&B#4f8wFe#X5K;G`r|S6a9)G_VS)tAXwNzS^8uQ z%XZdm@44PW(;TF}rMR{9V79gtNPX@_6wLC{07Q3_~*7&`4F%kX$<;Dq0wqaagk@+vxcj*-HR041) z=-NVc-@?@_yf8>#ZxIq%5hW3BCrS{P)J~;|1r-Q`L9CGlUb?N?f8r+~8xVWkv;CMc&lNVb=BcRP1}WTT3<=g&GO#s>aGA0Fe`&+iBGzWy%n`6qeL z-{ZM^cSI}RRpoABbFw?iHEE%bNUa~ScNP(v{1ExSu-3Pi6to_%rmC5F*9h-W7<0u8 zjtT(H1ml$ncK+JkOt5M;wI!6Y`Rv!{$BY+N*!416&7P7mi- z1@o#@0BM2&1<#o=hJ(U~31KS{R&hxJ>kH;b`&V%Nk{HY$pZ+935F6J&b_ zdFH=#V%KPNpi}pR?6JV$wW3+#F6vkH&;Ye#wKNv9Y1?jwJI>iwtiJ!Jc$S##CO?tm zKPSQRR@awSeBO@7stOtP(wC0PMVHd}g%dWmEJl7YgT;kiF{racZ5 zC^|*~wk-N$Kk7wPn5JLeX+3?RYa(;IECvgqqiSi^NKQagzeRS9E&CsM7$k)HW z)jyj08>pWxo3H;RUq7)osb3K!qxwDkf9;wG7aLf=$4>~qxjhN~-!ia(eMoS@+Nc|} zfQfHV4?_H?owBGGFYeNdF*~VFBrsRFfYeOYZ<)CZOn6GU7iHv&Y`{> z;F;e>HTz$y|MIYYKsMz~sSK*4RzQfln6_WUv7Q~Q>C>icMICyfjUbwh^={`Kw9RHR z7at_+E@Sj3N7Srot;QYlh=E!KgMH+5DKr|SUddkc4samiYwo{@3OBuQ5B zdE8I&aq;!0Q;)be#_tnZeq^IMZsdiz*mI?%OPR84h#taO(3A?WPnBVxBId2xr=pm* zhnsy$GLg4Wh5VQpvWMrUxf+?33#@w^oR5&&v1Qlm0Y2XWF4&-8(4vJoVGB>nSV5dT zaVj4TdvFVRjOwgXU3M;BNKZmeQc3Mu`;WCZhA&O2k^jHi8PJovAU)52tp3}0ZDK|L z|Bb3#Cu*ru^l9~fhL^_lXpq!UA*~(q;~V-{dDG5LTOYkuhxM^+ zJjS5CJX>d7j?7(;gZjqwwUQwj0dqpxactwHjSSw=CZ^Ut)fj7hO0Bgt)NX7IM6N8? z#zW1m49&EeLzrZZ$xV&PwXXS9KSA0(tA&lkC0{m2)Z`5!g{LSOEm3G!`uT@>=?Fq1 zuE)GYP|UThZ%9zBw%b+lHSuPo$K6fvGt=5dm1Q1AtF2u-f?3FVtN#kG`7D3J531iy z(8s-VAKgfOD9-z^{V#m@7k{F9oIbpk_u;v`=O>i7nm>8W*Rxa*1ap-@yR63}V(?bX z3$$xP*9K#7#^0jz-|$c5)YR-MH?ugBujl+|8y$yJ$CfvgZS5T*uiu@8m+c?)v)Ozh zt2r(V3Z+$m#rnVQz$}Pv+an=3nHvT&SKicqZ0Ya8W5{D^C!n3e){}YIhd3JVu*EJ} z2vLk{K2Q5`A`}HdhFKoOGu)~a)NplKI%v*R@V6ziuYD=AzkAqsg`JKP`6ngV_|3^CrpCL^VKQ(H*)Kv@i5nkvukWy3 zt z1l9mQMGXoy>i&=PjI*dE^DC3wdmSDIJqpV=48Ovm<}|}zWX^Q_gnujVKOkWnGVXk9 zipi`xm{~^jTHez7mMkND4Dz3Q5W#3ryS7HFUBbpKI~;t)wK>`19|n!E(bs<2_1X6J z$CVKF>oqlR1mkM{$cp~#pn~D6p%}MRWV)e=SBGTMsPbUbYr%-WcE`J_i8WnZ=Uqh`!7v;Zp8cXu9{W5?SQB6 zdtsm<4%)Taif>3(Y3a_4WQ`fxSh!Z2?^HXNlk~?r=ZpC+Z!SZ=-nz0h*7=TQhk*D9 z_3jwkR>n>soR_+jwj5sm;Cd!fXo099B zlCL0t*S>$%6}U;1G$bx(>-xpURC&XO4DlCBn`-x6NZ=3K(_n6tau^LU@_a+@+W`DZ zV{$$1y9v;|#3xA68kJ=d&f6kh6NvrBWq2okDW_mEi<^>95<<;3tbYB%ei2);9b=(v z1I@5qRLHFKU$?2!`wsJj!GY6kaPP4XhhQ)qg@3sT>_n7iF*@wN@C_lfRWvEDSLCh) zb&9f)P!5L@aEps(o)N`$hwFZ0w$WbLmKsMV}g;(tWSxxnr7dDFpua0;a1(X2U6W|wKgGat;XHpTl(6kNs`#_`Pa_r9vbdHBi&s$ zl|Of=5?Z904v+Glwl1*qpT{ZsIn`QxF)%@kH6p5Nx3_O~r<@QC0Y9TwDli0$_w82J zk+_EncZE&XXnyRhF@P`HmsBKM{2wELLiw6>w-t1_vA&VLen8GiS@^H`T11BsO{x2} z%!;&JqD>O@_i^vg$BEZz_o;iii(d1h3BM5axybD{1GWd>o3Jya7#xl|KygEj6NE<%r!^km%| zTP%fWIR1kPxwZtNY@KCfJcDQ2SxP%1;|saJ#2U&c;t|UK)0357LydQ~1!D~d)q;fy8o8}Ym7ppPG@JkZiSA2cPl!L!3b97t&k#zga zVb;b*%@U*A3&J*P+zUrq(mf(++pY#-5&{V8FRAX?Dg1d?RR9%@7}Xm6sC!GmNXu$U z8|luPmnB_Tp_}6yKDCi_Bi*+k*RbcRe~xec!edA`>Rl&tCIi%~^?#aAzhfWLjedU_ zrURYQCkVbH1>dQ@rB-f_$fMr}FB(9qCGKvNigBBck8GgrZ<<2~tM^ggje}r6S~i#gNX3z({Q)&(u9( zqmkNdcTcM*+6b-2=e}LJr!{&)!#B03?IQQ~p*EQR6uUEYU%~vQzq7?E-+}p1<-!Rh ziqH)I;tyn~a2tH;$umh6rG@x6{@`nUdK?q}T9U%fCLf3X$JnxHBAC%emT^|+G0rM? zy07BYPf@!O;Hx5R8m@M;eZx~Gkz@q8CQLH=7sEW0p>>z41`6y#e@p4pryixS(cikS z3>fg8$oAO*?>ltxV(HgM4&O%OOYpg#);$olwyrE{utK!n#GBV(H<4S7Noet4{MKL+w;4~}ziw+!M_bRV^z=PurKhqp zSTMx!yLIIdYh`2RXyP^KTswn4x*Dz28I_X1P-(UfPmQjI&y~Tt%G_r;BjirF$#x9# z{|?e8p-P<^Lx0?WcMo5f(y|TJ4`EKHkYmi>#HMHps1jcyN_@2f|t2ty}x3#yU z?NM4{zcLj8bHUI|hg<*F2mS5|{&=~=kN<->RvP~Lc6&dm{P#Lo0(QCoVw*T}V#aHb z3^BxCP`^_9eON}1($`f!P9kn)dA@HFdapSpNZ(Z1!&p3AM1C^lE~~BJ?ec1b$9Vr! zZLjNPTkt?f_%FbhR>h*?dVk)p2v6nrviya65I@rA{i<(Xe#!_@_bPRB~~rNRZOiR`*&Cx{iZv zFPC0jwMS#BXdR}+ws*|hY9@jHRg%9*osa!(edO!+WEZ}EcXasPs2w{_gAywtdd*Tt{jeX5wCcytt<3nR*PmW@& z-EU4-$uYzFEBM*({SW!kXpMVaPjvNEkx#dEE8FE4o&bOMUPHm;m_Ly(F=LqZlwhIb ze#5(a{&Dq{^8^B;_y?*AHxfv|SF~TZ71~gwo^T9|(a%g`7xCh@kP?;&Vs}qe%Y4r1 z9M9O*lObto#KjiX36Ua~Aa$Sh3ej>Nmfrp7yJk3q*CSfCln%G(iTAHHZqdFixIf1&e6gsw z8j&^Ktw+?g7S%7%uYRdFx9AtHB?#OTyy*Jrqix^m!6O=dlsy6%3T)vVVknnByVe%* zdUxoh+qu7J*ia26Z0KIAyYC7kwNm%=YBlIThIHBYMN5k`-n(H3eM{wG9S;x?S5k2$x~mfZrv1Cb(1g3dqh8B6?dx&&|Pgc`g-tB{|bStt+-_e z&w?nc-{zQQtn+_iwx(FCnYB-BiDH1rIn%FSw<>56oTFWx*=8f!X)U`&N5=$dWzH`EJ6` z!Q7|&{SM}*CR54ZW=R<5>IuC`XLwpOlI{Y*;cp+d>NqBM0^R+eV=eSoEldUs^RETP(G&`#s)C?x_@V2gr;InLUO~ANh-W*+Gzi zch@T8&y*3|#)H}?VoS<~Qa@`6Syaf~@mt}xgGa;fzhPeyesefDLnA1Et-U&SlrG%E z6lOWV(wDzu;|o?s#FllGP(ymm(;;TiMg^(=;=d^O(LeEqd&)^MuWSk|Cgd!>?(3dHVfKK#PkGY^j~>7-Y@RmbkTy86QI z3u~WiYr`QfUWNcz*gAYgKyqfpiW=o&eY{Xdd#7yF@uK2xWH^E>EQs>DDOLKRGvjTerK)J>-0md|bY8o8kJ1nh7!$Tp zettpaxD99dL+ZGi?9imn;W-?`(><4qhG$T1M|^DRJ_A!vhAM-28|xcr+1d3mXkq`o zS?M8{Xd@DJjzhfit8M+=V1~sk4>KMUnFV=$&wCt5#d!(4e;k;7;G34vz?RUcbsYrY zxMBLYOhYbcjC=X(dCtt*hmeP-=F|Nxv4pvpv(N_2hMEA{*#hkZ=`!ZFtzC2Yc$+`Z zlq%ZbHZAjbnwR6F=1LGAc|!hkcPR^~!s!Zzx}O@&L)SgO6dlDniwziS;$Gios{UCP z(0jwS&ee+_blab9*W8VDt`c-q-XiKSP-#-*^T}}Cp9fdl{5+Uc{{#c8_1r;qpS!L! z2hx>Kl?JshNsm;Amb_B&FFXTvgpy#%d$E#)ky@dv&QxHMz z2JFYFvd4qk?XkpVHqO-1keY}|XMF^wD>LxgewYV?mMmPpuR&h4Rfx3(q2~D5@^+Ix z2ChG```W7ucf{`7s5L66eJ-|)kP8LDeTOf4Gpw0) z3tu*DDl=KyP6(I5`vbZ_#L*gl>SOnvP+ecRCU#$cP`J852bynJ2PbpI<&NO}mm07l z2EF}Q=hp;(D>n+M~doEMPQdCGJ4#HSA;_`pC*ju>O4$ zwlND|f_ncC@LA945DUx`vFk5lPQ?~qYBLL?uPiF&C7`y&cmRw(6IK3mbm;kL1K*97!xH^=_#2fqfzA-HE^06bfB(_}> zyZ$|mQTps5=dGfKE%V!{VMy%yKl7D~%ZJ1}`a3QQ`1{Dh;iRGAWL<9Fd<)HYsGSTOuc0L40zilh% z{y+8SANteBpDZH0e!Oj{*9%BLA^Vz?fTvajg)ef0+EzBHL;6=;SbKKOg7e|!tC}wE zsW~AvdWemGU4lDHj*fTsw@q$HU0GT(>$6u5DGi3=Xpn4&&&{ZO_ke;~sVj$6@lEd& zc{g2Q=GRgAA#FcuNVS%h1VdX&GB;CIYdtFW)?*Vh9wu`EX8sg6Jf*l;CN+C5J`D5R z8jL)7S3sjgESEya{>;@Xhpu&)l=<97_6Qj7??0A~Y5kO;QvMwrRBTL*-s8eQ@RR-0bf(rh(lf!&Xx{ms! zl16T#%3Q0mZJmi3h0505ikKOcyZ;@KtK4GSS^x3u{r89c-)y7sy1tWuln=-`-)#GI zV#Xs|)O}Sj*WEOrg1LPaWHtB}ZD*VM&DfF{9}+XJ%NCjEzBHi7yuQCn)0AkhKwbY; zI0ld9T!Gzro}N)5j}Qy$JjJKXD`-0?G2vs{ zBU9%TC1=kjj1V_+VRe|0UQm?W8sZ%LDa)mTHHaSr8I^B>tZs9GIAx3KR9!7wU)Dv_w* zbc?Uo>wFXPxn(q5K z3+XnmpA$ex#Ef_IEC1syUU~Uv=B^=O(c2RJgom@V^)P8UJ?1@z9t#-Dy9m>>x zZb9q5+*@08Vg*xtT(N$TFq=`L91p3J^41BKlF^S(L8rFpQ8fVzN%U4At~Vltf3-0+ zJ5YR(i~_NCZY8}g^({tXC8A|=)0B;M@Bgzd`Ak#oYq6!zkSHN95J2PuC8x=qNXswZ?_j6DLC zkyj$`Jc+#cpHgWf32`86J-HsTI7F!}^~vWOlbOaOxDyZKklgy`a{H!3T|TQgAA9m14E6DQmAV} z&6dHa8DTl+#MM>gm-^Z{vlrfzhpX1g=}oCgb~$fT>Z{<1NI1eX_{!laQ&g`AM5!yP zQ^(J)=YG}6tD0(GiY>i^e(_aE`{B&wOWappnB0hjLv#637AU4{vH;&b?-7jdM2!b}Sg90N;3u#|S!b?h9{R$15cc2Ql&2ZgPp z{QBJS!H~9CSZdgXb%|*OZ92i2@K{VmsBw?})w7+7p!V@Lyzxv=MaWrq@h!HGKU+u?Pns*m^+6zFBDBrAfV))e zzOu{w#`ePQ+D)xFa8eEMaWzf$*}>4pP4wMNh9mv{&VY`92MoA;v>T%X6->oS!C&Qu z-N@=OU}wfSSI~B)D50uvDI@9eFaESm{At10`~W=KK`6~hZ3;HndQy-^^52c+O43SP zf134Yu3Mnn$&{B3($U9N;2(xqi^4>o+;*NbT<@pz?cv`n?8qPA328;0F75mJAa-i| zqlF=Dv|zCR@tay;zZj&itgNDO3nMQOuaO1*nre+CMnm148?51=@Bhc!mw-oAWNmkc zG&D=-MiY&)wHP&sjzL9Y1BrJ}CxS%K^FnVL7fXqMurT_Omb#E_81M+;|^P}miTg$0ar%s)!I(4cF9siCM zC;>(jK!I;VkO0`mylAV3BswkRC|16LkYfmZDv|mX{T}dZnc4=c1UoDKZAQN}an!V6 zL%svwYJP7%41@}oMX*?We+!7SB9A69S@Yq?ChgO7xJm1XNPw7R-cJxpKl;U#Vbpkf ztsUx@j>2}W<0jN8lr<4Kf<;#gNw8g;H5}hY|Cc$2W4rb;@P}iF3Dm2FdY?;wXvF%~ z2yrRI7tUAbi)|3?D}(W~%f?ttM`Vy|In4MbjEU#{5)?`GDf%2p&}VRNIv-7V6A!$5zh^}b$KokN8ux(`b{1jO!XGtmH@8Krz;BYV6Wx`Kr#Ao~M!?991LIqp& zjsNl3>bmfa)^N@e__f(MP=lnuXVNcD-WOZ$cpAZEUT8IpzhlEJ`kXX`qW{YY`8qhF z%j2)E1(A7ZmB79;CU;+SG<>+|D0EtP8>T|?d|B^|$5D=cHrQ&!(O@JBIItn+3y@$m zArfom_&t{%<0z-7msae^G7aILI!f6?d5pKaNz_&w^hupjlu>6!VSfCCihJb)!~sj# zf0}U^#5k5*%g?am-JJlN$@ohVU^rM9c?ENO>=>@BJWO17*!L|gW&AKUF#cgisp0}_SPB>kTS9?EiP>g~ zT;oy}I2NDL69s-pDf1kwOk)lK4nw>NAMwU9o$)h}AcSQUvwRyyK`7MOa&BB)OPePD z2>%>!@{b#pdvPELnN337h*>)53n+)vZ&~*XDE_x{UBr z?iaxMly6X;iGwHF4LE1VRw(%g^Yy>LDBOl-$xeD|RGu9r59P9qX?s1e59zxP+Y`pi z9Wbzhyq6E$Alz>}e$%fClPj2N+liE&co$fIojor+1ATCj^uYu6sygfKQP<3BNNnr< z(Ux2BA(iP)5HAV{6s=3=4POHgj|m9eLXzhBQdHb?{ZdrGX$-$djjJsVYd~m6|JJ8K z|AD0cw?(9XPh>e1{q;IdW)CSpr=Dce7WzlW(T&}4p`6x?i!h->0)N9m6d1zx&zPs9 zs1K95!;~)<#Q6iY@GK8tVQsS;wKm1nosWNdSt4a_`T_LVx-@ z!srYb5#u7*nWBIHmixh{Cil<3(a_xu@J7=R!r31>G=Fev*2khRdk_R2MUav47}U>- ztZx&>rzv!`KBRrD_XlwD0UXr19A>#gd!c`0&e5%+9|+RKb84zL>b>m}gxl5zLVsX9 z@mD;ZfML8s*!3`YuY)bcMb~#F{f)aivLa;A#AKM0K#%bhmcYWV zGLWziSp6d+s$0Z?OZvF#sBJNEzzh;r@o3+6EUahdG0p=Let0`r@P(L|BhkJ&!{+J+Vt=q^3_>$y=X(6j0jK3|$`fZqP)*}7; z&}hS~6$U`)Icw?IadBJD&4gLFYBH|T&041-uTw#;2TV&6OW^2^8DI80xcK>Cc>ro2 zV9*?pnI61WPDMoFuggu^xi$SV*e9>7JjE2PlObB?A4;@_9S>~4_;QYWU(8zKSn@`i z6Z*5d98j>B2-alU za5EVC2NIhMHJvLOVJ%!pvKDH>HYfd3`S4j}Yd<5vT^%ilP0uL2;M%vKIQL<$4SmQZr-LEMx<> zIe*LhVpA`T)6TpW#VvxQ@fLLU{l}7iSm$BZ4tqvOhxrU%b|r*2rOgxkItS9m9Hedq z72CXzH?^k;9}?VgE7Ny8UD7*YKW==<4C}4-Z0n}*pG;G84dVewMxc}nlpJM8K~^5~ zg%V=9frT%CHnz%R6}N?R%07oEb2ViwuayWTP!)}CM8QI%=;LimO?)Tu-xY5O|D8&F z(-vit>Y%Aa$D`3JYjf9VnC z_qNI3jx{HxwOvigs2lYh={ z&9C@BFc10LGkCmz1YS6Fe7&3T1L|`n*=1HgN#s`%ZM#AuUh=o=V2Sv-hb}+x=wagP z4-;Q~nE1e9;v;F})%Z3MG&W_Zm%^(QlYl?`%L96gc}~`F@yi5g(52$%8QyDQZ+z-Qv`yS| zx)7t3lp@8lj8HR0XsH&u9R6t-Engy}O6<2x%cXwHxJ&XMt@f<0#?kAQTH)o+%Hf>D zVJ=23L)fwVKo`_ywedSS-XI!MXd$%FNR&Aerzoxxpt!A|yD`ARhuW`>X5o8ip?x`q z7u<7OxOOVev7ipzgu8B4D=b!V`~p|h^jby3rr_R-{)~y()lj`&x1v<`&%UMhl85+> ziBDiKnSh^&IYFR?qHqT2#j%t#LU+q8DU0<4f4z{2WQX8C?sm72SMAFK?`_+6@@fy# ztM;8Je$~FWi2v~Id*NBqzIUC+_RU^*u=d^X@R7Ces*h9K_X){=nD#y9SJl45{Ul}k z_N@}2(!Q5j_#C2ri=}-Zt;irn(>F2HT5RGcR|J>{o21{w8##oHOk*Z~k{fx%bYd27 zl57t@S*`MbbDxT2wL8krwi^E*tY9Y?o%Y{qv#;pk0pnVaVWA+FF<*^zeKnM~v8 zGR|V+@TYC;lcxGsJk)?rZGe`GKM(%$H7LJjCKa!L;L*d>&)p99r1D{k?KyNj%dS^t z#0RGY{y6u%iRBNdHw2A%k_3J#;-KSK{Th{j{lW69h=b+_O*+)Kre;pYFR()54w^q; zJ2Za=b{slC+J}ZI9qOf=4yrmG6jeIZOJ)knADVv~4ujvC!^Afp zCVs_X;@2N0epA}`cKzdxf1`gakEZJ%Yo@jDAMNr#@B{MKrOhAtE%`@pNB)b`<}dv% z`Om^WgwZi=e)n(5-(fH7|3ljPPi6n>yAk+9*FR)*MFsxGoT5M zeFdMxnDYY10R4Vhk=a*Z!?x;&#Hb9R^Izbpg)q`3W(OEi~*?28xdT(v!5mXFN6q zS_cg3UUPpB$)H^1)DGv5xXpYt5MH5_{r?IuEkG>>Mm7~z=%Jn(rqSFOVVUm>p@%NDuuVvXVmod@VIxIk7HaExk)@ZL-?xB@0xP6QD?BPFAl~5JxLr4>h*YEwO|& zL8@T$SM+3uNOZV(!GD;EKURnJ)OX=7EA)OW$BJ`}{kR`W_y^jN#Qp(# zv5#e{Xi{o*g-NOCvqVwx7tCEO{(_u@65X{xntmMiA9^0ZVTnpSOClTAAu0b)^5t4k zOa3r&(1~I*KLh%U_CIaMLl*MrwoEnN1vu*|Eb#cI1A&J%iGK0 z-$FlET~nfd`Ml)-qGmE47l-|854S*bru}=g2uQe*EnSRG|vk}#j`PlY!v6xV`Z?DAoG)kRt zcDiOQ1DfUu=Up(G?dF>OE_jOtR70V@sUNLQoJrhu-qGI4z)Nh-OGp-SgFjj-0GA%zBU zKYE->4f-AoEYasVoCqMWSTAfUiGm3bL_VYL z(V39I76D}S&f~8I;IyAL`z~WJ$pa90g$UP1$WeDO^r=98t+3QP4R?>2*^PT}t$ACv zI{pN()zL44t$ymr1}0mLxt801UhIz@m%>`aKi7EvHl*XAB>ctBp4;+zy5Y%s9|bQd zaA!5N20R5bB8&+qvAveKwZi+#;KdUbpj)mv_H@fL^6oPC7&N^bHuyN9F*D&E-QaT2 zalU}ifiEruhf#Tura2Z{$6ZS@Mgm2Vrhb@X;kFCz7IO4g{D;25ssKJG1he_X1h&X5 z09O7$(G`;YFUi)+Hq4HWHcBzkznihGnm z&%EDiu{18jfFA~FF63vg7G{S{f<<5CpPxRzx?3VOf2Vf&^8-bbB)`-Ttc$%@)(^9R z)h2(LQy`6aAkLg(=JL~He7Z_7g6vAEUHp9gSp{pTZATD>EOV2bEQY`SgoX zIW|Kqz##+*lTtdg{KF8!TZE*QmIrbXY>x#rNhH~^Z;S>6PGCqQ8fdeNh$uH=dL?DI z#c(8t<^|wyUKPf|XVO}+7g~z)H|%h4felkv7JX+=6ph}ar%J`kg|7yGZLk^$cRW~UizXyxxbj|c5h&af6 z4wpz=Dc4r?;B!qpACB=P2R*z2{bHnkBF5Bc*cPaDkzoWgTnO=rLpC_q z8Eo{(lI;BNkoMkF_Qhtx;PN}N3T_o3V3Du9AHaz-A5LRiErCF?%l#&zY zN{A0k0JRYQ*PP8>H_9_@-ga+NNE8^|fTkcf1jtdo?mu8g$$6Km9=v(743Fq^Hz`E3 zO-v(ksrq~ZK?%}3VW#2mzR(TzgRyC_=xo9GT!k@8rw5dWLIxh-#RE#5ABCXC68XBU z!j!Lf!IsR}9bm1bCS8R@au*P)nGe0a8#jaM+F)G&dj^EJajC{*)k$b9{5#Od7BpT( z``D^*RRan4ThJ&18b&MF+L&@^6kb7nUmb!jfR1Q0#^t6A3gDq!PvU>00c^+GX6UE~mruUId4S69q7cMfs zK^`)#)97TOg8NSn^FE05zp8loLRUTmkLot9?PrTbuM}Bq;qd-zz=4b8Vx6bVS+NkXRznM~+RVUCYgh`I_Ko*=Gxb zgNbAyQ1b(HIczcEekvdv^}*bE05L@KC=6j=1TQItajBAv*y-fLQj}YPeVsoq0=AXV z`#X&*fu=8nvrWVhLL?PKHSE7OCK*j(?Urj3xTceDK<$qOt~N$3NeR{ba~OzdwgI#d z7##RWFli2|!ss9T1+~XJeA=z@WTSr{C~gwx%S`!1)+->_c`20etm_vGkUUbEZR~~N zW1Cp5sI>;iEK8Msq`wxt3wICqqilSU$s8vBQrs0*ac|gYa7=k1s z{4YGkJ}L6;rsOu0ZrL&$a|*K!gufE@kC-ZlmI`lU4Wi~poPQ*^!Fbt%r}hsHn;&bx zl>E0IVg3!6RwkD}AWijmZ>lxh17T2z{*a-EEX`swfl8 zL`xZEDF9OKHzj}KeG#1Rci{rPlgS$36gT>JAC}HlatO~RS#r?G1kC6X(|)UeqHk>w zYG^M1m)d(4U5u-@U`SCM1)zX}Nv8C8&}Z?eZaUd} zR+{W6-z>R6EBp|R`XP-2aS6~jmA8;y`9cpwy!LaT=)N~e+Co-Ilk-?yAbWUKY5%p@ zIzp@Cx;@a2_H4#;r;@fZxnm-X8f8}GPGfwHB1Jx^OFK(pI(THp1UErllmD#xxsB6# zG^ZW^-;hk&H2j~)|08Y7+vd+bME*E`B{34;#lc(`7k_R5fA^1b5s#PMbC<<5supJc zd{c^$rR+Wxjhd&TBi=caN8=6zdzA}s59Z>op2;1x!V4>=U5vnt$}@vSbKYjN^`tTZ zjb*+FLIqL3vxzuDLG}<{xrS*4*Dk4Fnm&2Fzkj2C>2+WN%(z=TaCcrB&g>XrCbimG z^y)_SAB};J3l<$KMY;(|mAB4#>nt7~z)amL#%kk;hJ6{YzNMR|fXmQzpU3G&n zgqkfin2Zl*mAgW*{E1)&GW)$gY9T;#VtFCd$m@4N&c_=YrjU%ie|gTsRo<((0g>WF zBg>a^{Cr{{*9UIgV>t5_)RXN%iGA&ic=TjKc)*)cI(yDl7n?{E2pl zeQhOM9v_(gnbHihP4BI%0?$t=(D?Bzmc}ANn4WE%M_AAjVYR$hHcIUrPpW)M|;`DIc zc&O2Q3(pwy&+0L~r_L?0ukbC}kpJe~wKF<=UosHVr%7I>|C~?v4qU^|u(_{4q;e$y zTo%rB`Wmc!zJWL_vDOz_;@h){nHv2AS3r*J+2apA%;JCo4&USHU`k`k@U`#J&J6tL zmHKi586Vq?@5++v+j1EF@Kk00-Q%`jVzmE8-h}{)aZAE+*{AKpSy>Re|ym zL}TG#qr~D=+DX{Jj;P744$Fz)N;?e0?53sxjPB8btL!p==FK*A24SZg557xJn0UEO%S&w>9!4t>@5_R>hzd$JD%gT9ox#-pF{v;F<8+ky&7@I>1=sE-sKd1>yXmqKX(Ansa0a( zl0>(vi}{JN6&b5cC8h3lg8oE1?5KQ2A?q<-B8k)x8g}H21Rni~#{*bdBi-$PM1bsi z->m{py8rl5%u0`M4rgV~?8XX+mKe@_@kc`P$<08TR z)2fcbM+Zc+e@2f(G@jZ)nk)p{5llWd$A>D^5ixR7b2cth=^nxNw5m=#xj9?Q#~c*w zpE6h|`t1M+i+(_;6bNmOBXmANc0@?VxG z4HqKpQ#uP-AV1Z^QkC~5%55}TmpnzJ+{T^}W^=J1cZ(6{E^B{pcB21c{KTl4=&S`1 zqxyT*5j3)%YZg_f=x}xoUCiuIM$XN@#NzkYgM~G|Ftx_y%Dwi=b2#v0P=oMWF>nL* z;@5cix>SVEOMQyIpMh&YS4NMC;hK9)076SRl;M#yAxXp`FGfuTo`*x58OuJgazkK5)IdKjn0EGyzw;Z7$H^)hQH~ zJjq8&uvQLCo1>TLITu6pK`>Xkf&ZO<V`8bGtA{L& zc@O;(i(>deuUZ0|032MxNY?Wa^zRK-ErFuI0uQD?op8qXl)*#^(P;m>?x*~P-&p$` zMhV=Sz*=D4uxu_IjHlRnI|<0KXOyEy)DGJ82glZgWSuYC&m?_Pn}fyCdhGM@jFMHbqF7@r{? zg?!Uskz*{tiTpNtwuNbQCd6lvL-5-`f)GCP-?tn2bBN?vKvi8;N!W)jCjlsMMZ!KG zzmkRH&s6LFK?pWZQCIvAptW7ZUYP-Wmo$1PdAQeao{%y+7Z&Q9*YSt71Wy&`XF-Nb>>h>gPhaM~=TP{N(gJht?3Br3} z-kx%TP_ErGa-R}aa>9DEP-y`ho>D%WUK3OrqDunGevQI{XFFN)-Q5P;OkB}y0Sg{BW%we zCpHJOJqtVT4M45=@udJ~%?mH%Efd)QX>k8IiCL&t_SR3&J5IDm=zmXu<_XSM+dc~z zkCmopT;#W$e{|KI4D_s)*0Xvo^w==1Iu29naFz=nix7=dg!6mgqINt8$I~KcOqvu# zVsceT{JH~o1l_d0!DBO)ZrqDGIofXtMjmXE+#r{;;n?%Lh{cJ-E-{&(&06WY2PYoX z_U7fx_`_z-cA!xGjrNTS8FGty%)SeOJSRX9B<5&Xm7jeA2f!nS8g^`PLNFfBme>iQ z5-|o`hV$ObNM~iGs=LHL2kXn{tOtcuar9!H#Q@*f?{brg%Lg>j55*!UX0$V9xO4M{sXaO zRuosJTa_9Dnk^s83W*v@F3FPZT)BKfHuM4g*-O%)ja6VZXWE?!4sSGivF8Cg5#*FH zNg!nsR7(1n5n)XbzTzMt(c=m898~zj(F7tjb2ya2Gp3G-Wk0OWST{5xB|KllYmC)r}usXg!=qnsK-gWn7pgP$**VkOf z(U1RXi?p}+{Bx|PiZ3EPP~9CI1Ik`{aT>~EWzkSCjC}$yms?jCu_Ymt?jvuR%aE$$ zvA&U+zpNgqKiu#$TbVS(eR`Vy`X;0vNQt_LJ{5RBI~6sHVtF_rP&DWj5BiWYSMFjo z36^1An0oV#US6P%O00)AQW0>v;)i1&Y>O2*fLS%Ksu0u!jkuF-4~rT%tqM z;X>t(J9c5V)?7RufP^kF8NUJxX)$E0?1CuwMqYIWQ_~(=?UK1N(p}+RUQ02BvYl^u zkghLVfGuS_bpqrimfl$$6NXO15V!pzKn^Y&kHKB{6~scqX<^6Qsfb(0I3aQp3fQz| z(*QBE6f<|&q5T13`E(X@%^nmJm#1w#CV%FelCl9g*f<_iQjJ}lO3QM)I$~b$qG2WN zL_$gF#z!u{jI}s#kTSa&*og6WagkcbLe1rM|Beq`1i1}h;bE2!lY7`#=>e;Jh+U^v z+oWhnD-{|PdaDJsI2x+WIJp82ZXy)NWmsEW*na^u-hYEsgC+WB{&L4@kKh^y<2Gog z6)s0m+UL+Dr__A8W8=g9q%D)GYE?PKm6?G>XvMgr?Q!bBew)Zdl+Z~Ej>CY~A@k4J zhFOgA>@)i7S$Dw-MbEi|zrCM9V7OZkya`yidPY`~iDR?_R8jhU5%8h@*n^a3`usMh= zIl*e-`oYjNNC$>~OO5vEHO87^rRQ;)GFYZ7k+P1M9Ti5dgEMtq_)>eQo*}`_eKmdN z8Ub{uIfl%ymHrq94X8i9<-+#*>uz26*n(y8&uTT#b)pd3hr(|hH+_+u^8hUhbDbc6(R9r;eA?v*~{v`)~`FRW+-oA zYl`v30vO$55#iYRUKb1!&BlwHDQ+b{A%O}7ps^RIzgCR7*QKaNg2=3&tF8_HecRxF zYzqFJlkopD$}}GBaZvm}y*C~HZ!@$V{sT??TfRLQ{@cCn@VEGjBVXynBVsKfg0%0| zCKQYZ6m4P0xXq|m?XP_6?09xm?qOjf6U{O{0Q-uccSVP|btUF-U(fN_jM7i|fQk|N z0@H!S^4KT@)@%=F^!^0hEuWM>u5I~sF_dqY@*jUFrF?(-@^5GPYt})M2Z}21M-Ch{ z(jDKg#{jXh8>3y_B*O_Y6p*=eB+d= z;y`ug_^KfdU6C_-HKICJ{jPTKlnE1Wu5yj5ttj+i5Vi?n7~1)&=LX#Jj$0JX=L~^eDWwCZyN;DR!5mxn zsa0MnvbySOIhW9_rw@l(s5Kq9Ao!hAv*WabdbKE6KP7ry~Y=W!UlECcNh~o)eht zA)FcEr9_zUtA`f-KywF*@k1}j;s&mi*^X?5$@#2e8BLizcA_wh6y$#wr>h&I67*WAlA}$YJ4?VDT zU+TVhAvVJ^rG<(YlI?J(w2@cLX^BFas(@+==!yjLW*I1a6LR=MUqe6bgDB9=!f*-o z3y267eJRX$?B)8~Y3njUTShimLUKq4ti0DzP&(VxvD zq5XviT)_tgshN3m;qpnl_456!x)~hm?MC^=CE4WS@qTWf?zF16_&HTQ@|!QT*SO4^ zTrm?C3Y|+BNo~_8-)0%SfZG@PMhkt&M`lG!PZ4mG zYvzSm-4EBttT0M&FWce~EEn}1jruNaIT>+ee=q8$_22A6*X_Rvb{kWM^Wj#tj(Ad* zyS(DLo+V+6;aQGsFq+z{h4vVohaA9zuPTyUq%sjXLPJ1Aa>dIi34Q77zr|O$Zpwvx zHEIQ8MZt1;6sEBM{W2ex)b-#<4m-InJ{ zs*T)E3zcRM`fsD>8xncj-=R>)3K06`hF@Y09{5!I?tdNoOH=3J=RO5y>?cUc9X&Jt zJ4{Ly>lIiywv0o6R8^Js&9i3l#*bs#PT}>;JTN3yh{n#dG4=bX4TU8C04qOgv1`1k z2fOgBwxAT4mk4Hs1xC^5Gi%-!+=iD0VV!0yyI1X>;Yqxi&&%uzeOte86Y3S**U2?2 zljB!#A$JTja3-^MA$2jbF>?1C@B|jVg)1Vu9fL{k6s5}sH#*Md-vROZC zM3@R$XeYdkk@W?GG^BrGQa1=6ns&~A1A&odf+Szgt31@)+#r!=$%M?Pg`B+pR~-Rp?+e;IXMUml7<^Chgz;x`G_dh-BAE}s3I4s+ODGTa(_h>1CBwrYE}Ov)xVf7^$KCB0w5JuJpmL{9M* zcoeJEXC178F23eKsRZbRV7;Y(y3sb97 zNv^8jlUS*n^&7=!`TFmR(;q7Nd&B@!|2?mrInf`^?Ci%~#5tCI_+EA@SGXrYL~}3? zhIv!i;kcVRtS?aMQP(f^>%*OR#~S_YC!p=CZRO!4*X(ET!S}~1T?n#eK>gOy7p`_j zyFp16-`~(`W33Rc(+2s&S9kI?{m{W5?yceZ$xB=dvX2IT`hxq0x`H~S6e7ysVZ__n zSMqJm{`;bT@`oR(LDM2%CtvNpy(rKXyi%pTsM!RfAPiKYr>8=I{aH_6xFOaTXcx9l zb(Dmb;IhBk?`@DTe7y5LK*T>gV~bsnG@{BSp-)?G1;%mt62nyke5??);!B_L>OYH& z^8Q*<{Y%27s6R@H*B@xB`j>>SLH(ns|4G^+LA@8>2k-^=qy9H%vi>KP3t`^wbzMpS zB_;jWMgLS1eq7Z*iu&(Y^*=+Uy=b`!L_z4HLQhYH!1|YjBdmW(;TqO|X|#*4b~Ec= z0{i-=&6sn4GTuv z$R?O1?=)ZV7f`4VngpRGLb|udjJ1{E$)x^YMWQ#9gr89~+6Ef^qG+^L&^x{F`zbJ% zsL;-BV30(QDiWTNH`D^3i+?|G*;aqP}(8N<#nkt=sA^{D#DV4O@aZC85nN zXL6Wwz4ke`y9SfNT(4oRPIGG7Qp=$}*X&mTj+8h`^y_k#Zz|q@1m|?1pf?$2h(EzF z$2O$2^-tu+@JYo&A#jVoFzG0YzDbZ56&o%qsr~t)cg&LbkNj{=gK$1x%E1_mTy=LN zd!T4&pdZ$kcMwh)i3(H!Z=(h+47CS-y^}ArvZQ~Lzr*ENNn$A2zfQBSF?L~NSz#dntTYwIm$X|^K+VJGRM$hS zLd^a(SB8+;c#_vR3JYGXxp64aGddDjb0eAA*mtq`CH$u(|7PWvG@m7fuS)ni{x42S z_F5v!cqYmJNKzU-5iaY?yYLO|i9cLRdmdj?YlhFh0t3jjA7p-0g43|~ZonJp7&%(j z!9}fB94ob&kC$>`U-}v64fSEMj zwe_m;uNU~&9RECt;Z^z<9-Nuvkz{Q$vy@X zN{Aco79()uTL^qRdt|f_eSlI1i8~>Dd80~<`45s$naKQBQrsOS0yn8&V49`a=O0S} zf@^EA>h!b7n0T7HaP2f$Bhluda5W4^g0vknGKX;p@+zxV!Z%UJRVe@eeGLwJ;!nhcoo zb~Ku1aelWSzs3T3na^pgKG~|ojhq(|zxe$YI3G!93H?UW%<2IvUt(s(^QYAB^Q{#?E@nQC1LLs1Va}0e&P`^{@y6D_OSS`lMKK(SfO^gOeIe#&(@Ds}9j;ltN1DrM7NpO2N_nabY~r25 z{SbpNf=lvQRe_CXCE}&2q`XGzW-a`VSlthGxzEHl*ST;f^BKNr_;F9>OUBc%(t1af z_f+Pu2V7rawX^CRwx~eHhLMzp*cFV`Atv`415V-9Q?6O%=#)6EQoD>D5h4MpRF&&@ zuo5Oe!(^mYJ{6ZRRRdrpm}q8Rqxn4-u5tSl(yW>PMYGae0rCY_@64u{#az6u&bX!CY)U~<2PW_*4X{H!23o=6hw^8m?iKi zNcYqD7kpihsE&-f#f3$Mtv+_r_usKOmm}R5Ko@LmB@B;*ABc zN;cLiBu0M-NXNwS8$$dZ#=fX=A2&zQOFg9CJS0FD48YMdcQE8pc#YE)49DGo0qz0) z7Nh@=eiHpV7S@?2&G!RPkIiRbov9`m&$XJfHkmbqvjzqF*l=7*4{4M+ zn928yw@>X{K$*5xE3AD1o~b+$wUQ}Lg`iR_G`|eA#PHv&^i&Hl4C;6B3Rn~_aFbgTU?=E6tQPfjhIeLt4F8Cr+?$f>Rcm1kylIFsko zLI+R~i5;F{*9!Md#p}ev_9fwNt>Yrah4!gmLpo3O6zd~)KutQS0wdm3Z01jbRcR(v zbE`318#x4oxPm`^{FLB6NWADN^p)}bCQdLyO(lA%+h6$kvGWw@rP-)&=p*ck^{YM*Ll7iA!*TBuMof$%)AL4wICStH?b$Z1Oy?34 zG$QITenfv14q`z{|K)hKk-^1S-*tGv z3p|Ta4bZs}bZ+#;R`^d?0{!L3l^3!Lk0L&ppor}+$J5Y919yv+tdUzw5yPdP%+gUU zMJJ_2l!|j>3>fnKl=+>q;4yOA*Q=$NRg(FuyszZbAFc>4>4(j zTMqxC%2)||RlT?r$a3f9>dV@0rRe6a4BlV5h5#Gl0NZ#J{hO2MPdWm5z9mAk@O-G#Oz>cLBXd2M+I~c#s}Ef6Js$S=r7$qjEBayKjt+i>N6Dvav7Ljf32>$a zGsP=BTJR2Bg{1j{@3JDeKPhv$x2K(D4#x3qa10G;02jjqIGKw`yfF@C!Z4h1i2Q}^ zh?L8{PTB@}WevW?1|~+KHlyGJOOhqnGO<);MG6c*#CID8Wl0`cuCk&7fKmTJvvS_Y!iM(Q19vk}hv z=oQozGduQGjd@Vdv;*ASm!w%kpdjtad%&w}s8;psStsBNDyEXq3g4bDd`){V@Sm_s>yWc=oCo@+dt`ja zta}>K`s-ch>3@Wh5@=yk{?&37z^Kc7M3k?t>sMmTSO$uA%#VpgF*65p)SrqSDipK1O>6&0}3!}a-4%yzS)D3fEp6VBe+ID1IHQ9 z=d>Y?Yk^{wnT?hiTWGmO1T3LZW}s-(T^<-+Sa+b0&Vl*>oa>FxMnmft=imAh&Y${Y zF+Hn!0(K~pW|>}N;4xGtjvsZQw#xh*9bgA(6J5_}-dx<)X$r$2TSI&ZrS;wln@Ztf$C<{M{5uNzuD;N<&S*3C7cacqgZXU~ zGpzdr2KqmNVh)+BR@j8~po9gBMi5x#Cz}44z&crA;W|UWdQWi7CXTPY3>?E*8m_OP zIB^pk#EXE%cdmd}J(KYsGhWh#aOv+yN3~&VvRfmXh={D9iw+c!?A5G&`0? zC5(+FV{E{HjVrX!ojB`vEqF5T7rK4D7=JDzCn`k{7xD%ohLZJvg@@*OJK%EIh1S6w zc1w$Cr>B4$*Ls;BW&2_A7?3=#2yNtfT^Rg*L?RNYmaj2zVg~_Q0GQnwoBw;jeE*_< zaEo1Q+LEb-v$4H>e?FQ&zQ0Cm1Xu9d4A$xVRn{0_IDSPF1BH4NXf$LH1*=8A2!4zC z0@rM_RxU)eZIP@pT*EL>+>;kz0RC+6HsVKf4f{+MdKd}Loa6zwWOgw^16AJ)FhMwH z-xL*Ym0+|$K9LsHh`fGso5*b!BQl&d_8GDuXPxFqzz2n(e<_H+Mh8@>bKyHUK#azi6 zv0tYhc{oRZN{xdN)(-qe3X-iKg=WPXDG@pGPFZcs9H^)IcxRlU22r z(09$mTP5*#!^!_GT)P=lPlu?gr~28ChH))`uVwRYPV?0K_ihwr&crb5m`coME zIEe++v7dZNvQ~0UL!~Kvx#o`9&vf&d0TbL2)E06s3wF@hCuJt>)xtxOlOrppBdKKO zWD&db%gQicKu*B0Z2DyCYCOROu%wBvsAR(0av_%=srqxLk%cD;01S%)0S5YBYvoUW zzWksQM{^!I29qV+F30^Lyls1;rsEc5{Z?FUgiZ{^nlH*V-F$KNYn`zz$x~31s`;FA zu|lXHi3sxK`a@%|VjSWF7}+&Q&KCFk!&!EyHA+Imy?*pA*eDOjF66{fCHnAE?kGBp z^RO{+@LB->^G*B@q)RnUb4^@2&b6#5bC;{45pt;<58rQhyniz;mvRmMsuA+ZJ^3`( z%vr2$aIXip{L1Hb)xAq!?cM+!SKXE1#g;EA$AH!4oc)h`afhq&^j)rUZHH#ZVIs$l z#oYmPLpPRyzrkOvO#0DWGgd4`V!v~fO1{MpK%ANjMJKe2JcK!`^9T`9jG%kKvH-73F7 z%I|LZ{r{1E`!W=@{a^g~j6dJ-X9<5+^QVbFv2lK~9_VgzOZ&EXc8ublSCrfPP34~S zj&e_5rrbdvD7WYnaeq@=40Q%bX1_B+XM}Suo$H+Q==^URgwK^WwRDP4MV_)B(RPvq|gq!{JJ&-haORE)w;b%n%`OW0lbOFlt|(HxX2z|J*` z_x&CzR{tN;9|7OQg?So}IX+ZyFo3Sq1^4;VHUv{>sGIzp zIvcw#1if|SZ#&j9KW!N_l!MC`nIDrwuOCw}O-yL~&>xkx43puwT@B6pd3?>wP$Am~ za4}HWJ^;d^wK3zpY2u;Y`rv~xe*J72zj%>WE44UN`=~t20`2o`3qTt<0oxGq`+bt~ zCpOBbDuZsdN!|{MwPj~`2O81QXJ0^b+f>Z{#WkJ;GdQ&Y>pj5J*t2u2xCIzXdE?bs?F z5U0NhA3Hd0;d|1Fp`9)2J_d;|mj^dp2HYY!i5 z=ydc)FyQw(415t8;YzG0xL%1jOWea}n?iWrYFoY*+`5Cp3F`*zscOydBRy6YMdw}X zf%9Y@u7SV`<4>3y{|QO@YN4B*4NT&CI@oHfJgs*BC1WR6RUKQqZ^Fc}zA9Jk-ieiC zZ>#FG+%ae*t`2CRRB=5Wa@61pM~jyY2UM8h;Hr#4t^Wb!<|PCs&rG7EHCV$oU4taL zU2~{g8j4YJac=Z`?00`xVDNiIlbEAsyvE z;k&vTS7Fy6t&(5L#{lFWqv@)t@GyFTHsm6$a;&Bw4V%x(>$M?4a#Gdx#y?O2v{llI z?j|f%_i6eCvCmTh=#m9#Euf=NpYfw`2?*GNg!hi3%Q2VPuaA8XieC;Q#@76+LlS|B z9|_681$ni?Jyl(dlJmg_`2e8lQ#2KH4TEwdNOE1|Hdo^pfk*GcYPKh8*-LS+ zKH6#t<07)>#$(fSMWTX>NQIV>=?8x#^MUhy=HsUD(Gv}8ete^xF zk-;TM;vHA)`fO;PMh6-_I=I%G4(!C}jL92M=eE2GI#9{cc_%Lb3^3vQ%rrTGPu)kw zFs1jQ@5#KmX1ZrZMa{5R#KwcZH)Y=-O$YFSJ*fj(A(*gc;fIl7JPY3wZ0seG=KOKetu3@ej3V-?({`4vQ=~MXAr|_pw;ZNT| z@dt*GynEf#_=wGR$coq|F5~5M6oiX>dgXJi`cw;g3Aq4D4kW;R^T;S6|B8nov4mWU z0YasLM?zZSA($pe$TSSHDh&p832|WRph7%m$Q$txuNiV9re7*ezzlH#pb7y(0_UHJ zkPH=aYv*{HOcin*%tp*yP8HIe2yv^BD%i-GX*??AM3_LCAzl@-HW3m~AvMs;lP6;^|WU)e2OZ_`3#3N}Q!0wlo#w#Jk7;zC2b_|9{ zifu~t$z)$*e#EKs4I(as+aS$h*9YE!1o?i~vs_1LMh`y70%p!vLRbZ!k0~e9fxpkE z-VHKH78KuU_HQ)%My>xB#&JK2&JD*kjh}F=JbKUJ%lEK+FW_qN^2?0-XrIi^lqkQ< zcn1)f4(0nOr>Fb|Zzuci3VOfCN5_4^sAecs1swtioQDg*BF!k4uB7udF z8TA56G4o(o;1wi@8^Iz&gx|^Zxg$#Y$kJ#ya<)uJ7S?h8@Fy7(PpuIYEhFMLWhV(G z=0gma1bbF?l#QI)EOXdNVr!gz+DLvwv=5oncuKNLy;!CgRU^U+| z3W%oSXRWW|_(2MhiXOPckDnG52jjyivhc%45`K)j2}PKBh##{OKXHK{-DLdEGVwz= z8rqQ_KWlv!#}A@V@Po^;_!-9!AIARxj?fPuN%%2p2^M2!9^%KW#7|t{M>iS22U-;U z5DxstB6Ax0S?jwveh{C6A6%Bj&p3YgFn&c2!4Drv_%W)Vi68vL502m`F7Tt9jNdLp z;fHYG_x_%?_$AhduDfS}g=LKx#}ndE@Ptb|`5DI(AI4P{p7=<@lTmk~C^HZ7WLDBq zT;NGJ8PCg1JP{5&dlS#H_B`*Aodn#((v93V(zH|NlYeBf`HXJ^ld`f4Ib-pK<*0VdPl&<0A=w zMxAHk4?ppTBlwF8{OKm+-_^t);lTfEEIp41|5$qbG2apXhfDnV8OI+V##KO4=#P&i z{26s8P%!fle`Y2BhztDbCgXqEzZLxvPX0e){OxJ^2NwGZ{|tpcJ`?z7fd9Ef=Qx6d z$@n8`(Jm8zWF`KDMEvOze}YPy4d`1<{4<3Ak@?8z-yuEznI`_33V(bi@XrMQqa1~Q zW(xj@+J`l#&>vZeKOqr+y2PKLlJH-R^Y$DE5l;R`<|D(uQ+oWJCjL%^KRy%qJHh{P z{GBQIBkDX0e`F>8ghc%55`Th9!oRD9zf<^s=aJ%%SI^VPf1BIH->vY+X99mW_#a3r z`nyx`N7S7_LFkXH#GjCeKV9NaP)Yb-w%Me=TloKo@rTJ&I{ZB*{vL%tJ`?zR!2c*m z;qOVoA5n{TnD`?r@h2qWPnY-;R1*F=uiYU3c!d9v`N;U^g7o-%P5iwIe|#qJ_k#aX zj>6xYfTwPs{%{JWq#tI&Py;xMU>b zpJ6}?RkXw zyVBzim4)E%R`^3%pTOU3T*WoGqQ5%@f46ZbP%!f-`~gYuhb#C4R1*G|ePz*~3XR@J zj(^|u_L+uvhJEr@?I(&}RLHTNMwcI+K)Cgp7&n;Da$+B`(>#1lN66P`zF` z+Na~}>z>MMxw`{~lE(`+8yBMz(5kEb4UPL7)Vaw97)`+R8mHDDmu#G$XH3W1l6oZs zPIGDl&dx(NQ{f-_4|L>c#1znRKyll=5R4bk5h!QpX;z+iEs2s7FqMM8JvIK-A$lO5 zIE@E&H+Mh^M>(fCj1O4S5D$Dy;9L4ZpeP5AkJ_u;F8f}b8}Q&N3E8Jw>iWkH*FOx` zz-UVvsEMFJ(M{*|<91rh&N2{4EP}EQ2 zPaCHU+3=A;qb5g(Vr9YR=wf+#&?7cvEz3)+Vgf~*3t9f@D!=9e0J{KK;xz%Rv^;C* zQ2^ez06_hE+(X!#3->vME$74*kwNxEEKA-Vd9X!5(@q-Q?kMYIU zl5_BQFXR6UshhTbrXuoDB%+;)hqvG5%Y7=en1Lw^_FYU<7VNpuyroP-x=}QFfpQmn zE!=LdP8haZ3R25Ver8?-uxYu9tuX6kHw;xz?2AxJ7w#hCpc8i9q>G~jC$`I>#b5GM({=Y2 z_*^s1Z(Pa0QN_R@_-o~ZLGUK}YWD|#h^y{L^+6_f)n$WHfub$vbEwEd5@-!@71|yo z3>3Y?P}j^y@Bx#?nhW?-H)dDd8- zO_pZ|JX&p(Xlk|1%GobS2Pa~LYx(v-EcX81?TthltCuO|?;oh?guhEX{PFT<6!HfI zOtW%?0#iOi+|a(8A}v4`}vX@BjLJC;R~i{CN3uFdSU}Xq7?_f<}F(`k{SeOP7udbs85M z+V{ZHP$xLQz^b7W|G?*cTbGik(kj#Y?nr#7CYs)N6Qk3_)OZ+CBaJt`Z=*`JMmfJF zPmNddw`=g}eFF+eL^*SnGfz2<%4u89L3$_bU%>ykR|}VSvkUYj7vPOkS6!y^WxDRp z5(dst-{=Tk_&t+1>LDdMLU-juN61k=bOaB5R!8`~`VgL~tH;M2$Fza{Z0CdLJhgP#r9G#GGSGlKHTxI1d}r!hLfU}LYS;GHBtFxE+hKw7lM{J<0h7VM z9Fx;;wEi3AAn=@ybNqc`U=u&tMDGZ`7^iofGdu$vQ-65|LUezhU%)kfa*Ym@z&LOa z+A0j>Cj+_4JL1pZXU8sAO(*>M$w(@2I4y@q^r12Rb@BMi5m++DFCLY0=ODUYyO0!HDkbkuA1BWB56&ffE9*K!XN>5oEPvWmf~mX zDE!Q*07sP%?L($R4ajsrmrMtI$#jAT93ldTn7}zGDmMdsO*z2VOau6u8iI$IAb604 z;8AgcN6iUdaEC+W;ShT`Kp$o++ha>j(FH_FVIk&Ws!~T81sLUjF$HG%!*k7$znTKG z{P{*R01#`Fo=o@|sy( z&D)#IkoR`L!`{J86ked5_oOd{VK7L`@a?gd3$XFZ+xPqL#KotsyI(PT9CW*`;8Fqz zck6@e3_+m@0sKsg;Ks24!zocASrK*zX!VU%WH{{F8RAAYU59J0CQYRKlAKOq!Xe=ME$k!D}2 z+4nDNno-jaV*m(vE3m1V62Z@1EWYL*A}f%D zG10Pcr9T-_AIvY!I->q1{g?Q0(IOt%2zTpi4qC3hnANO?5*; z!JXk@O)iGn+|`@VBK#QcJ$w&>mp1aH% zBI;rcf91m)@iTHRer^b8wLhs!)m*ZPjn&A;n#;yQ)OJRhnWr@+HCH|=Q{l!>HPNf_ z7VuXiUNxnq{4FC+HKQunEeQlv#d8)h68BdQ<%dAzdm{2Z5&52oeBTa{H%#)Htn=G( zIq2BO2+nVxgi-;^B+P9w^Mp2U1P`c*CZm$m)ahJs;bI8ROR?a>m6Dv7Vy-%dbJg28 zSA{VRS7+nnt6B3oG^x zxL6@z153iK_bN9+7RC3Yjmn+ND;@Fuf>*io0?KV@gxm6W0Kwdcf0`FRQZQU88Lku! zSIUMfg~OH7-=9$w>TAj#HsGP?AzA+ z0-VXyQ|~lA5t@E53M+$CJdQZV0sz`!xP2+ksE6~^@N`Aj2_7UJ)71o z#Dr@$t=nvBx7qY=lNH=1Yq(8TaZBSdI~fYO#Zg>_yz-?u5IM<+Zm_1?)^f$W<%*Nb6SV~rYpz;6#%Bkxcg|Wao*eNwGB;2UR1)#>R=Otc||FKPnhs7D@ePJ zM+#@d_vBzl+IZ?MoXv>0+1}$%1FXT3Hm>%4?@3IeNF68XG88}A4R&@9hgM|Arsz~h z0}}9}t=zQmrF=-+G#T8?VCuFj@!T^sZ0eMT1JFDsH0EdVDw-I&lB2EnXWe3FP94lb z?}aYgo}C=78VnSSd#M2qqt^HDGIzs?0wS)HX<$YHDeBmymQ~({QzX7Pw9HDmd}!!< z;OcDnL1NO@IswMaA8IBE8z8e#SaKFKUT{nfw;&|wL&MVCc7?|2qoOxjwMnKQiiUa| z%}379ZTKcRjkM2ZD@2;aDq7sO<@dCbngv+;FPgW>IS#!ZMA!5OIMm|Q3+4=<6;_|@ zUYCNWReVU|{X^bp0K6((oQJ29aMZ%w1u@_L!hVJB*p=50({P;dIS+?&*ds}Me`u@f zq9I+%(OHgyJfTtU4O80;9@Wm6&2JUFqyJ2)96nO%NB;ISz#==ru3d4$XD0&qm!^T* z(1#TEG{Edz@l^g&i#|*T3P6*{3P9*Mo<80K0&U^04{8?r3S0^Tv{e;Ke(<#$`JsRo zDK&zEB$4q@;t9&f|E>Jl_uBtP{-B~wxu__V>Jx=*Yk3n0iGbM<@Wte#X79PJ| zuR*xrhJXt-y`H?m+XBwP<1ORqIo+=ZN)eAsxhqf5>;00n>R4Q+b3MwyRS4ZhSUF<& zifwA)`Y#ykS+$#hZ1U6v9$~oK)6ce}*fqav6|PIq%9D(aPxJdRKkc7^<$ID}@qcq8 z^(~Z$ZCOXf#~BFCnoIuaHI!m#C`ORH2AnlWa8i!8XASS^z|LGg5n`V&z}g0%3@cz* zI}U5lKV%;OKbyr2W-+k4cMJo@CQopTVOPmRmlz7YaXXeusYeq3HaFssLjv8yFun<; zJ$|I$vFWf$i%6n;(hnWAm*4=*m4K0Wus!8}w#Y9I+Ctv^hE-PD^kW}Uj5m*Yz|Ysb z1evf)&`5_vDMnGeY{Zc@-xvJVR+)=iz-*OAm4s&nkir*i#6!&=!3M(CFc{w$_b7}w z2C?n_BUw(CEFN=&@P&qXOF|P0aEMDC`YQ>2XnX>*F`Qg`uN*MUF*f=$@JrMmbq}fn z)WCW~^oO8>Y7T1P=H?7cl>zIo2ZIHMz^1X;d>=IAO1k*B6>hmn__2W+K9J<`=82EL zcuo*+((!>qC`+3$8h{Pf_vwd8I}WtzBAP)COkhM{bE$}Hz)5!{!Ao>sE4(sxh(Lsd zXS+bss|=9v@%UsJY4P9x)%XKKZrvd>AuSB9LoFtw7SiS;Vr!BIrfU$+eg@f0B0)G~ z5Sp-3Mjwz$jZql%wa^=CjNMk#TBHTUz;b$Z1^eo=*qZMYYo!Zw{(|sZ4{LJ^v*@(xJ ze>txsSZn$=Q`67JU77waKy-(??bSGGuXR0synH;IT84=jHjs>!Nzw86GhGXufxTx; z?!NG7RZj1*QVt6U=REu|%4%DVOYU#JD;b)_bqQDQmpsdC<$R727)2|9$zbeCg?rch zAt51O$y- zG|{N>+C;%7BAOuRjwCe-tti@3FO*ho5podm7CZ@ZdN?(;wzbv1+Uu*mT5Bzct%)EP zt;)qJ%G-La?&GnF+E+kY^ZR_)?0qh|sPFs!|2z*ld(WO(v(}n5Yu2n;Gvi;D0q*#- zdfmt4?~W5NmrUXuwg3-eV1(a$Njz;iu^~M0NPe4AfBmBYOwD*o)2p-W=<{U!86WmC zOgO{@y|=+%bBdwN%BFGJUl_tn=fMa{(qPOG^3KolU)l=@(j;!BGp19S^2+MvBg!w` z+c4;_R2EE79;-{{739{7C7yb0i_EE6`8XZ>b%Ti%1t9W1r}lk%Pp>e9{O@nQ-TS-h z_rHr-k(V(8{?B>Isjp7_S1PSk~>IYklbNkN=;jd_I21QDqjkp7Otc=3~Bp z_1upx|JLk}{=RS9M}PnImfqh#ihrq3&c9N`2gSpRd>+BlFBh75JkSb%UiQ?JU;Ot+ z^6yEGNBt=N9(Q|hXG1>xUzdE?t9(E|J_xyQiS?2Xw-jG&8P11sQ`P-67+3l4t?4DB zh*tH5onb%7$13|4z{g(^!1v$S)(a4-hRsPcFHr#Tp8 z%JuBv4q7g~1yCSASIN;Otj%N(oEtD7+=I?4`L zj;$$O)uh2>8T-#Tr@hP7XbR40&SSgtH0M%xzFc^JZCT`jmZNKD9NjvYGyjIJI!d4> z0jdv}*Shk+e8l-BM&Fl1E+tB#ZU(gsuAMPBdL|D=wKIyM4Ls~!J7e!?Ee}I#XAFsc z%1g8qyYYWUvCa-|fiW{mnJdM*FmcwDuhJAm=P%#Bb^ubRTfBFHc)>#^_NFKo!c^Fu_yeo)K8-v6ikcHXKd8`HZg^VGt0O?V9fyd z{pjIb9u9PYf#Aj2=xb`aa^=wQZwdJu$PWWWOL2I9Df|PSfPV)?{?Jl3 zw{Aw6Nz6DnId0WVHS^4Y(A@K@;`$W4&b%ObaSr}yRn*S%^s#y9k-xh}uv zWF7@p|K~oU{zqd%_xoVxqzcfbE*9v9;o9D4EZpW@$!?tb{UFdsr5{~G(j|HOcQ z*8r@&E2d20M~`>SxT{0hI5K{@Y1X8lJ=C}wr-Fo|tmsq9No zesn0|(P6SHYp0hwQU6%|9h4tR2N|$`M3&tEmHqHYGUlJ(Wde3?KMi~u@`ixXTk3dn z8sJl0E>cxHqbhnh4@Y*^&Nwm(U(c3AR!2u7k+n!=^8z+ zx@#yIk04_osL?*KkiORtnNrBP(6%#=%S zotu^3;C$9oLjFb`D6QQu%0*2rNWqNS=y=An`q~-wrfnUkkCDv1_QwGRh2*L{CjQWk z&sqIiz|x+7H>LZqe@1@EkbgFQ90kt?*G?ZCt>B@kc6w11OT!DsS4KN1ErsI#xTN-r zEbGkeKh8#3Y-0@kXMDL_O<^r@5#wf+SJzS%os}bHiP>oF`cnVxhpekj4#!F?Qa4ue zaAuXi$$h3RBzv*0YA1QIHPtrS`}gv_U#sR^)^Jp)SOrQ`UQUPlWc??a)Bd4+NfC{x zoj#&Ju4E;^CDEKt(Sa>%YBv00O@Ahg<^EKmT9Czj+||Cw?^i ztb83V>GS~8N50;BAP>b*zKs6qS^DWZ`$f4QCC~miRNOF5aFL>i9;L5FkO-u3cA5X& zgZ*Ql&+kmrPem znNrHE+@vL3?^ar0u9R|1IdaJnN~uyxm8Bf8WHbU%T|2!xI-G}^+UYe&hV*-XY9-Tv zuK%2mLnEI@kq!%+giq>0k&bF|guN)zafrRm;C@Z@rAWs}dvBRV-dT|ji``7L%n9Uc zPNd^qnvI?}pWO4g{?OiR?Va-9YU4H1feY9?_TjX`bxF>TUX@Y$r{;7=j?eKDpLhMT zHk&15LiFyNqbyG=n!r|v&Yu^;;^EBs{(rB`)G|HHf(CKDpNFptN&l&AF6=!UfR+nw zv-p;-(X-P8KO8nIiQ9t27xhb2zP)pG!a3z9q zU<(&X?9K1?nk~ex#$G$Pv$MYK!vi86KN+n0R#d8-7r!IevJoEczR7=vl@02Tw4bDm zv0a4Lmg|YV0ak>Ib=!6Cv^EWhOMVf)!u!2q zyNe_3H&Lc-@d0I#juVMI5?E<`%o>W>$|q(w57^)P2+h0oFeqz@H|=j6nhH&^ z-7s7H;fb3;^r1J3UWg*HZv5#|_GD3cIs94uRpZZ0wT|PD7veY1;a8i*PX)p6^~W53 zdhLT>FaFermCp$(Ur8YNI+~z2>Yk|}7uSa%mdFmWh69I2kGJqUt9(FVniVn&m18Zn z$>F%@U|MQ~!||vrr?6q1BrSHF`bLpB#cX_q-J6*niT`ZUM%Pw?)Q4BS+Nve2etuB> z23P%62T}bkmm7;Nb1V`~En)TZUG)*Go>}h-yUZlLpX7h_23Nm8^{GEu^d?stX4#P} zdb-#9$t?=Bz8{nr<$S?{lGvrI*UD5(0k zU*^iXWu20){jIEURL13M6oHs25Kqm{yTD81mw)@Og@49&yBt?@u9kM==MMlCjGw51 z1+@6}jGMa_wlco$;d7@Q(Cn@Lus+KwP>hh(cZ@lg;C?5`ezB}Kb)UOlz-H( z@(7xgV~pk!7CakOi8D*NXLI4f9;+Xb2PW*rMbisQA`c87vwZko^~)!WVOix?x`Tf+ ze|l}T%qftoDJs8jz}{_GVP^GGmjb&aFm@7{~cT4H+&7aZ*MJg!|bJK2!6 z`&3=IQy6;A+&bQ&;OFr2cZDdWzu5hLmT(n5{F7D6cY#w_aOaG0>3!~e-o=4JKz2w>447zmz_bxu3 zN0!HhZUj=<8k2tx3!MQ$M}!1%e?2NGPvP{U(Bc2hEdEvCe?Z&rkymj;D*SERJtE3( zAg?<8DH7#r<*~AD_vk1=VP0)#x~y&Y{y~nCw%rE=k9Z3e5X2ZHuCrX{pMagZ>LBWI zJGN|fc#*iI~ zn%~&GZ$W2zaLq>QvNci1DC-yg;1F!zkh44v8T<(Wd}56kA26a-3lCODqP`xOT4GHW zZ9Uvn<}crdr1hT-(eLzczdOKx;PvguvOi||KMR*iDR&kvX-XV+?!{bSo;cRyr?Kwo z>-S@W{@~`sC8LSjm^r#Qt@|09J6>IMZFAyMl0M6@!RRrcz>Q;nSyEEa6hEfYHsE49 z78t*uIEmHx5xj8))8wHg1q~LI&>VlcF}~Gb@R}`@&60_lUBLf-PLa!xRS`ws`9FO% z%n4GTdw)};;$+set8cH8Cl;VQTG6MroB(!uDuN*Ig8c?er;9Z!*tb}I2= zwZ)y0j&6H2yZ!+lBM-hjWZ@vZ4VeBmK2N4j>(WfP)f_BANj#5GapuPhY);U6S#CLh z+37){PVyem8fn|D1%m`9DhH4 zIa%~*rAfoD|A92Da!L2Oq}!GBGm>(YqF7MoU-`3ud**z3cQqqei%mi@QS$wS-Vul{K+ z*6H8$s>9%C?jKdRIo?YYceY(kKN?iCk^67mRj}EP^mSL^#Z;*Fy@opd_X$M^bldc> zK6n49!LJDWzu@nyRjW%evmgOY>pz$+8_AU25TZFi`HtP0@=LPipZZBaYdTZjYNpmA z7kksJ%pq+38vIayU}^^<4F zEo!%ViNYji5X4b!VdO|oEQS>HH-3foz0p{^&)B!1scv2LI4`!Ote`&f?R6#}rXDoJ zcy-;junQf#{a5eXB>_+}VN=QR|NN=Z@~bDIWqCy?O}1!ky-#SA`)~ayXy9xYR3u7y zYGSC*a#(MVj=oEn)CBakh`u=jJgoKPx~H>Ecmtac#tOVaTw~gL zlA~fv`bek{ePcz43JIn9ypkN-FT=ilOQb`-1u>CW+ZHUyqHmwY(2yveieEDIC6uoY zr>Aer%HXEdgr2hK*JrJ2rAZYu~yY-tFHZACr*c#5q``B?n)q zT1GH>G*xWzlB3RHaN1nlT(`EhwlO)QQ1Z?A6nz0f{O1J>W$`us<%gq4`{BX!R%Lo< zV`A!Nj%lB{S+Q8rleETcJ|5m89S@@m(+8Q$o3?Gaa81r51Dqv=zw#nQ-^iAS%e5?_ z?k|>k7EJ&a)m~4xDrPm~@#{}g6IHAEydVUOpoD<+v{T4>e;=@5Mf`z&DsPT&ZLWB% zkzx9*#3g&N0HJZawXPXvh!HQsh&|2pFoxS7BZL8Pb3FBK+*A|QoRyfmS1E1Bt(2*g zc{kgom(bQPZzVir!d?AKuI^H=N`3C%0~vvl2Ohtv|D6?1(!HC+|Ni^7a!9b^+je-7 z-wxG6f-98sm-2lRbG~c+rr&}=p8xB2>8FpX!S!D`C4&BoR+?Jbk|@P&+^)M*(}V0v zP}by^H&q@aW{;PysAUFT&du(zmy38hCiX#LYmx3){S*^#|8=I!kq5|*1Na!pSGAgf zz(UGd^toM7N;Pvkr?qoMmb^{V;@u6g4TTLmyYZy)_Sm$@)D6>;4aFT>rbVW0kZu^( zfDu!$aBxFx2=%PEXEGbwm3)?^9EGG;t10z8Z+f30Ad+Fbe z@vf=yO*^JVep}4#^xdEoEon$FJYoN*K1A#~wnW;eNQ+<@jP~zg{wT?1N5Dn}d!zAC zvLf=^YZ{aFgWaX|r_B`)W>${Jmc^q)cIz+c{rxXz${)GGo2>0XkvqHOD{o00A9?V# zy%t={9oBKKrF^`m$2JAT*QFM#&uxsJ0Ld>FE;wdt{E>$4U4!Uf(@=Wj)eetwC2jZA zc$c;gu%`70)fQQ4HJkqz7NL#(UJrNsS_4D1u_tI6@K24TmgQ3`55|L175I;LuESkc z5Zx#KPWOj{I^K^S0;5lyA23?_d3Cesq!1)BJAw*yL!^86ARMc$Lsnu(^rVYca=dTP zj!5@j=%{)PN%({OrEJ}D*78*YcF+9yrP9@a5uCD~$6JTG`K31e05ucmd2|Rhy;fbw z$#;%_sZ5F)Fd>X>bq*89-!ugR7#{nX>E`RERz?asVL?sTpTs!$aOL3o z$gS&inK>GSiG#q-5mWrD_6W3+08LWSYeGQHqtAMvjr7KoK`u-bBKJdFkK)FoqHhNU zP}W+YATv+wE)g0`mIit8=X*A-lqlc5SL>MAi~mN<_vJsUlx()NP-F@5zIPY4j)=YZ zVfcmVq=J-VYds9PII`qN|C8XW&uKv)0+x+T)Ep;qNlS*@4Zo2C12%KaRxEzlaS zjrO?NzWY`MQj0%>yDQQbspDVDL2mZm80Qx6=@8peoMw5c%bKWKWdV`xV*vaMM_UC&qDSpN1uz*EX} zezE_P-^y%1L0)ZrL>1$kfpWvq#}^@UP>aw(Saq4dK-st$JC4^Nqf975WD zq?P*1+14d$?x!(?s|9a7x9AJDO3(h6?pL7bBaE8axFGZl^X=)w1Mi;Is6bv0cX8a$(x7v~>Yls)Sdq`B z%fTn~i~j~H68-(7m$k;OHFz~rLP;PNLerfKa9WpxHyqnJMNVh^4k{Ka_wIy>dTD(Ubm3LZq5 zq)!#O(n;vwaP;35r2EzHgGI7vA9Wqjn$PoRN!K%Xp(}xk+9<4w3jIRBY8^*adx;TV zT|;r?rZWJp0<*&PV{D%eTmDOou6|j&WX4zMr)LebtcafKo?m#jnTVT%EkYCTzMM(s zE0+L0Uh=P(H0hrBhNKD(m;4v+{t(uL8l4}XdHF_?LOd`^Bs8;_ia%&2_oPf7nGtQ< z^iQDr_KQWF*4S7(U#5j%Wtyibi47zaBNF4uMT_OV?S9F+|2&;UMPHpGFrI5EinST*@traLH{@#C3CAMWpr2HqR|9%NW z42EfF7=dEdE~ELS$&-)wy5A`8totC+eyy0v)$kP`cy-S#ikcgisic=YnOW+9PQ^vQP}NoR~qd%=s3+kZ7>_40UZ@`l$XGI$y;*uNP6GiyI4Gqa^@N%2-G zD`H;2tgXA)Y={d9^Kt+EVZRA`wUkt;>1Y3$Zw5?OV}UmsEp1*kGh_ z+q%f=ta~QXF5{%qiLTU&;v)Py=@S0byg!ZDUn<_wlpKCiZ1Tp}L_U3O=1KT} z{o7d!vA#B=cv@rx%5Mki+bj|h%p7kcrp^9zNN|!WOLvCyR3QRg`#llR$8PQNJ~WEN z?~@^UeW9J8yUz!GsC&Xux1^`yL$B`LMb{8U%M##gP&cZEX-N>VYRqp9wZ=ss%b z!Nk(gt+j2D;YGt;4degcMOg{#s44b;%mM~$fvC$Gh6^10+x<?$< z-LtLVI$E85d~-4Wy5?e z+H=gX0y_hj)j0pH&#N+a>3Hi;(=jtB`P0hu8=E{*#5p6(OP9NCA)NK;C64#YAT>~z z3W;Fp6RyZzImSz3FZ$aK6;vSvXb_qyOPN3IOhGpJOa3KyO{C))RY$HWm|rUVF_Vk_ z+6KD2raN@2^|@TP*Yj0|R8^-T>t7XAP^PQ&3JU6VCPlp$X=X#MGA4`mhe+nD{=P<^ zjrV4RPN$;jgy>9sbwJ`Ku|6~aacH$Fuqf~J->0)l$$_C!2(A8)G-+@P_U^C5H>b}Y z@(ou8eV*yF$Mv!f0{`?GLEDznnCTLTZUs`}bIgIUL$};9c3$$0d1OEf;0^%k{60FEevTx(fW?p6tk|dJrn)C1@Enx3lN5D4V;wikW!R zhYS46vojURi&VV7D-qByK}q+sf8?^De)Ku2t)?r-0%K;+t^n%>Y&!k*n}US=cdCnY zfy3FQ$@}!U^h5n^9UFf}iKCLE_D2FrykrBI)ok?t;?P1@IT^Y%MCp^n2Sk>A1K^>2 znN(T*_2NP4(nt7Mj|7if`hlLVMQap&`C_BwjR9Z}F1-_=!zE#>x_nUi6;6CQAOykAHx{ zV4|%^66ws*e<2x1%H-cG*ZQI#@uPnX)zjk~>bowZ$2tk^@7Q=<$ zJe@X{p#R2SWja~@(H{a9;mrvHe?+1E-BTZ+s5DpI$cjh;N<>ICwwwR{V z+E(ItFV+oKvtZPQo@dlFgpO}$Z5BeMo%H{o{#(&~^55(^ZFf&>@~!_>f%QQQuba{k zBYK)GsJK_0Kq?6|Xk}JID=$u;qh_CHzEK;4=J+jR9eMMhzTRmv_~(@hD;=Ja9FA16 zqmMZly7Caq9XO3?RdH30_WO}lFZRg4V5RegY<)`-Grw`GPcUkI^MPBMDxQhG7HO{7 z)DU|y(pa~HVG*8`iyZ(5jwoF7FBiW!*66!`dq5vPuhhjzmVfb`LY7x12d0{!BsqMC z5Ii$Es>@5B11ub3ngb%xbNmHkRDfm8b{vZ6LH~=EAhtMilSNMrGVeg~6HJlT93Pt0 zy(H4fw9vEzDg7lKeT2dURKz3u$_JXYsdxLE-u<~L`IE}U(BoVT6@=5@QA%c^0PYM9S7wz#IN!EBBlQzO6q zj8>M`Ol#jBt@q%rxm@DAG=5z3s*}T6Au!!jV}yf%@<{~dI7m8QXntpNVoWn$-Qf*w zlL|Vcth&9L9yT>Gckr~1SE*#}wDwn{wV84G^Tj=nN7@roNi590^_nVkNcV=DnoA~T znMbkyCVldvm=CVLev=Pn-gogXabbBI{UJ=6I)zH4{YN;Sn%Ld2LnXl81TAqEEOznK zO^KfbEWJdh9A^1_HwBvF+fw!L8)c4cb{dFK98K4*u;!7B-ldPpqAzY8R)BqS>h7L( zx(iI1P&Ul}pRGWbG5^2SayIcRQBRNaZ@%4;F97JY@Jq8|&J|itPTQvwZz*qzw^T`F z4H0DM6nzvyUgCV}VY+SyH`=`nD}wfNUCeL%K+HDh=X~(nANzRU&M?70ns>RNTt&_w zr+1+!$|dU7-&~iZRxvy{EX8HlvK{!`VR>;k6;SlTH4W{B&57B?G)SafCSNl~%-qiA zy4RzBSEF>1)W~+MCi!nu{@~7C1d!GjFn*q`>Rp@J9MXwLt{A$8L=2nY$R+@pAgUJ$ zs*a|z=2SDLq8hfzrY~ONymETD1y%H4M<^r)8{ux`$oD}0)5FZC(_rqJNITJaaP^ML zHsDI2LOvD#Px*x89P!~k2+;WY_2}ub#{xH5G|DASR#GuZ4ef&~IrIs3vi0T%)Y+J5 zC~d0S6@5*WZ?J^(U}nmH@Eba{A=)SjoELVkkO)iy>t|w|3W;$U^`ri<%@RYEgQ`h) z2!`^q7zFpuM~wzj0`(cH-6Sq-`;|xltlz`9_KSz*FAU|%m2d(RW|lfe-t)|)?4abo zalIN)Su`CIRdfstrtEl>x`|cYV2+nRztj5FY6Ku$qurbMs+R#5)B2;o<2t&+lR1+^ z9-VzU2mAy3h5;7`tI%sPbt)@v4r5PQcI+`*D``Gz<`);b_-79nQ}2O?;l<9jMbaZP)9%^}*WiuOy;+n$%}boYhJYQ>H$@z3 z<_l$h>k5-19GwQjAj+J9^Hu4!s*8LJ0KSCYv?V?CPvGlLM2&o#H7&^61DC1BKkD}g zK(gqxJtpIquSK9gebfN9$XxvA*Y@Assf!p6!uGi=+diI*ifg57X#o1(0rVt~HQGnA z3%v_63%wO;$2oy@w!y#ouc|8`aF&@>gt^rLT>Pq5zFIG7%aUkw0WVApr2}?o+V3S| zUF5{iSA4bcHu(pe zE1c5}TD0=X4_0%TKbQ3!TltjJSOWvQ{yB>xHu-WDXr))Ql=}^q$yOs6c*_0X$|-J` z#2czQtxMh{?F5HtzWQ+W(7SL=zlr`ktNUADo_$Sj`=l}6EkL`bZ{ziG%|K>00 z+y89;_^^aGxNiDj9kXG_T;xP7X$|({;)fQ6{t+03Typ}9gaf@LAE3?iw1B*c^Md_k z+>W?8UaUr-HFZ)ZZK7sU45!1ROYlH&2+SPX-T&V8{fC8`{ozl7sI0n5Y1WwKPT;?~ zFwiX_ey8Q)2X4XnJ3E#ea)+rALGFKX6v?lz&P67DV|aeUz$d(XBK|f9__N1@(>9_f zy5@==$NI4jvpGEB4X>L%+%~zxe~vcLaX~n6*XVp2bscMeEGzpJ@w5lZUH0c5W)E5Z z^;y3(`C1tA&z*m80WF18a4-OKK$=jk=jE{!M$amv$mo?qo(NzQ&Z{m#lmG4L#=1?g_}6a zwlMk_y!p}Qp#|udNj1I5xt{|@`z6P3xwkhdKiDWzh!Ps%FJ#rG7ad*ea_CrBzgJ;; zP>AiH9kvzh&$*pP&H`xJt0DGo;nd|Vdku_sH)y9fX@6IBFQj{p8VKpzb-Z;R|NRZQ z{MY(RFT9I$@iu;y!`ZJ!$K;_IxD>Dyx3V>WF#%U1*0TJG^J=#LsSvVidKzr0V;big zphed-)jb}$If0Mqx{^rjPJX9F9;hr!@7?gwvE=sZUWktIVjmVpM>VwlYjJenrsTzi zf5Mxv%q+ z(PBcXn6tZhtHlj%Jy$o_A-au`sW0HjF)F>SFFUJ$qgS!ntNU;P?oeiHDb*yya?aG{ zGb>Nm-7&K?U@n%)9e*bbdfD$5y6RgE(uDH=#LvW9JY~IFik$*eiv9gq(V?BRThxnB z!R7#c{lhFCAzCLtw@lL-IQZE<2Vjbdjb3ux4WRS94<^s!uN?I} zzRF!wmyZ-%Lp_mE4e@m9Y4CS!UdK}tR#sDDR%xRmc;>NL;rRvosAQ^5ALBsX-W1P- z@=X3FRF&mZHE$hMMTdhYVMGmWyN*teF$!x~=?N&zesi>jK}MlRCM3HtzP&O2sJJ;_ zhG0umd{*gM$x*YXub=uCAAAb*AlF2}S;?7yK_Q&8t6?4eaIi4O+4Tr6!9t|dq&0Ou zE&@JOFDy?jLJrJ6`*+b*M;Uwv^9W!zcE3Vo`l~MhX`>)f z9{rell$BemzdF+KGMSo^vkRMvfaA8k7N8-a7Yr(FXxmdAX`f+zU{6h?U4dc{W$;rS zlt*pc|7X<3S;zEJ8)H9@+Ngv*y;Zk=$uD}Vjo+@7Fq*Eri8Ya4I^*f?99>6!Q>oAN z|MsJM)j9L`qnw8SDl+4hsMi#*Z0>7>N}tx8lC-rO`l3PtP!E% z_;fpKF1={=yYgwBrF!2xsu!J?A2tx3#eJ&$tW{~eJ-Tmwi+k1QKSq7A-u3;fa-jNd zyQeo_|Ncm(Emtq=Ltk;P`WCCc{d(88V!-;U`qUTA);GOxeYZWF&(C7j_v0gb@pIgO z^{u?SH+@Cf`nIz?(yRTda_iG7b;j86n^_(8tA4Vl$3KlHvrqW#%uadyVayP-^Bwkw zzn?#0>}6uhe%s|1SAI&jbQ7VqZ8D(DH5|I5vDwU+OBTH`80vpoCF&U@sCvz+Qb}+8 zsg(dI@XwqL0 zJBc$#IHE!aZ}e!s3smY|XfE)Oy{&QMZo9j;)9JPxcF^VWk}?ZyS>G zpr!Bio9Uf7(k`>5%r9fcoE3S|U6!h3Sd*x0{uNpF7=jth@ewSo7GveiQ&Y@=$%{XQ zL~pf2>ysB$9>KEUB>rDhsy`#VRkJVp^1@3mZY8L@sqzSK)fHcCy?9=EHRe%M<)>8H ze3twUQfzJaTPG8>`5*5OFW}gRPqUS5)Tb46pdr4OOz=@#s(^>e` zTo=EeRn1_ER!(QtVpBc8S}mPr@Ap@>*zX;cwf6f^rDwma=jbfl zIg!fgkr%8mBVbN!lyDLNU0M9UN6uPn1i&SV)prZtUX>HF}RQOz&%( zHgMsFrGlk6lt z^KgYBKk-Y6I`PkI6zrm z$g#X&bl63r86fRB@y{<)`Il5V`+NdU z%w0dYtm?>hQ_J?^Sd{ZC*nzT;PU1)nS$V6kTK5HZC*GT-7UN`lwWtOb_2op@nP0VvfBJ&HQB?Q zDt4^5^ZBM^d*yoClYn)O+8?pF_)l_ArT1%ybyrVazG8y)U9DrUWB&hPnb|OlCN?Ec zr`6YcE1w8#I9yI1*Xwn^F^GVWk<2S^X+CmuV{BL1f(KIFpzZ9h56dDq{aVB$Fh{=2 zf*^rP*ZW*NEN5C%#X4{23tq@}V@D|Q^nhwBC$`Ug5z^nT5iLP-M%az*u4E|pfxI*L zA%@nlh1<|06GXJwfB2086y!#@T-)b%K;!+rIlSNc0tkE+1jNLlkq2%y4cDo|5&oor zgyakafAhj4Bt2CQ?NIh_Q_&NIyX!OVbEsnjT*K}lL__5v`}&%tLiK+v|5O>se|3Pe zgg_&J4eyGiV}vr5uaP!0z%N~^fth8_i?4I`{cL`FTRax|CsVmf-mGf>fH}hPBbT)Q zxwHRifU}QghjxK300d+?bB+fOJM@tDSMPZD@ibb6@I=N|q7w0tedGJ47umsA%lWPy zJ(2cXNSMl+Z^LH42_F<5+EW=&UmC;tOjCL)yBMjXkL`osYJH^ROJr?K)G73!rc3^V z6}Z{Ra6b&Q404r`p{6U<;=U{iiyo6(H1#+RFv^YF7?j&L@9S*$^_1}I4kRK|ZR%~D zc9eZFguEs1>$UFdjg+0+X*k`N_kAeeA@7m@(sxfp-4cFpDCUfS)CP1l;42`>m0#e# zL(^B?r_=vNS(6Wge@^E6zV7?F4SC;>58;bxsU=Vf_$h+n;E&9dKiPeIEg$~7bUVk> zm&i%kWq-|szlHA&#`9(F`|0cRzTfA{yGFBHaDj11mOr=TeU~#{-;F=e7hQynR_E0` z+vz>{JK#%c=zhDHDdpg6 zU!Y9acFhQ%%|cDh0GL){-8x{h=pf}tj{o#M1PP2B%D0}brn(K+9p97~wO&r&3LIH4 zH`Tn{_)tzYPvbgl?0$pj?y0aXwx{^o=hEw_?(E*xNx!CE#D4{{qiUOKwsbaT2n5|N z)JFSkxb{T~kLq1G^`EZb$5Q$H^S!CO;v-6WjzPuO{*6lS>{ImkPg?YnK1FvDee-|f z--zBIjemCmcA&=2BW4Rn9p$yQlb<=CwEQjomoKM0QZTBH_RDX+#-47)mvvkF&Foz| z^}0qKCr{jq>EvnLN6C|k(%;gL(=dDYf%ZM1H71v!W=%pr)foSvDRHnOY83x?;2Dtz zjv3cf^G4$za|HD-jXi4{>;84^%jrjfdEd5v`BR^R=G4Tfn0d z^_sAMX%=bu<8^8w`Fi>0^s4oF3*Y$2^SAa!r3U_uDpiKhh3)i;`0gygeI~bAx$W$+ zg#`9i|5nN2aTOf;y~*FYQaC9<2`^B&JQDR@Y*jJY3Zf_b(f2{YqF?i0pa5^d$#(I9;8#Rto--&mB0%YpAKeN zJzAN-qu%d6WS1gegFQHwn+-qT7v^ln;Y4NZ6yiS~49;gk>4!VM%s1i}Y8zLE%c(8B zB8wce;Zgj#*ef@1Xh0D&6Sm=NB@p-IuEE!hWGRZJsj(P6(ez4zZoTG_K6)rJV7(9@h}VRu5V^{dnw^K~(g-chgWsKe+gdsGUkdXiM?` z?*14>Ui2e8Bw75yj6gPMRvAGCcXtZiFT z%PIfA=1Gv}*ji?Sy&S|Qm$jXAXmmgMS@D4F-0pSnIW_hQ2flL9h2#}7>JglGwfJ8$ z68}xIQm}>HH$Y51rC44~(KX!sC&d_?f zMQc&3jeo?)WS4&Wo$NptNY7uk%PzZYVSl&_0IM|!#b*HFFi7wp?fiFee(mjVkrhKf zS@g{3vKtdCYNq0L+A?aA>IU>S_N;%A(*;J6$b)K8V786lsA*>e9jmOO%mS(anVIS{nGAWGbo&e=Xm8@z_K zoqA|gM_#f$%NnZwG8*axfU-aHW{#(QpJQ!YBfYtaMtU88dZ%A;4o&q*&L@g2)1)P! zZ?Ptzoz^@q*j-g>g9E*w zZgb=t@9QDSHM5)9YE)DRyi9-r+lwO0meM`djp$3Z%b=Czm+sg0<^;eehI7Q7Hn2A) z#?{DMBgz``xvWG-pqNF_d>gjf0 zF+s~TvB|d~(_u{O6<@KAZ>R9%i0z~;zJ3?8{OI2ifPe(e_C==YCx81Jd`XTURc0;r z#FMf(*5eTQ@ei4>s1lm&sviO3oX2hN^k|ytCcdeeMup9UmQYT$SkPdva*V6dKlaI8 zJ^rFASk}9eKRGjfzo8}258`8K>K5iUeKoA<_rn9(Lva_4?O?7mH$u^5(GWd9ujiN@ zmHPHs1jvToBL}OGenBHBVilpaK;sL(j5PjXxV+*Px9kxhb;eJFen=-ym-xGF`GMy^ zqcWxx`%^Ki!Qih?AeW0(JXx|CCj*~ilZRx>vmM=E6_jV=KN=aId#@vw{94c!1L@9U zL}PAzq}Dg8NO0>LPaw#~i=}V2@aXo3c|568&a>YY=6IA_cd@;~ou(N6J&`Q!VH0$`}-}4(I?INb?T4ONZRkG+8eA27AB9lQf@2XwU8Fkyu z8Hr20mj8=!pO08v?j;fLRe&nUPuIt4ba{Qx#^~Smvddf97W`A=)LTJY+zjpnXW6{+RJ6L*^aIeoOGnFi(jl}ANQkPFG5ucCBxaYz2I)u^`I?{k9h z;-S^PEu}Tk-tVcC`?*}TmP2tIy6B?e!pLhqHsd(wb z9up%3S_V_HgvKp$3;OJ3CLSYC5_y=tcmLXH2!=>w1{c@H&#qc3NF{DAb` zAuQh^c0F-bxdz4Rw(IK(I$Mu~_MNzLM0-^}#pM?}if2`tA)ZT%;a@KNXKxfa8yrRZ zDy5N>{waFu%mFB34KYJeNLf}tE&90geRlpDxaRZmFQ(_%xPkLxm@(kXeZDNT%_CZf%#YMwcK`gZFD_+jUH&W1@+FJ@zYK zE##{1!^n+?QcqKIN};@ZH;&+?k-ePwCJeUsT@ z8-F%+8&)sN5RT2Muk%J5&ZDDfDP?OUc^#;-kUor?5)O^N!M!+iMj?0P^DJUu89u{G zibvqAV&pu|R4RNdHu;zT0TK#vsP%6I0qS<=8&KgU?aye&&WcT5rd&}%Cz&3|khEFC z*`@wjR)qUEv|q9TW7#Z{3m|T)p?X%ku+~2! zSxT`S%l!wJ@~2aO68f`@KfSw%f40}Bcj$b~zB(AD!*AlgKQ;R0*HNNJkoF~udgMw++^liCy=002f2W0Gz1d*WecdR8jK1Jih_S5N4 z1D~H_vw=k60JGO%{+bW}o;>*1d>nl3?}?re>|8iH*tu{hI~UBp({2(rr3KeNa`vKE z&NRF{vz5Wk&p&2<{Ymdn{LPvD@AUCM2N4n_B%GnH&;5y?$+WK`eB~vWz?9G7&)$?H z5-p?ZW{ip+Oz5lj7wM32sNlM1qINjFqQF0KfQsib{!h!Ry7&Er*1nU2`k7c34O_1P~+ADevY?dohy6H7i!9mM@pU$AMIJ5IAGO;Vtf7gI(0fn2G{KD+U27jhcX=%@Aq zqxkseZ^cxJmu%-JHu>rAhgGfS-T&F=bE~>rIg>>-UqdMk2eUj&idp}6tuW(wvEOV3 zZQ>6xCEvN4SucKqWYL5_phur7G(*+(VN}}ZRZw~YM~P0ZEcw&TRNe>-OR`{(@JJJO z48@E7!@j>FU)dolJGax=b8rF0-n}pv=iwy5o-z!c^QNLD{)zg_awYp@{15M!W_%{H z8eLsZEDBhUK1C`Bja{lldjAIJxfybgFl^#XldDG+v})oj&sd@XGwHl?f1h_WyFKkR z8YQ@&^{WBztK8nla?G!!f=*Kbo}BfECK+Xbe^UBy~IMx&ka4M0I3 zWH->hf3W-@adx@C!m@MSfmHZ;Sq6yFr8`9UnW}tw$YCdcCl_Yq&-3HhZL!H038-to z(GMqSzvB&ZFgO(bk|ZxN`q*3aGx0e6Fd?qSeOSWiBsYHG-(r59d_wF?3{@0)W~afL z>z>7&7=Blu7p^-a~? zO1Zjc7B2KSQJWLznBRYo^v3m5tBb{}*yQhhSKJ)loETp1e`Yo_CC0?{gRAv1%~rti zFR!pVes`e;eDnXx_`GC{Gbum{E^kt6)~mAW)OZFp+R>AG*ZiH{(CL4h5c<@;{m8K6 z@3t&|Tbzt}qH~_eo`bj?q1g{Rfq6U}EJlA$I60ZZJ7R0h3gPQ?`xufF=Ry;{;Qf0Z zA@+h9chT7-*g;dnwaSOJGLPPI7qyC~OngRHlELveX?_k&E7gnej(;g(47l$C$ACHh z-TNDl*=zt3CFgYVxvo31>^(4W_j;9_sI42;CMNC79Q2JG@ymk(&cD>=^uwjs ztEJ(qU>zZRIr%ets1@0#SlI6CE|l5hs+b=R zV>Uje_Iv{SCC|Rc>ume$b%xs9PEJuP@}IrWM6Q%Ryy6skZ_fG9ieKL3CjVB1qU!R~`w1F`!35HLuN z{;Ek-5MrDh{S==S;o>5rgJj;rN|BF}{k}mh=*kwr-TaV(C;bg2V$-sZDbH48o6Z4d)S|0 zB+?iv^(XGDDuWAI>Be*9y7Dai%8EXvu0N|OIip9HTYM%ywG=)4g>O}$IZ8j17+mU4 zU@-;Fq3u1Ni4QMLoi8mwP4m?9^EF{z?AS~tcL`)TBFvNI!R{vPg6F4fZ~Y zsr{{X4u~{Hv0k>>2L@XI7eEo=izB5Bcaah8MsB1u_~pHgyd2=#S_x-bHPMuK_zQPx z)?l**mjYW_6+grF|FvY0&t;SSe)C@a;1%E7yZAjX&RJJiw-j(~Q|#(_972<{Jgyem z*Vmj%=JhUGpHINKBY-pAdzQ2pt?aOIr>Wp%pUxc7kUW}z6!-Ti0=kr zLjX7uC!6&@T+EYS-6HVL&+89Ty@Jewz|ys1sQK1ep$XscgZ%9W=+tD%xsx!i-dz>A z1G zf7zUr?r#Z)cRN4oHdK%kfxqpa5rG$(8=3n|5jXHa+m&>V%q;tDudL@+L7=tvyP~qn ze($I(*Dw4oM-KGQOA=#98XEm1rI!WiO-bir(4n;azq*uf&LwYo-FZW#wE;sKuM=q8w3>ggVNO>sBdC(Xpyrh1%S+CzyaHFwSDqgZ zD%nWqLEyDu5V!7Bwlu<>S&cAoj(<9QkiZ#H0T|6*MXX{oMZA=QLnL4h0%6Pv5W^s8 z_~U+5-NXvU6=J0!Md>oJh}>e8j+>HjG~sZS6(Gm!-MovedDvIc3mricIrmgRF89=x zN!yfpdNK1=eiE0@&phqmDZ`ep*b8C-TWVj9oe3LYdfje1%uPwh+}K+;K90kQGcftJXjQbIZ3kPTsgN| ze^L|7QxnWr6D;=Ej1rUjZvut3ibfEcNUG&c5X$PBK5nDoX`4T@Lv0M{fNtPa;RQg`ZQ{a`GUVD#n6 z19T^E1*{)`Mscv`_FU4Gm~a>|5MgKU&6%L*4N&{X32R>tA+ACzL*@OIJFM58UM)^| za3bR3zjh72YMeUr-6Ul?bC}SXjxw(Ae1Nqe1r|T&zgZ*-21Z_$6|W8KfQWb zZ=|^ZCyVdrt2KbttHn4l(s6xju2y_!6L+Z?}UuL49CzF`eh{reP10RM_5K@8;0>Z#lGLf2Bfi8I9MS*5d7SJ=h;=g#b>huKJ4 zE)eCah+SYn7LeG65gyXsX6Ry)1QpcUyG(mkzzfx}Qo;U!kB9Ej3aW+pjvr_ZP$ti< zdO+?q#Cfp?I|Z?|VdW3_vD3s?DZjRde~2HOQ`7vdXQ;{`WE>AC?t%8o0!EnB&+|Yn zVX!Ra20?5k_1{RlTO7WlvXs0l`Oh9A_A2@p4+!sk!Gi^5Vh1&D5Q+$@M){g9X9^uQ zVCiux9otphdSGZJFxHyj8?ygq=n&lkF8fAy-e`^JVo-*pXM>mJV28v7r%6aYW#6 zZ0qcbzyM&Z`$z)40RbOufFCmBBZt1}0-rtq)}_HB*~ij&Y`MeMPNcPOZ!MJOv$f4M@kQ* z%5X%J?`m0t0O!!ZA)voAkNzpj)SrUeC_I4KoBsR)1JO_6kp2-1KgaCvo^Ot)B76aS zVRH6)dqv~x6$UGLb6}sO*%yR8WSf!;!LGa0oZO_%#1$2U`;5*iuMPw z*1N*$Qa7kF*H>rJSM7VyU0Xz1izu`1IyDE34WQQuzs#uX)rRM9>HOFyDCY1X6RgQt zZLBYj%?Fgz6?NdZ42iE&221-|XIqx>R^WHk_c0`b30obmpw@E-GC-R9mb*Z%qfpIw zwJX6#t#|R{ET4?PBDa4Kq8`5nQ2%AiHn(m>HM!D0h>^muqB5duWX{z$Z3kd;>hvn zfT0LUu<@&bswx9jWjEgxP|u2wds=A%r`e-wnx34=@RB?SzB#%%ZAmPY=r_k-4yjGm z+EgD`6X~hfi57J92WYdtk;69SF&ymIu`7^2qu)l2fa1o)sK*qu(|UG9{hRpED63pW zPbW0!ZFPO6$G?RpTU6!5{H0f4kBTuK%F$D<=<6prUg`^*&3co{4xB;PKH9c;oYo)f%{1o7g+nlo@wxdw zr*MdRj(u$P->J<$y%^WFcx-{z3ugsJ_P)R|gVp%s&&~lSWnspu0XwH3U=r*yGzG?; zlRq1^e*hhtv%aWbrU{;O$#FCmXfquW+KusTjkrfja%yw!LzQ+8fS_tU@*#uoCC=r} ztaI>+*4=7gqsMqW`2gdJUM3FpeX96dP{q&dsIU(Y$~1?%l;W8=)J4jtK?pqa2|rIe zfdY{=f@Rjwk!q<^@8&h_*s|y%y_5$ZtAmgAdgo)kNU61t4^>v#M>>lAuCRT;E0G`k zU)yU1JU}Cqqi1o1`CnvBwbP%?U;lIZbGH68>CYMZGlf6s*GYOlQGaUq(ngMB{w-`{?yh*cqclPE3~!oTjxzm8X3g-Dwt|N1=n z*XO71@q78#=g|e6fBm!27c8-89-{He*h?>vZeVe1i`}_Ro>m3n*-3KF8{;KMMQnD9 z8*P(cL`;Ml@oq_v&U(cxZ_~3Bg99e!-=!oFWqpYSDBGNTtJNFirqOOw7F%9pjcT4S zGML&{rH~CflL+I}p|W8$mOAGv%qJ$DoX#S{Yin?`u?xkcaRyKkS;H@Jmo zl}V!EmNo0{)jKBO27bYj4pZ{ASqeW1&yt@BED+vi<+A4Crl6c3mZQLnN()qr5Zw{v zDF$!=`{HvQY`uF)wQuqc^M$R#)S>WGe#HfDJIfqc&vyG(xKsDc0{XwZmm#HNV?-hC zkL-@zlHa0n%3gSt3g8a1M^>;52|Rw}sVFKD959nvzZy8jpODBHocN za~Iyi{Z|^cxOZl9V2|CW!NzzbV4FKA14B}Bgw2Wc(poGso7>4htinkxt*A73UY5GD zzm;Yef3OCUO)g_^)(aGjme4qf0L@N$ERo#;`P$^0oclvS9!ElRv(XUcDyk-O} zsLpw+b3XlVkH+Kdc7F2s#Yed!2P=1#|J)xqs#m7LtUa=&03XW=`p(^mRTCJhn(}j-p?>;ZQF8p z+?NyUSy$}r38aPtShTVD)$eFil=_N9%VVYQugiuP_+LY!`emj6`-6-nk&X_^=*ca9DX1k#nZI9q6OruRuvi4nU$xdNAlrREv>A=tw2pPD^FD;(22K7et%en{?v5S zuJl4mQBGptJpW6FI7ad+@pVUy*_UR0aqj_N?HDpi*K!2Of8wBkj~rZR=SQcu56n9; zQ2Yz-zmlKcrMVI$x>7gsc(qbdjc9o3(ddG0ahq1HW z;c*5cadwNBxEghIAPT_$M@bQjH<Xu3m^n>(Y3Co<*o#i&5UpAUtD!vVq4EL zHD%7%%~q~PG!@|w86UKwX$Mne`BI;Kv-pDi_|hZG)mYjvqw#UnjVh;MPh+3ul~1X#+lm*03opSg{#Y%{TuqT#?grz_ZQxAJvLWh|C^t1*$d zQvtAkC1|M$ic?EaRats^KRNy97iRPyy(es6YwSlDl;2NR3)URlJBZp~TOD*XCMVED zi)eGUJleo(gJoEnkR#0>>mI-UJSj3yc%d4JOXLkj3AKZ*XBN}1OIiP~+{s4!+=V_? zjmmmjJFHYDA-n0t>@Y|UB8!9$yMy*P)&GLkWe`o_=UG{^i!Vh`}p z#2&@w_#=%++95gI#MQ{PO-DZ4lsKe0dCXpog~PeJ!_wBtZ4~)6jZmf5?B_afB5KR63~npewuaZvA2g8>+Uu_xv)Q9_jB* z@vQ&7;~7jF<#)zgc6+LsmXzOMaM&)(+Rk9K!RLtH!T_`JWqUDYp=hx69Z_=|Eh=iV z_+2XaplxEk!bbyvBXbQ_-tx;=C3G={BfwJ_EhoucRYO^LIro9fOi zzjiK~rV4+(zh*1G%JucdM+jW9WJW~hG%?rXU%o_7+>*-3BOycllSThsPm#``$Z@X7 zD)y7RBERWV#9yl>O={)<@5tsB%>938B}k+B(@K>dldr{?6|bz+v)ZaDeu=uc;=W<6 z8UF~7Z$-jk)J2des7I}=NRm$bb*&_C%8T~yJUaf<+t3n>49iJWcONGaUCE2@R?ZkJ z{L%yIkAGAKI`(|OkXJn|_IH+%?_C;6=m>&;*l$qM$?+fdAzXEI2?UyEp2k<{2Y87x zW84p>LLp;Gw=>8yoc{kJ!I1Zoj#M+a{BvdFgV?=>SbJrg{RXb6irOrXO$1F&A*nrJ!PnRF)HIsH&wx)J?T zpG@?86X3*6BCV72bue}&G-52ocJ;I#?f)tWOj9N=5jXnR7oy)WcJj%PC@>9pCnFnv z4JWPn$LP-y{OLUoW+zMXgjD;ljO;TkW@k)h|CoMD-HtP;w^5bz?(C}-=z-7%bn)#9 z#}0QCmwfF@6$KW$&dDnyxc!8k{@P7Ei)4THLhwkI*lL)J1D@+icSclF38We{&ajw# z44*LQQzi#RUz-Pj=a=iWhDiG=G1T3Qhz<3xxfaTN5GSSVM^*pe)!!6VRTE$0xzjv= zh{DN$*wGN_uI*Xh(R1BFWIdb|3#IRVUa~mxKC+W>Kazu67s*~`_gf2cT11@KVUTYU zWHwRTbOKuU&C+_g5ct{xvc)EUiDwSjr|_>;_-YmIDLRK#W17?+_Nd!Af)PxyUfnCP)+L@<7)W`Fej&Fr7N_~Ojfl4a`OcJ1?bTZOmX@ix3P zKfc(te>c1j+P~VhzqT?Q5bP)~`P!uw1>wm%HCdj_BH5qK!8x?K7O>1-Q~Q&yXJi2b z&Llz5FvLra)u)b)*B|dC&qH62AFp@a7$R=Y5sx3|yiTiIY{U$AY~wLQCpg*!12K#Pyi!qH1{w7WeNFAMTZ+#;ETqPNH{CSf=^W6A+$DbRs{9#H_^rgQr zT3+;L23U2))p8NbF}}X0%O5TUfKAY>5dkTfj#0945gQ&hvW;)yr#mU#a6ZGv+8-mF z7{+923}zfU9|oo&e+E&^E617tAVH9UfV>TIDNcaM>Cg_pWEQ_Fna=e>42xY8mzEV96QGVzeD9Su{MUSqz8RUMu)p@gEJ>9wp+X;RAeIKu$;@? zVzy|5Kpa7u`q2vYLe>jcuXoblX~t*?I8_mpUKqJ0xQPuevF*kG9QF2pevtetw>jtX z4VX-Z$kI1oq`fp?+qkI9v}eei!eZIM2UZ6(era%XPUsbZE${OC8}VByuZ=MP*(PAg z(dS%1qt$H+ogv3%{2xEmh}JsJ`9G4Qk5WF&EfsSCnF53nc}BmbS2s}l#7yZoXAe+X zUX&LBL{l)L3UM2Myq)WMG#BXjylm_wQUm)><^K&jKjH>8#tqf_Q?EZQ`ZGs=G|hRq z4R}NvE`8Ze5VEGC@huVZyz$!6)f`Odd56DIRf^_q% zuIQNo#zp|%epof! zAvFl3(nIvj116DLs$#RAXI4&Nt+Nlw*T|W|`87a5!}oMDwo()b{Sk`c{} zT2d!3!+&1x{LkOshYHGvf3Soyf2aJuX z;I8?{_ToO6n;n?C$P{g3{ME*#Z{8K5JKm_Nk5fgz<0()@W#FfNS+=Tx9$M4&p7#qO zTee#9$LMtb1H*WG^lR+dB{F7r53sHp&V5LO51@Yh-){Wid>pOVBqvW1%1hS@?uBdG z0Q{*;j^DT(w@uE;fgPN@05{LK&iFS==oWk9ipoINDZ@BvLTLV5Y-39unLC2G@vjjn z3ff?f`h)*yS*U-Qe|MO-w^2EPRtRUi-uU|}wc{)QD8sD8GQRgOuIcaOb*s#a)&KdRZL7S=9aOyVFmYbj zQY1&8d?enh#05j?xWk9Scf9$8d|Ca@i$8lto)=%@Hvav~@!G%KfZ>uw)W5}cKFD@R zWNHuZ-#9lbUqK(IU9o>;;?<2`{)>YOqGz%r@+KYvFCn*@6pm)Y7@Ds_>IAK@yCfPc zR1A^Hiydv4%7cjJK@x29vI99yAU^}hsd*rOJ<2YFWJ{b35sMFr?H-W}_K1%J`{B<4 z%W03J|II@d({l}Mlz4zVJZyZb8-MjrDRc^j7W0rTbO?o5Kj~^cG^FovEfMbiLWs_w z98_St(_#TDboES-lCP5eVT1b!Nb0JA=Rm#WBettNS2{j#C#nrB9gGi?IKM3j^3dX- z$;X5%kdH@B&6ke_g960*k&m~L%0NaA&yas2W>`%el7UdR&j3Cc~M@u~hm z-AN0f!7QIy1zl>fyzOmwLyD)rN(?r*7|a;eoyWpl>{jUSWlFptfsb5JPpN7%Yc3ze%wgUbfFC~R)( z>71MQ+_S&@;J)q&4W<5BI{BjSDEjf|L++F9U$9QDH260Mn2Tivw;6Y~NxPQ3=lGcK zpI%Fb3@?9Sx!GJPUeX#g1k@~cyrex?`Ewxg+Hx!B%0Gy+f3a!X#@6!#&LZw5BYyV( z*n1c7sH&?CIFkzm2%dlh!#!whNd*ibm>@_-5yxxjX9+s3R?QV!yvWgF;Kd*m;+Jx0|0*gJyX$;59l(E=pD zl35090maJ%X@cTEF+2@eH3_=yIm&*``08Q&u9mFWv<~C95PBRdz_BH;E2;&GRm~QP zdDOt1&2=o8_g1!@CwT6L^ONA=v_C#goDP2$kKhEsG=>tx+zcki!x3 zVF6-kwm`bfopemV_z67PHs0+iMB%>%*a^>J=zfMQmZ4eHUP#nDjH8W2%@n~(S8pEp z>{m|-pRL3rs0&VDW$k>kO8psAhl+f*`ER0nGl_4~iI-atp9;p9%f>7IOQiEscu2=C z(H}k;-N%3)rC=%eIi@W5vlaQE;b8M9Y5GK(dN^xv_0JAXKvuJz)u9=Dmm$6C&R(Ux z`lL|$H9UeI3x1JUX+HI)l5d8Esl8C8E@EmQ_GTzw+Cf0S_P0cbk5exohv!4fDlF2Jeu%CMf2vU^Iz!r}sxLY0ON2iiDm9*|5&k^(dqK!?JXF6st`z?K zm^KK-pDp{{dIT!|%x-Sg`TvSPElER1c&zWwY0aP43(RSg33G%$`>WLRnHu5GUMjUW zQ-wc&@+;xb1nJ+Y_)~-n<(GNW(dbSE+%1Ty`19Eae?p+pyePT}vgRG} zJT{-gR+S}RZkC~!My~B#`a2nV3-JiL6n`p>Z>)Ne&ld>1YK^|pD)n-v_N4rDKPbJs zkmeNsI^3TaJO1=jh!!schR14lLb{qjuNEDS8k_vu*8CC0zZZI1@-J-Y8)XxDQ_0N8 zkWKeui!W{QW5SDNcmyX{{sET8n>JRx%jdfY_l{PnmorsHt@{D?KkY(ViM}8A&b9)e zM45;b_rmGpl;$C;|830wmXIC8(fV*F#ltc4|D!_am3TzY|0?xoOl>j$t2dMQM$P{< zLg~wBj%g)lZPA4I1-KbOD0{m2=cklE)5o=>pLoQYN$An3<}0$Dz$>C z5ehC)sijO63jT71P;gqo_om?U-&$Rznu-~jW;B{X0%x2bqvjWpzY%c@cI`oXJjCp@ z2)lO05##E##@|Rcx8V`I8bh)ZgSw~vR;515RM=MS`Q=wCc_ovjpHJQ|{aipx&v)fi z^WTWW*J7N0m-!`j{R!FZyv!TO1{>s)OAda$k(+h^%bV7`QKo_ zIzKhGExxqp|A>4&_H}fRP9a}o$Cp^!tWLmlDbAdi+F=PwJcXWE`lUVp zg{M4QTN}XMdZK%aGkVm&EK5gP`9m_CD)5Ms8sk)|o2e10QJ_+*8JXT{qXRw zrKgYJ5!KVFD)knoMtXXaN}a+~>FMpil%9^wJ7rH#v3?LEgK{oef=H8X^;t{};#?Ad zH7v4z;-OuOzLUxF#T12@zLgb#HXKSA%NFL^s|*bAkc0lAtYI|Fhb;^=jS-kUr6r-N zLffFg6rF5WSlbS5DtiO$Ijml-(aeq*@*FTX+xAi0Qs!JKWBUp`EOCrEpmQgcn!?me zY-!v%Nu{=9s#tTn;Ra|(tYP>x))i0i@I;gw>fxYUeDcQbQu`8m)mLv8viR{qzQOfh8500=_<7c9yLL(TVHZPke=rlQr1qsMumvUkEI+`F zS``A3TZHfk8N&_BSHw#YI}kWu1unuyRlb?Kjr_D5+o+Q=^Ko(#rcP^j9OEnCMrpT^ z_EsYgGg_yUroj-R{0DWzO2Tiu9Y=5kIMqCVsZjjbD0Up7C4?#MEol2UD83QfQv?>& z$2J;o4E`?L+Z-FRtBsw%{Msf|E-uTj!JDwmVq_Zo z(aVheK(to46=B;~z^;BwIa%6(h7sAK41I0vymnc;3@h6RFoF9#JY@GLk3L&v@KM?M zDT$Hv=4HSY{OGcYFxjJrdqSgR?(^~a@FV!*nB1)LqK+MJwTExL$Hq-RIz%WeTk)Ng zzjYV@BWXf+_}%P(Rynq2Nxhvr97q9u;Mm%^!^rPUDf7aC4B&VQ^q5P7Cqsc-#K+tk zbvfbl>C}pp9b8sA_IvZ|0-T)_TY1b1$a-JMky%91h%t(TSCnJ(W&L>UaU}+dELp~v zP)g^A8~iO99i=gGienFUiOda8szMNjOoKecFs3I;Oxyf%y7q0`I$evGp<4`(MNP`Q z?G!NCmUDXJN&%2j3SbS<3dZxl6O2l}{SK{Kkmg~wjG8FLkOLJI@r#KEj03SBD{Gr= zKfdjL5py%~h?*~lsMMiMjm(!9snmf?mHBd{k3%Z$+}yB$YpEIJwY?~gnlG;lD0;M9 z8%E8S=K}mz)ZzVjrCf@Xa47;WBv->a^cCTc>(ry351EObQ?w-KBz?5wU??=VD;*04 zpvDjb>Vi44#Ud#F2H7kUW`q{?OI2DDiwvO0Q+7CG8?Z5n^qJe=q78i6>PpUGK=$b$ zp=qC7%F|q6UzcG{FfB9$H`>)H`rZwZWYv*DHqH?vh}eI*Eq^s7mNJX*9pZ5VG`KJ3 zBRRKE7D(kChk0uNNvDJY46si&HL3ka*sTPwi1(Z26-=+w0 z4P>I2`QpA-EK2-;C;!sc^skDd|5&>}X9%Z7&N38Djd+TiFZ>;TeJh+MvRAPS>ID@-X0)y({}A_#$9w1Ej>22#6zjhA z@i2KrE*h7+Ha=4qjVI!w@x(HBRs*j)zle-hL}3iI^`M-fMPmcl*!q94F}}qJ#oG%HN?dUr!i4b<1`9e;s)n`aR6u~PF-zB9H!s}3;`K+ z|NC}@i3C?@otvAYxUgnB3e1B{!$~K5UedF62I0e+5X#m=TXDt*-oxs)`XEK{Oq)mU zxdp(d2=FLOnTiAdYN86(yN#5dxSpm|o3l{FLv;Lyfum2M%Ki%xg1%F$!0Dj(Q!(`rNr&XTKcG z;QiT~=b*Y`RCh@#fw!5`{0JMDGjRS553~E;;~{e!zSU6jCr88rSwBOqM;`o$9kmsA zC2MFMlQ}GK$tir`lzi_Pk?$BPSo&$JcXAT1KbcxnzKG{iWrrM(RkL~rOP4KcJ5WLsl3AS2j;%pSM zqfA2RHR=qc-vUH2A^l+EY3{Hv9fPYUqPsL9uFC9d*tJ58-V1`bIE76DNJIcANl|_e zvY>0GUsFGv8cc!cOXGa6A}SGn^X7ZQVaW z`DvZcUTh<|`~a0NGUK!IB!>a%#c;lRduK}AYmh*3<^{=QJ`My#3LK;PsE->%Z*np7mzj=HFfh z8PF&8b^U(4+b-`6NDM46v2!~Mthxc5ZwMa*^ zFH`=w;enSI1oM|>&XiM^@(L{vIc)v|r&uV6XM#MCA+@Bg?D%eg+%O;JTO|^@*~~HR zXKMT&!$~g6j=?NmBy3^c#{9BJ2=i^veso|LH$BS%2uq+c)GzvnxwaQxhmUQ?jvn&Y zO&_)*Y2d1ePXO1qMbOjK6gVA5A8QIs=X3!Q3SA&d4oZ)fi-WQ`V>DkvRIa|-Kf7JQ z;B|V_ULZYHpLMA08b_R-^_5=R@yNcn-+1xK2Z#oF+ld1G305;}dn$LuvbM1S;gwqd zGWDmjLIJcQi`=mto~kM^4J482K~NX2!_>TBF&LuiGtVAWjq?kWGOqx6+lnnaLVvAf z)?L#F=TAl0_>#;kNc^j(4-h}RHCGZa9Ff3AeWSS#hio~;2yB?qO}@mnUueZnVr#%J zMrS8&Dc6c_V{ChOZvC7~?UQaeZTULPg`BtMPJtxo@;6cW=*fXdN1aSIN6lU0o?u5@v2vjn=3*?! zSA-lG1<&CYFWs0J58*Wj($KDNhpo8WO;|b-7KSlVuV+ZV$t0-fS-^pMZnNqkeo@s$ zZB&(ss$_k-_AjTd?g>?0`We95btAxGpq^z`J+i(y zMgQ_qm-KJe+7TcSH4i=mgkRhM2>qw3kyavgO1nDgk`ik8 z>PVnFH|awB)GBwY3|i%Od{O(Gc-IB*;D2e{*pa;0>va{jWOxPI!u;Ngt%2*wa;{n# zf9|`d!P_?#!!I>?>YagqpfZ#`ho!T~$sA3uLqKrkj3UJE{3%igyUq+$Z^S?qW;2UH z*Vt|7xJN@@bN95VCA04S#Q>}_QrqDmqzkvbn@h4#0r+3Wj6~;oNsR#n=z-}}nZAPK z$#)zwY)e_K>^8qr0eXHvnWv3*m?H=vt~Uf*qV3i)kL}t1} zoDi&`!-Gu#Q-&uLf(U3=K^4eY+)vJL<6?0Gk$wSZ*tWMO1HWJ-wFW6bw5Oc|*8`tR z|5x#pzhOiE$Pi{UxS$=uuDpSpt3iYw5-<|Tf1R0cWad}`{&dn<5)e~b4fA)gD__C< zKS6#@XsDLP5zJtd(`Aa{jDpqQe(Z9#R6)#t>|!G^%3WY8WnQ_*Mli)_lZP87gu?O$G%x>Y=jms!IPMxBo+o(-}w#qbK(~ zLC+INJB=a7eDIxCD5A<>>A!D9rgYo1Ay1|MRsi*ueFOThEDmI;6$!zm+nXRXLK75f zY>w?T1woS3-HrCfA?Xre|ViFY#vn@ zm=w53v-U$c&dOL2I3gW5A+ZsjoqqyP(Qg7v@y)70%1SM&pk0w&fm5t2=B%HfgsATd zq@UjpkZ_hh&Rp@{VVFHf8dxl&FCmR?Fl!EF59|5WcrfpVf$th{kx7 zheLyn!j?!wp{t=@J=XD2z+f_;s2f?BQ9%RA&x*+}7E}kV-^;AuldX!`3rcN9U9}qu z$Y2L^sn%ao(1Ho27pSxdm64a8z|-S@*NUcDEU8atJ|fS*$UPOjZACyqUj+o$c}Lb3KlvWg)0SK*-gRAz!n*0E2T4TBe5sPB0E^) z$*rG_i}h4?&WM#N$RePf&stHTblks5&4|kpMTlWWGUfcRs?dcCK zQ>7JH>>JVPhLK4o59;DKigSY1DTof~4Dd)ivqHhY1t9w)bm6he^DyQKuSq!3lFkBv zdk}DpKu#(1J$ZUtG_P) zZW}BHJ9$DH`$XMEr#lr~RtE3zCca-Q^(h;A%wJJZe zh1R=rKcptNT(~KCJ9|&Qa!0O|yJ|f2sE;1!Bw)4Dg6G;IFMDn?5NVr@-!A%c;IxCn z&xZU?p&J9u2s=wK5jL2YI|Elo*pD#H^rir=dd53hgdb$B{yH|uY;I5yJvOArq4hIr ztj;Jd49;$&GxvGWnKbE4?BEU82~@}^u*l!C6XZx4PZT4#NKcIwB9H{wkbiDy5XBWC zh4}^p5f_2G@#){@_OJ8!HwGSz!aEx!wuASv=L1lt4Uik$0Qr{REBvcGEkXZoAiMl^ zZGe0Q)nhDbEzCm*JWn_x6aZ(yrOCFQ&~NC2&k>?pp$)^u-T4R_4N3Hhk`D;xx}vx!)M1;(o0nx`U4 zjYWF&nw9F%2RLcu;k)^-AelzVlmDx9qBbOah02B301z7tTu*}yS{Hn_DWpguzI8Qy z?sn{t6;>u+Dq*!B`W2+rlTiYI^@;#!OIB^w!JxBvFz&zPDZ6QG?^y$1@r1&(C99Oq z;>r3aR)uc=evkj3frp|XWE}$GB8rHNC^AP)5t)Eg>_cmLybOI(`C5u8Tdz31xN`Xc zib&RIXd$L9iV{IXQkdLlWl&B3w;hO{=K|;9G^>4o zLU}V!_jzZ!j6x3YPIHIrhKk5%TZt1HBdfF9U;lD9P$BRfj#_T0%-oId*=ul4EH2QH z#*x-}lNTnj+-=&Dzw;)*2(PtCU6KPUQ2`W+cs6(k8|3-R=1%hcH zrDrmeDt&iM>2rA~4X_iDoC*VlrkIJ9p(>ni9-kijwDvm*y@l$L?!K00N zxqa}fOxJ__haDU@#sYxkE0<%tYukIS`u*|ajBeMu_&@7yDeG%)H+QJpn3P!rgU(3& zzb_H0)rpc$PDQ&9A*`{NGbj6H5>DiIMCnLnzI0-zd~?`TKO@Zsxs(roV< z3jv$_>;Id8O-_xJkXY~v(Q`z5OkYwd3Tn+pBU|L1Hs z1^yV&$zD|uZC_&0_8T}coAF#ih6 zS6zh{+`PehL#C!b|4IFYS0f2})@CT+*FuoTb77Lz2)*HDNa8rRmM^vqDsACe_o;W! zI{xy4r0-EcDI~H{Y37{$rrzG)f>a;A2BQb=4`UeHv#U$o&Zf$nQ%RWn|BhBbm`b#T zpIkqdH+PjcuPFJG#vfI5nz!iZJCdR;7tcp*JacgrF|CMS6N!QiF5u1Hg$|6uSg+*i zwX-2(WFvbInJZ#w!Jc-HLWB>=lXum6H;|W@T2e*Dm(44s17TfJ=eHGYm3jVtb zVx8=Wpj1{Q-xcnME(6>{erULh@A`h&j3ZQ!@)+3W?-^-yTPM*g#}8XB=?KGH=_dX$dk}j^1-JmljJcY6At}C1@3|2^13( zDC0ZXHjnJu3-K;J_0h}VV)5?BS@;6meyy>HbRFbyKf3Ar?xu2 zKwEWf{0yf*zfWAjvPpg5)x9yiiNQH15SFr)A0vF-m)NB@_v6E9jLp7cS!K6h5lFzz z-r5a&{QF_Fnw!Ig@?@lYjN3y|-nO#ok^q|=Tx}D}ScsWiS?jS7?l$`m!DP572QI>n zuUU?U5FZGiZew6i+&Zu9h8qR5YP9IK-EbmXOC=P1Mq$(K4~oh`m*eM$1DE4?>fN*!+c`#IX6#f?+lf9{Qo!Jn&OeZOe9>J@UK#{B*og2$Y_YH<-!h zjsI1=fp{RepAoGn{n&RDL%)dRG48?LH;3SPtA_qp82Tx+Md?OmCOy!BmJc$3mSldH z(SOzcFk0UFifH-otamY^|DWu$k|EKfpC|crLyi6@4UfDvAc|dM2Y+ZN81}c7-)-<0 z0|)jPjL0Qby;vKfH9ZXe0+?%7-4#E>pV%XR*_}P&!*EA*EAV%q8a5g8a3co(SNL!m zd9V&)@S!mXfJ9jsTOC%`V0!_J#l_rgj!I_5-eZ&u2)o-W8Q{vQld=C)u#=026t)F^ zOcGb1Ir!f#z(dF30$1*vYW&xc)&wDH;09&G$RI~TO#9s2**Ev?Oc&Pto;Ox|DZkoIV!^>w`~6Z2S!qo#&QF&Hx$}^0EFE0 zCR!49|D7;X8|=POURYNc8hyU(6T|M4KMS+_r(gU~>>ijv;{9`Lgje!_L-I-kfjd2~ zFzff^6qR`#TDm7KfSn`8BQ5ra8|Md}u+CpWYqb3P zcCoA2y+0^V>lmytj{E8v^Lo)p{yg5;M)FiU0SDy4bM&`^&tCk+9pcskA8}^wV!~^^ zphhIMike~K>xTIAd1 z$LTv(q*eSCzqtN&mLEM4f;R1O8{^~MxD0F*z9is_Rxu7L4$jwX)s~LJw|s4NO7;w7 z|MGQjI$(2W$4mLLqp#xl${MOe!SPB}3ts7(hJeBOnL6adW#5pKZE#KvIQ1HW$YVwp z4&}TSJhcMcVaW%U+`z{9CGGGz#arkK)j|HzBOV47>~pQRZEdp#L5w7VCW4iGAj=)8 zd>0SKg~3s@a&E{^4NXCPZB*8qm91X%-770t=1vU-&I8xGjL8o1U*)|sHgNwMi280r zeSm}8b>}1CDqWFwm=AsqM3uim*1UOr!Ls~rAzUqN1Mczf@$ivtES3psWd$lkqF`BRTF7HeC(wy;PTw94kS3;zeggDqKG{GuBxMNuuD`OB=k&cOr3Djo7R;z^!pl;6sE+Z@8p zI~*=5robtT@|~2^n5onSH~`Uo^U7pCg)7`RbA<888Y$ycjSXU0C7$b$Zl3o~ECpMf zKl(UJoj+QzK)GWKq6nX?R->Q2A^FAr7VW?B9LktiM;Dl>3anBE=%^DTR4EfT_ z%07uogTOy)I~~i&E5$IPk}_eJvhZ2LPVQNo=}iWQ9`dOk{6d=a~EI z=-j&1f8^$^s}v51INzInC9T5_BQ>vG5QnnAXyBThC;4!=Yye0STmJ;szyDqZ&5aN? z2|q@$waAlg)q0`2lc33tuc}+z-b{hHQk?=&^3Ob0 zP0)E40}k;b>i-(JAn|XpuDR>w{$f_^4OjcOSQ(}K|H+G1A3#*bD>9Ov%(eBSN9uVU zH$%h%+Cp;{YUj^v{>(9(AtrJ5!RWjfXE$+#^LCWugp~v5Hs;7SYXM?qoNx4s;~CIY z+LOU^g6HYg$z0#xR7d!c;_{#C^5eQ8e=6{ir}~&&W3K&!MVeE`_nYgrV9y~~I%$m# zr0vb=fFYmT=)ICOFOp>QP8_WuX^Zrx4=KOQUfe53u?)T+Ko*gHp#p?qqkMYbj*Egx z9=-hYec-`;xL*y@1ek5XSZ0b1E{`&#MmQ+|W@ux2Q1K}geSHVeJTQui5gdsJ4egt- z&BIRv<%ltZu;D-s;+n}laq=w!g<11VG#3Y-CZ&ac&b9f|{P(k{$QNce^zSCSQ1Go- z&QQM;e{grd4IC@9^5|*RVJ^VqUZ!jW<84N;b#w0vthsv7UIP0f|ytADclTVNYBAAAb?}|ZP6d200*4+j+rw~H@bCzzjQy{ zxTL54I=Cey8cc4}oSyocvc)gF12>O2-GMW)xZ<}w1MkNKyW_rBdK}j8>#KLzii*B~ zE{#|!yakxY*5HlwSUnJsr#-$QFJ~)`t@{g;5q7+4_aYp9V;lHe%o>B|=whZt8)f`$ z$5p|Rj6LzXQ3$^r_~X1(z4wBzd;aB96}_Pgj`O}SGCq#Sd5wD#d|MM_vv}6wsk;Zp z`J0@z4}~6I<%WYj_2JFXOUl>xNJ@xv`gb|&%~Wmm7U!CIzg!n^YtL=M zl^7Xr$0mK-yLx@#BHnmh|3!xGI8?(wgr*n@gydwq76L>PWBj+{A07dERdY|)Kz3BFC}!l7IBS(~H_ zZ?@_J00Tr@Bk(wJdzVvq-}&-gfX}0OHbYIVb2~P;UbX>p8Hqz(O$eJ&&t;Ze5lNWg zw)yLNZPg~dX&uv5muKpW&fY+Uco9EY$vWd~g09E7jEflxLCnh+Fjl+95 zFkEsNa;OWW;jg|C?=*xj@Nb020ZyHlQ%RJ;Ck%L=4%F8N`spu6F&oa;GfTGqa$JXB zEJI{{Ah&l%sMU#xH>~u(gC$q6A;`MoBF0BZ*K;QqF7ArY$%_z{;Afba-UZtR` z;3Q5}+oCGOJ5c9cq+D`WZ;X<~pdU`^sf&$cM6CI@Ct3}$0Oy}J5Mw1N{Cs<6{LJ~f zC4Q#D&!3WHfJ7je1N>~4@%dT=KZgWAlt-^c;io$`K0ZOjUgF1{TUUbZRCL;1omT{- zT?s}d@N=%Z<7V6lTe03ie1j&(qN_h2fbt2tjLzqpOg z2jd{7qVP7VCyunib`EF7wh?%j_}RzEsKC3YL!itblf$wflOl`*H;v_X8}BmAG%H&p;6~;T2n$n!Ci49zX>j zXhleA8NET6s45&G+KkBs0qc%3Qo|hYhOzzTkiVxQ#RN*`blEVr?=NcmqJG?>JX-j( z{Ak`4THKuTbz=?|uA`5h>;xyxrjm9u8pifn_mA2>$SbZ3!E;ddE-CvOyp!Uvfd@?E zfL`EDOlo+SE$?n#&qjyTy@o4m5%Cf6A6>Y|oHijIC)f;3bXa&DHJ@<&6N!z(=m!aI zqZ@+vbbHX9wGE5ulJ=r@<0inWO?ld{8<=z+3`HRvne3V96e1)%g~mdfCP%twdpI*mXq8#VB^LVi>T|}bYntD&wW!{ zvIUtpiM^pN19{D7*PIL$7?Z=D zVN3ou(HYvzhq3=HJ7ZbQ-G=InCuC9eB`}`8r2zMU#C(Xqh#9(5aGZQAK^w3O- z(!PKS!%eO$bAn)4Q1k!>!SzRl|4?oa@z9zlcseS~6COn2$!(bZDnxVDVGR110)kFB8eayc{2>YHZ_u#^txsw{j zrPhoHh%!OZ%%|O1d(nU1&JFV*h!H28>co`Aw4NU07PJ8Q_L;V%9&gcg=Q4NCQ1D?K z$_hTnJYcnAuv(M0g#I_gnDFWb#Kg#$w~zxDlhHw*D<6++TjzErJ7)vafi#FDbMNYt zp?rjB%3n6AufiyFpOYM9xRG=)2SRI{wj5_Te{^Kt%fU{l6xP?kt1!Qre$;E>75eW2 z{4(eA;~sp}v=l&U{^*7NTQV?}iwRk1WJIkP!0=qo5~KgR_Qpq_xVRQ(C}1>zqX)gY z%AIvcg3CZt@_$f{z24B6d?T^bj2dV85xyur2Umm|DV+>|+=%IK1T*sSy#PP(s-UXQ zsXex?0LwWj7MtB!oAWUg%l84Lb^5eT)catC&d?26!|X8s#262lvon-lIbKa+T#(_! zP-1xgMt8i@5#^CC!YOZAMI+BjA8+N2 ztU)3=u^IoHR&%wisRRETJ>SUua(x)Lm>)-Dk+m<#$#|ppqMGW?&7WuB7EIi2EsHcG zX+M5rtMLv*+2{Ik_X*WZh6Rd|H0#$W9D&Qc_Yn(_;DarxYpsv^SnVg9cTvNEN{%29 z7~H6ZYjm#j%wgeLVk%MmF%YuYs$(*_qS(xoiu82ws#f`L&`Pf^gnG2SWT;*}zmT@a zVi}*V+@qzq;Hh{r0=X>gh3kU#Y6MxRzB&~Khbw3qKoBR%jq)5CC4Jo0g#$df9T#^4 zgJF^QIvV2N;=u3N3SccX8^Eq4PoZ9Y4b-v5Irrg9Dm3{dcQs;OR8L7w#@X;xEVS>< zjw|WluD)S_r@B|Lql?-z{}$6knwl=k#5P^@ZB$<7_J5!t!V1ZIq>~Eyipy5Q8T8jw z`Osp_ohqx@^Ch64kX`3{6)4eQsFQm$2vV>Y`Lv{l`geQNVrtDbT}^0;dE1*zk!yLE@bIRAolckX`gbRZJfk8HAJ@77Oizd339KvmV1wLkb7vq0VrvKRn}mBWJEp?~2_1f7C^%Fu zCq{lCB^CE&CFr3#jJt(hX?p-Nf#`G7D|dTM-aW;YGa@NfZ6|S}EAxJa zKp9`47)+r|;KP%waZ-LDnLG*;H}{EY3LhX(9NWgzyb}2oee)`DyYTzi`6IRpS>TAU z`9@quD)ZlNC~MG+w93_z36Z9#DV8LaT{h5*8*`-)4yL@K8i?jkHLKAGE>)JlL6A7y z)$t$F2&}M+*S2BX0gV8XOQn&=GV25gE7}V$8!O8l=o{YA z5nl6RzzX=R80s)LW2?-nqgvG|jckW1%OG@y=lTk<8}Snz@Mx?uh& zYaUqAAD@?5x0I@TtQeiXfYXHCDdXoDgzt%N-aN+lkppWitO{YefhMo648@mw5h-SQ zW*HidO*J2ajfA*Yy9d^l%^=zyWaYtAQ=TuWom1AT8)|nmUrQZ|x`yC68zQaCJ@`nS z%_YP=Dn4mJ<#w%d1H`9?g7Q^-ahBx_)T(%#z$JIAzpFRF9&mJwZ?6OE=w!3w_ku-r z=evL-ko318sZt(e%Y_}IR#@a-P2&ZN6Y?3sW}CcHZ4AOpdjw(KmZj{_ROSRsW`l) zrkgMDq!)F`Tdd=Lj_JW@*5EFbTrx4yqh(^w}NAkn?=tvN7hz; zl}dBL#j*l}LQ+Q&p}Dac3$bU{;F3cHM?J6rQYK=aQ)~^D5NSK;yTY+Xhn_gJfwV92 z|9!gCFdg5IyQ^=7EjagIrFV+_a^=2J3jMhol*9)GP30Tnsy@Pk%M=$eIJ>`NjpHz@ z=kB0U2FlJ5-FRKf7?+^2FUM5e-Z5V?MgV(r#q_Aa_8RBkWJ00_XVc`-@fp*_M7XfK}yiqUcHf%9EdE zIipJ2W2wuDe8{F?n(78jvN(x?84LzzS`^?^aQ`CY&{lOz_BD%JgVVw51<BOFxbmkwh?Tz|3VVK=M%>&39pRxs7Wa zp8nfhMv4Pt1%^D4qY9GNu$im>jEVK{_)t(TDs2P846};`VMYrG^Np+DhD$>HT*QTK zM3BvSYXE7&!mh0wBAmF|xM{aue+&i=0NpK}^1#0>3O?-kv{{&!Lq}%|Q`Fogj`3j? zz!j|@N9`Z)!`vf8EI;rFs1P3NAmu&Us?@UPi@behhUT(A8oU0lxtY)y>{r%22p4yU z0PqKvsol5Fp*s#DU5t{;N;3O_GrStQzTL8ZsCinfiE4kE_b`Sz1Y^M7XTzYv)~ROD z7>cRTP<3pDS*e&(#UsU(m3Vu@GcJRDudk78r$%PEusB z6(`s;tqzJK?9taYM$Ye2G%YHRfQ+~-vb4mGXG&D+6@+f-qntsrwlJ<@n2c^CC0#l9 zU@^aa;W?2)xZk6byiv$NXzhEgFebF*jdPaej`SA5Pb7A3bvrh@d`BGKb4YSnkcMmz z$hiqn90~=OPS#dEcOdha3BEzIwo_%m{I6>T2qp}#x_Y%OYvUJCA;MUF492OO3ex|n zke<@T_BXo55xkuEE~YX&nG;Ue0}AEE_C~v4ow8ywCy_kc^N2uV;0}PVQ6uyV-?0w! zE{0)b46Qt#X`3csW$H0pHvVzG^D^!J+0gL9oef@Z;XkynQzTKL|2$6X2*MHC$T0a$ zyCi%=|9YG{QznMqP;(Y`4wnM{RqS%XB1{VN-FGyMay#mvEtHHa8#%Iu=)VDyW0zGK zyh9u?l>#hBNd{$`U>x7nUa%~zv(@TZsH1b>`WzPP0?VTPvVey#~L!Ao*FGS^=6WKg{0o3{fc^+^;J*8)RVU0IuA@$T-A5Y>r_Sh93$2<(O&!~S1%`He^tLL&&L{5XJ* zsM!wtzv7!87LEsGR*S5VxW1SfUSIqYL3%6^nMxf7+E50c#w0OYM}oelyA51rf%DXn z7=T!+@75|Mgd6lWE=M56GMr_{ul8Q)Hl~F<{!ejo(p7(ajMMiCcx;c%zuez1=|Qhp z6GUW#6qsPF!-4&<=3~%qLPrk=4E#V{9`D#T>k>BsirvE!)9jM~9rB`UrMe`wK8_J& z_lpU^VNj-{I;O+~Jkqc)x)ovz@ooxmajty}3C{)~)gB@&NR5cx(h==8rK9{m=cs}B2k5%db`Ga|*`4@>cP z-NwLVCB-2`Vhh9 z%)$q^=$Qu*^M#uLw~+qJ2tMgyaq<}($CfzV?V=i|)PyFi8mG*AH_Rq&jF>YpmN^vn zrO27JeRLr-cp?A;D8gO$I&ftKxNDc-{UupZz*Eq??^DHKl5R5?=XB{9mkbufC(D<+K~?PE&?gWv?K>e zk)+*EVGVp+eXR-JVk--ayG4?NZu^X{C~a4Y*6?q*fJRASMUKdj4+%M}dc$g)MUF`% z#{@+V{nTVAfnOUP$)Kb`Z%{FmiTue!AVljV3J-vUM8~i1DK_L<7Rnv;1#-vI%%Bdx zlv#!p_@FY*&*N|+{XQhF!NTk)oQs9V+~tl8x%O`3UPn!E5{bMKZ|L;*2%ct#j}(!a zDC3+GT@e|5r`I2|g(*EbLg|An0U4qf8177H5cwE^zM~!H4IO8|K-FUODfthgx6|&w zUJ+d(E`SROVMfHh672WTqebDiUhU*7C>V(7@^3|^_pM1cn%vNh(PwF2E}Cmm39iTu z$tXoWAyoj*zq9w33s|81Z*G>q><0#X1|stCOgQCEZl zaQnA~-X3Y>C9$Yb=vD1eG>~+ApgoUFrx1EnDrnO=v(O7qsMEtZhx&02epmzT@M2hc z$-_eq1OI_tZS@QUUZgSoamOkw-M0r-_t3&T{-|F92^WACwTpjGCm zZ}D2yPx#Hau7jAOo5#pzrX7=k8x2iCtj@b*r3k00<^*@vd-y4_8Q_|R3t99#cH$n5 zzcUn*3kf{T8nqYtma8djkKMd&#xv(QH@Nc9(H2ETglral9P{xt+W=!MKKA z1^BgD%~toqs52E_O|)@AwVJg}j9qK9rmR@^?SLsObnUra`fIg)tAf|m_D#|qUjs8@ zfP7tU{K1Ew`{7y|qhH6w2nW9_KGdt$d$B+OS&oich#mMtFoIldBs$z#8`onK0ZSZv zebb=bU%^7YWAR>>{<7UB{K9rbw+a8PNMk!+W@F-)fyQ>atKRdrf4L8mfS-0Eh4uC%gT6>ea?2?R}%;6gX~N2e(}S;LhX;;fUsoN`gJ4a4yNo~^2B|e*7Fg0LK~AO z)Mz{r{p)!=fWlDX!V5q;>ory<%+5b6i=r7k0j>iwB4)xwhW+t1AT73HnoU%Lo5M8H zs<;*{A35p9Su_~->PCYXKhe;;vL$Cn!O7;MaAEcK}(}x^?zR%zy z2$!aH2MGWxrt%{B03ge)Nkyw-pYR<`_1>VZ>R!3s+g{m_(#x8MdONJ4o<;jnS@SS& zKRMsVU7$Lo#?0;+;NdBHb)Pvs;5AU)xdaakr1Cd5q7@Lay3dX3#Z9eVIMs_QVqcI& z{4lq^^cI_fR|jy?PBWh34|JNHsS&0=1D$ZlUTZu<>e_=P%?%yH6S~tt`Ha7sihiQ((n0MyV*%m2W zmRVobdZC*ni(092)G-I0PK?Ff*acw`$07LSEbMn$E)9CvfDkgs>c zgR>*i@F`^4OhoMLAsh~P|BhO0Q&Q$v((+6g+s@VAZemQ;>&k7`Djvj?<%UK}no?iN zg1oj3Y_9&tJ&yOqgV#{N9 z5av_`rL}$`tb5^V{@=q2BFOmgtxJT`(-?uN@l2xt1bkZh?aF;itGG^}_=`0P-ttH! zH_<8kzvXcpz`(Ev1taxFql@C1!!o+*GcXWv@p&+|{Wqa^&>W*i;rD9an#b6Foxt(5 z3|_APa^F~Z;c0mpBTj5K+%#sVJh=^8#pPBYQ{kR0II6xPc2~=?;_2Vuax{3d-r!{k zloG^aGN1UZ5ToR(%l`&VO1to?OvRT*@UUAYBMj-xt<1>W$_5Lj^6e1hOw0-c~AqXK?Xv^+YcLa^#}8ut2ovE60NbIFbn$fDZ+&|n6dvTLLovw7 ze9SfHb(Og$9gpa_rn=9`F7hITNAwGSVt00l6yqrnoD2j5vqc_gF*+vT3xszLUPn)* z{7r*wHlF;0_|);$!HotrmGTXFFb~huPNl4h6lF#ZDi#cDh1&8N&@FgeseW%#^%(6< zeHuDknhZ5qNh5B0c-8niHB7W1h%yT`LSY-pb1C- z3nam|#f$g`$C)_o*ZIjXG^^~^{>}fZpmc|zWc=RadE_CI3H2Q*HRA2OJq`)`%%rV)Q)CJhHr z;BgoQL4MOkKQwpGI~*#|t`FVnuD;~LBV6;LjSTqdhf2DN+REy1RIGF0Q+j7{lu85E z{Uxv<)tRgR$}xtEVFbjNgtcL~=#B-_+VvSwL@Qlz+taH@bvKtU1VG&{oi&o3djv zQV`N%i8X7BArW3Qz8B!J)EXh4U^%zcGCHlaSmsmw|7@umLoc>HgFW zdC74z8W8$6&e|hduAInhUc%5TMkgTo|8X4UQwQKcC9o@!+7G8vzn?X|Qs-{1ag|RJmRLn;>RY2^bI11a`t$3s&`P zK?v&Cv-!P-#P;hjniOKw3(krv9|Qy>Btj3V*E);>dFD^Yqw7dikSWH1GMK0vKLhXY z&|ukOWjLM+{;W>yfn!~zA0yI=1NRq~q-#sKD@(}@b{Jos(!rHmzvzu%0#XPp0d)JX zEOdoWT)O?^;dC(`n}e&S^hjo8kR^#@ zgM25k1%fzEHzgw-)f6qBiZga_Xx?3Nt6qIw9!%b18fr8v5ZG`=4bNc|g&h%rtupC| za_FPqGuD{st|Z=v{khqb_3GI`<$XXcVgPWZGt^Zte%W1g|8;n)5ROT8Q`9P1buzdY zYtal>s2*PJn(+@H*j;^HGGM1S`wX~W?F%wu;R7Ro$Ja@nAQ8*1gZT?n9}3G_yM<*DXSWFQIkJK>=LsM&Gx@tllF0LpzO zDgc1MebtpnDahHQRgK1%V2X9sn8y7LIFf`)#sDYjylK_LW&X1-1sK5vG#|8X8mml}=<4%6u#*bU@@&6TL#;W!r9arNKEgfOZ2((9hdh;O+ zn;IHVL73M24d(STh+lhmBH}}-PHx|TSkbNQc6Nf;XK#2^Vdn z6XwIy+lHU}J2!!)ZD8AY(*Br@EXw}a7t1Qk{-}f3X5?!-UlApk8mP!d%&ard_jB38ca!56d3>lg`8R;%6@_1V(!jI^WT&}}LBkWex@V5(Eo zh_$ds{qR{&@_d{ex3)WK1IlE4na75q?%04I;n*sCpdqyV23!P))a?a{Da5; zi5IY;3S95uPc&uXsc?)o^4M;5e5jESN)Gf=DuLW1&IvI~uq{>!K}~YryuSKsL_$#d zBBeaE??z<9X?AV(wH;|K+sINz(!RaPXm*RpkD)R6WtF>_3AztjVev4I8($@X>%9H= zMryJ%13uy$cDT#xZpb~P8RcB4aJM88N_Bj74niXoj&op7bf$XIQLE?ycQc$iJq-Og6fgO@ zhi&T}wbi3??D-G%q-zyi`nU}z?yozNxDZoxT~LeoQ>I^8oyhijYZbMU&-Dpr#rTEo zpd8c$QzNU@-d7^V9QTjouO5@CHD<` za0P?p-py)vyWnN*^nILBpsntmfQ&!UD$bLPQ+Hw+B7lBEKy9bIpA=MQCVGrngSi)9 z@mUh>|5%(1)+#pRyW5zx-PQCTSN#c8`srYpWZ{u^uE$tB*yZ@A$MK#UI!nc4%!s47 z#x>g`23$}7cRWV7_FTPC26}LKy6SdL>liSP2uZn?f?%F35$|X=sv$)|@j7|hw>g?r zV`riYxR;ve-)h}|i^y75J=UXxB2@j`^50|-Ls6$eixGvEG= zqGd5@nF`<`#P=>m{3CNgPen|;Au&6>m;qv9ZM9soVf>nF<|=Bk*y*Wx+n;|RYATOX z1XjU3)LS>Y4TawZXsfpCYS5RT?gnw;Ix-pazL`9*1%;_^De~3{wbYz1^2NMtwa{0q ze9y+B>&sJNam6DFi!+JEWQD~?mtaJU=%J8^7ewNQ7l=febC?S_^m-Kz`SbKRyx>ni z5Dsk>$evapj@S*+2k_+F64u4ef-2GWBxfX5OaCluv5|CV4ZC~R6d3bg^ML4vy1^i( zqVHNHn5$IkPmpTd-FA|!AI`JZ4={6Fk!)t&4372jH*b;HR}@LfB5 ztEZH|$10z}B~CWiA9r`*Hwz@<+IRn3@da=4p8~YTOOhXw$ zfgxt#Fn$ag2hNj(cB1hN`Y+&sDpnsK;0+8$@a-_QuLUxB$==4UrOZ@-+7=oDbpLAw zxk}*qrj2Ux!5dzz#mDm?9z}bjJgw-JSb`|cQ*9#Q=ms`o>kv!~vg`?F^wnb>J_$!& zu;~uE)-erJC^b)=rfYOl!z2uaa)s`4y-pY*kb<%0aP(1RPi82blpb)qh*pI?&!FXcEkVl z#r_EW=hm`!)g43I;1uR{a<$1IX9yF8_5Y(H^G?w*yuax`(lxE}R#~-SF9K(@s2jkL z*qM9*oU(g}{AwiK{|ELhJlUadZYV1tTn!;G`uuD;`*zg)!wjo$d@Z%17Urp}!`u|9 z6q6;rLf{k#laWO;ECOFa=m98#GQN8~iuimuvvv-`D^57l2mS0*$On>A*zdSneguC+ zX4MJ2F}fU4lU`HnL>y~3fAb)uK7e3U07hwqEy<=C{2SjuX<3MWXj9wfDJ6dvAR;8W zW6-I&BmI2~g}e#P&IS~!{TV?c?$=UWg2Pir(pAsIu*h(-2!uI|Yy`&Wb6&Nui0Cgj zO}9`#O7`3Vjlow6n&d)Ii;;9BM{hG7jO38;=@a|tw0H~h`=LicjfF1f2fyFioRx^q>@s%Rw zt4M+}CR%T!f1KK8^VFoag^jY=JOe*!5il`0bN=je-#K@eH#akV!sK!W% z!G5jbwX9R$58j6QIDl)KcTqjN;sK?e#dg)|Vi*-x*TY>7t7m3KVYGkmdhkP^_!1cZop)GRA`rN9&4PVM~ zMtaYcgV@m_Ik1_{3_R^pmUFT4Khi2?0%H1L)&SpQZBeif` zoOXh9-{@QAF?>268uu^EM|oE^t*&2U@?jL-4$ov@$09?iibkIWPeKobKroWN+Jh~M z1Lso8Q;Re@7vUAcb!0=%F@Q%gPqj$^kKzn|!$)c{U*3a{)Z#pT!$)dyA-~}xwRkeW z!502T5v2|fpMgF)5=*gsH?V+KM`isd&2JdBieTy%n72F)FlW>#K;f|3XFJpx1*lFy z$6A2mRp-@sh2{v${|!)dd;nYn&hbvx*IYckWZK1d-aSpJ2Du%*uJZemr`}mI%bPc& z{JxaCrh9YrhNL_+odinzM!)bB@d{s^qyb1Xr`;xw0KjYA3$*Jebwz6MVpW?zDFwfL zqZdk=ywM2E=Pg$f! ziku5tT*7BH4#L;;6ek)lvyKILYFySM=L zuh=0S^GjxVbRrcSnTT$rf>?Zt9S4SpKzVrQ4%1ffzFK@6tgTo;70uT?P^+Y+TJGl_ zq*YzWR356x-BEg}R?!Zgc=^?d4wQG69~qQ=X|}gNtUdXTL|m|OBs<%CE;l0`?fAaz zNVZn_IambcJFq;gn6SxVhE8<2)}ZXj?Cg=*9t1nT6i#B{EUjWO z3bSz~AMEy1rEsEZZk=k5?X%F2wTc3(kjg&N+sy*EMggozjC@E@qB>6O4$@w(AKHr`5kq52bdK`pTrNX;@xB$ zqhb6Jw^vWqs>+c;;TFLE!s`X#IKYxe{FM&VDt^n7)hQ0#-*WX-yv_h&++a7-@95Oo zUXtJKXoue1t5rTuLSWsVwbgB0c_MNQ!rdPsWJjgK`#eFbq@^2UAl0|-@v`O~+S28* z{oRIPCF>LRuc|L~S-USUN?#n|zMu!5yS1uP)dRO99#H(kTMUf1n}Pdhwvhj}Vm~6k zx*Onc_T2r8TZR87S@1Vc1*;cZ6`Qae;g|s#bY3V`8;HTgH1{@0&PBS@qgJ- z0DlrRAtpT&|Zem0*(e*+xB@e1&6q@;kiD}jvc~^~TE(yyKy;PvfPYkre?w6eXvgt2K&yze za#MZ@)FZtp5Rq?SF;yUe@%u_q|0ZB0EGurzW_F+}Uh2P8t9(#EvxQxt1V=0*`2V@$ z9UJpMYCXPZNbQ#Vz}TFQ>Nv8Md?_6o9^6^c8Gr8W0r}05-5JS|k^P%kU_Lu4)GPLm zvLVP+v@Zigi~L%$9wox`ze}rJ6kEeHs3D5G9%6-zXf)?2%ud!mnmzXXTh{bNwNQs7 zM^l?Q`bXtB)@F`AQ8}91%#jh5<3yV|`l%d1Pz4d{^wqtI$cl9cD}7si@3;xoiS-J` zlP>>Pc3h_ZxZ)ZTM8eaEeUkFGf|o9=+ znz!)V2=Nle?{M!x60KqtWsV>T0JMQd-qg+eEhGz;FzRMPoVrBqQEew+NTO{Y&IH{G z2olM#!?lWuY*LNNq1o9Z;GZV-9B;EJ#v-;UcIuXRNy3?P@iuWg7aTuqsG}fusCs}m zo;`K@x7yj8qq8fqh)hZ0?Cm7`PCI+sR6kEq-Pe4H_eW>K9q;M2Yddwnd2KOrk!Jq^ z1gE1J8O5%!?ZMGQfp?n0!HrJ4j(#z#SHSQqg zS5Lw$P~J?Yfg@$^j^Kr=!!T$?Xeq?OLVJzHImC@zDta1z=GGD7tmUqsJw?^n_E_qu z#!~K%*%zG-)4Z-5K|2vM0*iaZ=3MzR?0c->$1nL&g%7npT)>}m`Ed_F?&Qa9{I~@l zwEyz^b^N%7A8vkJ#g8lSf%lj3`v`sv;m1IJ{Foo-;{)$|@q2fEbm2z|KicCXN?=aM zdPQz;Tfe9?Bv7}wf}G7IUjP$}y4Pq+%7ArAb^6vdBG6@rxo^k`D+ZCG_UK%5K5{tM zUVu-JmX8Y)ng@H&b(Zf5;mDV(eov~WLp?kXgXytJuJTPNkcv06d%Lr6j|f7dNnAHq z|My(RsCbcan}E3+ZwACaeO6PXPo(Y@;kuu-ktp?F9;Oe^cjt~v<_=&X9B}fmKAf29 z?XImVOwXB^?#0bHFe3FbmpBi@vj`9f-2`yi>@x@1El3=P;Q#zfN3iVNPToG+Dm^&| z6?emz4msmGcst=s$DDB;wUu?)WI5#xCRTaoX8BgR1^zJ>{Hd@6jN6bLH)OY&cs;f~ zMvn%M#+AT+(m7=b3>4aRV$)F9NF^Pu5@P}4lbdsKA|m*bjg#o-X+V=~Jj;Db;E@9m z-MIr+81ALCl~3T8@um9?U`!-U161acTjWxyWR9=*;B|lM@g+S6S0*z4vN`@Y;G<~p z|7E{#rw*N)16$-cQ~xTlAJi7yb|Yu%Kg*vELpFTp08wMNTZlqWDj!ijk@vLEi0SiU z%z@e}++CEG|8{RKPjPztpyoRc`~KD&gCcRBZd`)@bHz)4 zc>^-SMC#C%e1UH~c?7jG&*98DGCNsYHNu&5aPB#^yf0M_Kis@t>^t#`7HX@CxM<_qBdSmpo`Plex4cANpf7yR}A$1mqUp_JhF znxD3TUyg5W2^Dq0wC_L$rDZnFuY<7UObGd!7casA_=(4{9z2O1W;qt8YwmY~ef)}u z5V9E-Mm}7aP;kuwYYz3NgxrvQ)qv?z)g54ih zXQX6{{a{N;YJ^)Y@ciqsD^Ex{|6n859F7k)!O1+qeSa0-+dMYHn(t)BpmSS#bj%Zl zKMrsUf9L{@@Ctu!;P0s5ZyfM95%}9AkvM?At-zlOx&c5i`CD{SKlIRMJ$JLhAJ+dX zQN6b6l2qS5;P0g1Z#(d}UD-!w&!IgXi&_bC`!01b`shi}alJo+>A?I1r3~jQQj*J# zMsSBqa}Z0&{H@>)6>wKoaF?wkq%qFA#NrJw!tFvXm7uPYFj4H+=CNyIFlTNV9*wUW ziK1x><2Ih*@m(GY!AdpnLM8s*MvwhR>%VO0d$TTYS&nb-7~iI{WxAtQ377Iv9Q

P4-`O z0w~+_Mss&+?nJiR)%WH>RXC6mF6`e{zrS6$20J;SR!K~@KDWz;xG!fkCb|y8#2ML*S8ivAB6RqGH%7STRw9&F|}2@mC2ENELod z6ONdd#jGvAa}7rKK=q~ei$`x$WJ%{)aNIheEn6`>4@4V!x<>e zFbDCpMXaYAke3mF`(t=X5yPdT|JeR%@V}Wte<0pTjOvQn!esM?(Kz9S@eaqNd~7xu zNduq3W)G?@qDT^-r(!s$x%`{eUKd2jWK*5T6GtY1lLv_P@U58m)&h36mSGn2C_^mp zY$oG${%Hcgy*{wvC)CrRB2#_<@KHA4Csta355W~qh-V`(3ke10LK0IsU!5LibHk8m zNCWet7Hl!twd1=tU^H6tvygs5WoU_e_jCs0-SKoSqgzA`p2Wp`(m>D;YD@t&jIk<-wYEDY(hyKB&UQ=B1+;`Bn^P7EzWP#ZB5wa2Ixz}@HFz@amL(b7 zfAfk~SjK8hY zKq+_AOE^&{%^LyyJ$T^%Vejn&s;aX7aS+gpLid88Pb& zkw6Fjl`igrf6J==$Na<6JNFz7oOy@hUFDU+yPEaF zyKoJqogs%GshRR2D&@0{S{a0tvA@0?H!5|kLb>*6w+IE#*NY5D^@|`-ij94Cs{f!c zQqifA+00LP7@={ySyZ)k`d_*>VzUwA*g^?sf=Lj9=iejXnVmHLw^=vT4vtE+G= zLvOA5BrdXY;e64_)cLrT5Y9!g`$GAlmj8m6Qpe0-(NUwJ9iTBQpONAF_|x=%DZ4-U z9ou=7YQmP|T^ajxUgeY?ju(yh?$A#`ftp)Z)AbAIaKn;nd{kbA-1C-#g1db;r(y&3 z(0t$Il=c?Qui9g{RCu{3l@D$cxhI>CLOy12W7b;ahXqZHCUz1Jyh-o6Wti-8s(;ugakvsw&2& zv??iLtMm}R-KsPks%tu1kn&iA{l}A7R_n_NFV6Y{7IX#Ai8X85VkX;7K37JMC z`KBIQ2DrZ}Yr*k$aet^hBFe1Ua_nf)H_xJ+h)u7|ismWU#X9G((vs;=Yv^T8-ueWz8TQ3BMl_TCUP^8=%27noP8E37){DF+;h9$ zNM*LsNhu}EkK(?-u5JDC&IQmMP_vpB72)BPZ~D3wKc)-xCx`t=;}2YI*7^Ul`rEyw z>-yV|4)uRif0Y%eKRIqI9xbK*w!Vq_>qfb@)?dP8)Zd0LI@I5oB^~PTpE+ID-;F;* z{goI(NtMk+tK{;sX)RDYi@`_cOQV#rUdKc0{HMr~TI3mJJ!k5FS!2U17n ztx!rRZ^g>AM)`kr+GhD~cy)&IrPAWnO~dx#o=xYfRr0Ul=?2PWE&un&U84E(vF^ds zRQ{MlPa5N+jsl>4w@Lm#JvHwRc(sUX5BA3P7kKtHj*+?t z;STB#FpPIr4}oe`MlbXUgrO`A-N43kbE?`fv{xP^uVvd`AUD+*gZ#h32LPpf276bi zFd%=7B=5c)m;~s9q3CEifTtRI%1CF;)JRBOXz?5NL(bAR&gVI6uEGbme_A&;*x-h% z4|0N?07idP*I|tIFC6~-iJ9-n2OL^Slgwvri%yxoAm2YNQpjuw^8UpAZvXk^FZGIm zXPN;6$oU&^^KaVK7WN-{Le+oePt6ypBL$>85b4Tog(v}1#SpjsZOPhm$jST$Ge5UI zzf$C+^X7X_zf;BMQrk@`o2e?%J~ zBgV%5E=0$aV%o^SVbhvZ`uz#yYK;G~nQI}Y7SiUR_?SQ3S9&P~eKzwfW}d$aHLysK zg8uhk-?!6q$Q;NtOgQ9KEP4G(W+!TmnU54qP;jOQGas&qik@H(WLEfFNf~A9-B+3r zO8Kcjfl1>e;VEfzR)nWfYz#rMQd!V6mhF6&?E-zL?CkGg)uLdjEFoM>p>)_j1x{QL zh*D!>MgP~>;A4(|VSFR$1z0Hfuojj?^;Q(o(>@*73$mxDX}@<# zG>)hb@V4sQ>qR-3D~*R^F1n9FOkPxY8HGs^n;atc^|c`O`eWa77HL8DibXP|gW)9U zS%L&#$7U)X*}5N@v-+0c_RWhKSNMndDYEhbIe_L%j=_M-?Tb0y%yHK)oUaeO1oM}% z1J9U@4(EL(^WOKZ${RB{?bGe08^9Q^7%?oRQw7KdU+$fMg;G+WOX$wrR|10w6bEs7 z89yOHoBs<*&9NpG#Azu+P;g@PV(Lj_G%a63jKn1!&Ig{8is(^R;c0i2T`BZ4yyg{> z=AVoSy5`aWux&$%?>6Rm>Khs!unkdVqRYwxk5PpqKIdO-kl}=EvqOF!_=N$n$3Oi? z#Q&W={_TM)5TEO#p7vhORl88_p7uCr^&jLV-dTMsUX1dmI#;s!fsy!*7o*86I?LK* z=I5Xx!G>RSWr$8Fl`x(2S%^dwg0<3t*6ZuJ-6fEX(nyF z+$yifX61;$a!RhjVr$l?A0zz=*fHw`n*ZiV@2TvDucOiAwqaXXUY&Fp(OB`_S2~1^ zHa8?2e`PX-Oa{l$q@CiPqxjwcAe!_5o`cSDT+k!7AGBT=dJmz=fUetQKhyQ64iIMa-VG;RZu9y68||#I{Y_}ty{!8FU_9=L0zYVfjHHzh8aPs$D#xgOD-Qv1-2O5d*c7GLuLne;Rp5bF76k(f$GH< z-~C3z@FyxY(pG2F3*=g$eQVk z_}@3`#mueqvG%ha+XJxo|Mv`wyB~)PF9b2&A{N6NRD6jdW+s087*FxeI&Ty1RXfWl zn_PUY$~UsB@-2{)Y!ELa=wk|%aG#L>}X2I3m>PBp<+3xu^(%Z!C zv)S-(hxJkYI3M5gafFYq8X;7fXke1#={CrgZMtxS23**1|Ug~C6l=UE$L$OPvr zqfnf!^M{97vqVDUCe8wL;CwfJz;>z0c>Jg;4)(AxVz|9P6=S+846di##+Lo5$%4j? zEWr2<>z(>>KECDS2p@;}IEY8B(f(>sI-~ue0U3Lkeu+IyxZNJxmTqU8#MBTcdwg)@ z5~05{;5cvi!3byy!)|u*WhiC`@iH+*|Fil$EEJl`5kk6_IU$uBZ7_E9-HgcB@O*sR zkP}^Rg*q>#L&L$L!7kK?QT|WN@@HdgeRXctMKZ%RD#^;X2#H1TOZGDRp920TK zf&*8G3|iH<$n4{vVcI158+uX16>#eCc1&@qn)U+K!TYgcPv3*hf5HS@gTXa{z&y}{ z`#C;;l{9I zm&SrG(?Oy?{(7bYn+fBa{tCbIIpX6@{Gp%8LWYTd(Sjdj;`jek@?S0Z_kKxsNd8aQ z@g){~l!<>-;in7UZ{la#@gptx`igM*rzw1z;0sLrU_1WUD3kuBCceMIA9+^jH}Quq zw$pFH`^t@4sMYr$75euG{=HwA^xN?z7W@aqEB-&K@YRC%oA{Y_{74Iaxrv{q@N)!T zVB!bc@y9MP>HnpP@2~I!6#XXt5SCA{kY%ZV3qHfd?>{2+e_luay?3`sza3v4t!jF>j$D8;=aH7 zJ4;OZ75)yv$D8;=SR?63zXjjl%zyt^LjR^`g#Nos`tA4<3;qk{Z_uysdj#({@iXoC zkrw<*CVra2uMvEKi63moA48`S(tq#GGwE0O4T6t1@rN$7({I7|HuK*f5c)?c`e&K+ z+wmn9{66My(68{PpC@Sg}i-ozgoYNy|V?`!72|FF7Q@n`z!p;_2gf?i9duDn2z;t!LRyN zn1B1f6#7>S{=Jzd{dRnb1%H@$gMNiC6TIKV&$Q!5TJW!#_-P71M(_nDey|;XY`97P zViVtA;iDD(#B;e5W>Ro4%>1!aVZ!-R^yE-#(_|c&%7sd7qfen}Lb!q6KY z4?}NA`1(e}zKt2y!M?i-MXBec80_1&XFAw-zh}#e!6#U3*@&iBej)sw^Azi+_~&8% z=3Zc{pF|6N>si0iNCoS^3O`ElBTRgh9p7@1$)C+H1D`DTw$CO1(|>0EM{f`3|MvN| z{2#R7_fbD~7ks_KZxMW*iTBv?MHc+03xIbBzEa^=3clFH=i2d!7W`ARPkIPGOW~&o zeuRmSvg2DWH0hsZ=HGTm=pUfypOG4}Z{JR{({I7=CI4BAxSw6&KYx<^t26N)JHE(* zuUZUztl%pZeuLnPO?<8$pJ>6~V&g5SOg56k5=@Xc#j=lWWoQF_PJ623cqum$iIotwc`^l_}i$TmHcHX z{A$6EF!51#e9KUi{&Lzk2K}E2{nG`1^j4F8EW~uA--5r)EPuVirwP8!#Cz=cA`AZU zV&t#nr&8gMJR$U(_*^?a(SpBeJ@CCnezFw)Wx@ye{BbZ{zZa6 zdW%W_AUpjQ{JoC@&m%vOe}&Hze4UB+*zrXc{4>6lYS57-)R4T7y3V0Oa2|b*`)s*JN*{?kxJl=`d9dMg0D029y`9s zg8v7c*x)py(68`w1Yd08bM5#<3;wRVfmiw?OW{WeeuRmSvg2C@oAj@u6=KN$Cqn<} z{}TFdGU*>^r{98iQ~xAM`Rf&ai{R@_yvL3&vfz8N{VV=gD*Q^p7n}H8J3i5ZZ>Ib! ze3rsb5&Q@fA7#h4oM+PiFy+^vf4|T_K+!+dq#x@h9reEjf2)bFSNPBWNdDECc#j=l zWWjG_`&05$sqh;FUu@!Y?f66sem?8p=>HVHOzH3;y+4z#I0D!bdCmO}xjBFS6h-VEa@2uT=P*kCA`HCO+4WPqg4arv8W* z`O8xH)q)>k;-l>NmQ<7eXDNS1{qGa{rwjh*4JQ5l?DSjk+kXyxl;mHp@M(gtGw~if zzQ}@q<1XM0{jcyx)(HJ3KG%*1X=)b)} z|02O3z22n%Y&-oHe3V)KdWFvue4UB+*zrXc{C3KZLBGPsDf&%(t{tCf!5^pms`|@P z_&tx3elOYE!Pl91 zj~!oR!Qc24@M`>3sqn)EUu@!Y?f66s{_G9F_fhq)@c;gU&~M_S?D&>}CjD>z5_m)Y zKNR{m3I6D0lYXpdbfn*ccisuSs=s=LuNHiriTBv?MHc)8vw=7Czrwo(Uu@!Y?f66s zzPnleEQL=}^qcr7JHBOrN&nm#$Y0ryZGRK`KlwfRceKc)zmJ`M3w{;bkK$jw!mks2 zor(9@@kJJV1IHhR{#W=pf-g4lxpsV_1wUsE@P_@b@S_Aj!o)|}@h$yL`iI{Rywcxo zdxZYej|lzOne->y>9^pMX9923zrt@3e4UB+*zrXc{G-&r#`ss^R|>w^#OK=ai59&3 z7T}fs%~JR&f*)bxqwM&WekT1Htbc?4-9rBWMSr15f0CVk3%)<~zd^skfBrl2ug=7K z?D!%Je&cQ7{3{iHgW!uze6AgzXuHn1a+i3qSLjM@S zAHCM3zqg%!3w{*&ui8(&!bdCmO}xjBFS6i2BmWKkukbq`CjW{}e6AgzXu&^a;xwOZGno{mnxEbip6J#-u;dPQL|TO!-&(t6t&L1Yc+3J$8JN1;38^ z%aDJCKk|^!Z{l<9_(Ti--;_VY{#E#w1wX>XN7?Z$eNFl&(*9EVr)`(ezew;$3rzYG z?DSjkm1h3+3ZEzVIuq})whx59^p^IQ~=RuUGgx1Yc+3J$8JN1^?A@ z;9Zh`rNR#ve6fkowc`^l_yd0cK1uLd3jgol3jHQN%8qYIHtAn*6Yxg=_rB1-N$^J} zne;pD^jq*_Onkk}B@rf4vwKoE9=zoPzQuLen zC_BC-$)tZX^{-+7z9;m5@*w$lbfQWBS$6s@c&~}CSNL^;uQTx;JHE(*-$?yy(68`w z1Yd08bM5#<3;wTczlQuP{3yYXF!51#d`oYW{wfpSwo~Xo{Trb_-=rT49UbjI3x1M` zuUGgjg0D029y`9sf{$SRDfz2Z_?3b$Hu1T3e4+(kbUpA!{VV(w!H+QUQFeSwqDg<& zRN#&N|6QSffTCYB>5sG1Z^1ve7IBSOZ13STDp5hgy$j&DgY>2KuxwbEa0JB0o*f`!L9y`9sg1=$~@CkyiRQR0_kblJ{KG%*9^o-H}UlfpCt^74i2P(J{2o8~H^Rh6+3_uBne-2*{xbUi zZ9@MV!5_^t>37)ax8U13eu|a+>lOYE!Pl91j~!oR!4K#7QORGW!VedGv5C*M;}b3T z%ccWww10*F_e!DP#7EijE%7G(i#UE)^3%3e=-(vxqq!#iJ?!*b@b&iq?^N_Fe6`@~ zOuWaAFS6i|vi`dZzEa`cf-g4lxpsV_1^+-1@G*kVQuriAzlo2s<6GiP`ZelLRex>o z2>qY<$iJiGO!~Xq>9^n~+yT6y{}g_m;Ok7h$Br+u;BTb;Xn71e|09_W5*X+@XZ`QEBUKb_zi+DHu1T3e4+(kP5q(DpQZ3+ zf*)bxqwM&WSd;$J>ws77uWhr?KSuCJuQKV6veR$DH?sX2^ecR{qTj@O?D!%JehKAQ z>90zK-?@VPD>m`Dc6_1*|5{rA}IjxVy{_Y?rH^jD?AA6YK+oA_KiKGA~zy@}6K_?HDg!o)|} z@hv?}`tQ9q%)hn9^pU*nSN8 zSNJ;wUuWVyc6^Zq|1jH+A^!?LT=2yvKG%* zGw~ifzQ}?fXy#w3@N)!TY~pk6_(Ti-$??d)oA577;YSI6go%%`<6ELk`tRZXIW_;( zwn^we?GgGjLBDl>J8E0XblnJakq*cwn&)?@5i{FL_!9ovKdVmZ-=Uu@W%j&ky3 zPm?|l^dnOQA3nRs7s(kBaO+E3;*uV-aNay(evgdp0Ut8K@zabJ zc&c3TYaFWU2bXnP^FMJ8uj1}}&w(GV^+(IWHr$Sw`9aCqINvoTq8kpmohnU~kRF=< zhRE7r0}et4>&M|bnuzFGaB)#?_|Qnn8}1~ixbuZJB0{EDU#a|JQr@3Zjo+yF$-dFNm%(S&+KXPz&$f3`$6S)5d>G$t4 zeI8fC`K|r^kV^-aboi$Of9@q?szQvB^K<0R406X{%`G^YSb?*MRTF$usvHx1c~#M5 zk1H>8TSafabthYJ0uNl_{k=Ij&>3P$5?C@GZdj98-kcN1I6#fAp=K!Yop19Lq2z{gItakPbKibmoV%ESdhXbPkh@UMKS>NpZ%lstMggUf@VWT zQ*o*edw}QSG~9=aZ*}{}wYxJnJC`j(47U#+O5zf)^~dGo9Ird_H0aCAe0Tn6M4dkq z=ki=Qyonf>F$Uex(v9k;TH_D63*_5L{%8m9&)u!xEmtYY6~n&5RQjbo7x|@Ro^x+s zq=936->7)E!;29FJk>nWs=tqBsBg!kmPh6sJY%c>;Q&}h$>+h^z;N3cG*!Pm9p`C{ zD#fYYQ#jh$GwjqC=QB?%xdL^1Wqz{`LM!e>*-^Ji-fR2=yh7jZMadI&v2RE23wDd# zXSk|GTiq+Zgkwkp1yS_F1cUcOJ+1drF}&q3O!eSiqY0apRzbVpg7qa_@Ar=UT)GuM zUUhg@?+1!iG|>aTe;9h;Ns)7=JeI|pe~~t`38x9~U6PFC9+PyESMi4jc!N%yEZkKI zpU|&FPrT)As2Uu{y$~mo&(fN|)-v0i%YqaDfAs6)ov)zM86dvVsW8aJYVTk$oWd7D6e)b65%Xggyg#0@Lzmv$rZ?_kIJWFG4gl| z?Q7{Z{-mYC|0eQ3Zz=fSK>jx^LJOM@{-Y|%|CRy>(D)qR#5jZf&KzG)@8)4mo~Fpi z#@b+XWTSU;=8p1n5G7PYafmW(hv(oAk`Iw0ZYDl$@m!NAy zb)*m5ii7BB+tmG7dfP7i_u>0MG%xC~)BWlz(Z@szLt<|D9*5_DvynYb{Nsz+(|9gP zRXeR+`b{U;xAY2mV)VxhMeNW?mc>kkJ)K@8@Z?_#JTC-K*ZT?Fa*!=>+Jt9^;k^}n zl)z(5_M+m!v;`g&hVS{Sbd%pNV&S)rWZ`j?HXZ(B?D$_;@Y!Px9_XtT{vE+D zv*4%M@fTX~HN*?`Qxx7W_zA>YyXjR!R5yK1D6uZP>Dh>-UsTzlmQIXA4zz@D9^v^m z)Kc(esionP(cd#jD9(Gj^q1h8s6#E?huEQ7dO91aa6F@L5P0%;mE_YOL-2IHOyHJU z%C*36pgGUsuwJa-ZwmZ2!mVUJcYz}Fu25oKlIdkEu}08-^veA(NG^lQ?a=Lo|EU@~ z?K09B>)aS~7v6a5!-|;Li&Kr;3`9RIpzM3bevr%_S{upYcOOG^xm-JJ%SAN%|9pEqf7Irx8o87)_huf#YL%H~mndOG&)Zq0Ky;I1` z#=4v7{tD;wE1zcfvf4;$;!w}nrk|yP4T+ks1pe8@f07)D<~ihXDRjK4!P`SV-8~ou z@EHa07N!<>^P1r~Ju3qDxVi{B*b{i8x5^Sc)Geze@B!tT z3zI0J1ZTzd!5F@w{PZmJYoz2En<2#-06A_N+Y{8TQAPHzlpOTlf289)MTgs8ErH|J zov9=7Yh=qel`Y?pV?s$f-&D5rd3ylGE$}(urzAVs?JG*Z)}Pd^z+cpkd(H|5?W(P< zb$iF9yZ!J%HQt#p8h;C1e57i)!?cjQ-h&4Yl7DE8F*!Sz!3OnNuTnT}7hH7`>2$4yhm=Hu|5zYC<0rVNq< z7UMQszLDU0sqV;$ID9`5@os8|lbQ-Q!1)69C2Ia?_?^h!1qWXgEwM;KuaK*B=f=tK zfhzt?+Uds<*Q9w1(_yxUBI!wJvdU-?&mj8eACV+jEmR?{z@=wupp@@cCEu;!p6Z0Q zR8hEVQId{A4e6tAgyz!Oa)Yk;NJGVR{g3JxS4-<(=@j^?R!M3nc<*#8>G_fm}+$MuIW zSpWwI{jI@oQX2G1d=Xogk}O`mA*3u8N|K)MY3PBmNb7$TDoWQ3X6W`!gkZrVCtfUq zl@H$>1#rj(;o2S&t;XwnV*kUVf9}8u$d-Ols%qaosXy!CnaC6`y1jvqJBYFpuTc=M zFX5G8R61Oegv9Hzka$&u#j67L=eTrKb_wKb3FPaCiVJ|M5VXkGNXnNNw^tphqIel^ z^nVZewo1;^f9oJQQ153@?V=><-**ADrxKw(=%Yl0mL8!)SyWnITKM^%R$QX_YkZ_! zx$s4Uv+z{@!rufuEstwYgS(=4J5;G$GP`sO)1h(K8{b2I@=)RHn3(ysFq;mKGLy?Q z2ShANMeL9ZM16xe5WQscYG8$SL&@6dzhUE*)!s+wF6q zwL3jCIW7VZ3*FvbmRA4nb?8w3{J3iLO4KK!(f?~mDmxUnubaL-C@o%TzixDM8e(Rl zlrf(U0Trj=U->kIM+7Ahu!<2}`TkGX0;vQ$-XTTkqu1is&Jh)AFy%L-e?4N6FVEvw z!hMP_P58eHzWm(a%hZm1d8rV5S@kD7U-n;+8sf_fU!93BQ$vNduqJRS%$URfTgJ#; zNA$GyKqF}aXLjMYGiMk|4p4h3({HudE8v1iN-NPFB&AkFg%{#=i2VAqqfc2 zM4epV91q7_FlXGDJA!7wO&$=4(PA;cmV)`CIr7^Z-9C&Bst_Od|894BCK^o!LbTWI zeK%x4R287fO#7pfj}?fld8ta)4^FknN9Ey;@&RxB&W(yGba%d%c|es}Fg`ghLVx}q6vZF&7ZsF>~KGO{QVhr@MVP7nuv_LxOx{}tY#$OCZRv;Yqb|(H7(ga^f z>w6)s@`c%a6!I~HkGXifRt2*8OY-@<*7y~r=Z_gX7cK-I@nUF$tl0cnszmhPS5DWju$Y_l2XGN7uYk<0-p@J7)skYKuUpQEhO3aav*snt6u^)O;K%a0 zHvIhvtR8$n3*TP_D}-PcLsMM_3rLst?Bm-a%X-vn_!5k%AI)4|S&}{r zPW5|aw2y}`vY1-Th+V=OgSb}91p*oSgO`wiSD75fP2j3zVx-LKE2K;{@w+8w<02R> z^B>Mtu~I6PM!s*rURKdu32V~Vf5W-0YM_Cyfm!}nzMvmu1n0)D|wOSOs;;&TYgEwW*E+}ORdp5q}O8R!UFYW_(W@C9zLedc!OysT2?#!*u zW&b5{%RYcXvMFsezQJB`F0V$Y8?MXmtKbW0Bf-2Se%Q%L{xL;bYWbO;I9Gkd?~npX z$~WLszVAgC=0)^}|0xZ_S@WPIvQk|~fd(RxGj}*W(!7yNDF6&Ko;B$Y7YJOQRyugIBb9pN(0ggcL`-&BhS~-B^3cQW^!@im1 zABEBQm#F4eRP$CX@(1^@?WktCuEJs7|C*5g$$~Per2eT) z<%9aCGMf+TpUN40Q2*3dAu0aW8oz6eU!{LS$+_T}JK++{&&*?zrFgjJG2K!;T=UZT zhKFk&r%_5_bFWO>1p+ZlB#vgX;KWQ8+&svb!p(!ADcro#>{L_0H%eV9`RAY5L-Tyr zN^@r@|3`Q_ez9nlHenY28EyQN$A9S27*;#=GRAA3t?62O1Me4Xa{6C~$*=jv|F`Qh zl<0DlwStt)CnXi6WIhJ4h!9o&4y$DaxR8(Q?;6{$(i*=Wi#CVXC|C~NN{8jcS7zhk zsQh8Atp9?VhD8Z*{JSU)u4-|}&UkHdT%#6$CJ zV==YNZx+v??F|RzuFKK#$jtd{jGV=B&1Z|88!F(tR1Yj58o*h-|`Z6vnyT zN=Nec=*9z41;ZMle+z21FX}%5)>hJl@y=(OCal0qa0PsC2mXM|*wBAwp``i^EYNj) zxcRu6k8yZ#_R2T1@t;v#HH~e@+-V>dF#Q64^WN+lN1xnin6P|W9gCakds3WHa+EU8 zq1wm3(!a6dC|H=N3E38RV6v3o^|ptYjp~YEU!-`(YW-7{eK8K>TfINld(62ShcQRP z)SUFs9w?{nBE|HcFbWC}nG+pQOVJsg!##4G&$Q;Ph|Xy57Pt~o^9 zamM9q)neRPid~nB$tA5*kss>EB6D)dq5tC3t_sZd6kN^}8}LTm(}Z8pSI>J#P@@tI zO~>HCvJ;_651F5yY}l@FpL^0VKZ6%+57+$Hsr%WQ%Tuc(u=*Wa3hl#=u2p~PF{CNC zM#BHXXL$F=l#LTRDn1T&)a-d@Fq!m=r7#`rYB83C%jTrCpB`|U<_K!*J`m+Au5Q6;~)AWMEXr9FaQ z=j&g_Iz4?5nf(y8EmhO=)Y%-5$}d!7hZK%2{qg`lK3_zqFtPhPoQddm1Oe`4_8Sc-|%pi%-|ayu9CTY!^8Dr6^f33UQoZT z7mYsU1@-HCajo%P{kmRcn_ztYYJSyCA|3V_(9){Upqf^F4b`;jGb+;gmW^l?c(_=g zgbF-dEKouP9xfIrp#l$=QJRE}Rg#;_C{4mfqf{@fmGFd(>enTu0eGV-RZQh8u)zB) z;o`zd!{S7rj!_`E=o!1FPbwO|L%$xYIC7^F=BJ^|s)WV3f&7)#X>0L5%Ug(9X0=@6 zhQ-==swZcbX&WdZnLFAuwvcIY%FYlm^g|T6;BXAuhPr))>H4+ECG;7&6?oyM)`*qw zt#lQ5C#O)Pbx?%smWFEH1(@+SL>#Jx0-NvMr8~~ScZ456Jg5%jM-lgYHUr+0;TqVu zlxyi0HW75C{(&ETgasFW{H{ka9`xZ>IkeZbE2X{uy$9NBO7R)mD`(+`>igd6y3x`d z@6fC`QL9KaL9m>|uc1{W*r%Aho)`(e z8M{~mt#I7l_*E3fey$X)@nDp=dH#r@-jg|O7ZEwT59CyTQ+5_S5br_b-`#+);3iBz z$s7KO2tEtds@-DTCMNnXBdnh>^d8M23CHiSFzMG`UpSj9uJCrOKlcl~iC&iN9fl8e zPH6n~%}zWDt|Kob{oY3U4!u~V;6Sx-Hw5~R$`CTR$IiPjzC2t$&w`;5Wkr|?NWsW( zd)cK}`PHygh5aeG{`cm-+KH_*K;oOE^Q}}oH0SseS}Z)l@6t;y$G@uZ{+RPI5{6*> z5QFMJ`f7v)Q}mJh?(|6IP7%Pi%q$&&Id zVPO{jLdsX7f~GNO7J`iOW&P*!IhQ>LR)l%z!wr(yh*Z6d{6Q@Y)%>_uQaFo=`2{Hv zWjD+IHS{`=zoFPgpn0xzl#kRrOB@kp7vWk#hx7G=JxZfA-&NQQ#13&I4OAa}V0#v( z(0hEC(VMOiLY|C5sh`KrA~5;=2fOq7?rh9YVEdT!m6GnW zYL4R`!sD3A>F&G7!8uBh!#f)GVKoi+s^hm);SfOnIG6p#l;5GwjauKTlZo^Di~U@6 zG69v1CEnoA5Lgar#cNvC$>ef)(bPuQ22-j|_Az3_SDox@yu!&p^+zlfok)saIu`4k z=vb`Wyu=G`_B-Czu75WfH7t@4yd0A7<*bl|>h-UM>i#-=-IE?w{w0?3Lp~$RZpE`( z*#!EJZ;e8q>5p05AJfZHn^GQC$B_TF?xU45EGDs$TR&KRyFE)tGZEDtFPr72cI+V?yKZ(|L=dBzjN>vR&V?W}HB5}L&z-9IqMP-lzyA(A z$7LRDyHKHQs#r0@2yMU)=f?iW-*z}33azpmA(0dSV}{$8lg|0~EF+a{rlMI>iQXae z^Zbr2f-q=!Ard0ZwnlRAK(XYKBz2pfw)A8KXk2s|SX^~0M4`S+nO19sVl+}-Drc;M zA)>7OtiUhdgJbkK2$Hf{*7Bo28Xaw;c49B&z)>=oS)CD$s!hcfxTpI-;QTQ&FBQeQ zvK^vu;~j=L&Sm)*=tEvnGC7x<7ZwEIX{WQ|G#VSn7q!sdYW;bIBRsy)Y2IV|ODldM z4eI7tymWm>D?iM|~#b0HeCcI86`9H1Ess(*}J8Qm%Fq7fEsw(>?)jF%6;{Ont z=ViEp8Bh7e>?jL>apo@h#jUF%T5Hl;`Rk8)q6cFY25 zAv`}?z1>;;pdePKMIfa&k$PA3K=Ea_zhC|Z32DVJr}~*#8Q;rL=R3|P`!TDA1YTDO zh$Y9dhgfnl_7F=>#vWqH%|o~OcDCke%x>RN{yt;2BJp`h+?Wmqb1fzMDT5gnQWAV$ z5-c$igek1%m)FQ-Ei+)PvGzuTbY%U1X`r-p3q=b$3dNQ>hr!M|*RMOwSuUgO|L4Yc zP%E{R%qUE=^VicDp4)RNiOi_L@M6Q<6YX2GlO0q;5>8VBssj*TEOslwWakh|g?KU} zDo~*dT@lV@E1~-}Up_1mM{FuAk$8^7q%G961bgc*;{taM(9A$2lnVO{mOjSXEK$vN z83 z4D=X^J5A2%-77+^*kRd}7g_p^0UL~ui=c}x`nIh-h#TuvA%LkldAth3eAU^ z0`nlYNqz@D$u8~MuiM&rRdL4g9Pc;!pohN0`GfuosmoRiQQmQ|Rb&40Gw?a@*HF74 z>wpM)O!5V==+YVHPmU!gy;$gbt4C^RKq}Ed1X&YIBg<6Cb*cIv-em^rlU%Nni%Gi4 z(E4+s%yVE6Viuk3#p;Zxq)-jue^E_FGnV5*XyA55DT?KTkYd4f4BI@XVH{F&NQwN0 z6z%`1rs|Iwcs=zhX7x}=y*6F(e6N%^=Jr3UZzM=B<2V1nc;1xkkNqf&X70 z|4%2b!ulBd!~F4cJg{k=8h)Z(?*@&-832F$REGT)VVZZZK4~P{^YCzcmQlxFHlpz! z`wDjQdm2HsKi?j%?x(GvhCx#wg3j*(@QY zhT3taxi*j$o@zEMnvOp*z8YlMwots7;J$lOsEoIz!-n!~!EA&+rSALoU`t0V|Fi7x zjEe~w$y=(RwAK8-vl>f^XwQZr3I(f7Uu7*~F&0CrQ%N|2<2jX3HVB*f{)t77NawPb zfRgbMzB;Stpd|!oGGX6bA>P9`5Mz9BD#f|1hIx2Son7X@vtQZ5;9Z*Ux@;QF3$O!i zqS};5%Xv1!VQh2H*dlHhYtwx0V-Ec?So@r=nr-YtV^-1$$uCmjteF%XyU@_dEX>BL zZppJj45PW-Q9r&NCL)$U-p1Z7?_RAj7=ht;D0II;OEq=Cio?SVs*SfMM==g4Uc zM7c9}%zw8w@ESsmNYU6~nuAf9%jfd$<}?<^hndY4xX(;;I5&>!={eNH`OK%;D@G-> zM+B>7e5Y3;Yi!mEFV!@14Po(X*yw_Rz*LuPD9gsC+K;*3fvd4)Gi~^i>NhTgI8Eij z52$UST9#;@j7$x$cii(%hxHCHENv>4m3LQgImcg3;rx4XsYvp7`g;pUEoI=w-jBId z#NE@JJ`0y2lV#XbX)nVdmZ8>IbomYo7nW5b76R+QY8=I_>R9iZ&m2+XFzWL$;gz8| zpF5^S{!71E=3W?%9h`u4tlLnvUYC9E=D@`m2z0E*T9o;MT1zEvplZbokx_}Yti_#y zN`zWtwMB$tMU3}0<}~W4Z5%>tQNi4Np5)5$eAWX?b~`4lNb2TuwQu&iEMjn#MGPnc znDFQ<0+f%yJs?l7*cPq?S+7$jMN+Y(VSf%lqAt=g(PDT0c4<<8acP@(TSD}J1gz?uRj4%~B;FJ+^ivGfS za+qP}KP)o_TKe^`!`4IQ1%5j0dA2J4)fI*vW-DbCkF>roo3`LKe$ zC7rW+7%uZg!mq&7QF;*(Ly1k*SBz(U<#GNFqYTbUqExAR20IxP4Z#K;-PC{!WEh?N zHF_}D^`TiE3sw7NCw>R20#}22g926lKbYm8%GQHfuX40eSdhNa(nC(ZqF2Og35W&z z_xusGf6u}{w7;i)F4H(u)nw&tv~*n$Qn0W`Uh`#YzIoV@9{)+4#XRRcPbjg9SSH4K zBV~?DZeL`An#aGeChX7?Lxco0v-s%W)}MJZM?05#Sb9W8l>V4CS3_JrnyCyw zTF>a0-+m1}A^N-zUd8{IpMDs8^|Zz~m-B8_GJXaa8>MpqjqwMuRA(~q*_Q1RtY5=| z(YdD~bKHHRtovY+{!dwIQUA)JH{N52Z3P;xx!IOI6uDtOB|9BGB=XTxH9ux%U>%-u zs!FR3#<22dYksx(^`nvXYcX~S#rz+xFlxwQo~HSyvtU1U+etP+rFgjJ5nigXH(mi6 z!9OgFpM?XM7_d~4=r>F5oHggpnPnGinHlASmo9YNaQmF{@_w_HE{wbL;_^i2#(8ID zSN)Jv;=uFfinv*|Jhj1{zL=GT8d$o8)hhFYbr)jBkU|&^)Lm%zwfa}i8XkC$T zCEv6^jP@yQ3~NNw)3QCEakd?Yox`*3Tnc)c{gKiNXmyZ;h4~npt-f7}0dxgt+tW_5 z>M^+La<=`hr4YLNuKS+*JL+Y9!m98`;rGV5eZjcI`6+nHyz<=i;N=V{{~20ydhjB=Czr!OnmampuGl9Ckm+T7 zBN%ircV9xBLqPl|f@wHW_Fwkw2#YAW?u*f>0UGLMl$qv%-GATD9N( zx1r*;WjlJafKWs@ajL215mqJsn8?O^*}q*2Gr%E>Q z%w|0!`eXj2g1-6+K@TCQ)>gSfpFZtzMDEzD1cpGMJLuo1pb?DvUBI!mvcZkryRgll z7w(3(KvT0KkTqVluy2yHhRb8_%$#iJvWZAYw(^M`4Qp%aINyNHC|Q&K;9a}|-Eq7z z(pmivDmvd39??jYwKOjS5WSEsRdVysi&R@oPkiaDy3>eXsQF7$c;-Iy8|U&u3B+u- zZ~FUK<-y4#81PUXaXWAn4q}QkakW*HQ%9t`3HTd-{)blvzp(3KM9If|9 z-kz~#$Jt&XQc$=-xB-wE@dWDktk=bEQKzFLvA2}!7RWLBpO6h>q8p=i3PBM=1d_Kv z4(Ry@-s42CD04%YD`0hS9){)-ddX1}*s)>dEvR4Ku#Vy`JD6m% z0e6O`2Vz6InN5KG_b%MLuKMryT;cwEz087Dr@bn_YtkCz7rmhTZc0;oezCyAIro?a-mrDGCNMm_QzaJYOIFXnxA|INUUzwIdAST1U!7q9-`#cze z?qNT7Paz*O`1p?t1~AmH@8>3&7gh=9dp|RFW%5w0?8@YM1hvD4=MmHn8#xp!J8Vj_ z8OA(I3i-y2OJ?wmxtGkv+Y40?1pMVP zyBxWukxcHWeAZ|%=u|R5X2Md(IElJpo#5WWTyOH=dgKsDhN`*J0G^$kmUzJ9c zivO$9B*-uSXK4Tq?MnK8!hZ}WrJ8+f)XK{HU#Plwv96&)xgk1K=l>_GCRK#-|5DX( z4y^}#zhR>K0CfYm(shrgAYtVLg7iAtC+pF^pFLkKBz?h8nrBnmP*8^XGv~4`@Utf- zGy*7%s{NgrWX5G23?cJ?sc9(uCFjcgyLG9oE84`JPc5m3{jB?g|&NoDJf!zRNyX1TeFh?jKL_D)D@XbUn>-M|~;tITA4#rAvUQz z`-a)-E0V0UL2YgDs*W_KngxJ+0aY^vzC@OT@kycz423XT>JV%!m4f4##j6_17mRsz zG=6Z*q9|QXWb}Zq80-#-uGJ!OmMrAZVYOP?M1Qjv6@l|MXKCJJZZGz(R|5?i(0=@< zjk=yHb)B{uvsQbZo_k?gxP2SMt3iRkvOVADeh2YeDN<|XtP78|EQl+12)-m2BSe8v%!}7L9GSD-plt#r`N*!QF&@X%~59! z_N|BvsE+?-;Vb56>R?N|VFS3pJI(tcwfOJV`eB?%*niHN zxA4Xcmc7q~d{Y6X8}Pa42|GB1vKR}uJ2FY^#n~7C& zd~w!nFg`da!{B8rB50Aj8CPr@e_S88_kcbLzEl{d$W&s(=p6V`HunPNhPg?4k$wR4 z{_RrytC{|Pr}*V4KDH;Y7^oxWhuM49a6#tZoi)jL36&$GJ&48PMjVyc=EmVJKP<&| z8g2)GC8MF!M{##3511sBrGa5!wY;Xf{b~2+H+~+SAGyWt-ynR02{I}TU(3-=xDcDK zc;JD7rrY!o|ow-gx&YF2>p81~B-O94@ga*71QL4K!as*g`Fz7%HaVU(`ir4to z9c)0He9!mzG7Mj?@vb{U6=~;ps_yC;BtwK(uJ5W01IT1mK~cp2c^S zsza3p8tNguu`JYC*ZA%@s39o?FEo;(wqgCPLu%Zn+#>u|CJ7v&|7ktp3Yp$`9%l*;4+nQ>6^!p8$Kkb72SvKf@xV(O2WU zK5Z%|HdK6y4@pEH|0dw9TkgEz!6Vv(>fjOWL3Qwmdwp^6NbTx)o7+#gO+*ku>=W2a z@p;uKu|s~((uOr-_MqZoO7t$~1W8uXAAKdm_A;7(K%ZKD<{Z+2WqScCyMJqBBsXlL zw2bGJ{=0G%22y%g0te8dbE{RkTt@dlu1vd`bn)V9=uslD4tgo%ylTzm(Pf6Wa!RQ?S_` zwJwcXfzon-66+r`Ak;rVXu3J8H#5}peN=g2wZx*tEBi;u=LGzJjc_NBVSO=Y{ehi`WauIWsz?UNsP)deQ0cIcP7M57a@rhN-74p++Mpm&W&b`)D*Lg$ zs4{&lYWI)||3rn?>_hl2hQEt&eXIKTminmi<4gFcc^aSt8{L@!C!8=ULKH#RLjr=_ zevC8li&l^hRmOHRm+Fmstl$QSZ>j9NTNyVBzrs$X;85wkp-fQOoQ%g?RM|afpGv=k zj6n7zvZn>Vq53%;U4Gub#yMTl{Zt)&4fw1a=MtQQUvrvTCNN&A=rpS64Sc)CH=rM| z)p(_;EcLn;ui@x@5S?pxN{Pnx%lEX#mM*%+yK)PaCo7F#SU*x6f3@fgz2se0d8*Pd zo|c+5I=3@cp6WltmG=i$p3(a`*}em~ex+T%Yy&DK0}s^Xh4E68yFctj{igRHgHL_b zC#U+f{v*^^6vFvk?uSSH#|dgNKj~S3973z$_xZqb6ejWn5+VLket(#c-!PJFI5_-sOrV?>ccSar5?xz`h+WK)1ir>GSYuu=^rPml zmw}hY{9raGxC%M{JC##xDSSgm0B?hw%s!Qb*)Y$kKF*pXKxBRCa$^~)97{}?e!(=V zJ|u%>uR^8MzgP8#_+@$UjR|tvO!M_;&w-PC+37f#B3r9to3*9et5~a^E!ms_%h-=y z$nvh2%cjVNa_r`sLi9+SYH$Q`klXmL=6D&V2rDpqTO`wjshn&a%1NPA4d2eeY4yH5 z@VWE@mI}7^HA%HO#~a~hVSFpLVq-@Y9Ld(Smz~Qgq?G&<4Kole=T$r~hn0#a94|Dw zW3i9?8#(oHQk4sJ*49%he#_rbXJ5+{7q{SI|7C`nAFj_=^TUZq1oOl1q=n~)!P?OL z@WXebLSF#dKK+IBA1gamX5eZ_u~C7l{;1{8G=GoD^0S>a_cQy<1=$tzI61HR$J~n= z`N6UD;94*ohn;@_Pqe-myhP;3Hs>5~h%8Tb$4su z12xZRILXRKeF<3u|90YBG;r1yXU(Ig|KO@M|Mkaw7%NPAZV#BWV>HEBO`gU4CSwGxv?vMHOV${#c2_5Pu^@6VIXU{Cu z&(|DV__4krslBkP7w3;v*d7)3MhkLiLQvP$xXRmgH3qIfQ!ScnBDGkn!VJ3YlmzRy z;?gtKEzcLAKCr}^i=9K1U44?t7pOBRlh9h4{_ToRg~R^RKU$@!^ShF-56>uHEHm4J z2PZZ(JQK>W73yT7v*r>?nrAdR)f#zQfc;d}_uw^jwx~ZWVD=y9pj4_Jeeg`B-aI(p zkxn$$*Hl6R=NQilXa7<;B#if*gkFCJ^oNd+V1I&fegunVq4Ohn4V@n;w45J7aOnI9 zUe&5v0@wG}B0-)kr~LY&e8AFHZ?A_Y^?wM)&JVXwSU^LVE=be1FU(F(R~X2(3Ou1*NK>*!K~Xq=MpA z(DC;W6p0|a80$NibrO<5t93!bCL$uAcNy}T8rsnTAEgNxe5rNFRA^M`SyfMrWiNf} zVB~@@bRn{XBU`#x{nr;Ta~@GN6tn7dxuwG+{;E4lH2J6Z@1nqW!9p|2DdoG{D4&aY zqHE<&5-en%jlLkZ)Pa>C58b%y-(dDfy@H=lTxj%v<5WfTRTc5VC{+>I=zsv2>RcZE z9qpMHM|Nf>Jw7eIS!-@M}Nj{OVwafM%E$Vhx45>_fM!{hMvDb@a>rs2HEhLvQc11XjiI zYISE4@(dO${qO`DW=IBzPG{jp*H(>kZ| z#I|)Jd#xCt= z|9zb+*S7v%G1{nGWNqDBaqwK}e^Pjs0X&8?WKnCnCd?E|$|gy_>YQ2dF`Gu|_^*<$ zDx_$X0Zk*1{&(O$O!Vi8Mu<`bPB)@0m*C`C{DmWN@~oHcVIjD)aNVH?9P$E-6}aN`c*)WNfF%ATsxvUB1zO*yrt}zvl zRsRg>%s)L>%17<7Favw)RlnCU3#p&1&e;T?HhHA@^92&?-2Q|=*o#vA06vSZn~o{$ zo;aqJRNha^)UqpPac7Bd`i|&YefI>AV`y1XA<)k3U+ZUZ{{cfX->o=LHXclOU=p9> z3>n{6zHpw>F^@2NQP#dl zBY`uinOU{v=SedENzEjGFIDoxJ79n8aH)~agJZcre?KW|>X-Lt z*}`Lc!}y?^guNCM2748Z>hKS|^C9s#aqCS`8fTw|*93pei*3S}wyog6pD*md0li|e zmH5CAQ%xxPC~;?`kNbC$r;JdvO_83pItu*VEBfJ45C(fU36lY3=TWvHOZ4S1vmdg= zR?a@;4I68y>@l&bpd~0M>c4Fm;`s-zUM&Rq>F!%=6M{ZFB?MhTg8qhBmMYbslr8r( z6EGX%3h?}aS!dQa(pM2W{|;%&OH1`l9jc!{jx#KnztSsjQThe8V?K!JhDmr&TV%<( zT07hs@6%4~-Q%`nr{Q_uZP|5=E#-T0CLo9-JlDag+wPJ9 z+OT&!u#JAuBX_BS>xqwq8Fu&{LmaU_IPHv8C$vcYjR=*!IzpdBZoqhESNqn5a>yHQ z;HV~KSQBQECzMBUQzxca0^I&P(jHNpn+8CsN=8eM9H7wp)vPzxP|mpjw-6r}PBm%` zvqXOePLFLQM|sfte|yMuDw3Z!RTd4AFy^SwxMYfN^SIi>B_HMbN45YN8OXst#eB)obVB-E!`KC$3f1@Bb?{o88%4S})Yfv=cod^cyfRlIAy;&3}P@!9rDm zbJ_eB1YS9_4wd?wV$`4bR)BmbgykC}3jHRQghrI5Btvk)pOVkEmrc^t*r zc78~d(7!J*WGT4XQmx@vCI1(73(Nm(-_+q)v#w-AS^&jUf0djlOsa+cfobNC`NejO z2;Mn~zHoav*1Ql)e+3)hEXJGWXAkZlxV8@LnuhW*t*K%X>POf~LzOQ;dm073xn=^= z&D>Sqry7<#+wg2qd|1{h_^RfkZ*-%3d+y#%KrqIVhV2bo%Wxn7HMwKQ=? zYG5yx*ZYCyzchzQ`{QqZ04no(IEhDY7pvTyH5Z~7mK*`!{RHy()hKkfDC`W+*lzEE zeB#mBjrEG82m z4~5|)wqn2C^d08sK`>{AXXJRZhvsa{=J`IbX;In&-;FMAy12XLw~-N%o?{ojih^TN zv|-879B(1c*iPHYk(w)??w!(WIZVsqFfAXho5++mwh2>?kCjTib`?2t>Co}uNba}7 zkpXxo|9e@vA&US9Cpy^w^#3>5E&S*+w3PZ92aCdNq?nU-Tn*Q~liVCZc z2nqtWu&I3ySp3ER`YM?l4DA=DzX5{!q_!xWwa!{qx6_-B0I zxk{Fmx%V~)>C<$W&AT&j6irUws1u7T;7Xc%E%$1W+L0{~Zr|`G zZinEUe1Z2LxVVbD3uqG-c-w+EP-bVd_B6>?4%bRbDs?wLLn@gm7Db!ni%QFlT7*_u zElK5bIz^G^+{gl9ftXq3Xa38%su3>}{n6)W&3b<3Hs`WmqfxR9RR|}i*5WtcA6Ko- zj72n_{$u}~g=IpnWeFd#^eKGoUXD&1o+Yt>p>SN2Vn%^c=uY?#6EhC1RWW=3!t=e0 zcD0hc1#(PLXbmx}3!?JjUe*hrjbMy&qWe4&a>E;~|7Perr{`(ZDC=(lcN5WQrZe_h z{Guu*g#6oqpqCATNaK2ZuGR0tnNrduOK_;ynnMVtwc*3s9a7c1FZj+_|K*_n4SvNZ zrmguWV|S3+fiB~#%;pkoaZ}Fp=rnvna60B>qwgJo1qu8&9FQy#3PO(Z$gXYkb9F*6ZkWjk?$+p z)vDLZQi}?fc3SGF4J@a95u(+Q4dE#TWP%}ap;}O6xDlPSayt$A8u*G^g8kS`M~)9W zh;yR(!w%$U?keR%(W!|&xpbnxSlWgf-iKNfV_+{Fb-Pi0p?eDS2Oq#hlb??jc&Ii` zo$b=6mKY74rEvv@Avat9k${YiJ`7FPQ1&yz+kbqR*fvv!ATA$G2yX+%XG$nu)(lQ zhb1}$<0O|l(4i@-aH#IuPF8c>4%z|ZI-YaGzj#AGLoy`z)o{LZl0BwEO-i>zow;%pXD%D z%@@Pq8Vv^16dS4s=ThFd2I%GX!#m*qsuhZYgh-I)Un%?Nn5Sba%z4m)C#l7Xi%bt; zu%SmoQ>p}SW{H+=VGbdubY}L3|D>I$9HV|Qe9;`%^`%Le-+P>u#}mPslT(~EtEDQ# zGf^0S`*8lV>^scRl~t+=@Qrg((Vz-%#mmGLeU$nbKW`qY z`|mx@R50-;#|p1Q0z62RIXS(2kQ^DwoIJW58&z>QJ9Bb2TVcMYWlqv?uO_GVLo@s2 z1_Xq{UHNNkg#_Yk=C;^p=J|CP)>tBj{qqt;Nk#(t$2-G4;?F{91)D-FJOlpDzlQOD zF!5ji$|#G87p@~$PBFXaUJd5aY$A*dB>kLl-5@6RCUIJT3+i&?2N$5Q{xQiB#JQ;m z{ax8Yj(Im@kwfoi=Kt$({_8uGf1)*gT#{l-KcyUJLy`Do2fd-dK4L5Nek`+lO|%_6 zvhwx9yJ1Fk4`uWp*S9bkrdD-AOEb2?qERvk5rrJWFm$~0#`ZhhzES6+W90p*b;4;3 zOhY7f_%-l=%Kib_I>5`Z&}-wy1WQVK;`@>iR!gi22>;FXKeP>qo1+{eU+7Z(&tw%(xxPuR@;K)!lTv17;+nSA z4cN`lp;+M}8u-F69&O3Mk8!@D0Y51Pt_6KK%$YeURs6RN#oN&Gvk{ig_BSb=<%bKg z%t@oe%_y87w~7q~qty`c+t4^->5)SAMd;CI$nTo8*~b5CMLF>N5=yO!j*)@8-JE?z+vq!a5J4`2;_I|apBp?xUVgEh{91>H;g>rQY zd;Z6VyfYAEA4GDLRBamNYXRE1z5q>tc2Y8{09Fp8>4P_r9|n^` zRe?TZZaBuD7$amVqLj4F_&l{yiRbZba|3PvM^1DV%VD6LKC6QPfdf$hUjMJ7S zILC&f1tH4#33>D$c^-P$5vUA}zUmqe!trWSH_czP%QLp(Etpi!YHnO*9yDZ0;SBb1 zQ<-}eL;Nvc55nG1j#bp9KQjN8#XcMLCm<96Log#gl*NqNz++4l{d+wo!>KW^?BWKD&lIGA!qbb{j6gfbGJ&5{Z`l0*^a6-2RM_j=R zd_Kt=7pmtU#{^}z?EkuxUxWnF32y(yb_|ZHkpL3p?xf|YLSWg%{V`wlmiyY8hyed& z;~8pRT>#OGB>X>P5_UMeV!Mp_MEEy?4 zC|GxBwc9Wc2hN86htdzdB7-R0HjL9URIDo%M}4uuDg5B9p>t8zMFY~&oNx9FjzM@d zccz8H-s%aju%1&fgd1Tqd%_C#oa*kZS!9L#U^c+J3{3%0zX0nU$a*-QlC^O?g)cF9 zJwG^WdJ5LK;==i6@8DP>B=1n*TfNP^jj)-$LwWDu0=>a2xx+3Sa|_LjV-02mdoAgq z##8JAE$oP$KMwiyP`;~$Zm^?RJCWXAKr%!)$WC(ldA^V)iU|g*f8t z85}PCujf=R6R#nde2R0{=pr-*`?}y$?EE|f-$UV5n@EJ~AEQW$eCNjAQgbNMZIYxB z{0g{-`5h@$T!<+?#XTvJ!94^SB}%oxxycImRGOTt=z?=b`QouyXo%6joGxq>ySX8F zPDuWd|5?tOmE7KF#KE>^jF2JwJbRD&J!#-cAMmljZ@1!40-s>u83*`S?B;h~+)y4p ztF|&3Z`;eeRYqf)>atKpk1zs_LZ5?wn<~P@IPq^|R|KK3PMS`tO(C^8Z;C`v#=H!+bG{Ou1Sk&{T|-58aKK~e$|xyfPB)vdBG zir6Cbk*+I3bY)0zw@QPq^YHI3ldj(QcXNoY?imeIKNziEFUgWgWY+$!n8iQ~v-X*Z zl3DMD67A4#LJbI)YG_zwqOwx@+fdS&fM}u)G4#18TYWfcvU-2{jLxyq1?cbpojojP zHf@?uxT`5eKe!MSlkQZ4S1O2zKP4})jnq#Jhs(nqqg zwqz1O&Gym2AfjsyjOeNqQ&lNm_=l|&L%A=w5c`5L%Oa(~loOmi^YkG01vhsp1|)d2 zn&XF;ede#qp~|JVa8eAk#r_Cu$*B8V5D!F%EWmbXATeUtby=s=Bs%QkPkCuvm#oJL z8?z&`V<4PUUQ_+8irK_@a>a+-_^7b0k z9IRlO-|yH6v43(O(_e&mnXS%M%MH>yHdI#IZ;fhOFV$suZbr4uwsT6FqNGUuqIar4 zNdTSjTFL7FWA07BtE#U5?*zFJhIpeA2|_d|N^l~m*hEAV1--!pqN0Lmi!-&_q9lj| z5KMyHU$~n3(^jjkIJDYotF~%UtWD4|h*buwARU~0uGaxaCTrf$ckOfTkc7eh-{*b* zJP$eNo^$rzYp=c5+H0-7_S#h7-SH(La86lc)s8e0`caeKkD5+cyzOtU8|d$JqhW{L z=qm-eJ!$_0gxLUEKo~YpnLTcu zqGsgx!-PXmv~Ut7|G*E)@hG@|;y?N<&9m*SH2HVJ^9OZH^MAtU#gb(u&X>RnM?_|X zA89R(s^2vOIOFYOr=PWF&m@#+YropP;x@YxTQqY35BlRZ(?R#QwdVe(^Pn)=#RT9YGM(|$0>PkjTOtl2k%Q>K2Iq{F-vcRq3~UoP)q zoKmk+cV(73w98U6RqDsC)Hs#8B(u~PDNadit6Zg~P^v|;KSwmd+ba3tMOP3;v4*R} z>pyvyq<7m6mQc;Vc((7QEKxht)eb_%&q#&?V1cAD>0&f#YF$mtBTAp{`!nS6g2*wl z5%b>ve1ZgRaC!WKNM=C|5eMo21@%<#f=LeQQdL6@Nw)}fvCPRQ*f+b1PmzCc3oaJt z;`jzN&v$Xy<`yXf()a-WF|Gn$)F-dTLv|&Nt6g#8aebyAJ!2U-5w41z+pjA6hE~Ef zSp+MKk+Rpq3vHL5@2_g9j!n)^bgzz`n_XG9ZZ<2t;I2CQM&fujY#+^1pKaovk=(;Q z!)@W_rH;|#19yy`K5)nA%_yplzEfScYHlA6uvGsQNl=A92%%QHFQl;b?gW2+KxGY1LlZ;n>Iey_aL44t5hOI)Xlfr zpYGD_aO0=j(OpqB&S8Y5xmua=Cka(x#9Xdu|K@T<`=2flc|VJ5W%ONYRH_{9VRyN5 zY!ACjmcxEF&X;1>Z3Pb3rq+t^-K?|wgG9|X80dAu1g$|a`@*hn(6rdP*jmKnPzC8s z8ykHoSh5`3_-?rIhtNY{pBn03#eAubUDQ4yHVE{+BlHav`Zj5}cZR-8$u#j+c>XPv zA0HbuusSvcZ(-zN^A--Im0&?%i~QmWEvG-m6_L_FbZb>KQ5D_b6=?2`g|6aBV5mo8 zF1U&H1I=UqH41`-T0@0vTLA(F3;UH93nss#@yihbj$V61-q}vRR+arTd~=lP$HgoB zzd^ZuiK2)PV}vw68UDwy7&rm1Yb9RS@v$NMDAR$63f%8B(}Bj!2EbMmq28%b?>_&R zQ?GpTFvHGCm#&PBzL=s~j%%7GdJ?1W&1iH*t*s2^PN~&U^$K`R(dyj~8LbZMK&y*H z7b#kO{lFxxUeVuZ^)Eb0r&YD>)#zO(Qr)fo26UPtQ3D~3MAbr^Sod}l!ik>j-ZcFN ziF@;BybIj$Rk1;2qX{BsHYj4}3jKB#U3pGb_S&lGYt_*WI%bq)tE0e&OvQTYkQZ3r zRmTQ###l$Ov#T-V>}=Ih_Rrb3&`6MfNAM}Zs$2t=(NC>yYj`Oi|F@0AzhS^IL+SyZ z1=(|0&h*aEpKASy=+DXgQGC}Z{Ww;CM(}4>n!-mlyVMkZ!@6c_1tD{Oot)EQehubT zyz9a<<6v};@*q)8I)%z%pH~vk8*coKO+Zd`S4US>4`ch=7^#!nv+D?!YK^xW*$)~~ zxhBChS5RHHehw!HzE?er1LNOF^yLq~Dx+UesTujyuW7l}+70G&H+4uXF9Q9EGc{d( zyGg~>XzK-P0SZ-3eqdFL9uX5UH5s5#UG`4+=0kWqfut0bYd)zS_8%nxO1`(lmcO?5 zS6rD@+4df~!WD&3;FZk43j--=6S&SHwh3HmV%!9NRZ*1=YktC-Wu{XiAIbI!vA$%D zd5f$uBsjS{eIA!eVQFSerLZhBs1)))@9sR_m^P0~gRyzsG#EFJn+jv|I6RQ$=JDBk ztA01@fSq`g;6wy(`W2 z+L1GNr4V!+GeFS5sgTn-Hx~gC3HORC51`_j4S@Ui)q*U34cCFw(Np1=d9 zyB-nFiD8}^X(4CG_*~;+zY)VV#o-T%wZUy~R{$E8u7D(u{ zK8J$%UnK!iF707EPCLMlFXkcZ(>pwZ8sb-owp3xuYGtahWwqk`YMIghP@cetN@bL#kVslXmN8W4G z>;=pNW@G3j7Q!OCJ{zcn(+6sr)e55*%Cl+qyFBSM&Bnu;W>a#@YDv>5>QyW1_hVd5 z8P?T@+m2h$pud6Bpuc_fXD|Kf%b!%`nNwbhBHPr91=I_Dw}o%6h7{4Aa}dp@p;SRn zfhkg%{rBBf=XAvU{GLXOc*-_Cz%F1;7Wg|rQP%nj+ z_|uLMcX(L4Pl(3`gg8?o-3W0eg!mf%4L`nA7G>;Bsx;)hryEk|M0CPO+xvtl9DlTi zb`#Hiy4RUxcJ#Uk+}VsiN#1XTkKw?^nI#RQ@B0NL$^P}mv!t9bZ^#x%5hWA1eID9a zpqPg3ItX@pt`X%*J%Qfb2Y%|IiF&saqO^}8O0zh8ECrCq*9wJ!Q1qggK!=U|G5_-Q z`Zbe3yHH&e3s9=C>vFF+vMVK~s#zc7buZu5`7sissrd23G4y=@K^8PGE-2+HXGoD< zT^u`mBZGMKVgpuF$u`lQgKS-_pKBz8fL`kYgNODFd}A~6|`3&`*E>jIEC7!rnRKEW+iEAw<(x>Np@RAi5W%s)vL-{!!e1o zs#w3gDv759#bvQUC0Jc&$m*)henUN7#5WY(sd+9Fl0 z^AkHh&s4V80UF6v0te2u+>hD+s)}Li_*|$cDdR$mlDbACaW%RcbM2iJOq*UCMi02l zQ1@M9LyMHXL8#M-3FNoVH||sX^k=;cb*JfxLmkUD?9bF=FjAC`I9%BQ;+}96$_fye z@(~BR05xp+q271ACvwJ;$h{D5%h8`b_#^#f`vw1L7k2z<(>9pcv}t+l)UzE^reSVH zIQB3445A$7-Zsqj%fy_^LFOY*dA|&KmiNn$N8YbsR!t+>hS7h&(~zf4YVu9upfu!Z zi8vN2>gOYGjrU}ZA#YDT3FvM$fUy3eHz1}Y9e)IA?F@fLcp%Y19sh^X+=@tab3BZC z=dG9u{+{R0?u)ECMezg0ju!{gMAkI6I|UY)TOYU*2a4~bohBtwnzm$mi(Q>zD&wo( zelu$Yik>9cB0Xefn~2NPbE=y2H*6Y2D%AbPG+&U%{=Yks6bkQaT1kX6%fFLS} zb@tUkW16Ss#dT~5(Y6GVG@p+1nYZGMCds^lr$`2T)ozw-0SFIt)J~B z%xPr}<6U#FhK`T9y8a7sMJ(%9lcyD~;y4`351@TLt;lCWsip(-dd2NUx3<6L!#>K5tuD-UP48)CH#uB+>(5t$#80XRzbE_kwC1YAa^Tk5Gpb`h$`;+c!n=c3{+hARl44KVH~GjOrTpTsDe&^+<5JSeS-^RRx&Z`uEY|1OXBgytI#%&9DU zz4ol?*d^K3P3_j|p0vuqddFI;9qD7|4bqG_a#lRsHGCiqzsQc2_@^@A7(ys_2MaEy zi+J}cv*oUNI$pM;*i7-bCbk@g&#hnl0w;;Df5@pWKS#Y?@ptJO3%&HGp2QVDodwsL zeD|*36DVSCZw@ki$7$iM%!rN8X(kxa&VDy{tdJaN`&VnL6^V&(U;VQp`U38lv9gr^ zfnrz{{X|;h3ZrZ1#*?HmP6WL5_M9zf!pW>L3&v;{oYsO+5SZTay9sV%qgNus{sjw0 zHvcQq)=nbje??-0AXGGJ>!O$|;L6zX-E?o_t!!KP#(MNJ$vbNmif>v?5xjemVcV1$ zxy|d&ZY2EJ))xEj{9xc&iZ9=AHTJpdfOb%wn)seJn9pS|EF0un8rRmLFq77megx>t zvAw1;$jOgQKC(vZeGo@{Cm)KWppeojV%DCtaOE-;=RxRCPLZvc$ zYs2Wg|79*yGUx{kYl#8ln;GjqmAFJ9_NrbNhJ(;i-U1L8m2 zsQjTCicNO)^>g2#m%LxZbMSu(G9$X3G*hvW_bdU_;{+-rK-$(CI7 zetIstfOe~Cj(kYpfiPmk^OLtC1XgHCPE{=f}AQbBG!CTnZ12Pd;Ae| zu$UCkF39N1QsSI^bts~!QI0<_arV+PFI zEHJ++`i=>6;cg#N?cjp(9wt1+n$U`&eT=7WHHBErKbeNM|s5!}anTh}|4+YLmgCuhPY(KquqO z0u-Zv3@jxaWMBPR1EaR2CI;``GF24lbn&CQJP6O$*U#{EH%0*+d7rvc)l%$K2|GmY zH0GMsXc=B^r4e_3!BouVvOE!KNu+FCUUF*;lQKaRX>bh4fFltLR7bly{qfnJN&Rt_ zWWfUZ?#EY1f7k9E(FA}I{uJV?aE zNA6?^g?lv3S1nB&=k%*D9o~XM!->-(*sS=?dJzlt`lAMMgV)wm_zR{KJ3&t2Xw=G( z*z8e@Brp3ceB+nq71qXxGNScfjD#n=7Aad_%Y?ng+h|b)el40zXhfp@04Y9zX(LND z-;i_PssZw4-A@=EX$LG5^e!jg%V@W;&^JHrofU+J%sQVG!EK~H3g2AGyd0i?G3CQg z9Zy1z_TdEA#IDUIC2L|MKab=XFl2O9tRlOr?D^Ui;rU1NE#a6|IoTEUTZh*^HK!GcihirE?O0Q^=mYiqLd?Z};vh`2n6!MNe$MIZh za9~KIHrTG*hAHS?c>ax655siQvhF?HI0Zd<(0U@WPT557FQIjBR?)T&FHT9+>(9P>$ku(y3oq6@I6V zjEMMxPW?QiQy_2lL7d+qa#Dv*p+h}7bSRcKNK5|UIy9sEt~w-F<4rkTcI79WjJZ2q z(ZWPStB6$sK;z?gg`d;o_wWKzB#$P4a`a~p{%8z}3D<=fr<0YJC*j6V)d4*~t$EMC z7p4B*?^uza<|>Wz%sSl0RuhAKX7Jd|4TaeUmMH~ zP>_Jn3Par27 z-ioWXwm%+e}?MMf&9_@t^0lTXD|LB zu;W94!RyWs$q#S)cwT*_KcDK)hx+qx{dt=|l;6lD5V&qI5W$Pp(Mc*_O+WV1cucJ> zTRO9ZLFt>F7+?ct^anC#vZmn1t8X_W+{fZ|XgJ{^A%AFp z3YT=P`9D~k?YkQ#I`6PeUrqJDR>gMbb!F=9|u9S219eG`89KH zEYu|$%AKurpkFm%8Hor&A%1%+Dm74jDx)Mdj^=)LLm_k-y2zEg*p+*ahYh2jOP2cw zzrB`>axc1aqg=V;UAaG5x%tU*PpaIcjB@w6a{IV){am@*t=xDkhZYx#@!QFlffV1!YfHER>dwJve-EXwCd(N z2U<-=xNIF#+?*{HL8V+zTpeapxwO28^i}LM+;Ez<8@3i*GcXc!PLjaX%?lnR_JXZ` z^jkR>yy9;Z{ER{!Y}gF8*;e92bv8-+8t-k1x!Coa(OJSbS}qoNVrr!9m1}ZY5|PF& z0|NgWkeH2xfQlp)Z;Zv*$o5CDr+%i^#2~V<5ZtujK9`rvg^aqY%m}hA+nB8H!WI%A zH4#h5qHoE>f-}u;_GAKwi{=hg{?|GbyYq%jqsycCe|_H5MS=@Gh(&i{D3x;MM}nuf z^`4C)&o3LZUpuk~4F!|_IFzRuL(L`x%bHkGF#_%>-fgabRdtsuB7p zMPl8dZ@1!!6T};0@NcSn)gC0%|T~9#%1ua_nJ~dCWT7;CaiIv0v-P<0L7Of zHFRmJ5L%E#sPZQz_K>d3X1{POsxHMw-tt&)&2)P42wqCLBEs^rr0c*z&e(}5zp zhHe1KoY{}$O-ti4M@>KEr0(9NDJeKYhgWj|6$onQ{IRwmeyd??uW-y1s@TZme~|(? zMzYkwFreDDk z@$>xO*N~Y@7S7X`TThnsY4^j^?hoR=g|W)@{hd+*A6iWHaQFsnvc?IQ?8c9*=+D8&&pI*Eu;Z9G1azXEN#z z5Jc*4P-Sm*#fOR3|eEAhhbkl3|JP+-AaOJ zC$9AW%w)g(RZl9^`q7llk}u9@CC6fmKHz$XU7f!`-mZH629!m*%IF(q8^E;{qO;TC zQZZUksV}*u7f(Q6QYF?1eo0puu7`Mzt6d#+-UkPBh6CbYAchgHyQ#Nh1Sh$#yT~N> z3QDFN62}DogYf()RVTd?%;(N4@tQB+oZsP2S(CnV;@R;0(<$Pd6ZjYKPW;+^^+SCn z@5JG%(w%?f{1X#oHKzO%93qhEpEy({!GroM7e$_F%pgD(@=o*)n0Xo5Sq< z2MqNpu&HU2p*GKjv+w7fqCs{D z<{Ft|6?N5rU$VqU@CD4!g^y%X-5^oPB8E4+t|;&i7~?22ZtxC|Nv{9X=bV*3LDa}2 zuHquedaj~xxlaxWH~hgElm(fT`vjuGed0>QpHVRcu!!pW_oh53oUifOw?wVEnNFa+ z&Kxz|q9FWf15T~!z*hK_QmguoaLl8UKobbu{k~Jhy|wr&-?K6RtORl}+^7ugX-sGC zP?%<_oGM2qdDdq?xmNHo&7~Qc>a)zXBF_qrQF&Gzk`lMexgrdmx+rk2pucYVZ}1bg z9(9yB;geDnCrLK7Gk)Z2G59sb1S@h1J!|+QJyyp=70&VEaAYS)$@kK_RZ4;D3j+5A zzDvW9iUsml&KaULz(oCVM|PNC1K;Cx@NnWij{P=&;&3p1_a|7muH9Pfh=V>A!a=Zz z7tF`6g&S7c=eJq^mUTZWC0dZm20VVG%T-ePf~2#IJN!qq)a)0vIiE3Kq~B$0uDQzm z!z%NTo?!2`>KYp}WVm~ULA@74V@ zZMZ7eVRWtFHG0*LbrRn~{kchhZsZU8$@RLQsXtfg&lUP}nf_eJAL%b#-ttj2vXno-w?y|(>CfZ(^N9XDs6Y4d$LXC?tn<99mFQA-h~z?E z{QfUZ-!+92!ILLLo#T;1H_Y)}dno+vt7N~|_GTSrk9H|4AK}humowF}qaP9Ytv-<# z>wt)#2K}%dq(Qgn8luKh4V?cx{HyeA87gV>XE5{x24`QcyrEYB zN5XfT4RhZ`R|!947SQ@}KtyB!^d6jSHcheGzh3Q|dhXD4T46exTH@DtZ5ISUI{RD- zaRB3`W5TboJs6ueoW-9#IT{z@jpd$n^#N{aYg72~0jwsHUb`>&K8(lSYqMz-|BvX{ z1|t^Qhv&L4h{Psp+wnwKWp?@%ITkY*3P2Ki2?vE_ly9_43I6oyKZXqM?{zE4{a7Kzg4A z0losgrSanUK3(&njsK;7-)q!&5P%<0vnO}Y1My;=K3u7TH@{Khcsx1}9%)^u>tUWV z4kM9NA?e&Fzo##;+!fQ57i6jEkH-q%qXTmP@Li5ci4LGkb1U)o+8O*(t4reJJ9Wa~ zKRMt(@3(*Xy1ijbJI7aDhn^IYPD>XLbP2YbfZ1&BU!8 zn1`Q=f4f8RwU!4%hq4+h908%RXD06TG)58D=3b@zpQZ4FSw;F&!ePVZm$tMMeyE>c z*|*+bi-g(Mx`~k(PHU>*U77B0vFdIcB2|F!V}(0wCxwMO+fE7#ch(M#Je}dNmrirY zyIS$&SB-$2)@H8@5!;K0f@^6W!H9!?M*FtGx(w&0ZUc^}Ch) zdS6AdKjVmwhOOOZ9EpbUl7P}Q!Gqb|sdce*1$&5ov0g8O2F(8Prs$MDZ)AT&=;|)~ zcQ$^(`i?}}2yw&W-&2t*zvM8-E(eIfZhlMzR(RQ^BCxcSyNJ~5w#PQ980GH?;w_9Sf3Fx zaH`}sjuXmqDEz^H$jb3c3iI^4)*;T?J4OZT2nS}aOdv6GADOBN0R3zr_1NRe=ssG} zs*IkN7m3zTQ|_Y6R43VTqoLV+4j(ZIdE@dKY8^>!%wpqvp^x7ZoR2m~3aVoEu2IX# za}5SIhUg&}wP@(o^3dmL{I*}K_K7B{zqVhNRH+JbJ6d**<_hH7dt^MnR_ML7~%*2o4&s?o0=`BFT3a>Ue@aZ~~nQ)DfBU}(!iEKqbHFs-YEpUn! zR1`0(=$GwRWo}fxGSIwb6Sr!@FERfmN1@n)X(!n9z~K9V4KKfU=5$hSAs9_rP{~kymA(`$rK@E;6L`@JD8Ks}R*2coGW& zV61&R-_09A*goPQG^eNY>g6f{&-OjSKlf9EGqyie*`TOhcj8*N_o_cUU;ecekJ;2} zldO5x^UJ@h6;iOr(h<52Ry@lbNGq{4;=ravJNS94LiKO9U?T>OxkYL1M`vwnpZkpd zNF;!`Y1*AC`q?N;)rOh5tyo3MMa~p{EyDIDCdd+2$9ht8Wq86C&3y$_@|mW6 zH0AuSFM!6&*46z$0dBFvvugTedBq1>kehkWi%`%s!6GmyDMKo2iT>CL#Izs(R3ecE zA@|UuR+&wVP@N!&<=>@e0E@)21{e{lu2I zwekE~oq^{qM_d2^OKr|aK}0d<%_NQp zepl3AD;U@d^xHqMZKJvHcU%&Cvhem-h=B~tmjXjIE2js;U_TSTVE);jwdt}3rwJ1I zpVassi7S#gaM8lj{~d1dF38p33w=o(r_3u(VBQNtGTKIfKuL^Ak{?rj#g`30Ta%v! zpjWbj7+_KpPm7YQ|0{6!U?O;zE0td?zu|m4pHQ;rXi2Ra39*Q@=W@p?w~n#%H|{DF zv((+AMkAt)8Ue{SCLk4`L}BX>Xb#*`$lBfSp|_=4(@mG%@1);&rzu>YkDZ&u5i8M? zU9Amjg0T6gzdtun=A<0Yyx9#ptWNTKN?)d&4K|l_^{0#SE9JyamLItD@<`>Mdw6V$ z7|gEbGTtA!fcJfN@ZQaD@9@^|Ly>mWu4nFMxs(0NS2GeXMjBRf5@uTt$GdE4pNj|l z9=?w}*Umlv>LY`R3Pw>}y(toYypOpyYL{rFIsZE`6s^6%9Ud(|M(pGq?;*0KOPaA6 zZ7IdM=hFx?PJMg3mZ+LutXrF4G0uJ8*PCVEOI?tgJSz)NTqK)m(l2FC=Bm_7CcOOS zVxdJ*w4_+!oo6FOZ(EG+Afn3gzOM}g8ez$|`1UT8`m}*^_}LpC^zl>DxUqInBlSjd zo5bd209WVKp!!uw2rwT6@hQxKKK}-~i;8+o9E)75P z@2soqB2BN?<>PmZ^m?81u)zFsVZN?kVkWcw2~|zc*Pg4LH_-z!cFjhHG-hgq5A!$U^FIO3N@TZ#JFXDT#S08~=br`c zCjC)XOXzg>Xq+C6<&i_@0{IsAwfz7>=~MD8E>Gdq;qPzs-N#=+2mA?r&{BZJ#L&+8 z6V@F5z(Jx1gvJJNVT$nsPqml&*r`2VTaq@fjSMDB{kScWVQ)klmTrkOZLSKB%L}l1V1X~y|op5lU+WW(>K71+*7g8 z_?rwX=S&0zCq0#cf_-`gRAngW?i&!s-&gs4&uh#|a+e=}>a$esad=O+7#FP&7wzM? zXx+TG1qRV6*#z=O*Lz23fzRxH-^Y??a6L8O;QI5K!1bFa1Gvooxjx5-%Us84lAk1Q0UNqt?-6Xe0<% z93ANr42Evk>|J*v7G$?aq#oq&!6i|_^FDQimE^wkus!`Nm&9SBpN8%GDl2{N^X|n9 zdO_}i_1=Ap#5K9sBYoWN7)9DRR}BfswviyfmpW1q?{xljI3>T6_>m{d@H06BKNTtb$o>+}!cAIqOUKbyzcwn^%*AlD z?>UB}N6*Q?(I)rRr~1m_C<2Z?a8DDuq~QpplnlqSu}WKMmzU=Zrb)2B>V205)jX{K zK7(eQm!fgDq3Cb10FV1D2=Msp8$sa%pwRe#iTm)j8x5B+nPdwd?}STlqHSNuK%?O| zz9c2f)9Eg_H~zjX#d~lR0=!{s_qx9GMqT>-D=w+)zO4MHY|Tj}CS8~up?ze?3O9bE z6e>l46=x{G70W9QXQPJ^>q6xG>Ysp34&uoK10J$k_?!+}^19JM=4L*D{ zJVxPUK!5{#05A}r{)n3&OCrlFifGLSMMo&b6x5~}x;g(l_iMQ2@NOqqPECnb)s#x* z(Ta2LNkgP|S&-bcGWjA#V-mN@A5!mrv{-$Op0t{RI4 zwW7uGt1zqo<+rY(V(%`kDg#Mz!?lNJ)!}6nWCmlbLh)~Rz1RUH&1CvsHVEgRisgqs zXyjbXMV3(RsmyP%{F@V@|8x>nwcepYPaJ)W%IHo&7RjsY--s0dl{+6+Df)YVXS5Zh z&5G!pSC3#SL^o^HU}Qx$FLf$sn|>JG`19jZX7H6#QZ=PMKcl$*dTc84pyf{fmG$Oa zF6cM?=+8CGi}WXt{v^6f^a+pq8V#B1mF#4>X472Rj7bfxB!UwSNHWFX>Zzd8D!?>MiOLYAq75QhHdn@)*FA(HKP_$JZ>ND3Ev3r%wBm9%w8Oav! ztP01y86O+Emt+O=_v2l0qVZp*{SkHh1$_HsWBb=Tvp-~iZ*unc*ucp(??YLQ8mDK6 z)Eh2bZaD>F*y270xWm!iLl*HKybLu%yqF(uOly24!mYnT#2DkQlE4^uzv^fC#`psd zXwXLgl8YJRFPyF+8-4y6kf4llNpNiRkIWd?1~iZ}D-yH2Cx+D1uAsm~bQ#N1@l_OV zw0Ol>O_2thn2yL%sE|wKFNHsr$eLhE93|^gCUO0BC0VtMgP;10d>Mo_&k0KbEhn2s z@EpBe`5)rH;kj&R>${+;5g|-+IHAgVy?0($<6?!(!+tu6T3CkQg2Lv(sQE7n%7&m- z+#gO-D0PP{cfWqWU-BCv`-q?g$a3YquoXWZwkWh>k>Df{m>4FFvA0JL)-C8sM5I3r z?)g1OQp=iW6~#>R)u>W0AH#IAA=fPUM^#~|`lhcN^)-Yaky>>n!Tjq4Ueh`y^i*`?EIb@Hxlds)Qp~zLK-eRT=Pi z{tJtQ^pStzBL2>QSM(7ZIeWbLdu_PsE{gIvCL;TIAmxOJG;Q4 zfTOSBrI&CgNz^G0{95sr0j(|yX2mz(;nx8?!Tt|h6fv)Rur1aPP@ea~dcJl{>R06Z zpn@zw5a=X7hCcZ*Yt2+GY?v@95@B!QmlmN(I_8TMcKj^hVR@pD0)+IQZ4u%>We7>m ze`T+PZ_GzBD-Gq1J#_gH|BSSKLrRZjRn2GQ={V+kYKshO6ID;u zM*mIxu8a-B6X)W&6C5ceFCecTTV4x~&AReyNuUgL}oevlOGXm>MZiO98c}9>bG!Xup;;uEd9J3g5C+!kypK zBiYLmA-fAuqOi`!^YtDfH{HpRwF&wmIdb9%T0EB)lMMwesIs66`3e9Ab>T93F*Pie z4c8)JE~*GWRf&jkv0_V%d|vw8ri0o8GoT2{`5_ys4hL0wBf%H(b`0C#hwKML&v|q> z-1I&#*ts_4XC{5l(}gZUI{{@nl5@=VEhy7f5+o1!|FIGsY?tLdJeHGu=+hz%H1h|u zokY03yM=d8vo^?JKkGgKg*BYPcrORnS3Io)NGg>zdLxdgSmCr+dS|hIIFi&4ul*R| zX(rH1b?mlU&gy};lm%1G-&|U}{8A^5nE`ji!CeSt#>d~EAc2h_&l6Ypa(SucljuVJ z4s!=A`1;lLU+q->I{o)52-w%}r#k&tbIk!xS1NJ(FEYb?t~=0wL&gK_s5k%6zPPZ` z_1|UazjFfp_byRb{<&NN{THhb9?Yvu(|_v@7x|TIh|r^Qzp&x5?O{?T(0Og*H!!nV zQAd!JNPQ|z>dI4PN2oAkSRQFUC9lOB-VKQn%U!^-Ritc1-Jz-^vfu=hwRk?cas}K0Lo6HNG`&e8C=MuO3ZHjdaqr z_N%x}nglxVko;+oP23RZS9g83)A5)6w8iOHKfpF|O#VWBpl3K@m_=uXrmO_( zU_@Mx+n%5dP6Nui`mjjsYTW$GoVEKQ1f|5(tf}DEFTt(9Oox!ZqE8ch@McDFg^0!M z_x#I#YSc1~i|pO}n^;Nh>2}yCDLyPn*pq?qCVCEBW{D4Ekqp!7k0LCuwayEWF`hhX1B-w7s?Nmp)Bv>f@tw4YtJlaA?~EaB_Yucl6}oiG?1# z!boXR8Fk%tm*&SWk91U&@nIJPWTM_X_2aH>RZaE9@m}e&vLje{eE^xiLQve5`b|wuM8!J{aEf_vouq$I* z`t$V~ZJaFZSGvt1(|0kkJUfOB!EI_Lz@tzlG)hJ+=4$BlCLOM(oFyvP{qU4IC)Swv zg2oC)OV#3UGRmlB@7=4#`{1zMYt2nju1_*0MG$P9oik7jT~a-4Mdds^Qtfjqp4Q*$ z@PxKRkBY^*7n?8@`835aiKd8`@;)*1-E}l+OjBhjlC6${Ktm293*R~MO1+qZdYuO84m~)`!zinT#K*aiM z-N}+B<$SZ+eWTJUW#boaddVs%e5Z&)A8(al3OC-XXFfnKyL<||Iej8!f+_Yay$*=N zX@%*A_C@bPHyy~q>|_O#1$C1jxfW@I!t|`6#sslfe5m%fbfOcVf>QM2cWY~@bv@`7 zhEJ@pdZ_Qe@CI6!>dpv|u&Tq?L;1QtUwfZzF`;Zxlfu@09X=e#hduP+O8c<(XeE>? z$qL`2-E4Kkc8};{q0_8d$0l_J$&ri|-g*diU+I7tVTiExgMqtQa~d$737B2-TL-NF zo>IGkbvHy!yVr!KwN5(B%71qf^3GFQ(nW^HF6N);ztZQQjqmSz{u%AhKP6Sodh5W721Uzwv(&^>9VQ%z z;4m2=M~nEOU;F#28T7oCMSJhBB$$E=Yx`q9v>n?s%lvaq>tIP%VOJ*d`0h72?=kWR z4(Wsc*VjwrEnp5{Vw0{C8`%SRoQ1%HNs*YXPvGxU`>fHpO|pq0nUJWqS5TuZ3TYbh zUh5cJ#6{(7m;C^MB_D2nOE+{5d3k0I(bHLZ3Rcd`BIV%<^fJladOq>YsYvtXQja6` zq)5xE^&`XCkuvffmM-Lky{G1+Fvz9peB%|vCKBZvV6D82*I)3H^}Mg<+Iw{;=M9NQVJOT z+AY>R*@V!O#;o4pcRP`3{K}4IMi>0~YsL6A1ori)cXrC3Y3q}J4v2im>yyDUmRp|$ z5#KRtFNGc)q1QCBSiIiimA%31U3`-*O)laKbHp4e^3*Sx*KU10zvlw8uXDJVW;N7U zU}Wn^U$aseB$`!?QT;@D=f!(5yK_Eufs%B};3G*bL3+pi-4v+Wi^UBFsfuH+xK%`Y zz}#A|7J^m8Qfa?6B7@9TM8EJv6_#h&G#F={r!NLBvbs)U^;)yb9s1=Wcpu`nLZ_>e zUwc#10ylHVE$Tgrzg=cHEF}wkbpbQd#!oF3556F`|2lEENLdr)Jp0;Cj*19aIjyeL zv*_o3PE@Pqx&hR3yQ_sn{{AlRhUc1q((Vj|_dkOj6LmRCnJgszdE=X%xroTOAl|qO{;7m+ zQ~b02U%TWVKfeALv`^po(V%Odc-CJO3wFzAs-|7=&r~x={*4_Qtoey(jB!Q=3n@t_ z=ITacn>Ab#Oep!AH2ATR(W3~=OX;^P{#j=ASpI6`AD`G!4K-s$V!`iJ$a|8JrU#5< zOE;eiFU&&5&x-{X`4tnFWw6y$4XNyT$5t(BA%m@^I!f&#I$kmuwwjj7R>Gvx0R*a~^drY&%eX+Au1 z)yKwZ7ARFNBP5czNx;D9+K_;MUnNa6Fxl*DUsMijQ$~&Q%2?lS@w3GwW$VICw!y`i z??0-zz*Rh3%T|Kdt&R=$SI6)Lx}~wlef(O60@p7l2y4cos09XmmYDVgkS>LTMYjIn3VQ3e%XjBMoFStvBo+ojLaQ9WCN_!M|~Nfl~9|-*?Kt zR{ndw{#fdLByvLKI9bF|!qF~YHSWMjARlC76>wgemSQ3e$oG`ehOEgQd z8vEz09AYNFv({;?N@r&(xxgt}(i2aIsfON9mV)wFXu|z`eEA&$*OoOvoHn*;H>lI( z#{*PiVbHd&*8X>V{G`6cI*_IwZC7#0dOc?M*WU(E{}|UwStOO{MwAe%`s!v?tQ9 zJm(zipK^|wT*PKDcLaV@NmCs_(8{$6$-IJV{pfcOXDyeo&gPs*b1yQ*<_%R+*k2FV zQ^iW>@Y}ndg_z1H8#+&;7lmIQqOFpy;`-6|TLmM?14s=7P3OPN>xR*n1vTU^2i4$%CjDL6@5V6DsWoRm$tSHC*a%^Ptr!e}EmXo1@^i_xE0I1OG6wam zWqG+ze}S?Q>EBYnbzjRrUB7j|I!*)d1$mjvHB*-xe@?EP;Ia98{!Hayg~!>OBW<7T z=lu7PdF_OFWL>Rrl%sK1k7?aMtD-ThvibNezWvZ%J3w(EZ6EiZ_x=_>jx--bqRvfK z(PbpYZxyrmuAg-Y7EmcoHjF;uXwVyO(xyj@5p$I-;y%(`QR3ZlJEYC<)Z2rO{lDAq zKUf6c(MeE0GDH*82Jd#FkTiE5+@jGj;ZFSLp|X$Ggd2y$ZLm*G*}$y$ak_`>CJB+H zN{}?Xe%rpaq55t6)g2^^7}CpDU&8?*Go}&HK{CG?z3Z>PFcfZjRnwzC^;x^je*<01 zwbNB;jVg`!ODWM+(vPnH1^F9uEe3er3!+PT+_eDJdS(w$Fe?Hxeu4~(NK-&lV zXTQ<5ty|MtGZ4b#*In8|Qd=TM69w!e2(}eB=QdNWX=V7QZN%rUByu?xy8Q?UwdHL| zmS9nfvm<<~oA-Y^3CXkRe|aCv?PVBbpY&Xjf1PR03+PxP&pXnVZ``gu_N&`K`P?D_ z&x%4l9|nq+`G2NN-O}DL`tT7{RePpzSRU|~hGQw zRNB00GlAFRRewsc1{2Su3G@!PR{xMx{YOItk>+cGRP^}VdX+c@D0LX`YFA$p0*IL zg-2!6xHrj?{q7AxfLaYTmH3tM|^!o z*-Kp6pSZFm$+G!Y_DCxW7v+xSJI6oUKTvmRTlz=n2$he8PC1kWBp2M=F#!ph*R0}( z(f>X~9ryEB+-2o04@m*S`|d0>Y|BG(-;+7A-v&|(&uhh|QH1($RJhJEkrX5b0m{<- zz`*U)qG_w3a~6{Q2CGKPLh@5Sg)xfYpBGktZTolP+jnGHI0iBPy42?lWcjzwPcmgB zx-$~X*CO=8@WU~91ei`H_Icv67k#Bhg^|-6^jWllrFgX8nF~%1n82`CsXOW+y z#7-b$inoWz9|_9Xj&qcd9)#hTbg+g4v5JOsL|mhZHmRctCYS6ugGu*13_7ROZ+Q9Z z_V`3}=1#(k2Zp~6`AhzdlRP#4o?5i=&x`o^OHSQS)}rkhRsNDc+V=oR{*s0EdDr<% z@@^0k#{o`<{3VwsWt-N2aK|odhN!?B*a@9m-IJ6YMIx^aUhXeMM=~>(pPXY4m!F)c zYs2Uf1_hbb`glDJ2%qNnppK^wVJsYB{Xoq}lc=!%f7frnSkv>dtiWF?YHmKBEq%3& z6<&8m8`|dUNO#)(weDrQ5A6~tu|uUyNA@+b>WanT%od)aq+qkT7Y&d^`^$~ zP@04O!Pn0Yd6OG`DdkrG?4b-CyD6oz1d_vV23<(iYcau^YlgLEvc~Zhr{iH?cSC#} z_&*vW7q~4g%fM^y)u^5F5ox#VH(sG^V*@VyTHdnzcU-xP4wr!?6$Wi%DW^j&rv0o< zW5SR3P%I2_Fm=V41>VC)h+hNnZu6TBz;rbb2GbppDoZU-y`bU(u2nJjThE15ArENh zk1W99Nz2E4s8JZ3%qITkTGe(7pO;SKD&w@E=3gcVgapHfg&c1qsd3nI%; zDF8(bQa837HlIzKM3s-@a$TNxv7A*{BSI(+5T&;aH~msk8x7axWrc4p(`~1g{YW6c zUyOla%CD&1V->V-(%^WsYh%v3l6*>S1fDqt91vUSHX^<;3d2 zt1DyOOIz4FzW3~$3I$zcC30F?P6_|<;+}cog^RIOtIJ*r-}E3i98}$}DmuQPh0njv znVl7080Bf|7(ZLWYxFl|JUb*ugUEq{5f1j_v~Q>X15+b5a5)7dvFZCr-Ha$|{>J@P z6$D)m1oq$rLEP}oKH(eLXv%hg=^yzU2O8d|m}_QSY!F%T*hJIL2@PZTzHG&uzT_(J zJ76pcE92U0*T(kF?7F_>i0<1%`OA-F*B#l^>JF(0|M8fTOXq!aqz?b0z6CTKFJ%2* z1EC)TV-YBq`cWRfXBjJ5UqyzIugL!d+>7&4{$ciS-7Vvx;TtyMHuFlV^(?_Fbl{}C zp>*%^`u6VE4CQZjUC+fd)GaZYAKmOnQTIfZ-q%&=O?~1-e&k%!pT9la$K4Z$>rvfc zO!Nb}>s{AdU*;t8p+A22b)RJ?LW@PW2(vMyIk`WF9HP+;z%s^6GbcE_!%;+h@4~bG zv5I5lWpGo4E|L%15fPkh?X6=-kP<1xvAV`a0zwj%t-a}JpI$wo5vla1 zt~#K^&*ogVVaDL#M3QNTVr)Kt2a*;8)C$1x>s0_StYB&+a7+qdzY+ z=9UXs_Edr>moX*E-?ii|r9^N~tD}9y-$cii zY47s)f`iTb7!J1Rl8%E{SQ!Kd%%qNZz<>N7Wc3o9lMD@OMCCxE0TLP{zkM`3q+8H% zV1R};GV=rfPaPht1bDE|z=M@c!$Xb3Lt>Edz>XXj1Jk0jq(FrC1j{tR!wfV$OtYZj zwjQ8?LW=|i6n=-U?d&{x!Y#3st(j4+*+Mj%T9w~~Gd2MCvoTEkxjwX34WGBDnkZ5K zZwMz=m|oZ0Q`ZPVlR`G_~q>3*hRw>tL>oakK^3Vc&dmPOubOR%CT!pahsr(4Hhgdny>D*Y7+gtPyXq2IsZvzbV`nC z-l%f4rhVz``Htm!{iKmE98#)k8H94KPSIdsO&f7bM$Z~ki7Je!=%0p5+o+7V82UE_ zDy@kcv<*u{D9Pp7bDvt~y--X8WDC0aZF}r*w%x;zD&%U_NeZ;t2ce#q%F4^l(dGY4 z_fhv;Hy3uk~U5H zjoCN5%5VLhgHd`d<%IVLIVRKdTbt*vrG+#vd(RHZs(C*AM;6=~T0d%OF)#7+>8*9X zxAqVB?W;T)L1^(9#NP7{Nd9uCUKD#1=LR5Hi)JmEezydG()?nNc4)%tALrMP=-CBCldn=vPE^DM9A#n zaMQ8+o~5LsNLlU)mvDZ16&lWHZj!2v_s5rQb_H*PpVGN z|IB|Pqs~1Ypm>4Qe#5qI)Q~v0bMZsIM{!Qc%RiW#6iBc9)%tmm0fdWR_Cv$gLuyIj zy7ha(`iT<6C1hiC8?h4Q&wMnC!6Bb^v83rX&p-92bS6;sP&W>C;)Cx>#maObP5Wv5 zaeBaimVK**1IU_I&MA(ajsSa}{gmOy&&+ZADc_Q1gC4O*i+6u(k|ATEvq#x-Lbw|X z1>-Ic76gnx2L_<+c>O#)UjY|B4C(YA3;pQ~6r1(eI&TjnZV^m5EiTCj=cL6#Q})N# z@RYvbWx2T+Pu*Ku7A{6GkjVA6+Uf)MmC;dRE(FXh{wp5f{RBEvEcC}qfP3xPB7}*0 zeG)*Ni?CST5#?U>v+0NyeePC%m-|xvLpIJT&Z?c;(maVIE?I1UM(2zaC;A|1OvDm@ z*V24?PSe^OBDDv^uI6}`=h^cUe*7wb4E|-yRPI|W?eZml7mYr5r++g`0{XFI^^jG4yaymVzdy0i zcU((FYU!|KOIE+P{TaWx#1lKD&xtA8AV}6pL?^0DN+K_{&NR&n-{aey=shJBb0*k;Y<+B)rJjGo##FJw2w=H z?9Lxl{DOZz-i>=Corltmq$_2aY!3WM&zfnQGKzg;nD3;QU|-f=UD+_JJge>pm5NB< z8yS(_3WusX5r__{kpHQzjTPv_JIk zO(FlHmU3hHErVpR^w*55>@0$j{Mzh_Ecf<3g4O)XvVYOKINdf zZsB)T%sJIe{%rp__)`$dkM$);nl81X29fmEO8FnQ&u~^NZaP`5j~|@0THmw+5lq#Y zeI?LY^SaG%pO}=y{!V_3Vj(DaAv%K9r&mU2F!nW!wZ-~sbJlbW*TUgFWVkAT-X|~P z9R!6Naz%BY>Ro=g9ELi+1Md;)qBofgVs`pKvQRAaUjJVH`q?PKk93GI^<;hpf3jb( zPma3v<&$8z<(S~4OH*Hk3^XeyrZlnh;gdcK?@;W-ho!H0IsNesSk9L*)3qGYsKd6J z%X1j#iP5DEZ_h>ls%dFqYgA(iZ(16*%?&qw4u0`mwpKK3nOl4C==OHGCYJc)aMTcv znkBwCK9cX%uefr}wRx(tib6(0#=npMr~T<%8!G<@p;%$dvAxO9_9;3uh?#_P6RNwR zcF!?jvnsNjP&0N2_hD$NDwtv0J}^mgo=`GXwNBIbwY_{Vc%pkHjj|8iWyrX)8`(3c zbSj$qgUE~L@QC@EI@zH&$8{_#aN=>fUKlqdp&q>>0YV*q> z{@4?yC*7j2cgmqw*3MVm&()I*xBH)N>6*APkxy{bJI=ze=D z`sTDBIgx}fRlv+(c?ag!#|Y<0Uc>13drBVJ8g?lP<{hgvGUS(VAxRitg=5tZf2$6C zOT$${+2_a~d{2(k&$j>2$qy!g99kF>jo_thN;MFnf$#VYL|g*|OM?PK8a2H!yeCi= zuKSAKz5Lyz8h1ZQEY)mId_WqxbkbCeey;S#K2L}Q5OtLGOQvt^$8~i@k>&x8vif*c zNJpB^V+sBOM_Akf#cdlAaKqIXJdgt&;tsybAx^4x=(KhlQhhCQPDwy->tmfnUi^|k zt8(<&KV=_Ja_i^H8sO)LDULLhwuc)ZfnK>|N5qAqTsx|nQ@W-PYG2m$)$Bvm>NK@F z9U?6d2HpH|{k5+3X`+Ma4EKww2NaY?NK>sFR2e^T+ZxRd7-X`V!B&!S+W1Gh%pyV0o2W*T&p5?PhDt~VvOaki!Ga=mUEZuvfIUCp?fwk z=*L}=G3clL$PIcdck+L9hxbWUmWX}0WAvrAP7+UqzGuxAPE9qN>Psw?eS{JAw$CB# zFQ+IpV8SOZ=q{tvRGwqhj-oF^DO07(>itC0>@v!qIzEjAmReoljLh=XO4888SXk$XKE*qn%9U@-VaYO-HH5>CSBEySmB@Y zL}kzuUau~@VSNVLh@h?U8u^kTDY1E>1H#;JtJwn9uO8{t)%eg3dAj!NxB;+Ul8cIzN zeGcG(tI#OZK=t%I9*bBegY-P!h|66Lscwy*|y%C z+`EdLm0u+e)#jd9;mL2&`H!D*>KP=hatx=1cWQ->@hwq`o{l^SimH3W+(S74x51oTtWY4UOI zvul3SiH6L1B>&F!JDWWN{b_gk=i@JJpgz$B`?3@NeEgj*_-AvUB>$Kgkh0cU4E(qJ zbN#P7^?j%O^Mj$rKeZqG{4?cj@y|$V`Ih{%JjFlj-9pLgEs)T|O#NN+&zgriLArbV zGxGwUcZ$S2FtMg1ku$be#Cu~Q4T?J5WD9kc<2a0XONkJ|f1Y%&5p@{R0by+33_tUJ z@9?cBo#E?YdXt=mjMrtQ8tM71M( zObY2G4NZ-djo!C%P!`O%HbEzH_u_{;SJLdWKRTA2r0&%S{Ar@?sm`*GG$JkzRqbV? zE8zXQ3Mwe)##L}B@tc%)F$bfke{R%!6_>>Kgff%W9V@OM{mRz;aqx_$rjJikiTqD= z(dkHRSbyF7J_*T5lF{^MiTEAWqP{aoH=r}%pT$h`)?VZkWx6jF`NFSh305qHmrQ?-tyeoSj$^Yn1_DPZ9evNN z@c9o*zqOWCo}Bt?Ym|!|cnZ)5z0LPI76grqTV-CNXJmOB^?)%ci%HY<74ljN(>aNU zf+;#JznrpDxrSb-mxoOrI%h1T^2?R;Ox{Bn-2N7~sDs{X1ks4okJDz@v~M&x5P<9< znzgwpB0qACKLz>IjHPy?GgzLvt7yRIQcb{^4iGFGO;EyzX1o1~vD{Ot-AB_zX{CCP z<-xS>9pN*2xmq@ErztUk*g;jmF_tLJlBes1gG(R7+JGrt%yP|%yX(0l#Saj$K66Xp`_yLx-I91Ny|&KxPCq&_WgpJc&^xEEpXoFf$&Sq1 zn#Cv2=nuLNhuw(5W1;;Ao3r-ytJEBikf5Zj+Zu@yZzpu&He(Rj;hT(8YQ~sb6&bcp z6Y%DZk+$t*6|c@C zPwiXj?`+V5y?LLo^;}EcR%#DSNqU71=LJQ`gFk=++xca&RLV*M21?XZ&={KDTrD7|Yk$DhQp< z!e#M079+i1^QXncmdRf4+C>?Z|C==F>dUXAefotBVe%ILoMhXEw7m6h(C*dUBQF%$ zSvC;a++gwEN!C)&3QQviXS5`E3xK{T@w3i!9Xv7q86NPDacM z`NBJONt2fM-sAUcm;0aQ`t>v15+qHnvmJlxd{cEfO&Tp>5sAbB-o^7xV*1tuLGFB3 zjH9zR|NE4OZ#9LVAu+)ODGJZDZ1#t_WrgyF(SQG3^Cu|>Ci<3+a(8miiSAw-XMkz4 zh*WEPjZW5`kyjNhXHRJDkfG%Zrk@^(b`vsikbje1o2N~#4KEXK{>>i5S4NkaYqceT z?|YdRCZ@6`aTe}+SV}n`IWLFrI6I~$8!ObDT}r^{j+*qAH9(HgicRdr2?rlAEjy(q zTe(szqMI7tryq0+YfpCUm<3~o9O5FyV}-Z3_i`==;%-OXsex{-B~$LiA%~Dtd8k;d zoF%RcXaxN@*$QhfuIIFZ5$XTh4{W|(+cS%)v4jXteBj@I38m=W4MMAs-4z9xDx~2n z_BP&~&YeaJrV0s*oZk}Pp24mG+a#}Uet0-VAINjW1muB~0IM4CNi7Lr*OC|rL4xoY zw&eYbk$ErbP`cu2y&a{cU+4+N4+KoyZW#F{3#M}2u^an; zHu*~C4UikbuU8j%P1Yp8iOF!SU1vU7s6iEjg&Y&kDcQO1XPxLkvNJxAsU$htop0Ru zpO`WJsbRO76R3I8LMDV>S%|6L3jFOfLa(xTpb;X4S8{|lt#%`{<<}aaxDaCN6RNg`b(9@Zm z_=PrX;F}3{$MK1rs>K;n2ZV2J?b7}IQgeAx*DrilH2tN}*Dvy%1>C~Ai1++ujEf)e z1UTO3Kk)&}Jb&ELPyZDCfB@)1)4MQH<2067=+&3tuSd@mDvTT$$8$mc86bZW-hyL3 z^pTGq0P=gVIjGKeAvWjof02M_QiituKiJn&6F#7I9k|>HL8qX~8 zF4u8;(vgzevuCgx7n(wIW{lf>X;yewGpFg950Y-j23ajS{mEqIqn$Zb_OpNf%>tJG zZJ^xwH?;ZCSG}@K;q%T?P98;Zc#wI0>G0aVoKw{b{l_b|3AM^&+2(^6G-a%mmrR7E*=<(zTZp)EsY@<1A1D(oe( zm*F*dtS-u$bP+Ltf^2x{d9hXgU$}7e0u(qcWp6&~HX@jmh>g7Oo!%CI`)M5;pfVe(5M#F|$F!FnPLs+;>zFJ>%EpwHyNYJGioBz{sOMjAr`k`|1M=76Hf&r7RIDE) zD}>e5&2D~$Z{OD$u$#NA5Wr4MtH|8AcIY#}XNNa!3QS{%7B_dt^0)kRP?o=Z{rFM-(FQES z!w0Zu~V*BZMtfl48=#N_WJg)tfS`JeP-OAhO zc5lj;sxDweTQ2fpBAUx8B5lkKxNg1E3zFQ)%8|H}3)EJ@xkedJXEvgIgG?Bv} zpF8!8voEeHg=%KNo!pjlw@dDfh5CLPpzo#rKKgD`A7lA13|Hd{Igf6@<}mwPQX^9K z8hTXOYO#-v0&uLB$61pf zQt!XFqncLmBWOm#z1-p#BJ;M%^a#f;!rD+sr#_QBwz{4F%2iaAjO`P8+JsX(%95fw0Mkc94*T+AQuD|RGnA)?8psbL`j|H}Y<)5>dfxI9thEH=f8OKKuz ztL8i>;W$eb>XWKw1MUvHjcA7?Dov|M*WtjTEJh#vNiRqE-d|R2BfY~InjWPAkLCaU z2pi|xZX-4-Vc+!1vbFyB`l4Ios}Ue_>0$^y*dNPx;ifZrVB;Mrt0@gPjd4FgU^%o? zQyy+QiYGQa_kYarXxb9`1+Au_N%Cn0=&$FYcL?CAYXP$LFu<5s*^eJKzcCB~sYQ}x zkv<^+00Sa8VZ_!Bx_KKk0u1PM;c#k-o&C>9q|{`xB9{O9;f~mIkTaMlNs<;DNKj#+m$zi&r%L`97_Hh~bau zfymS`<1%Eb_y6$rCh$>KXWxHV0%4s2L85>L1qIijqC`X!7MXzwM6otX?SmVl)e0m7 zaf84lG-*0Cw$|5H`;^+&t+v(HA}&<|ltrx~whGd!)wbT_Xe-*v_LTg;zw6xh%w$3B z^S+-ypAVUPIrmwvbDe8H*I^-urY8IS^p7Hs2$ksj&)X%69XF@{NjICRGN=l$_~Eor zOc1V%_mU15OXiPO1MfuJH1M@d1Jkn&yks0T;u_d)&)YQ6tT`S0;Lc9SDF)5_W?qnA z68gt^j9d%!wG5j)Z1vnGCLa8=&llWGr^(?z?n-^M$=n_8sU=U5zMLQ7Rde$*;F9R< zX{|3-A4MxC@D%F#G3SH`MGR&9hT0IAHiX0bOOv191oP8p>$i7+vc8OsyeUUS)8Om= zpb_chKD3|ut0_TeKIns~w;=*(DFsWD_W=Z}>#x^|Cmvz+Aj(GqLNY&Z1)+L#D4dx1 z&$oa?^_lvrDALrda$bvhW2%+2#m^&T3=jb%f75clY!TZ9H~D~Ori8*{ak&tu9bTxg z?FIY^FD%j(f5HnDz`elUmg;e{2t;!k+tTwU=eyl{c8_!EA#mQHZt%VVf&sHhbrts^Udg)v%IgY4Ag@WarPFK`=Vf^euIm zS(P!aSo90oX~0uG-~iZUw-Kc+e?ngqyctFz_FG?5V4pztO3f6|Oc?*}EscKXWMmAd zt_OK@ttdJlq=siM|Hw<(Ed&Zeclk&5s!I?^t$z#% z>vx@X&JT!RzER*Xr1{Elh}UtdJZpv<`(8jDlUAuw$18s0sAJn^hxgf`$A0|*ivbAg zSte%+G}Lbpit-_EpryXlCQv*JK2UhmS_vB7KA{CQ8R}5;HoZ&^?n+nO{y<_Q#YvD( zj(P^oe9Zqb{p81@Ru0|#Z)8RJnSGpJKTOsSzE|{ri-qE)9GXbQG!ukM`f6-y4Q$}w9 z2}O+v)m%1Q>&G^<@g&mn=Yn*p(sY#QEuUovYE|+hurM2`(qSBWQ@JlAPE=wO~ z<4^1(O9m&LP(u6lVk0>{BmZkv;J`7H0nC*$Mp$6)Nfx#6@Ge0Dd%Q~+LHtVCyTtr7 z?tz0vSkt8m2V>pp`Oinb!5hI@X&Sv@P6kdL;3Hb##p?qS)hBm%f$#q+$=Gk?|5XMo zOm$&5|4(fOyPO>-nLo3eEd0aIf-ifMPQ%RxeW}AW{6sEEX>;xDJ6~Y+_-)K}F8fN+ zD8y6_P-N`K3liA6y`OFIiHMNi=1=tFx7>iy+S=e;wx*dN{8mJga!+!l4CNeuEx8)8 zbZqO|2PkazyYI?XBAsy^GA%I)TfBm!00!Y>$^187VKFAhy`~?O7xIpp@mKbD({^yFDa=|T^u~WaZGLzCHfMgn+QsJg zi(44>6~#8cca#6|Q|7nr`BHr$Og7KU-!B0Ej(>=f0hhBJwtJe(&E1)DL;qXpJ~0`E z++jce-oIO?hQ8Q(RjlcZQG4M^CSG7ZzLTgEaXxZ_`zlFt@OtAS{t3qZdWs~2d$)^9 z&30){eN$~h8I5xIjD^`>J%nXEhmHF=Sv8&vj0gTYGW)@+uVv_)C=+YC{%!%=v8aH) zCHtLfE}d-786mMy5@SK;5GNMwIvzKRrzubO=i+IN8;satDEajMl(kG`$?Zn(>lNc*5J=|#O}3YkO@`!ycj^ZEp;~k*s{if1#5N&69B9_p zq58+v2A#JW{L-v1D22bY<^a)|hXc`G=eB|9A}obwj>&~+-K*^(db;_4+CtRU=<8-D z@^gkTc>=1Tle8}3md_}HtRjAOg1T_z-3Ct&0I<9e=p{S;vL!6<{`; z4~htXmXdu?@mFowLgvQk(-5CG0K!QH-k24PClQ>FGL-K>^ZZ4@*RKPX01an6IXTjC z>3WC79h9!gp}NWZ?;pmi$_Z{deHTxcw|#__^5oY4E5cT^15Oe^J7_Q;i%u1AmP4oi zzNlGb+tLpDULjkdSV?mDiZ`%0bftefzC}*D6W-L~C2T+?iYakL`w|6K!iDBhhQJ0@ z=skKHkn9Up%m6Q-@8@Xj-tGxP;^FI`6KCnSfgj@k)N@Nl{v+w)AO@i`(O0iN1?UwwCwJS+qQ@yk6WrAj4$lxfqLnbUi2Y# z7XI9&F3-F8YvLt}2_s+>J{``M@VVzjL4S;Uw#!f1S^ko4m#a$Ce(?r*gT#&8m}%Bk zD*44baEm`sS8-?gOF}DkR9qIuzIUm}MM!y725iZ95fbT*CR zCb(dJq*1$|Z@&w4i!^<=Sw9#NpZnf~MduU06=^wmUS#bH7hZbz>QmR^xp*zI=ettfd3$bOVtXCC zypDb{e9RyrUK!oI0MFOG+l>Bc^8tBF<9Dc+nY^VhLPjPRmk4ul_ zYBlfr>Z<~MHE>=t&(`s*K+n4HjGigVsjBDlXrZD#+ajDSQ4XQa|EWBi$x7(c z7V>+89|-Ix*)Ad%oh;1c+u=Xjg(_V0G6l4c!A3&Y(PqGMZb;(Jf2*}NaUegLdR+Wifj9Ujf552|+Y%@@zL8n{E|s)esi8or z^S{57vF#Y=#x}lLQALu8lQsAdTig2yGX$TG$(R4v--+N`SQTv(PD_}^FK^cn z(K&ptKGEdaD4NlMSKoNS{hN&!V4X~CEOo5FgmyO$uRx(Q$^6ve4$9+wD61r6bF{*?Lhpb3?qQ}*bInw{0tDk zvobh8^WlzA{u`+Wy)J4NDEn;n?ha61_CiM}$C^Jkl*`OwBZF|KP`+2eFvL-C!jEvM zQz*}C_U8DzlaM{6HYu7lhyD5M^IzHZ84)Bw6Y~r!(x_>$_pIYSM82O!HhI`%zMO<) z{jpdLaIjJcJYOx$ZRUfXE$)L}F)hFg3)1;h*-yB=T>JNz*~({e#?WfV$C?Vuo31P^ zC;3x({a>m_Obe~KepqW+?Y~cr4`$%DQ7YEBE7tgDZ~LSBThneA`fvW=`&rm86>Z$= z7r5Y;@Jc6jx|uWr%j z`Yh5^*lf9}q<(gR04KjB(6-MaI`~ecJJATvr}xS5V-E)VpH~RYN$F`90QY|LXeqSDUpl%9;MCSNme1stN%AalW6QVa~}8p9<7O zvfm#Om`s-!_8T(o{H>75l)qw>zb5mi;GGG=M$AYtjs~^01nl4K_sOUjTdm}GVPN=K zk-)Y=R@tcFo8za75Q(Vf}~v`(Ij2$wG|)V$iM$9cawu7 zRo}d^BdL;8xD7>adt>@lbw>7VS`-$TSon*INLB>a-6}WYg@u9}okc0dXyl#0oGAd{ zJSN0l5N$j%G4U50fs_RPOAEZZ1_}HeS|!YtQJJX5(uR`uiSEeX@>Rdjsf8J$n$tz= zUvT~z%}JDlfgnzWYj3`g{I(MXZrV3xowr_Z)*7+&eX>q6Ul)gs6dQ;G{^tA4eDTZI z80ju@fWg!Bt4#k)KG64tDMA|qm^%4(KA7#pFrx40>ihYSy36DQBE<$|)lyRdh$GUW z$dgo{f6GV#07T*Ys|MNP@I?zyT9||Wh}E+?yZ%4+`by6f&3qMnb?g5HVQ$ml6+I-L zpC;6Sm!DVH(>I1QYkQGOkYaHKe}an4d=*8;u%qMRFg@J$w0ih*{5EGKS723Ky$7V2 zCvYNyyF$if{=%-1-;+*gLw@ht-hR0}v|h`FaU#N``y*ei)ckVeuNQ~k$$s6;Jx1^v ztw^QZFRjvK4k;J@oDk|dcAZUR_JR79GfCd}uJ4HS^D-ido1go#^HZw%sniG|Ipcmq z&L56I*8D6a(4x$rpJ&|kv@T=-<(5eeHKZ=l?z{QlN8DY1-sciYaqu+b!tMMW1 zn*Wf>v}=BJO7X0j_m}=@zz;(8-FZZrho7`Eq56L^YuHbebq(onYr1EwsoyUiAI1aX zLAGj2=_2?#_}=cC*RySxf3&Gk2l(!G`_OO@i@t&%I!zh-uMOtqQ2kPUo{5uNtO*38 zSSD^dU4ZeuSj8m&j&>6o(l^O|=LXhV6>{{C6We_Hr(`%y_y>fcflpf*Kt)Oa@z1Jf+bnjg<+Q-f&UUp0M zNzr6Y7sIcu@wYTI=#s+5hf$CBHNTPw^1(;I68N4SPIuzy*ldjDLeCpd-nCFmZ zga6`deb~b($k|ykqaZ#D7~()IWpT|8$IF^33QJ}e#);Kt`>vbJKYeS*Ed*`?5Ulnl3?U;Y<*1y(MZXYw@3B(7^ zC?FS>P@-veA<<%mq55yTyV0)y6{8W4^dzV61PXC}5(^*Guu?AtJH-l{CUG&n z&@1!bPYd2NH20p1>7%_7{`=#D$J8MSrR4l#_WG~W&Ij3MW{&rkEcsWbFkpVYyRT^j zhR*E6p_RAgjz2RFjnA9&Z9B{OV!soz1X(9$mc}O`0YoAtOCxcllA9|^$1kmjpTgAz zTwM?!$<>9;TwWMIg3H-l&5nm6O<$(Zlg4|KzjBCqdv9Kw4$tX)-h!!=epN!s+(T?n zc%iAFq)+^$rbzda8QtS3;6DCglaBcKHzO=V4lBK6Mxp8%+omdqA94`p;)mgI9318= z@b)WB6-6bpixl~v#b4n7_&eu1!{10S$!(DU`Nq8mE!^C5;U;->b^h3O%{I$S{LEtS z_IT&B?5(}J4a9UHcmN)s{=F3VT@&xu$dz=L;j2r0Sv&EZwUW!mnyRXEO6UJlu7NI3 z@zl<5>-S$g@V4V<$sSZ1S|qf`dv&SryMbsmJWC8$4V!G+Pb9L8ZM_ zL(ms7&co@XbVt)M@LHN>S|^Xv%xdef7Ct&o!xaAzQt(^nkmlkcKcJa?(||9tseYtmhv}YT!x^p0VaA$!npyLCCo@`_#rG z^HRff4Q?XWVCl*nO4@T?bLLo5HII(n*|DTbCMoq?bL|>mnGeRn*ltjz6+Zhwec7Su zNsVEQy~PBf$tW|zY|uaVIMN;`GG-(bSZVe+Qce;!S{JBB_5K>EUo}|2)z@P5ll$G0dGu>Yqm1lY6hLCEg1rLZ>}i7KZ%kFEUS8 zA590zL#UDK)VhBP!Q-anEkMY*&zv?2LpC9&AXo_|QY$Ab(9(Rc{&$h^FER1qr!}p! z1uh6^umCOGH`4>Sqs||FsLY)|IydM1QMVMnF|w9AMITDNt3KFcVh^<$J2XHi^MChd z4<>#1`S)XiZRyV>CG($jkB-%&pYtepV%i@&$|0faXky903!V=aYK6Sk1+Uy7*!6elK?%JNh;Ha*FHA*Y2Y)$GGkdb&synqmX-4;2xFn z2>)sgwH#`lhc`G(i7OBq6N7IeG_NB5870014uue+u!!r*8e#jcvG3cGg=E1 z@@dk@D_0sH8XfQ%XbF4<`R4p^Mw$QvXBK*6Zaf5^sc6$VmtWf25Au(OMH3WReg2

)~axN&{h#$(1((2EiFAlY%01!BCz6y54t#7Se}0UwlG#e&j#4CMLTkrua>C@lNZkiNL=#F4M-(vwhc9 zvvJi!ClK_R?jchQ+W3R>VT+7>dkxCume4Vnoi2h0FY5qNTLkG}we6bSsYW20mpYwF zJ9%&I-vF{#U%sh>#ANzNiV1pCV7A9* zGf^&iz)X}i{D|wgj^f*<1M29G6;S-DBh=5n)=waYjEUew{+4o#59Y=-1pI8~wUm zKb_F8mZhR!a|YY~kDs-nU-wzUs4P*)(63R?9)f-i3I_GRpx$mrKvembLHg>=;W z)gbjVX8p{iUk4Tln%S;q>DNsJ`x~uoPrv4W(Vu|-CH?vg{OT1{|NjiXM*FlM{)m1g zkGb2oCULxRn^*b3A@E)Feb*N{Vp|UVaQ20GZwv>r1a+_v`0uZD@8fftB7I9{^o`Fp z^TL$8yb{a{=Ql+LmCP6vKNl+lMuzyAO_5tgPz*@3(mL42%O)i01x=efv7iT z@4II*26~H8@)iP#^h<4*kNJ<+I{&fK4;!GDzrPNCtBuAI^rf;(Gtj<9X#m-v*n8a8 zgZfrQ4R;?Y7E*xoGCay#`Q?AM3*^RMS4g7EPf)l#Z;Y!|hJa1A3M?jW&EJE9?j-F) z+cV#?-^Z*`?a)+bylYg)dJXUeixr-Q1Z zG{5 zNub+Vi?>@f{t+O4!*YePyVr&M>V!8zkh}xzDc&`8>|e0I%2`XJ7yXqr{!&<`0yz$C zGs%BFD57Km#A=QJ;{G=XnVp_!0mP=63XW{GT$iRtKi&iGLnTwtOWa)w9%|{EL-^ z-bh+9nCX)J7O9#0+F8=c6Y)y*M48fMNPk=O0|S|VKxH!j=lh1{c{jZxlX@_f z{yP^NQ`4NTo8I&#%QXIPs#mi8gvVuoj zH^xfdt-3D8GJb@wVvRdEMVWjRmd*)R*l8Cq!^sgsF#i-A6iCa4*#UuLO|In_t5kJG zIsLiukD|#LFtQ?|$tfc_X7{b`<&EcbOH91|KF!{-g4P4-bQ+o)BUy2{z-Cri1P(zw`_248@4VE1;V}=Esy4FEkB-h=r;qzAl{UT%v_jt)BxG0kBdy9-PivH;FJM@pn=OrIJHC%8o3nspE+)#_DQKd>= z6hagC94XmRJ7Q5KuePQ)#>FR! z=~+7ei6VaJ>7q-b#EOhLsDSL~h~3kZXY`gIxIf%_{AC*^HT3NdhC#ocU-mJo6^R8Q zbTv@H=#R9HFuHTR9R8c3_ccrFq)_&22)I`M*zKwHD$7(rRUHCP!jV3`U}kar>4Uj4mIR|#L-lMHepDg+yb6^3;MQOw9Mn>Cik4IT-vjf)B^Y?npAP=mM^x6w6{ z9CnsWq$RIcAuv{J+Fk}H;#C)bKU$u z^^gue*Zk9oxpqJSc#wWtq#zROLO?_Sw6^G-dR?*hAO)Bh1ROad_tvO7rx#H8uvtuv zGN&p4aXazdw~uLWkxw6ilMi{;Z!JKybvxLt+x~{BI=dwG3&B^*mc6qvT-I8%GpA5timIR;LiFEl|X$A%O%&UNv&A)}{9o3tpg3K_wDE1*nOJUGse(Dj<}g(%(Dt za);#L7yd#~dKRPMoc12=AeK3`#)k2V_q+m|fhYKATb-ae*%fHrN)9_WcLg#PT7e(` zR{0l)s2%)IT7hmc*$Si#enp#8fB9*)5gze>S^R-NzZJnq_&_81{ypvI_j>c-Fx?&I zx9w8!Hk{vK6{JEPV;N2V9q;3QA#s0$agSa7fS=zM`nQWkgGV+w{PhQUh>Dx%Z4s%; zhLaE!74|L)no~SeIGcao$shldU0)1Q8j4Y*WX0&(nqGO;mzngE*w=k2Cs;1*Me5!u z%L<;sIspHfA(;bkAXOoFBsWU%_*f3!NrN4x18Y$?pg!7F-SvT_I%dFjJl|M;xCZb|)bl`9?cn1iw8%+~UfEuj@jb*6E1bj*j* zRu0`+AKkMf+Oqe&@)0fN$?gN_#gdS=N35Jnxk(MfdZ&rG0#7+OFeYCD6#04Y!~Pn$ zW(WLlH+rB<5FEojC?RpBqAeNj!Q*-IZ+r4@I>(cL7p0HHH9+X`zS~J z%5U*vYC|l{n=+0^6s(J*ty^M^FJhcn+DCwhmAtg%-SjnXPBt&TL}gC&yS(^(byo?Z zBmJikcyRot(*AkcrkB{UZo|crE47QX zi3RAb)Su=2A%BA|7wgYL{n7gLuF;<>_`~{{!%wqt9-^a#a^mFNb=jQK`fAUVa_-&w z`5{vu$nWA2^FcsTLLtfDvmSgT-C%V$rQ7FKq=7!iY-K4vG2X*gSUiS~5bIW16isaC z7EK&reLd^e7fX@7Vc^15G5R;!mwzmrLcWe<{*f)B)D~0m(g3&QDt*9E0N{{qfZ`^J z3Q5SzX;F-kbiOrV?Vm~eMdf55m_w)I7i$)ngyU=yWRCa(G3lW-Jh3&`Fx{8pP5d8a z;{VachlzoxEUeoe?^|2bCr@MRmsed7ZGAr74TBIt`~}NK@waQdU$pUmOuk4>XA$W| zsQylt9gkDJ-ILz&0^L2tQ{IO|^^4v6bZAn;mxi=PTRs43)3HWK9Y}jjwDC_MY?R}A zSDsJ7SaMnGq|lmS-O5Y;XUU5x9k5{UitOEut)TQd-ON7merRP69-iND>yXxTc=Dzx zgN3-ivksP`|9-HvU##)n@-gq1m%Ov=t#mhTM3_Q#%DK~QqdBEKITh??-6_<>sxC-Y>qv-kq2}($E23buq2Iw)g^jT%=&yk3wq}^fzQH*}vorB~Bj| z8S`3p-A6|3XWf(B3-{UyKh zUY#Q)_sz1zyFH_c&Bca`krv_FKfvyS(27#OMiqb6yFXLBOSbsStOb?s8d@>XFYWMq z$?v_ze2_!rELNkmfxr^z%199`qbtSUDd*-AKe3s@&>D(CMMjE>AVb1=QaxdS{-_-N z`v3&+=^soUanOj$5W7@k5lQ|?Y86GqeHI47>^?~LXe8e*Tl`%jB`r(eiL^e4Gwaq{ zgZ(unEuj@oQnTG8wkPAo$e0$z1drJq&9H{Zh|RI&pb6TTIDoZ1p|rNOw#pBo`hH9s zSDu%qd3{&MLyJVnu*x8vYG4%#UzWis^;HCe2-XXbZJ*_<+Tp@6=%{xpo>cDy{ zzeSQuyExgQNP<)b*1Nrr?s19(ii##A7(T_`w2?c&-}W==TSOw#-RZk*{Y=1{+J3lR zkB%cvDFdiddRHgNC@&(BZF6eq-43m3sGuJON#kM zdSx}W*8Sd?zS>^J)e4Omf4x}zwY+4I{Hf|% z(dcQ=K3b18rc7c+$y&7*C2LG?%@ghGh>K~T-MDF$tmNOd8-bf9Sk{Dt#giMVC$xh5 z=mc2lFuWm?w7h5Ng6<5Xn{aS)!$lL!aiONoIwAaxmHaJ~JP!UYak@gY7OK-}3PFBV z{1~BCV|Wm4-JpRXWd&p6AtZm?laDi|FZA-qB#Hqc`z(M$`E6K-9#dI!=Kg~EO zzo~8jWtexFpv*F?Z%x$`NLo457 zwBnRg6K{tQdAe&aNND9t27?Vnv>(!Fefbp)~KrU z|KAKZ#i7SQ61USO{J$3M{@HJ!-7A)PfcG72Q{_79V>a(f3<+T#m4(ew)?$CH#p;6C zm<`^^UVxKc*NaSkIDp~M`$T_s>(Bf8^Dckd(^O+2LQ+^UK>)rz1q+Jz-7`C=}7ec6r}!RbC9!40+-B z@+-){PyNln(uOH}J=%0BwWL$lpM!sQ0EeKDu4(YZ?`GMP>StMK+Uuq|jLY`wnd5~x zwxt#nppX9uwV8T`Kzt_sOOI{$5dn@<31`@){&)Ds^Zwe&kWN267s@H+*wz5#KdN>9 zqo=U~*&vp`zn6|_-OOv&=GB@attll0WDyndqqRJjy!9acLK)U!qV(Lv?r46jw7tb+>a>d$ZKnom@=;SJh!` z|5rFmF;~|t8_3^j)rF$(y07k^9>MS8>K^>9i4PXJnTz7tTK1%}6qFM`BK@A7(|*SE zZ9HYS|M~pn&EsNvo=c0au#oK-0?MA&cd_L4BhOE*fux7lEb1?TqI}b&{=l`%%=lo9 zG#;|C^~%5^z)OpYI_57<5iFOdOu&&YxO}6g=CTd;;b8cq!D>2f0IN`4KV971pV6lb znmDiO#dT|MX19FZAGnH?Tv`}f^*mP&e)fGnpZSCPlDsu8U?_(7&o`wB&N8by$2o5`DE;R9Td(7vF&v7%sF!P#<;jDetSlcn&!KZD`WAA!YpR_#zj zkRp=YKNs2ax}1KAw~0$y7>+dER3J9802Ld;IR|d<65GbQ5Erz?Z0T=QohNx&bl>b- z@`i4)u3PY3a@-w1XHci+xk1?*WF#w2&5%i)&3?=aVOK^LfzgMmq03&=pIf|z@Yuj9 zr#ZDAn?J>uZp`Fa;rN|J+LvSVD%+5KZ@@f5k0RyBGr?L;TIk=0$ZmHewTUM|tv`q4XSER~0$XvVazZVvQc@bHt02M)MJgSH`{ucW~wDAQoC^yR}?25oyXH{G^vT{ap%5YE>6#LlQG*j@-9=d_v z;Ruu}t>ufLx6&>U#s#RxkA+tT8cA(285U+L5@a3aEiVxOSWrELzr|&t?`)phYd=!s z{_-*VQs0EzMLDoH81li`m;=$|APqTM^7~I8@`0bqBk_v&?SFSR7sDx1wlpx}#QQ)8i?I)Pi?(i!B`0@@m9$h{DdbWK z!u*PsjWGEeb1l(fbt6~vSXm+YUlV?!h`aO|_^kt?^UsG^pWpl+!NARwCPP)(*<@Sx`JspfI*YSuKjsX6_N8OdSY zRKal~AVdKOAHS?`_Z>K33dVvq9|Tl3OLt>k)|tU~r#DRtFoSU-$+@_gY9+YGOF$B| zesAH|Tg;zk2_6L>g$5A8DLX_V+^R^NdbD@eiK@@uhV>SFEriDvnYlc*Z%=224U=wy z{A9N>TwlInGV<^L8)0`>e2Yqx{SFiopjxse9^I7qC8gkp37J!2{fUWRt`*6ry&0w6 z=~G1W$sj12Kc|%RaFZh{wrO&O=Jgg6!4qze`191;t<~v&6FB#+*^8e*?o9Hecd)=X z`^PRS%Jgq}O_+$(yrstoRoEN2W0`tENJ-dRh4TX!Y-F=q)+s8aH`7%lv33hT1xruj zo3-n>OicWtK5LeG)V!7l-i5)pwYt?mzAn^nVq)ByAUc?%;hGkVMr11Xu5jhGJv7>Q zOPIn%D$MVA{i<`LBb#g2>4twu^p6Yyltdn}KkKgmxU3lf`w(I7yoF=@SxoiJ0>X`- zQ!s<^mul_-rrG=~I+@tr4lDzCi_c?qm z#*u=XOvh|WAQIL#?dI?JjipF0>wBH0(kG_ z3qRaDVUmWytsP^ite3d6ar#-BriA6&6C$gR;ITHQfWt*z)o6e8>IW#L7t~Ue+8?M2 zKE}5Faq!W(D?WZe^n)$Tj+CqV8a1>)P0knO<_2_V9{U^RZ01?1$s=kPX7KdLT51$C zaD>3^CiQ;t1wAweW+}b13__g3b3p+j2xGy|Y5K=}GPY6Uc(qroma$gSfLCk^x?V6u zps5$;^i%2f0BNU6d$W)496s%|=v2BbxEy>m8XrCp^=htK1c{Uc2k-!y>X9|xhv?oJ zP*kdaAjPc|VcsEbnCHBoUF0ADv;cs`cAq`Z1z7pRwUOeiH-hAkG||bSqBiR`NU!F& zPZ?V3?CfG_JN0(w#;1%B{`goQ7PX{)Gd@NdEEg~Aj}Oob1dNZNF?w&w)oxT3WP4*+ z=A7u?|(MFpN#wu#3U@)7?~+)kPzXm$C(> zTkCm|#QU`@P=!t>XOq=7!fYbvyj*pv-~bb0h_5`GFD{TAw}hs=fiz?zCsNHv21Z^{ zwz+%ZIbXf@dgRW+?&n6(XCs!DX_9(@eT9iF@D8UFb_)57f>-thD+w7W>#7_C}noL0h_! zSYv@Am6n_nO;&(%FISyJYXUIXDF7c%Yu=;qAFxfa*=-vkUZQtvdMKYXzNt{w2huY2 z{rR}H&t!T(EV1^5KeQi7UTX6HWU2|8{lS0J?AdA-VO*nf`1m!egQ(xG;MW{# z$zq`k9A`&D0nYzEtx$aSwkR#^O0Bb|1w{ho0%NBF+5+V_#NCtZ_ZWu=q`NEp*fJ;n zgj>^}WuL8oL=ht_lz-gIvSpoGSAwv>HtW>#M43SXTX1HbzV`jxb$abTG$6ATugk7e zSREfrII6XQLRL&iY`au{cAoH09Mhiy4b@+&n%?WH0dKsowtJ}>&d(tpIqaP|UO|@b znc=zI40*wlEu*6W$WNlH-sZoz2l*h?>xkfcXXO$>TXEZbfOl)180h?cmG|U=|Gf`71AmrG0(LV^IB2y6zl&dxwV@sO`AFdZV3EMzTe@#8<9EP+0{=?z zB)i@KzVmPGtOEWSlz;ec;6Kf}n2YjvsN(8Stf{wm9n~4a`^G!tI|0H2e>O-qRf706 z2ph7Fgigkc=kI>ymY zQuS{Xag}Vh1(oi$(^2V?{TA;b_2Ss?1$*QfYuLMYs87mSPT|x=$WWcpZ^?IyPx0lS zaAIF|b$(*s;&=#8NMcV zg?ywvEY=ClYM4N~LhrF7a~YRH?F!Qg2JGb5ocxZ(iPkGa-~35Xf1>pZ%SI(yXNBtY zh`UgI3G3DkU+a4)<4-B7G|^gFJuT6CMfDM?q5iN;DQ_+QkkrJ?ed9~dTtQuoWy-_B zSnPxkFT_|YGcR|}51u5VY@S=5z2FVR|4-3#Mr3VTm_Y^MDh_s#h1H#Wp>`lgR7 z zzIB}Y#Fajs(&@>Geb-d?W`R^6lh{`iALI)75zAg!MT%G|?|#C?5Wm4|Xe%i3cYH3O zuY$I;hT0j^ynk4Dy}f8-M@t=^Rmj>cVqZT4r~L6((EVkF$qSxJ?C-kxgk}wlqwB7y zK02lR-^mN^*7JcHLO%x|vO7=XjXE?J^Jp#IrC%~vWK|4I@R1n`D<%#C6VLjptF-cJ ztpD=~4r{AuZ21nv?#g#X?996>8T(h)XBcc_aV~@PS;|yoAzNQNCekPmvj*|^ulR%L?QJ|Ymt0$jNW-KVMkrG{ z&o^sVag%HyEmX5bP|eX^_rrapwyuZyYX&D?LqSKk^-qUZwlFFF{2~Cro>;NVrr7*J zl?HPczrvxLH{(qRKojNN{aB)Y@OBVxe&7AjiYG-_z2jd8Kd&?TnrN-6zCcTVxGjCO z+;yd1PwG&R?7Grs@9rI3pBt?0evB<$+`j5BWvhN+Ck1@&q5gSu_#S9s?xIvThw{=d-g5fI7g@CigyruWn?|vCgwaT(+{Ul;jR*L}KemOR#KDEj z7Aiisvbr>J@T%%%JP6hALdT}}$qK;e>w-y{#{M-sH=d!H@4c>X*#5Oq$i{BGIN=DI z1d?C6FMyAEd&Lw`ecI_cdl zwTc2lVc>~;=gmKI;;Pv zq^gv}meWI&p>D0WjNR&D-%+Sh)nBeUxvji6R?WTecCNT*jiO4{Ql%um(Sah(q7M}5 zeb@MlzQB74KSz!ly?mqa5L#}8vVu7M^#lUOO14*BZoB8%&zdp5Jl0I(vuM2SSnqL_ zbIymih{|oCGFfAMap-~xcngh~>l&u9P5wmzAV&Y7jYqc5VMD2QJ0}j-R8P-ZV6J-j z0Kr{@$KHaB`^oyEXO+C+$szoSgr@FCaO}?Mv?_juVT?TwuO2)-;-}1yyl>cdSR+f>`6uK=PjOO#uJuTkQdV z>^z%Q0e&BTkB)%1Uiw|}x7PjJe<^8ll%!C!Mw?vyAL|4D2754Gi7r1RsNWZy~Q|R${UZBFDuqq zlsc*dBn8G;jy`oY9dY`>fj8PuZN%yg>~BM<`cw3(+fq{`C`cO9ki#;o!=~XtsMw=@ z9~K66Z?aiB6(SII|-0|YD0;sX5SO{i`%*QrbF%>rcS12=~1itTkN?-zvX&*dgi zTtjQ7#}d1{xYSDU@1exfr%teM;dK8Lrvn#632JYyP<-wq#{6KigxEMitaSslT{DU; zEW-@G-2`f#@+UW$`rL_Jw_M>P$!XpNxM^%Ab*vUqJ&-Kbibd7PKPCaWTiCxa#4IlC zlj--24lnTOdwQ_eZmntt9c#R3_OT%fSzi-AV!yvP0_ zGUsY(OJv(q*y(Egudla9q|<^ndV2-5@hK!>O!~{ps>}whNu_Yg-`o)F3x0$QerZCi za~1&jPsh?HCl1uahjRY+n_3rsHywStMeoVx<+|>@pg7yWhST^l_LbZRhoVE?A9@{{ z`lRk^7qgtJB8vWaPJZ5>r9aJ@C*dASnsZHD3Fq#i)ep8$>ZPVm7{RQYb`_UZ&&OVK;$P=~;xROp5S%-ljH9|xyp|n?ppFi0Q59TLpW_Z< zyyNbCDB=cO3fOz45IfxS>mqDqS;_?0*fKai+W^+2yKr&<3S zUwO}Mcyhz7;np+}OIQe=_ZDo&Z{kC$lfqemul$k#4k&u#{|Ndg`ZEy7^d#raR%Kiu z0>y_3A-f_w73x@;vxI|21P{E09pE8wjIJn~IeGJxuH9xvCr=C@qsR*_g7RedlElQ; zIqC+A$dN>}d)tpTKsgy@Af0FtnMIy*(4qZpb+rE#Yu{C)Kwmc>J0w?$>)TXXU;v62 zQJC)BY57clX;BCup=iZwjmUR>%yp{QLiI+rcNbogCO{wz|D8a$f@f_wK`+)&sTscm zZqQ4WCdZ9YH#hzvmm64fkoNhJXNqpPx_bVNSDhVgJfl!P#e$+NYxw)6{z3?Q8;>%! z;M3_%wZeOxd&a<=5y?Cx&^IP0n2${>Yt_{W?ndr{=5i1Db-%QisFFmrKWg`&YgtG$|5#2%!A zahF*YBI_^Z2z0>4_ITL;ka-o~a%7#zj^O zJaP!Tkt7LrqH^Na&gK8ou>KGXIPq*iq1b7?6bPH`7bm6tLU;Lv(mr6fk2zCN(rG2o zPw&7)oj)E#*K$x9>&GCL9KP*3Nr$A};ZtUNWb1bCgGue7?Y-XNkxi?&zQc3!brDV+ zNuIG7g>et!(-hWw$;;JeM3W0Gzu+5$-p%+8lMFG``KaobKx9fDCP#-KETWNVNJDH7 z46J$&+K7wK*HqR$q~eKvUD(c#lGFi$VTRHHg5!-DJv~w{1wn0ampQ7)e(xALnqMGT zY`4|OcS&N2y!Gb@a6t^b&M9)|yW3Gk0+%o92zuTZ*!<%?Qq~@L9r`z(!X5gz!!(4a zN9v{eS8BiC7#XqOJ4ROUOaChER>4*DuhKi_Kk47E+3VTICj!(HWlIJi1+>ti z%X4|yq03kMUDiu=dA|LAW8?z+y<=nzzheJ(``F0Unl+G89KgGFf&=V2y-c)}s^vUg zw*$7V&+Nfabymphvw@MEU)mnh?ebbiOP;GfBS>rc4rq7P{SNIOu61aq%7tharQ`4} z^&w!G-V`I7<=;fn+MYQjL_RCG#*glEHD2o1s72MTM%G{I7KBq*=|Y96aa_t_wQH5r zHLtq&Q}QRJPU87fOStlW@h2apy{pe_KS1S!AHnJ5f8z|RDPxIv+E9H=B)NojwJxp! zPNqBFi^~|DlfVVtH0+u3dV6yR-Y_#PU`WET7(}IzH?Bn#=V)BreapAp8CKpZoiN z&e!(^`hGz6`yQYB`v*Voep8MJkIWIqksLVd74kJN9(;`J}BbCJm-xePfiDx)|{(?m7MWMRu zc%Eoo5ULx%1+3r!-fPvYwqJj{hAN0d>6&JTTizR-c>6qN=isBg^IAu~%Gq~k%pL?-8J)?8YT{Mmj}g&-%IigzD?8QYEZ%<`hg<8JmhpDPF~buEqJPyb`e2;@eU>LcO@s^Z1M5d*im{EdiDsXia+=krIx!= ze+ue5z;gRI6z=tL=+c&_imWJ1ok{sMGXyGfm4?W`-`Q%NCyy%L&7gS>GrO7Yx zdzEu{(=edCORH=j0*97uquJF*H&--|1efAnu*If7doZz)YA^TlJ5RET4DyHE3Uxp$)A&M4je2w@UZ@7vtAUnuPby$1^;RMP$tm{C0!nzZEgOOhjI;oCR5$Yhs6Iu| zEqb6$1l^U~n*D2c{7bBH?^n0D*g0F+#?|p-Z_&}?jrf6fd$XT{`&oY>X$0BeavdTM zD;B0Xa{>#~%%20yo&fVFL`MXpQ=HFtLXfXyzg4dg=M!BV#Q9_`)>3D@NA^fMv5`4+zjq_UqxjU~Z6axOx>_Ydb|#!x*5sx@&DD9ip1YwHt^89{BTrS22*1-)09A zOrIOjp@Q({P4|(a0RBLSvOd|=xBG*hAA487qUfe6FwPY`5V_jz4InfjRmCmw{N0uu z=ld54hlyh>9FU%*$D#TUkEB58nE~n3?0X(|kN1H24M>mRI-jHbt{jj)oR1|ZSY16r z^-t-eCIaAJF&5dl$E%|;&2Or!Yp~anA3%o2 z#Qxs#Ui4>p(0(8HQ9s`F4b>l>X$o`m9_-H=)%W|g=f1nWw+Zqf|LzK2WqH?b?|B}l zZgAx@%xJwBl4C}@y$5$uVut@&j(o7&`=;KE7LZ)ht;V8BVnYc84L8Tt5!J zp}HS{JArBwIA-!kf&ManX>mHojA?f~(X#dCEfgJSFb*AT9xxzFb6yT9t9tTgJj z<4a@KLa)AjWW zSTQ|q0In@FUAyM}00vpF$7GGEC2Crs&Aq)4ZDmbo)_&@WKAN7a%^a1p_l=Oi)e#WUr`u5B>B&JovU^fC!cp{v=(NagF4{PB zljq^KsY06}1}C~@E|36O(xbp3=%0Cp+Tc&y;*DLaEMR*s6{JTx*GWIcYwJNdgr-mC zrtvv)s8%oZLv9?l%b9S3*5qXVLE7=anh`yRr!~5+V#;*FzX!G%Y!cU_Kpp@WMSl4K5wx)5nL=6bcf4Y zw9XZZuyXVQJH18ibl0??KVHwszx&LA)&Mu#2@o2gKIDK43$e1TIS$#{3LtnK`rL5& zf;kG?!Jf|4-a8rSu|Ef|bhw;!zg1*o@}uX=m1++a*%ytxyOs;BU4kHDoK7Z&k0Tqm zrzdBN{Q3q_;dPQH|<*dt5Pz3Km@)?RW>IN2HpFB!n!0UW{2b#A0i=3=M5umaE*6^;YdVoRoKB!K7q(VaXC*{O;HBh?;QRg?t_1DouK?{6f72e% zY9<+;X>Y*H9)@RfMq7-O6X)1Otf)~aMlKVPPlw2y0j?O&og+f6u@~rw&$udK#XXfzNf<=+` zknmo+LQ`5dvexQi+&eLt9dn(nuU$_9Z{CSwf?Unw?qIdVwp3T^U!WdSzKhD^3583XbZo;f3E}l zCR}Uqiw1jW3~HRGWc~Lun`gH$U96!N>K&jqRjs|K(C6A5iVyv{TkxT;ZkfZU0-A5N zFmPAP=b`!AEV18b(fr2qMDwx#`=SEWzpM9!ZkB#x_5ZU1Og~Q}>OI>qWcxKfE4LiQEsE4|f{!+j_p1g(@zmU_S z;~w{_TJm%B*Xj%g!6rKfJKr^9F6o??toTezzSr*-t&Y4@Up$*ZFq;d)R2reBE(kLx zbI_^k%5!V8gLhpS;zp>ZKOn6TLQ1gbGlTCAbq|5EesCsTby(-b+H8a-fek4PE-Vu> zIiejLw;iFzW9A&TpUYK7sOf!ITcPICdA6pqLd~a&G-&UENKLzL4TR%1!m#%tEKIVDN*r3PeDEB@Z%uokRvzxf$$S(% z$#}65mp;sroKMx{T?lSOOviR8JXf{Q@s^wr+_6_P`!B3%Kl?|hKmPvbR%xQ-jWRJN zX!?+|Zd}KO+aSZ1cc=Ix^D>323FXekjtZ&C*a=BDMYrU!#ohs$*5}zgy&rp(A zfV@pWRuFAKT^)P^6NhHZie#jS)8>Ll5L4VS`wh_AyXn_CAoUx_Q4F++LSdglG|hu&3*MYhgo0fP|HC1Zg?aj# zpk>=fr)ajFRiyzbxlzsa&TY=3S-xmB+79-U+tijBu1_wC(q`h&Dy_YF7DQHhYN&2L z_ODiq$Xw&;2UwcPZ}`r@x2J@{r{Opp%kLt2vlsG* z(*bnFpYWn$UGXQps8m<{2`{S96@S8uDs_cL^J(W(q}};iklO!$3>QKbjU$THh%9Ox zMlvYW9OZ-(2;bB|o|V}3h-QkJ8?TQLZi)Z60w`|$6_eKZw(3`jtRRaB8x#(Bnp>!{ zE`6w?U9f8I^SW8Y#AoTfPmj07-j}l3NwB^@m-M8WH;ECk zFx~^RenA@3c%VqUR4JtW&ngVMs zv5%FPydFv@{v?Pc&+Le}_rGj@ClH*|c77Yq%$?sk``gTKyWSsyHfI2-19vuNVHt4d zN)hT~TZ^!d&9KFQ&_oAq^jdNPe|zfmyTj6V1om&v(#Q|3 zIV_z}iTI?@RUPgD_^8#QZP_GP4@d)H7+djV9-HzNI{JX)kx;=!`bK!`a09&?{z<0ET~px zDBEDaxaq2}yvTd(A)jE+CkV18L(L``WpW8oUNA%5BoTvI0kh{#* znO|MXC}*-OE4%1iN!v2x&IR*(6^y{|erDqgMp|1B*NoMAAU{ZN^wSCdI)L5iSQnpv zOe&evFH?n%lqxi@gDNzV?il=@`f0XHZe0{u^@P3l7JuFKPg@!plZ%63R^>4``aRW> zwM}U`f|e%1Bo{`tz@N(+el>~m!6|_e(;=8CRN^sn)OlAEiI80??WuDp@v?2&$)s1f z_!5A-+fLdGOsOIq=N21#<=2U_xeB`tleLrcFu zHNy)YB27^zv?R4p;Wb&YLp1~6HiYV%s{Diwl`qLwUfyZtm!3csf0 zI;Gq0n@Zh8G(`|@)#2BVyn<9rAsn~lKxozZAWvxJ7lcZUoW1!j+W^iWfaccmg#G9D z0}(i{ES^uSX}U+*S_YCA=lr2frb484bBoIJNj1vM8N|Nbs%~+?lcR_cn3=OlA+%=k zpytv~Hs$P5XmxuOTD3uekj{h6&BPBT4t6K4P-0)VC4=~DzQnWA$KpXeOCCJf^FHT4 zJS*Lw>wJ89SDr=w|E9C7N6qQWsfmMJ4(2bpkoUco9L3+BqP1tG$GY#0K2vAt@w3u; z+ndwq&q@z+^qYJ054t)TNGw#osWkNc&5Svn&mZl;Tv<9PlowsTx3=ymodd`5;%JWP zo?|}&f?PL#s03Rtvr9Wn?AO;>Db1OAa1)$3(Ct?LESUad*I7F5v0FKEu?79?`K8CQ zE3=?>|7G#N!!)`q?eipalSjJ6Ptq3<0-==k>E79|ILqtsNJ&ea{aLfYJhGyaMqOXP z3o5%1n6Y(3EZKeNtYr7v#O7_Kp*5}3lf!z_VQrLVy*zi@2_ys#b3RS+qM~MgN|qcE zN&ZShj4VHBLwq)9_S;-2uH~b2V`fBcFI@fvMQCR+P5Jjq_AG_Hm4ays4r730YxmEo z=6p5qvV$s|H4QV_;yg_4&F=_8wJrB8Ly(Q81}9lI78u_wZg0`C`a$GWWq$kngA z^(Y0GM1bG6+t7s-D$~U|kNv87RJ3Wuqtpc(bg#9HM*Fk$7qWqMy85y~?IH6o-fgk; z9oJt@X!~Be)fOt*I|m;{Q~B_z5Jt?^h8h>J;8J<{nY@Y>^b;Z7kNh~kjo``I5Q{JT zL{xxxK^8CSAV_6?hx}blC-{Uk>|IWlrffbT%incokiUy9B}{B4f7iuoWA~3~!%xfQ zSMM@+6;jw`?)v)=vYERmlHJ)b$Th39UCN(Cv)Qy=y_uw)RZKCnpiD;iB4zt{`$E%S zZc(e6Aj=!3N}m}$sccGg=9H;yp%}mbrwk~lWD64Ng>80waEwNnIiL9!*POQdDoa>G zhw#~=Q@ASpeb*~K{Zvd(3O7&NsdDpk_5a2E9LYGmU;pTH&QE%DW`0^oXY@JeXUzq) zae>%dCBxi%sBc+LY3-@WwO(mnxZ}QD?r;#wW23o zqK(_rBB-Ko>=s=*AhfbEY(a9vINkcds5txQWB&QYWHVS+K%vxZb%}~rTtZQvhE~kr zLW`m@HfDRY@%MgG{Md-?&J-}8Y!>I76zPINX?!_Z9?AUhV?Qv^WqVNW?q&nTUUI5) zOeZG;vaY^93tSoXLqXRs*W|ual5JO>vw_HG@utjMQiCLO-(|ngNhb-ty&e)Tpsul>#VaM&Zl#*HBp6jA`k4>fJUDDh1JbuEa(pZ=DMy^lP^BG;zYq>sI*VDVCALhDP z*E74MS5Hk|`UB?sh|t&K!kLm6L#wXWENf0Fw>VCe{fnvh=@fTMLiGo^iZ$IOfW(?s zuj9wEFFdf8D>5)Fvf{!p<4Z-Jc>mczplCx6Ym@;=ws1y;L^6e zxkzz{QBA*8<=(}fFH>WfZ&xVNxI#sw_GM?T{c;ez0Uf=HHU?Q7tOx!?#Tsomvl?T6 z-AlR3*p!CK3IHj1SI*#O7Ld&2JV9WzavCnuXv?3wN1KL~M4MtI1ycyp{{1#d_d#Nd zYOsg%sC{e_&ZxDh4))z9#1nF)NbCqbd`V{!NO^u$TO@BFL_GM+__svfq&&-^#B=6U zbsy8OzDH{PmeuY%fs;~84x~oe)cG1O<8pN28$NB>ENx08!h1*#Z~EY7U{YnnrIET_ zoE~aGR2{XX%d^;m#S%YxVcD^J@Nh0;*hL zEe3rYeQMMQamFu3V~xWKH?y;F%0&?ZKBmL>E<{e?h*3!W1>*}Wr>z;1S4;qkvyX}+Mhc+CsOj}(o;DVl|U&2J0LG!bQFI}mK4U4 zcRJa6zX_g?2Q>#xM;jMbPHiZQAocZ|TDPvcpls7}C(|XXx;Xl~hx{g*x{^0TEB^$M zrj0>|vAA7)AuI2cP<=fGs3QBdf)`#k6`D5)CEgkT$|8>8jH1cWA3}*b>I{ai{zE=M znZ7Cn{-pY=ZDfra&C{W9M)9>dI5W55(kL?QZGG9nJQv8agE@*vB}!1Q1GJ$LaYYV| zghS_LafsAnJ^}$zA<$h>5a{%~a}fygj;YL&khR60iVJ=0>3QMQ$vN0FyC{P_WB$?> zdkC!P1Vw}&jn9wW8q8Fhh+l_9w}yjR1b(T3h!ch-sT~EH1cHo}X#I@<_}H)n|Hn+b zZ-<3G{)yAu@?nZs{hDB#(2DD*OHd~{!v5%(*A)uC=k;jIeokn9y*xQ`Am=1j4+Ikj z4Fmx)=Ww3stV-UrX19^r@faWF{l>~LZ8$TdHHp+%8A}d3LWiwXmL>L&0-1n15hmfN zLO3|Jk6;eu+bi*x27b1l5hmo`?`9{&8HWCGR0hVsC6iHhg$9rdC|3Ye9Z10lEi}hS z07t`-tK+cNQK@qvbY-}4iY3}vDfE0$7nFbA7EAvxQ?48F`m&r&4+!%_I6&ASqK#AjxHsL4F)ogeU-g2|DqK{z89D>PT@zHiUKp zke|nu!zv?TBFVytLRDW3$cRa(psbWYU*NxBDs%n*oto=U5xazrO1bMxg1O9TYUM>2 zmX$XSI})Yf$bzD*cKFFqa0Q!E$%|=(l(4t?O=$*f2O#rn$&0bZaA?I&_GiV2pVYy+ z+afJ*caOI0<8YzpB3<^!#%z*ouX#su4`b}#!6jN=VtrUvYBDep{Fqul6^BgGN`)Z-ThNIm=O|AEnVVj(x=fI1)=NKW)60PZUNQx^{Qf&`4Q!)? z;G^DHx(MN^=ETg<$`Y3ajk*JTRH^jzVe-i+d6U8y-#OB!1!3=rHv|nV(8_~b#P)_z z{r9XDb#OA4IOR6yJkFLXMi=yvgb>iptwBbP?@XqT#hvt#>54Y$5S>oDMX!$Zlb;{i z{aodXbg8AL2E8MH>;FgFyTC_TU3>oo6AT!fpr}!x28}kUsG*`w3ef~XW?%wQs3NFM z)!Nu<8zBJ{w@QSG^V6`>T4@Aoz-%Po-Y-80fv&Yl7URwlcx?0z-Q z)Vpcvkm5+5|KRv;`8Q*~xguJ@z&$r0td3+4VE`NKl| z=31Z$lz>gF2_5lWz*Lc6 zV-ZiCcKO81>f=L8f?FH>m$oJSH3-U z51YQQU%WNYzxOzokF{~nns-HDA0ElRT@zSF*@4~Ch}4GE&xLMz^&y|t({)Uhaz6l^?^*2Cid35VIkUn&^24iPC2;Hh4kkGa#}L?MF9 zYwiY0x=rFDr+(VY*l520)~Vw_!TZ)jV5OlF9$@Ay3RY*=G(h^BgK!Bw!H*~eiBQc{ zUEKCL-_J+wLUWq2KE5teq4P5%u|q|n)qf(EqD-r{O?$qby)Fqg8^S6WzdsJ}q-5m3Ka?R?f%m-}-6n zO@1T}1JMLy^378aj`ZA@Qt<(C_(i}^wC_4&_X`29Q_Q5pSD+BPb^LL z?gu_1k)f6U!Vgir%mSxAaZ_1kUE4%%j9Pa?JBO(+nHGVjs=6V^ox>vf?KI0BUmsX; zgQf=6g{fmCw*1b6(FI+ox!OLO^IjBy;HF{KRb?Dn$6#bQRO~Uv$7>(0pun(})N64? zLb6T7pR1o)3{fiXl*K2w?Hiu~&3R{7(gSBHnVWKkuXyCv{~^kYp`=-98I+kx3P+O7 zRBP(H;d&~(G1{dd(A#X*n%`z^(57aFh8t9(>%!DK_Dn7Nch?j$=AcxU7$qC&R`|DXdR6G+& zj<;j(FKTyvuCgKyP)D4WvraR;9L3&L(SUn80AF zO0>*d`Awt1p?ldB6m$ zB=l9+#x;LOG*Psd)zp$#^x%s`DHcr+S04ziJR|q1Lwbt$d2sP7dgff|q?P|*g7{@e z#=mH9zM;EuT88KhCUD*Fn2PT21aObE zuI{j|dIJ6X4AAF?6rWZ%muJRiPz&Tvfvo&8nwmFS5cA;tyV!%x^W;1B0&8?9Fuh2u z)Z3!Vvs|owZ;ie_uFIpkJfzFdbontC?9Y4k`8!;)IS<*{d+xdJ^QSxk@Zsi9EAc+( zj~zQj#IuUPXMTXs05>C;L6PXZs|cCbwdHAO8u05GyqxQvI56-0%oB$+-LDHJ$LUqt z&o_L0SNjW4)C~Q1gd@Edb=jiJvt0b~>+9oOK5l$a-)Ktrhr5WbZHvZVa`7cf4Hqmb zOx>-4cRdrS-nO{XW>?3bM3a-@#-Tfmn*Yb9+YKqYV?SAEi(g>=c%!9Jg*Ynqkg59F zMGf}$Ry_<~y0?+Qstbr{+kw3)?w+w@KjJQ2@xIR9>wo)g=2_WJu1o*WowKo5>IsRY z%SLxx-M)^?x+eezhsxCWaQ;Wv?I))!@Sk&7MQC-ojNR(B^VoGQ0H-F3)=f=ZwNCQC zzIyADjdtLvclY)~U20--e1@9XWcb5AU%ZS3XIuZtiJ|VTNcD~-FQ;y#P2Trr^OkqH zE|=;O<&ukO*$;mGq)wnTa*C~Aszrtw#+>e63-JBGPZV*rcK=0@wcdsG$>GJ3wTJpo zOP0;9Pv)ODH96{cZLoLC-!UfnK-uK(lLOhz$Z2@yXj@z2sZCjjoO7 zL8a90{q{HL+;ysFsly6Z{Pl)mD>8{f)rcA0>HeBD3<|XbhGd`X)#Lx8Z#y@uK2qCIOu4d0pR@8uGzbxgR{kqcAa^)k z%j73&q zPWW*+DaYu}u4g7Ei+DeRKW594S0jj|aAI6pgxssOZx4=+e$76;dvx&W?IC;$k0g0w z9O|`J_TQqT!gy_wt3$$hU|`&iNcHCVKk$}6Z~9>&e{vbR#{{|cqk?GuNX@uylGo47 zaPg1$Z>gpTJ7R$`Iz($0G$t0r_)>W7UoL_jiwzCi52o>KneD|g;XS6$+h_BuTNpb~ zag!($b4qRFBXjn?>%(UVR|o0#U$v)M5n#MV6J?0ivb~141U|lPG(Gx5=|9?**P$x% zv2Ej*SVZdHd-H|^>}Q#Vy|O>I&;MtYEL%SlEj0Bx<~_pYV=OAKz;*?Elrfd!EJC;; zL;sX1Fx4O<#nx*?Y!Ar8S>@2T&hcyOD?%&;FonrN=NdFJb}!z?d5b)M%kg?!qq!( ze?#4$6{uC?Z*eV0lDhuUj{KR%h7S9j#ew}QiBGV7z+Rvii9Ebj_?C}UQj@z0xrkviAKfBkzm zEXv>K#$foH@6SDIzfcuVTaFG_Z)zElo)W7WW__^_Kgh?2`jz}c#xT5z5GQTtFJz3D;Zr%77ZcX4;ju7yMb_ejw0e}v_pUTS5 zS`7#@qL}hG(r?V}Ad+NT&Pe^4Nr=^awV#lq6AR|dPKQn>m0K>**>7|3|O9VFuW;}A6R+l_sF~T4PftCaiQnWHk!{sJVr*JU6 z>;Dk^=lh(roThS?zR}6$%;eKuBM7$~O?En`(-UdFywFRm)AM}K98bTvP~?z%K7F#F zpxm(gsT8O@aCtXWW~~cbzpnXt?#zp(m^G@w`SR1@SBXD94TObSVKwCN3u;SK&lze% zf>t}Bi@iTnVaR-X8LToTR;am9NEIGy?fn?1>Rv=ub_&IBo_j8sZDc(HW&@A$Q=i6n zc*U&_v9-$TP&xpH7)WibTXoftuJj1raOt_zTK>l-Aon>1^oU)R5Lu1Y+5LR&}=9f(KPD{)V8-1=j(=hn^x541Az7Sv#0E@j<5BMkphT_z2(=%C)@BYc* z?~YvjK?F^rAx6qLEG)q4ZUdDT7b6$P700@kEGfV+N&iK@xl&Qqc?igUeoX+Dv+NAr zu@nM92+WJ&N zftpDCyhwauVX9s?IeO?!+qV&)QB@eL`M#dloDQw>z8*X)vSU{V92#5Ce0qO}YrH*N z+Jy;z4E)I6nxFQf{}l1rK#92d8%7DUy_71 zR1-0PD?*PC49D}?HgXlmpGH+a82@VL1ADtBhOX$kKAISF273h!m*_q_@vdU0=5XJu z;kAcB(EARr$@~+Yh)|r!+P_LvGC?zfkw zL)smy8gi+VZ?i3Pzqh64%a@$>?KcAdxUFy9VzhnP0g+B<`AQK`u;}$ys>0v01OL+{ z5lN1oO4Ravzg_+M%_&aa-LF*j6P6w9I<>gp{F?A}NDh{t;pBv}QQn5s0a!xLf8eGb z_!Pe3d(*pN>{+Hu`5z>B>60)fuhW8ckk@v$SY*#y?12Z)oLkerL?rAJtV?^<2v% z5yU+nm?6HmqGlS(us&ILF_x!ZfNymd`_RzZ5FzH0lNB%-I3&N z?AtvUTCN4IaUO}~;pF7Q`aDy1A1O8Ak!b89wr^+={u-80ee#shI#QIh;)z0IPgss?w`P$#8rJcf{IkXe5pmI_jJR|Dx z`Qx`prptA?RF|kOleoZ;4!>I$N6F(Wj2#S^lHC0$2bli2znGFwN=UNe|IQ!boECw9 zXW2pHk4LqU$$IS$Plj!2vc&tPWz7e?O4}vvso8kiyQ{Qr-<*6D0sHnrgK*X;5Ss(l*NA`fqG)`rH&2_eW7--+=5D79Y5T%j zTCT-?yF`f`y-=T=a6Z*eXVE(iMdPGqZBzm0;428lp5nHSHzFxK%DBT*;w{G% zTBE#vbgbs_zmGu14bmoD+)uUXVbc<2EN6FV{j=~%*+$&0kDpZ^zpij@O+hF-mA7& zi1dC;w3FZO<&XCrUGC-rR=TNIQv|XWFniHDUj4r~O~UA;fkk411%UJjkXEK1?B>Oi ze%R&qznq@$6WOwN?iXg!0*}~Vw~IqZ16-!~U`w_3W0pIq{!I7@iEjQa!7WX8!#?!f zp3v%NP&VPvFJDL(5F#UsH~tKQ{xd9NENc*ES+-uC_yiMtiRP`XPu78ij&Sw5#h-$B z>hb?Ye(idoi;6Avtj>3(8q~bMy+ms32?I3PG4hxd(P4Wy+S#rqikdK2ygMyZ+KjwF z7u^O-r`WP96h&e+;lyhRr8;3b_Z7r8$!EEgK7>M?uSF<)#S`86Pqu7x3j-U;go z!K0R)Q`tY^D^Rb7kS;S<8^HV*)km$MtIBkgx6RB9^{~^5`oWW#9(eW$J(xF3KpNdE zg;nb+<~&)C8q( zD;m3vpS9IAnz$a3K!O=AO3Y&NF~If*r?8H>>n7paJt;s~r>xHoT>G1ZE7pdj=iX<@ zbQ=6C@RbRqj~zTQ({{7ikGCO6z7W4)R4X(UNq$xnj4Fp>)G~9n2+5Ef{&^!CU=PK< zhR)T~wE+J)0sqq192m9suwVB?MnrtA`Bbz80H?~a8O|~NhCsx-a>2oaUEVERSebnF zWL7505wYC^2|^J62-7V4$KBnVx$A}9tvYvWmTsNzZk^+9z5NEaPII@0xm&-}tq`}` zk0^n>Z9mWm0`=BI_@wUX7IzJloaB#xe)NyB^2ewc`SXDAN}hvbZ+D`rF?2K6r^=S{ zGloC;CBdU?K%s;Ra}elfg|k-w3SJhjXJUOH?_1xuP@ZZI^aGjswg;@^C35ktb9wlF9NYMW&ebfKG9`rBTZ_Ls@8{+Se z?O(EFi7?k3NOerJdK{IZ)W6fVq+YWyj=2`(INevalwYuE^cr*W%G^;rzy^>^zVf&e zn3tDtU|xd6C>~H+4KGa4VAa6*RU99l8V+lzAPqfu&q6gJ`5#jQjN#O}FDLyz5tTYU zK#~N1lS#?qzau55a6ukU7-~}T>i4rPoE+uuPvpL}?+w$BC-S2=giBB9 z$NK);y@X!s(^*lMV_yx=%D4N0DzLBYa7`RkYvmufSpI?9rH7Z!{S@g~N4xB_H@Q(a zXCT*Eq3=AC{vC6_O*XcWQE+HIBX}IEKBE_S(J<$PrZeK46=Xuw^fyRc;KsKw<@nDC z52DdqI(;KulxfhJW1-dip;?xh`FRtQ;otiF&t^6Dr~XdV%)~WJSj8!Su2<6KL*|~ClAJJt;Sj*2e*T)r+^aLi|Asr`D82|H@xMqcD;z+A=sy>o;7nNI zy#*%Dirw%y0_=qL)Gnb;qZjxLS6HD@H(b}F)d_NBO}5tD23ITyxfVEa_YGl;_gn{{ zFp+_U?p$i%IY=A?)_71E$l&yqmp`()SV!rkRTEBuKN|8<1JD!pM(Q6*Mq`<_`c;|? zEgva}E5Occ;eDOqwTD>q?{@s196rQE!%!QL(U9fIJi4$$ShW2eGP* zS32S2R<3Amtw)pRAE!Y+d~Glr2vz2Ams`iWDa6|=rn33SgF`q02mNAkeOmd1^XDTj zBTQ_{ePMDx!*If+&|A0Xpyihw;xBCYLCECE;O%gucOlZ^&0hd%vf%gb{@=H8e;fC? zwb|YJBe$eq^zh?6oFiJim3M2HfhCoq1niM~1kOL8^c>$mP%b{KlBHie+TxFzEyVW? z!c=XzdROR<#hMMCDwPnaV55Zv?aX`UAyIB2K+3SoB>OYT*!r6|t=iyX> zME81QwGMEYd4!l~FQhEAZ2o{03@Mfl<>SJQKbajrlgdi3c9jW4Tkgpl9pA0vVe|

FWz5>B=#JIz~TI()xG9dkd&rAcjP&C<9jU=D4cbwysukEHSjd&oki)qBdF4wKtr%E1H}}Rwvol z=%Pg@XXD{uSF^o81w{!Ln$bFQ_pI}=ygiL03HNMCAIDt*(~w> z8urQC^&l>uTZU*|cJH0<;OcxaPFxDI%qyL&I} z5R^Xjk3=T1WtW=Gthe3kQJzz`3M0A>KwklfZIwADz@U)P!LJXaZ6H(ytJKW} z>d|>P+>-vdsQ-qR87HJ(z*q|>eHTc^@(*^)1j_#@2S#!@%;oPW!p8lS#L7%m))xn% zvJTGH1nLG*7}PK*+Q<$?^OOD2R+u)1P8lluV+!SR@PXOq&cOgcuSCRP-zhHdr#E5l#WS88f2E} zP#w5tcdFlLIhFde_v_uH@BM?N^jq+ZRy*hwM-^&H7$Z-U>?F5pQ~#;C7s$i}?J_;V zJ&UCMY}R-ixJ*Yi+C>WpE#Zg3`R3C~_yURRU4UFu|N2`3L zt?!k40-#vM?!DA}J;#?0kcEBlVrcoP>b~Md)e8)Q)#w}ta@3b1tnBm5dOj%t%-VO{ zs(j_1@b`o}n#|8|X~xQ|6f-m#>o_a(p#e0W6)8IZi zp_$F#Yn)_}868;>A?c7OgU1(4W*>%@E4-DJ4~mu$lV$xC5Cch-k2zgsv3aM6yk)l% z4+1hAtBL`+BE=R4dK7x{*Qe|~3Egp@=!;O3AKx9xE*+ndeYq1!4nNM=|Ac^w$Tw{% zVf?AdeXxcCF0}!D1$>VPsSdON+nL-d#)Rzx@jp!531dX_p|7{ecQLP!Se}x5MAYQn z)oe&WWQ4O{%Du``C_ecV1iUW!X_-U;$B0=@NfV>*uGfN}gAsi!r?1c9^o2(;pc8FC zxlH~eJ(4W=Lw_UV57$9)+eaIvZgIEX38galj^{Z#J8@|P z@CkndI7nwExjc!%zt9iK6S`RCnMWlYj@1m=KCEBAdEe0N)k=_{5C(s^O%1RRy0XyQ zJwn4Cydw`x@C=h{OK;O0T9G9O-e2D{*x6#2f)Ab>#%A|l z6!K8aQh8(dgDBRIvtx(4QWqT2fY$itx%081EKnIH0=Z$=2$#}B{^Gs&DgHRj%5e{4P{B&nLMN#%-^ai(6^TAQmIR=F6f;q^2>g(DCWGgBG^6N%70t5sLJaotPk$J2fwyp(kNec4JxqT?u+8rbpLR>dGtggc zxyM1RhBjuLY$%MvGemr>>GCm?jY$1M}&&?OU2V|LH`| zOgsLOedfb}7;~QI8zzKyE-Gu@Frn+(I2t>Cvs3PGgmGy6+SDwwtIi>e^`5^_{MFLZ@dps zJ8-T-lxhW9k>cPJcDhs+pBg3iRvBf=!_RG`H$Fp+AkSQF-Y*8zidHN?)nkdlFPtep zAChP;mQ^`&XL#*fWEf01mTcCJmNUc2`FX@`THkcjV(!}ec*EP+PsGPm;U9qXCmhSX zgqb}5Y^?98@#?KD1*1FK@u=_~%1x%1_lwxxEU(UW z6Lp1MFKM1hi`Gv%FClp1GG^RSj}H{NVehfxs(D9tCa6&ESj(wcdk(g6l7vHn?Zv$g*g@`eC zjU3dkt86cf`p-BsWoor)BVx+R3nkC@UUWBCC}HObR@|WDgb}Y7_DlVXeLnvr_g2fX z>95hoX!ou4i%+oj)}zv+3G^5^G^ftd- z%rEEBn)G+|`>n@5VH1!%Vd@|F@l2T$HdD;6&VfCl{Pbaj76zq<1u(X}Mhy#Q01sVE zxi~5p#vZhho2Di6Yo{h=JVOT1ZuSp!ZNO-Jsr7ZybuIJt+G#NNgT~xOJ=TwHJ+Dm< znw)5Prg(DVs%J`+K67l)S0R0+?+GWSlyq%x>tF=?81<73hV+?<+wG~~+gi~AK+|mM zYBWA^0ruA%3?(_Cq>D`;!twegwd*<~d2G$X!i-kD zET>m}{JF@!-$&N|<09IsANjkf$^4NNULdHbe8ksepLPC9shnu8*Cb8pU2JMtF$Lju zl9aDs*n^76m!lc7`hSnp|0)dc>whO@eOEnOEUPqLC)8lEu!#dXN#GuvsYdk$W3k5a z1`%QwB5F;)<1T7JOq=+3Yu{*Me1oFpNg(@IZSfBXPOyocCopFW1cftc3fzM>6)J`<<8Nk~H@+P+qY`7e>R?=b(}ZYeli#%axXjK`1j*XIR5QJ3CFB|ahq%BTn#M2 zS@rgH@TtEq?B^F2d(14gjLGZOH)t9hV1_?$EU^zYsRBZ3&-*B2Rm`0C&;A)N?{+$rEKK>;q^aL`qtlXqrU$yFl=iCKA3$;kNLFP)vU+^z<6~-ehHg(X*GTs)3<7?x>r~1&+}$m z|LnI_|Kkf&T1r~(o50rmy~O-YN2A4RrrC?k-*Mg<-Jo_5Pv<-^mB1Mf4en4(+kj?U z=qtZ;>>vBfK1dInr-XX=&*V8#!vc6wpO^vjF}1Edsq*pnE?i8p9T% z0PuEmw;w|M-uNKPQ6Ej8qSRWQXRwUoR_|96L_CnCRU0JQ zXojUNnv72|x>RG_r`7%$T2=ptzV*@M`s>Z0M8~;4l}oNGEb8KJb=wFQ$jq6Q*iqQ; z-XSHFN+c-;E5y8R1TY>X+ZoH4=H$rCoh=!5zaC+PjSMPBt}K{~eZGS{li+n%v#(T; zxr5<9ywm2&Ez;RV?wZObkT$p+jFarBq zC3|)VtmNP?;T9AGCfBPcm$o+Mi2L!3cUF}*crZ{V2M>6!PdPtnty;*)`L%nI^Ukl) zQ_g>RGD&FH^lty*B5VJrd-`nu?T&8kfBneq7tp@Y?5ide?#afIS(cO#At4$-zaB z0x}JC=x68_1M0rArTXGG=&FEXfm}8Pke98OYIZpW1D$-@hEw=ET+qjNsjuXS2OhzD z5c`xcRj|n2`nGO0yIVK9Tg$m6`Q&cSa5rz(b76O@&fS`&Tjz5N34j^reN}1yK+5t7 z|9xr=g@C(R6y3kL^~Eay?XNFpI#VsSptxV_g)H_R>Zz!P2Q8X7;ig|3>Yx6N(6SA6 z1T~#b<>ud_v|Sx%JYU`=VaQ`X9LC$5<$u%LSnB84+k=i>sgcRdz|bx^F1M54%aCTS%guX!lIR9o)4Ny&yUo?+(6aX%K3Y-(bDeE& z{Bj5QOg5q3~YzVa$mgv|nO@gLT5&+Y-VC`QEaOvGUO7-!ij-7ArGtWvMF%&dx z`dIYaD)q}3l$@HzcrAto9(zUzWJRz@i_jKD!00LPYikI2FPT4YA)vXT$85`+=2#Gb zs3W;n3xlD`*e@1rXr(b+1WXs$uGTu_z7VYH;JE>GCwfw_5vW-wyzS95MVNpkSjFEI5|Zw^0WzvOn6 zB(Fkw1(Fq4QmM>PF*WHAMn2%Iidma-KQ{4OpOFLSDHoH7FTkZbcb%r~R5hSMNRD>c z-^Z*G%}zslw0H9znoai%&com_RVtP_rT*A3i|*iY48jt14f$dbx>2&*mV2r$90d4S zp~sucMIlf|16E&crG9jRZ&o=FpS%L~GW6mPy4pHhhGm3e?ABs1&@a?B7hI%vbIEzF zk=L%}wE)y$tlr>S#at*%5a z*ygZ6!u}ez(pPPBAxl-7Gnl{J)<@^X6F;EIfz~8dr;*C6pYZe)dOKG*CJDnNPD!ea z^D3|@Kc+biX367aUf1|jkR;*Cz9qWES+W);t zzc+)c-&}*g=SK ztyPw)VL-JxO^$fK|G<7v9%r4gEy_aUI4HcAm_qO7Oh?zzg6yB!=C;DmNr%qqB?l6b ziDIArU58`*4uc{0K+Fm5sbl@8{DEg-DlZ166MUFv{swmwbiBvxKatn?GI7= zMYP|pX@{OZQi!g*5xAfnQ2kLtG}TG!Zg-X1?VHmt4*^P6zp^fnuw2SbLBeG0GMCK( zoY45Gyz=owlOh1s*r`m%A~`DahzRn2*7R|>N#*-WR^y+yFsoaoI-Mpp4TpaU{gW9= zl_@^&XTnUf;Qo6Md}Gg$sFnzz2tll7>(dfQNDoGv4&4C#SbT+V632n#^}@%&PYivD z|NJB88vXp0j~z=@uEEf4cK!OPXZYiTR*Ge*A}{ghr?J5LdG`{(1QhBj86@7s`_*o)U&6I@ zOBdvw-8xH8v=rI~koNSY5sDUMx2441CSXKx-ZTy3R22p0KLt)(&`HgeUX)Og31Nxz zhDyZ~Df+N%y}-G8oo#rQNGs>7GLhNOmpNJ^I&wRwq!TgeY*9&@vOLMpx~2a(yX6M1 zH7$)w(38W`Qph>vF$+m!t%?K1YW})Lkenh&SniwrT|*$l2Z%tsoS*OuR+w*@HB?%T zeJTdYK>bhI5f``yz0>;{4-Eg4cpx|xy3L)|gWS^qFvFT8nvOSebFXH^@x>M+SCT#s z)nNQR(9z?ol?lMAjaKiz{jBk%rQ+Wp>A$A+tw_a=dN$G5$F~Lv^vP@U>PJ2|Em?G$ z>WJ;0IJ%Q#$FvAu3NXIw$N1Y~eKTbT47q&(zhKS0>f%na6MYd&Gpb7faLn_wy)d6_E?JMOM5?r!*Lqv)@d zg~dRwmD$Gj(T$gMmsySPFHuq8b$;m8B}8xek!{H_-jmJo zga5JNe)A1C++Fsf%e4$pVzc1g;vW2}|DfkT=s=M--7Tf+3W@tDwX)4WkjtIoCOU8) z-3)P`P!9^r)C?$8zrVpmmR|R6(0-F%DAagaovtT-fq~wy>m}ru4SK1VC1ZypxHae} zcqB9E?j!lxKWxbNzwU;tCk1YY{(?(e6e26@@V{lovdMl7tm5E+g3MSJjbtn&YS>uR zU|^$oKTtfO_gGqF^J&ReeYiGs--g?aAH2cO{+Cg zwIxSXMY=Xc6Q7DEZouU`2`l}I+GySjv6^welEA_hJPCod%R6?Vgq80KM&Qq{beWHM zQ-e-b9p0VCgD7j(z7?dp&$@}rOU%pphEU(eAQ>)1x8f)I041ByirrQ!`~1zWgBa6K zJx>45KG%=VKDWnc)8ywu;yao0<>MjfSxj=lvkRPkzSLSKAmz=imT`WQwO6FIjM#?x zAvRy^U0^{Xch73g$XQzX1U>farXNHk-&2!thPhmJ@g+kfe7F?=0?zQ)x3=qbaLcP7 z#~zot2dDTC_GFLnk=esR)Qdg7JPwi?DQJ7L$0VH+*OR1x-U*`aw7%wm(fVV5_(*BC z>r*-8TL|7VdPez8z51efAmtWZHo}YxEn0bYgn~2pYRN`O7F<4nKxN(QTFd$Jjg1bz zU`xFx=1#O+$O56ZU+PU`b?jL0y=#0+Cv`{GC*+H$QX8hf*WiFv7oY=(n* zoTEpz+1BmphH&+WZyr9SUn|sb!aaNlEa2^4(bv&zv^2WI%X{N+*ArTac>7)_Z9~na zzwJM13HMUJm{#QEt3wh}WavN zeGp01dMgw0hk`=#J5N!BO{3k&DZ@rk1=p`r0xj#~h59i$xP><`Ph&NM{!<(arpRB> z0gQup|5R#I*(`}uyutH*Ye%u9*~P4dnGX)rjN=qP;SrupIXCs-8GxW139XKq7z!sv z%f#4G0d%zbM9^X!gz+YS_donDc_cm9i_8-W_-q!lGKWYi%K`o8&tP`1KiR;3`V=4R z=|LN8xG}I#_rb<)IK{i1Ce29e3+w|w5vT?4^QVpQ!a%how>ai8_*v7cSC0WjHzu^G zfkvzX-^Ev1{%dMs-}4ff;kLdw&gLd@!n+?pN;17k!8(ff({H%*4FdbTRIU$dpobH9 zZWdCik7(N1tJoXSGhu3j<@^VWzx1zz-g^I)f6U*%u?~C609p2qvkrn&ko>dDutH7A zAtO6PB>uh*vtR41&~2LakN+deY8wwJukM3?#}ypP1PFf z**~=slUOb*-SZDMP=A@;GEll+rA8gJuJ-_HHEY6`BM#K;i=42k#YyWq?aKExK$9~e z#$eDshJ5W4j=$fYIt0X|w>U_}WeqKJ_7aWJQuy^Aqbj~)DNS@IQPbf1bUoSm2lN=IMU2hG*N2l+f!q(LlLfzWti9?&1z3{r zQU1D?{FRN=cd}oCBkVpKP7J4DR7clNDffTIB9%qu1J0Q>moSs&kvV_w_f0<%{q!|05FOHv$i$N&PIU6w<8!8CkS)82RuN)|9wl)+4J zo`S#el|zDcqyqF7S^EwppZ~3FsmO>k6|U2(P1)|p*B*Ifj);O`d2w5Av|teH2v~o` zgsF|?zT1vhaFmt4(FJ}oBOG5F@lROj5D)?9__SNE;z8YeGWj&jddv0_4tfbl9}GBr z*4mS`g`)JI455c$*ACfYi>)^80;)K&xOiLL;{;iNPg_N5%P3}l)uH`Sie*;sTQZo$ zt~pu%tWF+yfftnS6HN?1M8Gw)(wLDJnj;C;XZG$cO3Jg|fuim+idvAxX8+aH+DI1#vf0hH zcX6F+B4101WzGe7W!{XbiBX-gnrHqUV8{=7erjSI(f)CJ>q$0#fyf7So>U8wT2DZ- z5V^B8{qu0eHj{|!BgqM6crtx)VnR3dGuD&d2XlbnT`ql^4Ly?Am0eNm{m7E$10^Ai ziZ1LOW>N9y+SKn@rS#Sw&VLkIsSQ@XeNig=t14&ysXzV&lON;Uu?QFQWhy1QV>Q2h z5EQhWHZ@VUHJTVj=E*Ma`L9cxk`(YYreYxoxQ?k{A=09JDdl{a6J0$-IpSloDttqm zTHL^n#Y!mLD9S8>P8Sat-GTjok?MJ@+>9M&w8nu8lxglpYw{=(!9s-TMTA+ghTOyw z6_nJn+x9{2&D_Mk#M^aH&;;$|S~-^ntxsB=oX96dHm6m|#E)(DA(Q{Ky66iA;&8R7 zgCW%XAijX4b+MWs{5(JsMJz@^ue-blZq6WyBaj0mfsjK}m0!*Q4PBekvuS7E#bHju z(7^<;n#-&m;veJo>U;z5I&0(@ouMqE2iql+^){z?Alv=A^|qn*`>;p%#`{3FFyl}y z3-bRO)emJ*&FrNw5&wb>X}JF#vL6(lXBwV=sK&rEBszglYJVlS9JWV2U?O5LtPfdc zFn+;JePLYkHT6gAJE0o+AE5f}pJ~dnsNVlIGZBw~YFh)8V)2cJ`MpuPd|H>&xS;=r z>GO%Y4AG@Xm!oy*&xPL)!7-nl=O5N?21pz$@}r^x#`A`sl=MemjPKub>x-Q8@%rNb zZ$lCyJd^z~zWDtAQzLB&Mr0xxDe(VSeMDd9^S?y#C*gmB``zgOh$L#qs~{0nGvCM* zl@w^6PsXr$~Rz@a4d~OB_{x z=O;#$r*x-En;-99;yk{@%n=5uzgbvfzgro2JE321yDrb^vQd|3xIjN^`18r>=jLhu zr}Wd=S5|J8pd9_k!1VP;m4rR%RCrnBM#jdF>kx^L({6DdLSZoZt;7SO@psKWjqNW8 zCC?Or@k(h%1C)czCHa^lPPjfM;hMa{w?H`P=!e{hu&cLKZ;epDjiACxC2<^1lZ)=FRV4PTlK5i9)D;1%aX+X9nr$1nBq^HKON;B78 z{X@yopduQ7xxV5r4n8~Kz?rIG;SvYLo1hMSzw^FBI)Mqm??+b+eycmX^5esN@7MDPA_U#q ze{clRsO#&K`C~YK=mx@P=inkM4Bgod6&n5VmGg%b;FAYki)k&YH|4aiBZy|oxN8V9 za1`%)Ku-`IvU7;W=-`w37Bw4l+j@%zwZL=z2k`j$N&do5?>0t}PBV2J z0n208r+-`#hubm8?bfXKU7FL0Mf=5o=4d|EPAodsomdoPs$hu(AD#UdeETHiH$C#n z$S=`dA2|7c1Gw|$f4RuKHnV;(&8qs-W@PJ(ymJlDET6@zjnWZl3o$b9nYIX93laIq zWRveU!LIm;a@@L1urJ9>V)!NmkDZb~aWktTbWv4+$eB5A2Og87GD1AmR{ z&6jZw4p9h!;FoUydHOPu7<8tEe;F=eI@sm<82zF5XIj&<1Tv`-_3>S})=Ax1G+E9T zhBWj%tt+VSv3*_*)3qa3)9?e$UmULw^OujmWw+>iHc=%jt$lHh%VkIEi_+OK9Zc+f z|4Yo^x43+w8JsfVlg;48ZU)`_{a1GWswCE&=^JRctO=a{G%k+~(Rk4dl3bX@dxhP= z0CM_JqJ>C`op_bU{=EI6)njQsnjFs2SF_m+uq(7$YvAC}D@yf`x+PluMrdUPkD+Bb z3Tp|c8Row!`i;tdJw_95ZWX4iQU+!tVr$|~9ZXpn!* zb0tKlo&6w@Z|n2qaKx#WTCdEb&U}kb+qp{NJ3Lly!PS|81sQG|^2}DlrUge>)kPa( zHPP=u1EIFZLB4EFmRDeNmv=eA7TabaB9KRAdP(XYp7HHsvzWcRzX%=NsmmR@Ea&n` zD8j_4H)i}NA`26vskgH_QuHzJBwsfcYIBY^aJvD9D!>Z7vdxK2pPA)SiRR`EK}Y%#58J2}(UGQ=fs#|3hio`P`x71^B?Wab!)j zVy(`riHzJv$sfE>-hn0TKy_i-WWkI7TG($5fik7%5x6CPkASQr1Fsv}Nz+)G0ew%n z;svn1cgg7_#T}EeU#Nc>TK<^vufnjK0GlF+n%ychlQeWvk2r+=P;F?nPHmOEFI9D{ z?Ovo}8}+M}%+Pji`OcQhPSZZa3Kp&)>c#NdF3we8D{s-~Fw`QUX`3i<7HU&DUTQ9~ z%LxAzY$6HHOsndlWO_=a^4RKoOt!FoeZ@0WUk%+Q!<>qvr5q}TkZ;qJp z(lxm}(4Jb8l@%GH%lY8wO9xQ+^i`^9uX40wgjTH55p37yfGO&xj^Qvh%0nx8hrIs6 zc2#*sdfH3UL$yjzm_(lvv7kU+EiFIv45x0f-F-eDu__$`Mxz}6L;%gP)Aq?!52KfG zD9RBH>o|Y{Azs2UDBdp1X|OMQ{4=`b4;?v+k$b~*6%0&AxAm|0#<*Ne2p(h`+8|Y! zBNG1q8NWr!{@;xs?IU6W8QsQDVK&CEYmf1JZ;kCW^we=Vqs|h58~=3p)}Q~d+M21U zY!X5nMG3gcz^=_AzraCj`XP`^K6;R!&Gk&OHHuYU?+(k-iz|o!)?y^i{?HvMqZacQ z*(!=Xuoc8%4rl7zZHOi~x_me!V(H=sy61=a2dc0lBa^Jy<}jSc!7PX8P}NAMV~Ef4 z_K z!*DG*Ef>7noioqTcQ|wP+i+%_XS_Bpy{2W_=X+1f$K-$H_+MrRleFxeRfbTvq*ooA zr^=Rchk7gLBK?^@z9=n?62ug2xbf@CJ8{OJ9?1*my@n1LNM((1Xxc$Zlwl~jB1whm+rkjMg2M}truc0#pc2bD^daZ+J83j7U$bHY}@ za^f&s;q(Ai6(9W}RpwxKBTZrpE@7rTWiH&-z z$p-E{N{WN#3o3zb#qUiSe}y;Za|d9SskiQ9`ucvP2M?Lycmw$bRlVlSNs(*KKzID( zfxe7>1}_F+I7f)$i^X<$A8k$idvp3L8U1DT;Qp1@)jhaJ2SyVYmvGRyEDk$y;b3In z?g$n~bmUHWWVFLdo$BdGVODRG{xuG`gvuSAt+m{0{j`nJ-qXO;$2uF}miOe(g^ z@(RwfdL~LKLc?FD%484y?9zkODK)oUni`!Q-kS&i(d9&Xc{p!o$*P&99FL@8BhHf5 ziGU3yU?FdUAMMTl*ymh9LfdwVl4`c|C!4zH-F8`kH*ebcKB7_ufilXGZ+8#ynW(#b z%Xod2=|2w{7>*sz3$=ZYPZ}R(liLo1zR;awLgj~b@K^o~Eow3^2QK4Gmba5n=%@34 z9v{(f(XBFY7hhnt9f_LUSGJV5L3L=ts%Y7Te7GV{hwRm;aD(~2CXW8o#L<6kPt7JY z6^`dqiu)>=AeNL!o`B?1sg~;H-hr{bPL30~Wu2##lg#b%Bz1HVU4D@+uPPhInR@1* zu4M-WU8Zyxb5PPc+X&JU=gWTYtSVcF9Rp`%e)Q{K2j4@FpVS><`YZ8{tLX#G(o7>c z?b*J5hau`$yb(&4Vh!k^zLholKuwxP_Q#B~{Ktt^FNfOJ0I@s>%S-Hcm67DAz>3Y` zuFcuv?#llSk9;qjhtSWUljKifqr__&*B5kJ|8U^i{h|t_VFL>d3Z-zCd&b=z_{jal z`-B5qJ}4s(lA|6Ga6I3^Uy$xlFSL`^RjcSvV}0^g5}OW&R?eUw3p!G^`>H(K|1+Vg zGqmC^UNzCo!AZ-@c__k%J5I5um6XJyq++wqm57YoZZ$Ix$*f&=!QQU+OnrkRLfki` z7GUTbT>1Q)BVEr%OPRQ z^T)efmrHeta#4h3DJZRv{{#B^JqLFgef=@CvdO2fCec@^Ex*`) zzaHOz#hcNJH+s-lOBn?Af-J=z1co;7j{kgL1m@`LX`jAkMw4ZnR7ou9e?eeQoJf>l zrVt*wiKEAoiwIAN!frR3AxJl&smkM zk-v-Py^g&m`WiXLr!S?)92wxg=?l{82`Eq*v;loZl2?@tvGX<7rfVSo;o;;xOgHu7IF5iBeuNm z#MXnnKAQM?60rB*1V_DXx@^^DgDz{iwD)BdO176vw&TC@7M|0$@|R6!c>$HFk|X5C zX%!~@Kd;KS9gDqs8K_j?8-N-vmU%XK&32S(juYTN^_`{0>1@o!|KlAx8~@&u*#%vX zPtLx`gD?C(YK8Ba8bUKl`la;o6K>qX_RBmbeCU9SlS2n7eWJQ!iHDI;_oRNQvkdO^ zsT1QnCWe0b3jf*WxIVJ|oyfipNU-0;(8L|}@z;rwFZn&k<)Wq1$4|WR6}_r$l1EKS z77dS3bF8{!F=dk0&VMs?6R#Nrn)W6s%|;(8Y~Tslz$N@2ZtKel)mvK0d0`QGHZM)! z(NZ&Qcj4Q%_{rGO(s!++G~rdEjYbp!xm6k@Q_w6+tZ4%GODFIHc6dj+*sR7{9d$54 zVc~ZP?u1r%Xec*s_Hi-%sEK*6kXlqtC@=!>?A7*A>H<*cXsls50;qJ~}=P(auA#qj4Hq8^y{A(xLKW$Cpl@8PpPj+&)- zs!~4*yh@I~Mld%%eL-5bhQCTdCUI(JC-`HQ5HCI5q&4U2O&}ck+SxLk`CvCvvgTjD zG|+7v(lYYeuc)veW+?s!QAfE%*iyZ-hJ{`~@5c)q`pQ)nC;lpJfT=3)EWH*SN=E)H z-D(z?*MI*h(1!h2Yg+q}8|q;V+d#01yc5ME;Iy)mp}XD8MtuB@Gw z9D2{R#Ec!gs012H{)xvUpgpvDxAo$CZa}VFMCgJhiz-GEk%ma(O5(QbB8j?M$yc3; zHz}BzU(TYo%odK~Qwod5&g3-2YEHV{pPV_h-aEuNvfDAC0|uad2YNaZr|IOFd&9}$ zd$1LD#cKYrNN+NQSVC~#G};%_HF(daUG01$B#b1#cAS2j5Go!GC!fdPTZ;KGmrL<2 zCHhnnOnF`IoIfebj8SYjXU=q9EWj^D*tOB_X1`#{e6+oJBS98 zHHRtY`R`wl0nM2a+Q`k=E}n}QW$FpwEZIP%8;YlHgCK#cvTwM&(~ba5`p%$l{dM&D zwXA**3x*#2Tg3*MT>ibJJO7rl#BCCH{Bk8R1?;{iO&iM8+-NPzX1WCJGZmYsV{{i0 z zsID!ani!=ZFQ@J-v3{}ZH23Hm`PV=~ZTixTD7i+W1UUKt1_VxBB?^a1&OB)kg&7>F-83WU-7~xsxN?Eq^syy?@@VQxe1ffl)2o zPRmRGp8SzCF|{id|4~ZAg|ZP!BNbbxCa&L5LLJ`?rPGr6&VEwxu7K(b>Czmz-G8xdw*z9@phjT^{1no|Tw#B+tFX9XGf@j6fI4V;p1d?w2AKRp~Uk@G)g z{pwkdxS#2laW47Z1>dQZ@xNC>NAP*UZ~qy2IqNlvvfxP_Z}9efq@FglyR4LSvG*N| z*SN3#u2pyz&FEzVQoB-;mzI0i)1t{? z?PRZmmYu(=t)KUoZ-bEJ;G-C=a0vtXu6j_15Vp{XOV@G10$?yz#fiKF6zFA^;xA_W z*Wu~~C84`s6&#QeKrf_!2esorPAvOII9WtFZrn0_nZ|Bh($P9fy|qPp$?rVYQQmGX zcw7EU`b7iOOgo&SZkAdXb|`=t)ORwt`tkpQ1(zIg%a@U`MK2t5m7E$_Bx(K^{+i~J zgU9@cXK0Yy5|7D(xA$Y^m8wyO+>ogjbmxJ?;EzTv1UDnucY8J|3m*H{r($+l3ZSq`k$2PzefF6 z(SN&lPos-nWX7ID>>3&DA(5!HsrS~YxkTSXlcfrCl$h~n_xzC?Rgu&(=Y+pQR9^hp z{E=A@U|>JGa}`wlAMY%|DB+lSrUo2Y3dGzN6D2&f=oEAcNjyaH4lOxWKm++6CmP$W zb^vBub8**(6(8O{(oGr6-w53lDH`V$cwiM7i?ylS$-zT`zz9YUS828o640{1$iqYn zmjXhmKo}RUzNU0BhfCX8h-q?g7ncLYV*fB(mGUG1j04)H!hiD$(_0toGgLjVIQ?7g zL}xMnd9@8wT`5W~_fGmxL1T9!Oap68H+so`atp}I1k_Sr@CPW#eZ)>j$UNfx>>4-K z!7B{O2{mspv!TWSjkN^x^NIG4SNL>Y$`I5HkserA5q+#jIlMn-JQG z`^uKmL+Ek;)s0s2#9y|Bg;3a*L}t+mlZ_4uCtGw(Lh%K#n}} z<*UTB2}878=$#w@m-_3GBd>G4-Et4)7&~MGj+=Ej(ktMO3mRqD6j;9>O z+%HpF;}QZf8SPNe$gL-8c%1$D^vEQQsOMIA?duxjZD(tYMdZCN>R(9Xe>tD>31@tu z#kcGuRr?&z(UJQvU-S%66I1k>hH=cpbq-bs-%DBeP}`&=!9zzUB4e=s3ZCRa+M;G8 zYnOt=Wnzt*kz&WbHJv{yG&hE~WfOWxK$)|Eg14D$V=FLbS~4v#S>nXr^BIPv=h z$ng<(eGv^XXp^r2%H96(dr`m0{~z##F)bskYyp4~+&rbe- zPx61GM0mlYe5R9A)X7h{)$XR}wo`oCNhxh0n3v$M8~RB*%Fg0;biC0hlCqY>2-OH!;Sj{)T&Rn))K-%NT-85C!>~px-yW+C~ zh?`c!Lv8~{ZNp+Uv-O_K02|Fy8NWh*+PuixWTwzg=@alh6ncZLCB9pgAhk3HV*ap& zmWBi^9qYY4S}pmNK2L0S`j>hAM!5RY!q#)Be|@uhC2x|WQ4*EjK70NsDx$C&nnJSP zT(k%YG;#8)7Vu7SXvG2MAXf9Ry?3grWAdKKmo>f-&yi)7 zo41!Zi49vl_M)?1%b$lkVfGX|6$9Yu|$#4SvrQiu|muk3As1;Ww@`T#qd@NJNuoS9hx@uBzm zb}ZKKd{}rKyy9+9%iEZ2Y{HTxuJYb{$bNe8o9?G3{nV_V!ro5z)499dPYbl-UJ4cI z*9Iw}O7A?^@F;88cL(xRyZ==Kaos4x%Mn0M|Nl4b`t}(%eRaRk zieIWH5Kt)*hPtz5w?!v1GD)Ser1X*n^M8aN;kXy&M=&j@l301$V>LhgiX_JnDJYz* z;8?+#Fe$mZ5l&pF_1nEfbnLhK_)+$=D>HC0T4rGh)wtq)7k7cX!>{Pu$8WPzf9?mn^0CX;uDLcU!As+O)|+rOu@LpY zk_uvvmtwG}h+cpSc_k%-@DES0bxAW8{!d5Y3j7h5 z9Ql|f0Lc=_39xVAe1}lq#2^~=_YF#=cVElh@D&`2~CQZjaaO5#FtfcW4^Q73RJp^<_;{EaRE6 z!Dq#u*E}c}4QdmHm)_fVWC7>sGiU#^(PD#|hEgp%MoBD2KSGk0>XrqM&q?Tl=}X<% zp)VV8kn^JcIcF??U_D8Bs>`*)C8Mzc#ajkdJ z)MWnA;G`?EeSi7_Q)}Tkbx_ti`8$^0g^EgwY6(Uph;4OHM4QPsldKj4{q|?m5r^u; zd6DEeM8+nca(DW#@dk{>JIrbeoc{)9q%5{_t5DgkWi1H)1FRh(v&4Jr=)Mt_`fE>I zY5nrLE6#sBIWHz8m%S6@H#mdnK0j9>$YF4K50>ZPazfH0Ok9yhP)A4`>q!ht1P>ES zc2p#OK>4q+161m~U#=x(a>w}~e1uocC_87uD)yzwP+Q95nuG;nIPO5q-j#*i10xh? zU|X|mJe=^K^}7(-7U=ON@1F)rLUBUCFl08((o*pB1SP!lVER&DAP0>F2^K-4JmZ~a z;VD^wL0_cIGQo7Sk$QXKu1!i7KDX^9OR86cjV-K?=<*!8Y?NR!Wfa1kIn7w9sl6b(g95HESFM*Adb4|e#2JhK| zBI^)IllK{Ggv=r1%HZW-W&zm7mYS@`maP}1W6k}yoIROulN5glz6oBZ=X!`G$NzS| z3t$$S{nbM@DSxY5Ih}60Szny|e-vc;_DQ87Rq{Wq{t!(T_>inO0h$;aNRGW-FRM=$ z=2O6i(h1y&x>n|p3`5k9_E*2RShe@ah{Wm*LocEfA561%P<8Oy^Qw&Xf;b2Z^#vT&B@--g=JqUs!aS9xM$fh>9W83@kmUIaG69FUS*VPq?N;X2p(cVwV2$ zF|Qj`g3k@AuOS&CGUIYXda?JA0Mf7^IP4YdpX|WgYg-voDA^?Clm*(gZ*jb0E68_* ztQ~<`?tP_y-{M#JC{GQ{mBDWQ_d+C6PpKh-?yk0H5 z+BWl##NZiuABDk_GywE3hAZBq7*qd6X7E*}wAWoz+Dzt9xZ;3*3f*~* zu&Uf3SHCUn*KZ4RK9D&~Fcr8b;DE~-D%OBmpS!t&NsU>7AM-!Nb87{HSE z`#m$yWjDKl{(Rs6UO$rEeV&;!XU=WToS8WzR*o#rvG(!W6~OedC15Ioix<%yu=LIB zuKhsCPaD_%ikOrUcsbZq4?g*3!d;Lp>VU=kDuG+BuEZcw{Ii?{uYJJ_;fGnB`xG7te4JS4N>-lQ#gYh{PS>k#XBi#)g{i|~)A##Qv#h@YBT#7g! ze&7u}7X3rsl+`1YUJ?PK7Sm7=tXWUOOs2$DQQ}0hMfEGB;EmWnr;GX%ik6ct!XTVl zBg}hPPys?5n49vjT)9TU=f=TLOTxQU$w?^5bZy(&WImTpdPusq<5aq~(C%vJKW>h| zXZ>nD&hi;CZl*TN4kzbsbc8Tg>Bnlc*z)+q8$JOZ21^Dh7=}$U*K4GC2w=I2YTtwn zWa9jRvdnfS`*+00ku^8HbPLOX@mW@;D@6afJWJZ@+-xeP8B|{z3@HzCVIGX8p!wri z7W)-O=H_630Y9-#C)GY%vFkFcvtB%uoD@V}hbo)RpGcpnS7_Sg5hoEkKP4~6j7)37 zgdKvEEd#EZ;JhUc%&b!Q_UyNTErT%t){I>pQ{Wh#0v+}$p8l@**WmIGIC6CdmPCvk z5S3AJtR!$BpKca@U@VwVQG|T~*6+tK)M4*dWVDO`IdW=x8$B&n16xeWtcZLzCAv(F zfQ4ITwnMZ9>r*&VD-H=ZUkQxu*wU#SHPn;$F?v^uYP2#^g+ky8CyK zF559ZyU}4csvo zum!P|bd&gp1@3`K~mMus7%G8@5_j`%Fb&;eo`ZrTc|#loys3{cT+3Xz@|Lc+;k zffo`9s>(sb1KAX9J6t!$tdZ?Myt?TFIbWKiNO%l^mKS7ifAcX^G$8t75>v0_YlACa z5H0b#94AaiRZL{pCBiUjo0&uo87NMqK{mG>iVajf31j}T#TuM4EkTFolYCNDBp?L{%MmH&$ z-Yq(iLd=eGzTdOIxSbncVSI%9120xAlQUEiK|ql|U?{~l1m`K?kn zq+-fFC?h!Y_qJkHA(+BAiX?1>bU;p$M?n(fC;(-rV!aI7NuL&OaEq7 zs9-I{=A=Yah@16f(uhhlSA@HH@pE9HD0lx$G)4R`hEy(KO_->7vdEB&^=rmCph3qP zQ}I&PiK(0`K#m$yxroK=vw#@f{T5<0;Oyi8;uRjT5CElx6C%BY9BjIW{oD%6^Z(MH_C*)jmJDH<}k@+{10 zD#|mGQfx!E%KaJyq z+{k#2N}5bgXLJqek;GY2_(38pq@Q(oPYVKr_}ek%muIs7|4Duror_%V$WQEyW28BT zBn*%sd~>>keDT7zMMq$Sa;!%g0O{Ad^2Yd!k~oNJyu`^Um{=9t?Lql6QeMuUwM1R( zkKeUG+30HJ3@H6e$FQU62hr7YJ5P`(_-WdkEMw^9WxxpBZiim3 z^?J2*m$Y&V4DK=ye}IfapfB>{tI$h9RGo6c>_Wx1mHn0c`MIQMJhWvuu@DX7QUQruZM zl|h(QdPg0CFbz0mjPMB-?Baqj*|FKeAtV8qE>2+%Z)j-vEVFdrX8C5dv%h`T3ExV3 zuR~5tv+oD=IU&gYypqT-5Enp@sWYh&5v{#r^OD)A-kb>Why&w^a8+)+>F%o+zuh+4c0*iAw z5rF!{B_PW5WNMF?N~Fw3$E=-VOb}p6T3nRHPeDd*7Z!hx#o^BhWdN#-ftY*=#Mor> z#9|8IU!j5%jDZ4e2y~AN#_-&+jAZz<$7pbhU*g+Tc z5#n!GVn~N^9vGS=m2{?h#NLk~Qqwk?oKR$>j?{diNJjaeI^G@IY2+ZNeojX*>j$ks z4$(*iIrIb)1FyoAL2)t6vhWLA%Zh~?XM3{bHsj&1^~p3JOJ@-d=mtv_t%PznXQ1F$ zCHU2481tDxEi;QB;f&h{_rwnD*M?({Cr|EV+>GDWd@PLMglKV?MuimkFHsLBjS@tSsA7EX^tD82!7d`ep!^-94n7H5|aEh zjucx{0Eetq{f@2E;H3TxU0+BK*<|1pk^h~6F4YACf`&D1#ebW0dbt8j6`mQ3>u{k+ z9ds5sJX7H`R1_fu2pOljRSVw`_Mig{9|YasVYSDNkS;V=(X7q8yeP_@G5;)yJekY2 zJ{6*lxGCte#LUdkE3nV3~SBE{NQ4;g@Mn`>e|q^DE%8B}f$D&y&!+{gLNsDiJs%Me>FI1^)9P#>DZ zKDMSP-7Yzi_Q(|6ke(&2FIWA?9$EGThu2!&Kdx`D%DBeZ^Jy;Zv3VdL2^h4=FADIsm5Zl-$?l?qqQA#yF`eDo zR{(CL@oMf6jvqG`&H3@Hvy9ru@lb^4+S^kL&zlod3eUSaN_a46)yR#tV0CpSgs11@ zN_g;s!t-nag$Gx+sQW$ZAw5_ANVT@_5q6}f$G}ACVXp9+exMvvxMTJ7haINm$)C1FVr>?Q5QZ414iAV&p*N7Q=!`#TAYheuyzNGT1M3h7VDu8_KkX zz+nynh?6edZm<$WrZM z3_y%6VHlV3_csat&nnEt+Z9KUf?b)!QM}eTROL$xe2rCRokkXPY1q}KxSL#&_*9NA>z95Ui?fz3#`q`eReH2;9#gP>{%JFW*=HA?n>U3%iS01*0T}N>s6K`iF}1V~?t2AY*Q^@x)uX z2$-B(Pxgep32`eg7S17T>U%PBOC*AA%VCcK>$jgY>x?*fuJ6fK3!umcs{EYp56;NKw&o#QPd1HF z4i3a+W0ynl62wh#j|*Zyh3^O28;>!(!W~2?Tu#dS(LTI(qys}%A3m*64@Tp`^nB}_ zk1>8?tH~p}o(%x`L)e@&C3m|`@Dk>`&*4uCl)d$%mMHtT=F>Q? z4_V6jbT)y{*K%FlP;0rH_SKv~$i+_BnOEzkvhOI5m`E z_sE5~eDkB+H5qN1QvKNHrWH&kMWq9^(Lm4lZq8L_|(%gp- z3(Rcntv$Hk0C_Imd4(9eXu|%lsROlaLJv6OL=tp+>W~eMc!-$7?TKU<{ooRWcrS}q zOS>8Cl@FV>5_^(LAojCA;fIC~$fqJ=s+;kPQ!%0X97`2A(F(Yy8+0`?Ogu$tEpBw&`|b{U``^&9CsRDAYLHSTJ7R;xLRi8#u12L6Y#%kuGgH=Q;tYWe4Z` ztB<((z~LxZ+a5(eaI9a!lET>LkOg_LuXB$4w+RDj?HV!(0%+8#WCdk82!WOHd>(Fm zxCpJ{3{M{7W~F`C%aBoLnx(xrm-O9=t?I$+C5n0tB`CiHN1ZM<7WdNUpNgsvHw8Q5 z!Nja|`07UjUGU^ca3G$H%tC&!qUy$`U>}(d3|!?)d!rBVko*PITPQkCWtr*Y%VOPW z!y}o#xhT_(Wmbda>b2VHnTMh|v0u+Q(u8c`z^JawW!B;< zs-`@sAQcCV46l`GM=Wn7gbXK<%CQ2FSzC=dI1-a)U2fMw@mv+?NiQ!8Pxi-7h3BeR ziz7p2WGx+p&--o;@m&TZtK>f%|M5o|8OZ;3Et%1mBw*@TX7xqc=V~xO%NK@D zaYin;?=SkmsAYJr2C;p?&&LH2~u@KXp2@dd1Wl=;ZilDhJI_<7c^T*ypjz`L?A zR3W;0eIB(A13GWcse*(t;$mjw3@S!evjB9+0d!cNDiik>l;bSK~v#X7ZffoZ->xs$rojA6J$Yiw($*7jC}?7C1qO#H zC+Z_roKbVHG`C#OZ&kCBD^6uRwNCsycwifUC-`fh!Cs#GxYXC#D>-zT5tR%U!&D0y zd=$neX0p;xIN_Xb3HBP_Z5DO2i9f=(hgDm38s5S@AI`xy|13}3=en0odLS~nJmgS!~U1_V1=>6ncSTp4|? zHFWnsjr@+x(6Z|fUI;fNV3tMzNX%G!VCEE1WpL<7W-tSLkz<`gM>+&MihsW{*am(b znxK!5cKjTzo&r3;7+fDZ*e?i0Qm9D7kH!!kP`_jMAU=aD1 zN~5HbB)FyzqNpwO_tzW80!R-u67~9eoH|4QIRJvP z<9emzch0n~OdnQ-0Rk6$bV5G52%;Xbfp?F~JsWm^^rac-0>U0UWPX15F-+8P& zlGob zO>57%MR;9(tlH|16;`VY{}}w!fqydaN6GJDEFD@0@P{eL2UFrjfhPV(DNyKOCXV?V zi*fLfB#pFzf-1EfSvT4b|0{H`L!kXAoHu-fUzrmC{^JI-^=K&LD)?oZS<$`J6WS*0 z=6AI95&N zYG>T_SG=Ml_8>xX2R%0dX;iR*o|*3>C$)#ux|EJC{inn28F*F0jV2&1n-yZ-k2!0|1_(0R zDUV_Gf!)KXWFko-9#vp}1lJeLIfvPaS<}tJJ;uD_NhJsovBfS=sMlrfNE09m-CiV! znthQhZq-3ed9ydH?;=Gn8%ciKxk-gSM9S=5X`oq7e?FCG!?}-+>Mej-DVq>qd$U@p|$xXtn*(x{5 z6ig*0H;F=?u~S;FXf^&Q{{Fh&dJox-gx5Z-B_XRhGO%pLQLwS>a-*PP$Ft#Bi5Aw) z!i-{S77%VCFQ5hJ|WS-2~UF>I%)%>=-!NOQ0)Un*b#z<#)ZN_A6a zUH62S{ZOk4xqUFiMr`(Zq|erscoAHS15_!*5IJU`D@!YFG2GfVxuQ(?-iwE=F;)oc zq13M#__U_-&+Ytk3;*22KiA=pn&hSQ=2*Yy#-sUi(Itmcn^-kJd;&yq=ZBa=Vfi(3 zIqxmN4c(aPb%dvp1y5s0@LOaiROgrYd;$|OAf{LO3p%ZSUNzQt3u~H@JDQyM_zz~J z7d$74=WVgR_8n|m${QL6O8>9A|3^gLb~2X?m!3HM$ZUooH8VMCkCfLH+&Q(Bav$2Fy8(h(_8p zY-C2npzF|y-J$y(I~-`JFz#!hjmz*~*CWlk@ZX4sG}J@TH^4!c)ovNx>X2R%z3|0q zWh|5SOYQa}=H}4B_R~73rg4Be4N;j{xx?AuY+tCc(0H^Vb|RMe-~45dG>`-Lxa{1; zcA7PlYd7;~vmrC?f#NSOrqVd%VAg|wli`h3ncN?^&$w#R0&nhJ4!zFXr07d-%Os*-t!e zKlM$-mJqfoD=UH(h8WGR#4k>;F&WRc4(>+krl}*tem?^tQZ#Z|I*Z3TW8x2=id$03 z$`AkmUtz_uSC?~&!Y$JV0{?@Rr!n4z6<%(>!pfc8DZCCccizC2@b9UXA?Bg9vc7~` z9fv;@vwUj~+T}={UsvR}-o*q8(Pf=K>UjG()^9Lh!)7*IlpzrTARL_zEUeXE*b-?y zxK@i`bV2;&4xCW*kGlGm$DSim?BNcxyVBF(K2Z>I{y3I7s2M#b#9$^OW!&Gn(C_R~%Z9l17e5;h@c zGB??s?LclgcLOC2bL=_147QV%li1^MievYPm*?6n>y9^@Ybf^vikx!(xI{U3%iYZt zE7@Cn$U`KK^g+-EhKUj|vd-_fCnyMOo@La0f%5p4A2?p_exc(Xr8)WLr&=6b%AlAgTDz3rv4qQ3UpeUkFs*UVwn%$VwYMscxo-J!n1)}mu2zQU~9DZ z)o;`*sny*Y;C*$SdPT;`!4*R8ITN{l{c#h1nk4J2jpqD1ewF2D3?T z;P3(lEc8Ei9Qw6$g)*Js{4h*sv9i9G?=fmt%O`5EYn^QRptDBp@9+v=W@m>E<_GZS zy5Qh9j>j|X*BD&lON$LcmEiGj$gYh@#updk(a9hT9(7iw@~_9Ej&B(1*SnYE>Ke_J zDj5a8r86eseBK1N&RW~l=y4k9i%{OGtV_OenPH_z-5-1npPP$w8)ZVR`_mpnf`=v~ zgHF9CuK7%4Yk2L8G~=#U&_sL>3s>kKUN#1}pT{0{UZH!K&K~B<_#xd~p}Sdp9lN~1c~tpY9E@h1PIxr(Xr+&|3F~kR6d9Q_aZ)3 z@)cyMvF`WKJ$6Uv$mBp)tWx#=$Yi5-Hwse`u8nJXj%vBb(OZ6`0WJ4U)-vMLo~Eti z|Lw9I$|(AGMj#_}@XTPQwRe~MQmZlacNv@)TR)7~K1-{_)wP@}XtB_Jzxp;El(Ax> zgPsyFYg8sBHljzEs8$7sY5zXd)HaxJQ*a}o^hZCer#zZ009euG8g;n>>UVQ}FvlwN z;2mG~4eT@nmnI_yOkOzg_^FLeNw0? zKX8)bf0M@;oNhw?2ZfqE#^C)6@#y4GlgAkJxt3aD8-sOF1v8>jC_;Sn{RffEKIbce ztrxM#99M@Wut-P5BvjZ}j-ww&|7Ki?(IJu<7_N#x&f<`7PBBPtnJ9|^iDX7@(M+a* z6K>HGT2~7AE1F+-OEpF+P!}!^=Ag!FyV9qeZ%yGF-2Wm6Au#Cn!X_Q1m1w>DGl1L& zC9LNxC4>opn0g($zZo;$l_&;hVl~zsX}_1@(^`x_%00E}koJ<}sV~}_yDh})!ib;6 zltVKwtS-n8<{OL6bc{o`{RwoS#fB1G7wq_2KA@|?wEt^o;X5Koee{>5Irtsx>ixz1 z=m_~>-#Ip}jhlKSZoSM8HDNps9m)^vik&?&a`9%2i|wa&qsV8=*W*I(8e7HZ0v z*6s~97kfQ)=-NQXH`rVZz5;d$n30Q`u31h04zG|$9Sgd6sIqLL@9VIFS+Cqo<=@nR z58A)1fIkvCbmQ#PlzxQ{U2W8G!WXH0OrkWLOXGd8AbJA6)rSsM&h8mHbemDrT3%EJ zPmVH|wKIMl3K%sO9)u1}HEKS^7c6qte1K27888D_X5%D2bm)rNMUl$Q2=`3uvebw7 zuhFSq(HeiEkKhjq1V>wuf04aX5tU>U<7-V#S!pX+BQ`B`Cuks=qv z3|*E2U;7z;nMTPW2vOQ^s0m%KTZj*%WTW*<*aeJ^p*0mCS(jws*f3&0X&B50!>HvW z|L>*N*Pk~vEdebM)nZLftgvk!4jP>0{?0$`BM9+W|NX1%}BmlsS}YDjUeTR2Rv3`&F!h~!L2e&FjGS6HO zH9ZrJSs9+9am0e+K^(HIHW)WV4MByh==fwyqawgcez`2J<=0QSg5^+hg=s4$v*1mh zxZ%)7%+3NJE;dGi)F_8n!UXaupG1a|bqHL8b@!R&vJ#9qQy;7AXTrAJ(81FKr-cq) zjV&s;M4}J$_eFuT>~!|(Z*YC&dGChUgNg9jth|h!RkMM2qH#@n!YojvC+qHK>d^$0 zSY_Y_ls=OY(f~$I);W9)>U2RJiC-^ERu3z$m|^ifwtiNggQ->})^V${&Ay+QeRpso zi2ncZ31^9B?|o{xvN|1vClul>OV-m^$F%;4KiVixkpqD*ER;^p9a*1y^`%g6G3?qW^HDLtr45ht34~bFCLXvB`W&V1Tx-R|kbv=CV^r zrV@mkW3MPeywA-5C-LcG(M}oSxg!R#>%zU$E}(;ky{`u=^Rc-IlVeN(u_usI%y$ z>6BjnyRrWo>mQ%t*EHl$gs-uxKK8oR9ZRuR7ydE$rvv^dhKT&{Tx>Jt_5{&%?8DSy zS~h*;O?Iq9(1#P?i1=|$hKP}Vm^X$iHjU!?f*^!Mg zBZq+Uto^U(e$rZHk(${M?;KjQyrZ4(xFrF0v(GC*9D_Q5*%q3YpLdcaolt^O@^Lo_rx+R-ginDGUjzw!snoTVf2`75~(do!l9 zlMv7}YX5*jRy#-nw-r1iaz7SEr#nOYZ6J|IC5+2A5DP)A_YpV(Qp3#FysrS>x3vI~ z6&}%mvzrDA4~vZ596HqAn0pa^hYp?<97>;4LB)2hy7C;vueQy?2Ffxti{B9GE}a=W zHx_RVt=dfccBuWd%;@o`Z&$T8?0{yYS!Lf4{#fujyqr+uRmQ?g;GBdShZ+mdhC$Kq z2k2z-x@8fu0Rec3{elxAKSMDxF&<8=kkYtD`E-hr!O==rfB;&-+zO*Qo_0j5ZV{8Z4>c4JeG@*q<0qxj=ykaoLs9%9~oRhA5ZZ1 zQM|!;wlyLA7iz39YI{icl%Bx;$^Hz|GaW%sy+gO_3DtV^O{qC^_D!M289~Y1 z=MaDC*(jwc^QbCj)Y6r6NOS@UETt3h#!UQK(FcF5n{>><0ps%UN&#|b@bq|66c7Nw zrU@wqqmW*I4mHj)YE5a-BNI!@SyYK@JArt*vG4}b;@-x>^>`V=w#G5GURF=9NJC2V z@cYUMm3q=X&iCTZ$24jp?Q8im$~DIM8*zD+po979gLrh!YC5GCh8lYtwaZvU8w0Ia zXW$VyH2FP`6fz8=`sgUuHE7C4sacczzf5dW+n-a7g;DfB)OdBZAhPU@T43(sQrT!w{3POZ1ct-7l7EnWyK|d z`ufnzV7vFxcJEUmWlUPQ&qGBmtc3$)l9P9qn&eb55K&FI2wL3D&q!v?Zp>Zqvz|X4 zW6qr)k<73E3KHZ=Icy(sgA>^p;E>YK8BmT5Ir>XjueJ`IB}m5) z@o1Xr&7CWgoWLLK`@?#)Ft6WkV_+;Uu7JBZl=-);o%`rpd1Q0o25bb%9UA?O7)_;y z))idD#E6C|Ul&X^Z8aP}*$i*=XyQ;2;nRWv8$SrxFM5c#>b zy04b@=EK}&o$#@=7yi6)8vd*}1%IqFr;4JWP;j zpTO@w`^He?8G!`jHQ2!<`Z?s??)$QicrM}gH>kNQ81uFMfekxI)qkqrScLhG5T_yh z1I>}muIL{``_2qZvjG9sv#>_bt>fzC#Hq^ntoy5ZoncnZPN{|)9`<2EJ$yFqSHfqTKn{Nedc;n~XHnn;{2dkOXwQF+lm*>e zY3O{HQHt3jxrF?!n5bxlf|n(}RC;9_|J}2I65=D+Xa-~$cvOZQ+npz&OF(P0ZSAW* zO*FmMsq5_dXHR^qS96d(f3c@JyFhHu{G(9&_i*P&a_=)T8X%C>Fu7eC{L{@mihJQ? zc=2*Bg44*;XJJ$Gb*J0+s>pQ1y2pkt6O7o?9{BG4A`W~j^e}IzL4Kn^9}&&M)$;8PD%)f)Fx}7I!YgIwiin6!(iTzBARHzf48|IB=zjJu(H@8JU1XDd6Ue~2Ew7^ii2elODW~FV z2DD$}AUR}e8bvG1a1S8DxuLJ*7xrSe`J|`@A*U@y=q-8F5Si_lX^ zF|mc|4>;))Aw9)7G*Q=syDY~%E62ocpin`e)G@IxyQ~il zuRn|-mFEP9Z3m^-TYtnYWpWGU47qU+hcKZ3UACLy!RvwU7pv6z#!h@%<69@e_>WID z!#H|tqOb#xR7V>{N_c*(HKluf@?uJAaP)L4c5Q>a?Qtg^up0%eM9kzpWJETXW3McH zE2vA!#zx*<*SaVRWxLyDJ!0v675(sQ+4SKUPF5PPJ2G=P1qLL49xlD(4Js1E5Hlpf z474b?sOQSQ)<0?M%wOW++vjUh$IK^SWJ4c|(MeA@Kt{sWrCT2`9uiLg z5o;gv2dlR3`;*=E7hKr0iFvKlGy$d5S(2p@&>@4EU`3*)6Vf*bK%vsQ7PP^@L5im*Xj? zehGZregio9L&os#ui_lZ&#pxVr?ov~YU6-y*?u35e$sx=xc;f8<7Mr>Kia)`JH8jk zSpSNjSikE}tpDEQKMnu;eq#MAQq?~ie~$M480r5WPBGBg@x}gc{JSqz{iES`wD*Gl znO^yWeZn9BX|G+0FWL^Rw$46m+bCs`T00mmkC({!Uq@^Ir@#06l8)u+atC8+|3tTa zzt3vVShdI0JoE>s$!kPIgSO^xJPUvz7yK-xe!Tqsg(puu^4Hy|nneDDerI{;pH2Na9wKi2(uD(-SeLm!g(Ite zZ&PGh97p1RB-4)sKzBHRQsL*7j}-JB>;O56e59!V{X=$d;_K5t!I~DuvRu4yOfJv( zZ@aW*i1pGlI-32H{vX{x2s+Itj4wxnFHV1YQq>nm9Ao?cdC=~DLi@*9|COIuKiFdZ zGaUJ3lAWpW_Q4L=_#%9ab|xQI8P-1Q)#!Gr18+sVJSP4+I(>hd|NH;L|EctA**{1n zp9$u_>-{O@yP8>>a6mc@gL_(%flAmYA2IB34tL<&wa8~z2tn0aPhFX-CHPEfWn4q2@)kYi0N+mc0g z-(N~pFW5(#&Z3k)z|r0de&>7elleXdSj>oI4VNXFXU7{Nai4ae1>uN8I`(yU#jn8irPG4KZ6I2c)ypgbvC-?zM^VoCmy`-`n@w z07W&w$NHXUet%58X<~$zok^JQ4|UpI=h9uh2g(NbrySdDf+fgScJB z1l*7F7x&oxNHtQp;IxH{}5mQ z=7jnOe`ohFRef*&^5`G2f55-R{?Tps5YxKHX{N>g`K%2*@!}EOE1im|@bmVszzQeS z@BTm4FSCjh>hGv;fj*+YGC!(IhY6L*h}YIA%|g_0s`jFEfbz-bRe)0JqpB^hiJy4S zP-77KN7!RAy^9M7Lb=_^SYl=T7Wr5CfkV3~|A?<|2o@2n9be=1@qn$(-bE_d=0-?0 zD-ve~$c@sH09dP^bL``T3pD|ww>1ki3VvSu4$(?B{}^Y(h$Y(hqm8e}Fn)UCbGX%9 z1?X^)vxw_=5}!N3;{(a#bITUk(vj3Y&}^n;uFW4ezO4E4GXz-k(x$3Fv*YPGgO6(i zkstqAhtBy9Dhcsr@BBsr*J^&lT`Wq^FlDs%aaG)-cK?dl9cyWRb4>jk;Td0~ecBJ$ zhnDPzGp+aHbcuu0pS7%W|K8*3d?1&=rJ*^yx64|P%BPG8%L92x1bf10?31w13`R1) z_+0Im@N?ILCFQw-hf^Gp%!RG7V2UV)?3VC5yCnc=6p}hwcTeQzbzKX(kCcO=mw^nk z?gTD~Lq})f=yS%2D9!Wdn*mDFo`#QDXWYcfDho3 zSPQpJ>wx8A(unbS2zZ9|-q#14tgIN0!eVr<;?e~c(XhD~OJ2Z1r6p_ri z;}!ABI0BWkPJx<@T$yEUR7F;|S4ApVWD@$&As*$a{{hO_5+*b*b2r1BLBu0CrC|N> zQZNjeIwxcI&J8de(KZ~OWvslYPRnL}^f0V-61!(VqJ1&ucE!FEErXLp^stq)W)tM4 zt`bI-`NSkKMHObaIKYe3SUKEHS`pf10P#DJ2)HSC4-O{$?IZLF2cm21QMH&Z7`7;v zBda9p1#svGSoP=K!na-0TYRcR2+1VUZ_1V$$T{Oa(PdtdGDt>&W@P;n=>AavkMLQ?>z35+CWS0YI!$Fp1kA=jWo$Bl z&c0881}7$?RSXO5=Y0I3DltMzAgx7z-Ms)WoyIY1H2P3vpIop}fxQ5k#cIh(^$kDV z)@ALDB!k;gxaZD2Si?mA2NWng7>rSDgr{aP{n(2D5{I^XGNhfuMOw(PNC1e!Mf~j8 zQWDa1yB1oNr2#*HQ?V;{F;8-0y$%Y1a`}J?9Uw-M=ZGhi$ zzg}U#{BFNQoqm|7)hYTGwtd>FBcDoZ8r$J~O~Yqxp!(0&@~(g`=^$7-q-Zl1P`6_t z(YvPa1;G3~y!TI;=r@NsCVD;P4(52fd_I!i%IEUjJ^bV-p)XZ9i0o?2Rk;S+ zMa6#Ny{w->leh92jySKRoT5j0BkM-k`61^thW_}`O~$Q10_*`S&8Q3VO z^b?QPb-5+mn70k^@Z+u?x3o9ry#_$e`{^f-^93&eiza$%HuG29s zJ7Cm&ge}O}q~j~8%RGBXkF?UdPDo)Ay#d7my0P1ze1S{sHfo+zc% z^8%&+0kAu;3Dv9{53m`_&m~wN!G4R)oB&X%v8wq8N=3KeA)5H1=$R9yO#^-KebkJ% zGXvxGL!tp?@{lDXhu1yucyb5j?F2Ea6XWIm<*c0yYoM$8Q&B z^58O9VVvt7xFNa_yYKY=TGan;(!QR?yhgATKYD)jMEBsY0I283ZvRh1c^B3Y9uUwV>6ZQDmo~EypHzYJxoR8sW#H-} zIUhf81NKkPKsf;UTkjJ`81o*%@QxpwCJ#E@m`A6P@L#(BkyC@XYC41RBGf#LE%k2S zMV|!ET{sb-={QdC6!TDt(f|{C>dQ!twuU=w zu%ka&s73q)+uC2UOeEux_ig^*w+nMR{LsvD(8d}gd)r0cm7GVf!d6v)sXw<-A zGLswTpV%*e6DH1!+P&Cn3iwZcpyBVpZx?G64k&l(yQr33FxeK?yu6#Uqy2Hnp2ReM5ljllc z?Hm?~WMqPLqMwwvnx)wA8@(29&{}uvPh*XF8zDOK9#6izr~7DWzv^90@BS#7to;CX z+G;s^H{WUhQ9K2h;a`j`5&3LDH{#`UFiN=a=u%HdcC%{AugK>gumf4^=deMJem;$- zluyC9_ICV2#|CR1s`=_T_8=`f7SB6LL6#@u@W5kHO;*54QyYxhsa_uAg7en(rT z+T*teCwGjVlj|V!&Hx9QT0BMbSJ>ivxs*c{YuAS&_6hnsyaUi%sJ`o-x>3c!+gl`Z|3#6w91%=Qxinu^-DV68XOG-hDrmf z{f|!ZcBQ$0@b?_xtlXYqLQ=77V^E9yttqXX8vHpxK5on3bd+~V7H)@YSs6W{CeJZ)+bQfJnwBAZz)ExW$R|JB%7sp<2`nT}q4#ix;s zzi!c5*$=;6C_`Y1rfmj6UX!C0jwFh53DmhgS^gK0?5-CpLjaH4aI7!*rp%QjYF4 z5?pLQ`D-^-nFCvakTU!NUk}wCIJrMKMxs7C0*`^}BD5m9u%mk-mG%;WMR8z(SVG&& zNy^_yA&|1RP9-;agySfj*-RdH#OWp=Oe!bVRFM7P5p)BKT6E4|e z%zF+Vo})g>zZpLG;T6WbkxDdXPdfCRQS%4%)M@|9e;Ti-@g4Fl(o$o1+jecwkMN}Q zI2h>f3_WQm4GKszwOddG-MIBFvKR6t@LrU9w$4ajo`WnY`@bi#KhL%i5Fh>%!!+_U zW4<~mvA&+*+(f0A-~zB)P=tYIW;y=VFcuxqLQ(9SX)tfU*evibA&4ORKmfhN0P~L^-;x`^=PBonG`#Jc1 zjHdu2@>P2Vi$pRq&{dbe>iD)zeX*WK&6kiwka7xgPFah;O=R*~ye0nu`0EQ#`^cDg zvXalH_jVv4@)T)n`$vzx_u&qOKe!_Fy&tiVWcbg5Ewu5^bMSAA(snbom$OJDqc#rz zbMerH*POnWK*KcLUM_uq3kv{Hzp|;CgHkRO$BK;xE3H=~OIT7X269C*OE;iUy%e&^ zSP9P_SB=73$VXtdzY@LD-ZlG;d5omG^Yg|rCwwXPxnh&1&sw-gE+(o!V(6~|)pbWY zpWzVbBoqgM1a>X2YC*5Q2dy3Z+=Z-k#yqEIlR-plr{sT2-ZRhq<`$&3vHsRVSyJIQ z1o&GiWK#k28z?)@6L>~Fl>866D)M2e{BxeSvD?s>y@UULAaIGYe}5Ww)?sx<8U5;S z+t+;1(Cw3}1An1XspNj-W7R<@4p2(2NP#)S&jxtR!X za%m@{|K2uf*6BI?xh3`-&emBIB-^Ej0MTC|%E~mSy^-d0SDVthtMhRU)waNpVkEQ0 zeHOtloclZ@8M{y8almcXyZd?uKv;^STgT-}${H)mTur3rmjf)ug{F(mj zrazD8XC3_^<>HnhhCGmW@4Y6e%U)JVj6-YT|IJs~{g6>baaH2Ux@nw^iu{!e{Gb+H zKE^f3s**aKz?$VN#cI!A<;+xF*V{$KdyK;7#?tVb(%#!~dv%*j>uzb~D=mC0fSdM4 z=BDHRj&FjWv%jASc{7Hg60+M{U+#6hIIo_a&7PLyh1s_LAHh_oX>pO15mcjhxboq~uj@H7{~yz`ZvBoSjL zXnyGS`=H&@@M>IRqzF4P9b)uRU{Gn~LWt3qN{l$yfLM+K7^{9SX}VmpjDwb>1Mz9?pXQ?`y<&OleJo)<+BS;>RfJL#Ka#9|NOOzWVm*gXj};`l~g_S@|F)T7A%$WiQB_HAl9 zLI0y2$a1Q4G)>EQ8%7{Oj~^LX!{_(>MAu%D6W#H25&6ef4VeW$-V$M^NNo?bkd7%S zVfv9UB#YO~k0M$2e53SJi*@W_MV3VgWFbk4ND`qB6x~afk2G1H6j+Ky)OoL}L^&1+ zO<+G;X{vlHc}_gipf&o8Q*5Odjn0EcZ*G7_hrR^WywVZ97Z4Iq1^SK87F_kbh9Z-;=yGTuh>lM{O=#nBmaG>3oJ zLvgr!0%)%&dhO>xNrIQml0B^{J({sdPb) zuB895Q_({sJ?tdqZ%zC zBbP5Hgw$NN-Ky7s;W2Z$Q4RldQHNY!5RLB@UprjB$l>xZd_$jvzV9>ghW@>+KiA@u z=iEb*x2vW8#p@}rfT>1vxa9iIvzvDlTQTT8ZV3FT6q}t&>Q0){i{0!q3R@ncAEBP| zHZFtDgrtE`tHB^L?7MaNQ{adE6*6B);l5VI(ODvdspZki zY|j=?(6+S?oixY`X*nE3Sr zCP_T*(~~)tyHA8;`M?*Xv2p^Du)A*LAk6Z$Z>VjC^^XscBMNLJcw!W1ZyK zD^lIz80NG|*5h+1_;qeWTJRr6Sg@IYu`_U1QvYHmxN5bNJ~>XgWGxYwLT;TWk`)X! z)^3IU9`8mbZI11=+BQR?n;;Q43o{ts=Tz)WTQENH%%7%o>469x)^9#{Wdi|_*u84f zF(0j~@t@&7Q0U(6B(O~(r3R?)l~{i#M`D{#950vpUb}leASV&yr1PV%vOu=YpT(p4 zf0-Z61R#n32(08{8|_F-Lz@Ho+q1^E8O8%=*76hd2z`)94+eu5NuEAzEgc+ZHR%vu zCKbFRpC=-u>K!d8^sEjFod`n1VkZj<9S`)91clCw3kqc`Ut%+fI^$DCR6c`)5*;aH z*GR;J==CS)E3LVVT#3H^4VtWH3bYhtebX@o%al&iK1^l!5p=x`pCr>6?~|@xG9~&Z zSf0177shvb&fN*4nS0;_B%je9T~1e$EtN-?FhAO?#{1n+6MD|$K8ZI&eC_yinr5vO z&DfjA8UB;_;Z^UkKk<4)rNJTFUvR@^-SI?9g4kWf+KN20!fYg4RV#VQhmeE0dJJSA+Uo4_WhJ3ux7=`FWV=bkogm+X6HkJ;b73 zf>-zVX_0iW6*Gpmr#V3OOq9OFUwLi93(vjN&e$iVz;|sl7;&~h6hxoiv zfBu4>AY0Ekyxr(hJuCt4mrF9xL^rdiUJDvG(6HjM4m2;IHz@|1rx1`k>OhmD2AZ1y z#yVk#Qc6DizYjD&`V@WFY){Sq=o(x5Fn%vlLrwH}1`t8tw)o^kboD!lRBEnk-Z`+! zxOkM{g*_3yA5v-uFWyro8&+KfFUswOx1ytBAm>K3h2c0ikWob2R-|5dE0ETYah$V= zUL>Q9ShY>oEg!_wm9L#~?jq$IV4P!wD9N08IOoiqGD~cGj{+TrCE=90QvztdcBafc zG%O*D=(U<**DxFihFzgQOZDd{enK%?y-fx-A6V`A)8E^nS+$IjFn{6=H^({}-U2Ar z&)-*~OWT)fG@SC*|2BWx-&P6o;rHSR?zOMCibhjD!)iswCB7qjwV>i`3?NXnXg8- ze~Ma=wW$95oS)&n?BBxz&`YRi@iNJXm2~+&lA(sHt}XN~cApxq77&A*RLfRwvt|c3 zZ&vu@8Na>!xg2!mK>6^t)O3w&`I}D^4Zh;1j&sQQAZPv8uSNsz0$ncTtn@?XOp!Ug zS~T1#5-S1$5udthBf;5fI=w7T=nzc`{TW<4R|4)88Wxk{Dz^WzmNBp0-^)c`K{2$a_#8-B1 zN!=+=%iph0)p9;sretL@@QKe134kujoy@Vh4w*7MWCuTn(hqu?&>}T*NXWXQ3(v_e zmmg`tHE|W{qkmu^5MW=>pHK7C9;1|EW<3dzmkWZ;71KM$(rZz1W_8pF^37=Ti*~fx zD{1?iy3;j*FvhM>6DD=2Y7^yY*E%4Pj1MS@AR9Ik?qc)}`?^?qiCbE8Ydzj3a4U{c zUJ>~f5Fw)mZ9XPOjd2@G5Rr2sm!#xGG|riDZz<{Z;}WSSw@iBcgHG&}P5adTL3!){ zVIG`DF^Od4q7LW5CGW)dlCM+v2j~m@ulo^KWUm(R(-S_$FfC`a#-!Wx-xzL~*lV4! zmgPJ$86Aq6N$hR%^}8R_l-Yao?RY%B!>Y4>cdRU)2cTr}r7ZzUZ`>M(Cc1kQb;CjZc`H9bh<;Mi zCY&2@xBa>a)VEaIQ@&Z9*vx+sc1v(;9G?dC=SB?gu=(SW?zn&DpQNJe(>$nrn%^bJ z3+Y3%;Kaw{=mS8MnVtemE2#@p=tKUu=V&DB8%D&a_Oio?cIe0P?vZ(#LX5pADX1ixn-K%_7zKoSlhFVqD1OqckrFMqy2`LzO@ zOmFw=qdg%XHnEd@3jN2#_dR$v=U3z=w=xk#V?mtGll?{^PH~#X6Q{#|4+WmExCE!;O zhYuui40K(n5*aVpfLIC}P;4Bf5xFuJHKf4hp^M@O7K!5!`D4tz3(}u}!=#irv{yJ> ztYw(TEoTykX;~C3C`jSO*+HoIrO=HDIo5|)2+E+FLK#F@Af z@c*G1{zmPN1dT?{5tojmfRxBDZo{kj8%rvM)SYp*SJksyMr}k&sID2cv*j06|I!@m z@Hpw-Z5jY?1yLHE7o6az{rjp=v0X^1y|xbp!GVt2Kd%Y`G>By^9&6H+=NDXV29Xl4 zxD1+EmYUHoj*KJP=NK;}|JMJ=-@XcmW99Fm%l{Aj&4@>}W&Tc0GJYJ@eq0Z62G^`3VslH z8UMVtgII~}u(8q#_Ip%G%E*QyFXf_@9;{pwC-_ZC!0)OA`#;8uFGe6qHN08zr>DXg z6iOWb0~w63bI69e!U@=0mIBf2ctp9$+(D43bPJCQcEz}hFJpYc<8b?WRsmd+MJrbW zeoMLA2;`^M|HVH)C?NCSIBfgQ;;C#D43r$EGj2;wu>AQ(W;dMezG+_F?HI$?2lxZ|C`5;w1O4 zj$Qvs(H88(|Du0AQlMuQ#bMTx{#}`%e;35*n@?px+ibm9D#+p7ws;C-p@{Uw>6dc! z17F9`=}O_|{C#*Fq2?+cl0U{=o=1$w!Ke+(D2^Ozh46r9dol8QfL2e1)GwOre{eL_ zp6YKMC=tvHZLyt_i1^&uxAANadEy#C3O8#H~!u1hZl`EFdNi6oTnc`i5|97o z{~zH$V~mi#W&FphLjM!~*A0!Me~b9P(2V}b(dUsbqm~}FmkZ7)W4$(7IxsN_1Iio$ zyH6Fmz%B#^z{^B@029%?Abwqv4`$_Cx2keZMZ$Rpgk{z1Mr-ce}JB;xkX;^BKR*5xoP=9@ESW@ z3a1qWaqM%1AByEC2_~3OEYtdx0^yJVL{ubb!E>Hk7)OG3E(uislg^JghgSM^wKM)) zW{*EXAXA3>kDz}!K-fFK1gc{YW}t5f{aa=V`H^Ox&zW$TlZdpd(@7X{%)zej~s!9Jeef+($T5u!-HZwjE_zg4Z_NA~B)5NZM)9oIyTnHU!UQtQLL%URk#y(*-hT9%ntt6da*7xZlsL%RCQBW6ZkY z1^B?7nLE{Ui&w#?qUDO z{LJfB^3Pv^-onT^yJfW>hpShjTQ`n0-d~>k48E-$nLB_v4>97%Uq2{yHJOAZGa1d1 zDj8;AzMR}MBl;nJ+m+LqOqmIb6SF1~Pce*Tyx8Y%fjJUg#^VB&VmNq?YEp3EdN^U4 zb*-8l7KkRK#F1NApye46nolQNI>SzD2r zuQ=SgIDEM;w!>Oec>s@zio#5ABzg{Ju1seSisKKr^4RQA_U~q`U)dPWp$8*#v#d6E z9zcN3kNx8-1LuPeffIpH;d+G9BN@+xn0&e<7wVWE8h+(GAkM2Wk>B<#!Les?_(FiW z5(A#x$*V4*{re{eo9eCI`G=ak^E;(Ki~wpJz!aP)vew{9tfv{~?HSS%77D`521}AZ z_Mk$*Z-(y3X%$55Z*2CBbB4^E8N6N#{776;5nj*nV}@`7UE&+)UdC^~2fs4Dbq4780Zw3qPRXKZmbMZbMZ$IDd|rU!9pO+dh1MAxTZ-FJsN)zVX&P z6*U$952JcLY38#gpJkJp2WpjyD)|}H%As!+?In_;)7sn((5}%macMwKx>5V6bf_u^ z4fxZHx!=*+2_^ING>Dg=ASJaQSlxFW=z#B&2`1gT?ME)p&KJPct@L`M_715(HoJOA zU!(RG{tyN$i@M(0DX&Q^fH6rn7+P3i!3+Aa6UocSaJ-^#6npt~b+O z(~TBmeS;v=SsUx}6U10sn|EkaeL9e{P4!N+`05_Cc#oXz)wFd53%#Ov+>3Phu3)tV zL~9PgMKY$d@)c59hCdNUBw%B$r#5+OZSI7UV^GVw2+Ccr(5JzwKJP=TP=cq4E!;HKCbCra1*#^%zYDO&ANPJ@vv^t zKYw*oPGBqkwh#PM3XPCL53>-+KN)XMn|1>J_BLw%iB9o%ut#k8$jHUpDZfS4jp@eR zzpFPh1E-pOx2aJ({HgiFr)ERb1!nIL%t)8>dF~iFbD|9*LZfl^pc<7hW^FPS@Zg5A zxMWbezW~|n+p$C#*Oy?C-Hcq>$_(RXJEp`h{KUBHE2;CLF^|^Dtjjk0;sVVEl!2@& zAIj{##Z2E38ve^_u&$m1Us<+w4%Sm3i5w$PG#g@G!6CwFB;C_U<#e;~!)cQ>a50jJ zurml-gZ>cfCCx#v^XCA;w9xPmXR|2AE;HL&sEWc~W%H$UFbriEY^;G;6SeyD&*}Vg z3YSQc2m4zH%>g+r3p0R`G)uGq7h2R^$@@=mS@_N5R5>P)#^R3M&Fgn?0@&YL1s7&1 zQhtM$>&);cqA>qi-7d|F-k@{^c7TpeArTDPy3*fJy7J`vT35LK;^>MMp<0IznuR-z z$VtK{$h@(5aHr6b*|Xc4kvr03y)kvSz6!ItI6Yu{c&!O>fRO?I@Y8U$!C>ylFd=_) zjx+(qX+1_7i`SM!G9zoU(=Ij^xA7GnSXohI+_y4zj#-zna8>s-EP2;o{G$h`fP(9W zlVSjcx?@qdNToQMJPJYFwzz7eJ~mFZFuQZ;NdC?YVO5*V{w;m)rYE$&|LgrQZ~rmV=>6y zbRGa!0ww~8D-^;$ur^;yTAo#YOLIx9YiK9qn>FM5IBDB7(<^N&Ix1;9_gyV*5x+;; zFgC!y{^oE~c$FMuwhZ>M1OIS+RN2qN(5ZT5FgKrO8_ZpYY=f!nS z)5%)$z!9JrI^1^VZFO13tCQOx(NB)qexJGGjO&6o-!c*P3f~W6QIHOBX!Rj}!C2>l zY0F7rC7@8H@;N2M>=P4F=nrOvZI5YI=$#>YzYFQuVwP3Un_=iGvzJ-X20A&O`QaYh z$+72$k4PpgIyx)Scg)Y0=RR(Kk@?^{>>9xXHD@$U{PgoDzi>YxM#yuP11Rr0DK{el zcpCUt!Ebr|Hpz^~5Z>tIKvCi`=!v(FUV$~_a0fk3j zr(HpwxBzB4Nbs=|jRTv&6la44cR9}I+6HWdG4DEHM`Gl#2JH7H8E$PsF?(+`(>I$D z9D8Yc9|jO%V+E38gSIulP&Ef_pMthEsiI7Eh90m3;m*WVPF#!oXXH~=PPKC-!5r}OaeI=>GICg~+T zAEuW?A93w(<9$SE7kgU9gTarpFqq7VzsQ;h19~Vg&^f-4Tb!IJw)0YlBCvh%K|;}m zow@iDcssbi>FNVb)^k|twEoOLPvDO-EJ`~nPl?lxFW`#974zJ0Rf8^zkx97Us*cI^ zc@qt?d0d9eizeih)LjR5Adld>wvfrR;t+hO+F_hsp?^#8q$G@6S>$t(=vaw!dCDTW ztg1u@RU{@NiY594uJ#8MCJdQe5&;wVt%~1FJO3{sQ%y=hQ4)}lg(eP#aRmT7JSldX z*>@kQUtuv%?Ht@1MHRBH@4_8K zj8DwOIv~pxt~cggCORnLK+FvYeX>mWxDz|PUZfUl7LwUVr1YY6CPWQ!??N<-bpdIz zw?$OsMcPXEzNC6M!iRa%W?-W3i!`OOX?g@&XVH5ba0M}+2P-PvXn zwD)W!|DhujjRn;Lr|X~BFiv^WgYxmRvVQ9*#PIX>1v#)`X1iRpIF@67E2+B}{J+F! zZNVZ+sq#Tf!xv_m>n`%Ksu@1n4F4RnhICpjPIo8)_{o>>+Vo9e2qbpkBn;*Qvp0V8 ztE`(6aF@vxqa%@w(O*Er-ju_&GV8@=p(1X{- z;hs{WI6TFNa8VXK=WO`M7#g_n#F<5SGA8<6U!F^i?ZlZDLCF+TV)PwC!#@pZ$7Qt7 zdKn8cfLR>oR=o)T<8+h#T*5z|o;oiRXfSZ4RabtXN$Kkxd_(>gEJIoc@TVla(z=b0 z+z}1(XZ8G9oZ6NswRI*@%0K93t8Qp_l|6A6>egW=!1OF+;epPM&ZGXyF~oK0)LV(a zg^oaX-=S#2E0}rQjdKcm_x2l$)?(Ec(OsEs(>>+vhuS!aIs*lR+=_hpYYqgDL)G-) zfa-$Y!G2)i%~Qd^Has@$n#kYQv;&!GBL7tDON(+ppPE0?k?F&lJtT&0+vd=&bTfUA z8qC@bJfM)l@Jr3k^WPoFJ<+-jINw;0Vd6Zr`JW)#td}#llp>kY=S-nQ%Z%QS8U0pS zm4Mi(8GY>JdenQJ^~zb##r2br;ED-d?uqq?|F;L$-_-chVk60!d{&zqK(*ei7RlU- zSLj-3_=}ZJd--VZI^ABrw1nhpnD5```q>JP`1V!{U$JWvU^!xZv(eJ);khcVbID7rt?d&ynNomz7AU65T94QZ= zlS^f72J^srRT1%IG{j!GdZ;_H zhw^RpydqAetW7<<`cxlXmY`6MW~nbqzXk!g_P-%q7?>!wxa5-GAd$>&bsS7xXiXkx z<$J|x+fNN!+{G6w%1v3s}GC;o!gAOQ#s?elf;u6g{Bs0nG#{WaxmB2?; zUHt$V2uPTqghmmK8X#!Z1dRkS8kA)s6Nwfziq^Ok)7I9A6N;jeI07xl0FIn2)Qs?7e_ zSc&hgoyYIPy<}Cw-fearU;v<)79;)S`&#C{@ZDQ;AR7GSd|Ye)>u!XC@|;o(1=R;X zj=>KVVr|eqnXLh42r_gyW?&#i7ecxrHDX`*7*BG1VH{E=(|wt3o3(p9uim#hc+u3# z8_{>f>3at;UAyiElvyGjg>HiTdR3;wa$I?J<$$VLJ##Blgc~pb7_&E^_;z0pw@RGU z{sW;jHO#p8qx~>;3}k(4n*oIxvv%F?mMI;W4j_^h2-IHJ>cGeP&A?B_4~{e2VA3AP zKp^qJ?O}X|QRC%KqmJ(y^Pgw|dd69aV;}Rgcupo7Ga_5M&Tsn0thx~gH;1;y)fC3_ z7oOkL-E-wX`qD;5a_n`NBI8=yT*=edIZ_y1xDr~P31B4UDuziZ4NQv=j*JXbg9@oMx1<;?oRwiu!ix!O z?tY&hPrT^O=KSg(*#GXVAK3p|yqK{6PX{IJ|A(*7`XnRqS{-{~`2Ry{KrG=u8MITqIa<#)emTa$#DZqE_8Bz-fUDa3R8arZ%r`(P>` z-0eR2?B~uG=i-6*hnQcM_JRes{hGWd?pQ_?5q(7t`N+g+90-N}Swp!?uT_rVxGXnn^S(pl~UoX9Bp)864e%yl1*=2tJe z4>H^b`F!x8J_r^(Uv5S;70eILOMT!X06tHqJ#Y(>q~SvP0^A4q^|NtIbaca)ZNY*X ze#)I1QfKp<^YD%9(s;`GdXSTc(=q>h;J&uVNl;fE1jk&eet0^LzUb)6V?0Sss8m5Z z!JhqC93BgB56>szx&8h>9jxTzGLF#e+y{rd55{re%iRaP-3Mpz!CmfyPmXq)nt%sl zzujlAyU!-_qs!a}E8GV@J}7b@{Ez#fh!1ky2XoyAXY#?%+y}pNAC%w$```bzGt9Hy zXJ_-H_uU8i?t@?O!8-TB;qC)r^yTh@-tGf3x_y^E2o^jtJ&wo05uVx$LETwLcVhA1 z;l7gC-kt^m=XFJ3rSHOc`a)`RsGtjF4gz-2TeBHZNa5WnX+w^yya?Xl{Yjd?#`<|2 z$%@Ca>RlFdhcAIfJwL-)ABefAhwL&pHZfEB%2qRlv}q&bj>m)4E}|6lfsMtzhMxG2{w zl&B9bA`;hD!3`JFn^+@$4EmN+g7@36Z9pPafU(bj$i{{0BnV=d8?rL(zTS8xFS?D8 zWJb6XLq{oQ{%xbyFTLgvxq80~YTE?|=gbhJDBgecPg_@IRN?~Q4^_t(=CtkLY9m41T2 zEO|8K{3Hp?tZ9|BDjAujS~h_6Fu>I8A786*lB+~V4+82Vy7TEA6mr+;ooK>-6W%A& z$%}ZgHm3*hf$=E@kxFa8Z7eDu$8szgu1rWW>*tQx@|1+Zz}C=b;9=Y2SE8(f{JW%B z=f6v1c#3_4KH#}HzN4@QF`UgzN{;gPj{b?ch2SG$gZCm^yLK-nf4fNeXCvYwG4j>B zc49c<=>xx-L&SnG{NAef!KlQs6l2v0!R)~K;#7KTz9k*tXa5fiND4LBs6fkb5Ftd@ zrZAyj^QsWb%w8aZE%b#U)q1iBlmRogB@?^@^YQ}9fXQtuD4E&QeGlRb}q)VTr6>k%~X{_+e z#or3Pcnx4ktKf^*Am`^P-wW}-yd}nd!Gf>KXpcu@qBGlGmqm)`;EF;g=$t#;Y*S5# z@5^DwSHX@u4CS+wg8&YI8;HKs2-`q*o;HL1BG(9~wNPj54OfRsvYEvdc?qA17cNZm zwXNb|cbI~`7Ad!8J!Z(tdwMqx75ZX347u}u=*)~@!D#|Cs4^qP9t5Dpg8+q)6p<}C zjBJH2#4Pzi^6o(FG_bYR{?}3N%SEB_TU&Xui~#x$>wy^g z$hC^OdfY?(%`*BIHAXf){a*%d`{0dWLBl09hETs+lM+p{r=VZwQnF&AKbRWxOkIbT zH>}}z=>fXf-`vL$vMzA%)sXx%|HFAq2T6Db zCkXULZed*%ATu3>Pu9pMFW{3?N?}Lvwn$#6XRu)2FUe_x_^QH>X&IRjXGtSYp{icJ z6NANs`1?;n!(e@S3fzOiT_&m2KUj}XjDIh4CeVqTepHQ)K)(jD-$3aYTRo)N|2l$w zBALzjPiR1~$ejVw`CkHYt<;y$prrS9Tx>iVWG$nqwuLXr$v!x@U}j81V%OU+W^(I75Ihn#~_Rb!YJs)&5%763yPHORHj*)jJ>V^>}y zWx$0L`Z_!}LZ9mh{WY%8i?Z3zy1hNCC^DGU0{wYdE4&bB8l^wa3WK&GNb%Z+{+;Fd z&*cz{(wC`fSbbtahnW7lP%;b6m{=L4r;LM4&@(b6)k(>m9;al^*##wIN!biv77g>y zX#|#HkYYc6xKSDi$Q=zsm_)ra%8O7heyEqa*qfqWKvfpVbxT!FE9Be9dA^UdesEfT zWVlOT`cKQ${#}3x0b~C*3f&yX=h>`Qxt^c3TmCN1viUb$FSo-vv>k;V&DAC>QVQ)x z`bv$~n<$Op2!NQ2IA}lYCm5tk8q}G4p$;eZ%R!=U4HYO0KI+~|sXc`0&{}hv8g^z+ z{u8v3m6}`&Uj!UXwxRkJPR2XrNPC37v$ICuX*Tb)@NanN5obv>di^=jOjhbcGmx6= z%O|k1Y;D{M;4!I~r)!A+y#xL?RQOK55)Mg!J=R615CxbLNFRGMJ2BJSR{F!^={Gy& z?L(g|mc9l^Uur;|v-9kG|H+owO7MkdtX(Rc^N{zJThI*#t@<1SaOFt0_p<%wJu>W9 zt93~Aga*T2Bv1`KOS^gCYz|2$%iV5HmTra~gI73p6XZJ>kFvnC$`X)2@`C*-->qJ~ z5x>E(Ynuys^8!d{eIo7^`5n?LG0R3S6R(Z>XXa@}_vHB6>I8xCuVf%ovoe9gMVO)C zj9RwOLN-nK%@^8WA3>*FQ+yO1`>~#;r|92eQ3P5ng>vg6yQujs@7y;W(FpDW?@I< zzc$~Okmj&z&e*Hvh?nr)X+VuVUf(S+@0O`pFI}>bhD*nF-)_dSh60V#LQXzr1eTQm( zu!Ah}k?C(PyMc=(78xRp5})pLKB-?vsKa%{Ep#1fj_;8h^@?+hw(9yGM^`3euKPxI zM2D>5X}AteO*H;aS@&(qAF#-`NlW3o<$KJX1`Begk_sty1Tz$zY6XY+q~rlhlD-xm z6mekNVvsSrI0}^_sEF=|3IDYygKhKm*zX(j+6^B?u0!;$`hVIGNBh}1-#Lhm&EL`f zE?4_IDHeaWaBRTyR{6Ws7!SwZ`Ybq#K=Wz%e-80I2l(EEf_<^KK>3y1iSi#FA(s7+ z2$4h(c)|`ma*$N+9!!QF24ua~>b?=$fGz8Mq3ujw?35ueseq7FhzQkGO4qs&N|SO5 z(OZd^{NXAR#~+4Mj1&d@iIegF^$dTn&%n8;IL4iiLoLvE7-MkT|LYhDFq}T9FK4s{ zdN}EYek=J9{}_ZnQcK(mwZu{oJRk7cFGI7^Di?Bj4O(Dv?+j=F{XBX)>7v$GN){a7 z8I`%OJK<`1AMouNuYg%tMF`1vzSu^wE(sRQJsX^=`9W_@HFN<&hu2!|63ots-k6Pr zP`qn-?l}QXtyn=35QUCd5kEi+9~k~LHp2jOp%4ZErp~YEr9>zY6cc-e=Lu7W7dK;+ z5@+AMg1-=IV>zRG5^>(}{peWi-|Uyk^iBXLjRXr`Dxs)BBhOS?;L4i(H z1$y^pRiI_mYfzgkK!Nx`5jSR4u``HE4s|GWLf3w?3xn`v7$4{|&UhsP3}rIW^h>%A z8BiyXvmrlu@7SjVViD+)nd?zhy<&>^ze zcsF7UzD1d#kSCN?3pKq%n`AcDTHQ0sSZ z{xn!HkU&>J1G052CnD9nwFR(j!GdIGT!|1_iKI*Zntu0~y^h&i&_Vd% zhEx6;RQ{ff$scj2d3q5ls23Y|7%-}1H($aHWS=L&cYR9oALHxBXH66}{Eoc3R3a0k z+^wOdzwCo=QJBBsnLdQp9)*$?OQU;8-O2d>`ZW9TdVp!AKNQe-Y`L^z0z(93&AhhK z4;{@|!^vJ5xGb$4bv@PxaFiQ$o&eo;Gn<0LJ`m$$@}z++nGnx!={4_js2md3B5kB7 zwDLWepWX6ThmO%=m{`8$x1h#h8pq)O>u4jfEDj8T!u8!6a9@s^Zi)%i#L}!PHi2lD zj7Kci%il&bcR(Wr^)c)F)Q1em1uPyQfkxUuP>xK_z?1NoiJXBmnL56PDcqSEzVPw} zbnIREv1bN00;#|Z75w8pfr)->6;d3Y`bBFo3#7;B+(hLt+7GM)>Jd0lC{2tKN4o0U zEsG6)*U!6vA znWR~;q)(iUOwxd7OeTpb5B5c^orAxUCa>UFB~4y|GVdDURisW)_FW^y#Ba<$)PsjFj`4+<$diYMkw4;(DVw z6QZIB>*j(57s}hTn%i3K<6fhRDr~@9d6(<@sCcxbcag< zuo*O7yL_X4#+UJSmtF_x&sn^F?UaDT_Y>Uso(W(##?QP)1KCW-UE>LfVtkB$EDmnd zDBsTc;+wYUqp{eYzchY10_fVPy}(|D7L5)JWLnX4g~%CXlR$3;uXvogtDUNlBL zZ*T33cvc*)rw&4-KBjV1QE&yrh#r;M#o; zRZsxXpCiz^r;6W7@0*>HG){~Q#s-sKVxNC}{BXqDybE6qh7;?nXn2F}HZUE?i07Yo zLB~H!4pHcLoxyD(93|0O%xyXI9xABoujvDcRZkS5}-?edgd;SV+0~DUl(Aba9`OGK>O?s#VdLZ zx#MUL>%+riu!?^>HW9pYnR+7lSdBzn*mr#071%@CgYAdejOSqG-z72lbJ!pN6fQ)5 zXv`adO86sVDz8R3rOfy%JS8($o!qa!68vuJz7f!91W9*6*#7C~T(&<9J=hzLiN`&t z3IE5wuvI}Xv^VkyV~k23`0O4eN-V$DfphHBKZ~bFoB|jbKSUkh_SpE~$RM*58((nW zNpnz=x9`LNwyW58QeZ@Mj^h?tsl7^&e1%y}vIj}ng)gIn@LIm9pkz5QapQM!b0nxP zxEV9HlIx%C{a4IwXXXVmG4UTO3Y zr?m#Q*5A3h9anzkC$4SCXWIpNz(-MNEBBxZeTjfp_Ik1pK02POj6^3xj-66x$g!Xb zf8%bE4?0|RE?sI;w49aD}EmULJWR0*e;k1wUN<*)3JW!b7ksma(fPFFCHc` zOo6Lm^)L3oU)cJ@7j0GfNr9geEqG6LT(~|HR6}%MnFfx?=5Orna{~%6*WdU6&SK!Z zSYNZ$XHAAjSEnz?ek-9m`EqR)@9{sdNd`GppE|=<`@cULKjO&G<9LT7)bTxnM$GtJ z_(1kFlVM5bcGH?V!(G^65dmRvd%yUqQltugj}C4^p$GOSfmKjiSg9At6awF%L;xu* z+=S!uWtvn-(d4u!eEN|WjKC${J2UQ+2}Zc$!ksiWGo70h8Zo_q*%ZUPv~)_@O|JkvdV+fN02-kO=KpUjwdr8I&t5`@{r$Zvt7I5k80o7si`S~flAzkUU$OyhJg zmODoU`Iyb)*u;w3760n&zmoq=ecPik{wGVv>ext{6}aQ_e+e#>|ACQs{=bg=|0{*6 z9Q=QiK*c;f_#ZrMV@EL&C@>-*tPd~**$@G})>%yzfolOX zQCmjVFJ(Rfl@2BFUtYg<979wU8cDhDhGXi;!P|#}`e8@Jf z>)U)U{43cPNx~yXp0Tf#9H1Q|uFy$aOjR;I3^^a zQ`86k-7!psC(&au;r5u19N9U(z3e#lt1J1*ygVj9jl;T-pRw<{@{{vnXZcb47>1!W z_A$Z!Oe0iQuqBQoE5l(cFuR%lr^^(ALdeQx0zrUbnAFsz4>TZw@i?^#Nq~fJu>bas z@{TaHYb#Eqe}E5#g&}(K3pNMBF`|ck=cRZm#kC+s4wYIymro9#Uccvs9sw_30wHLk z9BSl9Uw1FV646 zc{Bb^SNxH5X^cM>9@PbZ4Ed+aA8GG*#UDq-_@jb)Ri-D^%nI(sm%w=w@%(YUEBsda z%rb=}AAEAAKoUTd1akX;yU39WS_%0i-{q5=-&Q`UB9>h~kwQUyDCQn6iu^)7k?@J5 z?(E*=CS>B|+u$>FSx4b)8ZM25VSESr6RRjif7nf>WIV^^6|QQ}Q{^sCWvdG;Q^R(z zBb9FPH$|SwooV(J?-}Cpo3zN2T~V+*`&f8MjDBw((FOgc?QrQ=va>V&XdheEKV0Jy zadnjvahBtiwIky4WxzPsKo5t0#`^2P98yv(SNg-hj7faGz!WF(hZ`U}Nc@WJN=Y$# zE+uuZ4k-mQrDx@0WnD_LM{3>Stbk0nMaaR>I187xdXYeRw)1r-9ILQlxRXuHsA^eM%LinxJu(XZ^$s_Y%d~~zLGTP|; z=wN$KE2$05PbZ%DxCB|e`A|g~KK@RsmIO5DuLMk%7(Cj?C5N}?GX>j;fe@czTT0qX zm})Xw{|=1S9e?e-D8^rb!@JVzZI z0OFFZ$ZNuVKJH6_3y|E^A{c)Ss==j_!L3Cz1>9Ep5e9r%i@bCJKh9BGco@f%$Wc3* z0|K=h&{s^aOch71gI-ZhZx~WXBdVQxhJdqlcm@ArjZE$H+FlN%42gWI9Pux(tybV{ zthgWTt+^9#c%Q1v$D=xb*042I{MEz04jUelC5F+oG~k`Od3>NfnM|Jn*Yu0(IP6bz zmk0ivz5i~oC-hed^&P)|Jy>iK5?Nk}>);;Iw4Aw95QH$W{L zf3F_PJ>7K9!+(Xr9EvV%IYitvYHu^1FFS9NrEPtTd&oQXVovZn3KounXJiCYHJ)Gt zVnL%u$mp3HC9cbL<;zE&E`)sD`L)Uy%7P(ZxK|Xy0c)~NmnT`HJ0-X>n>3w2Z90y>Lgom{HaHUAjIl^3k8& z$zRz8G5PyyNEh-q`z=@gDo~-{F@Nv3?#FIMI4m1+mUr$Un7=bA0H#n>ftHpEJ>BmY5?n0e+v+^Dnh#Sp}Cd@dn8g7Q;2uq*@Wg)5R)#7g z|42(};YU}dVw2}Rxtns^BCoUewrW20K6M+#2^o$FYpVGR*`^jd87X55-2^fSUsIv; zS-QXo=rDD$fTu;^S}K!kQoJgY2hjm%hA!#@E^Oh3f5_(rS5oMaIw-&&j-yJxyNFYa z^Rt?H5uVp7_n4s$Z6to}CB_}rfk?p*R0S8@k;!JsCbT*+8B-nOjq0F%7`s>pGQPt= z9Ph^z)?i^At8C2XJ4KG_C9gxu%r;n|FP*Tm7F%(ue8~C>gCpJkz>Ur*yMAk8ThR+U zlg|t#_rdz_;~=}qxMhcuGEtSf+THO&v1;QSC zE}pS^>RSQ@i?m$+jz`W59)Af7$1(}Cg2T-Q{&KHTgF?S)JSZINOFo2ByIK|nN|qSr z*cl&kPeovp66m&1eooy66{e-o(RBF#nBNesrnijafG|URY%Uk6K>v**wXA4qAb3{Z zt~~0CMw3X;#6qGFRfJ!IBD4I!sBOYW4-4v$s)A7x5hOfk8Ip{ApO&tfZ)p@gW;2;c zttwKu$p2zHOncFmz0mNWlw_Qw8DjkxVp7fbEJ>^l3hW;HU`!RC@kep1PCSw00BSZJ zL)4&k9V&{gs%3&iFEQT?L;$I%;=vD~$E@E9V_(Rb!0s$e{4QV+%NN}fai2JhW(x6A^J?FD7u0O6#@>is-%~S z>|nwEqupUO<0gjnH`53&6-rnVg%V{fsb7u)LgExNb%(lBKMj!$+b1*Rg-BG8<;91w zJoWE^m=E1X!|d>|)Kd9?+Y@5r;M*9-`=8Jv>V9l4wmb3Zc){mS%BPlR#5u4;*3iOq zESDNm&H47qLA2sAFG(=giNi5ounNPom)?js=aHu{hu6t;%Z={rcf;8+`+ee|F6?*H zt3Y&+8)?|fHzl^;vt0We}rp5P|>2nQNNrdAJ25+*=?sMTJ)0 z2m!7!YbT#NhSo~2IEXOgBxLz$sZ_7Jrn(p521e5WN6bxr)tG8EiDvO9)P-KFZy=_c zt|sbm#1BU0>PB?I8XlSqIK#=_n#Ir#uwS?s;H{a>PJ-X%dTTXu*Rn1vb=9L#wMXC^ z`zsSe5*+(Vo?z_2rk?76%Gtiy<$Sv3d!=kV0o~*RL|WJ8BNt0%T|@4quc6%iXlWrk$4P47ayY8D#1t| zCtxhk@8>~+BNj&_2{hYcu_r59f+ESJPc-%8rRElA0Rz28Xz4B zkb(tGM-hid6Sif12!CXe{B1N@SdCiPC_j!C+Uo&=^SU@z`h`S{Fjq?cYcUG_5_{N5 zF&e+d>_?_yqjD#@gn^Xk(q%5Z0e2!aD+lFj`Hq{d&YJS2U_sH5z__>Od>AG8C73il_+!!( z8~$CJ5*f$4tnMwu!k9oGkWE*!-Mc@t_CqguQGT&kR#~C#;QT z;Y-mEv;W0@IBI+fWUCM9U;}HpS{%Ma<%EwcIj(eL}K<*#B7aTw0R@@Liu z?vVO=82-p@iHv-A_Px0%X5Xjw@4~+Cc!?Mh`@V5~BKv-Yvwr0UD0LH@w*Xi*?#%=n z1lo$f#<;^N!$n8SZi4Wi3rw0PLKtwdfMpgC!<4H4rQdmgT6W@{L3jiHx|V$;AqFq7 z%a~>VQl#6NnKbx^Wv}O3Cg##0{2bh|v#9prPn9?=HJ!lQspfV$HX7cPy94v<*yK^> z*T*Ygm(l+!l|(N&Twn-09G=WoeQg6+K;D*%V{t;e5kGPs2C*TgM1{M{$lcfu2J^Ae zk;EJYnz73)hp*SY1r40F*kxKoCa!|zxpx!gXEq<=CZtwW1jfeQ>&1blw_o zz`eX6#omf}7jpkBxY69A3aTm%N(RlzNtG4*#!B%>QQofhT9^B;)FY^ACwK!1ZRL zG0%Vkn&e$4ph(oue65wfEJb01n*@Zpd_InlfzO45-DFdg_);y~dD=lXwX%KmfPk!Q z=WBa2lc>0pL+&jEU(^Pj{K)JYr9Vu9&>yeR|L8T8WCx#OSrPU%coI`H^4sw|&{!;0 znP{2<1)NCr*W-MjK2Cy?H)uRSMGsJ|R9u3bO5)Jvd*hd#<74y<^yz}W`>}PRlmCC| z|Bb%q8c;~z2L+Tk`nL2=NZ(5d*^i`e4ybRJGYi>{zI&L&iKp*Na~%3Exj7+yj~ddB zzHiAa3~2r1>ATXCfWE_k>i?R)NoU09yU^1GeTO{n(l-sI^d0ld)DPad7kV7g-PN%^ zpia|BFb$?m0K2xkGdatb0pBu}hoe9+F>9^?>&&XW5kYER%?cN$FNO`-92_EBm77 z<9LBz6a`yLD~ow#pgsF&G>s8u<01MmIzXrR5x;gd%MaZl<&v`f0E-a(S~*!1{3ge{ z;5)biTEBwp0p107;u^n_y|tB${IF03oByIp!5 z;r!CnT<-U zDB&L)o7V}`=;<`?0>KgU3vHtUC~t1d3wY&04b4I1AQ>pjw}-r|h!xeI?~ad(r4yPX zZxehFHruXYqFLwxI^kO>kWTc;gF52kIqB$rQh@*ZZ}dh;2l}tLJg0J`UCCmH7?u-u zeu=hJ>a9IjJ{J6uY7=oOyt-jTJgtO8KbSv-5#^+tNFy-h@DFZ-Y&YNze&u*;7vYzU z4RT1N46IAw$T9pMO(e8-+8mtEgukP1%H&nxkm#xSJ1KA=Hr;DvkTDbU2e@-i<#794 zRylN!A1nfKa})!PK#l@D4gYM2==9DEi-EzvLtYZo!Ws6+=Z)@X|7mpjG9s10ctR`R zo&T0p5U2m!`hZp}VS+l1udf{P3^1$lOWJdt^*`qq8{lG?DSn)nWkQ&(U^)$9Hj*#l z9^3L4>+$4oV^#`eYE`vPfDewnyfPU)Vap0I$TTaL$_Uq5jMj_2*Y7AwB@h>yp9(?06z1ZU>}b^ zd{A_XSq;DqFV4V>P^K@`svA)Jhz5%^P$%?URe)^HccaI77p@v#cTv{(+)Wd5Kb(;J z$poacHgPx&K%4%e)JCT{1Gh&Q&seZvhR^|YY=N0ofqQIs2h$mh)Np-8)&zg}VaX)> zG3aH0M9!2!iOx|NA#JLE%w}&*Gq6GZhIL>)yfw>kB`x|v|3ZQODn@}CUXHIrtHeuy zPVvWZ5&7h(ra^g$rmp|fPlkRJ47>xfU!8z0(c58g|* z_^+DBmJUwpLeL6?^cVVrf6wBG(LBje)b^quy*J<|@l%ZRgMtssfF<{g`A32FSxNp- z|LyBBCu>5@hn0u>QTn|C53!i_H2gm&MHjJ+dlvVSqQCWrTK%Cn{Gn}596atU#-~HV z)F$nRMs`iZSDk1MgcXIh7lqaqg+K;py3EY~^0)}Zw_J$pG>c9kCqxK8oE*9cABJvN+ls|Z z;0K&L{UZMIoI4yu)m+@;B|r9P4ef{`z>fKJ4fv9LMP8(yA(qKLdS7{!tR@^RtY!^O zJq@dTWM@|FPP*vjwl*ACSNk?fIj}s+G#xE+f1T!l%anzvwf1uEyy(bDM+xCr3LMsV zK=g;=L;%ywl}L0)KEcW(ERYEl!JfBGphWNBw)j})YbshMi5O5J83#yJC@GUIH_cQz z)}G=L@nh}|J>>+rT*Y%EtOnfoTZ5)e3174&WlH#pEopx1*kaUA6_1Gquvf>2#kC&> zHescBps(MWhVzBC-L#tMq*CUoNF={(uDKIAL^xhr-DLc2$W? zeHpR+h*a>r6wbe#X7Ar9X(TP2AOA8sa#YL@8qBFM$lVi}3Tw-%g9EYWBT{JG zKL)A#2)9^A#{PKO&4Xhm9gBi%F?oy*32R%k!-pzWUgkf2I91B}5|4|*I75khtFo3? z%r$P3C)p0gW23w@B~AE~_bkuhnaIO0zLp3wXGP)kMU1~cWxgMC?u+mu=2kXu_y#rj zdWo}PxR9Hl_m?dk+8<_1+rn``cD5`vO(~3S{((aWYK=D}W_G{C^c3uDG*?{`DHDi9?87tKj8D zSPTd=lw`MjzPHW3Zwle$uAO(E0I(Nc1`LEQdbd?b0#bywi#Gn4(;Rhd0VuALzl}QK z3V*MRdky4sRHV{+7|D)=DF)RjbRF{Fwq+v@6Ok+eA*@6d+M#tIP&C+O6t>;C8M%vK;!R;S(;oGm ze!;OoH}cKc=i02(sSbjwUOP9?8%`G1*pz=HI!9f!tOPx!NNBks4-+=@;V0J+M2vb33azW^; zDF5%2(ZRoqDWkqP67soBP!Ib%Kp735>?ouD$3q$Q`Qa|6JLFXJo#zebmq;Ck*hgQg&@&2JS%NI2-N4Hitc+f-(&upwQEDM-iN; zggJKr$O|^)ckDVNiN8ph92)E7Ya~Z1^6!ZKM`PHLAeSLH#kY{#tur~xN!q8Di47&9tlMuNX!Ot)!&Ic06igR zLtKk39{gkeje>Fnd6fg2ekS9{`|u(zn{OJdSD&5_+J;xK$;blygZw03zJYa{fdNe{ ze_`McL5K!uJDYJs82whthCVJ>aw!-+15ZSLhhRA@X}O5sx?|B#-LWX!JD#Mho&>i5 zN%b+%eofGD_8M1L?)QbZ*q1)lwF}!t%aPw>5sO_8RS+bN+dwt%0TdXi^GlN*u%&*bn8ThgY4`){%DTSFcAu-q*U9fQ~^1(pq43NfH6 z4n>6>!A@J!Ca+E2g25+6!)SVSKa`W)?52kWzuwv{SoBg{`$=WGNm4k(nKTWU{!M%A z9|fHfJzKDzLG@y=K8*XU5bLPV?u_v+@DYb;Ne>8qvGvLucJh-y9=SOBtIhuHE@s)f zkBW2>O)_rGUuH;&KLdko?vj;bKkyI;#5q#Qz%lfNmyJ~boTSahQ1DLV1C-(*BiCL2 zt!iW}|2AkBxhFyXZOLCSP|d&9|1DAe&0XKmJeo|L$ysXBK2AAn-J1RpC3jrgi*_b&OGhX*8aNa%(qp_T~Lb5Yd5d=IkC(Bv1rQ z&Q|y=`Q@(cA8ji3_cH5-7vPYZH9@9gAND;3AP#!NJ&6V*hCP=BbOI3!XoiV*^VNbo-&l(H`b= zN^yZnl&M)KF-6YBBETK=gX#%0w-8$dPw=@U?BT~@kZzeyoofmK@E3sSoWBo0;FI=l zgHTk;E4MC_OP$?w8TNDn4yv=~SeeVi z5@b1{m(J%ly9PbtVX2uXfUR@Y)v%vc?UE3q&8vv3=y<()vLDnlz6 zQ73{57MuwyE)OSyborr34ms<@;WhsO+Bv$(Qs-^ms828}atI z;BGF?F>2r>`CjV7xVQkD?l>n5vFro#kCaV-C1Wj3eAT|q^i+sZdN4}WA3H8nS%qkd z;Nc^cRWw0ay>P!Ps}&e@f0=wisf{yeV3p!6vic)NZ-4NS%4$5dVNsB%PqQce#mFo3 z>uHe{-7F#NPJT0wipg)|M_tJ8*#B|mH|PGu@@wjI?gbZoUwuvv5FID7!=3t^JC0OP zN?}^Yd`wURS!GnubP71z4uQlp!H}nCZLlkX7~{FqQQVg!7mhhL2HcY z(KLyKUPcv;r`hBP`Py0Hja^t;>~*bpjLiaYe61wMhSt!O_>@`7*3L%ip% zRt&Km7TyD;Xt?kv6@Q}gpByRwS%v+9K2Sa~H~4vq-TOYnK=qNah%(|8euv-P@z2i8 z82Nzz5>r-48r2=$R6HqP`Mfn{5f{N$M@)oLW{ulF7 z&huG~GAVWtEm@D8elt>+H_P#*eC}|mL?oxJRr7wA(16gS1@RrKkF3TOq z!GOdBCB}03fSRA=8$cyGf=$rtg))Okz=W_{r7zqSK82jAF} zF5~NXPlgfVJ&ZiUiBFu;3J|t)`86a;|)d9YA9tJex;Ou-LRfKtwuqF`=GR1iKI_$&g}v4CdcNC&rcnj6?tx2I#q! z(1p+k#T$r)0yxBhQjrWO*R3FwdMTTP*O)c3tfDu(XASK+8nF|nLY}9)YY%#ib5Ptu z&E-y#74NF~M7h^cS2Q?_E69E=U-sme%-`|l7J*;S4gwX{ znl^abP=Q@{rUKT}7zzNa3;u(^6Ga(Desm$js7h2yA)ec4e=&#y-NtbL6Dwoo6|YoY$IN+ z5QFHFko*IFee6UCpUkb@sVvP`ckoq?obx^!i0O5QnfH?s0P;{@Xi5bWi zKDMC>z`nTw&v8-DQ2`~b^4AGa8%6p1!*i(sih`|B z-G}Qhlv|_=sTe)La{{**d}6Ies^qLV9zA_wmV5ew4C6dzam7}E&<)a|!*(dca1UU( z@(mo!YSoCf9w)}t9`rw41B|h)C(QCG>LDOa+L|*fuMwT!8s{t;?;R}I`WZ<(5DUh8 zr`QkU+-OrSzyvV|jb-+|<27eXZadAn{UM#bUj;{qVq3+*yLfZ(W$@Q_YmVRs@&qCv z)x16OXL#Rs-geCzb&xswT8r-{QSd9022<6+z3M*y^Rt+LHE288FH!#Ij{w``e-MEY*hhal+s1`OP3jWYHafehqFT|uEg133>h$pE-hKaD6OiNTunV{87|Q6!$Lj32-L8zvE@MvBeS&9UKM7;y7t|465?7uqEuDi$8gNtV zSWz`I%5K4@dg+$bux%WH9l9W!q~(>qU=8in3ZOJBM<92yhTnN?KFmmmPN+_GJ^$t*jgB?x@Eolz%tgk(hr?eCc=iH@Lcr%nIv5PNjZp$Eo#Xi#qI} zrv5+onN80#pfJAdyOp5C#h1%AD{LL&%W;IvQ3P(rGHUqJM`U%3FQsJGa8s$+XK(HO zq=e=9vH^^A>p5|Zq>9-+F==gKN-19jAFW*+>)BqsoEORw*l+&d|E9Ks@x3NP=+pG5 z%MoDj42-Y(OC6u`g@lS-M~OmzSr}qp12$&di^a9%7_dS2D@+Vi>8cV3Pq9VEG^;(a zq0I9vld|8um!lXu?45&MD?|8Ev!^f?J+5bmJJ>M4N>X?@9j=y&fjPZBi%`W(RzlHHB zfA79M5r5yGHOq~EvpjD6OS`NpxmCCVlZChgMxP|{ZxwFxzgYZ>{de81b|wmBvGx0J z5x7q4_m{uH+g+^RKZ9_Cs$zd#?tg@F3_fW=*A%{u{0lEpujAJ5H~9%1_m?5zL98;T zF=@rs(>qla)9yjA^wgzbLaoi^J2?M^ zU^u%DZ^gWhDFy&0x3@+%(p53*U%BKAQtPexR1}j_LrR>9e%LSZG4rQD2i3nr2m3uC zf!R~R^32!=3H+p3v4OXVjT=99vB6I{=4JQ`Y>Wp?L=tZsZ1Bl{i;d!?z{aw&4%pc9 zQ5-hbKiB~qFVYc)Z~B-l@;A<7a8^oECH8iKcOS+ANB~ZZ*q<;`1=tOM)fYM)LtHFv zL*1O2ZC@=-Bk3(h8DE;Oo`x$OEU4g{%qQsQa3{y6kiloeu~aOq^%#J)q?g zei|ER?KY;57-3qTqZi?shtFVCAaU?LG|T`FG*CgfRP&)Byr~yp(EO$3(Wb@ zGIykp6RbZi#mqsbu0PcXjrQmVuXIO#Y{zTrSy!QZI4V?&W)Y*>kFmEBZ*;F8OSHzJ zJN=#6Kc>GMU!yKe;9rle16oyo=U9pK_Z3-Y|3a?RG4rcbJF2`XA0$Ep{;G3^X`Vt{ z#A$Bsh6~>#z5W1&ryNGSW&`1o=?NsS@vxTws17jw=h)8Cci*C{(11o`{_`1th64ft zsC+H?rSeKRdNdW|b><(JDBHkXDwMiOS`BZTJND0(={xy!3QC;Yn#!9N|Kg`K=I9Rw z93DQH?H^0PY>SGN*_HZU_Pi4xp%Q{UiCv>Mx} zuTUHt*}u1oo%#yFE+ho}-8)}V^B=oKD8axupCat=Pi~@2cz67>vu})l0Bs&PbFBS#K1%Tnfhu6{#o@hZzSTM3kabhb&P+4-@`xZ>c%#H z!Tf@(Av~>eg5Ae>&J6(5+|CO0&0V(=Nk^WT5&Npp-mxIAcM!Qy@{`fLrYyV*{@lMv zS*p+hvFS8Cus`H&2Wa^WJ^=Byi4Ykxy%ww>*dLWiQ!8#o9A;~>n<437h}Nm^~!*;Tf%@C-|UdXf1m$Y|Ff)5 zjQ_q`*9HI04gwF#e-(9!`0xI#3fKSK8uLGywpJBJl}iE_w%cD0d)ddvS zDJ=!mYgDrZ3H%-2EbMvpq3jMG+6BxA7)@n6LcHnk^m z6Ez>$^-*%40XnECfk(&wa5WL7skCDJLXH#pSzIHbR)A}&L?~m4JD(ND6fx=qhI=cd z(tr~J*4daN;v3i~4_iLyYh<$tQP~cgE*2SQ7M3^moO7&{5>3F`iOM5cvoh3&6+X-H z3J9XdPCiGWko11^WDcrczUSuEj{EsGs*vr`=Yt1Xmxk?9UX$+B8xQL`3Yw7$LSBwF zbrby7=}z(uJ2p;x8*(Daw>~NM@eLA-vO=2Gbq(lE_qa6pM4oc;Ve!c~@c%RjG8fO( zN&3wYM6s(a5FzCTZ-PO^imy%QtxWX}g3aASodos>Lt!5!yHsjNSCazZ3E><~XDc#f zcYmN8qCPdNOg1HK!MQqiuUnXqMBRXT)O4U(gIWWOI)MfKYuypDhIq9+Q`SMn{OxqA znE4_eFnGa&{2f#!G7psvD3I&@*Pkf!DoL8_6&-{SM6=fd8BXVveIF~}j(xqISWdAY z#fNd(Yac$y#>h8d&N8w@Xe-l77zm)L1~gbd)e)Qr*;YGnO1lL|TGZrq8T$(sTp4SD zkYYfCO$)q?OI{Pc9Kd&p%&9sVdM%nEn_+#XGk-A&afwQ*yDq7U0|E<*3st?E3W=T{ z%d$L&8d5uwY6otEP+Oiy3P6GEai9Pc7Clx{726Y|{tMb&Y5_2dW_kW1$G<>6?fr!$ z*Fr-sBv?Y*h##4DBDthq7Y!liDY>UT*^E=Hez}?vB_ZY$q_T+K3U}X>UE73G!``FP zOMrk@-J2hr1a5eN~*V+!=H2l6!VfE_1TbUBlcSN!|rB&;&T+75;%208J}yulz!MBR(%24>4v~GwxlmnN5OAs>mg>i^5;@ zS8|}p?Ev+y*k7TRsYm-7u5`9iN4?9Dik|_cAYhWSU`hfcw&-3gEA}q2Bu% zI#oQz8;d)jdpSh=c3K%L^~)avew?S4Z|BZM15Rtntb~ZUSLU`BQu(C!@kr8Ho>RgQ z$h!*E>w=RdiY^;^0gCbP&6G6P$9i2RN?adHyfK6f5F*Ia&aRN27(J7`3vR}sxj)4> zr&XS8-+{VmH1qL~8NAqUd_SqO#7^HK-w*!3eDC+xGyoQ~R2=vf{yisfwDNT)DwDv% zKtg5d-`@X(^nBGjT_GR=*V)s#rJ9wx_D6km4J&1>)XRR%N3ksv?mZbQnM>X55aUtH za~ZaPhI(3pe6{`5F;q`!&pT0=%gXNgPd6E56p8L{r-FQ8IkA-TzbclMjs4>J6z2S< zvmm4<{-&R#&Z}S^QoaIrfbU6C-&}$Vo!CP4tUIwaQC6kO#Fmww{B18tImOz_%Wfv_ z<6`kYJjWY}VyVKTW$1k6?kysHEI;p?JE|L^mS{ zIfkj;9d|6$ODml7afcLxGEjGAly;am=wR$R$PXL?BT0sKXG2Zg1i@DS*IRQuq6@4J z!5L9$m`akl*)vii2XpcYY=9Qu^^N=&XM>5eqLDkrXY&(c`d9ujYp>--(I)~R`|2C_ z$`KwD|t! zwC?f)&EF^wWg@JZ`Yc%{fqmRj2}Edow(D6JFy`c!atu7= z=_~$0c;a~az9!yC#M5I4A$VG_=>}c847i*868G~1|BVgdYv8faX~HgI>JoH=ZkM=Q zVk?t-%Ew3cGV=*sThA#qupj4-R{K$C><7NoU>yd9HMpBMv@;}iGNt1h64&Hp5{@4c zwM+hd+RB8HyS?fbgj!D%V+)n@<*D1hx{>B z*ddNTg3olt9|se{|1*CKp|xnoA0xRtPfB3KYqw4Dze+*jD1%E8L#^sNC6#aMfuc<%G{P{zU{s^wFqH#<(e;$7b z7x~}ppZN7x3W^V`Q6!uYSJzSgw8B=_zOJJOAp>8C)pPZRQ=eT(`WE|;955V9$-Iew)YZ&(Hnlx+lFpWg`Q|ha=3ABtgPC#;h0fH# zdLGFEJK3XH*;oBCn5JIy)0ob|fn&%|7cWrOK}oh8)KsX!Uy5wEX{8QE6;=l*e+Yo~ zo+p)wIzpWS`(5eq(T~ng7k(MzpEsZEf`6u6?eb4aATj^6XmNHZ*|k5*soTLq*fa&d z7)3SXFI<@8UAM}q!Z?l@K+TV&|NRRB}t22tp&gFc;_FD zn~qc4Ymv-62fyjdAZ3xHj>O-vJRd#jtPg3*q3&_c>Ts($;B3LQ`QCl64_yZ)Lt^Kx z`QjR>Oh}b~i~Rz9Nh|esshVOO3zbzNt{B<>I45IpJmA%Fx~>jh<%SB?t4SwJe~cE7 zJT>KY<<3%eQznhL`Iql+1^B_brE$a$Vj^$NUbId7z8g@YYGiV~-}3x*BTlUzgUM(w zd~x=It^kP(FYA-q^XD!NZRyQKSY7VWc_mB^+N!vdh%`IJlS!gqn4H?EuvJsSfbje>EDU!|(=m9NzS< z#-~SIL!bHV?K3$Rm!orl;Mhq$$JRTieEo5hVidj)CjW?0oUEl^)ya`yK0Sj=L-3b~ zAmBeA7fNBHX|CmewSJl{o z1RR{q-;J$s^yAs>BS-bXy7Rv>(U0SQH7@T$KaTwkFsc4|&efguBir}RJs(6f`K#Fe zrcTYOR-u43oDEK6(w7@AR;;5=*tBjyRPc-2*j zcmG-$NSbi%Y%dBbJ}e`q;L*u1J2T*(&WQmN0CvZJ4UriCo%nDU{MYm=m;aXkCK3PLpOuYVin?gy`nfJz2}rIi z=o8}C=!!P5V1-;Sb(W<~qRXaJZ80vK=;W8;=5If@3GPCj|F!aN79MOg8*Q1@ZdUrV zhmeDNfJInac<<1p-DH~>P4ziLdpE}pNU=On5%-=@n7lG-@sD-2@ zWm7C+*hyZ}*<2s;Yh)t~?qvLbJ$AMjczq^Wznr&x`pwA!Yz&y_e7~$?Xok)Ce(a=9 z4%MWp7KX+AH}h4@gq3k2fP2KtiIw0VbC3cih~ygIxWk=@&>2BlhF1`cuTru zG%^c9gxvzVxTsL8G9&iKhw=Q=VU*K_x{fG>$*>!qqnyfQn6M2-#BVVf zcE-&rs=O_ts!!sj6^Ma=TB%j9k|ko3VI@XhGuH6FQ8j>y+JQLlP#z}y>nv(&5XjBE zboFX-IVS~0p*@>b#ivk8v)pRe_OrzHBg7JT$4A3~3T>25uJhh{0KL`VH$AYO|KP|WE@Zo zv4!nx_LLqydfJFPNtG9~Cs;+dr+Me0r(x{rWbNsVO!Rb?=?TkkI?QP14UwK2+ZRD_ z`yKXUc@`#N$(mO_pKr(uHGI#rB(F?Ola83l^;fkgt0|9BQbOK@`5nHN&lKqdO&7NRFkWx zoj$1>6QI%W@u7Z@$q$G*8qNhTqJH4dG9oDnbsP)NsRU@-5gh=!vJ*gq zy9G$vWCejU?@ewvl8wN>6y_tqV7?7ED)aGD!OU>Lge#Gn0Wg0WePMa-e}DmeA?E)x zJB%*G9f{h>M7{ybQFY%h6BF1*-~g#Fyuso2b|^peg`aLLrSHKoTSKqG1_ic1O}&${ z4#x3h-Q$sULtg6%;Ma?CJu(9tFQSIq*MV+R=f# zCI3eL4ctnDwusHW@P0CX*Ruonq-y85S$o4#s^I0USqhUes$dL$0n5~1^h;=Ie+3Te zOB;^R$AR;S%}gT$5PaKLKp`08yO(=BqY05tHS0L)>HrZR!^vtAp3T}Ry|mcVjh8H+ zxJ3bQAe#6BhE(}8_FTm)Dg)}Low$h3w-30H$l*P%fHd!nS)L!T{0lfuJ{9}FJw>kKR%@6{TZPFYGnod9 zcWO%HQz@WI0CeO{J_&t?J;!o4MK+?)z@B?AU0oBEggaT&_7T@MmgB=_LC3feS1mSU z6A!mL|F-#^n14IfcHj)|U<&d=$u~*+n=}eImP{epwhtiuXnb8>V&9!AHvpL7PUcpK-kIR%N6?}G9C>v3c`-L6?`WY!v|NwdN2 z4~^dXgouS47;Qg{X%~0>uXBiDAgheYgIQXPs0;sd0=;vav41;OW4MQE!)x1UpLscH zX!-`*4A-<0SL*{4#hDa zm94_it$GJuJ-Y#Zr~OX30UnNLK?}_BnTOC|nR;3J=vyDh_|;&w;v3k}Te$lZn1`2f z{sCfs4VVFh7W9G4w8eMES`Z?o*%M3)yo|HN02~E<(0(QOf%scXi(H?b`Oitvn5OhL z+*9+P`WDjB6kDWuQtnahQ-w?SF0q_KyrgNK=kkj>Yn{(JXZX6)KZVd3L^qF(1Ko{+olj84VyRPPlN!|NCd-& zhq(qMP!>xqT^+LiT=Jj6nX5zIB(CrwXvm1ul3xfpfbkJBw=vul+MiH)sw{&$192nY z%_dGUVTSdvOmGk62Otrn6^A~OzmeH8maN$$v14TXmq??u&))G%&5LJ~uQAIe-{mgp zkiA1=LRI^&3k@x0Pg7@V{Cn+3)z%pO1}*7=eoLmh^sB$1GyRyK+o|^BNr#BlyQme_ zeyH}**i%r0i(^#hzL%tqO(M$7J_eweG17w%)pTz%>ORxkb%?t%0%asI!u%eRqHTOxAMO^#y@Xj z_w~f`e-6-N!U-nCcZvTCK**)X~EB*er6gF^AUb%2jTzdCs0<7T%a8zuq z*CS^uWmmN0roD!n9A+lk=wRrzIvU_6r@jnZ{b{uo{fB86#afInHFM%$sVZB=27_&= zDtiXM><3uE1LBuakF={P8`s{vx2q|;W&tewE5kuW*y1u072JzO2iTaeQ#o1NdJQF# z2L}sUA9CE@!727Dn1hMAy@OMnp};uLvSFMD0>0<-31m-1G1Kd5no|)wn4xuFaOM=7 zt-TeH_B{W4ip{)S-|=HB&g=v3R30xO@599-Dx7jOW%OU4YZ#sSBSQIim_5PYZu$R> zIR3w*EB>Dn=yZ}IUFcX%_7ItsLvO!*UD{VtMpg(J}uWi z8I93UHpjK#wrHh$#AOywDSr2l2D~k5v1$eNq2v#AKdWk7L9B{5ambG3iI~BwN-$H2Rms?&iqL(aftAml% zm+W(7jP0UyNYb4w2N~R+iCVp z@@FAbJed<|LeF-MA(B)&(0nXx`&QH%aqQ~yUzGX!ALD?k`Jael%`D@+~lfS9AcOic} zCIf5}|CV%?zaLWnyj=a8tKsn(`=n&oEF&{!HgGBODRu*5w-qeFiX+eg`abn2(Xwx_ZlO6mDW}Kr#t*amec(J4`&fqO_GWJVV5Q!LN&LtZen9V&Zbk|0bI-sL!H@qV zJfMVy>S^YXH2x8~iWyH2e*B&L#tMBy;~ZCQP_PiygfB?J;yfID<@xFnRy?h$^q?d? znu34mASDI<>ExGW>$~G%JjREAkv8sye1$@(x4C5)ix+{A-lz;r@Gvqm;9RHSv_ zfO|ay4?Kz98pfOi=_GP7VZCpl_tr_cboED8-u;w}tFaNjY3k@&YXa8zUuU$ka?h5dGW%p8Q9I8<9| z9f;&w?If;F^l^V2`X+Qt>MT45xHvvpaRJi@f#U4BnW|)#20_51ONk8K^*?%`%J(#x z-9d6ZhKs_#bi&0?iv~$ho{lLbx*BEF+9+t11SNxn_y5B<3ja%x5Ql7egF(Xk-#Jga zMRtt&3he;hY$FYJALcL6bvC<3&d#%^2e9{fPsLuL!5*HnME1HRM4H4s+~EHhOi~fI zW`lpaFq!xLKjRCf4r^i4ib7xbLu-md8w+dN^rQ=(?~45;YM&%41!t%AtenggGh{)7 zT3>h?7{O6WslLA`}<)o&quInwPj^d&kN`~te|&u(9n^cA~x`cno# z7PZSLF^&ODCOSS!?4AMC6}D27lN>X*i&A8HUfL{X?z_KZaq7XJ)52X_qZY2c#5(I! z-#Wt>w#duv%~^N$sriMNeVSTB9!X%Ib`$_0wND#Q?`)rbNc^` zk_%znZu}K{)+{%i>1ZuWi`lpM)v&{Leo&%89_UV%if;}!ZfCO^sRll_^4_cE5F6Fh z!7446+v#Tpd0Rs`AEH6N?L>pqQQv(EInhAmnyCpG3qPu78!(@Xq%G%K{dYGW@FzpVOnWdUz1uyBg@`-xQCx_~^IaGs&SI}sc*elc=N!Vxi&?yA!4o%1 zq|%1JDjReoQbgLDk)nZtp_w)G9!`IoQFaqGE=NmvOnY0kf)Qgtust2dC+&7u~e|fw1k%DH*=wDYyb0wXi;b?sMx`G z8WoEiI8TM0{i!Ezrz^#KvsF=ItGIw^EnnV zoKPQ`Zo@J+?X6HF|CSqef=VS@|T%Tx}OE!s? zS%d_({lqS6nba!PG9B9h0-d4qKl*qzA&8qF9cVx*X+J;u zw|rF?(uAup7P3KcQGv=b=4U~0m=#eHWJU2G?N`mh9SCdutZ3{6m2%g0%O={Lxy^HL zQo6<8B-f|dO$Cl+_#B+pDN)#+eQ0Qk;s3;&y1;+aXczy>Pw9+*zjc2WO|Y7PXo_nB zGN3(lij(;pYO`$lyHt`|K+ABo2-L8+%7o^0mh6p)EBgKxs(^}kC-H0L4Xq-Woi^>7 zej{&pv1!*gCn>?Cf0tmF15|!OAtH2Q<`IbKwVr-KC^5M$%bO62WSPZKN%lmhtng8@ zd@Q>{!F8t(iSr#AWu$d?Qh)lwcWUrr+#Boq2+~OXW*!K4`{+P_?hmr>cyH}|iB)cG zmFA?nVYhwyID%~sl9u9No^nF%CIit7+7xfC)?}N58-m{)ALxe^-O=9K{cJ4eg8J;w z3uAbQ4eBUof!E{4DJ`U>U5=0G5gkQGiT#*a(kw*RU;s*GVEB*?~x*^||XnUu0Kh0-Kpj5VwJYvOFuR zG2n9vTzo`RrV-8C3(QCxg%<#0_!k_hUW)yIuPGietwy7n3F4+q0rpZMPiaa}cf3Fv zOXX|qJ9-f3N5`7>ct`CK(yDp?kqUsucK(Ulj=DfrCV!1E{?nc{dOF~6FoSZn(J-3i zCXoS*Cdm;eQfwI~?(cCEcCUr$E5!drnNG55%ag{HcF=6ko~T^a4EU(AU|CcEeBoP# z^<}T1o9ItjXYT;J_wdfW5A5zeyb511os81ZedrbMJN#eH?Q~B+l?^k9M2Y;|a>-{q ziPKTYe6GAx^M`9Hd;5{ViT0Y1yUvdxGJS}#*Rb^@#3$&mR?>H4)_7|_z&)Pss|Hs^ z$zE|HdI!O)@Q}~LSKxBUPPnm0ggmy7Wh8zY2o$uR5ZE}1eEw#QkvY~@yF56(GnmCe4fMSrYN4!Aky&hJ$=1n17SiWj@;gJ-`d{x?U$2OP+J2O$Hc3G;`PDFiLAj9uCBaKvd!XY zYke*?1&S3rn1i<`070X_h$q~m1RBiVEPrE!TRx96G=TE443DCEe!%Rrl#J%CN{#y5 zfHU6b4$aC0p;t+5%1=vZ`%Z|keH;Io℘gKlT61+PlCHC0lfnn(5$cM}u}?D?#3upKV)l^4$8TJlDqcqa57mYyA)H~3K9uRR$wP2%dt(Pf-KSf*mBH zc~7kpOPEAcw=p;eI_mLnp)J;aqlHeMSc_8^Q@Dtiv;<3dk8A{?iZK&GKp)@5QHWz6 z#74pg0wjMxeDwu#F_ERv+uV55`CA;%k2}$0SwfG#(3%eP&!XYc5`~b|aB{qA+pVfa zm3mE=)D>r6?HFR_{POx}ulQWITHN8qf#gfWQ*rq+ty0fn9_KJetY+MC5Bl9Uz?Cme zhu@KDsnp&{x(Spf5V4)SG4r z9;dHz(jx?eOJ6%U+ZV?Y>FbA35`8^(24^UVz9zONgF~mUyS}FV^L4yO(3i*1*XQ-E z2=|catIsv<(bp}5|4-~WTGE`Mtj6Ego*r1t>saW3>;il+~Z~<+O6~xtW zKUWR!#Xcz)rSRD50~^M3z&qo25qh7IT3D8seW ziQJmht?AMHHbm8dI^#Pgq+sCF#qsG(fq z$;U$r;$eLKohvjjuntE2EVL4Y@&o!oO!Hc#d1JFql2CBZ*dhe?ifFkK0}m-^Q&1rGxPx^ zp8XbH7wcBAE#@}C`$VbBQ0^KMDfH(k80|NIl^|`f)(|x=JC2=iatWspg!2-%g-Bn> zvZ9mn09u$4ZRyWSmvHE~L`oIh?=j0tA$cJ*Bj$}t9bgEDsx~t^v<>PxuzuVA=Q#ZY zXSG8=`%b`+wf(%Se|z-vK%9OcFw7Pt+ypYI$Rsbg;U%J1(z75iAV5{L?jEFAX?Pa9Lz=n>e-~F9ZVqIU()K3q-u0Q7vaC_GhOW%(f%9t&Kj|mH#|nf*!Wjtep7rrt-n8RzJtECE&beN7^~w+ z!EFCE+F>}bDfBrir457i#C+1*ZMiipNFyFA$?l-dT92Ockxz?*vb!T z8<}_QVIAhJy%b*&g+j*?=c&-Qp@zTV^+sY@*(}3`R#7m3f6uNOtir}FmPXvonPvGV z%u7YNqB96%es0A_Hp|FcxYK(Z}0OEb3TCcI-(_x2IxKhE5&wwqxL_6APh(?ys zMatq8YVSa{FV?nvf<%k;TwR3bWPW=M=h}m}pao3lelzf@PEcAu#ZG23LMd47L4*au zm=%>KQ1b&oue4R=tR!}%WM%j+!!32ln?JnS3=v6le~=>=dZ6{O44$bTU(f*W-FU!& zzR&|@CN7ki4*z)FPr*{S%u}n59bGf>@TwzO-^n<41h6>-V^GTmH#f(S&YW+nQt`GA z-`3%+MW*yjSbPk>t0ZP|#fDRS)+?P-UOht4ic=sw8m+$FXXYYaJYiM{(s&SXBVyFl z*w0D8MnqV@4mi@Bgo3Y(bDG!=R>h3~^7|!}R6g_##94KMmv6>PDDt8r8 zC$Nfx)3_TPdC-ngjyN8Gwt6D^Qa@1SfiS^ndWdQbi3M*Uy0~_LZ~}wygsmx{``@-g zmzqgp5g_ytjB(mO@2z`;BY_L>EE>wDDj1mVWyTMLei;_L0RK*`>ZT;L*vTkCEJtiX zeBXD(26%U~2;{dEEw~^2QxMC;pK4-}KHDM|kji4VRG>~VFjm_B)%c-oDC5tJodD-l z#<~*3A$Ut!!BImZF!b8-Om|>RjF8UsaX!jm5$B=ef6SvLf!oRHb%B-#ZfKH2K9|P^ zYy7MpsjUlp<5q>fmmI}#-VgkQqVNf3TiX_R=6OHf>4xjb(QYALptoxL1&14Zw)I($ z24cD0n7LKGf(w>v8^SkTD|JfPXOMjl7JeKEm)-UtD+Yv5$Pcp+a~=GKOe zwW^gLx!FmGGAS;{K1ZQL{lj_2B2Ip}M+@y4}@Ih z=_K7k8b1(y=PZlU_w(nsL*Jv00{%38=O5dezV-TV2LLqoTMqFIVF0wyzLE0}4fu@X z4~zD0-Fo34s}_Px|AE*Jkw38Fy>-j+-50t(9Xo}0>7V)dDWTAjDd4yf-!24nMMJCR z`yywh`$F@xQ>x$}o{}T`_XC4?wRcGH=-3Rb1+pPFzk3(bA{#AX{`X;hxC*pOlQ!r4 zb&K{sa_UL@stN$Z0K_sNzG+KUE*@@^9=daT#E<5#&rb0!T@&k2uu)vos3__je+A_n zV5? z-&yx+7T?Z6IV1L7z?o|mlCfn5U$+yIad{S5%3SH@vUn5scu}Q^4FjO9(t&+Wyhm*+ zzNm{Ri9vv(SqZ$!sRv`3;v1%zwb(0s8x~oM-4rUS>P+jlK6U~W8|>NP{~|=U2@+_z zRm4r%nYK!>vskLJOF3Nf1g8P4hVzrhCyXaJ1Hi zO8Z$iD4B$$P*}i^9R~Y&8|-7;q~n@DsKg*Z3j)}_kvlHCpkJ1Z*F{%VNebg2DmkaUIVWfb>wSF;D4n=_ddfZ^q=g>6sjl~|s-LweMoDWFXW$$DT)VdR+> za?1K_7(qF(eITMTMp1ykcOYgqru!bWO4;5bnW4<5_UG(f07IXC?^)vljdxVLljOw)_h~&;I?oW;PSwqQ2!XvF-o!2$ml)zJLdJ?^cX0r12w|!k`#!3J zl=A6sTrM*a$VK#^j?r?%?H1;OsXlDdHlkbsx%iJcQ zdPJP)xBl?dbV?*PP=j8rH~|=Brm`G}l8WnaZ1Y5{24ww-I7P^QMk&@{C^R}C()2Q3 zzVGXBT*2MO8w@bRbr}36Y zyjdY9VTv-bI!mtONtmgmC<5M=$UB(a$iKP@k&A_<3xEVsxA6*2gQTpL${-Pf8N=M#prI*w>QU)Re?kCr>RV>T+XJi*bzthd+ z5ICyQHkL*rOOw>6y%JuX1x8b)_@`byUY4LgYyl!6U3E42G1H@CL~k5OKcw6q*AGj} zI0J31{|^T?&HCTlmVR*kdw&7XCHVKWa%hl=)3&x4|4chjiI)kQA<_7s?P$%gob?co zJ(XZtYuNhXvOd6m0)@mXDV2QYM$I}55JMm!T@3K9F zmV!zfx)n5Z5odx{Vgm@MNCPxqZB5+6CW7HE{nRyar9j-o-Fz)^LlgH;mw=|dwKHhS zih=t(Y*1MPcRb%(19#rBdbB<}TJ@-A?gx$n%dC1+vkV4^fr_(UTelVDg;4P+?59d% zW2)f>h{}$MJ#lH*0NRz{Lk-HcesA0R_hy*JA@sq9J1=HaIKip42k@Jz?v?iR3s-7@ zh}y6|8;DoCw_NG^+0?vJ?OBMw5^f>>w{^9KRzWN0!a@8C4Y$VmXIg1H{IjhSP^qB@Qq>wW=isSbd5 zMtm*2V(bVofGoVQA05yvl*87Y`=zvNT%Aau!9wgZ&O(S20U$QDd##CMw$Do?1eE}$ zuATr$R3Dm95K5JtO=(Gcrm=orPG)Rp{Tz8F1-;q;YaAXf^44BYI70hz8sRklvYQ~X z3}{rc3ZH!yNx!!U|VzxI&eJ~$)6~emz;+S ze6UB|$YR(@EvFyjoo?}&G6r`MwgIgl!z(i-ehi@(yY{0^sE#lexuzt!E_4{|t9b2A zZ*iXEwe?Ui1a1o8urJo{yjK%T!Un*^P=3PZ4{x*d>3vaP)_xKARSJH>jv_YXOY zGL9<%CSYA|B;sODeN_Ut79rkr>m2Op-xD6AhYWeD0L*p@F6>U!poNrL+`0aQa0B-= zovd0$f)q7*>zc$0*LukpnUju<$|~$-3Pjw@j3MxOB>jW?Q@QNF4wCtFeDsI+@ME6@ z{z2ORrNTAWr3WIN1Chy@fyi&O;bqLH|6}pR($V}pAHF%gbFmK=DB9|+E97fv-X=3n z91GRzm*Xt)MJA&|So3s90s+fW3cq1rioaUI35@D;JmpV;e&?>&oKAWmH3Ne4{K##Bc8v@e31pa@vf8zm&tW0*7Us=;Be!Hfxp=$?hy!W9m;-K=a=zw4pdhajn&=j<2qlJPm7=hnh1 z=(a8q$?n)8L^Ae?^!dMl+3E!tEwGLZ;+^7)UWfk%lbNE@>FWgH*WiJ~v7LV%&$V+v z2D8@^LfKr&ahX8F_GTXclH6?PVc~E zc|X3y+CSUyv0lADF2SO2MI~a{4^6X%O5@LQkI;ea`y6bM)27dXTzP&RNwy99e$;-D zk@5d@Y|B2mG+ysB6h1A)wn)p(`*{8sp57->kh=lTrQ(aH zaK_+f`W*SCt#P)OYBufbt2#?8aSZFXtg=OVJe61&MmQ57@g#!g~mPIQ@;1 z^i(v`_p-!B>Z5~n#ULvVNvi1H#Ta@i6VRpdx~V_V$BH->@6xr{+}XSYVIqiI6}Th< zh;TtQP3R1eHlt|0TCkbSD(7&JKq~qVyi`}1)Fp)!=Oxj<@ZAsZCY8Gj?@Tp`?PKhWv z38nG3ECb*~dVk{AS3L^F+(J3;c(%WS-bYFAWZW=>m{|eGBXTgkeFQajdW}<|b%eq_ zGSK$2QP$h9v;e`!Of~a zTDAeS;(it+t7Hf1(MJ*7LLc^lM{ri*~COFPJ9I>PK-N=m|b3lI^S?St;Txv_CC)H4MfP*l64sy-8s8jOqlf{K3m0 zajUT*nWR^{%0glsnooxmq!|=uhj~*zuPmJ{OFa{8gLi(gkd& znmB-nN8E!a9iA83e^{`>7kUE{cYmk3eR=51$+&(k=nv`J5#MQ6sBA`E*8wql%+`S- z@7{wVJ^1!>k8su<6EtT@$-%NzL<|o7H$2Sk1~tNzaf2GG@mrS35a#9TXtYkEEhn4f zlc)*#hmW9Ze9%}>*N~ZkM`M#+cqMQ<|0N#q?Qs^xMh}Yp?EsFPT!X(n-}@1^UF>_Y zIrS&)N#}A5UKf3b+2qsE-axcxtQV0&o^t$WnNC|}Cm+DYl4n5}y-_g9>!b!P=h zNHQ+9*qv+;6qzGf6_j$!T}Ez4_{o$}T5`2`&lv_pHXuUhE_rOP5oBxwav6~laIxj) zM4vQrjk1mZJCJ;*^Xz(v3BmWZjjQA^pExW7vr-(!ruAgGhpDO544A95%t9gTma_iv%|3dbi}xN z@=hSe$$0EK4$a;WYjPdnc?GK@W7bHH)>=Szn=U!LQa$v87J&k~HQF-X5)o*ZHrkO+ zFofmMBnQlarK(gq8!&m`Q8zLQG`JlF5F1&GKj078b0yw7niHf?=_>LprKMS)bA9ct z{R~C%3!bQT`q#--ME8hs&={~F zgI{ZU7Kng>QYM%CB@o`=5AO=#Ry%YI+ZH*N0x&6Nxr*r~=~xNLN(g($rRhn9VVc z5uaYJYB`=Q8+O1fK!f9)p%{3`$3r21U=Y3%tX?q=AMDkPyQgUZSWZHNankAF zL0(SkV0QinfK6wF=i9kpTc`JqBHXn0#ltY?aR2$qS}L|I+?G`Q{g3TP#dBInMJ*c- zCLb#Zjak3$9?_0`T<~94K348-TRti+A5X_h%B)}OF<@F`9Joz)rsbs;BUWIUo5PHx zf>=2vVcY6tu74QRuv}Wxfi|`^+d8bld*|q3%!DcUKp}?_B-vww2Oqo2xa<-Z`p8|g zK8y>`Xjn+=R{UkjRgI{tXV~Y+FTLa?c&TKL2EvozIiY^@h4+bk*zoEpcmfluF(XLl zHkOeD1Mbz`t!5c@5$ztl=0fQGU!lcUuB7E*mLOb>$eN=}ew4sO!B)^9KUoC+XpnC# zGrqrqN4q}4Cz5y$*@)_(HZ@fIqmPOm4Nb{ZZ(>76HmMj$FdFX+3Ut`pKsr0k?XOd^ zVP7sVhVpWPe5Ux9jhYFMh848TwmdpdRZ7dfXyW+7=jM4|9G83Y3Z1>?6d=qv4um@v zttW}_eA%dBpnv;Fbf9jMEx_rNqgDCp_usco{}cdu=v6$2eJ<;Dii2`XnXX( zGfw|V^w`$8r0}qz|iFZx!L>r}@wi9%$mC(63bP(@uPxGIQL$Hi&ed~7w$`b5| zPlSG-H|p1{Oq{F{0&Y72*o`qw+0v&=*=LDjZ!ZA*lvFi^_Bq$r(gPay~aN>WC_J?=vc4dw>5i z0U?^s)4X+bA0z)m8rwE~X@g=YcA%WBW6orLqFBJa54v|c-pDN*jXs<;TKgc;^^r+j zAz^nMqk7^=HfWZe&9~AKjp9;oE71$dLcZ2r4M&tPPt8F;9|7^{t7`~OK*%#9c1#N~ z;M}yORs1PIZ2N3L%&Ax;OX`GP}XXdFtrzflxCgjCNNfTJpHLHlOyp#K}@ybgRD$h!;OaUW^d8Tf7rc`JFF)=BnB>OCbFYh} z72b-SwvBK_`(TPd#A4df(4xK1+q`LrOVCcxy#*|-jbwnMI_&BMFXM`W*58wu!iv@Td)}D^%hXUBC z-2i5&`0>#M2dPEH3tg73t^-_ThC+!1qacDfAYnV6S6J;jQS4HBT5iQSZ{|=)|9t$N z!&~Jm@lWQQ9R9+Xr=hpF?oWrc_z!Z5??V`Q6^qpMoty6>?{%Dze zy#UjDo%+3x2y>^;!wcduV$9!488J69LJM+ItBUa_Kc#A@*kA69B4}+=wmC1YUS|!! z3V`F2immL8Jn{hKUxcAA`Y{dib=%`DW;S$vPRhK=m}fLLRL)}{W)Am%l;}C`f^8TH z*rwexrI2P1aPam-7Y6`RlQ52=>Qfb%d9}1N0=GCLKt9X|WCKKcDz5)#e4WVKlp@(t z-alqIS@YMaAQ>@TLpwoz$Y#k#@?8GP!e=;h)LRV`atI#OExCwSF_nn#dbygV zmDG&CNVq@Y^fcFg+77t2{j`k zHsce-pIZ6W|C(P)mj^0P9OPfzyK~BD5m*?B)BEwMxa9uue%kLsodupWewX1lV_1mu zxSS&0S|&EU)NHCc84u=>OpSK}dQYHsbo_$5@EGugwnpTmHP14z7L%$}UmWmC{&lRW zt=GC7FjgQ23y~#FQdWC`)DbkAFb`$4W~6OxVia&i?b<`IJ{r~Iuxa&~am1P208G-x z5X&qw6o@b#6l`pUQzO33yd1q1G{~+HkC1)_6@9@-$nK)QbH<;~t-*IBObiv@aw=6k zOc))vfcuXk5Rzx5P)O=muEADL*Uh$9NvBlx73{BG9%SKV{7SS)f0zwHdix`kzx{3d zdgO@j`9StP^rI+DKG>TA5d?_KY@udq) z(|o6O573 zB=G31JrZIDOR|ya>RfCanJX8gOuE3RNPYdW$Y**XF&H0P<)BqqtaZ*mbc?(eaKzZ; zbVWB~ji);HqkY#3wN?QTkI(>+pZ`vjM?^z*^p?20gU9mVKbSF+s}fU!wT9b~5H{ z14Mafp7gi+>v#oq&E*<^O4|hX@4n}EFmo)Q?cat+w3h3Re^kpVYL=~GWPm4|@r!dG zq-gAV3WXSVa3D%xpMiZ4`W!o6?UoG{yftfdY^TFcn}hk^Cmo}ZKRk*q znlj$sCS|z|247J&0LURE@Gj5DgBurksK%C4NhX}G*;otWzjJfQ&pK(5T?2wuAjE`! ztiv@QGM20bd+^^mdifWBMQo+3z;+`Jq8E!1ctHNYAc6mL$ZT!#|Hqg=!~dVP&Hu(f zbQieH_(uu#0sTWJ;3qNLBP|(O*kk|ud@TrS&PkF?R~~g7i0IP#9MnGTMO+!!&}GT z5b_V^A0+Q&{8KjL#kC&K-U#`hJe$i|KR%lvib8iqk9H?jVJ$G?FP9KVF&4(rSp}kw zjl|b!^7XHm>aQgnf{$NIV#ng^*;N;#?qKt^j9<(773PuzAE`ME%E3L|r|F3X6$+r{ z(jcaA))aR@7?UqgoO})hK^KfkWhJ`g4F0ry+qVl7;dpvJ2o?Lc`^ak~G98N|lamyS z^1}Zg=+wKtEmI_879$1QW7(tz|0_{jg8!qVS~yhWrn~$)5dWmii1W`l8LE&h2l;rx3pE*~;1#6T>~LSneWcws~VX6X!B64U_e{9nS&q!Z*W8goMO(&?Io zwxbN_;xXZsR)^rSu&B!jC<|LP(AnYdy=)hHd<=Y&J>O!7X#7pl%o z36Ah>&=wWSw!9Hqo8_{lZmh2OLEoeW!0IzmS#_nl!F+j2_MOpzyFfM)#bHUk^_%HiI_Iv z!+gh(xuAqYtFMA+uh(sVkus-?KGqW*1v#UC#)=Zh?i$i$H%ug&KEU`Ps47Ud;H z5Ae~>d!Y-j_#<^;NuA$4048Y|Oe zf`{C|0l#o{Cfz;gmmV9DM3va0D1pv<-X6SX$VMQtn4uVf$n7QggKA|cR30k6d!z^0(` zUpk3s#A;3t4Xdr0vJImji84V6{BUO7;5OW84$yR*`h`lxel&{=nP`sR%Kw8;wwwYp zN87dGH3{;`Tlbobnf4C2jzdBiDON>#`|pPHISLbafWEil`|3$jNUze>g8xG7Yjf#5 zE{;qV1U96zAjl*bnz0L_%Z~%1My~+n=qw0Q#vBoYTj6img$#t#a71k3U?9(1dzxMh zAqPSLdq~)QqY)(XKZ?{g=zk^q1N)`U>HI3ei{TPtoEO2i!S~UgkiZke=XC<7nc?#^ z$@e5YUp&QJYVd8^NR=EdZ6JSW&!nnhJijn0h-?nz5;r~Bub+dd2cr<|vtHX1q!{f% zpEC*QlSr)IPvQo7Rd6a7lPl0LMbJ#bOHh2_ zEf#TudjoOlj}vhSVECAZFN*0p0cT9Jf6ex^iQ%+Pq2e)vfH~%mNCkqlasI2hv|9)8hK;y(2qg9BtWu zO~9YA|K4w{zu3Na@qg^nFSN7TmBm1nFd~E(8MawpO)Q0SvLGP zWJ1|B;SE<`$%X}{K|B%?^CBmiZVy8G&5{}&SOe#Gj-n7{Ka^(dN89QB)ECl*{sxDu z{hVZ;6B-|k5r{2Vm22e3jwDE?M#K@P}GJhoBAE{2)`2(N!MJ|9a&RV`OJEb&o zOk`eWbR1+#y|3AarAJA2X#{fdh=CYy5Ro6gY_$U$DF|J|0)y*_>{7V*>pr6d4po;x zVmu@=xdaj$79J`H=oQdM+hV<42)S)$;ge#JFoB{qUgr&rxir#qV`*eM_QwN7z3=UP zG#V9^2NWPwL}C{ii;O)Pe`G%XTwb(XLV=BN3$XTd7U{zz^{&x=+v~aF|j05g3F}4|@ zZVxO%sM}HajrC!-pK<^8Y*IcWWd2zO1Z}v<)cJElowIBm)yOK3xK-|Dm8G`I+=MEP zm)evkcd<&PTjg?Axd>JK;oX5gpE7yPnUUE?ru&Qj6&&h!g1M=sb>CEdLEjqWp{G9* zMya7wX`J%~L>K8-%kOTK&XM4enb9=-BEx7?nzYRLiEW#V{NWN;7$7^kBkq4n@DK6A zTVvd6si|EYjCj#{-6rsO#l(3UKQrV=Bheb(%adu{e4!1Q{^m8_<7@B|XU*R6-o9K2 z{-{#!^(?{f(TnD1ezCqkoa7+ftN79BJ?x&2DW$jxyMcV1$8&b9kCSZarI8~7k(_`t zJGXqixBCq#{3nzDWCxsux%v2YI{v$fuWkabZ4O=)2yYLBw}@X|EqIFYjmA&cLgcZR z<>J%>|2wwIGUsudjC*C7^RoF19RnECd*&(VxC&5ZUPlnB@K5G- z+5CmYqUZj>o|Hg1rh1mSZj3kOM3^&T5kAq}+bR$Y_agqaA6cP07}1-q9!8QQqp2~g zJUV7vPH-(Xu?p0d;2p|uyF6Qz>G?unEztVO-OwQrBCsmjnbxEzS7Xs6n|{4*gNI$?Gs8ll)ldkMzWWT*_w=$rR1!QY;^-AP=TIWW@4@ zz8E}}Z4g0L`u6BRWJ0#8-$6t`EHl389KF9t*^DgGO9l4m)go2(0}g@1h4 z=e|mu^YXzahgpyAv zzxK#qy=zBi-zDE)F>=j>>_a$^OW-^n!pZabk)jqnC%hK^4n`!{A`nJaV$&Y5z{O!8 zjLgS+eeEyW?7h7wY^?xza~0YujpU-%r8GVk<{~9uT?#&u0DOMXNG1_p!e5wAqTcbm zJsbv9UYN4NLJJg=u)<}~l~45{Wx%B3%G2;Y;o*2<{nYROL)_pSH?YlT>QY-oFC^h& zH3C64x3Pv~lqy9$%qtirh&FYy9z|3H=_63Ixe8~B8E!QwR6JPvH_x!T@S0{wAiPce zfPD@L>ze_aVNA9^G#@MdZupu$x@Odc-rB#2j1k9x@n_H?iEx7qt69g>12(EU^Fguz z!;q>j=X6&RQcj+jFX+x?9Mt&y-yNa9mp$?w?9-(=L=21+E)D8%2pmP>c8jE&{TDm} zCp=5w7J-W^+z9>{LgohoWS)`45z8fB2d{2EeLwCWA}Bl|-w+!w%u}rfUMdU|`h#W| zv8QVUL>uSc`<>sz)Zj4|9~4xz>@FfOS=BQY2v$Oc92%BG;=}Gva)8p&wjTNziT~zj zV!Irmo|~yg>F$R6*qsf7w<}!}hEb@pbg6Ep)IIDQbiZ6+@MJCpFZY(;x&@n|9sITI zVa?Do{3M3XZ^h6WNp!hb6=aCi(o+kPv~(4H625NNk?N16A!DTm1YXdv<|9o zYn*~9gOGujNWs2m=z=YVI_?7u^`th2s-Au5*Jkw%dl5tL%LyH2e_>md5iL2K8VE7* z5o5oAiU7hNh88tInYyD9RUvqCXh`L8_VQ)(fnvIZN)93)<)T-{jVov)t$$Wp)2glY zR|IPxY)POes1zhj@9GP!&4f-7`%X;$uPJ7njPw(EcK>kRS9n%>tkdY1G0c>zO<*;O z7MgE_9)QDbPF+DfHJR+$8 zbje&e9ypaAKXwK-z1Ou1=pKFFdfKIjuOf3Oiaq;i%oIdEUUiXRCgdVKA zfCXm~K3`k%;u%y?v;RbKaoMp(T(Eo{RHjHcC76%+XQ>DQ zi12&8VyeI~t8Dcnwq6ofOdJgP1b=+ZZ&Iab}0Co<#*D+vFu91&q4d`|>*83;0jmzt~;vb9o$G(NkKTR`4 zEpp)+DZ_Q*Yhg;}zzCfCTS?aMI-WL(o8HB+ic9K1h#Ueg{u0$BvVe^ZZX7QGBHW& z=jNZ9)#mdp4K$7hKG#(eu8uwjwrpHV4`w0ceU}tO_+og~+JiaY;#I@{Fb8!w_o$10b4s``TqX0)e8vtTKd&K^lGD#t`oOnMSE1xwDe`FOzRWOTt0qBwUB^=EO( z@n_3gPQAd3U0jT^5zsJJaP`sEw6fd(pX7(e7OOsj(|?3(f~RAvj8Y&+{@#|Ghrghs zS8{Prl8$rjj%2VjQnC|DAj|feuRDdlI30Upi>i^|8tE6XDLR4PPiETw7wDB6Hp)Z% z<2R%t9L{_Mqm}p^{o5Drnaf0UoOg+6$&?>X@4<(qr4%$5{51L{bP57Pe8dkx36u@t zgIG{jh=>%kBrHT{)*RtsAm?#6H7EyXAr7L85V+T>+5}y z0@&4s#{c14v=?i;6z}gZW<59yIbvQ$tU8Fyh3$?9OyjUc@Jyd{1D&lKvM8R8p_L`L z0jIMDEqWG4poaTpO166WBTk(zf-omrigrJBFybuGC;rcUBg8T|S$>@UA<`OwGzk{u zUk5RS=DC6s6G z;0HO5h+i;BIgY2VE08LW_AoQsQK~@4U5`{qsFTX?g8mURuK+JZI-zp3gRb=kuy5Dz zpo$IMSoXm9zbc<)H2yOIySiCqjf?;1c!TiM3yA+SdbYwpYgo*-!2igt8viVENccaD zlmPr^8+_*&{M%=4*%AMR_zVB$FNydk4zW0>`^j6o2OB8bG41IO`Yes4(=nZmOKmU{ z-yGq_-vd97XRzpj@pFkZr}0xx{9Jq<#sy*}$$>uayb<`heLnHizeg+lutq!hIp#x+ z9~LRiF%dTBWDMAl43rOV^pS>MoD9)?T# z(rZQ%8Ur@~jb~g>G;Z(S3XQDP4jQ*$bBAosB8P;=i^(b=GoL|YnL(p{-fqaO5r0+I z&xu&nROY4qB&5~^Q_+yxua~)`_9@>wS@%Kz2$n`8(xfG7m>)>XzrW`4tEMl6b3*=2 zPeRPFg_M8QBL6a5A%->DLCnkVX~eL|At7cXB>@mK(;%kOAjUqIa3KZy$`kt9_hW0! z2vT0mAxPX9^4xN%i)ZAJ>n%!J2 z^edrG-l&J%MhMb=jl=&P&vrBpD==KqU*$C! z(74v1ag{-1gF&Nx&Npf#8-LXcyNN}k>q*7XwnATO6v#CCq%!KQfXiCT9$ z9$-k7l{!AXe^!d4B8zzq3|!&9$xd3yq)1@Ro=K7O*6cz;kV%noYZPJ@=3YgHQosSzf1Bw4^84m9lv6>sT^K7v@l1e%n3yvg_yx&Jt> zNtK4z`1O7$yO4X6j_U(#4R}BcM20LmT^IE4KfP zeUW#eYhN6N4MJe+)x(qQiz`?+{FdHOIvfj?D2~6f+=*RH>*J;MWVN8>r=`ymq(9BO zWf+C(aCQ=X4!e%>Z?4F{F0JU3HQJ%imt`O1{#+J0B>D^w;%E?;Y3Osgp-=lPr}ZHJ zR%!XStEK#-4X2$m1r7Dl*Ruo@|F(F>)u4bh856D&IEICd0Luovv>&G?p<&QGprQX9 zqM_mNR%l?IcF^$LJDN>dmgqLQsFC#plXEKT06esQq{!$u;>S3h0`kp9M*u;SQr1 z+l&PPoutfZx|P7o!b1z5f`(}4?u0w5=`h2+w@~9#1R_~X@F@H{Er{T}8jK2}lKD~K z6k~xLh*zw`b$Swt*OHXz0NRH56oB+)cNBhD-lS=bHr{rTD_tbBg{&W~e3&3&Sj&fW zfULeKOPci_b201Pe#cpVymPBrXN`7d{XWUfgaptia!9j2;6${Ak)#_&$TYKVpK}aj zaB+?Jf}Kg6QG)e}Png0HoC#CxIL~DY7>h)GR_8?fs54t^Au}xgEq?Y00yTbo#LwEv zN%;BUTHxo~tBIdmI<>+NYqW!(`EP2$!6Ju*pTi7SEHU`0H~6v7lKdK6u|(wO>R1wf z?D{P@%Lt6Wp6lY~Z-Uqie=}XVIC)0|LY=O}U$s=kFzzD}tllp#8Eyu>gK(F52l|T0 z8ZgZK92%WRnqJS2_qu~r4*%$W^a{&Nq!KQJ>X=6O{P`hV2xB2U{HjvtAR`n*908Fmml*>;ev~9fedoLef_rpwKAcpm4pjcnb@ zPawX<5zHB1!CCy`4dfx6G}{-({!v;-vf$w~@;F)M2Nb|e@1rjmQ7B=+(~WE(T+Rrg`+h(pBiIOFmVV{bs5x3B4ZO$( z%z;*7GgDnAJ2HS1kEY3$(quM3$$<|DQ)WT&LuDbX2KS3i0k+2NxDDu<@^k+ZG%<;OJxe}M@+c1VXMnH{Y=&?epW3UW~FZBdh zc4%PK6)2-FQ}nvV3$bg}^aav9qTl(5&+&}in?R~g#w#iCa{sRH{^sc4vA=352KiB% zQ1+^3#emGs#6C-SCWfK?QVECjv26E%Je)>;XjIV40s$ zat=jxcZf27_=iBB540e;v;Z#r^%Np=Aw>SIB~%T2c0Aos18FPOyx(woU&)o%5F)%0 z0z#x9vp!nPpRJ{c$RzM5#nSc!v2_305G4Igb3);0?gVVFYnhbIjrO>-nD%PB(js(f zg0z@70Pu;ln2pzJ!#N@?8ulbi0q+My#0~MM(TY84%xVMCMzrd=y+6zszOm4S-?s=yed)h1 zrwBk47P&Wt)H>!2APEn<^i)Y zrK>db1U4?_>Yi+T=l|Fzwlwvg0YtiqtxR-Lz@rLm3GT1#Jv8mcN!Gk~So2c^Z}&`b#oB>x%x_Aqv)+tF{E zkf7YvZ|hIA6#Ft>tE_2|Pl#Z2dQbWVn~qM#xV>ioa7I5C+^Xi5P(^8U1n4IMrS6i^ z(q}ve#5^B!dn^vV2D#O^5Ybsq?;EjHLb&kHCvqbb+xRAT_=qLxeaOLhDL8)*CcMx%`h~A`i?*%jca~sq`WX7dzYc> zGtVCV3aX@x{s-tPrPMp_KY{S0a@GM^D3Oa}U4YpT{|gE9>u#77ryR!^c%*ScX+MKY zAc`7L5fpD3H?A%WPr`=c9w&)b{5fE7LIS9}1L^=aUdsXz-KT~kQ1sair%+O{Wv+zS zTWMruY2?auY;AgLFB73RnUeI#DcRUtD;OWSDKq*sier2^h_}y^jkhyl@i1;I5Gn44 za;1?W<6(a2s3XzwXq!e!X`iqCYraT>L+YsXK+#9RQ#nL_VBlWe#;SJ{#OCW|6vW%q zH>3t*E&BD@8M1%OGdVKtDEKvixJ|&?8$SSRsl6%gG#a8W3BhXI1TaYHr_ay+H9G*n zw4!uh(VM~3187+Tuz{}LcLU)kbF0bujwcrYz=fn{1Ast8zxFf1rzVuB4}+c@Sy+@Q z1|MSuoZcxv2`OLyGt~Cd69_mL&v3sW5aRd)EN@qesFJc0yPwm3+4^V~DU1Wo1`_pk zKhC{m>>fAGNqKICUw=tLhTbyL=GRpDgxez9F492g!K!dyS8QGKi+F2E;s+nE%z zR3K-;>_qe!A}2?I{)4;XwnQMjMm>5ond^CDOS}P*r2WP+HK=Co2j-7**2CpW@F<9A z-B99UL)aI&5t5}LxZEEpr&QTKN$j)nAhy!*y3#&PJk2#Za%n1-ke>txmpWtP23i9} zKhDFTirUH{P$c3V;%lO%5LA;R<5HR5GFsBMeKwG*yf*B!Q`z7xra@}EHWzxA{}=M* zp=@nVQKm&3lb3nRo^N*s-W(dA0rAMby>BkJFKkyw0)A>o5-mWqI2&$-Sax|v-4wxo>CtGAk$KzLm?Rw91?V?~qK^z6@ z<>M>@R^qkl5+DIm_+6XB*0et^*8d=etJQM|QujL3a3&KP8YTfk7c-8->4?ZN+v&2!u~c@2Si8{y@t2W%1ZCm|uz1O8;8QFJOT!yV`zSs5^U^T*EkO+a z3=Do-)hArzi!JJSCZZP(esk}(2Y)vPpOzW>JwOMYI~S{v|gK9>eRPy?%=*$kTQ$+l z?tu8E(xSJ6MWxO-eIjo=x%eL4?j2)EH*cx?Ow)Xw&~)?+vFOHi$cz>nt!}jIYfrZ; z*uEW+E-39T*xHlO3X~sER z67T-D)smQXNT0j#w?#ie+->%brR|!Dbca#}C$*e7>`^W!*xXSV-*kYd~JJG!D zLwZ^wqy;Xd{R!#KV@bp`L`H*~Y}CGXHo4pskB{Pg>6V>x0IT|9coIAH_$}J(hBLs} z|BJO^Ce~<&neO|WW+oOnBxZ^-S_#ZlXqc(QFq3_jf129lCU>VPcDl<+ z!e5SO*1wZU?cR(y?p;RP^q*u#n+Zl64mur_P#KH{`69L3v21yEgA5j8Ywa`GeCql3MqoZMfw83a?^8Ais0DVW# zIHM)=yt{ez`s3|_ySrZkxI2!p;QkA*RUyH(*2QlCw7R^DCYiW(aX=HOhJqa?5ZqG- zHGvkK>Y6~bzoNTE{FhPvxv|}@^hSKM-Jf18<@Ek^3HkSgf+YT(Iu#>1b29mN$BtI~ z%Np(Q@5g`D{L3PT#J>a5HUCx{{;e_mYo9BPGAzemdftJN`N-^xBtUwsV5eVbG1!X z`#W@{p6DDG_mGdcPpMrw(}sWLJemK4b<~L+jZWw&iX>z$yOH$^jR#kz;o_iI?6Po6 zk=g$z_760u`~HQ#-tQD2RP+K7((XLJ`*6GSygw&lp1;em^SlGE)tFHt_4Gn<1Usoj zC(%`(av+Dc6diIhW@T@;_y7_DjAM_;QZ#nID_J*vfap#+vW|Gvu)TfVn!mI zJ%r7P92zyBL(TBg9punB`!Sl$NUVbst&&4S^^G7|)Ea$%UEB3b66$BQs{iG!2dkfw zQ2+f$TlW9RLF+eckHddgtNNE5w0=!O{j*!u?|abtB?Swm z#Lkvcto7DCiZ6@+!625%Ph>E}?-lwtdX~&L7%7@;z{?gPm+BP+1dK(*3-@E#fP`HB z;UkC(hFt18F&rf-ONW2t0Y>iWccn~$GZj1JWk8}u+?&i&fkck7c_2823xJ@+X0_v`{b*(`z-h=p~C{)<^d22nn$k!qEcc#5ZFxe z0GEW;;9&lSQs#4GuA8Ety|{9M$U~B}i?G!;csG`(rA1#?c}l~d$2#Gk@df{;6<>pf zXp%C91#IE1dy+q#iqt^S7jtJZp0oikNG>xGHxvlNg}KQ_l`dJ0aem1|7sL#Ww;GlO zS{mdp>o|kwqh}1lAI4@9aA@ceg>=}AMsKOJFc(Qhcce`Y_Z$@}{^mo9^kWcgay)Kf z-U|9xtCyKD)Twy0ZgMykwgG{2}H`K!TbQ z#P_YaVW>aS!yj3|qZdISUyE15uQ4$PT$}OeV6pwdx={}%5LrOX`I*q(RPW8-a2OFL zszN&c=0^X|*n-(}`smR1^gt@|wCe1xzGmc3Tbf&gvH+r!006hnCXt`-B+5?!f&8&n zeoD_;ejeshR+0!!mjHpG2_n?QM>(FZsIC52XO~|1KoyTYD%; zEt(~bt%jLSla**7Iu^65E(Kfq!|w(9Z03$)X=HYH!0==6WWO`bP5$^w?sAleD8FJ5 zgNJ@lLkt}9T1PKwIFOXCJK@la#dN|kHVF=^@-$U4&5Fz_Cn$OnW|jI1;s%j3>ItN! zj4wo@qY%59p8enHC zj)vHI35JAEqJ0jkpf;l{*4%jzrI z2lHg|H&I~Q@xkS?E!a1CfXHbh!7c%iHDwAC9K>eJ`c!RW#$rh!!=B18s5cL47_~i|WBZ>~^VA}W}^XHlSb1#I#GRm2P zTPL?CI(05|hR07M>q1j4$6KmistHUe5^rF>E7Xu<(Iw^@U zI~IY~R)T-^VTTmehoLagd>Yt^$a{Vbq2P*mj!%t6Pm-^0E~ajb&(HLikeFl3CON}P zAWnDf!q^aoJZ=|dEE4_{NaYOh&Mu|?bC;yFYs2FDx7hAhnBai~yNBQe3+I7PK;=GI+ zawc*oF>f&?@$<;e3xS$-WgaE(F_65m-fmWVPOC4{;d0&&W&0L!^fAQ|a?u`vfQh$* z!xF`j&PCe`&C%WY$gj+|WTBC?v}?r~Gchvlh|DORF@#TTTMhrR?IM9b$1X^s&merG zZIGw-PaI`<4@eu6t_JXe)6n|#^VbP|&Br?IqqeHbJMoY7Gxc*|I%2jF7|Of*kVolq z>|ZUA)^b`UIaR4>IW7oACd5{@>`2a=56FD zpc(1v>Kk@7;|j+HpvxwD)mo`%(qLjMEQSO>qg%8;fL5q&e`>nikA$R|mEinIV7eyi z($JFc+V1Izq+!J#v^}-`Hz9v=76gC*qVLzDoNN#_t3-;|p7Z?3n!o1j)BR4@9==V# z_#%b%!oQ(ka;`(Pl(rGD2r=m&&5Qb2A=L&{sXjO(hBBnZ#`dS4iLAX)PYMhswxyrJkPGilikCRy6Pv(MkKg{DVCzR@p~K3Il36qjVqX2BJ*n4qm6fRI$5=l}WWbm~XT&EzbbvTt zr*@A=6JcEW@R_a3kyVr4Du|nMpL0&L?`Nooy{Cu1$n>SI^*NL2C|`yKT)M#Be2Ap; z9f`Ia&qGxn>@Ut3O8Aj&Kt{{kbk&=LA3T4XMgbr_I3_JzvFoozQ&DQkk>RQ z!jKQN<9L#d_5pt6$W37p&vzLx(Vx%3?T#?ahWkSMQoVIQptqXBp@>hfQ|#FB%mtjQ zQ__g?kJO3d_B6l5hx+JYRNJuEWj25{!l@>lvrk|Vpo`w(b=a^)qDy5A9}z<=F8XbC z^)B3XT7_)Qv}UU6TeUU)RCEBykoW~9ki{M-_|HZfB0#}0YPDnR5RSBi1PG!O?wT9u z3*Xv+UP8rxm(qyByR{L|Dl9cdNiy5;%X~$V7TQ?@73O%ZlC0vq8O_OfElrNER3P_- zdT!EDwf+!-RF2N{2p@$U4GP9qF&PZnVf#$ueS=Iz+t~#&HZ7%E^54Co%fcF z(jTo6ENxH0QEpGCPH>*cmBOds@0?T!vFmVy$GTT>${vDY7j@`N)#Eg*i|QH{7W_y)Y;Yu<oIcbRKKc_hcjM4KT;ILH^2~c_` zojtyA#D_nj;w6nlF3@#nA)eKAY^;c(M;krFSJC&e;!$6KX{i74r`~We4-UA(fTWN6 z-IvWFZYV3z7x;>t?&da!|LYL$=k_lC7ML(HET4UqP-ywsSDEH8#sj|~n3eZZq7jk= zp;*W^7zn?ko|9vbk_ozgB}#^hmv0~+3E}zZcv-Rvuhmu9*CCc*(VA>1a+7pDKVr(C z{0zR04JUyoos0&);^DD#Y)kO{=_@Gme33si;WP3NqCMF;;)&0xzz%)c6S?E&!1*+(Kpi1g@lZTlHTKMXdw1rq2U zym>jHi}Wt*&a{0QQ}Cx=O??e4EmnofLrTfm8(PaG=yrpAhW`i7GUJ_(2Ag zZ-gY?{4LfjS4*f1G8}11jP&4!#G!Cmse6>b(+&IeN02Am0SMuFL|6L7m!<;~d8*l<`= z@HoXw9z!BgB1fIslyqqT1h$-5qt}W+Pjb?_0tc$Iff>YamS-SX$oBSOu3^U#>| z%?%E*=48q8%*I7r(r_Sx}YCwUUUf1UW4kC z96o{F_6yrYJfZBJ8jo--N6E2oj61qH#}2AqhI2TFkr7>n&vZKL(I&%J>Kt1Xh&(Et z%KYMBoHsNFyhE15Y;4CVI1t-qJ3Byq(f->f;UoeU3i!k8VaEw1(NpOcf@YKfApHDi zQG5iBce2oxwi3UgbPz!9QB(hkJi@o*A4r2+Vj>NeKM85D;259-=YRAohp%ShmE!(w zy~tfvc(oA$(Q6QSnP~m#{Mqvs82-*<`9jLh60O28MP>9;z;?sZ_IP?Kj)NS^nsf^35rR1$p3wXVCom~0>U8=sWg7`)b8f^b3ImxZPUNerL|5HLZynPtvpV>OY647C38P>a=^=8n!XLOp0+Cy{^94L2=LEuy2~LrMDx1D_{@K?83jD z8Y<3^wvL({IWHBinvZBdY^ycucT)PK@VHd)=B-Q|gYM|!*8uM^0H2=>aLp_LJcD5{ z24Gf%{o7#l`>m{}=Epnmg>ROooUF?LQX6nfmq=~K8(2!iJrN`^LmETgvEX6pYKSz2 z#K}yZdfs7Jws~HejF^x=_7{D*3*C#pJdu^Ex)Lnm=E~TS>W7eqlX{mN4$l>HLF0H2 zZj$v!mgI1>k$Ysbs(GD1Qcuq<;@!wuE1Amrv z)gtuhda!QhD<(;!TNthR!_rl#c)nD^`HkSmd(@eURmOe1MI*fBWDYKOJ*3e0DuC_XGw zZm4+ct9Dr1@vNS>IdNEgWp*x0d|};-GZho~MH)EfMl4JH;o-=!ai=uGdCW{#SHzn@ z{? zuCBa}E;+o{+*%$x62*_ef8Frk;rOo;{_9Y%v38??;q#9F$o>F()5OQAX^bu7mgi_V zWi7#<*a_@T1WutZlB#CEgMp!aeRrM+1f=`fR^nay2Cg?{llTwz3rcJyF=+|*;^ljq zqtCQu!HNAg+u$|_ejBWPHV1t~F8ZsiVDMrZe5F7hOhMQk)!N3Zp2>mZpu#rXs;Adq z_|63aG=!ONI@}`Vl`vGQ6*7#$fJpYi>Gc~xlldp+GNZFwEcEsK|079$i*aB!F#r`H zhHISLy_l+69^Ax?XJE49WM?50{3sZ@pF{x5|N9RWZ0P1gUEHHl24TD=Uxi7 z8h&z1wpz3rY*inGFw%nkEbQyFC)lA&KsK!e`|%)YE!c;%v0zUt*p){bgQTQXhp=x? zs^fmTHFH~t^}k#Kcxy+*;niY&)5}H-XtDkXc4S1lA=SSt)^C3yQLMXAw-)QQ(wGtJ z<+dq`^>HHB`%U8R1nr;IJge(u^c2;Kafq{xZkEw(qMm*VZM#vZ`{1WI9Ie@RM%Md` ztjFFD0>I7mQD#Ff8i9{lpoDhiB1|z?E@sngoXg`LQZ;<57WWOjt%2)UE$;8YhE7Xy z-$2TR=8#@O#kWfhj2a0r)y1|v@8TG@bq|Y{#7Qz))@=y3ytFb zMKVtURkkVar--0P7}lDLM*5p8$42IF4+!g;^u@Gb9P_=S71u!q_XVTaCYAd`>!Ko_0}A!O!O{NpjN#F zI1|5Q;|PmfI9+9>cgxBeyoG&- z4+VXW{rG&Y?IBfeJ*m1Hi|q!CF{SDfyX>wy7Zh33_zB94wsT>xqC-yiqH?t4zw8yNpswMkxZPl9t>cXA! zFE^ojO7H^wTFGBk(}0Fq*d11BJYWnooPoC({3}Z^ctJy7ITy-nu-fSGa5~6ag9+#J za<;?mNC+x+#Z$pJGk^0c{Pts|kBZ@S1r6%SyS{_E_12x{;jj(1BeyPL_0Sq1lTKR4 z0k&0u7_EWEAQg(n43-)! z9&jdg{C~JR^Y|#M>;ESt!Jx#62pUD(Sfd8l;F^eNf&nKmfuN{CvBiyIs}>=HD2u^K z(CIKX)}^-E)>><=wXODR(TcS!mbEI2RghM3f5veEHv+Wg_x_yw%#sDv_P-ym7f+sf zp6A|s?m6e4bMCq4o?91tqFJ~2D^8LKoUFwp$IVz!uQFKArzNfFet3*zhI@%)!bXOD z4+`uMEV*a|CjsyO3B~LFQ@3qn-Qw*8>bzDG%3THBi>xM$KP?29eKq8BTmn8&-g5_m z2yy|no+)+fvk&XkoVc;FiO{vPf&YTil-i zL00!$Z}r>bOGP|vu)p)mHrro6B}wduciGR>Y4QGQ8bY4dI0BbMK(BaHf3cIjU&%+s zPWaQHls_FBMh6$CNpNB`s z@Zr@>*AZ7Ysv+hN@IIz01(KzyJAAw4JaG2UkW_PWkGmK|{JVNjrKhJW{UprXg7|8QSrC@p^^7Thsipko6T4?2iB3K$@%9 zRQI)Nye|i+SMj2C#wr-*4_dVZ<3es2M^8abUgMw#MQ19e^&TiXrGAv9e4ylTS2dFnOsOU8YgyAh-(4TN9 zZ;bZ!#*1!F_2iY`2|?DAHp8-WfYXy-*{Vp^VyJuLdeTxBv>F^>py@|vQ29sNe;Y5d z1P)r%nXAg%!erT=@4iRe3Yf%^n0sEW-+*fJQKgq^Akl{pK+&HyI3q)=RFBpwe_YIO zFUjJGwxKSctDpMEVnyOFgztD;ex#+s9?T2bqvz;223{5>qMv3tdCk5Z=-b!DGN~=b z=U0*ik!OmrjITcr%XmY^V(om_sXRuLtzqz210^Es*gN$L%LnEyrW-yCjV=qNE%TX) zFOgJ=Ds-c=SU=r4x{4AjYcLGZuaaP#DYV!3M)_bgm1mGuYg*mF_(-`&SoSQ&Ke9~g zpXJ=V(uPHl8)ljy=LR)bs%)vMs_=d>b!$gk@=#VpB@nCiO;F!7=o{DEB=Vp06+Lal z+T?>mZ`8RdJZHr(o&l-+{?P)b!Bb%=6x}TH$)AOZSZl*VRhHKXp@@q>6X zV|689fj*VniD?Fg27^`RZy6xKXUnW-#6GGlGIYm7DfUrg-osa?*hfG0ulZCv(e~DM z?g1$WP}OK5AXL&Z4ovd_87DxHCYpIUK=j046e_V%X@F2RShZo+O2MGoB15Me3>>I6 z*EM2V$g43>I9U(Lv)tYYoD}0{F}Ov4cpnk?p7>o?AC~4%+T!o#Pj6#<8lLCAXA%sB zS#ABf#|=T!)oVkC-v#s^M!x}bEaW*IfX zxHBZhL6w77I?rqL^O`5rsu##3`bEdAOf&4&dLkPOwTMj5JUnv)PHV@y2X zj5S{c&3BtPSU=|UpJ1G$2?VCMPPT^f9es^0(mG^24XMLaT2nHALRVs_uF8D#=mzS* z_;2A4tt!8b?Jt4FXQ&U1p)KC!za?A*fcW7fk{`UD???hR%>s%sv2;2FN~8|vz1tZogN4 zSA{$PTgn*SVjWzhl?Zi(@i-$nM^HtIb2Ma8hUsq^d!$q ze-*;m(WsO_apO>iXsN1%O$Dv~>2oPXbxw5k4!nxarAwx6B0~>(!1OCnIKt`t*c1u> zsM-R~zj%cN-U-3wH>O)iu^do*QR~E?T$$ZG9MCAJn+?)V!q9){%fm+BN^vX&_9T`U z8QwKM5QPFqozze7TvkOzaziXC*ddnj?LvlPMJH|%GZvi0pF|GwPP|wsxlrs~H^$dE zK{P{g;@wUg224Ni=j$E>H~H;<3@4jvwmQ61Q^k|(JF9m4rSgG!Va$Pye!lr$Ku(mYUov3$$V??qCtQTpL>67Gbco%lpYBU12$a;Us+HhH?30zy)>BU&|!qJA1lG$ieok=(+ucA^=iw z+Pu5@;fxjH1NoZxBL8y}I`N{7uSy>IpP!%koQ6terC`2v;(9&tS)Rz1MSf43T#%Ln zRGj};km(x(SKQ|tB-UMTAnQMhnao%K#F4UUo^4b8D3r3PuId`5uK1xxobvxX#iVoJ zTS4EQ^K=n+Of*iRQ}>wDz^K{~iWl`l2P@h`Nh&XQ&v?@xB=&>p5z2ts`$Vfo*0ZXH}T${yVdu<$(Q#!-$?FS z@z`Ab@oMi!K~m*rd*@e;d~?6qn|ZTfaCL^_s8)O|r}Ce}DG^UMQ%Vk_89`o6Obaa9 z=80J*gF7rb*EdY2?_h3)rD5XVfzg#2t6{Ul)K7SCq9Zdr(I9qibO;8zMFy?!jKxl# zfV7j<)6a~sm;K~TmMsm& zpI!Dq_I@|`z24tl@hIfOP|X^|M6^hYc+EI0UT{hS^XnfL*!=paA0xt`Is_j%F*0Qz-zg5a=aRN99blW_Syk(x^Z=k;}#OxrFmy4M29_ z4r71u&WYA(-~SBtRGOhtp_LUP#!O@@nLB%&tCmi^9B(h!>Q_H#acB@5*;n~4(+^PO5LvECKEy~Fgx;7w{IKJ=J7=tgwe;6+wy zsaJ3ryh7-4{NROGTN3pXb*}xGzcHgWCiR{fkrL@Ux{7qi82;7q$F#gOe?ZN9d_&e> zNkBF`dmDAbY2kxNKELh;;v82=zb5uEK6=WJqH{$#OR*$`J;LVIy6EaqV9d)3lMIfE z_b;jAsQ5~$RlLw^P~7a{4VjPr|DIuycr=mqQoihc<9pk5fpfslf=`KD%tM&dHa3rn z=d;Irqj#5uIEZECbv8Pm2MsLb@;r#;Ph=FE7#y@iK}0V8GkD03)Q(Dd_c039Ph!F9 z25rawy&E=d3-2NS`Q+pP9e3`1@J+$T@A~MW+PN2sPJ-{YSSO$?W{3-048^EsWoXc1 z<_9b199mbkGH_!b)Mqd^SREYnd|kBNj{vVbWJTSem7!eXig467l-Cbh!^%|PmIA}- zEO9IHSgHnY4OWC=jivQfi|YepR_Iyvn0Wp^iaCWFj<>4!J!axqS4WYV@nW`%CJXoa{NCQ%olQPIrh zhQQ4~27$t#tVP^(bJ%}!k$~a1?V6tn{?02k{AD9AiSbEb_%@qguy7J+c}g^m1p#A9 zWw7eGz)er^0A?%&Wfj3eTXkH`Adai~{EW~cudt&UeAfj+mS38*culp!6?|h$Jw#Nh z=an>T__P)M4rt~RJkjXvpu(a(e1UJWkpI3sw-^MFuUmkTMXD}%YO zijY-E*3)HiFR!koLiS%&*kppON*3-o1&3W762+_K(q=<7Z5bn!v`1%8+pM732LQmv zset_5#cv%7Z~5{akQSju@{fG^!4|}3YKK^*`FFC)p8O_|E^)v?{rc!i)ZwXAc4w!wM9=#I27d2wX?pxzFkd3ovL*Mq>36yJXB zHvzoVy`N<7nenI%rminvdzxl4mDcazptZq4>$QzD#b`T%@%;UKj7qG=K%c0IBr`O7 zpE0hyt-8FY%R5}qE1NMv!N`y2VHv#eK9+$~4Zl$gK0?;w0}~5(s~-ILKt-1O`~~_O z%3*wDQLqyI%hXbCwT?uQ5y?%g+q|+|IiURDeD)(N_Mi`&13D5ff<$ppgE%fIkS3#u ztF>qGdySwC&j%~xM4oEa2~v2=$B8>B_Gff8Wf2yypb6s#?{i-P{)<^S{p@>=MbW2d zovF+dDVaQ3Z8WNlDeCcLM06@xbLn3sAc@}%fQ=|g7|=4lYrioRA4XD(&G{pv6MD1K zu>T!0Sc*r-`u6tTYxK>5QH3L;`SJ=<8e*Z^w=hVM`c@gk;v+Rnw`S>#2rWjjP-;6} z>eLAUt_F9RndeK=dlN%)o=0B_0Z`;nCvV&7KE*6UMJN3&|Lg{ww*C|i1R0&? zzIQL=xVfe55&gNR>`@~QSs&~#K34sW7d*|Hq)d$M-X}#ugTJsFpI}E8nEoDD zJhHR!23%`y#pY=&2Yu+AhumCWste6&ABN?+oy?~GIrGOxPZg2-7sLB06lD1w6@6Y*!(;Oddaf=;h3f;jy@g7D1 zWuGw{25~nd6tA=00w|$X$}yx355fm0Y3zkYx~!~WOswx-nyNO_Xl-D@!-l@$E$>@= z>Xf!nv@b`oTvk@d45v89+c;uN$MC@U9hZe-Cmu$a2Hu}pWhEVfI~Iw`j29c{0tIC< zQ2`7BMV5!^H+7f-LAFIhxqCvc+$8E*PM*c1epD7RJfPqw7@Ys z+BZkRvF0W=eA9$#oG9Rh@5Cwuodb>xt~afO;DH5XEa5MKz5XgL-{IF{u=)l8^OJ?Y zV#|*o?rY9Tmx4o`n<7yZFZlD>(4}ebtsTvkIZZh8GcaT|Z+%XT5De@ep@ge|j>)hU zXEb_`?7OvNSq|v#8E<&OvhbG2zGTU-fqQ{EKVn=W1Z$3n@W{|h+CZJ+BT|@3Vv^?< zdq)vTlzNmt90dfA@f_nc9#&rp=J1|mbB|AFM_Z&R6nM#qlE)z!C` zw}F+X`lxOABm=Jo$X(!s85hUge7A(GLF|}JT;uF0+c3Bc_krZwMN65VvHa+yThW+OYwSbLrm|A+F~ah-?FGN6-a;h0theZi(!_#JKHY2q>*hx~vLro! zMl>~;UNQb3_!s$K33A?-Z_G%IZs=GWcyjaC&3*~o_%?l^$kDhW&e*s=8STR zf&?UN$>qCI`i_b#o%EsM+1>|N-W%qrqy=)*?>+0ok;OIo+gPPuXLT}ru$KcuZpjj;E4poCX=kLJo_n~Ia{blTY~Trz2H<*~=MDc*m; zwHt5&#ZH>RpJcvvC~A)TNT)j1HLVsIbM+eT%Mah&HO~pq}0K93Y;#CODI{~ zw6zZhO(br5U4wd*ien(GnaA2`W4qN=DM1#&=#&!h7%yrSo}$aKV&*=h&d5|Q8u6o) za6bG<8f{%PdjybF{Fu0989v^YuyghIkrCOz`LzR43q>QLqwxG1X=9kuKg{U->tus>F?{duF4LBKO@Y3{kWD)d}O{dI28Vyye1GhA3q&W-H|ICcy3bc;XDuLRU zL`QtF1Kz&_KT4n$W2{LwpbHU6xo}hD%68yRv4}~AmiLQuu|~lU_M^fTKGFtdhGy%x zKyjO(sWAPysi{bUxv{zOxWMg8l5B3{$KZAT`b`TCtH+H51%sbsnex5OaEX|;Z*!%} z2U;R}8!xzRHOSxlqprxm`};yZa?&B1WC$ZicjhxCLm1Hd599E8`UBo0LoZdirat6X z;B&3d!FdKV98=h8#4td!P+rjXEC9w{aRal_zV1wwc)|OtfO7KIu26m&?F!}n^*uoO z;R^=k7X2|O|Dtl796X(`eIRXkOls-IE*a60u!ws}5)&OSLzk4a=>FIIuX{;$du!)> z(!uomA&Mux)R#`aD@lSc--)<*;$BFC%;Qd@CdUHN**nSaN;F+mMSp zPYqa9vDl>&0oi*tk}-bpBfS6fsrokhym$6ZjNVv5a+YMLc@2M}+K9Zawm(k>`Qsg} zui^(^KG|y4{AyFvIEp={V)29Pd2R}T8cn}=JLm00RcnX!!E4SH*2w;YpYYE^1t|8x z&Z|G`@LtruRm_@r!QUUj+*n`m*iU?W+ALyJ~-;-+yMgi<;QohRnw~ zXUO0NhH#!2B9X90R&=bBNW)h#^uAkrOyc5Q#f&zhBreeB?pxA6-7OV<|C7-a`~KZp zrd1?_wyakxqHMB?_+J=(4));#F5mZE>b-G2j25x|73rZRuz^rssFqY)Hpm1pweuqR z`*hQG18Ea?QB~)snP1la*%|&QR(>QiYRXNl;?jehT2R28`Ph5*424O^0bm}_I=Dm* zs;ZI2f!i0$F2R~`3m<8qy^Y6pVvBgDaqg`BZ)V!}`LmV;jU))D#-wT}3F9V^Gb@W* z|8|0L%fYUBi`q-G?Z^`E0bci*#;LwDEOTA^|4sg;rKj&=6j=OzW)yru{wC{xvHI_6 z1=^dB5e19L-vhva+x>e?1m;JbfY`fdAjV_?F)9m)@F46gu_b<3IX{JkvmFS#!ou+e zg6(;S@zGmJvaA*TZo0HJ?0KSr!((EDjXkBpxhZCgC?c~F0XCpnAKOI78-5hiO~pqg z?%vhPuoF`npMiOg;js2)R5cxVXH;I!Lbj5yE8W|u_|}Bn0RPTH%!dv8HB1V5KhVh;ead< zep;8o#G7}gFmaXxVON+qqB{tm*7S&l1+QhW@JIh%Sh&-_7Zwi80^w&rPhsJioZVvK z{@LBIFtuk8&dCB{Ocn?yWP$LbUsGZ z_d>%T{ClBc-z*q@@iQL{=!bh4+H5OGD%Kzt_)h)G#MjLZV!mb0=D zfnUK5j7kT>t`Jeu9fY^f=#d@Xc{PKFH~f3yVYz=VJnWSP!Y?JLOg#MQ^W9?Mj+x!C zaB0sVv}A$MoCU&VSs>gzB7=o@?@D3ecn89+u+T3X1VZg49+2~7#uER2C4-7~ z|6Zv0r++V0hz1;TY%Aj}?~L4_yxlS#@W z90>$>b$1Gc= z)aGv_ql5;{|90*c5i@6WLquKAK&<*_h9j5x_d>)&{=H~%brujwJZFv_N*oBgLPYzu z-9T7oNsYSU;jAnW&ddVgh%6A2!!mgItwfZu!yP+zi-mA^5YFrwgf};3u&~*`7Z#rJ z?}dfQSs;9HdkPEv90Dws zzFSm$CmRkowW{nHgzYb9Q1PjMFH~&w?}dtsvOsw6wiGJ%a3Jgo74L+zP~kxMlVwHf zhK1=_AWY2y;k+ymUarny;r9|zhJ}{)-D2Ug?jRiBGYI=;fe^?7;bYcnTy#vl;QTBQ zKKx+{3%L%2U18z1Ca};&KK$NRJ-VUc2Yy?UQ8E8sl=xm24C~Lxpy5%;C|^Fz+_qap zTqr0yPjUzK48)OHKpdV0#GY9|jLrh$0?n)nWmva=W+3be5gVp;1L1*FdQ=y`);f(p z+5e?~FFf4j--{zxpPs?PmH5w`hzdIpc4bAK+Z}{Mdj_F43xw({5X!PZ2xfs$At`Ab z`O&Al#lpI&Sy;%D4|kv3BPyPHDT9h9{ClC|9{*mbSTr<)ir+{+Sm@Gs92~ns#Ylsr z>pb__Z~ODykb$%NdG5XX*yg$Drwb2a+u+GtcjbfE`rRV8e%G1`Qk(nU6Plc|ez!t@ zQ@c#t=+ZH#5ItPDk+}gLxds9qN}X59g`g5hk`+m|%q{*D$f?udcGi+sq=UeRUPS#( z8zoMf$U=@=6N-LJWZT|XP<WG>k}h~KFrUERYl^v<#-;e0 z65W;98lGZmgahvm1`j>1rMhbQ$>>iVE(L`W#0i(AL?*zdgs_vz5bVMNsNHo{QPuv=ePX`e@zNcD_RkK3G!{27#9JuCyhu2=&+F^yQI(0)e2yP+f zc=~iQf2RsD(}kF+LdfhXU|nc8<) zY}T^;VbRdC{NxL|FVuZua)lLFJl9levSm`%M&>>vj>GTyEbQIp7C7!ZKm(7}galD% zyYycxzN#c0Up2pfdI@?Wj2T$4ud>NTcJvF}bP=z_(k|E8J!La^kN@ePi+ksEl&w_+ zSak7Vt#GQKR?*3=q-?(aZW8fLC2v4MXBOAP-b4r2lSp3Yj1o{&M|3gy2T6bF;HbEW4a$a{uMnT@a=Ui=p)m}KNq000245;|YW8(SIk?|9kAtMWy_om96U2%Okgeu~( z8$$K4J3@h9IGx-xP7k>xpZ$kB-|ULi;CF;n_TMP}+8fA9P-ncVtuKq$e_x@xPRtSw zzr7erzP+I{QdQ;ufYe8ddO#}l{_;q@t0$!DVRxkNhD)EHNZ%fMqbowUO-^&^vqyKu zrW*OO*!;a!l#R`c)Z$$)b;hQu{2#D+QQsc0sQ{xd&7$3cgG;c*^sr}a?t(w(eoOp$ z;p<(|`QW#+`Ew>KDV_OK4SiXRPO!SNF}fG6dLv%!j8RqjKVY;shIh9?uc^_O#%K@# zx(#|g>=~oGkfO(ZlfLcwT33XgKPkxu9xri3qU+9cYRrx<) z^Z)QccEe`zSHWg!PuSGMp0T+L{(NnM_;Vq#GV08|0N^GJg_mdZ=ce+m7*#`G7NbvH zrn<5*`dwP}9$4QQqpI?Mz~}^cu^UE9cZX5Vo-G|3Fm@-%ATu5ifztR=M4_qp&pc#)R|IZO!@vEj3 zB)G`woLt3H0QiQkW->O#vzd%d@idbu492c0jJ~7|sPmrdtpg%Xq(-v8Kkn#YYIqq_!->^5&ni1p(WuVa zA!h0^H_?bqZ&ZgeJZ;u4DfPm5DD{VbcBRz6 zFHVb=b?kk}64YrR9aMn@Kpu*_#_OU!)tG)=rU}~&W`+|*sxk4tck}=6_3=99mOr!F zLjuYtRXt#k$&oN|@5VJYy`+2!9ezDRiV)GMNrk+tj^Tk~rAr*l-zmzVcnz20DJ8li zK0cRO7N*=f4x$Lm+qVEB6Jjdf4p!(sN(WVvb^vyM*x%>omRZ}2cU35yRnr)^9 zCG=)f#a_%_HnH6afOBf&`6q+#M1Xsr!U|?iQTQ&rC*m{lYvA#-drjK5q%^07{Ug!O zqt8b-y6p&}xOcS-p|oM|c;%t2nnqKTc*WSwj z^Wot4H+JRVQ@@qw;Nn9&aWJAzEg;HMqBk|K$V`p@{Y{n5p5y)YJeqm?StN;HK2`XC zni>~>5$2M!kq@}bg8O1md+HpWtlaigiRi03NrB`E&S}7&yTJVG@j2E;7s0VR zYY9V5@u_w=O{t?I9hH@;YeS7Tey?>~rf(LI)DT~)8@ygqLb1Nj+4?G5E5iMiyLH+J zV!g*q@<9}P2kBl@HU+lo3JGR%xLYB{N(exFVuZu zaw&VYYRhWK9TR9BKT!2(c9;i6r!Rzoey%b%+-jG!5wbAwX(oS@;?d7#eW;oN2 ztB-NK_(6Bmzt^pQ<2KSiF3GiL#l~%*k$X*I_nFQWb9cGDjQaF$o9m) z@GnNUXwa;zWk*?xY}S8o;5WeKeq3;_1|qhh_rV5s{N(*HwV_u&=wfeuzVFV|B64w} zHtBqt^1p9z{`V2|+k(v491236{?bPAB3{6UftHUYeesYz!t3gro661t=Myx%K=ZiT znp@&{&N{@Ku9lP~=d>~|v&y7g*zG0eLmfhH)*w8bq0( zfl(LzhmLvDCP>#CRX7pEG}cEi!pJ!2Zk#i(ID4?l8W=4Hwl={e$%TRgI~0A*$Nvgv z6bdJ5GF_7#*^_q#07k`$WhktZxgp&ochhBPkhe*F3(bDLK=<4Y9=(h9&gm|reS4(P+ z)K}iEUxyRtb8!xIaUI;yAKoYtvm7M0C>4XChX}6|zZ^~et6n}|iY-B4e^6E;=nfL$ zN=3Lb5ssXr?94klF{-mOUgY%8@BSyf@cCDEgBVrt*WT<>Lej8h83CT!EWTt*DS`uL ztm6N5;>zn_N*MA2{$B!9K2sk%5-Lnkz^hchpY}KI|F3Z+64JorVn)nNOZRb z$fUL;8%WngKTeIuxzC7nEac@6^zDzGjKAHo&XfQ70@m5M3)V3nvi%bcer$HRq^WIQ zsgwoMfCwz}enN4vW@YqwJ30hh>eWU_REGUCMB4@)(X-(~y>n84#cketro_>gAPZUPCtH0x^~buUG_ zy9>T&t&A2};{HPb#P=1PwtQDo4|JI<+?=vPgZbh;8FzJ}sLZIYP94xhhG&tnP9wv}kTZeCAd0uqj zj*h_NE)R0#HPQh%=VMi`@Ym9?lQ;{OYY>Fh))98=lVv;WsgkGogw{|GJif)e7n6RI zn-j*(v^}?JAKU-L`61zBV<%Ki%MbTK6RlX*yD&MN_w1mK3?Y80-`tt`9Ua9vskeQS zNANa3dDh>ftiCt%b$9bD5?qQ(X_#Eqx&qhw2*M>6ELKTxLix`UmTgJ2h zH`>1}NR&w-^vM~#h@Fz3{+dKT`|&FjFF5x?9rDhcm;BL{w(%~NYuwFmw)-F@Z%+@p ztQ#B2S?8f=y|P<_Z=?@jad0lV_i(=5P^NOF!a=z=o+lC@rRsFK_kD8`DK$JiJe#a& zz`Lv#i+`U7I$Qj&wPzzMc}Lf#)9nZ5DFL$&1L;I(%pgnEYiczzV=~!d3A33j)HDy- zCp;FX6sbVAcZBn~!@zG)QWXRR93n0(crDTa~rv7@2h9j zxcylehuS2@AHqRqcvtL`B|*p-NQj6^SCEyd*m#MtFdjKeW_6ngdL}xC3a}e=q!iD= z?4cw`1G87231%O^pAJ9}nC&1UN7i`Dn30JjF6+8AYz@GQKs$?kKWjv+2K3WC-k*>A zq{DlRi&I0!*k0|nY~m!sRJa@ZT$K{tk@rl!1Pv47zm}EZVX`nW6s3VNCqa%DMckF~+7bY22 zLobpL2mY`oC_j>=8d#n9ff@?@fd|(FgM&T_k`~c_mAtljM;^su=Ts!Gj87$jZ%%dd z=egGo@|~tXav-|Ky~QFDEo8c$Jf(R@VCrG^_4LV9^S*uiyxF_UVDp9Zjct84}aijf1N$qHke>)Khon5GnMr_{%*F%~}0tqY84C(Br3 zyztzmYT;k`yBvI9qV}g%Q^0CM92%$MEiCcw{3M%O<(Mc*Tw>DJ?N3_|;(hs1fedT( z5SO#gMSM)rkzI_OYSk6=_P$L+_nkV1ZkUagWW8_$7acWqiuVXPrqU|}!=|JLZh30p zmN0NH0;d)Jz;*IhG#{!4ZSe9A8ckxeDTDW~XE1no-0KD};?oV@I^#&mQ{_um<_(Zb zBg*!YHF$%`pP2AAEO@tnoQ;7*0d-`_Pn{8ymY;OD)A+<1ZRRWMD9IuUPxWmEiO;J*|Mgm$EPhsu23DR&H4 zwRP5$22H%+m;F*~>}^<_V&N!FuSv0dCl0v%qwM}02iW{1v2$0F%ZW3`AOFb6FE|0i zL`ZD}l8M1Q!n&dj6HO}R2U_2hctPl}$?EAbN^qS-AdmCC}i zReyeXYHYu%^YX*rj?F2on$wp&1M8AkAl{GYx5H!>5RR>2T=xphD^%sNvE{L|3rVs= zc&v3|H3cdu@Yz180+H(~SQGh&Nx`w@RlP|0k@}WnXxDKJ?K+O3UB~9|buH_f_Iy&n zCZb%LhtT^u0^NE(4TdO>9Uq^QTXlWD0rqWi0uhe&4(Z4EJ z=udtvh5LoDZ3pb@$SfR+hUo+d9ZSd@sI;)tM&T1i#HPF~pYFw^p<$7D5YGrR<&wzI zdxy(zE+&0qp%?Dsiw{IoYOXM2+oD(xcYudfx_Pw3o%1PHeX!=ZI zQpsH02Hj`KIA-!?AvfLvT^`ltVO@T$%Y9thvLwXR53@%|f((w55RU)LGyE^EFHRrN z(PrE=e+MX4&+7$TeXMrPmYU|Oyztj*nk)0dEIvLywpUH$^;~Wmxp^aZ((tPFO`H$| zu)Z-mnE^Fr67nB66$>?*D=^a7gIphL;D2L9UF^Dw`gqxp`q*SVuGf{YSylVAz%^2gO=Kq4Tcx^B+E~Zs{{nNn%I7#Zgs9YP{$_$Vs zIy$GE0#jPo%_4J#0*{y1xFNp0MvcHdU z%9OcykMk(;VAedx@z){nkFS5InS@}JuVhq}(v6i(*C4n6b;>ZI=rkD# z#bS*Trb4COklsSpz82F?{+?gRBedE(>`_gKm01i7fDpc>{YpksDIUX21hRfzSD{O_ zE)BX&OqPMKUs99oj|+dJnw0Uiqo&c-Va83xvfMlbw1}cV+m__!G=Ujfi*E4dnat5W z@vG|2`0DOt9}C&}-=3BO_~N|?S09Q;4PBJ%EbekR%4iN5&GGxVM6=-XB;Tnz0(-wRpy$F$DqgVikEBGn{{gy19?fr< zgekggO#$PgP>jp~Q;L#roB_5|^Uua)k+;qkGH_|>Gz~P4C93+@klvJAZX=w0J!#m< z&)3O4_ZU2<-m>0FkvOO1;Pk{aEK3rpUU&_*Smu7^V0#r<^GcUBw6f@HW=KJ zdo~#7bp|68n^;IT(|@+tG@n-1JT)7NAz4r?dK4(`{*^<755>K&b%o-9Zcwbql?d++ z#hO#QAcK7>@WB*u># z88?5Z#=tbGBhza(NWAj_$WI^%a{K&Le!rww^ROEO2!Gm_ir7y)I7M**!lzDxZC2BG z7YzhHt5&cA>q7#MT&(CrHH5mV3`Om*)!9T4?K4};NV7|Ik#BHzwJvxH_nAGB^O(r* zc@Ngiu>0M>nJmHh-?gq4Bl+F zbLDBm&ru+&khRuQjo%!T5B1TRh4s-((NAnW@)2O&tc#w@i_1&v$RP^f5TyS?V4iBm zjv?9MK&x>7(Xq>3Zm*BN>b=K8Onvkys-o0Rqr>Rvl`ppo;l=MO#DwUL=I#3gTK^B= zq*!Li1e#5_xgSv?b9=tBIh*8PsF|I&AMGiILZ=tWZ7Fh?QbMvQ9d^~~sWZhz8asRb z0j_=PKF76ey1_sw+VK6ZTzlz|u4AX4Eg^O1+5;;)b1lNUT4rU5+#|?*hP8Jm`(&P?qp%&j#!=Uv}ddq2fRzCGH6fHNSOO{5ZT)8lw z%sTMZknpmykvjRfjBfh!v7)(hpD;^*!3H-!K>wdW>|iWNirv+-O0fs#p#7218!)d2 zuM2M5io;g!4208)m_(-xCC#T(Z>2!71x8U`sFwSL0a;F>Nz$Q!5XHLk=v+2Cv#`?bOTJg?8$TNdj)nj9*0)1cX9b!8Z^pnbq6aBhqhV1#}Y4C^Ne^eOr zZ-1U4{{F-n_CZhp@C{VH8mA+NN`i^KK8hoFA|_$WahFwEG_W)N<)JeFv;Cy7sQp=sHQ@Lu=VQv4&D_>0a@vA@ierg?bmEBihuV`>QhXDS|Grhd(oX*E-()l8XIGbfT9IbIM{6?ykM@e!2x zaClvo*UOu)2t40swejhGf)Rhxq5~gkKOuC0_RwMM&TKm5{m9?nBQ5LdwGXYxmnOwu?t~OGe&$FqF`E>* zUM>-JkfOmx(9?DVB&66&js!=FiH3j0t=U&z14o7Xq&Uoi^hJu9X;L_b?{anYxiv$d z>gGxu3D^7hZwN*fm3!w;6b^0Td_e`X4`yDMo-7ox3NozRt7KILzng!A4Xzi`<5oo~ zbHXRio#EDYj)M8FuZRpi#!BJ+pw#Oud{8R5d{{XY$XV7)zVm828`+s3K1;=iMP{)2 zb6R8ut3M~to#9r0j`6E{{UiWj|D3Drj;@sz_>~RX$YR4~fm?n<6Qtd*7I4>cxXea7 zJ`4Z)38FHcs+CY(MAB=a_f;ma!@ku^_UXV!1m+??4LqF1fRprvJLFQep}P1rw#9KU z$|CP7w4pGC^lg%#q0?;jIDs6-Z%KB>Bq<0-Am6;5w#vd28{!-i8yyV>4H2|b=w0}# zKYvS%?TM0E@dxu#M(*7A%=}92T9;su}Hrg_17@0eeTl~b#!nf1ZR>4i{o zqHDESMv>|YMXM#KGP{rU>w1Z;>m|0Xm)N>~VsZ#=+)5i>=x#OO$7@S+r57PxZw_@GlKBV+Ky3Z$Cf5=V2T`O{}NToqBbLzD^9`1sY6zp_0DmrPmjO z9m_dsBXG+o8-#Lu#PTsxaQoDdZMWqybtpCx`|j*w0#ZX9Btm@Qv?+FQ&ibtFh?5A< z_7?w6l%*}_j@l;$&9Fl6?a#7DRAH)<>CVZ&A+63_;bo58N%b^^VWK3Ybgq^AwMXmmLs_eFs<43^EWAO^2Ju zH#87!^7YI}yLm!3P=4G_XFhp&8`YSJq0aztMkhB99;M4v{7MyHRX>QsDqfT2wfJ@P z;&$}ns=D}u0oYmvBdIPFC8qNgH@}cAYEgp3{ut$EGO*?V**+SYu+J!wuLG>^38=NsLLa{*hq!={o z>=~!OcG^?plGOQO?^KAeY|fa<{C^=!E15-)LgZU+7&Yc^KEV^EHEa5OxQxds^prlo zvx6kP_x;X!?I&hF)(0_prCO~8+*cRS(-Eb%eq-{8!F+h47Vo@t1vRW;U6~fL+I11?-h4jw6<(i+_Pj>VUXEh;m(bI?luApAG~h(;7!8^zd3yH`@;u! zB=KZ!kWCQXPA63LMN8{gM59J+Hbb)4M^|ugml(u7STj8Ot{-rx2ZmfZ048gzYAH|r z{M?$F&p&7n)xmI;&tWqJ4cwxf-J*YB-U0M!WbDKx&8PPZ?;VWHDb8s^MNEfjPi{Uv zuc?fE9^{kv_cGXBIn}#oT6yO5)3eNd8hCsJyKb&7$Nh-mIK48mIak2A+3&;dKxXQ( z)oR#LKx+Eg;G$TCxkBYi@o}Omw@E-lSj%C7{o11COf>(V1Dt^P-k91h4Pqb!6!8j?u_r zwmD&ay9pTlds`(Hv970a2nCWdaTdUaqW3#3g;QZ7B>{e1*$DYN(T^O6y#nY#H6!Ih z)fi}r^FTzBb`fR_c==DgfmZ)fzMgz`zD3M=1@|~TnGIg5OOh2Lj>e_x(*T*0?&oG& zqMv}H>GkAL%!f4Q8V%ue5X7PAWNFgV`9G&v7yX(ey*j5_7wOeG6VY#qNj?RrypL{k zn$O&HzwL0cjA z+ccHK7XG*`($Tt*%lvjpVBV)iz{ZF(v(0DhVC*2XU{V|+qsBXy-T$nAA1Pp2?noW( z;)X(EDyqEe!(i;hRo;(2Nb871y?x{)B>FvA^?cyQDQcf~Hw#Bqs{%J&zylp3IA{$A zPSr_SFXuo(r>r%J#k4_F0zVlLic`Z3`^IJ|-sDe#gYIlGl;7@;!3#8Y*bOk3r)>XZ z?0jAQXbMS46;qeY%Le|kAXnBA7|2;v)()_#-eq|>m_}jPVW6XIrX7z;SeThB-1#A5Y3nZ?r?puhTsh4g ze2^nUj~nDO+5N_a$>Z6Hf}KU2cq2UZiZ_KmYdniZ{R1HDIHX1{H8gH1=0$mZw6reD z3g_}Oi(Tu$6g{(0(qS@5dZbXNpmL^?uD!*CNRm}W37dk*5r z(3{IemVTpSp+)WNuX#_rLqMSpB%83PJtYpDtVPP!%Nb-QsOz|swI;7L-X65htgqL> zJGYz0kmD0i)KjJ_5_fQ-m3fGE4E`*wo8@33P>LmSCkij?hBU?pqHm zkf4k&PAlsb&f^nKgw&_+Coh+bsj#Y75VP-%Z540M_hqv-kRYf9pyql^M0|Ka_Znky zA1;4frKPoMtZ||GLKw$>1zHrc1fYWeE-$=S9jok2*|uZ$43BDo z)LMKb`a6GdsOtG?7icIuL5u#DRh8nrtKNh2Rw$x|i4O<_aS|o^HjN-P#Nkifb$BT+ zB1030i9ONb<5n}R`Iq-3*@$dfBLh4+I$FEBJ#hpu*GK=Byt=D!e)dJT*QyzW+jz-X z2&&zOsz5!P)Ff4I_DlLRw3i+8G%;XmNd&7r0}wcPyzfIR95YaPnL4 zHKNpbVvH}pvmcuLe#y(o?<4gQX4*}6V^mIRtE>7na8rz1tnkpF4?}}Ka7RYgEq*I6 zxOm4Ib%*?eVsUw1eI(K0!~IY?}#9q zPcq}7Yqj@SNNk$GUrsh3j%g89J%+5|QW^+fxr{%L`hm+4v%%$b?SpxdLpJsse<+I?9 z4E4St(xl|`LXsMFmd}}i<=clga&^QUN4Inm)Z#i$Ipmze`sizkD9Zv!Vx3=wAeIPT zqDf17MiZ)97x=+ooJ_MT0ugOq55@YfMYtSL)4Ve;yoX7xrd7k)`x{w}T-jOB^p{C( zHOzMrUX5Qn_r0O*faO2Tw456*tOhCBi{PROZ@d98;YC5pAT?+VntfKgH z0bVd2SlXVr&s;rESsK0i=<2%YC&>dt@$V8im$K5`yHNDG`Y1b3*3J%DSG4XFiXFYR zre!!zl(m7#8XlM^MjosTEErN-*>P=ATR2b`n@wcq%!)Y$h|1*sTZA?jb5{g=lB&zhQ3-VMmSOD-I*qgowjv!tp97C$HIrLp*fcXOLG`5z77Ryr!_g& z6O4_H9{pM<+IMRbAJ18(!RU3Rq4)(%8&@DOB$tHMZatN;k*UyCR9Ce=5V!MdnFP-m z8Owi-ZpuG0JZ`NZ+UeO)1s(!?zf;@Bi3wqg55<{9O7q@m~M*&^Zz4Gt=m$?ZNoe zT=Q=&z^B9T)yDB;9#aH4MB=|xWAVCNvw&?|lAD$Cc zHLXG2Sfnz@5nmqQZO)Ph1L%%7@ECS-&6TcjCud0pjdT zG26ZRfL`ClUo*i)(#=+dEq$fT9eKE`UY~u2I87~ts+Pbviv88q8|*`_UVsOpCo?x zp2lMq(1|Trq264^F#c6tdvYjxHOn;Ca@=G=n zF6``Qwk`x(*9dF2|Dfe>x<%_X_|g5GpCI7mE_RmnNzw3^@uQ#j3SX)4c@jJp;@oP&RwNuHh>+p@<~QXW|5*O~j_nsAt01DL}~z3*64gvL%o^o{~d`HIH_ru@a*liw7afg2MBz}S*dd<4h) zu1X&U%wp1M`_gjlW`#>`<)CV>>T=PUz$mImk&R?&Wo4FsaYf+9+o&wW?pJxYQC+rr zrkx(&g^1|Zwb#Egk<(&hOYSotWSRp4)s#rC>-m{+kA5c_L z0!GpIUhf5}Fs0UdzqrG3UW3S5Vcly%h-lTLwZv#D{VMkJ?j$jjEpnXc(^O{?jfI|C zsW!)NKp?pkivd^kAetH%zC;A`!IuYKtHJG_%p_ zhpqaHsS~fc6`x<+p2g8{hbuzwZ?Z<4njl7m988;`uWA8Y|eI@evZj-wp-{4#V;$n*)8tW6K!HlKKH#X z4CqO0Dr1p6)#tOM%c0eLo`cxKtH}+!GDlFA<{VGhPv7~= z??w8JxxB{ywwRR{jQij5Ub8{fnmcLR;$Au7Z-aqN&0yfgSsZ50mRUhDNnxDxZDtE1 z@f|k~fEq50Qcw{_xyMHJ{B{G933Ll)S0#P2m4!J&W*=NuDFar*-1nV}x*GYp|E{JCf;TVTuUvPGT8&in(J_Z}O#sUPw><)7PG9=ORY zs^*<#;V^E~oJlp?7U6t6a3L@|0#h%_l0?3D~GEaZ*JKW_-HsZYyepWcLyiU!0SD%{{c{Xz!STL@P#j`gCe@4i`U=&bJ;&AL2fGQ8P9!{mH=Bsm> zMq2&0bb3bf^|@z+38Gr>U1=jH6&K>~=-2V%7vkgV)Qqxc!@stbwWGRxVKWVR@wKv+ ze3O&yPOyBVQ=A>}{mW@JkDhs~tQm-d@qD6Yfm+oit}{R6&OuFc0$*?8Ep}-0&Z7eJ zjwD~9VYc;RTwUr!>b-DTh(=h*7o2ZQ^T|CI;+tUpXrM^ib}*yf)CqC-mo@XrsCYg? zJ_~aO!>5QS?{5bKT9+Y$Dhjm5L1L;yU!~TcQ!71~5V+|hpi7%C_(yi05oj67Gwv=7 zwDfUz69TQ*(j$6WNDmiRD>@zS5VZpHZ|4qP8_5KVQrpiA-1HlI!(C0&#axFq9gtl= z?^`dSL}D*MUx))T$9v~_QAwzYEd5*~Zrer~LJ^D|hD$S_Ko*t|x}xS~&Kg_@ALMwy z`Y&s^iy8oNY@kJZZ5{lVG=+F{eW3Lz9=S0w;=ioEN&u29H^1upDSa~J5 z?Umr-&(Dawjop%eJW;@}9>^IOjBN7n{Sngvt<=m9*@}&cPi(n?1z(mA0xiGfxxz#u zLx%(;vaZ$y_GTVx0xQ3ZLa5yM-nlM4@kIFl?rO^^;k{)l*H;_PI`RqAMK&p|;(401 zS?y3ywTIYdL$r7%Bawbxr%>|is&!E)IooW8)8J_|=xqx-PwQquW=p?jkL{*KKNdm- z)HO9)vn)3sel4CfoGm$N26P65znb=8QS!JpMUVTdg{ z8pLUw?PMI7{{{Q?s`P?SGeyLrhQeq{Exc5eQ40@~NhwP$NY!jsAw=7wf6K@w6FD{n z2&CYfX1+oGY}aO=RFQ173&U!(3%tzVXO>d?mjLqkEFkyTHIRM37|3y*fNXS=OG27_ zN0yoS1uvP63w#TsvT{?LB;)?UzMxC?%460gc3b&(Y+}RUtuFO`y+%l6PnQhdY5o-M zyi(41FO_a=1`%emoBd8@^4>kDhxjebN@(o}wBo|&f$2zB#QB~#^PM+usgBj->RI-A}p!djXpzaBjJ-dREUJ-1jp~NrQxN{TFddqaR1*Zmtn4fnSqvvsD`Fyg-`P?u_G;<{>zr}sNUVl z_|LSFReN9A{Z@PE{_eP_l$bl3dlj7Kg zGliG)tvaz1VfXO&wwJZE#fH|56>-phPtsoti^A}+@NUN%iNn+(+u$F#DIl2V?v!sn z@Pl4lH94HsCs?&KF#lr&kWeFlg32lZn+O|YsRJO*ZG{)i}EA~lWq%2w-tU6A};v+$bk_#VQaoof5j2bA2PNd(Rkqu9;AK~{pJ@KdG-zrFV z+@JXGt;4jbR6lzd8G&B^d&h&Z8ae@qn3ez6Q(f;chOm?G12vd&0^FsJLidRoHEsUO zO^Y3#n)M#i!%QDFhyJ5Qqg$9*y-@?(cf`=JJ6mL z{rj5qXa!b{)`xnDY4M<@yn#uwzS%v?1h?3d3NAuRe;{Y?IrO!$7?{o>h&LGB2ght- z@)}xuBdi5P@&jGbNj&^yY}W>>x;0puZjk;D+;x+iKTkL5Tqwl3-yoZ6nR`b+&3}FR8AXVQU)j{VdC1JRrhf7{E#(Y1c3G2)Kef@HbOT*XjokI# zaad{9EggZDJnD1)9dieX0L?>=Zo+qqp}3gfrR20A2BlKFr)`xG_9U|*$5pjjN~nBFHQBRE_I2Wmn6QOA(x{M>GD$a!Q^t&1s}iU0-O_Qp4qD*+^2bF-f85+ zQSKWMnKx%o9-menxP2K<2#l8~z)H|WI9*2@NpkwiqAY$A8=b^)+y`3Df_zV6{qdcx z3Tyxue?Fbx-tY4NZ3B3ITyNt+GnTDJ>Bb#q=QrU-CxrdRcl3)^tJT|}0!;?7Qf8aU zQXZAyAr=DAY?bBjt*<9~(UU00vc|zSzU9_uH1dK};HOdL;6;flnW<)Bl5u?#l$gx6 zI3%vs!vstKdBdoN{jpSZIm2<>R0jWXliXMwVC@y%ceXzkQ%JG#|2YS)Id8S9!<-wx zL=?KcOh3(A?dKl2m^pYV_kaNC0#KShy#hCqHymt@#cT3nn#Xztb6*ZTURm=5$Y#&L z%H*MhTt#21A+Q8TARV5Oo=dtw2}84@>y^}K5?+8OE&H906Z`S-DRwV{s5u7YB>41CN8FZ7=aj5?*qn z#`Y;XdMCpwtZ%}{h($}qoQ;N9wLimoY&WsMtx-w8d264msTq@^r&{=f$&nNbc59<8 zS!^td)13U?j!~JQ4cdw=IrY10Rhd#B{~pZw!%H1=enXv!7d6Fw=F}&qnTr1{&fGi2 zipl!K%U1rJ}z zMAoAHJ^mU#@q$OL1`V-GI*rlKN2k$%2+;uTW0m8caU+re`oz;cqhQgtPAE{wR@KJY zb*PrY$PSiZf^4=)_V@l=u&qODBd-V}6HVwuc6_U8P5k;b@P9|2>C58R|25Ka!1Sjh zOMV{NalrHih@b_qrH$Og!`ykFE(W_>xU_W<^4`MxyUX_@G6@Du>%w;>(zvHvmbQwi zCpYh?x^}RQU-<`TeXV&%MfiZgf^%}YnOdy3dpWk^NK;9k6^INa0Yez-lv5r_J3p89 z(B=knKUM>Qz=9LlOjj|rH`l7^EF~=q4kCnT+0>!(?I&56&Oc*JJii%dWZ&aQ#ZSu( z#&1|-CnPPKP4?7|oYy`rnDugSISvQdCE9MmT_kAul(o#Zj8&1jlm41s>Dw0QJq$SS z!M}>txRZUt_CjSl3)q8&bE(#w`~>eU*^eR9n}LH!uM3lpW-9jYoPLZ_iQh&=U;zlq zpWf8Gqab{7V8LF^+w-qIx_NtEQ!#glDI_DBw6SQEaO6~Cb8xECDPmb<{doJihSZ%Tm)}5krjc~ghrTUd7Gyo zBvLghZ=J%92tFu}^}~;7^0%g{IJ|e@@pF1js%q#JXqm_d%X0GF=W0JN?^{+c*&P{2 z*wn$w7(#0b@f2$YZ^HiBguIYIst%_8z3*&e_%-cAI7m76(L!_hDr}BOm~xp&!8$?X z`WKkj4y5c1EsvdAqk6sXcdzhHtI(}0e%IA!`?aVq@q3Dc??CIXbTcF`e4gL!yM=)m zE4qLjq_>1Ul-I=4XQUq5y_w^(n#u3nOmbv)RfOVziD?y7St-x;wz6(Gc;hqSz=8b4 zlbwCu5oNgah9Nb;-w^(IC+jj;m!r8X%junbIT%^YYLA7-%zkznnIxx`$4jy-3sPyXHe_%D?HfJ>GHF#G@B?D3xnby?td{5ukE^!b+# zK_QUFV8Iro+uBi+7npyx@lMmKEzPIT4Ybz!zuE%}POsM9g+16BS&`fHwVG%<+ZK3K zpyMl+CyQ#D+j|FE`|~|NA^$3mC|hC(w_8l|49b)b=P)8N5Av)ay!Y_v+T?yPM+@|m zvlIqzeUUq!*Hmtwb_nqwpBjHL+g;^(7yenuMWz!S6>VDOCHt7ky#-T8mPv&jGP2Yg z$I6p53OyU|Jn}3prlW4AE1xJKH^)wOAt!uA4!afzFdm2e{?;DfPc2od-D(w zth5)T(qq$AI3j zpZScJxT_1#WeZWqe?NsgI?L#MGY2HCFQ7EOBg>^q_tTCe-@cXms8P&FO0HyqNpbH8 zvzaJtY-|{Q%`glv8e8SaY?vmOFpGP;B-_ z^(5?#ffqP?Lkqu{UDqF+wl{!&ERw4Z7S>++TR&3Uh2F>oB8cdrYHKOZ?h|fq029Yhx5*NJWRJVE{?m+#swbL8D!oAn)uL*-_xUICWU}f zB0GpSCVmv5JM~ie4oa!* zrzhOj%U%&f9%H@;Uk9o{@-LU=FlQH6Fyo+;6U zLRho$;|)B_7{;C|${xQ%HB`;NSnf^9*Kv-r{zAZ}W7Cx7Tg}(Tzu$?ndp+7CW&6LI zp{%vl$yKISVH7m1_uU_L>#yAI2y5OZiXc_Cdh_GkH)r}^t^PNv!pQ_IKI;Uwb znE|s3z=Qmqnni6KjIewTbSUEzoYbJ!r&uxJeWKMO17}7sHeip}_h*b0Jo31#n2iV1#Srh4CWEuXWk23xv z7xkua@HCW#8OF$<%*-(FggbYGH_Zwv5^GXQB@2U2zx+Si-UU9&;`;wjLIM%N4Hq>i zYP4yMRclbxtUyg5!CkU}D2S+NTUu>vt5#dB#Y=4f z3kVhgZzyfWdV99(x8kK-q?-TxGxI!~%|*cP_y6NXo@bxunai0oXU?2C=ggVsV2K|6 zn3gxmd?B5H=8v4_gImU2+|a+}hU~MV#E|boAKT>QE*N{d&LWXOKh`WFM~HT^`^88v z*~kpKg%VAUPt2AN_&81MN-jmuK4!V`w+o)l&8*_1=~A@FADN z%aZ3>ia$yKCkDTGMVjKvEyZ8;uQbIs!OKP%vkIl9d6`dMoPIL$ojjC^D-9C`OX@59 z_`4GYq~L2{*zToT*-I_!lHq^m+1Q%H;Cfj1LC;QXU4TftL=a0zBRAo>;ei9*)S>(vOubTYph{&FN! zMpAAYc3s5SWAJ*B#Tb;$(%6J*Szwlr;wVF}T=y5`@+PE<;6syYW8*fvlHcHvlgiy+ z-YBiv-Fwj zqEA?tjrkLT7m0;w=bce!`%dSngE=3>mv3>}4%~b**_oM#vuZ{$IF#$j(Lr|o!|$So z{E8=vC@FP{&L=y(DsjwsJQ_fo@n_;dPok$G)I?j_TT&oO6vDgsoM zk+*N6u&T1>8wP2A@ZO@p;%n4M&L0hEf?=;7c-!o*{F>;-;|#&A+ET%w6Xrv1o|$FM zqt7~cEzS5j$|7tjq*N8H;#5)WWTJFv8Y7Bul3qU8`dd?Aw1(3#6s>JuIQDVT!V_Az zG<*^KV^hOWlW6Aj&%ltg`CC{}@mLW>$Vfr|r5Jr|Aj}Nz7CwaDeiPukK|rhUeP`pZ z0nvhC+Tz1owPfa5xS(xHUJ5WWrVoQ@Dg^FI_vMZMk>t|EEMu?fp@)9wmdw$We7DD1 z*wV-1F8xcL!J_*#>CF5R+uJX2%Wbs9gl(KXYf)L`3h(qL=cuP%(ZI<&^SAU%V(^dN z^Jk~GFB2^ni1=X}M?Gkh71(5R{A7l|JzQ*=5Nh$L=HpGto~6};0Zv{bbiiH@eSWJF7_TnkXFni9M8ZLTTW6b! z5WM&x`kb;>C@JT^DG}62?q9f7?aH4zcd3=qdKhB+ml^n26c{l?`6}lkXMG+usvTB222TM86~Lm%gOY6n`v10 zOiy=ZD({xbpETSXmv$rEsXYj{n|%LdZhHRB;BQYBF9**yetSz+^s7czE0eH)n$P?s zkUb>gMj*S_+`UZL8emLkvVO0R9)&ydX9#v0a>#BHM$&vWwh}oNC&aYRd?FWZ$@A`J zW=;)n4vDHY+#zgjjp0Bg0v5~gr;TRdhUj=X6xt$pg-+NQ3hoNr_?$Et?8OY+*kN=T z3qB?OQfSv}p_QFy$2buK^OKlbB>TDKS_6zhzPH&2j;G=to6p7l*IRq73Hwn=)}9I5 z)Fu=5B`O_(5fx%u1U2TZC#~d_{jpYSfg4Me&QKk~2oeb!hC_)NpBUk%%Q_Z&y&u9W z-UgM$v)$iGG(cQk{6!{Fpi!&x&*;ClFdFGHCqgKwR;@PIb;83`-B;n=9BEt+HNc^&v7RVqh~^a z$Oqa)!2uC@Slc;*Zt>0qsQY?&4cXaYxllNu0GaGHe(fvKjjRaS|FS~K0G_o|w75Ks ztcI}xSbT^=9;vkXzruzc!(SoZ^T~d~ot3~jMy#D904tTw)+dAN{7o^t#fUcGA*Zu+M z)|EiCiKX%o8lXjr9{XAi9I~xzH9$?qIvU@IUjQ?-IMN1hexn0bgc>Kxb*JNeC{KrP z0^8N+0$Wvg*hcxV`9oFUb^N_2c;EinzQOzUs|N(0xA0JawD|k}I-2IV&tVI7*X!~Z zE&<~|E&J&H79;a+%4CHa9&lTK&2QJPAEB1^Fq%`Q01iY=FTV)_!kA~>PDGHA!%S#P_O_r2`T=EfvNhW3ul-G= zTPG=>mG3>pEvil1g^$N3M3@|7LrdhnGDdq^o_B{-OOW_z@B6vKs@hz%yPne*3`U(-;yDq8;+r524 zOvRcUZDA>53(MskfH1z4cN~B)-t4!mNnBnY8+Xk%5f!1T_hhGzsBx|?QQVj_e`?xW z6Te2btn6_7L(WbviB6M~SIftjHdJWI-wnB{C6fK>tacdF)45p(m2fRfs` zCVo+QXzdy#eOjkOVvZ1_%D4O;oMQQ7R|D#WmG z;zE>zz6Xqs2xd2+Ix<>-+r+?@JuPzwJOM;-eB{gU9&qV*MJQ2CeAj1)@4$D#iPVs{ zq8g6<{jdjq!jr zQiR}E>F~p3L!gkR9{C^p=rjY2^kIp-69r8F?!bId+jDAbeYqPjXY>V3MNeQ1EGT&7 z3e^q1?(g~n8Gcb(6TiAFoCt$@b+0d8;@U!pfk^S}*tqvz62Cnx?3@SJdCgsUhopru zHeSG9*hNV=L0o;KO9BI^zbiFtw#?6ScfwGFOoWt+O6^|ipQ|w9=NFjW)D5OAUtv^| zrcT)Q^*3vO$!HA2A`Y%bY(p9(0@~Z zBH+{9(UtMshe%I+A|)=;Cwx}cwVh_8ahkOYU!3TW_@`$5e1m8=Cb#7Hr|x7m$~-7#zT{5ug}5O5 zfsVK?c2D%{>av$elnDHhkEvTTMF;cS>IYVK;lErZ*BaEOXfybXeVn^+I^(GMefI7X z5;nqaskS&dYFJ!MbcVM?f*Ts=OmreGxm832s0_ZgaBXGc(riP2Rl!#mK2{lgd4BHr z_}G@p;Kl_6UX8X;vOVizHU0I<+%L&o0r=Ni+d|^>zkHI7_80nf@0`r}W_%HMiZ|cB zJ089Lzc#b|elbJSozA5v=?NtUBO?~{qCjDULW_~#59s_+@n5fxkbRjPVx1KW4_E&z z`g8)UuK8g1Va*XSo#qq!w4(W3U%$4fQ{NX>kYWDefD?VH9L%|kNeuweKUeT%%UEzY z5SRS9lH~3zedg&YWhU22sgdq^=?W?mP1$5V$=4`v4t^R~x`={Q08~<nZDc)S>fZq9w-P+#yW#TQV40bd;mYk)z z*&sl9d(fuoi1y~s?1qKwMt&BhC zD!zyqU6G+&kTgTnS}p!33x+fjw{JZBV9;%m;F@{sQaW!$X2%gff`W!~=}AFW`$9#q zTWNwf-OvmEo?^P9D|c(g=Y&7;zkvTjETrx8i2{3-NvUW~(5 zWqhOCB*QG7#9853hF$#z{qQ0-^cG|-98B7$^vj)O&A7O@8UA=N_EL8`m;JSV z==J;Uy+F_2^W%qI+%^7d)qc}-WW~cH&N=xaj&d~MoPaJ7Betr)m8XbcOj8g{`3%L) zA0wKDdP#(wJV`5!q5NIMiL8iLfl3A|6Ayzm`8w#XjK5qN{|EbnS@@-X5ppglq^=^r zuEYGg@a|Nhoomw75KA##jWa3VIjfRWeN7dERQgH6d`YUjGX9dm-(Ke8)bAJywahSL znV-5Yub3%|PtrgdpBRfTvKpp}OfBjh2K~zmo`ZkR1!rDozD(Zx$;;XIY)yF90o<A@viKy^oKyVf9OE@-m(JEqH^=K^QrnjN%u-B` zhAjN98quy+yscIsB!QZLyV&1)mnC|k0Yz%SNvTIG7C|L;P(Nn}b%Syl8tgH7SX!9g z*f%X`{)S_As?IXg+fxmGtWtV&c^p|LW! zcHx##@WaNd;$t6*B&HJv`}xM{mGMeXFnlx=e1A@b+`DO4X((~2k!waUqAGov=KYVD z*`KXKoZ+QJnYEP)hfaUe{(B9ngsLwE=jMq zd}+A0d~6e=j|>GrX#9qJH4&VZy))~8z_AMA-6!odoI2k=LmV@FJ8u|C* z#uJr6kIu}0AU%KFcxWgwXk#c5&JB(T+_jS3SI@-P0sAJ5lkNsx*66a5OFM?^{Lp51 zb@yKBddh&0DjM-S{-E)E?QaEMr+FRKeb88LfafDXZ`F$vctHyyTP50m(0C|eLgT}? z#+$c7x{T6uSIzd9rH{WcXuSEYNCa4#8WuW%Aa(v4SQ>J9 zNpO6D_7W*cp%K3EG&aj&qwi<0#mQ&w>68)4Y;Yp4~Nl@+mdxfQtK zHw;G9AjiDdl1G!JB5~br_Tl8r8}Qfwic0mXj6c(|X8zh(a{B&|FIt ztc5)+%WxOMfFdsw?7!-?+Tip*Ii&l^me)dIyq}G3#{3+JeKj>?$i@N8ZE?w%E7*)CKB8?Gi9je%q-!OnJ zT-oY1eEc>id60@$4lI++0Q|BuFt{OlB=dqjIK4_^8sTtIe4TssEqgjs6H&2Aqtd=Q zc*MfN!HaU6^Sw93#V|W4&F6hQxW`crSRNEy7kwKnmvD4>DqTi!<$_7fDr_*{9g4m4 zX(;$4eWl#_vmM#oo{pTXr$?)(}Vn|Lj8?MAY zh2RH)*zfe9g-ysgn7J7)F$mj(HCeX<@g^JA?Ucvgqf>A=NgQi9ij6i&0Od$x@TiTs zS>fzgFer2oQ#rUQiuVorpX3CJj*a_hrBt6L*7EwrQhN@w8@`67XQTR1;)YMqWwJ~f zPsFNK;S;uoV;%i4q3ak%qK?lUD_OE!fn=7@Y}rrh%)yMX+0%dUFJ!aQvFcQ%!FpuU zfQ33^K-sE=SDnyoUd*stE6xz~_H-%bOd%L> zQeid?kpf?@%yAkzSqffuww1%^AY$Z;+YQBgd z1C9tW4Pv`<0tszF&?x{Sj~eHQu=5>`1Rv2(2X2cVQWJbNdc62=vK}REY~1J$_1{p^ zDcJge)^yCfnmAnuY6Xu>aAA57gI2-hMDZ~gwCK3k)p2(fxA0N+C{Rl1X?tE69rrhv zj+=Lu?KqaFBrs=%VeYbdygrk0D1N`!ag|4bnmtxNdV+zi2G)K?-(CM__1$2t3)BO6Qoa2XNh_WSlpeU3*YrRkCyUYlp6QYv z5G`;jaEGi=x6C$M%+h0qtzx7#2=9mv)QCAQDME>jTl^@u!8QU8C zc-oT_!x>pRt8|laEn}JpU5GCAk1oZH@$~w4!1cjFi|bOE-oQ21#dSJy56qLz4h;>K z85&@<3=(`}_PFQA(^!7Q<2uv*5i%ViZ@56t!19L%k<&Tfa@(TbXns*&7d52Q}rE(u86$DkwTM1T_6xbrMd1-M-1(U&KpVc$^#!QL zzdObQwt!;1J!m;Z&JeKqssUh4W}b`uXAjsyJp*hhcMsT~tg%^3^a)_g&Aqj_Om~1) zkpTM`u1Fl!=HY9_?=7$$9Hozp@oLd~Ji*xJ^~845s6MgS!?y?yoo z-KuA@?&!+;k99VyLd^+K6)A*qxUB(HMULt~e{m)d>TcYyGU@`*ga{t)_^>#f2>O`;XImChR=}$>_txSWx{E%!16~IUXtq~!_}StI$SFw6`GVn7kbbyL zg)A#BGnwq&)?XvX7>6)N9Pg(+ms)ex%AN0W&8msv7t2p><-g7jB?g@u+Pp^_LW<_0 z99d>g7Gd3DkFNG#q$&iX_^>E^w!u1tp?f0llz(PtjoRkAr;5dRUzw(CY9nizgvNKP zV#RS3Qel?VoK|bL!@D<+!GePbV3&raT0cMWbHJpx9`Y#WAyv(^yd2Cs<9&+x!-JM$ z9%39>iaGR(^%f=f@=6&@Mo`q@Kbr!Hjjm^~xrw{io7rX*E-PNAPc(PCxwjT?)g8>J z$Wa}Jzb0=0<6ZrGvIj>yDZKu@{I4G6nnK`><_@paUF64|{>3JmQO;Yxwe68~;c=A} z|Fq@IHu>RW<_;gzopSV^Iks4)dD@}9D0Z@~Qvx&Dw%QIeJJxdMza*^OPEsb)-ji)n zvOf^9|M`!aY>i}EihU(hGWCjs4pfCd+twt82mRR=&lk>PGKlt04^(2FGpF4>uQBZ| z8zq|Y5vpPw?ht{Y6ceIqxJXfUPrjo?iA ze}KXAM}J6TdHr|(7g&C>cst`lLZDJ%2~Ew;TVh=s*r(iheOU&|vzzj|kJlNoD1uivh+vb*3f`=6s^I zb>i=exE?}WA09Brn6iN)l!<1@Z1eep zp-*zQ@a;9${rzG4k%zm}^wS=$(Z9~?jqG3QYa%a;ec_0eBYq6BKN{EQ@2Kge#f5ae!iw90zdaIXo0z2aRok+qU%vQci{?TD zk(b;X@8S5mj_mjyW1JE!`I>zZ8FP}Er_7x6(SzN`uTNF@ z*JIDf3lK>YjA{YuRf)m-FimS(0fT5`sxN^b8&I)w0>(F^V|MWzwG|*I(K~Y#OwJqyMU}lkIU-!cA^FDs(U{UcApTS>@UuPokqs<1tg9#Jkx>*N=Uyj7yH-3*1G*$-u&$a&t z{61+;sTcj0_MqRVfZDzA3l_hnJ@M<)ug$e@`dwz+2KGn4HTQlteuvV;&&KbvO$NUY z+zNh|bne^_mtaYAIx)aMi%axgKR)s+57or~yXODID#}D)pt`IFs;ANb_ut1_R4Y-R ztitBn_hfkjGy48H_CJ3~i~3$a-g|W~O#AD{lZkY~l4fE%Xg>DSeWE#Y{kTp?%=W>O z`;bp239jhyw0v?Tzzh-*(F^P1&v)3l@{zw9#Q*hX5P$D~_lbCBLFoH@;?nnpa&hV2^!>s; zY5M*R!sO>ecm}I}vN+@+Jk$f>b7_Ek$T1e#O4KK^ZLWPIJ8aw>_Qy(c)S|xWdmSd4 z9-PFd@0w=~nrE?icPsYp6U~|Q?P}B2fzkKXcXy}nF#z-V(A|x`Ydv(=_CR+o4Kecf zokv-eD`B4~w>kHX@|TRa!2VEv%g^^k-{;Nhh4l>jeqp^q{Qo#0e%&75O~IPfZjY!5 zzDX_l%$vS*3-&YXfAkuy_k5rT&EFAdJ%JaVe2&lEk$QTxw7l%Jz+#2+!@*{7;HDff zl9>KU%g5RCzN!Nh*{G&4i)s^Gf{EqieZtGf%y&n;|j=qJP; zC~siHm&_rIuV+!Jidpne{c5MEKx+%XjO$9-C96%{i@(Ji3Y|guQ)fgy$G0=7ayAvt z_FrJG$HPfTsKpPm4hZVp4O8ChjO}0-6ED%zfR<3}GYzANh>PjMi=`_oh8IgWgrbhb zxMnyb+~?pWIx9j3gA8~Itb;y~4T+9PO#XKZArEhQR%=x>bHG#3KxiU728qOpheuT5 zA{5NDxmfu4#FUkMg_}hpTZM$gA|bJg5<-*^Y8b<>T7K20LH(I3Fb0>lTWwvLpcVtF z=$FvP><_@l2GsQ~|8&#r#wn(p#tGDsQHEV#Z9{cQc+P`YfN|q^XhP` z8ISHnT`IWX|H;*66RwM7Om_?}3?9INJcLTrQAHtV5H9;8i4t@ACktetUnk2EzdB!{ z867O?A2m><9(3PgFnI9s%PXIvDJy`lkux?H+!g)zsE+p38#c?|jEk2Y4@<(`#={=$ z`o@;r*Twh`UFVIBl9sZ;IFdS{8S=S>{tB#H8zQ$#E&{?b)l;bM29vq?H$H*Gnr$&! zO8gvf*xAH6*PBFuMJBTLX1#_^HZ|jHw~n^3DaJr+^=}~$*yMGT)C)vAe*a0|crb>P zb%tB1Y889}NQzh(K7##*?M3dphs)ef56ox@4km7vbM6caN$}M`Ok2yX*W`6hEc?$!)SNsU4FZVxi8dZwj0+;bNrGv zEUP$5GA$38V7uD?0V(7{>+L$JBJm`RjX1fhh;~H1VHEZ={QYSWHtV+iobTb4ujke{ zwX@Lz)=iF2JDBb> zSEjxy_m84#CwH^E2UZ|gq9Wr;L=JU-y@(EQ4e-F5-W*aQzmoEr;Hu_7iT;vjijd6C z0Jr`MM)fsZ+6{S{!6ZaL?#;!VpFJ^iSb3wI56LC~=ta2Ri;VN99Sn)4lf3h%z4?dP z=+~Zt&&&<-_$~&@!EZjQ5v+1hm0V%bp?L`F63UP*%gS zw7!Ii8BaNbbcg`ge)S%f`&*4Osqh%t4gh^G3 z@4|QUC2HW#o)c{f{4ty(#7=7YIM5J?y-wfE$ceo{-)x9pOx;IFCauu>Oyp- zDz%|eQ~^5!hEcs=-~RBN#;^tC1|N_}%g2W_4DA90`txCl?go}q3@n7(j}%9`U|Df{ zPgri6`T1di9}`!9cQ(S5wnQD2?obva3kMKZ_+XT$ASJa6Kz`Y|1EhRLhm;5&I^^|> z(;Z@c5Blto|018Y>=`!i7zPv5ofk*b@H^`YCm+b2sWa2?AQkxd6DOao(;XnH7P`SG zPDM&kFo3lOHZJ>jzCsKItd&eyNPv{T0W= z2gq`Z%0R)X7`xagP%uaP1nRjI%qh|@E(LS=Fr?mmE!QtD1#@cki%Y?rI{nh6sg$u& z0;IbC@{&hckiq z{Q^;y{Y*$7a}rHNIE~s_s$M!f7Isj~t!^G_wUwbSS>Y`LmEOfubwaCbj#g z{~=a*fW$8bhd9DtMM6*PkVJY!bvz73I%Rn zF6fNoKZmgi_}ct1ri8C+`oq(56X8>Qum=LR`}Kew;dWpN>fbLD)Toxn=esw}Ffdz- zGiTRH9P@dT&kMb=1Fs0y#U7eqttXbOZtx-A31iyfR zGaM>Hfy8QF2+8`uo)J!6*qs9liLY)?{?xn@r`7J%iF_$&D6D|Tu@AGBt+6abs#uBS zkvP=|+B%H z5XPWEnNuL}?EL_E9{pJGWT$&jTPSP8ogF5s%^M!Ov8c4xZ3b5>B~x|~G~L{&F^A|> zOM$;pfnTRUF^vwAh>^xRik^T;d9e=7m^BJrY#2H4v11%ib*B1m52 z^R)@cbSSPYmiUwZH6ovVAT|x>fol(GrRm(m)u(i>_B}I~RuQ13^;t;(iM$8jr|DPk zN%w7KSKoeks~TudMN$KqP*}>IR~&Fn~%;S~x&t>uxu+a<8Ob*}=eq`%Vxbqna>51P`P!ASh_}43QuMroh>&^vof!D0xED z%&0Ljj3fU|>%|M|{1McH7uX`i3%;%*%={H-txYq8Qd5*=2xsvY!r-WP&L3$_P&sr^ zE;>Nr!OK9yu!`7r(ZPBCAYT>z1~hQrdmwt&F42GyszO~f@ZK$=fga=giKz!ZzL^Q= z5z~xJUdo;edV8uE)Dj`NtJj}8A7Dn{`Xh{VVQ`iJ@p^p>_4nv?D_y84ot+sQccw}1 zb^O65y^*u&<*mEZJj1<}k?1bf*x=zfXMs2HSE zDfE;9X0_%1wakM?E4PBwqGwIbsHDHb`i6~=i$6RpYhHhX1no?5#LJ=I;xWX+lBGLC zH!_eV#16CoY|btI;SRGI*Ux`YNJIKId2UJlPq$K4XvbD2~MQ_BiWn#t!FK*}(Xz+2Opt_YUWO zL*Z^xmp8eX@wH7))6?+uTxa_5U#mUMl3Llh?C*1)+GC&dS9|VrE=lim-p4lQiv+;= zy431Yt;?EaK7Ooz=8w>#fh6`W2YWWn&WaXG3apQfyK|{X8SK{1c57=z%EJ&1XOliF zH9HhrA@(JCb#06J#Y1e|RVEKg)ppH}?g&3yiyrka^%c^K{`C*~Pp5C;*-cLIs%g=q z{$Y`N;cLXLmET(4z?%r;{lyW z4DbZXV&_|YJSA-}tTmpB2F_X-1pMLUg@Xb& z4KYA86{M=EBlHL9>h>a>Ge3+m)tKf^N< zd&s=>!)Xp>+p@N1uWvakPw)p?rN#+4!`RFj2|T!^Ix(DDs@b@;1**(z53Bq|l+VlB zDyR6?s=(bZ%n4M*->M4S_d-?Nym&Ei<9gNNObwB&Jlwf5;!G_w^M3^UNKDNk!14-i zTH|$?J8O~+gmL!;sE5D6RJsw*6iubeNdXy!V&jfnV!97uq|Dt>ZMx4}mN1-bqi|GL z$y!>ftrAK)xPv4xz%qr{v6|K`atI^|fC^}eKD8n~dT7O(%AvWqt5*)qPcegd>71!L zLaLHdrBT|PuVOiCuXDYkbds~m8D3E1Tv?D`K}6?*Top>#d@pxZd=*++zK8Ow;xE<& zlYzFgIBclK$(oY5_5m(qU9z27oyc|BF7he+zXtGG5^zW~)Fd3W&;rHSoULe^^-HD| zPk`K~Y{Ax0yo0k{2cP3qy7|PnN?wDzFnZgw^8&38D34Q3AKXA6V5XQ*27Tr*^03_TQN3?E&7^PN6Q6K z{D$(H#FS1ckSE56=Z{}gnV*|IIeuk+z8aC6{53AI=Qz{c+^YD?fE#Fgot+;b=g;9p zZU>9OMExF2SN#Gvl|iXW2v%SA*GDG9ePn>H|IFVy&bI~?V$2ceU?{OB@ZfVb*{_2W z*1_w-E0cLO!RG>PbIHQH+6m6+TLO2lnWNZik-&XxCd5bIqS!={ioo3*f{+!sQDK03 zU{#gIZdBW~YUz&M6i&Wwe>{M?)A7{BUDz$bz5~bYNyndw-OA64-K;crS*v{^8OqJd z8Vgc}dq_!CWHZ!v*JQ(iCxDet!zUSyB%9s4fj%ZE8uESv924?mN<(O1BoUbe#TpNgK((*RSvX^L& zZ9G#>;`FsgtNow!YJV)F{aBGcPy0*kWgGHON>ysB{2srk5)sO)5<0Av78DNY=KV>l zbMfccZek7J<5gNKJJReaiQ<8u7X(}T(LL+TY$kHldW5Ow^#ufo53~)1PG+?S2Lu+& zS3vd6u1OS+AmZWvnrrK_XKr@2&oo5G@}`UWU$r51NhZ=bKX726_1`qh6#o`K{%^$- z%_ZUt!%_!dU2pj6)EPCzk2ZXDeV}cZsbOmEInLPcA}YK$hq!gS5f$D$CqDMOm4Un6 zK4+;E9{%6BK~lDJt0l}Pbgn!E`Qa&L`j*M|=?mc8|1y)QtAJc%{% zXuE>hwqR#$O^J>?L0kUe>-Zqg<4xR=(a!XxTR*StQTGaeX*t}ozn!acqiCPuU&Kd` z4)zWVU_o1N;uRd<#1c2>7U5^`HvG468;J%$%yV}$Z(RMRRKKfR`=uvOw9XUS<`+2~dAI!`FDrE^MOf`{DE@u*eQexM zl+(r~k%X-XmJhe^!<|Jjszh&%FSNWZV)_(Hm=qM6L!mma54bw?0rp)dTMrCf?i5H) zGgP4w%boKIOn6yBs=cqNLHKkl@Zc4zJX6?0U!(l;CyEX+W1Q+O`g4dk15;n=-Y>Q+7&f^9eP(gU z&V!*)B6oybL702WaFYq#QUjUz@v#*Dew<-H)>uFjYO|t7<5sI2^mS~0NX||4&?}&h#uM?m)TxpVA~4sa__*+TodzH zt*$Ao4s#ykz#f4zDKT;Yi^?J~rgqgDd}R)rIJ^Ex0T;n>CBw}2-yyw(e}SiG@qZ+} z=&M(fnO3AYsZ~##h0N?p2=Jkm?^qVP$F0|hH>htj&a0IwR%vNftw;Rk^HqHAfqQjW zZLim~y-3xu*4F`SKnrzoT!9!tNN@u@bmpF6wh$N>E+wYEQUOm_Dlv721iq0TW+ao? zbJH3mv2#(QdT6Cvv~x8IxBe6n+OKIxxP`dwc7=oK8ssn{c*MEiw6P{JzaX4wC{G1s3+_T#`Rg{3^O|-cp zSXKn&O-=J=YC)kK={bkSEa%y`pZP7ea8|@S zK+X(K{2SF#B~J91$?BQR;eKJ~5{mK>`ntyi*>BHVFV<0FB%XqI6}On2Y4GUlt_}uk zhB~^SH>6;)bRz|SqD%vAyT=0SQHj?LYLE&@9TbUsSQk0aJr)*FR_mj@VLsJQ3&;K> z3P-10<1E$?sF6{Wz70F)=gW2ycK%>qJB!Uoa1zT&M7Sz*l;1m%1YQnR!~nSmjSyIy z2D+hHzvbQ(pN5=reO$9ccchqIQ{;-RtaOXwTOtQ>rl2{~0afk$k@!22_)GLfB%#F_ zr>JPHp~2Du07i&*^aG5V0U29i+R<=O%L+qL4Oa*hysa9BpaK((8v09?$}ZUr=d8fQ zS2@QPjdr? ys_O~ohW)asLu-vot~vn^zRq?pj`ga0|?OfPJYI1|CA)zX>$(F$&i z%R`6!Y7&2^Xz55LRlO5-5-mJKT}`+|)HvtYGrI+1H}g(xN4+4E-U{xLs| z0+TrW)gAM1yG%DoiGR0+RIzc3=XxU5_8WP)q5)mJ8RHT)TbVOn2H$x%atzP1f3jYYAc%J zT>0_tS*)){t9Kc5My$UAk??s_*_8N9eNQgOkD2!Y+5cI?65HnQY{+fhlB%V2!L2#ry>O>Jrv9I~;g!43t~quUhYN-~pNk-2&R`l#R>M0@euL7*NAbw+>`Hvq zuK5k4RLYhg7zZyw?sdL5Ob(0){AN_hOlBLNnn7jx4M&7y1jNPJ_X*Q!&BX;(!2uP4 zWouJqd_SmRaD}1R)R%qu1_l<-Cus#@YenD(Yg0o)YbO)|R@bV&s zhn#ER9vk5F@m=Q7t@SnWq#H1J>PFEA+9*TRW`!k;Fr)*m{h0#Hi2gjI@cwfcg}-w9 z7=`bDvuhNt8TJ2q6vj+#N1IXTUO;u9IR=wQ%Re-cx8(;$(Q)S`C_2_WjZ$N!Ms93v z0m5+&%J)RB#-(!s{BBG1oshGnMP207GkI}%Lx{=i{Xp!8yt9sA2!={vr+f*HANq_c zJ`ohPzS9SaHeTC>qPt7Gp~$0AuTTlIQl%nY7(v#j#t4h18RlH@G;wz+m+N6p*P0rR z#E0qq-G=_$G1OCI{l-mUHSuZh@AgUB=ZO9oPQEKgFP}USb2MZ6Y|^ecva3dQCaV!T z+(lSc@lWFFHtKSnp8J{swIt*~5i~zq5|+6ohxI)nN^0R80;NM*vG&X4Uet`er^WOe z&5z#stAEPc^dbN9nAS_O%u8u78zpb1Xoom@|UAoW3i z3YN;FBK~Y7_|HJwSo1t=yfggg5$Bqsir|ZlMd9F!fwrUhfKjW^*fyQv@^94kw3h`1 z>QELSOtT*cZp4iaFm5Q~drk0@Kk#~o%`jEYI(>?7_@;iN*o*Q=PbNlQyfhy+>*s#TuF>IMd#dhBk1s;;g0y z5i9`Rq|mK3=SeR~ObCVIV_z~jlpuYvC<;=plWnL8Cieo9(me*#cK&%G(Dn@MTS@^m z5q@CYLC^c`OWwfOu#+>vnfXq>`z}f&9HXXX78!W~`-a!q6mT!l_(;+$WICPic9OE4 zF5`$H0uPDF;eeU0@gQn64Pbu1)5zCd@JC)?8S(ilAr71mU-Ev6YuS_6ID%;94FgRj z$=l7lfsKbG9{}}=u)g>v(+4nZ3144|jaxQbgm7rs83V@Mt4_n?y6U z0*x;>zoi#SOoa78vp~(UQVCoBZc0!`S5D<*q-`FgDKv2V`jpl%`p~ z8;pd|Ts*sVKy2I}O>W|Z1l)wlY+MvW@x#OMz3g6yP6%TiQ`oMyB|sI%_!kPUiJlw| zuES8UPQQ;;*a>~anXMnJ*j-ErN54CbI1(Fou4*Bio9uB*i(5#X8tMNEJJSZELEY*O z_JN<8KPg^$LOvASjl?s^-Ce|Z1UuK?V&;`AIO5j*)>F(Y-{8G_B^S}Rd$FFT>!R`N zMszucO9rP*FBJ@CC^ff~YlaTF|0&31nIOJU`m-X#F^x{$a7;}Z<>K<8-d+IWkrvZdl_5E#?Dg5;W<&@en220NGY_IwBTksu305n?a|}$%_`BG z*tmd6EMK%z_h~e@K!O-6@ z>`s2x7!L%SnWLPk3^uzk#qCO-UJD1P)au&QIndUnqAhgD)BjZDJE)#UC;y)S_-W##iVrdU`pfNZUR&gv-?`Y1?ErXKO5d zHnkQF`kXhC9~w^tPt(I{{#@v_x+FI4VAW-JsBNd1cEw7sE_Gi#Ui7)FSnmvHs?HC^ zr2FGt9n-cKO{m~U_T>uv; z_uJIM7BTH43B?IypLZ#Rp|VSzLw7!{8c*R>W6^A1Aq|`dpu4mbZm6#I2=(eK^+KQO+Pg$&}?6!BQ2WsYF8D zCd#OBE+nQEYk23HeEg5z3bY-|5?nL7)y9jZ=HdWc8OA|p<(vI0oSB1Qew*BOS5r0c z^{T-yS`21}Ci2?&8dW)~y}Wg2bTSqZHWjK&Hl$m)AqxxlX94|LMdH@HlR^Wn>u8E! z8o2YZu%UCabePYXubu?wglk1J2KR}P?1s9lxFsVuos)(|+>~i=v|lpcJPlk|r*&>7 z1*bQ1{-U2O-3_7!m2DNWLU*NeSu`Af#^Ma*saKT3bdl|v(VB|X9;wng%-xD5{#Z^9 zh7v|~s9~#2R(nJ{mLiq`R!I>~j4VU7780Qw)cBU76=X<_6=S+xS-o|MnyfF_i$*w1 z-ygjy4&pB_y7V44kFQCx^P*bb)Wdc(nu$?miu1U?LT9B1lNqXR5>PFwt&6$Xq^u7} z+mrQl^?i4Au#4Hp6vq{y4wyoys%HbSnaE>E2O`!9=uwWvgYVdLoSDbw5g8++NO*m{G>L`BhIYQlz8s5$)kBdST$n`|J=8%`A@ra z_gjgjEnArcY((>8fsIpNmi-8nORdowprAB_mg)e|FWP`CB&s`7U!LMjJGO8NAfsB^ z5@`F7mleV6=+LAnSMrJRPua|aIXr76KO$G)rT2PKMSM$pID2c&L7Sy>9w3L|4XLoP zMGCoflIs{e=W!(R$o%vGLtA9=C^+hjP0|NOo0DJRt>s-c@$~^Szwbc!MWK@|F*~*Z z6A4P_=}b)Ys1U{+huW)gyk17)MDlr57Ybm_{_}O_XL6;zJ#KFgcYVK?pYBW8 zAKlF|LMHOoFE;Yp_iOS%0Q-XR^yDt^bW+vd^5eaC9w&0{@ zW1rRq5Y}vW+5n9Y?c#u34E2B<{;EZ&0l>FKK0H?^+Pn6LN~m#msV)mui*C{x!%_QfZW#1|)B zI3g+B|hU$GX-F3+-&Z8vud zn7==#3t*4wfw|eL?GRgAT}j}UNg55FV%pt08igl)?J+jwfy=@E5;ZzD?v9JSsr(Ux z1^Ga<3k~k&Cf1RC%d*%C1rO=dnwITc5jJUTlu)MG`=znJ%c% zy+h$1{Wbomjz~NuBWXH+jaGu}cnz+e&z7~}|KM<#!kXYKjqfClF~E69b%xQM-SjCx zH1{?|;>HRML&5)Clai>+{b0Lglz&h%+5zKz{C0keli(NKG;qOJmN+bAuPfiS4gRSBqwgC2P_|imY+M4_d`Tra_(WzX6 zhxkfuC}^uE1J2%@#5QPSY6NM!9SXO4N@6%ivkiKQf`(MIeB8g`kSeEwBiUBXdn;K= z){4Y=yNTeCaqiq^bM72+WZ&n`9Y-nMs|Y1V$0N?rn#3Ri0c@&>ufrlYBr&J^d3N#5 z?J9SYEq6kNa~FN=vaoYqfpawc-#dTqc=7XsP@=N9&`n;@_xW@4oYb`~ANOnc zN(G)jJ6GjLzbI5vs5t~P5=snz)EwS9{H2z&avSVS)oym_LCr-vreasuA#{htS8`&q zcEFgBNqDq!NZ@;4V=nq~9hWb{6U_YR9?38FFkOb|GKh;I9^x}(*(oPKc{rj%@1?PM zqyBF^-|Kt00zNpc?9aZHF^vZe%v9ljoO4TA_047O3YR#!ivWqE7tN=ZAfY7aJNwFP zIOLPthDp;x!6+(lFYqB@P!yz=W`Yt)+*90yKxCKbzr(8TO>r9Yvnm5G*$~HTDvQs7 zVOyb*vBK_=Ax~QQ5?_&~^qUrb$%#~sq7{M1x3fRs5X$7|>-_A;PYr3a5McI_%mq^@ z((TFOVs7eY7=`p+lsiM^>PM}9L=uO7<-8FjS!Tw(fk3QVFYe`TUOdDPfSs64>LRL3 zYm*bxiYMw}yK*FK5qfsLXO*Dm9p3X+?|CGbA=(Rhs5*im<&ueSx!w~ z+1)L0??^cQce&HUe@*uy;;MUfXqdp67;paV?uqefzx{70M#tu8wp$?-lTLjWR#1j} zOh0n=+1yL87Me)>>HSZq3A~MewcshI2uYo`Pw>L=Z3OA>4V0~PLOgO8@T|&t3P`ic zmqd#vCOMh~rT?lP{YPjF0&KM%kJbhE?ymkDeuwEl&Y|LcX8*m=z5l%Yf7e3a`9e+N z8ui~@rvLsGXj^GsTQ}Lh`)}r5^xwbI{bv*vw*NN!{kP=?5cB{i9DdIJqpZpU?!TF~ z|7t&f|IHP6hj`%q|JHxaz51_zKcV;vqBFG6r*!4t0&O#m-RDFZS|&KrAM^6%KwCL4 z*+4wr8QC8EFmUr#B5?-mX`)O~tet-&!7YK9&fe1N4qmgf?Ryo$51J45);EWduO=}y zyC#UCoOdQg;Fzn>l? zV;`f?P=u{89=&}xMc-~lT31gA9*s1FL4l*81N{k@3c;We01VH52N+MXWBjmy%t{_-@Ou&XeJ#+| zts}q{9q8_nRhKxcHgoBJ|RBy7rW1iPy0m=w$=x-h3N?yn7$l1(7*3p_c>Ww8rPBi;JT%`cp^*1YNHIw zoA3)l2{?min%hz1%+&ualpJqGjgsRZV=+p-ayQ{#-P6we&@5*x_I$+owm*Z-9$54NlhBC19nlWqsgMbN zq&sUTM8zD%lG zl5irN-LBAB2_5eqN;DVqt>6s4pUJ&ZndfmSXw>Q4^9mygI|oz+hLrKwM7cwnD3V}e zk;GEN`bc~xFGg{nr_a|Z`@BN^qMc2cRoPct2@m8jaa7tEQ~QS!BZIMVhfbokf!1=V zIYk5-sFrzqJU@~5@X{Q{?MgSbLO3)_RjqpbNx{RD52Tb~gf~EcXFN{mANe7M5*Kj% zGlv)dnBG>v5#(F3@B7VTX(;|Oo)!IZ6wW=YqGfmXyytKhIgG>32OUKhiEJ>$B-k}j{c$SS1IjOue3So(&nT~o8y;;IwrP0n-Iu>#m5-r;m5UEd;87G zafEGOoAh;}|CMj3>`(#?qAH+UPvdR^$<0+)nLu)Lp%oiQZZ6;w^TDg2^(j_?w%jAY zTH`Fg#KdUAJvM^e;oQ&54>lJ^qepOUiW1@LL#<2WuQsqW^nO-2BjQJ=x<2t7JUXzr zj?x_rRYQ~0RgcFU+E=^RGh*EaUFvnYMweN-T*k#N65TUC@c2bCf;u)mc=@66yPX2< z`tV)^A#eQNE_^dS?=^U5{4Uz#GP(naAXg3Ml6KLLPE(&ZGQ@&Qj17$W$30pOF8gF6 z?}F>B88xs{U?`}pavd5<&^;MhcuF0wI@g);mRICu+uGr0%Lq`Ec*LA#LH4imw}9>$ zvOuGFL5bw!*#`Qh<_t=eSm!;rc=sjdzO0xznx1EUY3`E@m&$;ymID0-u}V#efql2$ zHfDSpDjE~=z_E=g&Bz9Uq)y3bRJE7AUpl*&RnbG4KyBNfG)I9@%-Q@cRO1$^aSKi3 zO1(yunR}~Asz!&r_qFD}thiiv*7V{O`q!(W$Y1nC_Pk@v!B3>tKdO1sEbT%tv;tmo zBqZm1TxeSz`Lo{_KG+EhE1{s<#kp8wYbqB-7^L#NRnI5@wtMd_=kj)`0QYY5-5U0V zsU7C|5o=GT98(_UC||o#Qh1AE&xTL7& z4hl^TGh2i-w7P^MDq6;iAa)yWjo&aWoWW21^TCi0pi*J)S`%n{*ZU$s#yg|iDmpvl zWv&E5iSVQ|Ib~JTq#J)OzN4aZ6EV6SVNcznf0Beu7oqS!6x9>Lgm=m*LIt7EQ-sU& z#{Z(HEzC?l{n65)EWumhbu<2n4>?0nnv$Fa%m%sT#0FS3*_pPAAOV%D3PQo%OsEc9 z{?>+=5wHgKFGK~@A3uR{6C`{58pUw`0(S@|9CK3Cg#6SG-Mfh@Cj8yW-Tk31x9YM~ zmz%g)&PM#N{}DkV3MEHn?pyPDTqJR2@p8-D)(lHCx2Z3@9m{*33egAMRS{er9TME+>qR0M^P5tIE7T`2bpdwC>aNf2b1yX|f5_p& z>5?l{a_0JX6JImR*ZG1zkScvjS9!L&fn6`!=Z-QJETIVWs-@%O!+%J#icqVT+W!3@ z&^C*Yyey38{=TBKqEu5T(=evs+yZQ(*nht^SlIC`;C4i75n-5_k7q`3yIPqz^qfQ< zaa>kOcVx%5H9@dN2%W83YeLGi!7w#W#AQ-B?4~(YV!KL}89}9yI2*$C4hiPv zZdJjk%>tvH=7?GY1cfNM1eRRoRWh}&Cb*LLK11|n8lsF>&^duei~9wn|1+IGlkdDb zX&6Sn=-{f>|A`)s$@JTU7>{}wh{EmETpVmq&96G>ExkEPVBSs@^grbvO8yCJa{F;E z@Tu8$x2`@q5y8T`E36>nsRCM+7>>`Nh2tSopvZqdtdKCz@R9X4L2!mIM5H2$&nEZS ze@WgjPRbVZ#x!sTDRCtYtC1=q9G|%vFU81agyxNBOK3*a_m<|2_jZz`*nu_(Ls0j( zY{WUDL~+d@BeIm|(uBt&5ihSG;$`mUNd#dpogA+mRyHZ#Jgh_-^g*$+F;#<_X@qhL zJPN$+$uK{=cdRqEc(AL?8ksjXbLO>}(GGx{7BOW~*={|aR zS!~>I#)%~poG@~h;zzhQP*2*St@3akiSZGm-H$(H;^V)_i%E$=2am-@lx-RJN3 zm~lwx+3&Z(GY+)hi^lfV??!j5r&a|9TZJb;@G)IhhS`OQ1zRhqOAdmbqt6w#K`LoF43~H|kPAP4~ znf_}Ctkp(%yKA$#guQtDJ9_R>n_ir(9;Fb4tU(zXaOy z`M`_9iukm}xDuUHTJ1C!6bc%glyT5`(TpRj&27g&DZAmybDV2)bjs;pIOX&LXDGS= z`BitEIU?%`Kqs!f4b%PYE9v-2LKt(`y`~sUAPnBxctN~27oPjgJWjTS<sw4B}KP7&sr7hjCf`$VO^BG zB42aSvw^nr`GH$fIJ~xU13wvM{3y_m*tmZ~#97h9!_M#xcufa1f8jr`uEbY;H52c~ zGw?l$58puJ@4nUYwFJS-P2>rW+-Lza}?;pRP)UjPGaeZrx>6clYmi zc2dJMQ-dirc@e93i}V**qx<#^L9L?vef?Dx8{-9@76A6{4dgX z4W_fZnDJaq%Gt56yeb&|a=Vqj)^2{y0LadDE z#@I9<{pF7Nu;a*CtgvUErQLgHp)XxG=O3v7HsiDIg`D%}PSa(IE|YYr;$r#t7(Je$ z%P3t=(&czvj^iTxhkhT%MGE*PjXOz>Fqc+t^oH~+&+12F^g@00M$Il}gUBvM%SETD zg#{5Ocb9w0F4I68_%U}^X!E~9iAe;u@Pl0BedQ91zPIl`F!X%_0j1Hm8KX#d^rZ%P zcoLQl?*mKQ+f#?E$vxbnD)|%ipzeu`WA{tC9IFw{;$XR22kW0f3M?&FvuSZ-_$#h>?0!Fe+^`)dB&rl!V;RIwT* zMrG<|VZ&oKsxd8~PHoA{iUj_&K5X4oY66w(iSCJRXVlKHIatEI^$Qvt1{QC`c=AQE zLJd0)HsaRk64GS?7siJ>Mh|D`GKx#LPPXg+KKr*){X0$ld;KWWzwp3a?i6f8>HQ&t z=wCNvjyOyA@8pYZ|MtJ{!20(nQ@A%g-v8+T*uPK76}g&0=1$}y+}`VTZJoNdKHar9 zvFTM^i-d+xj4$P>YirfDScg{SsAHd`V?*6L_N0qoV*}JYzfVJ{A7u6^Ro!K6H;KH3 zoSnDNK4ttpajbgPID9X)`Cuy|kYp{rihn<2%5Bu;I$f^S2l;0PB*q$0_7U;=e zqcwBSP_9wBoTSU~x*W$vT;_tOS!azcE}IQr@9Se7(4OYhqodR`4&-i9@8@KlY2S3 z)K>=fahHDZUaKE`2b#${8AiJM3wBNVQe@VgByU+vd0*okb& z-?=iEEj`b8A)u7ooWi*1Y5Nlw5p#|nfxS-;C8EVMupnVs8iFmcK!&9uGA0(xl^wCM zFz_e|VjHuq{6^&8?1n$9PJ)Dw>LgOPDQj&P|J@ZxXfsYEf!meJ^~_=!Mm8B3>(OSG z=PR=BOrlQ(+EyS1M4SRSk@B}5n;!d4t>Y;N8l51Q(&$A>UT2cGl6*=cm$bR7Dq70e zAsfY&o&1XNsCv9lvTu=qS4+fzmMTNMw+mO57X4l{c2UUh+~Yxy50*+s}V#w5E=CRyyALF}C}F=Cp%{v`1~j&_LzOWd#Q*eMk@ zE2lsSz~ld6PKBh%0SzeO)+Mi?^*o_6J)AO)CnXBP*pcRerJ1q$PEHKZ#*nHC&Wep2 zVJkqNo?YVp^*vQEj5S}rsX+GJb}AxiZ=T;7VH*)dJn-{#O=|nbwlY5vqQPv^8>-f)gtNR%J z{`tCX{?L!T+f=^f$>KZIQd%t3iW1eJcDH`GsBl|gvCd=?C5GTnH#ofHcaZ=Hxr3Je zf9$<^e4JN(@BciumeFR(At445D!>riO&!}=uptSOkHg|_g@CZ^|6`dQ)ltJtoR0MRl9$9SVvc7mWzYV3cXZI-N zKJ`z6|H6Kn>%JefJ-H1R+plSq`^tA?TdNOUpu;=y3a9aG%lRtqu-0?bdZGDNl?+=1H zfPZ}B6Y=Ms)AwCDosZ9SuhAzVW!q;!p15uumwtEaYkpd3c|W@aj80$n@Oc^oT2+1@ z@^!Jc|NHpXO+N`jd`a@@Vw1ipefX8b`POpj!_tW42>bj@ej*whi^5_c-Eu8oo_@Zb z1opX$|NM%xfaRs1r@zHU@!zLzJ3;RbLV>dXNMr{)%m2i#Vh(;UH9d>`=d%1a{2bAw zG4sfFeOYo<*FCqbetmiBxTkMRchXnQkdi!Ld<*Y9mExC@x#asZPQDLCMDD*YF&jTf z|E6E4Z=ddwT!+rhDQ?33tUrF+*|IDjE8n6|`pmTr93yYZFC{)HF97=n<-)YZ}{Gn=&wvPQc`qAC$=aVc`fg)HYIO;3#d8hSO9d)B)1oV;=G3%`|#8z5wZ}z>l9WcaW_+Gf=0@r zx^zG@zE__4qKBMuyM=F{2`%MmwO0;)LkMXPKcpQWU~Zdwm*hJqO`g0pdPXTAThFQP0vi~|HvgNpeEZTtKGRHJv_cYao<%KMxR%h#YiIQcsJ?hdUdZhxOl7N_JSR>e;~ z8h`HV@nbK%Yx-NUc*s}CC6-U}L2~76KD{8OrZ3{X(W;)@5fK>nQy?s8AxM|$$M&$}wi&p;UEMQuDrCDbGXm9L7I_xUc6Im0%t&;(V^ z>vg~g2&wnBf0h@)!JS7KXmj^4=-G?jcjqfVKZ$IqrxT0cdH>IDZ;C(sc`0Lyzd8NN z9d|U^!j{E7cfN8Gjf_k1AXw~~`-fnS|31W>C-r2i^4fV6rNTR!(AuP*ExuMaI`l3< zf?%=H*B=j`HTW)!Y3?eW6LiXDCD)6zC4X;)?rRb9lyirle@@jNKjH1(lAx}GM;_2_ ziyKdti(2K1QrrL(MumO0-~nc+h7QUFbC`nVIer9PSTA405DepFF2U*1N>3htphJ)0 zefy0I_RiJMtg8#UAJ9Q|JFmX}$=K)o&yWRX%@m2{HQo zeGS%8*^>M=S=f8NK4YNwOsz(PE`elPkzAW{w#9ZrZ;>TZ* z0@CTS2D@Np)nvmic7ufukazW~=omYB9siKPZUzNaNsivOdZPROH`Dg^jgM}hd93_9 zN72&YF?{iPzWh)lir@6-_M0s*ckalVI{$T4y=J{h%zO=tv;0C`R8YN!tijuIot7)ip@5#14*eL4QzH{-`n0?3zKkDe&L zru|bFy;1fHc=k*M&z>wNe%tVjE>!W1i}J>AFM)D7T-vLAO|Pn8{!ii8nri>A+1lYPDXm3vuqZ33vgmYwEm^bv<`KlyBJcO14&SMW=6-}eE1 zdI0?DuizJo?>3q3(ucLiL>k27<-2Abnr(Jy=6n8RL9MYZ9M=b#+ixb=5jUFHZ)&dR z>Moa!yMnpBT>RDSQ)DfJI9ATxV_0|2%;y*D|3SzdVcm}$)C9=o_Rz&w?A5xyM6Vl&v$o(Rs4!6-&ZC{_#QTZ z`y7``pH&&}>_fGHKC*D@X}eXy0luhEIX~UWuX-MTcwT_|g_ZoO_hFNll30@3S%+_> zwPWTB)BnzwS}wl$?ALL9>4ozPb=^iH-A|rC={fvD=l0hz+&BDEs^Q z6}SDvFKphv4|&Ad@4tZ6)d<-K%!-KktP;-=pfA~1-ytAzU9Y?=xT7{@O+rUEz=W39Au*}5q!Wy z+<&-YF51j*5&M>n5cR^xXSv+PMc+K@V)KtMN4+Se!22T?sW+W>YL@f zo?6r5-)RBK%-0qUQcpSk^s9Ne#mUTRELYD4jS3jxc_^Q)H3}8^>lhWlMP0!IEjPjj zHHkxk!V5PoG3SjxW;}na>h^Q*W% zqGH(3BxYXdox{I^HK47r)gkaib^wj{!!^w=h%{6aOD^=c@9$6Fee+*m2RKg082vr< zzy0oWK}A1?xGH8K7!*-#sVhGHj-YfEn)naSlP3NEpMwp`TR)&y<+yoxYfR(h*r6xW zmkpmGUj#W1%fSDynzzK|JdoyR_0oc;f7JhF?eF^#udxmRa=$jl^!Ls-Cs&MIG->tr%nAt|?e)@B9*~hQ{`m0f?y#2vffqda_FeG0EX~U1Ahb?B2 zkE#5p@q@{jknX?+R;R-h?0Z}Od@8EoW3Ed28dUj>SNB_HROiCpUw|eKKYm=r4?_(b z$YB794?QN5+Rs*jXaL|jNCOvDykPor#XqhDZ9e_BD%!OCwnLl!uSS~-I{ajAD%XFd z;$w@?SaPVfhHXcFH!#7iS%2qd=e2xb#?^Sxj9zg**E12FXo!5ey2RXj*!udjx4)Ng z&>Jjg>~#!DUk2u*plloUdbX##?Hjx2&Vk`wN6D|dz3O(&p7V_aUo-u!Z!y+BmSMi{ zNu8`k+q!;LEb-jaiDNIltM5(UNQ6J0zHFjh-DmTRbJ#%pU&~wB_K8p>%LQV+e06l; z5D*r<0IDl$5M8Y93L`hLJwo-n-wLW9^W)mD&5oxpTWQtf;A<{__la6mw?QsN_15e7 zpz)*6=m#`^YK1xmn(uwIT>kUu-2no!+a48~!&k}|L8j#k^s`PsZ{_F6DHv4lzyDQ8 ze`Mk5U+(`<{K4-p_f%DX5hs-Xa@3A~FG@tAi8yFPV(IUgprG4+7dJ#XD3Zq#Vtn3A zdd6WD(P~y#)y!j&r0ru{>a}=q*e2$s*7ke91JUzM7&i6f#8~h>dskn+jUUuloCy*L z6Wi~4qI89{se7oEkF2u+P8a#TurxKLn+Y6szNx68YR7zbm=m#7r3a#msXHV{}q0Yu`ox`4C5n&?UX4d&S?Bc2nA?iGk4k zcd}=3HwlZ_-EC zH=_t?P*F>K2>25(TYQG~J%7l9NFMj0ac$_nYde`>=T8qG*}mm}+_4+XlkwyFNNCXXbR?DzVLl3(-k9r ziR?xH5=BY>3d(;5!d7oYPs#((eR&r@+t`0(+srwi*fw+KeSBI%e&#Jdes2e#mzZ3? zZT8Gh$UpNmUXiuW_u(>J`%q$Tt9^>)U3WcUPK1R6jJ;e(O-3It5t}@fQ=CrID*vt4 z005epITC-NlC|&{X#iC*YLb(wTBXll-2FZ#m@XOvXK^%(KQEn~x%3k(+MA8fT^%O) zxUr(K55>2&wP-( zGr)D`d4nI!_Tk4Zr>wSo)ay4{Gq;HRqOMdr{I8V`Z&2+6l@iuj_4I^#`WmX3+^Aj} zeZDaDL1vTkuQ{bR8=t=6vx@J77nkT~qkhiU&w2WJGe5(`FLnM}{jAhat9}~!IpXGM z>HPc|{f_46_c%Y@{G3hC9t2X1zAl1RH2QOyA0go6wK#CP?+P^t8&_rIzu`)}Fv&hf zzQlu?OdB~!e0=gO%`xMh`jB!19tYg}zD%D7^s`Gp3H@y2$ME-^ocOU+v95Yn9Uu5* z`DZ5|wtUkkqWJL1`rBd)mOpgzA-+uUUgidr)8>=Cb5}rZXR-wvYY={JQ|h|hd*933 zw;X@(mzW>kDDLlL`|Y*QB&MI=bX&i@{RI_bpRV95e0mDVMoWFe^=sI`SQNGb2?DHmht(J>-y&EF5ESD{%`J@yYy{9Bi8-_mWSY8 zxQo}RVEV;P?H|zht)y>=OGZ`8(a^8WMzMH4<1=BS?P$=?mL=xSypa7WfMx52Sizy% z=$jj71Cp`T2Y1b#!v&fmtZ9Oaw{hVX?S6K(l_KA|>S%zwgtql_~ zdsKZxMoRZFK`cSpFT;~k z4wL=_E7iS`j~;~j`uV<@a-TC#yUNNVlKd=-hj+>2_d2Y&)>4bDC5umg|1cpJf)_d( z$8)ErXp^VNi1K}Z^{d3g!sDk=HLLU~90ZBm@BS$LgYisz{*TzW+eUrHUCZE2TV8x` zed6RYebJGC*fZLG#J&0G0CN8UK8mL;0)vIj)~C>gQp8YWe5%_c5ZbU)|}LKvAnHsQOxZM_?DFmv|9#^~(3D>;k5>4o?VpU89a^Vn_6 z<7= zqQAqMA`H8OM(7}|X~?o8#pogrDjZYWWxV^qEIXUM;gP`8x3&52)G zw`|DQ3V+UlcWh!BJ|X?`_|!)i71iAbPJD@|V);>ieuc(Ve!ndc_+`q{g5vXE{9*zEV1SJ_g=z>LT@I!mJHi-ZXRYojpLIy_06s3 z*3jx@J4{-AOR7a@_g!_XkpdryZHJ#PC*}nru8@G;c*WdB?UGEApBnDjZ28%J*K!S* zvhBZ9fc4+-S)ZTtG||fPSM_sTKVRgh7F{a+m;UB z|Mf_$8h#>MC(n%9M?R{vk1XB~tOsd{`Md6v22a7y+1Qqr5`j*|ZLf^!E6Gbe{^q~g z=W%zHLLFOPQ^L8av|n&{1JOzpS|!->{R$$Md>g7$*te$rQ>1z*j<|WCgT;Lc(r>wP z72joMN8U%to;WoIc;Ek5%l{UC%lFgzcUJqS;&q#^tUFCdt$(|H|2ClD%Gs!-DY-8d z*55`jd#YR33JgZXft%(SF=;UK3sb^N<+|YctuOzmk@-1479nRjjC!>A-%bHq&84I7 zzlKPBA0X2D%>KIIL3|GQf66cY+sTvDm+gIJm3$+tU2FOAYlHIJ2=Y{Xb@k8xNQ>C& zkK}plT;3`_Z0~ed-uWg4%0FiFr0P3gbnm=#O9$fO; zNA;QutH1eU!jE75eV;#B{c$MGsVIMmZDr%U^ZSoT8qd~WPlZRwsra)d(hHP95}&*5 zg~qzT5>rUPc>C2#z&KkyJpOj=>)iJ3pYTT2eqjHh_V?|U%@*k=v-OSYrF;!%{UwE2 zB>E{GuvMV!=l(5z?3H&-|A&%kHUZyT+6!}~kyWQZQ(3QAvmks9JFF!*wbM>7+CBb&Ct$bcx@Q;FReD0H0(nYdRR?C0- z-WN}51qDgrA6fe%?fbUCF+3QU_TQwMudk@*)pM_XVO3E6zx)7A*`Y_96;Ofkqd+X_ z)*W=qby5<-cWblj*33_=TkrnG-D;1zRj&8Fa>|v|6uP##{8w*uaCSPD3wUY4?Z%&N zJgKi!lSV>>W4*T9=m#W;>CfWCc3WH|PJWKOeB5lddzxDw&(~plXTBll(Ws&cj7Q#j zbBCf=?o&kW;{ZuMhs_C={NH;UP8h-6Boa^6NaR9Atvf^Er=x;6K3M?y85bi$DReXG z_No?SEG9)^3(U>Akd0Hnh-HudlTZQ?2mYh~F28L}F9@P~x3_=#`ZIpcGMAw|p)D&n~iozAv}&Y44xk&Zpzw|1a{klQz$LKs;3E8`?yj!6kdq3{pUw+%Uu7B*szW0oi$G+XMt?3(gzPP?H8W8D( z?>>Qt?``Iu5jw=BW$zcL_laYpG`Q(n__>@r9*Zx255(MkKl8>kx-XwD!S?bSU^vbL zG7jVYe)R0?{%;WA36@Hb8Bkue zO?7L)%H+d2^@|2xS3B^3t<%88(oR3{H^bDTfujeXZs1Yhqp{Quyob(d;7{j&#lVfO zYDWK`82ERew1Jy_|AwCbsq)oP=`m3<~ zZ2WA$Y`kxdRmU44_9UfQ`YpMD?0`Y7cMW1>}`uom1cx~>ipTnobbS<2($<@Ugu@f%f z=PrdI;taa()I%v&J_lf~{ymr<<)8enc&_FPU5X%$bDM8`Vqv*jpzw!z4^g*;zeCc` z4t1*dzVbV_s3UDZ`85TzTrqKsqt*x9(&g8?0#Et^AG7wMBwrw2eqpoK@VCCe{l37w z6*%|VvdQ$`|7F7SzkUIkextY#GF@Hj))%p{caD{xm_(4@`MF29soix3Re4gFBhLPo22J?Z{`>1E>cr|GBWuJQiW1FYt@`JATpFGEnU$1HW`*o!3BPw&Y zEA#jpU71l|X2O>_K^ZyL%PM=ol^yc+9rR@n`?8PwvR~uq@W++E$d|vzmp@|V&;9S; zHR!GQzCrI_ZU%b4rW$~rdg}P2p!dO&)F2P6X($w7a*s;l4mPyVmivE-A_)|nf>Z8( zyUp8+1mCN=*jfZ^aS4!mj%?ac$*<@vhyV8vP97okcavy|iTAk_ovJ1=dwmCQwxX%C-COx* zzfT6>`{&z#e;(z0v*H*&Ih@yen>!@D)=H*ZE2iNlfKIh9b#KW)#m@X$nh_(HQb|C-0vPWS3mp_?6Y;c z=UZ@VIcHue_iTSr{b$xoYcZhepZy#m?|ZLd>C(epG51E>8s3g;A*9mN|EyeR8&yfU zA&s4nH{JQUXQ&x$nV#npP{(>vdZc83lbd{jIL7ks;UgCH{U_a-`%U)P|62R>v@Sr^ z{SrC*gfye~>|MQ63Vc7&;$?TNMoa7@Pn+c)b7WWn6SoO%w^=+cAl*$g$G+cj%s@=W z-?J=eF0Z&rSxQu7;Xve-eV^kI#Wi<2Ho!x)O{So4E+rMWZr4ojc`O&b@Q3J;#n-ZP zD4zoQw{kt3DOvKsl|<>E-8FOOc?+)vi8)_b!7&ayHr!nMZ7n}q`(5Hb1u~oK$LR&% z-72T~YLfFJ^dUg3GJkBj?e}U4M`XB4!nJeZD`-bG zWK%iS{>cg-I1>5{>Y^thlN#WSF<$85phyM;F{TYkMNE9Z-KU!`l^=hWO`<^MarFw} z>$v|Bi2-{HtWz!JkKIB!o_>s(bm%-U_HT$xk0;6xKV=kf^q*mxyih{{fB7><0bLOV zEN-fPBuiZu@9}Dlu!`zNwVxm})@9z}SNNovVc92T69KqUvAz9bd*G6fy3@C~hNWE# zlpkCF+HWC79)1`&u|LGq(z||t^-*;U8((juaNe)MNRL_M(-9vqDUg^xMg@NJ5aBoZ zZ7gB?rUt9GNf?nAr~Tdp^=d6W5hQXSH(Jm9YjmYcU4h*=N{;r8awff&heu3`&$bGh z{qfmuP{Qfz*!S$+iBs#%>L}p^A48!B_gIJTGS9$*dSDavaowG%TP_u-?uAd6n{u1-Ip)ScEyXEo8=7k)L(7g*|IPaG>+AjNY;mgQW z6^m<#9R_vwBeq_6^O&J@`unbTUfr9!%lLZ5Y~J`Osc;1N4PItLFhAVt6-^(7G zzZw{qT9=l-s)`*FJ5nhB`(M4}_}`;i2kS7qg6VValZzF0%*mln{jAZ%JZ_`&AAF8x zLZ+P=CtC?UxxFJaTl19dBj>ztwriC#Qp#NG`7=7s)o%~#?DBaoC8YvJ8Pg*_(fE(Q zCi})s^Wyo@Sxs8rEuUvO-&tw#4cf;?B35r*L_>(rUBnjtlaEYaw�da96AU8w|kC zP?E}jQ1WGsZqC)8PiacnX&FCFD^bdNqRQrk8ic#B7#8!-I zk*iZnC)X_ev6*zgGi=<>Y5EY4j5mb_<|%8B%0YEMY@jb3rj#o274G4POEGtWs) z-e8?~`VC*Ex_wrDGgaUPv{(|HRVaF;_UWZvp($(%*7}}~^6y#STwezxRPzj3@K;EH z=a1+)Ths_!;uglWGLG1Febir1*pZ-=9jRDHSds2mSka&UjblagRw!acRt2*y)F>}+ zG5rf}gfjxBW$j;2{}^j01uSN-i`utT^5d$L4hdKAA7A%pG=+QEn2_%29V>$@=+Y?f zx2hd)D32|wXNs6@uim4^Wp?HqWtqW`XypY_nQG`gPec+Oz*N&d3BE z_vwB_?{got@=&n8MWN4z*taO`vmtry7Q|;mD62Y`H1Am@xMh83daPO42Lt+`x3Hr9 z_dn=mwVy+t_p1*SHj&~wbk<)jcRKriJ%dq>a>S=ix$1iN2|jy~C)5+Izc{|gN}kF^ zq$pm&MhfNsc_ZxPz?1ODGnWylgFkNipR3@Hy9J{TwE^@;1>pVaaZGpS>f5ykgO>Tb zF&llqG~gJey~M=qSC6bbIt#uk2Xemw4c`oLUwzR>L)=$i^wE%x31_!2=)1;fwpH>! zjgIK};djW#mz;(Kr9sj#s)}MxGV>N1Dmh%TuRiRQ!^aWrUO7A=$bki-X^mLYh-k-i zPoXBkeVnFbn(O1`|E3K{DEnc`L|U7+dRZsf+Wbz>uacKu6pWW%4*6FkhM*L^gOlDU z`Z-{zB_Vz9|4#eem(!Qt*)@G^YO19O>W4m>_P#gi{>-1OK5Q@kg;yk;aa5rNNSy3W zlUvX=C9xlJXn9?9{|Jb9savknVf%f!4eFi|+tDb|;LG>i&4_RlnWCqg`n;FApiQW# z2N!Ii)NY_t z_s-oKCf0t1j}IoE``5&=m+=^XJL*|)NbFoqZ+Rh4UWpr-^=RR@X+@)tnBm8{PE4O% zb_e?pd}?TQj&0#fZ`l7O{Z56qtD_B8I;EA`W=pGN&G2(k7$dF0J8yUQSFugp79P1s~0f6ZtbIZYBOxv44J{ zu%7olQsrJ)f7niIgte1KpYirX6oCAU_xpU(JAHqF-S7fi2uiTJnT&+BlQ>S$m9J*r zk<=GRs_d6GBB>%&x7p-)*m~r}_dFN&T`IGvYAaGRhA5Dyq!jY|BY#vQzn$cY-14Vd z3aZ|j31ovUH4_98VOLp4*m}HTBSf9$;q&&;by}z!2xX(rM<2wVrw|*4@S4sdI=_k? zn#<4Z6NQ`(0!u7~HUG8>g5EDI5~K0X0JF4xTxPDmp8BN5&pA`0{L@}11?>g6*r>H5 z*)$^p8R}3^7=MCCy%83Kd*Y>q&|BtzbuW$qi|{c`II+rNqMmPQe1b| zlt0c(wt(T`!<*N)-*r7~k^EH_G<^E-<_k)HyKtq%oFz(~VuzI{?|u~s7ru>E6~X7D zRrqx3U50d49RTIm5YC9WKzmngB^6B)N()gOWavo3~+Z@sd4zu&Fj|}-@?W6 z+sn`i) zu1AZFrj;+gL2txvJHwSKSSga9EH|lIYV8s7*G^OOcrr6KR?NLasmiCm^O_@U8Txdw z`S9kq@C^B4*-pQBeY49SnybzqYNX4>Div%2@D|diGV$4gPS(_SmTu&117{mpj>tTN ze3pa7n$)2DU+(#V(yuNR-ftiehMM*&Y_OG+D>}=0_xRlCF;CoMPOjKc9^kQkEPeWv z%^6;tuALx5(o-klf9IN!{-1yU2Lk^a5D0G!!pSh)5rnBA91g;XFx(S_r7+wTgyTV2 z2*Rl#ECyjd2s1%=FbsQwFdKv;L6{7}L$Po?4EKfMdxB-TLa=PS6fWDhfxnI6vP72S zCjKrAm+hVim+cq|mJRbavLRTO;aHdmmQAF%m*twjd^%WmGtX|;yVRA>h0AvGw~fEu z`CwV`Amwr#H}bbBSe6en&HUvVd@*?Z&H6H%23A$=i{_}Eq%I{datEF*V3PB zFXHcF{x0F~?fh-#Z%erBO3GbHxhpAmCFQQ9+?ABOl5$s4uD^$VjRec4_{$ghV;oZ) zr#K#2qQ@T-M7m&bM(o@tj%-OaKo!p+CbPv+*wj`q*C=G_ouiD$A;iu^CK`I!_ zah4kfhX%5 zxNsv)W|)OSX^`nj9^?mvXHtMmZty1HlA01Yxi_jlk7oq&(m1dmya_<$Qb2qRs12k6 zSZ|KPeMz9ZqXg9Y1j)U*13VZ7YJ2pvBgY)|2@eW+-rb|Y?75IW52U&5De-h$ni))F zb3j+E?bI~pAG7a0 zRm_hCb=l-NWd@T4ehZmf_|1av+$jxDgmv3;s$s}}3qr-ZTsD;s>*C46Xjr$4cf&eJ zf!`jhVR(!gu7eN?VcphTZY->0%&D+0kxPvyWANs_So;c?RS9sX_qo% zCCcBD&gVGK1Jb&IR1zo^4rNn}S4gV+lRz&w#8`TP8@*yg)a)Rc9;Qq_m*cl+?T#f2 zjHr+D^o=sqX+0SzCb>UgHRr9j1@7~1dRXJl4(9}o;aro|tnorrb=M@-&jXwXbyJ*c zzEZrED!~ova$`e4KAR%1vTh=o=YAnQ#vF~NHJi*bcQ^+!^n}{_lf_YkFe555x+Ypw zZ+CI7)(f)w-2a(=C0>3A*+l(OPJKvK{cFuWZ+ zq_<#Ml%&6=nKp0o)#h?6o?Dd1MH`#qz=lT1D>>~g>2%60kFB+wfwjdPwH zgdo)``n=9?8y+SYrp9;|#=g;hsXsfM1p>pxaLjb677h9LYh`{32uP#(=G0 zb%3$wlY$A2b7wG9q~@W_Ftb0F(L9bP3kId^A^Mz3(sKvftQb{YK9i;Ag)!kR%$%O^ zOHYPN8Yy@MAArT)Y^_jF%I0Ot+NCX8%!>opP1$d$kY?0**fDqPcPKpp4)h!5?=|e| zrB^^Bof7Tmb5Qiw+z^-pKcr+lGXgF_Bh11;ah#Gp;GUj})_QW|lt-{}zdxPld^<=Z zJ_FyY+r^wR8+v9(WwAeo)cn%Mth^4x1%%kW+J?t-vw=hzAMO)MW{bs{@un2{xUZ5-l_2VVzDySEO7f@(Xd{)s*oH>+tno(h4s7K z3;jvJP1TtK45EG*;u#L=ODf4BJCq&{>$}G^l=>Z+G=je#F@z#le@$ix9#B7(hr_C$ z<9Z#wsV-gPZo)0M(s>;i3Ws;6>@dI;@(z|+Ul>j1CpbXB)FL)|bx_ZgXqZgBS}5l2 znV9GXK|=DZUJR6jc&BP%x@kSn+;d2crc(zPW&y>7tFfHM*E5Prq5}+Ahujon=+QI1 zz)e~=ZmP;OBBrmeWPM?h>(x5_6vv>wp+mxY`U1n$#0{aWaIj7Qe@)zYvWPlbKW==E zp};TH7x+j}pDb?Qy*H>A!=N%)0_sbBJ}q^wzEAH_*@Tp_`t0Q*`@_xdrVgN%5G9#Uj&qe6QL_j4*f2Glw2&6zX{M8EeHerW3o=;V}LbShC! ze-DK2sxDvCf`kbP@rwXw{O+P0+zi?gG@4`s|q1 zBG$vRtHjCFtQ`^u^T_-9#E?4_?66BBoK8%p3N*A!sz_Lmov~vZy)L8?MtHGy7x{@yW`PM z#eF>x#Sl7v1A1IKRpcn%UeNn+vtsA{yRF<|e`H+4!{T5KU`S~^8#I95qIivq@CU$}cpmk~E)QR|w+F2_Y}muNx~XTviJS%|%-}VYPNDj$ zoQ})`!b)%x0w7`<@+Qo}hV2KDRKPdwkCM-@%!dBl*cjLZ+zKU3D&QtwNdGdE5(^Dz zuqi}9!{ksQH_-2n{XP31aq}KL>W>}|PWWTz7u@~%gMw1*Jn7(n)E~RTew&YZf877Ho5%U@xntKd_ZM(Q@KyY2>1YX5IJ zx;X5Q!9DI;^DDd$8dB(9unzFUABE4w6Ca51P57z#kwq09`$}QMHjgLSoGb+34-IF= znV;OiSZ?aD$Jcp(-2Z7;-wA&V?swOn{&>_MyB=`&_xs~ff1LNn;P2e?E`L1XkHLfP z{$YQd_s8IOeLMcx<&XRQ(bF^VLLr1s1jnK*fQGGUC_N3IC|ryE2wkHYVM#O$q|It- zNDdY_W!{E{>?nG{YHFYo z95t9kzfgE_08+O0u%7F zo7_?Su9Ph#hoS$GoG22wOeAkc?Q57w$=U^8i0Z_)pdqVE#*2=D!9e+x3HXMz6YUN8 zoVy;$nN)8u?U?eiaQ6R@HAOqH$q|h&3!aa2gzxl~pm)?C*GlsY9rvw1+E9p1y|3qy%BC0j(r! z{f0k^4sDn`&t&8B1~iQ9HMOZ>WLGY`GY1}L3ndJf21YZ6c1!<~1=NlPO`GNqHgZ7q zNQK5*+AxgrlrEgedHS1h$9aF;f3v#|@}8dj@u)wZ@W=fH_xyxEb{5_BQGcBG#}oe8 zS#r<2{4tpH_4{L&KhFDOFy)@__s66D7##HV_~YT|`j9X0k4OD6xW(W1$D{t(d8@lW zA01ak^g5EeK%O7z2gz~xZttKBAmpDv_L@ND+8^!t0sovMdPoT^rvVS3bS>m&v6L5m zPi16UG;|jv`9%L?$PxH@cF4+^aY=c+H^$eEjE95oI=Q^xA5TQbvcJFJjwk%_@b}zx zu;`BS{&?d1?)vEea>vde_-lXc`k}i%;g5%(ao6+y82reW_s7m3yX!80ocG85&-!}& zasDUn`tVPE`JcIC=X3t}yno*4vCuk9*JHox!Kq zfN!dVuc9H2cOkJ2KAtpvR{VTedPQIICU-216vX%O#^U5b-eydUFH#t}B`^G7or3tg}4GPoZ0$9aE*uNeHqKX7@E3eI^zU`OOnXGgbt&mTM2yLyDb zN%-&lI(Oam>+X2iKR;S2x7*~)3ID$EJcHgX`Vc?W5kJgO=VsTA_?qhNeA>YyXk`3m zU^cFkoLRFrY}||4A{DK%|G^sf<`%=unvMoqC#Ln zimoE5BorEDPDxtWNe|*rZ{>UOY&T}`b>tz8Mmz#V?u3nr0z3uOZNw=mhmD;WvNk3V z&62i^V$2Ot>WqBgjhsl~XQbC{lx7(;g2nu3v%Lc__YvA}}H5odx>PiDlt ztc`;rZG>ebI{rcEpKgqe$>wDg_GE-^j3URAn}fz&;ezx*o1Ft0bo!w>h3F(jKuByB zInNsj%VqLNe4vS)DbpOoMhM^HHH`$I_TqK{6Oi=MB^#xx*@-h2==?;EsTD>M^FptnQBL;a zedHvcnKayh6PrhhXFBE-Xih*sOmXlB zM3>M6GY58GBbRcceuoGvHp;_Ke9_PkzZYnO_v9c|7LYg; zGBH@%>UZN(>qdii;@;wpY4}2kJqiuzM9~3ec`)N3CJtkO0#o-80%&T42f9btX`C}( z>%8UGXc{)EwL3w#b|>Nhz**|IrU|bkYL`2~er?2MW(srTL@{siuSW5+oTf=Cn;dKK zx=Dg}v;`}+c%RMSIO<;`@xvXI2R_tK6+z=Ix$(ganq;H&lpcce@Rm%`aEwuy(g^=S zw@14N5B-TkJPLkW;k4S4f{2Gh2#}WJGs5|C-+7#E)&#)}dN`7!DaxdB`5Y#SNM^gd zr63z>J4g$L58k8@8x`V(vpZnTl-yr-Cnfj{WeO8=0*la0U#6?TH%C1v);rL|tV}9N zU>`OJ)55JQT2^nxN&HAL&GQC?!II1XhJ(FJ4b)s5731NK)0C-aBsBm-QW<<01}LT} zbpUM{8l>|Yj@Xfbh29`~z!njgG&P~|IPHavyRqcub85tErFz7OJu<}TPhl&v1fovB8yGx8E{R?6Xa_|xQUDYZcEng5qEqu8L)}Kq zVc>Gc&Mis!R?Jh+<}kL6E=e2)vD9d0YzR+QEM`u5kS~luk1oPOxna|v!}8~qSu|7>5VIIAM zE3DUBz<{%1JIm%gf*CX{)EC?9#~Z{%Q|_J|dls&Xfm>Huj4Ot}JujVsHvGLHhKt+Z z8#k^))2<7@=v38kp;dMWIznzj-iJJ6chh5AsZV7Y9?i4SP%JO$7)K15>oHs5aRpCl&D@IUQZdA&VP_aaD#C{llsdCO zRTu*gJk4Lufuxue1qpV>5y_X>I=Y!GBHsL&##T_26!HVxr6NdV#!@8?R0YI= zl~N!aCJOC*IZ3&gQc)00ygLYtO%}!`Qi2cqNGzK}s3~+5!~f=_U@Wajy9A@vEIth8 z!2hKdfQg7bSD&C}@-8MP(>Ba5;lY8l$3#TEv=!mOp}{mS3lGvm1v^teZiZ>nuKYks zOtCXTg!#Y+XcmFPKWT(^rep`8Q9J;-k`e$7=AAnY&H%snTmYUag_B;5h?#GwoNa{b zRp3lAl3oISN)Fg7Cs>T=RC;1W+)+KX1eaI=Ga;i?3t`j5RvE)FM6Jy<5K_o%r+edI zafe)2;$f3%g(;!hVHf8X44f>czGT+qG<`m_%>rOCuWM5?1b?%z)}8tBmWFa8ZbXu! zQW^{z4$g>lS#G?c6dHGL(wtj_4;;Q&|6EiDt-{{5SW--styu+gz#(xi_1Tnr>O*~y zoTgXf19Td8!^n%H>Aal@8as1@6k-Xuh1!k9QWGU7>J3%{@NysyuA2%T8xfnaIU4DK zpULele&ye&z6+0#4-xo5)99NjC&k5-5$IAT!pKfhC?S^&IuJZ(EbZ`KFpxB1{2D%nbGuiDw!x`7*T<=3CHVXKDswh6%eW7iJE_|4UAp^#->XEfEI6eG#)8 z(hg$j+%Vh}`_yEBqbOCPNq2MU#*4y?0~Olcun7)G1!#$!ngEuL&~z2--Kh&rs0PlZ5Hy*oYC^%Csw-3m?oYBSyn$VJ|ZxANegzo^s&sEUmH3KquON>JZU*JLqqielU^=S0)G>o&;=g!Je128R-MDzSyG)MOJVy6~s2lO!D+>QNq$ z%5F4Ucyri9xffPWo zg&qA(O}lc%gbVDbvb^c&Orh|`G^3_WA&~`9jh8qr2rdiZpe4Bi>59hGBwa;Ft?r;M z`BQ8P@L&|x-#}6%pO90_&oQqT2y+lbRItoWcPKyv5~NezE_BChl~Yp;;*w|dOwJRd zH~6fipoqbribVV=O8^|8dW{ODz+)`qRBal{6t77Fc`B0=vH%O9XOojkB6;|ZoCHA&BjUV|5>9U{uU>$ZrTW@s!4 z!q6Qwp`A=KaXsJwWGsygGR+LRC?2iBt{iHNqFj0YkeoyxG&x9RXvS{3WkO_%HcTRP zBWY900IGKlc<2-cP-mL(<%9QjI+E(k6jGcbz7+B^P0B&i6qzQ=pK_rKaKvQtTsP+Y^OzPP)V-RVvx zaYQ)d86-Fcw=aOE;!h=f#Dc~IC<%$3k(iNefpAIy27<&E!+VI*(zF*BaZgfNQB8O? zN+c`lZa=BS#ZkCDl|`nvW2DB0JPX=w$YmU+igLbywNE=jxiRJ^D^I65cupWyGkVsV@&Zz5&aZ*a%3@P8V zH&-Ye3Yz6hBwE;c>+NAP{uB8wlt$W&&6ONk@6OFga|%f_Iv?U*)r8G98!k7rS^8mG zPN{?c=}aODi0UVbAuLG;&89D@y+Y8;ZFK@iyPbIGK=e z4-}!G*`&0o#X)n4K3kAvC}_5zz0-c^Ck`Wj&ir683*&fKo}7e|qWrn9$La)+VCv25 z%*V7|IydmaZ-;A$Oxb4XZ)skI8%1SsiiXX5EJ?t0re>u{#9i`Kvr}URl-AyyhbW6_ z3z{@L>znw9;3;IH51FA@a~4&``$?MRS#iot*bG${)8j_b&4tQ&*nCZosM;d18zSf&mB3bjs8mxKT6S#maqTsHHfegIGVk=HYSMR1f+iGBS?NyV575 zU8($*OT6|0tr0u}1(3_lE{RDL4{q3fV;bN9{C~YIL-6Nrj*ROY?*Jz)p~}dEA11DFU~O$s)nzhU@6!n+u+EKcA5g3!ou{bnXHQd{V=K?=o! z{-+$pqPXb3d4TLZ@1khy!LfDGIrJ-su?!t#XS19&UO{RmbXan}$e`INDyFnFlW9%@ zD+cr^e8V&yQ$@h%9yB#Kcjy;Pm^*h#i|8HDom5h+0mKp?M;Kfot;Y9U55OKjjF+nBYQu~0uGf{nk`XbqgqrA#EN{&7-iOqXbONjmP_ zm9b=`W{b6h%_N3FkHk~RDn?&xMywrzV5KzLxfKCVY%ZKiA^gv!dZi!;p62tQ7<>|D zA&MnD(TuH%)?i_gW~Zab5fW=wtP_XKDB6$XKjtLYIlfI7m+|G@yD$Ng0Zp@NF36kX z`!H@wl2j0l7n^Lt^C*e!y-YBDc8N;}FvcQvJ3F!s-oH8$^qs@^Uj{guY(-P;L!k|(Q=S$ zWQF^4xH?LRe2+o%jp#d0si%yM_ZobGoGSx+j~u9+kLF5ZUW7J~UrJ;ra!Z}-%wQNa zUSaAyMTlR(uOcfST9%q*LfD_13<{gYh5B9cP;){aVlY7cxAG>xoLr7%9Jam?SMmL3 zY5EcEI6Rb$3!Ba1Vz#!%o6K(KN4!_(&RU@iet3Za(*}M>_`uvg@DLmkAU!TacrT-n z6G;3D-jgNI!Q_61*bUk_bIBN!Q&Pl;!n^Sj-#6JRzUq^6n?32vzmAN{Vm&04ylcF) zm^`?CH}C{!@#HAc1)X7{roE+O`i&UBkOiOga4~0wPgM}hvV;-F^NS=YPxlf63`Q6zu>0Q@dyurzZ zphfKe0*5$ZOI4}5F>G;Kn5h$COB7C`ivdqC(AKOqlhVDj^^i$~mfha358tJjXI0{< zTsV>7FD|ZdTWUiagM4LzwV2-O<}_$QhNjR_Oxfaz)Qll;p%Av1M2U)(vIkg9n>G1I zJI>&yomh(umu)`y+X4|Qf^TXB#cmJ+OSxCy?84kZEm(fgEIu44yv6Hc?m}Lty$-kO zoAfS)u5cl_iv)fWUBJ7B5LMDgxd5dr7rq@C4An+uC$xAC%`Al$1XwSxSqz~iieV`w zCMsr2G^2~G)Gj*eb6H3(ZE?Dp1-Ezy#fuP&afOzGX)e3-Krw7VbVdY(OS6*<1=pTKEQ=v#VO?Yuj0T$y5yEs0%( zEmf5aD)D{0Vqo_!p_r6A2{eXn`U>6`*=fQ9j@GxJ#V3Op^J$TrI_KiqK?@_q#Aeewh?x2bUJ`+=sT72@9#w#G2F5xb$qa!8KDK;3oqz>4{M!Mt7 z3Q3Nj1uMd&f!yd3TAK5v#YdkcEdYq+9ur3*Tcl+?Jq}t9BUx$GDJoknLeerQ7lW~1 z(9!}_=^^O{^o_}s$i?f)JC^zEv@L*m(dG(^hL3Ladc0AVvpG>nTTF2<<)T0j>|Lii zv?viI4mhEfuw`dYznlr0dtL0U_)}U&#&YnD!T^F)y~b%)81GE1z*cAXA1xBpgYGHSP>P5Hmf3jLtz>}*A=_t%&cpb@gFIc<)*KEVT)1p)`-mEig zNSp%m)yr*n(W}L!0`{&4ND#V{dbpul zTwZiSQDi{}onQx8j*{E54(u+hcg_+>M%vSWL^$+=Dx&PyLqrl=qzmlL`6upTuQ^!! zoI2IOUkr>A5vFQ_dh79>DlNo#NViWjq;D5SW(9CF{?>202*Wm(CZBxJ$`Go2y){w; zOi^rwx}^oV6o^*G4b&mR8?B~SY(3=IU#kl$d6l6xLZ7Ro`m~z-?@y8`NhG5cPMcS{ zs!7aN$zMUq+)u6ROakZEo7r*ID&%8)m~Ov2d!364=hVa-;bOxo(r_a1o$c+aPl44|BbtwK5GQT(kC zwEE=GUHA<(T17d5mpNW&&rgYDXse7_bbhy*qcsybK9H+HE66c1kOgZ-NnC9m?}a&u z72&sFv?()w9b0J?-?9J=LanJ)ViXUuI+m`hq^d~D)>YC~bfvN1P&L<=yr;1<%*1YU zlLW1mSdRFH-mADo!q!R{M~2zqN zCbT+%=~ibkD^8JJFE1YLDL&%-6SUVyp0yUQ;jIAj^h_ebIXhaNgJvsc6){qO1&Yu< z&^7kpu4tj+&JbSr*s3NUJ86Yo$t__Tv+xX;03ud>p%!yTm@{)%tW^n2!elH6;e_)l z05LQY(NQ`t+ZxtT9j%-IPLZ&6 zXHT^~VHTpzR6ZQ1?kW;t?h3JI9&&fJHAzgBxPiOUR1-J$SDwE_wJ<^0nEs0Q#FwJ? z9G9v-6PNN=o@e>1D7_M%>{8jxc&J>7M^ch!G__qhOJOU{GOc+u6PRa~2oX`ExD?qA ziEO%fk>gqZ>XNY4Os~B;|E%Wf5<%DGs@;T_quoOxtRKa|rM;mX?hJUau0*#ol@sjB zQoVvB!Osu`3Qde%fLP?2grjt2^bda}_FTP6pekxDvMUMIc=@3B5X5-cq4$dHgh=V9 zOU-oBGve1yd{$dWSca{pWBY(SS0)*qKN;F|i(%J`r37ur?M#;BK^GKki-aQz5>(wL zQ%Rt9Q4O9(=kzCRGtxJ!Nv*UNPZe`p`l@r&DrL- zjJd?P=5L32I@&-svV)ueE`;u>n{>#*Iw?GN;enDP?Y6Jp}GyswW1ivWgEnV~ zUf{^5`qbsMR|-=Bn^|Z=tA=aX=7p@M@;0B!((iI4+OEou*VwXc((x@RKmZEcY(o>K zG$9MrYBp2V4AP*jLbAFUw2?A7gtQ^QL%zQ@nX5IIPG;}9#_TuX?1eTBl2TE7iHXx@ z`Kt;p0LY=R&6~7dR9E|KHm-(mOPAKWK36WqnGII%sfdpeMFW(U9#WNp2T^>kjR@65 z0jck#d7IV|J8&pkNke|Fg^22;EnV;yQk!OTgnc^8 z_q0WZ=qT#<0Yg#wC3ibP-j>bzq~JkGx;9gZc+AV}-$6Gf3TRLnOcWu%nj4756tqPG z)cH5sA{mXGMlEg|!qt|+EMr`vBRpkXVu_j1W`37E#iLXERK9+>vQ2xV&(Vt(QwC!d z+qu@S(`Z9aseKnbb-4!Sng?SyU3_81e*h#go^Y``hrS@W3y-;!1;?*0-ssF0>Bw!e zD@heGEx-uJ&rvpqO-{|1Tzv5cAD0T+Ce7En2j^m*1!-;U6;%^8fln5CMsmAd#w9c8 zg0+rs3fpDidsn9r2|X|J0@IKg{OhGxvCm|5Ni+bxPUsDTCE+w<8iBivvLF4^h`IU8 zh;8~yhL;y}jGlTf>MzA3O@r_?Q?TYzDJwOX5$p5sMm&~FGzITgL)~dx=OF8CErT;| z@`#N<&O9fL62X+MVFl7CfQBg+!$T3VJ3YfM!)VizBqBZ?9f@DJc&wROPIAxS6}G zj5o5@J!8x&h=`V#rTv&6&AsHkK+=&xmz zvU9_`wLo(~nOw`eHn=A^4Ar48$B^uDt2hHP;q{ ztGTYo7yo`mp80D_fib<$)mM>c{<)d7HP0*ZiRY2(=d9orx-`+G#7^j2OJlDYWlaR+ zhh4bBr7HCz63hd|`(8QZeResmUMF&FAX0&s15X9s2mN)h0@8xRq2pMt82rKXNBwL| z7gFG7MG2Hy!}Dkz?Rx1XYR@fTUhn(Q^C6a_jjW%vZ9Z3ETX;u{rNF6w=9jYd3kBQUuTQW>)6^yS3H3=~OgJAF*W!2U<hz(sW<(xdh==b=N8*X*G>3HrHXFJy1fXI=%D7g&Insp(; znpT_}tM-Q0kKyG;F?FvvDJnZ8x!OvYZbC%mtS?UwCCnfxM zMyr4{+1HUUPz@ag?M$D1(69FaBxVgQmNO!)HpVo%$V2Np#ZhGl@`qUeaq7~GT);C7S zjKp;VmcWv*c9&8sGclqUuVj)%J(5L>Y>%`~X_<0$FmqBXm8pwck>%T-2<@%}byVq& z4BN`edlt4=+5D*6p>(08^s!2yik|A~ znq(BYYNrvca_zx(XV)Amh2M`bv(7t2oV|ilCVW*X2_-&gW|1t7*7p>DEiKmE@VnYo zON^vUy`-m3(L{Z+MaAvfZO<)Xk`78gFnFML?QrB4AXn>fZnK(J{2qGM5+f-KlT~lz z25&NSn8aNN9t`Ei1r`xu)OF`-105=9s7^6#H^s23Ifm`*7@IcNVcPaP3fhOFK%}<~ z+AVbyCy$aNNv^MH#THE!!uHDI8t?4_apmo@xT@(Z?gr@O^VNmg3OJZ^UyRM)Q0Q$0 zw5!~xGDlxxYlSEK8&#g{Z@4YzYU-#m>8J$$Y1UCxTd8vGu-z?!U^B#G2Byp4pj)&b z{9FXxiB2(5(Ty8PNV!p6k8bR-@MP@`tPFNPsg}?@-3UtMVYeomU22MzFonZ-8ybgW z^om!Y0-;9u8fhj=DiUAmx-yW?4iNjHBdpMk*4lM;5|ZX@TnfB`fje^?>xKzbP{E8?pI zs$Fs??2vzCz|EtHCwHed6GEeKs)o}wSuoy#2#coH^wywbN}J4+m%^qznF)E@RVIR& zbJ+QMDr;WXQbz1jS`h0a1jC@ixTIp8UT>p}ms(@VTMo&mR=qRm9VcN&)$8FnGox@! zxUha}iF6E`FFy*Ymlpr%aJ~>nT9zfiTS63{51{ScJ5m+@h!5U$Ks91msNm6^iWES8 z*^Y7QvlAtf3)+c%$sIwd<_;Xo&1r>6si!170gZx^+}S~gZYfEWx6qHPPEjJ79d1We z=qGhR?H5#Y#HR`4k?37>CpSDSw`|Zc9EB&uc(GyB77?XsmKDpK_;~G~&6e6mF=rTG18)0~V0rTYroL{|684;yp&^yp-vEi#d^wQ9v8o|u1 zcdg=F3r|%aKxOG}ci)H+#ZyfG8x;-(L!v*B#HbYME>YbL%qu`duu-DgRw?u`qVwIv1u7plxw)fZu>XrjqslKv&u-al((_AT*N?MIl$>QiB zWSs#CtVl0F95WPfDo|yHkqvfhiMuykDIGmh(2e54l~rEnhY)qbtO;-Yt&BL(7;M?1 zzgGPz%IHeR?`l>B#8y@m^Mv$O$#t8@rRsHM9xKBRSISdsxuNMHXG8=m0VPZcJXX$$ z(J=k;yh$_Vp&H$)Z2MC!6=gWniKvt<aEJIIn`U^-nI@_IuA@=H6c2-()4Ex z1(zJwj{#AAQGQnZ5j!>P3s2#-D=XQ22uQ`aL8eN-CMqp5;N1UD+n2!4RDS>857GzO z*FwgYCGioVC{rYB_9aVQJK47)$ta?-W(kpLAym>LmDD6kixw(rofa+MRJ3Z-|2+3O z@4Gy6=FaHX|9)Qgb7t<`bKd8i=REs!pX;=LschB7WJxL}sm33nTc1wTxFmI!b!n^C znyC>)k6R^G$v%-P8gFT*cNaG2$tg+tIODV4n(mVPxMEvs z8+E4ipa(%cMqS2GG3Z^wSejK*KOobpOHZm3^zK8HLgx;EcbuAn;-1UR`t&rlZbDHx zp(~C0G{@-_Fm#t{)~g0Lb-t+@nKItHG@jN3(d-YchtqdqwT{z4(3c>GFZpYSNmR#^ z*>17k&MD}}D!qJDx~-_fAsZ>a_$oy?^~~uKe;-VvagJVGJo5A1P7_<{MUAGO>ghFl zPEZw-e5p&Tj$>(=SSRNlF(v5{HF}0`w6kukyYrTtlJ3)2G^R31tSt;fsy+lgOIk|#&FPjoTQsUMtDI8gaaBF2B{5EOp9Yjl)lDh-b4q#5 zMKvq!Y-v+!kc#S_v^Z*XZyM-vnx3U}v)Fs6i<;1cOVtLdUR_C)LUY)e0CbkFOxz^pefck^vakJE^6r2e%x<&yoxV}63LhtROYmT3}W_3u8%Uhp>s?I7k#7hMy z6P-t7y!)ti-ivyZjvZ(Y>s|BJ%)jy}uA-4l*XUU_XW5ZEUgF&6t1?uxm@xQ?dY{^* z)Vx#jaE)+jB%N{jK2=RkbT$$3?o(wM6=5_;?p<>pHq~+9${RkInlGc&u!47=DlK*I z)4N6`^+cyhXO)`h>=$sEQwmPh8SyK z#<$fidXZ)+)nN9j0aXn9^iwY}&`aEv|6Ege$ce7egBPZs;Xhg(#DnRjoI0etlXFms zc=oCvomn~`F1NnhjLj{@ADz)8p1kvToux(EHdi@sk0sxIs@hQXLT)J06)R4mjB8Z3p?snHNFbF~PIsWQUZh0%jXMNRUBR(N&)Nq&1%zu{qi%sJbKK_q zHBD55Ufo9vBm#xH(oapHsB#v%sQc(KG$YOZ%YN1LEp;bLnb&BzmF&>FT&p29%Ktjg zaC6p)4#yU&bg+DO+N0{CS|Kxpw_nxOAzyUZoHnxRQ!qPM16-E##X1qy(68srY}Bzz zE5CZHR&>2p+R>ydjqy06q|T(Ar7x;TbBp;&0ICz=wc$<=l!3SrXQJy>T265acBhQ2 z6LG90l~69z*s|IyiyDZ^B5uy}Mb)|RE;=Q+E~1T#+tU*0mQzJuZ3sS30Ds==gM z)Q$_S(*B1sy0vN5s8OTyaZ&LNp6p&k9Z+AF#mY4~N>AS^3YO{SOj=Pw+XgtZOmrs~ zsbieI9Gv|dN~^LQB`p<8YLS+*C~&8m!m~=N5|5rB8mrnPG=4(Mh*WamPBra8wyXUc zyo=P>!R7>|b>11Gib1z+?MHVz0vSUaNU6sqs2fe5*EM2Cy>O7*p23Scya`AbQnW6EM(yf5Gy9Z_ea|PTf=YGS zQZAANQfcsT)w-@f$;qoaXv<(&fQk@ZB+{B?%e{)&SE-PC)k) z6od4SOQt_K%=5(cR~Kqeu#fL#|}NO`Be)7gq@PSp{kv~YIS zYUPfws^#O8Df&=?5E4~{dT)X~>4st>4YXKor0q?760p(9!+`zuD@Wlqxu6bX|^h$1>7Xq1rJS84~Q zoU*}D2t2=6)?G&tc-E&}YE(IsbLHHjdiAu8iaJ_`M&tF){fIx^+;=AG%IQ2vqee7g zJe7)3uCvNH;~J^CupF`uKOx{uRnm_6<*4SQVRS0xs4}JTGd!hlUT3pNA3Q*&cGvaR z)sX%qsl_=)Ev)tDT%_9nn2an(na7oBlFFiLYHu|4OX+%`j&U2uoGvccc<1?~I?nxhsr65eC%=pH4EM;u4Ub$lD0%j>JktC-M*5$Xor zW^{hg?J?sAuQ5sEpz3Wc`mUVvs8XEKK&O`1$y(m4AgMeYIJzAV*aqwf)F32^1K()} zd&}9qA5?BvGuW3n@8`@d@082kRYRHD4D^0AA->c`qsns)d>UigkYpHRi`#4qwuu^=d9n@sN9^YTd`<+u4K0gss!zo!ZWTiE1)n{D^;|RC6`2 z-$_3-e|l;OqJJ6S2~3#{p`Yk62RAkYd7OS~?EVt8_jK1@e*?!Ejq-ldvFqe3-M=J( zUg;VvkUcJbrxlR_RPs8EL%0N!1#eiP6r{7$~)Y?gEvUqdMXZQl&-v(8| zO25%m4|s#A>dB;bqf;n($?E-vDNyM*XT3^0G*#5#iO1)xj#qt|-n5^fny1e>!?&H3 z-r9kNbeulMq@0RoI#69mOY&8ld4N^X&2dhgIaO9Y43P4VdRJL$3F`6Op=ubR4mefy zs|xTs5%r087oi`?-`qU&Rm8fB=KoO_alVdPMW=V+q*~{R&QOw?0H#bxZDJA&cL$dP zs78kG$JBWT-;a}M1lH-zsveA!G`=7GeHgBJD%S1S%qG*ohf$hUKg8%6vpmmh9*!zD;1SEpg_j!X~ToS%JlacV4ARt=@}0qa*SwFyMn zPEj5hH&XpbPAornY7LWfrdiV9)qwQ0*yy1HtTVNA3Tdwnry2%>oy4Eg74ZG+^3$fR za*u)KYhPmln{I`xM;(A4tUUt1t6GBYbo+;@PIbQ!ziQH?ckY>PETie{^DrOo& zPd&Igz^W36UN=1XnI;O*D$Xkfz$O&8Ra`e|+nrs1nlx66ea6v_jAKYbP`}#Tv~ZHD zN#i?Z7f!yV4X zsA9n54k4h?fMpa)M+`vmVp2EBBWf{|voJH#22ZCokMzllIJnIyL40?N8aj=~RhviX z!GSRnRoS40!OX8G~ zT(qiZ9QXRAj2!D4L+w`n>_`DU4mUT~L*8-= zp&H?E?1LIQqP4k{jZwJk436Gysw~M1HG;*St6Q*^s^Ml;w`axU?5edpv@NZYq2VgO zEKXzus;@?>8Jf&)8rIZC3guXLuX-O~)%4=QNJX`{iM&lKw#fT*o5}!cQ}94#T+g2# zN?J;oN(K2@;mPFMaF(cCH(&WfT`JPfcb^JsU&Ag~!Wj2y9KOYwmsV{eN1ik?9dTL= z)a>)==ftF!xD=6rN{_q2XPKpm<25zg>|e}2K-rx7Vpe0TahL{-1(BLAH!PWP$o$i!@Gru^qa zS29)pZFDXNxNlfBOi!oMAxG#2Lhw!{GuZHA*@Q!P)-gRF^rzcsaBg*yUEkma9TyR7!CcucNaXO#?W)Ux(#3Wmc9MlWwK)r>u%fQh=T8ZzEDx zLI$CtO+6z-&Z?W@fuLD_$I`ta^{rFL>6sZvuB3u5R%zg5+-RCe(K>|4^`%IdT(uTc z?S_bD$yzQvma*8YtILX@jFghX={k|mT-#LC`ZGe1U$QME-xzX(vb@~jG(}U=A|&q^ za?{=ElyGNfh=)Ldl;P%J%AFnb8k%1;ILoHFGc)A2RLLQJOT9UriBx;k(^;r34T<-d zIFcr!f+GM%qobaiKeNfr^>h$9#g9`BtF^tfkWH#U>sX`-aw)xx z)-91olqT-|8N)8+?$BULxjUWzoDexjTj^T`;j=ZhA#;vbZe`;`x;JI2>k- z2ABjp8k(8Fm&0brsnO6gU8x0sx=nHfim&yRf)Y>*61?sqnR0GQP-WJPc+?|Oyc~xx z^ypP+sHEa#rCYG%2(ZXW)5s~DPExr>M!$k)tGuN(G=dfMoU?4Bjzvg8?QmCE3K5f0 zx@BQgV_z+#Z`WP6@TPF%6sT+zv@G7X&ZR@%8qlM5Zf?0Qb}wg#uEa1+pYEtP?1~KT zft|Y?YVsf2e`O(w|H0v!&Az>RDE|#tKli@Gf7^x3-zJ=Y=WR{KO8i@UGJmgd{yBHl zZ7lJh(pd8+GuXeS`)|!8{)4>1TyjgdQ2U1uX){#f9}4^o{u{St#|sjFmre}(L3sL2 znE&?^62GOxz_M$H`>*VZon0mV<~I8;1AmiO8nu@A$Flx*opAhhcJeflpYfx+!};IM zJJ3YpzmxHk8TcCv_~Cqsziu0Cf8^ot^soEDy(=XC{sT3Cd`NiuwH-0;J&AwXd5r&J zxc$vPJmqVN{}A&hFAL{ia%Z_V68{&_e{VSdkssF2llWhlrS*@#9L|5)!YfZm{G~cG z|F&@c#*J6cm-shLWB*qP_y4pdMcJVYg>uw*OK`o8Th*tKe|-HxB6)P zW3PncpLhN7M(T64e zW@9yfWI(w7dDmPcmj9<;tof6#hvPp{?4`XD{(k8HRycpH2iE=|@lT$o@e^-`^S}G- zp%xPVDTCR6Rl@n#{F6UV;-Aq}^T%t3`>*L+!ycCSYXN^mIDdTnj^YykTa2GPCtUx} zR{T9h;{S;G?fT*T?~T|d@>^GM`e)#O{`7_ACH#0>_J4zL{Ci?$KbH8vf&Cfy$8@Y( zM&d8Q`rCQo_^W?=>28VtqApthXi;uR>920P5$(Vx!#*1<@jo$={kJtd{qGuk%Myuy z@D1$04E5)#D`z*5`1efK{E2tM?Z4&oy4589uGeY)NUd=F+rGKKlf<8UBilbRod35o zx85u9Ph^y{(lDcXW$=x&;6H5`rn29)idx{FE>}r|3f)` zB9DgKzweZh<0bsLXL0;z;O|ubmn{p!UKk6#U;k=Zk4%n_&h?F7Ze619@5=ET|1cc?nR^TFlJKW<`p2&hxBue* zt$kJEpFc!v7%v`LSgb%nSG5(H>X-BJnS0{@5Mi{KXG!&z1O_P1pGG4Ep~y=9Q5WfAw25fAlli ze)f)a#gJK^}Tqxr@8$6_lrzx8D} zexVB{6_fC*E@%6{3g@4^V&Pbce?G@gWLtRs6TRkbas0H!LdJhNoIifkezE_4)?&?X zXTX2u(v|Zh{d-Md{tLqGw;q@x=D)kyetSZA`qlh$P7Mja73&|*pnv|Ne~ax0oB5L& z_#eM{gIIshVE)Jx;r=fc8zQ#9uDDkFFZpt~{W-_4C@9(AhtofqA^w_G?|QSufAtcL zA8#6tf7->x#P<6v)<5=jc>4G6bl8^gpFsS76VCtJck?Ps{M$JG5*heAd|OuRzrMi9 zW@kvhx%&#;AmOj%^3QG&uKzieUl7MHZakOsPup<*R-2x49Oy1j_R|2p$0 zD$C;+z<+!}rqn-T8+majY^&fnyY z*7(U=!~Ius#^>Vv&11}FN5lDVU9;&`N&kH}Gk%8ndGw{(2POV9SbzKXaQqj3-SMNu zKNaOqhWJ}Q@p*ClV>07MZV31P4>b=&C4BozZNK$Lxc;?1`uQP=KZn=v#WU#tUazaf z_Ww1kb}|G1>Yw+C{TF+p)<61Zxc)yS&gv)W|7lF~N1hDN|JNL7(NyGbq516${IQ>w zisMhEI%@uS2L8Nve`qP;N0>jEf&ao14GT;B^}(OPe{)~HW{kxDL?gC879M|No}9a0 z;$Ow-7kMh&|0QZntSRw7&#-m|{=C=ciT$5nTC@K%@OLczg}DCe7?*$X&f)eyyXOqi z|JGF+KUyO^e)rkC#rET+$bV`0wRFpBe)q90xx)BehqL*Pnle84M{oS}u*4r>{gVr1 ze$-zJPJi+xDg6dqsu3cy!u{8xsf z4E$9e7$~;?C)}p_V>#jY&urQ8x1|3eetsbNR?z>j8}#n;@*S4=zhwUC{vf~U|3h8A z6#d@?>z8xG^Z#`RuPH30-wa-V9xE2k|7ooUOG*44ZT8>%aQ&MW{ZP#RBQDbXwlRKT z+W+$(_tcT_r-0uWzcBfyU;kMxiGMTJ|6dqPf0O^JZc}fQ_>ZjB`X}!Q=YRi-b|obK za(6NR%5eUjHNNj6@&7N*{HwzGTYtLyu*5%i2J?>$=RdPjg9jx3Ig^=#X;qBCHxg5EGzn{Wkrq$`GE_1Wag1eCHob>b1Vt^&$NHc>RE#% z{3kDG{hJ2yP5y1u>b)xQ@8S9<)BM#_O`j6mpLci5=O|#`8eaas{pKxV{lDTet$)&3 zzisOO)J^RRN%|k){AWKM?!S5U`kycHKh6G68tqpTzhc|xZkPBEjnVoiZVbnNv)$64 zB>vag{>Vq+{96ls@wdd^U=^qTUE%3JedCdS694 z#^hf&qtfXT{}K4l4!8fT({AW@BXDC0PxUI)PiT|E*IgSF!-r@My?r;CN#Q)K~?7zj~@&8TyH?jQgv61=j z3G(Oa%kFa=2hJWZ_Mex}(Kp7<3g_?k#DI-b{M7wZ^T%%t+Hd0DaQu#2CH`Z7XnuQ1 zIQ}mi>zyOCkKPf?zo!1f){W^U;or^tk&QuolYd{Y zA~PiZfgC@PzTy1s8g~-cFaN$l`!8wu&$NHcXNP`~?60~>^CwmY?Kk;vxo!DwiT|wf z+W(pKzoo!e;`rGYY=698(0&vD`6Y9%mGDQj<@ht6Uo-i?y?e$-68~(hpB@p8|Hqx5 z|0(ewn#}$;o_{j&n_S!JPKkfoO3iQI7mRN-%g9R-zf=Dlwk-4c8594pN(r(5cwc>Ozxn)( z$>008qhkB#Ip}XZzhd%lU$a#l|Jv6;%@vq|aGoL>*`A?H9om`DBJqn4HF`H#^LAE+wT--_Qk;^F#V zHKT%9e|*LE$18@{Kflkqp{AsNiK`j@pK$xT4Qefxf8UMM{L!Z2?f09y9Nr<}_nfKu zBY%e5KWRz+4if(X9)B^PKQQB``s`E1`u}2HKb#m9j$h@{d-F;7)u(Iy?LWf#Hx!t& zU*bP&yyj1g4d);AM5Fu?|5dkZe)IVO)BZCH{wnq#CNh4!YB2rH_GkRi#HmvJCi=4e z--hcy@16MXlKwv+{f+hirvCFUXxCZdZy3|~_Ics)KeWSe(f*!TfBs##{-10revyR# z+5*Nm)^D5o=j3z~aSiB|C#qN|K@Q1 z=qa~9CGjtZ{SSomH@N4Qxf1^{UO#89e>cF4&iF}V{g~+R{qAS|9}VZPJ$8WTzoYP{KEQ?rhyl`(Cgu^9XD|l?LhCmK&d-#F4|?>=+SLj(^dVps5Y%>56Gr^2VG~s zaChfK|2B~I#H$0WW|~p&#Vp>Fja#O@v_-*6$>qJ7um zxw!?gKO~;7-ZhoRX70(c?kb?~EWr#W|Hwmwx}KVwTP()=OM?F}l`rdgNWETAE zx=tS>`S01`gugyBe%Hm{4<-J5CVrf{Wyvh~j~0z=m-yBGl+g#RjOq8+eGi{4*{}9D zjBc^4Q|g7M|HmsAt(NfB{!X!NmNmO#kl#%IC(oUGTuOguf1>RibVR_XYfbNZUb<5`RkmSNjvivf%H3>Vk)e|FkZK|JD9Pi7fckQwtO*ZX5CA>`(M` zs{M!q{Bl~+Yj2_aQ(}a{ul6U33jAjLEMGcfBHHlT>H;k6bf3-hR zLf|*^Z(IB4&XoUh%>3uR)E{bpqA2l?pg2?q{02UK z)v}I^diGN(e$@UHvF9zTPi1{4_)Y&c|7gt&DgUVb2@)@)@|*TQzkBz!Qu(8v?@#Pb zB72q<>2OQP0=M_GISo@cq7XCHtM{qxYur!w=BoqP1&UNaeSBzBwlFo8{*R zH-7%9RQ{>wi=!{6;+y_&^!KZ`Nd8yP7smvC=#BJ$rRCCxCI6}CixUFBnSS4GTUkb` zf7J7>u~#i?WRYO}nD{S$w0@N2fAxH4;x&>{KAgX1{Z+3Je@gkKmKDcdx2$8$gZ!rd zj<^0|rsO~Md|l!V%PLh85zt!_m(fyXSi@RswGyQk4_J|Eq{5#Jl z9k8sbyiNrCX8c^RE`{*Nx6^Ah<#rT$jW7e%w+9~y6PpTw`8FN$Ts-}?T#Tcz|@&-X;%N!8!9zi;tZ z`bzez=X+vV@b@V;;Yo>KJ>QcM_>q4=KOW!lgSxr7rOfjGjnO*Yk|!u5(gD4}2l`rM zbIoeP^8uB4egd3He$EJdphKqp^sU7IGRF=0G0zA-(3~ng2TS~RPpv=rF;5CU&}e~? z`y~DcFE#jio)&zd!!J7HZOMO+VSIx9m!HLf5A@wWlj}(Mm%4pU_IyEI5P%PK=N)yb zO8o0D4C>n}huE-*p^-5A@>pm+qJN`x*LUpIq>Pj=5<0DvAH6 z)j@olpOXL|=!e_SC@t~#T^i)aa~9wO9lQGdA`<@uLw}3sxxfedYNel_m-x?K5yZ!H z8sG!{>x(n0N&N3{{2+d@&H#L%n>yy)A@SGe^_AdH@;XECf&RFtkH|lt+E4n>@n>Hw z$KTpZ>b@r7pKb^Ft-Iv-u?x)JEb(95Daem?F3=nFlSiH^DDf{a?2jFn@efY={#S`V zZu0li1qyIMfBfXnl@fo?X+ixXyiWu8K(E?3Y^210{pCS^J5BzbJ8I5f5`UN8njhtM zy7>93|2xMeerJ7u6466rDZEY}dV>z_U8kbNKhv<^=I5Nj2m0f@J>NG#?Q%@4m>-%^8!4%iL)_!S*4l=zo%{DB|O34jl@YwSUhf1S~O!Fv+G z2U@k@x@{7E`;l6Ipf~96r;RBk@%P~MfoQj+!{1YWK@Z9PziIqb z9l*85$>smw?Ys1q_3}}kI?Fo0@TNDY{hu=aqvltm#Q(d||AgN`BR%dZCgFd36A&~a=4o?UhR3g-7z#|E z`M(SpkSZW`Mk?%GY6Gk&&7SczO_y=bt@@R;?tA(&>#uoayn3Cb|7C#}r|NLBW?bSa5u6WmUMuX(iMek;SFb*wGRd7E ziwvDOaU8vBHs_M?#K__Wl>@9x>h^2c*4)*LFFn_IGvF@7H7{sZ<$h|SaGUphJIt{e&c?V#*7OqKB`hv>EGoP z&5!w|ySRUkcCocq|DGv*5jUX8t-D%CUn(yeh2MQc5Guw zelIQ`;D5+ZZaTU2{iOTuizWGQ&NuXDxhLzN-%d1ZCCT48+mO%C!JMr8bK0E!vn2nB zQU2IG{(7?Vi(Pr*T}ggL9^ZlgZ604aS^4ioE*8gMtD5njrF^sgsbBA$b5#8`)u`WJ zQ|%u*%=!!C1p3$1{}JQT+h=V5OUYks)Q@U^n8XLE@(URJ=GWTBg}X}}+N0#ZX~=i> zkNGfFJ~y)rDc)D)E6_@Ifpetv&2h({v`3J?PBwk-UDo3UNq${h>xB6ExAJFi>-mW! z|NL26KGM@IKaJ-VJT>?zQg5Dl=lyc8vFR9lZUv$@AiZ*rz`oG z|3drl;*0bhX8tn!-;e_e`JnYX9Tn@}QQUrje=t6cbcQ^WLN4gN7d-x~6hB{4|3V#z zPrI!izcBZE)^~aTW8O#S)1V95j?PE^!Daa8nRWUK_76%d$gcgCU_qey>~&53^3gv0 z3i4NKy{(1+PX2+{j;sAQT>T;c^?O)<-hU{XrF{4u^ooK7?yT#JAM_tB9)HLFR56av zO!0&AAN0bBzn)O~kLU9LDEE(6x6%5$`%kg|Gs%bFw`z9lr7w@F=Tlw(p#SwJ`v?02 zB^G7pfB1#PTg|H6IaSJEw^Y)1pxi|JGn4+15Bjq`{Htoh{PTmew0y*Wv=GO?@w_VZ z1chAC@)heYmE`}p7#unWV;}BJ{UgW)UDmvFbxD3Fcm7bz$3DR)D}VJfm#>iIU+s>M zYmcLxJK6fNLzhEh|M!T|{*3cJQ75Z^*~AYKN&mG*`#*6=$7d$_c}O;5g5D>4}P`YuKUI}O8$65 z{{7s)!2V8&B^tl5!Eb&=xr6wuvTRNLd?epoUp}RY=0trJoNi+T?qD#`zw+vo27O-r+rA2IMMtbFz^CEsj6?}UH2-5=%t zb*A>SyU>zxwjTVjtdgHF(zoCseFOH7in9JOLqGGY`TMr#DqO147xy7P8}s@LoA;NB zv3$e@?l&oZ2i;t2$lp@_jq>~;%4gIANuH-S<>EW!f+p=VZ<6HqH{@I0_55+B^36=2 zsSl5+T)04il3R`bSLLQ!qX?&Og4@rT;@=z}-nM_;$A15#{qSQ{%g6pwiDf!IGs%Zv zKtJm^t-s`-bsRsscA@!wwgVLYHmQk!^ug;a)xTJ5_~*^~n$zrGnEa-E=ncAZ!3Wn# z`q$+7MZ^!v{Y>c#xuCD_f9+mLeu*VoGswsMZzlP+VNjdq-O{$7dY*_Cf5!0v4WdP(v}#Pyv?URPnQ$WDHY0YI1j zZ-;t5y5!MaU7cUHj_BpkW4u2S_6LiyeAG`YCL{TJ&;RO4`bXAl)+FyA7Ryq9j6Z{J z-~9M|r9TuI&*RVEZDjfP=yqp<TO>F#f}Dm(cx1^_*}di_%6pV}`3)Azgzx+K85$yyQQ zUz^J}P*yXAM2#ymSJh~#^6yb2|L#eXe@%WvT*~-Kr^rL!)+PU7`~l_vcdUPs$2}8S zwyzQlxRq(o;~l5^;}iY6X_#N*{j*}Lb^5}urr!A879W_tP_Es06+h8Jnjhucu8Z{z zX8XC2!Eb(z@deOrt!AkGlimDPVWch}R&LNYV*i@Ny6p5njpc((DAjO)s^1eug8EPA z{axa`KTLx6slhr9@SD_(-vJjMET;Tpj^9>2UvtKd_95zHQ!c(ojRwk`xtGjU^4~P{ zuQO9~xck%Gt?io!L20Nd|I@#Jo+!yLe2W%<{cEDx$~SPAuX{I7$v5-YF7Cfzf14P~ zH_SJr(N{Dum_B!;{g+BU`d?Eyenzo>u>Vbh-#Sv1)%ANlu= zH1U&3er=Wuy8ph#w<`G<{~te2>)-PleWO{vWg7pF8y(nfx8C-$l7G~Qe~ahGu|H6Z z{nMKDOGmz@=N|n>;{q-FD*4uF!Scc4K#y?hu0uJs0J#AOd z`qhN-z13^AW)K&fqyZ66DSGpTB$o@Io4VfnyT5)}%;m!v&cAp+bM#&DU(LN$#00WB8CGO-E+^+%0F)! z@~g6Zv;C8)d`9|%zBp}CKdF59k^3)DCsIcD!(vQLz40A#K~HqN^(;yLEiui3{sqQC zEna5?c_w8x3-pG)4^{M+KWN|Hfd1+IT5oH8cJZHJz$ck@e)Yp{e)(^5`S#LgeM6G> zAB$!w-$Hyb-B)|?WWW3*%kRnlPxAg`v6Ga4l=ZJwpuvZJ`9~rDUe=%YFH2-8KgM#W zGF@K(;mv;eZ}RxVL-0TLH`|b%|IzOP&i;8HIOBWcU()^GTyDQDnxGZH{%28^k9cME zQb+~k%9pJd7jeqBQ?!0)zx6s--{|&tdHgxQ!Eb&=+=CXo>~nE`=b76zC*nWyy2j5m zK9*oWm+l(&x!?bopY6}_iT%xD_iOpki^Zf6^Y=@(zjveR-=TjE|19M3Nvub}IBO>V zLq6zB9XDKBm&!NDNB_Ml2bjA**e0z%vQLWQd?CgZ@%hcAjf44@N`yTM8KGao@-q1 z^Wdd-Ipf>KgZ>}N>(k8kiOFw>bH~SU{j=S*+DQ95^gPe9VtsO~AFAm!F6frDr*#F% z!a3GId_WGUnLnl;ICUM#Puc$?-$?2k_06%4QqEAJ4Eb$}Sg!2Y-?$3t-hIHSVqbJZ z+TWwpb)sSDjaAiewu$+w1OmjC_OWJi*pvj0yd8h^7N z&T;mS@%#S;`hv7o6n+3T^{-yC#aKyx110~a|GWGl+kgB}l0R(c5b{&wC($R@vUhSJ59bp#{eOF#LE|L(kGCiH z49ju$XOZGF`E^k%zN)BCvi@kwFVL*e3Q2w!dj2gwBF7puTFzfKt$&H1og&`NC%~CE z_`QNs{=Hx#=|3{Z*sb&%vQZ$$A!^40z?l7HgL!KN^}1dHJR`wtd) zO!9x;47zzV$-gxyALVC~+DDPQwa#Jxdwu%n8B~9rZuZ~5BmMnH-aop2^IwxbLvPT_ zN|zF!Z*Osj=FSHv;612JlRPhAVn8nF7xy>YS4|inTe41b=J0?U`lp$mlYm^%Rn?a5 z5an+U%18VEWaW3BT%tlPLH`Sul6+c!ju3gB$0aMULt@jCQEs6m{}q-G|5&{K;bi5XwYFwGN&a;ze&|5{ z!h4b-A5`Dv{fFM5j}~w7ne>6@*8{%Zb_`26M@hX38?Hu*WuY~>#uKc=pv z|BGDrA$^gqpy}kJ{sldM&aX%F<>rj=;1tNy<_@Z3zc;{cEgx@Ja)PLlj?Ew%jQupZ6_>aI9#5#)8ex(9W&XnZOtic?+(#yA1KYd;i=S(NRcGG${O7b^dt~ruzbh)ne_xf>r zX`ICFPW`VJi#TUm`7_qEm*hu#YYzJ|S^iRGAIXpID&m~!w&|@ zVf^C&@H=RHf1^c`{J*LH=g9A;^{+q)>+h$aACZ`mYpD|lK7lUk(Yc@`zu!E~5#Oif zSEc$yl5b5TN$TVSpFr>5xb166z8XJLN0j&F3mZpLV@Wt57xbIXeY#5WH;>gEvA4DU zTj;A_{}a?6k9JEPXM-#q?g~5+ z*c1X)t`?ILN zD9ZnpWwP_n2hB^Ck>p><^6~yUQ~sCapD_PB%F(~J`-j{{`_H=bPZ+Beax7xeMd>mQNi|490)Bk_ss{}F0v zkm4sctAKMlH`71J#rF$y=d3T}Yd^q0BYFLqJy@1sj2so_f8aEKIe$+{|2gBe2C>g& z`GwU&H_|`4vVe0!Unj`iFJ#Y;cl4w2&6N3@PSfe8-BgF;{iD1-IKsTyrtj`emp(1& zuf~7Xk^EDSBk1(?@)ycCH4dy!9QXwK*2HOXN&eVdnB#9{UsA z0Ulql_(eme{I*pIKa29`lgIL^O7iRT^Nq=Ivi{l1|1@%=*gmPhMEfT`{{JSw^)0*C zOZs<&{FnZ3^2@(ldA1~f?af;M#9mo`Ub*bjcka$f^(Fa}Vp@Kri7da>gzV(s*sqh= z{+xOf>t9XIzbbv>(ai0i;WN*uE$RQqQY}AP$*;eczfgZ659qtS@(uaxot&=+N%DJ) z(j3V&^3Tn({vFnHL_(7P&`_2?QP#f&&1)*%lcNh->cj!PK|5_f?E^`^njca}^e)<1Gw`$xSe!LR?( z(%I$TJKrchPLi+Y|I`uZ_z9Z_RC9qipf~7WecIn5$v@2HTe7;=|LBOI{;jCVsrpCu zA(|(p69+zlZaUh%uq0p2FFMEHI{wvr9Q^)4{j25~os(~eT+je_r(9ut?T`1|V<}cM@XVBl7$E3MT9FPmzyZE)&O7hkGr8*KBbDrRt(N4t`&VNA1NqH- zZwBPSFQD%q`CRN@305`bZY~3l&yAIV`5r)9bhLQK<#K6=V|1Ohx-peEPrRKFH5s{+nkc`HN`$EjdfCAM(pb zzD-;~{YF|J@-wBAzaM7GpI-TnYbE*9Y5d2&F}?gK$&ZanmG5~}f0}T`bq`AEyI~&X z`)9qoqsDvU@r&8d_98;xF|5*z=ShCc{QdZtD^HW;zcrrx|DtzyB1`%359pD~(=L|Ux2k`a9HLT7rx?Zuu)ZYD<7Q?* z4|1W|nsx_nlh&WzIgI2l%yHiT<&Xb_3UJ@JgWHa4UdW19E(EbItyA;y!jgZsFDCgP zc+rM-sLRM7c5$(Xd}aRL>&YdRCHYSKcBCgiT0<^BRl8RmkPrWWPJH5x4U+#YTHhRf z*IS>lo!YnRsI7^Gd1{PrfkH0mu<`3 z9iUa$pRrSFpFH`8CtH0Q&+^f}1#Ls)>X8z(4w?koL?IXSipv(Z$+_=&IYC=08A*|JcxCI?iyYvdF{hRFRm}OZn z=yXy0+xyEA)T7b;G`~uxYDYTr#q`;xGu;7P(CsyzIVR!f+FC+91AdIK)QNU%oIa~F z-GOukZB#GOP^GWgKDT<2goi9^-y=GG6ScJ;kRw2`??1}zuT^`x27XP|0=S?DXP!Sm z!f$R<`Q*co*2xb4r|LB3pxWDM4&Z{`aekvI68_juRDSvJ6ItTB^+_6hq&w)9Lk2t~ zrT>_LS^&m*)cOj4{F%>L05@KW)@{?7?f@?6WBo^Ul<;r6TuX@f)?fJX5&vi>A^!0_ zTl{+E-u+v`&yBK#y*k}DQ8^{yTbn50=mdUrb8$TpdS26=FG%>`OwtmPef2<1 zI{e7d;+8srAE(diOm_em^oQRMosjTV|4AM3GqwGypX9gyYx?eQ$5W6#iHR;#J zewXUU{r|B4(chbh<6C_%*6_&#+W%^OhaZ0_6|snQMb&t|zu&;xrx27opf7D(HAX6b z-Xj0U9Ed!_*M1>k}{T60fD3I8L)Px$Z?S>j_|O1AjV zF1vZYgl}Cz5+3*2-$17W>;^UM$GWF%@pnzj*Hprfx3#RO4?mG5KGt<*i~sNpd$@%E zjY@wXel#yT`@f}eZ`BS-cOczC@2*i(^nVHRf5L~K$P#}J)xXKE>G6^8LBH#Lt62W3 z@ey@k+(oTl@#nux<0P6p^*`(eJ<<-)`!?C|I=ZY(G78Jzt_)w;jCc!TRbnj@)vf4zBpjvE0X={`9yUj zczsz4J_Ufk{NHSR*W9W9feYGcYln&w{#Lf%Iz_g>VXYwk@Cf-TWE=^a02kjMyR_YQ z$^Tn;{ZH~EfBbp=KSA}K-~Oi5A$7e?Tsb;O*d-%_-Q?y52pS7R2R=Tj%Dhj zxl{kcZqV!QD)WVeuf{Lcf&H&c{F5EW)Y8256Zn4hMR~bW{5^WLz9ZgHw*TS_=y#v} z&g1XC?~rd&*bTbBce~<}{Zr1@oc1U=|5;Tveqz8WmOATGdtAjsr2i?FI@2A%1+BC5 znMWji^?b29V!riX6mstPjJdw=-^SmF5&gyWuXAp8;OQA*fBbv%6sUjfp#>~;o^1IK z`@dtJY|#A{^>>d ziM^K9XP@qWBrec#K-HXcfU0y+2iiXvhtOA3|HE$3$qOp}EZM)B{U7nIZ<5+S(c$!r z1D*di{U^Qg-9!n01Nl=O(RXG4cjNq?XqVqo=e0(8thrPF!*0+u6MD6g@bBUDx0`AF z#T0Ln{gIywS?a|2L*!TbPG`CU=??niS7R@h(tl-pO8-}>{Na6*5-sHPSL?Raf%I3< z@tTMZ{hR+k>;`?fYWYhf`!^82I_&>xT!rJepI$xctPhJ^U(`}3){9y6**P_P%75U3 zR{Zdu(y-a?||2K2`$M4heuhxV4<8SMrAbtxPpYZD= zKs%R!3wrFnwF@Nt-(p%qw4%1(#8=}VR&_7_Xeryj!$0u7IRDh1>{Um6rfh!?mBoDR z?MLahe`EiRvGw;#_OIsk{qd3-U#*|>`ycJk#6MI|(fM!d|EsRtK19OD_%r5})jX^p z|Gyf4e`-#NmJOlU_H2#dZ2c25%y%LiBr|E8&74N3gU*Y)k|3tDkQkB;C(%M6H ze%45TkH3;@sWaUHyFr_tIrA&Y{sy!^KqBeQZzuRY8?YM`^V_f=ahVPunt|qjwLv+_ z{)_L_5^R1yhFYKDxBqTxZ~D{wSk2(~boj6vbjI>Ry(If@qxqKD1D18yde-1|?OMJ{fsOPSelT-2GchGYV*Iyv{|Im4a{IF%U z$NW!Q+5g;3cKwfbQ9Azv7qsCSqpM2zH>&pMYrgh>8ho_>BkU-&%h4X>%Pv9OgZ{bh zt5~(%+_Ja<`**G$uCL(v2CNTCF4KOnc|G4=W<>sjU0%vTvZlZV-CE?y0TTXts&CW* zd<*+RE&p%vKVJLx7zzJ(v_Br!U=o ziE@m;I_Uqs`Zl-zJK6Ya^2^ie{gx^5f1QDkbV#oGZ}A&ES*fCg|M3WI7}jAT{geDY zy8kNu4_;(+FtC>W8bU4HyfxHDA9Own)uJp>?T3nfnHcF*-*lNc(CR~ z`eVPCB)_lczly)#N_A{1;V)aD@sm&L{GTkO8$|X7ZU0oZe;yl%xPx7$-T02*L1SA+ z7MJkbar@id&xzlIWN-X$@t@^bpZ!5IMv9C2=lAm+2v7b5Hzn2X&%YWEwQrHdp z{Xd$X-=en$_}D)n%I}Y}c|UZdzljgK zOuO+Nzk_ybb$Eh=KLqK|>5e$CAJl&Muk!ztv)}3^;jdpF^nY|F=YuVr4*ya8|L38L z&yn!IW&dOUa5w*N{cr6*{KE5FB>b7|f8g7^9zOZVe~bUe+Cm2;{0&PC|Np6Rle}Lz z;(s0odL9QD%AsuIf5z#TzbN&8c1_g+BM<3xSN)9q^auHB{KGC19RE=L4)lr8{>67z zFXj2z%NNM|vmBnNIqd(>_?zx{Yn5dGFQYYn{3P+Ccb#Ub6ZXgHvpR7g--AB#MxnV9 ze(o5}kvvI!_#626o(_M)u@U0Ba#Ncc3T! zDYmQuJ%5M&uhIWIvnBQUE9bX<;PK~ZZ;g*~1yrqzRtNB}-=@ba?EZS(NdM~n2QFx@ zMJM)1{8wlRzy9@~n2)mu((?dx;s7paiw7p$EZM)5 z?6)`Oc>VuAvi<1)*JgmTc)TXkh64z|Oo0np>*Bk`^>+$i9ZB}PY5xh@zb;bOD{s}h z&lr7A+*iao)i|K~o+-Qs?gE86TD9$%01B8q=!1-|EH*6 zic`DfR=S?-kz-v%`6AH(rIn{Y?B8z9S}6Hn?T?tC@y7}YjUVkVr@z`a(T^YD@xpBV z|Jk#rmX_lGpQx4_eO=?K_5c3z&z%40O!>oK{^5CqC_M|HP8|3I`pvq5T_pU^$^Ytz zyy?gH{5S4QoxZW9wElXi!l#wo1 zW{1D%4XtnNFMU75r6v1U7Pwd%|GvKq#qrd9-uj<3_*nk~`={>K_~@^jz+Ot|U%uaT z;LAe7`rpOZ>EGkSbUmhU{Q19fEiZpZrWdqo`Mz7%6|`nl@qSn30`ver=&A{Ki2LiQ z_n)W(?~gU{KcEQ^B^O7w>+ygK8oMZVqZI!~DgGS%4|F=3_&p;*{2}dv->)=&cZAVD zlzYJczRcy{tLIbk{z}w8{T7k!{e0}Zax&a@JF?3v&Ja<(f-8#gd-^ZqtE%)zYWaJerpGp7vr=a zfCC!A2c}QmUhaU(|M3?!AMi`hr2Id_^M91rA)_V%HU0lyGmRVNb=wA9O8>X^yM0GW z@wbT!sKgXG|NY?0Z_4ji4+)n4)A@UJdOk~?IG{Ja@3^GZ09F2&`!lHZ*Y+IRKY`aD zMh9o-f7E~0KXUv57j$Ov{bf%j{I3oFtNkexwuhg{5Y@4ui*72_U3$+Iv=C{6#@gKu`PBaNw?7&a zkl!D$*Tnzp`}U_u`G5D-)c$+Hm;Z-m7k@W$`eVNY;DVa?#ZG^wwuIk-vT<~`haVl5 z9sXE;UOOE=^Z-4x*Gtc-^l!%NJW>9r_1`uP?jiprvcyOHM}CmYKiCht?&u1!{JCtX z)-e8*KmNV`*R9kTQ0bevp@5~%7u1qRiibpuzSD{QX%Pdk7r3Cc=jK{c{yReTpE@GG z{YCxl--}Kq|M;G_!FWJ~)}pI3-FhV8YU!4>>ZU|9O8=DogRh;g;yIrc=W*ZY8tqSi zzEimx_4!j51mpb`@&{~J6nMY~9rI78<&yo8g_m>YLYQRk$-)g_7v)>}y)d@VCbWvxv_TPBM z=t2_yQTRUtew47)3H&%=t20~tnIryqP{POS-t5VK|EH#Z>}J|ul}_MCZzO%_OoxxS z2Oab5kz1wszn9W8=8yj||1SP>>QWkp#Q(|9!yaU()yd zg@63j&407WUOIsvok{6WXSVn^-TmQk$$o2q_E@Avxc?)Btxn*_30s}n;{R~_>Eioc zzK8u8{2wK3bpk&@*y_v{f624W=1BIJfc;a#?Y9YAoxrzZlpb_uiywdPL^BD0`L){r z$qe{0!d55nqlB%_Z1HzqUV4m#A7T5gSHta(6Sg{mA0upaW{dyr`ai_^&m^_~)DgcX z96v$W>I8m*u+^C@{@m)Fr%Lu0)7joitO>_Y61F;lZ_T3gr!!mp+12Zc`}}?NW#yV$nke!IDUe#)d~CrVXHG+{K&#C;`~pP{cm3sj&D)j zuTJ1wRQIbhTl`nYpIb|^Kgs@&v<%0O61F;lA0cdYW{ZDe<2#>~@He6S%YdIGY;^)Z zPT1Fzm!^@w@ZDc>4z)z4a>P*-ELc0^RK>ZKjmfD|NsQqc}^ZH-W zsag;8yFfGbzls>`PvC++vf=fgRR7o9|F1d0CHMOJzl@J7peFtX?*AsQdY4Z>Asi0CE?cq zeyi~Kj}f*yfuAI7b!Lk{`KtSFm+%jA`p4IX%#FPi^yI&fo~JGIb)tN1Re9-X?lK)3Ae)L#|{J)s; zKb^o&5VktA#s6Qcvp$sYb35qrFLqbB|D%MhPT(gATbHk$ z&+atw8p-||uz!07|Es-reEaX%WV<@k*^hQ7=*#oV*Ol{&u+^C@ ze&5KgS4jAWnsfQ{qrd#~=D*ZLD$-WbKE;FI@%%@08N~ygIAAwuzO_Zf_rKq)VJ*A0 zw!c@g;QS}%+mpW*w$zz+{rzu+Et^gph&#|p7uB38_PvhX2T(6tMnwTrcpL(yL zI%;cTeXk5_?c4uAt?Ue$|2ZwMdv(eGRamb5v&L08{`n8!APwMe>wn~Hbuun~XZ2F% ze?F{!|7Hn)Cyzf_znmogw}h?EH2Cm4=vU*m{3!K58YlKl!_9m#noXMgk?ig!9Q*$@2251crm>^Ilnw^R1N4=c(3TeGu& zC$Im{cK!G6oBH>V>{s}X{p|N_<1a$Ct22}RNdK~<+dV7gzg&9$E&7(X|5WrgZ9mF= zQ0zZdTdQl~xfDE)g6B~9=al&W?2<7vCHvR1{fXlmSM5LLUw?t}$L>VW_t4q%Y>E}% zdJD5WN{2t}%8KVm`0D*a>WK0FXX)^*vPCR){#*RKJ0dSPp!mc3SFC?g`)?%|=UBV) zbNM%4`vDONs`OF^{J-(#uFm)963yp)@%=;GN3w&if7JUq{ppYAJR7NE4?ZTWZJmT6B)@&D{H8uJ{I&$B-bemeV;mW~_v85DMd_HMr6u!Ntxfb1XY z;YSzC_Ma@inf}{*7TzkQzuJE)xje_({*R8!L>heay{0Ca8=CtU|FXtj^8eqX{L+L-Qt(0l(>bg8x-<9G&q9{kCPlp;H%i~FN`*4E1E|~P9MGdq+h056qxzpOTd4m}zk{!EdA^nR z-NKUupjdBimbb0>Ib@Ur@b_L8`y|sQ|I91s$A5E}-q&Z!>>z#~@4E$D(DuOLb<)gb z&3sCyoBfKezhE!y2YqAR6%GCP#~HuM+93YcH29h9$G%~v{qV!CL**a#dv77#|zwoLc{?;`3ne0bg!2VnmfJ}!ET>Gpa ze>~gY^wuDL-W@vs!*0+__QwtTp$BO553bze$3M#Hzn$to|FJa<@vG^1gBKJMtaq#P5oo?Z-#{ zt7_Vx20xSib_V+kwW=-JAHB=4fAzn!AN$s&vw!>4pB|Fz-@PP=zcmehCi@eH{m=t+ z`rj>|^y4G{wMF^MYUJH1+n+K2jhFKu@cVAxaG`{MHT(}ZoFslXZxB zGcfF5b8_|rKXyX5pOOEO@9@3rh{x{mpx2K$l!)8M20NtgdnF2Uc(cTcii&HA3R z!;g>pKi}u#kAnV({h(X>)`|J?k^Vi< z{(%~4@H3|Wx54}uVR^uB*SGX(68?JlpYP9$%l2o&kKP%y-^73Xy87=+_fiaQtOWt6VGLk2UI_t^X1~kp>^>P`mW2Q~dZzZh!Bk@ek)f{^xyP zQSO1F{K5XP%w?hc!FA*}^glo+e}3v&e*7m#=>BKl)j|BNY49`EKatOa{)Zl*#jfjC z)Q^wyr}0>Hl(ZgsyzeaR2F;ZJW2=JrsCSSbYF%~nEI&T#|0Rfj)cBl zZ!i1}T+kgQ_qCGnYu{_wzd^Pi{>MJS%;m%Bg$Wte;Z}{ z-Spq8?F7D?|9Jmi;3M5Z>z7y^D1VUtgO{@;(AwzX*^2 z%-tBo&)XDkKlX`Ev7h&i2Hsx2A;I*kqVEL!znA0xH)H%^Ya0Aa_9qPcBa90=Xla2b z{OP}v?XP=3--z_z9BzNQ@)!G7!+z9zpydt^nBd2MkL}-J)_-a6Gua>cF_`|a8~XhD zNsYdKe8m6PM*lO9_q|5F2a5QQr0IWP-|Sp=C+t4X-%ne&e2E|bYqo#w?Lq%`rS+aUety5+w>{A)^o zSRno6!}I-)yE`5~^MCnmOo^oxGn3O_sQu;qYi4u%9n;TvNq;`-+r0XZ@n1hZKmOXa zjGyEG;HiB1XS}4PGs;ILrN7mU`SDlWvv%oc{NBU)@w5IVo!BZ|8jqjz538K|r?x=+ zEPsXSAD-LJ^e#ZMNDtd@qub;0bN+Q8=U-U=-J6{LHOXJ_ZGQTRgS7Jfv3c`P%>Vh$ z{9|o__}3(V!3p`}f5uCC>*-tU9Zx^wzdY^ae{FL5*BF1-e#klJlQ<-XC3c zOFVw2|7NHDtt}A$n$jPvA^l}HuedoLKhyt=Q~y@r+zhL?Q+2$MNeG-PXsu!SU!B@j~jHiFnU_1VPg7q)Uzg|cwhUq3< zQ~Ley^YfqiPTKC)6^Z-5-xvKuHNl3q{HUHod>x*84%DxuzC-52Mn*059zyx8miiC$ zZ$tn6U*aO&^s44NC+Ww0vzPrgwZNuN^&oU;MLxF|{R76O^eWMZh(F)#Je$4q-~S$& zbs;X&aUY*@L6ZK`m@P$r;mW$X^UKX_n}5i5L)uk>)!*faa2n2U_ZwONa5gVXdQ^{u zX`s7HnSRoRd(^2&((h;``b3#~P40Z{H1MhVh8j{mcUn!QCC00^dL1ece)~G+(DtI= zA#|T6l3qFQIcOmI7(xpf@{M%poTC!ukM}>C#g-2vB){YGmvsKA>YI>1<3t@qf2Yot z^O41>J|f>KEf(M9<9iHClE3%+*$`5#?E0FX&ls1#mrt|t1%u^&c(EfZ?6WyZe2E<| z&x$t~DDTDc{K}NvC9k%SA>T;%4@Wjg!neaIHUzK2mR}cNjpUc|!T++ZQ9EN@`y9$| zwXS~Ip`y~P{=HRojoLznxJYl={Fr-^@TIx~-@7({U3_l*r%RL?KaG3-`4TVx{hILc z{U`IT8`UV`{N*nvSRdj0#o_Di#D9=5ATE!eH(Wb>cWMh6;v&8OmYcs#s{i!-%5Y9}exZ5D@{u(I zspfmU{xdj-H7K+GiDRJ1Upzf@cPVj^wjXruBT4etbcp>j{ZVrM7UCb}uMq$E-o?dd z;v(JW=(+up@ag%NYQmF}@ww++y5(hxQ(m4&`7IWojop~mFSNWQseBAlc@h(Dl`Mac zNdv;Tl%Bbnv|q9F0ngZ9K8AdnUFw<1@=X7MJQp(L8|mCJsX7FZBpjm$2CV1ldSpe~628X=#^tlJI?hi2W#isI8w>zrLP{_Lr4zX!((< zEi-C+?;P<*`IOu5B=3yaDddL57@!fsZ!-@4@u#UwS{*Uo}aN+xj?eEO>ExvU1Kg&PQij^Tf z^@+!hk@4FGs~)#{V4R-_rP&R})-elt-uZl6PfN9&HKg1h;KO|}{JZlN6Bteh8xF^h z_$)`t@v9B!p4&BjN%7GG=TA!mX?tV%%u|02Up*uFR zxEbLe@6Ss;lgvNfpXVdM`yaCM;I60t2L93Az}$NiY6!%8rU}F7UO%`t^!F5~s|sQGeAuR~$aK9tLc4GxziCV8e0qk^YE_^sTv` z-tV@-GT^I#e%Ji7WxNx^mo5_DyU@pFIbgg;F12zQK>iBlua6HZK&P0h#)^;OOdW3L zzaKkQ%EYm3#e|p7C-aZYbdKU;ph1_YCwg%Ne0VJv@`YuO0l}*f>7wXP9cK zUuvWI)38W<-GL)0%g5IbdORsdU(eb&&-bJOepG=zf9xsQ^C$Rz63WN;^90|lD1S3W;wu9_Z?pXT?Sb;a{O!yL9qQq^ z47AQ$#}A3~kMdVJNb0|)bZ#Fr}%1^FVJ7@F-gjAkEnh&FD2vK>`WW9j~Hg4pX>HdL)6=zqtBEBh9AU5_p(oq z7}>C1y$x!CkL}xUzO=u0%lZY|r2_c$-bXcl_OGnJp?sv<+VsHL9L{p{OTIhblQLgP zU)|z}N%8&*^LK-N<%|1F4xj&WGXGqB?B}`qFyq;OarEJci`2sp;ydAh=Euh6kM&FM zVIqIkB{_Uyk@((5IS9ARm%oP~m#HiMxPBon((kvuW>dwtfaMPD?+1MaUo3x9i;CkP z^%?!re0({5M$DJEa^~`nd|Z87s;}b90ACvTMoalf#q!sCr8sTP*zZWB4*f;v3P{=3fRl5RG{q^5^4X8^+J~r0&e`^0S}c zNXu{KeA~XU{ASPRs9$16e1U!k`jzZ4km|gk8bA9tD!*pa{Bl~K<=1KV@L7(y_|E%q z$mWXAckq29?OQlA!e^Ew=kMC$3mrYz95DQF@y-3N{d0=1vxBcz`Y-8wB7Et;37^|< zaPd(tS$-Z~v2DF<`2arZpLCb{FBo6PtU|ruznaXyRkGf!#?SsWW+&z&^v>XHy1Z-U z#NCg@_oQs!i1Vf!cgda)y#V-F|J|weU#xu#3*eI>Xx8|k)XNLn=gZ%Qz#TyT7(YJC z5f8ukzQrcB&ny4vf%s;Pmi}q4I=TCMQ%jTi$NPJI1kjQEbIQRz$cHuc4~UDj$)Sfo znbf{Lt@vik)ipR@!+Whbe5nU*K4!K!mPyXiiEwxI{qsD@1M`>i*ZblN7b^eCac?i> zZ@_6%KlhIMFPS3ot*QTFezNr=`Qzeq-S2BLyIq`rtpBRI$(N5r_ag?cC-YC&SJn90 zzs5X9Idk^wKk2xWKlm(1T=(Ub;|^;f^@}?{^ttp;Q!#vIS#kJYf6eBvTaWx3_d3(v zt>*~P#dpw&!&@ccTX&3n@o2=qbdmTtzm}eB^O5o9`dx4@7GKkK4tqQaU!&o|zZgFM zjpF#n`*+DF;(G+;gYJd!QT|BppEhEmmXAqTmuLO5t?)0D^1=NnVUhS)zqsw#XUO-| zNtUl}J~AD|#rIF$d(|fK^1f%=>E55b8s#_DH^1F; z@p+CzH?P}8T7G9Z_?D`|L(iyuq>IFt`qAcZh<$C0?pw@X`5)VSr+o1}Y1E=xm+}FN z&d~G!7C89sIZ^t5=SK49zw_7lwUN5c;iRy?=HHsXL6pCq9=IunxJX@mTu0!(YKGfunUzcbQ_ENO z^Z1_B&EI)t*Bq6Uzh7J+^>ZwLGezP%4*8gI^w;L1e5`H$J~nN|x=Hxzihf-thA()p zIQ|{Q`7Wn_|KTFbzct}=`FiG7TfVROYMlFvD@A`T^<-2&4D=|OucU7NZqECIksjt- zIqy|k!}!R}-`XEL^iSg77L$d4F?{JF@l}I=c1;K zMfrgIIcy?4!~Gp}Xxy>cwu&!s_}BFu@$pQA&-<`Ae7k~wnJ+D$7|+q*UkH3Dx1ohc zmw$5~Z8$cGe|;3+vk|^bk@$XroUt4bUp31w+Py;j%asp&_}i!hCMdpC!+iN`K3(!R zhA)5~FY6Ujw|;4~jSVM+UOe$}elqoyeedywLsyF)w;B)hsfka17cajHuzyGOi+#Dj zp5r6)adG*(FUJ|s>$b5)^Ohm;A%4Cmt-uctbjpb{vg^})&-J&>u8{gK#=mrt_{z}F z@Uc$GaQA^+`Z({zZ71lD@<;mJqFrj@^2hOI^(Df;=Og*^R~E;=+uz7<#~AM{y7#r= z6p}yUB3*Cmv)_p0?)Z2o%ZT?4*yU9%AXhzrRzRhyjJA})Vyf1gx*4@dZd&yxA);=3C-TztoYuXHbj zkNhK@cyIrkRsJf#KkApLm;{eR_{`_U;rjvQlsL$T8TX@H54PbH!bkp*j{9=+Z{qx8 z`PKW~gU2F#=_2u6hW>px)Z!q%`&e#H{$qUP8)@6yd+Yhr8~ETK^@sHS^YHNqpZ`U1 z{L9_{0X`AmOz@9-f#eV0lM)x{qK8V~R(yezznci0@W}{YSR}ru3do;}drkREy!}59 zcZlaN%ZJ`y8$27~OMO`!|Nd(EaQS-g@)O1=|7L)H#8=fz@I4pd^S&w$-@Ny2IdIFz zx^G(dHLY(EAL+Wm8QJ>TJ^x4VpA27&@MVg`cLUln7vBMxzY0d$bgn6XiSOy{yKWuN zU)IlhKV?AWW)X&9RdM{=qd@&!EIto{M|{&iocXEdFXfT=^!~~)hR=Lm9KJ=*Cg<;? zXn)Pcf872O7wJ_MCofLopWg2myb|Sax=4I03*alZ{v$5(Yt&ZkqLe5`kf;CnT~ z=l{Dn{{3C$mpJEM-s_Wi{<8geqm$r!Ey5QTiLWK*$AgJBJ>t3jQxbx$~ z&bj|^nICWL&W|51{PRvIF?v3KTtA!V^82eBo3z{;wrVGl)7ZZ0l@hU@)6cz9Iel#L zpZT_N?i~NLKFjy6A>T-MKXUV%gnzATFn`bT;S0Xh!svbh5BGdEK!BvYU%-bu@n5^K z;BH>WTq62eikJ5cd@c+M!bK1{p*B_Owg80Bwjb#eR~ zjQL%zLoK3f}fJ}chx`}w2v4H z-H(;V{)qG>i;r@a1BM?SDDfS5_YGYYUnTA@BfgU)n9QIke+|w7BHu`L-?th+``4HT zD5vHZn=Uw;UE$99Z%z34{+q*QZ?E_m4(sP&q_n?FjM)tLTcwM{*BLlMr~Dp>`RCLc z^vB(DbL~r0eooSVX@98j?^U7}{`@C7f9r`qHGcMQY=4iVpL0ISFVBf}`%(Bjcg{^E z96oJ+&8>0%m16#CPsMj+U4CZ5BJs_j9^JQA&KSU(oL6XM%U=awIMn6es$H6Ioy5Q2 zeEG0XN$&ox6!g+5cci?(OTA|e_EB)1m(DAI+e5w=;veOXI7@!1*Ep$ut~gipPlwbo z8|-4`-1{{-e>V_+YW(b9*%ApHu6|BS=mD>(es*zxKl+%3N%|$Kzw7sn?w`vPz{mUN zh;L2$B`#l)tQ?8e7+JSzr_Z09bU&J&&k!_=@C7)hf%!_hw)obhAK~(^(YTg=68}`c zIQ%)nXK)TMagnYyKBwNvF%CZ{cXa>u=sG*9{JHv9>-7`<-523Y|4sPZbuZ!|B|g&i zhMYTT#~42LUwVt&r}{Am(=)6DT zBE9CM9ZpEXr~Av*@cx|t=00=XYfeL4q!0dlM&kX@7025z(%R7zBh$@!{Np`{oJZlj zg?B*{qn7g(Mt-X${{s1~miHz4@>?wpagpvj=8VMqlXd^Bnh^VXb)Rf~6Wya&-Z%ez zo^{*jKQBKx|C#u_aV?G7)e;`lrqsq}a`!tDU;FvbK9iKcWzs&V;XX-=FFL=mhbH;W zD310r&l8WY|5o|WyE^#yb)K`4$sgh({kZK}6O!e)*oly%zT%;2w_xdpj-xB0+(EX3``Q2L@wZ!N5 zkY};P7sxxc#FvrZYKbr1P0}NlhPX%@jBjyX626th=h^a6h=1M*!Vj^;my+LViO-kc zYKbq9-&qU(rFx5hu{6X*I=0S9cO~KLgZvG)u=sQzrTow7S3V%&$K`Ff?4yl8k8_@v zIP%z8I>K@Ph4B6M*8PK%@ag_aH7V??EEZp8N~uvxeCesBMlJD$my{Z{#o{~vyU7ic z@O9hG;tTJI^RFbwzbmC9o1K51EIA?eZ0WElKm19hM(uUrUnuX?PQ?4*!cwF5HolkN zp;#LJBHiz?jprrdQ~iH69`ycI4=A3$CnG-Q(Vc>qzm@LMMLw4LC-p-8tW9^b&%QjX zE%&tl9nF)=+pHlj(ht_3n%I6kKFRt|{cQQ?;(NNv;z>9Mi>zW$qhOs649{Od8reh~z=esS>?%Rlmz{Nr=6{2Mf( zU1I+wtG_M~edw*b`2H>Y%g8;%jPF!0pC2P7f77x~!1r4V|KiWP$#eYsLi`*3+#`#V z`tNs4khb@{NI%jvv-!;N9jW3LQOuqHy9w6`*0uf_uiGBF{HH(49qHj$Kh!lTe`lU$ zzX4B%e)GUdAvt|8HO}M+or+PN={#8B6)U>QmdFM3C+V7;kjIXmb!u!;j&5T<1 zuhQo?Giu-1RsxTuFB_TsAuiHc7oB!p5#sGub=f;%Q(O0I?rXj?R#%s=}(JIZ(#G+Ur+kWV*9tV z&#CpB7_~ISMf&WG&2LP?w-WpdagL16)5i0+*#5J3Uzt(M{0;9fGinDr?M)$kdu}nR zP7=QC{GNQ|VO~$?@#>rC{Lq!k%$WQfA@xk0pGLb(^4>eIG;4R;&OWCm$a&df>+fax z7sz|HH2g){<(PFxB-MY{TqN;b7R~RORyLnm?~&^KUWxoGM+CWjl$Zx)yj=ItJ;Q3h z?JRF%>7zg5BK`WMYxhs$pU&^82{5mx^C{FIsy z^JXqS#gjfZ!uQ0e{Ac&PSQp<9+voG&#`b%BoA+(8TN1wW#@R1Yw^{yeadv+G&XM#h zFTzdh7_}=m%#UwRr~ki7-mAQ&ygFIC8qdLIa)!HD8s;nM@r%a3o`mnQY4(d?imjiM z_{Y3bs{D&T|6Tms@7sskCgCeZ|2h1J@wEXXNn5_z^}zW37}SppmT0djGF9u@eCCP_ zX`%aJct4Q2%&tE$zm7xyD|4ZBmu4r=5Eto?raR=_UrT%!-JbWES@kFJc?a3`AQzv( zy}E0{_u+Xr=G`w#e1mYlDN#;c|IhKydor1S=_iu;=OIGUN4<4N#`AYN&wq3HSJCFr z;R|=L<;&$C`O17GANWk#`r*Us#PN}T-TuQbEM4>`@i8A=d_e*J5f|ytU)^0d3Ey-F zU(E)8j(_O_`5QcxoWI0HdO@dGUr54Nc2s`(EyF!CEVral&Ckxp^1%GlOn24^$q3q>)SWV==u=#hq->W*BI#soe&%ULhpkdB~|>IW*>~@IhU!ot-Qk7e2;bC z0PBB@|D%Ta?IPulbo<@>PP%?y1-(`3XZ&=z#MwW>m;OV1b#nN8?0=#j2JuxqePs4$ zrm@9MKC$1byi-GWe%JDeo%7Deq5kVJLnMD=`20<5xa1qDCH=W`VSTOu)&<_?D=Ko(7#!U^UJ38lD<$(zb`C+?`s(+*O7ld!fSLN z_;g8r{=P~5FPzI-4*%p|YFsnp@7L^iy_=>8~wQ=1Ofi=>(^HPx2LnQfN8p|eiD0D6_FsWu$u|01~ispR?`!R83_h2QTK z*3If?(F4o>9XkJCOIM*-2Ow@zT^CS8{QIGtXD+vR>|42iih3zX7x`y!o(I$G@q+@C z?>xRtj6 z{GojCJC{;!NJp${_H|PE-Mz25!v&}>2U$-_dcVg{)wIMnJIu@*QL~m zxMj`ZUs`$Kx)q!a_to>h5f3kTo&w$1BtK0VAm}x%H-1vjH!O9|Hyk1Jt-%@5`K~FP zH%h*fy7+nij(fiAXz1thK03nSe7%qJW0@~}?@~8^_WXR*pltud!JiR^2KPqiGx}R4 z*Z({}lKdxr_k2sb2L;Z(bo&b~Za#bX!F0SdZoe6dzt%awalEb%-Y@cx`rK@tjGyN> z5`XS|HS_}*Z-DSwPqG}o;nb^b_(1_m+@v+9bhsg@{s{rdn~(ZO>W8F$wl`V&^ENX78`<;CIuXtl)|4zm6Upbf&O{CIf5b0fKLyqq5tpiDRE z1{b}$OOpKDF7luz=xzG}cAOT?&z~k0nXVtFPj8U53%AbCfA%*i6Z4(-FQWb9`yY3d z@M81PHum5Db<4-k>z`_L{N|qD^S$UFWFCpm56Enr%zsUn8p_X=+~4M$FUk8e-0{bI zui5;f`jpF!|=P7iqB0f){xYlN#LjAk*6b0bt)|rTZ z+O*Pn@%oeFm%}DV2#-bbli9vF`3diXJm4G@;&>DFB->e*!;t%;QC>WLP=FFQX~T|_ z67R=bhwJ-&;`L7?KWn?b&-HTUwVGn}CER4N+|Yfmw$r{<{%25r*?;aY^GE43qw{n8 z_Qmm^{hZ&OpNM+N-_6daGk%^+Nq6#kH4pMgyZ$mkK5$Ge@66g;{FFqv57w?f)_`Y8@^w9){Xy3YQOaU zV=sRGAKz|uy}FBCtI$Utv@lp%JO^PV3F5} z(fq1`9uN6W>hix(`R$1F*V4|pfGNxyn$PTf(VFm=IT^I;PaU%RZ!4Vh*;M~1>=o5N znIiFXoa@R@q5co=UGZ=(p9AlA>}UE&8`M4f!Fc;M9sTFqME?Exk^H1~E>3=WqCH9h z4*^Vo{G>)%K2!cVFTs5!Yr@a(NUvCY)>cXVhmFs%F^3N%*FU@J#OIq*$CSx^)nb2> zMTB_$ae%zn=XCRWqK9SgSJ!g^Jo&A*yQ=)l_x$Ex9S~kC2~TWclfOc9P5%qC^KYIb z|BuxOw(}zSF&&HJe|O14`4R(gg=yf(iJE7Y7npg zdH&R>l#CxwjOw4%uEp_xC(QGBvn@Xfp%VQQxBef1`&f#Vf3VdA2zaY|(_6>OZyM$I zz_EhAyl(FNK!3O5@Has@B_85$&vRcfe@Ho4_NZ;Y{Pm8_dRs!Rhb1ispo`-M>5h*rV!}Q-%@^W_mkp4M- zS*+!0L|w!A{1o(5+3u1Kl5w9J;%9rrdp_)2V|acs=T9gHFTVl)&$0RA@q+@C?@9M* zH6nZeX&ao672^CA)vrzUmPrm6e~)DO;rVvNfAuRCk9+=JZ`UP1UK%gITt5nXO8p-@pU-qE4*y*R@TbwwOgZO2J>dBFT)@t=i+@r3$@eDV zUnTg%M`Q9|B>t%=M=t+~-*@m&cl@sjKi@N-D*R)5D*j66d^#iR)4}5r{?wku@jvb0 zA^URY`Z(tg&T#w_7r%2U@smEX?!#%tKM?rKQU6yc{`nDpf3M>3um4!G{10IN4fhCB z{@rv@u3g-Gru>jzchpLw_{RZ%73QDoj1>G&MflC$#o_1v;J`V*u&t9W;^euX^uH$l z6E|tihWljK?^3|u8TG#}{10RJGezRBb>xA36Q!fe{JR814Bp;dFz*~epD^+PlxtUQPM!P5-SSKP&!b%nPPTGI zxn{n(lzb$t_&<#Eu}=N7J<|obBF;a{e|{fKIR6rr zpNu2_UrYH7WBC33i^K2M=j7i4r(84sXDDxI7g#>|olE(i^qDIUd^+C$=lE;O0mA>6 zBL15Lio@^XWc)5p%8x5=Oc%d%X$2feZ=2DnMESoO{Ad4Pk7o>H=R0N!;OF^-)d-jE ztlR(J66@e}C(gC)|C8@b|M)IX>-z8dOeg#QuSorA{#_z_pKQ5OJ-oR78_#d>PL=&< z2Q@QyG?MXxoCBGXXaB%vW}al7j>kiJ_V#aPE@&Y9I7S>#Yi2@uo+{7r`4inwlG#!A zLYyw&%lkq`KZ~3GpS^l@i;|KJDjL}On&ZdCQvYOLihTM9CCg9q&8;8uzc=PX(#}0U zeI0j>EGnSaNdJE{^P@4j`X?_;edIJtnIId*5 z%mW>J;CFO-wf864^U>Y)>sMv|Fcrg}!g+KY_mcAbM9R;v4j#tiLr#d3eEyv0b`?4Q z@8WNJRrhA``jhgraH7cnE7AFTKK4lxH!08GBmSli9^!B5xD$WwJgp+}v)*F3L+-0A zQ~cEbCVt)DnUV8npR5Zx=$b75E`Hu$n0DmLH-SSDCq)azy`J$grNt%D2 zIMjaO9b$3oIf4yL{ha>c1DY(EKTf?M`z6J?`Wn>3*SStLZyqA`XY8C^Js(HwTYsUP zhamR3b~Zfoq99XSz?8$C^to3~%HH2>aQ@&V=szg_;2P2Y#QBIRq=Rxp%JUH^KZW$K zQji}HdUTY7ixy+NIl<<$R{%GinKIG`K7IN19Yub4J{Q}sRByrmcAeb$g#Mv6AK0TH z)qS~oJ|_9m660Khd&C)Uu06Y3_TP$SdltxVwQRr4Oi7vA0*3Jr|9}Io%%0Cn@5KMT zL& zv+HMh^Ka$A-*KGk-$wZTBmNrxoq5mli#8nM=eXG1Y0EG9TL6A;{hjhN^Wqn8i??5t z|F5P0U|x%bf_=hH`ZjbgEIBqF;wG}^-tAGU^0NT- zC)=+Q$*3@X{$m0Bx^Gua4nOq3-TOtku9w-$_Q&m4#_-$kFU=^vGhfBn8T zK=QxL(Z^tPgB^GBaW(e86gz)K{Q=VRMowH2uYW3s9G8ui_gH>^x=do0O%@|?u4<+L z{zCfa>F4tCQ~q7O^!f$XE17PW5;y57SHAS5;;(S!I}(zZ@o%s+&G=9DeJRs1W_?vVf9dZO#nGQyuae(m_5 ze(#^*|ESgbUaR<5JNScjWN$k+VMa9 zFX8vlppkx&K4Pbag1;8^57%El871T2)9aW!aBqU&!{XY1>czXqgKi`4#4=a@apBQr} z^o~{mKj$q;n{&K=LB71W^9^k8n>+ixS_4mR+~2_VgWP^5lfiIEr}a!Ho)5a+KK6?+ zWBIP<4~vQ$yItmq#*zM-j(g`EBrjz?$ZH_;La?iQ;GeJ^Iv=@ghIJyI-kN_wUS-`yJX_zNUKFbTmOgq??^-9R|XE!GY3l zSIGTIy9gCIcvCVeY*oi})Ms%I<=K;3B|@&BN~z<;Ne zd(|_KmtXE5C#EYKNcj{w<#Rm|Q2tiBw=8MJpLghx|6I2`|9PlPaK!yvG?Dr|<^R}+ zAKpF*|M`>c7nw4vm+9i)Z-~5?`XRkj-K^z)l3<6rMy*WN+4^Y5y2caxg`@BM70Qd* zS^SE97wPjW>dJYTb4l$M(wvm3$LBRptxg?~5(JxA!~Z*(CgWKZF|JSo!%g_~Y`V_~XxtKYre<;*UQU!e41& znF`Q(zwEJ{_8&Zqe-}W1@*xS&+$D82=IvAcY&zKPl6v@2gYdS7f4Bdzy|aGAdUzeg zOaE+lsYgxsa)j@LG96>jyES|M#$1F`jrq^|(%zW6;aP}(Vlw_49Q>}HCqsC19_DGW zublXE`Wpw?dfLMW9hc<$C%>5ve!qHdi+?Ns$6@?V{i~jRWc+v!V;9;#8Nc=`)YMpF z3f+IV|Eu|USpH5#|BCaU`#&#Jpy_WYa*^n1&oe|X{HQr=FB z`W>kO$^7q%@W}r{`Wu^Lo|*DohVQm<+&#FvdL869-}C!temHI$<-ZU7l%J!d{~1=- zFxCfoiX<)?3fay`&-XMVBVl73UO{7}W;8TdW$U+>3A z9aECSZw3~}|0>8K`3(5RU6&;PcwQ{eIVOJ}gIr~B{xRi;-!a^9_xrb0{BtpWV|F5uC7T)X!P8PJX-DbC7tBjXMt0@j>jlsyhGq`qBB% zC+!C{X4UxD)(DF3Asg#UA*^DF$p$@0VVE69KDQ{#RR z8=Eo5V_!+8nXPBY$1=oA|HL)@Wn16+8(II9|8fQhI;P9*?R5Riy+84E!EZ9L{Vzk3 z@pJzp@e`+c-Nwu4djH$vad8fD+==u4*Yo{*2#D_)?iHU5YaU;}qx}4Mnv~y6gg;Xx z{-*EQcs*x5=;yEU-C2LF5B~xDGhZ%ay5P=yaq)Nj?3v9}eik|V$9IwbedH?c{0neCp>g)lUV{0hV6K%n;_QfahxtgpyZHAyuX#t6A9w%qo-%&%pN{aGVa4&k z74#$n?3X0FURY-3C(J6|MB^y;{43&Lh4i}p4W@(Prmpf9CdvP17YhDoBK(;m@qYrG zln2Jc{Zr&88E7k@)Br;rDBblb_?UA1&?FKbyX9<%jO%-*D*r(VgjP=lCbzUHskO*z4Cs{Fe$} zV))I7;_$cK$ks2!Lq2ubCf}X-S2fOeC;kd2oI?2L{?P1&B>Xp>E-^nBlm8;|x92=F zjN+ez|6<^m8tV+TO)V9XoY@h{`y`PwA| zr2M`Z$&Y_(arj@jAN4=vnc=$os))zkSLNY@MNT;6w~zP4fAhWndRgTM&W7^SQSrYV z;WwuhhkrWjb7%i1_m3NA|G2xa&;yYBpzp{1=EP6jq>VbBdz#{31o^3i{2V0s!x;Wd zk@%N6<&J!r!*Ys!j+CEAAwRC15Pt~&h444-aq+2&f0={-JE?zyMG^l~rx(ZnwZ$K@ z{Q^$PRU!P9U;9~=69h}P6J zxA?gKg*az@4nAX@oczztKcA299Q^dRY|Jj1xcqSctlmEt1RSNyT*O()^27Zj#LxCL z_{GLc{EyADIGHa@|Fw=g)3xV3>pz8jp}dqqq)S2X`t98;{|7?RkL`04MhduIe3z`yyyx@X|N67s|OTjKTbp6R)y+heVi|1}8T zL;ruy&f;+?JPXMbiGK<3_@#E;o*}TG=8hjHI^}}69zpvXLXVg7;vqmj@6_YQjTHY} z;OG4&y=1-Ff1R;QSvWhH{}Uvi)R6y$>YrB^TX`@;ET4(<#Sg4I%PDcyGQV)%6gvnN zHoDyUbw$@J-dFq~^d}AYf4k@pd&^7AgTLAE{RzqV_1;4@#QzNEsixX`&%QP0j(^LrenkB3eir_JY;yR`Ictgk(q#Mr^e|og zsjaPl7eC#J-#k{Q-Kfzc$MhTRo$ejvjTtm-bj|3IoxJJ_FLEE?4Hz@5U-`D)NyFQZ z8rY|%e|z!Pf8>BZ{rbyS2aX&$e5AaTU8#zxGGSuTI`6eTEJ? z(d#>W_|Q&XjTie?{EqBDYRu5l#f7Y4S9kE*_1L8sfO_MZp+(Xj<9|Cp>3*k+&z1Z+ zy2P}>zLWI1Hh)-Sk?Q?UdM{)-;@fPAm7`!o>z^srQ?;g>qiLcu| zD9`#noK~8(?tP*yww8CI2gq+sOY7giQueos-FaUdo+ojsEoAtHw4$uCG%0=A^-T%H z!#VH&%XLmov%Ah&Z2JCl$vKJl_uc^gqs$dn&fN5swzm8X4{B`GPTbT!XSy^tYL|7+ z&%Z8};QvvLjVJaZRfdb@_mw-^_vTPpX%;&h`NjO4T$LZ*n$pMjTRy+@4viAdN51|< z>m&8KO`onqXr8nF(h8k%EB$fz=sDA%#H{1I?@}JU51yBMXHSWq_51fUKBPC@xWuH_ zjo$lmS#$k8V(&|%ewRfV{iR%z1`m!+)Zd$YlKm$5mrbAUQ`|q|_e)+jU z+GS7f6;rH=pOo7(s3*;3xc7BV6xSwnjETaV}6A6W_g zj`c-1MGf`47frV5lxikxNU7h=`vURW{9XFp+`mV?b`gU=G)x!idfj%K8rNTE`fk$u z3Ez*>S9`%9r!Sq!@2~#t={wN2?`ujQ-;=I)(VffU>6?!HTXr&AILof77bd4~P4_RF zi8kG(;5zS5qM}Bd--GkpST&1OWpL1n!owxN$Cquk^Lj9qx4l= zvWE0M{ogHrX@tL~^znTu68=@2t+VGlrl8lx_4$+gh-{u3l|c{Z>~maBs`{aNe_{>7 zbM-*UUsrFGa=y0uq3oBYTS)`+y)+t*VYqbu;@hzeb^Xje|3&W)2+oR~e?8UapVX>Z zL#pk*rq#F3k)9~@_Tg+gay|?0iMFTL@Uj=xt!|C;i7^%mms;JRiZ#>bgUlgr;ii0~wYOFdKb zK>qmkL5!QsTQ(fVzZ~I*m@j0z;8QOc?jFJqiF1i9@8xhOS%4pvpv{K#$li}t4*k?p zw10~alK#}NNIx}wS#tWiA{?gA)k9^xJu#0H059dCH_}1qeS?0n#@W^Cu69{%~sd=>E{u<;A716XIunFkYU^#QjXn zzlP9L3Jp(LdJlySKC?*S`B02QpoxyuXm?+XCs!ofCnGK6=OE^?-}%``U45{x$vD z`se;T%JaS-=exINLO?r%dZ4%V-X-sRZ0>K>@olL3$(Vofu1uCs>i05zop_JWHTmuR zu`4aE)OFUKeC`8x_D3mi`ym`R|GGHtKGH$r;RnOtxbKQ={lfQcQ2sus5|_s#{V8)* za{9FWQ^WMR_q5ozauf&hHT{%LAM@{hxSM&loH3tjAfL={;yvAQ-fhf= z+jm#L`HCshWByL%RY+9`kYcg%NZ`o?da@6PnSzEi$C(|4#7zUQRJL%^h8 zwRpL!rmqb5zm(zpmP=*+AZ#ApzmS<;T>iDe{4@E^=rfKxdmin%E{XeVnC@EW^-(@c z@!~@2h2D<*<_Cy~d|(6qm(^9|qC~4R-&qVo`zPh;d1wYwxMtxPrvjTh% zF0r_nzJn`lKAGRFJL|1o3*6`M4fJQpKjt^%>5Lzw=gi$EyMM#O`gb|jUmx9H(kJ?J zG^uNn(?|WYN$^O0GXFoo4R?24glzv8@{j8TNw-7?_s{-yfzXJI{ z_=VEPa28HHuYWv!)c<;Ggp|L>qV)OK6_-92FJKw>UINP1T;`vn|K;9G!1TH2ov$f< zKX;$mCMkW*h5f;kQTn{=i%TEZ1(_dAUm^XlThTA2-VEjQhd0n(LeGZjbM?jwrO!vi z4M8HV z+jr_upE^L&w>U~)=EmakuTcHM`ZLwshQs=W=VG%SVYzhc5z6fBw*<*y3)m+B?uZ%LHCbo#HQZ*A+()kp`+CFRgfcV{LHl=(;c&e@By`)}AktAYOJ zSgBvarBV7)H~qErb>+GE&ix5)zB2z<4~Ii-JHz~Q<nEj8=a~ARY9b0dn=gfnBA@gMM_uuW7|IG7i7{`y!yxOBBGLIGu-=dAy5BU84 z_qRQz`V94Yn7rFBfb|JZic+?HJasQ)wx0rH&I^xXXZXJ_iuV4oQK*Hw;t z1B7!p^{AZjKKBQ*f6ehe(<4Xx~@ zj_Kq4UC0dpm*W>wo@w(A%|QBErKLQCb#nSi>D!a#lloOmUm^Xf#mGN{ z^O`81JdeQp#kK=X2lx4h(9>eOu|D-{aQ+?JjY8?`zvnT}YyNqdKV$lCQvIuyk^WU` z##*M&(ZBk$>GP-C{BzUiudwcJ`rPM_ydJM=`g~{n-YX^fH!0d57TjUeN4}Hl{8EYh zs{sRdM0pCF`Io)n9y;|!Dfj0=KADc*kWUZwR7-@PYgc9eXF6g3XBGVUp#3NB`h7P4 zus<+_d=8QM!JrpQiR2~LeOT^Db$(FS$0(odk8s}?qA|I8)j9u#{S?1h{yaSQae3!h z_X-5W{Z8alXSloV3*&Vu<)7}`{?;XX|FC<0gPvdI)kf=Q{#`bI$q`b`Uui0H`e~h* zzs~;4|J8X{OeZPRPx{1en+;6rAMpINH0F);{H4b7kMigC@78qw+rj7N_a7>yfUxaX zI{3i+=YI*{_+0emDvCG!`{;O>k*y5TvE{R+;rm&1J;-EqE*4|kW;!XXX%PT2O5 zc=}T)|E)zoBfPVYS%vi%|DNRZuR_Jc@OaNQ(}QSCKdfsJH|4Jf^n&T`;e(-Q&r;KD zJzWX+y14I``xUC-UWWG7+sxt|2zQr|U!>Q!JR$G?ofO7z-K4*o>K0r7xi>leT>nWU zqUpeqZfo0H#y^Mabg0Ma{vWLWaD9Y)Nh6%lsrUPTZ2PnHPkG@vNWsIFUmhcHD8r}o zXXD@NCG!sr-1={k6qK-8U8CpgG>Mh_E2M+OGN|+^M^ER_&eCqkJ>T@x-FeP9daeGx z`Tk#U!h6o~PyGn*1JUE1(8yfBWj>zjb)x5tymw87<1oMbKH2q^RDH`g_OIuN{QI+G z=ikgq&VR0tr4jBOBa7tx((trc`*)vBKl{g|+Wu)>=p(!jxPG@&zWgtxd++>y=yDkVQC5_y z-dFrQi}_pUzi%NK7#~+|>gB(0F5k!B16GbO|K+o++2@N}=VL%+Kk4Eb= z{{6}M&-KGJ!aJ=%`+uh6&T?2u_n)l%F@IiVexm#{|DU0M^e;Tb`;y~cDF1!OY>57E!0{Lef~^0Zeh{~stW{mUwCI{dfu^S|Y%sJ9%sJ!zSB=eUfxmoLh9-xh#} zbNvnJXMUdcUVgn;$pku-?&Nc$Q(rtf-u`j_-NxsL9Gw$O|Lo$@{~*#6;Jy+@pF39y z=Rz?5SK^$Uz~ReH4!_8kSx6`O#q>Yn@Ua6Uc4%ij^Sd60HOZbI*9PMo>aT2+5|2;E zE8kCPh5v&^qhAvUt0NK`gz_E*Uy>GXOT`1d?DU<$zS9@^K%@}`#^c|8L>m@ zpLF)9JG1u>ufqC5HRh)Wiui`H`Dy>bGL3lFcK+Qxmx6N1eZ5?#XoK)MUgG+b z2X}Ygn*74+9P#mseBQn4kd5Q=PyN;{50QE}Hh=BU{cGuW_rEj$-Tm)Ozq_8s^zX}c z(kWJsJfvq$>t^s~=%3+j_sofBYx>ie$K(Fb5*d%A4yFi%Q zG6wzdH0BB6Y#x3C^%>mRes1zbzPk*IvSwSj^ZYW7H+YUA``6^-IN;Aj9 zP(FGdyJT^;{>S%op+DoFAnjjl|Dyj;a{3pKv;n3OZlUr2GSmy47a+d3F<-~@cnHTm z@00Sn3^-Z;u^hkd?1Pl;Dv5^aW_aiATQ(vt|7nbW?!86wRL*wJ?SFhYIsKfUOCz=v z`t8)yBZx^HpCEsj&u2hCF^&5*$d}78&hfXj?I`8-XN;H9aQ6@a=Wp4MWcnCCDdmOq z;^3QlN#lP#e^yO^b7ys&8y^R>8<^kk>M4p$+JDRZ+SI5WTwnMX)3dFSXMIo8AO87# znA4AMxsUZ9)|K@jvA+t#=vV1^9rK^}Z=C6_F^(u~I(xaOiwTj8**pLJ)AByPK6W$kcoMf-8m61{^k=8tl$3rQ|EUQv?)`sx9H?W# zKN<&WzSz{*Jt+E{>A$x7cP}QTU-i$_1kgLve!dJXa`Rt@$$quGamHryQueoHzAMSv z@gi~>uO~X{YAsO={B_^ncjEo+!=(*3`?@wcS(d%dmy@FFY!dQWUT{V$8W#__+^JpWnG!`FDj z4VoCWv)kqK>l~?1vhO#P_hJVekdOB<>3`^Zn)eZ&*;r7BebIUUxP(u?N{`+-|JkO- z7`7K49FAK0@HIOA^BUTAp86Mh|449mN$&h@{|Q_F>s+rIQqKR)wa$j?DnU={AI|0! z)bn&F{~yA>3c9oY=Q;4HCU*Xt^*{H^d(YT>@esi<=(AHVknLPG^}x~Z*oA-!P!#)| z9>+F~Z#zfZ$4bltwn6)NmekjNx9EKA;K^kEbVWSm&-R!H%)FD&A9vog65rj5ba}^E z|DEAJ`Bn6r(BH3u`w2Mbmi+_k%b3|8=KHs~E%z4iylaGGxr)FN$UwM}UUKq?AL9Lo z1>jF8j0{eZ`+qr)IX{^{TCb`he_TG;x5oSj;bgA1$SEgxV%%?_k6n%r24X#q{VgBv zS8)Ci<0|rPgV!v7I1Ux~S<~=caIl|^H-LK~Lb)UTZ1DA;#QEccKd;F8Qs&`ke3^bK znLnIgA%B{J56oZUSOC3hy4S%AcRr>R?(TdH`8k37#C=F@;Gg5v49?&1;7)zxOlymu z{KxCx5g#s$Z<8Ju&W!Vi^AFz$f4s_={`1qt@rUcZnK$z#nS4v7Z9b9@AEG>RoyP;d z4w!!lezoC9anG7P=#KF>)4SWhAwQV+VE)%@4Y`4PCBi90GSY90o3}4Gbg9#yN6#qlR-V)2+?tbfL}lJhDk7gK@b?N3o}z^1?HBoT=%rG=;^*HkD2_iK*PD?p#@~nISGZGt zI=-KuF3NSe6AsJK5GNcD5sY!%DOX2w+=zH7SH$JgRnkw0n+Z+d%C7IG9r?L_qLi-_ zBl+>3D~>LbQ;qpQ?mz4{Ry;o+)zAL(#qlS%f2MCf zf8NA=Hp>g+p9XzgwmX!cF;2cyeiop;_8pIH8wjV#VBt+ToFNAL~p`&Mu- zM5^(kGwAZKD?U*ER5|+_yk1iO#LgEDUP$H-=LhE^ytO^w^*-{)(XW1Nu1y!`0hzB4 zI{qsW?`rl3zz3#pF7lo8j8*Voh%nzs+tq*mgdLSX*q=-JQT@Vh-wS^4%LOM9SJ@J04wlcm@6XM<- z9Y^Spkn-PLFz7hOG!s{`>)=`4)C?4l_Lu$p+V=U+*E{ngHID!H9RHPqM?>-&ihi!x zrw+;w?+%2QZrn`tGMkwL;omQ9X4HzRfc?IOd@nZT% z?3V^`FQl(TxgmY{t4HS~jn7;6w*dtoTE1vMIW9lLg#S7|Pmh)RKzB;i}yXWUO@3YH{sB6^Lt}9{5y1qBEZq`1tpY`vLlDiAUZX)vynQfzW|MNOX z{n$+Wj}iZ3zm{ShU)S9h^An+5gr_#`#Q%O58-D7?5~G$Tzz@pLc~gEI5br-P!u<83 zlVtw>@Vch{a$BF6S1g~%SJL`Y4%95N#Bkp<$K7x?FG5e$Uz*>4{$+^`-#r(!A;zb4 zZ-ap9U>uslJ}(dMlX<=Z+BMeO&ETKm`0(H3OB-(n;dF-kD$o#g>zc#s#rac%^0j+k zse4Aq_!Q%MZ*ekzR<*PNkv|u3d~~#(mq0Xz_rGQyvE_yQy#)RR*mQY*I1Mq5 z;5-lcQ^R#7=plIs$UTpy0`5OTPC}>tIn9wbAO7cKz9@uV6y=$618-*e1J@p_{22)T zaD4i&bEG}EFp{72Yx(IaMF6h+bR~b#k7YcEJMR4cD94@rIfeaXghTlm;kbK<;FfQY zFYwR&uZ277CGzt&M<1aB)8o(w=DmNd@@FN+7oDMhP^06E`2N4wlljB(#Ug}TXn*4a zblmmCX;{&I=53LIB#6>#d*M(mu^?wf3@u`?_ zSIZZb6J3HR%eor#wJdqX`^TT^JnNg0Tfc4cpI=n~vG<+P|6mwxr2oU;N>7&WVcCgMMc=_5QW;m4mp?3iCZpO*LW z@*GOV5)W@XC;T=}_%A!*f9-_-h7*1v{yj2k%LPgN%ZPre8h^cGvsCN97V=AAW{q3_ zaXpr4DpVhaS2r+fSs$h^ZD7>0KJ@QtVAQfcOkL5ys4ccWOkXD9iT$(nVfr@tUM%ZF zGesm;EezWo56_RxZXRaaSKLoP{odj2gm-t=HBZ*H<=T5Ux&G62Z#63|F%_7fN_VmT z;cVtYFOB^t=EDh#ZFvu{j?VgT0NP`&uX_mSafIXcN5|lv1G;0_YEFGKzdorzIA0-M ztT#Hqy%v0+`%Z8t;rGP(z(YHxlz-EoxA9Ov?unh{i@}k8To5MnkNR=sUrs*`{Y=K| z>MybWn1pyk)N|zPRJtP^;@$r{i<5eD9wMl6+&67{Kr1JY@AAIqX<(r<9RuQ|X!THZqMZb)7kKK@L8x|Dn+J$b|Z=q;+AUYTgH zP=3yk`Z^xp4C%kc`+t`WlKSD;Xg+H@sb=H;r?$#}cK5R_mH6WRx867Z`Cf@Hy-pOq zyT5Jkdinl6C%$*2%8Q53`8vAQ-#R}%FFD~UZ<5R+IA%cK8+6k%@&4ls^dE1OeV^&! z(fO3Y3M zC+dq@xX*L?U9;f+lH>nAxIeK3|EEzeGJUJC{uaQ!GyI425B^rcy{$8DJ`(P?15f%>8*eq- znLg4Q{1^y2pwk8W$K^K#{?>|qTX4Np0x;gk$@0tleaK(l?~`%v_c@X6|AQ7EL%tF7 ze&!DAPT2dQAK`sx-96xN@BJx<`}+t#^R4yo!+j%+i$d}j?pz0?dllTr0uSA*;qI=R z1aNl=@smD!z~qvo`d9T=)CAC5Q8{fX&y=r2JzIZya&U{efsUURT6%@eK|tnkMEO|w^>8J zl798$7KbG9SI?JKMDn_<#WicL#@NuN{KH8EJovF3FJZ zq?K=Myef(R?@0V=G9B#rOZ#uFV*R&Tr+>2$>CrT(31qOQG_$OQQQKSOQ}ZWyyhYYl zN;330BhPBD7X0d;rZM!v`Fxx6J~tk&mG8xB{$|6MzGNV_orpERRr($HYnBQyv0Z%o z-hZftQ9BFad$XlKDfT$LXBe+BzuuGY#U8ws{oX8;XR$K|+UHQhQd`KZCgb7Z?nBGyb$-82-~uTl_)I#rl%)hC^SB z>oBa>)}vkq=I_~VE@k*|_YlE*j(a)WYcQXh{@B*{TK%c1X>6a(N=s{`U#I2^h6DFn z0NscC0&$MRDki{w_Pf7q5BTDkdsl6w`ehkse{{V|r2p49n!gXA-$cHXy8Qpf(X(Sb zTX7u&?HFO!p?(wG$>(34aLDIQoR5cp4-s^B+{x!gj{X|?yrYAs65;IbxchKF`(HY)aCyL!0F2QX*>_s;r|BU zKmC*c$AX`9C;$68?j8VcvW=Bj`X~RVf7@+_7@=n74izEIAUnldQ>ocr>3hfW&{y46mlp=oi%Xn@h z`QI7+K_B}d$^SR0hq&7EkNkY^6)T?%pZs+1HT4lM?={U_V#6UnKZHC`e<6VXZ7~m( zg8y-F|B&Si>yT67UWladg7mX{dfp%B|8(#_BmMWx8FkHOzu9z!|4!yV`|sp`iPKLf zj@%;wNxTot|ezt*oXM|7vL=Wy4Vg7>W29kdP^AR{XZ;Q``_I;QUIT5=^#3TN_4(s$ecuizStWLkj-=Bo=)6WWCv8fFa-VzBT=dpU@$Z|5sx|nDb9M&$W&OT84l} z>>@v8{KNRi%d`Ft-<0u_*sd7grazRijo2gcO#d58e_el@FC<}NZ;|-)Irvh>S7Ik4 zywp1~9um7b{Cl6tct~tD!~TErRUGCV@h)TpCkQZO<$^u=%R`}2hVaynnicz7|DpI*yV;(2?kCS;)4fEFWjvSaCh?2y z2L5_IB|NdWN;RY5c!T6w>=faj`cDs#Z^iB);pwwCP~MBJmGBf#W^l8t{bn=!y@sLY zKX~?rh<~y5QJypMJ8R{8_2(ZY`nzIjJp7;>57===-uWoJpIO&0{0?>bnF+9tQ34lI z9T)4mt`GO2KiGQSUw%yPTm6xO9wP5~VgCP>b&t%d|9k5mQ^A!Q(6^^_pC5032SPvb z@kx^R-DBh5pDjO|;yY6I|9P%#q5WYQo;QX0I`W_M$!Vuw{VC=V*$=5gygbh!=qmy( zhW(iZ3?J@6_N|mB%wN*~K)CM@eL$|iksqVspY9{z|5NCxvA@KA&b!bXrF#ng7Xc65 zg`HV5RqBnn={vdSyV>!VvwvvVWRd^)_!s-h$ahkg|BE?q0DdyAmT#c{19$Sj4dy+_ z=Q4b-k>j8Jlczt;566T53TGTz4)<5!KaF@R;9iaKAl)nBJ_zpqD%)T3;r_NW9uH6f z_)fe7;a&xIhEoG~rkixrv)f*lRR61fx0CA-Jqj=_T^daQd!T^`Y?4&3!`?z-ud;Zf1LHNe$JAZsf#w(P8$zxmm&&yD`E~ zT`l;Pt}CIY(1cQ z(yiqm<+qizw{iWQx19OR(}ABn4qA!-W>Np7wr@WFx0UuZ9^O@3<-f0JoBzDKJcrVr zGW-jU$bWyeJjdUQs&iiaq0|#zZ2gw!eWdSiY}D@O#CMVOkK*`l5`6LSKbP?0`y)E; zmXGHy^&d;Wyu^_HK3a zceQ;V=ge<^FihH)M(w9rWhe`q{b~Q;U5G92bkYWz8JN zUAnbdGl}8g+z1)2Wz8oq+xCUwG=%#Ur~Re;O+`EFVZ6`s&v|&xpR@g{X=HKJ-9z~E zcs>EbDTn(UlkcDH*C$`29fW_jUr%7)1H<YoB;XjT1A^&DL`(t$*n3|h0pOJdowwGSk z)tCzr4)28~Uw>o%0}uJy0PFC?Prf#zzQ9|yKJgKLYsb9`?iJuerm@8n!2MI~|Ka%s z%m=(SDg0o(mtFGa%klnk4d(}Ce382^uGqK69Ekod_gOH1 z-o4-E8^sCSNd~- zU{U+O%AeC_j(j;OfAoBMHR0X1{OJDi^<)N^<>zRr_*J$tKgfA}Voy8SK8LI2{5Y}o zuz#EK=bqPBPsU^E<}&{z->N-PItKKs^iCN+#QU?ewpGVO!=u^L#-1Io^4H^{9OR+P{wDeZj#qO!AmvDeZ&sJUPoyZD-(1{VaIJ z7Bb{N>4Xa=tNwKB8k~>7^L_TNk`QJ`=ZmLt|HZZln3VfVs|BAL){6@cl!r~~m{*am z=`v)~@x(|OH!0QeQ`n@A*<=^{yoHPx)xXw@Ueh{e1D)@cXO^?qB)p6~-?x|W>4-Y! zqZ7n`mE^yK8;Jjo5{`b~T}arrj=5Lxq{V$-gsJH0$LuWOYq*-?C zEb5;JEo}cnmO-+Hl>PGnQRdG3#yl9jo1?JKm>FjK1+1UB&z0_!s{=3(=HZ;DHVEhd z=&J;n&nbudk&b%>+$-51h5t&pU%~z*^fP7pIcv6a_F)VAv!;ggb?A?xddi)LNBlng z--z((-Wl$9IPO|Z)bL)ZAh7+ZYU}*Fzf<8tdi^ffwTSl*=OX{kpDc1v8_l13EsM)P zw|`0iZoV@A+AOhxuCmDt7pv_)RRCyd2sK8@B_G0 z4zA<;9roK+!2ijPe#St!AHwx}+?P}X_oJa#lxbk|V;sX_|MMY>HwE`oiRUrvJ_+tF zVZ5X_HhE+>&A)-*i;w(!zn}CI8btXQwzByr)kfBkviyxh`E&Km89&c=OU<$AVLrWt z@h-=U%%|7k9y)yId2@6xM+EM<{p9=e?Dr#_O86gz@fYLu;a>71`sFwur!(Ad<9=*} zQw8^B?^^$qn`*ev#yFVn*iL3@FkYv-*7s_bV?0gw9@g1>fbc`a8^FB~k!Cl~q&jw~ z)cgBtocWJH$JZ00@pYzkaryft@my^4k&)dC{&=Y8=za*!Sq@QeNwbkP+;2+vQn-^3 z42L~|TOYK1raR>)#rY4!+Zy5A>G-Eyg`8i3f0lpFe=vLx;pF!11OJwApTvB`JP_rO z`+Wnrv!B8F7%#NtvmL^z7b0BN=y95!``}x?rzp1WMRloW@&ikC-uMMA}e#mD_ z0{%pW-==cU#^2`s%ZYikdHt^}O(p9R3?0F#5Vg{b}}Io3FpudKR?)F0E&e)?@G?g|B?f)o<`IgAF9)t#5S^RatiAD|@jkzSUt{~jwJX$p#Hy#6P{9^m=rdmu+po~`G0&sNwG z_MOM$lg;OrzqD~T^n8>R#2b0v<~vazN;046{XgNZFMJ4g2TGg1&wDrQ5|jZwU&nWr zcU9f}V{b?QQI_=mW50%Tlv9`}zR&v&Jdbj-p09lXbcOPS+qFISp*<+i((|?7#C4Qf zqCYm@>-uFuk4K*I&OLGdoYVb%9z2E{-iF`*(!7kZXFK{e`m*CAm${1WRQ>9J@;&pD z>T6Qd3b*~C?D>b4ucj6pes0qTyuWmGv8iEt~+H*kf zzg_P)zwL2_f9!MmUX^zhgKAG-#mq{>ir8ko;Htb33!*@|EdIhNZ~Vy`o|Q0JOQ_Pe_f)U8NI(P z!JiEudJ^yjy?-H5e@@}K1iYf~7pcGA`fGUdGl}-B>HU>NJ%%S+^tv6lhyK91{DWMd zD<55#`-h;Gx z`qQ|M@*%x{;R(2o^1JptzNb+BN}pf91pZ5uPw4wLE`~o8#qudPw%{D))z%(7yNU8? zJzsbV>PPvezJL9Rs1K!u-rhHb`cXcw?eSiK@j&^i zUQb&H_n!+t-saFE<;CJ}&jyAV-!?z9weMe>pYy|x zzukxdu(t7dKkSJ3`D5ktnBUr-`CjvTkjk23NydZBe{J=dAKT8&pKa&#Yuk4o+pldt ze=F!=Glq}m&$eg2-~6Cf)zh}<@v~oepf#@l-L3X{{$}WrPi*+t#;$Vu!BZ6R>}dA+ zLt3Bt5t92mM*g+`;p`d1-;&y^=I1iL_BqWP7}Nb74KGK}<2UWmc)Q*2=?exD@K%K< z{kUBUFMPu3f2N9?todzG)`_ClcBMQGw;hyR@I~D%l6mI<;Q}~FrQ~e+Z6uwL0 zrZ?QJ@H-Oq+@tW_iF)o+_`XCv+jPF3pnB(;&WopTee6*OtIv*a>pb)EIR30?{>A&( zU^hM3czmtZ;m=bQWJl94AJO-&sorDyy4CO^%{xfF%n3HbhdbmB_O&e7h!bzv0`n)js#0@91Jk>(6UF zNj$mfTMj=BZg{foD-OQ#4mUnCTF>?bJg4y5E_a`e!ZEm{bldq2B&qKPtYzFzZ-bQ2p=8bC{{ya_VvExNM z9AFFl1^k>Ze`lNJMeTKhZ;QJ<_0&I5de?O%p296p$J2Fu>k7Z~LwdjBoAuYz`VAkf zzr%m*?zeT3MmN8!`^9YL-Ml}j^*@+^Kcw(SlzwgeHx>R8&C@Y@d063})B7!d=j#gp zs=+^^d|2n>n^wQ}*W^Po56Jk&b9CISe&ZWgDcr`v{?Uyf~OaIw8?VecEb)#G-dIdmRwW55llgFF8wx(FZJ??z{ zwOdmx9|J?DEKYUc36y_?!<^>}*KAF(tm*x!c3ek!t)7pyZcVY&wEhizXZe;sKeij! zQMQ3GvA(rY)P>^dxwjwRQCL8;dzud>HEDNJdg5HeZM__6ULF> z7Y5LNlt0n_jlBu&L3t44#p`3Q#yQG6tiD&EK9q}8f7!eZ-_K}}Hyr25l<{H|HVjsgRJ3e^R z-4~q;zou&LiG@DLx2||eDz!c3Mfmkt`Ze=AHoF@3$YbThTb_q&{dc}Y{d@EB#`8bu ze0k=B#M^fxx@+&|@v-!8>f7=5ZKA#B%BSDFbxVpRsc&2U$k=ULQY<&a9*oR_i_PPA=()}3bBS}yW3l!be%^s`fe?9YhHL^>YWzX>T!6w%{>lJf%|a%9zQcGUteH;N|h7tYAW^1?^8LadV^8S zz`f1zR(+sb;U>4n46gpvg$^g5W)yyh`f+VP-vx!+x*4UgKsGOPHq2! z=0!ZH@XvqR)o;JE`jEo!wfDZ>wR2P97k)?EqwudQ{3}||n!>m0{BLMIn;WhklgHoD z`@Ii4I9QE**4004esPn>ojPvTuNl4nz3tk*H@p5WD14{+t<{gdrf}n%cC7xy!LClk z50k$iME>c$^g`_&_`LE_ttMqhu5X6`S|U| z8SpEV|1A90Lt9wBSAM&Wds%)^{MPWxj)vEEUVnZ5r5A76@^r&*i;s6vVB+IVIKE3i z3UPR=KvSvrm7Dqh4Umt_XEc8QTW~U*^JB*^ zOx=O|tu7v~#mnt{?4K@3UH8()`3BDKfWZ~_N4*ix^Y?)GjCaT5oAw9TcZ|C#UE^^fHh$~>{{^Xk#Q56v)aP-2N8^0#VdVWL z@adv6jqB@QxghnVS2oUB58i&x&lZK+@x~V&J?HPI^Y;b#+4wUjPx(6n*Q8z$;rGvj zfm?fd{AFB^pZ{v&{5p-F*gbnS-eczn6W8w=ZLaTYXph~?<8_!|DyM&K6purC2RM82=}A>YNEfk{yKFZ z?nilii>q%F&$68FV|Z`Jmk$g+>s_oLhe!4j|k*Pq>d9>v#i?*__m zB(87nYrg+Y7d4+3u4_JjiQjy_GuM2+j^|Uc--~-Y&g0{;iux9CeeGk2hoU6obrz3X z|2X!yLHV6TdoBKEeg1Gi=;2w7@&0mReEEC!@%O)Jy1Bij#CU%q@xFgZjL$a`^{*$! z|6S-W+N!vCLsmAilA@DCRMQ@{Jf6w6Jh{#^LKhHET_|Ed3p`%xYX|Npb#`v%&| zaz1?D{0R0}LU}BFw|Miy?_s|vl>fs2X8QVm@qgW+b;^$0p1bu+^sn5f`Rf&ppHjac zdsQR9c}?|vkd=JwXz|l~)W34R_^GWA8XI)=^5wEp7?U(h*7@6frw7=#@xl7@OUv|9l)0e&F zT>QTddB)HB``mb4kMBET`A6Tc{f%5&zgVg&m zJ}BqYhsJ&l^`n?RwDvB@W0db#AKJJV{YNob{3V64 zVEJDCpX+!x%enHuxUSjixAo0-ZtI-w+}1nWxvhJ)b6fvx=gIih-(x)D`m)8VQfM2C z#iKTZmK2NmN7t4xUMR_UR3A*_b*`g+C!R;S{dvv$)%O~&5+aEGF}kti^S}9{ix>l+|}WIkkzlu$)g$jlo7|c`P~g z{mLb4-}&T{T{pR8=ijefvgb`M+4&DjE?Iphm+bs}a>=e6-PrN+L)kmdML)F9y*nH9 zmgLmP+*^f@gO2pA0m& zW913W=i4rCKL5i0=JS^%?!P3F|MB(2{ihB$Kfk@^&ezkIrC9#)W$t_oij^FpG(Ps8|F zyp46fXRP`Dmw-I%T|EAF;`;C7+>7aBi|B7W{_@2{f4bmEh}U;H1W){YccMR6<(sd6 zH8H-gNVL!Nv$4s`QY;T8+WXnW`K^iZ_=dJOwE)CKDeC+!d}C{hWyQ{)d0A=!<+%y` zdbwU-zYO?;;wA942m!(Vj?JKbD7GKGjX_nfZ_ZwpVz~(GYwQ}2Pu2O|{37z}Q0%i! zzu58f_s@o0zgW@VAF|({eKptXyc_FNE#Kn?M~4^c^LBg$bkq$E5Yr`}9UpM=%lu6W zPQCkHm22uJ+M*ZUYw)X_f5ck)YorVTSq)<;cu{4`|gWV z&*^Mj=RI3cf4siWB;HSZjrZB-|De5_vG~>s`V&9D5cb0+_7}7JpMO>J^WIGJ`P6vx zd6K@@P=CCAEvVn>=JD5oFY)WYpBT?O63-j`ZD2gs#x731B{tuzFDbWw8Q0_exfJ6S z|9!t!jA#73H*wyM{>QI>F)_YRO^pB7a6R6iXC~(Vg9&=O6a8bm`PqEw#i`fF@o)0t z)YZ2%uCLWEPVJ1H^O?cK{H(|7OT7%pr5~dkJAP#1CvH8L{N(R%^Rw}nj;`*XO{I3G zx+3{`9~Nxzz4o#A=lXM@=b=0u_N-mwaRc|q<981vo_{cL{(G0Y=hv=*o`sUT(w#4K zL$5^nLtKy7cXe;``@W6##@}!G0SnK;^C*9;_1irUCEowCosc)zH1PjsynhYn3p?;U z%F8i6Jh$gf&-Jc=-iY#AJkNODLI>_gq5snEE`$CDm0&8U2Q&p(n|CBy|*==Uz_OPOrpNmVmz&{JoaEd zI(z9gG3xjfwk567}=v-{bX-qP}?ilzMsm`Y$EM^Pa@{W&%G7S2Xj>dmwn& z-nDHQZxk+8;CTwP!1C5ad+*cxtqsZFhyFF(AMgLq0iUQpdCvfTp&Up5;@2Npa@VcC z1Bvl_G4O%Uui;si^L>mj*zuRPwB39z{y_Q8&zj10%JI=uXT%@k@|SJ;x5!^U{~sxT z`Tn^4r3}72A%Fi%9z)&%-zkq-{=Mb#jR@>cU=6Yw#GpGv^j6uy{%Zz%jy#goYXRY81t0=`AzPfx(ND*TxV_%?+< zHv#t)eq{pQs_?54@Gga4lYkE?+}0r-P<*Yu@{9jpe0|g1y8ir5*e{#!ZtNeK$~yi4 zw}yP|X#8P8@#lQ|M}GB_&Ob0#XyzLie%Zloy^J<9^=93_bK~dT{hq$}Te`oa-9M!8 zU)K8#4)G$NXX^fZ2G1${e)VIF{i3UXP2pR$J(d@8m%@Kd>o@qi!tYJM?^bx1`c>@y zdlde`#Qpave7o%_$QQKS$j4W{(z2y!5>!m zcXYlC{)oc667BrD!XN*j`hT?j#jdvn_=~ijF}>g9+DUt_!XMK6|1eR{BMRT~4W&oD-{jzv zbRKQL&uz*lKB@R)>*t@L@PE|$*Zyo)Fu_xJ*4m@+E`>i`>))Jm_m3&u^7A%NJGk*D zMX%`4waa~7>37F>fAfu>kMpm!?{E zl-;GGeOWZWZ;L)~iRORV{aY3OtuHm#^HhZg_PcY-FdXsOrts&eezWmShaX)Ee^B%9 zHeTiKA5!>3mY3J%;A0B^VuG(7SNP<8u089Qxce6rey6s73i3-{s$C(yWYR~c2~~>Sm(~qH*Gw(I{1T^Ik@d_ zvH4y%o)0N}Q|D!2)7{Vb6+h3^@mbLEX;t_|U9No#Gp?R4g}2)M8CTDc!aw;;cfa>O zcN|mrMZNCa>OY|HhxPtc)m@)a_$yTJS@^7b?{S5{U&nKy$H8Z|yY_Edeyg^BLFw|> zbv$i<_Kd=lzmu6$_$&1Oh5KB;?pF9CTEF4dJqo|ebM3Z%-KX$xYQOCM4TbM~oV(xP z4=DVKJ>uki;vKJRDW|KHE$ zzv2EZ{4D6cE!?MtBX4}UYe4E=V?c#u7o2M<>{;LeBt@H zjxw}Q&+ouF%04~!e*DrD3xCgd48Q-la1E}bd=TrOc)rnr_n~Y>Ls-Aph5J#yVeP^9 z4U`9PKd-NKUz%dsj`866LJ#UgvEM`9+;(Y-WnANv8;{5DHKIH&;s4wI0{49C8|V*; z{hsjVRd^odjc70J59LZd-?$C+qx6Ta z{)Jyfdr&I+{00I+EML*~t?j_?Yofdpa-8G4@g+Qu(yjQh-jBAS+@tMV8$f$ey7hgj zZ(W*V`3-$O#f_0sepknH{YtbCW!F!-`p13){X;pZ?MuB5_oJNB{<01H%qjk@{{h~Q z@)B$RPosS(e{A#lQaq3H6MB99UAP}*L)*J~68MO6O5eA+h;x+B+ViV;9_0xTsC=*Y zV$3hfHa#DE5bZ^|R_S$f7oJD?nm)hw6^sW;r_uxK;O9qtSKsDkm_L-UX&vA9plvAI z^!nImP(Mn}@Z&j{AC$v-|Jd7b9i>h0_ijM@P)4l&i%>sGXwUCN{U|qUe>dKXbCj%( z=h|IpFUo1He|-$&g)(OR=nU`$rKs1}I)NW358C|yDV|3eHT?Jpo=4f#>kC&uImL2N zuWvpJ*HE6A;2)3Z{i(NHnv#+__ve8N9NhGgH^1+7pN;F6L%KfYolv+I?rrFo-kGEF z;J8+6N3)MxpWrSWQ+p-#r?YyeJDfIsLhUEx^UDdi>4jsePuTBmcv{;5g>Ni7dDp6N z(<4(Kbni7i@>wdkHt%(E-So)!ss3(u7|>HbzmtGh6#nr9d`02!P1sLs3cu3ctLr%K zQ26Uqzcjt!PKE!8*6*o2euKh4rS_A_PCrwVt~b-mdFbQqOYZ zaF4>1`oVh?zM}JDdc(a6zu*GZGqhjtRrprZV-)^Ah5v%}SK;qh_^_>`QTT5td~X8& z0fk>_dXL_JpTf6ldlp{j=KX^T|JB5MKcw*A()qG}{SSq|NZ-4u_ULaa{CSD~{+7Z& znyBZu75)kxH?uFz1>Iro)Op#^`|s0sE-3r~h5xwfZDtoesPIv($LfDb;a+0=|4iY3 zr}$v~r3%5%WTIbx?!c)7Pj&Na&!DzK91De%!`K@peJs$=`j-Df|MpGYuaq3eQ`A_4i9w6#lyB zx&Ea7!r}jI3jgocp0c~XrtmJ~pDm6L++lDVXW!Lh@*%SK6n>Z9eI zxc{a^{PZ%!o8r%3Fw}hhB%Jg2?X3RstD3Jr^pxiFcOPgz&t2Yp{>;StlKW@h%@8?= z)!xVamiYOj*5{x;yO+luiF2;kiC<6Vd-3=F;@7!eCw_igy7`>zcjDK%ekXp;^*izN z=Uvi#{tM6-;@7t&uCD`c;_<&a=4;`JjqzWeX@34q7_a#JT@U>zexA%P+a$hV{m=Tn zSbu|J>wh-zo#hbbH{QPf#CRS}T<3bB`2Acj6hG&Bq4;@neNb{g=zr__o?U2fd|k=) z3H+Z)oZk;WWxRbiB(5j-1KFP#kNL!SY=R!*^*sah6F<)Z~XjY@K@P29)CR1-;;^?d>x;U(bLZ-#?SVfw>o>2UhMqt z#Pbg(#^+?dc|50H(tJL1y!rgiwdV7WW4`0_k;VJs=S$CR?(brve{aI=)>aoIxqcNa8|_wBepKA(7rZy=SyA})_qz9PeoF0kh5xPoUO?(K4t|fq z|3TNM+k5X*ct^rdxS{ZE|J>ZK2NZspj?bFL`yW*J({vvjgFmG3ujqRXzNv7_GcZ5K z!wMhP_L#ru5ruzI`?a9)-LEM83L7`|%Y9wp&$fMabpIUl7d<}#hlwYjJ&E_4AL*a< zz2+Z#s@`wE=W6h$Dg2K$zro;7SNLJ8U)%Yk3cp6%WA|@U_$zGQRbP9C!rQIC3V)`; zuhRLldazZUd@lGCH;?8|ezwAg6ZLosf6rwOZ>*jx6n>+&-~5XBX*c=w>3i3H%01Vr z@F&`P4gVGXO~nVB-vbK&=(n5OIjQiy+RjwX)jy-~l;(eJ297R{EBtjjZszA-P`LTS z&0m^R_|vqVV}Il7F@M?{jZVMm-n*vv|FzEV*q=N29SX15_-KFc(7c{o6Y!r<_$v+m z8TZ~h75<{cysRsHw~q7X`y79`Tj4*Y^_X9AQ{n%h?cBJ~)&F&cKTrF+srX}t#3yz9 zH?{p+)WCSN?$5ohbhlOEkILgwc$?O5=-e!fBBGdeFDI*)fLeAL>h z?eQ*h^m17F_SnzqI4FEw@onu_9DGRO_v$#99LYVw)pOeLLFcQY@ZYlg6+gLdoFDt0 zCd+f$rt&V;(LTCxZRc&LckViI>yA^mzi@V{dt!2W=EnZj_KEgeyc0XTw$^NU=gwWb zt~!0~X#40jqn)GMN3R;aZS?f$Raf11+s^iDuWfH19lc_7=jg7{kyR z7kiV1$=YOnsx&z<6U?M1(zEHA%yecdm|2=wn#oTWZY<0eCyTSoGvQ=;x;#^!E#Fv~ zDBl=Pr6E!nh}t$5xwt@)CNK6vfu+>GZ<%}k7*+TnRSy`Yrwc6p~pTCTh9x_vV(vokG= zex{Nh^}PMra`yqhH0hV8s^#hB@(q5zyQhDkr+?a?9`P1Xk)K)dgD}kb{+X4fqTkuk zQ3`6+a=EtZ7Yns&J*cA(9^O2+S_x_>yUUr?*-DV!moEedr^feB92h^6_QN2Z^GiV? z43_Gpbhcb8pY`*#YT#$em7o;X{93qLN-yCVbaZrPeC~i(E_v72OTqQ^!fIzwOD~qo z1-xn~?H3Bm`BDalEJ`I`^B2R#>T*6)2r{V8%ZJ|N-tm38z^^Rgy`Eq54)~#04}*+X zUh>*J^n2&%=>Eg|Cr;se=w0jWsP>F{7?2UKGK#i#qx7KkqV%EkqYSiMT*S>4mJzQ| z9r2d%J&RJTjAA%j+Au5QwQ}CO>MGB>?KTf1+cD)=m&bGE;zZ6b9`euTC-Y%_Dv!Y~ zXY$j*S${6)=jSjMH`nvEUJQKu!P3&TC}|(_37lN=F(B1qxD?_~81!NedKQcMZj_!{ zz8HkLpitNe4BEBiV`$I#g?g}5D5J+-`}S~ewOX!bf~BB(aL?Z9xqXv|$LAI?9)1_LqkjaAC-Su2Pv!|S``iF98?xbJKmnQSY#rkwT%+(KPF{y{E`BndL=x2i? zb+mrYU#{lo{9?Y)O(Gf`!kiW{thp)>*~1L>b@NY8$jQVMpqnkAG4JA8`M!_zUORDW zakUm)%~890e|ff6tQ}n9-`Tk%2dDSviLnqyQm}%lyQ#bwf=tSJ#SPEf zO~l^r)ob~J2l_3iy(P?t2eR_PyDHV-%&1q$hqciiUY?|yE@y&Ku%S$q+>8WRY~O{y zmG)i5(bl(ORpBTV)nu5i=&_ufWQ&**;2V0Oq7f0 z(PU7o1=Z<#aWSaQt`--|h4HGtm{0Gn`nh6$!msB2(nQW*F8UMYN-dw>U#{iy=>s61 zdf|XiDmoB=sLme3nCJ3`a^;(r^OHdZLpHgZ#

F8T>sG+=M4)S5X^~BtJhH%;7xr z`L|x13ksMAFay8jAM;D;T=~VpE%{6y!=9~Imh%O0w$4hmobC*&)l%8(9qs~l1;t8j z)gxwgd(})WOjj!93NYF`>*G(lnCZ-x)78~VtqhKxDTPOgrXwxFA9{P_Fwlnz%iv{G zeuez|a3w&8$dY;3TL_9lsRpbRB%GYwyMKIg;_%cImKfr2rxr9Jto!_Hk0cj+KY{$5TOkEJVh zbQye&XP~a-Qu%Btn-*4a@Gv?F@lh|8Kte!GJ|tLQ%A%IwOi)Fi&z7spN2d=>A3ipn z2C|mwl@VMi)xaf)kb))EWndmLqeT!fZ1Gyjl^{KLQ>dYT0fuM0H!*Y6YxQm^7Z>wr zqPLi5EjM)mLBYQ=IP8$A85Jfr;_W}YXYcN#`@K>TjRQWH)5|zyR?%AEGP@L3{S{J6 zb-o@KP zZ+qA>0d7$RHJyPV@JqXc5~Ot=R7Gr_ScOn2*Y*Tq08X~I0IKv$dkd>Y9|Q)}tL1!9 zSiMv(AM#5jKjTmN%ebXF1+2s^BA0^F6c7+HV`>#r#IGI>i+*XNsP1QRm@{~&PR*N*}42;fNJLQ)m**i`-|YN5K<5ul_1kS+)uGQ zJUBpheh^Y~yins|x?J%gX28ixYkyGM6Qm2R5cQB+phTI|5if);$QP0|=Ft)I#2IK-bGdqz)H>@! zuuwdJsgZ1_%Vz?zMpP!p?N>m2)N-76kWx0NlnVt+W189d?)nlnF=9Oh`#wl# zp$ohWsvnd9z(KnHVgbB36anH@%3ujWb%*EZX!rOY@5uP{A&)Gj4(-j+Kcsy=n+>X? zUa11U1DXQD;ypN0ieyIH^!XEt%U&rs3tR=_rZJ8XNR+K0-IjKKT0r$Ru&~h+MC{24 zCpbhiCTBx^oK!HX(TijE)lq}CYt$2+m#0+>^_h-}Ukx#B-gp(P6S%gUY7@|Wcezq7 zmY2%A>sdLUfc61d4N8D^1v$N^UMZA;$a^6~$`w#SP_Ab2{Qmk)z~@?if4y3)FX!?H z@>QU1$-mw|19dtK4pC9T`5}MR&&^Ll!z=}Ub$(oryQln|57Co9T$rE8<(Km_IZ*%n z3}akZQ~In_+4I#UY71>-o$)jFQf* zJN69?^-#+pQS1Y4^9W`goEQQ3&5WD^`cxrm&O&nqVWczexTxouo89@DLblvl0~&`U zi(IW%!TDl6U&!D*fb1gi6bs8iaeIGeWP5LB#0yq{<+$b5#!{GAmkDd7$Rj^DA}kf^L)}Z z1x{xsIMZ3G7YcQ7m=aA8M_Ev-t5C(!#1ZcpdLW{3mbx*i39SJ80EbAIir1mBws7T0kR2C6 zgR|M0sflp^gx5+VsjbKx_JBaCH4DL#n&pd-Dff_ZtGUl=?zfuz zt>%8Kx!-E;x0?H{=67&QzdpZV4 zTZQ~BK^3No2L%TPPOE4=nKq9z*WCf#m0x=JCG05Vi+S*@utRWi6uL8Y8Ym*WiT@q& zVo+{?2&i@IS7{<&>5-2@m90bL&4R*r`(fzM-{9wV!w6pv>&y8G zj8PubQ9P8ZXZ*9Ek0~e(t0+YXy)4`hereiY1jmIkIpY_KtJRB9rwM7UnX-7|A9~1ypA*N^$8lUVwG2$0W_2S4WeyQYq`4Xn{d45?e_@!lj5kr+< z#8~AQSf!O5zks=72Jr{L(6A3Ry1ZEU3cV2BJ=aMF-QM8PX#>G~}oUOGm?C|KX|e z<15s9h7bD2o7bgImzZZEX|Nq_Q73!q+vmcWUzB)WJFLP#%8H z@>x793KYF#&TEqm$a3hv!8b_NMbSH9*uWYG7edW^Kuvb%f1vbr>RQ+BExW;H;Hm@; zLeMy-) zurkO@089L^2&&%$*BZ1U^lm?_ColqNMu%W%l*1hKHCQEi$V)JV!-dTJK`^y^n%`!C z81CC#9sWsy9bL^r)1Jwdp&imaFzbWSp_Zx-g^Zz6398?9r&iqIN)=E1k7pv5LhY?bP#JuryQ`-UeQ|DxP5|^9xD2K{TrEO7US8?%8kS47 zVje>e?fL2*SI;WgGqGl&rGCW(2uXG&{uj<*H@d_v~ z_LX=GWTBM`N0l=R#L-Bp1?MhoB+s!4agUM+foDXyqA)zs(TFKw?M1|JD5})Y4nn0; z#qaRaQkX527yW|hVZtMTDs^~jfwJ&X(l&y}brA|72_c&n%ZOrJxI+eJX&!oI2xbSZ z92yvGC-li7E8?|tmKpfP4$trI>Fw(ufO!RP zohc1aGu&6tqdH1G1l`DrI_+2h#vua=TLxdiWK`i325Ty!>t#BIM;rX0yYbZ=THp=6 z4K~rU|M1+A@rk{=$0rW8k=H>;R9CNszbaxHJG=_KZ~4*)8521V*+w)vS$H*;U_1mJ z@H|3aB2@xe;4rJ@=AFL~IC%!(d2s(3O5VB{@O!|3!uj##dbK_U&JIt02E1|F&(2TL z3tP=kgSFAr;@9BpJPokPdZ2tG1Z&_|^;pdK_4$c>Y5ss;pM}6YM$@d6JqDaFWpSaF z7xaXS6hc=pH(0@3ASyz4ut#6MOd+m2EORdNd}mok8zj=()!#knoYz!S zCg7j1R|C^n#!IVUJjMYSS_1y@rNmCmTn_9^ztSNf>>yppW8md0L?|>)iq{bKI=m;0 zF<`7ZNfU*zyUX36e1fdOZn!01*$d+-lL^E#Y2W9-Ey*R=KIj#}Bt(AIFWf+Er4<7@ z5x-P7(Ok6>dQa$OA>)9yN?i@)7{FN$L8r(G$JW&~FGp8qNyOqYDiaXg&Xp)cFC^?7 zH6cl0HmJ=)et|%ELb`>SM>1yv=lsPibfj814pjwmg+gBM$)?58D7Qkapo>(!^0lI$ zIgiJvuQd4(bT{cf5=%l>7DZmbazcF zSXRV3cr(0(qW`<^VBjH~kh{Iszq#X;RBpgMU~Pw;WQXF;H@@WbmQMO{;JxWEjYZw6 z6ZG;pO(m=sDJz79%xCcK8Yc2~$HqpyTW?2~=_tRo3h(9#wS4_t;V>Aj9XTb z1IP?aP`5KQH$(&_9MKlzb5*<%dKfM-ZYa?cr~jx$U0zyZtZ|^vMft#C;clfm41KMg zy>oh3OT>!6fDo7fi-xlh7R1>qY!YRVf;b-RM))$QNoNpXU|2(fTut9ypu@o(`@-y! ztIkhhpy`(_&riYI%yT5r$K=5EQAF^KDeAKhcGQekKRpCdLaWkq(yeH^Dvx#5TFp?v_2_4Da^b3d-{h4 zha|)?IM6fPJKQHuSgVuDEsZq41`96e?jqff7iwV0=^WG%a|^YB@?@OUJBwG83jB_U zB8V|W`>1!-D#bcXo$j7)7(_L=DZ!=E6|yJ4UPCYxf(ZWFAYBpf6TU+p`%CCzkKLROU?7%4L|< zP@2!e&f}2JGU!SRXDTR;i|VW=`|9NUf?a4+dKoN?=F|~sEfAFqK01NgFT^O^C*n%v znzIM@zv$?}xe~L z%Oz8;W1wJRP>~|r0Z$a3HOg+|1bu@Rh_DenIbsurqfn+AW9>*<9420CMAPVHLlX;w zo53-m^FhUc5u9_xJr5gzJZuSFFF1DsCYYL&`D4gks2GaMgy?@J;wdXIj2kEETsAr> z!im!5c)xc-6iUu72le)ri$(n$y|t1aL8L6Exj99NG%^acs9{>c4#n%y>ZNMA*bo4) z!AIj%>mg@jZgNj$wvI5~b>%es15=99+Oey7$DQ`qOE*DDncoj}9>x{oK7LV8pl$^7 zhw{t*avd)1%>02m!b%L$77*Dhc)dV;3|Fv10SRMu365Fe|CIf-u#rb00skQOI9uD#~E*0$SDoVxY)(=T9#4SbPh z7k;%qt9c^?OzoRP8RM(SQgSS?LoGD8Y^tKs2-l*M846lHO+~ql9u^X}h|REG0r|q) z0W}ONKU4;|1dxRRaw%lUa4<^g6mBQ$cIAF;J&7w1l%Xe5e$sY-R_HxJ-vK zn(^I7z-T0l7j{S$q7sa{PLkQkAVm}i9ih@n0-$mt*RCMbY`mrMm6<|liz-TVo=3G1 z(HewIy@F{f&~cnzGYP)%LgzZ+xbPc!MhKIV=`$Kja~>b~E+H|1dEzf~+6YDl2II^G zbRs;egx1pT7=Y>t98C|^`L<~1D4my>9Vr%=sA)Q{UK11Jjb~*G4BSrefMzJU~k{hK(EBw5R@Jm?Cb3w zh+N8hnF?|&pQ+{0Qz}P95y%l03@TKVU1>PF2;%NkrKeh>p@pzC+)E)c=`5xO&p-MU zc#G7yFj?-DbIn*_M=r=`b2Wh0+1=-M&W-QCgM(Pgs;^@F~Y zopvtf+Aexy5nY|~S7yi}9K*1){eo@9xW3T}(_9QWztARb8mB3c_xa=u4OLrQD-ls6 zS_=llh=U6+pm#`MLtcjqkO@bJ6wg(L_Zm$2_;4&GFsx^ z&@~XqfJYPcQ`10lpVLRt_Y$;_i2mW)q{oFOfuI4M7LXrDf&v7exKE0(Fo4Hd49^IB zt?*zJg4QnQ6@-oFFQy^u*g@oUMDl{(55(#qZ7TG5P*cdE^UEStU^WXDEx|!8EOTjz z8n}s2>I4lL?Z{c;7V?lY6(nB=gMozzg)xd)Db`Izf=l6C=HGl6+d;OdB9pUXqtk6k~?=xXd7F-njQRE}}z z>`YgKj*X6|=fTlJ809x2mbB>Kf;64kn~`G`SpjCx+jyE8qsg^E2hKm}!ufF{GX!MG z)C@89>1}a$d33M{2cs;Y`qk>(18qIMLw(&t{e#2ZT@pvK_kk@*AfZ8@<| z_RA6QYIuI9%eCoAO>P`f8~sYk<+DzcfVu-upd_89kyurU2x zya8|wVMQ^bL$rbpcpJzWp|%NY1UCd$NR&9{(yf=28$nt!mIwWov0&!A&AWbM(S;=O zz+4bE)#~^b-4MjCi6X+Sj**EEm}!7f3J;k%ZHMNDO+q}W_ZTeJsfT7p3F46&qdMT_ zr=igXw0`l=la^bAA>>Cyk-J#@(uvU<7-HNFv;)QLZvK%?q zP+G_c8HT0Bl3s;l*fBuLIN|j55Nr?YO-O_oQM$kZ*nM<%1b#$KTL56O zR_isix7x(uq9Wr$cIv4yTq0}P%~U%BfT?8!0AdVkF3q0?Xts;wJeM!6QY22$4V*__ zc9qTn^Y}yzODP-NL|GCUKRo;y@e;R7stdRTa#ILD?2^(;jOlkdb}R~xvsCy9z44LQ ziQb});}a3UDe(+wRXReX*I`kF5$Q#%S6qhr4kpgrDkBQl4!q3pIK$D*X;81md&~c7z#I-QIbW%$hTo5OQRQ z0K{u}zVLdig~$dOHQ8sN_!^!Pvmtvcu*Lz^VAtraSmfdm2K=eyJ3}uT4=MqOZZ_0c zB6~9c<`Mxm`^H+p+Mx=##64N7;7xGJNu0axgJoBU1Dvxu#-Hi><$KQ1 z05jClnZe9k{B_(9lJ4KR2)l8(}L?UZdWtO8xCh7T=1IEL(miu=9oa; z3Xng!J#6M>%%8H^g6c?S2iKAG+vE}y^RUKcSjcpUao%ovo_b<{P>d?P0kf^|Gi;+3 zfGm23iClK1viQAlzBEJTfKn0byb%&qcqbgdScD-d<;bX~SA^j)I*D$9JJh+71aG0l zQ#GX^E@uQnYmXrMG(tEH7pWyddnO~LQbN{d4D<-izL*;6@=4l6kdmhGDk^k^jBr_( zc7od>YeJAEwSUpU=;A}N9vEtkUNE}21w;k1!d$0t1R6bcZY z0wY?YG3Z2ZbdP8@xCNYtIYV(wi0;8!D(K({%0&<;xLG(C5Ku2y_abyVLk+lwCSZDK zmvBh9AcsmQlsqUFNdCf5xnzkEx{#e@b()!Xf}9)%034V5@Dw%F=v~BEVVcfXgn&VO zD98ZC;HXyy2e+H!Ur1fVtLa9<&@IyMZkP!;oIecYPxy66J`n%>IF=7E)fy`kklum5 zC(orH#YS{%YI8OEzSDyHKID3o}pj{vZnwp|-oq=>=XefttE+0WPNrpYLZx*UO zRPH61q?{LOWQQ0MDm%B>E9Ra(09Z zxIuh03pf}~=b`CK*0R#&J}xFSrUf&RX>&9`ou=e^p~_Q?vr}PYGI(b_tacXii=7x@ zaM#Yc8#|k;7loi1Bsts7po2te;1WFU`w(C_hIMBWeFw#f+=nnks71z*cq59*er8R{ zH;I)~4Qw*_kQD-ScOnjdB{fadrA887!we+XDlZ{%&@yo9r3hQZBXgE(5a|eMCE+xK z+6XegZJn-1N#ME0Sfa2H;7$m1fode0k>vXA6-o5QqlY^w6K`#(?= z0aSEzLpjWuhB^f}UGYs#jeO_u0K>I087zs}jv3bkQ;`f2yEF$~wvmZc!Qu%7KVb!m z06^X$V(R9ewviCF0R)871{(Df9<_sT?9(od=~6S$F(eVN;VhegdCFx{^W#_x1&2D& z?NE*h&hxXJiTT-dHILk8auaYT=u+W-o-AiE!01m~jBmnzkhnyfa3HCV zW~3NXG$Y3+k4z!v*2pUZY;G@Mv3DptMW@os^sSMpI&_7qX>WiBjBZdkil9X?vjI0l z{*o~|n^A@;G8-SIY(a$}d&FZBXQTHm;*FqI7&s9p6n-fwNDY`UOmexf0fQ$zK$|osSUFN0BmZ{@&;ORJX z3Z-)^AlqN=bcSt$a~)yG$K*5Jy9fuTXKM(7Go&(Nx~Efj&w@WeFdEu}JtCB+l#Tu{ z#R(YV7xrecOqnd_0JN@hwy;{sK}x9CECw?iS3-dL4slIJ1i|CDku&;Ysu#x$DT-LR z#CRT6KdcF-Q;?))-uuM>3=7MKVP4zPPse7QHra;d<-|sM)KGOsyqLX%J^ekyUC_?@ z2D*pc@($RxAUyiioqowAn?{=}$R5S>m`8fV3jPY^CF%vI$<}h}vuD;aO%-BOXlC4E z05%*tCp_m@5QrzP%HU28RtO0*6g`7ZD{Y%_6sKM!fX;T3>kUj0eFB5pq*2INOJt6cU8DB` zRNfZ_?O?cPj_9)45qKe({uf2^Fsr6eVyOd63(!6&&yWv@C=pNwEnT8B9p_#)>N`Ta zuC=J>(ZG0M4@fJ<46~p~Tv)R}y+j?MKz$OVP#DOaep^T>G(@Q$QiUN~JT-lE(pm?e zZ;Ic!?%e+TqZ7`SDkEk`FTYE%9*5442v;-PfbAjb2pU37$3^&@lT0-aG7s=2IA;A! zJG^VFj&ry<1=p4h4alCUdjNS5#E0)iqI|+9u+IuS6W|k|ED-`4iRFk26YP{tR-DMC zZ2?Y>L2`~4sClx+zWZFjo-_F>`i6XE8CQ)d#*`eOj$00r>K+>C8R+YWYSYu(HQeu( zh79+1!%plU1VifY8ys@0L~M{9>w|8?ls-%%B8kuv!3?m}NOXoU_97um<_o4wv&1xl zcXHx5w~vOhdV5tgh=6(X$_L2m)vBa#N9;oOGtyu>;6slw5_Kq(lh8%V0AVJ72F5uN zk7-Ln(ld09$jU2KTaI8>r!WuLN@f;HnnGn>C?cVXd98vDNKbOm28ZF4*11mhEKE$$ zE!9&}899omLl`)wTsK*gvvY^`O~Oa+$VY5=sz0-HurDEB7R$)z#>H|)Y*6qCr`Cx= z1$9Rv3&b`M9y3dwss{atR)^+Y@GBBp;Ge_zb4f6zkOpt*u?>*?PQMR02x|fh#_lg2 zgo{Ooy`OBk2x&9Qg9LqIZa|q5q|_7|vGD+a@?r{yx|5tpkJKr*v?Zn}#gr!(u?npQ zs#-EU;(vWl zlBVaAj@z^`T7)~}p-4_DmZQ06#X8{30jtm*ELC$Rj^q`>cL-$$VhQ(9 z2GL3dUO7-}Q=*e~O46R_?nS4!gBqGSAROi3k<+VrC~L@jnyEv3tp_fdyUDd1`NS|? z(qz@6)px03MMicQStUUrqyRzbQkvum^Px3CBQ3%nH9Z5(1sjYdSj4iP`jCh@fMuD3 zy&%T%;KJtM^o(lDN*6%Kedx=OG znP<%`OOv2Q5p+t5*lE}R4e=`QEa=${I%(0@#@STa<&;wD0JD~@-0H=#Motn+HY=e+h$2yK*^}heOuJ zu@F^7HGLcfZPvtpSKx1%oA;{JK}ZRFiPgqt)4c&mO~x7P-Ng3HKQ&H|Nc;K z*FazIK!5Mh!0-Tqirg;17<{5TSMD&GC;L+AJ6j&j1_jUHuP1THo>dWxAHfbaNIe#B z`(fEN2x3Fl&rzn?dnG-Yo-o*_XsL_aUOh5;wIzsNJ$kh>9cK}~eiO6B@n|Qc#Mj7{V@)Nf4golH z+Qg(NGf7_I)}#SS6uzbv0h2PE#w5zEo%NAw6sJJOdrnb==qa-D_n z;F`nci}aR)BB84~4PyU81tdlXk0#)p&B2MM5n5reaBwmZp$LEf2Z(jpx)pyRO<>%_l%Qtq#ByF}FEZ31 zQ4`_@Z9?7N61pedd|*suI88CR>GA<6JG4v>&nmZQq*IS*icXWh3CR_42&mc6M%V%I zAb^!17ZegSEI|<<@w==hJi^miygZ_4p->vDlupn=+`g=`kq6S8+)_KiW${G0hRlOr z5!BV@fbz4@(p5ne!_3>yagW}Cc|yFXsDT=|toS(mR~6y8xXo?rmW2vY#+GK{zIS;A zcJ0yLsfshogi|^X6=W^)=^zP2N;Y3$=Cxjk@dCH+t63N}x{euPtjxb9bME@Z5p3iY z+Y^uC9~Aps6(aPB7e^s2yUuWt@eVips(M6W=eX8!mYR>u3w_V=@Cnz{b}VHiE3gOYp1n{quph%$dX<*k}_=$>o-2Arp*V!z-Bx;Oq%aUH8-(VOkE2VhlO5*MP>dq6;#XRvWOnSycxa zODZDplvSeTTPi8-+hoKpSquzQwcO}tP>I(1Wn7#(ZHEI4A%?MZwH9g`Ml9= zxOJ#bP+ma!6rCQe5!Vi@ljJUYqsa`+g)EXqdS81Z?!t6G=#Uzt!o!rY!nv7fNWDQ4 zF2hb2UCKhOU;<_+>N0!CE^y8wnpcU6#Fc$MOem*tXK0l~{&EtbD8ypW;O(m98?s4< zCW%MTXf;wK$WC?0HV^~hXrj*y@R+N3#M|pF!D+rse{u9WY+QOyU$moW@Sg$Knj*afXi4$6mbGATd1=N=r#3k!8}}^q7S8s1(>4>J^xyTT-$?a$4t1Rim7LDAbMizySa0hTCF=4&Ev=P)L zv1@P}>1@RBh>#8H;=Mws2dQ)(uFi4~>BChs4lMf*wK;vUF~ZG^2ev7lM3_o=RLf{* zJeZ^gD5;&7z`EpS4r5H%HhWEu%DQ`vB2l(ZFbK;p;iPOtt)5;wKDfHvbP+o7HE#`< zj>9YiKdaOcd4vt9QjGb-<^T~oj?2pZ!Xt>6)P3kneSRqdkLiA%AdwlWsF zz93(OM}P}fs|d5koFr$ldNS@P5p<<^Bz21O4EnAt*E}J#DzSCi7tC9vlbv3Q>rD1? z8kyO_XBF0z2h`w7K#oStzy;hi)Fvnz(S0=FP>Bi!AwFYq>Q^D!Bwa2NgPVa998vaJ zwx*H!=u{u?;GSsYDK6%6!7(OvBHKdO&5_&bLS?8p>=@+*ae*ob)(fI72obD;rXqV! z?XX7Ux!tX5HL?n~(Ttd015v=xJf7k^saCpgsJV)@6-X*kqB)m~8kd|(+(d(<_Q!JEVIqfoydXUyjyUL z%P6Yd<|Gfc!PAbO(ypr*#tgU-$PUAWqLj8QK~$hG+R z-sywK&y@;5I;aNR$sWTFGY)zPJv_Ywy@SJpLqlDIFt!G}dxrbFVRy;WnFjk4b;s?k zk%8%1SlvxMBiw^f8$woG(njyTb9NzVy#uR3ron6B7eijQ_{I=v0_GtzfUjkQj^-P- z2(B8N%f%3MXT%zcnO$^nY(EocvF4uvy5;fX5t(ycQ~kUt{LeV9 zNm8OdSm}YI(6V$wxMmYmg*m}~^|*HI;Pk`+#HfMP;0}T;oUkmFFuFA?D@JS;)<9G z3b8*&I~&?a{E>JTh<&wFm|mE007a&2IMVp4=APPkssQR4Hh;=aq4VG|P|~2o5HX06 zV9iYovS@)kr))WYl^KIzoH59u z&XQ5oA&0^A;Am<#`Y!Pb9kR@D1;HthqK@&f~w-h3r}dKq>~NY z1tr3XW+hcn$zVeIM`QiIH7PuYRDGu6h4}HNn^q+TLcSf zcRB87GTD^T?xF6X;i2I^Y$4g#Kh!_aH`ou8(5+q>?i%hJ?i=jt9vtk!s+Jxwz3%=l zw~(cYV~IZ5U|BYv%nSDtp6Zi}*cmD8JTcyWqu+i@SNm|sd}sTqYfp9*Gba~gohQ%s zvA$G%%pBKKh!Q|A7Z(x-90^rScol1IJ6s{yeL&ayHSvDv!%$nfitiZRAY|yq@@PrG z(tdP;cvCcg=HSd;Cf9JOAxJH@gC5u#R?92f;k98kbjgqai5jY((mVzZoS+h(HYvgBT%10m#tC{__ZR?DxirGqcLzilfyE&7TG_O88@Gmr0 zg7eBrV-3O&5}6HKYM00=J;b)c4n1K!STj=bTO8-Vh+pW)VqvD<_R}z zV=krJ>sP25qXaG9+n+!a{%{YZg5%kse0YqJoFxefXb3Y~mAZ`vZK%!uZenR-Bg3~2 zZc6-gz6Jb#5gg`c8?HmSi~bS37s+lNOk0SCPcDMpAlw(RwP^Ta&LDB$(7BER zMdKRoGGhmLBc8}osR6HdDj}ywoE5RvKz+!h>Kp9s?;08!z}miU@X!81nD4SD-4eyq zzFOHAwt$~vi7U}IE6{v2EL#ZXEGB`d%+8!(@+LR zOLRs&u9~CFus6y0tJyr_O;X=ShA*(*#qoIAaY2!X2=O?Ypm5}PWw7x|J4)) zi`-J+nzPBVqxL>=6aZZWiyOJ-u=~+3h;~X{Y!L!iIhqFNIOaTTYZ$;tsWR1sY)7=x z2#KAJh0dsVT_S_TN@%@shXnh|Rf#A`7J%C!8+))(L;)p5O_kT9&o2De%+{Sj9_Q=y z5t>@+WCv{h2-5H%auY%*9r<+35#ZvFZvCLsFrnpI6ta^74%_-bB6U)`Ru$CbNfwig zEdNd-1*V7#&e|8TWh+dFsx3gqZ)?!Zjz#*MeuwB4bN(qsm0M!s&D|6;Wt-Tg1X>tF zycui}+d-by_@`-k+&C+m1*$Nn=VI*L7BYt1c0t3p=AD3!%snC;w*(qCse1AKGQq!U zYT02&7fJXwC&IZ{7#&tf$LkOW*rSc-gr1XNaXX57F@G!_d(XI~W1gDp52`TIJgkBlVkp^5fD&bNCxY6Zy294Z)!=kzg8Pe^5pMqK{ zLLyqV++^g18qIdQ>w@FU@8{u1jJO;>BWrJvap0Xeh1Y^7+m=?6Pa&&^nVQPg-EjPV zcYb&N7?^ir1j$z7<#2o5H;2ePq+*Sn0%MxpyZ;78DPjvXK`q=~ld{+%2P6@otcdeS z{c8?&z%B#VH@7`@E{Vnz-ila^k#0u%x!VM(P-$I$KEQlwE)pcca*l^YXUx)~ZlKwE zLXcu>JA#RRAH;FEq&rcJUD}c7b}5#_cA+p$_rxB9^lFh46E!2H06r#v8JkfsobPyq zkf)gU4R5-xjB(ybQAELR*#PG$0B-^cw{xJxj^zmGZaN$q9kq@b21j5<8wXP17&mCi zPe=^#8D({W3*gz?wVrZai2>-gVQ{C{u(D1PS=m`}BQBBY++KyoIQ8bS; zYA+W*(RS`rlPlK|w?J;eE(Fxtu#?NIQ>9h}IJtC7SslVCBu z=DYBKk;mW>xIFS0JVcntK3bKQ`Oz+-Okxj``2i*~H+L9uiCBCxvOu}m@!T4YX4!{r z;yHkHWp4brcmwgeHJE`GP`@M;@Jf{@@(+crN> zw`}x077kKga0LrH=ZKAak%(RD9L4UpVnlJqCUr8b(etnn1YkHUWSVW*!0w{sE?}wT zLlhD43_^2r>4r0_{ zd8u|5N-~-Srk%m0MHx}D537niO(IrvEp}JWP+w0seCvHkPQbq|>}}aM)YmsW2!}g= z@kE8A^U&cXK>R$YBErurMNmezo`@tWFZ{h$4D*$SztUNz$x~)Y)D$67Mo^VGQqjlS zJV~iNcd!&aa}1i?J-)imULiZEJ&J{G&$PvJVLSFCyb^P-Dw6B3#W`*SBRa8>hvRZb z&d=s(?70kFG3>x}MgNfXB0A6d3d#D!)#NK8Rm$0mkG|o%a7r-3?W@$6CJs#Qfl?y- zZjj#L0fB?bmJ0~4J2>6M>qwW*d;_z?4afJ*-Ux1ao_shNV&LC-*4SYvJ zI)`Vy6Cis@0s%y?5lt|oa6ycd_cXcPz&yp)YI3~+y&|U_ZaAlbr|c4$qG7GwrOq_s zx#!fsgnn&BO(Li(3YyD3Qx&br4ir`kx^6NB=_%HYX4Fu0QDe0Rp%%pgN#sI|!q*~F*jR(z7VHTsXRZ9;QqcN(XISPSIvK+5!?6C#CtyY#_1XrZdXaqZkDd8&c zgk?i0dJH+%6q0aTp2TAo&}zx?+#9I{q2CsuriLjO1QUdj02eIdUL;nu0c>2nxymf& z6m^q}|3QaKjJ7L}l)$+Qjk;|FqA}-)TZ|=giqXTTEA!k#OL=+Qed(uwgSaRaFB+K%WIF>BSvSQ0tEIDyD+^tqimMwM5-IA9Cu(E*@mV~fR zU=VwfVF?2X0|XFDfMMSW+j|X67#Q9R1ejru-}h{F@2&1uD`DpS{`qx2@ljQsI(2G0 zb?Vfqx~o^}N3T}Z*R5>CCKz5ab@g?1c*k({s`~nd#s=((`4KK>le1Nl2coU;VmHJe z|MFC2XPOI?<+6fX_SDhq=m}UeHkm!p?b7isHMC!OMvAPc?Bo|PMd~KF!X<`bvbCwE zW8M_udsRU_*bgUI}J>PmY4NQclx`)sP-!-FaF$`(45#tojbqndtaP(NYvSAgry5#Fox3Ugz z`>jD#Q$s!cWuq5z$hQ>}7sg?Ho|m;uvF70zSU-J(SsoT}UARmESxB#!sgA~-%Hjh& z@?>xh*e%;UA|%DB`g*4R&+>q~r8`C=cn7c~Wc0jBI| zHU|*VGjK$5SjIOz1aN7F#EjZvmoY*1)1hXkApj4=!7LwRulJ(%tU<{*6`D9?ET=Q^>@vBhz(r%(bt6SCFPg(x{2*>ZsyDE&G4O}` zWZPzA7$ygNnT`(fy7VrQl>_>6gQp*!Rqhg(o&NIBNAJnAb-|&UIoryc)x6N)v4G6b zVRKWAUILESkky6a>YHkp>|P>k4PJDB-2@wG_@mPiGOakWuGyZd4>o6dy9n~ro}Rw9hxiF2-M*8 zAjyWYp?w>~H4_E`KIw$cN)w92T=0NM;e8m9R+qC5*hyNrfWg;SVzQp zRJIY$a8saTAd;@7UQHn!)#IkZS*BK&QXD9cS8B__2W!^Lxq9}0)VEqmPX2Ap(4(-SA)oh*G?I>05Y=FylveQ|_0`J=zX1Bv3E4zcR+oa=} zEJ=|2;iu}z%M9m9>(s_g0~Z(I%?*|=aH>yCF1tWHUMQ7bijk92bO*nCWgY3tk}h;( zjr4M}dpR7NJ0odqtjTT$LzgJR`1CJ}M%unWvbk#r^i~?ql?HoZ-a6da*jTrk-tJwE zMIP^{kWCxXtD&iBRRf$o`BseoCi%dg!M*#2@Dka`eq8MvJ8t*r0y zn#$QhaWWuoO&wN!mzF?^ zi752?(8>mS36geUgv1xC!;~r_vH52T!AWC5B&X{Um6~KoVKaVs^UK2#%Rf$zO?JYh z=gCgr=0ekUd5J$%Sz$#zACfXq0_b=Ky90T)$@~ULw9A|YM&K7ft0VkvRgUXt5@Zv> zhGQA`yS1jf$r!nt53SUCtdlmhX)H5qX#$Bs1Lg3yVW9i_CJ&z4JCA8DmZ@mQOXY@y4ug9i@F1*O=qqyrt>pk{e zi(oCqW?9}I(UFN~C-p-u@Z!O~&2yBd|2k zr;}(k(bj4505@{ChrJXDq};qjo-2$J&rKcEfhYL`~a#qL+b1CDRn&c)zFA%A#n9z zB~D6ct-?)&)pcv?^aDdHaj~qvekH!I1I>HY>V{Qy4RBb)_lH&hePyG5?;|9t$fU(j zF!CNYV&n?0bvwD~+;K_g(I;=Mk`wL?Xa?pP2aP~ z%OZo>yKt40;^YpNI&IGF>6>6kAGSoSR=(C$No-zH0cQgHy&+li*?2y+=}L$ zB4j7xI&LgWwi%qXj=>I@?Q0hujFbYLPtxMSQnqwLVTB@XZ8xiq#2XHCbmhcD^12%* z6V6?UEHK75Jme#HA}maOvTZF1LGVKImNmnmcZ@91*f5s}`eS9z)ZhhefeS ziNp&HYT5;t-|m_M0A$)9<7xrEjY}u&B(`ar)k*>45lb5G$AUvX$O4$xbgan`Bzlqo@bQ8H^C*;Yy>n!-M?YFuHSXZl}6l-P&2| z0}6urH4^l-h>O6`#p4zYMN_YZ_hhss3btsy!M?UDpSg~Vi`2tvI&zH=9B`D`5K9+R z0)5&TsvUofhf5Z9nl^U`;-#Ko9SWb(xmjI0`)%rAD1^+lICY_m*!G2G?56^a(OkGm zL6V_Q!^f<(G{xnL5A_LEbst{fB6|VuJ<&ZUtfu6(qH7zkQ4|fG15a7d8x|BwkYgk* zQo#e@5uxWSmplbXXgEnx(U>c(NZal}$yAp;_gWEFA$l4EQcd3XBeGBdS-(`{mL3yQ z0;&3@obdh&Bbg>B9%3UsC*m;Tq>CQJ@isyCsbRymS;PXjX}teQGtqOo#2y*DDtq|ly+Uqj%^*=aFVmNV@uoC z>*K9k+gi5m>{`C5V_VDCjvLx`#5=mXceZsesA!wwg>gAe3t3OKXzw^hj<6#WbRf-U zWYf6qf{WNQ%pgKHT+B>|kpX$8(@I_(gXGe8kFa14RIy0Q!bY4{LnJF6FYS>f6Xo;G zX}+1`T=C@MqHAzl_f4nu?Nia|OiLHV$mibh2brH(jMPFh^5dnbG5M)7J)P0!sK^y^ zpY!9B6!>A7otqa(*tW^+gVlU&B;wP;g1rYXhuc1bBS-_zj+Wg-hQCi>8%b0yo2hBt zimx&5?&{dMX=80j?Ao>s;aChA?7i>}SEK}QNv^MT zyD*+4Qyt?3i!{kE+sIKL!L>2$ZA3SnskzHt_+V`oCoNcQAm;l_2(Uz$S_*LgT!Etb zHm&G*+~eXC&RbUcC@npR7k$ix7iTjfhJ|xkjT*B^zV{tbsy%Jl*`DR~{LloiA_?%_ zxq^xUl8CYtv9Ra+ys9jR)IUmNmqJ`mwhLfTbH&P&3TY;+a+gdrr(pXtEhNx+E{7~R znBRkGISeNSUKNCHatFi&k_TrJbhc~TPEsuCA}1S<uc_o1Zd z>?OB7dX7$Kb(l|aK-LY2Ry8op1|orUUv*Pv^%te7VOL}V$rSPC(C;#_aFA^T1SlU% zhR(dYfxZK)2dNdRl=8qM-2e|h@~Q;G5HU{2sH!z!w9$Yt#@NHP;fUrVNP)akCPbuSt zJRDZAVp3W?KD`aQFs{ntmIXfo(1>ebYZ@By7Tbz7_%wIZD*c4WYW&p%baIU5E4HiX zf<_bESLz_DAgNX~xeo={9o3DQq10irvGFrBs)Wmj28egqmF<=aE#YXaQ1`NnT*w2W z@=W5vwmdYIOyE@0da?LdLbaC;ZBqp$*thD0cpXT0I>opX>M!OpB-1id)>x01S;C`4 zJ$<=PX=jEL=!2}5Ty9Gc^b&kI6(gRtXHoo_Kv@r9>RVE=)CQv$P_0^B}1DvVU-sSg3m7oqJ9WXQeXn1Z{NX|Ok{Y9jEiBgF^H#fUl+6_JIdkWchP@%D`6VhkP*xVJmIX%i!AI#E7~Nk%hoR-k}z@^2qLVklPTl*|Z8rk>4Cg0r2`J)rNdT zr!|@Iy>hHj^w1~m8z8PBQ6Mt1h+_)~oV)q_5_2@a0K-S$v86$a%Tu(rTP9JPfG>@? z9&3Bw7+$%;D8RhH2Wm0qurGnkMILf*Kt`Ui^bI?w%VA>C)0cXsgl9j!n~mqNf)VQ` zpIU7K&t*(+^bkv)M3!%etfP06)xrlCCNcG4Wua>FIELDV8{2uY3EI#HJM>=9)MMW> zSr9qvj-AjL(Z?96_=i^-9nUQ1!~)EX8THw*i~EadOG6*akq=d3gxNA&&PcD#QL?=t zg$KRrHW$*PQ@Cr=btoCw?u3bTU-Z*JCvCG^vO3= zKtC)X%Q@SQ0-GD1cG_w|7R$rIj)>#CyEw#IP>LHFM^?EmMm zxhYN3(0MtG+dTdQ+0+LIkg)xZ7@-*5@Uw-Up7Q9DSA6i|1b--en(LzM13Tm+UlF?(6FLs%l&$l0E`{BChO7?w6DlE%+U~=JE^H23MrkUt zt0cDaGGgGV&&Lh)nMIm(!N7#cur3Ih@f-Fq_wvlGI%u&ZV7b6T7($oF#AvXSd5C?4 z5^eeXCKwG`#czln+6aI4iiZP9TA1Qwe6vN4w&pNi;RW`oCR>@=rmE9)6(Q{+d;6G= z_la}4494Oc&Esx*iL)bb7WzndlO;NI=)j5vq%$s#@YD^ar*9G$T_nW|fLjr;O5oA4 z_EuT`*l25t4sK7=$l`3oA7w$mT4Vtus`P_WX zr?E^@6Vb~gvQkDoJ|WWW6Hf6sX4Gns@M68j>l9Jf5%58sj5RfUT|VkY;#@eX zA~x*YGA@eGGIOpe?8D=R!JQDjbwa8rEMznVaG=I|B8udl8AthwJ`Eop6m59*Sd=vB zTQZ8tI~abJ(3J>2*k)frvbd2-B-;-?!)qg_*92)AfrUSEyeC^P9xv`@4Mtb!GzGoD z<{s5HY1Uy@%9||eL?<=Y3Ih*)!uow^33ejZIe3XB97`-KEu;{U|1bACHU#|MO(D@T zgzrlP>lJy1;w&5t@)ul51CDnsqi>PGc^*xH_aapncA`y1C%#q8D>!WCe2!1GAQd{S zyxItZ{t`M;Hla{n>2~FygGpb&%ZK1Om&WJq@vkX`F17=1hznRDCT&P2D_dFM>LJ=7 znVZpPW*`X7VQSK_O9!+ico(A8$-M*9R~f{DtEX0B_b@sj&a+q{rB-h$k^+Rv+P0p{ zrO6bs%CmF|^?+P_qIQ=QHs%*-D~2w>p^G^r)7<4xJE5;gBq0?A)6UST(d=3ZQIFes z&?CUU$}~JTG>Vr>f(w<5LJkOp^|hjF)9j?l-p$)N^L@iKBg+MDhO>B6-#)r2Zaq6} z8yVgNu%k4*6qaF@mhal~B59%cf@9PM}0l>*;J&TO0n6ShYys#JuBsckogk zNVmd)O1`JwO~(oeC{UrRuH{|kP8I)JdjW5y7N7Zq|Kq*ua3L9x%)7T{hP2!_z$yVS!U*JBBd4+Xy41~oah+MzLY%!Dr^SwD-j^If)?R*FE z>^7W6C^rpIbP-w4WWI#-0aDLWuxo--{3%CIW>cqanXM_%!qk0OFL<(aQ0b0MPquG4 zNI26KZhb)0=p@rYuo;A?DZsVJ9?691s-gx$&R~3#tlSNeLXHfYBx!=B40{p`ghUqs z5}}7Jk#C zOzqr&zyYd!DuAk`0X$50Q-xJI-FLmDjh| zTuTLG2{NdEaDX1D6Jb#@n$S5kx@uhBDK@n95Igb1Hx_gcNQX_Dx5RjgwVN6m;{f~Y z%bnVIkh~MK^o#;6Z#2@@#%ZXb;rUDI5M8QZ({4!zBoPw1#vOu2zm6PtNIxL@VRJio zuB?_dD&a^o!UMlUbOWnarFF39C+j`=lv7t?7sh)X-Wc;bgoYz+AE)0nHn_%W7r5~e z9T#2dj#gz%izuQaOj}`43A~ETG}yth;FHJ(qfwv%xe47S$Tr7jjyM*b#CqG z?C60ih4m{5&k{VuZ3o%QS+bKyT_+p2w^A!66Y;<8KWjUX4efe7N7^a&4UMV>mC^`3CZ@P;!5Q!`yxl26(g^~9B%KjC!%b~0HnC2{qchbd)n%eau#z7s6 znZABYkDrV0M{5diN#MOpXooaNOsC*3Yn3dtlfy2^Q-xuIAo~c)C)cis(kv^HeWD8u zhr>wLrip83w!!*mTX1)Cj_*R#hB7;VvBfG1goVC2i~ZoCczqq7(^<9BwT$cs&EzKQ zjZ80`ipeAT;d)^oLGuUlT*tdj{Fc7pwQ3Vi&dkn7&ftyKMd%fk)=S9B4hZyw=i^Ko z6r$nj!bih+D#!e__yi5f*g5CY^xUqz)5H5QuemGlSR9wM{Rw))Z7=!um#W>Mf;!-= zf=$NU$?hyvmIs{b&|+p&f|m@6i{KuL*U$nPSppMXw!Y?JeLFzolO5(zq&z!USdWA9 z!|`Q(>sXYKeujdU5mGHa|Et$KFxf)(1WXPn&tSq?A*hm3GXzrAISL0a%j87^jJ85l zhIEi6h8%d@a-j z6?n`Gckvrm;Tt4tR?r1sydbioaRnT`@$@x6J%Wd28}LXZzJ!YhNLJyo$TchLa4Qm5 zH1Jsy+`@o#TMfs{I^65WwP3tava$(x`|*S=y(w9buk5YBoBnt~j4ynw!S!K$To+#B z5Q})_7O(%{?OL!%&;Q_)C?JH(9f*qIm%OTlK&-ejklJ5~XuHj~*|AQ@@-h8#tZ;p3L_yUP9UM(>BdV#S~4Zm05M6bZfnhwra{Ofjx zlM2T>ujcT?H3FMoD&>qTocLrrr^ntU@yQ=6oqGhvjZcMft>1)(W6F1Yt+vPA*GPGv z5V}Q$;}2>%4+)%97<*XbCk0MCzLE2fD_`ShZ{lz=C;S!Pp?Ljm9N(BcqOZ1D;w6izBE zDvW(t%U9T}FsX1t>5gl7Qeo^PlCN3exWY+=MT5qd_IFZYvyS5l9Vg?T*YP$_#!swW z=hu+Tr-_vkpHw)0i{f9Z<4xy5^MuytULEhZ37z6P!A}kfEdHm)zeVwjLZ?~BckyJM zKOdF!;=2SU6*k|ke9qB)Kh<ro=Zjp8s~n!}QF(i<%G)QE|3<-YzC_@}kCom}1je4~;_~BfR=Bj8 z!?BkNoLDaNc!tErY8BqE^g8apgku(H{31o1so^;amnwW%;ZB8f70y!lq{6clo}_T6 z5<1P|HDgA@-+yeFOCJ8gV;u7^e)Pvq{0J75;Cc$+7w3OtvEvk;sBr&`asI1L!;2Lz zQP`mHLS^^^v&S!=iIOkS_(clWDtwW`hqZxPH2fNcN425aG`twJ=r>zHOjfH{Y_*1W zo-Ti!qG9dD*y4vi{Mvun6^nIhIZHY&;i`2g-u)7cb!d5iukq(7JWt_Yj?Lr0jvbST z9<(2^#Qy*;K3U?WRb#P?(tApxW4CI{wQd%UsFWzJ4tFAi`}N} z7HgiStox&#bd($Vo2`G%Abt-mJ+kw%osT}ekqzGO$eq#O>?6l{zayu3zyA?FT8xd@?XzaixP8{~ zmmGKJ%u^PhJmdDcs5|{X57F}h7vTTr;cxnXA^u)CYxZr60MF6?FGPF-e{aD5yXMTl zS7=t^K8n-v}t4?q0jpG?xRO*?rFaBvZbq! zjLaU{{OZ}Quiki841)BGg$qx9_^#PUVwl3?7cY#>c*EJT)iY--JQb4nwwgF5LGx`Z z&zKQg_}Up~&5kv{eun%#W5#VWX3o5A#@thHTaysMa9hpkEtk%}?NANnX}#@3b7#)D z?ce9kn{o6{GiJ}cV>WUeTYvS@8Fe#b^PBH)j@>n5&dj@J%!Gp(u#F!-d|#FHN4)e&FYME+7Ji^h_+euX zc)sj92{$YMtCfFi-_LvP{mVD+WK7dv-~E_`O^@CCDhbb4dLQx9KmSHaw{`Y+9=&s( zlJv7Q{|`0`e=9WnR}X*NI|SdhLeh=@2mVpQHV?n!@w>~T|D;E+ z*GvD(dxW0N@9%rz2fgx^yg~3yA1r$Gf9B5o@>^giRY|8G40zv`u*w4X&Dy?Z?TS9{?n zy!;P(>Hp}3ANRta^}?-Qdo1<%`I?9SeXl(lz4raJ*FR^xSL$oy>nSh)E#7#zY=_LB zD|G(!c=UTdD)el>dyz-KZHwezsrip}N_drqPwa@!&wHy4ksz4Xr-l$f03r2^(IL-`L_4V5n^v87_ z^}}DQlKyKiJ$7hndOm$W{NZyYzv(eQ^1=^!?eQD0zuxBcXWna%xYvFQXGnS0-&wD} zPv0%+q&v{Bcwct}#=j@&7XP4E-u}->|CoMu>UP05ed9iFer)#oziFG`+k8lP{5D)B z>88)jULfH(a~X?$-5alu=y>eZ^e=hsb>Zof-}KL4$0cm`qSF^e!}$#oUas^W|97dc z*5%%%y%t^2Wr&(!oUuMqkskM_Px(oJ9a#ym+k{qe``5^m7^fBmcA zn|85|h{!_xn@3~&M$qRpBezg2+u9C3H@3pffZ1eBhDil2R z{Qf?~=#Sqm{bT!|iJ3AkT)MZuTD-x9x<2{ql%>b!Dm{hqmqpj>nGR9@IHc|2_M=|< z$P1*t{_+dSD1y(oK##U^@wkh@pHqEPJS~bOxz_F)MUM+ zPc9HR@r@PtQu^e}Hxr0idhrTLf8+jZH&J|i_SFPpM!)#Dw9lJ=w)T38AAhlFIuwe< z>a@QXR_OO+qCB6?cSQM2E)l#vHK)Fo=r;c(nqJiO4_)&3)094L=~qg=@n?k33vavN zeoBvxY-eEgjJHYp3p<{;j}pf3mKD zn*L%*pZTWeG2!CeDF4Z&lKz34_HhG_8+~n`@vYL27yjE3UHrhY&xRgKZ%wIfC>63%ec`&Z&x1RsHgOuLv zrBD1t=+9n#9FNcB-OYp+iyx8sAHSo#97w8ssF<$vG=8S=xA6rJ$RB^v@oDq;4-$Re zpTGPMRBrNS?O#nVzEsltpMS0_y^FPfwBL&gV=tF>ocMr_i;a>mcD5F~>*~9i{x72K zGpXrofBNOqDScv9wEZVe7P=ihr|+lq$tRi#xc(V`M#_8FcV~Zq;)@?>Cg9SO=SlgW z{_MQ#D8Bi7TK*=9FYXZd!n3!1meOth7)&Z&vRm-Bz5Jh_oC>d~cn`hq>u(^u=J(2Y zolxlL^$5N9fAzSROi54i_CLLcRV(Amprf}_=zZ$qr=OaVp5p!f$R9pc7H_lA89!0l zz3tYooIrT-SIM{;e}#@8#Y<)d|MfqA_{D@bsdz;Xub30OU)_H;F9gl67CMvndi2Hw z?~5Z1tco?iR?_45NAZe7f_G%kpWaR7jw@cXkEi^t|A%jI|Hic3X0P0$mb!bW7Um$o-KDqmKgg5?1t;ZWYycY@HM{d~mb;f&> zq!&HB;;`U7_|lK_dR$bz*xyCz6_wuT?zi7h^pbzC<$8F@BSP=KrjuDEom9ML53i_r zC!P7D&k?=&o3%U-FF7vs{^POqYq(s+8~5;viuZ>tr~C`yO(@=khnKuf=uPzg;hlsR zn~-uRJ-njg{afp$KP0qf#VdMv$=ikAFW=M2TZVDPi)sHQZ9Ly4cz1T@4-mcB+qAxK zRj7DH#rx-%oyl9Mq~eV$Ua?*1#4i^3#*S~kl*rk6}+b# z|M9=5+zFlklivJK?i0Lc*64wYrcWqc$DiU|cl!HzoX3=2(x<2M|Mqi+j-zs$6>q}F zQ@L};TYfk|cyXQo6W;t!jtGCR{P^m-2rsF4vHQG!SGV;*EQFMaBE&JO0G-eNyozJ-lRI=)L6P?T3h7(fE6%$DiWedGS)&TE0fon?1Z_ zLFldf={3ASH7j1y!z(J@`(OJ;-s+7j-nfUC92I(R{`U93NBm7H-lT_DRJ`~rx=tg! zn9A9hCufrfgx)O|_RJ@=`0Jz|lOA4C@m}}9opHiTDqhjUOCA(@Kl<&@*u)gqc|WQ6 zZu}h*yz9So(xXJLS@DVU z%aguFcyV1XCOo{N;{Cqm!BYq?sdz;nPuHJoF8JwvoE(*t{waK_rAe+Dz_(1&f7Y0mC*aup5L$u z#pJd@XYYAXlU4LkAHSMDT7q9i-}LdT$wME%np`ZwuOjDt{A87NwFJM) z`sL$STNe$#sB%47MQ`)*tLbk(ezJ;uarlZ?tRe>uKdE|svC6trf?s7HQi5Mae*5^z zD*F;2zuNw!1i#8Y#mBF7`+xlB&U*Yg|K33CUH8Rd{Mes_u8*HQD*1kR@w*<5;QzS-{@sG#^&dAKAI5L~ zV+DMz$7k-ii4ApDe%!~`_9<==d)^2C?W^A<`o+i9&Z;o>F%91@d^F!F_&2`rSj0XV z|1Y(FE3|Tpns4GlvDYsyq?*F@Fg%0t`C=DMzDmj)pDpEm=+7^R*5~h}KVk}-6^fte zx7ns2+q;<$RmczZFAqKajn3XKiEqBQnRqDsn=y0N>^XDi#T3pzZo%`8KjFla3@$wR zlv7VT{fsjWo^|#)=bm@|1s58e5AWoeGiS^gA8&4s#}_Vqw&D1qi!Q!o@uf=)*3>S& z?DA!a#kaF(D?SD@$W;=E&dpB5B6t(b?`oa_Bd4pHK`Qux1qI* z53PNC=$CKx_95!er~&kIO4zTrANK3-hf#Z~{tVO|Jvn=J96vP0LbL-lM02%tzutb> zufHGm`K=cATS2&=F@ty~Ua1~b6RE|*g;WQs6V-=m z{MG7PEuH#~epGk*Q9IC2+F|~D>Pz}j8_@Nvm1A1?BnpTHLWp(C=?QT&@28cr6K6 zXxB))pimB%f#LG$Zy80=aa3tMQ5#jFYw=iG&>_c;Re~}qqvJ9%K6y5mAJ0@i(?z{1 zK`mbT8+d-WTKU!5$Ljf9VL)I03b%jhd@gMVDi_t_{+$k_wSGPj4Vs(`w*&o6eLz2v z69&h}eSD)+36|>@;#1i;MrBM@UbXfyI+Y-mHPug~jJ2!5KyH@Iw~`2&GqYyJV$Tf* z^^=~D@)PhuZA3q6FZxNpjE~QrJ!j6`x%1{dSLpbj?l_9p^H`MssQieI-}3St9wo|mdNM_K_@)@0qPz!YJE5*|MVZMb<^>Qn=lSj|! zYBjlxss5o>ovNKnhHFWLj$7-0>EB~AE?BN`@h+_WVEq-Y7yT`x_*twUM$e#)2MxRa z)<0Z7aoGAlIxoWWqZ&W6ln&@}Jzcm$y!DIqlZ+-APrlx7g`G%uB+i;5r(XU$B ziV*#drYBj$e;Ab5IdjTG8Yh$s`i9asD6{RDw|+$B2Gzmlmq_to99g}M&UE^!9FDbH zX}3%}M*3~q^C;ZUe*L5JlX#=Pq@V20OZzp3u|Pi>4h$=XW!$*_)sC@su<|&TmiOna zjV~Jqup%)ZCLbz?dHlF>Vg37D`LKCP!;BcH6t;24OoslE{;%Hd#%GyP;q`yGe`i83 zm%?nmI;inBj)@QYTlfk0yY#%ZxA8&kMSnYbCKtT&Tz_kwb^6Y>{t5Rx^)&UfLHaw) zAMqxmQN|(tjVK;T4)Sh<)(MIaK`-9qLZy05m#?6|qjDzH#Z&$XJ|pdJ{FLeEN>SWv z!Fnz8tfb$)ezATF+E@M}e(0xd8)@(I>$f+){Bpdo8xPuVwho5doBpOTKtCD-;q^P< zSNODXgpl;N*UuH>6>qxrti)#}`Zm67d{mnMQp>688SR&HgMct7{<%P*UVh%wSPaki z(ta5qr(Qr^XFXTw_zuQNv>sLB!~E0V#0UMTU+G76FzDAuHI zyt2L^B}l!gP3RZyNBWzGEstDDp>R0f@g0oUXgijT59vu@g7_m|o=d%j>v){%NewV9 zi1HXO1YJF}QMl2y-Tn6V+lkslv<7Nts!bUv(P)4AslI~0xLkt>P%8Z@m0xKb8y(K9 zv!zep|!icmw#Y>p#K)-73VC^lVAs8RDM*S^6E0_D_x&8wpq4gp<9zyfajT10z z^Tf)hcA~$zz3@-CALwry3-k;3gUvsp<;ImZhJ`DR3mp*U+O_OFQ^vx45kJg7@vi;p z!djVVd}urO~Wr&VIshUv~`a0iHN;ItU0Fi$Aem_@g522_1 zipCc@0*Mm}3rFSu4cCKc86Q-4`dPW<+udT(-r;%X`T^~&#g??c#tZ*aZn*q#{poMv zCg6wqf_SS$*W!sL6{SGs@J#M6DwXKa&&C(E2mM{CU95eKzsUS@{fqJ<^|O91ji-7| zRX^dbGJnDk`dQ1PF#S1ouPZVDwGaI$A3>{^wYT+f6{zzrW>Du_tSY23=||<$&oAG` zU%7UmK9by451U^zbe_$y`c;Hd>P(q8)NVo3OzSTxzm)$f?d2!Wh|ZHxyD1l%A!tvH z50_7WYkeZ^IMw*7MAza$l1nnu(eXY*&krh(PvR;3BmO9Cd}^9EUqbyBt!L1W8Xq1n zQ`NKF_@Q}jDP}|LL&u@7gom9yEuiH-C)Evxm)(ir>}5Jn_4l`@)m> z-cvls*C%4*3Y!%sEj}yhmOrNXZ@>FyzJJ}kSJU?iOlo*i;lyAxe{!yr|F0Juxt-d4 zVo1^_h6PS)IIiKChGX+*95-{ptmn->e$EMVPn>ts!n003`;>D|J@>TpPCx&Q3(mYS zUbCq7qNNvKcFE<7mtC4zvK*fhSktg}#TAWLu3Xo2)vEQe`3q+pck;{yr_6fZsk4ti zZO#d&&pq*sc_*EDR=noyMYZQ#wDjDIFFWs&%gV+#+q1>*+_`Dnwe8!l+m+mNeQNNAUX*_p7&sdooC6ll1rO(eiSxn51z-dG*R5Vu zTfgR_r44H@zHG%6mt5X><>F;4*Ik-ux@yUC<{zvQg+;YQJeT&Lx)Jj(sQXQQLv5YJKk+CW)UOd98rBLIE3Obe8m|;i zR<09XnywOVjQ_gT&6|xvONY_eaJ5ls-C}e$ZZ%46okUAYN3ZOn7N}oCHKSH&SWC5| zmRNBGaZIhzcqMU7EwXZ5Tj$Q3sa1@Bq7ZO!&Gi8fJ8lTL=)N)Fqvs~#gz8RtlY2%E zS^25K{fCW%-o5!-jED5T!mY+d-_Ym_h>vjj$vt5XQiEY0diRF8NbfT~g3?K(N&TsO z3P~Ff2NaTaARZ_rZP7PGf6I?JvA?k%V?+fZ;v@(WCl-p$n19^Dlg~OkzNn_Qu735J znX?u=@03%|IrpNAmtNMeV(k^P=Nx~+X{Voe{w0eqU)H$t%5`(+op{n2XI^mOrArda zn^s-59{ITokyV;;aONx?%#@jj>E3;_=kUO$?9{2fL&J0D@gN5Qt$%9I;K(87slI{7 zKyP~QK52zxD;jw$;KP-}(h|p3Hu0F~AIRpc9t5ccLX}1gTHzd5RYpZioOeF|CI1lr zRDG^}bIazAu3guo2Gj(Ls0G$+XuW#NH8#+)HC(xFW82j|J8!xfEigKE z%i>ED%U4MGXnkt@W-cC7n1iz~y115Gkr@CT=HZ-67BA(NWEOfO*-*IDDv}MwOKd0` zGZ1P9_owjVg8GN>lKeDO)(6;TzuD#CZ=~;zoUkd&)0JsB~59@-xr~!rnb%Jox zBHgf$M(+p)19e2xs@23e`aYT3GqOK_=rB)JFabATu#ORMeQz3HYa6@u1usE?-MB1jh%J~x-58C% zX*A!y5e&#%$v?f;%4^x$xovyT&TFr`9^d#H7#gPXXHx}^XOCZYZ>Bn2Laba)wP>Vj zTnQGMTTqY99jHjxHK@t1>rs^?b(*3O&l`z_t;9nQaefmq(#J0GsPCRZRCr`R*gkX^ zTpT+FHbO1?Z2x4FhwvZbJ;Zm2A!Y`3NT!Yh|9b|(|H%GD=m(PB#CC{fYPcax=EA5- zQ)Z0a_QCqGV;#))&ClO`>{x1eYNkW2YlyN!#c3MX)bjYph~f@7fopNPc$jk^Eau8A z<0f9o-9Yja{8B$$y@fggqJnQAlwxwd+PFVDxpq6{=EJ2+s4)`DscV{6F^6+_1fFI^ zM`%UJa5IwZK;Gl19rt4Kqn6>Jw^hsG;n$bpb{ys*=!72)mX%GIc=)wclpd7o{gh9O zrKZB)XPqtabEN@KlomWgn(zW?nM5OeWsc*XZ`P7U+)F!;jkfgJ&m9~C9i9yJ^EDy-B12!c2k_i+>YmjL}Wtj2j zAII{GenVOL)G*6BVAO z@EnCT3NKPviT(|m-m7qr!mPqkg|{fYUEwPf9#vS0{@YG&=A?%dzE9z!3O}mwQwl$? z@LLMMqHyxJ-ApHbf!HB#dF7M*j?nnWqW1tNHJns9;idb0{_)fDDTJ#(Bk=tS7d#>1 zjKZwKk0@OHSxMio@FNO+`lBzA{`!!@pDVoUsP^OC0+HB>sLc?9(r{X}jn< zmiC^d#oN2Z2L1g1Ux!cAFGc;U!t5-uC%tsGzzgOH{9p40{!ZhcQJ9~j=?YiOm9W+8 z`%5Hj@Z=f^uTnTvE8)LWxKr_8r0Jhf_zQ(ag+~8}ZIa*M;~f%yqFvyGh7DT!%eN?A zr@-dz0^`>RH2M#|NnR#??*jrYZ17i_{>{IabPNAU<8M@G_=acnTYF`kU8C@7g}W5K zO5r=au;Ck?LBlipv%etsRo|oVhA&EZ&X)wfSK*Ti=X_b>I~Crg@Tspz{IahKH2Ot- zU-j27yjG(0ecAZ9gyR~nvv+G1b}5|rmf%%-&vxAK6mHH5ewV&?+NI&5rjIE6wZd3l z`TDj%`;Le4KdJAl7ZpCD^d3?A|D@r#zH4jmsn=<^Sz*%X+xJqmfS-O!`uBGV=X_ei zXDGZ(;k}=cc!R4d#9Mkw)AI`BH;Y_OHp;!?{L4D(hy}YxY_R#Lyz6LTgOe{VA0OBF z2`}B+ulrHCpZxX@3bb$~_+iESzQUhZ$Tw5zo~O{K*QD`h{%jkwVsQ4qM8jumIN`-# z?S=a_e9(*kvll-1sVMyyw97lGuT=P=%@TgE7q<8(y!c;w;lFs{E0x~03I`M#y@%f^ z_ujv$@ahL8Tn%3MF2PGFyi4Ji6n6QaE_Fgx_+Gz)vas zSA{2@EAhL}6ZpaN1zd@3jS|`llp$}*Az~^LikVWyTkUry}ff* z+$?g~-Z`rTWBMLi3H)#3+sIt`64~FqM&Yj%Za*sV?^Afv-4f0z{Hns`_elJ`3V)?= z`%5*y!joR6`4v84;g@UtvxFxr{=iML|E&hEevWu|X+DFGYxpUJ3vZV4KkdP*y|ATc zHU1R}-|OL7zZm?}KMVcB7p4bq|Dxbc7e4+a!8iEwFH6|qr@tcMFDQJ;w2S`B|$p`}~B4BmN#=mk$*De!mGgqd}MKVA3*#eYiSpA?>VmC#w+Ch+<#QP`yE z4>wEvhgzffLmd)6qR{eN{d{N+EEW$7WaJ0CkROgju-zzxA$F%ALc&274Z8>nTZ9X1 zL=cvUP?#gaVTy=^5fKdwjexsY>?9B2L@xp+?g$3i?!yuMxJ)QQUYiLb^!XVVVRki( zaE3OG2rO?B5i-SbMA$Y*5ik}rInDXJ%nXvr&9R)xA*@k0EuQ(RvXF|XKWbkXMH&hB+yg}2) zDt>oFze8f_mz9ZNT8=|<0>#rt}s#T%YMi#NIk z{rnbhFg(})JN~Xa_`c)sADut5<;S0#_p|Su^|O)G=$_*S21oad^(NA};pMHlZ2#cE zhOyD1Ony1yb0dXi`OJY#zJTzaRC?d?zFa!JCzIZ{U^v$|-JHiAs7v6#Wes%=O?9j4 z8|xYySJkgx*3jF~unLDZjVsrzxvXz6KYIAM1-)Z~Lw(0BV}KGe>oSKj76}GN2Eo|6 zfwV@owr}6vwykBu*0zo7>O*m@o3^&JcdrY_baj=+?b=lmw{>GAs(pLQj@HfVQp0^s zjY_S3`}Xd2Lxb6|LoTAFb7NEEx&y|+fplRV+D?-ZN}ve`3xm1rx^R_KnN_L&zW!DH zbqy=(`!ktLQ&Ur2eSK4=VO5AyVsvmgvyNJBS>38-^^HAsjcXfMt*u{uLx?_FYOsGW z)3+!O~1DS-uu1yCpG+A zFWxV=T6n4UbJuNRFENl9YXSJ3oV7oz1?!k=#Z!=pm)>k5yJ zO^^O*2L`Z2A6H_y(o>RgeChJEi=!3U5?6-SY0Ofd52=_)2vD zSOLH7F5&N9g_ZI@+xRD{(EDSB^rc>ZUh9Q@K5qS%*qvv8L!gD9EnGa!{OhNQXXW2K zU3|rRgTfCf{H~Y(4_?^HIrW==Tm6lW!4)38>oi>O;tl^*8vlU`>4x{+D(Qx2@b`+p zSo_)H4Vo%2d5VnVqQd4=B|NDxewu_Q6vj@M@VLU*8Jb^V^O+KkpQZT}j-M^z$e^BEs z|K~Mq=`p2ed>EcVi#Hfo{AO>Qy;8%*pTXZeB6gnRbyUCQa}qvT!@u*s=li+uN&4xU ze#-+Ao~PlDeoVqAY50;)NqC`#XMRM&Cu(@17yd`D{P(<8@aHQ23164+sTyAN`e^#Q z9+mJ3ntp*tztQ98MXwh8*^0mG-4cGDhQHv|=X+lG=U#Y;$InKuytB1FbCmuwUi&Zb zzW@7auRYH2(&Juxq&@z#UU>f7rGEVJEb#DqkN=B2`X_t%%e?yac=c;|Q0Onv`t^C~ z7kKr**bCQq;g0)-9z7UFzb#()Q?Hct8Im09^wPI`;cL8bw-?^&g|G9%*L&d`z3|Om z_z91{-Clai3%7V-zkX>iJ>!K3yl}f0{;bE(pqKs`FMXevKJ0~aUUcf zE_kt@3Y;#UZ#TAbjIPl!X#80EgjcT7bNF7m<*Sw+I~=XYbn&b4=jdp=`r%6aO=vs& z_|{$%KaulogT<}le_>&>FB>$wvH5wJzr}R%C)Eya`OI!@(CAp$FUK$6@Qpu%mE!&U z)%YmFOBBOZVH!%ANSMoUb&`iH;jTY;-K%?|-A`1j*m{ zhpmUUZq8DArstUcVS1J6Z}Sz;^aESRO&>Bn(ex|R<4oT(JOQE>~EmuwG$F; z>lHRDv|YR0R*1#KyF3;XuijX!P4PA<6mQK~OsqDsn0)Oe7L(IU=v|5@R{K~?yzOE! z@g9uDWY-kauc*h=`#Khr*%6D$?1;rg+Qwp{wZ&qxTEt@4Dg9jvuUB}3LjIT~{=P}W zH!FO;!rcm!3R4Pu6{Z#TDakHSHPdll|eIHYh`VOC*I;fTWh3iApJ3P%-= zDLkO?pu$564=cPy;jIc^pzwtXU!?Ge!f}PSDZE|b9SZMMc$dN#D}0HO{&CWU{m@XZP* z6uw2_TNS=d;oB9yL*Y9WzDwbQ3LjGVu)=>(_-=*oQTSek?^F1Q!uKouM};3y_(6q_ zDtt`ghZO#k!VfF_h{BI5d|ctj6n7 zDG9~dGdbqTD+K;w$9xVCW=AvmY-(tEs&_E4Avc!oD{Rc9;Xe?Iq-@Kz71F5@FLujd zwlC2=njg##MA3T=k7Ty@N8@UiQfzHvYbIMhfvA;FX*)EM%a3OIIy0kta(#vJNISD| za~RH*5Vv?KeM(ZPzP?s+(a3mwY)cJi5*>vNL#gb(XyKf)Ba`a8HicFgEt5zXWuiBx zMpKo`>PdMG%H?cM6-pB_2TMyhm>(R?l;fyoDK&C!**>dTx@jz%uGmLiqxm3h6g{~% zk=dV!43cn5$I7GZ$PBdP2MQHZJ9<*RL0hFq#u6Rb!O_9g(BLhhHl+BGd@h|S6t<6y z!Z{=~ASewr%pBTqc+|_%mm37JDEYxccgBknv_wDJqCScY+Jm8iK}8)J$c*+Lh@v41 z&M)NHG6eshp)ysaoH^z^NW5|N&8{s&=`JommL-3d<%PqA#P)2a(2A)#+SC{jD2ur* zH`RdZXD8}n>EV&yT;JhR8m;h&N}Js-1BteLK9`q&gIZW(R|?*7Gy+PKhH?ip`O;|4fuU8J z(lVMGERDr-1`oV6M)vkCrKv3=BbjU;4TPa^BO7~?ylE(xDpOv~(!NZ3a5yzon`kK% z1_wgRj^)Q_8ZIp~KRB>ww0qBBe;J}fnf^*iBl%4K;GvGfR!F^`J*hIqg*d7}K7_G@ zR{B!r3VU*6Lw%gMGbA&tMm~Y*;B3qtEW_-8Ozlmhxl}0^{nX?u8hQsuLz3Ni;KZiJ z@`=M^LtAqL^>w=&N~!h^4pb;Emmf}zZXAT?VVUys)KcAhNdG95>9YRe(YDgE5WA^t z?1r+jyGmpGdUJ=$vui03ub4WbyjkM}_3wnAWkK4aaXZ{lSCk?Xp|0G)a&$&=2kYxf za|ro{-R07V+KyCqAXAPWCsIT19I2GNF*7ups+8C{HdKLAt^{|uu>AYLd8UBg-XfX3Y8M270RVjHP$rkggnbvYKC(0 zLE}{>%57IEbEQe6%{nDR=od~e-!D+b%O*ewX8Ouc4DIaFPVO5dC*t0r493vP(&SA% z|I4pK1xWazN?FP;M7*d>kyO5*er94rSrIf?0OOhb_WquOxfn#%p5-L{5BeS1d7`Ik;Hl~J?_+t#VL*7PcaOtHATyRhM{ z+~-gkAUn$H=UzKRhh#Q$s4~%-r6IBv1;}t}q>$K_IoMflU&@Kt@egEojzH{%mS1Cw zG5RtiqkDRCo~9c?sac8wYGDp2j6z(&v@n$E9vLb(k(r{R<2p?yjlJ;UmNL~0Bjz(B zL#cFz>6Q-ZFs36JF*cOr6}E%xaHnWXCbVHKhqtp3Hc^$saAkTs$a1(rsol}#E`q$L zQdgu$^F!?{RIxUt_iV0&M~hZw6jyqNa|be;2Jx<5#b#qkx+8-bn#rbNGu#($5VBNq zXNf%u7340f+-O>G|FbGGGn5JK-YS&Y7D0+Mmky_qvC;0K+~`ydTeH-)U~K{|6ts$0 z>b6X#54GGm(w7Pwx4dHgwj<&p^&o=n3Qlm>wGEGq9^RgZ5}JXvHQ*zXM=OS64r2aI zF<`LZ@vx{=xL^`TY7-dPQ`3{0R=~j&Mr*T#3^2Sdfk}2xC++CFQrWPj zs$7fpakF|YCiG+^v%rSEA}B3FCd5x@iiHVu6gKiy=;()Fsz7Bdi`9M)2}3G$O8Fm_ zVc~JSDOJGsyaN3)t{EFl z?_-??yT+c#u6{b4RW1Spe(Iq)O3hvi2^g8>UZILKoH~Trb8vLeRv3jUHU&@iLP%0_ zL`8I^9SHmin0rE|?+AOtsePHQe6Baso!MU@FHG~CoG7m;@St*YG$eN_kgHj$Ov4~A zXER+QQmf%lIkz3v5mYbJlN;_WjOL)oRwD|d`P7(R%{GmNw~vvg)K!UXtQCvxfPtr$ zPeH1npx+N>NnA~}A_=u^Wi>dR?1DmF2T{_|7upS!V_w$s4H=kgEArr53w=Wr3mT*p#_1Qz$yNGeSSMh%fDG2Ci?3`Iq%-`zizgwu{IkPUbH z*eDrDDylMyi}nEysedJfHCSQc6lSbk0#`!#gG3Eyk?L_CFC`#0MZyRKXNa7vRpqFK zIDoDn&Z8~Nnf#=H2TCc~O6uS%vo_f#qVj>pg1q9=UptUV}%k!K2sU(QEMN!JHc5XN5-(szWs0%irkXH+tnYdh}O% z^j3QGnml^tR1xdPO@l*_xZ4JYv&cqK`602d59 zv$?d6jbfJ+nkwOZNG#34&7~PgckLd{Pl2fdVR_~d zHl?}TzQm5PGA2C#Bw0^ZTX1Z0u-p#c;mhGKJVJ8itbXA_6L_RPlRubGjg(P4%OjT2 zU?PbA0YBd8*pphF$Arb^vU?OeEPvgluF2(Lyi06t6V`(^Mc(q+!-K6X5_Gr0u#Qjx zserv-mExl7dYDcxmd<@;L|+((tL(%%OFLT+_$Zy)D_A{o;)x}K)YuZFdKZOrZd&un zj&E2Pj1;vA2AN)nN*CY1qJh-|!|QKqjD*vE7(^ooJoO?mcFJDo3bB}g9gBfTw300f zQp%4CFQ0VE536XnZm0vtxqPTZGy=8oB9K2Cg9eI5aK)lgSu*=WOhscewCRIZZd?y~ zVYpS4^lHn{KnotEbXmk_!h$tRhYMK2*eC&uQ@#b(7&tABW%u>uHl@afg3hOH0ZGHw zp;V#Z$o1xOLk-~6ML2@JIF)d*uQ}RDBzVdJeG}MaL~iS^hu@3b;%KOF&-wJw9rfuqYsWX zMl-{hs-dX^(MWyKzP+<$SJ#g1t=%1@saQozQe8@_Z|_)PRP4z?W|y4K42C>b(7zBC z0lPS!bC@+t_fQ)4wHSa%2$VvKF2Kbi5D6CJGWXL4$(XHKdJqRm`)eWY_m5@9Ld&9J zL`MX4e>B?b8`42&mzFqy1EOF) zP;{2uY^@3oFOwb32jj}oz7C3{LnfKOy}M@*%_$ezmn$2MNm6zoM<{ztN7BmFpO^`B zjRrL1S-#<9$Sn`LKQ<|P${$I=G7B4J zp)3Lpy#|G-m$R2VTMA)=ve8VLO9TkI7RD2K!KfJlC!^3G2Gi(Shr+R`?BO)lsoXGa z@1seB*jYgj3VMwx&@RE@(MTZwX!v+^Q5i0QZHfKxB{wGFSC$KLSJ;-?=F$cW7lT_9cZ8#rjs5B~fLMOs`Xa-N|xvcrn zpJ9}+UEbfYgjHIc^Lt#ZXei-B`D^KRhB0T!%oO!iF)} zoI<0jX6YboT|IWh19F%st`?NGnFbwZMkErGJ`~R6u>;;s$U*;#I*uyh=-Z)|lonou zD1U^1JXHyk1PSZy{lT1(SW2Q;Ow-^>3Qb;Iy=c=LAg);EEYkg?P#?&2=K98lV8^#k zW0BC88ztgxWn(*{vDjQGx{D`I=ALLM3;+EfP-9n;Dt}tg`j%MqOJF7 zIN{{D?k*EQ=Go(jwZg^_jOTKR-e_iOv<>V&IEa(^DBTWf<{+^Q@p2em31iT*$npUd zTQ29gGT=4Rk2#Xw=jnnPONP?2xFMBKQFlVm3L%fC1_m;H+Ej@VugQk`v#{r49u4v# zxeWvIVJToXr}{cmS?t?Arb?5s&~Bq!P*V^Haax*RPDWgI=wg|J*hGy56NjP-Lz&Q2 zqL@*R+RZ%&u^%BIX=S1YTwEbDoQe`9J?2_mqv$`}$=*&@A@*w?8!3OwkRT!-JWjKxi;Nc>(=kG1X;IqtW@3l3U9crT4vB6BUgFNt!%Ld@}}`s-nB^{xm5k`>Kw;{6VL+8zl7 z9Qn8$NdJ5$s1Xh&v$yN+LI*(CytJ zew0&`E}|lZ>6x+;0&$HhrAf-w^64>AaWu%&B$pmY_Y7u(QJ6~aAA`%ou*1TP{Su4ITZ+COs}xkwr%B4JzZAO1A%CQ3qJ7+krbup#e3_hml|vnYnEbFkUMDhv6`!vuY$C8yMojUUCX|H9pweiBl*S#9Bbs4YEm+4__d!#0d$48<#tA z#S`)l#A_4nA@dRGM19h2jvi*a7?>&1x)Jw=jT@Ja4%-km8HW?1(#)lh(|=!P13N@S z7Cwg&Ep(^3m$=f2H8yA`vQc>uB+%-aj@Y~*f7)BwKfx-&J2;Hc@H$d~2ND*p_%M6o zOJfvEQX-Npl1jr9d*6eY0*-L+*wDTWseFDggFSKPI=ULZObPo-}Z_m1!NLpo}MTA7X zW7uV+B?0|Rh8ve38?jy&a9MccX=KG2(F$}pnCCc?WXTd;OJT@O6X&%FvMmIvV~GEH@W?Gl>SEznY0z(2H}EH;6T7}-lnzPX6XdAxC34KWc+k%2U6%v!c9 zsXv!*L#K3);9hlTmhm>Esj>Dw@xmSIX)J?0;ZRF;)Yy9ZmO+RHOBT^rB(tTF7q) zJ9#Z3uI+^Llpbu8nZ^{=K@#oZz0=vLGmt>R0_Ip7$kF+lXEgTtWkasZ;!?G#M#DRL zKQTJnT&h--w)u`OoUvPFxU^RuLTPAvqZuGnuO>T2SrgM-_2;3_4NJovW7#ZDY^owd zFjYb=u@oR8vdczT_xLSx=HS`@DV?E{6{8f|WQ!ca@dKEflVv21KG ze!{pxSCHJT~_SZZ~+!_8@^CGuzExW z4;dx~3J^16fkc50U&bv8DyAdZ4^=BduRVvOgi+{>0Tse=(OWaAkkU*(RgiIo96ah_ zu}fv?z`zlYq*6~uQhnyS$e&2f3yy^JK~E+>40#zj7Qp3XEMe?E2M47gayqtgHH;lz z|8BB`wI0SCckw8ZQaEyRZV2{Wx=##=K8&4)!x~6q$t25sXl%Mf@^jcY7`SZsD?9Z< z8G%nbZ4yj*%vUztkv}qR_uF$J<+!A>2^()b5LP)Z${<2s`(rHBYMkF6YJPfnB?o zdg(^BqZwo%_qq)@6%B9X&BrccX@j8RH=Vk%KckazuX)i3w9lqkSIR)TEgRh=$mj_n zh<(6jPtDTE&Yg~frdm&SV*Q3O)c1tM^dzeTTU^O~1S@T*L{ds|Sdrg{P7K*A8Epja zm%(U**T%N)mO^K@%gu91A98SWi3d`9YY(jX1-vmBa>Xr+j(rcEV@ypGa&NG(XZl1- z_BNRFKA&T9+dF9Mia31E5*b~k)Pm)8>Y8vLw$g<-+>s5Th9?|432!fsg_h@Vs!Yee zG5C>08#jzZ^EtAuFH4G|^{53RpNH>SRk#yHIi92IZ1A!VX9sAQHI9l_HTUDC&Bs zaHb@&>=3@gca{qwNE(J{nmh&^5o(owc-rAGm$oo2ejrU+oXyryG_S@kjHXW0qF0-M zV8<~fn28*s`RO#=Jp{5X>VOa$k#toNwz(3C;a)P}MPi`hk?#a#WayX`S|<@F&7Ec} zPE9fghYs@`^7RKhjTsyb)E->>3pp+gW5fT%zGL#2;h0Rw3&qVxdXF+`07KUZP`!!|m$RE3522e(9cVp3~G58p_l zM}~Dd6m(mQw>!lE1}z%o+YiED9e2EOj2+o3l*I^n4!gS0334PG1ATTPpZsByb8HzntI)FM`IY#j5su!i-2*?adGOPB3FsBQAXkelFyHcc1T2-~GYSpS$t5zwXV(E(x;Nudji z7NCjUtUcyC?A!KmKBZR{0H)ENS3c6GlfIO0tjUR%smtN$dCdui3t`O;VMb071Cj`4 zI9xr`c9JGc*kllI?TG|g)Z(jFF4TfW%|cVC-(rY>pUOSS6Ahl$h;$z`NjqnX7348* zW)vzEIfQFTwWPpR%1Dvk6gRoKq2UU<34TvvXLx1q@&2dI;&%$o;^d%sX4l#w)b5VG zU9nuXd^^k5`v7LGl>IEEGDm-^%~&P7)+bh#D)beV5XVMzf6|+Zy;a(NH<{(YK)JXO zCsmOmeBi=p=bSb6ykZ7i@}Q-?ooaTHMCIV|q1xrTgr^UmJ~?=LaMDi8@3=STx~MvD zF{DMmd~GK|l7PC$u*T}!mDu^vMr17Pne}O087Ow?y#LVe!F;HhNLA~2$oQ#B%fBZ3hN>#jBv{Dt(f&t`J~Ky zG$(Xd6NGHidrwuLKBE*UEn2=2&Z={ncKRu8J62oLjFJ!!wIj}KGy)$M9b7YVq4-m$ zxSBaVf*MuKbmE0RL7?FCV^C3_UpFIdXj!3S8LjKWZ?;N_}xXO1oStUiEKQH95|Evk;J z07tGzfauRz7^~=++=k-1Ip;&9;3tfpdG$^NeOzhJYcU@ub+fh=vA~)r&J1HPhv@A( zYLFq|JhdGGE3n%GL`EX4QxDrK9E$WWPHg-9)f%#%n+)3f#CeERWKYwLn{0^|FpMiP7Z#yXji1QH5i!x_b{fIAdqPtuPA@S5 z6bCCWLePRqrAY6+z1eMuQw<#EX5OVzq*MtHXw~ZL{17YNvbdIoCqVxjXtvF@KpY9d zvI}P&YQB*{Y>u_eVFd4qe2h5B@Z^y(5X?#z5oG!lZEO)mqEhZJm(0*9q}`S-_PVuozaNMpTH-uq%0&SBAt|bF#YLO$sxg7(DEkPBN{6RN!P`MK?`ix@a z$BYJ;D*!ScXOrQFhMq~y8tVcBun%Gh{5TwOGZ>TNfX_A{$;;mWUgOf$0Sw-?8S5q` z%0$!-70%p?`D74@XY$slS+9>LB}!2pDw3rkIpafYq2zJ5vSUtiMA|}+LTLHCvK@gj zCj=0?&Ge&du+U_<^vYaki#c7H%82rr&&%9W}g`d zts$)8-U#bPH@MHnBFkXq)5_LTkRMosCv3k`4T2)E*m$GA$5f8ltQQQdjaibnj8K7v zHF2kATXs(#MG76*(wK|xt+4@6iu_s`lSm!GEV_Pujp>eRjtv6PPrMIr&~zMXJsrs0 z2jO-^q>Az8lc*}{^%=sa0n+DQssRRiyv!_T^)-rceG@r^m^p}C&dX#U!jVqb1#Zy1 zwt6PvKO#V6kK;#7!+4-ECmRm%{lWN<^CqWbndP2Ziq9k{c;`oXB5{QADmgp>pWCQ; zX7_G{l!0V}P;K3vi>nBj;3uvJvBJ#MQuNrO!l~K{LHQPMj?DC#TIgoiBxHT_&JkJ?TC>VlptVF1!!JfXwXShb3SSfFZIGH`+JEO9{iZFS4 zRFY0+eg_?4$$Wx+iJD(2U2F8d6cbylR;Nt1hdi{9xVzejuf;uta?VH?8HiPg2}Y$n5ZG4w+CaTZb8k= zHvX>ENUVfVV2NLEg_|lb>#9M|B8*c6!$In4OkgTYuJ)>yOF<_yp&eSambRlX$+S%yJ5 zC5^PUO1$I1w?0DK*l{9{#5>;>guRd(eeouUZ=3SkX~c;o!1568m-y@`WjPF&F|tE} zR@}y|ZEG&;AuyPg+Z5~Dgpje8j7vj=K3;5{WnkeeqaqW;#8Hnav*m@hu(AZIl~&fN z1>MIni0y#MHlXv|!|Ey;BvN|SPqC*WknZ8~KxG3_=G;Rek0D}s!6S=e8tI^X{2hq| zbz|6q55wXVCl1RL$;O$zxDC0c$=5^JL9? z3y5!Y<@>M1>EtRQGwMCqriY8|cMY(*@@=?Hd6%u2ECw}G2ANhL~zga4i&Cq(4 zb$vs_bZ;3C4VRs~Il(EnY;ZFFOe`-6mYr%?7{B7E3dda;X#{1AD4atE93dgI?upvy zp{)WVOgeXuDo7TZO|>~cU@EpcM=H=4^`=%!(+1A%K6x3@IM+M7@e|cjx90Rj#7#DM zFS}S*pgE^t=3K40)E3clH@osBP*n{dF~~Ms5_84LW5V*?*Kv;$uF*Jg!R`TGu%%o$ zgAdn*JOh*lA}`E3IJ7TW<`CjIR%<$35&=h^2(bv=z;5XP@tYKGKl4oX^vP3NWlrKg zS+t|f$H#;AB#uA*!?eKnKrC$-<>`#eCO3pO*Jb9Fc2<4G0jT7WLu0<66j;Y(QI;49 zSSv&kfLLmX-8VQ!4e5Gn;*R7<5~ivJi;5#Vrdj+(6SoPz;Hs~;lCc4v4YKyt$YN43 z44Qrf8%ID`#|rPxWVo#As1N`%Ln8dg3zcHps3v$2+a;(b&nZC89^%xR;j z;wwT%4EtGfLZUepdmx;iBj~?Hr%RJElnM!#mT4?Bl;Wjqd5tfHN0c+wO$_t;^rnyX60bnAcA||1YkC%w1sxPS!W%WAU$VHukq0t12 z6O2TuP6h#-LB%5wf79y+sVPY?Dx;61Hr>)|Ah1(E)fruYdN9wc!AS;zCGfO$@U9z{ zF(cNTabGT)sc{LHbIeCM_2g#Oj4huIBwvw^lE;^Uw%ut^L{;T zG`+&ySFa^Bp44Bt9{6@DwNFsgVQ}SoO>nriyc61BbAKfIn^Bn%<4mrLv`Dr{;<&OKB}fK=#PJ6Mmg8XHwSX5x?2VHoaTy7X5ZLL;eH^yPuNT1r;(@}h379-)l1u*p}JOZX1K^oW?k zE8%%;u`fL-HbO+oia04LBi>&i{=G$$9xEheIi*JhS9v!L5T^>`L8UnCe9^t|$)(Hz5S9@o0OF7aveB47T*E;we%fg72=U1+E5KG;p;|rQA zqG*_Om-^UxsbL`#Dtgc49j35?3TQzixGL3yF(cc+fpDJN)xz1;XQRv?4tm=-TtppL zLS9!a0R#0$sH(5Y^%Re4javvKtV#hR7AM`BR#2O+Hz1x#ScI{)xsU>LPIwel51j>u z7&Qe3J#PJEBZu6gTN$4t4;~Er1#q>3TBolDLlDxpCg~o$LX?MzK}~V*|8ZnpuR^RA zOjqViZKkN{q+m1{twiI6Wm&OeZVY*!HLs=e|K3L- zQ9UXld9ejV%=_2+*+HGIl`~3hYBou6fZj*tim!O`A_Lkx=`HCZh!#V69mT~MDe4H8#leCBkL=Neh z975SdO4QL)Ptwr%r6CS~;4!P-W`P}>uaBKRhSiGEM0CtIFQs_;2>S+o&(kuDe0b5S zkjcxtrcAlQU;>jorG<$G%h(1K<8z4k+GzqLy$LxUpUnKNSgd5V5GMvf(?d3|ZFIp4 z1EH6lhpBZ89GIV6&}&#Rv|7G8c46!wJ+*aHV`s7$d|xaJlvHXhM=Dxf<}`#%dO~NY z&Mv|)#s*?*$z=z1b*3WTDAd85Qj5lwqRB^zWbh?Ix*4@%yrGd}Tk#O;x?kqSf*5H{ zq$z1FbKj|(-St3vujK5=^G;xSoFVoGp%{d#D%wr>C{dw$dea~j8dXR9iEx@-S zRt4vv&xWraGBM5S!D2Q~DA*X3XyN4jgbo;8n&|TTr|{6vXil&WP&d)4ICW>KPpVEO zZ$_P(1r_UEM$839vsuyP3=6GIt>8x*H*SVtJHkk!ZoJ1j@UlT6nG-jW!=?$lEjzI> zPZa`c9Z6zXe8Rm?lEeP`!91eKn1IN@p>8P#yxc6t=^3r&CVm;KC49sX2|Bs7E>Aq~ z+ZGI8W93!GRUWq==P^J-sKLB3`kPfk=A;1SAuKt5s}F${D~PcZr#l33O!vZJZ~7*j zS2Zh_e$;2DHCQCiuv?qp7Lf0sRtgM4ZYc0nh4(*Vl_cnkNf8YLocaWD zBr01J=X&Zol>gL3szJhIlMuEym?N=p8M{w7nHL?zf_D4-2B-v@jIc1iATLsyi@U4p z=*#pkH7Nj;Bu*3(L~;=9YVG6Or{EwK={Rst zvF=M?6`on7)F;SThA8#*lvv$^$4AG9j~=Y3sqe|PS!F2`lzral!7(wHNUp_{cB!Zj z9&``m7Ze?INb*Jy5Qb@>2!Eb5|8S2!qSQAkb2D&q2N;ZQbue5Z=d8F2$ur7)3Y)c~BA{I_hdpP)beE4+ldoio_yDprQ z(@i3lyPNg2hX-V5eLNuHW5h?eYrV^wNF^}!A4ig}Qp9w=%aJ}XJmu=&NEz+JoC3@S z&z`flbaqM5k}o7g)iP*k_|0J4v0(p=NP@`~+Naqvndm|r;xCGo4pZ<#czPX-2`=zp zKykM0G;=YjA#UWkJm@Fl2<4oRV|^Tk6Kt6~B(sWju>&6;>vtm#HQiOJN}-^WSKi?{ zEh!4io`xs@eDe=sV#K*dVvquJq_@Fii2WK;Y7W#jX-)-u)jls-O7xHhmgqf*s)zNP zQUI#&tGR49Gm6p;G`VHzf%#m1(>egB6I>@#1`A9#xse=&Di29;_5{WH{==iy@;Lx% zX<|X#bHFaA{f=;gw1h_M9v6-kF{#JcYAE~5q*fEio5dSQm%Yb(2hSo6hMPikX!nqd zsW~0-2Yf#EUsMHs`)10{%~BNoNyh<*lRm3iQ#30G7CgZT=^=(0H%>jPI>$g-pnsN9 zb`Fg_E;nYxcyJ{;{bH(#H4|A{Mfj@zP zE9CrjivJoSgBd6sasR8{uYJ|S%i_w#C{|jx4<#fcs0ApFpja#v@MuaR6G@LC<<$W` zHkw?b9=kePW1!p_^#+B8di1rK!qIT12goob;++`*YSd#>7pl0DsNDK`a>t`9EVI=? zj~AU#H$Ty-&Z4*CeM_-N2g>ZK*EW&Fbx39U7nhnOt0<9T@+KEAxc8(Qk#qyclF^qqrFIh*gmDIab)uCCI}gI`Qw}q z5WhgUS@VvSw2H{)CY7Z2`IIy7Fep=o24Hij;-4kRY3*3M|H4*9a4%=)X^KdSse+qN zbLZHWI@%@63nj6^1~p4HX9^Axh8BIJ%OzHHFiXWyC>8O4v(5GpldR`QgMErAT~irm6* zO*P@6jXcZ>7_Roi2roF=qzU=4d?8%NMa0GVedB_d0TFEHAV2=sC|D7t0Q2fCOPuuh zCRf^tp-8+AV0O#!v&36(ZpV`v;J&$w%cYRUPoqtz?nI91)TGPk)TGMDq@#^ti4HM- zDvKVvl_^Ulmt$fq%;U@=p)v%*L8-j-(_~7mP;98{)et{X2=P6IjhWm0_{K&E}dY*t9N&&#KfUP z<=(SMY8kG6I1vA9F1OD6P-fJ|$bZXa$oJLOks0SNaQ9%TZcQMKfhuCFhy-(Q_vpd! zQq7IITqw!Q;q*cG=-^WcFDdydbD9(|mZnvQdro&jC067r?p*OIX$s@P`!+3LXnV6u zzSZLnnG`0aE6pbNS7)*h<<9yX8!+oXr;G>SK8(zW#^*C`N~>YF3~7|r0G81`yxptZ zE$cY&=h+-*kIi%a;a^s zP_fYfP@!TU*6IM5Io;Ad`SD8my(ECOOr~@!4D}Ye8tsXLQ-qR#-AhE^g>6v9H%O$a z@o4!xb*k{2qfjFIM=}=Qc=II?7ytGV$+wPkn&=w;GBcrB2Z`o?!U}zWwpP^;N6oO!`9&loSpNaz60x{poar!s1|sNV476N!*2SSTS4S zt_9Ss7?zu>w2mY%r1HcTB2Gwu*sD(1^fV&tRqCWl2@rRL7}R3%q<1#F0g-)_(_Dlk0G7oN0V|he3 zl8#X2AD`2E1eM!n@P%di!% zhcs0vw6qTDog+H#_sNkOE)2i2h6hOjH4~o&q0C>q^9blm zT>H{-r`w}p`-K1z`*_TP#+7tna2}jFF0j%=1fu)IJL`td#;DAzkL*Sci%ucD;XZY&XU0uJa)_S+cgB%?TEzLlgqbv^40*hwn5*{^ah}Y%r_N}DqShc8 zUo||lz11s<^&OAgrl!<0XVmK?lyd-pQ%Gzy*pD+aX((QLSar7x0ow&)?^iM9w3Qa$Uuc}<4nWZs1Jd-4Nx$;NkLbvMXE#*{8$N`g`)DOEvW7S&35>^zUoQ;{#Qi8Cga)Ap3)H!p zj=6dFC`Gi}3S5`Y3>|3_(X)0`2x>^p23df0B|_={KO!RAzaB<}@e`Gv^!lpESSN4e zfN9w#gnQf8q@xLn^G#Cp1r+4DiYqJW5+5!A>#=No6|ptRf_6w|*qIrGF6lzP+L8_{ z{0SE-d_2>~iy8-ts5*c05bkF1RuH!fu$!1&LnB5uQA&8cRucIu)o0@lpe5VXJr@ly zzqt}~$c+*_;|EEq&Kxut+)_px4LL#{sQ$`|=xbWqR8rgS4nMKA^Bv*{l^VqA?Pu0B zU4_T{wgMJrUZT{X?#YME`7#T6mamZ}s>0`nn&}1vY!i!I@bH!b_#VU_o}-0FyYWF%Hrz9A^f!QgjSNAHAvRZv+;6&wSWU@N4h9dJX?(~2aaY+ zi@1o(t2Kk0}jHC84KyS@Ag5iqqI9s4G0$rIJFcr^YFVVuZJa@ zl_pH!8oCagvg33R`XknkwD=A&bh4zEgGwSQiFef-uxT`Vh;2cvJ>idV^8NuNB-Bfj zj+L{*-BTW_Cxaq0Xh1gPP9HvbblN>RJ^8+)hmlxFynpcQK};ke6TbB&hBI$B%qB+r zOv(9zR5Sc!brBh$4^lE4pavzoX1XbrkxQ4%QYWYjrWv-n44y%7hegLoNtL2$x^pMP zj=`={p(aRMhAz%^GO`4ah{L`v{1RAhdaP9J+KgZdww(dwp-x;e%aU=7?cWOuXD8Au zT8mQ)T98tWTaZ$3wIJ=rp?2Os=E^~>muqBRWxStuP8fp+V4q;CdJboZ#fy{S0*-yX zC8mhLx7Arw86%ZWcM_6Dth!4Ee}q3BYmuf@1A(^drc zW^QaZb7Q-i8{5s?*ly;=b~872nz^yl%ncR$G3Vh@;&@rK&D^-% z%#GX4+_>G$joZ!KxZTW++s)j#)69)K&D^-t%#AzE+)(#y^Z9kBnHzT!H?HhghEpHJf$|NqoA?$U%1xRs*|dM?U3y4a6>&gvvT8S5_%FNs87M(N$0B4N2yXC{&8o;aGyp&EK7F_p2M=(xRzzDWIoGCkFoC^nw zN7Z{%?iAzx)bE?+s6GHgW^9bcOBHGWF5)jw)To#5%*5c*j5jvOQ1Qf87p30WP2(HE zYcPh+`>HnnFclv1RR>2FaEr(N(Jfy|I1W|_{(Smu_)2AQEt3W)cxVHN^cIU=;VyP4 z!+`@n?Q?*fR;-*VMOO^vKV+~roTbD`<@3d=f<_~sJuDQ-(KDC~5pI-6+`gksVzIXx zFmy!?iYZQ973`>K0%cu+XiFunYgWlH}`O^Fggas(`le`gbP0m?x0`c7QaY2 z<&%l$ohl-W8Q?9_;YXLQ2a5xqOf@6%MT8bGyfkoys5!gr6IU4+8ljPZ@grwMgqfE=q)E+T6I%ml^OQzL1@>#FK z4HR)@;n-0zIgPmLrZ5O*03zMTJ4i+52;PxF)KNRe6V>An1$?{)o(jopx3(4m!PE|J zJh*@G1jojr3@7py3%WCfKkkV0a=2U<4+Dtb_Gt!wVe!Jfg|wIn3KHYYk_35N!6pS4 zq?pRpKfi6p0zxt#$&I-2E^ADoYk^yk6&fBTnY|h=4o3)~lv+%WK8E~z3d+xB5(+4^ zF^2X}N0YoS$z!!RTBDZX)=A#%Fah0@p3CK%6F63q2?;$l$6hz%Z8UwJLK2uTc-1ac z6AGETVHWOJZL!mWjHV}}`9`O@1mrv6&cl5{f1bO~K-V5MX&Zbjnwl{En$xt)m8Gsd zO@!LRo!xYXQ~vWAZgi8vF??jeScFSFh0sKtL2T3dFHYUV2V0Po=cng*&bEigSg=Pp zn<2P546zIN!rq6fIYtZO<_s2^_&4K zjh~83f~?GZ{AL%17V?|DsK2Enb;36LQYT1v>ICUgop4J!Rj0Uq)hVuPb;_-sTQ~38 z%52}+zNO4wQs3>}?R&ODw@|~|cWtw_Z@zQ)ma;4{>+Y?0c6V+jyAjjw?cBR}=VnIl z&fU9rw{tGz;g8+joY!}6-9&y%^48Ao_AL;wM7QzS!p`m8oclX?Y2oHOwLZAJb9eXF zJ!K81mL{=+_bRm}@Re8G&Bl>Tn9qTsm=S)zeR>I<41#yAuCgU)>{$wn_|fB2T=7eU zioL^zhchI&TEu}gH&zD-d-Lt#ihn*uGmqw_z3$UU)CE6|pJC-pQ_c#rB-m|w8dEks znbT}~>Q0-U>@zk!jXay442m{A4U8xvKS*_qX-Cux^z~Fx0o==#ktZ-{sAyi`DYn4R zW^|pZ?ScVx+j=ib^ckv>v8PxgSFd9MWO|6=LhGJ>K8PEfh{zA;8Woew`>t{a3~$AT z5h{yh>N5DyC764vCZeK|%W;BAOq2+eFHVn`0(6AGjGxQ%7do5?s!=)SOJZ~Z-IYQj>nwYt5LM!kwo_*mn>`vG8 zLmlBTFY#hl!yA|B(t9D}aIwIPEJCjSI;H@rx68#n7FowRlc#2jMLVkzz5j9M4wokg z)!}!Il6)`0BQJ1O3kFef-a3KRPA-z`%u$ZGjY^nyF`1J&5>u*%krB!DA);na3Fn=s zrAiWNxc_eTu8?3*R4rn0M8tHH0o3$R7{(Za1;s4lzQTbMQ=C4i){QL6J`{Q*LBtFZ zIA&KqpxVJ4YnKEN>ReJDOU)~+#BTRM3+Es13_l6Gk&b(bb*r8(TccX?ypKfyK<7ab z_vdvGoLu;(XN?jc10Q4j)BxvYI`b16W4h%=W8?2k%5`#=V|Y{#7jm(p4uy_DYhbMs zuaJ6%P*XKPg@$&Ip6=Hn61!kEzfXDCI11VtA)N!q)jH|PVYi+re#P}I zWv_G;nc*;|-h;RW#d|)tV9*6PRYQASzt^iQ(62Z$5aE@p9_G^79vXiYRSEDI)oy!eT{JD7G%KaZ6-s)e+68h|BJPH1c>?ugf1+_w}#? zZMjs^&UL!;1CZO>>h=3L4W+itofPGGfRNMAQ8~Jo>vTslxE7Q!gjN7V zo@g2@Gc5oba==&V${cRj?eoI!LF<-rY zh-Y%Hbso$NvjThNVyVyV5OG|`8d-{RlHE`ZffYy~`V%5LzQP`2J5bXlB=D^O=J_|C za>t!ePtGMgh6&pwVBeSOh{bF88g+nnW{`O1m?xxMJOE^2z+z&pGMoXOn}NU_xDSRB zSDSZMs|%`30t|!l>UE9+zQ3k9YVx_ox*->Kh~>g&^H>(fjUmXjzk!^c3r&62X6L2tS^!ExBr-aNSs2oja= zE8qX+?>wJ%aD;|SS~?X^TW~)olPonl%!8OE4n$ilV%A_!@#YGiI=Phb9*4`@)0*PW z)0IDR#TLNCw`$J28G&%LT%5GFEI7d|-n>;|kP4Or9(cGCc_tvw{2cKmH%(>K#79f} z>h(|G#V{!1HMFlDJyE|n9a1+t9Yd`y3AE{G`r3>DKK^BTpDI+|ACpzqlcN9RSab}X zF0UYxqu5w9I?grHqy?QJEP67(Hx>c2g8#T{GGPo+|(x;AxP z+?s5*ol68ujelEWv4v-FyXY@F&-AS$p9Z^Q4=+FQKAb(E-pBUXxSG~8bT4MB%fS&G z7}Qx#9c{t_j)#?bC$o;`sQE{9b@MmUt~@>L3NR?3(r@4U=!?5Ca%0X3Y(8Y@=6eoL zWpV}HEMHt9*PY#uzQUdM--C)}7MHxSs*4$s0Up`YOLd#fS5Ugq!IQG$VS6}>oDLd* z5*!1^+AuukCG!k(I(QUf0q0;Yb+tUB=}TueEkU}@K_@5V^T6OY2xNJz;(hwg6eS{mfSptl>AYucDP@1^?H|{ zX7m=amrNpo0%o{J)=JJEEfuK9anRfAlz|d`>iv_jY8M`$j;U&o@44&+Q(<2nyCKT1 zZ2Se%ie>Idk6th8w61{n9C38|s|lnC;vCgD>$gK9JUFi~Lac4jQ>>6I8z%^8D5QNs6qDEtwmc)yC zaxH^+mg4eD#LxxS#7E$#SUO9JjzLI7YsLBoZ_!Nc&V7TqJX#?;RQewAc8vzbROzmr zHW*^`wB+pE%HeL}hAcS#!yQ23KL%H{_8(o=U_SOMRai=RM>&CTni2#Zi<92$%3&W zmu7iz;@Bd|&&PwuV`vP%>;Ripr{Wih+r(46e=rygN<1IT#Q8KKMcQ3n%g3#23CbqA zKq?nC!K0z>E^R0;urCte>uDx`a9f}Z)46<~Kf-b7YB3Bqumgs_YWN7fV}@LoUTU1b zA6UzprI)gL2^}hd@x2h|KvZ0x3k1PX-!8O_y0BQdK7`b&X@H-EwuybV1KvSnP(25x&N~#{OO{kXh_Gkj4?tN8x`mU#{Vxqw;|vjGYR%>5${-Sv(mjnjMmAev>)H|yX&JG)$sx#=lfv>bw zB_-l+2X==kH_L`aLUu+(Mf_L%y4IN@QK8YyDED4cPKZscY6@r1Z87s?#|Mr56!Pf8 zGz7JNfZBEtGyDar?TC&h%gDVC9l&JzWQ7+QRQbA~<45~DI|%zF)ul{kt2`TD;Z-#U zz)GXiIhy(DU~=_IvV&#S5ci(s13oalL7FRcRd9g7I5^Fs18f?W`SBdB_PrcXBa1`x z@yLZQJ)~5aP+TL*>Ln!cKjU&lnj!T7K&qFR1|H=$|>qX5E7 zXXEpG4jCqul(w6v$-*Idxt|WarLuAI1qoc7(dFHq zoQ6CWBzXKwcL1;cC$3(igp)5ZqA%$`7%vVNUl{u_WnnQHUF@rjzx=STp=zB?s*x~U zRrwv77H=6nK0H1=JaGtoSZXHy-<9V8T`GA)BU<`Oe=)sQE)_+V1HV=Fwmkf>9PD4L zrd|qTiCiqJ568=kCk)ZB&*#AfbzD8*YLHYhN|EU~c9SGjEeD(rm|9VE$8ZO-H59BM zY3v#iQgydny&k5WUB#|mHzO-7hjAM$#e7L-N$_HhNw}bb2eU2e2`azXLZxX`aXZ@Z zA@4x$FJHqM7L%@)N}VetG7213K0Gc6eBX`$^tyTYgcmg9YXOmNwu-U_G!xIVn36Ms z2F5uU>wEROfe9CzfxbNuoeYJ2W3?RJ!?@z#$B2|I2hI&JJoYPtq>l4I@;|{t$E2}k z@(WcCL!0cf)X^=eP-IiyGTcS^CT(mK_qzKB2R6T3%MHBpd*vfqjA`K63MqTb**JbI zgC6J6vG^~0uSG1HeK$Aaa;-x4wlO<~?70)7G3n}cL=+YRVf2TBKQ9_c_!51D6SY zaDo0o<<76dcSCtQ+qS%&ZDn8!c|(tdn&55Qxkwv$jeEwVq+9i*?U-~>;XWcxRYR_E zg}4&w1BzGrc=)=1xnih>C(vr95wM)aKb>kpA@3}(Auog#HqlFw{vqvTCM!bBdy>d> z#}h;Zd^AG@v4AZ?pE{uvs{Y=J{kVD^{wa8ONUjeS zcyUKTF|5>A!i5%m+<&AW?)nSAjD4e{6GT^(7LV&_$=`m7U75}Clf@y)_H%ZP9+!4IPZeMUA>+#0x`L! zxR{j)W$Z1IlG|y4ma2rQoa4zsh2Jm|ft9YmiUbd!bKyELv|+?w@LX{D=l&X5NR^sP zR1O4^dgZ#h=3mRPo?;p$~C`0 z2l5Q!1miT;430Zf=*jg0fr^(QPoRZe>pU6{AsPaa{F0v=F|QIU;w4$xTm;P0{lNfxNe6Pr zQB$n%WQJWqf68sKki~(x8L31$3hC*JZAfvLSfR}1brTRzH4VoQ)R8BAZWlw5?of{N zQ-47;P>cOs2V^;^Crh+5&+eEr2Y5<)Q20n`Iw@tx9M^O`IgQKv7ml5=VHMq0jR;5A zMW}?a3sNvNRT8a)qrM>Gd}rGN9Fxt==P)=RBL#Lag(642U6NwK`bu>u*U_>=-le%? zn1C1VI)`tEBe$<@676p`1?ExcsbX}G5C*&jiTLfvLGj2q8PiKO^aliy2o^HvV`*-< z%$TZ>0ujk2I?=#tm7wfpGtgZoO#PEG6)n@X__$=Q!VdfvhL}aXqyIy76b4)sbkNsmxJ74_nI@G($rEzSMM3c_l=`@xPYp(eh$;;B>aZx~ITf>#0sy-p-UeHC zx)Se9mw~XBbEjncV=$sX3p#`1j572#MkFz>v;=C5Q|ugEW( zh~wjW9kI~Eo}Uy7$=4|?Qy4m1{mC2$cakAh6%~aWT~5?8Mo(5_+)yuKgU1ka1;!yxzGp?&^n(h~N$QMdPkY6~ z_dWJ5==c4}+;;t^=v7Y;$Ehyj2+R5^(yiWL{aBoTHLJS7%Mi=2Ccz3<{AFf+HQGI% zA#m3G4Pw>cI{FsAc%-tYWg*g@NZ=jBES7*sbMA7*4`56Fyn6kz_oX)ou@m=ud9oW> zHEhU4j9fv6O6~sO5vKN`g~rGjxwM>#Iw7a;Zp9tXZj3@S2Kf^@6?Wht^^iAd&=|sL z7JiETTF}_D)B~7#*=~bMaqH9Ix`O5!^OHk10B>E2GSi{NoRLAGR~XO5EWldLk+8UPLj4757r-$>&6q$GM1v|`*bay>*O-peOlYgAnBFR zS_Ub)oSkz`yNS#)1FRqX)L$hQ3@ZS7rkVB`y{-@>+c5WGzjr9bL`UN)$6R z;>vonn>e&-4tUqaHf^4#oQvCTMb5Cmu<`N3QlZSQ;v-3I8hTG)?!6s@0XdaXrf@HG zzYu_Ud2r3W>xwfn<+Lu);bK8|818&5hg>!u#T9bF9yy~L@$lf;$?`TvV=0-+ zd5xhBBRaP#_jakPB^1$AXM`p_8!mmT{3)$159e@b7o(iRm^>W90o{uJAdx)(Mgt$K z1~E;cm%&wz#Fb3T@fNQx>zu|RU!b#iwQ?`s=G9_P;SdUiWIR-v8{o{!-trM3N|c?a zV!32Cffil_Yk*-dD;w5 zanWP-;8sLb>Tk6&QuTdD6|l^tJ~(Wnfzl*yRnCP}3_G<@hO6RmHj)WfDu*|R{H1>x=XgVMGrf?pSf>DV zE+u}+$E5V0nU+!BKhq|{jYfRhZK^|Usg$^SK0xqprTGgV>3gOlUaCYvUq|z3g)rH+ zGL9qx&6#mLaRjBU&=f>vE~FBluKcznFMbOUMc;RXKYZ%opul^jCv^it9H%kR&@Fl2 z5R@wx$x7Y95;pn3uU7(TPxp!nVAMc)F&eO}oZzc+GX1}ZZtPS%7jg~(sU6p8L%OH* zrVpl&o#4yV4qX&G9NmM}m##w~O(x&~Jj6J_emIeLl zwJR73(0@4OJ)zQOt~H}DZTl|yj4|+eRo($120SW+b-vb0bkHf{~8}4vWQvO z42X{_IPdkQxZc4X7~Hkxa*4j71eWYk~NVQmo3fWQzaJ?xpfW2Mj z0L}~&F<^zLXVPIehPVodi;tZL!%>gn6r$#(b2&a89Xu%2i54~VOV=4(b!`I#_csd3 zC@Gdk!xphuRfk4NIJ|^{m`|vDyKpn5KswD`U=UQrb0`n2~=$cIo8#`cm_0&YbY=o?tNR|g!*WI{|)ck^p zlCbu4)wIoup?@6Q0%|q#+(LRVJ#>%v-)q9lL`V=Ya^@|hldyLr+_zk+f+-U|QVNT* zPk(cXp!WvTrkEG*OSb1B`FuDXF2?-;!vO+h#Qcq>;#LNr=*WtBID^yZL!ny~K-j8~ELkWAQPhOfZ6M}`Bq&I6j#I_}7P zSvswu1Dpv4_!VXyE-MV-_lBlc--;CA6=+n(u?@JQh%HNQ1S;F5teolLBnZ<`_6JTo0K5b zMgzVuB8!4-+L1trl~q70%08FwJE%OS}0(o{@smT0Lt!c90RWKJHI zOO%5fg;i)xf@Xz@fN|^zD+$;RHnFk^n1-ZEQ}!z$%WfaPxw(LYIR4^lWG4kh_}0kq}ofch`mw)LiQbKyJry$nhqOD}q$02ROPEEOBnd z58sN=(13gy5lAY1W#~_crVA5Hm-I1wVtMph0LNmB-mwxJIL`qDVk;akeL}IkEwAwW=-{N+UgKBt1*T5;$vKNFJ^mHY_ z5UWm-o$`O>I*Oj_{e=L%b*Ihx^(pL8E(^>^Q3SOcihg67xS?I?H>Pq)WAXg=QzjVZ ziq@mhRneY*m7))|cH%zyfmCMQ@`tvtA) zLt^HrEElpCyCdcd&_c$*ZPSpLF+dwKhSAlWIbakBWW7|Tks%exNL|@eWdaKPNE8D$ z$poiDRwFx&K=;dLDUC|Qa0@=JPSJ6eLw*ivNg9Pc3q2b3o&{nv&3}A+BqXk0=gMmA zRwQMTz11p9#|0_LmXkrc$$)I$Ipl~IO}K$LLXytMkg;~93$n+!+_;Y$!Ap+?TO=F` zJ%I+)csJD&_IkZbG;|C^>Vf~zftUVoiU|IM62i*WOQz4Ysrf_P0CHD*GZF{bOVS@q z5yq*~6p=VwFJk~)s%`FKav-Q2XdTvgi1%-!5o^~0b0IXMI- z^LI{FUUpZ=-vG|&IJaes>(X5LrlaVkDfzK8lUt>hjdF^hs!hdX!K*-lJ9Aw68!d)` z&-`@rl9?XOu}52ugnn23?b0RL{dwsI1(ZK`|G4m{=6^EoZYQJ$Q-B2b`O#At1Oa!=PV;OVSh}Mp7X_ zR|v4~gOwO>E}z1ijB(3$%8RTjaWFedL*C`}Np&O)`l#`-__$1j^<_Tzq{0$&$m5pb zAgwfLV~j$Em!{zG>3l}Zh`d4Y1jifY{9wQmmq2IJa%OLxi&zgoS@ka0qxLQjwA+7c zhW^D2j(A7om$UYkPKJXq?;3s#hu-NXsI8^W$kgptl(WUK_W~P!o@Z38m<(2O#GoXH zqmx&7pw5{zuU>yWTT~b05p4myKkU;l5T}N!Lo3M&*&aafwIZ3j6=h5_!Z6CX#9-7? zr@FtwV=`R%y}&9!xC9rH5m5w@2kV4r#4V+Bm%o28|&q^c0U zof;Fq@+nkA`YR<11zBuE zo)EPlelNz8xxu3?x|QgcxnLaE0?ycZ8AB)Q%z zX1x)Lhv?>uy0GZr7yK5lbq-fccn7&;5pn)F4-1aNbOc2>V?-egKr!91P(T!IBp;6e zI44-!B&fdl(RD#3TGFh;c3D8GiXV)t@sbx}1Te06=9RDd1%-TQ&E~SjL4BVvBlisVc3C9Fw*65ZYLcm0X8isy8GH29I$Z zw;imH>;5pEN`jMpK@ z1$ARYS$Q|Y&KBQwdDQy54%IHfn_;iRn#n@E4$G{?>yX0&yACg`v5k27z}3^$7#akT zgLjLg&MmHPSM7&gp3H?cPm@(OPsAG(kfnJlOzK=~@4o?9d`NQyx2P6V8)`)3iI{X; zCRV1~Od5u+oVXa2@**twbz%)5t@;TT5i z>HEEfdf?I@Co98t$ie3vz!1IU_@n0Y*^TAw#c=e<(NTJ-Lfn97J>?&u^YRX7dH zk|ry}@^Hr{{za6CeF=6{S0r?^BFp1irW!PIO>X!(|EmbAw=QjcZ{_?ECXBw`Iq(F5 z9(Bu>u}{oZAd&p6efRc|zWZ%9>I!(4k7!!wud`CJ1XS^xfnBIq;8#c)y1>zN>*n<3QH zb(T;GQMz4d{#t1yh=`hnY*LLfNf>^01~>U%)O+b#N3Qag3QhSlsp7?Lzah{ zPkW0uT?u}dEAp{GPEO9cq|ZYDxElaY#JG9R1{m=`8RtMw4)Sm9?Jq`=SPHxeIH2O* zRsq8Bi?Fywj!2=7$vzW7A$J04sh4D)Up&|hb+#PIFdbrJi`s0*t+Vb=e7i)WPM&g8 z=F)@GqLPBXqmsOSt5brZr<5kEZVt%wNCh_9m`cy>AZ%RS3c^&SbgKMTzpMdNg3}sR zg4Wbkvf-j-p!*8Eb6=iq{v&WK`*bRbbeE{{8J`@sVUbHxZFUK^xjN1L?HcL+*6ow{ z3pYj>LJTb6JpK7sO4>u*Xq&=F(l&(-4RySOifK`^3WZ4Y0td5Hf%+;9}bzmn{R21ldH)#QKT4~Vl#81fb$CC;uU>2vgC%rPm;LHqXrq)fYG@_#v18|3R(=I?fe?D~(24 z;u;>L`?*Anu6zk5WJwzPVUJ+JsuB!2PV2BP;F4zGaBPWfK^?<~tJay2H0+NjaEA8h zof32eF|9R{8VY360iU=SkH)rmh2)+{&=khidpN674N%x5>5n}W0;W9|VV!3@eMzrr z#2?YA86|f)P9sQdut(BqSti*Ls=_mH(hUn^ib?QgZpV2so_}}&-~USD)Ham#YK$Yc zou+CEbhiQ8MI{J|`$oMjEL3{VCqmk)v7M-e`JQjX{F7~pijyy1XVbb(s6kCs$qOFo zT|q_5Lnz_I7s1w62t}CF=0hPSC#@Y#RCAGPG6qQuV>T2CFBh(HOHO)Os^3(bR9H#) zB4R0n2bo-Q`kbN5M9b1Vp2-WnnsK1XD7U+J74g|knq+s3Gc{A`2LFB!k9o~;Qe&_m zUS5vp)fnC&COOr^BvT=m+SO7|a7dofpv{!VfMGqy5q5uw>r<;u7ng?mh=o}IiCLy8 zoopz;L?fh87w}z_^8$d6 zaTIC~Z?!`D@enWmObdYf3s{L@-{#LJszKBalm3 znVg8x0y*f@g;a?ZR!EOMZ-zhBOjql|Q3Ywa7(G1u7^;oQjwA*O&QL$>U5Y|a>H7+QbG1uHOR^&mkrt){#94q2 z8}|zDUO{iw(!7>Cgrt22%QxT%%HR|0C4|%KMue}R3cQ)MK^4A|5+I_#wj~TO-GU`$d>J_G1dQh2afVk|{AZp>O!NM9>1Ef{1 z4ib%`mYf!l8c2j`)GTUXza-Ss477^ym$~Lw`y>X^g1m0RhcBul`>1--BPBbLjyx?T97ES3k_tYIg){1UQ zx4H2Y>!eut5-u|9n@yMc5|;4)=yFx9>4AvS-W3L|BgU5sk3O~Zj`Xj|_FdRroDcDs zu=l7F13QQm>tD~_3Ha_I(onh>{%X9hXLqHSvB%CO1rxYfm&daZDY(Sx$#@#Tp=JAU z|16eLFB1gB${N=;zyri#=p$~q1THW!9=dI4i2a@4Mx zt48QXWIm6}H9XQAtYL@6+lVylAcyUZJPsHekxTk}BfaAbIiwMGFQ7@fKM*B~f+^e$AK2IspySJhBJ$1_63ZM$hrHev_CczOgQUE z4*fHX4=;zZ(Wo(8BWz0SgmJq{@+=S|!a8D76Kkm`k*uR_L^v2Z8cBMDjfh3dNF%j? zu@N~A+k#}yB)`U5M;6x{WD+{5uet_N_S-Z|n{Qny(iOD3w<`nzVzFQ#oCBqn6iful`YDYLEDJ1DCf@NP;RqF*oas#d^Wc_U~EK=L(Z8! zagC#yra{|?u-IS^7h-TdL=?T6R+9Bq8Goaqc-VcoK-`;`X*XSFbdI?Zc{$W+W{rS1 zB1C~qBYLAq@d$52tbJa3f<)SgsNY|%X|cviWXoG8>4$QL7Ht6A=!thgA-AY>JfDJ; z^OY+1t;&uM$F$p@pk*o3nY$>hD!OfunY zL^2%mHMZI#Y(%VGz7U$ow2UT;SnhaXadIDN=10OwWw(%wjwj6&Bg#eu;X%UC-PHS< zNh+j`h>}|SE;nG5$-yWN3-L0u)wv1NxZ4$$dxx0TrqJqAE;mzExdUi7(FBZ*$hDK& zyjJ!UC9gA}<=QNU)$H-4wPK%h0U~OrhFk#hMuGe zDpbXrAd)W77@$-5?jC5Eg0Z21pL0mY`45ilP4A|HstY)MA=XEY&k4o<)j&X;iQelr zKqa(F0}MQxwzZCwDK@NSD%Fc{u9r=4&z+hIlqg8;RL9?GsA-OOdqce44e@q1#Iy3X zxgAy(Hsi@5T47ve?R{sn>fPH6?e1o18}`M9U9n+LY}gT-_CrHUIdFraqyfeESh(FgATD*>7zn zR&I<3|2_imyYRU&=|w#$KDQDWu|F9^N3Kv>bnA4NpF=Y4WD&W40l%^Ca)1lCjgVMF zS4@S=c#>luvEhV`O<6Hga?mTjpMtfn>f;tDJp!^)b9h#^uQl!)<{9Y$nOK~)j^ijR zsJA$OnWqVj&iRbvfG?nBY()Vc$k)vZz!5aBhI|C2T%uegCh)ZjL+%xWh3+q3t8~8B z&@j%WBMT2=)RNFXd5vk+=c8F5j=AHfflq^>IhzFW1FE(AA?Ib;TfC*--oD~V#6!StW zrecgZe|rf`g)?nBnJlqY5(n(S6(eFAoJ|0$l%PfMxA{WCX5E@ToV55+PaqrWvd^zO|(DN`cIEhx(U;OD?h;e&9 zd_6~RPnW&d&XLO|DbKV9Ku!exGUp!3qF=q`jtPKo3#DXzw`WGB1aP7cf8C28u zrLzO>a}T|3NvCF06~Lly!J76bE4ab6z%gap zDqdk#YRSED5wG=F$+Q_;Gnr-kxJ?oUzXhjFwM1Exr(5cr33{C1NDzufD!t2oI|73_ z`FKrjMAo3pS5SG9L{5zuNeh+(mtA9 z4kWliQ{F=Fr%KI-wK^|`ObjvSny6w$YHKb=G^6JsxR)g$Z_Dh}hPxUTd^vvJ!YbTx zqEcqbru+yY4^8phF9K_@j!QfpS8z;N;Ql1^kEZ;K;biu5_++E93~sSR>5i-{KO&m( z{p#0LL!pWIyY>D}yb>I|CwIxckI<=Kn1o&?+ z$Nk>r{hAb-3=vwrsVkre^)Fh7eT5fjn~7)Dlo)GAay;5vTOWGF;;g0@xKd!#GWs%_ z*p_xQ_JyDp%gJcch&yN>rf%(Ue#N$abll#@^n_yYX76$gy)f^8gd3UR@r>T37>jLg zA4ujzo(Z#{tdh^&`y1`mlyO)>5ou8ZxQ6*t@rOY^ zON)KtDpg{bgZQi^gsD(1l`6MGDv7_JwKPJeWq^b}u^lIC?emjI_p%&xq%TY~`lB4q zn-+O&+0LViYs-=S9Dq1oXRzopkQ?}Cg@ucy;^Ig8-oa&+ zvpi?7vIOFhOqRUb+2$1;wMpX(Y%xh*ZV9ifPz_}kx!zQQn4aof z_P+FnT1!V10biZ4nLVf&!A~u>C}Yxt9dU~O)EW5B?-NfcH7TNIjF0Kn67k7m9b+=1 zq!v;y;bs}q`Ir%c)*nH)eCjF`AZaEIW*#GeP|2n|VTb^Q5whX+5i4-)1b2I{oeMr^pc)H(6_ z)esL6#8zVSy9!vfnPP!sci`ES6&7&ZN{-FAdcBnU*)S{#7*ZBNn-6M0E~25*bm8&s z@;s>AlP+DHvT6}7Qa(vwFZ6x=y|p7_kSI*6d6t^SmYqapiwV@=!uBhy=&&$jryB?Q zr1v_^@+1j6PLdRa(6Jwsc#A8rBUO%1fcVy7Uwc65r)WN1RlEbH3`}?m-F(XX8i9fr zpRU2zI(Ev+v2!q*Ootb524Vs(!A6XqFI#UHCa@w;x(8yi19|qYmjD*Pje{-nE1+T2!G8yh-9#ipmEkKqy^zEaoyxK6j=le~LOfl(!rzhao%8r@h6C0iGhu zPOb46wnJJVwzK3H?8h_6d|m+%X9VZ0jWwC4KMZ(|qj{I69u2@&P(lWKDtOzR?`>2E zL2XxJL*$8XU`>1sW&&1~Il-d7ALzMs=wT;RyAjb2)scF8PYB=UarN-ESVk{XpEyoI zI=Q>if0)v5gy5UB%(G1~f#(4D_Xa=5`1!B?p{=d|2mhGH-`DV)uph$DPvYkn{P#D0 zgG(n4|K0W9|LX4m&dsf@kMTYGt&YZz0`1x!2>HL*M#2F!|!t6-|@S*wtf)(^sjyM*4D4#XNB*7|1(=#2ft@)>!b`WccRSS1KMN!e1h-KBmH|(#$N}W--_Q8{AT`Lj^9!K&9^iir zZTMxRcYsgazkz!2_s97C&jass|A_l$+P5Q5;NiEUj(-Y2duZq1^lkdPDC6J${aaiA zwW>Swg@1n)upb4^4}pLCsPnI(%zwk@{cl0%kD<&zkDq6t8}e|>aQuYt((gZs_Wc}w zeiifs{9RRte+hs8u0OD~_0OW6|CdkyHk7x6_6_j+hw$^z_a(<6#~#NbY3cFD@Bh@} z@o)b73DD#m{iV;MZ#?fl=lT90f?o~`eD(QW0Pn}}6VmnX??wH89(B@b{QKK|-p@AV z`!e$V2+DdF@V}&Rc9H(O6;A@)|IYXIXM9;7d-}i3apwR1IpECD_dklC{|rBW6F&#| z`OLRs9N{P6o#5~P0{un#6Vmvbb1{5VUQj+zCUEXCo%51%gK~tjCgAcn=k^bR?w`TW ze~F)8!Oyq;qv#|2e1e}J$Ily#p`XL=@BB6=FE}6nu225~q%34Z4I`PcD7T>iV}=l?N&lm5@%aJYmKpLFj2 zp;WKmhrhocKZO6gpxZXazVW8R`*;3v$N|v#pFx}Xe*d>aetg%~*8ljOTU$4-L;j%> zU%+p|{(J{*$2b4}xj(qI_55>NTYnb6{}z7!4AOu2%GTEJ#m_I|=U?`Dh^zm-`i`wF z@`LUF6ZrcN{u7Yd_)VOjL79I7W&9F;z615C@blfM5BvB5>iId;nf*J&-)Bf?o^Qe5 z>{s&Ve*sSduSuW$Ar56+kg5FUKk}4)$-gOIgY4t{C9RKl9bb0v&3+;t>4mzptR7&$ z06g;WYt6Gwc=bKt`_JI#?|`2iN8b#7a-F!1-+vrGU8Em^r+*v$_RaYD4^a1i1wU-t z9K8Jnz~A47YzO~;9qFIB<@nFF+I`h4t^I5<-?%zkA&<_>z{RsM!eMSDQ;~VD! z@i*0R=K|Zn`tTp;1%HRJ{)>S9Fn&13LO;BZu}2*KW1HE2{(bI$^Y7oHaQMxC z9Lw&n`hO`et|AZR29&NwnfH5uPg*_v4t>OV z!L+}O-&#KX3ce{*LfPzl()!ka(*5Rm548E4W99RJac=VaM?7ATb3b`?YwNH0G{PT1 zj{kO~@$X;6-~65b`)i(*1ca-;eM+w2QPtojG>@H{j_tW8Hee_BE{& z|0~vyFm^tRGDE$8+OI2=YfK{#!n`MMIIhCDrtV6ek$O4xV&YS$q4$4laAJtOZqT%ZtCIGiG#jf(v7LNuhWkyf17k~O>i*P?IF`fs39^7| zZZ1ndi!_dHt`+Q0t`QtxT#G;LTE?-^)~7*cb1h>%S?|)C&vgBd>sA<>-*f}(4?3CS zn8Pk%B}zW4%Q(2{M2oHqyzHfZxXCwS9 zKzi&4=4E}TZ?LR<{U*Fk=U}_SoMD|=Cf8%?1))9E6E^7=?p>&py-ok*Via9)|UT_`e7`95=s?pUc zhyU{V6>I}-b1ck#w(SJvlMd_5ea0s9D(~;NnO~dCr!fE7Kb-&UFOD1Xneu^r<$R)S zV?V9X29C|Ygx|ztKM)q?1Lp{3U+7!zmpDH-SHpbxRlwPw-vXJ>eqf()9az^7?7z|+ zAa6N-G=Et))|K@n&&dmp6SjqY!ZvKGo4pOsSypMS3FGje!@5eGKZ@Vv%PsuoTKhlY z=eJ>#dw1RfvuZ1NvBHCmlObNCwt#lTvV+Ni?Dd9}$q4uq4+k6Kj~ltc=G=hCWF`MuLoUps zaB&h5zgMrrHOf=@`cxEp)x_oAWZZ;G^w0Sy7zR79|;Yjd8uGUyl{)FGT&v=?EcJcDC2hZ_K$?4mRe*1bLf6 z<%aLuWbg%VnB}}LZwAPJ{8(-0cxYG1h>NIr=;3XKdB};2)ldOGO-{aYut`3!8h#mY zc3NU_^{y`MtqZfm|K5;^LtG8M!0qZA{LeZ8*}s7IaPJ;`$?>9&`+H3>tjvtQPdDOU zYjPCIXyI4r($VFt#~1_!T_vE5`Ak_m%5=D#<04=?QZ+uuef3khr`}rNtnzZSRZ@lO zRYSft+g|j1EU&<~mI^JYod~a+HLS*=E)#l}wNt51;Gw zk9k_5`B)s=G5hDUQ@q%)ruM`_KjKa&oU+yugzCR$Ot_`2ZCMFS!SG&FpvP6@*0tU2wy3195_OuQf;DX?qPN1THI-QN+NZ!t}!SHOgW)KR>dcIa~CRjw;OG6ln z(>c8D8q~GGj^Sc4YgoMk3Vj8Kyiw9#;Al{7F#F+)e9^Shh63l1@oUC2?s)S0S9^^v z5U5~wj$ldcXp=o60A6#^rqNdttl76=XA7!*JC^0q#A!|&3K=zpF2U+ttktFX5F-&483~3h7@)r zn^5axMPJiA-SsN!DE&eur6wFOSjdW*$)*f8;pAqU2s_9{(Y zot>@L$jHfg9|5pmoSx&x6|6+P^EEVq&>QbaS#R3Q!@xOxIqAWY4V}8hRu}rxZ#o5Y6NTR6Z!nO6DK|>j)R%Wf*Py(q znokyDJC-j-&{Nlvn&K%y1m9{EW74f_J0nbc#2?#$oX9d>m)-z(2w}WQ71s-7sbk~$ zP2init<`u03nF&y#?~{2W~L1qyI$2_O{?B$4c}JF(Y^MJ%amHMnP=BJ`b|O*wz>V=S~woJa9j zx$rPMaDNcT;$@sj?;O!hU>(9ydW)4P$F6R)93@EGn;U{U-C&rza=pUg8I4HI7F{WV zUCfK6?SwqRwlzJLi72R>;Ek|1n2+bf2F)sv3njNT13QSzO9`pk+FFO^3AVR)(Xvr; zSG8~W8{5UTJXHQmq4rv0wdUC5n36K^2H1yl)p9EYp?Q5)`A-+4{?5+MJ1umo%f>Cb z5JD4MxGpGP!lmf(bTn%zC7{TW=_Ys#!a8eff27zva(r+ExL-(+gmSUS-p8!I!9`yF zQ%1uMKwJ$F#P6(eT6!Fbtx+ZuN)yS@pxOl-m`3LpP1~h_bU9o$iU~QG$8lk+>g|@$ z8;zpKudz2;R?C3WY>V=RG_Rn61mnFli>rVo=Vm+G&=*hJPpN#l?Fv^| zycH(2a|@-8D*V5JvV*pWrC2u3nTM>R=w%z!wT9m!aAG0cX~EQrWueL9RYL`OL)(ID zToCM-U9X{xozlvW|GiBvyj1h%lr1_Hd(|dQF{O_B(`DN^ZETgv^#VG~@bc6@N!hkO zm-ElZgVEsavoVhRc(Z&oB|#Ef=Cs%l%Jt0J*<@9WnWfYUu^`wZYr3&mLym+^@{Jk} zjBHK7;})I0hTC#LXmPQzn9epCYSKp3g1=8&m2+DFvTV)?LH)Q%j)b}9s^TWt#>7Kc zZk_=F5BsggDu#V;K4k^8dFTMRcH#hMFkZCO*CCY0n1jJ!(>67MgpEKWfgu$3R^U3? zRQNX;i9sN-KvYN+cJ5GMBJLqXe|sI8M;DqW;b6bX4-$d{`IJ1I5uHC-(Gv=-VZzS(mF zKu+Su?j>+d`GV5id4bvfwi<1wX14F%d-t|i?&~k_ zr6;5k(gUG|5{i^i5)dr(FQ8aZ0)!S?=tW8(2%(1}3L-?5Dgp{32+|QjzkmwJm-_ph z-FshNVkrLg%gf%~ot>SXojG&*Ih(q_eU@`@-L-Gb-rvI4hCW9c!h#Us5M}LWfW7$o zj7jrjt)FAg?gihF`nIqCwFe--!Sgme;XlveUh2YO8K0*4tp3+)NWJwxw~;_=jLg_) zyJQViJNz>h^lPddy#KzRfuS2Fcm^%`J@M* z&EfxNz0W~15~cz-Qv{BDE)Wl@R6aeY3w`zLhhh1C z2Jcv}Azx%$e=krWT_mD|z(PP~I4n{59`$-3*jQJet@&GDd&2auzdh7ONC-Y%S>Jt8 zt;UDwzNp?8fCtc-@Br!0`kQLhkS`>CHuyAZNn@V_IE`ut9P&Ap29QL9n52|@-|UM` z>+fWi)vlf=c?@g|2f#rF@dBSQ*lSl89Q2tY$J$lXDf&`fK-TpyQ!i`&%hYTn1pnN+ z1KFxSx7KH~nf14YlJF3ua{k;#2K8KgOW>@4FPn|Q0zUYV!$#G!dLBA%44k<4AG6QF zUrk+ypt?f(MXaan9|w7-^K$B-9E~lFDOvt=WZgiCF8Ruf$?+YdUDggMt=PxrXj8S> zRG1yMwZmGQex>#Bl9IbEO*Xr94>9s<{F>M%lqLFMl4KMyStH3JLM5E$`*M_zvDucM zZY^ic6+2crZA&9l5Dm_9q^DS%w{+h6JNs-x+@7~MXX%`Eou?9M%c?FXLv zRQlBWNtd(7zJ$ldc#N%C*}79H-K-qD-zYong4byqvQd@ud4DzEWZ%u`#$%YWM|qy5 z?{%$*{o#O>$j);fm+a{rdyxW&0ubI~ky3)m) zEq3zG*mw-(Y8Fqiur2|qjCt?i5a}RwppY#u)*~z)X6a!T4NGt691p}&v-FW2ItIu+`g^9y>Vyk>Mt;!A%{#5sv_2FflOPz z803&$L8d=X4|%{$*1bx1;_4LcrX_^KwpLSJw*C$Abz(;_myvz2l6U% zZX`S8D@d=PfnR3@X`3&h;9_zwA$=;@InEb#spz)%fh=eM7XA)*zV9d-?K_QU9IpQ- zigfH8>K<5Nxq?4e@9BKi-pAd`+1p)+ntQstIlH^NIt%p9<+O%_`|)Q7c8|9G4i2=p zgS}$`TMSavjrF2+;M*J6Tibis3qgD`LUc}9l6W@rNo7z5>!ch|_D~HfW@FjApkBWA zICKI#4k9$dm_ZE0-vH@Za&ko`^Z=F}ym71Zfqyph2o<%2AJ5GZL2{;D9CK1NPkbdUvH z0I~{1!OC)#wGqJIB4vSW;<~G?4=^Gq!E>|)!mWJ^qvZ~>x{c0rfJKI<8-Yusd#wpr z8yH5#ae9Hft+?B2@i@`}=sKap*K2DV3^Cq5dw(0S02TrzXlc+W*#pO*Di|jKP2*Q+ zL;cTXa^jjPr?s!X48FWOF52lR;4B+t=~-j28+}@{7qF6daAgDs?pbqPjHpDgZdeWk^Aun~v?ERt8_mS{W$8D#?Z& zh+Rh2m+N4@u^F_WI0$W74>*!vDM9nNOU?n4T~ z(m1L=$KocdNxCmJ>Ti-ALI`nYjR8>stLYLFpVV}lNG8tM;UGyEh6$FQAeWF^t}2%n zT9t*?B%pg`3#sQwMZgobjlGI2T4?EoDXAL!21^68N`ronqx7Uas3^PKH>kv(InJuQ zVXQ?}JIVW#qKU>)v2Ab$4JQ0ML5W@mV)?YzB^^=|{jYY9CxY(1OtYYE<&7ND$O?*Qpq)}eY5KSTzlRlPI6N#OIPL$kJ>iSEp=rN2|t-!gtXt;#zP z>Q&Xx*%6npEGjNWr53VX%zF_41tq@Sp?dMSQAmK4J?aq>PUG8pp+Zqr{}}-CH?k_& z-dCoSaM90wtej6&&aRoJ81p13>~w7}(*?8`v+uGU1}auQWLZOh0n`~Szf&-dUj+>U zpN~#IMvtgRg}Hr!+MlOAt)@eA`MjI+^0}O!r(92dnX*P#c??+lf?wD^{}p#9Z#$!0 zo9FxUXse#h`XRasuRaH(iKl8GL`-??&jM!$VXaV7dp2I_e9dDlYkz$L^Om%Ulvni_ z+&+$;VLB8Uqtx-U%&Ybh$PEO3-UU~gW1mR(D0CuSDSywvy3evNV(SW2$>A+Q8+=s= zP*v6=*x4|^?1EiY0k>f!XbNx+4Z{iwCfHMR;|e*bHe5OzIp5wRjci}8mgA3Uxhg$; zgMyTH6Y)&IVUDWu*ux?8oraVA0?U40S z9{4ecZ-UOisI>8K8Pw9d-Q6Q^y(Von<%`5!eVH`R-i`}B+4^7l7V|h zAw`qY3vjIE_!PBVg>O4eZ#fvt)yx~GlIS+l(O)Ta63p?3%DMvuzzYPz5BwQe zu-^5j6hE)R`&8H*wuNAE(cyoilaRuY5lU-0emLuJxQxQepm&S?`uYz@#WfC40K*DtO)_6m^aGBIOGx>Ppg8WuCeErkoX z8(p;d2pN~}VpyhP+tIR5X6rss>{>^M_G+qJ^i*C|^k}=E5}@)wX#SbzpFo+>C-ZWb z=6iMghG^i@dGp8f91t^h=5l{JHzxpWeoA^rc~v>S3m~-FG8u+W9x6&5h()$S$A##* z8)1u8CtkXY0gNmz=KaO`X7#BOET-RX91N=$T*>u=G4=hB`o6cmZ))sM*V|j}m?S6^ zlCW@()`{|=5qQeB&ZHq&srtLYkv0aAj;8Q5a*J*$D5_EcD=$zvC`n|X5vvU|h$BRAoc7#(U_!I||0Jo1C2d$gSx-whm$Tsk?qWzMHD z<@U4O^IhvBZVNZ}HpI&A!W1% z5VRX75ns#v0CVi%Vw>Jv-QuK+Y88FGuCQ21^@ADp{S?{rYMLN>K+j5T{aUrKUmtJ> z1HQ3fbGselstQFrC}={3+BHR0n{4cS4m!i3#*V%5?t~E&Cwbdt>oHHSDjEJm^lPk8 z)}o&U)ui)5zyR>eTNYi~0(f85@)p+*?o;)H*81M5?{}{654*8tg5@rDpzP|RkP{k# zK7j?nu}9nRuGVR~P51VNJWP8d+zqF4nMap`ZPonl*p0Y94^<;r@l=MG4vOD4GCmnd z&|6B{ZRWfk>MBF)$t@ty?V;Hr-jR2Rc5JnaE*MBZ#Nutu>mQgOb_`P!fL(kuKHIx) zepDhn<{z|q52Cu~yItXM&v?x)D4~$`02ncE~z)c0$uGc_P_GH9Y1CSo32tDAq%8~g<({e z9h$@*0j9f*Ei|6qM(vvFa98ms&W)nOUCmqF&HGsHL!Nb=y(Q$oEx;28+@puv6|O-U zWq>nX3UvvDs~H-aUBQzW3?7C`bm@N1?Qsn>Q#NlPKUE`y;viS)(HN6AZu@j~6g-P-kxU-cqCP;RTerfbibde_b(K8@%weGIAgM&BScTE8%huOs(lU<_fL zmeFtMbgZ52&?mN@b*j3Yy|in>e9^d(-EJ2_He_52&?6h|YkSE2Y>h$I!lpZ$F zcyJj?g`o|4Qv}9uhRlOw2u31+RVL@>xIr{g&0(IcUDtKYSTo*E+=8P=W@lp*T5Y$5 zQ>n4J*LB};%@8HP0U%Q$*j6^bbKT#&Zj))2a;U(6=bD$?g58bR_aI2-+##+ZaDL!& z127lTyM2H)1z@fgJ)sI;B75o-VJ);OaRn2lWx^hpb|Y;{Krj>q5VG*VCS2*f-*q2? zal~{e@^{|10ZSJ|g8zQW`rpvJ+jKoCTrw_VfiYi+u;%k*N}J zRxahvef(}@)%LL_z#xLDf^m)QU_iA#6`Dn>q^k-gvEHeUQC|Y*CaZ}?)%Vw``oT>N z9Q$;70OUILZW?FR=7N*vTn^jt`~{pV=j~hp?Dd%Z204?zlkuZ+D*p`S-2Cwb?%U5r z`Ek}J33r{TlQRG|#AI?$YJOA~h6erda-CeP=@Om$k@hdb^hOtJ*VgBYmGB&`&e!TH zt@8dcS{*GI+W|`x{8;-}YVVgCB(7zJh6zCUDz^Ws%*V=4DQnQ|&muOn3s34?_MGB0 zb&(DYkl+PcovrOZYQM$Y2_sL=F=uFZW3`EWo67%0<=)`nH7@>@)oWlO>1H(oY#!@Z zSiQ`VuZrqyJ{MT8PjpxeKfI^}VxIESQxiVi<`>OX8O(s?wCIAK>jI+$>2dw@N zy0bv)`)Y*AS~0JK32hQ1#s>Oq6-?Dvu{w)f(DCP3+Rz)CKeKucl?vc}!FsX%JewC- zJ&(2`J7MPu_Pfnbl$oB#yR@21b>sjeWsKwstQcr_Sr@6s9}wL_d@fNNU(O%=2J=lOoo3w;571rbkCDGUNX^Z@%U!B_y~ z@Ho(Z!A>B3=AuOIEEZJ06>wnZ{22H*SE#`D*A!HXO{$tyMwC75i!DCd@|!nqhb@v# zm+Dpu?@ZHRc2I3o)2pU=QVSH%tq>=Bs0C9>Sg0+dnhkic(Jj#XIi_rqyg|8&%(xV) z=l_kj1xzm*k^cTMJ2{uqv+J_mW(&t#warqQFis(Pxj?eX#rY6meHHo=tQXfr;jqGw3~q?8{Yfv7#qocC@EAZD>EP{ENUeMi)b>)aNSy9Hq`z z>O588yu-Ju;4(!pJYA|_K*SURKK{h!Elei>19ZIEe}pgwkIFN``ZFFPb-7AG_fn-U zRQ3hR2DqA=Is7R(p4y-OPINF<)zRc10*U`vYJQuXw_s^u?{#I~P?f9EJPg(9b#fs` z8_07R)Vhl~IEmDWL?@753I-|wyf%~hm_V@Arw~ZfZh?!c0&)SP7jp0_(JS@(kWEqF zyh`d7P_5)uGJhfUDzK&t^N#&2WE`MbvYX6JY<@%GecG>@>veQI)fEsfo$m=!dPg9% zh3{f&{*t;(=kPltTdNR-Gbb3RuqR;7--C zZ*R~;y>dRJNA;F_Ot0$c>Gf6M2_S~XPXTd!3W&2#q7*ZG+YYsAkC63(yaQyqaiBDv zV5z`V8Bc+5X6tn&aS2I;Vd+f^QI~IqhT~#7{=f|^o^RFWTQ{rJyf_2u!P)ir2;%im@2CTT?tKQdW zFB^Q8z58(K4D^n)GmK8w5bh_G#QGc3VjkR-r${%|h1^9qnT1$qhulvGZ)W-Pz{!F* zQw7{{l=3kOP@$;6W#F62kd|=xT!PwnG>Q-=Twi`Rb zL@A1sCN}qzdYJsGYRbVmA`eS<|F{I4g{zC~z>@D>#^y9OC3uX03h?@}-l%T@r-+vbh{uMQE*Z}UD@u7Sh? z!&}Ox%@r<(SV}i ziB!?>E#4b=^owO1R+**%4I^`1a{J#2ggY>!Av$awB+zaKo z7cgJK`HMMJ@S(76Qg#c3W6>H!dW^227vi5W(2rACbc0Jt1lzPHTLBFW6`^YhA9IT` zW>AOV^B{K5#kBoVl-tB=hjQi6A}~b+OjNPKmjdS~9RwR^a2(O0+=&lW=zfKgBA(qz z8SC=`-A&KSP`(XiV*Mbg@9no}n$>=WwoU{#YU21|z*6ov#E((_Q93~7A?N4#=Y&zU zF`m;hD9F>(3XTO9Q0X|HrB*`G#{~x$TcAmR3hpU_Y%oVYHi{v}epY>muYocUT+%Xr z0FDVVwY-t+A4;oFNq2M$!I=somS7l}Tvimhg~|6W;(p_+3ORVYKJq;wllfN}D=1HG7N zm%;6{gmFbX0c0G_qhSr{2Forsj~LPi)~DmcNu^+*-t-8DPU{jS<_1q^$1gNPq%_OO z`P2&H(Uk z3@M1L2}K?HeeC4`5rTLl+8qWYnD6rfBSrm#`W+*1N3Z4XY3&)?z3e$XS#^;K@nKuHl!VQX%fWx2<})s1jVtzCOP zGaI*T&v-ex1tmp&s5L_r!T5t30`h-)EDjZ7mBnuzV|>4kAl&-Cv<6WPwZs5$Xkz;` z9NJtTvks`W{Xzx4JOkwLrztrc!((|Tp^-uke~B@@kclmxYQ6PUo4 zzKM5EK#Sqs19=xqly~Lv{4B|*mC&O4NaNE$ddU!TCYcv=;73LLRaZNgidJ-$YL-3M z_l@&G`$D~5Pko=S@0;rT-W$~dOONM0QtW&rkH@~9?vgGou%4yv(Rq)K1sf%to5&UM z65>-Szl_?sEgk_p388jcr28iGjP~hG`N??yn3KSSGtsCVPqUk0B5aPLmX<)}$3ciQ z5XRkH)MA?RowJ&2UTdK>*VteU#s6owxvbBBE5ArY5P3IO+?~clx7@Do zvLRzHNP%iG{i1Fo8w&V_sm#uH!Ra)@(zmmw1>FFv1;ySneO}>oE$CQR|I7X5uv?`!dh6V{ z?)kb6A9<RzeJT#JXNOb&(^Y0(RrBhcf-_k6eWG-7w=J}jCrq{Ww&zw2LoKY0?fZw{C&kZnu8!0`Lf`%f7|kcx-1=UQTP*z(ww5|Eyoo(hF|;ZX zv@byM!1ZyV$&DbfaW3!8R-1zcYOlZ8R@}<#D8g3{(p?AmI*=i{3d;!=u@)go+41rz z{^FVD(;4RN382GZDHqe%vc;R6PNOWh9b%k|jqElv*P4~UF~II^>Vm$NX=u|B>T7GZ zRgwcv$z-LoQsS@y?}nQ}8mU+PJOxYEMU> z5AFyOF}RmfTGqTraT74_-G!N^i2W$TTXQvEr*IKrK?4tM$%pV!G*Yi5)vr$@xan?T zP^F3~I2k~idR8B2I9yV!99t|bDV~dW?F2({vf*!{tMa0=dS~Kg=5Lbz_NBj3`ddwZ z6Ud+LiEO8%gFj; zwAG^+H-3RivWJ*9Tgh3r;?;&GWnk zRC-%-^*-J-dtjO1(+|$;>i~}7pv1GGsoGTGVh50Lg-1C@xeG~v^F>;62Eklwfz^RF zp$tEp2>Ps}^g`MT9msr?|4E<9pf2N$>if#z{brW?CxPt_Y)i>{LRIatu)u}zVD^kj zrlDadS3l*pV^qobA)TPwma0;knk-o9h>&{05C11cp7aXJ+11o>OFMqPXyt- z1AfA2Tey~0yhMqmg;(<=*~8*eU1z_V?uJ^zeTnTJ(`|Q}C)heu5C5rh?@;mWD!NnA z&(*f8(>}sC7P8=e=wn{f-KysvRWs0)+^aetQc1B{HUCO&1HHhuoZPCQzL4Iw(t}2< z3ipU$$dh<3ZK1o>bUbT@R2dEn*#72CwwIyv!|`r0s3YkP8jDGl4!NDqCh73bw`|+$ z1R@d75&4mjkrV}etd5fLrn-|&H9K?HDy&~?Jsl8bUuvu?DQPkg%@K5=j9-L*$nNZe zgUabmxX`4A8CVWndnTw~UVBN@X4+>kZ|lzIcB4ZVHFx$Gl{$=Fa{bm)vD9KPqsD}7 z10Z}Xj8m3%5%Cj>TP4Z?nlN=D>}7B3E2fxJYvvQzoVkyE(;fh7%IAT#;gQ=U@R-)M zair6z3mA3IPxBJoE?Stnh4Tui)tci4mk_99X(LWJ(jDv(T>S+{hBl z<_SoCFhY%{Q3(uYL8LavI=4L#9-HGX(`B~Ff6IIaff$+#p5s-$g10%m7DG+ zP+fr#eHYXw&?xewDpvMp}~fjuc2u`7u~UAc?uMm9%!PchcaBS=J=2_-Pu0)M1K?78161` zAcvBy(7hu#sx6YOXx^H#jsR7m8r*=M`AZw6k660)|8*5*sw?=8~mk z-g40K!yuz04uUvxm+TH5!%O~3;!8;{A$2UgQ(^jtJaz%O7gDR^V-5?&XpLg=l@ysz=Yx4t zCP_7`Ye-MTIOEy7Lm7!VLEqqcWPr3yrfORBCM^W$91`GnvK5X1-ht{Ez~S0OfImEP z4E*7Bk7)%TfKrs~VSQpJvG2*LIzg*>9ZzXK+4iop=~`Rer_7TK75lxYX&zPjY*E%+ci}`4>IN_vd>|7`kQ(u)`6v{+0 zgiob46l_WdbOZ>jfFx?1qKj_ACEtVL&3HXAI+~*x9nI~Lj`ec74nv5+Uj^JI2egW+ zvLA1S69--wVLiqN%ay%y1zqWf+d#{p*G3=@)(apEt~lASKuv*r7NCw!hXxmLJ|nFc z*}GdeyGcF=4|fdH&y72;<20Lp>3Dy2=ru=O;hN(dvy#nH=yl@{F*q_<55f6~UUt&K z@-SGB!3b=0=ZjAG3Xb49lMULR96DOdpgk+sZT~85ex}vy#{0YRZq)iWN+0i{p-bJy zsN1Kw{Gc|zxd$UP(XRbmrw!?|UHZ8+WX^T@7r;N}*K++s+bnU^tJ+-5?(tA8dt(ah zZZ@zoR)CeTtUtgDjn5(8j_2?J9Ld6w^?W@r*eI|a12Y7c7WCDtK_r0BS?q~LB=dL>RJeC4Yw-s(@a^TXjkn59;7%@x^RF(I5SPntO_Q-K_ zXBl%N`}aBa$tJ=?yyVguM&SMxpii)saHmKI{I7Bfy8vj5uK8vZ48xGSs7x@c^THzfCHH075G9T#vU&_3r$_R@p*d2&$@lQ7HnFh?MenqR7 zVR=_epqf+18TWY8g76zG6(hbBK|T`oFBdTT_G_N=L0~`4`~rutVcHHfl>^)+qTE2c zHskL|pj)eyCvcNIj`gni;5ZQezW;%vP9`5O0vEKg{ho(3jSfREai4}@V_8jX4KZ$c05_{cI^V;ul`F}m{HlKdt zt4}=hQ`_8z*^aLg-*7C=_dHl$PW7>(ycCappt@U9@`y01ukr%!a#D1c<6kIQ zOwczs(48zMAUwQcityn4=#7ZOXgX|~A(j&iY*L#SZ(y{*0d0`& za@g@QinFt|8KK%*g;Ul#J9N!ihZXih06G9l&u7{CAWS&+ZDWMFAV+& zOSS#|2aE`RL?oXDCt7_8(XP6S+hOzq6eauzh){N(d^Oj;2+UtE7V-fAC-hBl#Qbi6 zd}4(gTOUOmH`f1XgvLU0?Nu;=#h{bv68UCoKR!q7$K$MgyHW<-gvNtJ=PsHL2;aV! zLnNT~OE6j(*s^k1u<#l864YqMUis6l+h7DtG5;*k$3y~&pCtMNsr$$*X8kc(SbB{# zh~mG=KORmT?g_B$*&FJ97{A-%jex3qfE4#Ih&O&ona4>#0XqQP6LH_k9OJ&naRHXP z=tU{oP3;LOeTxkmNa8|>WcUCo>2E5OCHh!`4)F&fJZH313+)6j!7>VALOXt#3!n{% zAkT&-s^kGaY!H{{6*&R06-}kNEE>1zg9qt68Km)6(hj=O5yHzhB)AF~?13FZKgc0U zPKRZTkqIj}Gl7RIFrEg@*sE}c^|Qtx&A=d)U{upj5&e**l9Oa2lW zq~m0eCg~wENVyF$NL?7Dh4n%D9hu+DAUz}Zoth33ie8XGdR~h5P>W=c2Iv^PxiCoA zk=`%k@0JixpdWtmAb}qmG)U$@1}Vc-^D{`gNd{@se=|rjd{r2>vq73|op0)pbQxom z;LLxO)<4tqQ>|8NvzOinZ}y-TNZQZe4MVg5BXl+EJ1|lhqpN_U&0UO9x?9zU=`=E@ zl7=^chChILRS7ViMjc0Cm=;UnFO*sh(&KFb&N1V|ehLq&bfCb73OfmQ6eIN`EVD0y zr*(%4w%C$^2&ao3b%>gsLewgHt|7A9BC^9%={JpnO1&Vxu%T6&14q+pWMXjl&|zO7 zY<(H02U?woIui~RZ|;RbPA%8L>Dp|RJfO_Iuzw>y=6H62Vt)fAngU_co(&Tj0#GHQ z+lLOuz#ZRrr-1gtNjT)V#RS-SlYnw9_J9IHM#8X8w@MT7((UMnjtQjKi#!~=P#WhjB)ND8C;=Ueg+e(Lo^b_b zQCcU7d!uI5Rq^K59V*FJGq!YNcV7Fs#1FEDClY*+9%AoEte_tN4B$|NcRUP!Q?Ih1 zAZ?CF#+g^iTucT${$UV=e^}AcQ2@8S&30;`x3}5L>;phUl?-Xki?%{rUqM@Er9d{X zcL88*SDe303O*#-+q!O4b?Ia+MpdL(_$7fkFep#p;Cd#8Ya*CQp??|5@?5WuvPzgS z->JgL3{>Up5cfn5sGv$b=({<3-!Se$wNxIM;-8T8dKB*=KHess;gY%= z>taodGLd6{Mq>cev-)SkDm4^Zp?#rq7bD=F*29#v=UScHU}S^#@fI}#(HRiE5ERd2 z9Xp%|Df%w)F#06`n6`?x^<2BJST6Mp@Ko=nLf?jbIoQEW>dUDQ(1V0?Fv^zU^ebLo zMT+3}!EWT_;OmiT6PMG`sxA(}x-Xbq4|g44kibDSaNU^cVPITw|EX_a;t>XbWv#@3 zrr_EfKvS&HI{-7BcOT+pS`I1zC!r+;bwU9aiDiX=qK{*|#A_Vyh}glMlim4r_O4^P zmf@{uK8XECbLO#}`F9>#``vvcFGz)<^AQzEH*rIT0q-OnSNA1k;LWsM*N(w*%EY1N zOg|$Lhb~WR6qD%S0VIEQx(b)EK9e#mpW|D=RSk#DT4F8{rvWb#--itiG%FDSB|`We zR<@`Q@Q2mt=keABE~NryVOT1vbX9{Eymu?L;JsVnw2Wz9^uN3i(|kzj;Axib!cf9w zk70x_KGf+Bd9!ic7+Yk&NKom();CCWw+JP&rC^djXq~~xHAaf_{6KFevyuMgD z=N9aDBVG~*q|y=n4ui(J=$vif^0=3|1l*5%G{f4UK_D*E z`U-8&EUAGtd|B!kfgBWv^OgvzOxN%(SQ|s>OoG3X1vS6K!ovS1bcBg2N(3}~h*FU- z%7eWK;V3Xf0^2|&Dq5Gp&1zFlufRvE6}~y9nzX>;QdCHSl6iQnrlsa?AsLU6E&ExP zp738DaSZp_FAX>?WxbP*a3MH=t$2n=Q|%KNi& zUQl#fBmfTe-96DD2nR7>wL&K=H9up#hirP#79f9;+$$mjIA6)`%E*7QU{-4X9Ed6+ zTf8EZ_OVP_CR_X+b71UlIMki3)LXjipE}+v;^5yV{0IWxMyy|kJc*I?Cz+QsJ&Hcj zrW-|%VwR$}kTq)N0wdDK`>Y<<9Z#TBbe_={8qrSSRW3IAN^!JETsW^aDAq0TTDGiJ ztZyOSllOISA%SDY?GWiFe$jgIBuvueT-VpKVlcqzih+bOuwwdJ!sb~u(^_c95O+{J zfWBjcZeZyi)z>k^?$%xTp}HTw4OmO7XkMM{zp3j72iEs6_apX=L+sXho|R4u*F*!_CS>Hp0)wG4g&(Yf_Ak&agyt(<7#RR zfw&?&E`A6vNBuryN?+Bvze28r=Al!at`+?1&U5sAb-m4U2k4pUV#jS2s+kIiSEjm~ zT4LG_*bsOvyEXRiHTv9wdNhcigZH9(I`Cl6we^)s{nYrk0Sb)ndL&T43-|9sfATIny!EKxYJ3dIe3ji>X8O z8CU)$H~by$&FWL*9b@y!u0G98`+J59Gt?dAzGwT6pV+NVGuB>YZ!th!{+ODsj%Gc9 zA7w`3qpFum?Hj?D&4%s{(PQ=%TZj|Rr94`QP6uowA)c2r5qPW^!i6W!^FGuVNO)j^ zQNXIh^U$dm;!<4nDxn1PRpEnFWVjxvT4(Fw?O~gO*F1Gb>~;CwP8SBSZTH@=$L;fm zz@-OqOF)b4j>xcX=c`#FDnJyJsA7kF1j>vKT@D=^{{2-Sc{apn4bdGu44d6!ix)@6 z*&dy0Bu*p!KN;=(4j)YLIuV-vjg(~1O@BT7jy#P`dfndjZs41YvdT*d)q% ze{>33L!bGS5<+wXRLj6paWJp$jo=c@%20lcFU4g`{~gL<=Rkn7#4`X(1E7VZNbtaj6u1$I1wX%`IPSqn z$W;fdK?uhjjimuvn3ABqu_z=2F*}2^4^?q}!CGy8cVG!sMRpqu(NQOSr8$(u z8lQsM(I0qi86Ni z0{6tA&o-|G`i(%n8^$k%s)_H#vWxOpg6&r!cts?jF*d!N(|^gu9L!eR1Gdh?+R;GE z=~J9na(GG&aWFl89|B~L&4)|#=&{>;5}8v#!|C?CzB6AqhYW&%eqnk5n}{$^-`4zH zAprG%edisY-tq-IKO|j-`<={zjEO+9y|g|h>F~UkH}~b?FYKE(emr#k6w)8UlrF=i z)!dYK?#dg)ts}Yewr71j3jYqtydl zBkU2Z$B!{%^%ye^dX3+?gTZ$ts)n7Qg)h6#8!o--N(WZU{kTu!*9N){VKsYIOzhEO znabAH^Pw2GjwbyFrp1mv1Aeyx^JTS-o~`Z;EDJt45e>wWiBUu3-Na>Snz&5Y;LeMZSZ|$Tix=nt^*or5;g&`st`J;?FBS|Sifk!`5{<0B zkGprbewHMarlJRUZ|0t2(n8H~d*4qZ!1}EbLSN2_p+7bcqnY&jCbXF|D{+9xV zKW9FU9PME?-jLH&f83;9zf<(Eu9<>0&;yU36JmE&Y+#?yv%LcxY_myuPBDz}TW}A* z2z3z8=2j2a68KU`i1xSPYd~ODg%L{d#t2qL6oH2CKL#lX5kFya--qu>mT71ee1_}v z_-WYI$60ziw+b`YT&E4MU;2;N$0}2Efcvqh$=3PB#LmH%0ncIWJswq;#&i4adg_;C?L~lnV>?^XZ`6me8x|p!^J>rWlk*V~8ynlsn}#9h9=J zeH@u5BXA>sj?FPSGiE>{xG0qf#_?59|8Nh2Ndy`5l^BBUpbh|B0tyrER&9XHQfj+^ zxDQ5^@M|Iji-4t>BZv~B!Q^!ISJSavXF;R-euMh{v9&IYv?{I8_%DJEQFMyR3$W$k zdFS|CP~e>wV0IBKg0jv+6SrU;B#2w_kkde=91Aq2aOQzH0@q{+VX*{bsa#jSlqv&s zyp44tCpGT_W&Te!rJDS1oqGd(A@g&rPf}_ro}yl5)vbQb(Vy9CaXJuAaD#|yZclS- z1e>Bn?;@$RA`+a`I&;Qm3o>bwRgC)7)5IsgE;~0@3OBe&7&Mlh%i$$0NZ+j-2 zN6F3kFVsajq?>@YDb*Nb0>tapJ=>&i z6EE;R{JgkJybX4$e$e?A{1_@X6J~fcA~g^9D(ju)&~GWkZq2m71~zDRVJeJdj%^rK zpu+HTz<2doo&f($jaiN{+i^}K3#QKJq1x%M&w34EdQb>~fWi2IP^Lrc<(uXzdHB*? zf)MF`SV;=@7`F)XZ~jjNg>q4nN8TasaM!~alSkY{0B>a1E&xCh?cImuGmwUUObi9- zsjNP?W=LEibV@a|F1#;U#A2yqbrp6 zh@#&r0g;#C4etKH-3fqV04N`@`EK-5&io_icc*N#z7D2yIEca)E-(oTO)uGW|r};`l@>|Tx^kb z0Fix@VhCJl0qVo>SBMk>E1CHU9~TIJw}UXr!+3-`McJzfmaaW`BwTYvATFY63%J*7 ze7(5^KYzg6Xb{1}A&_JO2n_QQ9s{rK&M}B(UpJ(y-dsAC5j)D-HWjQ?*i>q8UzM<6?a#HaOg#ucZ$VFr z#EX(B>8~8T3NcH+!s)(T%BVj zV(QEyz*L>U@yrUlUi6n@Lxpm&Mz+k_?Ii9SKrf^dD!^>@Yb822u*(97P=Bme?%m3H zl4|#ZL?H7YMCWKTsFV*-M?fUsUGE0g00Mb59kYBSl6fA(nMARZ`a0~8H&esLiNuK* zEwFuN7!*%{TR7BU;-OoDV1cYf4pdMI9t=}pcL|HCQY%9fBGW2Js%lyg-BSafh{#B! z8Emh$jXqYEG?1?LkG{8`#Cc(v3W41V9H+6 z=4GT{s!!Ro6g-UqgIx#fPrn6;Kb^AMRD7diXg&X>)H_0wuvEV%Gxigu4|R^fd>x<2 ze0@K{biv&Ar=&4mXDBtiHi|~;Ay`&o1-w}DZVW6!qTGkJs_c)goN)x@a`kEf2pjF!|BQM#^fuH<> znVa?{XKow_i_F}-IuCJ5$|@lG=se`o1Z8=QIv)iE%%6j>bePGJK|~eTyR-t`go$dw zBqa4^<=Vgt=^}Fx)@u+!8N*U9260%daW2UO@>r~tG9r<0BTbSl$TH5s4xgwJ@E*uX zf{=Jb?83}j1p$J*_7RzPp$W5_B7}V!^9RVoAqWSw;;?2QT`p2FJ2#UHkFxlF;zyAB zlhqYMIAHiZP^R}$(uX;RfNGqX$Mgo@X}Toem{^buumh~`r{obNRaOY9B?Q&pN>NM}W1# z^IJ_5-g`6J%ALy-pj!m$1xu$*jHZ9X`Vk0^Sd3M7bO0kY#!!qz#{$a_Fe1;`NR?*I z;N`?U+@s(@3J0xe2*6Jnk`{Fuaw=OE++qv_ZJ+jr=6!AC4n$Z-?t#}7idq6r2q|LM zg4o4Roea!RpfaS3IV2tq;1lD+|JV>BI}~D6+FU?RK9hXl5fgRTy@ejID{W;&Pm44o z>Wj5d_r-%zcSni{GSr>4Lc7!+1fU-d{FcEn!it{xn+LGCAfHME)NN0U&`~IrYOwH% zd2($_Z-nxZu;=s)?GGjs4A4%4QGg)tQJ;&vCw>76h=9090&#=q>6*PB#C`c-#N9uD zxQAJT=F1I7e&&2l`P})6F<;{_U&vMwZvN$vwoF*@i;%WYOH!o$-FP-9>#9`0W(DFEsOszy$Qq`r)Rs_ll$L=IZpAb>v)S{Z?@CR$u!6^SLL)GB+4fuU7M=6iL236ZY)nkFG?GKtx*Fe=*lbNGu z0-ydkMb%Ss$heJ67lNz7)dN>A&v5nO=9a;@dJ)_>8n_ycWB0M!1_>!}=F*n##yk$V z8Znmea?&P`wtveAOHFZgvpe>)aP_k=?_1VPF^zU{_qw>cRh^pR>hl`7deQ$cT)mu5 zN$vb_Q2kV0Dx`lE_1*|0M*=_X44%IFnebHplJGQP0EPs4dtq1VsHV@ zOJ%^4NW%lL^i6X}O7x-dG>EX}vP9YE2NV630HuJ zgLOte5xOolnLVeU1CS>1C|15F~MuEu7so zoO@N7kDyiqJY8)IJS~BC4z&L*GONfNApZGR*|~)20(Jp!H?e+?>0PK5%sXJO9UUUC z%NuN7N6fr=Lt4Me=xa<0Q2%0gDRMBv8$Toe|3|$-3^KIyKxz+}CeD|AApg%Od^Nz& zOd?I{eWSNZ-PkkQ|JBchr}BSE`zN$JZ7`X&!Q~yM5wD}GTXmW4LKpYyo^rR_h4~XL z=Gcr{XwZy43lR+3-qd=>DaPhy(yu@lX&`PO+6!*51NzL3MV~nm+SXK`xuYc3*AlA& zF5+$aH@zhQxtN3czPir&3LacA$tn$lDsE?|00RSrWGBFuhtGzCte2Q1ci$Y;TFBM} z0$KNAF#|pa~66b!c^{-N~A}DlrDFPh0i)|p9-=Qq5O);E(~@i(nsWA1YgEBGmhfLNc&o4If;^UbWE zVYq8zCT|yU7&8gij{*pvOUI-$={9B(`5!TpU@-0(tdHCYGr4QBCqj?) zoy{;Oa)01d*1P-yw>38eQxFbXey-zUO~6Acir_|O;+~vj*#P>F%Q%9U9o)-w6heMP z&(Z#T)WH&scZ<5IUblqZST=pEt6vm5k|GkH_}BT^Sh(9729T@rZM%=?g>_eJNpRCJEP zVs1SbI>(lVZ_y)=-SnfJJc&qNt*?NvsMS*A?&kJ*8*81P12DK&i(|}IfP#(9Ry|8{ zqOtyp3)ds4BA;Uy`Q*%Fu{j5UyKr1{55>|CuM|r2J1vyvIyg)K)l|(W1bINngwoN4 zQm_xKO1t|vWqvQY;>?wl-(lXy&Dxzqv)wx>cbM4~`ob%~0>$YY$!InI2wtf!Ou-uI zMD(*Nr93|-RF5He*42wALGXl6nWz^LY43}x*&g`j5cfm9ct1iHiC<=(3*#y(b?ag3 zWl!&n?}P|HGYoV1gU?Yc2KbIi91K<~rqU;{HZlj4N{~L0bE#NDQoA0wjX?v4FQ%9r zToY|L2sF7>-QqWgHOQrHBA3pGJnD9vuHAaOkTl8dDRt+&a!@pm=qn8odR6XohX5v0 zN9^I-0(2MI3kw$VN4I-zmae=Xwf{RppijfR2CwXj9-et+Z;WFETq3c!5Vso0TFv6k zEWKHy`X~wF=mIZ-u#Q;1{Irdwx3LIXdXa)ton?mw?{G_Ft5fk?(~LO#@eI%;3~Hjc zSM!iknP*yhrnMC!$m)NA=UDKLkw-6Duu%Lj^_65H%j@n)98>S^_hec|K(MKa(;~8# z@L7bYKBP!OAR_X*ya!^I{Yj!#I6$SFEf>EH?!9qQ_Jb=(MXB`3K#jpy<;t00SJwOu zzS_9=cvzCMzrk12M}Nn<2PUV+pIio0FtACLC2(kO{H^agoVBfEkok4+-@5grO}GvY z{7SngBEmZRTenk-%QAx%4^^CWuEqa^}oMoDRSlw{`)e|S%!?-+27zdkuiF>*0_?rW#jE+FV`Px zUvpiKzRc5}g%`)*zb|vo&E0G6Shv3PV^!~(>vFVio%PP;_pE;o8GM`E)L4X#7yM`c z;2K}9;rE9&?it*obQ2m5OB9f-SV7M(4jy8ZmhV@8ip zpo)}98)y&-iWb9;@u}pNv5=d>8XLfhCtn`}8zt|9;4AngLYW17g8bnF2(T;I2-ylp z)|0IUEklM>Ia4T-mC8$H#GJi zH7Yg=(u%xBqG*(Nd@61PfA-*nDcSyBC2ON@`K*I{qp8q|Y*+X)0KEHsWNI_f*v$jP zpCQMAM%rUUskk~q%v>)bn%%F#5eW#5NCXTGIaDcd=(EMo-`PHL@r5Sn zOIo7VdKt)=;x;`R6Bp@XG4P_^s1*tsa%PIdi{u`aY=PD3qi5CILohx*6$WqAT?#I~ z^8`hXF`alu(M&Y+k#wX*ZQHby$FtC4QAfovZLt(UqTis-Q8v*{frOyI#&99i{ml0f zA$0EO)Kj@zZ=&#tto_s{F0z8#fB6U4(z}pO1P=IYeyK0k_dP`Z?))Ns}wsfSA`{SCH-zxTa_d;nFrLCn?_B;i9kMiFx( zLMS$pdi3#Lu-u`r3jc^pK|N2PE1}F;fls+fbBpQIx-;5c^?h&@yvLRi^7KrzY~XY@BkhTeyil;dr_LL;*-h<)#Q$OBz)J=I zo#=i^YJ#tN;A2o?sE2U_=aL5wu@o@Yfklg}a9s#evJ7n)y_xzV|B;{`#5evb2EpwCrFf9w2_!ODf^SVK^R5#1B`rWXeCDjhr042Q$s%M} z%1VS$>Fn!3PF|$6!)GlZ9NG@Jsf@82#dt&vZ)_)HrVa%&1=m4Dd8vaTp2o51FO74` zsbeVPH>|-GCdUP2YJ{paYvYH~?VXY45haqL?O1e5@npL>wyhf zHSr{QxBB%gf(~$L^pO~yBf(J~&WFP@UiNZ+ByL6$_xi}C94GP@WPj=B?ZAx*qL#nL z_%`-+{uI0>^gHPg<)4B3atC z!!L53akK&QT-WI5MQ3%9?k<|Mi^0Xkm`md^K-plu1kz<$_(-HQhGe4VaC+g zkXdWntgS89)7EuleNb-;o-XUQ1!RG?#x&Y$%i5Cl)eC57M_;zH&P0;JJ~be?OqRDm zuo3VL%0v>FVO>_L2lZaXH3J17*Fpt$^ zo4x$>YDeP@0lVncrW#H-C`YSjqFX>;TQIlJF)KWLsAj!B(+Ex1!e1DUAC~pFONXM2iMZw%#eWW5JRShxnWd7j+AK<^pq zLN##5uSq+2O6rciiQY7`^ewNCByK$yYH*nYtgfTkJrT6%V0}JW|tVsz0++MydDegZTaJPJ(SRkt- zZMTMHwP<_mBILAhZLzBrguf3gt~s)}reZ|_g#)4%-I@g)^&DKX7ES6mhng+oe*I5! zE@h+ERo$YVP8*|@td%18hXbQ7`IVHpxXwsUd< zC3xAB(km;MY3igieSX&KEbAS(z({+6M#%o?K30~S#dQ^0emvak(CVX_+8jJoR=t5K zHS7qK7bg7Cg&FnT-JW0E%^Xa=1(FbrPQ(b5xkeJ zP(Qh9aO7-nFFghrN#)W@hSCaR`F$1c7i~W{r-^Tb^Dea!fS@X6E(=b2`}0+?Sf*F zBD=$2Av77cIsTpPk*T(jaZZlsSMdR@;O5u5c(=(V+uz9V);9B=~%!5EMy;@EduL#{$;Xzm^ACO`v$N3ox@ctN) zlK^qN#E7(2{PMQ#oE7!X{j@k#9d;~%2hZ7B&%PD!^w|b+RDWc9Y5(i_1EKDX16g)E z_J1?B|8>bz)CF8YkVecfBmN`~s6B8TZ=(^z7mQjsWx?o$ABY3I1H}R1fp>`oW}&;F zec^DLWf;eVBaXGd3P)_~Y{p)zX`--Qhne9YYz~q${iDf+J4*i4U7-mIWFU?$ohlF* zX0;gk^E_R9(^w|2%zW=yt`J(LXvPzaSwh}?`~Tk1f?B#9^xANnez&$_$Tn)ZJ=mF zk|AJ}mx)`07QQkOV~ERJuqbp`_Wc8ayd#KnK!rWYz|HCB1M?r@T_qth6N`iEWZtdM zRJpCp0&TTW6hLOjk>+R!)NbT@q!|Acm`(~a804F;pAbGly<2e*5}c(al%z2qPIM|V6enw%%8HNc|yTjQ;i1Uvnb4`>JUvhDeGSi-jFA>ztGlVQ8~ zW)pP{F4oYNqGNRG{m`dkdnyU8+gC@~eKuXOHRd1a4mm7QVXTf%ue{)vMkGpv+eI*+G$!3afIz}AOaNy7ddSQW1Jo0;AtP}^N z4=gNbUATALGO5Nbf#j5%y!g{(vJgq}<1g=~E`l6Um`mMs$+OiBYnV+p9A+**Ok8mo zF8PO7n8#M=M-L?3eo$gqSurpvLtERDK>?A3l^73(4G)D$k-65x1%$LE!wc;QJA~nL zsc$}pJ-1Q&@4MzboOsx6seVeZeNQ?m!1=H{tlIXD>3 zMWk7)w`9{^E>!@OuOQH4XL(A!OD2Xzu5%JK7GFio9EBBp4D1G?K1i`F7BT>Zf{7r! zCz76RNrpg$qU&IFhQ+X^wR#L$@xz(iA!u_L8=6&Hxz+37^N`8$lxXT{q~k}W*yfxS zdpa+{HsgU<1@NQ^AsQeE6%WG>mXxPUb_w=aBQc|~2W`FC*b+oEIA4J!z)5SDuZ-h> zJ+;dhDm2U2CIqw92q7+Q?AH*_h6jdA#!QPp)x_J83&t$meZlyJ?}!7;fu?_X`&2CGSa_>l|1cshg!-*MQ$x;$ zsq%O9CsSLq&Wz*TeA$v{=5@3zc(`7?f-O;*BHhIt;NKwp8L~BOBgMci{l#S*`|tXR zKWXzU$OqE5ZNI)o23}St=^Oq7`75*M5%Sl!dsZZ@4U)eJ%oQ*&=D%AMUXFjqSNDnV zA-mMQ9q+h-%5UFW>wZsBQ+=1NmsNleh)n{LiC4PQwU_`=(nGrSE>(}5>|fu=z90v1 zV1@gmlIu}jm{i}JO8RwW=aAn3AIHPKxz0D&`rcK(c+j(}ozH6LHsUskfDN;hvf34` zLxXj%vi6B5xN@U(S6MMvo24Ym_onQBFY>Id-%Z(n81PT6pT zOkFJyNRTnr*n*0$x+OGYN8ci6jIS{2~WkDk!&!(1JM* zbpf#_6+E#J&@jM*AII5YNh0ObGJMX~6xbF=md8}>Uc-`F+uE=Kw`^S9gR~ELF;w^P_ys}*@7>XpYjM*DG zxIA9r#@iK+bmw@5qso=(0P37Dy&kCq!6-P4DQ<##dvXvkI=%|cze4j36@44~M+c}n zdx(;MC)w2f6z{r^1`scXCu?(t_D|R2S8I2d!Nu_Sn5JbaPVKE^qddqii1pU#n$rbY z#e(=CsaR`xJO+lfV)h0Mxg1BG?~nH?OJimTD}0@^q8LvabD-7#{1F|_OTZqzR|D^z zK%5YW#ro4g{LP~o{B?;$^PmS|qV*sQAx$X`_D;jyf***bjLR_~rSB2MMUCjou%6aC zE2cPWL0RR$^FXx3E*jDf=a96+=Zx60`l01GQ z`dqdMv-|<>fyD##fj@BG;RNRH$lVyB4dFB6y?zJ*hmYH)q0zcGf8^NpVu+K`nHR5<_*V8SXcf}sB zidtCUUlrbKV)9y%`;G9{g6S09uZqNLIKBUbt<#`EiDs&56~KxA2>Dy#-N|ys3a+E8 zMebJN-GVwv$zgG;NZcgcA%nesMXUmil1IxQ(#vso*Qu*eWcGl)7stMu3@s9lebWth z4E=1y^;_2cEBcb$+o)GX^=slM@x3*@D)eh2@0&BdhbbrXmlsvBZ1*nw&w%g@_X@bB&EWKS@r#Y0R~ zGQ2j!C*e4U%NM0=u`6p0Qt~YZ{3i8KPjvan%vm_nY`@Gsa1Kk*l2*22Nfq0o6P1q_ z*hG^XDle2hu%E<~Xmav+5VT@=Wk;iP1}QW~i3_cz6YWP9b%Y|Z*{96n3GMijiE-ki_@G@AS?;VN;(kY~T5k$tgnic2eGd&+ajP^iT_R7Q{6z^t zA|fc#jMvK0onaMO>+Kve;8HkzG0(d^ z^WE0@L;#nVM%5!XQ*dSPqRjreq;*>3<6d%?hCt+Q_;^)HgshZ1NBFUYD>v*NUD=0xo1Jy=cl z;qNn1=Vq#{N93I-`zjWii@YKoM!O4Wp-OB0i^azZmn)2%Y}h-Db8pF7C=fRnXbLIp z8xQQ2xSH$@a%V+AgLKrd1(gD)h{@g*J(&ct{mFHSss4Bmr4HLFf^5uvZPx9qFW*^Q zv9mi%KR;hxv7@+rNAJb?`aeJPo|fDFFq%X>xj_^?RL_YxEUXBe&|q+4l9xc5WucN4esKW;4_-(ZXL zr5GJjHVOgL3<(tU1gWG99~bIjAs!JP_UWb4yNDX)o{#eG{Z_a`bB%*7hl`Y!n?jb_ zdZAqF*xUr$8h2>J1)j>2@6u9{o=cGlK6f%7w#I?hsdlbmghf1RrwbLqI5FNE6U}z_ z7#wN)+mW_|t`@P)Hy;(jp1C@H#wE)a+d&twt>U~_3aaW-(*|vrK%s00YXYTBeW}vN zK;{_Wjh@TG^gP34%ph|Y|WR-S(rN3SM zO7m8oDO$n#;KD0VOMvwz@@w(`7P?biT%TT~E;-y3IXQ&5p7C;~wQ@g6L4^`rRHq4j zFmjc>Rk}_A#b*)tN}RV+OrlzeP04TOEWfCL|I}LjvBd$bgb%X+%|!cJc2aM<&h9n3 zf$((`SI2op*fNPg=Y}ZvM}bbG=U}bWV_>w4J>?FKlaj<9E253kGRW4+vXyLAf(+y2 zHq=aQmiJ1UHI{P^5ND#PVjj&VCpFKx6W2$hh$9o0$*iZcGAC?YBClaU95}ecN$otY+=xMww5`LW^qN zwuR{^Qq3s|U^dS&_BX80b@$=tF&~L&LLjR+ZbtucX~EgjfND7|K8Cf(uPc2N}Ia^_7i4dxvYB*-3P296#mZ?Y+A;RUOd{;S0@lZ3p4T-W%e)gDx@-=o)`3BUPF zzAsPRAc8YPb4k(MmBFR|0NMsa*H>d@DHBdmRm@ z(Mg@*J2$HqiZxZqB5aLiS)DNWq6>M`!23p1!?xB;V&Y9U)2pPx7g?57BhC04SvA3w zII_xYHAFV`nr*-&PBp1&Sx%c4_P3gD&Nkf zPSu_CMV|HZx9AUXq$6ax!({&*ZcUE69IEXMe3{^s#Fm#Fvu{F?*0&cMDO_8+&9*BSgZ$+Q_x zu4@}q%S9Ve+nQyA8~kq>=AKD0zSOzWc?Zu9f*hN$9tyOv$<81KIg0R zba(;*<591=FdY&@2pC~SArR4a# zOi>&4TqJj=29}1Vm_A*?yAtm3sy zULw7>Q^`-xoT^vG^nX*;G=C~)1VOdrR5@)IK702FJ{6~mX?iEUb8adCukdb>o~oxM z?h)#4QTaX{A641b^DBF7n==YZ8$2AamC^2SKMzqO62o<;@nC3MXY|*WmCqAP#X6(j zG-@>Om&hB8I^WgPg9&`vN8DiK(?)HH|AD5BrkSY(v1V7*S+6}|<$AH%K&58ci1|EB z?XQ-pAz~8f-;GB6-RLdJ#z;rL7|+$@*Cwn1c~|tlwO6*uLRJY>Q{rEZgD7rdG|n3z zjSFg$UM*>LkR&4KR7nkfMqTJp!FqWy~g|*X-bD~Y|WY}#9j?P4b`%HZF8(Ywak}Fn) zY$XwlNkC^n6vv*e!Z4zZy zCpTv6K31itlZ&)lH7LZtjAztvxkPr0X_a!PWkN;FP-j~PB{4>d8*tK!FdhKX9b8c; zk;&s|l=aHFj_F(z3+1q6sv6NAn1bVO-)jG1o#ktcDMUF{{Bw<=w zaB9Bf`a|luy2BQHSIzcug0?7CxoNn#nDUXzdN~XDtfX<=99fO*0V(e{@X#VdCRv(+`1D*^0?!LIqxDFJ%5?>Kl7tc{53EI{Kk*&q)tH) zJraWb+!kbCAM9$UNEctdn;{*IxLn?^@gPYuYM*d=Fe93f7zP0n%-y!bH;7f@K06IJ ziR4qb2#%-Nt+NUXsKzP+6ce=ZC3H&g#3UIL#Y%qXTOa|Fg>VPCTgA0-E#vw(aRIJX zvgd1&`bN~oTN!VK^P(_iI-P+eZnOodv4qTY zAnaT^W?+WM%GAi8iOsP}=3)b~?Rl|pyXiQ*-Fzbyxk2BEu6Ub|x7*`n%DoktH>0-A zQ4#$Wh;TFQ03(LU(08k=fRn4BDa#6% znmVY3yp1#?0Y*M8tQNA3Q*Jz4_-En81SE5baM#e%5^_aVt!@(jttbK(Ua1-mg-(P z66f=1NN)HlhqrwmIgzL;h;Zgz22HmkmVAa4KY zJ468zgTqi7&LMy{0E2Rio*bnd4JHYu2n_hJVU+AQYFq_u8XaDL=m2rrk$ zYJ>CaTTvLRFOu>asfo`WFZFR!ZjkyuDc4z!1o@?a{7SBt`b;T56#4@)_ND$KVu|>e zeYUS9ENICmMfz=4B=dnZma>){76}*>iZyeM@E>GpFqAYiSs&#sz?#e9@G)y;@-mru zT;v`F2#))jSX6Z`%vvWjuxjn!C33$LsncY5s@$T@w1Q9J7)V}{ob_Fk`imI@=+_`3 zLx$RM!ml=$itr+Y=9rS7O#-brf%h78eyNMpF)vvSHnQS#xFxozo`MRPb2iH57%adX zhU&|)EV3L`qfdg`$JO1AbCtKc!>ryUqO1RgtHrUX7;RAnZ2xb68K_J!raU znZ0q}K=e&1)0{`RI=L52Y9RTui}@0#m)K5908~~!F26|}Vkc)gf4G>D_45-B=QSFc z!Nkjvw`ZNP+1K#vqn@9v+hsem+{f<9`gp4F*FHmeuKsBn3R2FPrnQKI@qEkfJc>tF z=FQ>6kfNXxzHIu*$WEtxBS27u@K0<-#>xVIQjAsX#63Qwf>unc(<_2;)bRpN`SN<< z+{!&sy@+TRD7Ehr)-Q;EI*#fz-IaPfp?kIQ@|#1g9cm7h)O zwLzAx4Sl*quJl=MLS6uUFfS_iRtDbUmueph0kPd3M@mdCY`Loy=I7z~x zP$#G2h)V~2XP1^Tz?nx_T4u|3%$Ypk={nYujG`1SD}4@^PtI_^@tFNeGG;My=N-+s zI8i%adO11OZ?-FXB3(Dy&BtC|818j*T?5{5wq|rJiL!eTC8XVE=yaF+*Qfha>Pg+~yOVHdp)f z)uq0=#LwN}XNpla8lAR!d}T&n6T|OL5&98Nv5rK5H|y2mNsqMgTs?>eeLM^)VMwxhZl;*P40I|`@_9hGAE*p9MY)kwME zL_X)+bZwYJ8F6uEp;lJzbyb|TzFFu8h1|75cY36JSBfni=W04@tJTa(Rez21H{y3%#n$KRiZOO1SK?Gq!1dqn+g^$zM7>WLl}jfiBUE z#J-d$wsT@HwMUw&f`b!(FFWx^QJ9E5z=_m8Rt&h9W(iTkMjFM5lD|y+qQTi2=$SOz zBqjr7+m<{f`Wdar(c@$Ihq5LqS;1Chj6!6{zFcpX-|pp5;R=T#Jfw(zDhmwU^&BhP z8W1=Q1F~%%DZI#+eu=m}PhriV22yW`RIL%IF4k?=Ya=l3`dh^B;T866+TGOF&UjE* z-SL>%=G!0Zhg~VX8aZoQE3b37K>^J$eC!l$S`eQflRv&nk*nM!ocmdh{q2Dty58LQ zI<9{}e5ED!Q_${j-@0AV#sfG#uQdS6YdLXUeBugtvuRm;$~awRR4%@K6#CEYiI0v? z{7bC(6RbCh)FJ6n{Kxeu_cS6 z@MJuXZFGxv6Mge~3#2>n&@g0zg91wKCbXU`b2fll87_xgo1sB3vcc1o?zevDUMuGC z`z5)>C4P_DITNrfb|9>Ee$kVKOu`0eZE`Y8fNb{N`kcYyJXYu##QS)cLmC3j0-R6W zdC5MDIoa|@Mf~y;yXCBX2bT`IPO!o9Ig$s)0S$NtS}2OgHJZt#y`#&Us7Clm@Q{UbM)=nOAE|(?UvIlb1q=mV$J9}a$d9x zPqPm-nthg~jx$rY#809s>d&Z=@eQ0QdP8PX?i%4;Exc<)@oJH}MwqL`FRl^Et5Idv zi`;R-TP4WEDxM_#&?QCj6tS-^oh}G&_iI4Feqs%1CNNXG?{Tp*&rRphBd+7O^Uk&U4Z93^TJ#K?)#uVET^51kDY!R+XK^X<|t1NofYBmHm~~e~nntzo4A% z_P^QIzRH_LyTu)@ro>fEb@g#-zS+@yB}z}oXmo0oNdEW7K3kp4_7YSj=y+MQ=Oz<* zRCaCBvN;YJHK@8owZ$Q);79O6{R6dKI`9erm28bcH@~mik4Es%wk3@y-CB3PC_*m- zfQuQ~X68`kU~=ttCIK3t`WWF4>)*4D$w8Oj?sj&dN}7KQ^Q6_>f0$@g8FRYKeJkX@ zM9I~ki&?xy3UN$kLZV^tzwA zQIIHnm1nN>%u@sV?h@YE?5Uz)fufaF<6CHxL0P~fA0vaS?JUm0hdG|wEAP4%FnFbv zc@jZghjF$T8v0cNJ-Z%VM7lNRw>J5d;&|{}P&^oLl*z>JvwaQ~Pp$8cDpIyTtw@}E zjErT#HDa;to}mwk7HIk(5-Q%N9~6m)MEIbXHovr^OD}yYoC|EA_NdH{$)uwYX(}s| zv6mTy1HNX~n&t8^?-8QW{%+y!<}gB1hnhWE9}|gb0TB)?;E&wW-(2?-*Zd9d5X-3z z0S4K8)>FWv(z(ztxklu-QN3yS&*cy^gWL2iW6Qcje6RodqW2qV{8 z5+NHf#?y;+(!vVP@}~h@NKcVZL2oji#2CNCYGRmCG$E_3Ra=+EQtPOA`+7x$Jt__v zLX#B#yGg1Z6u%NbH7gGJsalZ&BEQvXqUBVP=hM80gn3X<+MQ zI@glTL#H&4PT7%x3eszV)3LyLj9~&QFG5qqZIKI-M76|%$`Zb?5rGOFNwu@=N(Ljy zpHhvV zv61lDd` zvtTggH9{O07FLDsUscv*w@8Q~)muR7GMQT4i+Ei?NGn^FQ-jiZGwtpG1Cc+IKw91* zc1CFzJn7;rfv1=ow6)?l$hYv~B3L%bTL!!)w~D9m>n@wz=kMz9&AcaG`fnP6ne^|{hm9e^LU~rEYqvr+s4~$#G591$3zhpcnU@5E8!m_ z)g__7Iy8@n;-6LaB_$7xqUdKe@q3%38{~l05qBi_?1U&f!&c<_IuWjnYKA07Kp}mm z4o}jpfWnN0-bJ-oG8jT6+XP69jI54)21-dL>XNl|cRpK{O=d-u&z>c`*TdB2P`n9a zH3RU1u)q|-m4apZk0(BrqoSA_Qe2)Nu#~v`vjF6?v=@Zd;UG44>6A4 zB>oxrd-`usk+A=OH*vB^|5?v`;i0-+>#7@FN_`)rqW5J~<{sezuZ@+LBzK*g=1=#3 zqr)puy@M-N)m2JfsS4Mr^0mspQPq1XTfHi*NbOa zq9?P$Upajt(-5T1w4kX3#EpZ(8bN zlt#1jTq>8Nux})8iBK!Tbt#r_DXvbLjVgF06ffIcM6)(!BPz^_+mp$4;2O}8M-PgA zQe~JQ_420`@3%q!v~CafD(cn}ytcqPlc=NkVsm_JbDym!xgUtdEzYvfmGf9SC&!>P z!VCdzVw!@JCLh8jfjgxRoeVR``t^c#cSItfXXH%s@UvA$&XJ{LQlO_*R_SMBJ9Jxl zy0ZInx=o#_^hnezwOUrPRac6Q{b;2}ExxYRS(XE*CZ>dwLn@3$eSU9-KcBfq^q{wE zO2BvZlg|)S%;XgDk;m+jVoKxW1@~sXj@HkCXcIWS*77{tK@SgBwC|J=zgr^=m@lu(n{0jV7`F+7&@Q zudzdL_Ymum(I#z3(mE+LTLrIX%^TVDUS=msJtN0ah5e*GYYyB`Lpom^RzRuBk2NFH zmnXuj65>j7!ZLU-Lw^~VS()f4+#&~CZ4K@2INwS=l_WmdWnC~i{g&mnk(IvsSu+$y4a%Ast_U>%QlgleXkCy&9=k`|f9bY*>5ElxEyiii_^ z$Ym^A|JCL`?VajN^tO&xJ;~9gNA|ftRy}*s*wi15CML{GGdWMFx|uz=DWY>k+$jx{ zAzQe#n0qgwKT3!Xs86PkjlxUv{e5s@-oGvF-;qw;o=)7AuGZmAk-9k|ym?Dx)!OysS!f0tJoTT*Jd&4xaMcM(xyn{o8ff`@T={U`T;Q3LBK+rd!J~Qocs|+{ z_x>zwv8VE8Q$F=nUOqz^o8({@P%BvG07|8gO9rcw;)JAYyWpzGBVGsK!OfgNG%Ql- zp)A*x;rnpBihm>ZHiVvJhZ$lQ_?&*3rRXZNGK|g?(F{iO_j`n36hb~h8AC;l4LD$^ z`=ElB)HWbSi0GoEjR(PjP{!`os+qpA^$5-p8DJTihBR$xMa3EcwyffO!X#+^uMV2+ z_g0VAkRuFq%|#*+(kD}(e`(?`#edi?TO*^tO52Oy%_68es^KHD1_5d4LV4wAI^%jghP_pWr?8YZ z@fY%!;16GXa$}{x>eIj;>8{n{tAY76?J^|Yf6b?4U%I!J`P4?IeK()zG&_;T&{5s| z!T9G3ufxyxrFxI*pHCC$KnU8(xj&@!Luv5!%?{y>c>zpb(m)?Qh)OKTH zk=Y*GNV)$^nlAxf(}~LLZk|q=<5Olk^8<5ziqdA{+Emb4e|##+c$ZhFuBoOyKVZ^t=h5y}*E2U;uBw#$(#!z~zs0q%^HMy@ddSzDp8>UHpMmD^*+~0LUKzm=1HNUGecUD=- zC8B=(BmCti9?a=Sa_Dn8&;WMn*v{13$&j{X%!}#wvf+nW@j*6j)eo~wh4ZVuE2@(^ zeP-IMPD{4OD1A*%Tn*z^a6#5zE#$*x^GI1fP~Cs=GeYl%bd)l`&82S6iJLf%4!R+i zdGI^)sb8S@AG^h5* z4LbV>7BR*5!(m_XRL=dU)mploWjz@$Z7U8z<(n>IGLvh^12Q__7VN(pV{gq#P3pv^7@UW% zCOof^*7#?O>BS+*08PluTIF4isH?lNHM+M|Y-o-A##RsuTuAc=S&((BM5x&$F^U;D zR7Mg75r&j5yq?SFA3}pT>i}5?a%(sC)gs_}t((x-$RgWo9WjCjTQo$S}(t{T8Y*dpvS@!qlioSt0YA!ejn!YR0?(V_Fbznqeotfw?j&appg zIjAq&o1NlMwq{7wLZR=rT$o~9Ky8=8)lp~euGJfB#RIiSk%wwgkFzhOO_1u zJ*$G@|HA}KAC${xsV?Sq6!=tJ6u0wAaYw&-;vS8=*I8D>0$s;nrZ4R6+(4xWSy&_S z1}t;d0?k&pHKp!o!sd{Pdz(`0o9wVPw>O0wo2b4egJasoH>&V2WsYyRK?8Cit9%3G z&kpLOAU_W9z$&37!)A*zvrr!GbPZEjt4;-@RXbHA)I2Zta#JDkpi&RtZF zv(k&YR*cc_(Wh@|lNnkt_7kSv3I!uc+_O$>ivun=ox{NOq#)6Clh_=LZ3{fHp82Ak zw9XZ>(Rr7=Kx(8~FFeSXLM5S@93FdAb^lSV&aui5K_l6th?l{ZWydm@9edQ{u>{~` zwI@ikO76xiMHwa>OKl~Y|B+c_i$XM@`BOcQ0duERzmuuEn2tl;_=Ha)c(x(;_hA$a zoSB>nRRy1vV?n$uOm>3qZYStUQ5(1<2FxKq#Bu!znwF$A>Br7`@ zE(AVKBV^;P&4lHWi+ht?F4?!yGW;ZACWL(_1Wb`)G)HObK>9R0JO3<`Z`olidiaSw9%=h_aPBxB}xd|J#Tg9lG^VtEk^fGs+{ zqa}Z-xU%14PUX5iO;z;!S#?m|`UZ0ZAo!T1uX*a0z z{W861;nCoe&lPAyz&|~>(AreJ8W)a_{-E?D%6}NIzurg;z>q%tq_RBt#;8|v^7)+k zQ%*fVBp6`hvnt_hD*ntj6Vvx9{|zvHNX?Yh%dLODjcm58oTQ`q%-G1%&1HDVtlUB; zikZ&%`Cma*gJ7OIX7;0A0VE5QGDtRtIsRpL7q+_WYh|CyzUsDW2nI~+*4biiALkVCy(KrfL1k|c+D&|*<+mu< zpu*hT>6q5$3md6$y?=^SC+YZlgLeNU^z*_`xs!8!iEE{~PD;W(lmgM2`R?DKqDj01 z$-AHI^b7Cl%!gWhpo7i2z`AGts?%?1YNmn^H18pt&F9)Z0S;?^;Rf}8u}8Zc{gw_< zc*8f*P{Vh1_<=2h9wA6z6L~+ro8SY0YWAP&x?M!VeX*YQ|A){_oc+l@*iG8B2}_S7 zw?XXxO+w>i8M?DHuLO;qf(sx;;EE)PNGFD3a8Aq=)3Y)eG}<8DfGXXIFUQRl0V!s( z`2Dlh_#Q+4()?{*DCYO+@4E*Edg#`HH#ukN#I6RqrnS3nMlf?Y4L`QOGpgx~YC5Cr z+yQ?DjqWDTkTg5fWZ)nbhGr&FXG7z06LLJ}Tp(_zk1dvj#l zh%&F1B*=F*Azk%Uz0A|zKXl?Xt+R>Hj*GPaq^_#N<|8~G{45@AnGevmSwhA; zOMT?HL`TYXneOpj{xA);))Px-Ml-gasb>uDRei&p&4GUtnTGlXU*6^ywEwsdFT_Z4 zP{2(;mX_}&S<|)qep2y{?F&hhu6|SafY{D;CENl158$oE3yNutL(TeSxo>hn(l$Nh zm@xV#u!dA#)>08cmEDs=eG*>px|(3V_q4B`@dF_Gq-NQb(SoKe=Lw*=Ue#Uk-k@ga0yLdtz znrR5Ad1|a{N!vlIZQb$EZe>~5aWvS#j&;um&3r#HUm?e}!0=0BcEsJ}6aD%2)ym?G z9~OE@<;E=GuILNmZPMOMJ3j*1%rt5oDw#@jzo@2B3eM+wrW0ikGkS{tG%fy~_9hdl zy0XG+j7cHrC zyM1=FIU3hxV1v|=szC8a4`CRl{4|ktu5TN1rTC1vMvt>}87qvp>$I-0`=8RetB@-Z zIikjGQBt&WVDQkB`F)EPwgz*lkJT}hAMOVv>1ifAzxQEykyf) z&SL#s#t8D%G^Eg%l@)QxiOT8)&eBmVWTsdcmAgFvHy6b5P=%0wU&;LSjw9y{r&iS}+$C%-QzXHb_&d02y9VFkj|5`f_{p zg>W3O*2BTdct4r(exJ~X$UW_dPs^_u@1wA^tuU)WG3c|_5nf3va4pV>Xc&PF_>gdE zTNrtQTAUT-{$_FTO;$D7KzdF8n>%Qq9u!&GYx?SGr)_B$FJ9bDYk_tt&{pVWA5jGc z)^f_bg!fX}(>zv`PZZ5NMFxFQfdWeWC1>8sk=n(T31Cb8wX42mwv(n{2g%ok#J2_S z--Y1)0(z0v3Sprxn0E{C`DF2AepWDV6-Y~x=4<=-U-I~o>rU|fRYI1$cp3VbR@g?a z5prKFtR{J=Z3`fIvX7G^?DK#P(YwK zCyk0Vgsd2){up{shDpofhyO@X@tczH@pl?|3tEe)0ySAMcg&-_AoNHE2-Hb|DS^Sc zTBvITG?KH`)F4#@KUUbNn@n4R(_0onPJw`|TvY!mRA+?5Q*k+HjNUx!lsX?*rZl~( zU3Gx1gxx5JNGeyGg+cobWI5*&rVK6-`dq0fu%tbpPVURTdMSQl?=eVwRA zfL4YQsBG?SlKinnMjQ;huY!K^`%BX_{QylVbQYC+aQBpI=DRzJ_+8q01a(#Hhi8Wx z>9Cx>A>3C5wv%<#oFd!+MyU!oa;`)kHt7+h2e7Zg(o(|`MNR>@?8@4<*#*GKux-go56AwhYes(n}g0;OF%4&x4Pj?ZlPIs+5iD$KllN} z6*9U6W4E5s8Zv}1R~sU{eYm-$I{|FSxNHJv4Zb1_?@9wah!N&EcL{kW>5FzIEtVtT zGjJak7C-!eUTvK#n{D89E)Y@fsj`N=B9BIRtrmC!hd7J2nC;E#BpkoT{OpcXmUitC zQjGjC=N*-kO|EyB^nNG96po~ejrg^}+f#H4z&dba(O(7P-sg$znIwoepQ^e}Q{g)* zcot)pfn1E5v-LSOWZ+)c#Q5~3@K;m+IL;PWXPtnC_W+MDg^F1? z)`P?1`&~_ydh7NpI*ZN|?Ow-Nnim4shcv7_5Jw`t$dad#SpdoWLk*zB2JpY|4(&al zOAM;qw5T_T8mRb4RcGI zn@rq+s|xerVG@C$KFZY&UYWQ919_A@tzTJbP#re+u9^$Cqv%o{UK|)-dy{xnJ!Kc5 zH^kYd{|%G}1!sdOo+#u=V#Kz|>2h0tdbDj~y4W`L{h&ZY%?`VHyC>rV%yfTSH9Z|4 zREZq8{gH#3U3L=-+=aOXxrO2GayNJPYgPX*48QnaPFr7NPcs6TJ$&f^760ww5(j{~ zoeQV#CSg{n2M{<`4Q?oMe}T_JLpBPz%~+*(d^ zNxO3Q&n!d29uXaxI->O`h7lGXGOA6{qdx&*0 zo+WamR|OR0?m?YT6|>y%7&*yoLF$V7ZG5|Cy+~B5+5fK(9fwr@PGuyzW_JN9Z7!ktj zh+7J|9!FRRu;qqj({LRo%S2;aE7GVPCJZHDjkiFR-7QiBa_~B+_{a>_hpJTkyQamgQexEDk)hL_3rmntGdOpPb}uBo<{)Su zR!n&#E%6a7WXIQ+POXPcOP-&OE=_AUbHftvfgOWm;0fdsCb#j&j1-}+U*f%+aF44W zTqi+^u}&UMGBUe}ipR`X*oD@&iel#lfoP739(`xQ-gaq@pGC|Kzt>_X$T`!U?y8B= zgfw7)rj;T%`a0#T6;-F?q7!rO#NZ1r`%kC{$iq(sXY1g6<_4+}>Js@{LmAtyhf4~D zKk0Wy>C^;E6f{ik?AE&V1ebEv(<=>>6t5_|YW-2@6J#YOKzY5jsOry%J9E)fDS%~o znc)_+e;B1%(S#P$t;UgSc1yo#{srTz=yaDGBMJkgn`)eIMXt@{#qMHp!UjVuvsA*4hw72(l)U{tm0&M?|&i1X?u~9nL$@;o+cC?`$?0jGX z{`$0RKVAgKi32cWLn^T;+4*#GtIa{(>%rMV z|1eBrCS_Iq&vP)R4Y0aANf(haCL}?ceE}zQprDg{gR0Uh4m0;dsL7ij2h?cY+5YI| z^s#w-e_!Bn5iN8^f^6MBzs|c11YXbrz&DZVOm3B_OY`t{kgXPD?6M9X>#BHt=S|SR zW8k&W|GC`;`MSRpsgfOd;n7b3@JcRrHlbmmF6+?hBgs$|YJ#FEPte`KLDE+WMr7%G zBQiYSQprnrM)oIP`wEPF&teGi1iL5ztP;R^8zjV-IR6vPiEp(2J>ZzcuF(SmF20`- zR;Val_s2Ma!}K*uwA)}qjx6aGv$e~rR+8I0&RTu5j%I+p`PhDvJ z4FrOK0pjVJJA00eZg+P?jfD6{t@pS|>zF*%>4o10mwen{x-Jc${*y`Vn z_B=G?25}={3OfLW?te{M?tt#o3I0(+R41o9e}ZRnG)b9U!Odgu;itr+B#4t&$aGc8 z3R3_nC`~<3fV|3wohAzk^;QM40!FQsO8-Yz1Ic$sCoM&Br6rz-ohxKRlYTicN1kDN zJ|*v@;*bLxz%a`O3Ky>yNA-7S3^<{?pB)J24(!EL!vx{L*!-m1ilb%YfDQRgOtHF%^D{F(} zs`ULLd$$qa)L>DPy`W{&*ERUkAOQZxPhD-qH5F{cwKnSgSxgJLR-~SjJf_8rdz&Qr zmRK05$V_WD>wa33zP1+Ik$R;duvoYie5?3GLQ0q}7_^r+#yWl*vJxctbcGrbuW`>} znS80j;Iu=0GqJWqaf(s7Ge2@-@1`+U}G`1q;Theix!6r#CzbH!e#bg;9hTyfR ztFMJuMn;WoR0!Fxe`;g_=bjc^mmCz!Gq>zuLXJ3B6uCq9L2A?IoVP^(j0NI zXwKk2I3heUh&zUAJ6^Mo6{>$F#RVAE!THkrw=^qhgYvaT?`r9QFEM(J5%+1a*uBC= zIH-Mw@-jQxp8T1No}K&w1in`j*U;u#ZSDa53)73WxqmBnMUaaS!-j!~Bp18k^v|5F z4J>eu0j; z=o;$0f=l1~yELCmxd&C1)wxofBlUTVA-$t|TBg1g-lD|qh7oNZ^Tcf`*QPHfsf=Nl zd`O97?3?frPhNAVcln{>ibK5zSExr;K)~)jw!%H@u%-je=>F6|>pT5Ryaw(( zbDa+keFbh*(rVnF+20J8&^ll`C#1OqFql&0ryQ&BiKP)?)pU^c&^FRZ)P!O>)S+Jb z_3nD|ZGiZ)_9p!BK4mtn;!=>$ez;zeYsJkirj#A5FrFB~m;VsmC(;AQVsVb=Y~0(dG!3s=H@XnCvk_0rN^ z7j3GN<*vONPvw>F7tj)ZNnyb&tV-V!4?|bf64Bm`_0C5A)A~(DAz>opZG+b&NBQTi zcqNFIBwN~MBEp7X-MA3try7zqB&Js!$bApQu!Omb(Cn(6VQu}RF5R+av)fXpm3>;g z#NM#h?KX_QxCTI%%SbfcwOy5Q+38#p+`dAWIIIqS0YUtTW$5g)vs8o2IaH1En1bX&Xxwd<>eJixHm`f{y?*oK;BP!KWh zylxv+XDx<%BM>CM`5@*>@!)i^d;}g@7|x3>RWVFWZ8c0;Fy>cQ){2Ev^<6vVTPD#y zwiTk1e z-E|v@p|$I!vL{ZK<@!k+PDDN!y*~3L%VLnDKShku**caSORiRjM9#1(ByJ1RRUVnX zNQ8(FZpX^pAxBI>9xwdi;k)yej)fh_gi_goJ+}F-W z=U0lVuZ91ONPjJ$N!r8tMpnVW;ZI0RBzI4zMnzZ1{FV5o{IXjM(#^k-c&dR5W1Yxs zpHN}_luAP;Ap*9AP)2HSVC<{H;+h>f+_Wnu)ZmEdSmVJ$f5&y`?7-*JlD5OZ7SG&mz(RL;&A>A2DJ>2Pc! zZ4!YT+7phX4Z^W4ki+UE8Fe95$zf?kV5i*@q_Ei;-z&QGyExnCXo<2p!a4+U05_kN zwm^loW0Uc<=6`p^-vL3i4rWrULO8WtJaIVx?ArZZ%|bkVcvZKQBL>b`t@>Gs`*!3^ zbuf@_MZP{y`=Gi(c3(}!1A=g_TO6cQ*xS-6%qEj6rc?N_r8pq$fU>6s zoDy5b_m-Pe>x}rh^FC*+3L#wJb_UO}hdsx5im%7#I4JJRm15!17T`Lf`oN|G=8+X> zsU5`GQPY{xaDGiYRJ!ya`y^ut^OWsAOXzT@^(Quoc@+z!Quwe1m1K-F;#}c80@5>$ zOB@#zgm08hOvEaa9UTW*lC)vE1I31Y90oGYw(*kVDx>2{aY&Cd;v)(16Olwq`2k`p z>laWz(RQnjWgtMa9G}iA7kC3X-$XgZ0@4_V6V(qZJQxK9t%|j)HwA}16);rZ2(Fya z|0ef3j*wB$Pjr51o#b<{S77<*tgQ;l^?HRKFMpKLUt!gdba%2ps{uaPf%n7oYXk4M zpQJYpyq`7Gy?^li&U)S8`@Qs41Mjy#R9`Uge%4Cio-+9141!JWz!h*sel+l5duRsU z82B*jPT@W?_~9X;Hx7PyPUt%ZK5V~P=xYW(%=$#Q7Y=^-R_N0PKb$7@w}j^7N8J8G zso_%Xf8J}PyLs@#9a29x_+g{e4-I_S9-ZUHfe*9ZClz?`!66&U&pMANVlqacxzy{=;6<`sTq8?`pkv;KTM`0E!s+Fza~Zt{VIRl;ulQ)5>+$ zn7a4*pjl9J!e>n2;bvFAH27h?tI6=F9CjliU5L){;n*MDDK7MOWwvDW z;c$`|Ko-GX(XV`W=%6F!wu#meGeQ1K$}`8xBcVg&tKUytSBM_ZfaG{Xp&8CW$jqTc z_dIG#&kM`JoT!|blPV|YWyIX^7V z+jqy&^XKeb-f7ORwi(=<9gX?xvRHQRKt%K6luWNX`w8!?+AbRc`e^g5XtxUHC-%_?tO+1s*bjZ`&{ znf8E7BgWrw?+!k8lTJ@ZeB$wJ>u1_abd{oF)gtqwS@HhXczZGIYlXwB0~kY7HD}o8 zn9ASM>S;AYo#RzK`SxNDdoyoAhcAA@oz%Y{J6b-XqcHr4$O{quMMfXVs-4Z=Egrd1 zx#UW82XV5cD~V3Cc?`BwC)hsyNH+f;#@++mit6n9o>ivLp1t?%c6u)y&Y{D>Mp3Y0 zBC$rqh>Bv2JOT=8VxFKVmPZA9S7L*RVz1G}7Gv*XiM@BRmqh)3Yxdzp^S;k}eb>46 z>^Zado>{YIt#!Bm{lD?h$wdqV>F=!$&`T)tQmcCteAq#D7Ku2&uqWCRYR7w%LHb14 zUbUGz`yl)9z^OstM;g>B(QcTah(qPSl>RZwTdv}-3c)fdu=?}KY7`M|BtP8>tt<) zz(l!F!_m!(vkr|92@lO2a;o6;pK0qgXCvag{)4-)Y5>{ar2AkCQ=Uj<$8}O)FXb~*Q;X(Ysn3&g zrPQkizAhh>_Cr#BjKF3Qmqg}kg8*D_@H>}!nwh=qe!Eqns$-;fnCK!ktZMBBpe=vW z>T=zhb#|MS^QZY|G0^PmWPCkJq<4+X+$`aDagG8do3|@F4%^Az&mG%cs`syCjFXrT z9?YO}a{@Ch-w1@j9f@W+ZoL!Y{gn9j6``+DR34(f)*+&WSo#<{AY;I6D{@QwChAI( zi0FM^_cbm@DELLi%L~#)B+p)F)aalcT64vyl$mb4E!|{qh4{Vl<#H*h(UqVstd(_| zy9w)M6BLp4vVma7|M8+q#K5t!EpD@H;eoZ6I|326$~FjZqa2=(*49}=;_h&0rsq`A zX1BgBgMA4RqwpQm-^UTqbWUCNbn@SlYT-(wgr17g z4I#K5PyH|E(;}RGo#|pYc{9{<7Q^u{!`4$V5*kjkMjYAT{!kw?WCoYyt<92LPuT>H z7}|4|V|3z{^F=c=X=G`{B=9UpOKSl|@A2$Hv4F=xmHo7$A*Ee-oIFrQGjTDjB{EX# zOKOr??@jZV?JcDD3jDepOEfi?%-N@Jj=nBt%}ckVVCT64-itQul~aCia|=k~3FtZpjMguUJpP z?`j}uAaW~~W@$I()j{-9XpJop0RB0-ZaESsl7QslQC;Y(U}n5L)eX2>xK=vr3)uVO zFw^O+uw8P=0y@yo;Y_QNZH~NAj7ZP;lt6Mq5{`K=DV0048Ys^|zucZawkCWK`2UPD zl!`z+j;1l))THR9`COk;>+G7A=0@|OXqnD7roC$+E0*qBsh^g;J?_vc)<=}R5?ATu zTJ2t=^|dL|G}Ix)CGuV6zK2`Ar@{a+kHyF1XjbL|1Yl;+kf#a;UPF@Vswvfr4Not& zQMv`o#)T{CwpxXtk^OFKY&}l3K3*I0>Yx#$t))0<{3AT)NUzo~f;rB+f%5@aUxqFz zkIuQCvw~cnuo7MBxT~Bf)3v@o9su%dS=X497mg+RMHCJ!d(j7IZA0Kn9dH}tenuEC z$KSY&`pRMjI`_cNTdvtbL5F0RonC8f-vT{fEC}ZJrtj{2wV*WrWU;{KV8i_Fu9ubT zWOXaj{lXUU=5h;rb8ic^d6s>#MHO(e9!oNRDC)v>aw0dmRodi-jf@; zYmYZH=!u3NkX|f#LkvC|8|IO%`01S@&y^eJdkbXx3UQcoWls6Nux<K zy?2RO;Klz)_b92306gWLAd5k-92;s)ee`Aeaf;k&W+j+Fk`F+Isx@vdL_$nPrV zVmN35ds$F9B@ibEm2-l^F@d*@bC)mw?Axye-uu3R#Sz7`Z}Q?>J#h=1bw5I}{1kt3 zj`q$Jts9FkyxiAb=SC&1@AusY{Cp5(GP!A4`z*odl-Y!@yb;C?($kOe+!Ii90ao1< zm2U$t1l6A0D6lC5C*4CDBOLjs`nmJ`VGa%v790DU(D|jj0{1l<&DkNr?ZuIJ!j9gw z?S64_5X+{^0`Uk1mx6~4WkejGZtDwdaXxXX=rb?5Aa>7>^#!rrYOsrL$Ch>C?J#$_ zlfQ##4BsJea=G^Yq$S%cwOpe;l98qO&Wn!n#W!K@Ut#y(Sh5z%mNTJgOx2c>I0o2^ zWxXWzR7vC*B-0Y1cU5O=2g<5vgw6N5^#wR3`j|2-I!v1s`HWY)1aGtP{y7cyc3#EZ zE~pSpsDy=_Ck&E@)GZ)|*)*AYJ*H#;qf$GxAy+@K$!%OK5FJfK3ijxT+uOTxox2W2 zE9wsVaET8SBcl<{=)O^6Y;jCYzow`a)EML44fJ?>qh!OaHp$8S1TnF3f;Um7uaN94 zu~}|Y2ANr3=Iwc)5eZ`twcd$a$bX~Cv_s(T-=bhYBML_Av4921SLGKihV>?}#%^gX z%~Vh|9R={Cfh<|yd_2m0w3+o9?46)iff-2iu~GE37z^&O8YFpceUM~1S(nV)tL5;k zSgOa?r!#NU>t%ACY#+dkWM-5yL2F(5Nzyj4HMm}uu9G(NORbglPs^o(DR+K#=1ffI z&rWT%pi6Srx@?^zp3YR>$;kTvr;f>qzsJc(QRet~5O9*YAWJID6|;i7cg!Cbd$IT; zQ~5qatve}R$W6Q<=SSl9OzDn{{c_BhTn=VItj^W1AroL6gLqWV{+k(N&of>|)iiRC z#2THEe-q;4DEDdPzXaqabP9m-h`a{kn>cr5mICq+uKI6;-aR`4nqH4<`D2V6FhP_^ zT*#Lxe=Lv1qB1L9MQn;F0Xt^s@!_#B02dc*Q-F5lCzX6soLC6TB?@3ODk`d>zJ94_ ziW|=tExG22ZMoK;K`U5mU@+90GY@dqZ}u>3$73r$k{3RU(#F;k`O1m;p3_43e1Hq7BcvlU!LrnWBdbZ+7Wk60)8Cq?e%86NvI6V>z`*20RUUndyjS5gE z_4G%=?)T;#d$K@OXw}!b^#jSYZ}Qg2-@w{=FYCxw>Q~p8%oadX&5WawxPptyz*bXz zq)MOaGakiAC*4-}%?Pa?skO!?ZDJbos8-i)LL_7Z>((UMK)j!IZiZ_a`HPCe%kfe4 zWfYy6(dT4BCmiPG!=}P_5#%h7Ko%7`-Uz}lJL^q>&7|=dgBS+f%IMz^jQu77)85^n zdjChMJ-Gb5#seA91%PDl${v5{Nb4jLEyQuT;EWtJF)g|okPiND!gVaX5?>}2sR$A8 zhHgL*IFHs$?ei3UeR|G6B}eVC3h@*H-AaK`Q5D%M`KHMNoFyr7*Jwt|S!zYee$4hB zwe59n_VV%gQB2+VcMT-E>O7t`HEo@rZm+I7Ik!2G=XHyy&7;)1b)}wgXcOJl%&W(` zsF*|*s#TPr0Of|TscW~HfIsFu zl75|cXXD3)`h2lJ@ds~|HFjSlug5@sT_D`o%II|w%`d$>i6J6;NW|p(6g3vVoFzd)t<2Sj6?{ne@y0>Yzdjac@_^I6~J!3m&n(XV3Aq}4;_;J<$U~FUc5@>%Kuf; zUmk6sGcSkkd!b86Sv**3dZc8?vKl$RaVXUS?TL$}FR(~i13!o2W>h3rmZHl`;!maM z>XNvs6kT5;ROyMUipEWGZJFgwihm@=OK}BA@M0j&%!`{KvUWy7#4DYaT%$Zu7(i=e z0IfMNgVK4YC_gMZ>x#iAMfqt_rdx2SUliq+Mdyp6yRPWQz7{K0yap`8v0^B?htt>q zhE9u*ys3{j1&hl-a?}N)z*Md^Fd^Ocl5dlD3#?FfGRv^8WzGw}^UL4+-WPrhed!l| zBWdFx5J_*~{x2_b%{i3#;(Ul_{ z>dSf%sDvC;BU}Xb*+ut?Vzj#Gt}1Sbn*cBu^%#gF)C0H$A94)LB*F1D;m z++U)rbIWU+nN%Go2Zi%s7;Oy1ljYpnvUs{|w4!Ts;u?k%TG4H}03N8UeR7yr`9F!| zkWuTMHs^ruvaE#?_~0c%_7eRTxBGfag;H8lADPWRTxW7FRm#A>;}>+r?B+W5lN ziV|S^8v?rq^rAjO_Z~nyQo<;h6F`#WxzA7x#{{&=M8fNo$>vC1XN9aHdj~Y3(&ja8 zrL(T7_5#t6)K6)O8bwRgEKrzp9XNqH3q#oUw4x8OAQK~mEFV!w)kgNbF>)+c+F00I zc!j*2vF@1sM)8J^icO}v!I*<4E}T%F=uLQ=v{k@ z*-d)~6N3r+q;hxq#@nT;*7nw|l`gDK9JWjdrx_a?YtU#{#>PI{*w`6sEM%Yelz_!x z=9^T(i0au462iyg@q8$oo-lPYDubbC-0qxaLp@7zXcubQcUo8QYmx{l3}MbY{a`LG zhXNAZc22YE7|tXA`&|B$T>N=Xe8zu_ zmJf2&vZ{B+Mjl=zl^mVd$L7T`dA@mUe)2zaar(Q68t?HLdFN*XB8v>_bnPd5R8Ek8 za5+3A)tIv)uMIh4quKy*YTUPz;mj7^C%`g44*&qiUPM)u6U=&#F~@G* zsI>8B->(~kj7JWzvX^_@MJ)^6MRMA)dcYVF_bn(xIWN~BkLxcZ)0}^x> zcZS4=gmd|m`gm~zEa9HNvY0i!`-7I3)QXF1^{U$7Y>|gel{(vlevOM$n9c6`0C}*y zONtqKdxKttokd+r4F4iD#5D1e*eRVk3IPgNHp-;$j{y~AkTYd?YIT7H%TOqrg5lY1 z>yp~2&ad4bH)>l`mz2!{9p&(J>?{_~$UiW8pypnNZ(!{1Mm(ds0x}ju+f=JELJWIL zwE2L#wrmxtP{UU)Hi6-&gF9j|Y;(}voRh=g6so{G9|kdbTdmNxYbkPp>s%-7oSP_$!%F&Xj z$yPQ=J0LeR%k8%iLuT97T(QRX`~=Wm*Jj}Cjn?8O^x1zl{0El(;T?SyYUdHu{VI(8 zrO+XYKuy%&Dc*VpRQf7ry)H0_^~UtFBU?sr!O441immfFGsZMY(Z;p5HB|S5$b0-Y zXvUksFjGa|kDQhM>J&q!K6d0!+F4EwqeHA~2hJvM`cK^bnLC!x+L5I>HA_y5s+ZeJ zR?JMTDsSJUUMhe|dl-Eag*>%Ks*NwFc1AUT{t7O#mkoS(o%o~uv6;4AXjref)&pET zYz+;V@=E;3Xw;ZnXyeN6&xA^Vb zK?YHve&FDQ0G&-^X2@U2e&~ZBI`*MGMS&IO{oX04@FO zss@}KShB`;rsLKdEp`i2b#Tk|YGJCL2{JsQ^c!Xy7n;)jj`Xu#{;epwUu#BJd!~U^_q_&jetoo}ehVr7Xc)T0rFGG&I&o@)kU1nx>xl;>%xx^pAV zY4c5_E^_yyuncB{dD?H9r_Itei7I}lip*)khve=w5u7TrDZNW|$(orqt-8N^x}R9D zv?i!(w%2f6t9^VcI>4E&{u!;osjb0jtyzxw@{(5ZV6%BRj}cPw()d@sZYMC8-pWI* z;??xi_tHj^s+E5+9$B<~<3E+1KP)|}26^5_j z^9Jz-xf;nn${A;P1`KPuQHen)u^PffKmmcu5KI|L%Ge~lDrfzt{FYByC``#BQ*g#O zFRlV*yg=WJzsQHHhJ6S+zMn)!guP7s_cCF_u63c|2FBD*~=`dY51%qztGh^D|c>ddHs2h=Z zTCq761L$cJ+nIQ>ASXIe12v0A?vjqic2ctzi<*VrqRxfEBC${}a$vUKmeSy)5$);C zgCR6m-aFV&%+dQ38(1sBaPMV5EuCj&{$rVDXib8NKdru!ptH2--AxLOM?NDm7uO#q zE$S!TLfR*0x4F5x^vd1owj;fMvM{%(aiPEHXYjwrrx;f+sW>?@0dYuR_(J4EY+mf) z?`7lIJys^mWRgXzuHNsV1_HH#?p_ap0{u2{vpHCy5DDqk6LWRO{|d1NMmdJX)nfd> z`@e)KeY6-R|IDHq)FjgjA-&+h^>5zmx-{9dZf8wb*tu7i-TCW<*+m8RMc1&-ktQNS z27t({B^p8>KQ7#7g?Li{6Cv0GHu4f7J5;^+MA)C3BUgc<#gDJ@PA9Z&cRBi0N1W!k zCp$H#IU#hfW1L?(vSB0y-KPJC+THe0yEjQwcozmVh%fsg>d~Ti4J23=dX5@oJA52AwNy>2g6(oh4jfsJJL^=xY zK4=gqZB$26iNJWP0ZzLYLBC%o*?b`-pd6N^BkAMCVg&sp7&#sl5XPnZ_99`Oro$ZM zUaZY9l+>9J>E&2o5KOvPNRZZwQY0Bw#%*8Ar%t9>b;$8*1CSN^J}KTdM3fJi7!+4v zUKr>j?qgOmV=gIs9PSU3o6WYmsGd|^R68bh(V#LjWz)1Fe%dIV?mLSl?>kwG?WA3F zsgHyMCcCTp^oA?iY9AgzEK5O&sqqjf`z z+AK6((}#lBZj7yx^@s!fTfHGb=&KdN-GcA$+GuLX%!0dMPg$xUs_NC9g4&Lp9aba9 zB4}l4UXZdFBtH0Cre2o`+M}{)@F*Z)8U7=0sdiX3tNGAL-CVmkaP4GadC?{dBgTA0 z_hsp}XwhmKM@2SyrewH?v!!Xy;hs`oi82VO(?!}UAjnYv3wbL63z9sd7XX=g$Jt_s z=oQvZEcmDG?6bD`%6#^YO+sKzvavqI{%D}Y?%25 zZzlxIExj(6M@RINwI1pewpov%SyfZpz=j`H9T=0B$Vp7{>Dlc9tG}bc_StOaN#Otx@J34zAC7L5UXm$5i`6=)@tvLO(tFFh z({egzN<56OIJ6qlJ%XHM4N<%z=l<68^fHjhR)4v!T-$MQcu+g9IW2MXNuoFGYw7j- z_P1UTan8Ghi9+7w#b8w9b96}h3naO&6E8RW0>_QtGMSV4FM09fM7n)<(>T^*R=9i1 zul!w1MogJMkoHTA+&BHG#hC~!%eqabDyL=f1<~Pzl*ecaLOiqkLT`SO0m-*OytRKi zCT2}a^}k;q7+d{GZ`?PgH$(ea*P3EHJicsca7vllZ3rh1YTA%RagnX$!D!lycNQ8o zh84+&A<&Gn>Al<0`LlGoz1P&2>7PdbJADr`obaI+JU>Q_DIpjl@kZA8ph;Q_)p6t= z{=3}m5~Q3d=us~hr(`;&Jn7R6iD@hcj^b3+@)%z!QyxP+CLhp`!oS}?y{=F@j8}iJ z+qZjq)yqV$-FJp<-KOfGPRTjB2e6&!_J?(&m-|a~|4v zdIAP<8n^<~Y#eNh*HUiUd@MSMIA7WCiQq<-i@=HJKw@XA2yKoXYNwVuV@`Pl zPiKMNNDh(B_84OV4Nuo;&S=CuwZ*vDyp7pTu=@KCRtN26ok6d1%TPL?@EH4biLH*b zRZv4WIL(7N^#cvqZaX|y9EmkmH?4kFfxXh3xmx_{DkHw{Kxmtt(CRPDpi*eQk1bW8 zn;9+*o7LM5)?+p~Gn782g6Jin{h?BNI7R-wb(r_~!IEUof1xZO z0FetmG{ng_!d{F(H$RA;vRltNNL|LWHbNtJ_rc^27_Id#$lnH*hd`W`E)Vr`Z@G#1 zwds(w-l*zB1^@*?{gmNmggMRnPs_?sYZXjE)ubJfc4~_qJHx!!?_&eh{f* zSf+0>w_@jSVd2UTpJDI11EU$%;?taD$S?`-j2)mFP`Hhb1^<&qTcF z1P?jh1UQ`P?cuteT*jjPqO?~i2O$4=nLoz1zty8;KFqcf9ua{_Y85DSEasN z$SLHoR_it&A>^l8Ot!4=?02HyQ^eGtl6W6@g#f5GZs1$V|Msn( zfiHyr+ZTopd?EM0ePOcoj@$0!oJKFAHlvU6ljoI_owZEy(Q-VHl*7GjaIq^kbAPE` zu$_&}DE~pYM@q6-#CPfbVw_ib#?4Zhf6;ZHcU>~kNWW{abq53hzE*d-(Y>yJ5Y>>v zi(SGkFF5jPhw3@OVRom=c^}*AH8Q^ZET||a`-~kvZ;R(3cKQ*`$4{xq$Ex23hiy#O zA$f=-;6Odg!el$;9H7rLb@l~GlOGX&O>!#WT;~giORjO`O2>Z0;esu}lqmQ9rG z)Lt%oogLn2iyQu57j#-LqBM}ldDgn}QP+OVRW05(j^akvpXDD;_>#lC_u-tjd$$ zIwOey@}Z|f$6*)hpmFLZ^eO7rvxFej4NFM#6{0QMI**}JSCGSW%88t ze~|8?)`h4C%+8tV(cDu~KS_aP%B~RRkWWebNjaQPe_<^T6Q@(xcZhF-n>Io$o9to8`rTx8brk3ppE&d!PcZ9jWhWamI__Axi;rdV7?pj;k z9oqMX1(LyRXn(|YL3Cq)T+z;4d=2%3*4yedH+%>AFDdt^nr@TTgK4p$9ay@U60Gz- zq-m+|I@}#TQ9CmeCYM}_(Xaz5++0k>WX8G(c>p zXSPSL97eIk59bnyLdPMI2iI~q2vQHkE~eira@rsooB>!&{V9$P3MU8tT~D4tvxJ-bjmv(SBhp>xBb?!6cslN^(X6*i_h2t5XSG+g_;@MnX2vsCP))q4kH9(=XmC4s{N>4046sS3-O(vR{ehYvHB);~-f^ zT}byeTf(UOw{4Q1)@#$PQ|qIKe0q*EzzNnudkIVbF={vPto}S>=T>VR;=0%}j)b7u`iO|Id zlue1f25RwnFNzjfse@tvxQus7rtRcR{b?EJARgue>2J>qAu!7yS|@^sL+25a9;O4$ zX>IT-1*bLfU=iqn3LO4oo&6-p9T|!v!tBxz-nNGW?T^~Z24nR%K@#Ky z(IgM!wWs+(BgpBc(tb)fYlQul?R?5OJ11PB-sj!8=N(0DBhb*lBcg{2OtmKd1x^iw zh@+@D#Tu~vXOjY6YAe^5%1lzH_Es2}>o1c{xki&DVP>aj8P^=Qsa68!t)e4p-@juM zq+HnUb?Ek~MM?~I@w@Ib#83c@y$k{)URGfLU1+qztA!qTpLrF8E&U~!wgO&fXzPVs z5~w9g9i@VFYshy=e8vaOWRT8|dAx2uh`3hRE1{sy*?>^mie$OClu-DcEj1nhV=onW zHuflcGkc0NJma*CaW|6S8o6QM;LgvTc7t=FS_L`;zcF@I)@}*_Nnu(w$%|>!fC7Aa z%51Ygkn0WQE^15XP*Fcn#6^9Im%4;14Ht}{<#M*w@3RW2-g2MQ>!8;b`?A&(iT_|W zdY(#-6x;%p<2;dd9?v?@XK~UUmn|M|Xe=Gu60^}((h!rPu(NS0B0i#GSmjf^Lww`@ z)pXor;sN<6p4a{hX+}2g>)+O%*4P{LP2|04+rDY>@aADFB#rnz2aF=!yKOXWBJVc} z4(wuG4U8;9rBElx!PSVT0=un((GrgfBD|*E?)h2!ToJ#PgY%}zZqIbsn+0U;IB#a{ zS911YKKsE{37YP+`4M1f?a#9ITiIYA`y+&C@G?aOsB0;c&$IE_QD(K0*Mb2wDHr-Q zq*BasY=hIu%8p@n^(VRU_NJyV38bhB!Ui4*79XpHxULYrllLFNRR=a-)>5hQS<-;v z$%Z2^_JhC%Is2NhU(VSt;T8b?aESd|ymv2}quCP7qqroM2CVcCbD}gE5jcl-KFdX` zvdRy7?fu}T8%ecT--p&X_$=@LQk|FYq6K)}LAijPz;zsD84!tmg|P8Oe=6)-gnd(b z$Mk~@wTnN_p7bNiwWk8(SASUQOKpmtA8sj-d#t~q$qLD+Y=S)fsu+DsnQ0)GxJ1$}#lsrSVYVJ%C;630bVmM1-G_=t_njm3 zA5rzIEVvbQfo=NjE=snMakB^O7n-;|o<7KW!`w_{7KJ$6hirK#dpG0`>lm_yp_4YQQM6n#DGv6(ysK)l<_kKlri%K$eJU#?)Jd`si8t5Y zf+7)Z1obX;^xp#NkB}3%+z~gRPwVA%_~*~A)1>sAU8k;gSt-`Vzg4DPb* zn)2^Yg1&$6``ggZFxWn!^cZ{VSH=K$hx|gax*Z7`)HYPAOD-cYflrh?9+xz7W5`xQhQfN_WjlP z`UlncdO02DI^7;658T4)ZyN3m6T=N7c}K4@jO4x9;qEXsJQ`N+iwO>U>H6!^{e+mQ zlfxik4CchWW*IbO#`d#>|2zPrx5&2{c}+_kW_iw7OOI@GTy|9qLh zEhjG|FEYO(mgmRu1+jl_oI5Y37Es0+5uh&ka^V*CnH76!#eYAiKFAR$JhMVocSN0D zUP+T)Yw;RSaPBNek9fHw<3)Jw8ZqqitIM<^SzkWL6HsHfTTrJVDCC-yE-=yilNN$h z6T1>vd`lQ%vrey2(OJ&(;$?^Mqk&AMIR^u5>t@}qfufEC&x{Ej!w4kG0PE1{VFP#I zFLD7KV(5}WCmV`bBXPY?!oj_w#cuXd3+$HG=Fu&Y%GE!Bnks&oKGr+LGkQRby^d!~ zWc$(d<%T?+7I6Rq64D6dWwx5n7+;W$ zYbW^5;_XFVA$Ru9U!#rcn*jM z$_8gK9N_3-*=DkdT$jen4(7LZc4D=udcdA>WrJlMCT})%#GpOhN5MVNVe@$cq2F^1 z;DmfK7;LJyLAJ)(Cfw%vKO^wA8IA*$;WiAFO3NGIqJWlfZS{9aj|$j&nCx@p1}Ue$ zp}>X~au^9py?S^EVW=rv;WNs!=2$w8OI#v@GdvcX$f&PoSf_P)J^GQ8|6{>3rHIsL zvA(fFC*JKjpT+4A-qYQS5J+|S4$$zwC*4c4>awi5G#k8E5lcM1)YG?A!doly;R^Hw zhP(e*A)ly-BWmQx4DZKz{~pKx%FCCtT=bQ!d@-AODeL_s8^4e(n4D3hgY$ki`llOp zM(v;T#BM@3hw=&yPxpc?HVrYVkq>O)Zj1|Jat1XK-@#SJvI zannw51s+*l4oi^cps?|s3S1f@QxPo#gRoOVB`-TNsGo8BCLK{2Wh1w9U{zk7dc7m7 z{{dmWRi8Md*~l2MmSH=N2nDrdi)E)C6#1|9IN554RWHi;^jRe%+O64#TW_F!xI<*n zjThc2B%MsKsz+saL*=pqIb|G)^?zBj54BcFF;~r_p}QjBJ$G9*EuIc$hAKnuTyvx} zo9bMaIMmXIS{B2DRkVb98^gEXZV%)p{8xH$XGD`VyS#;-kA|{^-drdA1J5<$>*)rw2Do!=-Zz9{+KS@9dogZAv z-awV6iV%}MCH#|>`;Z{rSbaPY+-_mKfxvS@aztRje@m-3X}Ek|%jXC~h8q)Svi~OR z764(FdAUo$qJTBHZ!Ws#gLB=7=CbA6YvWQKj>xpSL$V=Ch4a_j;*?xs8jZW5bdlIQ=n?quk@B5?TH=(Lt!<8 zRAC`t?oPr*;1XL_{yfryiJD|ali|`vQJ)Sfkz#%2b+O1z>w;U%@^TAPfVtcGDe1Fl zSuN6Wq0_CKZgV4w*6d%xXj$#tnt{&s;|eJ9qP5gcq@qaSAC-juO{R+6pOk-*vd>oe zAUi-x$f1~4!O$g`K#x80Pg&|=F$!fRat6rQ zT5hb~V*#XnO zDv(~oiD6meoI2vM zh6IgA0@BO)A6ky6j;+ptPGQMv8|aiBc^Z3DABlYNE>#g1I_e@v{E;*gz#s@}CkPaZ z7|3Zna{3aMM|~+nfiCJ%x7#2zVEAj|3zrJ#3L!5Q2&qeizwwWZn+MYd-)FilU3;IW zt!)FHH;T?HVYgH;`i)BlgbS@5`L8POq*mcx` zy~>NP^^E@%Z6;0Bz}+hPHPEMiR`xhB(Rpzh6g;+ zKU3ETJ;~rI@st}il80o_Z39z;Qecq@?BWk@DW?pqQddfKPOX4tm)K5^Qg%i1^IFg@j3k zNKbVVfyN-v(@X~H0`Nv0Hmu2}dKX17uwGkfWaR!X)dWT!Ji_>-XYb4cBzCoVnSM6! z_KZ&JzA#SgY@O`6+t>H{;!O|S(|tZ!nNO?5qACJfFKe>^CeXMI;d zM4MVz=~v$ioy`Zs^>?HomU_8|+ynUT=Q8gb_HuH(s>hC$KR zO$~N0Q-^rF4Zl+OCRIr@&mN|pIZVCbsn;R!ai2ZRdGau|_Ane7+;vIV%MPsGz=YO*gC1ZT5a+kf=_CY58u#flFKK5B5%(lY$V&0&?A5anf^PQyNVqcXg_Kz6O zpQ%@RgTI!O#WRqSjf_haT%-46mnp0nY6Pi~9!o#s0C)iwM26BR)Eom(LY^8)@;W;i zY+22Ke&83nA(Npj9aAZ#GlfNVoqAGyY)ESsYj@!NVf7ye{(Ip6{vVJavqxcRIOuAB zH=v)d#d|XIt~^6o=Va>g!MTBZeZYVuyF%%8%K1jA#X7z}&<_OB{ekmX0Nkg`aCT4< zNH`__6KfluyjLCZ=fdYfZjXsy|5jaxC z51GtSafOh0k&L<#qoCn8Ij)??ul2X7XG|I=LIo!j{qhG?GL`s9KojN-i6W-J389Y@ z;!!DgkW)p!k&kuyE$WtNfeG@Aa}f+jZnRAFn|it+E){kMLs#Md(IlZ#Q~-)mvo6o! zHf;A}1L%|x_tG6^O`iU|2~Y`uI-{-GNpBs%g#?v1>hp2>7IDNnThwiSzd#2bZ9Neu zuS#S3A8Cs>Syl3H8QvRcn*3L}E>)plBhsYbmch4Dh3a9i?k!IaRXrK17~zRRVa>2y zQsa-zYkG)OV2_LfoHa$58HZ%F-)kSEGOw-YZ}!A7DStDJJEZ$mX#)?H?+U^4`;k0t zg^d1rmSOfp>Jy|BghKHtpp})uXfbe+miM#p!E0@9^J=j|4S2Ge{z}!v*$GU$B&x~9 z%DOz8T1L7h(9qhZN&{&Wy+imoh~P zB;G$vFTBCBCX)?~}1sMw47+p=uzuG37Ur%L_;IiO@f&-cZA``FZ z9T9mSgydOZ34PN$vJrY0-Z(SFnqKE>(dctqLyhh3=rJRF%kk9J$5Opyghcn$HgXjXenW=MxNFBz+pug#oEM3CgN|@AU z^LmY3Mgw=(G#2|BBs8WbX@mWQ=d~sHhUS$LOAdR^dvutIJI_Aaw{Ffi=C(s69{3|| z2zJiupFbw~t*X~8a%WZ04dh_g7(AxQF+lRRfhJldKv`&iQ-Z|R*wrhb_e|{y`Bx=B zQVZ`K-+qAea+T=NnM~$cl~!o{v=;q>Uy&MGIENEC*pCx*>|pVliS?f+kyUwNfdS4 zTLdPwl6Yt4yrnt$O*SnQ{8~1UNejHNz_}I1m;rKCI*Rz$x+@TrjV_|2pg=qw$hAQk z;P_0ZZ?75mBQEUz~*1@m2bB>sF8vJ+&uoQrffuzH#Zo61KWdA{Ax27FCtdu@3lmFjaH*Mv) z{2*8*C#{tERkC}fY+fbrkk(QsX)BVFQr|9K*Zx~tys7^|k&DHa>le7sY~!E(L>lPp z6GCx3(GN>`zrvBk>SQeFl=H=$%@{CLd=Q9!Q}q{ExhWtQ6egAPr9w>rkr+yrVLNE# z?o$D^Od+63^lQyZnN9n(vP!Cz(p@Fvm9nr(hUvbSZoi=y=|8r7TxUJc`AHGJ%60D0 z{`aujFyvLd)=^IzhqmX5CtUlvps-v8kvLbm7bx$1vsJw$+jV%u2E}h393;s0NNXX5eTx!uu~p2fzwyS zwYJ$AOV8|`-Yz4b(cYZy=U2*jeJ{~h9Djf*vFR##4qd}1H;5BOe3D>ms2FnZk+N{D zpOj1A+xCgXYKshr%5|Q5y;s-bwTA!D`V9gjCcYFs>A6pN`6s=2xv!S_F56pdeVg46 z`d!m};%B=!za%kHx+N!e_Hhm_VN^l2sOR0{_pDVlZ{bar;%z&A&t{3p-oR2E+~|uN zAWdiby@4I3a%Tk2YJ~Ja@15$IWTtMp3=E-AsrW3(Gg*PVnTF$Wt`1}2XvW!{Cy&bo z=1L(-R*MHD43EYi%3tj{0)PGuh6hGaZV&%X>wrnR*$Db_@`Q9-&4>8$_L{1}Y7WWC z4&~pjl}XyabS48Vw~`X3Qm5PBb#%9@j>h&wtj~kwMc@6%7hi_r#Kb+`0qnjG&#(L> zlrIO)M}ht@-STzNMqmomSnPVQ75fDh4fm1L==8H-edCbLr-`U!-gDKvu3DhxBeLcN z2f6Ez2U4T%krw4=@caV(Le-Y`{ z8-mzGfc!3!)QyGU8nvAYQJ@2>iK`GT-F07bKg_^>L?md*{ z(!^w;ms&`}dB$FW0BrHI(EU85(g9w8Vm&4AT|kHogH9P=NHNMmki+5>d`%S{WS+w3{JUoS)M0m3hH;JE?*gHW?wr47 z_LXnn5V~v&m~K2@Ep*0(!a5a6X71gT;H@x zLtda#Th-K`e!uZ{H1or{bSzYtXSU%gY5(YmNAIP*8r%#nLEyf~ukY3Tf$ltUpj|Co z*mQ#Eu&#(r{GElvz1bJ%X58~YEcyC%)^AF#iVHLDij4TP@BYR2j*i@Iyt_hqr_pBb z2<`g=bsrI4TL(7<;jMwV1%y*(iFA)eZkXJ&^#uk~8j$ay2_1COJ)io#=3vb2RSoA; z&knQ8%qK#{#!4hB$wk7UU7Nb@Fq#D!8%DD{iNd0oH{W9QL7M~p)>PY3RbZwy)3+m& z5q)$}X{AKGAdcBYU?_NA~0ojq}!w=+2u2W7ti{Fe{mzip|12dcCy1*MEvp zKSA*LnB3#6FX{Wj-{@B7d(yJ)FGBmI$SyI6-}dbXd~v^DxJ9U?L;x|1z6!!`A^W0_ ze>7wV`#2@fc#IOaAQi~j7BBnJ2gZG)o$kTOyd=#E+fZ&Q4=0l>9m@u&T<07uj6T_E zMlmwjri7tQzZUSJmvA~l!2FZ`Zp^~rksnv>^O^K{LMIf{KIXpY?+Mo0EC5qmd>HsF z;@j9;GQNKZ{2N0QfU<7VaHeFvXa}6t)xO@(MEe^tpgCe(Ui+I=HDA=RtWK~@x#Mf4 z_*l5(5x7ygA1cd_IA@KS?2irbT_4u>AM2-lD&9*p%xh0M@Uu`a(AT>n{4Tk%~r}}m7Jfp zM_B(Vfbu&o>nzX8^Rs$Y);&9`iFAKipj|g*rC!9>*{<<&gRS4q z>JO+^fre_4reRrtW{f+V7z#fl;7YT}wlU5dH$NZywTk1IJe(OIrZ=Wrv!r=6bARi` zQjGaq04ZA}S%&p&{bPof#LV)o0XrMnFnPoDhxO@p3vvsuCFzl3=;pUIM2-SbpGZ}E zED6e}eN`3k;?&RB1moYZ$wHemjCW@IoE1~1;2UYs$@#TN@}X(fT}I8hfQ;{3$DC^61M%{Wy5 z%;!(wBj?J*UXj>(x~znQ8VEKZcfW_8Q&m9jqZQRWPWU`%g>hzZYSW=3H%N7eeI_;h zxEbCmSxB3K7C|!(wbqzc+?}X<6Y;midjNhHT5xfazuvSUukTLmhZ4qQ2)Loz=T}0> zU|BoqnTkV+o+y96z6qWv&;;}jg4U)5)1NZ}D&+FXgOti~X8I3__H=nf#KYYmtzQs- zT4eVGflb1IZna*jB!A0^leII%zp)5Uh>UM3u{wTRloV@Uq!t&AxUoMjgr63~CyePI zv5XBag{io?Ifmit!?L^1M7nzhhL0~^PKQsA+z4Ki5ynkTkV!kjSM4y_kZXu2H{{GA z`P%Erq6UOap$0>u)uMQ`wP1re-hTF+{C;Xqu-`LcL_D%I@Q>tOSg*+Oo;XSZi?&JZ zVb#@Qu?#*Gevo1PspHkb5Ylq1py-sK6>{RYU3DJ%i?~AM8Q=;c`ru+AwuG)BkE70l zslXz)+R)kK&!NX*On@KMOiNNxh!3NvgHKEH`GJA(tsKxMi`IgpMEAx+zJT+<#v|?x zVRh4boF`tT@HCJeP8iDUmugfw=Js34f$XL}WS8e0^dlaWvr@ZjC-TY(EHW@n^5{KM zW5^#RB%G}S%fX~{7E~w}yP(uWmfg@oeSO1l>pl?nwvcD08FJ@f%%E26T)zWkH8$&g znaVM3YGC1?ZDcKvNEKjzqVBC>IGDq&)UH1x5W)Rw>mvdIx*^2orWPO9X|mp{UgMVZ z8n-#HE#0l`2b9jiLb2u`WNWoh)>Q|EcRTidj##47FE~y&;i&ZjpW#r(wHTTZl@UXS zuWwC+Jghb9HR?%dk`9U4+nJ_x$loE}kps}Bft0UpDANL4TfgZ?NVu7f}KsM`m^*lzJ%?ip$UE6aYu_I(mT4(t?8z4R&tr^ zU+Vg7Pty5gz{rR#>)&+B*Si$Py5H2Z3)Z@LCcZN_89e3|h;$S31c~R=ZR&Nhs6sdj z=cjX%NTB^5nB^B}3DHT5d|k;##Zg+KRuPymz8afq8Eh$A4-6dFgCFHd7_XP*Y>c}& zC}iPo2`b!xd1ATNtkDSu#z2tXf5mza8YeTZo?~uBgQ;~%dwjV6@g(!5iqo% zgypNxV8r@oV6f@<-m2^Ey;bN*9}Dh++Vlc2Vs0fHUy#<31UDINkEhpp%7dx;ZZEh; z$)oIcUE5Z`H&rP)<*5<3hp|Xpdk;CQCXQ5oj6J3NZ;tQpQ@gKDl1blE9rCtX!VIjf z4o{D8ug%rW{kH5kg7G;)_s8~2ZV(}U0{{P%gXFDQUC3n7B8$HtOxX#FsA%3ud?0%{oBEkX7R z<9_(k7hn9y{SZAB_yq@-;=lk~nbx##kxLb~PNQRWB^}ynlnR}$WNA4|V=pZO>rL5G z<6ww@0-Bb;BJOowHvXD*qHEwi`Iwtuuw(l8cL8E46)KzBSWjfXPBrQc(oZJdEW8V4 zv_ghAiC>u`ZtLh~zJXdRo50ibrr+vJw;sn~awTxw(jXiCVlHs6Goe!Z#xQD35<;Jh z+qltbB55UhQOh@UfH(0uKmLo#+^+1uC~viLu27kaoPuLR*M}}1xW@(2@j=~cr}1VW zNli}n2iFYy`@%XB-KdgrdgxuIql!y}nffpj1Yv^q-GFcGMo*=ff>+a-7|&H`NSVn4pjCm!LcmA<;f7aGIQ z;4na?Dq~hM6MUirC#7zdwYqyV}N^u4&?SzeRHXCVD(uGij;a+{bHQc-!LxjkH@L~#3(UN z_h-k2{c`kH)*U%i%V#q3NugjAep)!s3er4%b)AU+BH|Z?T9XyeWcWav4}#l8h|>E+ z#$fVezjyumaV}IpmbFYEmpGPa(_Tt@ry98<8dy(aPgNOhc=V8&x?82|b84oHv=%@E zs=-0cCe|=V@3)b)HWz;qXTFZb|Ad+l_O}#76@-I62*M0fr>YceZ5SiQa59d7$-_TE zY7m)u+TO^R9y`N`^>?g}+z56kSdbe=@d|ET^=C$_QJK*(7ZMDC9`nv?rUHu&w{Kyz zom$-;fEY=AT}J##sx>%&$r4ekGnq9RWQ-Iy zh5FV|fY!Ync1IX+bnenff1MFuk#QEgJ5YX{!FQFCH!FEibU0@1(IQ+b@?HQX2Lnf3 zmvz?)^-2cdId0XK;P{xi^-MPWR8Zk0xG3v)iKk;8i%Or@?IPf@Jcgc_xhAG&v-(ol zN5*_V`-0Gy#~|A}9n)_|G5wAN#>c*{?w|ECg&~cq&9lnj7e%|K2Mv2pAzj(5E&En?Nd_FuPUug^Fl2#GdfDQ=BZ z&(L$Iuu5V+{X(1^G%o}tu%LgSc}EFwk9q#d&QbjZSfI_+aYj>EWVAO5+CV;;Vtq}^ zJ5J10pYA}*!yUx0sre(jo$~29_l%sn=SMeid?s^%xrIk%;RS-f`tLDgNaIF$EEZ43 z>WSEUKda86%hg-Z(^CpC=QOh*8GWK^^`Y#uQv4nQ2eh$tooH1@OXQ<`*SGe35g(fqAI9o~SRb9MHh6JXEX(WDFy1kZCRmnYU~vt?CT4ITugp~lk%8N& z!s}12ik+Obpk|=Y58&Mli85hgPv&0ycgLE7SMH7u4osF`m{IK8Md48R=~6)YkH^MZ z@N)s>OK}oh%t~~w&^hBJsP4a0;vX>S)scVz5QJlGw-CXBXU0ROTwOt@vVe-o{{`dL zf)6m!idDxxs*Fkh`Gvc)*h$TBY6JN**6=Pk+4XD_K27vA7H`Yi(s)d{<#Pts<7y;f zjyc;y!uo)-nVKx-Y~CFAzYO@?sRVM1>ba^EeeMu?G!2%Yv19&Szl;VfCmGs|A z`rZ;fSERNLt{lHt^m}92vjnHryyzoOP$%3rS&s{#yJv9*^Qs|j_DFX2vOGbi^~fuX zq>+=G;MiJ2603Cvh3acqLnQ8;^vlvF>oAqN04;2n-jgImnH969HeFw$5s4a9MPEs$ z@jiMcIFeKs?U9sf+t9M^6N?KI(@V~~MI6YpSuDD$Z+U!lYa}#pFL3Dz%0JjGxLPPr3e?IKH|3l{2|_jUsBkfckl&SCvKVH?ZW%7^mckHwPksF)HwJs?o2Jb zWrk_3ns;w2!!e0|hA0Bn!03w12-7{VeGGN8SbPpq9+S?4TbWg+1u(Jz;b4ZV0;kiG z-pQ<6;UugeDp*1k0?>A@Qg^Ox7<45Q-cwL0b`{5;S7e&jZcjg1*Y3no9)QWOZNnwlFhc|9RABRwOAMFWCMHLSVur5 z0C3`4gM#9_7?RG293^-EUEtxqp5_962b-U@ACkjKvMFNYn zTKz|P1D70YbU){67A5Q>8OK-=(@oafQuur;5ojf-P;iP*wEGT9h!aJ3IF$2n?Q#|lkpy+aIrU8{NYXy176 z8I6wEkSAWdInyNFuq$A@}9rK18NY%E7jM^q=RVyr)_9$BW{(pR(2fP*4 zwf|?g>2rFyyofjJZufX5jWr-RYw8FK_4ED}=S5$T_4>)=dfNePqyAd`@psBTksI}b`i{qG zg_eHegYYih>Ky!4?w7xRUnxmRfVxYn*i&o6lxAMtTIRKNdMD$3JcX(LKz?x8fF5Pz z_~QYx*^){Y5kibGn-3HR4WAJ__6?Z9ZZy3$7OOlbub=Mk9>@)j7--}9>{(usa#@aH z!F~{*Dpc3taF~932He3$3I}rodT<8M>GiOy-bu_(cB%HMk)uiCv%0W9!BrUnX667c zA=>{~6mXRR2y$sa?>}Q88tmo!2Xo#bN@EA!9kE~kzR|!ggFErKGXu0Tp#Ln~dxZQN z@fLHBPy=%YA62vcof3ZB=Y%KlBUG7dx;p6|E~LPZ$Hkk z-5%@fw7OQuTe9x&Lb;C@i!GhLjDFo^9_v!?bc%QFt9Lp9c5V^+Zt349%?;A*Zq^I) zWteQG_e7{34aH-j_b^ioR<}ZU7#V-PxJ!N9DL%2^{#d{dYFc~|bHF8%YaW*8sMJ@t>wHRq)t zI!6W{#QKuF-l)Z0I=PN`s)|5jUs_g|Skp6Nfr~JK?$6po-xQnMW0M{}`5;uhDgS0u zyuzd&vFTiW8Z4_Q^d1cK zCLNz<#2Uj4*G~i!D$#>7dJNQgxKwABX+!tY7nrND>;R-dtk*5S=*IWS5Gu2CBTC}p zGK{h1bE3X;A*U+e5cS^}g^74J+2!dZd%X@f;n^4Gm*0>2KZrnt?i7P2B*x&1tG&_# z;M)@_8Xq<8Z$fy};`ix@YLkykk~ts4%oy(*D~f4%%0&6zytfn#`E=JOs#9t9t|v%< zZr4|J$)9!kS9PhMbpToh zZLaqq@Os0QFS_Q>E<6Dn$bVQd|Jj(IgRp{YBVfk7OW}^MqvuTK1tXrfOY)}}kk8MU zlBsZ%=f$?+z=5v7aFv%Exy<+{h2mslSiVL6Yf3C3t6HAEPIUGpN?xLWX5+Q_q!qdUJak+-l=|IWPA`z1Iw$ zXTHSQd|7-Y5ml-bNADef$?R>|pL{9Yd&GX;z6b12AmHoA9@uw4^*Rj;wqS|KR)bXzZx(t7GQ; z@KN<6|G$%;$RGP~(H=X2-|&_Q|2WaLOsJ&-)?v0iCkXF&QCKd#6GiS+5eN^$$&-aS zNfaC09~eNPD}*{-G@dCkX9)Ui{|{N8Cpu~$gP)iAzEa>LkF4?=Vu=_T7rq)F9939b$x zmM$txr8^l*vIk4DUyOra-`a;`zLC0d1-fM%+@Bh_-RZW=*$M|9OvtggH6@68FSL6WW9uM3tL2;9+De_y|p_h2g zHLtqEImNOZ{*v)u1X_+J1;i6RVay+hHh0jvDtyS82Mr{GbS2I*f>HZ0FE?G|nk!s! zCG&#CkI_za`Z8Bsp1#h&%IsEl+UAa}PMgm(Ny1LQv;{xBVLQ*PO#_F%xY(NFpBd7| zT9-xgCk*MN5mvtMK^wRiQ)G_@Q~ht6cZ;SL&k%O%&W}t5ci^oxFX&F|p0zs%Z&x?a za+n;26jk>5KCIKNrzZHD`8Biu0FOofn$s`&MeJE%XrD)QP496o15V5^D7QP~Dc|;h3#Q@FvwDf>SgBUKuwXW=v zmXy)Y%g==HegHGC2z;Ws2_;#D;a#idxGl1jVfAm-Ko+gtAo-xCJy>G=SCDtWpS=fj zz83C}W0e)>_$fHVULlzf@nq=zF$9?RV(7gaic>=GG**8Y4oF#9E2D+f5`BEak3s^4 z99Q!P$jc%=T-Z}R&!)L7$Z!tuLZ-Uyd|Y&vh&`Oktx-ZW#g1HJ3;bBY`aIV2+`;Ck zvrKjNkmRulHB>~$?`ko|1SfC_-n+9=7BVo3g~rxz>msX~%?HDqQlK+yH@u1@!-GMU zCwL-M2B3cEHYWqy?!l`mLUJ#8sx`mZ3+z-8A%t&Y1*8o27gvaRHg7D}ipvNFrcaVJ zgm0G!3I=Xca4mAfO_T*p9$?_pDsh-5Xl^H|J(mi33D((sl9>j2%_7*c1l@qulHa3} zOz4*NNv37$^a!!=n!X|MuoEuG%3(HY*2{%Kcay3DqweAIZx`#~ zE=&b}cP(Nx2AYE<(66+{`$qf0l++sX$C?UFz1N@R&l@%Izv83w{Se%LhA6;m>vUcs zhK03ENhLN2R}oW^#)?V&&c4Q=)BbA&cx;t))b2qK`v8}y?-zQrjS73K7SO@-f(72{ z8Y#j>_L;|P9TWe9F&2(76+f#Wj9hFf60SY$-?9vRD3ac7ityt!E;U+SF6Ee^OJ71t z<#D-w#B4IQtint)m|BVIhL9^6^lbx7E?NG(U?N13G))HVOjs0{3a-879H2Q?XDYVb zj#-9E$M)%#z+$$7^jOv`Iw<2tR3j5YB&bOh8-pa1gY-0Xhr6~1PR-?C&Tm_ifv?s2 z`()Iiy4jKYa+Gdvfw!M-BWCb9K^td@+kJRVj$XT7D#WSc--=?XFpk*Q(fis+oV`$h zQkGkY@GxfP(B)9nYU-0<#n9kCOROORu|#}5Lttsj=ybbtx-F#JNptjWM>?C`0-$$0 z6-9GA5I8`u+=0WQmh3rY45Osp6K0OS4EH z0fdU9*%V8`S7n(m%>h3#B(1BI4UqKFNn19HNj5?<9uKJ%O%j{YHoO$<%uR}uLP}#k z31}s_Lq29rh#CFUthB;n;r~(;Xth1`6FXXLXIYN3dpbBe5YQo*=XbdbF+TyTvqTWg{m3iC zmfyd^Oam_t9?cdCMqctMDVnjtK|aH{3W8u-OW#F zoD=UxXqG$g&N*VYZs$TvAMvKeLQxo+iKFG^@Qd>Cvbe;8j^Z~wcWW8az^{b|+k)zX z%)wFRe_S?EiN3+V!fRY8lm;6}Be;Y=ulA0|6;WB)g(CmRc!ctX;)Y z+Cn+bu_VmI&brN(Hq!J(eN367txbAOu2^WUo;Astv=`x>9_Jy-xGmKe-OcxqlWRm@ zxpS1-NGY*7%h`@AOS%D6DqOqOo1?D%*83Q$H!|6h^!Nfi4nlnX}f??&#NZOZ!|EIS%zN+=%c zL)Vhx{S_>N=+o`c-q@vUD~-wP7^a7nebV7fDh+sp-3#>su`t`8nJH(PQP~BRS!!lw zRy0%0s+p$Vg(AciY+K+jGz(@RmY6R!5dX^!WTAC5gJK`>P1z{}K2gKsU^tKrCVbN6 zQ)ESU@xEdDll0K0U(Jj;u$uKb6SkjUZ(Y#qEJb^pmmbO*gj|f0d|h1+whyT0htBkCIpWW<9-rv0#O{jYuM4 zkTt%)7BG;y+AA*iOq035PcHP$1phsIc+(@E_HoeF9?YrtE#I>Dk#Ekh^!X=8a%sfr zoBNGgk(%U~*wK%_E9fpXV$6x+i}LeqN4k-NN3w}-W{nSw8YcQyi6)-Kf_Ll370|A$T8mm$8`YRN*< za`;n3y&V3&p}P2$e%fo zzO2s5Y#W?IB}EJDAdIs|JL@uC)(w&8#_BA1{%r4M@?_VEay?{!LM)fY?g~VLd3{RU zbt)!(v=6l|UoPQVLtlrDXbXKJ%mBcUtvE8YgEV>8+XOh(&i(372 z>36YSN`U&{!JyXO#~ou?c5_O+95M{TYv9?98AjpeOncCn_lNs{G|cv<4-VlZ%0vTZ zzw*o0fm$8Q^Q;4PDSZqfBNd zMJCOJ@>_SV6?PZJ`P89<7SPmL$a(VnVzT9D?9%_qfQjTUSUvygEzg<_bVR-4JOMOs z4;xt+N>LC-tS2ZkvP(Q@6@3`wQ1oF!D<*~lm<#4oaUjLxR+}=o!9$K&&Bbb?zcK4V zH+X$k`9%k?B=kFzRto3YENx=t++5T+(w5k^3fyMSqW^>;;vi+Ezkwz4!W1^EwS9hx*bv~sftnZlFv=)rvR>S4H7~Ah zG(!2cgeHNm()(NOO-g28rGS;4;}y=vK+a=12E)Q`uLu8SKut0`s2z#;>Ubxf5A*Z+ z-4nA7xppCa!$_0S0!Y-5Ye?v9xgi+qIJ4RJj!1ue%#>6-gXwk-MY5B|w|Z@BDTygC zj`1fzlLqE*iMIqecfQiiQjJB3C)p}U|HIUgG;dpn?n+IBo#YqgxS9`PGcI%0UXF7- zX4F@#8S3FVraEDxym_eW(*^!rmU`h4+4eB>A(Lje`fbJWW;;9iO}2||lD)jP$Q+cu zI5gc>2W+3ekOjvh&EyS2!ZSuq{>f%p_`MXHZHI{L5Bk3Ekv@tCd0jb4M!U$(()?cb zvFETq3y}hJ&3oczG0U6j)^$uxyL@hiYF+S6=geYLTYIB!@J`A4r)7)(D3~QQ?P3U= zl(#Fy$;D17ZpboSlQ#;`cobbA-^83FH}5w}?=c))JibB$z~|Dn={MdgW}!6yc8#%Tyk=xH%o&p6*;#s@`Apx;V{!)Y%1AzJF!C6Vkrmx#MxkbIFUL zE#`Q(;K!~Ty(6MG1deh91mYPHJs_|pqZ>tGer19g53klgN`;R~;=>YMFtW8S7)@z! z=Ld2SX19&lK!uny___$5}ZcUY`IHo6XFo zJqMTyRx_^)>p6)!GEG7>zNQp0~T zSRnKb1wT`sItIWm-o)N1@nkWz5=EosR09$uo_5#_l$$WqZx*w?o!ni~h+mL9qY>v+ z(_ZWUV`<#03kIngvCaJR%sfW^fo%uOb0+P}ko-`1;a=oB#XvAPcU07$8|n3Zi|3OW zvZn~TN;F_%9Zf-5q12TC4Y;99XE5&(S_>P~$_QgIvqnd-0_}vU@`sXsswAE)1?#oB zG3Vc%=o_iICgKimCeUqvDnuU@axa#>KbGb161_R)W+@jE-{NX$L@D)U<=~D{;W^a+ zQh{89xF}CjDt@7Cp3Lf}vLV*eI^TUJ8`L<3ugtKbB2U)Tlj7v$I65)TERTu6{-YTF zli8B>y}R?p2lCh@SH$s!ktrt=<_#I<&l) z%Z{_J^~}{IDq?d48mOzJ7Y=ClXe!nXZJ*GpI{)<)xjD$)rE?pQzYr9$YuoV2e7l4} zK(-~V5s!XX*xAri?2e#r`KHxK-eS3h<&oR5LcYwLw(;6Yqi7-T^Y@56$~|)AQMn^2 zn1%-{4p!S8bDT>Xn7b|L`$r3zdx@6m-xo4l3Z03m6p4RT-DqMw$%GZcL&k4LnF6w> zroslDsxtbfe=za50^ZA-qPw<8uP)*c%S7WZi@7_C=A3Niwv2ykCcc9@i3HamJP=Ki zQMB`;6#{iZ9LuMn-3`JAEU8Q>ey`|$Ky{jd@+J4A1*O|bL-RXK$h2naN5JgFO;Xds zvuxk4>iy&=3ec8qf0$ufX4E4v5ztGV#9~@~=>x!DjXMQ1ie0E?yen`tM>vx@wkgbD zW*L8>{J+im)&=EMf7@-C9dMp)0)w@t!CTwlUf+O1c&#d*uLd7g$yny_(f(0UZ`0F} ztmre9Xlq41M@j3yRSj3=36@y{?(PPwd>?3{K=1vEwUuszw08K=kUBm^olTWv<>8`# zsQTj+uGWSMU|b*^3yhD)k%G=7YM z@C|3u-l#!oRiSf7iv|K@wH6GDY;o?fwXKdK!Te~G-qIv4t8lIQsU{-s->?M8_&}Tx z+w`u@pPy>k7sLTf>6fLmyp^z{MKUsB@r5+3Vf=vGZKWEBtAwsvN~BuA;2y#W)_#$9 z3+sUuFw88WJhNf`^z^7Fi38f4N&ghiZ5*{3)k$fYt-Iz#U7D321^XFut#&X#YfQyM z2{Ey&pm!$!mmX@-jp_&#&tlPWEJJEm%_CpXn@*iSSkou`Mg}*zV?nS`F7Ws}$hoqe z`;GCA4r~cdujpkJu@ow;U|Gcw_fKd&j>mCwN6gZNokmd~5GYrlh(@4SNtbRiP=UEp z?G?OV(O@o4sE9A4x+zuw!LpC|eY2fSANiRJE8+q)Dn96vN^o37E~$9OSL6v5uch>@ zcx1`qSZkN|YFcMCOpcMT)qacinY_apsz2eEKB!((#Q$b70}ueqHg=+H0FpD_>ksXS z$tNP577+4ge})`aM==0m?(x^m*r}n|7riZOGHN@v)tNM{E~AE2M!)@3MqLYbc0NEh z!H{g8uINW9;$bVBN33j~OeOPDyBIbkn~EP#U|eml$7X*DwxDX|vAII(22@QdkPcwF z7uX*4RwA!d#LE>bpS1r%B|1;U2Nw+4`kD|fRQCRMB7`=$l;liW#PObG#9fCNPC^Xh z?HX4TLxU9q^$1oFBfXF$JRDASVa)!FFuIBnLZ~5D7lTDS)-F+EPadYRKym$XwvcYu zh*T)<0=+O;FneK+5!1dPwr~9?Go+1be)4SRla4~6F)JQSo7F$kL5%rt_5$NO0pJCM z(u`qJkdDY>Yr){n#IWnp=e2fmbJ|e;qYnQI5Xse~_Xgz))<v{8DQ=SRfr4&S?;yfa%xYK`vFKuNjmn`vtr+5`A|K@|=~*a|H5CydzR^W`i+t zi_9R%*5n&CJ@>kWNix<73mfZkmfComTR;8m!kTiL<-F8YxTvvlZKL>k2kIyOMHl1h znKnDFF72`=nEluH%SOGaQQQp~SFouudvjxEL!-EbC6P1#MWfriZ8)5ib~drYVUe6- z>Vv?d_Y1O-{1TET3CuQ_iwP)VTHa#B2zocnN>4ji%Qj8Pa?d;FK-D~n0 z0Y7Zg%WSmgNk+STNJjV9wPgGo8QdfFpJmX8+Jwm!)HTkT%EVTwhlG7+Zqw#?R?PMm z`EyZI=b`#NV_+oH8?rVsaKrF^wOWv#&4EWBz^0zeXs-?1}CI4CP#eFipW-P5P!L@$)96c~g^lx;fa|ocyxWD*t=C#V;u>_14nx zgJhg>tA2cyO0H0Pi^`s3>WYpvb0vY&n&$6VWyB>N+%K!>-fj|qYDz<>Z#B`B>!dDw zOPR)Rbcxry(%JAzm%Y*4-G6p78!j=~w`@s(Z^Q1N7n;A$7l znng=1lxsY1k4Z}&QX9jk+A&tRNoo9Or=QW#E&Enehg4g#j zhW}u%GFjadT;Hs3Y8F3lw$g5nuV~I()hvF-E5`1X&0Y~xse|!4QcfDGvmooic%=|$ z+jvc=W3P=@PSzSfqS=|0-s((yYbn(ZiL+`rX|>mTti;n^j(_=Lnle16+e-V7!)!0d z)FA&l_PCf|o`+r2ntru5GxvAy7+Ihbwm4;kJ;Z4vxrUpE+3$YTXXjuJrtosI&Bg)A zhmF(AnYYmyG_`U{qfgoZs{p?_<@n){*mb*zR_k~^H24gy_;#4IrRP~ed6Q3Pv4JE?WdOD`Cju_Y)?{xg*6npLsuXDen`!`SsBEFCQr``^@|CP5mZrV6fTu^L&59 zNO8+&-p~Ao?~CV$zP)Lrxcf8j#*g%yocPPoyIV$z$3Oe-OZ~Ei%ChrD*02BXBgNlp z?|;B?M%baTViXlcr+iv<_$F+LtPuJNw^p*#Dz9`c1>2NQ7df8ggHC*YhBARtTY_PG zX_|7{6uUMT*_UfCbg{z7Os^PbKa=Upj!M5XT8v4*vt8Tv97$#-iz(^*(_9--kr~k9 z>HE95yQQz^iapcUdlkNvzW%D%r}e9}*_83uU^>GlUv#ZLg5kMX4Avf6YY$%S;R{q# z5p_<7#8R7Kh_k5`kj?Wv$u4j<4-`Vr^V?fVb%1f`lAVx3(8N*6as>`#tz9)A)|svx`Ss;lDNju?VI51frIvJMJ5Z+R1yr+Q+-ebpug3n34bL_>enNGnVL1 zM$YeIApsS$v!J&UDY?NsA!k|xwAFI_P^w}901|S?Qfe`Ix*wPl1yeXDZK@oOhG0pC zZK#$8lu|bVg@*L6hYTj7LATO45d$iz_QtWug6v56Ei32T;aO7mG*t?nNkxR0&+eLv zbDZJc$5^JPxoUP>s=!ppWP?-M_h^4>K) z;aZgJz{Mh6JPVW(O`4JZj#VP$(mYWA#YX;mq_B65|4F*)1 z7NYv^`C?`Id%MaBRO?es={Pg&xK-8)%6k1Z#rmp^bcp$5V&-D)T}p!j zM$aYMTt)cVxYSAIg5ylMjIuNF56xrg6hUoIutA#~Jf{QspzzggwS3EsRSW;2J7D+* z(>qwBCrsq&+`|v`y_WfNfY2e$`OH)VRPpkJj6-i{xTjlUk_S}Mk0(~w0zz+AANsr4_!fY959-3=DyiCOJ9BSUp9r~Ob|1013*J)<;-sY@h9O7>8!M7srL*=OMbArhH~bsn-s+Y%~{6Dm6L(LqE%E4ga6n?L*bAq+7P zw`TKh*c?m=bHQl7l_TSmAxypo_P*FbzQcbPX($(_m6mS=g%D$k-H&h^9}RPrjNp5{6t+}UST%TucSq{{q} z^0+2hxXANP_T>F4*{lF(KdhP`QsoC#<`Lell3g$SO+f=hrHi=QG<@Jyy$-&x)=MDb z+N$V+P)Zd<@RA~b^;?-hx^_S8w7$r!7V%XcO%{@ORq~GNep{9Pq%!Zqx>ki~-MpuI zH(0BnmX>)b4H7Pss5x|a7atjP_ZCZR>jOI2RaL9oYqdm^ZctkZ8{P;J`YQFD+pyIg zv}u|~LYTH-O55n67m!sI@NS~gy|%C=C=(Xk!3Ou4O--5Rq@2kl2NRbj=R@>xVuM#r z04SJB37H4wt^&o;^ks`XMMu(}bac0uIx_7$bi_d%CBcYP#dPe_j(!QQ}^$ihK<|r!v1yTe(h!Hz>1CasN+IxWi9-@dIv<%R|5!Px34NM$Sw5Rr)FX zF3esU;yG?sfk|#x!5u2TUCGV%o5Nft!ylFRw308V@OgR!$p!KtqTR&)3jy>?SBF)q zv#t)C#x^_~W;-^KCzSC9d!XwTUB%eS-_#EDxKiLk!bg<%urgaz_&5N!{PDscfCh>| z0weVI2I$m3je_MDZcw&|C z|LU2y=P|mjCoW=DwSagdBsiC0T7_=e^jY(f9AH8h5oI!D1TpA|+(jhtdtws}XkX=d z1VE)&ff?P_Ohr*8V?ls+RCM_p4drS84k&Dj8jq7rVWVjQqF04oESby~8|by&5LcoA z4JbR3qN%u@36`=Xm3FOes{(*-avQoo62mIJ;V{gW5w--(?JJYSG$X^lUDDY%|HygF zg#&+M!{!Sc2TFr3Rh85<@@SvCg8=aT9(wbs?^hHE-eTwTGbg@CR`$=li-GXc|0EI$PmkA{TsoTsk4Hz7vI?M2&9w zUK#&Z5=;sol;)ktj__BNSrwZb{K8F`-4+?I*N{52q+zUE7-{4nNR-D#y2W*cmY?Zd z@;RQ)>>D-gCiADnnN#E4W&Uu)J#g|m`oX;OeH_gWwQHIxnD#0Zxxqo3lD_z zY=wNsTBpt27_bDsIG92A9n9<>a^UZgLtEfHWx-CacS~H_V9#7MVC00yCmogC600$n zCdu+7cs~wOS+IniP5ajPo}jQP(7z1)jX@*S&54!N9q<@|>&xF3=$nIZL(uw<*n0uT zQd|}!R|Vb~iC4*ORz(!u>q&fv7Po8tR#F_*LykLW_)TDb9b_?BuTeC+Qj|EY)Wt1H zUKP@VM})yJIUWj<2ZP3k0{y$ddm!j|IOsi%1)*-VKae`RD!Z)LU*eXP^9#AkMg_-*DC;2**Kub zd1E^US;?wNR9nfmiW-!Yd-Zz=`FaPB1O*wKwH=N%BAv z+>&^|O5EeanrZQry)P$)g;T@ilu$2+uGqrilKT_ywnTgwB#T3C&&NT2Ntggy`~+PN zn|l}1zbuST3!C`dLkUemTCTS0S)Un-_kF$1mI&U+m_PZ+)uyi=O{u!yIoMKcLX8%>;nX(2Ezs_>a6Bq_gUIp?Sx5``9~ z4rpE)3qyL*Y#I``*qZC;)Nyyv6`=SU`O}?ayKHaQ)U<#UICnGoE#l3dvk+R3f98@f zZf$InWtMYrVc7D(f-J?cLIxzq;2Bey(7NO8idH!^WPH<*Mf2HK|{_w1>#Kj(a5Kcbe;*%B2U_DzO*y^;GDT)W<5IBxe)zSL{P? zr$*CM3cW+rp|sJ-Rlm*Ne*SU<8KgK`7J(4kV+N;dy+W(s*~S}%+l|7JJHY&h!Hw{V zl~$1(;rK&hZ4TXbs1-{6#b&f?hm-mzpF7wRT||r5PR379=0KmKJo-yy)C7F*-xDJz zuHep))6I-vyKua_9hr)BpV|%X_ONYQq5e7-s~K|l?62$Z?%|Q!NTFWQQAzzH$)35L zOinexJfz(pn}dz<4lui#!{*}fZ^IrwN~1K#nIli}f;V-%HkjC&c)Y@%66 zrouO@b#4X3cgP9Wv+qOzsF23Cu;j%%4q8~R(tH|j5PN)TN^76D9d@y!u$rv9ZrisG zK%u0P*>=VO<=V~631){oxw9?fk(x7NHYGRIZYY3`uy>F{_iQv$MA@VS%iO*r_{A7= ziHoxK#8x09_4V}I?}&-cl&K7RF{CQuZ0Xy<8FsB!D1}9 z?*B22-x1+xGbTSe9wSHlW5UsT`-D$)nXBl~K}pHT^F$+!EI|3(AjOSRUoWF)LA$~s zApa=U|G_V>Xifds~O7nu9ip9$|Sw3S=pA})mE<~ zy{ljXO?SR0?uMTlvsRZ`DsxFw*ay*E1K;dJ@@e7JmxvgSaHf>r6%Fq|W%U+0LyWC+ zM8hgEM*7ikdok9lJj70o;c}Wq(pXxfqb>Hh!IEFu3aFh@e>B*(ZFdeoQ8;_hu7lQq zRHQKxY>iw=NBPLwetYW*4|br9d96m`6^ypfwZkiVJhP-x?Luhud(QWO6rat)Co2qd z5}#@C`3fUfo46yn-GulK#F1qaWCiEhL_VP+pVloJPWb3k{K~Ra+22Xxu4Yo>srHH8 zEqU^IF0E1QLfp01r+cxOdo0V$ifwoWig?EN)uiu$|47>B~FR}UXVnge8Plkv83H9ZQBkgp9fW+zy_Aj_M?bwWoVW# z=|nL1#w0k1_I7U+?+wLA|31V89@QhKQ*6NWaBH7V=TFKJC_3D4MV;wXZ?aL)A9EW9 z$RWceM!+tF`hih3RZsJXhvm_qT{dDsAxTIVV+N2NpsmikR{FkIE>)6RbgT`j&IBvl zgX%qBjW~lJ2xj^Z3jb7sq3X+2@u+cLS=?^)3NZV?lG-`urqnNbO*P-eybKHBMwR&` zem4bvCS)YOE&Tp?h1Rbs?{yIXY>?_rp-~?}Rl9qI1Gvfe32~JY?`ypWT{l|Y2_+gg z97&Mayd+9@sD@t?2ig|6y_2C#xLUp~BunGbdP*%bJ5}AFb)v??o#dQq&R!upKICrQ zrOo1>uqTxqfHmA{?1Thtjt?*jw=GPSOTHK7AxcT!6q<{H?Ry4$P}oA2T87O&Evj_8 z*Ag`6yL4w)539b`eFA%)lCa(rMT==JmFN`;Y6#n4A!#$4IvdMhgt+V43l| zT0UbqI!esXr`y835zeAVr9%w|_(2+t(&IGLCE3wRMK;ARSxsM{Jj`_UUnjBy6}tOr zg7DfDUwMh3>tfoxsi1$%NV95qrF?dwId_D2y&}MOf>nC5teu4iKR4bb=qXtr+Ukrf7$E4_^lW5h zDWtdgboZu^G~zhlrmykWhNdz$zYJ5D#L?xn`C7uGaOGnQp#U~TFHL+=})LMT& zfm*TxHCrx&J8I2LLR>BAVEB+||3xozO4=keZx}Xd2_eca`5-R78q2q>VyGPj@>oZ3 zcA7tD7IkX29#_Jq{Rj7(~E8rsZd5j3)#y06T#!l_bF|_kCFZ( zz+Gy~3fjODAhAww7IBCFj&M(x6)e0YQ;59Sv7v6wpYv_G9ZJc@VJeD(9{|XU7HyEl zTcp2%elc?RXP%F9-qItj@n`!8fM7v#fo*(6OWopT>Hl65_`s7&S4Z|fFN-fp|3#@d z&>$#L*lbalG+2XDz_CbY%^!242#*Pb@JP|e8ROQo^v)Q^v>4_r`i?_y3_m116Z}kI zSJ7|M>m6FWceSNL-OQ56_Atn>tjx2pFJtE!#~AaKRP=@EZO&8z!uR3bg&x6Jn|oor zkSuEHfU(Fi$p$${bk)!Q`%Hh;cYGy!VJGYRoQh8@;%R;?il=H5o!(ti*cM;=I zfhv63zhI*E`zA0dIkk-5(L$267*#t?wSJtUGqrJ{zo6e)hOmG#{XzLpDf0b_THfvW zDi4he0+X6ev4n4Qv1OUzSWoNn6=_%wZ{6E>%}>; z{$!8(LiN z=2q^w*$>*VU`G6n%tb=&h8XTo$sj*)eX?z~NFe=2Fe7|Hkbg5WzjHjXBnL=_Q%#{O z%WSI_^>;zgjvITbbWf7vWT}pq(4TUGnGbXXd1Ani*)M~Q|DiqYjXIh|R{is*K#P^_ zD*0XPkg|aPKX{OJIJ?UIorEA(qx$pfO|9S@B)Aku$Y4HsoIB#_eG5-makDB0Cns$lljD$~lW&5Crc? z5pfc;a?_>q-?r`@9ZLTW7&0dyxJYlUm3Ful(hPB;L^QAg2}FpD9s%lBPxc4m;xyU+ z1Jc!vLk0C1mKdEODgZRQ&lzK^gh^=8$9aLd6hot&8q`Z_2DLlA;7sjcq+*C)3X=mw zsXy|5NTi+GliYEb45Xa_*x9L_d_+lcrr?%I*ACqd;0>@bjFpF3?v{eK>*KlNt%(h_ zI)r|#D?y>l`1B{Y(jMTsTJUwqY0TLe?9`(e{1;gXnW#0D(-Nqb5mZ~DG2c+g{R^MR zU96!Jl#6vEHk=1|-cW3BHDB&&n-@3FQm4tOpO~h>pKy1iTZ3DG(!#jKZA<3G>5_Rk z!JOHwf!pbNc7L9tQ6^nIG|Tzv>Z3_!`95Y%#ET;l9VD^{@>Cn;FkUV5&B;w2;jHy& zR>j*jtlIpOYD;|p2!Cn=V_>)RYMR)F9O@eAHqFl&z~MFcMDhmhUZblnMc(!Tj<=Kw zW;sbf%BOFz7ZCoPO1I!sm_Akr5VkJ4yX@r_rVuuWI}!Coh?>i@JO!Z*!HH?1QkqrLTS?*MnSSB7I_=-NL91J+B*4{^YG-$jM;${XlU>!E z+8&!6yH$I)p&{`r9l-%pI&RA=K+cXCX?r6m?g=Ub@4MDahCUGLSajtIp=%FwZ5N2C zvkujVh(oh)h~QS4YkWx_n&V~rA*TrE8n_b*WOA|v^8@{#;(IJ9*P7t$B=4w|}u0Kjyj9w;_yQOabTL$8yB6ZL%HBZBXGoY^-0ZwU>$P=|nwN z{9u;jfaSMAg@9q;i4jEclE9_xUDMiQ``Gtl1>~4@Gq+zBDRj7OeP?QBm7Ka#>W5_I zL8z#&3Nz0^77tXcHj->7*vDM`YEXHD=HTdI$JtZ%SR#{*KFn_V@g}f%Z9cW8jc&(C zsKeLAjIQ*#&$io{I%jD7&Pm5_Upkg|8XC)oIgf-iHX$zvOGmEg2Un0`BDnu|SN+Wr zKvPKinQ?8;4$^A7&unoGw2Za!ZuhVD)J5LE{qz&Ax!ChAB`{>uj^xxTYNDBhB@b~k zuZvwn3URTrB+^@LbeeqyeHH?r^O@Pw#cUyiX=jV>BGV0T7IUb+7m{f&IxLmQ3MzN& z#aO!j7_EUIXey=6XVR@U8HPnp<`ImCHu@`caiz+Wq91p4as%cjvfnCUFJJ`&Z*pI>o9sfJevxdAYjD77NC*O_ z_+H=BJJHR`73_WtZ!107_2NPTT^wYiz)LTobkeCF9TdGUq~ zewST~NM0}WV(61`*LV)*MPsLI4efwgIPc(I3PS zB8$B?GhJ~`t}W1eI2+<>DVxt>B#EEeenIi7xJh@y`-ry&XGfVg%ABlt-1Y{FFO1#( zoolzA9wEZ=5R8RF{X8Ke#r`S_48u$TSfWPj9CFwi(O&Q%I8*<%-tomsRZ|E#VpNKXmfHBU3VLF z@>=3oc+b?{i;AYr9V&u>s5Py6xK`+&h*9WJUBrAfKrGXWDdUxFu$x>R zk^~ro`5FWmF*yU{||4+TFv9-d+~QZa*}=|4O_9 z#whtyi=&up*l$~f{fqNoC)buS3Gr1Jk1B70Q>1M8A*(zW&0?^Tc6E>SoT&#mcQza_ zbd%>e7P^jybd%c?POr6*?t+Ao0vGGFMAT-W*&Ts0f z5YqL`qrtStf`&(f#%GD{`;nq?{4^4Sqk-vX1>NLi_;TRh8O*QE;UWYVwi0<|I%|N6 zmOb9-0^M?uoQfJC53H8$4wu11BDf8NGoe{<#r)bS$tUC*6vcMV)XSCgKvS0<%M_(5 z-tz<7#LJ+}j3~Ok{&7B>WCL?Kote(cYn4Y)yqWes*+)Jg!{Az2beiuM0`>;7M}Gvgp9in`z?Q;;NTg4U^OI{_Sp9!{^%Y?jKsLQMs zzFt_+&5c4`E8KMgMpRNCQQ6yOsSx$YQUUZA)XWsy6P21)VoDK~vA*~OIeW+#Kh{R* z{)@;Qr9|L3ZG>*dM$jqPg#cSwlS=Q2{GWw+PpIDsd8hC`5t8R0+4ez=?l3qyu9l^1 za9(V45U9@W?-1d0Zmx&yYR|WN=3&EoGm$@}0bCVpAL|g0%=J>e`(Ve!RJ?no+lF*o zYXcAgU7JB8zPIsz)2blZsax-sl}*yzEo94_rlGOBJ1&5JrdB-g~^#Cn(d92U<_(9H=psKf*mon%gZWcKh|@ zg%nJX+(bgpZsiu0YygNv&$C9=k-1AH0K2*g?~F*=v^*B=Vs@c<6*sfPoi2|P;TUj> z^>a}lk?pgIVIO2?I2_(WEa4C+j3-P4VyKz!Ahk*HY+yTv>?1EW_{-v}`d7m6UO`Wl z7y9A?gmS*WA~Jvdk^f#}cxGr$hxMZuFUWiIG-1wcF)N4_9c?yhyX*9pwRVW=G}T0P zRqeinY9dLg?NHjc39Q?8;?KSOHS_lZC@c(Em3&n9n2#TFJ-NA{#+NafOR$@1(tU zduR?)$c0#6kQiO4gYyUtiaV`a&N{dpk?WYACJU`QcfJrO=*&_bhT>GkDykne0gS%n z#eI)K+JhayRr;C7Oh|jte@X~qyx*FjQVIPlP3C7ttaHVGso#p=86|!%%)$Bx<~1QP z)GoJ2^ItdO1^a>HjQqZPrW+k54)<3Y_s83Wc6^$`fy7(LPQo&y<;NBr6ydhJyWu`;`8bzCF4O%F==-_i&_X>g| zs@ESGVPg4xwOcXf2y~H{;ig;Y1T7`pCQ(X7N$++9noYOd2)emfZxOi-qB9k4P27mS zCT`x#Wr5)#ir!A7g*~aBkik^(YXu!d?jq>}#PA_8Bh zJ|uWe0!Zxden|exK0Dl?4vqlOFi!lD&l>L0LqZ%U%`zF^Z%=hwg65~hrD@$}q2=r= zXwY>j?IG5#HFL+!wYZ(mlsI{{*QoK7wh{O8!wHUZXI9w2it?=-+ZVVoxhWiV>Du8U9q6GlX?K z&Jk*z@cYaZvDnJ%I3OP7w&fAM&Vu$nQ=bK?+Rq(VKGluJ*4)1miH6t zP2BfX?fQ1KkEM5lq;vF6H&HC!I)|~zP}Em)Fx3(HOPNE zt8Hj+LFOp!yI%{wGD{YMZNp$OO9#c@`b)J@U~wYFG&32f?>e&pvKcfZ2&*wRts!Qx z5BkX~$;@F;kr#8#UY6}@NBv#f4$Vlo#nMk7ntpmGXIA6H+@$iJVi$K>G^uBzo;2N| zX{l}e_n?=1#PbymwcZO*OYUPbS_k_;?s-o?<_*Y#ZMAkiXEUAd@6+wU2cddfV8i7( zQRdRghj=|iM@RtJ)2q>G&9Xn3os{DTiLdce-l7gYKf+$$sF}ZojBbm4c4RHd!P&@rDs_^>tsGfdF zn;L@i!t3em)_rYz%DEN(l0AdDxjh@^sy#P|x$&r^tJ7Jopj;sCK*T=8`5%OGWPqr) zfR9JI!&=bn*;2k3mIzW;Q0D}$)928E(kG=TOKFdkP1^PvIS2}fTAvh|_DRvV$KjT& zcXL(_Prow~qWg_meRWi)ae3Itw?NqB-}L0$Uh*d|c-PClS{X^bXdPGr!`AHDcuKbe-;sa>;8P9_!TIRC}EKTE!-P%yJ<)1*(` zXLP6IykIU>=A*;n6TeFiJJ|$ft@8`=VwjKsr33*ciwwt}Y=F|jqx?9epKE7I1O-`3 zRaPoxNfAYWI&ElDtR>*$65xTeJ16TY*~w~(n(R&qC&yEivq4fAX~S#C(?3<|;}x~x z+pF#HHO8qgffn!@QDia25iTRClaZU{cS+kx1;<6~DQ9-b0bBShPtI~+J*CBYiMXQZ zP|b#HKgcY?eSo44AvnD#dk6czVi^s9ag93V#55Gg zMR0>rb*>juha%EE3I3;bk``fvcQ~`VIW!^s$rJ-|E%rx=GpGA1>9*H-OlO9L?Xncy zZc`R!y%r0D!?@rxh5o59U*~7TtF#9P9&c_U<&Ojov&!K{?e$`j^ym@LxW?9Kw+TX$ z5RT=U;5Pw?S=taPw}@qXm?kD$!6Y$7;x~3aem9+umkMY0bYdo=;P0TOqWVAcoZi2A zF*%$POm3P|E%>$fxQt+Onb!auoM)*Ufw1jP;(y+))&gWvxmlQdk5a!rO8n+1>Q#UH z19jgIcx5&nrS3XPZ2WZJT}Op?9HmY=Qaq!=t;)S$sJledrC9Z#qosaP$On${??1{s zQ2z{5sP>uiw$DKKz8U1LEZMd)2(SZ0V&irE7nsIG=s~#CikHR&JP$$u zfr5ZJ?nSPNG&}WlXi}xDCx^RHD(7(^sroX`?8@Za6yaP>gdH>HDk;uzb8jicTt>{$ zc&4{|#^mWD+v3bF6vpN|Aya0cet+!IV5x@Izul};Ok~UMDaf(R9;@5tFOl<5hX)4f zw)cQu2247inx?qOT&B}NPx--Qe~RGwcb)q<3y6&@^Wx)1-D}j(WYY%e-Xfdsl=2Lv zR;z3~w{L0pYKo|N@< zQKjKi9yktaqCuE;?L}B|C@ z-8mxF1MYAl*v9NY_HYL@F=VBvr1j!EH6L%S7`{sS*DH$BIGvuAa=7y!8K7)_v%k#f zmud6L65rX=6bVvrv|JQ6%PPQBpZke< zN*v2_>QJfTHtNzCSs0#ioVoH)%U@4rn*E9`r(4`~rubJQgK0(6{QBb=y8h&Dae7k& zzi}ewbabvb;1yAL*@EYhL*^CXzl;k>v(;8^MAAf@T0sz)_dUN!CPjP+Vx^wn1%Y^H zwx=7NAJW`4o7YXC;pO&}CD7L*?v#Z&>WeO6wy{ziL%PA=!JnELNzQ{P8*8>_eHe#_i2rh+XSxBKoMvM`!-u+0@l;$Ff9 zHUS}@r;Z$*CwQk-Z$`#%xm#(vt zb_N=+fX)jZcfy|XK~Rse5trHFPHJ|3qS&68{e)>YX@TbB*!@t1SuJay?~JWwp_n$P zvr~Hf6=G)HP@A1T@(UEHUjx>bHiE2MZal$fm9_`7^dbFnCmZg!_V}{87X3DAz~^f} za_$6PH80H$*Byw%ZJ3w7K4OaH@NcGYaf4iQ4n%uD$SF}*hzGcIFn>?Z9?BYG@)-~LYFw| zGh(OA?DfLgA`4@{al^JK&ejvp(1QgWv+*A)z+RDm(^oP-|H=Uj+Jfquu+2zgzH;<0 z>WT6bF~t93Tagc7OpFGNTX8dV%S)%$fnPj;%Ua~JwbD4!d6#(N49ql(G~`zAK(4Qr zHeW1G7WQVY5J%M>ZmYkn=Z#m^Usf$a_$tvDV+qg{{?FR6ErUtNNco}+U*Ob`HHgb! zF~RplK5*=Wbj%~k$c)SCabp>5{C-;bGm~}Ejq?MRVu+Tx93sxJwvvhGApIsPe9EW4 z1Y4KWg;P>KBjqllt41Gl7SeuNT}iRZWhy?QIMV7@40n>?oS2pTm}kUju4+a!y^piL zOgdX=WRV*Y4euim&X}}xZE*7?jc#T~s&Pz1+{XgpZ41^BX~kn2A&I+2Dh<{vQlBl=*brJ%XhCI(>7PZ2ATBJTxQl4qP(dLY6%~#9ig8y|Tw|i5 zNsQvk?{jbUAm+`R|Noh1s;aB2t8U$U?zw0Ao^y;lkmeLlMSMa^0TclMM)Wh~8{uOmW((4(rE&E~vK-*4N6P=yzzJ*{0;H^TqMT@(^;am=OKjj{o<$fbp2ydlGuMp^&sF~PlkJ~DU zQ_n0D$kJ?UmI`8&(zoFa3F~u3x;jHu$2Kkxe#8wfGL0`oC90d2dd^|wOvf*~&~q1) zCeDQ!p8|9ix{0_wUboktnjvQfPKfAIM`8)vEzOUaf#DB@h5#&)=3?xH{2d!U#j!r~ z!XHWVpR#C?bWdgxR+5aj2mz;9C6>ZANe&37iy*$#CmvM=#08$1=YHvhjtcc#z=2C_ z{3f_Xz2pxqYnDvqvqSFaJBTDQjH9fZEpf9HoG!uVejur0%wH+DDZ-9O<2O;>M9V#n zzBj4YvGrfQY=J}|^hQp~23%o1<_rKgT;^NiUuj1RdkDXUBmDv>=!79tL_D`(w4P2c%-b1Bq{V+hjvqygrSX9&gdYU(ELHzp*Z$%wnfJ5 zwkh^hF(owBp5jkUBBh)_aRSo2#MP6z&-d)3F=777t70t`KMw;y2LAmk^VdXmX$J|B zXJlYa65Oq_2@o7$7&8Ds3}tM&hY@d6m^;3P!=1GRn@J>JY~#2+_)Q- zg*HKH11K)5d@tOtMcV`6Tyw#C!RijyFTF`Thw)5J1hI@*j4*_Hm_>4`@S(+r*{2D6 zG#$EMxOdiJA)T>m8TrSLv=1c_LT^}spjxdaF@mlhP93af`)u3ZWr>%($O0LrqyTNK z#S@V%3*`u}RtzC$TV&OiBpQj@ZXH-;OAvCvEcGy5+1?Ko@*+v`k!p3TPp!QR7b#kq zU9&JcfQq!fE%Itjdsl2Zb~OaUSZP5|WfG=$ya-ORS})PfCOK-nWH0~fbO2x@ACM!0v`_C0ncVA1)S8xG0a2r$Xc;MWpuVohW)CD&$?E2>qgNwbZfSwjC(7Fy$`O zVIoVU#oRkwZ6KDD}%##)qEX*F%JoRiwi=_PPNY( zvsbY6Agd*_NDzo_nW>CW&|}tuc9Mu{Xgo(IzLLv?dynjT9@1i+8n5dWQ1! zkCgvoYN%7*`UrJF&DB$+CU=XiY*$;R-)+*k1NWVZ!N@xfPs}=m!%$xdy~wQaV9seb zs=Fs(Rw|BANn#fZvRUX(v(3x7f7F?Hmstr94?;8o@bwk8+Mq`wieT#TOhMt$_Ql^SvGL-`t ze{skzPDt$i5|&*>0u>uGLzRDWH1rrV5Q~SE$rAVvpo7qv?@5q~fxU)~IUXk2 zAX@@*YBZl0s=f$Vh>+k(ia*cK%~Q;823y8@2}%utQmotFiz9vET;ndT?Aj6W%ag6`;5zgT)GW<>Z8>E?M2|wfr?{GZiS0z&0Oz(D6-Uocz zGRgd-k^nsmoDDqZotC`OB2Ls?A*}~}^AS~s)v{f+rW z^I9O0%P0nBZj|mO8PUkx){XLzO)|O>ioH8I2GS6B#*6NbWB+h6C&!${0N0iYRS)XY zgtX+GUOc)zzL&6G){D;%Eflsb!o;X%81I=Y zf%_ZZ0LjzBY`RQ=UQ|5?1+r~*4?z*;Etnxa1I*HpG5ZI`%5;@11Nej8tv@&fP=Qb)JxaM}cKKhC%#UB_+8XcNJD zLn@!gPhdWE)^KWR738q_m1>4RmyRK`lxjNS?JK9eHSjgE($DOn0GN5zxEsE849BG&@BRq-lvwAheH?vAI25k1eV zdSm6dN8t?3a6|q7=z++D=A7KQuXzN~1Ld z#C0XLN!3DiCV7*D&1np^=Jn8IROe%5oya|xk3;hq|{^rrX; zd`woW{zdUqd}XQPBni3_(?zSXDcgchS_Xu;#8XM>zO?fo*ARy%(U%>9gX4H#fcuR3 z0>qG$^s|1zZ`+O6vY47E*mXdwOB9R~ewiW*g{R^VHV&{3QIA!JKj0qi`td7~g_JFe zDR#(|#MHx$53CC3#MYFOcw~eX$f4L&)81*un!;;$Ti+!{os);)2|irkto`9Y zoK}u<(Q`0cZhNlezJc^J#`qJEN~%lAQi?Ky*n}eS076t@C@4>QAu z^X2@+ywG7Y4;`FOa@#}O^tK0yEj&NMXWht2si~$G)zqiNk?x`6!D5no@UvX_%bff; zSM(_fm%>(?ZH0$fSK)0rBa*l_;#G@<#g0|2EJdMM$XZ-X`asILW|^>&Y}e&S%KHhyhYiMK85IGgh+0ww7JrV>~#|PMAEg#8?)oa=Olz-RBeR&NI{THl9wwA$DcTcf=~|YEd=?LV85dvh332|@xaqVnNtnwLVrfFv zbvijg4dBJ(B@nMTU~iqrvZ)n`(CUO(1?S}lXC}RR%y6i(n{4$|n&i2P+I9fb8x8BTKZ!q1CD)y$$KD!xr(ZjRl-s8Dg68 zQ68gGO}yH!@otWoWO{P21l|=f@8-z!{1z{&MKC3&9HS(#W>6rUi6NCo@!Hlf)eL<% z*2Zai=8{)WJykskPC+g#ku&ZqL7aOtV!q8?qe@NnR2+{d)kZm<%K9Fx1De3%_p#9 zDfOwCMj%=t ziM6~GlJwD)g|^Kpw5`Or9v>{(6;AQ2g`QZXTDH*3hKspRpuo9{ywDe}Am&B2Y@z4m z>CJ$wFVpy#5(<^0W$7kd1s|&{G+|Dm2?gIv^#Dzn53)(^oOxN}XhIft5?f8Ga^);% zIis)XBx3BigTi~LpqVtCgylB`Z=b@uV}R3KK0y%-$Ha1NJSf&3gQK07obwBP@A>mG z#?ckjI8L^e50j16!=m1AjL${N!hp0)SPKcwcJFa@1y%n>Q(i*FZC7QSUCAnDJJv=z z+%eOnB*=V)b-*?RlLHcUP@qoyl?PYQ%A}W6(-O%lYW}8xw;re9*2pret-?Y5Mntuv zzpZ;dPL1(wtC-911;{A=!56z3sFPn#_xJfn>2HWPgn{AP1)A@@ShU5Oom?ok* z##7)d$yi@V-CCD1KUty z4v29IM?l*C_iV8X#1QoJH#-(e{w(7ny9UuIKp|N_+vE&@&(BKP0bVrk^DXZROwusE zt*I%FTOF$k!j2E%A!H}%ICAB|Gwi5H5yqz0=cEb)CQ(uhy}HQEBDC3Nx~$ABHLIW} z$Ep=I3WnFwVAeas+(tRVq=qaOwx$ExV{M|9@7lyD23p2C#hCI=@bd_I?M-b0iSg(@ z<3^Bt+9qvd91P4_?b5gfUXj z5C31AeY&u(6rpd5S>f5F)PK|pt+5zfpdk+-{);EnXKNM3%l(Her_{-VS`TLLSy~q) z^d>8gq!r9xl_QIUz`#rJssmo1%Y3kj>sFA36iAa0IpWL|>Vr%rgK(Vo1vrHeD^lH+ z#?dJf0ExCq?TTz8RVlr#YOB@f!fmPcO5-LwwY-!l_JyTlQK^esjR5YHc;T~3#c4W# z_DmB05<#U_)-M@wRb9#aL!Np-A?n|pY>6#-v{YUHre-6Hmve1C^=KYGT;NB_?_qq; zs+21Qt0d=@jq+;V>H>ML+ssGgR;A{8azsHa395CFiWLG<~G zSF9j@o>!E-PH%fw=R2z4xI1{=-^9S2mLDFxdR<$zy~5aOr*@Rc=S##3C75S;)sU0* z(r+T+hMy|2pP)L1zdm26cmWjkVqUFK@#3O9KvyMCkZ}JBOZ<*J1Jo&BZ;AJH&)kGM z>6a$2&qp`s_u6Nl(e~ND2zhK^n|+hFep0?|0+&}Y7wWA|*@?TCbT$kx$<6_;bu+X| zs0d1{V8WD^`;qJ9<<#kpeGT2a+6X1V8z!L@?z zk!wZxTyfCbBKv3Izb(-7O6SN;(%wjHYQtLLoh!=qwo`8p(%W8rb>wYP`e&@46>d&{ zo`H2usE70~Bmk)YxBX*v9**?+NhN(;C#tHvGeyoF-wt5ue0sD?dWDn)#N-;yv=T@EVG;JF7NwL zy&c&(lNU50ptB#f0xKzX=bnC@%D9Q>Gh_ZTG4A;sm*5gCNpv# zogFKSek=Y$#C|6tUQ4Lf?izG+x136uTkbu)cBFBF!#I-7Rg8~@K zg*;9bg-=<-%|}C4gDQ-nmcn6Jl#AhDt~&@I@<=4=gJM~-@tSz76#^z2Z{Uh@{yX_U zi2q(fup-$~ikwklvLu_ILFyNUQg%$DoZznRZ%fDO#dLu4V7I^Yt4?@5oJ#Xj zY8FSu6*}H~j#Ywnu!^UeN7;Orvu;Ja30`}E@lgg&2WMH(Xd9=aGL^SfLawxOtnoQ? z5UByrf*^&Q?TI$!#EF9PRH8!rclDg^?v8Qsy~4OdJ6jdkBj+SOW%40_JO*i-2k4Q< zjtJl*kn%1Om#8VRNqiy;2fc-TtgtUvd*X+@!sq|5edR_Rr|ZS{f+_Wl1I>dP4)hNS z9XRZut{uXiLCX3vn+9JSAo;LkXJ)Pc!^4&EW6 zFLJvx0X19UbU5*n7;&xc?`@*$WxQPkLKfMRqsv`$sY{)KDk`Mziueyl+#>nch%$J^ zN$~@i{R>iXh3ZlpZR?{T$l1Iy>RD)0TcZ9Mo?PRF&xn_N?)aZM;ZL3LCrPv{$O%Mb?A}oxg@Z;rm?dw69@j6{ZlAvMzn_of$dyF zWgyBBR1bus$Uf7w|0cyEh0lyGfU?DN%0LrcMCz+D40%om`PB_$o>hf7?gnPnZgYw? z-7pS>-zo)|)Zh?oG(_kZbUNp^1JKa?6i;sD$v-dv0$~(E9}d~KN_&GG;T0<%c20YC zNF;)tV1_1R3OIFHBMk$nmiU1dI<(s2ai~kZ0N!T%2A1N3KoF4Wcgy%c|k@?UrE3*q_b}* zL~jMd5g}bzgUy|2enHs(mVUpt1Sym*7Y*kL_`xV;`8r~aG!9ESanrt5I#`5xWPL2$-g_Zt!ZB?(9(wTpq4Ox~d+ygh#`ICKVf}Yltr~$`qHgRpgTDg`?^JIMUk$ zLK4`G(l1&ZboubO3VFO-4AbwVz-UTVNql9x`>x|-mujcy*$vY_4IIaF?h6#4jP4*y zZ=HEf-0MZLNX8e+E@KNCF1DuF#BeiVx?!9&M7i7`;#&kMJSv>(rXfc8iN>3BpaxDN z-6W@Tz_)J~Fj08jM`DfIk@qMrx`Nj(D!ldxV+ZZUGRS+qvG+*#Oe>cpY0PYVaO#zc z6ysI~(F#fWUVWQ&qEj)p3|Ez{mlcHXRL$P1tTMKUUf#^XX ziq~yM(au7qk zn$H~jKgTfD7YLs^KbMO!`i4I+w#yXx%*ef<;-oQ_r_=a_v2{i*MjO|=^Hl-!HCpwY zN?8dl0NAFo6|NGC-XREs2{?u)!3cD%;6FgOJZz<`Um+WL8uI+7GG{fS3|JsHvS18& zYlap4L*Y@(T{D_*474$im>y*-xlbVFaxQ0`!hCv8yyZr)GhI&T_j;0RkquVCD$7yW zgERu$#VNMx)JiT{YU?RcXIw*Ou_(U!QjlFHU@e;<4`PYYIfx+vwHS&iqaqn*HPQ!U z>_(J0`&y=bDK1Ix_v+J)d?ExudRMDYSEx^RS*}Fdt)&n024PYXJjim5=|3=-Uu8Pe z_6o#nwPIOGSpYdX2tbUQ=b=zOM-xO3dO;U}ykC%RUU&*V9P#Un4|zNHz{DZJ`vvIH zB1kVs{8VhNdzd&h{!RUz(&*HPW1~>>i}Wdw)|@J4a~XXw%OLx$3_oewPtoMPh@mKq z3T{x3Cs0E(#;HEE3yG@ctW|tL@c|%&%kd(H-MBSR+CO#=5(mb9>U@_wM5(c-^oi_C78r&&nW4gCL< z|Bb*U(Y`}eR`wGO}>BS6GUXLN!%%%w}szQdW&#AMawL4#B_Ij-XTQRLuHO%BoglkXO{?{C6b|} zn*`F$Ut2O-bpSJ6*%OMyLX1c%LbzZ4Q1-)8t?}k=5aEV#qBbO8-jXH@0?H4ud~x!( zWkdT#n*GaVtT-Bu#iLWHtwKJ`MrqBdOzjU3xT5iSJXj;rM*GPwd}K)Xqf^EeC3+hv*N@w*2E9evWjk= zFa}GE)A1=6glXiGI2LCm%OvV(zNo@9h2%Y$f}YBZO$znm$kQC>bjJc%j&(`}h%jX^ zrwgog{BDzYKx|a(YMc0nX$*RESPbWc2a|&xxo07 z>%Ar{_|2afZ|eylCgJTup-LVw#m%k)s63@=M{?e#cp&reCK2K}o46YL(`HbN)C)4P zAh}IngQ=7QQ#sxe@99)jH@RtfExx}yluytTw?k4BtjmSCQdq}`Z^>V%Nlj9|nB5IeJYk?f|%Cn<5FF0jSu*XwW>SFLeQNZXvf61q%HA-B=EKJqgm?p^;f+g^W z?gq=g-YOaPee^G2C9@j(ai>|{0Zx4b)2tGov%;lt9Ndl+Cq(OWEK> zHYr@nEc+e8mDh;2|9(=VH5w3`8&({jbWUo04nO#bd@0x zt2+J*s@}W!nU|@~Xb3liuGJom=iTOi$g#hWe$e}BZax6S`j8X-bxIfWQjHgKY+i5O639qX8_p8t(+>m z)@dykqJ^*3&8o7*p1oPS)F4{&S(&r4 za8j?|;kW6FW&R>ES0!f`8-EXZ1ax7DS}3!Nu)yH)0CQ)*BE+xU=indWHYa(9L)qY` zL;2@I;$A2D07{#FiQm(2Bdjsiw zR6aO2Y@dy@JiZzTlz7KM_>bKfCa5cvRdW9ra%ad^3deDrA_DGY3B=CWfEiLvZDqhB z@{S<+b%F_CQ;jMG{l}u6n$h(f+pWCKgBe(d{*&`6={zq9x%H&vCgEYZeerA%?jl`fTA}T1(hjtG~?NN^Klri`lV|#G( z4oqC5(Q1cV&Dfa8uL%Qa3=Jbf!iOgXxBo#9GBPYk+hdzQRCg}Ht7wr8A!G(FhW6J3 zXKF<^bTu4y)iEbBQ2&A~d0tu<%FqRJp0Op8!Qcjn^^bn|9zTq?G5x3?+3we07b&?h zVx47$&OuLf63Jx9E>h6|zpzfG;H+XaAB%S_mUNY7x`Xu7^-c*y6LRMjR`zXPVP$`x zj4nLC^h4qQLy*Cgt>2nzNsvN%lwA(2F;tnZ%2dXxLWDwCqNi<2Imkui!psVJU%*O* zUQVzX_s`Yia1P(LQyeljvt<9p2o7OmLA0bqTom!wMevpS>nQ{R&Hja%=6?{e!}x+9 zbdyiH#k?xeKk1$gI11C^xt9C{%&xnxBz)BmN>%5lVNfKaxd4 zaKwt}wKRT@EjC8lb~!m%lsL_^&-4fz4rQz`wLa_?m+%nvjg3|ul`h6wANb!MjH9xo zw5zN>-*u{*P+$0pmKVgtd(rH!s5m1UUL9?=LK)x6I^yB5BB=8Tg&9q1{gGCvI(b&C zOlHb4`q6N!v;=?7A*|Up^y?70xLml-tr12=$rTatd!!bn1x_YK3s83w7OWHY=Te@k zLO;3cUVlL=dQvGWADL84pEQOEFG)_(a;!=rg!ByZWXShZ(~~`9*=Z{($1ovEc%9N? zDq`g^QU-L9Z>+1_siOh)Vpz6OP@ib-2tKu(Bg)z-JRi%Hqz^B(%PtqC@GWJ=Qciu@ zGh0z(6)Ugg|HsC%cxubc*zX6Ob0czXL~Rwq&$TFDp5liE8DNnH3{XixwO#=Lz>a~~ zCXE?0sJ&TnSIqjZF?g`CB_1QWjnTktI@!#Rgy)j@W z#5 z3NTp?$}aJ;IfPkOaPH|!;y0UA=s#H7iIIc+zF3`3&j%(Je{gufFKhW3^8FUMj^I zNo2j;h=^f0aSWvdLinkw2CC-7v@jIq zXD4D4zgd8bN`-A#fcnDZdSA>r+q2eq;w=X7{ve9XyjYHJ+E=AMOhOIi*C3yr|;3+^c)z>V6_^eKr&Vvw-s!s`c zT?+?c3S25H5B4;KgocRc7sq@Yd@+llf3CyDhX_$cQ7~0nyS&KJ^GE&u1eP2O*SYb! zpQ|RYmW%e~3f37>D`C9)a>7R~jqYEa{ z(Na-#R2=CKkcx9_np(JMTwsZUw|z4n|0picQ&pA3s$q#yoGMkK>*X`E&88Cf>a zp|;4<&9YP<-zmDH6J33nm=);{l;f#gR2|Ugy7ac`E1~I~a%J@9(;gMF*)P)(FDyrgDU1`(I7QO6l84BFL{nv9O+;$S+Ey zZ%Fz#CL=E;{Ff72jK7`npCT8rC8plo#C|S1K#YGCXsJqAHlpFE+I_Z{bt4FMr4+ch zQx&LksV|y9e5d+CdTKU;qdJ@G!mCtKmM={cM~o|lc$-J4g-|d{Q>3u4TJ-#4fJF;1 zVl~ExMX|Zr!%!v>cfu8p zo%}`=-Mk>m%~NjRQ53=COw2ll7h0#WKj^utviT!WMNhXAo z>+dm^lie};bi~>b5ic@Z?Tc=GH*!bZcUN+u_&VmG!P$uq)7Hi!d^KOQyNgI z@<~`AgcS^df`C2xiR}Y=VRZ`2E6=UrS>H9T=UL!VZ1d?f)G*5rd2Z^fC;X3k z!hqErJYfY>f~uzCyP6R#5Dyg)1>On_u7j1UWp0)HBlUN3sS_f<5ib_yc4jgQNbJj| zS++X_n0Y5^TdfL4cuCtBM@l^JoFnzE`8v0MS$xh^QNjUUb1O#u-jM!7!R3N87@+?p)kTL#UC|_aTE(;VU?>zldUN%V`Ggq{A$80F>4V^x&oms ziq|fT+l%79%zYe-eHs&=uw=mtKZ-fSM-Fi`nhI87g8a7ZGCA2_P`+zf+iJ9_zud%u zN$cj64ye|hQ#=Y#E_8^HqRuvRmJUkm4yrL8D%L6NH)M0yXA>$vc0D#EcAPaQD3+fq zkV;Q!w}_8Kd08!!tK=Btg<@p}5`Qd8-dE(ePzw)n@c+pV)V`FCWNhAqtL_+AN(dGPGH`FxT6V+hJZYy{#cV zLm2x&Qh)j%xKmXBD3G;wiu;6rFK*9U^Ch=u-RH6;m*$i(kd;qo?O&R&q3+pM^ob(> zsUqVu4RdMj@A{3>-HlUzl ztm^4ltlP$+Db6VIFD$X=rADH{2WX=UL4c|SeK<~&KayaQ0AtT?3XclCBO()hK&xC? zg1~V(w!IPzdK{}25beUWGalI`yu{bUk@9FxgC^`u3OG(E?UHjXmb*ld^3yCUEsa%_ zme*8?%5Y7jI$2j*>o+9ozl|(wHb%8vFWM19NA47({f;0yc$;|4Dp-e7kK?x)EZBxF z5Y7ads!oQ+`~AW2j(}~LELp*j=P@1CW8EFLMdmllNd>}+Xu^tX!mf^3 z#i1x(e3)Fr;EFx!(`$K*h_B|9Y<_(y(Sw#MSYSP$vtOVVnhI=-dswPp$+@rPD5s({ z$Y)FQJ4(}Q?dbW$55=v>Kl2diro6m54}so1BK^pE^B2w`_Wlei-z!=4To#)u%|tK; z0|8U$Y=tpnV4@=!TXHo~_0l9InV*lAake~<+EHKQRu8Mo*QO~cTiy(fG-4CMzCZ%* z7SS3n&`3d^>afQsL|H}WVOnPC`ENK0b}qtd&Me1H3NBHmRQ8Jy?x0k;S%Lgp?>0mM zPuMuKwMFQERDqBHjo*G}V1h`a^u1P&&x|B>0P`@ohX9LFM-{j;_9|koRYfkQ!?d(o zTc=vsyOfn-aE7t1BIacZ<6i74AbU!s62M#5LtktXew%ojDNV z`%9U+^xX<&fe>exDzZJNf;LSRQy7XHD*TTsQcXJ6Nv)7eb)dmm>vmK83^m;$r8neL zYJOl^)RHuMVD*Q<4RI{c%!r7ECZoLcLO%)8*|?y!LApaj5lurRfv8GU_Sf*aHrBva zCYwZaO!~tc3!c2k?LA6WTq#GdK#v-%)OK)ZATlS0ar~FcuD265pt=8Z0iW;FU0?$y=QD3hHIYbTM4EuBezzkyk=yka5($aevv2k6YKYLFWFCQ->>M={lf8d+-bHlHkKf< zu*N^LCdvJxVR2Cv-5Xt3Q!B;&6{>TAfv(PrRje6I(KGW-9M{bWDP`VMtl1MQc&1?t zT2Bgswu-FjnEBG6K5Oi^g*OaeG2TeeT*Yjt1j>dc05#|p7;EEBl$B7J3eZ2KVj1RK zil-Jur=|R4AC{JAQJv~|87mcK<)yPVm8%50aiM({zA-pW(`q%_WGrj^y@ouYUNJ$g z;tBN*k*8`@yeqtIVI}X8e4xfjvW5+Dm&MwQ(kBO$8D$!LE@D>0N0M$8GxeWE3CHbn2T$kx|3}ag5i0dcfk_jIFh)R6HJ8T4Jp(5vxE9 z+G|PxN>jEO0=~LhweI@b^vnpJb@0+yc|vluHPWgDJB3Bv3@t6yF{z775yX#46Tn;L z@1!mhWf!CxbP|*Nr7Co=`#`n4u38+3=jf_xY(=FusIieP_TKzPPZ-6)CVGZ@^VsG*|V-Fa+d?y-IqG?r;D*efXkP zzI@!ris8mj56YXg8E4iJ;fZS_u(2;7Va`dKPgY`1uf>Wvddec97dE@L6%JFve;Da0 z{qGjJoN;+Q-eOFF)yWU4^H~sq7o;#Tj()6yq-iOtu_lzV9}h<`0ogwbFB0BAYgv4* zua#HU+E>-0_=2mgm*TGa#548cp{Ce7&EC7s2*Mi%5?kuLD};Qq#(Sm)VddT$|A88D zf6aebpw27@Y@xgpr&`Lo3(0^Sd>FQ&(o!tpTqW#-SCpgeMTE{3Odze11Sb9%717CD z91oL9A)WEDO8v{~k`KJkiDpgGC6!q0;?R?YzN^fE?Z&4KpbY+5c^_*i3SbbHH0N5VT-j9K9dan+RE}r* zql`qUv8Iu#&bam!Y(xd7tI%)ygeZp&Sr7Krd9v1grdB*%>poX2_SCpXXU?y2!*)cx z-;nsI0kqNFy>n^{0+(`*r{sb1e1VOFz;6{5jzUkKfUp1_Bqxo4}lbd5~0$>@6CC_SrG#;s! z_tx8w)z_n0i&q;HZ#0TG8lkHP2NG{LhF-1n-l${lJXz;IQzxFT`*C5EDoL*R z;xK=)bYE+b_c!Q?cXtEp>)#sGjQ)_CBjSR3HRs+K7QuGRBE7U04z#?sM1}t|aIPgz zk>aez#5s+a(!wjU;{M3!7iu((t%aUOTJ`cBA=U^n6D@H_h85$>>g!mL!c=| z7RbA6u4$dU212oH_WaTuh*(0$1cNFJsa;`FkS9uUkVXqP~?Tfg6);LCUvu8z_wwz zw1?r-%}LM{Pc;W8N7}e&xFSihry;SZ(Jd8kHYDC|5I5I{pQ=aW^#DAP3#XrCvAiC= z%a*h|B$CxPoD|%!7`u=x+|V)pI@}{}hM~HwF>*zt=>6)JpVsSv=vK;br)ssWRLNqk zMGxJXuET!cbE?#G))>82#SaH_h2-E~CT9tR!st|MQom%ZNe!JGGPIcjr3NQnI(U7}#Kq>oUJ}kr>QT~dBxxna^ zLyoy=PJ?nHfHU1txfY`>3v8{4vIZ?_&i4G*rH<)ZOyzaiQD-^ zAKhB#JX~jQugm?hE_Pp?xHmX^cb!uTlH#|ZP1qskYD9qY8>+ZB#bt9O+7eV!4zi0> zJtx`_#nW2mP@oR-|7$5(t^BcAa3M(LjD|Y99HrczIfOr10C9=E4 z+1xB|YIeV9vKKU?h}e;#Qe`OKTD&QR4a-gyeXnfbN${S^1|DWLSBg?B8bQz{9S71@ zq$rAAK2jDbbx4fwl6t%$7=YUXxb1jl^$V1PxTfboIXKREjhC{lgcEa8aZ-RksGIso zD@)fu)SCpd`TB&oG!aPWPqh}Ir#i_jmVne(#>3Badk?WXC;~iO`}d80EtHX86XHpd zI|Mn~KaO-5#$d!)*+w521>NV^zsO^t$pvCYu$vp~PCTgrdyOWU_&``UIt;-K>Z8Ed z)vk`U*j+t9+RnWqc)Bo&JxyFy1Eh!kLtCoOyRyN$qCs5NfYN<=18c~J7Bw)N+Ay)M zZLrU6P&K&#(BNz(t^3X%RX>CDps)1E#?X)Cg+2CpJ>s?zs#g}br<~aF{%@Suri9l{ zg&D2Yr~lg4FxQ=pgteqq-5A`&=MCaB7Fh^*cZ2gi<+c@n8LsYtSbkH3_&rVGyBiyv z?>d%y+X(yC5#p8+?$#0BC5?6!5VE(Dn_}yQeW~zt(T`C7IF#Fvwzc^EC2D9Vh43dS z*~-MH;NTQ+`yEXR8DDg}J?cLmQ4>27%j#{_7Ma^DHHpL~8N1t4_Y}I2VBWi?I2Z5d zU9_L`cx&i|*3g};N*J(jZMAM29=po7zlb4|Ujb@Nyy%f$=&dFdrsP~R#lCDxHer9# z9{H%fkC@fpr#Bb^&ZM(%HSA83b{JlUei;{1^~gfFWRSI1o92R6jq>tpe2Y5=L@ zF4GrWKN2&ZY5N%OYB?Fyz5%@}bUcLrI~$ z7)0&7L&&3XIpoA-*&Re!ZV=`s%L2Kp^43y}3@;%d6e6O5$C3n0;p%{IFxx4bNNhS5 zM^Rb^Y2ptsD{_@)jbB}@1f*_c6c>~AHWqm`lnBwKbyMkvAUjN$vSnGss1B$0T0 zczPmdCS`lr_Et^JO=+Lb(F`iiYK#q;JOhl)Qu7jUbA!Lp96JdSjK#q;gSqZ-d=kPp ztIk`a6hC80278OC(h6UcVKrNq5tp!6=7m3vO01|-KGZMUsPm|J*=g<8g7&d8aY37{ zih8IBA!3DoyVt?Gye?Uqa#>%3E_@Q{T%~Dfko$=<0WiqZgnOLA^BsXU0YAolm!N|j zS5^3!5g;(I(f^incuW0}!DN}Er$H?#@dulDgE9n-na0H(l&r^^8-Bgjeiv&E2oGup zw7F-tDQgL;I|ae_4&_NoZ|@+?z9U$ERhG>rhNBEoU}o@;yMjqr+Z|O1L8ZH;`hzJF z(H^!IJyE)hyE{_%kBl8AAsI4fx-X4Ny)nu|U=`Pm)C{sCa#2Ti9cZ3{M*eD>qSdQ9 zXj48JO}QkN3;O0AXaZvbqWWwkGft;0Qc;T%P#I|*rx3w~)xxPr9B@3Nd+dwmF@oYH zgHOtW3Srlo1=ZnS45)p^ve79gM3J+QSL{&{I#CbM5X+;6d&VfXEfuMeYJeKnBvNC} zvQ}c^z?^5_HVReZt&#GTk@mYI?SHnL@3w0*=Zo$B%kAQ&_Wz(oUOv21IzJ#Zw(yF& zR7e-GKV&L7N*1e-T2joLe*=>EB&qWPyESpICZQS1a{VuQW3(?wUF$9>+T*|}SGuvn ze!D0foFxkf4-K7JHgx9gp);=y9fS(ko;h?$N8yBD*zXi8AYOdLVC6_q+k^)sV7ZqC z=8l<~2%4Be{;aZLvJN9-ja}_9k)4|6<^`fFH&F@2P5QFtp^Gt#qvlR0|iO_cJhbUEdN-=jcJF>td1M;^sj>B3jRvnT1>)j*aZeN@Ue5j(JO&5w9M@EDnL zSr78~mM3V!Jz|Tj*esO+RB0KiQJ9eQ9eNAD9a|u$#=1ytzApB!u#WP9$%PBkg$wIY zS^w>YGxU9rC|q7d7YArGpY7h4?P!v*+!v$V#T}u)jM6LH z%cIC_K;Skku+@7=c&{)!awOBH5Q+DoX#K+!?`9T9adU^7?tl21|3#NPeX6^}vzGA_ zW$yDWXYEuR6R(ccGru!=x9~P~dmFpG4WpfpMtN!Tj8SEzh`I?57Qb=myBl;RuX{)N zn=Jcm$2rIG*`DI%-WTazBS0oxF?8W2z^N)P9{RMYTj5o`KOYy5dS4z#dXPQG*_%dD z%*l2`VS9lHEuP|i(x(<)-QL}uP2?3Br5g5DXL7M9rb+$s%Te;d4(9>aSu`SaOQ(Bl zr~Qx4*oU2I!ZE~oWBd$Q$E$-qP{W<>O-%cPFGZ?PbMhys!vnN!XJ3-t$K62}Lam)Dd*706a?(7ad+HE=ZleYH^A!Oo~aWpZx zbpk!``WV#%*G%A^Te|%lx}7(5sWd4zHt*ZYcgNaG9dD6iUusA5iArxt2mE{6D0#~$ z`_@sa!Vn7Uy(1$JjHHOh%_C#Cjuf|y{F?1&FQ7^b*k2AWzRFTn&%}zReIN7KnDm2V zx$~m2^0P7a=VPKWw{(oRoHWO|Pda0tcZ$zC|HECkwHM9uEQs%BT}J%NaY?7-sqWB| z-44~=#d}}t_N&Ge{iV}eJyyKXjqt>x<-XJnWnbOSDvP)8Y)LDYjWZXHvloq{6=#g~ zR*t0=d&a~TjTH;W{)blFH?oL=kK&^Cz;F247+^YU$1$Rha07Ab1o!j_ND`|Y?_9@T z>v-oo_NgXqUaM*8<*`Yp=)<1aKYARe=me4wJlf&iB52FqqvdU*?X9B=eSLq2_YieG za<_EEwswfyI{vTr5C*=WwP=z*-gyR&Y*gHCS z+dq%;{yK`gKR+tAW0ZJt)c_~Rl| z{i{p@x>t)tBN#M!2=Q$w;w>c0__drv4*BY%s#=i$j<6fOhlP7km~w=ZTb|NE9g~#( zjugDOx50jf!dh_l*MO9ayGpT=KJFfDsYPaSQ!Z4(nbLfPSME_k-LFH>s&3*_beNAv z$N|mjfY3?TXE`@nT~(1G$GHa})gDoO8H2>xe(l%gzmv^Z$dWjy*0^uopJ&G?s4+7asHR%0s{peg+1fs?TP{I9xMMijwQwZyxrS8 zA+%)zRp?)vY`)6;gzJ4=U|7q?`i__MeE=d5&>pd0DJzNoPOVPRjb()kaTcli^G7RdTN!dxKD+oZWwhW7|} zfwcBePz~w$LD7|&m_pRO%rySmg*WoSvHnwIRf(MFhH<(~_J!lj3&!b^*us781oz1k ztY=Q3QY3)A#O=NI9lic-y%}rlL%oDwhP=CaorM#S%B~&ncCo-!u7WQ^5fw|cdNzOllyE{El{6UYX6`vmibahVT}ldC2;t0y3oAOY}l6Dv`U+Q;c_MsK~g>BiuSKygs9EZC^^ zcF_28A~_eY?Q}MDTAMmk*L6C#j#YRCjO{Xh*Vs^*mlsb=P*T!U6IC4poL@`ED>3Ae zi704$RJNqZeG|R)o!$+d(*r#(CCKWD6=bbI!Op|2IbUY2#OnUCSozc0%AM%&@+nLt z?L^!%m8rnY7Vi$*IF2|~heafo@DfBw4fgFdQl%rqjB6%gb6L>o>=|t>?u;$$1hM{p z%f2?B^t&x27*~~3|32CQ*d|WW8PV0Dr4LvBl;e8ch8Rml!98cDO{#(FX)&jMfJe_? zq{3Up{0VwHT5q#@>#@ZLU$%qbI_bg?UKG{3H)rXsI!?qitRbe&Z?OvFkx8jo_>~56 zM#^0Y;z#ai!0~2fn#HqSs&8MIL_x6##>AMis)$t+RJT4iDGcq==OO$Ta)54Tq#c0A0C<%ZX;*<_V(lSrmeYRHr8i6fOK zcf4#>p4?iyR#T>ciudvL0yDL*FN3BffThBvxfy*qvJ4Wv%E6zcUeO zZ_`A1^+fxciAvf70DV`Nyt|8l$5^D;yRFNr!;Hr5j7#Bjd%h$J;L)Z~bw+bMAO=?RW&-UE`H2Mw#kE zmi6&?apQPjh95mXy#09j`0@Tz$IE(W#dznvF8hNnrN0h6_pXuR?*H&yzCLXt&rSY` zkd*j>@eXU66z>oHdhiujqe*wB zBuZ(I7rGW+;rHVOmf2))?Nn!qIbDChznHnt{r4AhID24~W<2xPTk|0GV@Dr@$LS#f zF;=p+20pcbcL%Q39!;()Kt8M;uC6B001trEd3%rcOJPJqc>$kNe7>+(fISL@TfCGL zd2gbE77n#U*vmyRITf7KM3ORc`?$njqK8zxE1E-6ek{ylYogt)SlB~q7%Ck`&NQ`A zH1NIDC*lY;s(Zl^5&>@)mw^TY#;%;ZluiJi0@_#XgAAaXG#)%1R|yaXm1EC~H5i-v zm}nF>EImel&)Qv-`k-3ZYZw1AWHUzSN!F_TAl~(|TYt_jOA?z1(e=t2Ff>#}w^S z3M2gI$@X)T-DfA8J10wwyP5YVdw-uSUzzN`Hd(wn`9H9im&f@pO_Enl7HcO{Typ0m z>*mQ|xoX|T-N|~d0el_dH(`?eSY#PODQxjt?T1xM7Wc?6y6rE!!!m8K0uhLhEf}b|3xlGhG(gR04x)a9om7LJF$#k=PBxvAA|Ont@3fb4Vjba zIpx@{$DFLaB+m}v-PXxVM7bK(P_5qu`7@4otv|~?mNkW?Bd^yLaA@}3@f%f!UiiHz2R6EoWX~vy;_I z&HKxzgit{k=TAo4H;oo|>UQt;7w!!U`^A>gDU~@h;P6YaH>sor1Coe|gnfw9i<9D1 zVIDT*CpbfM_>l0iM!5i56>a!L6B3K9NHmm>m_EV1=;n#2naIR5Dql00N|E|Hy;LcB zDJP})SM*W|yJ$c`sI43Z8=;Pf3O@T^ETlzft3er=4FrBS$6Tl=)OUX|9xS{H{DI1d z;{JRJDMt7=c<*tyP#Kct*CrGsv4(gL%Q8)n}Z7eaE`1yK^Y(S$e z(+Inbbfjch9IU@Tti=JMC*b#qV`1cKg2^ax?zon$FZ$0GmH* zKW&$sPpPkO1Ieut-@?v%96pk69qX2qVUG7)qD!)}@SBp9|7QYOLp*mP5<}Z+}=6aFHXhu>FOEF;_iT_`W zV`97Ur)jCD`|SNgGo9!9Td+jE3XD<@x^OF-VPtLs48{X9`U+nc? z?iDY6y+8MIUyX(cCj0tcv8wlLWAb^gN(JInLSeyNJRJ_L(6XKKN;MZX<=N&cBy?Ca zR{db|l{2|buxyD?Mu|fapX6afT@)}`J=Jmo&0=qNmIlzw_C?CWikT#Zi%G>4{aesu zwXu6z>fR~tOn3PddGZv3ELQeu@8h0ce^H-U*!S;=M_aD%n+WtO4@;?GS^1{$wRwa^ z#Z`=h=$OFAIMm((nlOr4M+J(-5Ddu2&}N)FJqCV<&Pg+!(H7}+!fcc_nF#VO@B^mz z{Ld^cyB&E9p;D=&y$W=1N7UV^u|7?j`6$g$H#sxQwO9GJ~I`J-H zY?_`rZLEDJfsyX2KKqR)t928~@CqrNRS5LLCpIRP{-Z0g^ajI>HHcWNd(`n=e zz|KA*Y*(c!Gjc?aU7dPmI*fGDbotpdd*$?0+8kqdhL=n;mrWz(pqHz$ubyUKIL*Fp zntlDW=!O~YVdg#4rN=ih_02=m>=&omJElb|!z`MQPc406n!IhAxpf+`I=4@wwC6+9 z7=$8u^E7AMG;!y&|1fhNcTo&JpDw8(L{e+aBJ}5KX#VHcczHE;R#WtSB zqMipU-fZLI{Z%}T3esG@_ef2)IoId}Qx8!cZNIEsL+rJ}Ft$rfZ!zQTuTJTiJcXG| z$fw5c={!_J5ol54oSBIGZ_ZG1jdnCXFazmf^9&-x&e;#J>Dkkj6tiQ0RRvN{{jk_i z87Xqe@tjdQflffB0X@DS)%L5PM$@sMi(_)j(#IthIHs5(`X{nFY|QI^(LD zIZ{htg!)W3;>-P0R$|q3d(Cu0&!l(P^w50_0-~}AJ!XeAlD{Rph~NoTUJ$eHy}E&? z&vb?t5=cZToTihLTZiLw>5+L=nK);yrO}P5wPpCf>{0y zO%Dj;ud}RIW;n0S5U`~+<}Cwu?2FU*=FIHr1h`lzA=Xt18HO1 z0a+`J^L-X`@=r7Ehi9_*JhQ*bn3<882lw|M*GyO^lz8>03S3DFw!pm3@?+ zHaTk53XMWmnf4^D#w5SiSrt*De3yxRRL25yQLQ=sfRa=gz>p_nX}e0dLB_A#-@kT$ zv4K|XBi`?opmZyCO>u_v>@Ev%Ap2#AtN&}1Dims*QCc9b5GTQ3R|+TC9moy=CV-kG zl`VobD+u2#W+`jqe~j_eY*hj>rHoX!^{c6L$840-kNaUE>-w2br}Z1e!M@efdt{oMLaOP}0e#1H5QR+TlYVE*Bq)vbI!^qMyv8*h-q|8?syfPM=(Q>XF zi#b$FBh&lf0m$(F z1Hf7?I)EX1PYu!b10qFk34q48s{kmNzy4SArNs}M89-pPg^3&O5=3qud5S}G? zJ%tlsrX96cj=T=iG>mbwTH-l8%=)d_;N*wI@EbwZDse!i#{ipa2Qp<1T314P(PYBM z{y(I$7o;;rQt>TB^h%Wie6LJdEB+s4=K(HNb@lzT+bMIVmpixjOSyDJilShph*CtP zUWha+D3+MyRk5Im3W!*-AePug1-pXAUa?_`BA_P52GPW*v3$RM=7J_~@;=W8&zw2; z%*-jfti8&A{Z|LZfUN0U?2dNVMfGHu_bTfnWX&&(IK-&+1MQmHlkX0q@~u_dnx-<~ zkNvI1^!K182*jb{m5F1WHDe$Z09)fr`R3m8%e~!gdvl)~_m*$$UH1Ck#_buWwx1jS znf3H0u4&^uljMMsrKT02N<5aoJZmJ>8tNjU*57$}OeG~ue<8*?Sus{g!fAWz|K3O{ zw9x6!<}sL*x?dj9pf!=pORDD~&Yw6#h?-G=AfK>zhQyOvsDmi(z{9N+U+rM>Zn_gH z)N%W@L&7a6e{Zb2br9hL19L~%#1qTew@6foUWpfEV-)F2|0K$PslT>Q5&Ojvc=ZQ^ z4->qqcL|6XmpzPNN+30nWTZ*4KHh%V4v0$uzPWg|Hf+P0!QSsHI^qr%a z3IAa^i00}y!wsngFwB;FD-K9reSo;?fav&@2e^+2f_+s3cPP;J1~&V9AOf!*Mtym{ zmMrSUkk7NaLOnzm?}wWQUs+T`b1w$0i%Ls=q9wpFVH)p;B_>>C9byUDNL`V1p}f2o z$vjCi;nB}(BzI!JGNLitQ0hez;99CW#XIUw|GFmCbn9tNp>$1ZW`w<5>DOH2Gh7G88@ubO{Zk92Y7>EBECtAbpxawl?BUjO(;0qgRVEWk%q} z>??z+h&z~=DnI^9BrwhudaS%$SWRJH;zWp(8r@O7fWY`#k17#%Zx)Y;_pP&IyLeu1 zgDERw5Ii1T{^W=|mPihxJok(JQsn16E3{L|U7a%{M!@FNKyX%|GBTeGbChxuz z)q^LB2Tn8(pNJFkkrU11C+ZiQ<`Okb;I!@c98mos3Z~8`Ln0N`wMulTs%~Uk$5JU% zEs!H3UIt&H2GRbbT(+#FrC4Y8M0%(zlntn#KAZ zM;>Vovf>tQE9wuWZfk(Kf<*_9(ZPcAK zR%N6_#Az&QaYcE_Uee~(c?^Ercy21NN%8q=P>>#MUe&~lYKqVuR`7_CRPR`l>U%nG zjUyTHmr}jEmFk#M?NU9Wz>7PN@-?hLP2uGX3rDT4RV5bC4dP{DTv3}I{fpuI??X93 zVtu4tR61uJ3Rv8#-Yc8bHBBry&yai>wa4>K?q!YU;zn^v<9{5VH#EvC8_k7{V%dND zobmbTSjK1Ki*eQS8-E_3H#b%P*zoh8zi$$k9&CGf(>S+bXKVj4awDx1`ueDH^sbC9 z#dAX1XV>Cijy0=8{I4+ynH1>B>T*V2fvQNNLxo-S<8?>?>kODni<89p8|RDhKIU|Q zxtbcHhl^oZ4C`>;$ZS21Sidb;xPK%vI| zjU7SsjD_@dKHSLbEne^NdY9KGUeq^>t&cUWi*XMdV)w}Qo##~h&gYdlcZ426DpiX$|E)m%|As-^F-)&Rs?3Z|WiOReEo$0=Z%}fj0$etJcir`kztY z&QKa0p;3Pus#{9-Z0P~*;sWK|I2q?WUVDqRsiECb1TAR>RSn3P#$OdbyG$=A!|Nu~ zG05ltRsdY|X2E->KzUPX-nM(*YXxs>!ECYH;QfNPxj;p4VNNeA%hl}=lUs2}I}Y(g z+?g$k!zg!hx;dZTeoU@Z`@#szVlTQA7Qk%c#Rxzwf;O^Ma#&bPB5$==VcI?H$3zbH z1ELA)4U8l3>e}~1_P0pCt2Z2jfbw$ROvXobf3 zV1j&z3`gwIWb{cs+TWGqeR!>v!1nBiWBKC_xVqbFU^grZ{naE?;=3owTPK-EC+UpR z-UAcW{SzhBQ;414PfXr2QQSQ7|FBHI94r1YCHvhJ@7pQ*yD1bz>7#q7pQiZp+dP-@ zPghO0E6U0?ECb!>w#WmP=Dl6uA1t~U2gN%N{*1=PliF^xWJ)nOta(o}2R)M@LfwLHbOx zO}J*N_o~pZh)!5c7eG;{1%k*7iG2P!*;@9fO@!5_<=ta7# z|7ErJe3iaoO8WIlFhZ}L~X=qY=NmL**vs>iI$~aowja`1~>)VpQjmYK$HoSQ0C#4(&J5o1iBXcA1ix=1lf}WV1;7`m<*nJMan=6jh z1#iNE^L*KIy#0OIaJYzs*{`Y+9RmPbX9zHwQ;~fBkK}cg&d0wZ?()D?!nj|z$!%>+ z_V1@eG0ab=gkMY%pHKNegvZ_E-CVR1x5$Y$3R`56vmUCS;^>ItwIUPVRA>H1XSq3Dve7B-nL+ETkQTeeQ}$LM&Y}fHo4~nTc z{x=Heg~M>C7fOm#MTVZ3~(=|501`ahv#a+yCL1zimSJGZ_|`BNW(1QvW9rA?CKSOeB1WQ43f7 zM=yOLda`3rnu}^MU)(KDv#|u)k0{HJhgs-d`Ia{GNt-P?8is~?@Oj)YG+Ay58U}3S zgsMu)$UR)eaSqkHLpEJwqD1KKv>@k+x^N&}NPN7+xKToF7o3}>CtaP^-HMg~29{3{=2lmWCwoWRS4!Wib=FVM zrYoPF=Dst{&z5~U&HZdzjO-2VXCH|rAB}-gaDC{5>Kk#O{C-;WOw%)j3-SXC13Z}D z0{An<`SA#>Ak=w4^8x?-V|x0#>E0ivnWv_SC#QMOOk`|jpf$#W!{c=!2yQ5b4Ne0u)rg3V=dxfQ;>F&TY^%z#d)JgqSYXz6 zdK@^C#-FC6?a5Su9@h=P&B9V^b#Ru>u>Nrt9#`Bj8dp`g{8u<9@P*@)mVTON%#SC1 zEqaU(r)PimMZX!5%rxrpa^?=~#=FeVu1LyIEwmB@wwve6Q4_=w+zB)6tTQC6oj%D5t#8uNR(fSPW&tGxkGp;_Y4#2kwm4c1*+v)Ci z)1fb=%$3dXaG_U|7tZAAo|=IM_UGu5pUe{X%&-ybnGEC0azxLbKFK_HlD<4=&uZH! zvw2o4P67&u*a|w|+QDmwbxeGM8fs<4Cf^?8ZY)oZ5AFhzC`L#)n?%0AW@zC1a&rx~ zaJ3!GQE)z}b!+ykC*B)jpOP)TJ7G9QxH;%Vdxkxld-Kg*vVGb16T4*x#AxZ(fu8;C z9@V=kKf70YU$sx?{c+R`=|9{ZHu4}oIY32dXfc*ydPwu4JUJsDQ(ecT`v}? z2)(g^N;y$#QaJ-9oxHC!V}1+iP{M-q>?lq4Befo*=B3%$H0a~&X3|0F+h%vc7_Z3D z#BqgVPa&Es(O46^nCpevhr@fQyuN&f?bYqG@yy}e_d3Y!q1hJZzX;{0gr0)Sq<^s# zmq_m;VF@|_=e%-w{I=PNTW6Y$v&286A3uJ0cz0ORm=n_fAe8qUo?LTycaqZfew*n^Y7~!#RM0T4<7(Z$5vLVir==mh_hu2%S!i$9Xhb?^_6M$pvLS@u8 zjB}EWDJFAY`=kbKk;loC0Ni9l0@dJY5>dr*8Zj5fS_9mdz+<~tlGsz}Rg^<}Bx+-T zA+uGKW3wXZu2SAhB9ck)aw4Dp^A?})ZuqlmnXa!>kM@YHjNzn$0bB-uABVK^KAGjm zG6T#%XP8wp4MCowPo-vJgemYK=}bCE*QKosw)CJ^My|r&QbXv3lE^wxEg%YDQ$lbr zCcM`ZtWg!j=Ank`NxH*Dv*E{a1Tv35G@ zU7-dB72hpxB$SLXRj^IWBP zwz7ov`0NPkn-ueEP^pcI;(96TArRO5k}OKGbB;IYF63Cv$9K|SqhT|xjp%^^kc~8# zf7cCd%tufQB%PTYwdAO&bT2N@lbmmkOu~QUihx{On}S77n!Tv?%*?W$nc<|al{_=` z3oVXS^mPAi%V-#gDDQGWVN?n}^Ba${LA*Rp-q<>fpOky|;bF|9Qm-X)6Ff#q*dxRbxO7hKeZTx-7wYSTgUAx0_*%%Rt zM=Q-9tWn&6&+7wuKz>9oi{9dOc_}^OU|bx3unSu}S?zp$l%>fQHyl-U(@}VPUGdlv zR(u=xxue1dvdIUt{q1!$Nse(J!w< zeCMhp1Jw6%FIgkCo37F;1f@_78T~QJLso%guI_AF&0cbZ%U_*97w1)#Uq2x>jcP8Q zc!v5mjql1Sm z0lp=q4aKKSL95K(=t|fOmq~Si-bamasl!ZZRXtgKFHE)lw&e@|0xPpoR*5XVj5g$< zx=@wO4Jm+__<)kcI##fhRwMJV+~r;r2RgXgulj?D9PpHuvPMQ#ir%QV#Q;O+-Z`je zkR!V!t+`FyMlFusl1dM)zSZw-t*>lU-pmquWRiZ=85MRPjlyF_?G+tCdJhPZUq|F z9)D?$`07aU<&ojqIq`evumV}u_p0pACcwLq8a_!bmRA2iI9diRm?Ta`3zkH?WF>3@ zdJ0bD#zJk>7NS~Ig|+dTp(UC5&yvh6>2bDDF7``Fp(-s!>uGz*2jayqUJzXS4GSt)a=8)z3x` z_S{?$6CUhDuL|#Fz|i8Qpp*dT{aXTD_C@MI&rLlwSD${gTy(TJ_h>t8UY*OB|7-O0 z_s?}JUDk7`TDQz~x6aKJm>MnebPA!_)m5wO5PUTZhd4?;r3dkSDvFu(A<yt^R{^6L+JY~MHOr{pL*g(>($?Z z|A~NoPcj^F`A&9TgaE;^ld4bjMoe?AJU+V;xn@H{5YJr;HH29v z43gxdd1a5w@TOz6l(S(ondMEl(V$?4H$6C9{)QtbdnZQmp_9B5y_3TW=BlN0#ge(+ zvbo~vdFkioiI?X9j?o?T0ogH>pZ1=a6R6B-cyqw1nu%F&XLNme#8@>}ULrw7b2O{> z0@C~x&%I4Bn z$Z{Sn5Eex*>I-a%p46d_S2&A_W)hrEyPnu~Z1T%v{R}>-lBUti&W)t(SSn53-+^R0 zDN4g;@IHe$)2NDQJCJRwGp>yly>9p1z`dL=PRP~=HZ>ki*N&Goo&-10Qms4AUw<4& z8VFS}LMUr<(Q&yejsu?z6|aK3((T4$l@!o>qAJBh_2G&`(2~hR#cb;1paIoUuVAkz zB(yobM7&Q`0kJ*(@Q$7Awsd!A+=JHfQ3Cs>5og1qmFytrxf5$-R~KttrXc}}xo)W9 z88?;(&r=ycZ=Sbkp6A!O;?3i&%qFLIjTZN4^DjBQ2|~PhtfQP>K0bY(6=TnwnCzEL zbl>4<{sw@M<7^jtv7o9l>g^IB4G*F>i;mIqj{QSVS@~tC{0$vt1XYGv{wQ!8G~+Pm z%9F%dN}p~E>LGh@v?TRI^ZZBWsqNDJJ2(aLg0hm#W|aEcy-)dCIN~TrALTeUa9TiY z*|2`f@8khKv#!PUk!x|(G}~pA3f{diuxQzcqadk|pU4b6lvj^PaD@ZQoTa}mv*c39$O0REV2+f>$T9l5)^!b@p;p)vxHvlU2?Nz8ACv;DMKy;04DJ>XIhPT`w3xd z#SJHzjVI_g?3PgZN5_{vc!Hk|rpIRCgJf|7k)%9dAFocx9_P+8l+A+iBOm-avTAG% zf**)cIL;~|-w?KdPnMy227Q07#b8_K6c5BJ;g%V0%C5qLkFgyx%8RxZx+6yAM^f7F zMF=2Irk)*qU1fw;q2ot)&oCN-L_odXysfxinkYEQXv^OEXsUj25Ia<&u-k~~N_~~M z#zst6>y_kxL_5!^J2mobOk}K41&GLKx3T)*PP}k15iPBZjxA95`BOt?4xKjSu%WYu zR1EFsTykm+W!Nlhq3^m$BD&j7$^Pw>K=-*LuaN`pQ$K z$uxs=(6JUn)lPBIsoBd;wde?S)v5ZXQ*)`5Yg6j>k-wEk$=qwFP{QTiQ(!H4?-VML zDKJ-P8I86Y$y295o$!YJoE~I7i$1CKaT`8!$^q6#Y0UGd;7hSNW7nUOX~^1Wc`4*` zF<*9^F)*&lWkPhqqB%?#)C69C5WqHXVWCj{+<_JYYhygW0buZsr#rwE@4vfRnWdCs z=hsb+vY%KUK!YHT0yxZG_yPJjy0XWWpAybxz$(NIk}EGn6P5Z7sV|UR`8z_U z+STXE_*wKRRod(|lVMK90etvag+|3=4Jg}bmH;gns}86kyRYs3zhA$=^?%o1WA<*j z#2SSwO%#idsrDoC^@B@y{uo)@hU+0CPjh*!wn}Ad$umNMlrDOsMipp zYO`1eFRR>JiV6g}PjaiWkq(l*%u4N3)lbFr3LRgjA>efrKCV-^YEuYC{s#>B5DMEv z)!zjTp+6VYP;vFELNz8CW8Vw)6E;%P`my}VP*VO2`XzmiBqfD{qz~ZEOfHsumsUd> z$|KY=6)+5a*?3sgCf_RmM@8#>#JkJ|GfGBnmAE66y&Z?x$!aaXlk#GzMr+UTajQN+ zGm-=Sq_2MMI8Xb}JT1&CW6ayfn3c8W{l?fADf4vJT>q>v3;JGyP&^SkLPoeA>i7!C z@BydV#fx|qnt>Gi+l)X|2%85=k{S%~Ugkj_G8dHP3W9<~$%+(z)!{Qcrq)h3JXr}< zpUh~A8fNmebra@Ly{;3D%&exYQLV`)64%2+IB}Yj{tsg@84WfQ4X~chdN=uiQV%l< z#O2Dr67#~PfF2rAt*(nO-smm#k1c0m4eq@nP3jYIn6nXOP=27*pS1W$>yJSZ0_S>7 zCqE<&2X)zZ8#u}S+6MZl5MV)_n)^*!f)*BmW9QCg%FL&$O79h=xBFG;{et%QMdGwt zZuutBJKd{SG#Pfz8>R%$z=XN2^v3MrP}%z;y;)EteyK;~!iT~39;5GN4bqpJ@G_&$ zG{M;>s8ZExfstn$v%t7#8@a%kg~n7>30SpT`IC+H|xEV;9EDI!DA%LUNAA<_=%GD!o-J`Cq z?a?KpU|mv4l?hD{Lwv;^G5ENs zy$GTCs`~_uxb8er_I;CCGs|31U3cwFbNWfKRZyM%u;+d9fhP08S;DMYF3ii&MM4ty zbawjH&x)=#-3GaV(ut25TLzCH@`Z85g0~;c&ln9zlT4V!PoYxQ{I!z^+2HDmVl{Ij zk*iHpxynm?&2+$gOE#?lJlt{~Nu7C(8-?jn%;i+qbP?MyLB;dL%d)#$rxGQK=hfmn zVZ)7tCErx*@XBnIxhDmFqQ!EfusiX^a@Pk$0S)&7QN?zanki*hlcc=ekBigq0pFBr@I?hY_ zk~!DXBPBmdZ$@J+E%`rDkY!g2KT+ukzqpksCiS+!pt7~NW7)FIkZ881*U=QI&a^^f zpR!#jk$FE=$x}j{QZ`>?@@Q)XA4egCgrs7_Nn?OEvB0NAI_|dYEQaw$q_s85yUw|c?(o1ldU+6I1#l_j5ql+ayj zxp=H=H@8qQ32f6oEW*^z);Kc?vRBDp+r}t0LT8Kxfs5THea3?Vmrb=_qP6`!$ zM^y9dPh5%`i&A`sPe;Yy5pE(tH^A!<135?#q$u|Wt6NIRRINz$xR;8aYQDHxoMy4q z8|9%7h>;J9F3xunmDK`G0eUL>fjg1j=X9nAIFVT;GoOH{baBXV1*>DPjiRaDtq+r9 zHtzBuO?N2PdY4En_nbt_iNOKeO6MKfT3M(V<U2L#On488Mn`Gf*h)^#aHjvB8L6>o>G%R1G*5 zUf?h96{~V=)aH2#oDaUy1Sg2&!>f?O;(k62?qSi!aTrifYbYFV<4N9TH%pz@({yX8 zgEgt$n4eyf_8lF!)z83OU~~o;?$HAD>$%qB#cicU4YxGG`NrPL_4eW?^ZGqTMam|& ztkULM_ATWHf>Bm$w}?Ni)Gud5{W41L!XS!VcIUUxF(x?IuA!qQM7C(psIY?LA7CRK zbaSQis`7EW=ly!=9ty>Y(0>!&Haa`$qVxLVcsq9wvH4s+EpepdM88DBmC!Zyz3XgO z-zX+I3u#eTHrf95=+=@WV{iM*ek{Hv=f$+w#Z(5!u`aw$H;RkJ3&K1v+MMMg>ytc$ z?1cEaCcfS?*Lp)y2Y*qjZA&z9n&dorFy2=t&&OhAAsv}_3@KF#ijMk6si$3#HaChD z(z!_x0z@?Bdc=CV{>b)ARNO1FzkX)^X9K4EE${(C#NzbKacHu;W@ z^SFc_maE#qFzrkowa>*eYM{5&fprJ1lg>(+&8KD7^-uC;Gl25+9qUIj`;8r z1@=2^%h~#pxPpZ2OUvt#*-BJiM;NZ$-jkQfWKx-cJ1V`xLb!9^WG}WYP#RX(;OKCi zSCsr?K&Qk+x3fb8`gInr+8kj5c*0=hpzEz zlIidWqDfW63`qlG!2-uAgY!JS&?6}B25|qiTd@S1P%g;AYLO?%;np8o1Kq`YxJ{n7 z0E6IZ*`T_NO^tlrLtUL$6TQkB}E7@LZi-y%(8vQFy0)dMAx zs;eQl4hx#_Wfy6B`F&8KdW2BL6$ga-Guemu`*%bBd&BUDkL?rPa25f;CkOjuSXH_8 z+JpVE^5Afs)l$+DrxnS@zQlR9^INHEiqfmh9 zapq#=$|nU04s+!uLAARCUuZnDUKccoY=q( z__r#XoVyuwH8xhNg-tuqBpQo!ll`p4d7RJcN}ti`S~obAot?L6n1n8OD$~vxOlpcm zS5`R73skdI%3+PrNDl#x5oaiKUM*VIIBN%E+uLgpzJo-wwEoyqF!-h5NEM~UF~XL|J^TDt$)&wch$OUv)d1&pd_iboVq~s46Ls^G}GKFXTD&mDp@m z0rOiB^|-C*fMp8Dq5m@a zLmRN(mpJawQpCEa>S1|CvN)`%3ap}Bbg$Z`G@;~Cpp1pjCQ+8Gub#iAzrS5m=$id)r&)buRm87485clwFblx& zu1JK;A3TCuDy&$wG})L^^PC*DP6z?)$w&1tJt=HoJk*(-&DJob@a2+^RYMJI)5%^f zcBPU_aJiwG<#t}}rs!%%$p&-{4x%}dmT9B)oA)s5G#5OI>1Pq)tQR(-btD(8b51TC z4X|c0D5qWA*4{=U@OKlQE-xJSS z-rxkPrYrVFMnh>PT6u?r11(V1N%8n+lm2aG`rZluwP3hM*c#7Mm&$2EnN#51*7hOAoxe+;cis89{Ke--MhzI7bI387IsK-j+EP=R+r*Uew)+@UeM~Qu z!r}bBbUWr>Zl|jKb}nIo?c?<_z5QP6mGiZz0VYT6Ngkw)8dctw+gdXs-C7L87ML?6oDGk3HLHlfpj`f3Tnb_!Q_-W zTqa$Z5LOtqRk&NkU>(~eOdt0=S)tudrlWe@{&fx_AJPF^E*WtB7-}oRszN_k03rM}){5@eti+Fji0dM(+4=o zxne+D3OJ-tqtsihpaj+Mdt##5HZbI?+xH)opZ6>9LefIge5A~F`o#tSta+`^)qMIT zvV@C$rObEuWbIknKfTm`Ivs;BYDYj(wf4{Q3 zMVZh3%avo>6lJ#l>y>{{auNP~?)K*^FCekBODxDIhRG3nx6b#9)IEY=P?OAEB+GU+ zzcE4CCYf3bbWWHnKmn9v&)5p@UB`N(&Avw^LDl6I58PCm5j@p@nh}3-)l%`VQ^NeW zDN*&mr^M+RZfG}IFt4LA7G);pK}KMXpxGAK8}mMK&0k#qGdj2iky5(BUZ=)>XL=ts zJT}NYugqQslyuCLQ5%@JE^ceDhUm=k+2W8LO6?1+ve|Kdqu+@W^OsAEJe4q`TqERl zesF_`9~3^Xl3f!Arfbx&@H~kUg!ZwE{ID~|sk5MQ^+)*9Mm+Bkq*-4VzI?SXD?yB| zyRr1XPCjAEA-8(e81e_tPAcY3A=;Ot0Q2u za^4fX7kJO}N*Da{L=hHbUR{f(yqxz0*=Ggb^SsiKNBd+GS|JT$q(Qt4lWUta@n~~StVjx z!&D1QJh{KK(gz370i=zGNzvc=SnhqHG$7k9l)aYGos@uJO4n=ks4ZHe8hAD$rtd{_zgW9-S3~u)@o@?57vgaNe`t@oJ2=L>6pdmHAkhZ8p4uI3Pcb!CN}^XLJ@LiwR}mRkgmn^_g$Lo!JcL(0D*!NhKPg&F=Xh<1%8C!%WAFwxK9VRW-`;YPq;j;M z?SrLa>keF?#?H&Hw>p~e{CQooys_d;Y|DYuHRJ9D}F1Ae#<3>M7Egn0DOz&WUGOx?9 zj~}nKOUv%q>S3fIv}v-=sOQn7+n9%jyoFsJixJzvs56QyGxA!dVK$5 z0zQV}6+UG2{Iw|Ar1jI}Rao|Ml74iQJWXO24$IK%3SbihFJVEON0M%0n>GfMdAwj~ zXhp8y=%|$kpI(ac-&?|CRE+FRyAFC$Hoqi~d{OF`lUFBumr9poQ$;J6Hv(~TgBR)4)OyRhb^Dp5dCK`qqfwzHT+fDx1f@g zJqxR?T_a2HMpKp0ZC15bcR+`;5owE?#wB}>j7WS|3U!SQF{BZjDtO4|+sv34ZJ0d+na zp~xiy4#TA)qZ+^ zp3F8!DpniTnEIlRBD=5ICr8szD0zU%r4~=28pQzDO0Yj({(P*egRZC?T`K@=BndN z)qm609OrOW_m_8AJLD@|2;Di`VokkIo+L7)&n!9mvLN$5mQPD(BVHkp6=*r!9%BG4 zafkjw-!fy+H0l@;jfuJ}QOk}yuX|(UJ-W_HqUfS)rL)-o|2>!WFs+uKi#u&_f4%hV zdmrZ$+2eibZI%y-_ho9c+|TLWC=;u&J>AzB{jOg_Gu9JpO=@_9@F$~QCLa+&F#tZ< z?(#WT%1Xz%R`88(hNF%8Bv~t#Fd};369JomrvN{CGT1Nja&3?|hc9#Og7c_s#B}R{ z0PoJL7q8wh8TH`R8okIS-?_iz*uTG5@LT&m``c=!e6<|z)K_-(8*(I-_wcJwW4pUm zF_Gw{tKuTjTNaWcv2R)=T16qtmX({WDU`AG3gv8rLM7XDBJy7M{wq0y+^SoQ(`)$C>!M!8L>Kp!8Jvg_136(Ig!D z%yR9;f`m?n1o5mZgVa8zT!G1ElId@-PA~xfX;Qr@JlR9;RyjZpFAkIAIv*0c`EMAJ z`YVgaP=6)nVXCs#vMOvgpabGvLVT>Q4QH$c{6M{3v=CHTU)w)_2h&N41zbW)Bq5xW zy0fZt%klguGby_Np8c(t%9*&ga|PN0@i(**j|CAqYtOlxjbTB9V_^w(DZW{6!JdIL zF-dX93uO=IYLom87`@*jn60)E_*N;a7rc@3CVG^*^hw*Lb&`u>%^k9e_8oPoB z18uuSWVg2WFpD1tq8{ENf{_V`?EF#9&K)MZTcBKu1M!iRb6MQV?W%}|1P zOU%!`PI&5!U-bIBI{01URDG%RS4p>Fr}Wy0hT=HK$fK0Eql~98?AMi8|frH=t`W5;lt;Wjj^b!R_yr?eF8--*x-@q0YqR zYOC!Iu9bH4u|`P#6Dsl zB*lkG<^liXA0^%2#Fx1KdMsa{e5h;^24b0f(T%q4Fek90@rtwLQZDh3_pEcg9Cd+sNmzQdZSi*_a-h%%jfv!)bKM9X4Tk8#rKavRDj%Ah7J;lry zV&Q-O(uzdb!WjeElO$Aoqg#n_kJsnmtmZGS_bPv1jpZuD7`(5-#r!0F&%$nh6}9bH zXW}~HtbvI-rz-84+;VP#whh1X#NQBjQIFn7(>2LmjXIv|e0K zvNun?LG0H4{-A8%X=;CeR@)u9K}7F-b6ooevG(`5?e8`1?|0FVy_|`!%4n1agPL}Z zauXd9gOY>gAURm^l7r&BG!0!BeHI%;Qd84~GJ_lOS|L^my+!OdC>%@$`;CJONi2P&9yMU3 z$1!(QXvND`5o{42TPbis?7YuT(SU7PBEqF27?jv~wc-435U=7$H#%nq7ba$^vpAM@ zAuKN61$SP&!c>~Fj=t_q$cw-!3L_i~x-~Hpg^K-nHrY=BErb-yO|Z}uFOT`J<9zn- zQ*~MW=U6mtAC8$jqr;c0Bp&-4l)O=?6-u(dLdB!4zEYWgpt0pD^|z%n1fNRzd#_%q z8$qp5nf|Xa^I<}KkkDVoh$a%q#oQ@C405_3p5==(eeX%-zJ#w}y2ex>gu349XVyW&!1q^p?>5gwu%me*6co%wsX@ zo9mK%HuN`y?wet8EAv`B7V7=nr4y2C$GLY0?x&&rEXuS!J5E~NIdSiN3(Z{{cfSwK zKvOPWj{C31%@W~tb_?0(W5G)?kF61}$GmgGsDU=cJeC}90wcZ`;iET$c5%YPvWUi6ya}kMgI09I=fyNvuM{5G3A=yRVXgEgn~~hZNyvJ_#O*yX)f_ z&%H0+e%qUZ%sSuw#Pr&sKD-7uft5=d2HgFvf!9dgj+or8sbbHnGEQC>h~wnx=;2Sr zAKs%MXf2?S6lZG!d}u+6Ch4=@!IMQij;bcSTknqsAXJy9&{#&6H5D?1h=5*I>{lH^ zZ47jR=fX@zQvcXhkebw`@^C}YrtecWA4?|857eRI1e>&ZRnU+kx- zSOxS!x`W*QvY+g)`wi&t^;3JhdxiV@`!w$#?B@*!!ZE}f72Vr`oyIEB0)K*1!RSQW z&MQqCKEs_J%!L= zF-)@697=8x;zPk70W)q35Jl(8L{>J-z4R_1j4Isx%kg}_v|Ya5jn9x7{xagNcng|Y ztE_S}y0+STAd$R3AudRWrHSBzM0|0gjJQ11e&kib$blM<2N|CVRS*7 z(+)*~pQ~6`aD?nBayqm*#98o|x3Olda<9Ku;uhHqoXRDML<)0aJdZxSnkq9H@+uMm zDc9Vz6~^`7mSU3$XCn0vm#5$pz}eGDRwT2yk1R`J1+hE3$7r)O-M(1Jh=|Lx*kXDq z`@RT%IyaKXJ;zy%Z1B`*yMMH`xpXzo#M@}M@LCZcG|$uoZCo_APhUNq{6L{BRe<~Kaak8hSRix{!qjg?Mmrkk| zFgb1eoE^1~GqGiKX3RwA6TJS_zPLS^S)HsVBohOU18;$hmgSe^l=sbf@h!(v*(RP<;Tk?5SM*DTqw%gCgor!Ic4EG0pFPv3yss}U|RgW1AmA!-0 zv&uG)_b8Sx^By970O}TjvWwp%!}5qksnWGp!}8r`8Fq{oXp4<_LFmi5OJ6T0DFao) zX~Svb3$78Z%!8sE*xhcOiHX5|2YI|)XJy_xM8vg;zSk#Qs9X|#Z%OdPz2qT|laPJE zEBCeiPjii$JCff{bDfDf*+q!KeFot_a31CN1US#lcR4>V9!vCjBH><;kD3fn^slU2 z&)4kz=Cc+KMnBYj$mQXbw#td`OssKU0xyKC9Y>~Td(CC+~4`2-edyD-7Y(&-|I$~dq-dHpknX_;w z3W-AAHyTHyo+$ZR+^KPA;*qkeP=g29=YyK!5=bAJxx*QyK#o9hOp<@hcilu)Lvd|# z!1YP@qrAH@A9tLGglw`@7H^5qT2OGhQl~-ct|TT60GaBlc&Qanv#sb%JXbh(Tj1m+ zm=^w-LRdJb4TPbq$^yyDr8YdB4n59F1)C{^6c=~}Y**}8I!OzkK9$Duz*=dVRZOHtem+~Sf(uoc z7Y_?}t* zi{vS%s8f%1MsfQ#VGIXSD`+?G4yni)L0Fj^B_JDFXSyfAD4KL_eGJqiMhatvnB;zH zf78E0hZ96iKHGc8Ek6oJhplWtaq=2mSQVNs2>CRtr^tI)wj5^$E;<{0KLvZD)y?Au zwCe4&I)=13_EfgJaGM_q=W85#xbxf`P=P$_Z4tL@UKR>FF9pUTcZo~Hz-j!IXgx;bz0 zXyx%>otH=k(PK5=?O`?YSoL>!=%PH1p|WPJj3EE=fPsm@hsq_g;H0m101lon=L8EEsETM?WN}mqUY){cNEVxGo83xnk!^;^mLtgy4+$haOcxCpQ2Cgn{G{wa(?9L za;ytzp6P6PtjrW*r~8R7rTHBB2a8qo#GStMya`H z&h+(Je&|*Wz-RNhSECZoc%yba>+1?koil{gA%@{@_Bh#nBo#J@o3W_nX^yi(Ee$ht z;yA~diLGfwGqb7_)h8~D(!fpkEOL=$H^741f=e++Vog*;PA(OD!(7j8_*^tMx*((-;TZE zQCCPSY^Qa?2|qqtS6MIWTDm0;*def)_mRRcZ62G@pS=(N9YCl)ZOU?R0%JkUS_K0@K-enb*C< z+dn6RzZSW*Zx-@)QF0BPE@)J1L*K#8!^c?j0dxg;itv@87&fzzCOsBbP;r5%C&C+0 z^oYeJ!LOs|dUVH%SL2M|D-{ft{fa!tuKkH(rAIoebvD~$i4NvVh?Zk+;wq)Cz{?bP zg(OK<``94VBJ7g{#By$iB8q$IX`&zHD;XtaHqWpLn?igxjJLf&%}EiR8?Q<%7#Usu z*lnUDsNB=I{?QOd$I<=^+(Dn{4i0qQ)mgtAI&wlLfPCMt<0OaQFX3+bgHn&;{q%Ig zE5?N-B8jagYR|0{U0bZNw3IA}+H0=B?u`KBz3^a-EW!4SdWi1pf@d$L`bQAMe)Lf(LcCpUmfNhoGG9I}+IQB= zpG286ezD-5;^|ynSnq+rsg3^Hl}QwiNsivH(Q60^rOQUsU>a3Jd1Kfh8cRgM?v)~d z9<%1a1@;UE5Mv^0^*WxeKd&}Wq*;7*IX6sZb6$6^o9<%!%D7I*?UQ`5eqbr z8eiz3 zGYIPCkR*cA$oY!LVTmGz){4IWQB&dBe@M{sjP2dky8~uM|ip+o$2vDtu0fXRVX+zx65f zvU?@>Gb7A%%F51jT@sm8Q z?buu9%d1>HlArilQLb>cwAyV2IFzb z_Ex>dMS^XmI8$C@N6u<-C;taI<0r8)d#nr<5ZQX5;gcjCjs~n&9Aid@UcrA>I9HGd zMj7UeU7#>j2=(UU-bSO}z&j{kH)e}5$q28;R8tqk^s*S{)dtVJ=$Z213Z*Vp<)j-z z>6ednR=x2S?aHUIbsk~7nEP1FTp0`R@Cvtj#{;}acPdT5*OY{4>~=}azFAc11FTkM zV_;t>TWiFU%^UP=AOQ@@B&|1^gy5U0zR?Za*sy8Znh;(gKRj9;Uj z?_(%W`7q4HVLw(Rb-j#26T3v1Jv-P^C9+FB(jo^n1{ulLQzNIk=L@$BK0PZ?v~3BE z@!*~({pHqLy&9igQWs)H2ol3}K{b&6z%fwjk7+HDmb=let(~3m1NP8+nmq(BvuB#MKgRp7qGPiC7-VsKn3H6`?#}i2 z-)g8I??3734W6zP_j%%Kt4x8;Mt27z>|UJkS0!S9^(=Ks1$IBk;0Q2)>jb*FCB9zj zIvC4WLnM z=oJ_zn>1pHJb3jhWIG|!(2$D?UoLt$^MTY3!XY3CHmIM>%gT;I1z`(tgz@u%Q+544 z@TsUI>p?e(1A~LEk>d)7)Q)oxIffPpXq9V(vnW|fiA6=mJ%v2+I8_8;EHaKw`weBOLi))H`&p%~m*2QB zAOggfT~Yg~5M>&GcTWbSSAZu*hDRgP$Q+kVnbY!xTrKWgfLx#lWwDm`3_Yzg0hBm- zfPFIPh6p>L9Z&z)z~bqto^XEhWu0`!x9p+zyhjXguYO%WjJ!h|L66A}NWCZMy#rzg zy&>8ERF6v^QpJw&I{8n@ao!=loU_wlpS8Xwu2#mAB=40srdvDFXwm;z+J87hkFG&AgaA!m&IjIS*zY!3wQz#QMeoqH&5LfMVs8tOeeNx3#?JXDNi&D1*)kxu=ik zIAey^0NyD#2`^G^GB*k0BC&gu=L-2NnW@Pf5#2o8BT{Xac?MM%dtc^S70b!;^K^Q# z&J<&h3PldfgQB=iW$p(eomOT*!iO@uudIJjc^gPRkLaXJ)FTVaqr5dpH-ua#C5-ad zNE&d8cc$=9@OpxJ_tpqYaoi-gNHr#Cjn%pb$^i^k`+s&tCyJ-y3{aTl#PyAWF;alG^a#P!El z0g1#~y+wAsnHA+v&dC4g~ZIflp*0V;+6 zOq<)u&rT6<=E2sBKSpuY&>3Gu*-NDNVC$!kNae5zk7qxgPCF0h$rq~>FH$c|CBDfO zi9;nW%%VE^%kx#VBI)<&*Vt;h97+;gc6a7;*p7E+Qw&Vpnz}qN(EG&G;xG0T@zr^E zcbj1)hshJg@+bqe$W15I9^9+%9TCp~3_hM7kK0VETZJ>8*N26mwn(sv{1NnR_`hH& z!0GR&+!$Gz;j^w>4MI@dNf5sLIkZ%kB!1=m55`3Z@t$V~hL^U4U?twjGUp6A!db== z57M5*y+oqG7z9F4;wRrOx>^-m&c~70u4~U~e}5aDyPRJidY1_97E|vMnY+cVcM0!q z;oT)-cZ>hW*LlE8QJwvNPMNwh+wbn}{nFub0TECHR74RKdj+wkX~dcYef0`bY=DYr ztf1HxvBXLgu^R=9y}XJwYHTrwC(j_Zc$hp^Iz)kQtr1Y_q$Z^O)4O% zooaUQGhn?Jqo*_V?`4L{+`F0j&s6E$@E+>RZilBgnFn_;%$9Y4d_bUGWPrL1f#Gwo zY_a1a>qX9$ zs)2`{96#D&w~5m2f}F3xw~MWA6Jg$4CI;UoqT5Akvu}32jjf1p_#NNW+$OyEoQ~T? z$G+iyT%-DS@q~z9mLxB?B`*L^SED>&VhB4dK9UL^OywxmT&)A_Rh0$!)a0C%OMNI( z->2oLYz?-`$8KSDVGi_pz{*MI-p_^aXzv@asZO)e1fsh@E_>%?o&NS+*_4y|Q&!%y z`KeE4s~{(8CPF8#&t*CF!B8%(oH9@j%7n5z>wTY*XT&E3mHTD!)&ehr8Y2iEQsG)v z$hSW%YHt@or*}`f`tJ12h~iXgZMyoQ^vN>U-}@+C{b8Cu$$gNn{w6(-@!J`HMY2U+ z$rfx`yWy|{BuN@Xt2|sCpxS~q`$(@jtTB^^ACg+fpb^aaHk=?$#0fOz3QaIaueQC*3)n?hVQ`ND`~ zjYMLdG7fZzV}KBiC&iO5$^f20!UXbWA$Gu*rZ(0jG+5UndW4A-A~L$gh|@%7TN;Ru z@(i-+28jvDc99pm7+YmD+4g)=t&fg>zfA04EUn!+fu!nlL^FZ3*s%)4NlZ6>)txzk zPnz|-c(+0ZA85Md2+mk9$ju)p$BV<0TXcxy3%5=SOv(Q&~EJd zu66qAFc{*qw-K>tLi>cBAd9V1P8XQrij^D(o+hJ0?Iw?cBbYDpFbclJ9UqXh$Gd0j zI6A)L)FXCd&}WqKUwdaG20XMU^HtAP9650^s4gN{;>jN5`52%houi_?K)95 zdb+8w-6qD#p~P|D*l`Q9YuAdM*y9sVa<}+EuspXm<9t^h{ zK_)UWSlK4XGys!j5b>CVTyZfjgGH<;@<6(-jGtrM$}==?_6+GUgB}a3~80lnGk@6|7JL8`GbP; zw1ZVw((=BPE!3>A%ZMdyV_6^{Xg98&O1sly5HX~|u)vZw%xs#vDskd_@en7+_V~U3 z|NUfS{O#89G2HBz!NE<8-&_qdSQ+;_?$TnxBUoe@t%whj3!g&OV?FTB38>-9il__x zV6bY<@EK+Ba)D8HlXo*vu0>F%lkaef8wNp`{#dfqh}7vQt(+6_k(v1%i8mk(vaI)n zK3$p;iDiwu#{|1)wjRTvbc-X+3$0rstPKR1?2%PkZt3limJNQV0gQM^Jt9%M)5N}c zd!z7|i`-RceT$8ycc;wV2HikXTJNH;VjRxZl{fv@GmWNxDyEmF%~30*yhRpP%1O7# z9f=O#BKxeA;Vsf%DF@#oo#|E6_MP4`ZMnBn*587hSwnt=Cpsh%B{%MP{QI=n`faw%O*1;g4Uq=Y%vrlz9|jO5RQKEu;u8j=?a~?5t6| zT2L(LM^9`EY-o(!9R!xUF;M?&Tn{wg4r+mZr?P$l!sR)lzKf}y7>3Vfjbi$S(5Fgh z4qp@+j*HI)B>LK~(?QF5&jjNP-|w7+`<0A#f)+bs z3HC{wd?ZHC^bwzbr&g8d-ftz+lG!D;ar)Y&cxg@Tir4-IVNE?-T3?`M zV^<*bI1r_zka@mnA+Du(jpQDw~67T_Pl)9#8Y$=ttoG=-;7Ud~`Z%tf>R> zZZ5}b`DqF&QK#k(W#0)~9RxH#(G=}!qOk*Y1C2x}OY8k{j4!KVVxqId zCxTDKKEd8~^W>+BCnNWXs8#o&h}xi%?Yf`2{ui$JN5VDog&X}T?L3n9o)MXK!r8M5K{W7s zp+^(bc|sK*R|IURu8G9T7W3XIuc-RJs=-LKT-pAOJ*gbFF{MdY_{IsobHukMcCWp! z9e+=~Q6yRE%cb5`oI*4k3W9oyq5e|+QZA5UtuSdGwVJr;@5C{r_*4DMvOY{* zTV;PfH-6v9Y&Aab6efTYVB~OEH(}^0wn$qH!y{OTokxaMu@KG3mNUEIFBJJ8S63nn zx?od(5Ov-!3#w^Hlvf{C-%mPHVW@e;#E_xK^rX) z=loHtZaep*PR%CLQ$v}8ffv}hbL;_T@6UKT7CG8kUlj*cpezw0K2NO^W%LA{Cw1)I+V?3nsZZ<;PAgA2^Wl!FggENwl>;XYvVp zp4evdlQWz=%9?tlwKh4q#%aXO1r>4c$v`=PMj8xc+T>oFD{PxwA6 z=FIKW1D&DS1m$CHK0)FI8pQeFds;YktdW&{VbEDbKV?bYoVr0;=M<@9&+f?HN8&tc zb9<^OODZ_Xc^HRX(w`MXlX%4%RfB`$(QQ-h5WTVT9MS<{%d3M~YLFhNVC8bD?P?|g z-*rF~uk1c{mt&R)X^_^vLYsV1Unl>Vx8*q7{$Zqd#`y8?IrinF`Q4Ur54&oB!L88K z3I`UM!vH5t^K$W@A@~Gy$^4pm+%Y^xx1hG9d5N%rHp!iCk-JY*77GY+TjL{Rk&o7h&o#UOQnjrGZ6FiEr0UsPQ!J zw3wYgdBsTRvZge5RSg^0l^(Vu22Snva=RG_XOCAAY~edyHN)`c<{4K1`C`>`#gtpE zv-PO#_Z8Fk7NN+c!%Z~CE&2_*k@VC4_E34eeNx&d*k+1V5wn9o6fR9e+nB>y0H<_t zmhkSA@^0wa?JYjBoi7VD|19<*=I>P|FY_sZL5=|Ja$}r4lIJ-gCR^53YLyPJWIwZ- zF?z?rWV<6_idt;J8DWq@FD4gy3v@D)CV9Bn%h;YVtXNa3wnu5vQG6_e+lG?RmQ(SY z+PAaEi)#&J!lurI+q-+gtYTRuHvX7BH_bp|%2(kVWki`Jwp)%ncE%aT7#1`0;HakL z$@Ikx);08Cs<$Uc`-7}c1>a48a>8CidZ^k)Zi&KnhhYZr7D{=x6pz`XAF`b&Z#cn| zC4E(lQ>h^$FkB8XOjDT8>N@72v7}7In##23hXJ7}J_yWRUpRSz+1g3%5!spu{4@PW_!d|XDE7J2L@uRKJfM?Y9^JXVXM)}FOtNO`v z;k>ID`Dz_KMR@}nV?^d`LS9A#ho`{|%J|d98QppEkTtUOpxkB$U?D6SgCGTC^OaMY z=cZ(rBY@&i`sPOwTp5b6g1Hx6uV6sqc;y?@?ZnJ8v+CDSY$q5y9vAH&;q02 zS(Bj$bxZ8;4wb(uf*qyD6r3|`9Hv1-&yw+g6~+~<$z{eVO`CAv?4USq#lJhosqs0w zO2nUc#K*}Hc`%>vcZ2(|W5K@P9pgXNDfe?F;P7B!-f3!mvdifr)*RadvSyJRECnV? z(n*W#M;=Am{mNBeyS}F{($LB~=a4gF7V;IYvx5X%X^P%q&n-8g6dO*cP@jQA$Gb?2 zCHefb>E3R+f%{n2Q28ohrlenNj8BZ;ScbCLC3!Sdfv{6s!L`rn4BATgzgV}t8@Z)3ho}+VvF{jnZ9(51H!}T=pc+yjLws#FrlqYqDsndlzK^~8- zwl@$g`!qd@Uiky&zM<;+4$>O?Qd6~{cY3Yy9Aw@Aw+0tvL<)W#v&{3)cJw^Qc2YMv z%(n3Szt4kbxB3Yn6o0#NOr0#%2FUnUo2Fnr#Z9X z!131NRKD7#4gtJ)pU{^+C0Cg^KJzB4?I%g~W$t-rrPwq6>{jIC^+DHBfQWtoJA_%b z&Q;Gq7Z{sn%KaB8bkw(x6uYM%@18ch=iimWk64oSldiqa4N&&{XWY%^hyQ@|U-!fv zo@x`b4Mf%cx0hZMcL&}*K~PJ9pXUPgI%H7x!-4;DAl~$nq3~9P>Ghuf zS5LeaxILo$k}%S#;h+NV==s$dz=|A_Jj9c!%+sl{GP=d1^Y!XL+#krE(>A5-c4GBg z@;8K4nlCA5Vy~!tCyvzv_Ua>tQ6&p#UmsJu#q{?F^!KCc&XTR_ZYd!y_hVigg+7hH z*RXgJ6pzvfG}xAiR?(-qe)K(`mPgiRY9<(=BS}IfN>o{(3o}h*mpP5=f5y81PQ5>H)vfn`5Oc6C|L6O6w{I-hp z-z^dT3o4tyghlY0Pp)C4Q}M{^@ipXRkK%nZV;;#4#(cTi*Fa&(%ntU%8r~aC?Ko?- z*&IW%+3pVA`@(>=xS8&mJ5Bx0zAj8(70IKW6QG4a#K%CImqNWUgwWW83@MT$-U*Uf z5#5!pBjr>45M{c7V6Y)@#zev`W##}WZ#eb~NLO}eUHCqzEJLW^&PZn-4D2<5+!1|j zv2CAii*szUq|g()({eTnq|p<*(-kSOibZtg9ps-5$A@Jd$_%x7NQFZBCTOwki; zzQ86&hjk>bOY0N;Wi62*$lyM62W{LJTcrlCUBFUH^ynNAC0r1xQJ~YBC=v*+qR>&w zR9#LO-DnSv-H@rb>r%~jlW1mlYr%J|bz4)PTnBctF%lmY$FMTH#n#Eo`pQ2Grwy5Lo5{EJ4u*#)>j$*0KSZLG zau9#Yl*;yZ8Rpx2nbhmRq?+ePYC)89(PlAbp<;5xO_3ODvt@srsWQf0XMSi_*LZ#- zvG*EXTXSJnEzPR?Befc`UxPX>I>Don_gIvEG@=Mnk2qYAt(qv{O?uWD(9_d!7UF7{ zD%VNuoxwJr=b_zu6ml84klh1T__$9!Y!j0Qp7IdCK0YnKACBlw@F{pya~FuBDk%22 zA<*5W>EnvrYbZ76n+C)^IzFb45mS>i%q*(3n3{@@?Ys3usgC=!M~ZdwuY4@ww&tDT zBS<=Omi2y?b@fu{BX{Oy#N14;+_^SOc6xt12TVu@KcxAVT;q~BGpdNVSF>5y&lkMx zg&BQGMl6cNnX>of*RvpKv^O^DC$6w__uKhGud$DY%1qo+?kaZ%^0Q4(T+=A29jpQj z1lC(DZ}Q)nZPPb2xR+*zBe854KJMzPE>fol@6clgXK^%n$+-f-4< zk-u~-q>|@N$xQDQx>CeieaPZJo{q8QG4b(t)|wo(GG)*YuRR`Kykf>^k@je{4PXEY zXcN5JB|nrPDzT9O7XnyKhKzKDn{vUboVT@ifc+0)e<6zJ3j2p#`rl-p=I_p>SLeJ- z(+)|4t3Wbkdpat$DeEm3a(zbsH6w1w^vac1%gWw;^9w!1ad6Npkm8 zEJRL{ZxR8pED*1O7>*;O=m4NHmb@Wlk4GyN1*mfZB9(Yt$)l{MM{C0ROx^KV8g|of zTg@Qb9b@|C`wol;wfRDmN}WPBFf2LQY4&OUhVUEtXqZ>`!FCMi{uU zUgIJRZUiw)UDt^Dnt;P@FQ!ZlU!$P};u3CUuy_mE_j>Ag48ak?K8SxUV>dD7LV#OF zZZ*Far*y~lJtsdVt&7RsWp)6z$4Sl)G=Z>;ta&L<{2=sz{W<+fx@^_h#^!%6ZYmZt zlqMI8{N=`7nm{^r9HTI8xApkVhBm~ObsNXLHTf`WX^C8TwmO^v=q1K>1YKiF zXOi@q)XU76;0|43Mq$QHiEC=y!FX|IYK~3ToM}(P$b8|`ju~fRO1lCDc|8G&hTNJP4Hy2~qQvG2o$8B>A zm~$)n2f1gDW8+K)Y@%s3lG$vN%xCt?l0SqE5-x!rF_k;Ynmo+<5`G+bK`Ir;$G;@v zAuQ~MN;;7%B&z6egx27nHGg|+UfE>d6?N&glKpl`Tu`XU-uFv6c;w;KlluNr@PV)2 z55;?7zh^ytUzNDEu=yiky?sPh8eZg1aaew8ujYtu#pK^gFBh^kamg7>`b6ffS&B$p zdpKT5GVOwXQ08s+NUrObi}^yuIq;i!SYwAtBWu%WBjB+54K)4kMUYTzEKc2 zRk3EBRb_}0<8)JfdO298jMn>kmH4cxM=sj8mz^qci^#7qD266NWsRnh@bSkY#IZ-2 z#u2A6F3(t~WZZl{mo#d|;$*fQe@q%~hkn32y~D!Eh1$j%w>DZXJR^p$psegw zB*5PpmWbhqIf0lRc&CTqI#sv_-fD6kVcz%LHRv;`>oiqdmf7yTo-v6pVXXy#qC)@+ z;-BCj!Ei6oo z&C%wqnv6Mmv#5?+D3*)NRYLGSeRyPjnF7%IuulhukEL+IWoA3#6XPXH-wDDwd zB~;=JDlra0KZ+O6GVzhTlKnB_vO6so!Bt{JeDU4myB4|fss0aei*F1MWHIFTi zpe@Z0s>>8i^2{Aqlex}x$A~0R3g>|MBz6wm!^bXzU;+aGv>dYEs_a2Fpjj|G^<=;| zJBNXOUL^E%`D@wN<^4|Ne<(2mfg8HJ(+^>aHYD_j_o!PpqerZw!EK!lLz$zgtAy7% z{8+#jbcsGr4qY#;H{4pNg!PNIx;JQeEYSA`sh2hX)Q?jUJTJ@J4H@R`_z`d(-#H2APqzl7n`%$6VUoLO92DHou=81Cf^G>oO; zs3!?hBb645vtuu6NITCFdxO!wN)TE3&aFeQ&U={>NLx-Z+}J=EUJVQ;+thvo%p$h| zaS7qWmZ_fEg1OA5G)Z4brWzSfKrKy80tVDkT+`fc4T*Xt6LPf6=C&u7p)=E02|HdBke0DBK)95zf^*`D ztoSBKU!SsnNP{WA77bav=CK4;pb^>cx#HN;%f^YNv?cbmEcQ)<*N)3XC^NNTjS&*6 zeeN;Mx+iDKK6yYO7%$u@Ncj@^0lm=(=n&Z<#v4Vp$O(u$AYGi>>lTklLPueyZ#+Ci%-YA{qjF`%%IKH7Xlt{F?z z_(u$~4B`Zy07eYreOm1qKf%mhu$#<{`d%RYC2*;1fXRm+Kj8RxI4Ls3Dwihk3m%kt z+)8FCS2j#-M_X231bK?MQ!nx)8_KaWVuy0+0B`T40#!Ld%2CvHRjuT z+r=yf<1tzvVVYXj)pDBH-t?a~Hatv_q?V90*NP8vn051iw8_YtHEN@J(16l6sINrj zP5XK^$yzC%6Vuf6)(eDMBHq!2ooaP`Yr=1jtBd3b1?{7nP`zzmG--0PKz91=!MZ^G zC2&fl4^2^%I^40C4W7>U+h+SSIsL&o$y%<{IR_KR&YzfXn$#nHmO;gX9>uzpaxA1R zdMe5>-`46QAy-tHiDPR>n`P5q{@2(C99e$(-U6d)fV(g>hAa$m&&k}_XqQc*z(DBj=b?_3AMR|z1 zGGnO|jqrJr=OKv?DH#v=5B1LL$J%f_=w|S6RtHu3KG(h1E!R8m(6`R>z5zj88jhA# z%fi(15Ih0UgJg5PC-!H&k84PLC3GX%30vBHnb$+`q1-IRBZggbG4u3B(|g9`ZlMQF zNbm^gP@cx=1tULOrN1kdcMp*EC9&T0>qhagti16nuNR6pMHM|f4qcwEV1ld@lz(yg z%hRQDS~UG!WqpYnjd4KE7#$`inIlNGzi(MC(5er z)b=Tv-@Vrh`ve#Wi|qv5^6{bzZ~H{ith>ZvY%Q@rwqDIypQ8I5q$uu|Q^casd3c;MS`{DN_~`7m1y_Rs=UTsfeYS8-wisqF$p(KUo!0by zmVyK%W|(xSj1z5FVDM%oaD?PB~h%0ShLArhb*WT(Px z>RvNdwvK1YGI5PCx~5nqo_8v5+HM7vzEb3kKVn*2TsFx@6q)ynU|Dg_m2GL!ErWCA zHQHJcv1b9$YS5&ess0c#3}`+k`4rlLx}cBRLP7+gkF!rEQ`oVO zw4V%|r-BxZE%6T}zPE!f$RHt=-D$)y$~&18oL%guT3G|nW&M_1==UVm?JNh!uSTYl zKTB3zP0A0X!fvUnZ$2cx-S(Nhts8%p+&bLC9^>RneWN3W_bi!v;oh>W`GP8Tvds{B z=K;t5g3b75H2llG?n36X>}cahOtG`JaVMjdyL48Y+8WWaZP4a7mpHl-W* zIw1TH-9oOFSSe~zY9bz*mbg-A3wfy-(P)!}>}K%Qv%6tAj5 z@o_+9g*7s!p9*VTD(?iKi78VdU0?=EkT%1HJ1FHuy{?02Vn_Y}qkC33)B^?Ato4*x zRqgRTy2aGfm^X{XbY5DmP1rhvs1)GnHYgmOsHJC-t|l^VS!_?ZUHA{&J71OcxA}iKg{KMrRQxGpxmN{Dzb_ia0%K0Ic0A_<`JG3|;;Tpm`jVrPn48MJ44;KQ;`? z>Z%!)8NE`OiJVN~;`F9zX{K&=`s8V)>BVUs)2B?!O%JBkO+Uf9D$KuV7oW469w1{` zJI~tkWjp(lO#}o_U4~-PuTfmrzsKqLlQZRck$YBvwtZdHtw(Q!DXOKS+IUD1quTV5 zFALc!FnIXFa?+)(=A zf2@sR8UQGp1{ZN4IEz&>Pwa2p)Wdb1BI5>0*6pp=Ke}cFa7dar+i>y{akU6nh#6N4 zZ-p4laf;a4T_OIZtS`a_eNtMy;D;~!ld-n+YreP92Q_$<_Zv@n7Y5$P8SEW*VGzai z21-}qGP9?vU&voNvQ-{1A}7l_Vv&|vCL^GZ@8?h$r&m19j>XerNmLyh=SrcsOyrX% ze+##P(~a*5H)kkjATS3*&5X_A(k!FeeJ($hpBXc{-_;>zs5gn|=%OvJv^6 z%}&Dp0=)q5kH-S*>y>q`$xmTLBtX*Hv01pSzCefvgek{b%Oac09q6lN{+ZF0K6hB< z=PIvfs>++1Tm3F>c#d!fvKliGcPydLJa4rC++oLigR?<^{kK<2?-m)YlvCD=Y8K%n z*WWvuJ~P%PQY)psUPK#27X4#GJV!PNaNf7^4;Q%i27zMYOe;@MPivU|kmSl&=y;Fm zvffRPb9QRg_ol&=pq{Es=AN{?JDpjoysO}??I$yjro87<-jiu>UPdnp?Z@!{!o)7; zLJ;w2+FzTt{}!naBIhQMRh9IB<&k%N6kQi(DQaaj5B|FX@@mAJbRSQvr_vO{aoSXl z(_e(Fz{`2V8@86i%?~4;8APsqd!Q-0EmD7s?8~C)(kOdHBrcEYuE&P019JQ_*cJq{ z>_89Q=I+S7Ckoz+d>ZknC_f?6kBf$<#17;Kbm6ld%k&zrz04$YJ6gL}3pA+#m3if` znv)BY8{hZy??C5R1xOs~z@ofVG@*OXF@ln%o;yVzpF080Y&T8)9uJc>AHW{yDM$t( zZz1>4r5bjje|UO2`XcP=*)3nqnl(93>ZgT-x~NU=k6N&!dR2*=MR0@kJHna_KW@-B zk%~kL+B4bNh45J$cpvv3$Z7@ip|+wvlF4^4&fz;unA-+dOwtP>4~d=;i7CD*t2asd z=_upn8*(z=hre7dO92#=7HtD(4YpgnI_;8HEF-XYo~H8(tFo7{>DBH3HFg zx-o`~96i}ul^u=ef2=G%Csmwga+Meke=Q1<6TK(Z2W)u(`Mh_E49|xOWoK|mJ8dlK zL>IhI8I5B!=#)Q*Q#IVjmbFIk>}hej!OvycqE3z*u|X_HgJOAY6uCFy>_d0hAoA-) z%?449*NuG(Es&$v3v{hCSu_ab%=AN(r9qn`MDtD?L~cFjZp`NYna+Qm#x?erbik6d z6J=_7WM3bt>ww?%V;1XA)9RUYdP(HpCx8WI?gV69Cr7SNyBpHMYcltSjQ&@aHp&r3 zQlFm5eVWF!Zby*(LGGjeB)AVE+LO;CqE|!AV(v-y8asOoe zLy;u`wXmXei85w6&QAmvS>Xt*6i@t$u$JZyMNmdC)WfOMBbI0%ZlZGpc?UJHj+)b! z$@2kZh>RJtk5GAYwJ4dbQe2&Byf!o3baNunP;cq~lQ=VNJ~UhztJs65Q7z<{c;^_u zMZC3VI8NnS*9hyb9LW~Qj1-(0I97};?}^_^(#cG^DW9YblsGmK4mg+rn|ah`$ApH^ z9L?0ryZyb1M!325-u6DWHw=+CZnmk#S~Xkh)8%2-Q@Q*%*@TxHsr5Cv&_UoV5XJfC zu8sM>0Ns`HhMfI++I}r<-uokQo!E8DDbgAP;|6R<69(7sXhr%pZ`6F`OroP8&_TIdy`;dP^a{HQJv)oh!y<&e|m z*X-^5{&V8%`6YPSy9>3qK_s+gldNaQ zp)%!K!Mx~o<-#z-LOEONGe~x$l9{+w!f5<^w)tkc7v-^H_wHj9sODF%r8c@vtOD3L z6!Y4#_Xa7K^NJ9lfd3*a)j%}oM-^6+@jfK_T4bHf=Q7NbhLy<4mtr4UQ#`Z#dDH{< z$b`M3nEy+`^kKa5J_UA+7Cl=CHWX~w>`X$Vc*m{&m%G~z&aZlv;}2rx_;5{K;iRb1 zPHI;@!%WS7)P)H|8_@UTlSP&=mR7}!Y-D^qF9~&M{!vR?h9r~V_~fNqSZj;aaAy7> zkO7`EoR8$t0wF8X>8z72xTGTc2(_R-GoK)E#`!W=Pw$e)bGKK(03GgR*!T8g69rDn zJ1QZyw#m8XsDWkGaj> zSHxQ!4P__f7_`iX8qoMj6?i#Ewb9ur z5Ob8KPYteg_eJp}L@C_Obh~j-!OMPrZGOw@F_M_0TNQePh(@qh0ys@vlXgko21ROd zxb>@N?&x=JOk8C#LG&#bE!?d2As=eQ;jF*k zCHrT_sMpqE4ChP@?uIs)guU(QaN`7Z|G5kj%X38LopXuc zvZd@uCJzP~O{M|{z%j~3$AoOYx4&BiZDY#N+QIIA6$k(-bHz_Sb*z~MJo6;$4Ac>P zn(0fSYD21Ug}4P{2;1wtxi{}j&G5eQi9>(cnVfi>wM^E_k!j2flkfR!6H8C>F^7)l zCmz?X-YJ?Kve5?+T!)h*>nbb~>cmA~3K*_@_ScODej2_{P8x2ICQx-Xf;ZL76vMe{ z_=rL`iFXeDqiyaxe%iPZTzJ2q4b*M6bsuR)UG3shnZJTvNna@$sdtf2=*6UdLTge? zQJN`~{3-`;O} z2lzQ*KfpIX4LzAY$vMvo`y;;b{!aX^cC{E)?)V-Clgg60z%lm6MEQZ1(-fcHV!wZp z2pLuTjH^W2jPjSu;?d5WC-wmA**nZTG0curCj3_C+V}}r{BVBtg;8lNNI8>VzCXOp z2WD(&(b}>(w)`S9g{&icL@Z;bUL(xt&&VGf(3wzDF*;kvN4)BjGLxsmty70#CkPQQ zWT#F$rgk?@aEbk3Mr;WJ9BIMZ%vlg~V{qB|8us5r6g&{Cv+a5(>SFC^d@~8tRH(L& z2h_w8GbwnU$=Yw;GZw%DXa@B*@57REL1q%Q#(hpu3Jn_0GL) zyw|Orj^2#~Og$UPKv~&F0)kB~}TCh|*#i}qF$=ey$M^aYL}d-vq@d5+;#k(jo=}P>cs~UI3s{F_Pt$9XqP5x~0V7`VH+^OeFy+C^NWod!jW4;U* z$Z)=FT|io!oDm-n{y)dP7RWv4%U{O7Q~h9XL=7_#2A+H>pay0UyebLe9wtn7oV}Mn&>v#fe{E3k$Oj{>9}n4I zP5R(pM45Ry{3#JWEW$_l1OfVrfcLPGoCG64y{LEP6*N^-U*;RC4acH&vv1%De6jZ& zck^>ljh_GS=RjinS4Ol)02^mfEU4cSg)>Dp_#ni~eUyRzD>co;9W3 zi)4|UMPlI+)yyOihZzCzKH7!g+vjC*rt>?*b7C+a7H3V!t&G6#kKz~-un1k;^OWZ> z%Jk>r8u^*A_q(P3kJrbA`Ct-vuZ`DCW|8t1E4fIy@yZF}Bkx-lDZN;Ei+sFM1LhNb?2k!(-VF(Md+lcE_>2{U=My9_5 zl$XOyA`j?HWiM2D2W=UT7DWWySB3ZkG-_`Mr!OUB56xes2&j6W3cId;6cp!YsnqYq z?=+`9X>KSlSNdAj_gUfY#1e6*ij)1>LS84`8>M(saGjOXInx-rM#^TzMQl|jn-;Pj z04s8g%{R6B6onh1O)bI%MODOWV}urv31BWbr%++tR13QY!J||zTgs%<>1aGzXeN9j z@jMwYt}e6_0QbN<)YqgMQzp)8q7774)=^*WQpv@w5zT&+tai(y#JA-nhj*EH(yl~@ z(k41|YCjPiq7Ka-8=cTDYL9II;G;XCMC=@JtU4|_wg~!Xa8lt-=_=1tvz6LyjBL+3vy1gVFYOlE4Fr?tnC&Jr^)vN{boS1 ztr#{`z!(gEt$r14lN+R7^}RQ#=bbV)KGhDIPZ#zT(!LU^YT}T~WN@Wa%P4;l-6ZR} z&Be+;yBMtJviDLyq9qq#3@H5G4x0X_aBBK&o;n_#NPJ2>SD1_Lzg>62YlK| z)sP<497IPP<{a+)Vq&tq^G11Qc5SW4C_bvzSF;VyT+y+!fuj}ifpwq-JA7rXKlAWo zj45&IWq7v?euW}bV+~5h$cadtXv~5-$h-KYps8nLgu^m1p)ylG>4_{x=7av$`Rdmw z)(cd5zDh4p)$>)bKxO0iYQ9P>P-EsRdx1KLI}tVkY)bec13-;Z^}!xsHntQ0#^SN< zk+8dslg;GTrr%M8qJ6$&KZN&P@#9)=fsoXd=* zu><9aMChg@W=v6a5Ink;RrPD;Xc?QL8lA{iSzyr$8uu~ym<~#GtKTD8$MPIhY5rQ| z>x*O}q@oD&$qc#9CWFwa>-C;Oe~Ric630kJ4mV+3LsoVbeMGko9nooo`1z`3zH%2R z5kGzlN_U(auEQ0!dkxhiWa>F)(PoL^<4t0C8~I-;6Js~%sckK*1zBKd-df@|E*8I9 zWJL2aF}?EIX%dE)sQib*`-n{tIi(!Riy@)TRN-0bC5Sci7u(*2K(M1LgxU|$?mXh? zdx;9dr248Iz66M&1?+_{ciJ(vCq*}G196TQgD1!#K&x5}3?@O^UQ9o}3(X%A3$OvP zMdMC|o(MxY^tqRrB8$bXqSCnIDzA-KqDn4Nqvo(>*<%r(=`&UCEY=Q7 ziDxQ4r!pGHV%&6yXuzC34dp<$XvZ<0zulxA+h02VMKRz)++*kdWTW9oKSji87kg^? zOX>U*^VZ1^z%GKe%MlM~|9)^jYJn5Zb;J`U8$USJsmhh3a*dRa_+k_rBQaivNVh{G8ww;Ht;*0Ov zK6=XAw#&cj#3}41HN;UYYg@e?EEBvj*=0aB84yCKAZH~hKep@B(3;Rk=Ku)^cL-mR zfIZ8w6$)#XXRRg5fF7U6jcQ{~&Z@P(lX{XnnF*;JGyH@jVSDAB*^D?5E(ywAiWckx3!a=`4i0DuI35nYOIjn(#^9guyH9neYho%Er2X~@-CvqI}@!xCXx zwozudf;FoqZd`ApgtY*d5^#h$(nW>7&g{nA_*Pr2N^X3IP1o6CCv!T78n#OV^W-K7 z^aj2(BfCai5xaK!TC;Z6UC4_&H4Zb;?^e~dN*RD&pJc&Af-Rlk#bRTus(o6V;ksu93Lo8BK;3AEXfUef&upw^pSBltP&Tpw&SL6K{p&? zZPH}~Z_T%=>pK`u%=x_yULH5N4@qq!$uxF7KNAd4F4V6imy#$tfHsJsjrf4A3BF#2g zg+qHJ^B%_u@;vTV`e|RvrzG9l+e>gTB;8sU|FU^N6Av*o-^twkh4nPQhM9@&10(yV zp54)$vjdxO+_QUCdiIgHXNOp`#vg3YXryhoHzT%tYO>?Sl(iax|x>x z-w69VBAyi81e*}=0~7S2G@tPs#+CS~xy&+gs+qxU)+{p(cC~JVOpuBV*VtXx+Bj2H zYfr;arrAEsB~C zikg56-Ll-`Oeb}gQ#jLUJ$hXD@?d=cB(1&k`ZGHAO|g0`(|QV1x&T^* zDg55COYvWclt!EzSp>9_lj@T4?DVYtIy+G4Yy_;iC1l)nk%g9-LhAUpJedmy7^2w z@OpC(16@w;FfV2~9RX_mV6h9}{`el*c$M~E!8}B_xIp$Q!#qQMWs;cbGu4H1D~y3owNoBu{gp?xU(vyDDu4zmFXRps8B3Lj@kr+tyeo2vxJ@bbIea>>r5O z?`O?o2RX|tI9aa|YE`EY&n~l7{Kn}0Q`jo_q(I3K)1o!7cRpyANsN0LY|ZLl>HgHr z@-eD+2=vc}z-0(h3_+o~qskLgLC1|{ASmzWm5UJw3iXg3thG62!_>8K%BQZQ#EV*M zJ8$WDP&PLNe;Smxwfn3qUv^V3xrLYA!Y2$$^X)Ls*NY{vSwca)u483`Src$fYmTiVp0&$|JF(mVrU^j96mV{WN08gG`DME95(* zSD0FCD~x5_hyWRTY8!gCzcuS5>jTf=?u};9YfkNvVD1Mc=9Dd`$EPe4$Mz@#_lWRr zrm{2hSJoGll?ZI{S10_7<2>Uz>p*3XlQGR)vOE8ek*gi-c!P{+E*Lsgv;iDkh$cvo zOKn_~2$?3CGuuX4c5fT?IYsuw0!lmso@C)v0omb-NF)>wYI#?Wp@5 zZ1q(De^iut&G~P}|4(E7x|to%c=>f+=^gy$_3yjz7yZpmJ#S*h$uis&^VHoY^*FR* zJ}v8ogk8R8Ar6Smb<;?y57a=f`IEW+)3BD&gi9>K_IxVW6nEhGJyGWK)~xI?#hIPQ z1T)Ll>j6buKJmgC=(3-CL+T;u#L=|ScSd8bCBC(TjWW6oMs{q#9cfuv)I`8=suKm= zujHw8i)#%LPKXfe3U~CYPAcKZ8koxfscai!Gqj<5Jd9MTn zH&12eDtn&#qqtWV?~@O^*0y;`&OI8i=Vl00i;MFHGl(B62eBF`A3KXbUPkycisQY* zsrUhMWFVz|ih<+KR+;aiL&z2vW!=V576+=KPOD3-zj3X!|IBNuSl0C`jKiiLXU*Su zxB(wY`v*qFt5YEF%loSRiboN+bb{YV)o*6}E@es>m`J9=EGB#FczZTQ3YDAvQ0f^Z zA~~srxPXdf@`F^*{RIr;Q?V24!OC}HS%Flj%e1HKBR{N9WrJ$}ETZPdN09AA^BkYy*u{t( zYTan~?Fl}Sm>LaDrc)$FnFw89*5lB4D7)EalReN~#M)b|hR#*qJT>wM(XvToe-Q2_ zK7E9G-+?M_)ZS}2{tb+#Nduw|>QBJgaH4x8Yh$4N6-8EfW7yMf;0do3D>^U?hSDt~ zb&JX}1y}?oFGs%NJqVadY>-REdU*i%yqLswy-DaFMC~Tw{2)ec62T8*!X_bp5N+`% z!#9a2{!KE!{5a8_PfD9a>IdO(5?wu#7cTtD3U`40 zknq+*Bwq<07BqmI)uN?0P=SLh2~-sHy{3lTfBoieq3-#=-)Q$qA+tX0Z&YTSr_~&$ zn;i`DZ46t;Ewq1?IJ#W@EV(l&>XpafvN~}=0QA9vH2q-tR|f*urNZaC0s6PdFL4Bv z!QNe6;RQqNB}0;9*1RXU`_A8l_iju4+1msUK>0_I|AdN?ja<`Chi z1;;Qpj&QV5sbx4xwA4Ui>iYzM43aKIzmR*wUo(G$Nn}^q{c%vJ{QfRrir^q0+BEzV zDzz17rGlIn$3*NnCPK{fH*vIVv0kqYsq-kN-d+#N|5+n}_1y*MW;5JV;zDAWTD0+( zl8sC8>Vk~fpIN*E(95Bu(ZG5Yu~3u9&qvzW20MT?UnArvLLTYz6*(5_1C)ThC{y#g zsw}f-%rdLuj$aAu4QdBK>y3BR$9L~JV*s-74wA}hS^ZP-&sT6*Sk~|KF0vtU%4`8D zGrrvCI7*FWLp;T)yk6Q9SZVqZSK4B=1mKujBcDUZMwzH&s^qh8iRf){zQ~cqW<7xh z2ZOiDjz~AC#@haqTyGd<`|{LS&kh7YVsG@+{{pTd+N-^KuL?9fLYL}7BJIG?MFBJ0 zsga~7MQwjmun{>o5eWRxRF*4%LpYB_(Zi7gT$sv*Kw`~hQ!-r>d5%=IitorD1bMrgoQM)p6(2#oijpv1yH*VBKTmUlsQCp1Q`9H>bU8(sCud z$y)g#c`8~x2yhyfRW}CXBzyZYW`GL>nAtXrbM^$I9pNkj@FLNcC&Xd#ZuuxqO4_hk zjserJ1)M)j2p0pfXuk@ zF>jsHNeITlwlVe%S=YxwhT7TG0lx6K*}^&!u=W?C*#u9Vp9N3ioa;Xm9g=H9c}Hlc zYv0WoOxZW0Zyoi~0a?5w((NR2cKL&7P$VA0a=Bh=HiAf-_Y@gISE4s!qh&atQxoMk zbR14Jf+ycOZtW^@;;rU^*8oU4CMyPu^MWfGWL+tp~XYOL))$QnP|?nx2v{F2wra#*1N_@ZXZhd-f+9V<(dao#kt~%yJ7)4QGSk-Meb`* z%RtVEtKE+Ld{4da+THEp!~N_>0K6K6(_7B2CUT7fUA4rMD5*6`Y@B%bv^XB#2jt7} zlt_<^>~tfvH2fAIaY$6W6r)~9V`Cu3A2`l99hZ{VYTbpT2xV6gnfhsEgqF!C9E0i>tK_U(*+wX;1V*O7c1X2u{#yAfk?OoHQc}wz@uRNhE4p~0q!1!g?wC^0)3*NY&lQKf5C z=30Cx(a%TkCS~8J^fd|=nLp%D0Y3FVpr^Ktac-Xyyhm#mA4~Tu>3of+m^pH~O3(fe zoSQN@w}Spr>TYEK96=1z@YriA-~1r;CWia}e$)89bpMTOoqC*{6T~wvKIcp|E$}~< z+n2-YT)E~#Gaw1%{kgbG}ol}2hUA^mETNPeVu$L4zJ02ZA{0pEK z_G3$8bXB-qQr82gS}i+qfu1A?M{q0wTa-v}*cR(SV~*r~lo2rQM#0b~Y!K!EUZm6e zp@irx$DGb{q_T7g%o?v)Qa8u`#4#4w*ElPMcdCLnP}`ENq)7vmj{_148|4{KxrBo_D~ z*E3Gxc9``NfAZ8{BZ0&W2Y$bcRpDHv7OKve0LC^I5-L1%-i^;Z+ zp%>ml-edkGMt~?ri$6Q&MCo^C= zVnkPp_vb2%amvWj{I+wIw@`7VW9P|jtr@M*?G;OHVAz%Zlk)B|LJdSi{i7;;3|-{^ zDCdRRhgIs4|Mtydsjim#Atl$UrWNM>e>=PRL8aIHx3dfS&q_R?aF_jEIUiHl>OYKv zp<^!6#fx>}Tb21v*-NB%flU3V*asIn`fNv> zm^3=G01Dz8*Jz*z>P~sOO=xV1@cF8h;L94>?H-YO!ARk~nAtk*nKF`<}atN;Qsb~U_bPB>x?9k1#;+;P!Dv|)aO;Lm@t2Ix| z9@+K({qy;LnzcaWzf(jlFi49d^xw4nQtN+exj|z!$a8Fcwk^AD{iBwTX#KF3uTxK4 z%X_rGTg!`WeUYt4+Mt}ig$oFry3PcFDr980wtvJCiJCV@0HfeFj|FIsNLW!Vj2ZO* z`-Aj?i1=tc0T|IhCA-BNJ!bo9^q~2(NMr<@G`zG66V?@^%YM zq*?C_?aiSRN^+|pE1iMtOP=_UcI>E+m+*RlWLNL<&l4HL6Rg$&)?$9jK7*Fh+7AR^ z4Ffff*Cu$H35}ZRfj*soI#Q29J&SyF_(YR7xSGVi$f>R8u@p(}e2P6GE{oJfQ4RYB zx3KY8nE_Ra0qexR zc;frh{4A$lA^_ngVYtPjY;;E8728%`ABvSoK3Ia=v&m{b>9>$Sb#!nHJ60-d9oaD? zsz?K*g^itHo$uiZsuf#_)2TNv(ra{^6a)DuO2&dC(jXf+bvT3CV7re zv49T(8)}?OGepVBQ6b)z$H?*op5u4Ao1h=?`lRtY%D>QXaK&+p?bb@mxwUC|x2Q8K zVlm<0aF;20IE1z?pp3g&-MdT5A!p?EO!8k<+S}aI(|GM@ z@6ftf04@@|$nkrRtFccys%Dw-YS#_^n&))m=Uej|2hX_+S&x zLIcL^;L-z7?g*q94#Av+Buls@u`~WK{l5MnP4fbPEytsV15O1(!U zft-)|7jfSF^p%V58%2%rWdG#Y zn;d^qxo~WfkV=jVlVj6X$0N7Om)Yuf<^IaCa=miAqEe+whJSag-0-Nq!K`<;&REHC zOj3gzOmb4Wu=G}9Xm&h;ktAb+Kwh}+&qIaGaOUIj*?I|u*xEEfuxz(4d#TI3 zc~?25>l|~X7q8Oq8}n!5y#^C05?=F&aUV72S>rxu%z2J`zGMDr{LhWp)L!A3UmEwY zGI;e@#W(wGJ^x}{d~1H>xTiVh_r`t9nCFfAf-x63K6C9~#{I&WD;;-@gRIAW5TcA_ z0}j^addIr~{xZ7J$=-z3&=|}Kb$BVR#W}Y*vmIis=G}l6bE75bx-W3u(-6fIu`~Jg z8iA`kFWt4h-wC6a_R^Dg4qNz-{CR%0{60_T^66>>MnSGB_d0WeFwmw7cpwjXW5(r_jH9A1q>#Is`BA;sgpBoi*S*1Qn@~wj+tl>+u0!e^ zl+)~@pxk@}I*R*!kdo%6r+e#kuPOdmVgZpCnrt%eN9BL7WT9a0PpEDFrMb!8%!Gky&Jq1-4XSey2csNf#sWw>8M_s<^j!a zo%1E8W*6oMzwLcB@jYj7Z||$B8=b*P-bbUobNBJj-)*^4NWh_TNC$Br(DOiyLb;>s zASW2evEkeDgBm4HbBW`J>tq95uyDddKcJ%w`8^3c>ZU?Af37KZy_JI+mscya}c^%_#U6-e4^x&R#!OZI_kSA0*}}DEy$G92xFM; zNcjc;53lDO-%t>;8{M*`gH1z(8_$;=%&9O?ClhUwb0)5w8}Gu&zVNuMls}r!9(<v{~5=7PocuN5o!;x2hBchixd!AxaphmL~6LXfoXcvl~f~A!6 zFSh}He6IKIB%YWqY>?MG)#FP}8t?-Bh5l*46LT=I0X}@f9kTQbq6kbHmKH%K$Fpjk zwjc-pEB}Zy<0Fpd)Cfsdc?@SV16>*c2|5@IK&j=8vT5ihvxOl=S1``OBy_MuA|bGP>H!rU9fO#);COa&9yqTe#k zGjysvyLhMP-Qo4YPs23@<#Ku$PgzEvZ!bmzi0%*+h0dKcZXd&&H+LvZqyekVLFbCB zYmNC{a(oHD1e<`bR1?qtk*}`95i%Rr4fk6b>TAcP#`DgGP1yuzvf0L&j8Q%>2=KBf zftX7YMjW?S*p~(X^<>*A{gWqZidY_lyuXvP*er4u3rt}j!x2d%Et>M{t3YNVC!oqz zQ85au>+QW|4C?B=RCX5_w^+9HDtl0+SPy2JKWTk5u&7*WaI^T#rp#$59Zq-F|4MtS zOTRZC?%;i}!wAdJJ)jSRVHC5Lv#o(ACtXQ`FUQ%u>s{J5G$FP{zKXZVttPmWy)_$q z*T2iKw*jj!4MD;BgmuO*4SL>J1Rq5!L-gfzKCBvuJG@%o1J0FFcWJDh4);iHb^nN* zXgadM9P{o#$e9H4&cGO(y}y!rL2TvNMl}eFyB3KRhS1?KIH}ew_Ck#?+$l>GR*3v_ zdqPB%*ri~*A*NqYnT>keSEZZ}b!T#P<(O0JoHMkVgiBahm!ZvB>)^qBzugxHwrv5c zjGZ@E^Y+Q!!fq+5xpDL#P3C1Y3WU@P&92~V&dt8eTdhOuS|92YGCvr#N}H4PE*O`K zTrB%7qL<1ZIyP8F1~Lw$yQ;D!iyGNyaMSnnG1Ngz_($S!d5sy zc$Cewn>0e29PGAim=Y`GlAj^MrR~tdoV-XRZ_;@S7p$++`L%)@o8jB0l+_w>`uj|R zA!R-X9@)oJ@|r;3;biW1^v@)WPUb_%mtPODkp(5v^F>&R8K4L&^E_367};h5pq;_! zn%`NTE!}XHLpM~brKKJHg~7C{>1JB}^#3yI9iC%KnR(w9#1 zFPHDsDS=dA-7NM~_(|&*?M{>!J?kdvpG`sl=w??>(vMeCFPWq-CKc=VwUhi-6kG8W z*@&f(z%sAVqU;(ioDYi#iPAM5bByJMs3NG?!0M56YYktg)|Ckq$_pcg|%vx2aInTbV*RDa8Vtc75#H2v^H+6P|uE8jFPE~4VgS= zI}s*Fn$U#O19%uc+L;K$33j<2b{O<@GEmqF5r@GHg}1pv{AVx2;Po*AZcE3XN+5}Mcp>Cq$qOxBzDO{%56+LI zgIe@H!M>S&GW%BT)4VTESfmuy%LM<@Hv$EtGd~yHfMBgor_nlOa99Y#5zV9ZU#;MN zz3(?-ksZ&4mEsCgYYqW(dDC0~b`b|jQ1}tK*e0hTr5XAe=j?h?~@v1z=-)Ld*D4#^+dp)T|> zH}LcyyvAp|2BV+#YFX;%HUD^f@470pLYP=ie%C;h6JdJU)rye1jIuNR?E6RdPaSkyhl z#C>}-JEYXYvJ)^H2fO|{^=NgS0O{mxQ}mspZ37-pD7*fBvENOj*B;e(NH3;iy-n)E zIy_ro=h9~M#lE)=mfc(n>>`-G{*8#Ja8BXBm`dexXNdUSzruGMPk_YZX>_`!#Ek&! zh{9f+WF+3pzVK+s5cMd!82LR?rvAEp884;yn^9MXQt+<=i=TO~meUK$LNQ;ewaT3~ zw>AMfuw*h;5N1{XaP@k_f)rK%!Rnequ0aAV6&Z{;jJtmOrb)JoOtO;M zHs<3!kfk5Pd)^}$TA=!Z&Ymv75p-}GLKSWlfib#9r2nv)8%{YuN&moE$Q;j_SfC=YfZX*rTz6A`E`D}e4hRFjQlz|UH+l{)mKul zks#yg!{pf4Ku}t-4#Xb`D`>fNS#rECIo_EZA4-l-CC81)@%`i|lWGtN+KEi7)jBPD zufB^Mf}$4(flH6NzKno6gmjE@i>If(GtwjMZr3x@&rWy4*axtOGGOQ${G==#W;}lW z)0*|~58K0Z!;`?W%$}Lz?cvLQ7+3F= zEvokuN8REUAB(^=?Rs=`^`4Eq=b}y3dodcmsd|`QY+XGhByfDTdZ%nvy-%p#$Nz2h zzK0o6T)pR#FX#?>JoTX)yyyfkBZss@Enui|#qSB#7jE#R>pw+ydj(rebp}zd z+8 zDpEwGT8atkHmSFhCw!Vb;beN$KB-on&nfG(=8mOQqVH{`_bh03mhfio5}A_ zlH)2HJRM3mQ}xYMtNDe)4gUcqGCY2!a%ZZwNuKq|@xJ8vSaN(RIli47KTVEWsGM)ivTV8!HGd(7tK+CCf_1#6nxH9Ed>uZ@B!VZ3@cLHE#S?*Y~ z(mS?(rE{#aGJ9-!WytUJvF^$(dGST*X<$icZkX;)i#R&~;(MLem+Ize5e%g>U31ja zg6aNc@x}33TX4(D%&{d3)GPCrx%U&d!v!PMeMt3aHbi_xlybZd0szD2?~jGbcfEE8 z*-oYf$lnk%itGhWxq#tFTbi)a2si$nQ{XF;(|?*__R@y~UB7XLdl!*Ub!T|L7~y0d zbo8Cy))x|PDD(KrXv0eLvZ}mt=F=84(aYK8$IrB#0Kv( zpyLiteJ6i~_J6;5GJt$WPt0&9(o&~Ea4T^gudw?SR3G#JVP6mm2m=HL2Z*K)eSz;S zMq5~8(j$6Pk0dR(MUSK!^9_D|vdwF<48)-`)H%=qwiEP&jnol~0EY|fQ0>;n+ ztmo;K>9Jbiuz}+fABH<4%DMJ=yUmy`~;8gZi zXAlipq;NUxU57kst~{!ZIQH-@Id|unaa#!AW(KAU-*%f;FO`bmaOa2un*-8Uq{#&| zgM71ZOi0O(Eh%X+3lZy7SDcnFgU&%o7SCG*Wm-1Yeh2n@5(Y2#>W-i4Q2cJy>!yeR z2~*I%5W~AZOes_0B#8mFoeN|T#}1mDd{Wv2dVqN<5}o{3$5QgUV`#eBoUb=YFK%`G zVMQ`DBe}4RAer8)TYsvt*}RmvL&Z5&x#Ad%akHF%N3Dk*fwwU;SMAl{=4Jn@yMyU$ zxPZLH!K9^XJ9tk-ITBB|JW%zp1ByYv@FlK!#K}G3l-*PKLXO#$`ycf0iigy2~y_XSM zq+b=`rTCqM`VhhH!_zHffYiF(vh~9nON&lHw1CyRV4u@AmQg0pnXHb1@-&xFI%gSy zlzGkXQgpk|(5^Mj+1p2-hH$IdjN(Xlt!8kd?F*(?bFvxmJdLAtVd)K5a+!67H2au`CJ|C{7*RdturZDhpDAKbZm$U}m3FTRY& z36ng-%oJm|68iD^SP$BJzs4Zx#>r=KPr2U##MV$i$85$ z+Q*x>fu%&iXdAiK0X-}$X1YvydX%jKm3X~97l2k_cb6>twd&-K9NX|Jbxv}$?J$jY z&;zyhyF9B!9expO1Q|eXLwn^LVtc3S!?FMo%)}OoL(V-d?k|9Z#D4Mce)T>#q;=vH zAL<6#{pavnA|;18xqZ+u9ucbHxi@v&8&HKka}NTTmj4ynCt1oEbaiZd*}S$1$zWj` zXr*n3tKm!4576j@b%8Jb&s~%{Obz$m)Xp2)Rrk8yYuW)WEbS{( z9YocXaw1k2OZl#iDPLw0H!bV1-xK6p9T<-29BD>$j4X^mm$aup!X0@7#a4%ZNLSsY z@zh%znRBB612Y0%o)%#bY@G#eXtmNO3b??lkU4XpCczsoF3I8GY_r|GDzsXe8 zZfas(SP*c_5RHgZMA11>DkbOO?g<79-tJ;yi^m&!-Q6=pzst^5<`8wD9?@!R)v1VR z_|ptk(SG)m$o#odm8YUk#X9D)lo2CS?8Dv0PCySZZ&^?V?h+YytC~LcGShvjaV|5C{T{f~c$b;rQoLf$ zA!0eMaR;>H3mso=6zSZOij)Aqabh_ae9 zaUpIL0Pd!y=BKz*8~OO0*G}=LmiW|hHF8c+?}&>QkRs`OteeDrj^3zKe?l$J;_N=F z0RY~h-N)gs^v62&H+BL7=A_@&{u{^w*)G4P{a5W7yXY!5ZqZAQ%t$N%5WHr4S-XYX zZ-E10A^ldo8}^)E(}fdR(x@Mna42AdM#i3xjYe(G&z3-_uCw4kC)n0+o7c*_0S#5H z=G5~ZX+GZpM+PWjAKjjNo`9x;TX8z^V!axoSz-`S#eY#^pv(fmghLVQvUZD7!@x+R zF@%ddM$K`iI8%3_IU+uRI?dBx82uMdAM70Me&PlHGG>+I{io-C>ZShfNy6!-v@UqgSq)WXsi@ArS36y_rN>K22+$)V%VDEEv*6z!*t&&(l$1?%dy9VZ zo-q-t9u5fkhvIufc`x%YYleB$ME1?N8%&1a5lN}sox-Mw(Ur=Cos7kpYyQjvl6=qn zK!#`0-H-Q5Iak1xiOOlq*CZesj@Rt^>}#Sa)eX3(u*IY)Og>YHXbL=vQbC@0TjWXM zqGFQ;SoAsf2vAztdBSQxCO+xPMA|>S%RFAR_Pd zi=wpfUIrvh%oEsIn($N;JncBIIQmbHyHU`)uQkqLrF95`uy6!|!iKn#?;%;gzh0P#Ba~gE=^%G84qpzJsRmoKZ;CK%$l5iO*z-r=Um7iZ0QnQGu*eo!-sPi{2Wx zIJKkgvU22bA+)G`#;a=xP1!C)FBGn)OSJl-J2LS`egm5>GHx*UI8TcEL;rUEoG0{l zg*oF!2cyn#)iarqc&Rgcug~~52~;uImQ4tJ%DHSNSIp;zF=z^|{&QG(GpwWSLMmrY zN(Yyr69{scdr9-`)QIFTZ>lDSEsYpv=COC&j@?96ZTzdM)W-FaDK;{O#Q305UxgAx zse{eKY`IXn4QBxyZuWGFdMxL|z(*V@78fJkiCE^nih`-1HRB15eqW-UIDtO41Wp(?>i{bJJ9gTh`EkFV%yG;U`Yi(o@ zP{#i^nbh@0-#}K>NH;Pfd0>84Wz1m&iowJq+HJ-+l1VDM&^l(CxRs>Pz~ZC=!&E*oF` z+c^J|aqiROYM&X0rO&&=-7kjge+~CnjnH2WPjtPfjfaVRWL(W-;MgIWHm+er&bAi~CEDLine*zZx?HU$@=S-FQ?aqKTH38nUI3a1W7cwY zaI>LlmK=EZU*O4nGHU7GI~Eq+tijweU0&xWx-0BFUVXSg+}7b?_%CB6iCHJ%x^G-m zxMV?=c~p)1O)jwzxr_U}pUh7!@b8{yZky-*d|uX!t1ENUq^Q|UYVuB+7k)U`m`Ryo zm;mrvX?+oIdYt>37WEu5>%}rJotuflWkVf$-X|L9^W*J%Y|uBm*mw&#*!1LBR7+Rx zSif-CG-T6=imSV_w%%Ts(|NI@u3ISfLO#BuUIr;>*xZqy;ygL8{*3v?RM!-qo@bt$ zr=Oh{ygU!{|ECuqN<3$Q`OyMz)sEho3!L-k`)1&H?>N&xx~00uX@-b|qst(61H}P( zAY=k!RX25EN8y4F#^c%ZGUw0p{m9Q0pmU6A|2%Q;B}g;k*%@<->zC+vlP#|{Yu#y zu#cL+z5Q?&a_{23EdRc=-QJs3FYSV>EVgmkt7po+A1~mYug!VneNq;}C z{?p^AVoFS(3I+{xidK$gNPP$NO7`c>!2i+yFNmJ4n|{Hi2azSEpzL5}$OzWn-?jga z)^Fi>oHFUxrKdvuHIOpU{-^;ap@cm{t4iS?Qbk1WmKqM~OT=*@twOBmKGkAM7q69w zq8Z@ZnMJ0-iLm_PiZpeh-c~;BRA=y5tOb|~6lsaMc&-;!IDk=Zi@L%{jOGlxP`%dI zC**&I;%kUdb}tdiHegYRjlJwRJ%`R2pijm7H3TotjG-9KYEa8IH%FAzi=es`cD@vL zfv10h))PAjTcniJZp(q^9Rq1)Z-e9xQxBo{9|*ngRM+UMje3o!Y`9!F5-(i~a+FN=zJr&#%s1~d=u6nH3Xbl(eJ75n`U zUH=0&;vvnu2TMD4FD!jHP#>n6U)8}o2&bz4%8nuZ63gId)`2F3$WwS@1jz{MLd?#F zvmitmr6YF7+ff4JIyizKMM}ZJwI1t3tlHdOHXoi_6V!#*6K#QBNsOESiF93P(KigW z1jXS&jl06Mv?af1GK;WLroTIAPby`5O5`35RCc_&JQBeNo*A-EhuTUQW&ck~4oTBB zI!ByyN}DDx7eVL1O0Hk~jt@GetLJuYs3>;m&j6g9JJh)3jgMmF;8A~+f*TM7wI z&zj+VEb!8tr19i}3$f;=MfJA92NcbN7!bv{<5up`&4n3w_{Z`Cbl>rNW2za;J!0XS zEkm*{!tp0AV^h{X$=XQAkdlMVAe@|iNSC$TmB%Flx*YRX>d_0XJ)Fo5I(01$YusF- zeL3K1#Ss0+rmEP%ink+stV4Ut+=zDJrZj6F?pYo~rgk$UORy=C>K+ucuT{=*_RX;& z775kcCf8BZo>ljzbDu>upR*}rs>QF_F1AfM2mvWMOv7Vm-a@;*Z|})!D)Kd6fUEVf z0TeyDMn4hU%1XZX^7P`&PU(r6`gC7L^Vz+*Ca^!!7CPi)D+8 zXAM`^86X&*V5*88J@3^3*U5<0KhvePy6o#Kb@N&5zBb8BuCl_{Iqp8OPU8;f>YljI zRx|zC3DB$$=*5XL=GiDY5d_g$Jn8GF8}|$Z@438F=s8;x5MWf^d_R4T-iD1@2J`$N zzfB?k?=K#VBY;zAv3HJ)@0_&h&Yda2DYV&(!}Dn=b~*qonS7DYXZrij4|XVArt{xd zZ^CZn>aa6AgB@Ht%Abz+NFj0y5ia;&8t0$L-u}0|vSWae=FUO!n&HlW81Ew!d`z?p_Kkj^t5)gk z#MFFHmcvJQAVHoSc5!&XBqb5-$<|>ct~U2dNt1~5bODw%-uaGqrW2e+_AK>aR3Dn1 z=!_8%oZtW~mG5yfwg@D}NfELSqC!aWa?5MOaxlv$k+N zLZOMRxQ(2qql28~hWHBWbO9l?R~RdJU!w@d7iItIIPW-KQ@vX~q4cCvhi9{V8tt+4 zshi70xzueYtg3F@v|acQRQnj(MrMKOz|g#&UD%&=N_GzJBPkTO2kZUWYAE$=dVMxC zH#0A@THC|91U2B-x%SuTjJ9!z=Bg2}!0f?$^g!D)9GlQFq@8VG*~BFx@V3c_KFVI@ z*o5~GSDCUIoI-;1?8K|OxtvAk)Iu2}F{n&CIQy3~B@fL0of|UsP6O8Cdbr^AJJah! zQi^;&(``=c4h>yiS1`;Qj-hh9-q#NNfnUcPoJEVujPbC@#l$?4rtDQIxdVhvndQSI5Fo~Q=2PASp7 z$y`l580IX3HZQ9=pp0$Ol^CIUvX&v36Z>sS8NgI3Q%8&2R;)7wRl-Vd=76h=$;;YB^}Q*^y|}V6fWQ-DEP&(Kr~4anzxJo-Gwz3(Q>h489~T!plMSZ^0gxK|vk*evtoL zFd?eSMi@S>eNpY^&Y^>oAvtJ3S0Pn(y#IC#)8))_Vtgp_scn2O&8cN2p_j9OMMf z{>P4=BQn!JfLYIo!q5$G&IRjpDZd*FoJNfk#Lr;Tu!ul1m6qv@ISM2VUf0#Xr8;kb zyv4a2pRYN>yMH@xHNzWLcoZ_%9DAci5hQv0xw`;GE<V`N?j8liX0}W#qSYt zu2}q=>wN4spaDdW?3Q6o*)LU9T%MA zFap!WBJ#3ZjJer#-C}_cZ!s$sSOXi2;h&1;%_3sMBo?~+Sb!-j`@4MQobi z!k%Pb^&q;WYU~(lL7P;)%)p#5XE~Q>7pS&n&ofXxi;6F{;u&>@Gf#aBuYH6D5SLKn z15@jc_Jt@1- zSvuujUARX#_V)BSz1gGih)BcpYp>|{T&1J6dNkhog>hM&M!fOkaUO9J2a$@&kqpx0 z6Z&J4j9D^PJV}y_-2fNB5PB^>A+&g4>~V2%eE9ZNI!n!Zoxa&uX=g=5Rbt1KGj(s+ z*Hb^X;Vtgs6~^0p_p~+iSzmmA?7g~p4>Ce2dsNA9D5+b5=3J1*iMIAK56p+)J)L@2 zhiB2${q4~zZB~h7<0H4KN&nKXf7I8P)Xn*4?d0ETeYIP-&P@^e)R;R3=EA*+iN=h; z@AVSjx!BLn%)jKN$GWY$4e@VdfZl`NUF!l(@SjffumfhI1AyBFZu4JQo(&PH%vnyj z(!Vl5O!9(n{@{C0`C@oo_qdna;5kov|ASrC*(N$ikTs(-j5*!J#f4`%=>r<>kmBC= z&0D_rwghwdvzL3_Luv6p6y{MEZVmysnXI?Lyvq&y^=wlT7+=p7X4U9t@pd!NB4D^AMthu40`T zC}n>Yh7X3&5V!CZzH=kKNM&&uETPG&!F;5^ENJ%o?{cGu5YOwsq-x(GJ_LLbd*8w- zQQ^X9;b(4igJ*7a+}}C+w~qg)ljHk$xb2r-^`h6Ih&YFw8x=1^-ASNLBAbQxIFZd8 z@R+K11AhZ!K3Nw&tCDqL8*`u`V%BdpSg*v?%DU?`q42^1us5PPW=i&aPwXR_5i5Pp z1U#jaupY0TIjJd#n(_s~LUMIa*2xhTyeeG={i<9nm21N4 zs4l7nUa@*uLs(yEK}tpFYOirTB5J3tVpND`MU4Ntaq5jfGfc>Y3q;o^8j@ zeoN1(-ERC2h3)s8=g!3icy5l**agM;BNs+H>V>0H{_K)nD%R`cZ$(%*0V_9r>CUPG z^Ba-QzR@Pcx2y)0p0+uH%>?T~t$VFj9ivrOY=P6F)j!BDnoX;Fu@X)ulO<(~+l7Zw zpJa$S2IErs_tmG_fb1;t$Q=>xF$~2XcU?&eLh|!^q#h{8xy6^!Bae8FVnby=Z04vW zcahE&bjmoU*<6(;XpDIz4X&E2l#OD@*sUC8h>{3qZqq-%$$^onJWKxV65DY5cI5nT#X1Dm?`uCRi+xo?C^Z!zp zO?m}di~lXlvaO5+YwH@>7L)d<)GKM5%5Q4O7HI3cDp&vAvC^_h`%9Uz6mX;7?p2Xz ze<;qo=5gc{O@v_--KrP?;S?A!6apAk1XfZhER~ZA4J{JiEg4A3m93BQ(p#3LSD`3- zs12Mi7UMx(7Dh+?Mt)cG+myeeDxvya+Z2{{*pwF76h?cUaL~2FK!@tlwrw%dNm!WV zT3GuPVPQh`7}sp(LhVsz?>R?8-gL)C-%Es7hRymq_ZcEuzegh`;mTObt3%k5*trS;Iz>AjISXKya2#Rg z>+edBV5wU9=Pq^)OjmI**DQ40Np2PZn?rLiIn;x`R?m=E2FN?q$(AAgwR1tDPZ6Cf zKw=ifB#Fy*#!DtkY3xA3iA9Q%G%L@u&5Ce_n^!TeVB4gfb>T$V&H%qT^J7BDVmv7u zdZAe`v{IT3Jvb7fTL?`h1rLP z=l&4SA50Q$#d%A)&gNQ*mv$h3at0qJ{m0c7$39ZpL|SDdSMYiQQTH7j7B;nSa%TI8 zO2+@N|6BZPwHCwo|Lr~I9Y=l4eR=y|gn|0s{L?g|u@2gn*g0@o_88Hx0{&#jJNn-# z@aB?XKs1%O(vU%Z4(cU#4xA;w?fg7KW&o-Wyf4nliVKEJ((h0VlDX~8JVcA}TwNj4 zf_!U;=91;hPS_LUd^?&QEBV3|GFQ^-e903}+!Zo$)9S)aDQzoc=BCv}Hl`Wa7@xbuFld2o_Zz6?2>7E5|qC%K^BC&w0aNUE1A@iKc0VfK4Q=a`@w7*I$MSC z5L?6Mgfs}bi1TqK##Hf~m0U($SQ3(gsSo&^JhfHb3l}7h5w0fYi`Yy)RbqyOQj$BRG^l4Gs~I1&M%A;H`d!r5Mi<25+bVQ!Zfw2A-*6)YRH9V^(Gf$vMnU! zg+@p*9%X|~w!-SZX1Ff(ko|ttes8ef&)M&n?e}Z;`)&J814ir3UtJ6vqzOND)i2mO zZ%tMzzX{kOyqAyD0xw}36(VfUpqtcWvWHnoBT}u+{|&fg@ed7_MwMI`&Vcw8b6u5^ zw>n}nPtAh1R;Da;vJHHuz2P{G2|ob2Qnd9JbfNh;iuwb+&!DWV{%O|pt|F}xOJ#V zoK8aWPc`D}@|~=L3>%iUctxak45YYSl6!4!Pl{9Dp1O~w1tNK6VE%r3l)cP`sT zlxs3s5WI85vfpk8T0<@e?safej8v(i-YMyYa5j+?L8GvSo%6d0OE z=+Tz{mFHG+ZFyCukNjgc0~7;qjLVx3f8tN3W$d^Qq_w2erA1^5A~|F;CBHWfMN9dp zqYy7?aru_>_^Fk5#%Pk*=L}^2H>V95p7!pTyT`0BxqEXpX=m*O<9fw2Sk7(9Hc$N2&9%eBkGqEEjPFhEvCpf#{gAta*dR67s6S7= zDtj0qg{MXe^CJcx>Yd8VRSFw&OgPCvBDvX$$>Zg}va75d<84jl*ME0JcD6+cm6HD7 zk6RBHj5-+*++W!Gc|*&T<`-?jzyG(ymj!Uk|Dk34@6UxM3~5KYb?CoLcG2K#Rb)AI zm-Q2Vu>AnKoIeFSG_&inamE5+%KZ(s7)9L{y z9L};L_!v?KbI1-4nQ2e~yOT-MEMc{j(t#b2+-P3y{IScSwCh*}@^JDndAziub@Ogh zpHNEWe@MfPv<-KfSCO?yf$|{vW>N1}Ymk*zI;wKX;8OqJ_qe%-*0r^gZ5xyf>nB-R zWI)H&fqo20iO;2)!h*;@Ly%P_9*DwOP#M;(mvmU%q;K+j z^H8V^07ERwK{l?*5|qrb_}MfEN)a)=W@U&=v4mL4vzuwqUWH3zu!g{1QwD!(P!?+Y z)S+nw=v#@_Q!TD62V|Mwvs7a*@35Ba#u?W0_r>3JmQmY~Rjx+#}1 z`-FfOtriGoT~(bSYH5FOf&#KO-6}U6?}Q>_H`}fT=6jmMHX@a@Esi^HRC|V%d7kAgG!q z0EMp0nG_;7BN!ITrp`t50$BR|Y{-OqYJoiQLuK z*2`TWY1b&TP`L{w>Ry$@kD$MtuVpj60*PHAQq#B zn_^3ik&WaEkE+7ok}KWumEqDJg6y6+VJ_h}*GHL=7$5SoIk$**8P%UOUZcI}BJ7J_ zb+oifoAnj6*Tp!Kc0QYT;*(@LQf%q>qZmx)2Miu)a*}gLJ7X%oggeB=9;MV=)TumF zU^C;034Qb8`oz!MEAEA9(hE6k1ow%nHHSQv@C)WRm()kDG!Sgl4ZpdxUMO^Fa_!3HDcABTr-JUHC7ILA@pJ{AihX zkp4Q*!tURl@DnFI-Sb~_%%9yz*Ri?AqNy+EEs5KnOx+k`Go4qAv8|+P=@y5OChToqKBA0azdC}-Lvy9K6 zPEM9!556A;rTghlLG{4hQmL!8JI)+#zHdN4`@UI;ZOJ-(9L))4ImY}rj=X~gaHO@k zck%DVuWGQu~LT~d->Q25;4GD?&WOr(~5higaJTdnQrV(!Z^9~g)6JtK7w*1On7DXa){ zLhmE@1kUX(! zz;jRC=@zfn!F32-aHoMci0YhdS=?ROhI^S&xepCUo(a2os=OD zSiEErMK7Cxr4&WivYZISC+_n0n9_Tx*WKca+I=5Ue}E}A*yrYaA~(Pi{8S_Vg;!-1 zUBl76UYncbNFYEMgOoc#{1~No&yz|prVa(Km82rNi_(AdAfW`TbFx_Z+rg@0V0DI< zJsr?}bj(7LM%&hb{$|BxR+hFJS#J8uz1)#!fKF7GizCqm#wEhb&#>brG^Lj;ef{Ed zi8B=26H@Zj!6m;m!FoolXmRxedQ@`s@5k&Z(*S|=uwXidO>r6SAJdvCC6k-!P03E3 z>x`M`k569km&psBuHBjO8$QBlz!V4s&IYXM1T*^>?E0}=6B4>dFAp0C?e_@2%|LNT z%D%Hks?0QNNA6)qPUmutc6puG^e-p;=sf3CVMGY5 ztN&Ba*koi3#<32jXoVs?w3>ARAp`Lsfk-O3RA zntHMLuA#V;2ICfd!CK|kV1{D*kfDXX<|@y>!mIhI2l#_LcKdh~%)oYwaRD8rE3xfk zoYjaMfefOmJPpirsZs(LA~&_iH`TySaZ^rQ{6Jx4?!p7+Vn#4V0_Yn_R{#UHdwgF% zy(24UWf7bkFO&0af0bvURuNP&qj$j&+s)l#GS4~YS!b7`!E@7h})^tEIaI1aRP-yXaM-OEy$&m8|MF@Z^82ou!$ zwJ8XpOs#V@egN=N`?=G_zM#jwnt|6(SYC<5nDQWqrcVhn_K-} zb}JYf{tcd5-UOw_{@UbWk!yVX*l~V_OUKA*9%@Lh3O}XH+_dCC^u;)-LLQOMr~Pyr zVWq(*nF&Tq+7Fv&a%Y1?Ad+go?h?lga=M=ja3aRoJ2;aBQKAV4keqOU(!M zpWPD$=E*dXt~rrPk2VQ)Zd=K_pfWwU~EkP23XQD>+8$R37;j_i8yyUF6qUTwPAU--3Eb-^BW*q}LutPT)ipg8S!=H_d>9WbUQ zmRA`UX}92Yo0_T&cVG*z73bwCgaXE@4WE z8@$^gtBErfVnlHuGX-c>F4yk2gXOZ|vKYqfu2o5ds#r|x2)`iwNs1+28Y3;=BRF3C zG9%)d2oE4LQM|Bg66oo^?`>-O5vm4i`#bn2h5&+q32q(!Y5p+3;xRA_c4`!alMe57 z7XoO96=oBLo?p{rZL2K)nV?qGtC}aZI?WVwc-%40x}e!&xP?2nUz>wU1;+BJQPBS#}gI8qE}V93-&hWy{X;5 zU`-4dv>VNBk1Kei)=g%WCYjzk8o6xDf=A8^tOJKIEC|8rtd@mie!M)lGY>jD`W1Xt$qN9Kdj(YsB9E56JHVSJk5)=JbqdOXMnS0qe5_$^)k)baR0}rSN z14Fzg7#T#hGxJtNr?7_M@YT(7Ba6xx^3E*;ocR}aaMCr~xz8J1d{z)&U3FpV_G?@( z?{HTy_s(8EF-~E~n;z#(2V!%$swq;R8b7NZb&3zmJhVe{dREm8S5Lv?#5k^Yu3^s1 zf=Y*9&P(A}9)AQTsIHz6#>b}e(G0bgs_5To=hr%Db&*$uVVYn+Vh+K|;7<$n?K*#( z2G}pa!3K092B(azBKQ;0 z3X2#c6Zqv(VcBm_i09d|bT!5VlpUOfZO^%Xph^$x4@bi}6(~$>OaxpK!W(7-o-EU0 z;I`N;A(}-UfzPf}b>*af&D0MdnCrlBGXu^HJyR+N;v=;q&}wjzc9vwPQ8Bd9)n!4W zLLTB*Ps7T=|3EI118Q9#SQsOQ;eLlPVp#+Bt&C3|inU zpq{QE(isirMZ4N#6s<_5?C*K%7lgKv#Wdwtnei+}vWbraIXDCqc*5w%1%;v~lgm`4 zv#(;xZ}i_x^csOLVOzG${}C~j@klk^r>0zDNvKUa`|G;T+^qTPjeEQwII_DmmgtP| zDglcTP?+1;NnZhLN8@;USGr!a&0PW0fB}&=FP^{S?93HMx1zLhCYq`K0d5dIn$hPu znNvYj!MZw=DJ8RaZajO(fHp>o#K)a!nq@jtC#_PGs>YeHIvS(S zXZhDe;#q?&ZB1F<;iP`yWWwlXr}{yMeSP&yj;RIMur(P#7baZy4yYNniM=)Q2&XfQ zN)gf!sTxzTF@(gm`%OeQf{0&nT=b)t=h4)t3f~Im*Bvp#3c+HcAq2Jv?p$v1s2*_ zVyj*vK&+HA@HGZ)wQ9;&>!?F}Ih`#K!92>1Qfm#NXrI(Vrouk&7=3i%`0%*scuaP4 zey4q9W4;+rmoe@XqWX}QhthP&W&m?r(3FBvaciF}3s9YEs>_yhyYZl6rdeI+5b96s zH+1=J3>>RM4{DYZu1#k`{T~$u!5i<7vV67=WLQk^2Fy;p4T*I~H+SPTiynf-bYUHc zYO3ZJMxE^D@NYp&MYq+1&Vr6DsFF3_)MvhKOfNK3D3C!zyhCP8pP>^7}WSN1Lg&DdR~zFl73H8>7{lPHYY6fYY7Xzm-!*!NWw)IK?nQ? zW5_;(F~l=$*X=~tjZhg}k98yMCgfv4y$m)|aEE8!Lbek2d++$sUw!u-_R=;Gpp1$= z;z>BhjtVAU4u7XwcMe8V$lV)V{P9^Z2ke^;>T46PiN7Vs^0|7k%B+RCrOE2Vnz)1Z zi}Vp{1McKaBt|&0>36*C-vHnwcva_K)9DYr)bBlWim5xxG$&lfz!*T0z&m3k+?^_TXB!N#)xeZeo{~A$d znspxAL)i+VXJ%xi^`X$l8bPFh{bYfri5bFNlfYG3{QX1p!=5vnT;oXny|fZ8gqmo( z`WqbQk{w)Omy=LGN=Oww?5MUCorYlXZ^2fE$Bc&XNX}F!xLi z7lZCdXZK3)op$LU;f-p>tqY=CG5qm*{1d}L4Vv+ZwSzi5Dt){5ey_uw!cTO#V|p*| zEUhWw99{KC?Y^utkv<-v5kI`xgnJiIWF9rH7JqW1Uk{`6qHw()cdK?T41*W_?nmK8 zB#MvtnP;eA;c-7(82hlG>C+hhM`s_^yFcbTKMCCnSy0nVsMV=q@~E0jZ90UYW41&fz!D%q!tqoAB#|vP zU^rBOC*7uuvweOX&SXJ#ciq=(r#0m2ou+K#?llaGU_$lC8nI>$gYN1MoCXdmmrA9` zt#PYIrkV+!m5qj_z!=QnhXtd5xhWnlyCDClWIxbt87?*gC2_BoW&AmPgk8qJ5g+PL z>{o#N7(Jem1jvIy6u)It#&uAP? z>pjvXYWylDA8t0nhtbMCc=k-8Wk<7;g0GWQvdFoU+RMJ#YM|kgty*czEnB9ZDU`xL z0Tzo%<}v?`uED)os!oo5c#SK#8)_G1h60sUkd4zK2h#6DGmM@z+80e=ZYH{&S zyV3Q3$sW+PnzNwqYb@OeYk@O#`Ph~Eo6uzTFk?+WdIScxD3a#8ET6K}??!$UPCroY z58~YWB~l)_s1fY}sweJIUMyM2$5BX|mYR${KJqCGfnNW^}9| z$pKb369tLruI!fP4V`Rdn&oKLAW}^d?yQ{rJWNtnB*$ZuAVF!{z+wFyl6C?=5Z$QAdc!5KylO zCtSDSHzCd1&Y9zH$7(x}g1ZEwj5wWT;1*lyU+-(t*SFQ)UU+GKJ>Bku79fmoJ!+@I zu1=PP!YvPThmRW;4KMO>=ND?pc{npa7%?pDBL><|g*+Mou*0AjKhn733bRZkBe;FB zXk_68&ml77d@nq*aEy2SxFZWkW{zw>a#?m3+u43^x71;Di)`Z_A&7~&o#-6qDml9V z-oiYf^=NaZz;`U;^EHz9-!V7D(?gDRtM)75tpF)4B|@Ji7?Iwaf}YfEO@uXSA^ z+iKd1?`i*C=sdCFOu98X)gWd`ezA~0tR2=AA%71e4f9^t-c^2hvaf&WyQiYes`|{! z{ljxU^Rl0NrtJODgr95gpW68xu|fW?I{OZbYAId*v-RgQ4S&(;g2?{DjYt*{mHb_P zzpl+TzJy7Z=D*sbWnow+(QAJcQiEDhkfqTO@+{k(&b&m5Fu4bD_RH6N8hL)C|y zqmh{8DwvvoWM(4=fkzfI`?AK*7Dw<0!b|h_hxF@)F!yA*gL1DmneV6H&ZuXC<^_Fo z>)c^R57aQ}h~FGPa(=jLXqx8hd;BiQHoOUXiq3m6qTg`=RbU2 zyD#Xv=LPScMf`ca*bESNPND+BG_mrr0pgwWBC-cw)p3a^81-bs+=Bab`j@(NpPrFT z7yK}l3ZsRT$20}2(o0<wBsMUB=VAwCw-j5~eLI%1Ve=flOT$5YB zRzxgtfz}u4(v8|{Lq3Cc8Sx2V42-r0ntD*Djw&6RG0x7F^pw*EgEiCpmUEc?R_@!) zGrX4&pKQK^U^(`e>j)#Z<*$P&X#Xt>+MJVrh9VNJbwAB1z!aIWx3ea*v7qD$KQ_DqAY8ZU=sul#T074` z*w{1=y4C-MS#imUsuCSF>?n{k@={X}o03>`TY0T-Zuwdiju z_nF3(Ri<=ozX=Y@9}aKti~zgMzSUfK%(+lSU!sHUjo&=!jgX;f2*0M=cll6%>jRbq zGicU1a-s)KDmk`%g}UDz4c<~Im(F(QoNPAt51k!`B(k9}DnF6L7ON6&_@{1XS@f$e zhDk*=-hG~SF3~toiB)*Lg&YRgn1_`8$uL*N)R@&+2;gR)c~7%&j$)Z4%z4@?T};#r z{|qrQkS@7`t&%9tE!(&Qg!(j%NF2+Tuc3pr!?55yhUEEScTKhTz$)D(5Pj`h@T$6@ zT3MIPUnC19mN>T3;izCD7xBb|Z7oQ|k5Ju?EHA_VrpSdo!Vw5UdMyeP8ANf^G^Q6$ zJVd@hp{`FdQ%^>VF+(PU)U+2lL5G&mv$n2XW`fx^u3_Z-ghjI1Ox4Tm;<(29xpSr9 zEv)x4a-5*tVNqMk$A@r4>JD9~&+k>J%kQI}afUr@+MeMd`ZL7#&AH5@WYu4iqG@VV-3ix}LsW!O!v1zW!cJxtZog6WnHzS-oG%+6c zLQsKm7OyvOER#?#Zdx>6xkuBrdlAX22az3NicH-}BH#pShoHZSsOa)URJ03=(rCf_ z=z%-kTW^ap1VR#Tv<42eMRrJ$h#cOeye7ODUALar&tv$Il!bWB*7+bHu53x`*q#(= zikegwaQ5QUB9gPZf(7y3bc4Rqc~S=HM*X&a6}VdWaUjf5@m}T@3sd0KQ)VY)umg+$_(#k}GBWz<&*&kLt;zaAQA^>9#P=IWg*IZpaGVaqi z44rxigucieI)Edy@^$SVBD}z4OmX|8>NHsix!_y@=XR=hQM32OV(*iB?}AdFQjZHc zL-#D3DKT*9Q|_VIkq{#TmcJPE%0rBqKm$;22ZN225~A6>1a6Q^wXAt)LfDW7w2J$- zao#erlY$>gHdGTCZJGE9b9jOsi)e%H1JmAMx2K@V);#gaXW)h%nz${P|R|hqHwGsU@ep3C6LJw$47~6p86Wm_v z`=A8vl8MkkdF_0f5xj#)Zp)@|isrj!2i=EHq?$LR#M!ofi>EH4N0;Re!0P7!HM-Vx zG^L?oxz?nPyTqL5=M+ZDol*-Bt;*x;(yVKKyfu5S_Lg z_TjC>vXti>PXsi^xF{t@iGI&P8y>eviE+WYOt0Hk>36q@pUO;Gt*@)d527o17k7hE z0|;g&oaa3#; zvqt~0Vx>@>SR)*i9LFTb7CCk)cjrQ}SZ+VhQKy2s6@iffGHs|w7e}!tMOi$|6(b8L z>_NNQmxrl9wYQVsn{KOTr!PJA0uo1I>1Vjdnp=%Wsuc4Yl;S~Wu(X|0JG(_)M#Djm z7jnf^dlp4@abyntfcG_IM@2V>!3on+Y!1z(&Xb~r+-Mr*m{#ugwt64oU?`Kt=-q9_ z2K5BC6|4aW${UalWZ4>G;Nvfq@gsYrrx3fCed0#i)@5B-skag2$n9-qDDEOt+{4zP zEq?Te<`3ordGw%@Nsi^O%%Lj$%pvbce=)6)aoGm#A2-vBgoVMch5Az0T{ zZWWQN!?ohW_%pwwVNV247>9tW(&W~C?>AGzU6rtqSfa~ij7x_Bn& zV?|^Ny{Gxa?%CpoKRe;=rto_KN3x_^4%1`|GPz?Gr~@%2XxSTx~h9%^7V z-R|#9;kR6u6t)%^l&}XkVYzURTX&zE+K8`2_^uZ|XhQKfVfRfrPdlPYCMX0UU#roA zln{OaKg64$^=Ki!geg>oEo@O4jhSe%U)NAH!%*J2;op%lx0JFGd@0qZ|H7 z%rH#m1vh+_vnmsAaKp#Rmtz!p54hnkIWN2HUv2@)8Vd#CJ6$u@4Z?}WTkVEty9j0e zKla``+ODen`(1OcIak|j@4a?Ey`PhI(t8gfp@bHCm7pL90tpJJKS4qZJqa!J5I_+S zB%ml@AtFc-2qGZT5@||Ns*0d;KhN6xAmIDnamTphj`99+ld;NKdzHE7n&m0q=lj5u zN=nqA-|Y5=8@x(;tI;?6wSCFut*z;M-VL6ChkyGgT}uD)uaCIFujN;9+ukokJvL}D z+u!L1XmzGgzr(F=0PUCQYYJ-mMmM_Nwbcw_O4yOfXVEG{+$8iC!rUlOj6SfFpLHiGN<_>M|)Bz6AM|40cfq&}Y99OS&gTJ~AKD`Il z1YiG}?J?E+eE6YVT5#D9FSPOHHiId9G27AlSF>ZWa7m*@slHN!iURI91yPkW%Aq z@I8FCUYl;-CfJv0Q@QZbS<;99Ktb-_k(m=596%Q(;1MzzbwKl8)0uVl0jGOUj=u>ErhF|y z%{B!Y7~pifv`Dvfr-itjrpvx90yE zPb2vrh~;*L(ygT_<9S%SnPyJHh;!#?ow<69y=qL?U#?O|ID~XDyZB;PaXAUxbU6uVr}M#F-9c4C%{?B$h`-= zaRAA5F#SAD=QJxKauD5AaS89#c+CuK$$+XkBL zm*Ofz0-0%gaftNz9Oe%CMMRZhDaDD!iB)p@m}3rX82=s}GWz8{5|M7Tj%3^I1Re9E zEk+ib3kz`83V&#n-@`dCLqg!2qv%HRwW=4r=2x%+g3L0-zk2oz6|V^FsX=r)e0YhM zw8uWAlro*bbxt~K;hw#P3Q;x1@fvYFry<~XAfJuIKDhuhyRb_}c8_#2Tdm(7vNnHd zmCP*bv@cuT*mgR>cnbKKnqS-k=E}P>EqI`!==q4OH#EbN*^1_h(u)8cz8MwYqrg2; z){iQoWVDr1eJFRsL^MT8HBl`zqePErVJ_rr!Gsy9$KWY+xp^?mxj!D3N-xWHTuNC4 zS6+646~qT-bMZVA<-DNWpQ^B0A70m9C*T?P#WS8WUr#^&qv{56s*BWoqi*bYo4~IP zztqquQ8k02FW{$9G~-rs8a109TvG%-p}>V;OG}WFia5)VMJ_jRLa5L{X~k3GRs4@3 z7te^F<}3Ba2@H4}WLxIYMNqlWGK&oPA0l16;VwU2Kw=^nPfi80ap^i@-RleoyZJZ{ zosjQ_307?B%tKYd`q9>U>LS|l{K)Hd=r00H;4MS^jA=JoZC*C3gx-3c8Q<9cT{U(_ zHMaTxhg(Fw`kihZx);3vLCOj#ET}f@_Ho3Ri41zH^1i3C-$$Mbf*xwTDPZzY zO=V1+m^v_m{zeraSK+LnGw2E?x|4#5;0j)5&hMdjo6-j?n`1)AgOFtsj z00t3Uwur&x?~7YA`Iw{()k>)y;{8f4IX%dq6}V@U4$123SwZ*jbh1)yS0AEI7uzWx zeI=~`tLfJIXwlu5FyiQm?v@_-qKRft!i!eX46e)u{6SP#poTB%s};c#qHwYZr0evS)tNA756afi4Qdzy3c^kF7fEVt;B5NXg7 z&VjH|O(}_lUGe9Tjb)OcW#VJFbgb$r=D_Lbn6R|ULcW^r%G1R~(mvbe8zaNcGf!%l zW1VQ>{q7=+WnJWtRWT%R7Lue4U~KYuas}m0Go$7EjJ4B;t6qRQh$v>ux** zcqBuEcrB}X7lmt5M&N>K1D8}2+Sl~vi?`c}H#lGl>rST%LSvhg?M$cTGS?f!bR;9h1p8I? zU2mcV68Iw|k8w>W0psI!0-0UPEx{x`0b(rv%7JfwCpYHJoP8@7yqT-z)JgdX9}+#9 z#WR*QwG7!mbuuxYp>N2I`L4j1@5xR4S&o1NWK)cDUhRw7FbpfBbMB1#EcKBGZkh1P zUGQ!^uk`iC@im$4|5>a0?bxpv5;{D+nt_D4p7|+_shJ!Zl1?|Hq7g4Y-^2eLADtO zw*-mG`_bc=jsk#`_{Unk=H`-5gA?1~4;t-o3-I+cLg_dgm|O3Xx$sfd+}P$D+d^a8 z-PmR}a!t!~sIcgY#3FbhEZMfDOxoF&LQoc$d>)OX$(Ay$VZoMq@H^r8E8$7<+9`o_ zw+HITE~knCWI%$3(#~+dzF@$fJ5Z0dSUidzFwSW?%=xFE!w^m|0smo}&tMUf8k$_U z5p_Y*%Ms$HbjoMzrx&UNhH*K_#F-PK@#CE5nHp0iLx;yl%=Bn|WO482L|ZR&))dG}8UpklEZu@kpFK-Ls?`h=LmK25E9q7muvA1Yq1)6&kt zJ3tYqGX>O3x9qoSDVHu+QGMf`FwW_!g{{Cmve9HBDiU&l)|VoD{9Z&|*1i%-sM8Vp z=PS)z;6$mobOuWqd8a6xmVs8re6}0OBa@@{p zmdoK9;T&hs@yU%eg}*SGNsg$=SmwYzHkP703}aWl#Ou@>LtY2$M3jBK@@`f$q}06# zG}&m&MyZQw$@9T*N(xKh%~IM8DsF5ucLCg_)B`|hve9;a^ohF82V=raG}pOP)kc@4*c04Q*)dY= zF$}KuNa8k+Nsjc6NWS77l^mD$Yd-jl~IF7N5>mF(*6mTa3}B=5}}JOoR|3Yd11$z~tG zJ%~s(BM9^bJhJ|{`XlG3k6fp&NgL8cr)$xt8hSq1-dP9!B(3Trc;vy!5#Eu>q26K1 zlKcUUM~d}d+6E}-)XF~1?9C%NxTx`d@{aO;+ounk_pP~t%IzBYnJ0~K)>_HFX8$Zb z=mnj;s=e2A^0M|`(aAG9|EvhLLt%~}CKrFsq3+uI^%9S+tp+P)d^u$O|;>w))1ko+<5{uCt7 z1^MTZ`r?oNT_|eO$e9)6VAeuEkAnPiq^No$Z?rfXdD`M8n*D|<@KGB1d>)M|m-emy zw7bP=7q0$y7ar;Sh}0}};ZtKC`#~l-G4@W1%m2!F|IQ@uX7cZ4q*5#O_oOS6PI0I! zbMUjBc%<{s+{a)43Ay7Vaq>j$JsBsziM_|-&vpR?cd4`SFd0TKKr3 z-kK-tx75i;a;x{_SWL4H%olQ>7=2v9v?dHZpS`i;2lA5=2$=`F{`?>PFIq$t(@@g*s zT29XDa6UjEO*_wh10#%G_`c)|KS zDxdw@GKg|sFnCvP_C_Ijx8S{3NZu@XZxxc43;9<*zFFg=U(@*LV}^#AqJe4Gnb&yb zPY*UjBiq*hJ+d9(yw9W4k?mfb4Cd#>Vu(qE^5qk-d#A|nCC{MGR4lHsSA-QW;yGtwQDLB8d-Q< zMPF6Pe!C)b-6S2IfknjpyOf+-_EwaW6U*L7<>c?B{QCr;Ay|B;;;pSTY-DT1qsY`V z!7RbJIK6HotLXL2cb95CU*@|Jsc5nDr$mcb_B;;`7r&?!OLd}44 ztur?%u}!M=Fm5ztW@UHR#+hfNvod!)9~2!nn?XVf=GD&)fV~ra zte40YgYJ^F$t_psODF@4ecESar~{mbnn)WXpY4(=BGY-*aD3JXI1lO z!yr_j@fwYtSl6_%k07UR+SCPwHw|IF-oxqx3r&4g-XzSodpSL*#Qd)_N1?%{|3IDprhwif3HYPvbZwCG4tM0eMFFOCZ_p;#x^FQ z+rLEv=U96lQMw_W;+QLoOue@OG&#i*KZ{#SZvav*;{!lwO`a>HP*JJ%{Yo-ql5zIZ zH1({0RR3)#2W@R5S<=iyzVj=uhf>Q}TFB9ac%)12S*a%+`QBuL6>tY&Vs~+z0geSK zE6WXv=s}+yL)g{OQjidRk^+HKX(6;Na6_zUeew=C7Pv7{LZLVugqNA*@!WDgE+H~W zYCYS`2QbM$;`@kn6PBrRV7E1ku8G)d{6Z2eSbT%&PrHOO=7)!Bx$^Q zgZB6jZ{2qk9KeX8Yrnw^)p)EO8xB$rEZZ(WM;N1&;vAm^)_uN1$Muq z#ehEOm^)nOS3wWCQ43x|FnE&Bmb-CN2m%K)1e~WNOCW}W@RGQU=cpUie$a#yM>Q-G z8l4`ga+-NW9K$7-<2{D_qcTjbH;=_P%P_UUcmgmsv#Uo|mR4IUC)#SUGOt>$oNS#_ z!u}-52LDrd8gG5{jO#v2=HenK@A&toDUPvqlif(y9yP5G0|5^SuPC<#&4Fqmqi~@2 ziJLMy$eSr#67%;6wt`9R|HM|H5+gQx`5Q9s??7{;Kd&c;sDBGN4BAj6=k$alf|1SC z_+(g&^itFsJ!0ILPF>yIDL5b<#1qtSJ^dd$`XSn)UFY zfUaAWSxQ>!9~z#VRf?mn;@=s`jJ`m9vC+g{9co&8HQL%l+3xF@S6pXZRP(kqecmhv z#A&uEn(t5c_o>e|C%It9M?20p%s24F%+vEMKh(@reR2K!Z3tIPyDOBAAFfC?hWj|? z_-aH_8v#kim1D_~5wL8utR__R{E%UpS;_Ku7t8AbXW43@@&mux#i=tZx#~C$RM~H; zTqpN%t67$Bad2pV7xpJr{;s(GV#8_~%S&L*E9c9h^|D$itIf8$ZRHxc4=PD@SB&b_ z?JE0%+)S!#Rb{QNHuH=vxpi57+L@n*4&*BPIJZar9phSuPmgAhHJ;?T@gB#XLVg!q zBd*8P=QJ(x{&(_opgDLmu~>N^lEr zQeAH-QXoF3f)|to&q$uVm=s?{0M~6McvX$#ckAJK83D&K5OoJ#rpL^i z$aA*(r?O+bePSHqR|Yw{&snOpuN=Qo+fKqQHYt$x$DRWOKuWcEH7$1XTZ_kf~a5hC$S2g74^QS8H!)eyMt9f$rW@?s}b$UsU0%64tglV}EOd z$1Slx@{$*2`d-6(9KLL0-S>*Mf3TlA18SjrEfu9Jr$|Az+CJ0n_jzt9$iAiGi?n;O z&Zg_`pZVk(dLb%cGK2Bp)u{gwi#g}Br|3}+T5ed76Vu0EW1EmtHma=`+Zd&Qk2mJP zrY{ADG|_6V)ZT%?LB8Q{p8O?inhs)To5O9k@)bFhI;5u>e6j=E%usGsiV;FMFo|+iY4ad&`yG+5dX!YdD;}6zewOHZ_gMJgf@0 zDRTBEX2Komfd^FK4i(&~!fMcJBS;1GgkPjT{6ZA~lH5%bn{aP>;Ag6EuL^#p!brj! zlB<+Gj==Rkd74lyHFe3}dSzR)uo<)r%3pxsP5W@!yABorDRK8W`Rh_;FIK~@^tb(s znYLSQ*I>6DcJ10N*frTLWWR0K0!{0i(J!ohEs8(1$@{=yj2?VFa{m+&bM?HRD;W!+t}B6wA^wV z9=$MNO=JDPzm<21$FM7N%q82@$K&0ZK=oPTraeXJ_l#Z>x-Tm8;~p{=8+>;6D7`~? zM6i`T!27Wxc^yV&_t(nXA$vryJ;#nIaJzmpPOsm_an7E(e88S`uRipK*q(K!y2X9r z_=9f%mG!;fX#37D_0l`D_N*85?e1fb%l-k5b39V3$T;HfJC-2Zc~<}TaRzHEd|{SL4j@kyW-IoL#OO6V|fWS38Eob!4nbSU1qh} zwrtycjnMGNtx4NF${m5DJyn;tEA30Fp^(`?4(9Fl`L&uMs7x_Dia5F8!oM6TKYuEN zklmLstulu_#-_nRcAs>LUhiH8lbZ-I?(f~Z@OGK+ht56O7QLfMxUpzQ3&t@< zwWm?tW4&r3Ss#=5JwNit~Ns9Tu&*zdMuVm-{*iNQE;Y%BPIruyot%Ah}4>- zO0+I#R#WLj%I8X^R@$~{K9({%p(PxVVd z+cIs78TCMYxV{ed0%Z<&Khl7t_+3y9r$9FFQLucT_sXI6w_hR(5utFszTey|a{dN= zIru}B-^J;#iGtd(c5A#oj&A&lF?N22`q9;w)+HCEL zth+87T`6mll)+c;GPA^2lKq27;>)v@%Se`;mmr_!s6$_%Wp4QiKSsF0hvNf{X1cQg zCxIf$Vtf|)jY_6bl&R3b%*5+PaMaE_*I)Hrk9Y_Y=`F&1`@FRr?J>jk8F&`=h9>BC zh3g+xAZ@n=fWZfm8r-!MUtA!`*gWss6|yGn_`c4V5-2_30DYO!I6TDDvjF2Mw`$RN zAfR60q8x6{5&4o6?BX0I{(9tNiH|1c6DFkkMKkLc<)O{wNCdlA-GaCrT1=GAD!79p z4x1{`N`pW#8uqe7P$Ip$$*h;!`I4ljr;N+?6;*jTX=^4p!A&H8(M`D>`07bEweo1h z?$ok3R*waG#jz$7xmjXn6(7&Aow)dbfOVVGS1wiy6P#%!t=@O5e?>4LXL#6PRGLYH zL3+ivnv#i{ZG|YKiaOXg=qwgM0TXKd?Mf;Q_NeCy6CGy=2eY(Z(82m9sBgRzW;uOV zsHhb7ws&;w=j>H9HBY*19!V-Lcja5OTA@oP!_$=wtrsU9rGx-Nud|`!oYv5BX6U1M z!KotrLWH2di-qPay`mo-2jQy(sYZvppQG_ax3HXoE+J8c`R43C@CcD7wSqx`zDWhU zkQXPIV?c0oCNG@D9nPh9ap{CEzjHyC>73&{l~KRuTNKKLtChLl`0L%$@L2c%&NbH= zw<=*gESD)YD^tubGR@>DUThr0Jsbt5glD=XZ#*Z_?#SE#(Lu(*Zh@-k09bQcCi9>Y z5BjR}Mh4V8c2dR@{}T_pDSgmL?ttZXR%XYf%Zw_-?&yqY3Fs%$e0QeTlpEkJ#95*A zxcWn3okK?@wF9WmkVkTA55WTPu7!2;!MF#-n>fO0S)rX%;%<*K_z=MrVGJq-kW!Fa z6DCa772MDkG;XaO%|>ifk2lQv@*yUQD{-#rrh{0OQ|C5r{d(ipe4HEOZh2o+^5B>M zx%JN*w$omO7RH7;!l}^wb4G;IR z-{h+ehd_ENSg!aY373H#DBTumG{pE(!{k4Nt^zj?`-KBtue^i1V{RGopE~)5do0Ot zU2mx?f1lujz7BI?66+NKb2UW|j zl{=3xXXKu-^bg{9(SSy7QlSWYk_Jr2e`uthM{U%gsVWz zM{RaW&?ZP{e-K=piz-1BDNCm>KIcr-h6QPW>Dz_?e)zPJjZGfxmJ6iS)dwqpYIFiJ zQs(AHc%)i>r=4qyLV_Snl@oiw>+L>woECmG+ zu4H$|v~hRM>x_Tv)#8Q;VfBzr zVMOD=dqW4ZjRVPDM1{3IZk!v1G6Jb2TkNNuNkTc#8yIePvLjomFAIJo4+U)V=us_p z0J2g78gqg6`j?mk42)00JqIHgk|R=&v7j>T0DUCtByPiay9Gd_Yi5|q zYD%xxqlq>N4Ti=9LNL=FvgI2(4lG-&4W@S4UssVoK$8FzQ!qJ+eQUKje+Y>9+o7FT zZ3Ck?v9TQjIW{-`{$FnOI^$hwraEn>c!UbQ3Ix>j=Muh@2cHaMRt~m1GpQLsD4-&Q zJr6pcahuS2rvhH-+e(X9g*c#jk*uIHND)vmL z^TUMc6$v!}F=+EZtUbo*eoxl}7P)sSSLPbFDI+N5#dwa*?HX#6mA!c~~IDd+`}vrYm6$gNN&ieD`7CFSSr zdn*4nu*SkaA)C>~3-oy69iVcwf5L?ukqrWW-&q=yd--1q7`hvEo=kYRE}YK{APE#R zN%<+2C)gQuceXhMsQx-J*+uNgKuIQud`pn+vm)4s9%n&k!lWXCOX+Q;Us9zPmEO!< zyI+;NC;y;{)bCn>U3Vkdp1J2{mAw~Y9wk~4kCYiYm8WL?Z2N;T=O8Zz6cPhed zE6CEN-agFr`5vRc^4|sL`KKxSKb3FTW8J9Zgbae%Dpkeo zv`TubSUAos)qC+~4Z(?iQUS!(FT47EMPxj-L{e&SVm}sWOiG>^?cS}ui)1vu5zXWb zf6cV-h0A}aRsdOFE=~MbR)@2!}oY$eJWE8aRseth;>f8(P};uf0b^qbvisl7RKK&#yBqp z&4fUN5j3eL1DJ7iZc-R{Wh9R>GwSC>sE?q*#10s?quu4g(0`=R`f!1D_Sc2nV+GgR zUl+nfndVBnS(DM<_J&{O<*q}t_b(}gXJ)F`XS}YqzeK}t^jh!pNQPc`DRN(o%<4k+ zoI-d(!F|}%Z%0IUAq+!MM9CfEoLaFvWEo)sMTTw^b1a`WgbTYTASQwQWFp@iT2@H- zwf0-RjH%JD+e8_9Kpz%+@k-+(T6*A=+>U1Nd5%>yI?- zd|){Icndx!^1W|5|8s0U$Be?%AmImP#97GwiX;H=hVUjWG>GXeqgiIKY*p8#bLJ1s z4>>b|a%=;N9C6o^{cRNxI+_viB3T2(N#}Hbxx0$&plY38`^@&Is&U}8_%px!$uI(KIr)FFy}8A0lU72F)vhvBZ;vLBRI4+^jR#YJCmACO2y4&-$<9zpcBx z;5NiyMB!VtzO8Y5%zB;w39|`j->x;mlbb@C8AO85!|CS zv5o1`G56?TWBtw#X}xjiXeJ;&kEjOD&ONU6?;6KvKBO@V2H#WgA^5PgWwN*FWN`qv z<3hyE${O9dPGun}(1qi9JyfN+c1LWL)3b}nI)99dLH!DND*T)n(UQ20xxTrxd6DVO z6x~AMWH&g|Rc8>X&sP|#(0^T_+1#neF6xf`m5>^k`tJ2MB;8`pKycqZgUIm z1CuN+U~fY3G`=6Kb(2!_@~{$N0Cof4J4 z-7rtj#h6#YC>LP}O4zzw6QyuXpLv-V5L@gG(K5*#ILI6e$!=7 z)ZXFPb5dAI5l#3etGe__9#9SpIfOQyB6L_I)NV*xbyxk*6GU!(met$nn@RYfHO+D! zdAbMKg=$FSJ_Ro z;+s37RsFwFZ}!Z0oE>1i7K;2X(i~_w+Rw#rVrwbumHe=kD%!6yBe={2I@%%ZhAL3U z{VabK73Q{JbM7{C|hhZiRlba8PZDUXB)e(O?D9SdTEtqKTIb(@Bh$Z5CQ zE{w7P>~^Z9z4;bRRHf>uKP+nX+e|AS`fk-DM;54TCkf8_%|QLHQm^hay$258YFGeW z+3tiIHN&oWz8VZhslnk~uq)=uht{RKnc{4=P4sT~Cv~T(Whd81_`|5?Ht|buB~b)T zlFBF@PVGi_m2hjUvoGn!&f>;)rPtVbXy}x?hfZ1A_~q!v_5|5ZaXL2W+T5n=bZt)4 zcfH!orgPoe?4~m`duJQxI#2jCdTII+vo%=l)_pVcv$A^PeRl5scIoWud^BRMCdV^c zh<=**J3HqoyL9v}lZtx>XDT6CJw;``yfA3S--wUPovXt0RQ4=IW|iE@;$z7k58+bo zR28m(L^^`K{xlVyuCgbJ;Fr5Z;SA2=pIC!2I)m!frwa>%DI#UzJVAA8Uf8u&mMLwA z?|CzC^p*|`*Mnt?3+_&39}weCScLZOC#f(_aHU2p-+(6A9dk}d)Gw}GZ}#)v(kSz= z0&0<9IcNiKI__0(=4;+k?y;I|-lcFqG*9AU=*(UjW6uHOQy0x=$I8_i7H7`8&F!z{bS0!shrZnJ?sqyW_*= zWLf?)7tWiMz+^3488=t{)*G+BPer#ppyG#fVs`yIau>Mg1B7`M$0mA-LjFK7O zjpFbE70=21RzWe00VUf;Z;45J0i^*kd!~>pM-W-qQVtI0EQo_#Q&`J3*;=k8Y|gfr z=AY=cnXUJ$jzYVIy0Ow@y9<4`cWOu2K5bxj|NnHD_OsORnZsxk9b(2woLjx(CTlmd z2kiwzeA=kzEt*ShEpBB!(doEeQo%RjSE#$cToKSx#8TOBnAwl2+j4e+A~7|xi_sHZ zbF==b-Xva=xAdj9v6F9XGoRefb~gf9_L&~c;RG*(P_+7R`&+S z*=!Dv8UJSn%OFTa0<^2$++9I_L*U;5{bjHr(4Z|W!V>6#;OlTCj{CDe`!7B=oP4&D z6~no>fNu6xH#E2@yb&Ar*MKyfK@bQLzGgQN2*>6*uLmxUtFYhQ027fnzceJ*i|`%k7{+GR%GlYp*$C z?#!n9qMi<}#OW;?3!+sMZ8 z&)#n~TYjRkm8a)(Id{lJEroQqvCgk_HQzG|LV#VsS!yv_C|coV%Xf1o(x=_#8) zerEHLp6m@ne(0TP79?95c+CwG>hY1D!4<8Og$mOflYsE!C*-+aJ;7_;jx-ZGx4;WV z7UG)usq!X!dfI79_ViZX7T$RNFZ@QN$L5A%Gwj1dB->~OB`!`jdX4wdn;m)Qjk z3VrVDtdS4-H<9CCW`ZoS-7)3p_VM&VXpp}FN*N+TuOl%K*t72<1cay|$-BzD10|u( zJ)`jtJfbU`v|H}IG_;$b8Lt1Mot{=Tn-D}o^BmyI)2i1_w@=d#?8}~g%a305?Hj)3 zU7rK=BR`yn`P}z6dv+7hy!1>zJ=1dL)80*VBl{gKXFJaM9wwG`pyk}(=h1)rVdu2a zeGD)FqM2oqt@*TK|7?>eJu()YUJ<7r4VH1or(&SVF&(9Li-}JfE&Y*S(VMV8NSvMz z1y<;Q2?4rS^Bogi-fXWi#lM$%r>M@$g`hy*B>ENx0<6hfI%Z49!3$J(oBGQZ)`f^F z?i*cgnqKpolA5GddJUVV)dPRdd4I_zf6hVaE-K>}>!#^Gv$dGI_ghgSDyfQoC+=|E zJR+5hkvB^kgm6F2gdNHukI8IO7443%e-8gQ&f-ey~VtSfCgGZ*C?d z>AcD5^qEQ5SHQr@TpF_0i!(cocGkm@0|6mUU9p*?uR@=m4Vlb!_E*}!7dr!Ez%V-8MP8_Y7uj;RQ$w>!ma5E*3B_IP1EfHF+~$jueDVeNeIzc1oHl@Dy1B1ROk_OdFy zq6nbOydaVlgIHoR6fkVZ=qUvx6$_sU%Q(!k5MFY$X1=ZuRh0C765Ck`DU$+DNNt=M z0idg75?^&2mPITTF0VM|Z_0TOtFNH*`O4URAkk+}+??c9MTL_6^e;v{{C5O;+N{On z$9MgMG8GwB{*1HY59&u#?KXC6yS0~A#d5XF34EQ^YDs-_aD6k9&3MP01^(Bo!Rs)G z=WWOR_c4P)mL_lZ8(j~)oNdckRi%c5!Ga7 z0WCmI65*yx1SWm~1(Z1KOQ3H`uWh#Z__9M+!hlWL7rn9+sw^sAIDo3F{4LQ!k+?Z4yPf9$sdonQ3h=5 zqvSu?{}z>;q{%?gZkpf6%d!t`7^aXS@ZL9G=`lMTa3U{nj~!V ziy$i#+w8TwlicyQsLZ!{U|Naz&8LWTrC%J{c~aMLUI#KAmH{<9qim1tnBOTMq{MC+ zt}L2K?#m2C%Rm}wJ%z%k=@5EOV>GD$X(5hc-gQALrLL&;t~i)#j@OPm+2BqwUN^mH z4|}zCR+#qRy1|pKdBQESK3A(>s;(#9>=W)DPr7Hr?^Rb7e&#Y{Vx~LRj8aoX+RFL- z(vBRp0h6n24TC8@Yd%HR?BQ}}FLqX%IQ<^$)r%Hu=4c>tbrbGqrLWUeLGud85 zpkq>v@>Ww@rAsL9=jw{rXPSSB#mdd|g7@kCLvHWQ?u_;BF{f#71(5}54L&XK=Qgz~ zzVK9<-G%^yxo`l@&_}{T!bvs!VO@5S_lC0Q?=>7XTJv0dNec8=Z!p6@hOvB>bEm0Y zq)P<$T=MagA9wR-rB8m`?ftPk<97F$RoYw0lSQ^)tuOUgiEO`4dsphuIq}OH35nD) zYNd7N^>`>tDLM(hGG?W)SS<9`w|U{082uNWe;pr4^q$WAS)f}On_9DY@-P-bjwgS| zp$m;PM(d284UrG&r`#fhO>QV-=a>+%xLdSz_Kc(t!G4`jkK{|`euPX!=ZaVOTwU6~ z$)`=xZI9ReH~=vgo|GEbhiCX*@KBwErrgRv@gslDkq6?Y`NWIJaJd}sGULI{PP~Zm zy2xaCymMqtPdqa)Ckk{}tJ8zPG@VMZdUTp9pIv3`)wcU8tFN`??^thMekNSN zM1p}UKqMWPhr9(kWiKBFxdfuiTYW+}Z-yMKoiGnvdYSHYYxC{g6~4x_dM1`8`lAtA zM#rND<6*jrI?e~d62?^5#f9UgmiZSj8W` z-Rn*M%?v^P)a+u23|rObnSIm^E^`W_)5+T9Boh7drI+ZP+(l-Y`m?X^pwj=60fW6d z+ShTQ1s(xTWmm70#?_4{q->XKqDbF>+7Dr`4Iom6+oTiumG#Nnn@dAqTwlvXE)hmu zPCSAZ4&}YV4Suy-)5W%IGfle3c1j~=PQn=3n+*s{A!SCZXOYsRWx!5eka2syf$}&# z`Uq3ufa84PcFcl%Gy92S-eb9pN2Y)5&h}RMV<#3$@R4y=2BbjhlUWe4bZ2{zY`p{Z z7>sgwOqhomtf!;1!>Hc668CLd21WC2b3x)>GeH(+PjHdAK0`9z>Q-PzA zIsmFG#<^Bps&K>Gu>kWKf4YgKL}QF$jE4M708f_!5*HofUkn*ns?E)Zh@Nut&;xe( z!~R~*9SxC}+8Ar2_nUrsh)0Mbl_$hFieT1y-1Cv0MTANjP4>zR}L8I=;p z+ZT;ktQ-K}EB^rJfch&~{{>nftu{?05{41EUKa=)Kz=T{h= z$O{|;OwE9@C*VOe#td^AiDu*KuX);M-su*$XUT-06&Rz2(*6 z(ky!4vldW6@gVZv{Clyzp~tT1x)vA1pVfsh($_!Vu1qtMytckn*vc{mD#oE>(t&7g zV!@xLSGagF9#)uPOsmtBA`gzuV>^w^K(J#b#yoYp9@wA<))t1pTtTCeu9Ly)>Ngh6 zr?zzw-+jgiwoI*a!^XC^vGuNGYBkqLqzOoBu&bDwVRsB+r*ywh3-od@dVHXW$)!mO zw`7dux1AL89TU85!gq{$(|E(DQ3GGxK*|^UA+DP+cVX<_PnDH0=-{gIOYbTBu9^)% zbzE$Ii#;>bY@RaaF+X=bwv$ZRn~Byd_WVQ9#ZOTCYgFg5WLHilfc>Bh&~K#4P(0zX zl-Q1|sHE@O^;KY?*9bM4v}_8Wp+Oj+BW|z-aF}ELY1}@S1@(|1{_E%5k3@G{tpNjY zYnsL?co9exmA<{tN4D-Zcs;Mw&O>k-d_`V!aj;Xk*xybsuv_Xf*-T2UO?Z3bN5bIu z8FhB!9iglAORKb5t>>O4luwgmdyyWF^y&3CUTg_Y-uEQ?(bwzmw1-{>Y5=K`-)pqT zE`pi_^K+tk>uBETqWU}eN{Td#0gQA+AjM3I5}RT7O!eXAW}A=XtFAU}jqMFXiT%RH zfw-~lX>2<_vz^rVdr4zEbpFuxLf!b`qM@B9;HM01F=Vr=0 z#SOooo|WY?fuw!{eXm8X_D&Tq};Q`Jwf zcZilHmDh?&ouTOh%OEF8AJOLn8IaI!_A(Wpp)6C>F4o^p%x73n1r429F z_v^;ah>swpGT$-I*`P{uUfxSGBZ18XIjX4Qa<{PHR%4I31YtRJ{oT)&hy#9RUD zo&m@ppOGl2+3|Gp+eWy|9;SkVZ~24H>0bNrWY|tkWzySsF>%V&Odote+$v z69cvsv_N=$H)AUdIS(rd={Vn*4Z5va;ui^8#&pz=q7)9skNMTt zR%A&qb6*3aJ**>m-Va{JA)@4Iad2$hM{L(6N?)xq&9==q@%6^N!F1iL?DM|8%Wvxl zz7bp=1b6vC2Xp0!AlE|y!<(&W*ARfzZ+#su7$V2@Ms>9xT;-!>b5gL$&e&}ACYzsx zWoqjb}_*dAd{?mh_Fpt7DjUJ~Zuj^KTRxAmu^xFgWt%3USGRNn! z=u3tT)|>4sIYw4Od6+i&o|sX=0&J@xqlPo@2b%0``U)4INq96+z?m)=wbS(;W@7wF z{Lo-@Z(>*OVz1d%f=<`osLob@IA7U2x3!Pt?2CC+!M2-sdztC;X@vmf9Gd>_9LM$kQSWER!|kl+(lVG=1E#>X)MI~X4rsY~>=uF&ES9|SM5L(4g;`Jd3y z){bqP(W*(9QqJ3OcE@zMKxq!y1Q#yEO9OQIZ>hml5*askENyRI%Un`_}9iI}L`Wk4e0X4gE1g}BL#991fmh2KI(na9KoGlv9Yht{ou zNR=llnJ{3Wn5~<|9yl3Z#J^ZF)H=&V9wEpgVc5#sx0v(cm067~oLLn9nUOm-S6kfX zd`lmmkw7m<2rD39@i_OJdF&QI(IeQLk#_=f9#Y?q*rEt0C8>?KpYxK=C45GPDuTDL zMD^F}Zajlt!SMzmpv%R4;w*eONQ2`Rq~BoJ+_K|UfH;ui(DR9{^!%C7FN1Wv!8g}1 zrQunm&zi59-zfh<-TZ*|HfRi7^^8ao>X%ZvZ419A9ucVQ70J{A7B>T#p6T3!i0QxJ znP+HNjT>!La;K}^=Br%qVz+)Lky;*)o)q*GA|fs++Qhkj-{X2A1HmlYkmP(&Ar>ryk?_k zZ1{v*dc>_jE{Z8x2F;rrX_cnyUG$iGTBV|UqB0}Jy~mWz;KtMs88R(V_Ui@70W(bt zl8V+jBujO`=a*2KjLrWXz?8pbAUm zGw}nH;Mj%~M~^mR&G?cY2FXV=&zOypvt)B-Wu~#ST5ZaVa^i0?=1=Jv?0ynV zfjY%w?_uLyJ$N|L(e}y_cHIa2}Wn0i{1C*piQ5j9knLA%Z1t8rP;v;`tyXA{H-?wbZiHiOZ8f1$Gtsj@Smg7 zTdMpp+nfJm9BhuqZHn#F@i<}jk>PiRuLcBFIZyw?6Y42sH>Lk+0Ey`?W{z)~%^I)B zp#HAOb49!PhI>)ofH!b1Nl23DINzilPl1N(NkeGIsnCyrxo;(cWS2OX86<6{Xz1T{ zi-U#RTqeSCRa+q^79(g<%Zsl*9^5*PWNVrSX~qb z1TtrcC@3T*G?Rt83Jb-Ed{PCqHXv`?j^_rELtLNpSmdM#(L?^;0{ctQo|z-jLsWCR zWG3rAlBG`N4ufiDJ|PCY5GS}Z1~EH)=1%f={Z92e%iqgZSlJ^H zU|y4aJ%_U#!_vfb#3#acK2QH#5sb5~-p74O=`Gpanq{%x%5noqYb5n?U!}+mMvQLQ z?M38k%0=kUxk7m;@9AlcIN@E1gXpg3F=#VaP`Ea91#Ti;e!ZH?G$WqKJ!M;Qa<@ZE zjZ6$h4uK`RNftrrx|afNk?CNzsj97z&eD-;j$4=7A2q*oHwt^zW>acxy-g-^auYD^ zM2l_dkeSbG=Y50~5;fkaE7$Aj25nC^T@10kEX0jH&5kzAiV*PdcNa;<7(|J+sx-se zQ14Gm)hzwErlp{@_kllrP@z4!py`NjH_z{bm^p#gE<^)|xI8a4tu&?MhP-m7?KaoD-Br2hb;Xn+ z+M;KeV!`RKZ-^>pq~HkgzZb|BZT?c(!cg&N<^4r@v&>`wv%0&TbQo6V9K;bh9lr2% z&bdhWaK^|5dYx=Baa_yRUat%wh!-#pASwUMwa>!sR0X|NE;Vo@R}0>iYPeB@P!kwQ zoB0`51wr{B)8Kky>`WJ2O6k^!SOF>BcxGS4=tS<_3|Y|AEqNj`20JHCHgR`K4Zfv5 z&er%3Mxd>n++6CUN1<7IhY^ahKxJGK%Q9JvVtGnC&t@T;dm=JVQhR7NhOmMAeD#hF z2E7}Ihph%pq

sBC4sC4Uq324-+9ZO3>M)2QwJsOB3~v{nX-Y1Ga#wx>%TUch?Z zcNIGcI@-TPbes#|X->F(G@A}JI_!*S_eM_)t9`b2ReVblJm0^r1b085HP2<+g^wmZ4(_k69KS?-ba+^BOjIOv#dQa# zQ0B~8xnNx`UuZ^L3B-jxD>x|ly=t9jM^5`?F8Eb0-xJ1Lf}LqiJl_V7W?OJg zlzGYz;2Ohp23S4{Zi?LRM@`IYM^A7^2MC{sG3P#-1J6LXcBHFsBB*uptoEmZBv&C|KN%KmnH(N`Irtyz zf@ydc$8E{C?*uf|jGb6Y7RbGb289fgaHZI2BZT#u_l!k>wDbw2T!>2i}w0k)N1!>vNykV*u)3c=+;xP_1^N5 z3NC*Ul7!IyexhAF*8Z~7zM1&{+_veXFK7SpZMC)IJOQnenvdo1^D2UZHSxOkQn z3na%Fj#6e-D^XIz{I+UV4d>V}Z!C<`O1rHSi5#&V`vK*Y)Z3mup>wSwBxG6-igoWY zemvbB0JJ)+Wu!aeyJ|2qDuI}3IoYku%xD+8yV}FNlQ;J!!TpJSrVu}0D4Bd$>5QVit~g@{&=WGp<0`1gu)mwx zg^5BhAQ>_v{}qh<1C0D+p2CJ~Y#Z1J4O}*gA_hRoMS_7pYp}Xmkkw?aQwP?k$>sHF zGMi45JI$Twml@G`&CI`NE9Zq$+bu=!hs6jOAvy-gO!IDHZ}-gYk^AGw z{FLWl61M8Q8TGB;N0EO?)?5l&rFOot-)8&`wH=?+_xMwTHT)K3wvc0O zM)DuX>;aR%|ypXfw?X3 zKGtjQ7-p73`b02k*?+Ixgzd2GeL!M0&vT7`n`iE9QD=?tS5zveR=nkv(rFcYL1jue z*|G#GC~x^@gE8Y=Y^P#;YQs5Gf6ERmEkev`Fgp5S86;Up%wPN`&W_Bdt!1xNZ4%Ab zZ?3d>%`kY=5}h2XbzA0+R`;i^AT}a{ew;!0fw@4eGF@q1gshQ5zu^3>t?Ay@;6Xg4 zgyDw6q)3wMgJ4s~8HY8WBTbTMrHNW!P_NlN(>ny|dQ!T+x!yvG=^xAHa^u;w3ITbI zWs&X3RIU=)No1HS<(!Do-Ivc~?}ixp=9~g$uQN zZENDf19nx_e(LZIt;DaN-;yftK%(guO+M2#h&bhdzFO=#%jL*!$(fKIzuI0sEViT=4<4nK#l8n^7=8A^=(!QUK6W>0a1cL?8nd8?q1$m2Shl z;S+lasCyzyNqvd(39VCOF)iGsc36bK$L;0g5`oWPw0I$FWZ4{p(J9LLVSDcU7Jp5P z29YQe6-3V&EV}ZY4?)6UoS2Mc)Gb!t96HfKVj1!k7s?>06PpxG-H$AB*%2fz(MI zP13swoX&*PMYfiE9m@Q|y+)Y@a-<0ZW!hTE=*$fcIA{rt;-|{FzoYG(R(Ex)TGi@Z z&>EeObz#ZbLlw3Mf_p3CniMG&+-vn}TbHUjb!%0m4drtc1e!3p@ ziT!0zM&}T1>dmpI&2JTW*i`=3R1eMUz0NkHE^Z6;_&?0ZJk)_DsVU}1uc&^~{HgY4 z@9)5wZNl$$_?LGCqf8TN9Omem-XGiSYsAk6Ue?Qu0je;fUw%HbVTf^4fn|3?t(F0EIK<9#irWgByKlKrN!uM&|Xs4w%T4y3Xnj=l5kV|{? z!n7ur9ki5h1l<}NCNa3DzCA!b&N3aX2xOgI;C*gS` zF?(O2oYRLJ+BCO;;Hyi0MGm*6h>wZPdkK|l?MP;kEFpUJQhgyUNt~|hCH(Jpb&RyDg`a3v z9W<*M(ks~hTsaR7Z@X+*W-WoGrkb{=vO1^d6YUA$gBMlKLOd%b(+-D@>gRyQVTg;WRJK~(78A*3KCVk&J400HT!`zH?oc1wu zSnqh}{c(H*9ER%eqrIy8(rA6|NPo>p?3y2qwr`;}2d2wpDkb-0BjGKWA;d^{5HR~@ zLF~1eg@FDJ7PB$0fXUmpIOsv$rjOq*ef%tW@N{^;e6WmGf6cjeJTZTGkFd{cbyrKg zvE-jOM*pJ4KG-61dBy+46R&POaTfNe0X;^X>1`yE-AOG>GdU6SBklBS^?_}ErwnW+ zU3+5-PQ29lVMtml<#r0XCr6|&95R+hTh;TSlVOKnA>50t^Gb+UMGSPsJU8hg4h?d| zc)s&Nm@5(V^|)s?BK+hqFQ-G}NX9iL;U1ha9LbqUGQ>*vHtv8E3)TnW=|-}tm@5Kz zEo!JF-lD}fx#Tua8x&sbQJomI#9hF->9c!zD)#FI&Pj3Z$DY2^v#)i=uXYxPh^|KS zRG%CKrZ+7+)dwia?M)#d8{B7y62eW~$hV0f&}2PaaE&(C>L|dtFi}33*x1O9lzzos z%^;EbsIIl$ z+Pn6ys;=(p+|xZhIrV5pqZ#F#Py&Gv5RUhlpxQ zhqf3n3+l(EuAi00jLp_dmwJ#Esb$ptF6#qnyHLQUGe8`FT5UF;QFEl0X`U855gB?1 z)2m%~sQnoc!(OjF9e=J(w4_SO?sQkQEcOy?p#o0>E|J{|zfS5E-}!k<8^q9M+=vM^ z4RcHg+R*J)G$vmP{+JB@#9T`zpg?VbE875xXN~p$m^2S1)p;g-)*Xa&tkP~NBW($% z2N$G*^HWI@c647*Lr|zL?O%{e#YfwF+!1dgL?vga4yajqAgeluEfmVOY%{2mb=wdo z2dkgaY8XLV@9A+G4AiSi-=XxKa4gD!68*h{9=zRu6TAdt65#HT^y9+*R(R`gsQSsOm*c-W5&B zd$~g@ez9zp?qmMjZ$lNwJ-hY?rBtbuoGPlZtU+XQ#N40zqan49)RRieB4Dd4gdi zo(Q|)%#*abJT(ZTqVm5q|{=_Y#|Q@%^8u$n(X?QQEsJ%9e7NM;eGm3Ullw@>No1lq9^z7P2@;FxhN@FH8AbvN6Rs)FVY;@28~K8W@E zHRPYFv%O=!bHunUwf=wf>9cC~%v$sASus6Q=eFt#TT2(T2IRu2^KJ418*H=5FUb3v ztu~R#<^gkWv%yx|p<&IGT9e4dvHo~9(mu7)F{VD2U(l)-!Z39ZvGPW3YSO>IAvtO% zNd9!2)Ce4B{%Lt1yd^}+O{gzoU6;)p6#}ae9`>1=Jz^it;>BctE*j}I;A08V0 z@Vsj5xpQ=n-`H`<=r^M~UL8H+6OAKAzqn}h$U_=mjQ;E+qhE~v{sSM~ai-bfE^&yP z&Z9Fj_yC9F`A!6o}jjWcpwCnTo}KUZs0Te2NXJ$@y*RtLu| zY;)_oflPP@$DNM{Hw`6kvfE`b}ynAVr^^>=hFfd#a zNuDj~Z}FK4@O(+XSYrDhCH*qn`Uk+wt!I>G;e=O{uAR#2+7h zqedJZB`Wz;&3^_7ko;y%Kfylv)tY{eJ>l~;??w6MKWh5rn*3HR+F9ebh3=)V zHqO)ka^6M#)N`HWPtH9c#a(w4!+VP&%8S7*MP$hbd%nP6QA1|H8#Mji-pK)oCwJ4k zL<{t+~& z^A1T);k$kHo)OeJAtLAqbsVljg+Z7E&SlGZ27zQy*txsA`} z?ES?}SLZjpm)-DganWZ8ScpFMXtf^C_zb!}akD2AZadt1tNq)c-c5}0M!X*PNUz<_ z0;0FpKRDZ;*{-0f7!LmICb_~)^Ga3pZxIZ5{9t-4!3meLL_OdLhc|>pXbB3x!NW@I z-6nklz3&yfR8_OPAmRf^46*)2=KF`pG{rB^l(djoI$M)CM2hF+yp%_;+32LO%+#=Z=kGzMyu9c6kCpW;Wh@FT3A~A4DVyU{qeq1w9Cc4wU-`jNx1$nJ?DX{aj|A^s zgjrjz_efdaRK`IPUoW_iBlB+bc=<;4RGASbD%#Z&4Mu4>&ox&oRwAcnp1~7YGf6cm zzH<|#)CfST4%-guZz8C_HfqvNb*H-1co0!*)-7ABGP^tGX62kV9hA}1x+SrS3)dhM zMg?D5SF*jQqxVD^+2##x^_Dobm(u{Z+Ps;J*j}x+!n-O|eD6TU6kG#93}nN3ls*Wq zvx0B1_+M^T*M9V?EMEz1p>(NLm)oxR3V#^ALJW|-!O9g_Jc^({8|Q!U1z{b|2F`kQ zOdACROCXT!%Hrm?VL_J?72<^a#eV>yA!`_n>}Ok=O5!!d`)BA|T!{R^9?qaNk-A&y z#~Xpnhg^MEsE4Fk+fYHzB?07T(G#6^G!Rn{#{}f$U8k4DtdUQ`#tteX3u9R0!%VdF z7l<>X{srbKg3R%U+3pt@J0Pg&0`NLpylcHi)Be*mK3oEpH*W0atyJ)+J)Lv@WZQ!2 z)#Z?C?>k1DHY7-06(~BGOnH#U+9MTLh0#f2e-?! z%5~ZhWpK8Pbh;&eaB+Mbc#A$dVmf{ysOF_{$bJ-&m&ue#M3+9;l7OD*P=)^Z3+l`3 zV-->S?s^XUHAa)kjgj<*fFSfQF-S;Bm*^N36Al2H%MerVqGUeiz0(uC7yQLM&v4OX zsoJgKnUl#+#^Y%T_E4R@jTMdnRMZ&qkZwmlq6D$T-2h%C_m*51wRySY6 z$5}kx5oj$_cvY{4#$L-MuhC^n4+YV!93jtt2;WZP)y=DTn@-${8zjX8S(GsLUZL%m zuzK=WAQN2IUaphp>Bf_PQq3Z5@*IVZH=Q3k4WHR`JjG`zRJgcy)>~EvPyECc{ZlN3 zx9qkyMjMaCD11ckaMwA`QB00zbG8gJY&fi!l6SQ@_ks4P&x>oP9P6H=K7g&GK7e~i zKin~D{Qp6{4y+ZNfU^_%b5NZW-IjpM;Ll*qq1s&`qYJ5KvYYFJrX5|f)VfgHUJDo{ z&Cg? ztkb_y2N1kruLj~xr@v!=49YwHkbfJ0m3c1doS$r~WOJ3&Jnuj~9`{3{w+V?JsRJ3# zLQFcrlrVGlVGlJg61FP=yntYMkjl{iK|o1zQ0B=9_H?Ufgj5o-(4^^nk{Td7lkQUG zK=w&ew{VnX^(=FU9wP|=<2>P?lEMEYR}JdR8YEP+^b4^k0B1lCDY+~*0-*r+z8G?n zafI(04ub2GxFC~%7{W0iPM^Ioms3&zcTgBn)37KEo4$CRdq>?dnyhe1@@?@8Y|+`q z_Q$|TI-KCm44QbSZVtk1;Yhna%(zAG=)`h&4<7Af_RyLh`54_pv26G7R&Cc%-=HVo z3*LZ&U<0CadsCn=#zdIqPQ}YuNsvJy^;1C6Tm|~GM-Ok1lcU3l7v@r=jR!yhuZzDK z`Im3{bO7RpycEtE_~4sMRk)WstjE3oYPYk)1Krj69V&H#J)X1fR(1zxp`6^MqC@Rr z(XEh5+U>Y`yB}1khgA3#uqlZL1j=ZGnjZY{QMU>9E*;*fGF}S74?)MhBx&b~sT=qU z<5)ihaT38f%6^)J6+-{@oumbv!>QqQLd$)vbW!t_D)}XnT0FwlLdSFzGh}|lpYdph z4gzWghVx4)*e0d)YSnbOa60APTgg#-GrG8jN8s-#*e`Fg*AhZ`ugAY;jlJ-==f;mot)I9_XjymTjeQ>kQ_8U~8AU$P_Boh+wY zVA9J*Eu^q#6qxM*oDq(rJYY(bE%I#5nIw!tGIhu$N2lnV({T2-J5)00rqt&XupLN6 zlh5j`&Yz)!t5y0cQagxlznCdtQKR6lZIEt?$Ba$?O zdr8uhe{=NAhsAj)qM;K7qxJn4MJD+y^U}sXg)Q#G<~`xs*yeg$`L))+8s}uv*_f`= z85G3gS>r;{Gt4|XF{zIf*Ch$?Rk*-v!VZ;p%nPn_2lX8cgfMeh7I422B7jAKY+4d! z#XUwjYBz~Ut$){ITRY$c%F<7i=qN==yh!rA_q!P73CCG0{DABO1nqtmU+Jap4Q@(} zcYX#~`z%~y(j7b1K|8nye*F~Z3SLxeCmj?o*VV$VqQti@PBmP|c+E`m4cC8Npx(v0 zM-69q{TsPdHYf3F+qjt^%VAO4671?hW- z7&>POvhP3e-y`48Qr$swI?T519~{soLg=8xOm~{EQ>*Ph6ZDkT4I#82Gk!TjsH?j> zXTpmVsS~ieQ-eT6(X@a#+y|oQ0`8P#kMorUwHOTPNr%LuXulfCFc}0s6yidM#y8VH z`VG`*B-;GzH!ySln*M=zg|Z59p!!>A{!^h~e_2b6ryG*1DT`PO{AV(u;Y27;A1VmR<#}xE|>>PVK?C-l@Fl%#kCITf=&H z zVOS*_M<|bV|)~PAIfBj;C&J{rEFf zVQga`(6IVGvB0;f&yEHxf~_JSx2v$R^{#_VDJ;VksxcHkh94g4^76)vgtm?bym_3Z z?@`DJKBYEzpCBVkF@Z@t!fMt>7`I_lH{ftPooD<#y&SXAo7!`syw z5zV_g72@#iX_Q<{5LR%G)hU zr;9+!vy`!-AXmCMm+YVuMQ0>-7WeCN{R1H8Xv6w9ef4T?^JmQCvMU1KJDl;yJH2Vd zh%hO~jAt#FD-3D6d7E0&XzaN0=Q@3O5ztuH#3){6At5a;!bl+ADGhmq*`}me0+lUl;cr_{ltDv zT^r2Qu0s6dT7RbgqkChO6qyw#e4#!PKY$c=vlTIz!ElH{mPNu$E8|}y9y$zL-RuPxytT=FknPT zQaa%?Ua278gT*FO^bX137T}U*@%yn6TnjaL+(*2){yC0Oq9y~J3_&sNUS((%|37@r zy?+dxS)3;n%bJ&u(PqIwh$6C6zd2f%r*DU-flt6_)%egN+d*gVp8m?1Vt+Iy-Jim( z+CFB4zq9>O{CNybdkS@_OQj6t$fYJ=QoHqB;Z`npi&wbOFL{3bJ3?!&KF@7`7r%1t z8C`iyL#6qQj^5Pz=eqrA^tzrwJ#LQQpRJ5h{iVUoKxVKs_M~aFf@qe%Bdj8gvyXv3 z;}~+fW~kkT+p)(~+_z9EdvKkIf-StD@YSmkIG(Z~_W5kbkQ;MEszMB=B+IudCAh)8 z`<>JJnG;SWawbO3$q0DCo~%MPs1?V>@5Q|;&fw>?vkgu*RsoD!W^_Q&>`DetGR0{s zFek8x5VYhM*1f9YdFjRP{hQjH!H2c; z8}ji?&>D8+Y!jt5@M)sE!0$zHI3VwNcCHy>Wsf?hdHS%~AA*&xC#VwM8ELEk)Ww=d zNArF{65*OHd-GWTKW+GP9~7yi<`?JjYkybHGi3G1uXO?Gbcvrq1rD+km2<$QW-M@a zaXXskQn9OX^_PU;g{yyAk^I_Lm+nhDxa9aCelL#DQd^aC8`-oHvBwqxhnR5j1ccv} zKTY_mD!!=VcG3EHu7(I&&hN1&i(9nHSf+iDy`8;WG4Bj6cAn#6uyC@jqD_gA8>Tgp zGga1P(awMO;qM_wi+4&BcWzhlU1fRibjIg_C8(azt&S;>1f6a1S_{0gEt%H&&hq?B zJ5BY6>p;ZMV14SNHf1&2<#iX@ymr8CEObD+qESl~=_LvXOrv^V%6PF`il61Fio}|S z%qGqUr&v`L=)WvFH`O56X6*d>;&4&D8|r}7x$}mc@p}@A_>OYUVC+yh?=Xq3B@VUg z*dFJPgk~>&cYHvEtxuJd&3*wvD#m*-jxF-Z7@l7nvF8B7V z_P2LuR}bsr+Qw~c)mYP1E9*9Ye*ZRb84v4?qqjkw-}i5$N;D{|7c>&%JD0_Ml;M4n zGv+$wY{t6?tuM|X0UEKm1GX|=&etJjQ{(p>bPH;l1jN=>_3Ub$5R;<6t2yPn7Lim{_Iu!#jLHh>aiS$(9*O9VNm-}&FM{;0MQvk;9%YP6rcB{{irPnjy#R2F;D=ydA07{ zt~#$%#qBD0Ic68xWkUDK!f>5Rcs;tBjjmUj8*svNtBiGt|^N_I@G zH!(%1-f!Z?wB}7ZM=A7NXa1`)HhrpeK1iY4+S3Z&!WV7tyQ=eds{F1>|4o|qT{v9g zmH2lw?U2rX%|uV&tz7Dlr-Ed{eEemruL`Qy2I`uib9>PHinX=Oy*6Mgs)A{G(z=h> zQdk-n^lH2>=3x_k6^qS&-{fC3VPAIG>mvZummOpKlf$;p9rE-(c5!C$b+&ey-7Pb| zWlFut|CT`YWjd^t{K9GY{h;^!xL)q#4|rAullynL5tPqNI$#bR;HUG^gE~ve!yHZVnx);DW>2VZtFIx-sYCFI z#;FS0*}tALw_8 zH>Lj=s6Pc{UZwsJguf4(eiux+ATe-OooJbi4W^ICh~FqI+Ck`OvDBIkEEwH*;65p7 zNgtk~s0MB)`eaj>=9w*njzG z227PKuS7g)Co+bPphO#{{GY<+hyC!Ye)3^I`=p<+`e8p&pO;@HW4}{JzfMHIVfTRF zlrDRTR}pAo7+tLMv-Gn1vxV+Cc;i0w({X1`q%#{o{ZDz2 zm>uhnc;b1GZTdlybK?&aWIM?jnyHp>$GtQ`n_iNvq|&IhZ2_g_g*7)QK?>)Z9vUlz z{PQ3+Nl$c+nMs^%wDYL`i|EXKAUeHRboSnfnI|zc!Zv?MSALyNKNsq2P1{vQU2QU7 zGN~(#{gNp?7TO3;Z`aO^`uL_`V1qi=ZcH5)Zfx2#W#55=8y<#x+`2hTif?@k zv%kySULV7-;_#qDJSag!9&~^Q?Q0C;fsYL0+0Oiar^ch94bD%qu-BXe7CLirevbML zMAb(pEW|kk5+UAZ?ur?>)poOJs~{}5n_6T0#ON3IsK%ZH8runt?c~NbE*3k++zCkW9~D~No}$0IsE6k^s3l2KN+=YevGy|Y%2LIW+fSWe)}o* zGu2ZPpHuB;D`*y~XRGuDs(PVHthK|zlt_1Z*kbt7iS_#MAa^7?TQjAm;imps!E8G# zIX?1I&G~BclyE9_c$V13)g_5tGSv>Ka;ox5C0lJvwKbdR4hcQt^-Dxa(lV;)#FX?@ zJEc06;Nf^XQXQYzDus{5CvtwWJ`V3y26xXA{YwRUTT-!S>D|o!?p<1jrDRoJLhKCw z;*zW{@s!*PbigeHAblF(fPUv}(F*98b(7W#Bg6r_J12Kj5y5j&%tfV|gW7>cF%#X! zulHa`56*NB$n0Vl%yZ7i)==9#_?o<3XVlLqGHh^@W#~-yq|IVJGo$ClqWT5(&CxLI zougsciOv}hJ!uk_!*?y-}CP80g=c{kAp!pQS_Dz+`r z-c+`gX1+DpKvW)%`+=HOU^v4XBq4ghOx~tPUY9Vc2(TYF?9SzA+EVE3be}Jpf%U$L z(b-HpHS3ys-UZe-##z?yET?s1?(*|TRijZ|>59=EOB%{ktTPQc%X+&i-NmkAce;zx zL;3dZ87)!kxw<9S8e*Zmp`5!_?}fT@fi7OCi=UHWccD(#W$*ZtQK4fsxH?l5B)_o3ro)}Fp$(>|x&h?M%8C#c4U$ZQv=zy!u=M~}8kD>CMz<4;_ z=lfpF>c^}sJ2Kabj0Oxl%<35k=ubkFd?egNAzo$f?}3J%xKrQwQ76LJM|UjQAqwOZ zdQxK>I~C}<`m;woyUe!!?gc#iW12UgXTMrITXgRmssiTz4Hdm2%F7!K@qe zy|Ce6xWD0j*_SF}dKOUoA(qbWpGM)v z&k+@mX|j2bO+5G(6|f1MWgDEoh2_}ws7KfNYa>n@n*xsn}o_CfV zK{PBaIzDEL2hQBfHEiKM(c?L@oBjQ9Rs~V9HZ!h1H*3sIwRuWBLzkW4Jc*&4z|$FI zi>7DPV|Y}3qW0>gjfpA+j^rno6C2|m;ZmgtlVqL9w4PS~xlZ;0b&+Xm#Xb^2FwD=? zoMneQ=kqgzNP<4#+(ZWmu`?64>ni|ca63CSk-qwe$&KyT@i8rN*31O>;HJhU1Ga{3 zkyM14L@4@(gA$2J-T?j;Hy`B+>{~h9JMI~>7E2R(-3QSHsrn{5e0bA1SZ=OVGY?K| zaE~6hAvi9v(HuK&L()rpBD+OZ2qd&UrL=VBO1$LyzLm+AO9o_pq9WD-5OVu7KiLpeBx*tI=q>qX=wBk(Z zf6`ay`rg?=>C>r`&5l4n>L(uY3BO(G`%hsBr}8Ux5VaN)5E)XyJ_y048^3A_BTZd} zj_61DUL^~noz5zwk(t+ZVIj%>xn=>hi9WF#I&+QJcP*}g&$)Hi`-Pe!zPRx8N_UD^ zL(T~AMAdvvx%UTVZCx0dEmvWpILcB30tUq3caLrk> z7ZrQbGIT8iL&j2Xef91pJkr=xiO&_)eEv@@%LVMp`P6xC>Or+^1MaDY7yZyQUi9AS zW;$t!gtysFU+tfg`%I7aPtJY1SNkXBJ~d|2qWqYh%HN@)ohsO&GCQd~DlRyY<-Igq zJq9inEk-}rw;lZ5fg0JNx@cg@sF@Y}z2n8Ph9ltKQZd1Pk-R0UtgbdbId^9OV0zZJG1T%6gPd+Sr19miDPlo596lq zth?zw5L8XvdmJBFWoBq(nzR0-c=F9(M{5PnqO{ph!?RFtUtx}y6bhE%5~a`MT3mIUk`;g>OjYs?g)MNT^DB=a70omdsw#kHVH^ev^A%bgDPZ&sF2Y zF^%nwqdVUJaFTpO9>(pAHopdmi%Sa)E>a8KCGCrMx*PPda3p!Z)D@J-ferT9f2a+; z$LbBq#w*7*h(BBQEu>Q4PZe(urJQyBcy#w9ln9~)I?G9nDNyY^X~k=Hs}TsK;A8A> z!|4~e)uuF{l;Ef!7qm=fQmvrMEPo`q7kx6Hz+Xz)lECy)iYa*rdq{O!q;b5Y9@P39 zBq6DPXzu~q7GLNiij~XztnxB#H!J%b{`87BjrnO({f7oe*rSr`^^wU9u+2!c@+CZC zT-hYQrO;QB0G22v8~Qjw*-{=hNw`=(nJ0udIQb1_A5qCi)xyKO*6UAFf6%18i8?`C#^GwNUaltUi+x$?9p_1lX9eg?UlJ)KP%$-cyDhnpY^x`^S14>^~K0w1#oxIfF=QUp*x3+O}+3&Hd7u zKh~_>m{yKMGABzE=vS%ejh`D_2a8x|cZax&Pgv=ESEY%oSzOGXxOXeDubB^0`e;Uc z?B@BKB*}8)Vd6Nf;dIVB>6G(vkRmdjFE+6Vkm)?dNk1aqA>onj3SR+_60S<@fsJ2l z$0w|VHXatWDrjaKvQ3gd&oWCj4~Zf1LT18*(+!eFG=>2TXxa92PJP>h#3dy=Ik_(0 zZWUXTSqvG|K`>V6#Xeuupj3GdOS=}Q8Ie@3$EaQwZwcmhnO77h;VO5JdLvAt5!CqN zNXY@Zw8w!3nn`Mc%C?Tbz<3-o)Gzcs(Z3(N%xay;KLaF)}(Yai4Cz2tO3xOa&exMXu-u^1I|w2IKd1{62T2 z*~wQi1M-bWOYvyn)x5)9(NmlmaJ?`PE&Vx zqD#4;a=QHPT$k>)U7g(-fV*ivC%X!KtGmq^D!Nfk>;|#HOOEM!|FhSnZc^cmsyW`1 z?^=P|9j3gD|F})uYSqOCS|5GA_0sAJn=rxU79_vD2tL?Ehy9_=JZ-yl^1BS5)c37^ z(I&qS)`-RDyEgG{t6#9@TtE7%ns}i#XIhdL%~e)EVC^He>$1^3*IRwJ^&Sx(weT+0 zeD&!5B+6`-6449^McqS_nvkzExqA9FCb5JNPDQeeSI@xdDItxYBV$?&H4iLO6%Cr= z2(aN`t|mKif)6o!u7)>cs2BMbL14;>~|*)EBz{=odQ(q?}eb z7Bc9Mg9zKOF9z5UHM{%9_72%ic5}FCx6Q{MTij4|7Ua|Ft8h=MqurO3eMnoNUYds_ zMw@|JEJQ=d8FhoJzwQRf@^Ey6tFCwZZgP9S=!S_f+|4J3&xpodtGn>{cz;sGZ_6?( z3h7SG;M|p0d%a1AumeMddyip%F#o(LZriGR2u*b@elDsEpaTyda*9f>(Z}Im@g)dq zyeaIdm@`?-7jtXVW0AU3U7>eKt3IKod}KSf@po%u+b`P==d>Ber%;PRoA*ZIhW@kS z=jWsLwL6dE{G`Goh3!*g%~05%pH5^u*K5c$iJN*K>N5zE9DdTOzYuk2+RF9?-M0O^ zYT$VR#Y*d4-T<2(WDeA02yuQs#^5!ZnQp7VNSzrFc}Y@c9xwonhPymP6IB!Us8oA$ zK4xXRb6WoR^oE2NInSwlCOw&?k^ac3rqD82&c(PLS<4e|p3nOvr&^evnAS5roThlK zrP^`f2P*Lr$ieh~!oKWU@_kWOf3C*W`IH1+6X%ET&ZKX$_}2<%0*T*rVFF1+7vhQy zr68r~4JX7uREghHybn6nPJXU5Ju?lOg*SBP#R_j;X`9NNi$#Ru5{z@Jep)z8q%Cey z+y{eYPhk3UWoN6IKtlX9$AK$@uQEc`P#x!-fsI~i82p>ZqR5PKs+GxYlg2q$x|Mfy z+izLJ`bF(&qk?9AF5Nu}&`rtQnd(%_+*dRArBFj>O%Eq^!0M}6qN{E@+tUC6ly^_; z+PqtMk!wkWeqP%b$r;V#hbd7v)xM&`zi4m{7?h|v)bq3C=fM((jUMl@mbeQJ5)f?V zjC-X}QK%kgq~02-Nh z;xMH8g9$U^>$B!iCKGCK7a2FhFi*1r7u*x$rrUfiN`yFn!un?J>9d{cL&mwq?}F?+ zgda~rYQnkJh0@nd*28^Fhj4DxaHylXwh)RQ)~oA|^@BB5#ElRkfHlLj-tE4P3F4ky zpX`Tr@KfVO)hRjEbUbqGqM^@BCxnwe(@&i3mpN;vwGxSoiJYekUyYqmXj( z7)k_bu{j#=`(}Z{*W#e{F5KZf^wP?k@MXse_cc*{>msWY*Q~~h!vbiZ;0wo zQHN(oJWIi;E^uCs0HRPgDI??qX_^%70%qeo>PzNrx#2B3`5xk?`X|e_zj z+t=A1bfq6G310WZANi#MHiFlTHVP@`^S*t?_r^73+}#Zsw+Jx(S3y>o4UR04$u zCMIY_t7jOarq^OU6-l*^q#2X}t;U@Xtwct33dc;|*?WmID4v5f1UrqTcO+hVohDS) zTzta1>{@zl^I^OXIPEL3*uSjyb?#LK&@xmfz~ANy)Z-f181ZdneNXrhWDPpKz6MPb z)=XK23WUQ>CCw7me&4uj*4^iF(Roh$=ZtfM&S%F(HG#a(5;gX6PiH>CLYN0QNZSH0HiSZ{ zNyJ?Y zo+%4rOYC-UT1Hw>o)@=!V!BCgwZActZBr!&dW%#tl~ryP-IA$&HTsRE;@ zgDG0#$Y+z{w`5LkQ$HDP^t{|z$!YJ*CG)n~R8_Os%d@K#hx{KYHS-HM`Ic+1GUi&N zt}%AljxFec?Km=pX#%oK^I63#&9*fvJ9v68?hDeHv3f;a7-B3lA;uUy9s@#GooAlB z9IIcQIJPlHWu4&}XS@7lJ5_l7l+*4;ep)%(eD_Y*zsp5;5{xClY2#e%8>fA;a}#w7 zN=V3fy^oDvwfT4kv)UZ+&LH}xg1DQ42zUAUd?Aw}IYYF05*0u=N7~0nQ1r;(fR{A! ztZTmuk>Es47^bZ;8Wuo1aWqfTQXdRM`ZNM_Yiwg6+(q+#Qv?D(AddN+?k{6V3E-2` z4zbmqaCeM?PyTZhmU7nUA(I-1BpchOY~#by#&&IEd)Me0@sSz4jMu15Q;9WF=ogP; z%dRsHo*B$=XHJ@7XLhq~XFImBjsHH?o@P%CPHQ?fahg7L`DuqPq-@bH{p0MgKQ7qZ zv5+!93xZA2<|<0M{_uroY)Wl*H;s#b2|n(0%c+~DY<^R1S~U9GO)ZDch-OAJf+=>h z-4txjZ7OoY^wAUYE$ydHKCLpNw2*gxW_ZEk_{XMWnO1Y4OR`4tG$Z^|QVvFsm);R5 ztwh_{?q}AhgD9+{+wx&^t{UCz4(ds_y1{L(dn*}7{dc%lwm2OX**)&wO;T?k~*-O6-7AQ(V zP{ViN?jS7rKiuyT+%JY%qAS(ub_g;VEd7U`$UP{1il(d!q#SP47tQRPHdckRry;u~ zWU52#P-QC%_25ygqm6ULVD#eFXnGXIZGO6{)qkt#hbnqW1#9BoB_5^{rxs6kKMk<9 zahmuG~c||5qZHOlh>4|V#BF!o)ol`TBOzWYVR1xT$`cnm?ls zq9|~H0@0yepBh9>ZYte;Y9%Q5uyVYqT7}UJUuWB)ol!^BN!1Sm z)B;?-L8bdU{N&4w`s z6~9l7-;=zToFndao!LNEf21=1t-K(|!bNoMn9tAd*ZMQYeV5of#I?`T}{F zdIhOSq(pe}aRYQw4SWl#WSx}Ex>vE_fVWcTvsR)vj$bi?CNMwXUB&O6&JnO19>WNV zRVq#JBuQ;)MsSF=7lo47BbvY_psT2TU4#?|WnY@7MH7%qZ*1hNZ`F-_^-YcKb@2|p z4LE9JPp@p7oFjfNAjF0HO^2DC2R_q^AJ<1oR ze&jW*132_(MjU%N%o1~=amA16gN!_=gN5^;e8(GWz3&Txxzpl{VCS*2OcF zoe+Fm`MXQ2_7f<32H(`rMS3r!H2qkdiy2&yiuz@}Fo*|!B3R`g9Uhe68Klu0T&cy8 zz&Rqnvaq+evbcAEYde28QS49GK~iGe&@;Fh)`k{3nmwW`c=!;Y2V>EFLj7$N zDcAZn(Rf}^quYY~-QgUu@x;zg>Jwo`uafs(Ei{uW^iS1{)z3-=iF3m1`!g_u#NU+u zvkLyA!hzIaI8Yc|=(oF*Wa$^#a{G1XKx7WFJ1IvJb13 zkE>cf05SR%HRSc)t0sTm4S%R=|3zV>q)q%tM9s<{sKwt0%bxgw=2?T6b#el4K*qufcd{2IYM`WWJP~VHnOL0aAW1n$_N4cTc!DGPofid`K)-HB3%E}DbEn!% zwn>uQXP>EdJ4F=T>7;e|sn#PLxTP^D78_N!DHDlwW)qa& zEW>Ulk;qHoN2!J3R2`@K$vkc+u!@=~Lo6i0%C8U5;SPSBP(zM04tGui=wG24xAscK zM8l?7#;jn_R~QblQE4f19}ASRu_)=}z16u)H!zh zL8-gzB^zPQ{gFa6+hU?t>`7CjY`Wvfg5JfGPIqonE1e249&WURw2?OIyw~L>2b^0} z`BV0!S;wZ6Rp5RTPjWw1If+7?t>u@S?SC{=B=0Phey)iYH!C)a$YMgJ zL+P#P7aF{`-R7p4$+?U{^t(s-hbdjqjf}qbbAbfxqb!GF2Sj!ZkhT7c3dy}*8 zOUmh#s*KQ~iIoo!swvYvD&rp%$U0ryPd|$Qo;<1qpQ8j~LgQ=!Yj`@B+or~_>2UVV za|U5O8dME*4|Z#;^4a+p-SBycQPgv;e%4Jq=c-HG?#tY6lvf%ZPF1X#rd&e?K+-w| zheT`~^zfTwaQ>gJTk586=#u+~YzlFX$G?H8-Yu4Y{a*g`p?m52*L&$3?4!|~Rr!b9 z@GEjJ_q+NYH$i&%nQq_NZr?rsaxWNtGSqo~xtE+QKs^{#V+b6FoKw_N_g>eBfW~o%;*rWGi=}nOTQ^L>tHLfgXxHE&aDeR~p;$dm#E&->LlkwC4F3*{3wkI!mpNZdQp~ z0E2{kEW1Ue4g>>J>*iNrbvA{+s71Ju&-R<23iWqFbzRsrfPe{>!-9gcHa1$HI9v~g z^Oqf+8XPD$C92u7#L;EEJ?1iTPpP{;_A+N`d_0ff6_Bb+pk(xa;pRC?FEV-PeNYZz zXFf~e%U1ly21qUA12-bVaosWT>|RYO*4%M=0Wm?EL!|H?++qQQHZQ;o5ok?nx9 zx^;E=!0Kvy;D*(yMtc?ZSh_5=+C9*&)(7t6oYXpt+7sHJSzTT5uOg%yL#_UE4K)?usg;U!q?Nl76x@}p%8)x zF}4sNo^Bb%7J`ImU<)TqMRp^pk20tmzK!w5qu+t)xC7IVci0VdHJ z^Y`+Jz(45c&uM+C{;^_oOal6HhK@KXZ@#SDvjamEy_?bMqL_{X4T;`j3K%L53(zoy z9P0ZJ&~QCK!zV|9hL9Y-4>YuyYe#{Gs{tC)`ll?31s0SQ0x3LYQ4A@BEo&4~*o-(p zOQc{qkiuBBtz?9?I{FlOD9O~1wLe+wGIjm0=uR^PC&XB4AAxGPP$`thJEpM3Exe~= zhnl7tKu=?WVxkX9*scI?j7|f<%2IqChUD}Z+n=S#V~_aFV^(BI9~92L`jxZexm`-o z<{GE;IwsdR1$X@bswh{NY;HLPKfS6X%ZmFwCHa|nolW9C)NXyJTi;16UUqWZab`s0 zMy0SS=n=_>7?I6P$6?e7;tA_0y@GIES+5|^^^}oI)Cl+emP#$$$x{q$;awf{ruwfa-cfuAUGd)>f%rn;Mi z8>?oF`zl)0UEcOh_L@yM+UK4k*tN$3$Jv!xa3i(^_C%}uuJRUG8en1)d6;x2rkooH zl;1BOvxM}sv2fq~Gqp)Xv6@xic&E2JgRg2bM=&g*nPnjk5>W_8o()?F84^#$mBr&J zDsIQH!3vN#-Q(2^-UV1EwM1&4WLMvPsy4arF8OO&GU&_Jrtv6M zc6~X2n7#8z#+C?PO@F*DO;0vcfFQZYcr)}tI+IwKnxa3W7fRk3ELkkTK8_cCCzE&= z1Voao9XFwu6EW_hFq}UbuudZ3EfN|_GWDj#4gZ3ANj)#C;2UVt@?pRkoX(>Leb=g* zml`5MR!w&F-J)s(eb=knu=55z(jAy9tc58uaji;u*YXepms@)UkBi6UavqhZP6utb zkPXSBM&;{OFQx8f9(iy?pkw?=-tLgMMgqk~Y-=3rKxFr%lF6LZM7=vG1NsPNGiVp@ zQuZA5+37r0V6K&9?;(ajRdsl`NNM`(l|NjU2gAsN7H9AP0D*)GHRRRCOIGVMcsiIg ztoe4+=~m-s->x3D4Tr|m9k8qoew}QQrt%b%%q71e_@p7{ zGM!I{#0^sf;L=iw826v`@|jcu79_8w$>!|ewEbW1SVPN;dZ*KW)5$+;^LHKouhv*Q z?`eIOTRzj(=eW`5C3F{k0YbN)?HHHQ^)Bv@JKWsc+785E(74V5*Wfx?c-8P%R3*Y= z{1kgy2`5ywp|lqJ=moT7_TV|dt03>>T;kMV?j&eSUVOUNwb#3#Y{$l)Q&0aL8b@I% zI8Yy`&!!HwnOY|*2;Fl%$9chSIY+^DMF1zcU5Eepyt0?Vl=a0vU>{!>593(6T*8r1 zeex0_cG*VMqsv33m2!5TGDKD&nAs zr%MUKCQSQmey-i0{Isi;IXJ&i;uhp5@oe&}*D?f?$;6ym>dm? zCB~6pv~{sdLkuFvz|n(l12CKS*BFeD$n%Qth40CE=ACxtX1F^yhN@VSzNHUvwLvgO z>)UeJm+CBxP0V)}dk5JyT=`&kT~0SwVBEn#phba@ax!<6{JdITpF!6r5Dhf^`3ebr zgC&E?@=X~&p4}j#e>8BMbNpLA3mtam36tIqajUYIb=#YJ>Zn!EYn<;7%?lN}si%_g4T?}2|Y(Ht1n?P|%>Jj=+*7s0qbBUT%Lq{0z z3?AwH05%T#iN5zxV`8OYd|hvUT=3ks^N$wnM%5hUZ^*lY(i} zK68;eGHy85p3xNK`LD}jgrD$j`eN{~bTL1zzePF0pnVItKD`nI z=i2BzOmy#E)B6WgxxjW^Y?~kenav(G_bnCtRH1R-c;Vt>XxaeZ*SDN z+f(m>Am~928UX~e2sD#d_nc)R97=kBRrXfK%$MDtG!L^Vp(gc{rVvs&rvg6r5WIc? ztRjFr<(_+R_{!QLYsGA5yPqa64(f_exEuAc(FxenN98tCj!;~fyYZt@-69^=&1$kZ z4&7L8N_mPpIoSO36oZk)Y2vz$wN2~V*G_Z33OtnBT2_D4bi8Pq-ZkxiGE{0QH58uF zN;u0HwH-7))!1YuwXx+qkzGyTy;=QHcitiL_O`_Fx0v%y<3pvf9oN`CMj4>l&fwgA zRle)U$KAeU%|Lz?_3d6O^d)N3`bxDl`cKq%jjBBxI6ojU4WW$ooOso!f2gk4yb7bw z1ux?U1JzdKYYJJK^(rIL-2RlElR%D3@Bp(H)=pKLf zd#ULV-RCFn_w%~%X}|Q0pMKiUKI2DE``4&%`Eoi8QJNIFgxzDTPT<3V*$$>Gse&B> zt~!f5nvGJjN01%wK{?z+0#?ge%71?+wTqJ!VRAv(5fd=W@`Ox-D9LnWJt7&D?#-ph z_%Rgq^+fyL1)Lyx+DyjC6Lna$wl^g4_Y%?Cwgz=AdL^r=J_H4Nu0BeirS*J$pHlPn zH^i@#?DYx^5p=f}{UX}wg@L}q|IJkU>#4zSrlLmACGDikeH`jk3bh5?^zKNbgq=p! zgER_U6kMZxnq1`M__ZVS;{3uqNaJSJM*3>bPVy5ftQ!fV9>Y2ZB&h9o(ErGCt4J+jc%-j&%g?G1H^}#JfxiH6WMi#> z(zcVU#OuZ0gf{n?KC4Ttr>Yg|-wbC(P)Xw8>J{&?V>W3O6 zgsXl<{q9J}ifOLr;`1HgwyQp0f&Xwny<4|YJIS*A(u25{;0f$QaT+%SC#_}BXJ7`?vZbfp% zM^A~@p|SBgWZJ0ZBa!>r&fQS*!wBn9py}bVcX!cznFIz#M}mc@VtT}qub90hE8kN} zz+pl$7=tO_bl(%nx=o)fTRLEbW&CIi&`P{0r4vMier5Z0a9+_pw}|$2k;$BAGUu9I z&glbY`*x>yk#R3I_7W4G(HH%;Q~#ke{rk?$Ri^7|6JBMatBre=`5b9!!6S^nO-S4ZiOwdoUhhZ2vV+`5l^ja|TmJ){e*}pb z5@E=gUBEtgu}2oC0Fy8c3brdYYTe*-cx(Y`?SW^TMJsi15+DQeZJYk@5ce)27G1th zw>sveiT;GK6Z)*-GPfB2W|O+js9Vjf zH;n(f8N9<#^+I=k-=tqOsqY*8vWZ?Y6Z|DN8TUpL-DYy%%7j17ds_xlS2cN0XFBdN zt@oPn9+SV;V@(^z|;Nj@jxcfNOXvxm1;w zKNA}t`ZOFblt+Va-FF8WT76Da+w>v&`^U_T!)91h#`?!}5$t*zwkR&)S zffr5A*oTE4-w!em(;tVGg$7L|>AI^0D~ea|b=P?g53Adq>~aTnAyFbPQ5PbxRXMjC zJt+eyfov-l^awf*UGs;UY!AayRvFg`$|FBInkUhX;n^amGY zupfR zO=&-P&b6~&b4L<7G`@A)edeDZ-8DdU~sQ#QJ{?2C1 zip-V-@i#SZpW*d}^!p;dDc4QW^%z4q^cQ=d)SL9F>R1Zz9?S|4$m2bw_egTRLHwQD z6-oFr2+}IR#-GI?_<}+koee}sK>&~?{o9SaCFt8lN;?6E2oCoX;l7Cyk~tuBS;@wo z;--@W`HtLNWW!FWrJ@>94ecfvc9YmF99-87$lC8pKSZ znOI)DFnl&>EDRah&T`BQF=j#HQ9`uLN{~-{$2!kpnPqPDy_oz~!>gU1vZuQSq zBu!uBAAG4FUg95l87al#MgE%0eD{lf;w+z}AB~*~0ZEGhp=P0ZMtJ6>J3x>X^&e#E z+#QeRLHx0T*ZB&SiyY;X%@G6zH;~gmLm%cosny|@^Q75#;1QUCkJM^K=AF0P;yTr3 z7S6n%30vbwbwd_Vyz4BSA=DUd+A>S`jndgQNbp2PoCGx5cKw}EHjbtz1y)ZPxg z$T9ne!&q4ocH%Osn`<^F9#*wn-d-fIvlqB=79`+v`@gHqTe6tYVl1*YPes%- zOFkH%x9}}r{no!hz2n=r{q?`|ebnd7Z~f#uzIxkV`UgK}5`A9tqIzF^Rr=y_S!2(W zw~x~yCo);2Q`Yku0E)%Rv=kHx3H$ncuHHya{8@tT;sRA5cxRz+?~h~7Lare`44m1_ z0;$*K0}1p|)S;)2^5iet>^_-!R3=LmRB>)0Dh?J@WeDxtS03fba4+I|OP8XiUSpb7 zRhEXq=BV1t;@sY>TBRc|rBm8$`}(%w&SZz`T-tF&41asW+xK;kPJGAvjc$C%HMUKS z?Y7Y`u2qda-x~e!|1fqQU~&{!yY5PzXQn6Y?rhR#?P`@JlrvF)Kr)CZf`~SlXp`*U zh6O|p62StAAdxW!BrsrdG||Rn97rlAfPlxKNQzv}q zJFg6G%y`djbM%9e^K#HBi+BpUeh`AQ4z``hI~z+mQ;*4}B^*8;LtO4Hhiz@PH1qQF z%>q!sJUH0Lwy{V;NGS=78T{HKV~n^Ezk}VbQXsoNnnS=#?xAPGyJ{u}b4Gw&LlGo! zS168f{Z7)0$Pz7-6<#Vj;hts>vuE)A5zIM(Wr4RixpQeGJKrzT_e)gI1N0?=m`O$c z*tMUh3x6c2_*wBba?9Ktf=v9X6^BP3@Ac_0RVWtspcW7kn(q8IOci>2nlvQT&kOLJ zTiJUq%W*6W7H>fQRn|1_tK8bg*0uF+we^VFx?w5NL%mKQ=ty=$;FW`wZrJ^uA(aQC z2f67tLo656qqyR4E;2Ts4|{PwGJ1Jnl4NzY2`_J3(}>0`nlH_(3-azQk#{qOY~kss z{Ae@`w+Xeba6si2!MP{BX=X!Moi{Qi`b^mj!MJL(92s?<8C914Xw%QdH_2?;Ae%R{#0asHdq!V$H(fD` zm;PTvKD;t$cir{f;s5q!a1+rj_sI~g+GJYwAHylqZA64wbtK==H6|O9UF3=Y_pXO7ocqm=$p3W)9&Drg;~gw$3e^m9F1pJJ5GV zBj8AE-~Zef6agO6A(?a=tY`#Ey4rhNtg`g;YrQuMwT%mPZQ~}lwsFni#)V03&keyE zZ?2>FtG#)bH-C=^3kXm@__sAl;;;^vVLtG%)NmaJ5hhBN17!NQbteKMPobMR+$Mfd z#!M{2vsGkYJHIC{nq%sMl{z)^iosJhZ>N(5b&|^vpkdxyVk43F0?p^xj$ka4ZC2B6 z1OqW4?pEa*e$bG9UkQ%KEgc-ljy+kv&jGXOwDq;~zv9-e_`2qs-t;!}T*POa)O*3k znf9jbWhE!BviCt1HnYP5P;pE0CBvU3=4qw`_qgFA2S+l&!{ zTS~2ImN!xbSpT|NUdulF`(}ANd*mI>-rcO#J>_c#~UP zHC3!3suozs;6IPCr;Og;{CpM>h;@R(D3a;Nlkrk`qk zgM1_Q3-T*`&$;(ve|?NBJw7M@70x~`N{)?!j*aveq4+%9^{X)WGK^1*#0gRV zg^^eEOa28>zD@DcTls#3ZkYb;_}n6cq;b)5LX|M zXFePI&&2Mtaq>(YJ{xz?`+AFJ55=)cR?lrLEp3#`8;dGg+SsN`SNQRj1XByGD+)uT zISG$9D93@oeC{V-K*#UDU-jP${PltVXw~~|)qkMs_ZI$9Exlcp>#Iej{$7n&#VxDj zWK~?ZI##QIlwBI=Q$(tNWgM@Fi|MCY+06d@ zrLnmrUdXoa|D12QE6(2?`*+2;n_{!1>OI~V&kX<4nEPX+e7TWU|8rw}L)3j^l-v;I zZj96o(d9Tp)kiR3E{A}bu z6HUH5k~c^5ejoA6;C4_e)%$I~xUW$@)L8dm7}pb> z_vHz*F9x4BzCAX##nJt-xG&yrd2H%8@}eNVB=#?D_CL(~A7G&B5A*V~eD#WE|57Rw z`0wY{r?3(R*TvJ)zkeOOH^u(17db5$Izjm4UH-txHBn=1pa49cUO^Jk@d)A96W zqd(BZs5!Pteg>YOc;E?5=4AHBQ<}`__M0=B%re&QSxpp_I=^YkMMH!0qcP=OXu#6a zX#VL@^|WZj*^xOVTC^nckB{6XQF43~o=MwmcurJa9*JK>J6ss$FNmUxBXLo*`Gt{T z`_f2U63t`#xaO%}CsV%;=VrPCj=OrfiN}Bc4|K-jC&1Qq1A&3gEzs zJWudIXIky>1;fGnv#}A0MOHEVi}efJ9WPo$f_1)}WJy3qVMguFAJ0oR&a#FTnGI;j zY+PYW-)+ure8v^IJ&U!%j3xf|imBg8+19$^-TTVkC@ zN8tDt$3j{nZjLC6trUPaQ&O~&WAV!#t{%Hxg3+lAokx)p zyTz8ExqXOg9n#*~Cfn;Mp4Qfpbk=pK&TG(XyG-|@u5f7FBZltVGrcd@EBlJQ`Tp)< zNk67p|1ksyJJSH693GCS3?~O;xEwWmWHKrkSskNCi!r;74)6tvas6W(#x;&j#*H8Q zvxzR%-TEh&$&>RZRVUA!lx))aFN;pGH3sKb`jzQ<*BJ z7Uu$O1BmrEJOm_txQ^a7w6#YFk*79hJ^F#wmaQhF+0L{ht1*?>XY~iWohcgG_U6u$ zc`RzMS8}M|W3)IC?zP~GQH1GJee~Pv*_jEdug`I*WqEZ*-aVDbr}fII(|ozi*GqkK zHuZz`Ilf$O>jVS5?0Kx+<46s^c5wiH#g^Qloz=Yjs+q zT-K=0Xso*`$lo4-K!5?RJRYaWzrZ7aThs4IyS;uUe{756(n4~-E$VEIM9}@V31G^> z-AEE}$U0zAn2iO@MhF-gcCbVMEX%g*7=EDT9)&x8j+$v;uK00E4B11|8lIMPNDn4Bob5}>DyL+ZS1AC|tMozl}`$S($ObN z=aB;bP7bZO9?1)2i2>;-7hUTVv>r>OTAwYne1P6kx`6A6@l3^h{+=ZhUUvd(>yKS6 z{tE8QMnLtVaXNM0N8_^6*!KzN)k5i{d~j-BpOT-xPHP$3@Sf1Cv7`)Z<^Wr!E>#eTLixugu z?tCG)iW}ax*5Ivf$L+cpv+1o;O^&Ziq&cqt|GL$kJ>28g1FF7mSd%4iuL|#h1Wf-@ ztPx#Ak;IAMmMzkO>QY>ce*sISq0RKe!GR4N%2sQgNq&@foY#8w&AF1@Y@b`TBx?U7_bM z1^>^5Id>ys@Ig_+E*e$;R3Uu2U|x#I;C(&{pNN1Pc|8mi?+;PA7my^6Y-PX(+^~=T zU<&BJ(fD_Wi0kmfLi|ZVd|XK0DVVnlKYXj;PxXUjY2u%p$a5?e@TqZfd~D8zilQ;W zK;oNaNf9&2gbjD(>+a0UoAc2_9Oz$`_g5zL05`lO+4>slm)Jd5=FL|kx-1DV$BP1Y zDpDwI82l%rh#NPscqhPb>|ZJs)vOH_k56Z0SF}%*0qH{1;C-TG5cGr>+2dsKQfZo_ zW7F-r6LD2VU((@$MI9&2C=#?ErT8qqw^tMK*Ccs4F)t+zFDLd*vNi4HM7@+0(@*t! zGJ;8btPI{r;OVm>{VQpCKgsJ}E)ZdfbyGg@`iT`?1S2F)h7JiVZe<#5wiODtO zICH!*5i61j+}KOWoRl*v< zhUJn2hIET0XX7lT)+O%wQZlKNRW*-@$pL0-xw*SgPK}m`_%2cAvX)`)4phAd+m;`B zt9Yl;e>6{#+QwCp_ud}n#Ab7Rv$5jx16wT68d7v5!AA#+N@Fbl*0|LKnwd}5g73~T zQ=ku~lo^))Gz7C34B*eE09L~M(Ze!_(-VqfF<b)r6@gEiE()=$IrUSv^q2Up_;fy=$F$rnYO@Z%bSmWjQc zXFvjj15%;8UYw`ivytrq*=(~nh(V{Gv2w8lqUv_(yj*J1^>JMUdLtqP@~-^GljQwV zmcI1OSANC%)sUeei4i4C>?ak=1I6&`WX?bla-}HeyC)U>fui|3iB2wpC@D1C5Ve)c z_u3BdgAA)MjTCarqY_$Pd<)369GW=RGhdM>N{sOh@$iJq zOmy_c%K4%M4ibPz5uY%3EcL2l;lg5gL2>4V#hg#(=c=N)uxKtQhO4O^psy-!b#+l) zRSd2vy6}glw{@fKaF&~`O0NWVH=cZ8%z!zzJW2zi^)qIRpAgdxiOE@x2OE4#wn?^KT9 z$7DQU*W=Bn=9neEdRRfj|Bx!2ra^DmLHS1y9fCo1CoES6x<(RyY5I2g1scoA-ay%` zjkj1DntLft?@;!B2*bn(DzWB;Q=JWkQwnO zp`Sr33-qOQwLgjVO&5zN3_#B?{iI?7+xBz4=dDp_lJmHn4KZX7WuHW;qX`XBFU>Sk zEku*t1@cmm!bUT6(+sQ05_iEyJ6*UFK(Q7q}9) z$~}6C<6I>yIar|Y=T5KU9>05AVR~D;(jwVKxb)o?iLAK1%W?|bu22d`YPn@cwF!AW zB;*CG+nm!uY!E58t*@2nd`U(xQ*KXE>AufJ2c|->8BN*AF##TaAAx(einGs%qzJma z0)aiCg0H0-P+pL0h#cossjalvzh``$DhFDoz2ee#1cYe21-RJ1y$ddEIa6Y1tHcAu5dST)fPK#7R{ZqNwnz(vo>{! zl3;5@yohMhrdc0lYwSdEuZZpun{pQ~OJ|!> z+{V1v$z15mZXYlok=K|)!4SxDj{tEYu?K@|sr0S5$Fr02!R}3=X|N9LE$KFS9lhlY zxf)6}J|0cczu*((<%p&59dy3~)be1L7H)C4E?EaMN_mB?1&shmC^Sy3I+U=WHTGGB8<%dWz#3=LaU8kry9lxtYZwE=i^C?ZUA+JUvKV3NRA?N1hEPj~ID#>?)g$wP|Wq_KxO!;O)*A`E8XgpO^PU^E^XBl?A|+H?M5W zuPwBvjd^clE?01zEh+oQUL-GGgI*kQ6pl%6asYkd818bJs4Nu|9hbhaRy6!j9poN} zB`w;cFlCE^TBWc@WtWLrgN$IF2VL8l!W?-`I9A30>vRp@H|Px^9~dJJ5L;M)B0(jz zf16Nzp+&S$OfR}jyegL3F1Xs(*J^Rx#qIev-QLiav&v%nu$w< zP2_S_YAH?znKRtoiL68{TiYrdfCtVqDKvn<2$&UfY7=glG)OGkW#aw8bnR#r;AUOw zEOhA3{tm->SC+Ul>RB&m;Jnot&!M%8oyP?~L)vs0S5>+^soR;uZ z6`g=n0=Pb{RS})QYY|ORWV3zj00Wq&Z5ua}XGelOPXc^&6WFzF-qtsC2In)|ov7B< zoBQiW+2^q79R2j>0@GE2St3&0lzo5!v0wIoD+YMV@r*~|DaU)yd=ITnNLfuUk4<`TjpA4Ee~}CG&NA9+MB(|a{kc|cF{Y4 z{~oHlNU9?D*^0n~haRhcAb#RFFN-S=CLProPiNQ{l`df!39HGR+SIWEkc{n#a#(Hs z=fS`+Jd)`b*%5M?C6-Kg46YCR?%%wg1)bH7Eh&b&Z+lPMaxtPh{1?g@knJutjiiai ztH3&wKf5i2$r4bH4(@(dxI^&;fLaK3(+u|Xd_@u+MQdqMzi5US5}~ZLo*C=& zWOXGISVMDeXf7=Gn4v$AEuFbpxt6diEQTFDJX$N36u+(`L&Yj+@456)-r?au>=`e2 zNZG0Ia&IE|zD>6Rn;0%10fYRx`DjG=*i}p{*OMbqHLq09qRkedz;3~q?l$}QLiPm9 zMO=+|sLb7R;UFIkos)K13+HleqhSpaUO%s$N6-ary{k677J(bP?KZ)ofkgKHI=Xt7 z6rbhmKF$a3hP<6HbKDCs>sJ8xdJ{tXfQzQX~e&qL6#m-D38PXLKNDe3u1$dU*48<*iz zZCBvL8k*btCYZNU0+$vudG!9}q6>(@3b%Nn>tEn@U+BgcxT7z0TP|=nz0mEv z%Mz-RXuHYqzi>A`LDXI2<$viFqUjfVR2Z(C zp1u9cYB2cs1hM!{S&NfAgZw5TBtHhVImge~KRrP@V*GKHnEJxHfj1 z*1mbbH%E(~r!VTT)>}RO8?WObPd(@rZ}Cih{Tjb|yC2-<7ozgHzB$LQo=P;;?H~!- z4p7p`QWoeFg+5H??rt5lrGM#m1d z!7#tJK4Wln?D&Kn;^-BUQNXmpLwC?Yj^VZRu)Repmhs|?aV%PH!gugS2I-f5fP2?Q zouqV-BZN-aGP!vpaQS86$u9MYa)D(*guTgX;<0SJC^8pE>dRoT@dqOFcF^%f5PlvU za~!1`2?V?DiYROBM1*{QTDZmX&?ZJ1K)}40b3%V*s8@vM@-S#HF-cjn{#TK?Hqxh& z-p*jc*|1!6oEnCwgom6Un$L}bbD~mIPD7A=XGZQ=^cDMFF0{#Us4)9LQSy#OPF^Dv zxl5zvqF`IA({$>6)CSDhCt&G*;$1mqrX`W!ojvzHS{f)LIP;_S)h zG}r}5J1wVOD)Z?q_)T_Ym$bi&^QFE5fiP&z5W+S9M6hhA=`j$a#v^1;b!f52?XGDL z58F#I*=$F}prTFr`<=LQiq#NE_>^)X28yBo0I7!B$R=yqX=L^xvv|q{QTpl5ALqPC z+yi28(x$B+o1T%5vXCeu(Gr&ey@PowXVeha-;?B(W|-@Wva0J@;>JD_5IFgmD{LA~ zMq(&t=hE$l^wXWy<>+&zb8^vUZn|O7ZK0Q9aJjKXmFN2VfKs)GQ6rF+u1wwdn|(TZ z#PtG}1@=84-kd>@gqh_@xk5Z)1>HLNv8-(@_i7tU-B<9}=${}iASU)1iU1c!02bY@ zvoU?Ao3YdCPdSwOQ2vwyY%<$+%sM_Z(AMlbswV!1qss3iuCix|IVkI4hx3DB{NN{I zvGZmTYMKx*$nlAPdO`_fa9TD#5criK%2VlDjv-acJW%wXE{YqHbU>6uvK+(u#-!ZU zct$e+#-tgM3mf~N^NoMW%V+Y@(|O?T5F7i}nqy?N{kiD>rKoSqeqMo9yXd!=o0Gnq zAYnAWNq%&R@Lw#7JF@TV((hL!+ufgZzE<>KFUAjKUo_b3cHEzY_az6OAfm^L!J|b) z|x1#T~z%aRUK8viWJ z70H2I|FNR@WnwZJZtrhJvfwN+?A9WT&0RIu)kDS1b+xy|d3CI1VO|aEna~r(4-{?^?$lDB8s2%;oqFmU=`2Uec*CR^OkE3%t(@E4PP6R3T z9prEvsH1XFK~xt_zKVo^AG)+n-CiVcOlt9)<0c{dap`sl7)P6+A8I88hJV>F!XAeCU zb%33>3R$w5YLt3sdM3jH45xJ!7zL+@M;$@}n>#z}(IDCxj6L=&68nK{VFnG2Rlu?H zmGwk0T-Ku(yl02YfO5Y^UXYzO!W%9|j2S-0x!-M~k8aF$V7=ySmZ7%yB-cCB6=%3( z&UNdt1&}aSLjRPmFabFBLb?WU-q~O=V8~!F+XF10nDq7b5t1;s)JKNrIGk(8xX0hFlLrDr#pz4#*z6Mlf$r zwQA~Hg~jo>yB~sb(jV*htnIStN9W{1$lDrpA)NkfK71fQ{lJeye2L0wqXoz z^=A}i+03#j=tY)2tV2&wE74`Q*8pds5DIxy zqg%~NpOSpOK|TK5bb~a+_q6lAZ|4mhB{Ht|mg-0pGEGC_u&Lrtg-Ws1T$HWhke2qi zZESnkrsx@Mpx)ct0jxILU}6`UfAvM4*P3om@qX<~BicSyLdVbUl7302-D4RnCrfSj zSPh(KmF*vIOXuF8X`a7%LH5k8{8H6ltH>SBUk!$m@GyAAUeSJ?imzAtIu)%|@;a5j z7Kc{#dz{uj{XNwHQ%Ax`J)K6ZN9IoE?>7aKJ2%ChdJsDq#c~Yv*orUqsr}7ClObqe z&*t35N-^bWHMM!l&!!$erP29q&_qC|icYi-26=E&5SCY$T zxupL2#D6ZCaEVZ-2LR_eg2XD(yc{|6e3E;nm|O3==LD*zx$@iPVrKe7H~rz54=@x0 zb#WlR{LXKueCLSC1HO3PAO3MMx-<~S`n6javRpJjpM=jPE5*rvJEUSc8(_mv2)V~% zz1s>^w^|XJ%OCGHUmE;a2A2ipXwUV&b)wPm3=-1cEGDakzJ9g^986`;e%Nvy>^O++ z`FNo~ZS?`-uOKR`a)s?0OtW)z4-%MI#j#TUPDq^Fhxt?F9>Eszm4Yv-1pW4s3+Tkn zT+9yl%kXu-U^8B=&>g}1pH3g7EEccCm@&R0huBW75W0{tOdwM693#X`LgX&Iabt3n z^C}DYFo%mN_qwXg;QVJyUM{smgt!|GX`rJ?#H7}FA& z?Xs~pj|8!4H1J5rnFU*09a&!twxQ~A&b%queO#Af49bJ;^vmR%x;FNn(W|W9GWBfH zu#=qRo-M}g)Hdl$-+8kz^}a&GdQU#@kzqOJ{&LG3CG{@B@P`C`aH*T~GtuoQ6HyIv zwzK56^BWWf>i%jEQ=59B$;H51X4Rlx)SMSJcZcMItYE6G^7UIG_hcFwO^)1DF-{Mc zlS~&|Ls^=0oMI}_x5?)3o_hmNz#qJCSC7#xf{J2UKK5FsYx@#5b8bo6o(atJLFKui z^rt{R7v!G}Lb)L|Tx!mRYilLO#_Kt9B&d6Kx8d(2d(UY@_pGE0sd>(qP8K$yQA|^QYBQY{H3v6Xw>%I>dn(qD1X?1y#|N}3C{ zHplZo2}lVd2Iodhl#NifP;UTG`&zwJtRa<| z9}e#M%ix~o|$YzPbVHlxEXG6g&j6&+k7Gi5bm*3qhrHD!sbJN+^sJ~CONx#d+_zKGJ$_*tw6TQ`!yMq3k z%6j*)Fho@S99bsrhB(e6-Rky$iJq+I!EurUrOC18fUaSEey@!nl(%Cr*ff$O5g3P2 zGU2!Yk+L`4r<bUT={K>N5NRfMgYGAmlwNJ|>%dP7dFS;K z(`$c`EdTz|-k9oWJ;oay3*ZmkF?3!yF^F^y9q!>&)F?|{emF@O1Qo38mD^Qf$k-e;15Wl_+SfrNG$$rfa zI&RQ1YOd`#L%bq)cE(*BJ3nhmCiKm%MX)KN&V5Agyextp%l9)L>1T139w`lrE9 zLJ{61(g3#&23z&1hXK&|u%Z(ELn=DW2CeNZ_G@cGU1>8`#_&r35lkB?-^z1B-bbgD zFecy~;AlA6%gP4bJ`32V8N0CdmF;sg7CTjQhxSPFAJ3kq%+w zb`V$bIa8P>JT5tdW85^vzUw#mZA3D9Np?+0%LgJ`!UjtG(Sa8c3D;z1`CXkHuJAn zwV6Mttz*0Xo-^)4?VPSV|0{%UO|$AZA@qF+p>IqGefq5L)k5f$diL^@Y7;)B6zL3) zJ04%!9D6UF`lnD&iz}HDvD)ApkS(f82z_Hh=+n&$nQ&Zi8~PzWu&&*|?~MDSqEt|O zVGBTsG5FfBI100?QIbb%o2lFZRT&&fpd;LduH^e!08`TZU@T{$|8m$FCvk3;ADP* zyKBE%w9!AN;+(Nznr<{2i}LujU>FdF|2C?AXlZ}7U;HB*RR?(}^|4u0{b==b4XliT zyNI%x={wztZoCg8uaGs{7d8USR}K2Nh~zJ9s6ALF@H0%Uh1$E*P&;|LS+m_M{*dCC zV0DR}09-TfF6C@piu+M9x=>7fIT}}?32{cqavEx{!-H;cKT$=3dnYzU$h~$eIOKC6 ztVZy=^cDUXrJm3`-S-YH4D9OpN{E6mZ@ye=xkMY3?hDocKSK*) z%*M^br#GueX$72t{!~@c-e7Tq#b_DKjT`E28*|_N%DSraTRbCH6JN0BeA`Q}%R1}a z^p8oq+q7KmQ1EQmXt6@q7b5}3NS)7jiVoNlJIOI_RDFd*&Cl}TY{C>_k-h%j_{k~f zW9gWBHk5uR(#5nvdk~bsfY>(qvxU6bd>3X1OS$Lw+$$&G6aFeiBN@D2n~-g`%24mB^JbZVD%@Ue(1XT$g(UQ zC4W*l+SmIY;~iF0Y3{74GYjQ>*_ClTOvQb11`T~Xu~u_;{S;f8qzAj2x-Y03`RKSPr-3zEIbnKFAKnbyELGb{!r9e7b7V$A5dB(f@g!%%QwY zoHiIV&n@Mp6YU>ugXj12G7GeyK`p9Jo#*559l$q_o&aiE4)Ni5t3pu%Z)@7*!nG9T zw#lEdO-|pLCUJvJlcNV|{a@uM{v1F z)6Yg+^w%&F^xtIu9qSAc=51;IA@$#-_YcdUH zYsikH>0JoBN5z|#JGYsxthoLN?&IvNWyTyYM%$6woPG{ZKiyf_Hj9%oW5h2U?JRRk z&*mM~!sH&dtW* zSvk>T?ebd00sVSAb*s=nS2y8I{M1`M$NaV5yR*&ws?PjA|FOQM z&YU&M@b?|{=JfK`)b4{hN3`o<>M-*BX5#2O$j^J^l@EvNz>f}u+;cM&_Z&!NsqVtwXJ$;kHX-xpLUIqM_IR_xdyP&QB7?)wx;pD2yHbNv-(1dK1;|yNjsE3 zS4)lwkKc=}b^=}9*i;J`DUZ+ysRs?O27-H*RZe}(%Q&12^Uv|QnXb}B+H0*=D0bfq!3R7vw&~QFCLas&5sW|%W zC6|deP={@n6CH_83Tw0bOJ=APX?dt# zEdXUu8j1rfx8yuC!+nc>Xg#j>=C^>_+<14Anc_`ip#r$q$x}3V^U@x@c*5?M&dWW_ zxzNCe8IuAOxE>R??b5T5_4PKDwW`=t)_c@m#^rFtrW5yFc%gg0eJ2yl5zOE4sR*4X zv&bi&Zt&E424BkU2G+LlPAy*2L1$Oq&zUo&dDS&*bmDs%Dxz=2--J5l9_Wu8_GxXIwO^opbA)lgQ0=~16l#!;z{f!2nrq>s} zWsA($dt!dzqaExOW4KX6I^|G;`fe}=*!54af$M48yjP)>htk?MZAr%6fI5O`H)`p^ z+sx^$BpDDEayQ&@R|sdo?U4Ej;XO$Lu?QYvxY7i&;`Li?cBHM7(8FA6VXK6>(z%Hj zfa)Sw%TLouYKG%}Ez^YJFnU!wH+tQ1UzFEmKo{h2x{#~u@r0ECf0GX(gV)^nO;^0( zhHtsUiC!-B&K2bvAZdRFJBUa5oXYq)_t5j@U!kGG^*WBh+9@|MBQ51)H{|x$5~czo z9^h@(JW z=;d5}8Y~)qpB~@Vk-cYf%L_I>dIVg7$er09`x}`o8uS1|r56ogn9HqTP7>BmZ-oSX zw<8?UoxeY&Q09m;?mD@JCD*UJdfdKwbQzOul3E;Rdz%$Cu!tVGYBB%O8m=snz~ z!6ZxwDK_U?eni=E<$IHP%M)zKNljNXb3EN44YbV79*&BI< z*I-5Z33dRqvpsYWIn84^!+71G!qPi}NeaUmol^WFySD{jDw<9#?%REclmDZ3R_f9z zB0N(-Z^d}0KG;Rjx57RKfA)1^nB5{kaU|n)M@Qbu z{)K=Arr~X%as8ZU+jQ_bb^44-pDx4-p|CFh>l@)Fm87zDZQ|MpgFnXT@o{F@b(L{j z!2wVey=h3;KK(@fwt@z~Hlf{tD6?r5{ZKm!Qtde(k+d9KTSa%2O(#vV7OA=#WP(De zP-zPd$@OuHv{Rjs*)+YjXw!u^Pown(0d9McXZR|%Ku6cTU19VS-&WUL7)&J>3Hm29QwL$NLMc$- zGB{p`M?+myiCc@Ot4_I%{DIma$0J&~^mmI#<`rKd^!{=ud8BH#khdoN6%H3$p$*rk ztnwJZR?xvZvC5UTF&VZ2Do`=U{iFl&H`zd};8e(;1=tE*YRCn;v{uJ!bZ)IpdBsGE zm=A0@Hib3l7AjHA&9I}`4v$nCIN4kt0Xl*GIFX?IwPlOO;Q0bqOGQt|ZSRE6rqk;% z&c)EFdpGMChSoLOTdOHPGu4V9%als`R(ezG#9z|^49j`+o|x+leMC7oQdhp$t%5j% z*3uSpw74^D?-m{UKh3!XbbmYUKa!bo@U*bliQ(2HC;@O@POE$W88Q1ce<<$NX#oH{@n}>_dUSe;3w#8fgQ^}KL@P(nGa=?ixUW`Y8Z1uq^ zY;bd?Zj56|av>rYWfj;cMv2fuAE2LbJ3mk*la~$%3K-iCW!c(ME-vSY{txAD=o3mR#qe1h6`w6KG?oz+Fibu3CscUubOqEQD|m3A*hZ17F}NtOQqF;BkL@~_(1anz>{y#3K-b+^Q_zil_QaPAni-F$P0dZ7Bb}{V@G09&Bx@H{aF2RGx~ch?x<|Qj z-)*hk>K|*jx=5dxGMu&`x8LVp8KrCGJ7$d?rT5DCyX%de@D11bS%1>kSL$)oJk233 z)|TTnya z`viT05n0RK>=3O#3}*);(RZO}4jMPghVwZt$~-pFr9!_>xe~+fetn0V_PE9C1sb|I zo|dUikw}ARJDn1 zZa(O$z0`l#n7pTJq;>7Ayh1B+mWd^U&Og^Gf{>mDc8!AgD09U)C%j5KC##mYLg!#? zCCWDq7Kde@p(CMcOcRWUqK_TJ2+wkvi-VPOF}fcN`q-P1t!QM z>&T3)brJ+<+Mm%7*2}>jeXLIJ@tdTWv(Q~9IpKU9lL|n4th(@{7+|^t4shw&$Q*qH zWHcj^C~D~usUDQYKVVMdS$PFkKa{i=2^+YtNb|Zi)wOc1fu0)YG+IYgOO#n+tHCh} zo)&sKr3ZKo1%k#d9QckiKMf%inT@)LMHB`=Kd_`KE8F?|TUE^a;Qz{uPcPqj{ zz5fvo!m|T+oW0j@!N!}5ElQh-x&51nO}l2n4~ZnT8I=UUCeb=}dik zWk;4=0my@smio5>l?o6uu+j`dwR1bdx~|H``VVV*qd> zdClMexF@xU#yc?;I|%w@QZ4$9R4ZGlCJWz{X;gkppYeMVb}JqdPq}`rVZu2 zSZOs1D-55Qj{=g)G|Cya+wFWR)4n|_lW7!ko3mlo&Hik~5)yU1d_oYVx)%9Higx-U zzRu*^f`8hJ(@J+)`IcSW%D41VseJ3^Caho`$=Zs{Z{*v@HTgE4ip+zr_q^=&4j|vM ze&VtMLKS3xQ8%3)72j=zTj^WjR`79>S<%)7ABU;O2P%Ey)HX{S3SUZtgh|sk;;pGB z-s)w0D&Bm=TT?3D%CfyC-fA5g?_QIQRvbgwtihgq{-AU_D7&Sl+!DiMAu&@$zDsPn z2sRn_%RVobLsTw3%HAPH6wIL^ZV zl5Jeu4&C+QU-CUG+XkdtTL*Sc13qSD+y4^kPGwv2jcgl*Y#TOf{5P`AW{aoNf)wSN zD5;GDwS`sO=A}X|=FtZXVmcLawtSYa&}zOF za@%JDU;?gK?${FiAK{?TA7)}lhbQXE;q;}trnI)FaLyqphZZ94mjOO^IKP$UlcYHn z>=EyRK`c7b%OBEpux)2i%2tzEwK;zNN8zF3ASSg#fA0KV=C6|A4#nF-^!V3E`GPPn zTQ$@gE_%qerG;UEfo`?s|DnfYlyvI?h=;6{Ex0+nfl%b|-w~lFT}B}l+MEw$ z>*b;y&0dPTwRq4iQ6TUX+1cpdtK>bZbft7#$k(Jf8WSqHAjm2u6K%CZPFpD(T3bfg zaoECmZ+3^`u$%ab%sq<&=)2WdWd2zT3IMs!-+lf_Xx|t!Iim3REwB#>1>_Xm03rPM zCT^2kJuavJ0c3dq3=!Wv`Z^T_D9t!Q8p_hxNe94>%tbJ<*mqRlUS|s!KyQi7l7s6# z{Vp-27)Hc*u-y1&E8TpOGStF@-@=ToTJN&$(iU|Gh@wqitkLlvGg&v84Vt@G-V2Ab zd_dyBQ;qJC2rD=iWi^^>`Bz#g^LH+=v-jhHmhi*_f^!Zum+xYJ4ST)pG)k5ebjU$jUkq7&&v9q-R>*1}H$g@KFQq#} z$AdA9B^H*g4egtVnbWpy@LOB$JZx z-KEMo6%QeCWQ(9-dhX!XK&QqHtFb(zON69^=dZAh4g54D+oOIlc8SLZ?r0^Vt@)b3bQAYD3Z#I>3-8Tc@#$`7g9YYVYcxJ%uN z`(}+kag5GaHviHW++b#Me4J`rm>9>bBJidem-te>CW^FloiDmg*JHxD7zq$` z25###&lMz)rIT{v#y_`J4e{eyflT(F)j+|O0x-3~1^dvX`SI!QW=^2J4z~bm`Na?JHz9YzbA4cxWXw_toX`uQBDaxUKkUn>symZVHtZ7LxoKp+gV6y-$k0e^*21Q7lpJ8_Gub;6%1Cq#b}aE7dw`XX8XqN*x;^~ptgZzFc>VO`aw<6zg%E{%c|A%JN2lv{JYqh%oWOnSZ7j%KT3;w z!g%N<&|B@{wIU63?)LaVNzoN zO8(mZ5-%?K$Zh`6)gQU_AG-YF13YN-g@3!vY{l*go;uO9K2E+m#RFWo%;RLjoZumo zn+qF-gxW$k_F5B|vPb2{n;v-9?GU}#XGr92zx`Ut9YHvaq8^C1z2NIKGs4IA_g?>{ zK)1eEn;W9=)+juyJV2))=QzZ}8mR)VuPs^nu#dD0kstx}W)?;Ici5X#XXpKhOu9@#6 zq>-!ty`V0M-0e2u*Za2!^E)vfzz75OQ)TWK1hfi6<>j>coWIFrJuMaNbPVp2ASOZ| zk;oAl8~UYGO*;4eGeDAeInGLqXgg*+h;bi_Xe zC-#_^7yB<&&FZ1%*rUzBB6G8vPXR*V#g(?lRa$lOMyq)2;Y zQssm}sS?#3815=D($Up=3IX=663$m-7Ko3f_z;rhf3h6 zq>CJ%^dDFR3=-Uq0azCb$H!yZL%MQRiF@jSOaC=Rz3 zL){TUDZs$O;wP;>^n8k}GdUrZ@&V;&yH&3o1YDu&rjFQ&dRMX7!rg3n$OzZtE)r*i zvmbYFXZG1Bfr1519-%g%E~I8Lcd|^CmlFHZujHIp-KL6P4C278#|3~ox0m`6BgkN7 z0*9#}@l6Gfnl}0Ae&aS~r<~uc>-V>g39_rh{GkwL9+E#$?qA$*E)kl}#NS3YhqEfX zd~?KJa&d8YZnVj-c8h414yfufu^U!wwC9S;8L(uO& z5~zX{mQ4H9F{r{r5OUN2r7&pG{0QE)7g1V*87zG)D@E8%Ouv{eS2G+%audxCK3gPE zT>vM88_m&w5l~SCF*6r*ovY;-RVq=mfEVfAEd4vBcL#k@BKF+dc`@)bxVS)Lh!aUM zr;?51JS!~GaG;;!jXx{a&EStJ_qrDk0a7Pb5L`1e9RT-=a|ZFelkc&H>ywQ7+QzWj zIWB%gP+Q-EI$I z5~vi~`MZO7H-6-3gzeGbUql%WJjPfPs#6wiGJD=5XrYxHp)H<}F!%y;b>`h2vvGgO{o-KSdO#!utVz{yZVaK2 z#92%0X;Wo(WR_ym0z_bBu~4b*(o?&@i?u-YR`O_kZME}TC*G@;JHnw``tkHY=b7aR&?P=97|@sR~ok6vm?{ zOpJP&@U58pr=+nNDm&VAx+b};VZVJwOQ`&+e7zApV7cH%Fs#=xtD#!jO0_-6;ZSs? zGCUcFxGzEb?c7cUWE3UQiM~{eU`?m}Q040Yh_Z*`eQI|0qjr8I+P(C%j?Zb%tNa?# zVe7zJA8>&)p{@~>vlGb{1Q)=1w&}5oJ$a}JilCG;;7~FpJxlPNGnU!j#37>Kd{#Sa z!8VRPqvqTVR*j3y#@V?Kz(Ln(gYgMY8206{6o+&6g{d%IEB_JHA~c8A*3X8ujjq}{ zxyR-n563s(L{1)p0ah!FXRF9u65wz-hUIfNX@jg)7a&@DKDO0syo(}rv8B0n3wQY* zN=a~w56s{sKRDITz2t_UxX~KwcEE8j_4SeWu^W6s`f1LKH+82`0D5<|Aev6yKjcWg zYfcD_J;PUldN|OJSlp3cIlw(un0AOJ!mp&H!2O?8Zjt+I3jznUqt2I<7BJhHV`X`X z#B{S?qv{9GiTo6`zXMAN?xD_e>V*Q z@wni|ZsnKd>x4O|cW!p@lOq3wP$S&Q<|e+XhdOGZIYCuUR*>lo{`z}xA#w;qvTK5R zOUR!a*rmMkWy1WBKV8`|Dm&LZ!u*f9#-8RP5&tw8!7&}?pF(xJUFvz^K0^o1pDy#h zcN(d@nyTA)E!e+Gl`mCt)i;-$WbPv<+}!|3)4fOpjjYK~D1+iW_M2n2GgBj%a!pIa zcn5DsIX_qz9;Tyn2LF0J+$Qu;QiD8MQA@2y%e+kjMBPUs_n|N}0!?PFQsrxux+*>A zXsH`LwSfh}1>?;P0>1?~zBhy!rcM^YSTs(ain`m<+-=OmH47-!IsUqB(9!$TCV@!M|knX7)|>)W9Qx0#IkN>Z_;TnlK+SXITXdxojI z^~*3>A0o5tl>2dACMh?NpG066X6hO0VVAU9>hf}goo_$EM*gU7^}*)r2_zs4X98<- zJ%+Z$i3W7N5KvkY2xxab3Ue!#pA!q<`+`-~ho{9TOtGIzf)X_HZKA$hM-9HZM@1Fw z1y}XSs;Nx2wQ2l*OSzfQW%Fi3;tZ_Tc1&k&tLu+~V%Tb^>3LA}m3tN5po;~-;&;V} zw&8^ldiZkDZ`vYm*=na_+D0R!C>zo298ksGiAitE^RcSx4ecDWmQFYPUf{_Jo)-R7qTfRJhuFZs<>L&P zjr-I2?2r$?nOa6TvYj6*qDuum5s7b+;^SDl2t9|mk9GT=!5(T)ss&|^pdS|Yq%-*? z7nZ{x%cBx-f%52aKbHq}9q8|kvA73Dww(i(+N1^K{vmn~IoDt*m-MEXQ34XmQ{=Lt zX0;>|XlX+gaIJ!z$V;&#K;u}th!%zTfoX#UC_7~^XV3^jY=kLc-I1dlUET$d@GjF9 z$z5`bMr9JWA4{n&Q*3wSDNt)e4S%e&V|uZPnOj(4Jf-ygj;oz>1s*h!KyQLV<+fm* z6sc2-u}Tej&Z)V3B&FjN=~liylKI6R+2>p>8mVN$k)7F*-E6I{<52J)_E274G9;Zk z-1HN@joIvS9I5CxWFbJnB2`-4m$c^W_Gf34+E5&q?3uwO8?y8Cq-PlVUuUZWcfv9I zI=6Dt;0qmm>Z;EOC3(l1K!Zn+=4I`@ghFU972DxrXS{>6@dQ(gRSWX^e=@g>(MklO z8zgJm=pK^_-L5^mcRQVy9b^{ihD3%T)4WP5Sir)_66ohbd%NAb)vmH*(x)Hxoim`Z z^7Pm(N^ItQ#u@ZIQr*iLuw(|$Fe*DkcFa0YJFl|5&hjQpdPds<4GyL0l$hYWH=Qx%nzIIMzIhpNKSx#sBOqTQ}v+G)|fd{tDF~(WO^po8x zs3)=#xrsg;9<}Bg<6OvZFJ@WIa=CAuD}88cYzNBD6=mnz)VZ4Tkn^r{_6%*5IxfplJIL#H$Mu~@eBXJD<@dhs@rL4X zWBW;#r&*q5d7dRbUnx7^c;`=k8j6!7=cebgvY6Y->mKJXeDxyB%Pi|yUggs1kF7=~ z+H1G8iSs(oLrg#y?DI6~rtJ5Vob??4KEL~b#U0{2M(itwzZS;dYhvwO8;^6YXYG2< z+E_iV)gLrt+`fAhWWKwJurIRj+uN8=L}Gq+8@^W;JbEjibi{?uk{pfwiuPXB*v4*?ZF2j&8QJef z!X}fxy=FDsN(9d`*4nd7NY4_cpWhk9J2=ZYpMEY<&r?*Z#GS-JDhKR2x695sBb#{a zfF{HD+x~3df4$?*b1vl+wm%oV)cXzfDnb#XNrQS_MHV!@dKVSOJJ9&MQr%v`b z#E#XXvmP!`eUDokPQG`m3uQMP)7a8hLe@sXLUJ!t!o}V_UzHGcpK)B;xY;aW-w_6o?eO*qH*~%rd0XF?SNDT$9D)(y z**8CuQrN6!+37hu>|{tl2FKz@N$r$brz>zuy3kI}amB3D>DPSkbs*B5VRUw)yk$+d z_s@)lr)aIZT-xd~@?N!ue2_XPzEGYon$Hs<%-H9Nn}xG486|}MHpH*rENA(B4b4qq zVY zX4B5Dt@o>~53a4F+S;wHx2>&zUR&>A*W5FnTjkDT`2ov8EVzlFNAukSaL-0;e~;}Z z2gYXW^y9O>n#jhG>=hZjY1A7a3n<0$e+YXIFsrJo|NriN_9?gbJ9qB%!py)73@|i7 z0VxC01QiuQ#b}HjHRg@_#)#Me3rMp|iDDP*##qqUEA|>C_7+94L_^~Lv(7zZ)L-8G zpLyn-b5GrM?Nz@^lU&_;!FEtE=h7+NONZY;)VG~tVmwx(NK9l2Mv2*OTmRs$U_Z>; z1uF*i7nKt{m39|8-sz4rB*vG(-{mX-3;vbZQwT^XaB(Al%C;W2omPCSfBfVZw)Yv{ zdOiaHz_P&GDD*(Uw})pEDs}{6Vo?kb zGf+OEoKUF-pAm}n4!sPnYN$zOl!5eznqL1sE-+ZYm%696Es>0b69Vz_Z=AqH^i{ToraqF%VFk=g-oOSK)*+WShzlMjlKNC{ppDir(ckCaF3NDkiX(SEB<$R@wX~`ISk>@D^xs^ zLIkw?G;id5zZ)fdy;2W7PsN|&ckyy7zRk3MBHuV4WgLCQC(wmp4HuQa=|#V#b!9*9 zsyLeGkBPHdRn6t-fbcc)qH9%rjVZ1+ZTs-mzA4>2%kC4tjkgr<(ma&83-8wI+vITE z@mW3egz)4%O{3R3a6Td`?cByJVgz8_#afKefQkTvs-$@xLf$9G=HLTFR zt})4Nrs`$BKy_c!;WIc*EE8a|pD?c|{rSee#CR7Q?-EmSsUeB)4VoHw{LWKjl6KJjz7YgypCO^<5%kNuFUyX{P}Wae$o|bU3;z+x9TE!`@1T!b9lau zN%|{eeQFMTMtd(yJKLA&nHOv86JvjDqW;#q#EL)Y+hHm$v+YZ5`!d_R)UHSH07q?; zRWG~OmHm?PUREAXAm>~1^m03|hUv;nYvnF+?l*Yczl8ZxF zfNfijhLsDAf>VAC#dbs_YSO;if9uD_yOXm!-QhR#U21~*#UE9%n7ycLjh0?6&i*oeC7rzPW?d_R5S?o^b`g)hyX{qmEdFVvHQ0t6+ zsqro|-dbbN`0?l6a*HjL_%o^8LcQmi!Apbkwf4NWry2d%wv`|J(LLIJReP^ch-O{= zs*b+~t&9c*>UnY~1=?H6?>Fp9;$C73r5eSea4NHgh&NjL3Ut!qO=hn*-W8m0(3R`a zu*Qyy|JuIN)XMW~jNgf?jeWWC{$RW{#{QEf1;Lmnx^+_&;vp$PXRox6$X!LevxtzXCSn z>_`46TCAkdUH)+Ek3?_V(i#}JE!&!XLiy9>t;~lXnwfiOyOh#)U4N1li=Jh<{t3lmwU%jxl37&{-4TSr1m}L-*+x22MfLF z(-i5=>IrM z(R^=|^7YL3`+^}SuX3ZhQWaA)lgBS!(>oa4W4xV7Q$9{+GZ8D#8v9A(J!QNn>C)H} zCjK}O=hB-)UN-h~#(Um)FB!W^-sm^mPv}>9;@Rc*Kc?EQ@oV##+VkH9d@!hmjI8^# z_n2S1YxK;kgFzkR{I#Y*K6s0X-)!tr<$m(M;M7j@{TF_zCaPb2?!V|CxU2cb=?70J zyJJl%+m%1kF`dT2*P^Zm@k#JRGag(HOo9 zIsY5&jnLH6BxCOQM zB9)kn0dAgsib_u?%}ut(Paq}*?c-mR*K7@wqeIO&5^ha2?e1v*ojb<|M9x=*Y3VW6 z`Kmay;SRZTP^39NCea+pq2bL{9AAx6=p5-McKJO87dSpZ&@) zN^*Uuf8Cc~cP?KX_Co+u|CcLBMMJre;<)R{P@`?n9&`;^mzW~}{sZvUHn6QkN{9Wwm;_v1wE z-#-NK(DDNX>uDuVNEHq%KX8Hna?Pyp@9hWXVcD+~gU@cJrF`$)^1XP_;+$4)lf!!M z@A~)s6S*HDth47#qqTF-8z%Dx(1!n~{P0X3ra`CpZRWS)tn!(5LZeYbC;0ean0db? zE-qKiJQ*~@6+yK|>p5UI(QX8wS-+7_kJK~D^{fSoBxuLWgNAvLvh(jZ%niXCb|%W# zf4T14tM|?wjkK2 zbrTtjXlZ$F&vM&K1|%Q7kX!Wrp}z;Op3egD<44xhb25PH2jb$Q`WO6dm~BJo7A!;J z)DtyDQm`=tP=Z=V`c*&r2+BlM=PY*En8W2=q`Y%ZCgDOC*;E~} z;x^^407w=SLxp26NM}G>eMdPPZS|Sk^aySOgeQu>g{}myBPLOTI8H@-#Zpccy(=^4 zv!D}4=_&ds88W;{e@G8+Q`<+NIPWs#>r#A4H@SSN>=O8A{N^awRul(v0G1U2I@b{) zJs{VJr-0`GQmy0*qAFOe*`(E2@y=eZOkW}*`kOX2LgHUL%*VJ;$ei1~lNXLQ{?-}g zhHd}=N)*E#ST!AxL+CwevYiP94ZtTW%x<{BxPE)hy+YBL6`_|gz>7oC>K9T&&ZVz)iii__LHsDuv=rkOTh#8@^ZR9_=D<}C+z0<$YpGV!{(b0m|E1$H!ny-%y_KW@A!VUIA1Fn63G#o?kgLP zG+oH4o%%4l)9Yo`k{M~X#MH~{A3?iztI>m4`4pnb{bld7P3o#1hm%=>f60Jgf0qdk z{)M84w%KII>XFeC(IkKibtqz+FqGyB*)tT$cvzEPiR}&#c6!R&twVzLcz# zm<*#|S}d!6%uo$Y4@#!tVqR<@TOmeah|mm}RQeATttO%@=T2I8BdHC5Tr^-jyN1 z`*v-*tm_=Z?0U>vzk_}DQ2VT*Y*(sNCSGJM%G#eazA4!G_PHcT32h=@HZ{N>j^fwh zncQT3MToe42E*DOT&5Op1O~&O(usgv$c`D>Loh1y^^lGFd?$HVXNR`fKIPaR7s~OG zajwx&j>@MXEqP;KAV2C~2k6I+2my(FX2-TNxga5xv3Sgl^&r`t4-t^*JxY%w$i0V( z5Yzo5@=@v5lhvR;+6h$1?0}A}u>(5N8thA-5w~SZcsedsnOOwQODdbKD*Z5tuG6)l z%bn6!CiS(+M8pq$-s!e(HccGjzGcu$#c(94Sg4Cc4@?cPL zUrW-fx0}4?Y?5r)5mMz{g$Iy#o>RNRNt@Ab*OfLQo=N8mNnt3|YpW!EqG~s5vrXxK zpfpQ*a>B{1Z8k`HHvRW~ll@U6JypU-4^PydVyB@)uM)NbFyv|2#92er`CklgzN z6&w_UeXn}~#x>|HcZ}j`3GX&F{hgJGru&3$aehzFPr2TX^wO!8WMn}$_kG5865mM@ zG;szY=J{*83lyw+Rt?kZLsRpS@jf((k4)@CQ}B<|9|6nNCsC7b|JKHq_=t`DS!(#b zg`j(YIshv}0q8(KtKbEi2uX1NUxn<48(3-0G6?YZ&KdojQ>!{d=v8UlfzVS4=9y|O z)?N+#WCF+;!eG6$yFifE%hv3z>Mj$|uZMdGTKs#(h@6BuzlpvZ>JUSl|ECGv;Y?cY zWLG#%uPf^X6@Sw1MS@fkppg=B4K|!=(4I@L*@NFeo2ve5*S?OUU`ne$*(2|_^H?7L z$Bo3&%k7#KHiB4eg&kgQ7gpHbayz}kPKWCg6@#&J3mIG`j^}$3q&5RT!9CS16uAOx zDBMwp9Eu7;_!VM4KRpjqzhcD_n94g9zuDVQ<@> zu6W1RZ`$NldB;xskq}YT)k4KGCUKgJ%{ta!Zm0M2%hT>}J+}2BZzOKVk;=)Tkwh}$W6mRl_JE{S*+?`Atx#k3 z7LL7WekbfCO+#jSS*VUaY@V!A>ZI~+ba^+Ryffupw7e6phCAg~pOA-*Ij3Gwp}p(% zpxV5yV13A$yfZoJHR8k~f$K(nl*zphShJ1$sFRPkdYKq^j7PG9%an?L6Qs%bwV8%8 zx@bM9oN92|3*ul<4JWh7!dMpS`H~mGH$eQUF(?LmslnU?%!4}m0yQrhx``zz5_7_m zvpb9F%(KX(YDf@dZW-8gB2RO;JuDZws~b`OSd94};)WCZ-7mt1Ve^Hh9Ae3pHL z!E=sJjlRZ$bBKrFlD+|2Mgr(EuR5eqgKr?nR@b`y6FtW@awgij#0>scL;|Vq=?d=U zYKiN}5@!eZBOp4!W=Jegr7X(*0?^UX*UNXv1M;{Pdc)}xyuFe(lCQ|$4@Xs<)lL=M zki379MDh#2$ZPAlX`yA6;dw@%@Hb8izk(>z+8Qc{~dN`(}Ku^M<$4b{mYijsbQkL*(wOtifx}P(_H}pGtMGz_Z z7llTmQH_^S$p&*a?%O_==mjjC!$P6mXnF@XoyP^CT}qB=*$?r!SUoKqs)Tq12Lok4 zC6u@d-bqc@y(3jHYPD7}(t&gIq|w#PuJ(NgF{XW@_>?pRp8bUAABaeB6jS2RDA#s0 zJK+%r$lr)qOGvDz>> zQ0$uNp@-B2OzYJw;H*ur8VN|4O@1QNe5!g+ou;f)RXa;Yo7Y?S@oF-W-1VyaI#?IM zuNLQTne0AB53CFJpp*cU;ORqZAY)>O=Z=c?4fi8KRof69?j+-Lxkh(ub*vr>p(_xS zFkAIv1nnUlX$fYK(5O&o0wn(oAI=RQ!8ich!$cF*rN^Zm!0fqH&RcpYk{dcU-z(EecbCUp zFGg++#h6(RTiw;{hAq)Yl#|HyIt_)8_ia^Q`|R%wW=vbEbxzxB3TLji);&X)tIY1H zJ?8BGn%cwKy={*@%dZ8>=xDfUNe)$HVED0m^ybw{&ygUg3@i8@*eG#w!Lj}|#dL22 zd{9Qu8tY!OTDoE!BUr7&1)^3-}2BUS$Z93S{6>u%|5I!+qb9rCckw>lXE>{U&k-V#OY`g#)LF?~mH9 zPpmzG)IkHt1$O}eI86vM$vbrFcJ17+6L)LaD(81Lfondi>{%}{ zF85%yC)|xJ9=Pa>3qAkab)=S@liHZQ9+zFT{S^ zbZSI&M_Ek9kKjyL@AsKZZNhrvb`^E3W>x8rDZ95f4$o^(Phy_;Gl|N8D+RCG)}LzC z$i+HlGsK)xE;0hF>K@{`zC{5gbb>jthg*G&wMn>EDf5At@S(X_oO?j)Q*Bi^p=wGtT^;l!NK8&*k%xO5H3Q6BR;VhWyny7DVH zWrNjpgB7{n0!4nx675wMh^I@Q<6m5>BbV!4FQ&HMIf8DMcbdpkN%mg&fiO`yMbEv` zzYz|8sh)C*j)O_vHiABo`H}-*YnzNA^2Cseq1;ikacT#CSxwVRl!#d+)7QF&8ZW?w zU(XQC4kAym0XS3KK{x@3PIOoDt3|@UPw)$>H6=O6@4=1M6+P_vo4%Wb!uTlcc^5hk zC^ERQUTfGp+V!A8kX?7JYJ0y-h>nMM5S%Yo6%Klt65Kbsg^!N_w1`~-iEHdw_#l~7>+Rir3z=^WIglN zjusN$4cUZj{F;hQ1^|(D=_;jvXZ6L3kHcRPG<$rY?_>TPPZ(M!nL}_iC;Bz3_jMWf z7VaY`zyk6Z!?+4DNhHM2qC2!xt9qoOkW&z3ly_U!N5S0H>&gX z21v)CkU{S81d4hK0j?2BR^c`4syJ{!rf)h@7zR`3)CKSmYc<54k`FdO`}bE>CgyU5 z$24FVpwgCKBub(AYTn5*nN9<4D1$a=NA8K1Wll{-Lw~Rj&?5nmWm@1Yhjs{OHVQUh zEl~cG7ZD8RV-Gtsh#!awf|;;6tPTFd9eSVg!x>n`y}_!Ghp|)94D|O)_^jC#%>UsM zwJcGq@+|2*{Dwb*P}Qi!tX7!8dYanFe|GxRU7163r~BJZw)xNlc3F3c3$?hCc!DKE z0u${K^H9l5PdH#VpztWdW_az4UHJ%dqfZ+r=)K`?2zV<~Alv$DncmG;+oXbsn}YPg zPLMt*@)J5l9&()(FpWr`a3ofT$vXi+(r7e~UN$ORl)N8A1-}xk_vCzHtoZe4(1S3z z|5A*8mfSECD^e85-CHHXaeDzqNoB_g??Pw7;fhkHAM0&ZqZZ*ewrx?q~*3s*`M z8^owq^h}%+;L1q6&p;UjO`BXsf|yTh4;bk>2dpG}TV4>{PmMCAjjfrbJncE<6^ z&`aPG{nmvY_$`v}Sb|267V_WB96_}P>d_>%-3s0BW?mvBvExOX;qG&l3+#ZItdTt{ z<})^)ut71-1dl7Z(CKg{Q;SgqPDn9qA}yV@KNMqwjD2wjViYxElq;751IX|6F=`^j zOCQrykSmzFyXvXxR&lb;{6h-zofL!-x|I;GK%~B)=O8a9DACncXoW}K3$&5RKRPtb zolZRi&rS@El4=o8m*b^L{PqqqBOQYa_&{}t?k!_Xw0;X=i$>4{m+R04Ugmmww&Oad z{N*j`G%d^mI+?8OS?C@I7$Epy#cT4x*ZH7C6<91;mPt7ii5c}j_y^idhQtYGN22?7 zla-0j=|=ll2b7c0SU!0VkfC1YY5C++@<|_S>U90Rd~zx2n}UOa?CXj2vT%Z}^($Nb zjePs>eA`2uK!C~F@qA)PoT@`RE>@MS*+N4f(F~E@@M)nSrvetJ$3k=&%cwv5xZG1q ziCXR7Ivb%yQz;RFUoU!@kEKK(l}iLj!fJc949AVSAp0(0SqH&7C3MSLVtSJ6+$MlJ z;%P4r?@u6Vxjf>mhrEr@S)u=+1R%^Wq(Lz;p*%%z zRDz7XFImkySj&#nZGt>C2!rGx`yA!WXSg2EC^;NFtZT_9AI_`dwTFS2WIJgH*`z5m0FZ=L~l z?dT!xcn2Ij?r~mf6<6?p)7gu2brr;N{%B&9%KT`2A9GGJQY-)46bqrFY((w z?;hBNdh?*Vs@cA@dCX|wni(+yIr5Rrpk)GSu|TVVSStV@X`=Z@`TS5l3n3>~Geo45uU9ZO{L(iob(8@T zVh$9Y5Swd5eLZRn10=1FPoCxX_VkIyaIG={3#B5F0f@yut5(6UG?Lo}_kw|lhf9bU(E z%Dz;&ZZZ-d5~1dzZ^^(v+4?ZYCCXAD%e)F$6o0-BpDb50riQz+82{o9(Cb6I!Nlv( zzPk^}54Lx=$!O$dcGPy-IH&`?=zNuful1mHNqr!SqBe6qj4YvHmV;p$gfxAEC$JLz z8+1o=yR%SvXR7uJ7G-JPvn-l#jcg9$1y2Y{`B(wz8%(PMVOq^VrD@R^TtL$*R;XQ6 zUt)j2Ypb;?%`9uAv$s9V+aKq#oPI>wxpnf@`d_>>+5Y?a(7pA+ZFq|1C@dei~+Ag3ACdOv29h_m0B&0v0XJ zt0CBI7kir#{5`jCCg&Riby=PEEc@-c6sF;KYHb= zSms)}>l*GVuLrmGNI(DTSq}~g7KmGVt{fSh*xGYPQBJgl%vmVCVwD(Qa!$=_@~PJ& z_$Ea>@^YOAcQ0^21lO6V4j|(DnmwJ}BS{?pI1k_oJ~QCM+w)j#lo{xB7GyhH@8>XF z!+O9DkyM2SBl+j(}Xovqv_I6lCR8!)GnzX*OGYS*WC z)w?-Jy#01Ed)CY}`#DH0{eEfojLbB9f>c-^+}WxN;2C(quL~9FM5}btnIs7D{^Ij$ z1hI|=U!q8;d#1v?{g#rkjfNXxbe14uSK_fYz&_czIV=eRCaDj?gdSv`mX>}>T3WI$ zx@)5waGcef+}j*EP@CMd!ok5)5jmI`G7o||SM_+LI*C6<1#xN7svDBktyLc=jy5Rd z#uo@qh_}N0mUQu-QO5MYq8)%)dbZa>F0ezwd)a3?)?zfmWS7$6QmR*Qo@^I(O|hlW zKi-+*KB6o4_mbm}w&#_M-P?2kCgMdKQ?trfoKm*NsrB+i0(oBPM`!clf|pL~dYiPy zWFp(qi0`AfOZbpzRWgAWB%RLcjco5J3}qQFK{k#gx&y!@69T^N&5n74H6)01T?B@D zVZNuv0KQ}QPkQ#);g=)H;n%KfaV}bhT~mD6kT;aa?+bWs6+9^>nM;+2uiZI1{H1nw z@m_IRaoF19!`--AKksUewezxjVDhK;#t(=TZTvAG0$MNAAk1DJc>Qs0{WI)r4>z0p zmD%Z(NY^zHJAMq|Lge5Kdn`-6$QB~uOi;&6D&d5S1k8n5yshOCXI10~Y-}D(iKRLn zd7>CkCi+L53UTA%ZvHdiY~@&WQSJFp9EHKaW4Ypq+EF)04*mpdsd7Nj#}jHDO1~0U z>)?4)#4f0p?ABNDRUVs26}$ndYgHJZy@7UTG$!hdY}O;qO1xy>?M64bhjRzOMTPPm z>Br;NCvoD12`+wFRnxG}OUfYLJGlwoq^6=YBF=WF_>Fi#G)W%!Sh`qluzAw32hg9p z+dD{zL>SwpOlJenjCI4odk*+4g43+?D=$U1#J-Y5Vd29LU=rL6%{^V`Pw67&f z%wHy!dulhm&W5i>D~Q&c_2OVuSx58ZE3J0M=c1@L3Y$9~dV3T<&{yopy-nnzE9x^X z)h)18O}aT0BC+}zTB6bS7mL&7+Q$Eu6&nf!TEaYiFqm)NM_MvXoTXr>^{dbYl z>be4Z&6~>ly=jS4tX4AZJk%=`daiNl+X}S45Hx)jpb3`sxLB9Tj{zG(#1at#3&5`n z|3OE(!r!V`JUTjtZb^~#<81}RkE6aM!$_vf>WVK_xz_9l3UHtes%TX(b6<~VK952Z zwnocq)+YUl4y2O>DmX~Xo|WNd6M8;XUc8duCdTRHcZnt^NlKJbXgWL???k4xMwUQT8HmY^7)B+A9us@Lkzge#qI zy{3YL?L7x+Ie}&M5ht{r@+4(3T}!gOi`^RWa=ApT3#f)lJxw1`kuoI|5uISf zR}g_OB?B{HAUsw{G^J9+gs@f@igJ7(xRhynCZ5=b0~y|A^8grp)=IQ5d(ik7gE*1S ztR%F*V};l~e2)GMD`4c4vPYbI5ciREu-rY9WDR;Y$qEWrECaS0n?aR1L)8VbC$|X; zFWOAB(kDtIXMU#ljkL<&lfwJr`w1DW!O;SjEEp*)6*`7Uqx;x>PMd>xs`+g`cU)yjWG{ zeq+M@zFC!guS$5~nBGCB{#F$qZ(mfM{YzCmJe9{i1WU;xPIwfodJDg8-4a2mZdDz~ z7!vM{h`UyF-otPgYty$W|Hp8Bq&k#z9Zb;{x^74Iz4*UQvpKFj++dSu=>2466otTW zeUP514-A)LIgWp;`y(@>XqieB*q<~O(3yHx{>0pPyCB?^@O1Z~WES@MatZ9t7!Y%k zIFxdfl@56^o%vWg;-m5iK&$typF;#~V_^v+6Xc>-Oz7*(ASx8qy)I5O0xn56MOYAt z@!emQXxFi% zb?O)A&Oyj`{p|(H!SN_`1molnR_MD-W=Wdjoty3%pwIM(oFjsP`h)11E%SVrWXob_ z_C6`={ptD^yCF-tWW*9spoc?h>_nF@b64vBX$mIznIivR8z79FNRrFA-b-ifc4we{ zq|+*~J~D(KWtPhj{;L&Qlg->JMY~0c#t@!wz7Gc?Mj?e5c(02-u4(5v&og)3OJm?P)7?LoOhs&t(v@pU*V0vWnQu zzd_McQ62?1N>0zQXs3An0zr_*4PPIto1$D7{SMs?1)ZwEGrTF6c{syoAIkXM&SxL{ z$!9AWq3=sc^=Y^MuoW6z?F*xWi``#h5EEd|HYemCM zcKNkgA>LV$gkY>AsRfnxS(STIq`1n%eT>Bx03cmJA=)Bcrq(2K!`~~~@$gH<*y}~1 zI0LmWZ@*hieo~D4zo0nViWAb+UK^eVV*5rch2DiBd|`LWN5z55E3vB!mATnKI!+b( zA%gcv_Kp1Cqtq0Uv3&e0D9X|LV10_xCt7>zaiEbt0Dyos$XTb8ZLC> zAo#fL@R!JLz+EI!d00;i(m`8jem=7@OAD>Y(n2V|wqWdilT`y1)E>e9SHb?4o(toH z6C;1N9~S)X`q_Sz{1&aE7rHCod|$R&$M4UQusY#9m-QaXnxd0WDYklW-u*$d6*ax9 zqlSJ@2w42MY7x^b`1|c(Q|;l|F}yeHJk%51r=-)TPwU{+U~BNZ*`n@qR}bJA-U}uD zUZ97&Mwy|I=V{EWopBwQXWdKM43SEXw4SoeeT8bd%|THa#Q)@}?i_ zCC^oO7L$GR-%7~`p-eLwxlG5Uh0GN>`sMOm&+OSEuAVY!^Rj1cz0wL@?tdR{;Zgbi zV>y|$1Pz*1KYaFLA&I+|7a``#G5Q4E+QaVr0~#$81y8c83Yoj*b9eE%yLw*wS9$4M zKYi(@Lgodz@%eJO-1++B9<|}>o&%qV7ecQV0wVr>4kA7u$2d{6i~>a$JPn=1p}Qtv zIWYNmP)O8W!g3t18&Gb{wOS?ERR}gpSD#?tr$cWPGTY?yUj)svMPFsTDb2D~j|=vP z2K&o==UFa{3{Gt8IWa{}K=n3+LklXT1EV^7Wu6&-Rla4My;C&eVuT~gRPv3XVmt)$ zJsz{t&IOzz8G5LduTMKSrH4a+Mdkaes?li~oykp3^lnFOLWWD~?0x=jvAQ@t?SoW6 zJzvmB$$u04Zd|&38j8I9vDiT8SvvzjayYP`Gch?F=mzBURAl8z%wJNBIM$uQSPN+N z8ikuF((W8yXit+)Pwg~r>ib{Bys4kvbpchUn)H@NgR+Zs; z!Q@kF5H0Uh6o$tjD)eho_CY=>k;a9M>vLWDVv4Rl}==ow#1(7I%30!!*L_3U$5iD_K#n zt}!D+p*=|LaLC|gS5_*!y^6lIac7MEzqER{ z21YWfXS9U1dT0V{_mqF+ScH+>rYggPbcaj(I{Da6@1Q9UzmSW)n)}hB@OCcq5uoC- zL||Y0JU8BbLT$-qKg`*a>)}8J^nok^unHBH=foEKWki5n0x(%LLW**2PqGI?t6T-SV!8ID@-wql=EA+R%fR-*0FAex?`ygu&jR_LN)W`p$V4brO&rH$6@uGoRG2j^r@ z&wYel*}WV?RHclkw61!)g6?~#!e5jfok>OPs?p1f){0_Qhc7YGjreY?MVj!GUSr~` zSsxN)trCBBB5ZL-7#i6Lyq`B!-(U=0Xn?|dQCdb;*ZqHJgrj9u-3x0k7JyCgR5Dp) zRKDPrYj-u-8`jSPB!W#**{D)VARc_MC6Z}cpcLxQEyH|IdJpVOf)s87ZD zMJD3~#d_qHh#rXrX=0Dv=+=OJJ;qF6tuGsm8m)PF)|AagPl1n7nK_GeoE?jcLF4JA z)&?Phn{+|;eCK5=bZ)6k+LAXHL2SRJi2h0!fF%}g^k`>xMX)YiqCw)EU0xu52kjMx zZaz~{B0z+jx{faGhT(rehnAHxSIT$S2jAVSZ|PYRt7L7g44KpI&~^TISreZrGXI|~ zc3?1~i^Cp1N{uM1LCw}}u`5(1hDo6W--_)JRDB;rmo@P|r4Pd*dYsF3DFC92zbL}i zZ7gLTlma{u6kv<~j$AB0_3xHFqvi}J^h9aoGsU#-^=z@pVhd_Z}gDw(^B?mfjayRg)H#dlRf)Bb=CRPGn`9Lxz$OprZge!wEO>^iHu z5`|`@iW+P!b@{7Oua%XQepMyf%cuuy!Mu;L0_f2?wO{mam6>Ig>O3sO@nx0Kj+BRy z_{p%nN>Vhi0KpgOq>B#)9iB$cw3*X;)g-~UBy(pcKXlHdhwZ;D?78VL!ro`$$W!6w zLOwenR~_zyf^lC5r&0K=bajjFbQ&A>E$sJUWl;~<+S6#?8`U30ZF$yg6hFd8@!&>m znW6Ww4s-ru={mc=8s@yNgi3Vzf+5LH*TRw>4vE09p(tBv z6N1>vUlM{ey#o{Ug9__$O}dxiUshz<1sn z3oWSbcV;Q0^9xHICVOp(R=ut?0H@{z!4PDf_|fpd8I!@3>RZajQD8>X68x zL@?9rf|Tq&2~!pBXi?hycV-VH5-JvoQL; zTxfB1W_5{nxvUfqomOqORk~kRmIvM%>ph_PXoro~7}?{s@TrCKm!v`zZ-0#|)1_AE zs+umJD`Qv^*s?1|m>d`7j+bTBse-u$4 zrTIssAW-JZV)&FwVogkRdr`}gJHJwYQ>^@Z(e9Teb|$WS;XuCc<5fl7aaC1dhuyAG zDWLEuG56}kT<<$g+@s8|^lO@>?R=$AkR)YYup&cb*?A44{Rt2&l(hcXf!FBet9lL|?>V@LBzgYL zLu8Mc_~K0Hf?BZ%)g2cXqU#E3H47z9Cu<6wA1SB@c?5ppp~5m;M|AH@Je=$kN#qBYssFy-$$AcHGM1{w3sm%1 ztOxtSz@nDUu2JN`^j~&~dJ<=}n7vc)sexH|p=6b=Q4RVu8O;4ulm5F#oWk)nA&#!Z z?Z`^91jbX8m+O?dU5Q$25B%YVJDZgr;J&UR)pV-01KIu<=EvBr?t!VXZl^mXvsQ)o z7WW~s6~BYB>%p|%GZfkvI?;hcr6Rx>Uz}0)AC#BHC$7%@HVmqvigbi8)1gahGdGga ztz%<#xt}+yJA1HQPw@e9AhDV1d{w{dDhO<>>MI?(rY^G~p8ql$MWp@{6^27l&Ns*( z5W}0|-iCN=W8D6eirl5r;-aU2>r`QniB|#&;-3lu$Ql_eY{5(w#WA(b}!Yw^n`NcT`Tlh zT_8byR>Sz*S|eu9T2^ShW$nY$fi?uiTuE&5u$Lk|9jfQ)lU%O(wogjn+dff+)MehT zp_SgMiHAPudG9&3y!YJNpTGB$y38rH+&jOvOm>&*b9xkt=_QmuA3CEx&=y@=yCbx; zwh1?@h-p|^j9ySwD_Ij6eXEKkv<;O39ehUSd0-bl*=$hya6%pf9^-O~xeIFVef++z zvu;JWW#OVt)u*t#WL=q9g0`s`ThhxQP`k!^yf_fs$fN{v7QA^c`>OERb%o(X@ zv3ly>Q2hu?dGg3glp{Z6{e3xb0NsswjrMDVSn=Of?pT%}-$nOz2=W?%0x_z66S`AY;{6g8V0;u2N3ytbu7M%>UY)2#r5qlWDU9k&qd6k4k4&I5h?0{K$2I1 zt^9$yxE_4aEj``^&l~kCY|dpa^)+Q+Q2Xg7-Jo_c1yvHS^CQIiY&jLr-SRUTl2kW84 z57jr-+7;qgXKyG8v1M>yR}xt9PF-sr`@z0+zUZ48|2@ocf4GxudJu;-I6w3-)a&7A z#ra_@i#t}7%NsL)tfy#q)RzbP=u65WutP^N=B7JrAzv5j(6fy=e0X_NLcMI`AVB(0 z&$B9s6~s5gL=Zxpq+n6esZgmn#Kv?(x#q9_S)O#tcD8E21$LOI1!1Za7?Y9JYP z>)`@~dl*2_4D3N%ACPpx)qYetYxFPaBau;06IVgpTxwB0wBfihORrai2^?1L-<4o! zDA92r0VKe5b+$5Bl3$Fq9_e!j>1MHr+>WYfI<0tjI5fX0v$BB}T+u)aQmy&sqsaHd z0xdOlvZprpL_;4m1xoyL8mY~>jUD^hd&M9Y_BU18@2b={tmUksUsvJdquVh%c^5m` z%N%tvY8=jAah4tf=A^cdL`V!%?@EZ@9&IjWBNJ(ViIeTd_@VQdzsT zx>r!+e_3c9;R1W(l`tK>M}lMnzRb~!2sz&%iMJ0ncWQmTQfCPZ^n3dR)fCA?@YgFn zNOYP~?Eu+uD?chxL4buPnt5PG}1Kl8v{aa zEwTgQ!*>7@)xRCu+#HPducT?dZWIX{2Ozr94)??K?04hd<}_6k=&^ifA5>V?dJ3er zH~(YG>MTb5wF;%|G!O+2!gkpd4-{E{fKbSwzZ#2ebLK-S(+5%}x@(JhGy0~C!mZ{e z6&$R^U*116RrYk?9jVZl&B1WIu!&M$)I=#!;mB~TWH`dVT;T?c&^i}`$gVJ>dB>Y% z@8T8X6+6o)g?A#$0hVdJ0|xX(?5M)2F)sN{2`P_>qJX1F#v%21L?;tt07=d#;_&;P zZyPL|AEBQ722FvvQ9fgmQ=(m{4EhW~Rpj5w*26Vg{P<#cC8wALCOoC8ST}TLFdo)Q zw$>U3e-oo%tQ@90F67iQ+1+uj=TiLSbd~EUSFu{o5T4$ zQ=c2W|DG|5MMflN_j7u|++Wa4VMMGylWcSvzhJ*E4=QsK0>}a-fFP}`Bl}pt(Z3b8 zT11=;uGzaR;tVp=t!o`U4wAj5C39;t#lEFE9=fQ-ENXTaH}}ZapSr;yF327c2iSB^ z-C&0EodK%IMEFUH9Iy*eflYSo2XhasfUBVk+2>)=ciDKl($q#Q|b7hX5$shqzw zdhazN7NeR*9cH4~65y^=T?~yhjt%rD@hxC5LzO%{Tn#}rlCapYR-3)21~SbXM(u?fo!b7B$B7e1Zf`bqE0U*){d*QvdGk<@ND+m|PCS zM1R2J^5@}Rj=w*DF*2|e7}f= z4&C22h!(JQ=ld-vn?7i1a&|&iItlG8`am;8cU5(lhvU1r7SSdJ##Vs{izeL^3jI-; zx!4*mhvP!oR*G`#AOZyj*$b6(wiOD&WlU8MTcL;AGOtNdUJZ(}S#NiQSHKojko^#t zbvN`@TY2my&unGvEo^PViaEnn9pO+E&+Ir)XhTK4jpf)Spv)q92`ND`U9ev{uZqRg z_NI9wibKraOMrOxr_f)N+ClFDGQzzAgwV==4pJ)vio70>`ic4k{S~HPwMLm)x^JAv zWGvl?nsORr=^iKaUR&lLQu6PlVieO_E9L7Dwv6%pC^2zikCVr6J<(X+FlGTN&__fH&9#g{^GWo`6Z#y4rE+YD8 zT6J3`QIrHv;BgQ`9S}ok@-USrqE1iT_w)LS8s6@5i1zgesPLnanK_`Vs zgll-%%j23ZBEnttriO}Mim{OKGE*Y5t3_1kREPQu?j~a9?iJo*v-OIvW}=0@^+Kn$ z2Rdrq@7mr>#A|wYcpk5c;3*J;{@XF+-8S5fm^u89)Zyq5JORh!K|*LuJW?I5s%tNI z`ePCrI}8bXsOkmpO02r9v$GimP|L&dDwqrxw+C%{xOjBoP%>8UrYqbQT}biJ3+M-``-jt!cRi|YS@xROs-B0m_(@VbJo1yzb?-od& z&+9ogaD3S6oa#YtdmZe07JUN2HOLWFutf=?*T4$N!{(I==nSC|7Pf53Y~vG3gC3Fu z@fLanWDL1VrtFx5J0bVDUMw!k3~k6OXv~;nf`#K?5SvxyVuyJR&NjbUNMA(k^#m5_{Y>ak! z6ns~yS%I(04MrWMJ6H?*FkGskME&4j4q%i5)6#(KW9u)Jnjm&ulC~YCTj2puwmKXF zT4(64@ZrvI=K-aEqjyOHwpM0Z)}Xb(-$|ht{#Qq4c{@$Bti4RFwyL*m5r>iazs0r; zra?RQt4p*bROP=wb%(OA!XN7+1v_L;40U93Me?bS4#z~<&w!Kp_wV6osA(mPUixf> zZ*O~zu5uKqHN9rMB0yz%+_s;voj==!2W!+E}1^O<9JJpv>up!B0@lWC)Lkx&J&pH~H1QXe4 z$2ZUpgwEjnf1t;c`Ihiiwt2-~q9h7m`0#g>`UT{)7ruM_851ln=mPL}{!U?j-Ul9J zxEgF)^sxA1mFf*?sLAtS$qcg|U>P}j?Dc&JW&=#nL3=PqJ0;7(a$$-dZW7A!r)SU{zz1q+{1i=sW z{X3anPYB=xdjzt~BGm^+W$JS--t59OCzh!Axj27$xDA{O%{98}JjD!5pN{6Ly{Dy4 z!xJ9-*O;fgUXeDdHQf@^Lvf-AUt^H}xFcg*Boz|Wq0b%!0qC=(PJ+5x#qROMm*d8fZf7T;@JQsk3siq*k>g9;Ab9lyHR5%QJ+PlM-) zz|m$H9o6hz9{&#~&-hO#ZG1@J}ZpGHLE^`Pto<{rn@Z+CRJFNkK-P z%A;*RyYNah^tCl4()X|w3r7FRxsSE`sn#D^)=LgZe6iRf)wo!Bi&SQ@;<(yBb{8x2 z7T!$tt@bL282Phr)NV&gw=C9$zZrL{(bqWEg(R5#FVDY2yfPpbTtmV1q*@3O3S z|N9p&v-skH_DzDM{;qN_f~G}pHtuakzu{QR8NB}2di}@JUW3cipaH2fjl0~Mfw+ms z1QIkhG3?ZB5RHj;O7TiG{H2OtrWV=m*(6zZtc#;4u>bE?m~Ri(o!6@T+ZI3{`YP8t z=f97iSE(8J;9z#*gPHOY+pN@=R`@R{CEGX;^(4bHWeLB8`prXn-OY!J9*9ZKe&6ao z+XmZ0?}i{NDxNgTp%Hl8qabQj*IMprR;oDOjgdx+wV0(brH=$Lt|C(Ry|(9Du?-N0 zikmF&Mym}KgQxp^t*4!3cQ0@%@)a;BHSh}6k?A^nhih(*C;w&Zeki-h0`q@Y{tJ5y zakM9%;&gv%m)w1_6@Rk4`_bKy=0H`);_wJ1rSG%y@Ra^}FXv^wMDlUVe%4AnV^!<= z$1GeFVGw##o)N6ocGCNkB|iq-V-@Cj1cTM>;*GPN`tfPhiu;d=5xx*5F+&T>MRXT$ zQj7ea>`kfphcoGAkm%{e3UoPxcth_sepuH)dFyj#;w@YlRlabu?mo?Ghp?bQQ;_n4 zT_KQTMTbx~k9-_fHZ~pV*>0V!tda29?OExIVbxv*ubLkIBdDEJXua~TR6ysiSFV%9 z-T4}oxw3qP1x*StU8=DXxQV5PFg)zD&T7(O_|5sBhwutB$aJ#8fs!fJ7+)^!r>cS~ zOj>KY&o)vHzd~o3?mJE5ZZv`arF(9IR*gaUiZ7>Giug52soECnX?L6M+kooet+$%) zRV+vq#5ymHdf&hc*I$Tp1YqGVx_l_)|K0gt%1D0FFKPMBEwt+@csak;-CyI-RL;Us z_a|-N;SXnj7~2wT=U2j(wPUdK&*!Fli_YMjIJMnxTh-SuYZq_4#i}^cK5F7`QLKn< z=3%Y&(pSsoQN?DfY~UDve1yrr$iS=A_sMzqi@hY&b1#xXvhkm~P7t9aC~bc@?shc3 zgRy#?>TtORdGY&d4!*Y8d?=@`j=~Y*?1h~2JM>J%wba2M`$ypu@myM_;&sl+kqQpd zzs||;{AH>rKP&T2qrGFboT?efGo=SrB3S zyxytNdTMLO(2`TwagiEPJ$i|%o~>u?3%A(s;GABeesxgyIjVWkp(BS)9x!^Kyrkal zJVHu)I_7tNwE3*8{pwQ~hVm8+YuiW3E;_G3IJJ7RzO`|@gk=Ttb6GEZaCoR2LEy6I3PR&)C{CCZ!5mq*Xs9(+A#d40L zrt40LxG1dt!{zV^DHm z3#{Gx&G2?RN6nbl-97#-wFj!OnR;&v!Qp2uJ@W;%XZOsr)Esa2|I8UQyOZ3Gi8(vY zzCq3T#q8Ssn)mhQ_S%1qn!Ee{-rSPfb6;=2QswSry>T_xq*3u-JfIHv)$ob9u-M%L zHrxFNbb9?qcNPvZ2WAd>P<73+x~=ZkJ_mRFjMFr~Jn66p)uD$T-2KagYP)L^NA&%9 z6C8e_I{Gd(Z`u*vhaXz(R=wvS2JSmML3|Z72Gh0o9qUQqPa=vOl8JTFQ z8d2UIy+i>tdb*D*gX+1!18E+&(Ox>FMzKl8oFcgf6JG={LQQ>qbo>L_aMk22AVP>< z4$io~&^6zzHh~@e<(`8j_z6(M2cw})Ky?*i%n`)HsZ`uFp$~4LA2XJXX%Khn7Ow_S zB+Dab)vk?RjfB4?dxcxz2ZbewIHb}IN5au~ti(U~ww71xrH4o3m;gDdX#rFR3`w}n zg11{xi!inD^k@t4WB^cVnag7>M0}pH$J1uAeEmhE4w}O1Lo8r}-iG#6TJ~j)XEV0b zXB7U1D3Mu^*meqZPK}u)0YG8vOmtG`N2cFE<$b|@Owg(O%f5HWL&I?i$=yqM%BXp@ zhdGCa;R7p+7r9I??vCC4+RL8lNl0aH6uPRLX;jz7dmM1%K%!N)zIMO2l@l% z381iewK`R0oWgwMeCHITUtuOtfy`Il$+6!BLq%*=QlSwTf7;9ABx@B=Pn^O>vNV4R zmkP|&GD7?ajcq+qLnn&S4CC1WvabtyQ~Ws}LsTyCfU91yLU)CG>qBQPk%*X^3ud=2R6r=(P(c-mJ@rh&w6 zRn%7oBYX-2@+5t)xLys1C}l*s(hRQ21K7u{e^Q09u;;?G{JUH$lp2A)H|*?>_TWHX z{!qA8$cj6kyq(19-0fsv!MLU~xsRw%N5SSwV=aur{p z_FJwF4sBJXyOp;|0j-|dq%33qS+#Cb@q5*No78ToBmKI7Pws0CPcr?~2-6?sCl@3S z-zui4>&jD1~;oQM};oJ zNW#!d8dnPK&et!Pz!UHey+n@+nJcW{<^Ol+ars}rX@#zFDxAOKD$JX3$`#WJf=B^P ze%>i*dyjlRjyk8Ns9;~1uH&FNs-SzYAwR7Mt zuCQ=38j96`!pc0FyIJkexH~#GZ)V6q&>my>WO2M6M44PY%?ZbI*39w*+7qUOt#HPMdoOY(u5emzb-mkM_jX5}WG6BzwI1xiid&rtw>jQ&$6f&< zGEV)<=C~novUjJeE_BptWhWwvgyVBhS5@nns%|pcvK|R37^nJp$%Q0h(3WFewq~l<9Lp<5P1JY=JAhS&V=a;Gfxe1$oo3l9It0j7m?!N`zcrDrVLG*bpYL z7h7`;F^H2n7N}1&+|~Fs6&e0MVBT0gMWc&?c8qh*RPqW?2dxVjS9eLWuXf51tQ(uu zjnFqA8@jcSn-e2Zw?4)@cGT?1oa{07v6}zlF}dm9uGRdH0ACHii$`_tO*^*5w%)Y$ zO`f*_J$Z*tziLNbv9s5C_O+h&w;+q$;N>=W-ZdCqOIORDbsf)@ob7}$X-KW`rl&zd zp&{ls`XD{T<#a2;i@)TuTnem17R5E1T-1^|)Em{J;waP8U7@FHdYWw$`G*sFgl~gL znyh496^`u)^v0|`qZw0Ci*pIw=Q8#HQ%;kxNev7-?>sv==;_uMf6}e^Gh*FZ9In#| zu*c(IvxrVB5;>HaIvTS!eM(xTfq+|)fwMi5%qFTTr5~~DjQgP%gGHBsof>+vig28A zFSZl$HH~9&y*c;az38vZyW@<0pCyxGJkBT*z#kJbLfnUN7=$o~73#vjv(Xi1H zc<>E*uHgowH2DkaxY7n#0g9OL`Bvo`D|(^TbP+l;Vz>EEx-(*7$7YR4qc(swiB*Ev z(Wj;}+Zpc+^Ov0beYkdUxYyYPDB=Smx9EMGjuCMMOIp_o4XAC;Sm~Nm#mM1@M9Mf= zitHs>ml(yB`U-G`FnsN#A2Rr=)ZltIfY;1o_|@QYljQb#I*-XiT+;JQVVv|^bWbPU3@RJ6F-*<}c#z`V zWZTWmxl=8#(v5;IeX0Z2GA+L*R!)zVlC11xXO0$1(MnmkXf-$k=;lUsyV}6$q~qX4 zKZ;h-j$j8s=3Trr4B?N}mgUtOM_lfO7@(fKMn>Vc6c4D)?`Wt)Xh2~w zAUe~{BHT`FE)K;-sE;-j`$as{2nsLPaX=<@Pb&Gh zsLvOa9&v3#a`nTm_q^MrcaOE0Qhn7a#{Iy`A&KGT=SA?w3#S1|>STQRw2va_&hpeG-vt(`scHTol@u zllbn{4P?6k)bp}UzLM163hl+=I5U~kqM$7*hLU#ACL<`i+leDcCYuuWwN%RksqFo! z)_YRfKO@i6KJKvgc5Cmk(cRYGVf#&TZmk8LLSL(+vwtF@WU|^CXH+A*76NTOMlTao zd>&`&yV@LxIoNRoTxmU*@CTT96lrm2UH9u`3mo{ZsVwQ_L6OBg_@u{(BMvTfYhchx zwe_Ofx>wdPEncK*J7Tmbfg_|FS(TZjr>9$p-%dv@*`{(pif2g4bdb(xTF6)1_zlm$ z7y#eE$jA&Nb`M9rNUP&bFZ6;7yy!v?Y?x@AqUU@nz#kd`K*tVjo{PW~_NskhY+NkC zC7tj~+~5Myew=rMWXo5ZNIgJDifZN&e{kUdUvoy0tX!t`MDGL(;oKndvhQ4!kp$%i zwL+~)dAFwQjVXIus!w}&ri!{zbOcTc07 ztJFAFJi2Kmx(x`C)78KVru7z8hbeM}>UZAdp;_=>z1)FN0o>@b0R4sJ_#s5YbwSX8 zU(^jYVu%SfgzJ@Uld82Ju%hZOVaE&sllLoSpqh#KGoX_>t8*RS0HWhP8&c{JSFe65iE9XqflG- zyrclw-QAE+yc3ecIS zGvT8d`(TFDT~B1lFRsIDGtqS!V48sG+Mdk~KA-a%O84jNuW}6E&t|MGu7?yOe&_2A zT@@P9ea)A_j{v#r31gA>0p${3Spw~VN%<^8a;A6Z*&iHkU-rh51x6vo5u2o@GT37j z9|T?xO}5C>@!M`vZ^iT!Okb0LU!A8a=c~+l>NY|!^LdZ_eOj%{+b8msU*t1S%`5b7n(bZ7JzpNIr>1BWX7_N|fmIc-C3( zZ4B3W)bs`~_mnr)F@M&lsLt*yRqH9i$*EK9$%I*`wo@u651vvw87$!Q1yYGHcF{(A zrrT+Kc_VET)5Q}Zx0@1BZblM8lpcQ2rvgL<)EGf9_vr&cGM zr!8YB>UbYwZ3=4o>4Xh5k;=>2K^Xf04jiXM)V7uFRJI7(ycc zYjx@;O$;YQ$41AfV_S|1S-+;7F_;h$CPFW~)eUcUJ!SkT3pHMSSQpg~@LdG!-+ST@T8n_-9luke^|m2q{M7W zrQubo6qxvPyvc>Y#AtnPZQ@A8lZJfmMfD4*!KH7gB}@rZ7Zi6+vUD%V?d&gT-g$6A z{mx~Q9OZSf-YcYER>j{d8~LxP;+v}bk1F@J^8cusH>tt*RsAc9(6s8e{ASH!b`;p6 zGvlNYc~}&_1YXdZUecs6GbLHN`IJKCPGpWdXnd7ZB!a}AuuAQ^QbxuhVX8#%8HGT} z%spzA9<@>f${vT|sUWFWst4qfSjA%U5KXn2zDo#fJwy6{tmq0@=TM7*Bh->cb-1I< z2nXa~GGyY7wy{?!|Ccg(%JmpTQ0S^%;bD*Fo^_J1dCtTpjFt!DL^{~(vq|({2q^YxUNlRz*(zedlgF8CgmvnaG z`0VUDw5N0AlD^K~C9qE~8Php>DcN)m-llWxlJTA6mQ3uNaOmXDN#Cj!`LxYN?XDGf zxY#59n_R4<^x{qW1M{Br;^nUQnONa&vSg~LKvR0JwB{^Y zN{&L8OQP79T;cbV8ZI~Yr`Xckc;7wAK()5ty zv6#ufLi=|rGy5KH#altESLATSC#o}Rso^u99o~3icw@ux#=q~m(XU;;xVBzUTR%8_&4a48XT|WI zuhn+k?bbF%JOu^2d7#(13kyr1$z7=2qyqGQy29Zyfu%F)UW$;`9N1H?bI4A>vqjtjRe>>s(y0CbwJN)|z z-_wP?GYq5u@ebGP!tVd;9ah7f@W0;SN?q8=otvDOL>$;5nD4e=wmBl0H`o!h2OR-h z0ehP|@<*AYg)z(=*EuIKvp6f%U+)MGLq?dDXz}Vz!7eki#!WPZ)G|r9WM_@)C>-V= zoGH|;5WK2SX}dw~WF~y7N}qsw-qrL5w&&lgeOjS12LV|u0}ROx0dV7OXyZjU z9R&L(_s7R~XyPg6i!z3hTGM}Cg~z9s`uVkf86t^ zA{1}FIt&jVC-0<=)*lNwgWP$oMB$*E-Kor-T0g0{vHq3T&#*oG`v)O9E}W;zzt*Kb zP#5FKPSEFFs`4Kz{i!Z|r0qk>8zH(}vuSgG*<%p*AM0HHkg}gVh&*`Pca_~xXJ5+L zt8Y{G-IKzh?&tNYNzp$>OcDVaMON&Pz;IYPm8&KMvTK#>npE9oSEwXjt^#&U-0bnb z{;-g}Qg)5rvMW_6#%FD{D_5vz6#H*yl?qM&dR9ZB?O)GoE`YX3c3!M7ez>aK9(2~8 z&6c>Pn^eBtbTqej_9R9Yd(Nh?U8x?7|Cn=Zm+2V?W+c^>>lvjAU4D0`DfikA21RZA zPa9JjeWBXsU*CG*Aw51ht~5TO=S&F4r^e+b+6kFabNcmUjDk~gQ>PW&E^jIXN7i=P z4!l~M|NL-BO;1iMPfzIi+qQ2PZ96HRG1lvI%sQDdHt0-kU8t>TdrRT`vChRVW+GDc zj9!@3C;nNo9{)^Ry4W+C3HAUFB&At0;h^AYZP>%MeNAn3M(05|)UIbh*P9*KC7iSdqd|^0!^B#BGfWzNba)rsoxGQEBi^e_1KJ^euT}bfccr}7 zkj|`@_xhfZbZFmJ^}N{U;+Z~o2@^Q4b)_0hBDEV`^If^mm1^KJRfb>&^V{%i8TW1~ zbIW)J{=am$Yj1F);a6h%Z_snpfuv)szS0UPWf8ZBU+EJfL4WP8xl9R$B|nvB}s$k8>1FD zPCLTH=W6wEk*(E(x0>{XW|MWUGnHSf9;t_o)sf*P75tWdNeI_VY7icG+K?!w3?nb8 z?%$&a_mUVZ@_dH-V%bfh0Z0@Wc}|jkfUZEAEJ&QN<5NWh*JwZI){}Y7k_=H~B*K@9 zdUtg!7`}S_7a?q57$n^J0j+TXdp@UC_;v&=JGa@P+te(npBoh?2UvavapZQZKO;y} zA#2qRYmn&6PH?OM0Bn8#{uSK_F24b1|#6Q(++vO9u&2qKRX@FJEgCQGmN&?zZGUo^i z8R`x`6jWbcquW73T9fd)M@Q2K2@Un?g^i>DdRj(eOnYRpqb(%75xlvG_;(TfBFVJk zY2^+fz}|*YI#JbChZNfRSnxf))#7}htL2zhUEQTlBjDp2>)hhzDN$z|Db$k^fDPL* zmZ!#a6E79w7V`6?QXrQMrnV{cP3Rz-r$$qxQ8!GCCh)Zh7V#Dc`d0!89VXIR?hubdu3)TJDDxyJmz_yR9z71rgaV*FL{f0)rgr<=Lf&)68Px^=p zNGN`hrOTF3pC?x0-U)i0MjW0C%-+OWF|QgNy8jtqS5e-3J>h`x&;3g^?@SMZSAD%7sJS+n>Qr zXmNV@Vu_qhFrz8vHf8bC*V@tZSSMp&^WmU+tP9SFL6qsxvrOs1EVmnJe6&Kj`sB$50y&!zbUehq51{ zCLsXARu&_7iC{c{Udl;%v(&u<44unIxYgXSf*^9|E|h$vo@EMi90rFOm+I|Rrr8O8 zs-0JC{>LsM4Uf6%5gtw0DOBni1~F>u3D^9B$%BLkI(*cH`H!5k_FnnL+4V!$K7ieT z=@{hASZF}J9AWX&8oJe?`b0{YLr=tt36tq$J)b#>!+CH|p>W63la_R^M=) z;te~T;4jL##LNFx-VmYmqknxv8nV1!8g?=Jw(Gs+@=JObi5srI$zj|*&KZA=!aJHE zgMIuCzfr^Qz(kCKOB!ye*j0qnt&|oqgm~IenF+_FYKnU;p_oH_j_a1~C`+bAZLL1{*?N|nAaZ%7rMn`Q5rrb)J=gi&4-ov0B zz-e(BKnLQ;b1b1(f)r6|2w}HLAHigLILmSPxv(|?b8fOk3EU4^F+H2YiaJmBXe>!!j-GDuYdzCogEX}=BzKU^gvhMdRzszl!P~bySpJX~ea5!~v3oMAS#knX< z=@05lCX;>SRGIu_Y(vhW#SMXX5y%8NdOK@th9C-bmg~Ig=W+T|7)HLhI5-nC_&9_A zvi1W@j{@$yxo~6&-nwwVv+j%5{T+qtZuTT^m=umsgQdfT`zlfC2$0A$c!W8gCrI`C zT0(f=qM)pB(^#Yzl&>wNU9L_&jk2y%J6Bgfl8FEbWQ{Ai7~?)Ljy@p0!NbDX8Lv|w zIZ7(J5%NNoZ{nC7Su4*t2AMXN2?#u>Ys4J$64?1VHM-;1rP2spcK<4+ihY&noi%~( zMo%`jb%Liu=ZT<0_pR~FJ)XJ~DM0!aCc)$zp z_uQMj(ckmzO$_2-B!UVdz)HD}d$*SX&ufNffIC2AWcq6&;ofQmAZ4VxFYw~ikO*;tcQA@h z0`OS}fT|m-ZY(CgCuBdE=k<>jAUJc7J|N^49YmW#gqqZUVCY;B&k6!*mf+w;c&Zbu zUBpJKe(A=x;#uxjVoFwKPp^q(EOE_ZO%Rc41&-=l1e&R{rLNtu9!tC!RNQecdib^=tD>f%u7QE#r zH~H!v9wa&U2&a16mxu7-q(P*0GC_X&SNz~*Kk^(SGKcHYpGJ^Qv}s&G1W7QSNbgHS zW`j#Yb9LwrAq)mlX{Njf;=$@Ld0m*hHni7;!Rjz$g3I7&4=x8aR_#P~2)THFP?g1* zg;@m_r1PDVuLZ$cSav5PD+Pqug|~;nUxHw}4wG8wAC%T@H2eVATZ)Pcypch^-PT2Z zGQkWunt?t6>%6ry*~(aduqCyv>B-I}&lzp^R)2tB+ShD`g^r++87GICa=*sK!C2b_ zK|;L8ABiPP@KHYoISU|{MC+B$n|RV&Q5ORj^T$t|g|x`nD0hnz*WY`g8gRE`mBNpto!N zbFIIsZ*}!fV2tf`I=J2yf-tqe`b2w&>W_36#q2WOZZq!Ohfq&eb`9OD?0RE2dUlNq zZG5!O*q=|c?=Q4h-Jp`6Jf-aKi9h+_eVF5pw%^|0f6xDpzIcPO*FUYMV8s_!2GLSx zgU=s{TV7~Y#Fl!S9GD*uNxR1yY#09rNDy=5`97iE5|vSTv-lc|K|&DdfC?Zd5w;O1 zNVk9h2P6#(+Wj5)*1e>N9!T~l-gVPSSmtKYQ1>Oxoy$6r`lrUHbGph0xhpk4yjpG- zu&p_A#s&GhTq-|3w?U3BVOb~aW&kj{dQDh_8UIW zUqymhlZUXgI1++GW(>WIC%9f1Mk!qW4ah9j`FU^V+nxFT4a@|)F%z5t4UT~DW)Ri# z0}|DUtGXrRWYDurvg=*kmU>$N6Xq`!dtJhQdQ$j^XMJ#)=SMbdH?1zQQb-k^wayhO2}prr`VWzLGjiXE?3&4mo-D* z@ci~_w1o1wO!uB|-igAG@ky$GME2vzeiTtu)_*6h{pR!k76CbH(`O{i*$H(PT3{Xy zn$1VsMWzwBiEx5!Ez@`xC!*#A(F?IG^Ev8ArqG3~XR;I#ZMLZ@jT6*+F*bP44i4|FoV`JMZq{3qKm(m|eT&(D05~vI7>M zn^TpRhKK5$zoj~x;EvF9Dt-}+nI2$3H?7%D+ZyeHjYmuHpwY#hcHF^4$;2o+0I(@D z6+^|$O8C6aKBw)z!9I;%un5|ev5irey%Yd=bv%hKvQ z>FPY!EYibO>C~cZoqamJd9J&-y62~9_uO>w&2;kIblz*Fus}BaR5aRTiCTGGmAh;- zSM%Rf@qYz-b2@ojTKynRUO&^nrBU9Rp5|pHvkji7PP z%vjhCrl*3!-l-)8o@n)s=Sk6v3wwT`89l@@iSMWf4ZN&>Exx0xLj~j6ld_3!OCE0! zy&w6ge=7_>zY#_7ADY1lo8yhj{29$3^wwT3R%B*_?bRDrEJ)`nbAY?2+09*OmZ-^q z`cZTM>rEwxL7n|X*`?_(rEYQ4C#TwiCE-^%n(Yn8*+VTQ656$&cf#1zaYMBVcp&QUGSfR(qrE@D{Pi)RDB9){|grkM*CcLOYkMzt;>@SvYQ-;1+V{rI3YD zprU9JG>XT&p9{Q9mLQgR2qEZtJ9_>MbTlMr3GyAwu!|GSs*toqcI2%Dr3D2^lgw9V2&Y{u)(%q6{3?uj%jkGVweFXmq{@Y zi2(PCkhw6>FEF3ic){2!CZvtkF?xgg&M>;|G^$yES?St(lUv*9tgTO~tyd2Netb4}i1Zh5dp z176gL#h5CWxrYYJVAb&4=?N0Z=i%Y-C*aN}uXkD7R+wtAI!cq{KQwl>XBEZylfpPRBZ@WakK(0^H9A5R(JPV?H#3-m^KR> z?el65h(j)}008<2y5`S5X(JOe2d=Xm^6UtaB!Gfr2QtJ9~UW zkP}`?)n!xDQ|;TVN_NMT%%V>>G}r8 zD3JqX?@o^*m(~D-H8Q*iUX3+F#2RtA?28m}sch6EbdRW7BHmEuNyV6`vsH|wb)UvV z_ox{uv&&9u2ZhhJ8c$c??(dP2Nd7>;}5Cn~RzlOnoDai^cEq(9{a_0^q&_Po%;ozKle4I7TW2m&2= zj_{<5^(abv=@H4XKCCY|^^(aQJqFIWvL6u>Bg~ZX=&}z}BY{%;V9I|?YMOKENOkgw zOZ>~rnmA?W6MNm1ch%FA+5EMpPcVS0#+Y<5;qD1u^jl=JM%PLBk5;vk!S(^Z$Bbh9 zdo;gTw@4aySACo0lcCL)k&_MqkQ*1~>y)KjH5B#16TH889GggDdCjnjGk6+zTc!4^ zu6AU#gA=UP&a3qVcQO9Ac-@T9P*w!nXXaJ!xly5sj&Pi>f-UQJ+1X^~xldMaxL!@b zCoe&VH^lLIZ0uCqQLe4Mr_?+rI7e0L8$Q#{@`g47km^-mP`cjMf7ga2WN%bNn(IU9 zmC0aQ20EKU?a6B-wFCor{CLvVd==>c*NP_`iLGYOIEmJ??gyh5IIym9Q|>P(K-A4tQPOn-h93ButDo;l8rFOCH=M1-22A&C$8z>SNv9ow;1e=t+KrNnp0s!^%K z#$zC`&FKR(!c|))=&S*b;<`-K)bI7C)%%rTDRby5@^LjnsgtU+dJucvU~A1re^xE_ zqs|TKxxH5oC?!fz?_)zE-L4+1kdDwRO3+K1=<}j^P89 z&!mB#A319qJ8)>#GohE@%X(K zK^kHkvZ}aU;x-Q#?{ckAK+oTqRy>g$&^rYVPGwz_gUL9|yPu!!xzLu+!eM zgZ*y(ZZ*63tLPJycu2?TWdMGhEdR5P|KDo=@bSAqRmUe3R-+LF?*wgG;?%v?yNvU* zrVhRB_bcYs3eeH-^RwBYep3a?;j;Z{#r~{fe_pAX)Q94|(SsG2t<@DX#3jwv5Lzqd z9@F7A8ZTjT(Bfdi)SWaQzwAC(u@6u_? zRuTaQ3hcyiu;O#I=%9AVJlQTY|3eBY*7Lh8+@Hi8JY|{v!I8wY4{A|jdzG2&1SdGJ zGwApd#^Zyx6SwR(;8hW8n(&&jr(h0%fEh_8czn`$P5iJOq=Pio_cYX2Mqd0)b^ zufSM+3DW!_%fE!kyTG}y?SHydKI+nQ)Dm9k#LNjiNhYN@R+sglr@BP z1(&+c`nEdVU9^P`-Xo$JVWLRRh_?|W*v3eQRG9(+l0$?>_ew;Z4WnWTL$N&iMbSo~ zmp;uLh;TVk$Or29wxm0j_Zm_Uy7I^g_$bL%%UkV8$`>#Ye$-}L33k-jSn?kI9gz=V zHc^WA=b0g*X|*#m@mb_GoNR`5IfBMrBqi&j|u& zRYxF~?aO5#wN7*{k*mmZN^dt6R4%4{A~c-Eh96^&Wosi@*`-=%JXp0d1awTg=R&61 z?b}ie%C_|m<=oIw2j@>AEWFl|db35p++ts8u>jE0sGy7SMJ5t8Aply2itb`A08+85 z!H1g=8KBPKMR#6Q-<{IuINKv!NDL9TjR&9Ws|reYD-Ry@2Y7J4tu1~qygEPX$p5{i z?Vm0BuPye&>Lc~RW+1FRPQ=i;)u)Y@phRC7|1q|@K!=={)FqR<`B(HBBu;rIcTD#> zpC>Pff)7&hT&0sOTjbYU7ZN*F{sOwZ7ExkT7V5ia>!u(iw zy4y=`cda{__jRy+Lwp{9x0_YzPb&3CmAOSQ-x$yRo|@i8=EYdo`aqeJ_(JT>n-hSq z#}y#t(gy12WJ4Qj)^4QcG3eDE_V@-9g*L3m zg=12^sg_g%@S_f<3bHSWpaWGlT9@`ioUL?~R#Cpl-(pjw8^D3QJtM0O5@)!4p|sE!^s-8)Mnu^JG0KC*XoSJ&0+NgmdAZ7b1s3fw9161Au%pD9DG;D{ zW;zF&;{&7P0}|tG<%%#nh423i@Pn?ECRoMLA-*dSt_vEsllrMnec(plF^S7e^pTFq zVKS<*KKhGm{;KmIYQP8KhwxqM%ZaUtEFd|O$OhT|=H$!TyrPRJW%1$#pUW8H@w_TIUSHE zol1A3Hc^=q}#Q^+2$LZfgT5k9Gs z6ZO%0Vvc)(GVlXQwG}jJ}iVrfsaqx1L3yTHI*yZ-c(1TU^s}d{oeD|UJ z@B3EgTb%U#a;20cht8Mdb-K2WN?)z*-=H{no~j=Yf(nk)`eW+k>{D5`W0|q} zw2CaDGMVI1{g5B%SDZg~MY>)#5` z6aRnCpb}b~k1>#qG;Tt@s48!&gsh`C)!~ye)7^~hds`)Boqk&#J}ooDEyzA1#AO|A zQipG!n*%2=`~IR5vX1_u4xgQw-?&3&LF3N(MeYdMw_Nux%)GP3uH-qMYsP;7oyt^pGT();;y%5^VuV}oQ?1z3{Y+H+0CzL?)rnx=hdBI z+>IvKKV-dimyWjFo%7eJhupUJhu`!AlYQST{lN6^pNo8hjg8<%7b zbtlQYU#$C=RR@K>|8QNkj6d8`#zRxfDBtjqLqFg0KGh+o`u6fxQ~t-g8h)GVo$uUo z=lHGv)4TuQo&BG_SM{#{r(bGIE&RW`U-7%prNlrEm~>?%EdnTFB*pZPo)`Z!CjMs+ zq)~?8>XBVI@`%DF^ofeks~y7gY)DDiAe_JBM~x061p@t~He&1dPhS?-N0_fJ*7W9E4M7=91`SpP+ppIbNA*x-;0C**_;U+nvYO4*feNcMKP7nW6enCQI1M z?vczZCeaS0B%nwGsjT>K2*M1oM$4hn$ofQGK(3sDx@@_*lr00qVE2f+Zg;<6eAw-F z1r)NcE8AHbk?mZk_GvpPF4KY8gO(oHzm#}J!jELid4~LQRZ#*4MAAL+>YAv2VQqbLZ9NZ3p1>3DzpbL`e+|{uLDf|Yu_@U@ z+jJ|rnp*#aT;1Bh#;dArR%=UJsdc0SItap^q-Vx>t$}X-f<7ra&Obg49F@d3K6~|u zY0>oEbWj&zUF9q6ow?u%J|+a@x@wv)oUJBkt+Z#O)d2)sr&>>5@wt=@5v z?jIXA*X)?W5GEZEclUJtcMWoWTorQsymFh&8Mur#7`mC`9E$!2A(8qMjzP&pKRqDm3XTa7r|V6 zj-SV&*vvyBJ=;U8&$m*Ts+0yuI~DS#X!at&3$^%h6oz8g=^?(N_9UkiMkZI3#n;u) z6w&2)?G_Mh7T+L|H9ST>-;laj*USzHF*{_>ah;3dtR}IO%6KC+%AMX3WlbD=A_GRu>OUzVfBA)8)r=O!7QWnt+-CIVTagBk zdsxn@B6C&)PN(5)a>v)!w+!z%cNjfWS37dy@Q$#y<8E8qxM>*PQ?BiJ$kaAI7(SAH zkASQEng*u@?}q1flMk{JPw-$+dRB*i_Lby);zh8xYczI#?+kF0c01N8L-lQK; z;ZKPrCy|6ZnlQ|MVxZB|s2o=v!~fkNQG8IMu)wG1B0OP2C$xpPV=fH zX}n+jGJr)AV|!PNoS>j$5+u6{b1k zK-T@L9VgE;+;i0kp$4Eek@US2#I4lj&h)+}ltQEi*q#t4{hZQYOw3BZr&GISdnAb% z9%z7e3|E*>j%>_YN?I{>?zKLH^fOo=E>7KbvHCD^`^BouagL%U>tao)jBQ~l@DaXB zh&3R@?i6~Thkg=Ib|*fAB8+twHv4;VNrr9FDd9(&9OH@P$qDR~RyB&@XhMuG&`BJm zI$2Dl9g{phb(}ul_flU#*(L)Ml1gm9DXO$wP^eu%92u;O$@4q>^DsdR`>}78he>++yBpzPv+U(NVlyZgQ~15*TwbTO0e?OkztUJFMJ^5oGWO zY9J0BsFMhTLFXg}nodkGSYQUtn0_eLhM7R%B%FY!DCITOGB3%%8RwpM1*3<*iWB!@_u?qgK{P-8Pv4po>ux;CRL4O@!eesMEwuwzh5*-Vj zU>ge{OdRS&-yIX_y}0ft$}*B&pn_vyMNQaa?J?cQGI$fXf#3GD?uL}^qMapqUj3=| z>oYcA@#WyO_yY0fbn}C(V-Wz(SBR1cAg^=;dME8f*PmkZ_M2+UrN;&5k$BJU3!hbY z(vxfLLY&xMRDi6|81oiiy#7zh{!z*6RSTF3*qih=s^~4%`!@OOxd?ngi?AuQm4t&Z|?UXmC@f{J$9diSZe9V zpS<<{g<0JppJ3O-t>Wsb58hD0n@XPlfdb6PJHxtYTCdjbHH_mU#s+i1lymeBZEx4^ zO#(NVz2zEcy$;#(-!Ywu{E zOZ!L|d#5FrjBudO8N>oU&{eM8${A3An5Y2lOhXCWt# zVf-P*I3Ko0HxL2Zt-eUd5-QAq(O*QHHg%th*~zgk5_fA!Co)<3W6+3cxrK3U1}re3 zjaXpg_TigLxaqlAw!LICsTOA>ngPE?$?nAV*$%9Jv#|t5m`r*zM}qyHTr3sFus)P! z5z9U-h5XFiZ(We$(2W70vi?{>`l>ncz_d}F`jR+QHmSeq+D21t{fFTlrP_{o4g7#? zD~Q>QZ$QXj1-R$yb_UHJqJUE8nR=7F5Rkb32{th`bAm>1*Xvw04f55GT_KUm=#ErS zgfxj>Ho*9oDra!0r4A~M=+gvpk}4_;f(&s7marTC?-;-E|YoZ7^4)Z(f{h25nL z@MnxBC^<$rT(0yAt#`%vJ=^_QdE>dL)%N;~{UkJMA-ZJFjxzi)tI*O1zBGSxILjqZ_U;9z{%N0HjyvLfE%-wg@s&w;Owg z3eObVEgHo+$|w42aw*%SqitXUt_0;^-_H6}(B)-ISiC}T2(7xkm}O5BWWw$^uNyfS zK%Wi9{a6J*Q)7SwJx1L(A;mSO!x6d$2yT|nLE+aKGr1a5yyxp?$tgLiQX6) z5c@w%EWcH;ep^xHjd(IvfHZK&Fy=A#fx=`=kr`Hb^ru~G)5XvI+BESCyISw%M7IF7 zR6qBfa}DVxkv)pEJH|VUrvgaXPWs?^!CrRnU?AuS(!pH8z|q?f4Py#WXgHwP>+$+S zTyd!px^py(cmu`D)lItT;z)lxtgT%^H+(p-mH^=CfO?o*gPz%?WO}?u6qY`G=sMW5 z_6#|14-$guAP4i4z`ZFEev&-0aE6eIy|y}c54*2KWu$@2Y*k9n?q?UL_X`$x?{5!? zwk`D8x?)`Kc{6*Q9b^{jj-N4x=E`_5qMLGc)VEu{1Es@DfW)OB{>$uD{UTS$0Jkp) zo%aQFv9Icqu$r=7z+kr+D>^8k3$=Mu>q}f17eSzyL-ZdwK{)dzh3B0q&@_==uWz_Q z+ZVr~y&JAm_N}|r{^UQcRlcYnL;5`^aA?Z0T> zfj1{YTqjB;q08lUC!sbGlJ0fEn`luxlSA zv)NK({|Q3Wt}q?{L<{xN*d+)lX$ApeAQ~N&JjiZa=&_?M!N!b~VIn-FTC=|rFT~3( zlipcUqdn*vyF=NsKL)X}jx*$%g-F}K!A$_3Ss$urWVnthHIIjm^D&&7*AOc3(vMVn z6~OQp-%$2eLX!9&zv_9&DHwGc>78E!deNcQRsGI`mx;t!aiX6nXBA)^^AQfM4%}5E z&B#qg1jd?TTcIoslqrXJCITZ0?zJK?a=47+1h#d)*?Krh*U6{apkEAX8%?$KjrJ*h zs1v=CVitVTb*}QJ(vEj+W+3lKFkU3xImtvRTQ34)`aH|1K5{%C2~`Ll-}wKTQ=hOF zY}2%9IkWWEGeyYAq+#G>M z_26N2OSw!xiGaJ9Qp&V=l7)RF0GXsmJ|;c#^Feeeo*UhgfV<+0!PgqUT2D8`eMeXB z)XDMb-XPU9)s`6)6Xi)ks&fHR8Rwbw`Nq54rhaSf&cUAcU`iOYC&N+UZ)~&?hDrBj z>%MN2uUY#F^KspNL26*Wos!_Lpvijtc0ceZC;AyuGBzyxw%LxL;}s6AHjR&^LF^4M zbw@r#8_nd>q}oPu%@bm^qrj^}^qHAaj)dEJhV%wq>Nd7Zq_fl)jB)_Frfyf ztoOr$k~gDmn~iIaYH9Ny*1>dlhI=KG`aAx`C)?$VskQHD#PI{r?bBufcj%)N?LOOr4H%kGrwouALRFoPkrFK^BD)YNV{1V~XxKlve@? zkwNbggi~8z>=n<&zh3ospuxEegtnyVU>Zj^3jy5JMhs!1Nb7_+>SuuDWtb4d+rgw& zU*6SP4VE^qXFn7B(kgSks%=~vZwxr*{Q}9C_n-=lBxNBai1g#g8dmSy-D$N&l=~t8h>YfsXSWX^k zj&xtknXfZ(=GR`S?aJNl@<#jFD7$=_|K51}Qahj2ZfdaaHQ1pdA*ptGXg>>1M}FL> zV{_HHf-RvTG3Fl6R+cd_003PwGtg#F<+CPX!GgR8j;urC|Kc-%ThD^q$Fdl&m$5a= z8!ThZThL~N;3q}6I#Qu;f@v;K2)-QumT-Ru>eujTsK~-GsLJZ=(zxbJZi{{3LlUT1 zKrD9^)yLzFh6fePrbhN3NjIab)!NR>o-`S~%CxRD^rX9dlB74&ZQ4L%QA)6$@U;W= z>sI4{o28hus@6F{Dp+E3ItZNs;fN`CIvT=EAi|4GjtI)YcqW6Pg7gDP3|v7pQifx` zR0f88p?r`pbPTgV7FZ)ZAB$xWiF?^(y6)W`$^a)dBX_Q(n3*-i7X z^FR}@)_c)g10}Os@7zWCFXIjK#aMsM`-_d#Ng?x zb>apx)!X!t3||-6WFmW&RaaV)eq3cqhX$`qi4bowZXWi1YbVnO8@v}JR!u74Dk1b* z6bllu74TS~+)PB<3zOk(S`32N`Z^%7a4rj%pJqSXAy~e>T`88m8RFl|8OcN|%iivO ze5}Adk}i;p0z{Ms^fF}x1Ti)-gQ>>_1Chg}k1YQ4hMFSx0_polv|wt|J~8w8td z6X?g?)X!aJQI6Ku0dP4gFNc6&eg{xA6ZS+=3jHO$hv}oaV*DXIQ1h9L=x~hF5!RnN zOh5rV{e&Ar$O5~vCG_G!Wt-A^KDllXS(IJ|2|!ajJ4_w@=pRZi)p9)T+4m4udvJw7 z(8lXmA79btNw+CkKm{15TXI3uY;aMwVbsaNDMS`&k|B&ISjDs7BPRNPxb|GQ9@@FG zJzCU|7=_seozg-O?Tz~P=iFmnp)gD{6y*(0`PbXQAMluYQ|Uv1Gx>Q8ew470E=ni) zDU*S1$ov*%$=(}pCm$zJXm@?E1}DWgt%G`mV)D3#$IMQHRT=9HN&NbfM!1?s=X$TYQ4b3M-F-Xc!Z(ERd>R7q zABGP-E>hVJ?4gTQH{esEuR3rZnz@qX3hIGdmHCAdP&Rp6ekSAsZnHPZ?Kj7%C)f;j z_wUpCWc^+3ZYLe*eB}}7`c+R4w1=!NAgt%bU-6~p%$!eaYK$*s^yl*Yd3OU$(27WSaTxS~YHXS5(^tMtb8{YFMQfgy)b5q)+NvLS?N2}Wpy zDrtM2@Pj8}5qFb%bT~T1lPD3QF1~GLgD4%sLnb(0KX$>8WjBWTJl6j#=9rwflYJYm zI)+Y9?b}pn+>0?OVJA2n(1+?_uus^l6X7)pdnr6a4e+MWtCbDHw8imk@|ctB7$<>Z z+d3rT2%42P)OanZWOP_0V-H}aOKlf(Neow94SEwTT>?<~3-th^x)BY7DKrUWdRs%) zA!CmJvygjx={J@8hVoA5>!rNOI_P9L?2WQ+2ss+fsTtl`JimxtZ^PB^g%heWH+JB; zsMoDn`5N(=m0=~Rqwiz80?yfwE5A=9cQIc5NohjZDnP#RYe3b6xbUI(yTzIN+h@p` z!c=BS;FEOo_zJUVT{&_iz70-NWl?B6yD!M)y*xw#x2k-v((7%_mUStSRz=4ndFV54 z1uB;$!EBOh)$sg1bwgTeBcMjl78hB!K8GBHZo5flcr`^VN~vBiEF!U?iN?Bww4D7p zk5D_XHccR0;8i(X&BsA!^fKNtS8Yi%2`ra4tB7D!50^QU-Hy!Ham%WA@At%c^*j5| z1HOfey&5(-_^#L=)C_O?7RQ@_yzB0c=}pK1W#p#M8}(NzY%~iVtamYYlj~1tkHy=a z6BiNX8Fplir|F^Sexy)vI3;f`){Kh!p9j#MCx~l(_qe$(ox6lbl5r|t^~b*+zxu@a z@%Ehf_ewcj?|ARHO(eByA|q8(ilxFr<`T9iI#*CoxG)OVrb3QH#5uG02xP$Qm_J{;TbTb*~IRZ1!K zhEDzogR=LYj^5TM2@GC}@_ki}k{gK?rJ1kQ>N@y686exl=~wy#-FxHpGb&1J9|wXBhi8G zE>-1pZY%d2tb(<@0h-caQ=0r4LE|LnOq^69Qwk%&Pj&idI{dK?9%gJvF^tA{*ZPp^ z&3B@<*mKA|W!ekrROx_$n&e#U;ao)n9&DwhHaT8?8#UHU^d|VwMYlUwaC`GNrD${? zS?_Pw|H#_Ek#D8O3){=BlS0LisItONr&=^K7cVCqk?rxFXN=#T;xF$U$ElD;B<7RT6OMTt;3`5>7foM(VnVx`1|2HY^l~^dAv8yC)~2# zd6hfL_xQ0U<0v$5n`^G8T5}_YYi^nt8p+eJxz?7>iu1$2*HG&3+mk6B8VbF(p-(O9=pd zG_<^|Fv$=SH_Gu`=SRNlJk0XAA2`pj_I7aImgt{2AU-b%$YPmfgL{#EN@S3Yu3&E# zJKiO}^SeaF%uBX0rHLZnrh-|)Opi9wPnQg%mOeY7K3ix`^y#2S=Rna^LJ{Iv1uMb>Ko;)t9?vg@HWsfFa&))a6Vsbur?Pa)W8(HtHeMNNCOKEFW^jPdE8?apRNmr@!0SM4kh7@qE9>;r1J3q=v za12$f=a}P}sWCJ&XAqhsBZ(-jd(k}l7%5Y%nVY7FGUHiJ5PZR%%o*3}9~FpH;%jbF zM~fgc&hc(l&Q1Ah@!I0zmFhvPN#bPbohMN|Y+Os|RO~4mqS>T)8`QIIZ4kw++3R>W znrd1sW>PRjrUO4-vp(3Xhpu8EkvG%WLeYU! zIjY@u2q=@N46e<6qTElF`9%5ra&77i?VbsiQTs&O;--ctFllgW$>%|V#dMhzvVDuy z@K?$_M&}C6w=lc@N^PoKqMovLgSErIesz1358E1zYyppx0KDo;$(y)vG&1o4ttjI6 zHY7GYPO9Qssf7{F;QrVI>RGnO7FK)PBBa&BCI5lY5ytO(r;hH5OAE@5(qd$llKRLQ z*DG@MP{ao*==BtFbJ=WMDh#jtQz6xd3@&0EgQMK#9$7sUSoE3Ank*q>#Tm3GIqQ;j(1X$s%ANXp7(-_vN-5C8Q4yqdZx_$fR!ar>lv< z_y_d1KOtjKJh*fqjMm3XHQ6DzYytQtY1c9Pt@2;Ut@QcQL;iZKgYky9+D|y9`F!P{ zr_}jsEV!NX)!g&cr*3^|xtjlVx52wi^|DG_rrN6iO{%WCzOEbI4KGxK7pMyn8ChMx z4ZQQv$!=238Rfb9F8Z+v9ya4H&$TlJEyNBsjv?6MP>j6RXc`Wf z{q*SZr5Dxw4}AA0p7(v#%f>n{al2|`t#=N8%9#(^os4f6MO=?j51-E6rYjbpWu_^vQq7SX(?1YL^ zRtFp0G2hVo9j$jDD2wpx0~89y0SJ%$Of$&I-&C2C^Is#jf1KW-u7&q@epp(>2W_T( z1Hu;5HvH+>8Qo7^!kZ_WJi&$#*_bXxXlEY9Gvk$En-FrFY`fBR?}kl-jTh>c!R8AD zNnBNKPdr_nz^7WSMpRc>5YmP~%n#9f#1_>9Sc#AtQ4P!P&92y4duqd9w3< zwf4klO%1QH(cKJ*y(`Akj&sbfRi(Az@N-pP)bed2)SR0DQDqU?MQaUG*SM`$yIH&U z-&Jp<=Cs@jEW1g>2nH}niA*Vz$c`tE<7BksIdx1wGAn;-XotI1XC=B}MIVFZ>N!Qd zxt#(C?!z|z0k!>WrCZhEm@-=|&y{96Wbag~fnKY%z=UfXi8WB6m}T`HbwvvLEV{y} z<1bZTsV~*tZ=APXw8IUO2>|DXs+15VP3NzA+2N;+y;zOjsEyX+jKxE0jqwFrhwmwCQUGMJA zcAdzB8{EoM$oFQG7|r_dum<6I@`Ho_c~VlGLZc-yDUybNl~L)wn~lE31UJJ5LI^lw ziysE_Z-{qza}nT3G9ldm(xP6F+yFIIX{LULbU|9e$ES)mF0qfWTRK0n-vxqjRkQu* zHDzA_X0!SVjUpgr(S0=4z&%fXD2ueT4d(x2?LOcusp`hzpWV%FvOSBSkvbqH^w0we z3_VgLRD&Q6JqT!|25Cbz0!jdZpol{cO@e|%L>&|*6g7%ykTx`p6piJ9MN!`G$=(Zj ze0ZPt{ro@w`S9brbLO1iDKq!x=H`}5J-cPhm2ba||JWlmoaFktZ@Tp!@ius$uG(%% zXU>`b>uD=J=Cg*HoA&T~{PebePFv=!X=}`wxnQ;U^z)%s`H1GG=EkOm*$q21`qR&X z=ElAJF{(+~MoTTVTIZ6h=Ehm^-XnhXug7}($7d>hU&zhVr~i6dqZ;~}@jLg}C%Hk~ z=Tlgoq_{;y!)3=(waLMnR8_w9JVfFCNmiwikvNy({X4^sjI>dfv z9AnP5gF{F>DDPvzim3s$A3_g&`&l%($Qay0IuBK!gG?C?lZRa_ImF<>S<~VAVHWjp zu4Li~s-`3CGiA;`793^CmTt#9?&x9RSCSDXZUf1Y%Gt||qs-a*Y4w=1GFk|yE>aQjTEA}v0--5}S`e(+L&nRQYYAx%< zu(ok9Ve(nW*u#P)!#djaaDC-0+w>dVK>g3rPmo?Fp1d4m>UXmCW9@re$v||A5Eipy z=W+752ODCtt@S-#{T=nmyu-soX1nR{1m%0m%X}YsS?+6{PUI)86Vn6bWD(E3=PvSi z4wzZ%(5oK1m|Ei@Cg#}eQDdBA4>NNZjr+#j`g!$?sgH%657FQ@^Ibhz* zue6?LI{sDb8NJFl7_K&sv$VNJUZxCZTa)Yb!En9xWO}3ZJV(Ak%fjkr^JaRhc^gym zO?|N77}Fu^Y>d^N=E3sY{vEyBIKH6%cU(8j?=e4C!`k%e^Iqd)exK`>-Vh5BdG ztbc|@`ghIc>|(Z*{#kN3mcMVB-y^kKTEEd{^~ZcU{kS&E7362O(zH-AXUo^rV-G71 zF;CQY4QDG)3t4m(`I)quU)*Q7006M zP77^?d95c86IM*w?zWP#pE<`_Fum41IKYY%Ox8Ewc$;Ful8c$NO$(jZYtKQZ8(5zk z^tYk)W5FWsZ=_%58|(K*d6~1^#5kF5YMpLU&K@S4Stn-g)@e{Zc0@OqkHr@9F??7) zx8;ic3|pB86Q;Ltd-Gt%D(>&7{;l@e%Va0($AYc5+3zqeX1f{}3%1;@d^h7_%8}^a z&V&1koZT$F>}Gnab!5(#AM58f^;vL) z+3n`u;9+YobISW?I?{&UM zlzVQipC!lX3r<7&5PzgTi-(jmdsz9yeAN0f{e^Xm{>r*MqWy? z%6#Jf)8_Lt=Y_q@pD`bnZ2h@@o;4qqm2oq9&bWV}KlU(vQJ%Q}l02j8v6tTP8%CM1 z^_Pw_XZi^1XbIboi^w*ObR52k-}dt%9s$L0IG z`7?Xn{F$@!H;%vIdSSlUb@5yK|8QL}d&{~+|LwXMlkaWwVVE&JjId<$6UrN=hc1@0 zriWn`P18fm?>J|A=wUureJ0J*L+g`VW_%3o#?5?l<9$l<;>Xp2Og+j`lDMIX2~#a9EY11(<97_S@-m?m^nND==hP-!vMpl zr-w17Y=Tugc4ICMP@2k|VMF^Va1x`|MzPio8rt zb^chLroTU_cZPN>zpR|;Mb_cZ`eDYbe|i{<`y6MuM7s&~*vI@b?U-C)oPUv*ISU^N zTe7^;IR2{q>+&%vtW)$F<$rVhTI<35dgqhr4a)znpBvR@!C{tz*89JV=Vs?KdW-xF zw>qD%Yk!;b!}50J3`6p~pO2JZJ?vxpn)Acz&(8NWP8dIvzZ(B^ z$N%Pb!|-?O%#!|qV-1a)$s5MUu-G~`xX)oX^EcIJ>0=FjIC#i?rf?6_X*0qovl%l& z+bsISWN6~>KJ(>fgpS$DSC|nB7AwsN zi^W3c40GlE(2UT4SATf>UX~W*3>U6 zjNDHMyxynXw&ul>VQJ;t8-H|%8KGpg!?xgXY7+w{T1_z18}zrQPlNWA;tgZ}bl9 zwYGM5S}*3`vR>=x@7u~*a*)|Q#?hgtm`pzn~%Xv*0+h z=7x}N$wdvJh%Tj^<@*{!$5z@cqnsHR$Ndj9gwCxUZ)pfaOg^Zb>2eLBD|LJYQFYln8snQkIa+-LGp^){1- zDMwkdb!X-64WXO)=El!*3+uj%d>=6{hAn-|Jaabhs(dT!6WvxhlkJr6rX9PPZf|{< z?9dP5N|6|H`GH-^RotL=3i}Ky&+0}Vu!O`e$)~VCD*~9E(=E0K59@_109xOQ; z-OD`ol=tK6v*ZYqF7@{^?)|I>E0#<@;k@nb`2Oa>aDem7icR}C{z>zWeo8sR!REKG zJnUq0sQEEFOrDP`XBWc}>ND$>r_274@-X|f`YeuCe?R-jxK5*=HE&iNWzl0EpOF7^ z){!Mk7RNgu`zt@e{8(|A#fipsfIKJZpH;8xo5iWFSC;Jjr1H~zh(Ghwoe!4mIFPye z%+FLmdX_w&;@RfG^gQ#(D&2g3-X1HDd#~AM&#>Mb$>&ui)pV5vPOBM`wS(oVD#`jtE*v;@A<7Re`@*exc z`eDvd7T;C=Ir~3!oiHi&ANRSK*^l*qtZ{IV=>x`foc*6V@6iYKAALmq=%eZ%Z(O75 zGx#EzaTaVnLH=Jkk1Sa+d(8dViTt(ejRnV8K5ku3(*8Hb#f&2?ne@u@q>+bW8|6czr{-}ReOit0ytMV~p$?`Spe5&JrmXGCx`OxQK zh6(2EIL-dw%s={f^Jn-k{hZF%^~2;1<73LEGnD_sd1LY~>&)V9>zO+qW`-_i(`E)A zG!pU|Gs9vg@1GgcGx>p;p^ss?nPHsi@-sunS;ogfdN*a5V8M>F)n935=x4Qx`pj0F z8QRWqoPA7NXNHRT+A~A@x#q`y=If}>Y<>Nnr+(YaFu-gB_2WLND9y{kY$* zexLDeJ~PDU-cpuKwwM{h7nOh5ac1me@e%oA`Ia+7>-pSjX6TM?Z9Ysn5lxNz0^?#& zbeoy}F2QZ(y->f~SvMv-&J05gJIxF}+Q-ig>%fwe&-HcaFP86S{9m>%yPFr2J@vz| zxB3@3&OR0#VY2Vcko4PUH!BV@d|W#wY`<7L=FB+4oXwYL$1avEm>gi-m)ig2%#bl0 zWIoKenCZdB@fGbps~=`P>R+Z`cCq-Jc``p%|4fh5|K-Y$*FVDvGyUB`d9QI_!INi( zURI|$AI$Tap=Ch-XIf8YXBjW6v(>-S{yE0Q^jza&^=0$;s{M;*hEA6K){Ws3>lw>0 z)&JMzWk0=UJd88B%=x}b`^(Ln>415B-8k9B{7Um+`Zee4YIzx-OATMwZ`{9Hzu!>* z8`hoK^~T9?gK-w}vX|jD^JPY_@dy?Bn19PSqIVnLwfv6pF}X*57EG>FJ}eKD@6HUP zEa|%mLwT?DWcEGvS+VT~KQ=E`517|Y^8duTF?rDWWcrBm zLFLR?a+u*!^SxO;b~9zkjNumf*v0&3)|1)KT`x?3q5M|uM&)72=Gz?qz4Ob0L##N# z{12|L+tp(q!z<1s)7PxiH?{kVbz=2*>&NtU=kX4C-f-R--js*czvUT{=WXMm&qfN1 zS+V_2?WWI~e9k$YF)NJO4_XN7JSESW4jE3|w^JN7VLZdMp&#^!s}TV9^%3bVo>(-mihiMY>> zVdM1yKJhv3B$?%JsLEG1{_k=X<7B?7`b<`z6*}+LzI9d@Vzs9H-_y_9`i-umUl!|{ z=Y86(H!Jip+0Z;$Zlb^MYqy#Hm~3I5%-Hz@3`ZLW3$~6ZXAiRzl*j#( zls}~2=hbI&igFfgd)WS|#=&s5d9q~3Blv4_cp)`Jz3U)cYWJS;fOaFINt%KO!4aj`tiE-~(3+GjVtDJ7K5 zFO%n2ywZGFv80bz2`!KDYUND6Ay3@D)_8txyw{s2iyN#rvzuLqkE?f!^TYgBYyXJm~sjF0)##`nDaXN`~5AB-dJ zk6WJ?__FnkzA6us*PO2x`6uUv6-QZ2==UZ2f6;IB4fz?~l>hhI|3iKzZ<&AeU*`V@ z{@eVSzO7$|X^o+C+_*T%bb4cG`lEUcjiH-4ONN<^q4{O&$1WC4jbVtnk6T#GWRCJz zjDthbxyo5AQvRyrODSi;#SF{n_ci4$%2~1bPx5_GzYNRimla$7Y+TDXh92fCG=@=D zD>izLN4}LBLoZ7XvEn#G(iqzQqCR_BaFk)?#?bm#^_a6*r7?^#`H=d5v(G-}t2Ty; zVYSB4{&)Sa?v1%DIKgC%#?bL!%3B*l!DLPIV#Utam9J$zS+3m}-(ToCvqrBOv3?w8 zzMgq4c6@!~W7xp>m~ChrZ*n8!VA$9=m~PtWoT|?OW}6uYlXm0yr+zorAG0m=_m=t} zRvt~2vt;;}@o!@sOm?!qtUhWS|K`rtm&wPBgC$$vR=&G+V!DTQVzQ_4h3TPWKa0Jr zH!HSIn;x=#jho@)#?73q)49KLRvcw|fbtpk*~jD{d04QcLH&cRYxEH7%98Cf?H{V& z=;7)!9BExrA4YPXbm zvYRPOmTd7i*NQz%t}=e+Y+l-Nb~63C@iXH%3#Q9x#{ni+>z^4r-tRaIR$R>F8}fX> zaSpOzXmOlfObYX0M(-^PIWrdY^>U$P^Rnu*o8cPcXTp}{jE_CcIKrIC^4hbPB}bWE zXB}2>oP8`W4O7|bGh2F zy;VE*GvhdOrfX`)0ft-5pD8=ma-0QAE@s8fwH?3J{26XD&voScrg^fs!#r8hCmQ(s zsdZt(A*O6vPkm-AIn4Y{_1D*)-O+DZ7lym7OPk~DVaX9D-?1(m$irS19A&u2x@@R_ z=1hjI3p2KDWdD2Cg#|07_gR;XwfnwuCM;R}K);*F!yYC-)Gsq8o2p;xmnlb?vt={& z*~4(Z`b?O#%g0_;9A)w& zDLc2(j)SZiwl%NEoo{BpQJ)2?xc`LtZm0cI)`vNV<1)2jv~|v5zGyhH>liQODWO;*Zva z71N!yf7!Y)=L9Qu?4tfF=Ema&V`N#DC5B)OX zC`-2PuKb_o#cX<$pV7)^G=;R24NYNyxz8b=V8ymQjAvGpzb~lY*yQgE>alfCd3{@6 z&UBGH3`;eI_Py-0pBYOQoM6S)y|sH^lfN^l$3B)VO<|bD2b;op+-I_n`s`w|tbEKl z63ZE11CuVNKNjp^SiZ^MA@s|NC0jnO{R&N?lR5iXa5$E)Bu|$->|n-z<{V?irv2ni zv}eHqRvclza#LvjgmQK<^Rev(lMk6kbT#X@zvIlAtZx0{K9d9VyM}SIV#&N!zE7&R zW>d&ma)|j_#(ALnYa0i{I{IPB3FhlMf1h%EJ>zFs-~3s!Epxn0|4cW~Kf{LlKge*8?r*~OfFEI7)NEk~%&jN!xP$%G|SPB3HAtvx$gFuta#_j@B$?CC#1^ZaW;|!nF|L4_bH!}`0 z=QsfIM8vXY(G_f_OajyOE#URK06pb^M zKgjjKaIk)uFwM2&04q)~J4F67?XzHVsOy6TJI|7jgRB_NcKk5smnnxB4mZwolrv+> zVU~>FG!u?6Z)Pl6u;o1E-Od+NjxcBP1^Y)@e`XwI!PY+YKka-m;}{FJeNn$hnLkTb z%#Jbt^VL7j{8@3F$?@iSf#V!x!KMoxXE*Z`jDyLE`umdO>|@D_`AOFA%f{Dh{aA2< z;beI)l81v#Pq9w@>a&X#hnSwKzl)VKW65DwY`(}7JUb!EoZE7UvBx-#b&OSTQj`vvo7=rez&Y`@a} z7p*HRjx)Q!x_s3>2bg`?^}~XlUsKM0mKRws7X8Yv;>G64{8ID$x_Zo5e8oKDJ{L2& zO#Q2sbCBuf*7qC6afS6|Iv_tYjx)c~cna;lYCKG@(l5(vou_NGyUuma;(Ga+-YEaI z+HsHt!*%Mji`h-a$%;+aYd>h5OgPMf%{Rz%v-81>B@4FPC=YuWZgD=CGPy}U_A=b+ zd@yJ0p!&>Nag4>?*8OJ3hs`JYUGrgazj5Cp-$TaDjPbRg#lyzU9K~7RP;d4y!kFb{J&QI6E|bSN^8i zA!D^*_T+12i{{y(`Cj|%X1Qo~7-m>X`S-MA7qj=x4nr*2bf57ptzRZB`en(*EIv3p zw0~dw{KA%=WvT`XACSD-K0h z)$je0vpJ7wuX2SLdwPQa^jx*cLd`8$lI}EU7 z#jv^j52??b;luLBeYQO;-`4UlPn}n$+gjg8jJL!2W3sb#d6c_a7nVKd&-?`Q{F(kv zHcyr;nS5UP&$VX{i&M;>;Z*bgh5YPgahh?&{nL$O)bTT%A6Bg5{+Y^u>G)a3&5~8z z|AKk`O8Y+ZWb#GhX2y=k)VsjAnP2F<{aT(&oFA5#8V9QZ>+!hu*Xobu4e~O%(YpRd z`Ayb?+4tmSa-Y1vRsNv7tQf}Zk5~_epSez${L=OCgm&y^cwBwv&l$(>9DiOOX6$3h zDwe;X-zVkc0K<#=WyX%Dl(S&T#Y|pO|7q*MoEb-$v-uhI*vX2648J$tXSHJoQx?oP z&YWqb9}X~#>xbDN&F?woFFW6?UU6QZ=c~>i^FO(Mnf}>&zMz~rlfOH!(bt{77aeCG zy%;-GEZ;Q#m(>54{-XajU#2tXgwEe{)|@cJvT2U@N9bqvoX{PeGbao(TY63ykNaEB z39aMuZZ#+5OtzjA;%nWLbWTYBsC=6_ewR0XhL`PcJICKO?;4O>g_ov^fB98epUy}nS8B${z>^?bNoR0|D^mN`I#SV{BfU6e|G$k zIo<~$FNc{OYF-oiJxqVBSTY|J5Bk2>Gurf(X-}+F=m&}3GJ`z@3J|epV{TsH|`IZ=NsyA zfF&nbeRWRgSS-IUwvMmyPkiUbVpi;YQ@yL5C#K)9F8?sD!n!cy5c6xS%Re2z&blzU z-nuZ{U|rsFoINZ!!f>Pc|4UxxOl~r6=7Z+{Z^v(Tewf|r{4l-4xZl=($heu@sXY2E z^9)`K%zhReXUX_pgyh@mv)}|vc1-sg;=7bHN6i!zd@d#S{D{0 z)`i(a%4fZ;?uba6&Ms!^|4yhL-utedbm-GnTB_vcUeV zxuJ&@N1{HhsCA*dO>;xeWcJ)J#%#{q$@gwl?DgJ_eD2&Z%5%$D{cRPVFTK31$4mQmk(LK5ao->*LN52(KkThwRrLG|N4+uyG} z`=iUw4dV>U&-K0s{j4xI3^1%XH%zc#M~ikV87He`ZdlA@<+-8rgXXcSPgi1CZSLfI zQPQ>M`m6}`Im~38xuJPEdD+cmJ?k0w*|NO-4Xh_Kjzl-IZt*=V>}A;4y0O~aJXchI z3-e^ok`-H4vcIJ~EIATQ;PMjqzd%fphbD_f@>jE5!5xWA+EucBXeG1+Nu7>fJ5 z&J9f;l4m#bV#ZonDe`)_J=#aEEwODlO3Vowd7$x%cGp%=rPXk+VXtH`Hl7% zCkuA0qyDkZFO%b(U#9F_SH0t%Useq3IevomVZkA$Ct08MmG@d7W*lb4X7BmQPqscR zPqEI-PIbOEu+JVQr<*@BCL1beFOxIPlLgy0GLEy%lO-!w=a{GW4prxwC$m2DWH{eE zH_@I0OgX`f9h=I>g5g5*WON6QoKYEq=?aCS7gA}e-pBXzhm*-mLthhLO zojhCU?|SEnCCB3a4aWar_1PD_$@rNM8vjSMyV>}e-fH~JZbM>d!46kwPQCc#`jVs z-*cX}v(Fxe`<*9dOtx2_y-a`PI%UDu9n|}=`7`4fbGGg1IQtkLFn=a&-$@?!GyjSC zvtrtz-cQY+87G*tvtZ}W@^Fw9!!C}Gm_IWPv1HS(jx%Hakohxx*!*{s zhuth$GI_-OKjt`lSaO6FlieMER34_kQlA-HI^|^#3y!d4vWNP=wl1uGYh9whvo3pT z|D<(c{*3uYUog+Tw0qHfSiEH1du#uD{Y78VAH!?%?&COnnf=LmVE($i`>OYb^5|ma zOy6{VKCa$BjDzVvjf2Ts>UYWaFXLd&ifNb^+V@jFYo7NzXvc9@Og~|KP4mJ)boRV3 z!D8;b(6K+~%?kyy_st87S$$w$=sZBa73PIOCLfyTIZwyg#ezeu*mR)dtIqS9IQ_0Q zFATHjm=~HqrF`dkp@(6Yd0`~(?>aBEX8PZ4p8HPucAw{SlN>+DxDVnX#?9hT<7RT0 zaUZPSk;cd5DC0Opy`%NV?3j5TqpJVedHzmdzh|EJH5m8j?M>x)m`HAKc_fIm9ZpTla7rI$}-aMF|Y92>wpU(?@%+4}iR_7V-r_JvI z<7Lt>?@_#1-smO9%W&zukQ{CQE7pP8*XMbSpS)Mk3vI_3ANyFcVp7Qa8RZ;^UhDiZ zz25vjtKN;)jp?9quozOmhj*&a@>}ZDgQd{%IeyppSaC6vd#%T@>i@`ku>7%cA7@-Y zQJ*>cSg~UAsQkxsR32u(QvU?UA2&~CW7d!9@0^zt<$cn5VfM81!u(m|K1o09jaKu* zDAVW6zgIo>v3$XNqAwc9$$ZK9nEk1qc$z*Nw zWWJtxUMNqSc`|Hho=i73&o61WiFq>L%sk_MyY>3A)eO7GxiuQY2M;0Hq zUd+3!%Vp-VpLJo*vADm#@m;R{0mjF0h;guD=M~x?Zaz%9}7tm^T6UH>-|;vdaXBeR!mOT-`DK3pB2X$K5xCRGM`hdE5oVty*EI8b}{7;Gd5o> zKYJKXGmf~=Zapo*J#)@s%$a{wIv0%lL?bpha8y{1SGiQ38;~Zc( z(>gI_$MyPSe6MiM#Vpx*gL-FKKPC(}s?RPK9Ae3)n~aAU!`W^ROxQfAKD$}4WXYDB z)jP-hnQ(+DlUs~~z05hvf~~h|$D9?%7|u2S+q7dJb5<RvFTgtebM}xvt+@RZ_CFXRvckC-#qV9 zpS?^u%8addYtNho$5^uMJKD34;R5qy!uET#XFqd}vtT-`J_ndwXr9d2@m=*;uwuAZ zzAu>%6Am$F)At-_#_Y?^CrdWpr`|=*Co`5T*z$dO`puImN0>ADfp+X=#ZiWf&F6>m zu#XulhD(gQ)Sd&(IKiA9_iN9B;Zo;^8M}TYKZjVc>BriC#kiSWZrm)cH0}o+XAi?~ zjgJ|VpD1Tfk3)IM|OzjGcKo;29hr=5op^LfU3V8L;w&zjFe z>T!U1Wj-v~@vwZ)nGXvtX7ar2?Gf!b$dchv<9We6S#gNvi{|+=`Cc+lroT5&CVw!` zpL5*#VZ}1;|Is{up&ok~UN%qWY#p`#ig_~USloZrJb$Sj`&hDK^_uzoO1(du55t7| ztl0LLdVf)$$=}px@n7oyTKPZBli@A%Wb(H8Jg(jJ1!0)!tOcR@H|jSo2;EGZ7I@F3 ze&#F)Ex%RH9+n)5`*RnBrZIWuE$~>!K8G3R%kzZ13l?~Pfcnh~LO+Y87I=Sv@}(De zKAkPf8J1n({Q>ruTi|yJ{jIpbVZ@eJ%ve;xn7-hccg3$V$_M0#8Hvsz_WA>2+ zq3wC~*~fgV1(TnFP_g|5>y?@h3yw#(HJ=xad%Fc;fXR;L&zv1E8UJqP$@F99$#Ng_ z{JnbnnkUPy1@W5zLbBh2(8b~t3&Ie?{^ma}&jIGoiomG0R_==Rf2dHBY9DpJfq#Yo1Kl&z$2dpO*hE<?u7^Tg~mc~~-j21fa3d7^)jhsj^%2@U?vW1P&nnAz*b zIjzC-(ZUWV}^Fq7W(X;2JazQ7{3`$-Gx3kNS=m;J~v1n zmaJwj3@tO2&t2$qgOqcG`J#oPb(Z7ISuVXWj4@eeVQ6bqe}#pipC!kctg_I3k#-zl z!3l;n7W&*E^;s}kXQ4k;smIPa_SawNbA#+N%;iQ4eQuC`ImC1`|NmaE(^mb3$`wlXZMAnkLjKZL&bva&D!m4+)VZ}ZiWMl zZ;|5%8XqS=uy`r;F0-yIIm~dm@x4zzb~9)EY>|>JOFMpr@iFBHb0*6;&R%*mLKtPr z*7rNkoF&H?uC(4CaGZV2SuuRgxLb_(D(8XWTH|KLjt^>oo%LpRqxELN&SllR$$XeG z_)L?MT}%e8H*+>Euink($@CWUWX9$dl;3KeOjt(mFrO8*8!{i3jGu{;-KBgb$M06o zYS=uP-fLYF`|OGSz`8K|q5Lar&u*p<%fp;4t0-p=i$~OF_?h}2lK)rgGh@l{xcaMV zKc+rQ4zv25^3}9|#&{T>v%YcvdF#8n{c-Ea{Ex0@man;<*U*kRlRvA^f^Dt#C!7x! ztXQ&rP33=)hbhNdGF{95UtM1;Il+o;Ya93L#>sSMv(F7Oj;7|&ypDRyH-{ePD>aAF zxW969Xj|9uRhvUU3yw$EX!dzQ`fY9Y*{bqzF-vx?FaKK2VUS_n=Frr}^_nL?D<)aL zISkuRHf;8Mxqdco_IiKg+C+cMHf{ELe{R<7wGxhhq&Za4Et^C8M(Sk{&0dqC{Uz!%xlDbgU$xF3 z(f>8pIeM*mGiU3T@?6*K_5JGKVBV~lZl(N2>m0pF-mT@iSzczh${W2+-c)_|Fx+n5 z%-On)cHfkj@_e}cjzwOtZ-3WCp>22j>|^TtM#fp~rN2(|*=JE0Wcl$$p=l5K zy7U*_PhO^t5F70OMf6iY43kmiLp3LO%;mFh5X#`zZgE`7z~U zX6)S8aSpOz{LCRAI2GDi9I_}3FgsKpmWQd|rT*dSv+OqR{nS5ZQRrsz8RKK_3w2sQ zVV*ta&Ez=ai~CIX*Y0@ZU~;1V4p7dF*-6%!Ia@v{Z?AbX;Rp*R2ReST`pnK*6o#Vb zF7iCM<9)`#@=NMRFHt|^W!8z|tBX7jF5lOjmxFkf@v&mX;_K#pu=?!g{hYda)!pRg zotYsXSw_e@x$V1z#@)I9l7ELoxOmki@%EJMhhLi>ek3Z#mlgHANBZ~C;7F7+{+!^}N0QeXi&eGez7kT0-Mjc;%9R$B&Dj{P%l} z`GMM)W7SmtkJ7Dga=Xs|ZxlC+xHfUSdkM4dNew1DR(824#Mi{sygjwNKd-H6q0R2<)brly-=%m! z)bn0i%j@mj!CRJtx8sKR7U8LR^Z&@3`c>c@b?SNFFURU)Em6;VRW0uU>=q}Ao>(SV z{rVdE&%7FcTi#aH;$|8izk4~1n7O1V+z@kEhaHV!PjR6*TpTOH>aHCTuZ5)MW0JfW z6WIy_es0RRZ`bBK!c#Wy ztczb=CVw57ZC>?tspnt1RJ-v6h0v;WBJ<(FYodF!{g zm5n3Dsv-_4ZgIS}Mi2Ae+2ZjYx$5V!e%t#)?Yhh5-ET@>5AA}7Iq~E3{zqO9J3{ql0I;YZH@$m_?*J6k;dzl}F|+1Mph^7;`H4i`rX{{`><3-Lb0 z)_977^J1axqUegMvMTj}Qu<6(@*O zt?`Amb9PnDdhXaLeqW52VZO6nqs@cj5fLxfn181wM;pdwd6}p15fK0FXUBc=CVp5n z#0Ir(6AjzNhebU92#+l}HhmjA_51NmyA`#I_rG!5-mw@v#RfLhpA3sQtIfab>r?l> zHDawW`TaH<$Wy<*yR?t7|CBuOXJX8gqTasltM%Kr@$4Xv<(=FP*FMIPQ}V13kI2)B zdi%Ps)$+ve*Ev|8`t9N~+Mg^=6)|^ASHE4HVdwljqOIGyrV#;`5Qa{GHh~tfU>+A4}vicT}zgOP+{X;6Rr~Tep-#@AU7x8xy^Lo}g zSgN=+zNxIfy%qnx+W)-Y`AcmbGIPt3TaEHB;2{et5}%8|T(9HYpdxf4@iG z`gn7BH=B}ok@_)~7WKUKb@)KcRomk6|LuAxzP%3I1C@1v61IO2Wevc|GP zZM^X@W^IicTc?cI+eP1V9bT`kZ~VTf>*cE7-s^ccoRas0OZxo(m3Nv43Gse1e*e^n zy!CAx`L-83iMXzDyzyGIP4^bacdo7YeO1+zc6&J%!`loew>VCxb;(IWxw7j{{q|U9 z>-F;_hPMk$Zn6I4KWjNF^{2TnZC!FWoaJDQbEni_Iv%T!VU-Zxr@k$Z|NF9fF}xjM za*J!TM*LSj|A(BDDfvI=4l~B_@s86L>rXayf0g<7)Z1wMcaO5TC98VLraZ~y-jWc{(tBp#^MPu8^F z>etWjOm`$Pn&KUbE!LmBG^}Ug-~YJ|iYB*Ao*U$;pZ9v64@}83IR|-$wD`|F<&rd$ z-*@(-DdS&V`xtB0@+_}j?dQ>Ci)t;82d4DQI?#1t&J8H@}w^9Erah`~mTFkrtl3b1c6c9Y! zAJ!JDiK*j#z>Phw?VQ^ETx|69DS6w~KS&%V>UnRi<@Ho^@HFw{=IP(?qFfWTeD(7c z^DZOGHov>d+q|TDcu4)v`*sG2{2_{cK9!b=BWM zcslf*y#Jg`8yb&@xon=w49CQOulDZG>9=a*ekbpSu1|T>*uds#&EToX;AzCk$Hj4d z-#>XIH2y)^-^2%89B*?zr>@2FF3vda7VEICh+F(Vz%?4*T@O#Eh0Vp5BHkQh{ykzv z>)|P%aE7>Cc)BNCAf}G}BeneX#{#iY{GP#VO8#rL84`Didj8MEit;B*xy_5M#X4d` zF*X0L?~y-#e_?#AX}Xi!F52uP_7nB|^WzOq{$DElt$1BLEnW~)^B?eD`M2;A!YTP@ zc`|4j@j+3)Uh0pNwpO-_h+9{5%6Y9{FL7-)u=eqL7N4Aw_Yn1a#POm&?t^RNzE9bY z#F!WnKNnMTpZXr-j^E#Sc+ zF^+v>W8Og|+xkkTrgyK$uc|*NZWHyq->>D})P=ci?c&^v%llc;D(Y(y-C530iF8NL zsmR;4q;1$={V$3yiF)4WYI%R5>`4)~7r3#U|M~m%!E&B1@(%Nu{qFtfpVVL5o$yYg zzRt61>)hZ$O|#fWtR&VGsocBP#=LjUGvz&B#4X#+{hRzyf5Sxg4{zq&1&sBD@h}(_4 zOTIVzBcu-KP>N) zB7P6(=j2T%YkT~!{+eQ2QP113WCeqxJ%wr#GH@TjMvGtG4CgRwTHYe z%gOCH_0JJs5cRyZAvRvF>>3fb!RTuL^E!D^&dJBs2dXP?5-ZzoSN}z^oCg5)bzXVN zp~gOUieC|>xJ`UlOwIjNZOng`d$EXHafln*+;{Vz?e~sviZM~o-#u9~G_I9+u1V}K zb`^VzsrldX*e9;dTXM(ylDOp>uj!@9waY8aGuY)tBI^0?n5-EZ+m&rE;<5mG@cXl+0N$|#MH+R>v+5n$6o&#QObMR zlyQGe{Ts#YqMmnrNxH_LC>s?|iQkH;d5^B;ooCFG=kwEk&zHAtN!##>`frJKR(W?l z;@!Wk@vqAME!Ocn#%!^)h(9;$*WiV<+{?(liilg{ht^-^udl~}+MFrQ74`LYIBt!D z%I*>miSLQ~#niDsRm)#rlh`PJ|LtlXBi8djuFad`U!tBrJ~p*Awyo;xdc`Ni4x&>` z&Hw6@{PpW4ey?sSfBklJxHiX%6Gelh@sh6HCp3OZ*?@@KH=^%xt*mBUHWcxDdc8#W zoxFqU|4jT+)W^NuWTwy<$Jij(I${~Is(8y-o7P=&jVxU==H8^X?(zG7Pm;fWUfZ?V zM|@JulsAsMtCs&UWzUL*t9vewZ-}Yqb=6w_&E?*?mOp;4@I&$^OLBzev|UrID`qN- z`G2_NSmO!GP7!fClV6Dc*2jPTEZR-(cumGFeqXVd4!-j^ywK))F(?`wkNNvzMd$TL zF<))_seeyBr|~uvxBBDo`2EMzJ?3tz)qhz1$HebNJ?}Kf{Mc)JTiHz4ce9uyrjB|0 z+M3k!#wWw#?+Eql}CmmKU2#azdzbb-riY5B zsE6gX5$&6M#Upv`IGOi|DOi(39`l-(}kb`QTV>ep6%?9r*?&(8CA1NpPbR{pKc_I|fM zT-5WAFFDrufVCJEn;7RmIGuNiUyCl||2t#;n~eR(weiRA8{gfXe*OOK7IhvFBch%^ z{!P->IBPxkH6m_Hu|*sj%T{~$_7?Mx$X#Fm_&w&w%U?ggt?F+fJ}TmM9Iqcw6~?VG z=IRlriIc?C`=3}IbJy1rsTcQ@rT9FMSa|x*7B~ozBLg?ie1HiqEN5?^Y%9X zuIGNDwl4Ae)@S&gu|Dn-w7Dv_6ZLVs>yBIF1Ik84+{QR{+%a$5>f?^z-`*;3(~|1p z8TF@G{FyP7#r3dcacf*b*_tA5ZQNA6SMGQ2JJrjt^cZVO{w=l1#G#^||CY&&q488@ zeIjlb@iOuMl|O#p{O9DaH49hy$9Ki|MLqv7m!xcbP1&2`LmRl?7t4zKto2B3y+>=t z>*eYC^>~%vDHgq(e+z9gag3<1`yXrhzozUaai6$LOvpFkek`u{TT^mRUW-?|%`JNO z_nL>)e_hP5;Pt#swd?$&%JvZ_i=)Nz&e1v|=KV;`=ZyC)kzC_%(egGg8B=)4ed(3j zTqWvx7uLpmjk5Z7WBm7O|MRx|v?~!}zby8jDdRpq;{GZb%J{S3U*2f)}BmVq8P1#v7r|k>T|1J0R-l8RM5-Zy- zRR4bQ8xhC-VNqY_^)_~2Aodj?c?^4`cI1K?xgB@e^ASNu(HpH)5VEm zZ@J=aI6nS3x|TPt$@Hr|k8!J?SIfMc_g3{E7He+yZr+w9KdKtvR5r6+UC|<5mFq3h zBkw%7g{fIvc+GdwRQn$Gr9Dp$d5~ zo|5;E>c1ftZT@cFtd{pAWoL^k#l@mau5J;>+dCz1T;Fua?L*#{CCeM`R{s(4n5d8U z3$?r(dO)_7*jwx@#^kC$ukd0m?>p!1PS0bz5hS&|z3N{m9u)PwchvIk=Hl2-93u`B z8@uMW7je9MbL#q*-*$g1Z*wj0H`Qo#+=!yOt9X^Q}`e zu5bLEqP*L6C2#%b%N^?9E50x4c~7h5y&f4x%j9rs5TH;I*PW9q*w zR@?I3ykA{%sPQUggW_H>Bz85%`s4Dh+IVNWcH?b2zsGHAO5T5|zi=z(MbyXpwOZc$ zmHkXSD;^h9^ESCHOlghzix$5J6;6L(a z_quPNl6QA)P8S2Bo_ArG+!~W@+!n-EqFo%nsoxJo-!zXU8OOW8I($&%_qlC;@ZHDz zhpK;yC`CQ*Q?*W1p>1V~1@%~u-C&cpGznk~^THYI#eM|gUd{4ylR==NIzWu*n59N>i z{b1R5*LUe1{QfUKCmQ5)^9!d>n@rreXh**ni_OHE;w`!2?-=p^w`ubwc{eoPEk*Hw zzNh3pU;RS-Q`Ga`Sj+pXoqW}d_?vh|jLB8Me;A*Vcbk~^LHB3!*4H=daP5dE#mw4x zeQihF8een*C&UMLwkPI^RugI$L+W%eUK92EwAd(l#Lx2O-pzl$Hdl#4yfg0Uv8Knj z%0@-p#yIG9Uw`Zz^TsXaj=$4ok9u9zl)TTWzgW!L<=wpTW58^U>nr=P*hOq7rd}6! z>7$-EUKiQV+~(zNnr!O&SN{^R%&za|U2DdYyvu*g{Ka-+Gx2M=>W>SnTHg9&q3SV9 zw*0&6@GJFS5Wg4obvQZx!*~}fo3Z=kzr!3({dqsR2(@*X{CV_i^O=%&q53O`twlZW z*J^q1RQ7%GxcHeU-M5X3_;aJ;e_My&xL=hwSu%{t2eiv{dOlm!^FC6`JFM&hF(yVu z=DzJ{G5Pb8G4J-SwcSKI=GvSx-uZiYj!%4D)bpObq|e5q_w@5uTq@2JO{t$rBHlg{ zP91Ohq}LBk$s6{v4&whI?M>iss=ojKeFqLw2}LDt^;SrcD3x>#pGY#4WQr@ZWGEy< zZf2!YQHWeaBIGTK5^hBisSKf{cZNtZ7c%{x>z=*b?fvob`F{TY{dhd>Yn`=Ucb#?i z*=L{WzB55}*I3<4AK}^qREN7DT7}~#Y(lpywX17>Wm{a6-flbb&)1N1dr;j=t*+!Z z@+kWQlmfS(9jNN->h+w+c9uK3Z{q(sT-hkC%U4P9)?oV)4#5s^bxrkib)!4EKJDn% zZ_FGIeg%#93#XxmRja!x}S}~e+FcN>ZYE_Mt23ab?^)P2yPx^{8Zi4?=PcU9NmaS zMEMQ>Yg*F=RJV=4$Sc8z@=zD5g6wZu=*hf(uho@#L~5Ko%6{YMX5zmK?rNLXon&%;LcZ1KIrS}xE?V9GacQ0{<@kT_{U)& zxVkL%hG2UYq>Q0CvkVDc67edXUx`2Pf3LG)^X)eZiMO|So$V8Gl$yAslfa)4zg z;0#DS(vEPYcsZZo{0*dBMV*)9q@GXt**kMa=1Zyb6Lgz7@#u4V*V*>>qd^z(zl16a z|0f*(QuqlsJO0l){?Smt^mhDf;3w2_{J(JgllTvJ{8hh`Xcnl98{NVWK z=)`;ya)T7f|5C?43;*97e~teh$3GaNkzL;?gTUX8zv@5g_&?|PM{)&B&Is*o(e-`N z@t2<+Q2hk{S47m?k6pfFrsLmUVzKeWa|g@~j{h(C3ELh2U5HpVsp?yDi-s(Jny^t(Jr`LIOhRHrmNfZpEp1Fvm{>S`{_RYF- z`~>NiwV{Z=%&Xpw(+L<0ZQv=05RYEdEX`+$^C3IekY3a#!vP_S^l8a?FUd_vT{vSv814mchp^4LO zsH1zY)qMqrQ)q7V*ED~+agC(j9IilLwns$ zpR@cMSPzoN1`q{`cLduRxTHJR1z<1VuYF9;v1NU`k;~x_j|5Ds>(leYYw^DsZUxoV z^N{-39s?;O@P8Kif$GvdrFaXleF5uW6}Y-J>-zDY)x9oY zzC)K1mw)!)|2O<2?I@fk%B4F0OQ<58H2;CW&Qr6$kH_hup<7Dv?k2GNBsj`{dmk@` z?xh*Nul)N;58l~?c@X0Nj&67dHYo?F-Tv2}b;~LlFjX9#U{9_C!zCd7LUdmB0}Nh) z?OIR`(TtP|m>;F zGZr)tOhu%4+24noj+XRU?PF4_uHj|z9gePyw-eBu9m>U=<0j$dVCPw|MuQm6y4lxSM3j(=*@!#j;_4VPVp9D)3Sum7m7EAZV^XU zf0xoB`Fn(dveJsVc`$ zK3_;TQik&ZM>jYAc_AODE<>IauOK!ph4_3S-59#V9Nnw%FAgO^b=f7Qc(-D!1X8L| zUr0BJ?pQ~+rs$D_hoz>y952dRT^Y~XSY5dubRpdcjb@!kx09n=;s1kf9No{+Ei5ZX zc@Dj?FxAn$%jzz{_BCvT@4>x)FyD@6dXFZ0E92RDbbq0p=AqXAL3dd;UHQ?AZRlz_ zfnMHcxqbsWFBsBy=jvG{k?Ss$b&<1o~@QuGX_%ycXKs8e4 z+n9ILo?$Ol2D5xL%mrP)MyQ$XXY=`Rk> z#> zm%|RB8%cSyKjFU^R)Ff-OFP~^Z2v%>e#8u}?tHd~=)R9`>iscviSp@Oyv6;Qhr=P*33)j=F9Nw3CrVRG+#iz%xlbCY&T+4# z6{Ttz=Q(od2s*y(#!dI?0M zQFMPrSGW5c_-8@J;IwXD@HV;UulpbO!y*k0zoW|e(oO08up{lCfma|*P_o`jYBcH!_;$E4Y^N&u9p9GJDW!X=2qJ4_Nd7BRf7hgaqYEnJ&o--cmW23yFJF+xb!$5 zL${`*I|2XcFcVZaANi(u^RO)eDa)x{U0GKts+&OfF-P}n{5QZRP~8lxn}zKUkaCFn zLb_S#K80>B-`yO=|B~VC-=MnXtZp@Ib)Y#s0&aibV)JlzKWxPPVRW^0z`ql81?lFp z-LLQ$2A{{KV`P$c3usruHXOvV*I+(qJRSXI-X3g!L+%&QguTR|_eGD{c$VA#9BC3T zdAQggvAPlbZ-MHN1DnLdM=4%sK6Hl{p)U*q{k=WeCi0w%)bcLTTJ)tvng&cs^fiy; zX!AbI1J!>wnW8k|Oa)iMHVQU)paV|JK646ATCGh7!-MvVhh87TZs-6J)!G z8~J+qsAG?FU8!_>dmP6nCl}Ppf#$1|uj6&W)&t_u8zjCc8a4UC+E!EZ6>SwTm2dVN z%D+?a{|MHB#>doGN;vn+JU<85g2Xq=YAuxbS_e!MN2dZlQK$#1v(DlOP8UvK@1$9F12ETU~ep8bd3P zxsE(*Dskn*S?aIoBdIw!?V{}h=4-p&BJ&Jw-hgqS>&@nu;;qKE38d_&j-Xc-hS~KN zZC&qVN9IvZ+(+>bjwEJK-KM^jcQLlYAf=epbCWld3Ry^7f7is^?7tR+Hoz8Zb@|WrM&&$D63DK2B5l}x=Qi>m-k~5=vH;&ZGv7G zcp7y3&9%ByUgdZFU_23 zQi89aI~Hfpa~2PwjdFBz;eQ1b1>LWBBt=TjM%Y@z0vJz>vp}}br#4>McJk2j97k^{ zzH8wJ&^&OdMvC`0w&1ALXOovYKe*3$XOC4pBmDzrIr>_zq)l-s52{}s{Yy#9GuQ^g zRFE=?TJpS_coVE#7Iks}&pA1I^YK{?--GVAcE1an(ezhv_uIsvfC-dIkDCQqeiM`d z-7Yo#ulF9t)&e>~TTmTY&wNe%{XqAt=-_~<q zLjp$L9n}5mF#boO{u^oC%dPHpZ~7lfQQsh+o&73ib@lq7yhLyU-F$u%vl9Q+upTtt zYF2lzXi*MP@0ZVxZrR8DJm@?witgoQ)4HKCbVRrWR9EwR12!q8sY}XdN4IM>-8i~s z&@G&5!L<_n>q9Hhesrn7%zG2t6j%c9!$**b-lwpTeze+ZpUnmBlEVY$X(#SYwD}E= zg2r9I>R&UKc%d?s2N@IP`kM5Myv_akPsW1Ob&nSU=4Esvep^!;|F-Z1Xxt5~?hI@n zf|M_)S3xE8YFbUvm!j`@i(g_yz|25j=Vj|?vmJJW#@$04*?;qoW1Ijf((l}S`^xF# zMB=4@`NE0&2HM>X^8TjAoe&{(E4;-yB#ego&=}k~c>^22#4XoAq(nvqQtx$Y+{*sQ_W01>MOwAXEb(w*GN3G(7*TAbU&15daj|}ZJ>GS;7fXqu}Nt` z-Aq2SJ@q)Z%*L+$JI2L;7LIOb{GW#zpmFQe_ZYVD1fDm9%itO~f}Uw%`--haTYu*w z`XdsTH)sW&(CQ0v9xl&m%l6W7Gcqn< z?ktzyPV$WHaN4{EsyoB#eu7QPV(NkTxqWPw)z$43N4KG)yMi`5pytH%c3SPrdC>&N z8Hht$=mx9N%d(m$ZGFT!zQ?$DlZn2T9ke+Bfl2>%91h=%?M|o;(yvCu{2Yv-j!xt{ zE;_os9>J$MJPx}4`2$9Z*AZJ!kkX&p-Cnv6==PEy5#Q(N4#odf7!9ghIFOR^-oZ8( zK8H_0&NKD>oZT@$R?(Gn!6drj+tU4DCH`w+1E}tG0bloLY`a0qL8)1H-LEuW?FZ3G z+#g0aU&@<)g@0%=#|}{4I)T(euOPN!Af*KLu~<4@)zyBGM7NZqTLyoL_bzJHZDw_A zVtW{*G^4(dZgg_M+~ee-75<%}8>nt?t2+?e%OGVmweGJPtJHe^J%R3nPP}j9{|W2{ z)m>+G>rEj}=mni1+>*H?h+c-Rb!>@F4VcmBYCju;{|uN7If$zWDjZg@>qc_NEj z(*x#DbR(&z9B1%<2pU2TY!Y`Ht2-Urd{_rdVI|1B&)S!lS#5duS)bpFzsLQw@>ZN` zKW&b|2@qM)|I*hFhNdx(0o{JmDoOkLwAX%nIm;uE0lMBc=Ux?TwV??-4DR@~!&&dt z^~sq5(+^!8Z{;^uI?$#YsBVS?KtAPnyQRFyvSHxvXGg5A?q_jyS2((F;QtQH0M)IL zQZwGi*p|V1_y%0vf{&j&j+%k+Sx-qLOzjx6G`#_N2yKv*Jo-N+kY_4;ltMQJa%?x-SRQFk{yA#_% zI0iERaN}*AE#Aoc%nzJ+FXCW*6%+&2y~^sA!*&lysV;T#|2#e>(S6F%t%ZLRXaTBw zeM-rn=M54)%FER5eH9rSq-cLg&Iy=7P9DbKp9xDqbu0N&UQQ0gdEq+953cSgCl9IT zzvc$`+lA@;mchR=R0Y-L5H7{5hpj0{k@ud?mj~?+=7WHl=jc98yKc}ERJTV;$#^ed z8x2z4mij#TRow)-U!j{T<<0Mc;J*+)1=Z#9pcHQ{wv8ZV3$+~6bpG#WH=WOx4h6BFth2m{ZzmObgzfGX~wi9n1^jg3mNB1JDYi6^Jpg0tU?r6oW-iU0v@lOKg z6uNqxd<6feU>az=jje9K_sK7egHa&YLi9c1)mHbooioN3Gta#vorhn=A9jK2PD!P~ zcqg!F*{4!_cKepEn%0dk37C%P zYAKKZeb4|x80ENV?~8`N!L}K8fx9nsYE7O$519GrM6A$X_!P)wjD{RmXJ;_A(Az$j z;{}xdfO!lQfe~mVK;oNkYxnm|6DtFzdBt>IN73dTNJ7}^&yaxWw+kuD0g(ob!j(0W;arpFx`?a1=D| z599+Oe=?sr2yBIQu!C3+*mzIcTE;OMccb63vF}Xx-=ZIK4Ho)<#$87~pj+)Du1iB# zXb!Ex)$ZHY&xzhMl}6FET!%ql^RkpS>)?t7Y5iZU{(fvHAY&o@0t&%NH051U$w?7g z>liHh@eKj-tA?#EG=qlV=3%PU*F40x2FxBO-d6Z`hHjv`oviM&*am?Vx$o>A_p-;EME4}R zg;U<-k9KdtG*I0oR(A`w-S7__1a}@d-^s7c-xI$COvc^m{9d+%`$KR$sP4~Jw>LH^ z1E`+^ckEbib)4T)$xZ11?VD zLtUDfDuKjQ+tw17{2oYjN5ITQx2${#rDl@;0?&Z1??|gV7u#Z31IytgT5|tDbaOr7 z*Jh$WPR4cy%vLAfUHBh@zd&`zn^f_<&zSFml&h(0qNTc`Ek)wJ6zwFshtc&nEpui3 zZ-%m8B)cou&>{7DN&wSPNer0|O82NoC-LI<9t~S(jbUAcL@fu-!45U0x?e}z2iyW~9^zJ4 z^N>JSekV)wP#OPv@F=KmPaAJfY<*xT#KGNPM_OIoucEsdx14z2z<(Zm3938P>Y6WD z7bpZ5gYI9l&AxNuO&!aA=Xu$C((&Gc|GiKLR9E{$cWlqXP1hi$y!Wjy-{g&`kA(bD5hZL50)+f06gI%^O2v(eT4xHSHCpfiNg zON}pfyM>pd3q_#-xVn9+E|AubFkICGJ|MT!QsO})E`_h*@e+Tnm3amzJ zi`Cm}YnfZhJ&NRkfEiagtsDG``6%2As{5nWO<Go@5>fvfZZIT69ytZ*(YN z7Ne`eobH63PoCq z&gS@>YIkmvv@xqTOHKS(zR$T|<1pL- zWuPlseXZUwTg&(^`(2FAzYX1p)$NG?AeauS`;pbXaSg{-s0Vk0T!+|X^>)}=`o&!` zPMqfc6}tJXZZG_Y!i%7JK5ccUV4DL{KB4{`&i9;y^yRbn?al;D;VNnUm9$w08$si~ zI%i7KYyKU%f^P5xxW}c8ZhoG1KQW=8X^O6vIruMvuOWm{`bSHDVR#?5e<1L^zwP9` z#9TNPe2TFNoi2_}K76i*TR?SMS)IDrnm{XXk3kveMEN5a!=3f)iO&#t9W;*#U&q^z z?F3x4mK;Cg(uR&=MMhtG&Z&>%NxA6Ey!gx}EVK2(N+a zHV>o%_m*J$8h(Pc;Od5-_G4Dv_(efet!g^nJ@|X;IbQ|M$3r$B8#eHJVBr10bEDMq z$BAVgm0>l@X495tk$ge34gGw+hRLK&5|)F;&8{cKJBlr|5nspyZrrBFx&1bB8NV-E zEgg3;{L4dS(6~=n-6q)Dz%$SZx`C@5vD%swX_i3$YV@@{N1GSmWst*$>=!rq3xiXz z%>nJpVvgqzn%kWAAF+HnY=aQXrTu;4NE)u##5^8Kf*V&^;))gsns?AC>-(Bo__Tvw zpzB%BU*;{t_8t5Qn_(Nc$Fh-jJ?~|_(&r>%mj}(a=xcw?y_x+Pih*vQ=dAwy*dBrQ z5CeD2`Yu}zBUdmVan}DC{71kCpmC4#b;A$-NIqaVNEtw#uP6H`WRa}0)RCe=Q@DD1 zznz26cK8ca?_IyS*ZL>MJa`>?!wVqWCKDYQ4?eZEo&!p=L?mdcps#tzq|GAu95fFL ztp1PKcEUl}3+^%Uq}A5G6uCBN1~|IM@GrQ9^#P5$l-+MTW9tpC!yp&|3HC3Y^X7f# z+#+R-Ctx2O0Xfgq=YES={jWIg$ect%1Jxa9b-QBg0Ry2g$n{9QZnEC$%08aD9*J(Q zn(6uE%lOZLC7`;Ct?mKQg1o=63|g}f%J?C19TZ{yU3Ap>?7!E9vb1_5jw+JU0=$33ES%+Wde1Bo74A+ zd{v$sBoDGrM{Wz6>geit@eckU!pESxrF<#x5Vq4GCD$(gAqScV)jd0ptPnJf9Nql* z-v~E>>Pjvs-oLQb2PsXYzJP8L-Hwj#=>CEKQ8*2%`*upnc=>j-zran90lNQ| zpufbj#T&aLXg;l(-rvgMUkz%2>Q1q`O|i8FDP5?$qLuw`>dF3=dPb#U(0pGrt=kj- zq3|N8?kr!*dk@=3AmuCSzUYpyacY0i-{Xwm$-J+o?<@a)i~k?6A9C=2=?j%*0bldO zAIw$Y1V}kZE&K6!t38W4>ye33t_g z&RgLGNI60+^S#~Z9OFw14?wSZ(EN#BB;`S0Ilz7odqMRw1F3~MZ#l%V1=@j>7Sx3Y zvP~f$$%#_Sc7KTNA`f$|ujTv6zo+occbIFUz*ncXhrNy!E`#lEs1B*Q{UBdwJarPC ziylbpJb+I_cnnl$n;&1e8@9eM5JYE|)mca#Y0G$wj`qJ7@EHdaA#CHR=zop32HTGy zWgGPh+Gih+weLmS1S{lXqx+1L&u;klg`uGNoac*$-@%p%3&8D% z>m{EZIA3yfKF4PbtOXe!WPe-d>jZzpb_i12ww`Y^9fRg0r~PS`=l%;H(DoZ~EktVN zdA)qt-57Mev_3*iQljX7dmi0Fj_wcm{ajuw) z8}muDqE7@(ncC_3#xQ*5!ZHXGm*nkpNdV*P-`IkGv+j@wT&*I5{e7g4y{;MU6g2l) z-IqM(oA}p;(axx8QBi_El|rc|UKuZ7`?~bcslyn@&>7(9Wa6_3mV)M?uCEhZhixm!v3VJ7 zrNnv%&09`;&Eqboz5Fg9CH0yA%XjY;ZNqKNT?=;UlgLfva7xneLcpzX#zzSFZi(xz(Q(*<`u*~W< zvHPq@CSPV8tZT)o{^#xT3V)y2X}>ZUFzaC>XusOx$Cvv3rCr!{ACYfO(Eg0mejm&K zfzzPk12r;$NZO!rxIbv&-EF9+{HKzS$))zN4mI;?+dYKc|*e|&V%9CG3vfd6Rt9CW?y^E=^k zIk|TQ^`Q03jKLsU^1gNC&7j#-KONsde8#{W(D?cj93}Pl1h-({4%wftuJp>e@nxZV z6kRR<&_?=4ZZDlrIo?o$*I+9N=k%{J%-Yd<3c+ z@W0fno15PtfTy56xcflfk>}_R>jv1=g-4$D#5KFr4+TR z-RV`f@1&qv;OJGyrydLh&0`mUpk#~Zo?8E8#aBcjXLKo2O#3eo{sozZ5gu7{9D3UP~CY}_ts0;2G9^{ft(lQ zecjJ(VOwjw$?04VLs#?r68^8k3{YLVt`u)SHYrD`56frzg7gR3r>0w7eZD0&gZo~N zZvIR8Jte3Ls(Y{19f55Oya$uO&BHOPD}R?po}-Gr7c|8iq_^8<{C|c&L3O8EUHQ#- zDJ7^g8ng=s8XxgKzd8meeW9SX4yVUCbi0wBx3j4s--DGvOpT%bd&1Q79 z+;myM+zt1G?jJS%h2iJ0y#V7u%4^i_xHW7v{dsoK6neyOApg$B=R^1&biaMlUmU(J zKl=mR0j|ypbWA4mP)FxceA+@cP@Q>JXDGJUVH}8#-aoGS2J<6yo=3;u#knSe&r(d4{qMtqb2=Fk7MQou1lbs&u?oA;$IS~gXZmLt9t<3Nhnf~@d*mT zF!V-2VVo0IyNxqXN_-SFna=v(L7V!}6mL10(tIK*MFGRmhnUO^DJ~5qAUGsD%-Fv{uALoHj3&V zwz`3<0_I|<2sgoWv=%~H+I>ge2|evs$uEND6Lhs4#{V<~u1?QCp0nqF7h$^sbl*v} zS;l#b(_YRWufZn*5{?{)d89(hx#y3xJ48F}&$r-T6`loMpRfFO-hON+;L;*&BXGyV zvTvogfn2Lhei<~mA5DE<>YwWP*M%5pKe4~N6&{G~Wf%>*PO{Hsp&8}ND>*vT@L2+X zf$Cf>ADAyUy@uaFgf1XD`pkFP@y5hgaD5sb9S^4C^9dXWUC-*ijyJR@;|ffIx4@0b zOgMKuhdZnYPyBV0>NBtUy;w7yO@s z!Jv74*Vhft!X{-7wVR71nw*50U(nI@{}P{{puqL%_1|dY>zKiBGs8F-2CsqKqlhH@ z7)#sw?6D8|_~u~hcWYFC3vKqoCB@VFT_w@1{|sy&!uODbuR-sDNDlTU()rcv>G3T= z(~_M-$H^14$$bO+EogqfvifzgH3ccHsryb!j}xLVMaN0AHE5o8bUWc6hY6s%hpq12 zHwH`%XaWy`t2>PEaCPHZL9+^7?Z-&sNFF*6)gYg_+x%$ zK7el7lsDI&@c$8RrejK&EHdq^?g4Bkp;SqJLkWt2`!_9i+n75uzV!hq$sKIRCT#1} z|G3{lo2jrIH134ezqeGtJOJ&W1-RSr*knH+dAPSL+c0Z)(6m8U`^O0U$H8{cxYt|V z0XNa_U=q9xqrmOY?Wg>E|48iN`7ZRe1WU8eLP3xe@0?qqpQcmQ<0yZNr(W7yh*lrB;i|M&jYpM0kJE54Tf$G+>xTb8Xqp?kbOqdStJ~-9tYP<<_P4iSdsee}D|0A3L zJ?@h#DdE}`xHbu`z>W0?n(^a2r;Lu~a|k|f!*L!dFFPm-#`Lhg4aRjjxi24 z(g#M(@N11xzC3w?;~e@rt{hH#O1d3MVZ|lKjQ2xF2wfHEX<$I)$ z={ONT6Exjhq>o2+Y10DwgX&LLeQZad;GN9LsdG`wyXJZgXSLNI!q|K{$0aGzK*$Vt z^lzt4Eoca;zuxN4!L|rC!&mSvoOJYa&Gh4!XTyVX&zTYnh0G-MOQinC^KG;_0eSCA z>)ZQ2-iO#egYED=Y=#nO8rn-<%3J+c^w=W$UdVjn#QzU%PDAkSbpN|iIwJi#f=x?? zd@la)$1Q!|A;JUR8`0HL0{`3LE|4{o<7rc0HyFn@0<`Z*n`GXQ`IGkAFUGKZHtYn= z>l7Q;_)6>#unrc%a%jN1>UN9S^>+J3gp-oOvGjO(**(l}pd#pg_q4ydUT192LL82Z z%~|g(t3A%Ps=bm{V`@+NJj!XZ%I0akZpWv;crT$m27uKW&xY_mz|rp^%xhRi~A zbw50S|4F#@-n8yst2-ClV)zD@gR5J1wy&%EVDj>i$sf1JVpim1H%k=AYGcSUbM zwi9qk74|=HbtCWly8G$7sb_?*3YnYG)p+aRKLDnIZa*#!Nbxc_P?v>&K}Dzxu6Efu z=f*6J;+zZ)MqiJ2U1{?+ECtQ;NvnT-HQo(}>Tnmh&l4o9wm$EdWH7t-@w9GR{CmR! zP~FGu{w&Y=-&~z*B5*f!C!P^y{8&wP)n<|JI)N_Ajjt{bVIGu`Hj-1HVg;V{lw}Xz;+TYufaQ} z;GQ3>c68b0 zR`HOTiLUmuIrz_mpFnj_THV6;`|(Doi^yju-Yr&Fe;Xp}hLHIdT`kq{ZvxFBh*8G# zCbDC5-Ki_KKA`gxF~)8TnJlOM0G7WA<3Zco_p*ZXu_eJh9z;rn%uy#_t607j{sCRD ziT?L{C2Dcq8SaGJz+JDtTvV2ERmVS5GGuOOo$fca@ox&fKy^R2y3??I088OxaCOIL z)6GJ+5xTk^*5SVmPJ`fd=X_L<97X0_ZU!c0JeL1h>gWP+E`{7=Y^)B+EuUEp>x}73rLgp?<_aXdSLT6Cj zDOOkB+j$ZDTQCaTd{)e+n?Sd*qdOh{d9W5#cfQrVq)xzG2_@k=aCO^f(~Xu5nO^AX z_OFS58yE|!`@QPc<=Q%wh753ZH(6aBmlOO^fH_XQP4I66-9dHB%MQhMdkxzJm<`jw z)gALuw*BC?konQk{S^Pzumw~%YITd$W4wpEpd7fmo3iO9%7@G`N4FOK4?`1B-QiYO z^4kmh^N>Big%_L~Z?rvCK6s!9Qwl6`-8fy95yz+OMk}Q`# zEJfxma(s&29y0aN)$#-Wzrqd>IoZFs1t=x;T+%-5?l_gCeRtaHe)Sj2bJXWN95k*) zHm)w%`oN1Y5ZwK$gk4|#jhjS8_Iqc2=it8ziawN{Pi?WfyRaRG0uOUf0CI!7jiy^| zovX{r#4CkNi+1V$+L<IoJcgO%kzgmH9J#2$5;KrTnV?U?bUn7-6<|T9^sir*R z)_`0F6H8W*%YNLteNN+_>9YZHYURd9jpOm5})vea&|@+SG-vpm7(I z59rUqwg^_j7a;vWww-MM6;@k+7c0s`d{?zk$Gr#tzaVGBw66S3ThYB9+bvK5oHn_iE(pdREKmv zexS{7a2!;>lhwbi5#ug2gPQOVxcb8u`LXL9Hl_cskU5NgME*nRL7Txa4^+R8)i2tZ zYsXL%%0p#v^>&>LhN6`QgF3JH1Mo4h|{&Y&Afg~Yog_?LmIpt>!r?f}uEyg)rfK0A3HV|8^KX4T?2{X{wsv+-XH zpM%KB_WN4I$iqL_ayIj|FQvW`+h&DM#h|9>>pVX~n~HD`sQ#Z;zZ#Ti<3CwbwVcL=x5NTGE@WAzr*Uc!}c^t=|epf+_6^U7k#;BEhSMmWIlHC^D=D` zkO{h7V<}JLoyL}@dB9u^1;EuVZ)4Z}$J7s*(w)-#Pb2(0!w^v2$yRqUww16JU2kp<9ag6t;dKWsub9 z>hVQ1rRbQEh3*_@y@%sJ6;^}J=kbAbdKJ&HZIHmh>yaU%wJDanmbVv4Ms07lJWt38T{(IuV#1^9dc$3gSo)Xtk; zdV={sybser)~68~)5%e5YB&E`okOMqx|;t3_=h@iogP&8RjXV0NzNPKUML50U$XpH zzFySU+V3LWLZ+@0?|A$ZumDu|2djGoo0OB($Ak?3eFBLyw&L7)ljyc_bPIK6ZVK0d z>b{mzGv4jks(_T5QlDo((S8_tit*UVLtXq^Kx-gvseUpsrDVME*rtP&52!zp&*#zB zT!>%v>5v(XenkF5`HVI{!!}U;&Hf^8IZfRx(Q&7gF-^mS&*ixl@g^+=D9ndjuC z6>WM!KT!RkFX_qkg?F(_nM?h#d_GV7nwykkPp->2`bpY+2VU2-{;gL34Q!KP5zK=5 z;Oc*uZJUaI;+c>McTM;2qqMoC8^;UK?W*VV6|hwSDK(|OKPgiOX6$$CrCZ7Y6B^nZ2YTtu5yupKnc zi|x2wtUJ%+!ENB`eoCClej#%Q4`k?ZvmQPzp+9IIi}*U;LTt-mJ*);-t2D<{iE$a% z4&?eloRirH?Smc???L=eL9j=<-(2tO2IcRNXJB`aYmxpT(}DK+q%q|tmRE+Vp!ti~ zxSqrI0!Vp-dNRm8_gTdB9nKP$6nDJKiqkKh^_J&JX3=gQ=z9NV_4Rp@9W0aQN!;~b zXxCe}P3-xQdBxE^MVs6`IS&EVEg&0+dD6q!T0j?Q2d-|e)#vv2E^`uG(H1hFlc<2 z$_KXB>)76g_uw6Hw^wbnL{sC-LU$&*kyKNTWB4zErJ#A$`y~gl9fdr7*+-~D)UI|j ztF7mjBAIw8WR^Q|Urw9iP!d$Xtc|+^wjS^T^n-!m>i4z!?)jN{C1iG@uj9gNw0Rfi zfa(vk`afaY1;KtiS518a+&qu4`nr!u{8{LGPpA7u9@^dri$V3}-8za_i34Cw=mIfl z5Ayu?c&j_z*5BH5DQOgWBV?MPUsnD@xirqc0uO-d>wS_!&-2U;RDrTk5#0DIuJyO= zCPzOyHe|M;ujA8r+RTIXAYn`YyUd@rd))?*cX$g%g3L=Bt@AZo+gkQVxxbwp&vjyS zb$?lc|JQIDRQG+W+i@Vzm%?y(9^9CBSY7Rp=IxLv*gdVA#D4?)1DcP|t?v7Sm@~o_ zSP9>Qt37r7xqV&oo1Db`K}Y|l!JGrZouF~+?_jsZCZz*)TNb)~vHJ#JTl->Ua>zV^ zuI9NXZHB-Lpt{w(l$5>N*;&+Dx2Mr_-`3=Nor)W^Yn&VQ86#o2AhdL^fY%o-=| zyJ=e+I)dsSxB6SK?FMfcF;mOm6qI)s%m3i#xVo*~>!$JPA+rPh5~(b5UO<}$@DgZV zD*J%snR<2{Ohju(gvRJX6y?S`!%ybdoy!A;CNz|il@Q%nEQbC$^L z5Ob1r9_HhpgzccZbFFU47rEvQH6aS_-;kSXbu|yM_e0EM(*5}f{NpePRQEHh`!%*7 z;5XO`Zodm}_T$z59Gk;^R!8?Z{+Ey7o+4CQ3@)>)T zaSf(`Zm;$i`SI3xjq82T0h+<%;PwUi9Xiq0oJy-0506~d(*{kof;JoBH_*I(;OmF; zzs@xZxB*<<`CHkq7KKb1N2dZl|AGdfIxDQs0BkSASa6RQN6^Va=YDh|Hl*qJd<=_0 zw@*cOb&B^Zwm(72aq3Ow{NF5)b<`sFDdpL~#Nv=?g|2R&oTKQ|P#!doovdyW+iLh7 zeuQn{_D%WiJ<*qKB+t@Fi6yz7ioW*y>qc{Z37UfHe_{1M!uC0Ag>PXa$UC3w(Jjmv zlV$bY?UeOd$h_<1#e0K!9Fzpr-)r@+f0KI?@G{&7kHN?+=0PBFPq+0h<|&8l{5$?t z$o%5u=O}IRjv+^&`c>?C&N^(rz!hWpLdXT}e`Q|>(H~}OJvNgblUNlpJ)TLAXM<^z zfSI8B9j*RKY#ZQr*aF+Y9oxrj^S|d$wyT^&N{OuwnX!)k5!zfej`

K0mb}#S4t* zc`v8|rJx*4M{^;_^^6tNvL3o`OQYn*kh!^6I{wfE&VS%0(0;kn>bJx8Gz^A*;P&yt zJACcG$-B%0qMJjeoufMi|1V%QXxv?72O{pOZ!!*+zfWG$o zDYRJ#>p}HrS^YOAa!w52!2(zc?wFTrrysk!U1Pt5%mGKgZi4ej=mDy~#p;)v#JM?i zgQn05#{9h7G%ybg-K!#NRkE^1f1gw>Y3tVLf+d=JlE^iJpHFm1ePoWFwVb4yo> zSN>h*8_){sKr{J2$8kB9OWu#|@oPD6RQ<%CobRHq@&81d-(WvzUjDNBf$8*dxC#nD z&AsXSI1TtL-yzQlNM53x#J`5F=KEUwD?%ku-QreP?hieJUCMvGKZNdVN4FX6IzvB4 z_fD((DYg~xBYX#Lu3Ou9Wgn7wBL{d6&(ZxI|IiHP$DnzxV|Bm8wif<@U*Hdr>)o2? z?vA#OThT)ya{_%mZanZF`!{?Js?V?{#p^PYYp?JgyZ~cB_D_9Zpx~c=uHEBCz}iKqQBqK??szYFa}h=rq%x%+YfLQ zvS1Im`rRFU$-R{5(U7^MZ#w?a?0|_t2B>~VtKSh@PmnT*`Zf7nJlz+iA4-w<&*~o! znOo4;{7<6IJFpbAKMu0`_rC9I*PyN@pB?Q%Hukf*KM^u@oVZ)y-xGR+>atr)@y1}A z0`I|b`3gsOzLOK_GYNDDJGvjz=41E*R5!05rWcswf5=UpLq0pY%d+d944G+;Zeje3 zz#X8vw^`liMT;_=da!(Uba!OaO`ZywuN>X+_`eJ9f$GxLrFcuQt%S|67TjkW!u!*G zPsXU|>5$3YFFlTA;lCdagX-=`$?}|WCSwywxt7|UyZSvMeXP$y_iA*tKa{}#4yX*O zd(`SagzYit0Ik8*EokG_{t!JAGPgRqUGeV^LqK%{HV>jZ1|~vw-HdFy33Tssbf?kg zL--U_H;>ho=Xus(-vIJ^m2SM{v*~h{XPTm0)?Zh%g*Lh8a!du)EnsyY|A4U;hCv*v zqt(FbwYK#s<~w;4jHltS>4&bCzw!6xaqR#Qwi#W>VIhU zCt#Za>tG>#3GxoYAapk|jE%JV?zkEE!sdqOQt_q!k>54gN4tX{BcJ5qTVFqTzTY)S z(!L7q^*DNhb{7#)QPB7{*!UV^dmQ@0lh6YspCe-adLOXy$uUo#H%R0Pn+A^lXxfa0 z_d&P6=MT}|Z`h>lquv85pd zOpv%|4e~YPR$JyR`aF-x8#XJ@FJbjJ(B>fIUy#IS<=p z^_Mf=Oy!s%C2~pFJl{V(K5V7UemD)9mr+)~{mb|-WDWo~g8c4+&G53_A2wVZ~IN9Fnp3Qf@uvzBB`yl=u;7QPY^AiwKyail$ zdmX!!3Dh&?Gx=VDW=-;;W2MF{ezD8K=6Ce9d`O#>@C~RwueeJI{*3K+&~k*&GB=WU z!ejZvreHjs*MC@c$tRrSg6i;Ur4&!zLwyGO8!!MyfP0>@K3i_3QL;eT+#XMlXR~SZ zF{}j5@74A^U=iI z&8nK{Yq^>>H^D8S`bB9=36{fl4``{*XB|5tSB6a&bSm0~53sBSbOF_Q(bw@NVVezW zU=e%;ML0Rp-{LO8XUV~}Y_D>%%_z~U!{&7-4_j%o7Y=~t_Z_Q$)e^3Gft0dR7bh+> zd$C+}rTop_dny{IKu9iyp*Mf$i$G1#hH#`X2NEipQA1oW@>s3cPS~P5aK}W}f zY505y3qj+%*8dXk3v6pZ%8#wiJ+AxFrRO(EbpJv(lJe&7_0et*>;u)UhsN^_NXOd?|A86k34l-){9^!ZsE@ zgefo+T>bFh=h43|%)PwyJYpGbHp9=L`t_{-*v~lkfCKO$B*7im%3J*h$hn@sM0nXa z>BL{+bIzxs5~w~hQoIJ(Vj!gh^;2-6+>2ip`dNPAYFXGeDd{wrWLsBRsb=S|qQgA~~xU0v

L*MF`-7l6w(=oWCf26^u{ z`}_Z zSCD4d1rqN_s>H|i;NSG%89n6>=;6Pt2fOzv^*`E!XBGM$!=B6Gb2$`9{CE%E37&jH zG+gVS6Gf{%Ue9_XZ{;7 z%-{4g1qVBlEkT=g|AUluvpop54nqEk1+jg|#d>XG?M=0>@m9dE2h97bQ@NE1>z^id zwhI1sRFwJ3yT{L1`J=&EUc5c>8Ser9D0mz6Io3R?zNxIJk@Tr_{zfuSAy_Oyeo#TYxc!7tfP?YIg%vmKWA z+CKC3tMBYeDy^2y4>zB=ef&Z>5d}=QYUd$v=XdUIQR7j|o4XIG?Y}C% zYv1uLdEa+ujB1lE%Fw?Zaw6Hb4$0g$@#hkr$k{f9y^0^CCG#hR)JSXO#E}(qR!mzt zZN=mjBP+LCF|ur=y*jl?pZ^lM(&xVdw?bKdyNSJvao{_2BBcCnR8q=+3fu}@ekV?! zeG1*Kjgs;!dt&Mf@LPc!`Q8sI^_@|~oaI+gcga5noXhKr5n?3!#+VZubEx^Z7}=7% zENj`55>}Q_4Bz>1s(wqmmvVlY45)u~d~VnNwO^Ipdh0Ob)&^<6d2#;rJ<@gVB`+tZ zsx41XC~ZUeXOYoNe*euyzEN}Z{(l?(jo_zoNREy7a&~MO7rK9#dZdiWN!nuk9|X^~ zDO<`LW3Df4j?s9@A>%pbyJiL&;S(Qj5|+_(+v7UzaqLCf)BLt#L3>=QJ&vo3SVwSA zdS%spw81&@OI8kv-@!TKVJ7|2xa2!Cuv3?L(lOv&ux0Pm&Wphd(4}u}sB_-xl*YVj zNs-={w6yZvSSM3k7rT;|_*n^SyM4C0)(NtH+(r3UaL(7lV#h~`)g{&@?eHwQ&vAbE zOh9p;b0+D$&-uuCd=~>gCh;EtZ$bKX2|o@#g!Fj@Za)b&28_XK?)Ho4dWO_*+?V>V z0%!eKpC8|CbF{*c^)KRF^5=sy-|t`a@wFV1@?NK9`R}05`#kPbr3b;U0_Xb0pDeKQ zN8qedej5Fo<>kAcWd0lGR@HZCsB@)0w#`#Gq+Q<-V`m|0^Fzqh{N-Mx*TLV7=A%BTX$U2_joPG75p1afk&J)-gKKq7V?;Xd+`3??cja8;4kixFY%ekFNJ@1lD`6cHEGvv=|kY3bN)d>dYtK8ur9EEXl=hcc`S10}f4fJ%#M-lrx=MSl17~}*|M%e1 zexKzidF|(tdyM_>1DEz+4=(L5vG)I@NB)5x`HUTp6F8)2Pd_{?Yct*yepto9_cdnoO^TZUCsRAX7N=?eoM-W&q(-|#6Krt?}O0JyAt+Z-E&CaoA6sMiTBo&k=_S>J?H%c z;%~fx^|5n+B>pMq5)Z)>Ynyh?Z?*X3nPz0Y)^+WZ#Fua`@$CiHmZyVDTULX!Eq7eX zd&|MOZn1N0iL)(^S8bWs;sg2_vIld{b&KEJgN?n+U%;2V?tz@+rGvrx-}O;ik@)i? ztlXd3Un2>>4!+}imxSL8K7h3Cao*8B-iw+#Gv;Zp_new@8@0(v(I+V9d}gdl_k#E4 zY&#|Ec^c0#tEmD!52Y+jlUNcFqU%PU4{gPHDzW3^+3&AIIX8MSIM0$GS{SqF- zvN{ZZN$x*pkC87SR)BL{g!U}=DkIW0bnF6>&rjHR*o|}<56+`G9<=XVaJKKmlozk$kb3#*bB-+a zEd^(N_fTG2eO^!!-`9h0fLHS0K)jTAG5##^%>{lGeSS}|FFGa1;NQWye)$*D(Ix*1 zaOP{zwK%QR|9XNcW7|J{aJ2okE146RP!^>6u3}E{n(>5CJHJH&yLa>2OF9tj{IhL9 z{6>cIj?n`X?t5Fr2PJ$Q*gfmxN&iLQt-u>4|Jk22!MQ)Lhwr*JrQmB%<||*~_Eiz* z_>@2SKgi3MvOepRa(&t>WqY4+qX%t~?CHgp-xPi>-)o=x#>3D0ref~|@E@bvO1}Qf z{NDQY7u_|+UzRWJUkJ|iZ^$3^UzYE+Py3w*05h?MtsLojVwagD0EB_f< zmhon6^mk{#W-QD+!>CZI%h1tdb6?knz>`~ z>lcm14--6DpZcG(-6(!7`t8FH1aGj{S{?7hxQ~;(m$#I2zR&Hwz*m5q_)K!I`3%k@ z9P07Rw^f~?&d?fDzj=RrU&h)z!VH|FE0IW+H)du8)}c`ZSPGz{5OJgd+A!}pVRAUAa8wB zoL>(Q`O%&yNN0O&&r7h^If1as{c`#GfyRRagV&K0=`H9vm*l<)-;nUagzc9HNaudh z&nKf-KkGy1w5s}h?TOkyYFmbMY|A;M%eHpFvCpEfKLO5rH{1T@9{JmQXZ%YL>{mVz|Bld}3PN6stVFg=T3w-UECh*NW0z!p}+@=5f{r zWtftrR;OO^AIhCV()R4mxoppV;EV8|^s*1e?~xygusQ?GGS>b5pZMMap99{SN_Hnt zzX!V-%ab%XQ)|FyKaXo?RefSrKccFWj&SqT@wWSpo_d~H)MLFo{?e`2z3*{2{P~oTnjhhw8;v?QHe`%l z#sftwS{o=Pw2X=#4<6uA4X)8HV$$&aCejn|#eYcrO+Lo6a5(+Kgtq~oN@M+g zOp?D4T=EYbKbC(GIP;%}{FwyE^HP1r&YbsWF;VD81(#wVL2 z%6KtihQoLZrU&2r56SGC-nwF+*67gzCYaGOPZl%N5YbKcYCOj>=E(EDtyJrAo6Es-M770J5WIoBi|Vz>;OQRb@jIDwIM7+!hdj&F-cYaYLwWV}j%CN@wK!`- zV^e=PZ-&38MCnog#2M}UMn5x~TBF`uIsa$>@Z(heg~=zCc{2aF)<(Ys4@D=DXMUa+ z20IfvhjePIhM5^Q>P+qob}nFUKmf9xALP6tdkES5JzE%qxyLNycN7~cLw3;lWPD>S z`ij-G5q?e?;?FS((Ia$De^r}T*+V4w^~Bwiwbg=2N0@hW`5d*jskE=02b7IvjQ|b|FmDD2 zRIge$S1ms44L@(L1;}T;75M))Hf`(6>Dt^@$Ev>%$#Eh75;h2#U)nM{c8$k!?8aS0 zANz>7tBSF52PWiLabBHDy?I^@J}>Mj>(O$3a$ZrsV6Fn#>A^Q=P{vv_q4f9rA^A0V`kJ>PBT0|2tUp-^)>Z1Lu)4TIeU$z zqFr}!&Uzh-T!wY)z3IH%U?ef%re-uD$c^u@+l z@?^fabxph{I?1(b;Omn)*5V0XbrdaZB6Fi_N`hAH9_A8IcI&gXHwA~V~PLWSQ0-%K<3ygeQ4k2 zYruFNGj{GS{Z^Kt`be|hY_6`FU#OZ7@xR_YqK}&<&3fJc z*Ym$Wx%uDxq}|Sc8?xK+l;>$@YTyRvwI7h5{Z!hod>K31kjJcpR-E*YOc|Lyvirz3 z{N3Do2wTVA2jFMD-aGPH9q%njWj$l`vN_tY);~=#^gtd4)2f58D&7tN*j(SiS^}HX> zhV(cusK;Fqr?5{7b44T0^u}7+$AoO32{bRq;HrM_LQDu((*xnGmRRSBoHtabcItZP z7l~xBJU~-Sh7FjNFTqgWT`>+(6#%iZAZL4;1)l%HIZ_M_K(5{n?5a zAYkvwIX^Jf2lAfgXGwYg&&~}UJTN_+6i}b{rqm~S%{>v>$2s(s*9|w-#{N@IlJ8;9 z4sr$CB zdk;VB*S-hQm+f^Au`7J{5I!S?>E3U}BLx+pma@Yj3F(}I6aL3%tqw-dC~0*hQpr;x z6&MA#)s-`qxb2i#uSli5qy$JRT=;ZLkcuVR zDXXfRig~%RD%@d+c`>*ZF_mh|ncUFo=2fW{MOqwz(FqBQbz&J)Q$nV49`Q3yq2Tld zww#nl8&ZmaP^3a(KNhKknYGI$<=hwZy4*&}Bfl*(>?fkW)u5!ARJ=|{NqBNE*w^ZE z+c_m)3hoYI9w>1;a-@344^y@}myKr`qyl$I!3}@Z0PNVxk|e9szQ}J>@Wyil&~;by zJP0_yx5s&IYjB?Du0(z@+TABgmVYxim;d#(JQE0hiUS0){QrP+dF4M0FUx<5`aS~o zJ=)cvBdjh3G`(DTIU)f=PJjtu? zUU1guy!>f!o|m=%F>tBxgpEh_-B0Ql zx4w1YT%YCtv}m-v@|$isR{juhDgXSf#>)S8n^F0b@YiGDd4<0wY&*96-Qe8+?mN7$ zc@anZFggM%^Zx&i8Tw(e>*EHwbU*(0nS!#vPfS=pIn8*l!0Qg*cWEBs4lS!{)e80l z%fsGlLDdSm>f4@_`m7<852;v}Gq60SfUfQ_d&VUPwRukiTz)6?)%YC#O9P5?SeK;H&C zcIJ@QcjGv+uV#HMKD)R)$!-ZI)VqH};A!BEz%PVv-Arpd=(uaO=gubL?WMq9x_M25SWr@%!Ot?6Y&b(=diduv`19{_&KEC}!J8gL!JQ9nBcRU_UnyDzXE$HqW40;slE$=%acS`b( zI*qU!3JTXWE%GJIvZPgwb%6QFIGU!PR1`Rb&~_J#iIdqeP3@YO(!nzfW? z3aySw<;Cw$*nN!IVGQ}FTS%M76dY*{h9SVXXa=XS_Jn$r!RH6UE92_~uzr_}ucN@m zmt?)msX#l7H;<~eLp>&lH=M91S+NP3z!MhuASBcm77a?z}VvXvEhbFIJu;ho2D#pS3hH(wUV12ubh9 zN^b^l2KSp0hUch$4b~p@g^KIN^W-mze7d%Yjw&RM*9k_!zA zvsP3&-FydRL0dB)oPw^?Q{IVldBy~sW6Njc7NR#lBd4!^1;3r-!?TSA-*=(QbDT?m z#a8><`QDfeaanJ4Rwef=yf4nrPqX2W&l;}f?0O=p|DT+5{ZB*QXOvzRxV(c1JRKa` zM&8T7n}Sc`ko+x#@2^`OVffw87r&C>h zJ)M^4AmeCI8(xv*iC1`I7&823g5p1}^#g(8!Yi zb_Pbtzmy5I0{+BtI{EvZ4{#^y%ws&Y}w#BwPf7y1rJjOnE zd`(9?U_jRMQ_j}YmE#gVrwQ0T)7qaeEcas3@qXXi&4bPaI~`se&{%9;uCYs*r`pwi z9PJ=wzIvg-{AHJV+|QMIjGYqilrUkM+7wo?u!fn(`*Pw7mPxA5xgwX>?lm+d+bv#& z5n`W7r|Psf2z%@}O(dRth}XWK+o{g&)Xr_!&aGjqf_;D8vU#MPviPK zRpX5nnJP`BJ>GA~_PqCg?$f~=3eJu8evR>(`S-xzh4HjU;{O3W4QI|kM(V}tKaug1 z%geuf!l=CM{U-5ldsUIz8!XJYs*M_~{Q1b0{$iT%mJeoyNI?ivelO0Y{E{M0^tJ)Xv@0=B@R-Ci)h85?u-?{=Obo%$$7op?0|?*}|5PhB@A-QpVyY~6NJu3P>xs#4w>t$&zRsGCOCypT^? za@~I=XV-o6aRqBM-+Id9pe5rsOZ!}TRn;14)?%kVHj%%Ng9$r@eD;IjbHI)T$8@M? zc$nXE#;2RjQ?DCKuj?eoxu&@1wu8IlzQ*6j4#KgIUW!caBY!t>ILd!$IS%U?Og@r# zFj$@>-hp!|8;xMxaLwgja2pQw7~^sBtEy9e6#HtGdC*1RQ#fB3P~`uObjjDg%vbl} zv`5`iS(kpuZ4T`Qn-~2(!gc7O_;h78uUbKFq;P#na%I9^PkxwmD`9_su$uJ!3H#oS zb4c5E>0j9YQS6z=A%*t^VMM9V_bs;qH_E>Or!=`n^D zGW8;rt)hg5<8L!A}Jr0Q;*+WJ7#oHuH@E zYs!79{A1u!-{Xb+hWIn6yVPg-QXh}sj?u?0zplLcdii%2eC?B8>RVbLt8W=N*RQ@_ z{>uu!`s8PQ;@|b)Sw)Noec;j`&ZoJ)ps$b@Usd2`*mF1de0(B#KkIR@_p>DR%P;j` zN3fUru41 z`}@L@|5wiO-c<=d40c~|TETao%6#RwV;;y@`KN+Q`IQ)0 z@=pYp{F@lZCExEUGr#d5>j3_^llnOYuV2lDR4rkuVnf8O$n+H6-pJod*7oK@hk-xE z`Pl*S?p5%YN$;BQYVa`1Y_s$+@a>%4!$~F9&mL7D0}c8GvKv$Obpb{E6Aa4uZ}4xS zz+d6h#9;pc2OJRMQXF)#ag5gmVC4P#e74o@ai8_p+6aGx@~y<=2q@-TmM170L&FRR zXwRSVEF9%d42XLN^Z`RP{KiwCdF}D7#q;PAl$Hnvcp5D}s8H%U2hn6`NgtzEBo z_TyTIpTcq^cJ)^3+5>P=$`JdoO~yBXecmU}lWV}AE&AjqVBb^w>QsIm_)p-~32*lE z_&01%NLYPu!RV}SPx!ZhPlnI(7a}a&bWZZ-8Ee&x7A)AQwfVyE5)GjBUd}n!t6iT5 z=U9>d=Yp?YE!vgsQvReAJBS5+H-fW1URnW)bf1dW=N1id^*r;kF z)8_1|hq)$(zXj*~zTk1cs8#$AzpWtZ2`0g*zfcXj4)h#j?j-@d#anFevcLs zVwwtZGcELTyo2OCvlF>l$9GQSoiCJmp5>tHsl$6|s{`U%f6w^$h|fsaJ!hMA-a~o) zYg!v5e{bwe8?VUYI}vbE*Js`jke|N?u>7ImT;BP`7|VU)d#cobEr;a0o-BVDevrPy z#4&^Ow18NXkbgeuEU&(s!Rm9|+7B09#0T_|U&eLgC+LzFVje#@qQ%v?&|}pld{N?a zJ^LgdeF}U9={d?kV%M$`AJc<>)q|(>lwaDzcP%UR*}f7#+Jk2m`p$hM`fxAuB=O^% zOYD8jjPHlfFzUYd-S#jny7kH5w}-!f4_|xzE=#if%QtcyFF7TJwKN$maQhm<%yMedii2J;FehN5HlylgIhvw#tFjQvw(H!aU2v?G-4sVUC zo~>;7FwxGeY8GGYEdZ?!fx-7FVAq@Lt!#1F>5HxCr~j*4F8P=9kh6>~J= zdEMI4bjUNmI25gF>(}`vrnR2J2kCVq%~{R0t=ilg660jAU%#FYQjI7+(p)<$mmKLP zC`Ey0P>963SMgEQWI< zs88XyK036kW8!YJXa}3P8jr1TM`B#9zcx^7)@Vg5c2i?oV^(7hmNYbJJyVHR=-ocU zzU$R!MlHn6Y-O_7knCUFjDfb608YN;PaE2=*b}-Jh0SJ-3X<*3bq0-IV~!ZvG`YwD z)a{%A7TNzT3fb7&z+fzH`)U@C+6dl~0Md{IGD+cZeu@l?PpB;{g z4er-KdnMhf&;XrHibGV5@OEDAtvOf9*%AdHq6^0H!6p9YGZ_9ly(~{+B246b@BRgVkuo0thmyw#PT}Z4wWf)1Z1b#FCYk7L2_&zPak*cJ0XnEKc&gb*0g;FD6c6`W$112Cgkv*DzrvJDJoBYnMu+AF_AARq1X_1|=c4NXjAEIJ|1Mxon-L3;e}V+5T`bkS>g_yNOX z#nClkkUZ@lwdNU3_Fe1NF^`S$EHhwIIyQT3)$EoQ*S4^VzyB-O%$io)q_(M15QJ)5EZ)9+49&9ym=V4s<_S7%*03cLOJjU*mor5b1HT39|%QgaR9 zPF3#KwXH^&m{d7==ILd=Ik}Em-HMBXAujW<2=4Xo1*H~dt9o3H(#_bbj4yp2dq$(v zwkS3-tR|O+SLUC_ANbDRi5=upfv)PWT+h6a+d`Qeif$KN8WhI<2yxo=Jp1(~TWcNw zj#i{TD}ha`_FPv?dBk3H6rRG;9FJ)yU1K9wo6u#f?V7=_x!`ccHPVo45F}4+-&j>^ zp4#03bZ0c`-D^YjuD`6-{6Vexsao^0K6eCZIzn4*{nhp61^lm#yt_8?soKa*wUIy8 znyc!~Ge)ki<#{Qt@oU{2hn6xEbu4&|wbN?M zDvfncuWJ{$)1r}Kt{CNqi-@_Sws$%1 z{#7L_*5=86owNPg6=6g#LtD>#1QlqplDKGi&4EkW)$go29n9Jb$z@&gyC z(O42SnH6%B_qtzFuvVu$8lDj{LNVUwGcY(be!_(32dTse&#c$$FNk@m=KcYVe{smG z*IClhL{_sobZRPQeIaXbaOia*FWQD|V4M^6(G=_p3dW6lW0cE+wy*z^l;<-+No?HZ z=JjFh_=%H7rc9kSedb29Z!xdlXPpw(4Gn$PyxjhA{ewdjCe64%$TjrbFvTb1(rLdo zPogQI{NV8LUt&(k8$j7G(hY_IgzM-X>frCs4o^yXdNfjB-_)E}#|god;o(hVo;K2- z{kW<*xY)c}pY7CnLldxvTilQhfsi3U#vhRN#f}S(IJlcft@;Lc91-;a1_p;wHfhqx z$O$1Y^mcR#4S8iM8$2I+ZeZZGv25(f;KG3>w}O)Y>@$qSoHv)x!NaiWzF!VgKHxoc(LB(VxS_ zZn&2iyFw#_6CX(Wlq4&(?q?w{K59mGXdt(y?e92-$g!S3ggW$}Av1(^!^3M+*&wRf z3?zToVcDQdFH+5rc?2%LGTJ6gq)Rpqd1RvA0Yeo-3(ZrIN_4<@M0bjE=yR0D4%s8f zDJ#{2)!rWs9b!xpEE6V;Ob*|l0?5koe>Sjn4y=(JayZw5Q48Z zFNL?0iHz5d>SI2ME;}pcB{5a-0*BNX~Y{SEkhCGe6Gh-!xH7`sqA-o-K z6T>67!7UBrYDk*Mr6bCM&-L^8Nt36}4|y0vQQI({5x1jxNb0!|;KX>_JYpj_z=?zC zJuu{92*socjMwL;veALTTTQ?$wfb2xF9t3?bx;>lOr(liU-fUhL~`UH1PLHAN`dE*ZA?i-#|f| zW~Q@5zh8Jr`aRKrd3H?*M=BtO!tWZWwSQoE!pM|qvu16)+5Ekf8<;R*WMt;1n{U12 zF1ziv+wQM5&yms`Vl|#TdFu2Tv#tnv1Fp{$oi=0UtXZ>fF^^%66;^w(Z!a5wDZZ>b>;%#@{^U|nqU~t07w3!=ivf13Z z^X7ddm96&=3=OkBO_{OL?0Z7qI1C$}$o^_7&6xEI^Js_bHpaM=P5M(TYg`Qsjh~Fg zGiMGBXo^HeC& zcKoVTuhXQ>vyU$f`f!OP1G+fY5gg^PkuK}0*8*=X@0CMi3cuy3 z)%zK&Ax7=rSzN#;>c*shqk44Ch_!DTw#0$Fup1ucyAkV%;p22LJaOXbv8+pCm(DUT?1bW` zVZww-lYBoa?O==Tw1HDcMy9^oJSJWzcB~10`B2C+Ke+%qKN0irpD~I<$4{R8rJQGJ zyzJiO+ve5!`km5d%-(p@dGqJb|7(;B%Mk&UNPk}`nkPCUL59ZN4D&Af>EOX}*E+7b- zb}ZX9#j)k@x{%W=iTVc*HZR6TT$VBMu%yp2IzW0((wBRkCilNE$k|i{gBJ!)40)kk z@EisWzcQ8$)wn7d9cP6+!X?C-9XC9Dp?OA-3vU=&lP0}A=nL(QT|pncC*)bJl`@K; z4+VY1Q0N`iO_=cMke7SOP8t~aLdpw9TN-2TiFs5`^?hL`pZ*K;8iSLj&1ubFwDpdA zw3jYBXovrYz4w4~s`&cKcY z*w@B33t&T~1eIbz76ri`EQk#eL@BcQz0bW92=$B4_xV51^ZWmvo7Xv?bLY;?ojaL( z?$k35++q`w=n(6E6>j%srH!ujMu|>K}cW|9oC3dvw!Yp zi+38`J~e7|G~(msrzT4oFzN#5iJRn$Bu-QW?_9rQ?`!1G<))jNKBKtA#SalTt-j3i z78f^0+-yb%p1f+tG5JV*5nX4sUUS4vKNzJ`*0UH9l0a#RijJOP`XiwJn<#7Z#O=s^ zCA+Cx92cLc)%m7BDfdT?1=^oPXdINA2ed!);iMqN$3JemNyf-w{7+9AZjw`mx}twA zIprno&-7syqh;cD+;PNBQi5mkxgy%1(X_JL*G9V;>d0z)H{zzBLjJDz#my+=a%Lnl zX5+DL#tXXnxUdq%mWZ3AQ5<-{ZAMthR34TJi?qRZX@8RUMuN$hKea!}1hXZSm}oVp zf0^mg*%fEH5xJSX80yZx5ck`wR8S_!egS=t+iqw(Zl6LQD;3xR3QeYQE4W#y(A~_7 z>u*z`vCJW6a<~sSpIp1pru@vIRpMuWO$9(denWJW`9FX*Bfkl*1L;r;y$!A4{6pw1 z2sCdY7a~4C_mz#0{d8IeA^%;_DoDb}eLsODesPmHR+9!v z7ikYjIN}QN3?bY@*eLMx41S)`j~sj-f3c+DUcxY0FT|pj5E$4=z9%E6Ag5YY@CUm0 zt67zwjSPceG1r2_IUhkj809!#F_->4A&_Y)opicDSx|Afe6 z|HH&HhWmWPxe(9cV*KA;y}+j2cXEw9EXFNVNX=nj&17ZC5~ge@mN(j8*%rJwVlJhLqFk!RUNdamU82XYN6Mh*oye+Bmsh+`1< zg+eU8@!=MLg7}lgI6-7tAmxJskh_rkJVbskK_(B})49jfq@kSjEhd~i&!v>T%g9eC zD4QSS*Uz(rCh}~Y`#6^c-ahdU6^|hO>u}?pDxO9;nuFh0p?N$9`5l@;+;PP99`Q^k zzLmI1dhw^;!A&NEzD<0PTE(@wJm)gv#D8Ed*Xghi-GbXNkdEQNa@_IjUrPKeKyu$i z__uH)4gOi&Yc=uUH{jyg{P8bVmo zD4S@9W|D5w;G?s>m=0+Ft%O-a7}6a=_FuvMFUQYT(jaA4@?kyKh7$)AdV%{8zi&3> zhWq-6H%OX%^4zzP|18$=&*q#CbT`l9-@q7VE7yqf7JPm>Y zA@q(9J*4&!4;Ww}bAU2cJesgPui`xoCE~_=uD;>=k6dGdyZxx@ic~daNYuc$i61{lY4OP_7Vqi`dfpYAnqxfTe^wUFZbxo zc^Bdl>Q2~h5cdgqIOkr$UYtuh+TfRK0mA!ncaxqFe%!qw;`N;cbs#S8<0H;uWS@`l z_3_t?FvR2M9zLGcOptT1NgQ%7;uGU$KGLA%{-6)^ zabF){gS&B)>yVQ4{>u5Ekh~YaaQ-t0i2 z%4imTFG6le+TC2|o$-Ti-W&I2xJ&$`(=g!3I}&JyI}{*3Mfvu*@J}3}ddS=-*aDer zLE=*L!O$(zs2> zw_juNcGI6PV4`1RKx3u8@6Nl->uK|Kyc(xzEY|)P>iYyW?$nrin;EX1M!&{V9e$2J zU#xMPMm5_E*F+^*g*K6Fb zvB}+Lxc(aFXk4aor^d8W(=--qT(5Dr z#JgJ#;69;fa?Yd?Q%6ji%=zdc!>(#Ee8R9{qel$8$}w)j@G}i*pX$x! zmy_?!Z{uy7*UHsA1ZvTd%%@dtA`JIohSL@I<%%{ZDW^zxy#x zz4~^&s9W#OL&gnn(@MwIt8d?nJ6}C!{58{#ICSmPy-lmmQzI#uI&5-h@=jmoESD@C zGkMH}@tva|dB}*iLq-lC*>4(Dr6_MX!5*|rzE?-^+np5o^( zG%%>qAA6Z`K18GMy-~(_SB;g|k2cOXX*5n?McV%|jm1Bkb;}6$|GmHAwM(2CB7%jE z0fxi=Hl}+7dv`V6-LlaMM+8UrA8ed292#>BM%+^q4QCa>X(P<%RH;7W!fO4Tk@L#P z`TeH9v-NZOHGZU@Go&$X)>tDRw?_YGR~hH0!v0sA-@U8Ho2V9>`8`zUQ{-H|In0RX z<{Qj(1ay5lQbUhmKwocTGrX$^`sbM8o-v)VrS+e41lF4Irs?P+c&4#O(tW1>PvwtY z%q%UqDC^7;K#5mmK_PJy7CFD+w-tZUlvcdNBi!Kl3FAiqbmWBhiyyTu{Iy^ccN4c@ zQ+HDXix>U1$hh7lEIlvESLfn7#(DPOY(aOOR>pbdGvR0CJW%`5+Jc3d(=!EqrPr1U zs?ux&1My4Zjq_)l8}atA^{~nLqqgNXH~5O`VOwBD;AsqhYP#_Zc5%{2m}N|n^Azo7 zJg*@il~h1-gk!pyH|B}S)#AH$XBhrdbqpp(;_ajm5E zFeK;5xd-`XXb5yY%ok@T=_dA9JyXMqb?Tj>$>2^QFA)~@8Yz5 zY3BK2+*d)7_=~OB6^0_`i)qup4@J%ww6Lf>P~=?2SX5u=$T|15Lr2cJPe3y#!=5NeNWS){44sDdP9-$MfjZ? z?Vof{ha%Ud4|adl|LZNgn4B71HdyCZaqXW-{jS>k;l`1WLuhY87ybN!(lw>*Y*P9u zT#f*F_jOeM74qLtkNW?&bM23)>t50}AS!)@q~)oo^aL_iQCfnT>kMtf4eHcFAGzwd zOf97f)5oP_StWf6+_-=FTjf}@EdLrVhb6fKZ;vne3b-5#zOkqmAoC1|;ya$fI{7ne z;l{zedqv&X9vmTr+K|;U?kT`g+8_Y|$AxX?RuDFUm9Ri7-m1{z7O@LuvOmwr5TuXx7ngHYe z!DP(9!24wOjgQuo@Vs!o_NT&Gx*0j#)ZH>6Qg|@*9V&acj%>~|9ixbTrYmy{QrxeIa&_n zy6+jYo~EmXDuR))VnP3KIK}u+#f*TMZ-`Fgm%Ps*{T&FS4;KHz9y?Mf^pO{PDPNrd zvGd?}#?FV=I8^6QR18k+Rzc#@9xTvuBz)yqY*0gTeK)vI%aQ9|VjKp^^$DO*RO~E) z#$KM*lWo9WT8@NQB zf#mu+P;A{rhgW=WyX$&GAvi$Gk??^8>?1-FrUZOZ%SW!KSMaop)8BZ;rw`d9FrYjb|z(Y%qOCQ>;zOI+#fGxBf317_l+uChCxaGL( zi>VWQtm_5az(ZP&gb#53n06}$%Z|IQ$nOlD=PpnvI{yNUQN03*+cNM=El1+7q&)4^ zWokEg;JEU|+8b(QDe>pR`^5K!`xC~J$B`qz|M9y1PlDjP$NfJ+bj$A%{Q`!y90^}E z)}mHI5@Qg2SId#>0sfD5`ah`zKRxdM36P(U={$V`6grwZ;zXw%(DfYAZ$i=6i>Y(( z(e>^yC=`8N(jofS{fpMSXC14*>*$0gXuL%?zVzvly)&HJ!Sc6mm+5m+wGK$SFOL5X ziL?jGdIa(8fNDO+xA zF1Ai{lX7h;E7y}NJvDAstOB%_m75lU+d<4N+=Jbu+N-=0UZvOLZFHwMhkMgI!hPx8 z(_>VR^uFd>nr7i2iAjq~v#R*CbYyqhG}A8R|TF}uqrTL5_94aoxhU*gEb8SrGDjs zq<^9Vm8f z{x&gsG>*&VQ-sF(M~gZSlDsMe2WWW^I9SW44$Kw4D0LwTp9MD8vKQ>B<2 zvsA6qs)HT0+yxw<<acbp1O713Gxf=gqj#&nI5{zrX!0@Ttj)ip-?N%e4m(Y`$)P?W+#lAXL*}? z>2dUSfbUrJoAE6@X$`2Nn0X+gUukU57pwt3dHtUfA~BbIx8i=H54ZdD7uxFQN`f#OAxCuPcR%k#E1$5FVC@~3I&pW_2T5bpS z&~hPowU$pv1iAcBeI0kyeTtB$=zGe1)@}_?e*e%9ly6AVwiEnW%fEuVw7eUv((>{5 zFHT*PN)11CLu#C=Og)JFcWM~EAoC4UydrZIT;(*(p%tE!lM{D*aAjFcy@__2+&>>I zgz6z*2wtS!dA*sZdGhqD?d$;zNq8^VS<61~94%h}_SN$72?$LfWRXR=xnKeRnyv3M zhwsNcE#Jw11j#*)KUz$_ZgPvOMobz%;_4RT#>u!~Lv84vX?Lg-yvrdU>tMPb>IUzA zs3*MFp}x_*H|ibBT8mY!v%Cv`&+-BMcgtRQz%?74x4`uvyx3I&f64VWx^S;+FLKmD z9Vu4VlQ46q9FTlUoM3D1-WF`9Wj1>q;)2gV(wb#(AkxDh@cy${LRY;dubmx6C-SvKvi2Z^7CU^6Wn;j6R9CM4J9 zfb$^9zuUn(wflVVF)cpW?Plk z`HtkL;m;s@C&0s12f_!{!SJE*sh?s+s@W%)N+P_ic()+&UCcZ3w0=(} zZ({5W5_j3T!3{}$%L7h_P8~bTUOr(I395_#Ltw3~rra9rtK|vcTrHP@Z)KsN^r>jyW>xFz*&&o)B1UxV)vSaC*46e+OYKR!|(JPQxy|_goz2; z`G3C;?>Ond97w!_R>)n63*h%8mcq*uUxL4q_&R)f;yduQiR9rCteO8 znCNG1(U8Pp$RiUcz^_f54nOe-*k_Utx7zQ3&$lmt-)k?0m)jS^m)c*o$I$+K9eKI^ z9r!x?dieYH58+$wU)W>Sm-eq^4VnF0Tz1&2;L*n|j+qYPciah|@3UatMisNp9@I>)>4_Z=JHm5z`jRc&XTJuy3ehaYf+;l~`+!qupOdt2}w$jiGc zkE{9h@_A45Zx&v5V;L^bJxz&Uymc-7{jG=K#o?9wn{S2J!QTsSgnty?3jZwp1w8uL z{UUouLE^d(Jf!8rV3n5DV(J%5AUt`%vmo)`4;&6jn`Z<#O1nqLFK@gP68}=uZlvWV zUd|9}_?CUz~mi6F|F`onRX+cK|y<@?Gl;7HHWA_JSmB zh2Q`!N5^k*+MIloor&-iXDYmgvkAPJ(+kgcwuHBK%E(hEXLoonXK(m<&OY#d&dcCe zItRiBJBPtXIrYZ zwU*n0?X)aCqdm1;2oBJ)#bKkw#$vO8{BfkhYdD&~n>oDjd`C-oYeyS+J4btXCr1}n zFcvt@M(*Y44L{G(2Y#Vr0Nb!%?zj?pkYgnBD92P}1<4)cd1AphEhmCCv|J0Uqvdq4 zwU*m~9kg5k%H1TMLa@JR?)4~hGYpo}w$d zCb(S7$~J+P)U7eM#qgwY{rCzO#a(FMZoSBU37TYa-4E;XuVsFeX;GUqL-21hcfxmS^h7 z7`fWW9^ zuI~na*RqUie7(qOhAXkE_OF?;56oI-%5Lz<4^4S782VZJ-;bYzTBbCgTf=6=QwY9T z-;|G}g?w)e$^E0py8h|^9^FqTV>YWGiBsks4Tg;8|B*UBWXL)JO}KYt-c|JY+CMEv z(S3tK?)|mCzn^geS$-g=faqgS+Dj;9cX+ zgW2Csa1cU;=MVV+5~1Tq$xKeDL(eg_Opv(fXxt!Sv((9 zl`13)GA(Y4&*HZPEX9_fCB%ouXAM|`Y?2jVFM|L(VFqGV9L<~rWe+%1VjwY)M5Hw^ z!=4sM57cGr7`JN3r?E+(8MkT8=A1s&J8&+y>!QcDPPD|>L%4OWo2^b zlt*h1j_>Kd+1*av<+j(q!RoBvtiDT)X?#s%t6JOmhsGZDW8>eDXEj~elv-xf&*6ug z*3WGe(=fMbu2o%{dnMfNtwsy9mNx@l&+9_VbUB<>^%>^UyH{CN@2bnIs;euj1|i$S zox`ov!0@o}k@oa4sZ(kYIYv7P6AST}X;`LW)LYgy=%bIUU&FsQX7~JR{mp7syRBhd zuCdLsrKnqNa}sQ^D_pBwte$qQcG1RgZG?a6`WpVL>o@peR~7sb@1vpxOKO);W=cHp zxh3=9S5%CxNKsc+EIrh#@Fk->bP4;yR`qT8+i>*z8K4~ftM;?+D&8wd!rhDhii|5r z-;0dTi@WGJsY@mKSV|23t2$NmypXorkM{fg{GB--=GU#dCXDE{WHhfs%Bti}DUa~~ z)^*o&Gd}6QiGTS{cLM*iqkdEV<FVAiAkfL-RqNKI_Fa}Ru4;?1-j z`X>#domG@H4c;uJWeVTH8aMLAG-s`RmR{t3Aa08LIye2~?z!+n&tMOw&Es#d)jFiX zBMq3R(jW|<+W6kal+NsX^6rnhH}C#D%4L32>gv7o`@%2G9}ExV&xJ3^Uj_G;wl0n2 zB9C$WK?=lJxcG<#6SbTIrfRtc*hI_CK(Chb!IoNX4Yt>EC$PJgdx5>Rd>+_G%Z1=& zko3(A1czz&k>J%@E&``$`S@f<&Wmi5ssCJKyB2=E?I!qi-tbs;n{AHGs^;3};c|!V zF68;PCy}4FZHMo+h2f2|nq|=f$QlA4nI$dqRawf_)nakg;>}NUWx?I99`N3-KJY@< zW$*#6!DtP?>n7xY>t*<>u6N*TT_3|gaeWT|($FA#Tz??{Y3Pwgo)HxV^CGD}id~uY zKu;E9?X>AIz>|vB{{(rP`V+oiEkkF8tlz;^Rzp&lopmLAXqNOTT$Ob#{JN}_a8)l{ zk8hZJx;t4da6js%jCq<XM2d^yI1pl~XONmu| zQt~PCo{})!TXA^>EsKib@R1c`;ObBu-#kyaLzu5-_;R>Ds`su=3%YtAcwzNR;r**$ zj@_awst-i=S2z3oq^EB|b(w3mwE8RXWz|>0gVo={=iAlSAg{0f34B|1DRb3p)Pkqg zxEwyvct-*?9zqV}Jdi`%GiMRJH0K5Q;+$9E%W_u2gE?#A>vKMYSLS>I-NCq%l?F?uX5AZhgL3ql);`_w(xWkoNCoH3In@H-=iv?zjW+VEnuB{A>0J zXrUeU-{2!16KIX>aQp@z>73w1cK!x8dp6AelaWail5jVAgbI@fB$J0mAEP^^DVoZc zdQK|;VCq9~bFN*gF;}IhF^i=#{Zm?NfvDLjg&6}f_;)g1hx?4Vt%aEbXlu9^HC;r^ z<}C6udl|AZGj?~`0c3N2qdChpHJomgu|(CFy{x;a`Ig6RH^kl^dvELmu}{S=jeR5b zHddh66WSzPny@z^#!=Ie=9r#bp1dNpb+r)Y9cNdcTm7!;k5`YW(X>WhjaD@})VQ){ z&Gb6yZPM+`xGl|$&vImS%<7UgGHXoM{H%Mjs<|dK7(8~>*vqdPdet8<{{3S3#eSO~ z+x-0IH#RTd{LbdMEw#2}ZRxP3U`vlJ7j7y3EIxErsA1@bAAb4aw;#ek#O!kKs=uqr zu9myn?dq_r_pWnyoxiJa*TuW~@49@~mAeM*^6wh9>#ALocTL-M)2`{e=IwfBSNX2s z?#kUO58iudv2``?_FC(vBk%by)?L(Arr55x#W63{7x#nuK5hs9>mTv^_+Jmk*G+J% z25c4*qux!JXfIVglh-B(7**O@=kvI3X(e@sTc>5-L|$hb8f{wEBU$y;qgkua5z*S= z#_XHW1ru^w!X8lbUg0pbllNdjxI-!f+L6Tq(|429cLdsy8VkIqCX>O zkt1?)6i?!G^y2>yq}~6`$M664A+{7xebg{)FKSlbW^0Aj%I;D3H2(I}umv+_%$Ng3 zVAhcX_c>fCKILHqnG-zaLA-NLb7%8Xs@#S9%$XCKF-M6wYu20~_nsA+K~he2`#CyQ zr@Hx(WYM^#{YEoZ9cjWcU)0Hb(IiH0Qm7AAV{hmh>}y?1)n=>HG?mU+O$K{+XE6@$ zQf}o@XQ}$CfziNiteU8%?0Mf@Wvd*O%gjYDJE!N>aKdIo~oDXt7=w1Pbg_&Y#0|S1{0T%7hBa|JlmhPxVThnd|U$hzq|V)>UP(=Z*hfhT(>M9U282Uuap~_?^a#D>VKdzPoW4 zuA0thO8;Qft?)0J9)edj4L76K*t~mldR?2J4{v&CXjOaL@T!sYe>lUL;c6-?To28E zWq1&+|-xQ4U6d!!4;@g7TjrhJRX!Y2_Ml)u8U+}@4UU#XnI|?p|zu*(sc|R0PE?T+8 z-ehON2CJ&QL;YCra%$n>Pq+M7u(@VnUqZ=G1)t^jn}6Swp9}gGZ-461F258!kkDvc zLF}&uSMMvRcxe5v1(U}PeQE8ST?PH(Hr^iU@mqnJC%ZMCm_yI2+iiE+p0ask7sSf= zYeB+bMqX#x%j`?+U)f_EO&xiTR*trg&W?eOS&q9L_c+QNOB^pd);iwfHH&dJb>=x+ zIR`msIq!Bp;(W~ct}`jIT4K}09*O59UY2-g;@yd5i7zLvNqjf)>%`qyaj%xtBk7!^ zK+>$FrAf<^wj^y$nwflS^6kmbBri%{le{i@V{-45g()jiHl(agJ*WC*)dx@yTT*>h z_0`q4RpReT~qZ# z_{6-4a&aT4R+N`ZH$uXt{rX9tKuoKaEp512?`?37bO~4|Wv;V4{Ln*|w1HDB_^~Xl z(b015Jq;|?t5uWFu%-Q7->MBCe4y^geM1pWeLD9s)$p8q)Z969xExSf>n5sEBS$hX zc%UM@B3|5mYW}zF6!%h3-=0gjW{Nm*cdPXiGu7-NY51+BzPY}py7f<)<(I0uUzeob z@h0MzzsTWGDP?xm?FQ+bNKgeo$El~5$8jGz{NmyW8>{AQjv-Fz(1}s)@8X@uMrx~; z=v14HIIL>mC@bkS9uYss9?@$qqSyb7q^3Usk_V4oHz8}33LtT>1V7bs^xBz1CW8%t z3_oCGO+)nhmguzqG6JO8Nro}M=cXV3*rRi8 zgUFF}7twP_K4c^_3`v~P^PzTsb97C`?(dKx4jU|TJ>2RlOY@170zf~0Vt1NPDG7l3^s zxz~l@MOwZDybO}~2Y^E$iDxJ{T+5@tv5+0x`wc8_hT z?S9)UwuQE3oV{*)*!G4^Y#bEZg7hb?wmofo%eKh2)>dYF7oU~*+=tIi_+06F!?qir zuc)By6MX)T&$szKjqfe^Zse&X_D!}wI9r5|VthZ0uP1R?NG$i;s>kHBrFN^BdNEyM zJTYBk&WbrZrdiCnxCSy?#oUtFC1yru*O-}^XUELSJU8aH%%L&E_|47?WLD>DO|I7C zs)wt$@;eJ3&A2)=W=`h0i~RM5@Oy-xzux2ZzGmff4^mWSYvwtRTw9~gU34D5Ihp7? ziM#7=Wf0ao9J>3 zyfb_5oBo{(vK}-})pdO*WURU_x3IlT;^Z* zzGt(K$LxU~Y4kv!tfxo%q@#O!%>HR}26*%e%VYa~WF^9x^!*gMr?_L(HOKUDo3qO2 zQd{+(q=!4+>##-UDat%^dc5Zw7zWasqSjJdmWP z6WCA7Mc`a5mx4hpe*+%WawgyKR{A@BDL7us3&2t>zX!@%ur??K3m6$k|F0ZBuS?#y z)cJn_c!`!T1xIOl2Kb1UUj<*+@|)laNdEVg;M>}L4Y*OuKY=!#pY_1DTD}OpO3Sx_ zPiXlK@MA6S0^@alo&|Q)@}=MeEzbj=)$&{5XIlOO+^*%n!J0bHYl9hDZUbJR$&ij7N*i&q(OuDBTGqXqVu z`X*txeTEugFG&6@W=qO8wCbVMpKI@q{iXJ=wMluMHg)(P(`?joW79s){4i#F=8u^P z>ZiGsGSkX$ai|5dHwK*> z=S^Vb*6tM>-Cl27cqeZG+#DA#_8#(Hq5k$R$h%M7o%aOVIhgmYp`&FKa(ezocsRd* z%K>UY%WzAs_6hePW@8+EjxmnzEp5-}WNz8UvL}y>sdqX2@r4D4Q>!+qYE|jhDX4Q!jFe@)f3@RxU1T3%sAZ{-i7;t@L~AL zj_C0>YHIX6tv+V_?F|catt_kH?^y2T|G(e*BHSExoNA0Z-k?VvZ?na#IVTx!+-GCe zgzXl-BlC<^P^QHRf9xD)aGkh1CKOf{yl7r{{7Pt%jGWS z_qpC;d(pS`=;a5vR7QxCj2md*H7krOlKP7q{ zjBn96#ux&N9)X`#GJ$c0iF(}fF60HL7`@zA@+VghmUt`L*z$}qOn=4b3jQzCa*HvB zY1;QV$w=nOiig5Jn`#M3>A41+rsa9y?ONVWi8us_A2 zbz5RbVKXFtqStl=##___khljw;(G;&90K=h+5a*B3ncDhV`C#E^2A@z=8(wGgD+}% z3HY*>Ex$5P5fVQwz|LA`nUG3^#Qn4f?{#GUUG)6F=(%|RbS~gOox2x3cQAS$pUfkS z%;WQshtqXFD(VT*bq}di%5zG+QtFf-ve*Nl%zl8CBqH_Kx;;s*Bx+ z4mgM19?_)szVI2wx`UN=(G8I`1s@=9wc8xos*6K(!%W9YM@O~F5k!91@jmmSKX6!` zZIsQ~#o1B$oV}RK-P?H{yNR67OmZjly;q?fRv$C#`vY9IIxUIKlr_R3?E=e6#L6R@&=*rvkkuOV{ko4p_{`K<@Y$(%z~`qv%+*IyA4RT(RZEw8wa&^q32IfHHRzyqb=Je{r#GV2+EiQR z$U|FybB0xQ$>_@5hHe?% z;WILx%y6ki870W&89!unRzGF@g1jqZPezQ|o6#UMPc_VJj<#!+*&4o`+FfnE=AwRS zgHmd4rGe4`>Xy=%OIxZ}O5euiBEvr4%(9ou^3*G3ZRT8a&I|l zE^h_zQ+`8vuDYrG=koDtSNU(a>?{AaVwd`^Vh8&o{7~^D{HKav;3qp4QRk({nAxUQ zH6!NESf}N#*yOl?N{Ra_Zln4!?r>a9RTcMV{C;)NUgVr=+3Va-i8$z-o_MS3n{-`L zGi6D!@n6+Qsm0D@wNvUK*G+N3TcxzaWo3$dA=c^D(i@S@8u8vov&-Y^E@5Z?VkHR4)uWNA$&gSc>?~V=PCFzo@e1Dp6B5&dN#l-J)7Vkd$thU zC!W2?s(w73k2d&`nzd^9DkEph8V2ES zHT(;%8jWv64W!X1M$YbQyb7*N8?4P+G^cjdyeGU*^W$sc-)H}nO$$2r!dz-WC#>N# zYv?iF>fU5kgSvT=!Zx*+_r|E3FUY%_I`{)o^>K4ePqX}9`NWy;&relD@~0!u%U=u+ z<{zz_n-&tAls2afwkd53Z(n+Cc^B)n^6MyBzQcVF^L;&h_;9YOGUhpd7v9Ny&0mdL z_TML~Wm~8>LOiu$yQtE}IwNGUgC_RGc2X?Grc(jr#yxuNgxI^>4Nb&dRxd?tYem~( zi?&J8kJ1&fF?kzu#2#iZG(p4$%bUo{AxY0laJ80w)p(mBai0QSqvbW=dM$4NKZm5J z?@KUZ|FT_m>J5;Dm9?wq)x@?XC+CBGA#uMPjJCtImh&;VudaoDg~U%+T8G^rk^NxA zo~YQL>V(#siF;?T3nYHTo@#fr7FmZqp`+_(zCkWPUk${M59|qv|A)axwfs1E#QrAl zTEtdsSM*a4Nc@ZKm5EyZs~+=vAaUEf z$-c4lOI&4P%$#kaz>bjk=?*?f{p4agvlfC8TdT6ZL)JsDz+C3+&yLy>Ib-`h|ApmG zY?DYCEaiDF1^>4!vNhZP<7Lt8Ux>`<{YuKZCD&qA`Ia{D_Lg4ob1l>0*I90Y-(s0T ziJfJ+4SBX@E_@zl4_Uisxf_13ck@jYhji#2_Wda?4s@;O((vh0G(=od2$Eq@~aW!aB>(2{Sp zst(qUv~N3GyTH3zyW!H^+7r3A^#bG`wjx_|HOV&B7Q^i86Z=8#rkCs{lC$+ z&1P4h*>>UnhwU#$sSnr=;(plHg4UEjCcu85^J0SV)iE33l`*-oR%P~^ME97Oy(Gu< zjMTfYo|TcmDtLk`1>I!M;%?$`B_Gb^xwyI&-!;wd2k3$}xU4%R-`~REM9cC(i3>$<;2p4{oNX3;Qkp-&ab_l@YHnp5KhM zaORqbFj~}NX@QPvX=w}ZVCfA%&vGsNddto5>8zEbzGS%-d5+}{^xi#|`zcEgSsupy zam$m)Pg|blYN_RUODqe}U&ha?me+A#L2oZ_6SD-+0L%}de~Xy`*m|;jf%})1-{3Ms zfOeMU0HF?9T?=3 z(mEPG#(FhZCs-#UPqJP^3^%d9&!%QrXW~BFdI$U->tj}@dfeK>R-z`d=EbV6wcUWe zz0v4>e$MtHWq670LwF@~3dFY3R`{n_r)K4wZ7=dZ+aXH3H)b$8c1X-E=+)a}R>9wj z`4GO5zG>RLvA0n#H|-ReJ<+D+YqJmfx~!YBV#I1iy~)Z}?|yXbBlVuF7pI{^1n(pBlIt~R+st`xQ1^*#O3 z7kFlQ+9EdN zbM2c{^tjdLI-k(`*jDE=xJrwq1rnd;Fxnx~0x|cOD6YGR)eIaZU^t^?gH=X?gsDWz7T$~yPum? zr0zk;2eSX>ds=1KTrXm>?*b}Tak;T7J~x3jvokjt`#dSRwUN_u)8QGp^>A_JHp_LY z<}54VF1hXDopKA{U30s!TCsa>U*wB&FM(UUHZOG^Mz~h0Dq~laq(v!T^+Z0W>U?;i9`m{kd2rPb_~@#!RaV95SNH)&zHDJe55w_r zM>v_Wu#|A!uv2A(U9`sC;ZEU9H6%QoRkI_Eaj~cZdz=_4zx3lUXSxMkW=GS0r0mML zsMyCC%*bda^Oc`e4JgSKlxwpr%NS`4<#{&W+sk!X7W)P(DbcL!`fn)F9a0*xQn@pw z`_`1ol=IZ4)0S>kbA0Xb)<=w;Zhnp$n?1IS|NEso)!o@vO_ysa%RO{imQs9^F_wF$ zF_xQ9-&vntN!C>JZ?mQvOA3wG!gsKyny(pas(JHRQ%xyrdKiAPH^3~{W+|4jT(cA> zu;Q9G-dJnx^>(Je$Q-%-|E64bIehU+$8V(+533qo6|2S?qqr7biXD{V#Bd6{Za4$( z(&M_Fkqg3CP?iU>Dwwaw$;vVs%PK^ySOCjl7cnw^pV*6f_zEQcSAjt-e+XvNr!xrm957e+^W=jqwcHw%{e3I&vmN|KyIawqk+rp5kP9G* zzbp8!*2l`)*rAZv)t0rft?4iN2)PZ|7Ls^;U{@{o02f17;l2c1s@-1)--IN8mV+y` z`)cq-`ki*+z8GAh`=G>z`kPu_33};!nuMP`Fdvfpb_6?VxeNFlG#>XCz!$aqtDu{2 z#8})tU?WK8rDpT3$b}@HcA%H9#(re!gFl&Fn9jKSAi9Or+2AHP} zMHZX5?fLrjL%s~`4~hGOU<_4>&9|LV^F8OZHQzfe_fW&V-|`T3)rT#QP;Wi9{##Bw71V;Q$JBz~u&kgiywaHY zu$KC-?U?%SZtB0bBlTaY`L?pQrOeVpIzAD`J>O(Vn>$ojjdA^xx_k6eq72Pt2Z7U3dz$W7-79%nGxP z{9X1h*$HYFGb?!SPFqLzmgJS7%}ORx|D9Aa4f)vm@?E&!U2-q{zLNX7YSx-xEO~{R z@@vP`oj=9TpCt!NV)P2~Q_a3OTAOab3aEHAu&jSFZF!ihpq^5Ta49urWIf0D6g^t3 zi{f21YR#Q3SlH;f!o-oQ~TDO~%u*W{uve$ml91hXR1F8%U9DA`zBSY>yiqR*Z!xBetlkNyv3LPRr=#-G10^INRnB!sQNZ5(vUgr2#^jfhKSBd>+ zj&hkZ(Ek0gt`lv$L`J`4X44o3De>BM+UfgYO?`>SG?_Oc5ZpWDdX zQ%L-CBef4QWWHaG^f#<2I9$tP!K<}A6P%^xJHRq6zX1NEW%Utt8c5=l{SDN|G8dCh zbMR8gxYssj0Dfx9Z9k*M0*U)LaEg|vf-|*zD|nlh`);Sc@(W{QRIGA;CDd-Q6-4}C zb4cRxg7<2<7<@s?OTblHUJY*4@+NSfmXm(Rb{Qn`>;SEMOgRd7_=sAJ^?s~zl)pxNq>^Q=Ia?%nPs~)R(8s}6PxT}kzMSu z$HgVZr?PuiAFQ#+9;b)na}vDlojQnJw8Vbi!h}2QVi)&byV$~g-7Z#eWxkqNz}?F4 z3+&z+R&TNJDfT^UV8yc&);q;^rklz4@SnQnYxCJ}6%du=*$uEReTd`?-z>(+_ zyQwv>kt!Ba#XhQ7M-|(sS7H-YETYc9`srO*J$=Y2mQKaaX}MD@oQi$Zwb(VS~v+4PaSGbuIRYmt%og=C*x_-QgYB8&>QgAv;Kn#QO5XNn&w% zZPI)EHZqe<)>j#pmD!iHfL%#%!IF0ni#lSnTd|wOMD~nOsj@G?hSbW`KGh4cm*lU0 zXY~cxM_PtOr1jNn)es9vV*g02AIVs!^u?>1kJc_`msZ&y)x}Bz*~i(>zK*gFo~+Rl zYhnu9JhF?F>>(vP{3_>>NP?5~N1D6tPE)}h=LSJCVL zYlT=L61&G@^;m2ki(P!NiZ6DsWCnQ_wZM-L%|9%bA2;&beK@_!O|MpwSbW4fve-rz z%gACES*#+5m?0%~z2iSr{}uJS{~PLb|BfAY*<UMTy6%K9~_8_F8w zw{RC5?@~`p0sbe}6aTkv$RBp9x*>JG$o#|Tx?uEs7u|l6wo|0dw4ENU$hwZ`{RYmo z4HW6$lQvLfe}Xe<0|h@i`8o$_3q{&Me&ooShyPdR^GD{@N7tF8-V?o+pczmEG3mmlJG!heeU6<#gg8}Cwi#%{2S z;$^R!pX2w!569O|NLO_d(&<6TNT?5Qn9vyBG$98*fcmajh<*b8p0*QhV^VGhdnb4o zW4*?O_RElm8v8KcVyxX*ZeMA)s#VAA3b6q{TkYR4g8wZ$L1ZY?`u(YG+7~%oYNF#B zM~pJ}iCE5x58^ywCx~y1Js=JmyFZva4s>D-2zK&Mv8TXLV>f{r)Q~%=RmZFckzD|` zQcG^CEQv9R^!O)sNhF?A?4~i)*g@kKW3|Zg#FhA5b&4H5zM)RdiZ1HZ%;-q6u?D1L zQYTpna?GA>eQ>!fX=oCwKay@qs;6ccyPuqDe-m>pNnUcRWSeSDJ)B;Sy7<%(o)j-xVKJe&x!?e?a9QHS-9MmG8=wp)V^!#G)8B1ej3NsC;y)*V>?92XgosW^ftm90} zRf%ayv};q+ZcUr2Zc8gmtFNMWkgZcUqpqw{iQXA@aos$%#IW|SGGa1VePOIjxhi8a zav);{{K<^x;XA0$vtrZObw08$z|kE6{)*ZWz}ySqx9s1uS&5Sq${C`z8+-OOGxiEG zcL$hY?4mnm(M^jORWkPS+r8*_WNT?$X^e7~)-O#{4N4oAGKNZR{E{OpT-M+cD*YWE zE^SoSST!!oDdXQU*1QDDW+K02taJIktZ8|7)y&ufy<7SD<#xT=<;L=xm_f0)d@0tA zUMhbX`L*(8@RjAO;Hy~+(@g!M*TPW0SKn6rR6)NP^?Lff52>netQNhm!Krs1L_f)) z^~-E#P5n>OFIF^#=ofZBv-d{sW51A{W-dBL%PhBdRI3gBvH_h^>xfRVI(Tm#T^+GX z+S#$}TXCL)HDG$5jA)%Q1E0$stMT)e)+y3=yutB}gV-Dg9d*xFwX{ZfFX^MC1og4r>nJbz3f1b2-~5RwH}kd!PWk5Nq>fU#sb1dX z{M5Ga_Ng7kKS~!w-v3)!v346;AYMI|I!pQRDO`@ci`l>G7(AvA=Ykx@l;KjJlWB?a1i2sUwE6l5IrYt8t&K zcak>s#R^N!`imC86A*2Wt^Q6ry?5U7F?dncotroQ3kKj+GHpGf6Vxm zb#A|9{EmBeW=lrX+Z>}`PPgw!rTYsvE8^VWyJOT2WA~AhX`CEyWIvJ#i>54!Ro9$S z<1{R-s~VMNm&U1gX#JmD%Up!t`E8r20lZ)2KE6<0wj?z9i zmM<=ErIwyVVO4f?a)Iv9rRaeyyl?D6em1_mop>ndtpfrqbVhJ!I4`dCyL@ zFHH*9#Lw~j&wP*jBHVX?4dmO&xJE;;F(m$F|J>&wk)v&q^`z7nLgGFHyj9DJ(k*jq zjC+ASwOj;FhGfo!eCcE#Yni7K0A&u2_?LM&Z)o`~P*o#6xLZIgBz_u$t+Xt2a%4V^ zxK9QHkj$~T1(Z2D;x2P^f?9qT{6NbxM`xp!Wv)(JNc?vJyF!xAufd=jDu)xQKrgcrv^7GH<7+o^vw@lsP&V;a}$Hysh139?mOz&W+5!32ONZ z@JlVrJRBb+>8t=>({dKtBC;pB%&qAFi65C)bF%p~vd>Z%Nc_mW8ktigbA!5pGPmX~ zWSLtNz0Y)rbMY^8YbO$f-bRlx4*MKy;T{KBETM*0=bZviw%3x(F^cT96g|i2 zO!i$m`y<{3NYbD_Bh8S=9l@)$d<{4Yk{vfrxwm(S85fX*{ipkv&L^Cg@!BT|n+LXm zB%T+(p)LoBKKT{=4HEZXzC(sYuH4C943Nm(e`FjF68ZT3r2Z%CUkiG(9n_X&w+GKe z|K5T>dCr%>SGD{)cqY2Ixz?dMU_>t;uZv&hT5IBe4P2@HN9$tI!!6LWe*AdBJV?^h z3Ty*OSr`2*x>?>6(a)lrA4mQcjMmW>t(T*9v=2AYxsC9DDxKS|CUX}cx$oIvcP)z^ z79E_1`%B<5?fwS13X=JWLGUd|(kc3RDf;&}@ef9H^m61CS}(5xPo}S1qMtix9o-o$ zfFw@Q;iA7~?&0&`Vo1IpOTbqkNwes7(d)7!L_N?2iThb#LoGK3BYM9DI=`*f`|YE? z0ix?WY27V4Uv#`Y<7O~gzkja%7<#@gw$bo&ynb(oyQJZC`u$SvX8;(j>mShW3&Duq z_a3MBJ8Qi!`d@Va#oX&&utd9;gNwDi6nsg`uYj*=`9Jb)knez4a+Lj7?}w!CU%mzM z9k`MQ{sWZnfaqWO7PNt+{L9Lg$Tz@;EZ+d*|84cpzX77}eZ;u{jMn?2>t8=ZT|a8m zQCcQH6XIw5o8HER z+3>l>K61qg>ycyZ?d`M~?S=Lls=s{*@+5lzekMD}u3*f(n)<^2CH}v*Z~s5+y$M*3 zZM!ynmF7VcqM{HoqyZUIsE{Ef5-F4^lp)Dflm?}eL`X%NsSHJ_5Q(S^6*7cEq(YRU z``?c`@Av8H|K7FUwZ661|9{)(+_wGLkNxPpuKVtuuIoI`3ASGR3+yj(VF_{UT=}o= zk-3QNg1Jee8@E|v3t9{R%Koxh=yg}%DkNT`{!a<)Sjvg~3%i!;qZeKkqpfU^8L*XH zCW(~-up_Dbe{x6CVo71CQJly>+0$2F%2G<1TlBXbeBGr~xqbiU9>ZDa&sXDKN>v~` z`C96Wlq~mEN=RCs6PA`jyQ!=X}=-ury`>yEwP)|IK#$mNAqu~!wvU1#9Squ19vevN6WbI`!gHCpXtQgkwrk0ztEZrjnU}J?%XpQ~%?%w3C z5J=bXZnTnxV-GjjJw1-WM)vp!`vv0|@XQtEa4l0+)PXfroC|BKxDIxMq7$sU;sw~} zifTQLxV}9n5KbRj9b8C{ik-Q649QZt;bEm=mv~K*N(z^i>I`k;nPS55l%!$ zO9%H+ZF@6E>g2$$*Wtl(BXefK&h8e8-E|}VqcQF?x)GK;BZ&;GY>X=GkeH#c8)713 zbh)UQD)@o1jj^k_mRNx}+;_wY!-~d9z)HpSgEfrX47)e(0_@kgM%b3P-*JLmYn(*9 z6ek%!ARhl|ya{ak&d{Fm=iyhxSHixJuY+xlZ-wO&G!k&Ogvqc*2{T}A6C7bTCTxY> zp0GOsD+MGZ!%t1P1V1g|Nhk*Am|# zxBLIzshY-Z;FExn8@Q)xQEd_A)LJxJ@XEC4!H#K}06Ve85b;SZQ(%o+Okk(Bq$1wF z!{?k1JABsvZuyO~b=cc;CC`zE|BDw6`>*ecjf*`i+q$?SkRdj}^J~vbJyy!~qf@lt|KrN!bV26uo ziQ%_EY>8NJ&KmncVAi0RBO-xf!D3ywLt;nZdx{?r7v}=R4~lo;g0WkKB9|(D0omk> z;+Mqn9T3liy(OLpdq?~(Y>{{=>=W^F*q7p!;v!s?I8R&&`zH&b_eoNss|0$_B;;Xf z#|bfRq{KMnl*eP=2|;d(gbCu)B}`#wOVA2G^CT=`ttD*mS6c~t_%0Ieu(U&k1V?*R z;Q3&e3VbFcG7-;{D8!=_NjyOPhZ3(4sg$5>*H?)qSlY)zh?AD=imQv9q&zI`YJuk< zIZjf98!u@rDZ!aYPRBZDrjoN!(@b(c>R3uHhFvOYhdTC>+awh@SIIqycuM+VT{M5m z1Mm+@hDr)^M!8R-MV3m5R;!5M%(+xJUXEN-Mo;+C9Uc-7xbDF)haHW~h%K&y#FKTmb=;a9O z+{+C%saG=W-Cjko<-K0Oswnlw)yPI^mr@^Yx6*zkDb7zR5Rqd_5wPc!l3|OKc(AjS z&6JUCRc=sr=DsVpz#pSB4%Z=5m6@=Dpz6iRf=F+RCusGR29)S>4R;QkwH+M z3OiesR&TPz&MR17MAZ#G?Z6_7^*7sR1JtW_!#sfRn2XO-wO3ooZBpB;hF=f0aO^*H zQY`}hb+sbcFKRqk|Gt5^{tZ$$P{+zw>Nc=jhB^<$Dm6nJhAkENKCEdNTI-q`nu6S5 z&0(7Ob<)&=U9GtRcBAHQ*dv+|u(8a=i=tHpyg z)IOrUkUNS^omO)KIzqS#(#|k8T%}GOd{x~8(Hk}eLr}B zU%=ynFlM{B9H4(&lVL}+VMt&Gr*2FUAWwq zhlm9IK8UMP{_jHA;@@?!O0BA`Xggy^oNnB@R!8{Gt-o7+xYkw<^JjB-*LkSVy8~Oy zdjR`{_Z0R8?-lHOUL8-2tLHVrZ{_h|+lwlP&m0#4dzRbQr9jXXyH1O8d;Y^$EMXDa zd;5jRbzHY(aFv=NIurK%zjWQAD;Di)bc#D59)K&*LGfT%+T%!!yYT0V_2-K9=Zf`j zUa`9NRO%_kDgR$|-I7$3;-u7MaD5u0HXPPg%@Ov`mF$1)O4jt>cO^r%{$IM1wRF0Y z@!MQ~XWUnD$QS^$)`>gN3~&O-=K}mO!!%x)=2+7FN&<}&roJP0LBxSbpctqCXv{E& z_8hGPuL;l`vN-_t?YjfHKt50ca6-5j1^9Ey_-lys*AM5=&Km@111kVpH}xvO;cBXf z>!%@L0oVeo0Cyk*;Bdth2E>3dzyt;Z@JS#RNCql^?*OesuZ(Ldt;I?iN?MPVK)K0u zfYzg@HRvA#A`-|K0Hc60z&OAFmF55fF-aA z*ajQ~`0Kgy*QDprikSxR*Er{|Z%*sf)3^ry{56`pM(b}zAhS9-~?;| zIP^&^1KfezKrul3>$$W3DH=aOV+J_1Ym9(7z#_mFpe&p_K zCIE-_46QF43DA1|)V>ixYek$v3QQ|zQy-HFz@K{;2|pG{0H}|Nc88*I1032fG#+3M za0*BPng9;17+QOlLraC$ouz&LXx<*JJxlEw>IJS{vUw$8*~A70f7Lm!%u75a*p_2 z0L%bdAB6gVB7h2j-{(*L{hSlp6y9JT{9gEj58yiu)F)$A>Qv;F8RmfJ0Tv8);8lPV z&~hHfUBy}~fD^D2a0h&VARr8&`Q5b6E{!Rmu>{(H3BaH0fFHcJx!#ym-ZsyBFqqaX zp}r=XyG`@9X}&gp?m`88+Mj`Y)IMjy7EJRMXs!b7F+lqZ@b?&qflqr^(H>N^|C9+p z`$*AR{8< zcVBS5`ikEefaaO==a}>7m-FYA)4Xz;d%&MZ&YwfhpFhr@JILTq0L^EnJ)pqG;55Vx#d>m+{%KF;9kKsaPvyoxJ(ZY6O!p|qU{6S%M3$Fk z6bo@Qrx@8;%qzyP2xb=J-TXhkr_!YBf3~MG53`(ma4#^^8NUPnW&M?rvhrM%>@8XR z24l{&2wSD}m+b#U4`#>xxc>KhGs_g8D++ToLmSuO|LuOvSS4ZQrJTrrpf_`u3LY18 zx$!HE+1%)5R>^_=U-fTtz45!zI|uhwT%Yc$xWZz#w*W`;y>a)78Q-`LU|mzxSI9-S9Tj4+ZSz{f4a}uzqP|ydylQ7 zrn{ybx930AZ>u$2Si4j}L|aFDD5tAEN*h;R^yH#F(AJY1t{nkCs;wvY7iO)aJ@)VP zT!G`cDdtoo^po zhna8OK;~{t^7(m-HXnB=l#?KzpO+w?auTWl`IMJ1Wd3CE zbmmi@!kPJ$s|aU)B$)CRbS&jAikLq~s6Bttc7EKyP_BY}e!ikDj(Zu(RgllmSCG%o zS+v!`9S7wr$fulz1VDFjlHgG+J{nB945~x<49aED*hxdM1&iB)w=&-yOt}uKUjhEg z{01=PJlY-?`Hb!W`D$RweUQ)3dyt=vSPqMG68K&c5SIfh092gI*Ybe13jJ9KH@>#w<>`l0D3)e92Ab^K&M2Y!_MdNCD(;1aD$KWxfH}kolCO@nXIYct1eL`hgFyIQ1@vGd}_x$9&4`ykx$xLVHe!9*dvX zX?tA6H30I5fVG*g3m(DzQQ)!6*9TMHM*;OI-?NOxDaSJspz}-xn=;=9Ot~M5Q~oEJ z`8UD0m`^z&$^~6Poju@l0M&m2E@wXFhO_{RQ;vvoLbL|%9&iGSUj|cdXd2=IV9F6u zeM2zihsdWK(NKVVetw92$`Mh1h~86aumV8w?%*EG?+K=Ua*DV2l()YZ{QMEcDTh?d z>bwTO1=`+gCH!U*P)7=^3sC)WV9GD`fWHLn%i`f+$~V#LoC>DA6V<1jlNdn01b8^} z4Z)iLUBowoDG$|FANN5b0Qq8Iapp^cwV7`MrkoT;#&FBP_AI^%yqfuI!M@C=+!f`l zrs1To!CwJ7zo05wU;zEU!eCi|;_~1T%%_|dr-uI-aRD&pv#1U~mqkA1v+4oz`8h4} zCym7W2(-nG;F~aib$fn`;*{fB3Xtyv&Sriwm~vfh$2#DB1jt_jrd${K{Crni9mn=u z7x{DGQ%)-dz5tkVTWxiG+Vfj&{(<%!SDT;Gp64Q;a$S_?>H~i+nDSi|r<@n%yJ#MY zJ(%)d6zAu@+Rk&eJ^$4fhfg^$^7(l%^7*+i@+DruA}{m)EIOUDr0px!Ge`5Y;a4qxe!L7{aKD6hVs6OS6x&Y)0gH@T|7u=8e z{M-_K*9Ie|%i<%!qnSSzOt~leEK&Z6a!)i5U^;jfi_Zp|0rXgN!Sk5U&r#9&7a_I` zpz|yTQ{IYv%3ZAm=-74OP0Zf{c459Ncqj9BgWUl-b`RK>#r?pP1Ecdqflo943^<rzvTYhU$+0w8{*z_ z3cJ7jXZMo`T=E5HR(%QXT4Vea-y0V7fP@`R)J8y(#s!+nU|C9Hx)X(~7k9UsypV;G_`l0Fl<@ZIC&+mUGpWpXP{%Eux zsQ;P#f3+>~>A#{aQH{?&K#xoP*3`DRgvqV~;6H5)B;4^j{D0BLkit7cd&eo`eW87~ zXdet}Yt06m0rY+?g>_?o3z*0JE&|9$090orSdaOEVA>m&a&RZX5iA}BE@FNw*iEqg z*l=(J^Qn*f74v_AdCXTwzIPbQ`OW~FF@Fcxjrk|RHvyWPe+zt@#Y@3F=AT4+Bm$u4 zoB&Q{{$p?%^M8SP%-2BMM2qE=?Z6wDzXR+CP#*RWI254Q?G*Sti)VmoML>#YgK5qb zJ??0<8w^<6VFB2N`K!Th%=ZGP0z*+h6U<|A5wtZ#0XmO3SP#&IKNdWm#r44xnZE!` z>jKgo^GI+Ei>H8JG5;I*2SCrW5!}q;D#$ta0qC*DfhRKG5bVbM%V3(TMRkh75120` zf#(U(ImN(|0M+RR?g`L5cRlcE79S6u$o%PGGv+S>+b};8oWuP0;E&921oN1$hc?I< zfF5fBcp>vQgI$;(45k@XR3{u9$NUs9&6A?|bd2wF1IWJs&SCyH@K5GzplzbX^4&B) z*QRTGeK&9dK=0i-a59UZ2mfNeh767c==@e-N9OMbCo}&Z_!aXT!8B8e>d%(Nx-9_t zTfw`Tp9RhZL=e9Trg=EAefcgWvg5?1E z{K$g`1B&oyB1@)YzeR= z^Sgl+0eYSFz+;&|4m=g0{*P&3Gl0%-1&&~T95|l&Pry%^Uj^nde;RV#W-Q-*8cegv z=sZ8cG^dPw31#>I`QpfRj|PUrHvyXg6kiW^WPT9%AoJtE=>X+kFN0~u8Pyj>URwg7 z|7$dOEI{$`;E60g4Q$5ZR$v?EuLQ3F=-5DTF!RH}5dfVh0sM;P%721+%$Gw>d^|7& zbtZuI0jh5WPG){8IEVRP!L7_c)*t5qsJ^2*`auEuyln-$0TeeHfc^ljcK;igW~EVF zdnB$Y0Qn2RyeaMeROHoptJ?jsYf%TFIyT_70DX5H!0TB&2Yi>s3&2GzUJI^c{tqyZ z`6do{4FNi*6?i!y27eoPCyNJx4K}pbIS%GAe}*HzrvM%60}fz*B={BctH5>4{|e?Y zzsVauK*yH)!w1M0KY;ql?S2FJ7eLR42kxJWv5=^w4%Pvv{s^!c^UcBYnZE$Mg88e# zj?Djc9*>pTeyqb)!~r_bF0dQ(eZhguKL$R|{75jbu)Y59B7A=VI(919jQKagJm&u> zh7VAkK@ZTk2avxR%wNy@6MP@tl3ZOcV!LOL#0Om1&;Uj#`0jlE)<}u&mG49y_ z>Tin#M*&plG&q|1vEVr7p9NG?DS-0(QsC|Y{hs#*j{~S}YXCL| z=(9Z)JRP9NnhTC8MV~W7Ecjj-#@E8X5B7hC{|!Il2f)VwsvikX0qFXY3g*3RkE_1I z`wUQ>pQ z^G(6Cm_G*`_@=#1GB}6%&EQt%b8qqes%)>*41V>#-G2|R0q8ZX1M>j-A8&oYC{TbN zw+zf<{>*B8egKMFfvuTu3wEk$k6!|FpWFS3U>@^@Y6UnoKn2J42M++~S~(D`!Tb^6 zF#tWEao`Cot`D9B(Bn=4n=pSGcqTySnFBTl=(p4Yya1s3mS9_e>Z}0UGk+!60ieg) z4Bo|jH}HOdey>h|BLO;3G&ljE_wFjVj>W%%d3Eh|hSlT!0;qlnID+}f;1uRx0~Z7I zI{yIkSp3`0mSF&jZ^qeoN9fCHI-4xG&V^I#tH=QpE1 zKiFKhzx7GXW*s;*lI>k((T{^|KK@+HWvvaya@9tF34Vv&6OPWz#Vs~glE(K7C z_dpYXrE5?e4+QVdiPm9KWL=MQT{q#05pM$Svzro z&;%-X+ldQ;CQvD8C+;A0a9ixJ^BsaFP~ksr2sD98Q9E&mp$W^FCJu!rP6@I-W=(C;bor5NHtd|U((y3l5^m$hAX?u0<0(4rZ zdg;&vD&_6OU538WsUB|AxU5dG9B2aN>ZlOkgeFj-uR6K6Uh_V$IG+do~fMXs}}qpbY^7 zz6MW%p4?XNuje-fnm|RLozDoGK*hM7IAdr6m8tE-nLwMh#r`_q9B6_ndtBnV&;%70 zBc2CM=)+>f=Fo)U?0FE+hbHK<81Vw=g}?|FBVGhe&|@*;#n6ONEJnNpnqYRO{huJV zg(h@7-!f>z3|5bL1vEj2osZZanxMhz5wCJjgSCQM<^h1dg{(6OF3G+_v!+ahG04#JSJ~o$B3#CR}6ni0?xe0@qoLxCoj+h5DnY6hjkk zuzJJ~pb58GjJO1v@PNgLOQ8vOS&X<0n$W~z#805>fR68FJv1SK)g%4_O-Nxe;;+yI z+JA@&@i%CKKdVRF08OBBlf}P76C#-=ZiH@XtM}J$=TB$?m7lC`Gc*?OMft1VZ)hH? z$G@h~z$qCTJcTl+oj7dbz-h6V8jEQ|n*kN<{KRvhZGevduPyW*pyT82htBB~y9Q05 zLgRU;T!${~RIdn{@P$1taWS-(FdgyN|E2@Ipe=^>0R0JN8MGHr%#J0FM5pg9>i9*m zrH*iv+t36m{MdbHLdRG!bTe>`I;L6q4UMMM-(ry%WLHN6?NEx3v~xZ5cNXJ+cAKDo z106qW?s!gw;P>tKD#UxB35QsWcrP^J1d9=SKzjlwS&VoeG$EYDh`pc*(JV&n4NWL# zF=8KR!VTZ{|A9CNIs>3$*wFqQv!HW2#auD?gCMlOy)N-CXu>-hEQ~@N08JRf>a{T@ z-5#ciw;kT!B4|R#*I+R;p<~P%n$R(315M}{vxQy-bbO4}(2kwzIYDm(Oxq7{<4w@c zzycN{-U{sk*s&P#HfUGCoyCZ^L+=2bSd4fl^e$jGixIm+djlPxpAU2(K!yJ~2!cM+ zsoqiOh)(q)p<_GMi-S(?R4)ZOwNt$d&;;@Jhi>D`&{qH|{O6JZoylTp?6ZFrnn0zI z#j>FZDKVLEQ1EAw;^#uAUtH*zS&!Ed$>;!u* z70|DNj>lF(6FOc8KR{OlRQTun2>pr0g4p?Lpb1p?*SBxbgpU7P6ZB73&z&9H4Bf(F zds*xkG=U2L{~g#D_f-Iu)9klo2sDApq*v{)>riL{l?)csg(gs8KZD$CXhJ1>Ok!JT zM^+D)jJDzg?FQ7ddc+>ko^AF1`VC7{$8`{(qSQ`YF?2QXjvd>^!|*!jofl4n{&mNjkQqo?BcqKI935yZ0 zf?fx7{B2(kO`uZA>TZB0Q0c-R!x5T5u>;TqDo?E1j}3x8)Tv$w zG~pkgJ=70{j_*`20h&PNDmz~yG=WMgizPu5s9a*Pv(N-8IV^S#nm~nrz7%Kzm0DIW z6`DY$l*P_N6R3P*u?x@yDv|7-`66^~TkNmT)lFyu75?|@7BqoM7CT=aG=WM!d+l#S z-))Qib-rTg2c2T2&`&$XzC-`$6f;l6y#QeQtNr~Uc7o0Uv{$#si2LGOJg)7Vj2u(j zGs5p1v=z|t{+<)Ud@+EE2CJt5Z3aAHza_-{wH`Xw3KXJeI#M0X-K(GAR7@39hln zAf~zEIRF*4Hj8@DG=IF~>qqm0Z2&52Z5Hnhv>VW|9w&T{M8{MtgKYU#DyW#>1?1t+P_+h+A? z>dCDs4L?r?%}YNL`_8ZDx0-&YwMUn%ICkh^wnosoms)X&&j;s>_~kyvyH?%8K*pr43;p=HbBcB{x^I^vR*dc*^L+Di-QG9Tj-($wFw1EB zo3{gw_Ymu^to(bE+qRUo{_6u8)w))Fuh(uhiwIq^uTJdzsQ9@{M`&hc^`Cn6!pfn3 zFZU|E8|A)j*x9W~7TRhpJ^Xa;CHI|EFn;DCMTZF=t~@`hpQAiPJ=^rvwio+mEdOBs zR66<8$g}HvmpLSiaMa)U*n9QaDnoy}O$e*s6uN~-^oQ+ zoW1rY%@mn;{&nQ`!o$9M4vB|6_*6G#v#QecUXxosMKwwOy!Gx=H`y55;}P=BEARf8 z?c!1~Q0Z~;n7vbvT;_gX>}PTKXo{Ne-W93-OE;^XOc`ZiZL{H`#qz5!wDf}FZuRy^ z7}@CC_tTD{C7Dw$$~RW_FA;FAsXn7Q-rgc1#o^cny#amij5t5F$v6As;}as+B|JB* z$-H(lZ0oQM10;;5eUTn;cgja6k!yF$?G}0sxgV;raOv7$5uq_xUb|UI@G&wMa$aS3)^R&JokI`rtX*R20zIV z{%E`Cm9dh3mm;NiSt9}ld#hh@Omxr|S$@4Za6v_r>*KUXXF|QMdS`sOd0|~om!rPX z(*h^NB@P}uJgvg}Wk_q{eWeitrb}i#eZJAZn`Cb{ziagoj>-WVvhxFypU$dWdak}k z)bv!UZnx@<<#U#W|9Cp=!<`Mn$q`99gM1$@={HVHMJM}i-m%+?txky|4GGgER%ET; zwQbLpaQ#`OVyPw1?qv=WpZ%%+&|Z`JeP;r0iP?V79ME^*=P~^)*Tv5M`a|OK*CELX zjvAuFHcWl+`rJk7mC4_g?i#y#mPg;)JL_{$e#C*Nb0!=)VlQ9lb~;kyQikXknJTGW zzgt7E+uY0Fv^;+LXY)R0&#z|xN_F9Fm&sH(@!`XORB^pV{i1}3r0V(p%MPZx^!D%K zEbVdlwxaslx+~wqO9nU^JuH5^{b%p9Mh+UAg=e_jTI;dAu;#dKjl`6ntKQBo*=nrb zBJkmcLG1lQjgwCF+y8jMXIH^f-(=*jZ*!hE#i7(_!ASo}#z*55wmJAJNO(w+8(R=*^3-aU~^lCoG?XOAq%FY=!)eBf>HDz~Sx`sYkrA{vekGD$jIa^eV z{pP0VJ~K28*IRIY#gn~jMGYrD&JJ2VyWbmUvx(jZPYHd9F>UJ&sxEXe^ogsLMp}yGDzxqz}56^a*<^?|H*3q*cPz@qp4H8@2D-mwDLS}(CL2hW!-yqt8R(QSk6W8zRb9EC+2Km(#G)ki~6>?1}={M zcFKlbP%OOpsPC*X7iBC8h8~~q78x$^W7=9v*BZV zZC^29iq17L^OjZ%xr5C<5tdhL59!z69h9*<(PEVAr4{L;oOcckeQ7yT%g^Haj8hW^ zcmyk_WcF|rX!)Fwda}T;w!cfi6Ca=7z3v*{eW{6!qVv}Mhoge;^yyXOd%syy&sx6Q z=jQ3@J65W$s&W5W=-JR?QJkwvm6G9m_d&1I_dc{dH(LCjPN1w$P|D?+^AAMp!uClT zw4U#taPj%OSXHk(Yq?d0g;}qTJ$`+t;$ZBmtjV_Aq^MHA3ib6%hGphgtT*3gcyRi? zb3HfsY;LS>ww$&)H0b+cw`V7P*UoW{9-FKwuyng?SfEdr(8=@eh=3KUFMX|Bbl=9d#7@E|=$L7rmVx)(qAJEO+2k`LnukJiCy%5u9 z+Q)0t60{opQWpLS=xtj(@R|CTXCdRiEG$g3c9oy7*HSFKR80TY*3Wy?FDWV(oZ4{L zPHKk#*7>VXtv~hR`K|)--@A&ewL;esPR7^y^g6Gcwm0>$>jA) zrUJKi+&m^5;gnK+IZs(U>cph9W23G;&huAMU)8jH#+@z?R|w=b8T~3dxYh7@?;`8T zD_&N(>MdxQr57T5qjK_h`Cr`^9lbep`|BxJLcWF{IMT92?@*AdwtkN z+1qp9kFcYP3Res^crMyu@kXO+;FfEbtehI{#t4 z!HR4v5y>-GFUFfYIBysIEYq_7%k5c(pI(P(E)*q%&T>7Fwd&TS?=Dj#pGSIF{E95Aud!90{xe}%rLWPZOW`-YdNhn( zemuQov~^NRVZU3>8Y()s$L$?Zuy0G5-(Cm3L%J(=UA5cTc=A!4*AbmAf+u*^=RRf4 zy5uEh9{20FhoFbs_opj0qn5|rUG;FsZ}r?2uQnCiUX9j|f9dYAzE9(#lLb>JZ~G*D zz`Vz@Xt8%&>i1o8^)a)R22(zlfaCuk!5iSCYDyT>R2tq&cm-MN4q)t#5vs!g7jX zrYf^EyT4F&POGooW>T^w$9hHNHmk?WA66y}Q9LR!vTo$g{2m*9TfDj^ZSNZ4<$gGF zmj1bSqpTmxFYNWuB(5SuJnG&eTaPWiWl0fUmJg3s&$wgYG$#7NP?3B6=ev0D4i>!_ zWO7<$#SXEYVS_E~+|nkOq$b-ImpYA^>epTJoblsnsdEz5L$~^i^s0S!;ORo~<1f@p&yK&N7+v%@uF1Q!%3Y%D z%*?8*y$^Jec=RKFrfT2&Gm9dY4z+jkyyv~;vFfTdoLcVGt>X>y9=>{<@42~R64&sw zX0UjX%WXx8mNP+?^RO=K>V|taEUtv#b1k}9yVCGLx4j#4!b%RkQBB&TZDBa=$;>Z# zT3o@H@Ak*(X<*Rs ziCeqZoG?Av>a8m@J7CeVjQfw21{uA$^?R_vzSm#s3^lI%yw*NEzj0?nz`I4YLmyn( z_T7Kti;!c5mc6u_wq)*oU#hDe&~4mxfn?PQdh^!4jq*3Rni}Tw<@&Kf1-b8xo>!&E zc9*gJ9(v_k)6#LWiGyFBkt>(KeE#bD`m`U@9(UieK&JGd;>uT_`ku8Lxp=y=+~GR| zG7BRd4vnnI=AKHY-fbCQx8{bo$>qthwT5PMt@WEF9E2_mwtOc)cZl5SGZ&?vzq|29 zMyW9{aZ|>}eedh19*W#teyF11!UCB!_N)4SUUb=K&cn++zg7%0&z*RE&1&t<7Mnaa zn;r3QQ5bi-=j2I!iayS^o6|olx%sHr&y&Fqsyxmt-=)4TseEjXX}U?H@vBX-)`g+D zGkiVL19bf}{2a{WzVF$2@noW%y{>^){05Oz7Mo5TU*=Vs)!N#1hq*-lK4))Zf!_*V zdNwxI!?uWIy`NVdI_cNZSfSDB{l~~n8x|RR`q$j?ZVzq=of+oU-Kz2Cw0HUn`|9?# z^m|{vdDhWm-=En?Tdqtzo$;ySVX^JR>lYrR%hno%-isR;CMx{%fR1WjRY-MFCU2gT z+jJ9`FTWohm-+o=SxLl*n7Yq?AJba%_nPnAka73+wLpjJ;b-hxcdS^gEU_l*XUgWh z)7uMw>uXNzJ2z%oj}x=Smc&R!Ws6)su%=3;SvhyP#J3`|=^LgE{F3|fP}7@l&G+hZ zPnY{zrEeYQu%vwbQI!g3E0e*YP4?Zyy++LQ&F*ih@a4#b%pY!x{8n9y8CpARxaH?v zk!!cqDW)5anN}Y1TxH?K+0i%RKE0@%W1=LVp-{PQ+45Q6f>(C$Q&koj`a!XG{?81x z6c^k3x^-UaOAij0@BMsBw?c`_?!1J!vzIPqEKpYn4%;LB&Nin+zE}UZYu0@}@`LwU zHt@ueTZwhw4_sf-(5Knpz}*WTztch;Hm9E7nHtj+sGSvAdDU*GN%4!9<<`YNF6>OI z?D`{Hdf2J`4)NnAZ?C`a5FUJCxLmsF**x<*509?9?q%d+yS>CN{7HJ;4$++38$bA& z?p!Bqv)p^r^s{zlDpTb&t&iW%`!O!Q==c+T>B^%et|RxlZoBCFDEG$f1G2q&rUkZN zW)#Tkd1j2AYdK`otHRdHpZm0iOgW?BV_$o5_K_PC2gS$eZx1Qd{n$Eqc|ZNl-j@ga zth}eP$7Y^^)vi$@VsQgU4sqwLh-w^Il=A$B=-qkR*GJm&uHLy+FZkln1>aw*c7B;O z#$ed5H%U_-Z&ORky!Kgdut)6iaOs%|o-;ybl<35Jep_)+@Rr=G$M#EIPfF~1WM6-E z)RZ43JxqC*6isFgk2dHLD)2GPcy>U}gTfhe#vUj--m=H;TIuVJT3$DnR{A*Q?%jTB zSN%+@*_nejZ?(13R z!#zLV+md8F)bWm)iNm@4;P7C1?v9`2_=3#0iXzXpryGq{G|b#kD4vz@Jls2IQB`;0 z-m+^YCf`f@7=L4a^TI&Q{_>`KP2wZ$?B{>0ZqmH)GcojezoUnyX6+vAr0(+bRpWxI zhlcLnwn(q8SKii-Eq+#M78A;6e_GhZA=0H=Rr9$o{T(EO`@Q>obDz)QMJKO3`&?rj zpqFSJj4UD*vHLvv4Jkgz}jlxQ7rq`Q{ zSpR;;nM0nM@9w(oE7x2gWf<+`7;w4jazxgvn0Z$mWaiwTS#W-!YOLtlBgL_?CJND< z+HS3FoAcH0E!~^1A?3f4dmJ!+K~S@%+mBPtx-wesobRT)4kKNE_PJPah4*k=q~TDr zt6qD`(g#Mh#^rcV&zJr2Mz0~|o$h7zh&yEsn!D~km7bzw9cl3Hb6%$OCRY{xIR`^_ zZSg6xiEkQmu<*!=nbFQW3#VOrUB2dchSKYa*~wmalm(CXdp6JL#_DBZg=ZIkXgPIb zQex1mlCQZ}3?_$ddeeNSm$*ZQ?X4q9k5}D^@V@_C# z?0@*ZP}lR?^1UU~u3Q;E?VC$h(2Z%1ONV~VOVx-oRjMzkx%f>)A0@yQiI4IQm19Yt6Lel(|px>cg!(G>!W8JUU3Z z{JDKV(>i0F$|i^IGC584V*7cP%60`O1C(z)dswTd>6c`n)lYx7$)-0h2fY(Ko6eTW zWUjr}`$^ZuA2UKe&da>#RekYBg#6U%qi3qeo*DGfElz#;g{fsn`x|t%^9e|;jCgo< zTx2h4x0(RoiQRwJ)}HoAQWw%*U1Z*CXn<9E!bkt;GELzLlXK&2(sXp}Ee53ApXDl2 zAm0!?S}tdzjfG->d$D9?w%?P?H>Df8rVj~Ejl9`4{M@<1wTt~E9@;qzz07x>XJloy z*ZAx310vbM`?|NtuPUjpe^Xkk-}7eLj?JG>IN0tBEuCdzF|&_zv{kXjO|Q!XC(L|( zB;l2P@T`qOBfiJ2)SeOXRKFzAZAWq58-uXHhOGfz;!LVSZH{?vD-X;WQJl3&Xx`D6 zI~%W^S@3XkouSeCzxeK!sa{@`?1NFnsX-3R#=nQNp|()vmNzI9}Wt-kR1 zp+j!UE~#8QXJ`7ZW0(Ek3N1diegBn!$>+}o2iSgdQOWya*z5DE^N;#08hw6Dy~XL# z!w=eg5P0RYQtQ@BlXVVxZ?0yH*IDM*JyL)CjHLekU6j|w@831{oRXNd#L^=*i5C5C zn}2?O`)Oa(ApcQW??auPm(1_>QN?He@MkWQO6Tl;7`%B+n7VpG^_Ak12a;7Uyj_ZO zb2QIBw)aWZn2LR$0qlG#6*h7!(swa{uH0v#B*1A!Cit z_DL=JYP#pl=bkTDHT;?~W7vhlJ!OSX-XTRF-F1F-TiR$d`P2cyS@EtO1EMC5KQ`)n zsNs-{m~MUh@9^%iO2uhVZ+7({@)JOn-!1#tOOig}h&$x_Rx6XIth(_CC^O>D^B~e*Jj#QAsY?POR#x z=l82IDwz#FXO5R@!M*hp`zBkg9B=V4;4jBSw38sH*WgHXg%Eom&-T2 zA2(lV%@$w$de+VCki+jT#QVCg&K^GVX;R9##+|)`WF>yg5EvaUBlBd5_^9XV7eoBN zoxJYpX|B-q;*7}(!(U%RyMZ# znKglp*(IN|3R~ZmE6?(=>T0z4(vdS4^(NUk`D$w)Zt{^>t@EpJnWvn~y+r+;8G1vd zZ~VSGd3#k!NKWZYBkIW`g=}Qo|<$k*1Y$o5zpO= zWQN-JdSj`W{va-TwxPnZ+(+YInH@N?LEfW!ppICQij|#2*=Z+zn0D)=f3H(vsaB^4{}c2kqXV_Kv0o@Jpmlyv-;mlg07r#Jj2)HWYii41r`+YwWoMU)3&h&dzdz?lDwi7iB7#lrVbtan`UaYv!qM2JMqk%e6*Tpts}fXf??a$|<{m!_QChgbJ2``Y)k^xC1l=4m!2kIfYP zgAjoKIL`+k|aj~_z1DqtQS}&HEPc7E_DrnsAnBu@eW)VU5A;TswFB2$Da1XDm z?|1wA?knjJ$IY7TS5o0Q^z5gm^DkrVy?rYly6lr0fnJK^TAzF(8Z7RuD2XZJO;_D^ zqh)}@?TrpO6ZQw?x~UB6@ojsZ@z~iWb$$!RJuBMyzrEg`NfRd6>$l%Gn-Ue)NPEHhODjIGBN({hd{l`v9)QX&R2|v z$_JSLesjUdIzQfS=A-vL(n2@JT`jjY9oPF~woGNveVta5Y75`1FMOh-&nfi2G$}jl z=!(Qdhi-}YXC1S&d-Fi^^X>_up?Nj?Bb{v1cON)4VSZ6n?>@ic&gT1%v45FTFk|o( zn==E(%Rg;S_G<0^BKzbwh4ij<(-Uw1((IO_xqtMOZR>Q`jM@=R>%?}lI z%e^tZrSX|};P&@rBGo(YEZs8V`R`{RE`}x5d!63+SwB-Fa?Mq_{{60%CB;b7{{!Ge2)zCYfioG{ya*@M0ayJ!bPu#|F53aef}z_jaoOxn(QX z%*@|dvi^|5o$4`t?)MsZwTsQTLeuHnEL-~Dwl|ENmMFBN@>-$h48`!RCk!;~q(3b` z)_ddRpS`VbhIp9iW)+_q&)G{KaM3YXM>Zcx*fmOBk@9AAK8!JW>**8s;Y4xUu#-?Sl)D#<%2I#nW`Gg z?#5diWgdARaL#zc{viW5{hZLvx%0$Cv8A`uukEs9 zR-KbeIPEU7=t)iW0VgH9T7hSWL++_fbL{%zyroxA>&QtyFP^(~J0L8s^RhN}_@CRb*4q4Z^X_M}1a8VjoNPY! z;`#6Qt2BDgjS?7DYLa(Zp!@vaulJm{KO;W*hToIMfs>WucUtvRwGlO0vuNS_W0q@D zst;^)9x>YYNUoM<)b(>7Dt4)*^Egk3T^Dz36aRWFx__3n|Eg=cD+=e#`eb~h!bC4L zBi*ox*CKF6ZKYz?(I>g%jnIvZm6s$rG$SAI2NsxOIGSu-9U*^YO+R!TtA3>Zb4g zs<--UY@cprt6h@T1@P?pCmRXYJs9{@YRcgU zheWQ+N|#MIUj9|zIyC>5`KbKcNmU^sdxIVQ8#2eG$4zejsi>MUw!ce3*|tlbo8s4; zXxU)iO=#;7o^;up0YwU)xf!Obd+k&B-ul3Qaovrc_6=*SZ`iD~Jil9TOjwDlR?g97 z+n=@=xMZ zA<(j$%7u5^?Rq^-%?})K?#cNLi{9EqhGj*Vyv+P|?rDI{UB}w-LhhygYxd8#l%95F z$IAiLrow9XhQ*#;drtOPtkQzy=x`AYUZd<&p=TlPbEAeTd-W4?=y zGq1;?uRbM{)xX4w7iL$_H_v&VuJviZ`TEatQhSE057DT5RMmWDeO&(P9)Ysq3zS@) zqXVyc8?D(Tu;HhLQH^a`@PP|S@rQGt@3}L2t;L|R2O6C!6ua$cFn^P|Z~5WNQ!XDf z@eioEw{6S%!-q06V&<=$WSM+^5O?H3{`N6z*A!Rh%pG2SQs>$);T>TjZzlEos`%}f zPZ!muthY6)Mph3KYF}tgNX#9$^{mQ=K_y?jEY_Bcmn_|q^5{wbHyiga*y6n0UikLD z>9ajoEztD-vF?FL+0seDp-`{6%i^rb}mCnvp0~oR-~Xz&LHyBhN2IzUf^m<7s!! zXt?_B%`f9OMjv=s<@>O;=HrsH*0Kw_1xTk(wHf9;F>b(?p3Wf-VPEFF=;hL=Ff?~^1g1Y~FBty^K$-1SkNWZx&V69nd0G)|qc zZAtZ8=h$xE8zuIPtZ7cN554eqiTQ)4aniG*CdH2J>9#XcWn`SO?4vo6;_`CSUiO() zc~H%F=tmD-A(KRj&!&fLt6>{DDYE3S9bm4>&IMJjt22CNKEw3Q#A_ibBY zwa2-K?!9a$JM0`a;3VJXq0M`yw~C%Gtd7zF|YSI?df+0r5#!IbwtI>2}ZHe zPj?<~Nj<$wpw94Uk2Cu}h=>iJ6h7Ol*7mT5YQXHXr^NQV9=!Qx(2y$`Ut_+UvMktN zQ+DZldFqx`Ym#Np*(>Ihev3I6Hn=XXB5M8JB!d?l?xo27$oV$pk)?$AZ^eL+{k-QP z-|AAni`LDY@$1FY6KSdv`b~!ee%f`HP0livF^Z0zIdf~~m(kfukCoPkD_9(OVDrlS zCD@V{!%T{t?p|A&%F z(-CJr8YCymXnMqq?~y7T*wrxhtM{ye!A<>x?k?_q`@FpD+`4MDiCcaQ8<};!a@(sO z^9MMn$Im*bbiy#LE+Ek_V1DC`G~Z$+wcO&ch92{tIL#JnOUN zRFGy_)t!w!TNFcm?R|oM?6>cX(b|3B<S zVeieusr=Ue@vX=_W~K~Lrc9BPWS%o+rZQFtg`!ezW27=gijd4hlzB)SnJXok3q?YN zA{zAVyq~q+=X$U6*(Y7D^T+S{)gQgw)4K0@X#-i6L5M7Ji~TR7}8zdpe0 zn=qZd@UBFagP%wm=HgQ$&J;&ge$)ZvyX8Lba&D|-}jYnnSmrH z@cE@pQ|r>-IWX^UNy<^uktW@-{gc*{*M648XBuBT9Z)1|RK45h&o$t2i*u2R?CO<} zva2tJq@u=0(-;yq2Xb>1&-t}_o}G8#dD2-sbK8N(PJ;V;`@oz+CW+46`%4Ok<##z$ zleDshP$;`!Ti+8rw3e*qML_kZXbY8{Je-e4oVkjIL{J@um8% zkH!JH!!c`1R9Z$Ot6JHp3dihO`^r`AV|MYJaM^v6Ch^wS1ctHBoxW6unHp$bUm#IG zYv&T#AP{~CFZy*$-?(zzz*120!qis0?ZVPsBgc-aeLFISy`1G!7QK8A+&kxBD)WZ? z^1IvnYzDqE_&!p)rF^nd*nw-fs3Pnp zRonSy((!EJPrK}Ud4=-S9^X&?qV8a_ZMLlnRY&&ls!1w!SzHaxIOdq0bMnGk-v4j!!!J; zL-j@++Ygwg@YqY&SCb8QE6HRe*O$07XMS1!D5}|e*|0X^f{a7(7o&>hnT2?RyB$3h zowx%riO;tso85Tu%$?le9i_i)d3`fZ^F3Z7gsR!zUT;_>xj87ZK zHczV3Y{bjae{YWqe9N9$S^3r^LeQ4%`S(CS0p3Bwac5qUkK*Nxn&&zmvwDYjL@ED# z=(1tkfZhg8e{Lgj%~Ip>#r%;y>xV|;Z#j%E^}Na0?5oICq|WG0Ki!B}AMtJmB+}Ed>Rn zUl-(KI<}mCk?&BlG<&1J;gmPUj;6akI=$8WzIXhM<=C~z0=Ye!o?Iwlp{9+B;g7h{ zc>9gcsk&_b{=J4Lc1+$=F29s`lWkk)q>)`(^tz0LLLa;R>!y=~wmq-T;Ck59|MA0K zey@q9bR5OeNdA%vrVp;e6ZE6+L>nyvL`V zqqm-(r>uQrrEPm;lWq9jumi0R2X*fz-nHJLBDQ0CgV@5ilJ2CJYm+=Rvbo+ANB46i zJ<|wusY@k48uOaV-p4qlA(&l&%qyI-X-9wRPL{(IpEEbQH5yE}m9K3{S94Qxx*@cU zbYRx|yqDUp_Sn$KWy0JZvVG#l2Mt-MRI74i6lXs~G>%nl_Ho?%ma=4Gs4;GyV?a{I zxAnl#K|OoH>%P^Vyz6%>vz{&O@foaie-Jkr@y`6xGi&aVv79!UbUDQs%h}S;_7zcA zZpAM9UumE%FU(IXsoJvLlXBNN{<-apZ@GJEZ|B^tfAV(Zim7>BYsB5mcj;6HJNbB$ z=0v7E?-$*CW^eHLb!c{`dcldT_PimokX^U&T$3@O;g_{rNRD2r-$r&wa@MojWqKxI z*P06j#rTl(e)$oTWFk`mt#wEGhk1`A_s4r>sP62HsyW3Mc8U3xYS*e*;y0{B-Piefl6f~;j%sEmx5zMGhO+!Q1GshFPmT$v;r_5MB zI{FC4D;|eWs5v_pD?a<0{j6gy_PFlP`(FR`Uy3dE_R>>;Jpc()hcUZp43z-diXZul zpAv*2!&wZU4qCeFKJBE0G1c10@AP0yCNC1cfdP+ZlJwO7$pKr+jl}9Cj zKfeV1FB%Wy2Z#r90@Nb`b^!4J2>@|xfE*wmAORq5Esz7m10(>%kpekDJU{|K92t-U z!~-M%#H|BzfOvoefH-m>2Z#qq0EnXia)5Y%1b{e7AP0yCNC1eV0&;+OfCPXzY9I%Q z2S@;jqXBY&cz^_eI9ebFhzCdjh@%5?fOvoefH-;}2Z#qq0ElA%a)5Y%1b{e3AP0yC zNC1dq0&;+OfCPZJ^*{~~50C&5#|-2E@c;<`aV$U%5D$<55XTDS0Pz3`0C8+U4iFEJ z01(Fx@{%Kn@TOkN^0ze!ukORa6Bml(m0XaZCKmtG%Z31$Dcz^_e zH~}CBhzCdjh!X^IfOvoefVj;-4iFEJ01&qY$N}O35&+_afE*wmAORpw7{~$Q0TKY> zM1UM19v}fAP87%i;sFu>;>3U)pzk5FTEg_ziz~+q%$^UiCm{Au0Ui7bvu6eRA7n9m5kMSTu%*4F&eH9xrqHT zVsD#|>BIF1=4S@@hcvF|pZR4#XkLVt1aw**);^qnf;K|aI4e1!Fwh|mQHJp|St zC1ky@Md)LIHoO4VISp(b`@1f|AH1QMoCMIeX8+Xt+aB35TQLm3X{YA z2Sg}W0_QXs7epwB{%s}xZ~ss}1g;Bc|5LVO{{QuR#sB&T5u<*7%5V=RR|O1+P>%nM z?Hk~E2IAjxkYBhzfC%M71z7&K0R}`UZ@z)a;eH1ql;dTw_~7{uB9sTGV*3+Hz*snO z=bs^h@qtW;&_3oNW)Jr>kPk8RCMKtV3{GQ`~Ybia$`X3Bf z5TOQM3A6tO1{NZe^EPAl#{dH&lq;oUayTv!p&ZuFpZ&pqpI?9S^Cv(5nltG7`e*)t z^Vw?m2Y>AUT9W_N7rZiI`2Y9$wFB%=$v|2l!YuIyWBUUwP&g2wT&WAY{#yVBL@38; zWBaS!fB_N8c@r^vxG#kW|fyi3nG-`(*C=> zq zO5pjN7C=;v(&gauE+~Jc^x`k<%~Sq)URr6pP;X5JW={nfzll43abEgWbL}mde|W$D zQ#iK&_>~=$FI8do@P7RJ-?S$dzrdxH#Sw{|CsTgYe+u&aG3__)(erK=Vvp`WVBR36 zBhTw7R@iT7UyMA@%ll3LK}h`-BKFV^F&swfr}#JRDXRZjKkUERf75H2J-p79|EB+3 zWc;gt(>~)4<{#dNBK)TPLuC9O{-*s6Wd1k*rhWT$EPiq@z>j{@{vOi*ncuYEa0~Mf z?>900=J;Ph>i6ky`maIa@BB@BV)wInSJ;m%Wc)}GJ3O(82l#Jeu>8S&Br{_F3v=9N zB>z3X+5b{x{tW!4eLOOLL%(VN5m|q}{ib~>l7E;l?iJ=SdKAk)J2YIO9aJZ4#q8nr zcjPzYXG7Lc*sjnD`Um4BhPJ=h=hY(hr-tN18L4m74>KY^ zgw*3jqPT|Jl{MQ$h{Ocb?{AP@Q7GvWe0`lL`i^Zt|I1p{AFne{thltjXQWIt`2=pN0 zpJRM@zK4j8e+rTDAIit1Qk&s#xEd5!T!fdNEx{PABgJujdK(RLc+ z%K$z^^nM0@wc~dW^8?$3NO2A0!+b#m;rtCL4=_FW`9p|*DATBW7Q|!u$;p+5ao8w0^*QBxqdCEA($mr2cwVXiu#FgbFNwaK8!>jgy%DyH)xh zTIKjHuF^k6Jl21>UxK*O{>p$<^)y*HF z751N4{ov~{|8PG55$%W4LriZ25J2S3#Q5-f4iUBIEnAr%)DF_b;vXV%et~unc`Gsh z@N=*bq5M~93&sha>mVvsW9>p3BHAAQf7E~c3fI3-BK3#HNsK0zf7_LgKUinr^D~IV z{Gt3Epw8j`03t8=oH^VNKt%0{#h*dK^1^-ox#e`4_ut|Di{O!JCKqAqR4ZLttJ(8Y0>ZvHYd1uzt0O)F0}H z7){JS9;{37dIAw`hnPL@3iGc7^x*t}i25N$6Z3DoLjT0<@hh~)f#*l?z9&Rt@%{%N zT>s(s0YFS4a{c{}ee6xF{^0cu;(z!d!WjC^`$uRq#PT<^!ulmns`VU>9y)BXT3(YezIv)6e>nlWJ`Y4}R{|T$iA8*#m<^?hT zDdj7xKVtS-E6hLdD(5dT|3j0BI`dIztaDxet1`yKVtRQv&#JOX0L4iDuFoRz5ybdCt@_Q_-$9%|97CD zu)ZJ?^M~?@`Nyx&KQVjT6`nuhiCjO?IEm3ItF$K?{|d*Sn0?AB^S8Ll`lYyz)i1nn z1QE?6vG@tAjGuj#{)JX)zhjm5S}U~2RbY9B_lF>&c_u~^%m2_S^N&ki+4YB*e_rsp z3V1z&i1ve+y~PUiN6h}n3hlH0NAsU|mHA6q;rihV`U%%l9-U{z=#*8i-(AS}7oSGn$2O#z zU_C;gLEb+OLcUKy2zkGs1F@Gx`%48rCq-#qL@q#u>GOhyQCba=J0f(S0A{}#*vss}XmLPisA04u zp!Ml7nh(&oR4`fs&|5Sx8om$bz=F~IKpu?Hx;B{H0LW3$OT_X6KVR?~`F`m=$oDb7 zM!v5(A`P>LpAR{bjL~qvvJYwh7$T2H>~#=-YV}xqaDJij2O#yd1F6T|NPVdwbURXC zHAsEcAv6zC|Cf>Z5{AU1gv6tT&=W}e@re8-(%uL{Pa-s$pJ}9hRPKj--z56Jt~Ju% z9AtfOM*I&T>pjzRZ2aK*If1O_X~_3gCXZwK@I9ceDU62iHJvNNXn3Et1hGGcTu)+= z_lHj-^8S9TJywvIS%fY^){m}POdq}vvKi?gnqTz&=s6@`O9=fEtY>h&)^EW4F@lD3 zkn!AsTo1dD?^B5QjM>BY0;#4k8s@XI8>3l3`{?)!A=k%)$oukz$b8y1fVBtnc?79v zG(ULoyH^B&xDSW_Qc(hk2S@;jn*nlwcz^_exLF_vhzCdjh?@g)fOvoefVhu94iFEJ z01)>H$N}O35&+`nfgB(nAORq50muR30TKYB`H4j8qZJwdWMut%g2?rd@i9VZGlaHB z?5z>GD6$?%A+#JqUqj+<CmOX7y^;M(##KxX&&lP_FdCkJJo+%21vD&) z?2pbO?M1)C^x^lL)Fb|bkoJ<1-w(Nt$iL@d?ZM9(u1EG;#aWmfp7%E*@+-*xP#>9J zq{x0v4(VSTk`L)F%pcqzXdv{d5ljyE?>R_5?jZe(MD;5%dpJLDAn|jTVsdyM^+0}~ z1RejzhnPOR9(N(@S1WS;Wkar)!^nO@0=a%aMAj46qJPFWf_z_02co~Z8qo6F?_@P!}naKk@nGgM``VAm_1zoERg+O9x@;9Ap8CM2u*@qZ#9s34&-3|;Cj`9 zjK49W?}4=EjnJnMS_T>K`V`C`ynYoS{W*u&S0eI9h`lY6pAE?P1tRU$BJG7D^2-R_ z7lXwMuQ#s{S`q1AG-7XnjOR5(?u_K$3~B#0LVF|n=>Fdxng7R-{2V~Wvme=?xgheB z2pxdXR}fkY$;S(1yhMtye8TI296~1|`FVxd8zb$HA@Ui7UP9Ux&nd2dM{YM1C&jpYtIA zq1%xCJL(UmOQNv$;C<$M2#q_8-Cu+9Qbb;k$d7pZQ@;$=N9b-q!{<)D2;Gm+FA;hW zp@$Lr4MLA1^cX^qBlILf-$ll!7@^A$dJ3`sfY7rD{Sl$(5&APiR{$E0PbESZA@n{fipwBZnk^FQc?VBL(aQUpBXvF zL%vNj<`7M`0uiSSu?v33MNJ5axK6UG-r_|2O!{${|3bv;dl z?{v7s z54_H}Aiui}+u5@Y%PXv3s2_^xL;hCeehB2-Kgaq7*Bh9(lL#N?;otzK&k6$f2Mu{3 z&+{1pe>ai`*xwnje!z7C>YqT`hx|w)?WZC6BmsUikm`21NK4MEG_@_%1~FUI-sdi~oRi$UaBqJvN`xBJsN*=K-!h%pVIF zX-C8!ecq>r)#fV4-|g^drK|DO>5>B#&x zLh`*6@qZcV-)Uri*dq2D5&yzSyg6A|eDHpURUbyPfP5Dq^8v8`21n#R(GqeW?r%jR zf1tlV*N5B>gy(|#C@e0x?}N>uzyEeJ5z~YBtKhsSByu0r8;So15S(_hhO9$-ZvyxKTP+qdV%-%vXU_x?jKS( z6(atL*+IT1cpd}SkCocP`n|MD|3S$7Mg7D46U$#*7nX0hKBM-mprgdbZzD2(ziVH( zfcb~}C)6H}KQaG7$at6k=J-`2*Nc_b4;;UfNd0rJaQ?&kNkOh}ziTgo|5<)ff7_A%3#DWIhtEgQxKa8V zGXGHfU**pang1aO{VV$xr2bNoc+hxJIv>%GMEw71{)QvhFVy~5^DhdSf2chgFG@Ef z^@G|I%O9*iDP+7+`(O261*sp@9`1k8`i1_Ze~~}9|01@2>Hot2ui{64{}7!&&_5bK z9EZEe`g0xW53&41`yQlzQF~(fgZ6cZ|7+3M{DsfKVf_({{{~X;ziU5+#E*{uulz3| z=aF(`K0g5p7G-={izq_x(H>kZ78+K;7f*jUPN$>r7ia|`DzeVJ!0)SjM6)A1fv@$cm| z9X)im`O*&7r*iykYe^!$YR&hWO((Y#GEC@fTKRIhN7maGrgzw;x)XFld|>H0O#@rNaBx4(CM z(RIq)f2@0vKck+XPVQBm^fv?N`Y4HgX%|1&^c8t&ljNR$T3EB_exEkHdw*A9#W9PT z3UXSH=bI<@?>^$o6RzSKvoLJ+Z04@1%IodwIjUxTt%988KVN(L@gqq?g&pS8Z4i6H z3Ta=G&hON|CNJjYaP5gF=GyoIZ1hZ&C?!dlMoITxrHuDaB-uiBM0GNS$!W9XT2hsD z+b9JDwyECYG${vrG7x;Wpe#LSvji@9d3to_mTth+xx z|EOvIyt}Z)Hs5@>UX3weaYKM)-9lC1G%g_Ttkb=qhV=~0KB8izc8~qTs@@W~ zW!E{_T}iwmRcI^VIDWR!)@AK}_p;n%)+Ad-)-_&cHR2spcZ$D0khV-^Y`SxF?&cguiP_I$^M~8o!_5f+Jjx0t`JlVMOqY= zCz3O2M^FAxXxi9A@%abYiLS>5KRg~*37K^l+uq$hQhSz>KkSOY=$(Xv$x8_u6xm+q z^3tVJL!aK~Ej@bbtZL^HFXutSvVrB3cDio@MyWf==cy-IdxG00;&P)iDjU^}x-1x6 zFUj@0$@aSH+>em^*)^9v`FS1(3N3c`9s6h$UbfZsPC~oplL%MC*uBp3bE%>~he#kk zLd956@)?Olt8J2hQ6u5uL&|i?<95Q2v?I-U9vLg+)Fq8bBpPQv2*gK@2CsKC6x36| z^9FPn=8sk}@8xO!bX9ci$87==oQcy1Vnkmqol@1cd#xTnLwHy*lVR)RV&>%fYW&F- z;qYCNr#PO}e7hAV@i~KPMBdzqv6`LEAfsdAX!`wV3C$R?8I`VdKhGXhN{Lb(M%W}Oxt4^4Vwzq$NzU%}WzMer;=Jj?4)#So0|#3%g-Dj* zXzNE8x>WS)6c+7j*E+CsJ=z+=w$Ya{NYjkf{?MUI`+K{#kBp27h8n!+t5y*<$q#P3 z+4acV^_fb=mRpg>^N+pVUU&8BItyt(wL^0`SG-aN9-SOjFb=(XExR!=*f@{#f#h@F z`_FxkOEDf-UJ^60-FPUj?zO1?-hy);Cf^k)B1j!Vb&W~~{W1rwJ?B0qsWSNRg&yP$ z{b&>+Ke1n0H?82mPfoVXcE)g@x1FlDa?#_!imA?qYw7ZN_eZ^_5^h=CxH>j=N@C&b z_W=QsI+ui@AI0ay%c_Pf&cy6cp7e@&_xYgDgW$FsZ|-Is>Xs9{MssY??@jZb!F%;G znhDGO=FW6`>?~i-`SQ%OidnzXbgsU2PPw>Xf=+Vl<=M*MXARFPwTfFB-%*~Oa^cSJ zlQQd+EzWY&&^8x~{#0{yX|nq14uP&?8$Z3RT%w)0o%l&pKKzFLRu}6wqYo-k@4m&U ze-qlWd+2FhrLWhiUb%}$Yo|m@UO&#MN+fGD32(;Tth#7$; zH4rvt8GYw8TG@QVA)N6Zbxrl73z7}W59m(magpeDk3^}J&^52OB4rJ^*P^+;Mvrn= zr^x8A8ol)gp$nRy#NSZeoNu%EJgl}=EHW_YuF;uiXC0qcTYh2Cx^2)sQeNSAR0uC+ z(mk?>>p$|UfTcg&YySBYAs!#$&AIF5%J>-T$lQvLT6d}5`h1hG;oIC;ThCiOUVLtn zFRK5<-qNifTV^=JI`4HIyl`~$NB^VNr3cyOqr$Gg`)>JMe1A-=A_r@v)|40rtG}A7 zU5-0#mAR#9e)zW&N`gjw{Wn}rL?xQ-k1_ za$M76!QIJnIjKIU*}jMJw4TX1!m47c`|t(N9Dn_fF}kA`%W-o2)Ga>-E-12hJXh#% zoS(h?#nxGry*|H8r%-6cs51r_^+Y2m<&d~I#RqxNDV8ut|~?1LlYyp8OX zc*Llwrao_BBm|H1sE%bEo^01}D1DxsS8c$yR8%W$7(ZpjA?RJe<#b=^tJT)J`4245 zXl$gjjB6jh+`r*qQ|~d^PXVqn!&I5d!U8sQkzT`gfwiRtWtok>7hjs4Ehud)%-4PH zcKMLCe!a`3a6NyQC_&1*oExL$kd9;=7v!} z?p*-_->U(3qO)i&we+!PtY=+v1v7`4cNXndUs{B zf^4r3ZMHH6n`8ECj_DndFI6ud-@vh3?L_*N@(qhOr{~Ak`;lC8CbjD+n9i|#Iz7m= zd_%ds$>7dF+XI7?eQuTQ#qR}^8aKu&`Lh=K6h@u*J}J3zQ(0Y`^UZl_%AvXCD7)x= z!c)OB+x@?WkatYqUcBRV{BlXlQrBCi{Ub{b7BbWaE^X@Aa%_5ZdriP2v9bhL?;8oT zQ;(-!%guQoeEhQ4CZJ_z$T*c=`u^19;{(Goy05;o2>E0kO5XQ)j^+h*>&?fCdKwH< zhFtxVO?lc5v}zkJZSmfFuH$`5-sB4o9i1-O>}K=2%DZ8ibQbX>`6EJ)9@TF8W>xw2 z_`QQ|?O%uZgHmYs1Z|5{qBt{RcjDwH-X5E@%RASs&sex;o%D>Z?QB?|?xbTfYgA(B zd;QKQ31(!s*JPY5u|C(|^mSLpV`|l;j#p6!)B8W!Z+_&aUsd4PfAeIvLTD)|K&^W(gw)XTJ|Yxjs{^zQIw;^R-cYM1@GhnX?| zm}&Sa85(6$2U14oToyI)n_H$s^Rm9Dr_gk0j8AF%8d2>_m`mS7<972aLomm2kC3p! z?}HP&>OR(;xb`IBimvS(P34y>GaH6aQPe(U@{J03c-#2Fa2sVgGoM&CUjDYpN57VZ zJ7!a1rIuXThr&dtrZ_)G%~VTXa<&lIz?H^#$cAb?U$9_+=fySYB?*ByL-60T*>>5w zbXP_MMFbt+@ZgeNZZYc-uc^_Vd3tiw2Q00R+1^mcAEkG=C}^r;W=y(|PSC+{%%Z?A z&aa5##u&vR&w1xD?pfC@JhNP$=~Whrx?Qa=rtyAppYDFKi{HVO;g@)c#UIz3ycn@q zGOYPcBZg;A^)pvwM2yjqS9;-xd1hTV_1I@tnbK`Odrm9!tFzt?Q#!%3p=~aoDae+? z?0IOK7V>wiC6m|3yVl7uzj~IDVX^Pvg#useHvx(hMLTZ4TR!CaB<%8w_c48U&))2u za8PI{pL(*CwKbxFbCH+Y{xah{A-c^fbwOEQno8@erLJmGev!?AWHU8!SLZ9GIUb3b zi59o>Bd==d-OTV#ic!=tDBsK_xW_}Z>_q;YSG-2;I6LKs`Xl%-DGHq`gHO^e!f~c0 z0{o$8=bMEqTmUrjHUHmOp<2+Fr`!m0)dBiR-*`&Vc@m8E0d{X%NZR8U{AMv!a zY+sM>(b+CP7x~uQbxd5GcaQvcJZHQwN!JzEC6|rWM?z#b_7w&ePD^$<$G+@N<;vKu zW4xQHbx6x5V#tG4tEulewScLvKjlDNSh!uvgjXS82jh#oj|TcoS2-r~|z zx9$T0?O7q5Az|s^9|Fw084etIUdbpeU@BVS<#e4sE>GyGMvtoJhI<#TvW?AN<(g{I z9In+%ZyxWQDtWf_z_5EqP?hbe@V#a4!rj@#Jos)_{QRG?#7yt~ckYX_5?6BSD|Q)o z+mxla*S^l$*Yv``i`GlV%BQ>{c5kDTNt~6;Nrq7e0n7ZMOeaC>r84)V6Zh?C)EUb- z63MgEIK49ZtepB-;~U~>>9Y)Fk^-VNGu9$x2ScYONZnDpI|0cKh;20Q)i4WE`2Gv2#L-cewxf9M7I@aVaV zhc0P|Dn!rKGWcB2x%S@w$ga%#+jLc`PL?DA0)CzKGWws|s;@aYDyb-Pu*9EqkL4*g zc2j3~>|!72sm+y^HGkBiPpG0$^P;ujXl^B5bksA;&0JQ)ZE7QFLR!O?+>?Cb8|bow zex4ZFPCbfEE-P81yvSJBPcf`I_JGvqTfsNgDfKlWBYrgDyX2l|8WyST5)1P@VsIoi zs=i3_sU~0Xr241&p3nBUmQZMCyX{N3)h;8=RFFU8Db92+q zRzBlPY(s*50ulk2B}4Y+WMxHe(`I5C65m1fDs_Zg;Eey)!%x!F#-r4@nl>MPsaY-R&biFO*rS~hqzG7dXYiVYqL4iWTWwG<%7R$xxP2L7J>d*ZdKNuFycz}pY+g>zB{o)D zYh5Z*tlEm?TblQA&n*V-;!$SjIpqEDYe&J{>yeArcJ{g3TbFYtOupt;=f{WXOXs?d z3jHwIm>wFo%T6TW;g-yvyd#%BWk1-^*}eTG^L}QxDP04X2SZ(bHr*2w4j-pn&zp12 z%1z!|>@S;*Yy3iXSIb*P_ha2fMMeDw({J`xS2!!@9alf-QM0$DD(}vz*`THQ$7fr3 z2U8{7-E%x_I?cZ?xjlYX)4E|gX}S1TO@+j}n=VH)@7P7%XS_7wx+zpv<63t^?7P>c zW9n06A17JG+}v9&w%^V-5Nc^`K2bO7rDTi5&AUvjc5b_K$Nc zH@UrX+MmzYH*oZWZH0+?QC_mKPSXwkXBk=1tzRA&lwGbk<@|kK>ZA1p7yrWH?{0<6 zW?$A{m~d7q=x~T#wqY6TlG8}d&tq}PbG>u$mMwep{SU`3pB;Jb%-L&oYpfZs#3?OXEWR=9bsS z(#u8?hRNgDag%6@~uHIX9*cKEu60c;SLKqpU~?gTo2lpp8?P4!b;4dq z=V_#tgmfH|>#7SM6P645UZhq)dO3ztr#NtU_xk5UySuYg88TI_2xsV2df!Mqn8F-& zz)iaU!cl`4D$DPwnm1)z$v-d~AkjIKNj~DY#`pBKWS4L5@kgS@6`$P5OEZca>)$op zFfa2`clwLvOzVi;$kAl8x|6+mE+v&_8HYJ{ixM`|$mg~l6p4$l9&)(DS+T2uBVM(z z;KFAbE%#02{9!JO!z>@TQpp`XCMLHgn~O$dxTL3;Hj<4zyV}m+!#0w~xo3ol$EU^K zeVbhELw>ygo0!zNc-wRDPph7bpG#+~-tDyZMpmq=amj1p+n3ND`@QpkGp6tmpt^Z)8razii}#N~_GTque~zGU>%`DM#0ZTU87+evA!i zjgEdixcL4P;geobcfAUkklxw*Q!OMdqt}x!c$J!x=wA7L$hy69O^1r<6Q=mZV3)_y z>uW4OF!AUe4KUxEyw~ftsMPwoU2JEDkBIVCkW_3p75(9vEv2G(;zf^PsK)$V0V;Ko z3Q-Tzh!;{7t@}eZ%y8cGE=}Z)S}LKE>#lMg2~0CM_fEY2P`vbmsockkZ*%-F{jfUt z!0FbQYp_S*v6*hFgNKHvgn33b`*0{MUXpon>*@{Rc@Ju~cjPTu)x%U;=}aas{Wie61<*0h6-X7Q)#Xyo0t zDdaqsT2G-F@H$h5jX`EPfpMg+Y3I;DoL#n#gp>VyZc-`r6C3rm&7`E+`i*J z({4}8d@b7LoF^L<^n(iN__9>ppHOJOk8X3JmCuNFxgaPQ>ELS1p&r^^o4q4}`b}oG z!HC2iic6Q7)2fVZF8sWcx9OWgb1*=XV2l(I(n~>VqwRYc*@7`H4GCrZ=!2!D3RXIORM8?OFiw5 z8IxiZfkwMirI_Nvz+E$ep$msO%iK9ED4p{{%DIMb3hw1{RJzNz*P|70FMaxv5}62t zjN{T#4hyligK>6Vf^sU=JX{rLa%|qlT#e9)ersiUKqxT$_{QqK@k9jQ8&Tw=utF{QQ_=#7@Br!wvf-)9-VpK38Zd8Sxhk)yj)g zIHFBfU7lbyNz3@i-^Y(kP2%=5?$_?4{H^IX!t!)jOJ+YCy3?Kef)5G1U#rP?*GlK` z=F-~eF7}d+wfwEa*=F`tyiJ-)<|LLTy1GxeEj%srd}znbGYAfwGQ&D2x*(Rh$#?|DdG`Ey81W<*ik7%&*r#X(659F#J&1NrK zxbezJU-hQSOQ!t+W5=A6HgDbS!Zq>W!1%22&EC{I+1~OxnNz{Vv)>?+b1S2DgrQ`2OF~-uD;N(tJ94mNfK5S>1)?6I0=A+)l44baC z-7|x}d}4)X<&`U*M)q#b`n)z$9 zO&?m~k~UA8XpU@WH(j{#D0a|0a&ctisSAfmZUkK06m+}royMl~?|Op649(b!d4)b} z-B#!x4jhp1vg0SAW^CO~+ZkkS!l>i9$L(q2#Gv=l>r}euL^esQzB0eD@!sZ*;+iM5 z(U>S46jbfk4m{ibgWXewW3Q*S)>Zy1 zly9^dy2Fi}KDfqZaNA>o$?4#Xhp(5^c15y541z-c+3`+oD9AT3&_Kl`tiSgG%41yYu_&(q}JnuaAs%y;iVDB5>#A znfx?O(Y@^tEuZLpdvr5d^G6_6{B0w0*O!YkYSX974UL0E?CV|_OtyBNH+`H~J|cG z5w_dGJALK1NWKa=QIfhvM5kn!yv1N(l0{nY%a4Ey_oZfDf1Rx8eM0Hqc5x(q9aZ*`8d-9jq8PP)<;P>mAtW+uYbH|W>{XF1Fk0lur*NjJE2%CdQs{$2E~oo?ulbAeR+b^<_kKPi1t;CP}lsdpL#zTUC|Z zz0B>!#k3n}UYjrpp1An&%q>%Hfs;3k=0`5a>baXmqo{}X)o)z zbdKsr;`XiQ7&gbL95`V_p=Kn@<9^ZV_;%xxTp|=j~W#)1t(gqk}seA6p3q_y)|i>-)&< zj4gW*JlXMddvo|f=jncvQ$2k>cJp&RiNE4saYR~HNoyJj1895)AdOUuXd2iHO zN*?X~=Wb0U@_$G_@9jLvp{z`*KcZ&t!T7$iPXtPFvL+dxN%$N<^@i>{ zX){Zh9LLR8D0!NM)Jk|eDWUAwKKOsLya%a!`$JY-HKJO~( zb&aXv_{6pR^ku85&aJ?Hs+)l+%ZOc39 zH>P<5J-3)+93N~`vWu>1IAG{cr6X0OB|F766x-#}vQ;&R*5&fIvaM7RG8%lhH$Bg+ z@9!D8p2%3)d^Xola(;QPKaq3)hHp=<04KEw-UUhwbQny#d*MS-JL$9MP4`>s>dzn0XiJ@HRl- zRmNn^Tx71vhx*= z=jxlSTaMD@Q6HDmqX|yG>1S9hJ)OFVvEu~0r|E>#3;TYHll(tC^PipgdGM-J_8ZRe zKg=;PKBJkCJ*!adowI?kuhFF|bk#lX`Z-yI06?PZ|2xrIN(e;te_<3?9 z>-2lapS_0N!)gDgoVs4;TX#aYFiedE4x|p)PpPnnWAv1sSUsM;XMIQ!7t-x5(S@hcS)M%tuGj ziyb4RQn|X4DOg+xqj2EgJT8B4kM>ztMwQaLl$7%}YStQEYXm(b5=xIcY&b;ltftq{ zxLI0|vQV}rV`tHw)W~+>LEJ~q!XulR(*ii1Z_#V?o@!-l32(Q1Vytm}r-e?Hdvoi4 z$#J3K*tg#!mubFIdCo_R?Dl*#kZq#kksA<9Sy+=PAU(V;DKDw@P3?9Ii@Z9?tOZHF zS(ir-nVf2*<) z{_~G4k8!^gk-^OJZ{4PlWaQ`500^YAz?6YTJH1 z)}@a1<$R27Ggnrp`nf){HZs4|?VD*I8I#Ams#R2<8Xw!XUw-S;O~KrUB}e31zS`Q$ zve1{MnfN`rY$d4h?fd74N6(D(7i(CW-sH&0t#z&tT^r7Gd#tcTVtumE?wUD|WO)OMXkS%QkP7P9FZU zYm_(bvi!tQx~TQo0dk2V$-&w-?lXelwkm%($|*XI*Ub%lWGX|{oYs&2o2bJ3= zG{{2-9q}pWTyNUj$Gz^idCFpvY*o(OXh`!|=!IruV#E)jpEsh^%=hGrSTCRcFn6r< zTYGebZR5<{oz}}IKYZD*FF*1m@f-iq*H-M8jTPu58V@P@Z1o}d%5B;6L0*KlVx{4SR-IcCg@9%dx@oZKZ=8OQ(+e8p%=4PdL_W$n;Mj zXo$#*HRtruOgp@K^eHIerpJ#XBV%sr>g(f#C`GgmlDPFKC*ftzfA%eTSZv2Ucj2|# zH1)V`>DjIN>$$$1%|CN{NM@lXR&O9crs>cTrv;Y-_v@Bi_U(BwTk=UZ{j2}WkA@p_ z^$Pa{&fZ}bHxVmk-9f4w{k37k)5eTp=~o)_?G{$JO;Lh1XYiP?PrYXs+X717u z5pfRFwYog(+^Po>Cj8C!FwW)W-ld4+yB4Q(F{#np@WkP#UMK0r1cY6a_Vx`I?6Z5h zcZ#EgnU7u5wq?mf<&&Aqz&mrhI*BbZ#x1-O71np}d}2=(I(mstVZH-b> zZrs-udn}|T?)dW2p#KMCK%2kfsvq7-6nIR1807lYeggY}tIYmIo_!+t8y<`sZ&%uw z+QPz*>`EI`zlU9HGSlyxRE+(6X;)g4sr03)blO;$l8lPG3}>a!SyaSSOH!!~C9!tO6vQ*D zzbok=gI3et$iO7YDW=`)s}TM(xdkS>-{fW>RR*T_GsQQkVjGI;G!%vG+=s21URS4_ zUiYS_AV5=_rxfGWVg5oJ!-o8USxwm6PB%{{-x&u}nUIa^DP!m~FVRbZ{*4|;1DzqM z-WC;}M^gf$5oQq&`Y?GYS;D5CbgM~yD7jWYkw5rlG6paC5UNN(`Y?Gisp>xDE+zpy znT+Zu%0qM?kd%*JvknFitairoeT`aiFD+3EPlt)SaVBW3oD44&3Nv>3r{f+O$*c?7 z6bbhrB!y+rMoAqXN0ezNNu)%}r`tQVe0$>P z5bn{3!H`cAJc*nL9-WFrIK(Bgszkk&PZRgSW51kRL{psyrKCZA+WTcqk>v18`gXS# z!U$!i??ATi58e5B)F1jw$r>la#F-e*H&Vi)p#kE8~ zL9B96W5eJPQ$JBE=jtcOG=+8_Fz9$+}p{QG_|+xD?IQAU$3@<3~R7pCpAz&Y-K zRcc(#6FlBu*2M=;h7vKT}1Dme)) zB_y!CfPSL1kbK9X5Syrh#8#2eoA0;)oRd>sr0&TF%?cSVD zmvHX?lm9()CS=^~<1RuMPW$6ZPJTs25!32qaIre`W>CJrw8AOw$`p^vU!bbaKihW4 zeZKE>3derCJMM&d+qZb#{ugK1|Mv)*J{)(y)%i94t-iNu5Wmfxm(HGj_0;e`rDgc` z9_uq{w9?=<)Hg@_=)$SSY!e#OW}V!Zvu!UYRrgn%U)_#>tUK$xsx6N;HH1{k2IXk# zc;EJR)a~sx>vm#=7Gz?Nn%nHqBHaln66Yyre%9l)w|}jc9xMH3(b%$VzU>s7b+*lI zX=NJ8&>*hDup0S#Zd6wqYH^=Jua7?ep`=`Bp^=yKO0j_@9 zKFxL<%?s*~{4&|^3c%tTy(w!LI*_iz8f299pzY2e<9UwimQxQR2xBUOpdMQ@5Ao*| z1k-On=T9nv)Z0@J^CuMw>FTHQXb^-!J!!gV#!(tpwH$kA3d06bhrF$vaubZ&`1bx! zb^2EwPWa#Ve=4O;f|PK;9xq}8-oYY!*bLQRt#%fvzD|`KyVj~+MX-z7oTAet*Dh*x zicY1`lWnc+Rn*U}wW3#1o?X=96pfc-?4o8CrQzyt7sXkWhHHRb)YPl!Si9&lr|2{p zXcsMaicXb5c2TTX(O|o%u~*R$yJ(qHG+vIgiyByzhAZDLTFRm{Tm^Q~l3qo}+eP(G z(P?smU9{LKnsF2};mL$!R28HtL{rf^&(Y2^7xIf#?Glj@bhwe{ToIZN=JDJh&${UD zp?PIziYZ5^8j|0;XkuLgOPeF#PxZ(VR{*jrRRXhAUUpT=mo)ROp%%fA+fy&g#pSHR zVpVF$u2hsen+laGQcg}@6!~Fc4F3^NF{pF3B*^Sj*(^}56CK!JcID@NFo#EnPUV^S zxN9fnT}c+u=TBR}g(AsXc(q~TKFlXW-0S661QK_{Yn%+39O(T?H2Vo1(Vb5oQlE%H zM`MGo>UYA<975BFjHj?fldrZ=-f|sADdeWqE*ibxcD*4trE2AESA>6I$lES@{TQ3% z!(<6e@XT%6-!A*cw~z9hzP|m){o%8Y=1k}`F6?wdB6X*zb$gU{a^I^ zsr~I}=iC29zuoq?BX>((3A{2QLX2sPCEO#05vA8PCs1p_H(o>fzajBjx**on%7}=B zYgx;X{>;1eo$Yd3B~mo3i3+6R*-%b?hc@B`CH(g!n$!IVY4fE2VVPZvFyy2FBySB& z$t{yr4)j)Ym;H})y-*R9L5EtcL@6g8M`+JH zYJrt&FcsR?gj1=rF!3snSqNQ@TVz}WUYS#iyTuF;0dFK3jz(t%E=!t3oMkERFcPk; zk<~8n!6WNa+vOcsVCq!amh!2B>xdCL`nM{Z7S=dnJhC{ZgE$Na&h<>{TILMgOo&ImTm%L@yLlzIV^ul*2>S^ zm43OPTsEeBnQ!Zje7EslSk)sb3!XOOg>83U%a~kd5py zcMXD=1Ln234<7skru-whS8j3#lrI^KCoohy)0PxgPjJTe2Q@Z1Z#E2ChsoD#WCNp) z@1RWfZXe*&CZe+zd8=Noz@6>A-P|E?v7C9Z`si9JKcfyJsa9Rso7xq z0z!L%e3|S~TZ{bKm4@_wYGw@ijq4q`J6S8w6IPb7=rBzARcb%vX;&{uCqQmfqf7S5yYAX%NM-<7R@l~P&Ak5aQ? z+>xfGpnTvu9G)lFGwA0%R|MvSP1K0h67TQ3-U!e0r{5a#zN;&vio6oukt=WkLZyN? zBvH~#p>YgEFP22f+KAGu1mKnSLTY}WS7sOb-qZZzrE|L%(q2M4v?-Nr*BV)osRc3f;a6uts?(iv*=8drgsZs4TmEV)RL^znF4>Co zzuHRc5>=oUikO?Dh<2Ew$}@1<4`f9(?Qu^cL=DYFxD#Gkwihy#hAUcCA&I?`TZ1^} zGd?Ux=MOBI2dlISahS!Dib+SInjdL$%!uL1nGwkIG+YyaO~m;z5elf}h~&dFAqMRf z(#GXTzH-QBMxq^7e4V*dsIH~fVGO*~@JOO|I=m}UD~mE86~SD}>T+TiWKparV{AOW z3sN8B0!|cCu|aWSRE=uveOMLi7$>%*daC3FC~j{4euqIqlrDED>MYia5K#HWo zNLEzCh-dw(M^1Gby@icp5}K$Zr4&dixfvEpRd|hs?eLsKYdSoNA?^WBSYFZQO3F8t zG4O`CM@Y&y{>+KYas=AtX*t@XOw&Oeh4-RWs^0KR&!8tAeSjFaN5_FoCz4#txzcN3 z!Gr0D!>di~9$#u(C5$x492dXU$XOux^4-!Hf;nkp7g$<-X(wd4~LYcd|ewiQR~4YQkuqsG@`5 zL{!Mr_I})04G+WOELm2djkRfD^>hcM_X!f@r^#|GmOr~IB~az@xz)VpSS~ZO|lxMe4@6j3WRVD72_F8c(~f>M_GJ%e&KXbkw;qG z!%&*DVM3dF6kch6S#l$&Q0OzEO*;xN{%{tVAZc9vmZq2Gn2&uzH~I+V<3vn;q*c=Q z^1VdV<}X>i%N8v#O+HNchCP7}%%H*y@3ID>P?8h^(bnHin%Q@{2b>Mub%MaM) zWO(P0)3UE~s_f2aBTW@T+&f`4$qk8G`BV#Rf&B2R{nPij>T59kLo1Wbi4y+p1w+fb zuzET0uC8%lxLl{hd?{wCt;3*;&s~}L?r`aOWU%BT$HDMIs}0sD29C4u|+mZrM%xkCNWDf31g5w5ZNpddB3ApZjgZdtD~03 z>UHeDZXH6hNh;-E9lPYmvIg=_N3Hx&%4iGyxMPF-Py%6a!(4`$>d5jPc(n>i^@QgI zzAx>y5g1?4(e+8U{JWz^*+rT6bee3C2;|>(y!kNd{MUi357H@>5lNMV=b?dn%q-<* zYQYv7-tVA|T((FhqPS!v{j4uXE8 z)15!45TuP2{jhX!C?Y$RoTW$Pp^m6LDe5oyKtM!)TE)iCgxpGT6Psv-kyn!C^aof~ z3%SotDem{l?Q-f-nO`gIKDoQ25b}cXAh*0)21n$Mj@fpBCC8Rg<~MOAytodgcCs|| zFiP#@06#vtMt+=z;^c@S^Y=m?>UdZFA(gTvGnGHABU4Z`DIZEiwB53yqgMVc5$W(< zBdC#8KH1z+EB}xP|JqBZg_HZ9RI+-9lPWmDTDmDgFy)Lwv>^bYd>|^^$_lxNWNy}Ou$h9-%8a40oAE}fL8Gsknk@n;hSx-R2 z^EhMn=H&4sB*}8R*nLPSuCt-wv)7QTJEHQbM4(;Nt@0LJ)zKrLNyLy#_Y-3eb!_J> zN%3Zph zNB|O$Snb)h@|GTvpS0I*VBFoHG8NbNp-#urhhSoxY-%sZObYutB@esoT2;nqCsPI$ zORNOf!OK8;Z3IbeflrQ8VV}os7I&jG)>4Swk=i1!xyqzrtsGY-4KX>P3}Y0^ryw-p zp0lN$41Zo&61B3>CnrY02+A=q&#ePbh1}ul!7QC27}H_O%33j$0rmIoTz&FOy;5Fo z&u{>H7Ix|D<>mJ5ERZaIqF2ga+Dl}IUIuxsT~Pv`y@s-!+cOYi{)HaVBF27M;4_$2 zud!A-Y9V79A#;6@@vVp}KTZ$i5uHv6^q5{Jd)v!xhifB3APWiPG~3jvjgsab;-Xn$ zNBr`DLXrn>XZVjiqmzO8VQEtt?j;LemXltR1^eZsmjW`c zT7K8QR$kU4n8k!$2QQU*wK6IqyV|32pB|B65g0A-$|X@bWv<$#$O?_gFc;1@VmI7B zAI5DkCB9u+eKAR{C6`&|TQ14jveGw27WkG+$84V=1CK(Y8yMOv^LL4{S?=iYL4GF@ zSccruu~*&^m1e+*NdIEkaYo$c+Y4nxL@ul~q__;Sv=-7YP%A5Z(`g-;Da#8o-ZaESf%FiAm$!4dbz+))p$BAbJNJM30XPi2 zN3W#FJ%(ic0TThf%MNTE;^Ht??MNR;6m~P8Tnr6sCuT5ZW&Rm<+^h#M( zt&(*bI|$-cD*D_kqR0eoYBy!S(_l)fS`x9vv|CtIRNsoBS~?PJWTP|EUpphMz-Y)z ztIFk0!t>&)61kJ`{4N8J+>z4?_0xkr*`fV1hteATt+a^;*)_+=fB+s>3+1_0Dv1AA zIhCc5U#}{VU$N1rRiklC<4^g`DjQ+h!9pI$p{uefJaHUTERU}$lt&5IW2*|_SCO~V zRHxZ*BwkJiQv~mir_nnY=GO%qQ=ZCU9A(RFI}$f@8okWH#%G{g2NMCx3fdo@M35V* zahM`sPB8 zX>6OPHfnl$DBtY2WkfMT+GsHj%MN#=yq4T0;{uS2xGaq!RF-%uF;gz7X5KL=pd%iU z8%7*=E64I_#!~sn6@mOPwO2tRTBTZK!wKxL5%$Z^l5Nu}5T|Tr$Q3-heV&Xe5BQ<2 z@XG9Jh(~>P7vdO$7K6GA)$Ha}l-42(Om<>0vP~6#pLUg{T!gMlZbo(Vtf_`qg4N6( zqS~T@R*bof*7Yi{5U;eag&6!`N;8-444>WFtf;K=sgm!eOQuKdvnZLK7gQs7F-z6B zKb5W$j>;1Iqw~`x=R~Zk!xiU8* zp3Ty_Oa9dA%WUM_LN3p(OusnL>XX&EWssw-Y9m>lOWMDg0w$een1o^l%tCDDu5}&g zkR-QeK)vi;1Yl67VbFq;dA}|5e$~73uT~%V^QPQN$Uj?2=poz+X8iENn3G*|8*?jF z77z=@%_=X0T$gU;A97>L$4O5V*jW8hDoU?MFTy05IYsbZ6x{Q(?e<`OoCLpmA27 zbP+M7V|b)dpFihXBO9rDJUKFrV#i7v0#7>1mMXT{^P=l0 zU1FZR~iBtzzhP^_TC5!uVWO-n0%#h z0z?>&o*>^AjqGa=ENPFbTp-H(lgWx;F|ZwSZz?*K{kLyO)A&V1ikg!@u>81}h&yUC z8c-y~YXb7!S~1HY-zC3%n=BR^Tr;=WzI&SQ0A8I3yof@66AC`ej_xO#BJn!qagVJd%o1 z#Y)Yu2MjGUL8AZ@$eQa^bcq*|ybm)m20?n=GBL>PZ1lsv4Nm*F=h5Mr_D2Rj()t6= z0L3S3nyjkU=tSn~r;WVE`Q)KIC108JSEQE0gv{fK^|VniN8>bv7#_?0g3359Jr87Y z8>=0+8>VP$7_|jcSv$1hhf0}stqsg(>VX(iUUmp+b1EWHc&ZY?Tv7P=TLOM;y4;0sb`te-?w<=_GE*uTtDiu7fH2 zU5#>ossu&kb(K7}{fb7`^t)E|E-6pCD)AjPnMADz7CK>#Q3|J-vU>$(A$hi6CFI@} z+ya!EL6On(&JFB;0{Rj~I37<%yipqJ;5921hhIGtU zVQ%V|GHK#`c&e*xNpVFsMEg2t$X{~E%r)RgoT0r&9W26Bp>)WwFmW1XuW>3)*upr< zLB=q6$MZZqQF+F)H%S#T=Gp_M3+Mz{J*jM0=2?=v=u@9>Gr5sBIQ`#pjLqa2t80WY z1KcUtV~zaYRYq@+Lhzn5r9!2LFG+(z{WS3TAyWb{<(H}1V0A9+b79Ht{Qat{Y!pnn zjSal&%DhvGHwJ8pMXIB&l_{@C)|9s8g`73Y8`Xp#^8Bh2$h|o<)c7IKtSUi9TPU~Z zkV>h#3Cl}LqE@x!1v=>RM1_YH2DT6<^OPxOfnvTN<)};`8&`c&%vXO@E->ekjdi7} z;Q<+gA@920;TBQJ4a1Om>SPk9ZJxZJz_Mp~Om)h~S@OuL5_wYn_RAgx#1fUxi~Gk+ z26v-@05vI4mQtQ$lpgm2CZu8F?5E+8Pz=_I8BSC6V`rMK>z|n>*5pvhO^LY>O~TbG zQ6mXK8%dD=kx^w;-RLy2E8RphOgzu+%s3xG3P0r5o?qf>Sjr{Fkd6&n+O>D}R_F5v z)1Q-2Ho@~gjNjO@;5~`^U~-}9I^=nchYM=>8Oss;BNr%&NQH#UIK!{HF^ECwco&|J z2z^1OyRMs@?w(0^M`*c)a#y1J)HIlQ4i+;eYCPvL{-d4;Nn_Iz6@+RkV=Zqud~3Qi zRcmw8B!7$3^ymFmswRu!wn1%ZH^$>ud$DSj2PGBFhyqnz&L@`-P!VAvLQYZ4#4PF} zj3N}C#tSES@Mf1D+6wt&w6v8#@*0&D%e+OF&xQ=7&${VHsLJ0WjlOv@C?g9&C!XVxg< zi6rwKkmH0!U!2>Nn43vuKc~J1ajj5N{tUe z&MKDaJ{i1I21KM_H^e`id~w7f%)I|Jh;|rWP;O#=w>fFCSgV0SZ=Fs~8CevkEo9G; zNGl(?H8;|HyrGyv3ZoEsokU16pa$BPBa$o>cQH*#D8^{0w2KzDDlZuew#E{sDXW((@3U-Pgs`N%YWla zGWXC$@C%GD|2eq(fvg9(*L;bb|&`AW682Pv?)q+ z&$uivw$&(pKa=VeKb}&|*8&+j)e7qvR0zg+n;WX6Ls892M{IE2<1~KzKuU((TPzf* zzy>;~1W~PdZGN{pTX*+B0^(H`dD^#`6PQfdguyG466FcQk^da$B7Q<1L~(q4_N$7lNQdcbMy z$LYqnIo%0Ma@J=YP>eC~j$&Fr5{B1L*~+Uffp`!m{+WI^5@z~cH7YKkqOn$49AV0; zsN!UvDr&x>lG94tP5N{oiCQfk16lQ;1Is;WSU9lfGPy387>KG1E>jaeIi^*beX1Ql zPcL+b@SFu+lBC@9s?rFMwoFw$@N*UC!`K)TCap8Jnj_O9Eu`tT0@=2TDB6-{Ox2dY zldTZb#HWO+VZ4sTewAKI?9&e~oi9Lha1my5XJ&R0qtf8U z!a&@VuWBkfowHo{VW;)a8M{&0wjjYaAzIw1CHGeTAwI3##*6)_@vhOpyb6~5UFE1}I zBnP{FVBl;l$4oE}&6z4YqLr5N?uF-4#HoSq9TMI3r~}bvcB1FYZJ99X93 z%YM7*`!h{bBA`fS^TU7I42UN+rllC#E8ul+y6Idg%U6zW9*n;Trgm%^8T*{~pE8G9 zg%cJvP##G6VClJ#{jS~mK*;^6YTT;l%CB7`wDd7{b@uaX-T8DLqe<))nBgLIuL?IB zhAVoJl-y#>l!hqe#9ry)mTsYLLSiK}wfG=hSIaF;fPPa86B+JEQxx4W1V*a%`o&ez(E{IVQl}L27BV7|S#+ zwo$HhK?7Zi8W+(il^Z8Hc@W>2aZ^6E)!4ApO8C539WRAwN1LzFpPILO^F2w(~!9eL=eGt^cKK-`BfdrunBXOVL3G;xv5ha>0mM)E3J2M@->He}3B zCCqfnMcW}0csjdNKTe)f>AQr^x^hFRK+iQ~kJhMOaIW`gk<2r+3uKSRD-dL1wu4T$ zjh&hv$mwrLB>Uz{zA@zd*^u&`GC%v`YWu~k*^o2WlQ@2yj1u*VWNF1@*_vb_7t*)U zYKCAs`JqFryA<{_w7Lu0&2D)p)k9xiYS;p-{Iy>G>x#%O)?9pBFT~RA?uerMT4-Co zt;e^%eGLwk-Bc%O)cs@z_TV?WG~{;o2-VLnXg7RIKl(sflibdacWGrZhj)(JE1yN* zvhXu~{#RsjvH!v?ue*6T`b{gWXOhQ#YS9WWM(P_w>*$U__guurB6aUY+ z$WAihy4fv%QcP$aI^}}x5Ob$2&Jx_^Ho<+@hNBmAI{N<%$5-ZL`?t)Am^&fg-GFc9 zgd~8H^ahccj6Mj!8T8j^t`{w&S>XQ_wP$+ngABeh%&p%t%q;1V&N74Ltn+st8_xgV zb(m#N|F>-8D~SC66|eXOr0LsZV5c@QyE}l ziGHG7M7hn7amD(HhSaL2i{?`M=7r|#=0`~yz_rng0=8&FVp*L3o&!^kZES^fwCN{G zZ8fY-N&}FrK#*{aei}hBiXqM032SvaLz@9Po!U%kDa?$01F-!YQ=|m&ZpD0*Y<3xXPZ@i z227ZsS|8SssLbXiQ4wW=st?&q_t$jjeD>Tu}%-sZ7E2U}M2v@-h zSNYj~oQcUGscI@j(n^5UAEX=ZCx)$Pq{-!GLUL>wWuL|5)nc0c)@i!y*{ zZ)7X&NcG4dHos1ER;9_mcQ22sV8yZUO5$aT5b~Okr{FAl*- zp_51BA}od<<5e11;v=M)-J9?M+gU4GMBCs#G*5jw3*KkL+Ntzwpabejhakx)ufCzp zbr!sL__g9A{&`_-I0FdhmMFZ)n0Mfn+f&t$Q)us#;x+Kf+&6KGOdy`t!K7iFavU3+ud7%fP!TLUfqzRQ`yR_(vUvm!3`Yu@O?FGA`0&(y3Y;CpA5F z%CN$K8+A*?;x8fLsDgDJywCczQo;&tq&()LBqLQZF3KldYEf(Nq+2>gcBgtc5^YNN zc>bkgUSd&s-4!5>z>)^uGcz=^h^h|R6sax?!64efMU6YHUVS-u=pth?1O=i>uk`}p#~fv>25bTjv}lgN-kzKR=Mp z|FYTTa=G2^FY=DzA2)xw+-^fFb$v6fiIWMWsim>Gepz%vye)2L1j+3yBS?KC)1bub z7pN>5?#5UsVqb0NUJz@HH`}H5W2iCKRJTCgF6VBnS4lVMT+n6OH#q8=TiGcwnqE9RN1}<`M;rMQ7jUj z-?FHWD*s=}GUH6g{Q7uwL0{QnoEmA!`h-5#2fVR9Yi9DrERQub^zl)=Exw?x&o?BN zK0c_AO<34hM``lvDXZ`}3@;iHx&I6g}zb5Hgn&E_^cb5G8)%%$ME^8}lk`DJc1)9vudXjmR< zX{>MMv%6m1OWu!-sLt|;Gv{^Q!ie*H%)&^>X_!CQ#uD|>F{{+~p@#a#mex?+vdF|U z*m(am5qzV3VI)Md52b07b=lxTuI$kASlou~nCALr>fL}Bmsh!Ug5!<&)UV0M&G+flU8|lyAQZQ124;yfEHe*Id`^R6iyjTd*{?T=kWCw#UNi zPD!TqOhNr}^?GGfeRFh$dW_UJIkoa4^-V0yTc}WXEb*;=H%3)Q{aKJjLLOnte#~F? z;M0%USF55;vCx9p^0q99d8DT7&;IIX23++^_1v`5nO9v^QS+!?EnCnKt!r#iBO0jQ zIn!e|o@p&_d3|JIq}P`#>*||B{HH#mT1s;pJ`ajFM5C(70jkMN8}5c!Y$+KFE4kA- zpK{WRlVyXWjS8W8nMy;555CEZ)-6~NwXdf=Zhp(cg?1{c{A^aLf@RB_VhdS!AQ!4? zFMrv>`o=mn`D$>{#ucGRbYWdfgKG5n<@L*>We#|GE1T*R)Y|-PKCHpc&9VgxZ4m03 zLutBWXU7p#r->n7`E^3Cp`FM#{NRLaj;o=H2e2@&zA+MQCEUHPjvYpDGq~%Y$(uEt zk+*+3M`Z_uspYzqJM6yqzh2^c@H?uGuE{5^{JiJ%S@gu7t!t1!xgz>3UdauwuF0QV zUHU9cz)<-~s$AC$`IBp>dc8r{pjFGCT-1l-{pgr1<)LMA)87zIK9PNnm{psoVZ^2~Kw{=vL#{MV~ z{(6s|mS@|hq7a(Y3_UNAI==fy$0z))70YHhtk0Cg9kse9mrGzOZK&f_i4PK25dqVy zbxmGnqjIq0D@L9R)DS|@s>JGHgOF$CC3bLcM--CWu9W4Sye0$kJTGDD6-OL?(n0Of zG-{R88$%*izyzJNj9prqen&p#)ZU;XetFQ+snTfoDMtzq=KEpJKr1Y5R`(3QI;CkN zc|qi?Zpo>UHu|;(VLXpc?OM0w9F|ojuvj8FN@dfc{0>*F)r;k`WC4Px*EPACPMkcd z>&1qAlJx1CT;mRCSsYdZ1)wZh2s5CA0Y2(kFsz}BBuDpMt!G#mVDGsXg2D_ z_VYwtlTG>?`YHVQWms(PTD@#6f-L%1J5A`CT&oAppK=v`FDd8N`l{bLz}~Afmpr`M z$U{?<`(z8457Yv^>AV>(bRhe|qt56oP^A#0RZ~{QAO=0&!y~rHKXKGFS!HyDe`E00W5uhysrg_o*yM*YANp3=?rCJVP-9dUvQfHh|MvE$$uW= za6HTRWoz`PQ0NboOPz5t30WIXS8t2C_wQGvUv%>eLl%Al8NM03hRG}LH`GOqMl&`leHA@bc}pt)yH);`ETLLz zqdOuWB@1LzhKkqCllPN_a)Uc!%o-n7Ys3TZI?SU#GyU`EBXT~hS@Q}P7<0y}ED`mR5DO~GjT1AeNTb<}@ znD*F`HL0G=I;eWxp^YnHZw?!^0qKn+`|hJ0`<)8YrT2M;w)TCs4!OhMPr@&GY^u@4ytJSXRdL)1|AUkZbPm5>b1R zr6^J>rf@@g3&A)~#d=$iW9a0tHn|`2FZWzn(zIO$L`LFXG(naXN_&*GJN?oSmEXD= zRfv=#UA(fIZ#McNpC+PsRiQB?N8RgXb&_toCgp@;)T?E|lrr+G)LKW`{aK8NN#{d9S_y+GIGNu6TEnUI&;3iZ=vy;i25EYG<{2x`W{ z)Xx;&;>o@2c9c`M6L zk6M74NmLNb@3pT`sMJL>i_P_S2TzaXQceE>m=sDIK@Zy?K1aRsTV|SRvJjCjgamIu z668Njv=D@J&{nZTG^U`Cjt#KziYTE}QJ}0&?3c@BE>xK3^1WzLOeeXQ_t~BysU9+m z&513}2-e7Y`LZKD#cRZ#;vlq%QrDB2->UZMh8clxiX2h@xCn!9muCg^H zSuJh`$OpeS0pno$xU>JhMOk8o9$G$Dp9c9=D`laLga(HECU=BAgO9ZCvgh=k+^6Bu zr^(Z;Z<6A21NeaVU!;R&4!rM-F&&SmZc<*lOY+Oq#ZJ6IvGgy~pv~qD zwh_|Iu(@@h_vA##ppUs$ns#wD4q%>x3Y0!J4ce@3SjM%6G~ZVuxi!ov(L@6azw&A$ zkL-9z+?zSiJ1`Mhe z1{3fYPpQxZFY&XLmyqh3yqR0WpSQO9!ZumImHQGbJm_a2l^>Qq9dd7Lxvt5xxeRSg zWL`k?bi>l8!H^qQmZ)zHdB=E3R#vkI*|G9IU6a2Xfhv8P+}P^F6!I&c5p!#3TFv+t zyFPIM|2c2%m<;-Jns{D6NB*{g>|lGp07CjX^5+$MNln}P?Ua6u*yXBVxE41OEhfUP zm>BmU!OXtaMR-r@vK!04oqqn-j~sq3j2Q^xNrbfeZbOFdmWB2vVKl>QJO*_?r#=PJ zxw25Nky}$V!o}4<<&}OfK~g396l0REUFz4TgmrBS^L6AGGlaWB7kObt0Vz#(_InzJ zXvNd@DYXCb?nH~j&>0yr4wgOzhOFF@md=d;-542Dbv85f9+ZadkmEK_W1wXea>5#n z#U-=^#laX~i^nIzZOE|7=?H>(ZA)Qk7fD@@jMyx7v!$pQKUA>>q%M=*CE9SQ?UACg z7f-=-m_Ol_uslmhtU#M=Z}zT3X=L?h=D@9()C4a#s`KI1$3cFl9Qyi0?o9eHL-(T` zLH?97-4E#~(EGy>US6*IrL|h`FS)Hoca`yBRZ$h@GkO{x)RBFqHrR($Mrkd~FqqY! zJDrauUknmmKg^?r(gQC%bl6jWE%y0YO9^YpRe78B{_hIQ zcOdh&=>27Q@hk*w8Ewi@T9Bt9$b1YQtY%+6mdS!oGWgl|Wg0)4tk(1Mf~EdZ89sU- z`|20e4^YUJ-1V}G9vQ_9Y_C?xdf&Af0lio@re;%O(KY#(i)OcC81h4w5#^t_TJ>W4 zCpOwd`yW>&g18fLy;!bJZCCoBqZpZCn_GRCP@HLBNm1ei5zBSS#blWDcpVN@{e{0sOYmP0eUtnwejlMMg zc7?3g+#PRjnXlB7ZlzVH{?C32O*~_M+UVEPSl3X$s4=Q^tM1kXix;Up`?T{_mD+YY zU6>T8eVU{CzE&b@zUliti!w8oAx~;#h2HU$(zkUxidOJC?CNhBW_M zOmp>p**2Aiy02cG$)TaAk6zL$@;=@;U#1b&(6{l9*GSl_%HP+jvI)>$JES*0X-(01 ztYL+18gR!K#B9TvERV(Oo9knC9o7B9jQzZ~X(VeTS&+UpBU_ZirOH0g+!R$08VQUg zx$$UIeO*KSD!aHYu51fpn|}<_6>IhDZR6^fwQ;2%d)v7B*+}PCd1(Sr&nxR1mhwT; zmJ=**s&7=CedR8VXzOxSf53`plWJsuA|HNvY}z(8aCu#`GDZx_nomeIl$n~Bz zPqBy-tL#|$nYP#~LH=svy-U>dLfVyjSpxIpSxaE%*@lbNosvxJnF8Aqn4h%-=J&P) z4oqA83KY^DSO>Cirz!Qzw)mwVv# zbxnRDmArn9#tRxen6o#iw%XEOe<_fcsGXdrz960ujp|Pdkc=7aU6s2ue^Z^tznS0s zE6LuCJgDpPMPfEOVR#YL-SV4cb@pbA10!r86^K+D@$Qswhmg&)yN%y6g3SBO-~W?( zvf?Y?O24_X!cj@@8<~bLSB4NgFLhzFum(X~2U8yfIlhMO`Ot>Sk{)=NE^j_%RPYjN z&ldWmfj=sg{A=MdiqCniu%xBhsPYSTN}EsjKt?}myC^SVaO+=GjGm>Bk|8xJ6enEZ z92iGC5Is+u9`#fl?hd-cF{uhqjLpg)vHmaEi4Y7bRHoVfalDyuIK|v2nDd7rhK2-r zhzT;?o-vhHE6dSf7dc(Mk?HE~^hF$hW73{`5#r@pztET=RaWsdP=vTPS@gs72zw>r zLr6a!hWN`lIPD3y_zvsGi=R4SubvA-d~;=BF(g*2?$m6dilh~tdXD@uRm=2CdM>mQ z`JL!gh0PPCYC*uk>C|)GK0!#xI_m`J+~eeI(Sa=>bcThPDO-%JmmaZ zViHoeQvoH*%2^r2@Jzm6UQUAxjj62YQJ*J7-DHI zH6dP|dXO=5wK=wYd*D>3omV&~#Q#ohuB!EFq833G-2IgaF{vrjN;xSS$4avN1@27kRL&jF>n%t9|&HB%| zM<^ifO|HcvbV^$RUV%4r_E}x(fc;MuZ8(Q?JJWwoM!|R>TjBfe{5cuf)iuHS?sCTQ zQGc)zAtp({Ql)K|E$+EQ8{|Ez|74q+3sQspJsHzQZgCT64RRn^&M;HMgE+Ji2YJu+ zo3OO=c}dbnb=91uuJK?>h@d_dy!V^fH{=?3u|6DfK#S;_+?Xh&nK%e*K`qr++Hjg| zgSZzArw!s(cy5DvvCON^9Ijkt&Jgb95I8~4yDJIP?qsc~i*^Bd$^DXAvbWIy4 zyOYfE8AM!YKxN_so%#03PqcB}b+Dwp4HHY@MF-69AzqN_F}dt`Dr4ca96t?E)1Qj;h{YcO^SjG;>RxNv*#kLZ`IKGG)1v&o+Dlb%0)%lE z743Bh`Wdzz!YyKb185J?1nm^LJ=uee_JBTSnfx;8nq>`CWj35^X6C$-Dqzyd;dfdnTjG1@^Lo*aOvdV$tAwp4s zAd(1T4nj1HTGX0K(#dkZFI)ZB1c%j&5FCx^2x(;p5o{)bC!G4LEvNaHSYL$-1Yvy0 zf4H#TMvD?wBvtJo#_xRdC-u!FD4+B(@Qzes#5e>WMwPM@%z{V7Z7@-a2SL;k-Ucq4 zp=xty0;nK(5koVrqm2$z3Qu!7`Al`^lN7y1me8bc zWk|p4Y^SYf?Y4p{{R^4y9-JM+7{qZUmE3GmY1rCnOYvr0)>j9d241Dl3-(|hETvqO zO^I5L<7BmR{;AQ*Yg`XYEA6HL!$3U0f!Q+1f5u=cLfaS`z7g6bhqx=8Oe38^=~x>o zZI0D-(6^cJ#u|k3?bTq-ivSXtetp zw6{r;xs%s%6QUJ+6IZ{f0Ft&?W)4@M?|^bST@~b?9T~)I6bCT}vbC=NIw*ha*p;2A z+X#wr5<-52nkJkIYT850@1xTF7_zE1vzn`FoQ^lEj^A)P{z1BXV5#UFL++)smvSWvL7r8>O_qTX=7^Lw+OK9^h#*$bbK|zW z8U#_HZbNyiWs9`6sZp$~9jSI4O9cfC#o2<0w7m?A8}q%2Ra{3Ia3h*Il#A`5ERAMX z`p7vBfDfu+Jm?JLsq8RTXKT^(T7_u&Jt{iOHU`Qg$ zupjgDU)D_p@Aevp3)P|3VCKFD(xG3oHo=_1z5l)T4cy5fH|k}~YxNwDP1RT+U?w4)#f4$ewnYWL5r!pSENg>YG306WhTbS- zj$H8;+iK&ffoY-*X)3@*dp$*ta*%S(kP)=J8S=+vFJ}n+z@-lU|Df=HlY{@aviPr> z=hRx0Lz9`!0tte=*S?knZsUK8J{Lhle&^Z@xi96TO@YIZ;~Pms0~kC+&aj6LG%a+g zq7cHCGDqnfETs_#GSgkS)!ehR|iW9?X4pd_d~e z{S@OaM2HikjgsRJL+am@xjsKaMiVa=CoK-`hP3-I8TAV>P92ZstiT^j=fR*fN8^&R zHCJ_GKJEmQ4qK?>hgZ2tYlasgnHHTYT20y#ZzRKH@xjk&*kal`L*j4BV5WCsy0Au{ zOs#=baa|cqM{mK(>@oYI4ua|I5|@wKGYsxp-C=Me7do}x%;9Rbr(p?Yy$!vm;oqDF zdl?W>6j86kIH5NJ?RzkOr{W1MXy?;ci|={!bAbP#7x48?t%C}9d!tam|7R72x%4)=K8MTII0ISF5 zA0VGo<#c;(w%Y^QTANf};??*GEc}8~^~Y5t;q+*4W4FeM5qZKDfjpG*A*kE|i;$q_ z2HBKHiAY=}#%Hi_58F6}nai0Ed~78>i@nlO4awm>ctMO|hSFHAJk1tovB3(=Tnx#t zl!j_}ALkQf4r30Bd9R%@Xo+nEN_TpxPndgNir>hVea}aJTfy5`Eg9dMeeoS1Gv|2ak`0ieVhW%f zD&^i+U`ccrWGn}J@h6Z|DtSrJ9y+(clG*kvk6c{KD#j#OOk?FhvD_ypR)+oH4VhAg znaY!{Vg~10D{Qx1Lw2Y3YU!-?tDBtZrT*92=2_TA9!YxhM)#9|T#QDAYAsEoGxFQqq7|jDTFW%c&`gqqX4W z$6h)14ajjHLmDgT#xr*oTdVb8RfMrNevOs>|E^80Z!)cfyJ;_=~ zr@M@?(FfsuK$5j`U#eDq>x#&ie0DcNLe<3i7UdECp6pEjkUAf{%)vfg*W~X~X%`pL ziAdMvT`AUPGN_l0e6>OO-Ui8Sm7mjz?9Z+;$g#x|-#dxo{^w|8w6L4YPdU{+l|nXu(6E?kdSdvrkx&$wi90C4QZ`b^Ha-a64mP8 zy`q)9rriE!Ny}GSn@NSs#ISLf-JImjrI1YU-(QsmAGg}WfZVO`g#5)-#$>w8Hx7B$ zMQ4p!Fh30|UCmV7Lx*vFko+j2ykcO;ds-Pn;J)JlMK+aZRkVO$w=AudJ5sxNZ>;1; zq`@cdH7b8_5i`ebk(`Jjs|x6mtq+o0JLtl}NEGD}X~NRZ796(QsFmNjKDOJSSax$8 zeUd&w8F`&4H!`oxyUL~Ez#Lfeqf`OppRP)Vi-&hXMn>qg=7r=2ghcS9D5#nCM#PKz6Ia?e)3V%&vZSZgy9{(y8@88nU0I zPc?FHYcGNHSwd#Wv76}#wh}WXhspHmsT)Xx!l`Sf?~Af!bwWF}oBvKGVA2{*-`T)~ zu}`Aj7;Fzn)urClLS_i9<=V+Ma>MH#;2u;%c+eTbQ`sTx%hq~94WXA{vbD9BJoGmX z!Ip;zMKdMKBA7hC+PYm53)Le^hT|;^7Nq$TFfnP44N=!M4n)6G5N&rLdNT`=>xWLQ zw+(w!qoPAe`D3Xkmy3C8fvjt#<7Rq)J7`09J%X4I53lD6R+Vy-58)vML11~R!W;^s za}b<5K?W7eGT(JD9;IE5#TNg0g}(FL`FT|sU53Kwgz@2(2sY1C<#g1ZSOKpz^P-ao zRY0BU;6t}7OC69X!18`Dy;WNGD$&Ht*bPQwC@r{Zo5G~sHovbrDniHH7JI9d_0V?m zbOxzcUeQcXO7K3Q(QUN0>r z@L95|KHiOo#n;aD zf<6IheDI*h%-iarg#){g!#1RimO?WFN!P6oB%AU`MF&=7sOaW?4i&j}IJIv6Iwa5b zhU8vCV#vTsMMXi70~K+xKTj2dQZh?o@7UgeVmiqDiBSb+djD!9n4S!nBY)ul(51k9 z$pQ2BESRgawI0Z`*)5L{3SsxIc$vg*6VS5+lLW*Aap>nDyD}jU_YcUUaUT_iK~S3! zdj8r2OSJLbH*Ug>S>ExS;vHnHufZfIQF?sIX+%gHE_d`ltVB;!UX52nZtK6^W@;fW zBAcm_smbr+ZIHYB?_|^iF_hLxrMVj9w{fa*jjbf+c3uha%Gv0IaRxU@KSHlv`qbr0 zgFvMk$*`REidR_suKv7DDrm@__}Yx0K-V1(0v}Wee9%GQQ&|MM?sRIsl1CHzosgfd zAU9Kr!8iI*V`&WMaapT`+_<7z{@gF3E(2_Dym)sj zGh=x{Cxw|XWcgYJh@q(dOZB{QMUT>-28k*UhRSRGve{_wb%y?GUcUTtMY+7xZ?49~ zF}$!n`}SzB1;Btj`Jjc)8R?~XJvF0-XqzSB8&|ae)D>vM74KN>R`tu0^g|K;BO-~PYt-?hhS`NyjN*PQ-u&GsM8*4m-^ z@3oyh*|L_)*51w@vim=YD~tLr<4#zs7@0&(BnvMjOFUc61zlRKUI~>Rb|CqMg5a4HE!iT3yRrHBJTZ;65ght$YuD;l_m0fqlV;7lDegLw4}29oW>!_ ziY=^hC);T!wJL3|Y*o5_`FlsXY?Tr8*P)I`{@Sr+j^d1+(7vZWzklTxbxMj;1cpa; zt5xM}BH_mzj6JL{cE5wMr?VK_m#y`lx+N#6Ob!ZTYg+Eh&fS;97{zlk)=p>_5e7pN zwHam>e!}VRebwJOr@!uA{bg(YJ3T|(4OD-JntQF4&STQsCj&o1Xh8_))xlER5|y}G ziw!`_mJ9#~o^k;AQ~_|LIkQ+-ALA_6s$V;`e$fAG+tEACy|$wt+W=gzkRE~x|^w6*2##1@2PTtt`@TQC=1j6sN54tOgPLpVJ66|a(F)MNE0r7z0L67VjoPHmH0R`!U|C@W)P zG(sDH6d^oJdUNkqx7PkLFS9Ma)=~}mMIJYUS?j*BExy#!2DvNm>0WOv*k)~crbTUu zROyghD86Y|+eeFCd1}vtywKufA+3oY*3% zo;6_R2)~RBNWD)vi5R8)$oLSJw%L6|+yPK4$k^fwt1~pP??q>Jujo&P{h>nxo3b=8 z@^?!V7B;d$E_W?unhllt`v zorWx%of&73U+{;qQJY226Du9aC#_pD$Cj$soX*z_;1qxCbbd{?^R8^IANJ~8$p(LlliQ|c zgP*Z;L$I0W3;T?0LQ+0vH>7`JP^r+h(u`*T&%h5V{jOS=+GxdwxEUC-vPYc-)7prt zHyl7WDnQ?I0KKUfpxIitC_sa@=a~E{UaeBK&|mOp{gsS2iJQxQ8+v;myPwd*Xi&?J z)Dofxj+((as3V}*lNN`Sjr}e+!IkG#8+30;7_z;8O@^%Y{lx+KrwZg39FXtKf;{qo zQ>$x0zWhC2E;shiN@dx%ciRIphB*^&$b)KFY4Cqd@M$%mE>DZtB0A6F?m!hoKTS}O ztfvdkDFNA_gzq5a$^K=KhvEfPwD1>^BZDjN<;61kAi1f1wyw#q)wR>JC|1mYSIMH3 zOfC5EooSS8DYKJ{gs_eqia}+GR>%{owCqxoI~5nou>p9cL0KA#UL)%~VLf@@1bS`_ zf?U29?qR2U*sYkZm~$G@&o;4bE}bB+;~gqr^mmRc`~I0hupCin{In^<7q1%N z@WqiIIkkEQzR%jay~TF$8HBFfZf zOR6@#hDLRxo~%te%5ip;+|;yJd6mk60cDU|n$qj&*8^(iAjm`jzm9KFZrbgI{4)w( z)WJ(fW>WQiT(i2!6Y)Y+jIlijAM8Ju->D*-_8;mW&_$k(r(Fvl=>HBE@sKigQK*Hp z5mI*s8EVmemzQOy@q2R?zlOXppeEx%Q}yo*)*!DP+nad9&Kr5*SZ)YEb+G=YEY|mB zYrT7Huf1?>Q?I@73nG+4E`0(m7}Sayl5#e_1OLeYA^%WaUFmf7S+=XHPn}wq541&0 z`XVvef&BflUJK*KW7Wct?&b|#H0zJ4luw%rDDu-4My@`F3n~mR&MIUW#OMk#I{$nc z&qgsJil6dk2uXgiiM(la7uQ6x8}fE@p*_d998)Q8H5bgG9CGt9UGy)tHyG_cB~^T+ z{I5+z^e*aWLo$fcE4@9u;5~5UoI&o$7BuT~Y=l^|Hp)2 zj(SeM%jfCp=%kHOMeTG6@YA@&ub*+Pk^53=zzY2RE(QM;1k5;H+yNfWEJH4Ja&3ga zbWqzlkaPXPWtkOr-LcLJ+n25NJg@K42SILcQ$Yit<-9{wzwWA(9VvyC4!&Kts+z8q z5*4+cC(x zCI=KsHaRHyFpH9rnp5kaUkByO<%%Y4P}U4oH2Hr8%1GVm}{hB%4E_X&wqw|9%oiB>Fi(0M@7?D^zTw;l=w7aXgWE)AuAm_ zTNn;VM-)h(F3%9mRRgmGldZL0UBG3Zf)z-Awn4H*)$IhyI7ul5rXe&7wAmP8)U{6> ztNf8o1;!MDA+1gXdzaxraSd;5lfOAo+?a*J)z7K5RYBopvTGAe4CRLzgJ|y{Xk5g! zT9UJy6qh8Tv}v-c2OeCiR;80W&vlH`+%MT2EjOZ(rT9|_+5!3gF@&hvOwROcL8I_dO~+#-4J@Pa*eBP7`a zi+1SCm#@_|`C?#Mk=kTUg+Jam*-1yjP13UK3h<^_6Vfl>msIR@&?BP=oyK&36E?C3 zIgeEOBsyXE;lbX_dBAn7Gt7Ss;v#zsvT->Li!^u2M*}%xTPiskTT6w;=|q~W9;67J zr)v9zy%Ddbm2p&%zskcVT|&A2QE;S>-X3(q*uvF`jp!6NRn(KyKGoXoZZ+%OG4`zl z1VcU;=m-a^2Rm^7Q_;ZX4h?*srGW$4TJI0am#xdoLtbB|@OIIhebvzlb{QhY$p_L~)L}l8B?5P;@pV#h@R9w4>E$ z+zkDj$c=owjn-nQ3!VA3_1xF+Fqe$7dF@ia4Vmru`h|x(!+CHpx3>o!3_sNi!`WK@ z>@{emzWB0nElJ#_f;EHH(f*Xpkc+70q+NZMtW#7VhX$;XbxqmLw|f8=N{d?Qroo#G zf(T1@huW#Hk~PxZk*&N=)J`2f1h0H?*;+X`AOPvd{QET7-=YNOb@C7U<1MmA{?Y5> z8-zV6MbU2eA-h8uHxpy!pCgXR2;r^tB72IZN}VLDqI7Ps(Feg9Dj(osnalTK5k58X-T>8_1`#KvIZK6Ef5Kq$M@ETVXvb z6h3Ru)k@{>F}|B@*TVHOG9n?LC<8d%9Xvd2d%8*Yci}?is85R)I^jVDR!DwCmimmp zfmw}SCu4Y!Y5uN-g$ABkNiS4Zdf@56bTy}5(QCjU6OWQ%XTdAl8gvf8 zNp48nYTussWNvztk(41QsViV`yf{3XlYMI0*;#1gi2On{Z^nYPuwqglqjMDdAQ z2mZ4OoyO~#?0JtY+mf-o8PYkVCWC~LWeyUqJdPCmk7XH(y}$LY`e6=^NWv#g zwYbE-S#nsw{(agdnEzd6(Dw59`G>~zY4eW3l}s7c$z7V{-swm1I>@TF^l)vPH+6P2 za?fAK@Uz8g_CjaEUs{1qZCLj_wW=#7s*HmnbvI|lBp$tLj*tJrb!rW~R=KheyTsT|nlQeFqekN|#Dfb+1yN4PI*qI%yc*SvwaIS}i+YrKQeBxu={Hq78kf7p&xxB`VKjc_}Q= zZ<$MN57m_lMbbt>W2F30sqe`kYhv+0iVrR%dJ7n9sFFx1J-UWkX(U zP-l1B-{MZ<$e4_yD)X@ASXPzZb1s)v3xYgGa~HH=5X=uykD;<+ix#jQ$VN_eK-!j1 z%KxJS(l3t7Qhv79P6bjg+TPco4lwrqyO$u@_Fe+a4Mi(CNOAl0mp~Iy5EZCHh>S~S z(e~sg>yu-4a{u`|<_PVOZYoVodidPwM@aO!bb>Q(sKuX@jX(wlWVw%ff$cM6e6G&; zq@mn*=p#e_G&K!|Je=AB<1IKzp;k|G#(TRO@2{Ql{wh1(1KC=g1zCxXBJMVrm*FFF zp9**>?d59BlI444U@`O6UM&)kR-fb+Q?9+*cGIvx1qk(a26qiQV~BLYWXzo< z^#zo1wW0P5S5-SB{$;PRd_cck>SjNncEHWJs3lZ@B=#amx|xEr>9f6+Yg9?kDlC^u zTlGtnSlU)i&B{jc1*F_PYME0^qp)bm9ZR=xA=^v*#eB+YH-K!1tA|o5 z4=|*Ju&t)nqV!cTW|EfZLriCv1Xo;opX6SdvC1XONmLd>(h&u3u;P$2Ag|bnq|hCaLeIsKG^Zld`RD zR27E8cQ(dyowb##mg#KtO7L7q>K9g~w;ir^@52Yi12RE*+o z>aK(rg_L&e>L@2=xOtCNZAC@7xGN`dwNaimWTvBesG9BI@C}8-%?=LV>xIK?tLkz%hZIBI_MT?aV-a5yL8MYV-Z?_5NIDZ3ZSy# zgdq8iu;^zUYzbe2nXr&Tr~*GwtAQfqLtI&fN>e$kn{HPfvuV*I3C@Ivood4lQp*se zKO(6qM9Bafmcn5)?sBEAu4QAU=%sajo=x3w}|mzxv33*ap+pzHFJ z1T&XvkT!s!eEE2t(Bz$}(jtv(2be5#Fr$!hBpKFlPf+LX^xdp5jkA2Y%@mkCoWC)LU7hy(m# zq7ienkwKZbGJX~|#)k?2-&|!dPk=F8 zhs>I->r&4A!xcz?9={fK^)G7ySgdc zY8StG+QqEDIgszCc=M>S36^oAjTZURRi@^KIOKnKqMj;PahJ`L%W7p{t1K^p9Lq=p z#yIjUZ~PVKa_zq8ZgiHJuFK|RK_({J)!<;^QDUJ27SD=awSb30k_8Zok)y5C%n*7X7LFy>toaeu|cIvvku1>q!;-e>M>CnZlMhEV{6Yey`_3*00 z(-M7xx>XDq7q?LE-=T zp6A{>1BUkfy>I`0U&-8OU(R!$^PH8g$^sv(9KB*^=Lyv zQdSp6l54|c_at8Zpd2$ic5^?5(7ae_uOO0uzOnkkX_`~yy zMI+nZ3M@UyLLA}$*S)w_%^U`>CS8mt8+9gdUa3=h+@yMZWPY(c`RpG551YT+o%q8{ z4`8WrHonxl41-pP-=e=Ja*e}i9r?I`XM&v#uv(r78i&!B8nE{(9pW~Q9?*QWIg$I{ zT8g{X$gmX4>Ea-6dT^mEDA^}~*|})5ev2 zF-XRKa^G2}2h0;{FRWob2G?*hs1-~z0H*Nv7Yfo70zb4$ZQZ8=v#+SFdu)EOk{|q^ z&+SL<$my=+9e`30vGh({;N@0i-q=w#1AR^D88rF~f5xjZ-Pi&ck zYV`iQE@8S>4w(4_NPm4jn}eZ-0Zle8fYKjmCFnHGV5@AypU-E#a2H#r@l?>ly^EOs zl*pw=wJA)Q_u(!ZxMvBhWcJpusMv~5&WTWjdxxXE53fU5jp9Z%>B&Sf(<54h{+L+A z-*S{*)z;G;34oUcI^W{wWt=d%(>7z^CG=Q)4`ztb{;02qRvSmxLvHpETR3YM!Cl&7 z)~%f!1$KLb78(YvZwK8*yY(r?VRVGtU|)6=^9q2=|M_fwtCyn3yqz4yQ_&Cd-(r0P zElQ2`Ypg8PX!OxEe-B4#U1BZ0qt%};bm9!gxWNbT^E3{dgXnjOJl@LDby9{h>S;c# z+Ub_WTKb0;VOpJlqfb%oHEAnC3ap^yD_qY}^P(EPaMuOUH>Gu0OCD=#I(9chQCmNDFGs1im60SvdwXNip%Etv20sJ5Q{d>2P4b3LA&Ai-C_xRw|^z71f!{e$A= zbvzF3oW>U8xsTh%!o$xpsV$E(>)HG(<~MX7Tl(=oL2cMF^QXeg)w42EeIRA+rnc$} zs31bOCu95aMdfJezmR{|RdBKAq_e0pCJ8`?bl z%A~Vlu*OUqt4Uvb9@}*RC}6mN{KkcLrc3qpYNcc&_o|JQJ-R`rKp)2;AP|1e|M~p= z8lx5plJ$b`XrRpt_S@uL3Amx4J%aq7P{{w!^NW>!`2Trw-?_-2ZcZ*!C+CfyP3bea2-FH= z$d)-Q4TMzs{aE<~f5HA4U^}r%pCpQD6&!RrcflzFd$MWxc}|T!VAlmqe|7hd?$FjV z&D#W<5KH$_;~uQex(mgVLKtmo+{*7=eD$33T<`@-J2>@mMXMN3ccj_y8o3av~P>P{8i5cRH3p|p^v4|UZ>Dc zn!5y@sX}i_p(_*iI(?lg)SW8yniTq#Q|OCSARJYtDQnyQ-#V>g`SW?T~495 zQ-wNHh1N@5zJ157Mm3y6r*NbB8)#e3W(c*a@9@53|^qH7wlgXzq2wJigjZK0DeaJ@+3hpnml zTTq_^OyOL%z-FeCH*+Y=G!{+x8Gfg{Wpr|c##PJhMWafcVRYZ?4&x0YC;R#BZ1IrtY}(|?w*tLA9Ne4WOKDXP&LxI zU$TnrGrhNpYeRaEacz1XB(BZ>AU;d1xw)yir;sQu2Mzqv(%M|t)Ht_?U?_7M8|s?s zdx|`R@FEAVFnmtyv_KEp4UMg_=EmBY=(3@4ddtk7gR8j3YNs~*hgM|Zx@PK!9??@A zmY5xFL{rOxa1^=|cto>T1c{W2)NaTkt0*lry}5SwMGX?CKBK;2x(a`kfytv5J3k2X zMM`E`n`Ue6)R`(UNyf}rYpZH9BNbphtD&{27PYcHS$h5tlO!gFp_4ap?Ira*|zzGLD0*^XZ2+2c0$9ZDbASStGmWdDc8esmjKs^zfXnQeY5{W`>GM<tI3TV;?wrKEV@&5*V#;KI6HX@LIN|wl{|r7o*OiD`oiNgGUye(!Z?JM zb|AztoQM5Jt0`dg*mD+*re3!7>S&AssP@pT&4^^Pnt-0gb%X(A|1f2+Y@+Sc$Jf@L}5C;ZzNio}aeYD3uMz8rer>AEY! z?fPDH9pHedRg7f6yyd^FVCpC*ion!P)CI)ojtf{m#F?8P3d(GmVTLzLKbvO+*k8k+ zgY3`SNp0owxf-9x?SwvOREQSb)mjA^ZQR6*^=2}5gM!fe5$~qnt@31#?be$X)K%0#=7#dJ@y9NHmwGYUVcPgyq- zMbrSzkvyCWAlkHqClz3S6+eOD_1hWX(-7sB{SuLJadHzQK*9H(Egay*MsLdaagzSm{Ikoio_a zj~E%WSc}-l*e}QUQ@xZ2GN>@pK0&b2Lm;q42nBs<>I}~-$Nt0-J01T~!aatb-tNGz zhEH^(7t^!x$q>8UuiwWF+<5UsZZLZ3XVBwtg?I>@^1?$hjFe6rE1dr&Y{ekXHhMGd z^Sr|r8tF{FYxJgt8p=z;Pl+J6@>R4TNVJ~dby9;2I3bj=b=p{yI#yAydTI{RA@$Vp zEL!A7kqufh)fe@ZJb`z@L(HCzJQ#XhPMbxUD#Uuh9*!ElOxh5C7RrYmK{$`5`}6@0 zzR5q-o#=I#C|9yRX{XGM^%LmM_#P;N2SF-hBuXOv=Pc|EWV5}Po}61O?}Lz$K@Vm% zBI%jAK^$^8K-h&2nRe=r0pUS}F&AKc82UL8>cr;Vc(2oo@g`nO8}!HM#dtMs(7Wix z_#)b%@4z=B17|xK!%-)FB_1gY-c@s39B+rJ#rry3Q^nbGfNSd!?$oZAhmPMkg!O#d z-LVHyLYLEeBZE!))U(jg>BeL+fZ^u2c)X^MbV!^(_C&a^aR}2=#~0+)6oI0vc{CUB zP!0)-rIm4ous+it8%)>15hZ=9Z{~V#;3`^&Z#?86gEs+9#2OOw+nK3l%|Y) zco3Ro6R{fLITzuB>~~(*(RS|!9g`z8bgO7`Sv;hWCFakcw1vjuv^9}y7&NcR_Ar8r zsDRJsG*9$p$G9yG2Cd_V@*{?xjrYMCwy5p3-5Ed2;uQzFzm9Zy__p)b~%%Qx*!vt#-S;qHh4-p%XvI?_HzgH zyeEe(F6_^iZu>^+N@c$Bv&?QMQzwK;f#e?yRZJRQ4Z$e>J6~{PxGemSF=aze8FD_4 z5nnvEVq;f-)v<&F#T}_1uigzH6puZ4URQda{Q~*RQ1#TfG_%L2#(;x7HELT968*6i z@eF&Q%3InS>v~9Ta7q52^O5}j9450lHf?6CuBQRI-PQj4r$h6c#@2>evEj37XZQ42 zYUnB21|JbY$TUF}S1rMa%>;F#{{XE)94DL7?IdrMtyk2#o354{{L zo@mR=hPqf!6R(>!yN70G)wW(Vd}>2$Pc`fpPY<;Y{(7`?4)#o(daxLvE-bbFyXT{N z>-8`oxBi^QmfC5ti(<9)v7TPBh+L>1l~a0pR8DJ{X+P$)+7=0Ms3Cl!8^d#UvmN*{ z735QsQ-imjUe`2hR;;mgR_$zjYR&Uz&1sEEAV*65s;- z$k?+aFIpd)I%m3+un$#qT5U^fiSK7gBTxESQcJ5mq_Y|%x@UHCOd_PBSlWxdmlIl4 zt8Y?Iad(A#UoxkuRmvZNImuhTj|8-w)2L!^_L)}i{zgPlca8CZLNlb&p*=?dJQb#9`BZ9t9K)9uNie(AI`oGP=X(H#No@8mGxL51-c5JWB=Dw0}mMr`45| zl#If}50|D})aVa&`o~C-yZ?aFQ{?xwme$(z$f1X}q#}npztvn&+)Z&>cM=+8e-EA4 z+|U}ED<#t-hdOau`%IIiI|A#CLVX%z0%(UJAr(=y560wnAzy0p_Rmz-{8)2Sw61A( zduoV%a2C<{k@NAZwy}NMoJIkHBkN|#D06_9P$E}KG&R@9nqv}}`bZm1AoHl{DNfGO z3PB*bx5KzOX6l@2(-eoMZyE#WDCZm;mDX0jRQ>)bZjPCbRM7UZ4by7tWMNDU9ZAO_ z_~}ynp-=P#=mv+L$WNs|De0zqT9>8L|K`cb?kf~A@&J95r;v*B=(Qvh5)VCq1H>U#Y-mHEu&t_-A7ld+0Ud|!=N3BVuR=!&BsMt z8DNW(pwHvwZ1LIdaDL?uXQxx|9};A7wbT=W%c`WFN}{==pi2K~JQGgA6vS24|01Std!A-%V~%h$LQ`Vti}Z)^yx zh0C2;cclt_o8D`8D*ZcDhB~EF$8)XQ@XiDC%2Ii|4$SLJ<$Zr(UUw?*hXeCG%iaEV zADCB`%G;AZ{+d+!kLl^1sdPxJ_M2CCDsS(B{diWmW7wD8UVbXQ(@5L>vQ+w|MoxAM zpfG*U@VEf4DYX%)3X9Vl>Q1FENl)LJO20Ba-E*Bg(5nsbL2Yo%Po*!F@(wOYr7x3# z3YXB&7qi7p&W?Ab3jNy1F${X9qeLB0FvBc9nqBU4cdF`mO2d zp6lId+-6VFJsV}IymbfWb*A!eKQOO5mG}Dt^E@lv{{C=aURf${y`ASScV{Z^4&-5L z!*I#Ter|X6WNWI>-6)j4U-_%tj_CNKfCIO208Z-E))M|4r%X z`Kk2P>FH&u^fl?}HL3KQ)6+Xs>9?e(ccs#Qlb+t4O7BWf-FN2Y z^jkR%bCspiZ`(Qh6KDr^8|COr_sr*MW?}oZtY))>MIeIfuTBLj{noN z!|Fx@>8GJAmG^aK8ZNI%rGJCLI)mvjOkh+k}ztZMc~A{2!p^ z;Wy5rwjf6hW-_;Ml=~WIG0n?0m}tGyk*eOycQJe|-mV$wQ8A>y)JqMf=aZ?^xMBlr{!7(_ov$t&W;lhQxvXxNQWw45hEg{iFd+Sal# zT!J7ruy`Q5G+sW&GFzMsq&%pa7(-xEcglB%4yAg zt4~qQEsYmbOSvP`>H34aT(@aBlCXI6vsvIk>Q<*f0rgh~WpL?gl3veIiZ6oXNH3*t zJdh;J;HXJgC)YCd-66{qeSzr%&knAny@^$9(lr|FU7+D@(p4}BqJ~vW?|9&#Yz9Z) zq_xSfnAT`3Rc(4cv5XGu5?_s#Qmuw*+9Ia@5vKZTrvCNpr@C!)*izth^oh3hL9`{Y zhb!r_J(e3oR#8*taJa+3QEyhrvm)>E?Np~l|VmGs)m=24uNw0X8s?nHq zM{*U@6H@+3O!X0r_Cu#VdS1Ja>ACnak*M9R!IRDmj?#mPWlVq2;Ra;}N4bWVo-&os z7a{(Y`~mxA%%a8sHNe}Lj)*wTPzj(&mUY4^zK$#Z$|jwl06A*X*{hgdN)6{v7|zxD zO0J}D;~UweqWjdyVHOX=5oze$63mNMYWAYjjj3VNjk5GBpfIMrpi|QvlADOn;ST zQTQJo7Xb7VXm9FFbOLa8$a<{dC~dOWR-~cOt&H*vrf0RK^k5=L&uH~b4<@P^8bkE7 zwv--81nEhnJ|d|zn4Zv<(w`H{Xayo04uw~r864d})!Udh%5c_j)I5wfV;Qb?Mr_hI ziB(L$aSHGXrfamNv?H;M-b=*Tq&GYeiVB$Ajv>F`6g3ZHdfwf$n$+&l6Y*v6yK2%? z8bsJLIQlR>h}HgB>cY08XNbqPzQHg)R&Z9pCN0qh*qdw8axqt?y21&O?M@n?q7%p=}k{P9FOS(=nZYRYVq$LkPiB= zy=>{_bbIoEB~gn*OEpz7kACM=T!x{remp8h=o@=2X(@&-iv0AgGwO#?)Erskj(Vg! zYTBGWK&Bz}?5A;y4qW(prj7B9=?f1#f;GkwYyqc=h<}HhA z@9o|C6!}H_JoR+90}}f@5w`S`sq-N7pI!YQAz@gJo=1o7MqjE2{8GKz)z`sFF2eLi zqT05vfjr!#-)jTdPp<>qI{pK=mDRAGuPkx&fp%{`ribD|QFSZhsF$wNBlKOoTG>9( z)q0T)O7vA+0rWchl^&t5Py|}wG79>Y4jZfl(=V3N>C2dQ-~lA7Jdm!|vCL&y=5OPB zXqg_NujAEpwO&t4_TRq0;N-9=7r+-Dbztc)*nZX{Fz!=8K%4Apv{#H&OoRx+&9;IT zYFiXw{t30jHn5-A298gw{<>XVcG6zwUj`*)FR;aJOhtCzSLoQ-6X^%23OQ$;uF%?O zz4nRf=n8bC`{Zg-;ISwXlw&fG_BqggqMQ;N*w0KmB=np*Q}mnU9RWGtVhh&O`DT;e z^K`MLm(fNAXB9F58$1rgGfn%0y9-@DrmIDBDY`;oh%eZ`hITmX)(udWb?g75!U%nL zO&8=)R-^abbpel&5tOIR0n<*c<-+~psjNnT6}Ve1;E(YjEyjs_F20P4vAmVVc1 zCZ(4>_4K|vW1Hw@3``HwpVZuaO#9-p&L%AaW_>QciiV-N@pSe9&8flBNrHrEWAcvh ze_ZL!veIFi@bjh~jt6m?*D*bVnA0{1 z*dB&|A8HF#D=(lGeKg(e*8giFNDr#bSw`PWc90gk*)oauaGn!@Fu1jen$nDn>I0k_ z*2{1zF?;(yI;Td@Q}+@5?&pUz$O+gFl=0`#YQv6m$c8EmxT!jY#g2_oUG;^c;7P|7 zIksV8rd#!;^lm&zzXb@s8wd3>gK4e4l-`5sLPFi8dLG@b?}n)+jHl?$cr`rSDgd_k z|G@LM-@TrO%_DM1nYMcB5l!JG&AyAbV#!!PIkf_`7F3plWzbs%(?^LQbves?Emln* zP5-j5OS|d2^`-QsAl%b2^6T~8^jUlv)k_eVK!Tw5KS9+d|DYQ>7R7+j<*HvrX2hH((rRvDA)7t9VFMU{QK3}WyqJXFRuo+!tc8+Rk(7yBy?M}}-U^X@1 zs1~K3N_^2l>K3Cld z`c$^T^o?#a@-y=BUj#$d|M z;j!=nC9hOJpCcOWuFi#Lc&g-)QZm3J;U>Rh|8iwcxlH05uH-_F^WdZd$@wR%Rx0)fCp{5vEN7>xfP9q@X+-kReAgh*d9-ayT9HQphCLhs=4 z@DTy|Gu-R-79!_Z)bNG}NL!P_;Xq*je5$gt^xV%rescOo<8%!kg>w@Kc!yMxKEUhs%Habp@fH>qdXJqL z2oz$H-s5oW#@-wNvhfyr@z+~*tY9`5%(jlUr=F3Me!e_5a+ZnP$L`&u)Zxmb9`Wlnns}MfD>7c6e4Lxa>LlOSp-OvZgw^gZosEJkYNejB=pys~Qn^H7GOI>YaW32h2 zrlyN~YGm51p0w|0Lr)yqpZL+kknF)8Oz*p;skx_CT{^~T`9GNrW9I*X-m%p=r6svl z`}aim*oy$dB26E8e{Jsu(dkW7)ULC2w+&a-IHj_kQUkAdtcf{IGnFy&7Ic@HGDtRM z50IGU>OE&;fsxe9QDE(j#Y4&=PF5fMNGaDIlyo|DzjD3ol|fU7iGsKMvhX-u)5s0i4G1oQd*-llaq8zY3oC~qc&7tC) zZ1_+BUqq4jEqYK9R$EhrPC(DfNN5RLJdaCGreyiLGO?7qibMP~!&i^R(B0Gf6U-9N zVtBEQbBL0Q$~bh4UaFcct8_+1uZp+UO0JcfN=rpA--S2c#64WeH;5e9c9z>&<<{G( z?4HF?s*nq~mP34p<78l~Qx4|c*_CjHjtF>&d2?Q#W7V5~uHBeUF!qLG?voI97Y0~j z$@|6S*tzz&%HitBGLB&SD~t@e3dU_r_a-MBN6^cjB132TQ?h#S7+%5?cmu?xVIDb= z!|Wf(GdaZj*v~f&mEU3>cf$~d-{V2hM4>|;V{zp% z*cn(Yht6fXxLj-uDV{5KOoysf?fj)Xp(SD#EY3{lz#g+VOc~GM0s}5Nrxml`IGjfq zIkd$y02a2x*n-Y7pP}s4#>d#djsxsJVF}`vP@-f!zPKhZs%mUapf=2*8ElO;a+r>< zFmwt98FMmk!>*l>@=IG&JxM(cbn4P_#84Zi!V?XHKKCFB0QHMdLmpO=u1!uJ28g~| ztH)A)mngy4r`is1jplE}!00!LawLAB-N(xHv96Dz-z4_H7sjVr1oc+R8*bz-js_?h zb66w!7q|nt9SY3spTo^yxvn{l^^$!lFF;#U1^*-?CNTJuU_2o*I!;+3Wk3KAF4`r=14q=nt*BfO)R>UV$RvRoQ??_CBDgc(?H7zo3JZ*%H z^fMjR92~!_tdOs@huFX>PqO~P7JH$ab3ZL*KRw&=72Qvz^lZnraj1W7fa$r8JTP)N z#I%tRnU1t6?5D>&@%ISzH zOjF7+wjre)1%%BkW{dho*a6N%+mNdJu)J{rOeipfIOT{NR=R-3+mm~U;h^hvkHGOQ z5RsYR^6;U?;j}oBOYe9h#xe9`B9|>Am#NQEL#JhWQ6Wc-!&x6lFD3Q>xY5(ST7+Sy zZieaH80J;ClOXKW8gXtC)igf{;ot1wDI7YQP5551{m^txcNg+OW$+yakZexm8b{HU z$z1l!rrM_L_rOt_*mLS9U^_Q*K_`bOk;}KS8)%~QBDcxE=+LzvQ_2NQp<;&RwJ8S= z#_E2v>?dTHxi}= zc>!S78sZ}S4V=fe10h=QN;8K{%2=t6?!`e4(fpL!*TwGeuZ0mXE{_EJtIlTXQv_FR zBLE%AjoiZ2h?6;n3wSuL=EGr0f}kfB?Bc^^9HMyjc*b<8O*|oH`e6DzScRFQWYZiv zqzL}7^PSzzpXqkKUW~~pV+xB4dt4}Rr2G{7H*f*;rs%9<5~RD6#qY3(aAJ(w{QR;(1p>YiJTpmYRNWdoeS^vdO;1P%xDHAa%G32w+wUe5sqqiobopC&{r_C~Fg3+R(XkOKn+q;Al#6JbEjdDM|7jlvH{ zg;ezO5U!+4@@&>79{s6NJOnRQffK!4U=H(M=Dl-xFpDbuGKdK01J@mUCOd${?i z;T1}v4**mlQ=f>W*1bYT5w1tm;xOk?yqu{QvZ&>iR;F2bVGhyZ72z@_E`_s_+c`w- z#bGjw0!*ziH=0Q6Wr7pwRn15DB=QjS1?nz-rY$nXi87%Hq6`?~lX$ebf%9+&6z~SF z0Yp3UaM3SjIy|zL<^&nQP{1{8@m)L)_n3r<(EIMAI(NtO+uZ(FWaMP8 z=9760`w?kzEM-O*f-2m>*6Cb|p6AL8!DkP#+JVI=7UJ&!ng#pll2ps>Zp#lz%cXn@ z`}rQqC}N8iG}-OPyj(CyH4gZMP8>lvc>8R9~Thhnig#MSuBU*Hz|Ock?u zJQw6exG#?FB(|udoU8ErRDHDC!tPX^o#}OWJ&H}lKX`JWZd*Bv-(@Nn~Yb|7kn&eUmu_M_K2 zKoQadRDqTH<9v8RUUND;$ZW|d1*mN92qNbJ=rALcRgh`GQl@F;3{5>cr<|$4hZ22( z_9k+aZwK1E#W3j71wk&LembX2 zF&Q1b@2Lo~N$ZluOjCl4SQc=X1Dlno!gPZ<#2+vXiUjFL_*8kv(@2krD`$F6TS)iY zgF(~NVyCc0Hz)Jd3cP`~>CWV{v9qv05%E4h=;SJ?X|MK`~d>&i0MH;#XI-q9+B^`_Z z2J|cKIqdK>QY6S0y(C39Cb!`%2Bxq@hgSrdTApQEhKuPCA5(KV(VfkDWC~V9GrNbDs*3>9E<)pZ6V#4wlWvR=yyp#PynNCo6Piv$448{B1i=J zdP2?jQEj38bmsfZ7##zEJcA3M`3O+`alQ}{=T&2yhnCX$dGfrvBLnLeV!d*g0{7iL zm%Gz0H-STX(Qfviz|mUL8?iP`Or2VUu1N-0aENw7t?|m_GI~QqxL^tM5n~6G2*} zH8MSztcD9_nkJxh#r$&NUz{Fb`aT2d*K2ShEf(27btRW^0e$3&1etD5#_%|Zsy3fa zZ}ZV)HB%WjldjStI6Xfk%4u$Jh0v>^bBt`J?F*XV>4j;v0U_lKr2TV2iJ{XCM(ODR zD3KS?ue2iCo(R%)TG9BRFe0i(V=!+eHr2pK^i%Wm_%^yX!wtvWwb;dU!(kuhmuPDf z*v}sv;|Oa#OH`Tc77?O{*nGovo0!UivNwX`@6&S?63xHTtyT$k(+8dkwje#dC0Wh| zNco3n3cgn-RhXr?W7gA|R#WI1({i%5I$3=sfR&#sbz4;JxytTtwd!uzLi9#wmm5UG ze2m!HU_Kcdogqo6kiIQ1m0x!N8~B~L)zVwpNs%6_qjy35?*z|kUH&*37vN+?ZG5`N*87IMMctt=!t7laX0)6dwa30wto z2MpeK*rL{A+`8w}tnzeER^1_|52o+59C^}O!cN8ejV@2L({62wusFfyv_Q?8M=@pY z;|a3=6WBj+Fw>85A)^-QKEc*tIw9zy;z|E<2sR@T!_MjhxPS++<(N`-hwTCMro&{( z!S!Wx3tN;7K4utH2zJOX?=TD+Qg8GInKFhg9>;xgV;2nI5S-Ut7{u4W0c=h%dQ**H zqE@!Hm!UO%$li5p=I|x#A56(&JVO1f58BCAYz$+|D!KAB{X!dGkGF?I^jA+#wm-oB zOL>SeKYWlC02;&GEPxhZe-)FqFu_(KSDh_+YFo@>xst1xrss0uInbJ#TS&PJLBmqc zdg|DidQX-`-2VOvcNmE9T0mwg!>t0%U1T>Z##~@^S2DHVfm50wIGy0@ICK>#T6yVG zVi69l`0j#X6P_Q#IP7IFQ+5~jU;#)Q0N_L~R{}D?)xntYUnLh+abNml(i!zFh4hkV zA=4enJbKQvl;$tG%pOzV1h&YiXG#|HSYGU0Kl!J+vstX?WcT$lynFb$iq8p{G&k4g zoB@jbOd0D7PlTIzKYNG4`!RTGBfWeEpG57;@Nni!gzp0=J{QBqjf^V{v?3Rw?*_JL zW*$?HFSREe;E_DsDUTNzP-GET%B^0Q#2l|rq|I>~bU%Nc$fNhPr8I95%~^CsYJ>7m zcc-)w>@kFW2E!Q~RJ{mJY&qP@p^@T{b|_n5mADBIS%jDtQ=odY=ET_5_>~w)jl8 zcmq>=9*W<>1$;G5;t2Ry)CcbZO3Y(Aylp7cjAA<4M;8?{9qk*^w1K3A>Dk!sbAYuyVF=duA)#Tw>G!SzEu+7h7KlTSIYu6|9xDqq_ z+_RAVNcnZLT%~-05Fcbtp?SqPR#cNmbBdXKKAu3mN~yh=sRR2%1kasw**cZ$#QAMh zSmKYERI!a|cs=&@Ar8%?M`0587ck%uIEPl@Wp)g*sb6VYMSg@ExHJzpIv&Be67Vd* zGUD%cnMM?$eJqAo$`G~2_Y!ulr!y@m276{K`=zXex_<+{W$bLc2b=PkvVB82N|&rs$(V&+N;CIB{D;?s zUb-v2TWoX2QpVqf*x*8@cnOnke^|6&85vzbDJVjWnC5vmVd+h}sELl2IFDEws*B;) z_3Ht(AZ1nVg1oJWfEu2V+L@rtF2oWN2T_ON_TmhV@^&5sHK0U@R_8yQM?++9J&ag1SA8C(9%dSTHIV%bUPY$J&>~OB@wP&je#GnvzF@yX4=Mu*@ysN4cPc z!4I2o(*(iK}3Lvy;1hgV5405)v;qaS>h=<1#UNw#vc}uE+!I zMQK5380BI7()V9L2_-tHOCeZ?qIeMLVB>5trM{fP=f%&>Dc=qKWtdWbgU0R zF=SU=H61A-?u`msP<^iXwtUYFV*4mwjdOjhcmjaxgJt$JdeH|95a4%%QBRiyhhGpL z!=(8N?Yy@o?^dIpGV5txaQFo^MlVLH=pfJ^W%F-g%dEPPLl`uq7gw`o&MP|}LL8hZ zn7*IQ!^Fx)OaQFa!uoGCXjzz8RqP+r^hG0w^Dj8A zgw%fvj|{_2^IOi~uA__y%?}P^N-PWTFN9E?$ktXVwRJ(YVNjP*4;E`H3Z2)a$Ly_{ zWp7O%I#RgZel8621nwV(+xStcP+6l}sDF;~N^8<(2o#0udQZHaD~&!pyr02*l+lN2 zoxa{+dMA#Eu5@S{oaUAw{c2t4-tTZ5UZoG9o$hq!md`Ab^KUoMakP=_TCv#u=mEK4n#bdNa_pwP|$3b5JAp?>+ zu^M5fe`ytXL%~H#0eI~n8Y-Imyb>8c_4oBNnCgP+Yn|REbAV-e`W*Uhp(}N~tIlWt zXr^89$xN5)K6*1=ZZMf`MjyISkBnbSd*VTwT206Km|oX#zx*Mwh-rhi9>bxRFb=v4 z#_2C5FsU_6uWAF>q&pMO$~h`vx>GA++L9>dl}z)C=_$=e)0(KCk6r{1v%Q#-L8zg8 zcqXKEVipx*nsx_U2BOuK7=6ea!46F>Hu}&`%|{pI_5%^ePjcwN*3+3bCrVJSh@MFx zqNBwUX#Yd5phk2TQQa}Uh|$V6eaL=USh_fmo{|9kG;K1|jzkGMdN^6kA?)-s9v`jO z2G|{zGQ9@7s`Z)=rjA!|fQLz1!#yiJ-w0 z3(C6QM|1J@Z9K?}jXo}`psU4&&kw~b1`atrs#PdQ(hh*qQy!lhWiH0JLGLn{w)_lA zABPbh{S9)4jfr;p1eSFpm|__0(Vx&wiE?^Yvw?PF!Uo!>wNiR0(L~Rn+Jp9v`WG?1 zCK61#H!+#%Z?eJnB_<1l*5X3wC$uvC9+3IBgxX9)ZhoLh2QWYM2xP8F+JL%2pCSW? ztAKRS-0JC)Vf$^^L`Sq)^U(u|a++FB0L5R6l$L&@<}pl{gYewrDWc1g#ats$4XJMxPmre!&N4u5 zi6#SEo}5fycm_~eE=w~BG{dwUjeOzpdGT`-TlA%;h?XZ2HWrx0g3aBho{F+?8D&<` z=K@)`Bmr8t=u4@s$zb|Iffk)IfX(OG(rwS$ooz0J{Xyu^QKELWokN0>&2u?)0-H4) z-~gY>(W4y=hnjY`-WDx~Eg|4&RtdCn+6FV#l|V#RIvl_71_7(a4{D=dzkYn2^OEmQ zweq2sligx4{V4$&tPcdrE1^VW(OKZLkhhf1&Sh%^Uj`2EZ5(o95|z!jN0LFkbFx>1 ztKnxlwt{9riDtXJq=;}kdDSaS(0c|`FL14yX?n4dF-2u1HwlZg(#Qb6O#GE-@G?_h zf|NT9rbMxkLD_QJ=HTa0U`#r+6!mFbaF~~eLE`T6WQW+_7CHUc=M8hGHnA0Knbq%vV}*IJfG1Z7^mMPg0v7|FQTQFpgUNI zcpl5y;#pkIr+|6IWds4@jG)agxe|kz57H(B01fJ3F8iT;umGrRW{^$|VrqStqBhkA z<%y!gEAzgR8c z9MIPN*qSy5S_y7PHJxrpz8vxQKUOfH)!h2!m@*FI2?S^|`vQ4SNQ>rnsar89Jjohi zJ*~kaeBc4Ll0~>BSxp~#invnbtuPD>neX$x_DbMwiDBw9_Hl^yzEB045av_WT9m4# zE?eaGw8d8DtpWAD6l%YF@PIEQuK@D7#e@4BhtYZ9$s9^W6~t|%6;XDCnu@_ZqiK0G zzz3cf6j}gFlzf&;*&H9>N|UN{smLeesbT*u&}_1N_-WGQRphN_y>ur>c^CR_<$|r3 zEuzFCN-m-~dkE6S!+mVgF+Q;LCtwXhb($v!xRPevK}A0BvXdK`X5)USJdMpbTl#P{ z#jY#dDL$mxdOL77Kt==%)sNUZfroR;OG6oC5}axQU`@E0V!i+OZ1G<>z$Q+MMZB;? z1_0e2^Dr63i_q~g!4@1i1h??TYz;gs$TYu+DV}#fw>T)RbBR3=rZrj)xA0`D^}x{Y-7uP6IVpss^k}L?!sXXb~46 zr7yz$YfRHt8NH}~kt$pdovp=e@oH)KblYBN)&ItdrP&S+(9+%lcl*Oc-)Z7h2h<16IsUR;V-eA;Gu7~aYPL(Xm z$!-~qvxVI$*9%ku&(&^IC#8;MBZnXpwxlT=bUITd$D~S9mXyU=h7N(*m-|A2vp~ni zxzx4^s{1dmCQKP?TV|<6u@_4jGv+T<)1hNv6F9sOCT3Mt$9k(|cP%@7UQ^Gq%#5Cl zbsC)D0nYB$i6i?StW?~Ru*RsJIsM-iaT>F?*9Mj0b6O4v_u#hKVq4#cw6sTKTQx2L znwbrav1oIwwqAKA*Ho5TE-7GlFTWdLQHvp`8O-YTxKdT zBVaXPzi;o2q2mTv&7-+llvG3fqzEBGJeET|fkPtk0#g4y2+IZ4TzR`_@j66R*)p}s zhE9JGJbfH_`1 z+*yso*k3r}~DZY`(T#03VSCN4x zb$kWQ{|GL>5_n}YSJJ#7Q!mIO%_s2GoVN@Mla%FI@Ctr+$iMSM-aFzx+0sgW8)e5s z?c}(9WfX5JGl&j}oPtPC6wcMBC`^=py}N$T3W@Cx6BSX1T&VKy#0;Kf#1;d2<7e}3 z{8NS2uL2=HQ7Z~-kShdy!#6u&LKuj-&?rP~3h=+Bu3P0{mz!s_0aNNte0VTqyB zW^E}l?n%i0yr9)H9E#cdv((w2>%y={K*3c>s6;s%^qFUXL3D%YrZr%Twt4EglZ)5{ z9S{{DH@!B@VoGPQ-;VjJPQw`-x{Occ3H&zuX~8NoBCK2A?^gli@l$eDg!R1dl@_l_ zZC^2zH*GLLtG9^zwdhE$;m}s0x%5KPcOTHy!(fUJ`Cgc(;5Yuw)5TD|qMAFvIwW%+ zb(DxLLP)m3hB80v-tRd?-JW_WJ@XC@F+~3p*{|nQ>267#{VXWvC_fMXW1`l2{7Uvy zb)HEe$%jQaN@pxGvY37=v9aTZPS;U{EjsU6N;c83A|An1na8MCz$R5dyj=n9p~96+ z=a+B+U7w6GZTD0#6&BHX#bC1)(-8dhF%8vAlffQ1~sRI9@^OEku^2csEnt0N@)h)k0MA z54Na(1=R+p>L>1GeE@6{pjtc=+H=WefYu~NMAJ6mca8j>hi1Dmkk>qDHN-$RN3>C8 zkdBYgnL&p3LM77MgETK#M)QKy9z2KQL1>zH1P!8VlfhGe>JZ(ZnrjB-R{ z8!v*p6hrZJP`5mRp<4!_CE+9B4UjHOw#=0vzTzd~!@$oFR1huXN~(ig4>WFII7-aM z>xJfk@T7rDv2d-z$)KfNc_pR)RXp0hP`{FT2%kcZ9qc!c6V5wpk0glFx-& zau}M*xFY;KktgVZon%C)BS;j15<GM14WGc#3^PmRc_+~I_|MCOug~m3o+FPX?}1F1TNrvsn^ewT*)m& z70!j%b-O#E9pGgrUo|Jt#M1YEB zl{>9>|K4qV84xcSkcGa0nc~1g;yV<4RM;56{p)YJlC<@_n3|za)7Md)?)-z>%&pSQ zA^*OaZZxx*7gIy77eeus4tY#U9_;Y-zwY^2F&?D+vDEp(^=|^HIH=50#P_iE) zo`%`aNw!X9GT;Ex+!tnR5YI6(>B$79|GZ()pJ5f$&7`#%nbhqjcWWRjsBJA*@&jDS z8=W3Ke{y?Vs4Hti`hDUKrZ=^Ex*bj||E{g1b#f=^BM5#PL!27UBpHs58%ZCp#&frk zNw-SJW?#dgcQ7C`pCd*lt(D}@4TH9-@yy4i{Wu`^w+UE!n1E<=9nKLJ$((@Bht(Zrc2QF?^^Wk+skl)JakOwvz#@?hu+Hbi#AL(IdcjVn^Yf^no=GfNppN@X zkS#%`^Mb&lC)8tZt;>X_tmNyFHn$pSm^rAJIYDX-p2BgO<3irnd)4&tniRh;Eiyqe zmGWanhR366+K<`2@JGXQ#-nLwPEQX8m_@rL=RJ`0Dhf~!83zlx*3?ts)`nTJp4xC; zEC0df-KOt*Xu-DQ?jgr*`=C+g{{M*N*Q3vanGHRMp@SCaaOi0EF#Nh%|I0_)fABuw zE{nZ#GZCCzo@rxxdi2k#ZLL$9stOSB2GapE_@T|Kop~{SP>UVx%4lt$txV~SX;PN3 z^C*&$9vduUT2u3^S~29ee@2^AvB5IXzH8F2wY1Ng+0ZEcIKNYwD2nD8Kip))1{gOX z699&ChCOZkHj(HSG15Y)WlgJ(x_%AtfzV+pgj!b5A=EOR9)&>?t(|3uP|K7!XESF; zn-#YO{i4AGLZ~5Wwi6C5YrnQo!)aZ99~k{CD=qq&^IHuA#oZK4Aw8i%9^YB>nj2bG z^s}t`hGw^v;Z8rh&i3?>?I!iYE~Bm9^$pGVYbf^+huERfWVKWCF#sK@mhq+b-u{`& z>LE0m;dp%LQ?GQQd(THoQz`&jADkeJ;?TNTGN;49ORz`wGe*GS(_^jk>QUU-4`g^w z>$Cupk4S@%BL(P@3XVY8X_LgPKD*K|Xs_l&nA?84xsuH{xYE!>kF`M0R`>K)yRc!< zYE2kWumtW*LUiA$MNW5Y1M*K-jT#312IY((?MReBPmXDk7BNnyYm&J}km(Z9Y`Ip0 z%i}!y%mdTjS`ZXa(}NcVlcwN`kHS=^fT^Qew-pDwQ(fE(H7!H@M^7;flkQ7ab3eLC zA3z^;pfYu8E1C8sa=~iAfafja5X!%;`S5vbLiA#OrEO-)svtyYi-;bqpXd{gvc)g3 z#cS9a$Yi`j30!gdzEh#N>r2d zrw^c46MNV)47yEgn>y7v1mE)2bF)12z5$Mdh*LNszRe4@}rx{u;{ zP zoncBW+gw(~Br4S=wFgI>q~0aaDKYQ7?oN~-+8nG(Qas3%0rd>zv0k!^LmcG-wx~N1 zqfH=v=HnrBaq!1eI7Anvq{NeLz&M2Z3H-=w7%tu{wz#zrtHLH7`iXG}%?`p6iQ?5l zB)_C9GT=_VM>4?h_Hf+w2rN)EozP(`#qV zs>Q+5W{gmOPLw}0QyF3!A&D&w5>!-ct#$tj($`v>8>UB_WA$_D1RZI$Qw0%dwRKG` zszj|*7eDMIry2b4NeB3)G96r^)lF@d`$?;7YHV?S&2DdLn6Ac9-!Mz6);G+G*0!kM zv1Vle5^J8;&?pflwOE^=B>eS78=KscSQMvL+w56t^3!HEH3_y+zub1G*-JI8*=g>g z_SsEpQ1Z(yIYSL@X1!BzX47;T=FFz)C#uE7FEyr_P1D_qGn=MQm4dUH1UcfbnoMJ? zt+jTV9Viu>BE_0xvueSLRl~)qOl?pDYH4V!Yf{_L(qOM@%O&<=wzST%w@Ag2l(w8T zCr_51Uv;|RSVN}__#j-)6NI$=loU)~4r2D_q-~Fm1#L=5!DePpuvu5z5=(ji(Nf-j zw6xST&qbQ+&j^o+&c60o4YKfXkHZs-pY_YMefnYQ7U=Bf77?YiIO{hY>E_lHy19QT zQZ49jPIj|9C)wERS`;N_&y%LN@?XvFX&1OdlGVZj~Fqt3@ zTyRo~E0TYv+vUzwmjQGMk1OaBOl;V`%te=Q$Z$OHuy8-A$n6z|yCNHe)Ccca6YNX3 z%j46!tZ=)Or+Z)&`yU_9WvRFp*sZRjw}+B03hl<4}~AsJi0-P;G%aUMwOkdhMx`omsLtrz}ujQi%RL*!y~l!P_P;F ztB7vbcSE?{t?d&#!yoQVE@Ml`r|)~I!`{)e;48DI3k*bI4>#07-(EexuTmGU4=FkVkj4Aeu$>O*V{P6 zHRJP{0wCmI@DWb~qFiTXHUiqVVC3L3qctO2O$Kxw5ml^n!pY9b0O5|p^4rS#woHrBF%I!^ z&L4LQARh8SoaHmv9~*D}ncwHZ{07)jODd?f+)>l$Dsr33m!?Q-g(LgBio2;bq*+77wL4<<7{ui{0k@HZzXygV*>&>zOXu#1;!{TdQDk z>0nY;1>8D}U^CRpemZ0!U06+nd<+**;;Mx|7|$VdC594(o;A_RGAR?G3xd?If?|10 z10lYsq6?}?B@e79EaL!2InH!Jkg0G7bbsTbXagGtNW83p3>OT`vBW2E=x*Wmis_39 zY1bKhnEJQTtXP=hu`tx~75_6$m!`~e=X$APu+HOG8I*L0A1NHhA@i^@z88NJWju8# zhd3eZ?hp@$SRf=cJT$^m8Pr}a6}@GADJm{0 zO5olQFHxOQdoj02qy5VG88jL$<6F?E1tkNg!OjtGgO94o01#e>?tTG>yhM=`sVz86 znE455j;NFt1j&q0d$5c@MkGC0LA}MHhnWaR5E|!lhceA9=K`LLIUHF5saGC{sHGV7 zb0eZLlHd?Eze@{(VWy)Zc$WZ_sVxs`)*ZNgWnpQ-v(zghLY#|T7x&%1Ns21VkO0=J z%!*;&@44F=(k!I#z}EVf?vh+mRprVyOBYE z(5Apt&mid48X0t_7GdZj`FZRJhz!?8#+(9wO<=Dl_Q2jIBVcv({JDPw1fQ*P>&}7nrVup}3gm)?aoex_bDUgBh znsS%V?suDe2xJ2L=Q0i%ygu4+eS+9f6hULgMpRu+B^E3fU^oV;TqBx(;cLTVT494_ zZWz<*E#vDcQO<90UxzQy6|g&GL2@831;f1uwSoPS+tX|w&4cX|x-K2Pc}Ba92zrB` zpZ&0#bpUpQl46K~-MoD30mv=?WVbOOH=-%~VYZ90!Ux4{jWs|RqSt;$BQ8|>Ei zLusC{+nz#c*!*;iMjgcnY~yzkS_Qb9kj8q}x)FjT|FuosHxAaPurcE%wdPlm_zT-Y=7>X4pj|LF&JLVXZ_(n3r( z*3LXwKB^6`ZEc#>(4)8N)>v~7l)uAo`1zZ_&N-+@=z|G}diFov^V6lpR=N9m@2Sb! zMdVe|x2IQ0YtzLs#X^EKqP3w(eYl)|z0MW}=x!3VHpkSXrFov4s5>tU18apRO-4(s zxuJGu!+cfNX674d%oTQ-D=sfSGsTf%wMb~noZZ~eC@-cg=jmkH&!FtaIkTp!cTBGa z+eu3AG|`LRT03>75>VlF<6#>*iH3kSZ(y?!YATt~C+Wv{UKj8aP?O4K>e5ykN72?q zu0hS9ox$J2Tzp|K-VHOE=Z)qAQiY*OSA3C%rqB zz7*I9IOFalq6WX{X~RqDH*g_})ZSp{n5372%6isQZ!lRAgOpW;pUu7jSXJp>8n)XY zc-MKvFz8RoT!ZOH&j1cp@eqTksv1uoTS~CibO*awQ8Nb9{fTOW=sB$(y+dT5>Rm4) zeK)#)N<;S#CsFcAPo!qA1P2AV_Jq)0A%pcZ=;7oZgXk$w#9%!y{fq8TLI>zsPd%F# z8wTB*a7S4qqulJN$1o#m?L58QVLqd%BzZBJxOzr0C1d5T25_q6>zEMMZCf0xd800? z`C2?TZ9XP+6ewOz3pK3dA1T7LJs#u+rfcE$S9n2V#leZ6#}1)S;w1tgmU$e*h5}Y> zA4~JM=tbM+@l*C|7K;F~4BVw9`bv|&jf*7bgLs~^8(d`&-K)V{62p3JEtVB=6W@?l zpF;xOr$r28E<)xX2!2(-ojO;@c8mxY$(QkBp;<%h4RhHHCIioeQ+csTmr6vz$&fXy z&?6k8Pvf~dVzz*e?&B`%53;BYyhaSTET)e`DrBlG0qgYmDRgc**0g8}!}eUk)I=ET;FL2xOR(mdYh=;h z1pw5A2GrHfBoGs|Zep`<%EqhfNOuYk7&+N3Mi$-HQOzNYF1L{jc(6hA7)A6$)WO-B zD*v)fxq;WPB^2K;alPlO=RfO_A04pRnqzmN)8~*)LXiuqRpwx}fDvPP3L)aK8@dRy zLTvhZES8$7Bj#vIb>_Mat;A6baHW3SPObt#{E4GH1a1qm)j0Eyvdd=D8&J^+&}Z^guEferb|<`!8y$*f2P{sN^VCsgf&cP=&KdUH#lex=Ah4tyrXYQ;SqHhi-D$ z04k>+!1!8@8Dt3-FQ$KZeAMNZ`Pn)>MDKZgbYBt+1w*`_FBJ8M;l8^{sTKVB5=ov~ zpI1GlbZfE)Xi81|1bWR=O213y{g2kC(pjI8?)rF+bJyoj(9@$U#B!H*Yo#zG&tn?t zgD3{}e^e#jDvxh;5KLPBaC33Ox+r!23DA9VIl_PHvoV@ zf4>?+9x-yw5Wt#KtyE$k*H!`-grQzsf`R!Yo4!1E+>c^k10Y~% zXB-EIuG7144KJeW^p!Kpz;ZjCx3hmFZ^vjSgrQ3dFiE&vnX-JlIik&a4u|+nBZoeX zPgaHrEA>VrhqlM_fXvZ6)F=u>#OTS=JDs{m(hA^(QjVJE{WyZp7lx)EY^qbkV_6@A z89|Z{j}rPBh<+Vk#UW_$3;)t)S=S6wLy;hUIHz~%M<^uMwSP{Cb!(rKmtT-pOW!|a zU{@+H$|kg-7wZF6lVvui9_kIlpx7I==T+fXFRHmcOH=-5W<;}UXZNI~<~}WIr#Ae% zmxoP)i+tsOQm&=FMZHoE>+zKWA|5XRZF+Ol93{-QMH=qIL$?!@BsW?gn>t5H!tJ3% zr`5K!mMHOmdeX>~q~Y|WmR5PeIBAj}YpJW9EkAWvUZO*Kgj{N9Y;A66Y-y;I_X>1} zJohP$O@l>=R&Jbi40n7jV*g5qx3NVRZKR{&?f~wtDsj9TOAMwXeE2yFWO00xL5PRI z6mO?IAJ+`wP|1lrkqfA0kwMfF1O+)rj^b&HKx+7lhI6IRN$27&vRDX^Hu-k}d<5iG z@GrQO!Ep_VltUkl_l)_%C@AiRs65xBxGR)`FL#57^C0RD;rx?ShUrS1?^vLdW{%iDM+HD}feK1$7iN9oNP*H8%k+KIx^l zyFjo~VeK&({)|n0H|ZkX~l^45G(7f^?0%a5@nTIKE0v?TYlNZBJZR_Cg$tTxwKc9o~=UMKH=W;+85b#E7Ee zKId_~TzRSbB;LN?mRxSgo_~VZBHf_2NW4wKzuV~POPjCYl z8X2^-14r*0iVViE{wXrI^wWKr8sD~#G;DTxMupQ<6g(Xr7WG8k3xeV@+(4WqoR>!y zfGzWsQF#3odry-aJ^c^1sBLOjcW5K ze+pBdB9xmXhIx7Q9I6pNqE+nYH=zzXl|zqmkS&R+5)!p4Gk^>_quQO+Q|_d8G5916 zY*y-rD~dAzX*<)TUxOMRHFCUx0T`q%D$^uG5c}F>o?+4_9)XG*leu6)yyx*LFxcZM zGEBNWS%Pcn+GH-%cC8d8mL#F(OiX({IG#AUCR1m!1WH1_49qvsiXlp~=o04FvY?tn86{qC7 zWHpLaG16gKE-g<4 z<%(`Y^}l#ZZM?GBAR33R?WH)mUTHGimcU}XtvRa!;>Y!`RP&s@B-xaelf9Z7xOU|D z!hWC;wFt0F2mI7ut^3$-WYdpux^_%NU2E@aT}C#oO$7US4S@atbxO8+B1Sf73J&qf z#Xb@-VIfNm|hNHW=1K~e7G~gbrWJ5DkR!@;D*t#dW_@j82s&r z82BN|t?WOIl}o`qcpB^o0(RI>YTveN^+q;bmnbRYepKIN5G~a)p6e1phOgbz&`|PO z^gj(M1R)21bpFjRz7k9^6*0<)6&aXq($g?AXL>)8XJpfQO@QRJL@wem zbb+scvZE?S8QC;m&h85cGqGJOMS;^xID~P%oRH%_*2tz)gOsz`Ah^+@jmaRrr(wva z2XWCG#Cj2phJxWE96|%*s)1I9RT$Y+4SB;kpz5-jh6zyz;LL^$CGA)(Po{t>8(zYR zY2Zo>@0T*XhuuS!&2*u{WhPj=eu1TIrgN(mEUif98rk%vN5Rqsu1Zk%3-;>i^aNO) z9N@RP66OjbF`xugM{wJhGA)=q6a#o1;TGxHL4~ySndYul!1ua_;5KEj{9m7_2H!^14Kl$89|~a7i`b$@yy=QKB=;CK zRF6{U_AT*oHrmkXcL_n=0|#&mnmWIjD|slq&B}m)w=1dHwd39Tk~^eZ06Nqcw9h3h zm!UjubS9&e9yJFTOx^Q}*>C849z9{g#`_!yliHSvqcnOcQG&vQyT%%XLl81_Dqe{d zf--9edCL{JeVNFGKSV>P2Qz^>*R(YmI(?KGq0RFE6=w!f7%|aM`*qKhQ9^764V@Ni zf=NENcinwh=|Vrq>x0;&=R6Ux!hwaUx>&8m;N5DS|LUpdkci^&>eA_IONoO9EP#I@8l8c8soUFQ%V3wMrl@u|NJ& ztk0u>DwKXgYeX=-Jk0d=WRv}*(dloxOmrPcZCtJHlSbC&MLmM&v4kJFH7-eS>pp-2 ztw~NsyB~RcP&LaFXMcXmSg0)g4IM^H2Gbo0tn|m8h!C^2GIiu`QP&3O2le35nO;fj z?Pk^6hjwqfyZ_~gOt@5HlMnm$`bb(K7hCaRTRl*HR&T@wAgt(9_L?rRWz6VH_> zkfl_Q*HGnYda0s(x?XkHx(g3=sHDHIAoF_omc-CL*GlPiPKQnUSerucq%HjZ;JH-q z3L8XU%X?C%YjlCom2nW&I#ZW=6u;l$Kbp zmm;SuoXQ7aG?wF0!tTNMU+GFJ&+6unU+r zCFKd1=HtnerFXsIZtnNkTzXl2J(_e^62epBeH=Q2VLGN)C_&`YiFP0wL#GF{QtaW& zYDMTSy)B;(@lh{~`o}l|h5bW=LX2$7gB|7co>rPdA%CUPe*Lgv8#{6tR^GVXRJLr+ z3yO=uWbB3kxk2=!g86@Gk?|bbiD$yvc+Ajo(rL|nTo3eF27C~oL#yW7*X=#>B*kc7 z0Meu1tHCn8u1ETdbl5WK!;A`AJ---(=}hDqI$bWzj-}2*f1~e!ybDFAE~0)uip8Mf zZ5zT*1ZQueL3C3BTzd5NvGlcE*5C`Y#k2xc-d)LMTwv(*7=cspc!xmlllWj-Dd+wp zEkfE-Ty`Lylpn+G2qRXgmho4KXYJMhO0E87YC`m*0;;_WF#d&xy|#N6U~P-(P4MFY zXZMqj{pBn#Xal!iInA34#n?Dvi$-&u=WzbpE?jisIUIoV7BDJF+ic%@2+p#c{nWOI zDYFe2c!fv?Lh|Yg*d(PbRq}Iyn#btU# zt%*F0Es>MW#Z|vfT)c#!NiU>`AFg;t@+dmBd@QZjKwCb-h%qSl^wSGsaxK#%M(IfI z$CMd?Tn3J5unLR8@$t*zP%m@|z(Ik=0N8R1Fvro@qwkGUlP(Sd9CyqQ(sscpPl#X% ziYl+qFHw9QFx`kg0?8pbP44|`GlA3mJQl6v{anR#Lz~4)74@*>;eLI{lFw8CpT|)Fq}>?Ko_}Hkm6KexKk+ zcR@^!jGq(Z45AfnxLm#zA}YZa6f&vM=QW7FZ^yjVxtG2DNGp}u2om@rb4np)VV5RB zeVnNeL~NKA(B8tfaz)T|np2>lG?YWMDftT1^MboJ(Gg3GnRSUeR3jV@K zZ-6>sjl^NL;RCDk(!6p*r&~#(d3`=F zs0!U=Lc%zd{rqc#=p~uX2BB*NsJu+`N@OeK%#CEr8=x(5c(ZC%Te@vQxeY(}WR$X> ziwvTV0cq&7NBFsvBZYE6cq~>Nnxc^F$&wF-e(B6@@XPVfIV#PJ5AI-si3`jdk@GwtnOu@o!87 zh3mv#Gh4*5)qSIZL?hGTe(5!u=u4?U&pY+U%^*tNX9e$}FtV%log; zs;txsz0+#Oq>P8 z-ivaC2w$EA5#EdGC&j&6m;@GmIt%#f8Ck;z<+*s>ye7I#ix|CV4SaWZU^v9|xyOAc z_M)#n@_g#Fd3*}ZFGJ%yJ&{5V!9y+d#!Pz8(`fXfI|QLLf&A{pbhuF8^Q#r(d`Yqd ziMu?w`xxU|fe5TVpwT0Z$bm z8GnIjeom5!F<)>BHV{L;JBeL-*&}fBlfcPB1t;s1fRjHbi_-w*P6%7k5oPF;_TiSwT;Po}WnugT79E0oT;U)Q?06{s9+V;$qXyNKM z43?OB+ptiLW1x5jYi&kW8Z5k~Ij{g#M-yiz3!Q-}-h%eN_Xs46C{jepwnVwni&krq zV~Gn5$E#^w`B5|+!L3cFVg|id(}Occ4ITwuQw=N)lj-F|xxCo!)JmB)dwfW{B2hxEL8ha+Kt(ds8j#`0`6M1Q@L7b9 zC*y$nM|5AEVbc3?0Qz2!ixEwxkEFnE574j4v@j_M@yRS3#toA?m1;qK6J{C4`yh!} zW4J!EaGVtvO!0S2`cAZuUkCdI?cJXI3h?-*XMkbS9bo$NAj2d>_^t~er12_HdRK#l z=64B^&@|hec~iyYAbMNFt!^^iDr_cV2zs~$DP74;ph0mleJ(|T zO&_f;7nA8dk8t+7u9bF-k9g7Rc zvcC?G7=vjT`ZzntVWvLya447!=F)44pkdO@8h+2MMthkN#eGP&vmf6z#Rh?&FCVoK zp5}rD1oYYmw&Z&x4R)dq30|<2zt)qpQGn2 zPN8RKM_$*~s~t(9=dAtEbJow$a~7wg=PagEOF$+54fO5b%Gd(DNM*dd_0{0_N^G z2YHQZN2d3TkE1p|HnJ$gCp3<1$jm%60%V+qi5-@u=O=eh9)k=`u&@c@9x|E1HW>8U$EbOefhGc#*S%Y#}*dW8f=$#=u!j?<)-a8^OR?^pV2A ze@WySS@ev;zz^<+fwP$Iaxn0**tvSaz;`;6rB)dEz<@6zob|`_P#qjdy7vO5(@nzwI z0N0tARSD#KKfB;JC4;9JS@eV_BB13&Hi{nXf`3t6@c&9ws~bLxg+5|>5QmZJSOj0H zE3T6^alPJ@NC&T{J;+}rBvBUACz=glFS~*}0kF@sdd2#ALqeCQ5pC*@&th7xq<3G$ z0To$vy^`KtD+(_^C_%&(@!YgKK8x{YR)_c-0mNnMHMkGLAE-5CFzsMOb`%Y=B-5y#&cy>XLshAu!f0 z0)i@r#(DZRzZjRGT=R?FM_IlRa^UM5*yxeos9t3&u(c9Rd1z3gSy|z7sFm6*%`T^2 zwyn$Hhvnu3RrhAS!pNo%<0bZU4m$28^@iNtzWHC$x;P5$jC#vYGC3xL00mX*Sata`S(mhN!ZcCI&f*V7v;0gMl1|NZ>TQi{c=3_NNGL zNPEPk$%?a?T2_rUNJ1hT*)(q%cJ_f}o{>#2soUo+Xq3otq6)KUnE2`Wu0^V zWHU%$r8%=)6RnvY2{0|bGv6_?>8g2PPd})ob2pm6;G(sOY9pKerWC1`h+@rNk*y!; z;}#>EO_~MwXdo#B?s6!R#X>2qhF7Jwa-4UZJZ89M!WzkM3t<1TTC)kal=o3$UY@Qw-G zsnEjy8#P3jiRTtW$%u{@rqUkKZ(6Dj**8kR=`sxuNMd@;BOCPxrI+_v!hUUMGyMs7 z7o;(-d1RyhD9Q>C$woab8}*~-U>k)UB9{HiriX>0SObP)HdDT^ktC2TWR=cVRqHZ0e(}F-wjmyLQC$7MfZElh1DS@BH8^sL zkxds=Q+trw_N2&&=xGPC4BzlHqOGcG#Wc)jMCW4~AcymQArhYT`0CIaXoxHK+w_{4 zBI>V@8$Fw8m%}jZPGcBmBdViKNj#moMZM)rdJ3#~=P{QpE`SH&xZB)NFHtrJy%#*V%xMZZ ziNyK|G<6S0`4J2S`N3|HgAj z&+dQS88y#oY;Bko8$P{9Zz+wfG4ZwHlxlH|`wr=8>KID2c2>P@i03#AjHkr(#CBcl$b6V>d-hl-cY+Z#pCg4 z|3l}tKU-C27sa^?LeAOiqL#8nJl1yGbIVp*4Eb6i4&_PR!yAf zWS1SO29GBuvYi5HMY^3L-)mCjfEMy|>=yo_OLh+}bU8(SR7DPG!INvZ@D`~SCQeMq z|GA^=bV@v89HfNjD7%e^GgJu-L$#8a*c!(FyRB_?%KoIv9x$A;qwS`C;Q!cE{xNph ze`Kn%KO1_NQ{p32mH0OU>+EZ{_Fnx4ibAG;EV)+rO#J}m;Gte&kwNqA2G?8kq(=Br3e{8O1klozI94V_B zQzN^{zI*<=*kV5{*`lz8GYBIm9QF?PdIN>y0#)Y*CQb^B^^Wp-14Fz+0;2+h1H(s; z@(u}m1!1hUM|a+T6_)|o?}y1c3+x3tJSW?KZcR&XOOLPYeG(a_Yx zjXI~Xp{}XE$5=S6|IVq{!CZ&A*8qlB+hY_@Sf!^q=|8HcOLyv=Y13lL%3aL|m!pn0 z<(H=7d(g~St9`2)7%mEF&W{X4-LTtmVrg)idoKg6)y|xbN||sS-4qZOYUoc~!<9*%K*?OkID)zr|f;2ywH00x#^1|X^AO4uzQ|<*Z--LBV)R4bYo#VhOu-E-un#pON;Ywb z=I7#Nm9qWc<92qbXwbhEmyXuyD=U~@jhE9Mx(|Q~SM|gZrWfMHbhj>+Tq_b^VN=+G zOl-S0#mJ@`pn=Y`O{*{DPyhj1VD@aW#PP<9aaSBiX0cw%m5(5Lni~kM>_>Yf2JOjG z+>3kI62sez+2RTY|4;8nyqhbP`kuJ7nGbO1(Ac|KNifa6FnXeV$X%f280OHpbqvq- zl}tujUX_SJvj~TtMDN9?nrdTFvnE@RQS(s|)($ zTqw#TBrLs}^$uR@9O7DzQsNHM>glaH)pT!mJvCL6UQtmd4l(qT=&d<>pksv&Zp-#D z#mnh1DRfx9Nlig18|E@E5EK~@;j5^fc!*q#S}hy#@1c!cNlh_IY%F6a^i(sPB28rL z^zhR$(RDTHS(%Fr@PVu?_5d$-2e@laHC>ZkPp#EtRM7l#2r9sl*L}1rHOM6x!E|*tmIUhC`bdP+D}7Tp1j@NMcRyD9BL-)M`Tf& znkTDv5l?tj(DbMhw%E((;g3bf);qa{bYYWuT#%`tk*)dTzHB>b93`8^QB{zJ_{6*$ z9*V;Zwxq=qt84|k+hIwO+%s-0C7+F)G;Yi(Oit-uL04OpxpN11!At!1HfFH4pPm=>mr@q2|xnU@6lT-p_vTcXE&PXpn`qb#%+V@Pd6#AYXTr@vnINPG*-KSMXmg`;gw% zh{(c9Nv$oHhAA2deFAYE{FV9;O3VSmq&GHh3=PF`4EEY_g>~ctMwxW((Pyi6`f<`z z1K3fivZRqLM4x-Svg8kipr*1M;U2CdoWpf3XQ!i5LpO!Ldppo=w+@%{ystURU9*qu z)552UZ!!Nq!JFq6gziT|Gv8eNV)4;-J^8gXF#8_zwnTi!T%@wkOhBv$O7QS z{EH*Dlt*ks_}3NmugpW%RRjuQ^dXxv!8&AQx_r>bq5*!Fy8iHSvp3_|36dv9|dK%%F$i zmio5+J$5$oLTWv^Xs`@`x$3EF)G#;`>zbk14a%_%&4C`cRy`5#z)QE-<;Z<&;8WczlZ0U zbL(gAr!c)8?xA&9F~8XgQzr4I*!=p0eshfJ^)u$QG}q6Vql<8@^bd;^RrZNsQWnnuf1o4Y z6l-jnsadGD08F9;-+(E7f?w)$}X4YE_?S8hy>^{ys9Lzp6 z)Hwv!jiH${v%&q{zk3){elP~;Y+b2;hpr#}MYz%d32SfvNBYc$C{IK8Fs5wq7hz19 z#2IVj-1T?bVy{ftxAE>N`u8v6n)Xk`XUvJu*AwLYw%}rMH^ph)Nodqts(&V~Y5#_9 zaZPg?tcayKGxap&+7U|!=s9#j&q=h@x413quX+uK{WFu*5o?Y|XT;~XXCTYr5@kLI z=uZbq{YChHQ7UKNjJdJ;Cd--OKwTvRjsA36$eG{RFtZ`ke$Jx$#+E4mX>8C9C+5at zdJbS+3`{(PHwu3Ya($;CGQZghsG5_Q+h}dF!I=s}oTKooZs%ht6J0IGg^%w?IRvX)tA)6LW!C*B>o->=| zuXL@o+Gx<~+NRvUXghssQd2TtJByCOIE;Qi2WuZ~er+GOlHt@RcFSIfClEpdqIdyO zbAY64H3n(~b|Iwtz?9tk5Jgm-LRUNpslG5q$~UrG8S+6_p*ltGOjjbH`offNWR)`H zZ#s2@*1)w=%akD>>(pEAvc^!miG7pVL=)XCbmf`S(N6w{ALb=w3Z3u$nUgv7I5*{@ zZYf$8b-)DToqlUn(iSs7siph5M|b_UfJR1 z-H_gdD4m+0g4qb+8$@6})WS7dX*O93Sobc<#bC!3blqj{%6?-bpVV+X38m(p6>ni3 zy+NLikogC!8|3g{>MnQdTww8Z?!g^&K|W&_(LhEU38}vFoK||ehMmf$R1mi#sw!a| zBg@iz5WxprR5e)+9foDfkXJn0kbn>GAV5VUvT-mOfmvq16GuqbyCO@Bp+DVX4F4Gn z4r7vGC~eQWIP{e+Nc42_DNcuZC;X)S4#(xHkE}C>agz`j$h%28^twd#l?S@P_zWY) zr{nNp4R@)J>-ZMu?+Jb`1A{sSPBMn>`VfN=`gH}&gH>Od98{;sx^%AIo*^<^F87ic z$VZ6r%>2@kR{>M9!V~S?ddeOGq6`@m22FQDvZ%xq8uWhWVG4Ij5&W_|ork*+#fyl7 zsv)Bg!g4}#5F*=+p|Ws~^avZr>%XgD97c}@era7R^b8>#xf%oK?QpF-HII7-j(x{z$oAz zPZNv!bkpn7c`Sku?wWv5Jz-cTbb)Y*o;Opz?_wL~+4i76 z)Y>pne2B<)7!P?ROY7Opi@77a!5!J(xDQX)_sL%Nn9!@`KdES^k+(|;!y~>uytejyt74I8!=S zjIb%`3oudq+|PPur8*DyB8plDWz+o4D2x$%5H)WXBfP;F|Kq|L8+f59J%0<ng_e1qHEmAbh= zE6S}i2=e&Jr#Tq`bqeJ3WX!&izm{TU$PKAHGX2P-(9DNUZoo;{C(_68+nweiw-^Hu zQm4p2sQjbv@UNv!8FE`H4-wTD+VbcWSwT0ZJd#%#U&6=q*S$>`ObAwV@l&cLo z=ANzk%69KCyOL&{UTLhcRZ*xQV)w2UL`>RqJNh9XA7v4_i`9OK+=KSVNouyjTkeO@ z&=@JB<{ZG=bIX1uSZ*zw3ObN4=|p?ef2GC_kk8~%2M*QakU&Tq?mwHgkT#2vckKQsuKMYX#Ks&K+1{3R zi`Fn~7uklB;B`ZVdhI&K^!kRmjZJf!>gQ>C$d&d97hAWgWoZ1R?BMrv0&a0mjbAzTP z7P%o!osnlbq*~S)^@%fDnj2#_$Z%#L+a>GZ{>qvkkLzyrj|Hudy6A5 z7d9pur_YVeY>drq(D=94Cf~BV`wef2*RynwMEks!`sw_cV^2`A{%C5{6l%{*zA=Ap z>#RmiKIb?f=Vb8s7MobknK!essb0gJGjEndZcq!$YPZ#ik<^Q`HD4Dn7PQ7&^uT(# zve(|-#J9cm?028;KGw!#lYL32$4IdAD@QN8&gh+y829${Fv_Rep@AbxWUr@KTl+>3 zMTC#tHQt&`0^~Wf+o$r%C9N^|9Mo{9-I6k7mxqF%-{H_Bm$$1by%tc7jF;I{8WrA$2bCN=$C}<85!fH-o#c~8FW_!NEIP$wcR8WqP zD&!!xPmovlsTjdz5>hN*$A4;(snnn=-I3lhL0)q!Q8JRG^1W403w3J|FeZLicN|5D z>}NxI3#Yk7JHqqRucEmT5hUca3_>*BT`C=8kWn`l!jJP1kknFByxTymhd$8kQMQ+8 z_bWp0?i8yEC@!6g5U!<^yks;sq5>86!FcV&uu&-KJrn;ZM#CS)yF^lz^?$T|SX*Jw zBgY|v#uJIe@9UwhuEB-vCxcXh^sRx+CjxGamh9bFh8e#jPI?eso7TaP!$&B{?fnZ7 z#kZEV?i+Ipsq}kWe_8~-J$E}j+lbkK(MmyfP!D`1&b1EDwP`v({JW<>b|-Urgs$~1kY|&H*j&%RIxIf| zfoq9SM@`vign7W|kYkC;mQRHH(12XhRWj^Q4oa|BDLIA~E7H4Why~*PXb*|YJbB*OjS0$>P01 zBwnR*<>7fjzM%5N!A&Yx-k4VlnY(rwz;!T-h~iWH(oiFEA| zX@Gdi!b(o$4sD7HC+fk zqnFjx@Pymc7c5eW5aZ6j%%Br;Pge;!dPf$ODkYOjRJQH@dX2XRAWEU>Lp(@9*A6$3?9KLPn9S||LQ7R9!c`|>z)FYE$eCb19{(D zz;WHEaSysy+o2VH{Hm9HY1r1KtN4Jh)K&IY7WvRi-^Y!#C*{iP3GQpnLwTzU?Pk5T zvt_Nelz!h^%tqEQBqn61x0+wqrz*8*cry(@U>qgydUrcBy3=V1@}4muL%@0#+C4x% zVh`FE+EfJ8Xvn{kTU5Rdy9s$fM?EJMUg@aeEzVT^Tn&)#lex0opgX;nlDRZkU7pSp zx>yO|63L~(4w#wFQ~K{b`j$VKDMkT<>XazOkRiYzrDPT}2Qf3jU%mLNp1+3im&po? z7zR$xHL9%>x-?0`9gw|7lT!Q?u+OjP10AQq=WPGsi`)VKo6aDWl9xM622Ld@KnTIj_{+i!%L6V1Ugk|#dr9t1p7h6dRbp5K7TzuZruG zl1DmAEaT3{RdGI||3U%*ZOq08@HU=^oF*)TDGRq$z=!kMhhPop1Y4TyGi^sXUEJXU zb>2YUvFl)rW-OsotQEX(j=h3^9xx1(AjW-&szV^FXYT>6h)nrw?kZwl#>3uSykW2O z{(vYQUBOu56}1~t9)dF$5J9J>vOX)8^YY^j+=^%gk_gDWm>j%B=Ee2Dweos=gD|e}{w(v?N^=nMa{F4@0HOxmAo5!K z7P(b-xS9Lq5Q-B9JA#+GrS4qbJ&?g8EIj#6SJNt!|H{AtIWH(B-_NG`G$6}!>B2-o zzMQ>BK`zZL6DboR4lk{F2wbfngepM|qNc&lGGvMF^d^Lgrqy8@;cA=$>23A1T+YbV4eL(&ZIhXqPje$_uugjJ zXPmAT_B*$;IAkHG*LUd0x5y zAH*?c>X(Mk{>&HEudwxHZE`g5)p3;OZlOE7T zwz)+%IYll=^J2<|{M%C?gR7;ntIDMC~Xb`Ab`7}UBbQH@vh32o3qMJW|WGF2;c+- zS<_V__j&oc^=p7eRxUP*Petevm_CHC5h094pn{jlO@WN&D{O^fT3bL{*mo@1@*lIrv z%5Nk^If=O$39RLaHQVPndW?QTC;7VN@!;6etIJoqlW<=)pC9R615*;z$TjPDA4t}t z+~WT5$5nr?coHEQ)LS1eemXT0uT#`pyqP)f)9 z?L-W#>M?erL+o-0DjTMJ0DJ~>F9m%kioXGJMY>k2 zfXYF1Henct%7<-xRJL5lioMpuPZi^34%Pf2x6Lk2sl18+_&}ZvAB;o4=f6WKa$F7a zru3eS63tLb{@qcl;g^r;9vyO>x2$&Pq0oWe|J6Z`!Ak9h=q~E-M^R^UNt5~pjv9U$ zup2V3P$_xeYDv~)6{Ai;)~D^3-|*b`D=;oBwIZULTXYG}7nSOHrrr2bC>k@`5LoDid4+4cKQkU{z`WzD*2p2BF4P0RyazWMeaxIvdi=>s$#aWJ^q*Z*RJL5%yG$OPlPiz1Amp*u4f0S9UCl)xTU&#W zr*iZdC9#E+i!89tSGv++v<<)287<__J_C@DTbgs_?cT-kYXekI52M^IBKP&N2oqV` ztS4k=Z}JT(CeRA{=}HT6HY_Y}Yo_AEee9XM%BuKr?*?LZhhw}_@@)%e&|$t*Tg;bJ zc-zQ}1Oyi$fK#AR!mnHG^YBPAS1EaY-{LRp;@4Y6cQt;>4yL0HuMaO$Y%HZN&Wq>`~8^H(f7@H@`9%AomH0YTtcN}cXJ8hl5=_&Lu2}qT#8!}LIwOtRB+3t zzM@i?bAA_ZaNF3;HfWAVcT8L-_}mQ;u}=TyL%QSp!*6%%Ufb8+36C_#!2d9b+~(cqWIdhd2ekZIv-tA$p`vOdE!w>kn-wol)}+h}dyh9Q#8S!&gQ1;D6^ zN^VZ%c4P2$-(#$GeP3ei`J>=hx$^mZjl`YXw+2g z!mLliZaQb|VBV2@b0lt;yC=bN&fYE{;>I^UPfwd%(zlr1AH-_%#(aG_$%ekxk)6dO z8OAz&L~NbPG|Z(8{L}s*uAwNggZ4v1Fhp;mnrjz+d8cV1JpHBN`9Ef z3vb!MWgNV3yn;L(FA)+F*>YCjFr=$e+Jn+B%#ipY${t8iY_ZCa->$M{Mc=T*E46_Q zUvg_|TKPvC9qzmB7T@hcefw&>QLBL~Axq3^_2|Pv_|klMQ(! znWyhHzRT;=K~7b^Y}Q>%KfO=xm}~8m*ZT9VC23{KOzxG0JUf>&5s^FlSMw$gIJ~9u zd);bs<6;GYdS>yTou^Ix0u__d~Y zxD|eEpfD4`Uo`L8WH%4lt|KasL%FnQr=&f@yt61RrZ(rl7-Vsv%hk?Q`%Dc$zDzRR*m_}plN6qsm7lfC{Yo;XR+fKgT=c!^GK{`1w0<=2z zL9!dPd>4=CyT}hRGI(KFC|-!9OqI0c>Z{T*CC{|KJBz_c{?Sz;S4x3=NyHCw(fpVW z2IR*X&hUoc?}GGm7PU9l!IXce;&P#O{d6i-me2M6NT$yRhd3*>_yM=lbzncQrb^^a zU4a^WlUQlU-b3gY+7S(THoH~M>Nz0i8rl|0BEt+|L`uY$ap6V|KkgBWBz8|89G+a83lSw8lJbGDOLc=EkZrFU48dpee66EO#Q^(`ddMBZXT8ZW_&sh% z=xJVKXw+xYf08kL*EtYxG5nIcprTy*u7b30ft=e>E4#89j+1n|^l5-Bq?0yoxKZ#= zs;g&#De@*`i7uw{sa%(00V=`%Z33c_b00{Ng=9ftIpm-Q$WQIHawZyNemjG&EXV_! z^tt&}OIw=@~ErDczF)lO?Ehbad)khY=5swCG+TTs&m z6i3*6`tmLIu(RbQt{ejT{Lkf-dsiVqEo3|)ds?UoAztYCAX)i$m@K) z_;zi8e-`BW)?hh8sF)xh=a6ET_81qDRNOL{n-6gj%*U**Ep1BDjz;@l_)z7*HvDnB z0527u-Mbu5Vs!`1S>xmkCjAL{#Zyh3Re9y*1-ZNuofE#*DVU&0R~Lj|dF9TurYHW? zhpg{><&|v<$jr-zZ0=J`tB9u;a4P&rI=~EnA_FGNz2e!YrL+6%me@Gthq-oR%lqrb zzMC7=itg9oE(~@qk~MaNO3B4W8DaQ5N%@yAgL!YYi{x-~?scSHo+oWcm})jU$>mOR z!mvwI9ox|&9Fan5XM1?yuS;nzkmce%3zfDWk_2T`zLd)Kts_TI@GGhm_scW?y zxcra)SQ0JGjZL%uM^m~3L+~G(pW3lkzX={sS$%6uT)R4{Z;3S==kYWqT&o^$M!C;x zje#0@hOIry-(FYI&vnxxHn7ZA^)2y6{>W;y^%JvZIzMJOKk8fJGj*Bzmblg)soz69+v!^87?$sKE3EKZ6`Cz$ z`olG|LUVzgI`*xxGgIdS$|c4js!SNi$%gbEilgO6&k|~JoRg+j91)SXb@F$f9Wds| zANRn2@it}3%?zC(fANItA;}He*S;yY=^#NOi@j}ZW63Yt*kiR(y9fRYx0&PWA?Xe9 znR#MtGsod}_`WAU5)1gKvFAGw!ncfBARE#fkWeBoc!n7@)~!EWSto`eASpK?x^Z=C ziW102-UbD^isF4G@{xB9^Y)}lAUC9Qm6&b;dW|(E$VcAYWGH{;{ki+2JsfTaiwz&xN_uPMp>sejJa2hYbv5Ffo=0rgK^gb|HWlDiAHN zyKLi~qMD?03(+LANPl!~!AMk4O2ZrY9`8q%IO4@rI}T^cCa(_e$0d9r6+G^Q6HG}K zp1eSF0?nxin7=+jyy01r-ZJTU#sD`C+Y=7Y+Oks8g*X8frldcXthQNOCrhdj;R>>v zHiJ%Fvf5^`^C*e6tOoea7L2SQ{u@I`I&+ObTFbq&w>zrQdbRm_s%%pht1lH~X;%rB zR;X;*E5lHQ5vU@hXLfBN$xSPoQb|@i78^VJxNRNlv=xAPUq1XYe3i_MOR_|U7f3V+ zs_dD*3ery+KaWU9tz^|ezSI)nhY^u`(-+9juHdhsJ^6lijHdEUAA#9!R3ktOG6HjN z@&Zoe^F|nEKtb+J235AaXcQoXgo517ShByWhRj?mD3%WTh!_F?Z>YXVdd6&|;INAv zXLA{br{eamT2?3j)BM%g7a^%Q0_H^iVw2{O zW5{?mhU_|qtZzR|+N?>3+nfGD2#8~oE2TeldoZQndiFd&20;PJQ96=L@%)j*eat}> z=FU24&jWo;v%-G!Tk;_E$+B38@%VK&$lH!1=ZL_0a`DV~&FM!q~;FlvCV7|;&(|KeiNX=wOXRiDv2r1#N84jPEx^G=Q zUGQNj*JIQ+_@%l;QZey|<#%yO1t)M}+{t~=o?IEW%KVyoDCt}c^pOSd$?q~P@4FC( zv)MnENUBou!&1*?k--WFS+k;X(z{6Mge?cKALd$EPZvDG*;9wy}G* zV>V-QCo!wX!uq+EMUUy^<=AFH&R@5z*-}4!u5P`jU8JXL?9@}|WsIGA+H2g+*lC|6 z%h+k3q(qB`sHb%j37pX72Y>YH;II0oc3SM{1lye0SZxZ}qq1n1pzx{iYIN08-(O-C( zIC$oNdXr#-zwjo}ue&>sENf`peRyQ)W)c>p{hYoC6-T;n=iO8E@0p2~`tD91`gQX* z;rzDXW^p&gY28U^)SedlWxP%F>+WqLV@}rJF+J<=+LaC9oU`%V2FoW!w&jyzAXk9t z*-bIM_6IW|>bir-Cgd(4`pa@oVgJlzb;O!~>6{|lHbl#{w@)`J?GV?XEhm0!-hl&_N7x73A3ll(iGhlpHY)WG}rWofk7T@ zFVR{M49)NqLI{NsQ9WS{lXcnj5%FOgdH*lKuX>ttZ8nX;KWq!a7`+z(7!Oytn%cdu3Rw07{nmr{#!(}ddV_n zKptQTDyCh4fEs2TCO4bARi3=PD5!?X&E}W-cP)%V<=*rjWyoVJFBfK7q)dh_l6ARE zp7t<6^DyIjuhkIb>O~h=u-vP{Do-Bltdu`fRq{TnO1ki{_BC#8pH9e*%UB={~4TbH-t^M|N|hY8Y2Nsq$p`qM!xv^Sbq=nbw`jBe3fn zU|mq-G*4RUmAyh12|2y95q*B8(fl(;aF1N8RqjGCO1^V`jh6dU^pPQd_O6mmTzIbD zlH?QzfLF;C`0XyH-qRU_q_iasgQ#N}8tuQd9lBRhI_gHNShLmLE;sAjlbdr{Y6|(< zKX{vD8T*p&y)`i9oK%d-d%R6@wocydt${J|yA~c;`^sALnA_er;5~FKOrFZgvZo`L zu4|WOwaJeiLCAOd#G1>bM;IYGHYnMf0c-2yZZn@{^HPbZDwuL(8;!e$LB5t9%8-ww zKvhB3wpG&2uzb*i{u$qtR~B-~@5wH%=A_)BwRWEz!Q*D=Y0CQ^QSEub7^<}$i*`Yh zF?|^t^CY*Wh&`X8}+mkB;^{d41dn;;SO^^&ZkomxD2HT;3O2qLA9|^ z9zz$w2P%achwp+<+O|ke1L(nVH=T*5wurapJn1Zywz%{TV=k>i8?`QjF;3d{zy~^# zk%Lzu3d%$@(`6`*l;#+ucLOiC790*yOZb)y;e3Z+4Bxd95jcjMUarSEQOuKnYP z8>P7x(q|R#db0&lF?^j!tV9!9A=uZ{IC2W*0)zbpci)YMkWsQ2ZkrwQ;U7PMY^{@O{_F{Mu1}g#6yU z@7KKQ&gmX&-9|?f+=(JApL6~bN7JZ8)YtWq4MAH z;Pzg%93k_J3Y6AU^dwDrkbX6grajQ608LZGpzXW4To%#QmERGy*1hg_{9um(Iguhn zP;r=%ZN1TpGr4OmEG3|ZKtAh=s}lw(LoSnslN>ZLiaoa`O>z&i}lQd4eDZJ`V6sBx4SyJcEXhOCfS z9^|lUM2)~M`Qrt0*a}uR4kMFY@;}mc0);&PZ-K6Z{D*1RN%USG!qJGn#6=LHkkH8g z8BsZ9k5;S=piYu82~+&;rAt3y)+nN@XRQxzePmyH&xZ|*F5R72A zn|%0AcRaWJ$9P83WdOn44;UZ)2N+3v5azw`SF+RKfAm)Oq1&5|53O%Aa}Wa5yeb;0 zPf1D-_^_YF3C7lyhQdLYj5O z&LA&S6())!U2*tRcCGjx-7at037W$zsi3sQk(6Yv^X}~YyF1>!bl89hL^aGD13&J@ zSd^j^^n;K>;G{hj$KxK$*SK+#)a^l3@``D3QqP~mij90}*aPFxy$F~G!%tQ_?mA~ z#POJfgtWO0*Zs?FnEIdNI3pM)soFmrk1g8YGyM*f}?%wr|BmU`WfVTAqb2?Cn` zJ)hB|f2xM0D(54?O=3&+7Jp&2o|DjbLls<~h+CZ;hWH}?9mcG^S}dxs{)7GU-JGKx{3WW6`B0MaJs}|`{~J+q3Clq|!O9T%wldLkS9`0aX4GvYKz+q$YZJC%@fET^OK}{ z0OmsY^I={KKW$MG(v|B{bmzGc=3A?BE&N!nVY^TY*x1(;_6|Rf5R{~yl<27T0s42(Hb|f9k$iwK z8C7N%sK6?*uiTOetK@Ev9SmW{#TC+7D>-4Jw^1T+G|$ojJMzW5TMd%$wL*#kS?=9I z@=6wNXYYNg5do=)1skMK7{(O6M|&|Gi!@ZiFFo3%IWC=XNpNTQ%~2D$Q^;53OG|!X zC57UH^*iY4VR$Zf=j2)&-?0>f{lj63wSB^s8?dLdQtgS0dFPUPcVwPg6AiNyq&b32Dl87zK4J zU06O4u1^Ga)ASYrP$ZoX=_(N^maaI_uUqV#HG9WL@eP~o7cXb6JDO%Ac zy0OQe6N>mF#Ly#%NPDHD6|{4eJLwl{zN)Ai{Di7>{xrM*zxm-b%!Z$s_Sv`x$K8zr zR7tWDB9Ed<^@k~sCZ|~U!ehoZ)n6XdgqilL`6nYRvZ_KlONhN&x5z`Z^d-F8yiKaV zY)<7_WuNxesQ&U$Di2l6eNyK>;(R{tUC#>wvL!XeDzH_Tf6OWHsJ8|_`g;mV%d?PP z_i_C?$!QHAXqjO&$pf;RblO5*5|Xu>E3vn;RvEHKn&7*Qc0=b+BO+>UoTd@-)8V7j zV;20dGf$2ULr$=sCwmW#)mup3l#i6itz9L0qr4|gtg*I>TT~k@z9C^+f>Lu$-|e4~ znBc&#RIjq=$C}y6Rn#_yXR9z%cX#rU(`@U-Doj}z=Gy|Cqczu|v$*0h)iTWtL-$6r61F|OTKGk17 z?9kdROt>y9e1fEd#R%#fah$e2_rWh|x@MrQhkK!AJXR|_+`Nr2uW`@oZRpm+@^0~)1?T#)q31$ z?O`V${=+M@!BIIvb^6j^kQh3bcXh!%H@fv7v6+e!;RnM+lOa}sh<2K1(hAncElW}5 z5j@jV=pN7E`S^Lax4|d#YauRKE5Ntmr$w8XTxus%x;YuqGg|a|zu9JAowsIxsrt)1ZSH#ClpUTp z0mtKyqcDxULH(qda>XLO!~a1zARjO4wu7TMhr3j^n+?*VfoJ2NmK?{F%gu&~O5`7l zf-q|A7v`UALO$AeC>J{|u=;n4YWWG{7+G!Z=3rpT%0+qHj{jn9$cKxTW{yx4H+7o{ zQ&yWiLVsNphY{fs())O)Rq^^oJVNgE_IFcXBv&uu5n9G)i=FH=!xs^dwK_QhdD0W+ zT#lEE^%O7V%dYorw5tWC{L@n-tI`)BM4xP0DR#}GE7;KcR;OR?3#~QSx2(K>J9D+i z941$!gG%HpPFKX9E)BPQvB-ME>AI1;)ZcP~IO7CU&lefK52g3;Zoo1m*!!DixEUdu zfHN3bV1#(GJf^4Yp#Ab52Jese&}^w${WlWYF7m%%B9PerPa@r=#pgH2sUOiCn-Onr z_-_TB9vOc8zqB{wjQSa8)R#8bH~rVv{+AKaXK4MP|Jq-CVXV1+R%}#r%Z&KK|5nl& zzyXxk+!=Ao{r70>+GVfx@518$UAHa!izMZCYqLG(Hn#k)7Jfb#Zq(fR>9M*0t@r5% zWYcu-ct*Twe^d9rVgxzUm1x&toknS8rT+<}cymK+zf3g8U$@h0tgW%-jCg#`e{0Yw zJL`WA#6K(E5S!jQEAii&n-wR^$6`=@=G`BMYK9&C-rAiRH7BnPNztshwaM~rE%fF+H$JOavtV?l_Rp< zFmJ|Bw%7KP&A*ve2))(K{Q6n3`nhxCGor`*dU~TZwt3vaI-5Tl=h}A=Q`EfX`lead z^m*q|Vaw{UDb_MSK38j?d7B#bc(R=FMB_89)>;~EXX}afrWq|UD@2rcetlEp47Tk} zxcr5Ud`7*q!ts_^G~RNCJsn)=Xkvb2le2*|L{8iKqs3YJrg+n$#-@h&qC_;& z(mGuOrjOy=_$+s$IE$!r?RSg6F(cj_=MS&F-=Z;h*Vz#3TvvD2Igev>a-wloOa1iy z><>cHZ7y|T4YuR?-Cpsiz6lc6-lC0~E@|xsJshhMJHfSN)1|22YI&rWg$;?g4Mn{> zznMf`yxs~Z?wv8emEYO(X2hCWnw^zP%&%`s#H_*2o7vc=cNxoh>l5`&qpe>p@p+9i zqVwbW>efj!X2qlPoITHvMB}Xb87+-*YtuEvW;&-Q1DCz-?o9BTSCZXebG)_NJ!@JQ zFY`=YYQClU>m>u67YTFp$K04TPK_mK*15fzG`7HEJ#^N*Sc`RBXUuPV}5H(pT&<+nEiCOsg{+=O?DOJ3;@v49s9@Mtc)2b7nR>aVO4*wYks88I6gS_^jso zdAhZ^)a0FE&9f7#BAPg((aP03k>zsi^~}*rp;L5TR1ZXd+m}a_z?NuG_erwA+9%0Y z*v{dV!6vLDKC`vOUbT7k^Sia?ep)TLpLQ$WdDH8gn;Y%*t+#@9h&D;kZO@BYL*jGR z6mLpQciy^LGrHaLGpw7j=e$`n=GV`#8=KeIG_T&;Nb}r{KQGbPVYS>eeSYKoSd{75J69+2}HZHm{ow&~r;w5E7de15EHdcr#4@ouYc-$pEAUw3+_ z-2yFI7mPl*Gn-=;yovcSeTsYO+gw-a#Z9e|NvnbS88Pd46OXr&+=ccw$6A`(twf7Z ziB6Bx{$QUZVi3)-CTkRl*ol4;$Bw{mKn;ToY#sAABwKiG0>E1+ao^?7C zv6kqS<{zj*SYiO&p77SHiYeoXj|zqy7iX&Sn;NYBq2H6(+?n>&E}Ru>;g*SaM;Wzte>B!?UCWJ4EzONh2^)vZ zB8|ZgdfN|4z4KHVdX|}GSitJvee@=^AEmzg6KNjgSYY>a@S%fk(j>Ej{Ye&S8ief+ zXo^SeD>#d^hVCfWQP}S{qb06)Uq454zn?}<`O?maHzlkCB>Q{S`typIF}FUEuu$2a zyk0UR9H?(lLU4#hbMWV&Si&(L5c_yBImgq(7+xCE76Lg5G$QG!qSZO6*QgxnQHF%- z1zAr8I5TBF$^WUtO}SjQDYDVdRoi4h4H*BOfg+_xfhv-l7v?Iz{G~^YDuUd^56DwJ z7#pPwvS}eT@1|O@BWGV=*c$CS$63IrU(5NHwp;{v4RUnph97I^PNM*suHVt+0-VX) zNwM!Z`0<#Nxh9kO2_>zi%$)=OSR7Ab@}N?-7iUT=+kc6jnG!Uuzh)fu;*Owu`@WDd1qi5VkVuKPM}3=OZ&|dR z99F4@Un{Mf-%1;~mV+Ix<<6iB)p-nm=E&1M$GPbj7z5yUTt5uYq+hJlZ577yO!}qT zLA)I9bWD>e%F5~wm4Jl zK0_-e__a0xeIoXST&A4^PlJ5!(aw42aJAa5KuEjNF+Y%$E6pwsxg9>~wnWwAA@H-Q zrA||OJ!Mpv)lIdtDVj@|A5fjiHaPKAxJ@mQ0Xf$kYr8hf=U*|0A##KyN~o(x8SI_f zTR;FufNG`GtkB%o);ub$+h=l()8c4(hFf<$nW*LtYM@1sAfGHKWko}WjCx$%*K#ZITG7<~@} z7{Eik1+x)>QABOCI{3BFj5@oYQZLoopj%I{A&ALg762xlLDC$_%*Tls?6hAVb_%cA^mVY6Bwq6DLS(38YUO z{3oIYe$1dkxMWckz$lPbDy*Aw(0vGLcTRHpCMgcP=YNvh@Z-F45x|G=;Tm442c77Q zW2;jtEdTNj$O)95juSy0M?Yr6hbFosi-5r;iXhP`ki#e&o)%vKDWrs(IVQ`8Km|x@ zhm;~TS9?)tDV38d9dNduXoDkiq&|%i+VP;8^6EU$MK4+UAtWgdD*ZiO5mZQmn`HG= zNmf>JQXPecH7B`ky~Lqu=Y7bh8&^JX9O5KNR64;pJXLP-kNLh}9FEcID1I>tsMK&c z^6g(E5LG#l)-6h;M;U)E%q8DH=TYA2JTUX9htOGRjJB3@mp+KH%w>0qsSf(8q@}-#yn*Rl`jMoKMr$Xx}1+YvEs)kA(=QK($ zRT2CA@z~fq)pLqHRpaGqy&Y)4;Vj|sOy+v(uWFr@p1VOU?+8L#%vcwc;s!Z62+1qp zOdU^Gz6?4c%1$0-EkNDi`;>vJ?h+Rc6G*gAdawZ{T~=`l<`#u6kJL2m9S zuhjy$(+la_WEXOgJDzB*}x>x|0)N#mkU=e|@v~;ZA%K?;*EiIKBI!ojYMImdT zv=qna$gV{?v#yl3JS80VS?Qn}FBf`iRFx5am z+YP-+@hQ$rKKyhW)bSe6Nod!ZariM(^@hwWQR8JugLbF-Btyao%RCTnxGOkRGmwUoNbu{FKalbH=)x;DU%lT>ecSRct}JY27QdfipM<<2y58|x}@x6*m4 zOrGxw>enJ4A#;RmWH7Rqx`IWt_w93^9>=4498X!}c<}$japZR!hg_Gn3RRFNyLeTd zqI%2KHpBr$^~Q(%-BZTfI-N&F9YT98q5V)p3sa2sYLaY7Wp>hLX&aGJM<1fm#Jk3Q zX+4%Ng$wi5(emWDVT?>hWVr$Xo|%Wkc@nNvljMVLZJa6A$=8Zh5f{6x`-8nj4tRXl zI3>o5j;TdLv4A=!L8^{wy+b}_JTFTTz*#Ou@<+Sn@v=*ZL?MI<=hZCFWS&Daa1pMt zNgO|b&v=dDcq%fDXn@RQPz&0Ggg~RZ#-NO7keXUZFM^Sn!p}Lil2srbQ(%P$<-Z}6 zQH4c^?F>Ow6Q~6Jil+fmS1ZkVe29BDAgbL;=Ogqm9ai#0yxJAx&2Uyam(P^krSze= z*{GIxlJv85q?#lTBr~hCUbWelk>?^L6Kkz!nI<;Yv#fQi0ytT2>*{{T%k!!XQQ|Y5 zL9W^hDvSUP8hLAWzxY>m>+5;dhLGHpu7$j3y}g%o%Y8+)!8fD(!~1d4IxQS!0B@G6 z@p7d>bdc|Glo#bwI2z}YO>lY}qsA{Fc{wb));fx;O?W zX$A$c=_;Jc*unAcY<6-XLCI{yZMlu22o*^B|AAAaxs5HzR({RD*Yx? zC)9qEmHQ@ZX2=n`Pr8vifjtm!h@dew6#-fW-(7+7ZZEa!E$?Oq89>55l#d!^L^x$( zyWW2Cn)m;JO9l45*C6L6H7>OynYrDFOue1VlXXV1ypzlW?W6p9+g5@)s^-nyryJ8T zhhb3O;GQ6Q988WkWW*-r8;xl57;~2Qee3rob-PQ9u=Upelq`hx)-N@7%kSK`e(OwoLJoLYd1l!q z#>+?Ahp@LyWy$58Q`C6*TyLYtI&)!fqiQfJ+B*-Lr1jwe zhc&Y%lX;z!`G%9ZGn09{mFXvz`B8hG8ZXy^p68|^KTl=JNA3FjUxza5G7VxpLU~8x zNbOtRukGf1IMKOR>&~!;n2eW+T$j0X=2@k`H>9Vi z7RYO!GMEpmEP2f{3_hmZo{q_UchQE=w&87&vq(J=bqV2ggf2Ut-M{DwTeWUWe^r18 z9V7&hLc|!nOJ&Imo-kXyCr#GtL%&m5Qfzl}N}l%mx6B#r@HuWbYqjCz@20Ju3S-nR zgm6E6DH?XP&<$^Lq5GQXJTJZ$QolseN6?^wk2P6k zHcx1=Q=v_MH6SNIA1RtCm9=Ct`9g=uQM=j0sk{{>*^Y?O)51y1<91JNax|4~=}B?q zY*hf+jIe5xXW9#CYHF^=Bqly%wy8FGbWtHc9y5ojHptdR8&HZW1gOw!9Q!j$>C$BU zUIb1eHS7m}`(Yfm*D69cq&;?%eN47Z2UIU9$`GM;?un)Dwrj{AdFF@86d2*+$ff_E$p^c|cxN({`roGU8^-6Cpq`~y!LyIhmjeZFt?vo@`JJTO zt&r0yovpPq)6ilPUU$#t9-hdZXj-&y1rrj|x(TFOvaF4@rq%6#8ClsxCa5exF)Zjg?8~yA&sNarwEm@aVH`?-&Q=OmGD0fIcNv`#LnZvmhy?s(zh5gKL{T- zYNoOu=4kl-04n2#CXt$Oj#c?0yOV4=VnEIdry~l6;|gISk`{k1dND4qL-ZzGN^i6m zd3Panb&Dx7j3(d{5!D@-I#fd)d}Oa;1pgjSwxC(gO69xw?@`i1pBEhsdOVe7(Y9NLq2ay|I zG_e%^lj<-T0cok!Mi<(Dmh@ULi9(}DdhM>8CW$LnQzyM6SVu%*V&##jLR4-_Uojc- zZ<-N8&Zq@#%|g;^8!L`>D&EBIx`NtPWujY6{^2Qr^k~q)hUC0-4En_?mfMIz|HZ?= zYI0MWXnj5s<_X%(!%9B7w~-;kvB~S623emDN~%`=qJQpTl5wc4*T2G&u4U&PLFwI4 zHx0%R!EVSU>0l5y^LhMbXC(;yf7zMZ4Y@QO49e%8Fnx(8gA))MaRoL*QoL`B~b)pmH^7rLW$ z;*?e(|AYz}Ra#OFQ<7hi?@GQCrHG{O&qN3x>gzc~`JUa@@Qd8G9yJE!e0n;fL;}{S zu$*HQqe`6)IWtLiNfqgXy;i88*Sj{5IwPrx0b& zEVL3nyotm~Fvsw+Ita^*cf69`qlr&5M8_M=*6#pAe5eAsgLYN)MErbv9R5GT@1P4? zSK5H5^wXkW+?*vytcJAZNjAMvaToDn9s=KCIG(;$w0QGngix&!)bX7D(Yv@MNOKv5 z`X}h1gpA0LMo}XO$sG3qUUQkj_+zBE}Va|-k1Xr{el75%=eP%ZXChLu6i zh~-IF$y^nY7(s>{UM5`(w;#ZfM1{Hy zDGwo*Hp7@C?X14rsA0l6$r41=d)@#$J6gTxJ)J+sj+DVppM<4R5AztvA;s{k_q>qC z7|R791B4-leB%GUlqu^CK*<;BJ~wQ8iZ@w=?c!M_)gj~Z^hM_=3lf<9WTZc zDgQ|w&}aNq9_4YRTzAkF{1{%G(!oeml0yq~9#<~bBh`+MnN8+ zS=v+j)?%|GGub3uggDhgp;tOA?UHzTMndB7JS&iZzN?hqoY%1h8 zd601hr67{2sF3F%2 zub0U|$ik)2ZX~cAek1Q^8DFiz{t#nHlj|4kWK_wc=_y)SA;5(~z}zW;eGBSwk#M;u zoyVg>Jd2ESAFZG{>5$$9h>B4r-Ue$HrEhq`IcIOeW|`wUoEv^qX8nF75>txMhr0f; zdWxeJ2uZ3$vqi{$VsPxwa3YpTXRbpE?R45$>XpBH2JjlvLEz2m@q}Jw$*bOB2&tuB z$epR!p@$=|k&K=f7-37N-kXX`W3I}QkKKY-rDD#VQn${Aaj91`jIN>kr#n!lt8Q-( zBBJPW_jZI4z{8a6`$$pp5$1nSV4TX5T^(Ck?ObvyVXlP#qzbTd7O=31`>&xffg+Oo9*Crx0et8^}D zJl7(*{FcmEZm{M%f=iK@2x1DED{UWR6prTk>B)HE zQ<2aZhfI$-I7<1gb{D<)zH>D;r3?Az&mKMz6_Q<0B#Zb6+@3B(fI5+{dCCqgBFd(b z20sRN({;-3xme4^^7TCPPK^+@Pd&x>-EpAwm`G7`w_C{X zpc=#1yF{ga2km!z3~jZXiY zPQP6L{zU)&PM2A(%PiIDKkD?abozxleXUM^FI7ThQlz-FR7K?JRIchJ4{0T{zVe}` zTJ@4k(ra5)L|#k!m5|7P1lw~vcouzp6L#4 zfK0b&=)mK6k`IyUCo8;RL|OA29iXQlLouj9FB3Q^xn;dT}e8d(*Ay=k_)UF z8`6cUuY5rxW5TmCS;+?_y*;eSvlkIkedW)3TotvDMYSB~bNq(m?*|>9OjhVnkl)OTr%BI;m-~isQhlXp>538s!$8)rv`pp zqDkF0SIV(9Q}_+5aE~%w_(|y4`;dih+46hbhQDE1_L~pi#hRLl(4Qx@J^hdlSJiAy zrpgOs(Q!~@<}t3Jbmj3PmxEWx{Ggy%ZSX=Cr-GCcP#G?vXOPKqO{!433W@3#;b<Di&KSGjZ$6XJFCXBRAG@*c(=C({;@hvY2R>zYLHjDa(U&*ZBn2bAa8bA z`}b8L;+@ydAU@Ki|6N!~Ufr-gn)7D6N-n?8otkesPLfwf;SUID zUW#_mlMg?G%1Dp(yh;BCKQ{8!;(8PzG;0(oDk4mD`pF8Uhx4Vakbw#hCk#2okk(uj zQPC-&uSq{%WOdRQercsBk?Do-i@XX+mgr0=ptz9|zWH$^205Fk?oTen8z_b+il}|B zB2rhb5v7}3;FmrHk`X0iK^O3?lx33rkQn4J*S9*kXL;pd z>dzjF1zhyDE96-gmN?m=L~qF?klw}c5fTggnH3~Stud7VJQJshnwf5(gkbO|ee%=9w6nuBq)XX_quhw-)B z)A4M~?de$En1nd(dTir$0!LErrj;@66iPRU?hzLnJr26_3aQYY)5V>`M|;%n^g^!; z(86d2v!Yw35OHAAYP?#Fyj`4fS0uQ#TeU;AWTgQPz3L2>>R2&5#!$E5z3ny?El9li|AP#@R?sk&A#T}(qd!?d8 zO_JkkFqj{qN+Kl_K0*}=)M_u}p|nof>LK!MRDH*x=!{3wK`c{~Bsk2$Iy_IhjbGyB zWl?HtIH^hUqbGc#-rBwFYavtiaw0>Vs;A-8d`&)Ioq6Tj_mH2;wlyQkpB*KMJnmtH zFiLW&Aw7yAi`q%0a!a2HKYooGiIzZyll_-o3dv%K-F*0~;V*&@qv4b4O){!j9!Y-; zd6H^c57A}ZGn$N{(@l9GOuQ8Lb2IqL3#zN$$2Q?Kp6y zw>(W;V9BKtZb%+Ylc(s{%WNT?>%BzfDT@q?Swh5LME7fe}g)TDODPam=A$*u! zPq{Iv$_`FICfxhScgp^te%(4-h|nMRQ+E7 zXCi`o5kWy3Q8}oMUKJyljL3N~eIf=PzMEeQ(T^u3lRa^l^+3-VpaXrX2qO;OK{;WF4OP&IiB}+PUkziXt zt2VhfrBMxScV;17ztyV7i%9z$hiY_!?-h0N9rVKfsQ5+Z1pTeg7e!nVgidrGp~bJd z6ZF3J&{%^#N2-WilANN(%4bFm$9QQnSB;g=jTI2@3RGz)>|zwmkncTVS(>g@)8*Ta zLN!*FW;HT9gmXG_IbD0Q+Dw_BCkL-OK@F83leKCrWUrTWi#dan zrbU=M!E8|T?4x+m=J4mAju6&WXz82P_euoB`;jJuwQli~guF)s{IW1!PLho?Xip?d zP_WGOrTiriQE@>{hrHH7g~_py+p}u;y}ctBrz3(QrY+0jCh+50szr@F9)aJeq4HHK zPmPsJyel{{pQrMyiMh;sA0m?=MjMBGdnYfQ5Zm}zg~>s03F>vYDP1egK{ZtVo(ihz za(34REOQm(14DAc79A=*8`L4Pyfc>o{iarpl?_=9GON~UK@FAdsh}Dw=X=>3a5nBrZ9;%uzv?YR^6ijZ>q|dFWZQuy-Uk4!gN~}bynZ#U|BxVV`W8ln6x&i z(~v(Eer<_*TRRalUE_6xal#0hM@Xn@XAJp{cgVE}%mlS6LbM|a;TCQ| zG24#QBAp%#b8{*vX$~Atv@jqGNVHeOFX>t`*h4Tz>I;Aa<6h;~Wy7YQlky}{R6Xcr zgNUNL7|0G6qT4AARHw;?&Js0N-cV)gG|2kSTufGDWv41rqvVxEamuSmYX@+c8Y|D3 zHRDjl+vBSCJZtGbMj0oT+-Rm>46;{+We5fCKKRrqxqML`m-$nZNf8Dpmfr^@9jxYkyP6V~ zIi;e?XyirFT}V3O((fa#7ag18W&|X6J!CFvuG1j*ID>dGOV8xp9l83>yHt&pD=lT` z(Z$sAr7i?jD*~Vu7yVw#r>S-lMi~kJ`|c`j%b|<))8wKKuF}7)wlCxasj>277FTK0 z!e6Y?wjMRsBCT(;7wL`cGDJB2x3x_{gu{M|DNpebe%2mm!lfw2ay3*Rjlf;E`k)6T3IWKG;R!M=I6;k))e9@t zSov#@u>O4o8~9s~0$3hzL!!dn*ACX=(epU9aiThkIc2XQuHNJA_7;2;dJ8_*Zf(I! z+31C6fE-ohEFPmMQaTx;)nDb=XX6@a%5^ZI@(6T{eZShl^b-*sp z=F+Wg-Dl|{^0~LhI#&NMxne^h@3n1FW95eIGJd?tOi zXK^Y}1-Vfzk@q`!RsCWau2noFqhxh!pisKzn} zA?Yj;e|UmKgEF9+;q5G@lF06T*3y)I!w@>qV*aVkUd-pR^5yK8!1FKbP2)NA^lwWc?)eKl4-)oc26%RXy5 zR{qqpW}J2U9$aXj$ESNNu~IhE=RW6UTaPkCUg8@6xJaMJrDmBvk9!vJnL69#if>ui zZN<+viy^x@KHkrY>ud4stTpnJ_U`E00W4Ev1 zb&MZ3d5phEbYF5vdWt?uP3+(qzAu!W-P*!u@XelK1n?UikCl_D_U}XF4>+Fd{=vd_ zmcPCSU&acMX)?I`rkCL#L0U;@J9k)!DBuKgw5|EL$eE9?EFdrJHXmP^d`J2A=nc=C z_kjc#?S)=7ngys&4I1j3LfJPoR^>`dqj z`ubjBwt7P%uRG2#MwVpNsIl@&b`39Yqd}b}|5`|Z$3iac(Znu3)2&+P^O7F=e6CHm zJ2&d$Pu->Xj!Qx2yzW5?P=z`6f8wRLc_Kn5BZ8+$?Mb7nB~<>I+s5UL62&&2Qb9Q< zF@?`)uNrDnsvu->A}+&g;3IT9dzC>_c`7KkCW7!Y>HS{e2`5Wdm_=XF(|2R9VjMn^ z-+xPNve3ZQy{h^B*F-K=f>ah{NxD`AWv_?EbsMQp_}g5L`)w&h6^q`UEadlg!_uze z{(ZVfgH}b-ul8##Q`r0MJvb{$RrceIRIL>EVC487Qb+Klp^L?iYU9h!rR8Qf20a^l`Fk# zxQWeMoi5713u&KoEc;i3#|05Spnp#hds^w0tG&fIp9*G}s4uIOQ*(_|bBugRqca=} zdE2{Q4V4YvGBrjX%_^fH%rDoq*FtVeEgeEy(agum+*L-dHPhwa+x?G`GdV&r%G6MK zO4!0fU4^G0%IErFDIiwcl?NZFhe0nVNAi~FM|qK@c{N6!@|3~HqzBS*HAc318W1Xn zJeE@|TUra@M~opRt^fr~&%$T)u|V+r;DVqRhyYxp0r*>2q3S0$=?+dnfGG4|JO#*O zA2;hh-n0AIkW(zL>ps?I8eW`fSo>Szezp;5p4n=xSK_DqSs1I#%O}>)wqH-tlgn+1!Ot>KxXkU0m9h;UM{8dWe3{f@(`i9u2&v}QRMr`>JmhMe5?TKJ^z8iXAE zxw@a+Df*dH#OZn2VyFGZTa5(d6;BNYV>BX!;l*T$8Y&MO1;3}NwU*6mQtgrCT8mIt z1(02y0$!)ow;Dq=yb}1h#rv*MS@Lc&SB;Ttj4}k6_K}|4t5`(y!enM8^x3p5YB$lAPjQYD3W5+q67);tp-H4*Ysa;=4u z-fb-5_lp{g+l{7oD){+wQZLj7W4(CSPdHvpl$VkuQXrd*u$m~3C5hqh(}$#~#WE4{ zYI2X;GzP1Q@**3PJB+4<$1#6TGTQNsOIX!CR_8zVuXgo3snl zysaCxrCvlEe!X>y#0f;y+1y(_71q5rMqU$rt@*ifG^OFpF7Ym%2tE+DTEK1mj;-m*Ehh48)MrKqm^jMJi3TJzLIxxM>je4-~@PX^3`t;xPL zxzw7Ge_4~gQcw0jjiy`mgj~V-f&9Z*f9pgwQ7*G*`U}dGIKq%K!aBnp;Vw&{qeTX9 zc$(B0xh-9&hRQ3R0{95 zssRY#WHnT#vz^gpr>kOlHaW%WZoN?h9aXIF5^1JZ>rhA?%N@RJ#lC4?Cdpj!C7}=}Jm?ypW>dUi|*Sh?rlbznAigCs$jJ%k}3@+jf zcl?i=1JqFYNAEIraz%3BnIl0xgivJoxCfDhwaS z(I%}F0qKendkol!fS+;De2}baZV*y5Q{f+p>&V`kB1SbEgAb)Ry#*(+2T4?tDwnxD zO$>eKupzc)yTE_lLn{>ds20X~{(MoM3@%e+yqnCm9-3P<-YnwFHw@UG_oxnrJtf@ zi}X|Uy%|Q)QIIo}OW~I@h0NgqUnA|jAYXp$%9XQ(2=0hd_$HAy_47Ez$Y)}>FnVj9 z2>HA<&$^RW=9KaKU#+>bF<6a(T$B^0Mq!We1ZfMZiSkoxP>qo#IbrD+X339Rxu*6* zbWsjxn0M&6t)z;^K+ex8({Io>y54y?O{}zwACR-GwtLgp3tcqz;mh_d^W?i8P6z+) z-obL+0WA)wK2 zuw+xE>K1Rcyp>vt{QN_XmG3)CRkkpC%=K$zC!M zheLkwltGrI3&+7PrXhC4q9HhzIyin_npA?~ zm2`CxCgYfue}ow13KYSAQfZNP4a$3~Xox)ASt45$-xWbYK4fFMP+syBV5% z0b4rw1+7k7Dy3%`Nq`XiMI&`*e8wjqgTNf*7Y!+uA3928NtT{3#n+7pOZ`}AtF4VA zdu70y{)`;mVxqS8(s)HXzLE~+H46wE98a@tda`w(JDAVBoPR{9#^opKaV5=_IMM$|(WR{z zTu*a^8Y<5k!_+9bKbflq>LCmPO>?uVAzmsRYNra5C5!%OBw4GnMXVWF8ive`lCygFy$sMja-eRc$bG{q1(&i zU)jCX$@4rvPh>ZtLo&!u3AKKJQeg1+0T`nFY*U#2bv+L4x>5+5z!7@^Dz-PiYO}vz~4s#`Z5u2p>R}PzQOti|S?E z8h$J;8b^)jx22tkNl2AYUY8|D4pSxad(yC%DLMnAqxBNHB`{Vn!-e?v(bz#L_4Hq2+7C-$Zvx@+Omb_ z=A+7_R{=t@C0$5AU&N4POS)aR^O%PXowRR5V<4~Q@XMOKG~422^(6xorc++clnYLg_NAS|_dwNEsL*&QC{cK9v1$)#$jylT)r zT^-~OeN{ZTTrVMKdJ=q-aLFJ?xUS%ell-|1X5jcs}K0mb(J{JChM#?Pw_<}s=FU5X}hU@@Ns=Su}NJ-uFpr{!T5$ z$f6cV6PJgM(vE;n+b5ii!JrmCS@J&VTPjdql8~!ivokZHg$w zmp*K*T-^v4-tRTM(z{GLg1o&7hRJVp^=!=2Jc#4aV{lRr7~tW8ntt~&-jYd>x%@#QbDICW`yQm zM}2RT!4x%LhX8i45KSTT5o$%0Zs$(hg(xEw>&Md^hmbi`d+o|c=o3jUm8@dv$djxx zN+GQ>{SYGg2sU7TN^mApb%GqAC}r zT+&X-a{-Ke*`;>tL^-c>JEAZa(Ql9O>+jikk=4@MYK_X3Te>%XozwVVoyPy_HhxWe zEkbPkaQVz>{4%TYgl@cKx1O{RcQ8T|5R&j7Y?k}exz1)BUgR#oTHXT~hp`Bp3pysG zBa4tED;Ge_9gMG^r)`Zx#;?9Zf(KB9RtMZja(6nO*|K__mv?RYFI$!x}&i&d^XsZlsFb_mh^Ih9x@>0IYt zUsG(uI8a{adUDdlyP}RaD;4Vll!ks}gw;T~G+Dxr&$JFeKn;Xknj{bIN+XOAKmVDe zr`SoP!fI8%#_9*kYZ{-tr4O~CD5D(+d3HgbqzLdMeaI4Kmq#Fg>)~VWiwoMVWxA&i z)f@&w{s`&-cQvmi!{bP8@Dn(^=x~j``?S0FQShMvKFYCV zYOVYDjdfS$8M3JnxQ!4m^>Q74Na=N0=A|x%UWe~fK^jgxm72ot9%9G^Vt>4G?@GQa zN0zC9^faupWK%Lv4U|6{^o092GNgZ-%PKDz)s(ytcskjtzzEho%wE?&PElE$$bll% z4>^ovF`Z`&ghcZ|ql1uqnW9F~#d@QBkqpWzZ&;I|a)~$0coP3g(ICdEP3$K8~sVc%(Tma#+)l=ITmXE{y2^-xiCAmsdXA!pzl4+m|n*|~Jv_c76Q z`O!1Xuq|cF1Mbv)%&DXFH%tDU%2NX&o4jERhMbnm;q6K3w6ndOnBA#dHBinWm4zcA zBg$CfFR4QK)j-H@51r7+QN&;;L2h&X{EVK9x&EulFi7P@dI|j8Iv^*gN`U zyytCDlVqvu31FbSFKy~*xoBJgoBwxsiaJ^@7&lDymJg1fLbaCb$7?^MI~~XRHS$oH z2-2Hspp4OmJiI(Ya9_sqQg_@JssTAK(5j9zc1(jBDCK&`Z1oIdZ<8t!VNU4|Yxh)c zCpUzz3ef;^e|E#~A8Ad84flNF>O<=RxC8Ymy@%7b`r zX4T?2_>r&II!kXjzg0qmah}SOtzCI?G##tua)REL8tCIcNAJA>!+5B0t{NzfwK3Ac zpae`h;|S3YuY0AAcUR&CMTQ=E_>>*`xOcX7wYzuY!-{)nCk>$>m!wO0$qErjUWxQN zcs~5R8A9aMzwIeN6?f&CT^Dc}f0k;8*642 zShVAv$vi9lHKPWNEp%L`CdrlV6**9zQ{0s|mFjEja5@w+654&m8~W zND#j7RDqUqM5yvW$HM^}OB+Bkm~7~FW}thT(3MIaO{PBWqLIx&$SMiL2VUNjic~3yZt8a6d5{1f)k83pi_M1U2VZ4he&HP&{eUzsXV{yFlx= z6RNLLYpKvB*$u3-uuvT$52tfEm{-aCK!rL)Zchi9@H$5i`C~gmIFU!Lwbm%JMzT1R z8OcR-l7eILI=D(9Y_6E(6dPV)7du4yQeZR=H<7XDTFhJPe`kk+V*4 zLE28Tklao32*~E4aP2N4*GC{^wNgPs+0uA(b!4|@TKIr0WVUdEipV)s{jhkB$wD!T z)gkg_vJi*zvgg3BllF|uny?GS=T;kj?0_CAR_Z?8qFXaXuhayrgOFH+9Gqma`W!d9uHY*rB=5LpkOd@lv$RDf>KWN&925xl8$b6$l{ zzB*8DKjwaNpxi+p!6$z`P;MUU?hq2#`|0-x=DvQQx_;)qc%a;0v)^Y9lslevw;rh9 z$34v6e4xtD>g;M@YU2iy0_M5u)O$X}xJ)M2+folI0iwXVJV zKz;Al*=HW8_L*Kz%WmTUyJWeSO>s31Y?+2=Vt2O7=4b@sUjsI5EH-Bh_9cI*0lgI#~=J-`}Y zYH$nu<3F=4KhswmU&1FJ{AadxkF3?T-|-$`3*4%+w;!nXT{`>u17-io;P!j!K-rJz z+K(Qn?{elq*vgsBjJll;)R6d_tt=2)oR&Y1h$u2%!5);UUA zo|$&~V0qucbWF)20pfGS-Gk+IGMA772y9--XIC z4v`TR6`=N!Z(;=z3Gz43rGVD{ua=1w6%`dz)g<}M!`^79Fj)TOS)sDzXAe>C!L;{@ z(<`5JEJYC#Ft28pan4VOn)){GT7HH*kQ<55kop`@#`^OrEt0Z~q~&0l_%8C#C9Y=& zl3A0f$UvwGl#=v)sT({iybTn2t8ms5&LM~@Cvb(!`aqVRxmH&Lf1ksoBSD+kLRx=Ekb@r>Y2 zPUBd67O{+j_|o&JTlgODim55OHx(m12od^GdNmc~{M_SR!NN!ER)b{b8cv4N0y_z9pjpa;(u93Okv)Snx9Hm}5ura)#omBWILyjpJHyZ)@O;E-ZOGODT zflnL!5`QyAtwD$ic-o#h0y#QdBDEzlBuqC2N%B@=kY6=0%9^)k9E8#%bCv2VCk54D zy6*|l1(_t@6{GlE>C|BriV!j@%0W&VU2A$*=;_^>s^sSrUXn*uYOrieaiG@JMX`>~ zRirvdqud@1CDKtMC&p!T7<9WB(Dn?b^jM;@MA>_iMw2j(*rl?_2^V8S5d)0 zZbhXSOMxm$H#v3*kyO=7?$L-bnURBG94hyu_Amny4`P{|L2A_X6kFHi?xyuJAm;_F zgW0dn3Oamws*-2KTXrh6gy1&s3R}||gE8F-+5MWgObwO$QhC4EJOhdlxyyDZuTY~Q zFGw*gJLDtOV7alY4O-mXKPU6LyT2U_ zxyD<@YM-zguZ={n&~}z4n<-1gD`xd-T!nc*8GSFP8mn`z!X6-)l*RnNt3DSD?LU(g#jE>S~?MR zD6K<8E8H(Dt)Q#b2%;y_7sX)Gs4lOme39G1lh&K-2i3fI@W@RqMIeu%J*bxDCkf3} zCl|(#UGR^l^-G|frB6OybBS4pTs{7!%uI7%==;#&^47Jv9sbob00Ep%zpNQWZ6|w( z&_0Ta%vq4Zyy}KP=EM*(=OP~w9E1NKYySe?RF&?J;2l)F-$g}KykGEw z3SR!tXYFLSbIzReJ?D4+&pa~C-fOS*u6M2VuJ`^@NNLo=# z%G5h74shrWe#vOVD)#%EsY|^eqf6!IzfjHVnoc1S&HDwet!lj;moo>hBvl^1RZ*#z zjhvdJQL11hwDsAyMyi(j)Tun&r2H~erl>GJ=?F_b8(*t*x6I>^oDyYs} zMKxIdJ~afd*rGg#mE?!n5$sFGCO+^vir;d07=+Xq~`2bIdE{ zaS2ivt&PJ>B*7fK3wqrp-94W?#A>SaB-UAqBJv!y@7X)Yc9GTfXO4lnaRy(=&{A=x zhG+|qVbXwxo@RS;$QPcfkIi*$L{^dr`C6iQ&*tSZ7ALTSbKaTY>nfFpdv*R?%*m<# zfBJ^ebMQa-hBcGV{5?^_>)fbj&kM5yW1mD%ZB-+1yOSQsd1AQn>1;B%uzT5ZrEVD% zO^@Fe+7e$$n0rt#FUL#YFVg6*W@q;8V&^v$Dyij-=ek z+^G-1gR}Jkc-*NEz{XUQJ^@eJiS%W>A5+?;Et0(;xAb(o%}FyYYr4d#usZTMN};lj zAF;gLs9x7em_A@S1XMjEfrZiV`dkYUuyNc zqz^OrjKHCE(zqht4wor3s?oESjs?>sewG%~$-(|Wl4Pc(rlRqIk%Er! zDDC9L?cfnjJAa%VW{ z2G$Ozpqq#whgk6G2_OLY(=HvTwLgFdcRLQ5yu0G4>Sf3NhJVbj9!EAQPpzMZhxZIl0 z1GxipKNmbTyT*wJoFT#EJi@#!xCZ{;RUR&J)=uW(-Z_(pdy-(iTB7psi6g|P@6KdE z=p?LHjWWS}EJ@mem$sMapN+Ddx&{U%#d+DpNnK15{58pYn9KzMJGaSMfPR$`)HT(a-A>azSEQ&GcM~U+`ySkm1_cxB( z(?lD!)S2o*gahT%@VO5A^Ji$T)65 z*taSN*3EQ@_P~81H$fcVJ=4YczMR{|Uw4?lUd`>IsB@C4#24E0i>jMET-~>8!U9!^ z*Jim?kyhH|;mW>jI+hGzR2AU<*)DvNqMy^bE>(a(kUJ&wy34Et-j~ko1%jDPDu9Qz z6GxA``>cO;cW)|EdAK{bS_QCurd#FVKAvqAz%w)T)?1(Jr6c?^`rZ0mubj=F+w{+W z@Ex|zBs%ZQt{jn_xJJTktgf@+Hn|gSl+$!GzsTFXi&1 zFq?f|DYPqhi%*A48|!seIFh;u+CGM}@vlt&<@`e(_sEY#Kd#JWdOU~VtC{4VF3;5* z*kCe03$=r6T#%-(q4BmI_I($E=Y6UY8(O)S&Heq19*8c{PHyv?^wy_uTby^i;IV#DaZWDR zO22w_on5fMJuLIt??Okdrt0RgT|)NZEiMN?#HzmJ76fm$x=5UQxYDbgnk)U>$_|!? z>zs`yS9yafU`RI})Phb#=U&F$Iyp}Sl`&(K$<=MSF+)uMr}ytonf7^jt*?1sI}e&H z_4HkoS{cOqI?Gsg_q2VR7mt+6$r7y4%G)9Vx`du-^oxi}IhM_KiHD?H@Tv26rZ1uT zfi6awWYG=X*3i%AnnRcJMnXrg%GTXIjpp{xTy|AzlHi5eYgHaE3I5PY--uhm15Pqs z5j6?V%nqB3(gqW)PtP{@(?TxLJp?j&AuNn`z8Pj#3yfx78jp%R^zXhCc}2KHPP$(n-gU^iXN3j&-)iR zN5PPgpuSEbA&zD6v@pYx^VSMU^Rivis=b-sF+wU23(W*@duM5p9Siz|*klV2yWo+& zA*q)*1`sJ5)g-((i_Fqv<~I*zzIoLA=3?`keSMiVIxTUTOTG!8wJhcAuj?1p{O6D7 zGi9LWy%!$vjj%3yJrDkZR<|n0GqzeB&`7T8bhosis8I$f2UezCs$B58t(HAq)7L9L zIp%C$zK6lHkC)n$=kq$x6Fhjp5-|nU$Iq`Z@&3R8QHi8*>I#9kmSphmF?82g4qQ4T z^VRp(QL;^r3&For`drgL;10mq-icf?s{zDi3r2Tta&H+>9(48iD6ZyU4o4!)&$m zPX&Vgpq{!vE*t0Ovpu8z_zh9s_`Jo2oiZ8wJ7Oexf=}XgsuCMp*d5I(dARd{E;Sh2 zv=|%TrNxGSO8-{oWH6Vah#5omg?)-`Ge5v6PJj| z!e=N;_iYx`i~r?Qmif8ue7F1$LzsTjpa&VaB$)pvS~QrW;6FiskuKkrc9#n4{uue> zB3c=XX_0^}w_6b1XhIa16O{uu&Zsfh>BIia@Z=mQaT!h~qMkD9T!{+`c4G>SgpA%I zlOLDiQm^ag>quR4(|_c*NoKey)%KZsDJH!YoF3DJLyYm%mflNg_6doYl|T6hfsAPR zLY(v{=KuYL(vuP49E|(yJPmO=@x~eVI?&t|JMXk+v!Am$M&fdTs>IdjbDNo$=NAWd zO;!QCaXy*9&J2^e?ttlZ#-EY-`HYThFuZ$}1NUVgZtqVQ=snq=m-kPoO6=1;_quyO zJus>Qf+x<)boJ1IBw8n`N?fd)nn3J3uq&l1u}42LzxJp+e0w0tArAaTRpP7jdSG5W zfSg4US?PtU60i08j6!|afT(ydEvA+KlxMgk#S)P@Ja%Q{Q~_R`@jvBv^YGLGUP{`i zr?EwEV5_uJ;W`V!4-OcZs}T$%sw(kfFL3YH;69)#@lY00YS9ODNhC!zr8sZlo{+d) zqa4_Mew)g}^#{~W)>7eo!7NvgR-o`6Ys61EBDL-GcPy4T%fM}JeutP7Y#HEZpQ;h} zH*5A1PY%%4$sTBK7N6PXi2+g7h|SF_n5%|VcYs$_;>KQ(f1n{BCV$obs6}*W^hi)B zw|Xc#aM3R8nUmoC0oty7RZky+Zw7S9+45JWlhyclq@)cDliU(ye}NFi0=EDO3UT=JHaWxcsRYZc%lTU z*MN#P(5IvK7_}VZg0vgI+c-uQelf>Dr{zc6-7|`5o6?${>(efCV!Lfb4|DsclmpAs zF7Xlik8RXPT}ciGU)wm9BF4W9jb|%%U`MX|}%~Yz35F%*HG{s~f+} z#?(=El(2Sydp5b1<%p_s?CaFwDi@)Ez3%U1LikC7i?E3RVqa&CV453$VqzC=C@20< zz@3`HBo@OS;Ai>B0Z~k6j?GJvU@zb6l8(+i>UWBZnWTuWGgIlhOipSlId+e*V)1g8 zqU9$aYA^4pY7#C+RP>_@%@DZ#Mge0kG?!a0_^ne@E}Ujzc+36PI?gj_9MmB)a-{fl z2niE1B?1B+J4}msIj*o1yEmm>!dQTE+IDNraE}Pt$t^a&fbm*FH-j{*oxvtbbC&Mhm))H0@zV00(drtxK1Phl4+FTQ5}t z`*fzWn4(=zg3_QIcqkQ6dsZY|bZ@)=!d3k4xA zF-~zyi@Yd4`4dL?MF&kzDiO4iG$Fi$G@rP-g|#u+)91D>>QyP`d(3|gW!~|&2d&XJ zVqosFGJf|HXQt~5D+hi|@wjKkFAIrhJew@YcKxgEC2UOhz_ZPk0cbY);m~#n(m`v+U;R z(=Yg27?lCRF;s^bN05z)(EB`-xns^lnb{4-qoi>miOVYaBPYNdrV(=KAEoGzP;AD0 z6P0mUX0n3sI;)j~Dr$+d;q_@|;KVdHcMS%HI0q-QQ1Ec-Kj{7xM0?Y5G8HYZEOWi( zVGD?lZ3AB@@hu_5}tN9fRq%5um|I5&EK2&6o3f zy+j|z9aDRSzVw(dhB6G1XEIK?VU1!=o56y&wTGbd3yHfmTWt(6h0ary10!fI9W015 zQHn#H_!D(tg9WF$$vsZfh$He?_ZAiI9+twk#hRWbx5~j(FX!d(9Blsieuw*;iqZW*>v*xwb$|o{aPL(R<6?7X3E@NgL-qF>LoukZm*Z<4A z5A?gQNlGP7e+#KL>HaHrFQ;`!s)h`lRLMf|2#Y%HkhmlzF2_H!ze*l6;2K;lv> zal?m}{ephAIMbccCE@rr;*$krqf-ob8;oz5w(2!og7lpA#;cnoOor4+GlX%viAu_z zV~Hlp00D^{i?iwkf1nSWM?CaRV;G8ld$dH3VBjL0*|+JiUT5cL5*dk(I-s%QWSXdl z%4Dtb(aXq}f0<&vpv>T`?{RwQe$v9UuIem72{93KjewqX+>h62{hVGkstS15x2>s= zR-UI8Z77*aJ!mmSmL_cor;)`pm`;`m+e{BLqKTMj8ACxfB9l+lPDSTfqS(%-EI=MN z$TR75SKLgz6eo@>n`~wtdNf(Wm3zqW3klaUso-3hw>@N1$T?fBj^5{WBD!MseOcc| zl5{En3{v$~l9X0ei5qm3H967|_$t(85}LQim8kxLuC!YX#?OprOuMC;PB}U|-%*^H zFk4N3%ug>OQ2T9^1(s!pQiJgkGXSX(;>6an5T3L7xetjHh9nLa>>AgsDsizj{9x=b zy6|@kD_gc%lbJ_ypGh4;n^CF6Uz9@84wB>~f=I<0D#i*r!%_w9lM<)%3u#v2mmkThYdYaXT$l zGF5!~zZ6%?%;Dw}4Dw3QiPHmPdH9F$?_|kX8AokSy&T6QLHetT@M@=vs91pnn(CNI zU{*5@j$%gO1UUR0@zqpV4aPI}s80AuC6jjJAE1}gA=r`(vxEB$UMkKv_*n0WmK8|P zyIAURo=cpAWKdSZDBNx#^(7+pSf*#FRrweaVn3$^=>PbmEvg1%5idm=66^^%Q)t`& zLPv;2T!z=&ZaaHA`;vZ~l;$ttX+BKiVa`zE?7%Nmsc7exO%bEBV=x*qaJt|uccq}L z8l82#Kkw~qRu1GBptx2I#;1lKf8?chaoR=M8Nb;0_-7l9>lc~N)L`t_K20M{(sp5b zsTz#mY;>t`2(IaDQiJgcYNe6_MST4Fc6$_^b%I?st?0`MNd)_tBe>M7!r0asvu3+k&-NR0wl^cnsrJ=V zU6yQCgYl~2N3K`mXm!gNmS)kDU6Y;cYvyEc|36Lk3~~Ad&)PKJKJ2KofZMHsTW$jP z0iqemp6cWx+>U<-*=wDdWmp5<-K(Adhh@lwoxUzrcrR5W!&Mmbl0CS4!{AO?lhixq z6QdXIUe()V*}uizhgsY$H*xpD{|R@PSjU53B{-o?R`yacylfGGpVUC@INC7QvZvTy zvEKfQf&aCmPEWH(99kLV5oel%_1{g^`BPNoa=&eKWL4)+wl6Y;_R9?lme1H~sii(3 zO0Mfa>g5Nc8?|G3eU6i$tdbT@_*%%aM&xwmz>}RW?APSr0fQxSoXkhpsNMV+pdXR# zrx1))SuozVz__)&O%29dj*vuDe_Y+EIlM0!Ij+iaeX@o??>1_+S>fh(y@2mJ$RyRv zm@&G%=rm@eqnj0*E^+9@erZgMr7){U=zPsW<0aZJN(WtB+L6`kjlkz2>h&f_J$qR+ zp2xYAxA70U4R7PY_|m}~i&;}w`Ri7n*9h57-RB(L-mJ>OyM3NSrK(XY-IvomJh~u7 z?+M&6PV4GFI3~e+eYvTn|L7P$e_cP$MPBFQW4ie3TJzT@$1uUjr(W^nT^d+`IF|6iw4Ujp3OQlOZaw6GDO@cmWU;3uPbY_J4q*vR0 zOpAzQFGc^HH>?S7;)K-*Ts%6Y24mm&Iwn%^NjXK|j?7jNT!X0GpepftJjU zrXfV9TRE^gyJ~Mbq5`RA!nC>KQB!=He?o~=$tpDhw~Q`e;5X+!jq+Yv z4aS?}sbqk&5%yX&0^b~M;W$P-{`WZ6`0v57DSRwCfzmK_2%OTko+=gvZRN?w=AU1&0*lN8i6$i1AI&-_EAT*1PSFDgLkX>@F@o^AW&3j z9H+~m`UL5DqD6+21lTG;8Cxbn8Ku>T9+|8T$6}+FTTaV->ToPEGNRk3$$)a;g*G=` zFb~JAP6j3o7JQI&s}Y!I(BjQ;56896YN_I$`^>gmg6eR=HR+ed!^W>B-QvMt!^mso z)X?Y!=GIjWiCs$Slw9ppKVcZ@`w z=o1no2+17&QX%2rty1qiM=qprGe+vwQoG=p_8Rl7KjdiC4<2jRhh~#w&0_KCC-0El zU}fh0TkS3xNqrA@MMWtyQ>B9+w3S+b(2C8ZM91RnF!G}~ zBP=+$S|V}=znfNqKh~0yl?V>?QYI3E=4 ziRSX-LARZI)9x&5J?8^!$~X5JDB9EQ#spIv4#p=r)$}u04zNIEL~u)*m)eI+cu2N) zSt5{W<3tc<9mkV;iHca965{%8ybxyn@hOB-ETUjp8(Ek=Yf}BFm*k zD#VF%=bY{bbcvpK;v&S-^P%u?A5C!0jt zs2iYd1#U_cIzJPq$E89!u%!2Bdu^d2iBFM8ns|A7HZlBsPM5YBMKC?gIKXql_=C<} zg>+2fnC`|wI?vW6vzb!@#aczQjhNR(JE^j2sh}}-AZ^~9?gVC)DrXY*7j02onhxW8 z+7VW#^=jN^EmCze$19C;eKEBOjU>lCc9uDxT08KwTy0aQZ|C~cBrs}$tTc7~AIxOn z$W~hcPSqk`AF?CPs~E4#8Lra!x~5MQrA~f1o!7gCrjrvTHxX`VY0->%UD76yyGz{YD&*4f^TLu zbF)6_B)`}TZC_YudxWX#ndUhn&MNWAMDdXdN|78bM~Y{J6r-=d2rU79cL#Nn!^z@v zOSkxR@tKH33blfeyPEC-jN5JypFGA~SzP)o$e z>nagObGRG>qZrgk$p!^c(E)?~qEb)Gq#7mI(-~9wc)vYhR_`KZoXxCpg9Y<2mn}Z+ zbg_OW=JgNJaeowkoDop@SkRx&EBrN&jjw{Arqlm0qEE-ms!_PeRJkk!C6C3rbPiSV z5$1=$8UG3>4oduoZi=R}Mnjw&WCW8fEYA7H!s3hlD3+D!(gV9PT{ASLLVR-NSVmuD zl3LpKSl_(gkMIA$vUkiqr!?@Jw31J`WG=yL%}{3!TqgacDAW+ROREj*;EeQo}8@iGVnnGLCxH7j3mNNEn<#J4g=WlkZIQ3U$^< zd^(5M5lNOYn2t2(nySnXXYDcHFY6N(hJhNLm@{jCM!%^=^40yQ{G8AGolKjkskMOtSIsBuR1a?nlw!OsStZs!lM2xwZD9A33X=sD&yMTEhT(!qG3d zUW~u&6}t3B#Ce27(Aqq%4t;CU8W!~TQWx$V%mm`j_j|PQJAbn9@?3vi@hUDSnu%%e zo7HS)THZu0?(7m`_vr-rzt{SP^0?JHsJ!(Ho=&*&H`cWgT`oiODub&3WsAGbQZvgW zBv@zHC*+<)4fpVKIez8GJ?vQUP2U7-v*=AaSnwP8Zgnej?F|;Z(YIFlaYL(HWZKd&hsX-GA2G{c3La$?X2~oFytB*JQT)XE_OO zk|l{ct}Q;zNyu}$Xd44w;*#Ra%Mvl=$HkrVaK5HtU-#vG5!ZKZHWOL*J`2NNaOcrS z>V4+GEfrr!h0q1RLh6M#z;cN=Spoz?18uA)GGfmDOdo!HPWKL;85|g*v!OFRGULI4 z^J9i5!(jfBZ7*14A1IjULV%lTnBbHE?;$x>A{gSu=_LYBx5cYdEz9W*eWGQro?#(S6=1gF5TkAWC=^6-DYsly`FSS6&>#*_*+cH@r^C2{8*6= zYjKZi;)vifRV@+h>1dP1W==B7!S9W(6%TF0gyP2WT8;7k=vwnv6LrYDM^lO?qjTMO z7eD!UbnW3>8n(H1ygT!Vzpfu&Bk^GpIhDhmP5&me(SeVgrbjz^dDIA89;_}$Dy;mt zYJ3>UdCd5HzJ=wTzgt*-NMjk#+DW!>Un+p-?cR|xv;udhO7N_Gy5OHo0-(8KUhEg-De7nBMq5e%*#rgIVnW#R?e^CWVDU>G$a{q)9c zt-(5)T1F;NLtP+_m@cSx$r;Qegpo9zjHgJA6a`ikQFoJ5p#0DgU(~%Q2R`j^DLrZ-K-^4Tf)OdCLU*6n#w}Mg8NC@gX9?bds^zHn4xiuoONjUQgoP& z3l8ok`%l#@c|~$0EfR5Sdv}DRo=qjYU*M{pjK-KwhA$D+#^i?{LSGJR$e%f6sd(g6 z<-lV}g8#6g!GDxL1e*-f3Vj|im&=f%_68r=*GP~O$g)&GMl%$I8mDB5@?)Lh=l#Mh zr~N}S;pH}E4SJo^U^-{G$f&~nq$oi4$MM&-w^1~Zu=6{B4?Q$b-%&*+bHbWJr6n2tn=a^U+;0?`FM z@9+3Sun2ydeuE3)kMdx6#a1hxY14tJ*_G+CrSPL%_*XLm+E2?`nXIz zj{BsN@qtDr(QILkg@{eGZZK;wk^!1yP3^X+ZXcxlxZOdCrj>z=6{-@C=t-F)+~VL3 zOsDYS;ycbfB0?*jlNYSs0Vz`oNKj1_G_vJt?Nt5o z(3mirJRahW;>RW2HK_lg=!^MYlO7I7NO2)F735BB~3Ca{MG=;PZbTkQOH(_?2%E#53A=qz^ z3JzW`ajo`eNP%+|`7&NNCrZ71Lnnfcm+30RgfvG;)iKN`--X9gH3jNpJ1%T<@qQvP z783B)jI5M;@>_ByKR$b{)M?SMUKUKD{-c5*6i%1==j3$p$rnP2o<(sZ`jTUck77Zx z31jCWIZrMk%|JT#FIwt32U^&?IcH$*GL?^)%?e?rSnC%&WRSUgG3Amx{=CahsrDtN z{Z)S4X`in01uv(XBsk&-<;NZNE?FmoR6brvX_@DKdjhEv6~{aD)Kz}mrM|%cFE0RU zkZ1}~yV2<$CoS3ue8jO5Y!y~_^va-f&^!+V5@@c&fG#xax)mK^`jTHIK1`=vyCua~ zK@QxL!~Y;_QqSp0jl!3m0h(d00=RGnD0R){T5@d4QZf5D)PgOB}YCPhT2_wZfgmQ^bJbFPQ`hVO8cT+R9 zMkwi{Er#?4nU5A1<;g)=PnU*2Sdi;v5~t8`vr?wY0`Z+r`g=lyyda+DaeslM5%b#X zu*cCzqh6{G$uJ{KkEc-hXlIG?<6$(KKf=AHz1LAIrRHPaJDcE@`cZnajrU-79gM~( z(sfAE-9<;~I7dp5qLt9D!>W>1l(%XqB^OJO7IY6%&11(xx^R9SRMZJafiPd2R#l^o z$8&-N{}q33;;&0!bW5B%s45e24Kj|0CWE-CnVr0yh+9v097saY*2L{RA7{C;>b!RFdBu`{5XYDL0bUgC*=|&pH+OEXZKVQF8rg_#jDPNxt{}!?=_Cx z%WQ~(bhvcn$dMzpI-1}GnJaG%H7S4nRqCG?Co?D-Wxq;&ns;SAoj~g4ZVBpw20kX5 zkz@39%3En_(>`U+F%s8rjKh9pS6y~$MU2FcIJ1d7K>6{y3h}7k*%@Q|H?h^!Q@qgL#7fhS z5KSm?oEO%5O77mVOr;GK;%@nAb{($fy5#W8YY>g{s(Wi6W~=2O6X6>-vuYn zQ~7w9PX&)ULXxILFkT{)SIwpQoqm@|s=6*sG))#?Mj__M*Eu1U#M4{qcsLR&f(sH9 z-}dG-st7JixQU8gIb?ct{8ro?|L)GPtW5_>4=3AqS zXJ-Nys{(x6!P35TbwAgoxxI+c?~eaBFC8O{S2HQU_Afa{>a|QC5#w$Q?;c0uVDYI=znP2h&rk7}&W<;ABA~?51a2St; z6Aqp$=dL3K(*iiykAuCm-I6#_4fU0P7I&7p?B~bdTyScH=v{|dVL=~1H&OXyPHayq zfO+XKu|{-V!D-DTo9JS72|UzcB1Zob ztWNSL-efOYqwJHNFhUg)DWY3Fis=DfrOO>u(E}K5ZWz_5i3yITwfF(466PLk9i#DX zOv37p{k+$(n^|1-z+V}gNW)VMt-Qk8e%~0=`SeoKYo=JZy`z~bH7@LH%5Od~gX9^6 ze5XB|0X8l{PViz!6nCX#^12Ml%CWXT^`P}W$}q}-YdQjK{jI9SUI#_lUuWr!G6%KH zdiWjJm)F{*?QUZ0m3B9q-%F1L{@&i}H)goe-!DZKg7abmm!DR0Myxnb6wd@Hj3FJv z%oq--mU@{WRazu@s?&`zZW`(0v@x>tZ=i*d%R5VOlpj?kGEyr>aYCJ*{CA*Au83+Q z<^!j{0BeTP+>B)4I{s0?)Ix&Gx%NB@&EQj{jW0kU1!HtMkBE@ zvyJq$HI~In_Ypl<`CSI)wosQeS$ro`N2(cw2u)UGtoh%{6jD^x4mu=zjLMJf>ELp* z{-sn0-rnI76LI8$9Qa3@-U8e7rE*(`3yV|wq&+RQrOJWz=Idwl>s1}P?OUo=g>gZ9 zouH63Qn16(NW9+C?v}9{sc)OP58rDKbA~rL{4#Wm#^@&&)xXxE-FQE4?}fZ(6~^y2 z-WcmL(RPyrZ-T{g!qPkaAsL&6?D_$tv6tIs`KX>Lugn>k+d`MOBIUqiZ8Y9+xgVBq zicCM&N7`7ziO)6*vrFWWIw}V?S#2Mc#&M?Bwk;+rC1?yX?G`(G4YOWjR&?3d_uJN@ zkcIZx={`qDh7#w^})HMF$Zh*s17VbrTadvgzuyCi<|0)&6 zRtshKn<#s#H_HB(RcZ;@2Sy{qZ>Tq86eZ_;wT9q2JNBrk3>ky-tZi5r=t1d+M5%<1 zmL~t-KbM)CtUghi( z;jBvG^p^^z#o+Q@BBRLSCNwxJa|jMPOO7m~vV}6&NC~n~444H?a8i>_or{rCs(oly z?ME%Aaio@d%vd#ywK$EPNB6+?W1oTI(Hh*%3AcDOjvmXQ3UNb1-+IsMAOB3$nBir* z!QMWs%FU&|jn!)Ov)6NKDda4|f&QGmDbsmUqy)8H_kv67h_#tp%qkLJ?pgjXD|s$J4D zUS>-~CKOYp>!fL3$6M!`N3XE7=fmsz(#p)uc-?GHTzi@+2d*`@#3yuK6S}RCXD%kb z=dtnav$NOR2hMI1b#%tW!{k=8H531dGfEXV+2W)1@LBV#t*mG4hcwXaZtpB}>`VG^ z>>o_Fq^nQu;mm`4tay-YX0wZ}Q7`DztvS3eXK8-?(mv5K!YngJfTOh#OIe##uK{1M z2Hcey@J2o0`?Fk`#p>2eTx^Z_?X2uPuj$iWB&?(9z^+-O?t&F`FOcj;OT~6zmv98v}F{%krD>`%H>00&k}mEJr{a{ZTR4P0D2DvZ@LdtIsb=kiK@dZwGj*srr= ze;=l{V>R}!S=kHq`#zfdUpkBAU-M}Hi(ndy{4dREBmh(w_JK^vbJ)-HzO*s!v`nxd%}dcC_{~Ni=rY0Fbn`If!2WEDMGQe^04CDS zekamyzc?41ETv+M+9xeCOX31&w;F;~D3CaNxT3R0$0z$_xpLseY)AK|n};X|p6~fx zf(DmzU{ChR<>_XNB!w-w-=)k;!^24ucQ%caGMO*Vht)8_RVmlv(G8~y;{?hCd+pR! zIU&1+_0b|)e)LFC$c0iqsn0x#%Tz*br*4PGPqRr9m(%EB9hb=X>^3Ys-h$!=(4bK! z<*E`tCEdy_^*{_FDmRv@5g5+!;FYQjwP6}ZS}H9<-_y%oy?Xh$rx#qOBl0HFFrsZg zWrCe{KdJCkX;35ZQduZPHm+Cs#4_9w4N!1p!H8X*VSaNH=wknIVh&Ee+VRfah!rm-i=8eEJA=l3sm@_3X9UIlskDXJ1T zX`2_#Y-QLD27OIamAI&9a)J-^wY`t>qv%_uL!HR8`pr%nqE;ujYH)%Ki1o>08Q+u6ZA(w14IGJQg7sLM)DW;H z3PHT0^Buuzlkni5$n`>Pwx+$|;mhc>&Ta`DY6I ze$gWQLQ{k%F)=0hh5t^1S7lh~=#nb5m+*>qW%D3(S6UN#jj(Dq%E`EonQrnaJ9s;6-~iKkLF0sn=WQNbzBW7bmYhP7>nd*T1(1q@D-U z5mHoXf2BPH$^^^tJGG`%^=}+2^#uLGPJ(`Oib!}*gZ`vMG;4ddy2g%;?Ey1D^fH6y z$7}3@Z<920`&1boCjw02Eiz^SuP(AXU8)juJ62>6QivaIQEB1ma~=D*Mo`p<1qF|H z&J#^z)`L$<1=~9Vstorb!Cdw#h^Mnu3p# zCh#F#`!=&lPJ!Mre2m#K-L6kT5gW`j8}uc&%0ilGp{KDE{R;#$T!K8Z(@wO}*c?H9 zEGz65o@fE~69MB*={%A>ax)>}))`{r_`1VQax7S^5-KkEvV%)_o${ApMv0(5*}gJ~ zAA!Os>ceupL}UyV7ZW5{h}=f{+@BK$PZp~AoH1o1C8A!j3w~~^G5ek`-^ic1!w#2q z64dX0YHQ;=ESI^$kr-W_7|Go_!%exr|8$99upfG!L)ZTwcSSm?bo zS$z1Tm*r|Tp`rC@q^>B6&Kg1mW4emt-VS~52%b|386?MwPl{C>>pDtQ8MZ6`U?#y9 zA9Hf1!eR9BG7!eaCqA6eL*-iQt`!GtO!mWUwR%l{7X50-4&Ul>(VY& zh>vZQriM$LpRG(YMN*;QEn7mB;X|SNuC$bNgZA8(o_zS_f3_gJmHEY05YHq6=BfH; z4!QMB?Jgdv%TfUj%tX^Z?KAa4J9ouB3^ElYW5y9Csov7l;X3EQ+(C2(p;o3y6=F>r zndGligmu5QD4+66C5R2AZ`wi0vTm-MAYeZH0+Zqp;ZL6U=e668Y5@IsDG%f)R0 zPMj(}TJENjOKju%{V3XJX+fKdaIY|h&DsE-wiTdnNN`8WEqLAT#R)t;C}R?;VyO~D zXlp#KRvzY$J5qFDpysn!1+hktUWnbc5Ig-`xC%cc+>@z2^zqRg!Zkyu$GJ8^*`iSJ zy{(aSn5DDX48&0;Ce7D||rmE-JwvScWf56&JIRuHG zKQs-Zwnk9yk~erH?IfGa_}6E)C8M?SfmwlhA4*6DaThK$QNLdNastzm#Q&Jp+cm^3 z5Ps+Z!HI|4>i(ZF)Co>9VOXbY8TsUDiExMhJbMGzKxc}_J2t-tN=&G*MM4<0gm7uF z3b7-V*=(QYOy}O*ndsS@SF`F9r*exvW^X09({Ii3OOWWlED;cFrOu?&t;%qhJ|){` zv(5d?o!%NdULt?Y-Ud4-TT{KF&p=g(?b;vCJOp|m(V3a_J@$J}NVi~L_vo=N_}9T6 z)Pp^w2YbTFSi;imvKF3V4Md}FFte=Jw9Wf3P`X%$3i<@Ycz~FU3$tBPCDR0N+X@6L z(_t~gTNo%>C8Lj!plGC;I2HWImEO&jK3^hPkaqTfbYrd#d-BQK)X|qRLlZ6FsN>Cu z;eNqsE`gV1J*HL5PKx_ZW>jyfG=`hBW#_5Z6z|UVNBh6oAF2s2{C@gh3+)U@n0)Fw&#YJbeS1= zBSO}ZH=oKCCvKj(NPo(MS|)fiw~?Q%n5jwUySbrb;V3{yU8zKH^_d<6 zc*{00cUc*&H#oCda2VO1plZN0H4|V6{^CN)1%oC?6nk+Be+qvW(JID2=t$(`>G23ojp?Uvmi=)#evEjJmlhdE*V&J>N`i`t0PX@S zr0!3;q>8;ASdDjVQHXc48i7lD^%h27s%j>3WU74PGDrn*tr4xjq;T(~C*@5R@Glrz z#~c(gF4u@pZWNz%h)0~gEfCau z(@jMZ69$)(i^9t~mb!ux7*o^1s9hjFx(<10>0oeG0KaK=kKn+*LkpJ?Ia>z~n4Z3; zDF+TLkO=#qy@I*XxR=+ZN|fV|DlkzzGRxF}7FKg_3F_OVkjqbg8H1Q-<$Y3QGGcM6 zLUd3%`Yusrm`NV%j+D#n{UbX`b}LQz*qn^10OlGYeHj^tG5NB-C>UI#RbiRT*5zke zxYeq#W2ID_cq|zcu-G^5O7g_?!k6HmrjP&iDLSkN1ox)bYOFnCc(FO@7CdiM(_4e| zJSY{zq($f?FrN>|Em4c&tB|0~ClMM1XMsc(NrYySE==Wls;5pmLtN)fwE+AM19Lw= zl>nY3CE^`^s#I|?Zc3BEc_&GeR6um`^&k>2p9Vx#Sa4M`Y}(}lf@h783gaJ1w+i5S zBPzJZ9u+=Mh0zjY>$#~FDuBxkzp(s8kdJ;!ZkBp}y}-=u^JCIQ#-C*4ztmd)R~FxZ zV12p{=Z3M>-WU*8xy1llZ|-A^h6>^6{drQLtw~ zwF%Vj=_OKCCQ}8c22kv$PZ^v4m40Kpk^u|~anMypNJ^C-ZzNs#*9g0S6v&&sVn}(z zXJSbG*xgpbuNUiRr7x2ue6u^JOMHC#UV90Oy`*b)ugb^n0R;`_i}$C~8+heGQ58T} za|yxuZU7U#YAkj&mq-P6+q&^VDu8S4jrcqjR{1zRtOC%u_ri$2qZ11+dM=2+{omLMniZ%<=bS$L9llWoyh1PRGHp zFv(*+*7L824`TYUfM__Y@Rx0ZQYH+}7rdLBkhtK{RyTIoLeioFa5+{tG5yP=5T>889jAeAE_6@JxJ}GPjk=$CYVf^Cf$= z;42+o1*3~Gi3brUpG{{JWxn8=gO+fnpG^zO$gEb8eYupcuMD(x`enEUdbRFgUKN;_Go zi4wuwR2aY7yH!5k;4Ln=!yYPKK(*3I5^0kPxr7wvrA`e3y6sWbfLA-4+53|^ke1t) zz{1XQIxMr*AlTSWPcd>`PdXA3VN3=eueBb(!c0xVtQ-0GOlSfNh~dSOw*3;p7s+PM zEWxTk@N|p*_7dyc9~@oOhvAGSYA&a-AQ5lvvC4tFwDBV#cpq!@J*C}OpH0?LBYJ(3 zR3(5L9eypSF7I?nTq{O3JA)OD=n$2UhqB=O2~QB5b8*VNi*WutoH0+3T1xI7=aXfL zP@C$cQNsw+Y)aNDEKIcRWQ`@Gg%4Yp7AlS}k~Jnnb(MB2ouKk@g+2vePj^d@r$GM{ zd_BG73K=7R#jaGdrp~>O5%#CT+~Hp-lA(9o$!fG}e|fyGrkls`#tx>PT9$p<$YJ%v z3FbYrzLUi1S=3797~U&)baE~zWN2nUu#VRiUg{*BUyrDuEsWP~(H=0qH>$BF8ICd6 z2*013YEl7wm$|BZ^g_Ya$*@UfzcBBrtNw3ym7@`&{Z_6@>$CbVzzEhQ!xAsTbDCJu ze4_&Ry}gczn&T*t2@OK&%_CEg;?(DK=vTk1%&RfxS=pRibh5-%K7PsxvA$=QIfGw# zu}QbNk;akOltm>{$^t=ur6> zL;4s>C_ipa^3O+&F2NMa+0JD&{)f1QBGiO31Tq~n4l_CXIc;N1;UXWu_8XYHOoH-+ z>CxS)88b?wI@L;K9Jgh^T8T)!q7{E9*X6OeuJ-?b^kVDC^b)|Q8ROA061-X8W|dgo z;mWe~c+=6vdC+AnLU#SiPQIfxAb=MgT`)u0dZdM(j$akV!uWAr2Up-@)ku4SpNR>U zcCfJ5|MOn^N%3C0PHWx+*sXZ4VTb)CmEUu%-FBW!B9C+1+zqb^;04++Bq>38PJ)ZI zf5a+%tep7Ls3ntu#mTTtAY<+tYlSW~UB#GZ(}_#kT^3LJs&+xVvt3KnFFB$(v|5vgr`x$Nuch~#&e7#l zVSKHWXg!VV6*n{LK}>pEN^TmU|rtMBOx96Su|DvS@?+N|mS zuBSh*UAv0}@TfUo6~+_Uxjtylm5yblrX2oXvfcmLS8#$Z#v8ypMk7w@F&JH7t;-8J z1MzbQ1*!cR9~b=Ys4kMEz@U`(dOPLy+a0xZ@Or78499&AIw}69U(9vXB2_{Ufnx;8 z5@DLTqz;gB=27(9rn43X1REXxtoCqAcJv6k>`c>nq|nr~fZ-rTv_hBCnii2kMn9A2 z6wb|n8^Lu{CkTv?Al)3IT_>X{n<7D3MFrL53W)@ux}X{{qoiF5DjOkKkxRKmXTUC;j7wHu+qU9B6X9Qb$Ipbt#^D?1H#AH6sv+Rw9 z7g^B!qM<3%A=4U76%sl2a4l|Ay|qvxL*%py@eP%6bOCOsjIH%bDQZL{B0u!f*V!(% z`dypR42aH?CE7J|7YZWwiSpxXTch~o)ND+(4xeoeFy`jsbd8xU z;(cxG8Yvz=y)o@petc*PsR&l48PmB{=Ql{1um3T=NsSOZoy}kn5o{Rm&OG9;e~hm= zMdI4;w<4WQ7^XcFB7)EC(KOpWIJ&x=lE$4Ukk9?!TIQab9e^tnASwHY~7u*=G!tppM5HMM`4fk5ISP z5QYkhtdH2}-~Yd#Kt+l848uGwTY5&lneIJhl%cg-hptd07(fUnPUFc@m0EZy(z>e% zmV+0i-eF{M7cw8IR&DXFjNn=@(>^`UoljCts4DS_<)Rb89Wt3%!qp|T}{W2>{?I}JUbe3<=&F+mZ* zb9zt5D{xQR{OTE-_1Tu5&%WembSTp}#Okyj@J*YSngEbMZ@(_A%zXQbtvU;3VV4Ev zk6bLFLr$0&d4Rg`QVBN6I0?#Itt@FpU3GSgZt3}Qz9K88Q|expT@PYTMer>vv}c&c z&AD?az!&*d1lP@EtoygRwYj+8fFknexz!Sv(NZOt%tgRRf3d`6q|mRGHAi{J1G`lO z7tO4Lt_c*cG;%XrZ;>^dC4}i18BLFo-!#8O;>pwlSP6x<* z+6$bY(Ip<4$o+zxO{x-aC0!~X&-WwADH1$)ewaPnb3hk+cyngm5p>-Cg9*o+%Pcr< zARJOEcS&&KWMP`1LF5Bl2zunNGDd$U7YaadFxuEyBcF`CNb@)%bg_d|EziWCrxN?Mwhb!;w$$K+9gfz#=y_H7yrNh!$6$MT#XT+sCM}SVRs%wyS)6=ZMm&CBr*zxyl0U0Ro0hA_%w2$0AiL zEozcDu{6a=er*piSmKJ5D=Tb1(it{ctbD;`j;IRb`*t_mECqnY!Rh)pYTpb&=qpMsl8C5nY0-6fF&Rv{UN2FzsS5Z%CBd0-sFf`c|;< z_Z?KPUaA^pxN_jG&Jw9t`PhuPa57M1ZwK{L3)K=#)%CDA9pQY?pRZr*(ETn|wHV^p zr}+{}U_$C59^z!9(hBJZdo9ft&HX;wvovABjY*C(&tilx%r3?+s#*pyS$&5tLQIhV zx16y2MIt7qRv3Q5^lp+{Mz0fYG8*wvnjTq$vYXJh)Y^oX?h`%hK^D&++)W$kMBrnePIjGz3bHMw)!_4o65EvBd)tRR#8TN|G`ae*Y5KnKP2 zU1<=URw7BJ6c8T^*}N@7%^x>Rl9W!1>4V|L%#tx<;fSIm+<;^qav9cx0zXc!qj$Fc zA}G#P;u$i9;cn*zFsxB1{seW3qU932^GzYg7m)~LI%D{a#>b`T7^#=PvQnbnKD;aP zab*sbYaWS^x_{6X$S@H3xHX54cu4PIRiKw~9^p6~heXjFJ_5;R7;|xMo4`wD<$M*! zi)}sU^b(7V}taqvHj zNF@CWRX#p78dW8pZp$1J+OJeTHs(Ynf-{+E0JCBjO9V4rM%27z8kSkR;}b>)9ZQv< zF$&m6j$w9;ZZz4jDcf?Z?U!sz?U-Ok$2)YiPg2G@kb0eEQZ0pYyNqG>SZSdDRfe6J z)6>C1=fK<+x;zc{l1z{1RX<*q$spqp6R@2qyE2FLpNZ9=Q{Zk|%!`U)kjB zeUYMT1e32)kDL-ZQTud|9iAo8!F>p=fW2DBbBmh}6!WvPT=xyuwAMJaPlHEL;vFfz z(WN-0WQ6Wk^FABR;h#XG44Nhnibo?J2T&7@8Fcvr6PfDTM;?jbT({s*hBEz)!a1qq zSGt&_4`(#-1rxP+7}&wt3r-Kq{6lEQ_hpq#wwo-_=Jp|I!&rMxd;ZlU?Nmy9PPBR`jMs z4Nv-`IgR2|qXkdRT1)kApJ-8$1bJdM&#tph%$7b;xl-Oxl~|kL*3$<}u&&P%I2r}* zb=1;3yyPcYu1fWTOFvz8XBYOo8viIqwMmkT6f?owKt(wfWe?pcnK_ zptV`MmAuX#C+cD=5h*HCmH2+PH9o%TvqU_9)A?uW*>J8zZi%e2_nHie2 zXBIVUJ}%V%_KsEgxJOuI9~Ww2AtLx76_)vQ(3I^m$nsiVWt~q3vn^wacGgSQzT%8G zX`$_8?aZ(`6yMkiR6aiFQ!B&eINFFxq?nUENytuch{q5rVqwWQW|Ez{EjL8aU!SRY zlBDjM-ZeQj zLz%V^eUV#>rHL>;q3-{Oj%GoZT7zp6RF|W7USYxIIkjXEBu{XGEWz(>Zt-D`Bm{HX z+a!qJ9SJ!``7wVMouBgsKlQ05LBD_=5rSJ7zQM=uJG(0c-?YWB&C!K6uFO=Iagup+ zl;1uktKYx0-@x4Mr7SoVmkJffTeBFHnlHGiPpxRP=i9R~BdzL_U}7pdKWIhG0`b9K zEk8*RXVu`)E;F1Po+`vgG&pB#z%FIw9;v|E^isiVwniBujM|8ZN5ygJEb^v5^wF9> z9=3XIWQ_=xrY-I2mOCsQ-o{L|WfCE`@_kE_%EzVscqYGS={b{M_YLv&RjqDwLO=J7 z((Xd7M>$_S)ygsN?W@BG#izrfU**2ybl3JZdE!@E|3CA@?B)e$V^j;orK%Div}7Zm z^07h(1+>s;@^q^!6Y|6~*$K>uS+0h6jmd7Bhd5y!^n&ElVc12IOS`km$2Oh1nQ;v# zk`WzedMCd&lOFB#F0eKJhYkOUvlc58dc(h!vk9vb-0*MaBm}Dy-0;ul_;FvN1aIVY z$*IbZyIL8;k}r6%Z!I@I&fBKB-iR=jXHXVMoQ^jUeOWs5WuCy!q|d_qY+TIeH0u+Q ztEe;`%kP%V(%$-Wk`!FO>^EJ`z-m1u9$@WpaSJanO%7JE=nkG>zDImN!)>1LC!O8u z48g|P+4PV3SlGW-aDPWkaE+q2ErJ12lZUx65f;3hLtY&Z&05Qg|1sX$VpPz9DH9`0 zt7(LaiemG~Zn?+8{?Y>mmNigkB$FqUHjF8qFky^x;H?=HJXiG(VNa`eVE=-e6v1u% zLs>Si@LsErhYujHBtb?7X~AHO1hoe~Q94n4GNr6RFeA3gs@iT`W@qw?mVeb^bl+!n z`I_0KPn>_yK^HzxC{cz7qs} zSk-Wn;1_*7e$CYyfVnd%&S|suuenhfBhQ(P&_n0iS2bu7o1s)2$g77{PD3we)b-4lrj610tNv5m||4 zGqT5J5;iI_Wch-HeWw%Vy{#_h+@aVZ_$8Oxfq64Y9e&C6s!6zDCRw20a=n5+Wboz- z{u~nw;BJXmTI>D~3p?LsuyfXb!p>_NJGb=J*xAu)Vds{K`$#kN+L9#XfMIPkcTcU<-fF;Ft&PvM7Ug6 zwvq!Not`APqSeKf{H|}cnuJBInH%uyzC6QN)Y^<6`ue3%#+es`R#IKonxO{Y_MOWv z7PY#B8SFXPJ)EpilfKECz!`Yf)@5F2dk)m;V=p_ehkks0V6Cde?Y$)-;MLDInLZ(qY!* zhP8;-^p9f63{qHpPI!stmCZfm`n`h^SVzCeXAFiOW2Dx-P>R9o$WJtT=m|;J^h)l=p0pv z-=}A{La*bx?jU_!pP$}yT<^~nr9n{5WJ=~j&3GOl0a50GM1^*qc>*}(& z-tvfr>)Q^_?9%&nC77-Kqr~2q7G(Lj>fr1qeIq-=%$d97;3zkn;12!mtLDP2=~BNHLdYlI9!yJeS}^QZ;ilYgLnPTQrPKR1i65xvSs<_oq> zZsvjEIohZJH<5JvABd!^^2_#^)#p+dZCy+{nQrE6e>*$daX#j{va|j496mL>`gvgQ zBS{K#3{__JOc>d_y6~2sL3VHuGC|II4EL)_TxN~ZYqeLn^lHC5ExX#4xY}N8GRfrV zR6ag&MNvz)s=cZb8~$A<`v&SxE;{?)bfWU{h^ve0ldH}RnEd9K2NRsT|6NaWOmKex zFTkNx`jjg=mUNXDNVW^TA2_RwP3~f|o1gz}H}kn<+g)DvGFDY$MYb2+L*~-D%66SivEUm`d)A;t*Wbn65t_u!F_&#-UEPTY4@tuao zocGsl(WHD@i}h0j>SJ<8#9-2s)*W|_#C;{_eGvv2Cv^;x7o;7 zbdq37^2vg!F`kf^|H`CXD*5{u}RenJJlr62bd zOg|ycBJq(sY@*kE#_RgAq+12?u#p%>4dYWu9S8rgk-(<(%eX5Q!%}0qZeB0zaBjxH zkPgd6oN9#~HoRaV=wWc1L50eBA2I80ktPU1+^rpAE|@G4;VG&h!PsEA#sqPnevesu zR3#qj^?Vh&;AB{!j~o5^Sb{!38CF63U?e1R__#2xPd3X+ zuEcR{7cIzlgEmc2xt6S>AdHKW0cjD#js3>H;o`#u$ryek zHk6-|U+@8;_a~wH!3g0~#_Zt|do^+z@o8#<;5z#z2^xcb7ANx!<>CDOf&;t6GrW$O z?gi$A-$<<$++=TLS zC}c$UHb_LAsbLb7TfoqxWYh8ZbF&U5S!D0h(Nj#W@RofEso-k+4hcH($1ePR5#At# zH`~`s3*BYrHDfm)tg~;DdKrxuQUSr;_QnP*O@d{_7F#SUMtM!+6%Ib{+!pXMSD>7EZTlTj(a-i@jOB1vhT;Sq)6~Ur(3WU zbQQoO=Acg^glkhSiQ|e?3{)Jy1X95UiQ}47ojCCcN7poGX)26Q?cLh&a3wtiu%UAi zd*6Z(ZcJ&E!y*rjVLkYe4C3gd&!*DaaEA`x-M={>n1wFqC@yO_I$ zu{L+e6%m);?E)QY8^AN`>*Ay;~L# z4mtjLT*_(9$LscjY_M_n+txCCNT;CEVwI1i%cNgmMkWvCc65e0Fz6MSS(WyfRLSI` zYKfyWCi9VUW%>Dr9af(U90PMd7d&gL6|7IMMTvKE4Yyw|l@U%Hw4_Mt;qarqjPn%ii%Rr;R*ukxPdq;`1;CZ!!Sx^M8DW(}}kb3l) zj>fh##+`uyjcBSvUbI0x;zOxl5UbPr(<-g|I+kVf8cr9;5~*h>HkIc-!8ILqybFHO zg@f^JvQC1yrlT2OtKS8e7zu8GACqlT&(KWFH?~Tq7}EY^81oJCG(RPq@r&J$d8rbC zq6f=&b}xQNhH-Ed=elw5bSJ*EhXj42f{$orICMHLVEQBMO2!0#42chp-Pmn!#K*~S z1LHQ@RzR2q7u}3jTHt6Lt7V2v6Lfdf;XT!8HJyw6sNmgpP1?-Ux!0)1!ekxyTTN!a zeFR=W9tLm1QGKk=yRxi(p5Q%4$a$Dxd3y~$bkHq1NsoHHk7vJ}p#ohp>sH@I`w8V92$Z&;%$2)R;R*9)Ug=Ed+l{tY}&fJT3YNnBHqkw_0 z+V!@$((#hutM;%e6epF2^*k4A9P0^6UvgH)O8c+0E3=phxBBZENgBR8QYBJ_m$~qF zq!!`bUhrL)ij9~e_`t4fMJ-Q-vD-w|b*b1Gk|04OjC1Rx1-GTGleXn!>!dxVlXC@y ziF;n*(I8xFRYDcw;f@#%W_V)|Yt?iat_tx$M~Rt&>q!-2t`NM?;TD|R45s1dm;X?V zkt`H!>tLu?P(Og-6(nNi6`Gfbh*7dvBEo7c+0>J5md&XAQwy|D>Fripj0@Upqy@h@ z5`wPwJyIn)t8QGLl%P!Ik-JI9y<=ypMr(G0c!#Uj)q4+<&@YfEKJN(A+`#m$+`QGL z_`WS55xU%z9==#cdZ{xiB9+uMeW7^HB}tUWs3RyevpZ=NT`cR1PT}I6qBAz^9lWJ!~UMRtv6|A1VabcEs=j zY37O!&2rq8su7>b_r9k>suZg`N_6bC&IPwyn5HLwyv~ml5j@(~L%9SiQ%nnqx9pT` zuuFL*f*U$`!|zfBsuVYAJiO1WYBFCUSl-br&iQy$Sr=Wy*VYof#w8;06r@dlV@X?Y ze&ap8AUAPA-ZvNIHgiGVkq|EEi1p$(KA|C4FUs%jVZjBCtrEm z2RE84^M-_QaR8ijk^FRr3wNdif*u9}>vFv0R4N6egb->IfE`06|&=Eji(MQYV32;LS)hYV3@3AF#lO|4 zRfh?7BxB;@@72Z{32G0R2U0cSk@@N{tWN8#t+l$w$RDY-Bcj@4q=H$YX3h`RxbJdY zUd>JnUn8C;d52MWJ&((mmU`w2ut!O?`@bYD>M%@Op@ML+9#D&xh2jKh>ROx<&Qn1= z#*|4N?vqCXeuDUzotzVrCG@)VtHZD&RYDg6!Rc)hFJqGn7-y%OMA+4xsQ~I+dFGoC zk|pXeT$C!|@0IB$@v+SgTPP33w7pG}IA(97%WY70@Fh+n(K<2-ZaRZU{!L3It-WC{eqM0;ESr@SasMxcwgdR zN(AdppoZY2MG_xFJRQlX!hZ)xT=1BEy*dmFQzbp%5Sn8`g8velUwFsESpT0;5hTPK z6(b6OMvk2dtHZ$1bf&AATA~W|1%_qmm=|x_3Wy-VU_URZMz=Z)gQKbt)0)&_aPcyq z7Gv8I-BuljLce&BE{Uo_Cv87imfoyiNd)$}9Ng^bbhltddWC+a4x>M_M{mkCX@(d5 zi<=e?4+lRg%H9^~Pt0W>+9)2Ju@s0R$4_(h7{Rz0Mn;dr$u)3C1t(IEVT{_#{ah(4 z#c~#%v(MVi|6t@-spgxUxIf*@9m~?5Ym@`m*a_X|DP6eYYW@&>L6MvbvxZ34n=q&j z!#k-O8N|o8o6X)#l^iL-Khe><%O2&-zfYBj_iz$Q*57qtrC!+YQq4l!99^8810*6p z)6+>6;-6`)^I4W|Hm9sN+lw~65O<}y5--|nRUy`=xfWY(Tnv7LWj(8*y`xLUaWU>o zH}h2%f0@Xg zq@GW{HBq<7eE)r_&UBT!)E-rZf*Vo+HhS5%gum`cyOCN1Dg}B?VFy9s9$<=P{9P}o zKeM3D_j@H5{?%I1ukAF7z#ckIPhn%)B_7$R4#QR(G3^}0Dq$l@wNjRcP5Ez`&qu?p z?YTkiLNRQ#lxmL}nku+N_wY*SU}B%Y8wI8ykC96i*voGF^R{jA=9pN0S6~Ma+iL5?rTBop{vns?oSV86H#y3K zOFN(-wM{(ow=5Kewy~y*&}eMc^cg3);g2%?j|$?Cev)39u14dpI+^XE1&}T^8dKVs zSrtaLF#Je!KE-PYkQUJh(Y~bq;36Z$JNkpNU|!~P4ZjS+?qrw^T?sarR-^xB zHG_H?Bdsck->LVxA{ADnaelK3!V_ha)5GR)Lo|zN4L2vHhx^^`XQMf(4NRf7t$d6i zCrWbVi1zM=0c=z&X$s+`r|W3JDKX7Kzde~2XcDLcJOM~f2=rka>U zFh~oo_=uJpm=ch{U0`QhMjU`aHF3c}zbZvr4OS&xYBc8ALyTFC%K~!5g4Q-Y#L+5< z9qeE8-(TB_LMLubWyGeAuvDqhtRNS}+x7$pTA5lZK@NRYn%upB5i@M>>uUh4Xd(aE}=Itfdv9(~zL5O+2a;%hPRa_a&`knhN7h&JHV5 z`=uUjmesS+ky)lv{BfX}9rXb&2?b}(Or0x1q37swK21@x?Hma+DKsl>bh-p8gdFeb zQYB2M<*X2Nx{(O?O1s!I#-n;Gh)2F)cXsNE$+2CdeYF@R5_Do_08A!kL|2P*FR4OA zoD(pU^?G{^DUj;pkf>p5ORq^X%5$u_d}xltGw;z8;wW<@h|btJ7Pkx{wIBBAs#)P9 zq+EP%Q0-}_TGsF|aWv8-MpsG@j!km7)bsZ4thja7@v>TcV*F{Zt~H$w%T!CVUf#zV zeXgC=KCaXWRT#PElcLh$e>`?19cqtIuh_YZOOe_vFqrq>dxQj!F5|xbjK2KbT}#_| ztUed-1Tw5g@E=u*tJ+FPL{ctIb_#^0t~?qkL3A|JkDhLdz!I4v=tC;m!VfZ3QjsK1 zkRVSX(>+d;2>Ovs_$0+FUZqEj9%*jD4U!NI#tRyZd;bF%&k~F*=WOe1O?ww_2$FR4 z@zU##f#D3&F-wX-C+``=CtM6#VsSp1<;miczh&33yQjMa3_X@)W|pPm`>Twjzrk?v z-6YJq*h*x4V2es{%)ed=>>pIS2t$vsBwd3KZJfQn5CmOmx<4`f^Dim4d7Lk{Z>0x! zP-p~;OF)8#)7(|v{j3Szts#1hQMeM+5s92FbL-IAaJcy1K2oU0^yw2bTD@Y&jui8o zmEuKrYXkFm`nnnY%z1V9e05QU1v=4$%)E=hwQwK3UrNj zRf(x#RRr3H3$Tc(Xj;Rt(<7OGBQPqFMq4)OO-5 z20F#HJ6=SbOms{G*D(^2)eccfMcZ{N30@*ZO#B+Uxq$N&+@@vT^>s+nT1y@>mkE%*+;e_>k8J$po)!LkA6#j&B zW4tDgKaP&#*2OyKPz$zgnxqA#p<=v|V?w^A=k4=^T#m(O$*^)rzPWr?8leh&&is6W zD=8Jcb%F)rBfUV}oB=VSJvi28K~x3!Clb8vrQSs$XONLe!P)&s3#_?np!n2U)`m;2 z0FC*wSXxv8mKuJw){ak-C5Mlcktm=TUmp-8Ys^-q(gL?1^(7satp(VgLp`mgH33e5nUYs4qz(%CqNYv@@PM=QD_vb5;^65xJ0p^o6J)JZ9yunVr}pjUQ*;2X7RqIkq|Htg={ za)pB;^C*ebourL8LAgD%LDzN0I7W7Z{?n|7y0xpM&SWj`N2QWfB7v)c`wCI90NS7$rCud{@++pZG{kl!mT1r0<}jk8JwheoL~pN8o% z&5Jk(iIricq0qwVqZ$Dc7aUMsX1Z-LTqP){oIOV3Vw5t}dHGN&l__Y92?kYbi3QWC z5FeDS71S`q>hN6$y%*wQ45HDI`314GBgaeKKqVvs7d%R6;K7} zwrek98vG}y0vf`~B+iKWD&E0b+_2BpDKJYb${1ai*sLbuom5yA;C6d-95*Qi@Ub%K zY#AZ+gW5h;A45Dx(+Tl*uibS1)j1`6a+NB;I(s9@J-F+8IlON1SYTd5+nod%Foq5) z)_GZuQI+^rhp&@|D8K^YRr>*b=q5;TScM!1$+!hcw0Z++Z(YKWk<& zHFAMCv8PXgnk4u&;bzD4a-t3T(sJN|+2&=wAa|~E;Dec5ndP~Dw1pv2H3@Uu!jd%k zggNFwzb9N;c79Xp+1J++6(8I7d>u8v7PPk^H`*&4!d7e{>~kWbR3d7GIPr8crc6}m z6@Mg`rtu}pfe%|Xbb=fD(xcOXU9C+V^bQ^6VT@w9Q$!|9lC<~+w8n5wOfaNca86ir zcM;}=p_St77}bE*$=c$zAi1_5)qwO~35xSEsgj715tIr`tVS30H%|+sQR>H)aQ&{= z%9H}55Fe?1Y6PzD*sltl_)HbtBS_WBC|aTFbs20A%O6GPiWSkkGrj+u1El_BagLOF zSuXW5h+SUUp{I+tRDn@#as%ZfEEsOez%WJoGkC<=DzoOUMY>MToF+b`-Qt&Wd0~n~ zj0SY<$DxVWq)0q6m8sm&*pziCwE3(q*XSt0V5y8_;e()a4RPs2s*TFB1r_QPe4{OD z%ZT*(IZ+mXDpIH5)lQNXGIw|AyN21#m}JwL!c0cY_9U1bnHj4PgLNg`7Wqj_PnE`C zbAnrXT8ti;y9{qKqp@Ihx(#pG=uD0$et&T>}X-eMcI4 zM~;*>&^Ob5ptmZ*c~KeKtQ| zy9Gbn{2&t}nC&Kmdw^H-wHZanSE)r*kX&g`kU9;gdgt6;>L}YN3y5`^ks1UK9L?Dr}?Tu@ev2dTQ_C2~l1mNvgNz|$N6TT}E- z>}7NiY_t0TI<7pEbmI;qftQm__>j8)ZFYvW5EV{5ntB-z+e1>MU5HxgRqezhsU~b< zP9)^`k=P(3$IB5XjFKuINQS6R6`yhJUaU%mg^7`=QoAEnf|u<}&>0>nL*VcammqFS zZN}^NCA{~T%8!^tU%yo0)>IwdwlBeq@EGkrO9k!pQVAN3Kfa2Fu;7q2RC`d4b&i#w zQM6ZHm!R?Iee#3OrRu|FRP8RySVi!&&ha!^Dv=JKJ{#vXhil5uYd%?^izymowb=o) zV$6bJao2@G3x^Mqt>=jM(o|3?!7t4UB4R2ios*@KOr@oH-kJS$3bxyLe`u{?isdfW ziAT;+4lFci?3yC@DH(uxRVA*sXKUP}Ev%;CcrC@-L-b1)M%wuKo)_U1JY{3zpx^A7 zKISq>v_$a;ZxMZ$Ou-FFYM2~MUCLo@N`~cF`SX#aYLg{WGn~26lmj0b3G;O`?$=-6 zqDAE?g6^a?YfDHXB*-*o@rruh@Jod6?@l%;2f9!osB{Us(TgcVYyQ^O48*16p%;Hr7}=9*Lq zc4<)N(W1sjzp}6eZcI~1@d>MbX59sL9%JEqFY!%n#n1ZV-uS*g9l+PN0$j-sZw1>h2WY$n0Bivc#_6K{@kd4K5HYDXm$(! z$jR)t_e|!oR0)n^-~T!n<-l2C&TMKJ-)nGJ5i~xT#{Kt-t-wUa9q9m9iX2Evb0i$q z&Asc33YKe(kmHU^i-nWIkcE@2re@GXmrWTom{A5(Sp?o=WKv9a_q1I=s$$l2n@Bcd zir}c}tkI3h+R`wbYA9p4Nu1KwXyxI|XhZOtF)*tHZ|Hft$T2WCC`@_klXc>gkEBu< zyOjak5c3`{JkIK8uCOGw1Z9D8;0Ce^%meWO=1TBrExmcDPPw!rmenQ=B34$~qY_a= z@T_8H`p1PxzN)i{pMC^V4d*)IF+1MQp7Cz#J>Hz`cyn~{2PvK&?rjdI+4vz?AW@F^ zV@Hg=&sDm2hT+s_d!KW>HJdwfX#1dn{<=1o8bVhheta!|2tE=0YpMC`Q|T5Dq_K>S zz^t&($N0u_U{6X8;+4ZMK1> zv^xpyHDsm1vq> zAMBO***G^KtI8!JS2AcL#pF;`EYLbs;Go%;naSD%a3tt!3ekD`BTU~h%bk6gn^1l# zjR%F)7_wp#f>A{3}Ak!A*6{#Dm$?5Nb;1(a)NPTRWs@gtfZt z_ypxZ-vTuhvv@lV70&`G9V~^)fq<9ao>U^iYq`a#t$b!&-qpABCxyM6%DieQ-j8Zw^2V|PnXLLtPgQZh`BHS- z<+|;MX4_@|w(W<}66zIjU0F3Jyg61v$0Tij8!C+1kRX$Eaba#{l4U;KZr?|X*hDh^ zSey7-9R3Uynh zHSUen$Y|eG_Q>0#yTN@9}IfaAQ(lJUigKKlh|uSk?+NsVf}9jOYyixH^ou4!j`Z% zVlE&4N(Z}Vr;l~N`qdm`%2=gh~kjzuENx3$=-PXrwm|(#* zLaX|wN&`E>tU4~v!$za3#)}M~6JJFI!EC9aaO6?d=ttic_LWf@*d|(i1$y;`>9k4e zFAm}tmi}-~Px~?aE4^QcKD@4&t)|7$%QVKLZNy%u46+{zd}&thrODN znDcSvKq;B%YOGH;;cs;q)F>FxJx)%Pb)!$Dze_WXs_HR2)~4%7VI5q8XKb~3RBPG` zR5hOD#TjFhJJNb>->@<381-%QS-88I{RY-Rs%4zilQuP>i0d{z+7h)bofE5)bmj3uDJxrl;m$K%@`LmwRIRn(zm@8^V~N`XX=m}_Jkm5)jebsow^j&abxhZn zVfz1rg4y&O)jA8K2#$S%_8R0w#fRpma*4S9MQK%DXN~k2N1_3Kn$(++he)7pwuOg!Uhq|fY~hQC5$AIfnb9Cl?hGE;#S)oRPTSQ=iDdKrcK_8H<6@B7l6!Lwpbj^~ zR_^R+@rGvKrcF~L@l>ZvO~fWJbaV_a7l{|0eU6#8&Qp;+Zw;qgy??`RAkz3@Z7>t~KTJ;*&`)oFs#3i%)(-Xr|Qj_`_a} z!L@?MI`QBS)o9o(EDlC`et40hQ^1_$BK3D{)dyy+9sjg%B4ML$NT(~-ZGN!%X_wWu zU-frfkS<}_oU~{MHQGZ-Ganz$on{p7GtUQ9EhaVT0QO^< z1$Kbc%NB_kSK5E7l&5%03Qh_Ot2r4*m;`@zjF!wS8@uI9Ye~MR;$gCK;G*_`nuz_5 zY90v&wGozx7#?~RIH`s=9yN4$<|B69=UA!dYV2=|Nfjq{k%Z9NWc0CVX2bUP%n-%! z^TPLHlQSd{Rg6bx(;eE2dnJmC4ZnC)vEb3!0p-OOr&oOH4ZC3J>_rk(#RAV77+&$o zPxL&iA}NVTq|)%3qipFJ2Csiv_d>j94`|}C3q;) zJkbU4ubEtPq@tx6WgTr;!R!rRc(&EocO*ci#|+U|e4N8xB*)O>gaE+a$n68VaBFWv zKBQ7V+n^pDJ#zm!R;PQl;*R__J-S&fGAI?taC_9axx7bEkcHMs`cyIcM)~SxTNEd_ zq@E27Z?Qy}oTxI)pF#f+9tYAD{>R)ZWJNqw4bk2CQVB}n*iuZjbbvd1fMJP^V5yWc zLj+l7QhX}ygHqa1N_VEXSSq;kbFDdOXBRaI2ZvNKngg^oA5 zqS>pdyxE%D+gfO()TmQ|EY5UWdIpEowJbWrsu%}pGyHTjpIWitpeW_}Taq>W@s7dC zA-xtZifGIOqhUCmUk-_m5xO4CqQPAd%Chbh0YKEgde7 zyis+jVuD1p%rV#NYpOhOPS56@VIil>F)()}H;J=#3_T|3l+1vnA}xa&m^ULF5_j5kZKS9NV=?((lFEN_G%d@@$5Z4r|0=MGLZBpLP3(FI_XM1LE`eIMC4L!Nsdc>T6|Kf z;<&0U!2R)s_{CYF;#h3{{*u4XIZ?=u(+1TZAi2_i)k!I7MNmpB@Yh(DnA>JsfZf12 z;Zli|Y44hoOh39D>Jfrc0SD{TkRo{`D9Hx&^%5(CbRy1(kds1R-Zih-8O%)WN3q~$ zsXk^TIYGg z)RHr`v~C&U3e?L;oZTe#(tx(6>=|!pw+36}H1FBBnRtaWUYX*Z`mWtO@@US{UMoJ) z(GH}+f@{g6XlJgI`1-?S39dF+K-G)yQ!#e%OR7Z0aZ`Ih72|z}KTm=(TzLhbgCz3m z&Jvj*qed5G)n%=Nl6xkAuw?9;oH zb>o>SGmal;GyJDmu+YiWDql)OM+$RG#fA5s{tK7uL{AZlH_rEa)C}F77MfQR&821H zyHzkEO44Nv#Ub1W!-W}PeR3Y>wlQ5N9;vg|DQR`^mecgZaq5#r2bEhBB*&ZeVJjjb!YT(?5aU zjaMXGlo}NsEF1BX?Oz=%>&59+#rQmj}gRVEb~<{ zKFBGsW|FpM@<^Y7xh+EHACm$_NP$`<*2BZ>>}mXRpMkkS^=HAavoyJw*C!#tvHT`3 zMlpd*LkR&%Muxk^{`@w4sMvs_x+QbecptT%uv#^ydpc5@?i+L9Z#WLPdXlENxVZIWli=^`TTA@v+5p9ZpZabR-%yz; z5$6`s3Rb#rkCA#~p?#k^1;1*-bET{owA86dnAhr>D0GOe(((#S8$r5+mvb{a{IxHW z$uZh(j`(D@_~bbf26YO)ZzD~4U9byu$h>(LNm^IG5E6AjHH9kPb&J(0`0>APNjfDu z;}w*DxMmUKY7)L_d07?X@_vlibWc{N;I*V?0&ku*k3cQy7gCjYLZgqme+T1;pQ?;bLc(IMQ+ui&sD1R4Emac5c zwmpgl4LaVGYZVXW4cwxt)lqo2Lkn^%6eT(RQ!BF=b9}OvtVS}6wwfzd>L`}b($d*2 zY^|5!D7>vxk_}rRqn!f|UvTFg(^ESru~RBtx0UTA~T7j@Pch% z?y_T#GuQh!MAcDRf5l=0Fkzb4Ntl@bLu8`X^>#{RB++8ZDYX(@E~BM_v**)bt2`&*$7WT#~eLp@M%Jh3{4CaY7K1z7M7binr=Y0B(=@MCCKMY zcH+^w0fwui@I_mom|nDTMp;v~cYZ5ziT6zEDr@{(>|~fukz37#02Z6Z7c1fuD1{{JAF)=Cyh~bNPJ46fVosVbzGQm;g{6rQOk}q>k`9-f!B^=o=^z zbri0)*Q!zYD#x$#1>g0Ha-6OfH@p2XL3fVp1~LuUQTT2eD<*ci{A}^!`Sa9KxW2sv zx6_Fb=QIlj&czX4)RaKHIHrJUWM`HjCyLGK07?rW`qAdJn@W9@?4VPJhq2uFYYBp0 z#7hK!DiE~9Q0t~P*zhp_21>kRc*&v0%{U=A3j}{*4B(+z7luhNOHLdmSd?rczP~lH z>WiarX|j&TINhX~g(@-&@tBdRu~5FmTEv$!Rt*NSlkuI*)c-v`U_A{V&ope1V5xX2 zDvb>5wzH?n27}C3si4gTl2XAmMhwRV@7c)IqP5Q40CDb9FpNCyhWMRmn+K_7HW~9a zCd)TXaE@EW@rW(TDX!E0Z19F~I`;^MM#UqmR3qL=x+KmP7a3k_sS^_6qi$pR5Y>pc zdo@vwdMnTr?J=8#bOcfaWdC}K9u!_{q39J(i`!&N|B#%oj>2OzbPceF`WMJ4R(+AL z&Hf&kQAdZARQB#V3XdAugypwe;fzP&0Ue7ujVPa>^6`2uUa;$qi{oui{U-i1vuwA3;a(_@Ns+pkU9#lo3P(T z*ej@#r5E&5CYgP4290G6q#sz>zgit7czXuvz(})h*s~^(Rw)oRxJEn=dLigFqf49DB0_iPxaj2cFZGMc ze03Dov{)W8wq==_GHzX~M}qV<+3IBW9A33GxKpQ}aMCY4q8xbC=2r|2*^@(e2eZkh zG>w7I?K=N(Tsg#fysBXmJm+-ED-vOFhMau{^&HB98N7{a1P6qu0~p07DUvz+TH5b(>SaLb@$q ztVwSZIK8r6g3959tLM%A>1{YoZ^CbF)e_M#txIh-L3zQxNlwv^?xa6Dp?k^xjf&$i zugvGKGdGXPe6uFC$o%Ft`zA{A|4cLE-Pz4E{2f1N_ZS8NN_H$$4Y*M!f#mS6zsJz?S6TfQ90=-Q< z!i+;BaC=U6kQ!{YQGEAEm3E8!_fJC$X>szhM?BoqpgZojzweqjYga*tr)s0Nd-;~7+m3ezZczJm07H@$fSR%7Z_a$T#K}W41M<&cgTcFjwNZ?c6?$l_tKG68oQxS7)J18+7y*PesQ` za*}woa2|0yRA|fEU+T!aV$j+04dR)$q?faHNpiqvVIWnlVw&Q|h$}~!^M8XSHLSA) zecL2Bn8DmhscCKc(+zqm*ts!m?@t!Bv*2kX$V`H%4|A59ZNAClj^5JI;*m#q{&>XJ zb1$_ZW=0N8(95)w7_~QvWTM;@RA=FBONgKeWK>8Hlp9*o^jG_US^W;(FQ!^I7qC73 z_M5-I-I{*;o$;1xMT9I`^7!{4#KX434JKIfpxMw~qi|4tW)+mxiA#P_XQ4P$T4p=K zDBPYd+)6RDSVqej^_i72HV@z|br#lI4*DSHA+z>tj1PjcNnAoZT4@Ryd!|IHMJdN(Ib)y%F)7pBr_0T5JVxz{Py)w9n$x`k z9kJrkn%pMwJqw##a*KIMg<08^SIP`b&b0M5rghrGW^FHXP+aWgr>DBUHvM*!?t1_0 zC5yJLo#d_zKXvaeq$SQn>|P;_hU?rC(V(yibf4iGCtj;pMJ^Hr11xd$R_ZDBUyz{;sJIZ?M(jj zNj#Gtt-tN>*Q{*}7|u=(euX*spNzqyrc#i%B0T}=5)2?}z_~@}T`f2#Q{Y}=7PG80 zE85G7w6GBr+!_zy3u~y>MAOu!3+~qwIzX6f6LBTu!n1>aSBEc)vC`W|pCBCIfW3OlZ!^>YkMlvbT z?8vX?uXV<|1&K<2ea}A{DX%_zcG!@#7FeHQ?wvDrYOaV>og)#f3~Y{zhZc(2;=#sJ zr^Wy{V688u?n)@0g91seMCHunpP|YB(*{ioWN$iWU~kpdp3$rT`~90GULrxX4$8+L z{zhrw=voJ9l(Wq}oVSAO25?BLP&~&yi8@t)?<^D&F}6;0^wYhG9jXAo>W2j9Z9Em( z*|@M$X2^}=!lgBG8eX(yOGG?asTE3(lqXLx1#eYB0()%o?`w> z|4fE}Qz)RBp6E_r${0RvwYgRstlcsqbjEU54x&(tMx*3i1Y&;WZQ)?*@d}nRMdwR~k!TkvipD;QHJ*IR+#0@-4Qr2vL%IxC- zinje|)l10-Ytt`h6VO&XO4+f$nKOSmxQ@MMmZi#Co;EA`lx5X0?6mk*0Tw2-HR*E; zjdTTAkSMB>s2YaPEbb%-q(JbAl^~G&cxfc|X^Emh@P#cz{MtoQMUpdk*ceTNK^jlq zv4o_YG>Yv`Cy{^1sVKRzAZIPe=7?aDpH z43@(LFIqyX0B7piIG%PNt@fT7;77Y!Dmjul+G&czHcLcoWxJ)18ipPrz8S&nHp9e$ z9@R8Ks5|2vK zZ#Ag#&u^!t-#(Z6cA5F@+VtD?ToG9P)V6^2X4~t`wqGN1hkhjSi0uM8HRIxw)e@A6 zLa0LeLMO`$=0}A4_@r1V!4l{ejvEsJhNKqYUX3WoQ;Ms@P0F>=xfE_xtF5?YD(_Y+5bRL%l)|>= zRGB+;851OKdC}~*4(z~m#gG;%;(DKa4c=ROxhlgBoyO#fM5ZdhEq1Dwwtfd_?%bpU zk0UZh#juCj*i`{$*xj_p{x&5bOp!wU6Ia-2{i4pYNz>C^wBU+M72rmDh~W(y2@sLd zr<;P%OJ?WZw$t0)uY^RkHq{fJh^hchp29U%JbA66`w=mj(ofQH|}*WlyH=o0hI+uFx*(VGBz^fyIN!w{L;iZxK>*Aub=r# z&?c?0h6brpyw;Ri#ReXgRteGlc?YS5Prjf7T{h(onyK7^-&!iAiZdJ$58uwPxm6#* zOH-T_N7b={YdiZT!e>8?pDq!a75H>U>gk^Gl?ExSw7W}7aeX3_eq!RBA{yXC&5D2U zrKO@&g0h@{6_(Q4epGh+L-i%1bL5E z$GuW64ot4(&ukos?;E7baHW|Jr~vz!;aac4D27{@J$Um}KwD zg{GjVn3_=6W1J^5JG4nuj+Yj3JSkD>&wt#825sc$==L@Sq(xRI!MYPyszOQyYM($3R_f8nM)E~Q=Y z)!CKY&{Co7__fK&k<5?^$(3@Ac+HYbp?%v3$zj%t6glR+ZdUnbhi(}S{UsuIRB=g> z2y+#}DSkdJU2-cMmjQCA^cUV=HOagaSlhZJfk)o4=o-vB1j>}aHOBzWnxoJ-IdIzs6!}Noe zWLpO^JalpkCIlo`W{9mj?0eB179d-2XpExlUrB|+pe-Ad_Yr58)JSUIG-u@rhYneY zh^=6^c%%nCBB|`2Thqm!H;P5Y5oZx!sz}LOW=%vjEf9Y|uvwoTwDA?-_6`+l7=D`? zRt30HX>{q{sdR!Di18bHr>;=}!L!W)ojV|+0+`Em zSuFFdcnQOsp#r!y^=!LTu&P^{NDeL%PHUn@1#rMZ{QUBSfuA2HcpntO0)hux^7;Es zTeh}|P&S#VFLYT|s)pgGsR7ccV3yM9yMAQPlakuCJX2Ng4eh=&*Ew^eHt0& z?1M_TYi9z(xMs+lQvL<%T50Rc)_2VYS9N5Au>0i(TBm!G`&hjMtV|FvC{%DS5eA&} zPdhA8x%hCBQw_r-%5NOcKPrtTn03(Pe6M2MUqM?1zHQkjjAO=yNkoD%qsd7c^KU0< zjt1}r(ZC!*!|*$+xxyC0r2kzt)05RShi$pW3AOb@bLj7K=>5bea|wp`Qjs&qJUcb! z-5utsVc0W;+QZd$zskjvlQh2MF#{yPdAY{!CYFJB7f~b|pKk0Uv#~vdzmZEhx=Vz< zkRK*5<+t-3^Qa3lJA|@h+vI#zfLV@tB!C|$Ck3$E9ZL-9nNJ^^%&u&3R1myFUD!vR z6rW64PkIZ zFt;`)Mc3au@N|#TdnH&(ZpwLiiy(Ss$J>(`VZOxCYD;EpUAxs>?>jOmEi#>SLuJz=&ZlNe`}ujXfk1h`X&hZsqFM1fO&S5j6ejDZ>ahCtRyT#=j$V?`HVb>%$vxAv4y=@nh_EV_(*VS5&x&B%kh*%9LydOL2-7axGj5u@7Z=tyi?dcNJ57E9{io>>J@K)nKRe+~D=;?W$Xe{HW#(_Pbd>PWNFe1a& zGyIx;d!j=<50aPoMe>ArtV4`>7EdsiW9=7apROQWN}{qLMKzY~=DXYVyM8CD6;{En z3CXczPN$GG$m!w}SL*1kO@FkQ9~GB!y6&3DPpF7}oDnLMjp9lLL9I=ff9H^H85>mq zUreA_b#JF?@$oQxbi$7G5!^{1!4sS~ncDx(46pQ*K`MX+6O+8*iwu3(-a3(ot!7NE ziMs#xuuaVokvYCuVqBkn&xEvy_0b`1$({T_19960g0~Kt$BnzRAxsMd-Z~_tlVLnH zA$>~z+^L?PvvuN=PlrlG4oDEkwPF-q(;nfSV4HBCo5B~~8@|QO>TYRBa-|)Id@s3j zn&uvJb=0C9rMg z=Lbyqy{B|8tH#6Fp9W6m2PO4N>$j#$+D=gW_ZQ=1cTHN_k4(TZ)nFUAcK2PW#TR^OnQ9Wi$+6 zy5y=sRl?*Orq^<7y42&$y;0mxA`c3>h9*cBV^m*i$S)=P5Uf6gb3m&a6e)!!NdB2| z{%MAE^5ld{)fpdH3EAJ#qBq8shg5U7KXhq2=#M0IXuUMB|CEx%fy2BM4K7Ram8FMP zNJN%vQ>E`@siGhH^6}izhVhBkqfZZ`Wp0zQken{hDv!dscBS)aJ)1Q{XN2dzDi`f)JoYoLI&P;85#JGhb9^L z(s4zq0Ph`6tH)%C$S=AcSF<#dk1on>C&T%$W*pjbv+*HlS1axFD%q5#)+;c4KKh(w7(*m@~n zlWh%SK%+5R>kiSI`N;k7K^h2?X2z|*m<#Yo7rh&OaxQT$ z5|LU}h7VKyPz6}jrOnVZB=>4nrpZwwAy~aCz#Uzf>xOk_7#w5TZnN%pSvLdy1kHD9 zc?#1Sh-12JfslS>@JvV(fCxeFH;Ic*Hc!WI$>G&1fCtApl^r#i+Fd1h?Ql2aIxs1KLn%MFq&Ef6v1>F~ zDTul|1;?hAZwB}HuX;>ez5?v*(uN@c29c+C#c$@sP3vlC3iRHs;M{gF=5}kk$SYmD zF{0Tgu&q}Lv&N+syge!^4>|n);L-51pe6;HIvvf=!l~3gCl!r$Ne#yLfYH(-CZ|A7?zeql-TNw$}eY z9Djo64vk5JiEXp|Zcg-LM{uHxx!@b>GewIDk9Vo3sR-*iNIc#}2d2-|KlXL05SQc) z5=u^kOQ>gyOHNEJPi?y5=a1-?v4G|lm+aIr0TCey~=WZg+Gsyyx|q>~r60W0q!iSyByaNZIk~C3<=Vj~&rE zfd*xqn`uk#%(Z`*5AMEPQMJt{A^bGty zA)tm}D-G@D-n*}hnFD3(0dqAT&NNm-*|B`=o!p~ubY;3sCM@DzZbZ5i_ogi<)zFWyAM2XkOAW#0^+{^@rVEW0ILwRj?9?3Nxqdtf9Yf+t z$!TjXr&;))D!_;A73q;O_PSKdPaV;UNtMcuH&RcQ9l;#?_l->oCSP>*N+hL{=2*?@ zcCk7cpd+$NNzsp7qA7aQ5p6i1CcJ-F;jdl2soqUXS9kZ3+DK`L3is6WRC%Y1K2?^~ zr%sjkySU{agwnCOZ5M0n*B#w-0)wp=>&Dx=RZFDUapI|hLk_4iygP=3V9>_>NAlR2 zCJ~v*?>{!axQky%Zq?PQ4683@X-zg*dL*69bLxwvTua6js=w(HlXB@x!|`?c1rH;> z_^wNgaijz>To6t{`f^~-)mumELz(_3=0}Li&_Z@$!NuCQ{&}|$c?N7D9*B zG&FO?VxWKc8y_Dm~wmysbR63eVTO? zSFxD>)0wHM=d=(?b7W{RrOhApb4s!^xHEn{(hY~Ziqh0i7g0W$brdD1t!AkRxj0&n zVydk&!H=VpQX)Uc{v+KK$W$5jjON-IE4^Q@v?j`{jaA;$EfiO|xO%jvl08SZv8u1f zgjE6NWxBZ*R~l=vuUjatN!r6Zs8gKQBIXE}aD>IuPafeiN(9YK)O%DJJ~^ldcOFIm z(HK>Rms11bU`^q=%@Gs)H2JUM^`fI%C1~7BzL-i+L>f-v^y$A$Jt?Py*_&sN>PA$a z&1%RKCFwVBv!4P(F#G-zS~0IXLX*gkmvBF6h{voWLPEQ086HY^Uhw8oZKtSV`1KO* z!Wl<|I?1iz_0?Rmy$U+D=kMC}`oh{01agcPxTwBDUJ zAE_D44uf=VIkH*}!-`9is?8>&hKDc7GJ#mJD-ER~}7KV@nUeQ3bEO!QCU4;+otF{8B?(!ABQ`4XgTnNAX6ffZ+3s z%)?P{mz$5$=H10(n2NMY@S43^v<2^lMknRnD#3Lf-1?kGd5qOm-*qNLKEm#&?dWQctQxCJF2?2G^r7DKLyKDig3x{W_2I1I%P-u zg*?L1JEjWo*wJprsEwhzctNGHCJ$!OJ4fdp*Z9E;Q*>H@H?zoI=vZ5sD*Q^;pB9ip z!(2_-26?@f)mF-o843a|daUGhW=6!?E@tokVDF^ATqr*6;p;6fStX~Tc^pmU;v)3b zC5}>}#)4dwc$IiCsY$?9?doRkN_xj>b%;wuo)MSyA-sfQv&~)2`)hNl6Oub@zaZ^- z-*q%~fg6oI^uy8m{RX|e9zHr{tbB(TlXC+sIa&+$Z(o>6)sn~XXyiagF%q1kB*5;vsD{O zzMLv8Ubukl;pwbuLwk7bf!#ss0c1Q$1yiU+EKw>1dv zNYoGnfp>efC3rIN13{lzgu&A? z8xg!^38g+}GFiN3adSzwU63ykb);af&2KRI-x?fCRjM-VR zPJ?3RW`zWUoDz_FMh|%ePxq+6OCxH?iLX9rBKLG}qm_qtl%MruW14p9X$sV{-@EGe zrF;vkvuJC$;{vDZiBI&n2wKdfj7#)F9lc!dbtl`l3$Ce4>Z!kU=gktUB|?^lJ+b7u z^ozfq7L}Vv7R0xiy(K0BGuJj`<2;W{}<^(xa(MsVa{M>$M@$aS?>+UlJz2^f|rxVl7mqNc*Ng^Ikh#p z+)wDpw+mA>CBc|49m~z{SXL^YT*)fMx{EUrCsnytR_Wq_Z~xvdnA^mIMUl!N9p~x`TR=CSb_(SZ4{4us_a;Meo|Rpdn~J_ zV{)=S;G+z}fyC%Byy|>SIJm3(Gx)bY$N9+#Gn>b|TD6zp8VwbIkuVtv?)7FU-Fu_}v!6qYS$g zOl}evCd}v2^XvsRrWtBM7LT4C7wB{S=B!ZR2%T3Wr~e(-bhT#5DuDYg42XuL zzGs|5_v%wfbF|ifcMAO-^p#R|_hxdhU2j_<50~Pp|B+noI;LKt9Kap1CUXE!9m4^< zNY)@&bxcU+NL1L>X?00`dD=1FRQG4pCA&*RJ%XtgA`&FjivOGI3=JkslHdT^`LQ{=Qirs-up&{JR$_8`nS$&)$5DCT zmF>rzku}V4h{unu#*60@q>I(ZYO??@Rdxy1ogYwkd|{F!_UI$$Q~kgca#kJ9v<_5( zMbVR$EP!2?>avW8$mVkLED&t>XB%G8R|~Nyx>WE%4i^B6qebF-SeWB;8-@Qbat?4T{Ac0^{(X0} zNZB#{e4Qh_0B;=YJ`-DWs&Pk@zyv0@=WYJPM|bn%_wKYe^y3MCd0kkrzk9Xda!uxA zo#+~396b(QA})DYJRcxY!?63~i1;{HJosXimTtc}KY5wWqy3)2zEMu`;ELnCGKL%3 z5OME6HsnCeiQLc`r6e8{gz$JyH6EG5J`G{>H?#R2Z2soDrBW`74WS6b0)rf|RwFlr zNLX+p9hDfW$<)1BT==5Kj9RStjpCcR>51BkmCNBl&Nm9VtPlO2*s)Z_aEUV zczC4tR|f@$$5a_^K4?z9-lW7c{14hb}m3rk*^6cuQpJ zZBn@XIh*cRy4Zsf;P1ph@1U>&7KIQ$&-QnY5(PoaBYh zZW$3?JvlO872vIGj*o)w;*m)S_JeG47n&Vlb)Sj`GA@tp5M#C4(-kdqGEIRL%OzFH zj>|_HLMskrYmwgSE@e0;nP?)w|Cu?Sa{8KmdC5s$x$ZbWo*GpoE}kiyM%I`j#oTP3 zk>8EfXXFjpAt{s*GJ*T>?osUgN5{FDR?q;vphGpkUpz`{)EkfE&KfQrEuGyRsJ5029YkVT`Y?QJ>Es{&Z6|NZuH`k-Ah>i>Gs@@V?4drUl9|HNU{ zw9|9{Dz}siUF-8}wWRcwvjXQcXo&E*yGEvW*{0$)+<0L?@XgWLf_=0ysLr_VG(8_b zoa|+)IhuY-B_esltFUism}b=*FC5KlYxXg*C&JXk9tWjak`A^3YOi`@LF!wKGyPISC=zle~yY<-i>xzuAQM38n$;0GE zJbCOAtUEtUOGBG3LN7sqp2sC@>+SzlTT66Xdvry{&fV*5E5$>JKjn+v>NUyv&YYw{ z_Chj6BI;?k8!g<-5y5&(8=gu8W@;3EL>zZWP;S(dxpAa+G(4UiGSH&IK@1-d++VA0 z^#y_@)bTVb_32u!t1+(oFO^mAZzgu;UXSmg%s2v7HnDkYR z8)G~QZcNXkU`|dOZyuwQX#U@x^V%*H`Dwij286jd*csdA33$c`=t7g`D9QhYQ$D)d zlgyQv-NQhElnH*&gEZFfha8$?%p3~s=?~`jU|#J2?y03K^&=;f4h97KqXCl}ee5JR zx~Ep}zOS7jObjGby)zpT@n$Qa8-|N&2=Dk`9RZE@T-V%A5i$Sed z@M^8zMk}0z&Ae5cG+RC3)V$}-+W!~cv*g&A7Uym=umIPoH*HOAwb$XQ&zXJ#9@yXz>q)gFXaGoGc@xm*{JCyRzdSA2dyW=xMsr zn5MnXkWA2MMCR2(W?QacbbvGaUTspzS?AO&nM(BYsb^0c<9|+%U+ZlD2YvsOW4YKt z;bnF?F`=#e)KVIslaRTRVv}4pCRcw~G>Jo>lf!(Cow2sIlAUc!q{(1z4$0uVs3wE^ zb3(Y7Li`WWunHid7xTuP5Vog6p;Q5G$f=O>3t7(+O%WeDdCF{O4Y)1GtpeCF(kULA zI&e#Nh=}4(MiP2FgFF9jEej;ca8lk9pstgZA)12$A9&Pye$ZTAx{vVmk z>^d?Ro}?PXs0y&L2RRv+`}k79OLbwvyzU`99 z_K>+0i%Uw)v@L7XZ+|B(6{||zT}#(1&3Lmre4q5RRT>G=^wW==esSq?POkG7Cyz;= z1m`jXkGM*aFr9wW{AT0V^rSrBuSBr)paH!?5|es~NN@2ex8VJl<~_%Fc>`UCdeRRW z4t^MsrsM-T>;Nq`Bt^mRIhs>F6XmDR<>+l0!CUdb!EB^Ghiqg=^nYL@ujLSt*udH! zjp|*oF{fSy@MJW};$FznEN*r5e`axicP#PFE{a!Q9TzKAZY;Zi*FO{pZp-?JzDnnA z3Y_|k5ZqH25WLYng!>PguOtDS_iqW{b%OxR6{sC(uE3{U0TsaeBZ?4ZBfNAXuNmMhEaTGbf$?^790lZtwJ+AGWOPoC7^a=^CGv@2Z9PaUX zsrmZan6I1ui~0Jy3H0CW@mKX)KKVbbw=x1X2Pk3Q?!DiM90@<^Q_wK9Q0OL47w zyQohMry72?fH%BKp%hEM;^Jbo6!G4gcvXC4yoy;tu2pti5hcU>J%?UTyI^{))_s0= zhO~ow^?B@Df#AiSA;H)tboJ5<(#eYnPQmULrhw?25)bC|2&vBaWyHVU*P)bn@IsGj zaS3b;2^}ZMt*2@o6bBtJ_aAznhiYEyG7}lb~UZ1PAb9i`r4*lZUmI z%nATw@A`zxU*}zv?`_?Wem!n6d^(dXsX_v*(eUuIcHe z8`trYzN(z5(*sy`9+|<0p4=%9>VI$UsgcPK{c{$2SE~Zt=JNJtyUDL?ENOhTRev>4 zfAtktcfu@*VogHFcYbtUKD8pjmp#8H172+O?ERiz$<ExgTj2mYuJLaOsAso$>7wYt}Qbcb$u?S z_NWvebSLuZ=G$lf{5M(-}qYeRk5mP{PcJ~%ag!LGb+Z0g2;QYqT$ z(qu9BpZ|BVD8Q^9u@qF%G9=XyzBHym=5X=uG;SU|J+*X}p=P;H|6{o`&2n$)h0_7A zi*(;Vba{I+B5lwFN>#~qC`o^?K3TDY1{&K9f9XLT#nVmz2y2{lic3?(Q*OmPZ2h0-14 zzv!o3p6cBjM(-Zdz5CBf$G`90k3C|%Jocd8on`j!?%v%p7W5Mj^Q;AR0AExH#@T*u zYAY7t*52GDrN->6KbP7EcgnTB46ok)bJIKXkzU*%+?gAzS%Ic~!419JB$kW!E%a*q zDe9rMck57bp*}2Q@Kxt*%pYHguXHh<=Xa!nBX*zIO6&Qw@il@2owEg(j~~bWwwSWg z+F|CHUf`Hi0K3oC=gu{~w8Xu>nrQh4bZYN_;6qERdA3~Ji)YK8bM@IWvsb8)0;M(z z2k^4~?B3L8&sdp1xIplFo>v=iQ~-}wCuwP8o~ETost=;2|1FLS-}Q`P;NRxyot#!J z;wJ43%k!upyj%UR1&O4c0bBB_X`FfPptUqCP}JLWz~al}0=deH`_9o=3%uXkom%Ji zbDcDE_GSR}Q@u0`-gwYLf5wHTZ3vEPG&-^C@a(^+nc6J*SIgy}ZCLYY8ac>@HRIy2 zM7`|t!s;TGR5b-p^llS$jA=WcOHQd4H}^^TpwdzdGuJ<-%3S}s`Q#4$0Ra!vDXZfva7+$E>O6#q8l>doZWo|Ae=FkD<3GCfu`9ZAMz!UcGvxAuuXcuszy6iNXby}?~Qn5m41i%(H)c!R>4 z{I@DaK(H>JK2TnClRG>$TyuvH-Mn^5cN~lJLWA%`A|QC)Qk^H|Taq?PDh)56lMDxW ztaqChmVLsMsGLF09@}WGsx-ug{rTFda(PvzV5`+{JiOKIO$POSJA94tXs)|jvQz*& zhv!SFkr&|KTI~LQ8W=KTf#C7H7?=QLBBKFr`pWFd{|UCi?zAC4uC8k_#btB=Og0@ya3^%yQ84{7P$ ze}n|JnkG(9$+kJ8%w_n4%Rn}T3Ql@H8#2g${{T1kj;$12*)?1KvO4%~EQ9cIdsjC;8(WFn(hDJ{ z3qBj0j|E-b_+o4&7X10u7h{R*VAi4=x|*0A{n2-0^SL6QR_T+hJ)eB+H^wRpg93fR zlza|Y=SdJ9+8Hh;2q&}@I-;eRK@W%Zg6_x_7l%j-#qPaH%^OA6Z1kd^~3 zFsFQZA8qys77L9ezNBu9+HuJ73!<6wVjRb{rc~ti^oOhZXs3JRpe(gp({DfR(=8*C zvUFK4G@JYE;O9B%=bs<^yd?eni-Vunrk`&=`1!Q-^Bo62Z%;q}^5Exd)6aMH>6Y=0 zvSZOOI>kQhqd_J%f{){Z<~l*|1LBh*a<3qa{!xm_CtQ zbu@1a{UsgRvUaT5&z0VWjc+asOSuNk@Q_E_p)ve&StV}D$QFE$|8VS73qybw zpQiPs5BgW*=gXWD5zIU^gkLYKlq|uV|E7|^oL#IZENE<^cFQ{!21vQkPgqXq`lqD0 zPvvY`EhkG=Tzreg)|<8@2kc8EC^(YBOJBj>O6I(#Z|57&JeoRj7&!*P7z^Xdj*o^_ zijJqdr%xzOTWFOIMdW$o$f7KH9BU2Y5|cStE=x{dU;M}`ESL?t6t+gnn~~C)NMBN3 zn<`m=cRA7G8!UNh6lR^paF*NjEhh!|)>ADFk|*WTFCjiDQDsXe8~JBmlW~&6_xoE6!sOy&XI^brONP2C8r^M4qV%p zwqpk0IQoi594zM;EKyq@OwZUWI54pi(=rI`ap1tjOtk9FlS}RF_le_hC4b`bNpE6b z$7=jBF(3;hV&t^L<$Pxp{bS-dT*04a(fxla$`+DE_fH&$>1NSHWwJt5hPU+MY5_(t zyKft=w)(LlGgg+%$Tyh`!f;utaWbU=4&6@Vyu>A{@uh{eRVsir-0^~(Y|(b!g?cpG zE0YecPe|4>QU!2ds*~>-oxE3f@;}?h7`7S^JkV0aSo}9_*^+W_{_&3((-jPsh!hVL z9~E(4KP$8YL>`uARfeT0npFjOyD!aQj>EC0V>KxaYbOQptcEaZqI`PNIIQDOyfA4c z9`9I3_yrEVcvbj_r3c+M=^Tq!NAkVHB6 zV4{4xZyP?hR12?J5T7iQ7A^eD;Ml|`*I-^ojGiw8NrUYZ1GyA(Sw{iB@c4yTWTA2C z8-3*?@0OS!XXrBHANqKCC&$v#5rQr&1S<}W;r8*Bsxuz0BxQZ!Susd;#{FlJV0U_A zxFlb2M2tJts)Gw>ou$>OpFDmxy04Oz>PC-=As*nfX)IwpJIV`(wq3NIm5GMw z##rck{oxCRetg|o_W)}WMS6q1(2wuG<9oq^lVc3+%B3CarbZ_-!B@yc7Ffyd3SKFU z33haz$3YChWMhxQ>c;1tvjah<7hXQUg{LQeVA8VJ#pZ&BEhsn zz2XvFL);T7)W&BFL1THQAvJw`?9S%O)Bx8Q z16<1iV1?hWD;Q;rZI^hox}1v+Ziz}Uzg)wDdZaQ#YukgR9LpL5=EO`b5?odzG*jU5 zjv+iXX(gHim=M6|01^SsGk=@bdq*6ln>HpqhfgAh8=vz+eRJGI0e*Jztbt-i9 z3mOBk@t}1)%KS5!WSZKxri;%xf$mJ+G#~7zrB|N>Z_;+qQ4&#|9r&?A$L7rI8`2)3 zuPU@$G{3J#U;bwNn$g#9W<+Yg-0aF7Cs1nSwRb*QJe(5FMhS|oh!RMH1f4R_bPcqc zA3em6Q~+O|nLgQn>PrXY^{F|1tgoI^@kxsc;Ejspye{jj=k@i9gXZ;r?X`HL4`nhg zc}CKfGu`ak6YN^C^i!SjX2m}4z2$u=%9Thl;yM+_)e@A&5|r91%BUW3L^rn#)#((fh~l~B|EthbL9-d{-%6% zaG#~@m^m~hE}hWIjr-}DT3ovQc+KIqovHca9mi8G$STDdVN436IgDp549ooRpl;0Y z>TaN!u+C2pdND2eLZ@XT|H7S4uF?~ ziP zg#j7PMS)ePl1&7Z9V>@w$C{qYeJ3y+_^Q-Q(I~14@Ub@}k%gmVfXt8qstnhpT9t^_ zFm`(h7`(@*M~hT#-g@Q$nlXe&?~h)cqXKSmX-Cnnp>L+WF1x)td(ZwMYYcrx72t}Z zHV*WP)HLn)&Xb7tfL}f&U*q5RdqYwxK4Fg6n@W@&i-%<5CrfoI-1n&y2+RLef3t6} zPR4d3@6#&~yz12(YJ10e+&U>=dg=s-LGhJNV9eF8l?;qa$3+%k?g@SgN<=m>zE}_s z6i6PIXU0(aA$~o9`#(>v)%=|q<$@A9MS}kzhDCyiH?i!KLyW~0-0r0_vkb2fNz#=n z!1AItWyjY;^eS+=U-Z_?YP{63TE`o1Jymbo_5mS0KBXBUejg zWf~sZ+)|4H@uEQDvyv&(W zNCqrE*(oD1W)?PDLKqc*3W0b$J1@T2GsN_y;isZDUWH0aSfOCD6NgsgC%YSMQvw<% zg&*znaNQIqHE7JR`o+cQ)3D$wYc^&lDn(zr(pCFC88VZL56kr&yiufS<)I-2{wyxy z26$1A!wJ?v42krF1?BR9tZHYA!6wfJS&^9lYCITt3VcHGmguizpBM4}m z?^r=o>6!G(V8hwrB!092%Zu0nri-|6zUqt@xwG-AHx$xDSuVtuQ_GylbQ^S}-NxEl zn#3jZ*}19u?}Yw)0{^}x)s3~Y&2C(C5|2S2tV=Xbia?S%<;nAX*NO9VRvW?Wa;?kl zI?*pxgLzgTZ=8R%bIghsoJ0ch$zp2zg1zNicrvAwsLzW0l0(hsuEAQI*;W)9bm9;x zsf`mJIhdmQ{Y74J3hmn-6~M=XlbyJ$NDCQT1|KA3{BPaaf)|dD;p6cEL3`&AJ{eEe zL~X#H#LpB6emJqU5RJ6oM^2})i^-@=7~9sl<~Ub!!kCH2$SLdVDP!f%`*lti%7;n7 zN$rj12d{Esin+v3=_USrSf#ndH=aoT9fGxb6w^*r5oS1;DF8eq{mrn`dcu=shnI3C zQ^mQ2=6(JtOD$)~O=e@?p2U>A!_U?W`S2OZljOCNzGsNaIjRhIm#0{Z{R&lpttZhG ziyf0{B!ZheR+AsyafZegZat}jzg{ip;yij{g}7|1Y)I^*f06wx4;#5f_MOEq4k!#B>&SG#2rnv&AEeb%1OHlcozY+)^gzbMGyn zByhoQ>KBGSBaYi7DBp@tY`qRh(B?D#{Gc9Lps!| zhkHos#TeGzU4nAA1Z9X;smkz~o*#o_95|^BT?wehrFTk{>8WHP zeLncITqk;*e`1UsJ&qlvlaXjhEp>O1pg0O8YPgVTZv2+_p02U6B+Yz|1WS04!JwX1 z2Q_*B$!%Dis7qaau=RFxWpDH)-2qg*B2qPUreHkbG)ampxx*}apHH)vh&Wy+pDY(* zX*QppT==9(@F8D_`BdOKbUI~~lwd;~Tr%6pRVTZLDmyMeLmx+4 zC|GuKBkml`YQN#OmIirUmEn_AbE*J$`8dp%&)~mToRlpQX5Id(Of!OczBU=on;{ob zUt-_LUXrT7+IDkHuX0S%kB8IxRMjlat-IP6;`0~yT#R0;0zBoTKa;^|%XG_|QZ2t` zw7lHcCfDfjOC+9_>zR|?3^!ZOX4r}N9n7K zonUh3k2$xPenychz_gPo#~#q**Ayf8+}9?U#Eo-ps`sh@@A}%{sGw3O#XQrQY}X~) zGB&r2a_deX1tT=wnIiO(yUo$vTHGz8fw!Y*#Nn8ZUWadho!He z*(ol33_^-ckWdKsH5Uoh8<*f)xG}f665k@_b|;h|H-YP#!`Osuf;j(eI9(%_H9N(J zsduL1m2(!E{eGz*5d^PT{0F56d^E9isCcl>;ubuW2v8P&BSc1T$3kL;c-e0;r#BZB zP9|((Cky8Z&Zn_v zk06_^x@jgH>eotdNLi*T!7G+(-Xq`=jBrW=a$}N37ofiA@eUtFtkb!71*Zl|fY8|j zH?8kM6Pdbou{i~wa|-$|)YQAUOnbpU^ifL4<;Yj0n%~%ua49^PFbDL8Wu9PJqOuPa zW5Mf|3jI^?h9!na)8$^V)C*Q7%VC4XEv4rO9-*N5ilvpX8D+&ze3gjt$nLL17=M`Umy;)!}4bgZ0HLdWi>c z_mO{`LeTyKaoMsA*=^eWW-mYPuQRd*#c^LQ4V9C{CGSX7dT|TG>XoM?N?8ProL%rb zGB&e6L_g28e$^7>Q7VpJjFS)XKry%xqndBBg#=%>WHPEbq*w9pQOz`Z=M6Wbns2hj zR2im+S&`;5_@qBiCR|iUvO!DOR%nc&WT`oZ83VfEX=^r~j~DeCJOl|RY}xGO_K-ej zZtWMtqgJXb*bpb!VkWj(2~*(O5T?NF0l6c^gZub;h%K3Ab#1zZX9tjpG%#L(rCIso zp@8O+>-(*zPT>B_UTykfz)0!v}pElvo#Lt%h%x7A0b;2n@({A;kId5MM(85A+Ia{aefD?iQmwkxv zrVBRV8>m5vcy0*QB?F-MXn)GCwDinSo$5m7iKfe|2l^$4no{RR86hKi1Ybrg71M@CWH4LWTas*P#=vj?iSnGyCteR;MQPMDLKVgr?`ix4uYG4buvZ@ zc$<)v%6L+<<6NO5y4aBEK0bvmWm_NP^IL*VrMWWZBpS7orB7fo##HG~jMD$uEx}3u zR2^`8Fc3IRo1r$I(x`WA11{hFEK1Mo_uDhFDw>U&*FlH<@#Fh=CgxcE_#>Wf@mEW|%#-l$h^>VxvifgfM5H>vk-<7-ltoL7S<;!eC|jY)rUnqT5h?6HKXIN}x$ zTCJ^IxK!Oc>EuW_h4h3oomgk}%7u9}xlxmK3HpSLwZx40QtY+HNEfr?HG*LNF_u;MespOJ{ROcTPtZI_gXZBQ}t|3*Yhm&$>WjUu=%m1g)jiT zW1|$EhsRs=CVa^j!*fP$&k!|6qkTs&o^8p;Gd4G#Z3*x>o^5er4GCjXKwOTaC*$yt zAdkX)q?DHC>zm0!Ct{DK72mMj-sV7(YF@UrOBO|TPW(IZaB}}WXY=;Lv%E0%-|Q(G zagGY9iFi}L{E%ichIpzs=H-`n+p!yUZLlbw1 zOC0EyEj~P*n1$yoUIg=Tir272t=3VBo-^|$Px|TvQ}^qg;klJmBiPkkM}A|cWR00< z70=L>C&)4q3E>5~;(@Jtr1UOCf(x^gh0%yFn)%CtTj56rw@`#%pne>AwhYA7z(Bc0 z{~K}br%j9-C|J}o?mv^VzRwf$Y?_oWXNx5Ao$*<6FfIRN^9rWc32q`8?X>yj)LOZS zOrlEXu=3fC{r!WPi%W#JiLDk|^F5A|lJO;|4@hl+^p#ii9MF#J69?{Z35X|O@CoZp z1kU5dW|=88@U-WW#J|)EW^SRzFW70xR$7zi82PFbwGaw}L8A1_&k+{_Zb3L;Kx9zd z$jf!A`0G?!eq8i3Ud%JQvzx}02d%7-BI{Bs`n2hrW-x_$^~Q{GtD(4T`d}$nI(VR7 z4Mh_V`oZFw&*B~3>SL?G@8*wF^VP>zoS4mj)7$M>E)5cqMdA_LfISj*Jcyi-#Cu9a zdf`;3l%qH##XU94^hqyC;Mqc1`UVX~_6Sp; zT^3H=lQHeZbW1Zd(~N)d5Ht6K zCY0p5erai=2uU}J&0wwV2i5wRmDATxN+cN9LhJYw0$dWtl@ArnN;suT&X%C8yy2G&S+6I?LD}6mDtV%w=kGG}BXR z%KAAQlC>ygam0p)=O;ZRW6FILC{;*;O35lJnA8Mm>e^z`vzkf4Dk#2`2C+6>>m7Q? z#pIu#*|JfVsTAHP`^F(|H00|mXtt$ZeArScp3~`*vxSrreB2VyzUm;QpImIR?d5`> zeVnj+DxWp`^O$RosLHH9;uRz zW_=r3pZMI8OFn{2bQZuP=yMuCK6BFUWCK2)j)DvJaW`kt-)YM;s%t=(i+`#GyE zj>mbTog+~h8keBHK;?6Z$bFh&MC5h)6EBg7oGJ|jzQ}#rBBT>@{^c)@4lVcP`9mGeR$$xzyLE|5e{;7ZQvEzRJO-H8VQ3gj`b3Xrm z@%&mcN?WV(zj=dHA8fR{bNd*VFF!Kn2Oj&c>#pm5QOsr@JU#irBmhN^=U@CAaegz} z_}{-RWqiFVVe+u{H_g%BKnY5GGHAjC*c&JEet;IT6`g<6Cj{(JQY;pIed~|S0W}QQ z(b`GVf>1RZ&2wzVASstmIns=e1QRO-o!k>Kl$Y&!QoLyETV|{4*=jNMV2+i%Vy3d= zRZBKPJV`xjSW@5P%^rhkt;sO<=CrrXI^IOLjBi9+w&F|a8#!Z-L}eK{?jrtmK$CUw z44tZ0qIm_{$1{XfYj;aA?Ff^_ z$K6Bbi$mOk3G=Bl+q$D8*^YzYp>^WHIH#ZsGo0@@P20z3ONnEXk=80E198bX!BMR| zBBBz+h55*CEk*4(WXHtuDMOb9(MmZFc_E3&Herr*k4z9>$%N-hOHn-zxv`Q792Jpt zs16`6hH9svSF7a7Kyk@JaY-(Fk`I$p)ES$p{T6a}7N!ocY3a8g7;k-&e!DjPc2Pz*-L(j( z)s|^2tK}oJ?$!Ezi?~wiZch5$^ZMOF@kl}XeM$QLr=7ZGWEGNLa|`>XdRCiyzsQQU z1k3x?FkGYDDi<53Y7A}a-hR7a+f-&8T4WV;As1tehXbAG;i9zmaZq(HlTQ(QuW|+D zjJ{oD#YrIv(x>vQCB&a4w09N~dTXA9i>xRPp~cDN5uXqzK9EMPb=GX%^i%O7Rfc;G zE`L&J0+kR-EJ0mnou!otc2e77OLG1eS@8)wrR*49lq{N0D{-!rb9@oH#5ugeYD1K^ zg;W`OrG%G7R=i=Mn>gh(b#Y{mCj$DLmn|%OU8-OFb{HN}jB;R=H#g^#%yuAKA17C{ zwt3Apn55OfvJ@Mr{W#fIKaM3FQ-ZQh%C-D4K|DQ5d3%(~#e^d9DZjuGDk&}De12zH zqG-!;(xNQEBWj85&J>QZ_59BFNn?c;7;x@e@|J^5d(P zBG~<^GZxvhl^?HDC*|VKv$@gDul!VX#d9{VZBe;6qloX;a}@-)Bm&}My<6i{WGOz~ zZuKW+Q9t}#7(~MYh^UK+_i3V={=lABQq^_h1R4<1<2Lf=g?# z$r8h!cnyxLht-RCjXWtcWTtqezxe7j2#F@W2&Otq=pZ*Zgf$eyVIh7#%^Jg50bRrK z^>Ug7V68x7fM6a5SZkU6w7-`*lj6bGmTF{%1pDKZdfyix4s#1G4G6xl zc=elU`h&sbEOX@KnKE3U+*ogE#SUu>&(g+nRU)jzsI(zYY~2r#0ge_Q^6NQQf-RQ% z0)g9Y{t}P8E9EjrJgkZ8NDU7fN2_>bHaatq!BH;9>njYerio0ewIeA~ssZ>|k(icE z4M@2RRRge5X_CBssuR;}UNu0l#pY#)hjK47Gmxv8+-9IKO_WdhF=uKKi|tZg33A$Z zG#3d9^rzcxq1sX^r3r>nxk~wZ?$iK_f5YNZ$R`V0bOoQ;yy#RRLCNLAeNBv2-e&PC zKaSHEV2sL_a(;QceT9@OKdwr35kJ}Ll^-*V-+~+ClplwR&w*_;7~W%TgN+dJ1rj+; zcr}JcS}5CZvohW}&g^#$oU+H_)6q~Q!Q+{(>azSnI65S#<7_gn@AMaB3?)zs*N)x& zMLV8y<_Ys^`D8}1@*`SA*{yV>>WpKuwGD$eNc-g7V)1ZLbw#=~A4V}DUua|wO5}Kn za{GE?%8#L8H30LJS0c)fJEv4~iR_$&FQ?Y10hq76Qp=T~MLEK?V7>FF=o#E@=hmjt zqL@!VHWua%|SFvjqg5VLBXxcTgyRxKDB6&8h{(k zKCy>?>yzH>)Uj#maVyz>JQQzIe!OF)tN4AA#o3vhq<5{%(DE*+bht$2z#wJE?s%rbK(Dbbp^1f6 zL?Ny8KntdZYmL<;!dh}mRcAC&+GINUX!4bib9c(dMadUzsUxLamqgG|BRC``E%F(< zxN9*sAVD%BaYQJ=)=KcAQmK;Y$;BgX5C=UzK^cTZO^AaUr_n?$HKir`8WsYF==|{b zVU3|FET=J=Y7BN*y|iDA(c-s9%O9>%E>ZD`I!%R7#uN*#j2FQkW1t5uwxz|G9S`6q zeMx~)`lKXTj1e5*c@z`;Y>ka6#x?O8{A#7|o1%@2Z5>?r*JR;+)>v&ZrpIfz+gfcg z@o5LEE>CkopCnjOiBfRv;^>l)vFO|G!C(D-~ZfgRz5eLi68!po|751#huvw z-**1Wcnzl6XgZ~o?J7Q5Pl?%WT+U3DjL)Mo?33@g2kaFRWtK+taMPrEG{1I41@Blw zf+dMN@sWjG`5OXWBG{{yuLkC*MK~aade(p?RtkUv1oyX$lX4Xi%t>gmV?Br|j>>ZJ zN$yBuyADVYdDViNN*ouGh;0aLd*upY!V+8)&lijj9K_5uMAq})@^ie_T!iN>|1&!$ z>-oR2^X>ncolj4)^PqM`H`NHf(2Msx(QNA^T93o31(#08nSoL@fQEQ;x_BUAIov9O z*O~*|gbyPo!I82|PeN4U<{UbL5=8%ML1-Mh8Izc^R}dQ~xIG?VI^THUj7!nHBXG*V z@t9Z{z!~FY6&f>bVMF(*-EE3`S1Ve#qVlc;r96d-YfrzYYS{4C_gho%S6J~I^^0N& z&g2b_;>e@N^aGn$t+3MQ&BQhz*my#$u!;kVTh<_9N^{fpB)d_7kLVrYiABtJI=kK4 zREZTf*q5OX!$ExG7Od5Art_Vik8wP*!tuGIUcyyyE^lO9*X=z}?y)Kv^+Yf{t$K zmx3D-0qIvN3k*ZS*A_zGa_L*EV}Eb4#*`gjTCydmR#?X{g2L64MxyHk^Ace?#e*`t z)Cjb{-sYExJkRfbXbDIVpI9nzPa;qw_}Jo>AQn*x_>f6I^qBX@^KrS=dl&9VIC~2n z5@^0t+3`iPIUPi(%J8B#STb&z$x~NYaT~X)jFI3T2{PHUL?l>d8(`3dWnXeZR#>rt z(~VtmnyhiN^%?DN^C&y6wjSVOqT`b8hJrOQ!1DXz`MBBY7Y}yC-&A&7VGZeG-IBBN zY@8s7MQmO_&m`E2KtkF=7>?u-W*6&kOqU>Br*iRZJX05b(%MMv<+vDIx-hJTiq7tn zBsheob14*`yf49rX==r}VL^U1jv>^YCVf?g9#r;dh+bjE6V^sd4dVq%1;$YJrR(2; zE?!lD=W?=jYipy^agkHNyO{KBKb^>@bLlRjV3#X>q?i07SB4j83_=i6u1CXBb44 zG;sD`vFLb+g%i z$|$KBZgvVX8tD%U)5Db|!KVk}xR_uRTfbM&poeqs(Q|K1IXw#c?By(T${kck4tf%# ziZ0C8A$znmMC-Oo{QXWAX0}aDW8uk^F=}Z?!O2vP))6vaD<@05R&^%kgGI$hA1UmIFL~ylJg7=MxMVtx2w@CUMfo&j{6>jN53Q^QwM`OQBsuXV!3OD;`7BQ_rO}f` zY`2AjcR+7UQAQnGXDSRMSF*2FIHM{c(;s=I$vEx*#&LZ3Y?S4=eH)p zZn~Bnhf9=v%7J)3tSfGlWfB#~dz=Af$1H0$&ZdKAB~Q#m9UAK{6vsBnN;zjN9g|Jn zVMRwag)Y_VcB@c0_sM;H+`{i~w~FH>iOL&)dh(P+W%Hk&yw4qD{qr*#U}2kgP&vo* z0&G9%fjDm9hw9)$;<%pA>?{6M?m9k`KbPa(W9abbXGrL$j=wyO>!%(6^0Y-i&G^gH zX8p9&U!G3YPY?Oa(<%CC=f6B{(oehS5ll%rzW;MPOaYg$0xC%XE%fT$pMVRDE&tjMcIJioiT-HMAd)g4wr zR<z0k?#Vzik@a8*k{(2ZA%Rk6)W)=<}A6z&G(=%YHi2EC|QJ8^5EJ;zEdcsbzF~0PC@6^Q-$f!P(K}AT4hkmTR5$Y zIgqPt-7ZMkKH`9FjV25l?4Sd2sc%!irVP4`#_V#--E%!qN3zS!~q;O~t>6;_v z%7a~T-lxwpTbidQx5DA%iQSb4vye^CTwiAFZG!R&gr?1~;7D(-%%00b1{aJI923ix z(J~kR3}c0zw-{sE)Jhys*#xO{CrHIitZq5doSW&YTZT{BaYJ*F^5A>$HV^h>NwZT8 zVOP8JDnYZWL87LaH`pa(&=T%L6X`h=3L8?+p7wOzwt4!kJq6t{W(8nfBDDIPHDP`Jbye`>7(-8&4bz)$LXNphmE!8MY zpH|WrlOPv0)ku)>)lAtaT(X_w;X<62uRItK60G^J>w1iJ;j*wBRA7!^Wvj)N+H%vf z%%QxghtgkOk=Zh5f&^)r*Ivg#rFxcqf@_*9@eBUN@|1KptC?o+ma(8eJuK)zlbYjw z@tlsy)8Pnd%f5#Iucrmw{DO-En5eIK&K)WqM{gYN$3JILcjRxKP}w86s7Y{?mw-*$ zJ#3-=a-C3KcIj2$Gi8eeIW=F1x4XEwtL}@3xxP>#?%>y_6#bPzZ?Tg}W9O8B`Kj`N zFhUn=+F)&CH4n#0Pn)c6{&*~&Z@h9V4<6HRbTQ-Kf(;D#Wx@5_88TQy9D;DfbSGcZ zeHbDKb#ha@lI(4HGd*&SV&%amcyotJM1Szg6t?}Xa0G%mO_|Dr6?VVO9Lm5BLFW*m zOg<@>Gih4J^yYDF{13EJV`*(BruNQwC7*q2ClTk$sj_OK8iplPGKXk2-y=LhJm4-8 zyk%b@o-#EI4@?R0t9R}Cth$j?B!6R&@7NhT98`7|P#)}L8#>w8g9s>_N!rdG2sb zQ!A7Qmp2oqDwsQkTkCs%A-QTe_90t&a3$G@tkkJ>f@-+nNTvshC=X$CLGjVacL%$M z&+IW}7u-B0Y^?T9`*!BpxqC_`&AR%^z~}o^h?WGuI=fPN@D{f*d!<|c!S2@oc5;~e z?R4BR{F2(a9n+@FVppYFUpV*`=Uwody#iSwk~1TPnwXo`gL}x+p3-sYSs0f|bE;1- z-N#er8?62=V+uc>k~~39R30ocC~s}*S(<4sv1bn_@BqUzOL1}7OVYi0Dyd+BB1g-S zq0)ogmnabp`drjZKM9je55Zb^F`B+$4_>hNB`O}>m*1y2dDQ>)eA}h6hhwp|LT1Pu zVHVbY{Fk!hJ!8Q4NQI_f*xdNYnvKQraXJW~mcMth^;#ow)7SD9p=1EYW>^$9X zw-_#-j&26Gx~I{Z;)@kYmioP=K9{VAy_qL7fO)bUgTrOEV~tgu*30a|dk#v|1LS5N z;yNLU~xdfNc%{oVdXNZ?!qk;^76&IRQ!lLXSE)A!T)trBrgS$FIcZ|$#2p(+Wcj)! zTR)}b!aw(tl4y6Ji(w(9gnJWA^O&zUTTrSG3I=ZPWAvi zp(?Bj@s2s#B^fJvsUi4DlZPW}40l!sJ=`}qT+Zm?jBIhG04nVsv$f57`q;S_E%o~U zr8HCJ7^=B3`9Sa})dLNOb-__VFQ5jh5RKo+ zlt}V`vf~A__>=J>-PHmwa|)Zo1InSVQD-Kax=E@LbFpp zS&eF8{#Er?B_y*Mi+h+05{;E62IcRMzVjcJc{%Ja#0vFav5S?|; zW;F*K1C7Cdf^1ubv8W}*$$|I5Q&!E{J+e?DB{E7pIYJx*Z@r|6n2P35nIU5(xKJ3- z(N}1qP<;e5$uBfdCew_IM?-M+lzGHhj4U*Bg9XtNP{(4C&9C}kb4w8`xiXQj`k>Y7 zl|oEm(62`#jK#(gdP~#ijOM^V!Gr+4U>Y*4{}Or_f=A1Ov<-G^KXW)=b2#c)e5o-N zxIW>O26lEG(8O0N&5*%~D%?`c0Zri3MkshKGOyVh?uc`utBK;8H?@!c(R zBua1T*DV3IFrU%uf-mFK^)IViPS72=D?W=4KG2jb9c#Oss>*PAoZU3~alqCldXb;#)GiU#2QN)1;+j9vsapTY zPYRKxgNzmZD$cAl^nUii@BCH<5dgxiN9RO8bu8Ytcsa>S5=Gi$YMdAuZi93u(HiR@ z#)V;tmyzIjZ5Kz5Yi-q1&IDCETS$Af$7Ps^%mU7h>Z?&vpkq2yE z4c{Ha^J1=e21|rHcvFiW_j10ig)@eW@@c7Nrn4BQ$>1_XD)_`_JJev9Ii)7OY~Vq` zTrP#;yI#=2t7Gj;OF2uMxm~cbfyd{jBYGcOlv2n&fHd?;h7J@_HoOKPmPKZ@< z(%UIevFlrnNxwr+y4IinZFbjxJL!0gnW4|8gE4}UPV@+o4!3G(lff4S-&v}Y{IJg8 zhpG?e>Fsx>@G{;A_p>?{tE?e*i^rT#7(Mn&bDHFDvoa#>c=6qg9X9X9m`5O%mT2Tt zRferCEUGD7aD{49H(3S0G&@xvJZIUb+`RB;MJSZAq_F#CM|od&HR z!Y%Gt$X@aB8lzL~@#)<411YFVu(^t{q==6rLb^$VwkbYfm%D zUWi}EUSVpWkf=0RLu0h?4r{A;)Cq#^`f#L-SE^3H7dGCfHJ4r)8_&bs;!^3u z!~TycJT|Ye``D%NzqRpu0X2V0xYqaoX8>Y2%To~4aB^cOcOU9^e4Vxo= zoFmo_1A9BQs(2-H@y!#oGwt9H7O!AoB2zq4D?YqvsStGM26yz=s+Nbo1_wH|57Yo# zX3q#Z0QW#zP{s((cH&t}1#KKY$r5Vm{GyNaqZ2Hb%0!{~us`k;TxpHv30_v&!^I^H z+I`+m9)uOzQ0f!hGnIj?KJk(4$gSQfl$qEO51^x0JX(dt3znEPh%a?=oI zw;F;&(5enHdeG_@Y>iV}($DU*R;Mg6wdoJrr5j#Pf4Iy_XN`|tdp7RG8mk|hG~ixW zF|iVBt$u9$)01bde!QA~vcg)QYG!M?nTMqt-6^d1;kXm8S^aoMe?!%r^}cTP<7xeb zsyv=g*HTh$j`EeHFsXo|;kYI9vFl3LopuJM;4hLT>p3?JW0?pWh-={XI zKA5ij15{_sZqAe}QtQ`jf?fK3YO>L9_@t){Vv~Xgo3ya{u5R&{sR1&DTM`uFeo<~z zg-tzYusP!W(k){n{h;R*iYGiuKJ<$Zi7l=A#XKf>G-Dz|tsD>fs+X>6>)>2=>_BTE}A8mB9w1;;5D= zuRM!N6pLE|tl$HiA3w&mt^0*|zA#r`RPd^eCD}S#S*)|A2Z;-obF?|#fybN3#YVHG z4H6=hPNF4hIBuE31=?<}Kv$yPa|Iv7Gx36D1y(2W1@~I{G+K)Hn7TsxNV#CUM!E!b z=1{$>xHQW&w|@f+^zAHoshL9aDlU`YOUw7?GrmBA=QFuQf+s*9DaTb-x8R(79bh35 z_Ahw4E!#Mar&XA1^?QeI8Q)a(W3@kXrE#rzZxJSnz#-3&@(*V|69*}t1eN*|Vm zs~W5-@ktX^Zr+A6`)@bh_Ynu$#jSy6ygQ1lB6t&~)bNZDk6c2gHHe;)@F-Ygq8D_z z_#8cmNfMijnH>*Uf5X@sbY*5m55~?C99=zFqVj=6+>jzFYMO=wje~`MX;u$T4X(DZZ zKDalL&mZquvITAN9}J0hzO_xF!ym+j0lA5BJ-@Kl%h*51PNUY_;`_+mtaLL4X{=|( zVezGmhim_7(%-!uyNOE*P41h1^FYUL84=#Qk}DqdtW~geQe9y&`zpAzqhCMzcv7Ym z7ScXONEda&J39IaZfg*aEtw>+_B^w(&pK*d-AC#;i<#GmU+9Cy4!UHR70Q8gsDh!7 zALlwr{k{Ckj%y}6(Yr$R!95N)6`35jDnQ6dPgf)P_RS9Z;yMeywzL_N)=h~GEZ9{S zx6b1-9U&1JK)AnnqD~Osh4=^GybiUTSF(!K9^vj@eS2D`(3&a-I~B zQQF-49P#M;5{?(2oJ-aBljbny!aV^yn=|{c$#!fXoFcB0k;(cmx8gaAHms5-dE`uX z7cJxH47D9%@W}Rq3cp7ab1^emEH`e^x^M)y#jTEZ@u&?x*=FuU;w35sJADMh*QZ3ixSa@VriKbna8vfW}ec*rQigU!?p z(_-nVnQzs{H=Q+}Ta73{4q%IYg}8K0_e^0J3A28XKo-a#0UCKyHrEIkN{%+c1kE|t zI*3)jJ`vU*zS!8L+<3&{E*{9@)<*GZAVgpNcGcv3E$Mh5(W;r*z_*P5<|$} z+)^h#U3h&{k+={qLZ=FuS<7OW=V(2Zlelkk4aSA}-8@G~fW4Dq^iyIozps=qp5*>~t7w|7-zk#ggY z4jih72~Q3hDt=>ol3OTQ`s_s=MqGH`azGejt|@7L z2j)!Vl788^h2jhO@3iEyQUhcs7j}qg+Qes#Tf`PK)_ff8uWrF|vxe8wHB8WDlpD*; zx9j!W(X9Vm{T3s_wxn-)>zFjfw9@qCmx!S!5D@I>CLYyA@Dgpcr*TkETC36G(JsYws6K z%@^3cdE%jU42RAWp98;JyizDViv_KTd~xOSOptOyf^x4dOzF*n>i~hpF#8 zhI`^FNB7qU4m@q(Wphj9RA%fcp@gmbHzh3ZiYp~ZtsR^0;{b-5_$X|P;~pw_o+mf^y%xNvj~gaF}^Oj#sZDYL(2 ze7b>0QVrCKi_qr_;zEsL}60D z2qTwH<@6`S)hG@mc1RF5@4!I=1qn)-PYTmhdUSxVOFY+05Ep04yONcno@tZPtu5si zA{m~`qb|tV^I&qFZjU~Mol+!pQmXZ`2;LzN6~2{6Lc+`TEcWDt+Emcnv!IuHKvF0I)@>%Ww12J?PB!u zsg}V1)cq%I+3ddiZ{1&&?EZ!p=efE=k0iSqEEW1U4M*787CORKS+U0EXa1R>Y|`Cb z(-MAAf3?ciCJ~96!q?WObeC_TNmG1-cuT~Ynz&$JA|82^B8jbCJmRKni(7;&tV-zV zDHIo@raV%`biCH;DmjHR;4XnOrOl)bKTNqNPb(S4t44XOeHFq4~|}A#OuAf@VE}Bi-VW z7Z^h15@a(>oUR%q_K8n>y&T07v~^4hQK=dt+D*@}W+k}EN(gXJMet2Lz}rPr0@~J8 zaW~#)0tBg&5fXKj%53r7FE?rKN-a0xqzXp^wAfsGI6>HN521BRz8a3-I#o!Nr`(JQ z^Ust9+izA}wohn77zm-np?zb9mt3Bgpju-UjNivE9B#o^b~iR#yuHMu)>yHusZNTe zr#KGJ6PJ8YS}JG`u;`(jg;I2P^Fosn!J+MXs|Lj-E@|PXB?0BeKrioFsp9YRGBr-c zjbH3B-2xvjZ=&lij~bd=xp53Fhrf*&U@J+oMP;US5gi1(WU!vyz9E0^Kj zrZAQYd*Kqi(-aseeZ|9XH>ensjjvK}JT{eP4F{;^O06*e5&r~hWjSXdzD1(8fjoTU zH8!X5f2>K=V67!aJ+&jRBO;)YQA30qMa3~&e2hK9>lVNC6qk%88k6sMr60x9lO5e} zC_Q`Th}sciE1**NByVVN?$*@d6Px?j5nQ~bb}!zZk}o}ZMoUPdI#>|#4HDHNQDBW0WW5S?w<)4&$4kP9m1UD}zmdI+MsdTVJdQxz=74N1N;*(O6L9Il1(}V5U-9jmSxdcZj-fK*h zN<_J_!5Y#gvPTe7ZftF)DJQCB653WH6d38l_eiUXVb@f8hH1Hv2&p-u+=4dc)iI($ zT$Gv8sw~%-oqWX3O`I!LXV>ZkEi{FBn3GntsfkG`zS08u2@=87I;fCLpzxPeAc6QFSX06}bwJOC}LZ4=pOX6FU8*f`_c%Le+k@Qz45d-b%&mI=$VF@t!0H@{) z9&L6G7rY9p#dx%tnWjj0K_(u<9Mz5|6I4605YJ4h_Bm~4C%)^@En_24&9!eNSaX=* z+h)q(_riY+f4$S3DOJji`{A$Vy;haN3?m#qwJhYds$qCq;}YD0=i%o!Pw^Y^$<@k@ z8MbyjZuJ5c;=_>XX#4@EgfOHA-WB4&J8`Greybbr#5V|*SQ`g9as{V51qEJZ$1P1x z<;HfY5SR3ppy2&@leh$TTc6?7E~aehz=v^KW3bG+gbyidj2S9HcBH*|rE+7Z(W|-5 znKIb;$<7hN!fcGUHiemgrGe3iXwHYtTPTG(4U2N)UWv)cy4W2}nH=FKQq4vf^yoPA zMBY*@ZNg+=ZOxTZ&JsVv%cieoYvR#!@H1itMD?r2I_1V~9V*0y+Y(`XYFUEnuwWoB zPj#T4Y~9voWdg5XxZT_1J0yxvtX{Oo-xPY$N*%ehXOJ1UN>F&+p)HE}@qN?`Kev9w z&T$3`iT$Ddh&L$?rPq_&g0eAR_-JnM3BB_nH4N*Un~aU{gwgkx^!gcne+)5H*V+0T z^lO=GlFmK{vkd*zQiQ8)OnVEPp9C~qu)ld64_LC&D-qK7R+MX^JYWCcb&+@_*km9A zlBU(Q>3XlFwF#fK6ybK8m)517$^Fqbb&Yc4C&m3iI3Ca6$mM6#$dYMGhA2(D(d^$d ztcSsfHYe7#>=Qg`^I~1gO2JdM)>6kYwEQ#M>FSm{Ii1gHFF0Y4QkW|~tymrPr*nPn zO=jJjJL+N#uuTpS4yNn1)qX(_G`0hMS z-ZN~m?cx=emM=bGpa^e;=R9O=7MDyRW1N9RrZ`5Y-GI|>N!Hm5d8A66f;U%n#v)$f zu6hYRn7C3r!c;h)aaKA~x@3WyGpa=w*fDV&xmpW-XyuAt>!P3TtR@3NYb5onoBV*N3Wz2v=xl=3o#9GieKxjcprs{>Y z78;|<7*X$4z3^q6nDw7+*%DE`#DQ5YJ80DWrDKI0P`&W-#7uFlN?##AZ9#JE|2|(C2tS$GyQ@9uS}tY)egUa^G2=9#fD*-9^b&qY&ZIL@zn z;e6sq79}_rAL>e0t1@)wFfJm_pJQB-U}a3Up!31C>Ot<;gZwx-NLzQ@-Lj9lU?UPV z(K1_8ZT{Pl<=kfW>VT!2M0L792>pS1f(^njx9=J=RUT${(5c3E@rPhe2fui@S}U8F zYKd6uk>ZnMv_kKZE=3)U-=TC=RAxLZim!bkP?n)H9hDl}$qUx`rrM zjY~3gZ3Pmh_NmX8fn>ueS;%rnas+v}g&JIOe{Rw<$^1c=A5)YUN)Y22&KT07qK6Pu zyx$>Pm@M+SNzC<=C-}tb$9o;z{goYSCl#qYKG3SPOE8gLD^zyOi8F3BPq0gi89^Ew ztQ9(D@&|`jF9fqD2P8<#g)il0&uKS1`4n|F+6_)oc1({uRUQsl2?)*=SVO$0FDOi& z>0+>ZvG{DK?mmO#C6=9XZcri|+gfSFTAd;5iWV-~(dJD8;7u;cbD{lCvt9cMR>6kmEfVBFo&mEd50;2HUc`cUrYgg28ox!#&ch}&GMq7)2DtVvv${`USd(h2 zPESFE+tY8E;bejIqdRnQGxM?J3EqRBOmna*!+kA9NgqHSKDCDMleJovVNna6!@0aS z%gGPkriF#n&WWL6b8i1eD-odo}Kv5}@Yykv*HU`~0Lzak1x5cl7s6)9yza4V0(s zxU)G)-&^4qObwR^T8QNjGK1SusfC@k$n550?56l8XyJS)Bgm*Md^B~wl(U`tm7h8( zSMi5E&E_iVDP64C`P3>hYqSt$!at=FDJ~J06wApHtdbk}tX84}%=lGy zf&k54%8rkx78yObOYulPU)k}^RPNIom0vtER@u=`1SmVX6<#bO!QhoCPQf~hUxE%S zOXTBqixkFe2T#2qQpBu+VVvaVJyPfyk_b)@ z;AFQrVBIT03mRy_`A-KiK+}&r}vNG14ZzVPqYM=3|!fo{`gsf zkpvz5R0Xa{1XLb=vgjYP5}6FeWM6(_av&`d(DJ~*9j4m27@rU>f;w(%gNd!R$0lG= z^Iv(}_4Y=J`#9mF!QxZYWv*;?l5c2ThO7x*wbY8+n)CY?- zqxQSTqx?+n8#X5M1YuC>;4wtkLtf~b7t39hon*`JQ8KkRfS&(U!JM$VIHt+L~eRDIj*G{aGab8O=9zMYz!e98`XE#7ROqFL6T zPX+9?hZvpP9L7cTmJ7O8l<54XO!+oYf*6^Z;-i*_%qe|Bx@9crFFwZ+f|H@$Tg?WRi#?M8G%CI+LN`Q=>py1KMOf<@l*PD_Ye7SIUUNI&4^LL}q(~Um= zp@W5HOijN0P4DEZrWSD~_t8FcNgyQ@oxZBt zP6GeeBB0>Z`GT^1Wfy$klw9gpr4d7%IH^LSGUf~^ma1gd@AsNW9!rI|tQP0Qk`iuk zY@YHbsvufLkWek)&!HZKi{B_6W;&z_tfb$FxP-l$SD#eLY^7UQsybkBj$p9!)Q;8 zr;zfm1@9Pz=fm0x#iLcJ%tkQ+IBX$aop8TqMRqiL564t0%qWhHSIo*sR*#5@fTHE~ty%%hx}I1a3Q1!rjO$_C>3z@FU z!!w3j^K9e4*!P0#93dSgJ}$sSz(FaeazVh8UGPF9iTRlhB<6S}5d>JH=j>qV`925v z8dWwNpZ1_Azs@7zxuflQjn3DgW6hgINZs(cdE*g^h( zN;u_3Y+q@P_kBHHN=`UT>sF{JMxuxhilv{BcrJ9JyZ0Y*ytrgBFXdT*^8z?x{h&do z2s$=WNTr<3gOz)zlnGQP2PkU`-gJZnSuwa{xHb{M&z2CLPQ1x+Tsb)@>;LA6q(t+8p6i%pY_ooFgd?{*Af zlyROL5I&4H)V^2%wNMU&R^+TU`|tw$P)wEQ z90?DQ<-8a)h6K|hdNjSoS^ayHc8Evx>Esha>=;PwxLtTxcTgOIr0kSaB!K5Fn!yTI zCjv4MFBw0v@}QiUPns=n(Jj;CJye)9k|{2m!%XG7Ts&u>c^n*mp%n{VDloN3pp%bs z8&rtTmXD@=kQK%u!!ABPiS~~?9-uzKvmNQ3I#qmENGV-p_ld`L94^|2qhgpk9m=bX zjEj?GV(K{bPL84~Ks_FX`X`2jZAn#r?bGHUuISW__Y(VLn)u{&86u@4 zj9djC=|$x~2|+A*#{6PoC#`!1#nFXQ3zzc4iIl3J$k1ExCH-S@hCcMI6?kV7iSD+9 z$^WUc%~*RJanqUviq?pFy)7RG0y z*&OAxHD;e5v81@-kA{K_I#jI2&+@0F!#YpKMY5xUkR2=buIxEgK$Y0 zXXzaUS4B!L+`85r*7j7dF>g`;Uw0(4d1zuLyUsh1vQ!@4>=e?;3g~~MJKv*i9nYsa z`ihlM-2-tRU_WJO!L@DT-&m;1!&{v~XbR)OgwdUi7PCL?&nEj*g}D>~g$a*5ItHKf+R)77kOD;H6rwDxAx6qyGc|cq5TuY*K~@TJi<9MneO7XKEO|t5p^D!<$!Cr6ViQfriF+R2g=pdmy;Q-X^O= z$N3w=4UL7@9j`+VH>P@`sxaS9KItIJbf%mvg>g9^lL8D>>JlO^(bq0qI13#^+PTmv zBshy{DKZRC#@2Poju&9{;ncW&It&9H+9phppfr?X0wI^KluxDhg=G0Ee90SXG`8Gn z1Tvi>*fAwvmT}5%x6e~{?3hx-6~?``>SPgYol+#_+FZ3*G$ZLgk3|FvZT#Z37HS}; z5NpC}ZnnE|OG{XYk`EH35fPgUNAJ~VOjK;wS@)o}4pYn|ezh-|{o74jDHm6KSIJ8n zZy~fA8x(YAbcpWg4of?0Fww`{vgAVRKc2*LX)F8Sx8^8s}XlxUPd+s}}D}%|sb#W22&HIoF`Q+09OrXNrd< z?^T<7>FaAeDMNeCD`rD)^M*F@3q6(`HE+ElSf-ZVvgFw?EnR#zU28(S2d@n&6SOwg zaqAo0s0x=;^x+M&uyGe{X-w`SRfQ`%Hqva*OV5%nJIkwPHa)$vpVi>>&`VgNMJ7+@;0ASRC!bgfs% z;$a(I7h75~S!@KsE@aM(`gFnm5vCN0W6tR*!MS8(vd@dH*rpvkzCjFIQ^yK!1$|44 zt%9$ci^#7M%*^q8srm8NgFfcvWzLqY1wMGg01c!up!%dc+<%x8}2I-Uxg0aw@d5U2C8VSm7 zWK@u&QXES*Uh;any6g1?gvO}nMOrH9i~l(BI*-7GjHJ9$2r7Q2hZ$K+BI^3ll+ z!lim>_{M}%8Z-z+^Jr|O?v-*2?y`r}aC|%^9~7c#nUtvNj2?}2f!8t&$`K%k$lfir zLhKCvLQ!%L?Bz7hr1`QGW9w*U;ES=lCHk7opb$jRP3Z*^k#d}_&kqt%*qFwgx02%? zjy;^k;uAQJs)F!LdUA@;$t}GFmll->!^nfUI4tN+Ul2yE5gg|i2f;<;#y-^;Xi zwR8z`vc8jc17>wY(^B!!JI#w~S0?hY-V#D$sc<2P=c4OTO*X8P%$J8~jy=4u={n+W@X-NWzuaF7PIK>wk&u!_p*lP887b#)#phY4AAV5bh{z@aZ_K&NnAdf zfx{0wx)aL!8g)>Om_;AL@Rl;sv)2-);rneKu;+HRQ>)bB|2z5PjoQ-!jh;;j&_10- z@3hpiRDAbR^Iqy(N-+;Lr;(P;Bg=hMRp7&WrWC2GeunDSK9IbIy)OeQ&JT^vxV?Z&njVl9Nf{=w&5QzoEL`FZR6 zXyA1sn~R_zv8*kw{#esP{Si|b%SB5Tv*>5S!!X@1U@bu}wJw8(22=AY=z3(pwuIWs zDAtT2E|mP0gJH?%fPXL=n9YT1fT|CiL&x~3x{UgVsjiGt!goRIb{@4o4??x|WLDSPRpCZ=-=r~$mrevC`f_ZjS^bARxYE4P7W7tq2qeDMrjvM`)S zvzI4OBYef+L~(HuEy+R)sL%Ikz)UpYI6srvoR8n9r^p6T)iS1I{fsyVi}vzzDv`6> zV)SgES)UP{dNNw|#Em`c>l6 zuejPh?B%ad#c&j12N=4aAm$kyUt+esR>2Fv&z>@w1B^ZTBO7+Pn_^k)8ZNg21s9rG zOwUA1*uksWmzR;pke@FG&K{3MopF?x0;R}=&jXeYJ+F^!WE@W#y=#N(#Q2W6K7t){ zuhiF{Mb}1FNhTD`sCJ$#Li?oB&MbuOctEOINc*96gty(*Ku=$`t%HzRWU}g{&uraD zLD4!C-MZzqGpJc9t4vkWvSD_o)qt1v*w=hk0LF zQ1@|i(!N<>CT5Y^4F$?p$U0^*?UkE@Iu`E@8$<%FZOze-!+oL{u83)Tm`*D@M#ln8<>c`Nvg~ zEpYHZ`8;`;VyDaFkc`288i#l=t%;?m=0@_3)qsPrf#T*A zxq%(WgQxN`xT_Fr5ZSNJ$3EXsNzqF6D5Gb-vk-4dOitRzx3UJ;$?9n8*DYq!-liPr zX*XcqshLb|S?H>DiJS2b`9%}ho@bTKVivuW5C*5C!4!cuwydJh62f98eb`hcX3_S< zFw^hNIrKq-zX*3a?Dgv4gB;>r9MawqGwCA)eK$0jJSfk z1i2qP3)9Q67?%n6G(!h2hQ{WX`+Q;+y}*7R!{_%4bwc-b zQ)0~&F^gKun5xUTifQm3s!sEv7jZh!pp{T93Q_+WUMw;TC6ji#$Q&*O*f^0MlEgmG ze);Rc=2g0_@(Uc62@f>mnO;ufmw7vmIE3eZLZR!L_kyCmT#UU*8^mx6;ME7Q*tJH!@q^SOz9m^s=_SzR(y|H zw5GKd6T*S^a6VIG!5pT9ZhA15hEh-3z9*mFiRYozgbtdK#vwYXhAX&$JFxA>R-HX( zr+gkA#nhC=l$Z%~CO&lqUtTI@BDL$#Ps^H@$%Az(r>f)iY1{RSIc=HlN=%m5jtaI< zIMI4gBU%)Qzng^#J6#XXW@Qk ztm?dOi=^8@lAJCtH05CY9!!LEYB$>dK@%QJ?9hF7v0E+!KWLNS)-u5CqkEd+#tP41 zS_~`TzQkM!^?sAwO`kFE7;oE(MJ8>I;b|{`>i%i-^ERA4#=IL$dz$olcXMJk`s2-L ztv-i0D=YOj{}U!QD7!_0kXVDcOoOcL>81j{Tg;;S5>wSoqxXNenz}yVEI{{3Z=z4r?nGRFWx07~pQit56?+3h5;p`7 zAK{E-FC#p&1JgNH!0Pye@uR&fUg`rm5;JLMV-9vcybEBW8#~{F8qBY7D}iM{O_nwV zd0U|MhWocX;Xa6N)Cd1or5M}f-HmDJ!P^u4`1NKJwzgOB>ZKO5OU%^pfF@?qTUs_m z7zCaeZ{V0{;%$ZLvc~uIuK!It$N}-TLYFnJL&yK5<u%L9q;<0;XUTy-fHEsr1+i8<{poEuycM%( zQ)~;2f5c4sUfvg0PPt_4vU1~c1)-u@p;}V_%Z#^3Av1Rik zkjq3roN>Mhs^+`^0F3{jo;8Y%Aokk`wF$+1+TS_E@b|_-A;{kbAlY+w2kag|ui2ATTObOZ^@%d({E@ zI>}42NO}q+!Ij1YcC_+19zJf`or{-T!_*H?O8dY}&87MS?B!?J%V&~S$^nfUO2+Y7 z?BY4>;xOb8)KE){3rr3*y`P2uBj9Iu9j{>*9t_}K#rsX;B+kQCj6>{X?>7w$<>`!a z_VPE>X!Trre+x}F(7>nm$t-QNer&~#a=FOHjcyy;%gH$eHEjxh7DT2eq~8l3R;NyQMQFzt<0vO{hO>l*P6G>d6@-|w*_oClVyz%aXgAw#S#r`our zV}OPCM&RWMd<%>>5IE-_Jc=icga<0v4ewt9r4JZ5N@=q;3*Cn*hp<-ye6wVo&KO-K z0o2i0$`ILb6zy4rZM48Vt!#s=dbjsaPO29Pw6pFYzi$ z=&z;U)njDV^wSHeYuUlaV^sJxcJPL{(@*0vlXs+1?R46K=t1m)q1^k}Y!^WFXC}sH zI+J59d)bYYk{mGu(Q_PPIt|=Bj@`6f$)(O{&UmIrl~j5>T0&1L#Zt?bI82X3b9gX4 ztAw?3#*4OtDOyHqHbo#nhZ*6BlW{tzxpYr72YlYk%1ZfJ$h1SrbTe&>=CB(-QelUt z;1T?=I401;(KPnbQ_5D2npVXf-=`;AtvsN&60!=W=M{OFJ{X0S$qF9M6Qr*gyJ;BM z9xr!^lAPq?D(NyyBelDlz3P$ra<-*d*e}&Z-drs*jL>g`#dP}FhM=p{AaN1XDVBDg zm`3|-rn2R9`qs9RqSm8fc^utZh?1>J`|m{m@0Z2`)0r++tTFj1+G9|@v2B(OLjV)<$rVGGuH$@1{FrIq3v56BqBMEwLPW-R5T(-4Rti|ey@X}DTt1n& z*-P)(K3CJ>~CTk!E?H<2py1Xpk0w1A)+&kng%f{cF-h!X0#8s>VH#(xvG=} zBZ@NKf8oN&$*v5Ju!GNI`wgR|3G~S6z`_*uT-0L*53w+P1&b7>-@%t$F5S*RfufX_7kw+DkW5#88*QWWl& z8W1A^!shAhFuSR1sL{Ax3Vknai~yk&&f-U;>Vk`Z#qM+@HWF~NJY&L{ z9H9CfrvABHh&-)fV{6iNaecyhYwd zsiqPSeYhFtafCN>h%aEfbobyC)9G_tCJ0;~g9_Jl`qWm+JH#%9>Bd+NMSdVPET*$M zjJj;y9FiG-H$dOFEtPSch{M3JE|!D!`-LqP&U*1km5av6T@gE>+!%W;sFoa*yH+o^ zS1%W0h+2E^riUqXonGj3z0hGQ!|m-b<*wJuAxfGdp4n5j@N~{+mzYjnww3A>YB~V0n_|oK6#V!#x-1V4U!;J;WT-lh zk58aZY{5{)dK=b9r0%2^>&Q$W9*27xaO~pe*dYz?{)Pu=Yzn&+x=Zc~UZ2RI_o69C zxfLnc!gDs`=QL}#?&yK?Ww~9ugoml13}6#Vi&?(L-x@2xO5CN;#7vl!#M1EHWy5>& z=_yQSpc1A}Y&9Z*ezBz@_mWr%JE#U6>gJg2h=1Cku)k7~v*=$@57UsXI1=uWM*^ne z8@LyX8B9B)V55-qu(FgxQbp_rgt75)K+K>gq8^#~l;Y>m5|Kc+NQ#)AvVp#9Nu^D)Kj6*K7J=qizb2SpJ4qb)2Fq<9`X1Z#9mCOkhRFnpHcImVUC z&_DoHPegOjGjx+)6MA9>(*sf2FS`*Vi#6%@a(&E0p%VJkhDI~l(PMt>VZf4${`g)m zbftozlD{gfaM&X}JEv@8c>l32`LCcny2m)`Va8AoMhdR@Sl$ zFYWuHF!i0nCx}U`(Vwh)HyrQYt3XPtjVm;4&o}ealu0zC{Zptp{wWy{M-t&x_#UiN`T`4@f;c z;ggwmM6)tD04mj$lH`aa*=3Qe(bODV)5Ua}Sj?-%WZE7};azOGoJ!BMhUCO#_=p0s zXf4};UfszKend>CEI+t()W913%>x(*rr%^LPEn`ogWDCy1U|N&UHMWZryONFc z*&&nu9x1~aSH$%v1Iq`B-@wr1fe3)9br}wd%4V}!w$brs>G~qnCzq-DbqG2NVbTSk z1l}pQg+eL?xf}RHH|`ULXt1jX4sg5mut*-kGCtZaRZ?(oq(mgpCMDG%{oQC~gSENl zjWK9=K_S?CivT^R;^pxLh3Sz<4iA=_PXf~mwqhEU4Y-vtC#rUzeEyo9;i%6g^ zWLKczwUJ5=K+*xz26)*UQw_1mXi9^D9NaXtNq>^i>hn%h4Yk&GN1PTI2(ycy<#g=d zZ`gK<47txI&;u}#Rp&HNNIVNDfBtYc&;Xug+GRpx8Z}wh>5j1mg&vxmY|7?3F zuXNiu3*!zYS)u$J@X$N*I1B0rga@ZB zP7Iv39{sSDgFi#^$aWxmhcfk;39BPn`2DS#%CKL!M0n_mNEzFCY>=u_isCJ3w}@l< zNlC^n)1yQ1Wm6`9nzRVY)-F{`DT!Z;q6iy=EJ4b;wonYT(M}i`gqr zj5}ly0S{~Ry0QndiQUspMVYR6vFr6>?87lwUxG8_QTSd)-S5~Si1M;mOrlM(5+r?K z!}QixP}I6VbYxpJ+^ou-oUzwvMFlXP8LS$5eCatB*qsI#b|ZE8uR&-L4%J7vBM$Yj zPMM!!Br=(4c@)7<(4Jpqd(g@@KQ zrkL{aypyep5oiS5r_oDR)8h~yszyITUcG<=T&~|PV-|3_%R={q-VXKwcnybUi2mT5 zgoi%0`K3$)BRHAqML33)9k^AM69PW&X0dk`Jh5pJ_L}O@d2S2&1<<2{wg8YX;DG2) zE3lxLeuZEIs98N8Qr}rYiWFd{vNq!M2^N~mbu{@>334*iy%BRPcblY4=X$oBFm%O> zUPXFeV6tdM)6L$>n`j}wR!2UE@8l7fzqdxSFd*+LlIyxPYOq}cz|(n{o>kx|0>);K zu}f+OfVcR21QI>WuJiGS5(KpV=&Qq+~ZqaMwF!Vj(P8@23=;29BH_BHlAo*Ac z>*DXvqZ?7_^@^YE+`v_=p8N|>XD_@z88g@Bv5?<;_{NsUAv%rf!OMg0gKc{;|EQgc z(Xj{Hp2ttts2v9!n!z);@K|#iwokI^+Sv<}no7U49Y9%Hp`-f6LbZb6*$5A4GZ1h| zdn^8u)j8S1w@b%2m9^v9A&2W$>>Nx#%fXh!%CP`-SI}0-x5w|d1lKmNh3R7*6Z;sP zE4>ww<9VAZ$MY>PVK|EycWc*YLWFdhR8N{j}Y9P^|9} zFe=}wtHf%iC*``=URtfz^1U26fOE#4D=2in#4ym3F6gaDK>n9e6^m_1Wvlr8N$taCAmHbgua8P@0%75YHx(EY&tRGU6v z9hBO81N2+Hb0<_DajfR)M=0OQ4)tjLu!y_ggWS z;Ap}Qg$RBN*s5V#Wo!cF1y+?$8@Q%GCW?XhsZB0`%SbMOpV|)D(Dtiap6*o^n@ z^l28h*NoxK$7PY}^R`;d@auG3pPRVkV)8IuMKy3y;-^R!YJRhAW3M}-M*r=``(Fn2 zOAIPE=vT-0TOkPW(BH*ojK-QaSm$AsJsN#WsklD!av!p;Y%Ab;;i1nkP(9-7bWOL~ z`41TGkOry1u2vZP&}ctHxZ=?jF$1hopUolx4hMCH)x-3ZD5d$za z8ujc{XoxhUbMa^F;8S@f;z>xSc>~30THYsB=q4yT75W}BUTRGf33ROzM#?w1RT2y= z*RZ3Scr8qPhVCIpm>!RnF^z;XFb`GM%BAh#GwCrI$$*}XmazkT$}$am+fIe)_r_IR z$dr@{Of|1F9hFV}irI@7O{hY0_aNBMGf@va*1#Ps_05*@VF#W0I*rPv@q5mmLZ{X8@$AqjXYJWju$QxgC$ekW zNNzyLgxx%YW|T2Kra)tJLKbLzIanMqnb*rK)x4>5cT$-{v_BVFuK|HkIASaM+d$gdKPH)*Vf$erf zF#V=2n|GXylsk=-*KB@MRLw3>LVt%Aq?rCcJ^Zxf0N2gB6nKvZe@# ztoVF;LrG5B$5J&az?(!S{T9Wm5bgomKt5TEo*c!~kE@bsMyrui}B)*VC ze$?${YIxpKFe#0rxxu&|-6JbQkznL-q8p#syy1vH|>pe0B8cdOq))+Xnr; zxt6M73Y)>%XP=|f0;NhiFNas)keWk-vbhkE+$k*Es7D$~z|^2vB~x`8^#7iXmZ6qM z@ajS5r95m?DTH06j)T9cURJV`FNQW-49 z!DE5>(0 zJ|V0(G}!}eIrZ%d8MIEKF*+I_{ba-b3eRJw_2oXuUjxBJw(~wlG+sMT zWjjxX@~Z>)kR5%{Et8lYUGhBMX{Z#bkM$`=+LKF`aexb<^KbQSr-}MSg;H>HIE68x zapBm;!+8n^)G@z7b*ezk);Exjxdt&WDl}BT%wsXSeA7)^>8>6SCnhIJ$12)XMm$g# z1h>0wenW8kqCy#d_)`8F7c?ak3HL?io9Zql6$jdj3O%SNJdXsNfgDEa7CrS1B^3+0 z_iL!Whxa^?uecA*OgSQ8ozId;yn9U@gL?0=vf@FH=`{51Sj$0MMa|vqCbe~ z^rzw%FXEKHJc_CB7SrfXOXB;YLSy{ck-t-lY0ff@nl|!5q}~!uF=Y|u^Wxq425dYb z%*XMg?PM>{Wf!c}nk@00ZGIg5O@OnDcZg|pGNjCS^L$aEC&Amw)Qvq!ajyi0mZ5jM ziD?EsZ%a6+jAr7HKpN;O7kL8aj*>Rm5R0N75 za1AD>qd}m2_RRsOJGonLc8xlQnhsFnN@{w54~iM|NYt_xYCq4IGBfBiIb%Y+K}@4j z=8Ty^ugD4G^@(Y;#+orR=sDX;>v6oxMDmhC$;nCe)iTVLoj2i}jf?RX7*)NbPsJ<-obI@HQBqS(v$RQfI@#a z3ccTRR1RNA44`F7u9!|gMzcVN+%1^)D4Ak_MynL4i~ShQ`k(98=oWody!Ss5j4E%{ z3%skOY7O{(x!l}-P>K&T-Fvn7s9X++0G2>$zn2tsDE%5aAg0rDbq~rfk3KJ^)2|9{ z*%v8(F`c@jWwKu`j5fo&fQwxsfoUnpp8peXVoVoMs)RX+@zxntlTTf$&xECsGM!KT zL8+lR%TzB|)t3~yKDvy($C~?M`uWCG8iY%AJx|~~x(OUUQ&+^}lg1`4Y4Pz51h7Y| zhW&p>yqpKh$OGtC1s2S-BIcoP8$MT4O12n8uS9ah0D3^p6ocpm`F*qe-Xp)Cl;7Ls z_oMQAhy1=let#^#ZICgNl6HPNvtGnXXZi<@5Y0PM*jounc|~2qJ4?gx(?iP+-yHB$mwk7)3{!)+1=~__s^%ZwDi#YG!KrL zmYE)z;eAgGqV+1|NSd2!kUJ0hP=Al6pyRJpS8^BZO15T;&Zi7IOJ{K!+xc{^hd7YhHp;2$V1k-EYk2wH!2w=~ z!wfTxgrEE%&LUk5qDNH(Gtx5XG~~p|ru)>D?8PI5nzx@b88=!vbG@Ki_vnDxOsXGo zzP)UQw4U3G?9Nt;?5}mQ9hv8G8V4lV;JG#Z50q;5kDMD!%@Go8GFbc@XDLEj#W zKL399!%%3jPmYkJGOrhvw6H)OX0Xx`i=Z3uoPZa7n8{6HJ7(lF3U&-ALd&1eDPf+) zv!Uz64p=A1#f)s1JXbSxu%~3H&S;t#K<`G&=yf$$45GK7SSDRv!hUc7WN@W!c1v_n zh}VYb=pK!xu}ch~r@BWd!a+Odw2~5Z}$-FrUpMQKxz`op%7l9sRj<=s{;y>W&Lw z17i4*?6}bClV8y%(mr?$sW8^n@V-8RLt+4H^h6|045FviT-pB-xgK|@+4%KnqyYW3 zQ>|gI7ytv>`=bXqgtV8HrD6bWjldaTkJAf`?*MvT4%Z;2JCsy0fS!z^hV2U2kq_l} zhx~p=es7ZBkIL^I@*8mw^;rZyMJnwLq8DV=XVEk|9o*?4rdO1eVgTIz^*BKFa`($} zuSt}5%5s=^gAnXo44@BW`bL@lw*3Bw{N83#jTt_Go|RdT$gHjM`$hTvsr=rcK&KXO z(iv=@$6>lVnntfkp$SZ@=&ooQy{fF0_Eg$dnjB_&NQUIWOD?>B>?2rKvI+w;UI=Zh z0)YRTs-4Atx^H=hg@qZzY(vX*z*!8;(dD(BU#X8(%6N65;mk%|)*p$DY} zcdXW^i`c@C*gIkXoth;EQFa(#IGS_9+$Cl3u5*201ms3nSP71(fAJ8OU7vw*38k@% z8Vi{E_}LE4Vy5pR9;PeRT-K->N_KxO0R?`mgcl_WP$F9l(&)Ib1|5E{^Ddv<5Hi@6 zr<1@7*jp(EP&o)3yp(B|P1*(E{PNOoQR}!aztULvyA>KG-3J8t?qf|UNJo#{(SOP9 z>XG{vZe=jZ@e7bKlMAie^`Uy-D*G3t3) zp_7xXP&cP@q4Yta!6$)M#CpKU854LUpUN(2A?V;w*voHDVEZtcroq96Hi!%P`U$X5 zp^6fAky1J-9-OB0s(57|+v2rBMGf;P14b?IxxseE6%&3eGPqDXj)xmLc&@2tyX1n9 z3kEZuW~EasjiMfE^YpCzYNPUVWZe;I?L7e`!alnYQ$V^1^06zO$B$qyuYuJ~Gp3GO zDy{6i)Knl}z7UWIJeJ+sg!S*+$csEW$HTW$$hugUUu$&+H1s6zahV%D93>Tt z0KF1T5$DjYa_gMM4z6<=VWQqtJH$D3JD%WiR%_W{l_7M7bcy71CoQt%Rpr-N)$GFS z7MO!Z+*k%|$0AS4#CPNK`1`yql#E>ytO4eLj~&ygI){$QrgPKinCypm1D~udW>Smc zQPy=*zVq@WTqpH8z1+p2JAJbo%9(gGyPP~m-^b3Sb8^U@O=qW(J)0kq=BKXX)xp2; zNO(R%AG_IcJ=Q$6zV3IIPmmGjni_G!Q)9DlHd8_qA<9ByC0e?i%2G`Jt$l;lxYzK! z!7j$83>zf+8n3cUYvDvEmc!!^`v#$hnARz|td%27bU}5aXDTl-I`&a@vp9!#$d1*H z!lt@Ga{exP_<`TIGn4}Ibmq}^qgDB(YI4%8m}Hn6qfoLD7i7s2N7j)jrX`45H`u&Z zc9=z9(}g*14#{Gqyau;fSl@`?hSTOWIHvDm;FEWgQR{08y$C&3lzm)efSG?yp@}Ow zAf~ZKxhutM3R8X>tB!+sCl=G_HdD650UiwK@qUUHSeMWpTGc<9E#C{}W_pnB zg7$;(&=+kvOzEYN-v3K2#WViONE%PU@9$MVJCSl(1nQ4tgohi%Buod$Dx_irw2Uf6 zkbYJ(c{t=}%i26_N8vvSn(AIi58KQ)T#rVpl~neMAl;)D1M|y~6a-xZzW>kqo3OL$k_%z^PN{nU$!?Gy7Vuj7ahue5kd8}t6UIGM9i!>dlVNLn;BU}mh8vpEbl}8d(VxDVS;A7CV9l5g z(VxDbnZ~X=#AsSG#?NXK_%LixnsgH}6mtz8YF1!-lAecj%jzYT+HmL1Myp2Cwd0c! zb}hj5)*)%T#mc>YBpwsoX!C(mGyrWLO&5(^DW*|3QV{qD&M`;R#UuUG%yTj?j^e{K zykOv1cX3Ep{QWgtD@N0bp}Arv(=Xu^JndXEv{=l<5B)jf$u^Ji95I@9rLDvch1YGn zE)ZQe2ejb!Jd+*~P#PJ{v}&jfrSW4p1(zGXmqSQhHqwdk+UaK9?Qpk__1fp21Has~Ya2Y`0rL%W$dZQzl7I z5$hwcb(+BRnfg7PA3~skSB~q<^u6kKq_LMPL;`&j$>IROZ&Iav3;P8-Of$L8cqLa* zvN)c8P*Qd9E8Ae$ah;MaCeZt6JhrL7$I|rN50JuVu-#HQ-)vF4j*_|1Oiwq{htLxP zlY>z+JujaATYouEU07M4Eb(xm7{YW%9~qtV^(FesxI_%0JNty;!4j|8&~h~9SZ5s3 z2T93E0W-ZTp1!Ofmh%KDEW=zX;(*B3=-0MYsA-kdmC6v=Oy9SqA!RjmI~h*>>!TtY zagNxE_6*0FdV6iky#A=t79`3x{t;#j7< zG`BgL9dYRQZOK7e#-;3_->*jUdo4wE&wAsKth{*EdxvC| z$Fn{@B&$81_2nU19r3L156S9`XYH4)Ha(h<%k)eO4AnK-mH=t~W9UFT?o!an!2eJ4 z1bU+738qd7psiuY44;(BI-q&-c+2}>6mXAem(26YQV;25d8$v~=^pkTW2yAsZ}rhK z^^l>8XI*+oR!2PRO30j_s;mP8~vb-UAlh zHylD-c|7ZuL$ccASz8Xt>WF9Et0s#CS{E%5$I_QdsWsI);~)=7kUbHA+@j*4#DeOI zLv25#4%>qk(a#)`l^)M}30bZLZW+)12HAmlN!vqKlYT;054zLiSqBcu%8O?$rDWX7 ztfgKa&$>$9P9;v^{BTqp7rV>SzYn0w-3p( zJz_QF!$Y#t<5`~{l9dSMkDW0qd6&*kqmiMfOkvPYzLFbWN$u{G$Duu=L|u|NcM6m z-V=2>hliIRYqD;(#|&Ie^fpclckluZaYmF~t)f5mlZGY#h)&<(3xrY zbo;5^LvU*3!CgOTrD&ohS)+spdQCVr0JJUYfqaO)03kn;B4xq@BXXI)xPS)>4<4i4 z|3|yf(X@FO^tSucH5DbmKMUSc$E7m0$vf=6)LdxxeNmpn)IXD{E=4p!@*>|Rb*tzm z+M}!#qv_3)Q|Tgsuyj#r@pr>i4{ocUOl$&%4O7$b>$8d3_;vkMiG8o0cdh>Gi;1P8 ziLRSkAf^$g3h6ROc<6iEN~;4W<_Zr@lO5=S4{|Tp3(sWP8D~P#Gax*E`Kv&9_&A8% za4q?_(i1-yqG$hNE!#w}r}whgM>DxI!b8cqqKOuI(4rS?rRcr~W3W0} z+-y;Nehz9F1m%n-rkIE7Jz_LH(I;CpQRfml_Al8wL=$a|WsO37F!a*4K7K$yw*;^c z_eq6#Sk8ef8$HN)G=^EQ%LY5~CZ_viXfC~EOZ~6&;NP|QFZ1A<7$(Axw!_Q>R9R4o z?h*az1)Eyn>wB_y6Hsf)L#O;oB>`bpJLX{qRRvtMthQyMIO^1i)EyyVW~6< ze%*#KJ=iDP+=FeM2F?-mY9GreJl#y4MHeMOkf-Pp%e;S+UT&rjp+EZ=BBEe5!s|d? z9C5Tp^&qh`4*hwb8tt86v;97i1sH9+7F?! z!%Uw|TQHp_z?Z;C`78@3=PofDu^%9y*4}{>o?2gLC}f0mIfuzEc06UEpG~g!EC zl?2y(G-nka21YQV-o`--rCzo}{!2rP*((CHF}h65hC2$5;1zrWdr#(k5ulskb`4GZ zSgBzzhae?l2VOmVEVYO>MN7nNdPm95lX(6S%@VWeZ3TE-46QId>Z>~VAO%uP#TMH$ zMrVYf%;lQEE|Jglg{?+zNWa^<@$XPo?7q#5oWqN zhDJNxma0-5cTRE=UT|n}3I|}z>*sn($Tk5xU#F_XADz?LMF=1#~aFV@~v%COqy%sI^;F!>@sUOgCn0^OLBc8Y#$f@FTaKGKg)kor7B#58(XK`P`U{g|>>GSz$J+m?^*)p^{&C-XM;p5tRDDY?OhhC^Np z9I_M+e=p5SV;WtGC%yb7oxDm=g>pyhI@nko9xe))u=mQm{gETQSF)yHLz=`R{h z?njsEoEIMc0yCiM4wV6YJ%X+15w)lzUI>ah^%x%cY#kUQ-|ytZ_{*>`H|#(2Ub1Sr z2eoh&U!@n2F{tl>-24-2E3g*GE(?BJLJt9Nx|x0w-3r&jFaUEf4csH|sa{Ioi2yd_ z^27N@fSpVO{Rlkn@^c=pExKx3S5uleiEc{tGfhil=^1J~z0+7APNLg2xR-=FAl^Hn z(dOa}a?yL4v`iX?l^2y!e7wAt15}Qnn0{W&Ub-n(09CF4(^Ix$^fYaa74Uj?m~m@6 zb{nlaiS{A(7@VZ+nPEx#;<*Qq3+*RuxS5;&vQ@Tykes`Y9=YZ5+|_z6HlGv5Ni7Gc zDoCC%3j3Mw@MPY@!G-M=3-LXAQ7_N1IA$|58IEu2#d3u&{pTDgNmuNcw9A#cLG$3?Ocwl~>*)?{fG|oG^}E zCom1pWCvBHF{R?w7^+$4q|xzBctfVMN@!H}O_I_=+-0Z^Lr7HxaZjGM*W*?0$Ne2u z8keTL9(e~2$!qVCcPrtfIEBw=>9U=@KC@3cO{nqoVp4LFOAMp+EpUBBui8p^FqGZI zc&3#Jxndao-jarpBYM|6#CSR=)-pn(K>ckP(`z!8?fVg^zJAmvmt9D_y*W*cr#GPq z%N6Y6Ob*b(G^V4_8&%T7hn*?141e=V`XHJ^jalrVyOc1`9*WgpRlxOp6Wh5epY3X2 zeK5P;FuG+t{g9L_hSAT>DO@kf9>$X92NH_KFnawEnwf4%fNNO|$AU2r%l~QMI+h+3 z$w}+^l)p3mEd3zk0HVu8E*M9xh-Wb3=(?bCIRu)b>bU*%OKXbQs?ZfmDk9^FW9etr z4~P^d=%!euag`fR?<#(gK>KWXh#t;#O)Q6940nHfZK+~7 zd_%H}Z)EwP^@%N445u4n*ltIN1p3J=wJMf_$5A_0mK$-~ZK-Sry4A6qXiy~3*Ji@i zNWh!Dj97_ddpLceAncsi$ByA}KY%Yg$8b(8D8qg$Sr0Jk$@+}Ud)I2W^kxKoi;*IM zo{?WQSV6>PCRPTMOgp4m4kxre9jov4Ry|0{JRtW)=9 zw2WnbZ|Yu=)CJi=w}SF_qqU%vq?{9rk#6WwAA2#xMu*Tx(KK$L4n@Y}xdbY7Mu$LG z3mOshA$kM=z3Y4jt_P*yC0-Z8Q5dtlV~;f)+vT$--tFWxek&56#njD`zz)GA5@>ZaO?rnNtYcaU!Nd~!CYr;plkq5kTaybSG}wT}JVbCX3tI~) zUt!Hm5Yy-$>w$PU-G|_hT(sDDwzcQev(n!sJkK3ygQ~)ChF&Y4J_GEv>|)D5F#76L zdI={H4iKo=nTJq^nLmnd=H#SZ9Ds=>Q6{xzp*Oy3P7|YOH5ap^dOqLJfzRL+o=M#b zW=tuDaj5`DM)K`g!{aI5Kk=^odMloxM={+c;7#-%EDQ*<2IGDyJoI!6aPLeg&4A9E zm+kotZ08`I1Hr=AxDui#poi#Xs`4-;;dvSv^?HVvzlNE31~f%BpxM*}{5>FWt!+V? zR2`A{bigGA=4`TkZ1m75S_+W>#>E#mGmGc0{cCP}Ja@gBYcY78@yrf0GmhByiB;{b zX0BB4bR^-QL#6*#{eP5YubLHa(ybR068{*XRDKE+`fJVRatU3_vd7z~P;v|1_ULWrrp zi)I1Il|aG{hPKJK(Xthw0e#3||LoY$GsH~VeO`eWO^+l?#hPc&lVZcilA&0$%C$E2h?mj zsvBa+2g`82QF^A{#p^O4PTf}~C9_v&_<4<-XELadTxFX$puuR%#cv~sL?4M{+1W;` z|7Fk4K(f-!+CSLK4G0Kk@pfNYOde?9cYiO3a7q^UbHvWqyN4kuSPP4h6NWXd)tfr=yG;{o1c;6r{CnwGFuZd&8f zqevXVAsiPRn}vb6Xb^TaX&~BNlQn|=C`+LWGgdsJ;F>xQ_3Q+64Wn%l#a@!z86Ep1A^- zWkw8c-N!zZ74Uz^DH3QUrIJ5|9UKsX?u&S&OHD&>s{9A50^IxS1u<=lt zW(G|7Ut+tkC$?=7k05$5hB*wE&q8X$fonJLcbWKS(q?)0b8$ZS=+W#*=Uk5P8i?Vj zrIuZ6$9O}PO8;B~U(5RErjcC8o8Xqh%iGw&O?aIicPgY-R8fE~wxac?|I295O!`42 zC+!oN5b=tc^u4WA58W&>nXZUcN?zQ7gY66H_(vPa%e4w^GHVd!V$V_$wn#nh7oIGo z-46IadboV{4(+ar^DAbTKP0XE?d;<*jL7%wQUiZf+GA|fd!*!OuzrNJ$1|@(rWizTL~_JTxHu~m$sd*Wn9P=t1gtxPEpbdErm;8jGU zS*!3p&0M@)wrRRH=hcd|rC;x6=NM^8q>&~c_F>prz(pB!pWGb-c)0cRyR_B#>1BG- z)^xln!0J@u2=7oZfRN24!mq{Y_-a@DNC^YcL1_$ru4r12 z9TN4u5HLuvSEFe%nXRCs#YQGMeBBh)+hBYge{h1G>z2>U6_T* z=VJ$*kwas$B{`d-1zdOjtR=T+eB;IF| zNG~dx2%;>jd@!1(cgar0UzEoaqz7N>n@h>zu~e1CtJy($8)D+y9ty@gtU3&jRSqkV0jhh*+m zw35DuG=~GUii%C~rY*@JZ47ncr2tGwy~#nRo0*R&^dlsIQXJ-$H@^(FpTkqBCNL>>pt77)kMnDUe!|-N8f0YBS74uJIdQdL z!LGZQD9nL1To0>3c5H)fT4g?$Ph`g(Ox?7VE`b@od5*~h_9BTQ9k++ znWfb~4R? zsJC94HPJ~pMX<)@9Hl3eQid-j#HT9cvzQ)I!noiFu*CYZKqw?AGz6HwY043qbX8(0 zd!^kcOcAtE>z-6vhQK%-?1r06hBfqCtj?3%_Bky4gY*g|C+)*TqG*X^5Fd-A zaDXEsNIO-$=Ufp(#GxN-r4WnJ<*@=7Azq+_c{ygIM)mJAUw(Hwd)0`F+l zXC-*?&*Y}GS_G+s{BSVb4>mwSR!7kC2B@h^FB}u_a}U z>l*;1Dw46ddZ88zO1^-}Ep2 zdf7W7Qeqm9%MoPyBU&bA(ozK^{Si$QGpSvEAC%ucNewfd(X1o7z3p|2+WRE6ujtg? zO@1yH9=a;x(W(4KHzr;4KNyq#8zT8^tFyuw1z#B#g79OcO!nLqJP`3EB1kD=%z@YB zbip8Y5@e^BwL#(vMV%o1ELL)$JcG|*-OrFVivw;Bo+E#TSUXKjqwgd)okOCnocbT#3cHpb(Jg{riAU%?Np(dP8YU9BMh3HLDuLu(Lw6kH5}p? zkLGXKd!0Obw1L>Kj)d^=i^%&-H>gb`&?{@?Wdcj`d*LS)>Mj{DBY~RSR)y(;)@Ho4 ziy&Q;;OBtqpq-HeOs}X-xZ6k5M36pIWQTV|Q_$otr5HkJrjBTd?ClSgOr|~%X9k$A z#*5oGYSX9{sQmX9><5Jga#~m^8HB}Wb0NlaljP!pOdl%JsIDWb59z%e64UAOwn~Ok z@+WGldX&EPm7jl%RnbRB-*h*m1_@ehZ7h_!bV(=AFS!xxFd z^mY^i9E(B9tBO~^c6P;c%6sHMqik;YG(5=7eqqr8i&SX*x< z=NZZDGPM}X|B}*fq$CaI5U)1%D>{tSc*#y9MOG27cwvu>FDdPRN$L1Y zO6Olvy8e=4t2rzM@zfA&gUt?UH%;}8h6te0)XbRTK&+kz} z!_-!XS(&yvJyR|$X$o%=oNnYuBGge90Uh!5Dvp?nG+jMY)e(3!EHv}V>-9R4>bZ*5 z<7FNM!e)L~&wLAGdP9#=`*2e!G+WwXWZ^{bO?0P~V-9bZmBP2eI-D)9w&{!Y3M3W> zwgR*1c}7msdJvp(Pa_ zMgyyZRXgeo#ot8A<9XWP-o$noSxI>L)()C=*qU@~veT_j%`;L#4xHhkJB$h1Ze%5` z$0;!1njv}3I-+=E%gq!AgUlW{I*c4SIp1POd~(`abS!_(DUav$=!}kdYJlOU{ciS} z?+)p$IxhGYItvu^=%`L3PjAJ&>OpM14*7OnX0zE6Y?>|4X0s`Z@_Q20;S>eGY>J|( zPTSbU^>t$x)XuF~Fm`_J*!sG;W9t^zG*m6Dw5f`w4p1lCY!&qjo%J@w)@1xkr^xai8X%h`N1K+`i-7?(*_-pD*9-D>~Kfc2Ds6eEH`8 zZnp%$pK|?=EascyD=I1q27_nnKYde*^gpNS|5*Q?rswDTP!0a*NK7nHZs>`{Ibn%` z;53kpZy+cFLg#7td6++^0z}em_Dg4`(OXx*HT^{2RQIgl*x-m+&aplpB^3iTTIlml z&DXof_#N+)og;!lN-7;0bQZZM z(lMFAscV8o8B>GRXO5jf?$ms@69X_MIK($B-#4s0=&SaX`+Ua*gXVyyk2T1;p7gbg zt3hHnbC1HaGhb5l~Tv)Uc> zS#53~Z;*6*LUMd`%*4AAk}=`sA1t-`zVs&ugT^oTx{8Z9XIY zmEQ23X8NnW)7$e6_}6-;=S?xvU+Er{@(I>2LK; zw@owB-{oX?#)u5(2y@z}n>k-_d{;5kZc9vdnp3#kOuQRXWm2-M-5GATGsEd5Ez{@A z_UQ}N>7MFyyQ{~#W$IYByV~t@JFU|{eY!!&(|wZjt4$*E%+y!ZPjdeSHl#uFlT3bw~nSVi2axf#`+yJ}G83t8f_Dc?C z_=>8lt9?VwQh8=(x6BOo%4|0?@93W#3_6Rf{iwst_^f~OkbJYDoo4E9{gbQRW({3t z>f1*o7nzB+LW8FFdL*Wsi68Vx%rg@|>XBG(CVtu@vE5AE+as~VO#G@xVyBt-O^?Jb zGjZ*J&*apEIT0?ejTDx_wiFL+BX4PjhNc&DZ0<4Ef)Ppu0Lagw)Jn zs^q$?Kly4OeP1g-&1n4XU^6E8+&*7$h{+^&n3?w@^DLe1(f{OEIB_NzSkg~7u>3kO zS?3q`P1M=lr}(hk^w7g`)AJTK9EQiPZ?2j9Z<5DWG}JDvI$UmD<-7%za}S5Es-~f` zuBKwa*orw-he2D_P+51lWV4jP@sC|tv8euVaJ7d?tgNf6tvej_;+m?twc*OKiyP*- z4^yu8aAhn?7S%3TaF{~%&GmCD4x7_}o62ABFc!jp)6rG6W9J=?kotzYxwSP*{v*bQ zx~iJ_^$V&RDh~rzzo2Sv<>4?dtY|oQ?3}8G!{yCgxacsbP~tGjR@3G!Y^blT`;XJ% ze`wC)n)-@)mFHGgg#Ys#nbX`*S+QWgek(j}vdxxTvACgjeq~K%T}4A>c#_SwsIID} z!8yOyrYx$hU4RdDZf#9iejw%i#g&UI<*$b3Me>7|R4mYwgqf7EuwoHl%zv#6fk})U z>w_CA<}8qS5{*KM^XqCC%i@VLFBGnvvv@uVB^pyaG_Rt*At(DUNhhE9m!$dzSzY41 z+PZ}mdb{f9R@4Aasj9_4n!X0`*(d&~glp#_iLe0hk%YEMsJ`>67F327*Hkqjz3;rR z_1$k?IJ9taL#52X4**rmLj77~`Ot!@n#E1VMR|U$t-rA*{*pc~9KtFJ87&4Z5YEF& z2ra6u*DLRbg@e2!T54-5t7_)S79A09tnnGDn>RNnCuf2Lm8eYwX8oWPxxESMnIgaE z)i+c$R5V!N{pxGyo>#j_cC7iWw*}xm0Y3|G}zP<^dFRIRT8 z;VLvhw~&h<8k1&>2UFU;5}9pYg1g%DURn+}cIWakBf?EM7RL zQdT#}*e6ickyxkrII0C-wRPdjx=Oh)j>3+BoaDI+Wy?~|UtHTD=^L~lT-hYkjz%E> z9W$??wgMl=R@Tq0(AQ8x)x3(ivOq%5r3|RSRW;$tCM?`gO+`c15(zb=%EW4my;rE~fvL1g>flEBBQ;S!R@3(wd4uV=dkK&@#|HaHfB1goJIQuhFB_Y7x;HpWN&_E3Ep-qtsR zmJCE)Rd+JMU`)y62iQ?CmDP;>?8qzED3;YsSKU(e<#yqwj{gY3|1ImBM= z_t^*{*yiz5%rjLRc;)!A##LH6d#NVHjK`DrvDG)v+LGC!YI>iQ$J1Z1C9}&+Z;z+H z-V?qfp8l4EH=biU&GZz?HI(V#?z)0c;_>XDNI}zN##8=&_G&YHa~AvaC|Wyqy40U| zj~!n#)uqu9#V50aAxniP3T+d^?o@_7G=#kApBk-5LG5ygS(_?`GVN9~MGDhh5ridG znM9afB8Al}6lyylhSDo)jr0`YoxxMsp$;SJ2K=T748)x5nt|ve><}u?)(c*%{33<< za5-60&LN>P^#4;>U9J3PARGf-5N*?JrnVCHiWIslk|k79!XkyDTbN=V)p)S$+G`R1 zrA_uvh_z8{7ei&Vp%kVEOv+;(oq%NuDcxcyy`UDu>r#qF4@cHXcz^k9lz2D-C2l9X z&ah~w#YW-F6wE|CQ-FR?IeXD5O=UXjixukMO^XXm&5y3HEb0!}pr0gdCj;`KLs!X! z0lpz4%iCuGUkJTPsmMW5&;rdqJ1=pwt9FXCF)d{O6l!~dV#_FDCEvy_;%;j7h@teb z;uk3}?#!d1nH2W$8aO)`%Ji_ZlH3#8B4gMFpC28SFs8`=hly92Frdg@db*_EOY? zh{Q3EpQ0Wg=Rv74>So8<(bSwpS| zydi@}GrX>!#&)@dmFuo)5^AW$(yb19HRbDqE^Mg*my4CogI z;m{8HGm<=Ph8vi|IZVS~AF=`(MhSlElZ(yCMQ5fljS4d@@-X$uWtv^UbbK~7de|i$ z)+c9^>Sq^)3z&vx^GNpbiL$rg;{IY-)g7@Jei+#OHIJCVW8id{cr#Nhi(Nd6T|5GP z1t&0Y-&4qibf$+X6KY#Ux?un|?dy0dtV!9$GuX|$QKS&9MdYjju#k1=!vH*PcF^^) zW%QXXldg}Y(HFK%C@f(T@CJ;d(W6kql4G~l?PkaE`7lrLayd_@h-cCyih1T^v?x|P zdFEuqkvhMYsW1Gb1ej_(G_-~)vM5-WfxQ8=Zr9VCrWk2BJ_j; zg{(Dl*0{I`zVGWPFGW2~-=Ew6WsUpGs-Y90`>D@h_*HZ8g-p>b&PLZcIK#<~`G|BI zEAU}o)M#ha!wzoH*VKcGUks()QRsciHFTeX3C>OIMdXl4JdPbVu$S6W%#Ew_C#(Js zjrwUm_RMVz3XaY6G0lUM2Zu(-Zm0PkUmmYuyl)Vf6y zJBwX3>vhV^)@ar;8ng5Xc=lhs1(D!lm8dGZg|wxpdsZ5a%%-yt^8k?#MrX@Oe-%5p zoxSRGT6}=c@zD4%wHBaIlAo3U!F^JtMvEbUnG7#Wk%9{+d(aVHnw_GWA*2sj-TMf1 za^Y8iL;STI&>wA>wqw}$s+dYoM9Q!kcB*UL>=IL%UW{PoXfBaL52$c>v7Wt1e_T%= zEK+EPo}Ld?MlWk{!ww)vhqB>$H|V-JdVD#VVbOtdDu(e*sO_S z`@^F0c}h;Ihq|DhPvkSPQ_qleWoP62v^0GiKdFh+@VglEU2ftze%1z3t7Vnk5l8tZ z8V-%db}l>{E$EUh_*taTEwTa2^@iyU-X~J%L75!Mr)CRZ`JWbvpHXtsF6>)wKACT4 zub9mARs_~L7sXPb=K}VC={9O&7=1dpVmvs248+aTNLvdf$3bqk*SYyV_R@mqnTD(d z1SzFdiS_22z;Ny3V0ad*!Y&;pH+Fsmme+Q`QCb1-6e?|L%fcy7Z&0cHl_T&Smfx#H zikd@jP-7sDvB^Mq(TpVP(9`MV~lZ*`;t9Lg$)GBH_K!d}i`f0Xg zuGPW6l4Qz=;TY=_oIFdG0kSuo_J>@-bktJ0_9-G&_Z!BtOC3+5n<8a%DY~kieK38) z&d9F3a#FTatgPa49?34xRP}^kwRG}&a0o}r*h>+MU2f+h^O~_5$1RTcZNc+I3f(Hr zNucty+zqD@A$ALux@>-Z1fD)tP11Mn^h68AdZ2*ONQhzCRmBbtAz&@SX=iYVp;8iR z=g^wj<+HgQ8vIe%E%~U{a{rgES=e?08@r^A6MbxJlCDBrtX`zhC$?_(^7-cGo!7@I z^tLRNtG&)JEX4HDy!cxkyuU&6h+EWRo$m4^tI%G(5NmM%59qh>mo`u@(QMr<`dTIa zJhX(gckWS1u3kxcKdZ>?a*OX#$-gOL>u(i-Qx0fWG>Ak($V~^+JN>hTO8;np?Rp~9 znxssj(l?89GNgONv3jlTaTMRGaLnN1dqg6&Ct-CQT%2_}9f;(xi`vztbTG0}B&sLS z6GwJW5-Pn^>!AaPKXs9sP2HHFsOGUFi`j*xw5zsKB+>%|VYpm~gcoW(O#34nIi%4g zYAWrI)Y2vDTG}7UVzuTsx)}PizeQ45JptMhv|RO5w1B#0{THb#WgV)YE>^pzS;INd z>VaP+`Sc?^ja;s7rXM0DP#?cS4KsZoNfATU4BDc03zgo8l(0rusyoF{Iy#jd8A4@^ z-iws6Lky)`)TJB{D!ms0Q@%+B{qm~tPQ=6N-~*UfqiL1ejk;h(=3=@+EoK*2iN5q< zVlI1y#`M|}kLXK}Cc{58?Qf`LJNjT_Qx0@mXdiTD>1uTk?TggX)#^^#hhAvL&ZTD2 zYGD7?#J)yiU(WOmR4v!2VV_8(Z~Ej4mDViDDiVow^FXM;t4w=jr*9fqj34jRmND&x z4l!M;?xDSrTDn%VRzXThwi{h<)(hwTqyb4f!WlO#(K2af!Re6Fhm}}3IJ0_t!YgC z^whR>vh$VAY}cq^3lnFf99-nEgwWulN+U+h9IC^?4j!12GG!1{Y*g4PMqqb`)Wacn zWVS9vCMs@~@#rCozecXwheY_0q z>VQ=Z-@y*<`J0rTsIN^*Q4&5!gcIXB-8tB*=v7oS(aHAfov@6hYq5fu_Nv*~)~>~^ znm$+kbX}xb9YtTN-FziGXk8?WzQht-i=_+zpg>>03o}gJTl1xjPa!X-E2Loy{h+R7 zx*W41kA76UVOcPX8Vb}&`lxmcwdnW+bl?s_n%UmwGz9cTd#_`8rS)MwJS|l6_+=-6 zQ<38)dmg*u5fUn(CFTXM%Pv&#MOzlF zqc9`%DcEt^Yv4bKF41TmWzrXITkw%Ol|F^B7F|a>=_?(xm#(93`rN`iNi}YS<#ubR zI|L4~z50D$}ovQ&@W&9SA2E0j7btMb*BKeWbRT>4@wR z?4a6Od=+tsH98;sY7vL1t(oZsotPZjPTf3?X*+(SI-Gp+pjduB%r+944jhpQff*{j z@O%%`V{IEbL{HNmdaSLMo~E7jSX&mW)d$hnJ1`+0ZA-xs_Y7fO(Y7`Z2h;+3mb%$K zg6YvV2sd4HJi?C(1UtkL&`gZ+tU3I}|` zIN5Ovxb zSyzbF^n>&xmgp)B+%iRu^V%W8`+^f zM*YIHD2FJU+M20lBRkp7yBlbXpJsY!jGu~8V%uz{XeIw_Xv0DaG{@?Q^$Bp8=whu( z?XUMzc|7x)zhrjAGnf4(vn!t2jX(jt(59bg)p<(-b`^4*l4EhAyc4Pj*>uABRtvP2@inNTcLy1k`@r(qp@ngC&6M5uIAi@Y3G zOKoZIDOv$%oW^!8q@ah6h3!t2ljfDsF!{+2cGDaWge>re0D-5M?bPC-B;+r5Q$y_( zWI=5C03C_MDkqjdE%4C59zSb5)KC9Ob+x3)Pd6=*9=rpnv#AzokHC(`PEijH!Otou zg-b}4pR#rrQ`;6gLMAwAQ7t9o^ARUim(bDpEX<&DOW+q3QV$0sn#(RK_rL{$7le5y z(-=sr6PX@4G8Z<1Kb-r7Pv2<%$6W^-%x-~GW!DsuNcSI!ErxzL*Yp1!%{8JF7g3++ zOE)LLUaAKp57|zfk$<}d`<adXzII!F5y#Man8TV}ZON-vtpj zdhqp@GMpsu^v~9}-FF)0wo9+J6bO}WO$d|7=Ewy4v;}d*XhTAn>64ZeR9i6)OEi+4|3Q3I2&}=jqsPgi2quWC7@!giM}TBvkqwJ%g0% z6R<}E4*X#v)4To6+Ha8{dn5>o{JqYoYM0ooUsboZ=3pJM z7X^0-tlC~l*FYGAY4&y7syJYeRF9s@l#N*u5Q(&&{X(VBnsK-R>nr`Xa%c^3++ANL z66v*mU=8quMt4Fse^tve4$;>M-E>vU7Wz8jbGoV}3vYGuMENEGC(4?Z9CZqPmC(&z zx~2up7JY{yyb?orIx>j-l3|&)O5cGl>Tg`e57gl@zPvx!ghHMyRO+tFV%piV4!7}# z5^`y0%NBYlVJ+>%aH{80=aHD2Pb^#|5;f{PvPr1=5BgVMh!tK1C*OvaY-2ntWS}kd zQnLpuki$GysPt5G7QKj@nL3glOXy~Lx@8Ny=&=MpKTl7$c<2!Xj(Qf<`)ON3H$BsW zvy8T*QBSs{X!Lx-PHHV75vB)Q$~5XsNTnxQwy-*kIup9t!G-KCXZp}q$}URyUZd#7 zGR78DC=zK$v%!NHi{bO8EH~R{xLKn;&1u+aZsDa&?=`2;-#JY0Hy=<((XHG~?>3jw ztz1m+Hg93Nm76%k+7PZ`jaoO-OplZ8Gn^RG7y2F4=j3Dc8$}{L+Yg;vh0bMqtRD9S zZ7j>d|Dm-O-NSUb$Q6mSJ5i3k&MZFEgf)x3qX9@eTRnU>hqziV@Tgb{)U6&~jk)s( zVgvT^i$vPmFH9?2%jjPMOwEUKPTkNCGxy{AGNwgx;WORaZ>dh>%aX?X<22Il`YfiO znlbGz<303K^A@^{Kc}CXvsk@cp_SaN6aP&@u};gHmK^$5a~iE;OvWFZ(^#ECmvcAB zek8F5^gUEp#tvG+ex_fVbJ(uY3f@Y;G%uqSydD3FMA|9EQh=nD+(G|p#`|odI)Qff z@18AGdaJ37K5PDguICQ=thtQo8eS_B>5smCy(Kr)=YVM+;@7A67yXPWer-Lb_*b%p z`V?P>7H+}9(&&wZT-wsIh2BV5OIup9)K$uF^m;-z_1Q{GN~lkm>Bg2acBvES^@MKf z6DFC8M0!1;hVE!7V|p!NCB1=2C_Evb9*n{B0|LZrv}6nB2qc(@mF61st(>FtCX9*Nr_dU8*{mBvPKvmDe9;v2=rdJn5% zx~b&=X75J{E17O=NujQUt#nh%7V1jaOgCZEX!s4bS-KGIg9Ja11RTP`sUG?ypqH6`a>RD z%krbXZ_Bm~ZxRXYOL7h#$_2ETUdiS%Sb zH*Ie@z#8pH*h5d?_)zoc@q})As-=t`Pbj9RTDCAfmCz*TVu;ltv`wFB&n7HodIZ~a z9zCBRr5g`oYBRl%P|EZGaDvpYjQkmPL6H;OguZ}WO%$Es(DI&Z|`T~?5sCfnoesj zZI>WVOYq0*A%u?5J*_3!7vC18Z0D2Nnaf^wP<3|v(o5|bH@ovPU`rEAbI zg8YEiwtCprPM?WPu(FvDtwqWpu$#gzz5)#Y^?=}whCM2^J&$TdDbrq&c}510VTUSg z3T|$;GP6Q@9}eNbUU0!Nk$KGQZ*1u||jwAhS3&&Ry z2eminFtsPv(7~o0c8Q_t@s?aahc&t&5!e5_T2uZi*oOiXBmnUXzm&~Du&+_uURs)% z%k)Q+anWaWIxS1=F5oJ*t4Hb7be>~T^Sw?@cT*12#fdfa+hM6$E~&Zg|3b|QQ1eTi zntZw>vAe(&v6qJ|O7hFZ$npVEIz#yDE7WY3{5qFai1wsgC9#yEz&FqLU<6S%T#6T|pKT!w2C{YX^X=<397+Sjy2qpK5Z@IkjGW;^MiEj;HA z`YGDXq!f!3+S~-$Cf@wsO7xE~)YY(VebAaB!rMp&yC5ZZV~&l);_30f{vwJL!WDrU zo=4CZb|F0*ucJjA_+lK@d8of%9rF8qAKXXhl#nw#nLf9L>55nxCHSeeU{1BTE@HpbX>;%+P>RyQ%b1pF=!+UC8u}q6`@HD~{q(s`PUSC~@GRoMA$ueH&!!)n z%4mfa-T)b|+#~2;jX3yo=*q-yJ^OOd*=_UFkB!af+ErRHq+zFWh;NVzJ{VmoP}075 z<;Pd(f>_Dfv{DH}uZ+X=Q`AEjD1K-b1~{J!F)i?d;$^pdoXBTtOrt*8tZm>B{T$6Y zyPRpIvYnRT0^nd;7V{wKPuu74qUvC}NKg3P_PH)1*)3A&rpDf)#XGbx)9Z~Xv{~Cq z|7`ToX03b99r#i+@J;`0%%aWOcKPp}S~hFcXAdpG1;&9<-h_%?MOQH04P37@rf77h zw)1|`m+48xj~-mHq>S#=w$p2k9*FSn)o`hy-6*9Fr8~85daZFw9AY@#r*(_I)T#J6 zgwyS{C1vuF5vqG}*~F7k$R_B;#seIpt=b-Xv2hh`)jp>e8?#tlsr&{Ja+a)(b~obm za53E{C9|uUo^SNfom!a0=S;hxz6Npg16nt|(3r(8dPwubIa%ZfmQ=eKqtEn9V~Uz; z^h=p~0>0YsV47RTldSqTN=)lx&wfv&$# z$?W|?iz|D)^L9l&YzN#kty_dj+k~H8cQt?&nLc*fI4+{j#vFFhquOTL(O9dVK#ywO zkdj7guc6My0(ul%_z^t|S0dQh+DMXh)$-2+fHn_kwsneM?@F}xMJbgX!hPKw*Xz%@h5xfwD+YG zHy0OCq!OMX>6jWOrG{Qpns|j1+NU`Fs3VG(t*@CrQ2e}}{*0ukriMqe)%0abauT>9 z?Cx5ST@yG1%EnXR1?&M3yU&)b{{r{nWBg`2k1~K($JQb7TODY1EQbTeZ?^NeQBeGT z9=lheeCi&H$7hGsoms(-GYsc$ZYNW7mR0XXI?8Sxs=b#hS;3BzJru27L@^IVY9~$N<)+zUdaKnRw;$3UJVBn)T;7|= zZ=&ni0SeYAU_ec>zA}@qk;&smT2!3Qjx>taPV(@rX05h1t5#_AVif%B%3!;b$1nuW zv-D2Z=%0uaiP|{V;4?K_ z9Y)~;tbN3;PvJ|`Ar%myjBqO3xd6>N*Yf|@5i8QQw0v~8YD{Em#btB~YxGm3fbD4O zWol^#qQTg?nxrsx3e!)K2YO@*wBLzoXxB5}?~$1xGZ95Ii?u>?_{!U@y1#~-d$9XX zYzpvwdlCxrNT@3 za)>-Q=rRz{P>XxPxxlJ*IL-iQ+-rYhhh#<&gNEDK>(nk|f^vc1hiT6@vv+LX4n7B? z$_{>or*SjZ4z=I`4-*GWthP@~!K7c#BRRnP#FP_+kH?8A ze4_A;E6Ri-!?itT#4-yh>qzl%X6Jwpye}r0Lk?0>E=Fi^7P>vjFMPBZ({~i7#g}K7 zfl7BDQ+|-|W`~+=Qc)ae_V;U4D1zrNs5Ur`W$6&1mc!%(vl{JdSY#ola6xolfV7jAExV z)#;w#c8?u`W`I3`DgFV*U;WgQxmP@jJ(kJuOJb6uZaze6!pWe5X3c7M(h_=(GvW zaVX-He>q1uoj#|}C#fhRCDmPIe9HlJI-TxW!BT+AdV|4{J-~;JbNigWBDYg^+Ssu^ z=h$GzEJ?2XD>y>df(8~1n-$a(^_&c6JWG!93IG2X%Ky!kR9(Y3-CD9&f0fTR`b$k#6Ksl-Vc6L} z)Bmt`_QMWmXMb3`a@f4u{%ReLHoj+u3!$bF#`W#W*rJy-+VZC z02bKXb1UYaTj8#&s0kmYcPuartF$TpPe8Txa{m4&khzN%>*oDCl*xy&@9$}7t-zok zHpc(e#9!75NJY257U*aBTjtc`GXZI#MW$)FVho98YR#B(092$Yy!=9v1)$6eTi=O2 zP3iFilS?IWv1BKdu&<$Pj&+;ZOh)=3Arm4asXOwcXo6C3NQ49odM%S1kIEZ--r z8_OFW4w4KTc{u<*2dJT5<@{MANY!hkSQS6LCpFj_y1%4Noas+#j; z#-gh5yl}jIN^Q;D%6W@xLc1YJ0HL1jga z?uVkU%rl2VX{@Mf2;r})umqL4R!NpWOBA z%KXZPMjbtNX;}|G;sA@P7FA~V_*thrtWfGI8t2y5=pHWWD#5!}ELadSMz*fDw#T@} zvrTd(fUHbHf~1}$Yies6t7^ivjr!`vl##&ri1&cLzT-IS8>;4>*Bq*;ZJ1N9H>tka zK+tR~V;xI#k3#b#WMX{k#WxnyHOGRA`i8i3g!z>9r^gb_JUS z`Vt>UEU1;PMF!~299Yp1GFB>b2QJ30AZZ;qZ|=DZYr_>i+Br}^*#J1GrnY9zg4(&~ zRn^S58a{C0ysDZCx%~T@&L0Lz-w_ox&F17EG`Du)qKdl89?l*5&8cdTSdXl1s*-dJ zIAr+@oHw_oA-=N?jPFuH65LR?c&;oc+i4MWgmIXH;-fH4D{Gd7!j(+^1ch_&s|ticV1|IU1eoWLuJK$InGF~ zZ>+4;Yh6@TQ=_l@zsY;K5>rTl}DQkrSGDO8hyI-t#4k~P%%eV8vjhO zTymr=TCjM2m0VG9A7bFGubN*|5g&uTwZ>HLIT8CVtXQx>UzdFsE~=Pc8SfDJvsW%4 z&5@Tan_ID@vSz-~8CYU^2gOUqTh({&xfMEr7=NQBHFFy(>*c`qt*=~Asn3YM4RsZB zD~%zPfHDE-7wh=t@5&{Wx*H%+vY=|A-g)>T%PgEfx3RWP@8AVh^$nqg6*Y^EslKpr z&YZ>ixSH3hrn*YG%B+M6=_z)8t*!6e`S4n+FOr(thRXP^EvHGSeo%om*Qc&j~aa z(@!Q=)xdRBebrpqTgTK_&4=He`0h8bS4zA&1N9T52Ow6Tx$&~a{-Kh=jTH-IZKA%i zMxL$~U}9sPzRD8foY#e%lOK`a>>S|bL2~O!1!mIfAi4CUX=c(RB8RF=csU%FJGdSqPtgRA z&g>O#5}d)wFhu7W(UOj z8b#Blae)7+4mG5hCb&vjP&|H&f5(H*_+K-aUbBU%pp2=yOyDt9s1(hS=$6CURxl+( zf3>kdFbuZjlcv;_Xi8%moJnK#(u>PDB;X66OsIUE7$ITpOzIxIZcYwUaT&FiA%qHy zd$l!)$j!@D2ko$R>vNx6+}1Fbumn^4Y?z9wc-zLrNT`cVrlwMgmjlcX`IV;RQ!?6Z>A9ELO()k8GnXy zz?Oz&9rQh0rf}2WO=bds16|8naMOgjcGy{ zZ{`c|E?55xG?iJS0zAd;(#Ll~CewCQyu-HCf~=#O0~}CSDpYiU&tWgwm(tlDCi_yB z{~nXgF!~snO|>4zKT<Kg{xRCq(ujizf>Xa=H==I3RN7S1+`RB%eShNsqTQO9b{W%tOylPmh~c|LX4o_ zZK>>S;E_V5KcXJhuoTHNLETJ8B>NaMVjX4#626rtat|p?O`+aOWg)i#PgH%F1~x(0 z(ZkdcOA~#l%a)BFH^owr`LWH9ssbE9tuE8iR(rg<1G3YoZ?5!565s~*GHN_Mg}uO# zoxOs+?38WxVx^qJ`4gdR!(N6n5oyaaIBt7XzSwHXdf4$}j~^viS_A^$06c_^q^+?W zdftXu=S;N)$SBGZOwDL#q68VqbV@cF`dG|pDK%x#4jVE_Ef!2+01w0OkqqmK07vMK z7=|lAPugHh6PV7o#+4uPmRO`c0Jm>$MDO?E00>NHMD8%$kafi2R!H|U6Ih$!!~6PR z_VV=J8WrV@7E(AN&_`}>R1V#B3VQPMDCk^|C(m@W=ZC1#o@k`P= zaOD;35cO0It;oKxG74>l@-!T;uvX2XulY*$l9~-v_0pe>m(|I?3LibIqyp_*qAzWa z!kW=XPb$Sw_IM&%%K=7*sJREBlb}(j(uAC6qOi|e0qtk6K8MDv#aZEFFS1X|VmpPJ zc^^fs*Tc?MqZ9kmFPM*Ryh*neutN-EdRN7c-k0f~NQvk}7pkd9eb$zWwEH7zm<+?{ zIW<*RxIpT|ksL9Mo>w!W>l5*?t}=;0Wy9!8_+SxzX=7xWRLInZuonnFQj2*c3a^hW z6T|3J8F95Qt&f!CHR$;U88<~r#4!3q%@pU*6K&uDyrM6?ZG%Okb~iwuQvE>ml%(Qm zHCyzh2j%yhDrS6NrcIG74vAqJJ*%dQzC9tC?w6pisc=}PgNkzyk5=@hS8Yw~BU?bX^P+RE4q z%2I0B&LhNRT4b>R>B|i0{xks&9}Tb3dGX|nv6He3gSQu4A;NWmtE=J_Y!_MdnQbN0 zX1RCtXZpsL3CK0E6#V*DPUojF;bIS1>RuOGRYH+wy^ec_t%D`*$6^IsC9>#g+e)B# zBDPVo$io>LtU&b;d*yuxJLpA{fiU;bIO1&}+RXvJ`&jFyaFJE*v&dx^0&d?A)nEQd z^oN$)4AvrSH~Eo{c!6Cw=yW>M;s3EeQ@KuM+E%7VqqREeH!HI7d!n-Owx@d#WQu17(fZg zYe~~JZrH(3^AwI?y~BqJUj#I^!JEU*B;svfIaDx;1 zMJ#PF9cUr6>#;Dd!YSESW*UyRUt&@55@EA)@g{btClGa0q&9yNQ6{x{c#dRd0=$g_ z3t2mw1KN!&kM`v__X=TPuEBkjgRu#~U_I{Bsq-?cimfn^7FqNZ&H!}ScGA1=$+l&p zkZD`g!^=f~*66YXXyH7>cD~Nscgj~Xfn*5aSZPw3I@Bt>+r{Pdz*|ZOm7h`X&GFl4yJ#!9bkHwz!Pah(aL&?95A

1gMJE7aCcMK&NJD?t#U#b+Kw3E6iH7rxgM1T5y`AXU95B@GLqa8KDy)R&a1D2lxte zd~9nBlmqBBY_x`TP6pf0;M=jfedE|$E#@&jAXN_sFgJ0oRGFp<)0Jhbl3()}p;4m!-3eR-BJnOgp0mmm=-5mUdv2{5 zK*yx&U4w+Gjfm|}M+2_PBL>j%-%}er4`9!+s2QtoFDl|g%aPV8SX5?C#qw({3ho32 zZg$|-aAg#h0Cq8eew1-IVJ#KGd2p$kiyuEnQUueHQc1o>-hsdnLB4_imx}>(nHuJL zuI9jSZh+n(2NuhN5;vrR-=rbt-PmMlakHGq(2le9QEk^-^mI~>i+6fF{Ygp|8r>Cz z&%gmpuPWJ6nFhg^;y_Ok7ziWyPI)~2MQrdG=cmk-(-F^nS#IN)D7w{@kGWcJO16xcS&IoSWDsG^QJIn9@fI*m5Uk@y8rsiq&Gg7hB_P+hDZLFE3W4 zL5|wMj-U8mEG-{9X7Du}f;&BjG`67@k2r$qD41|-1KBa$Ih-qaxKo^g)g+FftXzBs zQ-q(XUk5z%!7w1iknGq=+l;C52KZXmq8t!@*65z->qvcB2@5~n6V199!atEk|5Ogj z1kc3{vqcuYqT~uc-5t#mSsJ~f6!*?s`ycYma)}x)ORyFYi6s2OPc3B`vmu>OSF!^X zM+=Yx=Gw2GK&=O)aU_mGQvK{8vt^Spk~AA~dey7t<)wbvCz4Y1Te z=`2uDktngfnySeE72B4LZU25}=2$aXO&m+Vs2V73B|NgiRi(?0oG}bl=Sy7y!I{)u zgqWmuncdJ{vaVq0U%Fopz#PgJFAJGJXThN)(u|=8VWEc0q@ft`Hdtp%Hed2_JO+z1 z%xZj|sDX4U8bh56K+Sx6%~T(;X5R39G>f$!BUxC8YtBzcork|sArDl;&l4#G3x!kJ*a^+(UKz@ za>-7t*DG`A4sMsM{i;OnBLtYPA764Bt!cS*OLT!D`&E(Lp3YaJq(84rQ;gw|u64xI zi@tf}R*d2Tcvu(F+{PX&;Hx1#$Zl3>RNs>BAXC;QSa;v$Y|t|KN?z{P3i*rX?8wdO z`g8f9L>RQ?orU$d73cGSI3LE%{sRcpV<^4NKvs2J!_{UV)rjMKjFL_=#4dIZxi$BA zy_D(;JxrkpMKyANy8cvz(TXr?xqbq?Hn{ue5azCW1aPr7c+9hJ>%#AOO}*&L%l!Zh zQ!T6N*`(~B1`GFbBUMAP$bvNgz_aOYtVg3NkbE-hOa`EBjY`gYY1_f%~U9Z%9_@SgN`theXrO+MsJQS&&rulhLM_onGh z)%+gqF%f3^uY8i4tC{TP+`|aq7ks-+ zkj}$y`}-bt+CN+R=jF!Am_O`*qzc>)s&;qLo{p|dH_Ln3M5pCnEDFj_Wq`)fk$fJg2eMp~g zk_tgkOMZe*oyuR@`=kDe3!MLHQZj2UZKdr$ve1hJ(fz1{g42ZddZg{vU_Fm!?M{M+ zDA@@=Kp2`P>)eJIe&QYzYkuU_=7G<({Re-gIt_BGW;wU15_#7@T%9Jjr3&n||E|AM z<;mlze8l*MXO-v3Ls6%ha$Bk-lA*p!HT8YDP5sB{X3gE{`yTVUEz)#9H2iN6u1XI)aR^)IzD|%YSrm- zQAjmF2DU3mzu~Gumd~*to$7SRB6?XE06CrRbJ9O?%_7 z$s`B!)cF$6SEl^RUxpyblV7At+^0adTkw22j?W9{g|Iu5d_0?VlJ~jERb*PfNSuG@ zpQoxIH>G&Rns=)b`HO!zQ#PjxF4i39zxd1e`(}r${DHp(F;!*CmeibkQLp#(pZv8f zvQ^7wc+v&RuwGTcuq1vMF?TgMo&usH3a-!AN>RkfIKDbXjT^F-BsJw0O`&uRyFdkRpcI9(z;Xc znsX`b9e2ptebW(E^B5~a3#6sA78ZYhwVJIAF6PO366w>RE@u?+^t6;EgBidk3{%=k z{z!T!!Xo?efwbql^I7<`H>49aD+Fep%^H9)oMaVcWkZcY_B8L#lrFMMi)NYroxDTt z^x52NL>vw2NE6~N1YNda!!urAXOKx0V6-km1!zxQeAxv?$C?|lyZ zHj+~s{#E*KYMWlK4xe`4bKXb}*dxKMuyBC3dAxE#k9L1X0Idj!e=WwNK)?KgFkc{M z(yg#eF2c7}LGl`JA_3SaQ5#kC!@aaN|9lc%OIWL54~tXFN2SUqBD z3S@k-YLjy*x|#x0#=oN4WVVx4#;kM7VcA)GE`g=mbibrpWUh<>w-%mdk6tTK4>dbUF8uD!yhE;<%hVRPu;PT~N|jq%M_i z|8T_B6jR<#l~esgiW3N+j(5Ho-3U^6-hcp!fRS2)Z$+fGfRj6(;2zYx5_wBDs}9-K znXjhE=TeIrNcA>^r6LOXaCN!7A==T+-JNq(2M?SnvPWtWklQ;;P$6mqr?}(*pGOw% zA}c#4tEikqZ+j8M)pFWYt0{BT@&#%N$`Svm9t7oVF~sPkod31)J$fnRK7Rsr7~@=u zCh47r5JL(vd>a8G=2xi#UE>nX`XZw;hB(z`*i3u1CtUiay;Rf``GG@@eqxNUkFthL z-m}b`MDLqt8Kdmn-A=Av+DEtnsCvb2H8%;(tA2vvq@XqEo~26#Iz2On*zI(CWmSm` zA_LS9Sz2Hp7svAy@XL}ANn|v;3^CuUZu_h=57x2kB;7gt;4;pB3wI zS4P^k=GQjBM-OG6lhb=BzTfmH&s(d;o&E+V2ZN{~;SPO`lj=_V%|c&cMOGY>KS>{W2`CvnGmgL2e4iKyo%mgg>KefR?1YVa?^j|^x~nY!OeMt9wcN?<=D!)x{7I$ zin_UVqe>@NOo~+0RTPb?h={)|Qde<7U1?-?oi}HNmpGu@V`v~bXDN3C4Q}Sch8|iE zc-FXCPZ}Eikw{%>MNw&mi~HSf{$BdjDCKHkzTt?6eG8m!U+a72t#R|Olf1gpQ|n5L z7nK%Olorh@Dyq{Tb^I2ixUQ~lbhLDIBvLo5Lj3$$=k`&RaQb*#^6I<+H@KO)Jy`z-*7lxJ_FDhcK8&&#v@Y$4FJxHpW!ltL-()n+@wfJAC%d54iOAm8 zVaJb_j2)}@r7mw;*3z^%zM^SavbnV-Zd;PkY^bHxGbi#pv+5;ap*Fmk&Tnrx{K2MdBXAFHjVkBTr(vfy z$?k3K&6-D8d;7UES>F6VwDxxUXB$V^cKeeV+iv&U29(9U6pp56f^FOF&)9bRkF<2o z80^z>|BB^J%k?0PBiE1D^1?*iZZ4D5+`6J^LFT86`yMH+3wlp?PgCd|*Z6i}FALPH zWk*_4yCC3Luw`Y8O>^C4oa@+o<~A;CYSG4~InG%zo`}j}IlU(PdB&zWj=~QpEcJ{{bCxV@cC37J7H8~Eb<;iU zPW!obr#YV8X-=}kwL9(cnd{k|=4R|pbCPY2-Dys;x7}%uYs%Qu?ldQ3cbc=Lm))uT z(=+|!&&7*dJ-bsq$R2j5IZJ35YU4^bq)TV)PIFwl(;Rn0cjng}~}LHsO&$t!wMe%#8JDKME60avq^umB?w8Sg)0D;+o+{F{lAk zE+{}uiJV$Vov#ZRw8Hzb&E`0@R~xxDtEuW_yFDexFxO;2lAvVFHFsw!OdvDAm$~MR zluIS?Aco4Se7B2+Q@k$zM;4p=-0}uxOfi*n+B9v!_Ynf{M7D*)okmX(f1djmsd5ub zSd&6B^VB&gLf|^hD|=`b!qo7@JyZ)o7-x*v4R@2VCLJZp5EQEtS-tlnYNrr=)YDtN zZH6*r#0FI&b3@9Iu~9H;7Zum9*h>@-On@3+CI43?Wg)e@uXy{vGaM>rEwBB$i#zNqpcKlATkvp=HBfc^VEjkT9k9be<`9sXj(Re#8?6k`YP zCP$PNUPyhcO;lqlAEw;qpNBY&1X9~?VXfQTTE9$%RK7gm)_Osio418V(txRbrOr^Ly}qJ@>8kYPby6YIiMfJHjYqmR#mpL^c$8qoanv zks1o!nQXl&g6OTl;AZ!yoHAy=ZE_6XD5uf>GBGccT<9j}lS#s5Tm*{-EA%khfEdn2 zk{%>!17}J5I?0{~YQF^}yB5`UnMm$ zXH(3vC0(zZ`-87mE1Efy%)%0{&3$D5^SFC_xu+bmCX@Y-KC<_@*(XY2UhY<<D1z%#@?BCDLKT9NM_N(=!ycGR-Gs&)je_{$tDC@s(-OI@{#51 z?BBW0?^R8Rs}m)Q@wY5(Iatckb=AWhilOcz*ms&UsuN|hUT+p|;@pjiP98y7>Uq@& zFgE;T$m{~{*OoczL~WTFL$lTr4noeQY(>gi_&uB7G(=d)-YO_EGH>LFWO_BWBJ4^U zePg_ipQogeS|GaTlbxOyu;-J?*z?8J?0J44J;&LbjMP0}%B4aND@Fq0XZ&j!l@BTvTjN(&-FS!Ww2jw^H|n_X1sqoLYdSzTSnQLV1`(m5g^ihPRv)Xprd;yY_lZA=2uU4x(v5FDXw8EvJ zGPkq;*NpXG|0jFFgFIq??yHrLQhKv+>k}CbRCs0E-0)rNARGOaMPrIofBAzxytncg zMi*iP=V5A|Y8{>@D1kpk8wUp&&V8utN*|^XuF5kdSmq9P-#8Bp+IAjwz7~%6^4I&F z+vNq{Qz{Rp>`2!`UoS8Cc)jGwkJ8)p_40zxxn6#$A+#@wJjjl;0B%5$zjM97WYj^C zJ@%$~I886tF_kAjr;(Zt*kV>-6dvNi)ePh0f1?>D6`q?-8BnYG$#Drb*g}0sc|vJ} z&No*VFzs&DuKLLvIwRwGu|L?C3g-BtB7j@|;220`nOpslvA2lojiGI*zZJ z?BRXCVV^y{D2Fwf{Ld6s6ZHOkxwHEJYJWZ?n_;PZd0eAc_UMH<9HuSnJ zCy`XcW$$WzkUgS?lUjOywLYMcBCxxJrMWv| z90q+metk7JHs|$YWt+Q&VXos1XFP>4p0iKZEvw5BMvcmoKV?dN4K;MNzbaz~H^m#t zkF@UQ5u{#&n?FQK^Kz-sMXkSl$R_`Nz2>Z<*MYjlJy7iv`wyvnl`r<0+Kd=4i@&9) z&7WVShQOT0tu?F=&1$eIJG0A}|5E#5G!tRBXGPUu$aO}s-n|F9LTa#FYYZm>AfI+o zw|TH!V?LM``<#91KByt4tS)fRpTe+%wjom1*ZjNLg*2_(YMUt%YmfSS z-$cE!w#&tuzJ~Z3$e^qcvM04mFY}Sbst~3$Y;@iRWy4jW)D&=yo14^d8DGiL=jaDP zSrjoOqxRkXseb)OumiMS`j!zYu5-Tw(?I(1@G-qsu)bBg$Xzg~h$7o$SqK;Mu z)G2n`M^#jP5ArJTuA+E;AYpIR;+`Zp@0rh-0jiEyo?_#?L zah`B$2LoWJF;sG~a4O=sHH2o!r2P`*StpbBNVth9Q}#<(r%c%+Po}rf7U^l<9?1Dk zG#HcSdc>(k2Xitv&qLI*nbrWS6@oJQ_mF;T8H0ygNU(z^Gw#DC)X2hDAwv`T#VjYR zMF4AT&{me~vvv%lLF1s;V@*#ep%ckCq!kj zZs~+Q^5b-qyLk7_^ya6skHuSfwwFE8&Sn^NbMQ-OC-kN}OU`qB{$nucnwn+Q?k{vaNRiOekxDH`ZdFg=a6e_{ZFaUkpH;MfVG+# zFj}rm@6wBUt-GjynW|RqvtC#57B$s9PlPP9PxH|-z&^}Lnc1WS_{Nu?_$rATT2yJ% z|Jdg=<+``(nlU`fh9Ry-c04e}Y*ghc9SS}^Hhf8Y|SJ@@ixm~vB^#7s{jYPLIW zhQmE|9j&(EFgFYaHny;Xi~B1a{Rdps&8>*pOZ?|pj#H!5_OwwJ1~vF9K&w-l{nik# z=kL|1k%Jcw3Ired(;G5hqM&bA)R3BklI;@V;n3sfoi0s zkTZ86e*biJ226R^7geQlTe^H0=s_*6X2`St`_$x~N~9Qy>4>SItw%c9)gxsb^wF?X zQ0tMF3iU{Xke+&^rLG?78Cs9D6!K)c9C18B>U+tnnkJX+dYd34@U%A=F0JX$KQ@@NRI@@Sc(Jo;K6%A;qHU8YLs zs52I*(w@qrO){~zewNLQwi@bGkl=7(0 z@$sliPKhE@(LEj_1>iKDdc$Q#+Vj>e7tK6Nzkr8*kRniei@ zTG002Jk$5B$>0dWd|%?k-zoCn+{-U-Nj5HQx~!=&(X`BV{C+}TDhA1wjZ2r>?s2t$ zW=dzg55tkW8Y>zX+ahIuQ+r#}GVM}UGGa<`VA7IRaU`!QlW%ykOCuw@lr~pM!4-ju zC(V?e&=aH{QenfFV>EQx`Z>yweteO{$ZY(=AZ5t#$Z}Pxz5y0FkE4neBu;g9vLWXw z$X7%Bw1%_Fv;IoCE>+G$^bEt9bCmY#Kh~1cyEU>Gr z*Dl8t|0$0%9O~XX@+kyAiwC^$g@36W5A^Sht?V~#AdoL>3x~Tf_b?^X~m8pUPAz0 zjI6@1dHqeu6nUp-k%ml>@tGoz^(@kzDN>p#(yNtynIgq`xiJS8W6Br0odWwnTyvEN zO;L|Rr?Su{m;nrRd69)zJ0(T_&f^i2P$lgpq-3(A#Kt1fOv=JvF%#h--o>1$_Gv~G zxI2?dXG3JR(=H;Y1oE=445NwV;3yp>H2}#@NLL9gJjuXXuu$my&nE^=R4kY^(w2|A zGEPj^toOj(ZrJSnE$MRkp}%rG0$_BrQA)_Uu|L4Yaf3i&l{ATC6%8;4xx;bl(nX}u?u}KUIF;{ZF&&^5dxVW^m7~%8#Z&mi?UMPKD?pa@YxjSlc z$Bb#yp;aaOxW1|W@;}kVY+JUVwPl5UVUOzT!d}?8U_nzd+1M6$I^*@|cfM_Uh$)60 zxWM1o7N_!&8^WV+6+OeL?o?#UEz6f=8e=QT4xQH0w9;v>NA`l&mSkIFi>(mk!Q!fV z8OKuf@;BLIVYmLH<0$xh>yk0_1%u_ZF45&Z>fzERC%FeeN9eTJDvn2{dYUeNM?J>h z(z>v9@#5B%@uhC`7Jpv>9Q;dJ5?s^jn}G zbG+6r=UJO>bzdQcL!EMYZ2toalFYl21a0yrBMzfjy69wqOkc`k?2wWS-FP#8 zA}*_UA}MVdC7@wWyC;$gP4avsmy81UPdVOny|$Th&q=p*p;I~xlQyU<{sUdSNh9P` z!#*!SZ|^>scSQ`6d0M*d&CN({eg4C>d{*<*L3*PUr4v>tNCl^`OM)%-XA~*V}37{bR{ZU>h-=Zk+3o-ok}j&ouhw)MSKjJ}pi&x=UUH2Rup_jGlG>hS;gM6EEGnNB}-_cl35F=Q~Uz&)$3 zZYKklp&a~WQXGfV`GJsNvJH_Syh{MjsMG(=NGrZ zEesh$YB5N5tIC#s!|m7Oa(Zx~Vh9c!RLu>Mk$hXo@NQUgZYyM9F`4Z}sJa9j$MbP`4YuM# zgi(Z`v=>0T4g!^M19Z_Moh1-q6Uz|540v7Tt<_fB=1R?pw2;gO&tz`6^=CFK$}ec+A+D_U-wlX9z`!D49GVoV!nGB7}+_$B; z3^f!qKg{7tX)W2LOsv!EnJLfv?n7M83(1%$Za+w@G(xR z?C~Y$Q@GX)`5qgzCnF-i@oivA@0kF#2Aqm20s3)_@4mzsD?jrcf;>WHFH`nX|BSzy zrpe0IsdJ|?LcbB^e~^lH$T=Z?ixIul$$?aGHOxmGdIsa5V?cSvH_wiVvxzSpNE=zf zzoh6^o=S(NN@etGQ)F&vD#9{wxXb-4Ji*%zzx9(VX}d@%LhJ&~=+cT6{wOL?G)BLs zg1CgP3C(f(eHFu8NU8u{Z2jGt_CC=p#~`M$vc4uP1Q5h@SW~8>9RUI=>1xzSDxd0h zHsA8#arPnjao>la+1DXRI;XD#$u-+UN0h{ zhZ&uI=3lz3)eb@Gk`F!JQ_2BIxiq|T(ZjB@T3U$-ej-6LBz|T0FbAUZ;?3S2JefpZ z1>Fk&+c#Wa#6cypCLNk-ICt?Hw{Q-5>PeL?3;3qWft+4EYMNZ((SN%$1)m{xbGI_3 zBOjI$N+{+iQ%+!njp%et0bN6xGAo1t8=62h-y%}3!(dfShjG#u(zO#w4E0#9TO5dU zsIIKCWj1|R=RnGeU2dT77O%)pDaBVJtLl|$kE;!%RgPSn_UPOyw{$;wo4~^M7bVyb z(OmQ}%)cUtH)hDv>Y1(viSJuZ7yY!Nz*fp`Foh4k3IZR2RY+G!0dBwq1wdgmI9y{-}JO zDra0edZ`qnmh6eq@`;biTCyQsJ`uyv#zQy-OFElo%!PJ_BngB?mC5Q%gVI$lMj7O9 zzNp+tpY5a&5fMM%u9NsQZLm2VdG?E?Vc|lmj8Zr}QhwnhHscDE~ zF8H3_KtGL$88u=YqMnp_n|3`yx1E-jMqL)cLkQz;>H?6dUnCQ#X({13R1(U1Wh(!> zf<8wr*IuIGHg9ylnb!ST7PU!?!0_8qKzv6N+_PHhcYlDF< zSZ#D;_j})P)n9IB&^Ab0iR4xeLjdO@h&ebDleO1b3nck1FfNrb;xm;kzxEABQuUYZ z=@4mdJ)^4&5Ez9pgE_d4^}p*3p}+jamzUc$mK{zhR{bH75|u3>c73B}+RK_(oVXDK>t1363fCYDvL?s>j1)52PV+_MToyOVv&3w|CRi@4*n-cs3eZz>-_4*PXK zd8udG!~8zSOFEG`Z~58zt#loVF4bTDtO5k| zZ~CAkwHBnN<}z=vRd;*fJ)_r~sLCo<+(ZY*toe7}eW<}Gf{YnexRGaW6~d)enkby1 zME=49(7wNBVYC`3c~NQMz2O~IzI&Wr`pIE`UTzoP?6Dis!04HDk;*tpYwDLkjJG` z(jm7Hue}s3d;pTp0m$-dmuI`?UI$Ld`$8E3S8dlE1^GsrhvVb)4KDdn0`U-yjX08* zJ3|WckkAc!>MVC_72fAHwM|diWSA2X!0QNCK_n_48N>B#g{fV?sp~MQa^2odjK!&i z#2+$Pn*7tKh1}NFq_XA8G(G%pW%pNdKQG_LLx)#&1HxDaOS?C$fK?cQ813?|?nA#b z?JA?c8B2?E7^^wNYzd&sFz(17U!c52R)%@8L;w zOli(i*>XmuhaXZSaz+%JVDcF$JnH7^FpMK>RkmEr{SU~fC`PMnox{_(8F4Hg!KYBU zJmV|FBAiID=F)5%Qalf7SRk)zb-^?U~rf*A!=j_H-0s9HF<*9VOf;_FSs%*&S^cDsA zv!;YvlqtdCv@bn}SqD>$a$B5Gro8Ff!4_&lRQzt=1<5TdlJBeG2&!y3yh;Q2sxN`K z$~NWx^iBo2N|ixg)5_YWbPJ;n4ULo{{OVRtY?d_{H*CXNjl;0o0SQ5ectq=@hI8UMWpXOmMG-<&H^4C2Q?mPqs8gu=!-b| z2!gjw(Fo>vuU1jkycqKJPV%JWV`W z&>An0Te}K4-0UdV5u~F@{x14(l5cd9Z4Rocafz)8@hS5z{oIm^d%4P%H~G*bV0Y`Y zDJd&?r6(QM>s}eleA+YCK_rldq?}ms4EdkL;R`G{~1@6gnxoEt5|E}*oyK*j6t?3D&#Ig( z4RQ~7_BrX9_I*#-jp&kn4{nW9q;HUSySX;V_vPBWpI`njct0MK=aS}R(}KRZFyuh= z!F=&59wVR0$L0>XteY?48#zVBCOf{A?@soT=8X^OiveVhihPm`3#c#goX2l*L^?eb zV6z-RG{-2brCIaZk@WohWP1v-*={S@4jU(X>Eh*=+Jf{fH!sW8n9cGuX0tMixmg)* zj?&I_E@@n#eZ^!^ox_=KWylk>I@UG;7XD7h#fvJ)4yZs-N0p(@qa|t&&w5&5^L&(k z-TFj*Xc~feTysLGs1=40{DO3`e~*4tSa_V)-(H#ZFeWqqX9&`@fi%7?fv9;V{lVj$ zBGhP&`dbm?6J1olE!Bc<{xGd5jLV^4`QU~9mMTs&QzjEF5ks(uhe>{1X1gKCwr7ReGdYX z=#bSR$&XSn5|?v(@N#`QM)yzcBSIN+hvenHh)Vn$F|?@@WP6&l#wNum_%v7HYmiEk z;b|npcpv&}C!$83Aa|q-lp$~WqS}&*F7f5|^kH81LQntF)+GIk$<6=R*DYTsOBqER zJ>MpO~Wf&RJ-+8h~Fi$(oJ5od%b4glRU;&Dx61o@L|Nj=%i+woHU%4kVrBWgjX z70j50=}bn?4{4>$u^CncWC#P&bTM0EOzi?)y2y*ZGRnc2k}QS1%qDm0pLdlq$Yn9) zJZ9ddYhKFFu2RU)nDLlb?x*}oXF&h5W`>tdFU&NMgd+)42?8Nxv^=@*tHO`)N2fszatwDS)gByC{N~%2P`i zszHWDA>*TRZi$Q^jwEC@)ue`Ukv6?Af6`}%UCry^_dOENV7J@S@AsWp>U4iv*)h65 zsv3bRIY#Phd<3HuNt~gjT^8it^!rpPV1DVVcZVNRq<=%9N zao=?HATxu`SatPV(uZZVGlDaZ%r)hfbh(UlvL_yyE!)zEj~a$X)NrSY2FC5L=afuw zkA|u@yfuGsRu3h(hD`eYEIv50Ag`?|=gD|)R=X1U>8b+6nA%^jh3qewbw^f0WyxEs zd8pp4qM)fU-$>lgI(oa?JVR#)nnp;_Bp%d3oN z()&_2c&wS#)_BQcTU6)}qs9?JPM6f}A%67eR=1NQgo|sOnN)`M&Xc48bQa`0>AhMM zD5n=ApbRO~s-NdlMPq!s%93Y%)EYLZYf(-6jeybL=4SccvR8&O>=j~KKY9K$gFzXtGdOXm%FtB0fO>bYG*G{e&f@yY}fiCZ~6$$x6@68 z<&VBHG9E|r$$r@1&R0Le%(yC5fYE$lVkU{G)%6U)=*k*=zw^4ih28RSoJspFtwS)8 zMr_6~!b|^CLCCnZquI(PByrae4#PFw*q3R@Fs1cqN4!9a z2->s0V$G$rRE|86exFG{^OYfNmm*tjmX(An^Z2TCo+&3bkTtP)mLn@vnf^ypQUo-N9ny&i7?si z8}6PN4exl^d6nWdGNU8coaIUZx-;3YYvfJ709&Q5;(v=&(AftNBW}Ou;8w2m)2jJJ z>bks0>*QR>q0}x~xGF=g*D{?=a{0#|ANmg-5C=5a!PoH@R4}AVm}~Bt)Lv!CQ~nJI z&%7FUo#@tU_@h_vL${tuluX4WI!Fl5yc5rOrK|RPrT<9WDae~CGLf|Koy4oYAlc;R z(tXgNGWrvefi0LpTSQ)(LCmT^*c@Y)!Z_tK&F#@+{%%V9W_;D(e#z3Y7eNMW2K7f@ zlaBme7D^3&_C~dxB2+D6qy%fZ7F)EsQCjvn<+OTeGbuiI(G>p0X(3A<^j9i>&oFFN zPTtYA);Kv7i@esG$+XYO(xyePd8S3a9HZ(3yDObzzQZiCo3wQ82}fP~zP>e+zg!j7 z@d`@|m@m5)s2kY2%(MB;>g#fFn&J`fcfNai3HEz!u!KRT!Pu~lhoKBIWRsx7KE-+F z=7r?lCmnN!4I4I0{A4on?GmPpyN#4$*BnN4cQgamjPn|LnQ9f3%26Fcgojcc7$(^L zC+)5DgMt_yM-tbPa9A!a)oxP_FZP5zPZh{ zzLvgbg4skeSI%y4-Jve`mE`$_>hfpw8%1JGEb5idn}}38mdo9}B5z z*)e?fQ}eTr@_o9%Pul9HM-x^ag~KJ*w+ic$#wqmM3x%?81eja7S=zX)DW1`{%_iQMXD(@MTVOXsTrnvp({JwL#$;PYU-#0c zmZoLRy3K4~j^Xpy=*^znr3|^rUq)|m!wwwzw}2_;Gxqv?Ka~*-8+L8QsF=AgVlEy) z5YHmWqu(Nbk>*sFBRqBN(uQfqssA2_6bZCxUqnD{9Ao?e#2F^gDEt(gxEm3sb-Pwy z8E%t&yOq<2q5Y<8#hEw*;csevj#Caqu8K^c@jTT?gP>e^F)S1zGM$oqNQ!cdpfQ{U zWktC@V}iVhgSZw!Tn`##2h4)2q+=b{ODf;BLG6au?Farm1YN6@-I?^m{yccXfPI7u5)pBh01J$%r>G9s_FfJgu)6`#JG< z@)LwQ>T|Y8X;dh$&MK30siHoz7BZjWz*#c3#pcae2;%@njAQpSx?0^|rS<<-kOL?s z(dm$7O^C^WwVJU$8#P$Ii0kntYN8v%NiR)n^hd~Hon=$xd?V~3W0qVZR}KAj z_B#G4uhWgx!lFtI-Mf$~3&W(bxIE9AJ9?;1+co!mX-&GqkQZ2!jH=#!Zs?=tPsx<| zFG}dGwi0>`?r zV_fT-M`AloLxQMxFq2im?oN+HMMA>r>Ek(JxI^?sBcdO{)Mf}E??Tb)RwgR z7bh3mt!wyO>?j!iWnKUg=QEyca|pp?Q`_?9#HGE==##ArE?=-Dd1;T9yd)2tUa06X zmR==$nESUiFKLRmv@UGC+$I|NJK45u`2u^~#97O7$E87!<{Z(o^mT1zxn}*a*EYwT z-3u02>(t1_sv5>^6ZsH{BPGiHah zW4-3CWEE3ya@8D?Dp{Mg<$%qA&Z<-cHs+lgDpkfC{G6ozf*?+=XB7*a`f+cd7wwq-G`CcZ@F%5ijadjh0oBLY+iRmLLF zm!H{)7+%6ijMu`d;Ik;ycV6c%-bi?gLRJL9Tiz%?NI_d_C#iy!CA>hwE*G)zA07a- z%SftR8Js|vJ?6KtM`g%)o^Dn{ru3Csf8Ybq@-m`w)zKMm$VlDU&))nRW5{L6#sYnqXjD;Lxs0aL#WBg-wVbZP1|{E#mV zUhL+L7>R2^+4$lR#f)M*`102xu2DlbfHxwJhU*a591D8Z($(t_pH99lWJwbO(r*J^ zl*RdE>I99T{SsMoz=2cAYve6LM$Lm!C`%7RTGq*N8^Bgu#J~3Pw91voQu&CHbF#;u zKzxU!cj-wshjEEQz9G?vq-neCPu0uBg#5Fse&-C?Ac+RZKd4b>idhV!N>&~wheFpf zPeQYnRlk8a?m--%K)%Li9!S;8FZ~H=s&|`Pld6~R`4jS5YP(^{7sjE6hul(-&pYc; zBXop8km7uJ$QQ;QbFf>aM?>FC)yvKPg#0eGT@D%v$oj5&#Enw<%s3?LyAI18{)D`f zs+ULo37MGi%KtvKT|T89$u(W|dR+#7hH}Vv{gtv$XC)}Xr+(z);}AUUyaq^C0ySy~ zWPcakCq1Z?e4Bot?R-$UVje$Q%3_$0Eob9Pryt6D&X* z$1oaT$yQeUqnFi)AP&Hi8=3sKu6oR1+!xKLuR}o3Kbf&V#f6{{-@Fl)tYg{#bk&PL zI$hf*Qp--aj&q5RX^0zV$jAOekQ-72`SwffihuPNgL6hk|0aaxFaFJt&8hn7h#Qvd zXN7O~s_-r=+{UCZD{Q91(C?YHE!8>$LHt!$e4Q1)$5QcyPEWsLq5GMnD@yieY3Hgf zhCG;RrCu=kbTJsGa`3sekj@Tgf|#JUa1e`VRWt&V8TTZC@a^NY>NH17Oy1AdewC^R zkzi?pp2_zx`3-ih*E-X9AjEM_nv*{AGsNX)|9;5(sSe03RLy=nRS&tHU(fODF}Cm| zzn3CmE*`$z6Nou<4fW(`$*br zFx&^HQ1@@jb^dn9KT@sJ5tsgDlB~yrT8kl!XF&5~ORizp2MI(@6w*n{=LW=kVu#jE zEZqQ0KBX$bwP`L1#Py0Xi|BoZYv);lIT)5qs)hVm??TyVP`~3JT_MQVjYMX7(&@IG zUMY3;ro83b0J$w)4|&HIh0w#Ve88_O)Adx$CCf)^5R+Fw5?n7)e;U(k&e(5=?r~U{zI!8c_OVZAj`dg_6?Y+2{NVR zjw~t$#n7nlu`tZ@3DRS*)F>FEWW(yinjI0wC;X?B{7X?>Z~WU&;l5T*mGm}OtzgYy zui^WtK7in~JJkTlpF62B_JLBeMWV3O0QpmA0k5>Jw4T6v)nC5b8G?l_rDPwApcqL+ z&Ot!+m(88^Ec=eM^DLD#m;XZT%7%Js$9Y{ookiZ^WHk!%;i@@G$)>D!4k;E<1LPGA z!edIw1G@dUxQ3rVTn&)Dovo@rJ!BIC>VYZ9=Q5n;VREGn=NES0YbcwbM;$cb3wVL; z_Z{!S@FroXL!3bTX4N*O+w6V>Cs-Yt9_aLmzYnVAYm9qpX!xA?_6hT$rS~z zWMoag(_)^yMAp?L#PJ!z*ytK|5L~n?^e*>mL@*uJE`+5$-(4}?U-7zqkM>!Zgv$^H#XF<5s$T$?z{2dg z+9h^`gfNL>3k&f@h8k@+(QD;ezrCP&giX4p5!T|1U>;uq3oWW2ξt28Z~SuMz>( zkIb2JJLMH$JAq!{9PSbRFi$`n>vfPk>ugBw7l^aYE$QvB$TQJRz3;13{bVcMMY82T z`tE}zLu;k2Uiu|uQN84s$)b9F#x|3!qWa0EbO~L}=FvRXfrIuwy8efRLymXruiSo- z^kZZJ9vN>Upo$@D)2&#~+MoOOAjXs{(_8G6!%TtryVVeRfx91@RGvKQ*XlZcK8B2o z4$zmR7zq-pnzcvM)-WOw#MKZ}o=g=mc#wZHtO&(n%iibTu5J9=!N2Z53Es#3^(?9N zGuZ&*k@-|z9eokWi)$f%I%3~STgJHf=TRa+H!g9=D*AnBrasR+NY{2)V(j6*`$Bdw z5)I_@)pIaZDY;S=<5mKeC!eq0La8VN2c@>*E|n)w`-W@hwBEC1-*9Ik455L+)`w_m z<{z#G!Isj~pV1JxbR7Zai6@G#F2zi!fkV|GTi|^o?sMrw9!SF^ZkdWNk6#se!UMUk!3Q-=T(Fk2s31=Zi5Zjn&ui z!{ikl&WxeE&>KU5MiK+%goFzmrSU`L{fwc+zD!}gZS{yR&LtuuEkvpffqxJUbZFO;Xb2wkMR0u%z~sED6RFq0k|n+^X?nzlpe~U9$PCAo@bkR-hqeYe|kKRL~L zKEH^tee#^db$2;wqtr(COl$}^kPMK|eRQxp7FFErqapDEgbCIN?zPd7`3251R|a)M zhe#V#CaD6=%cS{5rX_81M61$8jIL)ka{nTTF7AacTfR#9eUaDoP5ONsBk9DL6Z;W1 z79N;iG#?d`)q*&FM#xEkn4cj=d&;vZ7)Knl)L_|>O?}+EY+!%hz6+KbEDvWFs{!(J zUjN1+HCTS!v(R(x?`t_#3^ej?L;z{TAgS#HFl()TAp~X7I>?C|)L{8WcCk&w5gQ-1 z?;52B%Xf5pud!44WBV@dU;TC?j&{WBSEZK!HE;T0G58A?FZ}{7^ z%qpmrfG(g;GTl9r$)V||Nzz%37;d2UgF9`zGnM~pBCUM>OsQm3weEo!*b8DJ$StGA0PV?-Xl6U|{f3hyP2 z&)4zu#9C@6yODH00=OLk>HiceCTb;a>wa?P!?HZXhdJHr^;24kGGKy^U&q(vC`nbj zY9?#kg8k)ByyvLHKr_kL_3V+_k{Q*izl6ANNLq7sInFYCW1LR<%RlU^IjoIgUjl=; z24+{mme^@kOLA!f=T32xo~y!EEzXPKb%gN&0$^B28fQt@M(-B3ydJ0%M)kTQp-;SUvgE&01$N3+ZptAyG!vn-4P20rVvs(0}+GK-Z@oK>y`) z0A&z34f+A!S{w9h(+=o|eJzL+$gib)0NJX6EV6-|oA2(X-QzqUf5Yk4xLgv#Z+bwP z$AhdNq=l|f21AY~>9UgUMXV9TURjjyn*ai8u*`ITD0ASP?fjnL{H}3+Ptq_-bk0~z zg@ed0y1eWsi`OBk2Fsw~pgo-#&XB%UWgf8m2`ryO&)TRO?O^IW2T{dNe{-GwP9t-7 zFlfo3(Kc5152>9)f{&+6+M{=UG^6QzSd=o9?0Zenod_l-wLV-%VJst0PFyvH* z0PPQ%*JRJiDCc*)iE|=_^EloBiB(9uXFRbl)8k(D$bp$pI9<(lx+-S`)ileAK6H{zrS}e zw(4NWHwYJ z@~qvtJfV6{ZwA9vlf9mA%GT?btWEn|U*(MUV3sr5b*r4Q{X5GU?NzI2;XfF1$W6J9 zk71^KqT}^C>zAw!tx`vIqcgoOA7z(42HSH*z0u)}_jWklztQ1ze>a@&f9s~)>89-K z(8!kWqVMtgD!tBMVdtD)cLP1^_V}pV1*gXyy?RV#4x>zu zZ`(b3C&Z6B91Q=&?eKB8!=Jj%|JY4=#!dN&-67;Da6P#g?h&h_JLC=WWwZCBKG*Ja z`Ea&_)jjPFRv*oFu=;$vGpRe>l$YBzRv`~%_vq4aw6hwfc-UN?KrVg{#GQ@tKHq_Vu79Ue09*--nkM*d))3xuhnr zk_b6q@8d6)&$01w$OZ077nILkP}aFA|8`TZv4Mkpnllea&}Kha-bA`hp3fcbvhvnM zJXpI4EBDn;oe4Rx+`-OOxej&?EO)STZLWizgUg+Lwcbtn&+;achq|M+xxFz&LfJEl zXqe`7t>oXDBl-arHMD_DYnl;4uvP|9tJswM9i*Vhv7hh}F+|@LCM_iy7oJQ-xtXiRT0kH^TRS)f$4~F$ELYy3%`&NC7^<;Uxp0$VK3X4JZbM0C4MICSkFe**3 z0=6o+FUKg%Pjm?XUNVMFFBsXMWnoX>kb6uk~{#;?p)~YOZlpK66v9c2hoY zvls4_{d!M}yKsFo?QR`y#2!&Ss@xo&`djt-H057D&JHcZsEJk)p@vjU|9%!>b5ZZ# z$`83ZJ%=aBAzyLtJn1~l>8%eF*-EfxOqvYmAB9Xefx=2w`(X66HrIC{&iwwUrm2ROCEEFk^*`T`z)yzI3;GsCwITpjB#;i<_F3^2_g_o!`>hvOsIx zs0EJeQO}iUmZx8(yf4_8W6kWgM#o^!N^?oW0k zGx=@Jwl|4PW0$rrYi-p4xcW(1Jyq3moZ0c3$Z2YCbArg__NBdKDMJo9&$x)JEMdKzO2~?QF>AGF&o*hVraDy4S_C9rEh|HeP#b|2 zTJZRM)bN_I_-7W`aZRFHWOad{1r{xOEa|EyZ9-YccZIHoWR(ZPnpzKpTNR~!u?1L) z7*-&RH3;)5DV-ZZ#W4$7SY-~@;v_0Yl{XOk6PIF!_ERC+-Y$vhT0mYyZlgJijCg*9 zc@@r;MNJeQyH5V9zUuY*Y0NLO<|#v7@8Vnr zB6QlIbH9nr)SMv5A9TzCJz54E4!6N?|xD7T37Fc^gmFdx*X0=Lheno`yX^| zr{#;0kbygd?)9{WL!2<*=f4keWymj5bNKT?f0_RIvs4LxKIZ4Lz8f*^9-)paSbm)< z!9|dz1!{oY=BME+JF6-=ELR+vWFE!>o)AOlp+*+2gXGKuy$i}`KE|sQ5{8fj&x;j^ zgLa{o`E$87U2lw#Kll#G)^xS}!Iz-yH=DjoOJJFDcX~VI4PP1JbP0l4OuIS#wtV2* zL2VLKKK3Q(A>`(CwS4GHTuhYmq#M6Z9}!*K#7LNv-;PK8Qn& z3-axL#>x$T#;}$f({pSQ-VI&cw&(D8cqXd_mNMkqU7X!N8VO9p{0QVnt3tLCDaZVg zv4bwS2S7G;QM@)Qll3=ahZ-Q??BZDaZfuq^WE)k6a^}qfwb3LLbpac3h$5G2$bfk> z5ySO1c>mO45Dn@vsR6QHFT#VVjrKQ8xr=-|?PNmk&uT#s-$d0S$jd!Je%E+P4Um7( z=g5C;iJrtaaq&a;8Ly}T8r*oM@%j3g{GlFW7id3vYq}oBI0+o$MH8dG2X~J>abMjl z6TXmIg8sDs3uVZ^QuXrHYOxY?^&2q`8S5cn?4fChvr)@Q8ZYAy(d(5))C4DStekcT zvN!}em0RtCYRF0R^0?#9db5-c+$_)>2RuEYN}-d7m*eK znKHB7lu0`znkn?3RK3ismWhcATu4WG5KKBGjTHBe83)TaO`h`|A{LCXl7C36Ja$2z z^?9X-=>>NZA8xY|lX>e1I$2TX>(sA(jSgg-`akg<0vmo1GD4?u+l3BIweb@0lFmE? zsSiPdM8R1bA!p8;ZHMH`bdrN+7^U(<%?-{iSN=rzNOFaFM5tF&S&b;D7gy`0;5cL(5VVv&3RD5W@Tu?2=3Cw4KZ9O_| zQUi|JDNm|a?pgLL%O*uBtLV8 z^r~(>A35TZ1 za%y>s5tYRuL9KLbrvq1rbR&jQ2*N1)4A%7*e{-rNTcv+u?8TDY2z~WY-@&|A7KP-5 zge6LyfPY|5f7lAn-8)snvh)DJV;wADjcRyAP?Bv~T;iA=JygH;U&B2(u}G9&{N zRkI%8X=xPyXRJ|jV9K=frp@{}X;Gu(^QqI%T55fBiBb z>&=w(c1|YbebtVnIu5dR^){{R7{?bRAu}YuNyUTkG_4O}%JV$1)N!)2V;h&+3n*jd z9UZOCFa2twnum5u#w*;;uOCK^V}zylvW`5`@ixp-(!9DmGBv}Hl_5xOyBZ)@`HQ*p zNhBO6cXyNwTY)fG@)LwFE0cw-kfH3%iHkY)o3DR^xW*`0k`6`Rm`Yg?okx@MHtP__ zhf?2U%(2PXhHD+9C~fDmSo=lbTPOe-KxHslQthf4?9P-e&C8APU08(hNd30r%SqB( zFcd=>+t5)=D7?;V{aVUMaVDl921d!Gs#gH!v!tv&sm;Dj`3GpA!8fAOPUh#>gE$L! zG1!2^D(}ADY5I6d>S>>-PJ(>ur+v;=b-Y}g;&niU5UMjsy52a+9lGMy`V-q`0g?n&(Km z05!Nik3neI+V-eosa+- z77nM;cZ1jQ-?Q@MCZ}VYhai;j_0hRH1@isWPHqU@EY8CePGw*%5bJ^ZI+ zNeN<@%qQZwQr>eXm&w8sSdv`^8QATDu`dJ0Vg1Z&25oC^!)YjzovW$IU8g5vPr(dg zE-9P2SLM&R;p#Y!8I$o%=r*>zGQnEReF;py^&Lf~h zRPkg`13pF_#m;hwaCT{lR*c}&Xgd|MtQ<0^9hMZ=LZTraH!`Sr66CT12K5RcC_kcA z8QnKgO-p{1ZsmKi4Az|(OIoQ2T$$Evl%Noz%II@bzPb_P5R{9z%g8cFc{llB6|kgw zqf9IlfALi^s~S>HFpD75%ORCzkZ7y+mSUL_&Bu7V4!tW#S1as+$rzfj>!!}#E~RC1 zXSzUwWf(OQ6*rL$R49QBSIPO+5RHQ($gFb6gfhtNR!CVH8=qZH#tvHv&ezWRbSv-p z)?TH9V-!KoFNcgNv(IX|E&V>EtQK-wv78^0(>H{qHYDXcLUMLUPTL^l+fWxggD6G_ z=z*xGF&1%LQ-okCnqkfDfhkL7Z3LZF$eG2kWLg37poe#RdXBv9D_eP$bQAx-C&mfd zQ|WTs%e;J-GqI29a$EXiIjKyhmQ7;}Fe&S%3T@ck099MO<+OpqQcT7agwY0T5>Cf* zoUV_U7-U;JchB##YxQfah)4P*2;w|gRC$YmPBb(pj#nRbu4QZcE}qK!v!9aZ+Vdlj zC$n2nNG^)BZubu7Tb%v}%CCKlkKioIh%)8TbUte69qaUBD&OW6^Lq*3iAnxGF^Vvm zp)q)|pbEd`wf2tPS{M(w+o2(od4s-UCSxjJyCP#1%wjwBl-ja*Ri=qPk zhkA8SLyW*(Pw&67J5Nz4pIu*jz{>fd@33^K9~b zHJ@y(7`3o478d4e`^}Fuf45fE2?M+-MO80K_x6>x^x_dnDcl*@H~737RUxSW$`W=Kr+)8LfYh{|!mal&;$w$DH zVZ{i`ynL##y2POGb`M8?F|^oQ(^S{Ns?ZFmWC0aBcW~S=NIH$gSWTD)VT?YA!2Qxj z+d<15HwE{AUOf074rq*NI|ou8I{tRj(?8yQhu7z|j<}#fOOSbb1Vwg`swmQ9v>xF7 z#QXOXA16evPp?Cje8vYAwHpI+m0tsAz8sZn(;@l0FG?{2$OhzXL)st)`8>6b5==IB zReC4npsyH=$!N;jbiR*Xy6zPr-Z+T*khUwcpZZb@&^;V~?pwR^$n8K5sOQ*PyXPk^aVDmSHD zk(Bp*-MCBsnaW2JLtWLbec$sYnW}6b*v2oo75qnfAxID5kg|^ul-UI`@h!;AjpP84 zKnOxkdy0Q!>kyXGw`5ufGCYBR3@wICFCgFGOpB3&<`C_W^)>EGZDBnDo? zCuuY%_JURIId9CD(K_|Qb>M_k{kl+Z9{*E3?ylkL9!s-nvuJc9H*n}MkA^|}dEM2( zGCy@Y{RpI@Y_NIe-AJI%+D?T=3v%xJkWzPQXNB}t2br#WMc`^@SxC_y1f_nRq;^SZ z3*dai<_JSf$^qif%qhU#Grxdqyl%{+&1g%6YXRpI1 z?n1g=k^6T^Q9$~blXE+el;X`YeH(kCr+G3gf-7(!i^p@dvm4`6i0K+a@sC5?LY>L+A zh$1W0*sm8s`Y?hF0rvwpB8A*PLC8uDp_$iXHOoAgRVf>#ShIru*~vGd+#q%} z$fGMmHcNMR7L~&X%7d%+O21kyW%;3gRG6|!T1d(7>)fdZ%Dz?QsA03;&swVn$}6i% z)Bt(LthC{L(gp0NW~IE{SwgDgg;fP|T&1?goP?O+sLbr%=^$~CHnib|&#UTA_bFNU zh?l>I0q^9B63shhm@*4-M*rn|NjeH3e%?~XXz?G?H$@O)6c_LkZ!74d4y*7bS;-xF zs#|FysTxfV6zJEKtSaE6>Qn@9e+Ao0m-p0x?0(b(?<1e41Mm=U)w4LyMQ8?1g{7jB z3f@6eCcFhxX4E4NI_K1RQ!C}EbOG!56LfAy_USpL2%wJF)FS?o=uYU`LgQ$b=DNlpIeQSqIrC|6 zc>dV=W9LtrKbDs3^0joi9Q4rvKc$j-JaWjFkag(-a*QNh%?2%Fm>l#S8cp6Q&&dx{ zZ?mhf`^)4XsR9=XoBRp+Fx9J`DI5JC!MsHNOyhq<+@d%6qw?q8MPbS}{j|uI{i!+F zlqtK#pOF2%%d)6$_PyTCe%qgr_fo_)sWKOMnDQRr&3)LzIv{)D`qsz+A_*1P<*@_O&G#t7NwKP0dE%4h{ykNC`u(zTJt z^`BE4A%PuowLby*ER~N2x-+<%myjth_{wBQdLws}%-F~|2|@U8WRyY)xwIZ(DNI}> zGwbD9Ul|3H=hGOD?lNGF)JB1}O?_J-7eL!C#H4VKe!9kaV##WX%H-)(lk6q{yHff8 zWi`p;{#wZ1)Eq9!NBsH{d@L2x9y8?8RDK2xUx~^>&VpV$FosFqAy_z9zUQx$9jOr3 z|F@z=MEw2!TKP??fC~1Nviz{7tQBqDjp6e96!#x3)y%<&%Xevx|E`|5uzW{HJTy-J z56AsVYM0#WPw?}Z)Gpa!f97+cnOdpvMa1M=>1xQIe3h~-RV}|KHoALZBg&)1+gru< z-XaAruTb-Vn`syZsVkY@Rwlqz(E%@g>j&OH-*oL>S~;Qr=FEViDrziI8ul zLh`B&m`N=~XYUW#151oz#zYxyv(I3jsr`tAVSLyBSp>A2jZxO6Ie`>ek}1N_N5MzN z{cc=^W+#Uy!{T!aCYN)?Bm`w(i?$C8LXJ-$j<=~1VmsM?3D)^$#FQ%vWME?cjb}#~ z`(Y_@U4$T-dBy$p8pOZRfMtkR(1BzHN_Ed+Oh9m|bkt9g%R}-^DkK+%UXucTCSsuHyJb#imWXx&`f9_S^C_LMrfJs|_b5?|g$O~w|$^pc%Nk6PCvWp=LwS;vj zxqyt+Xa=>fCF$vE(qL%V_By=h1@9r5s;&`zj?;00|Z2CQjw_4*orpdZJR@%I`_~ z8S+G0|9I9Hj%(?g6DEHgUf%qZ)Gb>b9Vc6tX7`%0Z&rPHVC^l2TW zn1hff!0u}Ov`B9ZBh51G=KZ_4llZql#l0E`h|*r@wk z=SGb>k{}v$=gL5eEls)zHDd@%R#d)|4$13$yL~sUC*U1l8DgS}Wpyj$?sS2Ek5IWu zI$I%kr3>V@+J^2L@*MoNtPgq1*MdN=Y5R329i|UOSPg)Yd~1jls|MzzN|dfjV&qsr4x zml~)`Jrwb49sr$}nr&QvBt1Src!pk(#)bdp`Y_fahBk2X*#D9Un@`#$&iM?MIuY_j zYCAC!fkg}GXZ%!1&V&46^&C58tJ;77Q{G=qGX614QG;ZwN(hRjW1Hp?XsM9X{}Q|P zy3e%t`3!u^s3-`n1hA5(d`W(}Ue_c>;6<&pMQ z{sF>d@QJ?+0bD7a1z4}XVoZ?FIuGl)zd_cj;!dc6=veu21gj;ub6^+tiLIP7vw3g7WS zeTtK+j+Z~J=Hzcty(YiGEjL((=@RzA99ohHtMFh(8Z-;w-l{*8CZ zK?IFc<-YV`U3eCP#xS{wzfRF=OPzDvn!^qvXs#NE*O27-tMlcOR>u2+bW}smtdto% z7O6Nu56E_J7NnV%*ExJ{%JF=`w<3H7tFhoBI%OjZ!~7eI&euixTTW>|mwB?9EQIzs zRD-INW_G}P(A34Oj=FzF(z_a9TH&!KXdanh$CL)^TO{XEXuBPn5~ohK2s+hERRBa%zD zzbUgj_=`=7w7Z`x`5`0uqT)(2*T6E@*ex@NQlBuul$mo7G|w2zI_6hVhGugvO3B|C zFpvMkl=689$gDY4vMf|}$CRlOj82*I)hV(lR3+zxs$|uiD$=m&P*v#sE2<#B@ZC3K z3@pgY>OKT;GHPt5(nG7uNnxIa3b`)5UH;{(gxtZSMt+l;Ly3vpu7CY1wFQz@MiBO> zTDfU;Xv&l+Q&8iw@z;FpEY<urZXKs1lzr2p( z+Nc=ojS)6@4NjIOY=VT|MOt?zC)^{)bR1B>*>_BzoW86b7PPjsHMRE@Q^!`e_Z@8* zKn3|el8<5J(A+|e^~S}=%4fB)jcu((yS?v~Y3Lg0{uYZGH9a6>Get*{4kj z^7}F+a0Xj?X{)cNEdd9_G+EW!($w6tuvPz9*y{SQcRqV6_GjY%WK0c~EN^Sldh=N; z8W%6uEuyu>F-UM@`XITu$u?XNH_40lV=if2%C1evS1FnoHrmzArsRUgrMgMemt*X9 z=0BGK54O>67iO334fJ|h1S$|%JMYJZ9 z&M1g>Tp6z8uef_`w^M??(e+Ieb64uVBXgSF9Nz&Ox(r-}nG^@2s-sdGGAUU$)N7m+ zr|%fn>mDw0_QD1K3xlMiJ*P`wtH||$P8@eTy(>fRa_-t`q?0JQ*O!_>`kk^+s-~QS zVD*_Kuq0hjrX5&bjvz*};5qIGF>7BBDf;*_Cm;+u1CXx0B==MNCVNU&zlyN*tAr;J z^&PY^stkGO|KG4QeCENj$&oz~FQ@W!7k_aDCYD~N4G;p5w0_4Rff^fSxA}Ps$~&oY zS`%IXOO_VU@X(Zldi1=~rN!Gf&yN2`dppmwm5hSfwS41JW)MTcv-(0#~* z>5=~}OrQBQOjoBfFwG%MvMK#BA^4k*I@b<3ANp)?DDw&voO*&2m*u^qi|#w@!Shce zFPC)Mbkt~qgAZ4VqG^gzgc?vrYNrMGVDi#wa!LOGBAuSez5`yTM=Z?hZ`9)B|t5$nuq9HI6z9YrosL+0-qv?4-kf|+GvdP`ThUD00030 z|7SE_XaN8K0000004z}g0000000961000000C)kM{dt_EMUg*_Ka&Zf2#BT!qPv#v zdZCCY9-zYWw9NEe40ANYFw8U$O-)Zz6h%>#MbR|XM}Z7F}J@MftrV-Vu@YJVOJ&Z~ZY{Q_njhGb1A-BO@d8**{5=yYIgHZl5e$ z*ngkB9=PZJE_r$)pZ!z*@)Q0yNkVT;SeOi5cWGG2LN5#5snFY$B#)KnBf&3||A!vv zjo(A@{}BE6vz6X8?z4c*Xb(r#pdJ*`P`$Xuu)p(rztNa}t0J>x3|IFH@ z{D-hAkL1z7JBHPoT1>JYPdQ6 zrhJkEQO{}qmC9j0-Lr&`$}1P#o#XPF4BPyZA+L$B&0n%C^tKD1qvdb@IPm}Y-uOZE zde$%O%_U@E_UI+PkT|U!m4m?NxnPro-b?tK$}^YekKteG`Bwg>&-?QHq5La7U(et4 z`9PjOh<~N$EBTwsX(-QY{3|_YIdvAf@+U?;d>ZOGvpP)bXJeTLvZAs|8xbVC$&!u~k&|6h_KDdwP zLwR1-FRfp42^VlR z(kIUX{nx~hhMxZ_ebwiqXXE*kjD81y)901L?)`Z#&o>cMZlB*sUzL9N9MCVNwbsx;I4r_fiW9~}Yy z2hc-)emwoL=gAB1`MHj(iad{YEF(MCK7&U~YPei*YLD39PKHiRa9W>%;7;ONP<$P`2C5PMSg8}tkAT#>6df$3;04ZDz9M%KEEa= z%*XwT{_4CsoWS$xqP%AOH&tFU)1l|KE55QE_{Um1xj#GZH&TlZ#*gCD6~O=JINr6n zd;NaP_^&%5&cBtF!2jPk-hUaumqh=evKqL{s4?6w^s@@N<4)koO6xHa{Da5&x^uYv zbNOGliTEtgKlE7({s)L*4!up}KU}luKdpkfX3^gfzn?1Yzh==tDgFvI&%!l}JM4MY zzHJ%%)^qGYXniXirF=2$QvO9fe=#OxcPiB~QT&vaY-0hougu*JP?j85g+-yw9S z2dp4x=HItt+ zMU_vIBy9k{Zcq9j*)^`$te;W2&YsQ`S(x=7v)|mO^hftY{x%V2&kemZ6XiQN3w*CP z`7+;@KTUbGPGiC>wEXe*n|rJN=ss@WCPS~K?dx~J_nWA$`9bd00&lMhy`6EM$j<>@ zQ*&6>LKIqyBDX5#=9T)}P4drAn?dMr}>xqw>r9;1lf^x3}&vCpdU< zWA%S2@DDAH@7!G{rRDDD`VB0ykgo{6bGi0O@6{;533B)U-0X2|I;QC1;@qXCMoteml1jnC!!A!T)mWf9|&_ zf4%nGl+Hj?ItRut>xFmxWr{~<68)x&!T;fAf0+MD{}HvrD^Fl16Z$2)r!P8&R_Yj9 zsYS2U$!=ve^xO$5m&#jE?%}3SESI|b0+*JB`ka1Qp7dQs<||1aPC6I8%gFRr==j`#H2J(cGccs9~@r}eJ7?TlCY}g0I$YwHV?u9A>H8l6z3Pjs*T?9!@c8AJ(A%W+=|@5Tn_|0W-IoI5 zcC#3_6Jgd}A9@a}_h`4%kAwaTM!%l?fNk!NLca~>HVfM}>o53%DNOylo3%ypiyP{Et9H5aDex1wCJ7REFny8d?=^eF{aN>aM|l}37$i{F z^6C)9_#>T)>L+q^F8cYS&!GGRs8hLLv#_w9Rh~ttdX-!W+*6D7sQE`}J!q^&{Hr$&XS!814doZ|g^vN87z$N{H*RHT(<0aOSs+ zJ_q{cMf#@u9iy|*1ey9jT5kGz(0#L5&pH2ew0|PZ`4nHXFo&LKjmf!kE$F+{c$PEI zb6tnQccRK;Ah`33^_%nS!5mSW*q(FfnMCWXJI8y{!hl@QC>WGzQ_oSD)c#bNIwa_@&wUi_Dnq3O@ zGltirKI*3h$h9@YG#jknD>ndF>i3q@*}CQ4!X&JnQNH~fLASEl-f_COF&%aG7~SZr zpxd!D9hMB@_^5r!Zvx#v7xiq`{e(-&!mLiev$9mm!YmAxJv)1>9{q2C-wTTT=KQm@ zpXc0XnKf42s)xgGg6?)|6zi*uvkMrUh4xhFb>ciY{1)(!DYm!cb_u?-ljjuEzi$J7 zOA$ZkUuyNjKoq%Jz5X3^-zm~H{pm{AoFZ>q%Ng7P{O!f|SN(-*U#bx3BDFHk7lT_t zcb?gKZvU)9t+Fud8_HqU*^=;hZseH!D?bLGCl~A6b+?OLx)^3+rp(^tw}I}j#4O6c zW85Q#vanK!djne_s4nj51=o# zwv(UV_xM!ie_48G?V z^}g!&L3<}c)jvuVznX`hY}7z2l4Nuz=!AZqm#@ajj8~B#i-S^mD z-O82LWn_EcBFQgvvAxOP!FRXz?u+(jOSD)0f)_*ob2^*aB4wLj}}o>S2l-bjhx@lFyATV;M{rB+pN-`CamEJ`A*D|P$`N;s;ydhF=<}gG zUy8o+@O!5p$n&M>lShC)`nQhU5G%ibAJ3CVg8s(Xz8mPP)_)|=mnuJf)VNk+*OO@Y$H0ZxZmEwMMU!}iVzx+TvUy43`%)LLaJoet7C;x=!OSM0j=S#J3B+r+s z-|(Nof2rq#$Km->{3{haUy43?Jf6>!&>+8a=&#DJFVB~v&z}JLrP@D~=dUNG;Qu=M zt9GRSFQ6~%JFO1aEV_TNfx|42B-ap8k|cwF1^zc?w|M+dTfAXf7b?*nn&m~1GYivj zEweD~zhstIBRA9VjK=M=G4OX8+f2LgHZqL@w57WZMU79%l&>&zH&{8OZaPkHz-3i(uEJ+2xVo-fHq;Tt^n0Q#udypNabLU}wEzJ?OXr zOTlpYp}_r~KoM6LeL3Oj^drSdp9S1?rdPag+x1srA4~O6%db2i_``{q`J$d!Q^$Om zTyWuh2%ooN2R zKyV);5aUFiSlefsS(OEG26?p~{k8lBsL#iVc$^;Ev?RUOv+_dFm;8w?RzBMe*S`;( z`hO$AmGT2xwoYs{SOQsSX?(18UWop~=tZcHEYmFhr*<(p63@%}uFos-e5vu0%JT=3 zuvlL3jFdi?=S$J|<@td`%=8rfj^lM8&mT??`8jXj8~>p^e*`_`=kR2;{E<9=8a?Fa zSWxKm%28;4)YCe_te`C)v(%$;bsq2NmW-ogIJwBaf#%3BJj{oWVcr>$Jp zgPy5sRneUhU67=r$T1%d4v^ zukJP&0L3RSMmdW`yVCTB!LDSXc?yM;b$s=Y2EN3N6< zbLR{K^I{maoZ)hmv(xCg9Zkv0S*i6;R{+P(K-7;G@(HuhLc^z(??~{`pJ%>Zgf}Nm zE|p2}J|r{MBc~If_UrIv zD1X1A-OrUwmT86`T_AWXhvk|3+aAEODC3jY0sru_-kAK61gLsbc|GtKn%ub^A6)dg z552Y4Kf^ZycWaSvL)E6?G&Q*44_L;k$sZl(gExcz68@Fs#riof`k94!=v@}(;Teen z+W315=u7*k^YACLFt0;y9`kn=<|Q;-JXe#x6@0F;cK9pltJ=@x?RXyN2W({P^HiQc z+uDJRRqfxtJU^V6ay!vq?mxM^vXE~NG|{R2hnJwdM;Gxm_uq`4R(%`21GsC8xbb+B zE|95*+ghK&yFgcxTi3mv`DdYfN+4%P%Ne{I_|ru3<(%1OpQ&1J_P4nhC)08&9{}Cw zsnN0BRomyTQWjEN&yECNj${`)X+ zICVsN==cXMcOcJ8`35zUSIu1-dYerjDj#L?F}sL7CzWSkp8v?k7u&Td-&T1}!S&6; z)bXLWP4yzb9DL(E!R={?C$(B}=@r0TPD1DQFs@5S5@=1Qxa5<-T}z;d>$q3YYC6uR zL&4$H1IdTSY1ftZhtf}h-)Y1w;&k3UQOg|)uEej6WmNQ|(och*=4+|na~`Ydv1SJb zf_rmOFPeUD)r+P&Nb!rC2t7&o(SA;^M0tA^{la-Q=| z#m}h)ieHYUl^8x&?k?~-v|R3+luyHL3B5B_e*LR~kLN1U9~%)~u>Kti4!dS!{f33! ziKhRb2fuP&uhy?G&o%!cpu7(3{6y$%#6F?olWV{)#!pZ`$;X0y*&g$N27)i;KXx4! zYFX&Qtp(wfjidYvD5qp!x=uGRyNIG^fkd<2>Q}iIbQhx=tUX#>hkAKaoNtGMFWJkM zW!|+mvc1%KZFn8{f6DYx{7MAMv(R*3V-==vSQw{N6_sEAi=Z#3D0o4~O0+9q0Xs z5AQl`uxA`V+!Fh-|4s1wtIZ?a9}WLYZAZiZ@gDrH{=b9n0P`PZ{`nc)>WNS|LjGx; z*>(OJ{1EhU-NfZ~ZQav_+ab#`YhV5&(EZ8A1=F?McV#rR+^@+fYdQICz+YdKd)<9S z@OA$+v=k#n<(U2_=zd$ItNGWUeOajOq`ooyPk}$ID91T+)v=F9x|SQhe>?E)BEIJT zX8hgJp?9+KPkssf8RhyM20YEl^wD2+Y{%Q~Ocsm9b^E^qKec}{&c&W?Fu4r{_hVwl{J8(y z?zPM>)7*F+FN5EM?}64H&n~gHV|WLi$9AwCYsmbTDz5Se;9f+9a=B;+%yEpH=YsoA zxu2c~Eu#ZeAC#)r+-Kn=C2>5ae?mD2Sbe#Dbx8uv$O|WZf;SlF>HN>2EBiS+8NDO6 zS8%FVB4=48Z8BW)zu@;csvNhM)&v`j-k%jqjs>JlVFLbM{e<4?Ypz23k6A&cUhjO+4qraitQ%%2^zUlsp z)rPv|*bIP3Ty%Jaz2 z@li}IZ?FgGKUVCI`FQSgzL2MtKLGghekr1rNz#|+M;JdIza7Mtve1zYF#4u3hK_pp zolWYFL^KzHMUC3q^dZ21Zd^b8 z7SC}_7x#mc09<+BMY8@^E5D)OFw4_;W&7Qg`1dN6NBVH^n=Q(%>Awqk&;XkWy={sg zJ`(sFOdi~>y5FYw`WfSX!r%bl|6Ih^{LR4gAR3eR;6UKNO+O}7Z|2`|6CyWBKqY<3 zLp+bwe+=l}SoDWy)Z59zjDI6shb+t>hC&~0SET~_U(%1`j5&kL>7`t+Xw{+}Y|%%A1ZHGiht=5>SG$@E`I_PAfl7+V4bD5n?Q@zQb2tFl$y5kT)n6mai3Aj7VALe-HE6(!|LdRzG{n`g` zC6lo{@n?W;u2|0+?j6cP&3{noYZ}RnUo^y1+o6tx)_d?w@a0Q%SYF&8Et#J-SiKJg z?$n|_R{b-y*l6HMOVrK{o&~xcrFz>crl#{k&2Lgx@i(`bwI|w#%5%VPpAtVmG-A3& z#M+lW5BR&Oaoj%EhnCDxQ>r)V^MPAsc7)d{Tl}4>{98^YyQ%URya4!Pi}GmOyw#SO zZwr+g{jcOjpo{Yi*QX=nWwZ9nNN}b2W7B_VS?H~a{Dwz?U&#;Zs2`;KDk*UBz5ur0 z9m!ir)t~MQ?(e9!?z7e{{#aM-l8qGE;M8*Z8OnL3(X&3akvFnn@~cb$cZcD)K25vd zrHOqvomaGD)^}%D>xk& zlUi;rxZ7?1V|#q@qW}CJwEv`bEN_6{dy4xKEB#R#En2B@-<57CVq58FwY4kVk3+8= z?O5^>@cSq=g4@e_Su;PUwvmdDdL#G~2+VkvPg~~qNtJu01HO9}^`L8qbh^g{I@+M) zBRw1V{fqdP*pDow^t5m1|#~zkwd|b8cT-)XV&>$~oY3 z3xOi8BkNehCG)_Q;?VOrrxN$K)BC__yZeGG&DZmqr!w!bAJ2zL#^&MlT-2kKA3TpJ zR2Js3v5x+KD)rV#Boh;@(aQ5zS=hwT*>cmtKYBw zcKRCdE6v|y`wcoj#*GB~1wyqw267E-++GB}*A>TMQ|}|lLUTJwOa0c-Yk{wo@J`(+ z$)lik$R|bKO}9E|BB_pp{Pp0oUM?z?dEj?F|Hb{7Y$E)w*9)3PXZ!x7Flccu6zji(*D%E_y?J$CuCuMhW3F~ ze?~%Al3z#j-8$}+K*mh*gAb#elHKpvbz~j)M$$Kx=kO!IKg{MyZg1{asY%NH`y4l& zKk8?UJ^{Kzihe*do*!wtOIXpe(A*eoU90u1d=m7(Vy+4W!JuyFzcf z&ga8jC@=c$j<1l?_U50%^WRu~q#yKvIn`rFjJM@i10U_Udo_`&+>_7adCTN3{4}oE zQA5^o-O!uWdi1XW-7|}H?RYM{eJts%j?>{6fInzl9{wRt?`u}R$q=}ksFG37nwnqU zbf@z8(fW@B|F~j3;^l8z{g%6dMupNPUqU(O+c@HN=9K>n^fL=neznt8`dGi-0J>7U z>+V<5uXXqrqoLl4-&aFKGSxUj@E&AKR>~X0tG>86di6(#pj%$HhwF6SpLSmfaeY&{8TgW&YuXhI%@r&J_1{N=zkW}Y%XvYQVVn4gS=gom z-{xNo&nOGq?AEJowhO)uvoXBYvH9$~sLxZtUe^m<1li*}mD~ax{uSJqAEa{31-Euw z?v_o~Ron(6EJ!THo;Jvwrao#m6Jw*q%iN&n=WS{7Q!{ItAPab&fA{U3n- zm1TP5YtZe5lFp1EE5_Eql_E*z? zNSlJdv*CXOe6uLOIbVSoBrIb1E;*!SS4~uL7KfuA{SE+P=ZxfG^qGS@$uvXKR#i|NnqfdCEGztFsto+mH{c`jOlP zd|db7{JQaz=ey+-jQQr2FQj%S{X6)*yV!5-c<)Zz(lF$Xl<^q0E&}71HnX?!FuEK3 z|HxWS_Jrl#6***juS^!Y8eizHAB*3QgtUoUCb*;huRU_o9qF)tBdVzYq~*O7O0sPT&nL- z=u3V`*KP^zYW^*0M$E$+?ul|s@!F2vi$V7q9UsSQWiQ})6EOBm%e_&=DS23`&&dOU ze>;I0&+}|Y)*BZ89|-P;1Y#WbR~y>|S!hdOT&7o(cmF})|Lme3HvFwRz8b1)je6*9 zQvDr17<8AJePDm%+C`^{FxM`sVqLqayGvQ&SEs?uYZp6Y%jsj|=^^0%>7xF%{8p_O z3F=J4rw;|bbdS!gA1Hoyn$EE+Bz<{2RR8yXSyBm=B3b6$DtkzFQzv^8f=V9v{ zfrr(ywxG6nDoyye*Cu5Iz{{Y2OO+)chPIajX4{1W&79JX5O)@$I6xWI(RfvS^FA z!UW>_`sC?i?JrO~P+(Q3?Ay!=>F1mN{-rnDx33KzU+?-lmRIuHA@KIGVV|e;+d3B* zLGwY-&rJ?HcZ+{IIQoi9aJ4S(rQAYWY+v?@O=jll3H$H1pQRZx%;E{9v0Nan91?wPryVTtmNhk|^I$=~YarBlLseWjyJUi$n@=7Fn5 zT!G2gIPytPZni7ya532TFz+G#9j^ktUQoC&%eoS*fLpg3^QiH}9HF%Pdbyv>Os`y- zuJ=7hT!jYP5t@=q7s=n?+}(X))_?N?R`eJOb11iyorCe%mQ9?0yOjdVcJV@}JH%2d z>cr?zxy$hPgP#rmYORs4DIMF9yvoyC;J`SkP--&qVkL|-@0u302*zksW+D{%b_yPJ zh9aOwKGc&KOW=cK+fXSJy7P_Z?0AL^YszM1x_mTSO;@s#2Q41Ae|HD89-eh2<0e0~ zcU0S=?*Uw4eaT9`)Pw%W&d;L1?#&FVypnryKYn$JY19A zaz;MzIP5uU4_`N*Io=`J3vb|Mpzd;P!Ns$W2Ay5l)YdslVHzjF9BAbSlAb;Le51*Z zjFkf(;R00?cQ~%2XMDbC^B*{_|Cc>3V9K?4_)62xcNp{V_ZfemkLikh4qPuUK63h>|vgI1jIqn>mST-7;MSk*uZ8O7FZYi$}o;KkJxjfCnRF@seR31hS8v^jm9p01ToCnH+cCm`eWm4ye^z>*M@ex&_E!g+k#4yN zr2}@mq6tpBP{TJIL>PHOU8~`O{y}&*Fx`E{2lk(KS`86u4$4~8qnDKD08#wiHMiKv z+RN4+;b}8RLtTl=pSbd5~S@{fncs0FaL$;-VeG8rM_o254`+K*FqW< zW}8i{!yWg|g!eB6;L9Vb!_JH8RLpRg7+=n^LpDm9^w)r1pW_1S*jl4K`{6pn7pq6! zRaCKR_^KJOo4{hG6{5td<&eGp3X>JbzXs{rPm9Agts-K3YK_Hfp%6|@mn2OdncVYZ zD}=9JE8O(iyFKcOJkaP9o*vZIwth|kRg@z0mbPmpxGXyc(I;r*t+kh^Rcbxg2wbKM zYJcM&X_Gm#)3*6d$@+h*jboDR!ydf;81BESeK!10(RKE=GLrNF3HEmtiW)~{yD0fj#921zR(Q`~;dw5j=)H|_yoA{2_0&>EU3fJgTF zuY0O8*9lylC}oF&(VJE`h=Yx&W1y(&hMlcnI(!-nTAZSAd?c!xWFNhN;yu6)B`ddC zQMrh*qIBdcte@#Yub?(|F*Dy6fw83GlR(0=vHMk2J!(L{E$9vVFH;$&>7JPwQn?en zd>1hBQz_C+0wqt*YpXm9e&3OMjGnrBS6tke3}( z2tzKHDD=b!eLO^#rgul5433U!))XAY$Jm-SMe5n08P|z&t1tg#!*$>) zCXO*R;gXaK(vBf&&U*L82g=_APQXCsLUX=|V?FWq`UVfTRGY;Z*syP(*a^UA^Xh&l z6+T)b_95I31KAh&%l{6a!TsB6SEUKAE7n5I|7f%RQ*h~kC(Dk8!VgtWmP`9|ZlO=o zKCyq2Y-KXIwm2_stFxs=c*8<>@?G*vMkUN(#tje<@KaMNUs}kDxxlzRS|it)ygBdy zo@a9)C(69G+qTHxf4?unjcX)2ncp5dG&Vn+3TiAZZ*4Kp1^K-` zsM$WDH#Tw|UfIpMU=N00htDwYXUsobUk=M`S@g7(Zt}UTA+GJx>a(qv>aUbeZ!27| z2~@H*s`44^Fl;Rhcryt(7@XjXFlz_>t~bg*FqTTd6+;`E%kS54T4I9=PU3wOp?7*q zTU)GHt$Txj?f>QH6>|RdGATiFkDso(603HhNDS+@0qepC3LU(5)6pDvWQ{*0y5rtK zL@NpxXQDUsyHE);q`Njt=JI#?=I;=T{m$CyCK(0W1j(YD;6yZ1BM-;Gmq+`t&Kz2q z#yYf-+*G(71(yKlkxBa0DS4!mP-@`U zwpdI89caRD<)NxIcD7g}vf!4H3`Ig)Y_QSZ^U>JLP_-QdDByLKmq3SK6_CYQHtAGS zs)}|^{_d&#G^hXkivt4tPi9asqz>k5ZoI^;N{lxkcK{K=WG5Ogp!ZxbP?0 z;KXwVBG;!oOW%$>vb6RB(02t&agpM3lRX;AL)vGX{iSnJWpv~L4S zSvck7k4%rKxxROq(N|=#i?Yy%3o=YWZP#g6Wck&Cqy$@+P>QSLJbwSK2Q>P zJ3bR=gIIB$G{h?2UEZZ}_}Mw>zYYT4JoaZv_3x+JWoMDi{!*L#H3wu?cl}o_v5&4p zx^U{0I^})T$p|K3o^Wtfv%iwtLchX( zre)k9+^PU1CqK&(ve`U=3{1dV9D*Wth?nhb_abgc`J6vU8hF`!k%AQ2wIV|n*#3Y) zQJFi1_&+mT4qBxuav_%{;*64xR^PJ6T}^%+MdP%EGnfj&@t?0hcY3+~wkK{>xcqAW zOhFDh+uj$3_T2BkEo+I9>#A4{Xk{rX|>p91U<~P-UluJJf)meW` zKvuNziSnNW(bhdm=jO1F&`1) zWMzEO>uU2~K&69#7^Ex{VHV}kpQnCP;q|%1QZJ)MMga!Py0Gv0$iDsGcv=@|!FXyS zX`4H)A0z!q5oFU@bq%>@rXM1v@CJE>Ji8WW^F z;g{7*Ga0$n#aThSNoGAlyfyURS2e59d*M!5OydlYv*3YN$v2Q63vt@d63n*jPTU&2 zy2>qr9=UZkC+Ug;+t^&8%Eg8oHBQAQt%{lF{G&7@Y%~QpP-6Iu-J>F%>XB3}?_wsh zq(|vXYWpQ_@RsV?*5Hw=TP7g#ht{)ipM-~M4Nwiuz3O-PDwC~074w=yGKTp!#JU_@ zw$9{{U#~1(4_%B}a=ncO)SpVcIG^>%CO>&=sWD!6J@KCI5EdqCv~X-VLbInUbxVz+EuYl^ms-GC!aiE@z@b8QEp3jUFF9_wez zIee8WM^HoZ*&Gq44D`%#~ot#sJx z%Hg;{t*Ed6?E6DQDyRLfHj~fP|E^KQ&QJstkD#`WbG`tsM%G(H+R)YE*SrI^0KEam zHO~JG!|v94<@*sD*U} zI>j#~H}?RIb;%0ay?Z!PqWg(CBf;}bm%QSvS+S@hk3tD|T3QUFfU%pER;kCUSa!b1c{-E2R?dAAX&pJi(6`#(Q&>|bcbZa^>pDQiJFIGCQi z_sY4@y$ zzh6m3z99cimhOKce4|-XFHkb3 zUHtjEs?_U7$J>r$xnK|8>V`%lkR&LlOIi9&Fg%$YSSXY@YhR$<%+cA6*hP4Vqd>Q_shl(oX3dHK*1{A4gb$PMwUYFRV402BCG z66d3XReDRE)~FjOg0FV$TP+Y_%c&JzN}b6GtJ6O^G?WFi_!WDtn)4Jsv)3k-Oo99` zzF9q)5hGhB-qlQ`sk~xPw)6n+AkZp3ikaHw=qlEYb)e_e&n>u-ik8{pU$L`P zgfT#{kUD9)rQrKfcQhCgvUh&6CSBdm4>>A(d0MGOs=3di)DPv?)|RUGf|-6&u~+TF zj1S^vh(Qbb2(0+PL7`K-KJcP2!9*4A4^HY7YE4BfO)-nAd0tH^mWLZ4BNcl`tn*At zBM2qH@z^Dq7`8I8nBLOcq`KH&5cIfm=6|FR33NT{`2on~44^bSCh*s;vP4AnO3h%n zFf($6eN>crwHiMEZ_dR7cgK6xZ#?u|nYIap?*nDPtQ+ZX|4nY+U!>Jy(%1v{gh*Jk zPhsUspr$4HZ@VtYJgZ@#o|wvbfrHd{DZ}@m&iPf^Q$-AyE`XK1ixmBuxgw|QH_SV= z()lV3JwXg4%JsKI|C6L%1M*epqtXhZeHxUf&AgTMeji#Uxv5tz>US$B4OiGQ0;l2? z&eiGIA5`yoq{AQhfGx35i~oUnkb?_M5y}Onmu<6|%^zonScJE7vs+1RrYq>#Ux)Ws z(QI9!imqe3+0Kq=G7o4@$c;`|Z=YVebgf|{*Y*8b1Ex6R%&N{ruK+`pt?;)%{*6bP zE^?Rcg28q;=m@Uib-o)N@n*(y$fJf=G@5eC8{<@3~xy}hOLD*gp-h5=83tdD^w0T}N#19#@EC|E{s z@lfbqTixiiuy;;rS?H5pjDuF+SOb(sG4RzJaq|y*Tisv}8Dv^CKoX*ww^t3cbGJ{l zeuDIe&IAB4FCCfbI!Bsg&(q8BdNoBDiR+^pU{0%ntlUy0JtqE$Lk(7X4)kpifR_)H zUOMA(@|vUCBlOy}uLb)7b?O5$9WF?$-hT(1&8ql$BtF}|R6P(~68cLrEauKBgQiUn zXNPo<+;rP(daW9Jz_}nOVVO_pXy>hJ?WR%_@^~994I$+j{k+AT*nY7S=>ZpVvwqOgSzhWwgc#|WaFte{&?+-FZ@z_gmv8RZ$vf_T;mLDPyo)tppydn7 zN$h(>`pByemyV7R$7z&SOnlV>JA8`VgkyZi}-7BG2m+F&*V-2Gqe}u8r#tMV>u#;NPS8c2X8QOnFUWHFNoB~=h zg{#Qk*NDX$e|E?*)vfSmOK)4BKVzlgbEn5kE&zVEBoyWG}- z$ur-ciCIWiui7WRP@wcTn1zJp%;g_EPU_wthZ+ckGP}!tfG-!Bza;r{=8l%3R@l7< z4`rL_vg&r66()F0XKjrl714=#y#H*;h{&4G{i$}<<_DwJHg&f)6Ig{u# z_vA-z{e?&6SwBtk9jqj31lYmrx}!ch&u()&?4iGuK9n)p3%{L6_3Yzjhd(`=r~V?j zwnqKBOLzbGF_!BG$)$W>v6I#51Q+s#N87l<4Kl822OHu)jA)FV^xrwB75B~87|9K< z?T^@}?`*&PDa{{r$k@MhmezR>XRQG7Kf9iMGgMJ2$l>F%FDgbQc+wv9`mNF;VCE3g zbIvgf`k2p^o+i8gc;8U;(J9Bhb6^tNdgm<4#_>Svcy$9%1DpIn_iL~mN+o{JafyGv zw)$speHHLnq+DX`;&SPgZpk|X1+-dO*XMHsCV_`Pes;Y@Gv-8n8aKDFyA zi=7eA>Vi7mw`*AkG$jamCeE_EFRusg^M5Dij{BsOBjoVNA?^DohL#d|MEA{~qvyT4 z8sF1cPl@paQRkM%g{k(1Te>@_QyO+S9?YCCx?@qFgYh>{t%g{DumS_6y1f)Z`=jBS zc@gA)QXXWPYn<|Xj-7V^vEYsKdHVjcIK8K?&7~klIOm0-(d$N!jfyUWkp5nuh2yY8+VWjpDp>cb;29)%8m)yH9|4D%Cn>buZE!w6 zF|`7Pe~x2nhI3OK?kBDu*5!IWK37zBFpNG9-pETRq4RB-i+r(Qu&z#xjAe8F*@;Ep z=F#VM^t7vRRd0vlA1&dT;)`FR+<^9zMG-HlT!UWBLlI&KGwMD65USm*ZV6~uGiyUY zoCIZXpfthfDxpH0x8aY@vfpPf(t{3|5~tGpY16LW)GO+=(XJzLgq`EdW+EDtyvUBs z$ML;a=TcUlj%E$Z_%9?!>q)8Vq;X+n*(7GZTn}nB#{;ZR;sxy)w$k(x6_3TO0eQpI^rW9xwB)1{<)AQY#V!ncJX>rJ#|532+<$dYWSLAbb$`bhp{X zWOpMrqEuIw_FggzdEDiT#w(o6u}Jo%2y2ICJh@!Mf0=eH-@ zGJ|1lSRHcc#wYDzzfjzwB+m1c?gH`KRy4^mA1Ls~t)mNsD%TTQ4M_<5o-^-tV|zYz z>;}Km6mmrvL%&oZimcdDFJEw?{O#E=sg4*IQsQF{G32J=H|BjSukd?*&B%sl{ZFJf zB+JB{9CfhBAqOeU#ZLz+(Bg)B+CepcUuqrpY(kAB3sIPSJ&}PsgeV!FMoNN zQUR7lasmFpY5}!sog=;#ZNb}}??`=JY<^_qwzG(c>9j@d*vKaT&IfF>#br}m^#2ST zG@Pz(?XTQU2fMwc{BD%q`Zpe&eIFFi2$aoI8h0SXQIP57;qp9pjxQy4Nd|%=*PHH_1-e~u- z4O}c~MAP7RTZ);l2l>WALT@yeiuU0uS6+^X6oIxL7ONBgSYUe(<5SuCnz16dv@eM6 z@2$A73--<@G;NYe1dQL?MD_J#hhr|efqA411-$Tj%+2t0J%<=-hwU3fxz50{)ulg@ z4`e!LQsOys3qq0Z9iVlShyDEBxRyoY2KNrY9*=pUgvk_VPHc(rY{e4dyazI7z1Wka0P z%#|w7js_1mI$fISG4d)UEjz0Vsy6jgQ!rsCPH?Q`@VA0T1KTf8&;)ses;+7J>8=F$ zlu!cIH-CVARS#8oi@8-WRRDK$mI4`E;CLOJ%aVL-3?(5ELEZXY&PlsMb`)ADcsg_ z7H=NV>)BU{GP&9A^q-kN$KEZcmL3t^$9;u~dZUX&IhNzz%BDXw2I}>7imJ3*JguUe z3#voK(X_8_L6IM@mACZp_$NyG18fDefoYrX90gs-t3_)bO0m1UyY`J#TBM#r zILr>39=C?mmA}nz`su9}u4bvHc!Hd2JMEei!}C6un}{xBzVboqW5w0L9=;bPBYm?5 z;-6_+<(&X;zgA zIW%OhgO;A67Kj>J_r}ck95yl{Z0tRfu7_lVvA8g7G(T&4!B&?oB-HGwL)& z`aD&Afxv5qd(_m!0<<5ez@^tx;1kgFT?^S#R!Ub#wX0BR$11^WUQV_Y8kYq~=*gB9 z&Ih85;n_`LHZGNJsn8HRRj?p!oZhomh)~5E~WtKW%6ov zlWGHgyN~wmL*Daj?Su0S!&XAEB#zn1K79RU-o$Q7^-=aya6?&$mI)cUbEGow75i`| za%bea;bFyf#-f&z$!J*i8$>-PeMepGR;01vqltexolL#3OZ=CXg47p|X?>1K8?`kZ ziVxJ!6CGA)QJaRi*X-dj7NJ6hGlXL1=u|UG;@e1XXS2Yq!1W^RCCw9zVVTXKDa3J@ zdrc#Prb*moDkLFOIXII_o(HFoRo-If`^3Nt^e8m~gR+{eaMR7Ysla!;?k3*5&rqaf zqxi3G&Mynj%5A>$_>A`*VD%wz3BZ<1iq+(H!)B?muR@)hkvn z@fK%0rfP|AH$5+nTQ9uurpmdXRpFCE&Hg0OpZI|~EumidQ_lPIv=W5Fbr^fKkV8>P zdKFJH4_`fn!7@b?Y98zSDT5bMzMcq|L1BjOmF!}a%9!oljo7HBRJkd2OT0r*Xl7Jp)*f9J#; zJN3L}__$nBlo!7+xU?C`_nJ0gOw? zq=($r1yPtT6~TKZqDxDBrpGk9vbIA8p-(ABf`!+vye=sIjNCPl$CrhLeHCv~*p6~4 zXbePNewMxXl%6A>4})BPS=;^>;<4^&EFiYnFkO&*NWQb4sYNKp!ml<{`Od1%f|9oW zSK1bf!$68O-Kh)UmSEZV`OPc@D)NN(>)21M%?Gx3z#Z#w0lR$7hjcg6<59e)e`T^2 z+wVpF6T7?SCOy)kTmZt|7n%*XMygkDzOwSlm^tFms;)o0`udVRtU1zQv}E zj&xCv;2c*Vhch5kevW))uwE`uk>4(7L4xgTypA8;qd^Qpiv6Zk4_V~T8I{>_fKFb@ zxZeE*)mTaQ8+uSVVslRtDFN^P3mg5PiyZ7ma3gYDNTK1?z2p!?HHGAfK`r${MMMJk z4$pU3CEc#qXeg&C2Wu0Hb<$%NFHVmtFKWbW=Z+sJ9bLpf6C7+&gjAK1v^0#r8=FWb zGlL?%%7P1*V4GLY1%>y#!i8GSwP!jOj(zy(IM|I>z*;09hgBj-!Q6 zPzfwJ^cp37Cu};{`?iQoq}#wfTcP(26;7H&bInuLT&Qu)D4iwsthV!)I$dPg5=6vN z@gd=@R-|{ar^7d2HE+4NJ-iK!fBatI5>$#JDzZ8s*sLqZ@5$K;_-7A`4t7g;_7VB> zl~y+bZzajpST*USkZdqU`$iK>*T;Vy$sI)w8W(k!;ASFVGIZyIvkP9hPA}&W=T*9; zfj%*Di(3jVSsD?pm8==Kx?W4kKN|s26H#CHHS_VJXI_Qwz~O ztn7U?QsidQF7qUD%(R|a$8gE5+1rYsNA0c#(AGX}{wFTIJo-&yU;J*+$FW+lJFEMf zkZE5}a2KY66V^snSlQ4WFz)j|lPr%v*?DA-zXv?RFZ z@ty!tZc%PDBOn+5^N^PuQhsiRAD>D6xu-Us-Cfhbdh-xg^p8^-;|HI7Lj2(XK|v%F zA{HZ%HOQRxeoy<1$b|DZLxkV^fKjcL>h(|15C55^Inq2aS<4msqffjiZVT1sN#G6F z3Gxzn)*q|kA7i8?jqhqlSIh8RB%sifvmCGTDU>I4?6$y6qm9`Oo|@eHz+{v;`Wvh$pom#vm9PVp(os4TxA24|<$=QXx^Q|HtyFj4+xU#=$b3Zr4G%T-g@->eq+T zagH*uHP}oyIX+-l*LUmtu6&H~fhJRTT~V>R0zS51GaYcC6sqw)ZMVktIusaj`^c1O z5{pYOG?^n`The-}`88;nS`+76K?{0YFsJ>KEkHq^-&JKnyIfwr<_=MCkDX|Hn@r7h zMZFVsw4Xyq#M8|a=9j$}0`9I_Q~A8j0e^=ZeT1Hg%suDRT11bAK(6{1hyN+5Up&`R zmLRxZCflbV{QQ)XO}&F$f>M%K3-Pz5-GEGyL{yC&?E@1{_m|{T;9R{5(X5C zelw+1hzQVe)0LwiVWV90=7uu2rA;U7m7ub8F3^{e)=;RC=oZV^?8aWtwObRr{K_lw zJH3xjDh%z);s#(C6x>|UN*nMrsPDEqW09U|0G-(VNT z-9--jdg@Qsu0nR~IiaX{jc!$a z5532hZdQ8`&gAQ^H7c8GhMuC>zr<$Y76}L(yoj4Z$Bk78r>wagi0MfA|JEv{eV3R& zOSp-u-Q&UBV&6D2lS-W$c00wRZbkAd>FD6q-T~g@b>qVsJTus9X<+sXn=b)H>7K)I z6J}LQ0M>^*VDUB?rhqI`oF!O)oA3xqY6?u|sqyi3Gt(zQO*!Uo7Tw4Ohns=UCC;ux zl0U1uj@;6PUR*b#CMfK>h@MkFn^S$|tKOboy1Q2p;0o}u!nFw&_}JM+nzrk|QgGP!+xu}7r0@lYjN_>GYsyZl3CLl2aW z(gFgRV#wYbHA*zwGaglF1T19X>I94e^9IL4PpyRf=~K!@>78R35rE|bMwHi8og8Qn ztJ$xe`)mPYjRD!9)Rdz~uE$mAh&Kl>r5_;wefJ0}Ts{`rmSWq3FQWf-xn}=r^-!oS z2zGlok9(ne+~;WE>)uFT)wG=WvenWN-cF~WVqHhF*753gV8L)ukmCmQ$Ot$3sYHhT zkNauv2~j{m^HaJ<-ALAMZ8?6d(@K!9vmseS+D%z?t~v#?Q(?Dp1_RPE)WNSpOPt~U z9D;fBjRAG?p;TQ?=B4ZCl?PpDkgjhx-gZUXksNGWdhD#ObcS!YsLlDq@e~ZU@>> z4Y@&aQO}rWlR^d1rq&EZ^${uS>$hNC$i7#fR2Mivx6WpZuT+5E37B%{G1%Uc(0ovJ zB~LX;uT>Lev8CDfNOF!fCX2!9?)^b3^jF+g!c}k($o=(>;~szDVD1IGo`ZnuSjmmh zEu=zG#u+_Xw7>59<3qVl=~G)`+8jw6!|Py-`H^;&Q18}pOuP&A8pdB!QNn0wRj}Bp zD!~1vn!VDg_SIQmhI(%kz#ZSV7VA$);=9&)Fh*3nfFRW%MtZe}p>0I`mTObZM4-b# z!}SlQ^uBL$D$vx$t6yRI&KJWA9ey)sGAPzf^I-u!Xi$q#Gz=&X-v)WrQ&_j}w_7F^ zr9D|{z1+EhXiX6R6n%Yq*V=VlV9v%gRAv1nZu$Dp$_d^r`4DGEU&K+pPF(WVR3p8% z&E-4BDmgY1J!FqcuW;V&?v}xb?{_`7_Z{&D&m{4v+me*Fd=RBO(=kgeHZVQ@PGzNZ zYEw_r-|)}dJk?)uB9Lbx2fRU9)Z)q-TgKx=Q_q6zyGb+OP|dA``eJx0AeDp?-RsmxcEO{AOrd?5}ua`FC&91$+K93wyrQ^Ec+QD zX@YG3IO&$)-%4cj=$-Y)xV_$;f8$V>mgTV zbbK<*zk%Rwje7rnEU`3~utRw}8-ox(6B$9SM z+I({2ix+Ss8b`XP3JrKZ1Pm7w@2jPwQvJH5=QOJgP12^_n=VNONh=^r4IscS)3j-i zU_}ZP`L|lD#Af|nq`dg7(-XZc+C{@S_CT0 zxx3CRi#_eCexP05<}tQB*S2lnZWmui8TwJ(<7sdX)t@^|y5OTuE9p1IhA&T06qc9O z*?G^&@7u``$4Ou5fnR5x4ZrFi{%57WR)fFD_vV?<9Xtr8ywYL0)Vlot0IG$wF{r!H zDuXGD1%+@ASanPt5R) z@B03VhuFpM){{DJAg}g)>6!o4{wgz$I=^wmf3-P=#^0g?e`BsFpc>?F`eNdf9!iKY zxfHiFqJ2x7#ve(y`A`E#*M0vOy=0lnU_YntYZ%4JLL^L8%zXd?qQ4Xt4Hn3}ePe&> z+R8V)zU-8I^D2+OEK^=l5x@5ote92kN*HoE$GhOo%cCr5o?>ojZu=(eRzR?yW83O{<#NGpid_*r&(-j7P-b`>;R^a1ZwXG;WN@r!qTQs1Rk;F(Y&4Zz}k6l zt?#G7-U8lBT5ouFb@`UPl!x2M=o6?%o~?G2YlLH{l5l6eVKLlH5mDyT(hA^GbDU2e zYE&h&eg~`@BD8Y0BP}!r9%~C(OYozMk%Ue>)^;nBeiMk#>JSaj9+2}DNeDaJm@3Za z(~j9}d6iQ-vsbez78q}qjoN2-zM;KI3^6`!P^fbJ0gu z-M;-?sJA3#$z7A}#>J{_w3&R(FP4{$LRI00p5 z(1v11`AYzf8JQ%JOo2xZDjgr-YVV}NFYKuoC&!MaT_U|Xt_!%Qba8#$!Keh)s8^#f zSD_nN`|-;I-&0w%0X<*J-kN}af6a?la^C){TM8bzp|JiwL4?EYcX>huqWbICCN%%t z|BrR|Dd7A>_8jmpJecZOqTVC$=o9NmMf+Ej_o);gWyjXa!C;0HfgzJo|3V^GS7_x& zWqOfQE5l(rdygHrk+{mx7?`z83O=s;k{0E8sVwKY`9qf2L^jQ5m~@?bvP8XD>GM*0 z=c~}P@NR({a0?pePO*C3Y zi!mc@zZ%27G|pmXB#g|Kz9lcKH(ZsE!4!AKn{g9R+(KJJw-thVn(2RsO;&%zJlVW< zqdT^=zzR33JVCWdUz*P#J>s@o`SVE;W~gGi{Mk83sKhBJh)_0oz5L9?qTzuYbqx`* z&B^P8+*4|}D3uD){rX8L|);0(z$gBiSQO+-J1psWwu9u3J0zB`7(3_o&z zz4{d3Xs}}B{<=p)T~1t%{2)2d<)3`|m)ZSa#>EF>;ex)JVQRDSAj(oPO<*;_Z#VOJ zA9*bY@U&keSm^H|Zxa4+K#7I=J<~IC6)Z|O=~J@3QvE_AKqU*Jec!`1Ckf+_QnPQ7 zA3h(7&QDA`HHM7a9j|$ge)hsi;xBvQc&CX*E!inye|ubkqL%RK8R?<*oyHff4^0N8 zPWrtyPLX3>-ivBz%6nNuX3q2XwotUYc6E>G_C4z4f#tEC)!&&dwUg2??4!7O@vq^^ z6C=2zUHJ%qFnBEK+~8vDtYWcWsCBp)^&uM@>Z09JZ)oZ9tH(i82UzRklu%?8!F>?7 zdri$w^Zj~Kny&fW6^bl{ACMU&7P`DdH@<*dgE#Q~;Twjfs0vm{dpab6>ka#=;(SbC z+TAn%WtoX;I+h^Z_>HJf;2-@uEx!!TUBnv>*m`TBByJGAdaM%sm=dcGzFmopM+s_j zl*&?0328nVr`jE(2t0*9E$$e!?Y``Ou!9l*Z8(7bYwGc9H6bjbDkp+wyZoovAw5Cc zhR!?XryZ_zln(+ObVcjMKD_akgxW;^2dor+rgTpw<#%%$G;QOH(2zyd`VGlv!{5{1 zP8uF4VC)uZm0JPviyyX<`;ig*3}EIxu)77YBGqR}XZB^-_aybzpst#JuPb;9PX0rp zRv2$H|GVps{+;^$l2rsx-OpRTP9!s)+l+mlQ}kB`&0V7(B@Wv^ppCx@vado!`lO{y=~W0hxkx4l z@}qax(+*#r_?Q7FULgh@KHSV2+`e7f?3CD?<1@|~f^xgt&V-tgAf5>!B0fScpx*iT z|9!Mt8k$P+ZC$!?K^ot^SM@?-t{Mg6yfb-&7ezxuw0mA=!6ebAGg~pyB~WV#BEw_<7{d)vESpZaysx2i)z;Wh(<&|a@i+9 zq`dUFkYBIvZ;?n!cRgsGcY-<_+x1ufT?Esw-`}Gi37FvTe_*@v5XP&SlbgBn{Bulm z+@Kh8M&**`acOe`xP>Lo_|mJ~ul{-gHkd#eqtsroHx=80es)i6UVgShzrgu0C0q`i z`vuaY0RpV!w#|wIN!v3R++2!J`_Xh?%LLmg;AxbH0nLLUP7M1-8~TXqj-`z${qkAU zhsLc$BoobGvHo5QQ4-HVIfc#PiOs%=%@}g*2&gylozGGSJL%v;?MWfe0IZ!4A7w!2 z2UZZFDpctxhQp&mbk!oCt=>dcS9Ec%R35 zjfJG`A(A^KW{E1YEHeq2luDSX z-v_2^heR}q75;;8ZT`gSeOu+HO5M6|gASiu$(ItL}b`!GD3TAs3MkS0UH`@cOtXEyT6gZ39yr0lwFn?>BrlryX{asE>C@ z;GP?}8~V@dl4C^S!9{?;$`uk+^kPlThGFTzy}d6mlK-z2(;+oz7~P|-0woQ~1;8e-c zz{jia0o)e|cZ3n5R(_Kt)8)U)Y08p?-@@Nn?L-7dv6@3V zbZ&W#^>LEe7CvpLQ(2WaM_dRiec1siw7{`T=xP`}h4YT$GT!?S80q>rwrJUZ z{8GE9Zh%{;Y^Fxk7A%d5t0NyPT zW&VL>`1Xz*U7S6?&SW?*opMLX3MQtR6fG~~q*Bq#vakd{vcM=oQ|iEAjIa`d0sXya z!SqJqJQB~=SQ4iSc7qNt5~=$_{p{f^H4GLjn25?h>Y&21k<;l%yac;;;gpWR0q|$s zdem%vteHm_pOVfk)`WfZV`!!T1r>Z=mcoDt4Y8H%qfhFEm~$^xJn80B^6CoXT&O!i zu=;(8_mN(>rS0Bwr1dGJ(Asii zSwchNxC<_Zamld~qLiB zXc7F##A0XF&WOmHcZ?nIQT3c?_zx1woO)W?a$R!*Q0>2c;hp`>-2db0yTg+FzpzU) zD^n}Wk%QD6`_y}c@6pUmN;Qsz9-HDfuZJ&X-lcG6UqkZgiQTn$ z_orH%2>%~QRT5qsSGrl+OsR8;&V7H_S^2?AxE?f6_Zc|fY*oXuOVm@VuT&D`Bv{*3 z{f5f)+CJ2I4VR#(twTDA`Ck?^s6Xj9w^Kb0sZ47f1ES>dGx>Jag=iP zH`_lSf2ySK|5i=Hmw%9{MvbeM_CDw}6U?;rE7b{QoAnAOv3O%Rcl>R3!q8boP4@ls z6XYCUMaF~R_7AeF4_rISUW*KWN?6F6;(Ob7N$WxBV4Ky(Ma4Vp)CS=rO3;O+RAu_Q zjphI+DH3PVTlPGsk8qs-(G-eT3YFLC=JZd(Z4>3vqwfx%K}D>a`PrBv+e&4$blx-n zt;CV90kDY%`^KMkHp`|tCt44FzDxjrX57Dmn{N)eKKcvTR2LWWl=AT)iL1I*0p)&dvf)Q^Evq3FooV16O*dZSVc_4#!fe*B|!rR^@BabhSSvVt%FQ*^s+7!}aR&z% zfl?FEA2&;6ZTZZPIdL@F+dS?9{JpjA3oxy>j;z-MBc_)IZ#2C1%@Ylosh7mZd3;TL zai*1(L0nyvaP#3Gki;`@Uy93=N;vnWAhKdB^Z7XkMcVdJS^%|RLWH=v)nM$*iSVxG{We^qx>ot1$J)`TCRjU|vn z0ri-7_B3F`0QlAj3A*U>Y-OcN&~W5lOJa;pgEiE6KQsw zL-+c-{)^CdWQVj^5<8=yxh9`K&f^*9M^n6WK|8VCcBB3Uwa8OC&BB%W2nJW&MbJ(3 zuA7pV_n}%g`1h0SLD&Sy9}aM{+fP6U(|F}W=FVJL$pT-gGum@7>TpFiWp+mjm&M`< zbB#pm?!K$1-Oaihm8ZP0&GhM%-M?(w`*pH3TKB!~B2n(iePGv$u^?IAPU|->XF&>h zgeWYZycV$Yca_Xv%e;=4M3uruK4G3HmWCp}IlO%YkVT){7kW1+h_*)D0CzMzre76C zo6btLoj4je&MOrde-u#}`w1Z~{EecE687r;DI4@MyoYzx@iYSRFaB0&!mMJa-d?#) zeS}at6FD7inZGC3j$XHNKOFwv^D?gDd$p?#?pzNy&Q^KHucElP%-I$Ep3{CS>VC2k z>calia-|(MZt}028mV=ilHT5U%(LcpmCznLDhadn(YA^F&*r&GLb@rLW@dYnb|q(%HYITZgae1-9_dtDd#rLs+6towIH){f&c%dpO8 z$cWQuDQ*75AHTM%`wfBT()~kZgm0E0|Hbhk1-dlXW$SW+b}qoXgSVP$7=L*(vQ}@L zdTRQJ^ z^qqvwZ)0O6*%?qdOI6;Cw#gwA7fo^$r0o27XIuo<1UZB~!7w|p>>%DhR-eco;k;R@ zF=HF4A;FYBzN7m#?|gxqDH*Nw)y)*u;E0MHTmJzvVP2-kVA(>t6F-pLgf!dp&vK+79>B#A!Ii{8i!C{TnYsTcN&Me+Dc+esh90LG~Jj*Ff;|Ay>n}a zv(C4e(OL28IlR9e`zSP1%4aiwUo;69eQ0P#c6y+EANiU(4*$SLVb(qGNX#^+IJuWi z2K<(+Rdt8y*f&8X7SNm9(;pPmsqRiPy&nqbhYm*3j?Scr0Tf)_t(WHqwbH1YviaTT zZM0Yc_8F;tDE~pu%^k`!EczPAO{s)t)6HEWh`tRxgQ6@f*1IEP-L(yTIB@Qp%63%` z#lj#8A-t6D&zLO{H(jE4xiDPz!%FI~t&5CCXFmlWMq^Z(91B2fY)g}`jEC2YH{e2! zOUdEPuYTei*p?MOFlP?gn_P$?KbxfBV{z}|583y)Qpu9^Bi#-yAA#7}uumWsvsIcf16!ViJo2dmln)TS z%W>zSGJV1G0*+31308%ojP>sdE2l1nuE^+ZWya;*5Z9KO371z(h57rWSR`&iG=I2L zq;17ypnjh$MX?`73xM8Nb9#G+(hg_KcLU|8t%+g+4bNt!P#4z;HBnNnWk;@g1k~^# zEe9#q5W2_qskdwnHg;uM5@847YOI_v9KQm-*M#2h%t8APj-g&GWM!?crAUTY0)CLC zum;-5d1$s?e&3N^DLvA+}=A=u}N6&#d0p7?Z)!s*4q&8MYJXs8kI;EG11@1 zR*~6BqkJ3tBhlc(X(8nUQD-vU64H-iCk&^4e|Y*FBEx3OZ5D)h6M%ssjN?sALSLVY z%6NRiIu26KczA5VDlcj`-M>$KE#GRTs%HjW+BVz}KjvN8?BV>%nIN-F8{z8FLMjea z4f_6@^iHLpq3x9UjnUtF9FLJCMruWp(oaj=Kr+Ba_+`Bd%y8&T=~mt2y_sRwUn76d zI?^!XX|7PGiB>9r9b2>WSWA$sm7c%y$(K+%@)o4l+S;jcEJWGge{|^Ksjp>nP$h`3 zBK#1U`NAS6vLWUj6hL;mtEsob1oK(J1bD&w`~#+JCT0?JvotpE>RR{BP@jGOzRmc} z1s_ooZ|!keG`x`h z>p6`>-9H1FO{gvXC2#1Z!+J*)JcoIre_@rfp?LuiNQv0n5%n0)k6L^3h#3`M3T>G^ zj zI|1)oW8{^(u7iv~*O3P7)Da}6?krQ`SJ%P|^wh4R?}0NyXMd)HOFgfiQ6ivs+-6Tf zt~)8D&w}Tms+XPa5Q~~Lc6eJHH`99xgsEevO`p#@z0@6Mo(m@A)*Gl%ls<$7Toi7+ zSpEL{B(TE#+0HUz5x282t`||hTOm(Md!k#GB+~11(=ZTOjH+{lq%Kuy(XXQ}f6Ox0 z|09^JRP#7J=%&~Spc(G%G#}2m zwP=*{Po7=x!4#)vDi-eFO8yT7NBx?2hl!JU$Bs8HCP5z4-t(2%JoD*(V8%6};(f-W zx!VZzjcF5ifbq3EhaDJK=(yXne1p0FC>pQicPjDpNH@A5$a_z(BVHxpa@_H!4c?_$ z_h`?q>hLuG_MMMhjpm5T> z7(7d2FZSj94XuTGFNp{BgP7Pxx^A6&@xQ}^-{g&;Hhni_q`WW*UKY%@4|?3o?H>J9 zO=C!6x&8UP%C6C{yr*7y=7LL^G}VaCX~6~_1r>15bwAZkScyyB?}wkacb{$OZ8F;` z??~++FE_O;Jbb(1$7N@7*lii@$JQ}=FvL65Y;h6@*G^_aE z;V1u|_~-Uo$Iaqi6W@m4Xf*0`fTXMA_;6wt<|wNYu06h8S(eR3_#9B4nY!-do!aWD zNXpmcTW>jF*5xp{6odJFMv%#~$Qy8(y?g=tZcU|~QQf)bxeuZ0ltyU&dvG-VUM&~@ z=*f|0sFKr>8kW}B9&)63bo6hOeI#_$bbpFGl!9lkznQ0(urZqKcfI!{nQz=(XXK$) zv13h3Ki8XsLodrw87|Z!QHhyRyXVFQ!kF^rZ;q{68T#PoE$8R8b)K`v_dWLol3M)!U=1k0gA{D4~DNH6pLTfVd@8 z@{?ni1tAMId@KI803*()?wTJ^D_TcU+@Wvm$miU;(n?$iiUe+5tK@a&IXr&!F8^z4 zz{`XHzzTbCU3J2J+W|lLZR*Z{_NvAi;P(O8FZI~Bo}-qk;sr3-YgLn>LCWJXD5)w{ zo5j)G2XD^BM_Q|}hPQDp)&J4r;_?&sIXC6fURBUAI*%kf~x{=ypE4{>5RfWAhG_uoZPX&4g}aimKR9j<;Lb zHt3(f^?OgSGykVh6*)S5PJ`w?6(vUtr3VXHd=+ry|6+`5L=tdO_t73Q5E zm~Fx@9oX-=C7@2xyn&jyeMfX+o5Zp`I?;6jx=lfoijLn`bOh4ZOn5HEHxRUi?eUKN z&6T6E%l-@0dW!l=aEsR|bRNuH9CyE4Q$QepwzbG(lV_+`#eAUUF`SbIUDq_FzxE*B zO%C)Rs+UiGe^Ea7p+hxY={OC%OIU1 z-qUc-so>qZz^X7VkgJp74@ym#IKSOcU*`cChQf+dAde~U#h&Z=Z`XCX-RDpIFLxyT zjAbEJ2dys%n_DlvAKLe8iXDyt)RQfz=--6!J8~ti*t0w`ejN3HHhblX?1A+EWt?sr zXX8f;R$ZH7os+V{WOTGy*!+3qG8GWFnrYu9tapq%{#CGv3>A^k&!p_Y9 zz4IT{4sN>`qRnN>s}$DX&Q8kl9}{{W9V#av3)DPEoBp6g;Gx~C5qlM;EYxZ? zZIoJ6DqtR?JJlLa-pY>kX$TC5)nZ3vv&~Gv(K*I*xURvQ!eQyw!=kzL`r%k}(cAXO5pi&u@!+J~vMb^!Xur z)MC`jDeAVD-b{G9XoVY*3MzwzP$$CTYohz<;(&h7`c?ae&9n42r6^KcCP zcD)w*va51wSGy^pN|0+gjJICha&eeTfBj9z*!4*_Udch&api+u zJ1Se?x4i9CteE7zkg2(Qb_nWw%wspn+}I3rye8LD$!*j15DUy{^Q|W>igU!`XKSYviTmHPe2cGUXhK`#Zb)TmI~_m+woGqIWcHmD%WajO@b~5W{v44 zG4^Kigg*o4VjX3|R;%?qCLDbZbGBBE2+LlNbiTFcsg)jGj0@m%%2;qG(y-^ ziX8!7D$2{o{(_3<)+0Xpf46QC+zz^L-@D~%$n)M{hgB@X5k`ra5b`Phu6O^|YD=&# zggZ^h-Axl|wV3}>dD^D_q`z3BTmW+c5%XfNd*7}vEA`=uW9_1z!V}jl`YA;l+df~8 zcU2%kUC12`7 zpZI7%6a`p!(G%Z%QH}}H^k~i;QN4oGql^A68NA;tDOxM(z^d%4?FiT*v^V%e26*r0 zscx(i24-XCoa)nbjtm#8Y;{S|{JmqQ+aX^alzuf=j#PI)2S*wJcUsA)FFF*DNc1$)XLoKi8m;B|AhTom6@Q=)UCn9F)#jRYW zUC&;v7Zc>h@7X-mn=5JQK=dt*7<_59)d$fi!oMnSYURes&7-t(W6LfgMQDlWLySB9 z20BV3`D%&lf|j+C1QNl%I}XT%*sVa6>>!i>k(nJbZ$NE8@1ZqKP04MwE=6E@X3UP1 z|JZpOy-J5)77^I`kfkmhwF40l^G%ia8OT|GJ77J(|4?T?Wrab*R`g%zi$=^^*<$US!J641P=b($8-0GV4 zYrXPxMOFwuv(&tN2_v-~bj+I2BVG@J^yyuSt#>>|JL z8Nsnrwstw=P{eriQp+90xtAJS`e#8m^shWnLN?_W%BGe4{dXdtVkb*@(aMB&0aWfK z+;$U)`0B4x64V7f3mQW&>n!4X?p+0CQ0SW%DjuT=)dV(B2PcoNqy1DOP$qi8mLwo0 zpy8cR)jWrE!g~#T}ZtL)2dZ2`tqGC*53OrLrx-z;Dpl9m6 z!%treaC%6rpZHNlze&*>4?XNq%ytOs*G*O3as3WSfzI};i?$jEfhYd%m$+)vc!4QN zK_f>cUW7c6Ub0l^_4qw)pvcMQqk{mkIhVuat}`qAZN_KjkG>|}#(E_rq`Lmqb=Tr* z)4fEg;@KBfJs3N(e0<b6+oq-~GptcaF9 z6yO`Ucd9~d`4^`+RvKZ+yn@qZu5pm!mk+8ZF@~cI=x}?gS!C)ESm3q{I1ekVVF~5?Y*fVTPRC`X9%LzHWLO1ghH{2ggxC4WT ztheXNs);_yBmslEg9Xa62ddkBt*pv<=Xrv*b3m7m8iMh+cLI-Y+m8CCM4!Y@r~XD7 z)8Blo`(t1~)||5E66a5*uHqNl;MQ^iI7o$Gj&ts!>bf#}8JmMgfH&H{NFwllt zq>Tq^x(_t$DzQqycIDPpx_NyI_YR3k$DhZU`(@$G7}CD{zNX9Y$2Ix#r@!;g@B@>p zVA|svBw+_Mh`qtq9aI)L>2h1<;BY0x-ZypJNv0?@?Tq+r7Ualt*JHqT%cR5qO=xnZ z^9}5ydXB3GKP^?S=H9qB`~_&DMd421Y&dyi)xwe0@$!46r@He&(sT3g-kVuBb((Gl z%%=WHb?BN*@Mk079v5$Z;-r6%=BSu10FnHu)D>ahwwson6{5^D+?53JpN4}2DDV=v z5Do*<T@DRHz7XJg?I+BVXB1&1l#Hru|% z$B@f#=^_0P@{P#qNPFq#lPm{1>8IAO1anZ?;TcY(?iH)jxz7t5nhcw7sKjw5sY+q} zHkS^j_MC-%+@^cK$E+!*MB9NI1R;D`gi|*))77FCn(6OFSdvkVbZ`$jh1ILCE%7~} zxpOfn(c2*-=RBiY-Rdgz6=TtVcQOw*_n4~wl=(4^@Z?9AQVd41!@H8;Bh9y%XuE0+ zw)r#e4O9}u=i14Ox1hbJDuOvF3hv0lAdHZMqVs`yeLCg_{e>GvNWI^vmEUSnbt^Y& z(R#7(X-_}4J9J~j;+nI4YJT}jw(5@NpywMv4>uHC*+ zT_zv(JcoMxW-DM33yHd>^`2=-@pFg76J&AWD}1BZ7M_t$a^PCY!rE{zSJR`slWmF^ z!F4CQ!^d9p4`-!d&u$_3gysJ-0>VJl?nm|!o5xFu3$}tm+d{X&A!L*y-!uW)acRYU z7BUFabDA&mdTAM!=gsup9trRmtOG>uD|EeFyUn7p9&9arzd-(5XM&iSNs5hypqU@P zCva*_KsSTmAI9(S(#KB!OOW5b5YXN$Y^Z5|*=92+s*E}m3~^|@+==}ckjrHGxbW7? zmoB}04G>6faf9hRt}Kovs$fj${aVS~6CTb86RmSSRlhcuceL!b?ZaN;!$CIebwFe0 z>18cv@byjS6%{nKPH0+C~~1VLYlP+PenkefX6>fjlNn zuhE3Bs7U)RDum{@m_@bfBqsjtY}{9fLCsx)K73ZgL;cyt25&uBEqPd4Dzz8zw9|Oo zF&p+D!W?@U3#K~3#rOAmxjh{ZzaUs!3$y+yG4Cc-jaTbO{MezHBL{=Y{3zLWW<5Gx z()oWBOQdaF^Z6+$+#OB=siZX0-64ha2%)@>L^zS7;u@d z(^K-Wu49atNvKQJ9c_Y007v!{0mC+zoLF?n-hhv9KQ*ksf9UeRbIr$o)Qc#dBcs;c zh6c8(4P`pZ1&1K>ro%;FQP5ieD20>RAgPJ!>EEw@ef;hHM-2q~%BPBY&S-i_`M{%F zBX-b6sKl+$9yy;E;}&yDJ+3Sz zfgJJ{TO#7{V~lWBMZLsA9#ymH0^=>`Fh||u=b786Ex+P}WkV%>)g&b~t}kb88zQkAzr--2xJI147 zslnqNk7c6;0KwL{mvMI^zt60`F7zuJYnU97qm0n%?FckL%rl073 zO3T~{J^n&T5zF0JS(Q<-{f*BnF0owS#>7lm$jYQ2{s|=jFK)3cdZ2I*Ms`z2&lel@yh0(BblR#Eh>W{2>0A9iqAAKa81n}%QR|NYwq!M2*h#A2Blc1G-HV98JoRUfM zp0|L8>WM~^CIk9ql1E}aew{duAdOS6D<}C4P%;4eO@yaQ<)W`01)reqm>bLBd=4#) z(6@Q;rjV<>T&2~S_vnnb$o_yGG3^ACV{23BrtYs)&zL+Z2iI85^N63WZ2P@LtZ?(-7S{^s}h7-*aQH3a}q`@ z^cpxjf7my-6w5qDSATooyvdL(Ms7W%OYGT-Nx^!GoUfzc@XMr~$Z5baE9Q z(BK*N$*c7}oCCM@tP61+jODosXQ#RE{puMSxb(8wVH4z>g9OTNr>fH1)K%R9E8q5S zIqZ;r>cSDeANS8Pxc4bXXYxO-V~(6{M*tkQD&Fasjxj52RX>U~d9wepa;0(QqTOP3 z2Y=o`;@&Bb)P-klalU4ZVy%hjS{5OF^4GRf8usg~~*r&V|Y?N*n@%oXNPuGC$t;%w^)I{sycDtfh6-g8c zIMVxbldo3EW@B9J>_jfWl42Rl2kR#q&H`@e*{EBNvX;>)Mqh^hv_~tlS%x2bN=s~j z2f0OP*2+rT^Q%6el3j$8XuWpB?>gu%wKUMUhsZjO5KD<16U+hrh=K4_zNZ%Hrl1la zsIHS)cv4YKA?!;eP5LDwk;&zUG$P-t$rD1;mxBWU<>7liN~1jC|Lo|e){ze2(V@54 z6}Vd=;CWU@(|>cT{KW@bnhw_c#g+M~`RwF|zK^qq$ShlYQKZBa98D~()jg_ugNhXJ z(IwP&+C9m$2}myXoay?_Dh(-;J~2xI@mX zW7jRQdWI~5i{{;(>bSp6uCCGD+iqX5Q5rQRs!h7PyB2CZ2;WkOyYMl<3k#B zQJ}>aE}qY8WhnHi&7nmLBjisRnb5K|?egdIce)?x1a_Lp=D#LxT?RMPq zHw zGCGlYb+z!o1Af^@(UC3PBN;0>9^Bc#5FYxxH4i`2^&ig5h%v)r<@-v-u#|^+(KB|Kgj17qxJ3RLYv`>(U#JFWOaveEu~Vz)$HIzh^%VaH z^pA#;OuG%(pMU<+Uf6x{_7M6jV3Q!cd*=o`Hku7}lQGb1jG7$>#YUebk5OAxm+qIJ zg;uyoP~W#UIC07gRsHI{MsG>rwZ|HY7z>rSUNZ6dumM23;dV$sNKHgz|j56#mt;i8J*dZurN*PIHE?jMRD6XBtOgK_?F#Y$QW1)_MY&k+g^8=GjG?v-FA z#uU7UOI!Bv(Y9^bNn`=Wqzs{UmA;xMzy6BY*W3WLbfKLcxvx#g3DIske^l%W%W%-Y z!4O$&J^1icIQ6&onLXbEVO#BX6Oc;LklR-fS>M-${h=OP0ke*u&lPK{J34C z@%G*~IfJ$>_^vM^{;;Q~ey!&|MVcD@4k$!k=6b^{^a{uV%QF^E)zm#H$36%6$aow- zoiCGpB^0slqgxg$&nlg~RJzwx7EQ^W=2aJq&%;@C6kJoY(!AO`bvn6fO)@NIr6FI? z(d_71?wB9Gz40iMh={^xPkwuQd+#jp2-I%j5n@!uiRt*OuXr{>iNO<0Zi`c3u3B3( zoQ+KX*_YcYLTSvJ*Es{Z5mCYFrZ)dsJyvqBy6Na-#SsV^G=5P(^{l4^#3{hm+x2PI zq(nq{g7=HP^-jqy!6?jXlkBbZ=4{)G7Q*P~1lH2KQ)uaZ*a~#FY!bsIze*3ihrF_j zbbv%h?HbCDb~ZR5WPxph!Ac3gBYrnq40lR5-~1R-+H@)yEEX@IDrm?n8f#zkyqhax zMa_umy)gRRak0U(JToQPXTX6yxAV>?y_&X&56UXLsYNlH>`Z;z4=%cA6b;%ijR*f( zYb>b(TL1eR?(3=Ebl+CIiXyzHNT&axs#uC2CvJ#a#L-t=%9F}-Vl<0Zcc1Lqfq$kII^1e zO`<@)Qv!PMjDJJ_ux&qQxZ!109Ymav@RIFetI7zAE)R z=QQyZxdWNe)Jwe~=xQ&~x#0P@=31bmsbSR}ueeXII7U+-m^mAM3Gl7#r+e(bxOo5!2i zn=Gf_#>7wkwAv__4QJ+lKkp7m@kmhmp2&q=R&8G}SiLqc0UkNyJFrS@qsi|k;$kBI zt;Zi?V!j#5c(waJ_5MQZh&RG7L}%glU#I}qP#yU2G6U&;i{lxC!-KQkZ8ulH3o79* zY<8d9Y4n`Xe6lCdPKJLsoW*VtD(3z$5EQqa*yCfre;O18l~<#acMJ3nD-LY1SiG&o z8s4At57w#&p67N^9kFU$Xwi)p$F^>6k8xM67JI`rXAeBg6-8tee_Qz*TCYW4` zSlCfuvGC-MrFTc#v|YE(-Jyw`%1|BAky(DV-W(wERgkknK4HSg3O&+RX?7r8U3O3?i{d@gW?cK`!JFqw^UmvaITG_wac{b9ldX- z4?O^c(p9f}2Riv@Helfi#Y%%DSx{(%f*1j}Q=p7Ig45KYG)2aWbcNa?peUH5lDonwLFQ1h`7gG zZkZUd^7<{P5v#}iEyE%uAa$3x6!onJ>BBiLYK6`SqVN_b_|%)2*%3d7eOTX4Chh@} zFxj>_sPf=@eZ!~Uasq9~Wsv$*(CmOOX@YyTjU(T>Z2!0agTbOy7i8Le3=#A_(J&R( z?PS@SN4aU`F1@}N+kiuDU!{d9P1D%9HI)|h}zpclyptW|MRxQ zkdi@WXO`~y0$2xYH{G`a!nm|;HvpQmxX zkKN|QPiQPTHoHB|72LMT+-|H9ckkR|&=*QoI2i+h?5!5mt@-W;FZOI~SAQW?DBVp| z&T4?kCm3j3S!nd~8g6PmK037+v`Nh%`bsnz5TSRaZ!sd+CDREvj0g(=uqA4;WY_uj zwVy2casNcpPD2yi1U~=MqNkb0>YzCub4@Yt1{4!}IsQf&4n@fS5a=A8cs7X8A02dy z7^T7xk%z4spB!zEU(-AnK_$U;>^ag$zw}`GTVpQj)3mSnYpu3S6A@K|Qibn{iy`fy zh}eC_#zO0kBBSDW(6kAq#cwh~%#td)O28t(6+7 zW4!v1`A*Jrr#LPg?F)#v)?0Y!97D1ntBL&FmW5eK8MGk*63`5 zGL6{6|NB_t<<=;wbNFdB$>sLT6*NzG`&C7Euo~Allk?MAxfFrL1F`Bn`Mn zjYdx>?KS*(0Qtb(jvBGK6mM~RwC;#Mp5=F^>tjaXGNRkW>5QoO(}L-ZCWAtdQy?YA z1CzVp8kf*NoqA50ZmYVLD@5=FNo&T*d(E&a<3rOOz|ZCafZqMdjdzHeVey>I?RN|l zuQCDp&AL0l`pQLE_#GpF%FBcNQj-`DUfPWgaY^y7!b`fo&?H%+;9fgwoRG7r#%7MMORCSNV09H>W~M=ANR) z$T+1fmHvnY@Nh`N+bXI+1FkVV1L!S#qaJ{3BREN(O9+Kf=>-vy}unetF!!hHP9gd4F zp{0XMCPqg!82_HyT1+`Jpe9#)$v7xi5q2TxY#Z-)+}ze%7tw>Dxk!PI-q?2LLl(Cd zJv{dKl6ipYUIy&!$VtqC;ZOWeKneS!7TL(&^f5m4rj}XvdS%5X{@Yfxm1=DGa9gsh za)|3{9EAVgaoR*xA(xgm$xl(cVsE*$0~W&~{zX34-Y~RIR7h|(_3a6j(PHc!wWHcb zkkTIvT3xrCV>dJ$D^Dcat9H;H70&OB`hY?K4)Co z1(@~s!Bh#%y5$_r9dGMg8hX`#(_4*rH*te$(5|tqp%3!!X&vXEPS?OO(z4rn@WdvG>EGItUz6vDf`~H;mKjc*T{Ls>wLswt!yG*qgev~pWLOty>7qx z-Vb!ZX`$SONJTB}Pm9;XcD4J&54aNN7CuS=UAw_i#4;s_votc>Q&zk zVIHOYNyAP}6!3qpBPDHqtm;X$-x>3LF3g$6?3Ebdwf`H88M3e<>YGgTIy)|VUoQGj zg*b81OqN$^b29P4fUxQU09&JLN*=Lw2>IdZzv|QyyBU{kI$Pn=#6(=;iLNWR@5mM> zKdR&V4ET#o6XPwAF+~ZK{91j-M5XCC!}ys0@3*i%_jJ>w)h>S;^XW~{aI@TBbc64; zr;>_b$x3@k#o*1WtE|d&Xl&kUTv310EZ6E4k80WXlNQ|+>9&YiCA;jLnG5q>-yTjw zqJ6hci$1Yyrk`nbX~O0k-WC`Hc$0jzJw-=bDvj9Jo{w8TEEZx?O3JB)RD zZ2$9C`M_OM^hxbELvgiF2x~p^|Adt+YnJ*um{J-}oak~!Px$U=^q*L9qTiX;t9N-T zMJy4e#|P1C7M(*;?l~c;kkvBg9JzH4Xq_q6LE8r+UwLQK@m7b#@qa#1FqK`p;Pzw4VmR(E z!1eCmj&IRXnvKIh1ZWM_U6%>>+AMxV75cFVlItTt2^dQgxg)ZhLdb9!Pb}ozeHdyC zK3!`<9n(puExVzZzbMnkS#Mh-+T75xi81UK#LvVupTR7%3?gif=u2uP6E$GQyeEfB@lE_Thi-y< zmp5z(c;IYlml~W_5)ApipMu9;Qh$Rd?@BGx6=h1`|gH8`RY4} zTMu8)=g@3+L(@1e@+5z$0c-rJWgz2;W=Cf#pWCBd?;iOa{n-mLM(i=)U?b(<`+S;t z%evK^NKaL~pXj|r-9fz2z>^}v(x$~W%JUw_9V2aIQ({S54?16K4bHWXb|YOxI`w50 zncK5I{oCzfgRa`22x=ra4to;6kiYIngAHpi^nALgCM-{$QPwJo#CrsA+?(6v**(~n zn{_lLV_*LZ9^8oLr=5gT>yoU^#}lJ2ymN8@t+Lv)Np^5d<@ObtZ#+#9{o8`Yfjx_0 zG}-i!SykT9XM>uf#>2ntNB^~VuDxU@Z2Q7S0o7NQoA%$oUgyB@n|hXuM3tQ`FkF*7 zK#*kmLNgPfw~^j2LGLC#xs{?%KT;4}M5n@rSR;xyWrY=C-qU764^o)f>@)JpR2THjU8@y?ReV-ZK1 zIHxZKN!{H1wybD`Jg?-UInwVLAphgA;bOspm8u-4WAzx<>Lgs9R_&m86SXh4NM43% zJ-aHia^d?8yUUEb3fEZ%xm+}{%1x0P59{}*>|Pqz29C4FNa=XN!Ntd~^cG>vii z1Fhb?nm#y+wMnb~EY6}GPDPJ>Pl0zscd;)xbtHVtF(Gm|v|wKB?ERud`jf}o1G zyq;=mzjCKbZN;4=bBh8FoRh$*Oy{xxG6GqKFiJf1OXj_v=i3J3TQAGdD}rVB`H;T3 zqkoWr@Hjx7x_w7OX<%8Okgf<#7gb>%AWDrVDs|WmgliZe~b1DO25vA)Uj%jnsuYLp%i~C@ZSB77RSF)KQqAxPXylcznPA@ zs4ww{5`6U};IFQiXG8R2>F*m(FuikCZ}O)C@5PH@zkPRZQ8CWne@ni>)4<1zTa`th zN4|EfwI9Vl6L@btn2zp-a;0YaOgo?oK6@7Moq9cQj9vi0A093gUp;qA5ClPRcJ%+_ z?CPT{tE&6u9-&ArE;-;Atv+2<*HWz7s!*$NZw#3s3=l%VM;IQLM~ETw3?Yp%j>EgJ zD#({u1pyW0X$uZ$WeUR}L&R$ZSEXIzN2yE3|0WIluke=iNKJB=-H0 z+;#77@AI|KKKp#_?NW8)l5dwua|ZI`E_y!HH-2Pq0{>r?`Hz^F5kF$|2!jfK9aIZ(^Aay^;mz_s8v?F!uWBL2I+!~j1b3_{eR-jUmHw@u-^*|AFQi+@G0>F9 zKwV|_^~+)y^#9^s`u6kV4gD^pc8P|S7$#>qRG2q+j|P3kE?JPEDs_&loe|(ZTJA3s zW&_)O0!#duj)ZnO26ThkTlov_n`Qpv=Dp-Uj+IPQpYqQ(tA1u_)Tn*Hnxh!3HL1wzW(^pTIXp&a%E_ea)?6Xo#2+;&zDj@FU-yHz{J7tS9Ia(>9QYZg8Q?w zoJ<7YWfL+arFNoEVpzWJMXRU7c};XNa2w10_;?rk9Cp|7@elOrfBA$IPY?2$T?Rgb z+L!WQ2=3mhe!7qixEVHPWt`|ZO6rFojBr97Bfd(oC;=9r&zO zp6HXnouK{ApX*-9&2K5kE8-f@Z#|HI_BWtgi+>@w`}^B_)Yj>rFtv5al5DV$fA@y< z@sDlQM?bMmik2i>6jvmbT@caWaf_Vu$nHy>vG?9R=8Ol)@!$K5kb zr~CQU(|JGCN)+7!+##~zC3a_~aauEVV3_HRhb-PH9WslL<`aWtg$Im>sm(aE3lF)c zIyua@YqudE)pa`d-$cHjSFZ1I^HPrcPj816w}bDX`X>L{F5o^>l@}RuQ(NyhzqCDj zcYtm!{>c}B`(61*yFoXIKjkG8TuI(H*v;{yzNTHTy`E3#wNP}FmtLNebMqq#_Vzru zN7$a52bu8p;4Wu-ZpHwYY-l-)Z-DN&>9MIsw4VNLo%{v2U)e4iGh4}jOk4w^A;`aYaCQFN52^KltLj;) zjwq4uH|n_K%QtFHr5uc!VM^erd7(baMsR9JW1PH4{+Mp`W2E~+*QkCyzz^%1|C)Rs zBuDHo9l^b!oWEf+&iWY+Q_kU-QG$lmiSBT)=!fGWuM(Xm)O!3cK?;&1sPrF4naE8<$2rg+}OT(NyN6< zog-|Yo)^dt1^u9WvK_#FC{p!{}TvOfMj!QEf3=TUPp#g>utMjM)b_6#_e!KF0qMZJyd5r0g!v4arr|CzBubw{TA`{%r zW&WGYYbbu35W1nlzxL+!@$U%k%CcP4gCm7Hc2H!ePwVffb@CV7!)5(4Znm+0#!)}w z5QqFbZ(W@~S~H4zf;(0Dd%ZU+jqV&>J>Ywddt%u7S)(o{L-e{4>+Y>mo|6qoKdirc zzRU5|!fjbSN-gsk!ZHrMdXM!^m7EcU^D4zg@OyW;9f!?#*#Cy@O0dF*NRXmaA}{JCD%72LgLIT;V}t;gd}`%=3t=xh0ewmmb* zeP?3z^jQBr!JVLXudD~@+UV}!e|2|m9;G_jotwi@rQYDydOU6QbPq$dMP0$YK-6$}Ow+ZppVRxChJQR>pG*sm+da z`_0r7ohk6WO7rd8f81Qn_8)id`o$Ux`_8p%%>JjtuudX;3)SU!L`c$x*5~aMKk`g>u>DW z(Pxo<#m`oY6a5xL!x|NPndR#V-9K08Xk|C!vt02spT%uR=Q7nNUT@XuN8LFd;;E>5e5UW!Zi>Zz zn(YGpAb*&|bp7md49G-bSL;7p>pQyb%0~J?P@MoJ>*N?3S`+b{lDVYF`51G&0t}o9NFZxV{0eA|2@!W~tZ+ZDo?G$eR)I2X`DxI%Chy-h!) z6VwmgA0XYz{={6oLz-$XzQ6@cWPYO`0{`6d`oxYr#0uFV2ZG%69!uixNu$#2$m2`A z>i0jEzxELLzS_Ul{<9S_AN)&Yg1bV;2`}H%<{s2*YNvS~Wje-ks?WOr<9-h#omZ*c zdVM%*E+_pchp16KDL9HtNJDls{)kkI%;p=c$K)sAJK$bUYL_N#dnD+;Lh$>Q%h56# zZ=}WDs zH&QwzP5EZXwr~-_nFV3r2D|N;FppsU^#u2da=8|`X0Qzfa|-ti%<9tE@|iJ`QotYx}@Ll4U`sw;fyM zlgM|DkD}N2x<6S6u5#~cNfx!WUJ^NA&T)(U(7D6C(n4_I9`^?8T>K$-edDU&&Q`tQ z^-jwSq2Hmk0zTVs%$M)J1N}dqFKL;Z5A@>3ag^Qui#!`G)MCHtcox7DkYJ;`Qo1?XbVFr)^F`=XMCQ zsqa};#-73NZ$QO3+L$*R_O#{9gL`Y<5;(?R3|ZZ$@AbCu`u6Y|QwRT}9Z(#G`nbJZ ze-mbZ*53s7Wl}pqH8*jrZO3kLuCLuXuK}OK%6#hP%S^t0yluw`+pTyV@WJ1-Z?{Qv z7x9xPI6U=Y^m^bc_fHo%eUn>6aq2SFm#?nS{j8j?NuxoZCr4atHTKKy;Yf%3mLmVt zvPpe1?ey9az{&DjWZS-b2f38*elgPP0oWy2=Sl7I1pFSde1+gE@iqJ6ZeuCXE$qC_ zwom8&O!g+^Bi#S+{cA47-wT1uojXohM$&Ynw}8G9|6@L;jL%aB=UouF)0yAsNYGX0 z)pIcw^IVK|b*V_oTkR;&J*Dm8^V`yOtCrbH3213hm(~m|ANK#+5ct%~e5Td*m<~s6 zr{jyHJ50mwPu&ATs8Jp}!{Ar(|Gvn38az)xeD7%BtL@8iZy85^$0%3X2=Kpj!Vo!m z@#S6=f8S@)4#+kD_k11yJ#IGMEk)?_G#kI4@61m2)>#hovy-+R*R|d|o4~gc2WLL! z;j4LE!*e&yaN8y2D?fCz-8;vDPvsuZTsT@d$10dR#S(eXMi2vP+F{Y-r)v#_#=YOQH&4K>g zRr;%$@0J{h8}c4)*{>NtJ~|Kd7aZi-IzL5r+o(+#$2+x2j8N^VP0Y>%q#z0Nl<0-H zL{#5U-$zC5{eW?F$R-kxz$NtGZ-mT>yv+Yf4 zuVxnj|FJTDk+Qs~3muEpY>VtFi`bz{_j-6or15Q{4}kyo%Kfrw4q<+ps=}IBvT$<* zjY`&}bT@TE*VGf1P3>~cc-nbk4*I!w8PW~wfzGe;kT)pD{oi=b|HJU3<5=-Q(9yn< zacmj)XHV36u3Zk?&a#}%8@&fNA5YqLM*ZFUYv53f1tU-zS&*FFk9mHnm#-8>P)Ahip)ca`?NiN7ZqT)+${?Rz+n zpQsnZgMumj3+fViLAy;rsnAPkQ~zT>Pd%YmzLI2uv zJ+^SX+bKofVsFVJ3wG2vj&?o)`WKhmbBcbnrs#;rEuXRAQ?x~{6aT&OQygzbn&C z>DW1iP3Ivy1$!m6Q?${hG>FF(uYpf-aX}s$V%|ix8<5Vk%KD+9@eCT~ryQgE?gOzR z8}S7`_o)r9^qU*WeI-YcmMgg#>D?&?sQBrgG<&d2FvRm(sh!k;Mvidxf5ZBh1MQRy zOrGRMBi4KL_eiHApUarlyKV}NlG^1n-9(&n5Zwy8N<1RjFGv}-_gzek5+u|cf@yh zf&b5as%{+i_T0Rhr1K|~JAn`Wvw$~WM8BZlEaJ1f zfUmUYtm>`V&3*u4|IAi^?`Zzr_;ZdQa-5;X`A|=AgVrgcFM`i}iBH}0aXTC;2ZF1} z!JZeT^X)MgUuNB!g7fckw|`3Q+}XB$(q&Q~wSPc5m3zI*;&x)lE^`{b zOkMOe4_t{`mLp+lABdjrpN8yMAJX0bSnl3eke{{6O?-9_@JFlu^Ll*5d=>gAwIlJc zZ8zA?#n*s8{7|1P&m(;Qd~+?&yM6zB(>R3lJ{k6+=wZhXuLoRA+q@f~&~mtZqTM^HTl$Pmh4_ zMP<2}F^8icr*`I8*YB^DbUTj%e~WB5ivCZ`i-}Lz;E8#qzSHIFgu%`et*?ZZPGWB7 zP?dyxItj<4#2gtuKd!9DtebgJZzR7){?=M=ECeU+@(_36on9^YA&>l`C%`YP7pFds za%#)Cn&3pN!0)8J`6Yr2`>{^1ZSla<`_`#@f(vn59PSK{a|fiDzwAlm?*VBanWrv^ zA0yp2O8y79%6iSB`E%CkV#A%=p?%hS3ix-6<1K0DNpk_GY!dcM;~n=u#Iv@IIC5OS z$esyLsL#{+u-8wS&Zjf8%qGov9w;+s={wwNORYT6o})hP`~mofxK8m8U6rukX9wc@ zzGb^*6W8%JnRD6yH;vf#66rbz3!UC~_xfehd<~QL)J~dzime6^;yj~!DCqvMte5KM zT$ZSA{+(4{r!J_+iEYPc_Q^p}1D}e2o+a_NaH^*F65#HZfl%6O!n}y-O_71Z_8c@K9zI1bu)#`4%s@*)H+6nAzSC+gw)nK@2$JF+OzuN#QX{PK2p{* zb866!i{^#ZUAS=0< z-d|X( z?Wc9ne_O{nPrs4NUK^>bH=08!S>c_2Ji&Y$amIDs6V55^4XAef(7#JECE-Ed)hSL2H(^+Pj>4Z)OW=) z@NZOo@AXvOjANKcIn1WEzCl!AJ#JW@2xq#{`QQ`gf6iX~mbVw(`JL2m^G98@p5)~E zS6yLzc^v*z9`E+x*$$l?d{0)r=x}%2_K@B7R*xR>f8&cBmoN_XI-q;4u7Alr#k*M# zo1qO;#@9vrGk>-BfqpmG!k%^-+lBp#!a7P%aHVo=uv=x(F|}J`f5V3LRJO1ls(Y#&x zy}T{S`H$c?_9F19##3Q=Yw|th$MX@td#SD?F#lb_SM1GYxgM}d_0Ppf_rCHuy-RZQ zUD{EX<7hlpnp>Psi(gt*A1m>a`P1E-I@XG zzxXuh!oIWb-^1o6+9AV}Zamd=ZUFu@<#cY%<0~Yex8~+mNXH#84|R0WWoPaxZLeV_|GBXKycaa$_%Yb#8QNZDlWVb#8QN zZDlQIWMVFGc>n?bQ6t|-xD|l+O zE));c+Nav}fp|?gJQf|8zOAr?e_#SALcee)U#lwVLDig)kkEh-JyMy#k^67pA!w<0h)8#w`>OSdfKgoA!y zVAm|OP$0=Dj zO(bNsT)JS`H`eyU<6bvqj9?db%Yt!`4AHt!zi@y#R!>torgcAf4#s;79{1ddHKO6g zug!yM=ogOpYQ(0euT(j1>347q+Mrz;{^*p}2URe~!%hRZw3}+PXaB7>o18r#$#t2OQdG%WKtn?Vwzf8wu+~pEfRf{zGl)Gw zhoy}A_UDQ_`~EFMn2jOU*l$>sfuh0TvY5|`*f5STaw5RlIa$cA$C1Nxnlx@g2LwX? zqKbGl5UPeT$1rln0$1i90Lw2JJ|SXziw4>u7&p0$oH+1t=N4g<3S)t5 zqAaigVq^f*)8(NO*QSfLjeR!5qIbA1jRIjH3GT*f6^~K~88&){nG;FhmlHCL|GgK3qWgWo!i*%hG^}FpMSM z2h)Jd*e0%yc7<^SLmHhQPZQL$X}~0$V=VE0ng(2+K+Q3vVpGb-Fd9;Y$!M?o)-8rn zXaQRc_N^APJ$8N@i1JwPpcNX6 zX{b_0|DI+PhJfGG*f2gw82x*iL_uBb7CUy-mfV^Ng z+%D7wv~qlgszVomTho=*Pix(`DXV=nmhKAjfmUBGR@1Y4H1u`_olFFw*YSZ+c?C%U zztqs>s(?Rgvbh4<{u*;xTNJE-FeoWYyXlb+@3dBR7c6LM$Rt ziO15}*{yW}`5KRP>1I(Dkgt?ry&}y&IjD+PV!Pxx!p$gMngMW(#%j1bz2K1y0Ny7v zfIe;@_r(lgNCMZ*P$SU|$+*iL+?B*74IA0B<`?kg=yl$?Gcm|mVib-A<`~sQSy<|J z+@d=#4?DN>41o1)94M`CUC75CO}(3E;c$wJ12?&@Ey}{GggB?SVsG~Emc@$n(%Zd_1Qx5l7DTTRm2HBB$8s!$ec$-VE2nKw1Nze`n#Aq4fvmydFyTOyC>A79R%a(NpBgW6lJswC>2Xu zH3ujShsN2_xByc86{@RME-MZD?U*1^szxObvg$crIqu}F)T&9Omxe>JxFAk!YQ!Kb z(k~jWi&O-|@mOzmSrn7vvnC(`q*yx0iVU*q2iOyOPl($J(U4Mg3Q`udYg@+n;?ZDP zZ6rQHbfijPhibA=u%t8$Q49q{4Wle6&qUw{3T(g*bm7Z>+D0Qg(; zz+MLczik%St?L26?+yf()ETGhkDk-kx@*2di@XQfuDgQ*xgiXTG) zNvT-}QWC3`clN|0$;T2Q6s8!N(^wRp5I91X|fmbNOTztxibc4b|4sTB;4>?V>@ zVojr}eZ8v(S<$hh!qKsIRDda+uLBHoeop`?p`8F!hb1|s=S?I>q+g(ivYLjjM$}j# zf6y+WpUTGBA*HKzv(Vavv(4ty!%;iN7ANZ3G>>U?VB2N^VlQV7MMz3B(l$rqT}SI; zw{KR6o;@C2YXw3g=dhMweFGsY7`WVy#sqhGOSsaYZH4M03Ux%Ys92y{j2A&iHV>H) zi`#U8j})d)ky2i`HK<4gPZ7GA2B#3$x(A7-?N~K6W3}b%~jTZ~-szbrL3GB*4!Ajy~p?Fk{WUgom z9#lS%^3^z@}QR!I2G^z6b<>C4Nx09j@EY)MS%#RpjtVW)K466&^cL`o+uUyG6_rE}H` z16&X|rfHm2#G`dSRjg2r4Da1l6x}kQEy{B-F>QbOXbqme1yk zW?-N;pgvhsT1)~l$g1ySN8&Zo)1)-&WDqCj*x9a4=~)t(vXH;RzDzKGwS-}X#!ITz zXUd-~p~^yj2lKy{Fnz*tzx-bm{?QU_NL5wLjt>uq2U^i;)tmm_61E~@`vR8wzWO!= zG{~wS8jsdmv9U=X-tDuROaNKI@z#V`Un>~1;c=HuQR}Fj#WI=#ZCRbG2!zJM<8HWG zt%h>-Aq6)!5b`t1xy%~*vRWqPe_Wmg1F_^)&8S@!w0&`OD9;3L+jgGdYB=+J$jt{% zR?c{*X`-lBR@O#Z!8)7Y2(p41mWi>phc&l$Syda4@hhmq_Dta1ol5^@e@nlUm8<&c zj(*Y1ZfuwpsTpr4#){ZQ7hRmF z5-q!EfX(%#I{TCaC?=g(rz<)QuqSkCqV=p!qP!`y(^VJ4=wjs51D|G?$nn)ifDNro zq?#-*U*qOvbDKzKzYSw!>qK#~$6{0K`+jSU>16rT~pQHXx04t z_f*TP6vk&+$+|z!qV5({R;ib7qPVR+s<`~yl1_Rp5F2a_ZuD8Bn16}am_5}m`h5*! ziznH<`#c9Rj~tRNF;&3n78MA^>}Wg?4zX#K)<&APtN%YuCd;PKx#gaV+CjTbdcx=3-x`6)^Yo2i()SOT=W<9G`cpI1eoGyhf zLIc)js3oytqp;SBNY4Qjv!D9L?JVOIM>0$xFQoQ39hnB?v9q-OID;w0X@KV+Ic{8` zSCYEHb7j68*J`qt=ZVg4+++Y;OM0X&;PGVxx9a3G;kh=OYuAwFs(*UjIRF=W3tDqO zRPs8iW4ljnAj3q=>!{4{ZxmWwfk%Iuz9tAz=H@4xJyGZ zf_4Zqjt~Qwp(7 zv~V#y%1g*Hz2x{1p!^9LKwfw(0!*GF$wQeOK#0k6DD*-ydSHQGG0}fs}<`Svfd?TrD9x3#^+k^mDKyAWRSqP$EE7F9G;8v-FQ-ygCsEayHsFo zVPG(fe%Hz6@N~!l+PYQdiv@j>TcK}pK_#E&B*Sxh4$x1NLlhZs$lQ?(rdEJRnWd#{ zY7KY-Ilzq$&O0LqIH48botFdTx8iE*#vEX|2AmHepK-|CT{%E^NA9;;?l(tp#Xbl4 z)xmkwa)F_gYvuwMiQJQOfmUg%bR!_-aSoX~Fc+wDQh%NWct+*|XE``;eJ(JW zavO4i>zQF$E>MvM9L7ao@77%4W>H7}e>A^9_;-*G&(pcU7%gy=BCm4D+%IxDP|$vx ztL?bYqwQF#aTkd6`?Pc~gxsph0u6pagD;ZQk94XAf2~P^f6N8`(BPo==+40NEa8cr zf%j;#gh^Jq^4vA>{IfH_O(QM<*LW*B17FbMeR*zVrz_9hb4+f#d^e8I)Vp0y)%-gQ zcvdcSp_ista*bN#_iZYFxI>EkJj$W`i*-IN{{r%9%2>^JEuYN-_7~vHiny zM`z%5t#z)EyR$RU&%^x(oqVxkZRiC}kIuYjCS@4sS;(Ka({UD}{9uSuoREf!iP-5MD3gIV~j`j$85n zlj@p=MIKdMyWCDoDVCPvP~D`ZxO7X|<$k9tFtDAfu3ci=Y*Mw*)J>!+9cm>hsjgk_ zFS`PFw*wvgvShrU#2CCH#IxLc-{o72Q?g8KIh=vGk-TUXmby1*nfO?E?~xbdKBVPRQ(cY# z%vPD)xQG?*omnQ%Wp4(vh`f-~pavYlmPv~0s+cJxfbrNMa&8v@DFW^h8E^-}vfsKS z7{o-p*jg2SXSz`s1$L&hs2?67Z^^DOcFKM|{mR^#PBF-<;wq`?qtn?Xc#hG!D6kskBL-C4aIJ<)sB#Ku=L%$Ay`3M1`3GaxY zqmBm5XUP?5cvrZeA1$+R$-CFWMKT#{`?;&!j$#sGGN}f=5sv;m>KMHdjzsP;K+;CI z)`4(Qg>8?OIaHbTOtAFs31J!zt}NsihAS%&E-H&gD{8{gxY`ckac_G?O()WG1_5?7 zs+W}<$gWgK*^s{QxZgW~9gU6%+4T|I7q|Ti^KCK)Cg<%AI6LKw)S<&K#{xJ`op|^l z^Y644X3I2^x4iozbwvSghvUpFj2m4>PE2j-&+!4=+@2kP-u~ElPC|0UD(pCnPYold zX1ovRm74|UAQPXHhC76phXV0{tiuDBsPMekFbeI^IN)B{YToS_X~_sx4ofj!JQgtXJ<{=hD?&4lV_WZ`SU(G^Jz4O~>j8}PsIlOyhIf4r z;JD*}+(&x=ml7g~|7gV93Q_AIW)P9$E`K->3dG@Bca*V&lNbGryr4bK4r18Au31=o z9FSLQ)tC1{jJ{q++V<5K<4Te{Nrqz;brGKSh?R`I0JFpi?;McOqqrMpOWL1Ivn%UQ z#~On|{?U;x^d;zgq5TQEo2JX^|8HV@W9>Bj72{-A4c`6~6NVv6W!c~ccl{#Ue$}v5Wu)b-+yhOs5rU|zs z5+2nFiCVypc%QqZ2l&g!dB(pXh|mD&dPn!Z$kMewFZJ zBH?G9@PJDAE0OS*PIyoyc#h|ro!)JgrM&yFN;o2s&`u{jq7qJELbEZbzfasfRUqy* zjO2bfxwVF+nIdgWlb-pKu35-CUiZu-PCdR!&)m4}`J!Hp>kn-GT3-6AX-x!X7H8pf zM<9t2O$9bCm{Lfo<*Ts=2152w%P+4tzTCE@fP9gMMc?ZYO_g0^O^`yo@;1m-giokGN+-1qC1XhXui}#DlVuf8CmAYXkHKd zT}E3&Lknf;J*Zq2C9`#thNR-DWaI^^9L+kk_aGe~%~x&NutA5e+P>PngG5lGGMYEB z&jngUvo@+~E$yQ*EqI}#zYdLthUUwn#PlAO5OWZFM-EJ&nzvY5;OM{81O=pOp!xbe zMC($jMmFsh4rf!*Mvlj=$>bWStAP|bw#be$gU(mLqFv<y)Ll|GylP7MK*{8-PgyL3xQGP*rC>Hk?4YK0CnqhSz8^(4+3b1uCP1Cmv=v+l1 zdwg$Q5*Wosb|t#82-)GW=q7Wh4zSTHG9WcZh)g;qCkn(_+Dd&sR)07&la<=!SccK7 zF}u#zJX~*{GR|qlr-*k7ULG42j`~Y$SYtthMsb9kkQ%bb540|y(3fjo#+61+v{-o} zC)!OtB#`+9wU)0Y5V8{i@RMQW)B@RenaH^e*tgb1wjVzm)7CZ#i9|Ll7!3Ph)HLP_ zK-`}lM_}6;la)7yZ-j)-kUf3~hbFPuAf+3|UoIoN77gz1>rAPR26qef5wgeYk71*C zqnC80Bs3(IN>$+KM(aX6SS0;Lb{v<|z(lq{I09p&h-Lg_ha(uZa@xXVxcx2ihulDU>_w?3{?INKjWRE|;&aSgz%rcA|nJp1}axQ~$ z@!d)4@(V5_PCF}6LlJ`&b5NvOnwPr230%%t=T zw#UPmWc>YXwj4GxsuDR8zDX^zOvV^v62P1gOjZ}0)1{VksYYV%Lemj z2STy<5GV0vkNjpqnd9hrz_+(J>y)b z%q(OArF!VzmTzo4%Dw%3J1EyQft7~krWzFkc6}tOCQ}k(@)O>O@Zy+v(i?rjO&--R zw`M1?UuMt}6&tn3+0mFij61r9ME!Qu_BYnEQ>~9DwrDKcY>F^e4SQMs%?{uRStZCG zgYEL5cFqj6W3dBe9WNoWk8&nJ{w8dxwfzArRN^0F`Rq`<5iyh^>iOBKqGl+=W;$su z!(b>YX(>t7DGR;jcpz^a2L-nJcD<0OoyP-a0awies3PM%e!H9JC{CE1FUUz0tuf}} z(Fu(aJPE&cP!`TKj6#lGW*Qv5{6s4%ftdzPZhHby7$8-+#zY<|4oYT9W4c60j&Wwn zblCV4WLmi^jF~d0guGxlRBgxNQ1ef7PXNpTG&BgcaC_GYKwiX$c_MF%P~jME5OJT8 zPVA&#V$)j`rij zuH5A%z?)3*+*<-H(g}~ayzi6%t}cN0;}T$67r^sP32)5=P=Re-E-azR|43I>H1obyVQ7ylxFePz|PlI6;RsjtL8~2qb0fpfRNqTAONsb>I zq{D(|aBtuNt^W=~(c2s8gu0|rx>7h5Q%!Yk&<4ZcGVun3pCNOoFaT_j-grGJsp}2W z1AUm#zd`9ws>h9D;putoE$c#;;Q@o6Gv|}$z|vt{K}Hl0N*8yl5XG8G%LjC=JtXQb zPB4l!XH!0qFP-03@ej&~ zH}H={ve8!6<$H#g$=$qwAO;CyX>XvNMto;@AMOoUL~QTP-C3;P#`c!@Xp6<|2&Q3b zTjlO4E^+r17u~(s3lxgGFvUfGttCVGOLHD2N9tgTgzQVCi5SY)qT;OcFn@~ zq==CAg(f$HWmqN1SkBY_ZPX-F*EAvt5S#pHtNF9$#xi26iPKw1DbF$Nb9u=CK9$t{L z-FY%#8fxdm6Qb(rlNn4WkQJuJ_eJ3=Igg~}H$?{~d{k52}?zxD=xJ{ib0 zN`YffNsb7P|MYi{^C^BUcIvCUrn@C5rprh9nWyM+V5!z{E%#nVqyikQ-R-_-or#sCqgwk$5&)&`~3}8J6 zp!Ngx;jMk1!%KlnbQR2Z=XNaxhI9owpHa$sm3Kq6PG08rzFq=M=nBY7;u${hC2@E$ z;OSEeT&|I$ykkp&LB)JY@Z~XC^VQ4aR^jvIFy7qw1<~Cciy1P6s?|OMxTXtE~e)ybqNEho27QK2ZuBe>zJ{ zK#m5SC4f8!P$Gc5d2V#ofIdJOAVtiXjjEKAs7Re8l3KniH1ORO;h$PvI!nqN+k8& zL6#sJd5!&jqIZx@wDv|LWIa0LM zlJn2gf&5@SRtg^Z(Z~xq!{fFY%wr7ywyWm5a8$9+5zPgJEiTLo9U`{%NAM?T* zT{3z|yvB~=dt=)LStw?1GE0JS{2;9J6|1+frn!i^%wegl(}g*YOe$v9pNwBuo7m*A z6z)%9K1PF*9BhrXhp0{fbMcbibhOeX?SG|<#eMD!r}&CSo_3pR0UKPOPj8LA)K!c7 z+~Ex-GSB43RNknHyIn&!n7H~(z#Jtd_TfP{+rg|e>6kEi0jRCH3&`>u-UqnqFx5+} zb1C{pO|N&sb5-gKqE0GT?Tal?a(6hv|5nhpG80aPFnse89ajYFl?Ez|Wa`UG&L) zX97jxvAjT=BVKelDS~@lXWnfh^To4)E;9F}76|TlahAXR8)Tp46F1)L`tEKM$GlG# zD_H@*7GSU6$Zb+5yIic3PHE==<_U+hYvAx@NL?ITMSGuf99~JZ8ry_7q2%6Ke*UqMX0G>xLxs+jQxB43ovI1s~Eos>ym%*J!RfZ zW&jgqk7tA8ts+lJoaLs(S#D;N%s_gq+-beZXeME zU#m*TE{#~ObR5|m5FP*Mt$p>523#e+@-m$|x>JPc_+0~(j(-wB9sLPVI=DU81>i2F zqk<5Y<6=k0(MPH(RXS>zP90H-5FMv!fYNal0n{;_0C+~10lhV1zS}#u47h1vMS%}|2-ws2>ba;k{TaD;959ruo#O>i^^cy2EPZq&y8>h?ZT25@-ieX0z&uN26A zy$pDj5AT%$?@|FWek=p#qqVWbdstuKOIjr(jcOUzCHgpBF5HNnt<+YyRosOtOFXL# zVt*`U-zInRuQIq^)vgav=*)m)l?*42>EpaOR>^F;-iE!(;AUbD6xEDKejk3V*;s9u zOH7t~R`<^#$lK@7aBU-^%Fe^1i?(jd;xPhWY~TzCiA{ zzCdR_%6O4+GbRqUrSm4>`p zd?rs%_671n_(h!dPG7+Mh4B@~cgD6gCVmyG4pbJYi(>)qbSY(=H{u$~6g5ZNkDZfN6+8?ESI-Ms^we_`uP&xOV475X7h^gsH+-yDNJKM$jFX$(6(iO&RdEvl3 z<|xh=VZM;Qet_AVoG5OTmr7kf@D&gwFNoU()j-q)a$NX-5+Ur?;3m?s&|9CNXnW1eIT=OnXd ze_!AkZQA`V@6UaKv-{I4j%kdCzvFR5!*fEF8@si<7hK*` ztK5k62Ryy1+}L{*a3p}sy@RXVnAsmF7+K{83M#AkZ?uYAxEs5Y`~ul&q}C<9Y6fyK zrfEASx($A$O>{3^W8#kf&KJ2F8LUs(HBsL64C!JRDp56^kF}AL-O_aK>#v*6^L${_ z+0(=gDaQD$P$@@O`s?==WT+~;R#|neSoLYbifd)+r^TYxSk7nk5}c<5%~pbDi=gjV zJT{xzG9&g|LhfuO*OOW2#<#ja*SWnX*16#>2fTT8ZkXkO=d8cn_}@|LXH90Lc`y0P zja&k%{&M4#a@KdE!c$5r#~yGiZ)aik%vE;H6}w8y`EhImbH%QKBss~5xiXp>Q7(?} z3PaKGEScv`A|&RUXbb9iiruo0OULXoT(51uQ`vl{`=T`_I-cjm?44qB=kpwI-6@9Zm{p1Jbn4g+ z+1iBFZtpoA+oAA0z+2X_9V|W!>evq9^MKq7I<~`A2Qexoc5icHcfGQ1y;wIbVa<9K zV=a`hF?4T7xeDD)O3o&cGl!*Qh-{J&S(FgFNs0B0de*?nx?G#x-r%zaZf9}g&ly4}C3hU4qES(24A2$LQ(LRrhPRHdPn5wORL0SKT`^q&Y zRt|9D@&&Q}frRxhh{-xGRU$VPydvz!S(5S2c}o&}7ri3K?{?FclosNck`j$8;Z`2q zt8CgUHtkE;uvdjmOVS#{@lHq3yGqczBIqL)j^X&O1i;q`x$hoat_rGE$W+GdS2FjD z%%2^Z`$Z-OI{w=){__kJmvx1q=oW2vqH48c`6o)tC!*!>gxF6+Y{!JyPgGDPT*3{E zMP0E5{gkm=(hYMMj~Q0tKKYe{&I6nFSk4@|6%5M0SUZNhus{zFzvAgg8~7@nljMc8 zB1Vcs`G1nCB*jVci%5k?aYFPOQhqxa7-vVxJAIRhc>_5_3HkB0KvoO{%nNB5+u)DF zyN{57CVnOniQ41Dtg?__^G_NCnAbC-<@4E*IDVHOfv6tD;VP#q>==GZ=d}9-B6kz1 z7SbnY(6)|)0rP!w12Ig^_++Jt!oeH~elEO9T$^#{N)u<0$9CrK2mGSj*@6u33H^Yw z!GQOqe!$4VKyFb#pz9D~8>8IuYTrPJ2Tm*E+}5Y=fn6)N7`Oqvk*Ss--pHhP`wZc^ zTXN~$L8L;YX!Auwz?Rn)#v7UaH*up()Q;5!91w(-@F)S0? z+MhWT$djuhu*Aa;zR^Pgljm^r#^6@5_$k>)@0^;C_%Gv~OD*ls+kpErjU_y~`7h_} zdvRCUf|yn4x8fG?uTR6kD?`=U_kYnPKai+|B91wqAIWmlqGAj>pG%WgthW`kLO$D% zQqB!FXzoxe8V~U3fbB;gCOmXLVCEjp4x392{EQk;B_A+D&<<6{Yao{|{Y6G3FfJU& zMFbo-49KeqgyOhp^WN4tn`EWZIlLxn$7;A=tDeZgOyczjaZ(m3D;Tvc|Ab^~;ML+}Ztr+zK|_1^s{-I&a8(Pd}gs`Hi*axT&Rj+la+(Rc|wlM8!$H8M@wP7`I;r zoLiwPZiajv*OTJnp-_`ZDUa&(Srq^`bt|T!U?^(FTgD8T4&jW)ED?5N1sH;gSXlu` z85im@US~)lH?WYBaJx>Js}deaBy7|POH{%WiG;^=!ZMZc0uv7OSJ`ECR!`g5}BA)wNXE&3MhF3cIs~!tOM-$AB|fAPd-O zu&|>@RXUW#qRDL9&O~)TE4VSk0dp^##TYy%oC)Oor8xV9b1iK*59e9#G5APW^T|>X zP;iWDI?t0Qrn^3g1AFKd3z#kwDs4sp^pT>D9>IA~YJs6RD3Wf;nC@c7 z#Gm83PV#jcAz?932rr2-xIu_=5@Ypr(D)HRzSo61p+7KDTYsO+dv1T= zX<9#^Kkxw`D*6Lo@ZqBVzz-vJkX@&KtJY=`32E!?pO)So=>CF!vA^@Yh34zP`b%Kadxe1>j#r;K!)0_aXokeo#2#R66FKH>2#wxIj5MYo_1&D-7KKNEoIG&L9oI#9z(QZ)fh-A$@W zELX`7uqe@RIF6%_J2?wa(B$4U*;f+?`f)6oAJ9nYVMl9cpCFCmmju5`^E(OOxKMYz z=7kJ&XFwVFJ1?IH_!Eg77@5tN(ER7+z|j|~xRjeuPa{zYMVxaXV8&^G0BvY{UoxhU zF$QhP7%nzRX>Qb3w-u`^9jnI*!X2LwQNPNj=j(0xWr7EBRFg{yj$UUXP7C-$Y$UF_ zu!UO=v>2HIR#OFd2ostJ<7CA&M;M744o5K|lTNfl{vlPvIm60*PS-f>7>|s}NoWQ`R+dIr2I3XGBy1>u3Bu#i+?ZT zuP1Aac9(`++8o5RrVggb z9`{_Gx_U`gW2zOJz|4cg@xcS(ac|U^CK5CT9`~;1l56>0EamsOFTG2h1Rs)Yp8#|j zJ55(^2qpt!>cV%K4~ED6t^VcfEvvF%V0-cv>&eH^(V@N^xU@jsTD0X@;LvBad211` z3TwPdmNVOgBH>6}xpPr|w+jS;2 zG=M)p4&Vd>IARp{5bGbVR~4rZm!ZSq=K^1sjXQxZOyAb9fkm3*y;TSYdd1g<*=S2rGVIAQo3oFghAJ zLEx&TJhrY5PUei`5l`+%%C503KaQ8j0RF)(jH&XHO%H`5FjhBOlU;>1%^H!MNgsfn z;c8k4o~OvJ!c13lg-FiN^=>(Mto@}<+Kb6mxaW}SeO4UCqm4G_R22i%nN!tGJshmW z5e{#RsY$jcvWLQ<>Zon|CjgunNR`r94^||?nM1>C_=xipCgXQM-<(Y!|DuvbD>2KY$Hzr8(8i{6r=>ZqADfU|g4! zkpZ`gCv2lOu9wXUEsF@+mOl`xRuhIWW@gB*ivLahIj?T4Z$+lNmw_-aWlb|5y=3I_b8RwP~* zwYkLt#+M!=CuG&?A5G8p;agAhS*>8Gt`^1}he@Mo4kP_D-vTg}CKV?~U-Xb2z=|xs z+EUG`3)R^5FjluLIm%BPVJBkKb;Bw;51m&KPw_KRbek!}!uk)sc`8 zf-&u|MgcA0D#lw87&DWA&1jm{tR{|GhC~v=;(4 z5mZXYT-UuDj0apIoW>wM7LWSEp>aih<+c>{D-_Qv?fhBMoJ#)OrPN3x_WZhV+#Vh- zsVFTkhcS(pDmW+5WzsiRBoka0C2j?1@tS}mjht99SU2^M9l$Y+fW+Bt5!SaZ z)Z|A*3Yxy$R8wlahv1?^0Sfpd5xp8SC|doD2u=F$a#NWk5B6oir7L(Hf%*u`9#;%+ zziboPEcPpn`h_C6WUxEs3!X`(Uc>Z+^63-0E6iddjF5)4#LC{})UI>HGS3z`N=iVE=_c?t|9=U#m~7rX_Cj za@W@>Ou-{wW$%Rs=Y1~Z$mpnl>rEOL()g4AEe3amaUoydFbjF1VHJF&djA_Rhm$b| zenxQqMI6|hVE+9XmS`2Hw!N9V&Xh6Tmy9KsGM_&_uFfLb{7M=zgz=! zxfl>%^5#W;Nv$!wmDd2LT?}-NUBm1u|2aCpCHc>D@?YxY=M{`e`NPTiT@An`I)B`o z*8ogq{$35hEl&QRPM_%#{dcA2pP|#oN&an4{@0!S3w65A|50lGdv$ufj~oxjs1N#&>g@9Ol+C4bLLcq*d-80h5xN~i1m7p3OUI$rtzO38njlYhFC{}`RF z^Djuv-$SQgE&10u`JZs|m+Ew#|K;TTy&Hf_b$Wy0wHts>C}4a8@IObuJPo)<1%Np^ z$pIAbfKH#J1muhcL_n|6+Jj$ffELg%S-`{wp!EsL1CtH!9Sy+6qXF-_1|UWOS6u@X zYQRoI8t~PlbpxI;nqlbK+5nuZA=3@-{sv$TW&F?pY$ZhEyj&w@8xp9`QV0Y6J!)a6 zF-!w=pnsEU<`|tmUzwSHsW!9YrBL0>Bn{AJzHq5F^UX`e%!v&Eub^OK&_(^rk#Up- zc(*hFrIr@9qN%XKmKJuQl@NBHh6KcI4HQAQEpS9UqtmrLgDSO%3o0ohwGU73_^e;AHwEfI2^%rtkNcbtxWz} zO!nE@(P&D})!GG$QT&r#RMw#rYYBZTmYPL@PMK!6zs&s4| zFOx9`@i(Wga4i-Z%H4k`+y4;TORKc)e~2w3NhZ1b53&8)D#vz(QtkH+ZBK(s+V7Go zK-%wyL)pUvDwu(9^?+ioOJa4di?O<$21LPisHItWm6RSH&2>$`*~IbHjwy51hkjla z=E+l0wXXTK+OB!(?Q>3b!i@(yNj`_Y>Z=$t5j5lupAJT$4RqML)WqO~z7E`}0b~rA z2+ZO}L2qaxFe;JWU8NsT56(BV96^#h$zzy}u}af&9+Cr=8~moVtM%|?xxDb}In8%) zaWWrw9cHSiCOzFXgPR1T4`?5)6#2aaj=73Hh}2qZLZw|A z4snj{2E3W3gzr|~*)76{iEv=Ii<2B-Qo4iKEgi(%gtpyMWY$bE-V#eT(HT*@8}3aNDS^BM5nl^@R0KOGV zj~FAS;5$*BI|lHqn+QzRs=sr2cTWV)83W{gI1v~qSD2=#t__6xhJ${Y#JLf=3;BZw zKY%|(%hh8XUn?4Uycv?7x?S{lg*pYWgW^-9H_qIJBe)4a=>u2mWdy( zGu@oS`!=C&ruyP#Gnl0w$LbO;*Cm|gmJ+re3wZZV1dbc4i&`+Y*>|tgZ$|BiZSmmD zqAV2--0mI$ZWMzCjnxx8!I9r{kvm3CE_FXhY!}}`NF}V6^Yrn1uuJ4O|DEc7~m_@*y2tMb0chBWeixEMu+{A z3^u`)X>5X9!%p#5iZ%(vHS+jgm>V5CsX}6{@J@~J4KRevaL|wYgxQ-+>5eLO$=9fo zUmVdPd1XY`#;pQnr#VeS?@p6W^HoCGX?~wT+^i7~C`86(x?AmX*+FZx%91tPC3qlT z`QruUj~B!r=U%4#0lXmY7#?-XuV`Lj6;-Y8)ik!gi|T}DMdNrajeWu@GSpUvCF!i7 z{BeSaVs{z`odJ^Jx;S1J1@+?ra}ymFz#AfkFPlNF6um2oN-rmer_|mNIW}P* z6BgqP{(i}ue+B)2bPlgSP`82nAysg}6||wQiWi7X5v#_M6SXl-sB5kO%*&Z=3>wl| zj2kG4!tNwDfLn$8CUM^iM-_2}WdDQg3vwH^J|OJED;u>wCY=7{L~U#n>OWTk=5l5m zg9k-^n4GuCQENgE$#(N~SJDz1lcVl-dr`pm6I@LWyWkIm_ZE4)zAbNzb8G2U%($Dd zG5B0Shm!@Ee~}r$|AhH3G9^kgyQud0hllRLrc}|%G%+rXK>E6+kfRC>Ma%(05-w7f<3AjTeR;PRCPXhi( zB;4OL;phgML#;b?!ZxKfr$KA&Igtp;{6HgKQ!=Y1fz9k&o$zJ4G_&YL-H4`5qQ6^w zg-7k$@Hl&*oxFZ_D<0ItwFMc{!z{>P4|Dq@j#F%4fviv6PclS`QFi2Hr+KMVnAs;u z%v55rz)zSAm?Owzf3i||XHBMUVt(yOs;ZV|i1`C1Yx6Ba1TjS;Rw=~g4q`45f3twY z)H>r*?A8T*UKQ|pDd26Bbpf9j>ozEoE1GydgG;S{BnqhzFqb$5dPB0LPhmZ=IyPu) zUsBc{HAR=Fa{{qVBi>SoGaN+!1maDNct;^Fa1hmkV7z>+5$|P4l#ZXG<7FBVsXmc` z5|&|V7u8+m;3IafBkqP=XNu8w#qfqj@ot!H2x?*kbIK=MmQ(Y}6+f4Yi}ezS1<8*I&KhT)fhqrR3Kh66w^I4 zZhcd>>@T=hQto4l>Lc#G%RF9lGVtOYAou9WfM+h?$({`C)PV0i-m@nIN6wYD(c(K&Dxo|S#|k{JKX!lh zNKE|dVN9GjSGoUJu_J#j4_(0cRSbs?0+ptM;8*bs-7+zY9bm;=z}!u@1TaJPR$MI> z9o(Rib~GOFS;5{`6n9{VAs=^}v&62=S+r{|rKAXvEsc#kR#xI({U&@oOaGqb<5{ei zrBWvTo~5E6rSHln1N*e^p33r8P6l3|3*^Qo1K&_ts^il z7q9C0_Gig}%%4c;)-)j`3GAbK>x3_}q>rkfr~9ZGM6_I5iI`!W9~^2$?GRSsVcnTb zZY>owxiu?jNusoqTeIuuH(4>}v}OgYbqX<8$SqWuQkRY16@6tfpB1sO8aHREU|6Yi ztrT5b=cyoF*_t8uG&M(ItZdCUk`tsVO?MY7wMjnQC7|3JBxLWD{Jn1g%%OC906SW< z?HA5xOJ{xu)StH;kmoHrjZ=P)_MeL{OA)5T=2B6A!*7Fa#SaGh*2utPil z=hof@lYz-h@-X2Io$$L#xLy+2us_!cn_El6zF88O;}@OqvC6T635Rf}Z0TZ4!5VyT zD39K3O6}cjvi9ztuRMCQNsr!7YJ5#Ns4_ycUz|_x!noN?cC^Z(9euMYb$7Nat64;* zwOFPb?^dOItLR=rZ82c0=-x~!N{YJ6ZgO;Q7246Qu-X$_l_wZe=5Z%yVdG7_KZhU1 z&xpu}Z_*cHv@TE$d50+%Vq`1;3V0#L!3v>vL-vb?>mpc(AGGscRt0!j3h<8w%3Uvu ziKmgO23|IoFE-I}q0=*|RG3HdR^)hX1aAp^I#|F#wZkNm?h$# zU*wprXy_S@>)Nn;{gKKlF}n>9qj$I&FuTy40Irv_4Qm$zW+6E~%xS~lY<+eyZAlH) zx=_Fu_S?hdS5Y@$y?&+Kld$C;vE}W>KoM_iH|}Zk^Utk;qAGq1CMX$6825;3m={rR z98U;z_$};R0*bX$SYcs}Cri8Q1<^9|7Qk#EJB}9x`8bjA+<9di%+P`Je4B!Yu51Go zJi&iG&t2IDHxvL_0C;!T!8_U!s<^5xY{YCm-~2`!=^Wl@!_MK=TU6)phS>BWsVMM9 z8@7ecOPsc#Xs0bGtZoZ$w2@vRFD_o0*p}_#k|i9malG}mI4MAy4xQMR{=Ai>4Q#O%xPv5>X5I_*r+nM(ol7P^olu&+ed@TIJQyUAqC&u`0; zj3)CC-coMbga_NGK6FJ}anp*nbkm?^%1tZUGWP9d3129N_Qi^}$`>3pw&lxl$uh?g zYs4`dNUM3Q``R+Fx04aa9U}Hc5;{t2P&M9`)FYMy<~#J1tWQ2HCXQZC|NTU+7W{+= z9+mWx0Oqrwy)ro#U0z>Ga^!}Qs%5x1#V8f1ShvM3ZoHVay#C|`}+!~ zgPGipA%VQ{xV{~uHR}!zXmG8tkG%sh|HXm?Fh`Pyk~5H;ngHguVJkdop;jbMQZ|hLL~gm z!bgK)O=4xsrRU|lM;s3*^$#fZYn1v2ME&Ty9Q7(S;g<(RSNJZ#{6uNrE}Yx$ zqCr0@)^1@vPFAWxA*mu24G$+erVo@QABZI%By=k}p?klGJ$tS6R3A!p{Ch26x=-P< z3_cQ0fSe=9sR`g?$x+W7!LX(#u9XVPST-4WgumUg#QWG}VCGuD`_yD$J|AA13@lme z_~5Vhd@~{Ujmf}DX3uzkGVmxbNb>$Q8F(^*oOT#P6v*&Q0UkrdSmMo}0=z_-#Z!Pc z`M?R|_tyfsB~yUUDKDkr$S#!;!~6Ea)tu4A$S@aROnjtaSp2v5LgENKPcav8*2-sct* zxd{=Mi-^2RT)|uTPgxIjYIVpd0P|ecqV%C^iEq1HokHjWL*y?osGuhm=v6>tf!qiS zxivOu^G5*|7!p@`0W6d=CWF`O-vU@>(2P2o5uXD5N1L(G@GhJJOk5A-uATziOuu+G zPXWRjvDonLngXmM;>{_*MnO=<1dUj(WIRL!WxOH?%9y7Sw<#GP5SOJBgOPgd-A+9|FGu^qruwrymffv- zR&^7=P*M`&FBp7lgzg5+%@X%r@tVlGo~$Q?Rg68tT6;IxGrdUW7gC8b#+KST3o!hU@WIoEF8`)yg{9k0$=4}V>4 zL{2zAiJe)>SF2qH53R3u@tDvT^i>2{?P5Irb~n^dX+`2ubaQSw?OGJHL+BXZ&Am#)m`zPIOrQX2I7!2_hUYeE4SNV+p$9e5aLQ)UkQyeeLk0?-!u>r} z9X_J!@DZuQvo`ZbeSk-#21ajAs>5d!SJifvI{km8k8TJnGc1@I_=)B_IMr)5hRYm7^Wo;KtCfPx2i!@uKPS<1-iq@X1 z+1r)1%kFJr?RFYNYX@tXw)Utk+S)U=Xlutdv3Ay$Mr*IuS$8UHr)x6F4q7``vo-2w zO(vme?Q+fDsjS_wrHQq>X$-C9k3sQes;%vEpSHIAK5gv_O{~4;K4mR6yr(rhr8I24 zuZf2J6hIAMYnay1<9@B-!uz#`_Fa=}Z|(h!8uGiU+IvQ6cJ$^z{hYGn-3OZ3;eJrJs<|4b?HKW(wqpVT z?BmuqvE#W1l^yiuHl6h)rQw?gn`k)VA+6y}4bvLVdq`^t5kL)pHPNv0A*G>mDsXhM z^5q*Y@0C-5XPASxXBQL$M*uuI#Ot#=J`5BzbA7gWt9L?%^i%^hnc}VCn*D|o3+qU|{PQEkVoP3#Cf+GxioI_q9#$G4hHvEx_G-mC1m?$IW8Y@!<4 z(W;xOAZ>^HF>OcQW7>|+-IDz=;W1?g>-Kb=^<`DJw=xIowyax|y8Y&{7V4G}ctN8K zjuc9^HnGy)s%wpBos#;C`?qQ<_Y%Meytavzh1-;s)NqT|uv_`z{B2D%)NRum?$$8v zho`n_4POvI4ZE6XIOlPtfpM{4XMIi8$CsK+sgEBu`!!{U^>`CIrarFi_*28Q9dA6Y z?f9Jl+R?Fla(xVXLhMK#vE(O?JD2fpLp+V?8OD-K0OuN_wU<2s6i$F5<~-qy z($AG|7SGhFKv8#qnTB}pp9*Yv0`P8|3cU0Lko(M3;7w}xyfPIyMA(kn8I6QTDE?W`u&S%Fvn2lZ_!(%x5!4|Iolnh z^%d9h%S#+5FWSyk(C++3uB*gDg5FHtDDpyhSWpj(_LkL`I=_?gtb7#H72CA|+ePG# zgaO;#Jn0WvFN$G@P`kGSo`z|FrMo-7pR4z5~d8m~Pm?YRn+^IbOTJ zL~wH)+@c+v2kfrF&k-zgCu_McD!H#a`1c*TNA9HDl-Y;I;Hc2Y+3`F!9BVA`0BEbu zhPP#aoVe3*uaGcTiu0m2j$-oJI|1`yvI3C%##Zdq{_eo!x0t+}$syLk(d2z4_Q3pt zY;sQ`_lPI?1=r>@ox7O4lb+;vjQaQTy=BgWfcYsIAs#QOBU7;s~Je(_<*8>ohGGFwTSgEf#Ym_VI@w%LZ=$CK|Mf1v> zEh|iXkPxlU{~aJg-EHD6;{Cq6(2<#=7BKCweJf0Sk;ty+20iaj25xaoYo?@);$ktp zj9G>w@UQk1_yfHb0REEc&i|1b<4_sTI4x37S$a6jx!h6a<@{#5X8?e4B`qx_t&d!c#$1^xDMLc`z(7c8 zYoC%fI2`I1l?$7g)486`F_arSE|8RMsb$a$&9Y}9CXj~Il8mxqeZs+@6;;Wpg^|8j zS=EqQ7`Y){7t~BKnMR4kS5p-Z9a2%Q%uTg692sa=IUAmCHV?El+++tBArn)j*IM=Z z&?CFcPg|v!RcqDDu~H`9^YQbkx%nGkiS+yf^K$ArCYc)=Z~1fTfpdb1%&ET8C+Z~c z+5Wwnv`gi!&1 zT#0b*H+0HHNTY((f-$wP6$py-^k&Q(9F9m@Ml)&jrzAF4W+oO(YHC}dPNtTGCP=!c z1<@s;3F;<7mOLv3B&F_cR|i7U?s%(Ps`CU=7V;+msjWi*B17(Rq>NPm2&63JPXJO2 zBY;uisK0l(F66hO6GTjE7a*v?;RA4~ok1w9s)_;bTq)^PW3kblF$S~RE2;i>Sdi)oao#GK&idrkciV3DWc5*A}ZpRDty}m zl7{j=Kjvz8K+^ejb}TMwsZlc|GR%(fP%ASYc0k5bb+nR+haZqw5_HZxGX02@^l)To z%&zl?CGmil3O7rXqt#;bfGA_iAW2CLFQ!yTN^0mZWk^+(q@~s?(}qTEpCqOhKV(-| z)C8*H(i+nB4W>?OutH6)D*g5|xsjmBRi!CVc--wjKPXBqZF}5{URE$Jp*uIHCWOU& zfq(N^b{_uPZXBBlrB90Jpmm&+akb2>ckZx4a##VY?o z)g{;ZnzQ)~`tcB$;;wY$p+KyW$e}>2lDUThu}(G~3Pfk`IuwZB{`OEHy1V_C2X|93 z{oVB-ph!3tsCNS8frA7J2Wdm}FN1pAL$yfGYZz$98*E{43IvU}`$p?R@j$J8YHUIb z9qQ)*w-u^eejn`t9Qu}DX4{nxG~V)?B#;C5SZTN}6z_Q&5HgnVR;0^i`s(tEle4fW z@hx;Y-^s}zsEON$lf?}V$IC#R_`u2%Zk z7KE15IVC~vJEadYn-?`G5b7JXY8!PPtVoBH7KjbAe75LoL5|<<9jyzD33cx#s7;^$ z_pIg(bAUZh6X1*mcinl*-JksKZXR9RRZy?prT^E0_S#~B-ShGDH}k*lEeKP#%~|@$ zFW%9sV;HxOA`l z+$Ns-TdhFyy_XK8YavDBqug5Om#GUqzhYc#7&+sC?$?_w0Y`+G560|dWW5|CXn3AF>m;ju%lcnyr>jU47_1gPCMK06lk77YjlgD`fv1&sDa4)@@K zo1(HKHjbRt#zb~_ERJNIG!`YlptRQSE%Ma_g8quQUyfF6Nt2s(2Q~4a23pbTaWG~# zhwuf%F}sf)^F;%ZcsLq^@jhYXMq@zbToc(E;SWFp5OivtC%P4KQ~Ugt*PZ^{%U`qU?Ur@OT*a8AeVe(7DV+PDtHdn_Y{C)J}%9WlLa;ku`lT0`!=7b<_l{O+j z_nlpdZ7xk)Hmw&b1ij%UnMsJPbPd@MKp)MY*_nunihVd*Q>zZHn0Dlfs z|Kjs$&o;lTi36?E9rI+E%DOAWx+`d1^|Q`|?iK9PfQ-}L0;YhI!rtL;0g(jYTD83p z85h3=OhpG{iTCQafcq1G*;3<429$bICcZCzowF7{XFFBdv^MqfLTUnFoLZjaK`h1oUz#IrZ+Ya$YXBrvbTWO zBw_7az<+eYR=0QCTflEjXsiM4fKvT?%hU0Kj*k!BMxifW4}9nzG}pw5FYu}*o@T>` zV#q~gh+jSwzeHbf{PLmrLiy!Wd7kq^Gd|ZU^|APCai;SB=WavA;^$I8bfJ5{5HXpz zzW{iie+#g6nZ9s)KYR;Yb$?u%QnKR zUex;q9_y#*X%u zGlB?&Fbf;B$L6QWeV6mo*hV4=f%DVY8B<^}jQME{VdO=|<96X+^Af43rWTRnQ08{Q zZF&hX&pw@p0CAJR-*x~u3E=0K0C@g;lLtezCvHkB`0FOFNFKyy9e=as_fhGX)oD5a zSBq41iHye@(U*C`F2*C)NTJ#n?$S+hjR1S@0?dnPpB;@BW4$mR+(nySyU~N`+NL#W z-Vbi{;MHA#_sbhS_>vE4H+kTGnb0%$01Gtqt~Bq3dw{cE26BCSfS4d!FYw?VjaZ-N z?XW?EpJSZi-?PaMW{(`m8y22imG99RC zJYTxe#sMI%$2U3-b|`f_MBN6e8xQPA>y~BWv4oNx$x3!8C3%r3UJ-uUD~yWqnmU0L zi}Z@%dcFdfkJIZ_cv9e%4&X@vT=`0KEj-m?9R+iokLb6YAb3lJpi3l*JtF>?<*xu; z#$%6^A#;Sep7db+~+K}>-84&6Z){Q!1AiN7d}Ynm0v>E1Zz;pZcj%!%pJ zU?--t!7fY4oR}_cRP_Lw$cw4Zh3C`Rn0M}$x0{67%ffk2a{?heC5+$62u83po#Ts) zSNU?N2?YHdvc>RZdbc7I|00)0KP4KEeT|JPG!Ad3^R4^TYe2qS_hI`nL$2e3`4P)m z9gc?U;(?G|7LDTb^dE0B@sHQVA}d}O^WnSni*GW~=XG9gLwr>T->09{(Zrb785m~k zUOeb$^QV=4xGv+e1tz95#WVMfHaN1E>QWb^EBXXYKavj5xIMs0ntndryI>D+i)383 z2RK6~yq)fSU=Q%PBv9f&oiHsONNXIV$)}i9Nl|r}->BVi1M)erJQ%1L^A#v*K$Rqk z7tVCUjd)i#{U6ee!m1GPgOvZ1*LmHH_R`PdrOa>1YvR%WiAUQTZzNobpVMEv$;9F0 zu)cnj`nu_jX8HwHAevE(o3LAtEM}$~U3{1&ftLBq8~pKUr)FoS|IjrH?caI>@I1Z; z7@@s2E8Y9<9^kV#fZVV407t#a#zVwtjhLelJ>Jxa8X^wx%Xlm9t0|4wV*wUqskmQ~ zA#uMXgK>ZTn>?1Gg8@r2-d|wi);D=|1iu{dPzFC2*S`tm^8?=YV|zxs&RLAqXcQ~t zKB))Z1k5OdN?yIux=5Unxl$6hzQqw;15=xLdAFn*dsr%tZ*JA4+L0mSo8$KYGQL^c ztI7C=gBcm$Jk~3DeA8_Y)cEEc3e>KAUW?qHA+Ee&k9O2`f=LRXviblm4kx}D7NStO zYHBMPl}~MDE;Mn^9;e%xDi;8addual z_`&|xo`lO+x1!5GBZEF(F6bZj0Oq>~c=29Itl!Hb|FQ@8uP*ZPR`49V7x+WdD_VKa z*b6M(3wV0(1>9#SuTFM*t-ZkAxCPVFl+>S;JAM)wo!)lJ`%^1^ZL#phFn*F^A@3yp_WG?= z=Q0!Lyscd^DU&a{L2vWcE%AhnDVYrP1#h!*ANvhhuT8o()BEOcz#2(lt#8u_zcjVA znYkpHp1=|~!{i?`4GxHY%;db%gKzUUuz?>lY4+1BMu^v7ao$>=A=KAkna|L~@Hjha zRonPY5J$etzGWX1LYO4;O(&A&nYkDERa^LTrgzg`;LLXc@AkbwIUkNbz}sC~er)PBM~;Av|2 zvJkcSx-oqGD-{*JB^MBtX85)O;f~$QW$WxPZ(I{RL$hjW?=HN4BjO)jfat&A2 z2fRn6GDg&sf|~vTYvaSY9*opxZ}z}5Y#(r`reE@SYxV(m5!mQ_r7Sc~c9Si`v-+*~ zIZI>3?D9~|4#fiTz&IQD+{2gIqaW}~zb-grfWvv792NqfODXn!AO-FUL(#hQpNpZ$ zi&^9Gjpxb!tAg7BLI<17?5)58+#h*Kr>L<{jh&@SAWZehB1^ z9f$A4E%SxK%q$Kgw|&Si)BIY&7iO`QEdK~FGtL6?#$b_f?)``;&(3*nslQe#G6XZQMBJEa0C2>b<#b-1t&uSTfIz9y-Hs9=WLJ*pCwz^+>DluakfBK;Y+V z`Y#3V`!O{qy7a0*$X`}(`|9Fy(adf5!euNm0dz15)j~oCmdg5A+}RaI2Ng@T=s4Fj zamB}s931^pzKI+7Ot&6Q$fF+vp3k0dgMXg|P~h=i_X}-s>?aJE*gnA0{1d%5?E|`g z0uSdlm071aW}QN_&ilkMOGsVgr%*rgIO&VC3A^kQee%w4#VtIR z)p#^75|3h1(n-GnZ+>|!Yj{qU&cU;KN3jmo^drehGE)mP%nD_Bi>YrR3ua#K@OqN> zgzzSl=MO}24sAL7Q(jy^me|*uyk6uzKpw@FGOPV5s|lWU`+(=Pr;5GL?gJuB@${&3 z<2B9i;XSX;jfI~A1;gsx`Z}j~bol&Bg5)tK>f4+=yY~T~=)C86zu5D&S>`!gyPsJ zGi6^bQRX7 zY`{O^W)sUDRU|gHq{`8d_-Lz;@8&1&FUC4lHnIQWn@wzWgpzo=sn9G(R#`O4FQh(p z(3-#>)#lI2KrP!E2@n^)`4Iq*yZ%|V$))@i{_3_Pg#bGm^@j;*XckfyjrNh`uFa|_ zi*j3JUv2<}$9--x22U7C>-W+zZ~@HOGNKm9&|%10;M^kiX27(w|IV%!owI+dzt1oodMxy-}O}aMpoRn0H)!|bk@`K0d zP{CVHPT=bXnDe*lP3Np(y`?T?_vX?zjI#}ADI4k4;ZtKiD-^P$>^q{-aFmO|-l7t} zAI3>WP6Rk}Bv;YHF`#2#6FIf9YG+ZmI((`Xix&;H$5;5m5gW#FMozd+e!(PA$Ho67 z=?U3I72#+cMqiO#I-Ibo+IZ2>Xdo1?g7K+gtvaDP!<2u4io3{Iw>bO@TuqcGQZ8qcH9{1ag2qVSG61hwCoi4hQ}CN$$wYuE#HJ zAHGl*R%ee`zOm&Yzg=HeABn=4akcN<`IPq!p%uhK6G>zH>JPX{)SQ%w|x|bQ?LoaLBKI`TTD= zV5r4SX>nWHjUHwhH)a~yRRKHb$AZj{MkN_E*dAZ*w?lCld(#a0xn33JQY>vuAk-LJ zS0rjf5G>P(P(<$hHGa>OUreX(vK8xpnM*HG8;Smx$?rtTqop?1TRc2gwnQ6GB~=?E z^XazDh9<$b-wyd~7&Bc)PB@Yj!v{zg2Kx{gf2w^z5^{kMBSrR{Nr?RArh(Z(?mU^8 z#%fMBHV_*=A!1jI55#>nCAw}_941vK#kFw9VSO!C)H@ENq~zTB1yMT|4$96TA9pzE z-pOz9N5+qul~f=31(N2KU1N0-7&%5x3<%Vj$O&2hA8qd)A64AT@aDpt8}F*ARr<|lnz$xAR^cW1eDJ2^_-b| zcSEw_?eF{g@CVsBbLN?I&YU?@?%cWd_s#{Jws+XMD5t~JmBTI!cFDm`{JMAt3(5Qh zrs6NB+{3=^tvWpm^^8jH;-`BpXH3=4>SYEO6Ix=W59av-={mG_aD+dv`x?1qrbVlH zw5Jcy-C5<$>80x5s!b_Xr;U_KB3P*AyIHulw(tzl?ng>HH zW-6MKC^l#wEX30y5b?;Q?D>D zo4=SxDW2ryOO|pM%hqMR7rFU-F}E6EP2e&(jG8RB>URLv3{AP5yt{-lUsJB`Sk^+q zA6)oz@A=(3^d%I@dhcnANv0H1xi!b-=KdTXzhs`E66V0)$i0s^?MF&Rw(!jNGi8Q;fgx}eouak+mpIQq3>Tn-8;ANb0ICaD7>c2?>z~m zIOUU00TY>#bj2y4k)cPBl$h_rT_*XQ=c;@c<_g=cJQwaW^yfW?@?2Oc^t(?1tqr}W z=gCvR7NKw6q|m|8U-TT#| z@`F55fk!A(na>XbV$SS40q!w9BIf+*AmFKb3OK}ii&r#{^ZK?jw|p5>%!9@!McpTf zUH%Xc?*UJ8l7HDDxdg5gHyNMeZ;JN}rR#AB+9A3d37!#$7;p&i9N(-kl=<|GK7~DF z92pvIQF#4OAs2b`khoaZDPV{}^w#Zm3P9by{2xhE=r1NKv+jZ@@eM=lY!f$~0+t)1 z-}Ch;;2l9vJbDTki1uodr_^cSIEjfBP6LCuBjc%a8c>JhH5jk5Y=BpA*qCgv-n|*D zXtc72`4Qbaxs#9Ka-#AQ0$E>@RDfx!dru2@9HwW4LYOA|OOKKxDeW|{-^e;rd0L$Y zI!Q*y)4)NKFQ~jtv^-CE@jobfSLdX@q*--xDoZbj9?&~pX=i& z$w}{E`A8%EXQkF=rD)UTu)c3nc+^VuX?u$g(*l`XypTY5fOXkj;v8!v`J4#7;52ZJ z5$ZkV*>M_p^)TSsbsCs>*u;uPhGChKSTU0f^oRwA3wgvlM2zFah4s*HA-#&D=1K3z zTA7bUne~VHYzFvP#QY>iwJ_Aj>K3jB>N&b;E~Lnu>k~EYQ44$7w)arijG#8j=VFoj z|K>nLjh{3MeX2Fi_}ge4`rBxnYZ#2i&y#@~_xrn$#zTk*fh;g3KGTrnS%OBKYeV)n z3+S<5gO$Op(kDcco>d`2LPZ#^IPhVUAn<4X@7r#~?~&c%3? zdlb+^$v79A?**o1EEy*^c#b^EP{d$9*~Mu7E(P0r8mMmso8a;sI}L24U}sJPyC{i_ zI5!)P`7Rl9{vrp5oKwQ_$!3MNhGVizhJ@r}W=KdqW(=BrccIBbQ!-HdR>uk%H0u}* ziiB)?`ziO z;;L-|T%zPna)M!hAR8m`rNRD6V}B*s10C$I1bYh88RnEcz7k_CV|_B!|LVf^rTcRI z7=`1evc0;py;9jW0@(ps?R7~UFTRz%5sr6WjHW51ubk3Irv&NSLSmj0F%OfL70k&A zb_Y(0Hue9to8y#AHaM(T?gmom2)*Rd+^zr8U5oWIZ)P`dAj5|-{3^akFv2Y}t`Tnb z)^7hw%L60a)B0HGPoQFPWMQZGtHxrdG0UeK>QjLl?MV5ld%dtpM3E}TX_;dC zaa1GL6x*T4M?3W7C|s%2Ky87GZy@eh5DgRXiIMw|miv&%ef@EMDuEka>X4gz7tbZ6~&j^t|(UQiBYlVN6{#DM?s4(HrM``BzIqPMm8uxJY-M;JtX6}?R%0#V$JoKw7M|$=Ih`EcJ|OvAg(#E!M_ieaf)@u2~Dn!NwiLA7q^@tXFSS z=xSI`CwT7Mrf^U)?mGiKXEOSi@?@R?+-Ct#&Kclx{^)TANaK(GXMizhOAZ?1DaABx ztmDjzI?g0h@weJ>-WBxtjw8TLeHl5Jjf2Kh29}b+U|=Z@1|OW2MsEN$u#{{>>rP`5 zDVf0x3@OF=(C24O^Kq^Jy^ww(Nk0kOBZW_s5bc?Mv6>Cek=89M++TX3Sxz`M(q9C z3cW?__>n6rcB~oRh?*g>u?}7PONkjq2wr?MnAf)%weTkPo1yxQw!;~*!$ijpXG-OC z;`WeC>PzYy7)te4LsDyt%#x!0)1RQi1|i76P5K zAqjj$&1Eir7Zsl*Ei*GS*o71>{eqhp%szcgFyx-tyTc_jKVTk83xjDj_g6c(LZnyr6?Y_KMh>I;Q< zIAd{X_TP(=lwRe&Rho|>u1g}^#u&D>!WJPL;ntO=B&(AYteW@A2Jw2Sw02nq>se9) z*eF%rS5|R0(UUYTqrZ^~+Gy$uQvEn0Whb(1%_f}8;8^K`$1S`gToNpUO>}VkQ+wVg z%t`uWs6v6sIF{)7ZK%SJk}>iO(A#A6F5_8r1~@7iE6xDpqZyx{0Vj+uWM{6GNV<*_+wydklSa86c^}S>R7Y z*jQRC@{dXHEG>#WBVuu`bIxRZR$AsdU6^s9PG|R$*pByBwBwa&>R6KT`V?|2*| zq%RXTjJL5QLHE2j%19`EqYOjoxN>$VeWMH?r$dKQld$Kk3(L^o-YBP_hsiEjB9zsn zNH17ahJEcD8jjlx6^*R(%1D51WznDF$DG2l#_GQ$s{ch%OzQuPV8+)!M)#%IWUqp> z?yE(2zon3>-;V@VmtnVl&a%z1I@TN}VO`Ob4Lf+gk zeiVy-LrTcUHJ(DVg7TPHdRaw85j<)=Cq5NCfaqs(@=}`8YZqIU6*w9=FwlW!$lVl}$ zSrr9Y2|mdmTnYB&53U4jRwY{eE)i|DST9%^^@40u)o*3Q3+fAAv0mWI?c~eM^kp{7 z@#W%O?hVK`;JZl@N8e3i9KEHg0`~~sP2w2aqN?o>I&B=nB&-0<6~X$XrWqD~WyRv< zFBpm5OOl{@h8e|c7%Ne%daI)9^^1bh$tzT&xk^;8tuK^|_i)e*6Wg_V+eN*Ls@V!{ z7X^(%CXo`sH$uL)nu0Z0Yxil=C!H)j%6hF)Bymysow!jK5=G_7M#`O9<(HUIvdWY) zR^`=Em1jl4sPbz9R;`iS!gh=$wei0(_WD^HzhMo!NcBcuqN6BKSm+h1Wg1oeiJ<8&68nfEq0n=W=vV>RAb7rQ?;yNd)=6_AM+@rHoi%S z@h6I5pRA#f(#6*UlgqOEb!D=fHz(hRsX|y-!z}!MHS&!sD_!h&kuSc=M!r~O*F}{* z90jAYrv)s&vQ0XB1ETGE3^jdhrq*_*Xj|$cTicms@5yo&?j|AHz9HJyxJW_X41BZf zOYJSxWzrks-Fx#S|1J`=`YS~J&_zc5<3{4yTKz>AmE7XC#IgE+5Y->eAt#(>mlgfj z3R-;qsk^h)x&b51qYNU7b~RL zOT-;Qx`ZU@aU05Vz)HQ?SfaF%eT}w6txN0?sG`aErmT!W4KGn<1mX{lKwbHRBhW6E zDZzPS^^LXQhfxcrnab8^3;rgE#ab{D>LCwk^o}(?!ss%36#8D9?|U)dkxOhB`d-Xu z%w-bREzP-3>yd{aCAZwA3^vV4G*gLR#AxY4Z$rA7*`5^oQACK|LJ5&Vz!L&E zfCZDDJqtWz6x&_a)AuZ}jv2+9s<2|QcG}46^HdT~frX=RJPP);z!hsJiR?VgD~}mB z;jrmx{mV&Q>0gd<<;P1E%;VAi<#>Ag$fd?Do--A_Tu$P{IjJaqe6TBu6?=2EdHY1s z7$7RuWOs`%_PxQ(9@v68CKL|WA`cglFR5v_?C^4Ou)3b?>Y0RYKOe@F<1kaVCMR^9 zxA`zmD0h(}-C(Tf+oq<`caV{Aq}KOCkubi#lrUD;tx;WvN0F%OE6$FP!cYqtMWne3{m*v%Z$R~jF?lk!h+!47BCo3AyWFPhJ~%x>!W_n$oAtw67R&tJ!YN1wgzep8d$wE@aD!MbO=%Oej6+J4D@fDRfv;vv<7>km0 zoLZ|@Tq`P`aa3FztD;HBQ1^?pV};8VtaliR3b3&pmp{puGiYrf$rs4PR$)uMToyk& z%ke=;W8wIc941(OE==vnWCGgPLh+MQfGJ@}i!q}8AjEe`l$omQK0Vm2*Ean} zGPnU%)@1A}XKz69ndilZ`eiwJ=2`j*rJs3T%pZ520j|HIWY04ejBSojqRnxwfnQ%v zn!_((@tY&vm*dOe3v-`hkclpT>Gt?b+9Py@UcLM!O22Z2?SMLM9MB}>arY5vi?^;Y zy(-m+b4VNKLlGyw!`b4*D)(7bxkgbm`r7w`7GF7zvyJ7=Cx0-2&+&>0`Ny?}$3?>f zM#JNx;lGZCI&CyG3EN5fTa2d3S2C37QSXen%}u1xN6re^16LX=++pNCsjV>l%92~S zkleAR_#$eGrcp?mV!A-aH-)?|*eaBsBOFObbZB?Si#JIYmk!BbXBmgfZ8;^t!UBc$I>FZavN7 z+$)`FKVN9X>(=Rk7RuC8sAGyuw{{J*0PDf~qI(Xb1i5-GPR;h72HF~9ylTnd?2!z1 zwkJ%+Y)d-ZZM95idyqfa*`5|wZZJG+SiiMode^^}ncgkt4^Hnk@CT=No@CZb_?JzY zw>12n$p-#m{vdoOvXc z1DpP15-A1fU7p?StE-JwHk!ImYO9=;y5q-8sXJDUZ=-7Lj6yL=RJ(?OC%zio$KuYy zclgQ-1_R1VSQt>AVd3&?Y()l$#6}U5NGZTzA=kS`!P>>{DqR>u$}?K_V%^eP_ZXoD zmY3c-iWw#7XM~E?@cXESKS#l+;Vc2WpoX#r*p2??xWH(w1T=b z`zbw#Ak31+IODXLPMbC}2_33^SRzey_q80*^zvZ7P|`{9)i`B17(F5jkvH2Y-c0bW+V{?&d0M15VJ6WY8woX}oRo(T2{azB#9&JP`IeJ1vqz*Jtymyrg1 zR)IY$biLiwn!_};Nz@5ox3Iw~-@sGY=Z~7qbkX1JF1n`zyXYPJkb^iL6OcBY+ zQd@lKSzD~!e@5kgDT+k*{#20S`(wI4H!nwa^zauZR?*TAt|*~pa7BieZ&MXg_4~ww zE7Ae~aMT%GQ7(Sau_l^GgBo0s=L(n;O{5fHSVhh`&Za6@18nacUy&iHYdt&`t=p8HKgY7h5@`?kt0qMQa>d% z%u6fYsaUJCg{K4p*0-eV@V7xQ{Ph)5df=mqoW1rWmvw|ZVQj4!^jmnBBx$tXK3uN8x+F+jRlB(RtgaN7E|COjeT31!G4fGi2ZaLjTztN zqK*>lcn717*WA=Fq@p<9B*BaCcul-HIdo$j!U;1U|6IG>=i+v=(iBqpc_VHZ0H0Un zVXviWc2D}eqAcH13h;$A(YI*|){7k!)8*nH)UZ&`b{I2?wnc zHXL7Q>ntM&k8^L}4_fC7vX-FDeL-%D<1qFcU4GKK{3N>k(a;wAr`R525;8RYDqeT0 zA)n=Vb8_&T=vVOuGdu5Z1U#Ufto98hHl1CtO9U#`R`Hjx?@ zU{EE7xka{mGmJd_DoKQ>cq1K?y?CC<7+gsr#8o#c9UId4gZ;M|Sxc})RPf9>O4<~H7vB{3hP;6cxgiJtVux|%5!w_Zv?*@nqsm|xU_>R(BPQNxH~xr9^P;9P z2{FxBG0nUix&D%PJgySs@tPZrZ?82nj?(7&Mr4fN`cWBUbv_=|c~caR&HuaL6{~Zu zw~Gv=IN^Bq>sr~@McJcNHVnL8>CGoCRBoh@+T9z7kicm4cq3c)*DGQji^}oyJ1DE0rvvls$z*W-WeD%Xd)ZyZUBZ z`Gb|@(jYwxFbQe+f285>xLH9zuQ^eP&+u9^Es7l%sWO?Sq&O~`z0R~RC+vF~r-Wh0 z&1PNxl@a?;C0QX{e+&B&C#gT1j3e5EnlhsV57PG@MZKpXPDj1xP!x;a^TdC|O2e7x z+TdSy{PHaa4u^4YNm$amBsY?1+Q3h#a{n*U%oe# ziC${FnR?IF2AeAe`|DN(_Tagd*@KVYYMXDaz7sAf_Z(2uRJ*A1)zdgV)6`@`onP5A z^c-;cZ3-s4c#)(9qgRKaw>n@>R;|_otrmgm+-8fgT0}A}XcE$b>!rbNz0K}6zg1?p zd5CFw_~64Y!r>()(!;(64?l`d`J|eCu6@Ech?H;|Hb{k&CDqWR_A@1J@sqegtJ@W< z1`l%K81hMY`KU6(OZVI92JCD18@sI0{xO&tB{X`}BC(C$N3~It^fqDZC?5OUB*81T z(Z#}iX|PES?^8ox^}czJRe$FM%YA7p*%o|0#q(Kd-~<9^XL z{>{{IOn2;wf)~Gy^@CCweEO@MrSzI~P8ErRbE@R@wJ`G@yN%~m*~OdmbQ_z57>5H-t*C>~w^F2Rd$7IUj2UREnAX`8InHd!e)xv#Npla*B%?2JuJLTvKB==WG- zJF@&B7RX`RUV5*q!i9S;lEP_ND@ZFP)zGBWy_{*>U{b5^Rj|-9CSZI}g#jbEiGp># z(1T%Yl8SF?B5Ud`RX6}W(1g~rZX*lNFdmRz@Dy3}AwEr*PeK8XO71?Ekto!rr5=n{ z>87aE)OO~MCS!|s=2}gSGdJW9I&*WfmJqOvm1CQ1V6@3P8~9aKq{;dUSo|gvA0DK> zGmj<*R}~)~T$MijYEv1S)ZnUYt(i>~tYAx^jz8Rzvt(bU6rNI*?EzQ?G!$*Qrt0u! z78bK+*@)|HM0&NV%!)Qh1|#(_lQFcaxa)V!C_!;n7uC8UUWsZwK8i#~J^G)J(lA(A zjP?~y1JexBt5s!2bViWk+pk3~KT0kyA-t+SH&)!Pt+-vRnAl7qH8Yq2Y_H05zZW%Q zFUV`iG}kAn_hQ}+OwcJ!m)Kr)X4qN8nS^=S;M1yHns}Ni-C@2JTeoGB$8NrpWM?MB zdAI?iENx~&$Q+~pPTeMFn$d50SI;7o@nhAJ z+9+y|XiKGGNVKI^8*#ja(# zi%(xKjeo_&H<9KKM!Y1@%*~s#4fsCzzp<7!32nMD)v9;3(5kr%!TJ`nQPtRh9ZB-@ zGKw%xSLHi}0aEzf;Y?KyrrVg55D~`NsthGV?=#ljV6;D>tvmXD1rINant4CX%t`Dv z!!e+mOk&@=-;AJJ`GX_q9*6ZC!#Y&6)@fl_Z{`oOKG=fBO(^a*D4D7_#*J;Oq0zSb z#Z+)Yx78?ti{DoF`2xO>U%#Lp~KET$ry< zVp=sujP-}nJz z^n*r?>D466EPbG4tHh`gYnS0syBv=KGTMA7fbs3Z{Xucz5o*7Ap0ZdQWw97##{;$t zFBS*e^8me*5n^$*mQgyixMf!mbZ#j>fS)Fg#d$j^lK%7dI8dPvM;yI{A}vG_p-ACfAzATV(Y8^n#YaXhes>g&7C$3sF&6g~@b32ruWG?4^|jd!7*bvF-Jc=V z=`x8edC(>p%J2b0s&mZh*phZ;6c|#SUPjZVL1}ha&8e@bJ4&)MTG9$nIn?n&?becB z*Ex*wQp>QG3RVtzt_|j4Vs*Yr^f3#<$|qIuUYC-;2{}dyy=LUO1&mhq9Rf?V4od|6 zj3e<9(E!#6f)-$zWT!tw&yGQiUSlc!{XSnn-fthHPMDEuU3KZ4>#DPJzVVPkG<2@3 zPTyNWS{AUb`faaR*z}NXv31oKhMW<~B;g>^fFlo-}Z4wF| z=GsCZUDA}RNs;cmx%&NK3->>)V9lg@61lg_XPf?dm~oPGhqsMKd{A9Fb(K~olGbWP z8^m`sV}n>f8yoerRZ&#>*&PBF-=NL&0~un`acYX`**|ED{vZ}@*2=cm57n1NM|6`A zd+ir{wQptYbwI51ER!K$MmPLYov#AE$g~VO_)~mmJPGz&nFobu0ZHZs!V^N-Ns9gU z-$^0uBT3d4r>k>q@h{W7%^O2%P{8Y2o0z%Y7~)55-n(0uY*pJ3v1T0~HS3lr8qL~T z(Bhj_Ogce*Xhx7pHN;6L)u5AhXw4C%M<4^3RAX8n3(vN;Z9J*Qq-@70O(G==uh*dK zzR;SlVbPuFmWyl9EnlV_;!S&ufKzISH%(+l2~I=-V^y6PRrTj65>=fqNbyx|&U>^c zshyTyFTJN#eNR+f=4kd_4PJ}Q_|yP)LcC{F4feK=S}Q#p+$?H+!=(0>Z8aF!{vsg@ ze+i1~5x%A5%gEtp|Blx<_KJlXHYtp+YShWMQ0EZ^>n|}DFErg-gP~wX8@uoQYjk{H zTWcdTO0X7njJ4L}sI|^Tk!Y>21j!wpu!Qti5Qu;&YJ3?rDFHxrm6}Dnp*qd7w~az- zXKx@g#|KpBeba|Xu~kHMs)%%&s7rQwMljEZ8vNWrC6Yq8sQO?FwfNhQIvindNLR2D zAC^yvW#r&WI@L4jjQy99s156(UEd&8?&7}xVStj=K+?Q(Kr551?fLi|utC^(CjCi6 zzq+ou6M@7$L%b%I_@W_RXA{3Z2fS*C*L#kh19qh=cut=K_7XqVYO&v62MTrE zet6;5Swl|cGHtb+i+cIn<@ru*WjO^*2Lz@-eY^(I8*UR_=TNKu|RY>CP z*Lxo>bk*s0GVrR?uiC2E3)1%qG!kj+LSBLyT5(eEBKK zU;`wZjB!d@!0%*SXEOTgjG@ek*EHeI!BC{VHzfMaP+yhO?K4HU&lG8&Wsf@TGe!OE zxA4)U3Mm0hm+PK)J*r^c*jgstGvqTM$4Kc$injYqvHMw4myt@l&lVe3dW?~oG}?Wk z&}u)XO)1etJ))JLrR>N-qm?(**-C76CrgOo>zj;)+VK9zjNxD44;p?bS>xHlglEiD zLyQ?VXftdOGraMbg7z?AgQ&EEl#E~wUwdg6FvT;O%L(}=DtG52KuQ?f#cB7D(w-EW zV27yd?m%^=%LR?}JCyXf3LQ+JOC^h#;|0U!HV z4_&&cf7d$xE;_dBV4qjU?}}^vtPTp+IEw5m$P3{QY2c|OE_R523h^DORt|uCYy|pK zd3ZW>M+XHt9qQ^xUER?Eu})oMw2-G>dw3xY%*4A+t$od5ZgA+GPdnYUJ-AqVcn!F*+Ev? z_Gp%|?c0VyS8|R8k#txoY%v*|j6Z&6(py~Ok5#jcKi-;c{PFp0j-Ry2Uc=f~`{PQo zveG@-rqZK^L09@43nJ+vmx9$!H$z|JkJU|jpGG=sBVFCuAk{Vu8mWF~vC&;Fh1*TW z5x2+ZQfSgy!ISG!@OM_ITfl1#Yxi|2L|8(Ee%KV4rmK311t|0^yDG0?&{ZvFK_m@v zDfBQI(~Qu4OnSSv`34*5HydfRVbDm&G}026!UB`A-E^XNO!_^ybfP4`Y3TZX)6nz% zwD~TV!e+zzwOfXtFWYH{U8-*<`;B~B&mSB{aoA(Tq@FdOH6}e`7_@ZPJ}V}r+m&mt z8)vJQ=C)^zG|xP1q!~?Kv3?!HdQ@Bg2eQ)oiCqd=zj7CfFU@5N9Mc6Z>tdSg-ogbQ zk^&5m51Rr5b$EP?1sEP*>|)$;iLg@cM-A(0-CYiom7(aO93yv!9Ew5D^%>URbkmK^ zF#%+CjxkQyFlgg!VnH3Q2b+vTx_f-bl9b1lYvj2(*REugVLhQM$1+QZ zP$SHZ0#!CZ-)NxQ{tM8Jcq0mQu>pEr12y?CKsVscDA1J#Xru;e`Cot@1I`Ut8pZJ$oUs~b_J6=>h-Fcn9D_4L<1G3QIB9q%iW4?CFKe6? zf)i&U!zC7Xkogb@%hexdoz*u%ai^+p0=GQY1$nHuM;_2OftPH298`KVd(N&XLFN)a z1kK=dFj#0bJ5B*)G<(ey7^n-l^Gty%d4&qp%wxQZBe4mge7O`WRDUDzU@h=q5%}6X zXJI%vp6CdRvTnv@(Vct_x6*Nj4Uq&~qR3Dbp3%scsf2!cOAig{!z*NES zoM)~go1MTl+#n{oN8}C35#liB$u;%sNH_BH^@cF!3;n9D3f3DGk5*nP7~YTqthY&& z#q4sS4htz*pOfg%#0t55e+L<1m3@pKN#e41t#E!#vUNGBS@=kFzB*ijS*f#JP%egj zSM5<+@$Fji?V@=7uw&TmqWA+O$kGto6PCBP@O0StM$^ai==iB_>V9F<)KmF`^US4T zrKg%-Ur4OBt-T>{ZWyc7HY3zmTBxr?sC|?n#~+RWUx`phY#CY^8NSvsxFbe}s*ytO zRy%S5yYP-5yr*6@8!g}K+P|0DQzHtg@>mDoC-Aw>BN2t9WVgc8ruMxFo(J6uok{1% zBeM-XS5~^OO64+jd%?fkWBHl_(Gvz z0Ea+$zlhjtRC{7`7t(y@t3^KF9pfh>^=H1?_LH;5C2CulRA0* zIl=r0)~m)%d9Ike)^w;Q`kYQ!N+!hQ>W_C4uS^V; zJGkDEm)FxYqlf5nm0~#3^YTOfV176z`>NRNF8;h$ou2h&MB4BVhngEZ`hw9^jI)?Kc!U{p~u=L#P2B^daPY?y#?ufg3(m==2*)w zrOQT*&KC{SBi>L1N$xVwca{x#K2%jPJRC!8o=S0e81wlF`y}_paX9j$yS+*7s|?en z9V{p`s{)jQD#O}UcCdb@e1A@6{fuBB%nz{yBB*g)RfVfgJVXWzeGI6F`+`?x$_MSH*; z*uOze4&9Lcf`zvjvLs&Lz#8;}f?}W^4n_(=sTE2;)Nd+SO+S6X!b%6LsbHmq(TqPf za@dI@V&j0cx+9|NB@O$ez&<&;r-d@zI6`trd6H;xMDzwS8;7#t?yk#wrM#D}U)?G1 zmGUWJbmEUj-OL+e#i-jVR7l$dBh~YQ`h3k7Eo3{W&l4<;RKXC1DrJOvNs7Njp(0N4 zm!x<~7`>#8N0lH|dXGTFTOje)Q&0XN(VVRqu2iZI7_O$gXyGFVTz`Bxj&L%ppmcxJ zlH-+1&G83(z<7~lhl4U+QDja=(xApGezqLecustST`)mh@aJxvpZf|Tm>`7@QVnam z;h8Kv6}sCzlZB^7cY9V?qy?l~-4~RofHGsvyG8RI3FiwyqwWe4ouM=V^@3gaTl#!T zB;?PCUeH;^=GxEl)}W3UG9_ADCi#yiYh zKHSa7oW$=dFExdiDbJPpZhT14+t0c2t|>Ms!SmEPH$E4=iuZU4c=RnKjWsWLexX#V zSPox^toynv-s-Ks5UZbN$`=YTO~aQii08Eqw8Ww`lp8pj-Y)4U zNze3D_}*0bs>}02Plfu={g3r{Bf(r$_%%Vd-6&nrD5=QnR5VIgqyx7}r0})ig)T;u z;ByMrPi$c>2FA)W%L&gZnq``le2>y3_3x>0$cVYv<$1lQ!f9swFP@O&D?r5w<`uh@ zTFR9oWy|Ur;XcWjvQ?pdG~?~93LPY)Q_YHa%4B@!^1NKLBD%bw;2B!8BKp6e zP1WiU&oVDK9u7M-z0&IjFw@t3%E}`J8I0o+jjU zF)|%>Nywqk$Ap}&9b!YytvwYAg`DoD@Nt)focjrS`#Cpynqns8(3PQsR9{o#oGy`N zml#&K#NwVRt}!H%IL44@Re7>Gc0Al|N2}qY=Ed2gDj6Cc{()^wZ zlZ`~<-L;SOR7ic1i|w8Y&+9mh;D@FDk5iQ9&B??G8XW0FO(1e*L0p z&%gPD?dg7rYKSYZG1aVd$MN8zYNg7`A`MlRngg!m-6}Ohzu$=QqTl5&@m?FzX}nvm zwz)|t1sLxx)7wIWhhLJ{swRj5vR+b1^1P_9(Filq?YZkkh0se1b(_B^vOe;n!cHf< z_PiGr2EU|Gd&!Fm3t65c(RW7gG#QD`u(&-EF_`{p%CB~N7)&qfWrAtzUaX>6509sP zLsb3HwCzMUojn3f6x9dyqUt>`Q53DTS(0LjiDHS1_x9q!A73^myE)>XVDdRk5=&UU zmG(z;)SY;WTReC?>Ga@o9kt^d58l+9l1oEYHYKLIHNqt({klf@*G8yS7~$GJ4uZ#& znC+IR){Z#>on|uTx^f>Uld;q-hA8zl>@n^R6 zW~16SCVXsmtJLnnP$sZhOj@O{JyvWMlfindqlCWgZbrkq`|=?gLtmb$e}`K_Uu(%= z=<6NLVCeHQqj-7l3${16b5kol1QUxQ-Hx?aRZ? z{_Fs79c#Y3pKTjS!WvD}Jcm>=x9i7oVlpYgJT%DdW8sXDW*O2=BvtHBt_36o(43&P z`YWm?>yYdCn^URgoJchzZ_=6<72Y+PHmmy;d#LB&iwdonTfAD{K&GwMMP>CCZX2;{ z8&>G=uaMdUI?=Vit&-%$0Stz0yo(Lq6N2{y@p>3MN%VH`BpC;<@Wh1^3Ns_T*9MoUI+NLQJTwFtZDF!IKvsPr9ZdPx&^uCakljNTEMK;G=(EVf+s<=W;g1i!}07>q}vFx}xjqx(Nk>m|W zP-6`5W`6Y{K|R#*f7v@?vAha;JH{K1)T>k1Y%F@}wGM`%TBzg<;M4Y2u`JvMQxBBD za$hKzpJ$-jsN`&bXZU6Fr%-K%Pw>)<NB_>pU3y0iF@)WsSr~buo3>cWN1d-qcKTQI;)rt4_~8 z=nrJt8!~F1QpsK9*fJmOIBa~D2IOkW+(RXv}Cs;ZK^0X!s`tRLw#>u#Zz9Hy*xT|rE< z7ZsvzzCRGTr8ta_nmQQw)hZF=|3Q&(o-d;$MS2%FLS*;&KNBL78!1VM)jb>`W<2+Q zB?Nb^OA_M5bB+*up0|L++lMOjLV}v)X*X1%5hI-JsI}mW3_#*jLlt^+d(cxbRN*cs z{{fTVd#FMmT&5;@rVUlN&&ih;A&^A)Qyl?rm9&v6S`Xl4Eb)z@3Vl&WP4a9Ss?fnH zmoB(Ttk(6oE|)G?CfAfJvwu5XafXyhg5A>Zqjm7tb*Abp7vA9Tx9<)FLz;}+g?a1Xkrfsx1q z>4V5DFC~2FFdQ-rQJXX~7rW~UUSSzla9CGx*v-$p?r_QTRr%%1kc6uxvA z{x%HJ3K+v%a=2iee-$mYVUB40Bkp~VTlm2#enc0S6S+4T!yIvYo*$<0>i~0)*PVuL zj^_R?28*eXBY80FkMJgHtlQ=YPr@UlJ4JXr)lUxN}f``J`|C>m-ZPHBu&?ix>9DDPmLDuN-O5{L>h%mz5E z0ZzLIJZ+(d18}-{0Q!3rWVj7-MuVJjmwU#-l@7?6A|UdCi73Db8{n)4IP0GBjDmg?aqGlXtWAxKf^h@At6;C-B{fb~T4u!lu*dkhp z@wOWMH9-G_rkNJ99f1Bt0Ma9&{ESExVSK5^4n|+0_rx)elLy+h<|0gFZx~$AFmc{ORJ8?c%TL z;;$v}+k>N=;;$7cZht3Fm!D#nAF9g_P2eTrlb!NIiBEVl~NA zahSq7hhe;Ckk)z7w2m2fx185HPM~MSGf+=gJY82jJ%NG#GY5CN#*GoYaM&isOq9_W zGc?AG1cvSJ9E=%7Fk-?s0cP0%Gc~}>1cvSX4#3PJ0ENRgF=q2(Lx%oY8e>)h!}ebe z#w?8?(~maBK(i90nf^V`Kr!*0$a8GzW^3fx35@3$Xb&p0HFAuJ1RxsE2{P9PnWI7G zBru*QIUsY2fW*Xe0=!`Z%+&yM6By5{H~@2t0I=^jmTxfWKtz-`ZIm}O${Puc=QSOa zHw;Q*zhMgV$n2RmOyO#W;Z4I3b>wKkW(D(cgZ71ax`KHUuv4A#^NN&@3D^W!U<1t8 z0P`ha-{b(yF9Hx7u!*qHMp&Q`7D&Lp+d)`R1fg)iCdMKgW1+@aC;|I^2V-FojF^B; zfWqS1Z`nO_u|`-d0lTAvu(${UJ2o3#FRGE&M z(b){A{98rJpBJ_%#1dPG7%deEM{i0KTWs&k`L&Kctcn4Q#8|+I^ss2o0pPX2I*#X#>AiKLU?tHITt~S%d z#&Ubu7?r4aQRk?{^;s5%ImJgMo4$+j@wDL=YM`DVF! zkseWim9_w5G{Bg|1=$v+I{;&f0LV-3`g%64!@DT0Z7^0tj7{X#^79;su^K{NPU>I+ z3iOROhR&JaI9+x<+vxU_T@Hh<|W7~9JAjY`w+2zOU^5YXvbhhx3 zQ+|Ar@-5`Xm2}6vt8Ih{8eu|W&~IU3_M+PNHD1FW?HCToDniQAsF@S6iLxd=e?PHl~_ z&PJG`5vC;a3h*Ni!jvKi_d2&|YlQVS!c>hgHIX-EpLP(Y7DdPjW^{?#@B<|gh4T6o9-m|FzEiMNdR+w6Jvo4WX$ z5^vi(#osJaJQ{CVe!CqI=IQeDB;G#ll%H3md`!G0zz$SaGK-wA0p?4*?d$-|F9J{~ z-V$P`J!ZYFA>NjF+tq=1y9h)ytg`&awhl{l`6UuopL5DDDN;TfR$2ZNyZ)uR{89<4 zeVy`4iz|N!kd@G{Q0otFJl;%ZebxhE*bbhE^J3g+^E*VRf{Fu%ZZp9adTT zb9*YkQkPySVRedAdZjL%#5w9SX2e>VC==B=g9?vWG4YnjU)ad+YUFn%-Y#~K-;F`e zHpuU4$W z1rspBeUMlPF&dZ&_!V+A;6@F&Q3CUB2XLbSz~a3H!CZH~6uJ z{a7OQAqVzj4I86rY{VwQH@2;IX@p%8u}?S%yNV#h##$nLYtKu+(+J;5#CE-6k2&8J zK{!8R6XiP_<$I0ty+rJC4$AjMP+}uC5x%!I*{u*D(*VqfbN-(RG7OvEO@4>rI74RAmrc6|rnKoJ1_DhA(7 z(SycbRM&2{ptMYq7nFV}&%!MZ!h+H=NtOxb3&zbBl|~Y`ru&-oTcu@xy74Q8yRU4c zMQi#Im+P9A=$e+4uHMzc15Qm#VrqKDATKE`Q`z+Mki{MHd`5+RTOrYEvh7t7aSQ4W(r-WQ1V5v-PvlIx%)4 z@&S8n`A7qQBzBtU0Dq)`W6Iy_&EycRJ>_S6c5uA3O3eh0mwqs0VWw03c#-1f#ztNI z7khSaLKi<#dSS@I0;l+iBE`8Pj#mGx9k@>F@+V6#3tM={DSuLzmxme)j9E^WmTk~A zc2g`hbn{SSlbEYGeQB=WY=KYf3Qvo^pEwns))mGScl2fP-|Z)QXLRv1qVG3O@iV%( z#P3x`uCt{je(w{xqRkjJ1cCpsw+8x_k#^`?hKBgV0q$EydTeZYe~y`>{%PyKMu&%QaAHer24ENDP_1D zUp}snaNXf)Hr$OSq{mo7zw@OX@(|}}Qf;4dk=Xi7IymIP7AIqj$taKl>7*m^jbRFh;Zc)38-^)ly=phyJVm2L&Ht!3rwjhZpy$-2+5l>) z)NVj69@YrH>RfqM>&EUD&b+E%O{K{KXiCD>Llj?UCM65sy6ChI3TZ7#0qk*+t363c z9}iRb?n!`kY*n6{hAZ?OqTsn}xWe%v3bk7dSGesp+N|Ahg`|PL3I(qzc=`-i zIP#i8?IFVzt{Q4{R(?u@))&s}h8oVUWcs)prH9*Sb9ChAWWdDLq1=+6aZ(RYoYZA3;{?^rT^(;S$tQ zBMfTAkp}gSkz}Q)&l%QrTGabS8cVGwD=n2UimX?RP#9rYKU1E5BNSSVQt-SwLSf4& zh1z3BC|IM(I%9;wn}+oZmnUhY!ULlfJe5Z(d^lR6_GKd#N{=BcQCAz*e>G~GF$Q(} z7=!8>OIFJIv0-g1je5^mBkHQL#;S)L&V7b+z1FJUIK%qJIK#SooDKSqVV&a=)XT;j z*0JLa>$dSWYt^T<1N0EiizXP(5fcpO#tAlOEyI~1oK+?o&LI;G=lY4{r26#@=U%OT z`AJ6ofs>5-t0yV;Azs#fTRmS_z68wEBb>|n0udZR;S+y6+;(b`IZDVx!sPfz2?^9f z?u$H%!ms}_mX)7uV3??J0T>-waSZ!aq2rPasaM)SOw_vokbUwE|DbCjB%WHk%SK}2 zz6&7P59#pldCKwWTx%PNi4GS)a-MkMI9@5NAD?w~vay)Ry8xD6Lg+IKIDv2>9r@Jj zB^!;2As0ZChgIByz)8GWSh4|6TbN{HF){A~Sk5ymoWfLBA-SeJV_}tz#l)5iU~z`t z*m-<~)8`Av2Up+NfK2>)0l;)~vH)k!YfK&~IAJ3(;hIvi!#j_xaP~Y8%0K&#BP&JUE^!7+}LOG4uj(=7|;hov$R1 z7>u)#n3#P5B>UkN`m1h*RODfUWi}EM?_U7P*_OlrRih9TpZ{#Mp_usi0#Gpd`zZ~{?>t12G+b{2HQ)D66>MW6kiry9LrVGqm7sa&%vNaCvD-lqZ1Zj`JX zewoVOd?kUf>CGN)3V!NeF3TXLO|vHLh2pY#n)`DizK|@B^Ye228QzF5j0x?{qv-ouQyYlWVfqt-6dNHj)YBu0U-Nu|L{ zB#PlFq_g{0C)(LM`;0`Qb9YA~t@8!&jGhTMI;df2J$o5c(epJ2RqKgzMXVRh$_o1; zty?#_>BjrL;nuAlZPw;iv`sFH58^VnX_4Nfy|A|z&UJA)TefQT@O{GBGW{{(UHiZA zHa5)hfzxlewL!uC-f(-3`f*&;$8Ndles4HEz1fWorT)Da;B4IfG0nK)0*tL&wQllo zTfzLc7}nMyf3C01gYq`i$iBVG6gB)q-hz8W`4L}p`9u+&Z7s?cX`Y9?1ucC6B)Rhj zJS)ACj0&qzV)wngg+j0Ty8C+nQ}?~9D&Wq@&6CT;diCnX168t=yrwvpV*m#sG0&kDp~vo`GKv5TKq2mN&H(xdIxTXh-V&Dc;-f}N&bJ*q%}3k_2v4y zI+}cDR#&NrnpimUy*Z*oO|3)Om?p6EpYG-j<@f?3{$-l&k_$J)6Z~Y=OP3~D z1@PlQD3#}pbgrM}&++kxzNZSRyGmwKUvib4>38ms;)jM5XACIiv=)iv&hbZlHo$gu zL4;b}f;reBV72_%DIWtVMq<7+q26&h5-001ImVoYHEhi{X#Bwd)M$6KP#(Z156QgW zMAd9=+OPPM&3P5t;9?4UGoQ^5M|_z8Z!d_&qVtFAaf%S~W%&!BK24Cjxj1`E&eJqW zh=O+eGyLZ@X#=&eluGWT8ItWUlS&=6GO(x=L2CK2xD-dXTF>Gw{Uf6@-YUiU8cg*q zz2S({W1#w|s0bN==5!j35_@y9&o5NENSRuGlwrk%B+m(U=e=UDx>a&UXP{++vOuZ) zfIlOc>8sZw+|n13d&fGeX%XuZ*nBqr2)VTJ^3?D|CE}vEOrNOB{Nc}4`Oo+qm@yyM0;kws3<4L?`lY&Z8lRWosQn>MT zd+}0FdV;;s5RrW;kE+GCs`;46rr^v(p$*Ho5bP3bi~rz==9 zxXKFQLHg|A=?W>`@gNO0lbI`-=?@^CfnoJ@S~=;eniaA2X?=0ZBc3~JR>ZF93Z7;) zE27d21Zhj@xf+=56N&>R~HhWfqWWoxy$oZR~L4WA*-tkUy5+@ZMcfh z=w_U&JjXXH{6H3d6Yf`Hl-r_kwZRzUmQTSQovBdw&MgY?wA`X_MvzKWGYe&BnTtIZ zXgwE*o@Hh^dM*$>Ymkr?)L+C~AgW$Nk~fqc1{SDmJ}HOWXK~*lCalKz5~GRP8$!7c z%V=L;s;gWoRX#e)?o3Ms9`#-fr9mx~>X9Nwe@7C&S#oz!K?KVsoiFM9+$L?XLI{(E zkYfVmN}>HjT8=-0z2cuY%~nWybc;fovGGCW$=RaNcea8jvPEGt8J={xao00Ic>td! zc=BCt?3>LVlhkL6LUU8}sPaspxo0cXUc5!2(j0}_E4L_I${*{uC|t)MTem1Qn#0m@ zY?Pmu>5ceW`UAcefvg~`P3DfYbJ|Sj#7uY3;lq3?k8`3}dlJMthLA&oz7_DC=-OwF zLW&!-) zXgui|gQFPi8TXQfJ)j{ zF#S!1+Ba-f_~}hHLm?;j+w;5%&+DGO$)!>`9o!_>^8Mk6zDWz1bjMbO&rQ9XU7j{u z6^;^CF0lG0n$dNu!f9rlSDhFO6+7wLwwcY1LMR z>%4kkn(6j@vQ=T-Jf)j7&Cp+SOOt-b0ub}xY;wlC#r*$DPMkQ%vEt$U+)lm_s_ZGR zn|QHSa=G!g2*v%QN=?aV8GD*`z#akkB#reEZGS~%g3*(hciglJs_N`3k=|$Nx zxkfF66l0oqgl7mT95_x2{E7Jrb!>Ys7Y3 z)LSOwv@S828HMa`R7&^dq3Sm#1dY;f7LJk^0jDgmjXo-Y0|`3Ip-$<8`yVNdL&eeN~)c@ypP z`e(CnhBwcLYHya(p0g%Fy2qLXc8`M#_~bM{81VsXM4s{sZMD`UaOg7bvsT2fu~6dY zdPy{3LY(J=gj;Ht#Uo7TdJ9al3zG%-PV#y#RIn;^0#Z0P{9Ft;exU-a8aD99DUue6_9rCw`b7%X4HQ13Gfs)=8ZV+(m(YpLUR{lo#-GNOlBO6} zicRt8BHQreO2zcs39_Z(V{PfCw#lXFWRVNi*2df2RCv))Gk0I3D_kQL4svBWw_jG^M4z2PQp@Ifg$#cUE713r^2nAMc-Nh95dB3bxy%jAzoqot@FM=;+^`ORaBkS}t&+^y#h>?RXMe;O&g0ee7pH6I{!T0S zohWz*0pc}>>@?hfOL)MFbC5&2M&3ktBII5^O6KO4Qn~4eS$NoUr z7mB3&a{YKWk?wQiEd{HW@t0MJwBMa?D_CPQI1li4=Z5mni43X_z0DXglXPeOGPX2x z9(|iv9|v>gSmM~ytjSAebHqJE2gmvP6{Vrfk!9#Qld(KeCfj4*Hk0kCZ=1>XmW)En z&^ct_WP1@IbYT9>U~EqGaO$+2IZ4g8DeQ@6__ir*lnhR`4o5Rs;v31}s`#wQm{?lG z`H8i0Rs5GNPPxoN;v6Rf#c?fR=ST`{Q@A)&>pHizXZSV+Yl%YL@!J$ocP9VWOxGBu z-xG!D%3_%s8m1K*sbR59cN?Y!nyFc_Of3!5yPD~-VwpM^rg@sFOA)5U+Z3`4)3(x{ z?b{SyT%zFlVw=LiC8ogw#zGtPzQH&$&_dI-g^2OI!PucO=97gO@7Nf93uAml24Z}y zF=*vs2IGA#>^DV(CDUZXG*UDDS%isR@}^-rm?&O?rHqujw<)}5GS((~j%-t?x>TX| zxorv^_@nH0g$%M5ifDRM&D=?PSx4Pb8>v)I8Tq^ijd&$#?ovAzHIiLg6guB)c+Ixo z<@Tx3I`5t2Y*txb3(j(>~5~V3Wdfu}v}JIGDi@u4-aX zI}&xbgKBm&Tt;ezloU&%SwuG|bFp~LAa7BI6So$wo)DOsKO#WfwS(C7q z*-fRlYm>OY`=z5P_jr?+DR{WYo53H8H!1X3#$XUv0(tUQd!)2R9#EeW3|+=gt^@TM zOUE+ttVv8=rjW$F=i^ST+<%_K%DDf$lRvos{H4@dE@pqLQ!rN^>76^{jwSnoSwem( zmdLTiY=DKq4Ny7OWV=#kFc4|s3>%uk#Un~KgIS~`x$}O_<_>~9LQ<$+FXp+YpBH`d zcv3hL$_NI!p~e)S!nE7<)7%8#|8hLZF1n&x>~lRs)m=va4|R!3_5t&5piB-x@-StMuWM)cz~qZ+EEsRI(T7*{E3Qv^Dv3DjaUx*&BfB<%&Lc3!6tIe)N{5c`hHcDkI}k{O@rWW|)KQ#VsT?ef%fivC+n(OQ0-aS@|d2F}Wc!2bZ&G}t`= z^;a=)#T3q>(Qjzj$sY+rRg#CJFWg+Lsf6>U8#QM|;bhYkgPEJ3(=wQy*5K)eP^l`p zAZ`Oi86WZo^255&jjg)*LN`FY;S#r^_QlkZ*(q4iI@tZD8=AImxk?P%3{Fsg5A>^K-F?8OwRQNA_l=%kf$M%`CS;!;)+4gnlyZx zFgKT^GUaZ=>mVrkQkSBnuqD;9=lHTBP~50X4*9b?o8QG$Dp=a{h_>FPlJh$I4O}N* z#H#`0lx*tDiFjFVN^w%eDfCc&j;-Wc=sU|-+KPTg><%j6)*6{B9ZSj>GW;7epdemL|7>__tPPKdQ)&oS^f;hGqi8X;I$kF9!d})_wz!J{W@FuYQ@gx8 zUx;qDQ8&II^w6$Wt4C*S63kjXahk1|(KKq`l3adl$vTV2Q?^eF%f=QgMz(x!W~O-ca^1z*ost8_MB)5gtSHF_ zX}30nx~Ncp5P;5p6BKg&ndVncQ2(fv>(5NX#T17>8{!iAnc)qEdf-z2E=I~se>Z>F z-zmq}I@rAt)HBf<^R$N-Qzo42&B*}|;3u0iSj8~;!>t)1T4lBE9)udHO~ye5rET_}b3+Je^+oF;o3-=6x&G`7n-_T0I?SWE9`)!)Y% zSxQEJB$$+z%p@GLpz@prfZZlNsS zzN27O^vTyoy72i#x#bGhO(X=;&{zDT#&X3y;2dVxTF&`-(nI?d9`->#!gH^u^L~XJ zm?89bh8`CB9i+#z5eJh#nB~?cnx`Lz>h~P(TTY|M(~fyE-ajJ*+e(_|U#?Kk&kOU% z(=vR%&xAHp06T=-i{kTpG)rV~nZsm$0INl}b1AH&I zotghE^D{c*fTH~euAu#kkuTchtsX=_{BGntrR6*&cq3QXUUf=Lft0YfJ9^8bwFRu% zk3KR0tzn|GuK=&eW42FLDBZN(Ow$f_N!#wFFw*8dO~xo!akA;vKoj!`i~iW1pe9)W zYN%9M7}U7FURnIMLcg6*qhX`6nEWmep>T;%gIa&jWL}8tgc|I)N11kfK}h9R*}4fD z>bw|gP>;ubo3a3sy6#sP-~(9i<(?7y71CBIcxLWbXv!Z8_bWWkA1n7OgjR7QgGI)f zB3DY0{$ya0_58siU-Jix9Ac4T+9hUT&{%Ha!vIV&$B`aUsb1g_u4LTrDe$fSN7zHH z_hffozGiymdkS?r| zXL@IURs=6&k6Ry#3WyW|N^uXR=mG>7_#U7XAp~i^w*1{4dHnq>e+LjI&kOvW>kW6o z0LApK_Y|yk6fx7Ejln|OOJS_9ZQ>{){z0Nh{)dr#niA3fWkxZga}KQ~AIK}p<=UDd zE)ji*i?XZL3Y2|_i-MG0&6vdrFkN*iRA803^O$STpY z?EC5hU@|4dD;R9N^G6N#qk!G?KF_9P0zV4cJ?|?dU4KB~J|pu1m#6gsg%se2nv?+GeiL`@XWW@X&ANGWfcv@n zUAV@MJoi6ayDXM7sUy$*bpCZrJCR37SZhZf!9xn?6KKKyS$3^LN>)w;4|Kb!EUsdT z15tYp$#t3HQdGWB+>9w%9z4c^1DVY91%jbmbRhQx62hH>p@=UWL2n7)vq&>X2FA(o zvDi?;=%YH^Toy;yDp)VmQ^RGw^VXF1(Pc8xmuv!xYY#kexM6;>?=DT@)v3*9Lm6LNSVGQBT)Z$fpZGH4Hv?i?GX))}T8ak0EI_Pv4 ziX=5+uT-ff85`^s8$`%2HrOjR7)*YdY3NE|ZDi|G=_68L0afsc!~QCS71W`a_6P;@ z1DWZzL%oLGNm`2mF2y^l21u{p#p<<*2gr)#7zwNm10)Vy@qumP0WO-j(FdH4`U7N{ zC>#$9#T$s^1hG&syrlRF@^XS$BrIVP^0|!D0eh?Li%t4K!TOfk<@>Qy7#EUMBO6G` z_2V-kt!3F9zgakMl@z`bfL%=F;yX$F!bCoPkiAhD?N2BinEj@dfGn^@FR7iH+{Y>EzYOX%yuq6~enY%rm3 zG=DJk&5=Sydrekuq#1@{i)ozEZqsE(yRWZT7H@B0Q1)d5qumS=Uwx#&#vAQs=l_u@ z@dS*PV<{CjvavX+8trCmyLhABA2b};DtKFXYj5N;$5pqT+>zlbTfpv+oGVm%AZn^pJ|Ckf4bRKhHbH}uK|neq*=L< z$1nnamDeKlOEAsfFM-WJjflE|`z3I2dU>1O!2J@~zeG%xFKpB^j zz`kk#4l*q=_Di6QYP&6?t`W54dxFh}c(O#8mcW7Kj_nH8H#BTmrk5iUI16jFo$H-~ zNXUzkQelVfY^5K`=f^S;I+G+>L?m_AJ#BS@tS(++MloK+ofa8NMj}&9ssQjE=S<*| zM{g;M;oFtn46^4ifoak35?W{mlV)7SCG0cvNpS{rVOqwDi+ZzN?@c#i6n2!=Ro9Ye zS&LP_Pb6*KS~TuXrlsmytojg>cGb05b>$rjDLdXq6J}q^L>SFj@<#p+p&7T1n)7#4 zbmZ?x_`63aA5W0$38r=qKojo9|xA)&Lk!>(G_)>F`K`M(txSA zSg<1tcE$B1yvOY4WEbRm3bt_vJGaFnpDAHHK$cIVEDw<7d$L$L1PLRZ9KS?4(#df| zIP%G1HhQ0;1^ll7DB^~X`-Ui}D2m_)BDnj=F76@-zt{WB+$4nr z`27C+_7BK8=RGrLX3m*8cV_Nf&gMhuY_&s>0sQ$p1O-0A7r%E1db3(x8FwL0@cw6q zpmn-{i=5MT2pWR~3wH>b!Wt~!A!wHdbX8G~bSp*sI&b+&&^(4g(UzK@?OgklpqG&k zG+v7z(D+CEfX1h86iVrfHwv=<@{^#;b{Ym`$2B4y|Z|S zprsqpGi3j6hoGT4kN(c2or0c5%H}%-y$^`}%$Xf$= z8QB9n1>LD(!<>tE3QFB1$obe#K^Nl3b2|lHy-ARL^G-o4G;oS^Chrn-?IuAT&fX=+ z1i-mV(7PJ&i|BCuE2q%vG)OKd3rVMeBj5*)9>MsY%r)0P3Gn3|9}W; z!Uv)sJ;;&<5b)E7nY{O7K@R(HqV$@sRD*Kn08r;9FLZbi1kj^EJpu4l0FR&$9P&ko zl~;$5_ARcwqdy=an$9a*qF#VlaVKE@0MMtk-$j&u)z&#oO9 zt~{oOT|4O$xVC$jpxZUy)7%IooaV9Nu}EbPs!6o+FCqsh z{}z5g`AtAVd8}xp5Rvlu@1X;cec*0EJ#-#Zgfp~T&_0OlckC8apau5|=aSum4xsc8 zb_+`SRFM7i-GXW~V61fhvs+M$PX%>oyGPJD_~G0m=t3Yb+au^sjr>43i}ncW`YHMj zg2`I2UJ0&%fXH64N6>67nkSs&_Xz6$sUYW~J%R=!_tkp@{Rg?fzemt=jhri;`}PQ` z;!HS?7qn!V;G{w1@#r2wcUXB$wDR~wBj?Jv0TkwJ{h&67HVEa(Pvb$2=xG68p809S zm!D<}e+UeA=BL@fAO95Z#?VS8UWJawh6dP)%IwzD+KQS>g{q{@fT6Jji@s)R2dHuveZ$l*p!iYSYr5P<*re~6{|}l6 z{j^Ot&vrpff3NAUG`&mHUu*goO@9;j!I!Jqs~cAn`$_X?q^jo*RnHwD zBO1C}INR(MWPT>ddEs6`69MhASI~4o<8)W0yUuiR2sxiVX(ARS6VYiryq^Y>Sbz$s zK#n(jmx5-CI1NMRb0GDyi{iWvjtayXu?sXmXq|>I-1a%Y|8Wr#H^=V)U5($Z@!RF4 z8!$k(2jTH&D(ZSgbybuB$`z(zh^ajwRFGYVTpk3Cv+85GRi6ME@QZN{~eh*eht{aW%rG)&2)}PyIaEvvWo&rEF2>=z2oet{~L*TTkfPZ;RD+oW{smik7~wtKOYqxEHQ@K!if8I0K$p`dH4%U!}WT^gn?hbuKF5rni~@5D1T-zGBgP0CYf$zok(#M!mKHZwSrka znKfIno?=!uSd?^(VRmeM8u>vQFT^4~j(m3aUa3^@rPajhM1ma$79Q{t!OVpdhZcr# z&e0pVLh2YP&U+T&R1u%`6mjLn^}euC#{d}@0Bc~eExuT9+2b^6(y<7)PaXM${jZLr zVeSd!`1m}Z8BLUd*Qit5WB^=wtO9%r^3rbkhA+&n57?OrVL5ey2rA}AGpjvyW_{g8 zh%*{}SAv{+bZ=B(_k^(60-Gg7MGLG;fU%0}(VZ1bRGU_XG=#4hXKqyWeu&dy zeDpHk?c?-I?>JT+1u*Iu@TH7i_+~YtKM;0%-M5-#x7lV_68`Z>gLI?}@91 z%RTb45~Ca{Y*xTfd?4qikgFe12gBz9N!QvDs)?p(m*~N8ec{|Cq54pT;qhGJarFw7P#1Hg=?mj(#v6O3QZ+bUqs|;j z3NjUpQHDG01q6xaVl?xSV1keI`1~Z!E=fzp1_ialkHueNU3ny(b7fj8Ee8?IRFah# z=%Ryve8mR^OdpA1O63gE1@~GJWgxV88TzQpO!#exH$ex?Aes(y)_c&d(nW%$5%n^l z6?Jq~x~MA#5Q0LPU~YnTruzNG$tYK38ZMHxO1a*m3tF=`^8A)nA?l4tWGD3Skzh$g zjov7c(oM?3kCxj6r3bpw6=;Fu}#IN(90D(jf(?KtS1q9V>a zX8Je|dSGcGqg$S+MOf{keiptVb}~Iq{y9qZhK7dN8#<4Zpe#FYP|nbtY}Trwpl$e*nq{mymX`F}`LI3z1q zRb>7Ntt+OaqMWRfoJ=n5;r~NAE=|Q$FP~IX=UkstP}0AjO7hT2l{Ba@ryxsJY4k}Y zC@jj!>Zb$3Q%|Nhf#<59R9}`xZ1L(7We#5~7*xW+w~<5Jw+FsKURx`^$6|w02(h7>NS#{>css>!$a51@19C;ZR0%?4o=tO zH}0mo2B1$6+#MUAH`1V6p4*FiL7&psybRO|@bSuR5e4|TrdD7e9uV=n8;OA^htdOP z(Cv4T0eucZ2e(=tOxZ37Cw0RH{Rgr>5xO`WqyiYn5U^Bw@JhgY3p`ZgKghoFtGEGl zY&EhAOS6@8%31ohH?Inzy>OsWUkU1>+{O#PX#nl74HJ1$+$4|@A7j@0Us=mMoB?W^ zNy0m%cPjtxM#2l#DBVY6c%|yguS9g^^of|2(+VR%PcTHuv68B3$9gPCxoIJbTYin_ ztYDDF@%sv$K(gb`)}8DNVHgXaz|!}oop_jd?%|0poH`*(054WN}dk!C#% z)<`oL!oA0|L!jfo0xx1FD(U|3t?H?=w4vTW!d43c<}i(~nOh8!&EWyQ#%?`mz0H#BUok%W zEOPL#f*iN`alDT{Zvj1Wxc3yzQ89>&hLI@Doy!Sklko2>1n?@26$nonQh^_%zR!m(_)#gYGwz`Ox&DU z@xg%5WP?77+CxO$rUwSxQ-8A>uLrczZP!CJosX`>n0@_kg3>Jyyb}I55**$G>V-`1 z0;%1xn_8$@4i57@AEF4A?iQrGM>{E`6nh5lPCDG{AS%OaL~;4NU`Wo zm|{Zb3Yv!NdMnPcKdo(Xrcl%KOdg>hi|96!3(y8JQ;nkOKDwV_&**Y}e!8EdyO+U0 zytItR@i+g(>sz!)lp^#xfl4~?NqtUhv_fm7b~!(aXtYAaG}j6>hh^M}2w+7-J@pR7 zW@w}A;B{8-YcQbR+pOMCO1;-kq+Wlw4_!&k_Sn?I$oJ zHLpU&OcI-T;sVhP1iCBgR9jfM_%D9{Z40;Xiy+XmTNwN9UxL^mf7S;1v0#gA_IJc0 zSxf;nihQEPRZ(%`PSCZ~VVmQ1UDusfU3YR_pZ`0yu8Q~D-&S4KTNkKaCW)O~9T43> zsJd3VXgAla)d3Y<`TVq-JEt=kKKh-dmw~Vbo8LL3K?ekNWar$)n#8_K>OP={&t|&f ze+uV4Z6&>MK#(3Dc_2Mqi~mvL4N>t4+l3>VLciM=rsfOvI66^kJDA8*^ZyRuB~BIg zYL@#SLD8^fqQtPd2s}MbTDa%`v6^rqPyT2%Y`=1-!8P^yX^O;Xw(cLc5B2)q#~>``NwLa$*d43q*#O>es$(e76Zm~F7@GE~s zqDzpd=!q**DLs;5k+QTv&>WfV_Xa#>*rb~7ckwHMjY5NG*N!}*o|Xub`J6}VnS z=%v0IAKov5xhHOd>oXaUxZLZzF(77_^r#-m2?h)Ndc?BZR)4N`3eo>D`=v*vF@wQ; z!-Ln@Ojmz=?8R=|c(Ms|eIpHz+m*x3M|RscCz}v0UE=rW`F&Mnx9vaKWVt@RvgN|6l!~bMMNl`s;l^`|5d~o_`0NQUf^-`hC zgSa1%HGNPZw@Hx!OwoEGdQeT@_NTi_s?}rsL&EuXS4neu&^$_sTA#ZP<&2@lI-FY; zDQFoNv@BAPqIE&bR6*&ZT=W>@-q2$-J;st9hlIMu{&ua!Bf`0>tE8s?3bNxG`>~p@ zudz=9AJ^DV2@qWoxyJs=e=*XNJuOqxT%F=k;lxe(*F(hj+drTMPm0L>_GqeTQx};Y z8cUn>3u-T8nZ*dHr&fBIwGaG@3uujC6$Su{dC$Mr+^0ag>MwHziJz#7Jw~Y7bkTZ_ zZ=?@FI=$n+{xZcTj%Ds0L2GG)pB1_e#&HCFP}!#aC6D!RvNKE zI2UhjPPHsR(l%P~rAoTeO8Pz{ko01W*rAgCzyj#mT?-B=b_rhGP`Eo9-84 z5kB0}PIOVDQ9BGry@iAwbtTabeoT(5M)0y;8hXfw?6{l(Bh*(vE?`?91wJ)vY}LhP zzz7;)e~`nCOOBG_8qUUu-l<2WuW<+Zxr3Nj@2JKKke-l_MP+$Bm_%byG)~6MHMpUO zT0b;LP`m4|<*W)uoXix%>6Wx6vf-CCB%Z7Gm4u*X%&r~jGt^0~(KrFn&~WHTMB?_T zyDpWW;qR!#?=!h!EXma>GcWD|L0cbbp&07$DmdL0que?dcch78R0fTT{75qOr$t8{ z3}kiljXE4)Mve-5rl)+4`)sZ8%NGZVT;!%X| ziJ;Mhy~j_V@lc6d z_|zp!?Y(+|pnXMiEbB! zLK2=EZ`yxhDy@&?!q145?(x%b_}HgHQhK$U_-(`OLXyK!BkIkN{)&;)F#;T~+S57& zPPFcBoFYyBpHL5~w?|dD{nP`^C|N2MZpX2@UeX%6Z-?oz3ion{XGx{QWTtYZBu4{^ zbkm(sVwjXfj%na{=|09(gB7bqPF;nk*5&q98ew^jTcyM(Ct4x?`l}g@ z&|0nF_N|YorB~U~gPA?(ae*cr4aI_&cB7R7)p-M&EruSro9#)~WKUyF!hUM9NSA$3 zh%VYD4>I<5UGPCJ_z)-G?MU%ZxZ%NiNrrF5$@T$>kHf3acnR?qM$*~iS=cS*Svl&G>{sOBaNdHQV z8eao-RuI|HVa{+TP{d8#DX5zGU&&4U8`=a-d=PDdCT^D`iJQ0+exQl_;s=^IF9{um zCcaYVa#(W9UY{h1TXqifyjsK6SR z0_uF9h%(eML>Xli@GO!PWfU``X_RpzGg?L&d9}=G7sK%|XEjAx0p>Ks6kWxfX)&BU zKeN7xNtPE0KVrD~Mjd+!hKeIc)IB%4s7j@{zlP@cVUzY*zV$ZWD*&Z@FE?p>O@wjKtB9`Yeyz2r;f&;}$f=Rgm4b z<$bmAf?+Zyi%P_=@kRJ(`;Pb`Kh}Wai=gh`aYg;yRqimBfY!&;qyURNP2-C4va$XX zU!=ZbYqy;hUyPNY_!2MKZ5`u_P`j@2MF{tM#ueq0-F8iU37UUke340ZTVZ?=nty0q zQ315LCB6u{SH~COj{3L~G;dv8Ng-5kh%Z8aO^h!>t)|5n!QSS@7rDu9TM}P{S}l(+ zg1xPbFCx3`rMQw}RBLs7Q4QH`>*9-GG8^NIpx~Ccq8s60aV5oMx9x~4$%C8hk1whv zyY26|q8nirgzJ%rj&k!G17x=~jW0q2wu~z(t_ZpV{Blk}k1LJGpDdThK%1NuH+5FE zAHsI=g+3$f_qYvT*+91$^jCT61JzKZV|;YbD0idJx+V~NO`qF~7-@#WEWakM zysv>#I0UmDm;m6dMP&*TNJAl`?0Tb`?6#o^5Mcv`bxVAy>8mn4F#qcK@@m6f6RNEN zA`l+^rF(Ax~E6p~1h6|mY zRqhYEtK2>Vrn)2nHmJICc>-~5g%RSsJmrS&^_B6V)kcliz#x!Fj4oZBKxhX2H6~hQ zT>^kVXoS2<)s68Xey`ULqui1}90;>fe-mF^>oeWh%9gy$u;ri;cB-(z<_~q z0Rv2buu7RmVSIqcsPcQVkfO`# z5&(R|4UbVa!0&Sb)sO%c^w!o?128czU?8{hv_!J1T8snp5{ccF?y@3(wcA%!kBTly zgsb)WG4d@>AP)ywioP_e>=!-bBJvE_<24CnSjDp22F90~ zfeQBO!uVphw;W^W&;(MSX#~r#5`4??0DZ}Bt4;t2A^SjlVSR^gUiQB#YS+n4|q z^kXh5%dQQE+#?aRY&kx#@htgGe6X9Xct?DppUr=N0-+DH8;`nw$43O=AoNkZfg-=w z6IOQ8G`_sv@OjxzTE>+Z80AJ-ck)>Y5LIRQwLX`MS=uGQ_+0KtT+=Z=#vD~vVz|rl zYSH9f6JaoD_KYvAK{H$vUsfBchA$3`FRgbQHKwnstgzOosIE23271-WoWi*9K~>cp z><*1D^^|2-yLrUBB>})yHn7%*Adfq>Iw2}IY^Y!|kPuSf4~DBTU6!lN>JlOg&7hY< zpoZf?@GwAj+r)&JVt;5JIz;F88dd}Dp9}+S=VKW#L?Cg(=D>8>0J{&yzJH8l;rdV0r7;iu+HoQg< zu>saV5+G`WMyMJW9oua!<3p;Apo)LaN+cht?73Zhx!dJZKG-pVyvjEu=ni8G$ZqSJ z0OPARJZSKq@#PUizb1h^Xp|NEy#bTka$o{bz294oaj7uA90RA0B!|XF)O-A4cUgf^ z#m|JdBmf272KuZzuDHagGCY3tcp#Cy-0<~HzX97sQ#Fk5OBSlpL?ez z0Mu~x<|UAN-FUWHl0fRK3ZWmDCluErcwHG^YF=J`{M$xXVw3XFLQ^hYidWJ zZnP=hFfhdMRaB$!rU}H@OfJiI^HXulxR@KvTiqP@oE2Y;!rR3a-DvoXa^qGbSXMlu z)(FBdJH`bLsdk6WGIeOcZtEHsgB>Q`S;mU#G<|Opc9^64I)R`+UBCvx!C|J&$HY;^8r|yVFAbGahsH!KstuF2| zai!nm!bVKbxRqfkT;-a?V)(+q#A5hDVL~xBW`-t~Vpg~%t{9bzJV!PptXgE5uR3ln zsNVo(XU}4WjRh9E1=5Vt+L)G|C8sh<@3KQ^>56Kj<=p-E^uIQp8JDuGEW@ zx^daD#om81#ZpX(jS|Ew(Z>1~d)yT!HPCPR)X-UcRq$E($oYLqlDc@zP>ATP$|46n zk|ZfTIFinGPisamfk5@?oR_9HqkSNC+n9wl6~Xg<`fPRf7WlF&H3lx=5$H2qz+Arno}?QXj#;p z`T}`YGSQtHdB1R8o=kLIGR`e5n=5IY7Ca!FAI_Cj0s+n@sd~c#M^mjj{LxKxQN7y@ z&31ECcRoiu8nlltMZNApE-DMRFNC4V??Yay$H&klsSZe`S~;e|U}h#u!bjFpk;N+@ z%1IILCrffn#rX|4HG_037<0iGt}cu{gc3=Y8FE*K`}s%tRB>bJU0qx&tGHGuu6+u6 z&QH_|IbI10-|uBA2UMjy7z%4~X$rd4?+?=%K$|I&94k?NMYY@GqBFr=lxh4*vJf%Q7@|H~`b@ceDBM3g|<;1Vknn-f2 zh8}M91&FjJIAgU@aris$y};286L5`ycB);*(T^#r8?LgHx(Z5_G*R7f6$C!Z(Xt>X_V_cJ!&$d`3`JNHySi`pc#oaDuQ}aDqS+ zrrA{!PT=EWxuD8PQ#XK8)zuugT@tQuQB0u{QAV6viV5ntSh|}gan?b*r1asM7z16E z`9(D4%T$!Q69_jf;Qs6dt^l2I-Sb7CeouxsvXxv6kEfJotLWGag9LtTn?(7G?kw!^$GGdkw#g^xSLZY zIj%xC4yX5+GYOo0#o5Z7m8tL(oUu$FPTw=@6R@nVE)SYUO`#FSYdRs-ev{~J?Zo>d zYVKz>shLu9Kj)JHsvJj5p>%#T4Do8d{e?N#H)u3ArRh<@kWy=$9E>KHV9 zF29$46Mq&th#a#4bGz#3Pfj`>NmqjB4_BK(`ir^Cnz4=AZ@yX5rVx$+6a6lnwKq$8 zv6-X}V{Vr8IWYFAH%t0bBmTn092gBUDysedkXZ;1R5iVaR%yc?hcArrj6P1nu)jv# z45D#-)b4bLB-B(P*H>ES=MV0sB(*H+FTMYMo_XIpp?$^tVGDuzqw_n3PJY$H%mHQ ztMr_7o;pm@_01(Y&mJbJ56#?9JiX=ymFpo1F0Zav>4;VTE zcm{=8#aR&m-A5axx<5KP`J<%Ika=YC{~1(d^8Xu@ntO?(fu=1QP5x)KkmM*p(J_;M zaSJ%1a;R!O`O{Q5&?0;jBs%Y-^wBNUfWbG$F9c!D`;Vh2RW{H2&$Wm<@2`al!=Qqm z_diAPjvB?`d4C5uS|L5}(=_@xMd=fr@}ZBdrP7C|{5Bx0DL)HD?390JOEtOoRWqob z@}JS%*eRK({4ZKca*Tvp@uysIYIJzyXrL7sY82sUAOkcHBODD31{sM4DnP}VCpj7z z1!1FT;9hVVM+1+XD#@`N`XN&)PgHCwgdlCA5i5^aiNN zL_Y$QYIr@-k8Z4~HPH{(bNf9?8#U2CdXzRs8gL#^u8WcWP0CqdenZ^^!^+4XjO|KveEQ@TB~EHcU-+6Grf0cCCQPCq_NX` z-&SmoJiS-e5m)4K;4p56l*5qEm0+4R0m8FB2)j!M?HQk7IQ_i|9>);#~; zR`Mig_E%f6g{ql-EeLC7{{e(GvtMw=F*AF{FiCf6-RDZ@fMJsQoFU0sG)&TnGcXqd zFNt~uVejrWenO2(DYn6e#pweUkfi#u)fpSLT2hvPJ8r>kVp#aUL z`}E`-8wH?Q=AWsWo@Dk2d|;xdnsNNV36;heryy~=+{*k5D%sCC(6f+$5Tl&!BlnT0Zya5YxS ztZXtmb}ICT_^H*IksG=m_a~4@6KMf|h^SkCEP%yeaU+8>L%l^G7HO44#ql9IJ{O6x zA|51U;uu0ME?yTqllX=Cs!h!(txhd~wRh8RNie+j!>u3H^ape3SXCv<%AXOcHUcKDq^zw7x4W%fq@q5CEu>EAZVg z5fEu%qS=ESlvYDjh(>^Uic#PMjG*ZYlel%DgWA{82>w6huJRFoOfV+f3cnZN>&$u* zeYsrDs$OLo1MJwz=XaUTjF3@j4m90W)nO7J2$AL^Lhf;pwE-7viuXh{s=cRLCH<7& znrk0yM8?S@WQL1WS#Jy04rM_*{2w2mXI6$utU3W)HD*w~Rg}%^cj5~XZBsOgFRbd8 zhIiDs#5A8dO8sh7w#p2;VsTKs7?V$39C&}X$8=`Ypvfi6(Ei!LxG>U?g02mN!VHJNqZe=$Dl5TY*lQFWFi`-Fg`t+ndqxeT(8tF+O#n(XGB zTWO;MK)vvJbJ|f$bOsS^7S4^IHz#>EM>HwV1|*H9W@3@^!+@k_XIo{3Q3O%S=K)D$ z$RQRv_Xi}kipa-`={XLBagpkD)XkRVa^VtW8jCj-`Oc*oxR;G+hQPqw=4?rk&mYX- zAhGk=lI*|S-kg5cs?QYmQ}1X_2Wr)ddxkUfj^=bFYi!TIy*b%Nsv6G~cK_|osntk@ z%j&S;_U4qwxR`c6O0jIer`GGkV1_l}B&FgMDY{e=O_5M>NUVxec%rQY3m3&;7zPf_ za|f6h8NtA?{xldBoWI3-$Ew?fTIc(uv*{hpX*>9+osQgrwikk<=k=gruZ%C3U!XgrrmOqx%R+7oCg15sBOB#6PLTndj=n zd4MAE5d1*ma{NHz+mM)!?T>&CplAZk*RN0?Q9W{mdu05%cqS$~BH_kUK}9>`2zSOj zFfj~?BNF4#gXc=Z%i0KR8f@r`C(e~*?=wPDPpx=^%{gp@r01b{kR;C0%eHoGIz3AuU$l43}AH21f;rKqgJ1bi4?B zbmKD|s?$9*&Zd0tg(R-q3rVQk<>#rke<2BNUldXKg`^mjHIW|h(Hlt!D%|Huaukk& zZ_-PQ3`1MTjbQm`brPoJJHWE%2PIYOn!S`n_Rl|SPJT_lmSn$ibaSd7Mbwmt26nn@ zbaNu-y`!7cTqGv@xgkjn8vRC+^XibKCFeAq1!O^7JuyeA~-H3azm{M$Q^ZcZz7Ca)(s z2aaw|XS9*jVeshY)V7TzuGurXW_2+&OXs5E_mnjY_xA^BGOvl+FiWZq+sqx-wT$VKt-Kpa}vhLQZU(BHYdSZMzoRScnMuoNndbp-N8CUjim%nOxDytg{BL2W$`aU zbP4-wh<*_(avU_ijb+fk@I_0M9-?3Q*Hly(^ZlAp>fYtQ1W))Iz{iCD{-{P1{$?&e zMghFcp3#-=BY=X*edO)J^Z#YR*Wh(|%_wB32N1BSYnnmdFn?)BN(ao^K zzuRC*Mn{*!aGL;bh)%cSP3EMwmAJWzcP*(5nA5?jrb_%iudO8e!jPmdv^foPz7~>n zA@0y+{x^;I8Q?ckRRx7XQ?GfJ251^hkV?~^(a1zUi`j!5ba`7f75>cO`oOl596zBI zs_7Swk_}{Se>)`Upf2)P;ruQnDb!X{hg~5_lkwv~NYZRe>1K7x2R;?7^#hy*YI9m+ z!J`nw)!QF7!lsJ7r_<&nrT1hhx`c@)OX$54de?(Oi@(uU>cMU@)07^d`}o&KXw^EJ z%EZ?o%4r%CKSN!6Skl>AtJ%`oF)ZmwTS?BYVM#5{$JEp-Ea?J`m?ND-!jjHEUy`#d zEa?(PREJd)!V2a}=e=P`R|7FKEU5rLmV_k@!;ckVNxt(Xai&-3OurSJ>74)|)B8A6 zDArFSz89?613*Brrx@{kSW>=5d@Y=xge9#4;>)n44}nnKcD;tom)vdJ&)40y7eCN# ze?uYkj$0#jx7pgE`Va&g3r>MRWqzBMEKr%B-A-rj#1CZNy`47X`!rH#el_yo%ojBl zTnj;Bo8afG8T6Gli6zP;mas{bwp0DEguB<(&N2x_!z3PJNw}S)^m=-jiMv6R(^4j8 zL0feAGOg5Os>7GI(;faCwBx>6sSzub(X0gmee)?JU=lBD#N)~&egFa{@f&`?By8;^ zu}PfXUYo?bI*B%k4gkO;E^UvlfJtoB2yGJCK%m%SM!+P#&%#9}1!8|IkR?Ys--b3l29HJPU!!yh*)s{-;#ttB@y#i4FLH%)hWQ zKSv{V=06}0&b(t|!OsxHGYP}xqM0;L+ro3o7M^2U_@})jj-ZI1YmR$oI9XNEyIJd395nPrXYf;HR)JJTXvu!fuG2pH%BTEl(Nx&s0W)d#eOJE2Pl zN$GX8fr)+{RFA~AIk)a)t=k6Gx&<9Df7>E)>ru~u88{l4NwcZ9ibgl6C&3MJ+yDoe z(4mg>3j`nr8au)f&D zQfmKNUqy6@U5M>H2VR$=DQI-6K@ zIuXqiq8;|+3~yKZx6nbPsZ7Gsj3w(v^9MUfqWbg1=JAqVL1ToCV3iq09zTwkv=yuh zZvgaf<0b8iw9q_WyuhrRNn&2)0L&t0|AT%Uu8CF`NOCNJuT;|mEbesydMx%ygX2N0 zt@2vXTyTIxh9SJr{ZAGz>4Cav^8L+W+#+rFaB)wWjB3rmVVD`>1 zM`T3o#-mpaXg-a=qYV+RU?mcZ1~};E3nXQ0y!tfANp(?Tk3log()Mq62dxTkSe%_21`@E7_+gy*doW^P_y&VZ~uLaZCZ#(lfdLHYSP1trXuQ8sQ24jP`aawx}q#pM_6~Vd^ZBqpbdUgR)e+~qAc%Uklk*weq~w3#km6txa>2dlH$_7v68c*lKj%VSjpK@$>7pKv66G5 zlA@gaSjo9j2^5Rb;Jm10P*JR)O;j+nv7~KOQarGcYUjsF8s*k5DuDt8gGyq{Y9E#6 zS>2Kr!_%G6A zE_Fs(F|F1q%C$QA;uu!WV9u^{l$EDhU81Z3nw1e{^~>p>Tad$PFNtz<^73*Ei*uEV zU8DTG!mOekWk;DY+`dIw+1GI%-Hzg_oG*=XF^Xg{w0o3Um{XKHNV&#kQEpMRupTko zXknKh#Z`s%jB<-}@^iBXpRQ46}b$US7$-qCuqt268vN9V^pT|4uBgRGav_G0XvKv|HDRRic>h z#V~XGa~bc)vhoWD6{#Amk7XB>aeuNHzV&7WtF3HX7rwZ8;!;MK~<@rU77&rfg!i7PzLhZIk zZLSm{YD5q-S6t@By9XsV4 z0cVEG9W*P#{$PDpn8X)Sqy6+NqugVX_%Ve(x93s-Hh?ZTGN+(KP?hc2{a7NJd z`bV1m`9&MiN8lB#Gp;#ahx6x(im(r2`YNoQ^amxEy9won>jOlkeWJbJ-mlKXJS6eW zoS2p~%H7HYO6miqGb7ihnvIV`Tp`lDVUn=Y+_DC4R|-EmZ-6_}>$IC%tV19{m@R_4HgAj>TQp6aGenW!? zt3-*9ZZj^Q#0*s|8t$Z0;`v^TjwZ53gG7nFM<Lp1%-G;`tOlr@{svAi6T`c)c^w z2vz6f2u-2kb61e)8Mk{>mntVHRA<3LB-RTq=zmy=iw?iB*xXP*9(Z#rjS7>*hPVkD zxlFAOqYuVel*To}H8r7#!YLDMnrB161u60+`@L6YfxV{8mdllF5 zxjAgqVhq9m?dxa|nx}oe`ah-?jk4|7DGZIA8D67qK+r!bT+OT8BE5DaOX!%Dk)r>3w>P+IpL?;-9y+(~$81$E$#pVbS4XGk# zfKTIFmXB-F0i861KU5|rrt-(DU(8Ni>3BX!;wfd$$8)_%JBR(=@=)0CGeaakNjhOG zA5~!gT91ds=O->tkIxnSX|5NMOu`1{Afs*96|^+s5Y$P zP!dL@@Dr%)@sBb?VUATwqG^u(Fee9k1?H%HBR~!Gm_F8zj|*bbnJ6(f&BVeOzqLUV z*~}jT!wU+L*?*Zb>asi@e+8ImlMk?db|((|Ph=3KtHsc4BVbgx!}YX`VcRZ{lEmxH6`bAPa&R>}H4snqvENsjec3H6#@dY*xgUMPtiUx8_z zSN<HP{z{?WX-4!@dAcZ*ao&3m3ThB8evg`$aP( z73li?BAq2OB(1+llJh?^By9!8ZqAT&gGP+EIcLp~^aBu!W=Q(&B1s*V&5)FuE~&$F zGbEjnF3G-XhNKZX$xqU`cZQ_&bV<%XW=QIRAOFsfl$8z*IQzRa_8yh}P(YA<6>>%P zn|6lw-_OEmHi7Z?9SCtta;tp3M8XQCS==TKX+PI_U+F-=n z(j|4_aC5E=HvcQ=8nd2gt_>59y`!~gu4u}*6N~jxq8o|1HXPufbj*vi#0EEL*HIF` z6Y>a?ojOXgH<>AEp{~|En=@mkq{}*Dx9jqmk{;56M{LgOnUb#SD9IU^Dal|2dhx#+ z@u-b^u?7hA;%FdFx*dwWh6f)I!&|U;2W6FNj8)tilRH|Cv5FgGHfXLDt>Stt1A|*< z6}Qe)k=9YPZk;HBrx4vb{D47gYPa3|1Y_UhwEA~mQfZ%5ItW_z@4O_KZL?02 zRR7LPg7vrRWLdwWN%!LYN$AB3I>E^44Nf{3L`e79o1EITSlnIjG4D?Bs%U-^dVX#v zNsj)v@#)J4IhThZwsLuxQ@jAsaDc$)te#-Od!5kpjyoW#!DO(8*`I>#7!R%q?t12a z4K7>BRNc1sC$W|6VgamVPE-IZ`K^<-l0%Gul`PSSXOq}UnqLg>HD*g%p#>Y0oKt2? z>VB~#=j_>%u4V-6=v9q)IEn437zo%=1tVZbA85qVB(|ebEPx$t)q)3;*p4Q!;E~yq zzSn}~NzRS4B|XIg7}zgb@I(?D*eVnT1KYp|7}ybwcru9%>^l~0oh_;P?Zo!}auV5F z&yjR)gmw;^Bk5NLqCyvF!JDc=|Dp_3sCj2J3MzEDM!cme)Sd;XP>vS7p(>Qg0_a_! z1@9@nuk0*|_0D4i^fol&eWmv;EP&pAE!dcJB1fqT`bU-ci`h@cQJr#=&y|~e&TbOu zY`Mwj>?U`1mSi6~M^c?GWOI`9jyaMhbe7awkefAtlW3+htN$S911dZo2o+(81 zjZ)$pR$^L2iEmhm#hoQ$sdD-@2?52^AfvI-p(MmcZ-QAx-?MXl+*y)i((UYAKe2Od z2WL4r7{d1^!NU(C39n)N%JeB+@L?V-Fa5=7+IQjVp^4wr)!UIo_K)UBS{I?62j@uY z+(nYpHdj&)Bw-u*NF(+t8yN%yY^014u#v4Au}|4Z9SdLz|I>nBl_^X_Qkd{OM!*z) z*NESgDLezg3C2jZ$UqZlrcHJGgk&BaCnRHZe6x$y?Gutq`=rul&}b=|kc_6<7ipTA z$rvn?GbB0wMRS_LAWcffCxBaIAQEkP2U^`#M~fKP2~3{;JKjO;T@#bl^v?oJ|CeaN zqGUDwXIRreBQX8<)rk9()$|VpPydW?%#~EA5tEXgm(G)2%I^6Ed|R^w|B*XC8F0-;8G8Ewc?A{ zQs6%17;-0Eht{Sn?UYLEx?;?uw>jlr5Llu#=$(|MS*i4IS4oa4;0;=r@>W(VHP4hp z4xeIulv2<)mAZpPj@uOP+m!G7rqWHBk{r{)anpAxaODPY7J~y<{+@Mth*Of|Nw7n- zGsT{rO6vf885{ujF>o&f`GT%@btA1#;S0K&c0-@xg02l(@MQ{L(A5P3O8I=Qq08{NxseN!S@Ab4b3ATY9Jb+bHlfhg^h zN@bvxhb|DPe}o-nR~*X{cXx;2?(PnY2G;<=-8HzoySuwfAh^3bY;bpnz}x!^-iJNY zr>3fVwx_Flx|A62q7YGX7NwGtzi0v?(64FBtuf#?^T~+Q?tRXK4%)YPL$6H+BtvKe zY$mLm zU)!ap437xi2D$0lj^y#pqu7i|ehoxrVdE8;i~@mv`lyBPN8zc_5>Y#R!90%M5e*wy znnMYu1j(D|I?4CL_jxQs_%Ad0l1XG!8e2j`>r@Pa5!18#>I!=_dPCYf*PfFZ(`+Ny z_H6}@U{RL|c2bc5HwT2!Ym79bhR`cA;+!&zRloDH^6vz!f2O~Y%HV9gBq;LcSMCDK z47FDFjL0U|s-Rga*k??^mo^KbS?C_wSr$ipm?#Q{#bP}*tW*%7T5iB^{aexo923fJ zHcKs!9<3{Fgjn2`4b3wre;IJ)AnJmyk^N>=c!C`@>39kTf2P=RrSy)PRE!;8U)Z_R zznm7f$;h|=WG8>Y8({mAv2{d{BoP6SZJG0(F<^OXK`(f7;B@8$oh{vkFs0KrMX;kK zG-R4eh(4gRtw)K|nGYo4B#+|5C@FZ2~*nu7egx`9)fU zRPih#EgG#u(5Pp1i-WD02&=*9BSc~V%nPoI`J8}^%ZsBffjy8K?8)RYIz5H?OZ zUcQF|a&R^rj-C-q!o8TLiu~H7M7q557V0^kl3gR@4JDpKz~8d_e$VjgNxQbrK)9^@ zexWXS2$ax23m*(i>Y#+;-py=wW_VdX@kfT^TMK$jyDX^RZ3JA7pQB7QhQY|-JTeZOtZjvJoZ{6I6*zngs1)a;5 zgs9zAMvm>a`_IGnS5}Xc+$8=?z5mj}U-i73c1eIG45A@51whupeAxP^wtLpzu5wD5 z>iLUy5$B{wperOzl08rPdsOwbSU*?S&p#T2A4;-o4zQBYH=Bm@rrJP(F}RmYqu90b zu-BuWnvp+Jh<>X3CsIAGHqWL|K2@3&e(Dl8Zj7RHg1U$VDY#uA9xZ|Xy*zdka7?9Xq3JsgOQ(u6@`v42#(0r?*pQXd* zAP!X`!&pz8B`Qs$Dw~gg3mwoe#2It>Z%e%Haa74`&6McO__FJva&x+;!=4C5{Ttlz zL+}%!2T?jD8d8+_m)=wIZxX_$)1UNx@$%mCt!nqnmgE3Qo*QXJ1BV_JwGG0l5Xgj` z7vwC@cw>I16l3%oY7y5AS|HBJsLcm;6%ZD`HmLJ!K)tJ)Cr{J~jXJxXfI+3cvS)b` z^GqB3`mlDdmfrayq_C?Jron4&)__BK;oA@Jc9(fU07FK+Td~?`MU=*E)BI!)6bh2w5jAzd7O!5O8*zaS&8;au1rXau@Ka#5qk#ixt0hU6q<=6KSS-xQ5)=G07 z`i>uI2%J;9mhko&rGijv^$8{6VA$Tdh%l(&^6R)P9Rp|LQsaA%MkAiom#TauK1Yv;yXv*OgTk0TBKvq0@NY)%G`2Be?>_A!Uy`U z99slXLqG|OT>B3NEiwFrG)=#!nx0o|)8*ZqPIrZobU*e1Jj*}_AIn>NQ#}nI$;(+l ztstaX4`o~Toel?`y(W>Y2DOK{y!ilpbprByBoJ5NuH>#$lR99pjiJ&qS8awigGQ?& zX|YX~k)(}k-lQpn)l8Pzar%y*t@__5jzz>(Uq0Gn`icVasu}HifM#I_)vQxLiL45t z&zE?esS#N*a!aB0pw@Ax(wBtA1$OgU=%NGhl=!XsWvqF}f6LV~Bbh*H;{LK8lJ2iY zG$G?H++BHlF*91!s3>F30%W(;l4#b86CWW@>uBjLF8@T~$Oo$}s~*Hy{Ma;Vs3ke_ zbbz$Pl&R!2nbb&H_!*38+t6=VH*hq#7J}he9B;3(RfX1WvH@9*J zZEyvsq2>iy)o0xJI{kA8+1JR=)|d2LI@8GH+(m3)(o#^TBc&eCtvWowdlhK29I|LW@z{#%$M(wH>}M9=J%CE(K0?ZYMcTpJ`N!QQgK# zS0r?Xp2K|5FgK06`oI__qN)d*@wqLa5N>Zsx(wIPVm^M{8qa5FWDrQv20Bbz9WAF> z2@P!K$%}czFKJXhK+u|5T61_1pxj{qX8f?pA|^7;$@r3FskMw?Z?GB=mP zCtjgfhG0EQRZI3!%z;g2Zh&$M(IH3+EH6FH5x>{0IUSA9y3c*lU#D;oYzAypo`t=^ zOazRWB{!swj@@0p&bITV$^6IBJb?FU2hI`)Q3;dC~5b@a1w%d zRGi6^6YzSs05?6OG9j9BTY}SFFwsFJ!{gdVf59DA)S$)nAf>V9iDSx=@Q{boopM0* zM|8mzhwOe@w?W$M&)CEVJi|RMe$-U&{9G&jeY=kSjhDmF8j z2PXNgTEdSv^p!Hd-4+r>#Qc^VU1(UqFa05X6yGIwj7y|D@$W=6pT`rya4G8l0~8DV3T) z<8An~-Y^t)KXHFRoEkNH<-Z3|y8XPYu&!HH|2q5Eb-M0}_J&@PBhsHxVP56ZQvkl7 zE;q2gNAqIgXQ|k9Ra%-Q1zH9H;Rc zAt>Pr87zBC0;H7G(p;cG@+Q?yET&q^;o|g+=XyaRm(i28p8B=12Ic#V+;nLEmU9X@ z_7LSwyTGcKv29ymO>d7kY>f<>k~Yr2ZA4?!DbXp3S@AYeDNZ$D7n-&mkBB`n<;a8*p%@A)_emaxFeoi!K- zmTb!omE-bT4t-E75$V1pL*qdU*z~_EdNN~n{)%urIJ^Cr(vNw;YxA}_30GWtO}>D; z9C}UWq#S-tX3l{~*3Xl+wH-*-S0-Z}H{*bCS&t=Xtc=Xkt>*GIRMRX6qieu$2`-I` zP8QEaC*UupyH)qL2|21-R zp>b^blNEKYLEO8eY~8P>_{#U?hGQh{se!n{efTdD^zDal(`pnlJJMNRj{PP#@Ecg3#?*OO7v zmP0Gu8{Me04HpVdkIMp^Qhr@migM9O{Q`7{GRM`hK+)BmVK`0|o>)%?so36C%Qq9Q z&lwp6#&G6Ctnclj6vFd#pT(#3s(2mr5JYv*hNKP!aW(SJ-F*4>suGWZWgiD#1$1GR zOsl&0$AM*~zN)8sa|RG@8uXW4n#hdnE6(SX0xR_X!6Y;Y^Ag}WN`|8QN$QP=m--jt z0#QOC#-7^_g~Y?$zm+heept#h9vjfm37J2-ClX7%4Nna(cgyp}Gl;?d=Y{wy0pH8$ zW|Ch1lFF)*^MW4`H)k3LByBWlKn%J^HR_2T>RKizL~=-0n#~oGpFq^BDqAuBhVPv2>-NM@z?rnidTz zILPF=G;`%=pGV@$JhND=EG+S}h?whv?Kk`U6x=j5KNf)PP2CY8!_pzvb7F>?9|11o z1WLM3@}6tYO2GS89H+0?ej&)>l88YtuB2gE3m;t1&1T5O-N5D@E(ntVI*3+R_Ie{l zu||u#F^}-#TyPR=wOR23@{;Pir#9pvM{$|#`8tmBxE6KQ6Ou46XJ#t>08Z&|+*gFa z4*U!xP<>wd>ctP(jXdMHF_fzfH$&n$cbnZ=98TeJ^_$lQ#c2LfCT ze+Di?u2I@nrOX)?(TF|_$5yS39UAbH{+R=!Y;QHWI|*&3(e{Dn{pJECG~*2u3S#pfW!Yjtc$;vrlCSC>-0HJ3;R8C&APoEDq)Urs}{TNksD zXI-aRljK zfX8FvzBeui6plB|!P1PlJ~uARXc2{Z#!w{n93b^XYyT}f;*F=Tn|i?LIaiMBpAzJl zzKLzoSWj^~N1sUuB5L9qXbvb+>h0JPt*O){*9Kt)U2cunIAMh>VZ78s8TWdnw~`IQ zQ&{-lbG%HRa+k4Cur{-q6L5@g(@PPl)()oqMm;C(G3XHvB&!iT%R6I}i~)!}HPExw zJ&D(eSj>`Aj`AIIumrb78-!LP5Fyfftw5bto`pnc$AjxuquL$9b<9Gq!h(oE$3~GB zAXn?X69-i64@N9!t=AL3Uu~I2sGCM!YcNj@deJH2c1Eb#Fi}FbklAa+Qfc9Ix&q4{ zww2XUEu~GT#CuSrxB%z1vVJWf&U?ms3*L+~eTTgkF_-Mrg4J-+!XRhXvvyYi(BtoN zP$y!!jTHuDeW=3wanDpG1neiDrt$WLeL`d8E3sYH*s-f0ZQ6k+loSJLcl_)dkysLa z)<8lH1|Y5lYm;5?;9o+xH(@;wcwF;2Og+i_8q4VTmkz8 zxQts&VXqLNh&;h4fPMZ}L)zo#CQ^(6kTkR3GviY)`cnUUk?1i2koiUE&sD_=&y8S+ z78ch1rsIefsEuH3${tJ^yBq4Iw`jah|2>?y;GJAE4HQ##oZZ)^ZaW^z$W87#Ssa8GXT(KmAI3bGsfvdw6N^oS7lmd zikZ6zC1pjMG?i}!!d8;-7B{W9ndb`06*V|@Q=OnJOxSkZvg`rmvS^+r_aKF@!hV7uaLqSSNu*4vxqoiu@ z%t(G7@H$Z2lhr?ZRzRk?LLe<;UP8k?6EdRYpLC(UDiYF<&tt*|9t74=6x@d!uQ-{C z6~UwlkGaqR#aOpfLLXSPb&QF|q$ha5GZADdM~QAkfJDnBLJnp8vRhfl7t;wh$)Cp4 z*L|pO;TfoUo(lIYKu?iZ7(lMkdkIWbs_rlRcuXsv6DQ+7#GE48*(chg6pL5%-qvQ$8>By^M4ppBZqkBzn%ZN;e;#x=r5!TaYr8)wvZ?Jk(tfvf zTGO-st~;!lL`0FuYI+I&4)(Y;wBw9RIiYuT^xYHdhN0hW5o*OUDV6TS3_}LB8SD+M zK(_3;$%yT^O7O^K`{V0pybd_L_mumzNAqZniSX24nrYIRqlVM65t3$Qc?XmDb&upH zyitE6vm3mu+Nm4&r;L@a{*ebHz&1WuJf9Tgm2rG$*6U5iJ-Lsk0y9kxOJxZ7O$H)Y zf!Oe{8Dqetsb#+<_Ewh;SbnD};z$MXDe=p)TxSrDS20d{t2Ss8nHC$?|Bn$=cbPWD zm0JHLDx;_XzAh^Ox?O~V?qkG>BMZV0b0q?vK1?VX+A&9<#i;9h9*4oA*i#PYNWV*& z^`CU1a>SQdp>PWANvE{A4(bV~8!Fj6-4#c&&3p4hejDBdCa~c@&0)I?Yz}QX7RZ}% zD5gA(^V@#SZFVHP%YSFz?aeLL#wy1_x3L%Oj~|pJ6h|q5*w9_;3uNb%R44YUcjGWo*5<9=!-Xfzapy@G~V z$y0|R3}|&&i7;GtF+#-Y+wuqL)vqrnfwcEjZXlDVZ@%G{Q`Qebkbt@s3osl(2E^=VskU`$QolWbq%HJ6)OfXqW+a_vS_q%}H z{M2;7Y6o<0S{Bas^jvGwhv67UV&)^9&XE2oiW;$*OG2?Jg0v85?RpXTqMYs>8QOI+ z9={S$)}eZR=f#yZh$e-cqVIU(4tF5?uT~(=Yv1h~yDvdlso$36kVc)4gBKe0X+Bnz z`Wv^*jQVJJ(|(T_g-?ORkf%`{mw*$a2dspNNhcjnxCKqz;S~=hpMjV-+4?G9n)gru z5ATX-kvRyS2mWEf>c-d(6GMIPXg-*=&Fj3`ce*UNP;}saE;Fm1ynS#= zX0~nB2fLGt&Os2>ZAlfo^T+qP9~|vOIKf^g2*}?P_29v7rhdWnaky}aO4)mGkjC** z4ul&j9fsUfF&Tk<+~I(bHrbB`nYRDyFm)QfV_PPfw(hQ zC9tcH=6VqfyR+3qILk8esCw+um@-5L#S~1?ITRE*SDW#g5sUD^BLdw`LiZuwN4Cv?AC6v@r^V=Uh>4dr? z$8G%qFQsVTeyROo!a0lU9|XAz98>IA@|S>!Zo$!hx?gm@YCVZtjetEI>36C+s; zYP82)#s|mMDMeS)$ao?~oKqsT>=&X}*aZ3dCoRcw zLg$!PODm}V+`wlHNcX9S<_JMpe6rLHwYtQE<$0C3*T`^Zdx_nqBq)14Q9^aeFsCVM z6`v)r;ZrzQsr)cy3b*nqSW{WKL(IiaO)IZ4+noQoF>3p>UDH~^{C;aNU_90KHJg`< z4`uMv^YE4dM+BaWI1ai&O^f&vwD(F0|9lG_Y>5{elGY_EBQ^q(jJ0eMn<_bDtFy|? zIS`eV2F57X47Bv}UC>u29pFV5rS21%k9Hygwm75r8@xr;=X+!PiC!E6Jr?nBdbOdC zDGV+Jx<$Qa{IJVXM=b$C_;x#?J*ny0jG5xW!K-qKoZ2J1!!n?{kXibQ_c?YM6wbwII)9U zpuYCbF5S07V>8r4uizaG-S7;p>)4JEAuOr7_Wm3b(8IDC!AAeKF$xi4HEY?=NnF-b zbgF~k84w7!xMJCFi(N+5IUfVJC_D$UR%WaOLC;xN@l<8|78S>wg4YPkBNBLeU z8))oYwD~B_ZyaB>{S`CLCxmeb6+pcSv?pMu>j@iSpZDvalvyA@KeZ&_5I`NRda(iy zT$1e7yiw?6kQ`xl1&a;+LixSDkMx0Rx^bCjI-~6fbf0{oe1{}6!DMJxvsn9r4ZV_{ zpSaY#V|z{^n5r$Yf91!P#1@*i*x|6DH}Z^-T19Uk*9vVX=nz% zRVRsNBj#xyZ>kAxTyA(7{c-$F5UX7|({6Y%pQw#0-FG=+J#>EN^KOLG z*H>=Sj|gh|Ct%s*nnG>aH%beZ$2IQuLv(CAGkH#yrH$p!xBMx#C5Qa$UT@j|o7;~+ zYaHTbhJeWvkgMqr7CPvWX9BgfS%SWq`pW?f{888h>h49C;*W}#4A(Q*8hhSEWK4s zJ?=(}oqRwO6VOhw5TQd)`w*OI!Jw!iR)}GNBm{mYVTn0{ zB=pg*6y1UTye9*?VMj;>yrvzNX4obzCgAb25Z!_9oXHHl=D7i!Ky;Ttx^L-B|MRAYDmhh5>V8d zmzH}69%Dp+-xU8E3ZG(39~lfDyTgkl8!tw~>6bsPNklFn3BSq6Trqr58RNYjJfWGVQI6f+ zy3uhB6BhgK5$maxtC;}{74vQ--Pds_K_8F1WEHBV4YqHOkKNb7X=LWEmAOC6nX+q6pqht>?KqHk~4Q-w^nld07ZQZv5T`HL!J!!@75!?M)(f9=G zp!GCRI1#ucLLPH)d@4z7vl{y{m`>f8cq>S3b(_J?>Q;k9QoAyXTUbzxpdhMQIQJmO zQMnIAbNKXBe?Z+POA~#M=)~CrkkO8V(#4MYm{1p+lfpF!fiz7jpkWyh)!4igAtiY? ze&;!6pWRj-l}gk+D;DHKZqWLWxG7&n&kV1DCu}WbmS3=3UbVp`P`TmMRaT)RnON+6 zSl@*C!%l-?rqJ<+pR`lxUj`JsKjOtjBd%sYL>`)^>?ujmgIK;>F?0dnOs%8KBNopn z-RSCTk(JkG~J-AG6lH5g-b{8pmn;UrbcWaN=>)XkrLB>CkrjL zUWuRD*CT6fPW0Nk-3zikkb6P68CEfho)yMnj5F=I#M_vi*9WOUPpgZks(*%B#%8XT zP%&=YNM_LlY}-ms0>!V+Ge$aEZx{zfXuW;DVr0y7s| zCZqQ^*W^&hQo1EcUYU>I_qmRfqbwj?j|lQaso5AzxkV6WF4)TN$8e9m@4N|Mc;BrJ09Po)+4QB=@~ zb6-2bAk0k(AEtvTEvi!sAc?j4y7GXHedLm<}gyDbK1<1Xqig6yVj=N9Uih)0}wf|D~5O1QyXgCzx zZFrJvY+w8edj>Lod*;wE9|3A;FP7AvBRY4)r}mGL{D=WV)IgEs)!*w}J^W;tq#}eW zFSlY#8?w|@vs^iEx~qR^6YJd1VqP|FeT$x)|5i$QBJ^?6ahDTB> zwh;;!Q?am`DP|FJKeHxzGCXXKdk)FT)kiqdU!_kT7%hBQTnUQU%c5m*70YL{IHT09 z`BS+~M%U%Aao5sp7M5GIYFSBA_k<_*!m_vqRKHXL-33Z@iqEhjWppH~Mp8*{X?I@( z4+!xE3w0>cD9R4jXb&^|681D)VoF(3(Pm}8<^BA26^e#3&vB8YTOZ;XCa)$gn2fo{ z2lEAlpRWkyD&dKIkV%&^(BwVt82Ro`TJP{OFbt-N1TdCBD+XjbHl>A&s1x^>$)Sf zh5WQ4P;OrOjj_ndy=_IH@H{Nfb;g}#nYB{PC~GJYffZ?`n}<B{DO-T@>5@3}eZCu!>GT98C%_^fbl5P9Q|5-PePvNUNjs)Ragt;IU$WrE5Cx!B7^_%rCGn zy(lTUm7C>&92cbfmF{oeE&!adVtQBu(>WV~DN^mMqx4T!X3s&=z2vL3w81IYa}axpGM|WT2K67^68Y z`D2NTRVb@ZAD~V2>rNjU2Jj4VGOJEG&*fstn>lme459BKMobV)T8Hp{r4DrDv3;M= z3~dxkbB1O8KH(7qPO^zTLNva=tHnUVQ7=sgysaC^VDMrDhw(fy37l{4Q8HwR3Du68 z>?a3>@sBoFT6%P$kbKh~Gf3<$hh{f-;m#O**o`Lv<{k*Rco>G+=qNj9do_xl+!y$`p52)>qZnQsTIF(5UHUR z|7Cx?ZmQyp8AZufQ=xMTM6JI z05FWqiA%;%ZsRjMuNi@PqK4Vj0%|W{A|( zsjHV)+rmp1A&~@rs)}CUH9a&Mm0%zYwp@yt4>;CJCyztE0baG2s%ahOb2bTi>+DJ~ zlrYW{XXf*vx1DPA=bv-FY#nWo1O(0mP;SK)j2^X>$e_Lgks)SBGl zY?4E!dPdF}drkV;>QD&gTVp0hP3-1!VJL24DH#bMQm$Su7j|#FDg7p$vINEs_qh=A zB1tfXB9)*HU5zAvF9Kv4#RrP6$bLlcGC%fRZ@)0D=ft?4Ld6F8!)9~l!iZWzbnRgW ztS#XtV1g9_u>ux2i3-%f5bB^zp_aj&amc`}>lf2roo5hay4qGN&4Z*9F*nXz$ir`f z#PMd}2n9nf`9dxc{&GscY)R1Ooy3M-(}uX*?YbnyPQf4we7gc7D+F=nG4!wQ{ss)OK*h+R;ml;Dh|t1{uL_*rdKpbAy+semyF*N{TlHoP|=L? zV6%G0id_Ho7Z1_J^xHe>4xqgEFy!FC6K-6uV1Uj2bqL4g;tOmnw()S)8f%LN`iQOV zyw!58>GwajHX5=(|CZHL4-ZVSvaGR?C;rDC&Eh(>&GQ4`XwDPA;z<1KrCU}o>2v$4 z6_;NP=)Wc#i9a}ncZ-$uH>fUoHP2ZNsvX~syvKWdWr+o!X0hrHB})%%;zm`=N%ER; zW>|Y#awh3qd#tcwobdpPzJ*<8P+lRx(Wmiyu#zpA?>kjT4k1f@^6tyxq4KNeux-6z z?rSa##asKxsoO3};nAT&-)U@`Ck?SHhFrRCr1E*me#=g?VQocwGMPMtXyZ*3o>z?L zR9g<7n*Uc*qGQuVsd-M$Qr;wICRr6;LOj{JK!&jzp7>s_ z&0&^NUWkZu%I}_4exb#EG})o+f?RYx{6td2|L|*e^b0G3 zq-gOR;U_Qjo7?J%OKMBiCspt60SL$pO@!Zhg_djoN32-1r7L0r7tM`wz$9~39e2K% zHYEf2jA&X(NBuHDQ9)1nG98FfsGM!2mgkPHgyXJgNtE%3(x!= ziaEVulj6nWo0ug=G}c!jZ6RD8hDNLin#%I>$CuknKHi`P9_GftSTkpdjXY2DvxGue zd0*S9`N%~aWz0fh=G5`W_+2#EGJr!We{9?5W&&Cgn=WgZ%0`Vf-eX(LHC=Us5uMKs zRwbW~KqI#^7|q``r+Se*Rp^KMqwCLxo*Vy?k>%4pIs$0w-iT-W^7o8q(B(Ci|>@qKQJU0!kf09hHJ0Rqsh3P3HG~k1+A6n&!miv1|tzz6msVif% z4RTou+d%G)9Q_f@Z@tC!IpQ;4Z%OEU7Q?908%lXr)Tk0edf@JvY&4ThP2W`2*j$SR zmJ2P{hMh6$PR*3vSrKSZ)}{cWI|D=%7il{X@sL|WmcMvJmHyB?t2lMVqi2JWAhXIG zvo?Dz8tqC33ZTwgT?jR$Gh-!cgrB&Q-gU&*so_VP5!&S)wa;U!xpo1}Sg;d$%1$1x zI2G$49C~EpU=_Q=&K)_T_QcHU$UU_^izoI$r1e2{=!tgWClANjTu~RilI8x}H7cv| zsPmQZB7gWK%lW3{bcK1Gzg+WOC4w`ZiRoX3$+Eqg(W)|eTpn?^a%{}u*AN1%kEXY# zNVhJy?#=BPtALpAOc2S}b=iOG8@@r=1wyf2 z!i^x9lq>wqmFas=ScCo`NJ5oUOO=XL!XAi736`!OVE9fr@3Idr-jv%`Ijg_M_}AwZ zsyNbCMWG)0Gh?u%EG~0=n{1G9v;N-X^Nl<<{H(>aOgfPPW!dUbAr=A?W%)EJ)cN0A zFiGe8_uQS)*o1e~;eO7pbj*&Om^dPH?oMC9aXLr;O3u6s z3qcG=959Mn^%yMRH4@Mb;?m5<+1$%*dy={kCe~NbQlCp+XI8i^Z&-HVm!J8PS#!$c z0cwF-0YUVW%P3R!Wh}(IPM?~^eitpP{-9C@bL?O26EuT4N1B~VtPVr>y-D-;Ts+Kw zGW73qOufo}r3G3xTQm+?wKe94wq{%`K-iii0cOAxK#<+?-nwkXweo`d@GUpyMG~GS ztL8R_V{~!e6dAI%eJN|8Qe<|XwgWbG;6hxjQ;rKPO6q&L+2S zV)`#p#fEmPo$ro>#r2uRiL3Vx`$^o8LCcu~o?JAmb_BCM*xcJQErwGn$Q}aq=kZ;N z#iCZ4<$dJqh`5%CCQbaIU|*Adx%|vY!N8%SvEHY1PGFlLfT`Re8HutO2tjp@K?~si z#`G6MX7}jSGBPD}Qb0V_BcIWsNo$7`VN!4GkWDJIsKZcI@JPj#p~Q2roL5Ihkc`gV z3(EpawWXKXZI69M1q)R!YTscsqLsBEVUMwFOz+wR+@Lm%XUVUV-$8Q|2DE1|cmJ>> zOo-SuXt1NTux=iA4!_q#L!_&X2}BN?ZvFye;7Wpcn~^{B@@2igB7=`amzN1QxU;mx)rPN}rIOCia#}LKe*Bes4$7&hwp) z!mCKdLPJaQTNtbAHbW%M{1Cy9kRRkeL^y=J%ne;l6BW(Y(<+J9qg+K4-cF{hkusdZ zpFf@@_(F+a`1np3Z38gP0hv$hjxdp(RODNf_l{7p9h9V_EE7Q0H>$-jfrz1x?xqFy zfmphGL?!fgz*y0+^AUsQa$Q|bRrA*UbVYU>#j-TD$-v^Bx&?Zj4dup-8eix+WBQ9N zzv;Y7?tIJZlHcQW%p!|jzC#}i8NtV!UX^XQDj7;<%7~$L0@yz{8no}#|h3PgTDpC_ zGYm%Hns%#@-cR-fvZC8l>fUn%5eSxYW!U@jk68M~m^LZ%o9_)K!+je|oL7g@cS;I_3x9l08MbB4v8&2GNLWg^MY z5k(?qmJ0IGFX7L!x0EfH?JjqU7bp~c=Bu%t7<{i_55qdtO zdu8(VjC~rOZ>(2r&ax*r%DU}_@pIq=%i&-(O3$?kBI-{g*Cf}ivJ1kY zD$MOHS!a^x@4ZZNhMH|*tV|FE3{49w-bpvNQ(vPV{39!8YDpZ zg(AYIbbx#g(u}d>E;_6>i3sdk016D_tr$eH5f;dut}gIH2s)NDSt@sWKlq6cKTL*< zDeIWAN&M{J@P6#-gIqribY_|NGC0vz*_IR%Uf^Z`{3mGm?u$d9WGWMaVWpXaSBCxH z;#iY#1d#-EXEE2tg|NygpnN7I)Bn*K-s4m7H^FdO1cTO*6$*w0T4ebBC`i(;V@13L zMGV=A8}0BO#+zk$+T+GQ(g!PDqtz_(PGg4t8)>jB?))$6j>0Fm3ZK!I`VbRO(1S>J zkkRtdYb_(fjMy3ZtXi4e5ozIR2*Ml`9gt?26F&3la7#>SdE`YJ;BaXEi{yQrT(f9ZyQ~1fQ@o?lozDbV;U*Wt%j<95xqB4v3^+YTyMY z-z+|UHs+N5?D;oECxxYTe#1t7_ev+_O0%+=^S3G{lYL)o=43&ty!s=i`S-~Kt;Le- z{3*W(#ky2EuKg>fG!hzd$f{BKvKprL@Eb>b=KX(hyyhV_5&%w zReA(GWx!-ngR@uGe(D%ebJ7RAC*(>L3lD}RYxc)ki9mPlf=~ZMN#W*3*t~}hs3818<9#N_t%IAD^^tFw4$&PmROEp%YvmcYcG$BP39|kz zncXq7nV`x5*r04k`w%V3l)y*5I0*|3E30wu6*)w3KD2RwQll)WaIf z)}Q4Y{fWFg8(v>gpUSZ0k1Hx+E>Bg-Pjv-X3g@+)&kFW7ITzi2{K>8p*Cvn-Nz&lF zXi*PDxel7RA1}9{=bN}*sIX>fnM)PtCw9TLg)9>oDi1l;bb`_TlsD@p*Fou#Z>(WC zaFvQPN+I`D#MnATuYm$L9m56cPzQsVV6Wrol-DQDmpR=DS5P0K6gBd_6O}jm#w{A< z%S-@{T8v!aefyK#QdxZq2R6U_7IMa}8y;k))ulVi zdM{qLR{iMhKft?hT4S12cdSLTlOK&(wB~~1WEW0-O6W&l9(OND)<(64b!%Y3r{*eE zW@kLTpTS&f1k41}rR$O!J$dvf0Yd3bj=u;hb`8v{jAHw?4ZEaL2+^@1)2w%p?<^nc zpC+pl{AGtvyQLNisQ5GCinGZHQ=3)*B&e8ml3D384>Lc(<0Bd~=3CR6o@4u^FO2GY zBxR(_nNIwO8ECQwpEXIKC!$~;BvcE7u_kp+h z9qYn&v2Zl=NBS!Pbao)H(K~4U5y~ejWD&>QW5vh*N>oR-+$-8lt4AX~2W`Qs&nLDk z4}alQr0-{p4Auxyq*G-$TO=Ed?ZPQlD4SONTDGe$RE#|LX^Z_PyH<5-*cvCDNeLFAxQ);0YiX%kC)4mpEY{0!zK-Pqs4w($JG$V2@ZUY?RgL-i4Ip}jEI zx8rRBw;sllMfDFn!UZdoVq<55lJ8n4Nyj1@Z(_M#JF^i$K5;YKL_wY)Y|pDf)Eh?K z0RC;Xh0|UHw`vj{!i7o~W|O7~ZAK39F|zG!tQvLuRv+Xa<$@ubZh>>hm;646{`vuQ zXrG~%wvy#!x%ce0={-oSj3w>&-aP+sEwR?H7Od*%-`#}n++@qYA#z4tAfG;Xe9R5- zFSjO1*QJdfo37KDt&cawNb)gGDy0oe@za1VhrI#gRIf^DM+C}QRB~A!C7j7*P$ijx zqzOke;#LGPiDmk@cS&i~a~~LN?{MVolI^ZxV|^r^=o2=S>_G8X*Fc^W=Op?)fSeJu z-<1%7#?6TZ_%%6Y@o5HtE@nMec7$-;@9EgNiv+%SCTgA*DcWPJ7=}(5%?HRTeDasi zMqeWPh=Ux`EI5*Z_q|mM7_ZH%_h`jvLd=T z#cOZ;-(kxENo>K7aLc>^x|(j8V&J5_CrmyIE0OR-(*}Ij>|{{+RUjX=*4aZIy>Dd1 zltJa9{Mb!xUH@30p87dKoBZm6h*`}-Fz>{-UkRimYk>oVyl&F?{{yQ)RKIs&b^qOp-Bf|k;|!#$PCZrnMJ@8Dt~!lj zMCki3D&sYc0=>HG)LW%r)_BD=S7{aoM0p{@YcjsSu9Z-P~2D$)tupaI4?*1xsIWS0^{O3+4sp0z^{BRYu)XRFV@(wx`{cyD5sQjI zvY6-rg|M$Ea$7Oc>mbBTy;@=J6}$|1uSFf$x^JTUmAre4S>CO4$@qipEj<@;t={XZ(;JHYPsNe%yXtfX=j4X1KJ`ZG9Lx5ad>YMG)fitY zy2Xgbmp=D>IrUrQ8O-=nzs=uOoF|uZn-7L8X!B1B+x$W<(J!*H%3+T$Jj0P{_WRP! z^sz3R`*!&mvfBgLtr?3nLeS9d0gUsPA{8fbd!V-n(#?xB3Vw|q3;*w;0OYzIMFsZ( z=-`+>iaUI#_H^i>z~8PerzaL^RFR>j0gOb?12>=_t5eDS(st(sB1ayp(;J-8TlP$@8HU33Ji4wuy#;Z%u4_;G@Z;5W?WuH$Mpf^xLwFXKy-*R{EQLIM31(bK|B%X<+BvUh z_@=`@yVG>4miDu~o#9HE0?<}~Ec%L%C+DJE z3cd!I>(cJd=&$R5_BB8jeaC3eGa5UW^ao@&d#y7&mp(%d+en$pcvITQPn>~G-XSVu zXJ_8zb-Yh)^19pyH3B1|Fy56IfA%oW%VGRUVSFSpOb??mhcQ@Td?GO>dl+}-FfLXY zpGu5JJd9_6K{@5;{G;a>u0b>DVIgK?z8@N1+s5%S|Djp5N|nA;h;Am)Qt>wm z(!cNbN?$54Hso<>G?H1h(-?#!wp;1eA}RkGp^R^hq^USQ6QxH)y%r?reng95^E1{J^QF6wy5@d!2|3Ii-k7AJC}lzfLKl!4E)fxz=GF<(5*t zF{;kaH4)aajYN0yqP6Y;te?B;^nl_F*H{ZaxC7zTCex#74tA>C&JSta&JQt@D<1GP z{Se>!q~JQPAw9)$V!2)&3)Aylf)Uqd@U- zIyI>D?sk!rkJIVv2Q>9h|F~T6B2?7diKTfCVisG6QF7pnBcr#q(SU4=q<#SPC zPzH*Q*J-87m{<}x@pzp!D8g5;;`q<;I&D$;*OjmY+f@EcorsFO6-d-bCgnPsZl@_> zyvHSX)T>LdweR+jM%`qmq}3%*`Tqf8o30FEpw%V2PAa1T5{QlW>Jn_c|M`&e9$)e|U7EK{%6HPX<&@=1Q~oMSCWCLlkR6wvFM(^cVk!KrKLKXZyZk}=o+#O+ce$2l zE!8M!K13viu650fL+_QG|6@7*6?jrY34Wi!n?bRSDFCLuT+Ri{aNe;L`&x$XV`vP} zbA9NzQphw4P!~}4TwTLohrfK81|K^GZ$XA+GM&*U0{s<0Wq~sodJCY3EJGx3nr1SK zxspY&KcE)fUy32&zGWII!uy%PgFeKD`8LZNz0X|_%HYYuWmo!GV1vX^?iwY zAuuir>2w)>0Cha0ZaH43ltLX-8hQ74oo41TMyre~OCzrzuhTq81dL^jf%B*_3S(nw z1P5a4IRiU@i7I1LDenMYT~b}KYuDLSvf zSPzUP3ghik;`9oYo+&F7V#IyN>-4zFxU)2JScOi11goPfboxL1IIcpc{`hfng-%16 z2F$l9nrme77Xt%IXkd&pDs(E+;;# z+>4>V#p0wd{B3v8!@8WY9}n=lT>DG?h2hgUa3*nc9lBq!jF!XI_+Pnd>|Qx zIZrUlvQ=nQteTru#(a6+eFQS3FLAuec`APgFIS4vF>xo&*Q6G|mRkIpHPdC4bWD8B zj)~|hPp2}MDxjZzte@m6tdNuRBkQLTDQvZGDf_>08I4(`No`G5a(tt-Gh3y9l-jut z67$MouFCj1K)?6;# z?xK5@{p>Ac``KFt`?+1!d@nyh@z007n#)`YZiTg=`uodZ9_GUuRj6b8G3D56rT}R) zk~F>?Dj1DqJV_JEVLxLYhQ;mlc-&MD9ut8AifK$S4asMXGRBv4_uRr6SbHCg>B;uIM7eX zWk}YisPr_+`VB_>O{Gp}`WdHI>h$5m8b!{m)ak2-H96o6PzZM(!DW9BO4(zEtDKu< z;l-WD$abZWVR%K)r!ktI(V0Gg_Wc?Y6)msRRC50CFhZmQJjf*ir>4w&&J!A*+b zkq&u#Pic2aGc_okk`EHirwMBJ`B(?GzQ;Pi`rI7P$0X0-td%^3ZDg4~K~1==KUKwS z>>yq7->CHF4%{t%Qc2~CFIpunV-!j3a+Q8cVjrcF3cE`#DR*oUm42=R8_AGWvJd`% z_JP&>J(tf`vyX*@=eJH}Jl}x=-xLvDkxNH9784b%Q3Klq#qk!oQ|q_}v$#L#N7I?+ z^Nl3kO*4fYtG0JgA0pV^0UhYKYp~)^5^e8*P8LBDgAi@+fG&8}8n0!yvyv$|Wff6H zly-3Ta1_Vm=nN&_>m4|5$V7%OhHOMXjBP%!DcRZy)n}BFArEM+{Jy5r66k6F>72 zje-wA7Z`o6?1bDQk6?sa2VjP7=>+{n0Se5n)aiL8#19=K4_4}w;tXu^UsV}Db(9A7 zmP+5!iOunIl~e|{JC`IrMg3W&r*)E^w33IVxsK^1xph+M>m;{7sHEankxLS_TV1Ks zB8rOHk(VlUy6h3Jf+55x|beOO*G{&ZsRG3p^fL| z_)bxLaW?!X#dmsZzVLgqH)S!MFHLxrafuwnD4fdR%g^%*dj8EB{Wk_ z*&8K~jm+co9FL8Mp;N%m@Z4b-nBr@(<#Xuu!{Ac5X|3vYy_C4mA4a_QK3An*JuEWj zc%9Y(4{m_L4@-~2Oz8%AaxHo%Q=G3T-ad>G|CK{*U4h{#$B3JrrQS#L)!aM(a8~R5 z!=cva*Lux0|8N){EcNcgVX2p|(h+??KabOC$$E|0v$clHYqzgbr-!Im%#Iu$(dqFVzi*3RH+h=L3FMF9OR2Zu z1K=N}Oh2+r&*XUgScL9FL47rrye|D*gplP|P;da{maUdOP1ikIcd>dVDA3H~N0#mmJ?GoyO*txMOTH;N(H_h=}KUgt#V z21M=Ac1G^JL8HK3we9IBCCDqqMC}GebXrd5h}jVw{=6tBz}R*; z@FbkGOlXI5mKfxRhP$a!$F*Y(HyohU0cMI;Qc@N;{* z+Ho@y8H*k&$6;mZqZ$SO0`p3bq$%Y%emwnAbU%xxFhcJ~F&&==4A-UU%)1Fh20$5_ z!6jU+Xl66bji8aIkglrQl=8@owe4yBqnbR3+=CxDi0t+l8u*^$bh=cb-cTOdbevA7 zat00s$Eu9k<$MRK2^lFK0u5a55JgWF@d$hu7 z8$ILywtXdTU{yHsc7Q|wYro4WqoEu9eck`se>%RLE(63iUE0MIi#BQ$d=QO*-CqrT z*B)K+ipLch(zlh-9gk}id>dGbKkaG%f8jFP0X&O-V4`o37@-oseL|yP_ci#C3;o2| zXFmZGr~_yOUCY~oVL+Mz2zH{^@gn#Npz#|J7zfwLk!gSX$jXRLv!75qqiqVlvpw&O z9$*?iu-&P0_P6Kb=Eso}0IN?_#&sQ-)pH)JJqoT^y$1rxs`wFE`1Ku_)gI2tO$_YI ztihKz_;Sr^dPc2gUM}aQz{};B6%XH}Q8$P09=*)n;@(YOi@nT7E|+p09+4}>_sS^% z=gJW({Xu!;#R{F4ZGv?_AJHkSGCnSkd>GN`D`ezdT=pCU>R4e7?Ggn~9<3}2Qq_~{ z?lKamKZz3`@}4}(olR6$A;Ku)&3cc}X*izX;G%PigH!`DKIr~j1{dX1s#ujA@mfjD zQ7Zo_4${yZv5Hd3C+2lxq#C8uI{FPtZ6sRO;fmrQU6dpAwzk;%p74nJNC~f^dME{9 zquT~wjIitJLdAA9vyJ80dK+MDkWVjQ+fT8@cDN0;s+VrSrkY!S;$aZDA;;NUw_{yD zuz>SF6lbjB^EqRfZqAtUf$vALz2{;2W(`AeV~+97d`v0#rH02iZy0GSit{l#A!ilx z#7V|*UIEK6Y#b%Y7|sb#YI!n6{qw4g)DtR{#PYamDu@e?t8N9P<#E+~2}Bw4xaxkC z;lJVKSuopyJR^S`dky(O7T%iX1M-K#W)#W9W6*|g#I2bjI2Q+BeGstvL|*MPL>#@k z)noVM{&ITh7uoT#6H7>&=%So1!3`&OJ3MYkd|1e>+^e8bXW^u$w-F=Uk!Y1si|Y)W zC0f$RtKFQZwaoLjCg7>J%;ZakLrqCql*{#A73Gy?4$4RG0Qu$Dq+EvhrPid}(-`EJ zRg-eNpUSZO65Nw}FswMozb1u`9ixDDIoNPZl~7Uul0}pjz*HH50-!3StN?gwPcEgr z0EmqN$`0nBtQ^IleIZnF=#Yc7? zew)j~Z4^NKvWA+`Mm$r9SVZ4yYRy#4gZh@!JMGqcP~UhEM~kul0xRa$6P6;r!FYKC z@l_gZ_KwMkf~;ECijHg^I+(M%6lC#jb(OQhw{TF^r0{MFxQ+28Mh4#%XSgpj;A(2+ z9N)nGoZ5OT?y}^*6(Uy^ztb0iS9L;=12Qu&Mt z_6t4=?tfuph>{+7JHg`MjU69DT`UXecU&bI9Q}HEUUt$zaAqGPT8~0@wu!^xJxYvB zn_?ic^fZOh)FwtO+tARAnqDELcx)A3W3jU-*J?1UFEQ;joVEdd%$yNiiEbOqNRa4| z_u`7<+R=2Xkvh-#i$-I9u3^0TM}EzVD;{Z=KM>({Q1HP+mafqxXFoAn6XAG@26A%glE}R&8mgn4_>Cu@y=|ltYHk(N4!~W>RsFYY+BHcu z=lJ<-Mj`70%dO|fkJWRWVTQ^#Qo_Az`_$B=Q^{uHmmR_h+sM>g(ZM;0&#cBx8zf$l zH`LMZsW_XmqUo4S2`=;tMAGQFQByBQ%<22ea#n(LKb}^ ze~j>c)YJbM(xMW*GI&x()?yZ3a+O!U!>wv_0MSnFQ7GEUJ$%s;d!%TW|60*>Pj&o0 zEzi8PP~E|(=RGDr>iHEGGj)bz64j$!N;hlNtqusW*_4)%}QBi!J%}m9S2L;l)Y%h|4=> zi>CmYmO({WVoVZ#sCLVA(oE4LE<@tyr2|ti??VL zSa0fdxk8wtMcy`bx_XO7T|Y8)TDS!+%)mFMPLmYM=OPk_>-2}GG>RM=*QxhYipQM_ z;bzIB{wc-d#;3r;He@V?>3n>L2J*omXibxq6khYIiwx-Ri00Dvie}j#5X} zkMuQxnjQ&bqQLLtI;~PNT&+b;jO)~Wt44v-;yP_s8}LgagW@{XZPlpi{J2h3RmcC^ z_#duO&yMnC9G)6&8yPAJN*S+_GG4k2I)=X7E<5=(Y*pFW zT-oEE@hU6RHApK$qS;*EDbINIo&En%-++>Bj;!y3XH<4LPzW~ub39V5EcW#dH0{IR->?td0lCOQVj zyYzXuN-)h49fRBNonFwWTi&d83}%!NfCW<dWBZi(Y-1F$M03>oipfep=*_xK3SOY(vbxPSnVlEGGq?4azn-TgiAfWbFB(l<{oH zxE2W|-i_-t{3VS7d*eF2qre-BA}1wuioK*!*P4V*m*dCKgie$2jFge=Blg}#fXDbV-a<>UKvqxW6X0{JMU}hz+ z6trKBGsMP*y?nnqO1P$o?}A@bgkp|(#gpP1x$vs6ZJJkv=Wb4aMZ>Y~{32Lz3w>@pfAL4(q+EOB1ZhMIC3@rp*lZm60?vzgae;7MM0Fs~Z{@Oa(I zR5K(f$4f%*L)ExV`ztNXmTkKE71gG1;Ro9EEBrv4c6b#nc2h#9e=3^!MUkxuosN1{ zqsWU1ovL5esO$R)oleD%FA_SPgCE}|bow_F!-z79c!?~~0tSreYWzTf)9?cYF3r)5 zS2TA>nzg_H&8zqUnvd}VG$pTbo4L*2Bl&W#g5yIu_6L^~`iL=$AMzRoJ|a#W^ICzA zxZLAVlX5xA7mc`q$~>^rcK1{9S(kU@#t*F}@-RH*Gt!U)AaPTl+=Bvo<{ilfrqC7} zMw1*4y%_-Mt!n2$C7fe&MSNNh48fx{>O^SvQk)N!+jVqjsO3g~!eq ziB+Tg01k--#e$0Y%Z*NTZQ6F>M#|sTR520w`um3}>}~MfMES7R`MrY_jy7b7R`m{I zZ*vTqm5SpHE)H2WSJlGjHDr5| zcrqaJg*R`Xq27UW}|64CYyerhD@Q!at3Lo9Mi^&Ww6WxmsIwv3o1v^p%E0s-&`>bX3WA1k0XqznL0>0Yuc`n zGup^FMBhALme&n(%+q$vw0j&__(g3qt&<+O12EUQSK>LgYTPL8PGdOW1;h1Y#e(-u ztor-&-sQJkqmJ&^;fxkpaHx@^hI675hv=6LsbXuV@@FI>Zi7#|psRSQf zM5=2|m#(CL$k&(fIZ20TkGP~)kp6_xztKn{4SPHLHE$;0BfI$l7)qnNiqxm4eipou z|CxDSkmK<)^YnN)7_O2=!lA42@&niY4qbGEZXBXJ^asuk(tmQqcj(Xb3UW-?UF={< zzorphDS|)rPR_gjHI0IgV^I*Nx%!)D2k8aY$#afQFDRWX&?9B8PH(=ZQPrXNf`cbb z-XL_oTpJCHRy2#_hyJ!*qw4fX60>+cQ}CNz5MovlrmIV~ zYgBOw-Cl%K=WCF_k@{^#2#J}wU8BJ2!2$YE)&I7l$g_h3G#_vT#eA`jC_qFXmk|Y~ z4++pNh4?^GWZ94a-M3w%$Rk4n^k~~PQuccd-JoQH4nhix5-t*VnPS!dEvst|zwfB}J{ix^emI z>Z=<^ttUFN@T(hOUp+j0h{r}$M|{-)RQu}`DHB(aM1PSsg{z1vF$ zLy*m)HN4Jz4$^i5WCX2c$PP$L!P5bYH_}r@hn*9oF8~Y!QQ~LR^DAIANP6OW3C}2;~Y1ew9V~A)}^e|Vak`2J{Z@MGR1Xt!dDPGyfuWsND0^qr#9Z;;X2`eG)ZjLFV^EhaUdPZk%8ZgHZ; zY)O%w2eOQOOJHe!uL`|SN^=?t<%}wo@qorQVb{=Oa7!c>u=ANbdbof-uux;p(y$@XKr$UUx3 zn|EpydBD}_Rs2}x>huYIY;<)hdPk$kbFNOuyrWUzO;@MhiuS8^k=?FNe+I&SSEu3c zz^q!=5KHvyX?~eh^S32jy>ClUy~I1XaBd{=UA%8gM)V3&6Ckp}-BkZ{G^*d#C^+CzqKXD5K|eFM)8ECo`VRo{ zJ-Tc70i2Nl2Jk_QdR4VuB@uiOWBI$9{1k-qDA6B?NPQ6Fa}ZGAl&nsdD~j(*B7e>5 z)b%}$s)lBDqQLAaI*nI!XGQLxqSHT+xpIom+det* zmpJ2eBW+fq-X%r7i$y*3{X9|cVgW(`8ANxns3*SfiF#KlW)>;xT*f^6eKl9#p#+&< z%8uz#Z3`kTV-o$Jw5~-`jzuiTT_9;CdIld_9Go&~GVN0{&QeLWl&S8`3AeNqW~2_2 zmMTekW_r04hWEnz8dapS4Fj!I)-fGg!*`)S05m<4US{gAk*YWFNr9|MPciHVz#Ll1 z^=G6*=VvH|=p}69s2SzG3 zz)GnV-c59jG?xtlp>T3L47D7YM*Sqp0-YbnUBGK~@iC71NTtd?_Nuyow;2?;EvwTY zCDA>4cnfhgqF^eXLRB%dAcpeym|&(ACa6 z6B`AY4!E1VnHC4d?B5X48A5&Z`gGoY2UM#2NdzZNSvOwX&>8c`>6C{22GJSV6i-2- zP9+{dB55_?MMTd13IN`@pRshDPRD)%cd+5~Hj+jvYR0G+nzE;Y4l!((KmBROs5de) zpJ){PCmKF!#$CiyW>Ms9;3v&g!mX!%0IUSSwi5L|&NhHDR%6GXgm za0`7q2Ow_6L3t6*`0``6mQgx(K!;s>7 zY!p{c)G79bH&$&_&0^7Jrfd8HP6>2{5wwLNcLDO1guKp>Eni?J32x+?zsI2W0m6xs zY{F=LI_;Q4&}|Rceluxzk*wu7&9m1YY_FQK*OS>^b!D&Pw7*}g(-B|FTFS@9&qb;Z z?~J3)Ly_WIj?)s?>U7bU8db~o6cV4RdFT-1Gz=b8k)-RG(*2T+aS|u~i^K?;%!xTj zjHD@?*!rbLmD1~XBLgV#WTQ@JY?K4UbS?6IqfQ@usZpeOv`$BTrBUQJqjd^@g*^#S z&r_%~B9qGNsqLj)+rD4R`A()>q@tu!Ymkzvp`{vJqT2xB)>x{&e4S38 zeC^qsq^H2KqjegkYPn2{3?8kM_(r41KSt}+6F=%k>vSG|j2Nv`9ey;9)~Wd$XcNT$ zRm96B@f2Wy_;LII@mu%-;@$WG;^4O)@iaxeLJ}YQtt$Bf`~dMN`~dNF_yOX(K%CQf zooyN;hZrutf9D)f@wd_&npFJPzp68TEzZ6{r`6v|#edDc>pi64z~|H#NU>tS7K3ik z>AP?7Aw`p?(Qg=I|F;?i7o&eRq+{7+)}dXZ@2O=}`ag{-Z6g&+H_-pYy=MlAf*XNm z#hU0lCOzbT8U=R%md5Uh_As=||1cL(;Ig3s`bOz(mxxRs8lV%96_`IXKtHIAJ;K*f zy=i1>)AoT!f!VZH+2!$`As);ukN?+=I`#aYRL=3}^yec{M=}vdf>m>T@#)VcI=b`k#(fZI{0;87CN9gr1(u~X`;hXV7px!b*r~jsv}aeA~O3J0Jx%u_nxHFiM!y^ zPN!Wu0>o$S(kOTW#E;fn$(W3r8ovu|ScDx*{zfz3|IsbpK(|o^E+_bhzf1skJKawB z9A)0E3T%6pLlPYOBJudH!ed{i#j%%_%9?{y^6+>o&Lm}4-zLk=2MY-vf=7|_;aVAU z>TBEQn#l}~WnaiYb>&Ry!3pU9c}iy8+P{p1%)+O2)si29&MKrA`)ENuIuR98@n3T!tIpnN!ZA1k;$sb`y0WTw)=I`q|6-G<=I`;rA?Y6s z=AmJ6EKWW+4jzT*gHOMb=+XwJeB(uYlXrybWa~Ko3@#MESVrvKj9A^#{()qa_+y1W zTAp+l*p{0+D9q%__5yj^r0HX1NSv0#Z4-z2N=g2m!)z_dFxzSvV8;2Zn#7)VzR+=^ z2KN;N+14e5@NZ9GobQP^up{u{=eX8)HISe7QwvEWM@4V8{!Y@daRf0~lwBE`VTjcYCw?1t>?kM=s#KKKrsSPz7Gd z1^(f?gBFOuGa5&Ct3nf8Xaa@y{7%MmCD1N^{mv^ikymKKFVs?n)^ni-3gs}WOBH+s zM^B9g+^@aalu6=?3D*!J8zJYBd>DBo+WJP6pCUPww%g;Cf8_4F@KSk_j)EYk?t$-- zeh1)R_h=NHj4{}v-y`!50PX>RKc4dkz#iL!Vgm0D2+)SdrBCCiNV|andS;JCkq!d` z^bs&P(&`z7@COdGqP-e%eAOv?!6Mg$ebU*KOXIoSkWs}|s6rL`??srR8VMLOf3H`M zDo8^WDe8eA-|f{X_y$C^s3!o2?8B-FVt%2d=*D9HZl4nKPy2uXC+9we(372<7w*$2 zvT}+}V}am{$wLpf_5}Xu1w_4qMZE%|zPwMi_7!ODF5i1nUIAGsSn>o<)#G?+68Roe zAB_`0J?DGuOb$bS(r{dw$|!?@VyUq2Boc5~Iy8-Q7Xx5BG=(moD0eodXtun5bUztDS2Tguu zzDdF5SLP=GUlLrYGNwy{7d?V&6Jo6m0qpVwML@}7_@)bPjXb5%c(#A6rmYlROJ9~sKio&U z=!VDn5reOzlF??8f6F__v_PvsKzs`qh-|trg>+d$nffese;cV~3P0|XkDq_3=q|5Pe zKnuKoE4(Wu-ck>5bRHgNp=%Z1*rL2{gbRJw(e{8;%CsWUt-;7-I5cQlQR7)bdXscQ zkj6Bw#b=~rfIf+YOjAW2-C6`a+$eMk&e_BbIEN3XX9^wfM9ty2%;m^_8`(D9#*l5u z9?dbxa~c0Tfs>5j*-!HGQjajwA(~FXIzVh%%aGq`z~b?2;*(NA^NV;u`;(><2Pppy zKc*kuk)ps2qz49QxE>m@SUE!@NqQE&* zb$U;wA1~rL>Ia4XA0pOuhs{#7r}K3^EIlAS+O+9<+M`8z;3P_YbXEv*ujkI5}Mb_=>Vz$e-bfvOCZ1GhF6?Ip5 z-xfz2rs{Nfk-{6K@SrO+fuZpBNPfq7c+CnA{Q>rSy~5j9oM*pS&<%yZmltR^@cshb z{>l>8?3E?x%6}`;31_iamSBlDvdGi3%*Bv%6))S|BAtS_Zy_0|JeFZIi*%Cawoa8l zwuH@XUXd>6&(*;2$4E%T!rVyv)M?g@QkWZAn5{~f8(EkSa>B@53N%jDX|pP7Qb}a; zRGoICs2Njr>R7B(*E^=_bWE{MfkjhwdP`yMZ5MfTs!mnKIz_fj)#)5y?wG36F#Py% zs!k(|VF|vRnBI62Wnm}L7A5QwDeMv!)-9HrTf)NLh?H9IF5xrL+loD1E@5p^@MEaY zqWd_xtXQYuZa{d&az6uKDAuXMru%t;{7wt0puO6R5yf%ZG<8a}v6S0Vo@afUD^aE? zSpF3JaA|s?6w}L*?ReCAq7>F2YNu21DCE~$^gQQR0aOK0lwM$@p6ysMzGhSyDNUjI zhstsBTPeY}e1LXlJDs}WkU*uQNONGR%)ge?$b~%f+j$z2xrC38*e+ek!5*JL+B(`_ zijFwAM5o}NAX)?MW#WrUbbKKXpb<2dDdG&eT7qt1(6uGHwAkx8xd0g4vmSm*_S9=e)1!n243BO>9v#+@s}iqQxjk=uHi}Chu{WV?#kMyW6_;znL z<>LM@pL@o$sb~)pp9Dn6HXZsj@ZCWEuCu~%tVGOAI;Kkq#%?g2kwj&K$|!8f_)#kM zFu|=?GSRDVE#U%b2wxYQqsIrAVZ(bHFNu6)yn0caF;ab!hU1WU1~JXnC1#Y9>=y{9 z(oWP!$t|-_SeH&Gd*E13;M?a-Ewd}D8k~%gituGQ64!t)(N}{Ds?_ZC<4fvdHiE8+ z@LEtfCBGJ(cXwG;>_o#&H(1f?%Bta3%00Dbq`FruM&eaXgtJ6}lglU^Gn1}CG_z+} zo}|fibR>!CLWGk#ZJ;7Y351)o4w^h2sH#_2R@F!Ap-$U~nno;UlbBf|;4qmqIiFEH zi(vYxqK&M|s?mn!j*3*r%u!i0Ym)e`od}O2YMNR`At#Zcz3s|Jl~Jgfer#7h3S4uM z<4TOe7C5;_1dcX@lJ`o*YDXIx5}yffjGL#HsWAT2x*`}KVf^^zn@?p`gV9`P4&(aN zCCwqO9jRvP{zzjzYy=Bs69*>4^B9WmYI#@sbI?VpgHxo4{x5}-6DMSMBFFXebxDtY#LYhQ zHjpyu42eZPN+^+`d(S{+52o@OyfG809*{O-Bn}r)-*G))>YkEQMkW7ObUghrr>6aFZC-Nn*{nQxsSptW~TkXrLpP+8Sb*lhDO5pKv3>35Y;xPhqA z$QRm7HJ)cS^U*zF3^U}t6WnXSV%{&Fud>K^M>zJ=Hi?Tw*d(ePRKU-+(>5MfF&(E6 zJI>hs=jCH(l7=OZ89bhsFxCrG^0DN--kOwK>)Iq1$UX~iCPtWQIQd!quoN)4RpP`P{M>jlZMdiQ zti#vEM9((J6#_mVB9Z>gBOU7NbFoh&aXydNn78uarV$&SGLo#-Q+twFEJtTxg+|d5 zea`&+_OW}C82U?WPVPZsUICl=`f_HIo2T&93tz*j9?)0zP!dP8*l28Dyaua@#6Z6H zgj+JORs0RrTQmq23?Um3wWhplV(Yz{5In5d3=YD(vEZ4LR*Zeo=91@F)MHshZmfl-NA(xgE{~aY+ zbYC$yMg!end;-3Io-=m20CX_qW=K?tFyi#trsPdQSeK8@AE>Ivcse*9C-Jx@!Y@QnlpU>D_LENP?>MVZJwz|gY+muP$t{Efoc9FpH)vU~C zY(!nF(HxkLWs|1EE8$Rv#uxoK|}R4ja`U-4VX*r6|>sWmK&`vVD(c0tEl0a z|CURc0=7T5V4I9Pcp-0yfgQjg5l-Q_hvE<6{vK2cJM)E5*uzs9#vdv$mCN4bBe_N* zVaAlAsxxV}2og0S>}H6@K9t|8l~qa0anCi4*gzwdHIfmmtOh{_ak>cCV}_=?AxuVE zv0sXv&Zc7747OqsGZiCoYq1Dt>~x&yze_O-yYRK}jC^1_t;8xWxBW}2VgBdeC-q=WFRZe56&J3uyfqfzH4=BKC03!z9J9d~ZHzRt84|Y%xd`Ka-AK2KLOHOq8)~FR zR?8(5iMc|wxr^mFd3c7zcd|NYF|66}_gCm#t#^m`T35?mXwkRd%Br~4WF(X6XrwxB znpU67D>=EU4P|Hvf5+3Ws?+QYPuU)a ztF?m{)z3D~!Ens9F3D$UL`P*U+iW25S`jbNw-*%}Pr`Hu^6*IFI+14=nGD?^X4aQc zC`vbqRR#SIUv4)XFvT>5^*ozWB11b{a8H>{F68Wo6IHRLgo7yHx(T`UW^c=-r%JHe z4cR7NseQWS>*LBOgl0xq*|VJVD-*LChhj8?&5hN$3!$xioAVkMlUS|EpOPMw#-M51 zBpxkhcL`GU0}LD1`SGve>$3_aqNvX&#hCDYzApCdz0i-)AbnGCmBdKgF7mc@5=WX0 ziAP#x<*25&%EEwb+SRx^{JjuiH%Zj{sr(+vyoZ`eSPrpqx5nWS<(%~B6p5eO8dJRX zO{AS@y%|en4LgQP+^FYOB4v(F*NrfvE{V@O3BPT9Rlq9cI8NfZL-I)DhT|sFi5~ot zL6h9)gqnChIKio1g-p(YpVmByPK%or9`KoG8(>dpBx^6^oyviqD(L~rcwlI4T z37x8KBB>&=MMjjt)UiZ40DjDBv|?uO=Dta@fxDh~IFC-bb3>zOZJ>|=;Y8(4^|MV`Z^*N+Fom(WWxMDK0oUB3*E_o*Q2;5dm@nEs`LL$*chiswIGMxkU6 zda8KAqh%DTH|W{ovd8jkSy_dHv{bEYxMuHk6E77>+@*7KcYhkFIr~sOs?Z&Kn&;NK zlwGj!Bl?16lt)LdHYUThmm%7g09(ZkKGM40*?0t6>_Os2=_NV;=`vW@RBj~72}&F7qm4tGok#|$;8q?IxU8um!;pW-UmrFDrZb>+*OvtW2IS`s}hax+q! z6op0XXbT$+RmirVod9e=lfQ0|ePtQyf?m_Y;4yOo~T)*%-ua8n$m54%u2*0YEA+fA88|Z^W;pUg6 z=3}cvpa#|8{nEA?THg0tC7iBP1CA7$HxJ^dXYwt`V^D25Fdhu3F9iggk%f3hEY_XG zEWZlAFiy4(vl*;)!NKzDNKEqc+fqS86b@Ky=WyIoJKD^+1aDH5X!bK@c*(^yGYK>0 zZK4j|Z{bCj{^&=2C$cYgWnOW7C(Q6l?8S#XZIC#{mZW@wopYm+Wx;xn~2tM6Q9Fx6p!ziH_<1eX!{G&_Q+n1 zhLyxxh{O$nJdDaJwTF**hX}pAef9|jJM+vy!x>p^q?$=AJe}=5{v40!i%!SV)>nVR zbUE@G21sJ0fU$aZ+U%kSU;>fnv3%eYGAv5+aL>CLYQQib8lARdHL)hLx%YF<1!+4* z4$^*Ua2sRvBC#UC`=z=&;Yq`a(#=Fwx!69F`1*u03QJrBLi#)s(b_1^b4??KedDJ( zX8tIVxvh-CiRfseHP7XDt=v%SWXz~#B>P#ZSZxN^x_JI0aVz`}xixPXpMWu4B?}(# zmdC^)IQM8yrx#wtUH}Vzx~-Es3cI7zdBgIH1h;byXHdFU7U_`K)G;@vOZD&`@5zqP z4^+CjBkQ!@pe-Gt(SvPOEeZ) zrBpBY{QQQitcuD;>y6Dk93<+fa;wH;?CddR93o$ORlY7;Qej9UvCSuGqkzBR{Fhg- z=u9M5>H-JB-@GUX@xmUED?m}XcJnY}q$w%a`jny3Sz51S6@5@etD}4M23hXl`0>0` zeD*hjk@Pp>*DtZeAleIu=yypzd=RIi0a|pAbjGkpdJg&*brFWPWne(qHVr48A}Sh) zZil_sPzAXr2Wk5hwXo@2W28yqO^wG{Znrw(zoD4p(hlvFmk-v2>iqN7w%V}4XzC-a zq`yOABi{5oi0xVOxKp0ZUzw*G<+LgEA+>DjI!qTsv#FGoN~l5|67!04#)89*1;ub9 z9N5UrRIC+?C50>=Xu+Z(W2ar-3N9!SYOj*-yMf2hm2bO;ZS0BA!eP_4Q)%MgA)D?g z;gJJx9LS%(gdFnX8tyqJ+zlk&EE3_EiHF^$?!b&lJBoI{QbwT|y;U@rBS3yx!-H)S z(|<|727Ac+_NXE8s4fZ*OFWnUFBjD-6(e!|FO_AbhC8O+3l6nD^;tx>AYR1VlQ=Z1 z1iLz4DVEbe&EvgkUtqcQ>8x9eAzv)ORzZ5FL-4<3Xu0;!8L-}*q&Nzxtil-(jsYUo zHO~2lZ5c5uO5#?y?TIE-ADkkk*3{#C^ibA_#poJdF8gBURM>;WmS5CiOUVXjT~*Me zyn@nMS6-r+T*QtnE_j+M_<*$>lx-NCbxHiB3mhxS8hYz4$8`HyDI;lJV%mMuDc5Xr zNh~@<9jdS`t4}w{b`M8w({Rlpeblsyb%2-fD~~b8Zq4^Yk1s6V$8LT2fV~vr8rYph z^5lU}!X#m?s;U+z%HuZaiGaUd&RsP**RNj|9Mzr!3j0RsU)XRVT3vAij&ebg*oqY> zqL^CXR8~bZS@caOQf)+|*@kS=aLxXGh8S7L9A@F=wcDgSa^SmV6pp#_tRUQAG!3!S zQAZ96p=c&cx0k@-lP{uM+nkCHW+#&~JjJ8CTta@5zl3z)LKsqyO&yPzP2MWrt4AW* zJArlR5Zi?JhQ!kL!Y`)3baIgxr{_WAX}hlxtsg>SeJ4>k%fwSe``^u16ucA(tjn_w ziIoA-W@Jra^pp&P;;@|w@`M~=P`*@%{E{!;(EED0;a<)4FE>tFQ*SCe+ zX7rG9HOLc&3~?lv&%UzCX?6yh4QS;^b&>;dt}W)p-x~#o0S!1Q`u8BS$?ek|O`0Tj zX?Ys0tm1smIyWtETw1B9Z8n%Gm)K7eCHnAvI4^9ok+$;=C&Z^)^tw#IqeyS^Z(qJd zbg1dzgc(&=)t7jtn0B*9T=3N&xb12{`4`C-EALY4>e3Q*NYMp3I5qI!D(${wdZ+IN<;MuUIpt zN6U`r)8|vyx<*3=9yJm;0C0#7DRA&%LLQJ;8sp<-03rRr2Pz{GJ;yez6gneTqo!RG zgPlx5mubDvX@%X-#^yMkf9=~M@X-^&Hd z-#_!?B;~B*4Xc$^4xAM15RS;Hj>O-1T$oTGdL=A-$Z%ya%CcR%8D|+J7R%t=MZZkq zZ2=ziDMHwJJk;U{xV0t6vbG^lk@vxUDa|>Y>jWX$SAOJ!Wxq$XDYp@e!D!{whA8MH zvFu?rv;8u8FUPSQS2DOop6{dbZ8C`917IeO7Vy9YY%x!9xo6SlkNc@9iRH2lE8Eiip59c}2m+9<(8TeHhb`#6hzScKZuM=m| z8Hh?^{294!3uoDFl0OPrYs5_w8!$$x7+_z$1*-wf?p7+%FKyRm9ejDJKZ$4Bp6j!z(N>DzHjpbx zdC;(N7yL@9kgy!|C|+=Pp)!xO(ct)3_HKb$oY#H`bYIF6ROyB~@Ta1#g zoJ17UTm*w%f72aYH=-Y(N!_9GDh^(~&}c-b-l;V=6-rh}iJhG!UF(zP7X<&DGCbEt zSrQxJT%(8E;@yo>t9J@52&!2sL;*51a zs|jbU*R{hLt51dH<>0yzLlFAC22Y3-9@_b*PuTtYWb%jrOL7v^{4;{E6_Yzc_UY5j zr^AOP&Gr`l-I4>G<>J;B4B)Yn3}&CszuE5Rw8?Ad9(qEatUfQOUYjojH?L zJ^2fbCoA-1G&VYN7(pQL*ZcAp&_?SGE7e!t%vdkIz90|T^r*hL#XtZJ*A5xjC%49Z zvzUiJ;DzdGM=|TnrMLLU!Di**h2C>sOb$w4(3`|tz6;&+X2P%1QhF(dlf**gD_;s+ z{9qvvvGlbH6*{m3q=guT&TA>p-aL7*jAUt~1G_D`REuD{&`iAAP$TRAt2Riymshg# z>$WU0siHQ$FjQ4+-+Wh4zUB~1oNgFw^JFiVv*P75MHurS{dSLxJ%RpO6ZK7H8zR-b zwHEK3DZ*wd+dy>Fp27h^79eqBeA2h$SK(&T4nH(X;==>rr|U*!T$_)Wdb1Pfv37jE z2OH0q7B*TK0TA&*8eB%a0Y1 z(EwXZA$CykF)u&}>NC&Aihi@ktAAaPKj?nr{p(uo0UtMCU4fDXe`7Kp17twSH)0<9w~#>Ey6d?r7BIY7TD6o+u z6n?c3vE>dMwI7~|8Mse0Id7kt+xGhOmQ#zZygb2wN-x;`!R6BE#Uogb#KG;koKL~q zV_~u%YU2Azu*O^RV;3u{a7E9?b{4l*E)!vwsKXUyglkUck14|fD?x-0g!oeBh?FDa z`(mGLbUmUqpoMV8w5@c^b7!^cm^q&~&eqt$!N-nsL^Zau+Dj3p1}0~0jIwf(I3|4(=b|1tf@NLox~UnTL;GI zA)|%c#*l+$R)kxZ;UK~}%TbKyw2ET%6`YR8ac!?UX*$lZdLu>RCfG@LqBDkCVR=dWnL#))sEwY(f{E1#b0XO zdQP)bJ-{?#Rx0ri(@s0MnKo18DDy>=4Lw-aDN>E|Pn*P2!AJ2g{D7ruGDgb5f8T<-6lBX-Ef0o#ge6E!(rIEOAz6bVPNdp$)Z%l$Dt^w7`I5F$5fAkPtrT%s zRUL7gse>uBNeGwHACo#mOFqs&^Cghl%2@z29G=4FkHj`#^znscet>c)kYM!yGrCT;nPBzt^j_D3cdmD<02O!E={t^SrGu}&$ zm2>XLE!scdeJqca&T7MZ>|<3s{4^S7MTh9l^ANa~iIPC@aX8NJD74xRVOryLRirwr z=E6R?Lc-1TbyFa7DC_iJmlEOHj`L_a4@3fE!N|X3dE{$F|8^e-R2|ssCVqog&nOB zSFZG*{xzssMCOj{m5Sj|kHm{UO(>eR>7^qIqr}j!Fg3tbq-73Dr+V=lASB*t%iod< zW%Ee;rS0Cl3HZtnH_dMlZ}aqiTB6_uQ4K}_PR_I!W%cPn7}vaSV1sGwa0iZvRkD1t4^IOg`A0*i4d47cyEz(cxT4;Hr)Aq9j@#s!q_VU zXne=73Ldkm%x96CtX}Jo&mzC}euS)arg!I!gpB4zxF&`nAHQj+nZOloWkzTI;@cFw zG;O&7z)L-9aUpjA7}mp>2>F*^9GZrULPSq>17BVx@xBbb_^E|mVbRK$(Q@vd-*8=y zqVhbJm7e{%b~CdcD2?!&(wq_E9Q)f+oMVR^+E-erU+h1yX6qGqO}n<)8Ln2O=jClL z+Qz|kyAAo<2lNB<_8Q(=lNcbvS;w^fxOra@n96bc3g{&6I8uaD98=#?VY%9&7jVsR z9Eq{|oUnPf_4EsZ#?LhzKOlBpn*p)wJEF<3AK#D*h<#KA#QHObjL~OL zDW4W_6-c}$-R2YZa_KHtwFu!R?vBpPSo(V2<%BOB)&S11bZxew!LXZ$%G(F?u(&rH z&7=%3HQ=KW5Szz7$vx8x6>t+)QiY9%5EVeWSi={(9@Td))bassyxz0+Yv z{TDCC&7$%)*rLty*}my-Eed7u*g7Wq7l~7IOhXp^3BvpMYLhc8JpfggGlICeg({%0 zmYW?`72^*}t5p|?TU!vq8`&cKR&J57ag=Q%X129;^s&&GVqsf2N_4a)@oPg#DI*`9 zC|hV%QQpm|$6c^f`hVKabtmzTuXJxe=aG@xrhY-K4D*YS(sSR6V2|A2PLKAsqYWa=4K7;~ zM}J~CPR+6nHL<4NSdye*S0M?I9xjIX?CTJh%)8veez&}Z&EN|H;DrvxKSCz0XmPXW zfTH#wZ29v=l@hUt%uNBLhzw!Z<=}W6YmP=9HMqYk$Y_S}O`|5P0{jXcP>7S2Iig3& zBHB{e)jW(8XiS3q6438>bgG5}lwSxjh&Auyc)cKI;Zcwqpv(h%C~%hC+j5yFd?3i94m>%e2fI1A25h^m6Y@2NBCPngV;;P_hKut zeI&82ZP`MNw7x~TxrZ}gh?DXoH#zV&o{_;M2*$v*@`A!6)%AwcCy^eE4Gvyzd8X8V zLiB>{^a&Q(F(OnMo^VUSQ*?F}shE))C;9Rf)8n&bn60Lp0tIP8%@e7nKcM5ZT z9&)Gf&jE<@gnt9S{6_c%zU(w3aeE#+bwpXn250oB5yvi(SX`QC5o|Ef6^XexZ}aZK zIqEh;IO#dwyeK4Jyc{iW-W(FwVh3xse0tEIIHKtkjvO3*6HQGXYCTujjlFrq9F;`? zDV}FJ$VB4#+py=UHQm|_T2Q_n4j{Qj+HA%5#TqS09SH{{KKs*>P_0CG;)GYq|WY71Zk<8F2sUVdc3EUTbQo zaF}7q4S?r!|6b#*;i-p13!WnDO~c3Ze3V~H%)<{aCwX~;N87M#;6d3!FG(RiQY3Jw zP)|($i=sshhs1ta9wd|9pG)TMk6%6$^xJ~E$rV2rE8Y7nBmeZN+SaLT1e~O0h}D@- zkZ+G_$&IZx@yiw&A_J=7^%BwFI^-+VE381woHKc*-bNc#R;iZ|VwMv%>=>z~6y8Gc zg-V%jCY?-XQ?gj`9Ly(1bng-66mGyPUmWHWw$zKPgc;jA9lZBKMBZmI^n4Kx4fzP- z6~1%C2NQ4e&sJsiijBxRF3ySBaf}D_)M+Emn_HnvH<^t%+qPv3S*duMt}GgIWTD1T zuX9W%iWAm&n)ptSS2e#BVDZF==MXv6c7kA!aUr`Ln%R`GY%@00G-BtNMl5NiO!=6t zMZZA8A1Cr@@aEA$XmDepFKRt8Uz`IEGr6N&c~24^LeER4CM!Agx8mS5J5eKdk~5NXkSt0N z1BwYzLBIrJM)a=VuIdEndEal{^{sW+y8OZP4z+97u3hz1+?6nGY3Kr`&hw?%%7dXE z7vv`xx|TSlPMQ$*{uksYi*MNyrLe<;yDZwKzFUS1<`ZDQ!#|uuD<;^A*=dyW%*}57 zkE`Da`F}sQ`TuPj9XnKC!mb@+E#u%gpDlz#b^bbmI~{upqL~T6-y6t0cFkHh$Jc*I zi$)PNY-Wk)XNl=lCxTzh56g&Omz9Crva(%1-fLSW#IX4@P*RkjagsJ@pT|#+-NuCP`@V=!vABSc_mRBju5l z{^|U78#!ru*-4U66vu6=Mxt^>u!FhYn25rd62=JAWr@qb%d4esN7adU3&zT@q8j}$ z#UJp8IwwUYqKH;y1ZcO*77_^=>Rq#mSC+BF(TmS~%8#B*Twb)pfR z@t&^+>ck>A^PY?l@gg-DdiOUa>mBShQg$f`bGsC(|Fuen4f|e}7}Jkkd)X`LD>2c^ z5TB%N7Y_G`LG5AuTN${svq=d{n5T$W2zHyJ1pn8c>cS=^mp8nkQ4{C#Vy8)QBY(r< zE1b)(Xws-jlV-)mR}>ds-uQ~b!Yi6KyF5_ZC{WVqiooTiS6orjsI+lm)5{A>{m$LT zhNUqx|2d}n|1!UZ?fyGnn&|%d>jd5Z-;XB#zo25q7o19^tXLTnj=XZcRZi&3&8cnKI~%6=c&QY!xd!zv&n?HJ0QvZ}VrQ4q zqAYBNW1%o#)rESQVcf_r-C!(+SF)CL#FW|=xpj6m}8qrEB^SedgTo;$rtT^Q{J z9Bx>HaY+0nHzyyB;T3-Y+lS13OY@e@h2lslwv<-#Y`4RYZIu%ZmiB@AG)vh#VY{+; zK`g~97v6%R!88dLKg;Zl1Tj~Bq&PFrBuI*te{&!qzzBgX)UVk*vtN}MizW&m3zo$g zkX*g*me$7cbSk5=uoJ3^K^;zC=#4pn%BTaC9v;EqT8FCmWI>&7{#bG$6#tgaJc#o% z+ny{%%d((p(9fN4Etu;N$@RlFouOVy9}k3_UL9`Z+wEq>4eC&KYC*Y9FZ_^wL72Tl zvct2b{)eX0q)BnJ!X_n6OD=EPtZ`wfzd_T&!X{0dHT9P^b}nzwpmC$(hE1C`ySz!0 zM$Q$*f#N_(qbr&fH+32`EG)ge(0_T8yX_hh)L7GiR~M$%#V%=_?%@@YsADRRPuv{; z$*@s1c;JAp)gn~V0h}O4lkS+RD8Gr)k;(h-6Gw{9xF*_xj(?k<9w?hN|SlcdP zGRQ)}H=fj&%Zy4nY+|!W##c%y6^r+>!6_2Kt5?>L`$7|LWUbiB;1(;V!og6PdEJBu zxhokGWNs5VRP{^qbgQL=24ihoL9IEF$PnWUanB6uOo>eFpO>DaUE!heInwzm{SZlB zK3j}AXCq^k=QzZQ0B2lPLk4D<=Q}Dx6%+%mE~H9ck>-_V^A76a9J$G7JTg)Ciq8IM z52%@^D2_#Eosu~Su_}z2b?pZ<#0?w;oFbYo1AGTs=&kx zaF`9$duh3x*bo&Gjb&ytd5&Rrv&XfIr;E~MMgUFvY=jF+xtTd5-pr(?|T zXk|#wS-yN_=EqFx@@B_h;zZLzBF;+h`|P!cn6Ew~$(uLTyE?gzpa}S z!Y+xJQ%CMXd?vqB6;@{BQAnWR zj5SfG8SPgi;y=e= zvyI0rEnb>xJu*ShTuaK!uV9SMK)Ax;1`)%qnPV%dKL78(Q1;G`$;U7G@V=1AC-ahm zgyBv`1s~ch)m5hoS`rOM%AkhSkq+nCI+<0%8I>7+PPY#iG-0nNWyto*YT_g*Ns%hp|+o}uqV9k z-*!9R_e@P(Ds9$@t(i)4DkrR$!sLb|~ zP{;3%lfx-VG7L)}RYe(Evk>Y#bI_I^R40b-tMLd*s`@g6!a%)~3LPPpkZJmou<6`V z?}iP%ROY2$^Uop1cVGlI>S>~R2_ zGGCs(;@ipGA-3P{H?K**LmV&-M?L^SY`um*QWDAnB~S;hkr0}s@Kg~0ra1EQ`E-o& zj>Mj7Z#j(f)_*ca2hnh;Ob)r_&`L6uovPlznv4;qC{$Eg4E3zJ6vq5`sE2=#%~wLD zck{UCqz#;{_IjT zY=j0wHt1PO@?vu!ih883XQqTLJw_Ns8T0r{O2j;|7NL?>92U2c9V|W^kucVUoTJ)9 zdfdP{W~IcGHc=(Am&{9vy&+X%KGw9k`2g_Ov1U!AwO5`VkepecCraWkFXx$X@UC64 zS%a$M4+PLt)-ih{%D-t#AjN&+_IceenNQj9HxU*&UZ-WzK5#|3oIm{N1iW%fzzLv)3h-jrc3gW_J90nOSH#(I%9X z-za|R1?Dfa%;+7iZ~cF%xsh|M0UEUVe=0@}%Oq#pl*1L}N(boCmNIQIIS4!9!?YO@ zBR}9=@A$}uCr&AI7!zrdX9bT-mp0E%%zvkOq)*Qb#FcylI2Mk^`KYrj9R&XNsayNb zZ&77QxGmISGo0mPzZvh{{+Lz6Jo@{S{75y&fIk#-D(r%R`AYJb6eMJ4ohnR}7)mMr zy!@C`(S_yo)sKe5@ivU`(oFGc_WB!YBo0x%mJt)QEG*M4s4p%|8zse@_^lmU@X@8B z%1GjEy;IW|^73QBG7hhN^`rjY@^Etin0#YqJ*Ie^vKZ89@^$`ursCeRD*2Cs0=?yY z>Ob<7^oFYaKk_OG%Da^RC?^(#I`@CbDUNU*?SIIL$kUAfm{&8X^Z$pKD`YqAAEj_N zpw9mg)371t)Qg|ucC zbK+g2^rXhgeECt&+|4X#+c)n;|M?C!^-S$Ex$K7xt`%i4!x zaYhvkxATWe%6SNYH)ojGq>5vvs@*ZY`Aec;ynR_H%omo_6K2;`@(5yp?YqLU%Ve*( zoctkwdDmcqpHJk(tn?tBwfu>X1RvyV5$h9TXhg2#Kpk?OXcnDrkzg5b7yFX-$mlr} z-5HnJBPVvFSg@>(6AyH23pLnWL&)sQ?DAGyQy@EI9bZFT7>fgscB~=0*b{2RGHfe1 zeeGn+oM20=H6*;IPJolTx3bJc(}@Q;K8<2~mMrE7(A7k*#@mAXyK;#f)!+o>HyWF{ zUYju2IS=sm?eQD;Tud;`ws?bW@lNZM7{(+DIz$RuCl-%I@IsADzm7Taq9ChVc2bHu zLk;965R90ZJyx75M<{IAZKgX;tXyVY^En|#U{Ai&&&o2ke6bpBnG%0|!XhUS2vmbohZ)V9!b8Wz_>mWGxlJS2Cd!=5Y<=pa>Gv*9)|FJOL=#lT5*BKY!{qn2`< zi&;UfV6?b+51{-WkIX+gov0JR%A8Dx;zg8L880}l%}I3w7bcU|5#l;YRVP-4^*J); zieQ7FQdY1<@P~r@Qp`#h=1(t5Dn(h?o+#*A0rljCsoc|9YKRlXB1?&alo<(!8>N!rULloF_4&4d26Ur2Y^BqP~* zR2CA>rxd~`rr0OfgCr8@etB8J?)n}uKr!zMekVMsaz+AjF0~bxoo;aYKpo_QzI@$} zU&xBc87^@F$fH@MK(TpNsJPrQpSYChsN=V%vY^J8TN^x$!JWGjyFkH%JF-+!rwT87 zEPSGlsc|O?3jUZh>wLll06#FeM|6Sj9VpOM<0AIvlV0@IWj# zanb@<$w~5;Y)G`kcqOS<$Z<+yvXRHL<5sge#9~G^zv#zl8A}v+AqyOX~_dj2}bM#A4Vad%A;P$6DJlpgLFc6OJsh`HLJmZlv(&Ftjr^u{uG=3pvN7MArE z-WN;z0(_DF1(4%oEuv*6ka;20)NExQLSb)pVeCHGALZe=TqPyCPH#-h=6t7)>Fj16 za}G6AXhWzmnL;yU6$j%nO#DX)ji8osXED))#eytVp;)IO)ck6EJKdgEjm5(e^D|Yg z$M?3S!E)!uMVf31YI~ zPAt)%dbe;}hEUUHXzmjyG^!-uDPNYJn1Lt%Hc#7kayOw|d=H&CjNT4OZCKCSPxClpFf_0)XiBS+UYq9=vVjv0Xl;Wmg zMd`*(#6`%A2Qb(5xA6ePF7mZ9pJPtDp*E&}A2@d8=QypSHxJ`+km;*$25yVZGj@9~ zN}s+)<9#Ad{mM`vTu~7YLFLJm=bRboJjKCytIB9B9OaF8Svq>nY(IZjRRb3WLN*Rm zswSgOX}J@Sa51b;s1X^*TT;|pLj0sdy-a$tSEK6O8mezf`eByh3WSr#X+$X}))Hyq zc=qr~WkKy4m1>->bOmI921RnSERj@y+ORMC29~bgD zQPh331_vI0RX1f%G}Mlj6|Ks`bU_)H*9qYjiE+wTJIAWbV_KnDmv9kpS$>_PPH?+2 z9*+CVlShF0`R(Wrg=0{Ym8v5|Oi9X~Ze=Iyz$$cEg+CIj-_hwMkwQE8BjEcibt(yLQr%ktAooQ2Y-V)+H zCAHh|elEOe?J(9S6sT{_)3qebQ-4s;{d06bdx$-Czmb!r6Kua{juW{5PB-I*cmK!J zyPOh7R*u_t>d@l$&Np{zRb--kx9xOY>z22)g#_3;t}6eJ4g>g7rx-Gonbj&aXsP~0 zx-!zlDx3<5pR3;C1G*=euO_&lwz6-q1~lkWzT+f4V5**lKQY#VdhNJG^f+0U4$$rD zq$TC|DMi`fQapxoBNqY07sKTxt^5(QK*=*(OutbE<8?~HmBr;E@O43?)CtBqhkH5E zPNiLXg`pnRa>ONbO@S-QsXHMNsNFd#xgKU$2tUusycd#}pGx7Y&o@UqF~rpl-gPJe z$ea?vzVdx@tA>va*(W)I_}tvHjPd#1&$F|}cp%{czY^9|5ljOyCy(oMucDH1;TL8p zt}Z^>pSv-Yap33_51{!Kxw5{~Gx_@1Wr1$~KsSFgz5-F7y_$oEafKSK04P-u0aS52 z59+x!3VK?gzFVVy6iUe|6?CG~{dpuT8bpB>HR)Vdo` zpEdd)YTY;507}5LY+~^!rL^&vmvdH+{g^r1%V zP!apP6+2YKYLAAgXaghHkLOhTP9AtY8o67H1ea6O5b*B4?JB zW1vMzITMbR6G+Gzic5@~$wtm(k@K3BW1vk*Ig^i*)3C6aQRq2#lJwnaM$j}7^tKgb zppTM*rX4FN7LOV^!_dwsG}FkLDRREFat!osQqIg{+<{$k(_7dxZ2%&<2hX5X1mp9FMAGW$1d_Hk?#rHgB5(Pf+H(j%eEHCC5*j4ts^ zUHs)`@~Iw)G1d?RwDPvw4CDqeTyr$_AXB)fkJad8MLnZ0TFcLO-K}FahLW863{zVD z26z!StI-VrY*A_7=)A<8{FoExF${@?+=@@CbP2bSgA$|gm&+u4KSveBfcJB_e=?0_ zY+N4Kvgz|?_ zk^`XsSyVfi8J#fHkZP)449`_#ajRGJYPgq;(|FuwGPGL$7M91oW1PmI%|JT$hKf0B$L$`>ASf5=1YGac@J?e3Eki@j zazFKIsl^ZCFhAShTqv1dd|Dl~Km#%TCtF zt#B%ED{Hz9p#Zv)tLw=c-i`F=V#Iem0)8dFc!$gdhtz1=o;+UT5^8q(#2NR z`BZisWxz^t;{ZXnnw2u!!-}%S>ocYnvG;RHH8e@VQp?$|Cqe zvmI97d8$S|+2;|RzL2qU&Ce+=DNT-7vBN0g8&Q~v1IP!%I_|z=9V@OHpEonXsYXiQ7%c&LX|1k04<+}0h%5DkXp8i2k06-Js2Y( zm-`234v{9;(#Yjb$uj~jq*@__w_)Q|Sn{8$z(=!W{hhyfOHyg97o05&u;=E%to%fGg8hK^%2+@2! zKjHzrcWedN;Vzc!Yn^6XbFKJFz0=tJ-fua!3P%IWu|qgo3C9R>ltu8l;5rf~{qQ8K zN-wMiQDZHi6Wmp@6P4^uRrq_JizKvy1pweQYJ8vRWQ z_S|pU6pOX=+=EZEJ@<=D%AWgE%P{!Zo||>{l_f6Mrq?@Y;gyMAPqg~YVm~%oO{8dQ zRc%{_RZkOvV>L}n3P)m+cF%d6?=kQOME-21)aNr#eS;Axv$t}8W5dZ zdWx2o{-u_lVmq~Q2PSFUUOpQMu= z)7{KDad-38X(#G#4l>VVcVmuX&PBku>^H_`zY&-H?X*NE^Nr>xBwdqk{!r8jR5ipr zoNbc+VUqqKNxi3Q*a6WW(t6G~J)^bQsbe&#l?L4r-*309?HI3!x1HL|e>Lryo%>u46c;uVBsNc5*%mfTJ_ zF(k_7kmyTdVwHh_6N_PLHZ%SHbPaEOn`yKkN;-W8n`uAddPcBUv^|+PX@oD^N_`_s z8e!fUwh>OTwQC#U4NL%OQgdvI53{66h0d@|st=RWc{f>xR)pKF=sd(Rj4RK`>nJVKzc1p|JBgXNvE@2 zU1aHxWy`Q?B_+!^tiTcmX3IEi4^?4;rf+48!`x@eM~dUHYi)`_*)k3*I8#H$VgDhE zjKexuj_0$F8;9Nd)(OX9F`Hs~cG@`Xfuss{RB(a@U_bZ^5`&>#SsV=Q5-+ZP!O%Yl<29a6nn?yjce4a(nXrXnA?DjT)XHpWA}h1mL`u)JU&@u){8CmD zWQ$pu%@*?*!PH^ZAi%#6x<)3w;&aM%~C8e?3iTI;EcnT&M$6~IdaRmEKwklvin{UJrSDnSlRyTi0 z4z=JLF-7aMl6|4{1;)`nwx#$vJ8h`H_jng$3pr?c|Hu{}=y;Zf_`oljK5!c~PV)iN z$%TqJbixu`WqQjYIpPXKa_9>8QeiXu9FoJ@4^ml^kbU8h9QIx(kV)%eDHo$?g$X&z zN|_*1q7)kdCP*gtXUd#lWU_*6k83fR*5=8ZWw_rcJ=Z8bSLF4lJlRj3o5NKAxED;) z_|qC`VNRMLSs!kQ<+wqOjsZARWK!Lw^?$GI0oX@hoK%*tAIWIpDsbmbn zV7YxIX9eDMsnKx&-DR__d+sm~USav-{<6-D8QFb83lCl;hF6);ou|N7ou%Qez8%Qx zRuV;JHAVx0^uqt%4p3To#*9=-P|uQj!o6>jMu7$IgZs}(8qF>EV1A>?Y$5-kbjNV0 zZ5S(YL>bMWGFz5UDeAsEsp(USsve*>@%wO{&EQ#;sTwoyY-um6|DC%8VZ$nL{e~r- zY;vD0xu1QuHa3~6#3wEupfP6QkEra*lZoXT`EQ3F3 zS-VJ!9AcT|ySZ$f#tW8wTbiUXmgyKt6D{lQBI#AjB$C((EVSf~LSB_dP8GJqDXuJ& z2*=S|8)7vV3R#Tblrrt*H+AFl9xe^yclp(k_D(v#q~=kvR^6OH53Io?rAGG#P)8MT z?Whh{((X>$tB#x}%;j2n1O6;MTf_T0t1}icOYJ=={_o`5&)-^hNRmrKRqx_R01ai` z{l2p`%sPC-tQS0}`PA7Oxs?&z$py(52}p47X3Tiv*&6QuOxAdJJ3xIK!R<`e_{f6I z;O;+JW3L5oJCRDaMg0-1wY#_;|Pnv2}k|$9eD|;fe^J6dOMAFKr6e!0JED6l^H5%pFq99mLTd!BAOS?2vT35?Xh* zI(%Yu`0gKcD8xogv<>ZXmrC=y$K}T7QRb7#yA1}&>Qqi`jl3lCRy^t2($53rg?r#> zS;_gk5+^PWy^gk~+=E=I-o@b_807k~fd|!3t*zm`^KBs4iAFKl)#OqSYS-rXCfQAt zh0C0{6RN@{*-yHkE~p9^iw15s$A+~NJ*t4nC9mhFaUS%f)_tQ5>hs%P%-$DXKl6&= zWTu=}o1R{Kibn6Z0SZ3FS2#uEtJ)gAE2n6bo|B z58l9@95uQcfJ;?@16+F3cn>C>lThta=7-#1DDFg2Kw!Z+8oB-$8WQ-9Kp=)D1g<_; z!}~b(tcaE2a-s&Gs{!P+nxgS0&j$GXQ#5v*n~;7Nd4QbmQ#3ZS7xoRFqVa8#UTWzh zrf6*8X&&E#DH>;-mq>q~p(jmlcAunRws>3d_{pYtbCi^Cj_NScgStr(bCk%)Ev<-S zuKb>Kohm;%9pv>`5NALi3wnt;$66>&Zi07E2n7G zeFvbW*DBu!Q#2-?ui^V_ibm%;8W;UEg_WwNYTRSlW~%&JQ#If_cdABl9gVsdPt}Om zNy-~$8P^+m&)2c?>ebcA-$!|AQs1@A8B#B=Yo)fYOQ|VK$_+g^3d-Zw+we?vW5xHC zDyRb9S9JIubv3-%?*h41*eRHti#RYj*`Pj>J(ID5I>Vqo5hKkJ)OiNAN48Ve3F=~l z`bwUmd|yzP8PxX@hwXr%ni0XWss)a!vRy>q^bqOohyK$$^ZyB5U-;8s5HCHi-GM8vn^LQW!0v7r)_e9>|VoSZjB}0?Z?*e%Mj#LNSmrd0epQQUbOx1WOPowVbQ#GFF5C2q+h5XTd zs>Y7I41>vgUZo{5yo2|(8r@gA-@Fp1s$*q&IsU~9i11D`wyItG5)XdP)9@}OfW*rfTd-;-^j3 z806D%&zq|8jYa?4_d0Dx_B2&1!X>464|}YpVO3BHgsH&G)Reaflz^yDWfDMcZ`{vY zol~f#g9lnS^!}Xrgx1UPS*BlCNlQ_=10}Heo{V;$tWbSwd zXV~j}Tzzqz65tGuBKHeyfiv?HmJ}Kfke*4V3-YD!mfwZ>8r~Z3apN7Al6W-{_Ygs` z4b7qBTbP1yAuc0RMLz4(ebzLMq3;1y%ICXyn#N=K8t%)cX^gh$+k7`p(|9Idqi&aJ z8ZV?0j<+27!avhOx4E-6orFd2nZv7dlG&`Z^ou2%R}$H*w`h~i)I>IOO*Z#T)7We| z>iR0CX)I&Hs%aWKEV{_|+%%1KOgL(q#+FpVPb|kp!vB?pirf>YX&kcp@xuej=2uI< zK(g79$mTDLHreb-WV6p?vvrzA&JJV0|M)(o;Cv0=-f0?tkoCK18r3e*xagN@VhHk| zlEGi=63c(yB^tt?m&VWfIotAIA%<&oiLIZDE!r6F8m4Cbw7*0$V#3QT#}!gPEiGi~ zr}K{V`k`8PSo#%Gj4lbax>7KU(Vah7j7sJpOLgTo$(3>r;$guv<4TLaN-`c`A(Qd* z85xuNWlO(WxaV5PaKCmO_a;kkDApL5u*Sz0ZLIM;b)_}Nl1_g-kQ9`E(WaBQ6K6YF|GRV5rI^QXmTIZ|H zAIzZMr5vYmL3X80(pYM_0r9Etwe8~?6()PR_fcp%xmME2wPGjN{L*A6*NVN*b(bdk zH33Zn+-UQ;P8wi`OEsk3ZntRD0B@y!Z0B7?5Aoa&EJtf8Q@2E!dXkk!yYJG>2DmH1 zpU(zsTI-_;=BHE4$Ca{a<76p6KqFJic2dfAEamW2DciA>W0Iv5&^X*)n|XWj-^ncH zWz#ecTD0-s+0=&qyChZ0Uo6Mae*jQSUATSIHO{u+MRi+D*T^Rqm$NSZ0Js@IQT|yxNhOO~mwjNC*dBA`^MHr^ z(}_Di>B`!biVrc;s(hL%s08F4%_apJ1>Guu)4rJGLAwHtdZO{^RJi)>)R;s6f3bM} zg0#`x@6|I$bH7*T=m|1>Yi0{^jv3rtYr*r(%F^{oFr{u@zE#+X`s&MtYkY*2+E}=Y z;^m+&?@jigC)H(S0iesJ^*wmFK*M|c2S9EJcTs_!_1V8C&5$9N%iH)^20FBOrHHMh z*n#!A+9EgTo|pN=@cJ6w3d#-Q37M_DLQEwwr9r2>1WyWfx@7k^`IVMe#=1%DkWcWn z*OY~)*}C!Y8nc~WU&EH>6`5zQ7d^^5hhvx_^7UmLdWK4{Q^1o6G8D&0!v3$zH1f)W zA>L-jEcNqb9(H(uI)+Q-V)0^0mCsa+y|GxPqD?O2#AsL=+j3$1kKo6p;Wr8X1|~1Y zCQ0mErr}*j9)Bzl4B~CUMwk@d--)+be<5l6kzMcP(2SQ7zY^n)r@(-p0cm;(lnl#(9>oLHVXk*I0X*hHvh4jdw58sJnE!#;zpmC6;xY z5{?52jz5Hhxm;m6J~z3X+<=`qb7^Y{OH9&#HL$`jN^*3z94idRWeJWeg@eNHupFz6 z@YW=xJjD8W2Y-~IgJN-iG>%WPOd0p+=TZd~KtC5-W9J4Md9jE;;KcB#>z1onyT!C+ z5dCFxR+1^&gsf^8jK#xcQGW#=Yz~B@CD?`g)aXY61jXZnXHM~;q5)m6GV1425D?_f zeN_Vvn=1o7oOsJ%9910AKa|25#2_MKmBlTE50A+teN+PtZ;+~$qZgau1Zw8y8U4sk zfO$Wn@_9zzp3m=Pv5#k9`&w+dWldS_xT2Xp;xnw*rfA%>=>|NdSh$%ioZO~-O7TAB za_ZbI7>i?|>NnMc%~ba>svE=*@xWc8@4D$4BdiVsmG6h?8V4F^_?~PD9n5WNW6KzJ%Ry{fYf54dVv0I<8uuWI zF;#wbYN+9To2qwb0M|=A=t|5^VocR_lxya*Wu>GWb%pmcQiE6|MeRxceZ+LP{li1V z{6tK;gry?k*@j7q^B4`r#M zCyDP8aVilJL{FdY!RO?zKozBYE&968n4xjbhX7TI`0CHl__3je@5&h(N68@rx(h8s zG_80nT#J$te1SbKQ=fVF82Qf=9?-Nr=Oa!kg+I0^TR1{*i zi2F{|63h0p3eQwx+FuH-Y0-$K=UDkk%kgS@i(onA8o(ZWSj`xBvoY>w$-&)7qo6bx zjl~&70oW`Hig}F^Zn9aH=n|{bTNHh&eIr&#p9r?frO{%7y|GQ*Q{ce^1iIq`apdO- zlvais;6pii{RZLQ72Jn@Uk$p{gCj&#IPq@bk{EWXA7dVz*;vCngeK{Mk3~ugVm>4$ z$dx^OD!KM;tf>{B)%{F#94ZK|p6wR+0F(JX0&*EP1Yaq}3F*>A!y6+q(xa@iKi&-o zggHd~1mc6GA$%{|u5QB74m;KVWCP1TGM>Fn`2yL%<|f)KDgO8oa0-C6E?H9CD~Y5& zj@T6ME1A5YDJyE;3=Q|kM$|s#+d4y|c2f=Cju{$_g=6;&jk7Grr^=T#Q{!48FzE%B zuuDmb>xIA+K1yAG%OrUT4*`GF}dDH4(2*cI8K?V(cE%;cdP@&WN^1v zwj|jA9(5^Mu;;?#<5~4*aJwh5m-2WP`%QS;f6U&c1dmJH(3hKPcyA&qh$rN#-xOwR zwz%)H`99`K+nIJgHUsdqo#`uQYLr{v$6a-AnW-_4Qe+SxvxI@>PJ8UbN@ZHk2$w48=C5*q z5mJV)n`#s=_BIjhUVkJ)ZaF3}S(me|V5E>wzg)vjT^_T_zT^^pe3xs8K3DJu^=W@O zeJ@j?P_W$Ug#B=gM&n${DlkrRxP$4E$pYa}RTmsU55v5bmn{KvX|n8cje;sdoIX}w zo@nq}1x9Xfd?3I2A1^T!X2pM<(BWev_G3}tIV<*KNjx?w*1#0IPbjmG7u%>1-{8MS z)!$vJpvqqk{4SBsS5Z!HsNW@RT1U+qGMjGr7Q?hj{En9O`gioI86Iq*LUG_7IV}A# z1<84xcQij;<|h2R^7|00iUBmRPj{Z_!70r+Z*h9H!XbfcH`8#xG*e@ct-UXF-T5;$ z8aLCZyK<(+HO(|GdVMBqPWWE3d(1=f;=_xJvLd-n3E-*F(>QPS3UUY3K|HQlf|a{ z=M@Qa%#lK)e&1+As5x22O#=Ry(-jMZbjFoz)Ba*C6k>aV;x}8fX20rzpRoAN2LhK9 zX8IWBX0@B+!Q)qIcn_P-aEVBKOIWZZYeK#U-(AUq)6tIDf^Wu6ccGac>Z zPs|79EyH(8bIVsdjgO92$MSuWC5~3FxplM#&5w7q_S}vxO&Za7+d*1TJ^_2O65h5) z3VD5V8naIX*dyjFBFsW}C5B#AP7JMvJz}=UnkNiyB+&o%3+I^Trr~wOVS#5_Sp4r7 z@xRwBsug~f?B67u=6`#$w$1Ti2eE1X_q$*(xQe~-ERDw290RlSpBDccH%lXSl}6ne zvo!i%#cCkmO_uMOY#;fCT&3ZAewM~m{$QFli8LQEP0A4~Ls7>c=;kjjcRI)*2ZxYr z?6)C1<92v?X)Nv!^zfO$m_MMe8r>hj*{VPud&Ak6%=O^gt27Ei;SvWpyL7GxN3Jq< zLTzppd9K#*mV5%x4mg*n)2?O_7S7TLeF9KmZQs^e8s`$9QZp|t`)~w@(bVLAQ6l$? znENGHC+h1Welg&^KatlZ%&YO$REEl3M%}I!(CHmV15(>CNB5VrGzMBtF7y34OQX}( z8gBQi8pAER$al%B8n=@@O~dk1O1{-!9xU<49sGzAqhVWR?a`Kb`e}jD)T)?K%GV&d9H1qDP6=Cdnl#sg$FJ64SfEa{ z#9$UR(vd|kYCg|{5maL))nMHT{&wQWGD~-pS2gB;0#Im?@2*!hrd_S!D}7aCUXo#z zWw>1!mM0k2li?qg4oC1aUR6qTzBi%sz0`SYvi|O+*2s-Og8IClQa?yFKco7aGSu%$ z{C;LG>c3^R3yO9>B(yt{Wcb)J^c04yYi#*Wx+bHW$;&_1=21sNru`x-HZ)M5L<#z^ z1ZQ4jtlo$EpMMSa%Eh`5E9#dgh^SK~xJLxnkT`mw;Q9&f%4@VK##dI$hn1+=Dxv0$ zR8tCi*m68#IBrRB+>_+^-E#CZ9AycP2su(U#bBwu{5_n?2!6#7rA9vkpthX+tj#B$ z`%q8bEkCDOT@U&(aq_dzwDM9tev{QzCao(;>oVyGCM}ELA|C#mMIaPI9#@FE?0@bt0-_ItsII0S5e50YZ9&gDjrdmbA}Q%?l)#t;`mFrM2aHv zdal**s!!RIhkL>g8pNyWK_fv6dT35i(=iWSiNi6{l$Rp zlwAMXgks&3iuIrkE@ze*)-y88@CP2VrmqyKm6ZCQgw#q(ElNtQOiHby)UsG6F z0MU_*EMiWDUkr<*=x($gsFav+pd7q;C@FNHiCN9Fg-^@b!l5+TziF~6Jfm3oV<|hO zKaVcn>O_O3eLBeJ?@xTJ)M&=QxJS9euWICdYUW8@ft+RIH2%V+YP4L`dG%U*QRhm_ zGQ!-JTYP*Dg?L!KSl!4SrBp#VFiNey)q~Y6c3A|YPx`yw%H-}ph;ZY0vRiyp{N&vHTD(}GL#=M&5Bp&2%c`Vpc5_pDbn zZrEjvxI_82zp8ORN$w9{)wstJK2UJ~^{Pghg}+z6^JZ&2*FvLiz1bRz_@nV`jWv?A zG*Az@}R zg^{o@3Hv6@*7&o9hKQ=xlKm}mxX1N~qFZo(t5!>UWn+~U|Cmdz?VKar$%bRD-4vpq z+OCab40MTO40O>kE^29R-8?NZeaaXVT2r!dV!eFiIIAoD#*p6pnJ(|ji0RQ&${YRJOO3kwW@~I_ z*?yU=;r`52=-V#eDRVS-5YG|yzdi$|1DNQN5%p(G$f?_bmdOz{;68f}Px%=MD_p+j zb2JWNA+y(SkrP%^IUF=6{k&-k9c8WF5 zZKZkG??Wl`#RSYnAD&4Ys~OVsu2ve}t3FG3`Jcjhe=B-#P$5@d*(X5lj+!`v~y^Sb@ocI820OxJlSAyH3OV9i`HXFk6_eBr<1rqMUODS#+H^ zwbb(IyGXOR6cy~tS-gBLu29;fxs$6OAO>MfpE@|!&ij?MkwIvMI(!Bdn0-JY# z{$TSSEUY)p(de9F?J-B=MIo?@xWf`A85t83NoNZOdz&)LF;z?U%Y;Cgm6k9`i_CRG zsGOtms3mOCzCm*|wh4hLp0YP4^~9F0BKCBBs7Wvw&q>%tmn z=lCNx`$HuygYg(1QxlaM-2}iutqO{X!a(tp?~+mmN{t~miox>h7iOAl5EcIN@^C;F z3?Em&RWrhdYn4|K4Dk!rCLHY`EF5e*(e^PSTb27`F>E*Yb8{J0MKDh6mPnUyhZ81j z5p_C+oX-9-2XC8ntu?&E=`BILBP!Qw%_cF%pbiV_B0)_iiorfv_LiJ0ES6d2Wvw;x zsw(_c32(^U6W#@64&nm=TQHNA#6+-D(sXIfa|gjt{6=np{h2j(o(E+K9QtLio#(-Q zOtoE7MV-=MZ|s+(k5L)+H=E{Y?Ai^`?i;dvpU%-3LYn*gIU4&c;hpUK3+IaOCvBaV zU(wC+M||~TePS(Wc08d*oNP?KCtLO-_hg^D(1TH}IdlT{NZ8bAgpw*_Pd0U4L!>|I zg#1zv?8%OA^5E^(8uhE7_GEL+jryz_LTvN!9@;I_h~EYLoEm$Zeh%bPHeStP(QC9} z9keGlf~E4j*m-TZ>*X)Ok{lk+y;3+z$q^0Wy_|{bJm}j-!#jzn@fe8EtiCT>tbR{hjr_gl+~8$%HU6~Z7jxit=4zbtg<*d$$M@h|jWS9Sf-gyc`|-IN zg%;kE;~O(qBTBiGr1spe&edpc$zSF8HqF&|jO6Wx%xtc+=n6e%vMYJ1f39Hg?Hzr-t3Hi-(ho2`&+EtcG8;xOr znq+&Hsnx_Yr&gn9)^4Za9rp!zD0*2nt`qr)nMF)_A(mHT-50iFjk!6zU1~F*Q%!<^ ztp37$0Y)erN#}J-Ut~hTZL@T41GqU3+F|MQ4E>XIIxFr=OMk7JRNPhVG;GCXG&^}= z-zWWNo2cX9N%f;P?e5EJa;NpnYKzM~Xw!~o&v;?&%WAuB@Zi7gOmq6Onmi>~KL+(> zweLH50CSeQZL2QPU|AU-MEJ5AM+nH}gZ^f7_^WCM>v<5PEs{Ne>21pbU4o%LcuK9$ zHcHHOs{&~mnCoU!eTsU>>fBs67dxj?4_OAE>oyI$FBdxvvrJFsyE)RB*G?lhfL(4D zW<3GMx%*6H?jjiA^}LkUN8D8UH&S8|e+YlLS-8{M%ZTQvn}u#npf?`zFy9XCHN4-j zu6yIKXyR|r{^GAMfV?;sdEVW`li2Qxc^cKfG;MFbyY8d&G|I{7erBG=S(dQN?VC7H zqpH0|-C6TA2Jpw?c^c0OD?8b`mh}s_H22v_LV+cGYY0n{gv%}AdqY?wgf;UtT3W&{ zZr=yb_w}45Q|di7 z&3unYJ^gwOk$N#Xj<5D2)_=!vEZ`4ep!(L<{#H+-_P2Ui`wg#8tj%uqu=bl14mnQA zeNHqCZ1u3xT3??SC2W**4i)&8kS=q42G^3YlO5ughOE%n z$iiQFe22$s+%R|wu>Si?maPB1HqC?@ zQvZX=L9d!Zj=!mYKE=>6Y=%>KTFuWfeZa072`|_s@6FD;A>jqPYS0VbydhEHyK1m4 z+6p(!QsKL6u)@E*;rI&wp$1*%s8DdY1}prm8ySl+c%QBCA8W9}8wfHIz)v+;;q49R z58>w;tnebjRrsX_D?Co1H;#xhgKpID{%9(Eo;R(+k6Humt|1jZ_Qphod-s^`;cyM9 z@aZ?&3SY+`tne+u$_hW*vi?{@D*S69u!7IGgr90i1?vtP`I>P?rJ66@bHZwFWE1^T zL#p}Q4jNL;x%|OuF60kZ^VJ=wY+$}d3!A3D*Vli(M!OCgzNhDF6!FKX`5Ha=W8!>` z{!Bc3zQzlZm_BlkO+4ExJ~ECR^pR!c_y-@c9x_P%Xgy@9H{l^mz3eA8bVzu}QZGH^ ztqutfS?W#m5W_4UvfN7#+27%K582|ShqyYDf~{V9$hibk9`cr#9@0dRkpSNJ(nDGs z&>zAFUV2Dp!d2MmrHAw+&>NqKGEWiU6x4}gxA*H!9*pV8PGXOA5<^Z(^O;I(u;pIy znYkTV4bn+i!d9>N%<_)bXWruv`pl=oN}m~GS>N`G&-{@jykH6MdQB(svW4IGiVtOX z%J8ANC-$LbHqlP6_)yJG)`!mF5Bku>{6QaT*on%op0BaVruo9_`(wVwRh=|^ISVvy z;g8c6Xat3oCxiA{*3Z4Z(0Gjpgg{sN-Vz3#B(5}sxzLrSlH+(+y3rpkbMTD%KFf45 zFPxNcpchV}1I_Q0aG)1Xq62Lvochqba1wpu<4y^$df}uruQC$Et45wgullBw_|Alr z=sVud>|N*=lTV^woJ+VjW{8CPoi)5iO~rqhUhz45O`kCGB&qn8ooPE({Ardj;UuZ} z8#>#Hzl%Ru@g>5_IGpEO*2yRN7>Kiv5ExncVoR8Dl0;U1QV2BaWtQ;1G3qGFq*12} z$N391uC^S9PV#kGps}#ChVPyQ8XL$OT%hrRuyWMX*|L6Tim*=z)axEg_}=JsSO_dz znI#-DWz#p=vYp8vEL)wMXa;H;v8=xtO&gJenzkWFs`?{Q$4uGF0@pdkm1P*Lme{fU z(WD0)6%V-Sri2F^6%V-crbJ~Qm8ycb?_Qo)E)SN4@RuYB9Fti%7SGIWh??gz{x<4l zRnQw4bu#^?C$nEloKeY-$os|fmK zfyN?Bn0T`9)P)-RZ_<#EPV23NCtPWfcHY^0TrekA&Th;5q)X}~>t>k)owHEmdn^6b zlk*D~5}T^35~rjx5N{ES1!M76QKuvr$Fu5gW4%QuCtB+wvDGOz%Pn)Vw#AZ@xyx}j zGf7P@oQgnsRE8E2`^ryDVwO847|N$rWua(C&4kz;HCY99Zq{He?WoCG%4a53cwb13 z1d#grP!Lz$tl|BY6;j2C#Ycj?kx189T=v6m!IV=ixLYmMsP&a;(x27@a_(KI@tnF! zjrR3gs8M-y!q>i$tkcXAiH1vq<&La7VVL^Jdhg0pO+@CEr?SK8YZYI4Dit3_NL0m2 zd4PO6l@DOmsqBx|+^o&y<6l;vRi{c%vh!wb#+l#q2V2{()ZN{0p+;THy6)68%}V{T zxYIkr#V8C{FIq?cgo-)-5b(*VoD-j3lqlLKr}9QDa(m+7soXBQut+1fXL+~`hfZzZ z#DhzUv{@T%WOF-ss;rH+{3>H@^y(tJHrlo*ZEbYaLXDejxW-rv}Ovc3vHSXk( zbqh5D{IPAJMg@QDTBy;RKfYh6@hE@%wov04YO#H)M&K*pK>)QfYQu@r>6}p9RLJuQ z4;@)6;YuTG(UnFPX%v{g!eYh|6YIk#e&fV_w7`SuN#l&H#hOE21TWUgt>Vlv>C4CD zX>aYkpsqGfJgOEWzF<_XBX4+6eSVQfJ*oTAqDRfOL>NU3=IqVHBorAfdR*{cQF?U1 zV{&YW5o)`gpiNAcbE3%ql%+D_EheiA7Y-8ToG9|I=#p@PiKcX1UteB}uIul@&G4jI zv7**_Z+dXQVDW))Pwb-M?ao#e=vEo(5yM-O_2Mr481PFIvlYL*mV7MN3V};54_di~ylP$-(S~3Oyp^Ju(D{e=HBYTm? z0?YA1EnnS58W-Q9;k#s!M#EdEDi?9qT8@uvrQO)tY&A;V*pmF-v%EWM<#S!tWOh|j z)TfrbDP7c8$B9Zg5>G9J9Dh{STYdG72an{VfzlfeIZZanhMacYn;tl~uoii04nt0( zL*Gw?t!RVkPfW6+hnz--9z8m% zEz-Ei5=NcoyK#|*_f`#Gmqi+9@yCA`Y4~o{=4wj8K7h|h-09=Zl;)I>X2lABq-2AFcSrUWZ#Xc(8u7;_G_15(>u2bEK6AT`4cwxUDq4Zi`Xe z=%lbIN=bq#k|30kpjYvoT>2QT&R3&{0+`2)d3bG}oGtIg%p`{HJUI#e@G*%ygsU99 zr0SZ)uO$+{CW)U+CVov44<#I9^j`yy$`BScZw3bZ<>hkrWsKUPjM(22Vt*5{6DUS> z`c1^nBrIYLyjo!Kwcljh`#mC}PFW22O>M95!Twt{yiMs7K|Cr~oPMJ!GMa3=51=7_ zS2D`gx3R*@7in~~g#IqyXjV80DZ|J6n3oO%IvK_H^E@z(xnE8MpLrWk?Zl(N zemTACyG@%s@3o>2xFpZ3Gesw#5n&#Q(MP9JyrLdaYIH*YRjMGy83C#|Bk0U*A0H9P}dVL)2*IB8~3*07~xVdvlS-;M;gEf04!*(mCYs zY3c8~WXL~@8oNJVq|rM?P>VHIFr|C3#%89hwOHdJ%kYNVcg13jkIB$tvBuZ8Y1D1M zSmQ^^N^c>5Q~p~*0j|9{B^av~TSGjd5|(&E(G*8nbYqGq#1(RGPn7)$WeU$3_cMw! z?!w!7n6*y?<^{0k1j_<)g=LcBE!10X*Kijt)_B~OVX*S`T&!`=?evlR7i$c%gptZO zda*{C5GF0w7-k8RlyCWBjffD|FV+}q36quY)5RM7Z`Y{1my*bla<9L!L6<%e2jf(! zaRatp;|KGk^v~a(n1Yzb{4!x zSZ<27QwS{9a!XiYiuG-xSU-~^RjhQ6mMsK~SDRd>G>6&hBYXmc74;W&FAr9*<2x+M zzkFw+Dh~?>%*wqX!n>BuTefYVky8P4?qnsgF1B0Uo_0ZW-IavJ^2>$s;9`w^mhiLk zowh_{1Uw0=;X84gC=W;_FFG+&JyEVLrlEs@W$mVx*x8V0A_D#XIAy#HedcSGV z^Ibm9lx|8AJeIJ~5bhKL&2*|Ith8pjC<%+F2JW_=8cL=pv>Y2B_iKN<}> z(aurlwrDW!V4~WPV+_+@E7O(t*X)1#&=%5_8+eky(v=&;4kFk_(O+{`n{$swZVUr8 zTYF6c@d##WTKSxNG`y|%Gw_W+?vG%w<~y6W+(SDRrO?9#eXpSZOSCkQ1)@$53M`4m zdt-@a0K_W75iHe5-}K-~NfJ*cStUt^kwucMl_W0{jzt5#u}}byK+d$(S(7=3oO235HpAnU-?jc<>Rj0ZLciFZhh-!5B3s_;d61F zLj>Xx91z#}qpODZtOH!0;dSyul3%TR>1wRWpQI+wBOJlc;tUP$W$(h8Y-|hqxv9zK z_u87gmp@pO!Fz2@UUML$CZiMqv3qMPW4E#U3#5p7J6gie+IPuPjaMj>cAid-lsS`M z3m!g^lN~(1GFff2pGk&xj{$#3(HGvU;qAe~7UNIN;Ir$Ad4QOpy$AD^$oCE+t{9JI zk?RNIrTsxiY7p2+fzSgLW6 zU&B3ism786Kp}vY%C}*uMkC_su^TLYw-S$SDT1~w)!3RM{IXQzCK66Kmf&d-vC0$` zGwwB#H)3QIH8P96$$$NcUU;OG*SsS4zSVSUmgMX(1GiqL@o9?i?`0YxzlQIsWg5Nw z8g*}2rtvV9e`J})KFc{b%lFDMjVH;ua+$_Z{@AiiV-z`QuOBSu3S+OS%*^WXn9 z-SMmdI);vzNqgD!GTiEV~UEvNO2i%T@S4(@@yZYeKho7>sj zEj+@)A6odO>=StkkL{J0%bHIsxpz5TonboAjn(B!;l}FhJsXzrLU6ZWpj*p6aR=B~ zokw=Aq;}PoYkXnzc)hysqU9Q`sQ#tPHEt9&lSAv|hb-jumg7a{{Lc)v)J_t1nml(( zp0|`FI)t5)8**bjGZYM!IKAhGojekLhZzFK>l@w*&A@;EFNzg@q}F{9H7hl{(L z0vMk291ZVZ)Tx3_k3ZaJZ}H$_hu`WZ%Qb3zW4fn5+`j)V*SO5l@RcmrXvQD0shtGF(2hUO1|RbMFhXr7g@qy^R=GA1oZd%7H_}S3nT%*)=g3beyvxM0P&BjEM=b( z|JX<+=pS!UCcC#b-Jt(L5&vjF!VUUpri;A;ezicS2F8R5~Jz7M!P4gSbwmr3qB+QbvgShCUbP#k?t= z*KY72zm(?X7`(zNHN_)i@VHe!IR?Mq(r0<3PiW1AX-cOiQ7wb<3O{3HJZpRB0X6It zYJePW=|bIPSZrWNU>O!0L@y$^s?n)bf;U<86GV$=U_cG7b_^-yeU)&u1W$_KMTD6S z1LZ`^YbG>;N_l*kB1)!@YG)G~IzHNT~;IGi3MeCL*N z;T|v7;KZmYS?plA@LS`UgKEemqyvwpTc)Z5v(+!QA{N$AX1cMk2B)SE zlri*CEDkIb>kK6<6=UFq0!zgh#D`*mcvNh>TI%3;qNGyR*5Dr3zq)C7AE4!eSSM0j z5;L6`vH51PWl1;o2ej=Lf%_7UV5``6L^t^oaEkw)E$!+W@`V~ticCO0w}dsu=1YXY zX1CuGHX4hr5dsbOgC%S=hTB3y%5afrxU5Uqw!04gSP#rm8|`G|&l;+Lbl^`Z^9S8H zuM@lcDMkFMTcYRtv&P%6aKSQ!zl3s-!*PE(eFpEy9{;YOhWC{3WIJNEq&Yyg0Nxd#T6a@(*efE=Cm1d*#S%%}y1RzA zpCm5kS9Ou3=}hcoVuM&Lm^-?&ioGj{W9m)b)=fR=L9F+~1oAyWJ}AiVh>ZB-aVHwW z0g>@EvkoP2UkmOv=H&aHV_rNX8o7FCT%&gn4WC+}(N8$2#mkmsH&pd?|6C2TN+5lO-vOL*N7#tVU3 zEVYCmj25$mz&zGk!eoMK5==5l~Izm!FujNpk3xu=YLMpsB2kE zeT^n-oL0^+Ew@DTExydn7r7eR#E-d-nS)AMeRepD1!`}WQHzli!L+K_lY*k5(fjODgw!R(kmXc-5& z;P$N0c-+FnT)xIDG}=|Lt~s(CW(hBuZKxs=PGp6sQ||a(vaFTpuu*$&{VHr)NDeaq5+W8e4-j@!_HIAvW zx44R!Ma0A~O-%FwG1~=`^obcF?m$Z1Y!UZ|6ba%C-`dj7aTzoHY~h72@qua~_P#n1 znlLH!EFnVBoh;cjxmx>ArQ5h>Z>b{>#BJACXRy1c&8v?FzSv2uj2 z-O31>H4kx$)&qU1;vGyEL*M;dJOI4^wzQ$rxJnFhs1mBTA&FGb%-)_CMZ#g$t@k?8 zj6U-e6}pdjagP5U0%*)Gvh(=7;CXT{VDY!h!M%z@#~j>?Tk;(~p4)p_lJVT${T6?h z9NSwQ)^PJh?8j~TCtSz9#5n8_aLkL?YvyT;vnif*$>F{2%mMB`D>P=?ETXOb1 zYxpLu(D;EI?u9Ef)>?+D{0~;}X4hvcG>%dey5NpOKqCOpEAxcgE(^b?e2pe(RF7!* znorO;jXzpX(D-+RCKQ|Ovx4U-G0M+Y#pG$mzbt*e607)_Qmj(_2V>-gO3czaV$E{q z55}xdxO^8))bK|%jA9J=R%$#?jyqOr%n%NCoINbZOUifY3XMhNU=O-QIOra6%Q4=VqMy|!X^MfC zKEasc14;PH0*#TDFxi+QtEV-^WGlg%qCw9Sm|{WF6u!_zjppR3n#k&b_{>@>!`h@x zPa$RWY>ED)GL-63ma6^A^e9`*2X2dEpK?=Ae#C(-^69#>r|IS1mKYO(o*LfmKLB~L z7``zr(0J#EwtR<_xMz7!>zuZxEh?oc6?0Oh#!B^kmML^+Rlo%@bmnK{8@hlTb1|@vY7}s0WWaL?nq@I`=CW9m zXreMYv-^e&(<11~S>r8HK0f1*^+4C|bv?K@s?D-f8(aFD;Qn=`MrR9l^_{v(qeoQ3 zcg`w}e*BTUN@G}5qi*3UjY<5`e3izl{Lyxm#$x`sWtGNi%H}oLyREQt+4Frf%JC1+ zKbIUf7LUrN{^!J}SteQ;N>&$EDc)yi_4MT|SVjalhr{tACl2&|Wt#`Tv0!C^UU*V1 z+vY*_m~GKLY$lJZi<+^Kx?4`vh#o$!H{jXX{7eQKSciPlwC>4BQ&((~@ywFj2;($O}cCNH`jg zVZ4M&L0$qLr*^Uhh**Zww{hi8jdrrBuX-1=u6QBXIK^be z1i0+U~&xcUE!O+Kd2PT+Kf5O37tkQ|$O>w%xl^W6|JYY?+QAwZhVx{d97VroAgpHN9PuR&H>=VA^ z5B3S)^9TEc-zklK!eA@S^a z>Nmt1RbkrWBBcu0QDBku6gOA#kT~ZRtcL1$35caqM>R{TG~ClxX-u=(FIT?xt28RA zG<@4uX;fwEQ5uf6_6NEZMVvs;UyikEzsqDg&7}(Z$eRe5=DO(}4<4%0@Xlw0@dq)> z#qZS+qTVE`n;);b7$9LJQ9lwD#9Wz=O(&-IPyE7~Ok$WXp?X%3(3*tqSnT4G*>+;e ziHTv2Ox?a9<~hMcu))Ow{~`sDe`4q9KbZ>HXeOoS^y26xX=mHL)h~*NBUq>QWU0|- z0{F;`1wK;C-|^tGUL2!vlJvP4u`l6@2=>dxotFuP&Eowxip^pbF{Ra_@GcRp@uP5@+FJu|o_1gJ6F?32D>?0ct`Io6-fRiq7=NiJ1RjHb z#}d9*5?!lJZw(1S@ZnF1g&N=Y<1|W{0PYW0Y3#Ns4k=%?*EAmQt>LTnn#Sbb8g=tu z(^$nHtzOgE&P47GuW1~%X`XWV%3ss?m>lufG>-DeW3Opc@1s$7@M{{U_0h)iIX?sE z0@!$pY@+hbf>ic&eeEOq;b*ecFQr$=;OC?s87mu z^71*13spvLs&pzHUwtRklRvOtJ#D>ci&h0afi3#bJ01+_qrnA^ExLL?561T4uqA@6 zn%5-0ClrZbn;zNC19cxeHN2%qKkUKj_wjnf&s^hS7^IzoY;hk=Nq6aIHQlPkU2YTt z4~so*2>@_FkH6c@p`}}e@ZxJ4&soCT=J?r*Kbw)m6y6==llcWO1)st>O8_xX~W%+rL_4(|sEG zhgQ>6T%$Y9QWxuduF>&dvKu(IE=wF!mmAby%Jc}|n!5Z}>hi<;65qCOr9R;PeYM89 zHiPfAukIR+{Z#OhH5$LNY>NT-ECWXYP1k5NweULai?7j8_iOn2uF>$^&pt~0`fAH^ zSWDwR?S9+1ulvO`krAeG*S%j-Jh?{W2Akrj&R@Ppu*~{qi+wZ;!gYs*AInN`(eM2h z`*@bL!|pZ{`n|i_B#oG*KbhsrpQO=<+VDByM}7e=;XR3~S1*M?`AhDVC~-)l8awS+lYzW=P%xa9#2U%Ry$p$9bTc3!LTq_B=$ zt>Lq*bF;+P-xR`s*J>16!s0C7Lu)m@6aqcGxh1U05)c2L!o|ZMw6|M2T872iH))(k zjR!SkHS)X%Me{ZDH2jw3^(<*ec@NrlbR}7&3+Q7xHfE)D0sVe89Yv}O`1|T(L^Zsw zwz*90y<=+c9jU$64{~LXVd*}|;tF6F!cOma)Nc{@5Ya0f?SY+HJpa*+unlDSp5RC=l)elQcZP8SnfvtM0T(8rw;ctj@NChqI-H z*ZIv@fm!{1bq1o2Kkl@RVUyySRSr*vW=n${n#~6JF>9!szskX|Y*y*lgn7Ll!v+3{ z3e$A?HuvG#rgyv2!p~((<#_wr-mQgI%l2;P_7&&lI%7MVVpulZJ;pVC zHN4Lg6U2^e_B*#SAF~-S)n;@k8}2XHYRtCqd)amWy-p*@lJfh#-r^@`OE(gu1ZjiY zEMZD^S{vN?+p%p>iu;A-otmBK%-PNlTI{rJY3EP%we5Tu^MKp8PUBC@axlBDf1Sq5 z39Y=p8~2%Qw3@~gqE&56n3Jwm-tQ;Ws;T9jo1xXU7CX;qwIQL^cIJ`hgUQHoZ}R#U zFYGmx*tiWj!v44~C!UF0s0}|_;K2c+suFh-<$?0UeG^~lhKZYrjrrqW582ML!|&!Q zU?b@wFMNnzmK+kq`otuH)@IdNN&b&2RZs;yswktuL*~-RqcY;ZhEP(UM->(7kjSNr z&4mv}F~r$j79OH}3~_erLp<6wPow0x{BL$*PPEEt!Jq_A3AU)C%BZr!sIo#-iAmt##4N%02gAg99@ePKNO5%@=4frx z9F4v<%@<1Uf?o2ly^h;NIB3VmEXN@w5#m}W3C~!j-zPOW@6Q7dQA&5-Lvqd1eD%btfdYvoL$|2Q_ATSApFr=(L6-clcE zlTW@BCZFtQJYvd{PwyyrgwYjBs)8{Gh3u`{Jfh)!L24M+ll>NQFyHH$@4b(3C2YK* z-$Z(k1pOw`t4Pl%GdI;c6=AztWQ%-K4Mk5gQ^T+&aWBCcai!^Lh@adJoPxq z?QGP(PDOZIJ!HyRCc?{@e6AHsCLSZL$=y%GUA|6ZuT|=0Exm$xzdssq?1EQa$ieco=$!;Nq)kT*QS#vB*{Z8`Hgh)sw8=&C2vnB zf0!hXv*Zub$v-8@(=B;dI=SX!39HSwn5*tK6 z`Cj*Ul7kUhfXO)uP=iR?8Pb!Enq`Nyg?T+*<8;e9Ov&QJd6tW_b9eT7jf*XPxXQnL zJu^rZ+$>R)a&_-Rb-gL`RHbCi;4+(Rx;>lJGzsT7pP+&K*8D$BSki#zfdhP`ZZZ;Q zbEho=%vKCaRz=f@88BN0CJ#NC7%j~bamU(|PcJAq1`WKCeCN^Z9D zm#DNlxx=b+Or6|od6%0yDYIOxla%$Nm7&z30eqtNxQ)G5E5(!N6%N*lfnI!4!yp2F zZnx3ljuKZE!RunvK~HITLq{23x)|HUyT%YTm8cLtQk=2;_>_iuq+zs+{#SdThIcJ!uGPl}29E1cMU*e99YFi`V-fFDJhZUQh6%`SEGWgfgTP<+bR=)pgY+ips? zQU506a7J&v>VWNh&1mcGNJUt;OW^lL2rC6}as)6$da z-?j9yX1nSWOPBO#X9IgJ{ZA!N!Omnk-Pf(x_}&tpa^;svgA(_1{bhCs;>qgAr)tberuJuRd+2AjZgQyyTL!Y<3EHzIu-GpLYUDYXqi@;e z;q-zL0_JM=Jbw<<$PLG_M6>6~dzzbKyiEMM-2cCsaEzO>ugksplBYHDO7W?cQ%X6z zL{6BTrEwh81L}J)ULf{wzXS(Uvz`UmCtC@y>Ej?NH{3-ZOie8k=aKG zeD3%oOE{|Kx#Q=Pg#DR>dC%B)kk5xoe+T&!CV=~i4H|h+@?{#3<$HO9Mzz5jzUdn@ zE*eZd=WozxYB`2v`99j9aoJ#vx`#Jt1O{uku~DPQ3Llc?tG7`jBq=9n1Aa>wk>y*L z4UD7g&Dp>XazIucx?ADTX34U{Zc>C0vxMgi;TsZ8+}PxJP9b)wY05OYky)yqgBP>d zn5zFWSfgI4g=$tCqESyA{Y7!=v(F+zTEdIssux^9L^zHYv!ucK2qs&?7)jLNiXj^A z`WrPKuu6`}@^#v%(SC@A?+#joKgu?0+|3_V8#OA1uvsLBDCwPr=-&{ZsXL7NpKGfB zg|y-7y_i-1jT-%JR(rK?@|{k+d1VIwJ_n^Ws3Wn-_R6mI!~e3~0td()1zZk29EKGcNWmV5Z43q~|GF<8w8{ zW_rD3dOb5;H6$?}kaab_o^%g|e@J0DJc{szI!lfA-8fg{N1BVr5snVgkmCqB&!*p? zD>F~me5syQYBUdW&Qr=e5DK|Lye4C=Q^@b;U7Vp%a@KRP%I9Sqz&&@P#z>3Zkp7Bx zS-_EZF|bFyYX!ffRBiz8sSclca5iOTMJq$`V1<)pu3r}J74=67u~+4)(dus*8saO% zkThH*TwdNL>JP+&;gG-lws5qE6K&l)7{@+256N;ZblGc83tgvN#7_d>>|5d*+1P`; zXEkz5obtFIO9j!8hzM4?Mt1YyN&+#bytGTO!oezGX!Wc%kDHCPgeeR-u+=<1pUwvt0j|kr6z|)fO;qoiY*E!am-P|1FJ-)* z&4s7cl&t!Igx~ zwT3Y{yw*@Q^tgK#tdvzbEC}*q@m^S+Q?;8LvEQ+vWf6Rl%@K0{ptnSmwy;)kMqvA5}r8z3db6yPIQIiEt|p~$3NvcDM-uLH9oa@ zJdtBO=PL_O&M}^I(89}d;NCY$Gm@k96RUFIE`43YO7Yz#uVjSxJ0A5(U(V!F19Hi zu6Eq@jLU4Ic}ngi+{V1BcpM3EuYO&lnN9j=HMsY`uF=B6!>Z-0O=1wwCXMSY_W5eY zm5MApwVLdaSN}m=Hs&~ z1DS$H)Lxbpd7CuGSdIpITV^@|ky40nR9houO^&K3iPq#WQT5mVHc>--t6G{w2eVbZ zvIq`I&^O8NXChxzv79b@mwhpVOw( zSXx~=jl8H6lX$CJt4lX3jdHfN&hOO{O_f$(WU&XU!_7Mmt1SFzbvG|Lylue&r^qFT z&s<94RV6Mt?6>f3^ZmvNsq;A&JH5JTCl^_GcJ+L=6VpfvbfS^Kcw|${wWzxB$ZIXUwz_y^ z6DlL(+gU>Y>IS~a!cV$0+$vEk;uDSWz3e&hd%Lf?b&7q}#VP(XjFandFMKPN)p?lx zg5GK69S~9#AE*`uMme4ZoZ7-*fy4#5)EgAb!yInzEH-I^A9xq~5&*B& zRP~~cKNb#QOU-Vw$}XXa}R3H9Hx<57QyP8u{%8fAIiQvKFVVI`#d|F zO?I<^00I`Q5yKM=S4FQC6_BQa2zc$+yCe@`A=#|E8v(r*kgimvBfaqWAaa57<-Y%$YN1&Xi{g%`GIqTuO$?H_0?_VAaj>>Cx3i-Z+D@_H!Dk zSVHROL)lKzk#ol|MZXE-JSRCjty0ui;E7Hq4^;*w5D~97MU2wW>r1Z{t#S42Kz2^Z>$9*! zd4bZ+c)8Okk1hEaw~?`2Ym8UyaB}6H>;^$v;Y8PJD1H35>T8>Ls9j zR?|q@eVq2|?uy*wV1x`mZDk|1=#Kdq3cFCsvcjncx+?@e;N*j@zk#uEp(5pY&+;@0 z(q-eMO_!yMONNCxXZ$O@28tQ_+1E9qvU^4tP%!R620@QObgOm^uFJf90Z%SFyos})%SPZiiF z@I+Ts@iN$v>sx^=ug`-4HC-__Jfcgt5I5+Ani4H^A;gyLfgS9Ku{<_j=0X_G1TxD{ zEBN`W9|5K11Ty@zn#=ne5Qqb9?B34g>P7V%7c@!%KrrZ)wE7R8y+8x?J3w%@g`E->ZK@5#!k|KLY^2OwQ4>p#<=@7 z41CF$EWA_Vd8vPnaJ9A(IRmQ|EfxBrcxRW@iq^&$gr~PJ+me>7R#dFFqNMe!6_vq{ zJ*yQZ_f~qavQ0R58m51qqUU=fq}&>!C{GA`4L)aGt+ygRXZ-;DFU~5hety0 zTtyWGJKCM{c&;KcpUzd(uD7C;7Xc={nX9M|ggP-re^!LdbRN8B#NW*SL9ZeV!T3F^XCUVVgUt(ilbdK1zSw>FhA5 zE)ms>dhnr_L;FO*gAe5VFjvtak+I)xw$D{mw2vaQN3NozK8lita4;i%k<#uCA#|8 zgRk%UC@Nbp_-fNf@p8hVM0CsDkxyhCbB}Ctd}$Tvno(DGjCtw?1OvT&Z+^pUJ!}}TJn7A;PeRTK z7ai+^JCP0`m`1T%IetuP=fQD*qKB^wsZlJ=|Be7{ACI*xy`5IQr{n z!ro*8l71kBfja3s;iMKgqE{6ETqs$7e2#9yI!3e=HM1@}-7*$9bggeoFj94CX&V>U z-&gz4_5}FQ4}BH6zeM5vei~8)lZ`H5C@}c=A{al61`=bKChy_udn-`&Ys(j+iA69T znGYg-Cy#k|0!+^d=#kle#+^plc<25ADgDs|J}_hSgGFJlkwQ4G?Nyu!r$#869wC^; zMk;!k2}rR(2!o68nnpP$AjR4Ufm2jq!h%_fwh3WK5x&Cj4JKecC{GCEi;(kNuA<`t zPcD-3&>F<+vTGF8?5A|Byb^2BTSSDRz_V)<-HE^{^}tQe&(|o5i_=_vRmu;*n(fyp z`hv4`Tqi0PA)BvVC;AEm-S0mbrvpn~5psSzQBgU8j}|eKA(!Ea;PZ6b=pZwm8AW*UV-Y_>7B{?~qOyKJEoK)< zoZe57yH=b*<drfET-Qn!kbd=ur;st3(th_aC0JF(Agp4 zf6@y&hvEt^=$sU|t5c7T&PTym%DE=6EalMevXoQ$cUU!A)yh_e*N3=4KiY~;_uc^lyqE1CIvwa*1qk5aFzI0C1!iLX32-Llb8s)LjPe!kz2n*O@Dk6Hbi06J+ zx@^j+9lXCTTM=jBvXvA#T(&Y%Fv^xBu$1kcaM?Uiu~6C2DNsvWw>TXPhZZ$b3nCj0 zEsD^V`MV-_d8Z-!D#oy?Iln7PZj5=ohQEhs_p9LY)1sn?lWmc%1~52*zP{+3^)4C> zHgbOkte;LZ-&*jc1CvH)isFi|9n9s#v_4BLF{Y@7Lj`cOvGsLXKiMYObwOGr8mU?M zY(Xs&@!jIk?_n2ek;tZZe~S$Le(IA5U9TfY9!0g64B90|HJvWbKQ*0;YZdhr-VTXQ zd|T`9Gzb?R?F)ZfBaUOkgzM+T6vQ#XjumXj2=9K{$8H2Cdfx zmbpyX{xX+&wm+;@$S3MrK`R6Y$7U#tTG>uY<6V?!Bzppu&l99IiC->t(QEzj0Ex>W z+)uDB5%&}P2dKJ0HS*BQ3UBLT?5fLzi%ScqS|{}O#iE+mcHz29)_&pbre&QFF32iq`wg=~wd++1)~ZKs zY%|4Bqly`+SjwSM#c<#3p8kqbeL;X&hk0~BI2LF!B{!o9Oer^jKO(2m)M8j8dS!qj zo}69~MaC90F*$vA0ABaYRn%#K(lgWk0~Bdi6|Wn@EX_JM%z6huUd&ZgY@nnmgC8|= z6}>nRmX7osIoC!DBSboVrd?L!hx(@R*>-*$VG~{2vN7 z^!mKPMujwNXB%r6tl>AT;WyAQJEF}u(5B@;MegKygZK;hhyHZj$la2!*6abZ@NEA% zQK_Y&muOxVxV2$o;bs6c&ReIbvJl!D=FxSEroh5y)+t(!!r@5hd%`f;mZFb@{;y)? zXpP$2x=T@p8eEp41`4x2QkbEv@($z!+t!nOh8b+!1Hi+$UkLtgrKzJ7`KFRU4YXC2EI9E zBT&nL^80C{fi5~9sCc(Q$=GYR$;f}lMOPs)GLzcG(rkm#oV4e>4c>dXG5Eu27E?ZG;01}Mf`AmAUivY+S?FDR{)pR z$m7efs4FMjFj!W8yNJ5IqMwZJ<2LTzvVcL;P~q)u>KztP5#@R1>y-KjhB61a%O)6vuY)u~6?@l3Zx6wTWveMo zWv~{P8H1zOMa>b4cp;&hz$2B3g@k`G;~(o3)e^!uWj?W9(U(IMnJMcPHA2Z>Sg+_S zX2r6@r@}f_@q)uQO!((wMIIqc(|4}?1R1z<JR0mzyJi$=5pE}tt*mQJVpl!2& zZPOjLLA;^`Y>WPY*;WhK5;IZoV91l@r-fYfMLlG?c zN4Y+N|6NC_)=B)LKN)DA2V+7w*r+8GSKy;fblpTsArU?pXK2Hcc zb>*3oOeyWA_!>-WHy;D#h0@Vjh=YYW`(wrcDjOBx2VAP>R6)^}()-E&x<4^rA zA$`nW`X|C5m?f7eq8DxWOaJ2aipoUz4y{)-XQ-m2{Pl{Kb0!f_&Pb~h;OiwZOTx$Y zAa${gwrdk*8Sa!K1|_F^@Frt(Jju8bn!f_1?`==Wqf>kXEA56ke3k3f)3_giJIt9m z@upx6QKvb-cX$>A=O618y)XE0%ttpUx`yJsI#toX1RXHzPE};^-Y(|Sh}t9=t%#8!h0oF&_@YrY|oo;42d2ys%7@Rf@)n=;a1GOaORfIVH+r3i8Btw1MpG z5dCUv?bK!5i)_-G67A&+1ltT#l;`|M!@PP-g-cW*2}pJen#MxOw>VFNnL$BFg~Q{=u0RGKeD=M3xyr{Ne*x?M#L zN=|D)e;BymC4RUf_rpN>=oYj6L$f^%oHXmMd=vYt!}aHcjyAOYs$k&+2u0@CLljjS0so4GXdowVtjuiC;HGyHUsnKvRM zUW4f-s+_Pzt-Q z+sw2Liq1upSSf@SidQE$ieO%y%-W!6m(W|PlwUVsbp_u!4vAw7u1I=iG+(%WQmo!( zkplJpY}0yvk1t3)ZOa@wwzXGsIcj?~XT6JVj8GKzg7yktP+}ynu~8p|XjcZ1$4kE} zED$~msF8>IE36H^0*KcX>v%FO8lZ3|Xu3wldmJ z%hkK}UG$GpirmLFswu5epPzBjJK*C#r)QR;8;LqB&D2*wI*S>6PbZHDv3^&&n5Hk& zmk#*uv8~*lQkv9dd0WN{x(YK+hk{g#fcTtmxN=JuEeS$s&FM{ zq#=S-i<}YcWy7~343l;!BQ@x6NVG#OTj`<=qfm{2&c5%Woq)Kh@8C*4IErs3*`w+| z;i4`(9n|!FZZCSi_tc!3g zJczCk^NWpElx(5nv(nM0>onD}1N8%*G@MHQ&5kbf39#vP6nrNne9=Xz z1w>$jb*uoGXev`*1~uJkplLMCj%ipGAn{HLGfrn*ZQvSYz>?BmFJ`=mqEo^? z#m+OUOTsWsrQqNUCQ9JCC0tWASA20TW*XuV)_(3Qu3N)myPg$2Ebtn;Id-C=B4faa z&2>)+;gp>>*S%2uuFZ87g`RKc&2WhT7`W=gUW7MDb z*EJAz<)FmB!4p0xfpsUp$dHY8USvwna;p@5FS-62qo3huEASSres@V2d3&P2(6?&! zLy*Mkj}Sthoz?FeR)3mEX#3}*ElUb(J^pU3H%d~`dKU81TINY+BV*Xer-d=1KYX)c0 z=pK&8U?; z1Kt|R{9+8}wpBcXLm4*s>=XK(82zy1d4XFvcqh=uki@fzKZMZMQOIRJ@-(q3WoGKm zEl9uHyt;pPq{Cf8G3axT1lqI|wy}a8MJb zLjq(HU|h?@#_vNp<(qA!fXmoB##`gF%VE?s7` zb`y?4T0-9_3DJ$ZT4qkLVA?;x)>i5IUg|JX3!2_iZXY|*K7i!03$175iE)bDL+{h) zKR2`O@1V3i(4Q_!EOTh@ohR@*2Yc_*`*hG{??q+h3VmaAWo;7Gqbdv2;hn;}+QFT) zYdjhcW*7T~u*pHroQ;ak2)x;m)N7-n63mF|zAA(hy1E}3uXL4A$wJj_aspI$5g|x* zzYrmm5rS0rn;_^CrH4c(QnxC2KtcVX zGJ=?0(m-45BD&_<#p)Q^E*9!lAG_ota(`6PpyYJg5{sP+ zdr=a1Hc)=Lz>-ct623xMfv-IwJn45K7R~k&@OV4uN^GBtF1iCSK!3zuy5J($1gyKH zVV#oN$6?lA5|{?mAr3k}HUYJcMTov)ulBLLjPmpZrB~?&OV#k2Di}uzV<*k{dYExy zG~S&=O^V`6X=hmzYbI|}ls!RF%Cnm=S7E^q2)T>a{Kv51CrTLw2gE9FQuMSi zu8Ae5wMo$n0-uW|XRl3)Dhqri)?B?wQP&BIlJ;&=)Q_!sVw0je!f_|oEV^0I2x#)a zX4d41&5Hgl0uQw~oXW6KLuO)GJU5u;Y zV*C(Y3^2A6#txb>ZlY9a*C@uqZJ}YnlVzdfw*oZCHb+JkAMi$gPcd7`3ZZ?ICZxetr$R+c|RljGp5H8kaIt3ggi6;Ea+ zO<}YL=;G1Oy-9G>!VeSTFIzMKr!P%#%^Zp zY+$`~E)I(r`yg;TFnEONDzlxCOzC_a+R7yc8#bg1aroAG2VetF(4vdX?V7~(hv$Ya ziDf6pMHw(7t+v&ScUocfp9b5~bwC;6lumYp6YD2fP|vG%sE=kV}czcsgebT6zs()FYqKMA6JcU|-aN|NEH zeSAdmdq93a4dY# zWf%Q8S&{q2(gs_QuChUgfhoHQU1j+bam2~}5m*|~02gB5954iFpsVONF1ijn?*X4E zhRJjC$nV7|h?KDCEFoMJi!P3WTW(gAEASwfIbyS-x27mcny^{Xmn;Dh@Pcss=Hdu= zqqOeSI0DYytjK=9uIa%p^WbJhji)Gbp4zM^;eNdVcD^m?{w<2yL!cgwJ|-zvxHN1E zyxT>b+$Cz5 zcX$6MtCe)QrHg=xMO%V$o?WANkU0l%4_v`6{UhwDwNzo-Z74fK_hX4mdO+ZIjPMyYU^tmkWO#nVx z!$6&Biro3Iv6t2{rU5XQfZ;XT4e>C0XCQ9^*_gJ*BaRLS#`%Cj$$r|w3FiUx5HJ{n z>|@*x(U8bgl&i}viR#L zr!Ne-rYkD2%tf|L8Q?fPU1ZBV131V7FS^LKd1JaF_mfcDOWoZF1a*L^3e4A@Od7+u zwCQk6T%tDDje>j+*qh#rmN9uCKomQd!8wr76B3$c2hyo0BiDh4ZQ9F?#q90V;k@L0 zVvC}259pS@+-<(UMbZB0ip-C;D6-8^l;q!{=;0ZPoZoFxH0J?>o+F}hPP6wGMdfBF zG6!u@RAGi9bJ`X~wZR!XSJA2m^kVg#Qs$F$6@3DRXXYwOpP}8qXYrYeP81McnW<eV?4E$bA*&gGqNWO9ilS1?=JqcpY%WlQd7& znJ8Jri!uUM^XvwVt+Wu0v`vZC`5tr2ReQ%+Z0(tfWBpq+l0GvAGeIS->qw^1biEJAG(T#H?F25f#$hE+4Y8MR4(^IZ?4 zYI%Z9s7(Sq#Xbvt&Wm#ur97zpB;Rd*K37rES$Gj)uA*o0BRE<Fsh2E6!F_`9a-B z95Kwa*@}9yh(WUzy(fgDhPiyUqJc<&n*NvI4;Wn2i#Wmh*^0g>AY7fT=pYEh9+obY z;|6=!DJTICy9Aks=P2?$s9kVcDf9LmMYlL9ITvkFlp`g%>NfXnQRJAd$UM45QSxkY z^zR=u*wK4wM}H0sgSIGo9SrdAwjx~oyBZjf`vs4F3qoE^3*+9pzaCzxZmD%uPgQ@1L*1R3+UDss<3 z-PfC`=!~#-O5l$#r9p^t_O!Qivi$FBcOPYI9jD!WV1kjF>1kkP5)Dkivk6bkQ3Q7d z41ar_;f4*v@OyI*=x9&^qTJ^UH1YcVRyvJOz_>k&Q5cI);PgMtL0f$g19Xn6BNG!OiR&K>iRflJq>GvhL#oKMYCRN^7+#Dfw{xa-k5iujhsEBJw18t=?e#CCi5A?-hM zOJm$z)GSxilOkh;uBQ7z;V*WnLKvA~{se!VtMs)ouZgH3%EaADuONX=QBzV(OyE&i z-3ViJ^vX!Xr)ZzmR07Iq+YF^Gyd?qO+dMv^Eo`$IbHfJS!sV_z7ngHJx;(~x2AmEA zM>!BQ1R@*=jxx_zVH5{~qZ|nSi_#!&eT=HTZ#OvmMzX+6;ZDP_!{|X5NWt zGhPT1ZJwW}h=a;Z!5=UrmMjp2#FE$NDdN^#4Ji;ya;07*mVAILaLQn-qAdk_qA`CC z605aW2>TN_2xc%LcdMeKLO7UUUf!xGfZT3vRrFuv2EDI~I@fiSYzsW>8e2veRH9^8 zmWU{sSU^CO>?nmJGpv1U1bAl7We z55$^1^CZ?BgND{*MK#LkHY2g-0)!Td6Zq&_-|K5$DKj%WEl6W*;SF3D5)AhTWq3q) zIRUe?Tk{mTKLI9+(X{v2JjSkA`X9(o%y->XiZUS zluJR1n!Zf0kGI=Z_J)FTE9F?*e~o_66VX>jsyC|v(N`-kyXf`#ic-@uJ;5N+S9$Nc zsOo$Si!Cet8!M1a^c8|rZDbSa|L>hgDA2r8+E+Q=fJNhM&2&!P49TjSfxJGNAD+o{ z8EgPgB#Qxp`qhhhF_o1*{B$53sXBHXr>^vyO!0cgXl-wEqL&H8Pa z6*qA)Ye%p~Yn}!3nB}vwzqSgD6r}OC;f7XusbSzj;ide}Y7ZDEJs2WdYD}u@q5-Ia z2F*iOkXG`3tdT&#n5(#elTdGMQEy(#Wro?n^Z*8NE=X$_yOP!7O@$++2rCWUuqO+= zN;i;=^RWqcu%fwwmj<#661agZDIi>(t>_R4dKj@!)JB7eR#{maY}sm@TK`P)`Q zD^NchJ6EtSKoe}g$7pk4E59FG_R*)^hBE6-9gi#C7Xq*pCS9DO4_O_YNPggV< z6t?O)A@s4aRp&6_+nI{43!$&g>^D=Oh;y(w+6 z4a)`OuKO^CA+&_Sv5@Re*QgbYng$fFp!h|vC3*#A0TWQR?}V^Mmu)2!M%ng3VU+C{ zv*v79)LB^9+RRSd6`cobkL`*|FH)2=X1k)t7oq+l{;R{$2RZx%u0JP4lWgN{+Iz3t zjMT4)uG>ajcF{A7u($#UrFwf&*mtjM-*t~ck$lusy`1EtFOY|G=5|FhM4e8`+_ha% z#v(=L!R?BESfnWBa^dTx%m;QT>IH2d-=S#YB1OEha zNsax+MHLq-awj}uP;!7aGv;Gl*y*%(D7xdFmHd(y+j#l{&tK1qY2Z-))-kkvX0HKn5Ee`v@9ffX=k{i)a{CekL6eL8g7#IT} z;G@aNFM9tZ4|BdKa4S1GC+|@7y1?!1=7t@Lau+KyckEEK zl_lIBuBeJ|bg=U|rF|g$MahF9%ach{ZL_7=1MKYV1MH}&V<_lX&y#?7^H#U%0d{yl zYGa@s^;2w#BKJEePT+YO!>GrBN(U-PWCG6(d9vl<}2imn)e0|vN4Nnt=(0$fJma6n5ESOVIM z5P*R827Vx*Rfi-5v=reC2ejt|=76U6a=a|4oA#8oe0Xo$U`1~}s=qo%eR_u?)r9ws zo%p%+S^~F>;rq?&Apg%ND{6wL)i}jx!hsaQor=;0ZWEI-0XEU!yaR%5uitL{R&p== z&D&=+<#AMLEipJg zKMXd)-h)<>`LdWO1NT~kR=NrAO08&b;VP_XIi4y&PqTcwg>OPM)7DG$JrrZ0 z9UWqwCPD|C4IC(PkH$nb-O-QU-E=v)PZi!{F)0Y{q>skT5$y4p=o2xE1$!clE%5S& z0n2*Z@}!4t8l+jaoucIB7$Z4Azc^sQ1xppVS3PQ=M`{+LPK?~o6%6a`ksR7a@7y>f zc8Rjy+?|R}3U50{%Kn1Nza-f9dc(sFNei3uml4}zx*2tL@N$RqF>Mw8=!A>*6NUb( zgPrhP*a>5oVNi!!dqg;T>Ku|E)6R_?3hYs6Bv%hz04zhZZBy)e%=5d0$8x_rFp+#@ zS=i5hcj&n9_fvn~KbE{qk^9-l3@T^&aOrCc>dV`W+Uyzk@&eHDboccPTn8 zgn7Udb#QbUR{s1RUu93wqO}gpq+*xj`+ZgeTIaw_Cj}r_^hA8UBkx@oy#ORW*<)eB zN~ensd>^U^tj`|`1gS$TKBL!Ij*csv=WQ1p-&R8+MhgreEa%=_2fgC^e;q5WsEm!1j2MoR*^kZCCq=DkpFBS`% z{QyVSC^XLqh$82xU5dJjsnh?R<(}_m{m;_ z!e$50!;Udw{Vqjwg|N+G{;^BZIVQyHRu zgd6zCShxqt^5>{n%)+~^h?<3u;u`B4M)53sR4i(K7;tcnAdP3H2|z@--UODtc!eT& z9vr|+vzhM@FsFe*qX^O*#$HBhz1%UE5wR;3C5N)B2dw6_gfYeSrH)wtFZzUT>7!zK zP43~9ig-=#Dg3~i+&}OGYjUrwlr_03D`g$qe4@~r+W zR<2a!e&Y#)lAF*T#%u=J zlb#-+eVl$D%IW?LEPgu4DBSz#_5p)tdya88kqo{`=eXI%u8Lku*F42n@tD8G97RpV zm|J7bfpZi+yh@Qde~zN3@MG;9MgLf(C}jtKh`_4#PfzGY@_BY%9c4P1j;P^-6@t!@NKceqx+Sgpu?6zLjM z3*H*_6<8WjE8gYQ8bG+xTQh1fP(EtM%=3`EcoNrf2ga-fnd|r$X5YLT6+`5H0bG9S z!`OXDR~Z;o^FYR3KuWIWfpLh=w*W_?v*wA*g*2|_cawBWysfLbM6OixllXyZ{%3BX zYEDZkRL!_#h@z_5YKC(-p&FLQ4-eN>y}&j|25%$cj8rxz(Foo+`DrfJXTtp?jo>1r z1IdLKL>3TS`}kHS$ggw5QBbGC*RhG5{)b#__o7J*v;)9ZJelFHfCH8%ou)I~Cs&dC zE7%ZB&(bW$js_PH&(Ul~OktBnf=PN#mLI(@?obNSLL1IBV*<82&S2vQ-?n@~3mkYt ze{URaHJJ;UDC_$T8W*PTWBT?mJy_502^6HxW9o%46{!m|>}Q6AHG0Sq2wKddH_g%k zCYA#+lpXS9f<`A9StWwR&?ZQy7+ZUdBKNm22tGmv=}_Ez-?``$oD*>W1hkjVu#Z}6 zWZ!L&&M*(Te*wK9n+q(k+g;gQWbAMVjPe{bT^*ij5g((3IfpoTW5W<9#!s`?gvVGz zcz4_q$PLm2C)|7w03S_cPFxYmy%UF!ZH#+#E&3xr&2}Ejb%jxuWyU3g1yxIzS)1npM;e{xsi?2dJFr{P z4rz1~oaXJ_ifXJ=l;qf>=!13A$DK;jecT?sc>SqPT5qPJ3zBrIlgCDBpg8fZ;JOgz zJNa9C78B0RRAhTnxA2`#v&1Y#ZIM}-S&GIp2ZmLN!g1Tl!>Uw)2ZUiryE>Rh!vq zkD|H|)nkvM&mam1^!_CbXI%Q~urCBY=i;lw(pl91Fae(#s?t0y)1oD|kq&K$mWmD0 zQo#^eTx3rGHw^|te7uNS^3^ThgCZ9RwNw}fwgV;H_nqNv%4u!jVzC!v&mKUo_5h?2=MTU*1AxE*02cT$ zdcU^lBG+RkV1#PA#PD~3n`Q@^&}DX%PJknIf1PptfkPU2R@G*HD-BNr-(uPX(6T(u z_&Ne~S@e?~{<0#B5ATa@Wk*Bb1aw$bT`SAu^g^4R+;L?MO17HusD^#I3yXDb#LZ=%Ksw|4Fz&vMm_8!X zlq#!3(P_E2`eA`D3jCzNm#`Ifg`%egzAW(bcfqej!El_n1ir2v=h2PgIOSObxM+3Z zxFtE(z6<_PV0^d$|K|eZ!^N0AiY$RQ+MPK6=PRonZ=Nz=yH4~n@*!qyDvX;nW9!0< zIMo#0(ciN#uzcw{3@)?HkJDjrhn>UV4m-kN?Tw03aZ-|Yu${jEEWvLFU)PcaOis`W zRLc&eS?OTJ=bi6RNxJUe4quDDk43Zr1u;#6A|2ow?+i3<7mSLRbb(2uK?-{xb>lOe zbAe0C2?Q)(2)k^tZbQGuAhfOkDLXSgg6_lUgBumOJHe&A)Gy}2r(JXlrgZlMiksRf ze!?*hhitg2r;2@d+c`!&vPr5sl{w%%bA;otUB`sQ0w1&M1Ae&zUlMqWz};dreeYfH z(I^{?N!tRRs8f`MFUWBSg^M+%#A1F_%cusYhuj2;fh8=HWNk^ zCQM<%)rpG63*lglS#*-3`4Ej2-MLR0G=_+V*^;J?Q?v?s&mX5~%O*unVrdtDe{WGV zungZv9&gC&%cx#OOuNE1+^$V~Q=9fCn>KF~wwC*eZn9M_1LUTClUtN~b9i2NQ@?Mj zuTaxOO7>-^Th!aJ?rRs7+pNgF1@=z2GD99(;y@o!0Y}34-0?vva7%|a`U!zMI>=db zucC7TPj@7B-K*%0%@TT5vi9aN4s!P0tH>?zM2ES3ucDfp6`2S2Dyom1wCIw;veaRg zT&d_wru@Cl@c3EyrM8I4R@#;;ZL+-%4u5+c@Ww`)#bkSVg}y03HrZY-a@&Z>_VQs@ zF_|Wc$t3wB$e4YY|x8yJTy|K8C8R?rH)hcVo0+YQO0 zyUwCJXR#Pr@KP|;LEqUu7K5-{_Kf9`!C9!p-NZy8 z^orGtGa@iEUW+i!7een?op71JeI((U2y9lkPGoFV#1dRvG2Ft{7n_Bne=PgMUa6Rf zKO7eNfLOkuqXZ{}Kb#W6pjZ>Ppp@S#S6^Hg35EP2wp`dB3b{eaa@zaE4QfL8|8fJ& z>2%H43uXH$*VbFAW{j?yF$(g2wQH>4s1mr=pU|>Bu!c zmd~GOLlGvV2w_5O%GinAy1@RNU?*wzW)b$6g)l`ET7d9ByiBgMUSk_2-RW#yj@eue zEE=Sy*RVW(c0`)ZdJp8n0E=;c7>h0YxO=bQMj-c_<#3HRTzH=L%&nN!20UpN&5dQx zgof-0^+ol$+7bRORl|<(?O;Wg(C5XP;|D7`%?US7Qxp)weC;8|HnIGTkO~k^tj|P|zEbP+22=jNL1T`CIY&)j$O`y8nY7mSo$fSF zYMY;oMdbK!o1*d=nCcrR*=kfi%j>Hz>jPn&dlqc#vzkI8on^+fZHnBhfDbmcEdSfy zU?`mIGBaedmOL=oEc)liYIv8xmt+5z$3!jUzy&z}b+(Dp40^?J5bPC)qU4|`-v^#0 zqZcn863_E+ksbA6#P{1U7qdKm-iR&8wm@ci{C+FFuEmc|F>e<}N3A011=ij``?7t| zr501^AoC9fA^U49;K{J)2&2XT#irGZnNtBbvOM|{>ub!D3qPs3TG0WqNWVC3q2mJo zF7VmA;41?6kJG{MmcV(@2cz#fiwdv(the2fMmXHbRvhkx6}LsKINXW&F2e)?ba_TF z?oTV`y8;6gmy8i4p4y{UsF$W z+Rd2e+hvAoH+A^h9sP*#JxiLFot5Pc(FWTcahIFApf|aoKW$f(>J9SCEquc#-QoTRp8g6U`)9y3*1W!n$CidV@)AUl7t^b!ASUN1ZE8u zB4I&L!Pk%K?^mxv8*Pns+}IUOps=wAr>!Tw*{x`~HA<_r;aSB1&XwF*C{=c5It_|P z_18hpKC3B>W$+W^&9?qtY&j@iUx59yz~kc0&|*amb|~Vjyqh3Jfsya2ZouM02!%D? zV%sGeFV-3_W{pET6uG;Fm0ZeNeHT`8HG^%CB`Y~Zlv*lEP82v-E7>`$WG|%nA4>Am zHq8nv8KkYYwW8%Vt>re>a?lP8P(00uw#B2ZjE2@T!dmZOHD`yl-p3$z!D_8nik5i4 z^Ph_qZ523AYrQk9_1VH&XGDEVsG4}RVQ7t=GRU|uMN4R_FXQvNyAsmuPtAO6`<|5&dTWb3K5MkjKUvY zM(~}<-|tkE8Zj-6Fwm0P0h#Fu76e!!bc4~OI$o}i37n=MlcKunDU2QlH2PWn(O|WK zb+z$~4992|lFQt)K!7%Nt&qp-v(js4H>Led%7r}_7%Wdd{aRjEhPR&!5-J*^H@CcZ7+o7VfN^z z8cdUViT-}J!!}i_=&+3sF&(x|yXvBoaOZ}UZ~NDeE+S{geTuq??6bC%2|NX#fq!>l zG7vS~ygL)WC(wj;+L~%N7=rsyiH0cT@x(5rx9Rp3$wT#hyMt5of*jwsyK1qbQ9>W3 z?r|~L-(}v^)5M}(w$6smeX7oVD(C*}E=BH%DF*2);FhSVetrZI8$ahshSRh{OQRLS zhWlKh&s5Q^d^dj8@6_)=&OwSRpgu2YOu+8^X7g@u|nT2ds6ag zUFe#)a(}XEFw?U9wA;4KuFJJimun-J>w{g2Qt?Fv^YD%QmFz#e@MRx~`1{{U{&Lbv zkp2+mGvc>hipqJ@El*~(fF})~`KUK9TT^nHKPQ44#JFilo!x|n@*?>{*z!_}LHOh! z2+>6rn2UnCOFfNMPU^&K=KFwR6F>U2ZbzH6iJy8ps?M>mHC50V!%S3^+L`%VYj02YEwEH3+>oMLFL7_ zjD_q7Q+OqU^7=!MJB zAR`=OXkVmhx7Q2A?PF@~chU2^6}dODT6(Q4ow~$8`AX0Z`g1$z5`*3VyEn;s2Yt2V z-aW>wkf*2~)Q+w}zbC`u>7j|uCfvnQo~^4**V>R61KW9r#8kiGqR)5Za}zI#5e?zI zn*bGTl%12A&I>j)B&Nq@7kvwK!|Xts1q{A8b%oh^uBsDKxkxF7vLtdJLfO*1G(6^! zc`h1+Qb9RfTroTb*L#ooKj>awKijb1R$Uihbc|8TbV>si-wgD$4AH(XF%Y!nJF2W!1`mne4Yg{pH(E;09@x3`QMrt_w z${9p+IQ4PZCycJ@!KgwgS3zORr2_@i#qLqMA3ZNsxj06{Hw0c1L);C=Jfow}k{IrG ziwYR-hD#N|`g_vDf>@)!CzVD%X!}n;^XKnLFFd0|S?ha$PlCPf@}l>B79F%LkJa_C zM?2CUHu)2KaMIdKw1-Xp9KfLE38XbbWz!xudL>|a484bK_Q9U;Tt&l_oaJeT%in`^ zh#5S4FxU3_H10Ix0(%s>D?Wq!pFBZ}uCU~v!03a@LBaF~TQjin4yPNOb`Fr^fs~r> z#LM~XkXmm7>*lEYp^Fae!TzYZU~E8r9Th)xQ9e+l`-Ej;f#OWhQ*=NGS7OXId5X&HRb+O`Q-p6~&R%(n zEaBC5*EkkfTa1ldZGvX6tUxC#ki#djnxvEmk;B5A*(dXl2A!>qJl zQ64Bw;Z?60o9y{?u82zoNzk9HIS+itSTm{&&BkGWgMIzoM6z6;%=x*1=j> zeQ-cn8gsx({}qlQ+DgHFVx`uid24N@?~ym!`Y5Djr|DH{BDm=&)_3Lx-i?4kI;-=(eN74HsR3b)w?XZMKp-4>t4q zyjeNSi7vM!<1oL!&2ZVguqAaGSwj>c*-Kq{+w@0y3U8kd=GEe_0etfu4T(ivv;c%* z%TNY?0ciQs1)K|zxB1Ry@;-(`7?sXp#ECpb?$fCT#Ou#gH}Vjb9OZFCA&uwk9s3oz zlYnVP6Ih3GT(9oufa7>r#|qTQ$*>SYX;mzWT46udkOfz%LH5@ct>!G>fV7X1GEA*( zWo9>}4NR@clAWt2DQZ$)N0?5r=Dtaa(7?>2lN5ac7U#VEigJWwNUV8uzoM)N;d>#B zjMa>71)iuGn=vEu=puyGu`K#0Cg56w-a^9atQPWgM>(eI(!{CpoViP}Cp- zo23sb8jN)0eEguI9HFd?GwUBzH12>Rv%x_{(+?l9R|aY9)j2q$HR~X zkmVeBP|*M(?2a>698|Olh1_*e(PsQOa!}De$V53OOF5THW11uIO5K=FKnZM6xdhqd zJbzHpQW3r*&V1;QqB~$oI;6;XQ0WG_Nn~u+GD;kj2KmTA?hvaSQnXuStc^4OeMpfB z3b)k5Lf9W?mN=lO!a>|!azIf<2#3O_MR>T$UJ+QDY>jYc^&s-^e3&~tI&M27VJlxd zaXvfozYoe_JD=Sr1W*RQl+S+q^FbV0NTbtnEpMVeQ1y32`O~`U9nWf43s-$&1m>#$ zjWu*;98y$TD3{`#!wxBWOu!jVz4T{BU|vJ~ofH0D^9)!Pov`8FQY=v3&?URUB^!yN zU>b3QOEw=MdNHCKT&}G^go~bsZiI-{; z4}6LytWh5+JG z?RUb`(rLc4Ur{YkI2imagbq%Q0UyJQ;bi@vjcWZE7mpCepS6TEmazViqKQKI#c3Lc z75N|myR_$vgq`{g=jKT8cU6WfrmI^%I%%t@`;hKV?nS#h(Tlc%SVXTCl3h=&a7W;w z@D|CA!xa?XEsVXK#CjePxVMwlJ1hL6Uf=(vUeF3v&GLtu(<$2+X)icXgCz}CaOfdv zFGHM&@Z;bixTSTdv!Hcc5fz3yIWW?5g1oSAm4^Zm(g5?y6`px(NNctn=Z;l$-?bns0&@z z7Dic3QC~FFg&yfJDgwH`BAHKg{au#aKu_D&h$*K@j?*~D(<~lsGDtLybG*VR$#ELz z=s2v%`Q~9oRV2qng>&?K3r@+H>|S)n)=5^V@?88qGtYJWri+Rm#wTtcu0EnX7Z$=E z048XK{MlY#D2z-3(r*R4+38`_Gl#=t6rD~w_BU?|xi$oA6#miW)ZxR%1x^!=O= z@;S&zXrG*|F-I6v1BL1}N>ME-)KQl?dX%D%fDhrva|XGH=n=EcC`JD{tSF@uoPd8o`)3$AdLwH^nqU_ahPakl-k%ey6AI8-TN|6vuO|_$)_26MHV$2KQ5!ZZkeE1h22|(` z30iHyn!{nhMmTG@&T!vy(FDK^avIVmqry2CEr1e{g|%`ick7U0u@2{KeME=TT8GoD z!vWNzpN!M217ShB;EreGG%G;v0nZt{Stgy%unOl6D{_wo5_+6vJz|f*=6|P&Cq4cB z292$>5S_Q}5@kB+?@gU-FvufE6v>gzPBz#i6^H;)CmUV?sCa~@gPm>fo_A5LBZ}OM zph9!%$C##2z=<~=)<0(utUcUjKCoF)OArbaYvA>H0?q63K(ju&%L_JKS%m~MYO8(IJ*XIc$I zG>6%*qA&q(Mx!vod9?68g)Dr7)Xle^-{Y&69pIfPbkVlgX7sB-ME@~T8xj4d%ybvs zcQo7_|8w?z7v4U}AP=Hb(ose39WYZcjT#Jk*F_b8u|JQ`G-QGKLu5?OfpDwm^_S@e zDeP6`OvSy6g3K^KnXf1V+|HGU6}>L_H1o(|MNJuhW}c#Ig7=ya&sWrk@#=`8`hxeF z&m2)S`lzC$myRe}dsOMnGlgDFgE<1$z$(uXMc)e?OhIy;HZPpEtq>(`7XfP&?s)M* z>uZb6XqLxn!6jbyfh`9cMyiKsu<`La7hOAw^Te3|-(2S+_TrB?mnugT zT@k5Q4c7OTfa@{sK|R_lXlH0?d;3E?Ljdqe<)sOFWyI?)wdYo#^nqR(V@ zvEj2!OK9|11>Ck%uPMGej$yUBLI|&1z9!OtvqjxjRJnp)B8|Fl2j7Hi3U5!_J-!LE zv=4-1hK-j$KaI#C;;k8JLZ4~ltr?jD%GQh=0rl1lUB47FEW03zq~d5SiP@y^*&cHo-ar2X?0y>VRWCbdVXJq+EF4hh^xx1{RFr6tut zcKRymlfrVx#&;`StDuiW^K-HI+~;^fJ9!typZh*RO6ONc6crW1OK`?D)@g`auu1lT zqfi;yKe-X4o7!3F58Jgzbs4W?LqjIfb(MJAMaPcg1OrYX1irR_#L(#c@o+o1&M`>7=`=Ft zTv-=+fe8h$UA&VWyS-Wg5%l80_|f*pw_P;;#NFG!?%IL=U$!R!feirk;{_A!c)Vcu2}N%Eix`!8g4MjfO1|{E*4N&zt#q2gn=y_e zh2=|szhT3m6{4vu<~&l>L#j}gpQhR0t?!~DC!s+@ApNwA*&bt5JB`}PsHcGQ@gFBya| z*xt_Zpvp^8@c>)z-Vu5yJ8!-F_$7lX5*2K{^9a4O-8?-_(P0*h{r!!F(ACac?~0s~ zt#{2t!aW{8ZS#^rF+@=}SMsa3zex(&Zujyj9#Y_I-(bn(H#>jss{#sNu`osm4}LOBot5Veb(|XN7>vH}Q8H-CS5*M^52|+HFzk>w0hy6LhA3&drXCht|gj_8DK)&2A{bar(=ixbu zYP_s#Wm+i{k5v349~RKhM||+IuD^+P6VFGy3X&5;=P!kD&`!=5jw)&-@LoGPgGUv8 zE$~dc+3%>Ls+}HrYUdH`>WrYoVg?0w1%RnF|#)&R3Ka zTBxWMezabws55@xPUJo)81h;q1zS;+>uDJ0g?pw~3t?qZB4^WSiZ+YzlXh|rJE~}p z!1;DF_o$);kciqiDYiVPYhx!%L~UFY!g+lg_+cb~3dSqC`VQzvMQ(EfRFkWKaCNq# z`%i15Z#k-{#4Fn9r|srV4BJmDO0n~R4e#HSc|~95vmnmI`!^Lq#j_xkGL4UBp~}m? zqH9!M2B{&!QG)U!ymO3+XHn{b#A#j^Lf;tk$+?RDeOlba8{w#0n4=XFoU>&J(r3pMjlz#c#}qBckDOzQcHzhO#}wVf5qsSK)liDFGhV9^68KO&s}Xxf z)F^%i2I463on$v9MhBTT0xyr@Ak$e2&w~!vJVm{PemKT_W}c!{h~ z;lgn$#+-Oe(Yt39rOafDS01KlstD|>c*E|$Kn=f}jX}*~NqsWLd^%5&2lBC*DU;|U2M0%zrc8ipTZGWt!5Xz>Li2fwjtQZ!!yGa&MGnkgB2AytMvJ& zXI?dUAH?qlm*=o8`S5Tm12rodE^xVzgS3q)&DJD@58%g>tN{7@7Wk=dm-lR`!0(6@SJQztt|Gq z9DS8<&DZ`kImSe^j__X7SNVP=_B zCtb7>h;KM|I>VSfNH+rMGA&<5s1aS_l;>bd(w*W&Dd9c`cZxS)C3Go^UekS?bc(L? ziikVK)k2U?vE+GqB4dZ(rBi&86QEN(P(VPZSOEkg?i5c-=6Me86yG?nqC3TluNCSP zYk|t0B1e*&uNCSJKNhhFAu+G(rgOugL&p6A;|x6B&w5JW6GDGM;4=>0^ePMdNA&CG z=~jA9T8J0EssyZbZ;0;L#@KZQca1etF#+UzYlyn?E|#?O_^9K_%(V2XBR051h(Dgk z)C!9?l|4akkOuJHm;u1@QrJL-XNO_UG>DPQfb?0o=3k%T9n9Hn0GdC0)b|83tPoA( zlf9>b)>DL@d_b2j+&#hKuvtgS+*6;{{q*&yu!&gc5qd9uDEGMw@CU@gMndSL59Pjd zK?dzXkx=MRZj0CN83j8FuSCH#2-nMYzl-z%a;SBTzyo9X%cu{WyuLS82-7v8d4w=e z2yNEdXAWIYcfYZP>^&=>21wqijj=usgo)dd|GF6bqZP^h4`iuWvNVnuCM zDd=1XkBZ82><5!l-PCr) z^4i}&1(dbFiUR7jKP=0>EtrE+pYIBsA4|MXq^`iHWA(TDPXxXi%U>g}A>-&3o(y?d z#q0BisD*mZ=vRq|@bXbp{5NO4i)-`*;gTYE19*gwP8;~z^717N z;iA54g-aR=;29beww2mt=fz(D}90nudh*?vj!)(}hE-P|7-Y}$+ zjI)-Pf5V`1L7L7>zU2M}HuKUth4y>|4E=!dSxplIH0%Ru2j8&5{f?NxQ{5Q~&i_NgE( zQl;*=C@vX^B5mEDBL?rFYHRNOitmNp&(`|q6{Ss;AUPk_dw!ps>O{oHIdcSt z#}vL5c%at0rKEz^PL!&>&?jhmk7zpN4G{YH=(%vAQc82^qWVi&hu96g^FP#%4?~Nt zC~}W`lc#3GxUx3_GY1$<0BAUWD>()ah_YkAO3MzUGecK3OzFAwK)aFpbt9sIcDyum z`wG6zgrWPcV*Eyf?3h|t01%|XEV|}ZMeY^I&qpIzgGL}{XQo%m%tQ`Bnr_cq=%Qvo z;~IrA4EDcTXe7vAB)!@pluo?VyZR|jwF_|*aP9f!qk!D3#TP$oWCr_*+xpJxK2CubY@+PCk4;3ss0w9WD5QWs6WcK3A6{n%Ru zCHop?=lIg;GUs#Unj-hVfKJm>(_M@Yt5bcyAr*(DZD^Qk|uSuJ4sJVBx^vGDhQ0EM|IHhobSo{44w=Lx6cKHL{FuK}w>dlzJz~~mXhL=Ci{DCbKnbap%f7)MA$)IG9mj=WR zTk4`RHxPF{G>{)~Ne0B~Ve%`drrrk9%k$)+vCouu(fdH)5;-fKhB2n^4Mpx75bULK zdoHG$a-Om-8R9*fa= z{hKHXO^@Z>AMR5ia`*|-3@-eaH@R-`$9oY}747|fVx#sVG`=Z2L+-1hr}DBFA&A7h z7vUix^fAl|Llu306L{)N!jY6tI&oVn#R6v8^4akdENjL`s^34Nn(0IN{y>q8Z_ zksR*P0Dh}-&jv79Qb+^13KjI=eWK*CNf&OG=zzlAqk-t9+a3zn4I(C;(JkW)w+!2@ za9WUY4;1=s{Y({|iN&6a`)-9>!x{Dy%x^B}Uw@US3~_p@uXK~V7;BVmL{~ZA zxQA~kDl1;3Uwlb?4ydPsbTJlFg8QoiEYRaRtMORzXoG;f zBJ@`Z*7EprJekx>{Yxv@8IP3^b&f;KXaqBeg4CJMH+=Xm-s9SuKR&QpW0>I;?K5+;)^8hvSP~SMb7q#}5BKN*3=-jCvbDsg`EHGaB zoiR6AYaUd^y)CUd&irn&BFAmaN3F?&QBpi~9C$9a*Pv zQELJE#tLLx>HJ31G#2y`upDn0sh@>u6hZ2jCRQ{zFPTS(mmo2!B=DTKK4? zze!PFwOgvUos+wyc22lgXB37njcDgY?NPGdPd__x{z@fiME%r!x3>LCt;21&s5k0)GiOBaq!R z)QHwFN7p-w%As=WG-@71H^|4mX`>T85F2M38)q3(@;x2(v%{yKX`%}{Zv%;sG)4%M z_>99f5O8VncD~TA1lcKk@4+=rSsoa@38{5FHX&6e``!D&s-X_jXovHDilm+{c>q zL9sDtX+n9d@pvEt;VW1Ua`IV7?l!6##H<$m#@DAU1)9C^zN$JtY|~!2p9v3~RP>M# zc00|NPbxaWggJv1Jt2fWPVSt|s=D(=|HXamvqInJrQw>7=5{LO<+G$~vj& z64@!K=}AR*B01C%jP*vT(Dx}`3cTFKx1B7js&}D= zZ#!9602AMUv|af3xyX4gSJ4rH^IT?$HHut@ol+jc^GjygHHu0acCE%mQL~rgX_;x* ziJZ@_QFJpxNU4Wph*P{gL(xmZanohKH$%}6 z;HW=CQ3w3^e1@X_C?&SAyj4x_H~Eyen@olTy>F|gi1;;Lf3d48@NfDmzyDObYfR`B zdUt)5-*QOeF<(FkJ@r+72az+zd_RhWdyM%yRntBp_l)004TZM_@%&bj%HYpwv!epPaZxW&R)7-TH$0b94B?Wy^FZ-n21hsJF^Cxt+2Q%yO=g`HM%D5Jo6ybp z#z`((isa4~Cl%e4N*WdK9ClKXs;<4_JsGvRs%sw|7tf=%^_&jdyY3gl#Q3OPT~7(J zuZq+fws5{6=xOn0znO~iSO|7GR20Izc;}jvir%fRKW+SEBXZW8si?lt7scy6WnTz< zGCI>Hf{e=a>Pbb-1-&hvc&V$Uz?b5Asp~8&fpz+yg>X|7?l1w5bN*I9sJ&HDQDrCd zUt1MDh#w8MDk_T~c%1WDWv8Scwkmo}+4Zn!lBB&7!=uA$3XaNUo-LFg-Mm@w15ljU z^0q_>t=$|2J_q3*u8rXV^;eg~t-HF}t-HG6)|tv4Spw_ohL5&Vc3DT%Fo5UC=<3$v z2Y5tZX6&f!c&0Su$*iu&AHOqt1kgBVG?2kf0QJkQgBY;~h_7iE1D62k@xoCz#tU(F zJGs|X$3XOJ8t%qIYYDrZl09&98qSFx0nb(N=vn!b&B;6jpW!m-Y6K0jU204CrH zllO(NO(z{4PCAV_aAo!v!ZFfK3^%+B&W?hSRWpIF>8ut)&^>$zOYSnu8=%I>ykmR< zd(!v>cv7xi2gvaW2#~t~aey43fB<>Y{-<$Z3)mHdCW|H|;Ap`g$lHl6g55-^i3z$x z=`HZ21m1c&q{dwx%4nfaPT(cV5;5q1v4}892vZYygZeWucH$0Yo=7OP1thmdxGRao zBJ?0Tg;#ozst~T14~~iSSqVJ+I#=Va;n#JcFGz6WCP!OMO>ceIC6{;Y;gjjkKs7&B zPcas2GcRT{*NM?)Ud(3p0Ae#QW-|w4(0S;N;!pybb8BF<@1ICO3+obNCwF{Jv@q@k zwkDt#=nJ-RFR+zU4iBTa7ucGBUSJXm&&&N4YijRamcT=^w*|y&;M{6^AB@Jw(-f@e#i z>`dU`SsE19ql*wOYdxM|0{W@mLb#R?)lZEOWK@^&=qW|h1bschta?h(3l2M(wN5Fj z>abJNho=;M1P%W&SnUTf5bDbXVp3^3&Sp+V~3 z+By0b(L33Q`W8XM>*cVMj5+!ifddQzB0T2MsL@agMa`2O#}|nz>Ip#>6t$2N7$m*t z4Tem)lA8vrBN7jm6fsiqJ`~ZCA`jJd(G+A2rGbEQD^R595)}yZ;s|z#hNwSelD{V+ zY!3_DSs-i=3p-dym?u3w=(p0mo=h65I?89I%|-bG+2*3?M=r1cqRmBd1jvZBQ!3AK zfkEF^EH>QnZDyGC2f{5yq50#nc1q6j)1IREF!VAY=_~Sz!pb#(Y2x*z)Bd7pC?5mn zQ&LBYZrtpm#(=G6-e4$5M_7DLtX+S)xhVGDQ+HHB0j{%) zc}K?)xz2775|DG(0!0b$=tg;@s2RIZ(WF>AnZ*|>T8STzE>yH5)=o(&3l*KjkAE&y zbQ3?SEL2o94*CA)l%j`3%BiB}cc&CR7-y%X)~6IbhaWvoDS9102A)z>Jx=yEmzN|9 z^cj!3EDK9pF9~5`QCV+(OAu#@a!jl#WkF2jXj@n4XN&UpC@-?Y_o(I&S>QVXz79TI zEpbzS4vxyD zRPkzH0#-05Gem6@;X}KC;Y#k1h)O;UbKq-SV<|+-M6S|n(4DI^B!qT}T&0H7PF$tm ziW#Izi#a)dp-NjyiVlffrH?zMN?*ngRA~*TRO!d~ftqZL)O=d!H%Z(zkx%R7fCHy> ze!&l%*6E2KIIS}nnjk!nkR)X7pVqDR9HfPb%T~Imyvt7R0E0k$zn$-d zul`)i;@)uC#WB_=^X{;q~b`L1rLi?r<$g^O(m2P!S}b=rYia3+}FqzGYCqWRTKMZYisqm&9l*rBc6 z(`DD+aYr);^s6Ks`x4pZ-jO_cDF;1NJ)!3%at}2P63{~}V+p8nk8teQS~nI6(7K>L zb;~TM(h&-mkmGyF5nZK6xJtLej6pie)v(WH*X<)HIh>5P;Wv^`uL2uF-xk7qO6z+u ztZ!UAY6SZJEFAe--)8~HYRBsU(xDgv$d~a_rrx4Oi(*lJF;H}gDibswA-t`NahsYT zT+o>PVusK=6yv}W*vmzb>Y{%i#2$ZirL0!DHXk%{5~1B0`^|4PFzO6c{VxPsSRp zPRsaZQP^0E*ar38aH4_&FX95Hxx>!1h|4T-XK69SogfULca5xM>VJWdK4}$8?FS6^ zK&y+P2O8$Kle^4&m;=+=V(6o$Lt~EYWu+*qit)gE5fjkGJR^kF#kh-E?UpWPGfa!Y z!XErU&vFWB3W|^71n%;dF>0Me@Ka#}oMKfk-DQANYyg!Ij83}sEOgUdgb?YbdkdmxaSkbiMRWFW z#Dy_J?^T@R!YX8iZu$g^gb`*5$M40X0@z}a6V;v&lyil*e{t?aEGp@?vy4D4tn zg+8@7hv{@=Qc$>zw2wSZa1(mHP$1ivQ7w?2^^xUiLgSRz;Er-l2}3{4v982aKQ3E@ zevgXGwI!lz;VH>EO1~m_%~^QYl}LJVqoOS2&x*e!gbgLw8QzfOP`p6DpcV25vKx9c ztp+)1O{@@&SJ=j0hKPPI$)mF0OTzB0iejn>YrYgY>0Sxv^RV_b+jmV&c>$+*3O>sG3{EuL~1caCvE z>RC#uc={PQwx_DCJ+D(K9>lq7hy9a?+g~xEcP_>4Z&0G0xc$vw39#}*!qKHvN@-rL z!O~Qc$SJtFpL2U!c#lQb-V4GTReNap6@~YBNzQp~IOju=oZl6W6S{uuiyYLi^O1Fm zz7TqTN%OsRimoTxDWyK%=GV$J6!PhkT=Z;79vQzj6Z#pgfW4R${lQ}4(9=dZ&X$ZS zdS{VySJ8V3??s*4AmNJSHd^SHbZ*avbE_7~ZKiNsj?Qh7$hj-G)xvv2=eAk6BDw7m z`c0kN=i%G}k=#xS$F1nxE{dGHa=R(Ktx82T%9!`Vu9Om;hg(N zaxNnrZA!5#l@&Q$tq1|-h2B0ox0i(LE+=|RcsuCariOD{9m%b>aQv)u`$*(Oa{G_a zf7K1dEA)sZ1492z=deGV!<9%5KMF_p=myeW0oZYi&!ZC{E|qX0fT=&yPF3S$bdLEt$9&Fl z59H{51o?cr^Ar$zOrsGuOV~;FMxAF4_k9=>hw%8r9UHDFei#URmet_1_u0u^`~xg} zQ72XLLl;%K4`Z9hfJ&pD3Tf(t=>uQ_)K_6J)eubj^QP|ugP)N(ZzKMYm?Q878-KI> z5uAK;{C|aT$7a59KvDY$p<`h}A12^3=e|Pdq)fcZGKLB1d5T5}VVvUUX6D{!C$m$Y zqTKuJ55&V*p-$jxYA=K z?Ia(uH>&pYT=b8Uc5)wq#l5sg;qv8IONN7&t*$nBu8L}f&bnb=j`Z4Sg^9wuMV~Y* zEnH}YOn*e^Yc)MNnx1?>(X&F|qqOzjh=O6X>H_C!qkRagh|!R|j*!F2KPiC!!fNsc z`gGMhUfU^O+bN&z^q-QLX?U=wHJ{IZeg#DMqn1W}3lyG~^JWm`^UZjzfZ|=VVN53& zJeWr3*}ta)vck|xKxvIUz6>j!2H3Gsd;-)IB_rLy#e0+ zz^74fJKAB@(sm+p+v*vVoJj*Y{YRzk9VHTb-({MXn=iAZ<3fUR8 z!cSn0V015yrqL{C8lXmAffhn)9Z2=kIHn&3CJUHgP8LnD!w6;Ww^MRjBX4GU!1B>} z);jrq=t#QB|5i`C>UqUY-UAvtM&Ag5xIqsW_$NCz=qC3|gZ}URcI|lch2e;en{6jZ z(n(hcrK?UlFr0K!IBA|RNYYIONskNVnhqlu!%6KANUl_0>n}-5J%F+~Z=F))6v}A3 z`AEK^au3+aOvzXD9)48HSM)FZcqdY1eG)CQBihV*AkvB!@s)(Dfe5!EjoR}-c+{xj zaIdnI6XZXDUL}o|v0GjNWQC!)2SM}Fa(1%U09j$EHXz>QwvwqWAGDLZPJIJjl;dkc zx%Lh>Tr~4RG^a)d=#7kC0_JgyrLCOtRxoOZS}zt_W@k@31`2!Hw!(z#Ou$nd2ZgZQ zZsI8p^$_AK2xkftN-_bx4t=P-VWY0UM;{U=efA-7mxqNx>aQ|VO4SP`S0}9>PHKgd zRuKkC+Egd4pRedWq3p0bTjVSH^h1MQ#w$RIoMZA8r3pM$nd|cvwTHkR`HC_Hzt?77 z%~$l>Lv~8Kldot1OV(QDi0ExvtI=Vt=0HfVJVhOaL9|+qwCs>Q3J7q>jUZ^51B9|$ z%iI%|c{(g}t}uwq$I75h{Y7tp_jYRWlg9ig&P+AZ(EfZ<`}0Zm=Xz!A;hWP>+A)Or zyiC}6HO%M4&f0Ns!zyDZ_p%QSO8%Nfo@amdm9Z1HnV;uq-xMnGBI+8^^=$O1<3a;O zXh^fvx>8!NPWmKnCw{r`N9Yx9R-O28Zs&+*8kS9UonoLiu8kTK^Wf7i8U%eX1h1Eq zMSEfpYo|n^aKdgcGad#u%}eVX=pTwbY^UVLwBCWJUj~4FQ3(7RnG7UfMWqj#J`Y$k zu{rkfNz-Z%+o@bbZy*?|hAZM{$9Q7miQL;@woKa3Ie+l5o!rg;Wl*wpSEqB3>1mK0 z-RT^PfmU6BZu~5rW2Sk4xIe$c)RTaDJgebH9gN)gh%0h?i*lfOba>D{f{DtkC8)8 z7A@jL&oCd6`-?DsGvi+Z-WhjV(GMT%;BY?1G*2t4%!Ep(6?GKC&knP}X+^ajwUg;P zt>|OsXntDJFyZLvFngR`Kfp!YZ-EY^C*KMvy{k7We} zs8@;!$YWgr0eL(Q!rufrIoUT`osj9lsu&}c+bON$*znBb*zSiLnrRhBlB$o}sq9k) zjdWE^d`vvWee}4Uoaav~Iv@(Hjv+4FsVErq3sEr2en;SS!teN0943Z%E|zc?T)F`M zi*oTmgyyI|GL=2+;2F?lqVb;&vMl1{J5RUbD0f|pz=Ia2t(0v>JJA3=FG?K zrBqh1zAnyM|0^e}x7goO& z__p?=;z-GDs+|z-=r&d63291w1%Cva(f8yj8Y+m^vD%j71RfA;zO!FZWtNDc#~dNF zjQuO4Hbg+4t1dWne=|0gZ8|mwAW3H$MX2DeS{DyOz6u5#K^WnSRTuhkYPy@Bc~@x#SRb#iIE$SQa=JaQYgz~&Cq^D zCz15O`xRZr4?F^!_#{FGa+xHoi*+tfJ}J4p_@v~rR2U?e_n&0z)ZedYtxy*0T)aq% zTtfJPTsni7bJ-@Wvve*)z=65O)Nn3mgh6syfRx(QSA{Y|n|d`UY*G4LSI$gr(LGE^ zI-|%bgjuoX+h-J=L1yorQFI-deRxJu@z3?3^`OlRo>62kYbW#DGm46q<+8ynkBN*` zTHy!50)?M0Yu7{03c?^uI{!pc9;CirK){MlB@oEj>WreQLRl4SjyR*}y|Q+4w#Zjh z`*VX{rvJy-cgHtfb^o7FJ~wUChK+zAGD<0_76BKoM+6m6K?DUihBO_}CLu{F;9~E+ z_bwaROE!Xn%94#BLqLY?CDY&QeeOw`0?+gP@khxS_nvdlJ@?#wKSY099FzVwshLgz zEt*M+U$qu3LRti%1xCazg+a_VMkht(1cdUduAGetijq({#5J>>86UpnhbILZ;{~Iv zM$VL!3{RTAN3hDgC$0RTZsiBLl^;(CxAKGBg0BG)YULUgT{+y!4>M0mAObEr!VRuG zAa@9=0Vt3`N4c@O0l7m^+scaUUww+k$`iCdqcK67T^S>-A$jOij9v=n{fwo*SUU7MWm`VeUL}NcOh5xJD1@Wh-L8iTkLD-DB!-$+k`PYm+AESMO{-#} zG_AVAAhq`lQtI~7NGN~mq;H0jHVY-q5(Y_{k(acMP|oS3Uxt$Q2_@|*43cy>lJd}M zP#$6DVUs3-Ks@OiEtK=oJjt8!nQlKa$(w_mG09sXc$wraOO#384>~8z7gq?&Vv~J+ ztEM3F29a?wnkR;*LE%QQMF^L5fv$!MWUV4*JR=NJpqf?Ciu0U1%k58dH_66A7@pHz zZT={Onw9tY&?R>oi~->QnD;a;2?`UQ6v75gusGm|d(WHnq7eRwaa=xcQUQk|$G!6=mBNo0 zyjKm@Jd5Rf=$&HRd9VF{UgL)#XmUF8cVY4n?w+P!}tcwH=D=^-!uzdJDyT z+kw$edPZuH-ok_{6AYh$LFQ@nHrTSk)`A*hhp-2J`{`XQ>NKA&kcg~hWwS} zaUj?ZEHJ5y;NMNUyuc)K+*)ALbcdoO%R-YVzVJem7J~V|7q710n?q~On>Jm%6fRy0 zinkiY;|U?9K($?f^>9TajziZBJmON{lj3em1Ngnnt0-h&6f%`4copzWlA?O#NVWT;R*N{u7Iu1<2X6rq}M?pvaP;g(oZ5~g5fxE!K8PQ z_|gTF{PQs7(IGmt&YJtqt~Wcz%wNw)=T z?`SjGq(#gIy!t|0>`TV40iJAiE}B$82-6KmtBWT63=O`$Xwo_S7ItfLHvNx|AIUi{W5;Q=yyYcdq`Ss^q6FbgAoS` zUK_U<<5Bmc1TS?kSwL;;$H6AXo-LGF+Sra{T$s9O(mVJ8V>e4y+Go}Xr>Nf|SrMz> z6+fW<03?C>qwxdkPeoeT?X0BL>d!|Cm~AB#VSR53gXkOW)V`sMwT;W ziX87RHR(ecyM&ecGo34q*|%e<|5GY-m2D-z;5-co=@m3)IWXZ}_mu{A z-8VlK9zSp@N=$dQaW}~D&=!V|J*5QYY)e}ibsH%34B*@o<29 zmERd#tD4dS+NxrUZ3a(On^uF%Bpx;CSs`rKgmfn08|yC%VT<7i9yO_Lm{3m$TMgYS zd?fHT-7EC2CcVN?P64+}5svK!Up5}c1k_L~Asjc@6^Bd3JfU4;lYrI46?X{t34^Qg z@O|WSLO!X<*Y6|$o1Yxx3OfP&TM3u;x0Bl6rlAz@w*~kCe_I7p!r#idBK>U>3Zst* zR*@`D8~ok=ouJrocJMhN{H+P+nSk=YE`$qO<;HnBMUGP*bW9$Ktv7oc+A*(b$Gpal zX{#O{j9ufGy-NWRcEfAzh83!Z-0&Lv303jvd$~6>nCPc}3=F-Jsw+Lf`a)Fw$Iv6J zB#f{khgVNmN5i{sGFivzN_RVC)$IopA5wgdh!PB3SxLYfJ1;}K&_po-!>c#Kx-lrb z5&E}1&BdeVBrrCtj!~t{*@m9L{fuV+mjVrGgPChFSc4Z>gBPH|7m*sgfQ;LQHDFLQ z(7zKi=tT@+J3)9B9vt`&g!ci+y1a^!>{OWT`bCpGE`w0w7ac_}nKZw;B1h>* zD8Aw)llI}q6PHXn`aiVim)dEgIZ|om8?y2Zq5K6X?;~o6fhyI&)^`TIkL9tV0DKwr z0kn;;p~(KVw%tcSJW~U+1sFjzVMiue0MMne67EKvJ z--6Hkv?6=Q6a)KZT@6$dJ%ehR1C%o*#ZLpddBy?DRkBHx{z`+p1RSA*`6J8+vm6n^ zNQ3QC?is0+I?qU@+{ka2hDfOw*#4EIV+>xh{0J1=vzJVYaqHR|V>s}+6c@6}xMWfZ zx2~lt7DvxZCV7xR_Y~zM#c17Av;&2cR1v~hgOhY-0`#sfgf3d|evpA`Z0HX8kZ9RV z7`qx;xi19nZ8*NTWYPj8gmQsA3pENykNjijM5dCOMu}5VeG$B>+4Eta(=P>vl{*%kzR|6U=i*nXff0DwNW*c@AxLEV1+4I#B75;v?)Z8b z=w4m~=5b)!QcwQOb-m{lRS8l*9W@d&sXzaE?>U4qdlj%|&~#4xF%s7TrY+6j#F>!i zqh*|AE`V0FoPk5&{S3S4mdnbcpWnqm6D&OZxefzi_*1Z^41Y@D z2ZlctYr-MmRHr1(6bn05brAlS<=(;fsT$H2v#Z3Nh1zlp*>W$|jBtX5Y`NEgim=>5 z*1BQMkP~QFEGK}Jb`i5StBG+ZTDyi*0ed2CsqsB)DzaaKJt$0gK?px;~isLC0$iX8)G8$A z0}<2J!eWB|O-u_P{bs(W3)4%B>BVBc4vXn!DG(hN(~re;3yJwu#Pri*`sWuD2)5Ez zqn&2o7%gP5MJi~p1r;;`6~t9QgSo9tV+1N}umwh33Yg}xU)|3)kq|*>f zm*_b93l*47Q#hxhFXA*gEwG^8-v!WuHgSrN0XQ==J?^$a+G6RxJC?FuRAhIdo%mdo z%jw&`h>>s`;9AfkPS}}IV>N0mqvim`-w*m;Y%#>5FX*ikc$g*PfcmDi2M(wwt}|(y z@Q$#M&Ard0JpzxjICA%y^al&UN%q4+m|)@SF{dQEt{9afqf0_xWFcFTD<=Ib@M4Rj z@)eU#zo^Jj^@>ReFDZ(D?utpZ@Z;4hCcXU<;vw>QEM2?kS}Dj=0}7?y0j?yi7M5<2mmxMv zIU=qkf%jM8?QZfV{x2XF?hN#Mixm zbhuh)L|__{HW{D2S(Ik{fvBd*!dOq5Y%B~NwHbi(I>)) zI=sJ*v_-0>W_w)KX|GvDn`N76B=~4Mn;~Y{D~b|Y&~`3W;qed??kc6B;DpvbbEDMo zZj%R>yE(!1R}_gAce54e!!FtZ_OR8~0g>gSeQcsvR1k z_E1*){XDfbA`^%}s|+8}P`(J$6^NYl3|BfZ=*p-5M^R#$kH)LON3pa9P?nD-D72yj zfVi1V;?#ftN9m^_)=9x9AWB{}X{*4K71=VbnzTCt#`7Ep1zw>X_&!hRSLNY~CtpPc zhJ7&A_rBlha<_20S~YU|gBi}uH`@A~o)r4s9ISMq*DFH`w4POZ{#87xL2Z8`mUh0X$bJS9%IBi( z3ekdUDYD16#5p2oW@e*0w3E@cT8a|0Q)#za852jP8KT{)uq}?BMT&+<5lE%IDlImS zUaN(ol5Ox+lYA|8oZF)u^RJrp0Z6tLS50asguTjf8ho`B*=}Dose4O<)(}w}Tdip( z4QOdl6(ag68Xi^gnn@!i-9F{0bIqjQoMD4&CQTB;0p)0S&7@%<KT5h`*8icA-|h1HQ$EnwYY*{9%rFd}7S?PUYqqi$-X%hZ9w3^= z%56jyY(W+H{O&fih>?E)c`Af#;=*_0R#=-n5lg2~eZlmMfJUxlcl&r8Sof0Cc? zzq?7MH;0ax z+bp_C+zgxMCTF$>#>n!~JuBknc|fd8N4|^^T^s9j?Od7e0QHPQlPLjArZ*52xIAF) zX!=Hh{z7dxwSkGfvJH#?Z&aZ8wMR-2BQAM5H|5oaW)`KlAGh=V(wf@#A3 z@LzMFKh421>f9L0U?XR631#=WTA=&c7zb-m9Yx9QGTfOdL>uEq*Nvr0b#RFbRU8O9 zgV_Q4F|KBOEIn5T^}GXk4p`gbK7A*aUah0}#nz*7@UME{v9;Q4l98#y(T{PCE}Kni zQAZJvq+&7+dV+|S*&M!ACbdQavUR&=QXxsPEzYs@nn|5QDdGh`CYDnS)hXav&kN;f z9DCL@P;6_jne>hjj>RRJ_~c|#0sOVyoov#_LYfkrgh>x2y)gxs(8*Tnx=Ah}9*;|E z%qi|oH7Qe&6JnE|o~C&*V#pTs$vF1j`E|s5e}NWxb(G?LcqP;Ea9?pLR7ID#iuRyF zq>3(a6`g=7VARecvxl9HTJm)UdqO(BVLC(P#B^TyeY z1bE&!I~*^j^6QEc1ak@Q@W&+ZZsCNN~TKPIweQ8VqOpfZmp{PnWjVi$L z($@UCNu$L8!wW>zg^nG6nNy{0D3t$L6^NrAGBA3Nr z-7SZv7HD%cmcEBb56#j9``k=}$Eb5y`M2K0vZ{~1W6 zR=lamhA;B25aTQ>;23n>q=RoNa*V!i()l+PB~5|jJLceTU98+Jy>8M5N$`CE$FA!p z6$K&B#j~8P+_>JT*Jn?gEsQbciKv1hM@=iB8?ICrhmrYaj7B8a4OzDWPJ`m0Mn(L1 z4w;8T9Cj->->QM^7D2z$6{IufK0`}**+_O0y^K^1kbMgQ#)h+In!d5MB~u@hc}0Uq z@<8mFpAqm?eTC?%fUjxrUVhM;rL(FNVT3A4VO0Z;s{F9YS#!83de2}@?->^g#L;4? z8a~Bxk592|$XDq6d0}U$Nw&*Hf17J1zn&J(ucrn1?LvMKPSleZ7!QSu-;>uUDY1n& zNCWuyUv>Fw5?$P&d?SRB?HCVd9{rE?~=6a2G| zN6(v-1%26Bx`y$1H|1;K|7$^>8^*cDvSlJL}ySdix2;4`OL@J*@E1F;;CO z0GHR9=?=Kuf!Dn`9{Q8D-kX3* z3j8Nlb#It-Lg3>T;@r*)+{d)xxZxcEtNr)lx-z{UcYROLOBc*lQd#Rv_SSVKy!8YM z-GT(V3EPDmdzGYs&*^F64mzs(upD}kBej!=n(!)5lNtr%D5gI84WcG^yR~F}ap$Ip zF^Pa$c!NQ2mPWh^M8KEfalhmC&`02T3n*T#ppV}x7)R~vE3(IWaBl&8)Urq6I2r=v z3qX3@Idz;q%0kjDNa}ItG-1Zpn9U!luQ0>KDZ_U>20_)2^wTd*1We@-;Kv?4PV9>H zbS$(vh3w>2qgFy5fps`!mM!EIvb}o4q^|^Q$%~M^1e%A;a&DM3LJ;j83vZZotG?2U z{Zj?K6nrahn6yX`y$nawe@rU=mN2gO=r3}NR=fnB_!bum=l!-zir)IX-;1E|vfq9o z^f9=6e@Owje9-u!&_831Zwka3yZ$lB;?>5|fxR3`Lj;c3JdLyK0 zqTpwktmp?&Ctu6U^B=E|E}1hd2D{HNy`479fCIVTQV0mu$QWk8he$674>vH#^}Gd# za%N--ob#5VDp>Bp_wPqA3%Xi;v_67ZuciI@FlmE@ zN2L9&rTuo(q)|dyVmK_fOuF`#B8UB!N%v5t&#gCUnlN-Q9l`Y`MZc}c@y&XZ3ct-x zSn`%h^Mz%J;dt(rNsof%wOb}t1PgoHGU3=_u)D1jFzjwW3*t9T-xuj`4Q`oqQs_H1 z{epm)88H2>Aogi`luvsv)8Vg$1aZhng1_qKS4xmG%p`0qAx`vMZ&C$8pEZ(JuE%tO zn`V+=&lyQg|KSgo?lb9WpKceURX7KH@w*3P#-MdbaAHUl_-_0MS)*jG;qmKhsD~C+cTD zS3Hh-hGq0K5!Wa&JxKle=O7pahs;Y$nfjZd55*%sRS@hTljGCq{MumnT=f~cW*Wwr z3PiNSVnnJMXcuVU&T0~L1|2-Ux^7Mt#=%wt4-^l!;)cSMw{b{=XfUs=&VgsQac0sG zUO8O_i4nzjc|C!QK+x?8)^j_3$UESu>U6cv&hWeGhPhM(^oZg^Cq1GL7LTJX;o|p* z!Z)8NG0p9v!BJ>AN6>Prz~Vk1meSH==`>K!0Tpn!re4f;8EOy*hSysggu?cU3IzrX z6dDS4V3cFaB$Hy^k*Co=Xst&Sve8uJ9S)c9@=qnj;HZ4=^Uwmyw^QjKvzrt!R~Ims z3t0LcMfOx^?DNsoC=?SBvAN$tJzc`Q)n=Uv{`ET-jOKnb`5VY0ed8XGC*#&xmetESBDX2i5J(A(|0A z@|jrr9B`To?{PLt$Mr;-!Jmgudj~64PJgS{0;usizHFMq349^K>+X~cmow;20qr}c zeG{U+i8*M7*W=6taV``4goyQ1GTlJWWArGXagshy&}t^k2oY+hfqM-j7s4p`R_iD+ z*5YVlc%r~d1fDMNQi10RyiDLF0ZgF%0Qe&XX(wHhe0?`>^RB0jRAuOW47fLZS05b`8v+aHX@{01d@TePGr zjGKha0zRjQuJ90V4q$JKmK-mIXBlu#zuV)a4ifJMa{BYY5c<7cV+k zTE@rHe&DkBLy0$yQd?r_IJ6?$vnx$%mkH1AHtBpG0iUuv1~r=Q zHt8IG;8S-0;0HcsXTGcScR&lii#g8%li~teL-~~5qwjM3#J7Kn2ehfXTKL;Pm6#It z^D0R`Z)WD}?tlxE)E1c;f%N*GR4?5%KQhKtB%+aU+!Xvj>ybEm>Rrt0!7z#^3^f6_ zrD+Vj4P`LhD;qEfX{Q)^U{Xn7jL{L&pAdM4oZP7)@N|80=c9M!J;2DGm8MAvz&YpZt^p|#KB%T_@^i19R!J^yR1`2yCw8v{+;t!W{{Bi~hIe>s5T zpg=BXlN!m-SVh!h@o5XP_T_PG5SuKKve|1XxS zVY&l`!J?d!@OML>mP;4-4ge%(@8n zPd)YREqP(;d%v6T#TrLdepRT08gFQ;&#>^Vrx})`CE{om%nW~-VS&H=3d5$R!0z)n zP#lDhU?4C^#Lm{IG{1%bQ^ShlX?Wm&~X3@qtZyL!#Z{uta z(RuUd!Ld}Z5e`PB0E9tG0?hKJxPf@5S}c`s6dKo_XP6TGX>`%Vrh%i8qQsmK^g<&= zRZ`rUK_^|%oVH@OP1+~QUN#+1-8QLyBSrD)w@qr?NKvK0ZOpyUB>xt+J&J6jPMdU1 z;6IgP|7nv_8YxQp^R)IIWP4BO*L1etP_}LJXIn6+TY4zl5&}!My&|)Xo@!D#q5oq# zDo!4qkhHcWy{(hZ3ng71O8QRz zr0Y3po(oHb@#==ln}s*6I;limYXcRwC5Z+q*!>sOQ5t&dfqcegSGbA>>a$3Rej3ET z4ng*}w@qpy$_-aZ6WQh%Jbo<5*;W|=Kd4QbS36K=m7+BnBbtn1O-@1+Y!kS7gPq3k zIhqTQIwRL4rwACU9IJCp`UfWYDc2<9JyRds$qYj!9nvk8n9o@cprB zS^SPkGX&8|IcnT7sS65kd+Clz3xv>BIox+l>dyqv9g|k%5k}rIX%rJC-7#r{5PB=e zx;rN2f}k7X7NN{hjvc2>n)jZfB(%s-bL7^#OPJ|I1yiCg zg*Nfe_{NIt7lQ^RX1TLywG~UsHGqrCHn2~zhR>|L1k7W=_)=&sCv4Cd4y&W{Q`tJC z%(wDd@^jgtzD+)Y_=?bfwsM$%UFe9;w!VLu^tRA{uxw8fF?}8WGVWMxxvA_jsuUrVN>l6;*M!p$fJa@x3McU6X>@ z27$4pe9y{L8qtIab{@=}$0hzH8E5{P^vzNzqL( z(*6CeNqvMf!BOp=NfnwXihuc@NzZ^GuLeb7ug~qF9%`te6|Qb1r=}29hq`r}NLN%H z_136Ks2-U}i9sJd(`7*{ebhvks)jBVG#D=$JjWWe2x*WB4cPZ)2*WcED&)%a2HezB zwa^N^pcQ%n3bhHVz#!Z5#XPC=B-58z>bD`OJs|aga@Y3bV_3ZuPSTKIkL9(R+B z_HKF$VTS-x{U%Su64}3p_j%|Y5C$SUK1;DtTzOB0^qPfYJcXY{J|9Ir#k(eru=7flJ3`?|5>FvoAacXwZ-8PWvcKfK0T3{Gs z8W2(K&`YPa*M1mFtKL_X+{T$nR2!>QKLYdwh-#xcwxQI)05wP~6-Q*tx@XeYZ45## z4IRVonY0h`^Xix7S}w0D%`_8hlf>DQfB_@(a65 zM0V2G_ETT!LVRu{@CI*lWEo@mKt*VQuR}KappG}&6QurXr)c3e^et64%H`DYq9 z_*4xU2ZF6=mVqGtDnJx-DZ5i6i1G&9L0W8FZ-CG@;hssO#kNa~q#y2~cVX-#!LBvP zw(p)vvjqMjvZlidiJ=Cn)>^BjhLl?irUdA;jCG1h`9M)Z7H-Ev8l-ZqI^T0R!QfAG5uIcHZ$D6!?DVI#0phhsKA1&d4J46k(XghDVNd0Z*bOfXQ!ba=glwEf_15*LCp*<{cIRF@CkLAy2V(FKr zimG_Bv*6l4TY5~vLCkQ?dIQ`+4^>ZTc}F8x)-kl!FJ;m&byFJB8H<5K3TG@hBDDwQ z{sw!eXIM1rcaBvm+AOkBX0e#z>J=@fj~TImA8-c)8EG^kXByyx!Xwp(TI_Y5^L5Vo1by26$2XZ9TPh-@HXr0wPWhAG! zC%VV8gD%amn(d>1Ipa})5O?NTxuJ29-EDj{+uF2r98r~EMwZ*3kwUYWPWBt{(-5)? zBYz6z(SyM=(9Je#tx2{VgZqNcR$HItCKb-nyOYx~(7ZXtq>@7KYOPc=7xU=axh7Q* zu7yTY8z4!a$$vt4r&}F`=9?7tq0-028|3I?>vA~1$cJ(q{jm=fRocWiRCLGmg=8?p z$~{x!hiKa9vDyk@x+c_M0@Uj*gmsbXjeJ18JiqW~dm6d@x+);k)MNY%1{k~S_0DJ6;1vI2#&8EqKB1r0Qyp z<&hjI?o_v*M;4RSHbXNUwHV2WfJZGjja~3#h3P#Vv%rd#0Hx3=OK$U6O8)o(ZT$E$ zO(5tDx@n3!AQ|4Y7|9w(H#uxSpD!Wn;PQIfxcx!ORliHBJEoDGQjO@230buum~T$r zHQ)Fmmfi)-M_M{6(3=BJp)L$~KgJddoF}C^^yg!#wI-Ep zt3%WG%29NkNxy*Mv2`XLgc1=h%q55Q`6Mn)RiEe@n4pa06ru^N`3aOP%|{b?h3P!9 z2)nVzox^$1GFH18-rD0* z#tn*(w14;sjIn09Nlyr2qjKzDZjzG;SQoA#gr8Kz0{07TLyG|61@83=O{yilyY(%% zmY>L(_3oS-mU5d2$5zFQ1y0Eaiv@Y5_IZ7;!*6N2T4U9vJ}S#_N7+b&P`DI2#^oLZ zAj?M=xrh1=kk3b#xZLYLQDkoknf$2*y2>ebg9rEC1XiEo%`b4J&<*BD_*9`M!6ks+ zz!T9$ZLw;gu*HT6;gYu4i%ftO#tWghl~3-!@u{NtqYF*?kU3z}mBP`{8e!9oVvC4t z&#>55;q9WAR}KnSev7e__}#&5zlUb1cG_lxtVW`b23rR5hg%0Rey26)wusdwA%XZ=dsiQx&Dn@+t5xc28T0| zjs2EJ?Y2HrF^>KMDl+H1Y-gzz5|{tb+5W-VR{AV5?o>%?w1PA_ z8Z``4R3~F{G%A>b{FG<}`8m)#5#o6>cwscAq^nW14Eljb7+ax({b{hI(3WTf;QdHc z3z$?7?c)58gNtlG7>XK$Ktw-8JI)%4ZZIVr#`2fpO}{hCO>4q80yFRz4jyJ`f!u1%S`6^dwFCHAjPB=IQ75T;IGD#U6(_&&QeFLzK)9)i1 z90NC81|#t_X>g3L+td^q!ld=kox?%xj9}p1)KshrjE%t*V_!Z}qoAM0#gwlUOMe0% z$n=KUCo}uq&lTCO8j3tpt|2k;PgxYjG*=Y=qD4^={CLx%sC0AmB8@GIdI{^;7>CcI zC>|W`EQ*rxqmxC^^Z3!c~VNb?hjmz7{?WYB5 zj`;7K80nGc#60^X-Y`t_(RVRuXzQD!6Q;RbslPN=RK?}=;Jy|zIIOGgA$g1QE>w3V z=pKn-=RL-m#vE(T&U>D7EqoSG<%oQb#IO_JhHQ`5)69=Au=%-F1n5KzRzBjsV1GUu zqy0Imy+MhobSehdxGR5w69w6HDhBtsYk#509uImTl}^Xt9(ThpxNo%lX3|R_5Ye$1 zN8)cLee{K*q-wwMQWF|PZ6W^^qi=n`E%2!rzV+P#8S$;}_l0mehHriQzmQwsE!s!k z`fk-;Pal4Y#*TWpN`mQrZ;qI3kxJ9e=_i|!5TMOAbOJG*ASleA>I^zFX|b9l)wkcq zhrISP?^KlDM+a5xM0~usZ+nC45mDFh z$BQGXm}QHuOO#*h`iBiKR2*iJF(p+ zaLxmrO1J;9P@Raz#Oec#(*#}~8`{1NmxS%gjzG&*P@A<+oRJ(P>J!)PomiUbRD4Uj zZyb~-Xx@*1E@b&W>d$v0SHeIK$yKWCdo@#>W_TR8$Z?!1=2s_Lq>ILJmW2-j4EO{r z^*0JM(xPad6kt-^{Vu^H6I!7rO7`>OjO45U=B4xEVEa3w{(Kg|>M!7*))sm|vXB)i z*aAlqye_{pkWP!@U|(X%OGWZ;50@;(TdCHF{H1Y50?S{<;$up-P?S(Pl=IR!M3};f zK&JWV7nWV>d4N6_{lbcsuM02$DlA^585C`i-J(UNn|_Sj(=V3NS}0wwt3|mraSzlh z57pQ>&9i8g`dd2lQ*jb;Pw6ru;+|$L{Gm)YN~U*1nexDUt6=ZNMGU<6N{h`Kc;~r5 ziZ>*EwaSgwjy2A%+laoo+PQ@c7{}RB&_Mt(VAS9wfKqH4XGgggvwWF>L@Dt8-KN`zM!AVqXQ=fGu<94kLXVJBPb?TDlpKR zU`G)AyM-dM&9NxD2qF@lnTlHBMQlu8(7eyi6F+=&T+OWmSc<0>_WSaY=JL9pZQe9C?Nbq2E3it~Qc@>bS@CP1W zhKDwA7Xp==@<^m9RK5)TvV8Orlrh|j>}9^f@n|1?3}xcna3HL;B#6w9SeHi_4{vx% z@GV%Ea&GZF2N)uC@rm)WS(l9p52`>HFYDs%9f+l8ApT{D&!7OJWu5$)=q&2GgP0%v zsO}iL0=_oz`sde`D#y`B?vSf|4RceXo4)zra4fZO<7>Bg#Pi#em13zC1icMGt?=}2 zXXC5*SPDXzt(29hnG~tB;dtIk^feRaZ8Yg~A#^hwTQ{224Tasa(WL%vMYhVzO-lXB z;2W}|q8%?TH)$joYA-iw5`HvYZqh7px)+$_`%0fdUTt-Jy}+bJkP#WK0`4HYTMGT8 zW?FSYXBb8@T#07zrtT^?T1|!rFgmMW!-b#0Foq&d56$Gm>IY$gEFUc~P|>#mg^#X( z&kOGMRCp@a5~ioL+9;hEM&vTWRp!nAON*&m@z6`$~5*ayMqHPEpEK^t+^3Z8%;w75xE< z?G01WaUrZV92usfyG-z#if#yDo#7Z}DtatUkz<^x=%qA8wyv{HvVN`G=VFUv+-#GY zf?@h>lbmT7%iE@zii!!#4~F9xQ_)vo*=Z{3o~9`NcT>?I{5WMQ8jBxSO-0j@{nxup zsw`>8S{x&HnY0jTC+;$7HGa(4WzuH+SiH-mT}Xn{`7eB}-D*V%KAnFU3{S2!=?oZf zI=`+k$m#rRtSOOADMgJ$-bRCLPbozo3B27%`dFbB-AYjlL3Xet^#U?!2>!-T#@}=< z_B^Gim2mxJBpm^TleQCNmj{!^>7>x2yKwC?$aYpK8X)j)(Q2H)$0D_wEy#yxRYGSC zt-cqoKO(i-B*=$oRY51kh-Qy)oi=zZbNFlRW?1UwFnCJnXAF*mPo_&8e1)?Jj~2qs znnxiuXp^d~+x9-gNC-E`{oEj9>ZN18i8j2S+i>CcfT%2uZl8gXeyNYsu~eMOYe_m? z21NcBiPdQ{&afiz{v0Xs7cJ2b0W9$sE%D2U+%->^e7RRi$^tv?4yF3tfpm^pI)41D z=2~>wR$vc`Xocm%yRp<4Ir?a&1<_>~0R7FD^?c}Ie7Yk0^{)-WW&4QCwln*5$mYhZ zzR@jjrNx29yn+d3tcnT?VZFuis#Vd3bVaro7n$^!;3r!gjTf1;C0$X{$BVEWqQ9dR zFZA^m{<_aT(DC&t(lO#GA#b;Ej5x~j5F=^|;WrD%h%@ODBd$O&V#I60ATc5;LlMV_ zA{pFRkjJ~ivPCJrw&d;x&8Eu+9-8! z0CfOYq61tFH8T_?i`&ovwtd|UY-GD#^t*+s#8ER1rqV&nj-9dO%TQ!Hu*RfR(dVGW z5xv%=ZYWUEwRmq*QGC)`yfmpOzRp^c)}n|uY^nq#%^#MC(R}-FbQ_8o&7-At6y75i zZfQM*i(A?kXH6O?^ph6H*Jn-I3~61@nzRo;hMhI(PyCp0)}-@Lx!NR?rhKEL;+jHy zi|8ingaN zrJlyO#7fuDuqj*qRt2wyV<+Jwezh!!ql>dzDm>5R_4(W>l!KAb8DN}&b{XyVqgF^;Bop@op9Cs{zQnM! zbfzMECm;g!74muphyy@qp*3hH53}CLj1XIccJbAy4}tW!-6^j@LE6n@Cl7LXqyyrf zH-}CdP^A+DBLHFkR-=PKFia~xe*Z#;h*=xRwS@c?KMvM6Q)YLcNAls^{#U}cL2jFM z6&RiEsi`LQ6ZoV-wt7}Y69qnPI6k*3nv9I`l-k@51|<{GKNiQ+Q%qWtsVM(JV9srs zq`q!wc%8ui7-Tyz*QB2XzA5yb0^c#nmTpyaP~h%{qoY;P+Dt|9y{wA%Kn)c8jFfM6 zG?)7f@F?aL!Sk#ZjCTaFMl({D7|7Z&&yW!w>30XRv)pxQtJ+~|hwO|d&u1&BvjuKg zJWG+iU`O6y?8Ofz^v*(agtUqsb!GLkur`heAzZF%LhobY;tYW{NcV~`u8!t(ZweSL z#k+!#QcOoW6!$~HgE68M?2O{xHE5f9UKeGRg-((#!9G~kXK6d141bS^ z{;(K{K`$2Nk65q-_G^Cj0Q+zgXR5mqX1%mSL( zud{76vCh`qqx5ndCQ-Yh^Docsibm5WyAxHKnnLUORq7u+sM8TvMM0^vfu>`=RnbuF*V|Q8;XB#*D#^;V+C!%_~`s*Qpzv@$znBoou>D}b6vGf5zpN|@0 zfg#hUh>vX8I~jz8jU4-zo7C9{6)|)uCirF%BZtzRbT<;w`IwVUsvxW%*>I=PAx!!E z8mQXX9SGua-JJ@b+<{QP*47Vg`-pluP;Wv=z3P&84y(5q>g6??h)j80U!8WTCk@WI zy^-Ma(U-_8W;IfU+gg<*Bx~gMH7BW% zWWxqtPXTN4{#|lwrF9!D=*a!MQDFs>@MZ-63)_=-;4;0gRbMUi>-a z3kyz^eBX-jr|FV!o&hNes_nzMJyz>2B!`d9mE@6XEs^A1^VAA!m6qer2)b#%!f|p~ z?IX6@N3dFx)`}86lmYv6#P2j8eGV5K4QYQ^6|E9!ZpRg?qFlCNIBPC&z()t*Ysfk) z;-EDXJ(=`-h}immVhgV~lMbqe+Em#_avP#-#M_+^lV3_|rq>yK?io6S)722w!C?Ll zM*U}F>0oQQP0`W#>{*=DZhgX_A4T;}M$(`Y29aaT34>0w#=Zr>r0@9ea{P^GNvt+Y zd%6bwq1;-z9$H!t3m39Pot>=cU2&5i%9DgDecDpmo%3bPwuy^UZW-*Rsk(= zfMMXeVbQI^| zVb`&`q+|K2QGy@a{WO`+rdADQGs)m{{kA(+MZ2WflZ~XxQHsb>HA>O*el)fG6$l~6 z)I38MZ<>}ejfa`FASIjTu*i1-WY7W@=?aOQA0hI05xF2zWY$AOrn}pEeZc_zsm4mc zSZUys9Injl6nC|@L@RmZ+s2Qx${C)NjI@kk09Z7K4#2hngiC0>v{q}FG&ZEwY9oy= zI7B@krRcbN*%;$!5T$4~bje@(*4f^mJB3cDWmau~UHV(Iy9^8q7W)<1k0Dn1X)m8H z-i9n}O`{aukkcj=qEJ-dC`Bi^nA4&Z*#e4eDEae}{+7YTFB*8T_Tgg~^ZbR>a5KF7A%%LI3#;&XG{mFBlAy( zEPFekT(pdjRBvQdpUwtVX-mIYW_=ioS=)?hCJpVZrx(i&+lFZ-_C zBlJvsp3bQ%ns_FXnCkVr+-a_Kcc#znr}L_-MKhhZ7(6?DO!T}f-=vBc_;TbrM^YEv z67z-zd>^K|@LsX-?TwmU^r7?V1`%I4c~$7wEfM!&>Iv6E!{Ny_scleEQX9D#vw6Kq z?@6K?mZbA|9x&-P|1IzXFH=Ur))!Q1V@#fL(!2pzx;v$QYVGVmJG!Wz(Ip&i@(gbT z&%HVY71M8MSFrOApIWQ*-IlegYf>Ej4bkCN9^$S+S3~T$HixS)8<_pt{p@~sYNp#2 zWD(a?vaY;MDq@t2JiUH5-wRBuM%OVCh8|m$k(frixJvKcpKU}64p-IbhPr6z+;=M@ zA&vHM!kFkbk;k0#$>P&Jne>mUpwk^yhV5>Yq9?>|$0Ab(ax#Lh^!L4Wa4<~YMY+kB zx}fSmVzPhK=(@2~vW>!P5pVA`6Mk&a)K3Y*7$>yHo7dGFLbbKWT+P^3C4py?&iBa^S zz+J4w^e+VN8u>DWGcz;InUX@c_*6WKG|#H%+Vl7uDQ`ecEPZ82>iJe)$@>I&bV)wJ zV`+;WHAfJOtq~KrZ^Q*7qIB2UCUq6wWmcI}3cNz!*BB$I@;h#-*Z+pom0p)_^TQC( z`FE@K+~2M6+}3Rr*>k(?1je5c{Fu*%y-CsS9h6BuWd(wjGbc&x5nFf`Afyxw5ki>0`G}(?EcB5^_=kWttRyl!jY(?_qSruVry&q(+9xS)MUn04 zSVcz#z8z(&8>{GQH-i=uQR(>4Vih%OrzqYRtEe3^hI2%B*Yxu28@)MSvbBp<^hkH@ zdPAZeLt_;ULyGaSisA)7GKLtgF7PN^#YNxzsvw3(M})k3-5=gnl5hSf0dQcI>aBMjYN&x z%5J#^McQ}Iq-@D^YqUOP_|<)I=R7!X43O2>9dP^Gxa+@89jr}s``8~XQDQ&4Y$P|{ zCG&c?J$1DHV%7X7qxD_;lhGKWZEA-v_NNe?b;}lf`iMzKILg*U9CkkF=0y>rrLg*I5Rk}rV zMU}EA?h$&Q81}@5Py(KKTJRxHydf|=F|VGgBxO0O20Tt*Al(~$Ei=mf_@ZGB; zFe}C|cER%)2IKZ(f;b+-^P>wWo^AAElgbO>Y>aKmVv~}381xDetwNaFvDl>QLO&Pd zIJelOe>mZd#U{NdgbOi_B1=qqFyk_KQo28T5+xvW44Yq!@i&g4-zKZu%wvF z%HlPMHIh{)Tg2r2$2_B8a-KIcM~W?yVrpcHJ>e8QonQ5(3Ma~QR+lr7>i1?fuN!bV zJ=j3b4p28M-o%2EYi!ze*Vy2?KYfW~B$+9AJBHTSaI#WM4#F+oU$ei~v-5Ih*Q%&LOlx|d4oM9i;u>1= zRYVOP;u=~5RH%kDYTH+#xOa%FhwNYUH1H19Nd^zY%3NJOQRk$tu2Z4v`iD7wic^#$ z9H(p?I6C&!)m4t;M$Fe}q4|6*OSe_SHR9I4wup5WmorfJ zeQz_oQtC;2)9Y`NEyuZfTff#mcr#Xqxtpxa>)&V}B)Z9(Gyv>(I|E)1P^v*JHT_1B z?bjV9MfEoLddjU>$ITrkHHU(>@^(eVgm5?3@seFp`ZtOkuiF*1#*c<}MeV_wuP}Ar z_sU_ICN8Ik`dE8O8}AaQ)$0-mTXlvy{JK*Y{`O@b!2J4?hKE8ow9V3@LXS9Zo0WP; zw#{)Yp1roJ@b!$#e?%(M&~@MRd$UA4cMA2jjuqX8iEhJKw`tIYbsNUI%>&H3X?XcJ zp~y2#-@dcg>}^o!Zr`}LJ^f;7Jv3v*UKPbg|2M?~L9g%qbaylETKie?EEsD4PMi_0 zuRC#5-if7O!gBA#;S-5G%)ZAeAAq?&wJUm4r2QM`Xm3|^oYi=IlSv;6;ci^gbDJ=0 z%(G0S0^)@It*>gQ>R>k##A`a*p+w9TWEr+PXT~S0j6enG6Lz8%a~t);S}#@WVvZ7BM)n&*XPUdq}6Hk!TTW1 zXVMvvWb|&w=-u8yQDO^c3N0vrZOViWdg7Nin78*tEAjcLOM#K;vGh#`MfNd3d0SCe zz8BWB1G-xKOdx$e>c@OTfV3|Y+!Dsk1&+t^KZ-ri+IcL$v-f>t`2#}#+sQmH z@<)Ym-tNFyerE?6%l|DoKz)(^C0x^4tax6cG#FcTC5D}uR)5Q)|Tj_L+d}0 zH!REbdFZM_72&;U*VBsU1io!|RKf;UM@11s=~w%NbP8{8b+#+2CyBZj(0y@JfpLQm zU21cI2N%!_6X^mEFTk_dHliBOV!{8d&~porZN6Pm4}qr@aBQ(FvUNnG#p87Yg|Myw zZ`O?x^`;w+CCg1J1wL(($-?+!fut>y@QNL76wMa75i@-($}AS%p9(P7>M$3PZI4~i zPeLCTd52JYu|(8xOB!mO8=A@%Fp|*}=m>jqd`CryRYwXSR@Ltq3ILkQ6V^WqAaHf; zh?PUX*A<|%1+YLkkP+4CB0J?6Kzxjon@RtIXlN%G$&=in1<_0{c6^{+Z0}>>G^bUa@`Q9mZ2*$fs!--5c?j1hQ1K^?bp1s+?A$!-^>#3 z^|QE%Rij~6JYj^<%8vzkGyJE57~I|HgxgX9z0bC}ASTZ-ofX;R`WaLufCsR57JR=V zma6X0vN{d7hBg8(>MSpDmZgyXk$wi@@uhx+uu)f`GhF^YowBOY2y0#41CK8hF$BnR zx6KIBNNcVHfmMZ!Q83yD7d8vBJp&%PW-A3>P)gZGm=MkRUT5F@ev_?vqp!)*tbY!(0PNd%jRa zNNn2gfp&Cns!7d-w`<|ZZ>FRRwnt$O8vQEC$e8I^L^6k9*@DXC{rZ&Xdy! z2MZg#34XBfzsF)}sJOwQ!f=BrfP6msqc8?7i{TVk*(qw!DMtMW)7kGbj;=9k2cx3; z8OyTR>57fqNCv zMjj&Yh$7mB#|k{H2>Z=c$uI0TbA>*m2v_DZp|d>1q;*1{S;Vn#p-GjyNaT4QrORvO z{%lY9BE*{>8f_gdQ@CYC@YdgQwqflqN-MQZGF?|B!XSG@^nKoTNO*tL3Z4)yD3~YS znVIQzWziUGS8<&~Mf6wH4zb|3yU4R;hl(IVeGCvgBZrD$EYPxxl9l>HMc`UIUO!O; z5wm?4MfP)W1dluC9rXO?nWZ=I_5lccez!Y|E--dBuvLJ?6aI9m2$mX_0r?h?SW}`a z%(~cSZc(nM)1i90%DG{6sGV?J zDw5<|g_$PzaNPxarwG}8E}&>Y80LDC60ROaq2ALA6S(AXOU?4 zu2HuWFjG!Gw(Nbf& z>Ym~6qNul$fcU)8-%L#c9Pm-cV(8SK1*AuOgNk9qSF5W+ua}nP478#XMX&So^f>FW zN{Y0Jl;Jt2R(q?S1k%v?u2pJn`Tsk}>h9Fi3l^ zOgwDeF$UF9G)Z#UQ9Povd3w+TQ53!J%fh>}I7hQLgbUG(2bT?neyBLv#uZf5OyD!c z9g7PpDvB4I@vPGqfS2hN&653IG*?i>3DM77TK_Hmxo&xO|ov4 zzI5p$MzSX()7#3~j%ev4h=3Klhx)FikHFn1F~j5X)AvlQ-d&OX%R%^#XJ!hmd<0>z z0W4#yd(@;+qRh%i^ixz51^zLlGaq!DF4)bFkPV-Mn=A0Ik2vu0sixh-pM$ggRZ!7V zA#Zy`!)paz{YXTENplCKEl;*K)v^8PBSzIM9~nn=DXMZ9H;!^Kw0fH*r$58$SqdrI zF4*IbILZ`K)Ew$mDugzUYS=5(J>fKuZ#C%;!R~#8KMi$rMWOi2;#ri5lJS0B+k z`&U`J*4-5)W^r$RjS=6X+7VMuNY2+E;h53`IkTF73*m-Vb6|couLw22nzsZiYK}){ z5o&teIa!oz?Qd!W&M2YB$}>t}gfqQ6uAKUaW|Y7ncRoN2cxIHqfM*>Sz(-3;z-4}h zml%WfiN56}5T^cwEFSDWF<3XpMJ0G_a*hd@VLvN`r6qWVeVqvy?7k|5jU^(QTfM;# zG&k7mJ>mVi1ludB2PzKj@M9rtE5Ys1CCRxRVziSf^qnPmv{Q}~g3w+Fdo>{mguF-% zn^mW&)?3n`4wTUKdVme_Y!5~D9xy~OKnF{7c_ogTAU)qw7$F%SDZ%~7=OE-|%=7N| z-C4d&XV9%boIum8_`(z>;WtWfhj5Rjr1enRwBsemd)l<^kRz92wh%g$eqs$rGOcgt>@p@69)_!5Q)3QGoe%2NIX+ob+($Q+ZNoUw1 z;V~+9FtTWdb&w26=9T32miZ;ojIN=op_5PYSQV*%j!25oAFlt6@UGGNbQLbv2ea!w zLSI`l9U6KRNk4%6KHw)o>qz$)=bs}ttD6m&}@96fi zt*5l0!<<|7LW)iaM~71JbqXmu!vvWBnh++JN-8-StKhgpaZkkL-AJ=FETkxUsCM&N zr5x@;ic~K}@t#78D&t4{LW-*6N4G+XUhakRA^%4t&A`a~A0HZOAfcCiH$7 zmhye1vm$SMDGgtZfYXTRZWvCQOhlA42Y>bFnWKhjzuQqNatW`HV0V{_2+*a5Y0rvi zAW*-8@a`$a>L(4$Gly+?Aw^FM{d%eRV}%qI=&dOJav?>fdMo{H{x^pilt4s>qc!}I zz(=ATk8Coj2I`5pqFP8+e@Q`G34FekP8p1V(LlZy_(CaedflV|9REP?FZ6#jeZ>9r zi9$c6=`$ng*a285^nImt-?LKSLz;hM1b?1yBg`Y>VL@V!^^8pP7Cg$qe&M4C_OJBT zTe~>pw)Rm>e&6q{$i8(LRvUfv{iA3C&0!Y~_ zNBLZ3J1}B7=epo=n#;Cri%Dv@_KF`Kb)4Q}QWqA5hhz%m5%7>qe^e%pCr(CII9XOg z802KxQs5z?oZwjm7^?_EPL}-=VyrHBFy^zG)6b6*z--@zmjt&ys!yD3WxE}Q-LibN z?NRg;rvUkUw2#eo2Lj%kZ_K8l;=qb{Xk>5l-Vx2IX9v1OV8NH0vxD~*MT zU>`;K5B>78L|0L8UTI#I7(85uRbH0B8Qn2LpI_R6Gr9v%AH0^3D};rmc`ac!jE%K~ zg_1+Q{jqgoa@iN$1PiypdKKvr@-|5%%LzLnCBi_d8J?8J*&dIxMW&nPTYDwwfzPVa zM%6SQ8LQYzR5j8>#ws=uRSo*vHFLIdHwt55vDIv`KVT!DkA5zVrhEYqwyXD+#(1V+ zU-*(YGxGyaFe6it&c2GO@bk)z-T3KR*WC*GTTn%=G1*27e5v z#%BYck&@~5HE;%6g^ArBOWhVrrTZyL#Hnz9erk87y87K;gZb<8|AHb8c!Tx-8?+x9 zuIG}!vz=%6Q)E{o3=;P`#P0PI_k{Kez^D1>G_&5|^1!C2*`}8MczodwT;DQi1W)$I^AQn^pl=!2`FUpb3+oVOt=(TymDV(*OyXJWecFeBs=uo{ zy$l-1XJFuc|LJ9T-{1Z-Skinni!*2sS-SCjR|buzAEc1|l5nkOuGQd*)M!0xv>9kF z^!hSzq+Nh>1UL-9hsZs$Kd46kw==3ZZL1>0gCKD2*V%D zFaf9&K&AQU2y?B{IUbQ5$!-}HuKatC!94r4A`am7SCPk*MbTphs?dRpnPp-4(m?op zw4^MQsWmWk{93NAEFx4%)ifo@}oGr_?l zq64FJ@A*q<4*Ew&MFf3p?wu0)&!u^DZ!sstHH8a8I8a&-Ja2?y&X-2(2q_yVw$XX{ z>hV$0(OU48(t6NeM&PTZBf5`DqaWx#{w<^^S$MCNwq@@ysg{8M)Qlgo!=%;FQTHni zg>t<#_bbgLJM=5IM++UJhtsEtZ0!W>QW}@ z9)#MK;S$McgGvz57J2&a$NS)I5pa(mOxl+R>uNeFxeh9$tLcKkgUj&T>>sh{2rM&T zm}-pC)jG6H#LO#pjIPFrnHLTK6%*cRW!MUjjfpq_6kSA7LVkKxp-;7v9zs7KrjsqP zh@x6yIO(GzY}|81R9~<&$|RM?w1;f2sU|fR?94KH9`c32s|3!7fK!Sn@(aACjH7E2 zMLkg^7!-Xe_=Pc{{Ro^o=pxufF?{M^6g=VSX}Yd3R_ZJCUXMjM`!KQ6eRG!a!rS{X zZlTl17-S_1t@!6^FM{dk3uB+h*xA3A?AX~cb^Jl-{U0N?_pbtvddz{1(Rs*;%eq?# zV;hrK{6#!$T2{yhA7js~EXmn3QT(Tbe&{hB8)^!CPK$d@_}N^j z@wbG2SzF;;$O=sapTEXG6|5Bg9+V3e9=`4t`jE10d(YVWd_5;Wy@Sx%*Zafa!gR;- zB8qH-6(z0HPL3O&gM>V^EZ_JnK3HyimK%&21BTqAg=2hKeGqesz_ZH|=P*a$Ic1Y7 zE`X;pc8OrW)A=Ta@_m-`MMGL69COR+0I^Bn#bvn~c8FQI8c@pzgub*ad+DD-XR{-} zzlFZ4taip*0{>i=ow5F4*(o;1X>So{{1^riZ-6t}g)H^q202t8qZga>h|mw|0e$>9 z-CczT^iK-?upZF+xV+dLd{ziY^?-f?^ud6>j^yx=&B6D^=_Y&M7ISk+A*1>25TVPQ zB{FVl*ZUnZ5Nz5AKELaID_AM&-}e`_htTgm#vS)C5gRV*c%gSF%X60-(1VLQT?n1Z z^4ukHh@44YB00#mdb1%9*;d~WE;FB`YzdyosmyPZhZH`02*+zU$PtlxRJY61<08TU z+VN$fpLk3g>$bqBwXr%tOBhRy4>?GrUlb6m7;7N(3i(BksV0>W`s%XrGpCv~2DxFC zp_1Tdy+XvNQHd^tYkdt47`;EAkugMTR3!?(9h8ZJ`5 z*9H6tFK1N&_hXp=ZhDTDnI3t+&lo0+X!zR8ig$uj-zd}D!hF$$ICq%1`nV_BJSQ&Qp zLc_$wB_`-f5);2V>>(zuG$CZ-e3q>tNyV~n4P(o~$7+eNS!LMAK7cUzSi=xLMoKn7Pa!PO2G|Kv2y4S7 zhlhl<+`Mw8rZ=xV7-%{ZcfzI#GN=AK?n7r&m-6C(7#JQbypvblXcC9yZ*P$Mi@E;apmacoiNHHbMsIN%vP^)?Hm}cDADiq;L?Gg zZg7TYQDeyyu@6SK%9eg2mYyA<$UY1h)|r_D@A?~Odm6gi2J6yoPUiyGjfwc?j3+yb z?v}OOh$XV8O~Tr84eInbrpFz?v*#P`b4-I`Bp0pGRP9Q;= zk0w73Gpq+kM#QSgWaiv50$ywXM|fv5?>%ra314%dCIzH|gmxE7>X>FsXh7+~9yo&IlL_wO)bmm9=40 zr|o1Ne{eX_*6x5w9fjWMak5?BV^S}Hhdl0x-D{F3qLRq_TUHR!R_z^^WZKcWgh&!MfaMt1|m^{pE<1=dL)7$ENPtWX&q?jZA6Q#vn_fBboJv# za=t}ITKzay8F!Dwitz)hjI{c3EHl!m&>5rE>}X^^HyJLRLTes}4?jK%OP@7p4O0_G zDY6%x0?+i(dPY?r1^3}9NSdPEWUVgA+oPlkJ_ZZNqZjfxu&L?-2Q~w<@B{Iv4SsYh zq^JX@!IY<#q*?cP#5A)06y1A9Od~O@YAn2)9_MlQC&I1G{FV&~7&T zUt;*(Y~_nEd_OSc&|Xe|69&?DA1$TYqwQ`PEp{(58m^BmznQ|Z_i^6xD-Djzg%rh) zmMy>eQ;d9De#-%jrdEc#bzO~=aVU*GtvMQnB0Ys0o_KH9^obRB~oi7yyO zUCP58GZ^Io%0oR^{34)uJkw2#v9+Az+o>jPVgkmeeTA^Q91qZk=j!1#k54fK9w+oY z<#=R&loMiro-2eu%JBgG%orJ?` z#`zS*CL9#2>ncX$H^j!+OZNy*jEVWBZUkL zCr=8sDr7QVcrWNo25}~69&?0nRX2}WC^}lf62VI=*uV)u*dPRH1&6|f--I9y>N*H| zDdUJxuIaixEh?gJxd~qu`ejYO9YN2ld!N(aD%*pDH_ctN!ulUw{lhEh(+Tz5JxMFQUE%fJ-r&ie0FP0huqdTGr70?m282>;= z^v(ZxSq;R<-l*twTsia5_Z8N4kEO52E3(%C%G-)oaAA7@r!#gGf)gM zp@I$Dm*b{K^gQSSa)myt0(Svxkd%9#B|=zSfqR|0rt0DETZVV$Xiw+-Ylx9!~{jQf<+bG5&Yl^Ny$agIB}9Z zc80;%dS_dbicHrXOUNQZsQ^{kGVcoEM{St~&=i*WOmfKAC%2jrGDyBvvUb8Nc4&vpBm6MU%W<%NmM@c5 zS*OeS%AMkjJJ}h#Ou(Uk+(-1`86Dcm9x-@=j*q)4AU;l>pr}e9$fwlyRKO{<(7BA= z>?w;t|6d--KGa>MYkxbXp0bzRB&`Hs;ChY`WIESTL{N0IOY{qG>8cpG5sNgzjW>F znkXZtzeQ{D+Y*x=vZQ${Tv@zoTn;>utHv=iwU0=xRhbm_-V!sl=bh2s`}8F7-b#Yc z=e;#%KGb__32#2{tuMTh-iz+3nJ}NNz}?dqGqszAyQd7HU#t)@y714`(J!KV`o5^5 zFNOC~1;@^!iv9!T(Q$MU{H~fju4({0T2x=bOULmk%)o@vLXeK5RhTeC2-0!12SFnB zQXyTgzyW%#sK`ABjx%l+`o0Q$oU!L5d7N(qw81IGy}}^J8D|3zCp#i|b}}%Y7K9vU zToGctEO;;~|A#P$GcN-k&it3)#q>XE5lC@SDB{%zLMd(v zUQ(Rr6#3k{9X>1CJd4&@r^}+vDe<0D>^;U5-IbiFh_0kCAU(=B&CXL{%KgrRo+M)U z!hMHjw)WoB+7s-vBRpZva+8V){Y*vfJL*kA}ljI=1Xku>u(ci<(c~BCGIjiL&ZroqGYV?Ek zDII2e$Lo06J09`!MX=|ES$td3?`=mL!jC@;7xv-IUME+N(MQB%jNTZK&qpKU;lnL* z71{rqZBSys<@D6?yHhfPv?LxYj{!)r9V)6w&Cwn^Cf@OAF-70x;!H^~Mg3ueFDIE) zXpUZO+#5{{mlXK7XvcSxOd5%t^yIRnPo9jyZGu}w{xrqLZ$GzkAxr&nU)l&`r0HFymm1ZpsPs$M4; zQVAaQC?KDYrc{DcR0R~|gR`qEp)J*&`hNvB1g;UH?37Aew`o%mxNt{dybxwoay(x^ zk&g*j1e_y;)s?t0u9y=M3K8)(2z^Z@Zj3!SAp+Y`Asny7jd8|Q32gTyhkSjM{X6Y7 zG6UN@^}ZQc>F=~yX^gudMW2bS@||}4pDXc@vbtn6-AG!poaaq^81qHp+FvONUqjCS zDP$g+))9`Al^h$^nsgZIV#Ds8aE6inQ2zSmM?;>WpRDqctF4tHZZAHB^=aA^V%_k6 zu-2f>)}JMOF0W)Hr1|K3c88cVut7M&JVZ)$`Z=6*p-#F;C%uv{X{4v(T0xU`fh@0w zezAV6+eohjgO_za5DWEAh!~uI`rQMAa}4xd!rLc-jo326h#Zky3%zeb#Ooeyg)3s9 zVoo;cTj3p$z+>%hA`xTlyz)mDqMp;kdpmgWmVUK{35I@lo@j6an#>)vp)?;2 zNkIFGpQgy(_dD!T_-JGT8rd_`&^)lDHBodJ7FqV`qDjQW1Z`}t@QzI2HddE2K~q^G zgmDSP@2ad8cw&O%^@55TO_S4dKMB5H6+S!p$+Ym@9pcl0+l4+Uf!IL%1)i=AbWGIx z?*?jtr6_jVXK9PIp|0ku2?n>@vy$7j1g@!T((>{(*MA?ZDXf#&=H_dqsVMn>siQm< zo}sPQ8{*;T6O4owKDv;A;27hbrU(vyf$OL6x5zH+@R1dsm)X;_Eu7h@1S28fqtiOG z9+KHfAl5x(sOk?(Fy)W(@6$O_eduzqj_C}d_AIjMa*`xGIt_% z#ZST`x`tsocOr$Squrqs`9KI~Dsw0D#B}LIT#|!~=-!;3Z$#I6Zm2g&id+c!RuV}k z@-C!AR^xq!twFoO7TQ?ZNT}@d(Zdsc0nzu+gH>*P?_7#Xc733 zG5m~&tGHBBh>Ds2UB&nP?drONjcB)ZhQzlSi3VPt_7TlUL^bA2SJ=R=MuvvTz7bXA zZAG&avF6+dncI&5=kw80PBRoZj(E4EC`%HP@?Kgs<~=mp$IR2MVp$^how+av`p!c0 zbUny}H{T(19sf&6isgwB@xQFF-xvQY3Gd28j{i@J4hV0yh6NQpEA-Wg{GQNHkd95> z{|J6;6&bGT$LQ(`dQPHF-bmo@bn@Rq$v+bOSRI8AO^=Aec;v2y(B~#T+=peh-^GB&3~Zr zU zKo~EC#PJ?@+|8pXhiGjSfXn4&czZj2*7x0s^0Sd;L00&=)Ntxo%_HFbYF)?wiL z3u!ctbBg(BrlN#A>El><;dEpa&d1}<@%g;JEcWoLE?#qUL8YOSWtYDSOT`;M-a9s7Ix4wWSnCl}bUD}H?fr(Pcx-Vf6G z)axeXhEuP5M=7d|Q?I1gmYx;9F6kbuEgc^vYfINqUaT$sXJW~D>1; z8ZCX#1d;O(eb2m!I+`X#NLYH6q>#R+Jwzn5Ppl#}4rKcx(O@`2JFH%^lQBKrNN6V0 z(-Dn2jE+U8>FH}e#iyDBq3j4POUJp?Pe;SIX+b*T*kAzOShgWr$NWD7tJ_|&$T{g3 zK6TL)km3pGS4Q3d(hm{K)0=$kqF2XokcrUJ^a_oV6HAeo8!C*_PHUzNQnscW8KDr- z)^s$x-D4E-m}M&$SLtftcD0dvg!kZ9y5#*%H{Ng0r%ude;YFttTAbh@Lowz z|8fmlIZj0_7UU4zNCDSsL0nDb+9F8iGKZS9R}k0Id3b$PB$n)j^K$ciQQBoKmY4iG zSJR%-x!O1FTr_BG%)>iZgU9n5r(g5W32>3KQv07UY6Z&7qHmh4EC0)CEc*7zy08%K z#7&FxLho8l!zpn%9VZn@W7GeJ#fnXqV7paIFlT*{kg#F{-)bbhy{oZr{T{2uCj~FQ zbqtCV`&MhAd{T{l>l`Rd_@59y)r1>yLO=*#Yl3T>($}Nj5j^e@6^|m=-rW1wqTR7G zMWd?m^nNs3F{$#n#E(=LC&;2bmONtrolfw*PEh+V2||V8JRj|~F3S9Ifz;^&uG1#t zR6?`ovfSn5|;2Z1aQUmlR_=7rmgawz)N)DpJzri#o#z!1+<3uD`^n=3Aj}kkw4V?Nx+yLc$_kxTr&v~N1TR^AgcO|BE+I%(Jweb- z@sLn{OZ1)7fA<|UvP;6dx>`b0v`x{D&5aCP$%0su$aR|_nF~$v9zm?F#_gf%l;ZYK z>>B#4S<5!^g5&R2Cp}=BTAj~7Ppgg=_!UaO^HxPQB+J>=Q?A^qXc!kVK3Hw*&C%Hf zBhhwYpErm0#nzJMRX50PzfIA8tDG^=iC+yQufx@e?B#D$bbv|t^@xy;fK>lBMF*LL zUylpvC`d2ersxop@aq{N9Rul&+Y}vU5`H}|q~jocd7GjmOv0~Mg>(X>S+^-V$|U^C z7ShS;2?mS!^FrZZE*-PhCuviit8VbF&$;U8#m0jCD6Nx+=|G3GtThCKwZ zAOtD~s%6G=_dPfReR+fN3g?#E)At!o(9xz9(svmZ&*2u-8&eEQ&CUz9%*~}C%-nW7 zPHBG%eAJuQDjKGZ8N(X8s55fZ3UALqRrUp6PBAn-0jCVa$sn3Vi{ zb^TtzD1m>>Am{4a6ipU*QHJNxZHl(X6D}0O+KdE~rKN{Fnf`!3O2@6P67u_G>X6?j z6OxSyd>ez)|e1tW<0x^@J7s0K+WNYZmL(XM!R(P1Rv( zQ6>yH6xq04z=hg*BR*Q2iCMyEpq*!KQ&euMZmqv&dTzR1(K3_;!KsSich~3Ov<~<> zBTT9#c!?<6IU^7r6oN#Q{UDH*(NsuFwTu(U3o=>?USwPZ9$CF2c#&aDgt0*I3qfQg zgFxggce|pnkPc;fYTT~qc93{f{k9N3sKI-^6+!rCyJqrJ_u1a;c0TESPFk-U18Wdb zN25wMb()^xC0#(W&@+eP^ao1z*76%1L@)q9S(})P$dQWunbAMOMxl z6HWS3l-!f)d2XUf&rXEHOf=~~%z-X_kZ|nFOfO!N96nVC$%HN)p>&M!9?0ZSI#swZ zv?$gb6ZNo0z`P;$BOnhH{Y6DoC54-&T8%{VpB3l3zglHr4?_>V{ z!oQ38PXfoY<`L6%fcm-y&zi?iPnb1hEq0pF`_))>EF5#V6!_)e9MY+=ydH!>|qOYbYO3Axj(a-qN@peUXA&}G5lQffbn)9(V zDbp1(YlG>Co5;SUuuj&jq3M$ScQMw<%!=5NC#+LyaO?<)zK9*puA@!rB=mVTJl~Br z=@_#5akNR-IR~s5eJUJ_YUm2=EAVf+0*B7{O9hS=`f6Q)ch7*HDOu67LfESnJrYy2vg9C&+GmzfwARd+qUnh{c#lXT(XaGO_B`|r&xn{a zHTbg1i!)3OxRqRWukuB@UmvlThRWffJLr7L{(!=BCnXDjmbEUT!=Y_1b% zRaaOBYOP)Zg$YfC&`%S>OgJ{uq-TXNpr!{mBtDB1{wstLn$VvKkkL*EBXw3onSdtP zK?p-@@}li3CS;XX^u7>=*W_2Vw=e-Ix(i{qPO*;((5kl(HfiA}nE>J63SqMreu)Xl z>PI1L&{>tAgUW~S2}0PYg{Oj0JRb38zgg%H`$BZa8gA&($l02D)P0t_gj#drUE-fL zF&bz%=dYsyCze@fikLrZa) zaSG(ntbc5zXM|T8X*Xp44~2Xt_#7W!`@{0-qJEU6i~3O(`qN%W79V34v02VqKZ{xV z3vYks{SIcy3(+@O7+$!cGN3PJDW^3Oam&IPEfH}a zo&ArM`HUoz%6t-15^NPKYpgOaSj%m?Hs{8QJXeaG7ovGwKhMuqgmKd^Ovs0NXfrR1 z+P`Eam3E;}@-0bmr@`jEoLM>$5OCe-}BR5BQ(tupuj9w2?PE))U0<9U=+` zgm-He_wj|og(zHHll)FV4wgm!w1(TY=-pWchV(V*A`9<{!h{P0bd|xra}}lKVaSiq z8FZ_~gKqabvkgiu!j1UvYr$Uz&sF3e17s*fLu2+4y9PRJl)Jnf2{=I-^;5UIxd@Bq z;Vav7_z~YCy26Q$feAU`DF^zoHr)A+`HI|i<{FeL=hASBly20*G^f&h%#VE?qx1pu z-Vfeam^a_&3sE=5HlB|`gZo|J^`pk4YNKgCJwNtN)Tr8%LoOn6_X1CpR@C0G%td*~ zZQ@)*zIgnbFv&9R^10gWH`hvt2W#hQxBts}!4~1&R*U1oZs9^aU>7|o^v$)Iej<^M z7aPwB{You;c*8bN%f4ER&uk>m)6q5ISTY_axGm15=S%kpe61FbVyn)J=_-evYY6>% zt@K~!W8de~879?_=S_MouyLGA?>;{%@JF@(w)@;h(oQncG1a5^XdBJ)RY})bm)R%U zuuTwe148dpo3$+xI=>!yX_!eL2>r{y%k5DtH#WY#XH@ zuzAQphx41~Yu}kyTl>;o0{!0g%D=^j#f50~R1Cu|3@jbd4NM zwCAl0{$@{<^)BJo(ig2N0dJK5N)W z()?IQ>(fHu1$DUPy&^KWk zv^x3>Z93_zFITPUG9uhnN00A!)j@Uajo0R`Iu{!z z$KG1n#ir+@Kqu;S@Ve+C>Lf2jf7C(8TV^4;Sbf;%VjXyaXQA}7V??Kmb-15x0zCTJ z$%5y8_Sp$0%@V|kIv#v1>y?G5=J@Dcx-fqrPj9eg>hE*3qHETtG8X7n*T{$v^{NZK zb07!tWuavIRoz6JXe$)wCIjYHblo~2cKJbP_XB75@j`4yMZHlU(GPV|z|$zQ?ze~6 z#eBh9^pA7Cl_Gz5U7jy&TJV?o!cL+8RF~%q^%lkE3kQWTsxHqL{EKA1a87b4G3T=_ z)G;R^B;dGAnT1-KOcMqmbA8F--i5m9jH%0`$m#-qo+hKn1Y?EtvjE=we7a$E(8KLn zbqzgpnpGEVl2XII2+ii-BNi!g*IlSrZ|Bs7Q_W+!@w$`@g8?6XU|%Y=x2~>s!*!fu z>7rOrS;v{O=dG^`&s)1l@j-^ob>Vs2VHTWNX(T1sUYGrBKk)FgW`buwd%{xGLJ-I5 zdS15_od6>qhJSvcK^a8!r!Bq2!|=s=N3z@ba&(n{X#e6?ZHcpWjf@;$)a%dpK(N8HaLztJMCE{9u8ZJ!YO zsQY;>>IhPD!e@oBMkoAFLc(Hi$noWR3-hCow`|e)rBM;;G`gN0Flz(<|!XC>;4t*38wWs3^S>v31|hNuwlO5POu z%6eS3jzZ_MVW{!G&?nYQsIczBl`sT@L3<1Dqm?j&9xdz%F=*LBlcosow0h|$7n(%rSNLzKMYsmYy3Q4jIf=S1`Ma*@Le~iIJYDWx z!i91dSB;*5>G~+HAL?SCB352k&q&QK42NlJJAb$L;8NzfaE&;JSU$;A5gOO6Tki(zM2cu&{kVdpEq z;>f`Wlin7*3_EkR_n@R*gz|?j$!DTNyrf?XeTSxhpFmHjV+3Q}*q)F0!qnA1Ln`-5 zJtM=XTOnPkhwkZ3ROgSsV8%?H>!Zd$fHrKFMI!8KqFI)U$ONUCX(aliioA}8G*AjlZ zYyHZnL$c_T24MRgs`Bf2kHkvZfM3Tu!3123Xd#524Lo?N?_$jJUJ?9$eJ<3t7(*(! zq+bYfO`=qsP$UGoCQ%LqExfBxKGDKcm=d=jKO6~r_pncq^Ej&-=yA-d2I$%|7c0uZ zNC0ph7d2TNGv}%Xfc4ztOA)fB0na_2T`Y4CAAVr&5x@`3J&GWo$F+kb&4vbgb~;Sp zO%2G2(>r4Y-rRss?|iUWkq4)DzC~8wZ#HQdevH~|(m2ku&SsOAOPZ|>_>|C0q`@hn zJz&Ktp=0=gQ$iOw4OSWtNt*2qc%{);0%K!g^1KjsG>{>s^YjXnt_yZ&15cHeCf&Y7 z>5uF<78~>k5%o98S#zaHW#Vvpo0Z&Cyt>k)I|Vzy^z>M1QUw-fzeH52m{9u?k!Oh_ zPs2+@wZM_!vs__$z9@ZSUoXCTw1G@#k8+JXv?NwTN4W+ux6L8|bzH;?c<_mtb4!YE$dz0@wK=)x;+4g7ISDKo1+Kglb0&}fzcw7{`mv3OAT?M2o`88pW3&|pnvKE zy0J{KfveF+cE(koa!fpWe@NNr`}wu$b%0~y$z1P=^n`s7SU(+ z(bCxWi~jpr|87t?FGRGT_3s6+9U$oYEud%&8n!g%W&62kSTs4zd}B~99ZwHDaQ7q0 zG;Jw=W$nX;95LO4QA$6ZVCF?o(mhh6t}$vIP+a7hQnKs1$UB*Uk-#D$bZM9{He9(_ zcRqjV@-_-@*M{8X?GsSCyfXq8cX^iu)2$(QdFB$GYgb!hD-=i2rTpC9UVGkW4Yf0T z))0<%81{OT=(C0mkGbd!tkRBpH-srK1Bg-|2FzuO-0mgZcTnGkaGaZ$q1JKs{>~-3 zZGPU6zg%z^6W|UNh46Jlc83%uAVsPWzS1eGGXWn+%MwE0hMrz)O{%+05qC!qgQKLM zcbX(+Q*n4z%&L1FQl+_2C%~H`%g-lmNjJGAF)iuADKu0`mB(b zH{||x+%g&2y(D<)MyDe~wrX1;NH@A5PRJL6^vKIWAePZVCpdy;a+2%i#xg}2+9l~^!={fU(@o1`m?wPR z9AM#n6@le1F0?L`FD=l?hKNtKmd6_PN#-Q?SXjOtoo4XS<%-gxbcO*m_&@kpi{*;k z>%ho?>mt|qt3VzBvLHm48e;5L2-GE@@+lDm-zVU^6PP?2 z@gUr1pl0J`lIlx!i@4m7mq|u0S9&%#LjI5>UP z2%X(S$giz0HyHL&-$pYYNv79<$@PaL(Po8#Y#Q1Kuf&c+;!ly-Ps19)=CdH%Jq##c zAcsbAZd*7ljcbIj)b9fjYM)2r8=bD^qLV9dCcSN8E=_FoT3zg*=`q8KnAIDR^Yx)7 zZ4`KDBTrzcNogw;c{&U=>FJdSap2e`9K$uof0=-V&qG2O)rg$NPbQrgcxoe0`JYUB zW2K^$sy~_Z4yOP|sb$(XrfH7PV;qCQQC#b3={UFFq%hZ$ne7d{81_eft$o?Sa1MQG z?`aqV3yJ8AVPv$$zXM;nXyQr?f+NxPKw$Z6*2-8zIb)#mDYb2w{xB9k?V?{+DoSlz zL}wXV1t^e1S2)=wKtq?7BIj3S72UneAgJ(%LC)DY0wwST!?UBT zqCZg>X7mW*tT5ITSQw2}F!6!1it5D)#PGucUork~t2|c})P{-BSN6qXnVvSbOivpu z<60$_$s+1$gK2J!VQR%NUfK}TF;WJ_UkHEs1%ZxCVH%`#TYA0}C+dmtt z2>wHT?Vq@{=Szv>R8J_(_^am1bEZKowU59n3>MaUtq6N7{DJ9lmQyqW+T2`D(Tuf<(#w}aXV2+2311gex3S#` zaB4Y4hXww^^gL5e(J#p7rE-ckL-Icd^88@LM_=2Y(T(tXlY`XvCW6%OFy5ncOgbak z4mR~v?@xh;ntz+>CG-*6O&{wR4ST5{7MT#7f7SwiW&y|6Dstagu4ivFntlG9X3_DdMu0UI%l<=bi})aXad7?~$y_xs*3s^bB_`qvWk$Vu5kTi6E}~3dFc&~PGOuKPTduPXPy_-aPuA;eLQ~{4|=OA%LQO z8pF`!b&A~gtibvv5^UrQ7YoZKhE{{+5wQ4aGh=qMf!xmm$1&`X*`}I{&LCM%BuXc^ zxL3i&hWCr1*PFVl2noE=9N1^;s{CdX3-*;iL`X*j7OtGC7X@v|i%a{PhyYw#Jek7tUc4p3Vy# z3t!g-j)gDBO6`3UBz}|;c#Mu8#~=y8>H-R_N7nZW%Q1fHfi)I0$h2sJO^2SQCY zC(SOW=rv*8X?l8=QxpK9xM798fgHY)_>KLPWegleL{*Knh|iZp)&F=TnaG{Hl4mDb z@ap$AC`!$ytT$3z)B_p0gP;cJX;8n~pePN4;zz4z;(F%Spmn5X@XN8_)=Tz3tuzR7 z5?}EdzfvzWBrIQiT~5(7VXc`m5pi^bqLkU?6sZbpU_{waXVr++*%^Ygd zYGG@`s~THG7*;i$Z!9ZCdxhLA<(p-t=qxAuwVa}Jf`2^yFmm^tE~n@^Q=yz~l`cok z1li7wqT<~fOT;e(EqpYrwKtFxETC`gR}5|JSB#7>(JL@m)s2c$JJA1NuE#ejawo4c zD3$Ng<-okp0(UoXergBAt1N?O3zbEe|0Psy+h8yniH5x)2&Dn`fg-Y#?EQCwAYCQZ zB>7tjD@wIi{jEx1s|LdQetPd^rHI&K0Vu+TZYtCd47T)Bk_RkZ>~kd)Ywcra8;Gt2 zUeUwQJE(0Wr%#Loo&F>FCAbNy*DJhVXsPXltEAL|xT_DcuN70wHuUz&Yy(sDB2)lt zGsmdj+(q4B@SryMT%M)$=7MG{D@E^!$c2fMh_Ejj?$k2ySmVbVH-Cn{vwvY21IG~2 zO-2UZD!QrbWfzUu7@H5=^mI+Ml8+%E8ut4lR2sE91yXwh=?jMgK`H~bO%P1Zrb&vv zTV)V3z0LDVlA_&ANa!b{{_OUV=Q@Raa@F{I)&kC0fhW)vk{c(};f+dH{P0x%r)zqqfGJ$j3nWcRlc%NU1#^6D3-g)>vOSs21KH061CRQ6-<<~A z4;TjPHQX>V@`#2T0~#mOMbv>mkWC|u!Y0X-yh)LJDU1>D6*UiJ(~m~aCdrh#3BmSK zIYkFVjS&Xly*a*0Z<~IuJh*#P4}9c&5| z5qVDDsi^rTMb1_8O)B%77BEw#-?G3Y@|0g-(#twE^to43Pt;;kh5d7txR@nYc_tY3 z=XRnW?B9tcW*OM}?9jBGH<0JcA(~}iT;kuPD7BD}9?)!K@1w~S2F4fYKywVNMs$Ob zYW{{JJ2cl&{aiE`3OO&`si@v>x-_%3K8+LfaXxdGqNjvDSJPW3(2Ko_CwY&B!#v&@ zVt-rL+hN1V;Gq>AHY!$j(UMJ=4FiJ5ZiJ3`Av$hgJ!n5vd>Ja{=FlkvQ>PQGBL=4b z6CF+(YHB`XbTB(O`i;`~EsK!hYJ+D!h?!c!jTB&`A4KyQY0%7-?_N zw?=cUU!}c~760j{Z;W^9xroyIS@EB5(PjfnWt3JxgN#+fT|`bi|29R``_9JCzpX8) zR>&KU_*xeRqW%KkqX+~qc*7C;(LPyB^tEYZNMj)S+JrOjgRSPmRvqXk^LVpla&O^U zBBB){Y@C@;^jv?yA88lQy^Swg7^0u-1Ek7-GmX>`tv1mt%5G8Q?0c7@4U*AX)3f6) zMOA^1Y&B`Sxc?C48MoD>`yn|&RM^J_;*iz>CHdL@iCB88$xWANE0?0#7Devgbt(36 zDGHF66QwvS!hbhCmy3VLVM&$z)p#ChV>o!H`$Ed&BSI0%YnBy&Q zbfAF>wL1Vg4+JJa-zh8!jg6)Gj?>IQ8XRnc?Pjdj?G&F|u^+ih(P(>$G0=0@-HLtz zpFQPnMPuw$jDeokcPm=OxL590G}i7h272DQThXR%u@3lW7s^UxKf27MarQFCKu@XV zChd+h%yS|B64~c2Gikj2PGg{F?=q7P#~GFgLvh6MMfICvxgnZhFKY}eg=6l?GU7U% zjKD{!xgk2jKhHqFc;dA5a8W^F)Ys9I8OGT@nrM$01BVk)Gb1BhMAYnTRx+vWikwT5 z6)jwC5QtClJA2Dk8&sKyD)2LVrM4@W>}V-P>xJ!^bbZ0--{r~moJsbt4K22nQ6*eN z&q8Wa+3kwl+fYvh^fE?ERUyKO4aq|y;aNWGc4l>K+$cA2{uJ`_JW{wJshJ`hC|KfNGOeE!s0U7zUAlt`~FhmN^S6{Qdbwybirf=L&aO#SfH?~xT#&(Q3__-9 z9y|$R?oh-f8Z9dKH$10?nB?98Co7?pSbeH}r>K=ttX2lpx_w7UwKAaAGdmQyCqWfI z-H$PFM<5mfkxliW+7~Q}{bGmc*3g4ncm1JT#i1r07Tvnq_-lSYaDo!L;rYz$U_pUD zO4IE9MZZS+0$L*sQhwfn$PmgRYJ`0voRz3aMk9^^d^;? z0~65AqASnfW&jhdN#7diYSse^a1#2F=_i5l=I6KR6v)P)ihklTc=9eqsYPCYw6)J0 z2?l71fwxv41vZjLHw-wzOMtTJ0~>s#Gl2H=p$#?~3m~Gubo`MGyvsC(w~RY8<^(Wr zhNz1TzGv)Kcy702G(=r(nNKBCc_6aA5kK|dZHPw%rcYSHy8`;!6lQ1pA`#M?O;cm& z*1mk)p2iXceaagz+dx7cw0w#_pKSK@90;ps_XwCKSxi*B1KNKx2IiNK}{ zGs7Sx$p9uuJB-s+T=b((vXhfc0`LayX5J;>eGa_sX)j~8a*pJF6Uay&&1Fj;1J-?2 zt%ZbcP;$EX#A8bUa%33ZsTaHvW3h47Uve>I zec>p1r-4%!N$TM`_3N?J{#fcC|1EW^VJ1zL)QfDM_lB7iWu-nIX3{(%EVX&24m0U} z=RnexF6e~X@YefLR8vEPG6GvJcEau^vXV^PYUeYpsTv4;lTlcT%;sUdR&sO(n;TpCG8qZ zdbwoMUYzvr5u8VNwP}XEz7FGGD5Hvu7`{+w?MVanDXLQ3vcFJh?iCjyzxWt6;?w;B z=T?hm#&SDj#&bJka&E^;=61&9+-}{k5_H3|Xr~wb(RLh|X4$_tjDeGh=zSw2Li9c& zWyAf7^ao~mcZJ?Z57KtxL$s%nLHi zMaZJr_FDP?+wZ1Sn3mUbUw{!1?U6eY;_=LU)TaAz_P2pq!j=lg(b+`>hhfPR& zeGc{EPDdTk7pT7Eg_XMjMQAAZK$QW6gTW{bGoF4bneGQ1tx3bVvul1pk@Jtc72P66 z`^NB;DzE5`1Bz10l~*+A06e==c}3-gW0;ZNq`V^XJXv1R2qq(g+CrYLGuRr-zNo+F|B@3bd)9~K#1C2Dn?n8SldNlaAJ9GtB^Mt#I<->;O)8=KZrA)5yB3GxGpXW zyg%*)=1`N&O}fb*)Kzfvrs68#I=)NjU2N=~UmlV=9>{W#Lxynd);Zjtn8OR@6*Ut2 zcO}oPM0^F_*1=%Zllf+$uh2*H?ERB;)sD9r8C*Ry-iCHF@{l5F!sBgd!V`dqfQ*nd z6OeAu<9Xz?0S3?aMxr#68Fm2gGlPf$+{j^ z3=LvIEY)kPy2GCw7|Z^rt9x$yhKO2 zMB`ARjzmXU<_xG5qT>uK0?>(0Ft7?hTRO?WW~lam$ZYM;YZs-3aiQH*%#7U>%(xdq zI}vqLu-GwV9ir|GoCna6dN6PUKwJ8R0q2p#?l9tuzR;raGu{FpEwcY=GX_o}qOt}) z%@K|gmBq~9)+3le`vQ5UE(01{DIENDG?MAqCYfcp9o998TT;au)XQKtWg)g5?+N6hEKVnsq$7eHzeqX}0c9C!uPiu?Kms3~}3j6XR z^oxCKvN7;`A}Y;G_N7NYolO2CikzR7SG01IL7)hz!e5^G?>UOl?EK^&MYV*#tY`Q=imJ!>8w&qD%->M+kG)6Hqr!iO zXW2c9o{aIg5dM3a|7Fd;?jA)i2!A=x@p}}ti}C+g_$x4fk>)=S4&lGkQ~F*--D3Q2 z3V%iB@2mOC-K*#=;lImM`(8!EV*H(j|32oQr1>AbSJ9`!f4AqwdlfB=@%I(}O3c4j z^Z)N&Mc)a3dC%MTD%um{A1VAP%zsMrcez*5c;Uat^ZmVwuE+Ri2!CbfFLjLV|06UI z{(C)(?p0L&nAFz_;jhB{)inRgdlhXE{tBK$_bPfI#=leet1^Fc&42n{MF)kyq9?h6 zqL*U)r-VP9`SUdYZ50&#Dg5_&YE@9wA;xcP(f(PT`MYZVh7}aKwrKyX}bcRCo>erj*739H{j2vU+v2b9V)VnjBKJTgo=~Lu)X2WBg(?|(=~v& zqr-2W*^le9m`xDqN&|?5s40L7#}%=K9}x|ku!YlrMud4%G}IQZcbsb+E$CU{Z|Xq{ zY6gOH80tpw%{{+VQ1tw9MV^%v6y@N@_6mvu#}%aVh(J#NlN7Bvr;mY#;Nr`+z5kU>Wb86N=m;w(x?^`>4OF$iw+uMMZ12==T~vHazVrDthdMqROF)kl=i~ zqM|KA?qPTaR#fy~PB*@yqSHe7!tkuDsHoEkMJXF9D*6%}#mZ&p`@G>c{=9%U{|PTX zTpEth5_=P^=chKqeO+tynGI@vS28i)w)cm8v=pxZpkTk*4Ck(jima^$0bXrOzY1Mb z)P0Jkl}wxyY~#;s754cGLQz^~zi4Qgn{0Zed6Ny(%lRi1WuOfZZL-17H^EZwtvE#4 zp0@F*^56+YIQ9_ArfoJj^(hE)-gKX$TSbqpHc$2Y6kS4v;T4U0wi@&-5uLU1^^nph z<$6fvt@>&Ju7{BG{`(YFlN`3$JZshv-|rv1-GRCNP-YA-C#5NU8_TP$ zij_i80Y*M<9#>3OS?qP~z< z!bDglc_tWmJV-0--$+a9p~Of%6pSUw#DO@q!hU2yL1@B7F zgB-qsf7>?Qpg&Q%oOcWSx#DvE7At3^ZN=sMX9Zg|rIq%_bTtlE27d`-utKxl4EdgI za;;#9!nFo@Q?90n`yp`_;LUlXFcQ_VOIO({`%$HHo)9bh1TOm?6cyjin4qv}c?2LT zTPLFls`E3+bm^4B{z*+TCMX1DLN7UyRdb%kY%LlI(F}&mYnY~~8_y(D>S;ypdN5oh zO3N8l>ojJrT`MViQdFO%JfkWpYIIsr%9KiqTH?pNN{U`#)|HhMwGq}8%JWAhMY&8s z93_U&*C_9QQF_P4(Y#W zyKcBkEsitJ?b2;=oVjDW^j2tR$gQGquhO|av|YDm&JFZtLf>s^=`965p!r`)f3P4tV_!rH2CVq5#fUQWQmnNL=7LGbIB6acWeMxo_Vl4xxlA8}zvRRbm*ztI z#-6UvxUjI+f*oMj4_UpE0ApP+~H2o?|EW!S@B;Y>~5HilXiUZ?T+n zQWW*xpE{^uO-l#WU0^%C`PP>k? ztLzeIS8*7sau#8gXq6qK=sJK9Q&-s$Qy&G0puftF2%2*?))8tlxu4(3qk|2%4! zyON|hyOL0xvrr5Jh+Rog!*(85%R)rElHg0XoKGCG6_;~^y_bwf&c(7j$LT8}eKyg# zB$PAjydvi{yP~U7hD%8$HOwu_$qUj(JD#(I)p|Kaxn52v*BH6!;YBYeh8O<@f(O05 zoETmB&&PbdmlNGMrREmpGz-vIP823`9_K&vy?GJp>x50;1tKp*3!P{;A45Czi{>sJ z24*_hu&!M(!~Vsd`smIkdp9Zj7cL{i*U=xvxPZRkLz2Cb=iuum-7IJ9X6$Uta%!@YL-`B49olDH|oeSpp_BFBz ziPALJjc1Z+HVTf>ZXFRj$Hjx(CFd3KAa^YkD=uz=losAdd)j6{Dpp=Z!OAXr^n#*{Xb>MRqf~fI3m|gC!GdDci!l^Y zD&olh;>Kf;Qlr5FUjd~digZF%L0%j)2$*P)>Lcmo3yR!_b{Uiw?BEOM<_C)?ohyKx zo%-46!Y+fLVFS;=el|M5CVzdXNwizzAN1hKjFT7S$qeHnW}YayQy3CItymE3;A?~8 z(;hqS6(Qr9rY`$T6NSI^qM{7kv!|K7bdm~~%RQ5ic02?)+ZzHMwrO)Q<~5ohQ|K%* zG&6u&aUeC@8-fWIn6OIrMMYS)qlGLd0=?t@AJ_AlU{i01_S$!tx}LU)vfEhM&QOMx z-Nu;=0L;p6W925tmD60u))J(gR|NOJ7YGu2nLk( z6)CH>!F`uvHfSsO@}v)Yy&)N0G}*@+UJ@UF1}Tc2B`+K-;x^r+Fqih(KUdmSuA2sY zqg6Cabe%P9cL_JId__;=7Kpx!@g`8g{2X|hpn3rnC@hG<-vCB%xXwN|1Yq03+=P6m z2`VAqO_yS3zHZh?Pu5>;1idq_tnI#}ogZSqWX$19;z1E9^p}b~$aYyg$bDHnsGnF# zTd(ZpnDqt=9@azP_^CJ}M2`EI5s_oO5C$kV>-``UTa!DTP%xP9#nE}%Z^tKCs}s>e z!_Wtq@e?@60yuvLg44 z-P|K@;45xhfmsVoN7~3d$5b&4zy{-J!iVV{o<*w5JvF5YRw$mmFPn&m%u1+7Tm2sq7!ee4RC=M0zU z^(%^;d$*f(Lqwf1JlD6IRCGmAihYMkAArF((WJ6_3{(j1usrWhG^q#c;`Gii>7G5h zTz?pRmY}jQBC>NSstNs)E=3G~ah33M5IN{T7Ej6Z|IW&BDAGj$mUNe=&3#{cqW938f=lbW2b zi#VT)I0rh9fX>=4f8k=T1$G9o9ceL_Ayg>J9#g52f6K@XB(|X z9)VhPf#sb6)RC^RY3{wQ$o&8kWK&lY4d$8a3LpA;5jY&yLiqAtN3;%k^L*5gd%n+s z$Peb#(#ZbYv;KgT?k-3e4STbFG{J1L+(mPNc6P3;sNY`Q;`^JPZ!0U>#ss+B5FrdO z6Rww!+8b+A>9|CMCEELrm^4{<2b!LyM@%}wnc%eFLLm$`xk0Uv0d$^M`!pGrC3t_V9xp}Hdb#EwrZ0erhbq*yy_E7D2y*5{TZi+8_ zH4t9;*u%5PT>I|hlKY1yN2gbjJC4(~`aNbz4=fqfDPXggB}Hd#vpivBo1rHO3H@V} zqt{1B$%IZq=&1>xf$$fn=kDdGy{q{AY7^(v+7qod;pP2rU>hSuYj{WUS3n(TEss*p z0tnDL_O!dm;?E`*e`4AF(eF4S$sTr)J*){?MDD&oYq!5(BGA7^7QyW=az^h1>PS~j z#Qc$Dk$V~vWYfnAZa)Wkkb60B5&Bxe?Kgw#3^2v6K7t1;=a`#)!?{n_^#SpXG6Eme zzH!$+U9)lDxKHSZv~S!%PV5_LLO7y*<1WL}zHz_gP{KDJ-52u>{z!0L!z%uG6mA8! zmPFzt4;vQR&))4O{ZGVvt+>Z-Zdkg$yrU>cX(MV~9Ry_;bMeYj0mLqQ6bIw9HU6OqY}JQUkZVOiZ3G zCtA^c!@F!yiF1m8%L775`; zi=2;)G-okpq>aw^C+N6+vRHhMWn^d^&9R*4UG$`B;c&N@cn+KRf2KvL!M1Ni zXs6{l@1l_$u@{Lf~eF9iNowi`wJ>V;S z06llxH|UIY?hh9oLteNw@CR?#UI5tE8}ZRu&c#p`rH1Gt18x9$+5GaxbqkeuhqB0B z9Xa~x2J=)>Y+UEi%8Ke9(0;ki^31KQsE)G8v$C?HSCmC5n<^{H!H+$a6%`;Ar)eZ< zKD2Y14zV+=tv6{dINGc?X&HXJzTTt__~Bn~(n0*_ zu->FUk@&A|gwH^ou-DVgqq|)nlIm`cyzC;=O022wb~FaJWoe~f5e0f^rEj+^VioVT zEYciph2v|@ks9Nu368(&k>krnOFfANW=sl)h$cf=lLjR;8N!-0u`F`uqaJc-q<#2* zUGx+(W{bWfqDN@a&&5Q)7U$?J96xG~+!#kN&heRW{G>TL#yCEVbMzCApEbuPF^(_6 z@z(-I3Uh*a5jtgmPMdnN6mT*ZaA1i7PUZp*M*)980V6ccjzjHZkueu=tcaejMNf-~ zo*(C!E*vv7$Fdm5I&cwHtp)(uw_Jk1{hK^3eO4cD@U+o54$#Fs;~mUrNe0^!Y( zcD$BVzHC`o>ZwVF<{`e7kxiTJxM1qCTa+5f;|6<@^QdaK$i0w@m`7W|jZIL+OD+1;WCoW*lz2J=G(Vv{UBXCY!-@YW}KVawk+xCM7U!RO$?=Evt zH`J|~en%o5UDLfn-)HB+U7vWyRfKR=C#;{C5Q3Wt{gS4)Or)b{dr9b*?R*h@fZZbQ zh;t9>e!Q!VZ;p?Ez=VpzIxkOK>5TonjQzSebaUnXB3XUyNV&C&qB}ux-cvV$+C zR;@Uw$9O*)o~biT`VvZzGq;MO4U%G!!}CEEMZ=K-LH&2ZPq1@{o1;_M)|qr#C~F*^ z)O98;by$>Ma~(R`kU??$CyZa7gf^K1LMR&@=XadLX5cZfANakF<%A_`8v#v>=Bdbj6!G!*n zqW=hCNs?!RrKpe7(x+px4;g$2cZiMmfbtI+{DG0_PETl#NrRA{$l1S&qC&~xQj#9l zbQZX?Q|I)lz&n#Tr@kd~n#nowc<4J}9Gs-j)r=JQ=Oj;`3np!LTI9jen&0sQr)y3i zEf1~63+oR_L&caS)DswXlKRVE=qw8nw zcI``}oe6uXdBI538;;_!oZJANv%jf%COVCbydXS+COWNF$yC{8QATbDfZacGQHIN+ z)Z73~;!W=RT^2cKRZ+B2l$_!8tgoWzQK+=DilP?yaj=S_7hD#loT;Mdza^E7vPS3)%CXE2&xARRZC-}8a zjw=-o$KncU0ab;*TMHPEbP$knIOdT=&XsFTsuO2SjQE)7^FDW*kT(#a3-(L0LOIA~ zxSJftkd_ytzUSTNnJ9lNV0jJp2NxF0_W=1ikP#ZjJzosoxU-!kj4}`G!dddnai*jg?@Gs0IGTM?oIO6}HHVtCQg~--=^KR$bH?Ikk(b>x zSP&|V!n9!=kkBSZT)b!>B@3jdT}CRVi2+|uG5NX+4|WbtMySp9#%U3{!Gv)jcst}# z&t&k;g{^kMRw4Qz86R_4f>QCLZHGnCzR4-WZ&kDggklZT(j(FKJZ17^dc%25Iz@dE z`qTcjG4MkodLllZdIGbl-;*sFaXo>C@$cER@P?XWHXQKg(#+%y!;LYhNy29bi+mZ2JZouk$`~+I!)@&uT;eKFekPd|x0w>pcha6!-&e zT2VfE~TX3_{s`Iz(0$@I4LI67Um4N7P3I?kVsy0>7`> zUyXzRY;t_o2_0+;Z-_42m%6o~1{rZn4KiS=DsGE1_$4~5guoun-4E4u~CMWXEsydj!zOmCG;*HMA)Pvfkh zY-dWjQWzAB1tmo14PJ;TWs!R^Faf&ArF{iVy3Te^4o>q3K^SE?v-9@W0I((v3~Rnf<#Eb>&Us_2JOmR=pX<)}ev zL^RXIt0PO06S360CFyxBbsdC3>Q4NC)WhIq*80M_U9+AA2UxG;2Uwjq!MUMOGhscf z6}s&vQRx1gM4^@?6?zpZiPvjhlB9ncyk3(B3K!Zdgx{qJ1O?tH@Vf#pOMKxo5^W!B z`v#6-(G~l0L;HPqn~@5~`Hc6sy5EGwuV4;+ZhN)Ai+bN=k-O(ngZR@9A^L)`V_1z5 z(@p9lVg@EY1dtsJWP9;2vOka)p{w@mrZI2^5tTQv`%P57=CjE(>n1Ec5S2ea#6`c} z6pL}?G03D;e@;ib2dg`^N?VkgPxs>Y%lMrgEDS`c0^kC`5xO5q-ofv-bU&VXo?6-> z_xDiRPZhz~vW$fty^3IbsSF%*9HV>Me-T@kK5(2Cu`NVw3y3Y`%xV&~fY|pL z$`a^nhH42ko}t_V1kF4U8s*2+fGCOCLLa5{oXk;Vdyunk{FMFW!MI88Vi$%yv)! z=K@!74-^3yqLns`8M;9qoD6$G^jTr^;B?$zXoAym6TtAmWRoJt5>LmigION%DVW>&hkfPYUVQ&%KLzkqxW1Ey@Q@kXbxFk1~(I!|AL z+$OF8FhtwABu&a$`kdbqVZiGob&5d4#NoGM+iPvlChG} zPF<2AU@R^Gzi*70MN{rDdpNK`hOP{su89zR&#w~CE*Ep>?@j&k%zNQ1GQQ`Vt$J;j zhV!0qxjV5ZOdFZ)J^+OQ+G=7VR2@(#SmX=SB0kUX7!U=tmZ_}(_`+e@Xzr`yqBriu z1~MEwKqEP`!WhFyX87Pvxc+=_WYc7p-4kin0u!LAoaU=onyH-Td!!-vHn8|<9V_uO z(hR}LLlP)4c=+r z4lv@)^%Wn?y9y-_YYp@p(0ANbqH*8~L#Ig8SHPoc>gl-882CINq~?1Hr;ix~@QH*< zOiORZkCk~c`D2%#Ixd$n24d*?Un3*iPxRlf+9Xq@yDX9oIOD&i+ay!%yDZAY8Xe%u zh%FbPRw$eDo~z`dhwj1(4;58vlT0t+w=WP4ccPA<0RBfDt{L zgOAtOqQ~`^JV4IjRTaG}V33@%&Y9Fr!0v|g$~lw1Id0HABI>|NhX`?r1FL>to-=8b zU`s8klIKzb{GF%~CI>SomP1+!sK?XTzS&DWF{G;L7 zXek=c0&4tZ(&=JCi=RxYS>B?Qmwqzo5&ZD}WKu4Eyz!GspO#0v##ZYkNwXkvsP5|+ z@&}}8o4)!y+J*|7SU%>qqiq$Q!)ei6_86MN;DYk#6~lQn#mvNSPOD!2IsmE9M0uc z6;(Z<-C?xy+^DK()jhHiQRjr-h}h}ijfX8rK+dkCO?pUDEKup+jW&rqKaMtOAJgM8 zAT3=N3=?oqX4Ka)+BhdCOkX&9+O%z_TSi7f4$*WAg*r&%hZ2fo(d@b=7-UZ&)u77V#n+q0N6FHY9DQYE#xNPx<6dM0kYO_LoD&#S4^SvEm zEo_?IzyXM9b_9i1@qDN8HXN@9Pq*LI&qXhzR4<}bxqg~yzy4e@wS@p@sZ>R;i{u%0 zPe!Vu_Dr}xRZ%-3%&~i(PgNAX*P@iyQWd?6AMH{Vb;FNHs-my(`9chfp?6Wy~4I(Bvcx@~n#g zuyPa1rYX$&w?&t<4&Hp4mc#%|g78s=J&#AWD z2X(TkKj**iJ~$k?7l0|)o@OMWXeW{G1W*MbTEUrLLNY!qODmHGKA%jgl11*)Ck;yV z(dwl6&nHvWN;$lblx;u+Gm?6;(T_8*H~E&(Eof9%MqnB$FNxLiePU&XY`f zj0res^{5bjO7d)(WYRO0EK1os$)p#V1A(!naEz9Xla~aZlBAza%oTWy(1QYx75H6& zXC@J=(o^6ST9vje2oDl}BZM_c&Ou{L8hNtBgTw{UZ0;D7I##l%^3pNb`_l&sr%1YO zx(J=Yh$4K>Ib$PWk#Ou!(#tk01wJe)ZWH*Jz=s7sm82zH5coSS;hUI*A&^kq3J^U) z?ejw3Xgm7SG1|~A;X^04gb$r)31ce7Jo-Z?2a8lcb#~rW%|)v!VPxkm@X<$1*<8ue z%BoYkPCs&Tb=)N2l_VnW>~0stM@|nqyFZ~EIy-xcMcmm{#g8|BGO1Y#yeA&|pe~OB zzH&?uU3+U?d$X>&DHzfC^L>FJQEw;O!xt$r^?S3DJq*ecWF+U;STpxu7{H9w}EPqf>wwOjVD+SQ`|jvTGs5v|=3)@~idMzwZFSi2({ z6VvVpYxhT7l_RWxbOf5H4V5pdoY1OVDXB^%>I=~~jy2*@U0p^-h^VUzexj;a#Lw7t zb=jM_Xb?aIbL#3E^^%K50M5m?wSj@VjIUx54iSXN&^b_Muswc*NU4P#^s&V5d}Vh= z6|`&ml!0XcLfM-BC8N$)vB-HiRZ&C=@VU!FX^I?GE%GF#DS8|~ZcS6vx~fGf_oOL$ z4L_=;DQbrwwbK;6g&z;5De77ko{a21m+ZdQ+4Vv$$Zi9EAiLd2gY1st2eLblAIQ#; zY7u9bnpz@aq^0`&N^G=$g_J7p@N2&11f+mG++vfW` znc4gqvAjss8!e2`0LKB-7+95vs$uaGEJW2deeR;Sp%J#btKo#lmw5t?1TN(#}EAqDYQ7!~h znnliTX^Q5ZG6?!L)ZhvMpCI0d-6CLXCr(ElJf(Mb`(v*gd#|U2oW~o#*My9%SAHkl zep=`4=V!uiO|vL{$#Cu}<6$=K|2E)XUJW1UsP#{;hF49q=P?qd|_xbR`9gD=COdst+sS40dTLNr>%G_Vi!uaF3AnH)bje8Fu);N}A(~De#?R zuAw#PP^>`*XwWRpB3*6opxT~~DO61)7O_J0MPj^S8VUJbu9)URhC*C1t%UqOSBwva z`v0WpU#jE#f3A+gf2@x8Am#t4_X2OHw!Rm=?R`%Nv)lV}XfXORcxD$~{MAjTivgp2 zoEB@pUHCb6(kB!87+9|Am1dFqrPBs~v7{f}Y{tMvMAXR8 zdjXBGRyiY$yWTvaMwpo|jVs=$%S5bHN9hs#*aGp+aVAAi8-z?6d#a5yX)o*j*maZM zj^nehn{+ge|48sn7=IS{VlC6sqy7TK#lldIH|l%B=MB*iM^~FM5GDNHW@JQ(zPH`< zzKgCxG0m1k#`pXZBBe$nG{pAa2QIQa7CEPwdCglM4&Eg$y4*nm)^7SIjj?Rk>xVpEr4vA}ChF2if!Lm4&*UbM|;ZU4cV?5M2^ z1C0^-X_#ZAp$)nX$`Ea1=|vuk+&kfgfnX8s=LO1c$dSM5c|b(%H_2)9C^|0iVbgPu zN6{Bh31R2F;BOe*%&$v3Ml=6^YQ`h#EE?`e*XkWGjVe(($l4`+=dq{?G&{(el^F@u z;_fXb_hd$*!4Qpb{3_(J1BP+upUmyp4P-lfsXdViI7oHqvbd&nS z)P2fL0-w{@Lbierz02)qVo{aP-u@1iw0X))ii_Gj$B+W%sVaCePewcgEc(IC>IlOJ zD&}TT=pn)OQsk`aQPfP}uau{$N6}?u-(pbM<@=((7XAQ@bexuI`a$Vd@q!vV3W7QQ+)nhPcTG@DiI zmTpl-Q9E3!pUqz;90)|n7xo8p!1GNV7fk{x7tjkIxM(>bENIefRkyl}_5zOh-UN)O zn^Z04sk7NLr9<7sK!s|Uq>1NlW>jOKyg4~^oWVD%S>#@D21}j(0PRyy;LBrvD}SdJ^tPLHCOt6P+Ez@sP#7B=O4;pk)O_PR{quPtt`y`cq4v`+BS zUPp2UXs>&OAno;tSWLH9w7x%tp})ngZ(=;<6(J0;xFIivD17%$oz=A_$M&})!N0q@ zgyNqZFKB2*4;zS==aH4Xy3`@t6QfIXjeW1mc1s>vWD=EH020GS% zYH8k1ZGDY%a_DE?>O;4`#Nuv$iG^^GmSGW={MK4{L8%^~XoS{Th#QXs;&!;lg3G_k zu(!RB_VNRm?`2rzzWb~}u@E>%y?h;6@jz+SALW zE7~Irr!CL@>55)Qj@L(+bW-pO4efas1^z{U?S;<8{2f6COSR5(+BMHu9xT-cP)e+G zz6V|Y=86$dW_G^M8+ZawoQ`tbFb#IbkLyc^kpuMXdQ=R^q7P;>@XW#=a z!|m|apFocdQpfWQ%#{kA%N07jhD8~Xa5f1%72;3eeJqi(#?BvOURuMVbp0`A9z@g> z@>;v+u8AgX1sM|v(&Pq0UT2SCua7XPiD1{;W1pr2_9?+`u>Yg_UVinN#yGZG+9P*L z0d{f$en$Z?Os1W7#K5zFbA#b*A21l@UaetKs$TQSp<%pFWYx6D{oHv2E79Rdln!#z z2Wn!(;04-G!yQ<=X$rm8=u2zZx-xg2RBE1mNdr-f)}Sv%R+lb zbIcHeIBmlV2~NwS+ed|ArGrPewUHx=_oCoSj&A=aSQ*_u3OU51alcR|JO0s|^vB-E zI)*FlOlKTAyq$3%ytT~2c5SeT=!^r-6ag$9Kb>))=l?OwqRcRO49!EC_z>vxfv7*f z7!~#g0KolZ<>NeOxH`+C)VG2KZT-FoeZ-r8`+?F9+l_bUPGwo-4qrf2Euub2(Bm@7 z$F9{`ig#YSmQ_n!%Yz?qty;CjwLTNh-45-oUkS_}b$EnH0|ar^p~rAT1pY|&>Bb1$ zEs412pDOTYN!;^44MA|Bd4iXof2mZhcA+UFOj;`pgC*l_2{1ameF6_p;tnr_j1d^l z2!5gAsW#H2uWH4d>9P={=QA%RI@7TE)e;aVCTSO# zm;@IXR4e8J6WR2m0mocmViH_ncCFZCMYHH0>h_CT=Hes{-xUOumasCeyhjMq5^9!E z9!*xSMTws1}YC z(d8t}4yiUyp7`FRtGoez3qal|xW>t=0M7B{dppr}M$`eq8_uIENtjGNUfUvfuZwy) zaXep53)Ds^A1b)t8TTP@9Mh&s2|stnVjA3Zo?x;0h{(58;IHFcuswnQ z-)_N6eSgQo5cy6BLF|2@guUVZH-ur7lfAywpW2UN!@RNri?dhwGtt@6{?deDg;P&k zp%E5qvV>FaZcTwGX5cwSPRaIzw= z3n+mgPts}6glC0>;bKxkY{mj;n|z-yq(kTg$0S*-``Kk=z89`Z#?LOqK#8NH7}$s^ z@ARiZcxq#u>zj5iIu2A9po(ZJGo9C(!bYEpucdCnf?;Eux z#5(K9O7tytB*gw8oUsu5qre``l(6qv( zL(>WuLQ~Z`7G?N}R=6-UsZqzG)OJ`fUg_%eo{Ju?gEbJ8KSUduZ8-Sg(NV!mH}Li)9Ts$BL-+oXFpN#s{ZkKtrzCUW znv9Gv&*&%kSpP6wV2M{_C1dv4|3}GX5oId&oKXB3$yh|0$)!(PR9DusXL5ndtOT4* zGuayDHo~y+CeaojTgJLXm<>A3(MKA@!eoBxa3Lq!1rtVT5$Ash09FKdCzr15qKhaV zrg_t(ILoyCT=(N<^bnI42wv>BLW-&Fhw#5q7&axxIteUB>=NwmWL}K8>wZ~`NWUL# z4IRW8;n<_?{161f&Nl=fvvaA-+KI)^WiRUrWIMAnR}hAk$q9CsH@}N*Gu?r^MX>g9 zZJXn4n-=$5n3bPk+q?iBV2m`$@}xFKF7Pl$Ey0U18i+2%#&|>+F2#+3qCPIzE4rv1 zkR6Kptl*_D?8df1JbXn6Qs%ZIr?||1VK|dm<|v*%Yn;=;8_4#ti``E%xQV?$MBmtr zDtW#D4d646Nnbz*6e)b!Ake?HC)`hdM+EjSj`-npMV*CrfSnlrOyKYB!dye1*@eCiRaMc$EmbY$X(UgQ${F;Cp{FX}j=Vu{_WHX41%b1^q6B zs}`5!h$Kfz{txZy&@9I%rdDsLWmKtJ@LaH2eqp2?4Yle%m`q7i@3)9+X(}sSX7T+N zxldn4_Z{|ipr4p)GmxdOU=cq=Kl5_uRiJ7B?1RI{GN zPbK2sf3qvP&PQ21kZy5B*Au?h%0BU&(5EDt=(Q`l;U$;|b($-@v$Z9H!u5YyA{c(m zo87JzyJ$U{?P#kHLd-8?R0-=Zm9HwJTDT~wVLgkgMIEKU=S|OsbVc9Rv&gd}UD5D*7Ns0aS2Px!7t$5=ykgM9 zL^Q?ll&Pj@8WiTC>mVUaGh}^-oOf4KG)i*5XnJ0$rf5F$!LIKdVV{j{k^iH_nOQW~ z@v}|)*H!&7`ko55N?NANm`7L5n_fz$GFt(|24C^EQn@22Yk`lhv4t){a{FZ_EfbA; zD^_IPmEw0F{-Q{0U!Fe_^@X4Iw)N#lFzw-*jL%tdH5rKFxE4c^(H(BpRk8%#p(!$2G@s=6FBGahy2@ zg5z(>dUJeXn(t_%Z8bDWM$kj~jT&CL9mYSW)wjs`b!kQC#S+7koR9A{>8gOUl89mR zs%}w$(ZXDDm|NJ*R})$oB4s(D&raejncNKTDqtu1mspzlz-JAaAteDS5x#~ zpz*L~Cqcj9={&=vAkbL(_~5F3i4*T?lCyU;MIQ@ew&$m6iaN4>|EgXyyzl+11J}4A zGf!)m2kp9xc6re5Ysf?Hy(RZ{ocjo%YYs7~zn}~FvCOF~^q-|-^3byF8@}wQHqBzk zMKR4=TKHQKz8J#2IXPjXx1OuyqTPU_okB!!9jxr4Q;<8cnxgMT?%STV)fC-;T<6Ye zibllos=A`m51^9%(Fn!ruql=}-qZE;zE2#p-iI<74_L&~$BL8>3>N?3 zzl(W17!DRj{Q7@rOZ&orxTheltvBK$`hp*i$N>U(ZDWYHAHWln z{9sNmqv?N=0J%U$zo`#2DqUUC6w#=c;i+9+(LiYAY*by*5+U?9JZ-Bhngqf>Tco6_ zY?Wm(tMnB``?8|Tp_f*)FDtqQYCzg=BJFD}?NCW+Y3YUW!>yQ4HjdJA$1b}u@I@l( zYVi5iuEwHsF1i2-q3oJK!}2#ZM2iW<;Vi)U;W+#};5?i zYG_faKhmaCB-@*xPkZ>)kzNfgO5@99^rJE6oQuf4@hYAqDh%h*$DGrEhM227GSZ~| zR}F%m%MEfqvBsnm0&g=s*=tN14n~T*T4GVdzDO{?gD?Ja%?igZOPBeYF7q`m^IRzH z4+MPS0vx)hYpmlY#>N#F>?ssSYku9pOD>my$P3X8)>=J?6~laQ9(`gPTg^o`F-#xY z+Wz38%m*!fEhiKW|La?>7hs3{aI0vT{@`19*$=`H`0C&dDfj{#F$*;PlF#*0(B!pk2T<;0I-emIE@#6ejDRTV* zf23X9V^%rl*|f)WS6rU%3gyXq$l`IzBp%>B@Q|e+oBK(mO;W5@E2u^P=$VmD1+ALW zZ&=ZRYyYY<|CKX;`Jvd#{jWSe)W^!lOWupszhs%67i{Xy&&NBcs~z}?4l-V+GhW9T z=RL$%0`NT&TBq#z~}UvuC&fm6); z^urdVW#qd22d0t&-(pr%C;_o{`IIsBP?*S&vI%iT> zAzV;=@s}FO#ozwd^+f=EllX`0x+N{a0bsuP`?I9Gs60*2n{;<0C}D;R15tm0FEa$k zZye5x&|1fVByGvwcnz7Tw}og@wGsNrFk)|S3ulDu0ujmv9g+L>MmUg0eJt;*$mfe86&K2LTp1B&Da zqsV9hr)ctsMea#3a*%#uOb#$N-@wC9Z_yS;b$bLQ<`<71x}mM!$KofMdOsphGJT65 zc=2c`c$u|@u=dleqrrj4k*44WSm!e9%Ib<<6xMB)=Lnqk5sN%$t1CK!A6Kg@I)^l_ z3`I9JwkYM+3`J>;EppzMq38!mJH_%moS~?8V~adbWGH$boG)Z33N}VGs`0Z)dxiC9 z%c+)?qEj~vdYynJ0iV0kjohFMw}Y4LnsC%4>cv9a1I!EhbAZ4L6>meQe7r+2z>eF5Jppql z3}sV4PV*g5xN}GY*eYY2$SuekqE{a~cTW$Jjqn1)l_UxJO@-dyPR`tUCOs?g0K2El zJd?IGvB>k~Jd^g}$9MBgD%BKDi5~tx!aB&V`;T@4f0uZGh1EpFj)uJ<+T?gwmw%ky z;6O5twXfKehkzuY2Vj0U2G#tnt0)7lHM>e(a;&2!J;;_2|ESS&}F0>!$>cZQUJ;+9>SeuPR zgJBx!=<=D1=0jIr6Y3|%Sy1B4&tSp+631d$<|n}}v-88BtD0K+#_&Y4$xE?`V~b)7 za0AYwEshc5WnCRcMx10!js)VxX zW4>En<~qPgNWgNAM=h$79~Q7;8Gw19Vq~6nCqQkxj~y^w%}S4AcZa&Om}&rUqWc*^ zJPJhESK#&Yg|Obt^%{`Ae1DFQ`Y@v1qp*K1>ZL1y%vk>wFL*85>gaW|cB}~w9z;#x z(tPwN{3_7^6W9P>GM@az+)e^C^JBYrk41r3lOK21Tg~rm5nhS#mM({ z@a5BDzJtF4#fUvfxxs-)TL^xHk;W1Sk2IK^?+efdR*GRAd7>P6Ku7q+BMMOj0&>rX z(-r2@3I~QEyCKwHNGlv=oXJ${F^k-_3>&3lUgY!9D#w~?E^71`mf;Xhwy~He0Y`Fa zr2_+%=K(X(&wV*_v0u!uKyU>}X~YxhI0hi^0Qw2gVM! z088Ya1w4emM@1ca^6jwS)}v+li@=%BD-~vg?3)jZtB`!ig>*5i6)+<8h1%NPj>5eVgtn7d!a->F&p^zkfeH z^>K^%`{}iilII5_B-yVH9*9501dQ&+31O*&M|V#!0nfV35yA=wkM3S(0!DX>g|O1W zqr1V6Te?fxWwY@$Pd&OjZqt!lkM8h{%Xvw+)#1T2E{8b74>J@cnYu{p9iHzq6y5iP zMV=os6jgr$p?h+MqPvA-o5Qm|Ls30&oXAl09)A3pp=j0<7NwY(iWYMkg!|f(=BPu5 z`^EwvbC45{-n10>vV&NQmju3|wb+KNp~V5@NOmZ?&GCdWFdaHlI!IKdD!0nXjx%dq zlyv$Di>g#bv($((mlzQcu$-+q=(+`Jj*7|6|JLU>4rFskeh%Ab=!s~%v6(2d{ieFVtE|UQA#}^iTm3R&Ei^P z#3w=@mZbT=EQX6C8;@1~rZ+}L%`v#%;W#P!k4rLexnx`th7oTymtn*>)~PQvnf2a$f?h8ldG#aIcDk0J6WWVgsd(0V0%*O|?}? zn7r1U^CbEnT9L$G8z`=zJW+>sIgW}V>yq>))H;@R7IwIF`F|4%W)h9rKv|AnV4lBfHN^+4aImx^}B$Ftj#jEqPw(Y7SS^Z!CF zhBw<-ua5xorTk`iXbD^x5%dI_%j9eRD3ItVzKScjjhXoV#r7oJzZmpXVl!hc3Io~v zQKCJLk>Z^DMUnli$Owo?l)Rraz3pk72EnQVOWx0tGoFr_Ml<1ytmsJ(@JZ2nPh(Kw zE%4C|cI3uS>jukRf44bVDq9Ac;eL(bNAB>bpHHp}yDCa9li}b-U8x z^jH$lqQ7ARJi5FPZX}Vj;SH101^&e8dHse-L%~>FSN_Oj9Yeuz)Rz+*j_q~KmZhIB zoUw`37f!Uzt#Jc<;Y9sVs-M2$=T7>xz`ACzFpxvNg%r;25T?GI?uQl@Id92SR9{r- z?ex^mRJ6Z^MV==!6*-=ioE`4ZZJ$6ojB~X9w=d2 z%KD#t#v=E#%0{u9Iv1TdY1*VEMil=6J|Fvs5xU~+{(3UCXlaqV9ngNd&gSU{PF>p_ z#02x5T-y^{;)7?VqUHEe+ElawygcCkNLUx@hwyi{lmYkWs(8TdeC2LM-wNYer@kHg zqrjV;`b~lf0v~gdGdok!Jb{lpJ>4=Don(nPWVuubmz|#7BTOpQ3YL!>K0dOI1Pgq@ zXgjR9?Q`@HXZhS^WEA*_K6hc%U9J@(O}k)GE-)kin@pLl;??nm3&X_6fXFVySga4H zd99VDZM0U@_`=0DinbCP^~Mj_=vye}eEWh)+lBROS9+fdCQ&**@<8ds@S8vHFchr+ zXBi}T?{|!ok_>j~m^qlWn%T;tDq77S7*S>!FuH6bxoG9qwX(>)4>c}+GmIYt*$&xU zl}AO*VJ@CK?MF$m$$loWDly6WQy6D!#+YAqMM(^LqR$YFLhz5zdA5&y*c2(3fqIvqAG*5lA)&o zwet(~8pQtHWkjmj`k>>2^iPNM(=CTMrvT&>5FK*u8{wjNpT#*0*5fd%k@Oib(Bm|- zml;w*7H?TZeFgDdB|5|#epn9vAX!)G2gz{GiI9`)?})E5eZU9O7CdWVm8d2e8rGwt zTgAqmll4sZE`fU|6Ysa*C-8t|CpJjaEgL?cs86(DbD_4-2PNxB+&B(%U|S3Ii*3cj ztEPFu;t}CtM=x>7?xhUf5r!i~-AjGb)kPPd#hP%ipujJk=9i_O`ybva#60AyQkaL> zTU+FQ(!x}WJ}HHoySX(&R%?yw%cyEVIWbhu7WI0R`m0tg1HKZ99f{B7hn3PRCc`+d z`&*;iOwbAV|0UC7z(X$@R;u8C$@F~dn7N0Q;*P{!0F^>v8p&|`*0K4OhNG+_9^!jP zbevd9zd_Ym;OU7vqvLLx7mQEa!gSQ((_O?br3|geFRaMB5CnGmwbYLPB~!Q75@SD= zd>5CN2hMzPR;jNb%EQR4bIGjTdJ*B^>EQ0ZEzAX@~A&ImtMfCURoQA+~1-$px~?6 z@~zzlV~&BDipE$rg51{5!y`k@JBXij-ZOf7d6M&)l8F>yWS^cH)b$%?@=g#6^F>@V^v^vyd2i z%JHHuS1-e;QniSB8C}{YQ_`K!Vahbbq-0U7w~>zf^7^v;?RFd9!lnL3`l%r%5s~x% zN7;A4M^$Y9pS$-i>~3O1pS>Xu!Ulu%B8o4B5Tc}*0)i#)X7^@U*~acB0emW`6qTaV zL_-&l4kAslBMR6H_TGE%sQ=IR%-pgGhTq?hAF?y&%=er*bEcPz<8-G=-nrtkY6r=c zc^t-RTltmqZ`(fDMkvuFjN8Q8cdjxGDZ=b-8x{E5MOC;kT|Ag}DDbw+pe;NrS8A|P zVb|*2CeyVpkmQFH|I1x9idDfQ;d2#|@Q5Icw+MzLJSqq`Fah3pwIu9T{GM|(npNc{ zcCtIF+`=zc;0K&+6Mn$S?za-pm5Co0iT9X^p9d>E^iBLg;!p4ciNCiJ-z^jG5sCja z6ML$qy?lR{&8+(p|o5`?4a6 zYN7C#g~DGhtd{<=R|;6<^q1$PCp0^L`HJLSA^hcS$pwGm6HOmU`YJ*H%0ahPl_$jp z)z|sEHt4+Tm!|LAPL*oD>B37+bwqEvaFTRXHD;>u6vC*i0fZY6f*(by-IV=P8y99I zZ!!JaL)c|deVsV?`a|2*Qp&fcly6ze450FH!EasYFPmVU4d-Y?ZACRd=<>gIjz;T% z&SLy)AD*MpIWjmhcSU#1pi-}?)JF!8*7Ft6fA~BT6vNv#7o@2!8Xgq%It9DZkR*Gr-=W~7Z7J_L#l%nxJrhK$` zxEt>|VxhUQV>F8>`=Yik%4wuE+=i5mK*to08mY7%P0&(TTktiY#Zu`pw47W2tq5}iYXoUMv%G+) z6uxRyJeamJ;#(qW49!%Kr%y+qexe~-C{4RrAr5bn;T;Nbv-6k??^L+8Iqni!=R4yE z>ioI*fjVD!2{6%A9gu166KTr9fkq~XA4qc*ejv>hE6ryz&HW8eK75ITPyYK^P zp0Ls!lxcQ}G%tVyX}-V@q;ZXO6Q?<1q^a9c9^r%!h%_gH18F+o2h#M$56Jls(lqm_ zg7Run6Mt?S6+X2`kxsRTk6&Fh(oNZCd3efQM^7qf0;*a8lC9h?ZBqhnucCCs2y8#6 z^jtnt9&z8#=toCJ%2v-Wv$4UHxRvX|^Dd7l!kTE65$tJgAnm3lN0G3eK}FKI%f zmyy8)(aU^Z>Z*|#e{c{hSF;gJaB#tBAMHXAu1PN|7(l)}631?g7=6L&pF9dnP4Pzh ziTl(6qukVabTCQ3E1S3?4Taqz@es{$eKf~MLq?&{wry4EzcL306w!EvWcU+>8?T9; zW{uZPlK!dUXuRe~F1zva;&AdJ$@_)kPrs+q#VizE`x;63Np$T`cO=A6uc)>``vY#amKD;_}9q9^r2qA>;rYxtt~`g!19UN1r{CHxYNIq= zKt!Fznaj>Na(VA4H|2%mI2T=?BI>-V*hjA-E|H7}tk@Teee~TZH%6e{Na_4H7wd&y z>?kG34;T3Z_RS6>DwLqJF|E}uMLFY4|7@>|AlUD(?4r?8m&!@aLaz&hbw1MXeQ2jj zt1Q0PcB*tDr%(0NXoDHgcH1VCty41XhI-++59BQc|8!^L8uP%nb@LK@;UKe1U%F^VleibCo=U=vVtl;dl*@f>Tl#qSsz< zsp(u77L3Yr&Nt++tVB=vyC&+>bg(TxBD9xywwcyzi7q@XmPN||$DKP}h>g_85KiHH z1wz0lwg3#!;K|)dxe((5${DSvMpG&D&@Mw$W;B+@g9eq4No3J!h>6n0Q(yMcVEhJi zaoR{y1rmfWb5r(qp9_cMs=zy#5U(mLIsATaWBH|3-v^uL`?`6zI?`ycd78Yv@9f3>X^%3&7Dg*r=tdP^^N6AvJd zmHEC!kpoC?o8O2|ma(@gxdVPf8{EPcxRDc&<>M-XzpIWv^mkj_4%#Q4@YRXB3?7?B z8Ud6T1# ziJo^{3g_?wrK3)RkU`JSmtz}POO#N!d@G>$I#W1o-C>~w{j zvMWXYnBM0Kc=i3uREkQ?26+!GQz@Ng4o!$SA6H585Rs4TWN;|w;{ry(4F5(Me<9y2 znJ-Z=bm8J&BFX>tW4chr$#4~MgN(n-kDG|2I394@WxURC4?Eymw^}e6PtYXKMn#zG zN(ByaCG2%2EU*_A2-GK&Smqjw`Z1nGVw~`@6gkGx(Z3^0)zQ&|^)ty@?_mACB`e$@ zD_eNaSYd~DGMJKHZ|8=mLTG4mbrR$;Q_z0uX-y)7!e#F7s= zvMY*5^>G-ZrD&SxRayEA@C0y#Xn_ko>|0l0i6R*fq!5EGuAiZkua`!%q?|ikx!rqd zXgLolq+E;vlWDrqgB1$6$Py`I3Cn0xg99E3TI#|e@VFYc7|6|&_)A?plIvK5*5mwM z8ZDHB6)u0YmquMdXiauJK{t77h0Cp$l2^0jzBR~Qf@n31E(FpcGf`9^Uj@I}GhP5~ zkw9A*sI--om1$&ty5|XL;0I;O2RY?s$S%yeM&|0F*3DT|FgPAFXojiBUWvAs(dz$E zkIJeMLXnxC^)8Wx=Vj98IqCJVg}gOP&%5p#=A$O)c3HMYo270qx%?BdHChKL-if_5 z+G7*$?xoQ#CLlKlEJCZ!QCT&Dvop&xLg@6W)ag~$=_TO(LxEH_8b(57=@w5&r2a^z z{)kh*Fa7FMF5KS^iAGLa-2Wf{t+@`O|H*_UdU8yDDiu!Qd)~=3&Gz7HqR9LlDQXUjx*6b5-*tp&;^(TZ zmTHj$ne#BmEZzkYcLC$x1?3K1yzv4)KTdN!zesOgB$F=Ur1zjaVn$<#Xc6B-I)I2o z06~mJK1GlRD%cQR#8-}fhsBHrTA~gs_K~K$$-B9iMqZhz#VXH=k3B-n$R4$?lq2h> zNv^vNlXc93lWCggxlii7M(VwW^*%vI$CjYAtaLYo5(!$Tz7X=!f1nW>xK2{m29+DQ zi*>jU=C<7=VWTMA00{qNz`|IN=9_lkE|u8MN~DqQAMB1*TDsjcLu$WACfvgbuhZRR zwGn&NwIx2f6H3EC{iSYC9L_-HdU6ac@T`y$o{9(<_mMV5I+ zt(&-Ps-?^WDsi^|YlT^db81_jP{0Ta8=cW`x;n-_Dc3~qkdGY3~99w#tT(uH?nK#fI(t8K>3JvB;!5z7mcCF7x% z7v@RYMui_`_+PDjlwmRwV>x7{WRQmmDqW5ktOz^})rjW=n~)S>iX4h_TCT4IRL70c=86rsEMKHY6F3(p-L% zyc42BXq2!tw_3x}TtCD)bXmi?6a?JFUiGuI$wG}++DZ`*uTqZ`4Ws2%M;s}7gM}J9 z)4wGBP|lPiX>zSiutnN+3){6JfG=l<8w{c?8Wt#S0N5c530OsOJwi)7i=|iWkXSnyYc?#6 z7t@$)C&S%`yl>jC(qyUgPA&J1{VGw15B96{EQIm7wds<)tHrHM*`Anvqhmn^^>GY z-|7~06Z@9uDB-WBZyhhg&3)_NM+rB6L;6;p9d2fUs?kY956bM*a!*=hdp$nDnIKxv zF9;2Qe9YMfNSyoJjw$<~qg;HRYKxMKwg1e8|6wx4UT2C*JB8dNXiY1*dUKZt-@8Ji zalc#X7){WFtea^0)7;(WCg0*IT2nEzXZ5=LF`Y zI?34%KfpP#4k`lk2g&(A<}3#TFl+GxoHH#>^9V2h%8#0RzDIz>hh98rg`!~z* zZiP4Z-ySVD_dmlAY=-}VAJ`0U6NVFFbAP!^^SDTJOjxGrfFDTH8$XcdKUSLiWtx2= z%|+nAru*gifi!XaK$;1hCg%~AUX*E`mAZZ*!%ql|$w&c=W%vP%_4omd9gG28+a2TL zI{lK#X@0ZPbd+iKiZt4lGJnV82hw!L52WdNB@Ati8lw6bgSS%n zE=Y=2dseuG^Sq8NbU5`mPM_Wy4UyWvsrbu#Ym`66O&zZ2tx*ab|D-Fe z@%*F+Rlhb>{hC#sGR93^>xjNqj;hQeb4B=TWm+nWNVq3`!=d?OplOW0SHA7yqudBW z__q6R9IlEu8-luoc-^LOTtbfpX{`r0jZy!XyOg|ODowQ9g(iDSgbjrnE@M1V(^Sj( zv=r*pdj2&qinHB%if_CZ52g(+T)LTxSf1l;YCM)K2)_ zZkPYY-Wm-DiSMhOEeVgf$UFN-m3qtYewTmqk1AcsjJP;9P!gVU@h!&5F?oye;&v{_ zEyhvpTzvohiMB-Ijf#Lw_q5Aj@RLeQ7!WE&B;i@1(pnJ6@?E(FJ0vdd_0c*HjUyw#7{Qi!d7GcU@?89*2f_(dAkx=q;Cc{$Yv?zw7F7j!UCwVs7H+A6~%^ zJpb@+rYgLfAh)6$li{?%%PpAMtoO`xDNO^3=r}$RdmNhH&tm8$;@E0D4x@wiaU4+L zATGspM=&LB&d_m~8J&xmsI@9abR1@K1&HPLw|FoKq)~A*uPn%6trjYZnH-cH5>J-X z2G286(H^X54=5Ud1kB}nU@A8sp>V9SY6MXaD6rI$#@x833q0zBIpo?nwl{lfbW1xi z-tEaF=4CRp?hpqY)=An%alm045HK6tCF9Kz^L`n2j+ikVdQHX;;j#Ps?d(yI?KQ2~ zfi`;fD59`NvJFPU1`i?EIOawpQC1%!Xco>$Wb{YGgk!w!OEeOO`O`8CLpa2nQ{JjL zH@lXfZ1T*PqLa8F!e*o-MtkiN_{3O}D2W#{Pf3^soP=XgPCAsLG=6qW;6~5$Dt#fX zFj?{c_Pk166R6`>t+9qp$#5*>7&mR^<=p*5bP9iS>6A}XS=0}*xfeJEi|S7CM9SeWnBslp(>%^N7&&b>mdAbhaG+Diy2T{r*LE&~f&at1 z%YU~sXD38F@M&|bAP*J6<7IG|IMe8t!4e+zbQ~*t_}=(|9=-@a(8E`ZMZb!X#CbAF zDJQuc3@4wXQ5-*zWDH_C zmN)@%ujfWZn0FMLcNEOKYAhN-j4(#Qy!Sy?tG>Zl(mS?dln+~82Jg56c%H|`O7FM= zct^irnti;~{qkJ9BivJ;c7;i zBD|#x;@?B=>XOFTdLtGXPgDk{`4(Q0G6Hltnt4j%I1UGgb@S122u9l;XaS;h?}*j}y`j#=jM4aJ44<0R9I20RB$Khj$(? zlhkpN-C#hHSMdW$KF1Fv`N>M+mq|jLgi7PO_Amu!nWHcuk3ubK*uBKg?0& z$@KVy(KRJH-}^mrrRf;4yp|?9^OSWyQXAaTh0jEhQBI25<43y&H+i?LQ)$+}T!b|3 z{Rh^m)T04~WqG!MPmBpA^z>-j<#}Ea0t(on3m{;CC7=Mfls)fXE=-jMUyaEc#DQ2+uKW?H8GUWH3=q7slUoJX|h#uq53?k+wNiPyQz9EB!tYaxaZ5=~K8r#vS zF=esAMif)Z2Rz?NJ?mJ{Iym%5OV2ufF9^e_Bt_w&qZ{0m{UOv&P#VN>i1;26d?0`( z^K^JV%k`dnuS(wIh0!J}{)&55TE-O1YArO9t=@y4Tw%Vc3Od_q3iR@hIt7Qfmj+0Xl6cX zz;Y-pWa4)S#N@i#9|+*i!7^sdZgi9P!~0b_TIO(};{WS@m5y&jbpqi8Nm#A;f4*O( zGaB8L3l0+LPM743g50?oxuYcCC&)c)vLn;=;Yd&vDLw4@SQR$gBUT6Zu+h$IM24|e zu!jv0Z*)_3*W>YM7`>@{Fvv%_E&_OVaq#o(5r|9CXNtGL zM^libHXIrfHX=d#Tsh9~qkF*TJ*kgIX{q@^#oxD&M&FNflmCJ~8XY?xmO0T)G*NQA zuK4kM{i#eCKi@@DCE+VYK;0t4zX+(I<0Vv>Q$W}P$?>t^NShqDg2T3yd@&a-GTyOz z#Pg9RjI|Q;_H?p1RuT`^M+~BsJWX#J@20$XT^+)`|Lvm{>WiVhgNNZh}-R`3w5VaXmNh3w;8Ah4FmVN-S zF=Jesb}_3D(cTODXtZDEb-T-plcO)n-~yMU^MB*`=AA!zNB7a_1IfJ8#e?fFWpKHR zM*}~}R6H7JVKwxWu-c=%Qimq+$>vsjl5^g1f@!rUUBmzFqplN7t3ByL4JKi=XE?h9 zCt#O0NY8REM<4`Se9Xku1UF^>Wm)1m=D7xz$o8Coe&0yZt1NRmI8Q+w+w4u|TntXi z_9Hq?AF%NI5XW}xbAo7-UJ-V@Kn64HIP`==+wo$_{F<=iC>fM?49HZ??Z|x(E|$ZL zk9l5{HT8R(t0MZ|h3?^T%Xr_r&d>AFGnVnb=Zs3@{mSniDhGx$)% z(O0=CJA%BkNq%RZQ?A0(01b$R@vc+Rp8LUhGvb(YiVEL651hhM3uN{tsqAq}WH7^0 zt7M+-;imAo4U+kKl|62|3`$EqEK@bJRANl193ALx4_@nlt1VX*93)?^qS}qP%5tXdZs}+YsGlv3@C8*Qov@+7PV=2h!}o52SevKal2SPBX2KM%szO z-8QKHb$v8?_bNAeSGkFfI8k)wZ)pCf+(cg>fur)lXCmR)m{b@ik{|c1$Pz8qR#m~^ z(%@SJJJrO5EczLlPvB!NySN08`5&qlH)tukUu{_Dqx1gfrtITS#Cmv;9$>C35#>iz zIzkVtm=IorsPj0A9#K(cZv<325>BP*NwxEYEV}D|+)9mPrYOCvezwF%?;>4@qaySw zL;ZoMdXA#k80x62-IP5IF#$am3@_w~L^?H@YTn$~UF#s%W0(nF(1m_iEF<{^C<|lrttA3(|D$e;s_Z;%Y2xr)iFc@!AUmk@Y|3eRdrm*MR7D1`VJn#iYfdP614@ZG!hqlucZydB%eilgkENG(UYX}Uv0 zMZ5r+lyMDoC&&Ho8nieEz^$igm4?B_GVtjQbT@}KGslPE2&8GP*5)=JJpztE1FhrG zbIkD-IO@{0QJdD)NAH58u7Ngj=o^I6;TYYk!9D**u)zwRb1kkJ$LrH{ACqekZm`2Q zU+bpq&L{C9fURt;wbw%HLJ@U8M?H%u%C6+NG(D=_mFuG)fD~?^$2jDg=%#F)8E79T zYKNFKV$xCCuRXukM;ASPqUP^MfSJ(fl~$Q##2l68KLRE#hM?M!Fmch*R`9S;&|xQbf!YqccH@Y*GrCjHGguCN{>u(Q-=wARC*5L z(S$FN;%8|7-EN{c0D-prb3l+67^^ceeljuK*U4^RS0={M*SU!?&b-czW^a2RjUJa6 zNP_T-j_|#ERC-T_@6-Hm>`|%9b#ChL!yc8+MFM(4rN5+%TQq;iCsZl~G-n|D6k+k( zMFy%&;Q??Ega7LkVR{K3Gr_Mh!Fxyy34SAzGWdTaL4q$Z!B>NWsLlI*Gx@(+95B$p?e*j+P0tX~9yF5mF@v7=%uJzUH(NJB6c$Mq+inXDY2!o!M%xOe`nXJK2V z>2e}SK`hbe+^e$alIz`+2L>9w{F*GPy&hBNG(|A79D@K)f`;?=ZW34+t4CyTe2m7v zbZr)0kI-mb6`iKcn3zQi5Dvxa9Z@^4$IE;|>CjmtE~@=G19a~L5AHo;51hx9*){w} z;h0Wf%{17Ma4b07NT$N^7(M6tND+qGr6|%;yA+tJ`wbX)7)e~t{$^qp{pSX=SavBW zCdvsKb@Yhx!PQw*euJC5S1ea)$tf;^)t^@UvE?dV1>yWk)+$MOT=9S8(P$|MnOc?W z$&?`;$V$=ko~dnwS}$5^y~t{9mTIx~^dhVB@C|Ot-T-TeoPWzX-wPSpuOm7&K3W_L z8sq37Q+@{jzfN_@Yrm6RFtlefJnNrzlIuJ#cz$;Y&0bZMJPVj!W#nTgi<|Q9t?+Uv=4#vzp>hC56eT33AktAg{zXnHLQ|WlZ3fVZkA(9_# z&|?Ad>Cqnail<3_itt`d;bQ{#@{#YXDJbd)ZRO*(r%w@s>}Y~^Daa{#aanWRsV>4- z=C*2lNpsq%;;<_&X?k%Gcb24Y)BKfPG`f6>JlnY7RB@VsPvqj_{&LB#<|WNh%)iPKv}fWzBJ5x6NrSR6G3{ zm5w+~nDu~`i(AAb9OXC}`-;Y%a>{AKoiaTo6&P&k8p=yIAkn(=5KKDe4S zRTgd!8Nb6z#ILRPml2Ql@lQBKqmzMP`($G{X(XhwuVbXpg@_h)cMKJbap81Id=*Uc zy@7KD;9Js3lth6Pv9yz;BrcQ|a+Cz>=EahCSts7Yzr^Bl7JoQ)r4dMnFin>--}L;U z2t$5!1}~s|bO!pF4pZHfT?0Es6ZFX$FwwxN=(ZE|`58EHQ;O_*qgzzEN(%nuj1IV8 zJc0?(XqqH^dWJ*$S(aWI2cPFj-tW&~FIXtK;05f~cS-sWXYd{2|4x;6gcB?c#{f1< zjxPnmea#Ublk~3y!c`{1%|NirEug1D;s^~Js0Y1e7T&EsN8w?urE4E%=}vE>y+XOY z=Tf@z$ME0d*T@{OQ9W#ac>5hs4`J{PiUUwjjgJM&lZFvZqF(xdL)XZz?Lh|GRdMD1pdw>atp5w(Z8 zengaQ;?($5WjLe<(&4yilMi6z5+YimIaF(`HD7Au9CW7-JzbQh0wTKCX}T0{wZ>y+ z)9?}Zd_9S1y{hCSjfkPAjNqUUZRSPKzv0GaY@r@9l5`IfJk#V}`4^|T2+2374!`|g z`jey96}_j@Z<2SjN*t!sMcR8*@eV^<8Q!7#@u0*>)6mTP{kBR+O2SS-@G}8^{4Ytk zPvx3$>gk7S4?E|k0(yfH3mN8@RoNl&%z1bE*i)}G^(Ue)T|9gE(uJbxF%83_M0Z4E z@~%Z(~y;~aJ}O*e5! zpN3T~x|!3BMZky!X*$y;p#<=vXou5X1R*!6#Nk{Sp01Mjs!b|&m*HDf|6Q9@x@nr5 z{OdNUGzV7vKV_vSed_5itTb1Zm3FRJ%kw7RR;j;~Fkkf+?^EeNW>6sx7ujL*?jWL4 zGeQ;NY8k#=hA*?j|0n%=(Py5vLcbYu~#TCD1?L~;z?Yz6rS^iXRJv1_Yq27i0JPlkZ{#BH}PTp1Y$60 z+hmpZ-(qBz!)N&?9{Egzk9JOTQ+D8VtRN@ox+BqbJPOg=jz>>-5mdYFNN&gXPm}HV zOW<&72i>ZSWHcPpt#+bE*Y5PC=R~36hd!n2HHmISANuZp7N0nBWbIIid(l^Xe-_ej z%obz98?(`sy#==$+gGDTsod=B+{Jx0q7JM3YV_s*MYCRAyVKX65kj-+*-FPmf@U(f z=NF)(JG@z<&&YN(E4Rt&?Pyle2rQ7iv$DAnSR%R59Ud;9z3CfIXQ9Y<*^b6E#8$!8 za#`5ldg=t*Z60Bb+dQyFn;YF3GWfXwPSTUUGmZaI8wWC)o)ROS3|rmD_vqqIB%(`Y z8C^Q_6(3Pvygp5I>7RG|=(rnkSfZ~+t4?R_#-7wVc5nLG#BLPWjljOi!fpii zY!mx2i9MdNn_9>2L%*2V*9h!ufW5-Pz6RJEOzeFUd!oYN+gk_kOTU`n_!MtAhEL}L z{$UG#vI6|QCjRphf2zQLp>_Oz^qYx4T@l((XZ$xT{OOGUp^5*h#GfhfziJ)7KmBgv z&zAVJ8UJSse>UU)ZQ{Qp@#hMB&rMhavD&ZZ&fdKn{b35YLkhTq1srpe>F;;2fRk@> z6FdCJQb3as(BUuwy3;{Zz)~q-DGNB;60np7^fm>2B?T-O0tOyNKo9!U6mYi`a5oDm zvIN}C0?JJRKS}{>gn*HU5zv$VLa&DgVWSkVkpo|RAlJ{7Fvs>cqW}MqCoZXDGv~`@m zbe)N_U*hanP{-C-IQtoAOY1oO=z0_91&Q+l5Q%sysB+e&{^Sy=h3FG|HI!+IoYU1GP z7uvF~8ArR>tg2r#&Ji~|yV>SdzDG}*X5#!L_4$c$j<;}rVw^Kt$LU2kdgrOafeuQb zgACN!0y@Y*eQ$PC&S>o4|EXNJ+DAng5i>E1h~-R4Q4c?|TM1vHO=Jkw3P z&3D0WCr)=$_DN@0cDs}9)&*Q)x|8kJXF6tquv?C_+k6+>Eq}VS+r`tR-DZHbmHhUj z8D@T$Ni~e+*C_5Mp#hg}kP z7vp|y;qGGGUx15mAq|wc54MWilWsHheN5s$#<(=YEQiM!*E^%Ndf&4b%{FoNNt}I* z)6T-#$2h07j?0x0>H`KDYUS|*#<{q4 zoc?sX_f&!Nxy1RLaYk7rsc#*pJKbTH-EUH# z-x%i_3+Fe+nc6x|54zLDnW&03b)t$k^%e_fqKYo|RBiK!0`A)?%uGtTE0&T_{2p>>>owA8dS9zX-m8pb(j;j946Kr_E# z9QVxD+K^uTX_=|dW|^#a zoQEXNLyXhI!g+{s2DFaTgI0J43O~dXYp~BA#u;qk>|vae)^U2$N>iU_v9^Xqq-PmO zwrS5Y%J9}vdeJHq<$%o90S2kDv^l^yqg%)6O?R6(Z%LfD7-y`7^A_VwXdR~ytu}E! zlsF$U&h-|~hm145b)3Gm#>DwT;(Wn4b1j@N7-v!IIQ?j?iSxb0`JQoBSvcP_&ZgFJ z`qMfS=QoM-8{_P>aDHQ)M_a||(~Z`fea_!zssGJDvef@(l>M!vbf*m_$_<+A4{y-W zs7jO@G_ikY$ zjYeCDymr+Q`q~3$e%PU4v=JDCClAc+vU|OFrT1S%l&j?FVWQj>yM5GkmYZ_)q!H7p zi|U~yIn#K{)+jvPN zfxlRjzZ6(_T_YR|7128!cO~L@lbpU(@W9@LSXBND_Wh_?W|ax46YAf^`yls`IJl`_6F5XTSK9AE8?upZs`qi%L(*MDnCV5>m+f z?J*i1kYavOI;ib5x*B4RY^TwOXNax++3j=l+G#}IFIK7a{TVJgf{50+a*w$ip9LUq zKM>CpymQ*;jzG}cYo$uwGX?KWuG~>8nU{EJ|AaGz34c`_OZ#V@DR%B0OZ)e=)5tG* ze^dM~w$o@Dlq+~%r5;k?Oa1(T=T(}2i<|soo>yrZ7$AIrWO(;HKZI{aewk1#3GWNS z!xmwLBz!0c&w?ONT^Le}-^DjCEMp#ERX&}Md5nVgSL6MxOV*RSxK8BX zii_+!=`hxpmGh z565Cg(%-e*It;Phd%n`ti-?9Od10aZ50-RA5fI_F058l=A~e?_7)p_^w0c6g6e znocF6_puX*&FA-hI6O+;rsq_e+TKMVe&FM`?q{}l(SNWZ#b1G#D-DLPKx8P04~-@L zUF%~w9h4snR@9r)c6t@1sUs1+;+5V0D_(4?V;j9YVjX+xuXuUi+s=6~&ZjGCqT;Ap ztsWR7zMCw)_dahMr3qgUy%|}-c=To;T6yfFcO&IykuMuB6%LKoW5I}#JS1Ruy8r(Z zP;3rXIrdw5Z#f-L@^cbpwKz5;wCzK?yqAfM!yDuWl5b#TkGRcE*-he4WM9@; zA03a9wABvD&BTIHwK~T25zpkYIeOCr-pz`T@TL5c_m})7?_5Y&E+zcng@pc) zki9|1{mOA85ob%S#7l{c+`Wahy3>RIpO%V+BjH%uNRGyN%gI!+B>!!YTfD8xCHe95-{Aa&)>!seZ>tlW)UeMB2hPYG>Z&Chv;*F51!FMS#3t z@jpG^Me{RrgS$&C`(f`hnvng9!gsP?VVEV5ogjLJHF+GN(Fj44A1qB?;V@-C3d4oz z8wEF2y3KYIW$#CnPCqHQhEqKoAGAhHn11Fo6Tn2-e;_VJfABTm`H1729LJs|bpJr% ziy6C^fFsH$OTt8#A4inmvk09f;TLgs`KUQ=@;5A3>HIlvXVuix@n|^ESWAz1<4RMI z_`yq@!lyIu%J8vOU8)ZU#o9o-iREHz9CMBAp}(0;0r%2m<22mP#C?oOmQiV?ar_056C~6ME9fj|H7# z_INKAnx>_uX^6QRVt_?yfZc*17d8j)vZSV^A!HGC4TRztBGVIIe5hjx5lvB)yt)|v z0%!+-@OfjJ!r^Buq$zwboL@$r%?E=&nv2Wt$z&`}JDK*=T)c7!|8v|H(Z6JJ79 zlSW;{2&B6PM(Z)$MS0SDw$d~J$L`uFc>$uA+swMfN1l0R@x9#Ux z<)WcP&LJ>Pw-}OjC?9T#NhTh9g4`&{;^_E9Cm9#EZj|Icd`+uqUPe0+h{qbL`t+jx z-dcq-eT%B(HSkG#70=A9LYBsnatmK;cJvaQFeP67c*?s#5vj4B$En3N;;l0E@cg>gpI#|?#_JK{A9Bm1X%D$CzCO#T zZj?tup#VMW{mrE`^(LaV9z}jZY^?{aef#-l`L6Y#fCnNRGmPK_BN+!fium&RrW>yH zph{5AIC_hJ{ck=zK4L`qt7LC82&i_ubK)JMVwDsr0Cn@%_>M#%(H{ zFJ#C{*Hzpkt0^@a>3I`&(lHWt(lLM?V!=*2hGCuEgQM;`pk6ScrkGGu7^=*Inqor9 zJR*B~GO3TJ7rpZog|j!`Ogx_xUvfKIaH9Fgpasz_sQCgaCu&6L&ST&US0a!9Y(^pH zC2ubwW}7Ky8;eOvG22+o|12@vgcy6Ig%?|+dZH!;@1&QpSbH3Q?oAwu?oxfekH|Zq zpGHreY+C=(kbig}YY4T6(r_r3--Q=IvPostSF}t5eD=ok@sdK;I|O&633!E*LeU(RhPFuX)EPO}7!zJPhOTP}V#i$h`=w z2k{`wJno!6MmUuWfDumj`|WN~m)<+eMM!^#!gcA$1*kG@n)+$gMEC|s$h1DU z)q!|oJiX<`B`l!M!6hsdz#JE9`3#^0Q|WRHcjmZY^La9A7@h){!{xmOQK@9W!L>z3 zIk=u!U^YY|72esM%jut6;HDgIVt4Ve>`xZBDf@f0ory+{euSg{Ko)F=H_Z}=BQkuFG(epl@ zTRrbXOIC=~NuzF%o-#l}T&avJtE)4kF1f=^UHR!9MWmyyDg6AV%tzEUUVCLR-%K=# z*#}|qR2olByzhJXA|KU4FK?%vDrI+Y5!86W=RbF+N|8I<)M3z0mFn?h_)e9sxx-Cf z;~tfc?;zG39(4P!zDK30fFQ5FQ>D`+#``{AfB3g#T&@y%yDd|xi$(Wev`nR2kkb49 zc9nWa!Z$v@vO}fSceu&#-J#N>klAjBN&_UrKCi$34wd$UA%BNTA40q09V&eTEQjkf z7|C$m_|kZ~IEHU=z;EC8hJ>Ym5tjait@=Am$n(};#QFnUW3ZI>hp>ivr?f^ke!v?4 zx>H)CRAy3IafFyY@P6VF8vwgBB`>B&4WeBd?w;h_ z=_Y(hDTs&%Zpflxce*JjNDpcE9`Mm+2*k(GLmI|4acJ>!KaHw8h?7YVXypC6pGKF- z@Z*|y(32_|GT09$!sMr`bm$sWt@3z0QV=opSbc&%^bQj15+5I}UASJQNgZ6Y zmT=9q!@cWOdJ2X3;Chu_zSB+resVpQxS8+POun~GzE5pFXVE6&k%(nT1S*YWgOTKm zsh@aHRGQ8rq64_YV>L(M%1Ba{Fk0nM|{NF57>AWWRvbX3xl{U*1zbGQSLx%s5;fG{+qKo(vuU zGctB+M(isx_9iP9)1!A~>`WI=pFWeSVfy5#T`lZc5Q(P@`iy5M$l?M#%@rhC;DP~% zNkc8<-i8geRQ%*zelKM%bcyh9GQ1SWeEzu%D{wu9KKG_Y8RBFVL_WqMYnt$~IDZ4; zG42XSH<^Vh!dymp!hm)&eJo02!ymW?D@tj%%fJ5*l_oT~slz*esB}FTzWhU_BP7El z&F?#?(saZRen6$;Wc)0w+aGsOrBh_Yb(+7&L6zpBT)hJhs&tklOxFCyL6sIUA$CwD zzfD+hP^DE&SawjQZjx}b=6~d%N}E6sMc!9Z_FBb=A|EJY_nWb;72XIvoTe|hM?~2j zkY#s(4Y|`ctMfhgXClzc3B?2N+<;YRMoCsV$Vpye^aR zmLUT&LK^b8g>H=W52|#fBuGP^#snC0tWAI+J23%<9486VkmrCvtnRgv@~%*~-$GgL zL!lPby-hMmbt@5%a=%l?Tk75=Bc!?k$l!8cF9}lJ7!#oGHk$x-$1?%yJ|qcJ-5Wq? zwJfV++(por-W95-7rQY)3KH#BQ59z`bW=_;L{IUD>=q%^XofZ~bW`V`5lQRxjJOTP z`;Sjb9UfP?+1ibKquF})-x z9#!eGMQFC|uDUJ|OGoG{Zx5xZgos{Hl{|DYFR*1pi`Blk6(lr zSd26&f}gsI9>omiBiyVzHYr1bVd%hCnASMjhO` zQl&C*VTGuTFw1ZmeyL3^%p$)F7xq-+Tr>w zD!qz)@GA=ACE+oZUr~4;8AnSzQO5Ht3OL0vRYp9e@`cbZ7rTi+!TmF!Y?CzVV~hm- z;=Ru$?#@p?NrA4np9Ec%CE{g*J5E|K+DFGMaf`13&Xv%!P9krJh?=Z$?sB{pn7bbT zii|9mwA)YOjPzK7x^w?Bl{QJjohLcgwYSR#$Z@pe^CL8RQ1UK1Dfg5kHPkCKUVCKh z(vx_+_N+|HjTbENs-!PFi7hZ-iL}5)tOF1}mK>`E!Z*zkewFm~0%5p`PzMCth6Wb@ z&HajBy&Z)mCv{YE>Jl`iBWBWLk;1A2&IF>*`pvu4Es|~TsK7mTbVS26VTqeMCj#^s zgHTQ?LA&|q43tc5f*$A4B81o<>9vkHptKq3u1R*Y-(NwNW}4$(`58(9r=ZqE}dL- zK9M-jfpZzXB>jhue6;Cj$Z^=kez}8w_fC}-ncaykGN%(Pa{N*>#gSlw9_R$8?22$A zL62~#|57()pO35wYwYd>YYbTmr~7lcO65}g=1%^ecd4W=byMzuyHujwLi|hKV~)`1 z63O&nr`*0ru(#o)N}Y_|-HCISZl1HNEjs5c!ZM#aMx!Z`Fg?fr@i7`rWkTn@D$SCF znK|4qq_CxCwS0rP4nUywpuz@@aItgt@n~|6e|hHXwe< zUn(u`@JzX&Hy(9Hwk#6JL;M-=Z$k<$i>@F$LN=}{VeEyFht^czQMbPzd<9i@?bnVULH zI7*`<@ngzS8lA8VW3o2Y{WY58>#Q_+U*D+GuQK_Zfn?V@JZ?qT`NB#QRxFk%(x6ND z%ZR*HyMniB&s^rFoB*vfk{93s#SOgFF&x_4%9~4SDI;B-2x2j5D#{tU%v6-T zdJ#u6m2QPuR0BKVDZKXvXHgV(8rNSVZ;p$=f2-nuy1zyZh)=zy($P8MjM*~HzwtGd zu7zOdG{+&j)MzY@1xn+w!A6~4A4$_R-_=5WY;nYzQ)!;^+Mq0&Ce)d)+&n0Y=0WW1 z{WUs4s&j`z-ZtlI)Lw=cDE?9BYP1-9P_J{QdUs3p%+eGqjg>~aDyatyoWG(QeHdL; z64542$%_~bMg%`Gw%rU>(zIE_KxgkVH)WrbU^Gu`C7)1$D2UvQKeCxCv@eoXlYb*wunzi6LN&4TB~@uGZ+e%0^*^LIc`83DX{ zk)q!?!STy6B{b6XJ0}U>CC)7JBUe+juItRVfdhJirm&9Ok@8!=GMwEHS%?Pd4-Id3 z&s>4N22UlI=C}w}_*LVll2?OZ=cd_v_&57{h#bvu^P0Z>9R3V92BG(?zzq{D!_RPI z(scg{vq2H`mdI7(6a4n}bQ5{8Tggkph?wC3bGL=Lm@%KWFc&kOyzi}3=@OZZC2s%0 zbt)ZL;U>SfUZr;qnV%|S96zx>!<4$gmb!saKeeQ8V5#3(QU#qH)y}zD*vw!vO#xe* z8*D3!`P~w;mBpwlO@j%#!(e(aSRr;LvClEf_qa3Tbs1cjrP58rCYq;UL&oy+wH}mw=T!UUogpdzdf2GX5F`2FL#Oe+tV`b^KLH& zt5?gk^8NNHG8KlqPMc+{PgWXHJutRDoHXbb-+4;Yy+m}8lBWlQNurA$zQjl6E8X1Q zI{Mg3BbpSCJJGGa^F^YOW}=ZuG;$@*;o(h0cqD)Qt`btTccl;kr1{6)^492s;H`0YOt(&_Cc;j9>{BG}{yr zFhv9)Viq8UhyX;~j<8ci03w$DA4Jd`Q^IId!e~fX14JQVG$d?6*eQYEhTX*yENe9{ zNwZMq`pyxCYA|IqK*riD&n)VzOw_A@`U*6) ziux)j|1P4O%3lTZdt*mw#Dc@yD;K?{8SlqQUVPj$Sj zlM06tc-xrn@O|D^kZ)Veunezm>wo5PmCjn_rVa-lSLu96!d~c$ zIWFo(M0d31z0jdxz+PwoKd}2311I)E-^-WJVX zeJmZ08eMUygm>%dPTv!X(lm#N>XbYqP2wv=cdx=i2sY&FP`;ZHL_a8k_pLJ9(>nAe zl!G%dA(ZB0tK5`*kUK>qN-;z|#hT>*Tcfs}T?9c1^1gPiMn}qE(xF!<8E+JNHTga| zLg;mmqTrljIZh1R!$%QbhB`5$k15C$+}3qk@hR74l%?d4-PGai z0UFK3k8=lTv|=@e8aVaUNv3&T@#ECj1}4Nes+1=Q2NeI*jVe6>u*DlydLGj7b*ReD zE^5MCw)}CZ&p09CFO%`75;2e=f!-8AKbk;)n?TcL0s(Z)8mI=KxiTI=!v<)yNCLg1 z2;g-x{Fwkgb&Z=?!<;p4@%^f2B!B?!VFAA);{lAUzAJ&g6F}#iKs6?i%kRwU0~S!0 zj0eya%T+qgFI;q{i%(QP2_PJtegi2S4QcK8w4p~rT}$*aMrnK$&i*a*VHpkny-CH; zH%7FHmjHiVV>;RerA+x|*kI*z}nHvSE6 z%BxGpqh>@8M8pt6!!rP2s@3B0d?2W&b#YdsJ1zCSair4JnTWpClsr%p_=$o1;0<_w zB$%Y{wOj7=(Paq6>TvM)51t4Zh=_(`bPM-k(>SP)qgy$+oP*(5B0#rs#CDF*$0Y(Z zn`VRpcKkus;GGR_%ASIly6*J1R=d9Nti4MPg{h)Bw?x`d<24B7C4YpS04+|GT(leD1tlNiYNTT4% zbED~QceX`lC`S}eQ(Kfyn@w1m4q(8(tSx4fMUyNBT!50InV)tFm2#K9s+fB zwX~`2l{aQlKLo?UakQC13O1oC4$vq&SLC*-t$+FejjA`fsl(g>8eOpob#D0pjgFNZ z%i8+)4A3aD$xZ%e2WZp))>j8;bS-{-FhHYe`0@1sjc&sa^*oIhG78$7vn0wUXU7b) zM8YwnJ1zHpsR-Mw@+vqNv&suo+`Y+7d1*ZvGSZ0v(JHJd*Wk9%ZmP#SNf6}}PT?%6R)SA3IKIc7mGtRnCSdX;0?NL{1&Jg=l=56N{= zPHlZ{ZN#8<2WI+c`XP|@Se#b+h6?ERa;>U8Lt|pkEl9?hEMd-0|@b+>SPt$olhei z02NmxKDCNvvijwXD2p^r;a|TZH^NM*bUY#SxZ8J`P-6+sEfOtZ)?@B5%XW!)-qo(# zjrbZqt%e02C!*eB_qR7Z;@|hcKZtsx(DM+85%q?l`&f7!binaazI=tA*7z2+6R)b{ zaR^otD^ElRSc?npaZ?WVIo{;Hwe%i0b*{6%$h<QkfXHa8HC-Xfau%$=6Z5cH83!?Ua4 zK#2rB#;@j|w#7}9Jr;542z|zH=Xd6~8)V#%9Cr!F%|~1`L92?E{Q(Hk1U=XWxmg2V>f$1(_)r_HO>bpB z@99sfbZi&#&ipHCZl5P{Hi3^aoGfGCRQ>7qRC*Zv{00B6lCVVcAKgWx{Y(JPd6KX} zGjRs)RjE+M-mB&6dl?;**-{z%j!NFexf+d-;oX}5rCg1^-r^?zo4FeOw#7{yKF-zX z)O+1R{FPl?G?0k4Dl9(dUNjAVtyF28By3l5d#-{Y;w{%HT}1BoX}nW;A@l#7tI-@u zcw6M7nh7{*w8|z_J)_b%COo=DrA?CXr^Y*v*Wc?Fd$04E1G`C2OODUPmk{3Q;@Bs{ zHRTT_{Y&xPf@R3mZ+EG5P%=(+`TxB_r5EmXQ;QE6_|6t9%3Bn^-~SeP8divmLc0^s z7Q*E9uS6{=nE@2nAR!aR#BVI(CCd0S79XrRjp51&AjTg=Cki2)ed5?IxL&lCT{Jpxt2~gk`)uJw{OO60dTR87O!1jpREl?Hcv2hFnc?D}$=KW4 z_)%4AkQ?^0?2{+yJg=(&L^%Q++gNtJ!o54(^qn^q^Z>xfMhC1nuE# zNt?Ec?dK;rM4e-_mm!_gAlaRs6V(%`u2^2K6nDMW`OX&K|1uJ&RtlP$w{`GjXFHPK#3>mR=iuL!eh9 z(Hh@l)3fL;EBP89r{~XDoNXyJ;S`NNZmyI8eMCl0tv30F0oNe9^rPun^o<33sX#5b zTcti0s(!ahzaA1bKNw6JsZ=KTW(&N|Gb4+R+GhGdodCb`Zk5hA!80sS8?TQAQ*1a> z(|ati%}S3MS#+X>wpkR5ZNVr%U|nJ8K_l5U5RWG6(?(uhl(zT^l_q)Pf1C3mnr-|L zP5W(b@*Z`bMuSbA{N2yfsM|I-`TL)zQU7gd9~^~@JDF8_ZG<;I{8-e7lzV->VA3ej zYNbmz9}Pt^YeLAoS9lpltWR$Bouf3dABl-bdyH5vwzAfq4RwgrcvptD`8ryOgW*&{ zPX|U5MF24>L#W);K*f#Xp3-(-e=8y13i*xKrUKi{dqBVOOgDmXDj6UdZs2fuf`JG~ znTUv_5lSKA`K~^?DMM^y?V$QPF>=}AYiCNda}!VDtyJ21XxjKNJ~VwFR~sV233IdJ zW_)0S?mtxeT0Iy=ercD(NOduyhqcMMSu`g@QIoj`JJgIOfrbp=ELoxCfbJ$dm9Eu#}hm5+>qlY4f;yB^bogOCD(yz{MEC!EJ}re-MkdmdIjlYka%;-ncy45CXEpE06gl=uNh|3Q_+CD z?!MobXBiwiKFr!E+ubDQS|aS*ZnmrsyHF&K7NZe!40;M%m!cN&u~?oM9San5Vst73 z=ESIzg=bET(953N)fj6|WxLjh?Tn{=*IN1|h?Hxu@KHBFjg^6cfJ&00V08fV&GCt5 zKy_G>d4~HpuI7w$@_Zkam^cUwKO9aXFq9j7de%2X$!q9JhY;m~Ts=>{W^jwk7P-@h_63zcQjOcM)%`G>e{V9L%tnm^cWm zJ{-=t3M0hd8KD;)eE~`^Z?cc>F|iQ1|8Q8LDolq3+DpDvhGu7;pGCV(Gz4Ba92!r( zD+8mAV1<#2*CzuK`DI^Y2J-HaS@fQXjKDXCLyiXYz-WUGG|TXgh>!jiB!%eNa zY&4b7WAuve$_$0RDf7|MJKV&skHG1N#i>l_G3-^+tG*L5uuiG)QJ#r~K%c{5g#v@Z z=@h-@^JV~TuJF+XCJ+Kc4+oS=7=f@Jq1S!wGmtK-^3la65(1+RhZN$hz0u6)_s#ZE zz{EiyayXoX!@u72t;($2jWe>S-h@NohQq23!$*+vm%G+x@wZR+?}KY&;xXD1cA+&^x{f89?_x>!Tee5CYE~4yZAn9D~`{ zyUl!k{5T(dVIm>$Xqds1@xY;Btxln6MXci357tLorkG50dezk5GGx+t$yF< z&j7sx(}bO}4k2*j;XtDf=lH-^lYzE-Mi#X<(GbWz92z%1gX-((!)AtieVUJYnotOw zcQ~kMStWhs>zSd@Co{6B&_qF?^l&IclDIVcv2RB+udmFa5hf4t55d`@Kj^JciNnOU^X#6@81;c%@*+DEtdr7xN}%8{33(Ss%&0#6(c z4r9^$RLV%=l%UY@%Vz!i#mjy4oC%7+Ylj0(gbU)abTS@^7)kodcSEN8e0tDF@0)lC zeECm!m-e{aoOB6S{Mt8J%_x`riY)rs#6qC$eHraQmYE)Vd^`@u9-zmH4s;_-C6_++ z`U~@3dgEL>zB|W1^uz;i-v8D8ek&d@6*vbL9W*{|q!?|YVv*}pMlv7ov=)r6kBwoL z5`CQDnmAEwjgRHE!c?w@49R4xpDC|IAD17A!~-nX#Iu#tQ+mvZVZ|UgD4b@cZ2JU4 zab6RUk1h<+!x2(0^ks5X7^(V5+M?OeQAiGlVhn1l$Kyq|I*k0SEiGP$naU;o`V7@m z`NJ<^@}vJq?!olk|48rMU2r^pXpX{)l1fH+`Ox%=!Bv$7<;?MBbB_FqlA(I4cyRIX zd}es0IYUWtd1aqomkiZYC6$8Z;pQyE%F0TM`t%yAr-oIEthUCIFL@l2^oDVj^@&70 znKpuKVcYOYBN2@^q{@>q*1nA>nZ%bxW#Pmm7xBir_igQqTmbj*W@M8-@S01Q-;L zN2-$b2B)@jXC?-Dh#pA^y4nJ~I40!U_0LRM9hM|_i$p^WQE%I{px{szvf8!~A-e^EhbVkd9SM(UK^KD| zuBBjTX1zs$ORFk4jcwSP!u+EA;!=*ab*w2YEh{N3;aFQi#8!^1A&X;o>VBxVR2JiKN|MWIm5_6m_|XmwFx zd47=~9_dtL@bH?_vJCQ3&Bz61!-nOTSBkVJ*~H5Hnu@~8s{D#7w$sFk6CG6&)Uwjb zs{DeBOsb9ba8dDh_-7tqKk(Ki5aRCRaN8*WV=>_Ie(Be ziCv`;J*Zl^pk192JEU9~)=^@W#YGpH0`1C+=<3Rf?wl37)*`yHuxL0(J8D8@F}Qnh zw4*9i78jKlOObXJMRfkK3Q=(!?onA>R9SV=kYU0k4p*!!E-Dy0OnB%q8OAOslXi7f zV1_9ZraCr*yQ;EEL?4$KT_vmbznVptRda@p&xo$BDB{=?GGZ?&C>P8pW=0RG9L3yD zPcAMRUS;L~LHN~Y>gNsEmI~-Y3%7zOi9nK8OkYQFDhd)b-na1JMl2TnNO4i}ll2TD9 zeAwaHl2TkMbaQyOq*PW9VnaDRd{A{|P5$7D{9&S9bmT`;3M+)g9QgsIY|w=!#gQMl zKUz(beUMR17XF9X66v zIPy_eGor$ZcOaG36jT)Ei%RWmmCI_XDymCGALf`u)Rdu{9E7~F1jn!nP{Ycsj?dYO z*XgNrBpxcQkMfcox_sN8>LPJH-KSTHo)TllzwJ&(k}5}s>%?fPmsK#5G$^c#3DMuS zvqgKeglF&iarwdBv!Af*Umf<>E(*tjh4Bcp*!HnV=0M9fkwq%5(*t6-XWQE%7FtBR zaMOCIP_`Jhq_iHAZ^Xe2wiv{xM;pnCcwFSw7LwLOm@;#M4D_OSGG3n!#{|iCo3xIl z?!Xu^frT8~+-W^jt|#@VFq>U@(|Tw~IHpI!6O1G$u??EmL&Z3g3n07ZLgC7)(MdxW z69l_^O6#E#BZ}p5A;j*X(t7CPdZXS5W{R@=sz*g$fL_`?U?!{{B>#R|zV^o4IodPVa52_E0 zF=Q?$ItpxjLeTS5skqR@Q8?kKF*KY?mxN;?xm70|7BqSEam{$TSvA1qsjRPU#^X># z;*{1$EjCdmE%ia|bY!P<3qe)!v>tJ?EVI40t~e$Pi=p4di4%YQ+xB=I8o=Xewk2)h zdLSKcFlth`)eZMLB&8-06IH_QG^6!tW8AQKV2qr8+L|z>GGZ8sa7;{#Y;y=&A{>jE zG)JKcBA(lK;5t-gdWqdk+4VzE%6NT&b75B!CgpP`A=jSK+8J%eVp*wKX3Oy!aYHkd zX4$UN!;umC7^7UAT7^MvN5_I7PX3tF-u4+QEhe>cd@34`G0_IMhylI9h=mL$+h#S% zL*mJR5ehKXZl_Et-b}Ag8zuU<@?<=aVlLYXCYQMRZ88-xm)&@oT%zJ52W>1jHEETN zhLISdW0yh*u?xy%$xq>7XKslY#4azBqcWY0$3jDr@#qLcA7gXcRn+7x5NrH4i{09p zEUXa=vKu;+R%N8p6-=|6J11=f)9hByqzw-lX1Cyb$J{T9c_8`Tiarp@cwp)S>B7@p929s85q;aVgEiQA|a|e@y zhZrzl`xcdl`+1PgYC*EEZwswDwBW#^4YnT`;NLCC)#gGqMh3z?I<{cql_Ts&K?!?> z##EijVnIu2k<$WUNLVyqb_ZrA#^!USkw!x-#M^7^CQAwL{>cqtsF2$NpH;wktV*wC zmM$$=ig;_97v+VPXSZO%NTfK1JrKsoJ0t^d95TJ@A?YPXRP-&(bIw2U45?4oCk2l^ zd@yrdlnUs=VBK4!=iV?8k4G54$D!%Na7Tt2dbVKTnmWwTMPp%)-c8{nFu+RaF=3_N zEz)07VTjQg~B~IJ#&@^XJ_iw>c6p7dB5pGf##NMkhGr-Qk zv;i$rGmTAXddhh%czBbN)1TjhX71uKd0-22g&r`5gkxbQU(kZgT1P92<+A|H<(S}^ z8Q>N%gXs}_~#5E+IEYY!#C03>d zusu3~CUHr#VC+#tO`l%1a(BxfG}Zh=uC4e(WxHlbSnQ|qW}Z+ZV`($32gY#sYN_Eg zObrJ5U@1!mabO+xv2%gSfGuZh!eO@tyqOk}a}^BWCpwM939-fK+;efvhb%gFb;SH4 zV^=W}$BKWV8HC-JTImPz_a&Vuwvkb`sdBm3$vJbX$X}`)*4@gQ?Vp0u!=l(@20`g= zFE2DB{ZkUW-Y!P_*vr8Og|O8qtoC24BG#1X@LodsQ`UkfE^w!J29Js>HUfOnSM+JAD!LhS!SBjcKtO+(>T);-t zaJk-Rdqq?aHiT0~bu5*!HELS}j*QVwYOs-@vWy8@6(IPb_Q(n z5V4lWbUPa@=ve-Uhmv}f88foQLms=F>}pXLj)kgYI1?V`MXDg-MzU>s&uDyf9sk9!G z%Y_+jX-!c99`r$zU?;69Dv0Vy(casN%h1vNWC+Kj@~6vUBnb zHiF>*EL4J5*uZBCbMg&IVqGR4(<2t+p@kL)BZkFdmt!a}NDqv`qqQ+1YGX5%c%^_7 zg5p$yDeMFm*(tgz84iVvBw9S$*9=tBFmYm<6IRj+#s?yT=mZ@UD$$dc8G}ZJ5gZkd z**&aXPR`ShrSX_SUuNjwB(rHGEVJ3_IN87=mLr(SR?Ep`uDduGZDTtbA(U}!A9j+h z4(-sXF{$C+qq2)nc4reE9hwuVGOb4wY=L7gavs>J3y(8`m|t2oO>|ne32ly~VHELT zMX=cRu~_8VilE!3vFX+U5<5f5cs$Mi;~cBl9b8l&S5_M_(oU*fvx7-J9OE-dSlCXD zjz`4W_L3QPLurmfF!w-CxlTGdlu%$WP^x3;aHKqG7|}$U`d;L7Oq5K#x`9Y>N@3OESvGq?W}DcpmF+OEsw_dThK!c8V@Y zLf6U&uAra=d(K{03I&9BqWakk({dc0Sy_XT6ijHT7{ED{2^w{Ha1nL8BpeGz zSXwke6?!@xH-{=tyl_l5Hq2oTbnFQ}=0gq$lfj<I9!EH{$nqsOQ4o3rT11XSQb;?QteAOMaOecRDT-`ZxdS@aaD zGF_A5;}*F@A2%eTheRE=Ymr4~BDXp)vpr>t#6xKISc~FVbqZ_3%wp%%!jN=x1JNE- zV!VT1nWtKE{CtbU-!0l;H0Db$^6{YAc4}te>TCo{OneOV?fO;&U&b;9Zb%^uj>bkF zO6RG#pgAV7(QwQ(zn%6>tGb|+Wa-%CmUMG&;NWq{Fx#pM4BqkH1)Ec-V%KZFm4Vd; z!ndRBrkdl~woI^nkO?JvtRDCGE^&V$(=&%Gwpk$t3$phOwPLg9G;xGqdJ! zVTXwZiDy@!w7u8iWT-R(c*_+Gc1;v_aoD*;$BHSMvuzg)XoZcW&0%-T30{0*0MXh2 z-{GPTx=7A+r>jTeq4Gn4*ty8$uwm@^U8+7B)sy3g;W^zyjFn7sH;ZO(yEqg~ITjo2 zjhhSx$C^WPj>>v@%o`@O%LvVZj_uCjdPE*do#jPtk>M8qF{^GxEC&t)fOjy(+ zyPm=D=2_;!Mj}0$bMNQ?SV5jx@D=rb9eC_)FRg{lLmGeyM~wX16b2QS4Rem0L(Q0q zW97+s2oDS}qixUTjFoyioT>{OLFTiKfL5{65F_EjSUMS&y`Qtd6FOM1QN&v!c+!!p zm5svp+5aJVV{M5(PSVPaByRX~a@%LI4OJQ!7d!y$aG7`n_j2%6FLNi}&Y~n@AQ`V0 z&Sq;QiKX#0HX5zQ(=OsfurwTDH*$yz;%S8O9P5x1HOSgBY9v(1(Yhsup4WE&E=p3x znLuHLmI{{^j*tc6yc8jmR*tM3UMUZ?Pi(1jWnop-Flh;g+sed3D`t`h4Ko*}gzg1H zi-!%aDHv9mUtzPg%wlyZo5##X%X|nNXk-aHLrD9syDC?XtgNXlEGQ@|5y!9{f+{O(1{YW6 z4;m&i-*@IA~#l-^vOtO!RrP7T<;z{hq^SURGm&NQHqV3~jHlN5sIvEb6 zD)E*!`0SB)b3U;(WHH)v8=Da_*{$#+HO$a){t~FR*V@b#M#@O@R>`nY$8&&qH^Wr` zfIxr0CABmzHl0ic+h4Ji7mng=Kvg&}27}y6BM^^?CE zHK{2|h$V6<$F3wbMG@g%$c|ki|92JilmEj4-|D*2D!=oy)KXCYSyVDH?9o+W~5;bWgfrQmvc2Ed` z1ebBaPWmQXNxIwa4vV8>qqu;8pdedx)Nz?{M#XX8aU9$o7gQYgeP6&))Ny;C&#Ah7 zZ-++b`+MH!_q=cTgRVNKPMve=)TvYJ6_7`1T7%Q74_^wvqeZ|m&Q{%!*^SfF$ytK# zNzHtHLW@;<@-lyv-mMUb=hp}so0QL9v52qX8k|<1J>=$vfPC=-VN=a_by>iprr{7DIC-M2YOiy|bICiAoZsB-L^B|t53=ePoB+)Oyo_;+rhhrxpM|cFs zvlS0#Y%JZxl^njmAYXqHOiz`+g2}xc!Secg89*#ci?u7|?WN$3@ki9SY2t98Y z_o49CgFwBp+k=jr9!pHIn{8*NUFWnhC8*xWU5Lt~<9|ZL7x%#A#PB6J-jVS_95N&b-dxT@;L+oe$%J0fAtT<(XCab&q=*+h1j}3c zEyQv^W|T+t=5R$3^LSohUx-Ir8JkXacoyhQ{yatKNd2|oWY-Ss#yhG_8h6H=E5J(!{(R2^P zn;SR@ZlG!#^xUL}$;k)3PUCd@xMaFbYr>o1c!;u%&MPGnm}aDE@ASHdC(6x7{X8Jm zp^?3V>|Kya)Q9JtX!r0K2Mb~0Lh3%CNNbIBr!Iow9c%XpjUCBNrN*Sbc*52d)QTd+ zXzM&?Kcz!!&pYVuk#lkKguJ8fTO)Ptf!>+-;<)*q=$(Au8d3WO5yCtDzBL*dEbJKG zPPvC|CUQg;ir#Vf^ekEKpBS61`;FeY;5@+_dotptgzNH&{!Ii8m|{226o5DOX@EP# zvyeCDW$gCGSW`Z*`N11dGj@AS`mI^%$M7z-wa3K$_`zPCvTQPH%mi6G@J4gV9zV8D zvVC>jMFOP2m=X^O2%o`K9*qsK?Rhk8W-R()E-M@o1AQB$RLa!(gWV< zeS3Dwm+y^iO-_u+BtLg{-f$DK#E?P$BSk;@?*=AX3W5HMg9*E}5SYuIohR#ZH?UT? z^AupXGx^>?Pwocl^|iSknM5oxu-4tQ`PmB{oJ5P4|D%_muv@)+--4!0ZW`o;R#5=* zj0$9;qtEX7mN?}Ulf;7qq(o7We&WG*BEc)AMJWmzCM+Xe~5$GeDI zm&~Nv9BrCcdO@4O#&*QgdU|oCr&fW;@FDcNXpi^swyoPSJT){aF@|3?q3v}kT$hxA zp$jP6p3>KdMs#>re7$i763J&^vS9@a4>;lNac{}Ait0@y7-X0$^ zXd5VLC(}H$3)H(LJTR>5z~A)Tf;UcN3H8 z3|b1t5e;u}+Ux=ZPfHr1F&#@uNl#b}IJ$$j&oxid^&F(ICacNyHV^1GnKLKe^hPkI z*sV@dAIFiwPVVb-y?fIy-XJNM0v>B8?6lL2^CuRp!&9FEACpYmGwrm%yJ%A2b#_)@ zo_Jna6JwBcv8wYE0wQ=?@RgsF(2RLAPY=kbhy$aP4i`3{a7F})9Z24DWgZ0`?CL4F zAa&I>7vIO~nW?~iojb1|?f3F=tKfBM5uszE0bBFy4ay!Rajz1cpFgpOZ;t6<$eGo# zBS$CV8Nu-;nI4XwWRik6$@HK_!dRkulS~hl%4ZlW2tJQT$;T!c{=260*R4&*ASCsr zT_SX`9gW~Ag(#j0wIy4f<`{2KG|yKV(;k~WrNg|_@yjm{dyXa3kxnODV_7>NA*}UG*#nvf9e;Vy17>w> z;E~Ge^O3$(;budpeF$LR~t@f;4@;=Mvoh% z9~AN?lhf)Or%jktc>Lhv7@I< z8#7_-v=PJ2D{ej|HH@p9Hnq+z=rzlRyTf>d!WMe6f@(QWW${NWQ;@54KMPa z=N^eNYED8XYlKTw;4>`38|Jj@NH8O4z5v4Gjd;h}X`;Fd+M1Nlc!^VRwoGGqJ%$J) z+LFn3(r9Rowb{axr!^uBPp4yZJX4oHtB3odY)8f(ZfE!)EL1Q$?=VR zJx4BqK?QqXq;YnO&!viUX< zD%iIuKh3SlY5Kz^DtP4+twQFS;XQn{C7R8rA5`!$LxLAjJdv7tlPJ~DoR+<86+HC` z&Gh?SxZ(QRq+_6h2N^Pjn$cwV6r2hUxImK_beNx$=42upa}su%-w;hFn=^IEgu4i! zg8hn9?OFyZ_-7;Mn&Ez}&dxtQtAbTUX=#ix6Nf_utA7Qfep3C&x<;sA|6f6BXc#@H zhN2e5F`s;u$Xo?$3=X4hpWe+wA1b)+F5Ui5FY~KQUKy=-80#Km+o`DuzT%^TwT4)s z_M4I&3G;!YG3{Au>C^$5=$Y60iE6w$yHy5QgZfr~jT*VfZ^mY(Gj`IHNt39Jqc&*s z+H_C>!49V_ek||4CKFJ>`l3kYg|ga4*;!S=-p{s(rB)SG=pSrmor)C}R|3M!cUy_V{O{r$2NWnisA zxp12(Lk1a?B}Gv*zXoMxaTKy^Fs>|$!7~YSh@syo*Q*CASZ`d$x*Pp`3$i?ozz5(O zW;xmB>28VM#<})g>o3ukY@SgkGeZ@8_DyZE-(2m-Ncr!5sNh@1oH&4aO-!VM%O5KE z(QhNlOL{7}$zXC_&m%eAj-~j}c!O<{x zb~@P<%dqWx7bV%+<~_5af+?ft`hu?4;r}$Ai zGPc}@kSn(;IM6Uv=&#JZ@iB?|Y+4S^svwqYr*Qa6KQ)7>Ct-Qq?G1Co4)No*Hk*}f z@{bEObEPl(QDWwbxg5Pv!HB7ISh*ib->A-TPY^1&{jcE|UoxnukcJM2EYlUnyyUNk z#}4H#kNfPK3Jy41bG>(gQ{wsxZ*_Zk^+oYooCKdH!EuXmx`3>B>07BH1fbGAaenXe6bYC(8F;ymQS z&N09cDU4KFoP<5wZtmbTTm^>}#fi1GwKz1+qYQW}Cgpy6TE=eEvj2SBA4s$|r>5)v z)MzwVXdSK1BX~p8PK=g=LS*;&Z6NYwfZieGb!!s`(@9t9R(^D{zhd5JqjnZ*VD|_7 zqp`j~K1vSWc4VeYwI^+(T3L!<-9(299&PZ-AM#V=%R{DjK?UzJ4ZdcqzfGHxX(!Pt z9+!NljMaUe@guc1kF1|6S3>PH`|$$Zx^H~uM@lAa&j2i=_`+k{}aVq2BUW!Bb7I zIqLlaF6cd}C8y0!$Fl5Rry9u%ot12y79vhBia0TU32Ta`xBF$f0Sm|ZxRYV@JW(!S zlTW9On~EwJFrBGzfNgd6#5F4UTxYz_J%xIA5|dh5xFtc`F;yQv)h{z|_2*G4i=r?h za4$sF^GP!mOc`nK-`Q`_?edL9nW5ya(j9!&qkcO`*!c(cjJ?b@gbFRyhiB6V$4zq; z4tKnrqd(K8f-rV>@NRyFQs!}C6 zDRi^3j@dK$tT4alrGmLtx)Ba&_bVl1H+Q7<6Cx@&#E>a8u*{rH{0`Y z^3=g6l#=b!;x_rNFN%}udJReiPc?(cWqTE{<+Nt(?6g>08$%^yh+DXQlV8KhFb0>& zEggwz(RT;=)g+e!T$E>vqUdJ}T%5Ox;-q7VR+}TNi?(UoXmZZZ#ls7_@d~*Ta-(NY zk9B0ScHG6?e%rVcolM3_=o6GKdhep>DZbd8aHzDqp3rp{uAP_zuEM1}{>lNV%`|(L z4npoy0~*ba%6>RU^v#+=C~Q)%P9~Y~rYJ`Z)QWkuKx`gpcaID*Shr_$CGAub+|GR4&%&%^ zx-Fiu+c}5c-3*UiXHo{dcTun$(dW|l%SK1pb$>z{;k%paZWr9Lar!6!k*R6S1b7ZmCsFH^^1+DC5ow`+$7Go2v%wafVJIMn@_h%i8Wr zJU0hi4_dIQuF?4RK|0x-VSiX_4Emub{A}^QobUN@qp3}%>cXy($=b0tc|wy?nn~Ch z-}>8@eOR`L8KD^Ky89@9dnC=bvl?Uc#yC@3>t8SMLEeehL1d(F*;&L7OVA3l;2c6!X!O{?;;BqZ2b(pFuhGsUj$K_N?)V=7Noy z-3|W60(^0qV@A3X&os?Y=vHFs zRu1Di11t>5W9e4%(c1_yd=J0D@W8~hGlmRe2R>h$LgA!N5M~QP_o4{WNHl?qbnzXY z_A52s)H*XJ!Bxrx!Y94phkHkIJxAR8Fx}2q6<|6U`ZOoeIwqNJ=*Xn(M4X+o_l+$w z2tV8fnP*nV=Z`HjzAlOwYin!g5}r}c%!2uMYtrW}<`q?LqN9Ce{ZtvqJ5o@=3yWeI z7se$@V-5Si=+{ERp2evSJIlhN1Y&J%DdS(H!#vNWXDV2v3B7-w zzikWArphkNN<*-)v10MlIx>t)6Xsx4?f698N!!gdhG)&#`(y!^;!<^x*J)_3sP)%Q zZ`9zlW_c7*1qYa3+whXVGZ~zYjI4MMGdR~z^J|~e>N%P5t%)SRH>!eHn%W8_AeNmS z-qyzZcbcsMrnR>ePQgX<>&y)Pk^*)zPOEDP>*};6^nKaSuN+mbPdb@oVq`K!(;a3i zDV+ES9+$A`s~79GnYuM4{d~R(9<@TFr2p-&tUWec=x`$jDmc!>Qib;IA~oCYid%hA zJc%}Fcs%^cbrGoG{zZqeb~`&gsh^snfsNrY)k#gK(cx`x)~I^D;^)&zWQV6)r`R&1 zINsD=sE-s63dmAbdrbDfo;7}JcmbsrC!NW*C*vJ$c0874Xny4-ddQf)#&230CDXv| zT&mC5&E&uNky>IiZ2C$fm_{lLGG)AG11-@_eRTmZ0v#To$(MZ1URz~ReF6Gic;=pOr))M@-bR?Sj(RMb^SzB>NO4Bl;Dd!A3?Z@uEHMV;wZ2PT2DI?%oE{aR7zI>2ndVjoDdUXQbs0$Q?6l@|GLs?uwG1u|5xr6; zI&W`}Fd3*)wp(~-zy)fZqn=KCJ~ z4axp=uGMxrUFWp%xGcr(u89iXRYa4v!KYo_mV*UYy z?Y7AbNGBB>+#o+`CvM9VB2dBOjbev<DXh{f1m5pO2j;RWu8e@~ao7?04xoqLI*}YqnHPy94ss|t1 zJ8iednjE-AmmC8GO`^IzmZIZGB$FxLfrMpsS^!Ed;QJoM>RqrTgi}qujsK^5SF+yL zWNT6?8l)?_I|u~XkEYmJ%+2L+kjW1N!PaCZ#&7+}B{}J~(=u{i3g_f7v^#}xDdH^@DR+;VZ!D305<#O0T)4tUYY^Oi3cSS11F+gP0pNK*ZhJCqiz#DGE{Agsxvz_&OiLu2v$M14%;jM0 z_NI`Zxs=n^Hay*$!R5IeZZfoP^`mqoJftgpNYD6@Oc*6P`(rMLPfT-t8?sR1dI~~o zhTzIv4q58705Gr?R}}>e8HB5g0@zLdl*?g-a9u!*UFDiw4p(jsVt2W=I7qt8b;V)Q zZLTj4ldkjUTn>NUx;p7Te<=>rUFe45K;4c0S{$gm(%*^$YX;T~7+Q-Pi$iON)Yc3d zgqw;(2iFd&9X1R%7l+mi7&L6~&>>h`99%o#;Gs2xYjI0)@SvK52MruB2!AgQ9yV~; zuptA6;nw2dnju4n4y~;jg4>G22M!!Oc+jAMwYa@Fe8|w60mFt38H78E!)pc(s;wD1 zw00QoERIk+WZ0mAg9i;Bg1d?%3?4XS*w6t7*VN+f;s`YZh7KG$sAgF0Al#G3$d993 z<&yYxc%~iq=5pAceFS(j?CY|Si*>miN;LFEKUDlx zGam%UL%AIG(@ma)2!C(v-ghz5Y9I7#X@?(ey!y6{z(OeGuXoR(;J`$}- zd$yCsW4Ro6wi8iUv3+37@qU+zVhSc zBd%j>@q8|aEyf%>{eeXuNlr@e&6^Fm9HLsyH*fD#v$WO-xkrK*aygu?aqjlxwA$I0 z6kha9|EKLO;D{r9!EZ}@7Q4<_6T+2u=z#l_|0(cgv2k@kNVdT;)eXsX_Qcj?b!K`j zWmlhgvXjX6%O{;g_GDPwTV=C>x(|DzPXaq|ISiqWgwvdi+x}z#F8J(c;6dTs2 zKwe@GTQl0yo{d&#(;W$Zt;((c(STLf0z7zF1TF)85_mj73HvyBLVh5W$)=l=iJ8^I zQz<(UpWKnm+OW>H%Ho-RIav$x7E^%6L)z&Ud2ZPnl1Fw?3am~`o$;#8tH^|{)s1sf_M{eAANH`y9LU8c zg!0QAu_h;val2)e#WY4Ao7Zn}hgCI#^IV@5wX|m&X2ZHQnCHuF|FXC~xg=f1Wmd#) zY0r+B4eKsnnI>a9g=JixkBzl;*wrIr3GR2vO(0kg_q57p0{8yh6X=5I!+OrcDsx~B z?nm|u$+D#~ux<$W=uyCIGO0HYthWNKC|L6H=x8qJMF+6@+j9+Kk1}FCy z=Oi||PwgGQ_Ccu+|!It@H}L<9(C=cMdIs_oOOGjkHn{bSi=yVG24J{o!=^QyVK zG;%sW2i2B68TnbIWmTmB>%fB}*yElMs!lhFvU@_PPQ#KG27)vq_V8*h>(*c{YOKxx zfJ-f_`VZ*=urAg1s4?wyI+*Dl+KH0t@-uPN#7YQNF(?gh-+)fQnfdu%I`6OuF1|N}$e)J?-sQW^wh^1TWI@)!{jQc`}yh{ulhmr8i`$Ak-Qz#8$ z-|7I!`~K1L(je9oqM9ct9ANSXLoL}@ih(9s9sT3RQoKntt%Sg{LM+3G-mIIY~-SV(F>*(v!&l)}=FU-RHS=A1|ek z?|oPVr{qf?U%c*2)UEt{&TGi}NmBeI7H`cLKZ*LzS1yiGmW=CTan4|H0sbAZI(Gpu z!m4TkMsQ?K-5)|#0vN%zIs5()DiZcA1_k4oaTzmGu{d2CCNZA5kvUBrEf_Q7kO=N# zDrM+TWlr4#Aw&+V4xqxpu_STf18hyP-Ac_Ar&1SUZ8y!!$->LYrbnwAVz1(sg7+?KV*%VMt7i_MfQGe_aUCp%WF3B!(c&F$j(zJm?}kpGR0| z5LyIb%0q^N{SfQuBCLsr=3{e6i<}gZlMfyi!TS$|P?Z6aZ2E5=%8Q(($b0`I1QBVq zsVyrK4gH6a=#+ni0Cm(vg})kv)1#+MRLBvbWun58Ji;9Y;rD`Yr;G4J9^sz`VYVP_ zb`eS*?kZ4Adv-)J*=ENQSb*cTKyxjTXs$((4th9*s+quCaa)5(z^{;&_Uu$0QsW|A z8`cCCXaWm_z~Lm&0W7e1RBFP*Ayi1Dv_yutlbCj}MiNOTl5KH$Rrdj@@bAo`fnH?M zjMhIKLgabcqqe1GQtl^mrIHgB-ZFAuWkFpsQK4IZZCzJe(VHhK?D)?j@-rN0wbNLL z@0I3%z2<+t@ZayBA&~#|!vEn+$#q(+m%4Mza54=}D?j&$^}_WkX3n(JP0Zl=va6X9 zHv!Lji{^3fKc#oJ##8;?l2(E1Sa3Ro9lD6ku|L}9N;eKkxw_)-!_GePY(|qfS25ew?VD2DMga^VfP*Hsh=iXox1f#PnE)2yFUIA(7!VVA zG4SAF5qz^=ck~wnY@(mnyUtgq5g9KvV57tw{T>M+atd=Cyev6KGbh8GSxy|UOP=!x z8w#rTUfW@fX~Wk8(Zl!J4(Ufih)&#VJKP~SU5v2-i}5c@H{<)7$@hiHM;_5#^Zfvo z|KcMdsC5$+{$hxK5Qx4xQ6cF>%yC*@bfI30X7S-o0)22it3&8SO|Gb z(g;^QmUlEiiuPV+Ml)8)lvO<*LWK!{z7lXbb7(cog7ooKkB1PskNS78TBf_NKVC%C z$ykb4gId%FgVOvD2HE_-JgznSV33;a^+X6le0`AYKKn!nm48SNsOD+*N2PkL_&o>c zp1Ce4iht_~qxdhMFp59y$q+>GCq7BP7^qViXv#bujP6;d(D7sl(f#Wb&J&EPI)x(* z#-qXL#5#o=h;dwPldgU$lgrg(;#2pSk06ijl!p5H-BP=c6*-+ z&wpcvI4^^7ABEsFXR`?L^iv^3ng;|tr}s;cPOtnKx~w(=rpGd)>}IFke6SyDN{BG@ z8OE`(S#`<88Fo53ik=mn0y>ePI5RR>Si*t#Z02NRP8(L0h)q5dLM7AuT;^8>ot ze`(}@3G&U)X?OT98K)k2jx!-U3+rDpLV>dzCM4b#VSCnS{+_W!#$BJMqNKJlDPFW{ z!AdMQHN9b3RkMIMtlAzCG(I0feq!{7MVFLdR*VRo8qI$`gz5yWH~dwq%ZQmEU8kZCn7 z5mw{hriOU|5olh30u9>`0=b_TAoo)?Xzu4}SE>~^FCdDmNa4Hyn>gErbXx*z^2Be} z#BUbj^9=Euh4>YQ_|1OeH|L4372@mi#9Qs`7{_jlqZ6m;Hh(E#(LKBr;IhlJr0oDN z3AMLLTePB~sF)dR!$!gUWJ3t*#L6J{Fs=S_K>cI?AbQsX(2ZL!y#RI1{y;?@Zd6w( zrq_{}!Ov}T=?a(QZz0Xh*8!P`e=S`9KxSqFUrU8OUI;AAt^Et3>_y=cavJ4}97MxT9OWVaCp zpE7`Rf>8HNQh3v(&kL%JlN3I$37{u{k9tHmO;V_4K^5FTh%I@5nVkHRFDNQFL@=p> z-D-80JwK>x>}%2&2eq!pn)HQ1t=oE&o*&e@JtdzO!VB_*XBxl)gE-%$7xB0YS5dST zn5hi@h-0;CFAa(TTpDDbc;!W^7PwRfn0F;5ioR4vs?S(kA+Z6x$8jaj(!{RN#I6ux z-$-%b3K^z@FNILmX2&=!A26G_9HJsGv9nK)rBnE$WbE>i+u`&4x>Jv<@Mcg~bDgf{ zI;m!V5}pZMC)HFj<;^s%6QVNOeApvX*)(-B0c}(dVHcAbT zFhkd{QEGVer4S-3YIRUh-`0`AYa;4*tXVAWA!7iq8-sYoq~F=fAk1X_8vJBr|5$VO zv2fO7qqd2UC34+KQeqPy3nTqDhM>ar3LhEzTY}NO>lFrXWZYS=aKy$C`u3|=fX4gM z;C-#}j&t#vJiIP8#+8^1uElMoy7_Pt~%~0i9y-&MAq~^EJIf0_^su8^8r6x*N|k>3Jo(u`V&`B_&Wt><`>v z(pQ&68}$^;#ICIp;!6nRay|Y zAAsvhIO=^XInqqmmC%JxcrApA4qRW-Sk?n4y=F$b!%dBUE|HOL>>w??jC9m$oq^w4 zqMc>Tq;E44B=c!$j@)Z(4z|+;25`GUTy4^K8c}aF>3a)BZRX>SvIUIm@pKO@>Qh?O zr$p3eUt=7SZUvqy;XcWmOlv`(5<&mV41INhIE=h{ydLsqe|m0-$htuRa7h_Y3!MXA z4kLS^ZWBk#DGv7OW339=Y`` zYVBv8^=RnKp*`?`WOW-#?c?zf=k$+D*7iE<$xzF+J@A5L?V+=t4sj6wQnJc))-xea zvU|Ku@(1axjUnFi*+sGj>8yW;_}XD_$vRwTy&dB6%0ZGfMrXYnqL&;ZS(9|u`yqOg z;gWT{&iXLKY5Yl&71LS&5j8AemIU_6p}NC-7J^FDE6nz#SJW%aHR;bo(fjHZK9_~gxR#mk7}s(xf6%ooCMI3WRR+_zmR0Yt({m)d!2pbFxrPAa z(C#v|KB#NGnY1`4K4gj*hqmLprq+G=gSAHA4MA#s#$cLS2fgdo`mzC-T8|_EdJgb` zsr9~4^k0({jwUTm2EH6xFd4X!MPxGYT^>-lP9WwgyYRRP7aXofk6*OG{vrl@_q%ir zdZ7Fz#DVe&$q{GqiW=PPGjy<%ysY|A^6_= ztOSvtbmlqT$i@yIgn&r&5DCRDlB{ZGiOpsX(Kb6btZnuTUs`O|q|XV9%^o8KIc=VA z01Lu09<4YeAfup+M~n%sHSk4Y?elLn>7`+)UCV%nOnOBaYG@hogh{UoL#-_XJ~Qbx zVW@-3ft?Q3j9zZidzG_6Vhs3oot!6@;Q2Jn*+y~>1z#RV@-O!p+7aB7S+!YMyQc?19;RRE->jQX^fK; zE;s3?4dJyW{hYynz@(qogrCe4e#rnf7((xv^vfpwl}Rr$67771mT;+2U71PGGw@L+ zePK7<3#OR#*WvPK%YYp}3PIX@&JnuJzuXC0b>|qwdkx3SP5O4j$e&I6PLp0|(hr*S zzfAg}u$hfGiR_qkvYqk3&G(OyceCzgB==xYEacsDWE>p|QqyyGeBVZnu*Tj-d1tpEbTKELSp1hxov|qN35v za+u=CXfu`Qppj?XyfZ(c3EO!y)uhC79pqCj$&N&vNl_-X_L2O&^pg-ObQ63eRb0*t zHiAxGPr;;JwOCEDxNckg9haKrxJ_EDO(NDUWKl;fo4PT`UiV2zha=qFG}Budr-mC9 zZtkY1Z&OVAt8OxVd-fAEeQP%PdiwSj8PWvi7{GtJ6==R)Kj}wDa4Rk{JZ{lEZV?_g zc|2|r9)H;uj|)u|-x?k-H|g&*kK27}c)ZEvYaaLel-3|Z{?h=yFXS&q9c7 zWJhsuPIubSDa^TScmNf=gz8|PYmg+$~gW;(b+k$63easA^8#TnOG#1TF0F;e%q`Q2rtyGsDvR2yOd%eqJB zO;Y$+01RV}G=N9C>jC39lRii3K76i8Ki^&Y@b{mG5M>|k_l4=bWBG%<_f-C1?@fPU zdhcbXtm(aLzMv>l>oo@QQFmR-eJ1^xuH`zCVlDsX5Bi9&`Gd8Tei?$)vfr1cmKRJ} zQ_Hw7rIx0>w!=FH@>BQd1$%9W1{S?|ukFyzA1n6S4l9W(`q^YqJC$bedy~H0r1u)7 z6?>)9)0JT+eXWw|$_-?O)0Hu!3Z^UXO9kA!n3M;YZgsq&@F!D4%A~JV(sY}pB!iF( z4d6PZTWF0*-(U*fWYXVvFX*4f_HjGDGoAA$C4TWHMZY+56a6A^lcJqZ*`$v`%`}VD zH!C`@`I|zBJTxi*+8T%RwPJm@5}DSwR;=%NVtqy|Cu54=BE@&yEG@wup7POJeYa?J zRc#JI)YWfvfx6mRLew=l4*=BnjPddmv=+vi^liKh>@BPqsoN5`gWDvs18~2V`+kvo z&Sow5{UY~;n?s1iM|%=JAQC>fS$BIpAQHYIY_ToQHnpxZT&ywaf07HXe;-n9pU&N% zYA)yKQ=xa_OfKobJ&e2V&mF4yL&cGw{6V3L^~8W9=`|)X(PR=CCfb~KCu=hP{1s2`#4;md zZLvhN9mhzTz^f*=K9&c^9!J2O4m7RPL2{)M1+C$5hy-p5p|Ep5l* zbNt+7$<4C_w%IM&JRk3ozc0uiDI`hn=l_U3HcnRfadZGw-pSE(CM&3~Lx?V#tZ)#2 zET60}>gy27FQ2S%GJjk*S>X>~b6U1`vck?|blF7o$;k>!n2&s$xoRrjYIozWLEUQe zt$eddt68Si=37_g6xMvLjdZ?6zBe${1e1E5DXmYF^TF3TG|`!sE`;hLy0YfWVLMbf zxJXEU`E>{trK6$`+1Nfr`R1&bY zwnm@c5!0_MZgr919z1DjmEF7zmECN;FjryVH(F&ki(HeLYJy3f$duNO$%%hcpfX*E zYPm&U!(Ja}<_QoEVRD(mMXmRFj*!kAlh327UUIGCd)9>%R#h(lRE%_I^@wUSQ4w zo%5RHyi3j_m+P$eCF=`jX)$j%Vm_tC#1_{q?lXW7G(c?$A-aJ*C6Doh!FXL`?B`~j9pJ(QM~`$hqWbILl*?x{!=UcCt&)|1%bEERT#WQ8^Z;1++#XZO)#nS zmJq77F<2UoYH>%_1pzuFRJ37{l>7Y_2JKiXiFr(%hD#)I4HGkPsU)7?5<;cEO|nEX zpkAA-@UjtkRUjIfqVO3--ffD)e&14U#Q4BqtkxLOZ$l7_lkynf8;ms?BjI9PMU1@K z^evd;8oM9sO!v7xudzapb9-Q?^Av9TR%`5bk>E|HnqX32FxBj)cKj}cDlIN<5AgcT zUf+ex6$f1!s^1ia$XM+r?+8R2rzjloT?o->QxuNmkJc#)vv_#u*Qd$tGhMnL!5O1Ik<8e!$i3lvVEv@xKPZteF>G?~Ojl)S}BXR?SAxQz0( zCDE4&R7`hp5Pw}mnXaKs4yu`P8+nf0rgH`|=Sk+|8!qFtWJe`uZKLn3!|kT;>{^`b zUF$AX_<)SIC4pT@zvRCmR84nGs+1|sw+8R_-w-O&$z&G0?RiiS^!aZHkw?j1^K_>z zjy;$;{J(S%j5OXGtGm!X(jAV==YMMQdrSVQ|26J*1`+bIIr0IOUmb8BLW^#dNOAch z)$xYnh?O$q>_v8Mg{YBFi4*v@E@Z=Z9RLpAd|~ z(3#g*|AE`gTL=2+rd)s6z}k6*?ZLw$cd)<-Eve}pt@d$_{#bi1 zm&=t%u9L`);4AgyZ=EjI;Uu!DY}%LIgVa(feh8c|c73iN&HCNSp0MzTqR%!>e<_5c zCh1$`<>LaV#{c?k)2a3Fo||a5+nd|cb;)sdEM?AnWXL=|G|xk9X91@d<$x!9j+&x5 zsQN!~Fue;0?a7(8RQhhIp1G7;z|5kRj{A2AN1dQ69r}N&H07@}#!HOm6U|cd`8{;a z-M1<3%vVA<^%Pz6@c&cIvsttE%+a(qC($umYBf6UW&yjO;(I3`nZd4azY;?3uY zjkx#kd&_*XGTK|8LFj$f$*`*BF7u81N6;sZ0cVy+3@P`LXk}kxMIOaWHr>&j?fv`S z$xL;7M{lWkVn^1VeJFF9I$C=7J@I6AiD8nFV2+c>N}{QwCB;PVvrdjy^YKMkhsgEZ zcPszjteL0$VrhGLBHl17mVz}h&qEn!kGQjMMD8t{UyN2#JoUk;qO=EJvrS~D*v(um z<>L&z%pfl=2smxW;^PxpSbwwRdOCMi%lKHnZZ}!5(?2^P7nRDmgr28vicc5~YrT(v zR}9`Qc5d7z({VdpJz?}z`JN{%m9JE|(aerdBwAVBN4aLZFBgcPhRnbb*|+@=|kl6tcyw` z`sW4KDgDgP`PSD5ZEXPK6WM{a(XCqR1Zk}i%X*sD;zB5InM42Dy0t3%@)aICli@cD z+U#g`b6YZF>jbQxR#|E~@NBWDDO8_MlBuXU&C{5UB{GhfRhu2l*s$)kK4#{~qm}*n=?6P8vwD=>66mDbKN_ zm<+akQaD4aBAKCI(%R$mwsy3-VNM3teEsmrh1Jwo5hMy?b%;(ijw{Y_F^AvG$#!I_ z`QS6V`inuUY!>kO2Y#`Ac)TPT;|CI~jlYGNO=|D)@83WinM`DzLS#~Fdi^&r-O4}s4LquoP1KQr^`;-!-#pRkl*4Cu z1?yqI(I+$24xj3#M;Tw&IHlGbhMYw9WLOvTC6@#+sDA`~W@2feiBIIv(Ja+>JxHR` z>uM<{&PFuv6j(=Ef>3AAYS10P_^pv*^?cdRm^3MR0Lnl$zkZId!r1BT=!PjH$H7Yb ze4LQ0?90JATFtK}vJO75GWx*0QEH&PIdyETjlJSqj_MGcvSdnESwM*+0<3-Vl**d) zXyZQ1BmDV#QF4kMi*uj7+Wi4*on;~9B&+4AaqHZmRVMG)@Lo25DO==)^$A5~D5DG7KCLE_a__1!sqbGkCSk1(=mv6Y zHmx)=nMlC8CzRKRwD`Spd{Xq5uxCw)&C+O9R+(3!KwWAraad#WGz2s$McK~_S_Q$C z7^`l!ksLZ;?d&UN*4xLXle0YYG$D}pj#Gz|$PPOh);0Q3r6IKpF|=p%4d=!q_3ubH zv#ZC&_}O^*3geizSSzfZtTMihy2F8cnSu2JuNNd!c7ih0CEJp%ZU>lW z6m069n2g)74!6o2U`Zr`vLviw<$U49N%n8aRI@yBs_X4^JFFiptE^pPiuPE=C?{P| z!_};TLE`@#A*BxIj*>BuA*BurB%EVlXYrSCTG==5r1`}O6AZwrw94YZy%naLHpJR( zN(*Z=?WYEKrZR%E7N=JK>eG^`!I;v45%fvUsKFQpZ+%)awHRyiYB831Qd=fZY;UWK z1wo`TqRTHq+Loi!(YnvqJ;qAu>y91ULtDPj*QK0zOZ>QGdPYVbo)XH1{;#FL1J0mR z=o$rx^;Pz5a9a7nwUJy~i24RUShZGJ258xl4kH6gkCMg7)I0GpqZ;f4KV*@JwMld; zOqvKd1AOvoPmv>$M2}}*^$)mX?W}|i9Ju5MXWf0$1Mp3d!GlOAj-{SryGH$2%j!eM z@i%MVo!FjPr`@iens8>r`Zi*fW%#(2__sv;z|cW_V9aiY_NG#s{1nFd&9Z{7vY*9yoD4hF4cS;$-pfky zi<2_RD`NrRsn2?LbuNDD)YycBk9H3rqfc8J`>gLFJs$h$@_Cz&H96IzGtIG-Z|>dFk!Y@Lb>H>t z+rbeada_KkW&?j1M$;@HzU-m#Sw28tAl6G?Vfv z$9dCo9dh^Xo6N|Iq_#U3k}}PFGo>TdJKd4UvZstRX)X|~vn=28TAo{eYqomKD46H0 z^PAHHca7kEcbSceFAA60f*i9FP8M@DSXRY>aST{j7Qwgw4MELcsBqG_07?Oj zi>_Lz(Bp>?`d+=cX`#ZbaRJlZ4 zvvjqGSR{Uk5I^MqE5xg7Fb}ge^+SdFp+f!W0_wEx8k~n&`jkW;^U_xzo+v`aflVDP zDDT@df)m_QZrH_c7I)J0C>flOv#rhp0gSe)7y>h#oc@D;`Drx0{pml1P_1#T(cfI% z!@XfYTIP(>dM;r`$@Ewk;K|)JQ~iZ#e-b^z5baN*3z=wVu!H{XWf45aw5g;&D|v+( zdT}HJtADgIf)AL*VTBp(l@WZ!3{DKJ{^aH7A3~^zqlO`b`Z0va0{+8QlzFv3 z^2F)&k{N5~!qM!8gL+`}k6hB%D@isp>Y0(80h=CX1`||eoNGuknc~xo4pSd6MW%5k zlQlnu5IJnTzL1tkVk((h{u3*0XRd>@DEhmSGm|-S8;h)2r4fAbQ%GN9TO@OcgMMbA zzY&GXFnZb|g%Q7S{~@zT;c1gUEc(SFg=xQp z(09us1w^q};j~{ui1t{laF*b2KC={W8T=!n-Onn;g};QLb~vjPUyKi6e*o2h+GDZ8 zw+79QRxMWe6VZk(RtOy(z%T$iM8_>w*a=}o?Zpb`A`CT)IY(q2%|3v15ocQRv2nZEwZ9tFIE_2g;C!9VuiD< zFraq2SfSZqEViNtT&%Dl4>;WbR%yVu1fWEQSH_-E*P^`}UNyK7L#$3qO+2#{XPe?j zMqAD-MLZCON}gGY^N-g08eYEo%u=)m!eo^mN859qHoo~NvpT7-ovkVw7f63pLAS*9hHujn zx0s}E3E_0C{*cK6Otv}?0bpBIGweBl&Bg9-@;pis6*JMw{9eJZE?wEz9|pKD++Bnw ztCLSK43Q`5hH%C4fS@bx5K<^!+`O;1kniiU{4gm$jO7RB%MW93)8)IYf{xE%5#BG+ zb$3|eG0;Ku!-8Q{Wn<}9J8N>T%hT%+MOWDP10&++f?<6+SI%agYjwFjbgnF=K@GTA z;jW_ta${yrblk-XpHe4k^S?{+h{-=Y8h)h|yOx9z?e$7229(e|XdPRvVy4YH#?b*($hzhXM#OQ_QkTsw#pa^}V2K$}*^3o^Fv(=}nu`_M zS@%sBE6n7NyVzBv;G-8S1dh=KPmg|jvBHJS7v>W7EWKW9B1T-yLoUJBSmGEPF)m7GoWf7o)@mxm+*GckK^6=QX zrP#^vaGeEJu|#1{lfJ=wKU|Hi^!EpsK0!l290; z^U@F-UaC68px$Z$;ggmqEX4$?GkX3KgnK?9y#&`{*^_2sitQnEo$16TG~trQn2>aDv~H;Pti~XZG9+5aw{B01

p`#>(x@5`Lb^khd{ zd{jqD=EOLVjwDLJbPQ#0IGn$23?;R3;V>dLb;BC=W7dLj7>IN*uLT1cIo%~W=Q1Zb z10zW9VP>iKXe!6(6S!4SJ1@JIbpg%mwK9!#cc&$9SR?O9yY@9gGU z*I86Ey;BC~Sp0o$w=g1iP>N;-e&>m|IK4aBSiMx?QNzYuD|*LLg)_T{p&neS@SJJ+ z1;OYmOBK#z0jPJED!gn;%(I|+UZU`!Nnd0^4ZcL-3zJ@CL7j4m!gnTpi3K(P5`|w( zda(s{`y~qD30jpGoAk~my~KjL{hL>ucA+J0MZ+wXP#9D0}KIW62_?kI1=PH)%rNXE*9`>-$xtpU-xm01ngn+zjRuTRE zr3y`ow>!@*#i|Jb8Mhv@05$JYg)0r-k>!8CRAG?{qx@cGv%sU5D%><7fGDSv0YH6p zslt7xz{qInGKH5FoorAdI^zTuzGu%Z1)>+tEyc_p6j_w~jwv-= zlzcWzQOTS9O5S~$!uJL*8SS@B;ZhP1;kr%Kjnw1@#d#Ixh4V+ot94}DZ*D2JHzix5 zzH1$P$p6g@|MW2em%p8>^o7< z;LKcXLQguV#$^fzOw?;4i>zpJnZoY`Fn5_ke*;)zMVBvANc0RNdigSibNJ)hWePX& z$BoMr?qL~Yj-CW#(#dvQE|02Fikr0*H;WXn^bDga&128p9ol51xLGe^>S5_-;T;t^ zCW_-$i`}#=5~g6c3hU_ki*-U<%h+ls?6lL&MiLSK$O!-?d`e6Blt_3+L`(RT&^$Nd zcDSefWS`Px)r-p%CK-00wxXXcQ&=4dBf4do!Y%w!vRvUF5kPlGt!3HQ!j(8Ls10R< zW?+Lb@EjRv0yc=Dd`Jcour~M&WrME1!p27V)xR{1$g!?IUy!`!Qdgf%hQSxKK2I0G zcFPso3}B-b-G8~l1*Ks``z=?voIeIFS9qU44qLA9g_Ie)T;cbo%$rv9cgq#ZdU0C4 zTwz!*cJr--Y)s;+yd}*K$nwkl0Q*B*uP~}+0rLagaXhD&?ho?=Tv;`iG+)Pnc}rR( zuLj@NODt)T0PpV=M&wdg@&%Ij5m}Kg@<+q$f`D|9Ed(H(SgvrjXGyCAeFo$$X|-@; zENQi2Ml5Ny&@QkfX~xDR{^T0cby~pdM8L>)TEOdsUEl`7}8%1x7P=v z?<`a3x1BMhk^DhJny{U#<4I=k4%hGrOfllsK{udW9i(S!X7ze^P+#9Xiy0~I(_wXx zn|X`!EUgZ*MJRO*tkpsB`4uhbl+j zVgThgE>~E+y=(CI8b#h4l4k$20PbF{u-*V32t}VFv{dl>;+j)B8W4NpRXS^2BN_i{nw$EE(w$Imjif_p) z8`S;)_!2ctNKZUkaBEjMoW{@zq8Xx+`!LLQaPW5MLC}cCrvxJ zZTLx8x^LtI_Q)0opN6?oIK$=iQ{nWYJY|M)R1;6S*okZgf5l72hPH&QDpst&HM2$N zF57{w*^b45E#c>DBKT9j;w^a{*1*~#)u2KS$o(iUmfT7fWU*vHH;%tg?hr;~6S-`T zrKZ^JF(-kQ-S#}F2gdFgMnwV(B@ttS*1E78TcT}8nppHQh2C{~@Lk<4dg5gYFYFjb zwD~fHmv^GJsWt9><8NrOI!6QOWmTnQTiA~I2kab%`u9tv7*Q7hYu_&V=}V;;y)zxk zOQkr8Kdgrb|!hHlXnZk~{kb7$1aEF_5UWsOD3CGwt%-j5ByM$qwS|YQ- z8fMIJ5`uAUSp*Z9kw_*+v?ZHoIEhx4WFT|WE^gZ_k>MH@+%8Mk8BF{`u-bMBv!^Z< zl=GS34jK0`u|^Os+a-)heVvKzbUbkf*^ivUOk&fizA9t+Lqwj*d}`n|$$N^(x+!RC z>_&CTwqz^T;{Bi&d5h(`oGl{bMv6rJ0$U`U*vt$)By6!bBv`w;!fg@Gjpc2T8u?QA zFH&xYT}8STGR_^ugpIi}k`38440ZKo3iD0F%nOu1beTee`A=V_u&ho`kS++QPcBoq z#-N=Si2ih$!gafb5e==vfvSIAAK?U=A}rQjU6n-TU2 z!^zcJ*yET#V1>d9hWQKla40#`d*D%h;1qwCE5$V5TNyZTyuhu2`3FXD;cjj_+$uFe z8vY*neZ_8JMBb(`$Y#u)0d6L}xLX*Ae9BxK_X^&7%u*9pDE!B;cW0pQ`V|U@KC?n$ z!tV5CuP{AH_o2H2(XUo0oJfG-mZu&@IcYn=?+Eejs9QM^BFB#et*SWiNbr){2u|DG zW%m&ol{}{jJSPMe=LtOL6D(oR;^70W7~F~HjDfuv zq?f0*fEOkBS+RTG&AccCu46`aPKpTZa1Z4xcriGuRJ->YST9O!go=*1jhBRz=XMYC z#gCRG-U)I{eV1u^gLeeAW{)sbeXr-@z(=FD@Vv)VLz!S&0vg`Q! zy~2n*N^A}(8MJe?^aY|&8SN~v^WI@Z-gHqghn4Kdyw8~z#~Ea8!roL2UC9qC6n>Z# z0F_c5?YUARy>}SVT~;bQxOW)k`>j-XpFak!RM@n47;4-~g_8OJdI2~ldi+X-A6TMk zr9yZgl2z?16?UxGG>7$FzET0@SFBXnVV^L{uV1N9M?6^|I>MkGAqzzFC7+w0$C~`3 zWzREFulMk(`_`Pr_zS}JT!V9>u>H?{4BLC{YuFyoA7s06U&Ho&1#C~-Hww0(tb zZX!NmXikv5!wsfhy?5B5(WtT44B8~AI!8j(*iEdF8he31SoNE3)$bQn{RvA@W8Zi* z|6^!gXbDm5XXH6yKO@gt{vgqN_cQYBH#y*IhDTU}M4#JF~U2WbxLZDJhzgx_HlM1(~-98c?u49X3DEbhfO-86p@F zfl4vMU6yvZEPV!Z=(A>!)bc)I--hmtF8jGNNE4MZ-cOe!j1ptrY2=$BA=a~f!cdQ{ zR9HXR4YAA`^ag_$a}A9P({G#1r1+hlWmMWHD;2&p`Lm-Hs}#mCUuKWRwCA5m-iNWA zNpidJCqu%PEyI~YfK6$k#7MHoE@dql5 zx*q`Z+tvNq)YBDZVZF82k-^#2{q<#j-Ks9SRV)Klvr3`I6m7#7TG10%DXcBy-qb3E zyUW5TPp(pUoTA7Q^==+2*Qj40ps1QW8U4z7z*E)%hSK?#Xe&@2HeJ{|$BGAWLwBv6 z)$RvRR_l;lugseS2heL|N4aM?`$Ia7YXq&L{I@j_shwgbBX>%f^Tt%2%&a_+BtL1DI+s{%VPN2KEm_UAs!5d5UYE`#-QsHq*r( zPdDh-Sz?ff?@xoIp`Kv?w`xFK0Bo*H4B$@PTz}j@jJ|9x-B$Ms9tm7&@b1zC9w9*5 z%G0pFZPuZJ2N7wo^-jvhL-^XVI>!SjwRl0elpzYLXTkkNJzJ$>lod9%mmdd&QJF%o z=U?w>`ru!t1V9=)igaTSa9f#&AFBu89~f_S9t~heOKRpl89a<;oq2>+)trpmz!7wI zi&>cLRrXEmOAS$3+rdA1NbeW`ds%#6VXs94BIrDTOAWwYO?yRf^8s!j+Do_;|Fa)| z-gQ72kz3rx-kVv^uo_uLy?06gB)hjPr@hX6sh|6=SdYn8=M(@v-N|N823#NHtLn*c zi-uYQt0xKT!Yxi)+Zd-!&J2%9C)+uuJc2KRR%e5#x~hdogLy9g7mC1W4=5$+UI&Ju zo?NA{eo6pD-ah)uDun|M3?us9Duwuwfz-Y# zTdnY6p2U%>72+f@ZnZ)?e@t1eFiTLivdL{!3;ifww5-m)0Jf8Lu1-fh`&AL}^wWXu77XrCd+?B+tP@&)*-zQvpqTA6KLMQ0(XP<20tlyIu6jqT}5SB6rb47#_=$KPa8G1_HNiOQf7>DR#L#~p}0d{k-V z6pQE{Wj zz^MRRSbe=(p~;}_5-nMyaB`GqyVfYoCLOW1E~?Om_at7itj>Og`nWV2b{EQ|^IaX? zwm!rPd$CRLkA@LRQ8+qB5%_6eE-#6&#z~RxUYZQ9)OE3(r3 zFW%X21hAWCWjC_2cfP9KWO*B5*7XdR9HgED^6=d`r*}!`cc-_$%z$TQ@9!wUe{`Zc zPe&iC)a(Acuv=(Xy&HcX-q$~v@7Bfgb`#6fq2jJys5rkN0M@pf^rm#*Fx0d)3Z41h zWQM653|^TGQ`h?xrM=&*w3FqQ*K;^8WOY`_fW>p#JJJEZ);BC$dOLDQ?^6mx^ek`C z?I?=dD(&tOTRTb{c1_Dhk+mbG4jjZ)fR;FR;w^$+Ou08cc6xtM1iLdQ(~Ld1MKp$q zG)-?`mTfyI40X{Og|yfCEMT;g|Hp z_P0pdRrbDL59op2A7UOAx*rwV`#G}0fyi|Y+-Kpqj15?2c<3ul-Iq=MNV0BQ-d#KcPDC^p@O4oHL>l#oM z_LvqasZXHP9o1Uu6DalB)qbf@pe(-5a)M9l6AGk0k(leMwbUn3>L;qh zi1cd=pmJs+>26@Ra0lG#L}XB702MPaopruTwnZg}8(B{gm2~fKR8raBQwe*?D1+9f zH8jyAXNrbui0o;|F3`||{&@{?;UL-8HfGfDM7++{SGr!p=K*aMXIgw!`Al9Z+1TIp z|7WuOjI%tGz5sLtXAK)1!9fGKfZ2?>7Tv-urr0ay%4Fs-CY^LM&a#KPu<278=!|FT&zy$X$ z*C1>f96^bBBXux#9u`5!q=sN@p9sPxH4OcSMbNz}#TPFo;01-ds2J`RCOT5UgkCQw zJjX1)eTxZuzo76AwIzohC)~H82R8sREdD!s{m*K6yf@t{`yD5LuzwE(YQw0Q!9B}U z&MfbNQYPgLajNeN3d5L`&v~CCYXVJ7XHu~Q&au9n)B}r{Hr$Lk7M<2%Wj%0@WRBo- zBbQ65^^(!RVwX#?kC@@aaf`(ZAw36%5y>oq3V*cTeX<7*WAV$G6^qByxJnSG4CGLsP2*Zgp3HKH{FPWPy9wN9U3g9p zOeaij-lFh8V?e&}+7R9ITZP|C{sEl|Pn-P4=*gW5%OrpI5b(0eKP5Ue1Y9BcZ>_u%Dk6^63lsQZJcG0+P_P!~QN#33eqVF&`BXwnz+=2c6l!m%dfehVo1 z|EDf!;-J@g7Qw1&NdVIBBL?Yf1%O!XG1Oe%weXpat$d5yrQg6P-J_qdG`%N;U}K)( z6GHK1q39nB{8xzZCNCfOoG|bHw2;KD}rsWqbKu@P#-|D2^nP zSLBHvDRV%X8_#ozYFgW1QpmlB?F^4clE>?dk-NwxCsXaUzse(3iuWyk*J=kkPz#`IXd%y=Gz8;oafQ1&h-cUgQwO^x8Gb=*fwcU|?Cgnq1#vz;Z z?+KCr&q+}%q1gF4nIB!^>PQaS1qO#90bl1-cUlCQ4P9r_5Ae}X^0JM#FoJ-b*JIOOxF$@%y}NCYY!NJnXXMHKwD8Utx0r@ zkMqsFL7KZ|a2Rav4RSm;Np2IxkLUhcb8Fh46t?#UY42P?1@nKc0_u31oHr)%DaIL7 zogZLRuO{jIncF`Z(#6i){wD8@NqmMK^Fd?_Fh9WNyQQFtdw#77a$nguKMRR!r8Fk- zxz8o84!rNV#MJ?=EHKm`z_)-nxnY8bRs%BcQ3;;%bj@R{rWLI>CXEOC!t;pf0TDb# zUZo%SJmOP@vfaQ0j+=%1@dZ^(`L!yx!M)#gZt;6^>i$#`6bs&_>-@rPUh(7| zLyRZ?&N#+A+qf+^_4%OgaWUVIZV*&L}R+GEbP%dFIM;T=IpN zloOwt$kus{ba5J|Om*{0NT^}-=wqfe zjBXS(;YV^tPSy1bA<1#;7mlV)Z5%&w^t4G6$LoSW|MJT(L6YOrg?o0KN3Mk;GxOJ5 zm@8D7E4%T`5vt5-NH))q9FJU*tA~;&9P{O>20Il?$Fj+^u-%_EGkb!Q$rgeRA&AEv zC&p$s%xQ0P5;HPVMzk1Dj!#TUCbM-(-L)F+bi0#?wKcTGGSdZ3ICarRrtMhPNwkh~ z(spw;nVusk!n%txylqx&PG*XoNw&=_LQVwWOIdtQiyKS1TuwJAGl!>Ab|Rk7&m)hX z-Q3oZac0_ikkrW{jdpt~nU1CBHYPBH-%Ocg;GJ=@7-NxBFu|9-LxE-3<**?Sx+cx4e_U2>Eii?=xm8!EWA z2!ab9J-gYq<3eX$5j5lI#d)dVv(IS-6lzOQ^Cr4r?D}>9T1_}%45zW zW6jg4ktKi7HC}VOVMR*I!9+fd4iy|{=<|V0DL*{jnxQUDNuDm2e0uWf$>a>EV7)1G z#2tnzFKdh}*wInJ=}%}Ke&9!Hki9P2h#!h0LO=*scS>TJ)j90SJ1#l%Abp=>|1Vzv zNHzMt0FZH7Q|V+&T{1B?Nxh})G#v@waA9!$b-;&f&vvqyo6B*Noxp*Xx2i^1<89`=*d2) zRC<0chdnf`#Ru!iwApqF7vyq$i-6V6_CZ_iY}Se6LQkame80}hxo@+VULbMY)_C0bc6|XIp2mODxRgu$$)muLWSI-A+$y<~U(v zkth1STO(yCN4t&1xg7S@r2e@zR@`p0voa*`j;Q6-AOd_;qoP3^S$VYCt`^t zd8)zETn=lwN(A6dKT0~Q&8fLPmYIP|ayeA%ivAYxX+52tmT_8R&HP#jF3si8TO-}& zM{16>wT)~|HsleP<#HIL5g+y=W}McRS#d1S<#2!oKhp)AO~=|(xGa}9>R0^;%~FZR zS&_?8z0%f;gFcosPHWoEcBB*2e5|j`<#;lMT6m`bc}`|xdn|=jxg6>>u@C)lBbwl> z&gH;^u>gMYhSza*z{;z{Mp#mRu?tt239w0A1G_KURAzK9fd#c`k>&HT*h1 zyrm;+&&CzG94a;R7C*GPjp6Dab2(gYn)?Ain622B&17TEGjOHH=FbHmIds?XRepG;dAc2+)@o;CEiF6?IR}68%<~FA=FC<*o0e}7 z)!>?3j%OXI)#pMMuwN}a59+wj*U~Rz*SGcvBexgNF9HYsPkvO&t(*y{K`C7(NJ4d$pbn`KGI$^gRYo{3`j2$hn-pi$W-U$q(tuOc% zcN`eFYk?qAx1E+qgcl*LzE+u&8RN9sdfY8emrh%geeGAsZtIa_Cy^a8=ww(^tTJx; zj>{6WOn#)p5HyZMVQ`vC7&zfB}0((1$NePv_=npM*UNZT!`hQ#+kb zB&F?ku~-WypIvd>N9EILSXrwqZD+Kd{D$t?TBGbtbCjK%kNgj?%2IJ)>Yl{}X_zAo zNkKB%baD=?9W6e={QEumxOH6D*p;(NUnQI#WMLirYn9NMs0s&-V{ISe=J_0erYx8p24|v-lL0kUM=w$2Iy{|pBJ*c zm$PXAoP_iHJ70Fw>R_9d$t#y^#^0n;btAy7)xbz5XQHfQS?8s8- zQj3$w|4g>DaLoriqgU3P>_}vF|H`{*StZ{#7d#u~q-=jh2~p9KD5aljBQ|D~%6VnyDvcK6dc_{@eJeDQHotOQRq zdaqySU$QP3t*g^5=3VQ;>{-RLdG?x^z0dNV(SETH{hS-&SN1hWMkaUI9d@*u*UiSl zIzMEUoepf?&;xy@$7b5NAT+GJM^_2BbTB5FE^!dRou9m->y6#gj6+2jV;56Om@sDpc@_SyEm}jIE+ZyaRJDY(4ovKJD5k;2D*8NGOw0->fucaV~*2u4UK-VNnymn zVW>@;6dI2UU>5+J_(tGfn-xwpc!x$0->fj%#d8ea8^jyCSs`ukjx3+MSs`|C80GUf zE1by!%Qh?IjtlTQEgH-3*{tv|;s4mI@CF$IN(!Auf&QxFc8i^!m5!xqaiN}E{%`0t zn6J^pPj6OOz*UXD|Jkf$mwf=N-8UW716ws+W#6u=j1qf9O(1;{sYC$Y?y!NwuGu4k z0}gQyd6>%`T`Ya8NN{)}&hXsELYx<{I;romRux0;v5dK^^YrvbRw9?O4H<}!XP7wj z5ZbIg3w2C29TF}kL_VfZ&*GCWScJPxO&z+X4%Rf|5FX2BObL0C`HXzcl0-#2Ck7*& zEM~H zXYQWQ6q&BEC{)>@VMK0nh0=#eYlujp?vNS|J+x^1a28>vTNiVoPK;m!Pw~aMi%b8| zc&KYu8*~h#e%!2ZujzO%Smn{L6iz-gjPikBDYR_6p0pi{PffHXoBu!D{b_t$N3lN+ z*GRHFqc{_p#EK>)WVqQRCoz(|M8Sz8TVABZi?Hm(!5Hgk=4dq0%$dnKGqw~Gn5-B= zz+AYA0|5jVxMnxISpp&~*X&_S!Y;OZ9k_r=923?&pKn$7IekVWIs87)tG`~@bGoa$ ztE;Q4tE;Q4$7nyTlcxShHT6H-Q~`x&a4m3zXtlQs*bEb(dM2FwxclbicD!M3D8mBfaIv)g0d7DZ6{_)|J zjTC$L&8O0rud5?edeP!f-+U_3;)n2W?CUq5O5eV&jv9!lmngRCi5NYiAQ!h^|3r)) z0?spg93ZVW4D<%NzfSP(5xjeV_cwsIys*#%Vf_PqYb!zzR=l72eUUx-McDDK1?)e7 z`|uMn`mMrfUHdDZh|!r>G*bJko`_NB6-pFGc1YhQ+E4vcj0Ua%AI*g_b|~~l`m(}z zK=2&^zJ)6qN#Q#H9LDjj@f`rZw_c%{Z9r%be76Di0Pq36QH9U;cHsLFjqf**kEP>W zl`r`Iit&x@fAmzkP-Sebfj)Sw-^rHfKj>|d$OC5((PeTu=rXXxUxBD&mxwNdv_ADp zgcd90WZy}b0rMqSYRq}nlLc@MI&s;RGnG8qU!|3O;9i3JAR65yjc!7toBbL$p&F@i zD}L^}(!8zqoT}Su&jG7a?7k;r^nx9AglY#U_T?vHbh-N6+Wy27F?ucVnmLjng)9sA zain#W-zjMA1X}m`Xzc_pf>stk-+g5x#s2<8jCxf&wk+nG)aR~QS{t-Wen7ATFhp~k z6Vm1c+WfiS<^&poe_98r-wUqYq126=karZliY80B_| zYVoy5`}mVFTCl2-&b#%=7@dh9cRv}U%=#4;)9&{pGb7*?Ogw_R;k;xZ)b>kSAh`FzJ91k`PvApUp-eT+3>%L zK&*b<`(%ucDZn>H+NYk3(Uz+ksr{=@#>nNW9(^)Ke^C%`kF?hxkI^lFSa3W>ufM91 z&O76Hj6R4T=NymGSJ6uBdvRKDy>Rg_=e0lgdvR*$X{7e^zZa)g{J7+MaaxWa%f1(< zfgVVwSo`r9ov#YLGeWT!ACJ+c>ib=h_E#T|(cOTI9XKAN6)NMsk@im=kI}uT>!IT@ zdKZ3t?Rbn10krn;V=T>afAbvUejRRk(gXClCK>pn2v3$KI$8$~|9X!M{LwlXPkz*+ z2mUBWNW<`Uknz!p53oCOf{%+FhmLWH1*?^az@3k-Ktkkfhq{=T7Hqy=&6~%$ri)fX zPv5N*f6s|)I5Cez>~|aT7kU>pH;&UW)>(*&kGNeY}oU`>(E6JoAa` zW&W{h|AXT(`n&@CeO)^}6{E*iH&T1-sTlo@s{+p)Q4lBUm}eT-G!pa7S!)!}+=w6G znLF1sQY`uCsq|x2mp*zbO`*sYkDf~3$B(s-o=O+@Hd6b>M^B}zdVQXGTot;r zo?>S{6{9EA_g(eveNV;cCP2nM@yMz4HfX_-S>~Ar%@`e|KiXdIb}WHqhwhjc zFhjOv4bvU-c)eI~>WdXSRM_PDMeY;i=yO${D)U&7{;XFC(o0_~1NpTG%g_JqZ6ubT z$G9Zq=PCsO`5C+RsTi$ORoyY~yjMIGqraf4S3eb_!57P}48b~T%2}p_Nw&AmLAI^d zUQA4yr1vSpeR`e{?$h%?xNFuz-6Q(+yy53Apck*zgj3OP#gd^u7K~`Je1^$#!&=Oe zvQGRwC*H=1x9h~OaNh)*lvGn}bS~U~is>tI@&vz-n&(CA&`O~#ZdeS-w zVo0$MDu}PlV<~nDGHO#y5y7O{+vlR0ZE1tA-WVK)G`pQWgVP^%Oga~ zAfe7(r>VA#rHK&D|J_NEWtt29-wQseDYP7UF9Y%mzKk@7UWi)mU8mNc7b5>K@|gqw z^x`@KKFgT_>((mewkW`j_+Ck31ElU!%x(o{G`a`0?YXVzg~TBennPsTdVD_=2QQ zHFIVA!0{Np7a2T!FH-5Nc=SGw^jSvF9}aT>|8tH3=$-WE`p5%G36G1>i(~Yr zHuw=I;?Q8fif@l74$%?q!+a3SbsXdH{60On5)xMiSAMtolH~L%L2|mtkr(e&a^y4& z;tTsQ77!z&JL?E&oyLQ>y-y9|O=^gg6nSZ1qezhq7sMdmtsr<1Aw~XO)pR-wks@mP z!&5Pu-1%&Th!vvfyJ}Jt2M_CU6#H)KmEaxEV~ZJ#kZ4dB{rs_*_+eP0C2XdgIbNq-|P_^2N7 zt5Cr;{g9Af*J*2!Ho|GYLRxCH?2OT76n;&ABceiY#qYNQg7t>Bm(D|qkX}96G`Y=5cCaQ(_>iztchY<4 zY8jm?A{U62`brE=^hAFnU4YTK5}j&(2A>zgcmXr@6&Rk@=+!!o#1)7mkzB~%n!;Bg zjzrs8SI^usY7BarfbXS2LEz2^^9QN7cFwyRqYw7DlU4dl@U8jd&ImAAjwFv6L||4S zK_f|b@}bp+tHm{5AQTVZ$=d>oEjkgS7b)t#D$;)Oi5LxB-AL`1orux(__5|hjE3=J z%ZV6`;m6JsF)HCl_C$e%x^**5}5?iYXlCqA_W{`p|@ zj{;%ci3ledY_7gFl_Sr`mfe_*@-5Tg`QX@}T+O_B5r*-9@w-U>cGlSo=n4GJIyje- z%!X?kX~B+{C~JN@;Lp7VGOvWLzod@v?&iOp_qr1?x&rCdEGXSJ8SwqJ8L)_u9&24I z>(B@2FN#LjMlQv>?~wD?qUp>v7=AdO(6u1j9(+S{m+ZT)(Sn_!m0-&GUd*N%Ry;C8Zd^pcHAIeGHMImXL%{U)GX zrJfqYVvgYl=NQ9*a=u6(qTe+No4+D*sSMaFFktab*av2dJfyDxDbGQQ;y6jUbdw%M z2Eb@_Q1H8xBCi0|k?#M#NKcJdvRK%)sgV{uqerB|^ZHiwZ$a}ewS3>fi4Sn%c}R3f z3=a=&Qe!Koho7RVbpXKNKES0~H-l6x&UfsRDNu>9JYTh04e!XVDtVq)fOkY#pl{l& z1bPv5@%Zjh5cfoQfL{g(4Dem}fdRgEb7+7+yjczKH@FH6@Exj(H%DZLcaQphAi|5p z{4Kz{<`84l%n?3RbA%mxFC5-kJbW1Lz?l6H>iCimM%cOFq9RR2AWWWv=BkWD#d3*D ze}vM)AK#a-Cg0~07uG0&HsQhWQ7TD^Y2Ds5m!Y)aNNWN_v(@QC6CnQsIVFb zWtZeyKZXmP=*6D|k3VspYf!8TbKp@ZaNpG``Eg1KMqiFZF7=8dL|=~lt zvxr&}HoD1d17824Q$P@gBEgSm^232f zTJRR|T_|?R@c}4`??bvDyW|;wehx`S?2<(<3dJr-z6g_a!8ZVgV-g%MiWFFyJWR$Bow>kuPBJvCEHZ4j$N`#ee2jIMfLqU#4h>GpJOzk5+1|_ z=l^d^L?v@RSrye}-qui5llWF>*1E?j_{$4-pVT4g|J93X7agW8A|S%yQO@)+lkg}> zpjNf^v@NzxH(GuC|0%xjfs_B%HUGAN+P7+npqvR#35(6VHQrk=f}?FMl$|s?sa2+* zd1ih!G!EPO1V~^aweq*J8#45hx?0)S`PmJ%vbWkJTsAsOCLegC@~3gDv8ppbZ!4dZ z1ENx?)NaDBqf)8-{h4QK_ToCTno6ZoyDw%s@ut14d(I+t%QgQekWAFCgj8#r_UaA7byM)fZ*h?> zJZ9T$uhds4jIGV4eG^x#exE8~|88ap;T9-dQ0*vIPk)wid+~u&C_*>Cpgy=FqJ%27 z{Q8BBG@a?g%{zJxFEkqp$y7f5f>a@2%;xN5rqH>hYsHe~E0eCBv4*pxi;iALRFCUY zOPs=9urK{IBKKS35jy>fvf~x)RCXk5r&rN)%Z_J_*h>Zq+)0|Q$0;q*8Re`~!l~E% z=z^g-NqZiHI986GXjwVxNYGk%I}*jg=DUg5d>J1oxoaj$wntISdi;`?W zjSrSwYFmDO6LI6)3fo4r9$j)R66oBSh>!kTlk{IN=BrMXM`ac)A^C;P*i1u zD&0s)l1d2`0J5CBS#r;WovSTO;!Bd@@Af3F>`?Ud$?a0;G(@}Of126viOzlYwY=%P zCOU)btBXV?)mWY-9?=AXwp2dJ997j*T$Fb39!}#=$S`Ihgb8>WWi@iH@0UQX!tm0QP|AM9}iXjW-=0)*>7XO72fFxlAx)aH_ z3QU~88S6;A-{~!sof35%L&Nbc<&u1N@ply>er5YEP<-3Dg67x7CKVfoo8DvqLiqp_WGY4RtZE954@Tm)%sz@|Ya+yTk ziOR+rgM1GVcN7|S4P1a;VL z7%Uc|9(CW0uj+<^${wE45`+Ln6Unn>KE*|XQ}X0t4PiKvucb&bp>7Lwn_TBZK6m~;n*#5g{2wX zQM=oM)z{jp2d*EtGDobG4BkLuy4G~9BJw7?G+F?a|FeB2b;1>Pwa+9|f1b;OM1N%p z(FKbG5`E`=7{_NrB3(~3F@23m-O{zhg!b{kSc!T+OAqWLwa+qKFM!yZ=#l-9l~~tc6RPk6PT5W=)&pq zWnpBOyoe!(GX={{jV@X3rbgFW`D{+sA44Kz4a4_z&E+cof_AKxKgjqaN0?dnQ!fdrO9Q$PJ3qb9E zm&U@>)*$=q5|iInl~~75-ON@yvnE^0TSXqUx`jPsMv=NI-l#6}$O~qQVF>$s7B^7~{Xm!j z(_v{B_7e%t|({iqZQ#=?L|CX(N&<9sz$;W0z;^|nAVh6oN=*M$Ml8OYXnt3i*J_t} zb*H&Rn=npxlqf-EsnMWSHPA0RK`@`6bhcG0@WUJK__~FvU;Jw;PiWK+*5Q7aZ zXODMwbyIzF^RzN>oiT!CV#P9Qh{lKNrRhaGyOyy$mj$&oyr8z40z!8wZKtw%D@P40 z46ze%TQ%6>#z50b6aCu?u$Ggi$wuB3#nVMPsD3(jh7L7C=uy1n!c_TT`7$P3b@lIB zj#aC>!&D0<8^hh0Y!r=`=11oz6)_g=T-s%HJQ*&LtkrQQABVPlV(zX7fX2QqZ#kvm zEY|FGOagnn$e&U99L`#v-X{iD8r|EV#>o}tJk$AVOn9SBZ6Sig5tl&lR-fKU{#B!y zP&LoFtVyxV(k^OfI5nwQ=6O!R%4KStk!xgjCwIzd6ie>P;Bel^)}&9~LdgKx-9&%8 z4BWAsXiYaJ;i8}-R!1m2N<@nU7r#PQ9A=E=xz$i-cZXz)#w^tR>o1#=y`g4eeigbo_BduH3cH{yda+v)5O6W~^IPiQyF6)%Xm#pLCq&*1X5tut-FATOg`7@u5x#Ogj zF9^7RTl0u`KM-ddctiIK!41K*IB9*Kx*WvqHYRv9Oxq}{g0fN7wWTsJ5iU`&q9C-D zP6c6MR8=3Ys@@QORaGHAB)qh3*R<2Rwv{Hjb0t`PB(3d4UdpvfsZnZH6PEb)D8(In zFRGyqp0shhFhbodB5Tk?^#Jgy*>}89+aa?~>5}A5=|+1}KEaE{lG|?DAkoZez@eF) zz(SVDIqO)xGBl}XCq-gq&6!nIpm$)qDL(hu9Knm|I`BgL#&V%#tzWB&SG3)1A-#U> zObJ?})}O5ebF47ey`F`%T;>Gtb9ylIOzwG3c*viFbyMs(GIJM&^B2)MGt^NvHe%e6 z$=KXlQ4@9+3x}~esp^MW&Bw0*J#&ITb~s_S&Ra!qNvh=LU}Vu8U881(+hi4K#VXWy zgKSoVgp zr6dk-NF@!9W=Bf&d`W^!BCJ9GCZDB3e%LD&9DAVPdD-EdP3Q4sh{MUp9kg$xHpZgH z>YKQ# ziCQY_gru|3T_BT*>8OAy%8NxMWfiSdwlqO?@||%DdrPAm?U9nUz~l-kP4Y$|Xx2&F z<9Zsg0Q9K&w^!Acw?^krtTOeG5N}8=TM-Gvc2Y34O>GiU8fWVo2{+_yCsP__zlj-( z<(&1s=_=8^Yp^*qDjRy3HGQnrzp0YD)d81%nSgu3}MH7=&9itY9nUUBGI$O_cRj_O|rc(`@ zPfL$)x$vbSCfmAvu{7bE$m!BGMn40@Yd{*h7VuZNijJU7wsW=gd&V>bvAN(>q4W9K z(U}QsV8q5IwLfF6r6xu*tGIa$$QME?I2r!h`37wa9sqIV{D=v0PFroTIj0dOdCR0S zu?2Jwl_|P~VH;94w2|?~w4$pnjmZ2}vZQ%V0qoak_hJ>6MR;i!t9#AiRkXqEaR{yc zlI_y*wMM6B!Jh$#g2_E*PiXODNAZb|ME)-RPH zi%hWSbO?aCq;-pY#lw&3apKS$#C!NYtQI7)mIg4(Ng4y(4z6gn>Brrz8jZJ8NX1@+!klJ)M&&Eb&IIqODX(YHk&Z(rn78c>C~P;YSKoTzA@O z--aftHVdrRyNi{{9UaM;bPCLAOS_V{n38loG0GI*(LvD*V0rz2t$aJ%MdzqJ21BRG zM5$3LHEMMu-0>1Q0sU=X6SXAMvP1@AW+vdFxB|OnZKk7Ab+M0Fn!nm&&$)w>1sM?x5sa zDO>*C)3t;*-Mo~{muUF-3$_wfz~k6%~(C{8_gC&L!}$@Qr4bc zTq~7|Og`~J_S$x_H)nYsJOa=k{Q24W!J_40c?V{hCO)WAqZoUk3k9qb`I z<RzCRP|0OY$&IH|R%_vIb{CJs;+pGpW4gj&Vw#q!hD`W4oL(ASo#F$0&u>ml z-y)d-%Zy}Q&*zz(<&_lA1XDODf5q0OK%!<+xvVn=?R$Q7K~kw40S9Mfl>ZKthVBqK z8Kj3lNnt;T0u+?I^?74WyW8Yjez6E9S23gf8fBho_LBYHCkUWL97+B{gxcBd3_ z=*-;|NzfLBm3CGL`9Lt&7z(Qzhj1m=q8*j9gs)^#G%>YU)vL8NB^T)h+nOjMJ9OqC z1AE-&qR*MNRToZ7D={CGssdTC&EyxwiuCbqP1G`_RuCUoo!gp7epX?-n?mA6_*a`h z7~eQwplw!^(cRWn-LTCVIow;_YB|_4CnkTcS{TOL|8%8rKh!^p@<-64pxD>U+6p5h zEXtyZ>A$MFEVYFS%4(q2?IsyUZL0{j@YdS7l0~;)3t2lXY~)j;3TS^UL7SA&g|lF` zRD$uJ-6rC$owF?*21MmM>#!S9v;G>ylQtf;>Tl@KYsw=YB_*YlbtYKN6IrJ0EG!H- zSzB6y6aiF{)yrGC90N*n&)cr`g$aw7=>`$OTplR`cT^>F`5^gN1D6k|SVfBQ?bwv9 zkdq>{=bCI-*wZ5vWL0LZArFL+Aq-o3KF0#;WNT+xeEnA@cXU==tXY}d(PeD0m*Sv( zY1hi+j%EI@<^Hb~49Oeqj=&lg+Gsbf2c>p&>cg5HU3zWYv6PbR^Az8)jLuiTmQ$Ph zwSq3;HRvQ=2^)x|L(;kAEo7J%Lr95E1*CY2oummE8JGl}NhTcs?n?TLgr}dpDy>ZJ zSXwJRd5h^i5klpCJ2ZU|O_`WJk4V~5O7br;BrNS>53!b>!!p8WDO_03ZK?RFzJ&0x zqMg?p`kX)i41i=Xc%HReBGtHRt|LVPbSZPJXYF=vuT*etSKS*xQXb~pR-Od`UmHz4 zy~7j`8G6A>;g+hF79Xb!9jQ-DeOZYCd8mqVF9nJCBU85Abcf$8W<4i$YNpyIY1o8Xi>__wizWJSMD!~4Jy^3XsX~A@Gv2LMkT z^x4R&t5MJ?q%t^f%ne(qF?vt|Vrz(2=yO#GIA-{KgqKerNUR!DimqmV@={M=B*u z?H{XDw48M^Dhz-}KT)*tvKg9IY~tZXsuKM=B61N2*EZ~cMp&u)(n);;_hbe(rK#S|S<5EzqG zX`BwLZ*VHk(x>W9xe@TGOrf_lUZNv)YhH=(oHcCcJesbP=~2QniFC9s{t9IBbC1`J z+72C)_y6O{*Z^*Ox=tofrpkU;QKeIlk4- zc(lKs_9GKKV$*^8?fjKV3G>N?t;6-ADeSRw88_>sS)=G*OH=hs)j+0Y=rz|HIv3At zY}zlXW4Rp96|~?S%_@I|ps+x%dZ{T3mB@PiZXDA$N-e%XRGFiR%CHiO=q)Y31pQ%o z(JZ2l2Wg;})W(xP2L~uAH1~?sCcknnb#Ra3BSq?#G}p%P%5Bm(i_A6I61(>I$<+og zSCH=kT_9E1W4m^mc8J`;(_BtAHD;&jdP&L1Jbtl!ai#JgBkh!=Oo3(1`T-i^N&_OP zKEEYQC9Z-xhoD%i1K@y4lG%~yIYUti8kKs@F784l#%*9y)6OfZfr%GWdMz1osP)Yo ze5xj8$ry!CRol8DSP*>OTebGZ-5A9g2Q?!7_0{m5dO4OtyXdRjff;sx1$MI1(ZtZt zMG1_TiLSwFM(6&kDBLkL*FKFeS@5D@yU_gygd=P3*VM?(hC#Tpe-43Qs;5ix^p+8* zC9yi5H~v`WX)>M|`jHyPOb3y7J%%M;a9Qp}W!X+=_v8y{>h9)?K6uqNo2DKm&%A8L zv2xTWCHcKjp3gLJAFr)mHpBYLI4pe>$9tER$cH&A&ogJlp+ga2hg8|k(BX(wm9om2 z(GtY-lv<{xsX;sC+9f&?QRvXak?(SKjy+x~(qrnYkV_Y7T76{GbW|-i*j^M;kfFzv znCJBs3CAOMZAACg%8tuTPef5pR4rVhVq3%^_MK|k|&<@>Kw~ANatdq(V=zz-4diHq9wdj8TdmX;} zonCrVb<$uqLvL1zuz6jF2UH$V5*~<}0KH3MSLRW41b#D!VW-y#k>o3wXlil%~`whXgvJsDU-g%H?bq1}gf7!XikehwJXYlj&}` zWAs?v^Y6lkmCLcrovt$!NlrOhCu%}AowGONeCAl){jBDIcy>BNm3mR@;7EZFjn%m_U_?+XltG_*>UMxNB1unkN7;8?au`;;#|z&O=3)$eb-i?vau zD3`LSF?wU8^aLZ#6gto-G~?l;$;Q!rplB{Tj6o`<=xC!XODe@H(y?$#hMsN|8t%?|e1t*^~APg9B9I2fBzq2YP9r`c#u=gYD4%`Jz(DydAKeG|vf@T1@fn6fs90 zn7@zfPUi}l0o&a~lTB~B8^)ykmO+|q>V6G=t0Pr9+=LTdil?yh;GCC^E)Z!1s(O8P zE)6HeV+-I2OF<$%y`W#TEIT(s2ja;>XsyZ9>nuat$P}RZbtIt_`ioqVTFCvs{Ok|Fw6*W52X@{fotncg z`IXX5pZrBSbaP_pGl~VWX?1rDFe=Ls?|6A$s&F!D{&3P60`E+9yCj=1m?(d$wN|+k5EKHJbd2W zoF+2uvGe{=VhBE-pabVO?ZKzsXKcfR?+4G9ZAK=w-o=Kw;8;2AgE{li`Fn6lOb$HM zDLoxN|6{5ez`?MooCBuLe>Jbjrq{qA4xqTMBdQ?~U_) zyrw)t4`2PBTkz$U9p5mp-l6Fmgw`-h$oKtbUmk z>>k|v$5f3Oy>awM;VDe8DI4_(IhhmM0^*vNwvA`q)Bdvw%vfOONER z7IZFM5r|oyrhGO#6 zTb(BASvX|EHv|L^!!{=>OJqdkfS6l@vF0XQEz?22!X-C22LIvsSVT>0B3V%t%88DM zTA`h`%%-e8zMrh_a8ShqX3hEQY-=po=1smtRh}n$A>?#`UI_ApgFW1A`#n{kzv<2I zqK_4@g4t60tc!4sg3-kE|NB-qzl%zR@KP)raB4ks>QAyBV}~DC;dOpG$L$Kf(&?}0 zsu~oApPb1I@RRFWZm^o3y;yxJ%?p#48=O|D3s@(^dVO;u`2r!6m>sy7W*Oe&1!E#5 zZYzen$SWGPp4sz+^bqDa-NPl<%zmRT5Ghha)P+RRCrO%-ByTi9yOli2=&d={7>c4b zi}zj2UHt=oAewNf{hv#yObgW5#ss6#zY>X0NzP`jje^;vI_9gpY=5%69)m9jmL zu9Q#gMQqojRpK@vhE3{`wvoyEj=tcVHH88BPSK8!0kMFl(!aJFjp>)SCWdX^?m%|& zm7_#bA2jbN5{YiTr#xd$&n)>|ch-v8F5a9NIwbrNpIMkd#7KZ^7=p`}To#L6-2tyk zkI>&rbYUgLeZ~#Xq#od$?cii@rJpcd9!c&D)yRT2c?<1}CZ^<;VHYOGo4m|6^tXj_YRF0ZZxMcWqkyioAvb!VP| zHZu^8!)@wGOxLT~!#d+2G>NUYS17wF1wvcP*jMHU<aN3LzQ_pT_kf-W6ym?`dxy&2Fw1^v>UdeV! ztd3w_b=2_?tA+C-R)1kg69RZ1fx6GOs8xGmXnlx@5b$LU zz+_@tD;W-qSoFrd7~@P)TNLut$~(fKJ2h%~I@GTbuBkaeooW<#wP2S&iWke?Xv!(g z7ztJCrF#tuWm4Gu(9;(rhL)>26l{I>4wpwdDLSFHGv$#kYL*W;tldbh-@-cu1tYAzMQlyDu_L0Xi&AQ*Iql(QnQ(b)VzVu2woBhpshA@k zJ=S~!8ZgPkWe@H(hiY%Z9UCr>(2vJ)mF6xPabMi&+)8s|@>WGVUxinhqiL7uq6r9$ z!tf2$dKG#Zw5p)!z_>w2m58FPiAjG{jPZ6*mkKWE>ybvWW8;{|UCWp9jMVm+qo*yT zmC^?mf&YjEeZe5`HjpNp6GKN;Z+I)Owotq_tGyG)X^Z{}eTf&#C2uh6q}1~>`vfhR z-LektZ(e*;X!{nllb#S919hx0d;?HD?WQIuV?!pYmAb%qq`>A!7fdQ=aX%J@=j1c@YsutMT|`HeNOO-uniKpn9#i~DVV z<0gaK;2sMhw26IRsX5WprAD9IRNEMq3Dx4bs_08!Hpj8m8d#Vji6Ok$gS$p$-&b+A zVc-%Uf0;QS)zE`OT87kgJZtgJ&JGpK2JEx;X2{Yf(FiL!W*(N>O3%Wn5Nkzg5nQ?S zDgwt=zK#GH1Es*Djkh$>rv9+j7}M-c)g{^zmH$;#1l7H@w&U5T(80niW)@^@ z8NMN$r#Fg4%kc(_mK&5((hoT(70wjD9%Q*UP_H;AEWe=;$2 zo5G(*o+*dxifP3JeAB7ml}q8=EtuHLJ0;8xhJ?wUT$sE~BQB+F*jTW^iobc%fGLr96!h@<+nHc>Oyt&Ft_#Gy6e5o)`ZEsU0%p$_qd zfF7zm7!b1X<(!Xq>u@AS18|Nc-cZVc&ki2gDr(ThuQ0-z*gDSVB}pir#gcmoWcrF_ z?G!zINJRua4Xtx*<XR%oiwF>U(-PqwQOJ0N&EEA zF50huE~Nwd=Q5hqKbO-%{c{B!(myYw!}2pc_#Q32-DFZQ1k@IrZo3n^;LlgFX^=nF zoS3{sF`KW0x^~7>EEjG^>fC&%*_Pps@f$QoUy{cBn|=lWD*<&2E0)ZS=ioaTG+{t~ z=1ya3I0YG+Lld?c{7&gpzO7G8Mx-Ll;M~L&jWWSrW@4UgQ;^H4i`CaCD)u9qp0|Lq$W~1 z+tVwjd~GavC2fQqwUo~;b;ydG&hkM`nmYMAAYrKa_uR#bj9M5Gvq+iIKs#+l6W@QR zRWr?Ka_!$2k(n8iHOZlBqo+>|3V~092NsLh&;uVQt>G1~G)c(DE8(@i#PmE(K{v}D ztR%Z3?8&3ID*qH`jM~I=#kFn3ytmWT!ONJ0*T7Mg7};>{&3;?r7u{1$KcnscdnLH3 zYuC=Mz*@^zvo+-r`p~{61RGo>{bo+CWBZriS0D68`*0z1^2!ispgs6-y|04iaHp`L z&!c{JrP7d?yhCz>xvI0(a!((A6?6y7bt(C~SB2CD4M~69XAoPbs`AOi`$qP2UTyTZm@=G)_SGk*^t4CJ7wjhJ z9qdn(b+&spRqCs{6)N8UYQ-Skz8+-euX9TD=&PHkQonGjnonjgF?4qmO+^+CnI)n@ zx2qdyO$>cb4Oq!?GwdYH^P9waDwAN3m7@iGJcXYFz0?d5V34c2+SuI&&3xY~N({{) zw4Zs4Sp?o!t%;t;6>4yA%jS5@UF`^Crd@00vT16NnGH9?0o&a+ieQP#!cOyK&$1_D zm*BWn$cuasa|BCQ&(2$FTN1DV@HlighN&}9R!8CIRY;9-@S9J(rimsa3n$Gb!svSl zwmC7hT=fVJV|?>Y5!@y zj!^VLzI2c;QnRcW7)hHQJ7wde65!W)b`^45?~>Qf*mxivyNt;*L=2tA_Z(!K8N#=n z4!qXv18$s@Y_GINZbW?gbJC0`q@K^c9_#?H8)-m3)IFRbxrT#zK%;Df2}mS;dH;Tc=wOf= zAqp=RKGiqqafB_Jf^stmYLOy$zrHC5)KSb?S!bQ=7F>ivRTsG9985#5vjiHcT&!Dg|aEI8SuM38+dcF?Vj*Nj8)IqP7=?}?38*$WBtu@X@ zTc-ae<=(da@k>^C8_57Y=G!4!40BiXs51nPJ204(U$2qJR4-YIaol;(5X`K zvkc~uS&1vjSqE2UXS=;C!UVT>SzH*s6So++ceYH;mv)1$XY^(T?l>(&isFmZ!%6B~ zxhkG>#3-LCmem?W-+UvM2KDDpP6OcBs(=TW`IWi3;80WqUapX#=HI*#6UWAt32MFY zUVJ#^JYS)p$5wIg;<Bkz8RfHQ$8*XZ|bubQ3^zRA4bps1o5D7(quh#tr|`6lniQRFp9yA)URG_o*wE z!8PjtWYj=OY-OwoqW30d*K!u^?CemF0O(Es)T)J22Z`)HI^STD0rn22H{1*9{Rx>T zK7**tXks!Z%&DA-iSG8AO!poIc*DIXjeno2?#XDy?5D=W9Bs6hYj3Wst6ss z7+mp5=~pmicEg-Viw~ePw^emU@-9gXrPWdtyzaswEh4<_L8wc8#Oqjjehsrhb_es_?tn-4+@~q69&M;4T;H5%tp*&N^PTQ|C@m&kOV>Td`DDn0;dr6 zl9C4>;QVZk^SULkm;&H{{>V8cc(l=|B#a=l68W_%>7-FR(hfv;Gl%0XToKk^)_5^R z2h~>z)Ax}2u=(q-`f>`zlFOZ+QYm(jbVMa_{=@1+NcEWd8umPzR=;h09917&3lfg0 z1gRG(PpgzvVNa^$dj7R&TPNsi(YRQkFGXi$zz@_(cQYx}q;Et+7s735$+P9tzYJYq z{PkVvOaY{$DGdx>1tE{91dzwGQ~Vm$!*vsH!BC+>SVTNJT6fl4k&?yeWSub&MsZFl zqLKskZ;_8&Ig@pYR%w(D)nn>Xyf~IY3})M-srrt$aUD*!RIZ86 zib;|xS!s}xqn5{7`+)}L|M;+#ru!RY*%CtW<;ls0?@pp2CKjh0QYq*Vp4*ygc$^{F z?0KZ&C752pY?8K_dM`f^TB_ z8_geO=n`)Ws=4La5Gkl6n&@d$R01#S7ZnksU7msr1}!M`>$ir6O=d2n2G~jA^ss@` z_Iqa6sC;%ZYH3R(Z&FA}s-PyK4T2CR2yU-g(i8)6Qc`po-%(9!;H>etG2Z?T4Ki^X z2dX)TFY?wrIq?SnETez*MWXkuDZT6`mT+EUyZal9E5#4ojF z(%26VXG?qR6atPkCo1iVLXNg_!h4a$XOy?K0R@6$Z=P(TMBXay^mlb&O6+jAjEq#V zDpF~3^{KRI`YocQ;0;`u0Q|mT8naEYIWZkkqF0n6I_o|h4gj4ZMXMyeU+m(ypH!h$ zBda!ofqEMbO2v9F$DJ}>r3%GW3O0!%fx~g9SZEq!>R+_N*<8zzGP?w0o<>M>To}L3 zwTi2uxc>V)ur__IYVc>mH7BMoQv;XIdPRPVN7;4Znviue8%U51#&2dV8{ctK!r{1V z4&wtq90|E1n*>N)bz+AZrDYpWrCAn}MLSpM!YDEn-UT%p)B-21_B`9gqnBccdHg@2 z{JvWF%IBvVfNhE7LyBIznQ8gGI%Y$PrwR_@EZF)rWs4iJ)6@($g_`PlStp|&s%-_D z23c#g_OkypW*Y~1h2h=yJQe4)HIe+h!Y1!!h&xX4noCHH(y@2)PC@M-<>VV6ddeIp+m%peEkCVC_IHC0-+?fZl zMHNiJV|d|Ws9XW-nsr6q)kJ5gHv?BJqx$G+lm07tmz%7#zbZn03|^PrylL;I?iXTf zs{YPeyi*_Jee+#Lx(-k-G;9dduwe!b!$IUBp4yb8xx}aBs6C!8=Zowe?zYb{vtIpf zY^CKq`y{oH@hCsU(rLd!Suy6Htmu|^8>|{a&U|JjHEOwVun3Pz82n>3Y6?Fk#tg2c z6n;yHq^PLMdkbz_5|n>m9w9QCnGF00*#xyptPrdQFytgY{$JQA;1lP$?NSduIkv=N z`7RZZc`?HV45d)FUHa#{c{Z(3e1Sq$FMBi_GAJnb*8d7I%4OoUE}YUI=9GS;0;n8) zS+7*cxK^HCchIQBpE+Te{Y`=KjLq^M(R&Y~=Vd2ti{-4+BxW*g=c0X*5Og?P=gNc9 z=??~M$=&SFo#X@12{mFoZ*mkNWA@@k{VzBATVt@MUaEHQGz5Ko4 zoaLQeRcapZNU#s7B*WZNX`r(f*Vw%P_SqbTYz=NigfN*!bZ({S^^Ctr&Y2B|q$QA0 zg0dFmtKJ88Vz$$d()Z`>(r6(~7vQ1psqa@YkqaAzDL8qESj~t8EFw@(apk^dD*Fpa zFM^)yljf|&JA<8u0kr4+#<=70H#LDxnAS6=jthpUQghjo_d|Hh#$}=20)0`rXz2%x z_JSMNTJcv<#^H)wFsFeJptXLuI8pSSi}BHGIqMN!LsonW?ow1$_CN2RLH+rHq4EoG=9zpPewR_1ClI$#?&TUhH974?hfa!{RP>7v)nK<;D9UjD@1dsZr<1CAZuY_kbq&S?H8o|K31#0~ z#e}oh`uaoCgRoff;W3>FLSe=MDI{9$!Q(OkAELD8!>w}|t&B5paJP?w@FCMXpyI5P zV)kMIMi>T-(fwe4F4CR*Q3C^CH>v_MSOr%)l^}(!DQo4jH{n55*~zxBKqLrNk+9(KzTjJ5b~Nwx#Dw((xcK~YQ7Y*~QV97(qDQ5*S~c0UV8NtofAO~yVJ!4LQ!rJkLv=$Riksg{RzmyXmV zndC(Sdiev!14B%dKv@&;`$N@x6W%79{W<9$W*cW{1~vd{&e}Y}`O*2Gt~I2Rci>0! zYG7zOeINplN70KugQ4}`Tba5|4oPrH3b!sjI&xdX&!+&x1^U@bc>1=6Qjj*tF&>WI z)*zcmhU2s~mY4PDn9krva6NHjc8@K2Pv6!6p9hk>0X$1HVDrYFDz`UaZ-dP{M~&#` zr=<4Xu3AyCBzj#toh{M++Z95)>A>v`TfYE&c}jTn*zFBB8sB~8jLq%P^zG{O5X9ui zU?eod(c2r=f61=^^V_3+cQo*XlS*m-9SX!R>d~P)8g_HBvVP}<>-6Y|&fxy5#A%%f zGlfcfTBoJTE+^6cI~yM2I#bwPSvi`#v*D~S12>F~Os>iA%){K~d$4@rTlGRG^A#!q zJ@j24)J|os+(_18f$K{4(^c6j0JzjQ^}TS}-cdU>wq92tF#EnAhS`>NCiv2xWItS$ z4ZoOdPT_Xo2jQ|?ZM;o5oKr7hOjl(OWF3CY!d6Wmd?Z}_I@=oSvz)Xpf2=BB{7(h1 z!;gl`O4wY%TEz>b_wATAKRdJmLA> zbmWKggjciqe8DYQ2HGC&`_a6296`}Cu~-h=qWY2`lsAvXo~ z-`emh&g1xAhi`2-%3q8Ve9h^=Z4FmFUCjDvClNocz8E84=SRT zw*h3JhMl`HID%W-F#8eQqMhBHmv`-2EdPaTA}vNOV%iI`ezNv zt{SKTw(qm3xo1YrzTzeQVk|0#51k|^IXNc&o%{@ z+>AQF%~eQ5t1IBfCc_nEY)(B{aRv5^&l)au%)tHWaWdZI^m`4(X)B_ud*(TuD=GAL z^iMpy#a^s}2Wl=&GLHuM8?~)`kd1J9B>WtMYa-hNu2~qLooi-B@8HMQd^^7$5MK3y z5FW0b;}?h4WZ;cDtL3#=a%YxVXJu^nWW|!Vm@h~(PDEp$$21PwrU6;~bqd!^J2){I zhENx1AP`18cplMRTx~wMTEu2^1HoE_9{v0raYwdi9q<6$D&`E7&mz~@j4RGIjri~{y>!Z0VFZ~i z{xe*%b;9|hy6G7ZHVk_I6cg6prAhF$)-y>(KK$dBfR-)K%t1?kU!N+Lm+;OTzLW!2 zntB3kcB`A;M(<{TpZ5hU8J)Wp?_Ab-`Ld-Q%L3%EvWgD&UtgHK^i-kJOW!NjZ}^&$?gJEQWv+8X)w z>V#kcEL!R0PR%FDTj=I5H&Nvqk+9mduU70yUDv-*`IMn&>Ec9Jdxc^41LJidxNK-u1VY61Ru8eR3MVIj2hClF*K(kt^i&@9+wTfD`5;Y=u7k~pS zbu%yfN>e}$Su!AD2JO-y>e1#$W0kc0M`koL&0g%!Gi!&va+{USv2JD7Tb^a*4Hww{ z-%T~tH=YXE3VOkTqn{S=;*Dj?wH&;?jp(`nfk1x00bilVNC_Zu7kC0mGl7z~m}BF& z;t?AnDIRWwqIe}1b`(o0q*hJ{h(2@o2?=Qs+{Hyo{jiUwdF@iUBc>ruJqYR>8tB@u z))Kojz`6t0Go}I?Er_2nC4`x2MQj_2J9y+q`8|)o9II{!7E09dfhCx1KF%{5`aPo? z>=~JukZ7>w_-1^6vS##K_NK*Fd=9?GJ_opcDlx6%4#}$qLF+;3d%p@Qg-U;-Xv zGn?i6otS=j+%OjR7$>6-1 zr#Y+L%vL+ICd+pqVjZyfzrM=l1c&oV8hPd#jhm@@!NQ(UjYOPpAE*w)leraxYp_G8 zzBhaw9HB1oK zzo2@*iXWh2r(oqWc+6fjj<5$^z|s<e>uOg@z)tZxXd&wRT{ zqcsC;;@c*Pr7+wA6)GG)5DM) zkoxTL&95vsd`IRSR&02Nw)A{TnEb5T4bcz3ZE$NK($tzBK9HbCzGDFUtX&)SS!f%9 z`CdgGP4UYu1HHcDQFc-Tz52RUvE=e{-ccp;Yqx*xcTPGqn&VXkyfpiXELi5aV9Pwg zt1oua<_!Z?ojU2EpMQ5QqUCJMDHs0*YEf(SHjH~VtzI$@__C_uyT7YvpyI(xs(NR9 ztD@~X6qhg!sd$&@;c4h_C?40pTI=7wYY1Z9@#e&IPL@pci0#(q^b0zt3*7xZNCkhG z6ygNze0dn~v0^a^NPX%LYK=q)Btx zc!~J2!>JF!6A)gje*?oE(h^fu8Ak6qkEAA7`L_dI(bGhlNfdAam0p0}KFdj7YLs6oD|vMIlpB8<8ksO^AAQsqZXX$+v@{h#!^TMpN zW%vd=Rq|+m3`0tY5TcU~s3eY_#D~%R#@VEqj5qJnbkIyI6L(B zS>7n1+N4+}wJGbRkkBCsh0>_);=5bE(T@!UE9XBEoa&uGV9d36W?aRy(rJ9cm8OBg z@Fkj=UA^*$1|>8jnUt75EE6Q)GP?K2p-3MyOKtd3jY?@pqH>j@>V{rMLL9>3klJXd zEu6C^!|>|aCJi4{)GgqC^F8vt-LqXT*eBmX0SP1)FrFq1Jz&y9P0oPE$;7n2pobww zTzbuH%zd1oqTXk6g<&hlf%i4L@x);mVYi_D87;m4$Huq>Lcv63a!QGC&d%OsyZY@z zmc|HYrQCqLb$SI>xT(cT!>ie#Q+?=aEV&^TP5~aveqtaRh^hdfJ282t;-w4^fJQH~ zwJd?x6jJ;R&mfIYW^=*WP*7OJGuK%XHdW2bOfPHdX+0@R9A(i{Q!*fJEu4P(lhBa~ zq$t+hV8e;kSFha9nPcS+w7ik5!!A*@<7c%rJU@H-++fS^n?Nn~(lb2@@gC>Hp{V>$ zIVELpjPIs15E+06mRg;kg;oN;fj|EgYE)-Or>`OKuz^45Pd{s-Bj<*dB0Jbc1%Sp8 z!H7d7_E`9dM&W>|OtWIb0sEDd4GgB)WR+<)sPuuKJ?rg|jjI52*mbu59GwrS&+v59 zB_`?TwjpT+fJ=tAT{@}i5_lGORrGzIZ4*V5TE_cn@z;R+_<-yWS0;BX*A~{~E#}TD zWS!z(@cvEx>e44GJC;(Cx0vxA%czYh8sD*8`PfnmV)nt~gD!Z{sq~y76|51P?UVF6 z>y%b33-@+!!Of-dl<6EB&2LRZH-VY=SNJ7r^onJ?9JEXwmYrHK8h(|u=NIOPXqpH4 z#)+tFTVBB-dM8KbVm~#gJ%u7~Nz@WEl6A5kt3xVXy_n>w@7{s!Ebv=d;0Hn=XtCiJ z&zcD(I-Jib;rNepP%8)q@CYJwo@`8JP-PCj*W}k_{B;WpearN#L;;wa33ORRI@`)b zXNG{GBT%J_xPxrirb2w%ut~GSGrz<<6x*MVR1w;`@C4Cmc!;`MQ7^XBPk(8u;koP{ z8>=zHOE&%ZXsw24!tJXM7UoQ9z;@w)Ky)8J$&+U{jE#6TkD_~6YlQ;1 zDeGkO<-Ar{+_JORnjjUMFja8)wKqzNzkAN|O1(O*?XO2cM!zAr&-0FuhtgnT+kyfMk{A(@xV4-ZOB;e)%Cu19ou7r%@?{Z`M4E@(pBAhSSES4AT6! zvZ*4*8aVF-iThNdsod^YX=noOMs}JGD9aC$&;q|kHyIJa`I<7P9#pADjhuc+r4MIN zfw~TGSS4DXm-S>zGNqEzdPf2jcnvtBaz%{PnsYIMa4f-#ePe*vF zgzE=}w(H?RKDKj7$8>EfSDU*Own)`?AfAp4JdWX)ez3dhfb9Z;Ds_?-V7rW&ZVcAYOG3yurBrs#Yd#l2e!E&7-!! zlf&1>W-0XC$D5R%q+N?{q2F&jm7bG4MWp-lE)UC%>US&$tTYBU@moYGsE!IS^BqbB zUTH|s3bikr2}HDNFU%}OD^1C(e%oZ88qb7QRet4hCStc4w`ID1VdX062d`4o^(R}0 z6q%}(8YmmHE%SjM!)v%9-E$Cx`uWh0;f#Lzqk@gE<7LF&ZPblt40ZH!JXuK5mJB8V z-%D%eosGduQvB#|LxUuV7yZtV=*Ee^>Y`>J?JNu5rIw+O$e^6%6M`iyzl}$4za~_n zst5c$u$^VTUQ2%Ve+FRC)l@ZHU$B(0gv7yEx`mWSYpaKC1}VPxyINjVBiUSzH%QoxXnLotqLs>)CR9dPdqD|p zInaR0asV|Z7&Jp|0RwBb<%gYfIPK59Rm^gH=;mNdLmC<%f&PoLkF_&7h1H#xv*qM1 z=9Vbb4mu;7MYS92qEW+{!WkPe-zuS?v}4vNU%R5#>wg!L zTMEi(^Ugo~i(4!v$Ftf{@mf5`oYzYR)=>YH#-FIZ<^da)ZC+jA9HQJyF|VMw+3p^z zl-*;iU=$qNzIEv_WaG3AafXuenL^n6Hu=pWuH%|N0gOdlxBSKvw;uIigRWjL=zG(X zVJeoa6q^qPwVVHF%0146c7SHzd93D$qPzyF7`z&crUB81hkRpy!cv5r+Q|!nF`36T zDZjGoj+q9&s!D3Hjq!9Z$z#E6&l2j@ZUp#z?iiN2uI1sE3#LyC@3;OAAALP%7@IA8 zU;)ZJ^ru-V69COl8y^PP(8W*q)VcbJnM36R(~Wg~3eMnUMv&JVg`oT{miS(=AKW{WLa-bFOK9(!_^H~@ zd2$vknV2&LNZHv7?=?J1s_h$4)blpc2aaRXXQ;1*l^VPNR~j$TfXsOWU$pJ@We4HF zcLd?UJ-U7b#*_d_zljH*4Dr?2h>LdmjD{Ve;kTpJVoKX$Qw8`S7gO4fm~*usi&xY> zEF(o_M~v^W+@cN;Y`K{tRfh)lbh9gtn}qUlOddBz(NL`*C9rK1VRoh|u}mn{Cy>sk zwPBLrYC>ESSR}wddTH1ES?hw9n5KN6lIbQmcGpm}N2OIf(Z?9`#6$To!l*Uls_srAFOP zJf&m=d}HML%vE6-dR0{~Fj8CgI=1VLW{ZTj{n79{;aX0*kYDG(*b%T`R!a%Ts*dP)1PaR(u6PstF*3!SE^8Svw6q^4ox4>$}D{4 zpJz7AovSn3H3mCn@e!r6DbZh=sAc+)Y$<#iRRQgfB&LRhYt$}4+-x!`0;_rkr&*rC z@g}@{!MP5P6}O6tU9?=-QqC6DzvyNin2(fgYpdS9CF>7Gfo#?qxQE#kBY&rnRC@LK( zm8e;M@kLYh(;C-Zw_Ug2DcKoBS5SSoU3beK6&X=IKbduk<&vM+$>a=h4dHY4U$o;2 ztE=szwNmu-$z>u__(|qwF&BwrN(k^PetAsHV##e!>R*>gT`-$Z>6f12Pv0Doe|aR% zWdr@}WgGvh@nh7Mc2V^7p}3&d9O1Q6s?gaZe?6(1u3BUJwXb#IrXib;cmty~kra&f z{poS`C`GxI$sNo1N3n!6u#P}#gtj$-FX;xpXNzr(#3sNQn8d`#85k%5&0n|YV?l^? z;tQ-`${H8haTk782zH3Vjr$r9npx#W5w1(u0J8WdvA#Hqo655S!E=F6H@Hz;GWJ13 zQpA7>$R^<#=-36AV%VvR@vlx2GPa}TFR5 z;##fgL|3#Nc%|X~oL^&r8k>HU6a7`+GO$01AwcsUA2Wp~MIP4JIkvEHUzOea*`L5} zq82h~diteUQ%g7Zbi7Fj)CE+d2cG{ zq)lIymQGWk8f$WL@5#-vH|Ji?Ik!!~Y7|DQ<7j6TtoRmve8G1VUzkU6B98v?9Z?)a zAOD#_Mih1M6%+=3pYK|GpR>=oH#cdE%KU!B5A~k?vi90*uf6u#Yp=aFMw(B}S$MH% z<9@Sf6HP9nHv}5HqtXB0g%@JQi(+cf!r(jf4r(-r6=BBL>7rtW2{tkYNFim~so`VHy{=lrD$@}3VRLK%pwAIZa8{wfpAGVf3sgbU#^O0qL86ShWM%?iae=NYGq`j)>Q%B(5vc9Dyhsc(h&{S zSEE-&F#{8orxD<{E9DM2{3NpD>?V~K9*@j6GN@6zE90YEVa&Sp+7`F~U6+SSToMOH6v?vzwg2XO9DVs45O- ziD{hdsK1CBum$QXg2L6WSpp^>g`0lU8iW^$kTJo1cu6CkIOyr=jBXD}K0Ul=CEfq% zlK7tO{zsP>^H6k~!SV!0GYSP}T$rGDgs4AZ{sPiaAC!ec4mbA0kD^2di7qm8@cm?V z=5P&}+_xLMp;YTys{2*E`KCcYZr%}nVL3QytQ?d*n==0wUlA`wRaY%me+=OJ0XLdL_3^RB&>Es6$FOIghy zuyRhS=MtkXn$`ZU!C*VdxL8|94SdG5jnZ)odp+Bxrt?mL5C|8oMAbVQFiv5V6+IYI zDu*|5Xx}LYpCD9>1Z1gJ^np_v5p*XRJ;sdBVnQ}Zfz9@g%|v3V9j3Y~p93u$FGXE6 zHl`nyEa9GOusf?Lg<~Z30HnN8pX{b|;OHp^>3lB>v#?1s*sn{(vDqnXv4MB+6)k8) zn;6lkJq@;LCFmKaO*l?XCM6@WWs(FGTr8_fa4P1}=yzwtukferVu#uDVHqP{prle`>(aF9tz(M^>iNhVbj&XGTEeVqxu6pmgi-L(2)4U zL=UZBiEDhGM|AZnOgsH@4K5dhj+xbS=ELB4lOc4hQOd2y2R7>lu>)6lPAtHdOz zJXpG~gEDHwI@Lx5Tex;mka?|-HF5A-Kl7h4nGiTa1uaBa&2TP7(=9B)K?Yk!ULj`X zr~o#fux22-PnG&ATW%lBrp%$y%o8gz{fx+_WM&{5j_q|4wVm2Xb)4nX^wMvg3dRZL zwOND8DN~Y((S`BQuuP@7GN0&m+*HZRQR|22Z%0GBt9ElHn-wJfIR`+mOO=Xp? zSg+m}X@hp03U#Kt&%A|tZ$cNpmwkdeqVP*%0o;jLKl%dc`ld#z^5jW4B2}swad}D= zL3yf_U(r-a{P`j)m55jwsOWpF!lg~-Vj)eUQ^}A`hz?~iVkj{byJ-h3MT?<)ah*SI zmF#sDDtaYLbVmCNWcrz*+Jw#=-cOILHhKOpjg2vkIlMKNy% zZIQ!#PD3}ZF$YGsT3OCuT{gI@$O9EZgGIc6e(f5w$MBqT{J?g_x14V_zp%MlUHg0$d3-6R$+zrb;-SiYbO^tA?2606*q&^S6;%I(7Ha);UxK~0s0VkU@VO8 zIF|G6%XBW2clsZNR^lC#N(SC3OvX-&Y^pWYbF9YA9Wu2>57ng6Qz z1p8Ayd~lv!aNP3bx-F=+<)G~bbc*@lWAji)XCE&6$c;WVQ)*Y9UKMAc>AHwR0yrX+ z?5x?-;NY-tXZ2O;;NY-}Pjw+DRI|dGzc}5bZJ7M5R+F@~4`r|!>*{3nm|vQ%aZDw_ zm9Q`2?WT@V4hZ5(GMxwrj;(af)@vCsCTd`E!P#I_V8W5`a8x8%;Pqic>J4@F_H}pl zbgQ@@*w{>^4catUDFD5FdV0FjE-*b^M{BvA-fq4`-9jpMQ8?)x41vdkYV5U~V3?Qq zgI0lfYzRqmgQ*E)WlS3b!fd)Rg6unan_1EbPOH<=vt-Fu29Q8Jkk}3u%8?(uU=R^{|tx@YdJOtA+||A$GgX z3kwM=XKQOfEFZI+#S`)_qA6J^Tk)+a_*kKU$P zy?UGGb!b;NuT#mxh<;U(Sp5`Cy`hd?NQB;Q`u0;|d=;icMouTf&NfvOLL%=Mp%-JF z%HV+W{BZxzVeVm-N~HUxXk)A7)w)u)GHuM28=mJxAhAM48|LAhJ!Tu`eJCZoJ&w!5 zL?3jMQhPtt@ug=PWI73T{C_kN3{~o}*aiHLrp1G2U>?n{djAjZ9Ibtt$?X5{?4xm_ zkD($GB{P&rR3{03NlWKa=#V_-QtMl{VJU~Sq0D=S@f)&*+O~{9W2>7(T*%>UifFjaK5-InWQcR2-l)c%UI8>waF zh_XyqFGJ~(PfG!8M6NwMrX<9{?LHfebbEAjDxUqwwDE?-z=JP7+@lgLG98 z`PJDAnT*4Ji0MB394>+6=dD)z-PgCZu=Jo3&4q`dyI-7Ncf5z-&^K2crXEDInf|PrPPI2##?f1dB0H_s*kSRY@(%02 zE`lIF(I#Yk7nm)H#&`&MFb%_%&=k|3CZ1(3tD1L=0!EC?&^2k2IB29H9E=JVJj>V^ zl^k_7#Taw=Ka_O5YJ6N`6?DjI4qtr=B2vbIi`@IWXJK#+BqjN)W*AQ@XLP5c5~YVUxOBT;=8kmdSK=B z`=lIW$Ij6yyxJR$#Gt$m4b)`Th*C9Ng_1YUC->O--L|)zo_ZymBQ06vnuj{faGkcs6{F^`QG4S^e4PRvk#rGdABU z>bh7s3RSNyMH_pr{OfbTVPR`{Qg^TAAE0N?7~&%#q4E$;B0PvrWpSAhPWf{vd+y>_ z${M4^(2r-w+u4&_-?5>q$6h~b_l$N~9itoU^&5J+dV2asM>mXiuJ7K^*}0*&Z+&*G zE1T=ukX=8vVMDHKth=*!edm~E@24OAwMlChoQTb(1|+#n4Hff~Z}{YPb|>HdOa2m|Xc3f=wSSm3Lu!-l!vwXn zQBXpoQr{B3a;Z$beu>6qwNVMBER|vjqa~VD3BiG&Sn^9WT_*`8%d;lvNS(}0v31}m zqU_UA72KH7=Oc(W)ro~YUv#37Hymz|_c}9mEsPi9Z269xwIhqW2?1oRn|Bo2t|s4*~(%ZWFs4BSX_-26o@lIfr8B*e7iBIJ$)@1*~u zie`&m(Vlby`m9RutgHYk_GRLSOxu*#2G*#mU5Dv0Mz&{G^i1BT9cmA>5 z#Y!FWoWLF}kI}t#;$`AH`D`&~x6^dJFr!N7pd(R2DN9GympGqoW9F+L#I_)nFP5@2 zqw*~`Yx_ab^XdBf+g^vRb5OlfmTpibFecexl5SGp;7ddvnXPZU4CVDD=3DF8Hz`%H zM(u)6bM-Pk*b+|n)~gGQh#r3Fxb4#Y(W#N04K^d@?Su7ldYAOP%F)C1@VFvo7zCJ{ zUh-rF%}a@6IUQNT>URq3zfVV(&`}@;9mCxPaQhA3cb%;y1$_XK}l}8z~Fu$lwZ4$~%>R)O(0i746?6KSf)c!Qg z%Sidqct5!l{ao}K+tV}J*V&Wn&8_e4>+T%0+Iu@YdwTnNt+8%)Oya+H1FWbdIg>wAT0Rr_Xkog!(f!d~%EX$#?wxE>JpLgijVA-M+yj zAH_|)&$G3F_&(r6Vqb0?B(gEIsuin%K7mCf_GLe zz|xeu19Gd9#wEI~?sf);dmDJ3^?aI|%1xp8>(rNWc^to-j;a*AuZLxX-lT%8u?M@IqifW+ zYabeP@~nZ-wJMD-hGUVVH`mL$>bTi_k&dZ+$G0Z~&!V@4-&^p#!yTaOl1YP3p5Cew zaRq>-#M_kY#v2a|YJz4|nS47-*Nxe1*+bB%cd2xi&%CO?yIvM-t57Hnx>m^_F9vjd z{R{EfPzrcr{ij*Aej$NwRn)-hVCf3a`V*A*5~D&1E9mcL`VTiyY>v;JwX#)qXs zDbLj#DkAG+_tuL{M3}x^#hi_G>Izf=@$h`b^b%3n%p?9HwqUVTtfcN0+~v=aJHh11Ecc-n3kL zf{|tl9a}CmN<~JkBTvsg$LAm-7;uQYn6k?vJPB>A~ef!$Xd%nxg3y9j^tP zgE_xAxSOU|2oQYk9-t%YQ%xQ`fOT|*C<`)gciV0b)8Nj7ZuQYkD}S~fh-7iDfM^hO?<&!oKq!B^UC80F z%llUe9m7O=aMcdcpWp^_ER`w3To&mOCoQF~>R$XVoZUEJ(qNAc@o?^{<;KyxrsOD*wONR_Gp_`dV8 z((Cq07*Y7HU=eDWyIRa!#zpxFeh{*XZaJZ%M84yKMr!F_Sub?faCPp3r>19gSjq{a zw~t|74AV^N#tSewp}9$ycQ3%k695LD+o+6Z z>>d@foAJUeb~BYZ^W23dt0q2+QHXmR=PiZ-FxLM~ctUd_N@|cY{TY)Qmi=hTGy01K zj-!i%7S3xrGO-p#%2Zr1iFM=1s~}n-W>o7smc22wdPmCsdRO714Sk;ZmG~7sJqNHp z98LJ#cjC5ec+rK6Bp(j%r?uy@|6Yi@U(OZt^j*&|lCC{>sH-z7q3lZMl#C*^g;WS! zUXrXKqVUF~*?Wob!z=HV1q79y)qU^i+z_E8yT~JnJ8Q3mW7<$>Pw)Pa6+&{wkk{GF zd@x;^qDw40`T*a_k$QTAbz5JDvBu$tuY!t3lO_T<-X9ZPUU6(Ahd`mPU1N|@C=De0 z=#t)8Mu?-6J>cUd1-fdZxlgIgH;z8AEbFZ?3xK_Vq8uo7%0&1C4LtH%4(G}F- zcF)^rb|qiT*`wwB4mV4`sfv(Mz?jas6iEEu7D4x>rtO*^=BdDl=n2SB*v!#&>p{j_WIiFYIk>oMq6668bN#n2ic zJ*TgmNS~g}Z3xej49!>7ykRp)#vjtudCH^V9BSWUP{L%Zs7S+UBTqN@ikU0MR#DMq zThP#nj7C;;cQZK$=y86lSnTAr@iV@NR zJU5!Z#PaCUZ6;=kOhY3#1u1XxsOdxdpjOC147EO!A7jYbW0VoiCRAKiODngb`H;SX z6%DSQX$Kphy^YE`D1#q`tB)*U+GT zgP7g1h@e@^w~Z*EAKB3uMgg^+4{g8taeBye0>IdcWQpFuhX~wFxpfe6l@x#Zjz%B> zRi>lYX#M_Yt_)j$d9BuEyyv0EP^i&yYrMag8_gZPHEzM5zXRRH&E#49GPG<4!=y2m ze1$wvZlUnOrlH=Ro~}rxl$tj^-uf_=Gu1~N!j`B3z$xV( z!jVYD6=4mc@B&B{qv5?cX{6MJX8$U(pK)O$%^r?-@FDY&cw51_=LL;a8N$XZ7K3m* zsZog>_)AtU6JE2(95yeGpe8X{D8<*S<-$nwQ0y6r-Equzn_T4Nvj|}PN3(+wWmT>* zlN?-Qqf>W+ExBgJWKwm$d|`}|PM&KzI}Jjb?QpIcA4kd&kxkVl6!*_cDvWvYY=8`o@sPt4qwFLjN_IT zQhU*e@Cf%1v#t34upj!z`TnppuIN#+a>Lntak!mUedE1Yu~8Z!+$!941@8M}_^8B3 z&3>=ti#HHkee|jK$JXy~mH`$!m9)_3WG@|=kw%^1pq<4L|Lt&+ntO??QBeUa_tLT- zFn9gpqG|*;3K-kZVj-vB3CP)nz*0R-`T22&l%s5@l^7sCcu{NwilgN*!ZBIP?9EBk zJ$noX=R56SyqM$XkLlR%Y8X~2XmW=eUhrZ(m?$B*zi+l03R;zkGp5A5 zLYZh3RH0pe+sF=mN-4xlNz|!_L!gmD!vsmaNOlHW40kGNG2;EIn^929$$c zfhH~e>NTfG7I3Cdje9X7V*)!Ag(~yjy7b&Ff{ujq_k1EbtiuWN?g2IXS@5K)OvdV??o;E<&<(6J;Xz@fR3BZ7YC;%MvDdK za@*VJ)8ahOwcVl;2|QN2tO=W1CD-PG%)ly3e8jKsR`M)v=k#bm zD_S4jYYqd91ddyvt1kwr)n7+FfJKm*v8G1!Whj7VH?Vhe0Pkm#H>E`wk@#|L{VNk&(lC0woiowH0r{r#m^|k2txK!% zUA&B;)bd3&x{J@j`9Yrs{vGjAyyi8Rf}4hn0|uQ>A3I|3NF;g6E|ht1s42A%0u?OC5&&~DoRTJB zy8MNpqxv%*6p0mz-Vy=XwS<*6s!P~t)OgGWv*UJdkL?%BUKZZ6flYhL7~~hrDgh04 zeTX1efiyn-MFw)sL)D55yr_|mBrcS%jtnW-^3WF4@veIJC+D*d`D67e#IUai^}*~8|92IYEb9k9zKYD!>(0_gcfk^+kSB2@{{Edo=M=@mqgNK=e?% zJf*b2!XsfPJ2z3xJ5)GpA- zON`N}G}KpCFt(pBhzzr`GZYPo&Z;;RsRWaL2`ie5C>hB{;HqWgPxfQRRhNwm5M6T+ z_@KhM0J>OPROB43!*oFbeIZ{KpJB1(2K@XV86}IPO+Mvgs$CNPrQ3Or-SDle1%C?P|g04av zpW`i#`V-QWUEdnBbySk`GV$+oWDrbx!JCHvX{uuq%MozA+I(QH88NJJ*?f_mec&ky z5oqu^9wf3S1HB{lo%}%2O(bi zi|Sn_Fk97lGkDCmw>tu-E9`Y9>_u0yi(@s*!rf8#W<2M?fEg`kIs?02bwFbx6j*s5 z$+5{4;p^?PCnHln2*hs+MFn(+HkHQ!hBt*#F3u)G4BTR1Bhb#%#*C4xTt}W5IP5GU z8a{po?xc^}%h@0kJ=5^S#KVmFGfq4!hc(vpGI(M@qIvdbmxOff0aFk@F)mi{xLBd+ zh!Lg3BX$p^)FEnspD0Do*EhYo3ksHA0kNc0tEAb*G0Mno5Vau3jn6;31~tKPwEee; zzmnpGmPT&j8(A78)V6Uci-e&e;mP)dHuIO&X6U63+eJDh@H(zSU_(?9qI1!< z3Ra9amB$vj4}(rGn|m}1hja-HqT+y7n8@O`sx64ysq|^nQdN+BMA9^67Qbx*Yl&7a z8S9-^iH^FaNUO-c!JJuefZ+#f5cI2I&lfNy5Yu1RbrbFJdncZj{0n zpX(-fNPFzOQ**47ERdi zb1O(-Wb-XH`gn0(dQ_CH{!|xtG+7n_wQY~+DJ3|OKyXsi=29hrlJ#h3u?DpmWd+(` z2OJX;F*W!x^M+t{Wd&~}TT)=YTg3F}<@ds{IS^-(1)d4xF7LETyWqKUUuj+n>LS~t zW4ADD|j|Z9|k%(YLg3eOu2TBV^GOj-259#=sR1Q|mIyyTxFKyWO@B)o4C@ z)n+CktUc#?ASO(REN|Fe^$_0#GA?~pMS;LT$J^Ih7qIvSThchdzCq&R_MkT};~1q( zi4<6)#1bsY3`Y4|y^2XMC*MbWH1`!TQN<;n6v(7Uz91(ohRXtMh&wjxLogg}@7S!o zv*bir4#5)4DFD~|l|~!MiOe>@N}Fw(eT-dovrWRrG8iDRpU`n%fR3rZc*o3QvxaCl zMJ)_oYMBCko3KJ8`(wgs3Kng%WIi+M@=S=hT&{n?*a3zY_n8`Y@_U&)U~bRNWN7*!J(EYMnPag{~fBtYiyym1L(I%B1w;&p1KC~g?Z&_Czkyh9%q zTGR}RiZ>oyaC}2czcuQtLrv}%`vSvV)Hu`Hstv9C+Nt3`p8*X51IP{_5wDIq!9dyb zi=MfvK~*Czm~xeIHkxHojn75sM!xl$^uxha$=+=_9-OCmFMSxk_9K4~SAuH3_TN9m ztF$;7EDqwbL-YFHS0JL?@b$I;uUfWFvM>Iux&&3*7k@DTj~uETLHOn`rfzF`?m}Ro{pKuqt?)NIY@IxwQj&0>>gP-FlKrky6-EfU40!&Pgtdz zWIendH#goX*Z>c-Z69$)B3Q zTH1Q{%P@QVsR>!!e9D}87%ACt%WWbohK9O(H*|D%Z|Lpl=?XYw-UIwu z490DbmWAK`xSN}#<+#tm`Eq$nc_jJ4FiujGHWu|>wfj#m+(18+$Wi_pgLQMmU>c|B5;sPvgE{47UysK58)RM@er4T2 z6a8Rrn0IC>6vx5buvMN^;W+Tcdrye~5*q=9=hByB5cG_;3u9Zxa~}Q6E9SwTbB$+8 z>|rN|Z9jYJQ_AKAgqj3Vdw9aij>9YS$vQ!IR05Ht>|ycj6dgTf50}OfL@6VCOMBSo zPqo#w6;aw{=GnvcII~x`23{Js-GGyNqa?RHL4Equ4@*2JN$6y8DVyZv1c2sOR<6u}(qOA*GY2xH;)-ECt(A=fcC)HF(=)sJ>)*qfp$^?x zd|rfae-9H~e*{882OS72FiwectvW5$jAE}mQaRffM5{YN;rJa66T6+SF|kY5W6DV6&(KR_@QwotV|Z@$>m4;P<`x9w z7lN&l)2S-P+!owz7X_HN_s0QPk%bSA!V!R6?_z)R^E3Opp?30P^h2!9$aNUwEUuD> z(nWb8vy)nRjp5Zs`J;DJn_R+#S3KWQG&FJ?DsZ@GM0;+TQ%`9`W|vaIa$I?G>f8Ug zl3GSyC1Nis0Urv9&`7vC)G~8LJ+p39!uGtPCx&}!+qIHf=3bcu!bM=7v3*~a-1Z(c z_nBnL(PG)n`GV2T_X3!D1S@K9qL?ceY~BIi_D)SbHg{RP1u;k6nf(uVgcL?=pN26s3ARal?eG1n>N{CTQ?6vQswLOf@C6@I&?5q z8Wxbm`$Y+{!Eqp{>DcQV=WR(KoprPk>IwT6<81TiGLX0}sFjm%&Ov*uuAH2~dJTub z>Az2^f+2L(&%b_ty+*3`K_mK^)C800n)lSGY4DFIZMc$Yd+XSGOdtJ6tm)qqkP+`x zDcPEyd8gu=%~oLPH5Q=|8Zg|H8n8;##6OMUssbtZkB!t?b=vTV^AmrWk4RevB$HRT z;J5w}%1Tv0!WfV8#CV0U)7o=cVA9>)E2(An)6!#==!-B_Qgr5@8mVRWMZ(Hwa;M1@PUf)mb+#bDRA1*Sds7nH#qJ@`Dz%-H zVVD})^h7mi6=j#dF@alHVrYL1UZys@sPx`9VmKfvwM)vTVzEHKdt)QD%q^4QJhLKu zX`0TKJZQD&z6n#{pi&#@tcv1aej~#COu1njZgHSknj%V5QTMw_cH^6pxb1MU@p$8# zfSlsB7;=)oG(A%dJ276x8j|waigs}CqN|hs8x75TRC*d~NEKL`?ti-EE<^`a;pg}e>uE8^x9}{2|O~E{oo(m*5YHFD11J@|pv#}%IJG9x`P3x~oP~R#zdAGM45hbdU zU+2H(8qhzSssKqqw!avmbvyYg|<5VQ`dqv-1tR!pTD?#8Ma9J>xpOG|XdBSJo~F7NrtWY>-y?d_Ti{iR@MD=9-WuT=mZUEq(@Ykog|##3*^CD5 zIR|mQo*4I(KW=$;j+#F3mMSpA`fJ}}!XDt0+@^F!!-N_^bTdGx$PW7wC`y%sZ;26w z6Sousde(KI%Ra$S1{{3|^V`!SzGO0GHrtn#ZA7X$bRB5I$8i~MF;(*HgVe^q)nLW| z{V3KC4JVVHK1+c|Pxe|)fmn3%!$&?f{KIu|;^>OcyN-20p0DaaeR?fJ$O&icatiDu(K6R64avMVa@V{q#)*1B!B8!8iV>Aa3j0Tx zBQ0}kC6L@CwL*(&C}J5ez))?RFDYPJ{*{Cfme<_BU)2C>FR}(MG(PZlET-y@nJn4T z;|Evc4&N}*b??ARI!udV&&N+EI^V8l#p4AfdhRqwMBwFN&`z-&Q@>XHDTwZlP*Qz*EO7?q^`!{Z{7v8hB~?>f+vpXzX!A!CtfAY zEEr^`Pl+?{QJfRSHx4-T-|IQJbrFdIE`sGabH(BF!eKE}_tOLKHhGWp!Y#uI12s4Y z&kEZ);?16%KI|;hQtWUj<>8W1(=XoxF?Yb8LUYvm+%g6(kEy zloPd>ual)p7A{QjS%6qcnNW_Kb38j6oD`P&>P}{;qnEXng;!IiMaWc+&p{m3;Rr9$ z@n!GO`!L`qyzIqWdt#{U$8@L${`b6#`xAt>3Nq0i`#C~%{UTMECr05H)$zM>IAc6gXk8r1X9zkk6<;?=uqnwA7vB9 z6Jz&h9lMu*z&zn(Z3IJjT$%{grAPi<%or)9M5s#{NsaLML4Wka(8=Sn^MuqT>ij57 zc=tk)r=;!v#2_B4OJ^QbI}`Nmr1<`^=;FIR0v+J7QU7Sm#~Nw6ZgqdRj4WHqnq+Hs zlA0wBNj|9PHca&Tk3kSTMrx(vKdr>lT^|KW+V@wnDI_Q!(|+mSfYj=_E~E3+EfY1N z4BvpmS*YQCY7PLCrB=NXQh-f&ufAf4nOf2U$w+f;{tlan{B z^2SPVHnxNc-b@T047WOhVH}01&VK+PyIzDH)ItmXp{NzSVY+P7v!pQJhMcJkde@QOT^61x16Oz~*E+DaF7*Co99TJhV(J z(YDy5hIog-HIKcuM)P0HVxv!<;s~4oXCw_e2kfcp(kWSxFG*G}io=liea76toX7w@ zK}{cuFQ zPt0yTyXlV4nWFLu)>}O5Mc2>4PRFgVJwfV4llrBf#RlN6z;VA~ss@{lammY$wp#eX~k)IqtgjE1q;I**<6I3YKr=iaZzXP7AX z*Ar&x1^aNz7eSA9BSaULo`ves=YY~`GJ9Uh$_q5kOxH4Zjj(ZbD;3kND*5SsUuvY5 z%nyZ3iAf;a^BR@g({taJnz0F>H&fKG<;$QsTcE_5n00f?@JDqERE_4=f9W{vP4mNn zbtz*o#_Ji$ldvw;YU-{pRppEYN&5$8jTzGo7OVlbs=b0N1bIJUP+BspW#I5^T6K37 z?$zR_G31!B&M%DU0(>okp=CD2b76?m^{VUkJWgKw2{zJ}S!I)*pBN#~d8`ugql5i~ z!&HMBAuUH8-_8c>c3MGp-1g{96z9j4PU_o%-Okei88%kjW0EcWH2#%@*ApwVpoxN6~t| z`jyCQ-T4}zSHHek(Hnu2o_m+-%7o<~Ah|x28g&9+g-}8yn{pu_b@e-17!|e*=E|=u zBneb$?l~s>%zIU{!$f1C1AZ*VyFEz`1@XsUNzQAtMY+^nEVrEn$GZDp40>#$qXQ|l57IyvtI?)2>Xs`4stW~ zyd5iPIvWxH#!_VeDDK>xw(d#PJn}Xvg4zbjalfN08iFF4_Bl1CmUSq{?_r@K>y?@9k|V8x4+;JLDGucf*j?xjavvYN3yCHNsajA+IH!T^XD^*a>^_8k;{1v8F^)+7N3_v+h zu?=vaUssgiDDzf?s6>DQRdY-4%CP3Y*0>C}_T2c&6)IV0&VO-rkKyl~FXrsga(>;Q z9Rv;sO>0WeJt}mGLci>xh8?#Ke#;}Qz8lLvfDA-JZMnNb+)eWdt6rA12g3W_L@SARzd+v)}A0yMIEc3v$lh9SN4yKp9&m%Q92!iPLx^}GijQt177`l}EqZxIn1H*e*!!*=G(@_Z`NxSK+$miIi9!z-PZ(GoIC+d8##~N2*Po zW;U%>nK~*Y&tQWQnCv5;zd7kN6pUcYhOSd$owHg93V`; zmIu|gp*5BO%|c)X6{yirz;v##hk=(Q=zSveu~+6W^k5`F$j7EWi@0+afXXvUCR}>ti_FhS$_GdukzB{o1VhXOqvt3WQ z%OpgY+#XHgVNwAgCWvmni)C+E?6=>qFrb?^=6KCex>5WD26oSt5+`U8xA<^c!w(Pu z_(|U4tAW!wcP%9Ku*viJg&f|{*Ek#d@^(;4JVIkliUXMhrbJT5lXkd~7bw?%giw5kxtP)DGE@uwY_z$6E{Ztl-C_eOK*g{)+ z=0i$_7$bV?HiQTRvRWf!9BB>AFO(`#E2zG3xD|d}B6G!Kh$u7A+;3zYBHbB_<+2}w zfoiDaScI8m>h3SY5}GC#-lx9{u$qTDv0LFCM#6kkk9~+dvt#UG@J5c_ifl|{ovOYS z!Ktk9)^4wu-53NOUHhZBSV?3Xu_8A+o)(5%+=JBgyLV%-wmJpdr?yR3<705jr~VKB z2z@w9b8*Oj;P6^23}Rb5J&K6Ox>%E1D&4s!L}kl@uBn=NrRf6H5(vHr@wt ztO7NS&Y|nOIhZlE3eODMf$!uf9e$PaPL9@wpV=UoqNm8`t|EV(AzuT?$zYd9sjWrN z&U*+JNo|t58(`WccX!UVf^px;Q{T^i02BraMb}28L!bI#1f$f&E{B$pwCyU*$?dfG zjYFSy|C({%W+aVQByC}%_n;jBm6A`>b%M*riBZRPg8{4L(~&wEii>@FfQxP2Of#xn zm~efaLfpx1-Ap&s@%A+uGL!P(ijA5J9b)=B+s=(^idV2{)4y8A`r6RUgLQKyb?lvcVjy7 z6OauT;dcas%YQxrLB&=zH23h82VuXGlcS|!kh-vCRgdn*P<4jfm9nUADu_7lxa~OspJFv|Qmkv-?Bv}heIQdd zdU>DrMeT?@;S&l%-?oPD6!Kliy*t8}3gspw67*9jlTM)Yhzw3RIEGyIfPM?b53K9~ zX6|;$4GKQ>$xq*AK>g+y7u_x?Sr$CBo4<^1g+2Ju-R4pdrO*7>Sd5~@O0mla{{y*d znLut7>rlJgSE}U$Wsd_T_jaG3*=bFx-BIK`ocd#hI(gW9JkSi58z%bIJ>c6# zT6B)5nJxE#L#vw9=j$o;{^ue$Z}UR9`9DokEgoMpUiUmA;W&Vm{u8RRnzV?lf{@E) zpH?hgIXx$W=Zp{>2b48bBuHpTHfxG%T5BVO1j4GHG}4+7YC=^HB_J>v4(MoIIy0`+ zl+E@*Ju!EEOHEM1vdAqsv{nb*Xqv7q*ai-v%!wYJ{$Q(0S+br`=yHyTWBM?f1~jSgw9 zUJIxTD*nd2`2}Y6+^=N-Ay0)?d&<6*w`uskMr!F-(l%stm3g!-Jv*To{bD>7K=i)* zz+i*?(Ig)`tx3=KDZ{Lg+QA=f>LZ67#lAayd?@DK>9}KsKr`=7>!tYGF12>~hpZCq zmX96oDEOTA$>&97`5ckYoqpbTb2J`)dD(+hlCNDp@1K2|RNn`){vn#KQ(q2$9+A(8 zgH_jaKTFI61SD)q&sCWS7tc2lP{qFwYhdL>xba>?)<&bEW&oy1cnlQfUL5%R9MrL& z8lk6o}W-=SuBw;( z&BY1JaT&swBq<`CZa)2U%>3RS>}~rvO83V2gx_fNNXeaxL5*q6h4UYK?Q4haqQ=e| z@}HxO3X}Uz9#3=K@|g}q8Wn*+l!8K3)M0doY3U8W0C9$C)r0(Fx054zpNr-78WGY! zwd_-?$mn4@BmbV52sPR|?-yVmZJuBQ5Ag2lJU=sla8eFpFJ}&$+5{KUD4~$nUz>;6 z+oP+KgDx+PlM=DPwA2y^xBURlkE@ci9X+-Rgnetv-0MaBt-&N-x3lO5PYgX zwtXOHO;u)WE_;>=9lU(*QK=r8F~s{*yAr{AY!$swyy(5t3B8IY_Z z2x3c3|NToy&9kCjTCxV-4v)bzps z!bk^`)Yfx9e%X_O?dGWeet!HQYh}mr!h;uR>BA{o+?*Ca{QV+;8uei$PAA!)69=S;&b!Z&V`ineu+?+j04LFtuPJWQ1 zQ+R)$a{O|TrIq|)ASlqL?hi+ou?Ce|=tf~iym)Brh_}X>e{018&Sa0T-a4tPQvl7g zVBM;@grfJ z#GCa6P~`pkCA~nhB|C1pQj?KszUWExdx>~j$t<`5uLXV##nx4FeIeVe59Aj!}N;_!NsRYHlBMvGh1|V zIJeH8Cb{7T0c9C!PI3vfZvuY$Fw9aVwUYqKW>ybDu=bb8nFm#+czhe)C+F zJGbmQ*<#LKx5skx_FlFRe)3tUG!s>N-~sSpm6FzjU@*18J+n%IzVyhO6$|a@=p~wZ z5R~2nimd(veqLw=j;o$Bm*WjOs|uX-gRIWPa%4D_1^(d&BcVw+Ih*9A>I7;Xz4ZAic%gHr_ba^K^oIzq(M99c)k&+;GuIk;fo&Ks zWzSW3X;W^jS6!WS$sc0$8nAqu2iRc5Xa6z6to%oeMRi6DDHZ`So)!enlDKWQ3xP!q zV*nbFEUJG09~!AyW1Qpd#HzSpSQ1ss(bhkj+!ujC2g1GS8c!auT4#+qgMnSr`v1tI zGCRV2&REf~f}St@9cB!STQ1HVmo?PSs8uq|gWVe^RR5fV{t7rll z`oKe&C!dl6XC`yo({m)Nm0JF<1?9AMt)2q(oy+a;vH#!zUhG#dXgHpoS4u!?48P^Y zJUT1c&c=s8NHf*Gj5a-tHQ;-Kd<-@FGTNS=y+?9Veqfh;qDvkIr?5-iV1WHeYyR6v zVf+22slfKBU5*=pmQQ_H(giP{`uQV{n0*=j@F8Ya6S2T9QS0gbYKH*wrPMP7XFr7I zs3Zhp8iMybuVpT&{! z+}Uar;Z8wJSxR|!K-)oNkkHB=7_bTj9IHSpqoWdx426^oJf>3ol2a(qjQ&E+-GS%R z^>wrV4FWjs9y`w|H`JZdj%B1+4s_BdBq>H{MsoRon;bCe1ee&^py<(>M_{PjFEb)! zf+#wZx~QI&s>H6_o09Y8bvZxJem%}8E*dgLS0ekve(8V+wG zuu^3EBL>|su@G;oHJ$m6fWw;|^S>x}-yd1U(t|0LU;c17Xk)b`m&uz?G4kRsCFugsps;APTt z|E$^>bBV9GC`O_N;RMUeUue5pGoE%qmKYB)%?6K5twXrqo7DjHCA0EkKJQ^*GkrPIm(MSR}D5)VEv4NVG9DAV7A180Fz%JKZnhJEH8#Y(yaE+Y$lMzkdVC3_ndpH zZdLb;BqQGA%^yT^p0a|^{RLELjL)bT zP$mW_1Af@Ct7V!jj4fBPw9~5D8s5m^%7_(CYLl0hL-A-whA6wos!;E%`KKDbD*R#_ z`yjT8YTW30?(v$}2xv^LWVINY*gr=Z%Ige9!q4vw92An`rf}YYjto6XmliM}CYPU4 zuYb+5z>7FpwT^p@5KsK)3Nw0aPlR~)<~Cl=vCMY<=xK>=i)($l!{DMMGhz326pDIa zg!+NU3E!&O{D@TN*KddRvc}=rybGEvZkPdO;XH`N0SQvT(XN-ygWP>v)c6u319MIH zr2|h9LE$4`3k->JTy^Cv6ZhW?Mg1+;>`Rt0W`k{s%Ji}o3(W~3S?xZiSc7yucXO>C z9*-c{~K73&leGovstIHmhBq&l60ibiLTdWbxgm?zA^ z-MIkjw7pRmALwX>_LK`ViPd%s;;8lU0W9$0tngO6o?z0d+p;rnCmIyNJ$YemN2$21&H0M6W)(WWYv$hs(iI2ddzQ|*+l>JOpnAX@ zx_I`1ns+>XYMV`$rtdpuS0R-)DPlLc1*W=<-Dw>S`*d@bZ@Id|~QoN(y%q-MA2Z z*hx9wb7IPq(0<5B#AVpe9`df4Z%V%)$kEIgOZqC?~vFg(zu@X3D(cR1IRyf&HwQe~+ z-k31Yj_B8#vq;YY93H^Zj*CRCRT*?wB56Eh7*m%!-Zc|J4+6tE!0Dp-3yXu&Q|VnV zDVelXqO>#YdPN&^XAkro-PL&^WytY2yP=CcJ(JeD&z3^Cb3Rbz=gA`Bn?JzCNGH+nMvlY^=%*(Te4CSM; zp&f)(uYy;k<*f?o22HtPjkK2hdJ=7Gf&VgbBAUjXJqDC1lG8xN!O61YcZhXz1K=r{@i4GCK7WIVj6>jZQsp#C&>jhL$8^SkDt^ zDqfnI^NGjvg{OI`(S>dA?*CmxBrV~QQFFe?pSmO~ZAL^=z@j-IiPS zYQt5FJ?wg*87rAYg;A&CxD(#sq*E=^^2-dq#M)=}3RA{wK8Qq$0-XYfqn0Gz>GhXo zsN?ZQVYP2(g6vaI$jnBqNry3rn7DR9S+k%s!3R2Am z!%4BTKfI@^`Zn&DNgMDDGcfG?p!Fb}dxnST zS6%Q%d{EpL@zB-T{e_tx$;(cZ@vQ&oQh*#i9!!*V9L(tP0CouF-?0?qwO*#;Tkbm!gGK3ajDL9@6{@<2XN0kn> z0?rJU;U63xNr5g&M zt9eoyB5ZZsa8*$)Tvrt3vxTpV;UQa$)u%Yi5*(fb!t^rj^jjf7sq?b2g@Qf-LuX&~ zL|p++q96zeXGZBrT}PUYRXfaup(K+Tt`w&gbJ zl>h6m@zzwb)p0G_bVZ9YiE|aqe4%+t;qxcT#PNreJvvd=ahJTwEsal0d<(F}$s6>KJJ_+1Ze@o09NYT9=NzcyGwm!w#_$Hj$kjhtFFDljB zGbp`KJV75=ZqTwkT02CR%K5@$#K^{c6Jlo*jo%+JS1i}#`Aj(ci85G_=I7D&$q+Xb zFP<>f|Kd_HqxJsp5#N<<-So-+d%Vpt9h7G=(tcm9q;Fq|$?^9F9vv0M8ZC>^s0%c3 zBq7R;+o*C^JUK&4qbjrP+MJ)>Xd_(zZy|pElhFamW+Y9m2lLpMRaVL6UeM#)R=Mo> z?A%?@De9Vtv+BNAvV#CFFFBZt4E&*fOlApdb3?!6R)C}I^}v}OR0NBQJil@ zz0f_6tE;)N6;IHMo(lc?Jv0jE$_j61uv z_T~Qr6Q5XfXW2Q_dD(PM?5SJ_*Kb*a&qXr1Ps_~WUQ3IC_{_%C%K*k;o)i8*KkbZ0 z-2b0Cm<`OdM}Q_&mnRI#nWv!hO^<*lTQ>Bfr)Q|E_*OCSm+REd!t{Iv2i|+4S3f<2 zEh?S={HH^WctH>6KItl~V{ee22MkW#U!W%l*lZof9b69T{93Zmj{Bc z6jkuN$o1#gr|XohJ{P~mCPs2y9Y*4|YZ%|SigylW4=LKSiZ>9CUJ`p0uA0N6fLm~R z-wT=?Ofz8I-yOracn%n9Uv1c_+6;j=r)Sg_q25;;*0~?)hGfAtdFJamyr3s_{kIqN zj5j8VdgFHk62LD^-25@#nBZ&Auru@h6;SQ!Z|hT0WvdjX?T&j`l0L&|Zi&&vSp$Wl zR#Wk2_O5DK2kP#$k5W1prR|s$gfO1QSGr9A( z0G|z<%8mwQPU8YUO-1(ut1zC`TAg~8hr|ma!26z|I1EgDAK#OEOd(c9Img(p$N3hu zTi<#WUtbT9npg3eQ2y~5JP|;Cpki^Kc~dmr=BLN%yUsA$$Nw!`8C6D=XaThh$!LdK z0NC^h+A^@Jg`Zd+;MjlDRZPXLTn1Ac0d?YX63Y4wzKbL`{D|(t1cLYX=w*M(Yunam zJO0q3v^OwbzO#3c9dRq@zk4#2#{lDNLS%kw-Y(K7qeL?HUXx)lae2FfW0|NhW)?JZ zUaShk8rkQBlYBhHl3JaGnRg18vPKO$bqySB+)d2t4o2P%z+DQs>v0s;9uId&ztx~P z&gkqFq75**PG@22&WH@1NKfuP0~NaDnqDQ$zIAlab6xsEFLaVIY;^`6D-+_BH3>ly z*6Jef@6AwNZ(r1p%oKuLOis$yz{c@Zbd81{)9(8U3Pn)5(0!13^~5-hV+|0Y&Y+b!492f!_*XcF+hD-qXzBJF?8!1tYwsz0pcjf<27Y>lty60|k1jGGRqh-(Ze8ypX)A9vFT5fRw#HJXQ}LK0s^Tb;Cb%fci- z=cspb%^6p#O4HjxFo$sd(KE1+N4OJP2z-SDU+499T(&dzM(OG^i~-&nlLaSh%?-S% zG46R)+0$@zuorfYWcSVR7)L`6gXJr-fw7u$Y6GK>^1Ok;n;N|3K~GA;!)aT$Lb?2y zy0L4P<28{6VSU8vV@z#J#p;9eu2_daSP-ooO*`%IsOKN<=74SqHs_`Y>J7yauUZ`* z>R!P+IYvHjG%}{*5#glTs5l>RpR*35tJR_$agf4ApScnWjr`(Iqv3ac#!tL4TpOc z%iOSRmS0g9m1p@}wmNB=ov4L0 za6cFEZO<>;zFnq!)ZNS#&ns{AE4a(!BPywGxlV}#Wj?A>SkprBeM}`B^{x75-w){H zMnawA2?DyegU>tCm5N;d+6-NR-{Xym3EPM1pO-$k>8bI9L~|MqM(t-jDtdLmqX?$~Tp*`*w-c<=T!L!h_X4y#ezQ;{ePTJ`0j# zU<7x&NVy@o4`IX@^Oppdvu}vMvc96k$iBKy`*nN0>Keo|Msj5E^qEvW*YcBbm`1fh3kAc za!ART>PgS1ORj^}d{oMCGvmBsfi6>gt_2lswAj8Mt>J+_F8`eknuk$ZKy@H!wnY%& zLjLv`0?NJox~PK;aDRMV25v!?O?U%;Cd)}I@3kQ+^ZIPdNsx>VzaL|awn#sw%?}hx z9u!b1kN22BDp&*1>UB0~3@ZRG^*$u5!L59=88FYk7Q-F}3_nkRsEi_C21t2;9rpa1 z72?$OmFpJLUmWxNVA7cg z&9hs}R;pJqqRhKY@_3ifaVtU3riN23+dlO_8&08&5*M+tWX_^s(P!oC)xQ*#~oS8Ze^3hqePhc(<MKU(h+P`Cl@mmaXJ`=+sd=q<0Kpf_#l)Kq70hFtb9^v)8i+MLn&- zOPx+}!tvvwWm4}XSf#LGRjGK-0N6AEk*!jlIxW~6TqKwjel8#h8)?-o|X&Be_R zA5%ST9u1aus|6$<^Q7WU8$sWYJt5z6l!amv>0bvh2CG&@&WEZ28#z*poRN(Ybs|Rs z@(vK$e2)ykCvkZ*JC~pStu$bk11Be8vI2%H_5n>T^mMuWhQ*k)zZGtNy| zsVJ#%nI+~8o^dg)&&=b@K2HqhN|(D9BQbe&KC!U<_#irJe_~0i1AqMHhWS z`e@04HF9oR7L4+WZ|V}h3np)kC^@k3b6`CQhIb427t7)N3|&qCKhm0{B^*lqeYU3q(gt|26%<+FtrEA3q-2 z5}>lHP769N7`sq7vTUW~Y!b`&*3GcyZx#)?JdxF1D85>06U-HSvXZZU(w1x03c}sC zRi@&i&1?=Ost;`D(*)Oq-eKGA8Sw(>?E#uju?N|lwM39DkFrL*z~QTGy9+b_ zB$@02X4S2{RO)gQwdcFtacxcApjU0wTxD5f5XY1V)X#6mNNUCQ#9_>)%5uP&XH^mI zQu+omrw%B7MU^>kf1&xGicFKlaRitv0@#hqJbmywwK2uOEf`s1nzinD4nV%Vt)-_?|P zHk^*2Ub7{^=_nn9c1``c4E7YKF|A*{6+N-29kY?$TNwLFKThAeTZjaw6~bKxt^Y{SasZlNyb zGw1aenmK6_3=dwNG2Cp`o(QQ^e)~>kGNhb*U`0>)QHVqKuzj40BWOc*+^Sl5PqvrM zu(W$DGKKzt zDK?&=!f@2K33SQtHu3-A%h}gUzr40M5#|IUkffxGTAJ9ceo~ zEf^L*j3jOG&t=V-%hXnQ9~#N1P59OUCCmVmHk>UljWw?0hAj)+@sSKIhAXW70yi4U z=Lz$b&w~&~jg}?F2eGngj*2C6IbS%2f9#f5W@XLHQ7_yUEEaKOdXLx_auRRZ)!3a* zI;>V1<=5{q6%KEq6re;lrhv4FqYhY>ON6NvBq&V*!FOR`mFDO~A zYx_MMo_tZ~MNPFDg=wtw*x5(@g{hkKSr%(XUX2mnFrsdD)Wa3a>|rt)lGA z#_9r79fj$=k}YPwShtA(*4ilWOO(e+P=d>mdOvwR$mfuZ{sE5Evv$~iMcoC}d6BaCqs(37 zH|Y~W1KSOuVwhg7hNa@u_GPH6`8vskK$)5O!q~Hf*6e823MPr9*Y@xOLdXsx2xhkuQv?>@2g3ruXT!bqllu``B**Ep6msp8IFv!&mplBlNB# z5bO3Ml)DNb_=F|x-;b5{>yuPU)bz+`P_WOj_^BKCw^gCu zFY!;!?S8Hj@l3#W>`%008y;PT_eEU+`=R}DJKk_M?GON+H$YRoKB8RR8<^Mi1{AzsW9z^m<^MnMiU?%Sf>mJZdDHUL3DX&a%@CEe{2%Mz0Y#~ z*PvwVQ$o6?B+l+GOut5vva4>p*t$~v#kD)XdLzV5-}6vpq9O*wU>Y|jQXWxm-Mw+=Y^D+KElfICXvvzauQVO2_k!_8^ffeg;^YsrE#<#lqO<6dI)IwxH&S!q{sSG26#|gl#C+itz0` z2oCI)oRsXvKz{jrmc5FMS4Nv(I-n%)g9l^D`_yd!*IrZS&FW$dE2^WmGUPWNG*~|9 z)#~v3+vwb(7oe%B&P|jUC^WT>XPyzuj&6BQq<3=_Tt4^$kg8hVD>>WTl2@x&?a-!v zHtr+J5?KD}pvev%Mfs(q*a3`sftGtEaI|MfG;xhszU?v)It1bUY_cok>|&w#I^C6Z zRMK6!UyYIMZb{B_Ya-fX2%mX@!P-%N5ybNubq%PSDb$G)`9f0X)AkZ4GT@>DH_pNwSX1FhQR&>BNBA7+`@Q zc_6l#A~sc~w=n&8Ej=kRs>UKJXp)umraBTO477(WgLQbKgo)WV4$l3rB-X*9HCMEx~LYNkkva`T0$KT;$iEj^MW zxj`nk@U`PcyRUaG|2QZ2l+f_MO*TBvE*6?vW$daOHqfp*b&AEapK_l{Sc!4vUzjL2 zIT6mgfwP&yY2^17#{RczTO_A~U3L1dI^_lX4a(Y%+G~KZOGb|9|+Hy0kOl83>qx_Mg-H+nf?6ntC}(>1RBWfSLiYuv8dWyX3Nur^az%>u>3 z*qaoaIhlBkueFO>R5GX>Oyjt%Tv}lnoHUz!tnPD#A29AOq*|UL73tN8k5Qq| znt(@bR~mJr16F=92{_8_E)?IaS_JXa6Qszk(%Ef=HG+_LjOJ`}OG9>v8}tD1HdAW0F-KFy9`7(_Dus8CcUVmpQCp4rCr!K?13X{Pc(1<+?fp`+y+-~(p{a-J_Q`-q z76S^in9um4qD)h}Cj;u{G7%95u+E!|#v=;37SdmVfM$vSm6t1wJzKGRi>DD*tK|{*XOki?BT9FxvR#WETUTW)ER({oj{?<>jn8Tt9b^q;5(s*Y2GA0nfy z8y<4$C5i##OD67Z6O8v1@HSI;Ro*~h`lkx#wh4`In+rw5V?8_Qxn(uAi(jFe{R-L5 z)xf4+E)$86f;m(*+COLo_F&a&1U5afhW6i|Y`>8|P?-LEMGI0jHCSXQZYzUFmi3Ap zUhqdGprS(eC6kQNqfV&0;oTsknIgl;?=6gdL6IS;nh=vMaHfjEqsU;cL}W-s=Kg5S z;07jLBX6w>jy#a$NUBV4q4>o!k|Tqc^4uS7DM~^8CzC3;gB8<03yPX4ij4gJLQ_)% zR%_Ov1Vs{qc}wXWc10CaedN_Ny1HvHM^@U*v}-&t=Ko4E#>meV1~zJ@@Ty-E!uV3I zFDb!r|J}ql?1_r_B#<>z$aLmFVd`fJ)36um98(m`5i;T-1kdP&{-j)JsAbP+H$M-{ zV-j$JzS}V^^v5vO&u%79g|+rX5**;){Bf^2d9_YVnudPXn@+V9t#s$>owv z+0RUZx7F&NACA`T68#q_Zl)+U^1BOTKUeHa?NLxC`&qL5)I=`1FOlbciR@;#j26gn zkH(e(eY$S2ktcK}>Q8P48^4xhW1Kxw7Os0xMD!PtnXRUu~D^^NsNf%LX3Rf z%?3?8>cFS+=}&-rTU8IjnVBoQE(mitT!H(6yi zS?>UWV_#45OlRf_O+DPsXoxd3$2XX;#dbMyZGdk1MiPb294Is|YGr|%2bB$qc~I?Z zC|`$aJ(?9zaccnYWP9g^#`7iLbakR4_8in6-Ft)B^ZUJ516X@kXXN=s*RtogsW=x2 z1ZTZEFxUXsIrHJ_5VDZsLzLTHDE^{VI(OTpBihT(J5}PPlzz_}ZvSF(1V>=Mo*>1k z+O)I*GFo;Pt2Rw{6lh~>XN*{-!&b%Cy`#fmDLY#7 z>NX8HTv$ePKwJNlKd*OvJMgMU>@tnX7A9s3+YJLcHpII?TfDutA2^;%Cp(hcT0lbw zLbHEC7v+}@sQ$&$PP?){@EXwCzJDWEwvhTsaB56H?NgDJmt^G%Q=3$8?P}oQA4#)h zS1_Q?FQHknRB+Q@(MX+*QXr)gy`qToQE!uRf+k|u6UT*AF<}`CSbpiuKN0`kT8~Bd zi*p>zGvFxBs=e-|QwkEahGtUFC+1>OL{J$T5$ZgO6_8*8Y-1|`oe02=2^>6;%mZvp#RNpG)VU8GiPz;j5t}Z>PYL^?;+$1Ds)R!Yxp5G+9KI=T zcFWzk>{3Nyk9YxYeh6C9R43TS>ONq0ufS^z(V?rWkHy_^c#dvp|CG${LIXFOMFD?t zwA}e>;}_2#?{Ec48{Sop$Gltg`{rGOhTjA467VlNe%|CR2y0;*-o59Rn0I&m=j?;_ zyvSXGhTjM8%r*|*a^84XwoBDEy!+=D#=Lv(@0)iC8h#JFOTfSNg@*m1!>fBbh2}S<7%z=^+7jhEYn2zj zNDwkB+JB^c#5XhKs#YTE=|vRD`!QkH~nLiPsA&CwQJb7od5cF9)Ti(d>rDh9PB zLKQ3)X!E(zpek;D@obD3J?@6qF^ML8!mSzVDyrznwse@K^Mz?mj0);hC%AB@qy&Yv z?-~=xmtQRB!dm(d^Y@752eywmI`tPnj_K%w4I$jMFv2M71n~NF^Bz;S?giA#A)<2V zv7djpC&<9{%v)RIJyZ8n@VWarF7?`ow?AeXxCW;8fZ3{DEq83BP|8y!tNDT}x!$Yd zwXzIDL$3T{66F~ask*K>YYo1QT+@+F94r3C0}Ju8$!f}}UwxGCdDchOe_pG3aP8Mx@#m*R36){D`piDzFD1$$p|#*UJvub#c>!b&N&X3k=3 z;}hrWxEIcfYs?MYL6TP-T0=#ZwwAhCPO{({=PGW*=KyfAN9Se2DM}mzU{Su3kJ=}T z|M5%Z%rjpo5l6ch|68CGYF0fyEy>3e4)SS(UtWO~%^kvcIH53x(gFG@nXGskjbM`l z>qy3`0&6{CZ*(j|CFxgok_TcEa#wvB%h+nl{nyL+SD!w83Jx;gM8*WOB7h!#In>vT zER3PPlG)99g|S;CGZE^}gC(F&1Y1*9#aB}iq4OkR?$aHwcq!-zeT1`}?f`diN}88d z_eghSOCCo^ZtQS`gbYRsc5%4Wgk3H5QP9*5M zsd?xhKnm%$c^D&RnEa`EQZhL1mf)J3HogblkWSBI*~vl=ZMTomJ?h(WcTWa%?>yBq z_8$f`Gfx)%t{sFZ{h*X)C7R^z>t2TW1%0hMp9bJX5xFC?H^wce>NP^j7X~g@a~X8C z+DgG)O2*uwu;@C=UJ;)nir0aBoPL!$eU-Rz!U*u^(Gtm`KH4AGvR`pVeUg@Vo&&~y zETg841dEJMJ1|aRViF!K-kz zL7lyST-;apr+mk*K{j4MaIbAU7-m zxl5GB5n*Y$Dka^|XEmibE@oS!XJ?r! zWEREsQw@GYHSV>#7vL-O)J-6KFkVSc)d`j6NQ#f4ld9NlWlbB8X!h>G9o;qXW$CP? z20qxWC;{&--ymYl*nm+D$UG z#?4^=E4;2=08x;tHR8O>*cf-?2~s@LHTU*(tNJ zF;zze#tPF#$<w{@_33uXC=fARlxPG`IKHHr5bwjT%-+B3N#Qy4{_^ZoyJ)Bg_ zfov6VI8s6RyF<&b*x_hsl@8O^pT8D*1M5r0-iW?uzLr(Mfz;^DFP%}xaDYs!fVHoK z^)RanNWnnOc;Xb*9GzI5b;M}Or0d&GN=vvk>`_q7(evugS7fMb=0hULxQ@8>^>ubr zx>og?aVM}#VNcmEH|hsz{TCMD5lWfJ&rq}CmF@9HrH8NLJV@XA+9K+j%1PC9JH6l< z`#?&EKb;_`B(GSYypSXtDB>yMHEj+TDe^Vb zW`$3@o^NrNBwWTQmwtLaVvRniK-GPF!a1ganYTo0$`Uny{d$ZWoi$i1)00kOTG${% zV!4@f+XaQ0mq>b+_i7cz9ABK1tK#r9LAU%Ia(o(KWtJTc%Z^JUH}X|+qx_-|jmgDv zqhT3D*5zySvCy|*z6Uhb5j|>v`~NqFp--ne?*1n{cZmcX8=mgqd#&|1?*F#wbjNM{ zl0hjvM)!2=IEfJfN5PCd-I^W5RWen2pyTOJMAkmb35V>eb(|jTcV9C95=Pm$!S~;myZF+r@@gK+SpYW;g+M*AQT3 zmuc#P?fe92)YItB$v0#uU-I10J{I;2%Kyr%^*zzBbY(ib=On8f$Lqn-EgLs{4t!6B z>?cpg9@4(KJfv}DcA+(I)yU$EcL^Gv2K2S_`K40|6M9FhwZdD##rA5g>$+!@CM{Rq zaiBF@FQF$ibAk-~)7e^( z^{4Fn#{*~N&2!ow#v2UnsK^(l+rD|mk23IeeBAysHPrEX_$F!PV^Ga5o}f?u$=SDZ zRv_2@$(fosYt>?*Sy383VU&v6+`pRg+)`W@+HgzJaC-U^4YJSB$vld5-$rU|G_=A- z@W1|YHFKTIup6Uzf`0TC1Na$wo-3XU@O5uF6R*x0WWF%amWK!b6xsz&pnt_L>N*2t zdfRiLIn==V#-AFRqm^yIT2MXbH(WU*E3T0V#}7hi`c5b+W4dnx<&A%uQFJl)MbAwu z<%Q~Lvt~H?F12R;V6Ds@$*(pf*C7eH;?cr9;a3?HZVe??kgPh<*K|5!+!No6))@Ll(e*)Wb77;zQ6sMF2I9PrcgsdhUa zBU~-UN@T>u`NaY~M>3PP1Hp9Y&_;>AG*~w~uK$eN&m^5IS27FmfJmfFgi2AH`PhGu zVEiMuYhmOrK=?!qh%n_u7JJ-qG5SUu6BEv{QR|59)Bik$jh+vP?vEJIT5fBBexRgt zr`}bOQmXaYfT2=R3>5j=H8G*rHNjyAb|?+-`zf*QAwW!$dQQo$V&Ytv`7PP)XszaT z!b)B92DIjd(wey0u^2+~x&}Thvk+e!Eh}>k?M!nojHxz!t!VQu(t`;Hsp z4%Yy9gc&5hcwzd%B)z3c%a@p+Y5{KfcMD-KH{N|mhL+D(x>y)^t`Zs?OVDyts#-xn zoy*>V7l5yvt+IUwRvgJ(w4GMH4V^qDfK#}+KzE_}70JahJNn%J#7NoI2x)%*Q?Y%t z(XUXa{M_AeaUoedN*L64+YmA0dlkAHM9gFaO^OIE&|R3mQ*yHmi9Yu>kTD87Twlex zvr!wg>d}R)$+j|-iMO$Zoy=i)`K2?DNzZ{F+5rCS9YE6F0A7}2=5Cfr`uv?>=i7zW zR7+HmdSPb0(t>!s@BPfsVSc?~-mCayv@uSd|9mHqk2c18skrj(_|5F?X7=*$UK+T8 zGj=$xzLEzgbJcA;V1~MeheHL&AYqgi5k*w*oy?l{jmj^jUki6Kcg72mJKh1J+H;2; zn@K(^M1atFX>qd%y>f73`r;ef32Uj&OJ|0R?0IQE;z+&2SN+7=yiPO(kw`Z$Dtqkh ztpgy+eDB*0n<~|76TVd;-+M=fp40{<1Igt{DO}tFMJ0{NNBirKw|>Kx9heQ1~kbNw7xsH?oNYqxbc;ay&J#NoKsDB(>qm! zYO2cwDaH!jyabcSyQJUH3?Swm;92XeUrTpgdI>FQ8nr;*8LU{gec67M`7F6Jm9V3D z@0JZ%Q8sDFNoh!Kg|+0J^?M`9n!e>$aFU?Ve4CQmI?>l&#a@H9C2xOMt67;WI2WPk z=&LlJ4G@(V2d{4LjUNZPYd~;41khZyZj&9|)_LzAv7&|NWzY-CnMA15i6xnD!Ovb=+;nQy$*i zQZF`P|4d)wZ6IyFH=5;o6vbN$#hVo*zQCX8&(H*@eOz6Ye~7<)+rm>b-Ov6rvv~@{ zRqsnd-GtW%uvx9vS^!4!f`HbjQdbI|NY|IAdMH;IQ++1@L}}^vFmhG$(`g8Jn83y! zz*t>1&L;{%eAWs#@7km8LSR10UGYh{s{Vh!FGKL!V)9T)?71DA5}Cpy?Plh_KZ~Va z2n+}k(KU0ukfG&RO%?Re`(fI=N2WvF!7`2DoJsSrc3XPuzYwwXUrdewi=q^lq(kp7!a?5G(@XV{0 z1e7aIncyAzi>cC+q@IAT`& zU#ByaS0kTCiU{t&0%>tnNAfQHKt?aUd#ctg$A_y{1y{*7w~CxcV#~!vE}$m5#`X%l zWC1l)pe(wk_q8jb#x0af7o|&tlRm8M><2T{HIwQi~KB0BTYj>627)$sFeqW7})s8gqmyqkL|ci~;=%bQoz zfc#?lub<*no;&PvB(kCc1xYFe$bRo+YSBWuxQlG^UAwoxmVG;IrhH`)X?Yc2UXhcD&D zyi$XPVUwA)<^ctPzMCRDT5G3$3g7-{JOe-UAJAFths@$miVpQg=+8mI`&nHS)u>sH+cV*~Wvmsy`7w0X zT|(IML{@*HsNbf~fB#mt&Z(D^&#^#20G zs29UX9AC+<#Z0;`%Ir>NE}$g`)*a*?9Kn+R##4*vzK+&1ee2fqU!FrP%ETt}x1y+iv}3DuxBP2#_iQzP`IowLrGz10Vp{jlhD2e4 z&m_@dXN0rsUOWh+A3*c%i7MiJ$5~J|MBm3CN0Hh~nnUCIo%dtZxo#Ea{Urxh_lZfO zdLY$DQys>D)B!40uXH&2;HU03M4!Ih2<+m4D43<{9I>wtY=5I~yVl@j!#y0Aov<3! zaL%&HQ+&Wn^y^W0QyC9+zV!$AU_eyl4_b0y{k7}0<-;+5Q`7TPay304n#)vN>4taW zz{Hw^6IIW`w#&A43+c9$bUwKaYf{{(=51CA$dXFa&O*Y1&8Uej*0sL;}D&k7w3(R>=+E_fq5V2dh7$?RlrgaJ$B}u2FBy1B(+C4gLhjo11-raCrZ1Wlg?o|b% zn3e6eb(m%@cgJuc{2i){)e9fFpa?WhdsY!m+6%9 z^E<8+I#zY7ZPm9sM{Js&FI{E@ffIz!W53bq`QPH^21jkXj>vA?59q%68)m?RAoM-A zf@`bxfi=zf@8aar@lw?e=(YvY*+F;|JsZ&L7Hmg2HT=qwa8f0Nqkz80_G@%%f%JEX z*3h*1#rdao3b=NU`lwrtz}`7Z_p0wn+p71{%z{ytKzyyH`;4zXdO&@Z>J3C91@z#8 zxBlZo>YyuIM%70@nb55&5)TR|(ri3j4dvzAcAN(pKp;SzKi&wAx8^4g)dIdK0Fv$O z&KK=QH=-`(`F9%~gIY0UJQ5sZtvW#%<>6ziZIyReZo@*@Vlh@70HRT&9Ccp#F-!=t z`K6gqx7l`=X$1#NREB;^b(7~|`cW*id4QGmq@+^Io@=L)N_Zp+K$B}dg^lQ;7lIQC z9I<^vS->H62$lhm+QMoj8x4%wkmAzKQAULaK+=dtP0gB{sq?BIx91CrMQ~CGz|knL z0>MbCe$>?{P?kDBUT=?O97R*C<0Q@66y`Qf>yCS!p=l!kV5n23)0-(bTRVfg<8GV? zZGX2_so3RBmhU^ZkDe3zRT0u&9DJKKn_V7i*n7ObXI^{l8g5MS1kH=dYL7z8KpPlJ z9@=z!r8HvuCEE?Rcvf{*BClr~J03PQyXN`Fw>vfG-0F!E-Q(2kSy63+H6LRdw@QaA zzSnTeXRehL%S6kFUbzP2BSkoMN^(pW<&LaH!6aVFb82i}u;wpYp*5S1s8DBc0|3=! z=9in|vsNj@q;mP`uOJV6_pPewG~QK@aSj#lh-p`eG(Xckl>{6TOLvz-Cq3cEF|t)VE8XU&dS1@dDEK;F6IXJU~%8 zyqinKIQX0|sR{ z4_?wq;`h-d*HIJLcDWdB6U99U6=;|=rAezaY4!V-TZZ~K`x?tjmW<*FT;LN4x7jXW zp-$dtg60fu>V9M^x)YV@L9yr0Jc@WLGvy_FoCB&osJDMHb7m@pfX9hfSAOc3&H|G` zJU6r)*Y<0c zEcw#~$}kqJ(5_kay5m+_^PK=*nQ*e+QqyxopuEKnC+(x2UoEFg*b}x}Vo^1zt(3SC z@S&tDR7!QLWcwkmifYXZCVj^}%+tF!G0`SJ^y;&bQYp0s>bOU&s#C6qyk;_~tXbtF zXrYTym||*BvW~O`7nCOLa@oeog4Q~dcDZdOPQ(%bhxmig^IQ5r6v}KpXu$xI2?QSi#nx2=RGSt&AH@{ZE!Qcz4vWOul;;kG{pRzj z-PtC{6c(lpVk9Q{+|`OF=ye_OgrF4*5l>}VL!r=om6TQ_)F~N|EmMI|Mx{rJgK{dR zMPaC^Gb@UM@>0%F5Ojr3iWLJDby`v((9@!HLlIE7PGttsD*22DKJ`k9IpArnq(uXr z`gKAy!09?8NnopY-1!4NfkD9onuerogAEQnkZG%=a(~AIn6^u@IdEx2(pm>B?U5Wt zY7A7`Z=@#%C_UfEX)`csO!AWhlFE|Wb|BKEWXb@fDhzLgNIEj|bjUGA9EDP}1dR}n zG&&~9+>B_1(Tmt(%jywCQyr4PEQ^K+y<8=8ZE#-30Np0(SeHf)it>16uZ8ONe&c*i1I z{Qm8WXfZrtiJMO!7wE^n(av1QQYu<{;UiY^H7ht=Jg|oQz?@=_T5ia8d`pf~aXr6% zmT#Aiv;)QxGplA#ub9d~<63;Xu4havWVCf~=-oNXH&)d=I%h z7tyIyQONvSEXL*JysqMecD$r!lLL|8+d{h*cjuwvfwgjXR)6sXee}UhOZ>z9Hp|*` zhddBZ!l+EN@0;N3A5kp$57&35vQ zg<-^|lp}&Io&#&vMVycJ)ru$R-uZDm07O%QO4RvXvSdfB5#U($X?fK(vbxbs`L zVbWq1NICg{x}$vW_n?9kI*t0p--^ntv}holLG@TA(N;-GC>$DLivs6^+h`h+4Gs=m zfQq3#hZwb1D>Qbi`d0dZW-j;$rzqt>GZ+4Vzh#(01JLxvOTG{K+;sk!hFCo5s5M>CpZ&<#o9reCPcitW;48R2(QYH8|{Jx@W$Xkn$> zE|IRY6XHm(yF?apEN^u364|Fp$r+te>4tpK^d(FoUu&Y&pbYU%4Vf3|{(Wt4=hE{B z8DN zaIs_obTw~z%@Q>RblO2zqn!IgC6;DuaJhL&pfN0aJSm}jUXfuAw zOXwD-03Q`aF9I5{XtyN38M<;zV&Sv?V8eAvUfI5;5l-~?Sf!F(5BarP3LeU&4~XPw z`K-m~#gtY(;&^MyPCC?a6V58qm9tiS)H6LD2L9ty{H_a`MoIIDh7- z_NIq0&UI+Jx-D@krCz6aJ*VjFneeLR5z8^XcCUFj6P+>GF_-+bz%Z7o2%IItZH;(C znC9`Xh%GVNeGjV}gJcnb(MQ)^0KtE|2tJM`AZlef_F~djc_1cO&+aN>*b?gU5Ye^& z2V?UP(aN`AvOhvRiioZ}8&IEr7`*JoF$^~I6b^du2aBl9k&xAE)*O^3FvSm~9wK-} z2NvlGy_b%*C>pC^?qdX=>xxi*0Q4F5F5G`MvX=S#YZE@UCUjuEtVgN}=94|47-T#Ol zc`?f96q3?-tH9dzYt(>&@ z%jwhfh>Wv<+4j&HghWL#*jsMZOZ|eno>Y%+>ZOMW4 za>z-|1h=KSX(%qCHZIcE8cMA0yOw>%5+nAK6pWWZvGuJri~KrOx(4^-b?%C?$-Mwf7>ZYH^L*`$91I5)IW;|rt zL(Ij)W|-)0TR`3JhP%rhww!9ix3zAK2Tpr9Px-l4K_V0h)q@+skk*U%GM*a+GvV`qXXmXR+&0p_AInb)uK*}ZX-yPqcB2x za9zxgiszKEYE_ZhShPZ^k_u|Y@9W*rsp^PqBsgwmryWvW7OHR;*mgNeJ0?B}zv13YQyqN1Agi|Q=~Tzh zehD$Gz@<~V13J22C!ySum1`TCv-QG zltB|~G&K(!hLo+8bWGuG^Tbtv?R%ur>*irGfw(lU&O1;i=gAgSa6G7aav<%LuEa@P zYFd}FCT#XH4!d-E-hY1&xTCavIL&sCMxaaX^g^5NRrRsHb*lE{Ei|LbA>Ploaoq>@ zp6R}M(oG!Y%P9}2lu{!Iz1o&tJ2vhg*}ZFUlvE&{qMRAjoF`mF#Xa8chD#66d*f*k ziB81{1bQqZLD!6c&r*YI&YHSJvV!m^T%U;DLi(0Ly6qBylFHeIxMe!EG|JqA*ko1b z^pjhYrNX^eOAeE;TgEn4SP>!jtrJ3`LwdoWJOn}ytm6X@#ugN!CqmlzXght;2y8#4 zEO5Cz+)&YKuHA_s)YHmAS9p8}gV^sEOd-j-FhNVspWmR3u%RwSB z4Pij=_Ih$z&9>c|z7;SN*7TVc!k(urq{UcaFUF|Ib>Ls6iO&w!Bfm2F?!b12^^V#5 zQ1WvS!SUN2-1bx6P~2(-8#j-tzQM=Pe&b_r@?-DLo!b(*eTlDit6RQ@(**{H(kYwv zrBjBUmrmKcJ)N>;I7Q03)qQ)DE!oRyX_8TH(~e{_R9Xx5o3`!QxP40+_1=+PBZE8l zw4rijaQlwyw?EI!*|cNZ>KMSL9VU{^yLT9zA0FMkBQ80-V`Kc0Z0xSl{i7TAZjQ6t zpcNA1BD;t7j1G>(-=kX%@S~%f*BDvp&&_L%7L1N=UTg5lVENg~T=4|Grz4)d4-v_M zX9(ZsQ57e^Uqkz8Bd-|wYwv#AWPa`4xpNy0nkjuWWPYw&-A9{K3Bxp;N*NrYEvckU z`)F$_Y3O;hEtRx)J3S|rgnpvurV_y-+MZ4X@jKFqn|5rYooy2PXjdv#BvWsJfOR76 z((gmh)7u|Lj+RZ@9l?Td(x~~_M|+}Ah$meieL_BIZ~VDqBkha6xaIq!PbH#sLzEJu zzcEhZaYP5A1d&pDev~k}bt4^&zeYE&p%)mR_&#KOZ(h5a#uDFsWJTZH5##cCh)OJV zW()=#{G%L}J+yD*?qSnT4Z?O8ZO13G#nGIbXc?of*UaCx0@iZ6zW{*aC*opF;@^tWuKYF>6-eoWb51^ z$KTBNVII9CLtQgbu397YZ1axTCEA|HO^}n~q>Tp!JJZ+n(OZ7Kh`Q*04Ox#F&R)Hq z{`0X#)HS2tTgUxc;$s~>j_VOi+lF>nb$ZQr@epGS0#dqp{X*)R`YR2VM}iF>I{oGj zApEG#QDa{AFY(sL;Ef4J=zMG=4B2(sg^MKgUp$6ORoikK^d|g zks>Hf0$34-nVV!}GBeCfAgCa{D2UQQ6fB5^V%c3?U2MB+T@@=}WkuKCUDty8d%d4? z?v!LEg#D~9_xE~z=bz*`=Q&S1&vW`YR}~fNDM>Y-W9xm~kYL)2uGNu>ta ziMmJtM^vPt=%>2sebGu@=Z-pyTdbQWj1D`$R{qe|pNNGZYlCPT4@DAjwD}ko;5@mN zmB3lBk`H&uD>V)NMDeA?{f1?EiyXhk)i%3UaIo5lDfd1Ge$D;Q?Vku*~9WIOf~k~ zdAbs#*S}=UWykeXcIVeo zqAxq*9qB}y#bMS17>vVjwHs#Xp>EuVVm6DztfY4FaE5BGoAxz=ufs1>^y0~Qbsvet zF};)+EyrPtl+N8JdmOe{s9lGh|5lt;91fK2Bk9T7NK7`1Lm_uerXE@1@Uk{^xz_Y) zLU2?jK~#$A^-ss4AU5OtOUGda6;W}RU4W|A$6@2Oq-&3OOP@p!-Z!eRBPac5KQt6CqBw_3EzuMv>_s>E@6@_GGA<)H8NYG__LLB#G193 z4p(`qtavi^-&Z=!o#|g*%sI_#4Z-Pcv&U*{%C_q;#xagWEWbzQ3}a=(vRU_;l`6-S zJ-TO!+ei1Mf3_xWv(nXdc(zoM{^{t=itotrOUH1CYN;4*QI4wCM{?tSwA8N=$t`N| zqiCvs$#`zDNIz=g{5nchw}?Nd9Yaw6S|8gI*~lH)x9v}|&HCJ|qR`Lq8b8UHz2D7R zC>7WI8vOne)l>f)QC&P4=kNa?#k9P^ImR(cvxw$l!o7&-Eb+YP0D9^FDV}k(RE+-Z zDVlr!;<4P5D(xYbd+tpnpLQT^^gk8JJ@K??segNp72Ft zb-DxTFjqx#OY=+j+lNp&q>sIG8m6lCU3ZTTG}*5a@O!f7-J-AlC8K^%r3~uh{5nbp zzNaF;JD4%5f6d}QbAqFuJ>k;T`zo@sjmt0SNP^9RJ{zSq{Ca=(emfIgM?CM{7Ei{a zj?!b}C?!P8v*nfu?cXtbOt(~~U5B0TDZVO@Wp=Cr*}2sq`xL1Sm`rNNP>C$j+w~B- zVr!x|lb))R57H}MhioRE=KD*>={r*U5~o@DSG7JkpZF~;@@oWVR>^Hvkn>AMWLDJc zDY^6OC}Eft@4a-A&0ySfR*VAT- zP&^s!50mw(hg%haink8oW~3G!YB{Rs-urA;>fjDLKhQ>K)}3}dk7p2?Mxm18m`qAp z;_&{%=yk1$Lq)M^{nSbY=%0>6h1rbvFCB{)Qxz49IV7lReKek1OuPIV(U?Q_&qO=@ zOU7dkis$$X8q0FXXFbJnno~yJD7jv^$Ypv))iKAC*RD zb8#zUG0D1kGFEkxI6UpQN`RJoLdDaG!*nu-b!trvrk6Ol!x%^DX7Ts>X)VQHl1i4? z>rp}<+nd-+Qp3N~Yq&|=C9!__Iq8Q|-_rjndmod|y{h%`_Sep|#jhD}X;!Oc#W=ra zv6hCono>Kzju~;5hV@=LxtuYUaZpQM7zv2oAAp@Z^;p@iNmZ#5AHC=F-)_7{I}fY%he$^CzmBMw;oAv+?&X3P8I>F z9{p<)qRr8N`B=S_N@d1sHZiJNAGFg;X{KK@XtOC$cof4z|C&W_wi0Jk59il0BaE}5 zFHUEWE1p$zh`Fu~JO8QTC0htDD5I>o`b$k?S83~_R-to2sLaAt*M4jFzMo8zIJ2x3 zv6;j!?l8ttvROFF(oe2%R1~sA;4m*;YcC>DQ9`L0RR1!APGS7=aaKstGvdtQT-Ex} z+FDNif5p&pWWHRq(Z8nAhzooKz}82U+T;zZF=Ha<^`sDC<2RKDi(OV8E1Q*0F@8GNf+ zA0eMtQ1f3SLNX*?Cz|MAGCnd;o~5MDucJgqM*iXH`ORV@{ZfH*?PGGr=ev`s>}?!A z*?ODfkIfo8d&8kyWzN{jN=AoT*1Y1$n0>7DRF2Rs$6i(sag8KkyZ5Y*2H#JiaC5_X(gRN|8(qUEuTxyG&87!=jt^3 zf9<^c=i;R@r`#*Ks#3nMz>ScB9c-3=F39rob(Yq1$#FDdYuruI9hHqPtVzw?P2uN|WV@TZ?j3wcg#%Jf4>N zHQcR54W1KC^)KmeEfzVLnmE6X;%+VCpVy;>)=f=a^nke8!22t*YL$B_I%?qk(HYI% zN#$!kzqI>oq}a-RGWb@t-d%zx{#x#mA@N}+q}5&0Ju*Pqqsvx{)%)G%?92I zb(GUy)!T_!&@UfnpX=%{=6f|;%r?xvxi(7(gvrNC3Th};u(I+1Vx0sLGS+R6)w zZ9MXXU^He=Ks)unEEpa9wcP*o`NuZ|W9sF-GP%dnHfD!xUtA?ssiZ{EKh93zgcJC} zb=zRP+79t-)G4xH+&13e_uKI}PE{aZ8MI?@^i<0-Q6E1+kJA)yW`=^{ap<3d`DITG zRj?oD{yrvMH8IC)?b@ZZs|m*93E-pC=_h=05^dyvJ|)7p6m^N$)2)119l!agbD}9) z;=ZXO-?~(tL-qVuphV*alQZ3>CulZST(OUbN0`}}@ zEh+c_2|7RRe9o!m$^VJ3Z9a?j@;}=sbu3S6hr>?fFi8LOXegQ6GmFptB)X{*AT`Vp8f6b$w5S_F~DPYeYm8Q>O1Jl)2*5Gihl20`MCk`~@i~m3LYH2Dq zZ<~%9%otF9BL64-B(0b=DBW47)#tnNf6-IpmLx#grh$HxW4ijrm@UO zqIa^f+<3HCAvz_n(%^iwQw^>&R$S%DMM;=eo)ruSVEn~pluQ7ESLei*Bj)1-d6-dB z1MHD97ZG7hbtfrzs=+jO3&nh~m~T?A1dJ!$MoCnC#);P81^p5`l#tJW$+y`{Ce}@= z_SM+>jmGRo^#uYjcDquf8uy}bjPv@+u&>0oc!| zh=+oH8`zJ*)ODDN$|v$nv8fF4Tw=pRmN5#KxEX1MJOuCy%!8p3jyV`>qNqSf( z_2_tgAvQ_UvpVU-zh3RZHRokIO@UNuRXbg;R9;5#H6yT?k1!W$dfdj}Z~CW_ruDEf3|Mh-vtn zq3XPkQ4s|Cu(|mC2on_-YhcR=6Gz6;_rz;FX!Do=!AorPXMMMOjxfF9OnSq?+XVoK zKzF~akK#<$fARYxOq5RWg}R_W;cqqA6$1#i8EK;6j$sxCYuWpIpBZN1;E^W0FAuZO ziT}JY%tAR4zaM7dTy4Fl+}?w$Ep#J7akYh0MzSJ>)@V&@fRN}*43Ze^kO-zou;e*X zvK5v(0n^b{8R}Fq)TuPon32j*0t82zI5HT=sdT?KF;Z?Z-lPVO#|(5+bWakxCz0;8 znyvshYq}@V)7xxp9o-(7iDMPrBa z&QW#{pyN5p4&52QZ91Q0w#L5QF&itiCsqpKN)jHZ2@5cSgyV5kvaM)yQR@hI!yL@g zgv*6+ISJ3zgauec!qGU&*)FwNotv=goT}w5eauC~SnUSzFTBcQiFqsK z53a&%hOwFoZZM1r8`xlcca;Z^CV6iVw?n~GdBB~z-MiDsWe#Cb$&txI{LQ5ZKkqUs zCIHX7*o8lxB>cQmN_w=mr&o!vA zzfFRQO+%XvM1)!BrL`Wn)@o@9!zrAZNZ+X=%#K-lFq*jY7tA)(T&`m=;-nMQv62C z^P|wYG)X7f%5mm!Ql&kVs<~Y~Y1k0KE6$DAw|=Z0&}a|mup|W>5Do-mLTsv$n_90x zKqI+wBk2z-aKbw^Z%=6IA$$gDVQy3{|4v|8VYamj{ppTl8^XaxwDyi1q&u8C~>W?y%=^cqq>K6>z!+had z8^+y+v6^oyv^6SH3RRzPq9P^}{^Kg5;SCQ^*1(k* z?7QM)4^Y&7j7z*jdBf+FtLS%3^W)&2XBOf+rsOi(&|sinpCM5@jJ)y2>Vwr%K{OZu z_M;%~3rsk5CJCMkobGNv&KI?@_EW}+1_Lz#buR9J3zFvApA~n=1sNT6hU@XukHG-) zuQQC*#Y%!;K-NYS&(0JgDbmpbg=-?fel`0Sp&McKwcxlea59r(4RK$s4eZzNLl1hV z#8#rJXcE!RqG+jBCPTD_Fi-6G62oJ@s4TV3No(OUFe6broQ5|o7hcTv1)9*jG8bAo)6YNu?9L&@kkLbX4eu{#Q>UhPeHj|nurW`opV_%M4;ww? zEFqTG@nujt$3e(N;amqHtsBmuFgVgL5(-5o_LXjeAy<||w=;$f?lXGukin-99MbzN z^w_^BCr!Z|)@yK|A%g@jmvG@$^N!hUxzbEFHy6!dyhr!3!Gs)8%cb+^-UIuL?tAWl z;eGpnZFGxxXAKxQu&;8yTs(zdpAmzGYP?+DA$Y@w^&09R=BidftR6ljiI_IT%cwm; z>^)@g@BxEIXy#^)>hnipw)j#`x8(PZqjo@$e$Lgh`6J;(Fx=pv<&1<{I}!7R1Cjb< z6Zl{*^ZC<<5J~jMa-mCaQEi6<)xp}ZFO)2BYc8`(fgw>loJ74l7piKFyCxC;kPC6> z=%E9YQ{-|U!RV)O+=a zPFtY%&4!L?%}`XAJonu6{e<)-e|DGLF`K@}9W$BBR`!n6M}0B*8k(`vEgKMATY_70 zstksM2_RwU30cARkcIQdsM+fZqx`#&MI{~VvT`Y=rbW(jhN1T!2FO~*fRT$ls7`jn z12`Z~u^SMF>uJ5vRAE$bD2NL7)EBTTPxxZBc0#9ImZVW3^T5(zJWZLdOuOy^6C&{# zEpb;b1zyKwuK3jGdG`!AP~fV!5OVNR5(VRM-=41)k$Px}dQhUjrb{F#Z>CbxBtZ{~ z@@-OD0Z|m=$gB}3zq81LeJ(VCq7^FTcU>2I&|6YAtCT*|7ke=OLK8*zGJ!_vO9@^k z5{e#TVk6FC(r1!XD76sha?*%!ydfHm#1eJ@1@5UYD4!&%;a~|e{RRc@&nMThKEYKn z1Ak9IB=fsW8>@ zOnalE5omwQVh;*NnW&iH3jytE$^A!h1es2PYegf1VSe=*)3A@@s}(*@M^SC|E5sqB z5w<4+)f}!KG0H?`Bou%lAdo>%Ri51|97v};9s4$+93VI<)1$S5w` zZ~+)W%HM>U=2;iY6&GfsR3brzHL?$TBk4ZAmq>@(9jxM)UaDu%x*&L_9Y%naflI^(^_IZx?>Is zGqgN#sRvg(#0ad+B!-|ntr1SP;0ZgP2t{hqzSmhM#{5RD3_RZ|r*?|om(d>U)XIU8 z+FCmX!)tU3)<;7qKWyJ3AV0mf%F2hT-Q29tM-=z23j||j>SCAoGZGrAz-e$4|6zn(I!asD&Sy|qNX-Ho<%*L!Tz^_G4jQOHnVDvCn8wG(E!`fvZ-nad$N;ILHLLvX8lY zl!>CR*i^EvyZzL*2v3kuL0!zkcVpCkZ@11fV;0^d->YL5e%8t5S=rJ0aMvnkCpyed zB(r~#S-#H&VRjOk?M^cD_!P5~gxUTVnGk0C>E!IpSh>j4%uaKdoknIIFEUYdki)DO znN?lH?Ph9rsHWOWnDuj*b=JvbmKw`AhK#0rMS*+k?2B2Uxb=e~7|pRm%FPShYcErs zhy5W(JP)OJ9?4*%^P~OHK_;dyQr(Bw*P4Nkl-tS9BZE|BS^1!bgx%<^3`P9oszZ^9 zz`T6bTaPv>>VeUZF7;sWMJ7slo2EM9izRsQ5o36*=R&5(6TaAlV7OL&u6sO_d=n$% zZ1uhFWrTwXI|e@&Lhc~Q=03oQ#=|syH=3SJegl&}WKs>2#y8jv_P}6G1lPz)b-U3f zil#FsV22VutTl+=aWog>(%qS=rt}&Sre-isQA#~vh*l36RO^V*CWP~&Lh2Zj%4MGh zp(7S@@nitEq@Gg5o)Ti+N1ISR*Hc2RAH`ilajEWek~W$gGG-ECe`UCLT`&}g+2Mha z+O9I$$e0GDV@Phh^a)LRt}JZR$on?IsAm-qjQGddYBG~CL=XE_{yC9xwqlSm(QvX^ z^HR%X&{RNSz~v`9mRfOkjkl7=cz7PI)F>GXtZ!R{5e!2Lh6;dD0HHwpEN`eq;r}<=tjJ^4JY2c0Ds3Bi3Lobr|VyiZBw6nk{ zAj&30Lfpgb&H6)W3?ul@Ul;*_NFoqPsDvMx5QznAgJEBYCcx>W)@_W5(nv!B!)LZF z!sTPQ`Q2#Y4xbA=7Ih8^-fFb)lm+~tA)HxcQWuRdHNfv?{o@b!oj7b)zYWQMBb-4oy)lH%gx@-RjH`Qb-;vce!eBT(y%nIglfsYNE_G=PNwI&%g*C!Z*%Q<}ULz3hVLUMPK zq=HHEM+Hv63M7m8Qv&gh4(ty=}>0m~v!_c5JGB$iNyHj3+WNPr{Ft zNF85g(~9;phMPETnd*JkjBR!A)9ySycx&D`pJtTQ1HNS$=LpHHIqCz3;IjGd#7;vs z-D*@=SynzI?6o`R{m9lnse+G;9=hs!xGg)%j;z&tR+L#C2_=>gzA})^QC8V|XtHoqwA}X2oD~G)eZz^^B>lQ@DzU9S@w(x$pgqVJ-7A^BYTem5%qXc#06*N& zyvEpBbnEJL7K>H0$rYsk)MtK~stwq_Kt{E4eXeQ!*Eck=yhLA9EcJ>++LJWm5W#RD z7_kWa6WZyKw%WYr3J1834OZ@J9E zG@N9t_TGP)g(*H0-bXL9Fo%VnzRbcO#=1}dpts(VN=`om5m_gkjwLQ*H8BPl6%k+n zC!<&UOjOhW12`jHNmASr__HQ;rfdfMMN3oZ zvDzp&X|jcvbg4n!b0=H4SID(oybER`xvB7)E`FAn>|u(`O@+6$kji9F3RSfaD7^>w zB!@O6FbfYF#%jJ8>X+ll{+E_}@B)p{2>5x4?lmrBgb=xPg$J&&&gNv2$QgD5v+?nIumTfT*2zvoJXylkQ$qVuU$&m zwTjPL;d9Mc6Y4PES|PVK$#<<#)HnTZl)c3}$t%R^dmJ|zoTooB) z?*a{di{YI**+R^3qI|CGCP{XGo&9^2J>74@%k1k&p@0O=))@CIjEyM*O)54T3}Y_F z8&a=a1&;zxiK(9OJ5}FiKfe^NfxjylmN}Thx zIIk*kzHtQp*>9rr)sro>32^OS_MVgO5)Fo>D(B&|JSE>-sw&?S`SuGq^1YRmuL@~E z7Xn-)(~`fX0CA>w<^SSUqIK?Ujkb3Hv&}LiQ%CVY+CVD8_)$;q=I;gCi#vbQT#ro zVieEP0;nkdLg;FX^5{xs6|O{?vg55TL+3PI!D)!s_2+WYe7vcTI}bG~0>IESR(tS$ zz&U;}lrfrTI~6c=UtV@Dl{Kfcxjyt;+f+Ab&u7#eX`3jxcCv-}eiwLz`fL>Zb+U!U z8XV^RXtIS$n~TiW6bq|#da%6v6m_UZw~%SeHr~o;Br2jVpj*hv?5KzurKrazWs6c& z?Ez6GC)ZtOOURvOn<%=8K`64vDSL#n%gR-P9Ze%a=61ytW=|6_sm*;_%(&9#Q4J4iQ4Jv!bJ&wLX@p8CuJ_ zo3}FQnhWuQTh;gLhEd@MUN>r2dvHRH8WRPtPhmr(1boNvF1*~r28tsY?RCc2D&x<|j3ac$zg5O_%*d*M_SdU% zkrJP~1%BWM5&!KPCzyT^@pYa3pzADv-6H2lH71I>23#nOjKfcoSy;=h1YZb0Nx=hZ zSzD_vw{W5sYzFT$rbUorQ0+w5;BM_ib6sN3xh~qXyw(wDt}88s=DL&<1u)M=%l51_ zQFIyw3UtL%Nji^7!#a)A?LZgeWqHtnK_bS>x`u?6bzbb zA*A7TE^om!3ma=qcn_FnVGI8`bee^iq$ulff=0dFRn9u(ma?cX&0rTSLaDKu?aFZm z%wwimSS+K+{?jbHLD8oLT?AvnqgFM(QulUy zUaiSqEo6T~LL7pw)P$B9G6r26&^;3rpY=L>h2|sL99l=Wp{{r7>{W(j9L0?0YAP+U zOfJJxmM66=Pl_zZ)|uRyd|ou{S!bf?J~~7Y+a&k~lc;ceNOOBWU6_DmbAbPt&VJ31 zKJHnqit6JML~~?g-yqwl4N)w|{d({>&1DpABj+gQxj4|goMnpMR7ndZX)cqfVchQv zg(~ZOaqfQy!?nX~U%-yVu>u`cHGZIV{6KVET<1i{2NH->_(M^6HEUuSJxGiHp^?5R zDb83{{(o2!z-5)Qv@Owg&f_5kXeChsixrM(bZSkdB8i=A# zXyS|Um7625m*@d5+lA6FzIL}=Vc{z}h>f4zhp(`(TWX+S%QOomwo9I@_}Yzv_R}pK zqv08O|5XdBJ6)?Jk~jeSBxS;`Cx{8BChgJnM6uX3WsgtXhpn{m+n@=@0-v~#U1{Oi zAji5hEF7mL{?zS#aE686On+jAg;R9;;XuI`%+T;>?*FQ0c4O2R4&Yi`m8Z^Qtv4J^ zj_)d(_1DgFd^f4*0S?$*JmpLWJWkx=EC)PZatDb|tT(<}X<;O75D5ijc?Vc;v{_|g zG!vaQA15)Q6Y23xpyACL{_}sg-QYIGkeFIlS&i?Cl!Kh>_(zX!;vc`$RoTWz6) z|1(QD-i36#eoTvpA_Fw#R$KTZ|4(}PLLRw=&j5Z3*Ol2v*0@j>8HX5C02FnraiMeq78%s>)DS(5O~_d_%014L z7GzM!gtQ>%>*T||@6WJsA<I%)(FvSzM@ zGM%v8@ZK}m!VN63Wv+#1g(kzUi^f=McvsG`@BuMym}4O?OmT>DlEzr2F!p6e+Qt9> zbI+X?f$7ux>-g}F8sZGn5-c#hi!QTJ9yTE+>n5V4P9gnQM8WmA-mO}J)0|e|xZ|Z2 zI8n#yaVJRFpX7ii3V5;xd#K^XsSemx!oH^j_GyQ&wQx$<3GCA<*IGC$Y(nj(!Z_{J zwH8nr83*IEePscGQHj$Tuw%m#uzd!uwJ?tVGfM?*Uk)f{hfNd>uayDCfD6`IxSHmX z;Azwb>?Of-ZCD4-be-&Uzw(b4^9wUA9>#m7CsG|D62=+<2SIEtk=6CT}JdQ z#E%r5r_=A(f*&Q3+%7`L=jh~do$f`!Q*$l6sKGAYkLOxAB4R?Gae2Mgg#!Srbj#Z_ z$FevI{x#RayShME?^Rb=IEfk31%BnEqhRF~7Itg!`0_`u;1uk?8C#C+(gSO4DzNhF zRD)6~an(1X<7zNPZF22H?K1K?&HltGA7|C<~_1U9rp=vZ}^ zDY-c=n@!0R8p#cLNp=o`qywWyVO^7}D@z~t;17-f1Rl&KfDqanX1Ik5-D&TseDR0} zk2|~wY;7GcwHGV=vucI)Se{wo-~H8t9S$b~@8#mecD-e@?uq*-+}gyZ+aB}a8;3iA zpL21~b?QNMP1;&EiX|zl`lE0gI%jxQ`Qsk6iR#E9uwS%=$Z1*qJu<(&iS|<;_n@Q0 zoIvN6m{$%vN6wt!4n6{x<}6&fImRJF;J6ma@c1e=pi_n&-dyHEPlpD9Gjh=o>n07Z zsyunNPBI9P*69rY6<$!s8y)JMs{ikV_s> zH))GxtFkxjvAId;^PtS-4tD}`b8*iV5=r*Sla5W~%shFAJDbGB@lSYgjUxepRkW&syx2s! zLNdtL=q#Ucyq1Q*%SUI#A`Q{g8~9hYCwVezM1OI)w*RK z7@7GfaBrQWZd%=QFK=W?=}0IbrFn@rJr`fLOFICctgNxYI6q(1{_+|VJ0IxJc^Qi8 zT5}d&mt1>3knem9uD34~;+moHcb8ET9~X?OiytLXKXCdSo?LIjnCIes34fg(^Hx^Z zMH)hZp|M~%0pn$toIk(n2@gtw0d?p(?aYp1o?g11WYlMVV7!r~bf+NRlxOWa`SF%3 z_%u&m>`|J&VRa>*Px;oPsW>#a(_FXeq?r~wX8Y}MqWFR?T~8QwLHAJ&!EmBS_q4Nk z8m+!TP7JE?SeESKdSCPcRe03cNF*djw>ZagE_>ejcPjb6C}sB3$&^=}PVWAkN1YN@ z|1~+C+(NYt^2Ns4u_58mBp6Smyr8-3^omC9a6qBMxH8Wu3B(h?F_ncWhwH@eUM_P}7+hH-^Eofa>q0K9ut5@NPQd#460aC7NJI4p9HIeHt)M@! zNuI((4UZUX2K1ibBL*KWKxsW5ljI+x+-p&5W1q@SMEmh3O2@L%{!Dgok0;E_oe8M3 z4Hq$CVlaR&WIJXi!6=>(u1m+8C~99PXI#FN>|QYwMP*F!<77IDvA=up7Fma}L0sok0%Lj6>uxs}684RoD6PYNZVKg%n<$z> zv4i-%pbw1mV9wP{3gCYCvZp*4Nu;Nk62votG?7RsxZn;8+v;3$O>Tp`JbH%(crU%f z!ZhX=%(}zE+dBJCZtq=pSXdo5;r-Jc7H*H5DEP}A7ObEuzr*GI><$ah5aHiaN zqBAyF_=&VoaKHu&hilxI+}_hRSlBmV!rOm?g+mjXSPzZxydriQ5lC!sLK7RGU?mg` z+hAds#{IJ!1>bJqI=vF)5qJ6eja1~WjTWYp!UG#EEM>uhr#4y`ukjvpd;hi3!Ww2Y zuT<%>bW7seZK(Qu%Wbd*-;x^Km@rXM2fQT}@qEIm&$rylnU7*av(x?YRu6V2=)L%d zn=R271o+O!EH#_l18yxXJ5UEgF6Z6&EaeU@p zQtiR61}e}{gAYZ8ZyHRLMPqhNuo0g~ih7*xXDR#JiOJm48*1>eyY}WnplCtRh0=OH z1oDM=e6NWnN^1yIdoXIE31x85em(vW&2EmCLHfR*=9>?Y3FBEQV9r70Jt4zEr&!`Ca5@z$6a}hPe$rH@?Ut8iK6#t zg9&&ykLM3gyu?J&Ja!3VcaBQ>G>`3h^`%T&sFJ>v-l|cOmaC+%^VsD~ zm!vf+>6<*>$C)ol>s8XXd2HgBNz!JO^nD&L$*+~9dsWhI5%hLRdPpVxl*cCL_mcFu zN}8JguNw>T;H4&tUSdikrsY%8T|`3BKbSTFGxO=|Z7!qq->Rg!`L)k`P;r@wqP%f( zlyIJOI75hpqWzdQ0rT_MKJUSK#5#;AjaZOR6{jeyqnS1VSLgHn^SQ)2fhmo+CZAew zR9JnPHUUfWZ(Uu8dx@`C;)Z-$Feq3kxP6m_jpI~9 z^;Mqt$xRmGlTCP^-(+FNWD}itY_hO~$OXGLS-4-LewOETZMLwEsD+y?{DG+ZZ?^EN zppxq28ued_>PJK+)gOpTszp;wEx=0}^#_G|=oBqL#S|?-&m`(UH0qBEb%=vH+Chyb zQ9sqFKP%K}4(c@y>WzZ>+szh!(5T<#c~9PK;U1#)-fZD7L_KS>g_i_%#AXX^LdsZQ zlNyB2X(%Kx=c`6zo%=|>G@K>>xs(xy^E-< z-&X{c`ktv#m*tDi-Xkh)_61RCvmcVE!!+t5g<3S#grK&cs!dZo)iKTa8ucnAYZszE zzsbVMM5Sr^CQ-*~)GHL~NC$O{gL*Mh(X3}GE06kOaa-Ph_VU@PNDTS<*|5#|@^0AX z`~^>YaOqU1?c6L4N>*9{JJ1mIR>o~R40Dr9wZb3g%UQvX^Euj?F;#VRA4_;%lO+0a zzS@$JqF)HGcB(%Ada>5+lYH4yh==s~BH2>7TlA8{JC|v^ukvLNaE``Phj$(kyle(Y z6MA4I9-oALE?0v8palOx1b$MiMO^Jv6X*wRPX*&K7oW_9?v zxtTu_4xmluLLevKCDZhRD1q{684IGRYyEnz5UHt&+le0CWxliSvAH)qv3mV?XEj5M z#)9>>#=2+5)TvX8v5qe-q3KtvY9j%AY(p*DSBy6?^)>~9NuqfuptLIOSmyAL70+Mvy4{`)Hl0)MoHLLucz0YLJ{>ePp7&d z0-O(bsz;6b8w{Y9Cv$FNRJzraMI6rRV3;vJRXH`loYy?*EtO-Cw2B`P_79GP``9(U zhEM`i5mGJIB%>k@OrrC5oo1qd_mJ+2(IVUcx3#mM^Z8g$1Sl%bLmchUmY*(f_S9 z{ipre!ap_M%?1kEZn5x*hSwS8r)-g}<2_4OS~#~Kl@%`&p4 z-d}6dYn0x%Q161iTP*yfGu9g3*cJ@oAo_c7Cixh2;j({IR4ZHW;t5 zAuNsKPWkVnX(oya>Roc4d!s?8&702i+}J3MfHj>{f`f>l9s3?ZI$a^%BS?dYRB-7Q z3+44{{I}64UqK^zZ`@*G%5)RnOKij2R}p zPd{j35&zltpoM$+&pQuVc%PKAn34PUl~t*aFYPdlELd_^Iz8BC<6gbs@TTFs2KT0z z{i_+y5a~^Wcl2oXx1{b5o@t`s%Lgs^wbXAJUe7}o%4SMe-pu72q5)sR#vELuYnUg2 z19lDYfp8i$(?o?Gp5VYS(&tg^i#7cZjkK#miF$PsA$3*gpoc6>(WqY<5O|J;cW0ad zbYfpgBo5vcbFp2UV0Y34yTvsYP_Q^Ow0Wjuklo@%I5H3n;78-J{vNdXgfg>!uhxuz za_TorEu^vUf_c0+Ch_%UlKq#${u|9+K_#;s_Fty4|5~vhGRs8Kayq)aWdD^hsBa<8 zoyGb{eS@Zn_GvFCrd^O)r{(`hU6At4(l>krd!w&)v+2 z%gXg0Rdpg@$70^fb7Fk9Z9eK$-QDFfDyKxNfV*5XU-keMWBD)FCElIw)Z1OcU9Usm z<&velEY(w%8Uto@j1@KYSisvChPv^V+BxD6}wqVVn8JfFC8h@u_B+-S6b(WF3<5zJtbj8)^nXzxrM!WqSJzOVn_?(R4dJ81g zDb{N+GJ_ziwag(%pi8R>>ftpOVSENjcDW}xBnkA+Bw5(ZBh(bBz&&P$+Cx3$RS(i$ zwRDVP*GChRP~fhbrqI^Blod@i39@CoLO+wKwrrd6jf(@Kz+J4jcHel}0|Vi#Zw&hD zeEvG$34C!K?O&T{V&}2Fz~52f)=XB?i%-2EefU0hQo@eJ0(Pu&U|;2aFuE9gRggZP zHt0?xLC;F~61KN;KsdJ-YYz#RpcOE1y7lxJCS71FCzE z6#S8b{YVaMeh12r*@38Z8fV zfYghCa;d2Os!1ju{-{3#49i*-VN!0z1$5qo9g|TUaHi8Vp-@t5BX(mjF_f?AsyRb} zd*{ow!iDo*1N)ijqC}3ZiKG2*xxjCz2SwMkN|u^9)=H3*KqWV%2SoyQ<$!pfU<}6R zhRo`&F5-$v6BPAu$W*moE*Nfw!BHuu;$Bx$Bc0JN607$m`UGR@{>wCcm#1!tox<@# z3^-+?RfN|WnbM7&!tnxB$A2pSH|BDi2tC={9LN9bBLQ1I(z$W2Nqc5$q4%+;W2;;B z*e|I^YhN-bZ_zxblYU8tq$r)JFWVh5&qNuwqh2xCHlXM>21*dyWpj7XJg$vlyIfog z%;R)pi^|_6`4N@BOY-M2ALa*tw=jb}wAcNNg(XSOpQ~XV%%W#3%!FyI_8$3+h3k?C zQ(Y7_saje2P+y`hW36)*E>p@~>5|3HD_vJwMYttN;Yt}YWv4JA%vZEAo9|_?0a>6( zED#dEPm)-m$1Q1{wir4o3+BlC-!jgSmo5y-uw|a^{|Wq^)Kag;=P3$h<&MjFwa?Av z)j`?T{@mD2cVIbj2W_hY+Hz}hR6~2dD@M+1PEtF-JoTl*df+9Y`Dv1-uK8?b#lNq> z!TdI1JuuZpY5tuosVk;{6}K%Z4J!{1vafu8xx=v+~li`ZoGQ z4e{UvJDKZB%N=glMXhi{HD>7t0hRLwx!Cpyrh!{D4@@u5AeU zVmdQje5oy^*4ppV1srO}>Luf6ccHRF-&kxwc!Dn!9qp) zY1wi5HU{JTSj*7t*@Ghq2V+cjjNYM0Tt2N4&5~a|E*Pcb6u8IeWJChtuV)-u6?cn3($Qnc(luR`m%|?pyW>{4f2PW_4@{Mkg8dC5qDDl5UC{PjKxS zMr9Hg&2aRy&mEH}$!DJxYIQUeOu)Ft;CpTS1|oZbl7MtgM;AgJl#<4~QxJ=!^+js! zm*Z7msJ3#TFP<0>4%m&SPfFOjNif>USW>9?)pOXLg6dOoaEmIvL$)sryt}WlIuAg9 zL%%THpJfWJaQY4bQ5wTYju1v%!8a5li9jTw5*9Kc(vZN2u|-ALc7=(8pI@->epr3A z^;`w!MHDz*frn@?uE4GuOek=G1}{~ht-;GtaP*57rfG1Vfr23~T3DgsagJVeDr3A- zN}h)i!@ea}{6|tP1w)=#-YI$irtFuzXkoLaxYO`n@uCImN)z6tFIwn)rHRhBzi8pa zD@_#q{zVJ-Y0O22_l*}V^diD1FIqU~O16-|P2Z;tVf4q4(Ejr2CW=2+1F8ojt(meo zMcZ8HtWEPQdB29RABM-^dNdcaIt5_Wy`HvkuFtJ|D~HJ|0etS1PY&>;x?18+&9>!U zq8-a}h`4t{tXQ3=Jh^y~uTlTsYy;(+cNAlFW4 zba-SCPlp+g7)FWT7ljOkn_!4r!+0t!?}wwAcrPm z{bG@NCoX#@2DG12k_xUog}V zvn7%nqA>oQZCqw8FnHTl0(|Yfs|}n5vyK?1aq$gYiQfqeT5jgif(4>~6!8 zEE%YRd1Zl7BL6su^9!0G+8k;aUy-K#=b(PwoTlW@C@@Oo9|v(}6Poe~M1E4tXq1;A zx4!1#W8mr=V#*ht5R%V;_T`6XR~SiLxSec09h#q<4wW7ifR+Ec2cy|e-t)4Btr4{z zd3gEXUgq{dX5nOGCTrK-Fb$*C_dE_Xjyx)W14*jQcs8jSJew4&?1JgIR26J51=~x( zse3M1$qk`KRrDY!dXN-d*u1FPKAMTGdQ0taqv-93oEzvwOJ9E_S0&Jit;|DLnkf2= znHQsknY)f%NRw+9 z%cd!=cJGIG_dpngAL={t9Yr|7nQ-q0^@}@_<`q3qb`)$u~=7Jr-&BKlWL8{aD(*a z*Ip%o)q>slrrx$nWwP7@Ca3+DSVF6 ze<%{RyWxA|-gi9s-8Cl4)Q8`93rUpvV>Y)M$L{o?nz`Xx-T{l_C*gt846s%x;%CX5 zL_h{BQ(YXbEFv6bANsAq5!I~%$L)kBp;G@Ysq7UM{4L>zV4&U?#dlKfh(&C^lf_ix z1}4^~qkYSingG_iIHvV4Hnrz{rOaLy3f5zq>-M)jK$+hcjpG~RQvss2u_%5}HCMEp z{u#uLvVk^bv5C@#ngDKe(Z%O2=BnGDh(QnDDC<*8m{{=r%N8Dws_E1$7Yc^FVqvR> zH@eE}USS7YF#Z(_J9O&&Jnvj0N%6(6Sa>^?amOnbUSmc^VAT5(1Nsc|MWexRZ5&r( zVZMrr+wzTyU|bK>8xzmGxE_SAgx5;^Bl*(c5+XZO1B<+kzS2iT-j7c;RO9y%6 zq$?WJ#d?aW0$cDD&A(HR2R4}-`j1Q zh4YDV$~Ft*`Om;@7Vac!6V16Yr9x=|)@j9`pyIqV_=KpkYndER@Qn@Gz!P#n^5bQW z;!lXwqWDvSy?YtsqP7N4iqQ^SuI=!YARb3h>is#XcmHw|Mco_|ydpRa%c&77w3pWC z$$anDS1jBv8MIA*o$-{i%{|LAZ1duBZJUp!0Bti|7kEY4rsE0|Vw-OKhqmdxf=zz1 z#TTy_5e%Fm^{ssSD%`5O%AJmZc8bc4E4Zo83DnMfc4>1~IM&%I3ZZB$HEak5YVfvL zW%&vdMG+>_MRp0+W|5%iGN#rN^%FsTnW#&cNYoDn^>d;Y-RLBKDv3Q;QUkHuom$(s zmEF!`j%3`cGd@unb#;-md_wtrl2HpWAPfto=2V8q$~cE<97NbgK!Tn&C5 ziwi_AnFilUt_c7ynRlF9h>0tmzUd`%cuAq^)WZ=NFPYMmGEwv} zEf~j04rT3CjK->xehUA~H*jM2=!i@9k++KIuD@K_E#un6l6C0x*`pvFNK-m%I= zMOfqTqlgHy<9vUWDP1j$ppuh4BQ9o%Z^jak`Q05TX>0nOEvK_1X-lJ!YHm* zgN?E&v8u{o!Z#L{_)6Ktc*2)xh-0zw30DD%US};y*^fn&!t2;#oU_fscjH~4pImQv z8@5?E<2nkSrwpgFy6$6s`*^yx=LmEuXZzw1){MB10NB$es& zpC)>zH$6+$Jcug2sR?<#{IcyOWX~7E-qjS9ZZm{&%A_$nWc%VNlP<%{hBE1JWzvr| z)e&hX{YsNenl#l=Hldd;>hhGR-)o{HMb!C@s772>l@fJn6H&QBQdxx+;5m&B01h)s zkK!Ql@a^w-aQ*crirU2WFrt`E$R;N3A9tZFOtcaiN&*G%Z?o{*xC^9FT>i5R9NKQT zaPRddydAb%c$}OIj@WLYvqtOWowVJ;R!N_^-9oueuPDEEJ4cEsgL17>8tSyw%9Z$o zp&kgYlA{+@Y&Uma?{tM#Y;|=TT}8n;v+mBs@5#{ZbSuHQJnt~bt{-d1unOm?*LG(b zMg@oCm?`bkF>4&UGxdZ-k78yS9A}@jMvppXN&9gA8WRN%Z@17j?gBNr!tj2v-GYCO z3Ga8?EzBT-YlnqX;w~HoV1l=5hlOjHf5Hw6cdaqe`LrDt9$LdrHeK4@zGxqxf5-$o z77GSAoWiv{zfCR+oOJ~?H&tUl)!IF=#zdJP3)NshMX#UF@3-S|UjnP~#6C*(RffTd zA-k4UqWtq~_!$D(s#ql*!Fx(wI<5q3H;F*@jfTa{Tz>5FJ)J(Wmh@aNxWAQpO(Z6naFy2Qz-9dV!?nN z79!g6e=)ol?Xb}H1{0lwJ1lg%fo*AGhlR-+<7vY?cZY@U#8|Y$!tVs*x*Zl~YmA+S z_wF4Q&LqZ`9Tr9i#uGa%EYuip8{XGLJq-?idCR|%@aGY(uOs-T#Zjk?X++d%}_kPav7Bq z12Dc)M-Ws;{FTsPxBD;Q^f{^Vu*KJ|Z<>+Q9=--|xD?4bZlkgQUO=J0HW-M*nB%6` zYoc@HW-y7)l?&+K-M|x~SnA&Sfd^;YXrgEZYbl6pB|CT{UE1x$-#NZuqC3{&V#VV} zw~XX~9|bvaBQMtL?ifG1kND7o$xMqx6TwJ0&NL2Y<})qU5ck#EOzQWc2TN}>Q8|(G z3PaJ-;{K?_Ez?AQa=(_TxmtaeV;;Bx4eIstupI9QZ+*>!>q%FJfnl~dD7u5%#Sta6 zp32G4_wKk0{CYrxOeG#KUkk~AARYD=ru>R@fy z7jh0$+~ml^GyB{?F+P0FgCCQnH%NG*=uaY2B8E+pVBSQh=M3jzE!91Sh;=A4Qgu<2 zYz=Ofiy7?z6d6uqP((u?byKn}D5Ap05tdL!5nF+!e?6r-(-uOc_;@zrep!|~NE)S%$EuUgol zF@NLj`l^M;n4U$mu2_d>T!yH2NK&;!sM=PlqMErwsM=eEm1>7jwQmUPMotQtH#@o> zlG63J)TRB+O4m-*_3)cpsq1H2gF{8v@|(4;z4#Ax_1(;Bq^?FnS*5e+I*sWmT_aID z>`UMlysP!RFsbK-)N}sL$tt{%dR|Ld>m>+xGeIeSAr*g=dU9b;a&;J8s8qJQU@Vn< zff}=}M^XPb2*s)}mKFKW*6QCuYju(6k9AuAgZK~iKYpE~|Ir%L7X8m*dP;w;QFg_8 z+-In24oPDhdf+1u#;!}XwISMK+&ZTULrHz=sZU~^sobi!W)%@ulQUVJVJG|(1GtrI zvf@$?8b-y~h8o~OS+tu?@?q`~lbN>MgVKLNto4w5%w^L$zKK$WzsU;Xy@c#8_?ygA zwmO0g*MdA@h$OFOO2T)ly5lxp^$O5pOyaUxLcg+c~bd=r?Nm&%4AfXJpc^@rM&3+=0h6{mpJg zf3tKOLvP`_czpmGK98_3R_nlH$)8`VFciL4eY5I9sQR7qZp%2W`kiiyHr)|zt`_Yc zw}^ISrf6r_iGUqW#IYe+YumMS+eNx1lt#R1yFA2k9i<7wP`O%`?OGPb-VQfEVDmQ$ z6RW~oBHFWr>@IjqM0?K>ZKW3NZ6(?lnWCK)427@}zt={4J5P7YZ_6VUKTxiCuoieb zkNr>HdZ(7&&fC?!kmHpu*p)|9SnIVH+@blsnwy9;)TP`5flJ)?!%rG&aWQ>YPgC+AMN%*YOM)jqoAS+&piA9?U+3L=Xy ztM*CO$+i1X>%Tb+-qH-N+efs1Hj{xYN#d@gZ*JK~sl8<%wq@J2+FSPFlxiorg<+^X zt@akpm})<`57lmSt5W-~`>Uk?WH(>id?1#=E6c&&|553g{#Z;(T%T_RL za!tyVtG*%3y_$QHF|%tQqrw*m#DHBwbvi`}+2L9qrBg{)QXHwHU0Mda3*Hf~OB}8T zXs-WMT(8UI+K+=+{65*$z1&9C(aUY9?k!{~7`MPWQrWT5P`L|`bN8AnvGniwcd3 zNCP(yv8a$@w!Mw}Dq+rVRl-3`aO7T8`0UO?6f?;mX$U8rQr_D*ornb!2|El!71W|H zD%>TlUaSg>3+dTiZ&N+t;zEjk)@|Ce`)bjbDbYt{iq7+vejE4VM=kgRg+_(U!XFT^ zM^mI24TlFr#yTcUq#6ogyufJ)moS0Bq7h~g)&o6NWImM&!+4;Om8I2rAf?WqMV+Nu zoj;2@n;dn{(ds;;)VVKHof%yN%1Iop;M9)^0G+m+3)^U&t|-QLPEcTg*_(j$Y;-`=hVo!$5k z2c5%jcLtr8YSc9z@w@~xQlrk=N zwnkwXDqmaw7Oh#V3hO;|rfalf>qW6!Z`aPWSW9!elICtDO(b5~WJ?A2Oa3ezW85#9DcdF6Y0W4%XfVU%Q%oqjxj`=qE)ZHD+-{=i z4-GDqsR~_{wD^wf(_OZaIy zJ{`eN$v4Vs5$xAsI<;tWiPAsOpgsUrBbw8cy-fW;9ZZFPNEiMgDEwnsz+y#DtMF+F zKTY7%5&X0PpO*5|W_&u5pU%RkW&HG6Ehd&gV)9QE^Ft^m>_v=Es1Jh_+rCj2VrzZf ztR_fgPmAmU^OacGVnt6k;L{R*x(%O>;HT|c5KKpc@J|%PLqUxBbHU5h57lQ&RCKC~ zPNC>0F#E-do_>u_OZaIYJ{`eNZ}}!P>Qa9CJA68lpZ*b_mhsbvzR8V>C6JK(6NOB3 zLav1&`bX*|cCc5@)kE}^b3w!aGS@>ikp_XZZW7KLU5W9JVIYu=Gv#=sjOfQHc+`W* zm2<(bo&sWSz{x;~vgN*hCC5l64_9AB2~PheIkB(K1HC*%QAfdRGown4|BsjFsOzC{?C2D(>X6QxQn%u!4+gn5K&tOUEvEU% zLmFE~Ru>y2-6IBWK|aspBmt4D{iZX*#ffVK4HIqHMo(g9Bn zV8MmXQ}}(eYBTWNw7;cb%-Ga5M^~EY^_b{zo3rGvdrg<219C}XuhHlDHA?r^92k1F zIzw=Iw9GP0BB$z7vRexB)q`j`VVg?%Je|n(69)4YNctkz;SvkA@ZABQYf-GmP~0E8 ztd>GOVmC>eI%%OMC=l{^y68fUs(oIwmR6gt6B({T-D+;)RQp_=OQCvgAGMa@`F5gG zK-x@_LQQ>lpxTIncE~C$RMvL~+KH}gp|-v|;DuG4wop$<9J`Um3pMoJfzZfSs30_v zs~fl2f?kkioVP<%t!<5)igok+BuMS*cdB9Hwb(R`^`%YEZx5zbCviBSo49SR>bQ$_lzTNaXOVv4ndmVnSv4J!-xRgFvCumMdX(td}AJ7 zdEDBGkzq#fFsM^con`~m{6m%_5W}$PCQfrXLbEI=?nC0+EMn3M`>FRB6+k{oD`xs% zTl|Adj>KFnQF@zgHwl7-3ivyjpf~br4YJ+Yl3sPZI%f3uHq}SsyCkvZR>w!FndVBm zTMcyIJXq3UaKKzl%Q^Mbb6xkS!n#Agv7T<)@GC1=6_klpz1V{*Q#L4A-NVvUf)f6 z-L{9^2jzgK=aZS3QPQbHiYTCQrz{hMPIWnZ!oRZUeOW6UV$s7eAc6j;Bu6#sRexg< zgP2-uj!kVRM79Ks1|#g?&*ib!tvXqsf`V)EL9A%RN_gMnpPZu9?G^s^&ancx|M;%UsS|M8o7cWMOxorP<8b)4B7JT_%;EJ4@7bFg; z?27#|vgiNGUtmbXK5`&e?vE)=XfAnak-@KfzSpbQ9>Te^O2S%=MEqniZP~*T-|4%ExEjNk0Dh~r+f5=$i zQ$_x~ui#ojuNAp8Y57#4$dFB5tRXndFv>=lLNz02AhYeQMO2R~=M>C0ilcs7wwzYL zVvl`vLCAPHyRuV@koIz7(#;hBh@9M(LRm@M_g(S>n+kanNJ%#r(EfmD?E8wU*8TQe zQ($jcPiY`D!zt2w$*CKIMQV+-V;UH#%{JPb(KJ$dx&5HcOr~iUR`Y1;b9m-QAp@E> znlTS(UW+=uou|h|iFF<@A43(hd5>|AMPY3Tj^Wv;Ex|DjYI0i%$ME=L#yc!5=6O&~ z249!kjY}WFV49K?W(p*ujWsuB+`xAD?E$5gZ(kni!rWv&$S<4yp{8)z<>}s_* zu8_~tZ4Cr^er7AJ<@tZPG%u!M&dg0v2$ucQoNR3}cv~u;T|=(^0r}gUt|M*&(TYxYj=e>p++!X3UY|sovb$DskNPLGDudJ6LCjB9-7si2-H1dpSreIgqg>*$E|ahS)L7m__H($od1t(XQ25nDle z;Ja~OV9GFxA-GLYjvPib%`v(~?x>ax*`gsC(&Eav5<`9vk%JPJiO@h~GR%oE5M`;v zD1oWcYBO*Ld6gk!K#V5MRJ-JymQuiKJci^dhgd5hCuA(0^7I40x2erQMBUt^FAdYh zM;>()TJjs`i%b!MWi+|gO=3XHu#~2KqV75sN2Wvt5OJJ{CPu#%D+Gp`R~vq!QPPc zx6dr4DMc0*c_Xi+Du+f)f8`W`pF{y^$*gc0YqRUydP_b#v$!%2h!WMb5f;;U4t2=W zi;(Z6H44p6?8~oYX`5Nf3 z)QyEMnJpm9M4p6ba`C4X^bVmR@Ezy?UM$!(EiQDF(L^~o+aMtE#r%ShR?zDuE)9kz z0K{0>jMElb$z6pK5p5ItlL8t#)IZND^v}>~b7<+zVk#54dM)30VHjrh%X^D34AYvP z@cg2fZ5XCJZxq8K`Wb*?-ne?Ym{1!_-g62=$wQI$Y5yq)6f7*RQr|hF(7JImph?On z3o^t$FQd(rmvT#7nixHFcV1OlB<=2k_LIo*njCL=rn%Ha&$e3Gkp`;g8@I~ z{wGuf*+U>RjX#1KKQmW!?2+3y(b+n0Y1V^?d- zxVJh|Nn0~BBSNatmeqW5rY$qJ5x>?}flmFwm>RPWuy%8R)~>8$>;hS9*Muc8C#l^t za;da-&78fS#(i2lk~wjCIG09~WK%e)vUWz5>TUZvTgf{RX{u>Uui6Uxm%&y_!u?lZ zbtkQ-HK$gG-c55$BPOG67`as^Vc4wn2<{77u2ZW;ZcMQUV~m9RL5*XXMo>b6F!5Sm zoN!omW@Zoshi=qz{A@oyFLVqOhnf?SjpotBZG}O!f7DN$#Oo)2A!hwhvfg|#hT_%h zsncw>+RcR49m1_6)=q+!Tl2_C%Z+J3d!xXqRUK|`sf2o3b9>v=A!Y6BX>G`NTCA5% zVmN^OU`)>9eX_CYY0HUq8;f29iBR@T2oXd8&=2&`V`;e#PJrA#HLYxV08@@O=dy!S zAjh`dHfdL`x1g{vfQ@qei%v({OFa#PD2aIiR7e>GS#Tn!lc??co==*znzNq9O^4fA zOu;}99c8v#Bx&c@ugKd5cTgqIm2VIp>!k_S(|+Gg(!N@Rb+k>wcUrMW?pajcPn~L2 zcOsFO52ly8{jSdkC-#|5SpbtH@@PC4Cgi8prW40b+840h?c29c7<7hfW0wt|fqIu} z)22$R1w5(>IVanmr#GmNei$6?b0IG;Y8BheTWda8n7C@ z<^qt$Zj(0Tr4#VeTHq&XJ!tAFqjiSGBLjzVMeilUN8XH2_EWFn2N90~Rv++FFV>MQ z2ozZ|X?LY{F3xOtK6tFpgGj2p}&26N3#VbYf#6$A>NT9-9XJZd5m|V_9z7Zv}0AHci$n z45J_kQilTXN0f02E|Dbvd8)7LZ)tm=Ix?dT%7AydD-z) zu{<}XWJ?Me)+49U(qsMm3$Wf&`^N&(7lfId#R5IO?JRW3f&#=V@DCPp^>};FL}9XI z4OXWxNSz~9u7eaIL!x73X;_Ayf()&M@_Ve9VYV~(PlZ&WN1@DTi>dUYbZ#M0IPo826KqiwaO&W%*Al>OSFRpP9Ss;yBH_3fZ-}Ma=S2Cu!HhrgpAp z%Ch>GrAw9^y+m5FYygJ)g0SheJQ~KNJsUhTFfoj2I9#51KF9B+NpR|LIdmg0;N2Tp zVdjVuJxeg_KFl2^)pZ@2&ehAQ)nMzV*Nx&nwk;EPqSWoAPiJhFBM4Rd-0JeUO?DzC z1t3u^3c`HOCcHx|!ZS$w>t6<)(dcriXhXs>Jub5$FO1!48U{_TI)w8jbH)lwJSKpN zjz5&mU*BP;N8Fq{&1s_PI{j`clbiSjW={+zeXhQ(gf>dWxDNGcC2b5Hfzw8zO-PP# zSS^6Wpp_Uo%yGRO2cOfCw%xzX%-L}a#T?AxAI!mb2a`UI(3$W6Leeg!yX{|=hOMMs z^Wth+qros|wgTqyM!FK2K8%81n$+YvMwZ2Z!&&6)H*%}}(vGAD?q7zm%llC#R*Ut5 zlvbCOBOWJ}W5SWPsX%h6n#D!fbjYKMV1hG9Y>V4+Y5`B_MybTcrp~a>ES4NKK-C9JJ+M5L8;7KzZJ^3J(p?Q z&)L41RDm-3mj!;4I=k80L1eHVwWKdFClS4{liw@ganO#cZr+KRqm*8l_CiR78BrzX z;H?*?HMj1xn@OksCso^lFG*;HXtVKLT+Zjhj*iwGWYr9v>vE{DkF*}SZm-8@Da1-C zgw?0#^O{w5(4xPUjRWg4aX?faNbwL9nx&2){cYOf+FDaoICP+OBfV?ditAn$mXcGT zw8i11TjY=pP8Zv&A~jI(#B#h7t;k+hOu8is>lDme4n88amS0Yl)1Y2&IWdJq_kBnT z1;H&n>RVL^BCk=46BymGI7@q>6UQ-c+R4$va_4fA0)Q+^jslq*#&RsBWDdH+5FkPJ z-m-HWxU>5=ct_`t9$5SKIZ|WbnzI>#oG20Um(&JHBNr4w7AYq+2qt{m)tsC57~mc& z=frR#B@@KXij7;YQp2L-mlL^E7j5~3By#+iUhYxwE`c1^GfR`>a@wX1e)b5M$Q-x# z!h+j0a|wF4ByxL$AW5sOT3U5#V7QovY1z(f6b$?I#n;|vtggV>=QODrS8VyguZ<=P ze9N;_5x1Z9fE#5pKK7?GzVH{ABR5VQ9&(>O>ul2l3fVFzooU#0#yw}7 zK2hL}2hzA5hb}wTr`|kulQABPyX7>zDxH7**3DrZPz_O_epYmE3wh8aC%nD26=$7mk0zIMY69X@zx z+%RDSVc^AVGfx}SLa^mV4cF;ylIz-u-$)tEuG<%H=GOL{%(24d_3!0}lnX5`W2 zp;o}JCfQic^@mJUP(-94A@rhllBrTe-vP~DnUSgr)4Dgv4Qd8^U~fdhKwQ(iV8XEh z2#u07$qMBQZ-9Z-agK7Z2gr_@iEto+ksG@a2k_*q2+%MH+s!QMnG+|Bync=uRl3BOs1dD(zF z77|quZltY%^<*`9+(`W(_8LBS zRm)i7Mj8ZUnzj-{*QE)WXpFc4vz0+waEJ~NH`0hVNMtvP8)-a5L!XG;0@cm6b(z5Ppwhpi=1E)?i zeyc50&+m7dUado?ic`-zlAJTdbh#VJh_u~qY0L3z;2_Z8q&tk$R->A>c*?xV+T3BV zKWpvpoFRsZ7{m0Kq2+I4*uFF`)k@2Uy=RvWsax9fgPIqKG}0ha-)!;Z^2%Oim4=o2 zf%Q_dIV9VP(=dp=L5G)Mx#pG5%<`>q8r8DJvDLg0uMF&dkVbA(RHgu$eFJH-Y1B$^ z_XRb&Jtv&-r<-!xj=iRi)8`sp?6lhUN3jV@MoYDsaayee)V?SH{i2LkE46*Fbu$Kv z41K5N!Xg$EiHNrE;%kzfVhBdd8B@E)KGDn`G?s1Xr*0Ini!_pJu4>@>ZZ%=t%)T^U z^P@zciZ=7842_C$SYvjY%dJL3VZt{nm^Flk>s~J`YnSr|wVCA^hR7Yz&dJPXG~94~ zSHJXTw69Tkr#8*bkrox;h0D@9?JJl`RF*id#&nj#Sc1lu2ffF*)g*1>rZ+aD8KX6m z?wh{>(|JXUM-j-q&J zj8eJPK8n!ilepPYl)Qi~C#lj@vi=53Iu* zQib-4%XEQ2&Lxbu0`dTLXjy=mCEB&yU#-n-SXf(-4n!U1FBDV$%cC#zWCJWVi_t&B ze|c)bO!Fjf0oo+%jJ2fGt z2;ikUKAz9J1j}0S@dOoejtTly!{lJghYCt?W(NVadpQ6@w!|UAPn6k%vq{6T>JmS|i;1LIoULk zq2;a{R-KSK;_N&MOCZeBj0Bu6thr9o7qk6YO$>s@ZZ$hEW;W_LEndsw_IkX@@{W9| zun3Rhrk*>Q+gLa~oc883x@JM3F@EXT?DjLz_HiDGwGj>}N?TPoUGDKag=SMuAarjR zrnF2|r_>v`$YH4><8Ymbcd0FN%35Zk&cmgj9f)sVvfvsIqgmIM; zgH=Dgqks*Z%a)U;Zk1+bqKYE-G}aSip&g0agS^l>Fj+@l&D;(#&-aq7YG$R7VUe!3 z8A1?i28H*2k*;6N%CYNn&^hrViVo|!marp`J4ylw&!XB)2W5zSRj#H{lJq;|sEjMZ z1aS;kF!S*j<7*J>c&{TO1D;>wcjSc;CHsqt1ELjR28<}F);YWw^Ys_j+fjtW+fkkf zL5dI^GUy!%D>Q*f%ZZOg9a$Tx2>E=ogS7#RNWas}PEm;UYLwI=$`;{C<(593xM|a- zTZ{wFcmiLqsAXmGb=SZbZ-Pmaujc}EusbbnzMfX$rfFRtJ1HNoWl*-g{no23j(967 zCuqY-+yRcSO3SR95T9L$=O=Dd&%)g~wboNFV!ITvS5OxygST|7@C9Olp1nhUc7y~JG02uT3b z?PKCr0x|7#S0UF-(RQzdEB$M*i4gEr%y$%08cmxB5*Lb)*0kj^TadFbL-Q&dCpE2L z-q~Qtw1Sz+Ye=_(90sr~(F*3}4o)Ro!MquZV3gLKme=%n>Y7tdl(ymq9CM_eovUGN z3_I6~F`Yy}cVO0JP+;tmcjD5W#3Bk45Q5|g zhY*~RW5+KAN36wj2|1TXz)wi?a|B#}>@-~Za7n}` zQpH-4(Cn@R;W-F_#YVwm<7x{|AJpgoIdv@4wtz-nqmOq;OeFxY*LUyA8p^`-GRlnW z7R;{^n|I#gzIKwbv6~t&wXnsHbfya7yrAmTYBhZi`=-x|8WD!W89Ib-i(B;=WJ~^3 z9!XkGM7Df-4yx(l|``L zbU66@*&^6CkjZ;h5%v6^B3|hL@qNaZbb{a&S2V&ebwGL1bXgI~Hn7g? zfVoMwM83EPheieeSwzi&*RK`9WbjyhGVZoKnjMumEstat_hcS1`#)PdLhKsO$bsOp z;Xpw4;=~iV4q#59o}Eh?Ya`#C2ZWJdRK(cGZ|#H_BmZI%mbUu&B5Z8+t3}W>l)U#7 zJXGvSTm4EgY2Sc-;ONF8OE&*JzldpT{!Isnt@+YUP-e|v?trp2UtWYVYrdibCaif| z5f;|`og!+i`MM$~toimlnpyLfJd#=SQxXZP%VFi1?aRpX7zk$9(wHD0(HoIN=Uc@9 z1-b3-_#1+B^a=fjnQS4VuRSqyK_b_v5Hnvwa_k-}vNEwr0+YyP*~GvaG*gGSbw4RZ zZl?NcF5=rUz+H2*Ps5yUC+K)x4J7es)+z@7plL3bHOqM<>+esTWoItxb%u>-6^Tg~ zWCV5Qy+gaY#hYD#eUQI2wN+-`at5n`PXQGXpo#GSsT(F4XqL!;;f^xA<)&}CGmG6g zz&Bu$pyu{_{DPHiGwt%_V>0aux%D)8NHspeP;q;1U7>KHUJaQAp|DxbQash zE&y@cG2VWODwWoqMuTvn7hiU27WHvJCtKhne{e?+EF`K<7Sl43E6M2k_@W1V5YTs% z0sR3>6JXd6v;8K5If)4Deod>$?1p7@qaqWkAke7Dga!yPDl$RPIN1NPM?f7`Jp$#K zjac*q=D5G`-S8cTY@boYBjeP|#u^a>iBqqxzuX`%NC&$9c!LZy1Kr%{CR{=4WnXX* zv2`HpZ#Zlc?|TEiMZ?jiC#3XVJ<^}e5Ft@u2XBi8wrP`a2x_NWDRwwau%u5ayFqy?V3FyOCz} zO{!jC=tjV#D##}Dq#D9OsD>Lu??&YsM@}Gna-&=z*W5bXHB^Ox5>uIB0pRT1j`8w9 z#)E!*G}w%O8u4mP^8dy{GRRN*DI#qKEWnx`j6Za(fzcx%EoU%hbCycL8)ODJ$|LWV z;WV&oV{R2S!!W|NBlW@6P5>0S+#S-3t_NkCnEPaeeLb7_Uu?bp z>hnbhgUn#Z0!`v8`7~ZNixm7Uk2R~ylc?qKJt=$ga5l$3w}2#Mw$~K}iQ=V49f_h` zlTQ`9k-mW8%LR~jT5iXS2BRgv+UfON(@KZb`TdFMuRzEr9C`u=#A&hRc%_{d_hE+bYX&Gc4Jv z1_m$CCuegF3ZQR_wzUOdoLzZitBf$d642Itti8`wITgg&>t^TV5jTRsBfl-MvxvgS z47f!f?ueSe@gp7ZIEmW)!rnt2-~o@nxwfka#;(Zw(GGZ)cy|$m>*2{9>_&qLEA z@@ZHF-@W>LIe>UUHMSk+-h9H$ah_K|5`9Be(jAfdKTYi+Urzx!*q%IdfM8f?f*jy-vfhMVyDIC7j1e9aoK+Q8t|X|1-S118of zJ3GK|&3a!gV$Z)f&jAgZU9tbuuUU=P2DFiVt^WQFs21$*4pRlb+ zpk8kVytnjVCw#!?RsFpk&=9^2&kpmR4!BU+t`2ZAC|Y!T2L@ZG4_O@9Z2@rp$oQ85 za|{~*o{N0^pwHnU#dOU9KM`*=*2`oE#OOWSyJIAp$vTDsJa~B@0de~^B7TrK z{f^f}@E2yFah+N}(!|jP*QxtK+z#;$0Vw)O$=`rYQlOf-z3Vh#7#c$ItAe@LsgXG5 z1Ow3O$Y_=fNUI_7K07tMo&aTuBQwApA<^8einL>^NHt4FpvKJvspig8x3>=W3PP^t zvQf9U9h3NGtaGc5Uv=SaL*V_B5Ukn%Q1loQxG+%cA(RyT;v{$NgkFt z1thNtO}VuosRdM~I6vmrj%_pb4UquQ_DpHjjv6YBF=@z1#G9ohqdl zXLf+x>yQj$)eB^ddw~jeirO~4UN}nuwr~UmqKWsqt+;_s8_18y9N_RPTy+hAI3MOhG&u=^X5cpv zGXZbcHxBm=k(KWn6Bm~h0^M}(U)l+z=|3Z(tYRj(>iU7>laZQ>ob`P(ApUbQg8=Tq z0qT-0(&oY^lM)B1|J$OvG*p<#tLq1F855)zLl$3Q1ynQOx_+?SB^Uc=O8}UK0;@T4 z;`%|>HsXkv>*H6B+SGsk+sXuXIw2DiC;{%6+Qb|zbm6oynY9>_T|Wqy6YH&3uDE#( zXZs*)@f`%$58{yef!Ra=BDoNA5iii#ub7Wm0C9+hZ?kLQ`auHGU?|BPy#i`gJC_$M z*%F8a1Gm`_0B*MxCZuJv>jQM{c3!tL!S~(W2wxqC%uW^V#SapU`~v+UI~iPZ0OZGQ zGM8-jydaOZ@6j-GuVfx%KWf5&ZV*C=?T~u5%o?uB!6W!k<~<@CoT$R!hsYKoJbb+i ziISF^*2s@a!e`Zx-z>9TY)yGFEv9g zUzW^4&~p5t$mPnuB(cGymuGxt1J`X=o32A+&})JjmZDrAbMzjz-XhZCUcoyMw3{`0 z84u(UljK3|Ki_7Y>R`Ryq$!5E+dlRhPH&W`=O3LTx(863Q46VN7R4_|1FH!I$6lk_ z*Q_Dc%))@$kqEP4$iRrjcXR;JIPlnOz&EUcX!;bqzu0Ud(M+6x=#%_rQ~+XtjK)lm zMvTS}#9jk!778*;gxG7KK>*b(dVm^m`Bt`J6x5N|OfG?UAVQ+C`q*n6+xAEVW2*Y4 zbtudJp@yu{HJ@{YhqxrvJnq zgu$zQ$Zkf)*lP^JOPe5tnScSc9)AR>X2ghx;uO}B7zQ)l3djT5H_U|n4aI5pIV)jo zLopojiD^GcH0)3eq00nw7X~{Nr*$}~jC9ciLvh;7=)y#Y;BHO6`$P0QWY^cfik>qR zr!9R1gv%m;EmQa>qU$id=)*%Xd|Mc0GE)|&(uSy6!UNfSzS_(_ zfbKhf5I0?ZH{3)I0Bg932O}rv3P9}o zHC)Poip`o1p`g0lrH&~MlR^Kc3r;bKnc)Kh;W2(8$Akm`fMWO_N)w|20PZEL>+klN zr7=K|rWMm^1hYN{1QKb)ERq4qrczKHvup(ju8l>qnMeS+>BR}ZB48F`05n{jgu^lu zlbPi_qj1RG3&B zkj=dlAI#=GK!?}>zdvl^a0GbNs%FUqWC*h^MOn?F6zDivfGU_NA&}ddQp|D;=&_r1 zKd}U4gg36lDv*IH-!LO4&lJ^tQLPoRz zVkH7dz3Q`MA}E0X2L3=TB4&p`=F0B2hu1n>pOArKl?AErrbT^Cw^+ylR<}SAzy%Oa z1GqkK#)=gVW7Pptg$O4BQtgA)ElB@hPDq1@AQ2>qFcgDnL{tfo)^eShh(ZAnwKO1t zgaF`mshE{mO96mk2@p%HNr2vl!;8xi5o-ZJ;vtGNK_an;1_(yMEJG241+3cF;_F;Q z6bgX4LB!e;kZPa)ih_t#08lrGSf~QhG>BNy0n*N931S@%K*LR7LH??K=@L1Ay)!!Q4bx43LJKw0Wozu{1#9 zp;%vpAOi1zG~A@YX+&@xkl5rVqGycgG$Qy52;8uwMG&DI4e3;3r43N*CZUGJdKDlT zJ@xP@mbn_z=gGv50YKpAxl$sa&PbF=C<5vkrsWVjI)H(iqM*%}|A`GOJWXnE|Ofp?3RXzlafi+(v{y0ilUI-0Q55p^EswVSqkRgE0`TUBvng3w{+N z>qBCvz_7?~3W;zTFkpZoF<0J*P$0l<5CF>-fg}K0%YAlLr`zkYHe57LudZ*k5!gWv z;9^BSUUP;Gx3eXe_?{{h1$4eN{gZYQT)i=LmJP*2F$15n0q9TiaQCNe7v7ck#zy#mvd zz``cF)CS?h6MVJ#Wj2yc&@Q*>PL&TbU18JX{CNEp8#iC)xY7pNh|o&%t2Pu5I3a&h z>Z%S1pQaIKd7$so2jH->U&|$O6WI67=IdWC!1OLl#_$cB!3#n<8~n`z9b#?J1HNS= zIKOkjSlWEv@EV%|uC$WywKmM(xo-to`s-{4xXYH_zK01QjfLN~S&nVH(U8pI`aB*a zj<&iRY|O92DXe~te#b_^(jLs9n`{VgO4Y9X zzibSri!{amo{hll*Xh%5xPRXUV>cOel7!Z+Kd`Z;1>S6fbqoBV4K`%1KeDl=1&Z(b zgYDKW@YY;PFBZbymIH0{b{nnR=p8mnpO7d#30v@+}_0nZ~0i@$V=udXoAar*+A!e>3-D$Hl1NaV3TB`=Za*x!z z%jR%lCxcxR7P7k|o;2a=Qe@cEi2F1qr9`#U5 zk9T4~zr<$##C{lH*I9p{<;hMwGz?%NPuX}C<~EiTzv#purFeQj4EomiXFB0_@b;HB z3!HF-PZn@rc{YcJL9>b0f))5xCsYqG&)Hx?8+0(RK5rwqNFcL%!AAP=n~UVoU$miC z788BR2Ef=_ZcE(p_Oi_Y{my3iwaw5v*6a?wQh-F%<~Icp46O#iU##b=o$<)6y86Y~ z-xgT>AiHGjcLfmU^KOz2a`j@dxl{N9El`jAcr zziGqE-67rFf3OiRfE5L_24?%;9Z|jP{bLR#9pHotQ;SP^U}V)e$UTsKJ4jr=BblO> z;E`{H!+wj`h@3?FHE~E67+{x>w^ugX8-*AjWN1qs!n05)`KdNUQ8i9>S`MRrz@U7S zekg{ky>PY4sC*}VC}x{v>H=bbo_^iy_$ z6l~;_pUz>h%M$B4o^69+j2m#vP;uwvFmOBwoNEJZA3ytt(0Milo*)W(+i`+BCCGBV z%>uq4&mwPq08NBV{aU`fgk&gA6PJp;z|IpETQpqK*&XOr7uqcSEs^U*HU?h+76a|) zY!q$8*9!c+4U%^bp`&A|U$9~NC~2L1(-&{1O0Puef42P$WYYlHes(jTQ#fm3Zo-jNzGU<(v zPLlzNlL`e6a!q1q-r{h^H)0_&Vs0_C$Hzzv8Hl$ynq%W9tQp=oO1cuq87wY;bb8I$ z_z75;IM0DR&9U*-oZRS#ATMl9j{YmA>I{t|me0`(Ph6HI%!|~TT7BFINh|hsQIhIf zgXNWq>JCqs9vfdZ(Yes^(dlK9Azv^`m9#ybfjG{9rNh-TCoZdxt(j(Rz{P`XEp}kKRo+{ST-CQ%&~+DqIDt@1i#y5D=@^m@Y_=Th~RKJ_tw)uZW}G zX?h_d@HR~7@GU5&7XpUo^kJfGx*3pduV%U#V5nwHBNgcHPk{g!Cn%NZi?)(#^mA@b zD$}=Iu~ev^bGK5Ze%cEkn(GUA|3K;#q8Kcub7ug z^;5mhG;S?Q{M5QfUaH$~Hlh%2rK93yCnhNCrk3_NRTi|cR7fDWH>{GSLc|if8`IJt z0$$j^6nv4secRHb;b=wKtz?!q4ToW{6e<|>c8;Z0jW3fzSo$>_LI_LOhQkO^)VLR7 zA(^+9W-hW2H+vg@9!ZX@BF3X@+^@mLdZdr$8NW`GC4Y^W$C*(^fTNQ%$;+pVrW>Q< zYo}<=ZR|p)bf$UQZyK1OXnMbpw+d!oI?uc`-YREgWKyH1$#k|Ymc?jMBmU@y>EkBW zp&{ne#S<$}5Oc+j@Vdzfs%Al?@rmiNRU6$CM|s6!7*Z!m>ot8|ZJW8s835X9(WlA8 zi|GJz00uvU(QI=67SSo-p;x-e*XEMr8(nGUZN<8$--DM{!PlA|-jA;{0L?TZyx_&- zx#`mV+4hg=%KdIYqm5}}ym=1uGu^gd9~UtFv_Br;{%^Wwf861ckbZdm9rH6iupdsP zAkFl-ewQ!SGrg=oa?O`zjZyT&$0+p2Ma(R%f544&t<5B@zv;XDjWRRVKv@(7FwN~X ze0|Q|D6%(N4llNVc8wyvh9B~!Kt^q$6SerVC1Zh}A6990B+7}C$fL@eWsT=Is}w31 zM^wFr&qQ(f$E!v@ElGqydF^VGoUt$^Z;-d_#q9{*pySh4nYazj8`L}a!qmK$GpIiz zA}^)$+DZK=REYcpP!Q_byU|_HthPz0u58X3Wc4(f3$hv+#RY!ARX2(Y{AR@G!j0nK zTVA9Np}3%4<6H2B;(8B9sZGb}J(4I!;@%I?n>xqv5yI|adyZG~!ti^K{D4-@W+Q3u;>Aa5 z^=uL3B}W{t6?Cc~FI{%H*7|9JeB|NqA1dK=Nrn=Myj75oUb0wAa)ux;hCG=4Oi4!x zDVtA9x+wK5L0=;B`IMv!{!a_~5rY40Nf-R*2>MdNf3Bf>`W7S8#k{KHvs*H~Y_O{R zwrNJU+83bqOxFMsjZDVSfJPqH6bm%=k;1V2px)%m6NP0Z=FTf&S&)O?8xy7lAX$BY9;ffP^%^;PZ%3t&2nwnN`hZ`k(Cwk zsO}k?7>9|3X^@G@vDML5;K<)ji`p zM(sl4>5+-`)2e&Maa@lA4C{mL8S6U2qmz>^T>#WQ8EVh| zIOy7l?ip|0AIHQb*xwTgHOUIA`cq@8$A{Md{+n^-@oN?>mD*N%a z#@3E5@`uMKrm#F!I(>F&{LC3PnABc)UKkLaCp;npx!Vim9QI z;f=c1Uz=6p3Mr`2{I#m|H@}^u=C8#%LR-umQ8!_Ij0l(k=Uuwl&SBp1tJIHX*#(mA zt_2HLrJu|~)5TIak52NDlAp0Nw-U@>GdjFZsek;ftee&jVx{~3l6K~8Tsm=rdSDh- za^vE|51%+e?c}GW__PEh{2+6E?87;{Umnetascn8+*qV=pDn8lj^&( z`0nHyjQI)_f=AEQIeE?)N zZ{6hB__R9v0GNNw8&l^H6j;$KY1n7?exi0qtpKSwW@T{%+mZRrCxd8f#e*i$F3dTz`w?U31pf-IXX41 zO2{~If-13S7taK6-lV#CX7ljO>5ok{p*c$z9aNf+rj6OoTRS{;g1Y!1NWt=hOY+85 z>5~Vd9f1oJ2?SH`=&FgyQB``qJ7b(TJaW8xqg&(#a~Fuz;rO=*|Ef|?Y5pput}=#o z=wTzn)5BiSvuMTG>ZPjWVzWL59c7%ls;S^QRR=fAf|!((=;b~rQ&JVzsSocb0cdYU zmSEnbTG^3t#m4DTRT|6~L8jvmIna`6NTdXQJ&=r*w6C2vrjEB1Gd=>Ap-NA8mFAy3 zF+Mt_)YpGKN6jA}UOURoKe1}n)aW$TWB%9_>=oezc;1+L2L1oMlhrd_|6r_WH5_*+ zZJAM;zk)nGt7-M<^b%D%OVTITkK=@)5#T#8r6;;d^QP33U0_Z+)x_k)1ln&rv3_#p zs48`r<`aEX%gse!TS7ld zJpw(R<|(T5!i>`Vl@lYQ#5{kT|K(nIO`> z2_DAOUHEX>HDxuod}5bcuzrcU5t+YtOTcxw9gw=; ze6XVY6T1{h`>h#02XC*aeHrjCHt@f$Eh|cKJOkHKiX$^%gAIfku+;`m$bbuMU~2|^ ziGh2ljPo<#s|-9qz%~G^Hh?Lg+N>VzqDI&>6B}XEOlX9wt}UyDTQA!ZS@ZZl4K*LkkEnn<0D{9&vhq2lB6n=e1+w>!(MVvK1&ir6-;*0tMv1 z6Xn0=`m&n49h9?XVx@X)CXAQI+z3tbk?j@rI5)}dGkd1DSJWB=KC!)`o@3ySnLS_J zUQz3BEUTWcY_F*QfFIXxuc&k3$A4|Fs4Fnd9osAFO-}R3%NNFDHr9Ql*L|qh$8RjFg=>a4!XjJk zL)9+3NvoQk)dCpUx8OwR_?yaV!3wo`78v@Lo62hLU!T;a4h6-WHmm*52g0(Id==WB zgDX9j;B@s%w!m{|p#`2h3oP)bHMAZTt2TE9anpB z#HRG{{1QFSeaA^%Y5};fZ=eh(gAD5?M^}w)P~Si)&H>8Q`c;PV`mJR(ci)CCwP2&V z9aEik8;lxn+t{TRtX216vg?p^G?1p$9wa@6q>lsXxJmVEOnJcVkaCJ?uOsbXq-_P- z@QNvJug{fX+UWX)??6@9U(Y_7y3m(qVSl{|5bUp) zFz~}!*kA9tqfGtv=kNpi>#Ohs`s<%C&Eg#u^;=GJ->ja#9Tj!JkIU-4;f{(@hkSHL zMJ@VqS#^)@sHpe;TbF`<{AkxiOo5inp3^_)f0a0jE&KUX>MFb0=5q9Lf(W_V=ey#dcA} zt^x!LI?4c0(D&_v?$iZ+q*FoLbwR&{?6j-+*Yy+Aqv{NGO*grRC(EUUQ%XHq2LCem zC%X63vqC@rR2f{{;-8e&+>=h}QVYh^(`Yv5-c?o$R;s7VuyDEIuCkhY5x^&n!8Ged zWO)#%Hv{!}^%_#1z6-Rdr9syy9amJZ9&yAGN2@c{&e^4Hf2EXq8#>6hfqyLhl>Fn{ zK%T#Y2b^0d^)^^cIX~6HBhD7S7`nl+KP_jD>|h|A1q2v24+b}OF+8E$dOLvMfJgFL zZ;xJ{qy7_~!D%6S7d+vR`5s_?1RlXf;nOql1Re^X-u!7<&3*ioE_En4j6;E)yV|J+rCtCOs?g>%Vtp zVB#pVsIIxYtQJm< z{;N{oDZz^7VR#-HT{Arl6cFzzli9?&(Q$RQ`j^tSw<)FGQCf&YhN$C5MRnf~4Z_;jQP7d$=}~pQ`Voux z!mQFloaU$(aGrDU{bjWX9Y*N|9D>y%@)xBSaGIkQfxFPy0v$blaTdfR-+6yoE#O$+ z%NQH{`}@nP`_!EkwT?x5aaPa8J1gq&`^&25t2-;|==;m+kb8GlR4@G4y|bd0Lz3U^ ztf*5t$>prFYNWQ&A%<|C6(O-o2-yE_kr4dJf%F zQJ2Gy!}nCw4e;Zi_Egl(@T0b;qV9UItPW}Isi>Xsqkm6D{Q-Wg+*46=x0lr+YxY#s zySIahLIIn(fM;hP1_e;=J=@C)GyNd^fJ|LT37LlQ12SC)KOoaB@B=cv05cukQBhyu zOrM|K1C#elAQzawUjwW#f4?PT{XVn)hFG7~tgma<19pI@kn2;-`X;d+x}!|1f)DKA z$#ZYU`UhrxidYlPx>B>Q2UcmN&d7-RoZ8DK`k8L*F`wy%9&_Oi8h$?04efmM4&APV zDjH}$+YNo@z8$dogg$gZH%x%{?kKCd^FGm~7EF(-OOWMBC>f_^OFu#V=YsCT{=B^c zvp^W3{)wrVcOM2L6b(-v6Q3>}2E!BlM?Fk#RjeMJR-aenrEQScM@tLWDD_e3*Dq!g zL~}Q=o4KE_&$Ev_f9!Tsl#rAzuotoa*+C$Pjo35{i;eUNEX6js4u9cRL*KF zXEl_wFDqv?cBc*^u9=uPVf{MwMYU@tCBLwQ=`Son1_$iK8QV&wF2rGb;m)$sz5(}0 zgm1v@6Gc&JRU&@1XmotUJW#Z~bRq7ls0C{#)DJM#|K3?v3yvF8H{(;Vv#jQ>geJlz z@nxk)Uzwwh+gVm>?(slftA2!h{|c$rjIHHa$SKJ2@4zu}g4%&)oB=GO?7ntjs?Q(^ zW9MoIR_aSg0YT~cYJ4VHDVrORf||V)gA3sr5Nh>vO2qr$LSA z=bl5E)Z9;j*e8#v-{A90kp0}xG3`yH{RwE@C-14KOW06eDD`}KPesk%1-3!PhZ|mM zoBH#CRO$s?xNN)tHz3}+3nNui(+TbcstdZHgS>6GZen_#zdLJUN@kk)0t&9^CMJGv zV*NmBD_zh9Ydy6Hw$S+Zg3)oDQtrlLm+US>Kb`h)17;7h*MT-QJtAqxGA*E8o6n&L z{{qC3scDP24Tvy_Q4b>1WB3d+JbHcwpTQGsM+yF$o?#P3?Lf*~_P}rp1Q@M%A?<$= zZN!HF)MqT<6X}<2rW+_?Dl5P~6c<=VA_O z5$&ZC1KGm4Gte#;jE}BXpT*z5d2iGRei&l(W8+im>-fAB zo~K4vPN^I5`9lwvRrj~|RMh>f(l5{Gxnoa79rJKm9d_@Yic&pK?5U_vJX}^i&+nrKc4 z@|yW*Sz%u9epKgm*e3GpH&I?ak6L;CpGP^bZSVu~dKj{Ryq<<1AlIKEFWD4mQJ1Li z9Zc5o5H-X@*bv>1Y3q1s23R3j$KgsmEQSYYGC-EV12xIS3F>F~^P-=bFw9xF-*5*| zCe_23;R8P_tGOTD)TI_251s3AY=uXE2JZP&KwUdAuAW8WFCiHm%~3Dm^B>?D(!7d~ zm7hbJ-$NQ8{t=0P3q)+szu8QBdxG@#-k+DLCHvq9wB#q?2WafuKj)VG0sH`s?a6X+ zIG0~hE>A)lu!n;mXT8Vp19G|Pan9v-_yM{6{BhleYdM!cQ7+FtZnfd3p5VN`4?iHU zC!gTFUW6Zz*X$>CUKem)FH>G`dy?z*argoCx)gpuE<2y(Tz(EeAeT3@Tz<^C{FZW= z`IIHm(ND2N>);3Eb@@}A*SFvYOF?fP*%IF!t&~``MurEh@aOeM`tmeMH83OAY4_80LyuSSl*a6$PSlxz? zx69!Dll;;pQ`_^9qi*5@F%_in)e=lw|OdKxOy{a1S{>Yule&3t!e&-}d= z_190A)gcS_R@A$IrTc?>D=J`)2WIxfdn@YDr^}S`V_Ui~BKN5SG38>N@`I34b*FnP zY8@xtHS>^D_EwY&2$pG}lzP^TRN4plyLZ$(|EK2qA&bLHNO8hKjlsRuhD_iJFKiSxqoj(UHNob9kypLEU+HmTT#~m`>*y^)b-3>?@F^|H0N2|ky|l2dZKy^DKSvSrXb|} z3nW}ag!R)a)w4)=9SEZvreS9K5>7jp{Hm-L;Gp_4a$E<`RLmbsaL(loAWUyi7k3@` z${aQF9L%xQNq_&lIqI*U2g^{Gl#<`gQGW*y(;KG8){ai8oh88E4V&a%>IS6#$Ma=1_n&|`rfx;bCxK7R9VFVHkajU}T?Leh6V#uv{l5wt zS)tD8f+G&sQkwq;jxn_jr&Hg9G>cE`QVYh_m(WZe1Iikt9Hp-8f^Pa6CLB+t2kNo%_{*%bO)oGO9H+Z zVem80Fnn1_xRu|(!2SRCjMhckgI@%FVBT|1r;>kA>H)X#AwUo~gn^v|9P?sXp(ko* z93N(mJ;ZUU<~S$g7-WuzOPKWT3|Pm&W0dq6o%EHA<4opwoH*Y75{%>ECNE{+7XOtmsxpc_U4^`A12!JYo&cLQFp~^WgvnpR_RH}0E z%c#oUhbpRjE2;9#uESP<<38+o_*wu$e zRh{|w&V&h*gb8kU(Hg%)8%G~Pf-dWB?X$%M9$`sBO{kXLE!@o9B)81m8Sl(M5`E}s z`3PWzHn_>-Vv7n^L|PQO)e4&+p-O|+#b-;#+AUSPuqz}1311*KWaJH?-7drTPk{hIh~3Ig)fiy`CvZ7>s-5lCg%8wGt}=5aHx+l>J0T+lm+keeLi@a;X^L}u09|9dcXtz?miz3 z*0tib zJou8T)Xf@mfgXj;utgECsR5TVC8(PK1JwVz2WguXZbTG>!-MigH9$Mi`As$8qE{8a z4AZTkfi3XoNy0$8Tba_TM{z$WK)V}XhWRHgBZBailhR1L*g+>I9_&InDD7^tSh~zn zz;(0@Zd}g##z}k-nI>!?wh$I^b?Zga_v}dz6uh&NSFAP@%TuTD;rx*#zDmRnA|6Ac z4m;>$|AkW?D9~5o{t7ML1ieJ;IVFZ4@BtP3ut=}ogH%3_WqhjPo8&zr!51DVX~y#V zRQ_u$Hw2LITO!cC@kDIgb6{@lNmT8fPX~*a_~!MY)>i;Y7LsX)KsJ8@Dh|L8x=1u_)cLJ zoo-t7eU?;+`8B&U!cSo{Qf^*e`h z`PmCE!|%s)C%4qMllo6>^)Z0<96UQXg8ExQX{UXCAoj@5G)<(Ci92z_6?TXt^vZ{V zdspLUl5lbZ>Am-i2MYcP$@qCdU);}-vo&Y9|35>zI?v#Xrl28>a}%k!`z&*ABF=A~ z#U8Z`8QIb+#CGYd2MS(6vSn!-S^DxhmfuG5_2$ zxj#Ie4_htKonoEYi|f#P*0_K?r?u$UM?B8u=eICUDW;TWwSOqp9xbKU6h0GSCoGg{oDv04a0%?Q5f4mx zlnWEpfX1SZ4G|ApdG2D^{IUKpw2{@g&Z44kaimcpj;r6L2al^w_m+`fD{luWo~O z#;WjqBkCC)bqfhIVQ95lsDY?S#U_fwiO4%5dBbY+!)ho5_;wk+w13YCvxjxVq9;f9 z@A(7M@#W*NXxT)%?HyOp9MwpuW(%FLWcgWIy=l=nQ&p-NXd)&KU`Eu`Lqy=5RjESB zI1$U7grO1ak>!xUb47VZqA?MR69?zER*S~9aJ^;{(JR<$0`Z6>RWdxZ&d=AXh(+O0>k?W_GI692YeB;%a%&wF^bL8OvfYVe&L~w;p2-ceZ6cn^dv$t`9w{=$X09!AK4_89GWaN;%3fynt5+o z89sty1im)J2@Yc&)-{<4D_hviUgx;g`dB2Ch-tyh7ct&PN0;k zi_B&YYNpAR?Wq+{CX>nU3BROxU1SEE5o{NZzjR?_baa#}2v1#SYU+Py_fa-xYoW`o zu|Fh#^v1rxTSV0^Cc5 z%IS|I4Xe#*IBKRpR*%ODMGcZTM^>c=Oegsm_mV0-6w)2+-OIl&Vik`@Qjy&7`N!N$ zxrvcqJDz*{kF1?q7ZJNZS@G#H_5?pU9?%WdZ26X0;`vrN;LJS>jfJNXESpOx+N4rT zpy=_BGY|=DjRK*#@sBOylIfg8NLLNm*q<+ZB~mMEzD*>yjU@Vh!4{4k0NL4aSZ&6k zD1J;z^H#^u7T4lt6r!`un5HeRNSLO)K9MaTd8QF0PFEhrieF!4&ER!!+RoSMoX!VD zK%t1ySgE$)9uvIeW#S*jEiyQf;NT#SB~RH{9u-e4peZxZq#Afz&ToXC*@rAkw0ePU z1ibEUzHA8FIh&bZSAqBFupAEe7)Zneb0Yz~45(CGK+`c`=@dgzue)=sSSS)uLqc%V z@-c#h)))c2_otih?zy|e(u;FDIFUOuT(1R#T98*Az3xXI6RM`Xfp-L9#CQqM11i3N zRm|`q5jPG{*?-h!PYu_#(xRHzy@)k+*qWjtHICa@7eov`5RO$c&zWv0c7uKIP9S2$ zwdOcXQc@o1J}qvwd4J8d+`A)1k1PZj$AwZY9F4bB#G6Yi@m4A2Ek((K(Nt2G6RKAO ziyO^I!U&=)57CqZiUMw_8Rrck33KJp0X&DUFN7z+t!yk^7A*sKOPM&7FQ-=CQa(7H z4*;J2>kHvY7$=#!oJ?KfJ{9nIZzzQC!vx86KzYR0bbvQ*2} zdU@wvG6Q~*f)(&3WuqcJjM;jnhgn52Lo4BLEXgjXq;%VoOwS%=eii1$GV2H@i`g`B zcDoHzX34i-!R<6@a(uNzw##XIjN^A^+QzuoK&~Thhv}<}bHiB+H(MGGI5o(+%#+m> zz*~8O{KPreDtcz(|MEbA_2V7gBw^?{8#6T#Z@3R8P59UYo6d;7(sxaLh2*}m2wO0pBqhOqCj%MpjUsQxthw#T_OnIE8Wtt!B{N((U!|JYUd|X2#Yq z+u#%_zgOsr2ApNfq6yq-3WAmkwV}vTu+IH&Q)n7s8*LxBkw@*@$So)per+SqprrmD zI7q&|amfQE(K6UUrMI!v46jk47Ynggc#~v4#8Q1Z{3l@_Q)wFPr_!G)22YTZ)uSFL_+K3wPJF# zS41&Y!6@pB3gJ2i4!QiRiVETHlw9zyD=LI}_@kq!5L9H%a9%TH*Q<^gGiobl&xV{c zib(%?k^b|PepAV%&1~n%@z<1GY&vD2oF`|Y;Fh(t!)(}vJE`8xVo9Z&0;4K_%}N_>2k4zX+|2=xK^bbB%Ivgz8nW@812g7h>L&glwmV2 z>?M_Sb@6FrraO}?{;AZFOtQEVcrcUvx1{7;1{t3?!s%=gEEkRigzemP z0B1nTtyE;hjNmj2%utEoJr+2ck;G6WP)|W+Cag(kperNVW)bSi46-VQ&zUKUiAr*% zM-vlS`BDZ|q$I<`n8-(Q2Ct}!do!rhDVEH}CN3}T$&xi{_YbthH8C|dkP#H-&SDXf zWTqpHMTE5{LrXMnTH~+rd1?KpK{sP~nI{|+qp0=2#4$h`iy8=M(fC8E(Wv34`=Tv^ zGxul#D6kUjZxUByWU3tVPmKjs!_ds8NMvygCY4_O&P*qN-sLp$_Y@8Vz3xZ&Zqs+k zlVZi;iRDHlrkQ5MycQ26YhI=>egn=nmZ%{;h@+vy&e2dd-g%lC)?>5_)9c=GRrZ<9 zI#ogURXM98amoC_RhcX3LlV61BTiP>;TUV#Y2tgmrZxtyB~y(7$hQKwMN8+YjoQNz zGbnmua(q^%Dm4^}1Rm7Xpyp_m*;#c1+wH7~=@gB?%<;;Ph_km2n5EH?Qpyi9`Ts%9evA=M?7tY)hdVRWq` zq{d>JNO@28fGI21B>04^+N#v%n)>hJY-DXz6=}JQf0!4&RoJaY)xvgOR<(7y(SqER zmx)(op+JbwWp^t_>q0feQy0OXcs+2JcodyGfe)>0EfN`7hF$f#7wr^Mo4$4pQkD9W zD%zCmbuT(3DS?U0U09M;t zrw&?6d&@2NYW2-P%b=C^)?U5WYioP8trijjFNB1U9Nqu{A_OD^!jLeBK|m$U^B{u? z5siY(2#8|!|9sXt=N%GI^xpgLy}#${BYF2)d+oLNUVC19?R7e9K4mCN;XhKWZlNIG zQle7@pcS-*D5!{-1NhaL{rJ_n_09OrQ>?CY1K;UGeYj6w%H)B+rhfeE$EXiK86xV( zA(}?ipQq7Aq5+DAC|1HXU$N?f)I$}k6f+pMvcndqq#6=XG)%EdKzt++Qmh666H+|z z50t48h+ratNR$&8u2`iZ)o{f>c@(LJD{lXo7idpe-2P6=Qb2e8Cgms^p;&zlDMl#H zd=7*o6sJc5>6FFkKSGKTif_Az`Y0+;tZqb#0>yoQg%kyfr$Kz#64}keb?Zi1+^shf z7bw2t$8O?(-$E|szyCXB@xPBDmm-fw5%pCxQn7m0lhL#9X+|(?g)M$hYch=r2{xG@ znJ)Gt^RnsDUN-Z6jzoEluhHjFIQ;6#%nDn5!WP%lNzKR-HYc?v)3j41++?0MUG!-) z#^E+jdFORb`C%1 zv?f!xr#MlI^_{w#@8;Gv~yY@Y}q}Xe|%2cs3!y+07%}b zZ_yL&$73*C^f%0S%o}Et8JkG*xyYZe;mBsVvE49oL>{PvX%Cd}2(!|3(2^jZ7D@|_ zRGd%w==S+2eLpF^ZrA5Z`%ph2UP~Vm8h)hWwX_z4V=ajLyTo-MK5bHeMTLsh574iQ zyiPpI3lu9>>4-w0J9^J(#i|1^P9R%RiDH!j3<5U;gCRS>?~Jvqu*Cyrn<@61!C}j; z$Dh){XvsXqb+nGC53i$Lnr=4^;v?E@69MH#`XB}LoprR1`~d96L1By6(P0Wm=XBu1 zbdnP7y1`M3le9~Vr8uJ5dQ6FI-PSFqfMJVm{Y5V_Gi>pT`b<5=E=N(14hmcL8Du$A zzr-z&m-ug-V$Y1H{2S*RE;0`>l04tABUlBFl`*mdHw@p(V1xfL!CtDWbc! z`dle7=FJer2r5MO*OKhMVGBLdF3m;DxkP=!R!-RJ8@5~`i~x*_a*t>+y-8-jFyzc{ z(oqW7Mh~hE&0-bVrfxcAN?R|rJss4eENn(iN^ND#$=$#TQNJ9S{qWG28n_BDkrNO+Z z^}f~=;6Ip3g6&NuQ+-7e4N>g#r1hk!6@v|{YrvM z{KWzKwFIw>-5F>MP!?}(cc7gxI?yf@Wi%#fN)lv|v_DC=^Bm^$lV0(}yfJxKvb!4W zO8z+6TO>YC{=`G)rwmJRD5MDQC0|T-E3iFfzZ=8*Q--8^X@{f^b(d@&nOfuqCGE+S zzoococckq}bCw?7la|-YOPklKpjE)G%MDw0u)HFe{+I0`*8(6xw(|hxgl8=@)eiTP>uR> zgMM1~C=SzMq8vU8LvbJKg^n+H;{OGLS?nwW^ zkJF?UamXM4R95mh+)p1!fe>W5chf$QnH)hm^G4>+lVUKaA$DPBG=Fv&DKYV%(JpC; zwiULpTd+HXExx4X>G7C6{k7ycjI*sPz>H9!zm}}oog7R(s$DOb9)f91C`+VFE=znp zNw?1o;@6YjNkV5Drudh?)$Q`Z{M*GkW%6RZ7Nd4B*P2UA-Od}#OUw^_68O+}34>rT zUrKr{8A*ikfL|i`IZP;%FCdq(qyk(|6Stw z?QbR1-!9XrA1~8T_B^NTSFgD%nwD}LM#G5)@Ng<5-99>q3uyx22?Vhn9V8-gaeJv$ zrvY55m#}W{AH*d*pJ@OWnzgbQ`ETq1SFho`I`_2tAG$t0|_3ucl3AT<_&g zW+={DP8!PL)zpwCz1hX|<<+z&K|^nLG5v&}X5Z!to`eq*bofw`t}6n0PlmRstMZ@1eeYPq|-u5a6CT zJRtC691MmlzGpYqligamU$Ev!!=*fy z*O{d>5lG51@JY&a6K`-6H!D=HFV1g`xyGa*eth`x&9rp8axl-d%0-oc3SE1Np53ic zrdz)?PLT%h#_H%)xz0hMRDI(G(?AVGL2jT88U=ZSwn#@?^CEqvj=jQ{E5$4NXzUk9 z8`B6#25k&IV)@y+EcLhA`Z)lc1cOeJz*Mi$aCn-;1mbZqLjW&YS2hInL)PF4cGG6y#lcCF?lH z4>bzB#x2#y>V~uZ9ILO_EjeuA2)=G0)UY~qTYt#%mH1J{L9mA!lFz1;NtmvM2o;lwPI2s-3qIkY}G7dgz zR{1=BRlaIpEN!)Kk`)V2vSwKx?JTR-ax=Vaz3q=Bd)q%bAr_vTP?g{&liG~5CRu2F zM@O>4+G!+lSRROtULM#H8@(g&ZXm84?*=XgT4Z@KFgc+)QY!V5f34pLTLZ!tuk~N> zn~yl*3;yyzz}|uW2ep`-UX|PgJcx?`oQc0l+5F81HQU0yfV#n(Om6sPbOIq(T|9i3 z9%g13ql0_=#l!t&kgEY0G*p(koUp}1shC`BF;(jz#nG}_-=xcIC|cZ2`YMh>tGIzJ zEIAU_z=cK>Dl}{ZJaCa<8`BJT!Y}b{_eU9Q_h0h6M7Y{`=ogg5%W0EN*%C!rz~<=< z*gBQ?-nVqSB$wZ}R{OC5qu2@+OFgo}78lb54LlK^pjGQ`otB}jSRtW!ld}4yGJ#)vLPdGFq=#a>A0#!ss!#Xn~T+Su0E%&X8%T!#wU|Lg?j7Lq>8qh zJ&-Hf&S{IHYP>ReK?((VLCSk6n*BJxmr|7KM664BFNL!By_C(Vl*OA<$FBhOpS3Cc zqC!Q9uQhbl`du~RN(GPNqM>NDJ}<=B;RY3c?}OUZV6_ZwvrM1PRKYWOE`H|9k8)$P zC04U7iI%woo7^RG`-eTrk0{7LnrvW>0r(G;&HrE%64*3f`T)?qDT{jpoys=7As1sn z|BU+Z&n6q1-9e_d#k89!n@`fGgbwg2Ez?BJHbn6Nf z8^&VotcH{7S#7jvzmd@xoZrSsL=PvTucY|F7>x$-7_GLQZr9`rLns0A71!xYb+`B{ z^esB|=Pmj^UB^yypZ*C`fBu9&ZX>YW&Ti)hs@hS1VY~)34-1WE2ZhA>t!f9|LcZd4 z`WmK8UL#y)=L(7L1ghG(Ip;ww6y*8*aT|<5yIr{_x|-xAqF&EeT$4OMnX-9)@|YCd zeo6L|Q$Cd;lCOAj%DXA9SQ}I8W-(R{QBD^mcvo9rlnt;M4oJiE{o_r#)DCvs|TbK4pnmaTk_^_02P1@!( zH{}tj=^KjcTT27)6ttVJ6cH z9CxDU7kDcB9kmqpe^YrnTXJRqG@WZWa@}0RDLv!_s7MG|Edz{UnWUZ%_c=&_nb9>i^JwU5MjP`COqBDCLjVsMrwqi-@XhvNO&qFN zO(yE^vf1IX=`Z=|_73IbwA)N@6*{;u;oau`C?XiPc)$6kgTS^7h&Ro*Oh-B5Vcs&2 zHp3h>k2k{{H_tS~oH0v$@q9{r z4CIBzy9SnkccnKB6p~}w6sV)8=r1rPe%`_Ph6M7B@fHFuRY*4bnPH1V`Y2sC^Vn7L zDE$SFLbbdw23pADtw@~kS$< z?4T6u15oC~P|jk?iKD2+<#3Rj=z@kTZXT~!VxqO04F(+*`&fw>alshk% zXPP6SZyzb;9)@zi4)}H7$M~tWUb85ZPg86BjM_mvwM^$8l~6AC5cj5J)a`V1BSj6%tBoB}2vGRW6} zNp%v9fYsax!E|siqj3ZoEtpOYCXBO3STH>zn0_wiHo-g`MppohF7y9z#ZNpz{rQQ( z*!vAvJe0yXsD!mWKJ;tbLK%XRc7uKy1MD&v`!u^R7yI^L6s=6CNz&Y^tu%{#l*O}s zbA9wE?*hT2+~l(@Y^H{*Yv9nV4lvrx$B{H&uLwX~KvZG5s?sY0A}(NZD2oS%A+r&@ z1>NI3FG9C?)z~0Q2xzKw>f@&B;8=scPchdh?^Bf?w*?W}IE<633MVut_wPEGfi!>z zp2G$FIr#HD+se#*kR^^`RRH`8PMRepd~{)zz3ej^lb)6Szk>dciUq`lHy zBT`@En9M#Avw?>qYc-iM8ow}X%R?lDb*y3G1mdh%(#dtf+Hv{i9!@LuCuNmgOz=>v< z6M^vwPF^0L@d>Na;>sg}nr6(#DphBk!m4q~*q(}2MxxH}c+C6b4G5(?mlr4OPr$6b zKVfAeW%J6!208yUBtix~xi)nT^m%I_iY#F;&8P!|I^#_Y=Qo8K`uF^&=HeGG8_6VSd%zlnPsE-jupM z6}yd*ia$c}AC&|rxDryVH0muKc9Qkh9!tj}zsH*4mw@!JpxeVP4HjWyMdtkps}m{6 zs}mbw*p%x^BQKY0Q_Uwq%cfg14teL80ELEtZ?~ zk%|}663hkHQ1kzf&IR5qhRG;0S^Zz0-y$6jJfBa^B3IiG3|sieMZS_4OmDfq8rKXn&NrbM zW`b{WGt6Y)=4P19zBjD6+(mTgI27db#%L3p&(Y>d*@T|-y5=}1BD_@5ZT4wS7B=y)eOARg>|f|JT8`uSE=!RK3D zmMcc!Kf{6LGyQxkTt1y|mERgE5s{CxN#+v_rAJ$On5sc`(&Tjhah*iW+p-I|+WL z{(;=Rl_)O4k+GjFEYzQu8Xua}kBfX`edtP8j_)5EUt_K{DTmjZ>!B`LZ|=g+5%WWn zawMzf@!LUt1W&>;CBBkBgypkSt{nz|%E5|C6{~?1`Q-j|HyN|Buwg2RKD-1FU5K1 z6h$8O9dC&|?yK=Pr<5X}&{4Khr~D1R<30$XRPj>loJ`lHDuT5Yt2uJwL}F^q<;K9tKperzKw&~0qA+1=a%_sN$)i%@2u7uh zi${!0ITnvNmU6jOEQ`ynwzQ68v8DBE@rc)2A88Xuaiqi8%i@(AHr^0NuJD~e$nk_oQ-Y8 zkL=Sh9&N?2|^kE=gUL8hL)SDs@|`AEr!l-NoBd zcc&&epq#gOck27`h{CinX_3@p(#EGrYR5)#eA@K1M5MMa4R-iVPpeByj$j;?b!m%R z;1;KCX@RTla-vHDOl!dmTcs0SKI;oPPw79N^DwkvGeKp(bvY}bihy!}C?4@q*HA_rMJS^84WFP4H<`<h_XTZ7#NnH15SV!`lYz`dsu& z%*eyr7PU=uVLJ~sC~8~P4D)8&H`_)SyxI0lTbQ3YU18IWQ*QDHWv2^nQ*L_krfB4g zH!Zj+l5TaUL!FW&BQ%ucbg0vrPAP(N>{JDLrc++$W^{R-OFGAwv7~cVGfY+I`OPr% zJ1=X_Xj$iVF(_%Tb)DbuoD2noQv|`i-}!V4-099EyELPdme|_nR2$0VQ*El+>h?Q> z`9i0v&Jw8VJhBS{LIs&pkPmel)tQ1ks`LELy8Xsrp5J+EXSb1tcbeVF4L078C(r)l zrkm&*6`g{?LtOG}N7l64*S<=-au0^Gw>88(E|C}{bOL=4tJ$p- z;0@*mlwyNsTa19srKLh`2)Brc&HgyZ`T+6B*`6uMoRD{%-& ze*D$cl)EB4zLiS~5Ig~Kyj^*ZT&v}WIezv&) zy>5Z|k{pl5Dt7EfPnuN0C(RKuj>anf<*z8nzY-(R-E`9RH8NK5UhN3(&5mdxJQoh> zI}9i(6{0R1d3ZaV%cIR%IAYB*j|i-2oMLrSP8tY(NH~R$SFCQPAP>xk(jlKt;^!oZ zk=bOeUZV=G*Oo(bS)`Xj6Hy9RCKU<^cj|j^u-~JH43|}-en|{L$19$q&lEd>nfj~p z`zq39OS%{JnL3u5@rq~BQH+DV+5ypA9MJM~XfX1SS5Sx#X&-BD@PKy63wjxqD^|C9 zWB%4Xk=JDkF}MCB5|%5z^;TyD@U0JeL*>D2QRAVHbM_vJ0Fv-3EGNM6h?iN$@tDlM zO3Xw|S12F?w?Z@%72lNMzACw`r(Ll03lKhy^)CMi~OrC*_3=ROE@ zMO202PB$Y(h2mCSU9MekcI&Tz{@nN%6svC{Jp$hYM+Cl(S@Z?PH>5k-MgHb}UO8V- zeEZ$*^R>J0gCbHK=uCF1$+!K8D)>i_fg@0NQ8wT8Bj|&E^eZr*toSamoPM6N`1zrv z*-!FNvPDfbS#bf?%Qf(1#X0@mtRH*c%X+dx5|{NCaG0W4eFvln+<~m8C{FL@lhrnC zakuYS62v6B#V;txzj(xD^^0FnHlS>Y>-iAnD5~^YXR2c8&Xfew zK{HkHO+Aows^V6VC9+HJ5ow*Ppr~YFsCy}! z@9hma_Z}$&{zb+2_NE~B9);Cr6ipCOPoQcM^^1xpLphkE5PbA8*(*TL@Vh@oB=kp{ zu*H^FV?t)*^?gu+d3c!bB>ut-rYlz8pdf#vA60O_UxEWr-$J#fEB@AxUCg(nqQHC) z6|GXNWEz+e8_h)L7J`kK zU@12;<|YNH5}};IOH#WBo+dgBsGr2i+jtk#-^F}a_&kvhTPvh@*7+L6J7}gx5A#gz zIAhDi$2n}s?Q7VmG6XZvSnFWc8gLCUGnbc`<9vt`p82%H*@f(g2BzR%W{L&|<+(i1 z06BIgUVe}8Ozmxkml=Lr@~g{r^E)%x&95%k&9BbO?~Ie*B)mO%gm-b3L61lYW@ zK*!lu06=H)pbF3L5&C$|u)-7YRRFgP9aS}rz93@iG^ z(Wo?h0);KEG^(OeQo;s(AJ(lAyq?iVY7`&V$FuCKY8030`*aO^GPliw(n47BYLwI` z!ufw&<#?X4GFtB@<6^9YE*hguw1ji`m~W2rMdT$y8Dh_o>x&6*Sg|q=K?D)>_`76S%-jct!U5i2rDLdUq znS9@N7!N6$t60fGA%RHFfF7kj{HS=jo2$6v9CB=L=P6eI6qEHo-H)uHCPg>9KNt%I zs~CAB5<_*K;`Bb0!+ok)gNvJaif_HkUB&L|gQv03r65|Y1OO-yg{c}obg~?AR#P>> zXB(~^aTQoir!;ZD<{?gLpJ~np+rxaO)#>q=I=zZx6G=Xs=^dH2YZa@X;#imEyg>Zv z5-U!Ps2mE);h+8q2aG>85anGtGY{*(LDfJqV+5v-)l6uMGl0Ss1$CoaKVp7AQ_iqfG8pDa;or zZqteSaHqW*Dz-pzrS_5(eSzZTw34VVH7j^6L6)zH0Bb?N%EG61&MD#g%>Km<#splkH=A{}QhlPqCJWlke6be(bL;k2! zhA&@iDcV;}99QnI$|SxziWVtWonrb&r~GIK~Wm8?JbD23?=9Qyvk?``wmz zrz~FH{b&!}zVtjF?QyyXPQ}9%Z@hlz_2>t~6z6v<=!UJzFvYKSIou^NGtAi{l0ISL z!(HC$lHg!aed4#e9P1LuL@o||tjn=3{#YFLk9XAnkRmny@J0D<(ai zl%M<+lfIm~C-o~PEonWi^;b;#R@?J!zhY91Tmzlq%eN~=x)J`nf^TifS9sQ&e z9_-rKl?HHQ*VA38FBfHu$)Eu|K4WqQ77fh4SL|LpZfLr}<#lC(vz>-@{)*B$_J3~v zc|Cn`S67@z(wow005_$dPp7^-s%sd+E$=!7KU2C^b^TnSP0m=D;m?t|8`JK>jHMY? z4(1F%OEZeQ`2=#i4Z4Cm>CeuXo8fX^o3TEF`t$mXJsFhECo(<&bSdLA{Ct*C(Cu?4 zocI54E|Oz0vp2GpBHwZk3SFpQmqogZ%RXqJFemRc*W!@A^zlj$cS1gMXK@<^I zw0>dkALapJ;v!l?ZR`qEzY>4S@n;+au|z6$rI_iwiQ~CAnO=cbGQFhRY-LH7VPc!d zvEPA$Vd8N-i7kl(G>NCPPaup2wA@u%bcg5yUKJ^GuvuRnT$$2Y!GQ}jB~42)2$en&z6UA0sf;2+|v`-f*zqb2Qwau7fB zTua<@LntLm=+F(JYEF(tqAjds24*edJpB#b2|8~>()5f)^3 ze=sgqIVq?wce@`C^zRR13KcF_VBCxhuOEkD4jD#g* zseb?-l8Er0?3Ktv+2lqj2*(k1bSb%_d~W^L4tXdpkLy(j9{ zV#Rmm%c&k#{V+brRgF)WxrB zh{Ts-cp*(^)Mh%*fg6N5ydR)gfvF|9Z^l%v*@+H8mP?Q*1a~w*C)OYw1`6i84H)bW zrmtW=w+PJ`z%DGCf}FixucWOqhQ656son2TyWhFB6Bjcc z2N(;X<2LI1ShG`kAJ_WvTk9_uyF0}Hm9qIA{UBy#J}B`WocL_V?C4R-;$!++dHT3k z;yXDJf2BTrRzJ*|-GdKHL=PunA2;62alYN~8a0s*?w#S6xrsg_6F}JF&uFjah4*U5 zwFuF1xZ`n&Li+2v7k*to%n>5wDPE)TzMgCS%lsbMGJko%&D<+Wzp%Wd--g`Xa2_9K zUq9ztOfEBgm!@YJ%*q2UnZuww5cMlMPVr20hmRiN9ljbrZtQCOwSHWok5ioSSIU%J zD3izVVb<+cxx!omBKJ&Tc?kAj5A#J4U{FXjJIJ;EMSj@rqh8oY0$~z;u(ZhT8-w| zt%zw7jK|`0f(Dpf^!j&){v{urln38Wohj&Y^!1cAt4j+Kw#!ECGudy67Ef;t@0nm|2M-|5F}g6KcTsIC7z zn&KY4jHYlrB1}i(z5#GVI~Ds)l~dYmJ%9^$SOSDCo~_S|gXifx{W0-M3J}H?1&r}L z`iQn%ryO3c@AS)#Ws>3-9Sg{{`dCJzN9_iod$4Hu_c&NS_-;7wT!>G5X6rn{9$h@~ieUbFOsPMrshIW|NU>NWk zIuGzXy@*!$>e*hQ4qs5vtK|hN!hfeAhp0eIEVzKGoj^6!qL3%GAvy(lh#qzvb%ymJ zc%8hKcjK=6ZQ~fGhl^%Dyy0x}z3+o-P5%-Juo)8xl$qDU+upHsR-F z;%AAJ#Y>YmB~d27n|wBzGPy2gL>dM8t+bb0Q;-YVtZqX=-qvP!8w&EfZFaS#AivXY zc6-X?741K3PnkTT!-Ni$#XCE^(}6O1ct^VyOpboz#L3UYO~&${C|DSy_zUM%$>lc!=v#Zyl^wltVno_@|7 zsr+0urHCn0j0^2*S{geZmTDuo1&u#>%B~OH5YHxb!`K^|r5k(0u^VG+SC5(;yK&}CEs!&BTGbM{>ZXR4 z$cCG$yR=AN-K8NtzBCQ#+tQnrW?TBsW<)#Fr*~~eG`(wG*LY5KUH{e$^S7=;GnyqE zno-gmRgzJb5znbCqb8$8(Q7gmHBY%HV^2o&hTM~JC@!sh%J5J|Q%hu1Ms>H?T!gZ^ zTYZn_NU8X;ZHkGx}I`)P5QQU%8`nJw^RlksUKek zn|@r9HoCRgTaIo$w>5Ueb6fA1-~FxM>InF)j;A})!!kywpD=i?g8Yxlr#t(HEv}$y zvK%mMaWyT}+{j15a94g(OK>9XHG{$ypVY?bG4bQ{a*ihclwUUjkA^K9A2bMCBEI3(?;zv-DUB&sq!^7UO(`y8L^h>d@<5d1WJYzjXg<~5R&)bxW>_Lublcw@ z;KL5Mzx&bdQQD*3&q$<8d!~DRk0`B(Lp_C!m@_Rrb#2q)0Ec?1_P=`uY&Lwq;uQGW z_3;Dzwd?<$Q{dh%&1$u`%eZC}-njIN<`Z5;*K3*sUu!l8zIKgs;D2RuyULU`XteY7 zmeEx01mdQd4THRC26LV+pLMBFd{PTz*SSV7#}TNUH>Ak?wm~K_>Fn1&0xx8Q@Wwzs zt;nHnW4Z+-Xv>#D#&nz3Ehz_|tHtME1vRZ3W@P94r4eLxw>91HrJ}w#7Vw&G8@l1> zDZqQ(E`h%jbE#WJ_b6RO_sQLTa)=IFJfr*82q0CM-E9T5kt@3G#n0Yud%NlOjzN5| zTYY!RqVD1|+64!>^H z!v#q$*PEyC*6x(K2}hkPjFI>0V;pGzM#IE@^#6&KuXMoLg5zK|mn7CYp8RTYF3jd8 zoC||jnp0j*b$kg{C_b8cE)`0z3iWxz`PEi$w1SrH|24oB8{jBT(%C$_{pR*~QpB6v zf7YI|`Lp&DI#BRR^IqlG7Jbc~DgWO*(Q=+Ra?__bQ6K*Frb(UTebpqW8u}5TJ&rr@0;3FSvNCw}cOHzYD*5VGcGzMVclg|IDsT;jGCV-x)v2n%{S(j{JY!E$ zoDJVA_-Nx41w6EKqm598m@H3G+|c?0^k!A<_qK7`E8hpWV`%WH!r<050aVfK+tD^E9O7)Br2cg{D?8@S}at;~62xM}ng z^ao~{&ke4zc3Ez4THvFAAv;l?+;(PLH+ZgXsGUm?>M*8*FPo&GCZMikul#0*zoKkA7zxf;xle|8HNhS#-ZL`+>*|lJG-x@H+S9&Q!{Lz zw{|}0VGnjb>tW}nZ%U8lvnf545d%wM3$;Scd9Tcc+Bo^H8d`gtHVICl5iHjy>P8qr zNl;`=k1IHY9>bJpe6@-RZ#1}9(a#Zr(2i<587&1h!sNDfZP5S-*R`!{>(-~P?a{Wb zRREv3;nWQ=l^D}uRtIcIrzjrNVM+(L2af45y@T8Fzf4KSbQsgY$dYydU-yYQFTd`k z>)aQ6+ppVxom;5w*A;a13e|YyksF;t@$j2w+~g2Ts4%(v~ETM{#;tx&@;o={aTTRp|kNoNxSBrLT#D*Q9Ss_fl?3-<0n9AJ~-sak~4S zk!N;Y(ACLDO0p^aQo1XiFPGJo*}FV9rMu%)a(0HVM1@nsQFmPc@HSK)b#XX#duq&M z%I&G|#YDcB`hIHUa%*DRlr&3vEJo9mwA!>t)SByGxjqsV$^U-$(&=YBy+#jTbov!=AebDA*~_J7ev(?+$5MviJ# z(kfEs)vaD_6)7{n+G;1Fq`f0~xD{wfD{JKzlFM2xZ53OArLCI0I7xQ(S?UX?_DR}l zOy@`RB79XjSJ(~XNsJxD6vgF9vy$9yJu7Ls*HeY+%AGhG<%}ZqZ^!9YpRjdJvsewj z6da6OV0I);N~V51DS2(ID(-PRtbJ;94X<)5 z6}P*|87zEL4*hh))iQ(8o z4yOYNxHz7s@X;Z!@*`<<%$ICN(}4teb#14@3T>L=1>yo**nHLo0J5?%o7tOdNw2Uv(t=$|)uU9Lmb*QKiSs7A1ESLN~u z2CpiYs-H_$?lzJt$wUR=LxJ{@4`KA0eKgDc!al~} zENz$Nk?pc(xNVFWl*3CTh1pIg@da4ybxzWUgdr@>_xMAarTOK?u^tWpk6JSlqTqiu z>BT^4g4?^iARMFIg9;PSBl$=8H#`OhSY9`;{QA#?-${c<%_bdR;;e4AYZ>iX4PuNgPY{+Rjv4$ zCUJHEA1yu6J_!86YoA{XjE=s6J2?vMu9LwKzCIcIM5v%1M4G`Wxck>ogsM*g3caljaHz$ zS#g10jD0w_NLc%d7lK{T*=(JyY?gTCq-< zTrB#9zCvGU7MtiL#pX1Vf;`Qf;gj>`OvR1nSrfx;rg9}K35rF!5)`RR$dmOf#p+vV zZV7l5>etVhT|RaVWRHD^UmK>1^>QIjK^vetGhjh zcYn`e$bJ9l%MQyr#D9D~+F72jbEh>~ppf()zmqAJ(|hi7E^iRN5B6QoIrhOn2i)Qy z;?E(9a|Og9s?*{yjsulDD98^Mz>>CrrpWk&la;%?lHT=Qx1>)MQKYCvG$v*_9Yfn= zpzXBFg$9N#-bLr#ngBYlUD7O>TmfCus`MySrLTyAR_Ifrqsl4h_hTgR{U1an@PnRm z@r*kE{5ePfw^u#F7C$$>nFPj*nOg^^$%Lemrf^G{RAP1tI=SBE_TE1hMOL69ni~nv zrHjsLgk9@JLKWay25Szg;I2l(>Q95*FB$9%HrR}LU975c6z*cCw5| zjp50cBcE&WND8zyj+Z14fdv$9l%nwaT3oL0YahiCe5B>;u?h0^0zEE4fnF4kDAG&g z5v6)X9E%ElQyjcW-xr@?pZ=B}E1I|TcjDl8^kV|UvKM>jWBO@bI=Voo^)il0EsfH% zC${Z9-Ny*Vg1dL=m!rI^>Fcni!Q{D4Kcq{as>442kY3Jy8*&n`oU5?k5!38i z#c$~$#`_&EXU*=Z;08!NNkOirQ333t>lCY}ycP4Qr`;8^kj6!q%yCrXE{myQ=+Z|8 zq!9o){QelTy#4Xn=<@dLUu2kId8?&Sfo7{!o#IM9CZ34v6tAZxcv7@PJLI^$Iiy#j z+?8DB7Z*5X{y8u?p5q@C04y0-@_EK$SEsm^rpvvHFntTJW@-%Fl044Kj5kfue$*)* zM-`YZFgI3Ht=E*b2s(3JEzOB+N#{gAGX(7LW-9u?itLRPqIPUk}0yzBzu6AH*zV@@1?# z#UE21B!J#GMjNlW3OsyE(j7QedaaIy0ZJs1jHrMFLY~-n_Qe`ir+A50CAR)`iWeG7 z;cCxW7M2BPMExxjz!6;2ld<hhBAN1{g!Kt-E>ZwA4Q{=VRiiO45bZBKFR7!LxF-ooP5E_6-J{G zj>xwtP=-6y985`W=B`j1jbRa?4l~29tfl6SW@EHJ0Ej6f^q9fOCC*v%VoVV)nwKN} zA;QQjlsPma|DnDjw}pi2YSYEP)M6)7OK*z7{ zom!NJ^QkH}7sQuA!CpplNwYifT->(waXhO{!j^uLL|pGgINsa3bfHY{Qbj1&BE=65 zMzIzt{>fli*u$CHH)3)eFd#B53>Xlt{D9|TXr6m6Li5~nQJUvQ#}*yVDV#?l1KsbZ zR#8<8Of#9jL=ny}(JLf6UT5)pg*H>OT5Cp68@QAiNa zXCzvtoT}u>Ru%k__u+b)C*OiVNzhP>;lcSNQIJp46iu@q;3?WX+1@QttnP>r@*Q_X zL~+L*Q6b;4FhPawB7H}?8o_zf5hK^Tqs>+ z=~pTTQhn8OELB%32b|139wU#(ACJi6@yDa`czj%pJa`;7_uf_qK$LJCosFS%yxDb& zkzBWdF~Z@2{}K!R%h`Cz)hoXBHtNf_Jr4Wadd0WhMwx&z`SCn)dz(k&M4I)Adp?M9 zRw_}1~dh7ZLrQ(U7h(lq-gyh!Y^e!>T}@j5EK zOz~N9<c{2q3)zorXgmBFgtUzs_2VPjar}Isjg>ERE>}E*=HmP6bMf;C&js}W-Y&0rehck0943ozjoP&sM#lUz<8$UM42@lD++hr5@^db&b!cf1qmUMAyVh2q{%U;$bo zo+kP!f>XyQa9Thh6FVjZZii}PrDCg%tDbH19G==^ga2F}IXFcxDOPe!UZoh9t-<%Bs|J(1KI7O=!t8Bz$JCVJUqDt_cv^%0++f93s zeKvMis}){sBNI22DO|37Y@qO6+Or>gqa;MtytnwkPmP_T;+IkHcy$U6636@8N@YPt|c{gPWKcNC+3H*MX zi28HNP_9kXs4q{0*Xq8K=IRBhK@oHKbqu>4MQatS@1wE^JWJX9?4MyW`{y}$-oK1i z5ujD{n*6>-vvl;awTfS(DYAO6Rov?V%Hr2(qDEOf5wl!huF_U&Xo64K zP8it1^cv`BTO{{>&r+6T`Xv8(2rM|A%$}6UXa7t=UWE@31qFs0l!ClQJK|-23a&}| zDr)c=twDK>w$A(RM}ug^959=|(-08HIO`PO`$OGs9Lzt=k)IqJZ_RBw;1}?KzaT)F zTo9NP5O`9cA%MnQr}#M=1$8K4U%F1QO}0Bc*rurwBgU!PbWdk3kC&!vEA@b*>=t;X z{+8}_=C|~>b$4(c)sIGlHS%4449*&!13e&uC4q4`?8tC*Y8FJzp#EE@xQ>Q;<|{+B zI6&GKlFy*FDEJwEQ*L% zJQ3f3R@rNvjDt^FMShR=jQ;|(i&v@8|7-^9@u39@@=q5ePzA3@cn3f4B%Da33O*rM_qckH^;tNpG!o9+zQ z_0Quy;9tTPH{Ch>u2^{ZT{U-kwBftU?{-+I|J}J>i#$%;cKSA_GJN{Bx4-Sx@$GM) z`*y&tgFNaWk8|G+-yRExZ(n-5M?3M3DXvJbSss6%T(3nQAARGKZ@BXKDBSv zH$&eF*fSxInUF{5TQlO|8Qfy>`R*&+VJ$aPh zTzzxEE{8nIA&=^tH^jjkZaxvA-Tn3bUw2qsvpoJjxn7Gr)@5wWa4N$aGwQo}@~H2& zzFWX9g*-|jkM-S-#=!u4K!m?XyN&AZ(SFeVQg?^NHOu4glk2s}wgEd2^2mcc*0nw9#a(ly{|8wg@*To{3ftjBzWEU?_7)E7RQGxH4@)E3bzwXtk_9zM zwR$5Cexp^WwMYA2>l3XV7E+J@y}4dX$+jeKPj)K9+ml~S@#^?$%C3}vy#eyr0D0_6 z`5+GdAZ2{2NBeQ=XQ>X0YnI2~C)aC{$MJ+yxGlu!JeBZfqF2W^6Hg=t>@|?b8pz{B zVsTO|T%0sN$)gP?m%AdpW_kR5a&2nY)Xp_OXlhsA-a8xDw_n~qU|&LAFQKl>+aHXB z54JxSp*`3Be0zt5)b+og@%px8Pwy`>nb|N z!WA7GI(oDdyG(HxDXGW*-dwMxWczP=-F;oiuivz*lUK)Goep&h*he9cqmaj;PM^fV zpLD9~?9q1A7_K!EN-*tmm$6Yrx-4L)FA&*ALqv?j>H^#!l zZ>+h|qYd9w?uzu9`^VoQ*A0r*?KIwKm!Gc-&d z_z%|nD6d2|D1J*j1Jfob8_#GV zICQsQ0mC7ElS|a=ml~5|ph?D(C?uJDq=oS2D&MF!VBKGBEWxito#7AU z1^Wk_Z{Q_+zA+h3*e4sc0@fPN+m#K9OO0v+TG0)P%Mi>~w9zy0->A6#b(FqS}I z>j@YUK2aii-;IiY*bB1SsJPd!5ZI*LcOs78>rIL~-RWFtpu%_F3A;~tPQ~{&?_BEG zntJe3de^-@_Au{KNK1e@s*6xy=)6PupW{CpANacH?qmH`QwJ3MHrleJx)7tktW0x?P^juO}5=hk!&LG^-$( z^+^Ykb-XD&kh~n9LtCCQH&x)dshd(MlTW8kN)vce+PJm|NaBrp8B>tAwk^C)K99Ra z@#MCX+fo)!Zo30NJKEN@6P0^iyNT^FV74fpnlu#>n+gZ0S-dG}dNO=Y@$}@K$u7n8 z)VZk?mdj(02Yn|7|O>w&2XYHsjf7b59_PV{nN%6V0oY?-u_DH)G zPn9UhcR!3l2T>seh@|Y)IakqP1Gr)U7WIFG-I7Aa2t0P3lDR^+Zx17Vzi8|RQ>)heD%tF{TAZ63I` zZ5IHs^ATwI$cwrU@`iTczFyufG52cnd0~gBm)}W(R_@j03&1QFmPE*PxZ)5#y%FU1 zv?k{r-*Ckzv=i7|fbj{fIC6bgtdGIoLT==SE1sxVMU5uL8dHr#n3aneEmrBN#w;T_ zf)O;&GUm0w%`+OrYBCFz;|AlPkq}80w)mh?UP_JgQK zDE?U)*4{FD2li9)VVqXqz}Bch@pa#T(5@Kh)ZKko(ES@Y4~Xe8K2MVmX8E)Lo9qSJ z%eXDSWR8)K^p8~hk+wz;NIS_LH1E~-qt9ae?AIIQwFANpyoqDUHt`fQ7H%|~;^3wh z@CWkx7Q8+%FTsdeL@`ov&M%xs<6nftKprF^3R6Jl9p|A}m}bPmGvM?=tRWRx{GBUN zs94?ab&>n~c$x;FgI?dSMD1qSAAMC76E z@+4v)&oydgsz*d`xBvJ4S1*HqEkL(}@D>{@@aWmgY^N~{18;XFsXByHa!NKuC0vFt<+Xa80+L}Z98V# zOpKIKil=MKGzb7u%i^OtVoAe9a?f_nbj)t0I_ceA(RIHEDMd+Z%kn>0S!*y{D!70K5+pMa$jid1ZKT zVB{(E!1rR__`hd-5NYNQj7#VyGEa0)MJp;%-0Dv1!*{~_oPb}8IJmjf9e0Ah^G=u3ol!?K101h6kB2QD@GDPHzk13! z^Gm9$Flz;u1{hCwK85}>5M8cBeZ@Rt%a5;8iGz!uVE0<8xI+hLapMj>+}dyt+`P&f zVk=g4m&c(XkVRAw+jYyo$oUdzpXgWSS6E+t$2c7fvF$co(g@X?(G9daSdB`ZRprb=j!Q-MTMI!DaQd#F8Z4o;jGyT91R@ z|G_-2^@nYM5vnZE$u>@ZkIc_YwP>hK!s0)-HIu#OmVv#DT{ABOpXGgOmUZ6DVuKv0_u-4#kYRj z7l!o07JvJnp*@4+BCIC={7?eEGLY*$*5-$*C=RZoWt5l|ORV0}<0#3=-Y-SLW}P28Oi@VT>t*eFQx^B$?X1;f6?emtF$?hH65r)^w-??1 zJ@g@Tt?y-Fc7tLtYqu*fW|3SK?-tkoLDXb{5ifvH!dKn z-#Eo9^r>R#JWla`?Fe=Q;E}KAd-jp}dMI)P3+bg2&ccg1z0@Nq)t3kw`-Ua@3K(Dx zh6x#r?N;dX&43++=bKABSd8(OnCne%1_b?jb4wh&#hl}dji2LN?2F~M*muB(X&!kW z@V$%sY6LI&a7T@4*2!j}wa@Ydw9jg?T)FM=j|;?bmoJ+&Qlt0ExsgHOUL`2+I3?Alp+3i*D@(DRH z$b>Xb@nQ2_)9oVfnkP+k5p=ne<~b8DQ%g~*0{=KnJ_1N>KDF}wZdvmE!~Jeqc(}g+ zc8=0X@U65ojAeY4tS1GzXN^u3T%*s2g0hUm2G+!K#l4=TAU`{sL`_$&cndz>l_TFx z>($FGbg$KR(YC~bTeLSKly7KFu~AK0jUJP5 zGKY;QC}n8UnlyKiH)&PUBQb=k^qNTHT%i)pEA_K}I2@L%XyB}NNpt0XNz2zgx##OO zI^$2S{PcxSUi%qx6&siZ5!HJxN^F#zv^d>f>Xn4nbbd zl+&c0(7bw`(9XiQh>b5m@FkutoeO{z;1r+p>UEAUM(TBuFGcD#QE{v5upOVM__}XV z7JutbJOjJ)55P@QtZt?t-#it4Y^pvJee5h;epSf#&A#~z1^Jn&y0{;hq<9Uj@kZks zIv3FkoTEywhLz|u=uBaY-_Q<62IXOGyeleUd=7@}*<7W;lXYJ~#pMOJ?1L!CgPemT zz`WRR-saKJW*%>b((q=O;q;o8D1HM{!=mKk*R)10kR7&w!0xwEtI=cO8hx3bj18Q# z4oP2HrtfNj+okVqf!nK(HJYa#Ym^)4^^Py(a--5fwhmNjRHBc1K*;oGi(ed+D`d_x zokx{@-K)G==8{-~C1#TuW!z-G9~=3;`5~U}x>ijenzg=|I?5Ly8nt;kn!f^%mP00G zNsjPJ!L!UJ(~bK7O9NbpYmf`>r573~43BBGK5U&+u@Xzk(Si_^s}^h2E@+U0XvQQp z&V~`{J9|>5B>UGfcw;q&Uc*Bb!8EH}fxb*`+gzdj7aCo-kHI&j`$}+`-h{86H0fgv znW|RhjQ(GXx z$%<8XTouTNmsg0wd$QuEpEjK3?&$*AhM-3k&{%9k5PVUaBcl@GIocd-GMwNFnRF0d zp{?-HE41|y>h;=o&F|>b;1OlJ7S^MnLe}j%`eX_VTime|mVU=!Z>M|xnGucPz4!XO zef+)mV(xWRv-ds`vxk4;$wV23Z~%mb>B*<#;iuvA*oP`b)b~;)5V!}JecDCMJHTAjK7xqkj>M6(M?IYse4x`YMp5^W0T_L@P$;t~zf0(KpanT0? zD>m&x>yQQcAnuSA3bN5SS{MB>G#CA$06MnQ zUr@E?DWra*wX^ahY>MJFe1`GCN~k`A61hV=fWGr^*y00PnT|=vu0+XEfPi!62Q0*( zaDDTZ=>>*QqA@ob3k*j;fSt?&qu7i@6`K`iG^)bf8I9U$?v9DtZ61n&4w+3+LMXW- z44cg3E*-XT$D2Wy+&Gluk~zW`u%WQ9XQD1pfF(m(3q5 zA{(&^nn9v+7MnxVx&?!52uzDnt?Qk|)a)nC2h{xuZ69}3Y7%eyR6AS=~M-70XY zHc=K2h;5=);i84==OH;&W2OqxF>;@@;ZBW@!I5>Q3`rq9s2%inmj|^o5r${93z}cN z{9u{j3)%ra20Re=)bJQ~+EVeUif6IBE5yNc4zFeJ!SP!DjEx-3HInORJj`$fJj@tv zSh5>LMMfLw(sj_1z>S{}k2Y#V(|GMtx<+AMBiXgd{J)dxONr-yh!|d*`%{qnZxk0V zFDl+h`(?|6sc1hm2QqpTqWV9D+4n`obEtt3oUT~)pdk0?hrc4H|9pgZ zsGCW1+)WGbqc=V5B5kQVba{ie)eSoN{N9_Eem@ckF)!880x$SFHF?3g+Dgrr<(|V< zYOjhqu7fy!+bY*wNV-)!1nzRNl8^n$>*Ojjz{yo*NX95=WE(k$>cq=|vnJQk8rei- z%f3>mRitnz1~hocxp^tvtJm6)1DRe0cC6TjDh?tHQ@EjuKcy464nLtG#XtqrN%{!;zmI5^?%1{sRa{7gQ9%O0 z*l`3|NYycdwd0)Q<%Em;=uhG$#$fGn%cRwy1 zp;WM=`QZZ;|>mv`4oX+0-~tr*OD-p-Dv zNTlD+J8@6st{=k`kENwD&BO;M(t3umpJYE)15oD_zeRmoAP$;`%t)U+c(x1ZP>BCiN4rV4$O@nq98vsQI3!Rb1;!eAm)UTGf_*#J{+UR z@wF`!)E6W5gNU?gK90D}#=T0bk5FH}$x%Shl}FGj}4i!_6rou~rI z8eZetCh;2HK~m@i~UF&j`b2KWuD+G3_>^+Jx0wH5~S5DX<%*uhS`; z*XdJPjEg0CHcPr}4ja1-%H-WfwJEXHW{rvVYgw#(suuNCvEmSdnZi8=TS({FY3G)S zTh!?z=!|oOMT@vkKZnsIeXD%Jpjh!_1RWMJ*cbIoHd;) zz+B~56y#rBj99NcPTBnUVtM1SSbJ06c!26DZ`btHA1!Y}pn?@E23Oq@k>sykO8G4>(E{t8@x-`XQMR z0Dhga`Rj)u4khqyo*Ztw%h{>(_rLGf>-!_TdhrMv>Fq>E)97gMr3l4K(Q66$PLeaP zHPD_2#U469awvvckq^+wm`@>$)G8u}$_i}?_JML#gmucdDahac9aZq}{u8q(PR3yvM*7{$1O=UazBsXK&svmc#C z2ff|2OrM^?5K<2j_g-Ta7g3QXYq;U}4hxg;0R>sFc_keo@AQ0x-UAykUc<$91_e1| zkCYVPjg-wd?m;z`+;B<{8SmXlZHFIFiTD;Q+pvSYrD_%~^y&^1+E5d#^UvVhtj*})D z9_jzXwSq|h2m6@Zrg){ORICahr~*2#<46m{^OVicua$DFrENsnyp0Zl=n#!Y5VMfYEDAYW0bu6I z=^rPzc{HCQ(<#rVkQRkP+S168bE%_nLz49fI#b7b?PNqGC$$T%NI0ZV!D$WMZ;HMy zdf&WGKck~xg3B5Gg6{e^f+Y=K&_iYntWeGwJloq>&E}54z3r8rjyO*`5Qn=KfiQq7T9l7-+_Ccd2LcCnWecO+Wk z77Y!*BXKWYx1*A1ZQh%B4zJriSQ0mw4W^s80Tw6DL5feBXUu>N^By@t^BHrK6$@{& zwnrR5Y`6AA96+E^TeNa>#4NbB%jA{X2}8HXx|PsYdivOv+J(qCxuAXQjuRAFc@E;(=r%mC_YYeH0sN9wA0DXsy0J$ zVPHZ4uPX!R6C8ce48@ZJZzW*cGDC5ZzsXNQZt{QZ*X_Jq{@7m_puSuv+A(gadZ{;IQ@o zWAD%7q%5w!ak#3kb9Gs4@qRdwjOIG2FCXhva6a4NVy@Uaztd0WS|D0%wxE@R_7_DKSRYrCdzGN4RU# z#gyFCSX6Fm0#KZaFKN2s)Z#c@aq5E9coqv%kH@08fl&oAor{lE4HsRe(~#s9$qb`s zAi%^U?eSQfj<+ZH_3_DRg0`wXnAY~FwU!mC?8|ghXer4oT1vS#PO>sCakxx318IgJ zF#!Wj^TKTTj zY5@8I4C3zPme`7dK4&hw1T2u)oBu5HUF<1%zB~Im-<|zG`EH~9=a}!#6@*Le(_HnX;P(8TaaF2X z$?mj8?Z@AKRS3gPAqcy>ghO9p!cjDxtk8*9XgZCsWd@C~YXeqj#w%1CXb5mbL*SGS zoC*vM$_yGDj0QO(8l0FUGboyj@6OQKP2%h>xY_lj5%xMH{yVMX>@K|GW_RHgon22i zy9=*SG+2@(d(zQ%r*E=CC;m>SZ$iE&ba|?iHYLey+LRPchE-v{pjT-+rDBs-JAo{N zV*twF?}aH9kFwZXd;y+FfS@hDZN4Cb-5K8ItMf+J`NHri=!>`>VTZ#0sR{5@f0^Ht zTbVza5FPc8b3D=GoGK^Dd<@xDIUhMG1`*1^#P*RhA&@{bAy5+VxIX(UEbE$onQB%_L%RDsI796RI$Q zO}EtDB6~3T^#sh)TbJJIY9LE*J#?#4i4NU*=vLR_bLiG%xB9YmpFVc$`B?b;tygX} zz7z8W9c?%GCfS7s-*g&(r*9hgMVU?mzgYPtE429)s{B&qX4!=zH?L^V@QU_Jzbw1Z z(k~C_V1;(QLIXNX?0`o!IHRlWu&_q&xY};8xv60AP1|om!(zB@zv(p42sV7F|IM}* z8U1gL+zjavVn2L*Dj3RvhZw^v+DE^v3Arwgw;Ozu6{>ngGn_@IZ;G~OINE++d$&%9 ze(~ZLp-Rsebh>@cmrW%^za0ItTV>HN=X5YtmeXNC2e-;bcbL$@P*3Pk(!o3-Ury)I`p=feh3NNI~QfgAU^Cok?g{=+Bw-AXv zwS~B>AXoWW6%RX9i;EG!3`0!Ih<#ro-(#yBS-dSR3V%P@Y}o zYm8(@P=jt)&Q)__%lbKLp1Z84HL8ZIQA^tz^|lJ~ZkvYRRujnsbDr<2593Yrp_)hm z)=nW&IXaL1Pxacpr}t!z+o4CiJ%Df9Mfq5 z|zw0*=5 zaJ8Z^wAVj2zH}bzoOC>K;{p{dxHFitBG3>_4q?5_lU&%L`KcAWZsK@;u_mD@N@God zvlVU&h3z9|Av?i2ZdQMz1ET{j!RSCJV5CtfFpk5ptB(sTkA;^9Dgy3&iFuA$^TM-J z=chvYVqrNybxAC|Bz1YJ*_BwP$D#Yx-0O17Wh%w-q%5jeC-oIiC!N7~u4_T^qGXmf zi;_{*4Skt-3y3qRUWNU9-nTaS-DD2D%Tzg<>LPrwSpd*QH92M{m~8E|T=Y&W?Dw;~ zDLe<3VFR#%y{484Dx($f%UwZ7+@<3(K~Xb6fx{AWnV^ECswA0CRY~(xtx&@&%-?x? zi7z%lm-xc|05AHufg6GYl3)dK?Lz~SMkh7XS`<8)Ll>a^j!r6QiY!Q)pW1{nn!2$m za%1Y2rpPVVN1jV<#wG}DL*wc1T!@4m7{gyvcX3G#{MS1UWcuZd2skw3TTd4p*jCq`CDOcBmq4b()_goZG1D z{kvdU*yTsp!b)qIpn3i`fO~^+Rl2`48Rh7c?lg^l35y3@2)J*$c=XR09(~jR+z&oo zKdny+v0coy6oit;C+pROix{6gCdIRw7?Uz3B_V!F%CwXwZ80rncGEt95$nkbohN<_ z0=X+eUQ;{g$&H6CUr;R|vXBqoF{Jw%56S7^qA-Y^V>@C31Ls1g&_9 zuHmj97G7AUT_YTLj={`9V$-}~8m&?g>{aPBMAoueQYk2E)RJ0D*GQ$HL-LsE^vC37 z>99hHZ(o)<%Jp-HiH>qqt>uCFv8SCHF3uCxWBIf%9uN0*$+D^q@k%E0H1!N6%=Xs?ji~ z$#l~|X~;cXCQKPLr*E1v;JqeSM;n_AfdoWE z8c&CaEc1wrQ_7tWNnLkOVDn+0KK`u2ORb<-xBn?TAwf;c*Ai$ z4kdQsMK9J1L#>(Q&SJbjhn-29NplSnhAEAlOLYlI&aIBFl6Q15@+#%pO^~_v^rpz^ zc9rd6rpn%CH(_R*y}K!Lw>>twF{MD6|K0UE%eRA1qq_Rf4quHwz#0f^M>TwZ8pfU* zU++KUH0FyAIr9UaL~D~aBzgAFuGe@`(^K&9(L6}fd2$=hac`p|?5DR@&_Q|7jLd`b zYRoa?svKmrfRSpX>AEA;tFZ~|RTXh5_~EE`)FF1ZSu1Fl^#RPaA6VN+PXlWOKO`l*8AbC4ct_S@Drau3q;sq{}O%{oDpj1@R891f$n zVR@1Vca@+APP+3?lgRa^mT;-=5F{HSr?W7thD>nRSko=NgIF!-g2bs)8l-^3y1N?d zsXa30S-eNSCvk_!n0{k9I z!mg&+``U~p^(Dy8ON_(!HVfM0JBU-`2YuBJ>@otlmHu_mxYzlCgCS$Hpi%y@es?+> z>wnF!opaIcU-K{VyT$@cU$n#zrvQT(985-6)FH#1-Etzs#gj%|@I)#X+&6bRrJ`HoqJUm12juZf|K)1yj-%q{&QLz`f!FT?Gr$ z7NogCZb91qG&2_VryWf*3&x$Mm+y-A@{ogG4#X$-@{r@{<-5?!T|GABXtU%l^ymp zE{tK!>Kaezv|dFlbbYN3Q^Xoa$tO4lv^gOTlF?N=*Vwt^NEEO!r9fd#L&q9LSKRgE z##j+lYQ#eA?d{7%5i4R8yohx$HVzJ2hpZs4$F-6CkTs6H@HncAO>A{^&YjqV+-*9{ zJHmAZF2ih6CRg!n@(#Mfc_WR_%YvAyipOzHue*NQcTLuN1c_Wo`CPe+b-+E)o}wn# zs5}#s@n_^k8RUB9rlpG#D>>A&hEJ;ru_8~f3S&cmkD#OSA|9GW3UoaIT;gZ<8iw`> zGP-Q8jlr=`&;xMn!35MKa=%GdCrF$_InK%Pwk)FY_FO)U4g4W#=3FexV}pr~$?=}6 zL&w|2vD*!c?bo1Fu#K!vP?@y^3jPvnybUw80B$9$)9F;NfP*(souI?&aD1l&0IcSE z%jU2;?cIzztuAw<)|W4<%kgxVRUzL;k*#ObLaWSb#yYg83zu2r?Z!yv>J#hWdUf-j zsl4~iLgGOD{;O#zsC*!1#Hw$Goa3p!IqXl3LEoJB-tuBbygZd>=7YS1)BjTqdaA0A zQP;zNRA0zOXVu5(xmX2#taimt$nLW0ZFj`L+Cla9xma7Bv(MSCAPu@#W$Y zW~ha^zTvT3DTn*U1C0-i_pOPc>x0L!>j9Gxf8cnqJlXrf^5oa~5h@tbUQd2A*&LQQ zAgF-m!uxD4Rl8dV2L!!Mm$0pHiE-HDJ0R#|-*~_2hvWT21MZ>bvB83%pDoT|hYEs= z;=rQd>+YSH0_n}gWbuY^Zz_u+K5dO%^bN(9Ppq&*17i~k50-+=lCBJJ<%Pi*Dptq7 z9<1m4?YQ1hkMXGE!Pk;tD(9%zl0J2nj`vskv7P*ZAm>ImK)lynZ@TP3LBc&+uqR0t z(VnC;?B#k;&}$g_nKaiv>%(zO0o+Qv(sYtad!wywGw2%|?JahYEj60UE%sTT2j;}} z>NxfRkE>(E8{g%DJxK^~BqraK8qrO z+1Lr29VidTZd4w4AJF@Oq99C)R1|!VPwXEQG!qnEs622k0RM=Cg31Gz1F|d43T_U{ zY}y<=6_i~$>-YUfvAQ|xj|8;RcTmtp|5dXXyXqhA#EqiEoxB8(@jNGD97iGIIm1t? z@$2G0G)>hYTrda0 zRVr%GQ8gkaI!0KpS?(ee)(CpdT9g1UY69oPL`#mHYkSk?+7X`@j`(V05@eWvjNeEF zl&eC@E>s~e_*JN_04CR-2z6_s9r5YTb4buJE7z7?IbU>D&Jc}vNKhT+!oLrnv_e&g zs`g>&aR~PqqX@7W>OLE>%S`7k<7b=@h0eXiUTFsz(u6CSf5bA(Y&C6>CQZ~BvD-Rk z$*%v1`A;g>VKbl)3wJ;tF}>ud(QzWsaUyaN>p0iPeq<6I6C~W-ok=Y)UjZ=@9v2hk zq!xTg<(QyLazK1~9iWD|26#O&4^dlGik@Gw|D73jXp7pd+}RZ<-Wj0XYF|_2J~gRD zV@iQfZc+OnGWMw*ev1#X922zOK4QyEI${I&@hePML!r1k!2)|hB7kX1bGg7?Z(~2% z-7H*hulGc*w-1^~tc(uYM{L)a3dcqEFyOB?MluHxYo0b#hWNA&n(iTjN}u7FDsyjF7he_ zAir^r@p$(`@rmG}i(X6F2|*7%FguJkSAk(K3VrU%Gy7jfk$tPA~Vy8;rpnE(QIejxrRv*?dC7Ee~^vG~q~4Kr8Oxb<;f7$-O0cg@1St7{ZSa(D5r^SfZabW!MQ zBQs`THk~1haYs?HRl+uYL_TJgB99eHt+r61ER*nV=H*J?6sjp!J(l*o zHbzcmvD=DtnzmuS7lw+hdcGu*FE6?%Xo!sPZ7!IiuvHrf;q^tBmN;P?6!MZF@w7~* zr_Zqk;F6%PKP@xp>5(|5(U0TblA9$Chx2~oX1T{b2cy^1d*nfx!nT%7_ojL}D9_7O zM&a60ZLk=j%DFF@qiX7PmCQ`_aWC9`UF~j!*{zOwlN?hgxfkfqo>V#U_pkD-N;Z;p z*IwL}R@6dOXwT#w*1I0)nl*^xaf4_q`NNu!i&`Y#;srF-2fPQ@RT1I+EK z00&rkd?F5%dDh}sc(Jw8vh}HiYHN!L4yRG1u|i%JBSeJ{7E!UUoZr^CENG5e zfeyJs75nrm;`f>U<)Ow?TuUGFX?S%qP-c>l2vrfr4zE68SJ%XF$Z{vW%YqhIE6@Y6hTmrmg1HRAVKm+Z$J0zyArE*e zr?s)8e`{%jvAkhXLmLRJ@Jbjkv+_yxa9#WrGvGcpi=32nV@l?yKGAk{92dU!V-r-^q2ubZ($-s+q!6x`Rc;gEO1TztM>?kC2H@Py z`L|e=G(lXDLm_cdPK&qVK1+QFdCfFLj>J)4sG|stjjb-n%9x)Er_8?klq8|p1HF8}G5+&ggjOKw+CP-RoX)y zud+RKFzBv=c$8y2F-QH?Y&a9mR%+xw19=6i!4+AN zgyVSvxJY0jjxa9_3`@d_nQ@1#Iy3SkzJXYULmmwDpTON`+#6|@a~M0rz#n!_@VQ!a z;uFqkbKG`dpdj`XLqPzx4_+si_6s`{2@Fee*U=0QORB)LH0+!)P}0)C8-bW&@J8UR zK#)hB9=LA>HV5=x2-gd~x;d~t;Eq956-zhT9vGI?7|Eq8Qm@5@!fR?~!s>OV+F@3& z%lhhBXoq@7CG*H*6kbeJ?>EA{uj(j~rjCZ$?lRb9G|V1ljLbl>1&c=6;iky2y}BuK zwY}XS;T@%uZ?{kQ-L4Wxp73AvH~RKP|HuAB20!)>bP_QGox_bVhn=%dfQt^bfNO7* zRg4u^u~p}a-hq-LSYmN1RrQd$SO!Wb8)RbbT;?akW<-SD%m@}-hw_|~Yg6Ng~ zKuKrqOU3|m$u9E6mvBWs7>wdexQOqB-@Uj%52ovNd*gZ-8wVp)5kzB=I_p?`|H44| ze@Cx~wRODz{L5{9HnFX_Et=HSY-<%-dlk2KzLpOEqto5H4 z%|FP9zg!uc5o=lJ&6V+U>9y{;^jsM~mkt~huUttD)=JDND+xIG2jxntwsvCf*=Yd> zjU!h!J*!@OowMpq7#VC>91@=%moGkHQ!7FLy@GJzPY&Y2a<&0xxSF!W7^WZXX~W_%5B1$_gFgSz1COja~ZDn zy%XEuddK$;cCx_mJHC;AFpTg>e+V-mf~Z$tx3Gg_k^B)itUrR&wX7KONBXOkn5tK* ziGG|lWZX(s1zeTF{d_YtuECmt&NhP>*N^F{olTfrv%?N;a_ac@e}s=YCk^_fbJ0Qb z0DaNf9WdeDfve^=3N2uVNIL6Wblkh{FCtktUJL1DZdfN{<0ibtn29$7wdS}+ZD2Q_ zwc^>;B|d?3pO|f#*ywq&j@$&X6OSNg(uZ93qq;MGsE!&<>ZlrR>0>;o=+Rc#3i6>I zJ(q{AQ{;h#9BKy9FiD~s>#S-y$dN@f$SLBRIfqHQdyk{{#)nDTfCpHzsNT20udk%| z2kEYx-*EH65z^g!87WB=;mbvG8#|oU|p= z?Wi|eQb|*d4XZG%56)D1ma7kfLliI1%C}tA4=61$@~twXB*u{Z@q8=aXfOHJ%9zK+ zN-JviwNNz_wL;#Lm=vOtn3G8fy@skq*Bx#TH>%5UdumJ?PPL~SX*k`kiHYDEdz#q* z)90G0+_%GrA>J+Q&<@`Q$K5kS5-vi$RUbE$0Dvm3tEb)?=snsx zkcQ%ZWp~v(ltyD+ul3vzO(%H1=|=)+I+cOah016SC^Mi3(lPs3d|w4X{By_bBF~-4 zROFlDi<=Xt_@?2dEzQ_8-)vu?JHO6^#n^1$LLX)xeY3$rU%AiErk$`ZJt$rAjtX#9 zUdSJo5L^q5dSBnZu8{AWZ(MG!N4CwXhl*2gg~(#RqtTM9Ftz~s7whwS-`Z;*!?bM!;!0RKW|3Ylj{;TTESDov*fna_$35DOrd7RY>?MyeQUPggswHG9Y^)^VzGPg_o9IA{K!uHvc(C6Qz~G)BnNIJ@dcPJ+Vuni(1*4MX2z~sSB><#Y7L9!I1Iv`Kg3iulw-q$GgeX!)tCU0KyJU+7i%at zwl$v%xupfcOnWY56&s{c840x$HuaV-Njzb;gP!=Qc8{YTtM~$Ycrno`xmub>OlY+% z^u>TeUr9{uD)CKmwK2hYro(iUFR4_ng^Sx-IY&QEnlGtdje-(B${I(w^>Q3d#mk{GH6A-(7TA4rn-2!_5WY)v5+7;~I6*)l0@ps!?aq&Cf6nml2Pb zbW~l0CVNp0w&1`=!)YPO3|dG?2Q%Dwsc~7fkWSmMEK#mA*1=5}4rq4u$#( zx6T^Q*Di3g&~Tc=6IZqd=g>lOZvumg%5yj^q=CLB$br5ZbH5~nNsX_rDNUX4KvU!a z-$kc!Zp`J!_CO!2UjuyyVW~XmJMCxqwErAGi;bF0tmyG_yxAZfFK3(nBIE=!dSH- zi&ZV|LFgxdTWqe+1#Vei#;r9}^*h zX%a0b9JzPz4p~k^on~yQV(T57>}aSn&Pib;9>;(ckH$Gm9gjVDsk5sw#V)7LN#;ah zH=8=AERcvP3)BZ1Wn3S)7VuQ)GScR8!=s;D98}1geG;4@f$al*q)9q}pUn zWH{wU18=Z$Q%SHsD6?r;QaDLwQaA~X2-8ZF9#L%i%4A968#0}~QOI&rgINGsZfZDF z!_5WY&M(V!db!ZSBLz#?YTrv{Q!jmOj>cyT;J@EXb_1U4eTt;9avl_$d2)!p zvwMncLNZB~NY_YKBIogDHP`-iQcsm6o|5VG)c629Mly`OCd_?L{Wh+k|2Eg7yXVUB zfmoDq6LsO&;pnNqI(QQ%bYIw^zYdUbU;rojMwp}AM6xTsY=tU?L3E?1er1KK1pR7! z0RI|4K46qThNsG1Qa(ewWErc|w8+0n2R8YU3RA~aNxS4GOhKD0P@%D=O4@GWO;@^R zRgxZTQzgx}=i6G@<)BeY=i7T?;XQVp?b!2v2QP#;_5&@RpTm^c2i(&q{hmlWLQJ;e9RY_tJ2JR%ei|1A#z9qBhTf6kk z`l`gszS-0%g4;JE5_f{l=tqla2caXsDydr!jHy>8Jr|L(JCpD`Qm;yi$UTsEd(L=eM=tf8aVJK7 z`ft4^N&Hl%(@#fni8Yu7kmb0BGwG*$Efs1`d)W{mfPUhqGJ}5lYY5I?kHTObB^xB5 z26npMU=KY z*V06sYk4^yak*u2YZFo2dUfkqiq)-8#v)F(z8ni*Ze7tPMpV%zx2;K?+cw%Z77=Y* za-)eTxpC=@v52KNPWY0EnDC{2Uy4QS`_kg}CSq~>tLt@U3q;rg$f`ARIGGhdnT)fh10tKqL3s_@sRemxd3_3P0%5dHeb z?;EO(-+%Y}F{*dJe>DzV{eJDEhN||_eUHYd_C4Caa}4O;c~=)hwX4gAU1AX*b{YOu z3>f~@)MpIU)Mpkv6N^~z%(ghN?V0({8>;!wzwvyG>W$~$j|1;NU+@bQ7MAqMN>JG@T zp?_kYPu`?!XgF7}04aL?{967k-)~_`|R^Ao4+ml!1?x+XkqHO3m zAMbhR_nmya7~D1Na2_#|9SJXTE*y+g7OHPn-`2 zhWMz5n!g8{f*7vuzPTwZ2rcKZ~A)Zs-5x85zNSDFf!uXk#B1nPV)c6sq_ED zsq_EDX-rW58^o!ILj8*V6Gdj6s^Etgr%76XU^=TRR%r9z^}zg8narUD?yK0efR@D` z%U(vS2%@C&k70*$`ZV;30S$ffeq{juPEnuIK3dRFX`iKijO<_9r=gE)AZX~5%SlQh zK5~DR_bZL()Sr&aadw3b)gMJgFr9TQD|F#+pCOZS|31H)$rc3DSs$}Pm7k@)DgtW) zb_PqxHGz!*?2o|nVPjxR0JYM9`kLAEWX~9IvgiEg4ZzHpJ=T~AYAbv^5Q z>UyDT&yD6JC;lFGX!P^b;=r`$=RdEBIIB-rc{#yI&@J~k1k+i?v_fM(OSvZ{SMYWJ zXaNM%Ssk@Pr8<+@snJxdMy7pQEqqsMZZkK*Sp?H5w^?;_D^#WP`*bC%Zyrj+UeYv4 zp|r_qGMy%;U2b88c72vi@>+&lx-A-RS=!RHXlctxOSD@Kw1H`lAALLq9DRJoPYuA$ zQ1SSh$K4iP^Z4$^O^fb+eBa}`vFQ9y2J0laP<8N6C&z)wKb?UME4Hb8>dKqYrlO78 zq6-jAXU*FRE&D9xK6%608{C!E*&A}&Vm$^oi=4K(ZBe=t=*iWOEPONuEPS*!25`9# zK63aGx7>#x>HnxHcmGEhKI)cx;iFMbQiYKpeYDoabLvmm#8cWv+qy+vf?zsfEn$Un zK1)%T-uNybF`p*s-5VQjlAb$NLMJ{81KZnQZSQ7s62Wv{3t6H0pQS3QKTkz?*IjjYxm~XAu5)*x%fWoz5`(7*5@L6j8 z@OO@V$2IL9`_6^$m}dztd?)`u!00jz6DaQnU{Wtr5oh)3hRK-+hJDxVoChC_eD5<=Q|WihP1=+H zIp@L8l(wK#Q75-Wi#om92`!otcIeekkxrY5AWh6Gaxs1JzVeNIrXQjkcP*PKJH5OqmQ3^+(`9vk6(Bkyj%cdZ$2^W zCoy2wPikWTe`o&_2cB@bJn+P&Ck&UDo|yF$m&;i{iRvV1!{|?HT|B4$bX@LxazMH} zfelE{OPA@Cm;OeE6)N~FL;8Hi|tQgRXArKInR+t0~=)t{-(pfi|ObA9am%Hvsdus@v*rZs}Hc+ttmKZdbQq-QCg+ z>t4u7=A(3l-6JlZQ-8YBo$NXJSyvo~o}K(Gl#ge_&sm`vpQUtLdTsCJmTr5mJ-tln z_Vn7<3k9k}>Gt&sKW6~uZ%*$8z1`9+=v~#@l&-4x#olh|F7_VANh(pgVb6u1(|94L zOG@R3<7b$_OcN+GfmtRn+XUvAz+4lUX9Dw0V1WrNG=W7Xu-F93O<;)$ER`f~m+5r- zQMNP#yhUcwEk~7tyA$BV=pR1=F}GCGNm-^Ks+y9#)Yl~$FKhYq*D@JYqHZD(PJ7OTDPAt1)kUbV{7 zd(7-%7BM;*DEv zL)o{wi8!2YT?XD!^6tH5&}U zmjFgAdxkH8e1>ni5B_$D2mNy2yNLwvvU?0p)G!U7+@b@%(SFx?0SPs7w0}!ey1q6P|&6gjU%u8g=4l z7Xq%4i9U_z);dEW8+*jdB{leu`ppdHAM0QSgR(T%nc(iK)0*HGcuBB-J#7gdi~|RQ z9|z5lUoPp8Gc15!zCx1V7thmW5v5Orkzu0T&yRTPs4V(sI=XlIeu?3sk(rEaPU+*| zsX0#KHS^}2kRR{UMCtVJ&a~G=9=t2{mNyNR8<|lJXVL%KD0$>*_#eh+59OR*mn425 z)9D9;abkY3wG=zLORY*kmDWh!m;+6Q%%Y6JIJHlMfzA?){uD`nkRj7`(oUZ`%|%>` zrU(1SxL~uZ-ufP74aV3E!MmLDtdTZm005lvR%?gl_Kh9ZQOop=qt-FFccPojC2hc2 z)-UYPD%y$xtbwgG5?#nIUjDXx`M)U2uQ}t{@QviB3abTE=ZE>DF7_UGrPx_j>fxE{T*YbBzOA zt{iI|*vzS4ekMSXz!PL&?1w!*i^R=l>tTlxYGAS{qe~I_B%GHu<4v>(kB-o$s5J9q}(tg>14hZL&26;+5 zjLe6KJtfzx0EPsENci;6WG4M=yM%8LjiIURBt%oGoCBbE`DK@xmrG6Opi&u;0T%Qq zF-7EdFF2S+z!#23`)6RL8HsvKcJx_3| z>Bl>zaiG+h?HH=r&dGoYpA4J}#J(?NGv*aO_~24zGJgQU8H8aoT5O-NWj39#i~K6| zD3a`O4mvV}4mx`R>=SuCnx?7dd0*<@;kc(Vo90LLfujLTa?QPhc79xf&Ns3ZQg^wm z(J_6(4%NtyH_Gm-iQH0Hm4d{W16u>HpKc;gFNh_L8L|S8%l+G ze`au~9O~voL*?Sw2Nuiq61(wSkoEFocA!C_z`Bu%;M@q@=Kr>w(n!pYonM%*7U}vx zms+HXeLO$00-r{Y<02dQq^HsAvJxt6CH^v~QZ9qf^)huzVH%-RDq_h@eQRC@Ra>KR z-f=WdW@oW9PGyBQ_l>7J#}}^CIi?gcjaI4kN_L_3oZ~L!SY*j;DzXk+xEGQRTjwm8 z3|z`=q&XtPN_OKkGM!GT$M+>@Z4;)-IzLUmx1N|U5+>a6<{E3-< zAO|SEQ@>Pg0*9N_aSb0=7x_Jv7EA&~7MBK4sak~+Lc*+4n-m0vj@YDXJy5MW9#4a; z^kHwXGQ|6wOY9v*#C$~O$#r!*PdT>VUC>dEJ>0z^7Gi0*J<8|a2#b>(NC;|u8i#4Y zEIWG-w0iuMy+(~ ziK^5k6TGAr#1|C{toQg9DUiQsRbyU3a69c~`vT8Fw3l$)83(vEe2U(;y^prNZ=Z^t zr$1#6KzaD;luxdYy+)T$EWVg<{p$N%$Pa&VtD&CXQJ2uaQJeY{VN2Re2TgxFNaxAn z1ApjZ=eff8_#gBHB>&%9@vTUF&Gf^s-J`n~-IHkqB4xf4laxZXqUQ?XQ(7n&C>8qo zr$MwPahsdJkge&qdoj^9{%=F#C6|a^`kgP#p7->-9G)K_qjThJJ#he-Emy}PR-@)! z`W&Ti$6=z^)SJpgys0k4!WYyvHg7S}HMPPrL@TV*vG8f@QtUAGC2JL828p@&G|;ZO{h>3SKD*1isJ#m_dR> z2ha=>^x)ILl$ii}t__HEaws zf#D`F!URSN677*{q@c8pNHtPWtB&~AC_&;zM2$AYd4fc1V8)n0$OOikK-dKGO<Qq4@*$q&0 z zl0|e^Hbyw!&bc3PyM#MtcAI|lj^Obw@Y;#)E_m&P`^{bxwa+xzeiNuOf%iQy` zwf&dA9+Cb~C+*Z7k%z4S0IkKIvL=!ToJfm&aZn(atJXx4U1=h%BNa+#)DHU;F2_G* zFVaWZPY60d^@PR72|-6_tS!6ISbMq6#*^jtTHB3UBHv(J{s}x?*q=85krs1YCg;4( z+RI0BPY8O?I&6a1Vc{Qqq%n6V1&LHt$tgkNQ8T+e`U6+Hdg2LpntLJ|JLDC$3vUmG zHvc{Bgc{)URe1Z%+fBlmx6ew5n|1rj1bF4`hhnscZa;Rr`67;xt0Nq;Z^m+`fiXT0q0yv%s{jhC_Wf}N8$UOw}(-aDf+FNZkEjJ{!qLVuX_ z2aV^{pJUPY*@tb{Y2dJ(<8$~10+?Oq{I>S@L54z`UkPhIr~G!#Z{0@y99f%RY4vFi-*SYe+uJR#dyt_}m1(*y-S&3-{F|<()z(%n z%UfIRZiS`;!@FD6wL$~2&)vDKquDXwXm+@Z0l4XkvP-jF*-)CjG~39ArP)WZjfPe{ znmvq@T!5e%)+OBK|BTj}+^(#hTlBJaOWMU{L-hM4kGZk|e&t-s<=>Bf|MPFH585>t zmK)lgYKPXsKs(hg=O(nt3{>!fhb}!711>!j`Mv?T9P1z2^pHEyHa+ygLuR0T@X(=$ zbgR%u4_{%2!etm}R~|0p^b8b!Kk|J|#94ig0;l?>nw#9FtGQ|WO{fR-+U+;haXpMd zJybln@Ovma0}H>mI|eZG?>~6(LATc)eDLE3O|Sj+~m3kMr-2a(V`$ch_PMosA)<#OGNL3p$o}bnBtKPC0rTyrklMlJ2J^9duhfHZNxRR|DrM>h}l*JSP=C`_2 zO((Z)YdY0;GNrBWRP?ZJLn?ZBIVYKq(k_2E>f$-|=UCd3M_x7O_FsLZ>=Bd}LcQ#f z*^i)Y8!)10KN9I|0Ot4ONBTeN%JKe>7CdU?c)_C+-Gd|a(W6%$MUotp_R6D$oSuQg z&XLZ#N;s>}vFO7xMj3zXQ5h35P;|)g2^obMV0}Isx-eruJ7)u6e(N(1Ww;G}C?hA+ zG;~hpfJ|K~TAmr@B$X(7G;@0#*q*uHCE~0;$D*I?dA6t9$Itf6dDav?=h*?zqUg&| z^a0OS^)dkSTl4JJXWgQ2efH3^rs#*BJ@Twu^r^k(a*`?(eQvLcI8f26s+T6>tUkx0 zmpwQ4Ik)I@pDTaP6uta8y+YuVUrV36%xC!kFu#MIANsso^r6p}Ja39#^87aUm>+F> z{v;4F2C#RWm)yE2`=`#daifW9ZQ=zGtz(fy(}wb7kFMI@lRWftB2 zQ;xi(&Exd-0sL`*_sA@|XMq0rWkKRznNIhf=V*Z6ky-Se^E&!UVrqci)E^s05nx8I z3KI8#bp*ID*9>;&LVMtQjy-23^j*Y1sJ~Kib#CRY^}1J=(kj;Ie-4gt@W2O*=VY- z8N;2)KYp?mbI=(7WOhqZ|C7y8W+sX}cz7GJP{&DPlV8k@~k{R_|Me(~#AA?Vk?^CNp~ zzE6a+Ne)gx?B{rx~J_!^b3yR01BpH+nL^@uoQ8O9RG5z$zlDaCW4MBYNwIETr$RcH>H^-RcnbZ|RWwSfQi(>951V zDYHYvwb(mfp&J^9ls2(rHzax*#7vW(Oh+Qs! z4%Kl^mGdT9fbZ_ig8Q*}&D^0yugRH`Wdq7fGi8yALq)2=?6p&aIs#uDUTFsC8#AT* zr4l}FaXn1-OeuTdYu(N%i=U(l#Bsj`4i~2eN!%vW={7vD3$JG_{v%q*21(p$wh8Wx zEp&q)IQx|<~TN(T4JbAZpu$@(FJ$*O{62361so8wp5 zn{m(aHvdjP!#n+_bl{YK25%=O(NjI}Vl4F-j}AMYGal2A_R7P64|B%z`_W{zh-4Nm zqLqFoU+J&*qv?`pv)ZA@JC5eOr|Olz3;JmocQ$Xf&_4R`?q;iklHhU~g2z_ap$b~* z_aflTJ%onibcH^Ug_rjn9uZjXjG}^gQ~{L|u$r)xD##rBLM{Vo5&Tkmg&kT%6@()g zy>wfAa?E6_f@C*lO81Q;lV+(r6L4=XhIvh| zR**%U28l{#9X?zq*Ev?Gv@fl5^4Py5nM(11X%-#em@$ZXEucSNDl2*K&qH&7EYKX_ zCrb+Y(kViI1&OH+NY1Z8(>8E#oza(aY|zd~r2QnW8l?7+Nu~z*F*Z>5(OI%Wd41_D ze=@HxN|j^hz;cy10#?>y8xL z>{8sR!bOQ=KV&Snij)6&0g=r=Ex^B%D1}72XRc1qa`>uw%>G%wfp0R#HBFL}J#*+} zSsI&Og-oFbo<{AYP_7KKhJ?^)mdO8(-2dnNeenVCmr9}~bm7MT%}8_tzVUx^GH+DR z#6z(&=v{P zDpeO+N-J#Hg;v=6Q{d_iN8fr(7Fl!{M}o5`SItp8hb>cEEtySQt)&DwMwzK8vt7!g zeQBAhg}ZpIg*=bO^UNT)kIGES;XKFmqh+evl37&EdCu=gOKH9>vuM7(%;9-ynX?^I zupe!A-qC?~oYRiXpy7cf0j5|ISQn64v@U>e;a2n(6ba4=x_$?9f|rx@;XX)*%Srt3 zQopdiPnNDGtx5^<(LeWo*%mYy-o@D{Tg0j4DYXTClsqs6U7-d2?hj}g)Lm`k0$!)g z1AT*iI?ElGIK3cMq=Sc4C2yGLav{qh~|OfBj8U&;*nP8tP5Gl=%WV2Jir*W^%wNl{ zIz={>1I zqv{f1_{@6f!Roy~vO=@_!M!t^diLRPpTEm&MEx5}vB%3bbLA;yoqFFJ{k}TtEi*Vl zwO|b2K#SE?^e1yTNY9F)8K(IS?sfWx6GvHe~FxaxkTs0kzL%# zY`QxeIc5JcmQzW;=?gvkHTz9ewqyT53^5Ma&a%5p_9ss^hX6U}*|4dguL+Q|;)7FQe@3 za2tOH@QvZ#jlO)H0yG|zmn^6~%MkH$<`@Af(iK`MLzMUs# zQ1Sx4Ij$XzOPP^!ed>73l$5n8=mzcnb=JqW8rw>@2#syErj;+9jZd_uRkT%*C4fH4 z5^Xi9wHKb$dQNMX7A>}^)uh&%+3HsLtGrzPs3CJJMVWO@jE=B18j4R%@nc&-HhGdjIcvri(Svu=}+!X#h)5t zzWBq`Xnx!Ql%rJ`b5{n|pP%Jpw~+Sgz6FeC3H_gm|Ca4+?Vs0iL3> z1D$x$n=VI?_yS4{PyKRbD!*KljEUu{%88x+$gzgF zqm{;6#U}U~4aNd38|B5P)-j5m9DDM>_rOvVJO9?&+`}* zN1z3DpbP!?9tGp<9vqeIB7pwyDbUEK$SMh=XO*l4xKvd^GpkY?c|IB-=vV(OGj!^w zKQS3c3{aC<*bNjUo-{4~yh?AIpp*S|H9zx|uREs$sUtvI%{4HWdZ z{=Bk7=x?qK@o)XvhRAP=4HOiT`BG+5zFdaCw@{8us+DIprN%4t=1Gt01dzz4=?m)u{ydlscaPpI0L+ zFZ~EBWTC_voH}F`THbOLTBQ~^&)`QKsnnXoV3r2wSW!*gTf5(bsX*isuLf zI?62S*imLs$CogV3>I{2N0~_-XYxXGu%O5I`Y@1k8l1|~ujU}MhUd{Cg4*9AGw7DH zQfAN_cvUBZk8M@L{@9HwWjPN!Kl=f)>B7O$s+6Z5 zFss?dA+kSXhD6|uM4^WY>UfqLd#Iq7&#<5wD(E+CTNwb32FTaJ(d!Uy-RTSt5_h8< zs1X@7Lv6)z^sUgYGXxS2kbLjcOt}Gt+5qYd%2BhF%%oYM&Y-Q>$I4{tN@S`NZonII zT^KtH_fu6HC8HZ9)v z4fDhNM#KE&ewj_@{3{&Dz!lE;ApXY(m-Cg@NFG%XY$F7vKP@xp>Ao_9`p(7m*8TWH zPajvQFiB=oX;LH!+jGbrS@fiO>pdHa*9bu$``>WT!AA(1 z8>|SrL0#OD_GsKmG8!kFvZ>mxg?X~pQwLrCQJJUEx}XYm;_^WOhBAzq|1eLo%ld`& z3r=)gjWRb5;08S!WzFZi!dU0Q+0qx$=5AZP7?EBt2i6=C5M{E!@gf9gQ3k0{CNHsG zcu5VgtkBT^MFXrMIxxg4(}6N;g$31dh4lgde_*XAnMLdAT_4cz`lj&S9Jnfjj)bqN zQ2W?Ny1JMz$1vSo%5&c2>h4qN=Icr)(0yg+PVrx|4w$Ja|$KjENF-|2KR#q8Uua58&j;6 zCnXjGCXW^JC}!!Sa-x#mX{CBcVJ8MBdh?)0=gB>|oNkXb505#{^Y075_JQbXm^Z8C z9=@e+k97j}S(F$V$Rb=lF!gJTJ1v( zjutf4e$AG>sLY<{$HHc`pbru3&RoBZZ$87pe^Qqhd?kF$69xMxwf>KzEBzZyM(_FG z^UJREo`0_6mhFuH5=Y{YcEYIpOI&^Y%PTSWlvhTx*3O-fLb8B0whRpx$Vm*k<93p4 zV9<>{CP(sY;>M0t5e2y*)m>WqEiZdCZBi_g(G?*VE*DQ{)OKnfeQhSLf za;3e)8@aIbL1=sj$eQ|zjedT^LiBXlm-tS3R z??31DM?2>q=)~J|pflKswdiPPqT@+8(V6S@!kX)>cVb@@+)DkLjtuJ;rAA7<&P~zmX>>s!E`_mRQ3GJ_j__nd-=Fn(DlTzqg!S zdIxKlvzI5orYQv9Pw?*^15xi7h{{?9-R7*75grom2#Kf_D&EUis9JAit=g(|XXRVL{`h)-pJi@cia{N08Hqb-Yw^G!|PVi41W*PU`XJR z)okkA3%e4%Uc#gg+>d2f`Z4yeZ>Pm_xx|8Exvb`YeAOiVvFt`ao~IPFkg;$|_LSqE z$t;XD1C!N4I3a0Zp<1hA?h41$S!OLm5B9U_f+yJpRmfu5jjXUvF_@)kPgx^eQQ9Ny z&wlrB1`R6Zr=h_ZP%NQ2e95A;z~q7`M$YETmqcyTjPmb;~T8S zC8EarXZqnZ=yEsHzru)1#IEqK^P@pD>+AdrAue6OIp}y29&`>HafyV7o%61^1a#iX z4{{#@FgI8i^dzhcp1?B4{r-vI**N9p;P51Os3GC-q}gU618{ayeNvpa!sPkMZaX4! zesXYq1tztB$4M9)wsP-5JFT0Oa*`Xh>rPO|oah{cg5hZCjyf{ixc07x4S` zIsBco^L>oY_bu~54IC@zU0IG*d^z*jhx7m45H^*J6*N#zU|n^rpiok2lI%*QN%i=v zPby5dLNi=`5=)8uW!SQ!16jfiWST%16UY`4chJDTN@rwE5b_9!WzcL_QV0*DQpi4m zS&U8u&ax922+Coft)!y__46o!pt&Z<)LA}*kK_xQNQJmYqLB0Gq)ECl$r5`ZR)QtY zhYncG7gXXz9G9gT&RhrDYQCV2&QV9E)0=^4K&DewU_1M$5VM0P687nEy_vs_*l`qr`IR=%KxzBN7-s&U=Bam?T+H#>5XT{#2TM7hzravBdW zc{GPFZO5n3%=&V6PUPp=KCC~f@tiu3@-Q2Is_c=aynfI5WX4C^g*J?Q|G4Ms-uJ5C?dty^n@=v`r%T`8U+i~>@JRo1UQb~-#J@e#AL5lJ zx~)qvPLRO$lXOu<0}wJmyv=q%gf_FdL#QV@<2XU%sE#k987F9~y$2Gc*uR=TJ5Er( zy%Uz2V*jgbNEjz*x_>K|e4L>5{-}eM=r}=RVI$8F2wsy73ZrVApv|}lvkPNKT2pxF zj}tV~D&nC(PEfsli5r@OXKf7qae_Yfjped(a1;;yae_uW%UNWB_gE=B-;E

x^dnaoa%}BoQiJh#QAx ze=OB-n&IB$!k-;Z!!eq!PwUC|039*kJq4XJn^SwRAJQrF;Uje1(0T|w!LV z{ipfL4fgs3o;En(KjsGyxJIp`Os9@D61@%JH_(mcH{y7FUu3O{g zMIaTV69lz>+>L7YWf$|+yOH|@LHB$I9czN12Oq|ahfCUc#zo*ZxQ)XScw0xC7rFxI zj*lU;0zqHsphCT=!=L#IV9=X{U+M^Lw&S1qmZ<9xexZXe%$F`xhsR9lu|NCaQq>!~ zI0Yj9k$e9Pjtd0|TuvxB^a$VPHe%Y*V1pUo%~bU+^Cy@EnPm-XgHRPDj8 zO%4r!1#HhuR=bgL(yk=ae?SfeZ!BwmSUMz4(2yW_4!X{3Ccx6<`y%iFRc zA+|xDOEjjRlNS>a7v)OJYh9<6)_SwBLqXPC>*Me906-bD*ig6Ls`XOVS|Rf0B$)La zUZA27T~NYeK{=|7J2r4S7B@DAz02pY91By4ULw<2+_lPXH(`gasZzET>hhLaE3ose z`T58`W5*ZrXY7l(M%fid`V+DXO~Gzz7rt*<_M{v;&qiY)dNA9W5!%F>G(zw4Xr3%+ zid>4NQ4Rbho}nXHz+_Ol8iD=O%hqrVFPy@V&rptikZs441r5PW)?FYN&;6B=JT#Dd z?2Aj~O74ycNH-d{Sei8;8YDS2)&hbfQ)L&rp*>1bqOJcB040LbTFG>};Tf4l&-9kv zsrN7(1{|h_!O%7g?&evXewd2zx}Zc*@BX}NTOue|7E6e<5gXG&`>mPj$F%H5N_rCBF6O; zLCLow66Oma1c{pix)d z(s966w08gb#DFCIn2e-*p4Iq!o&^I6Ii>S~(*y>-8fW0E_xQPQVIETS;GcA|o4<|y+N90Kv zU{67QdE%rT2$$!Kum%UJh3sQw;DxGEI}N$~jY+hU-XeBA(n-MM2y3b(v#8SA$eOw$F@_sW@d3Il?w@15r(?&;Vi`pH<3MQG zq2eZRe$W$dGU&<?cQZo0G3NyrS}8$jcU&5Wp$ z@f5+sd$`{d<&Mx+!cLljw^AJ?bLkAGju!b+7=xj~i5B^``Vxt@`gS%Z+Ubk>6N#e! zjs8YCZS-$%jN0zs*%-Cc|6Zf4-t#v!CTj4XY>YbTKiwF0+CRZb;0hH~Y?tbp9!Fmn z*_&;=C&L=bW_y_rO~s2#S{5r3H+|TlsQ*2GJpMiZ6~9S}e7%D$afsmfY8K?Q_<~1N zexXBrgoBk1jp1G%;$D|!BK2kYu~!B9SPt~4Km*lKk3d1@L)G#`09`<$zYN&I>QlC)%5>V2+K|epiW^ebHp6U9bewkLJx!mCT|MtuD8+aN78Cs{yTL z7F}+AxwVE{=khHsMDNNvBXsLzj?#}KojrN5=Hi^)$&U@e17%tITpAxttGC zisRH&X6ot1YTGoa z-`Y0Ynj*Kg+1&&Q;q;m{-AZOxJ9x#%Gr@JG^g_lj%0 zm`oCqVXQSK+SlSp6Woy&Ls~Yb8`2Ve8mC|5AHbxPzy=C--pLKb=K0*fxPUGg51?^@ zH33}L6L#g&n!vh15(KG1tP7k9CIf+jagtNPNLm8Pyw=NFCm>4OEN+v4z>rMH1Z+V? zNSyyQU+&C*D(C@E1uq4IJT!FlrQndHq)ZQDNYc7w5B<92+GH<%ZE{_50)1WboD>iJ zoRsnuFMWARG$nyPnld`oLq9rod}>gyN15I6sgcyAY!4!mI>$>tCv|NC{o2$WshIq* zV&x2Wq`v2+e=qe+0{xlP3yJw(NX>2LWgxfN$Yu!)jBGYBfnZ{@ONj)Rnw2(B((jRL z7D}5hY2GZ91217*Y_E|^n&+i8LFT1J(h@!vN!!@MQ#%`53~AXU(U6w;t(ze8TVHPN zNeBh02~BRB;Z2dl+vK%LU?Hzfej9IvAOk1Ha} z+4yb)%B1$~Wmjsyjcva+b?OddwoQNfi|j^!S<41_oBpzzy2^=p%89rx3T? z7T*K8?K`o3lLsGxeu4E69(;YIbAUHg80h?z2YBj_4yz@g`fGo$MWVkPjGZQJj;FzL z1S)~09Io>dojp8se$pvIE?CPyxytr4fCu62b+(6Won7ODBEVlnCQmNK@q?xE6v0vE z6rCZNPQ~^rn{QF^)01T^A^jwtgucKZZ}Ndy4061`Q|yYhPEVrx!wwrC{Pg6L?n9kV zj)>i-H$w6YnpiC!v`*oeHiB2^n)}Eia?H_pHu7~(v|JsAl?M7t*rCJf8qCIkpyORr zc@~PNU)j&ICRwf?n9kx;v0!jVZm<~mDMw9LxNS)FX9KdIS=3PpRahruZN&D1qA*I1 z`^3~{ez*~>Nt;pHBGy8=C!Mk9~^TWTel#1o$Od*Vf}L6cs5DFJ+GmF0zT zb)NWrypHMjtE^;i3xVMG)sWuRavkpmuEY7QbjFWkshv#Kaz7}>DBRDMPLmWUnWP%N zoLMwZm9k_j<(MBLakZ?LZW~q0gRw?BC=bQo%cnzfgknD-p0-A)smi_gil*ZB9Bxcx z_K6%`m-7@7Q@s=5R9V@mTUN?7jWBEE2ui3J8bM=tiw1oaJ%0=x#vu%VVTTUW@r2mp zG>NCg_UPCGEUfchbGc5ApcG@|W@|R*A8!~piR{LtR;Wra0rv7!NKEo2Hfjp3lX>hN zl|mcUhnPdAS+n`%{%mVE{*m80iR(0IqXMQY?Y0i_?1Cg4l^zGQQ5{!icpO(JJ*{z4 zO|jx_GsRkL8M?*R5=^l?Mf{&p*Vn6`Pbm8*R7xrdpL-byUg+2NncXXk=-v{(EUp=~ zzf)$@o%gCxFS-{uAX7w^*ecWuQRLfIgGdiU5cp`63`r*(1 zf<)Wc_Y$E2!h3O03D5A5w|w2nefPPy;N16+o17lP6CT(jc=5O9evttJgzRNO_q}Y! z)XV>EM$|w2gy+_xMj!voF#`pO&W6v!RoweLXZ{*!cm1Ng%3D)+(IF94P1{ zf;}0#4%_KnsL(fu-#Q;CsMe~*;j&t5C&?}}+86dE#;>!EuyfEroaR0Tx4vW6WVrQ} zx;GjQ6x8|0y4L8&J)ruqEuMP(EPxv)H1M;l(gR(UgOvu^oHtnIsQ|>62J=+08w;C0 z72~v6Jf~W<&hmiktZB9S01jy+&1P%veS2`S+$Q%DOF<26mU1@DFf&&_nr1~WI15ka^=wvKi1`3+%gm8u- z6etN=q0N1%An8gn0-W6vr!XKhsgNV9`cf%JR_Vw^_*MoT4wMApOcF`DlFa_20|l)K zt_|We3O?K2{cIgR8%>70)j#eNqVp$q7xAh3*#D2cH;=Efy7q_n+Rr*uf)d+bTY5XC z-r8EHI@F4^RctRp9ZyaYdXj*ot+c2eoYATfh7&><4~Ia2OawxhXEi~=h=v&%WD=1E zZ4kr>u!<=9e!goz&pFS@1X%C=z4!gR|D3b;+H0@9pS7p8*Is+=7JclC^0LS2`wRHr z%RU1UhHb%9+Ol!u9r_KqoF%$xenTJ90cZ_6~Q%1F4<*V@pVCiC_HNLl9Q6ajo)4opj470CO zb0>T3ien*_XaUqDm27m}iS?CS-%k=(@~(X8&InAm#c%9k)62y8(8uY0DVzKDqcHa?6XQ`IU(%1l!0FzP^6+om zy(K8di}>?EY##mcHV8cTtM5^eZ_ESh0<3;&{<~I5NdfNKpF;5Xn$3TD82JMHU*dBi zz^~InafuM%LOoVC*@^797H_YKrBo#nDLlti(GeRAxA|4HOoM9yu7as`2EPW`H=F+< zUU`5qUjPU-Ae4)cQ^Q2@N5pA;+i7F<6sa2A)!k{22EMblnC65TR2@Fg)Y&LMSMpN*L0b;1b*$%o1pO6}kA2GIkf%i(OC`Cm{>y z;()}Yhxp2VI@+E4!2>qe%8s@>@1g@}*aP$tA@L)MX#7VsTnGxOev<1?lc7eMEV+8| zF8T=3BUxj!V zCp}97Js*a{GbDs1e*1lt#rGi|6fb4%lvnTW&m$Dx%MbB&^`<`~F6ANK#gMrU<&99> z6Alr7KTt=*Jg^L-t&D&b7OdNUPg#-}XV>B?v7LdkfvZu6BE>)LN?C#xn0Ou z(!=4AeYjO-Awdzmo+VbCfw-DAAm-|3o4F(?ERoD|8Ht5g(&Q z(*__W*B3@APQQV&`G$cQwQmSs(8dc2nR^FPF4s%O?gF@dAceV}c3@iDAsNDw0V8ju z;#yjdhFcGW9LaE+0)96Tc<{=$H||SwFBF;RyYh{VdXIKm_ci^R?H$!PVl&qvk^3sl zD#ePg>ShOS+l$L5d#M=;ux4sBjBV5#;!qV)9#=`q;=xi34D`}zlW?e|Y4jXLg*odc__^&C< zzefB*Cmu5KG$)>I;$5705`O;z@UuWl2pWvjl+b@5h1~U@N((_EsgmwW!7Ivo1X zYwb?W*N!1Os0<2LbiqY~Bk*$y@y~QCC<52rb9lnwQ?XBasqQ<$P;esfGLYx7KD9vF00BzDn!Vh{=Hgbz-I!^I_^`;E&ZDxGgo{fV$ib>L& zCyA%wAg{y29bw}G=NhL5*KGGDY5+es*HDPB$pUw?$}t0#(@D5j=98Y!Jz%84$>wWr zqM)E;b2%**W#3|6%`&D}^HH-NAN3$}zR8?z7fo4GfXSW3<+NG`+iKc`^RBKMFJFB zpW>ywpb{rLmpV;(>E%vK^5y2N(I^_>iRUT`@l`cu)kgek%I2#P?_!8t4OT}L-}nd0 z;y)lEUlOjnk23f^#0QA8leSA+>FUMsuOg+bG;1W{QX1l23=t`9g5n$Rpe(-Q0Su}K z#-s7a6R`3H>$*EALlOt@0~Kh>3P~Jb+@W0NeD!6kNsTT}1M$xk;y*u*k3CACV2b5WM8-%HHycJcnW#AZM#|!S(l+7bHk{iTXA!rS zK_)4qV%c04>zENXVtShipjgV|W^;1%rhW^txA5vvP|D8O1tA4Bm2oNPeI(@ze27%` zi)MDd1fSUbixNrx90gYjt|g#beBS6*9&Z_g)E!Tnn1@K7z%YHHT+5OJ-wfR;o4fxR z;?tk;`fQko(sY^0apM>Z$kPPu0S=`s?v8l66AzpCg(jX@kxo|~5J@wcqzZ_4apGrB z^!Iq=m4`}Q!w#8$zplT3f4&Ouci=Roq=WmFl1C*Jv+zkG;HN(&zsH_t$avMnxR;` zDdQZ0!~q$-JJ|rEgzue`8jr{DC~dKBK|>1r*&QCEmc8Q+Tk(Cz@0{=Z-J{+Np}~(1 zl8dTQDDVc=QX*1I^GWQHBxydauw%VqeqKS(xnj@J2yHNtHbNI`yWrx)+#)r4U=T)k zfwBWb6sr_KhALL62n=)Hzn&~FMj?7DW%8|)wK#?xruh4}Qih2S5M9+_Ixb3fD3z|D zAYTz<_%K2AVanu(=Mf%+oCg^qQyH+ML4J6i>jBhxbX3%_ILbIm#n_u=LkDdLWdT`7 z(|I06WezsrumNAl^JtRn8;2{NWIrG=T=9?KE$!hLV+OO!rfid?3(uos*}n}}ywX}L zC$rE)C7I*>FmWvK!%KZ);e|Q@Pj>w+lXGK4GbocY z%HW_(^dCmd?T=-ve?(;HLdDZ@a$xi$WAp|w^(s_c0N*xwlI!~!lwqjkOZ)>pLF!$o z_%56Z;@;n1?uR>cgzkTu9DnF-)ZqTLgwa!|`2K0wflq_ifLt!8>7wjI!2*$jp3^U& zLEy&j1-(ss`-sCmNm{G7Y3eJ%t=7w8|5d1XtM!pZdHj*}u|@s(W2-=%^cE^^5{Rf_ zR8RCcXmRBECJ0Uzq^p9TK4XRVN!tWLGjJ;f`L6rnw#<+A0*9}V4eYCJ3*+=m0g(x7ec3;We1I}yBMBg-jmr7b#J?Z1#l^mDVy)F{22Tl zr8xb^HpB!*EBmoX6UgN5JussG{3w1O#V*#~M$1YmkAFS*C_1*JrO6ii8=sM3>}bW^ zd!QU_i=Ds^FZLKSz>6=1*)t4nuIS-}?zzXFJMX#AnLF=`$~!G$d*Y^J2#!^p)ep0N zzY($qk3csLn$6_hcHl?7(JJEsNxH+pb%eyxY@F#!{?2phh+= zX$_MZEvopW^_e(li7MW0H92{YSjPp5J>Inx#RZ&_SR{IgAOQGCnnEsKB3+Ab`e zpm@EtS(;;l;#t-r2fD&q?Lb@7de0gqjWj{=P%dN))(MLDTZf#y$E{DKk+2KC0y6*t z#u`1QxLY;Zux@i@NsK8TOHhBwo;86O&-){JY+xm=BP)7h5U-NBm~Et2M0^AIrxfC!0-VP34ogV(x9T>^HrQPZ*lc@md#)pL*s^}Nm8kvQ zOU^aYcU-c*q+7D6ZMJvaAO)2u{%$wa0ki~yE!VX!mqORBvr@1yVws0nCh3#~xE#Wo zc-X|vChOWh7EVX{Y{LA!iPl+&%9iKaJ~(0NV}755-tRflc6R3iy;@f2Ns8|)!YN;o zNidrcx!w=Ic-NvA!L!_TPC(=oI86H`AP98F`T#d)8Gs;=4M>546Qm$tI!9&?M6aYw zzH*M4Jxn~rS6)p)zWRC!@%2adi>fM^08v^&Y63=9{L0o6)^NO`+ytO&scinr+qPO&1^Qxe}22U<^qZ4_S?ZB+{ndg+wCh2gPizEy-7Ie#5X0!h1ws- zi#BM8;sW|qgmly~`AZTwEfU)KmVfD|WNHLas{kx6u$BsIThktGEfhmaq_o4CtUg zffbfbdkNJ;J7_ZI3+SITRCdrP&?))C8_|)6DZcm?yDk|yC@81n!qqLwU(!|$TH^fo z5QdhZHwC%(OR`Bc(M&`|c1HYid>I0Ap7fI0A`Vxa)tj=oH%>*na{)S17VoC#MVb0M zwrp9v9fllPqE~oVmsns-i8ailq3j;6_#}LI=5mR(8*1>~)cE)1UbouGA&flp{eyS%UG;yEJH5^>VSG zdPz=O1SRheSor?X!Iui!Tl|qoS;JMEU#og2^R=xHXo+)%CAZAhGJYmSt;Y*;=0jR$ zZ>#NE;<%c+WzuQ0Ls|32vR zoi7p~L4l0Xk+@?|0dz;2Q3~}GYpWHIU{=t_(4+9jR3s9ND0SB3IluLiVsuSa0Oi@B z0YYv)HOUNEsJQn^F}N&L+%CT|~)sTaZE={4*wiKd(fOSxMDm zVN`AH7byS_L+-caz@tdbm5#@t(^IJ+-u(6{4yz%{U`yV2>jRhgDJUx@H@y;Q_b)H#^U$TKN(l2t8+K5g*} z=2Bq_^2azYFXL0t7zKHzu0v0*gXCEzmQF@>K1O=-7#)QKKS!^Y=xTk!wCkDD`qSgk zHqsmsZbmA;_kPOYF^FfJRav6V|8lBSrsv2)ItPO^#B23-iEal2LQ<)jdJYuMP=T)1 zYn?arf#@|mNWnTIUN%~dmaRf;w6Y2rS0o?P9^`!t1C}P9jDr?!FiTok_TZ*Fk-pA==pk zz%jvLnDMd%`Yl_`8>P7K@1Z&vrTF0|oJu;SefJkO`uFdl5KpDWVqRnl$v35kgxpOi zT|(`CLcEx>!F5%B2rVYcunSN6!gh;vy zKoAVmMmueTLZod*E4yuAUWT@rMoXk^OdXd6>_ z(igT{q$~GnamFajYZy1lZ8KNe2B|IDX0mL=ks#bcphep>OWTZ5+;-cHfhYcEjkX!1 zxDqZGjM?6|nzcMzFvb}-W1O}@Ax>##+>B9X+_Y|+W)UUED2Lz3+ukRbwmD1OH&8@| z*a)`MHXRk|%H3|Y930pW{vPuN0(~(g5cr96Qu~u$=F*H<3H~ZXVgAc{42JdePq`29 zPdbU{NqR;ekshn~#t`N3-(Q4G@uDDw4N}M;xv5N1!&#uFT6|koh zq?0rXmd&HIs3&69WKmd*RW?L$;#H0lh(oH(N|GD%^J3kgy?HSSH|YJ^W8an=t9Th! zqCUyAM(N|ybzpp0OBCcqGd%_4d#i~9Qnp^iWgYVh~8ryF0Vc#Pm_#Od?kv_ z7lK3ZKufMoF)W}4e2abHP1AmQYLqu2JubK-_#E%#6LhhP2v~+ z5+tIE8*nWv#0?OsLy~kFO7Wa6i*S*c3nS@FIb#y1$UL5Q$VLH&RO7K40w7xjK(0W^ z2#m)vXp)T4;BS}14tW!0g5pPaSTcQ2Q2aVg5RVlmZk_ znm5uAyk0%TDzY%X0DlQx^d)+apu2q!Z_U~-1d3HVFklHO$7cv-@h-tl=l5uX$YL?Y zU4QNoFZulQ>#(Hd#Qc2Sb!JK9>jpZYfwl2VpfSaLhRW5~nBv=qnC=$CAYVkVAzeg( znM1pAxMbExDj;S%xe|<5??Tb0#uR`50nEYe)TW(EwEOip-ei{(>VvH|*zi(2j2hZT zo!doDe094hZPJT3Mtik*Uk`Dbv=spyK2F2@I*pn|QELM-1t7!5hJ z4h(r0E!9|c^|Qu0_F0UFTyDlfp3BE|g{W7#!qY6e-HD2aQ?p0ZC=(T*qNSp*M|Nn9 zKe5&@{?~AY(H>7!JQhlb92+IfZ&-&c^t(eAP>jv;SUpuPUrtn9!fWIxWuoFzPlXuJ zgJBMPe$n0L)8)3Q7wXbozATQ@f;%1a1N=^IoWIH~6n9QKbSKD z`|8nLk@@G+7>3$z3`f~UE5V6!7Eh+Rrjh63!~*9g!^|)lCJ+DD4dx}*Q*xA8f;&1O zGe8dhcjGdBmIVJn!*G_192)(-MDf%5McFBqC~nekXm3z_DDWHl4M#uphMpk$9Sq|M z))F`<%79@&3EoN_E7C)W;wpS?h^u&s9B7m%KFA+B!IwQR%20g!PAaeep=4`eUSa#g^(f*3sk@4c5`vZFjg4V63dn3V%UrJ zo}ff=gI?nBKADZ}@~&kOALtV@@sue31n2TOQjvOVr$e`81{bS$@+%Ij_whj|=xTtL zd0j2>k>?YqQHFU(%gyl;qhm};fx03L?;fItkR00^*E6pWA< zg4_`!%Cr;m1(K1AdpI%d+zkEzWBMUdJ_;~V*-?B}1+hGuY(L(WB^iIY&XE{2%l!^UK&MRlHVj7CEd`@n+p5 zeWVojbf+xJ;8WINOg$%gz89CCy&x0j{r-3SSnl5Oua>8ZOBKIOLqyqAs`vvkub!1E z9-@mJ=xew|lr6P;(rUunZcWxZIC}lex6F^lsT9`7$1KX^V}O_sF*uT|NfHymkOU|4 zRM~cy;&JH3c!&3S&x`nb(Q^QQ2R!q=6lPQNUi^mCycfUYKODfuqEzw6z{unI-i=-g z^2osE03^0j#q+)Y^in3D0;(x@E^m}KM@y9{#e9y*DYY?K?BGbBUB~0z554F#ZFG|P zc!xGaGPpQ+0IIOCKwWG*tltq6fKtUVaL{CPwb^t)O`TlOrTmoms4G?O`mf+s4)ksQ zm#h$Ib)Fz=N}QWghbqr*2l^VA)ge2D;U=FTXV|=V_nPreuW102T7Adq^9e?W)fgX$ zcg>L)Zl*@@YpM0OQ*PGL;<&N#JW2py6PH_Dc%# zFC(JJLiAUZ$-jyiLo>vGLm~bR;%N%;%f$LG!d7(AU;*5gM?ua5LQvxOZPpaz%^Hwi z0+~S1;M(sq8o8h-n5uXo;XZkHUP!B;%v+@w$}!_Y$N?eA^%4P;FX5fE6LauRY~V6^ zgI;Kx=}lE!ptsUKY_C0{!D z*q0&5W=mb)r&ndgnWozM-j+1mU`b1qmhsbN!P~PvD9Al#;m~-NUV=tjW|@sM62+Kt z7PO5#OD~f%6oBQ`Pk_^S7ETaDl1a7zWs2{cBGwRPimPG!kszZ`49TcpH#v!;J zoF(TjWr~+r%dpNbvkqG5r3bAB7*;j#21axPJa6XmaXhk|%b)Q)+11Rm_vB@Y%Pj1J z2ME;>JdUZK1jlg$Q$L$bn8$gLF?_nDm}j26MhjNA(*kXS6P#}c!POuM+~){JK~kw@ zXp$`9t=OI=wPwd%rQ<%)Vcu4a-eD_uNGf8D6x+Bm#g*0qC)id`tFzz$rx!PL)Z)UF z4hwWOc87RpUfgzmk0E2C_1hhs z9G;%ih`+{^ohcX=J5!FNV38_UJi$yJOY}zEY37Z3zf8mBiYHmS=c; zdw5U!J?tG6Y`#Gxw3nPn{V5;0!-qZJvv+E7&wzkIIc%I0(yIQVzAwTN`(G%qr$F{odTHYd;eRxa9y~nV) z%~D+*rfr0?Dx(NqjQdG(&wBTI?cf~mvre$>GR_8i0s|qholbZ*gpLM=JCj)ZH1Uo) zG#!s`f$C-p4p)La-`XI335mE^cjrLNl>@gx+rnGuRcsed61<=L&6Dj9P>3HuavE>J z`WUj4(|A5E0fq!?P`L;_6^du!7(GLP3u%jplNE}eM=(>MLv;l52rjEcbde|@5iZh2 z+BPmL(o;mv0eFfvAIe90t)xOhft1P1tcWOaD->r#p|l8bQ{-*AlqIEXu(mp%S%>qI zT#i`tWkIZfnd)Bg6IP-4b$wVviBO?Xx*3&Ad z4VHr2h9QaccKO~evpf8*@p_`DE-MsIhHPve_;_v6p#Y4}^@r>&R8M7L7$ zU}MT$skoMwiM?{A;zeL*NXl4^V3q_6^+@z%7*>wdqop4sJX()-`tfL8F8vtba;qBs z7{NtGpPmVQdZpq}9%XTZRVuo%O2xhND1%oZo+0JjmWTaPrQ+SU zOIIp>1rkReNjwPUQ=SCNaW~gw>6km$^|Zh0-{5e9cO94I;%p)d+;G@6T?QVTZ%?GR z%k48^afcr@QI|?bu2eitKP@L#mCD`FYlPXt&khN>n!uIC)v`{oO4*lsS9qz6S9o`L z@#TPGLcVSV&X;(FcbgaU3&1^aw+i4iUg3RS)b&-0|2zu9>nK7(F9k@QXN89{c!;+g zD&TT&t@wtm^{()OpH+&RaosJ*pAvje4dC%G4+%=vUFbg<65OvpV#?r;xYPq(PpN0V zs1&OdM=?X@aiz7ADUVm;9!o#TGDj~nlI;gjVrTO%YlRobyOKD?Dnr+Ycv)su%7{R? z(yDZ6mrrFfMER^>~+PvA%+TY~Lyy)}E=L3FXMb)Lf-K5C_$*Y(RX#@lSVcA3;J zXK+oHTXmsYYn}x`tO|GZw_0b?K8Gx`VMkAsoA)bPbW0bnT)5*n&iR=*05m;8xS!|Z z{%nuU{kCbJExxNRXGL(jVl{|@JZJ}Gp&gKOf;`K5URHc0V(8szJaOz0S!f5eH<^5r zW*L1SkRGBCKZN8o-r>kXNKWHf)~B+DOvkQrI$=~zS3H-Vl0{^?;-$Fq8&U{1BA6+` zb{A!rFcgy^17Rp;&B90$VQ9K73@t#xhL{LLa}duE;zk&nuK0O)A_M@xw?!V9dYGTKN02t9V9D;o__->q=VfP~z~| z#ZQ5?=967S+m(LKgtZ-hmm~dDC#0X`23{jfmNw{+&?^bnyRx`i)CtZ|th!N3Td_9)vg!BV&kJi%948?yPgPuRek$z^V(?~xv6d%MLl^~y@DDEt9)Rul`sQ3~- zL$xRU%xF*gnW1dyXYt@<=?9vq8Q4{RQR&AivOVc%hKfr+Gn6Bg$$Hva`kCR9erBln zDhl?t&GpvoZ3oeje%fpjNBWt8jkb|~+Qd6c=?B$rvkN)W&y0lhbGr6%B${?*>M0_#vH(DT!CBG~6qv`S_>cz@=S(yD zpd0=`zl_(*UbawTcPY`n`-t7fBx?$m8wAnWyup}+%P=~{8zGljRUQXi<%xJbf+2LI zCb?YJViPh&Oj2hm-eyggO~_1~gh_4pJGF)Q%d^%q=-gY~*W_UY@ z&M0iNk(^ODGcgL=#5)sqwacTn``1h;Ao|MJK4)!~?MTN>)@+S-SlKp37t>t0qdDFJ z(|O?;Q)s&gX}mnC^l1?s+!{PHh(U$GB@oCF_)iQR1Ozfmv9cY+z60s)9XR|9@?NV( zOtq2x1ZDCQ?}+sF4t)q+>?&PjjCPUyC=BegV}5>gxXa<^aC*lTdxr|*?|!b*do6M5 zgsW3hP&}qUa5ygB1|_%%K4mi`_%y1QA?V^odKUa2zJp6Fs49+81Z|Dpq*J0*umguN zxbd`;6yGl64AS0qYp3N-+iBH!TydfI7ksy=Oo5&t=V!AN7en65;k{Or<(MbRlbCXN z1?;23S<>!SIZrTBy{6r!|-=}30U#pyv0dyG| zwegVwkQo`Zis3xm)w_AO-rXX;KRz<{TL+Rx#sO;8Md!yNkNAhIzB-vzc@=%_g2%Cp^&Za?p7&)`;#HK+~c9bWx%T9qOw~B9$3v-)2 zO&&Kcs^E$XJ=6qd(o&IJK@l5=*|^fs1e=B?&up(4FU{ za$k)PrUhK%+hhWpeEWQq$NPNEeoPYF?4Kp3%d-`4WpFeogl2n|n72-rNMW-FbDbYK zV3B~fZo3Q2ZKFZkL47{aFm2`9Z@u9(;dU@ROBi9y3)<;9tsCO(7_Z>OrB!EtidTpY z!ED7l_;n{3mA=$Yk0`)BlfEsRN!Z$U8K+@(2lSSESBXi$Y~}6+JG=)RXw+AO=5Epa z9n|HlGn}UKZGUllrOZ)moNvxmto{Qs5&}QO3^Px`mM*9ya2p_s;rp5IUL^Ow6{|l{ zCjV&>L{>$_Fp9SSGx?XZT;Pxm&bI&Umok3^>O++6HGimLbuR_^v3(Gb_fa`h8JFYK zC#WRxACQUvLFF*BHVK)M@SS|h;K_t*=mWT!@czjFu7Oc>2A49>2MAur)H^J?!^Af0 zHB7O}p&;knLuGu=IFb4Q`=QJA>JPIZAcy4H+N>Ox7go->#~r(81|<+@&}{O_W4bsd z8>Ub~knb5TatcalS?cgMY64gmyr9FWW>${haRAFX_awsi%peB^g_?Kn74qiXlPD6T zS{4bnY(J(T|M(Ir<4cT7Hi0?xejKsl<;Y8lRfL<%66|4LI@&IF=G$=sYZ9uc%B}=g z(fjeby-&yO_a5LA^f-;z=Jf}}#_LLP_Kwf2)C*lH3-yY4$_l-~e#Kw>wyEJ1Ft)VF zHk?LKN?A;*i}(l{nG_#MdnjP1$Nap9_PTTLrBCI3acMCAls>1#0|;DG-tid|5F+H`7p!Dw^jt zhUyVI6@Fo3ezQjd?IZxoh~q2q&h`)m`JoDozgOsO{Jl+6MdpO-wyT}iyZV097x?~1 zJo3)6WWMY%%HYQ;#I-{Oa%b?{^tMEWN`_!PW~?kmD1PiQo62L;;%zyNDx4->L!0rI zB3S+=y=@1DM8~yk_Y>fW4E|7YK_4>vXOq@bt8?mC|vta|Ly>JzWEy@hw=-trulTYn$>B7WQgjQA(| zu`MW8CP!bcXJGW=kA36(FhU*&jJ`s<7UnB`xSl8a@pPWRCIXgg!)gtz0E1`hU~#`$$id4P!BGvleiCwkqI4PK@nBo|s6Q$o1?uD>P)F zV%26>S07-}z`}?zjkikE?a}O!(Jmv|0gvSmJWlunPk|RxjNlh|51nHt$e{Wk>v4Pi zP5wADn*0a-31%Gh|0|L7FaOj)GBes5&u7Vu9VzxV^Ny6JlsGe*QvPo+1D^hNk!x+< zMf<3eBeG(y=6%%M0@6$oPR5DwtDGQWoB*C5$ckaw&x!f@{F~8P!dU6~=4SHAYdRuU zMOgZRq=1T(Bs4})F`T3n!=xgIn+fK1K_0J5;C-n?<5jsJm+MN4a=6mkYUyYeZ?#^P zYrUftU)_uw@u;ni-XheovW`}KcQc%&n1o&?Ay*14MuA~dU|1m4x(3(RYGB6~6o|SR zFaKaYySbS>@+Csbi#{Fm3poQ8^eeBXjP`4C_0<&QtAA;e4&6<;?N_e%-IT+3KZJE_ zwBkN@Q<(3*oBHtG_oJ?g)nhnk!?D0)8!7%c-9{R&)d{|V}r2HDn6=@in0KDK!v~TsBX3>i<_-y zSX6A!;Dy#Kj(E1h5e9Gdz9#mQ{F*o7!%kW82@uP*i9sO*V$C=pZMI(XLJ|<%Jk(_v zj&-v5nD6aWvzSA1Hw!+;45(%>u!?*|B5M@+j`=8;kNLLxv1V`eR|P1Ss{%t(v6K%< z9h(a9*wnXE(fJfl0;wFE6jpL&NaXP`A8>;PS87t=uaFBfinpe`E~-q$Z&^jMiYu=2 z&KJ|y|KToyCWbmf@e=E4oC>3BHCoM<>001T8?Cv@_oC0fQn}rC%$LAz#cg7BvD3pZ zZjASE(R*C%Xk{;MBuuYeuy_$)d=EyJX0DLzbcK@)lMZ`vy{dpmD6suddsZzp!udgcT*Oos64*=K2%b%66sSObLPw))> zgejXpVWbtf(u$CF5ElXuN?MUC?fu7j27F~?@?sD2z5h69*3OnV#k9&LIH@6kuK)3uK385k>B z=&%-V)Gup@1k%@D)_ZhHwBZS<1oR)e$T~;j(Wb}EmaWJdXLU}1qK6)j`FWf*sWott zwYfELv$ee?#qC!8*E%IAnri*aD(BA8Jx|2^(ed~x1sBS>sx`2RXS4>+Xd77P3FO8_ zggQ_C*IE_<#vbH%VYm)i^Ifj<_%mYu=m~sfo#&;_DbaPP4&uPA^VE6l2CVb!_BoTq zZr?tiJ;hA(SNZMW#FQyGzriFmywk`|HuQsYK0e0;L2%qx*8LwV+9W;aY%22qb-I=r&`1exR6aSQRZI2fB!! ziHDz|Msf%=(qVf;q{zdn!FfnqV%724pqlV}Zd%MpO0_iKE2|Ke6JR!AFCRpxks6(u zsFAih)Oagxcfe2Tm6%w>&evn`%>va(yTwx=zN=g}0!ii;55H)=WI@@ICu5FZvZ@(T zBc*dSFTtMBjxFIe*b^G*b`5WKC2i*INHRn|<_Zsp*fc9VYdsM6OyXM4s~)2Sfd9UN<{}G2dLA;)E4&f{s`cEKZyvn-t0dP@aMFaxiGuD0q)U z^_~ap!_@Kk&<9qNJGz=)jCYC`vGT|g0m8vYp!N3hBL&Xq7tjduN7va)*$5g(DH4kw z!X!S9KpCkfUhJ9bai>r9EKQ0p^%SSL(oy75`hd)Xc^NS%AU_~!NfTM(==Ts^qMy>8 zqkGVNCopdp;M1PcJ6Z#G=uaK3CHl^%y1+tvn0|#8lp>H+U^QFVX=aPAo|~;Y|G7}j zM`xp$#VDc9-{3ztis#-Eum*pl4XcXdHTrkBVOafnhkth~*lz#6Rcg$=%<_`7*H8wtwz^HEmm927J4PZ&DN5DPlgjlotIy-b^{G# zU^lj9VA=cVB|uD(At!N=Y=ED4j5hnbTvD=WI$k8{B_yR5o}Uy!JqB z@NV`xLvgcrrwvBc8@#WH;jWL>tq#VmA!pcg=w!eNE8v8{Z0vwTCj+k8-p49LSpdou z;NwsP2Llm08L*;NgOD|XX9$8OG>@=&`FJ%Q7md2DzdufuI?-RaQrBv9FVn$l^&;)4 zQ+ScyE+f&-xLv>Q47$Y_iFIh@*Y%sNfp6-FWslheX2e=x**zPF91E<)_V7e(v9&Dz z_7g9&{^=f`|Fqt>I!6m&+$hpy6Uu$xI@KC@%Bu6X!mRVJ^mi6_9Iosu{i_|INP|Li zwSQX@5K=U6^Y3U4+~IF(4Q%p%-WvG1f2lK`@tsQpCuKYvmZF_@(?P=4$H&|Cn;4{T z>ZJjAYCs}B-DAXz_pKFdCMc}ZD|l%j#Y|1JpTI!;cY9Wir^XS3YdlNEUpB(`dQ#{k)v&$sf&+nP(*GX{#%?73MO| z?jn`dCGLp4qtOfpz6xnSa+E$ly2R{30lnlBn=_Z(U}xnUqV@pe>C|io1$C%g6-_;> zJZDP26RTPAFP=rU@pAval5h^In<&UPjS~~QbJ#ppIL_G8!Bp;63i7QR#fTZvAfDFS zXl{uNQM`tRiWR9mb=)%XwDDxxC-h;QSsk{fvK2ivh^OL$TaHj3V*8qFqXvbZ39@9v znh%C8J!`~CDxx>xedtPj3Rlt!5f+Ck-Uyc;L2jnCvO*12{1&|ox#VR%#j>JL59TRW zja*M|pGG^RTU6jP*W}DaNTo8aNUaqQaxk5{l`{D$>jevLkzRnkY$lIny!Gwp zIlKpUhf4556yi`tDtul`_K*ReY4$V3J8ZpeS<$V7_-$(>OJF4YE@bgcZZz>m-osE@ zpH1D*u<&*`6l(L!tLRCb3^b-xq*~FsLBfpS%GPue!6}K6udYipgv|$i8d*74mj39R=oExrK z{e^1OP$dIhZsZehHz!q~DwsOPhWSSMN zBQd;GMKG`}5>SHyRXDy4Pry3ygq~+v(eZ!VEG>#GTffKwBAGC-O9OecKk zY*X32zPEt$mf&nPu(x~#a+(xT{8DOTr+5i%G4J)xuXm;(zutL78U=Yo8u(ge$h3uC zdv5KycwX(?t@zt|ZcS$^T58bSXzT6zLx+85om%fbB$tKT=|!zOmMcRWTyLv0eX%C3 z=b;{~P!Yv@c`r`Y_VQ$LD;ZI37W2g#w#t9lZ+F$_{m7#T!B%Kz_rL=0@=pwxE&mr-d=(12>cY;5s>UAkZr7D+rcSPXkkZc z8%BlkLuoFgonB{8#yh?H;>x6b-ZyXuT6Ry!e=n?z?PKP9M^a~_2*B*uX_z3UZMbutNs6*g^!SrZA43Dient$`m8k8}CLFj8y!1p|~^|scaA|SicF5 zBk(<7BXB;2`20TN>Uos1U$KR0(rSB*he)XDwrjbN_-u-H>?F7YIyLtS&_jTLcdJ*4<4 ztYblWB}G*dWpbsYypNO@Wic&L{Eb86upMvJ7+;gv!bNmL+@h$#95+eVE>Zk}9xA*l zQ9RTta)S2`l@5UiPF7->TuBRLndAj&i_=gCq`ZhayeKIRNO>|1J!O*O3mVVE9Yf%( zj1Rn(^dhB1>nP@rHc-qj8QpPEb_VI8A&(>$q9;)1H7 z**+uxog!Q{t%J`C^DIsKWwqqf;!e-uxE<$f&vlxT278@+=+Y)B-qh*1og_RtYmT;4 ziOGt;@(pyZQpIWmy4?n9OhHcqpaH$Dff{iMRG#}#jZm>P3M8!^NX#<}mwtJcXN~-? z@oW=+ejwN?`(mn-SNZA)uLOqqJt%R^gB-1q+kmvJ@&um16ygc|4E~! zS`+a8%>?Ud{5@@b22b?nn_8k)1*!sgcPg+Rf9nHaNcXl;OZ+8RoJ;(x@VCkz3Bca2 zZQRMe$vz74WZ$#+d)7D1kDIIV=!d$@rRcfrwuBk(ZQ&FgJ`FHdF5w4L&_fW7`FS{v zf~L`^-FXy^H=4!}y3iEG;kzlwcR#43VSexlOdClsc?LuMfPx&%q%zK|6J@|O#XtTP z1^HLgSOnH-iu=EgZt^;f!e|;KFDvxSry%D8FnbV>;%ST?H4RQJ0mI&Gn&PO&n?8bH zWzLZ?O)j*WE+L&rd|K z62wzRTQMBhnmm=(tawDqnuz^vNP>TVQkI5t#lv+}u4uuVa(`zY?SEHXpt|cL*Qo=L z{+bYc_^&Y5g0jxo8=s(vmhNK?(sDa?QU$fKhd zwi(~%+}ECC9^tG|oU}fc$JfVly-b_gpNDaAybn|;?*CVGRCnO7#@S(o;&pUb^f}4F zI=xABI&i`JXA1J4qvvBfL-an%7iQhokd;{WLBtEDK9leR7 z=UdUbzYFN$*D)i$E}#>S2&j#r*8>L94 z;(~JzcgBFMR9tdy$yabcrc!Z5=jok2G1#Z@^v+w)gHk*%=I5>Fm3+kpN4`4dtC&2Z zrH{n?Jm#wtzY3vPA``z_^HnED%~vB|w{xuj_O5Toadv&XYT57ViKH#qRn8h|7PPi zZRqsxEclKceCd0yrN`;Lmi~6SL+|bM6X^y=sCOl_5lU;E~+Z^yG&{l`E4!$w;C)yUWF;PYPvzFopUC1Phj_Kor` zWV}6(>QdgtZmG!#W=c_Qbh?If-ap4i>^Rlc_KVLg>TH*@?c8nWQXX$Rx1ux5rYjYH zh>p>ZOXREeJi?>C*_>`6(42lE9c~9I6*qJqlV*3r1Dy|aroMcj^RzTvpaOyOMt%h% zJ;qgwarW7HC11gsUa8vb_@shgS=U>xxcC>oq$g$YF5Rqkw3i@=i<&At@4rfnFEV0SS_Jp+;-#`e z=Ibgv9g1z1q)bFGB*9?_8t5Kc1uJm@zfL3N6~ZdT|DuRSGgRUE@Ho^#fMeLC1^W8< z>dn`WN-WQFX-Oion%2f6N=S4=3DXr{KSQ>^(-mhAm)E|hE1p6#s<~ zYi>%2Z8znKT^3Go$I@Jvls1GhmYH}qt(K|>ol3uZn>IAu{o&+(%Bvr$>MUFH< zevfW)A)+1QCBLnYyONIU6Y(S^mCwhAS1Z2eUbI5B;-0r*R8=d!>0Zo5)r#-F7j0Fo zcr2|E?o=x-L(sSoU5Q{ws5Rjk*h~qYLeM~4la51N6yr6C;z?pdx`fKe4!SUR(lG}b z&*Z@11@T;0dz^b-qC1@T6-Np)Zr3hy;azlfoSRCVsU`KPyabWFJK{p<-=?Cej3hUe zs^S;!d6)haTsA2StmSbTj~lGDiO9>=-gra`J-dSfDGx89eCR9Uqyrp{5^_XtF_BlL<9NarX%Kt~|t9ih)iNAndxRWwhA zI4W8Nm7u6?;GyKlu4@1I()hRYrCpsNX8e}?%!T)}UnbZvc(`kH52vO0IvK)><||g; zNn}&BK(V?i0pP28Cg}9MHQw*~_Lm)v>0bRukt`Z9+3iq``#wCBc?k;hX&DMP*JB&ug{ZW_!Bj6}PTp0p7Z3b^Y53i1O5GU+Z> ztbXB?_lq75#U2s4;)P-&G&-&Y98IN;(yY>Dp|n_W4{?TcuZ|Ajdk139U#z(A-FBc= z;u6Iwor0YHH*BbuD8AqVyQ&u?DszhgDWoT3e?1+nTB=xydSIDi^=%Z@L0~y1AK)xk zd`&mX;BEu31T0tl<4Y;T-5$m?xLhhCos2KI)Zxm#!|ZQX^rT|-HBfN}zV;(Po>HuS zn+Rm8mXM&LrSq+>pG}0md?Mi`MqUV8$1*-h>%|D64v)1h(-h=oy2ecB zb&C7nZTQ4@Kj?#~h_-+52|t3^o%4Gd&T8zvI!CPa98Xiof66-L*y^9M#>!(BATgFF z+q-9;%r$WnqB_Mt{|$JBz|ZZHfBs(%um0;dHv7iXM7zszH7$%YununXj)(zga_|Tp zv61))6~wpm1-cNoD^Q`?yxd(2^)pWlV;mgw#QbG3zi`b4f^#+$+%rM>+%Hz?_&1+P zBQ@Y##Ef1_JnK*UcUyD@-cQWn#WZIiT?eCl0MuV~>MWbTUa`8;Y3wU^ z`y6eNLduoh?EcVg9r?wZD%x!w?e^IoC1I3jFt4|7(p-O|H`{nKxG@vE>#ev;kh$CE zgatc)9R=-2aM zZ%a~#y(hgcl#|}EK7YJIlYQmBKxRBz?px?eT!=D|CexZ-BG#{&yCSvnJvV_DZ}lmLZwf(G(5;iabS7#}DQTpyqM2o(}_x!GiS^ z9={6mUNpNV2by#L~e$kL#I&b|M@o)~hzF-_|GXMZJPT zudU>^VC|Q?Lb1BlB}3dA#QY*s6$gKd1z4n^KKHwD?w=)Mg3*G`qQxRn*jn?&V#6pa zFtlN`+nu1-aKI*$*Jv zgEG0tCbJWGRWhxEY6QeJb)#Y>D=-2VW8q!nEX4@q0Rj|f*80&LO3YeFpb%hEjzqIf zvMRpGT);JR5zujj7a`9SJgqQ-;N4kn6 zPQQYJe8ulT^mikLC~K7&Y z?hUuP*vq#j$NDF=aQ{&)dNHb<)Z`shz0D6=MK3^@z-06SZIKONbelMZIYLwXatQB3X_R9Fe(Yf6 z+JK7$aG#^n;`<^LNcfn=ZA46V;3B$MgldyJ)EV|Uhdc_~pf_s^FI6>KpTf%KQ|pu$ zaild`M=hML`FLeZPW=0f8D%wC6m*pluL-&_Wwx%6pH;fua_9u_K7fk*lNML1l0V>u1%2as>8Wf#nEZ3yKOC)RHElY_}^?&VDyB(ZJ8syL8l5 zM?Oj;>^TD;4p&Vs4#o5wSK75k7e?iKm6r@i|nI`|!QeNsLTZsUxY%KTkAGXQnh+ zIWkG%-Y>`@feB>bLSZ`v+~E{(N4$V!N}1)H)TpJ1DF34Jb@plkBEZ&5q$y+ zolmF$8rQe<7|}JS3J!4ZnkvF#D(}>L#Hcitue{c5)cD$8!E23d-&6S@y@OtWe*X@A zBK~ablp)q43q3HE_wcK7M=TYbG=n_-Vi%21tzl4Ng2pf&#jccZ!uSO6B>d0tf_WAX z!NXNqsI369d5AR{lV=Rx<-`0G?udnuYyb$g{S9CYQvY}tW$|6h?Jxi1U6jptJxC!g zplU21)wEceDb)rbOZ%UXry=2AO}{0F@~H-p%_H?hT%fDc4RGt$pf}p=H2~0TpB>|P z0#r>C_$|3vmTCamJb}w$#yOK;U<&gK{F2RX15mhtDeCtTqUGqs>MF|Qt40_lM}gvR z{uqqHg+aNefIzylQBS|h?A?u*esL8z%sEBfqM_3mhEwjzWJL=G^JJQ70yF7d+58Vv zd>M{EGh}w)9z8n2{TA*-0i6v3 z-=<9d_CunR8Ls%MUjmNXGmle{AAeu=hloDvFyzq!m;1j0df$?xD=Z6gC+Z5Q1@T}` zMDct&=2|8s`7cPW8Z6=K`yg7}fa0=--olPFvy@N&Hx2X7{_TCa_x zt<_uOCkxgB+vZ#0M$4t$DahR?nS;4P#ovM@>kkkgAn8B2l!AQeB+HUY7Ao%E-Jblq z|IwLz{x~2dS_%#AY`LbR81J&;?9Dr zX+GKN`tj%-^XbW?_$q2niZ|0??ZTJ)LM3`7c!#rrm3pgq&OmspK5T;pt3~D9QCuXt zfr5NPV;bhCk&3UpkwSc9W11XCk5v4_D=EZRHm2b@2Xo!%_Y~yc17U!~8{t1q)YRNa ztK$80m405Q$d`!|Dt=zi_qgMu(_(4vcr2|nDPEdZ8NWzUnKlciogxB^#M{lA$zz-^ zY^E2rKML0;Q1`s3*XtCCnFFNtx-rcam+CgB43~S-BNaENG^dz8&CMxOQqk41fKEv* zOSK&};AKEAOZ{h3{GX|dIytzDI=$4%kPzZ6dDAl9`0v!bHL*tYEa-CnhZx_o2LIjh zq-#M>2b@Xu>A;Htx4!Yk!2YE8{=msN?#aL@=L*rb&U-qWj@o8hb==W$bM86{@^v4H zV9;?C_v)^vAYUJm2?5a_PLJsk(XLg{B-uxwk_7E;dd#ovBy-+rk}iz-p@5g99@8M3 zPNN9kffh)M65Bxdvg@FFv|IBQrQ?3#XjFJK)yP#K0LGESlW{c3B`8dy5BzZ!@dy5b zfP+^Mhy;vOEbhM5w74E*8r4uj4^kr(Y)A4|4WePVAnv6R z*zu3BitSr8qZNMzu39UCOMj{qgcGK4;N1gfO(N7b)ZUr27iMX(O z0R{Pjby5L|+7(bHmMB*M7vS6hlki19#o4e3Q9r#lvDLj6Mi4OD&c~=8tIje5?!(F@ zUfhSpMHPOA_Gl{OJ$fNrGc2?gqmwS;k7WfPulRZX91mLm!~1cXC8zA;6)&TgWJ5My z@d|#2(Sye;K9mwmr7S+0TGR=Wj<`4J*R+GM zf$>Rd7pShvW7Rdqv(6*qvg#!9(0+?NsI5sIBTWr;}6au5&&-2V4

OaPiwV|Na*DiFzX$q&RXNQ3OBaJk`IA&jEjkizw$MY*@J)W0Vcrrib{$;e9p{(8IR7+1Ql|Nl-M({vJLMSa`8-bzeD6nI>cby-!I55)|1(bss^sukV8guI;g@B*@O`X-)p!_I8)O8OT$s8&xyk4F=lLm{=lK`O6B~>C zs}Wu8uT0U=?p&ENJB6}&cFMDe3R4#OUjoKU{&4}y=5c}ba&4K{2cAuV6%*VFTpQ4Yw?)b;v&%BsO%qH+NZ?hQQnK?!Y>1Qx(o}rJuIMDyt z+bmCzpv)pU>p*Cn+`vKT89Y&Akh>b>T%l4#&p?}LQt|~90VvxB4N$o4p8OdNuFq&7 zI7>);#*0*Mxj&=cT4g0ZW0h5t^svul#cDl1V?EVd_>6k1MwFRIFrR@Cp6xO9SdY&z z$XyL`t|S!EdVGdS$rn%rpllm7z}zMOiK{h!a+SNDR}FT@27l;o3zPRM%Hpd&1hbuZ z*u*b1@zI!PMiVeD7syYpqHMmZJMIH?AB}^m(e%DNEAze{ZBaIlwt$;2xIgQT3+CNN zU;{Bi(8Bz_J_dFCNe#5HpuNY19?W)yo*EB@xyCad)1oB3tKWwTd5SdyH_CX1)gb>3 z)*-wQa>#m_b+i}1%zNa8kSU7Q=j7tX=d{I2nx}b-b=XQEnEUnbi8dUWFT*hs0w?j= zCuxhNqnGm*>mTww_Y}pKU2S9h=5w^n=QIHyGeHBf7jLm%vF!9)mlE~kr9z>*luG^h zuyq7e*b(bp#NM_3#h7TOD9%`c9`+7tbbbQ0;tK^e~(nnd|7*+@dc&^1NS%Xa2CUc=76L!et zpmOM4s1%MTO=WToxT^u@I@oytThRt(;CTk#$7`FP_Q_A|yYrh9dJ4g|kxUl(TwK#^ zK^R{A-(k@h+JX7X-3c&Crz-x4=3}(G+t*G}{m-0H z(-f;7t{&VYlvqhZuj<6Ztw4NL4%QG#N7q512Rh3%1tZk3LLjd%`pGoK-TG1n|MgYj z;55ZE?R!~qTzIs2#8vVmE0ZTjB^VD-7K=B)bQ8ZG#USgwl*9L~#EfVXS|DEk2!%mX z^v`9A^Byx?GbCFRjnS0HWAr+WZd?ucq47^50?v|F#jUbt9F^_2p7L5|zbOdK(-d zZqqX@;LNnswdmRnO~MK4$UTOpC(h_%p=2y$u5yi*vW6E4JyDfS9cQ6Sob zGP%c!_$j4IM~}kcq$~~aIQl&b^7l*zL@&TrXDIGD#SKp`xD5Ne7{n;P>^7HK#%&qK z<}e(Sy%cBkPLB7!J2`%Lf$J!b3uuLytk{P~!xS922IY7Xo?M+kP&_-T$0*2;O@w}9 zqMjz>Vz^>8$knuihEUSvJcLFiweBdIofMxG6J;eZvjleU2r_CoxVy&oE+uBHNTH$| zLHmvE7kUu@`{^Jh`VAllsou73wQ+=MEiE93bqnYK>@W_{c8%zET_C%(Ld8R|Z?&Bd zCfMh;6E0MI(M6QiX01EoVr86NmC5V^yD2kXG7ezxcN(sM3eBZiC>^+vX1HQAs4i~U zQb*0Mlx7;K9m8fGsrSbta?Yu)ur&^R#jkBM=U?9vH*>z_b|>}r`|VT|BwaoV19?-F zZTu_*r_l_#eG5Fw5CoZVM<}kNJ<_9-KB`rX4$%>0JOZBy89Y)R2!-&nU)GHgiVM!{ z!=*M~?&sk=Hu1L4LvgM?v@|iImeTfkL)7Tk;@sxfbdBpa8%W(mA%#Gdca@hyyvo~T z9=2@q*7)qCCht)%7N#P_MO1^ET$8Ob3pcK~%$j0fy-Fk=q^Drm@{|V7V&Ke#HO@qy zhX=LiaUJ|%4dyy-gsn;=kMdx#E>e7uUc)}-HC<+5*Ij0Piv7!{INuLRK0qZ~m>YQ= z+tvH~U~}%pgKK0ej>@^_96iMwfL2`>(Z!q|;a!QC zQ%|!}p`Lzccyl$?#9u+H!NMWxR(_gRqR!aftdv^X(*YkK5Vm7BVaftcC>`+Gl*KFQ zRf)bzyI5`t!Ezvr!W13EAdK{FkJWeBTSc=$12MEi| z0V=>mTA-aB`Ei-mM=BmL*gQcMj`?};U@Rpte?prMt~M))6OZU!Y*rE*A|;H|?@3=C ziL1u{>sv(*oLw^6bvL7Xi%i8g|H(0s=0E)@0sfQAEc>AZ_@PI9V$mM+^Dv5F#kO~U z5gMDYLLN)+Az})6k4E_+GntEzqx@6i&vrX+i95ab17Kpw!5KD>@>lrn6hZvcUn#^< zIKK`_`~Z#e8()USif2N&4-0%K7qflhiQ@?_=Cw)jS9l-JYH<9skGI8NrQ7By_qnre z@iiyKn|&vI-rSf!C+1gFto|S7{sTZ3_)x}#TtV~jU|a95ha%R zlwDnlh=sTs5=(qFHdxA1mbMQ|XOTr&dhfluR4LLC5JXo{6p$t$>i_zjxt}etAj$h) z-~aErV4pMRoH#bN@^(P&RL4>Pvyct+2OhwCU5(2 z=dcs;|1#s|@VQjD+7?Iz^|z$Zwnu~hCLZ+#KY0l#TVHxqNy8{54rzsvDO*y!1RtpGZ16}kJ^dIZ3%So;Xepo|$wPy}&IWtz zF;2n7UN)!LY>;QTFFQ0$wZ)wchJ}vNtKPBDz_6FdZ-s&3srnXlXM^sxSF-aAx6A!Q zPR-kLyOZf^3h6#(4+lBL#1wPZ{G0mzSy=sMDg5TNFS0s93~{y3N-0As2o|OUNy`gs zHIm7`fV=y}7_^-zStAw7tkS?N`M$)S>wEiS=_2VzyDXfHqDfqP zgG6z|pScF=VsOI^62lFRS=KHFx4s~0%JhLOVT&%2epaHG5!kIxT)P-_m06q&lxYc> zB3L5FSc%8%+<-Rb+`xDqyR-{03p1>&8zhIzpB#@oeOh5|U?~;9xysYW@pQ3+lg%`k zR*uer7;?P#ycBk1XJYZ5SLFF5l{`K$H^8x|i^0c%ok{P%2Lelie#C=rxd6=tp6y| zosA@lMqRn3Kv(IR6!7f7*b`{ca6>Zr8Z}oBeiLi|u%z5m(}4%_WZJL^n%@BYMJZu1KbOMdKvYcv#YQc$QlqsgYr>LG2-` z&ZkYpeUh&6pLZulxd#7kD^!;8bi4H1dMf!v;HkoDN!TdUv&n_pv(J~V)1EJ^RuXV* z&vVbt^^THCUJPS0&r3r*|CvzJ`0Qwp7`{hqE~o9IWzF6*s19HqNo9 z{ZwTf-K29dz5Ki}=exlRW6oc3evpG=UKlIR-{Yf=WEmKBBI*ENWv3Ww^J)-7RheQ4 zTv`r8&6v7Gbuzf@p>hD1;d-o3 zAV{g54NP)PVDvs1Z5#D<6atmVLvuB?TObf7hNG$S5KtbDb!z8DpeA`}@bwGkkidn+ zuvc7241r$~!{-hzC5FHa#PCgn%ZMRxBQZUVmRoIA%oW7YOh6lpz_rBi6kIU`6vLzC z+bD;?edHlIwGg8`bcTL0nF%N}0cGxMaB-5y#VWz{GpP3f2l5A+@o%#h zl+e%MrT^ji*Z*|X>4P^OiRYO`Od^OarE+*F9TrCP++rmCH9D|jhR6QllmDuZJ`6Bu zn91@CFz6v8b&Ab5sHQVyOf8D2_Kz|W0quYeaIUk>bDR$x#y>N7j*EqN4X$`tqImc@ z74oh@wTCI>U4!ZmGw!6kKg!&m`|wc2r)y#pYEed=>8r$1rIiOriV^z?-^WHU!ti0gy!`< zEq}xis9v8@-!rILpBbXd%hx4>*LOH=_epIHVh1uW17(NmyN{9(H%f3X=e=)GV<6Xi zjwMsQVm5z+sSGiAxVc2oyqnlWni8&ln3Y;+VDz?;58zjSBtM-`UL+A*v|0~57`&v6 z*8Y;q-Khl!(aYU=MmkNlh8on)kf-p%KjkUp@O`$Y)EQ;%roPbHO_^n%&8TC_S|klK zFg;nio-#q7xtie3Q?KSpF)wh(c^b8%%E;}F5tV}mTg*1!wh=L zyQI9UluYcAUR>7>rKwQ_AKD2XYkQbMdv8Kg))|s;Q8k+`y7Q2!^+i{izhYtNVp2DK zd)Qoi^lBN#1jYpHf*9QvX!l>`nNQXvhhY3OqIDT>|9yPhF>d;SrkeM*QqXkOh`7;+HU@>6`=05W69n{si0JuV&V-s}zt&r#qYbL7 zpU2TUw8f2#F)&w31XtcH`MCKOiQxX`l8@$7bW9mzaBoB+=p@{gJ%?PGA~x}yM!Qlk z`rT|3naCA2Iz=xfXPyiB?1`o|@$=TC8G*6%t0xis?lpd>4C#bTfbJ=8d`&lSV-2qV z9kcVh*L3(ES1uMq*HajQizSAOU952i*OZM#m!JAHQ^&C6qhq+cE@Q?U?6leR1efj6 zxnu)F)c2k} zGT?A=UWvyWOp*3#w@^NXvWa1*su0E-Y{rPd=~+nTWA@4bOGxw zj6&?GqJt^f8c7U|$W|2-z2!XdIf0x2zk-|q*{W)ai|s1T5UXg}8AWmO`NL6x&8jQK z=J1{>PH8&XpkLtK0Ef+Y1G71Ns(^O`>%tPjx-d}<6qQIBp&#*NgQb;vROV8l@~FyQ zVp=ODA4#25h4a{CgLWu@#8H58dX_W})Ah2zWTR?PK5%MTf(Uk^7(9n9))Gck4mGDg z!?LLIkyJmaHI;{^a+GA%oI@=i^Rkjz$wIp%c&>GS4hftKPX%>5Ka{6t(o>S7;*{j5 zSOQEm0F~GD%7w+ign>P^|TBW$cQ9mgp5go6-b=z9n>YtwB#o=E%^yeS1)-Hbu8*!@DZcF z_(}l!39U&U2gKC{p>q^C)4*Ir%q#o0=KkbgD7~# zD_rs|GN`Uk@zF{((=dF+ZzP7_Fx*VTYXTqZUULx-)3bPZN2Owxe1)K|=KBhRsM8>N zP+&+PsR*D?#AjK39~k`dDlWaQS}8hMe_+s0#%Txpz~HKOB27(s=$2cUyR$_sGPtrn zC-gzIPc#fyug^$Dx@X9M5+X|Yjczi?n5p6Vbh;5`I77pa&C_*q5nX+5)166?IgM$| z8Ayu_ei7$ZG5&_yE-W^v`DpWo01IVHHnzXsT@a*3-@Tync#;YOAjm`)|n{K1`(5`2qfW_mZ$jN{H^>VkAwQMCKS{2CA6^rFypdB6p;1C_Fmk_>D0wcO%A6Up zp@gzQ4v4$0rI8IIv!gWXBq7?@P|MRv68>>DL#479nju?C8MnxR(!c>ZtXU-2VL4F( zpI`+fMgJt_3jM#TwB-gyADb@@a>`w9P`|$4H1#8X(;yP@jT|D)scmIZn->Qw={=>y zQoRGV+@N{#1f+RRNh{_^cd4XjeR}N--KA%+Y`AA|dN7&F^x%AI2DL4h8+7LtB|T0> zcUf7|;w$Y2TS+y3dM^$e>|B%$&&BtFq{Qz7Kl>DhgmS`DlVPymiValdz)r^!qVE}$Q|CN8vq=SoS&d7*isQpW9}gP}4BEKd0% zg~2oz@r#u2QqI%U*){AV?C?Yh>?%c7Bn?GX zmRF%FY?VP5+u4&R(b=P@{cmHl_oc^&qE?yzed86EZM<`DtLcHF0L$&ya#3J~23<9v zd`qqi99E*wdpIyL$f!Q=Ik$6G<-E%JN}ew#ukw;|;U$&3raH%pbfeCm+BJ1(YUKny z`xBEF#?aKUr?8Aoo$6!QJs4?f>ZVj@G?T+3TSo@5emX%Qlyb)nUCsYamsfoY}C~TCYqd-qRG`r8|ji<*v=^RXY#ciO=91( zqy5Dbx_SxT`sU0&)|;LL`|?!^=YQt2z&HL>ioU@@f1bvQ;D#i4oG0~;cX()G$bshn z<5`O~k_Z~T=q2)6X;xWf5}_*%>Y5eBN|Fdh+ajylmeo9mJxZ>lLfg9r%Ed~P2&Q|y zW>!~GtPqJHJJdVmbPB5tKI6Tzr?Ah<28~{nZws{%PodbJQ0JS9TZzpGJe7w$U^9vl zPV{V*ho|y@V!B<`5Uneq%>B4Md5TA_7!nv42&>KMQ+Z*G3#<-Q(vZ5iP-bmtx2j5b zy*uQX&BZYrXPX>WHq*W`DsnUiyw0 zS!+;0ForBIUtbJgYtZ~3erEsCOWfL(+3h7WZ6%#2ba25;J3krb>In1g+H&Ew_Mr7$ zHYoj|9T_Ye9vPewEGutDkPCIrLn>eM*1T8JFr$}@k&sgJ!Wg4Q^JL}ecd@j#C8XB& zpmljB$)!og1ZPD}vy{pdlMyw!<@R85*?rJvc_G~iJdwpXH`xCwFwc-khywVJ6C#BDS+Po<(>5g<~|;~tv7i6 z9Uu5hizLuQo;DIJ5`cwKlWWy2ZZzYDVOe?0*Lql0%ZM=b02CLY#GWhn)TLcB(7(G>_9DO3| z{|zuxb%dIoIkGZYlEw02vV4<>b=9EQi1L0&tc#|V=dcxno8)*>?kDs{>4bg7Gh!#< zD>S2YYjGQ)am zGrPrLnS7%k#m7l0w@N;4y`3pIR2+5s@$)wf*V58`Y;e1tGLq21$X2Iw!_9NmU8n}j zXk~BSEUDBhC440=Hp?y_!~G5KGVLn4H<~(l{A;VGOfWF#FD&6tmtQD0_kMfNks1Qofmvy=}d@Ub!T+{8@Z~ zG!4CEELDyeD~I%3*=ArS=|{26AeYw%V}@XsbkbViW)N%0&amCU%;9oxj@_F|eHant zt^&`uoVMNkFyAgJcX@r0-J4oQ^KBTrZ{=Z?`HgNjXcL?k^udDQv|y=HXuCmH%Gwm4 zmYb57!jEgaK|!S*>d=D>UT#3rksDa1hf>P|ZIZI`yc7CWZ8tuMj{_%kf4JS?$Ka2& z?fo(6ANObT$Pn57fh3a%?Fsn_ZzCAjTtC`XJ)4v6USdpVr7LNSbklEtyTJrW=%>Bi zU^vErI}@x1M}zGKLx_0-V~`t=Cp2bp@JNsynx#qUoh;aql%AFRCM$yn~k}{z&uF|fd^TN9R@XOOB!y7a(>vMmeWz((3s!q z4ui*ED8poAr-5lI5i~8*Z->F=G<6+DGY%yWqb*cA4$3h18SXS#Zoko^iVCMRPvVz&_u=c~#Psnh)dd;?(p$HMshuT9#9;VYu1f zS@cg0?rz3XeQNO1OT1b7rjMQ~GdR7@kcB$^d`hFN8S10uQ-l5l(~Rsgp!Y=w)MKR( zQ;#Bc83gN5@-Bn(>-o%=UoPpmydL|^E`w{-AIC0(-_~QFby4F*Jp+liC~3dGE{aC z89+_hT17Qb)Hp7iVi?Eg+4$_6GnCmQU+bs-nZXR&q@*kFbL#4`MBwKJ<^lF12gD75 z-~%kj=LXduU|oD}aP`%ahN~ZtG^OAA089S4!3_^k>gNV2Rei=P7n7&hz^q}$*YI9v zKK9D^kmO^0=wm(3_sMarkx$s$@QI8M(FRQ!;)V=wu3;(HD4~HPq$%ODHC(xoz&)m; z#FX;-8drPcLmuxzs<5b1+SnZTI$e%kZ>0&=+wX&3;#f<3AIuF&6Xb?Qg)}@WG+tE_ z#Rh96NAH>C*yQhe`UqfD?ti`ywhc*R7oo8x(q7ik{ff)ka6e}mN@}@Auh?)JAi0v$ zbMI-H7uHT$stHyps#;=iNZi(DLB7`V}4+BGUDdIcArBN>li$$Lw2z_OS)&y(V6?; znd4-myBZ)A8+^!4=01Qg?IE?tJZnY@X+Glk&n!PLP@vWk zU7z6o#^4@(n|wRRr0w#qju`LS@j6L3631Fuuf{~{=?E(B2!oj4K}x9V2r(r* z^MXY2LQl=aK7;8ppQHGEWppyv@c7(;+i2?Pz*={P)yE-qC3pUr*K4_Wrbg+{f6;@j zWbiLr^clKjaEtc|SGZA)tT|wkVSQAVT8#OUV=2wQii;fE)t$2?5nb(S6_^aK_STmT ztH>FAYp0QdOSnVNK!0zjnpCo~{^L5@U^j7>zmv9s=|=V&+N(qy&`{!N$m{fBp> zAK!1#^eI}JKJ_yHzMRb(&6c6G;J{FsOD)4(+fH4GwWIDVO+~%jos(I2t_UI+N+$|Y z#UGU3x;@=*FxPJ2XurYk;Bo;w>~39D>^G=hr?ffh+{p^$fXbVech=SBNCxW`YHcNh zh2F@r&2hG@Yi6>AhRO=6;e3XIo4IaG=60?wo%b8`rU#oO_UFoQAlZuv@LS{OqrLdB zcU-HLgdyz3LxhB?ju10S*e#Nd-Abt82Hf1!^RPkfo0v#> z^brGRuSDQc3OZtN)o+=`5re-(ec*JS63ib}V}8`YJWugQ4Qjv0SVs+hcOU!kQG+M{ z<^!kmlwe|w$@3i_-=`b`cQZfV8T_s#1%78x|7D-2S<58PY0M><+wS$5OE3?&q`+ea zM(vZ28T^V9T%B8Oq6Kcv6`N>bkWn9XI%Ey2MCU%cm2@ zzxy&lXFeB{sWj)S3tA%;t1 zG<0b<^jW9*tPOqEX=PX&Io3w#;B|(VnA!@RF;VpxS%OBdOVs6|G4i;zjN&lQ{~F_{ zbm3)d%~2FRz1f~L#%z!GR`8kE8PeFviDDvtgznFNM8|+cu{5|Y$U!PuPZ=%)8Jbs~ zDru=QG^={(m?hX4_$nZc@KxYDwad;DOyUkVily?2NE0pi9{E-mD`#mrKeq*#=yG&Q z)>KT#z@%gv`GNNXeojl8l1<~y>=6}E|MI##uJS(gce<^`?_woD8-a;)9cYj1 z_}518t2#U}sq>LLDQP1Zptqz^Ad@&f<$Le*IAN6ck;h)!MjRoIao$utjYwi*m~Z#; z=wQDc<53^L7%@Y7F13VFM~`B!Jx+}dj@!0+$)t^-gV!esUU>}%nKq*Sy5bt0p1T}W zr;Tv%ZzE{Z)MxuxcIbH0MzD}zQzLB!=1=^x2z;wcWkM%aAJJBD(ftxdYiX@okJc=0 zBP|p=!X)Z$8lj`@X!WOu<=U;Spra~HkmarAG010LZ$9we8-w5{q}A0(6W`D7no$PC zNQ{J}V2+t?ZvWu-B z#n0Cw#o#kKib=z18zxTfrdGU7npp?DRh4vAQdsX6YMx zm2kPcNUyxN72Mx|mCrg&R~>4+z09A+X{yc7M+LVH1; zeOJ4Fd%;}$ft3i>a!DOg_QSToV>c-9e$WotUVKyoeBkZUrC)o&XZA4H&5oH5XpyV0 zehuvflf4g;j4lBq9R$t_YXlf3kiG>{(|A*DdSVvG#vzeD$TDX5foKAqK7RV1l=kR zOO+;Ao?4vh(OY@v%yYI48r!L8 zhPTQKYu?sS&lkm7`BB{9D<5&Z{>UBRAqUk>YiaX7&3%b4I?9mhKe`r#S_eB*4c|GK zA5?UH@O{;*bP()Bc0d{;JHQwnT`sZ%i`6>4gP>nvU?32u$`=Czivzs;-q0@}+e|aP zOx*cm2RS9bN-bXmMV(-CxqeVVo3j;t>IdQFVSW%Dq$0+%Q_tMK9R<8ujZ25BcBP}> zx!3r8bQHXnE#;w3;@^6sVje}_VeQt$KFA)+%c5b2jvJyM)Cbjvi%m4baG9oKagM$ycA@zi&uSyUO32+3X1T%Kd=#V1b_IGr2R~RR4z+a9yq;T zW-#rh%H;~B;653u>Yg0I4>DM1s~kbD-D-IVTw(6kA}c^aodu@1j)jD{d^8HV`yic5 z3pR*tgF%6Bbd}PX)jf#SJ;*EKPmwa*uaWP|=4v5ZF%cIfO$p7OmUOh2LE2)S1>@N+ zF2S_~GZ=|es|wBVg*MQ*+u1}-976!KVZpI-zkVw4pDwf%1M~yLr;YF+?z&TY@G^nCdOn!PDg+^NhIa-Slfc zTajFc=$h;hXDUX6bU*)PisJIGi64@&I!<;Kw6P=fW9`b$`@>Nk0 z+Zmf_eqg`0b~l0H1Uf~EIA0dYe(3&__!lLP7a8W;Tmtj5#PBl1RSoICenX;oW4TU} z%e^k(F0Knm&s6$-Z%7*6V7P&X-K1KI7RrWnLRx*m)%l%8|^V23RtpJN_u+aQ#odOUEt^QR8kR1k#aS$%iHU5@a!ho z%WXs)hrJGZ=G9Fq;vbCtD!seF{DZSSfu|^;yWsJL5=GO0@N>%*dby9F`93PP_Hole z=Uj@76U&cwpJeMnnnTCX{7svviZ{FJvMX2cX0H;z*S%z)1ZkbX_2z#~S}FTJq`t%qZ%P@p0qg1a~m=S6n603ZwQCm?{!Mjk?TDFG2d#jM7W6mpj6za7=QoJY|TvWSX`~ zFTr2bQBp6#6NAMkKK;BO@3lU90Mbj4C4IDIdkMM`%up$F_Eqdk8 z0Wp@Jm>5gkM{wD-62-NDQVn4rLA7g{(>{Xg&UKNX=C$PPD=@zIm9aG97|Urlf+5}! z-rzrild6aym#)(bxw9;kv6kDWv33F%69X`a?#wU=c(sr^AtyHjy_JD4)(G;b<4MDO)@K@WEmLlWL*9H)V>w@wvpt31zy1YbnVU z;M}736PPz8f;Y=4vx%+Ch9yv&%|)QCu5}5u*KeFwckQLK1o8+PQm%bbqIhu*KRTxw zk19I$j>Pc}(HWQ{%k`7%CwRs8B1%H0GS<{DfJr1%t*d7a{RBN_tZv3CjCZ=EQ!xF- zA1er4&Y}^xLSne0iRvZ>2#k94$`?3S69iJpIWUPKP=ZNiwY)1lYL6HN{v>hy=`jwH zk2PUD66;C~bsysp`Ph@m2=yc#^&Yc{8hETZ+l_n=NE#m4NH@+Z>*XvhD=ByR;(gR0 zfw^8Hxc(24k3Z;uNYphF$2EUo+J8_VU&NilRv`X6w5@g5%-|Ig#}(8YhK+_VrbiNn zt7`aGJ)&ngQ^W2V+cQVk)BjTPDZx_{D^I@SI#yYM;KrK?3>KJ1EIENEC5|Us@VjfF z8m3(7rNeJ8;XXZ#;q;OaH{?zIHM`tk!3{S{6n}V9q8c+3E!fwTrNvv4ra%dA3Gk;f z{BQY!O4wg~iw*dmsF|)&;8uy_)_Ym&_ePij5^t55;;Q0a^-lku;9foEdQXu0OA2*d zr^PJcy6-V^z0V$-n!MUeizZxDt8$(@?&PeBT7RulLRQ3IAM^S1T==oaDyun9GWb?% zOl<-D@LSn(o*u61yP+x}Tk=oC<;#0gKH_^aK`N^~qAzKJtW*{?JWxR^C1J~DHevH@ zc`13ew_;Q|rIC8uezu(4es%y)bXjO+7+{B#3lFhF?J0FI)Q+&JTI!gexe<1>%SsY4 z+Kw$JWvrc6E^wsR=2kz$ zG1qx+eYmn(kNLreAFZT8M|||j6iRi0CtFmCmWEpVv$FGq;E4ZxtGw8^S~8rLmz3MG zo0Q}4CNmU4f!c;MWQFJ**%HhO*-)NkgKU>n%|e>rhTCO#d6wPMU(fbSg!H$wY%0xQ zOE9zSXXRNwvtL^$wy`hvYx}k98l{NU9y^pPvF4XAzOjh$k|J*Lj(e<2?YOi;JnpT8 z&k}XDv=Zy!vuHW64jYmzegka4X1LGOM{LGcRATP^@K$U`X{#7*)2BIfv2kb6IC6%* zJ$Efud;Rrsydi=Mp7fi)JErIp6GH@@_zZDO1w8$HQb1A?E8oYl+6fj4%n@#`j&K>6 zk3M!Fbvgs>0xr}R*c_^Ma(IIZs!9vW}=bj1$^RXL}hTZA_Dnl8w&{b==P_R=EOBCD9o5_1jGrg}peF3&m z9IBCza@8}6_0~iq{72RLM_siS3YxvnHf2TpC#}+5`s!J3`D)wAJ6bOHW%5;~cpCyc z159qHz`P<6e8X*E6gh0AD7M@0sjX}6bySrOna*RY5*Wo+9VJWX9~w*K2!lr?OItO| zw)WV%t-T(4=12ZX+Nwi&4$ZB+A(+iW+6)EvNLKmgRBV>*s(#0Y3WhOD4YA68Pdh=S zZk0VkT_wezOXmObn4j3+-tvKSiuU_EScTaYL0VbJWMb~R_j)6m>?GOEpTJaf^I%Qv*s?oA^qa(*f_%k|9r&a10luzv7er`Y(yAoU_Dg!UlciU%u3ms7~q#fq9Km3FrcHgy6SNvr$I~ z?#Q6{5rTTE=NKWl|0T*9A$%gGp&`&o-V>keUn4oKuVAC3DXsZP-II+F{G*FjA5%#t zSM@>G!3aV4S1jKMLF)Z}yk93X@T+^ukwyy4Z|RHbLCMF1MS5gG+%0s#{2)im2Zw8B z95MzXtKz}Gv$`BEU2!$=V4SIs6f}8`N%#P=XgUzZ0B@8Y`;HV8N}gp=M+(OAdy5-_ z3nWKBr;&mwvN4$^-3$3ib@m2((g=eoC{3fRl9{Sv94XjH&C_##@y+@0? z1k^N-b6KA4ua!SqP`xSjU|BTrLYB-EiDDkd$~cPUgkn!f2WlNU*g{=mjTY2wDruBt z6E7f-=rlw0t#?a0o_mSujuzCrPtx(~S31~@77UiJICX!eLjQ>qEJlV#d%US1<1@0v zjEqT|yNnUkavMTIddG&q%RW;na5||mSBt{cV&f-tDWdQb|13fO^W{?X%l{5V^TK(O z7skKeB08?{TkYL)l=${CkpUH>IlS&hwimNgl6VrRr(ToC2%h>U8)J;n+i#l2df}fw z;PO6JU~Z5IZkPtz6S!cULA8H$;g}0oHGVkVg==W|6<(l!9N99`+Qj21_NKum9#>LX z$>RjZ*GwnW9M4C@Q6vdk#2UriEiv59a8(z+Owt|Dnj=GNX~*u-jymo%6iHh>+HdP6 z)S_sd;Ii62{{wGJBeW)8BcJa9$Ja>3IXl53PLxhc14oT1wNTaB89pgPaVMp-8k39@ z6xd0$XPaa{wY2c~l-5Tsm-`7eR{opxF=H0;udMKKf-4?mdyNyMvk=NuMrbnXc+rbY zc%YcxHH*Ekb-H)hI39R~W7I3Vx$N653;cE7Dl7Cesxf2AQ&o9lK2KFFAWzKra?-KP zuCi2vtg^)(e~Z1NY7{eG(C`)EDCS!f_q0^|^|TB0%Nx&yU>|-(gLwX$fkEWUz;5Yj zy~OBNjxj^i$&xHuFK3a1M$F_G?{lOp$9$3+YGi5{deVfaVJW4NPsu<}8uBz!%6kMG zE6Dp^r&rUny3W>&_SYF>yp%+mAaE~!F3}YNgBP>rCJ3(7kAN$v48!mZ^#i(LNBt!d z%+p87j7)So;3N>|EwRR27{qbi8aBxQJC#SAQT!H8OF2CEr6<@prh7T?i#Lx7$8;4G&G3OE!7Tb# z$qMxf`5EXG>_Q70P26SaWgcX`I$0HQOzaRp`h0IL>uIU?1%I-U1Bs$HhVkbJzUR-k zfs?v|W}IUjFOJFg?5xA-f*=i3yfsu8ui;M`)-azL=#9aU7`8BK3?~EGdT>2au*M}c zKJZCEqWG4Cs1{|7+Oc7BU=6SJmW}9&x?I}nNHLM;gJ0>~%nY%EXneMa01t_;V1*2^K6X2Y+$cI*M$b@zv+Oz@ z>zIqvQcDu23fw~l1n!hL?(FJu*zD@{^H>Q)|50N2BhgjS)q7WWMpFfM>b;jIXf5;v zi5Z4iy_z0DFFC2>{Yeh;bSx|A@0%%|Sz;eMTu08S965V&Yk#VkY2rJ2J)+a%G{MC! zB!(78+?mES!EaxZC|+W?u3`9&KXADGLk@d*ju78W@ki;IA)+9OapXubH)trfN43_b z31T_?&>g|CzLCRO&|w;A&kH?-Tb-JL&Z4yJX=V_w< z{2H#*l<|t&B#LLB=NX@3GZkC^G0K_YwD!2`+py&0+i;H*ikcy~yS@)}v9vEfL%yY>3K$cZAMj;;6#P8sgNK5-AwLUK>=H}oHN23z z#O8ZJrzFcTchbKML*$`emC$Bh02oW;&IQ172sF z&lFr)myKDLbSBI!@m=!H68t`SQ6v+Q7?YVLxZwAcG+S`HUV)!2Xe)U_;vB(4G3NjY zvB%i0qSSoM5p>l1{6^*qObdzND>=^N_T$o9Hv&ZeQR3Jy$MwL6c-;|@K+EF8N~r1+ zsyaa(B_*Bi5rhYn9p$)CNvk2H7w{N6Rtlymc!uPAQ;QZW8z+aDG!)1tRhG^b{P`8u zN(KB-eu-Ec%XQ&Q)o`tN}b=f(XwsdLXO6IM9`!iE1Q`6*Mb?9}f6Cs|7tae*^R z!NdQSeEd6`OOb5!0y{lP`sn;*?Yfg?y{?`dI!0!zPqhr-!fycfFlb1=`ri_D30~RE?SaG8HNKE}eIPJbCFlREt_$leSB`+!(lR@lD(UCwKU)uHDyP%7qaQzgm;VA;rnAPmWP6|; zrn=b=1g)u3jcaBH+ljiAKNkr<*FL*!o?5GZAg45mrc}O_j1&nBwUEe?E;>6Cku7CB zgk?)xo0{xGT$Q4&-C@fx?6AAk{Z$@kWbCrv+K?Wiay3vSxGkICP`1$cv#ut1Kh=7f zJ}OgDkN%Uk^*jiS;9V(Xr!16>dg*4P-Z4j8ZZ!CYfnXsWHrw4DmkAv@G zDFtrP!@$LYXcLK`$riU1s31Imovo=MDG4qSn05T%*4br2Cb&fKa1SdD(Zena>NS-m zf~PYj9ho0er}&}Gf|uyq3RxHcUb`Jo^5o29N0^K*R6BGDEDMs+H~}7?a?adFu`hK80Ua-n5-1d zL0l8=O1B`56)ccqD^2LA-)+{4u@^jhT_U*pX=$oFB`K+#VwS|oIZNc-l4Zkr;l}z8 zS+>}wJfU#oyfBJw8!y%0UAg^M8}D7Ol;P~D?(qhwKC7Zu8q4$Pbd7&2KYL8n2Fp}T z8RF@!c{tEB$nq{tDjQep9JW-@%pENe%2n0mQo*fh9G{j7>b}7Fcc~zk*GQv=;N{oT z+-x<6%?iV1Scg;99apZCGC;R%OQj-kSxL5p9deoA_wHnEnc!))&h5f^vWu+dsoX z(D+IIeUfo9HBKo*4<1oBRpe)OlCFoA3szaW4QYlQ_A?z!NYXEBIj>iiuyy0=ys42D z$s25sviJ+Kln(`bA`!JBl*!PQ z633Oi>Tfi7Ee93iYsne7R*L`7D}k#dj;ns);?-#QH+%ty;i@iNhmN+=^1}3@%C{}3%l2hR*Qe0c|b)lSTpF1hEVhJaME)oEpD`q9a%% z#q97XmIM4XvPQs%MkDAU!+A6_+#BbyEBN@h;w^0=y~(OLS|h0YkVNs2duDWvpinKX zRaBv!tRLwb!PhpC6!bOktj3LeB>uaG)3ih`7)SkSu2Mb{)PIR-6L^vl)(YJFwgj5` znBV-7JZlAY?qLnC6^!2DVw_;rpZ%wQclFy#_1Y&3ip z@`j|I!U1vI+|y;4;mea>*X380d{MZnr<4Q?*>2WsY!KXhheYt_$2k~0PAQp2Hj00t zbf1o>E*MAMeNNxZ@D0gCZn&vLE^gXqO9CpT?h6vf3p}rEhLK$1#~u0&iQo;QGcl6e zq==DCyk9t;B!+G%y2DHCX{n@@SWDbm9O2Iq zCGB*i$$=SsZG1*x8-KP17;Cd54Gg}=Bc1nn7!yNLkfb$^)IQWXBr$XjjpfhS5J^iN z>6_3&;tqy-g(ZewVUp%M()#cg;+IsF>I!n3J+FMPgW(Qp}&?6vi6wVhyb{ zs*=Pos?sX{tg1xPa7XG|xrci#Zwh~=R3@pwkq%crPTcXz`Kb~^ekw_Q9cg>&F5-5j zX7iQw>?$PXI@01QD~MZBWgma`DXF6)jX7`Pc@o3K^EU8j!+DIA5XQN*93Uy!uMk=kF_`9ikWg=6_M z_Ck`DI?^{69whGIg}r{s_WC7B^BrmZFSii4<(DVsPDzv+7qQ4R@rjHG0&L7<$y0!k;NMNGfoo!!?c*cf3Zwi&&Kxk+k$J zt;0`38(wy20YqQ9;i}_Pro3Z9Q($K3%UCkn2 zy^24pt|n=^BXzx|$2BbSHBQ_YN;H{B6v=qv#F} z&RT-vs{i z>-y{)c*XYyl5!ns+YLL3+j+zLzmXW;|ILg$yhO*hG2@Q8$<+7VaO4I*^^rG@;}fjo zZd}cu)i;tk%gO2d+uYwu47tA@&!6$XCFz*!T3`S6TjIX`ZK4jdUWcRujxMdCSOVfvL)oe~Yh4ymy}``PkQw%kvVs@3=%_nuwR^`wkX)<2b)@f9NHS zy^YCe7f_&GU=TN{?_f}{&;d+a<7^7=bVSZ}g!cD_1#VLBD zbvqpkO=l%cmtye}S?{1&jxjvajuqC_-OMhGbwenBuXw zaWw2os4*9Li`ZZ#O_QZ3l3AgNA-2iHP`fiU(GJZLXNB#8PJvkgX^d|J-|{CfWfUj# zDJe5k*uy>%n0iU=WWAT1k*iVkP6_%J+%!&h&nPOT-d3)7w#rtvS}SY~=7e~p5z0=b z&H>q}T~gU&Kau}{vzYh!BABS2ax|4<>8Yj)pU~+|?*Pp?0(n6%(Xkcsf@|4TM}^0S zH9S5%yOIL4D-~7Z(DPr$neX)uNE%!^xvkJI^i!A`63x$#!PX&3N9#~O{`3nC4SR`W zEtPcEc*6q|)L{M-!5)gp&?x6#hcEG242?65c8^g7OOda4)_vV4g8p2Io=QH*xAS8f zr&r~^l_i3{mA`jx*TsFhF2>>iM^*gaq%)hYA6*&FTGMAGo_mF#JLg#w{1G(l(whHo z3cWM%y;=hNmtFaPnWXFGn)xKSLvYhW(hv`gbUWT1g3BM03>R)@7{2x)Hq#ElZyw_O zwnI?;AxU!_8Om|5Zh0voqT#3LCsv^svh^5lhn&Vk*FotIF<(0H>1N-u%ZjO-HM()cCG$4e`Cti6Ih&FLv$&{Kv`J2FHcn#jaho=L}z zd?qlzB8vk`FmWTF3m$)tq+&tsnB_Aed~3FM9~$y0$yTiONd{3uC=(71}anu$A@+dW6QQ<;y<71gy{l`29l1rV(66wNa*FxcNU> zJ0#@jx3FLEr+fLu>=)dtreOyJ)o+&=Zuhl42Lw(2CK3Ft9Uo{j@@@IT928u98wDH` zRJ)D7P@SRTLBZ9xNdycwGjd2^9%Isn1b?J)c{`!LFB2W9W~X^c@|`bt5vYX!u;9`g zZQ^0vIM1_*hYb-|-6&Dqcq~FPJaZ46wmyfIr;k- zeu-m*-tQvVEnn#&tq9&=h(%XfyI_*3(c_FZb?QercHJf{cWM8 z3cpajFJw4B4pEgcL+0v1>QTDsNR8x)jvJ~sf3<^LnE39kJV_jTCoi1HYMB>KbZnUy zMh97QS%nlsF}d<1SMNW{n#;Td_wPpq@A1)(2)=f>mdf`v9iT*zZOO-l*-^o$!1MrL zZwz$3%+n42QNi@UJoUk+;7Xlij|z$cKP0jFDa9#)Xddze#VH+9Ly66AYoJ4F|J1Ms zVtIo8se3OiA?>~N9f!LB902iUp(*PfHU@)cX9S5G`UI) ze`Okq)PH)LVU={O%DD3+4dc$6bP;zDitAE!OI3+rOV!V-N;>9WaP$I+;OGT~ z)x1QFQxmjYWZWF{_L`%5LP{pI#w@yH6?o_*iOEfkE3Sms37a& z?2CPgo!JGNYH`lm1ZO37#Sr*HmIpTk{p#5e+@A#7U6{B~;z(#!Pyu*UFgd(S_lZXZ zQ^Tv&I_jukefaYvc=8ts)|ZRav6berOr$cL`@=apgJ?}2{DogbWw0m1U34pcRB$Bq zWU54wRb@~Wet$;=CsVWdLUdM@eso7uRAoaIu6d3Mrkz)Gp2Sh4J;~4YIN~Bc&d<~= zZnN8ygLfuo-x{*g8uA{{1EF+GKji!v~u?qFj0NQyWRD(N?mFn?!} z_H-Lvuzb%eeIF&kvj{BUc~Da$KM2ed62TMm)JWh5!R5_)_}_e9(9#^^2i`eaOS6Hs zc4dGj%PV;+p`pgyXeW3Q!31w*z)K8orMMw{7b1$`-UKei9BGgvb;npLYsP}?v=aD1 zFbI>lR-2@_@s97b9E_AzTBILXx~aOf{XwvwC%LW&CwSQ+s_FN%1$yQ22dOZ76=k`% zH&}b+8M2cfn5%p29|VPgrMedTQE<85_syZ|%P?I17DVI39@Uawq;cbtGyv`;*{}9?F?zaaDbZpuXSLT3cLo z7nP-Ypqh!%lIsrbTU*2%`H~tnEs@mPB8yL?M2xht{_|&TEPnGOKesj(cRtCAY-6!T zzTjr%3&~?I#8>L@Is?b;xPab!Z(}h^#%s48FAMdzt?f#S6F%gp+o(1c6KKSprfE%~ z`h|Xyt^evlM_NvHM0YSVZ7q)4pY&+Ht;J&B*04UOao+`aNuia@wXQVWLxy(BOx&i~!tE{01>Hna7n*At-(TBN9QZcSTgJc+OFo*G{ zA%@8~z2ns0;yr@tMmkvETRefg_^6We&Ga-Inm9d=CU7A|cC`L!_oI@JNA-$2QR)Ke zQJVN%K{HICv%SVeMNMno;M$J zY%evrBmNtHi(Tz{xP7)r8Wze|{OMtrTQ4!am9i2rWO?9G ziDIFA&gu4h8Lam!2ixVe{#tHFdmPf7e(?Sn)1aT^B3Ek5$*j z%J5^=)mRG|f!=*BCdq7(#u|rv510F9$~A}6P((rIpe#tw$`)rX_()1^gnX?NW`#MX zi)D*+k>af$n6cN8+<)bUy3FacM^5Mmk$(8tI^T5_JKa zva?0yyO=;{iwiFEG50+{po{e_9|+vTSPqEco=HOM@JZtIOGMXTjdZbS#b=ETp%PSo znk2=HbhR)#f)dax2wg4CtH#8;T0Gs7b9Grv38{qnR(+T8EYZ6qdoh6>?1^8>A(~g< zkZ>OwHcH84cDh+yb_EmfX7OsV4x?pJCA1QtB-+z2offTBz<&sJw`k92S~Ji|#_Jf- z-Qwl(I!t%BNXv9XEl1wWOg`?!2_iEujLh+tE_?{{zajUv4cL*pTlApggocWv4o?~> zSO!}L97~`5jf~`4)N|U$T#Lr9a{|n@=tQHWxKgkD4cj=^^0k&U#Y7(WftLBY-OaUS zpdwzqj2KB+)ZpRb`gpgV0ER$$zv^jm9ba|PaE4*{*L-zG!wocC|8>c5;rbdbNAG2QC!+*@&ukL7 zlTAP%jeU&3FWLCLEPnZ@57bU$mG-i@Q`@VT#qS@HI37vkF^MK(pK`JGtx60Em1ehQ*<$Mjh z3qYe=%D!Wt-U_?$HE7`6$6|<`PXlKfZh48JtuP~S zQ~`~5&`zNd*c9(w=+)GBF#_yVeJrv(9-EJEg)H7ek5$OCmB~glS<8;p$5w;3OvMaM90V6;+-MmCJ$X%bj3` zVs3w&8S7`!rP8oUR66ql+ptPGl|yRnO?_KGiywmnLP_F)P*ymkx9fc3w_X>$ddHYu za1x?FwaueR=0vx^v|_nbJjHfaz!PK8*{SY5~sLG-oC5 ztCUljLi$@&R|Q{xi)t6M90RO>QZc~#Cl&eD_mDl1`_+N?P*+`!Vq{gXEZ634>867^fSB#>8`yT823qbjpi3oLp|Zw}bK{nzUYEC$LF zUTtwABG{SoC5?peWeVd)kXLz-K1N@_BJrM}A(#~;HB;e{;aRHJB}X_n#ZTxPf{yuU zxSKxeUtsZ3rG1q+AQf1wAm|t>ELG&xV*YOtW%9Ww{Ee>a3hWv3*)1hEndR1%rt9Rm96_sKQKgTP#rm1D47M;YN(3*?(mgSQYDztepP$k2ixMMQJv$G! zxba2FKo2|D+QdVcYbSU%@sKj!MSs=3mGGcXcu)y1z8Xl=+5goZ5~A{mHz|9_P|=kD z@3>*8bakr)4gKKFLJ3Vp47GDr{W#cSCoSqDitQ?6g-tftVm@ExaM(TG52|+@Y_XnT zOnKLMpL-ne2U~0=wvmzdEYAOx#BkTM5 zq^OeQqo~q{+5|p1j&-tGw{M%Js1o~m5t|`y$Z-8Skr>t~fj(_5hR8Y{791{9xt7sG zOhe2McT3T=O}CVyN(7WxcO6v_>*O2e!3&@u*>g}w_(8pf;m;jMh})G)tq@fzHasztL10xKz?L6eX-y;@>twsCH@9o0G}AJ6 zOLR0JVpxl#3}prS z1=!s0Tdbmvp%IR80*GJ)HRBOXr;E}E=3^NnEyG$yT1%%xF&DRy=4TL?Nq`G_qENIsSXR_TeRBgIiaIc~1gGtVIwx7U{#>JMUP z8YJBVZ2Rtk0Ray70|F!UcVu9RD%OWs`e2DVA(@8Z&*^q34Si|;8Nq71i=+20yO1td zv5@b=M6km9hzsBK-j}TGgI-Vd3o^u_gYC;r!Z_6}VK<)=iXhMHMYfsVLjElDRxs`g zPOuTI_x3TQBGNVeY_F5YuXKoYU|g|I%~xS9Oyhb!?dQ1K*$$Q|6k3=O{5nR+0o{!g zF{sp>FvpNdI}sZoMS^D(s?=H~_f?l#H5ZS^IJ=wlK^<7XuU z&rYI#Z<0Q?kcqMOfKI}N7R{cePn}6z(>N*}$yzjhRvK!ghCaHPrk+KuR3prkBAQO1 zNPgn4l6J~Zy5lV5zW#`+;1xWfN}{0_W;&~6x*XRLo`_kjl38-xjq$|XCNbQ`a8;w> zB7Xiw%2A^PljdV;Ddx7i5=Gr~iQ;9|`3<$|Wly3wBw3bAt}I&!%RT&1i!8gIeeDO^ z&10YK<{i`DV;qXRU0cEJ=7}9)( zT8?3kx|F4?5-7n@Dyrnce8MwB!I=abDfsirmdG*<)x#%OEe#v<;86YFpz%LS(EsQm zrT88)M^d7B;l_?_j_grl<2?HO+#^SL2&Dnd#}!xm+5Gto{ai);p&nUBm~n3hQcpqAO;P=20XEj3DcMq+p-JFIJ9<&<fFZsZ!9H-^ow3Ijtqxxuy zY$*|jIYx}MF#U82C#24yM_P2@2`POSTXdyPEoz9(=Ya086A7j(wu0zoP$jZ&))A+? z>{4o(1YdbIL@P#qTiMb@N&;kY-y~H*-6g-2lrM!!O4nG0GM-lo7foVf~bprVPClSqjaR1<5!Sa&D91y174>`aQ~*3SF%y zqm8n-`zhi^S=7^$^ci&VVHl=6VQ9FShO_xNSKJ5R)g{De3-eb_1O(zF63F29GseQG zqw_HqsptEc>UCLvV=QXc^)U}W>I0Ack56j!Kg5i+ppST?fZ7alPK)48!@6N1T|5 zA>+F;L01#wELQnm&c<03%TC?SGC#?T-SkJ6yDX-J^dF=)SdX^GStM+K?KA&LW(&O8 zULcQO4Q6}uJ!c-Q#Te#|b`F^>Mthr+;9jpaeE!zRhSPb4k&TW%TH`MBw(E_$aTZ6s zj_QwSy!G#W7jZjX#JBV58|t85Q6Fz{Lw(l8c#HZowC=}ST&wpJ$6G{O_(`^SDVf3X z78y^l>Bn0z+())D zdt3P;Xv8SKxx~>`dgv~{hiv7q5?*bq-~WFT^-O8C7W%ux9@emAPKXlxax1E6U25 zXiI@JF;B8^w>}88*9s%lSsP%IMXl@E>XR&LU&8`Tvbg3(A9&^&T1UU&(@P`Q)n=b$ z@xq&=P4;b|?ogYNncAI*yG7!-IdtDs7o*7B|y^MS2<@`zLp(BG)aG}Gb%?UMxbplznbr4O*CW^x1` zZv)QsY`mRp^=Kfh@q2M>jw;xnc0vvu<1I>#zKgsiUUIxz;uZU7jnGY(hYC*fmU-+S zv#h>>X%zUBd;2UqnjbMn+ikiJ+eR1Nab>t_0Q*O_{mOcY@h$O{-A3JBOKb~fhgiH> z7InJn*h1)THufxw{kDUac$P(XWT}p7mc^_8W~I%t=;|+EW>KyAh0sgXEQ`$qqnc_v zo*GAx2rdb_h3+hiVg5n1g0pp>sNj6v8I~>7x#T&S(^8D}?hM8#Fj5BqqIAJRU^+Lr)9oS44elXYP^2sGJ^B{W zY>P*R>o_~xqQz)6f0@nMOW)aa(VXmY{PyFRL`odfE!}(374#wXJ2RVxR+EI=3IC$l zY>SQ3j)y7j>~wwAc(%n>#%`?XcObTrf;>Y~;H-K2&3!C6i`0M(KieW#cz4~%oMaUc zs87vhHWyTmpcj)!xJS})4+%At@W*@DJLXv2^N0^T(wF(~D}0Ku0fx&A9o6Po%;HAtLVybWEN?5vrLEqM0E0UMV}rabhq1wYy)}pY z5OYx1$!g9Dnrrcok+cvTDc_0O`FtlsX$vvbo}@-aMK;D(Z-LXJFTe`W`U5Ml+X1_= zBftun%T>lu+DZ(yI|4lK*JS$H!Im$f&$SqAhgzO-lCIjLxfY|SPmW=!$0+nsH`n4* zy@y}W3QJj@n3l)+-I;5#)#GI|KluYKUGfo4N^_E-;9weyH&$?RU`IfnRIpocY*3;Y zt5@8PwNzYDuvpbnbFF(+A?{;$>Hx!b@jV`%r7_!T8MS^zIAx3O{NSzLIhPpZd5k%3&gr>m43|IMP#v$!pTtn<0SE}*Kg zfOlS_SR>gfULyAeLsEB=(i|zxClxqS50c`J6!%FT9jO;d>5i1{llnSRUy?E$DZ?ja zInqvkSrJY4OK+ckQS&V#1>z+(Kd< z=S{EWj^qSPATH+P3Z6Hzz`{LVN?P^vUJi|VDU^5$BiO6?CjYN^B#6Y z<32Zm)7>o9n>Rp_OrS;@^Qd=;VHvUms-RwAu}!w|cx@X8%rvyKgPfu7UN6gi9a)&5 zfJ$912gQG+Fs7DHI4DPj7LICNPP?b0(y9EDYZzp=or2kBKexY7yBB8!R?sR>%_H%- z{jy@hmv*gJQ4G!11ii$8E`imo@zsGnI#lcl9ML#2XLN-1wiYux@AdncQvkzd)b7U>4+tPQeFj-FC=tf{h9r>U?$ z{T#JJdo>L?tJpJkjWgHAK-N>5k%boK&ny9f-|zz_@J}v=2$YbX_esA=0;Qx9W(5{m zn4?q=9JRxPoF<4EsFO6I_jO-RDBby14`=YY_yo&-;{p@xQ5#Cnqs<%)S+CwB^0Y!4 z9q-$tmX`wU@St|!MHaEog>Q>5vY25vsCHqI#XN73w&o&^uALxHp%Xr4w{WtK>ap1( zTai2xBV~(_l=Xpyd0ZlRe40LQ@qxu<*U(t@nrWUI%YMLf1RhA{mq=ZCH+{&_@bAc?yNzTweoRWU-Pr zm!H8}dEc@{i!8p8kF#Y2+xWu1})xUm8sm=!{fk zF(f!V$SD`YgV|vM$qbe)&u{Ab<=jr=vxt$!7AE2Y&-K!4V~Z_#4O(KDZojuS@vL%< z;tO*TjN*j}7ca-=uqktFPc6e@8eUG9lkSYq)Z)v7L~GT>Uik(s8^>O3fq8(C`or(YI(>=`Z?#~q8AgCseIKmJ={ z_&1Rmikv~!7d^yMHOS`~GI3mbGiOR}ZF6lfs+XFOYx|e6l<9AKd*MX0Jhhuq-U1rP zM@m6@khQq~lmw4UYi)t0))|Al2>(es{|WEa_xp9TpRVwm8d+vx)H^AG8zqh#-((BD zIY>Y4Wfs4>Rie1n*;xJ~Sv-JAB3sYMnsQnK6`bvx1sxVt=ai2a|y2|OO41w?;nD)oAwL?qgC+;?@HG}!T;p?I zbg2)#UP3$J+j)FsQL9$K4F)JGPNyuftUS~Szs6$eBNf!eiQ z1k`>YDdU0C_i{sgyMWg`o6Qtmk}_aqorS4H0qZPk)M6IbS=^q%L{7)7PhM|YZ*j$S zWL|G^r*8F6$81P46KEuHG+HS-nQpMS;y#HXy%G19ip?~{-t;g#($A1LS`=|MjhGTJ zj@9xV4bK#H%Iiv*Tyy=mgodn#jn;n%X`@B*g{Dmw#yyTo$gN)p@s(#o=yom3CW}AE z`3Y>YSSlwi*DISWa=AE(ZvNs$u>tq~VR|>} z6Z7-JN_9vhTde<3&g=Y`KTd|atN!(4i~3QfSORQKe)~mgRpf$Cp>{)#Uk#sTTRq*4 zS0Cs<*QtWGT0Hlr#PBBZ8HQmVrAWkGE{~wVe!x3I_`vSe$!V*_92%oNt-Kq(wz>`2 zYB5n33f*%G`5P#8Cu@f;7cIuhN2*TSYTcFpxRGti;?!f|wkOrl{dJPwPW|OHjiR8t z#{7wesVNcEbT#maMFYJsM4%z>Ll98Rj-(Y$LPsGNjN|46Rj|en$8htXIg0<8*s4iv zy5p*$;buKG4?8THP1bpEr^OXKMX2MP{p_@;R)=NWX;Hlni?!3DW*s)mPK(Q~=bZ3q zvRPJY(OfW&+AH1q!-ZomT-7jq$o9}3!Y&JwCK049R?QZJ`WY^EdM$?e8Q#ZmRioiM zBpr7!TtmZmG?H{QS{!l;-dz?A8cEC{Xac&6>$x%97R|FO)IMy5{n+hZlr)74{SRzU zPjyf|y^sB?NV_b)=58kqN0mRKiM6H?XdFY3<*v=|ve<+}+CeIgkk*J*x676S6Zq5t zos0c^$xp3`p9`m*wIUaLA115340yKa;|;;A&OC?XqRT!@(0tY!dv;!i=>N!D72cSKLG#(`^7D zlFWYreeUcF@Jcp~YqJA6T3%vb;^#x)X^G+K>9k2RrQxUfr9Rz)e_Oo5q3o4xYBf~? zkvW0V7%#mdalFz=Xa7#LM~`EykUgRTf22OifkW*|-IjlD@wvX`jpO!59t{+D1*+pM z@RsnB_!93s4Sq*|Yw0RwF&U%it+!P&e2xr!=Y0qElg}->;yXQA|J-5)wn5UcmzXq- zK1mkq(DJ#(NlHpXH%+pEOES$D*g%$_H7%Vp|H_sjn{=TRi)QAFl*>=`AvU;r3w0 z2jWQ}mITrjsC5Tx=L?Ig)ZWL%a?B31+l>oGfyYSNZBePC?xS~G+|pB(C%Y}`#;C8| zZE=508Y=rEG0NU;6+p9MRg3Mms8$mDqHlH0S58hguU0ov0VN_!60S(dw{j>crPv=JFy-L@<^&o0v?$)4mTlDXW|%$0rG z+lbYVV=h;64jng&ewB@}$KrO~4D7KO$@874kuNRGn-amB(|N2t-5$_XiG4@ncxO7N zRELf`=Kqlx{)gzQ4jpsoY}zkp3kfwGAzcZ3sXK5y)qn3Nc&{3poH>o(-{muYER%Fd z`qGw_li>0!a;o$)2@U7qnr`GP3-c#(eq~Yl4vFE8KT+^k7QazLy1iCU?1Tc??bLMLv&0{H;Jz6(CJ3LwJ>!gf;t~-WEYGxs9O*hj=6AEWv^XFqNwwj zMDSQXH;DPVLCnNb+RR3=LJIZ6_|_tyN8=HVWa^X=a?lyW;P$>EarBje+>&6REYRNt zv}=eMpDT{rxem4guv_XI2L$7J zpdY|*?NJ+0Pzl%E$Ub-2;+5A}2p1<_o^=&ij=u~zkeABSlwqE1)LJ|4Txb{q z)$@ePrsEcQJc5iXGRr1(3OH_2uK}At$)l5zOK^|AM9C*CxQK`tg?t6g)XTUhoqE~Y z%P8}N#jgiyLMJTh4dll=P^MnyCHl5>JW-7tA1IQBfwJs!PhTK8VR6Ft_oNZ}d*nX& zjp(UKl%MmxT22 zFE5N;vf3sCDkN7^;lAmF#k2h66}{Qpri-%^7GHav^zi!xFEo~5i+S4T%0E4jAEYOr z;Lf0znBNlLUs`w>0TnbqFh9VXhGcK(Fqa;^)UTi)0)6yk^@K&=@W!xutUF;bOW_RV z9&phBzPdMn&K>Cl^7zGGVtPv)zxc;X{N%If3zB{xN$N;ayGz)BCoFcftf zta<$6ke+-}aeKm|d!?Ryo@RKBJ$%MwPmSD*XsD!#E=t{|E_6>=^gDmU`F=wAznK3E zADnT{^?UA|@A128s_C!eDU)l6GxwZ|y2+Wj%QPrKy-~v6F#rQmV#_`b3rhnFu^lvO zZKT%g+tD)+%JT!$1BV02NSfi#y*(Z+G|t-92V)$#>^xyHnxOjt%7Dz6U%_R-GneVi zl#!vyAwQ|Ep`{_e=Zy``3;k@ho>}Og(AWQ)=*M}&^>d9nKD;sPGnD~94u6uwj!c=J z;xkO*GZzg}oYJ|Hmndk7&Xsyr@=H29r6|QO|C!4(uF|AR9vy5?s`OI#iyOIPK!&7yIMZ8A|iL#pT!0sW*LIMhwH%FP8`|XE?*i$y4Yj zZF%|+7S(hg^H1tX{@IFk_oG{I;qsYk`S7E~VVN1!8RSQcZk8}Td0LFN(=3mlF^yJ5 zF%;WecP^b9EDZXhJ|-#ZlXy@4M~nBp@t(vm-Xr^%XxzXWmbI^2*zQGi|e z^c*eWB0Z)Njh440ucrhz%MM*do-U$252>AqB>0nsc|am~V2MaRmT<=r!AcpW`f*2$ zlgP!0QsYY19mY>IU|eG9N!+eh9r$WH3YLxXlf^gwHebP$!iA2LcjmHSvlZ!00n1xFxOI6mWOM(4Kxb53p!aIexIvbYjPE_c2)k7^lg#BCx zkqA1F7)4j<$93>~T%AT8Yt%?vk7uV5-2H^)I&BGBWpVJ=DHi zqIlp5i8|J(V`YaSYXisXa$mr%)X*0aG1AV1(N}Cg)}x_z9`9|$aLb(%#hv#{49(R| zG&Q2l&`CP8#EGQmSC55x(z9-gI5Z; zs}vnPJetOQb@cGty1WI^oR4tp#tEbCX!Q;}n(FWv*4S-&V6x4Aspv0l7xmcC#Y=D~ zEac^^h@qs>yx<(cCS|CLE?#$CxpnkTjjP;DSAjKly=68#d8no@B0Qi*yg8n}f@?~F z&PhxO(8WVdJ(Vf}x_U5|NCZ4_&o>NS5|;?#Z*!J-d!TOJx_bECldP|99$L_kU5kG+ z{qCMW1kcvK)!oDUbR!xulI!8p`ZU^km-}E1-*OL)%8aWf&&_2W%%#)l2tKfrb((g>IEkE|lp4neyqod_ zmfIzs#IeL%?L6VFMzOw;($m8u&q>rp;-SRkpn9A9F`E@qk`ri&CxFfEVfvM7|^ zHb_T5d115-^av!Yq(@*+z@L~j&OkeYH*;foWE^3q*px2NkYXc0E1R zdyX^FSqgtFFgfV6oT1d3owLz)^16FdWh;~G{k(zHM6o}jtuAhQdgzA1dhFTLJ8Na0 zt)f2+>{0*gy*wCwPgsG{IR#fQ^k~`aT4JHs8qYg|@33tzI4`1-}d?`_-4heZds=x5OSkU9vA&94ZZJUbf4zWJV{-eBmQG zI3|TWMk`eJlDxjq%R^h6qlZ4dJoL0fZ8$I7ME_x^oncd+r135>n88QwpH#SsK5Ad+ z{8?$&r9_>%8Pep(%6zG;^LbV)BGJ=MC?k9Vg{PMno?b@yZd)$$Zd-_Q2qst-p=oBZ zmYXQe(|06#d6?`C;4*rE7WtEw%D32CN3GX7vNuvpZxrhH-^)WG7A3)r_*BQ4ULJm@ z2Wr{~lk}ulIhSfLElaNZEO$!E_n$P@f7Z0~L&YI}O1(W8)nO8NmJ_c7Vn+ISxbl99 z;Qn+@CFxB#Ui9%$?S6?XE`zwZ@>Rc|Z-2h5vtu6*m)|ex%JMi_(v9@>eBG@B;z>-b z4A9SmnWEDbq2G~-z!V{u57Eh{hu;m?>8qcIU*9Pi$l^MaZZtjo{tptxA0CzrJe;XZ z&+h!Zx=SzNq}tEJ{SQkcJlw)(Z`NP0l~H&yy%*mmt-t3Vzd9g}tJ-RkE*Qf#H%TMh zl%rYe@8Pj`{75e!*6*dihj&&n<B8T!j))tgUd<;gZmLe`4C_*Z;i^W%Z%VqOU!dVXy~(bU&o$t1nj_4%8+lV=qutvKWhGr7A~xk6Ft!X?>(dOQT}~zO_Ctt%KFNR*#M9U8`@c?sCwi-Z)p|(dKLn<@2^)^_6qD zT#eIQzqge14puu@&HDybB`s`IwyM~jeLa0_>bcrv()*ZYnf%Dx6Xa_2@=uIaX#0eL z;@R#Dbt^54?S%Es*(O$76=-LxfwS?Zx)c30!p_xLRDEl8HuFImypE5%`^g%RsNDbW z$1B5@;18$}9w1)Z;7wIBni9V-h9?=kUJOq$c!L<;!r<2m-eR2$dxJDKsn6tCXOPBf zYB$2dFR;HA3zWGNLE0U1X`By5rM6_=&~Wa`;w zFqo}NI7%Ghf-iuM&SB3iZm`C~S#m{cutp$@gYb5Ww!je#b~v#P=7MkpZ`h5HP(WCv>$VQDP;E9r}(1v2cfY~$%@utvoG zSia<7jqcozn&|S~F*5TH)|lWfh=HZWFU$FjPq8lz*2vQ%WUD$@V--D&w3KWu;5E?} z0>+{oVkUAl9V5ybgNBL9C~xqP!E0N@TfWJiM=* zY7}$z+)}82e%+&0PUCeNsEg1!W64s(#I`+8$A#L&lk{YXpmOBrQN|A9$?8nuD_2Q* z%1|wL$t(fH>YtQ)oFj&5SWl_|UU^sL;@uMY*rat~&*`Fg`Q2}+k2Ne=un~A&h4K1v zYFI5b-0Wp=O?TM|6TLx&aYJ{baV3703gIf^wMG1fRw{s2Yj|lKYxHLMIKwr9G`$dV zs))VvmI~o5ilqqtZf9!!IxAA17Rpfdk<2>7HP)+d*-E~($$dt+kG109J6z)dD$5=t zBTX0;@iXM--0An?RpQ_|vN4>)Zn7kNhJ_#h;ZJxR8Wivh;VM>GIu{77 zEtRi5pC0o>{X+B_6~;C5jJ_pb;~Fuj=^_5QW0vdr8qI0?Bji+x<)yb(2yau29xyc) zt3@=UTx63J5Rq)PO;*DBns1Ss#P4}Xh42t%(nO{reumU5rdBc2?G=^I@hL`WeUmI{ zoFUFWJU&PgiJz1)D$CaxV2_b@bN)54-R_`Sx)B=I9V&o321sKkdanxO-T|hu8$4ui zdid1T5+xg){yhaxGB~|^YBUv<9mA(t41a_VLD5mC#t|wf!b0sL79E&iccea2NJB^p zV}ebERw}02E5v4QgvJR*(OQH$Qz$546;bT5JH|>?F&pLZk=lEtZ=`v0n>0+K&%`M|p4p~rM4CkXqCsfJ)n?|1oiOQFqWoA2rhah-u z%fpimUN43x8N7kurV1H8O>kb8Qb8rXNK!De z0+z;B3X}$G@~{fwsdU*fjMfPJQ_+Q8EPpGcQy4UiMk`FG7^Bfh4t+W+JJJlD)%VQe z_lj)##?yE_NS8xo^FiHonpGiPlTTlH8h?IM1@R{N0W6bn0gKTtQ$-x~i|i8i3Y5?Y zBN==2aC$Z^zzT417{d+i*R1)SdWGzo#%NDQBDp`vIzD$MZ@*uKa6dDVhN9A!xtPf` ziRWDWbJW3^%Gj@sXfgK!^^@O8M4rus4-6LP({8}>__fcgF?&Tn#+LG>^-sz zi!VyL&ek3~o9@PqWL&vQs3>ms7X>?NkWcrz`@#=>vfDh%Rd~~7Je!x;w zG^|&+n>oQ_;}gu5M}19&@!AQ_nT8xT!v9bq{Db7$h8&8KlMT6^AtzgEYAovU4(DNm zhVjaH$86F`xQEvb#yd9G2vap4lp&1*T)j-y7)^Ka$vCbk6OcH!kkrB>H51YwU#Spp zC*6aetcU(sGlNq#N^~}l5VA2+{O66tSZNo`!yj3+sk(A3m2y)l9aD9s<%>(NYVgdt zI0I)|Y!)~q%dBY{4`nN{TAHTug*r%+`-3Xi7%b)5%Vg;`P2+pA0+yPtVU=+GP@?)* z=T{(sp1}<3TGkFpyJZ7TD2oSV^VM!;N9tp@q9>I4n4!Dz%xNmk1d}9av)$C}>{k7& zi#5=6jn|fO=3OQsnqY?Jn_VdKQ=o|i*@JG53Spg-=jzD!ZIS1e0-v}lgiqY9K4EP2 z?eM7(cKCi0Tmo;>NBBjL=tas&IQ|pzF2d-4CtXI2L0+Gm3 z9Dmi`bSj$7Rbl% z7Yo(TBs0*rB9_+^?kSg6$o@Y?{W#@z^7*5zFJhg1QJ+t+s2@?^KwoL?OJ3vJd&RC$ zx!NjIDg`=cLqDfLr6?<>TA6Y_AGEBfzxo4J%2Rr^>}u43PS;g|Gc+u^YC(Ium!AU* z37x2D>}2=yi^h`_8Q+Q5wunF4Ugn}18Yx*+jbw>zKzRSivQ-kY?2Wdlo;TWCh<9{m zJA%)a_B)g9x0jzyZwC8M7QINCSei*Jy|{-9VUc1q6Wd{A{#N$fpok+5GxX; z5znIW-*V1u2fZ^pp>*PO*a>~a5~L5d`gl08)wi9`SS_wGvL?}yH9xJ%`ji0MIa6;} z9D@tnVyiF5uadF-f|3h(^93artVkqa8DXX;V2=M|c`|O6Mvi}^JiItdW0n6$ze>T6 z{@er}kBa11qy+@*%v(w!Y+4GPa}YlM>}=EL^SjJds@MuVkknqgM8#ZNUx*3<+> z)?}DfreM?bLOz$ZP!EG@fnkzBb~|jS(V?cyR2^zERCYUzta+lQY9R?om=G4~Z)tn; zt%RA_7F|SiVq1)?IkzU)#ItA#Il*>h8o&g56({Ei%~r6=E&KCQ{SBluJr$YQTi zB}pYz=#hD{1r%#6B7fPZSeH%)erRHc@E4dL^sRqyi&j6jP zRRD+e31TPo0NJBaY8_)*rv~u!0|WFB8YJ=rmj;+6dH`LVN_3rVKHP}~_Esv1x7rMl zBAh;I9Y?!$igxM&6v_?G0E+Z(Zk(~3FX7Q?wZ=NWTNsc)>v&I=uD~_gc9Go(Gjm>9 zu9$_n8di5(1<>6-BqjtTWOHqjZ67j51f)EtLU@jNZHxGS4U$eoP9@nz+&w0V*am_v z1$;ZlRw>A_hlvJup3AsWh0~p`9Fve^&k_6RIkeVH!dI9_YfX{#V#}vsOD~QT;fUH{ zuEu!vEf4U%Rg9wv=Gfb)pxEquNjI7J(qUXpBm_tKxf;{ufiQgROqDf9l?AC>w6hgE zj#sfh&s_F1bGp;3Wk4$EEal$8DhWy5(c_MY|Bobpf@Z4cO#W+1g^;0#X``lKJytAz zTziNED_3r1$`5QlDN?AomQ*#hQnGQMwrcQa42*sIIIvPY=iNNdTkw>VA!^{c8eb9& zA;Zm=Yg3k*r(qrE&~sd!lI}>tFC1llQKw9IB;{5W!mY$>OOX5DW3!&85y;?9A;Tt% zUeh&RIY=GFK{ea#6lUA=xKl_+mf0y}IZIs4ox&3Ll=QQCnr|Z6s-+i8GfAKez0rrT zP@f`v z>O74+XN(y5uwp6}@!$BQzc$Dx8dl4MfH)`&Mg3?w%ch>dD2-;>i@0DE#1c^+-3yeQ zYqP_CqLDn9`+$5kOisf|h{}P{CmQXhDD?uSsQIG5{Y2yWx44`pFhz`^2)(CT;=L*6 z{N@vl`Zuwee4;T|t&GV`QKhL(DNARHG6~K1%u^qETIJ$tUK+7HT3CRm|Exmz^9iNd z`cKf6Y6$J^snShE;Lk6!A?Yg`<9~!6eshAs-pV?)Fl6 zyF1C}v=EKlB;N|ZFEY_sw6F7T^T*`3`Ahtc1eI9NBRfCQZBL8;b?FXVYW+!)iAyn# z8V8<7t|L`e;&OW9FlAZEU7bm90zF?F>KKl1tt1y!%brKl9q2PXN#ckiSI#KT@5BF~ zJHQKg9?AUM(#P~^P4nPF9Un&=H4Z$Fd{kZBER2qoWeCBb)JJDz#i&&aoJV@coL?Lc zR)rcJ-E5cZ)bp#}ssl#dNwOO))aXO-dCBN6PBcdC;;eAg^H|{&b73pos>7T|-oJH@ z#q$2YDSg2CS**Sbb$p6()Hv`w1`sLp|5tKHd_Cn}QK80ef@U;4OwjbPIPkpkxIn|& z$fepwwF@d2yFAyGq|*r=daDexVk1S&P>9#I1TW#PuSD&F9jRx6CJUog3FjKaNW(7d zlYYNIKGqL*d!QK@%jXx)7~N)hAnEVT&MX= zV+&tsPnLj*4OI{gZ&1m&fwz5{G*`)J{vt;)rdAs3rQ&PwGtCzgL%2bn+APwr=mZz5 zRev#lB4InX0^3!8*i>Bq*^3|TB#t`3n4`aFTG?(0(i;WAotS5dg*y` z*juELqbJL^V(b-@yY?aGl$>*?TPY*6J=3rvjlsMu-%4^*HTB<#KbG-Dv7__T?1iV% zo~IA_&OEvco#$+kW%MGA)$A`ptYjk$VuwC0R{IuN>&W6GTr26ibEWPNHo!%+-u^*x-u{8m}ynWoJ3a9I>BIJxFY(N(3y6Z6dwawGv_+SjL~l z%6eY-=aXDqj;jWH(UEQoi7!rIm;PBZ7oTfbbETk!Ohr zf%lwpF`75!0$6DCO%=@0=5ZxTHDU?`+A!ZsH12M~6qaZdFlZRV?8UYUW3jzg9Ea?+ zkBLd$QVnaSlzyp3tvV`h)-YNbV%34#23c{3(48@*AZq_aRp3t)qwc6Q@7d&s z5VdE>#&D^|w<04MEzNPA`&gMvHU7r33$M;~{OT-ZjAs&#V=mL;C(-hNumLXR=UArk z@&Hk1mJ^EcE^VMfX!5Kl`J}kMU#?+omhVF7OZg;({QNaaFwIaQkTVrIaB2I6l|s5)t6!^eFFSC`-&6?csxL>FzI^K7rIytFf7%tRi*O1hu(4T2;A zOZX^#0Q-?`lnS>g;rne*b@%&YRV}Qq-3*^s;N5N)@i@1ZH{kPQDv^AA zf>>goU<14qrn)O!4_x7{b9d-mLL~F}dBMVGZF3Gel)^`JBbh z8nA>ujC+k?DhoW#6h_!E^0`vT7e;Nv;6?Wy#xj*L_E0JrJw%|M5lEJh509oo7o&xf zhTa$qo5k6p5%gRzGqqF^9?eHQ0$8bd;TT)_o=6ab^-wmUp?Wxnmf?DZe7`Eg@8Mf{ ztu6J1hV_OD;EjB_Ba+V-;scnf)+nk}*QoIl1*LA_-NN_jZD5S%C8RNWDi3t0>eYg- z)={}ZOwnuN2J~y*j~mbNeiU)2B!8{AV18c(@%|V&D8m>=6^t>HaKrm5$uK97IaRA9 zNmdh=bdyB*q4znnexdP(I9O+FY}sFEtWmkzO^*7LqCl=5tQ`R*P#4AG@Ld&+Pt+Qv zBjeklkKI#yah)aTSy>}w3;Bh{9{Z%t+2Kp$G|D1SCzTETOO1Q)V?noSSZ}jo5h&qW zm(K3#s^b_vIfX4UZYz<6-&T$JoX&zmoWeDx0iXKN13ql$0X@`GS@>+#n8x*zky|Ru zP6>UGdw4_bz=#ZW6mRebEwxR<>c-aJjhmiaEaBmT*W_}sj&7&}BGr7D+z#2M(fn1G z>nn}ly~kXCrE$3&zI~<9@I6NVmBwA~sTO#zgl*j-{_uM$Xz&!luenRLz+L30T57un zJ+%igTur1`r-{sFKOrKN;O=lzzj$4NDuuyAg_osQpHu~geN63sQ3?fT4#_u{hFEYX!gSK9=-rjr*S9$p{%~mik7+x{Zu)jnW2BMdeN( z(aG^{^d_sQF6U;?@?^wqQB>Q!E%&X))p9@mTaB0GQQmJgI`M(M6iik-_>r)KuHI8j z=%-YL1XV~960>`g1r_!vWeJw2{ByE2m$N36Zs*Ir!tXS!n^XWdxQaXn2h;iL1@1AJ<&ZRcHz^T;Dt)DN48nZ$$3U zu==n!^xGrxaaMsy7>~bkf{$_Ct(Yg!_T56}pA9DEpb5y=9mNh#yuF7F=GL(SG z+?c~JYbecxa%T?jHyBEqP%g`n1)(9O3MuhnM`{NTzr`~|o+`hUqs%d*2%Jw!mGf7D zvP;9dpJNAshd9I$xIea}zyG1w(tS5qOfm8UO$-@tWb%#y&qgy+YEP_t_mw>=(K}Tbck=NHzW1SFUBLVjD3pcU4;ppq zswC8v>BL|us7p1(O%Jell@l!`)&09lLb{5`d{`#3H+ErhkECzVFdFS)Pqv6Rl4oM8 zU{GxpFIW!Wr(vb408)4JID5B$zZ_?idW&ni0d7e(S3r=OQO)HA4c5m#&F2VN;(Z!J zxm``N2=e6t)yh))HLTyM0DhOEa*@(QBuRTjh4Dy=%q#~qtcEIph9hLeB-)s(>=E2Q zSj6vWO6MWX#=F7Hy;b zwaqqkKx2^oDR&N^+T^5S2Q_p7i8RVZLlRc1Z)7g{MjcS}TX{gyiA4&It8NU~%^t)} z_#g>y0uH574WFCrMt3a|*Giro1S*6*2d8|_M7RplXr4`ngj=z;%Han!tU4^&L5=VS z3_(Di0zIgaE#}e|!I5;35f*Sd!6bZSvmj~cW{(n6kAoVQUBM6WgbLw_r&Nd$nhliDR)mZ)xX;|;50N!b*a?x&}G^j%w zH_B7~hcq64pRpe@d9}&`hV`R{RhKpLqek5a2po>7i4JRADSlH+fuCc(;|vf+{Sl_4 z{j5>HsS2Pe@ia>viMbShQsv^wzcbn+8ZZ5oHGV|nB6;HHh{kodsSy78A>Uv5a0Xv) zk)VHQ>IE>sQ4Q;IQjTg|^an<9RO8xPsgrt&A)n&a^4Ba<@A-o#XMkfG)&!{&Lh_;- zftrltm`2S;DukOvYkf?kZX*@MO?PmvIHvKNMk)z6J;MHbOyjCXDj7FTQ2Y$XG#;5C zBJhR)PwtW4cg$KI7dPd!#xN%H>0SUstXwMegF6vC1G%%(xE$#A*+looCs_5S9I z9HqkEfbDgLY%ovic#wJL$1h(eaq-UQgLxrI_?$JhS^q5O9w&8tuu1q%&dh%ihbRGy zKtiGlAyK?r%LA{!Xxx1-_4-Yj)-M{Rz~iFnKc!`FV+rsU2MAIUD11tz_9ZF_H~xVy zWxlAAM5sX{5BSU9Jb-**{XvGNbVwJ){*NppL}T5wah$ z1bBq3cuE~PvhM^WHe%U30d?eXEd#KwB89-WvW_COQ?i=@)RR&kQKw~&KCLE8X)}P2 zSVt)q!73tXPvujK^4vJuIl(K>l{Usa6tnFd37ccmkVsR9%S81N&LUGjrxL6pDHE{n zVx(tNOXMJRUsdXgpEqtjD(*FA`9HbStiC`Vw8HaJqr7d>~ zPPzMivM1{bjHUmDFvi=RdHt?4jvHI<<4$*1g^}-;7?bW2_n^E0)fE`e5FryHMM4kdDZdBG0fMC>Kw^lQiU4(_l|+DN#W`Is zz`B{aAaD=!)eES5JrnH(+}xClyL`vycDEO>fiC$1;v|e|=7}GnfJN3vw74-~Q?W_v z1sqkqxJ&p^ccMldov@$(A}*}3fV=gN+K!~)M?D!-OJOO9F2yc6$&Jrg{l;F#Oje_S z)gVq`(V$U+r{0MA(dgPZ;QAyZPk@0_JUu zcgQzb7}vied(T`Lr^k= z-ckX))kEpXmu=C_*V89JPhW`uB0`UZ0UUCVxH|G(TO4u8`_AxYs83`h%mt39jj{yF z1%}c>BPf9vb4zOSHG%&B>1`FL)lI3^=%&WG{GQ|7=`IyOgMf(ol*7@dYMjeUlon}y zs1gk$-zJTBQU|e*>Pf{(n2LfSfOW4YVG&EbmjUxkGH6sR6P`iCMCJSB0eAnNMb85s{F@5k zZ^e8z#UlRf+bWE=i9aUzQ(`JXys6;9wkjEIi9ag%Bl7qt@qpmX+Nu=8ZzlMIk0eC> zQGZkgq6&{Rt8O%`D)M+#q1m%F>1vJ&M?-k_Z?#B>G-Hts>2Gh>j*%jdd9=6NR;INr zwkr`W^|6_ka1T9EA)gl#0zyr^hxPO^gcGpTaCR^P`G9qc3g8ywuR9;OOkO~xn{GN~ z1g@sJgy3|_2>hWrTS{{Z(A{Dcgo-g##4E+{i0G!Pipp?CKsuO3phioUWF+wSkEwFZ zr-fxQwyN!Htzz+zY>|CsK!p%!$)T|2RxVU_>r)&jg?Vj21%;W0mSeco?Wo7fao$)F zN)w^PfS1y>*Rl(Z#M$GV#+li z9xY91**eNI%_!{-1L%*zyzxC4bjE~9;FOYrd}qGHZ&(0CDc%B6J)LvFbP)&`fsn*E zUNZ&(-^rKWR=~a+5&Pk)vvtVM)-2E{px%4titQ*MO&;eqK-f~FA?Grf9b);` zS!J@mGgU8sk_DaI}BQC zJmj?(+}Df8cfD+LXfhtS&;&ydM@BG8N{`p8h5OnMW6YchBmXeenGDR|Ub1odjHUBdc%{JVVM!z>Q5jN)yIyk@Vu{(&8rpFOH7I-sUZ@q%Wp<@?}{| z8zq~%J5LB^HwvFOkVW;+y<%1_B7 zQu(!~0al_nZzHjh&s)r)(J&Q*Eedf1Pok7>8t_jVx>;&EaJ3j2O_#LHYc-c$Cuwms zx$e!lv}V9lDiUbMt}zp^o>2ijQ{-^Em|xS0?t27V|>C6TWqGfas0r*TCz&Cb&_Cdt!>G~2-}z`Bvi%mNbIuno)tYPMnI zZQhmw&jzjysUSjP5n~Zg45@&@Qw6^wq(TO#rvNjqS!xbY^G{4;4p8S$Y)f;2-^=D> zKF=L2;)z%A1xVs)f?sj13gBAeymAj*dz%X2HsZYE4czv76~OO_Hxv1YDv+Kz54fZ; zmjI1_FyrGVfF+Lc^2K4gLBsfv#(%sED(sNKYg-;a+2HjA|Ay~kBnh~XU<>5qW0!U= zLi@qZ7q>v40Iz(=b3&e!emGJYKO;Q$#Yi<#c^nC1eR$3s1egQ1hfjcY`Wvm1D(6Gu zic3D1xoa)d5d>+$nD66-8lnCAYADUbe6sfx2QXxd>?Z06Xv^lu;fCumdgv-W@2pS%fmuqhe6M z2uOX`3udH0hqw41EdvwLJ5(5Vj5a<(J_qjjqY9wK2Rd@JEk2+xt)p#m4C%7$`yBX( zm}Zhr$JCz#gY04QX3OWmRPL^W*ksg7KdW@(<1pRs%`ecKcTssQ0{GNs1T-1@9C-Ny z*3h|A&Q#r`nCF)4rh0QZ*jq6bdcP~5%@ITomq0Ax7^OflI~KZz*uETx(ehjO2PQfO+B?vzZ8)`8ht=Q0nPS47c6Mvc@w@ z#jA*F74PSnfK_lyLms7d0k3=jRvQ&Sn%?&DahLE?v%C^EBl+Vz2YM<;nmI2GX8zakrovM=@ zq*st%4p_SsOGc) zkVoVHutk2MT3sQPV!&#y0%+c)n#x6&YLRNpSTWH2buM>a@5Z}6-R%7iU!cN%=VMo; zV7wT~bR?%8#yW+L&L*w>3O zh>zX1K4GktxN_Q=xOh7S`0MLj!@SGlEn*az%M)U;v}_H*BEau~+P zlC?C+8k>ORENn4nufMJ%xh7{x=w>gl=~oU5>;tyY8KD4-QCL#wB#BZOrnvpQEG9{$ zFTPGK@#`OPHTjX$R)JTxkOU;xgezdUgFbfsV(_YtDP!<;E={DqlF`lXQjMrY-R?_n z_X?ashg+XwV3K`+zE_x0>F&j-oO=oRB?Xg3P)GV0+9*9s4(`tQ-K&WG!7kN!&VR-r z-}^rDb5j1u-=&(Iah$*83c&iE(H^T%RN;3|R^wJAsv^%s6`o9v$CBTP$KLrMF4zZM zR6MVX>QfHyqgLxUzQtsJm(2FC!f1KeMDi8Q#8ZVy%}+VnN}zrtw!%htOP#L*8r`Y_ zxRpmouUTp}VDVjP1C67J=}bkQ-%}O&G2dAz&xKMnPv$E^x3ZJ2mVISV0+*-_ob)%? zLmfNvD26&8%L-yOP@*=o2W%Ej07IR8M}@K7$#-q;16BiL^$$9>b^Ag8tj$)dS=5i8 zbqADT9WbKwmdpqg#4gW#hCQ(hGe6@*jGF0mcg&tq@;92x!XyC`-}LgFW%rX2Xf-h0 z9xX0pRs;PA8p#};tEqbkMuA*Cma2td6cWk*i9G*bk;WRp`jZOaPrZ3`(Ob=yDP#@s z4|xWqw=~$^o*rrqaC;k-gf=9np*KCCCs`!lb~}N!fF+y8S5z)uF^{#Z1+Ms$3gJ($ zurt3x&7ei%Z?E8BwGOCrDd&du;PX2HT=U;t)2|2a{%k) zfx$e*4q&JJOX;HejXlgJ{(H1KeGiWIt5>AtGvXA+7F@6bH^;s!fr9NM@%7ATv zbu}s5fU6%T@D*S+bzhA7|4cp0b{>SdFGlg_DA4FS=fx=4Bff@r(e-QK*2fujDdii; zv*!5iMA-`wy;lWr?-ME)Pn6Q0=qT;t8{n=d_@%!Etc5}%G*y-M6&4}^fa33l<9yi@Y5`U3sYedt+T=l>s{et6?nNhS!?|CX3{Hf0Q%YUEK7QeO=tT zR#l6dAx`vIyMUg&&la)>_Ms|2WU1Z2O?RpQ?i}rx-0lX(;s6!#2aw^@k%D$2vj7Vq zE1Ct^!(+fb!lZle-N1TxyYa8Q-Q8<|y>5nRJ$AE77D+oQ5BB531ObWqwCZYmYO$_% zzU|}i9E|#rZ}0IX5D`Oi5go)U1}0Q7Hp2<>xC)zb06sb&2uJ;r>jWZVgD#==usi`v z?Ex;RM_?cDXok%h`~Xn$7szqT z0!?0oG!!*%zy9`gzE9`pPVK2uL+Y9*2PU zH!BsyX2sVj0v0J<)n>8(F|;(H?Y8%F(Y4o3=T}Te22WoyWE+J+=qiiCu1>bYuYU;G zOYs)iYY(FBg%L7TiH>-YP0C))4%$pG=6P;C8(MwmE!(w~4=xBb7HSxnS z;Af!LHLR>7K%y)iXlI;esbev9(lNk)8ztg__va~oxl+<`WBr1=yvs&2#9Fax>IuO5 zjSAp5IWl0J0REWFLYy>bba>=n9KlZlH{Q>&_5Od!(&i-4;2ti1?)jI^k@zHVXA?G) zCaL^Q{TDyPiz*4n}r%CJy+toM9YwJ7I5#N+yMokh|V-xNOUJH=Nh1Jo(tz4oy}w^uz) zK{=50RO_po(KEo==@gLT8y^dk!&t%+Ap@zfh|2(a3K*rv%Spy~HCz5?E92Va6tJC} zVVYqA9eA1DfbVg=;YE=qv7UFP`s*dKeL01AaIgQMUxjecKQ}>zFgIarH7cYrw%VL( z?DnUCgOmv1pg%jo%S8W#q6B`wQ$S~~q?3^E6q>v9r-1JE`s(a=r-0q=Nik?X4cz)9 z1Gjg?01bC76ICG5+f*30EifK>d)5LUr{v8szRbdfb&N?IIx~& z?m9ZMp|?~g$6GJB0Xso?NhFnvU0LqeI zVeb;c_uDLT*PZw#GAJ{Pr;Bhj7&#Ng>h4n)Fjbl6-IKAPi%n< z9x`|hi+I|HJf{0_4b@+3)GkFO33ltfu}1B*1r@=d2z=+Bay2zHr`)cx7(`cJk*I1i9dvX0$r>foK@nDq57nHH3eNAc`w}Z zfUp66M;Wq80WlaNMQq~;2&aaJ)U>F82GJJss4!gaNWSX4VKqmAPA%9QEU_=GEg+iz2PO>x-V{ zM7D!~Sq)}8Rq$r>O}W;V>g9NLqRrVKqYkW#%B5tf-j1B-;>IFBMS44!qrRXq-4|*g z_W>B_AM0mSy&arXIn=J@*aQ94{z>4SdcRfy?AN4a8`{qpM)k`u=YY=`-1K(P*%>M8 z%-#-ubo#j}fPOA_6?yHD;mhMYPkFwb(w=%dc;@BU_U7do%Ht3K1w-?6AKdn;v$$C2&<@?4*rQ_Lhd&Xis^9~x zG@anoEG0#yZgU*m(o_Y>5;bLxgRa~c1}%d5JcOf(>mkvk98yO(^5cjaPkr2Yd!EcC z^XxV9zs5d9@-F;HB`ki#1T)3tILOlZa6t6@!0HzbhuVfME&##Pc!WIggocXUXYEjuW5a*)n=I zUJv>kX)Q@rtlC0+Bga*J9MpV=`-^unSfLgPt^TY6_%rc8S*ovt#Ag{vUk6z#Dog18 zW}L&_gXq;{5K{?Qq$b|4Lb!hrCqY9F33)XSHbPjfy36vVzk|-Yuh??*cd(l;x;-ay zo3LBH*KRSpOS9Afvu?t(6UANo00)oK0b{F)VuLUIr&}@ittQg!RtPK9cVZ4Tz`+4^ zh%36ERY%!}4RFvykK?>EPIq9N75Q;`sdTmh4tDW9h$Nw2eLH*I?TogW5PttO3sY4N zmN`2eR?t8PS3F9gT*ot$c36UZhk(R%P!E#}Te%KydzjhG zbJ` z2P5nSwi_}7-2!`&?WeAXm;SKGj-V8iU{yr=Yl8n8*}?V*`TT=fQ=O#M4{`9Dn|P&w zjmIL|q$#g*Hhr4EPq$)4awLmkw(i!Pjon5rA< zU<#XC$Rc=O^Vl5IJXl&g2o8y_sw!eQ&tT^%wvUboTT6cKx{u#r3goHOl>VO zWSueYf0ip%h2luqQP?K;w8l7?NHAHbGYFcDUss_Z+wEUu3p~a-kJu{)PN%N4wWY>7 zo@v-TJ}91xWoj=~vwP`7JRs~L7!MW1c&s*K&ACHd{ufRHV;wZ=B3t0G4sM(*bLUtG zoiRk_jZ)AgkW?;#quA_l?jGkL@hR0BPw~oBDwg648D_^h$WtR^$uQ2rQz7PboP!tN zqN?&O%BEN(^rhniT7WyHeRZ6Je0#oh-}yEr(?oK#O$A8+ON15>+Ih*1cVOMl^v64> ze~${`o|m|8cu9P=j(6~YD38dj&u&^unc$#KD}I0p4qCm!=ZV*|Ia-3R7nQ?A2bP$K zc9R*C=q)OYTe?9u$`c)2AuWP94aFTSuvbWHo#@~P`-B~v1y0y2b*U?l|A4pFTTxBq zY_n3X9!zp@<;^O9o4YjP7TO}=0kM*q%!LysyEC{U+TnKLIl8d_HHrOul3J>CB)u(` zsuJS6)hVUIIHeYHfxXb4?CQv>wwUf))tNQ}n zIYj+9Sp8V_1THq@)f617o>`*?(MVxibIO@nV_S_2N-2@WZKHl{t5H&kR#KyH-3oG& zT4s&DHGE<%9rdGcjS)4fMd({vC>T*=T8)~5M<#mdO{>wjZmlv>WM*4#D<(OZR^zj> zh(4>asz$X4of4UdR@Eq}QB&|p-iIdR%uuZ|Ql#KRFQQ52R@vOTtLm~dt*YDk64^CP za_~jny>(;Du)TE;)vXpe&^GFiWPcd-<51nsm&D;xxZR5PWj&BzSHLVigp0}{da&`c4vt^m;|k`Y#})G% z#B$O9iZNHjDs#*g6R)Ti+0I;~GZz!DnBO1{mt1`H+m9|+0ep1%7ngHMzw)Y;SJ_bGWOItUB|1h({=JMq8rMK*f|gU3wf6nU8V^XU6%7(0urv* z#UEeH{9R0`>~=W#n`6Jx1djcNQdG?_H<$LmjJ4eVvV*^g)pF5gTP};`aLZ+1T~;lU zPJdnfSj%5scJMcGxTG}Uw{w2W31gCj2gGU2BnMmVEZI_$cJ`5NqC1&`ooT}O?&^J4 zdu^eptR)|FawwDI4smrPvn__W6Jzat(beBw?X{RiR~N^^#zk|MuxDZYq|;-atI|+i zbXk!&KV|h@vi}mVZ3}2RZlw^@>Tjv zZA{#ks9H=ow&EKtC;d|#uh=5HULO`Uwotptan%$D>Arj)ccB7i#)7eaSoc#L z{I(&d%_$BZ`j;p7_Z<0bQyl!A#uyU$X}gax0`;Sh9-xi6hj2Pmd!8a-r8=E~xqRJu zpL>K>=v8N>6K2TsFH;;WclXJRD&Tr?)jq}XLQ4X1vT@)cWIK*=V4CgpcH;7O1gBzg zpJKyEvD8!tdwzn5c5)96reldz-vOQ7&w&_q^!-oGvchraE{fUD3tM zH0s&nZ0Blc#AP}|b&tz5MeD?6x=#1_Op{wrwLm?3w`|Z|l9}e9!3|7#nuA-CSx3_x zq`mJ^tnOvmp61|&dp!Cd)8YW6N!yw3piL%=pDA}`Q!$XIH39snj*05%n3^D(p$Ya( zo3%pu?%X?e7x@$;A4W%;2Z|}kv?-s02|Qj2Ta;hI>%IYeDKVzu7q|9<)-Jt@wBcO5-cvc1Qthrt}%R#HxX`@41f*`u8 zagyzE{H8(7RD4{;qLe860{9k(saU~bu#>0Zl#?m#cb0>Nd|)PoJ^Fj;h_f6#7>I2e zo^9`4ugv2SVSCj%9__61edYj>TuJTefC}Q-GiFR=j_bLio0;X{dmN)>-7#=L>DNx! zXDn~?r`h}eqwJNalcGWWk0SZ^Yv+y!*)(Q3@l_C48|MT^(R*eW8QqKx$sWOfd&KA=dllWg}%yD2{#F`>dkCk2-m>cU_LmaB`=Q_CT4i&^5 zL#X<-h=;_=oj9*bJ9wx~tXs4h;>ghukAy{ZhP_2jKIb~vVh@s&@VO3V>BXf-w2O7I z_Vb9Ar|~G(hf#`23}=b_EUa02mQ19Qn7Ms3*TIk8smNRhJ(#i9lESaa&99MNgsq}4 zooB3h@L+))cN#QIR5Xe69Nh3A8{>loRN7f2BxNZ#$>@r*R1an9v`N&D9%_#+!}jRo zIwp5qXTuS9IugS*H*ioeX~ie~pU3=vM+^@pvGvb$@SvDS%yW=#_qEv~<~bN>?}>r5 z!{V1=SEyW@{|Wbi&XxsXHu&9B<*QYQuad|oj%UR`-+|Sh({y{4%d085GD};eC(4Ob zq2qa2`AT|mp@R&SU+RTBUwvwu8ER%bE@rBd=BcPf&N%{(Qd?y1ICm0xw4CPs`$~D6 zqrZ>?rZ4nYW|XNcvd-RSt1!0Nv`;Y^t18q=iUmBeG)pZo2aC9=KrXT_aPUkUcD6PJ zJcSVcoiD_OuNT^s9oV)huuBmUd-56fs0GgX%AaSn=P6dmXM0*pM!ry4(mFqN(D*Lb zyC!m1Csk@E{qHdvb6)t=!QVQ`=Uf<@Dn5&SEo1lanS;w3s~{TFQX$nMe&cj=gZFIGbaveEUsxjbK(OI#TFSoiyT;wFlz*wvC|TGii^M^2Q{8z zr7Ut_z0SkS0b3^l-*HF}hgN2zU*az%!D*OgMVN)%#C?-(~%%&MhZ@wG<> zBlY(>)=s|H1AOMJKup9WU`k6*@ZXN%Tq$(dBV|ro|*fn=>m2}5=TMiqRJ80EYR?R)tN&bt>v#nU=%N-2z z+@>veFoVm+=PXt1;I5~cpA`-+l}quo<7#FRPZUk=$_k8?j>lN-;Kn;t2zM|;g?KaJUn?=LiJ3XBb$FvUU=e5_&L-D7X!=5|;4f@crm%8D>ECBH^^%Bn z#B~lXZ9qlDItPiOE?(!LQ0&w%r3V1 zDi0kV1aQ<|!ey=qexbk6Du^%i5B&QFnBg7(nZAz_N-+uc#H;+UUpPn=!}Twmv!qrr z@4NjUC3v9=(Zf-uM7z=1@#?Np;j)~GFI|&*s_fS1lji{NmWa>f>Rjg_T%8`oI&$uAcq#W&MWIN@> zB=XUAq3w@S`NoS|g?5q6*!#&T9~C1-_6b{p5tARBu)FG7vg{OGe$Z9#*A?XU>*Kn7 zWXJW-C`Yl>R>!#COXKw=37#qv?B z({vwsdZo)zaHac&s{;7KJ>;qo4!OPPd^tW9LXNMPf5pBdJdnT<-&#LwYmb9| z&HzWXKpqW!TS$=e&TTiIP@6DE`L=8;LuqAVId^US;J_Nd!F+(qkOoG=5H5~~s0?Fb z`GbS@c3(an%TC}t`s=nz!Eovvo2M+n00BP zcx*V};HnUv70$X;M|!u#tV@?(%3uc^?DAY^9dNKJp;t9-JZaVj?uM?)thajP-TD5%in7`-$$a+dWZ* z(LHfiJ(`kWR=pkdc$T)KUWfX0=u zofIq}1!HWIr_{G&>)W^AGk5oS3HQBa$|o23sRudW;HceGmra;Gbx)av#7K!h=&5Iz zsfw8VV1}NnFOc0;8EvlafeJLqglQDt`=n8P@9XB*k%G49Ml-4)R{Iwx2);OBU4jZ? zRJBpnQ~-;sZ>p{W$hu(t1uBT?Y!*TEXMF`Rgx^1iL5a%}>CNtveV3>pw$7A~zv8GQR$R?k!HM}CimPp^9*0X7Ot;xnQ{`e$&Eqvy z0LN=)T%aSv+alwFRTroLI@DTQOC@1Tt&O!+61LUea-mAX*B6ed!`CWV4x2%T{j@9pSsY*i6OM73c0_c5dfA-h@msaey$7`Mz zw~YrJ%w`fPu{PS)w9ypF`$@7|##rni?3Th}lU4yNxp?Kp+#eoru>GPQ7jwuy;NZl? zBkM|gmyT=tj^NUBP3K`}_UhZT_dr>DXNL_)GJWb#7dI#e9BKAm0Mk!I;QZSA`ALmt zg@z?s0Zj^1x!`Io)Evx$k1JN*44Z{D;6hc7U9kqcz|+i-pdxL)e8rj{$77ll?83Kn z`emBwdhCK_CO?w&XYMjSeITEa~su6YhB>{k?mF zk7;>HpKwpOOnMdV`}l(sZnjU7CMG|Ubnk>Y2`Yd&35&UJ6H;k6uc~AJ+7A1_E#Hgd zooQtPnpQTB!=GtoXB~dd$_%A?u@%>POUytU=@`JUtcGr@xS4xsk^>OXd zwM(-zy7t1_W!YI+dt>eM%Fd$N8*7&(y|MPj+Dw`T)AECjwfEJQq)SPX^oR?`U09m* zxC<9uSeEpn3%6W&UP&*xaLa{dNpHDu%Y{suHq!EgEf@Z9p(I^OlBCZvkPf@3_#$uE z9CcBTi`DZIU?Ra61T0-%94njUm#bNqQYU%FW!Z|vRa{A|O5B#{HHlS;-;?rv;;uv$ z!Vifj`FAq0yWFBaV?0$Z&%A8);9`mMK-}UDaT}3f^$blvPWZF=@^`j$C#^JirqH_DuL7fMwiGGkCzEdm`EP2nZ zl;2hepB$vCzEX&v z9V9-lTI2aHyat9YW#rqR=T7nY(KL~<)DZ{PWh#KnTCuQ49i%On%pY|Sp;1wiMNnQ- z3kXd!u|Oa(GLWWp?gTvJK-Q@CR@WyVWgrD7%o-9W!TH8xEYNi9yFjxSZTug zlIC7ve5v;G>+Mw;T1V!$6IKTG2T1~+IqI=`wY<1+g7==j&{T$;;792Ln$?|jV7;#b zc>gQ;64e<)G-$vr{V()%QNs+BA-X~UZtOUN4f6VP&baabpFkI|zPGEQ0oUlECnQ8B$yIU;pexX=`ZE9j%15tlpdU39DYv20vBy6B{$a*z}C{(n-vXgtx& z-e_i~jxO3!;u%lk85}f2XLpf!#!{VJ-20dc;jwA9P4n0zGNQ>l>;+e zPp3Ug>@6}}v?^jpEK_7q9n{3Bb_8cy+hU7HQB*BA36+ykxm(^fFsWmWvx-=H@@k#b7lv=4EfDnyX@6 zEX&0Q^c`mr%2eIuR58m%0UxSM7U~XlG8XcrN*5;#+?%A^L#S$%eMy#!g|rMY(X67^ zhM*69^eJXa?U0lpk8)CsWsITLL4N&7n?cc@4NLnK#NnVT8cd?*%Jj0@Nb;a5d7d^%= z*VV;Ex3Kedb7674-&p+k8!U{(hANDPZ&HgmOpTVWVOaFj&E%7A2xtaigcwGLJzdX3 zZci5t9%MW{U1ZTBA%Ib8y0Rlln6Bo?>Q*?WIrntYU5%BAx2KB@Y6JW41~o|9Pfr)S zXpWt15iE`M!RNf_&jQ4SJ3E-|ieD`>9w}!ZMCpweQ`Jaw_Tf=N9;LPwqa=Hji-mHR zyik(u;+_Xo5}Hhvc9!iTbt=cUscN|_GM1~o@`O;? z+r>b8l+6WAdAX`%jhJtM8;WHqPxNMfBm&}SEaKv~cdH=oF6KyU5x-l`EFvyaj4yzQ ziC@8#mZ+p~b}6<=DzT5qk5jD$Yo z$FY|yEVJw9`SMD&Ue1?i@&uT7sj*&VB#0iMl#-DU;o3MXhth~7^hprSLx^gYUM?o6 zDV(}2!VA@UrMb>tFVC~&wnI9dek2(tuiJ+NoNLdQCe_Que*1`b_=F>NC+*|vikibt zx|dEMVvfCg>6K0yDv_K|b?mo0@kFwdUg^mGsh5jo9CP_Ht&7FZN=F5-*ISGCa!=X+I)$=L=;h*L-unq+hHsUR?Yx(Z8NM03T|L9MRBrY}U0CApjldK9z)=^~Yq6wJ z7xk`S>7y>1zMz8mM|&A9qAr5%rIAHlyzqC%TRBW`SB}ap0fLN|l=dP(YzoFdUvqM?LqSf=O zvtB5duBfC+ipnjYbk$o`i`0wyBMrDXmfXbSMfPM-0ej+;og$|k+lf|>$C*x9?3Se0 zTP3uJ`ddc*t)j8`Z;kpR_egq0c99duHu06QCBD+o65khmHXu8rnqpDk{_bBudB9CLu+G>=!nkr zrDRX8o{5k5A}LqT$R$gB2g|b1v0CqHzpk>*vxoIgm>4T&95^IlYQnGVs-GvUjYSmK z>Z@oJGkuH2Z)4R>CgLCDXUctCF}1W*Ul(*_CBS73I4<;c(cmr*D5W$KNZ%|h9^*viCQif z{rb7)T5C&0=y9|q@~~KLF!pn?0bN{Ad_UGYRBrckvDMk`r~tM*OGJm$&&769T3|ab zthSJ3UQF}CwN7J4skTPGaz7W{tL5>GIIr3!*|qj#e<}2PF=zR^`+ah)GU`Wn{{X*V zkd{$D2KYNCBm_#)&Iw%;YDhnCX8Jn1CJe7Y8J;jTKFHLB;|bI#$S{cG38y)&2L-d3 zk2BVk#n&dQsQIeN>2`*#T490jxKFjh@v_1lqr<3{nC&a}d3Cd(3|!~?K1PlEFoU@C zY9+agqZZmFc4cbC>{rCQxFcfUGVVK-lj`qcv$J1r>GpRq-PtS}$NnyI^eEme9;K&< zpZ_WPCo%Er&-Ke;Sugi@agq<&g^=#_iUm7PO0q@fc6`gJ@LQS;hJ><>lq3Nc+G}Ew z>@SONpp(a`Aggew1h$N(4joKPIf2e|032Ft2pfQv$2 zlWT#6s#vj|4s?<93bQlFg>}0M;P%zBRvqNxH>=I7rGs4Dd^RZ)(*VT>yK?4$ zOL~gCo+f+~+Ip5X5jfe`zyh}a)i zGnI>Gb0pS07nj|pLU>Bth|J+46LYwI;!EW&ZhMM6lG7~8z9KuIJQr;wr93x2ph(0; zWT~Mptfv^&P#2dat0W{FPgJk-lMHon!!1q=nO<+XjSq41F7n;UF(~;ZqX{JSr3`tg zGlk3Hp)Rhug%kTQ*E>o0fNBw9H1A3LK#YQixw!Tn9%&A9(dHe+7tLK*_m=@-OAUAN z+TZQS^Z0uNHg>@zRGpxC!T$Q0S&+w611Lzfhx zySD=F4Zw=_KD&FF8y-Q|8wC+$2$oW34ahH+hzf zuwuMtUo!3Pc1-EbJo}h(a?~$5H#gyEqAbDo+L_wKf=oR}vuar(b99k5&%R`eX|rZc zH;MWMm4Kaj5Eu|J^qdMJlM9%j;CYxOjdhG`z_3vF(uln!dN@m5aVIs##U^L4ECK`^ z=TdO23+pPzJ1(}=8Slc9ozw&uRxPq7y0B!PndBnjLKVP;7po91mJ{yDMvZ3?xcGSv z6jNMYKnS1_yCmH*xOgO0g^=2rqoPHAIee-M>j@RW6aV1wGu1_d>p5&sb$JyyWD$60 zm<%M-Tv*q}%_P@8pWyYss2|U_i9_0KjC(f9l7KgsZL)Aj` z@f&{bGG$zUW2-7fEJ`+dLxu1LYcvg=)m9nErn_kR1~WO`#b4jxhbskU7+tqT;4XQ> zB24}a7uTk!5K>Y(U8cUy>Ym{uoZ>M{fmdGlCO z^UlsyU8(hFK51EFq6$e=JvkW!P^czwu$^E}y`J8@gtb;}QaX~|7MsXy=`pj*n5vaw zwZa7Zn5`q7+Txgfk}J%Uc7Lr}p}$_IbtI!L*6AbQvT!DsZl@g83a6a>>vg2PiEMX` z^qT4g9ICsVCYQ@EnRO*CO_9;COG5z)t|_^Ob}BPnY_67FQ$3H&S~>LemQ!ox#o|Ei zME$v!s+L&XaQ$_}CI3t7Wz<(Kkx_qDeLCpFs`@ADb9Fn@#qvu|T%zfg@x&!3XhU(L z9%WWhCi6;u{CJsh4YoJ%!WA~&(pZJCrSa~@JpID%#zz`^6`6lQ(FJnoRdhj4E!EP? z+RnCEdGYp(z2G}*p5V#UiJHAG(2=~h=yk!+3slIPd|_B3CS&+9M6zHL7B0=D@MB$!pj zOcy789sH^lI`|LB8SG3KUHm;0R4WWiIFR6V)0|pEXn8y2VsV_3PtYC^-s4ZUK1(r{rzuUl3nIlA$z*qAe`aiM^-T+~VQ$x<@vN8+VaC5YE1 zTzW&<Ps+-oD&}0X#~J}fgvXeIq_Z2 z>Hmo5MX>j$$$?!dk`G6@ut!lN1orNA?V!1JAX;<@?m%+uf;&?k*l1nuvgPtNOL2 zySq8t56koG!~PpVR%*}EYmYWhDa>;*NY9{>eTEc-Za7?UnNvk|^~PjzYe0!#pWQ7~ z-UOwh-u+7aYky*FB`g7QXnd5Tezw`ZezqrxjUOd=NbE6c<7fLLHj|HZSIuo>SIw8W zYfB6-=TPfyVrXV!Xeo>tYCFH~cJ-ZYM*_&vLp1+~NLZ8lTwW#&qeMiSNT>xQg@j}- zCVk@K2;b=m3A?L3Q4TRbanY4;zb6T`pFKpZ4w!E-LnT{zjf+J~5wTL!gs(0{RW5m?H;(B9X@$Fg?u^)q{9ay}Lxfb(6W!AZdaHI?q^rn+6kBk6n>qv`Q0 z2{UO<5yS%3MO^#McQKwiABI@K`Z576GD_3!?=EurrRKX>~1F7#H=p5y}LW}Hf zYL#YJUEso^^EpePkHz9-fs0GqivnSRi^KwXtYCqQ%X`X+->0P^2$>L{mWKGWG{mQ+ zAr`u@2C_j6w&{+nrDxz=oXO1MlHu^uEU#PNV&z{>}YEUeH@q&v?by)`=7=;D89QO z*<#uzgWZ*}qhKL_W%`lx4;q(rxm1=?3q~d2crgk$Xc&#go3~sH9x`}si+J;wY3%

gHFgJSL`!MTFjJ1XOw<8J&Ea903+q09 zJpvD~ZVV8z2n2&FfS_?kw#>!Nx3WJicVXScAjPpJOyE^TGfne8hrvU5m3VE7_%*L; zY9e0UEq4Nh)REPgB;dmoY$o7o`*To*BZwvbQ^+*2e5{rm1IJ<)9qman9T&TZ>Jd`5 zD$*USKc}NNiS3jgE6zk$@I*lcaOZp(sSFw>Dn~j74;j3+<>AQ&uNT8hgRd-8_I0hM za?!O~3D1NV)%c|bE12wT#fl{q6-^|e9Ho+xqdK^Bkhkk;b$9vrKPBN<0_n#R zx>nM)o~wX#Fk%-H#wY$`ejSGko zZw&$Z)>tIhlvld=D4`o)CH}JdPu1;6GZEpxNQ5MKW{qAoJa9<$nbqycqnKHJq5Lnb z{<)YHt#px-Fo5x#MIxrvJVU(~V4`dp;;Nfx>-MQ<(4RRn|H zS80M>zV>1Zv(iNoIRTGj>h?3=MxPhy8NbYwYRhAvVtKU{0qyh=9m^#nhG42N1ZXOts-Zi6#Y9(fh!b}|Dn zOgC!B^FCY4(}A%`uJAACXu@x)syXn1KteBuceA~7VG^;VT3t0J$B zjq5*1W(*oeqaT>8<>4WN*S6F;*LxT=TSg+Hx2Z60%Qhp?dKcC|RRDeLK`hK5dp!Tf z)4(8L33r=}ER@?OBg=Xhjkd|&WW9^~w#k9(dKc}s$)K^poMc;SV{GK!=;9(#2yJ$e z$V2-E$>zce*t5xDpnu|50JMWZJe*;ZE!2rL2*1UbiSbsI*FVMbLrjPDiS8Y&V(FOuv$y>Y4EXuTcL51*==z}sPhJcW} zt7!}|P0?y16<^UUN&v?sU@9{0zMN+J+DtN40$Ac<>?^l|sPJAbAN_V7(WwCLX{~b6 zxjKzeUmh0$AF@%XXNZZG%j$Vj(o`67(k*hj0|ki^tzFfSPl z7DkFtwyVK%f$M7*-R%g?4Gd_LJ>} ztoXG&D9W{jy@)&JMQSoT7ba5^5*EHp;|zbZ3gKq5Yh$v#Se6UlxVU*SRe*~nT&fo! zRbre=Tbd*k3o8X{R?X+k=4JTVT9!BZ+mS1!evBr{n)FXx}&w=S&5 z*^dZ3s=|1*6RQB7be85P);-L!jO=UqEeSMd9UCAC&0F!tS}XHxyCJ5aIb*rj#F7FN z%e9urZXv)84|&lok6oTU%Hab??NidszID-NmvqT;P%pJu#we50uS@K=Z-e zlh8EsEWes*)+D0!Atsx%O~rxx?+5 z@;}p_FPZ<&#W1#q0E*QXj%L{64SwIb=wbI@FX_QM1R;s|7kQOkz%vI+9n6H!l42~D z5*Jo8ep3RY*v?0(c^nxqkCt~~i;N&|;$Xar<$H;=aE6Elz41|wrtuWR+F^{8aQ_)|XbJT(6~<$0Bqbq-h5YRMTp+y9%YTR{vQvZ}e4pCP_lL4nLxpaldG=-IeTR$t zA5#GnUz!A{h#SH0%?(4m-jO}MqxZTjsZXjfp6ni|MR$i<-&0LAgu2H$ThSg+|cHhHx_{5!dYHed^alAh zqfI*}FBa=A7girue;+l9l{d=%l*8mAT})+Zv0m@0T&#D$6vLKXE)oaIQec;hk!-s` zWax2P1u;$!<3atNda;44x6wnc|wKK9?2IE*BrOZbKqC*`6)R`duz2+Ve!0yvsdn)Mrb!Glqdn zv0W|(IR&geeg(M?Q#HxdspP~|sHJwhuu@|tXsLfT7G+qYOJbH+o80ZLF~Snzt6ov9 z@ybfEmR+fLYt!02oVWk2*c$v6K29Z1PHT8M8gaL z0cBDH$RHpx$UOZ%-?h)Vxe0@`ectEy{_*|+S<_y7IQ#Bl?X}l7(pg42!ee<7WBiyT z(xwE}U!!!0;e5l$rE{ED$t&c%%GoBC|6LCMwL`-7t^;kR#Dns?9A4-5#@XnNvjZCf zcC1eu-Vo?6y>XXw(V1ii#+kj+xByCk&|AA4-V8+<+}#<0?#3gWW%4NFE_}%KSUhdD zj$7y~eB3Iv0Z4NVvB%1}%7qJmfqK36SBi?JV%jV})?E&tppi1T@50oxUZ&KFRP{%U zxVs$QVI9ZJWQv52zsuo!U!w>b8y`Ww;D7c_KDW2Xtou_fF)1(`JrrNY!U}7bb1u?3 z8h^LLN*)9R@Crrwl^nB#0satvSO7ZtFY9n8nquLU8jgiL#mZqPF0g{!%~NEJy4&H~ zr-{BDO|j#(b`j}M4m6m=b7XNz*a zH5O|M9&4d!Erc}?o@Pz>D=IU=&C4hz=Xc!4nqmNy4Lx4OFQBQ(i(bB_8TR<|V>b-( z-K-+;`Y%C=amK3cA)RGHtfU;kW)4FsJr^8%#RZFb)rA9!zs72qY$# z1?N&Xs~lBG_C6Gc1#C}%n+YthWTy)_#2PQ%a*xAP#T!+qlQ0J%G^N8cKy4({5)|7| zr`bh}_2(Xki|t|Xc8eN$4AD2to+jeo`x|WoL{$ZVtD(Tjtn1`5>0aYOuLNj= zRC^t+(FQ+ouzZS1o=mCz2oxq$Oq(QAn!gK~9~@S4WX21zD2%w~tafQm1qC_pnlW4=)7>XE;q4tH3^o#{opxGKW_| zd4$hUXUmE;D0u=)yFe??O?Nc99?byuL=OewjTx>7<9nPjwpnr-E47+>@C6git04z3;WQr^t?5uyF#k@b%-amma>N0)A!hE4|fM?<Y2QXbkK6khI)LOTAw2jnR)}RL*-cj{*Rf_V7D>`0@uFM^;ghupfVIF|L zZ1$D8SK6_{)|@NMLetu;y6ycxU2T?;ttTCqo#Ry(^D{6JfVO1boltT{xfW2(G0(giDq^gG; zzF7>0haArH?yy%#Q=Zy`4m*6?otUTjPVbML(5^Pq`fA!J>-@tGH+_R5{01J3sIP#x zYE2Pt{Q(YUKA=(9ZH$uVB*Mb&2vSA`()Th7@fq4^;di>x`c^7(*x|S}0p_*|)*A5~ zT4QaL${cohAUF}9BbtAXH|Dw4omQ*`hu@%dQ>GRd<{fdkj*QA3#Ts+O;rfr_sG+0m zXOB4id~3Ai5r=C%if?tq;XKO2_?SoIqy>&TtmNf|W8Qr5UlGdZNU0nx9&>m)trXSA z96pKXztXvrwMv#vTdg_RPbfO>T?T#jc!2Wxc;F;fj3eE#F6HxBcafZ-LFOrZ^5YKI zXh7-Q;CMhhr;i7EI+V^mokgj@MOzLw;bHDX+p!PcZb5WWYaZlGc5DEXMR<`B9!&kw z$o;L=mW)2Dt+l{UgxaSF-aZAI_Zi{c);4kVJMQqNCwZtz41vk`~m5tG4=Y+=E{Dh9V7{HG^+#@h8K%gVqPK>Im^WMg#P;r@Y@ za)Uoc^kF0 z5Ogd}u(np7r6o<=Hf(=HdBX)m^YLCN-}2PuOelrUl$l*up{X7C`aAu_ob zS1&S+*e@xQe|bM;@`Kyt`sYapNwfIDNzxTgVhON|yxC8#dTB;Ry`3L%eP{&NE*bmg!3QE8;7a@hZStBhl4K~smFU;o+I^LQu zsCfaF=UaP|WcOMJtrYCn;%;mv%5l&dZC4q>-{NJL&L9tQIpBopM;!Lk|G(OUHa^{$<^Od_Kc} z!13zvK)ry}P0?wGRT#+tJnAQVw4t92)2zQhCXL78pe@4F zWZ9p_#k7Ph>=vL9@5{FAjJc+>m{D8sIGO;|NVO1^_sM>xt!7mR1p#nBMfv_lD9B%0 z;r~`eg#3SsWvpF%e?1ru(Ch0xqwz2cz-Joy#J{xkp_Z)@>{hLOVyhxFWfUJ)@^j^4 zBz|)D*9*m6D8oOl_e_eXThM13B{TohG8t>xs)A^%R>{m(MYt0am0T3EtoIC>;X}>p zw?6Qg-vJ(bPIANe#Lu;IkaOJSR`bXMl}U$-0P@S{-#&()rWwv2s{rGIfX_$|p(<(e zTjBKQl334GKw5%hf{=5|Rwmd1?w>Y8Av#k;Dns9 z18wNnvf-2EwS4k~l|U54Zo7>#__i=*aQHRMsjp2V%HS=u1sl38Sf6BZCkqGQVV-C$ zz|_6KIw8heWO5rmxr{WoHE{E#Fmaa~gyqVjT&3XfYe~p!g;Xw9NYj$AX*5lKNumu1 z1kL>m{2HLd8;6RiB#Bu_5QaVU{pEP#=E^>q9e1qr2euG?SK*xwT(E?(#A^?L8M+ zAHTgE&0VNR`2^O3@=2~`n;9&hrg`nuP`)8gqf)Q``O!B@>GMjI&*`++a-NJ7?>En4 z0?ET_^3=i{4+Ck{|JFqZB(8qHq z@--KUw}hvJPnPH83*fNnUsB#ddk?@(h7EJFHB&Y^9W?)JgDHCl%~PoaKgkjabJ->wp&;O+oivSy(N1)O-M)JuEZ>@;F31 zj&PZ6;!k(fJdtM0j;y2Rwb-9z@LKBtt}h+%ZO@`8TO2q#YIzRG(^+6mwb1uEYR>w* zm*p-xEbD`gns>n#6qVdpL36s%jPR3MoahyG()@5k>|PqSq;ziC(_B*b*j)EvE7n2; zT0kId1X@V48o!_j|FR+WH4R(h!W7bG2`ihrN)ht3cbI=X&5o^83WPh4r@_A?Pjew+ z7H07m@Vv<4ZB&qA%Z1WB&1>~u#BJNFK|9)75|;2bhKB}&R%mG31Kpj}D8@t1igTkl zad)SWb46?jE@kGoj&rOp{_E2^PTa>?tIy3@t9R%sMvKVDiFfEjI#u-glta28B_-~9 zD&r(&IwFNBGld!CjCAD3%{yQ=(xMv+jTO`F-UK>pKHj9y7)_r!}6AA7tQ}{Q#G~-onFn`@QkJjl_(P^&#owwXD_s?NU97!*+Tm;SI$g| zc^e)vT-jPtSIyVmL1Dh56AokrzxQ5>@VzflgkS1rhvZPB zo8}t0i1kiC4DtO4mia6N@+18S^L=-J$N_LS(stK;)7=#2yX(mTcT9V3f)@!~dmTo> znC99Mig2VceoDY6$=t66w<)`0hedUk;-&;TU;AVTD7t2KUz5DFFDM{+~rYuQ3^0XwiG}V+qNx}BR zptzqFTG&J_wB)724o-msw7}V$g1>uHHj8gHDpCu}6964CTXeLLum&%*egvAWr)hY7 zP18tNgZHK^sDh^Gq4~)y%H*{)(vm0$Bdvu7kc62$B``Z6jM;&`DFR5+Oey1hL`@9y zZX2xZHbOf}*)WD+v~)S!%Cmx4_e#tc&a--2A^9O1yr(tNs)9@KVl_ut7|H(HSV8iR7c?m!SUe#O*Fe;Kmc)c9!_Rze7w~4oS56wgP z2@WP^fnY@ppG{p9yrUxinB9w+#TMe3#;Nr9}6=H47(5J#=|V+R{jINbaHe zQ~sVk_V?UJ-ka^Axlf><4$o$(!4aw)5*{k+LnEWtz zJyg$-e7>2tYS-~+tvbIlBt<>3QS;S4@{}nr|KSx6`0Kj{FoF`Av8U!cp2A?*Q}ZL@ zOW9b)*It^{%f656+V(eneH7Q0<<&8oUz#OinXRRj4K zs1bm>(0_VszDqn}KoM4-3Q2GElY*S!--@K5+=`K~kLFv&j}a7+>03d^HNFmz#fu)m zFQEf~Q2J?BHDJr|_VYDvbj4nS%K17cZ{`l6cPg+%H2g$|^} zqJkxEKg~(XlgbpcmWV%3Kh0fHh%Am-ABnF|Kh3f7@(i$sSs1taX@21kTADxZ@*n7Kyj!YQ#_wWn?feza)lA)4!FpvXfsXZ+CvZmpjLaDBP^J5;l3 zOkr-kMr>a|@1Q8(fsd<$Hvxuege8dZUk1x@(_ku*N#y)wywZSG z_HfPWP73p#yQB~XjRKYH4F*qUkF_Srwts|XCCAlWq`^jL{@v@SekFQ==4w9&y+HG2 zKS!S!saeToV1y4>K>PcSIScW97fK}XH-uALEbb$9IZ!ESCG=C6pdym=5T4)-R|b>i zM`>1P(0k8NM;MDbTFaznqcs0QKHwZ!8%&=d`M*Q6gen&aJ9n0VYarZMz(4;TpJcQy z2hQ7QS*9Yln2H!pyR1W&2OhGH``~$6c!9H3e9KL%W*BufjJgadO+|@wex-AM(x0yV zxzim-dqyPda|_H1EDunGmj@0bvbzXYCXLZtO*X6bvE{BW7u&{YzN{`qxNd!{c!dX2*TT8>y9#%jLlO^WcFIdI5Vz@L7W()q0g!aZ;zG+9Ve_EnHkCe~^=PKA% z-XXk+TAcj(kDV|lcCxx)WmSM>Zax=V1u}LRnJB-q3SV#)brNT*PF6Qq_=>DzL5r=O z7({p{BA-Wq#$s!=%-NAfJr0^1%%Ul#%i;Soxon3BN)gW!6Bnj+!cYKm=I%G z*qIb+?u+2uFYs6PA=|?7S)t~&fgJ%{YS~JLd`4TL2L>-kPFzOCV^7} zvm~%_p-zC4H9yjTqTIj>S2dNyb}(7Sc{p*3=4!XeuE*uux?7%4t%x;~=)F@ltCvt_05?&T-)oD@ z;0I{11-G!NnydZVcdg=IzXYSYv9i3>JeVQo2bdz7zmbr6qdg~t6wj_!yfepZtZZDV0`&`fy$6cA1JqMI85MGrWV?Gy1$#6F8iwtMKeqe0#s{&2Y`EEbP;?Go+e1=PiZ$(p>Fo0JEho5v~=Hu3HJ6qxt%qD4lQWgh5gPul5&g z;5vD3WWGRs1Q6n$v|Rjims{Uq`L!3Tu&|`6+Y`TI!_PAOs4zyujW5i_^sVtH{uWP{ znKV;ri3|fDY5rLql=UOcm(`&RuJcDJ>qnYzs)N`wf0PSVbIl%60jMDx*}0mdJz(DN zVXZ;=d5yhaHt};cPop)qEiUYHH7~LD%lJH3m#6&0s~CinDMsnXnyXz;8GJpiJY^~1 zwV%ShZQv~g|J75J&Vn}-{3fw0f*)2iPqTV}!u)_);Lg*0^Sc<7-W@{tGlZtfFfmVa z?R$+`lka^W+b0QhH&63i>SKumNgu1&05ZKqM0E)*CNI@u%D0l!ePtn>9$$lSzfyDtdHzOx?;_@%iMl8@QLY!T&*d7ee+>5rZ8XqM-RKY7W$?6QuB2M z^iyB96=Xlvd{-tu`KP{AEBU;Y(9blh+dXTi66^+w@C|c}n;f{6aS1bCnNgxy-JDPZ z?B^8WpXV4gKZP&QtRC`G^Fv1n-fm$`IAGvSk6*$wBTWfjmom97@ahJ?5PxBXVgZw4 zwU)(3C3KNyRnIR(ocelx7fKlSQH1ZyLv1*Z21-|g`~#H94}e_VkTXU4_4e`uJHNoW z)Ge-1RA5O(t%NSotX9Byv4V17amaD<#Nq&YSBwZhjn1oPsb;ku_1I3IGUfB9cu6U&guWZ~*iC0JneZ8FC}U(pf-j`?mufByOqZ3z zQq6y9M{w3%s`=L4M2$EHE5k;-+CuWj`HVG^G0854nRm5JqmARPuw`X~&caE zIA!)o4tOseE!DirULzZs3#FG*%aD;N;A(4^41P=Xg*2Zp(`A~~;}qt{3(+oxJPpTN z^Ld->fR<_goq2t|5C`%+BrraJX?c8L8~!Q?9H#-8D<)ctWzW4#^ZgR1VYxq?FV}qE z0~F!ky@;eQ&NCD1a?Q8OrI;0(6{5)8QV)Yksb=-x_%ZolH9bFkZ;!~3xf zi)2$wN`$Hl_>ov`}R0Q~S}zK(ioe=D3>SSd%igmUC+`YKpYN)X~#C=t%F zN^tc0HsU3s`cY5yqoNw)$|}uMd9j>JuM&R}lj_%xU`Sl0`R+$N${*gq>SvYamhXG4 zH{SOs|56rG<#U#F2X^vJcn6HQO?W?}4H`-vR`S3EgCh`i39!Ro-l0D8pdn$@rU z>GIcm#b+4qx(b|UpF^;-$ubRouKBmkFnF)ltQvYL6tLIcH3!uEZXP8ba?PV{PPe)D~EPK}PGaafFj$A~qHyExPpZGUa+FVWf(^ks?5hbNd7cVqRjqFCb}^%Tg- z#Tw1m$uL(yvf5pnv>f8wf3)Rr8mX0GQ3O<3K8Pq~8oavj522f&C;n(#=+8!^LXv%S z%sa%F_w5qZ&aseLi@3~1qHH~$T}T)3;uBRa!53Og5K4gB_zIx>63bHncTlFHFEy*F z_&rXgxv+f9wYo7zV$gfRsME`uE3@!itE){>?rO(mHU+;QhLL^*ej3lUx`-7Cj9z#) zs+Tnvu_sLyy)4QA#lk{jt`%eaCcf0%KCm}{B}zgn6H+GKI)5uVQmm@$G(RY_;z;Z} z6!2P)qf+ZM-}*QzwNCS$kE2rSH2?B(5jKpdsNW#2!2<4~_NYO7Yl|3Ww^+w4=wGi{orc=e)csOSRvsZL1Tpl0A_3|E z43Y74z2+Y9H;8yrEfh$zK*|)79ozJt(1zPzCgzgw?eU4ZWPG3~5Q-grFYdZWVe2(_3-%Ounf01?^Q=H> zleqhQoSVkEah!Nope%4ntPJ_Bd@s&%c&L^IwmTss1zhy)cCtOUQK{bT7{yVeaR?m0$ED5nORyyspQM8+>3WnSlk-Jgb}O$O*{%3g z)wXHq-0L-WtU9);_t^x@k~)qiM5I4wKgvVjdO@Um!^05QxobZ&)KU%@ve-yX;isVS-r`Q{hIsQN)E2fU%AsrQ6#WWEYN@mvsJMo@k(Mk&Cs2!bU(M(ZinCz$of*P4}_r~`PJ zqWtnMlIaHct4TYbS6{EN(c#zsyCVMIyQl&|i3U;qjb`<5s&ple#5prg{BSr0)*>^GtPkgpVzZ_exdTH zyT5$wPQ9hrc(t=Pt@p|6X`>Hrq_0H+UZh{sHlMtWcKF~9+Le&lMf-j7{$y~h?~2J| zt?^%Wq(_<|m()J+I3d89q>!xEx%Da$!sC@*d=B z!2LAcGK&|ZQJu3X#wM;iowv3AhnwXhax53wqFD{JD9i(`fWd$JJ8n_q=M!yfPNdVSBDZeS_iqh|cokJAi&Y_|d90+hx$}EYxzD4sr5(4Dxmbhl1 zcwBGM{0q6xajpjZiK=wAzOZogy4ANLjUmeCG4!?AmJBt@uZ_V-$zy1n+}z%(`PZ*e z2FT)NEc6To`s1%r1azDs2st9;+kZ`w^QO71KGs=VHD7zXCw?w1-)dIRQJ9~bB&TQJ zYOZ+;GW}L_wdauTTg|_E&ZAV4ya2jQv-+DqZv3qzd0G}0f|!<=Y1!bJkg~9W-KM#& zL@+Ip`A>mx&EF^k0%p$Nu35>mDTihA475I8TRCht&)dy857&PSCdIe1Wjfrh`4{ym zokb{1(GD&5SNX;xq66s76y=*?(RYPiNQM4zS4hheB{BoQ9NsDVW z#>%WQ8?biIn-z*p|_h?r4n#mFgU+PoLvRX= z-HjZC|7srG0^8^u6XgAEb1C z@L?PxBWD)t;dMo~A*T2M)64`rv%4P!2=)Y2Itiw9y9pG%v7< zY_!Zi&4;Zm(ro)Q=h=9!PLvhe!^9x6PxE3L#Hj8*%|-S|_L6;Ve-+BwPk^FM_t+$hI9lV`G zDd|`}db@`l+L(MPVWV}*GHXqbf6D606%usi;cRXt6(Ww>%r4@FMqOL_b8Br#+k(!7Z#F+IGqpc+-Pu%5= z_9OyYMby;$QHaY*xC+#G9Kv1ML=n=<)?q~sHNql;nTkmmXNL)TMKrpHSl zy+hh-MlN=XUBaIeL9bEYdYhuW(M59J=oSS%EyLWczLsLQUC=AW=)eiT>577o<)Yw1 zKS|qQanQ@SZ*a9FIjmV-fgk)~na0D4j%fZ_T}tP=e-+#K5zUv?qzKpitHgmgs#%SJ z;d2ZPgV}f(LdJ!aPmc;6j_<>8#V5)o)|Y~QX{}+IW<3QFPcV&#;Vp-VuOX?UB8ODG z#Ez3Y%yXhMNub19!xaQX$?wPDEEtKg9vOxJosC3Pri7!Kr{E5<$#A$m)=nyYmY3`n z$qD|RQtDeoFRGp43DhtG8J^x634u&cpt=#r^aQFaI;L6O<1f+fS!@Ml4B^GrAP0^Q zvcZJR9PA6`SpG|(LnSaA7@x@j*fGsDeua7BnC2mf1)J`vMm3IUzOIHxnNN!e-fG7* zkLAg726P+_ab6LWU=N@jK)x@jS?{|a!;Lvdx&PPxIHu@?X7w{KIsdE{N}UyVxmLb- zZiuTOL~23jN!W=H^z2E>=O;1X7ttqJlz&1dxDEtvrzqe4Bs$BJ&r+286OLnCE}#?W zGD>9brU>8tBvxck7U0yuFw=y2_mgs*_zBjbqF6fYNzE@0guh+^at!k)l!sG^JnJ(F zg!mZ(?;zBf=4LNbI=}o5rE@##i208@in12`2~L^Q%QJcTWt=U(+zTDQmlQ8cn16nk zvdY8G=Hcw!X?1wu&QIV;j;{(@oVw@!V zmJeKh=^vD#D97crS5T!Km+Q1Z${d#iPh$(1%zFAYP};k!Qv4rI3eIGr*ahUete)}6 z3RvA|Al<=D9w^qyk4r`eFm9m;-?EOxz}nGe^_xWcjxN`{2_xQ3Sa`KiAY4}yomk{h z#7-`&T8RX}s-vYlS0LxP<*s3T`@-_eI_*^?vOJ+wS3)sn=3Xwp-4^3f zTRLLdu}N(d^-k(g{LJif&Ap|=r}MqD%@En!eIKv=kFp}N&AB#pTCQ#LO++)gMP&yED%9yA24KahvRUX61)y&avk8+&&K;#Xu;{8 zUA7^9NW!8BKQP_o3H(0Fo9gmSTV$h8XK&!a%eIsjLh0|ZKap|rQV$ckr>%k2@o zC0(e!tW_4_&a2A<5D~PAP;q!4m0ZN>f3TbE?FmeL75^@S(U7F>!L@EPR&y*5ZX4`5 zcE|!@h|9PAn!;>e>%q;{u=0tDhPte7^ecK}BEA5~GA9hH(CemKW?10q)@EswW^tD{ zTZcTdg1A{L4Rd)0VhB91XgK;Ksyf2uYSK|luzXO!>&W$Acz@UDk+`-M7IKSh{LHcm zjD|w_YmOL{3f#n-+b6KLIYC3DZ9(r#6y?5jGH7Ay0mWOsfRd&_d8hzZh5|YvvFT5c z+;)#yrE>UI;PRNjd_?Bm75KoRbpF7Zfj{3l-51x{dME0+6EzD9PLtil(%;@XR z1LU5V9^>n4%Q-ANPn^Vc=boG>Ur!#upq7`fkM09~lG^B-&uf^%ybhnsP^R*9qYvw; z5?;<)41;l(m-8A1Rbm0i7xr0F)pgD~hcb++3`HYdR@Xo$fSZ%7jW^$cb%lInk-FoL zkQ(K(s!3t4St2VKptn$zrQ5p-_-k)gFp&xE?#FZ@Ou{IaA9@)%kH(}7odAYYYQiBD z0egqjNV-g1nP5r5j3#}EN79&c(#O#FbJE9CPUu{EazdR#6>?Nkj7idc8^!T4coG#+ zDt3ynh{k>uce#jiLKP{{gC1{^h>{|_&=nRiZspltRUdlV1Qtq@g@*I1PO-*=?ozEV#ll_AY)4*t#hv3m9+-!FF1O5P}mk)RXdnxl7NjM)A zqjrluTI_}*K2B_mqg_6v4{2)5hjf1l5kA`G3Gg6o!oA%7u9xy_FmdM{;{C;tG1}#E zfk^>7*1Zi+3M@0gvcPc1%l>m->v*ZV1co{od`G*yDsW0{kfU9m=1g2Si<0h*qMUK)ud^LSbRbx1ki>-ve)H;NL`}W+# z)4mfmIwWG{oRzS^DhO02N@)vVoep!MjpCNJ7TSMa=drGA>$v41GBFm%x_oT}H{f8A zi@O|Y6~e6VVXelKMB(BFr&l1R3v&iGlQeLK?#&-KIQ5j4WMegItTlNF6~ zSvA1NHRB*R_){?71Y?f7{HI(>V&zg#871POh$Pd8aJl=03ETDpD5Hnu-)9>7Jnsex@t@ZVeuVO$OUa7;l1pigyzT&U zbBx*(T~?m+4mu{Budkh8rHIioB5Mp@WGzR8J)f^6&0skZL+W7`GMwmg47Qc9u$#Yu z>P>Q4HLO^Nf8tucDYV(&?r!`iUWU`BK+`nmhBYq z+MX{A*RJhgCW^aU`w0yQ>#ZlYvkMr*po07>1+pob>cW7QDWu9ObFEy9GB_8PlrltO z6-}4VG!>3Gvn*6%s>`L=gk*84HCv7^r@FjLlJG8Xc{J7K$yQrA9To92Vq}?$0#XKw zCT9gjuEfvhI$4y@SH-UiO zNm0J@q?Xp24mbM#7yzb8I_c! z)-c-xD`&KucH;)jZtnzmy33ORW=Xo002>QfYMu5~tg+W%7+qr*$!cr5%Y$$^G(+Ty z>|8l%n~ss~?6MUx5^)jtlx5O%mrvVU7myZXIV{AVj*y!LFI^E?GfTnfI z0ODe{|IM;wQ#;dTbt^t9fa@VU)8$)hgEGso_*T57tOTtCfmts9ra@|Y(kLR#t8YZ6 zvt3qE3Ul-jo=7{SXNY?esNo6=e-1alwBkks#*pTR^f{=|QX#Q|!f0~}BY{+7w#(gU zkNkFKyWISBVFd$O{?+Kk`JCbNteESnDLa#R!+;~+7e_c$jU^hQ46w3AimY?oJo z)kvha&~WjxnCV6!+J;ged(s`S`K)U5@my2)=+eFH?#O@=W2(w-8!Yjn* zz+@dYS+_7*M@6_7A7*s>*)EUcV}82sf$jln%-sVEWV!=0Fb=(H93B)(mz4YY(}33+ z-2>fafAH@$`W%;44GMFOx8zuFj?1-bc^<~K$}cEAWk?GAYBf;$k6gxU|6v8_jlW@% z{mA7BG(|@8x&9QrUnYpTE??T1(z)?|5+|LxF4y`UWpEF?%pB&=X(u6^-A;r)&QM@~ z0MGicfbaYRz{jo^4DDmr3x+n&Wt9lTn|ixnLXfYf2tWP=W$_bDF~ES-M=p-cbNO~e z=2w8Kb|XsXZZuemJkRA@#!2s;=W^i6)$9UmaXGTs zT4Om#7f1Yx?d6Q^*6wm-x3xPVwc9#X&NyX_@Vvuir#-@+X=`XhJ~QpP<;YxnyY1zp zP;{@NGK0^wQ0enma}pj8Nas`10AWeK&pKs^DcwoJcPE17bk2?+vJ^8+*yM|3U{-{iTh?Fn7E5wzV!|~1k87Az!AX)8fP8|9*3*G z5h>|Sci@-xFP7>jwSGz42>b0~mk&u(jBevK#ppJsDNODi?LN{fpSY}UK+gw|gZ+FC zZ8M9UPh7qMrl`NQ#*NI@bBsU#CoT`C8K~3@0;z=pDIcV$M|xaH_aIc%Jrbtx6PKI4 z=4CR&S|VR{iB%xIw!oe&y>>o~$&dlilA_$QAYj4dHQ(hMe?ei!tJ)~YLON_pGT-HU zpQ8vrC;pOnExjS*K@ik%zRUSEo;-af5c+c-V<(+N@lT4L77DUISZ!^1kG8eTX<+@VTmMFug zE*Bt`QC7Du0>eq+KE)A}XLyE!7NWM$`czu%Q)`H{*bsE+u%gdgRyTXVYuPfUeCBdC z9#hKTjyRyr5TPU9OOKzq$SZ^Ec9xOoGnem`tg}$2&s=^qf_12<=p^(+?4L}MqY`_i)a(UOp$5q0-NY4VM%Qa;zy|+9F7E0kRA&~nF&Qg z8*VRYG&V$G9vgz5?xx6v@itv(ZrPTy4 ztv2;40HQn3o*?Uz1uh=|n8_2kuV-F^?x*~Np{Jhp-wH$CJ}f$v1cy0q`I_~Sj=I3* zDLjL{h29Ka%(B$O(;d8+S8+&YHiNI?zJVlMa@oim{lpu25BufX!#}b=n@fQy%;zu5 zPZaeh*fG69d!{QMarvIh{VS8OAMUw)Nwp+giaZPQjm*A%vdHg)y-^;IHS!5uzG&^Qw6~k)3>H>6N%9)i~~YvSpCXZjFg+fy+HF|KxHz zR@|CDxqQdv6yY70pD_4|%ZFZpp<;o{Yp&dXr92h8|H{tQD9oL!jjAU2sA}USIMYuz z=?%cv4=NQz_%o zdTk=n1z44ecg0%2*Hz+FLX!n6Y5(xb$ya(ksWPiF?u#yQ*}Q1G%mR!tiD0m8Y6%*<8n6ZZ<+p&W1jMj>5rM z5GC4vMVZ{Pt?VwK{8yN&OI=n2Wtst09UrmO`PQ%}dh@N6!M9>& z=Wg`1>;g+&-UQb<1ZWw9J5OV*ad=96oV7x}yU$POGRlLEB+ri7)QDsDfB>eLQkQSN zm7;uWp$yceu5qr5aG7|CDNuS_V`LXy>he-PBB2LLU0%bd{2WRHX95^jN?raYkSFnr zS9tO0MXjB0>KtCdG<0+bG*|DB&cp{b?O?ZX%fh~APyQ=^qTxR!W!jaw> zISgFo@@)P@z|YNLj1r(`)u?on%s6MnIV^h|gXA^`jnT z3Vnp_r%}*Q(Q0#6ZGb1xK&xG@`ITI=R~B=q3&}Qd=t!!Qm9QwetNQx)VK}5q)jfvubZ!^VZ~nN8sgcqm8{sy3anp0LlJ%k zcniTZ#g}oD%Xf=#dcDbxBNAY&!fY1k|JA>i_mpy@k?RLw7 zo9m&4zjwVy3JTYNgk(E&3oIaK8|yK1zpWYVbrgjbtk|0 z0HpYxeF^}fRM0?5LMLA*9<^3_xCje5X}R83IL(x2U%SO zJqCy>8Yr2DeITl6kgpklXddj#7$B->h%W;`WQO{h4G>i{%$ETmGQ)ie0HKWVDFB30 z5cFPWH$YU;$RNh;sG?E6FaQxA?Na~sX@M1C`Cc<+3uns-_eZHx!K#8 zGh22rb7oPH>->%~x!K!DJ}oGBnfcXHIj5c$4w4xsUK z=Qs_r%dtWBa1TQ;?BVukFRB`_(e{KSY=T|N;_CyRLKav50u{J$UPuF5xi~-n9~13o z_mflIX+hpiZDlPsEy(S0W$gtiDlUE}HI~SS&&8=Ecww}kJ=%86Zto`>>tB)WhSvaI zP&7U0y>vcJ))>=+T+^(hrdjftrw2Lm-|&Qp#$EpJmgehVkI-_Ol|V$zb#lezY<(A* z{36BH;(*qadmloazMyD^{3vja=MM-U1^G%@9+@{$p2zZPZjjY=c;jg@VUaX9$aU_g z2)Cmy==|J;dduJ5h;tNC;Ab_a2*2`{6>G+Cy^H_fZ3E7{puByg1b7rb*ksC;4bfre z1wEiR$m%f)b9d^4y-FV%iV1HP{5JFX2m41k3V_gmQIus_4oA|XI4t?ZIxeRG$E_a_ zmcU3yl}KaJKF(Suw)mh~3u{7JAJxco{q_WYm(U*uY~DW7Zq3SHEYqFk#sl-B+gKB%Gnq}ZoHFCy># zl+XA72HHTXNl~tOKeXL1?lhpuTK|4rmAqf>NPSkJAP*p^Ateg(018rawwNKECHBC> z(6OLGiJtUHNhNv=YK>TglS{NP$V#3Ro`#>rG}-+tp*~4besUU?r92JSHlsqm<6#Q( z!yva1yghZp52+i0^s=HwGGm7oE%t#WLGKlV?+`)xJKiTD6F?Pv&v%R_`;HHZtq5ef zE4Ce>QFuF?sUr&HW`ChDccCH3Z3to0m&KE4CeT$h7DrHH<PUAw@qawUQ*lEHpAX&hVr-^8g67h%QWwZj=YCMt==E2qo%p^PlvE;(# zsiG!T)TD}j21)V|9>g$QFK$-@^;q9BxG-yzuh0NdL1M|ofWGo(PP>PtOMnZm5jufGc$GMK-> zI1E6dLwzW-@rTq?PK3V-@-0m$gPXjLdHD5rJ<%tcK;hSZi3|``^o>t3KvYp#(DS%` z5I;a**He_Qe^AaVH=9XO3D8^Y%^<}k>&-!KF-Xp$L3<3<+Z^PpZ^tiubC4f=)&ml( z=LQj_%gs@&t%uY1Vl&?yJU`>7lP>V?rECuJD%jW}inat`*#&& zwxUb=BhIaN`9lidwZrmZB|>r!bBAT&_q{d9IrJHR%Affz16zaK9G)DCz74W^1ley3 zdaj*+7qbCSY1+R_({2m$^>xq=V7E}TJ;+(g^7(mr_Ged+)mtbofWM(5?F#afjnKBB_$=qr^HLJ5 zO2FL6ldLoalGpugQvq`D^-C9C!8vFTnZEIwSpMPcQ*~A7mwm&j7AQ zKL8+ib-xett@ogd7$Bl(FNPEU$M)Foz3Kh;uOz1TSKjb{bo|D93Glrk781dWZHP78 z3Yv5H7KlY;ZE(s_$smskWed7D$V&<5Lx>!>H^?P;u|F&#CDwW|cKv{%51PfMzOMqd zzXEok0(P(h_9NDMo)*5Po~e|gL;f6+01gLPEtW+A8vY{l;dcTdn zwH87vDNKwYgKu;!$c1ohjL6|E@3w{pLgGv;ZWWT`EFJTyhb(%I1v&hpm-hvg91n8p zOY{Q2bcn@M@DPH4y`Vs!hk)i80+tfk@Pt1ep8yH!*Z&hxnN{@$1YEamJgdX4?>_-cDh@{WY1L+J^WVnc`lP?9N6XYXUv( zLo$vi$_4iBCf+|hhQDTZ&q!v4~BC6E@dFYQgX7A)@aV4lg4^b*eG-hpy8y#vz% zsd3{f6&nrbplN}xDp9@)oC;KFQbFicpvWm#QsnG$kVBR!+8*bKQ#FS0qp?NsBf`Z< zKH~J%XA%4AF*+&X7`;-vi7KtsYqb_E?(#l;Oa~hah6*0jCpFxaOib02y0e>zD%RN@ z;QCD{O}dSCT0VhyS~F~H#WE#U8_%%k+1`cALKJl-T40{N;B4XodoZ6RIha>+lD3sx z5HQ<0oSYN{rUerDqQM~fqRF?&DG}5wMu~F(&FNtWoFk6x1fiv`Uao`2?+fU1y;h%9 zjJ0~-*~ESNOmf0Ax~+?ISaFNwwr*$FzYQ;qbjsRf)APK^9?atDHJHm7hy9&Ge1|xq zb`HU|9#$R@Rg~vb3~)|L7hlEzQAJ&SiUFdEx`o8wm~SYN6;-zokM-XcUqe>xPrQbD zTKL=38i`AWBdrpkl5jLe{-~nvAu-t~iuvjd5cMe$MLm2O14IqwXJEyBmI0zl0Acm? zSq6wI0ff~nB%2de4)peOHvmp*gc4EIC*+xd`imX2e~7QDfu&82UD}F;6$r1jp$ND6 z7(r_V@5T!efnXs|4%o56Hat17O#(so4{;$_k)M(p!iC~p(?7(;fiJ|Rrhn){YWK)} zBF=G29M}aF4G76mwgDbSg+P%_%775xATL=D2yv!NZ}}lsO(@LcLW@Hb<)JAfQ;-7W zePXTw^a6?vK;AF`kQ>5{w$N80JTUTA=wOI46c{x=5pUA`5Wl)D^3U-CMR;fG&Q!|cov8&?ysuOz;+=*Hex68aEKftdpCx5^}D zL4L>s%?D{B%pr*C*I2-K;FRNKoCKBxP6j;L3pSak@Fcpp2qeJ0-1TVU_3k(L^Nsth zOHKG&_b9NV?g?r46BXM%7VH_6pIy&jKLeOAA=+2zTnYM+AF9;c!aaXa7#NZ$gkc_o zU@`d|v--)RVPJ@d(i9jVrjQqG=mMe$WC#^gWTot-;2+OY>C44nL-ey69P;j64VHmu zaENQ%OkuvS9{OB8&)rR^fjA~JzOSAWmm?#tR}MAD%qHGt&EIjc+Y$JkY+1bsjOcKF z!feVZXXH>$f&sUogr-h3*k>qH0#{0a1IPR7A$(o4L_sQG%_W$f&uspVaai#2ce1Gh z9|cQJj>1(CKmn5lP{;}bC}@&^SJ?m8h_HkEt^RK{V!h_L*7*($PwyaRlcFIqeD!+(ZE#7=YgqTr9yIOh-!97r>+y$O(y$xdbgiD60?`20GyiM<)lY;?|PoXMtk@O6OxDKHAV$2C@;~ zCtKuZ8d^3T#A)C``hxA)%GUe^?`1qWlrlX<@aZY>Q~~0t15;723smQP)jXE`C|Msd zLtt^-$Lixn(BeMU1bOuq5iurMU$D9LiXbIYnW>=@Av?CHHJ=C-r{LY;l)Wi}?@c)) zt|vo7Ti+HLLl56AGt!l*>a8| zdWKmga;tuLDCu$8dLv1OHVk(>k|rcV+~e}8Z&^W#2N22*!N$^fBo&DP1?2lFlkW$) zI*+71ggJ3|i0he`(GWsR(TEVM7M{7rU@uXGU&@tGh`AIKT_ZwVzXh5o8F&^lMng?` zPH04kAE=K>bVP{ntnZ1ROI<;TFa0_ABSU;;UF_LMg}nCy`pAkL=&y02+Q(Qp4IW{^ z)0Dv-Z}al&K9(y{4Qk*R%ZO%yY9R{ms1X0!I{}V?%t3y9B%*!CeA90-;zjcB(5; zfF6NjCkdCNdz}-GFMq<>rnPKp@iE4Rc$vG*Mc@RtZ4h64Y>2ait0au{*bwgz?Mt;| zJ56zNQj29Y9UJ1UX*<%;k;aC2%B4###U0hLAudVXnu;!bagAS+x;xeTau@Nb`r3o+ zi`TscANB>Q{6**uBd#O)(7bGsO!N0D$SFR3?4e=6uKhr)*pK|l1IhTPtF2w2$UfYWTDhL!Ou8q!6pRU`+~ntiq7z zlvo(ztF8$c8^|?xI%dpJG}-4*@ps!(L%3`cBp~}<{Uw%FEuS75Mx8T!4tZHK{ zm@XRf70n2-dLRLa79q(QnFm$(#3Vk=M}Eq=KJb|jl!RE_4qXC>t|h)*(*RNB0dPMM zR;EwM@BzHDEv!b0mWCv#pASS8Eeo-_2YCn}d3aEoqUBP6FyH<>B!Ec>z~@D5g+EXN zs6{x153!OHXaHHDtPF|w6W4zg3V{8FqWqgzMZu~Nt4s000EmC;=a~0E0q_VEtoB>l z08vG2q;#tC0uqfC1tEgP-Gh2dbuqfARDa?0Nen|M!!-3q*9wg-t#e|WanehDBm;+UMq^e3b7LV3IKU@ z{p%1biNy~E^ha_fGSP9fl zjNp4itOjGnKA1Mi$^ry=H+leVGHZ)$S(zVzX40>j#eKlB$yoQ zaUbhDPR6G@JDp^Fr}Mc^#y{5sQj>7WEM^zr@-cR`lleOzJj|T~I9&o6g$$Y%2Lj`C z4~$GkM+VwD-qyUWGYpnuIV0d<&UBwXCD3k+7iUBDrq-ELz+>b{6fJ+aYM;0+y%k5bSvt zt!Hpbuu>_e1P7#6%2p~h%jxP;26uHw2JP6<);uyeB}f^(CbT9+@HHs|QZe?nRlLrb zqG1PYt9Xts(*Zd|;W8a}^^0+FTIRUB(KU;Ee1MH^b}+%p4vq}MkO2m?d$1JZ{5|u3 zuSmSMhDlDT|wf z9OilOEXYzIe+e)m;EgwFnZM&M-*l%dAY#ki*&L@^8K$c=Z=Pfx;pV+6nooMs2&!nJ z89^Ua6#0neC0kf{9&Mo{{afe&VNWZ$NvTv*vjIbu@PSagdGx)vE#vR$fP{U-Z~6eO z_qNB9GTWLaw^2JNR=6QH(<+pZWx)SCDXQpy|2YL(F~Fd{fBt94N8>L4Gsj9sbF2wg z1?dUaoQi}wR!K!diB+hRR4C;CjWyP$EFNo@zuMQ#*kkquVGsK~E9^#bXPl>bM zv2o(D-q|eC%sMFkuQrs2TYJzrmBVY25U>!ieI>!`T?Un!mc`klERdhv=^plDfAH2LlqpK>5CV2bbp{xl$; z=OR;fQr^)f0P$h!tk{IvE0DYBK%b*1KUd($g0r*YE{MGp;TZ%H&TJKLrC~Tk+lru% zjreoiE6C!Lc2~w6%HE$Za5(k_Zv}BH{xssPJXfL(c2?XoFgHMrcy3^2z=}PtK&tVA zPLCV+gcsg{As>ijZ-!?aS)&vo*v#TCZlFlI`|48$KlK96+FodB#Tp9nkaYqBGj6H0 zw+n4^gIH0XV$~jtxb}1`h<*e@M;KQ-(p)hj&86)?Pgx(@)RaH8yV(@warXBPMY$VZ zzyTqk*Ug92;?E+Nf5k)vpRHX4-LR2m#jAq!oK_W(!!7-7zmgf?}NE(S)BIFmi z<o=<4tL_Nh+x|&?sC^ae!$d*X9bEqs%W|?2D4R+js>mQi$YoI9D*(Rkkdh1 zv8LQXchOkIC))7pkK0qVLxSXeW14wS=wGv7lj>e*Z}t>O|ADm=)bJV<7teQ>JJQ9 z$cyyd_fa}ORfM)GB0O~1jMpMcg;Dz0Q?MjHeZ)^&45&tN^S+KW}-z3{;S9v=~ibSjMN_&It%Wbf~vAt)FXYgz;7n;pK z1{0Xc{DGjcCSmw^;8Cp6#9N3T-9`QjXkJd$(X->o=^H!2nkO1PmeIJ29P`G2m+tPk zd6EEC^Epc;na7c2&#u8wVh!O{_pqeIc|Fol6VB$Pm^LJtOds79?}al!7N2%<;ggW7 zC%IPaX;JmSE^%P*u6Tk~h?r(^IB{{IRb;`D$Y4d*3M=?x9L`@&5pdi(lEnPPUTG&W zx7p)42_4T%xm;1NKv5uxSrph7C}+-bCh8>SME#8}XRdG$x(Q55e!$K~1Yyp`oR`51 z7?sN6N$x=jei~C=Eai>jZw&My|C>Mbw8rlr{}TjAgW{99c!3Enlj$HNYxYJOC|=^pa(fwaeqB#SuXH`y}jpYh!tzRj9#V z2a@*YLc!G&2o`34rwFI#rdhBU1AmG#`KjDAJGQR1NH$A~+SIIkfNT~QXG3r3jN85K za$aw{pY0EyJi{&#M?z1sgctE8*e;28u`xX@;-zQNmU4-%ELWnJ>ZI{{sa~PWGhLxq z=|rYS^zkItah>fZLQnN|2e?M@Q5-fQv>XpOCv9Xf6$OpPy<(0GmIN!OED0_;i?%5E zO=@MiZ&D{zsiud1j{DC$>rX4T44 zGppvNm47$sRo_{IY|7w4_6*yOm6)D}FJs3RwB`YDY0894Q>x(Kq?X8$Q%~i|dnRpplm#yNyZENZQYib!fx;tBkvZ z8c9Rg;G+R>oZ)4f(ll;-exHw{zibEwo65ulbVKlHFzB)4E*}l{4^NlxpX+gCsNUf?ev#NPP8Cl_Mw5O8(EtbOp zZayrD`O<1f(Q3=8VEpW7;y;`oclk`9t>X`l+}4@wfNI>P zCp(Ls6fx)`++*D3#m*1qY(>2ls|~V>?xR>eLScTSy_oHRHb`1GHfUJE*wrwSWXR&k zTglj4xpKmY88z;5F15GtBTd7KOc}lYI-r3!`D5<&Cx5_iPw`*(A%Swgog8v4UNHlnx!u)nGV|(hSSl#Vs zbN2!&KaUVj&}4&+@7)Wi(s@Kb#dk}9d_0NKLIHo}4HLnN-*`vEc?t%ycm8Qi(OCEV zbAjh{BCqfDuaNorq|Akroca37nfF(Gw?q+JZ#HWK&Z|o}7t}SNlCFI0E0RYqAz*Wv zuei?Z$((_TRZ|Lc)A3>y0@^I8FEx8970m#90Y-3ssYOM+#Z>R9+7@vmFqM`_mon|n zu)CuX&DQR7TAQ@dTT2_T(KD>J+=Mn!rxVU2r=6}z zW?Js5Cnlp4^%Cv>3YO^Q+OO(hCGk3x0CE@&N-b=`hbZsxR4&^9Yk>6|fSW!3RShVe z8@zAD-cmGFvHA_n1pq|S01?A#fZjC>eHbzT>SNhv0C;i9x-p_?c)9(kJ9ehs5$8N? z=mW|5L)`si+~t9^DQQc(iB6IJgZIYQDe7)}ql_f>k{Au1A!-v@vFf~uz9;03EIsp5 zcN=c)lBX%l8w2qY<3M4&s%V5?0|0gW!4GkH%*NM9)InuOD6TJ;a4#e}01jt(_7c@U zm%0MQ>JK?f#lJDL||^9LW;S8;);agKuJYHNnnhVtYVB)C7lwbZ774=>~!U~I#O|a`WmLl&el*%{2Yc_)5V9Gr|WqV z9eJeU3HAhk7M);kOw6Ji?cKKVl9pL?x7|5;7VXR<60_(C9+j9yM=4g%P?(=t9zs0@ z^#|W)mWPZ@Nmi-CqD)Z5njkoWuVb+%qBY_&h$yh0dB)7E{LG<*xA7s$_7)cWp}kye z2xv534qKnuKs6KV=J8+>`eCR;$eXW4b0N(jF9tl%pfU=iV`LPTI)Bk$ABX$+BGsxN z;VgQT;+}BBZd8d_&b~lS7hsi%eV@zlGEchbR%bQa#Wmw-#R~Td2HGXE`T|~`qWsqa z91|7TlR|dv+g1wnHbXG5W7{-@rV=`sIM4D_0AxU$znX!Cqe0MGI_@E5)Ws^7>te-V zrZsXgtEe0)vPzQVO030JNcNsabg{MBPR2LelR|zLQZVG{J%U-RH)zQb7gl+L{#tt} z1^-%i2qxnlf<-}S5@u0wLjn=CD59r!E^oyG*xUi$%AEt)!WgV`ARh2^$_?RopxDn7 z`2VD)35rz*ggWYAtqxH>uMTa-)wXsii{#URy(w{uu!+i&mTYA-y!=RjhX=n3`ai(0 zf@MMPFr{l~LdXMmhQ5c7R3z^5;m`>WRFXy9qD+ok!-H7U4G(UWQ?dz)`?&=!mUj~r z7vh24KZYZ?pH8uOTNW z-V)do@YJ@|dD;U{agI+NY>%`(>SSl8IPOhQ{INaX_Uba8~_VUHfcD+m1 zLGlCVT{_3b2%H|rv7Si(FEnXitFJ$1^|d}r?2$gRmZJYjgp2>3Z#&x^D3|%9;;Y;f zE(Wd%inqCkTv*2N5zDDb;QvA+jSe0RTCw_4v?;-jvd){JctP-sAV%5=Dw&!j@V`*B zqruf7F)vM2tlDC3ZA-bo!BhuAPVxpkhdNMIV>T9FKMWDvfx4Vc>_WM}sVu2PVGkU< z_n_S0$b^n8dJtuKlv_k*^yQ;3_vXgYmruFeo7#BF8 z`G{y(UuRPtJ9hMa-c;vX1AJR&b6tw?=DO`46h`|8`#y*T`9#GzLhH~*Qg*4iuBIK^ z_dc(yxwj^z^WK^(Zv!sOQ8!P*%}E#)Cf&U6W(-1r_uYK*=1>ebugukrlQ;LjB^mF3 z%iLQ$Sy9vBszF!bkP*A`L084D4#oQ7-ieIk^Y2-FPcpvvp1e9qxTOE?s_g1+;`(HE z^_=Pw<^ekJALmr>S-naaK^+pLf_vuQ6HJ#F4j2{Z-?RFjs$v?HmtbP@bj<2|y54&h zvFp8gb*dVJcS4&KqW8Tc?zLk(-{%qKz`A=W!t3rWxlb4+_bt88YvK=TudQvz%HHR- zwZE@TVg9~$!9Bo5)3)16Z?|LX-sjTW_uo#9c>nFY?*cB&9@K-pzR-g{PArr@rV>n= zGP+DuJTf>k=s5|F43-7`9#a3$EFjkllIB?rW0rn0EcN>phLr zuHSRLuW`@yC$INr`C@21dHu*5$@s_`ixR;P7u8tmy#*lc@ITb$O>Y^}n#=AjxsM|J z&3$=wa9dN+B*kjGRc=M(?IsqAcU-m;?+;>XmC%V0u8G~*BrHw)5^kAbuih7{TnT?6 z3OCReIbENmc%t=@c!f<;{CqcK9G#@N`TH>XPg4Ak4un}EnUvu5JbwoN9_v$Ut(2uu zvAV+lHdpvv;Gsv%hvY{d^FHAd&l*4>MU5I1;Tq}qK@}>Fyoi-EfH!=~OISwyd#V#! zU!o{?pziRv>P~aT-i16~q;&316QoTGm6U>!F?WV+gu7D-4wxm_WV)2rPd(ZA1@R+) zqI~|-3`7>4L0APUVb!51KmG!4RJzT`RyKZzjCtTwySANU_SIFlV)*d~TIf6GadjW(Oz-Vz4xas)W34sb^=pG0gK+HSjloVK0XiAuRo~Pd zc(Q6wYDpCe^O7q0mr#WBFIjYnoEI*-WN1~2aB0;YRVmDSs;D1 zDU~9;Cv|oe$>xiy=;@{wc5Gj3ZilxC(|HFCVZn!RPk0#jbnwXDzScb0oeICesqSf) zqI}xzoMOj@wBgPv15+rZeMHu@`junDawOxEVxl}EEHILMLv?n#J`mpM_y~)F>pQug| zK2d$~b%HOxZuxZ-;d$4WTn}7IFsJ%w)dS`f@U!Z9SG%%Q!yuV=_2TP-g30Mi$@L}I zm!pz&hw-Y%Ciz2aj%DlyJjdE(IXFv$ z!y5eg@`g?~dW9Wz!{;|pmZ6x!o?8nKz2VCnD9T^n(CtPHfknzwChA9~jZX{6zK&<4 ztxpR)k2z5|>(kEQmv=F}ZGBq1ODW3j$~)bE&{^_-w)i^PHxwye_p^0BGjkQM`&r(# z{@j*#ZT__(W46LEH0NLYX$Ab#Yquq2w_UsQS~CGEnug>;=rxIj;r@YXXGcgBsLD9^X{ zN)*zWiu(mN2B-;d44|G3Ma_QLroxHl653(@I6zVUSekH0e9kI+ly zng5xJ%j^P1E6q}@Y9{rzn)Bs6RMwO{pS~zR4_$BVviu`OCF#b=NC6FXP!Iz&5?<{E z_?A2AEBS@YQhcuoaWG49^aW4&AG5@yK1*>2D=zUzW+|RztrT!}<#H`8FP9STQdxUL zPI5OuBjMGaBMXk%itn96*c;7OocRW_ovpZ~vEfx>*6{KvG%+8+OjDMU?qiZJSna%##m>{;+^pJjgp>?6C7(UCt={LF5m z7o|{gREx6Ei>3_!da zKsq#1K0;aC08f&0HjRS^#5j2$oTpK7Lgr2MRtOgp`Uap532Q%cFy`)regiy$j|JI8 zsv1#rK#FHhYm@~Qa=B-o;*8fQonPyZr3Cl);xNrqJc>$iEXXCa zNB-`iuPv0f7#EV03X?LeyvHcR#rhXw)1(u4P@@EsQ>sxWS9_N-_}%_^=dQo>8sXP? zi_-b6a%#FzBQ3m~v#G!IqGH9}05(zdN#zmlmBiOD%vVqxNWFpv`9yJ*s+7)`OLU}9 z6kmQTrSq+?Ag50h*Z)0o`b2T~_fS4xv3d_90f07GoM$U9KBxikyrAN5co3$tPOTJ1w#h2j@(F5-a zJ4f*~61lmhptt}oVXqAkl^f5hD~7wSw6wZ~*dn<~C{gZ8Z5bzCZ5f;8m92RQmohfE z-1#ya_|&WBUM0ZXtB|&OLR-YsRzoP^rPYmNe6Hf=fQPgZ`ac09zILwSJX%^EOTAph zh4eAjYai1$DAqUB*}__(Gp=Q4@H7iK)tB@YC4^Msl*xI1uHqj8C5Wk6;ta&@yfqK3 zI;|=_?@9HPQ?*>hp9K~g-&h>CFAOY4DC99EvTAc6;z#8HIYiP{w%P(Jim2;9|8$kloztHNfV{wS}yUR;g9C261J!+ zaZbazNs7UzoevNyIV|_@`2*b(p^^=&r!JH8K7*C%xxqv)=i-!-lyYogm1R{DnB=jE zH?bLHc@wt__~xZ{ft~@6Jge%$svbBXZBm*!z=jEGQd;NBg2o~(ZZf%whv*`C-8)zD z=HT|A*}3ud;F+K+2N^iqI1_9e3JE5AKyDlQI3)>}QmqND4;rH$uMg&g%&{~MRdPZd zLLoU}iuG+1ce#Tk9*rvtg7>>}@|DT_$yZLTfKR=$U9}{>WVS73SBh8CT`3=?x)Pfk zCH*k9eQHRsSO;X*KDDGu5-y3?rF@m*mGrBWj;SWDHcHwtH7_+38-kJ{FgE8&;&S}s zYF|`K=6_LbT?KqywJ}#E@g=iO+!HHqd&!2F_e1 z-)?YET)45UB|wSU~!)mbBmNz&+FWF)@y9vAW`FMqv&g|v(Z8) zx5ZXT^^7d5@wFQG$MG=WzsgR3RZ7%wAWP6~w;7&uTZ*AzlX!834A2$7#Yzc-^f)vJ zX4Fp@B6{K}T{`{oPX-t)hnibY8Y)Yi%g_>8WrQz1BhZq+;KW>zeT)(YO`&Si5}KYk z^P!~a{8lJf*mPMUy^yHk%798FNRuNR5+L0z&*O-DUKSGU5esP?`)oiaKdHL^D3hO9 zlN@2((B%la>_N!QV}YyLH)f8YmJebZ=MWDQ?2nDEuVgDj1aFe5bWe4D*fkM*lrCMbki-U#Bf3FQcz?p@Nd7thI6=} zl;0o4-Yz3KGAytMc0(c1@_qR*ww}CVC;JRxfPz)Utd*HZRBw#Bi;01%+JW zu@j!`p5^8Xl3DI^3~+W;vXUKR=L!v`Ql&!l5gon2y^JMEoK48yn}l4&&X%RvHQw#l zYAC!F81J6rwzo5L+zX)1%eTe3f?jyREZHwCbSC>kxfEX!=KT=Qa42uHVMwl^qt+=) z2Dp+7-0!>5p=jK{rjLHKPeT86OMf)`YWF$r(~-hhaEuf*PL8uRE5^wK4$C+o4@+&L z15MMzvRFk!#j4EF?ANwy7^1iZ4{PO)<-L(s6hww zH$FST+^v-iP^&B{3n@!xR|&^$^9VQFF(M;u58`* zcUGO6BHv>H@_QW9lVe)7GMnmF9qd`!;R$U4LX~o@k$livc|>}!zs8RHh&(CzRw0bT z%t`ry<%BrTpHb?^X6 zUV(2vwxScAWh!-kMTNce$|An7A1!E++<*btAp5cNA13VB1044fxh#^4?AeaA_6*!0 zcS)m34Igm3WIq)R3fR@@eMW(xX1vdE02tEo`Ls}wxJw48!{f4$9-qf+3~=|xNJs9y zFKUi<-!r`JV4hPbC@sy*j?f=(cCvDSQ$X2wk+Kf1>nfI?Dico`*Th z`TuBbV9ytn0SZpU$1)MB;Q^tscGZIuW7Kvh%BhZsZ>pRDrptVJtf1f@WGW{O2F;fq z{1ZNZFy%kJYEYwOA<}S9jTLlX(CLYb*96vRY%vDl2D?f(+^joT{0RD<-=Zbs1>JLx zCZ>CSYtjogV#CYHk1fMn3(M3;%xYlT_H@h;KfO#vuhf>oc2H|Dp+zfH6(WOLi=|41 ztmqUd60ii&-dLWV?erJ?j7Iwp^m^~!N$RLm`0My}h9d617hwUH7xWVACz3J`t&)YS7{y*%R z!RD!p3{aQ3SOe!;@9-K3?6WrUv(GvDNA%p>sLK?ZYn9t7>r`$n!4eOazr-q!y7^%P zE78NP9s5v^u~FCZG*(SCA)IF>suJ_8Jwhc4C3TPRriA8V*I=^H**A@_%9A!7YAXZO z_Rq4A{`?oTd5WMLA9Ow&7%bH#sEwK`NHmuLYJR&cq}v}sHWxv`?&L``AZ#=7ByOT} zNZz&`TrbJhLNU>X>Y&3#xw&_VzP`d9Q1Rpa!<4 zbOT2x^zvKuaZzwQo9E6H#>jsQ;k=1p2boG8wvY;Y1&7%Oz!QAq`~=>$fM9o~pnIQS zR)v~9@q{k|7FPrb*%LuO3n6tVn4z71wl{{`8E@h!p29A<=*>a0X6zuDQwx(Lw@?il zu2Y3vqGT#9Q9BgGS3A^czPFw!XgDqt157kr4mbTp!{xh9kG?BMVDpK3e`4*nJg{xW zhIY60g=JQF1i!F`Q%rC;jUjt_kD&>0;L9u4OhLg6w7orgfHL0H5?JK^<{;_E%rq?@ zB=c*8^W{nvhxjx@uu`p2HJVCm)aSJ@pQ|rb0urG-_M}N)s{JYfo53h*zdBJHbwW+C zYEezG_FFZ}+i%UT+1WIk=2ER>b7>33)|>k}Q>}sK;2O0*g34pbn zAw4jg_iMm87S;E(iSo5Jv!nYN)`z}W(g%Jc1N58OdJ|P5=#|+LZ7dP=04wE|2Zg zbsF2&)9QP!&Rjv&@{9uoS&=H(GV*|-^#nmH~H>yt{^-D zr9X5E$=S|tp!x8S!@c; zQ$MEed_fl5*+XTJ=M}Wznj#8{XSc}!-L_s~2}Cf;ch*PUziEZFRx+JhtylcfEfmyh z98R0#Brx5XqEwdJ%`cUeP9vcLuLljAl@$^%=3wR`G)j$j8aY~x!5Fap%0i)Y(^J1x zE^{PR%j61d3-|!EP|ymwnm?OzLBIdK>HFXJcgpTBv!##kulOvREr+R?;4l?-N)M}u zDV>Uxenkp1V74l55KX}fT=RYN?Yq7CzKxDy%|C~#HL*goGge&5{j|0z5iFoPzxKMm7Z79AhIW}CD{9dx5 zoDTV5+psn9%S1EcUnUMr z!bb>RH!x{Jl23~^+ef@KA!(@-wKQpLvay30n_SElLPo{OQrKem`X&ubilG~rG&VUVxVv7RnJ^=MM!Xq;8S(GN+avI9{Cn{*y@N|M zdM|!#vJ=Rz7dH1OT(KGP@9~>L<$?~zpN@BF4fWIUMG0Ou$A^Y`QNq~d8c!-fn=qj` z!IWE^FfYL_cV5CugXY}-Ro??=_S0tPyYiepJ6FqZSuj-&Ww?uBm#Gbgr_lzrU+G;l zhGD-tqWrvv4zI)e#79(dgP1T^=Y9BE*UX_x9ambRACu*{I-{Z*{B(vtUpCC_ge#tM z@y{gvANukyxWkTbp|EFxCuY(u@OykjJ5I0Mm5m159Nw2K&>#$BMX6 zygMzzUp3fibX+wz)lr=Hyo5-iDP}`Lb|Tj5a&Zal&*Z#6gH3;0|4@Cj8+yIh$^cyp zxd&_aw#Ca4-NP2EWGxcZqX2t>0y!D`eVQy+@xBTgxtuPS4-^PqFH`CITz$#-uAnvn z8KA)L(7tyC1=6EHs(@Ckcp6SdPVoa3iv>Ns4aIDeUuzM<*Zc%Mm02sacJ~VF6uUj) zq)&g!>}Ro{PvN3FKvS({s4p$EPIEZJpO$_6Xjywr(n%pELYgK2I#RBvN|Tn z%A2|_9|(G(0>fCYPO<=qPO2GREeS&03wq(E7b+dOMWrlPK3))cV|-Tiu?MY>m2c^# z5(`JZHPMQpn`q7OMuV&gy2*8t9~VT0PrA;!%$RnHc$f=E%QN&`o#B0NuG-@ez5Y zpy0DQ2YU8JKHy`BU;OXrJoxX`u?PHLl0f{FYTXw^NB->WKfY9}H^sF2W4qOxbgMrW zl-|X(y35N>t6zR2+Uhqp#kTsFB)E91YgOyMbhP?sXJ2K$kk(Uq`QV^EeOphB6%$km zYTep2we{on^msf)Pat99gDfy^{qObx@81#62l^^OFO^7lmxvc<&=S7zH}@KxShSV_ z6p62>N>H~RP}!*xG(cv7Nx<)N7L>rcMgW^67q99n+XQb1Z%zVrO3vv^31MGFMW^532&HXZ+?uS2+434OOg-oL>5bnw0o9>q>I=(xHuecv)gN=g3 zy)r=eJ}(RD`Tsy(jIw9Iz0XH44xay=js0B@dtPi3BwmsMdT9?NvU}7QJTHK~%O<|7 zgC?d99n7TY@JGZ!AMlT_nb&pqD^{CI!y$i@pboFe6nbrs!i!6LQ~|#fq0vE&?oNBu zL4J#Ulc3k8@N)R$r3%E~b`LntCPCBWG-(*wG`Zf9POg_bF#eE4?2sq5?h*ngGp3GE(A*Tg6 zSQRTz&|G^L;~^LbdAWzrsB=z=bE=<(-sT?u7iKKv7PvXF7l1Y$HP@#ZYPRyg)fA+^ zv*8ud4$N1T${pbkf?o@?lUAuiXcO;oIZu;Qo9I^A&it=$m^hST=QX=VzBTgd*wL&U z9bd3Zd*LOMMXp>fkp)J3x%`G-!Q#L-@`w|0M25H=o(Ee5b$l744ZzN(j~o$AIzr|e zRY~NUE8mR?!6=sd0#WbDB~BSjV$0YnNVJmyYWD}M@(4X7Q|X~U@KJS}AgzM2idSs} zpOvZf>?$o%*sdRsqZY*+t%Ioua_Sw>GX{$Sz#IIX!n}qO<^%|~ld04$tP|`KB-X+6 z&pKJ@gSK6zZzGGj5OKQ<(iAzw&q^ggY?Iht?Gm(3ZqyQrjk40GkG8uop>r%0zDv+9 z8L?!LBGy^5!c%+GS?Y)Ld_UJXABV^J=CELGm!OC>66Uv4td02DXq{zk^V9ASgcua^ zjPtQDV;3yCLojY1M(YTw0qY2)0h;Ps?Lv69YlK&Y145H-fTi08LiuIAX^yK>djzO- zjqvg{_6TpD7m@(9hBom2WS5{FbOc2l;jBAR*j3;Hhb`bDI&s!J=s2=I&Lr(=kSp5- z`?hQ*Y0o4fPpL-+sMNE^gDU~r1FtT+V!E|VRYogWp?;U3ey##ne1P{olLeKNSSy2*E&8jLc_(^!tb!2nzYR zy`^QZ5(u@xX(8nH=?SAvFT(Ws=g=W zK06TrUu?`*g2e4IKy4m|+lYt%!biWa1l`!t>~MtK55|d3+%KpROnjf}4cgwtY+1iw z(49}29Tn4Fl%y{5fL&PzVykq}t}K8WmHirLcGQFcY%5se^Nk>p05kyGv#OAX?M^&m zcj6Jd6OYPNq&z!+7ZFH)Md`nCJ#P(Ot}T2?GTECB*z`05l7*lcUuVG@S%cS#p@I z$a;%)1}o$lD__4J zolgsS*%~Nli?zje9lXW5V41IpE?6P*v$>2uXoV=hMmV1qk)h=Z{12CahizGV9;R;% zF$uF-!#+qaydhKQjlr0)G+0i9WN@0qqvhT4mO1mxY(Xub#iWG&86T(?v6KYCTV*O6 zo267DWu;uCc*`(UFa~~OfYA??f+p3_WN@l0TgxD|t;C*RC+*4TzxLzZ&QL)EX6f}jvjcUJR` z55YDvmD)Ul?cF0!qM{=NJvo}cc|ha1rcnrXWsT4<05^hO13|j67z)NzEKAW@rE;|5 ztzksajfJ@JD3l=RN%J|Tr}*(0JQDLGS^iiw479k40Jw@82-1zyxr)=_RwBqoT{jk? zYDE$eJ!zM$)I!T#@gp(1Y@|qz&FW%kSRe6jzMCwhZu~SNP*KIgw&qO#hw)M$^Vuj# zKX)@y#GGGjd9;40i^b`AJcN0IQhsetIlumsBVYZ~t9+P&{E%MFi{379`uo_uCoG+K zW@szOQL)AS#y&3nrU&Q2+_c9lQTUbrHWX~GBW}W!$QP6+%UK!#u~fONMx*%P$(BBb zrdnR$>6I_2_3Idid_nD>!>55~t$N4+^%%f+o(Mi4T~+D%9yPq1P>+h5?oOyeRjLFW zJT+Tu3jYmiZ!NDud#wSUnnY~XGfB>~`7h0rA)H8=6&DB!sgNyD3#t9ixpluf2r53e z76_V1i*Y(wOnWp3-b05F-su|43tEAou{6<0^JpS1BYky;MQa(YAfLYCgVxmw8sLcr zxpuX><&X@)EnP_UwQvHN>?(2Lx5PET!|!Vs2s#atASXUyox|F2&Kls+$FTxI<*E`o zpGT~77CZRVk@>wj!Nr@xQU636{*P2+ysL!I6qsE#CtJ)=?R1@Sj7!hBF1YNE6J}hT zXo(-p6~P~!p-cQVrmR4UGio#@#%S8^W4Ec>eM?wXu~6tqsBhM2o;-!mhh=(&f=(gG z*H3gxe&<{eekZ3plMoqL#W-4*Sr=F=RVZi$?MG?*xwPTExdtE5YI`ECrX!>;{xK1c z&`C14!kCCBX}d2P<3AZ!4uYKl3h&8 zG1m$OeQNF3woedf?zb*j+N1zVOLV~+Mt(LK(BWY;ni8P5&+n8n33@RRch*syK(_zl zX8-?h%_q9&^I7&{QvpxWF;@n#6_TF4@)%@4bWCng*b;2O2|bnHw9AvT9M(Qdeu}xt ztQ~3XOf)|qXY=!Mf{w{!MuC%#$t;I=W~p3d^!o4!DCMfDHNsQX5{Gt)TINh~Shn3S z19bmP3*R4t@ECp1OpEu}MS@=KWq&}u=Ae%J{S*nBBj?x^nIqRY-_IJk7F5i{iv$&` zVw=?$tEEmAmZ}ebqzYr?9DD?GxgOJ5ae(?PZwn8FgDRE=qX z&VlXUTpS|i%60r~5fBT(OBc#@`o&LRy2>DRML1bMZ?zDIMorO_G0&`v!$yqZ(<)@i z04<@g%fb^0VHYBcdU50cm8Z}lsSz*bsrNAi%)O=xs#eu@tE<&%rzNM=G^Zs~1${$@ zNoLSV3cJu-Qw4=x*}O+ZMQgX^W0(=8P_Tu^v@VDuL8b63Wn=a_`2jNCG+^+^>Xi`|)*#5jnur$G=x~ryck+pGr`#j8 zuwI72slsY2yZvMvxW|#E6NBTdt$fKbQ&8_Um;-y{d&I(_nc$_Hkam+gqWF^Gh#GAZ zJK2s?T+F!G{8LlSzAyDfbLOHKd+V7=AJ8i27993$=`uj+XSqoTc9E&n<*aTJ!rf(% zx+9z{5H6Bs&eBjO_hBLArC~N)WbCt-%Y8D(nMyfoxHI8q!xRinpwZS@BgmR9=sX<4 zYk6kKDzdb62}}a4z{j#C-dq-2&_JBlJHkP(&uAKLT0^60EnoFxmanDtP<7y0j#kua z)jGKk%kMrpP2muPO(K3r6B^oyGu{r8AcM8KXeSI713IQw?_~aK8<$0+c~ynQ9{X7M zngyf?rpZ)F`&tV~5$-I5)OjD|C$vu;P`ozt^Y8&0XB`7i=uOAWH(M$UO@41Wpax<0 zKZt4aL6gIKzfw_asE;^9T`K4Zg8F1}q{hi&sx#E3f@WABf+u}wow9iLp0WyAz*s7% z*qUJr7-v{jF(Y1Ot&JV=wbn6LbONwh;aXa2kN8^J<&5|+R~Sbw9&z0v0gCq5c6kH? zenfu2171mMdBE2ay08=HyB8!u1_xo0(O~V4{*gZYpJ{Fdd~62Ubgu#X@$9O?J*n$+ zn1Qg)!vh%CwULF?rV~)}1l`PQ9L(8RRP!`;y)b3FE9MH}uC|T~Gr{IBy^ zXp~xs8Mo4!>axPadecEpv5${gE!d(C% z(Z$BM$Xd+{(2Qp1$1O&TIrAigHlC-$cL2^b1JtyE9R%dj=bKZlDcK2e{KsxUk=H-ll(87~p z-cP-W&_{{lIG+RF<9Kpc=X2b9&Wn7unS9Q9b9|f+5G-|}9N(wDL@er29OqL(ACrem zk9g^0S`T4Pc%8{-JyjFu14Q^JY~8A9j!O%3931EKzH2%B>gxI|cYWeQeO8)$K5;tbC+gq2nkc6pPVtZRKt1|u4Q*k7R0h2Dw9J<3U5(Qc zHlSDE=F(H>w$?gM-~t@BK{k-ez{QfbG)Y_DWhd<~NZf&%X&_Yqh$g+#F7?WrP12k1 zu#@64{VpWcfWB3aCXH6OZmGCGXEq9;C6W#hl-NY)OifzbrM7;}l=>P!U(e@n+(3u; z>cv3XLwGdx&35XWpEIeS3t^|osR!BDidvOmkf0VV%(k(`12(UI;NLY$Aii-klmI`h zTxgac(E_c`64Zv(X?x;h%Mx^ROBtm5|0;t5p%yL7;ig4PJKO*2=PUuZCuZMVLj-mC z6OzPYoT#4;;Js+BFM!3_X#Yuv;DO_~9~EiS8Gz*XpVFL1nsnsKPo{v20GFC^@TscbEGNlUq^2?$ePUrCL;4Bi#C>aRf$I9s4 zRXBsXL&m|l_UJWbd?)d5s?fhd{5IghSJa>d@D{y`=POdELhiu%qgrP2^DYLDopl*Y zb}dTPD%BQ!BG{p{LLrwJSuAEu10V@B8VK^zB>2qTkBw&Z zildcgumx*-#p%meTmnRwN#=oA5{n{h8u}Xx$Eq ziP)C5d(5^tQFQ%n;N#Xs(^wZxW0^E`(KK|?G-T2UwtokZII;B&qOIG?L0mg`c5vI)Y!D=xGoIiBmppBYOgwu8}=~yzF|J!g&VhhDT)z zJz7M#;VGio1cox3^UMIHj$X+ZK`Z5UslsWrU1lo$W~w}PjwNWV`jj1)3Hq9KiouLD zcb9Y-GaCiQ6`)%ml7;lplVBAJLikj=^C2ASA9_Zn(wk$Lx73aJk3Y&(R7Naz?ztAr zO6iy>R?0)l2^>;CIO4q@qQ=EjU7t3zX^_`2YlMYYxvf(qgET8HGoD}R%#1&(fur$7 zcnq{CabyzTYL84h#m{pJ+OH1bG{zaE(Fp4Yl4-QoABvZ06pCM)WQ8+()7qrz$p|+X z+5mh`{7dWpDn>6pO{a~ncBElD)8zk)`W z8|K>VSsV3i7yV&Sm%rMmzrLxdFrIfkhi_Jqc*u@@sH3ZpcL5!rH^B2Ddw}qDHECs1 zI93ZWbh<2%b#$Viv2%U~mS)U+z*%^kkSXYLo=M;=mtg{FK<|#l^}zHMB%Y9|^h7G= zRO&3&_3A6A!xM<@Ct#x&;C-$3dD~wY{s88}9()y7!#^@qCiC1a&Z#TAjq5H!C}~Xr;p4HKIEsZfYe{ zbhsyn?|lj%{!{!`Q9phnsh^DS=QvQ%Lr*sI_#yd?aSLODFPr3Tg{*1YTwJSUvejrjP zTg`-u8_iT`tZs{FRkQJzBE<>dDjA@w{#_Q*zw_-fHSFs`@Eb@h33 z`C@R zM#M|~O-Q-*P5()doGFcfl%4N0ItFJRz-NU-6IU@K`-gXLT}vo>t=`(z5;*HH$j<3fldXraWzX|!B!fTbSOoRWjF5)D?9 zEw%+3CTKq^Bhm#4R8OXg$%Mlf$*6WJoYMFVIb2Y^26#oR83g;yTFVq_{RqHEeuEYb z7u32PJ`Mn_%}3n&5x3sK3qISmkOBJ5Z)G9-N@(eU&$2u)m*LJ z9~N{sV;}t$;$qOhN<%4OLBINyDdktcF{RLN{$RM%U^xU6h}R8}{sx1MJe@MSbCoVp z#!LSVdYn0V!HL)ljsxHniq^EaTNcvYe4_zWL+~*iO!75-1wUwyVan%n)a`2W`tECRm>)evZArwS;xKJ=^s2Fog5~v>?%42B`ZuUK0@HYq)W^hGTE?qPt8-G#`aW3u@V2rcn2RJlR+aJcUL` zkauVDN4sMqGg>e}`SKl%8NDO7;Qg~LOxTlEDn)CU^*5*sAqfktQ);T6lGCdMR z?KCbxF=TKz&q6Z*?PQSJ~LotzLUcp zx}zt?NZ788kwsw5eN~86{6Y%Zv}dv&V-QmzH*z0rl-v1tyM(x)I~|fNsjpB66&BNj zsy{9eCtGv)a$$@x$-iLo3_2u{aRz6+N`5ABhx-}Fb)o{Tty;-hb)thRhu>ZuBWMC* zbfSt{<%1gisr#cw`)c>sMlR&Jo>lL&orEFx2tKM73JO_cd7cys`pTE<2jA}uRWfvbt+99u z>j>~Ko91)9FW#2j{sD2aGYyCv5RZFA8W4Xr9((;lLF?5XTzEeh@zNgkwemh6(TcI$ zCw{)eVV_t$gk#Y8=~QVQxA?eo9DS6|Q9LendX}Rm(_8{4x?~^y>`o1PE4;ERRd{## z_*#CK?<=1fh54?fF8wMzEp@GT>02kXuEIOl@7H%w`Mph_e&IUmG8^uru8`ZyH%$NP*KZP z<;=Cp)iO3w9Vcjw+=}HAow8MaCOz=qjZZyW!C7n|!Uh-mO^MrNfNsm>UCVgrUM$Av zzF2Ms2W5&IQ)G}*x`W4cXSw%yLHW#RIXVWcl%KHlyvXjFBD-twzyL3y09dLBwMn+U z`y<#CLbuCQy8Vx=8;h3(IFjvS5xNO)UTOPSXw&fq20#-`Q8@NzArSx;5<&N^9Xc7n z!=RaJ+mHVly7debWJNFTK13_({-(3L=d1$mWsv`==WcjF@Q_|gqoI<0XHa?5n> z7Oxv+xd(e>I(^|^&rVhiRT`~vh4_X1U*5jSYI3v>Cadabpjypw*)69zt_3b{VMOZ) z(*jqO%f}x{S#LZ^=bGt>3C{E!j}0F8z}YOmC=jC$*PyFXX^m@xTc*+m_fbD{@1tm4 zDose5&5}|>I_^P&(%y8`KPwK8KqgE`;s{RJ4JGV$ zf5y+o3fka3!#;zh@$IsU1&xwKJGYi+P`h2On8Sy}TW>{*A&Wzq^4 z^`>RAL~Cr7xOTZP=_I}SSD8k+a;;>Ry_N}}bs}l48~~R?H%x2EY<-E zS;zys07)UN?LkPG3an{RzL{n%#l~u>^*JAl>2o|Q%ml}2fGM$EigP!Wg39;AVG^vr zb|Zg61q6G%v3unwBseZl!X&U#eZ|)!{~Ja2QT=ez3#)mi$XcC*?)%urdo&W(h(eEp5dZ&cm(KBcfLA`pN;=4GxgSy!=@t z(rmVs_G`OU^y}zI?<`&}iCq_}MM|N^Ntm~p1T#M$ZDVT**tn6efoZkys z^eACZFz5v;QBy3hu3-e)GPA5C)>t0AALLGrCHYey2$w#M{crU^N1%6&_qKSMGj5OuZzr2EKf|}YNy(jE>C>lri-@Z{lv<; z$jZd*WK)boiC&tXG(E}a%T7-!O|p4RX;OKTeGO~TbZfq4h4bE~(^e@q(WNeQbKcv? zpo#!PJKU;0YDe{#cT(!l;Fk?!$oGja=F0mM-wt0Kcr#jo&Cm|tDW5N*M>682Q@-K; z81mu%h(9UJ23y&1Ig3pyZ9gCP5*L1jQk-! z%O3D3GAm(3UF3*_k#&(H6Uvk7r#sG&OrcCy$R*Q>pMp%Gd00hL=$LDO8|OiH1%7t9&*EpaXP!r<&?e7e{0#F> z_sSHS<6VxQ-QG-}OrZ(B3jFNxW%`lazX(4|{af(!wSQooOrc0zDSj&AcH?J%-1qny z5nmE7Q)of_D*Wt@&rFahG$>&#e&!~8f}bM^gA-*6g%hXXry_B8A|ydX?bD2yJneNT z0l+2v>$qb9kS`a283J4lT#TjBvcwX9dTd46Rmu{Ck(JI?9CA0jDTW8;!toyLs5`8J`p=) zqPds@ntB0b;ORVA^ijgbgy^`16Y>%?InNVKzDe$Maz7p)iXs0X{-bzJ&T~nVAD3qx z^2zb@;-k4Ai#r{s$!A$*mLV^*7Fu>?j(bDk3#RVxdOz?Qa?DAcdzo73bnEy2?6_#| zRsOYpP0rI&ldq$#PT$RSSH|?+ImlSLpsV%wzk|Okg!NRQBMCnw=rR8~;YflE(2<0k zMC?k*q!`MdHB$Vf8CC@C^3GJ`U*d-t#m;3l^9bakCm!wb9rNjOKlSbL$pG!~h5WJQ zW;1g^3OyNV0=$5w12NV&0VyW^Se zQ+&Y84Jq{GrcItNJ-Uo_o=wo>-sCyKG739Ih`AzC=#Pa)d#0Ndd7jZoG1^mJBgGjq z95{x~ptq(2r{V7{T8_!054D~*UR;L|G60_Oi9`XGM4 zA=(wc8$`Q-;F=8LWdTItgm=xyTaqw0L3X9NKrm6*Stbe+R~m+}FtH*L@-QH}LSIVo zEOWE2Cf!lO!hJW1r(`NURif{E-Bcw%#}4^(3CtgabW;oV%Y|T11iythg;XIuq`j_q zNUPF#DEV(#sXWv^U8d3t|E-CdG?4*nay#a?hn{>IOSXsFo5&|$)#2a2Ak*oES26#* zMlj+fE#b)2o=NGR4ziFs@Xbl4pnD!hhJ6Hymt}xn-UDaWdm!D?y0jO;;)4GkY3K6{ z2>aUk^b^$hNg1RkD{(Qw+C@JahKkW$_POD%`|Yy=-G7*DSb(VOi!wk(a=5}R_HcEW zR9Nc}{Hm)AGR3c)JE>pW`Te@9xs&>Pf2`gRqx8o!etbycL^<>xne;i7V;c?S&;-Y5 zXac>1bsK5lp-Mx+X@60HPIZ4$tB1=XeVQ+l`EbpVuf}UTsqxkXwx{hcmJ%t>U;eKRa=A6Jpr8h`wQv{{Y*G{z)(SN4lstxz+C9h?rD3Jpy$!t9^B?P+Y^Lt zUKn$X9w6xEZZbgKaADh%-E;lpL{QcU*f|GYcXEC`95W3;^tvr3emzWVmmF@2rbCJ0 zX*>PX@V$)*Gg{hbY1Uj8kJ^bJecVY)kHe2na)dLYJXyr*B^ZPvq&AzJL4w-<8Y}@y z4&Cj7y8q71@4tnNCJzmYxqSs~x?N;?XPp;iO4hzc2_xhvGx`F=LDrlejK?^^OX?~f zKqvZ3$Rxg$l`Osjq75buPHb%|W93&v1hsiY2I-Ll;DHAu9yV!DVOzK~4>G2C)=7fw z@g()(Wlg6^iAiI@Mkh;HY`xjb21a30Ze>GsddWLnfIvcRM>Jui8SJ+ z2z^cl<`kc+Fhm(c=yPI;-Vi|xtOdAoTVUnz{ml?jhX@KDH$o_3lx=Uk4G(}Ob78mL z4*2Ts@e>qFh5NpQ1Ia)%A zm%DJZJga@_a_FqgQT)bgI`=E(s8K2r(xot*!h{Dw#5_tB*1;93%~YFiGo2+zGR5VN z!?TkSuI)HkVJmJ?h1|+8zQ?U{hxB3kupEGP$bGTFee!H<@T|-=T3T$GqFwl|vv6n9 zSI{jjWeTtIUIjn;we_s!p=!7bNye)KWZfx>OB?M(RRerk{;JGyPv`;7fnscp0R=@dx6W zIUR`4Pe3mSnyO}D;pGg{XsH?njnuEbAwM)w{gDKg+eZ@06J#14NjRy)CliJxa>TI2 zQHl5v1a+FFFZ3jdn7bl-(;`XSuVK2MUxQ$Uub)TT=6=-pQfV%0gV;<#Y1#Pdvt>4P z`*;r5ze5J-j^~+w!RzM}GC)tf$;y>=oql$oj^xwj0^YMNz-$T7duknmybpNkzg$87 z@cwH)FM5zP%$Ez4!!`R0di`~oO0So~^thCB()*T|UN=c!FXf~d`cgUHsENT@3^HQ% ze}uTW`EmfOM`KDpXfu}wAGQad9uCDYmyn>_@uY1hRx|xTZshCIkf3t;8SDCl1bv2w z30OWxU&yamoR00z$LfOZ&Ss`H+t{#kHt-)JgEU8N=lg?@pziFvae%GjH$YG`w$yNd zfr5%+nj#sfM#;ch% z!ZXzx6;r?(HO8uu;TUTyOj4Z!##+0Kb1jr7P~k&(UNgeOc~s6+?#>$KoG}{V;ozie z)K^Z_SL!>ngmMO;#MeJi(6elnHOTIuL3Rf@02l)+`!Wz+DtSjE(tY|72^Nzu1P4~N?K;g@#U&i6-mxV3|z|Gzn zw+JHeMe*OqTjBh-===DMR|DY4g`TMpT21v%^;+R=Z_>K!Gn?bv$`Z5`;*d1@B!S6$ zG5L%u&Rro>=-d?-uC&6#HLl`{Wq7ybBSfV!)z0Ljc!@T**_dXsGi|^2)U{asvji=Y z1-N4FWv0Y5ok6BG)&<3<=Xkn}b#1*pp6_|WE8hf$v#e;izM&`L?E(a?Z}?e5ENnXT zS;I3<6w^*PX+5%OeJj@{@UMf)ED)4B{w7*rEmY;8M zbU4$>w0s=qtWawYpT8nr8tWQ;8Lp$sxyCg5vdNeEgRsok;mMbk#737~w)OTXHP_=T zjdkI;psP97b-*3Zw^rc_okLNhMU9-&7B%{)5!$2$vmZ73#EIg(#=6G3oHmVhEpsI9(Goa{`YxPvXN z@St9Fu;tdA6c>s!`;$;yUYxzo=EY5c{2A-?v8zv9 zZBtwmzD9$bjh;_6K%6k|h`E%yqYVx~dVtytb2$M%Vzqf7iFeN73bcPEjQ<~aBo?&| zs7IbKD0T_i<6wQ-M0DK-W5`uGz8PQcklBL7-F9E!-Olb)pl|U7xgt2K-f~Ag4v&yo z;Fg{4XjL=ZYOtz-;EX$_$pED-Uwkl!Fpp+Cn`jqm#Jt3Yqueb}uzxbl5#EW^(VC2b#wqnQ+ zvKWF59=f4|N@WE*FyY-Nr>~F|HZ63c?Xll34@8HM4#*RB3@37$@egZvsb>AWYF{!N zv?q1} z1OrU9QmwRijw@BQy>sNKcjPW>gC*O z`1LzzQ*l)72FA1(awT>Z0dZ3En0ep)CSRd`hbiKvn+hlzVsnpn8LV5E0qas4BMS&Y zj#(zRNIk#67q-YP5{_6pMfl`KTjX9oz&MD#vVh{zHXFm4w9BYzp_MTPd8V;pKaG(` zWXJg$2C}QK7y}UZN& z1i>q1DqRUj_d2@8gLuOEKV*RZ<3*g+VJ#D}rvtmd7ZDl5_9L=7z7}6cl3&XV`gKIg z3?|@1eMHb~xg6*A<&r%`(FE@#zU_<%TJJrIt>jT}R=mZ^{1HKaH%ed;2$xU}ln=QI zncD5^ENinR(`d7G*n?Y&!=9sju^AC`$eIqWM_*2j4HoBjx ztG{<(&1!}GA-`ekA^!@tYe4mn`;Xh`&wI}Yg7u=4D zG*g%eZ9np?Os8kFEfsD`+15vv75=CfePnHRGqBmc*NvFH?hE|O`D@b}@vKZk)+*dg zqtiIQkFA}S4A4&N5KKL(h>F0jil~CHB`XwK4K7Hz?mWB^Kh~{X(iIAN_IcB3&%fa-sI52+lxRqX9xpEJAfA2DLvm2%I+Hus`Uuk&$EL0B?NG_#5h@h46bc^!I^*iY zemx3Bt@?7VHJiXF-Hh6x&W*7#;2GB$7UCBQ2OKL%+!n(wZ@UBQywPC4<8E&u&YWO9 zcc(+JiV&rDi%HP!cTw*8yKz`J4Rb}#?3HFL>`zT!+?{SdbGF8L?Dy#T@q(JYA_Mfw zcx}@*UM|pXbQj2t8rUc|>!{6gp9c2H{aDmisx{gb?i%%}g7}{8V*1LF&?Fxz_pzlR zh+ujK8mzA41(m6CW&%aRIMe{pOr}z^7uYHV!4{y^K)PV-88%^`07q1sKT*qexQ*oz zgmn$aPsGVh2I%g=yq!cadZT)Obhh6=*m43wP7);8*ViOLH{NQpzx6&RdnbOfAb4e< z>!-7h3W7J7kA`kQLS6)bzE!5vtOb%#Kk)^jyDCsB8V-C)^JS`yxp$p?T&vmpzo6Dbk`bP zQyosz;bsEir~ZgpQY>f)^b~`PyF^xZ-DRqN*Zp?Y@Bc5m>cs-_dMUZT#lju z@I!D@1>O80y3_$+hIM_+=Y9RH(a-zVJ8gGm0(95kioB)?Ja{YvG)!Vc+ntK#r+jop zL@qZz3Qf0t@BwI!O*DYEr~!cH_|m2eYR|S%VL6pMXexVs5FC-m8G=MZun4;b)tDiu z#eK-f0bm-&p1A;AfwBNJ100L@Wd z4WtVI?b8fK12AS|z5?K#FqdO+0bGya zULfeMff%BJaxAZOW3kQEY3|DAF9jqTfs z5_I#MGC*%)%io>yWF@y8XuX6+p?3v6j@R&Lj#Xu0A3{~uIQ9cAIBuMTk7#3N_O75R ztIFIXQl?+yQ$@I&KZHAN2NbUK0}9ZvcsKq_)Z}|(4H$b z!1EoLYtdo=SEI!Mu0V?cG)0R)5OjMVd{TYnC@8$rD0zrS9T5X~E=HjW0Y8laA(sl$ z?>GYZwLM0^?(A&vsPhRG4V+Nlvic=|4od~y8;~g!IH6c#^9!i$Md#2X=&z37;beBar&(+_e4i$HYL2({4iV9$>ez%cq4_ZMac!clWfj_YZA zY;ZfBq-fdMu6eE)+Ig-@4tCas40Y$ZV`B5%A&-~kXecz~$?`-awSQ)IThbkezwSLT zjA-_+WE%adJ5GGv2eDcjkTHY>aEUR)z11xJsFs6fs^1LknlwBA%Dzhq^F zOhE&!g>bpI&{}W7_dcz+`Vgjarl3BE>TIHlOjKtst3RT;ny7pe)s>?*TiaNNEK}&7 z%3!SSJJuQ!e~69<{ULTLMP#vzi7S@HQGp)<(J4_Zx5rX$mwP#wqNl`O6Et&euUr=+ ziPLrXn@p#_fp;|JQZWypWq2(<=RShcLy&`p-552Q z_xgPWb@{DKp+EdxrqBjCM9B;qqC!ycX1YJ<4SQc47W%`{M1M6#K~sK=n$8AVec|%# zYn~mt+Cj&1c!(OJd=bZR7(qV=wWM{38l&RuFut%cY77V*5h;p@i!|-bvM3NtSJRQ9 z%?1$kqck%()731{2b>IMsY(z8>;#o+drgAv5Ug?)KtkKq=Z0R_@N=~X<#BrSJN%g5 zA2TlZk5BO9uE3VI^b>Ud<6y)61TB^$xr6%&ng=8KR2rnlCur$5M-PR<)=uauPnnNfNlD8aG=VftuwJPPkj+YH1=AFyGWoC{UlpOj!C%9Z^ua z3PYNWEgT2GG59szv9x{>RtI+n7UPE(CWo~Ayon0ohd zWii(`8E3ghbI^S8qg|t+oS|EcK=jx-+EvDsCSjSY(p96JO4qvBa@M)FGr7rlyK8@J zaKCGRv>XJYApp5NRH_q@zNsS&YJN%eaC#YKZs+#Q+05seCO)m&iS(A zYp2bQA0A($0>k5{)I>~)FNu$7U`hOYHRIoluc(Qrh~H8Zu_b;>Yz|xE_ryb|({AIQ z_%CXNzlc8;OMWbVe1gy6zs$o5z13csLHWMvJ}evPGyE>{o%3Nmk7bz-@BB%OFk>D> ztMiyQ8a`O)Eks%Wph#$tXYm?u=1G>!mhtxbimMIEmcwdcAepI2vjQshF>OV*xz24> zu3RCb+Au5RMkfX$Wc$?DU(oF-GKIS4vIAx$vaQbmJM0c+;bnbZ32BGi5slg*ck^aO zbHd$nuM@?J!QxNRI?|tBtJ#Ft{#G;mw|!O(gw7!|_RXbC37V!6*76D8gjEq*&zTas zxLqPJ0@`PJ!$z@G+emeZsX~{~6F%1G#e!=`r?bcwC(AAyWeraqv{CMq2~K(V(rBmr zqBiOa`L#@BD%^!?vajWdI=B<^yiCLh$IzXZ!|T{x3|9jz+;XQzpj=1;tQ@O$vK%X~ z4ld7{?W#>T+x3pYq4NBX-f@-3;!tNQcP+1jTkbkt2Y1>v%+01GsSzxIG|XM;=0StT z6Rv})(p}}&tOIr`8dv2$+@Ln@aD$@_bZw(_M;n~4LwCNx(1x|s4sAHI4sK?{c@3cp z5zTF0!^Keynoo-xe#jU!Sz|tIxVB*eeBwt@Ya4E=joQ?3ek0@^C7R!8Q6qjvCyH9s zD7$g(ie@*y(55!-LYus{y5Z5Zd2I{Z#&&CA+v2u9%oP1y6}R2gwstm~+D>_(Hg3uT z(;m=SM|)w~10U9*`|yFyb#R*>I9~^M{(*iEqTSKl`aL)#is3#T@?eB9(Z)m`EO;;h z?%txPf(MIhqlzC4J%qfYM4^YW9;(%+Sr09KsCFY4KQyI7ZQPU&(>l~?c!v+`(0$lp za~<5~4(IFO&Ufh75tWN+c*h}(L7VlY9?~%q#h?`w=~&Q_8_q0qFQTZd$Cf@;yWLA43q4T_XSkZp5WDnK4nL%RYKT#xY8&y=5H&m| zG+Y%aAC7L?6-<$u78{(VF2n{es3OaU^PnNNY6ZWsJcxzW$T!w8$8_+R)yFm+q&@_= zJs2_dp+n>WoEGuYA;PQb?QNGqC+R|)n0j4klhfA8JEv`4TQ>@dcxhhSm2G3_R<;GJ zw{zi6`R#C=d4{We1r2b@SD_~Wa9o$+I9(2B)JlySA&29rqjAG~Gg*;!44xQ|Sr^(^ z;flBUTb5mD%6%W*$Kj9eL!K3HGjX{pvMfAE%c-6>sfv2(RL|2FZ9xoAL<0mZX5#W* zn)o?GTyBV;qXSG_uB*13iC4a@i8~wOm8L$O=`a(oj8;QtXwnQiW_{Mc3YYbw&l>D& zV8NB?z6M7%aJ0d;62^zLJ5b(wC+C)|)}rq$g{L#COMx^XuyVVX=s z)78*q8k(;39(R5wYJ;3JbmbbI z4iZ}Yt?s~M)>%v6GSXQqk8F8I9!)X&Ikc6&B2TyzpZw`7Iz!qVXb=iHLt|Yr!LhC- zE<1-Ma5>7ydoKH*`Q*-8eQZ}TKjUNi$KT9I&sum}T4;MjIv509OD1OkyG3~BfzP|%84WGH-6%xk(B)+r^IWnL~*XxNpz zuaqft_L|COGKGd-x9vKaLf>9jiPui{UO&6JOrhc%kKQO#sPd-aH_H?%yE*d~nL?pk z*WD^p=;*DBZ<8ss^R_81WeQEWbIP4Eg^sj7*;=O1cdZBCB~z&Mu5)+6ApGv?yJZTE zy=VVDDCpj8_re=hn+q@o$L>J}X<)nTb~1(Dc`)lC_^o<0gm+fn>6pcj3JegmA^s3L z;#fkzM43So6PF}f;qtd>Nn&mi1Gz~BNhm4lUHrVueKJV%xXi|*8>93lQ<})}~vYz{H4e|Y`F@;O@na8Y~M8V(Q_?SUg#5530ZT->&ztpPQb-f6cHvvy;< zX2Z&Uazxbl z9Z$%yA~p2Tuz#YFaxGh~7*XL`xv9=MY?C}+$JYHkjdsCq#Uv|qO?N>mr1#|0T_rBZ z-hQF0%Ed)?izWFMH8<)_DTJk?&a_TQIhAhkRNDJy6gGt}2%m zKH7_WN_Hh32{AK#jyw}{Xn$s-hvgy>mV)cp=$ZYQjh-53cI}bm8QB>z3OAsG1PyX6 zaLE+<#I?>P(`lXS7(&Nfc!xc|H=Tv9VG8wekAp|xaqf*Cn8tHPX@8eN`a2MCCp$>c zGk=%qK&WshCiwegz7`!M=ydcK9D;xl|Qk`&Zy(2{T~UQGq2ZlxLf@kcHGDh>Pqj zK`n#0LV$VN)iOX=m+~d`5J5Nby9;<#q9@y=^(^IvXG6`;-q76rBHZC%H~!+wHtyxW z+glta1>e&^I^F#u?k->aJMOGt33Roc=IR!9nxTSjX@v>_xW#CK-*TUQwR~SY`||&v zO%HRI1}F&crnHvn*d!CzEJM_qn&g7p)gE_*!vwYA z)o7TY_U%m%w|~a&;b*!TRJY&ST|G=tnXHngv;Hv1wwfxFWl?aAZ6-x)%2I`jdy zz0qDr!h)`94f3#{sd7GF@WWn-wV7iheU}-k+wViBVG#xH>tiRoSXOU;z{(wAK^aRV z>RPiTyHFVKaG@gvH7nt!j1crjw!|L&;*q`^@$HWg)arrSzyqlUbFr+VnMR?7u;mG| zNl`S(7$DOaIT?MUA8;*SVVHu!@%XnHx1pW6UaP#SMCdB;s z0A(swLO(J{D=_&}sY(uDHR=dHhjQ*Uyw`KdGIE6}V-A;*E9k%HAlG&BG5cuZSwr!L0=(felTJp+F2^M;%AFH(}UhKg{AQ;LVp{GubBOz zt&>=(*U-1Dw~{C5q&1La2364-jP4p5gx!lCWX>S$nh1xx z%v$pVRlsF_3ddAn?9-{j^@GdQ3BzJv{NxEUG?eSDVE0;ig7%}&gY<(Z?3HO0_U3wJ zI^}w|dNBb;L5nQr>$&-UOa;9YzW>3fIyC57%5-YERk2dzC_#@eVD>Od&~Fwndl)5X z9b{|iY&|5{UDA`Xke*~aBA5s9LX1b8`0>LO8K7J_n$^%o%hUXOT59!6O_WMkZX#B_ zD-bjV?uycAmikLQ$R0_QpR@`yQ}~fUA@qJZLI)Ifu zGq8)NDr*bDt2dk#Z=tbnV>^1m*T-+bus;HjzYXpI8Km|X{On&}htqYqDI513aZd&( zne5r*gYp;S&U&ZvC2ygi9iFpZa1XpJ#on7f;P)oVdeJhuL$L^Rhst3uHKkC&(V+#7YZuz zZDQd_p}1%}+qc)dWoqBqt#5>>b2lxWFNXxO+fEr1!u_QVPJ?yu7jm%TnT+ z*(%E)6PxAF_S;2d`*ScrsknnJ(wJu$)g|WZ-lMK?I`mpYK zAGwtG0^LC!Qt{bj$$Y+6=QB9v*RWRQ*Dyh} zQx3KC;INQmsP&PBTOV9xe`M{2$Qs~YYrlo>jHM2=-zp@VsE|G(n1DkZL7z}I^k;M+ z+r7{YX9D;<7rG0uZU8Ls%=fs{wUm3lXOYJ!lrQ(JvcYWcK_9Xlj;VFfcZ36+{}ErV znMtTDTfM#Xl1!tQ^06}Sl(~K@e5M!UhgvgO?{b`=d@BpKi62w8o1MvJyR-0_Pw;$% zpMl;ZKA<^OwtJf!OUgJw1)j+sjLbOk6FRqMFLGA1+9r{%CR)?>FBQ^LOV=8@M70a72zc25C2=I?r(povfg?o1Qu6O!rl z37sS6jpwKYdyx{?9GC1I+xOdDpJPjcnRmc-)MaM-B_>qtbm6vUW3v}zkV_15i7MQQ z&e1I1$&3?pj>0Z1%i{!1aW6ELrG@T2JZI7FJ?<}TG>Y)?DH+-coU@)Dw8^s@Pd@F& zPX_JwWMjXR?Jf7R-9owdIKs#Ax={w5@eXBw>^!;t(MK@OR|*gIs7R@=!iROv?#%+v z9NxN)6S}}47YO$N<=$_2BQ{P@xpzG;R^tWyliJK7Qx;2Gx>77>Iq)pGf^}|K?6N|B z??ikr`zf2NQ9l(?c1|@O-#YI22BhP3)P>KW;?t2WZN&gX$d5mKOazKzkqM&CAvYMbw1G~%G|s1Jp*8zDOC8|!y680+8Q z2S0&>A===d9Pb1s$4^gicZ)#2Nz)Um6HG5tb;7X(v&mSPSeguaUIa^%=W~E_nxDKV z*{<-SIQnBYhvj&Hm*0s(2Zo=?P!p zd4NU9``C5octJdQ2mQh#QB*^Oq_uc&XbMwhtLG_OF9n8%dY)!$R! zaF9LqkJU%-^StJQoOW|5K`sUJ`b51x^-X(E)EiVEce>*REs*bFsl!ZLA=lc~|3;pY z_I3Vp%qe}f&z+F#$@R!?lyD8>_(IP8~iez zHu$sStZ-&;%8pwUC(~(BTm@detMw@|2f+pd-*((-_!+_U?GryJ-pra_!6<7beOKT9|k`5%)B7I&of-%%FKmWuCF2{g zdr3sgM|`S9}Gt0V~|a74sQTjfrPiJ@oDPB~iHQQFDGP)95=)XKBPHB+oo8~ngpX@lR>0GC-{4<&q< z=q}{mq7M^`l5Mys`FuTxou04Px4s?GxBig&F7_QlL+bar+JJqo9&)uqKIH1N&7Hv6 z<`AmFh^%yu`Z*YAXr16&>yqv=aFF)IyfwRrm-+(zjNzl5hhFl{9 zG~}8i&2a?adJMT{JG&N`BH(JuAHJZQ5J!IKn0Mmo(<^ zlE%n=+uNK)h1#H?_s8|54XWJ2ZVaCxM^E-uCgZ>g&A`g!^Y#4NmF1wfp;}Zgx4s>h zTmNkH*toOJb6c1=&S!62WwK8{tpz=CWR=98G{c#AXK%QjUknYhtV46Qc~*-k4QE}Q zP??OyEhXaReEq!141fEUT}7iAh5TaUc&v3C=QB8|l6frn5$fmXooo20lTSB2nRPzc z)p8uCtxT>=*7JiZlf(7wX%ns&sb|pR>yuss0J;5QgrQTkY#adWcJNMQ* z9}_$H>LFMA*=t;wV=-N0!d&|Pq+>}gt*m}5sWcg-BjeKKxyc5-1ohJtBkSeYGhku8 z@do5QTsw5VAa5{}# zb=A7M$aPm8XuMFL-Pi_#V{g-Tmg z-(bG&DfKJZ03MEbUX?-4Vqc@9jj%JCBxveo2QQaFI(YeeS6JcvUi97-A6_AYbo9z^ zuQbFPFW-E*e2yvLHvfvvSIFl$7o@>~X_C-jDq|;IGmkyAOcJ!a+2m{SOv826%`H~K zVq5{cXl5{vjb0g?d@b(5nDX#joYC%P6R(w>4Y<3R`6`enrYjbfyz2_D^RpO~9T-#L zb=A#d!ko0|`o-6qT*RyBPQ8e|`Zn9Rfl0kxi|76z2P&JR(Lg9*r-8Xaaz8{>I8mJY zMr*JAB;J=a%mrB+d*qoUXbP2(y@F8*%_ZcZ`N3TJ(uv}1Vg_)4=N-Q1nyYr-up}vG|RhR#2@4anxf1s13lrW=@M%Vi;JXRc2{`ewAeOT^l~A0Bt?(qlpojZ4 z;-$HXA13Nf20QyOad{%Hz%n!+Tb?*L35-hLXbesooMfltJpWZZvB9zimpQdKZ2j-+M`y?P^-CMrQCzWQ4f{8;r6v6v4QynjCE-SE z8kx+8HXYwoV>!WqhB*yA+{%cTavFvk>Lx=X9B#PGiDKG)jrKK?>9HKa;Sy^aopQ=O z)#!L*T^OedHyYi@DPeS@!bZ^&3LC9)q6C_n*LX4&qna4@Q*rs`%iYiGUEZuKmt5(39$zd| zox1G%%RC&6c!ID){OrUOV|(h^1KL z87#^UaH8G6oHv1&)#ZYEjxkPb->p!>$`J z@oWZkqQ&_Z_B^8VEq-W$#&BQL4=v{0U`Gi#S&+EH=BdFn&1h}3aTV1Go@dY*ojdDz z>Kt|I{DPqp@I)qFv9o%my0N`Ywqs0guT(d76tXz#m3eSoGEZ)DL+(bK+c#*x?JGvk`AWI8#hm4E1nkiUn25uUOiO2|-`UO>W~A0h=n% zG%xsp-pEe#=J~-ag1U?H{D(Q1p@WD0nQ_`~Clems@sBd&RwUHMtw`8naO*&af3zjx zvpTrX6242&n+A~ZKW=VqTqto-!`iq-4L3K8)_Zfq3k{=gyov>VgS)T*chx#N#4aL> z1x@#qdayC@WJ2veGj35s)~R3A@N7fy<6=RX-b@HnbQE4{E*7-jmkG&=#=(}QSkN@k zWf&ZcH;M&q0Isva!3qQU`MzVda1`zv>xYjHraX*0CjCm;Vc#*I_Lu^B-Z9@m$c}Z? zK!0W&usVba_#)mg9x%tzs8~=au_)0rv%22VdIr4oaC3*ieWGS#RIXMi^rDtGtx&6t zp$UthR;$C7mee4~Nk_THR>u*qhLt7HIBw!~Wots+{ zzDr=n97W;ltUWa^GF>_QRY~iTOuw&7`kYr`ZPD|2QgxC!oUnyYby9!(XoD~(4%g4K z#n^fEi|cc(8j~*IuVMJfr@~1~FmwV_2Wp2>1<*-tGRosY>_XYd~=PGd6d6 zCa86V=#MXHfSm@4M{U0L=uWT4=(X#Z2Yi~ZVK@1}Lzt&cd22=wJqrD9c0htuPJok* zk>jP_*3)=7l{fyZJTVQLf>WbRYpR^eSIaCpqp9-USX=aW<@+3|$L)Pt>7?T_kk%{@ zQ)Q`RQ(h|P;&6fbvWkh$x=L<#80u!Z*P-4k58BiN)i|XU50G}8nx}kv|BX%QJhg;n zK8RYPSf~VWjarLujv4YaL5J00Wj=tzaItKp>1S1@5#MmdnMyO}!|Jr7v~pU7a8-(h zsMspDJ&_e#^BqrQ^R4+ddcL)k)mlKk)cV*?_=R=K^74iP5vQzkmXAZQIiqvdFp3Ed zqdc;wMIMcVpd5*Ey?I{y%bg}@m}{P6A~w%eVb}z>qtaFB^01x-WDTxL<{P@ZD_z@S zy>@JK?c_*3k~>{rIO&{>%t%(c*4QTvTH{)W;?U3V31UWazw3<4UK-E12D#0)fCjmT z;|dVeGu)MKtvrBGrF(~4+u4JW(GFbA8e!EQ_W?W2K=0t#W>-=rIs_cClGZzBcI#=I zL372o(OxHNFMVY+s^~Cfa&yDbE}%?T-0HvgEgbV`p}9=_MtV@8x3+5P;0#v!KJy@3n*5_7r`x4MmHW3n`LT6 z9TKdBwX<5ShI(t^xY(c5g+GV(N4xufrW0ofvsA#B>QGh)0%YtOs70}JuV1QG>x}~h zaI{)gn|D1qSWSH#R?x>a0N*Cxz|0hs?;4Be(7$x`cdKxK`nz-ZH^=?88=DuKB2@rf zt-i&C`&RXZYc1+)ZLkc{YIT@BK+nW`d}}df*UIe@H@Dm63;=aNioa!uisAAxm7TeY zbIw)Nx%hoeHS6V=eLjcE*xM#aHQ{oIKxF@q)xmki1c;3SoizDX>&q1SY#6(-5zR{V%OIIzX604f5 zZGu~onw9vh$q!u1*@7CRpwR#xN0R|OErUYBaqP8-f{#}Q;K;QxFmnVozS#gbw+8^9 zt5+JJ$>mz@mM*{FFhKz~s-iXG;bHY2lrvw%_*1Dy#AK0gG*y&Dcl%p{84!-8u(83Q4ZM%H7XhyrzS-Mv(=JlV7XeU^Z^&FW2LG> zlrFzYt>c-?B?&2LtehdyC_#~aBu$EM^^GL0OnnX-GCxE#%8G zN#b>zyT1OG-b-<742ZTE5G^qv+F?Mn!hmRl0nq{t3MrjBO1qBI)KS`Xly)7ZQ%C94 zQIU8kW(askW`^U@r&$JwZhATp?Xo}?20-^1)cX9mqc-7u`M&f8BHpk!;*I?OxVmDM z27(~EZ*~Ozh=5;U6)YsAF}C7~h5ms}AU_bu)fOTW30Nzn)#@rq;elIOnBsoH#!jvb zZ*K24q{>d1yS?{z_IS(9?(Cc1qNrmd0-|#)_%xXp-P7m-vqKoZBgm9#F{{;N*S-Ju9vvgUO&yN z{-~QUqiOnk`cE2T;H$br(%b&-?Nkyt<8@5{%<#0OuPgj*S?}^?)5$y??{dsD)$dsM zVb|OQ00960s9mwK0RR9100000EQ%sA1$PJ%B)B{LUgyjw zNZXa~^SpkqCx2wlIdf+2-21tA=FG9VDn-eu;21!9=-PWun#EZwVPK;MD;guEPy? zTA!d>OYWcO4z=DQcVvD)40#!2^3FC=-T zcp=}b&>XMgwz=!v^z5%VdcPSxaL%D-od*6mnFtLX+1C zFRb?7?9FUbI-Ck*;BY$-)-kRlk~?N}#ORJwI&s~^c3`u2g%9d{X8B;A&r%-@^&RJn zslH9VSnRvn7cqVl{RQ3OX73aqjPdticfXJKf5Jb)Bo@ilk~<8O(Gol5UWvJCnZhd7 zqR^)Ht3Rr|Ku?yX5;No?dc-?*KWAl#!YLJIAlb+?kYmi$H-CZ79Yz?*1~QEt1C7R9 zO*(8u1FcyK*_dswv(aK7 zuyM!^bs)?!%z>&dtz85?%1ArS=8Ft-lsGWbQRQH)!LibT7RNCMj&-imoW~sLPUJhs zJ29#AvChnO%yG_vNu3)sHr~0wiB-;RPHcA`cH*cr*u`9R&dE*&W;kaP!#a({xkkHC z>6+(4Sm#N)hk34pE*y5nyD_&@SUYKn3v)Xy)GtcBdxRTR?#XUUbS^LH2N?1$8P@<8cPY7 z5P^55pw(8zs>AOq1q6;z|9OSFSf!dav_lELhGk&}3{eaL8z+d8pOIQM1az z3GYN7=BT!UorrW6J5k|0;KB)4nj1OpHEwM4KH<&t{c`siZw&DX_d&YPZa)v{h#OH} zE4;AQ>tf|_AFTKDa18gE=ZB?!>oxx;U!cj_>A(p`q!V$@EbO3Fok+^x``#`8WZK#SPOf2@d_4~vF(xn zmTiV?k_c0U3Jq!o&9es;j;NCg=hS%vL(mMYK`YRPQ$VO0N%LI2iNoeGx_5yv6|Io0 zhAEWL6RJ13RSK}@j~WaS*dR|SgcwmKO3YCv#+hqPgj?16YmTu}EfiSA8rx?dwh`qR z?!Y9+VFx0enXdNdy)p<5y;BDWDRI*+csfU7qAUigP!CMSX&}suHZk2wv5{%#*eJBm z+K6y8Ik4QZ)+wY!t})s`n`0UyV`yQV{#))?2i7>+9CVReo~Hjfa-tMcA>X&w7xliA zd@+NTwne_pzF6+N(ia$o3@)2|7jfC_yPV6Fz8kpQ z>bt`iJAC&sa?JM>m%IHA`B7(6{HOclV8GD;Le}_i_NOu@U=7~@g47n zseZHlu)r_PA36TT{ut$7?T>^0MFAKUFfIV~0Ve`*I-s!w=67iBfMp$yb-=j};em(^ z%nC$7U|Arl0w)JzR^Wm_EDhWgh#i6Z193F)R3HjE&hLokj%^)rvSWECAwvXmeX4vg z%cso;alXmEhz(2%6f#60nSSJxzUO>V6<8C9=8h}$?7Yk`&L7knPrT=REB&yCMj%)QD-f$ZRzKXZf5(&h>g%k-Bpv13*x&JpChc?_aNw|Gq7x0y4NmNEmbx&@waA6l zu5&K5b=f2(JR86$Fkr1xHk^@obtg&-|fB_ z?>E&CY5qC>sP>=lkNN%w{V~5|b4TW_@|oo$WT-$ah6Cl;XClF#Vl(M13J5FFSh5^1 znLJ5GDa5Faim`bzN&~S>87lC}XZS2x@@ktb(80%i4w)#i zMp}q<#yfe5+#?T2#Hitlv21&UjivTRo3S&FSSRA0SxyXhRyk4aoZ#lAt=n^WFIgg0 z&QVyPY7EpH#|@k`N`R3x;qRbXG{l@wzgW42$<{0j^Q`4ITJ0@=5<&E>+p*~pZv)%_SK3jdT-{*)A??Kbl5rva# zrGeGPC@?8g9Z?KK7%L41*0fiRCc$R9x!=SQ^R$V*_6eJJu4yt$B1_V|A0x1fUY7&% ztmL|(Myi2SS_(>y@rICb0xc@vK(SE;G+;H*f<-1;&AlWP##q>Dx7m8$3UNj`QS7X6 zqS!s!jWVxlFKqJK;f49W%Y3mh;7EX=?y4{zSY)m+k#Dt-EVtE0n|;hiup`ldd`Ad< zp=nOkI_Eo);gjow0^gCoXbRY<+sC;YTxfKiaN&%r*p1P&dzkGm^Fp=PWG~G2TIYqD zfT^1Ih*!QhioI8RW4(8V4@UYF_+qT@9AA_N)C35bAaF%L6v##c!|Z%p5TVhSYGICb z+`fz6qu9w@149+&sKq4VL>s8b zbTBzp%~4paLJUM3Ee57zo~Dm6rJg>bc^b&Gt87%;%{GditM}O?;e@v4W`t0+;Hs2He2o4DAfbu@W`k}GkrhYim z?_@u2l;YRshhbL^>xZ@dHfhp=b`mpe=o@k+60c0VlCiK3l^rl5Ft`(%dd}{R{k`M+ zptw(YAFiwpEbfSDL9=^fXrFjZ8rsoAVurK53WHD`R2#%t!xeL`z^W@EdNTIrJ9sBm zB3))m)XE7Y-bN^-t4xK)0gLrbH^^fWp(;!vRi!KBtK|w+0~*^ak4V(FV+FddUf1pO z+2)H){f_8c+UIk~2Zww{`l8&o!WUJ(V|~%qUOCQ}S=%&gWrq=gi0@OZ@20ZD*bW%m zVP^-lb=cbh`#T)!fXw#F!9^$HfYv#%{sgH!roZed%u3v z!}=BULqWgBenKV-JpMF3D3RF1s+eSf61hiVzsfXFW!Kxx()N2&jWNwYgR#)SN~6ja zGF9N(8*$ft3?<0nq=%}eT}`vZW;seBj9=zdfedqkiHT-|iC{ZSx6Cl}P2`)UCb!PC zMp;6p3FN5p3a#cb6Q|8B7Is>DEg{ndZd)#e%n;~yBbFF@4V*Ae85oLiAO&ea6~+J! zm;o%tJ_wm1(CbDlG4}pP&Q{I&Nt8sIvBVH`fiD;#^-+dEl-wyXU#01)GL3~9h%pj1 zX|Hj@z$s%W5RMce4OPGxGypTO7(!+W1YL(a{vu?Sz}2}@mjm$^0*49Qcpn~qTF7jH zfDY(<1+KiB5f79jaQl5i<_di94=(=kFGR{zDP*3&9S`B@mxU}4=+py!uVRRbB7tv` zq@Xg11dv==E`=-;P!9=NE-*M)B1E27h&CnwbFdpoGE+?Co5dz7%~lh!w0+C6$}EiH z#kgD`g!FjHax87oW=PDH%@U{oeJ6`ew2<~8mU_C-$sXmoDvx885ut%t+O@4PRvAp5 zKwFpHNTQ`G)@cLwl>GGh&5z^U)s*wuiYMjD&wL&pZ!X>0BnlxTcmRN8}BT@p56?o=#ZgG&N zyI>WnnMab$Gfs_HLXH#2kmV8^ zs#tcd5xDLaCOz~P27iQNStS{L^(_p3m!U5c+U1fO{jLaEE70j0JpLq}{~D<>gEkzq zHMv`F^!ekO=ikB?zvaH>&$$0_?(XYUi42)9g&Z#sa1-uIlNcroHJ&DiNfeTPC{AT6 zAtwm9JD}5R_%Ko;hSW&O#E~s)C0D-oAs3M{hKvy;u-6GVAHn0#;Q5#F>W6~x?!Unw zc^uC?FXUtazxy%hMTV}v3wLWo8)_bH-=+^IMP8^tw?4QoOK%do^}(Q-r0DbD{I=C; zseQ76*~WYWi;eRJA`u59VJvu)QDf8_m~SkmcRCV?LlV8V2Z4Aq)#RPVE)`=S&MYv| z*niakv4|k z61yO?OMVwD>aw&8_IF9?irlVayP~1n!fx2nZFe_Rb#Lg7^WDRHprJ=&4~*+Ks~M&c_nJEoPDJrwtd9*2ONBZ zLwnEc;{mEQ@XAW90)6FmywN6cNR}#8sb!iNW5nqP6Jx|1NHFq%QfvgaBU;nrtpyHD z?cdm+JB=sFEXgXgQERu_*lQoPan>$yaOEaPfgAPxr)t(sjx7#sah!4@&Nb168LlQ5 zmb#9)n6<{e-y1dk>oseQdx9Gi+;hFK&MVRziQbvs$oHP5b+sWr)BRA@zecl$_=Nc& z%x9P{Dty=aVvBE^FAn*p`*E+!{SrE$ynmHuUGBHa53Brk`s1|!$N*Fa)CHg+U|RsQ z7IxU&5ykyU{u?S#*rB)siaSgU#KOQ+fe7gsP4=Gg9hvn=$KxFl+9{(m@;cXbMnmVw zE=cT>*#-Gs7IneWF8jNnvB$g~$nIaPFMMf(LTYfJGfs34zR+rN7w$KuYi?JJ?b^@{ z3%hOXhArK8bi?j$x!qCNy{bDJx}Wck@E+woaK2wie7r)1aaIp6*<^ zvD=nz$n9R(9pyb5dSG6UB|WhA%G`d4>z}O0w&3@q<||sS;MRwG9t`pT$9m#;&#)lG z1xWtW&i6xP|2TcsQNJg( z4mdaf5m&9f3a76M(;r>(MJ!CR9LGvDI8Mi25GFG8LHIue*m*Q&fAeAKV zP-BLHRmOUQH`u-V3mGNQZ4d@clUOA;Nt}}9q<%iDcn5mZD|kIbVu#wR@h$R%M44Ji z`lc;P$asM(AHi7_ZZQ1FllU}DqJr#mt=JD7!f|j-yeyMgs<-J$nl$(Wlu7>b!xZAk z>bcNZYVh9h^{-GOmr1OX8zk?`uDlQLea6sz@8PptQqqsrHTOM;?}8;FWtL>Ax5lV5 zP;X>I$P|HqUI_XWUsOtrB?Ie3(%CPP%cLMll`6+c)XS-oCDdf31Nqnn?89Lo&)i{R zk9p8Uj+Jj=q&3>YRC}f^WQIWJ+i>SSxNi`idXMozkK;Wu=VuE18bb0}ltL^o@L57@ zVoGQUFPAk66VyZ{7oxqZyfMLhqYt+GEUc@_}Mh0OK$jSb$^re>t8kUrh0x z>x&lOR$q9=GpRr3UNWfE0mvTEFaYb?hqsYFaDFPK{YPEOn>`?R07?c_55U#|I|tzC zfb#?RDgU=ew#$VhuK)bpl4zWbG{n|^7}meAKkD?Dw(3i4C1X{jl}5isw2cgVgy#pz zbWV3-o^yo@8~e5PF7aKE)FrD6Ms%6m4NJP6?1q|t%lmOpWBmSYPa8U5ONX`&INpK#tO!JP;KV>o z3C!t;;*S6J665I-o4cW{+x|zjgX+=kj?Kr6; zX8zYsPIk-hj#=Gj_rRhaN3Ou}D|Yq7!JbEZ;zZBJURcs=OE2u`wZ9j_gHnR9I4Hdj zO8bQOMSR}{eUZ?wM*n~*S8&s!o*310PERcExvD2N^}N_qW-sLT`lIf~^~R*$i+f{B z@1wmD*(a_KQu~#+_nCDC%5=xUJ(1f^=gxOr(s}3~b}s1QF6evqN(SO(xaDPFa{{&#=*Cuds2@>xdVsyeD{LqtA99jP$Mc z#lrq8`eW#TSpBZI$)O6P)KtaSYH%+gUxoxPWOyC)!V$0IUO4X+?ah_b{bu`Nw%=m1 z36Ui)TcF;5xWp!nW4a)|OHvnPbs5ox zS@XM(=#CNHXLV<6c8^6pu&d|6o;cd`L{BvKTG9(!dhO_i{k_72kP@^w2zh-<`yjk; zd|yGDfqQ>JxQvj9l}QrivPxpREKw*|m7Z;EBB@CZ7$*&!L82+BO+HP8mvSTOHCAC7SrzB1g^Edc-HU;P@YpB#qChfX zyqZS#rMa{l-=?rj<>|In#yA5tMmU%&9MM2DGE7!!gwZO#U)33mm6>BqEHKNwF~@s> zH=4bdc%#Ut+6N6jjXp^8EhLrj1Yb<_o#Bf`z7qm4GhkK#sym$RjOZ?PK{(xK{gvEP zKCM>4u4osQ2hQt=tsQrE#Ih@5dvfKxPRlwWnm*LcU3PUvXt&62Xza<&!}>DE0cWra znXciav)4501y>8Pa|~#QCQNU@ZBEcm{W>12O}10&%L_uqzPO zx419H_RYK!HCKAZde|N8h13fj{{aV+8vADIdpobMlI)L+9-Djcc$3?&$ykEguTW<+ zfw400Io=E`@NV|T67M1(H2S3ZVuJ5PGJ}&nJ5OK&P2sZwsyhgoFK~T?fjA?_5VBC< zqrc1m@W87SGMy4vvC$n9!JHySS(;7>03sOhL$;nd4Vu4x>Qe2+XTaZD~&LXH#|BgadW*qdy|^67nUQ+pJSt7HQsjdBCEMlcX& zrCZ3eYAnnpM~@X2+5bk0|DAr$!Z0=(juco$mesYYO<|8Zu7{CK!grc6(m=UEW~Pw> zQHUiMwIcAyYODzsCTNGU6_${r1R`1KF69Ta`cwZ7tR!!DPMH5_L+U7;Ci_EYrx;!2EXL zw93@#w$m!qVC7b}sxz>`PIY3mbG(yDRpthZbzJ3`K@KLvOyro09a!$z>%dvZc?ZIr zbKE$~lj#_N<&Iq!=tEox^QK95j6kD#$ixs=s*5|Tw|41X-+m9DPtXpdSSO1}&DTg1 z%Myi?#yNwT_d3oxaNZH-WNp|})e?`pNFOvw&ev+J>wopYwE{m! zku9}SvBGH#1LFlcyn%N=XMK?esuSoOERiioNmdkHbscVd9 zDx1{-CFCrDXFtNtc6hQnO2#x=KV}K6lNk!b$VYXonyiFu6qk%| zwm`T0@o=a_5?K^VXn)ft_es`mB35N7j3wE97M1{qNNF?NRpJuV?ui%h=BN1bKR4ZJ zU@x_w_xtwuKaAnBgmyzM68mUN6slqsveZ}uk*?wTBJE6Li0J|~lvd#u*(P})LodVf zNnBZiLl%xYBXuXEQ4MUwF5n=FOjMK8=|b&NaVZ;f93qYjEeq{6PHb@=b@GKO?Xfl% z+iPuXu@fA~c8qagykn9B4US9Mm}4t(=$3N?9)4F)@rW)y|BvksQ z-BNT5nr>Nf3pU)6a4Yg|oqQ`6-0G=hdJECRZugK5NK%5&5jfZmr1RT8M4P@X;uiOv(HBemdMcT|o9JQvJfv}Uqm4Zsq63i}*w_hq zea80Te)e=Y&;b#F(SaBqm>Yz$w z9yi(tY#jVOJ>NM>GZeG~Nv>iS&in1@!0pcah5Do1zt$g9{P+9gynl88MhAE*nchJ3 zH61*pk*;wrZdle1Y;^5)A=Br)ACohEvVAbcXRZ&LeS&?F=vz$c+*)5u@%3|kB8LS zDXTNeI!ATk)~%h6cfyIwNHtxux+Atvp8hpvbeY`+ZC#Fb!PzcVT`{fe@~+s{^->P5 z4DMRh^uhX>Iq`?mWzO?LcCW%w9~%?vdXEO+8lhz=j?PS0L|-$yZ>(6`o3_w-7z77m?-) zy#FEo{sZQlEv6uJv)Z8$OtBKXQDF)>PoVo3T--khPrfQ-lR!Xc+{W9d4YYIGBZZtV z@L{~f2HB_>iKnV9GJ(7cvJ`Svk-|t4Jm#xrCFBBufsdk?cAInTc{VoKS>8-7zl0Ry zjZ|+Bo$U&RjuICtU6<1D7>Gwd!B>$IIkH${l3XA$S~V!7b{*E0du&jtKsJhjR0>om zHY-i!Tg5iAyyyF1k>24G>p-T<_ASloFGWd+~A=epq?QHPbsXN15+v8cV7lvNgvJKkUDR zEjaKZTejZ_KWz5f=7$9TnE_Z4ur~mE+d0Ui?khyf9EoB%iAOrQGcUT6p zfnty~Y=J4cU}ZJltm)1J;kE)wwSitc|BvRS~ZgOE!EyaEyU2|f>#LM|2X>VhtB z#|{`S+YNy(wDfH2iTp|3XDsR=WQZU;VE;RD&qw%nsl0?R&_f6(*R5g$`%q@0 z&ZHekI2rGX4J4bFl04X26S=(Q2p3puF1CgCVz z?e_?l`?XiyD<89AV4W(WyEqKQn29EG%@Px(W}bzmR;zBuq><({^CD@UvBbb?+Kc63 zJLzO|DVFPm=I6>aRN2~2%Cl-M)LIiQ%(RwTf;{6UnUhT{G0&J7VrAG&noMq3XUrj% zkgCz=Mv-!Z=73m%0r%kH$B-g(BsaY0VLbK(UPz%& zwOWGxk|xXLx^gEu?TBz9 z!kOwso^ytF7i;vT0GBj@JKn?RKd|v)qMRx*i+0)vyU+gj%+7JI4hm(6*G%$0%s|d zqu3}nm~`(TeEKCrkA19*C-Ibqo_d1`PrblJxk27JnF6bg{)% zm28#RNrr?&GEO0bY-4N5ophaX$Y735q)FJL;ti}c)@f3KG0kAb-V9nXR;ow?$E~v# zlS0fe6J_KebHq%xFwAPDM@@kw*#h0J!S%P|))`tQ8EGUNNH&I(z97UzikYT0c@1(N zh1u6CPwAQnIQl!;%cl;SIeZZQxMzu-_()FyDo5?zJ zSYa6X8B8}88CXxdq;Qmw=jZ{7!kBDfj%a=fddJ0{HaZrQBXX+~JDq!-IPVP8SJ>#-?ZByjQ+Zeo)0)B~ z?LfUT-M}JanSl~CXoc5Kp6l`i4j{~Ab=DmNxp?day!Z|NN%M4pzymMg!(Eb{s2bHV zgMoVb<&GJ9fhaSBy!{(Y%rIkZt{ja&rbn4czh&+70ABi#8|`9m-2(F6J*6*}sOlA0 zC8{(MF+5maJFpi~Cf8?BaAJcwLt~l0!&t+1-Q9TpHGGjuE9Gd3dGe%0l1fordG}xO z*QfB>7YJ5KnvyDW$uFl^Vl=%@CuOi=&DnJ~;>K6nm#jGL2k=`IjnE5DXP~I87o>jZw(JFrbkfy%y6Zd<|>mh6=p+ z-x$(loMK!4NExYtF)9NXhDI>?JQ}rs$3$zU#gryq6NU5MA9U%~^RoEq9Q+Wwl z6e~IMCR*UO7x4b4`0-~9l@Z#Qt<}!lrj(}@Q)C(;14%2-e@3i{A?Q1A>cGdn3!hH zGm&PI_AicHzjl#t!!e0;4r7QD$dvS1#nCH&kkqm13d7Y7#qI&I!CYHH~%;mRVTIQcAo)o+>3% z#z>l_=4+P&Ce2qPwc|j*AYPplWh$uwGbJyTcfO0yA{4JYPm`BGmSDbN0#9d4p8ly> zw!k)-rlBAFAFohL{nMoG1tg{x9ZIZ@H1m>&R1~Uxf zNx4Me`O#9yQvJwA3OrdN*=LomR4(w>c*&Y@LPvYh3e8+8@M@71q}Qg}YJmmD8UtsI zFklz<0f)56I^0B+dCEk*6;4j}8*Ci3H#yMiIHWb$`zTI-b)V|K7~i+PFQ)cw>C2k! zUB4%tFwPq6fuj=*L|O3`>ibUZi?+TKuEgdm&s>R7{Z{tl<{|C~H}-Vj-yKK0pX-kB z9%p)>=!%n9U`WrTo+#`&wkIa`jOm5+UP(bH4Vn;yxk1Zb)umH9-@CFsyfBZ!GKM>8?$W>EIQZ z*t4N0k9tVYsGcbAS=AFmf}(;@6;u<1MVE|gSZ@^mc5uu3aMN&CybE*PC)_wqv03F_ zd%SSO>x>s-yi>eU=w0rO>E1KFvB-NmB^OxYgB`RjYwW$SH}>>C(i?ews`_AdpGAEz z;mT=OV&#<^uf&-vWBZ|~->7~UFR@l%BHRmEUZtcM+4cvQsQ2{l>A2L>v8T_Wm-HDW zw@B{1QO(sZyeZy=-Y6%3lREF|-k9mV$eS6eyz4a3%u$5?qXU>+95^-*hXQwWLVb7g zTdNj08hASJBG%MpPB(;iukX(63%e}qauGYzqv#4I$Mj0?#Xw`w+#oh<&`Uj5;8B`t z#_3nSMqn7oUA{)(jEq*8qJ}{bHm4nUff82KYWDF0i{%OJCd(hv1Wm6KcziIzR1$4` zIC^4(1N$BEPV98Gl9@A@p6D=dj3%RNz0Xu1Eb&?I&jydj2V;y%vHv&DND58LFmery zGXAGF%Z-gDwsRT{J;*F-yxaUYjW3KU#m=`;Z1Zg#bnrlV`l}OYb?M_S+U=e0$fTy}?x^aWRqv=w}=^CBkL1$`omeAv$CA3>#i8ac? zC^AkqPz?QQdzS-s?lw1DQ0Pu(3na>X@&v3^Y#;dXS2QV-!)6OKsM!j+23b>Q3tV{v zZg>*EhD%Jdhd5a21~)6uUL=?5d3pp*o&n9*=mHPAP@{`HQ}JSrHVd|ZV3t9w;KrJQ#O^!?_ zQ;%A~Hip>cHtS&Mrk4slLCsEjm#F0mjjj|pWQ19Q0Dc)(3d~Ro$$Ge7F}1`! z%8gO(8aEo;^T=8EfH#KtrTTH@Fp5$x_Mhc1Zs1|p4Y1GQe~ zbk!_U^BlFJY{c5}Hqz~UTgX;@t?dG1>D_Kp%N6#~4mra-Y6+sxqR`>hY9CPST<>Pm z8QSE=kb%39c9Iw9aYVX+MVTok*4Y$kw_V_dJ8|cWSnn?I;x1Czb#}!JB$!p5Zh0rh}k7DifrCfjim-c?Af|%snG)F*=J+{ zg&0TaBREWlKIz^1f_pr_*Ite86R1>G2KE_ACPtXWCT5u{Z9(*0!$W5*%#lnMH;RS# zKkI*yw9%37#s$(OXS$o~3LK*xDD$1-i)P;?zBudKq}z;gG&r!{yUZ6&{);u~O`3`J z32Y&Y+&-D7xPvP4!kuC4GZ;%UN0=x!XX&v_p)3YVe9!s{xnJML0fE2&h@mn{B86Kj=;8A*qj|%LQ zC&}@bf*OwL%Hy6F{DekN3FI3^hLEQPZn_8eyo?-cy~Suco4(IzzO(uVKj)GE&e5jf zjKmp9A<^eGPq4&$KME=q%Ow&k*;9#!&85lSgU z&PXJvM1{#J$3V3)hTNbJ07tRH#7=V;?PgjWh;o;^1vOZB30n&g-%byvKv)m|0g4fq zdSVZy@g^uFs>uomcrFW-$T6x7j4?JC+~*2&C*=g8jm%IzvM{Md-f)dZ(DR(D5Mi7L zBFqF6sTAB%M#|l#*N<2p% z5U~=uMxlX1ql6-lHBY?6uluB+ve8&=V2yEtwp?X7wipKt95#xQ}^Cb~<6Yjnb4}XMD zzr;^@fIgobwds)BgW7?UB>S zwo`~oa1W2Zh*v+xkG~*LLSf$&LC4(l)Cz?air$hD5|6xu_kPi$aETlvF;0?tXoSRjf5UfwSnQZ$&vz*&`%27%he%O=;)5@WPvTJB}7pwg4q7rr)XQf5*=ks}7L9(^G%f z(|GO$y!p1EzS9P^J&HMxt$K{HhCy=&p=HpXLD)a&*dT;IH1T1~c$hgBYmS(Q${xa) zhuR*($w%5A`=0JgCiUW;~1rDZ2W z;ymp{uq(rj!Z&ul!K^v187?%r*1NFNHPnq*cZ!?oXE`Nbi9~`|x)+9fReNLgi@7gx zT|Fhj*y?rE3q!nfC<(@BZ>DE@4fkT8%xAO@D#!R>^h<=Mt2?8 zmFc-%3c4^bq1)Q-Xu3ajAY)s*g>^?<_q^^H)qPHPEbhLtJJXY{sJ{YB?<>9^756vY z&!o{k$Mr;A&*ol8`O}&|F=)Q|E3Fp_dQItt#$F40F}=2DT~7w)1vLj@MbLrX zXzf300FzDz4eyPj-nG3kz4wORXzjhHH`A8}tq5XZ>(y;nBjoz(>rr=o;|)xjbknq( z(0tRfn;5$QOuK2(O;~o*ft%5IYmELNPTn;9W)$6Ado!lryy0fF-n{2#Zj*j{?(Imu zW9}U|e#e3z(fe^28*X#I2Dy=b_1?Y&GY z7})w3297*_;&DVjvG_^GHa;EtEGl0(@&aSg&s08x@z2bC2Fss0@C;5obN(5o2S3;N zJOiU&YJM4qU#oweu{AH9ehHy3r@f4Vm#4gp#+Mho%=BHa6u-tm(wkXtqV>%^Z{pya ziEkt2oi*<;J?pJWZ(-(JE8fE9x6ZzWu(xCNteEv?!JF9k=D|0aYwg=9?+A+f@VQ-3 zh#D1Tl8bU(jMBwuT~z3zQWsUasMf_8U5wSmI9=4}qE;8I@A z??WWwX^k5#$4NnzAtcu(82b#wU?1A;f2$uB(uU8KcxIm5&v za~lPWo;8K+fXCiMFsGIvkO+yKxu63k%DIy822VMZEyW!$S&_l00}iV(2G#FIq=`5) z%S54BXQF}kcY(O-8r=LTqG$(~LqgR~IYtQ?h)<&^O+pSOZ=o~|ftby2dq>>&sE{4m zfu$1;8$%#uC&WrJ6n8=#=OFHcNYW84S78QKHmK!F$gbpm-iMsUyQ0qxxM?sx{vQ7b zmI$N0P@XKIy;OxnEjyI!)Cno{tU?4Rb9AUcR~?>x??55L1Uh#|&~*$2_2uH3m)Vzz zm?H!NIIwxw>$X-cOcXFIK{`TGcCOIGRRW!R3b|VMvRT0CC8(h0 zTQqU2?q!>R_Z5N)s%sUv=K)qK1zf{L$1Z|ZNgY`)Lv{NFYUL4$W_7?|g-o^@t1y-{ zS<~5x@Ble>Wg9qT)C1Eo2ds&C?HkP2RmJvrVQi!zN%WPSHG) zY$C(VHc?|n=g*TVpjIp;)xD^v`opvkc-oEg5gxnQz7xvt9@E#nw=j1&I{&U!$5qxjh zy@wc=G&zgqh$8eVOD70It$$HZ|Bd1|F!#-c zZ=(6l6>nnX;EKVh9$Y&ZYu?-V9(KLA?>!v);P?kP{?VC_u<+xhA7k++%Rj-qPZxcP zvM(yXz?d(_e}Tv^e2?iZ{;mFKd^O=U##RNk1Y+Uyd!EO^=Z`&) z;1^O}WO`Wl=}S{s31V=pNhyNAJtJ9|iaCx*v^yDc1C5 zJz9Do?cSOIzd%60dr^Py)O#`e-Zl3ze^|fReu%h!@AWu;{o)&#H1V1Z*I>&vJFdb0 zYr?K$Qr=xN?!uhA7T<-IyAI#Yq+|DI4@AMhl7Xlk*!UMFjeM~AL9Bjo*k3W{uf>B9 z_E7XgNPcM8LtL5mY{+v+eQwipjGcXR_ggso*4(!l8~4u2cd+iAmUpo8ozw3MnJD4a zALP!c=N8&HcUj(5NC~rF`-*mPZJUjDS~g{J=al~`7-O1R3jao-3jFz`WI0I!ZG zHAFE5#SEpKwG%6toLZT?i&MAouMHyh72yUm)I-7|?a`2c6LdJQ@g;)XPn z7IBo=qiiZi*;BY2eW9GhIOPNs(i>gwrvF{sm4E++{_j#l4MZ6k z2C~>cF#u)c*)t#8ft@%>POwQPF@{><7L{8Z+Z`x!mO8Q6xy*^Zt|T{7C`)>YdxD!5 zz$WmUVHyW!! zc!e?1z+}!?7Kq74gF$Qb&G+M}ck$s*2$o3_nQ|EEJr+uAmRlt)%-7zAyQ8I$opJpw z0yZc7Q&$wY~na;ieJT1Lq|jw+m{B#5y_ zyn%d*WgKNx8W=}bmu6B29x|eUG8_d$Xir{5rjtf!%y(tDQBJuj7r0Njk?xh|jd9+^KB)0&@xfl7 zXkX;`=KEqS**>=Wp72G2U$Gw={F?mG>euFnvwp$;$oH@E#~lBo{y60y8h{u|vD*;P z8h}FqCj$`Cp|%4ic9_`#^L1W;%0Mg(Tpx&*z=V!S?U>$?9?MK?o`o^?PMeT?b=fls zHpq3hJFdNfDj#_b?|;s~(|GnZ0)8GsDyE^5-~`f#=F?8(bjR>cMB&^b`pxZ*268c7 zrpQB+kVb_$EG=|Lh!JZb-bgX1%@m{Az*1hjyCcyoA~R6ANi~P92=a1?=W(XH%3K)b zs&-LLhP#~Nn8&yYIpI$CqH?HLj2Gg(G?L~$&YOq@-XpzH?m?n`b9|BSTkK0UZGLC{ z5bPi3Pe@U~C`wh_5P)MHPxC{n46F@AZQ#N{tPgAn6tWjO2jS|QgzST$t8v{^cr%5< zbVpLy`g+PsHbfzcy%hVRLl<;^39o$6KK0I~4`GPFX$nY8A;EdO+Nn@ZI@5W^b^~q3 zao{A*fwS#5X!?8u%XQ@uO@HTouHJ66kp)Je|CbmdSLlqspA$S)vb*42f94{ObF795 z{GD^dB#}z6T(a0XN-mNtcy_%KH~$&;zkzg~j>84Ukizen4AV(-a%j4mKp*=&3PjE^ zY7Ie>>QNc25JnPUl0h-m5oDPUH4tXdAtI3iKmAh&s3y~vV>E3{>q&&%VC*v3TmOhW zE)l7c71GpFg(a+_j1+kA1FjA>W*TVZxglC0=n*{rKF-M)oon{vFVINp^&RpIS#t!w z{0aZ4rTjsS8vo%^JVs!sDx{o3OAPimJZq=B7)Y{~X;=F{-Oc#pFLRM)jxrgjWq~nH z;L85E@eV}GR!U8COsD)=WUM!Ez^F1Yg?#uH&=CbS)(H!Fb_1n-*+}W)V<@F;A?0M9 z;6RwO+$qR|@5uk7R>5|jjR_nY94|2JGOWQ~U}K{lfHqdC!H<`5CI82!z&lnVHs7dUB-iRm@@igU);F8GZNraUPgX2f6Ha9?*9ePrKyNW|fJf<_VKW9YaD= zoFmVH6^?BV>~QRN;DF<_1Lqv0oTzq=b7He|yKbIFk(?QhVGguh;63O#rk^Oa`No_!9nWKheY2RTnJlh`f~Nt}`A zB|>OhSgpp;(tKWFC~L^m#6@5|n*q}Vj#@dkAYcQ1UXl9qDyD;G>K#nK?O~i}C+IYR zho8lBu@bqYVVg;w;bG2XCv#Da{+%z7=yy&NNR~OYrJqTL&g~RWb4KDkx&8z@DI`CQ zT$rlKpw+B!%n_`+8*NN5kYg5_-1!7!IvK)N(r*_H#9<^b3S)paewt~bonyI&;{sj( zx@iK_Fy9j+$6AjTN2|WO`6LLh#2VTx9|B@%vpkFKXK6xLu4=F3p)4i-9jwGj6WEF! znw(DQ;vJnd`CCAc@cBE%EDRzu>V7`L{%rt>b_Ewv-eff0c zqGNY1dJo{@hMNV&wD|Po;+k7<>k}NhvVb1Q8Y4u9wX~T>OdK~eEUtU}O)lR16u~6! zm6ED*9HlUwNck<+SQKTIB`%Vf`+}r_<&u1}vjoB^%srOgqvh5bOUPjYLH%*hy?Amo zWnEY$nbiLt-1{UeRy>uj;;r=(Llq?=9WL7Ia|A7nFTRYAmPu@tlMF02$m2OjVBm{* z`6CWL`SBM-(7L({`+$Qu4xGYF6Z6dNCf6sC1)YQO%gCFe5xaCCOA67;NatH6cS|g3 zr+@hkzWJV8{t_WMIK@8@SN{n&pO>gHC@)-|Akwoh;lrsCbJ|JgWhmL1*OEw4V+iuk z7K6AL^f8(^^FqGB$K(%_FOb4=LV! z5}gmK1`Ca(COKd=I&j8O%+eX+-PpDzyjp7F(b-!wne`%U-5JijG=*zUK}4# zm&+u<^VAZ0BF8BuezJizowhSeo9mDZ)4b+*q1d~^8^Lr6QL#_G52pI;@xck7vp$IS zE%C)F-*vv&=X=l>XME55Vzpn39}@hN{gKcqwG;I}mHp3wG{1U3O!u2dDVtXNp~Y{z zA9nhM_#>=SG+(jMZ@eEhSQs$81EzME*+EDXSKo}=_DCFMA4(ISk0dyfq#*K}GV%F$ z`1Nv{g`T$yY2m(?=>N;#k{)1igMm_$^1|C_Fb+`=Rk}$PK{sQHNz;V`0YSKvq)9h= zU5S2oMJI5h=VXZtaX{(*C#wprNUvo3nex4)I29ia*@zm#tK^v%Y z3u|G$QEJRFXp?>8EqJh8qJ~mKW>S8?e6`%bI%9)@RwITE|6#qxS$&XIhb|nke>{2)k0d(_TzVVY~b7h1i}crmGx*2XsH87JahDJ~3iF~SzEkXy;y$l@HRg98$*LXX#W_yw*%2X(NEsx3KWwvC0LQy4lv+de2`8Fg^MM< z1pb|nLaK%qPOW01-z#`MOnN-yEOfdKe|ij0{elWvC+Syx_alUo7gvNN9|9YJoe=aI z-h3D7yp^}N){(hE$JR1qq0^J{oJ zg0hj(_GhR-k85$u5XmYJ{vn1))^Dtnyo-A7HM|ibF`R^kLb+a|RZdozOJSL-RhfxO zbGwPd<_QyL*#|64-~jESBFS-Sn2|?o$|?ivjm-vjk)i4kNeuby&=o1r<3`+`sF10S z>Mhf5YMV{+?CyC2vmWQ44c7%Sry2Q=UP z5FY+FRpdb8VXl>!Dwj*Fky|NllssCa1fG5e?|;X=3?XA%g(L^2Xv*%CDY1}K6-86H z)L4lY8Lb3iW63EgMo~VZ7=a#l;?Ac9L0|rWA1EXyM(EUdrEEos69}MfT%5pPKEhWe z_ zs8=%-=BpesC9O5FgM{aUX1c}Opv@%h9Uz@hh!J66Ds8~$lU`yq9g(q(_DAtZfljB| zAJ_5E5~K0$v|%o$Lj~p$UpPE;&(E?*VKv3n<{O@!%iS;F=YJxE-lQ^mP7@>rGNuaL z|2UrbcXgMtPokLT9TErSG0CF#3m@W>pBW0L-S${HLC1UzCHJR!{I;eEq|)|fJ^v_a z0+r;46r(6}db&Wstt_ae3w-t+zN3#nU7&zW)aCr}_52$BXEgjd?Oy(mWXzlNTB8I5$V+j@CeYbx3a8<;SZ6AASFoz$H=i;9-Mx69GN&Xuj5F z6!4=;rg^&1Ko*BzC)3V?o^!Im6tz=vo0F?2Q3=gsTmF%rwyK5qG{43T6CL4-t6ULpvi;*-rcN4`|=~fFFa&QC?u8 znxe2=ZB*E-b}Q^rmHMRIlj^KOtl`0y&_mv4P*TDn0tbzw28MEq!VrOgPAn39{WJa< zED_?4QcaOqM~nPU8KQWOyBxdfS|(om5FUDrp(kF% zORqBY>Rb5gXGF;~-RaN2B8@jnp@OYn%rix~Y-X6>;`B=`V zlba-V%P@r^HA10UP1hmhe?W>gnhc&+^RNL7Tz?xEw>`s_xuF6ty^X=|G412eu>o6v zHXPEtpMQ;b`Y}t`pJpf>zcHN5C?qKk708h#S|r*;OA!fc+)WsXXIjh~N-sze>BFk^ z5T}!3jMi7?oTrv*@;bFiVIMh3M;NiXjx)yVmvE>+tJUk^sFUX;KHRYn#=4>s^ktXFFd?&=Wj>&uL0ja_*a6H`gZ&E&ZuM&O}`@%)Q; z^CNu!3oo6XqGxZ<*Bv9!`_K6EK(2h?Aw2vTLr*`CSKnml#aFrb=zA_m^d81DdkneT zOq2*ylpZ2RU?SOrmr05diV>Jb=NrtGOGryj-g_|uZ8B5|%6o9xm|_KwDOS*!(&cc; zES@pNiuN(ZiuN(Z3LaCe;4#Gt9@B7suVV$qli(SlNT`n$m_#$0>c>@N$)6Aj2r75T_jmOFO^g2-EZjp5*HH zKjGqw@45K?XD;}i8mAf*X0Q)gyg&+B;71$e(v~3b&b#>GCw9}v2(pVc$s8I1xiTiu za(yXw+r2Di-TMk&d7Ys*-@&^d@Z)Cm3%$P^Mtd=mvYGhPFP=9r!ShH?(4u&N#hnB? zn~Y*t5@>!}pt!+ewOV0=+M=lts;HumBo{|I#*@-hrpqj;-WPxx0iFlbv?jggZ ze%l&k6NNjikvJ@~75~s^RL!(p?5C{(O=8J(@%9F*F7WQt9BEpBBtsS}t{q38 zz&ctPNLJL_nlKfoD_bdD73b$Yz~_vn2)%2G<9L)5fibFv#K1L|JgnX7fD*Kw{#OLO zO2g@b#pK>pE5V1bucV9d(vU*YjniqD*-A%GWzddcy|LFoEaE61&wOA7nKzH)EHH#p zBBhxn+O#&}@;)zicldwqDOdMYK?D0gx4P}me2@1IUNYbi7z`#QA(jyffysj08MsGUS-e$JE;O3)E9>|FgX&jB)?Ivhg7m!H3MfcL_dpW ztk6uWK}Y7K3M6riOPavTuj1{mInqCkrkY~%I+-QskQp|K48#rOU9v)9D>`NQ*U8FB%NV)p-Wo4+lLhU--fif zeIOBJw3_fAhkt?hkM8Y4WeOGoYp@>JOmh4QgqVmj<0;!(m5D~HN!#|yFK1(pJhPBe z8eYn_nB4f;;VhOC!z9x|DkH2q3sbE|-O-x=%He5LsrdtL;=SkBzj6^yGI$d2h|*{+ zC?@ZX1~R*DqGVs`in+#-DR7Qltkqc!B=~G%`7w>Mfsh#{jr>k#Y3^CPhNcOuP#b7H z+o~{{x8i96dlb1prU{(pH9SpcW#Ws}8*4PM5Nqf(x)g24U60Mc7FHvr3G655h7dDK z*X=h?YarB$v=C{<>RXH_@BTC^Q)8J{wg$4T5tg8HIR6s+18b&(g zVo71%nF6PsVJ^hEGF+&3CA*Q~9_~iIyUdM+?&WT*b8m5D7x`EmcTe{c)S&qf*jn6M z+*~>6J1$n!_Wp?EJa-8s=@b~4Xp99WqLs1??Ey~FOOs6J!B3^|=3t$qqs_uT%B--` z-eO}H9k_hl9_PSD%8Gx)anykjI(j*gyaq=(cj?TCoAkwKlFt-4CrOgc6j-Cv>_zK@ zhdFu(JB{CT&BJXbdW*fqW-J=N8R&Vm4|J7@wU>-`lZ9=1$mc2RW0d`$2U?;#ZUJ9r z7d?fumvzqc0{tX@-}i3EUOn7~-&bc=vkTnnP?A{#|EC1J=E*u%L4G6goP zT?)GtCF95xNHEAdE>jDS+*5&3M#;0t0V`9W%&0I>YfRL2W7%&vQ=pYi$M`?&Dy7dE%q)tEBlbXu|xK8 z4Xkl&bRf!^sPAyEYh#(xP={~GgomD(sAXG(AUWzo` zPk|b#Fp@P)!v(5Ut>WCI<0#_1kxXK1SUAb1q&0`=nUK;UTOfn1Z(}HuZ89nFH&QZ& zvvg=_7Mg&?SPC3Qgo$X%^OC_4+}Wa?ce`;3@3~9Z$Zs%P{1J&1JlUk~i}Y+Ek|e3W zvuX2^P0r#~k_Vng;z*sGrm^Xg)VkRMv*ZFzDWUCZt)jfX*#af1jCQb;4ubBGj+WX> zIZzvnMgvX8a)bLktD?x4l9Ykjl;tPG;O!l6=&+nuzifeVba?9&_QIxP!AN6$z&L3j z6sh2DP8w$oq=NL<*#hT{P)%;)LmaaOmg2CcM3~VebYabImg*hSIWIW=*g# zna;OaWF4_^!iuD0-lp1^PUr3|vX|Rvp~dQ)ecnd0Bb7p-Q=B>-V3Bi|6X%@;E>1Pe zgDOPj{}9g5RFV$gnM&TSO2g1l4x5qeW;533w9$K7{NUB9jkCQ`dR=R=F#yErPYWaMN9DzE6 z@@LUoK%dZdV~>HwSWcc($ACCqopJ;sDI#V+uX_aYU0v`{aBhX|m(v%|>CF-W3 z*eNzrINxKAz*Kv>jV61M{xRC@Q#Q`qaSo(93LM~dY9bx~IF0m5 zbI6jtkWxjgrDWH;^k#>9ok|?@FRx58@^s||fTp8df%_iCQ_pgy=AUIBxe!NrF^F2 zNY6^KqPYSSDdJ$7qTJBA0&~=SQctg-Lu9uo9tG)u8Q8_bdM^3R(z}#PGcbjTRcI7lg41Qr`xG{C+>6I31LNt#LzZl=O)y53^7gcKwj6}Ho)8D&h+ z4Q3F>Zz|Ia%Bz|uE&}xQ^7PYtj=l7rdx?vG#mP&x_j#9T@ACvk$WpSPOw_J@lX;fU zBZV&cQs#JJrOMW?Ul z3G7u-`mQFmKeTzqLhT(mk2IpIB`Klu1qx^xnM_ZpnH>B!sx2gl?k2~!BsxcS1}zgS z4Xh>m=}uCR95fCaI8ELv36uqSBx*g|h&F_qh%r-4WYX7IWmZ%2e@756Aahw-M!fugdf5Q~o@R!l6IgS)T{9qgD%h^g>k6IR~^92@? z!f_?NE84u2FR+Xb|J|Y}3tqlpWgYjrPo30263LEP{MF?PP_qOy0j6 zIj?)Zz)CV7uQN7kuDvv|9%qAazQAG54xcX&jRf#jh9Or2xtvltUm%>0GH5Zk>3d5t zGfhugoqU0jw5_i;>vY{hbEAoqoVBW;{Tq7mHIx|TBo0h4Fo}hR0)Z*)QBm;UXP_;# zD3H5f0lk~kF3e0@6k?1lorC-WKwnOQ{&Job1kt=xKq;5mdo-Oic69V&0ePQ{pwJrf zFDeiyC6h8KJ-O91{$dIQX0Ufk!DSOqLHop0aM{FDaM{FDaLL5OUFtcfKwyhHrzz#E z0xuwcZE`6nY=2%ay^b*?vDA@}HP4`UmO_E~23d{@#ebc1b|{3hCcRKxHr?z{NH7Ww zPM&-LpyySnpVxC-Lo-d`@1IxUWzVbdvgcLUKEu!j`FRyyHq{gg&s0+=E}d!$>F1oG zJW~zbVf$3W1JScgp}-DB2kI3H&oW;q&}hsvge)S#ezn9po@I*uznNv)FZ=(WS*A$* zhgqhGEauq~(y6*d zGDVloGDW16JxESRvXn>kDxUEB%O>97-@_*FwIzK zU?Bw#tz$Q*5#pjB6nEZc>@#qLlNgQ=IA9#nk$H@X>qBcnCljEr^y$X!;xjh0$q9tN{N0zk`z-Sa6p|ByqZ*a3ZJDmU=(PWm11d`=}-Lbimhn*ZwS`O-tl z){!BHQw$I}tCR?okbh*AoGh7Pw5*b7zJInC`s6y~om)D2bFm`stPkWKn*}k+kP+Fq#aU zHzM?aNAQnWB9Mf1P03>Eqg3F4%u|8@I=B>Rw0R#+sW$TIAf-y$In)^o=){&b1N)8R zlvzKAQo|MlvvC&OlpA<>=lqU$31`PC6&C?|ex>4f&#&~d=T|B&eSW3w&yV`y=T|D) zBP3QSv>E#ioH4@ncs8rO3daqKWh*5y^)xMsNd}TA#jf_BEhQDraB@`1H;{r%-LRM< zv}-6sF~<|dfLwA*X?s9XFQo!GDD-fGk|B%~I)P#hOTr^b`H@84dSxW&Or=9sRvFl6 zv>4cDL;-VYGrAo+fjx9CiYK5kicW#eGcnq1ps8gisUNZ|6zRkMYb-R74q~;{YN5@V zXk(f^hw>hkIxyEUkHYC%Ng+Cvjx!qT#BAqWCl)w2JNca4C>qcI>&qVazh0JaFGt_h zqzg9{>$$1*myMmrxkhf3h)}5tN#uK(Ym|~ov%)|%{TL?@Y@*d_vzWJzzEL`Whq0-~ zbOWncwjC+h>ygP@*@u9B5&GPdXky<<%IH&+B`M3w)m>F$BCyvyWOAE{m(DNKfPDj^3Y z5HeJt`_;I5AbGb%6D#ZVuy3N3tL=eZdAG_xv|`x?=6Te)san4cc}xbH17l_7CTot zvEA#K7t*|kX|^5C{Z1Tkop2%8o$1B~_i8V0K7m%0UB)32a8hXujda;cNxb0>@Rp_P9=EAK++G>V{KBn-Gf`k2><53~X}laALV@ zi;J-`cO@Nrx!f(tE9$!}I^AlSL>R{e#8M{cM1>TUrjVm3@pY^~(06tc!ej?+34rHJ>~2I|axCW5U{3sF{_g)+OsrfMc%M%hQ%k>adci>f`y zSVkHwI>g36gVnnR9=p&o#(_jSHEo+? z&mT39BMGO;*hMEkw)YWi{@?m&pmltvb1skPJvzq7LKZtNTZrNB*+Q(RoMWWs5(nDklOz&SZkZXP#LW3@VP$Z?8}XCLdNXt`DLoJ2S!ovBj)3;){xiR+JUb&_a>974#?p&trRO%qYgwl_#287 zpZ~BxgX{Brs_Vdj*CF9HQ?jg0=PyJMu!VL&r1?P#eX1m& zBa0S{1`@Y6dJXr+a_^NiA-8yQt1@a;WQ-!!=PoVL|K|o-bYkisbd*myEe=`nHcISD z8x8hh8^O+ECnmU0xl!Xa-ixod<=@aLkHc?R*OCKeE1mvO>^q-MvsmQEU7RGtWfT_`&PvQNK@IAS7MhQIiK0f*e-+a#!PsgrYTyp~#H{8aD zoyG~K#|fs#iFSItzypKu+)H@-Q$a|lu3S*MyLf>=-OAXY=kU_o_=Q3e;{{8W@dA%O z!*!p2%kIlQ{s`!Tp8w+buUqfu;+&8 zhZkPqYPT;JAAF5(e`e^1pV>V%;A&iZD{dc%2Oh_hFKJRIE@PP)JZTVoHTyt-cmz8WZGt^T<>9Dp(?(Q?6!;%aLf(*JqN~-Y9vVA{8hqAd>=r zi{)=forAc$`ySvTn%rXYDHqr|<1`Rz#%tfBMs-r*v^uBVnU6`k=7%}HXSl#i6k(Sw(4!Y+1-XtkWjO+Uug6~=#FJ0s)xr4mGxAvprl{R$5?l8x z%Hy6R(4!B=C^`fpN8tLu;K3*H^s6Kre)c`veXqZXi=XL7%Ml2d(UJ+1D5j%;p*?u`T9Q9elWN%x#yp6@r+AG7_>`6DhM zCji9(X9Ez{A*>VjbxG}p{BE1NVN19C?%314tOv&Q*w_PSdqnj_T+fD{$mq4P7xwik z4?2fNxnAKxhz}~i1R-BHZ4KgahWlT zj!Jq=Y4qqD^>az>fX1%BfAp6=mtj{RB`9BC;bQx+4*$97njSdYBkd2Hp1I_L`?}#^ zxBTun(>;rRh~Kr!(J#l?uKXNZF2mM$-qsoWJD=~2j4nA{nBn+k*a}CCK8AUPW3z+n zi^wOll(Vtr38c9yTsY`D<3h7L--{X2TsefTa5HwmebkMk?vol@y*X{yqmqT)O)37TGkFk`6T%u-RF=Gj`^hc zVz_UCFU|&pb-<=>Te=~kcd`DkQhbN|qQE!b4^#bT`{P7Vf~KGI9}>V<9TE_yfw)eY zotTo@DPIE_YPbAuDC;q%2iNC!-_so%dz{r+RL{7c z*w|}(FRp9onb8a7K~4I-SlM%3Pc~8a=ug=>pLiCN!(fsqFooFR+2upHLN}*>xOh zzQ9p=O5(IUFZoJ|igL{s@MKM4Y=YoNpW@=F=RkpY1p*)aoe3Z7;)j1QMs^$_3kCWP zq`^G(G+z1?t!(Ho6!?2QMIq)=1VMwu5}qv!1!l|jlr!Tj;J$oSxbtV`4Y?JN{JRqz_MHJC7r=3N~jvH zkg5~g6)KEU6$<0Yn`SyK;ET!bQDW57i82B`25`6czK#WKc`6pT_b*I(_z5olF-)S~ zSfIIChAF1ykixEuDd3SaD=n8gJZB5JobII~m`Oc^bd^Qt(-2#|f4rF0fW z9T%!m3KeR+LLG<177H};Nx=-vQ*4yE?Q<@C0uazqkdjxg_&1U;TPCoPxAg3`P$uwA zFr~~KLy8cJ_bL;(;$=S2_vLrF2&Uaw7P|?Qk#3W+qLv9nOOhYT1jg`|w2T~W*Gq1Z zLSvl5Sy0OaQdEXwGL2u*5yAB1j1su|cHDWdpu>T0xr2*`pXA~ZUHm{QjS7JusjL*Z za}YlG9>37#EA=l?DKO{*&udEXqk@X3U*O{VU%1eLos|M>$;EFdkA*RMdnyGd@Zl4Q zpLiMXL}~Eufq3~1Cek}xB{1j-KIrwXL3rwUh6X)~N1xy`UnxbzIC}8~6+Qu6kX5io zu&7@v;NvH#=-6A(`L2I`M9`_O#91eB@BR2CRU%K4>sg(^m%pHr9Cmio?z$)MJ;0GP~Yp?oYl(8GS)@luTtI*||5#KWaUdG6HfJn+A60_zloe$@*sBLA>b z&J}(U8wY+$lu(pUq6Et zy8*Y{=|T9sS-9E_DSK}dQsM8D6z20uB?^D%=+ioRfpCO28DnVQG25PR6T64fKn@cp z3=i4B75#AaJ-B}`KA$N`r>gOR9^6Fd-spV|uKN|o6=|1DPdJ%Qy7g1u)v#26WL{$GNLO!A5j zvld%eOmKb_htRN%24618fQ*68h!`zS~?PbZ}Cd4Y8=FMX_w zce&U}(`hlM*$WrAIfasqha0SGNn!I+xWEJkA_RKei}l7jo%H9XOW;r=lBS&svYk>G zWrV={KjE09R8bL>Glv$WNI@B5UZT92A(GEl!BiQhkVNlFJ}ueR>cDsIwX@Y_zvhNZCOf<&G5&lsjvj+y^_01RG%ndzGQy$TJb< zm#HsMOE%|;Myqj=G}^4EgFgkPnXGZEBdh!Y3kQ6|ben1B3==cywZ1?)O39i}S{rR_ zwRh1$`ehDm@IBzm1K`S2RWu_ zu?Fp~zYCctFj`g7TC+f5fiV<_w9{;?a_w|+nk+G!6LusE^mrQ| z{)!Mu_mM16A=4FdR4rw0ql5*i0zLW(Dz50qYO|+5!gs%bqP#O`lAlGsR*PgEB?maF z5Nagb7-pZa5$1??Ac4{Z=eb6@Fxj=(g%Wp-8#CN<+}zVlGy~gEOm4H&bYN$lTCdPT zGwotm2~B!SHEXdW&xMh$$u1!?1p=R=GtqDYaogxjGy-afaP`jaEeg@WTXt4W+XfCP_5XH>*`S!vyxy{B&Gq($k%! zu#l%BN_=}aUVjts{R;(hgv3ZmTdLs#*W84g|G4J8zu_Oh<-Yp~JpDQcbN#D;BJW4) zu%&=M~!HY@yE=sh8_%0-=D%98TN#@;DN;M;ItKrWx()dhxSt*dQhEUHIe| z&id228-iZNH$Ng(jZ{4826RNH$MD71IK~O?!UP6?fv@?jkwO{=oz)dC5KCIO#c~~` zpI)jE&e`h2=}{L+@KMa$FQW(aCX??A@A2&2AQzK6D|vB52>g;uDHVCdl!YZi;Fdel zDs!}hMJ{zXj^+PIfybUkmUYl#rTWLkl<0CY-T4UviJ&hyQlO9=1hdtj!4p+0Id4(Ye=Hygvy#4@ z6*Rt3bC`*0YmCKgM@W#3qzJs_^cC%;NP-;lR6AkE=#H2pN|maMq@6}3Fv_a7FvePL zVU3kzV=+fRMGH+IOY{q*W~=}<;2bc_9A%-^K4J64nchP53#1&o!bXKXmP|&AZJt`Y z-HZoEDoi0kyNRBBC@nY%Mv{SidKeQ(E?j6VrVO3Kfdyu!g-B)s#VbJVoJMAT>HxJFwcZ z!GZ1UM-?m3=M{YO9e#+=IfHJz8-IRHk z4ZXP|NK&dcYfYTB6E#1DfFO}LE|55l=>d~BlU26ob&nOAe$Y&9|0rSws_aG^jdqib zW&BBzJ?>82`zk*BLTAGbmxv*|&Up5ZjT3nFGkozA%LxJh#1K+;6q4a;zNFkD@tonO z?+K^%67XLCF%s2hp@NCC~xSv^h@{_$Im? zNfP+vD-5Ayp~!Cx%W1k!h0wOpK#l&2DlqJZpwnh@cl`jy2!HSu4awxm{zU(oy9=rdPQaxB6*_ z#3Tv^o25d4a<3_x%%nz2F>--aNe<{Gj!Flr9BUoe;+WvXUU!)0XL>c!FOZg+yG`un zBN~zfrdf07+dfJ@73DT+>=FmUyfSrbu3SKs7f5TIo1NI}oa92IYb<4=-s$G?GJT(O zm}`|&IYmTa}K?1!KnbV1-ka*IA+RZnoUYGHm(KG)KefZ;2}IyrUWTUzh0%? z!(Vs>uYM|Isla(fPWGh&KMavfXyg1&rNWcHx=i4Wcd&wd*vnj-T&&Yu=3M8*4rhuB zxvnxz`rDWI@}Ky1sAPr(a;XLuwgcNqUz?+f4U9DAlXo(upDQER{+R|hIbno>fs^gP zSZvXhT=rus6Ub`^;_1aXZq?e{Vj=~v&af9;g3WBl!ksZrBss@BnUk^Pc5IzJMv=L3oWdkNoU20Ms+(A;dDWk| zpp3N@0&fgvESgipR0zZ{P$|&o8bJ!jUISRo7$V~&l4XiS3#H0BMDF*KC@ArSQ4Hn) zk3ew0C`L6YJqCh0^>m^VO9%F#Y{b@IcPD_z^-Q1 z0&~ojCO2y{<17XaS!XqHxE+YG8*Hv>(9`!^jm_s%II0EOY%=#(3+!f~M&PK|DK7+j zPxlst#gqE}2r0LQlBab#)&i}Z^KIPAa?$GP8yPWZqw6lW5`3aIW(Pfum*=m|%a+OhIV6t(@V0CiG9=M`UJJeG{eXnD}mDdS5 zNuWblJ`ZJzzyog~nv#+%m1{`)4_AVy@BEXCUrCKWg>>0VCDurCYMUYuq3F#0sRB1X z3Z33}Dy2x?DOn}jtq*S8B+<-+nI>>du2x*JL(!254SLdR(34(+z=O}Q*7UEsc=j#E zp3}wKf5VSIGvV#OaZxI3Bm*NEm?20l9>O`?W(r*QCqcz$Uy_2A!Ay!I$YTxPEb{e1 zx4Q*FK?87=hOQjIpZP3-TQs4FEPkb|+n+_-L7E^M1)9lQnihOP*m_Pc*+_RsImc!T zJpT$_9W3NrfzEdbIZxpJP!c@&mpmYGiVc4A1VUv}`_I`#yCFJIauGegnFdyC8FDOe z9BJgzea=L_RYcJnkv2BiEjD6Z4DgI^%_k%etFMQ++H6bz^Z5NHa%K#Pksp z8Fn6>Beu>)q$AORGWHz+lvJf zSg*5~(jt=k&|-n%oTOy2K%14Sn=Ceh!HpW#QN=(#r<_P{&gj^!fHH_l%naBS zQYA0q-!igC@v+Nye$7SKE4b)$gD$QH`Ms?W`0`t1uzh0%Su82sf2F`xH{hl}W8fe( z%T=UC*euaTR?dTTs>2x>Me3Lmg>uq()zOx8rkba)Qmvs_{5_;(I;jw4#2HBC98fC- z^~Yk>|E0}C5984%1hw`Q4?l`0o@K%#7a$LTeB)LMy!Z-Nzx6iWd5K>q8(S~%1le+^{6)wO0wE;F9dk50k?zWLq13D1i|LuJ4KAd6m1=CR z+Np4uRB=;KZKBpZWunxv(t-8vBW~uOtD5Nuj~4p+;tixwDB~15x+jDZE%3R-7h7#} z@6oM}TNG-vK_JGSNHKvsDU8QM8uU4LTtT*^R!5tIu@lBfpaN6C*j$P!++ZEI7;ARY ziIp1!Hn>uC_YLl5w~!kJuDegjO#Id3>H*;PMJ$K z3;Y-&5ynXwHVgdB$T*4dtnS?+5ZDU?9uNd|>d_8aUQ8f)eyhOKF%nB@Vk9pX?4;yp z!$|d0!W+e{v=10AF`6W#RpeYlt}TM-hvhIOk`xe$2}?+#46?p8r3 z-8Yktj)NJuQzTk6eSvG}$(&YUKn6w4Rw2biKAn6y&P*m3?o!f5Znv<{I!#KpYMXoV zbh4W!r&AIss*H9v3+P+krT!mwcYu}xj%?jUFWC{&40^`26WIG72UcR!QP!=rm~NE1 zlT(*8*luF??{A0i4aBH&U-J2v`yfmV*YJ3u?OZRGu%YoL^m$vh;;GySPI`S|$0SL2%7@c2_g9u`pE z=+YJ4u0YW3f^hFH=-SN#33)`o=NkOwd4{gNTgamVgP!HWCkS7Vi@;GqC#Jsng^rBi3LmLaoKi2etxmp7!en)*2EEIMDXmR_u8 z63w=fV6|TzR5-3`$s1z><*8^hu-AwM5=f_#g*=MpqU@HzzpWHBs;!!z^ai049q+*1 z_hR779<9(t%0qbOW#<3vM=m)0at5WqU%-z0p)@s-ARH=@OmRuWRV{g?NGw$w6*A0h zliRgW=Hr7rorFr%^2zF<5^cs_@kD#InRDEHS=wMEx&ZU?r~t~P}% zMCF`OEnK!^^EBsFMMr0ZOKjyVRT1=AB}=Tcwpch|9kh^R*V&k5&$iJ*>GEP6ISv$) zqJ5TQqXYZsEaFgSB&Eq49Z7W0bSf$(5Ad8C%E?g-uIX4|W6R5|J$h;$~?!Pe89 zIO~dVGutV)t42s{bZmEE7>D|JFs@J0N9L2?dW6JkcZ*w)Nd4}Q2$QjNK#Rm@m%#mR z;_3mqc=$!e$dxxz;-xnjBTvvssl8C6B~mC{aV*JwbfSzP(h($>3 zjCg}#dV}I=LL&E!c!^mw?Jid25fU#^Zd4fybbb$C{zDMdwHK}(gcsgw$KU%> z(5Z|8*W%637`o>H%H8q&>-g%Qf}(!A+>LvmhmP@0lZ-xk5q-0a#L`F-iNBX41h-m)vf<+C`a~ z5)8(&jWP}7v;*lVrL5u-+d1QJro;{gvLx>ME1r83pQX}SFzgyLT?(RqMnZ9xM7OK( z?ng}d>vQ<%Glo)G3!FtcN6Vy;xe_1zgk-w4BL3`iB`6JEuEbBt#FR(BW04dD_;*Cd zE`olo&UbOqy%!g~uIHl9^@4N{UcOxP>dnQyf5BfK$IEXs^4XVy_AB^&ZUM-0hbCkv8 z2$WNjf(Bq7wg9JDFIp@ymi%txNL7(RE@rbRHR>{6zl$ZVeH>5zz|F7yGZ$eplOif8 z$LlB!l(qw7IN+BqDapgBSR#kS&$BAdKs?E-we&S^G4@bQhr}Tx0w~8s$`&z?j!xL& z$?O|ulBK6udQ!5L(AmK0lpMX3&aazC%9RZYJJdl6(U7?FCA{(vL2P$E%0&jBKvg2K zkQ|}YNlRKvr|{3C+2SDYAWJ1~xC4dS5I{a=r4qOOmhj{Ug6KhgamPIj^}Cu2@^L7Y z_(wEJx!GjkmG~DUaULX8m!UFR3OQ1OLKH?y1pEni-@}A}YullqYnkxi!(2T4CBFWK zp{M@V4h{aBpq28iZ}5G&WYEix3%?t<=+=`D*(sBF>?tNZ^NOGs=9W9@ptYmwjKX;} z%3#_Y+NwsYiHfm_iu23OS6Iw8)^Z7l7rZ*6^DQ`|&TFPYk0DsnzO7v1u_y5A8+iL& zZXHQWN<2>$<)mthrH_psN4dl~8KPTlPlg?v&yRjP56MR_Hihe?7}wZy~E;)Pf7_pk9|1|4%#NvR$hXqw+bM}3~A z@UB$K9zRJ54|~Z4CJx!#L!l+dh%@>!&YN%NfcS^G+54Yxq3s>jH1F3-G*C3x7Sg4h zrV|WOSphIs0^aD_A6MUnd%wcBk@UG$NQ|N9x{P*p2efE)RDrT~Ad_T{QN~^hV~GT! zF`K5kBPNcUQ5Isg@rpgY8!fCQZ--#Ji1I>=v{A_+I%6gN`U=+4E_k!9PbM$scBYzk zrspqb3bO?@4Wq0>u~vqKVV7NtEC2QtzWoucY5lya>BXgAajZoD ztGVW`d%1{|6ka#BeW4mlTj*xVR#vXx!?u&L5|n0~DH$B2I96gLCoLW;F&p#1Rb(S& zpxIicfuq(54V661L&jNpub33^#QWgPsxeVdR_ZO>8!|n~cq}&XGpB*5*`mOj`SU zQVDsJR?x3pM{~?l9)7(<$Ijeh&~xm#QZG3cuU_KSH<tFVt!1r=kIChg~BCG`>!d>TYODG*8& zMk+dpg0XzXW6(yidWkt|slqaqK|yvBTS&kpcX(!EOz&3eB@WQu>{L7Fa+u(HcKRBA^R`-ba|ExUMM@SG|rf-i#1@v!LSEyScb~AQvwX1I5TqmFP@~^#nmz zr<1%$(%4jqn;&G_d!GqXeRR2!i>|u(Cw=(SBz~c?fj;>>`hkwwIB5@epw`jgK&zwJ ziRsRDZftdjc_GiM+zU&+61_3nd%LfoRw>5++8|LkNO1h7^HnZE9i9B`1*ZBi{g{2y zW?;CZ*1`~&XfpX18|-~5zRU? zID%@X#DlNl?R<$M63j-Eed?@?B)jqN7(f2cTr^wFl=w%yL<((O{zHczR(4nV?`)&# zC7MA-89GPj_rvq_wwO4QFB!InPDXL$sUjsPt5h(ifq_2{#9y9a=*73V_}lkfe5Q*Z zqA5as7QJ8;(Kn0asv!y?YP!Nff28|SeUrq+c2^0c1Lvk#KAbS66*u2pw@t22~@X;5# z_!}30{}$i>1|k`lEzz|nf^Na>j|&gdryu%X!^rJ_<>I9`xF99TY>79& zWbDgtxcG@QIJ2cE;o@wP*D3SjY&yGqIOQZD53bqtx|Wdcs#0>R8vc>yNOB*${t*nW zr$Z1LXxd*x&vdVWLlkau(x{^2Ru%y(Y5r~Ho#h--?zT5zskY&g21P&xs>ro)C$O6) z>|^b%`t-+u>+#57L0ypI1Pvt0tdSE96m$B+IT90%27?*)vYLF3L=Bz!l1jeyHD-g! zbr(ss?W9GN+p~aNytkNpOzbsdEM{G4ZqaR4nrlt0V{ER(zmn+zrAa}^mDh05PZ!tT z${5YUb0yyY0l)kU$?WqsSK^0XxRUfj42)#8;9QDcBVYKr?FVkom0*x2_dSbepU3+j3c_h{^CS;$p2W4cGx7HOxcHIG zbMqvI$au+w5C)ng0z0GcAUyRn%E`7ljz0ChB)^c*fN=)pYG{&|&@YfW_Z3t#=qWs1 zP9pg@ijX4rj3!CMXWr)Ow?E-cR+A)%_E}95--KSm8cMsySV?PMlf*p5tNu8H8#A_? zRlrRWTh(5LeQcy?$M&~lN7)IcN#dM}AjcKzV7^5Ey9MdYuhzvqj|ozoJoXYk38vRS zgWmell8IN}%Ee2caG|%m3nemmJKHSr;$VdG8CuOWdliu<))C3sBCwhQl``16wM61t zTGN+G+LQn3EkRJv{?(`@9AgIkr2PGQqi+9B(A@U3D&|M7ZyjOcOrPODd4+HVOCB6(C_f7C)pvCWm2Ily0@@GnA!0Z49GCEXsU?4a!GmwED zf#)@_sN?pIOqtMWaVG}yJJ)q)AfiiN7Y6oq3GK?jlCFC-Fs0jyZcLfbV{s1#@~^17 zf`N#hc|93u45I8st0YGEp4FQv8GWkyFc91~vo8ZX`kvRoqARyw$&?BG7WZQyzkgkS z1|kOJ4PYSrstH$N>Ya`H@rPfXdo`2yULAG~1FNptuYr}<#$AW{JEv;K5!csW&-Gz9 z47-7W?Khm(z??s={}WS2-Z?u0l4cS#_!g} zIaV#KkvQKD#2Uj5A=gUy1ai^kPeQJf@a@8dpDwyyCCKr`w+9z~y0~o+W48|ylw&8A zB!GF853*HOlS-mRVXulZ5pRZDNT8i;u{F-d3_Hw$RL3y~COTI;xoH;dFQ!m~cw-Z= z1HWl?%);qQnyzx7^*8NH6f%sl2F4pTlvVVPI@xAn=YQ{sI+_3PJ6UC6{r}ce|6BOh z2I%6GpBej97ZE(OZ=i{TRMQ)1A)F^Up8>N?;f&QAB&yXE#gsAaKnvR^Hb_om&s9+- zWwF~J5pE?|$gqkn9CJ+64|beA!)B&1N2)`R;;9wqfCx$}pKlhK7-^0%nSSiw(C3-+ zDSRP?a(L{epCR04{>Pu@;=^j1&?z0jMu`t&XqB#(y5+meDEo>Z~z4yIml3;BhxRsVFb$558-cvbMs;7GDb^;-RAPIyZ zf#4*BAR!PWKp;qhySoMn?hx#|?zNw3>CyN7UGMkTy4Tt=^2{@{_flX8h68yR%`l8Y zU?Nr3)2PImg?W$zxgvra6yj|gi)7o)9iyA=Wsz@Zvxvtsi`BNHk8BC%+n~b6iLUD| z2_D#>uvb(N8x)cPIyY=o_>OM%n-p%n$D_08qi+hSevyzbS}KpxHr1P=*>!?mf7fFU zz6Tz4>p%AZ>{592X}pl6q^;gXLY{s>NC#PQ?c%DFjz;AQcYc7czjY}?2hmYws%9S8 za_+qowIrbR$W66dEPBvqYCMBF$1^0aWz}BQq;a^D&-VWiHMlkur{ADsF*+RL(R(seD$@j~iyFtj` z`RMH9$GiuPO$Qa)1dOBFr;x)(DmBOpq+^cc!{0{>8r{72DNGQP*S<&|tJEOJb*xa# z+_6t#pjcG*DeM+Q|2~C8G4uh#q7P{TVPwucnY#ooJx+5$hb(q)2BD4a!DUa))-c(ot#! z&b4rATuvl;!Q_0iZPd+d@ptd1*-!=AYIb&ye~XC03NI$V$yE1)Fy{H`J@t+SvG zcGo#o2c7F?)Wwjxz3Pd)!R@%?13@2rCgj^T3LQkrd5jyg_6j}J0EJm%#pGF;0)8G@ zOiZ{DMurue=?*NRr{88X2qNBZj{QwnwG2vT9~DvZHgNksCcM8snl1qcJ7AG#V!=wW=(0?ugp!2A+=U5G|6G(Pa)4 zR60>fBu6WkS3!K$woHULpei;u*xf+nrLptfPc%PvnFGsW*E+Bpc?-KO%>v-cwLHSg2k5wf~xI}uqr_0{u4AUs>rk+b8pH9(kdE!Z5p=VdY^N~9ohIZn)Mm0S(iw$pYEOoWz4r`1XndKSp_9RWg#)TWdE`zh zrXo2*Yxg8Ak|N0pc1GbKt&;JkzY+04aTY&ABlv08v9;;untDhc*)s}z%{hbiQd{_p z!gk5@bcSE|z7~D$Br6k5VnF>AspxuEVHh<(Vg^~q#nwojuRY4&{7}f(yt!wY2Z?Ia zvkEiROeHO>f*@e7VrcK#-#6(@Zgf^*Gr!{d)Brc#cD2j(&eu#-d6pLS2$-T5Xpade zuXqFBr6~t*6ms*OLhig@$V+eFJ8E8AYFzgoe&jBa@D7jUt_OrX@R*P{-lJcGM|boa zoF=Cf<}QnbqN|{LQpE|js%VMqSr{!*bstaDv{2J z8plI0Q1kvKXbcJgQ-R1Kmum)|CTL8OeQ|<__dm8@m-nGmorvPgF5!`f3x8duzmJe_TjBSnvsG`dnB*Gpyc zGnuD7)kdRgHN;*bh@`DXv1`b!IZ`ir2~-u4(J#=%VlMaVr* z-R8JDV`o?Qk{%$ z+Y*-l61`~NuA@3XY!v5WreVSn#iy|G-#ZTAYf?;#=2z9i)Jw}pKAl@Qvo z(22^QJb7ug)5v7p$S^aGw%0Nvz1m4e&-R-6-*39hi=dkwdgxIR{1Q)v8dv)5wJ@!O z>7Wr?9W^iah$7_U&+z&8BKY_-eBsbPS}}zQAD?!#Ycqpu$aM(0G?mGB?r7Jui!8u8 zY6MXevjX{yzi)i08y1ZqDrwsYTZG{;m4m8=E--3eDJNOQZ)5`wd)D0 z*95yn`Iw?{^@AdM_#=GuDZc+vnBVwXO40a7gmx9>+7M6DOWjEk+NKWYfAlN+N$dX*6q& zw|_%B(a?3$c;L@$&1N2@&EIz9bs=)2I%)itOg}x11M0ZKadp;l9Sp6FowTI!@lSDv zF~Ia-b%0HhNu`U%6e=it`>TCy_V@bIb$~zH$6|lA1V4js3n!hKclX$yz(O9iEDUlS(E5D1zMG5ug~?Wyh>BY0c;QK__@Ni9lDUn&Jw(l;#6qCh+wx@*~L zV*z#5yZ+AxtoqM=i-D4VJ;FL}+9H$ZGPUX^7XHpM;VI=aSAz^)2rT*6@%=cez#g-5 zS&@tB!;8s>h`Q5Bez7@VP$A_XyYn^MPfIyc>Coj*+$O!<-J#7P$TC9=hL{o~z58Ma zuoCOs{R<5IH{7fNGcSKd>I;T=#WH@nxc6qzet5)5dLbJa4Ek4RXpBV>BC!)8H%0Pma3;(H=7&AI`B}b9xrX@% zclrB5ZnFdNL4vy%xxttKW5pJop;5w0fAfPSu1&ZFA-6=L?Zch}qVl4UA2rt9oB>fo z9GDu#j1?IgyQw2RE~>x`jU?s{ONs6hE$1X$YRGlr-l=yqm4>{#(MO|kJo>cjxifmd z107;g-ETTJW@-$k#UxgenHI;aioxob4X#bNH6gblW=9NmO3zG<7h2$Zu97n~;<<(z zE%}dyV@zD8MjO?M8T&NSWi^H-t2Q!&7~LN2A3@_~;91 z|H|2E`)K^q(mAwZ=i3*CT0qy(7(p-1oGQ`yF}d9pT!k&dfhS6>?vVT(yF3$r^hVS9*Q92yYuc z`F;6fOxNft3fR6}r}U-s9u0wgsjO#)asgb|_ocfG6)Jt{d_;%%zI5#)=%=yTF88tC z?;Ie53D(?KsGmk}K9A#~#z$cR?b!0qUBc{9JBNJ9KaEZj3ffOg=}$TIVhJ1Qr*S6e7=@Im-ccgXiy9Y&@uD~Ar*SIkEbFf& zL`z%i=uXk7h#nh*@iEh5FgIpljL1h;8t1MtKLqnDvovHsjRgYw)6;=_y8irx&Z5;X zk(KJXe50wnKfie66ejUL?4bTnR;)K+`T*&3u2%*t=fX4kVd1|0WMpR}LMn;W^!UVeMBu6L4AU!4{ z2E{QYG15bv#HZ^eTKuNa-{dh{)ObcfZjU%!$J>3Zo0#PzmsW#A{&63t{e%E*gLFPN z68M)FpfH#mU{uUFH*sGnvNlj-kT`)4)EFun&VhX6?`5FbN+t<7sc};GH#qK}_R%pa zBMKRk3u>SiS5Y~~cA6T`ff{*cfe}fb8Er6{)`ZESXrHaH(zYVl5(roswKXaNHbr@A zkVYrfS4oNhv~hVbh8v8c=lM3Kz&&Ip0yELiBFpAl84z!h4Z1RSG9A=K^wvj0-ge|2 zM|iOq&EI((*9Q~rOgDb7YNMq)Q%ks2<;hUAM>0JP(l{hKjzJm|F%zE3(uf_Rh29gP zuea7n7SGo#jc*g_?$esfg1)ZXY{^xVtr457F_=Dn^Xa(XDokR9pmf%6H7lj zs|g%yO8B~HSOw`eTH8Wlx)DU&|mB1^d7lJX1nzPJWQ{8 zw+_nDxbp##zx6IY{!CDW3thO2%w>@AQ6#cvutvG)0dlnS)9uDkqn;QC?7~sV=oEBjGB%CYX0gF?lj6A1 z42Rf_+`wZ9^kyO42 zm)s!esdwP)Nh3Law{P zQ+XPV?!rA!I&__ocKi#`gr19$r@gT zn{M~Wy!s~IZh^mji&bia63LGpX&&xO!^B{P5q$M6kRKvnzXbRmYuVp9Cl8YaCKXous>xz#{G)M`>L5s7LbX zGeXA5qcB?I?q@}VJ6fZDBafu<#X_EaQ^+Tud8$A&`sMC>@aSLpOeUz-G%+zY#kD;8 zBD#fa^}5pko=1iJ^#>t8B`CBOC#eD*VHoo|Ml%U}(@Sy1Yxw9VB#UPlg%{!82k^v; zc=3AF_sHWyo_Jcw+n)(}$C1x|6fT25ntQp8)hH1Ug|S?CZKI#r9(SlS zl1po>##sU5G-@^VNNPJmKl^bS)cKCrygusF9AfIl@fz=Z=#hN%nUK%_?x{kJzr2a} zKftHSTx3sFBBCat&@I^uHETNFe4EJm|0vYB_etU2eBY6Ggd|f_*Ik?w3pFOmB@{Xh zfTt#K*&(a0Wwd2xbwo+FUKx0V3FG2*Yb{)7iS(YJo#|A9cSh<$jYPC_-Am=0%PW#F zSsuX*V3Ou+gW+5~O*iwn<~(COHBsZ6ZuDV0p|H;1>5F73T3IZzGkq-b*EvyFf2IR< zFF`jhBbe_%I$v^?kn3+2a_2orlnAeh8c#I`3${$u_}e$qcv5n)P1I-w79O0$4Nn0upjJdUl`Oh_lj#-^)W z<*6c#9;zRG5ewnWMJ%VNRaPVk;c`x zd1|so-3g3s-cJSLX@#zIoygW3Ei!{4fpqxm$N20!{MK7Rk{r)bD;XyBPXktS6Lv)7 z^q+=~QWNMyyF?+MzvNVQ+s@@!AF~G7i1QD#1Z#j3tPa2gnCN2rTMV-2_t2>jzI2Yc!avgeGD?J?k}2 z37E=XZLC5fW50Zgt_f(D6NP@JFL7@W~tTo@y7FldylA@jV zi1ip+)95)NjhhI0)^X3jBOFz?(=_-_na(ZrER7|4jmAd3O?wm-@S{3~fv-Ew8Y`j~ z-VpNU2SPslQV1jOr)&I78_;yxfap&7OI+ljjgDA8D`7c;ZaS?!T4<<99e zy7?I7uMV&yV8l#`#%0ZPmu@9ma+pdFr;aYs*eW)_5-tS}x~7Ss zhgXTlJgkCrUWIKAY!h#V5{&~m?Ihj&LB8}^9qb6OGf0dQ?nnq+A=^@oj$FJBrjz3~ zx{9>sZ@yXY&>kDdP~KWg6z3dX>l*%7BaQTcDb=Xk1eaYWz3Vj*a>H#xXpt@DXJ{M$ z^L$a4Ql&3kxx!w$$(#}SOlB4=V5%?X$eXFfZZ}io^$$Ig-uyC5RZA3>i!y1Z#x(iJ z&D2;f3#OSG1)9Nnvo!9yA55IqMdc`TGkuIl;iY#8dGbR?o)<#vfq*iGhaVAT)+{cI z`PHAr5LU)*%+eUkz>8^eayT4 zbm8u}UkJl;=V(0lHs1Z42%dXY$XDM8Nu<58vl!UtXbfPOOs=R7LvCou<*D&pM$i;L zS0k>WN7AsFkelun@@R8U&C|HyCOr5!UU(6o`~&Ueai2$1Hg3O1nyJE?r}4}Sc=0{F z_o2u>{6vV0-=-FD9xdCFfRLeAAvZAO2Gg>hANJg-jwnyf*Qi<@4X(vax8lAxg}>!@ zRHK0iZoSV_3p7-ekf>@xs?`+2EyDtCtUR?)gAp5xG#X!qn;*wh?|NkX%0jBf3Sl16 zMH&qn3&-v5B6sr_X?*{)2!Ez|agml#J`q%ioolhiJe8B5o zsu5EKRpao^2hw`Slb%|pQL8o@-HxYU!fT~U1T|`*b|bv>nlN`g?WyI`squAq=qbF! z#2m|=eX%i`za*_UKIEwtTFlQYG^#fdj?QH(bQq0D#4Mv)q7heUeDrsG!)U}6?h+!= zh#^NSuFS$0ZzLLVg~meBEw0qER9>m^@XH>_U)~ckLC@6@Fx7#nnz2kPHP-8WPU5ly ztfa<*DMwcEtvQ8BCpF^gd1|#rO-HVI+*4~bF1-xR9>!}egkg_0uE!cJuf;VQ55FdD z&%G?9#V2BjUZaWr_LZmBYL}HfOO0UYP%(o+*D7?-J?W}hprywWaf?~2(Wt5LjU8d- z@wFP?{v^UK+&giLCS0*NUaZwvE1%M}8pl)zH(O7g{u8=qMs0VKpMcCU zLcEZ+XuSBE@cfHx(a7g_W{SMjx44fXHc@NQDo6>W-xBJ&sG$|ELQ=wP(U_}OYLOh2 zM{$crspRq5qA@cB?J&e0I}LptXk$BC8Pzrf9c{KnwjJTb^TjWFiw47=q+>h3kGlu6 zeX7>BXv_)05x>GU9Tl)u?)R^txVxDO=G$)Wd=@-H{QZe|3GV%%pFpp!f8>QZKJOEER&~p=9(nKpr4s(u-cRx zkBxbM;yRmdEYQB+IPdX^m_^;kYG55UP`$ksGN|NFauGf8s=RBqX>`)L?u3@hdT<+W z@M?Fk;h5-p&%#`I+`ZIzRY=V`sM}c3T~7#k^>w`QYlyhgEYtY%XHRX{xa3+PRqLVg zC4%ZV7IN*4p4y?&{CT|kBbKTS%wt;4K+KjJJ*ZAx%rtE~7&mxEGpFwkjo6EE>5V9p zrNIu3>NRDG`yUqaNOK`Swqwv*KSuG7S5ERPe&YvWN91jq{-;(c&d<;_^rJ`bc+o=a z&}b*i+a1&x&{VU78qLEB8|Vd8E`=<2a1G5mQEZb~%pDqsskUvYQ?wkqrRHmA2lrn+ zoMeE!hj(ZUlr6~)jVWTw+Nsg(1y9Izxc(+VH$5*TQ&c58wPe>2NiN@)BSpMR!zH-5Ry; z!9x#wg6hjxeYZyAdqi;0L-HQkt?^k`C6dpmh}x~uf$OI<(Ln9dR69KTyr=eZ9UxvD z`!s6bibtOC1T_v(vs*?0kiz zigx=08qa=+ui8>S_`C2R-vwhCr8r95?5(_iU|>v3Omy!bZtLNvp=@@Sd# za~MQpK#@EIhxPwSmy55ES+BnjAN+)$X#72_nHcWv_eI`~*4bP!?jGi!H`nf%!X zX$+RQoWnFp(h_-?`9>Mya+qrUj#?(zAXk1^V~4!Qj%YNw7)|fNQy<}rpV3Cq8S#k5 zhY^;`^CKFKn&9H59?|_z385|eh{n&fl^@l(>k)kVji`UnpMFodiYuI>8VxS-NE$lw z$Y1eIibA$%HI8ch^;2{a?eH3w3iHAb{x?j%nmcMfGFc^YIFg(auS5g4+Bvg>EeBdXk=}qv?D!-i(9C z#%^kq`hy!4_L8=Xo&(FJoX}`;xd?83R7jfYrcfYGk0t~39uLYfR;AhnGcc2I#J8* z3XAnj&vMe9v55Cu`bhUPeGK=<`IzZ%^3k=ys0J9twDZnnG|yzo`De1U-l}?XCUQ-3 z!t?&rL*!-A<R40#Ky_49KV2OiYjmoC)irk1KysawIv(#M z-4ZJ_UVU4JC-WcGLo&=%Xe5i9PK8FXny#dM2SZ|xsX{GWYggES6=W*3<2r_18WY@R z>PXKu;(=D7(bM!cSV!e}uFZ4LRTeAGwvX-{jrf?P7$jFpt%T)OH&jJpwd86@sFPd= zQ|r#Gi+%Nu)RV&wbr$}yMz~F^54qQjrgPmiAgf`%dl@$2S$161U`yB(M1WN*(t&7!tZ()*~midATw4C0++Sk!0-M*aatImw!+4N=$>wZn0_(Zix; zj!DtQ4oDrD-Z6(`a4x2GC1h60t|T3Lu)a+1nA{lQrpC;0U_qtjuDzggab;;56M`vK zmR7;iDm$x)_*|8Qs_0a;Yt=uv&LNjjHPwmtS36Zr+7mBGz5p{WSaktbU9k585p}(A z$b}ekVey5+&Al)!R>1PuU9s2|8(&?x(&}p*I8gnF14pV?RLAM+9cxJY>FRAA=u~61 z1H)<;)Rv~HwWm8UxAp=DI@Re>2Zi;g*2lE^d))tiLY<;ID6TWz{d;yWuxEFjeU6K- z+orC})V=OthH#Atxqc4JtUIqRj?_C@53TDb)yJOtXWg8e>TY!%PS2GnQ_;Brt3RqnN{g?v_{m+52B#|$)bf=A48hPs_}ob2spN&2a?8YOm) z#az3?dg`3UjrZY!M;*FD$Sbc2`P=vSfo92b^x*19<1p7tA(t9*>8iIv9~J4jlDmb$ zdKg1`=(fhfzUQbf-Q*;P#rxo#MpxS321)u;;WCXJbch+|z<4v=V1{V}5id0Wra)Q0 zYYf(!O|DHizE-7eli9`XEqlfrG-!yX*Wl(`aCegOC{R^}=m?1tu3=Llv>L}7&`~em zAW1#|2?mcof%jT7^~G8`3hoc}D2WEK$;u;5R)ZBbin~&xLHeIKm(V29V3TZ>6AgBW zH80ViT$~LP4faW5&P0Qu%qb$_XoZp!C()pUx{lRqy}~wbCF%N$<(htri3a1vlQGGl z@e_FJ8&9<{xcCm-`J$j}en;2dB7(c_6Y}u0La3E!W5gWZ*5L6s@ks`k(0de4GCrdR z^Dht5i!_$$!%P>L$dvRQ3{p*&@i^qa^yut*%>CElGV-STkY&a>{N^Vj`l}-u;uG7} zpl1m7$jY{@!QK$Gmu+!dgAO5Bq?a+%wL!I-xaw|Cwf`M;FrpQH)Ke)&%;_mc9P?8Q z?s)=#ozHj-gL@v9ayTglU;Tg|ewNNpzAA)87E+B^_*0Eo_)`rS0g!4W=|rlLP_I;j zf5g-Grw1c1Oe9D()gYefT4-hUR40RGAK|mV<6GLmIvL#fdL*q(XM5>C|1ZrkD|rLf*7-uX7JpLp6X%{TMK&_#Cpas$5t1EV`8)JVvvmzcq-js4WHOn zCe5I~$u}rudBtKg)nKM+2_z#0=#QbyCs6_{#G*fq>TFOHPPEZY#Gf|Zphi8J{hkN# z;Ny7wd10P^TT&0F8$ACP5q$U^&e0>U1ap8gl(T|Dg2h&5T|8t{ed*Le^5mr((Af$3 z;_8xaFon65W{TAy^Vcvq$}?ljh09TTygJogG1s%mu`^8#8wj}{ZYEX zR5R1afv1Ha1^wMsFTzR(*2}6V-C#oq%5fYxiLDkpV#my(5VK5_5XVXt(GF|q{sK7d;rvr9>Pz+ z7a{PcGn~%>`+q;pbAg;@xjAc)#xkLk@lPjLVo~<51G=&A`B%Dbq&#l5S+ zXn(AeY?a7{t_IsezzQEo4_3Ns91si%kQ?Nk#|;g+JXUBZ412DUc&4rfs|9p7xcEAc zAQnP6i!;Kbhv|r$(lqH-~Swgxvm>OV9ur0u@AT3IIl*jCe!I7Bum5@=Xr#nOD{?9ac z>wW1!qfe$0qfe%Z=tDCNdW*Iw(@5rVoU7EKvh-f0nX4t!U~ve>n^Fc`@ZA{!Bf)By znFjeGSPn)KWg4u*4#+&~{{Y*Z6G7UQ09`53@?AQ6}skVWpM zE%H+XtP}_COoK)KMkn6r(;q3*V2_^^$Whw{sSXqb#STmjRtDH6xd$>0(xUpfyOtc? zD_Tahi|*#YqL`I2B3U0(9)mqG2SaX~0|#S{IMBXQMkVyDwBFt8A(ci}LVl&O=W(M# zZfvC~l~61_dmF5x4W|dyzj->JW~Z$h4R(W0%{&V!$koT-y8`NXkI?z4AHC{EF-~|9Jypx-j&{nR4fexh*Ta9} zN@xKsQ?$+YF(?l~f{|&48yS+}XZaZFm-@mryF5>_u-}OapFDZ zumh)LW!=Xh%V&mzz6N*Pg(sTh&9Ct*Up;-f;PObWz5{nX?9fd@UVBr>*S{iOR4RRq z(`t7YztWKF5ptQd&Sr-_or7&(BURyKp2K3E?`v>GKtF@n#<=WVB&+rcy;WakGZ;s| zwy6s9nbu?n^BiZ{@fK5U_rT+bi!T#$i6ifRD%_`E2>BveNy#nrRl{hko2)QZF~yzD zveMxPuKxS+xn8HRN%n31SiWejk><5@FWxH=-u-w>w;AjUx#MOeFp7`GE_n$08I0ok zt5mFS{S3z2sn%2d4PJN!uf7?gzr5+GK?V;zf=6E#^fPxggA9I&&?MGy=4vLOUJ^)Zd(x;xE?0}O^ps+=r?yYI&X&v`^2 zex61LJw8mWxs8mO0QY?X~vwn4MoJ(8;(;etKe$bvoF;5fq!PE+xo zq!|^NZ6YS9Y=fnI^K26z@oesAG8t)M&?y9&Cf8u7ndQW@#nmj^M10N$yASqYBOmO+ z2G`w#d*ASgxRn`f@Yhc~m1FS0vqBzpPa@j-NWe?#RdI-PbjK#<`NLF(g0${}3 zDA(ZD2k`XY8F}xip;Xc5K)`Kx;qIpdJ@=ZB55E@jkt2UkQb^_RJ5$l&aj3x>ck+`p zR!jW8cY!<+o1-x>qkHf?z zawr$<^o<-QyPeN}!LL1)M~>ds!;IuOA7*gt!y>%Rk!POA3-5YrxRKb%;RYAf7cLST zIoyD;k;4rb8#%(D!Id6KLr3m!!PFl*k3< z8O))1=`g)l`^m>4&mhZ;V5tH|Eq4J%qX5_>dx|`RGHj=1q!o+lF+*LR!R>e8rI(SY zn4lofAm5I%m~R(YoRBas&O=v>EI-@Fbbp2~r*p@nLhf|r(U6nbgVB6BPE%AcTVj{#os2+ zpg@-}2E$-X2v&+6EYDz72+F8OIHI|M%roe0`nemE7J@u8$w@|rV3L_*FjqW0^Z2|T zb?v)C&_&X(m6ykL&Dk6ty9ONc6(ROk@MzD_cZoQY5y^iil!&EwQY?s~X zNP~;+VSUl&pW?Gbg~d`dYox*B&tN#ehg{8#^`Mt zdv$w*jwZ`stZckS8f??MHAa}lTqEr^*lQAjT+21>NP3ryWju{RZU|OmyOXR5!Ey0l z8EJ4rK)yjs#YzwPMwB)APFa(0@Yzou$>%?LYLo#3g-00)6dq+5_$Siu_?Qo zLML~$F6a$UjWJkDjqyQsQsJyh&={fT(w4nJOCw)|W88~yjKPQBi0~svI!iH_F$QTN zVBj`7N-gd&{8BUN<Y84=NehU0i#{802b}DIUuu=zK1FSMdivWRSpAheug!Fe$2i zl*b-4ykiPe{cfhq$q}8)_|b6&6Qj09;Xu^UC?rM~L`&Zjtl*d!o#nVhuG31Qmq%lL zbUBS+$uSb>ioBRbG19;1|LjqUGGI6V#y#vrizRla#W}k)z$zBn-yR$dur+G8JJbK& zy?c1|NT*#HJ4Lw{x_EkV5~u3enjZKfJH1zUl3j5uAg%0o6E(1 z`>38#=od9H3P+<7T?dM!!+f)h8v#imo&Zz?Nq@+tLm9V5Eo~2riFS#_PJ7OxJUZUp z#pTiKqmdkw5raN4c`;ZNv);**V>&sI6*Dx(Q{(txZsdQxjllr^f+c3R5%~Z$kiYSI zu3AzwGWoX}he^P4bYPH0y2WsQt(H^IlHrmrZ+65(nOj7dSMoEu{-W2lY zR~RWOig5;C{VcCWk^kJ1mWMQj3F2fr&Y%|)01l*!@p}G0Qs}j^J}7s`W21~)Nx!g7 zd{?&Nnsywc0f&Ol7~}ZQ(g?)J-y)PcVirO#QpIbM+Rg@PmRWk=#A0XAAK?!tz!}^BeimRWn@<#S=r-F%+vEV7U?xC zG-J>QIly$R1x_&$LVt<;Dm2K!7@!Olz(5uf7-C0Q%%s_Im0fRyWk6w~srqEzEi#DeR83B$~uBeQ{D$}Z9T9t)Wu&TZM$eAM?C2HI*ciP(8vQG0yRj#uTgM== za;oFfEBALGtxEqYm>at#7CT~FR+q`QS2^s?;6#Y@!H!Ti}<5t8;hZ%8;9as^!E)ECdPQ>9%T$`GnnqW}pN?duhpc`)$a_gfs zNxu1^FwZh_(tx!#CK!DBIX?eN33(!)&TdpJ*_keLX|am)>IZ{LXq+r`#B zk*3eHv{NJ)nI;}7@YEz4lW=WwK||;dGoEX-U1pEL8N-#(BqI^=;;N5zR0~jzfv$QY zgOIjs9M`8b68U16%us;7LXz zx#x?&=OlxUjH>M~8skX@-D%{`RU^15XR6#u2IHt7DyDwuIFm*c`Ez`kjB)`TbyqE5 zB7L5=>*E@wSmLgKqMqj3PU%DjYx3JW#9%0O?<;7}o`6!VbCTx!MedxoixP2?!EjsPF8&zWIdD7#Q|vN}&9=fK%g=Yi zrr5cz(^;G7d#cD_DxK38x?iBRL0hSQQN-OtFNUeEWGV4u3Ki4@?KjC>b9V+Nx>ds( zpaSjqe;;o#n+}2d?P>Y~@^D24!^HwR3P?sL z=A)Si6#28=3=~P*a9LLrMV1q5P~pVIvYaR~m==N^VN*Lh)Lqd~e%XudZ2DI1w>V96 zpZnR0j5K;`vcYSU6qfVuR!D-A$p&w{jrV@RKSnByXC}%&H`ciUH@zeSCov=RO4-v- zrh2do|3qW8r=}Rh{(#?7s53pK&{8~Krx-l=D4u)<@BX`{AAUoM)Z?0BkReq;iVa@s zK?`nyf>b8#tOqf6VTQ(L&G2egQ_Z6Wq=Z)BA^un&#r}LBoBS<4cCd(dg@4XRa*!Wj zb+9(Tf#7(6VNnaBusW(N3guA}XKV2K+xVi#|31ikW|~W&?MaR_>wh0*0FP zE2Ds0@g1tOMgg~rWBp>^<0VHL=Q5S=3H48nb2(@iQwX0>%+*tD(2Du0QY5KMu|Zp% zqGg&vdb-98y;+OT3(BI(qeNc7f5B`$&-I$XUi0)q$F0(99ayXB4^kX?Z45I5AY=Km zz%Zt&S!*QUMJu4AokKc@^lv)Ok>wgW{bi8KXpARHkD%Y$Kds5lR+zV1iBz{ zuq5#>EH+3+M|b!x624z-&^PRp%lbtLc8HHW+RQXzf5|)G!D73Ycne z*E1f;GcO5w`8AA_x8qcU*WW^CmCn~TgOH~heDbBU=u9;dl{3|#ryi#aQLoiC5 zIHnqmqEE|=kXvB38<}mPm}920!0AzHR?;BibYueA$aP#P7I7cD_B?KtaMKKGH1pJS zg9a~nYKB40C-77YxTKvW27h@S?ZcFoq9po=sX=pz~l z{Fron$AfoIT?9>yodOi^NR=lyu*FVdRC?^qx1 zc-xweG%7I-V2MEz-SQ}sUL$GznxN)TJGEY6mto1A6654j9&GWSuZp=Y};BU4eEcE%GuNMaR9)Vlpc=cVPU}*`^<_^<+*NAu`Ogs(ZK=V}t(aG47%yX)LcT4sUPLUkP#)J( zgQ+YovsRX45l-5diGr)tNP<$4BGB|=V_e0yqit-I`9q#&7+_vXrwJx5C^eWa&toa8xX^xDN-OR$BiXIwD94z6 z=#(V=C^e2dE!<3l$DYAIQk6&e+GpY}NhwSPx5)EVVe$!)o~St2XVIR;C(8QAq78voq&fmc0_h-W^gu9C@qjzOa7 zVbD{uT+TIk^J|Z!MorXgjJw|S)I0;P1$yw29l?dc96od|27I1DgKKc(e{OBjgMTe% z3!G%E{!)ETqYFLz zhf-g5%1;c?B^VjV$W7)Tm*QEpNz4Iq>C~~*-{4Cly)u_NW%g31%wB5b&AgOGr|wER zWlF{VrQ87xagv!-3oX)1wX~npDSR6aFixknfyJK^gLdxlDW;3TDt@bv`KR1L=bBYU z2F?pX7C*{!umb2Ld!(htEz(xmO%_>xt{b;iK9frgcH4tiCOBk|I&e(314|8DspX{x zr9R6SFEyAcV3|SnyCt*SGJ_foJ(7!W6!Q7cLcVZB%-PE#=Imt#om4MI&>M6Pfx8{c z!rQUj;IilO%B%RPlk&)2%2R8cHUDWm&1iRnm){cETVDuSYPK3|GYRn2T7%24!rhPH@mKM;C0zfn zRjyF~XnFzepe3e_N$1OXDD(9cG0)vfBLn|)|5StQu)lQ8;x1n5|DQi?s+&=IEK$oD zFHf69H|7dj?8MvTKem?k{T;5I)(;s`$mrMI)F>C3662|L234PMYLG#H3DGs~d;J*Ld^!VraY66whrK~Jwg#Q%@s-0uo@#~Stw*`Gl$Sez$SMgA-b`N>MhR~ z#6UX0#hj53%M?WyaP zEb{gJPaZ{ATrZK$KgX)R<#emEc*;%uVwZA$6v*8=1|>8MOGW61IL1dC{H?EjEgVDGyk~*-!}W`9>u(8 z`}lCqQ8Kc%Nij%>N_O)Imn7T)gNGl%$DiQKufWVKlIElL?{#Yum=1J2-xQ^i8~gy@ zpa-a$kvh8!I6q);$AccpBTor=)RCv2!zW*g;Hl^EsY74=Lj){%9*LMcU?j!JAKU>| z!F;3%41+d~I~{Vldb~!VL=_*Pp>aGHkSqdtz@SJo*TDgUnR*^09hlM~!pSjL>Gck* z4#9f8S!0U?*&U!i(`JpWA-7L_zz;CQ;-p4}a0d}7?x8U}B@zBF){u;h- zuRJzZuPvm8Beff$@kJ6Je$bG)<#uVk`g$SvJ|yHmM;?A!xJMj$x;fr^A0K`%vZtGe z=(YDm;Jn@rnux>OL3*b4W0*5@ZHC-{kQ*#T91hZTV-z#$j&-M6D9`sn6M4`N@=2NJ znr4Pzo?=OZg9iKLRdvu{e+Z5$rr|wka7?1k4;erlQoKUs=*0a{hcJyqe+Q{tv34=toOqm>=)gpA z3Oh};_iFl59^^(Up5ZGQfOEV#Z7@r6keoKiM*%!_#^9o+LTXFoSsOKfp35ER7;>iBStPsfxlI%l@=Lu zD+^d9NfufHH{F46lN6FAZAnYuJNn=&SPNolXvqI_%#Jo$`F z_VQoAWUDQKcUyR>6%co+keZizDglUn&{K)PN8e+V=Bqgo{CNG`Q6ZIT{(fqJLKask zW5hksHUH9*k#W-V*9dGWAIn4_UDU>jz+h1uCjwJsU6BY};g0qAdvZvA+!KN0>YRd0 zGLi&b^$g;9$lZ)o>n8~rlE4Dm|3(^5yI0S!x5ti5yp#km@lq1-Rtpin?Z}t$3L~hQ z*dx&rNx%S!LQ4X&)d*U*b}LV{0b;KOL)!%3`?jch1b0+j6}obpJ6A1Io@xtRb}gRx zT+p>QdMX*X^a@<@n5WtScYTVl_&RC_#9ra4_COz9Or1d+APqf%0XPUG*hGtD+ufos zH)Q*1lIi9j^ku+U-HJY0;i!@SJYbdmrvbCYeY-ud>%6XMoO_kUQSmWs&wS=oleGs9 zGK*$+agJ*boJN9`!zS8f>!}XFBhB%``)Kinr&58Be})7?x}39}fUDp4NV=$*jD7>w z%l%6OZtSCQ1oXE`1JO_B5c*#U2U&HC=!vSL5Z6@p&0bQF7CYppTCfS4nVV;q=B{BG9lSrUKGKj&!D+OrQGqaqekGc>dJ&cL%9l>L|3X+ zTKY!h{m&E4qIdU3hF(f$o1GHnnF-`^F*QjqX2uVCP-ilPZVH{r7&#wuQ-$jdDN4{A z=t;Msem=7?_5ot+qv1; z@(LEJ1InW$M-6pgo@C}30X+V7#LsmE@bw6VjpD~jCXrFE=SvFJH0JUK6IWkzm#0Po zon?og4@Pg-zmK)wx>KW7!QjSZO%qN&@Z!sO=kNHgJC#=b6bA8kD>3Vh$40)(@`1m; zgT8#c`b*VPmKrOYauU(@jyG#;7kC%{>4)hfe*j( z)Fj}=_dQhv^w2q4zz{J<76G{eCIipEh>r*J_dTUO@{c`_7e5x1z_r38tcP%!W;;Eq zcL7rwR+#7~`(hMAnZJkWeIY@eD6~^8y7+yasE1`m=E=Yyu{uvi#M(U>$QO6r$%rVk zCId4?nKc<$=9jtQ%LNnzwwgy$?-De9K+v~td!3-D#w!M#D?~Ansp#KY3=~kGI9asQ z#c+jrcdA61K!9s+@YGa*OX6ujl?yyI9k}*7-0>UQsJ8svvi#R{;Evy<>8fkN!k5#5 z-`a2k&n?6ZAhs5+`OPD0bTKZuM$jJ}N`R}c#m%2Y>RXipO`4&XVwS;DKKmZYja*NZ z0yj3t^M7}ehdebCm}XMxJ=+Juz54+^{7z7U%23E-b}aelr|NW#Zc?pmCjUnNr7=TJ zdnV8`1lf|#bS5xIEuofol{5LuaaPl^xv!Sx9oCzoD??e-{ z%pkqSh1~C8wO;4inY~pyZq!>H*vU88UWwJ83CFp}{h7cZ!@SKif#Hm@&Nl@{#*Q_G z1{2J*KXJv5OGR&>kJv_M!g0=0IujU(5$?_o3c(0^O%!1bJT(XC&qd8J$q_IIs9r0g zc$x#$zaBm04?PD`UTF@PKeCGirqAJuW|)#0CQCxRIlyE!lZx$~PP|*S)6%}1VWTI6 zn+wD?M5D`b-5VYm#<|Re#JS7`eo0m${WU^|@J&2lwPU(0)-0S0jFL^`TwtPXO6LKw zH4xVj7rl(XedUpF#W!Yu`kK#^TGjI)>I7*^mAZ!WfX$*~oQH@)e;%+;omMy_tF?JR zFL{g112P572V$F|*;8m2lNsZYedx!7n(K`!Y#~v;Keua%`fOc z{Zu{*nd0XdFv~8o(&@!F@a=zYWgbrHHcs-x&Ih`fA=DL*qr>=W^ zi8deTEOz?&z-WJgFC7>8yBtUidIcic;<8nrj23QZu-}PygLWabxEr49_0?73)0Dg{FXsI%cN2aAHT^9hYLXav}fCWG&0gK^mX1RKfMt@o8 zECz0;>V7fM;%^?w2ac3T_}gMWl_wQiiSBnXP^P;Yl-Wa8`tFj~$6{cY-lIj*l|h;V z3=^F!28J0i1fDWT0;?4)1{QO3US^IN>3)W;8ST&y!nL$*E!x^N>!~Hcb1w^drG=1J z9r>PN5li4A&z1t$+~}$0K*OtqG;-wDhw<>6BKY__A)kEbsTIIiRKJn-;VNml!YX>V zr7%Btp{V9oxEs3y+-5%isSNt7BX51`sg=MD_X@f3UQew8F27mG6*qfoHLzBdQy~x3 zzr#}-fJ+|r)MlW;b)MP+-14}m%7EBLxNj9Td;<)InH^MA%z?D5l1!Rqh}^z1V23$q zq^XQ5pOU@kIFBT+JkfX*S<%{Zwf+uq6q4 zB`SdK0!{%{tE1`PJfa#+h4Aq^1qo|91qo|9ExoR}4R^gF`iRrO&9~vMhb7tbX`se6 z9?5NYN!GeEK#i+#^GEn5gX-XM3dOYJA6H#j4Ia4nKeoK|A6u@v+2g#796AGJ$YXE@ z7$<7ovwW;Z2OdGaONCr^gOIzQ74p`XLIy}&##vyhVr=VKF5XrvFoBV@AEd$Il=v;4 zEyqPdPnz-#_;Hw(b8c*&hW{i zi{4p+ZWi6d2jwiViP>ikiq`UMxVk@!$m;$qSNG+cE^}rMvLC0?xT-;T+KT zQjdfs23uM@@`6Y5s3X5*P*rCmPLeGxQbq06(qg${LCTgEyL3k*LsCpH2U0^Yh~Lqj zW*=Sg23zTLoG<=Xl478x#XPL%j%E)$)!L$VBOz37wYF$_1+KhF{!gtfo_rOry(O(r zvS7PKqUxxG&!Rod<=bg(#WsqWiW!kYZdS<6S1ai1eB6!WQ;lprUCS)9xvyNPSGyBg zs8=}gq7XO-tkxFHEa0g`i)RuQ(k0DeqLtkCi54}QNK>M`4-+kt1SDBJ{+dVf#>e=i z4K;WcZ~p-+oMtcs(kEWbSV=aLKsm`qZfBB3C%Lal7CmiW>K6(F8R3FFlPvm6v}ck< zoli;YwKzey7Gpzs$#3KPf=_pmTuCASb|RridvHN&=Z@Emc(iyIT_4GZ)4&po7$9 zY-`aTy?`7#bd+E@uo-)R!;)d3t;GQx21eL?i(%<(Nn4m$U~5fLuGm zBA*G2M*8{8K|)`SwiYkFi!YhFp)+d@u29Gc_&R87ktNEOwierHa_B5&b=q3&lh~b1MU1XmZr3?(lVy46wifx4 zPO_~ZS;;=)Vt%y{6_O~Ctm7kg#yVQl4eo;N>6pM@=8y) zSfX1psC}%#LUD>nx5)Stx1X!JZsHuCZZXXswnz-N1RlA%7vavw@Wivi&^VNC@hr1y zS$yynzNVTu-J%r}zccr^bQ7+CqO2sY7k;Dl)JtciI(=*f#52Q} zMJFl8o^B&`+0!lh_)H#>ZqYXc?W4LeDV3ExnRraN2}U~3lsep9EmoM# z^ux|#o+^ujE`Z~#>m*!7$elH9n9DWNGZ*8zVP)2`ZWeLR;JFt()!pL9p2|}h7IVbF zn_+R^bHdZTCjthmNZsiS`v({)eg+v9BgHK^!=kPD8fI85lQ8}ai{&9WE6T?V8>w@d zVbR;!u<{=va-S=$$`<+VwU`SdRpXSj61xGZ|`X%@$Ee= zhDdlk`-EVuoncX8w^&d0vSLc?WyO@(%R(|Z^s+94L#D<1EkJ$sRI}V*lNrDqG6g^p zm_#Yl{`)p&tI4!j_Ag_A1+4PX!S=Hrdz4AsK&Hjj*W-q}MbzSJAs;xBU^*Cdke@cw zV!7F5FaX(*E<-WOfdZ+in`trT4=~X+F~~>P zBtuOf8!2<#$6}s*Kl)g#r?=Z-DXi4T;#deenI241WHFTQ-EmR~yN^XFfi^WuOu2vgdZ{b*RLB?)i z5&)+o?r)L7#0~xQAa~$F@{R3pF^V`J; z=>8V*lHakv#SF8?$WcoStL65$*k-uS>TgjdV1T7{?%G@M$fIcSAre#)oqw|FD7!#; zY-Rzl0T#DBBHW`bgnY;^=>RV9dbnQMV!9q^aY18`>6(Bgf+U`#h2x9C_j;;a+YbgsPw%i?680&$0MALK9@wkYmw01ii&Bkz+A} zcd%H#gb_|Ank~QT5R0e&;*mV<2vrM1tf&@-SaC&Yqxvc7;S%2twK$~Cuzcc3ElPGQ zXMVTi`i%D2Shpb>T_fnWhlSkk$g?jZonFlY4YlP%Eq?7zlNx=Xhg!*`Aidp3e5l1v zE^m5+g~Es0NQu^=Hd3N>D4%&crVO>17=oF4xyA~YjmV1ctjyTfq&u+GtfFHKbH8zZ zu8)tK?(ozwi`WM-p7xt^wO3(c13;IKJ*09>^FpDIK;~Hj>XPByYm_?D9Ze+@Z z5_3AtVx0tt46~6)5q8ETH{-|Oy!rk?Zkas>8@~$I4(aAi|qDWRrc@~oejI>y)H&H>!Qi#H>(H_AbsWdXu;uID5 zZDh4K(xMxq1zc+Gkn1anx<^_JG{YEFHHTJXE=?yW6vR!6!|b@Zaaa_0JPrvpGixHZ z=FpnhS2L-Wr}8cSYvWS-E)0q*h?A}pXo_FTM?cx58T2(H4Z6n-a*fAL4`8Hx$@48n z`lEc5Fzi0{;>?S&>yp!#$P}ym)jqcSodWa@Mg&;XWPcN!Xp(v{GA|x}vGhob8WM%+ zQM02kr}2WuSkZW8V;pXrbP)z$G~^MMAX>)zH6MK{b?AOS%A~E=ar(X&0tnh@@JX zwJ@vJ+FICItGpKW*XmLmy=oWK#Sou)lDa$U;@HJQ+zlOA zZFDvC`nNrLM0)(U#%}-P$i3>w{YkvAh-LLqI$*kP*QJKJshmpu0DFy&!~@e_0QGE!i$f&Tlc^E9;`2?IH*BZ0}N|0v4L=R zKkUeZLY{m<$S+(!Pt0n7WzQtp*tIY48K=%U{OxY~ zH6iE}^bTZ>&LJob7C1?1FwcQS!MYGIm^9y_EZE~D2PI8&zQvHJf+(4%fML+ZQPUlF zGU}WIEu-5+OZ({Pl@3gdp6kH8P_m+OS!L<7G6ZFn_c}>g<=qY>ROwVj`m_!~?YwmMgVa?*2m|An@dEB&+n^|*F zO)L(3X4abJzBt2bO>&?pl&r0_vlhy0?RVm}wYE6WrFO5{a>#<((^v;6$-Rsg*Irc{ zt7~s`ZNjYyxsA1V*2b=|=lnWr+>iw!NUWPuSEkIayTpO9bxR$X8A^84-Cq|6>UO9n z9mxskS#PA1WQAa4y`p+3u25yyLxLsqkZyf2l zpz(^vSlRfn>q$-ykaSVciv*;Gpyx${FT#+EMmTZLi~2jTC9+weveVPnzf}F7D{w61ycxn_46I~U0Fo9{2SkgyX#MYIT%dWspuL^qY zT}R#)^8Oc&d?Ms~uBk^^bd@i{D2pNDG&#y*lz`C|m*0(dTOgmQp{J^H?&&*F!8nm= zDi-m}a84tY^)Uz1Z)ZC7aLMREPuv_}96fLr;}DQ+JJE`;!D1hC%cS@dd>r+&!VK`E zEv~-q|NjSA{%^0~kjAn9lgro+>^|>W=2$HJ9~U&;-J*Xwz+f8X3+c9eg1I05>1O@w zQT8#p!oRs=f81=j&qw{l0BJ#1;PH0;8xcR0*vtcr;mIH7v;+MKzVvT!IX?PS(B1E% z#YbRXq;Fl~+tC)^{(^WqXO3m|(}JMX9isz7t5fJ~IY1BB$O{Ubd^nSpyNuwYxu&4q zOTbhuM_42gilZ&gagm>7QVqH>onuyz>n1p1l7S8wK+DWHV2YR(M_Y6dCyvn;qr@gK z+Tsw7L*_h=vp~E}j)YxI@Td5mDzK=36|TP-k3NlGlN3@^Dzye96^a<}u|l*11++N+ zd-+w@uy?RXcvN!;`2AwB45Bbi<-62_eCtqNc8c#Rw({9$8YJtK+38gKxj$0IR%c;KF z81`&0%i2QTjiCy|)krr%kvxZm7V~AZS!l5!1Z(t0u5U*hIrKI*UuZEV1RI%XY7myV3*AH?@cCHexI(`ACSkhcN?00r7UnySj^a{ZN)A_H20HN) zta4z3!hCNQ3AR0-cgg-{(N^3y3N4mO4aP!?Wg%$mr!Zd} z?MY14SZI+Jf0^vfx3WTu;j%I>v^e1>G9jGBNdXi1TrX4}!9EEy zm_X|#<9a7poK#6#nkqujMyEST+Yl7W{$hf~YKc3XU?VmECRl9OM>LL!rDTFdJJ}OV zu*jx;e~1}rWa?37jKNq_;5OR%CJ24IT*#!53LP@ho0?Lj+Ge ziYfGp!vDdv<5) ztt>s>jT_)N*6c2_j>`_Y5n-nh)X?UK+zioc7g@}Zd`!qf9i!Ans;Iy7<LNS#0secOptvX$ouP zK`W+hUm|Num9&j?-1zgjf{>dOcACVbe=ey&u|*jJst+m#-51k1l%&x{Tv9@=ZOC3p?#|H-kf_Sytv~a+xQnj*!c)6mrY`c%Zcs*!&eKbTQ2m zvCzddi#I>Ohisl4B@=*@yNBQV3woa4CB=W%%iYvo)kRTJh~shTj?qW&eGkS0PdyHUvHjxZJbT#Ngk_S8I!M_$J3KOupZtogEl znP+j?P11C^BQL)$+)sQk=UMa?--~$`gF`S*oX+NjHk^5(4QIXuVo>R6kEl*#Ty$xO znmBanwYctSPc5>Djq}t}i<;Nq&in9KqCzLtnYnZ9zwp=GiTfUw&ez;5gfEMw+=~AG zM_FnyfP2zh2}TLIp&^&&mUa9~Eu#@p%z6>-ym8ASv$%1~?D^xCThzY>)6_i1xU5t- z$GrUQBwgroi@WZ|6R+dF5AgLr&_VT7D3B+4xy9X2cqI2Y^7?ziz5b36TI`owu#m@c zi+|8xeL1a75ztc{lb2fz3c)K9BX4~v+}nU+Rjp#~9UgWlQ%%zR8FIrzE}u4!iDA!mvLIVw zu{{LGm;t}FxGk-quU~?WxZs3bq6E^du#qhH0#Y?Pg+qF1<}F!46M6(>$=7;?#cFXV z7qE$0fh@|zU!TVhK^wEk$R)K6L6*re$T4|NEPv)PQo>>dU*OXWri(pig~dj*$938y zV5P;i*W=c^aqml>T5Iv}<9OmPg5GW+BwOCcYx(!!c4V!^9#=%8f~j>P+|iJ0Cw1M| zTJ$x83{Fxtv78C`w?(y#mgyKnB*0ne)>=%$2JWKEfpRGtv6ivMo2+!2U`riX7D_hR zy%ziJ5hvbccQ`P|U+2pR@nswm3=f1G9*l8-+GlJEvZ6$MFgU>s&1YSka1|kUHfR%t zwo&Z4-eS0#%f-(Ig)%OD&Z$I=cDlXBaGj@7pvN$K+j@<1zE$(gTy8^HB4j)-V>#aC(ueWH)>^JSDwBC9PmjZS@&8uY!+r`Ucy+xvKr_o+B_uYDnH23N5 z<)#}XVVvtN@^k?eNsN|QPkX}@W=CN5sP){KEp@%u>v9J+gdj;Cn)P&{N;YzWb7f7x z-eRt771moEH8jYsw>TzXgT>#!K?dIhWBKlxLT7<>vK`)FQTH;Bq@E);-Xh#x4+(kX z86hwI&5;&D{`Pl#!@#W#)|pl|Sfn{mLZ%qmU@=}zp>z2(zlG=|JW6i9O~{>p5%SjiXhA#fW{balfiJ%m;cxr~Y_=|;QmXv@H(PXbM`t+1 zW*b?MY^Iw`iJN$Q2sX=}V6(+$v4(H9$d)y$fFW8Au}C6TH(M+gu*Kq$C-CIoJ+;ju zrkbb99NF&34o7x6vdfWjM|NARQ5`kb`iTKL21^30aS>bl0~`-nkaM@ie&kw=qH$=t zztG42;CSFs-r!;(OVt`BUv+jc+>(C7-C4t{R4>xf zBTMIMLB`uy%v3BPqLSe0d)1+YjGNFt*7=|)NX>u{)(ZpKHhK9SM#UQ>? z%Su>P>1ZW%t-Pu-wpZR+83!t#tBj6SQmP=mZbn_1_rDI69w&m+0eZ#^h(T7&kQmIU zG^-L8Ra#XETdHJLMQYu2cY^z?oU4M4RnHeKt+u8bR$j2-0<5`k^Mx21J1Q1qW7Dgn zsCsdA%&0!UI#yOssevIi#@4{(8VhS+X^mwyu&T!P8Yr)Es0NPIIa$Y32P`(krbkB2 zbfb1v$G+;vsw1gJN)3!~IW>w$?Nujjim28V9^FCKv#^ShwNOYg5Cw>)h%#8$pIV%rrBi{YwaP6+`4&A zE?>>L{(2wVSVtqPZmyG03l;`);?qO0BRCWwJvuuYBcf+TOWUsKJr10WZXbh=F=;U( zJ{z6rz>t_>4iv}Cci>P=d?mE3G{Zekoho&&gdUZ8pT}i{T<=QRl`uH$xvKK^%Gg<% zw$%d`t154*EJxZ~`G5oGDtD}clqxH$h&Z##z$zG2W$1ZaR>%#lGNuZ~hCOFhU0zj& z%nre+s(q^=yW03_m{M(NH6+$;=WfWFY8$H|_ku|mVEP3sFTmM4iB7)Zf~^-|_=Qt0 zL@9j@PS!c=9@9RtLt|y;z9C4jUQ}Hq#nopxFu(dr2bP9lSqM^UbghB(xL$EctC>*~ zqie3Ji8VDh)WqhRyJ})j&1JQ)s@C>e*jMXZEiA3QrZ(2q+3JqG?!0aX+~b&0qkj!7 ztFg*G>HTXAse$b^${jbh#^f4USYxT<4%ay6z_}W2;?Op(gZn2;jhpSj?6@rsoQX?x zb5E#UT3arwwDyA9SXg_h;|ABsbElJ6XIULj9ki(B_U%NCMR4_XLhgDLk1^!!pv5bH z#ar)-@Rh&fZHM0f44BZPR3#N5BVbT0$ndhgr3R6+) zn$}3h$rDzpWJ&Wvy-y1`q1(CxrO9kK}4cie=||(t>3|Jyl`x=u?R2zNZJ*Xp)L{2h}3SRCkR` z-J9N{6E&vl{j9H_#1rhsI&LeepxAD3$Q(8}YdTROIRMDRRJv?0O}!cSTkmMup+<~mg-7nWvO9NC!^%NHvNwyra-!#`OoLXC257l ztUn!I26YH}2N)Vm{I{ndJ!byvsfoOLQz49ytgyKLQQ@wCSO~pNE39~(R#+6P6$;&T zrk1vi^7~g%JxZfcg~b8cD^^(a7AQQb~uJ~+M(4t2}UIo|SU5!lGCIsE2 zierUE_YkZUU;he=RUz1J4!Kb~LU34OH7YCyAkW>%fgzZR1x_+81Pig5hS(#(Y$+MV zbG2Dk&LhhX4*~P-R9MWD8h#ZP`y>l*g+)&>YDk$5`W;nR?DY4!U!q9j$to<0g6V-w zI4fB0!0ZsLkN~6#icT8a!?Y`^GM(vX z<}%sqVI9wGY;%}=I0;BWD$orhfC;RaQNl#=t8fS&=X&ugd{?3{hq)jAu)09>xfwK4M-u#b1BA#tbPIc*VvdA(ow8VLm{0i>SH&qnDi|$w%3=g20HtCA<3U7Kd)ngm`#q979O0|| zj72k6Y4p@ti`yQ-Q_necpAeVV^elZE`Y|^o-G0x~LOYIr_B7LmTw%x+Im=3<=PtER zVZUN#p|iAQ5uCHA`mBUG$NS<2AMfL?2RxF`s3(i}@fppzEqxT)br#!fKOY19{V^Uz z3Cv(Mz|Y~!W??jzMVG~(JSNgO(ur0_OV_kYiIoN9SDsKAi!1l4f`L_5$BJk%i)AHN zIbU?@!bn?_yQK?Dw6^r6L~BbQZ@eqQ&wdt?ptxym=|?g%we(S8S_4xs8`4frKx_Ui zJ?sF+(E7rOcw*&Q?$joQpjVZFRitTq>|u9`I|L;7c%g+y@}eW3{UqGyj&zZYOoET} z5M+s}Cc%%yMJD)>w7CgB#z>yK1Ro{x%1ZE&D1O@sK9WMvg&A}Dit#GJkAT)b`tku7 z&JF(zn#T@`cD1!HFU{7zyfj<;xb#MkgeuzBKJK{}Omx`V56L&&j#=QLzz8L5r^JgXc7^_MY zX3I7p!b!(@;uoIiV}1zMsa>vVeF#!@SM8~`K8C7c3M)iO+t$Zp&*H^b@RwhuiFwAc zQnhv+)2O>Yr&>8~kJ`__(lI4HPpDH&Z+p&hgPcB-&JoEzqXV9K!6SO{6Cs~`fiJ!l z^m8iHCU#foLkE=cbU-;N#^Gci)745Id?R&FM-`YY7yI=|EdyCG25CCOaXsa8mh5Aw zIG+gMcP-h+D2e+?_Ax<<#w7b#Abr~Tpu>ARA2&VWkv!J|Ek46H$yAT`P$U)JN=8$Q75`c0P{Cy=m{G5hH7TeBFvJTYYKbpkqP@AAkM8BS{n|td2h3 z{M94r&pc-%sM?*XW+@T5K%0&}b}E(x@91M!2#zxG*(pV>M@Jv=x-Ba@K9-5eD%HoD5L|w@ zG~D}xkQZN(K#o+O9%CPTDzZ;M#~0rSnxmE}l&c-I1#|wCSixj4*nN)9%qV|x5u{-&AKI~A&=#nMkQqalg()`y*i%0%X z3}63lu4K)!t)2LP4X01mOgPZVN3voBLnl8HL)?k4rb4<8O`|gk7f)$E?sy*We~s@3 zDsj8PB(;!si7pyh)M`%Gv*;EoG@s$okpbJ8vy=JE(tK>E zMI%lBX^zP7jZxSUwI@o3KmR_y{!Y+9HCPE)C}xQ?A6;~o#uRaSN%JwwF66Rzx{rYj zpFbwmQqz3o1c_1D6Ll=gQ(b&mN200;cR>vywHpa(#Mo^gw>;pfbk{T8m!9dq^i21q zXSy#v(|z3gq^G+2SgqD5^ody-BV3=D!7&&Ta;!yyzIw36I(yJ!j=#jmO1cHkjG7mP zQ!xpZWY9`}RF|+gP*#u|Adj*CbAx#SHUxVE911!|p?B2eDCzs{&uFFE(9Nqqi>WdH zXjdQK{wPxEF^^B;8nsJdTXaGUl45$fQxiEe2}mzje!r`avglpWA}NpF=fJ+`gV9Ke zNq58YnbvZlUZT+}rcVqG$DE2m`${S9%!_HMZpTa;1ELF}F)n(Mo1$HG$7rNPr#Wsw z^hgJ0MbC3!Uf6M|Xvn+z*rg9JR@z5ykQZQYa43+I8XwGcU|z7ufknXv2RcXfj`CDD zA5||DQnR6_y8EbJ1GSstmM4X|pt@x3?(XCATRhdnXC{oBZpD3%NeDCCY24hmU?@ z!06#)x>zH6_*fyiL8t}oY^bGN1DyCp6co2@%Qj)2Yz3f#H6Q>j1V-r%~QSHTB(;i zgI+$Kc@Z!DDDt1$D4{=-X8L0N&h*9lo#{(jmrNf_>(bk&tHEXW;o&DeGOx5ii)`ho zK0c~miF-d4RO?FI`w(7q%$4_gs;@g_UmtNzg=>1JkoUh5(&8&m_4Cp6Qe1N@?oZ=u zcL-IT`CRBMWXQ2EDe3$9@^JU_ap^U<>wXz@+3zS#-kAM-q^VwfUGV+c&quzR=w@&! z`1<>}_;!z^dOfjx_xDlbcU13UX{vv*rv~_V=UX99J}2b0cRV%7$Ggc2J(+rOr((^W zLHwpr^)!fU$ev75%a2Qu!VEsW?R97EsVrYo3uXBzk|pF|AFIUOD#yp;?G;jFV2&@U zEKd#b@t2Q__G4cXC1Z; z!S29ghi2E}@mKJUbSt19xV!%!`@YkjlPy*_CSHLN?gJ>5WeFepeSA5M?M8NT$$wAmI@{@i1rr0W{$qr0Esduo&q20oM2KwM)HG;Zdp z(LOUvzuy9%ekV+WrnvU{2oiGZ-9l)HAMJ~7aI}vWpNf#nmC-)FOQQR(kH**H&Ij>$ z3w-h^28hAGz{dj-iARQJ(E?wxSrzzr@Np47xI-iEs$#$%u2 z%Wv`1`3;|biPnl2G1iyL6XSebbS1948MoXid6LKZh^vnV7vaig-tUZ{X4kQl!K-hE zOa$F|p9t=}SI7&m;?1`sNXW-u2%%PVypL3>?lRRNZncXQ7OP3r6wK4uqWiFJ&Ip4U zW|cud%w{^rwiW~Vd*@zRaHYrb=_*rU5|tu-Ot!&nEC$BfWd8C!ef0CoeH`^u0<^m_ z>pu^eW@pm#^`yn=|28xw$P6$z*cG5v)Ttq*Bf!Z2 z*=@tW>9O&OL^sDgy;x%eo%t5CXjD(?1IqpVJ~CMeyMNWJsu*5%bXAP6T2vLAs_v?a zQ&rbh!`y8Fm_Tb=EW|H#h%#x zu^3-{Vs*@_KBqd4RXN9dkAYtt*vQ!t6>*Dq&5f)|Jtwa+k{JR(Wt`my%3u&JaHjT zUD!4j9b*T?A}h8q7L#J<#d@51S?uOmY>V9!i~X^^s-s`^@zpW0`mE}hQ+;D~Y@sRe zWcB14GVkFU6*X|G1_Q^&`;I#ua%X^bIdN*;E_KnR z?!LN6s+V358TIDZ!}@xM>fw03JjOvSt&dIhJ2XIggFX#p*8U9c%xZA50XjGA*AQ6^ zS2x72hVhM%*r=!x<~Q2h2wNK^HAYI~E{$bCL6hlC1WXP=-etv?q2#jpmx;LW4{oB5 z2Oh-}KYOak$2E83zGnpe(w6oSi7FbeP$CZYMLq`V9E~%&6^keDHYmb0NcRB@i61Y8 zm5Y41u=gS#>0<9L@-Yuf`A6RfY>~LkA|LH-I-OE|bQPs-kq?(=ZZg+z%QV*N^%||1 z5_k$7fi@ZD^qkDq4V^IEMNt{Nvm<5Je3?}<1lV$g0AKOEaFJ9+Ue2io@ z#>HHlk7GE~ald8YQGV}xLgq^Xq$xhS`r~{|@JoHn_80k{D)#Z+34>m?pGB5k;H7V;XNU@2)WLYgNlpT={^n#nBk+zEuN5@g|uj?9A#YB3?F%-_7T8pNHcgB zxd9i@T}$6Nntod|e9V!OxHEjDit1j#AR~Piit2ubkA-HNlcXXC(v*t94lKdW5bSWk ztukl$NV9{jbY5b2hJcPxZ1Qt_X-e~1gm#9HCH_t)S>o?-AT7uVT%TaD151LPA>gW= z^F-xDxjv$C=R8rnon%QA3j@#akr6#ATKZ%}=R2@2`a}qhJCGYw8Y6vjV@e!29Ftl} zB!^?Trz`PM>oVMUljo3-%dQdfBpqo>d_4I&-h1CkUKjGWFY(n65hUb?U+` zq@(B+OMG;c>hPsLZvPoQ)Ln;X8Oa`lzGil0v zAAJ-JVe@@-kvvNCePozP@YDhypMHn$rzlS?^wBP=V-$u)W?7}PmC(9!ugVxxxwNv3KNWR43T>i0ME|?S)|I=uULF2< zvYC}+^b*+vEaV1rjTT9gVZN4yzGNXom-9Jk&tMjrkw&6E#xW2^5`{6_=t5p#f7ffi z+}VXb4jNWl6mZftCDMYBf*hc<@;rBTgqkK&d@q z(aKNqQ5NhCq^&*Ow)^;fxeV;@{~_vkJ}2VtejnB`==TRF;^F>i2bTD&9atKI{r(Xj z?SgLZNatiTv(U$kV5O5B4%$T_KWcOo#zYlH;ZW4cD4DWjRA&b|N70>ap^xt3h`G>5 zR@6|}bULb4wCfz*)q%q3X%5VeUK)ZW4y=jZ8G`N6*l|85b99QC7ZU+p92g%nJp{!L ztd1#*!Je4CG1wQg|2)y3IGLm@W={XDhXKzhbY-{T=9E zInRN-%3~^fY7u|eVqgJH?TfG)D8mqo>6Uqx7x@@$g-i7@Kwk5Ud~8yT7F$I9IHSb` zwAM(}=W#OeDc#9LK&k`9SO6@Nm}FMqGtH$6Lb@8{Td(5 z?!sLkc|@PIQfS2-*sIhAC6WxaM0skhk4NaZxz+40tQMv&1N4><9X)OsDoIN+tPx|yHePifg+uiAtWamDEawtt z8&^ZeR48J3zHL4Rh;4D35Bi0A1ZQN)ROTbL8LoZ~pL~IK3_X}FS$E5P)NAIEJomPc z=N%c%Rq#~N!EE>O)O+~gdynY;ryO}g$a^0M>7}UI+RpPN*x@6QcB`J^7revA-@b`N z{R;L-x+`jccKBEzR=6EL77EzuBlarX@;Sa4O2rmqs&@LQcNOk_08jptw4I_}VW*F) zZt+N(Ir8~8!qNJ&lNP)Y%2T_1ND8)MF`(`8@#>pcjsX@qcD%(ryO^<~>nt|eL#%Bz zoEGcpK1%)Nz6@UaZyM*yns%3uH$THS-=Qs?t9sEOCI*)2YO}&VHBe))9-=W`irw$> zk<9>rF-$YK%B(gr`DfqYJ7zQ7`fS<8AuxSeLd!2!e40lR$19Spf+ z<{aawB0UFKDp7a&7#M=_ETgkn5_9eHg_9`{S(bg??qj4LqeYS*g1r)pQSM`32r6`UgF%MH^2>b`oB2jYObx+8 zv&3Mjc%7B|SSs03%Y9jONXG&@feHV8j0wRUyWC0UhM+4IO2hm--&4DNRu#MNb-eWf zK5b3s+ICDdC^h<)Dy(4P-gw)flv zUtqV7*WVJ&I$jb5RGr~)IJ||uVNLZC!R!$4}@ojeLk+b7S}x@0!A0SBj}wL_~18B?f2ou zG6BKOw+Itk6Sb}vbp6e^ z2!6mvnYc?F;MeY)Lb7hJWddee_tZfj@v;aw$khnn;|G0|h7u_@nkiW?4*FQ8%QPnW zD!9+ky2P9MWX~`sT(05!sm{;JSj{$a^mEOyx62?Iv zJM9UEMV_(fCE278`B)!!s1{DvYFFDM*QeT!YACO^yavi@#K$2au5}!S#W6Y3As=(1 z4o9J+^0La`eLCu>Vsh=M}0j1I^O&UpL~ZOhAFJpWm*P)^0gyh3i;t5Lbwb( zN~fuuu;(!!HEN;hyZDsxf5&`2t9Sjuh0-L|iJRbg3X4^w<1WQguE%_wP$e33bcE|k z8}S^m&>ZtotEop)+mUxa74AJpmdT@bjIJ0vlr*foo#1M>u(^uZ8qluAj?lRgr42aPV0 zC*Y)y4SKuAc6nQ$^fA#)XSm)<ROl64$t_f9smE!|)hjh}qen$!PV}i5 zbg4A7vd12>4p?pm0uxaL^zpNOO!kwa&?hQ4T6*lpULehm<91?&MY`mzsPNI zcrViEQ|e1e1mqYd_pR_TP;xX^_!u36adx`vnC%boF~pxtr&1rRHjd<|KJ*CnF)DgY zG{!{FiT2bfAB~?D^88=$mlpWj51u;hqt;h6uVTEJ!%Dtf8MM;qpbyjIxs^d1ljGza zbf!i>ovksR6<#*E9%nS#n9c@$!fx4Wl=4)|0GGaqIr4+H3UI><_~;i;wGJ?m?qRFx zT$ax0z^S^F&SwE)FT;&*qs2cwl^7tK9!-1IAy)by$;kV;+EYmZ8r&MGhSMfMY%N^+ zwpcscbJd$k@1@gHT%}EbTki2l-u+C-d^wG_0Ur1XzYL@&)M$mSl6JIhfahQHNF<(}=Xd8tgQ5#~gJtnJ?$B7dC ze;QB}h1LPjw1# z)pefg9H8OlLaJVX3#to>YlzFA7sQ`5Ex?sm;g-kn2MWDJyPl1MkjNTNEgkt z0P`gEeOiF+x?H1Nyb{v_tTtPjR_1__AyY6Nm?56+X#sYjzeTpVunX7yJT9LmhKc?v zca~-TZU=hPnJXul7RYo1qenzzS~N@gqy)TI)-RN_;c7GO=~ZIw}0IiZTDx&%zV z(%?#m;)GoJn5WVM)Or+8y@ub~vtC93wxtK6dF>jYgUV2trOwhnD!|jt@y_2o%EvLM z$7Dqx#clx_UgD|lj`Rp{(Pf^>2yp8IXh*NU&U%1G7PtK+k|ZS~Ku0cRC)2HSru$Rx zRXCx}C{Oha@c5H>@&!Tfe1^|{^i;0^jc>+aQBL#wsUz7dz#M*Ub}4#%ML6j{ zm#KT#>y7$%PQWJJ)p)9RfVg@>YC6KoM7;xCagC??$V;tGL)?11Fm)OVdFUCu{AvUV z`3uue_Y2VcO^@W_yM$bFxsWTa_Ei4>*WN4S@#lqn@D*~!yJ$dwzbA3a!B^FQ0P$kG z9}u8ZC>bG(#sL9VD1Pz>x;r~CkaRQ{s`Io*&VfMz9-;|oP=IS5@<>`Ls%-`Z5&g}e z00|<=4p8eNkL22$g&Q_Xhm z?h}(8h=-?)II2!La4ZC;R6C76^1jaw&{x3V0OzOxY$tBegM-M*ad3eCp=6ji?B)bm z%wKdh|5gX-M|E1q8;|n&tgo=m>@nEKaN(n-C6It3R+yd!GtZoLcaV?$XAYh z_bYy*k9SV+JB=47jGO@D<;#;3V7a86$q7)d_c4O&pq43)>eCvN{rNr?`K)uB6JUxz z-5qR^yrFXfFh&B2rk}w;lVvc1X{1Lpi`94reN8hZ2Aj+_gISmlq_Y0ja9dzeX7^Z3 z^e6i$6T?_efHJYP!gvVmuPI3T-~_=YSlyitEBh)p9^W>$On%6$h(*u z;HL=vIYJYu7)lXcSZ;u6YMa6i`VAhI-C1scPVy}0@|W+aW#V4Cp94#{dORRXtK0xb z7&&)B)}OfnPKDyrAxJbS2B{{)$Rw#I&4DhVBs~NfOvRXEN|?PqK$BPTb~}ZRsuxw8 zSqgdd$|~j4y`1XCHo8b-p6!9(Kc=J7v%zIrFy1U4Qa)pzs8<34LjAfbx>_w7AcT4-*@BrWZgx{ohZ+h|Nt1#jr z9QWtmbsEe3S3WG{s%wSNuXK2Tr=JttE_(3c z0lFa@7=sCrjy=%_=mWaJ3=h!%Pi^F+Qwg^Rb7|>VE9UOu0hWRl-G&F)8cLFEck8JU z0ll(@=>_y{;8$owfY@ts=fl!ey_S&LjfFJ-K*$H5;@fy7(A8xh!C#@wN$9&EO;m0O zI3el9Mg%x3>VOe}cw(SLO16v$Fx$*C(s6z$SrCF<5@(thpy>^`@h*?(nj3KA&4O-m zf?FN=^a~NjD}D*`0<;W4s}Pi`ISO;-Va*F1H%}hsydd&0=LM06IWItK&FGSm0XmuW z28Yd2gA&nnj0~{I9=C}1JJa`&mH$TuSgtm*#(aP@c`J+zP$2OQBLmFg_h5x=<2lxG ztF%YX?e0egSQEDI=SJy>KI__#NDRTq04GAp$q@9Gno%PI^b0{giXpR(mMZ8xhY$>w zmHNm4IUyJlf}MVa@2UI%O<%y*3@6AB@HJOh`GL6j<_8jtlpo-QuchCMuM2tOJt3VH z6LsYWNE0wBz{8K@xgXI^jZrwFxEvc5;79%{qxcc+q&C%cqy~-~Da(s70Y-=7 z0s-S>&L>~;BIv2#(bEpKl_DVHc$d2I?K4GTfjo)hxKx==(-vQ=Ay*>q1>*wD3dOTS zut#p`_yF}9pkY&wC_)-J?#&NH_~94$@<&0Ret|E)7W8)~prLI%7foCl76!Qd3S57; zM-(AD>VL=g+b((FXT1x5hx6>R9?k}d^z)-JRuN0(S!hX zntCLc-Yn#nhlSkwu%{*lxbYU;_c&gVT0dnppzY$?<%ItCjfEPM^?dd??0S5WM0NN! zg~<&3+!u-;e?i7S-dsoX4GA?E;DdG`<-3J%kr}DGX3K$~#Z=${&(; zbUt&zbwvR#z8crvhliex7(9ythx^f8iyIQwFPO|d1i_R5vAN14%~f->fH}I{c&a#n zy3CO%Aq;RS4p5`Ma5d@*Y2>;zcI3K8MR@(Ao|+cO6EH21CtzBDdmb0zy^nipx@(*6 z+NKA1sf7q%ZsDmJ0czF9RX5?zXM~|I?Ti3--6z~lcjEnzJXI3lvO68Q&QqmS}x~UibtZpEhkTI)I$^Cx!k4s!$aMSny-d2<6Sz)B#?j-=xZxyA6* zya2mZZ;b&o?u}ry(`?!hR_T#c=*@FI?tMr)KJ~1S-rNEX;d`Z6&!%FKFY0;0pX5v! zJwK3v3j$o+6iu)8)WSew=h~_MbgKy%HSo-~;(w-o-p*J|w4vkm5%r3T%2>iKBx zqqCpkqdzrr`CLU$^-JkvR_?ozN&G+jyOD_&DYmn9Bg@Y3KS>wU)YjKvm?!s93ZwPYBoTl2Sh2bIKXqS;OUb0`XkomgV;J&7hpO>;-%Kz1G@b%FMm@^SiJ6{fAYa zviD)P=UMB$*4kmt7etC^b!#szcN?hVFUD?Ki0n|XgYEje4b&^=6rAJDX|2JYUSyHWE}R!Wwe$?t z0~c^Z6C@?^YpvD*1#hyZL?Os)t$`AyoZiYL)fq@srYRtYH+CwARh(AO+a7D2MzDrS z+G=v(pVknfhmp^@NJoXfT}Pe1U&mSfrjBqU!oX}}2Sq)FTZpsL2>L$P!YZrU!Wk>u z1H~RoJuugExu^K$5o=XCBALY-|KA<#;c3i@>*SX@ATrn`#c_aAjb25KH%D~2ZXy2@A^-NsdeM9eXM(K1ba>N z!g{Z!qyGGCQryUKZ*$|a`;Og>&nucz5iFG(C8klH<-_V}6~Wph4OQAM4Fw*>9^7ps z+gIugM3J*5SDB}<`aEyX>kM31PXjxQS_5fTwuPNuhwbSnA`FNFRVk}8FcBf(al5E? z@ph_1wV%u2)EPLfh3E*Q@S7sNLg!v5^|Lx|>fr_=jM)altvHMIbFD=d7FnxosoJWw zP-~sBr8-Y4I8$dJ&$ZEoD%W)vZn`4eLhd*4`Eqi9WhyLGFd%xr(S+mJZ(ygg+it2? zC{FEw0iRA7mo8DFu2%)gue}KZX&o@|+8eBRd>k?6?6Yc|EEQTT728tali16PwqpjKejaBe zMS~qPFy?1`7UdUSA~zG#iZ1+2g(u3=%XHK@PudeL(+MDb%)lY@gel~413trf+k4!= z4^s*3WMI%3Ax{{bqV7~TM2p2K$=ph*zvTsAL^WeXWqhx-*Y2zpE4INqX{CHB9Td+qaErY zmGz71$*PcP3d+?TwyKayQ7lzfD_Bpcl6h)50Tm1m-?~VvXY?B&Y>o+Kh`ngwiRXm8 zWZ-w7;9IhvHnD^>AVcgvi6ioc#62xi=YIFeMK@7NQ*c?kr?G0fl1 zG8_x-UWd)&CQg`Tl=v{iA>?%fuGfXUVW8V!Cf#i^_7!~aS5}ODMaY{5!qj*bS+oF~ zN0Dud7|3?hKww91?mLvC&h13<>b&N{m^Tgd9gMI4$z6s&iKkv@=0@Ax_}4Ijy#O~2 zq|j1*IRyYv0#Vc|2Plqg5oO}C8+q&;dTQn?iz$H@`2`BeV%sDgpoo?u^ohBnP6Q}3 zHjnw0elo&seS;E0D~gNuA>tV0s|O$^AEgT#7!ka1to++k-A95Hua2(v$T9j)aGb{CVI3#2ED@En3wR9&GjF| zif;%xc8feB(ffXq)JOZ_dQSvAM*P>W*}5JmAaw+sYpiT07_5b*CHzYuO42LjC z%E^s&j6b?dHZ`&$+&9qiQ9-2JKp`I(7&{KHe&3V^=79m9K-Tu^Z;Sgo$>KFnOdmo_-Cl{XxiR6N5ew zGS-CuBk2D)Mm>kuKEeYTst8hk^cB9DOsQlFC3pJj8%&m|^zSdH{3PU#OEB4emtf*u z@-I#?(SL}LiT1q7Ci)D+V{Z%MUa(WQB%4^mK!vF$e)l!L{$3E5$JpUi6ED0*IbJ@A zrh@n;Ui$<7@MnBUUhs4iAN+tHDDF7jL?~}|rK$##0`5IPmg2nr84r$nt16Q zB-0nXg#DY-OuY9oK1n9a9c40Vl0V}ivt<$8#!dQV1UTQ!2>WR!f|Z#BEiP1q%rFtu zl}Wcj`0eNT{96{jok8gaOmrK7!7t;Z&xD+AV(iPHYFE=u{DUkXL_;ZPd6~ps*`(oB zMhv|`mdU;L98D@p`8D0d2HKSGY;NNk4;Lk+KALVKSy`qu72=p~Vwti=!4&ca6{;nw zkXa_DZpt#*{WjA?KoB}VD~KC33Iz7gHsSv$`VZol>!-LOV+rd+^~tl%=C@_G+5EQ5 zHu32VDTs#9(l(yJs5O-GuTeJXXA^)ekF2|U*k_Y%Hmm6V$u@DE@}6C2Zi{6jd$x&E za=lS8ULj|h@aklfHe7ycmWfyY$coqgDCBGt{RsCy+r+3D60;cuKifo`e%#jPQ6{;v zSTZx0nH&?Je}V6QL;`^bIG@uU+9QXUHI|^(FTO*Vq&qIh#NU6$C-4d8m{h=6;hy{@ z-p6@Sa!g!PZ>yMZR2keh6?m|;<9 z^rZ%(tPD%YJQKU*eu?Yy0$6&D-Y^9wo_rCn{1waTrN5qTuLCkkK?<#f z7gA!JN%XNlPqv^^tOq;E5Js@8T&+mM5^b4=HQF}HDNMyX3QVpQ^^5TlDq{b)lT`g; ze7U+o{g21m-+Y9%lv<{Spz~?=?%+20LMEvwA~fMLZ4IRcy`c#@nsTS@ zn{YQhEeKX9TxPzBKEpBm1#Wxgb-dBk{80XV)3Y_-L@Ysa(m3_|d=r&&i`{EIGYd>S zJ_@5=#fM)Bx!Ao7lxniHVNA1(6_|jD3|QT0xYW z2<(o>pTtvdV+W@%DmC$!A5m%SFa+^GPLh~R`}I6|R^pOulqfbT?Y3|wojw8O3ioW1 z3T$bkvPHpmdW9XN)1Au|3QJ8~P_EE5->V|Upy1+C6MNMIWRNWbLX8xA<}$1x>`1DH zYkH`yN~I?#ODok-PQ@Zl=+|^1m)JjTiOD~0iHRqkXC)=TT57`O3%}ulIA1>|V?M!u z1yl7j6Y=^C9ZSh3U8Qf3>y!y9HW+(t{RDNgiaeESc`Y+BSq&$wUmlsX8&s4U z8|+>UWLi8=X(3{0g_~oP+WIPNr3k$1z+Dt+i02pUG808wgNA!rJjGwm)-g|CqGPfV zZx5QS&!bSHDjl2ktvW92w{#(woAB!(WxdZ3!tIY7O4U1fq6D6342drlCE;Ezs)iC6!M0;NpBStUZn6#kD@&}Z@AR6$+v*RSzk zoQbGba*{k;lyoCjnCQ|CXXHgGi2uziOzdSKL{KO6d|eP%PWQ|f z`t0A86z{ag#4*|~o>A&m?(klS|XqNi(#zR`Y0~4K1qjQX(OY4jc z1`ZfU4O}-UZCWK&ZMkP5#1UrCeDW7ko~)2Ut~b&4Bg}Iyb21-I$doyl3lw4#nOed% z+;fE6jp156rM;n~E$dCB=o_g(m5GgnhK)3$4J4J2B`1&QbSJ73xNkyGg%ER+FQQwzca`Y-Nk{dJ}WWYgVq*5d`N5t+-B-v+x{wxvwZT zpzO91tYV@Xsv?{t2iKb@S17!Hy@_ao?PXJ7-5Pa0N&z5UQziRvpIx~j*dbqBxYh0_Sj6l9%&%jNHFXaKpB)=|3-_uEqGjvkzg>BKzQ_- z#v%j71|_XqZ#HGGBgR$c!gAMY7xyf4Eq7tHYlAJN_|EXf9pCsCn9?Gn1!lI`-2$up zD(y?v)JUb%*PB?_qQpMvY~Ojl*xlkx3!H0lqXq7^SlANF{8rgxni>z=U1M7&v=nly z3G1d5a+`_Hw7cA9Vz1mMaX`*dkVh}eXbPpgs6WuTQv^jSJk+yl6RI_4s!ezn&O845P;imRm6yHX38! zXYTdC;4kko_g7jT)S8GPgv>;R^7_@9;2_v#{A#T=v60};+a*BHyKI3-`>(5FwwUkh784TKEy;hNg|JoRh3-+@qkH5#`+Dx&?f~6PyU9 z&w7*hto0`PJ|>8a{}YoxeZu6^@0d^w&M8_x2qM3EkI4_@12}C$`UoZ_6T*<3w*N(^ zO$LaZHqp7KkY`P}{L!H!bN(IB@d+W%oA|?D@Ym0fM!VZd3S||)U^05=g30Ke3nn`s zE|?(a!xa-oFCnj*a0Ln3Xp?I;xo(piHo0k&TQ<3ElRGxKYm<96iLkIvIi=vda)knE zEV7x6$d<^JWE_mPuz}u)R~Qf%{j1h^3x-R`1Pg|zkjXY#Y{3{Rh|vFHu?4puOF`Y3 z41Gb!5)0!A2xj4xxAD%0ta#;3CX}hY3BOumA(SCJB^DNveWyZ_9i_x#3>WsWNv2t{ z!73#d_RA9z_02se+B*}PV>5xQQ&j}v=}(7oU{*elAJnc7!zJ%;U>ciO01^HnGy>j>J$|=_L!w;mCtR7 zy4Gg)s7F;CQ^`hLVu7l;;+FcrZe!_ov-Cg>2O`*-T*}v}_Xs>bMv%~Z5R-O~Fd6>} zzWo=zCva4$g}2{DqNI5GQVW^3Ip`dv6SV9Ij#d1^YL+URrAoW*c2m!D@)m)@qZLeJ z?_{Zk8@7t_dN)gVnx#n;IQX#VBqc;ah!U*`S!O|cGEtg{DdY+Zt}#NETj(|fKW5S* z-J)=mzx*iVDvK7_UAhZdVIf7Xrlqt6&Nse*KFn(=+s|%xT>K~fNkV~H*h$%u3X~NJ zR+FP6QC(o`+dsndu25D}U=&p>sIX9>u2r#}~VStw;7N0o(h>Sg*6TIm05Q*n)L7UnY! zahrvD#&2)45W<$}Z5EO^Tf}w?E^l~u7IL=*S8pL}Eoi2Ydu>u@!7mVjZH3%#!QDd0 zgBF>N$Nyf)qZZ!#1fPXV#K={WWwQr*y=Zf-m{5gi_A&*-K8pR}p7v9G$gfer|Lho1c`kVMe1{Gr<)Zb64ckt2Yf@CToA1hOu zdz`i~XoMg#*d~vSVd=HsG5P9SCf}2_`83_hv∾p_ISKr!CY-LJFU@njpgs7Fx9x zM95u##)9;QZ(sBuCrD5zxq=1NCc1-_0d1Ic?#6`hdS@)W@kf?E{F{(xE%*eX(y7d!8y4z$L#Xsc8HB!hM7JLGjw4oA87DkN3sIeIL z66+|g>V}1v|H#rOv^2V5A%gRZ-JpLSfgWyHnEHzexAI5hhJ|g-%sI+&a7WT<-mb4BxJaQ%v3Lbz#Qqr9juRVpp@f4A|2>778#W2W2RE9qe?%f z3(~gjgt4y+8BG%i8RtMi7bdN25@?fD4vUO)Ag!56XC~RfrT9}FaCH(g-GR?mQskcl zQJlvm-GMrV>U^d<5UDOxxl0@tP`E|~u#j!4=?+`9P}@UUtx2NbjdTYtYn3_=S+55h zLQZqw#oysmx`C!S@Vif06D;XNli@(WK^XKRPJ2Xn3K9vMo8iEh!4i|mrB)#iP(p|- z1=-4c1&hg;U(WdtG91Wbmsf@Zha?rz$Z+5?Z6_zGWJjMZ6Mp@s!ou#SoPS{;@84jp^QG=If8)t+H1|LP0}Ch9Rd zk0~&g7+6L*%aY9l1Z}uvVxkpmVXO0slY8tljv34(n^`6^Ax<(QWIE9M1AO!Yf@K2b zrkP0r29%IG(}5?(3L+nU#bgR!y%`P+dIDpAhp#D|VWtD$T$H#<*4YSJe{o6uLRuDG zSM~rIj#4KootYkjx@Hnwbff&A58&LnO>^9I@*G#R83yJW^(IRfDV(fP-jXcck`W5m zI>c;3L^NXP&5wl4alrAckaHa9G+fAh2lC00bC=@tL)Azs+P_4_F2*J0J8&I0fqP^rE!QeE z?te;ept56kbVL}0I?Z=rg?Yo|wj1VJi<#+;l@4rn)HqP4zI&rsP{VMh56pwyiw=9&zlGRQqQW+k1=`tX^j6Z zRysC2km{V~WL-YlnM=8XcD@5!7~z%gz)6`;v3U+0=YW8G2iSHJNs#Cz99{I2Dpuv0 z)~VZ6Y-?^iq#mO{=xcUc1Y&>~Bmi^SA(8LEG>*E-cVGwVfE>apRvQGXH7**sWW?J4 ztOl||Q>}MC1XV+2rbsI%%+MqqF?t+D5lz!szm@86?9mR`SAiueF2QXFw0aFE|9#9p z{gjRdooa;TJFrhbYEN}Xk1!BvR2w`v)tF%*%b4>sX=bxD$0(v4(oH?%%o+BnXPJdI zGqaglXYH`Bd}T9JU7YVgu;+YFg!n}H@Tnxb z=ee0V%FSHu-R*e7Y=*XdvRN$caDAOw|UojW1n}3kC259c(kSX>LI_y8=neU z#B%!qLN0J1u$PbvZL-(_-$#WE4h|L&gxO$b-J8uS2P&#O8mGC1oG5USwg(|<4lqXx z(-Eha>a4#dCz78pl>l-fDoXWmC*qxlo!q#Ba)58L^&wO}IFA0gdra&%(=5!i=2%E^ zoN%DQ!K1S1-?PYxRn6nGj64JLjYJbU=GI@1s&U|gW1@fpM`DO9Pg zSYauLL;Au5W|M>L5@o`;DG8SnF7V`7geZFzB=e0CF0jj%D9dEHz{`KcAMaAlBf(oi zgsAg?26ldg3ml<3c8!SEg^Umw`ZyY7vVwFzZiK*?m+|s($!)uo!<5C9kXI1`+2nvM z#ad0sD1p9DVceha^#sY%YVvPVxhn)Kk(4?ljdp8`=pVhB>O#=+EJ`3$O{Hki1u7b~ zTa<1>;F)*G4fA7y#ByGjMGNea_oX1_rZK@pnwe=L%d9emj1lNL5ToOpjB~~EhGb>` z|D+r}7SFzbm*2*_ALFy1hAfp>D-YUeN*)|fOSn0V42Tu*ABd5k;j0vh3`xj>cwrY< zzDQR3nY2*5q1;svtIi_F)oK-6X%kpasi}gon;=#zHLRwm`jWPu+)mXLp}mtbD%I-P zr#Be5Y!p#4)+9^F1VM}Xpb;o0oA7ONXcnrARc?6abChsIO@hEbX}vH-;E^tPbPygJ zFJz)X|CgD3NYKe7fqHguBne!S^As#q>J_A#xegRLRylCWk?w(Pk3}BX=dr^Rb)E$- zEOw>2vDjVa7BuRJJs|txfaHe*&Ugsw@x5qI=U(VlDTT}sY#$@?2ut023z;djUn1;Oq{6sk9EX(A$lND2)} zK_i5mE)duaeILW)-{D6x{7n~x3(1#Mn7os8c~XY&SmHlsmFSEdVOXfrfq5lsHLc1hzgA$p9C z2rI!tgd@p;B*#GqjyM_|+&ERIY82B2X6XxblybVC=>psJ6FN@l=X6{r9DS6LW^(s5 zGlL$TBLsrIWUCUb85Xjv2#1if1X^~+qkqN+U*Nk*5~~SH!Rh@@%1o*jS)?FTrA(-^ z1SP8b;yX-|t0ij4)p$UjlsrWytxSuQP*up;0;Aq!GL0Xn9Dz8b0Q0dJNO2T8P~td1 zZ^3&Gq&Rb(sBl&}(dfM86x8=7y{qH(R2{SRJROUT{RWO3sRV&pVB)eFZz0vnvXE~T z5l%-SN>b=uj^J=VTqP)GqOwBe$teC9Thurp9rMAe#aKds;b|I6vk41QL`lhF^mrYq z9P^tautMLhbB7iBhGu3hp?sU9`#NQL$q{zN^Hg(|iCF}KSzul^5pSi^f0xoo

m6 z%PcIjLLG>3P?6~zfkH=#0|y+Z9XRc{>A*cl3YCklaH7iDX#W>(IVXEyvd3-@?DaV6 zA>PNo(JpC<1%ms z+bGAw8I4tS+Chrlsn>8uqwG<01h(jhbsW~`Qia%JL&#i#z&B7q58QF8c^5*j_=8G@ zilyo@6*tuopolg|mnkR2bgh6=de&$N*OLiGP^aUL5p3cl)qbBrSFpjlZDEpwZo*vg z?-Soq5U&1zHanS4a|Pb`7lJvsAXkvVGFVQh7*To&P;0PTw<0cpbK%IY6BM#lBiB2 zhY#xy04FHc={_cD2+`s-o@*P$>C|X-8V+gUI+FGII+p2sbsW+u8&j^pd`i|+rytUB zT)$yov>V191HtA=lcz|spL{ATHdo-QJc(juE8QS_Rh(4Ms@P}6IxxkN>_C>I$RVg# zkvt+%VO%5F*8>yb);n|4m)Q5W@SgPAi3u{F``)GQR3u9w*}7pNOl?z77X zF`3CV7n!(cW?C#A;mcA;-vubgi}si;t3k$KM^vBkV-;%c+B$J}qL>j`RimceX= z0<)}x_Kbzrb}FOVBrUO4*y{BZSFnW(rxglZwUQis{Cn0!o0;f{bqG0MAm6jt6RSPf zdZNbjm?uJAQ(c(ln&ZMr_a!$bdqsO;idT{sYP?Q(;k;LfHzK?vy>ZI>k~i*p-}6SU z&q^QE`keAXy6+NSBoA6K7*RuJ4Z*e{HA7G|bjeVZ53L@G+M&~iVg9h9VF(?bG#oRA zXAMWg@C(CnYxwQqSU+O(2qEVSr~qbah(%7<6!6d&bZJyybE%=yiturC1R{SOYn z%>ls!5iu}oAd&{A4aCfWa|WVlVDUgy46Gc8tpj%r6m%7e|6fcJ7myTy*Z~Ls$45Qe zdubo+?sKpYj`ykWgP6X_eUaLCQD0o^d#^7h^^59(s@I`jIM=JO7lM0- z^cHfyz{h_T^pn5*C(rvMr3IKTu!FD&XV@FZQmyin6sb<7n2Gh^5j8jh9Kkk9Cn8YK zWi;jsG-?q#qVzOMil47zo?b$+p4B=+9$WPo53JW4X(1A9U?T0I5{xw3NafMjq|CtP z5g~TBDr2W%_h;bPe1Y3Wl*yV5esRnfs5Cd)nv>=v3n5mz#qD$K4{N1`-PRck=dBbc z>rBc4ZWG_T}P4VJENnR;lNb#!i!U?bQwkpIs!W)s^r@Xnt zCGWf5xaXbggOxtDJ~-u*?#ueAEwWlPF&Q>f)#6|a9BOg01@5<4(Gu%gR<*>wmM2<-`|#{$j-;7Y*l08D5V(F$3u z7PUfgtBtL=@l3##0A#i+Y=^8K3wofo$I%`*-s5r)-0Cr*C+7An=!qr0R`ue(HLXs! z!s%9*S|KE9~|s+ybtR8 z-0OqnzNvk=$CftR+F)Conl{+mW@1~!ww=)y1#RcIMQPi0ZMny$wl!^0(>Ajm*0tN& z4*S}jYRCF>?XKEPMEj}jk=j15J*!LFZ)%TC?d#g3q5bvtxYa(hBkMCeW_84djypSI zXUAzlSQfN42%CdygSauJ)2vRI)oEKN)OL#N%&LUW8J&^Q`Cw<%cfMe&!n@>jL2j27 zUARM8*DYO9-SuEsobP(KD;{)>v|mw?-D0{SrrTayy4Y=EcTDWQxjT1r4>kR=`m=O!z|8>&9vCqYQ3I0(B5mNzftWL}XdsFQRt&_hfzg8m zJwXQtoF2gaqX#7q!n9%YhoNX#=x|o87`$;XHV%#&f>}eh4PjNyki$c8cu3JuEE!rp z6xBm(hq69t_>AGm8s1sG#epJ$WB-3l`6@w$iUj^L zQ6iKxVHF8b^|&H|e}0c2sBl0LE%j0*GC3f=N#YZlLn&{Tkl~mYz+2>Q*@T`f5;!OC zki{cHL6j0pd2Uh_WGQ(H3OH1_NMNlUd%1%${|L0{jgimbm9J6C!7>X3#{N?5JrZA+ zQqCcPIfP6tvzLY-HG7cP6<@WKPH6mQgfU-QO2?+_oP_*A#V z?v@k%5a}1^hdu3U+v8@3$d0J#7!riYprjzA1uY8_bo#&l6aF=sJkv=MDP(i5AU{Iz z|KZo1)^SPapLEy2Wb^;^?>g%Bi{Evgz9am*E>MZRu$G8xS=JI2EvxBgo^Oe3E&oTq z^%`A|O<1gUJwE2&@Rij=(*Eh-;nH8Y^4xZH>m(6WU;Eo3u6vZa1kN z;@jo6Ls7d;?J&Q6ReK!iaH#_ys*&#DNlFx%3+Jm?Nx2>_GMceiAdmB-6$=zvOKB%v zO&|Q*7AA59nqq;wj!-9Ny7Sz)OW)@PughLY@y_-}ws*ZZu6f_{MvPC24<9MYneN1F zXQLBIL235yJnTH_#7XCQCwFM{40d6HD}h!5%U!5&O>ncmz`e|kDoUyl*|DZ0LV_ag z(W^SH?}+sst2=V9C0<*+u+^*1i=}+O<$la8_uD|L*u8!@NUPWc|1JL5=6}Q=$Nf+G zbC2BtM+0yyAi5RuS}kjZRjn?!LTwiM9{At8af@ofqxK3lwD%U9VDE!yMLbw`kiQtN!d`vq#Nr}KxNgmn~ zdIg0k2&3c_naUxu62z-W<`Cgh0snt;MlNiZ=OwOCu>1rL*ewa;d-z zFXGj=nEUc;`YaJtjl~J{1`p@A{8E9r^vR?mHbO2FoEB`Ez>oAzST5jx3BO-KhP=xX zjbxCRq|8;2uPml0X-a#sTp;deDvDoOE*QmvEk7GXUzFtnFa2H+x!n9xWNEIFPo8KB z3tSH8n)E})-!niCA|6u-uyt2-1=AYGtc9tSDT$!RG`py zY#sM()`dEnIjxz=*(Y&ipFDh53OPYw7H1}&AaIDGXcGj|Q2=h*g;g5XlkI4~M)tli zfmq5_H-}tGg>sifojgDx2xq0B#;IflJ4=h25~WhXUJBx$h;(2f+4z&l{&bP7w6T=U zx>Tx)|#lJEEXrp#(dSBY$24e74glvU&mS)*c|nhrru zGv5}JmZ8@`0%1S?2CKY$LAbP7fsVacF>nZmJ}zXOz~CnYxzz$YFnP2)20eu_uOmdJ zO4bY>#$?RPO!^PPpWk6e7afIzs)oMHa?>Fa1qU`K3G$eIyISJ5PO%J00-5BR+pBH{ z`>ke^f%Lq7TW4t{10s_IwjhMkuBB?2!7hL#fg1h1F354!XAsU3KKVMAflC%>9fY2} zxT$pzlb{~x)dyK>w#wq*kxWL8#^`a(J^LFbpMB3HkFp3YmFp;*xnN{DYRSTSjGZaT z*8dlLZ!Wm9=DY3Z7N? z(B~M7k|N+6gswfYiXjmx0_}s?DHkj!((9IjD^dhzlDn-))<|xtff^SG79oX&HW+W5e zHW>Ldb5B2u=U!u9U$-Za&1U*cfezj9#CRcR2m}lgGE1PtFsxzMa+ZL92Mim{+R@M8 z+20_7VU1Y=iEu4`-fb&pb!KzbF1quI)L3aP>X=v8$xt zAK8%Z8pO8lC!a%vjFm#>3HY=ZGGD+IfR25IED-pxk`A|x(0JGBn2`$RQQ&WyI+LPB z7N{su3xP!_1NY~ZQLw`9gLw)TDzPeNs&iBnViAO#C(xn?Z^U1IlXs;t$_xS-(O0-g zV1_cAw$Q5;Y$W_bq?)dBFUA&M{YkYzz^601Y_&I-kG_sKW>NA6ijH3(Fk}QhhHr$B zigG?Tsm2T9?4mCV1%E~qBi~)>#%lLkH+GTR>|Ny_n@Z2u!0JkNXLLbFuwy5hnESD1ZP3%pKv@#)?5O0X|Nf_J6O9Asos znZTiDW{1yt`#-ajnWX}6ZdQ18?cWg{yYO22>EGfnpEB2^TTbuevl27ZJ1Q@IXV|&h zsqD~lf%yc#i(&uxa)C*R0+MhB+;f*!tD#n#uM1iO`}o1HGkT2Vb?s-d67l@0D;LP7 z7i}3QUt1}D)^C+S1?2>&(#~tB&?g$aAf3oD(yIgpQMKq(> z2z*!|12-0y?hw=iz5jqBhM6A_c<*oc`*g`e_tN&kE{1VHAVi5#a8iu~GEB-6azG$PsZ*Lh z9xN5n$8C>&hA|ulbwFT?cAa+A6Ld`CmG1$8YHgRsN7$vE)NoQet>KDx-BwM~BXn+? zMw14{gpL z{f96&^g|&}3$z@DQD53z2PRK`Ddc&3?h6m+zW8wNOZMEC?YXau=DCTp=e{m@?i&y1 zCa!}ZLUY@DzP&!p8@zjTF9r+ve2rikBazG{)g}u#x(OL7@RxFl4RRA%RZfugHH2VK zISMu@I}}hMI;5-FDoQCW$yxQPiZG-CE2w(WZu+o9YEv{6Q09@%+ExwQX@j^=yR6~5 zmaX#<%IUG*L>D)Nb~ZUmzJelU6J?sMS8$ym8o_G1ifpx1#RheYiX8+YxJtQqQ;|uy z^A%KOXgAe8KMPz!BxPP%p<%VQS;JOsJ7GljX}HW6HB8v`jb}(qP-$%&CUBO_IFv*T zltzL#HIIzIi+{i;6nhaS@XdFutds}Iq?4|&bejWE!-Q?GnX5*C)pIFcYqh$EP*{yB zg9}@X!*g%q?ejJY@RQkO-^!poR|2m_NJMi)Pn>|)vv~JgA*TrV_#@yk<^qD4y!Zw_ z{2PL0sKiuG5RfR)a|A|>#rUrgLUw>6N%JQPjDL~09n|_9Uj8Q{$bL{O(-c;}{3??? z4u+Y^x0ru_LEKX>;Dz7wGQ3kS^d7++E!KH0K9xfNQUy9qm55cA+bi@g@BYMp_JyEz z_SfHHmYgTCTs>y5zZ)JdODnmoeY!ve?XZtg)|-n2RoP58N&^9U!fBhGMo6{!bjws~ z8#G+fYADJZfrWFQ2& zz+zqlrwc@DX%tH#FoP>~qzf$3R%zHk0GVCdenKf-(s+B&{Bt%ajg*8-V6QwaaZS?e zG(+HqvQtH^ngZOk%@$i};dGtKPsZw)rf2IY)|XPzzx|YN=&XqZi?B!;{BwTa^m8(r ze@=$LX?e|tE2iKk5UnNAExf}%nKVMT6{7}xYO##^&Jf7fi*?qVH78okOtca#L2$jP zavD9q2PwgqeeI^n9EqJ=Qe(QH3;0U~UB&5w3kcw#%(O9w2jy9bb7ZxSh(Y$zXp@y`kcs`anelHb79{;d2PJxlv*RZrhs2 zzCyt-6!vYLEfA~BA)s)CiX49Un^mRCE(JBT^}Wa!I$K~fhel=#99GZSh{G)U*PW9S z6$T#m%#z3<1H}||x!vCT<6kMh{+4^5ArIn2<)A%oqEgVbLo4TxaxUFd`zViNoPy12 zgNh3(rK`*pD5qK<^~xCqAp`=RtFBRbTeuWa1~QFZ2KJIo?2Zv?A_>(T;&R=qLqZ&-n|R5eE6i!YHy*1ox1?2`~zWVkvh=PHa; z+NSJR5J?XyWt2i1w%VAhP=d;)VLFx3q35-iA?3~Atv=*OShC$UN)^j(p_Zc3hc(KalvvOT|d$(>N7E~n_FdB9Q%w%SH7 zp|iNG@hr=2RSj?!dA5qq>5ur7&Z$V?+kbMuW4tsg5(uZ1n#>bV7y9mugOvhWzH(rZfhtqD{a*;rCr83%BXVRz(g~{?l62b#(srO9JN*| z@ZXaq!r3fbDv+q8C|JQKQ7XVu1_=b4uIF@fr2^}eG!+?Yp2~+`r<|pA-PC4jpY5f% ztxBf)(ky52c`^x2;G>ojc3I>i9^mi2frM!qL-v1om{tG`$B2Psw6;azkw#^W${Mf+tO0B6BT&Xf4t03^P5kK{{QZ!` zakAW9r)^J|a!|nu%B6EjNmVh2zCl~ni+n1%KWj^-wn7yNu-mc-v08;)z;4zkWRLpu zf8&SThrcJppMJ?ZpCDeQkz1!oqFAOYSVU1U#VuB~pyqsazDo2ErfQg`Jn@y%d$DuLkVkrVo?bB6~md1QH_ z(I(u^xSH+y2YXOs&uuFEdOyVtl;@6+f*ZHL_PUP$)J_C}pgJ!`VP^SzPp zo#KNupOrqS@~LC>4&ORo)cIcW#TDO(7D#F_oqtS3iPwR_ekqwuuNQBv|rf_K!DZBy=K!B;(uH}-vo;fX)voe%LTZDYa&8DyK;6k7UZ z(2BjG+2_Q_>4{{|ehkjv@z!UcK{Wj98ro_O|) zX6`wgyQ5Me0(uQ}yE)gFz#)Xvq>gKpvlJ& zBjDeT-w)jfGZ{XPUlaZT2Zd0&4) zs^O!Vy!j5^`HZ?murvEiT!FmN=ra%lpJKm&yFU{zoAe)oq0g}5rMGzd zG3Ey*lo)!dz>fqXol4(+Vp0TLZ}5iXjVgOTLZ+590iQt_6(%u7CemYcj#Bpu3>bt_ zWANN(`0A%7UL!WO4|*Jrk7D0JqRgOpY=M^jdB4!opGp5Acyf%8)5xd1o_2f-6qHa_ z$TQ@ki6u*FzPeK79Pp`yXc2Zw~b4sIv2`Yt+ zP7`RP#D&Rhf5{M_e8E^r<-Imis;}+xlEhVtHA=SML-%MYI8DVOiiS9*o+t3rRTbB1 zGaN-b?`8Dz3DzcQsC4XgAkrDM z)*=UrohvAiTA=GVeD*I~;*Vm6;JrbHKp7#_R?+&pT5gxPM@IiDN*A_>F*F(U^-Q)m zODD-_wAT?yktan?tZ*K;CqCdf;y|vm$d;z5i&QLAD^)(Vo$5ZaB1GAnob&1x6<5{k zDmYi#CT)wxy;8A=5|GpCDnlSti`THoQR(2eEo5YfG}oE9U|u(I$DC{Liek(Jk|x>G zP3?faYf9n#ju`@TjS>Ub%{wNltZf$ignT;lHtMs#-MI^(B`IyP8_HL)WMA?8_{? z{`;nN?+k%d#tkq-_v;LS9J!c0O;mY*hCs2blssrDrxnN|-%In$_UIGz`rfF`a3b4z z)CU)QLiwe?M+?yrPO)9IfWu0Ci-A2xHn~C49GLF-b^k4PhfM0Q$V7#C*2F|B%tDFh zOgC=&-1DK&^4p)_AK&1INQwDcu|}E@HIkeUi7Ha)Be`5%sbVwTE&FIYcZ}}dV1n)y zQ--p$6s9td_v8{2$whG%H$c-o`8p>%Cw3dH<=4=z=p04H-K6{Psu~RBp%~bX{lIjM z7VQ$JXybaexjzkVl;H#mtx&KZCxJX|9-rlPd0XPP-B$Xmwn%k~ibR#N{!2T+W+`nQ zR;rs-nvw6>q2o{FC6|g^B||0s6ll`~~Bx zfjqO^M6eZNp@LBF!Hy6ImO82(2%|9VBhE%A=6kI1K(J?$C$@U-@RkRrYhCT<(`x?6Jm!S||(GLt($XB~j0D za^Rc`4~0ZZeK6lFH)+hGp9?9<5(O(A)edg?xv+$ymo8}c_=oTOxsXm~$X%Xy`P?|L zI>a%LC!j)vsI)FvG+Qh^J|Wh87PhLpR9rP^I|y8$=cmj#YH&9s0{8VfEHvO8RimY% z$-q>N5;Fkzv?BgzRq54~jh9}4KsiSs0o9J%eCQnKRwqr@=$y&_nKd34nI?Iz=JU*S zZF32!lY6$^_$H=1Gq1dX<7|!7i9Nxr0iO{<8W`~c{e9uf=J(Rdb~w^*VFz9WcJ7Bk zBWCC7_<GtGo4McE+&q4@hY3tqOI1d~eDx!*6}$WfuY8Jc2zU}{uVf?bm28xN z58Js4RV-Gkfm)mZ8gK)cpiu;Al)%TO63fZfR3j6bdL5=-=gF>R=?a$e%TeI2T0|xJ zA~np`)@xYms&vti_1Yx**=OP^*S-?fz0(~KGebw<94bp$C(apkjmjt~fW+-8pXhdbAjc@vjooa!B*ZvQ(xL5H(ofnF5JLv?AQVJB7&t zkChSxW4*$6@0Vc`2?Vs8CTA;HsQkR`f2CT%gF^)BX|p?DNmK<%zxjtv-sYQ}b~2%Y zOG$;%qVKNl^%!ICj>f#fH#c<(w>w3UsqLVGJB(n85ST>3B3p_S$gpNxIAu+8Aki_+ zfm!rP+3h&!z?oi`dhrzwamG5at6f5Smh!nUZlu6@M~IU(o7z{~O-UW5b>Lfk3)=&u z$a+ae*(iaDN`k_Btry?Nci&?UXVQxn_?~tV(Zaryxx@S4AwyEyg%}D8eux~35oq@) z@4H_46h(|zi4iEKo3xTWzOe!$V##+zo2OWT_kS)h;xSLgD40R(lN-teRZypgdX_f+ zqOIQuRuasHcTzsj<0ZQE34-99jj~q7IYy}`3QV(RStzwOP+<3bC&~#%(cp~q;0;$S zK}54;p+u5Lx~;0C{mKQ()fDHEWUHzvU(*rVIYfHI*{U6ErbrZ+tYvFF)e3Ewh6P5s z!P0zZIo<6IPC<~h_G7SsQh^<&jM9W?W^IT6sEy;bZ<0WKGgBrHOPpj^RTAA*n|~%< zU?4$~zy&UvpCm9vp`tiRWZ5Jp*?w^*+b_6nUB-%LZWQk!ULkZ`hQMm&s)A$sS$nIHpe1TpO%*0? zXqmQZ8il@ZRrlDNmkTQ8=E@LA)K=RYm33TeVTQnR+63k(C4`)+Rs>bSwUEitj3M!18Dlt^TYYOeI=5d5TFvYpdBWHOda0~Zo?GSET*3*(EdN#!H1qX*%Ddc>AC(Prd?dfJwD zbB&B(fvI}BZM(168+2ad5uW~0y!B@mo_GpRjpv2k_z&@q5S5p7v(3pKi1b+D!P4Wu z!8`9W_nUX{et|@~LQv>Q0;R@AgBwbXN}CC1r^#f2fv@r>EtMhx@6%rCsJd0dA#JCQ zWBMrrappqW(yleJ)!bnsnl@fDt(6uwS?is+PkAz;J)%4@&2tt-_U`aRo#%S`l23Lc z+I`#`c|OHHsPL)u!5*K>K3L*g(*g%toM?gKmX}+ivE>p!T=YBdkDP${t9!& z8JIZ;#|Om>#;(DOhv3$b`$I5iSn)8d7#1-cdBYbD$Lir#!?BZ+1w0s@FajZuVSR2m-g?<0fT#5B44D<8$&ZVS5MUiXk5INjq?5A5o>zbDfA&g_d*{V(=MWBI)~+~|YcentII-oLUx7LHyz8VASKj}tOf z;D+(QKty0(AQlF$48+>NbAgB)yMHW7$88&j+HnWRp?+NYGst|V;2A-S+SxzryD<>U z$88(;vu;_<-O{X?7FJuEEX1@;Ym1Dwd2KPTZFO7zA(cLRe43bDHnTEtZ6Iz3-Va1@ z>-^RzYF*hH)vfDW;|4{+ZEIiC9$BN#jY8z;S))-fdf{j+9erUmE{_g*nkVA%75`yW z+%E?-j=n#d2UNGc(H6n&^4lTuiQP|N!N`>(v2|qDC~iDzH-@xBiLH+vg@jQ}jYaL2 zx5LVIo7-V)yNm6(|HXD$?UB=dTYJ<{oO{mD3qz4GB6|cDjR<*+dz3zGoNDW@jKH-K z4@L;uAbj*4{(BN_#_p<^K=nJe;tsGxi?>5Yj>@wXlo!fD%PJPq$D#>ylc8g_-qh_R zbqi7dQ;!gfcO1ElQV$n+^GlZVmDLK?DO(9I7Of&vU1V>&ry>{JVJc>W7xXQ<3mGTS zZ8Tnchq-qqlG7klVgW79F3SlNSxozfIDt%Fu*MOT`m!A>;^>UWf6I=N&X3!qKd;wi zZ}fiw-%lVvJXszR1o{snnOl4J#{@Z<0AG}|KSAJy?^z!q$#0NAvEZ{Lo7CA=EBj&4 ztN7iUEDU-KFTToLzd?BQb$mzDPZ4djk>$^3gV1$qs{1$jkbhr__ZcxI=>2}$*{rwjZ&m;isN68Uu2XUIHKLg2{F z%6SDBX=iuQx@HOLx`c|ioK#P%$iRN!2rdEFuvkNhwoyZsc7d>T!8*=Z7n=s?<&-q5 zUPq0QW@5TI-^60`iisO$jD;yyG1-8t2~b3}&}RsI5KNfpbh?}8Ni4Oquuk&E9G`-w z)z3-#eg*qZ^<{U&B3dril8>X)>b#nTPDJ-wH9_!oZclX(}BZ|Qw~%(*Eq4q zdBllOk8ls9cvN{{yT>^X-1gY$iLIU!Tv+GY;o>xc*y`Tp#x-|{7ZSblz4&1F==rTx z>r`A+FRMr-@4;+b0XH&mGF|3MO!D6DjosdJd{98&no6IOKDg`??2D=FDW5^XBDGX> z-3eSw`~N@ilghrYku@xbangRc+yuVs<mvibPIBTDq_a3hX1NIj7}KC{{^fsPQLQaC@^l3qMR09 zYy76>dE?dimu0dZy>4Cg{bzrT+1dfWjK1C-lHwm$JO8Ki$;$3d&wqZdPEYDSa+ue- zlK8Muuh)m_|NGni_u-E_iuF%x3~zQwH*T~nr0SXX^zj$RN0bcz*f_SRKCER`UGbxZ z6%J+onoHX)z4^J@e?hhyZ5Exr`66MywnWq6_J!sBR*oB0>xyF@*V zom#(5@mbuv?Jd3i2d*@J&)L0mL9@AqALi+v8hoifFgT)U-9(!|HobY-$$#R&i4V5E zcOJCn&D&)elO1kfIiAP=1v2j%cdq>~?YaGkCq6YxEjvhNFW5eG+#yR>|9hA8{##S9 z)#B34^GjP?e)4)=b5p%R9uArsk9DtK96hge*n;Ac7{8N~gB&&Er|#N0<(u!Y;Rcb@ z%EsOv{&aZAJ;lMt^#<*aUmG@H>_aMDdrTaHI zAN(HCy6Ly&C(Q`+bt%IwkfE8>bvB-Vq{3$*>*KCHGkL7>YLPX z{NuRUTB#pW4ppX9-n%lZrlK*gQ;oZ2uQ#WcZu7C-Hb3{W&qb3V+g|;0o+@6Wcv^K~ zWt+M0vo8(1GxAP;Md}sp&vp9>ZXf?+li#}HO*7kkc6j!$xJ_^Ob>{{KUmyGW+s8}% zkMOQs=y}=VSNgC1=@Xvn2c2B=`s4MO7suy27OwIYnHRp#w-kr|=P~reT8B;#Haz|` zDz$&oMx(Zqrq6lVKj!#btJL9PK1+*wt{xqG-DFzm^PHY5#+a1fvogEfYE5su;DQ#d zleIQzwLWZX658wJm`A5=7fignvg}jpj)IjVI(lRrpJuiqGQw8>MC(O~;tIQF0YVCQYIx(}DGdpqsN zsn5GdM@0{t^L+hI{U}A_ZkJdu=}8y!lGeY{#s^G3b-2S*zl&{FOMYu6CC^#Wc+jxJ zj&#?x<13~uIMK#dvRaZq)#<3==dS#p#`!+`L`hKVx=m|-l-xP8{MfP9{&`P7v|KW0 z?Zuen=vhe{PVViSyL^4}l8M3MV{<2V8dui#^X9)tdCGHJS}Z&`(%$Zo#m9nqhMpRi zAD>L}{@cTJT~XVl@>BB<`oErkYS^%N{_i8*@b*jZohw7y^?76XvHgJZITMpaI! zt0}qJ{pQUpc@A#F>m)WF%VWp94v0Ko*U{0lefmN#nP<+j1H;!FxJ5c%mEKNRu&hc~ z-?{ng%Z-!mcPGqCH#oR4pnq&x*C$)YFOZHtYI^nFQe{_TZr!3?dyR%ovAK2U@So=T zd7Yf+ZF|0C=ZQxD?R_sPGK&N371|AdKJNCwqP=eKW+$$?4t1Pf_QbIF_Q*jVFD^y> z@vD0F(2jrE7<8L;>*9tlYvbp2SUzdsz?)HnqyztZ@WN7O)Ur2g516K{-%9n(SaK^Cep=}DJ}GN)NV3x2Pw?=kM?x|+#;T0tke#l3ww=)dIAoARY6Od||y zic3POG$JdiBO6X@>~H;`bw}4nRlc3l{G#q}*4$@Vcfb9g?G9_4jx2hgkv(_*&`DVa zmy~Ory!`&q-jcAy`RIT>5d|^)ceds|H2U~MPqtCg`r_RkY5f{@XmDI(V~lIy3I0FS ziB!eR8i(AE%QDFJ@>x8%!S``WqJQZj>-nVtUT7(1#hvYZxDR~;9S9n=x?U}Ryi^;~1zlZN^oLqM)!hHVO>_LU!*KIrKXAri< zC*u06U-3q=jboUU)7lki|jWTO81SiRtqmXG?!_wnD-wxCu1_Q0w^ z`9o_D_Pannlm>}P4MZ)mejFUYTL*s%9ujyDb$Iv2MutJWEFrZTWZ{9|%X`*fdvVWGLR z(#QAtZuH|?d{jV5vmXJb#z)f>TYDxA&56CY((&rlDA~IH1)kr0ViJlb)}73Ei?q9u zYWg|D+~IA2q`=SnXvOx?`eNIdJpD6u_Z|D(-PWw4+m9W~vKod+oH8SJ8dkUzxIHi~ zobxtnTRS6@pp#YGkHnrXs;^q8S0g=aakP48hn$gSZd>+L+r-blzqvF28T#qlV!NIu zc@F12OyUcja-1^yRdgHO;BQ#B+S|8Fg`P*{na7G+vk!LVc@r)~dcXT#=sF`RXq;2%lIBiqGk?$yAgA=NM9uI`i+m=^4HS*TmL)p6>BnP$=Z z7QKA@$$Z9|V5?q*Ix&moA@_%5TX<)s=oPtn%)YU6OkQ=nA1C9o?&#_j-+!a)r~jxv zrzX>fE74RIL)erM4??vqL>CnArP2S9~7Nti@mR&Co$@{AF;o7IP`#&`; z+)Z+|A}Q&qB95r|V}1?yStSK3`rLpIPU)+`0YlCF69{KKuDt zwV1!~!#Vq;WcNs$Cxdz@QcQi^19IHV>|Xb{kZm53U~IGL*wDN?ox@H?e^rk=&ok&lW>^ED%5d~@$iD43YveqvqU zm#rf5uAb!&lf0|1l4H!HXFgZ`S|s1FFuML=(b`F=dZ~}bd@}DDnV9;ipM7oD>LK;- zJXiSbXz3o6<4|y6m3vgKv3>Qi@~RCZ-c`MIdos1IN1R`$4NDVEPMhra>l8RJZrA}c zt+Kp)*Q}(rsU`t43pS584(}V_k@w`^rJ+6+64#?M&zGA&`Dc5mVa1Z_Lk{N?zk3@8 z@MAdnbX<7fNW0h35_z4uEC1@GqR_qpF$oWkND8dSj(0t3SmAs!dr0b!s0~Z`ms5Y( z-t3X^z<~dE@&Y&h_lZtkPu(8$glc_hCO}T4LHk$;($O zef8|CcRZ_T_ro&&;pTwP33p~*NZjkTaYPI^?OMm=Za(gXId}SJ%yQgxH$gX} zk7G^78=F3X>slt=kMFa)#L=#2W^RMauP#R2>M!UFavq~y=I%JlW{hTJ;_%WTeq$xB zC#(yTKlNCatn+SF%q!`VfQqe;4mhq=+?@M%kI(R0Po0F~(|s~u#oHDiob}pA?l-8R z=5@-ECB3o_I^M7@Y+qlt-ZxP%ZhGP2;I-1lhd;UxJ-wsbyVd#gGnQz({MCE!#+i@) z`BWx#>f!0m$Sb%8ZDE z+b3A`oL&lc<6khtgP zz%_Z@FI-L>_{rF1dci(v=tjd7qoDY*ti>w6E`K6#APLnJ(+M-zTH>1 z!M9A$$h`RMcfVg6VIeu=r#5Q6v;TGM_pYUxnhW0lD!Amh;QqGtWecBHZaryPf9v$A zCr|aW{J-_{2$wGH8ynUoXU&wxqqkb6w!IzVbFBD7{Zk+7V$JNO`5o?UHLdNN-ywag zj!)^nXNK9Gyn7#z6wLKLx_v~E+qk_~GnZL)icEY~dZemtN>Jwd?ip6!wi&&W&sMDG z&v0#zB@{ncy2F2a7oTI6&(^gmxZ>z~J1BTe&Y;sp2lz8i=xh60iTBA}K9*q@bvno= z4A#HbFVe2G!-lu6Gko`qa}AZeYz(~C*w8J?C478~kndJz=N`}eI5z)dcpIsaak!%Q zu98=UziZr$)?^si*Ip@T@pe|`fJYB??Bk-hb^P8p(fwPi^1P^Xg_UMe_rJB^kIJYg zpY^h{^PTQ~GYNbZcRRSGUCi2LSw5XT2c69}E;B5z|KrEA_^6#`eJYk1eRN6F`ELHh zV25Gs)YRtni;^`e?X9cZx$Ez=wpeK4ToV+ZHQuX>PhnTdUZaF81ACv+{#&*kHXN6K zIq)(6e;b=w@WERzNb*5vbdti@&o(76z4xf#HH%Ms21yEh5ckZ8MnEne=7%pK2vU|Te|&*;8tVbVEIqnGRQYo->qaGBtd zSA8K{F?r>f&i1u)y?Y0h=)~lOL|2SzyU?w7Y`x8=LCZpY%q8cdW?e8^@t50)>2;gS zS1hw?@qI?%<+z7=&-1RHpZu~_qEm<@>45iJS^cX|H?j&%*Jh4x^=?+;!+h6Sr?ZQ` z^+~+wSebsS!?1W;-~DSsmhI?WHsaBsoTv=r?^Xq;GW&fG@xCRin*GVd`FFRn;+%%y zDu-Wd6D{NK1XZ{HP?x_#TBlWZVP({^qh_I>qihSey{tRv87A>mW>cO@I8xXf5Q_jYIXq22qSr%uN4^~1{ZUY(CLD$DVcB=-rc z%C!_1c1(TL$$QNnw=O>p=ezFN+O^ATk(lncGb>DKoy|LAPh;d`^hD3|2673*UX zvVF8uCH|7yjoxo$Te=iHj<|8UIJly{RjUo=FAeiQ-{nuR`eAh?nh_nG{aRKmvs>8b zLU!n<*~`K!+*8H|)NgWhQdD;iD~)LUdvmwCGRL>~8jLgQ948!#l13i*s$ZVx`6H(0 zLWEv@K)%}}>&&q$zc17MIdJsHOh+y?P`lK?vu{C<`^JU;dP_RnC-wE_9|kV`5i1Q% zFHJbHq|XNJ#G`T3>Uy0VdNy`fe6NBzfg?@bbf;z>U%C1r|Iy+S?m4-t<&U8FhxvPq z^DLuNWBQl2G%}A4dTE>*XjU#M2=jh$#3Jl=@clQfvn^H@Iv;f#lTyCFp`BgN;&b(j zBgQN%53JS;taN_etx!?)$vC^_(~ zW6Ncsl8o5vwrLB8)px&cbR)0I!fxT9i_t~Xd-Mz~-P+-N;6?soe(C7wBAc2PIejuz z*H|{AZrGTe8#gsPGxz+mqZO^H*5*c~56Rx(9sc!JZOAw6Uw@tmex2KJaAs|`ch)z{ zl;3)hj~1+~Ytj8!p3{oTwNgL(JN}ZSO)vDN^&JZ{^P~Ny_Bb}Yw883p(6OreCoAp` zsc)0`bZ51-)u7rXI(Z+W{kD6waW>lHwk#&#%npa`?L0>YzKG9u+`T4mU#{P%u#Nm1 zBD<=)EGxxKGS#__QRK2vtK-#X5iYqI%cd0{Ou7>PAgP^aVOGWaS7y!E%zm|V%wL=S z{@uKG*2*z1501nKR2Rin2H$B>uv8~udhx#74~;#YeE5q@)y3lWjv?8*bK9r)duN(b zuVtHVTsXV5c6eZy_>+5l%ro4-dGjZWaXr3|Ref4;+5S2`mZf!mH{{V?pOG0O9it_- zbz0@Gmf8JnP}a`-cWe8C*cX;AsoL2C634{briL3QWY>1|_4{M|-iA>Y3oqn0Xnjx& zD*e{gr)S#fckV_{AFPNUx37Ln%ntDmjduf8m)9#c^-OqRT;_ChK|_ysjX7h^8|mlG z^jSE;dA560o>`Y{kHwF+MwM-lK04rOoVX>Cey9o?z?TFol8V^b}+N_z~yN z#_o^r{4(~;mB5*`m%OtagNzgSzq{eI&T46>pH9VU=f$?|GgI2vZq?D17I(~^y57Yj zQd-p2uj>b$^2KM?`dj<-Tzu`7=lkl2ROfIv%L1RwMW%N`X1=`rX*>5}=QpX*K6xWo zvG3cQEjs68_C50%@bau_aK_fQ)h@Z)_wd7=wY>7enUg!W8(5USb5G^$U$%MCW7(2G z!*?IOQ?<&XznR;WhCh?kcJmJP=~mIM&?J6I(9DAC-X}$C`3q@-f;Cgqv@3i9r{{nE zd%b1tIL8alZ}+X6@Un%e+w7Ea`|JA#?u(zWt7Pu4QAzF*v(HTMcPLo<-2Bvex`hl} zVHQ1Mc43=u)`8)sEoNOT6;vBzxk_I?v4M;SKmmRJ=2 zS#$UG`z0&COCJR^475sH!nsUL^pDSS+*6$%H)HV$(N$Ta(^YXKegR4izwY$&XcN{P0uX$F-Z+gA=*&Pdug|AL~@}FaI)19J% z+vQmPZS10TQunmyF6);wOM4$k>KQh7{f5L`oyF3ugn<<<@gesUx@Ejv?`x;JGG0+$ z99BHBvCsMP)MsD)evC79D-8XdP(GQz%5TwU+NPc@E=KFmuw2;TY}r2%34JEMI-3)m zKDJL`tNa~-6$6YuI)_SXx0E}a|MC6x_hwuAhS|Q4b~Ld`?Hn0+`O`{A*ZP4)Zc8T@ zUf0nal;gl(iY&RXVd2#ak>v@qTyN-_Mi)&>DLoDX!m)W@+U9z8^Lqc$`5 z9e=~6`mdrZnGgAgF~{;g|FiwU5PP4V_Q@-1oRjqnHS?nfR+zgUHZ0ryX0@jNnTomm zK`|kNzk#bB83&#nybYhRFig1N<>OMFApUCX z<*-lrojr|G+Acg7@@_2O$KNI=<@qgC-(g=#uH@fK)h1;p=!LA!OS^h1uzq0uov>0J z6Bm`|H9ooBF#A`pj55dKBbCeUgj8t$=umQDhxt9T%xg{mxQbm3dWn^1Di0>> zh85+uKf2FlOtboFMww^yL#q254U*Qi3Oo4K-ebc3_5FN$ZuR>+_}2J;3mxz5+h}>m z*wFWMc1>=L!oY9#^+f%=zL(1rdS`7p>a%B2SpU*dts{+Wo=HA@^*$x5c3Bwzuwi(? z?7t8BbS{dHva{@YA#Z!H?yud(ogDY{Z}UF(wXeMo8`h7lHmKM(+AZzS=N>M}S`|G$ z@iQ{BpyW+jCvnaCInFnp>K z4;v?B8Nbth!XI&NzYl!xXYaGH@zIuB`)8i__S0{9EaAUbw=15+?g;Ozeg?91^Ab8t z{i5oOCwDLP^;*gwB%ZUMTn@agdbIPlfPYUt^`AtR=he7%Sm-L*`*gKYfMIrcsd4>K z?*~b}CG-C_NKHJNFUeR?T01h?ympAAoBquqsaJyC1{d_och#F(qq?|X(t2BL^L=hw6`cz@UpMNyyXt zw#~Kc*<(X&){**;<@~KyqHU>hw%e+OSIQq z9UWy5rKlbgIKky`g>^yI$Ef-4&tAVXS=ksM2}|Q25Qdl5ZZe9M{?@!~6q_fhUG4o~ zNNV6KtIFE%*UOGaKCZQLS=h$@qlIoP|GaubdyfsyS;pB*${qGD{m9?EuJ}@S_42yn z#>bgm)=EPg&Mzt`OiT-~&ZzU&``NeXqrPQX)Mev6p3BMuq>J08#soa`oNhEZZijZH zOL%f`&uo`aH|^1GG1Ka@A`-4lDqQ6lt-5&lv|8G8Z?Zv#SK@X4amv0mWzLe>S3}}= zzL^s&E}XW8zf7I^DZwyf+K)q#%k=!+HY5(qapRvz+dlE^y*Kensd;z%y*`bjeT(|I z*p#Qrci4PBxG?@yV2QU~>53dl(r|a(kiLZr|GSp^hs{79yuGoGh7O1 z^RphVgtPVTf-Cw^5A#3aa(!~va|SLFHO(i$xxVCEX>+-Ia2cHS=fS1@D9^_K@Bg`K z&*Qie==lhj_ah$)uY@b%gW#?B<3siSiuzN&9lSGK40qM07y7^zgDL+QdDU^I>X93g z_kmlnyuhvDO1KsB^WdT()H4b01eXcigY^h}D_lIZY0rMR96lBOVQ|if^32b{r2@YO zR|xzbTr{j{PcB@xl-vXBt$@p~%vB5jHmR2e)-Q0?c}O+SIdH@|UEVdgwwzb~3N`8A z1!MRjflr0U349?uN8qdBUj*(4@A$gudPCr*0zVC(Bk*f*MLG3|F#asKmmvQUen{Yr z@Hm0@(4zUt5x5Ebi@G%i0O$9y z+RbTu=LozH+)Ln=@IwNh1CJB9J3L3=yWn309trPQ)O7rba8rRlhR+fB2e_BO8{vlp zuG50%Ax_|C@En29fPWFV3%ujo6-~}3+u)`G4}#AT_$l}ofnS3w1;_hixL5ItChL6* zKP2!k+d^o%t{K0W@_IWp0?QJ=(g4QcSezMy6gDh{p zTK<5~hRch|`IV^`2jVxr|I_Yhkp_HNqEP9o8}YXrUK7| z&k^_=xR=1c!Vd|&c`NK!0@sD-2;3C@Mc~%(j_;a|e=*!t;OpRX1ilaMCGeB*Lju1B zj}!Pqc#gn};a>z^1@HL2>G<2Urui`ycwhJ&fm_181U?gfNZ>B;IDv10=LkFm{zc%? z@Qx)-$Dax}6?iUuj=(>{y#!tlKP2!jZLt3c+z_54@CooQ0(XFS{Lpm#tKt0rL0o-Y zvFo3m@HqkxhkFV93jC13@5AE+{u-Vm@Jjd>fot=p81?7!$EM@dg_{c83_eHTHgGS2 zOW=nDz5yO5@B{E1fk(l=2>d#{gGz<0BLfgfl6C!6-ivwnf6 zvwnfUVf_OC&iYR^?QhLLJW|brSm1r&GJ%hTD+E3h&P6rtcV_(p-^%(09>V$seu4GN zoA%#g{Q`f^`UPIf`US4RU+}2rfjix_zdKwkaAUYk;FIABfiGtLXPWkVv3`N?XZ->{ z$@&F;o%Nq>+MmVx1^zGV7kCZp7kGzGn4fb^`v<_q0v`*P3H%SZLg4PKKe}oEPS!8* zFxD^dtE^w(_gVk>ru~JiU*KO@zrb5|rg=~ZTo2A&Xxcv#E*AI z^$UCx>lb(+>lgSr)*s)rKbiFlJeTzg`~&M3cmwNCXxiVUJLX5=L*X)kPlhW5?g;0u z%~xM3vFjx-xLDx+aGAhQ!W9BffOCoSoAhVF#R4ye%LHBnR|vdq51I$=dei;^aIwIx z;4*>Fg)0QUob@L)?cdJ&1s=-!1%8?J3tYkaZ#3=CXZ-@NVEqEu=5M%E=M9Cxd%?Mz zP5aH^Vu9PhWde6%{Q~!9{mD)H16jYoPqTi3C$oNmKVkhTP5VEveu3Aqet~!CiTM%u zU^tiBv|kJt3)}%N6Sybq7x*sLf2(Q#an>*J1lBL`Ox7>(V%C4VY5xz_FYva#XdYw& z?+aH5+zQU!Y1%&vE*AK5)-P~h)-Ui-)}Pk2|1Z`ra0TmGOL_irnRC!yp3tR`T6u2?`lfb9IzX*I0{HMUZ;G9>}@$ZGV6!-~vM}a56bp-wZE)w`#_+Wwm zfSU@uHUABJ)%j$Uz(sJez%Ag@1a1ePBXDQ9qrf-Ar2-FzuN3$>me*dO-VfOK?{2`C z3H*WD+i>D6dj7!jZ{ZUK{!Q)t^Wm*4oAhhysph9Gmn-njYH!ZTeCfGFKL4CWwe(ke z3r@P9T!aS}Bh;?Vd10KC=C~+D&@ zqUwLwsJ%TW5_n7g8{ZmSdrn%gx=Fs*|L`II!^iv&w^6$`w;k^~>0VmN>MuU>k=rEvbSiFz3hm%#(!j&MC2jJo^l>Y*cV&0Y9nm-g&OCsyh5vzYcQ~fK)<-oa~vki8=UJUR?AYjA6yFmiSZv}t}j+6WBBL$s^yA^#v>XcR{fTHNG)If>K-w-Pybbc>;G7-hb+Dr^f{W(CwWwzUTs)tAFvfovE^{P*i+mhhDk0B; zXRsb;auZEXy}V&PZg7nA8(guR{4>VclHXBPp9>04a#wW=|8szF@fz}3+VsMBxO@Y7 zI>xgIF5680gyNhJT)KsP4m=F5fcwC2z{OiB{|wue2N!K8uR{Ja^Bv^Fu)VGL6SZo) zq%!ho53 zJ4k*A{+9K_+2=yD!8ncrD8CVT1Go(C54VMj0x8cv7dF79@FL`o!Noz8zlwRd1LqEr zcg6c&!upSrTd{fOPo(O34kORPiP8ivK0`hd`9I*Yv*gJfEj}!Nj(is8KMXFvK;9BP zsc^+#+Ibh5394S6-t$I}ca0{zP&^Rh07j^)xRGDkAW+mke8@m<+yC-Psw%B{{^nh zA%70XQr;6Mk^Y9g}{7L>B<7s1x?W!eb=k0-TuD)r{c(|OK$f=e!=wAdEX^}gt zU*&%ujOF3c7-ukC+Jf@2@QbXcHMu|L;XYi^fqX9dt69DyxedIh8EuygJ_|k`u7tmU zFNG^QQO^YUHaLer?{FS|iRJrIJ_Mc*m-Q!S*E4O*X*}`)M@o;9>AVaG5FfKY-i8rDo)n z@O8}1$4|S6We?KV7Jo9M&_sY0o>>10Rok9b68-3~w`n zwpTiadSc+ZaM4)ux$vQInZU=wmGB?P&tg7~df4Zh6wZw&XYb2;xCqYPM}N2&-V*&0 zaH$}F87_nOLOu;Hhj)eNz!mUr@PFV+IR9~`UcSLa6KMSGebE|;`GikHz8hQtXY)B2 zE)qAL=kahEJOMqk;NpptXTB89O(H*q{2I6%J`e84@{=jQLxWzp0GCZ6XZcrfCHy{m z-oq8vlwSd_fs3b-2g9557m%v!IwhQ)XLR8r8_JK+pf4B(mrf&>pvM}nfd7WCU_PDl z?0n)6m(L(yfP563vn78DzXMmoo8$cal;vkpUJv_}qvHSwc`@k2&yc2N zU4JUzV)!Q<@VU%gDbMEN6I=!#fqAZiE0#AMPsdR-Z`=xUwto(SOW|WN&arSgob7LO z;YzqK^2=DyO6s?Td%+d(KQ!otgK*I*%GV)(k@;$Jw*NeUi#^GoAz#SyYseSCzrtm3 z_W9eA|KLy^N8+`V?}+P=fpF=1^2g{I!}1%*^)={)1uXAPz6JR;a3wq%?hlu5q&&Oc zI0NT=$VZ_68eF`I+zsP=1y^h(XXnGOaFH)Ln}^P$X?taG_Bk>XE@$3?25Jpg?4q9b z*v}Wkm3!gH`@p$i@~#@x69^ZDkRQbOPqF?#$zLHK3zr`uKZbd`4Hq9JFM($<4OD4`lUz{ulWq^jN~>a5wbWz(toR z&-PDOxC~x^_i-a!dX@6*c-aRR$C6*gdQZZ+IPyF2Yj6eJ4W7+<;wirx{+i|CEMLy@ z36x)g{BO7%enf*_=)hmNs^=$>@-1-wG=fW$$R8p@;B3F0 z&OD9s@f!36ZgAOMa%c2xhI9AG{o#RdIeZoT6kK$l@^9cttmkiX{;`94xeph^d*Qs4 z3zt4)&3xTOuiWF?G0DJqv0drvL}@Ph2vrx^E`6Z zpF>kE&T#o_a`t%?0GAe!|IncPdFF4((=pCexVV^H_2*_)%PZ#pl8?Z6e!*oWr)LUgNxw(;i`{C^?2Yf;i}WP%EdL*GaIftEvQ@$-w7{d z`Ja@(3D=rLdF~haa`<4l3_e|hUYG<|)>7Ub^Wy@S)|0FLytHcB0atMRfAC8vdd{$X zGjeucpn!`t$v3FKisK643OLJild-+34dIu|=pO)=HYe|fo~dvdd^GZIa77EsCm_F* zv{X?0LBA<@;eL7q|hI}^GyByAq zBWL^nKDZLjuJTz6!n?E)5}{(}7mt4_BNbcgA|J!o^YK?D@|VxE#*jm(Q$UPI>nJ zw&x%0sINod4j9i+IH$S*;1`yk0~f<5V4hdNWzm#Bh@L%g(FO8YjQ=cL31{QH0hj+p zdA6TFgexwRcgAs-&w8$qn>3>pe1ePO$p6E7HSB16Me*eR7-v_wB7yuS+yE|1BxmDv zfQzq_$DrRI&Lxo_gvexOkNH*m`UT8rjQ?mPla=-J;ELPiLz+=h6zfrtXQBTFTnX1l&kL5nM|pp|FCXCY405*Kde)Ok9*O=g z{5R%Q`=RUs`7rdGz!eY4t+BsZ!$ptD*?uK~E8*$dw1N$+=NaV(W4$48?m0RA%3q(t zrEt4u^ab}=&r3?Wqo)uqenmb64(fxzQBN|S5KlDt8%i(eGt#IiG%I`o=6kIuy zoZau-XKq2h3O&zRk0m+VpUdE)QRHm@?Bzh?8mCxHd277CCUE&A@=3@qf^(C}k7K=?S$+yR z>knZ4*5sX#SN(Bp^>Lwk(7`V@=zk1Xz#k+3p7l?oe1;}{f$EQ+sCr~}V4ssk+b(@BwX%H{srT=W$r@Gu1gog#i|Ei{KBpe{oqPC+i!ze zekJAEbF<5EnLGK<4z%J2%(sxU>)U$Pv$d(4FT!^DlC$ei2e=$QT9f*{;mYllABy8E z7%oyhxZ{_@6z9&t6>vLvD$DPpd`rypbGUdn`9t_OmiH$wKu`O{82?`KW5^GN%lDD9 zd6)#3?kDG`MZGM7E8ywqSGhibnSg^)*My9U9PhsZZ0KN>DQOzwpDcMe<;N~qZtE>0zX zi=Opx(QR@ocpzMQhr9ygJkLChd=}Pw53aaN&fdqjaM?X_cK_7?=kAlUB>xNJ90`}cA)nQTUYHG6d?aVj$=AZgrR2vk&Vz7e z8Toom>Ny9OR+4Xr=dk=Y@~L>=Kf?L{O{ltH1YBzwjbBzp{tM@UzRYXMwKdgW#!Z6D z>&XL%ITyINft-ClZig%312yOij>ARV6gBk3_FiW_&BzPjuUKB2{1(>x1FnSIYtRc_ zoN2qnEhzsPKAd?g@;h*QIM;^!IQrMXjY2^V!GPey(^TnWDlcVYeAD4&V#+6q4K6pKd^r3G z>oFx)z$@UK8F?98XF0aloLpO*UNDD?EXi*pKM$^iv+Y_1ms?Su-FNR~`O)O;x?1(u z?W(Vr#*(w`z0G>yC$Qf4aIxwezWjpez0SCX9jr~ z@}&5sP8j=U~hI*am^nCGF)=aDBMKOQc!CujFf^WX~j zHsn3v;y)<=3@&3m4&;&8u0L7Nd~$ZZeTnrfAdklRAqCEojp$#* z^6(P8FPoUVP~HL_3g=dkv-8XamWMl_KNT)oN%@(WpIo@i9gh5axDsvy{|OhbqWn{M z>(w-GqSfT={diub*E#!{q5wrYO z@`2c{<#72n@+;`s%<_KZ_2@aod~qH*u7sOloPlsr1oc?MFT-W3AL!zjP4Fx@7fEia zO)D;hi{<3(=VQxQ{~2;iigOxkaa_RD;T_@Pvy>l*_t6k8J5SEeC!<-<1#))(G7HZA zMQ()tm8>6r2)+}pgtPBcM6mu#)Wbh6Rxg*}3OG9--hqoQQ=WYuJ!U;IO~+FNmkYcC zu7uCRdK=;5E7Ze2U%GnHe9GZ&$Q!~%S1He~izc$Xz#UmWmh$X#Z57MIxGbK0Eb^z}3iwUz&(~Q#v1vYwii>4qWlmo z`hqTSSqgbS^ccVuaQ^hJUPiK>RLT#APhmZ9ZOp?WxcnC7dm+Dy^}|QNWpM5`<=J`l zC|sFF-WJEjC6>QW&dy7zaIwH2!)5ScSnqqd0?v+?I@bR;^?yNLhyQ?3%_o;m-WNUs zE{3z~kl8GsL3#H1=meK$lC$erFP48m&aNl@;W9Y;IgpcZ`9sRTz|A`(mmVZfJg8Ve*ugKYT zxGVEQ^8b+cWB!Ib9s9!}xI#&8j{HS9_Ye6Y_&vBB?gxJd7yV25gYbIR4?hX-!GF-J z=0W<7^6dKAi1~Z+3CP>P<#6`>6bW2WLU}g+EpYAwIh*H0tRK#<8~M~qWPkDXxB(wfT@+TN) zHp_F?YGL08DT0eM$l3fHNZzxY}fvtmhOtJ6^uCd=xo*9@u3&ZLdO3J`&?GhjVAh z*>nCGaPe7kcAdNcE`zi4h6n38M|pPN?GG14lV8Vr!{EyEs`B>&zls^SehfA}` z`O~0!DS#{C?ELT%E`CJ$pA_e+nLj4i#rxiRC(V!a3HcYeKJy%M_Wh1waQQQG_H!M! zaOHFINUV1yT=s&T{rRAsaM3IBF4(Wa;Nn8^{^+^Kdf)@$t*M+i>&7@`77j;;o@TQB6v1jq$H1k z{{vURgSycR-&lV&9j?Ebd|F6&92h91tJ=0V(x+^;#k&;_m#kxMZDgW#e81MNj=J$7R5! zaCYBR43`^Gp52esFds&K06p#b0jRH+jLB!i`@!Y#@z`E-xYC63!;rUwi%iMc&)qr0 zVRvE3L@A;s3#Scnkhg%##*+tQznTsgO(OS)FNQ0u$+a>5^>C#P`3U%4)-!|L66-w% zm%`b8a+USK|3LmeTx?4{>^krbTxLgJg>imnK8JirTPkXVE0&NqM}LR?G;c~c{}^Ar z41`N1lxKe~zzWVek#E5~&waM=dR`(i$Cu%3Ir~2Q zRk$dCdklPo_p>ed8v)h+pn%7tM+YuDLivH1e-oBJ zO74vOWVkqtd^y~a<>9VyPnHj-{2cUeh07zz(~&<0mmMQ7LH;gt)nCxTFYNlK2Cjfx zqeqv&5ms%l=mh2Oz$d_!aMrVqoINL>4wojAU&HvNa8U~R zRP=0t%TmeN-#2muuDDI^f}U8o_zpSS{~xoSG;+3|d}TfG|Hsvx$9XmP{~v!x%hWVu zkc_e%YeUJj8e0yP%GN|Gl#Yl}YEqb#98^llkVp&164{4B8;-itNEl0GKU|`+mF>#f z_cQ19c>Qj_^ZNX8-LCFEJ#EYdpktJiTzYLGroBU+HU@=JA#IRNQ}4@_PMx2v2amZ(pbWmgIAfQ_|NqJa}8Y z7T@a*_P5$>{y03wFXDLVi+k@&{&V)*O5A-Yz8Swm{bTWyndhar|B1NnZ*So-zL|0U zp#G`kmoT2)?v(L|iTKd^@*gzA-DdG0>FJ>UjkxyrQvX(b5%~a*@n0E#rTSLM=N{{& zuUWXiP5dOr`2ZgNApQtFD>VO;coo;pH}T|u;yvmAM)P&Q5GnWCMo)v;Y{x&v_2)R+ zsQ)dl&*e_Vy?^MT|6KKd#dRKr;t8(L->$-9*R|7;)&cv8KQcw_Q4 zxN9t~-#6Qa`%T2xlHWadLy{hMb-w^A_xfGx-684);(A=1s9q?p?-Tps{vP7GUB=>W zPw}Dj--d_yllVj0vzO#QXPhtLUNdp|U*|Sy4}KLrKjUs6N%qJ0nj`BQ;9c0Sj>e;6 z$!{coHXiOLehWSV_gaWQhTn)M_%?i=dP~Va!*+ZIj}8{UlKfijKSX>i{-x&ezMLO+ z;_h(CAIN$Y=N?R@+qXnq&xgn239ipS&&9(dC9n6-BXHMRyoT}Iu08m9_+z-=M)G=H zctiV-79Y&^{Y87)ia$e7vwLLx(J|u0-BEaqbGW;nc!IZ}XAtg6rAOZkj1Dfucq z!q3JRX-_-p*@XWGPjKBIzS5rdlGp3kF5K%NKAxWaa}WCJwpWC&!^`lnV>W*-?mCI< z@6V~g{m$b3>6xkh_~rOhxOc4N^*-}W?I{yqNB#%RA1A&P-#hmpt8V-WuFEaM{o^IC zpKqRr$0vyE&)1B>-AUrwGXoFs0(OW;@UV;I_5SKr?LS$(Gx^W8{}gfE59`m9@du}h z|H^tDqTW?Jclk(PKJL1S>;30NxPO}XHRLDaF@8UOulDzl{3G~FxYtvB5##>~PkM=u zBma-~oG!i=KQQ+|zHYntXNdpJ^}U^Xxw!71<#>#1PX!+Jk^B{$$EM<5fAK|}m+r%p z^TmH-JkP6NAg&_$}nW#$&vYd1#nBai#lP-7gr-z0Stl;{L_ruhDZ3?hO&o z9fs-aDm=#5;dkQEC6YfDUxp|6Wvp+42bW1c_qZT^?Y259WfY;4~cZc+J!#m<3uK9EE*yP7*&z;h9 zJL@}D^RvZw(toe|UE&Mbua@J%T=C81-%-C;yb<|rc(_3PI+oiwVt>9*Ja@a5zFOcB zo_kD`zS`mb{n_Q7p&p6rb$kRK;QQDkoEN!WqVrUA+F;u#Us2uJzenx?}rc8{zs(0BVMWfxSogS;K8HW@l@jx z-kP4*@dVfHl4$>8>A9MGg9q8ZkBRI3*im?lA4k5o=IeeDYwpzuABTJR-uP_X$H(B+ z+K(6G@8Sur*Y}^b|4CV{-X}DBNX8%HCG>Q}WBfAwEZl!edUUy$-~q1N@p?SMwf`PG zG5##>JuUs3e?$9?Z`OX}yR_fV1({l<%PH-2^3iwK`zPbR1X?mwUHIU5g*5645}leORY{dkP;!**GLCnmoU zcQ0hevmN*FB6{*4mG$!RX7~|!fS-t;f=BpX_&_|y_s6fr6I}O)J8}17k2I;{c?$Q8 z*WfkBEAasD z!g_sxM<%}mkBv9Yy|GR2w~e>L-SX@>PsKgsgK*z?B_0@`jfc4ICr{(C@z-&;LdK){ zuW{e_F6}qo;&EBu7}xplgeSP(hnM62N?C5MHhqo4-74|kyNS=hgO|ni`xTGk(JSI7 z(X$3m@Iw4+?T;nTX~X5^ZoJd`PrM=dQrtIwJ|5r$$U^bB=-QYZk%qdxV|50iHCR@Jw6`eXW*CM-fPlxGCmOxjNgSvcpvgF;BKAt zY{Fl|6TA)n0q)gEUi}w5!1evh?oY8@-jMtddiKU6JolI)eYL{<4U*4YKGN6mxO-DP z4?kD?as6JwrP}|NtL(Vn-n`4{m3&pp0NUp2U^mAu}^evA9Ko`3$qLtO8N z3!awwN${rh?~l88q+h)Z_wW(q&%z^ImperJaotZQYtOsVulYyu0Kbd=mvQ%Ac75N) zedE94A$~kPg}EE-y8S=Ki#dP~#*_D@|8nvt;=x9o{6NirAbu+O>v8`>aeW?Dg~zxa zr}Nb}NnY=VW9`TF`ww4e|HqQo{c{)YJ`o?scn+$T^$l@d-!6FcDLt%LfCrz8>wWkr z&Eps3P9b%#Nx1t;^7=kyI_?`^gon89x6AR^;Bmn_wX0U562VZ z1l`0!Xvy4zZXyNZJZw-S9d+r@@bCM}|g3I4JcQ@`g7t!zGJd6kXitGL15lPjXut7En(v&=->G^09(o?d{bMB`;j8e(_&a!5md$^Qd&gz{ zA3Vkv)4%sJnV;}@$*UiU`zK`G$K8op?~ljEM``~_+5A-P?~?WVwEyI+zo7lb-`0LV zo8O}Sr)0g}a#>$@YSvrevGI<0*fpC!8~3|qeVF!l&-%^UZ~Q*(KP{VIuKhi-zES&o ziWjjRf5JUnkKZOMI6vSG$RCXdcy9MdU)^!9m-O#}_tzer%eA{gd+>wE--L&_-apL6 zV|;J&i}3_+fiJ_|=`x<<@%6ZmpMZaghxh^b&v=A$8F39)%KXImUgQtJ6FeX9gu63j zJnCoRp7Ei$Z~S^ZFg^zljX#A)#@FJp@z3xC*Y8E|z=N}8{7150MXO{UB76*f81D6! zyl(gQxQ~C!{c~^ib0q&??h^*9pD*5!9dSG!TqLgh=dHLKEUxco7vLV=l5sB8eq67Q zui+uC`@<)AgtwsQCp^aY!|S~y^ON9uKei9<1=(>PiTn5=^qh!?_&)f#c!cY9_HsPN z_a#38PjDUo9Nb+j<2jIgHSXbh-dKVeSU9Zha$sfBaB9#!K+dxVudH7vjCN2iN5e!4tfU{57~&_YWiHUU~Qo z+{bl0K8^=?CHa@NAO8$rhsVRDe?0z`_74{?#{boR{4~5}Eb|lNXX0hJcZKw*55z;` z$#_!{LT{s*Mj30-GxXw>6 zJTm!9@fg?fT!*_WWjyM4;6AS7c?u7VzmA8-x8afTdaK!9#+&1b@z%H-l^v&#`*>^S z^Bg?Hb^Jr|$oK?2Ha;6qj6Z|B(K4P>Sne7;z>mg1z$3gpzE%728}NE-WPXAQ>DT?d z7?1JW$hX)07|E-jjk~MF_542^_i(-bhIoYQ{y85{@Ubj+86J$4{%i3sHIHl0AGkM8 z@>h^A`j4z{gzI&uH6G)~AD%@Qod2S!v6WW98`@7e* z2ft3&7msmW-#@kgTIoNFe6zJ|UtI5t%J2vuO#VFFRZ5TckH&qx1Nq5#h%dwEYkquo zeOKTCuH*R-kMMr<{Dr&gq(}Xb*H|xH$9Xay;kv(Ff_oFBXEOaa;xRs@p8Ump?Y~~~ zcQp`ShP#`^bHhttpWq3u$KAiUH(ByJZwIeq{J5UayWx?^UydjET$Xz)9!`<|Dfm;k zH&uKz{Uvl%6vDBs?@e1ds7%h)-v|zQMgYvfLBN*UwEzdcTe9@pT05-<{2$fQR_;^qhgm zcr$kN!FY0y^fVic|9*});vC% z`T0}x_hrY^VguV9FJZYy;0gXY-W8AUm!2>1!P*mv|AbFae?a_Q=Iw4gd`SEv^3`~P zKZmc^o`)sh3jaX!xNi3!ac`02^}65WP1YCJ^V>nV|A^%Eywn+YkBaMa`yQHKEUxb> zFUAA>K-RY!4}p2uGfXU+zwN>pSvaE_p#jm zc(hdfF8p!af5G(BN>7M4XP)=RBV3QiGw~R|i~OZ{@S^lj!YAViuJ=m|aJNkI+W$T7 z;kuuhMvpu5Z7@o!(&`~8oVz(3BIVY6zzvcYo-5F&I8BeVU76TEVrNf>*7uG z`yYwt)AKkU;QD)1YP9EL$?N-t?{M!Eah=b`8)dx$T-Wy`Jj6$` z+{n{j}yk7uV~;2Y7;yV%~nlgD)ko`$NMIWSkNHBI7B+gRdm7 zzt`8t!>`3Rk-tduo5k1T6LJ3=@y_`D+JmoUoG)n4R>=<||2dxEdj8D+P{!|VlYAce zBXJ+sd>=f-yO1A?$GC2<#dw1EBVVKa-^p@y|KFxP`03<-#l7z(-<0!Mz1#%Wo%j47 z#Pxm00eFN@pyveK`%&_h_=TFs_4hxF!rgYsH(;Kx*PfrnJJWLy9^juc&PQ?o*KB?@ z9^(Ha|C##llJCE-EZ`43Dd?5L?Tlxyk7ORgB60nB-lOnnPjUTT!6|sMm-u3qJ4o}* z#C5yhta*GY>$?yS_mO-H#GT|iM@Nfm{&?JL zE3W6yGx6XUasBs(2IFz5_)z*s;eLDZWsGMc?mCF;bJQ7lf^Q{%uX;zxKY~AsN1epi z;m_k?XL0R$P5oH$rR3kk{W9^*_}A*kiGPdlP(NN=uOqu~cY^p<@&%tV|0jy;I1j)R zT*uP}k4}=j&fD>L&?Vc`1NToB*Zc4RxaW)i!+0)NKSg{X+v{39JXKt;gVXV#tN48! z*9&lWns`h4pV5ANZ+s2zES@ED(se~kw{r2hwehk8%(0eE3P&i_whx{!vM{nkf!+lGp1+6&{w0FQ@+j?KwyMe$IPK@nnE_8}e(l z{{nISImb`c2Z~QQOjhg{JPyU5<_-D3csND;J;uNP=Q3}>bny$BpVoMcpM!V8y;~)( z`+rwF!Ji`E2aje*ejt7!?q-U&!H3~KuIHI?+H;%a?h70mPBn!iW#{po3vJ230^&uFgrD8_RT?%gZi5kD3W zaQ*!Zz43Uy_yvsTJ=}Xid^F4bR(oC)f0Pr%?g{(h8{&)TISBVQh!5orMrSeAP0Jlr8ZSJ=IQdq0bp z;2ZG(?}~qi$HsTz-Y?QKk^H`2vcKU2@D8~9Rq})J)9?V-@m!=mcysbs;W2(Degp3P zCjFdd+#KA;+1=dZcz_qsvknh&9nS}NjO+E~Cp^LTp{LPTG7s+e?062rJzU4*5qs1ia$nvIPUKfpN?OnJ$P%5i>bI*U*3^zraw||D9-NhR%$=4*TFY&mnV7k zukg6B_Mg`SYAky(~TX6qsalKED@C4tT{4(5K zBl*$z20X-P;y>WtwUU1Z|5N*M-LLk{y&+2Hp;Gc&*nf^zzfOED+r`I&o5kDGe?A`J z-5bbXT#38sl3z~#W<181;rHX=t&(rae)XdE&&>9`iwC!ff5iB=;r{L7|D&hg7Fl2a zPVqhWlm$1#gNNv+rxork64&$g37UUI{0Z{CHNRMVFV<@a?&Cx7ad?d9G0s_d^0@Tq zee!*H_(axUz`ZBMSJD5b_TV}{|Hb2{C4UL|ow)yu_;Yykt(<47#rxq$;{m=O^Uwni zpOw76FS`WymxzBvPX+ER6gzJ8OFdpNr=|2^B|B)Vj ze{=!vW!^cB> zGvhf!-JOvxP@lv1)t-9d$Fe^U#{J#I$1@M(@VLHsE%{sVsG)cs+xLFW;|=j8c!E#F zH{d}d>1m38gNOK2_%7VflY9$&-yhj7xbFX@c!U>|?}5kopeFJcm*C#s(m$2_B+cVf z@VR)O5Mc|C6r#iL^J zQRHvLz5T>X*}jYLpoO^ZKWnugUr5hac-T_%EAiiOe}D1Oc&prvclvw}pMhV92M0*L z62Ajaa6NB4j(Z16p5ePSxQ`Fy`1%5m4wn35?B{>s!C~U9SneS^WSo)lUU-5RkRO4& z!=*=kF7DwC7-)?9M@arSJi)_O;(yb>+s`tdutfZJ`~ciLQoK8UqUMbc#1nio`3dSr zNsnH~7vioB{fu)J9vm%xKRp{Y-&Xu?d&fuFUiQaMw-pwai1|Z!-R*SGK1V_f8j=tB-SM z;URu5{lm2fpUrwr()?N3{`>G4|AYK8_3~`~Gu-tNAHjD2UHkiH^DTat^@{P4jI$%| zpC|cC@zXVrkHZ7a_mlkD_;q-MUxLrWz5bFP$vj{DKN(LnQ2aFVZFh>hLE^pf1$cn# z^Qc$x5I>ImCwPqObKU>qNg(}W$sh8EEH}7V{7L*0+#4cZi9doz__g>_&0iw<8}JR9 z$Isvb{{`+UB;T3*Ke&${f*1TL;|%dW_`Z0855Y_EV2t$ZeZ}e8gAZkY8;rYglGpuY zg645OU)`?#S4&=fDehk*ekSAj2#@eZ_*U(?R`PmZRPQfY-vrn93wz@61j+Bz^Q8Lq z;wRDH1$UFgza`&SJrti$emEZCCo?}c;>k^t*X{K%?%gb|^Sl)I@g?;C2X~Vt{}H}P z`|+dkpR|99C+JpCFJRfM!9ny0d`OonP z*YnR$xVuyGPmynsdoY{cr{VfNnIb&7OY)nU|AW=<7QY;ChX-@T^?Qt`;%=U}?mq)? z56@>jqj4YS?Ub9M{dh<63-Ji=!+4&?-2z#ze!uQTJYFRJ9QoJq@KN!*=zkaY7K`h@ z54BDGN%0=!3;yLihF?#AYur7Z&G*Fv{3up<2p&BrdA%>1fG2qFa-Y6#R$n6dUifXe zzf@eWUvuyn*Yp2k%|9=BJr7so5w8C}!aDUACBKp7eu#(5#Lr|NzQ&W~;(hU-aet+_ zexBQ47xTGF{A2nLz=M~>^YM0?$8~=@4Ucdx*X{y5#&v%ig(tY4e{R?QS7f^7EL7Z*jL){3G1Cdg*bRye57nzAqlsh~Gwk8{EAvuKUTU z>g&bzI(04{;*V+`&u60h)|2tOcOA-@0*@B(}p9^!l8A8J2-7XFL&zc2mTv)AsjULJlo z`A&F@>-=Acha06w`z!GT*Z#S<`#|zN>3(@b+oAoq&Rao!8NdHwcHY|H z5w7FufycPc+fY2gb-hCE-;|xV`|tqQ^?FJBab2%3v>(@bu9tfQUUyv!Kazf(=Ob|c zV{skNsd$9zdR>gixX#-+-1|g&_F1lyS_$s_L9{el$Mm#V*84nwtnI@~qpN)Hs#B*Z^~%qa`HzdGXB+tg)%O$E?bQK~T8igx&(c>9_5H<{avWWN z2ZxFeV}BTpC#}TKV!bBg{?X!V@ddcoLHtCP`-=7({|b+cH)t&Dn;0*_y^hjf!*Wl+ z-SOhL94HGe$D;w_*D{}jwdVry*BR$k+H;|JZg}Zys^$lZ&&KEB@gQ;izRELrFj#!b zp3<{g`^Sju``P!^$BOIwg)MkAPF%11yKwJn@y=|oLz~FF1>?o_xm+*Yn;`xM>pKp2 z6UEPCy%uTD_2Q+R$KJ%F8^mLJwrf5V*W<25zKqAeQT!tMPsXF0#Gj|{4#tN zp5ROI`?Y7Xz{Xua(UOvO!L*mU?-=8%9u=wGPWdXbJ;3@I-EO(Cr_LHZ@FTh*j5uT5q zipRJh`PXRq@>IO8RPn$E(E;XUA=eyBhJoCGJjBe_gx=ABZQoo`7Tv z9x^{(BCg-F>W2qkiC;thRy^4(el_Q-=QY1Y{6oh73GQzbzYxzWV!M1N{t{k_2S14K zNB;mk{7GD&OH|@9uE*C5_3e_^=gAM^{toe`%-aiifOluPZ)ndilHW=GOZ8vHf5iV$ z|4m%CWAi;_eS`mr>viV{-2EZmf_dnIdw+`SetRzN|0SM#jG4Yhs{bv%h3#IczPr5R z(C0<7@Cd(<^^I}YQ1U|=&qsLJNL;Cf=?)DPb?e#4l?JeG!@#OC<>y_ZS z$4BX_wR$tj-+`Zkhx>>x#QWf0bMf5A#OZ6a`o7}1+tlHRSKXgF_@=M!p)4@X`1N+&fhAWAJY^ zkL&&aZn-xab<6b*lYA5MZE+tz5ATUbc<$rW^mVTK;nJhmsX^L*gm~^YFMVCD{jJ1% z;M26HL_9ZL>1#e7A1OYR^W;<7bF{dAuKKF_G2+M3^D!Qlinn5W{h|Hs#k-T=vpMtA zQT%1R6`phw*KwBN?pX2LWcaQ(9^tw_4^c0Zd^!CU+H<_Po|h)!-U;I8Fb^~Eu#31} zU*_SlFMbmJPiz0F;$4`B8r<(DuJiB-9(5OAPtW&w*hBmPe5dAniqB#mn&eJUb^Dv& zOZ-;+06f8u!;ite(LxSu2Hp9LClJCuSIR+2U7yp>$o{k3> zia(EEragni7qQ%%@dWSA{qrK+A0qjl+^4O_qszrVqUUQo940;i--)~7;zRKK{bYSZ z{3^y-in|e#Z;79Udn3iaVEc~J{8(}QykIh(;QD)Y7U9t~k{?I^f3&|+{7=TYS$(|t z?c^KhZW!veSA3ngeqW+3?oANa{rODI<1f&E1s+b6dqW^}PL} z_TW?Le+T!bOa4Oq2hHPM@%-F`r~4tk58euQw@Qzm2fE?G4Ds3IFV_4_adsgh`SK#hWS+4fKi+jeu!+pFP^RwH5vc8eYABe}s zJK~A)GjKOs#=~jSU5tCU?&nwIK7JbGnTbbuG5!!9<8ATfxVuZ1%iCP{KJFR+9`|v5 zztHF)nTNpS55hy^C*YCsbMe@C1)dnc1$T2~{2f@Y`*7d*3wUV!Z9F!+$;v?#-3uYW_pq z#~U&J9e99iPu{`o|Hco(6XRvLcdsn>RQmhiA+F=OO#6*b!eit2;EC~S+|A3bZw>Al z{|xty|BeU7_c%o6AvE3wkBoQ6W8)X$iSco`o1Y#3Ox(luyzwCJhbN|Iw?k!py#+EJ&F_Z?xZd}+$3wg~+x-kY!S#F+;BKMxt5@P4uJ0f3(0;rx z{f}!uJ`!Jz2lq+;nfQlzjBEdP+`C`$db~G2Oy(glegq!j+H*4QqHNCq+&4Z74~ zk9hQ$_>uI~&wap=-uL2-Pm;eV!rix$*Uz;}@Br8MHC?m^-%S5`>RY5opTmsOo~`2A zbBpG2eIM}v9&VHTSo&Ya-FM=TWs&@j=wh^{31Qq(Q^f!;BVqLYR|8de+plKhreZgCGP(&{sH;-aPNQOf8al; z?-bYV-tb8FXIzi>gK+N;$?JV-cihL9(LVxre@gxa{0=Gul`DF4ng_?iY(6$@u%=VGHpleRL_TsvIPsf7};^WvK zuELYf;$!d`nm=CrcYKk07x8l#=XyNGFJgVa$30*2`h2y~F*5!b*Y7hNiif92{zLk^ zS4c z&dla7#AEz1#yMVl&d%l^#1s4s^6PQGJe&UqkMLi~AJmTH<(zE(Ox&F--hk~p8u$8T z^9%71Kb<#_Z{x|JY`$rGS+0MP_-OLS;PKFGeh}_mCVoHjd86isW%JdVA1*$W_1%a^ zS7h@II>>n3h-|(U9*)fB`{D^cgY)yXn!hTWU!-~bfW2jh+km^N+5EqFfOlYhkLbwu znwHI*D^nEY5%Nj{x9vnU3@zynu9tqZ*#Nxv+)2wpYe~z z<9XTqeB7HauHPqFg+~js`7OA+PrNttzei^oPw-GSe+nMsZ?nEb@MuvsKMQw{i0{Gp zt8s5}HvbtO;(PJ=!tTeiy`IkIJL2vc@qKvX)F1bji0l2#6x_$hFrG*8`1x%A``Yt@ z_@k`v&v^1;Hs7*L#_2E1=DXl-MK(VY4{)8&+1j%zn_r7Z_%p2UH`?=RHow<#GM*Tp z&iFgx!J2ITV$I`Cn4f8QvNoGvf%~tCPv8b+oA%UZ^M@ZVC9PsaUEv-#1Q#~X5fn1jb(Wb?1#ULvmh z;s3NBe}w&f{}W|A?pw*X;Ck8v_i(*FUWJmY<_o&Wcw+ny`j1iHCHc*G zZ}oce#7xI|9q#QWuK9)P^|Sdm@DQ)1|0g_Xn9U!Udqa_aE{VTI{!~25%jU=6u5ore zv()p&f7kP;dZBm)+p882_ssVHg(tY~he!DAZ+nra|8zWPmhBmj$M}A%*Zp|1kK`}o zIpr zmv%o@#^bfm=G)*QuJd^w9^rlI8IQYTvptLP0DqkP8@P93Hvb16;&(9*2X+*7qhn?3>L$fhTxx&WEpS|ApE7&)Sdc?@`R_F5`>`OJ09}(Gj>mM7+D6pYaI) zg5%;!JiJu$cQZdTaBsNyCf4g|+>I2!4d0;sqgXEe+caMxKD3hzsNrcc{&11_$&9lt z9vkn6yGOG5Nw{zP5$!krmi8O}UHc!+_8-_o#_1dHj)%ra;<54BxLcgW7+6EG(31gT)+QWfk${bJ@?@5Mak=PlBL>%YyM+AHogn@mPwC3M{038`zJnx z<#xc`a>?gzYtz^1xW7VN&$mPH0G~n6_1d#i^3CykaSzw?;bZErNd7FA8{=Utemp&& z;W2(E=doY#;6IXILcU4v!9v~rfVWos8S;nWNsV}KmfH>Y*Nf|O!oixyf1>9G^|vHH zisdfCgSW-I;mhzCzn1&xGx6qJ z_s_$+ijptUa40ufLD(A>7|0uAd9k;4$8i*r!uY7efTUp%V$ z-K0m)1M4-9>*uha;R!yJ{r`77Xed4F3uOiN$Q@91+tJ@gd@xGXX ze<~j1GuTfq#e?IeN1umJ!QDyX`tuZzsdo|A>(mC^J6Zf6#=lklRPh0LK_3}s*iAfl z*-c+Z<4JdM9e)ozI8FRl)@z7*5AkA-uN$@hOz|JdFH}EE`~sG{3Qx`!pMrm``Ev1R z@ZWI%9PxKJPMe=2>*e(qFJu4dga;$UmopC+YkrjYd-!d*8zVktFIj;H@aSgo#~IH` z?VlokFaCx0+#>!F^V2YQ;;q~NlbPcG?>+&KZxffZhjZn)H%ojeFxkbMRoc z_)5m}lJ?9I*Zb-(asOWNU)WxGec7MqiI>vT2@mIsAH;G8;n70zapZ5rz5B(B@rQ6f z5^qM&D|qmr_*3}D+OtT!Df3zXJjVIB_;L=&R=9gsT-VE2e@=Wf>pKt+aXr4S!J{RT zAIbRd#=Ymo^}eDSPmI@U&kK^@!E$$~zbJkW{rUY^ujS(U{f#zwuu@#t>ooOM;vxM3 zp5S_27>~P`Bws;(HXh-R=J*Zx@i68itretaJ5TijpP*IO<5 z$M6&IWKFhb03Q5DTz~)eXgq#h{MeSV;HkLVEZ&Ig)Wf*9Mf`Tgxkh_%UEi z$I-tx?za=)!E@0P^%KPVlkbX0xPCvOA0C`6`L~(3;o8$pyaCs*n>0T_T>t%}xtbp+ z&Sr7dn#b3&pTDB{K=QZX@8iiO;zuwKTXAowxITyf8;>s+f1mZ;<3gFYXqfnS`2Om{ z#i!!O;{FxldLK0q5Af5;PsC$f&)ajgXN2@DBmV;KMvBkEYw-xz<^HPucrWsM50v%t zu9TkZ@wRw`zlEQHhodAv1;0#tMvF83ZU*ife*zD1J#Vkmev{vfM|cmG`wQ+WWVv^< z;5`Phy~c_!BHsZI#);={chlD(Jic1|N%E8N@EY;Mxn4i3`ATv9Jry6~?t1Zg^zXu> zN#d{3-{vA2XLy5n?sA#F2IEO6uD_>ZI_}*pzJi{oHIHlm$9Ozh^0_~zuX=;o?o-8| zr>6u@@XPSNcyNp4_4}(=;2}Pq{8Zdcle~WKeID-N+W#UR;d87mEMM`D!2a2gUV$#}Vp_#E&801$U2&AILoS z!M!KMH?!Em>Q9P4ijT$b~2J%_{5Jx0E2lFX;>=P%+tP0#Ci zwaLGOmz(@&sW)}Q%zpkeUSZr_BFBaIZuWTD2d^~wBk<7pad@fe>52Qs2d19yJhMNK zOTEC=n(cclo*0klDK$OMlJ{FV+~+IUO6*7#AW=eyu>IiKh_Pe{GMdAG>;YZ%a(sTaEKQ)R!><1wJey&*l09d0aM zZsuol>P=l}w#&TK3*2@y&rfLoecAK#iqs3;GUhFhajvJQ*6g>NwBPtQ^ao~~zv0nS zvfNVLFhgaYi@wNim%Z>(<454r%zk@(>V+;g;Cg7o)}+= zSD5}c@k--g;6*pc_SN&l52@#l>*r*BefHa3sTaB<&2?d~%j@PjcmA0n$8|{l2;5B* z_wdfC=k}|cWw~YeS>%s0{XLRm$jw4@V_Wvn(uwItyisXbcA8&2?pTtXVk-W~s z%Xk};|0?ySZm}89-{g-r`NCl`KW&YB_%X&i;iblV;q8nMO1;3v%Va()4w4DIl6-rU zzcuyTeOIaEtC;@>@#Gls5Pu2x-^*TS-^0s|Z%I9OeXQkp;e7sY>V>YB@#N9pWVp=F zCgUwr&m9+Lo{z@kD`cESTu8d&ff-MKyu$bhJT!g-US)hX9vOcm^#T`~<7+uS&G-hq z%J>)fT;o6Ek@5Oh$h?)C{q|toGsj)m)a$$8AHE^L1~@Sp|H3QG`tFhYptkP(lV^HLQqLV1Q)EAh*xybd-+}Sy z{cU;bx%WqNWWQA(PQJ+WPodvUlm4Cb&!wj+J-p3zPvJ$zU!}jJ8P7)g7n|+A880>G z?SJud3JyS1q z15HnB{B)ehU9KxV%glWC$1BYC8cC14RpzZH^LAtE`L3SXKkp(R-XZyE?6{BNzBv!9 zNWH*$92a{2-+;$A%KCaN_ha1cJ3N)*+@I@STT^f9wwv=ty-~8i#VofZO*_{-^?VnZ z_X{O>V*CW$dqR#!?dd~*PqRM^!^@3N!Uq_ii&vTR$#bdaw!7J0Yw#N5@8h+`H{+X( z|DJlG3(Wr0c(lx0V8(d}KFs(Dspq?5bDwz*zMI)k#-!fV#b!UhmAq$q7UCtwt5Yv@ z6=poIw!zYq6}zl1L{ z_j_-pUg$=e?XnfGF#Z=l&1~QNt7N}A*3AC_c$LYwO+7bnW;~~*p6|-cJO`;4IG^{+ z<(&7fqTid%{=kLd7JRN*?gMyad1+LUTJ(5?sK1}@5dj&L*vik4liLpe+@su%)_U6V#c{O z^?c`><7gN8EhfL`)phgM)YX{du_X1}{i@l%e(JgBjizTH`NZ7kj3ytN?Q$b|H&M1@ z9_u>?uQkhkj2^E_j`!ThI_YZ_exjM5jd*01`(OIEoBr*1Q7Gfl=N0v?k>ke_OoB_$hd?@rzS0bUV#_jv-%a#xp7P+s$;-T^7^m}GJuaS2= zht%!zA)aS^3m);DY9`z9_tbOG$<1}P;kB~Ac_+#|>-Rss)N|{_bKPU;ISCJp_e;IN zm6-8gl6s+=Y}WT0e46o@^pu-S@bTH$vY?}nd*>wQ#Tyo>S6@RN;K;+`4L47|kneW~ZJ*PCSf#$9AXK11F&{cmXh z967G@^!tanyIs7#UQh8;OphBc^W$#gen77a_+0XO-fowA?)i*4@AW0Wz~qOfUf@d2 z{x%*jGkzOAk?DB|FE#VF3XjeGXHDw4`=zrvFEy0;{D^#+>Dht1S=o8m{W_T+{~qx& z=DB(5`L3tAUbM!`jd#TlGv}W{^cR`;7n8^jFg7o=X`JU)-m@n1zx>6h8}eUtHWb#BF z_jkSVQsYDMfX@*s*uE1|&prP!%bk&W?tEqT+Xc99yc#bz{t6x#e+REH{$=X9&q2)i zf5Iz_|AR-y51AzUVYTs7QZH}=%yD#S>iMqP%)@wkDz;|#w;AMPlV3=GVEU`^Va99d z-(;>M@8OB@&+#qBx8mE4|BCN4z6*D6$a>|mKNQ>`^Ok447%wt@C|+#5J?` z11~jx4qj$_5bhhl9PerTD!knI_4oke)9}FfY2#-G4TjK7YT8sCJM8Q+Tg#{a;3 z8gFu=Y{zor#rOc@N8y3-GJKfvo_K}v3-C(gBk<7pb@(*nx8haC=i_sYKZZxf*W!zf zzmHcN{|R4a{9imao_~|fbB*!+@mk}@;G2wh!4uR55fcEBk^Iz zC*l>xZ^bK(&&NaK&*IaJug0s4zlF~={uv$_{|#SkyuoCd=W654@MXpi#be_g@fzc2 z;kCvGN^$3g2mb1Mc3+?*E_RdB(TlMaKWai;Wjfk@@tDABC3~ zFT+cX_rS}HpO5>-hvGerkHyQ4--Hh^UWEt7AHathe-5uO{t8}c{4G2*{uw^a_>Xv% z@qh8T#*3!P{71$;e6jHkc(w7a_%h??=izmk4!nYXz1mA9a z3%=9%pSXKFyZ<-5MdmHfcyqkS_z`%q@iN>qekNXGJitqhkHgE1--!FhZ^L^UpO2Rt zUx5!WUV{h5Kf;F@{|T=!zFY1KA$8A5Dvj@thsKY=ry1{xR~he*&ow>o7aP9^ zuQt92UuJv>9vfeS*BIY~*Bal3Z!-Qbo*3U_y3FSmnejUSKiG~Nq$wb}i@Kb~iN zI9_CYB3^8KChi$ufR`A55-&9#<7LKcao>1?_cZ<+UT(a>tumhjjPHvF#@pb-jGus4 z7(WBAG(HdyjgP>m8J~z(8NUsmYkWQ)8Gj64Y4f{nyWu^JpNp3p zAA%1sUV#V3Z%94&J!dn{JIN0-`9*kz@fYz*<8P*(?`q9+&QHlF=K1Q+P{7$#&7t&5tEtZN3NCBlQ9|&8+XacoE+p(4GLVGWm+sbKi5|^BVo0 z>h*YioR5#(jMNKVH}f3+e!SL17`g2d8r=I(H7BdgOr=IV&oBgx!_PY5j zaEnd8UFuDpXU5qJFExHK?i(MEmm9wu4~##DR~UaE4~_3gz0f6Q9-36i`7JcZ^&$8) zdVyPJ=J_A;zmY|qql-@h_FgXuZV^xT+wzT0B13k&Fv%{Z6f6=pxIp?@*``hA;UQ_p>m z#hmww=g9t0Yy1>EF@6QU-S{22`%vaz&krl{BI94{&GuS=FE;s?Q_ub02D9Bi$7{@f;^x+kC-*%c;|JlJjGvr( z?&ng?cDWF*Hhvu*8@~&$HU2D~7~hb3eK+?8=9BI9Exycn<9qAYE0@1l@@3?Y#Y;XA z*Y9bJ!^6qqdR?B6FE;)vUTgdte5djJc`_bvO18f(-qZLwc!lwC_$ITyci}sYzlcX) z%5wGk{t2E`i0kp#c)pBtyYcqw*Gpcnn-}74Otxn_USzyleNwjPL%h^@!v)M+D0z?V z*k0ZA55`N4--Y|e*Wl&Gf54;nWw`@b?mi1;JiZxEDIOR<3lEKtz-!I^IYs+N%X0Hr z?mWE0jPq&jH@*?CGX6h2GQQt^vR*ySa(%qopq+3vmZx#qYY zgU80_;9HEpj2BInaq9VMGhSxA$pbRZz<39Iu^InBe45Em#jA}!jc+o(5qGy_$N4v2 zV*HQ?Wt`>4yW^F{N8*w3*?5idm+|e!H{-?Avg2&}kc`JSUWyMh-Vfho=5r!mW%3c8 zSC!r0Uc<|be}^wKJw*@8IER^hXMC>lL3oYvoA8~+pTtY<$d0oXA7K19e46q77s)u6 z89x=@V*GNv_|EKd@5Fl=e*v#F{t3R=_%3{t@gp9Qapuj=F82()%=lP*nDKe|T;s3e zHO9ZicN%Zbp2qiHEaR*+UWP9= zJ_z4rd@`PQcXqkY;AO@?z=s+C6Q66`drZbzW4tTA)A$v5$vxTe%*F>8UxiOI{uRE= zc%#Qms^haG(HiJ&2{H~yuw_6x8RA%H+@3J<8GAYdR!k%@M*Q;J@GSf z&*VqozVTb|ym`{2_vcUHfyr;gL*xJAi8&u0^rVbGGWjlerJ1)Ocx>{M@X~8#oO)le z2=|R|!oBH|*XweFr(`@;X8zmY@yC*1#(Z9aCuTe$?rxI2ZkPGEXM82@8{dKl#v4B^ z;|z_rQGZ32>od;t@Ywhy+{M}aBlzOc;(CAk5?*cQ^F8f1{x@E0+%6YV$KceiR8&oZ;zqj1mkT!5DvpN#v)AH#!bc~hoxTV!iD@?75R?jW0UWPC&sT$J@>hidG2u|zQy=#e7o^y@twwB z#vQ+}Pxt>%@I2#x;6=vkFRh!00#|JO0NgWPntGw@X`VZEAzxzh=i#Ns2jgYNN8rBk z>+qh&XW`|>A5J~@^W&Sc&k5J1UYPs+in4umKlv1|HqXa?p{LyRGn-f}h)bkh3x;j zpDe}Q&Eg)%<41U<$-5WicyT-zDkk3+4<=@hyAgPW@rQBG^n9#t#v*FJkuQyKau&-`|x}4#EjV?O`D zhne{~JeK8pCO;_k+|NhPl$3gV zX}|F~+Hd?B?Ki$&`)jiOo3-EgF6}qo;y-L(4$Aihz?{R(`oqA*E@%t+(@d>Htz9;#beC{9Px8eT7;(Gu5 zApH^dvHWw6ZWUgI^Uor=jd=34jOTaW|87k^cXwYU{rWwD-^oui_sNacvE8fX-vMEm zt`HB+b4+vtsLhrxw2x&=u5}DOGf83{eM>uy>jT7^#2VX zb?MN`|L^~eA2&4p)6mL_i$`60O1}Y}+O;3t&Sn1CKKsWG**|v7{;_lRk7e0EwktJ% zHr?$^TRT(N&h)i6eeF$Od(+q6^tCsA9ZX*b)7QcL_Z>~Xqgh@@)8EPTbuxXOO<(7Z zxec7#zL#A5f7HEOa~sE!E~=m6hx0%&)`rB3XnE#|;!WJK#< zPXR5 z^MkIMA9U3mf~O;ou9_cwepk1FggA%+SPPn_ZbB-ots0ol@~RFP?!Aiu`&PnX&40ww z-S#q|gOuvffzn(bi_ybyv3i)blXtVCeQw{iPt|zYI+=dn6ti+r*H=X|DcMj(8w!yTHOsgbM0?pQKKU+5?a1svLx+zhU&}QqVgiJ!4t(y`rF|Cp< z2{c=`gKXWDNJ%(k>!yTBLYu7{#7Jg59AxVTWivy2m>rXc*}5HO>jtGY$2VKI!|Y@` z%+?KRVUBOMZlAJs`;@I4l;{lKPuaSC%GT{uwrm{)Fhv@1ILLE2$Z#;E9UP)v%3+@IVTQ3GjTj&0IUHp; z7}5?7QPDo<8Gp_&Hlz{by^nbofTt~QiBl#ZPJybQqB1MaF>t@57`Xv}J$iNo0G=s^ zAx?7yaSSva7!A3-TxSEAFNP4utzn4M9M=>hGB&7U#6UA-;xgxk*PbDci)V&M%p^CI z_6%{#B-8$eIIg&GPJyaP<2nj)1l;c!x`3k?QAI3qRAxn-0<%L`5l3a-Hv=rrF*kHA zahzjr=vv}5$8^kC;<%NBa||@2F)nj%obMarxXcC~7f+a^z--TgIqDJ@&y3Qzc)20H zZ;0dK32_R{_pA`dWj37C;$_Ng#(7-k+zi?`#BuS2I0fd*oSQ+Gb6n=!3_9qTL4c<- z$P!1zQ^YASTV_QZwX@|Mm01zTz>ev5kehA*s$#^&Gd&x1)YE8-YvW_{FjhdI#!V7BQLaa?9Y92YMqPb}xO zc0;<$LZxoL^xGUw*zCo>wOVgR0Ywp@>spw!0N^R5r^wYC1(6 z1I^%%%bc4jpA2zaJOhtQlA9Dq9g_m^w3RGzl%pa}f!S74#8KHS=cqvxaSSv=H)^G$ z+@t`|Op5_^t|Gg9F;ofjG936c!7!5rr4M6@?(9Z$v<3|NOC?5m3hK@fU z{#cZI`p=_*j9blEj{#sYoX!Db-s9DL*xR+F zV;qwbM65ZGQsuRuW%SMLT89lkZ6zE*3SuQ3KKOcUJ=Xq*aPa|U0vXmX!)4>8PXPYO znQ0SK>&Y-ENEv-khC$})6Ybe9n`%Bmi|V!=mF>{h4OG>#1yXF$^J4m;c&vI~a9TZT zPs?FFDnraoeFo#nB7**mKI-))pOAcjp12){u$^5(-}kP{c^+~0eNi{da&%oTpXyN? z65YW3-MehRObZOBpwNQhpA2|VOd@Fcnv(A9vLf%ZHQCuc#~|!1`Q5T{xFzcMZ@uy_ zb$DnR_1k<{&t~So6VIF+}e&<)lT7nfBrwHX+| z!%NXj{b_GlUD6e%BOAf_*(CK5iZ5ukbsUIa%f)Z+4n{snmRGxMhV}fVcgAx?_1Cqj zLEh1|fW6*$IH4(p%Bw$(+)9gZ+}j)$MDpckJ#JO@_UNj*&UU`YF13&_u!RL zO+0aIirQ3@r)8fAvsGE0eYT=e#t`rGlh;G>+kvE8Vuxw9o44o4Gw4SSzK2oSF_a= z&O_hmrjz3<_@DL#PbZ^<`MCOCj`HO_m*&lnU4_dJUKxmMP@?CIs|!86K0rNPeeazu>gn{?!e21+gtwS#t{i!q`?Bx` zdYpT19E#<-(rEmKM%Gl)es|F0x*HKf1WJE)8HxtM&MroJ$<`>F_q{otR=dW_&aTI{ za{|qZMccb6U$1j2mmqg`fqM__7@mXEDYV*Y*tk)3 zt|wlsmi=kH+=3Fr|8-DrO(?ZmpZ94wg?Hq7nvu|~%N12elSof{3x(-qX_(cVUZ`y5 z0rnni2Zi5|e%qYGg~DHm0{*%`V|st_*@hl_sP&DZM?k$=qQ=rDELMM0vbbE`3FhVN z`hHuo5#RTk5-z@-Wz|Gmj8{#GZP!ydd@e_KYBX-*ykX#It_!p|JjG^@?XreQ?PPk1 z?cRIYN^T(G448AQP0QH^(wnRp(Syr2B1dH>BTdz=6%3k)C3BmNVo?ma{dN9$$hc4% zt{#UyLWF4VVXTIBg4xeugi8+LF~hj;U>0E+KL|zFXru{U!IV4ex za%CVUk^H*LG7`kd|L$$Dq`k%}uz^H6F+((g^$AY$Eym`!PK!1fiXRV_k=)8*uzk4t z^l_i!4*vP2zEsi8>%5v`Hr!NGb^9XP2I^k@V0c4KNq9#|(5P64TP$v{T5*%>^7c_D zD^HvRo8o)eUgkd+&Ej|5E`bnVls%R3568)rtNf1jv96zc_p6L9>SKGOa$GjA@a4~} z8F@m_FqF$LF&;e?!>8hNgPSZcu=JP35^|IFDpzdaQ~6#bul1VFDR+FS27@U0YT@`FCH(8b z8W6|?3?RmK^3i5uAg(wD0xwmQvjJhzjzPZM;AJFOYW%vP4g$03P>B$LT0{V(4C!UZNEr_U$TORGhL0G(ng;p3v3`A*_E@!^3CSL zq+}abkC22UDt17_kB1+W*+PN>FO_8~ZGJd5Oo zvNQ>y>r!MgXA&pu0{;6EE8OG5&TH;^Se;3!yJMq`?8*E+fjfy9*wXq zXtM;1DaN(G?=mSLX^?Dlm<9BPB?MVDeDMtF0xjlmL(JfMM!m{5ouFW4C?Qha2oMfj z=PjLVHO4qrGi4Z0>)KNn>(SVvu!wLiN|redKiKcW933W@r}Fz~HCy~zH(uU8FzTb7 zU5(`K{1MUt^@u0{ z?*3<(=rX(<8m3%9YEys2hFl#K+qAG~jnTKm=l8t@MnD!`y9qHJ&#}??1;?mdX?<#p z1soiXu8TQTq?B2V_IT2$7A9`WS^eU;&+BFRij{Wd%0W;&Ez1zH6cBuL)S;{`9;p>B z1DaS^TjCm7z?ACoFE~>izg_ovaBK#rsLlR|lclS9fK;C`djD5cC*XFEBYJa|ZWz

i?z^l7^Ce@-Tuch*n z;VJjKmffOmmwC*n9Ib{+9@;^XYs!(QRX{Wkr;QYCAtqv+4~qKhEebGm)sKJrdKIsC zLwk^7*!*c2LGS@?;VcYiO3W0COh_BSBUv6{-Qul`&qX8M3*9B?WoXm1O+oAR#Iy#A zfyuPs>m$#4Y#Co4ul=dklw;~tRH%a~NKrLX&1I9?JpqxX`QX4}a_YdtwL=;3HW5+` zS{gqOWq3E)1Q>P$&emQFZ!vmYO`mln0UQ`fU;)cEgX=fL+xgTDb6XA0H%`Z3Dq1XO z-+GKP!qyFyA6o#MURFrMUPx0K^bYp>(*L1+w_GSPICGWx#57UW$|^p(#aLfz2M>e8 zEn3}oHb1XXP$Pez#t#(i9iK~@(h(7D}gm9eX&jivHn(TqUt zv|v&VV3Rn6Bo0M|LpInv;OrCamPrYTg8fE`LDPTr*Aphk%x$=sN$xa^1?deI7HNvj zPJCc+6+P;N6JQ3#%Bef_JxHP0ms_aK8_k&lhfItkFL7{c+GDUorRS@K%c7ekYVS>i z-gXKn%V(&3e*xzRPxaP$(@Ds!(AZ$9BK^mzTw#?d=YR2styhd6!Pc=3FDh$iYAOt! z$RX6BWqIM+hHVqc_t%lnIVgrt|pz@;yNM}F^S0l`VRZ{})X167Z zHt~S-=v2BN3zetrqxsJbXV)qHa%rJ9KOZRL*6CIW%3nL-s3AgvN2#6)u(RtBg0~s@ zn6a-6O+w9U0x?0w$|f`bSU9+ubmfZ>u5|R9K&%2Wb`?|X`mp0VgMHd#Ie>T31p6>? z#zAvQ)Ffz6!FsR1rCAQW#6lG{mQU+SG8uBEIK>&5m)w97z5(K(D}~aA>|NMbg7)Tb>y1REb4mdDhemEoBnZo z-M8E@EQZGaM3h_}khC287bgSg+$~&t;T>z{MV1^RqiUbFr(cONc|A`>bA?@^C;YRy z<5-ctWZ|YcQz@9mu;%l?wesw)RQ+KNg;aQf)&YeCp2{mYZ@UVIc-Up!x(l&((e~%? zGVy?9pmRMO4}#ovSQjl|j`& z7AmD*synoUg4&jt49{t4`!b2PqTD@WKzmJ0$e00aUS&P-IB-9At-Hztp9Tj4*dX)! z#uAX9I`1>1hL97CBxo>@hn~R&N2j>UV8|v-`4(+~!5rqv+i+hz8M1fM{jwICFdaxg zxCVlY6uR+pPM<2)hdYa8dCrk6o44cPUn?AU*g`^GC*}Jdx2=w)%M58wd5#OWB+&Iy zbuTUY5RLr42cnB|NdgZ^zM`|xs^!MCD!oR8hcN+)83#QRU|}Bc^yUDSY<9eY;9knI zsof?OtuEENyLQuBG3x{L9!J=L)f6snj>@H~ zFBN`_FuF9>rF%8Wu7j-ceb2s)P>$?LMtGam;w^fcUCS0EY zM-f!B*AqqC8lKW#+&ca6{GUl7O4s)=g`25< zFPwx&uFwh?YI2CUo%66sF!dCSGZKneG{s^xk8{0R#pr0G9-~8pJY-swIaDD%;m-?L zWu5gkCB@9O<#?PJMi#WQyMR4h)+i{KI-B*_NJEfg#XeF(Cms5dBEuM$vMg_9)eB7s zEDhC`Q`qX&;TIXRD^6fzj*nkVamDV}*&`Yo7^GY?X)NW3Em?wQ0WqdKNewC>COqR}GQN-$O_FFDfTww7<3!-=c1zQDtGlFvj9eui9<`oP)0?z+{ee zBKV^f&08N^oZ-{JHzGh^p(s;@;)^NwWt#Ni-uV*0)>bCg&!_{c4uag@MY7LWVf)AGG7jCiP5_W$BsnK zh>%UBZezNx)5;*WHQ4X`2EX3Qvk|BhAylqhL|V9(dBjAE0N1c&UKv#hBM1HNRVze% zDH!P370zIlwwX^ks#+XrIT69dRh8kfz;)h0x)@C8t3$7iU@jRzEVN+d3+Par@yfH6 zqnJnLa+cDR0uO0Q^ik2S@ z1rs=uxY=RHqDF|&NSVd*MROByR7}fJkm}$&WeAbRk?-0gOm+j`%r-cY3-Q-XtfpMb zTQVj=iejVWF_HB5W@uLx%ckR-`E$#M-WJGeU=G5Z4B*NEU-p-hsj1plCX9;KyTev0)?}jcov)PW60p z-qf>SVUx5uBCS46eiZi?i%?A-9;#rEXLiY!jw`ALit{F};CZ43DFh0m>9^1=A<%WA z3FIj&(OB^?%H}PT$ecv@L)@cGw0aLG0~qcNh|cT8qlc$1f};wYJs*dMrV&kd>SWG( zDJA!gq~TiaCE|t#B_7qYI}9%D%I*Ru3OHv@%Ki#2uZUdV(IPnexeU)BJpMpl_%}2X zC2AXj40|~+j=cudFz`_~QF~}yeAea_SXyyV3t^O48FVnnb6u>EGPAnTi+VAfXOdGh z*4$NFd(JsVb5?i`p`chUDN$mF2rC^D$f0sd;Ax{_=`rV&E1Q?8n%uNlyQ#mkYoIfK zO*6np2Sh3bwH#+SOdmgpAu$JwcWz`v)Hht z@)gn3hn>@@RB$?{vf?7n7EkkEWMyKc-Yj#it5O0=;xJfc4>$ zmzJmx4f$m`aeeI_+E3&N_W-$}fHHnKt8j`M}lPvdA1i zy*_?fjm-s3(?UVu=e2I3gSttI z1x!Jr)EKmQM!~5x{9b)`*8;%ZXo7*SY#n-9v-2Qopg-A);XK}JG>jJ9^RYO_7e`Cm>cS><*^%nsQw+!f&|}J0U~TdNRMhL$C_@qJD4*>2uwx)@@|O< zR34%T8IG!#$~#n(JB2~JOTvb_Fe>XEkP9Uy{ENR^vdJ;Oy)#4fonTzn_2QJLUKSwe zro?LLh9r0I_6CLP;2dmc_l~WDOP_KN!`y2%qiJXNL8_q-=WVVI&J9agq7Wxfc66i@ zTr?_OY7QcaV*v;Ck!0bj!l{n%ab7!ENW^dX1m!z|jbVay(pSY8Np=$jv;qAvBrc8 zQB`~V2;&8ekz( z1ve{0xSPRH@wlFIxx?nVeG+yJ_Xu7|H3=4QphZx6L&kDIB&ZC!UBOZT=OfDwxxh!m zeHZN;_+mYSwat~6!?x!fpwOx$>lb6?Qf;|?N4&c}RJ#Ch4_Sesor6U^yR%CMka>4F zOz_uK4$Wo+>+>Baw&f%v8Y+)ljsz0jZkUAkdW58PI~Vz$yQw4JkMQ*gv%#gRg3;fM z6cI83dY5Gci1nS}x%?ZrK0M~J!cCBnYXZP6Cxp&(V?fve7$*B`g&QPp>CxLV%TCUuf1`hZ1@`y=Ft3lEs2euSo;v<}31>#~*YZnE` zk$x-(6@eCfJa6-PUeG40ao%7>ffs`(9wvBo^nuZEK`okPCV>Y{Qn(zvv-^Ni0C(h! ztklO{FGmn5lB`mofv3Hm8tv2wp%fz{BR7`<-=#*>q z8C8CcQwK)^tr1!oT+M8r*i+w>uV(~0g?iM~3rE7WK~mX7m_<Q zXv(;c-IXO89!|q7mH2w`e9S^boFL&}?M;0bLI=F(pMvSgadF~PbNhD#^+=qaEDwlV z?4#lasph=NHlg>Cr4%6tuU`wGzlK`pA3S{kKu>`*iwU~Lrqi&LYO=z0ta9Wb7D@}E zf25cEttzKJ)uiS`a3e&0yLmE+z2Ip2viy(*XAJg=!KxL4WnLV1q!FZ(fSHtT>B}Hp z!To~JSrj`?tPVC;AN>_uWA?CwQ8W_6ClG^#l*}oOdAzGu9`9anhm^vV4}vDxYU}Sjl}pCqbc~~R%zZBo z`DE;SflkH{dp2+R61J{74(2$M2cM)g9jvC?Z9fuwP=XW&ms`bDVG}%H2tg>iZ^&5* zM12B1#zC);Fpu$;wg*!6FE0=m<@|I-RTc4b5$oC0riDZfH(}wVq~rCID}Q(J@XKlc z)@BTa4Gr%617J5xj)?(@=dX}ypzKoAy}zhILn_?AaP7)ohUD|FYHJ1834H^&spXu) zmiZO##Ewe7qKvg#?1&5?W`+G@g;}gt5u1Ss`wPz+x6NmHAn3U~B=az+ZurV#tHD0(?Gw=WhB`zFrJJ?)lQ zsydNL7)F96w#_Q`flVDix$E+F46_Vt9J*nW9A6w?-dG+CO@bRGyj-4$BppQWa*jg{ z{6PR9*z$rnSegRYs1Xyw@{~4%L6nEW78n@ICw26RfI98NYF;@*18?>vf>&gQWeLr! z<+V6UUkQKk3jh`iB^0MH7T$-E*B4ciSR(x(u)IqpU|lWC3OiEXvl9WyyNz&r#NHJ_ z!r*I*2_IZ{?4q@aE!S7LvESn+c0KRGAI4YIJxta1VgCx$p8$ITEk3|vno4 z`RA6Blf+gdfOZ^UF`9`wICSy?FfHvJ49Ah6?J-Op+bMZ0hWo(zKsd->=g%J1I zqzZk{==c_ovGmLJvAik*vB&Y;<28?_^bVMieKi>_zw;nh-A@Zml$0Z&usp?r(ic;a z(xSalPKBiM!byy35Z*y)hb`7J01<}wY~gp7Qe?tVU}OfdD?rcutzyN2FKku);8-TX zxc&t%Zc8zIZ85~&54dmg8dW6?C5pMF#I>TfgpwE$;}Zhvb{-ZYOE-QUg|!XOJ6Gz) z7#P|-<*-hb!wC@&7-s4rf{+l1_s8yw`5+_I8e4F0$^sTdeUnoNIxQej=n#<|+&;M;yQ^YkNx^}kU5JN_6cJtQ z@)7Ve^cGo%d62;!=8(xW$WVf`mPp)Cz0i zvznLPL+=DAGXfpSts8m=ABT>oKAIypSi;o1S2z@hn&bq~f>8;*I44ZDc*bceo@_9S zA7S){3jo+6_3seB+*2wS@~m0N&x5&D-2=Lzh0TN$cLkMI~C$1809?b;NDaE8G%mm>9u`?4L$6HyG-z= zM~&f_yE&UU#-2mD$Rary)D^#O29BnajWv3S^3csHqzl;X?5?cf<}f|>r0i%rFHA814Xo|j`}EJ zz=6(8Y@6rNtYY9(tIQm2#CxK_mK%JwUPJX>AmCQb-o%d2)V9xxTu^q^;Z?#*k%_aqI5I}@vOtn1)ETs4SHQigWk@|ERyX7 zME`B}So1khxAW$ZRd>Sfya6iZ6WeOj3$Ho^7`ZWP%jToP%QFcks;`fac8Vz~N~@)) z7=&Tv!_fD{f}{p2bnX^tAKC<@w7j}y#)lxXKseN9co=9@Bw+(wUv7_t?W5(fG^%Rg z5HDWi-7T+^Lm`da5G7A+$>dJAWvLrS;Mj-`I1TY}~TtJMP z7xk<_oLijSWYIj+!J_6}?6kE(^g4yjRTapKlSsMuQ(l~ObGTU=)puN0z}wjmt2M$&@8hXR(?hOdp^kQ6YsuYk9hYmL39>==fP7=c8#@w^>Rs zB{D?lQm6mYayp1Qo;{+ERlgSA1DYO^? z4b{JHPL9sfU}YEP1Em)vdD#Y}9c*0-hWMywa$KZt{m|l;qsuNVDxEHmP((SZu>hM) z7)~MtM`?8KJnZbQsfSI53UR?mX_kQWFwp(uI|YnwTCj~WoK*XKi(}LoOmMD?VoX%* z$7*@9YFfMsElq0E$?FJ;r-kVa4()KaUPKBFX88lK6rXlIABvL81FBZ_K`I2Ldk$@b zOxlLG6e0Yp;cDK(TVFMae;kn@@n%He8}22Jk23tU8t1koF>(W6g?7ndMT5$Ny1E6U zoF|}{Q7g^{a_sbmmKfJ(PhQ}1;?H3?#PbNPAA6H$W zhiCfrEKq|SIF_c#b|A_@W{Ph~i8gLN>cEaK=jIZza~?vjX+8h6h}!eKj4+X7wJQ{N z^}VBr+FlNDnFjYtB64?kNDz)WPgJ=-kg*hRDO>M;UBuAc1&t6A$p`*H5g10?C}5XV zi(7nGgEd61#A}FLZ>=FZv|Sp7iwu()O-Zsea{A#r|@&9N;hy}h$V-^ zjU1eDPvt;$Fex0CzGf*<*CuRm9o;*kk1?*XV@x+USFt#aD{zc)Cd?S)F15rM_kdrF z`N?){jKOQ?Mx-YwH~JD(cQfpDx5Hj{L+o|8g!c$xQjG4l*z0bLz3$f7?{1C#?$+4v zZjJr!*4XcEjs5P{*zX<~``xYKJvAA(;eK~(9CWwFL3e9-7t-Rq4!T?8pu05=x?AI* zyEP8FTjQX6Y#emA#$k7B9Co+HVfWZL>~4+2?$$W$ZjHn4);R2Ljl=HNIP7kXPu;EY zsk=2kb+^W+?$-F!-5Q^|TjNuAYkcZ%jZfXJ@u|Btj=EdpsJk_ex?AI@yEQzY^LTz8 zb+^WmYYo|hp4gXEq6JUfA8B3S`-ibXKR`-CR|R*888?3;rtlenp&Z6W@P+XU8dXA| zk6`_S%ZSF_(e8zPL(;GRb> zOiko@eM)IuM?l>eKC7A}#c@T!1_YXBDX#$A1)004;O$-&O6B#@y?LzH?hgusO(!mq znzxFCA$-L?L`2Z04GH}hOj;PYUD^QgT9~K5-uZBP5g{TzPA~f&h0!K(P@oJ!>b9%6 zMsVxrN~I9;lr{Y({Cy$zHGF{3wgg;zUIyO4m+xqYtzdx{n{qvZGc)fTA04)qA1=UP z98QK_Y19GFhZ)`gz~fo=K{H)?wSj%ODPO%LUIje7X#g-Onx=U35=40@w4tYg3AsPC zESy(Tfxgq1hWXHZXDe!)VaVab2gy`?L0ypmnC*)W3cu_DNsyg5D=FW?C_}s=*U=J& z8z~Gk^^V$CJ5pWO(bGvyI@=})S^>8W`)(Hl(At`5w{3(pP$%w6%a?K7)0sUO+#TE$ zPw27XIfaWaf;!UT*w?39mOU>pT0Z>f^O|#W$y14LBF5lYgFcaK1l`H+d2w+~dhz}4 zPOdG?wynnqALj<#L`A|-EhKwmmy>QVHAy0zv<|LdAt0E|T3`{K;W31}=xWhZDNMJk zue!BO`dH#_ZyA`gSwQbjBwZR7wl4lPyeu$u-t~+TsIXYBZPs5TYuHww6V&k-qIx~% z5)Y8!ozifiEpYOK#W4k{upeQ&nbC<`E4)$@wW`6wOPfg3fV2iVN)1*0C8)TPykqgs zYj3%NVTh#JZK2Fe;vEO|?n@2@37NeX@%P4u5Oy5k`lf(OC?nqVjZ1jVixx?0efQx0S3%!z zz`IQ1(rqk-AqYx0mkT;q@Iw+^(6JAx3ew?T1qKNetKfzJzk`S<*1Oz}N9z;r*wfLK z_fM}eac}A%uCEP&;f`JC?W_#xy0h(qrWPdn=D|gk&Zue`a5@!N3RA1`gC}h?av?gK7w5)o4td>{XOu@WVC-dJ`K-594+wD2 z$jXai6sC40AsnmrB!mwO1j;bQ-d9;oLLp_qBZC0Bij4WtRRpL4*HBd=eyUt4 zg4DR^*hQZ~&59A<7z_DJK-Un2@rJ{{pmk9AVv4I*G{}VrbmKJADC$25Y(1j|5Zb+-U(26f#(nY!luFHwW8!|A^l-Mg{ngml^ z2H7N9tH{pcFc@K*4HJta1;0WXGdO{5oof>E18(Ml2=Jg8m} z>8s8pd!ju$00rMb*8~79j z2Mva8O)70(ib)WYJRkK?K}T_68Mx%_wndtc|JH7bg)&65T2hEtKp$~=JVCUmC|~JJ zF>=FhwfI8W+Bpg~b`Ec>Cz;M}`zcVoKU1)1YB$wXYk;7pAe+0Yw082GQjIS#+?|6wc}s{YPsp{z1uV&f?gqpPk% z%0bvqn@K)zCi!tQ$l^3lUW9f9Uc>XYo}Nf3616ZCy|K9-`ptt`p9 zF0n+qSFBv59aA+ypOq@FR_QuCL+gmIPCOotC1yME)-k$`yPdu zydKkm|E3<}>cA>50ZAXS)yXvQ7S{>i_fBhNS>M@J-#9X1=&^uC!EiSmu{>U(k?yZY z?-?|Y3=zv6VbwG{1-QWZTmZn9!Ov7t@!%$)0w7C8pevisT=c|`hQR^_IV~kP5pO%R zPh1T1$a=93C(p9zQjsaHU{?qUpJQoIDMN>G?4-Q5;q;-$``&%nWftBjxZfTYcZI=Y z>SlpHA1Sy#$;B2^tiR9#c`yp2ncC5KrgvT4uZWdBz?)>(#o~9^!|}vB{P<-Ajdnc88xIRCIYa0-X8p~L0x0yZP&?B8 z8E&quU0r9nwaaETT>kKXeu%Pd&p6h8KmbGI1#4_?s$!bS1SBfO5@~;3pV&zQRBS0;3PoUDtUG3jLL4ZEwBaR`_XXs zMEFt9aV3XEU}ZeDVZ}^b1UU7L95&aWaSF-#4_9pCwz9Je-xIF>aokeNAVX<9!`8Bs z{m*8Kcmrgzo7VL+9L|zrX#FmM!%`P|*d!DxgZlK<5ySgz{!-z^W=pBRbENR$V=SsOJPG0a;#A#Ilq(8wvtoI9 z3Vj?qBZN~lS&Qws3yww=*TRVWTQ$08< z7Nt*zV|bj(9Z)%jarvSo2!N_Q4h<*Pm+fE~XeY39!1cC9HB1E0l}fvHB}pTAE~yqS zrc?|lC^d1_um!C6*z#&|UCth{e3%p!A`mQ2i{UN2t{S}Bhq_wac`-y#qPB35I|P>H zmReN}W9pTAQ~MS57q@AL7LS!?UiW0ZiD0mx7$!Kali4M&8Q$2;!4A#YOkpD zaC1l$b?B9qM{%xX7!HU;YBLizTJwd3Bd9j6gg@hO+0rf=F_62V&O>jD{Wix6}*?Ay(oinxy@OILn*QF_U_UCw3me^)H$uHoyDg zwXgay13I#>m_~m)0z3x3u+#{A`3vWXrc#GQtsX8wYWPhpgCa!l?8hRNRhR6LwtS0xDW)CL=Vo6=cmGPxT{|{A#cku)GJmA zmz|4|M(pg8T#j@5kW_*%9^2F6t?j|lQZq7;x3XydYlM3aLdTTok=7;@0IYq0DGI!w zA-8O_IWne|&ytB(KE6*<8_b@h7px*^Pu~x7WCJKIDHSO{@2!F+J`FCr0 z%TF;TOH%oSmvD%`=d(Z>-{AMaHZOM9xG8XhzZqSCnA57cZGNk8=Ejx|aou2l4TustMy3D?!U1v4c&kEhz7j@UNth6} z1Qv*a@}TIQJgw$9;3LF((TYwZATz+iX=9*aKbnyd&eEOTpn1)7w;G;g^SAV>Ib60N zoCYEqa!5KrNt<`rZ7}YIQpL;%(XkfDD`{NI5K0&Hx*jHlUUJPR zjs`SiTBtqFKBAj>lqASGVi@4KklOO@>;^b##crgo4_;(oB#aNM<@hs31ApHmP=*-7 zI&hbBl{Te0mGoD5eUCie1?fYa;StiPs2ofSP3yRSa(NlzmFx`g?Xp21y!7t4jpbJ2 zoq^zKiOPN~)#_rucXn@9GnvI^u$g2&27crWmS|9q2vsg=9E1_wwNS7?Rm%U67c}{h zK^DPEWRPdjqHxbkn$Ki=Qowa|_^cKZ1H5d-4B!U7L6~}(mg5~WnF76!DQGVR?OV`g z3y%aCl5{ursuq{`-3LyJ+{fAX;dDh8)+@;LxkccWdP6g)uj*IKO7q>X__FDFjaxMa zBq9at#gm${`uH;Z*x7}nP`~_3)-!mH+e;<^;(qvo+h_WYfx}??$oOLu+^|V-g&?3Q z+*l;`=Esi}qORc5fu_d*qu9PLUB&HfrP65RKpgdShY0wLr^TcvzNffphqN9i zeKe~NOif{ahCR**K?Adgt2mN?`*Ar^)ppgA<7`6>Tk{<2UCIPQ7nZnz90;HDNjzH^ zZf38FHw5R*fV2t5u*c;evQQ5k>(;{feLka+TGn4fnL7(NII#k#YKXF6;L@tL!Q^-~ zL`lSV5s3y4hdYb`L>((DY^!VqczmTYupq@;&h|}W1qxe3!7k?`zSgU2s9@}z2*eZo zkO&(Mh*jAbS`06Df`$E7>>xw3B?LTIB6I&Z%&xC==n#mmhLB(}a#*h7K@+OtV8*j& zGnj7@i7L)t-9pk0L=&qigB`C??iL=jqlKo;;ZWS$CG3Nqw6tNFD5edu8g|lhCm3q6Q=VoS_3zFut8TS2!)s?(PudJda)1=_ zhn}8U%CEyQ(WFuNVS7d`QMHgfBPLZH3_mx4I_f6bsfC&?r<@UWy(ye2fT7a)j&=s? ziEYSrd0_Cvc(z1jwq>u6Kh8R7pb(QVm3jxK27w>|+LI$qL{?gS$sKFl#)I$ev^<$D zSU7iH-I_xR2>TyQ14#Y;{RjCc1oFVbFnq%t#*>TxLYC@Xqkjd%s)h&h;th^^@X&aN zuX}7yj$u-<{RP-ng#eoLvJ`Jnz8=w&``qv3Csq<9{4mxoI_js|cmpM8I2zAw&o%T~ zv+!tA1HEh=D@)2@sgolT2C@!xMa3aNXjRcGKZ|BlT3#jxoLhML;vEfL96QlW9uA?( zWJe_uupz{|OSOv|u|Dn#AK1yGq~eAl9TKPY1ZBpSKs~ki(WT2_{oSL@z!1V@M$2;o z4{ysGYA8P5+|qWQ4^Rxh_rwU+i9NwEViP4!7GjRn9K@DqOA>JZ8FRdx{-R_0n1sm8vhV+;5k@rn*#R#e>xXAHOQo*x|L-| zgy$70W$S2p!EthDdL_lVA>^H5ts{$zS2hjaf~M^jdWE(thc(;T6*pVl6vie64=9$S za4wtiFS)`JG15M5xZMMRi-Qhj7>=1*y5@CC2c|XnRpkAqb2>le^CiqANlX-NG};R) z=1sI1k~{FsfZG=R-ea8Hq4hI!N&b$4Hu40`{4aT?6?0Zq!lG4sfl|Ec=9`kKaN;0d z-{{3GR}b&TOgtDMM!|{;MwSN=n-WLInO@livnjc<*yox>Fq@LY0N-7Dh1unDD);qiQM(tLgTtw^l1f$SdPj-BK*hB$pJk^`>EP0mtI zaoy1KcaZA04znrw9ivc(`Kr`JbSH+<;STEo&)A~WxVD>tl0Ky!F+6Ymmce-Z%?4V> zUVv?0$IEd`lhr@76+ynTscHZHhY+vtas1F|)|&4Rp3h|m=Vm-2ubAO$9!%3a$*K36 zy#D`Pji^t!*V(pH{^v~>cAmJoyG7L)NS$gMteEGg3??Glj{Y~N;z$nMro!J!mfxNC zKVSqv+N0~F&ijVV|1df9p#OLIi&A7*C`|}oN;6lB%BX61mMbB444kVp;LJM$`BNNN z5J4uxro{7Jd~5w!()HD8XrPy55PFXR49+CVX8MNalQcL66>{Dd#8LfML=)iqbtX^@ zaG3Q9dZ$Pfz5aOLgJljWzUxEkGn@%RJ{1Orw?#n_N6xk|_bz ze-yZ{j6z|yqJe}U-1er<9aTcz!Hj?)Rp-K8@Ti+iCyMb;a^-rZm5S(_mSD1-qmDRT z!luAbHH)tH&!t zj;Lv73a3GOG4^O>0_bUPh?Q11z~caFCK-6R2?i669PG@_PqC@Q`pWyU&fo>SsY3v~ z!m|t_{F5ze3`7}D9OAMHsRNHA$7;j2RLt6HC`Ga2qb&c%be;~4& zT(1OaJk8<1LqIXF^`~}-R^r4fl}5V;54hUIx&AOov)y4+8f+#{ z)7tqg4Ynhp8C~6p4Mm1Q)Ju6D5mAPXR8kH86l+}2rK8U=2h^+xT*QG31Wh3Q^fHly zafvJ6;Y3F*oN8CV&yp7=#)8?|)oPc!K|zWDtTp!tj`x9;WKZEi0-&|M?~a=dSjbcY zfg@&E^r>|kj|M+^VvSh1J}IEkci#balkPYA9Rl?`#ueGX(K@Y@p}aM zkLdd(`u>k$1UQFR+)`jr(ZuP+7Hxq`DPz7|t4hjGHB|V0zTiC>)kl5rw}ML&^>eCP z1*@|

@pQ^)|;l$)Y+sD8i-Syx`Hx6gcq+a5VV!@jLEI2avE`rSP+*s~*lnS)bXG z$A(j!@dt^6Ue$zj^foQ7LFO#nrA4<5pX5--W2jbObqMTp2;feK^efUqa?r)yaoOKY zvgeU3*nf2Kadi=poSp~}cnTjwBUe`Nf%AGgx4UFT28Lc#q#oU@f)mhuV)&^J8P#`g zAO#>Vr6$5qvTHZ9x01n}$}UEK@htha!T!A*IXfF_Voz>S4a7@_XY6)V@<7*S(qei! z*U>_F`n)#5@TrDca96$5>*;3Ys4CVM^RX$5XB>m_EWKTu=@UZFY%H01x_m9CYI8+{ zUP4dNM-M$uh2_f%k)G*arDt3QLzj&V7|x;yM36GVjf*T?$*N2OK^PxEDHa^8rWDkM z_ylgLuF&EV6wt$7K+Cry`QJ6e6X>$h-^=_qetGu0sb=?hb76T7iSMWY4FFR(c}lhc zbO18tG-%k}mk5Ri?-cPjlijCYMCpHq$E&17GNa`TNYTY`AyO#Lo^zyy&{7=ufy1Hq zyBK#6i7-tAWJo)OE86WA~ArSOPtRhh_rASrw;OC*q`@u4Z!@aU4mD8#==$CL_Fc z2$TN`PZGl+A<1l^3m#)cdZHxUJFUYxMQ$%k#;sW=VpC$%s_@`)JOaXV`n<<*Y? z7+@vlrOqz}Vku+2@vuwm5O^5!s8HV)8D!0ko-BJ^$g6U^OmWzcrN9<cZE{( zOEoW=x4!f!7gDDX{{DyMFx6e{!ZWnSD^OivQnomD-y9b4AAp6<@b5oxh$xgAM(Uu{ zaS@%<=7Re=Y;7wIJcQ{Ri?iC3B{F4n>aRta)DGnv3(a+GOU`O|7RvyRk@}A7PfrO8 z^%LI;7^r;@R5KLZh)@q?q^}3k3z!cvYgG;=%TkPpRv-@@tPLLATZBBQT5mi+gEwoi zMvIf12M%f+R#ttPda5s7Mg3uF7kx^_JXlmGg$b&oKweE0KvhEh_RBBsn;$4F=)R~< zj`_=hj&Zp#gwQ~pLUFPf(fvs+7efZle{&qZDf5apvczD9$dveVSp?EmH-xq8IIICC{!#7 zv*P$fh)>C<&L*eTgaJyul2z>$0(4*(9>9do2YGd4IWBq2x*AtuI*(|SWaJ^qLGS(j zT<0&v6sN#=SIC1#$<)28H3XtpbfdHBjL0=CrBihaSPQLgEu|K! z(tIfpRbv5-JfN0I5y8%;(`wOHupkGd@b#{SR~33808_O{p)@m6B`i}Ec7)|TQ7 zd;oSmAAtRy4-kIO2ME*i0TA|D)AIq`@A&}X_k4(OJs-eL&j&!i=L3Y_xd9^X`2gwn ze1K3QHPdUh=L2%D=L7g9*8XPMUzE5c5=?tp{4#JUZA$L*2{Q2b1aQYE0AnO_*hPi8 zDCZd{#bgF-SpK)r4IY7K08~LV^zaNW+zbnW^PPu*7Jnktp5qZuG|U6U%L~eUA+^GU855Wd)}?m z3EC{k3BoSP3C1nT3CdrV6Qo_36O3D$6I8GYCs@4>CvdY8CkQJ|6O1QM6Pyv93Bn1_ z6eSB)0(NpKLCGAoYf^&Nk|u#$S(9LdA%q8aa7yRUGsB-nk34w&Fs$b-%?fjF z>EUj!WvCFrVhbubU2depaTgE&QOZmSoxJ}xUl!kGqipbV+EvWeJ{T5{O zjmec>8t87iYBw~ICE<9;a*~z|$o?19!wKG+&E?xgy`QD7S}cv#2tzxIzNpP*X1ZiR#{fYwwy4q=HomjI=;&jVLHJ&REj)EDFm4<6vPSA z$!zIJMz>g)nb)Mo>)cfqUC^CwR^)M`7jsycWGn!se7TY4MuS7sR*~f%l5A>0p{77u z&(Bb7#g5BvchQL5ip_tlAh2MRA8lxkkZvp1EQ2{OmlmMmT>Ze68cs<=u@yU~*md@q zCE1>#m}_q(R1JLSmg|R%@Xw^!DmzKXtxb2YS(2?7dircQWG!$F0yDRVt>iTxHB-=AYM3W7(QCS{J(?WN zRxFKyvYVly*ovLQWI>&%WkF)(8l5AoqtxkK|`i0j} zY{l+NJ$lO)O)?{PJ2u7uxrUb^*@~f=owtx^QoV-3dPR-8=)btr&|D3=e0~bMY2eEjOtKdHSug;vv>;gWGN|I#N~l^o%IC zVlT$p?xqp+R*WcnwIhjid!o*1f`5kD`gy4tl4vWY82A{f(+xHDsT|w<7DXzWPayV! zd_%yue5Q}4yBppkTDSG2#^95}2UtCPxF&yRRqY%~mSn3I$WX7z-ZR~H=I>}WRopTB){1w(D<$so+xa#z;yEF>#O0q_1#H4G+nmbS#7)EKTapHrLd}o_ue`(w&NSvvf3Du{5U~owe2kTQS=p zBp^Z@n>7Q5Y#d>}Z>5Rdv21sHIGU|k%8I#uuVzWMVu+Jj#>b)F)m=!BXe*}Vw!V;t zBF_#+SlDovkxfd?m(Go)G`T)#URxEKB=Y%2RxfJc>+KhYVk>s*S#4jc(3~EZ8Q6Sj znzF5@FNhTvSmP0SM!{iqH}~88$>y*_MyZff_n>tn0y#HbM>Rt0GgNavllBP?5x9Go zw3W+7|LS1yievq&ul)|JTu)qw^P28xOS(^6(j9I|C!WQ2)pPZhvU}wVB~&+ED4@FO z!eft4x}UbI#^>$Ge%y|1%f8sME4J*3Ejwb{e(0zv2dvrZcaZ45NVZ_EkH`dX9E4|D zAzDn<8(0kPXtE6rpdpvUrjnw)AsW<24QYL#;FdjJkMw1MA(OMPE~F6Ig>EgCS!sf6 zm@dOd+@0Xd7E3Hy#^Xm70nvE)3P#<2DDk);Ou>QIKmxXL0Tnre4&V(LNu%$+m?Qxz zN+!o-FyRy4R71LynM$og~`D114Tzq7hqWWbtu_yo5PJTirwJDr$( zHYO$dD^B{#m|hU&?Xam9a9H1j&u4&3A8|r@DY?e5^#!musoA{y*%TVd7?q|^bxSej z7^{6pI--(PuMFvd7YsaZ4CmG{N+cs4nJ&n@cttd{iyC(y@Me#MwOohJH_`2CiMX_0 zK@d`UTz&5&vOoS7FjtwFEUxAmk}nd;#F0pu5kFquBsE}p3>XiSa-U;!9K*kkPjIeG zTsKt*J_m=e6Hk^d9E4G2^jOzWJ0VTR(y(rx8n8c`Y(6UPkC}hQ)5j!?FaQXedY!Pn26}2@tMGd2BZtsU05V~K(e)w;f(qJcMd|>1+S1rP<;uWRx z`{Dy`al)TT`AdW#&q<>L5i>#iFQ^=bE{sb6l=NDEDvGuQKc|@vs?*{L_+MOD5k^p z1iU)^wPe_j?rgwh1Ic2AC&s%9F)Q9488{U2h&pMe$~YV0;q=6J!sH5G7xzr>nf7VQ zMVaKOfS1Y_E6UGn{`JMhkYf}9gvAPrB_RxtGvm<|X^1e8#R5_+Oy@Gj?I5mNUFfFd zD>+xNRKY7o`y*~edoN=s;wz=f!L&T=;w< zZ#^qEl#p)2lQxRc`ueJ;2$efnSU$SBonYibyuTe!E3Bw-tKq(Ajqq^ARBRz(YTUx=1{C~6*=NV&ACV*1b}N~Cb&jGV<#mf%?-`g3OS-TA4M-T0ew zf+o%Oi7HgC!4yU(%@NFnYc5yuNo{e7JsI*A6OUbukQ=jM$H_ACZE*fMY81K*W<)QK zJ8u_V>lb1wPOPF5<|BcRfxHt%G0JRbmwey%uBqWNSKdvD(<_p!*c;((1?C;4A(*Km z@XqeN$U|spf5FGC6MJ2J$NT7=Xy7!>VR8!sJ z+H$rf^rn$YMkj?D4CeW@P`hxrWNK6}ImPlt+W<8!{(j?9f@e)JLR^Abf!*L7RqcYeO9TM0xm$7uaM4gk zl0(vE6Pkwd9%h^;)H0Vc0tocA>FhFfZ#udH1h>j-aR#!xQ+2J5h4 z!S|Oe3!H031>;ed28GGBCLNKxDh8t|(!0HWL%2+nyGzThps7`bxJCHprG5>%UbPb2 z(rNlV^{B1J@9b7gp$Y(-aL{7`3Tx8|Ro1X=qx4Tj)bGtFgCYl~%wy2@qnxq=xS+|R{Gq?=2{mN4D! zh6h|zM6g>?>5Zpz@IRj7#xa8zU4~tAucdTK6Ao>cQ$X2YJw{R?%g~T%o-N&a5I49x zV&}pBb}>71bh6;&qFBbnQT&|^NxUdL8z@zHo()7noSzM}Cf3jfG82ty16j2xh9}!8 zS}pNX16Gp+Did3c)CBiu{pg0Nmd$~BF~dzXW#f=v{PWKK(j!H_WtA!=h+3;CM4`Ga zn&%N>2z#K58s-jqNf|mkNx*<|?WIpOzzT6YO9(0-{R z4e2lJF7CdO6>bG23be|ITT_WOx%}s3{EY!s2)4X43GEh$^oMPA#QZ|i_ zWUgP_5q>}84G&_Cft^2i=%7GI!(TE|e|3+?U~PXLoj?Z?#)6e6Ms68d5A?X?D9r(@ z7@ixbp9$mhXjDmf$a^n)D-C2ET1lo1v#20#(Wm9Kctbh`x2$HR zmsCF6<>=#gg_+if6^3?_-I5>)xrX-e;Yo)E15|MKoqy{45Y;dfX^VH8iAaP2y)P2xd#Fi0~FS?g?1#n4J(4N(Puj zj~r+L8;Ok?K(N!EVOyf#{qts%h9EM^aoIxG#NJJVin4`_Z6Ri`71J;h0BFCF3|FfW z-%@WcHQ8`de=WG^HN~~11@Pfb4p0rZIY1ZznB+Dc1Ag^~joL&8(A%FQvXi@S4uYWy z6#$~W!1_`T+nX8@DkR2pH;u)7|9phv9{=*65#;>(ID*{W-ksbGB4EFNc8HS`UD{bW zqY)TeZj1?2gT)G^8r$zt`M8?gRSZb?b6GCF%@# zI*z)%qcipDy-rKm!F~!mIt*cIE<`XcP$5WVp+uCKn{u5p`s)Tq{EgF1yu`MLarm-3B4|tf#c*w0L@J?-18q2?G!Kbv1!$VjbeC zLbO}c-qh@|q(kfUXQ&6{7`!j3E>g)f$^J$F_D3Go8o*?V?)zbr8uJzPjp0zxagM_SR?7n* zcB%jE+7`&ae2i;QU?9q8eoK&eRj#~x0Ya5)#mm~Jy&xX}wx9ToTfgW-Cvhgj1>~~V zpTjSR?T?_rXLB9|I98J(w>`h&eY3LRb8LO3n^@lR@|nq35mSpjN9YEB5tzUQ67q|@ zM9DQN7EnZV?^>3RHSGp6Ph1nCoA18K=_wq#O=@HmHxTF`*BfZC9vwndzLauCVCJy~ zI9BZ|gsNpc<2-qApHRZ)vRs9;ax&y}k;TlFbcz7K(?FC9q#w*f0bSJ-PFtOJ8iYYTv5WyH@$;B(iZ zSk+??B@njTN{n!?XU5U2oKX7@_-SKnVO09Nk?6&schFSvVaQWqd;U`>2nxkb8# zlxRwMQ_+yMZ|&gg9Tyd`5*Y9bhXSK|_Ao+x3j>36A3Twze&fp`@Gu}w10H;xtmRl2 zmBUhriW`E^>geSVCZ`dU5E-yMe3XHoeSbofKFGfe?pi$qlu3%QPz~pm8w98**E}JW zyE1M#2rcw%uN#;ep}$P)j4JGJpRfQr2%2gd%u3PSaL^BDCM33mvPFVjhN~oGjJHg{ z1!xj2v5<^Qp0V(iRg<@bE73r0ZPj8cO81!FqqY_DB)cK`~A`WoVcGe z8RG6+Q$IjcSkeULs!r`ezz-wzq~%30D%kidm1e?;Ho$snX~`7BK3MxE(D6MvBwy&0 z3!4Z-5PFH%fCRW=37SV3x^?)C<->mS&l ztx+egS1zA+SuX}pCDzR8h>MY&59vf$E~lf`*Fh%3;1k6D21tG4;AH~;H&bv0r0K;U zaHvi_oL%|#r(zHQV0N5+<=h@Su|SU;tnQ-|I&a!MAZHv2_Qt~!Dg*9#)Q$vA(=4e4 z*+eS3xYQFbb-qcd!`10<&^=LOyfwY zR-)uun9^3M_gWAo83Fa|9KO4rFo!zs4Q2Q(x{fViD-#2l$!h|I2wF|NYt-Ox3s@Lj zVKo#^kG2pRbW^?}=38$2$pMd7*-d_w>h=TUWQd0_hR+Y-+T-9Tyro9jJ(1H)90rDf z<-^~2;LhYC0KRx<08&Z!^*DLKEmiwXV_$wER4vCS<_51KT+R~TWB4Q>;A5IzzE9nV5& zN^8-W3)iCrHE`YcKoBd~a(h}DLid)-U#^dRgQ3ZG{K^-rZ4Tfz;$r|l4C_3$5v^xa z0fb`W1TEI4tFn1q%ly{NQB6h{(i2iW2ttk=#yT1E1qcMTtm@Za_m5uqH!YKA42& zrKp+qe;N?5S2B5{vgW%vH1q$R~KSLG(FEFc~po<#*(4es>VlaCE2xvHmztet# zA6CopXIyH*hzdc)aEQ&gq~;MOo`Z1~WBG(NhQ?8`Jkzv3sB1NG6r{vy8NK5m=+Iko zuE+4AwFKok5ft>|-XLc5*j_vHHJ-M?GeR!w7%^{QfLTB(uGl_}F zve)p3fm@n{JMALEDXF{$3m)i2^=g@ZK7(g(Jldlwsn0si!y2v~kz%9rU1b^EIj(oE{&yDNcWnF54(h7d zcMN`Wc>C+h&ZXYf%0hp0)%tDWpsoNo^uUcM_kBE?7B0`@Cq!U14Sx*Rc8Jen{_qtq z^3;>*+v3Sf*xImr1y!#a4-MWBr4GAsd62BQq19AkIEm@ zwg^(3EgDuQMdMfXq*!6wC$!T??9;tkpF9jm~2?h|Lo6|`8_j3;l{+2fepCct<7a9z!7zff-tTEgRli*k66*rhrx5g4aQwV#++aJ!Lg?yty22Z^Z(cTMlQ)#MWB8n*rCOhO`i8x}tJ>M}sj3$q z;G(RXiQhCAa0A8g^xNYC_7pz}mc!+fE8zt;>uy9{tp3EE)1|B8#cKX1-UxiSsG(rm zieIdn+3NYp0k9XgNc^6x+_=Ce0%bnj*YHK1yt#}4U(IVbGQSpFsU4RRj#jVkvue=x zbC(=fRjkACzda z&G7RRHdEeL{iiqCe|}nxaDUP3r>nxX?-jb$HSblqz*fg{!hyh}8^iQIDw>C54=sQ% z9-#He-{5lLv3{e7u%y?;Q}HLpfCqTSD0j8E#`t=}|8BxwLyz;j6yFs}i_MJO9Z2=9!53#A_wgRxq)LnOM6p1Vr==1a8pbku5n=P z%Ov=Nzz7-2DcD6G21WI7wQ^Me%ys|Gvn$384xC)y-n>=V$IK@WcPkj?SLMT3h~9}U z)9u6;-nY{S7{9y`c{?3Fd|hFY3YG>!FPB)joMa>D1|A|$oX(H_@F7N2(2y7)E-tPh zAnVtYVB|3=yihur4pz-`RDy4Blc$wy@Y|;H5>v}{$32T@`Sc+e zAql-!>K8bXfVA;es6GUcFTe2p;x}x+8jbuuh6!O#rybe=Ok?z6495g^-%&^Ov4o>1 zAhG>K^;?ats7u6w97x*!+q7O*4;ba%n%l=ZUAQ{JVp-6JZ;FC%XdB+pmT~VofS&`u zJ_P(ydF%Y3c=oaz6f+!cIPS1dyLt||(m4%bP)=79*RRONUkC8%B*CD1Ed7odV2Q+} zb&B4gYG4BJvZ|M^slIVS`D^?y9_wGQJUy@ea(VsAN1R;ZU(w%~&+wylB>x3_y(g#s z%VB;)6&{Pfu^RMo9SDJ9OjF3ij1M@^g&EnvcnMu^Tnz}C7S`#dzk3pIJYE~K>7Xbg zSmYzzSxhpb%~d=L90Pb2ez~p@q+=kTt}pm`9VESWvf~`cXq_cJU2#1%lb}#pBE)GM zJVfxekMcRGOPI^#m`V&#@9b`sdv(6C?e?Sz3g&!X6oE00ep()-fxs*+hFI_0Qj5La zAn-QN8*SL;d(P7&^U>mV=#%{t^DlPq^YXyLV0C^DGNKm?EIz~IB~E<|9|HSuu8HB} z;e0tgIs{7G%?vp*;z3}*SHmnz?lJDC)vQ|H$Pu?iJTNo+rTlmeW9`iAeZs0>Y4Q8) z_~Q8TCV*Vt{BnF1KyGf&;A>`>AQiku?I&!WwBWklq#YGf2+`Rge{bisk$z0EpqM~= zvmMRjZm(NIxb{U2-G@UGSCk*^yMDPKc`77)@r+m70t{!KPSc+ryU4;PRv@TnuF~f1IIHPqq z!A$X%IW$T-FC;iQb3fRZv)w%M=rE5|4rz<}btKwcnq1c0cwQnCk-}$BbOCZP@2G29RhJeb%q;9*iViq!brh`O1K~Lr=vB68cyhU zO+)@oeIma*X)y1wStc)ascIdew&Uxd3AQ#-uHZd^O~EF^9@}3$MF(}*6?vK)<@=Xp6mo*C?z)&@chp6vGLw8iZ$q@V z?~!RCi)%nQ*~sJ|#|=5@?5d|pW=@b76Gqsaj@$wz`J}$D};p`OA8_K_0 zybO^h&|1s~*qT@0drEgoxKdH&*+~z_WMGzZu>>gcMGd2HHw!s~S%bf*)y;-(4jVFn z16}>}EB?xT%|{D|S_F+TIsF!B{rA{xp|>RGXVGX=d?n!U5~3!rdh- zZrlUI!wn{`li7mn!tbgB7`MURm{!#0Ht&6Mf}eU8q~ zJWr7DARjwNiy9;3H6!h12X26D<6%wgV(}0D13wJ7)eUD0Gfdl?;^ucunm;@s1L-JO z_mDRC)+K2`X2xXzxmsZKn)Z(>FuZ(>~=Hd2tuMWM}28sUs<;$ zlTgg^Fsoi?P2qfIH`vW2#it-fz$}wtmd3oR2wPb9qElFuF-X`Oc_n9}=^qeZA(mz2-ep-^tTSGk-k2ZSej`mP z%(LZ6Buro;T$$SJ4Pu#m|-$|)jQLUDfISWkE~R=&oSWkrGF={;GRGx+K)a7*4a zMnDAp55{3ec%VtBZm4?x1NTOjJuBaBMYFWZDiiEvl$h?rFKYP20{;H{A4sagA;GYQ z3pnGNg^3`cY7Lu^x_S*`9d~pzDnxrbbL5DE&+B;ehAknl`f}rjr1apXsfk(J`s^w= zt-9IWAy~kG`}}`PyV~A1ZWx@OvX5(#xwVr9!M<(7fDGHZp(wBcMqtEAoEmd&!>Jnt z!~Xjok`hIU)Y3CWZDP7)g zf(NPj=qV{%3^6vaSbk#iEV)^oqMlrpN1`GDm3!UZ-8=yuTc2iG@8lj9TT0u*APnWY z;RVd}p1z6eg7lF!L3ji$pAv>gc5G~Yhu9YQ48A5_I5`k6JQ@-G^x|5h4@4-Ly;Euh zmRxa%@@Wjh7&^7xNI-GwC?d48$ij5$`f_b`C~2j78qAm_!L5gsf-<+m_-Tj6Jnoan6Q(b%kjr^8OT!yq zI}RjeTdu9h8D#^bAn+5u`o!5NW(Z6{R34YC;dZ%ro~0&C1_Gwid`4ladNYGRX^Nnx zDUp6@hWMxfhqIb0`N&wxHuVAN&1SbdIN`tm$pnP&pVlk^UZFn+|_ctnp(3NMVp0ngO~dm9c?XaIP#*h z8Xa44w;_|se{Syi2jL+Zw)nctRb~nhLD-nAJVKCZp@+vHDi_yyAa}Z4Frj zXv>ZFBy^ytq2}36AGAjd6$mGD~kjrD7AzS{r9#owJhC^|fdPygPUq%bjhJqRZ zE#zrY$&kt6bum{1XN62HFcva-G$>@Naix&O0aPKEM^i&K5A=p?&fE}kF<@uR4Ixtl zKZiWL15QI-$UtsZNHf>{o?JNlcXSM&Aoh+{0ai4^I*#A;*XKxwE3?be7dMS4n*Y&p zNpxUWoOveEiHcp{u{wEs|A_zx?+JyYC(^EoSz9-AE8HyB3&t~t`?s0!Jj7GWe^kHm zp-K$+^eXa9^f-wA3|9?X&QMUVY6~_QV5nE6IES%n%cIK^7|ci|WFPXh21bYl-d&M1 zN0v~yIW@Q*jSU~wNK>{ABJSB0Q~WSzlNsPnvN@>;X9o#a%euySug1keLM!UBS7ZG8 zFr^hX?mlCoxH{d387t*#`MOqsC5;@F%OIQia?^T)6W|td0MAPWXvoK#=2PHQgj}8Am<;%JKWs)) z>n<0p_fql=eDO!@7(UuEPx3?=~o0@}wX>mnCG9z+Nmn)S;njp!l7P^saX4DFj zdWt;xJ4b#mDdj89W;nZuqjVFw!b* Yw|=PZDLL=S2v8zF6Z9|tKcuUF0Z@j8lK=n! From 1cbc0ae2226a0d5dbfe5d889cdbfb9a050242088 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Tue, 14 Jul 2026 11:03:09 +0000 Subject: [PATCH 26/28] fix(doccheck): check the citations that do not live under docs/ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pattern was anchored on `docs/`, so a package that keeps its contract next to its code — internal/git/manifestedit/DECISION.md — was cited by a Go comment the checker structurally could not see. This branch introduced such a citation while claiming to verify "every documentation reference". Widening it to any repo-relative *.md path immediately found two real ones: argocd_bi_directional_e2e_test.go cited the support-boundary doc twice WITHOUT its `docs/` prefix, and the old regex was blind to exactly that. Both fixed here. A citation must contain a slash (a bare `README.md` in prose names no particular file) and must start at the beginning of its path. The second rule is what isPathTail enforces: when the regex can only latch onto the middle of a longer token, what it captured is a fragment — an example `../`-relative link, or a shell `$var/`-assembled path — and reporting it would be a false positive the shell case could not even fix. The golangci exclusion note is corrected while here: it justified the gosec exemption with os.Stat calls the tool has not made since 1574ed4 replaced filesystem probing with a git ls-files set. The exemption is for reading tracked files by a computed path (G304). Co-Authored-By: Claude Opus 4.8 (1M context) --- .golangci.yml | 7 +-- hack/doccheck/main.go | 55 +++++++++++++++++----- hack/doccheck/main_test.go | 39 +++++++++++++++ test/e2e/argocd_bi_directional_e2e_test.go | 4 +- 4 files changed, 89 insertions(+), 16 deletions(-) diff --git a/.golangci.yml b/.golangci.yml index 20b94273..190cd549 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -370,9 +370,10 @@ linters: # traffic generation, and operator-supplied target URLs. - path: 'test/loadtest/.*\.go' linters: [depguard, forbidigo, gochecknoglobals, gosec, mnd] - # The doc-link checker is a standalone dev CLI: printing its report to the - # console is its entire purpose, and it necessarily stats paths it read out of - # a markdown link (it only ever stats them — it never opens or writes them). + # The doc-link checker is a standalone dev CLI: printing its report to the console + # is its entire purpose (forbidigo), and it reads every git-tracked file by a path + # it computed rather than a constant (gosec G304). It only ever reads them — it + # opens nothing it was handed by a reference, and writes nothing at all. - path: 'hack/doccheck/.*\.go' linters: [forbidigo, gosec] # Allow fmt.Println in metrics exporter (initialization logs) diff --git a/hack/doccheck/main.go b/hack/doccheck/main.go index 326036a1..f4123549 100644 --- a/hack/doccheck/main.go +++ b/hack/doccheck/main.go @@ -8,17 +8,21 @@ // 1. Relative links in Markdown — `[text](../spec/foo.md)`, including links that // point at source files. External URLs and pure `#anchor` links are skipped. // -// 2. Repo-relative documentation paths cited inside **Go comments** — the +// 2. Repo-relative Markdown paths cited inside **Go comments** — the // `docs/spec/manifest-system.md`-style references the packages use to point at -// their contract. These are the ones that rot silently: a doc gets moved, the -// comment keeps pointing at the old path, and nothing notices. Seventeen of -// them were dangling before this check existed. +// their contract, and the ones that live next to the code they describe, like +// `internal/git/manifestedit/DECISION.md`. These are the ones that rot silently: +// a doc gets moved, the comment keeps pointing at the old path, and nothing +// notices. Seventeen of them were dangling before this check existed. // // 3. The same repo-relative paths cited in **YAML and shell** — Taskfiles, CI // workflows, chart values, hack scripts. This surface was added after a docs // reorg left eight of them dangling: the Markdown and Go citations had all been // repointed, and nothing was looking at the Taskfiles. // +// A citation must contain a slash. A bare `README.md` in prose names no particular +// file — relative to which directory? — so it is not treated as a reference. +// // The Go side parses the AST and reads only comments, never string literals. That // distinction matters: the gittargetignore tests build in-memory filesystems whose // entries are named like documentation paths. Those are fixtures, not citations. A @@ -65,15 +69,20 @@ import ( // are deliberately not matched: the former are rare here, the latter are URLs. var markdownLink = regexp.MustCompile(`\[[^\]\[]*\]\(([^)\s]+)\)`) -// docPath matches a repo-relative documentation path as written in a Go comment. -// Anchored on the `docs/` prefix so we do not try to validate arbitrary prose. -var docPath = regexp.MustCompile(`\bdocs/[A-Za-z0-9._/-]+\.md\b`) +// docPath matches a repo-relative Markdown path as written in a comment — `docs/` +// is the common case, but a package that keeps its contract next to its code cites +// something like `internal/git/manifestedit/DECISION.md`, and those rot just the same. +// +// At least one slash is required: a bare `README.md` in prose names no particular +// file (relative to which directory?), and treating it as a citation would report +// half the repository's prose as broken. +var docPath = regexp.MustCompile(`\b[A-Za-z0-9._-]+(?:/[A-Za-z0-9._-]+)+\.md\b`) type finding struct { file string // repo-relative line int target string - kind string // "markdown" | "go-comment" + kind string // "markdown" | "go-comment" | "yaml" | "shell" } // exitUsage is the exit code for doccheck failing to run at all, as distinct from @@ -227,9 +236,9 @@ func checkGoComments(root, path string, known map[string]bool) []finding { // i.e. the match is the tail of that URL rather than a repo-relative path. var urlPrefix = regexp.MustCompile(`https?://\S*$`) -// citationsIn returns the docs/**.md paths cited in text, skipping any that are the -// tail of a URL. `https://github.com/…/docs/spec/foo.md` names a rendered page on a -// website; only a bare repo-relative path is ours to resolve. Both the Go and the +// citationsIn returns the repo-relative *.md paths cited in text, skipping any that +// are the tail of a URL. `https://github.com/…/docs/spec/foo.md` names a rendered page +// on a website; only a bare repo-relative path is ours to resolve. Both the Go and the // YAML/shell surfaces need this, so it lives here rather than in either of them. func citationsIn(text string) []string { var out []string @@ -237,11 +246,35 @@ func citationsIn(text string) []string { if urlPrefix.MatchString(text[:loc[0]]) { continue } + if loc[0] > 0 && isPathTail(text[loc[0]-1]) { + continue + } out = append(out, text[loc[0]:loc[1]]) } return out } +// isPathTail reports whether the character immediately before a match makes that match +// the tail of a longer token rather than a citation in its own right. A repo-relative +// citation starts at the beginning of its path; when the regex can only latch onto the +// middle of one, what it found is not a path from the repository root. +// +// Two shapes hit this. An example relative link written out in a comment begins with +// a dot-dot segment, and a path assembled in shell begins with a variable — in both, +// the regex can only start matching after the leading separator, so what it captures +// is a fragment. Reporting either would be a false positive, and the shell one would +// be unfixable: there is no repo-relative path there to correct. +// +// (The fragments are deliberately not spelled out here. This checker reads its own +// comments, and a bare fragment in prose is exactly what it is built to report.) +func isPathTail(b byte) bool { + switch b { + case '/', '.', '-', '$': + return true + } + return false +} + // checkTextCitations resolves docs/**.md citations in a file with no parser worth // carrying — YAML and shell, where these paths live in comments. kind names the // surface so the report says which one broke. diff --git a/hack/doccheck/main_test.go b/hack/doccheck/main_test.go index 6f554641..3a537532 100644 --- a/hack/doccheck/main_test.go +++ b/hack/doccheck/main_test.go @@ -162,6 +162,45 @@ package thing } } +// A package may keep its contract next to its code rather than under docs/. Anchoring +// the pattern on `docs/` made those citations invisible, which is how two Go comments +// citing a support-boundary doc without its `docs/` prefix went unnoticed. +func TestCheckGoComments_ChecksCitationsOutsideDocs(t *testing.T) { + root := t.TempDir() + write(t, root, "internal/thing/DECISION.md", "# decided\n") + + src := write(t, root, "internal/thing/thing.go", `// Package thing records why in internal/thing/DECISION.md, +// and used to record it in internal/thing/OLD-DECISION.md. +package thing +`) + + got := targets(checkGoComments(root, src, known("internal/thing/DECISION.md", "internal/thing/thing.go"))) + if len(got) != 1 || got[0] != "internal/thing/OLD-DECISION.md" { + t.Errorf("a non-docs/ citation must be checked like any other; got %v", got) + } +} + +// The regex can only latch onto the middle of a path it cannot see the start of. What +// it captures then is a fragment, not a repo-relative path — and for the shell case +// there is no path to fix, so reporting it would be an unfixable false positive. +func TestCitationsIn_SkipsFragmentsOfLongerTokens(t *testing.T) { + for _, text := range []string{ + "an example relative link: [text](../spec/foo.md)", + `out="$corpus/support.md"`, + "a bare README.md names no particular file", + "a rendered page: https://github.com/o/r/blob/main/docs/spec/foo.md", + } { + if got := citationsIn(text); len(got) != 0 { + t.Errorf("citationsIn(%q): want no citations, got %v", text, got) + } + } + + // ...while the real thing, at the start of its path, is still a citation. + if got := citationsIn("the contract is docs/spec/foo.md today"); len(got) != 1 || got[0] != "docs/spec/foo.md" { + t.Errorf("a bare repo-relative citation must still be found; got %v", got) + } +} + func TestCheckGoComments_UnparseableFileIsNotAFinding(t *testing.T) { root := t.TempDir() src := write(t, root, "broken.go", "this is not go source at all, and cites docs/spec/missing.md\n") diff --git a/test/e2e/argocd_bi_directional_e2e_test.go b/test/e2e/argocd_bi_directional_e2e_test.go index 5b7ec706..fb8ce2d7 100644 --- a/test/e2e/argocd_bi_directional_e2e_test.go +++ b/test/e2e/argocd_bi_directional_e2e_test.go @@ -249,7 +249,7 @@ var _ = Describe("Bi Directional (Argo CD)", Label("bi-directional", "argocd"), // // Two clocks: self-heal reverts live drift essentially immediately — // sub-second on the FIRST drift, because the backoff is zero on attempt 0 - // (design/support-boundary/argocd-bi-directional.md) — while a new Git revision is + // (docs/design/support-boundary/argocd-bi-directional.md) — while a new Git revision is // only noticed on the 180s timed refresh. So Argo replays its stale cached // revision long before it ever looks at what the reverser committed. The // user's change is lost. @@ -401,7 +401,7 @@ var _ = Describe("Bi Directional (Argo CD)", Label("bi-directional", "argocd"), // Phase 4 — the recommended shared-field loop: selfHeal:false + webhook. // // This is the ONE Argo CD configuration docs/bi-directional.md recommends - // for a genuinely shared field (design/support-boundary/argocd-bi-directional.md). + // for a genuinely shared field (docs/design/support-boundary/argocd-bi-directional.md). // It is the deterministic counterpart to phase 2: phase 2 proved selfHeal // LOSES the API edit; this proves selfHeal:false KEEPS it, and — unlike the // ignoreDifferences of phase 3 — the field stays fully GitOps-driven, so a From 89662b0acdf7d1ea9ff1442e49dae2a48bdfc2f0 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Tue, 14 Jul 2026 11:03:17 +0000 Subject: [PATCH 27/28] docs(upgrading): record the overlay fan-out refusal-code rename MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `overlay-fan-out-needs-f2` -> `overlay-fan-out-unsupported` changed both the Go constant and the machine-readable RefusalReason.Code that pkg/ documents as a contract. A Go consumer gets a compile error; a consumer matching the JSON string gets nothing at all — it silently stops matching and the refusal falls through to their default branch. That is the case the entry calls out. Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/UPGRADING.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/docs/UPGRADING.md b/docs/UPGRADING.md index bc980aa5..195ddacd 100644 --- a/docs/UPGRADING.md +++ b/docs/UPGRADING.md @@ -7,6 +7,29 @@ guidance that the changelog's breaking-change entries link to. We are pre-1.0, so breaking changes bump the **minor** version (release-please is configured with `bump-minor-pre-major`) rather than the major. Read the relevant entry before upgrading across it. +## Unreleased — `pkg/manifestanalyzer`: the overlay fan-out refusal code was renamed (next minor; breaking for consumers) + +One refusal reason changed its name, in both the Go constant and the machine-readable +value it carries: + +| | Before | After | +|---|---|---| +| Go constant | `ReasonOverlayFanOutNeedsF2` | `ReasonOverlayFanOutUnsupported` | +| `RefusalReason.Code` (JSON) | `overlay-fan-out-needs-f2` | `overlay-fan-out-unsupported` | + +The meaning is unchanged: a kustomize overlay whose base is shared by more than one +render root is refused, and the refusal is a *forward-looking* one — it flips to accepted +when render-root scoping ships, unlike `refused-structural`, which is the permanent +boundary. The old name encoded an internal roadmap label (`F2`) that meant nothing outside +our planning docs; the new one says what it means. + +**Migration** + +- **Go consumers** get a compile error naming the constant. Rename and rebuild. +- **Consumers matching the JSON `code` string get no error.** This is the one to look for: + a `switch` or `if` on `"overlay-fan-out-needs-f2"` simply stops matching, and the refusal + falls through to whatever your default branch does. Grep for the old string. + ## Unreleased — the wildcard cluster read moved to its own, droppable ClusterRole (next minor; behavior change) The shipped RBAC now says what the binary actually does. Nothing is taken away from a default From 5eca2630fe08f3ca40ae89dc4a43ba88acb1627f Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Tue, 14 Jul 2026 11:03:17 +0000 Subject: [PATCH 28/28] fix(baseline): escape pipes in the generated Markdown table cells MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A refusal detail is free prose the analyzer wrote. The day one of them quotes a shell pipeline or a YAML block scalar, an unescaped `|` splits that row into extra columns and support-today.md — a CI-enforced baseline whose entire job is to be reviewable — renders wrong with no failure anywhere. No fixture produces a pipe today, so the regenerated baseline is byte-identical. Co-Authored-By: Claude Opus 4.8 (1M context) --- hack/gitops-layouts-baseline.sh | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/hack/gitops-layouts-baseline.sh b/hack/gitops-layouts-baseline.sh index 82fd0cde..dfa8fc0c 100755 --- a/hack/gitops-layouts-baseline.sh +++ b/hack/gitops-layouts-baseline.sh @@ -18,6 +18,12 @@ cd "$repo_root" corpus="test/fixtures/gitops-layouts" out="$corpus/support-today.md" + +# Every value below is interpolated into a Markdown table cell, and a refusal detail is +# free prose the analyzer wrote — the day one of them quotes a shell pipeline or a YAML +# block scalar, an unescaped `|` splits that row into extra columns and the baseline +# silently renders wrong. Prepended to each jq program that fills a cell. +MD_CELL='def md: tostring | gsub("\\|"; "\\|");' analyzer="$(mktemp -d)/manifest-analyzer" trap 'rm -rf "$(dirname "$analyzer")"' EXIT @@ -33,12 +39,12 @@ emit_summary_row() { local accepted refused layouts constructs outcome signal accepted=$(jq -r '.summary.accepted // 0' <<<"$json") refused=$(jq -r '.summary.refused // 0' <<<"$json") - layouts=$(jq -r '(.summary.candidatesByLayout // {}) | to_entries - | map("\(.key)=\(.value)") | join(", ") | if . == "" then "-" else . end' <<<"$json") - constructs=$(jq -r '(.summary.unsupportedConstructs // []) | join(", ") + layouts=$(jq -r "$MD_CELL"'(.summary.candidatesByLayout // {}) | to_entries + | map("\(.key)=\(.value)") | join(", ") | md | if . == "" then "-" else . end' <<<"$json") + constructs=$(jq -r "$MD_CELL"'(.summary.unsupportedConstructs // []) | join(", ") | md | if . == "" then "-" else . end' <<<"$json") - signal=$(jq -r '[.candidates[]? | select(.acceptedByOperator == false) - | .refusalReasons[]? | "\(.code): \(.detail)"] + signal=$(jq -r "$MD_CELL"'[.candidates[]? | select(.acceptedByOperator == false) + | .refusalReasons[]? | "\(.code): \(.detail)" | md] | if length == 0 then "None" elif length > 4 then (.[0:4] | join("
")) + "
+\(length - 4) more" else join("
") end' <<<"$json") @@ -64,7 +70,7 @@ emit_detail() { local accepted refused constructs fleet accepted=$(jq -r '.summary.accepted // 0' <<<"$json") refused=$(jq -r '.summary.refused // 0' <<<"$json") - constructs=$(jq -r '(.summary.unsupportedConstructs // []) | join(", ") + constructs=$(jq -r "$MD_CELL"'(.summary.unsupportedConstructs // []) | join(", ") | md | if . == "" then "none" else . end' <<<"$json") fleet=$(jq -r '.summary.fleetRoot // false' <<<"$json") @@ -79,10 +85,10 @@ emit_detail() { printf '| Candidate | Layout | Accepted today | Namespace | rendered/editable/non-KRM | Refusal reasons |\n' printf '|---|---|---|---|---|---|\n' - jq -r '.candidates[] - | "| `\(.path)` | `\(.layout)` | \(.acceptedByOperator) | `\(.inferredNamespace // "-")` | " + jq -r "$MD_CELL"'.candidates[] + | "| `\(.path | md)` | `\(.layout | md)` | \(.acceptedByOperator) | `\(.inferredNamespace // "-" | md)` | " + "\(.resources.rendered // 0)/\(.resources.editable // 0)/\(.resources.nonKrm // 0) | " - + ((.refusalReasons // []) | map("\(.code): \(.detail)") | join("
") + + ((.refusalReasons // []) | map("\(.code): \(.detail)" | md) | join("
") | if . == "" then "none" else . end) + " |"' <<<"$json" }

q8JPf*?uLo(s_P%!ne_IT@l=e~=|M%mW&M70egw1W} z>T$9w{{3JisIFXlrFaXmErB(#99-S-iF4O83*9D;?yvaogEOGIyyBVCjjUik0cD^R zxVqJ|>Bh@2&qG(||55y_Lkm#d8CG|aXi;WRzayWWJao6ZdT%z$!xjlA-Y@ZA3EzO~ z)=8-uZ=-10@}qoqbhG!P7`hA4)$%j```{2rn6ka6`3uA0m5h^c3Fvkgy&c4wL}$Ab z-{ts}gN~5H>U`nrcon{8&HvP%W0}v`LH?a=*x4A^Jw=a==zVf`uZH> zVV22rjBc#U*oh@(-H&4E78;t~UT?0TudU)9A*gPq)z!b7`5?=(|J}^+DPLFLYsy0R z4s^A|X!8UN0?q4>{=%@#XJ%sm0Nhy1qZzHhJP{q;uU6sn0~`m9ucW`ZQ-4qUj@8T? zpene>fT=b3Q~>L$_Mg|3!so@ee1H-X4W|KG+cQ-T$+MM1Yw%33jO@-qL@?Q@Xt z^wu!%16|(?8`n5&)8He>1ozrRK^vF;c4hp|usMdVj(f-P&&`Sb4WPRGB&QUwKeiWP z0*nTC`z*7%+TW9Rg-wCssdlML@oGEm(+t?u{O zw!n6f|yp!sZL+xNisJZKrlXWc%Le}zpS zbhO{R!m_FGKIrX{^d{^YlbEA5xUNKd&3iePw}P&q>&NXEDc%}vKf)>a9ri<6;;Cd~s%h&+iS&81 zsTDSVps(|d+#84wih}Bw@>AyBhwUMd(u}&bd@la)bFU$sm&@N|lM;O(Y)&}q-TYctvZSBvrazu;eQ-Xf$Co2cL6W=M&^7Vr2zHxdjH;M#^`-o{us&2 zP9Cnpzc`cx)va!ID`1O)l>4PV&ob7l2s+-# z`uDQ=J)4Jz!)6h>TGrsd1O5U%F7S$qljcZ)`*0O?U;|=eR1OC2`8%1C;w!Np$mYzNGzX7XFK138-!@tGgQ8Mv$^q>ht9D zE5>cP?hBNCXn&P9S+uX=w11lAeW5>S`#WuW`TIY^v$c;l;XV}Yb-x+O@&rr; z&6^!>Qh#^mJM2<6iyy}Wy$OSjBrQS2U@;f%V zeyS<89%oFmuo>*=UO~GX;Vw|!lU7%rhkq9PaCjah-bliq*S5F)M|HE%okxB&4+;Ed zLnf$h#O^mMuzdqk)=GVz{-e6l$HL}obhT{6e=ii;lI}nDeo44DwjnS9q>QGP>y`^` ztjnmQEyCs}C(f_%*$J2ZoYre;<9q|#WLOGwVF4^-Oe!Dp_noM%HP+OZJ{~rEop}GC z%`rFu+MoDSE%NtWLYFa67XjJFGtnBE)0jBz%`1K$yRaJ9v%Dfy0?p$R8((K^y+O(_ zYKiSr8>twDc#?({RMflh#O9pX1m<%_y675wtcKU*VP@} z0{CY@2~b@gxk~BYj;#tvsVO!2J%*nAZ2>caVmtOI+m`i>J;{Ayr+pWe4}^Dt z#i{j+`R&6;v4ys??}L4Lk$9r#5_YN$AIUw6d6XdvsT=FoLe$xG5ygTO&PF|nTek*JT&Fedx*FNfg z12?bmV*xXqc-_AK&FeD0LVMGB{cQ7+@pU=%QgnQYOY+g8>sbQtT*q6CxSQZM$D3ak z1mofZ>Q=)J*bMIetGb z)WzT>7znby%J)s}Aipj_e>tC-?B9{D^WB~XvL7SI;l`5cQU*(YGC;R&ajk}qwZge9Q!Y43M> z(S2-JAO?M49r5znQ@QTFmA|F$^s{^MegX3sULB7M@UJ3fEvUB!{X_BAr6&GAsdHHR z@4t>mye~NO{q&>8e1`KBX#chLy@C7o`(x&QrtUG%=n(V$billUNB1AE&}J?y0nP78 zo8NcT9e{t}2*~o)`~sdo-?IOZXE_O`U%%GA|@=5PnN{m?U0zOnw?r**s!(!L+WK!&AkCs}k-yo=u8nHcd=7BT%; z{-%$0A1&ibiuQ%Hi#^AB^h$bseL~C*H~`uoPfJ7m#eU}Z4xk!T0ypo`ne%?0^LxDc z{aDkO_MKrCsCT;mn)lQ}uD8LP@H%Y8wHI=DT*t9q{mfZp5YH8ivQj2j9O7IQ%7Sj+ zcla-7RH3dG=(;M^apI#+d;?y;3tEH5ueb4)`t$uF)a!VX>Ll@fh}ZS;5ndk%anSjy z<}U*8ICa^6;g}b4gXSU2U~7MY64$q#ekpW> z{Ts{z?U&9ez42cBm1|D080LW7A8wl4&pm3VIz}TS0_M8W>3+HNH;zG|A*eUI&3hPi zuftrJ4zWBO>x1MRx6>}HtEuzlR|4i1yjnh`{Wka-bR5+1y&3zdI|RD?BqmCH3n%^< zuV+8Xm<5e*Yvbkma|!CT4<$Y_DqtQUJ}m#Cl;!moUMwp|JJGV+J@9ep%utyoRZdg&`x!E zL|@~2zTXrM*6z?tSrom#E3vwKz`?>0Q{hZZn#&Z7Y^yf#kUk@8W`;)^+ zDH%Jc+XH9yC-Hloynf>Kq!en3E7Xk=_sA?!O#3#r3G- z)L#QS7G-RIi#LI%UHP=90&QwQUC{k`6YG)dEB8^~0kjXra}rN@9LGcCqx0L9HZQoCG+>oNPkJu?=Oi=V87sauP3fL z)N#DAl!@nWsA~t0z=Pl}gR-{IbiIh<9p-p@(EeF?0W{ws);o^6sW2aAgX^tsy=RW^ zCvv|JukLR?p#2(H59%FZz1yhU4N~?qb-jKsIOkt@mpJ(zqP=+k0`-n{yrDnO?d=t} z+v`aI^SR@_fViS?HR!mUV7*nTs|~H-4rmH)&J8p5v4q9(=iosj9T#nh=>~m3{qI=+ zcUaceMTi6ZiUuOL||Kgc7kW!TCRp9!y&->ZFk#?~+ z*-tw8Kky;@6ynN*_WNdO$a>qC*KVd>%4!BrR&E`C3A{D&>NvTTxF&FqB(ew1!y>;jr@k0SzV0@4L#Dn?;C&(s zZ)wM?&wYvaChBWguiFpbX7ZXT0rQg65A}#?4y{1@*Z5uPJw#m(cn11{f{$umZFXVmNc;Pj6=@(W#g&Zf- zK2{@hAy-g7rEWX?1gY=*!6U!HT!rcLj4dg#89WDMee(Zn{$WhPjiB3WE+I(Cs7YM| z(0-K41o6K+@y&R>HQWm_Te2@{=g(h8FDEuKGhl+RiNP;1UV8~%27TYoHcmblG1iHd zh#2t&ocKw+J{^{W_G>pkK5&G(lMp!N=dQnt_y_$EpA|4i8`>n8TuGa2p&V!)18p9a zsJj`?nt$T2b@Hgm>rJ5*XdbWGJTA)1Z`4!Y9n>M~dY=nvFgsu(j;A+mUV!&Nw;ys! zO$n4ZO^#3tq*P_+T=LIPfdHr11t0Q=y%EJ4$o`h_G}p@FI)mT&hGc)1I4H-1!X|z zL6+lamSY4@4tCHwE-KLG7PuF5x%Kfq-YDu`hp7+;_t%Tn5`hc7|L(@N_*Mx6;|7!Ta>H1875ClcIOaXbZRa}|^VdH1{FE8mlG z6Lq(OI^?}$#BU~Ek3Z`1dJE_Q+W$ZL@!odo_P_}^3~v7?$wm4~uZcug@?7t@^mx3M z53$_<6+ykX$R8Xp-9nv~`toOMHm3bu&>GZR-+JZyT(z|SKfIAu z99QGjx}2)f<__o%I^PT_Dc)Dq{QzFB40D>PDabuX z5Lehv2gd#5{^Y0JPaU83)+DAeL_xhft#>$e<6s871@3Y>;&|mbjN}H^Ysb5c_Fuw{ zxzpZ%tT$U8a)nFa0uZl0e;O|2=dJlBHV4czc(oMm?>~RqkvJk#R;?Sa?%VU7`*P^a5+yi%k>keD@nSR5YZ9;lE zccuMv@B*m!RqLHX-8}dZ-Urv)G?O>_MZgrstNXK6wBHW9LHpyR^%@R%@<0hF07XFi zR>o%3y7io2`XjnEVCv)7Qk9t6P#1K08~;8e$vZIFC#uH+W8x!uFP6S=mO_%dLgbn@CxOlij3_e?dfTsAKmhd)xU z^O{O!Tfn^P^xGkM9kS(1=T*YyC7)Bjkoqg3AgD+3if8JxDBju5{Fb8q4RAB){Fb%e z2GrdJZ6FsHuUzlE%=3$PwUh4y#Por^px!ptdmw*?ISz$+aQ$K!{{qKv*0(uRzTs~; zZkd?={N+&E$KfAPZ_;{qUX)=DK=5K-XDa7Z-HZ6^P|Qw;vRzAUciCw5#;c_}F;Bs> zpv$KY=VFwMDb&pXnSVJpmJ<6eU(2w_u^Fi+Gpe|I0)V+$e{naVxO{YH}be#GnYc$K)f;cL*m zn)&fwmqO$WgWwsEehO@+ZX4_Y zcOJjRlRV7%Z#>;!ks`E#he7-6eczM%UA%XwUkJ0oowqh6&K|#sBP<8JS~k=E8~6!y zK6l&vLPax7ZpaU=a~aO?uUwzSqsy}xZOTG5(EN_s{O+c%Ep&zlz}+97wE5|J5W~9w zua4iRXg?B`fqJjWoyy)TaYcqH54EAXP?Gy;j1?KT_4r%IuiSGA9}SolPQH)Qejp43 z_1A5ga%zJ)Cy=XN{r$qsq1^=iK1V*#@Xua>>EKMn=1O!sGR-y4woY>lbE3v^p2 zIUW=Dah|JpJUwai3@ij)E~BjH@-XKoP##=QiBfoe515QMH5+3((xw-@2N*VkVG(-g0cx6QQouEGoIt(GS>-(HUr^c}nf zuYo(>Mwj;eXOU zjAjd(EqHXf1h3987s5@T`DMSr@4p4qC14wD1i6-`zcpQ=te>Ag?-0u#G~YYHKQ=-oT^Ra|{7r!Du|=t?MAu@TEbs|E<*fr~Y}VLWY?RAA`>4w|P@91uo+L z{-rnay%wP3PR2~xoA6u~G=JjJaZ;BykHedw$J57rk2ka;=O?fTrot?c^HFfdD*OI*Y@hUg zYotif6vJO7rQo<%V&F8WzlHT*cN6D>a643mTfqH|y0TS#|LgIzKZ(Bzel2Z@83GGI z`?;g<4-~1)x(ijo-OqKw8@VEAn&8oXZcm$sp(p5gdduc1*AZT(ehkQUgtL}e)wBCJ zj<=(eU!0h^un082g*Lw})a``5;5r-P3||>EPdWMhOq*O)IA;UR?=zdHMztSF*rP>JGq3kn2}}RP*OGP@VOWlkA0f zbbYK}o$E$$A83BB`7e46xR%?E`d-k6zunJ5RIK4U^}10U?|NsxpCM)_902uBu-=+C z^4(1}=s#%5-z{);u)dyls$)M=I%slEPUqX`7M3M^2kQO8dcUZdVRpeO_#LKwZ_MOd z{5%)f>6z_EnV@+Dua2X!5&ydM+f3E_kM%w?gWC+$OBuo6?si?)Qz@En0`Jp~cL8w; z*y4CIxXDEE%IIo_R~-YZh>RC z0=N3U0(PqTMz0T=8IE@f?car;LA{-W0C)c(zpoy>A!s%@`L(A_SLhC!-%B>Xe$)*HDKE>k zmA$uQPM%B^=MYv{?!tf%fw+ zwx8Bhw++;hlHL+DwX=x-&WYcDuK1ck)4_>9K-@9-8+1Otw)2s%0q4q43^WJn=OptH z!85?|=zNr>tbDSafN%J31Utg2j81c)U_!`93 zhlfGuqn#h0I$oSh{RiM~*N!kBv0H;?M<&mAv^(K=Zg)JD?qK@}t|wX-&uu~T8y?+{ zwW3WA7zsM=ru!aGz9;B+>Mv}_F&*@Lfb9Ve>DyU$s{4gRt)RK!owWBh+Bb$ppx#fd z_nk&uYl6>UHOO(heokp>7fAKL_X>3rVJ^G_GVenh zupMJTk7X)(>vLPCZqW3`t7SRuKYJG5_w1C?VxTiNco-VDUfHAt2FeNfj`ITd6ss`CPA|uzitl$cV?JE zP#-k!yRAP*bFN#!HE<=k-;YwyzK0%XhVKlTlTO})Xg?O-1@%5}y;WLpjRsmmW03P* zea^N|qqE1QX%RHJrb*_08BP01@D}KDn(2EpW>NP(oHc%kzru-M&g*jB_!B37qK%j9 z#@jQ+$BCEcZ*@KXj@J)DfxFW4wZhKVRO;r#Qjq7+-Q%2kjnAI1aLb^%&B-g&lJy@7 zfNrmDx->P%ap(*!n)BHcobvg#+SaZ61#^GU#PMpGNBgC)9CUr^ zgWx^s`M%H3D^QubTF@M%G-T?o-+Rd|(mrT*JM;M< zZJvTQ_ojU>+xeW*mhCNE+K%THm>!0T&3LXGWcftx^vu4Q_l!TvaTDjx+K)Lo=X)he zKZ5q-BJUC_btjNOXUaGJSkN5Dt7Qi5 z7rkOshMgeilBT7<4Dv9I_hi3?N0;jlv^fH&LHqv;+fT(F;F<;8 z3^#(#m-KrP>pU}NdIe2AC%^i%9|X%m^V?)Ij1^o7A7^QphP+XiQ(Pte@s{pnrNk@In=1~-EHoK%}uXOFuG4~z70^1Flft>72X{95|nK<$Uv)+J!j_^iv`UH$J>VXLt!ka zx9#Qre1A^ePB;QTf_q)3-@Rvh6a9l`4&HDo)R%CQwQ}Pwcbm*axM&aKrLu9kniiTzJ#6Xed*-OL31r$ zErV$<$Dw1H>ioV@IQ44kcc!ONuVYebBg45KQ;i3--hrH+ZY)m z;?tu0jTqhqj(0tAa=!PCK;P%73sNWB|oehuSJ{sOL$4|8X6n=&vvwAmtX1x#g;MxKVgMKgw+??~@@4Mw( zO`heEl6*C2jyid7Bj!i=1JwVM^|yYUbsnCAZqO5SU6g*_Z2j8T;*X4F{hXa%Kc^A% z0VF{CB~(;e@;MypcEQi^Be?w%Zh!Xr8OK``ufL07xzj#pPtKb_y*F9!oz%63ZqO0r zJK%LYSKfN{xzgC{K~v80_ND!+FbCAz!Fu!d;yM^y16P5Z7dN%Oes;PxZqMh(1K$giFHt9DB-59{J>NcQy?VZ#z}wR4-^sLJ1Yd!A*IIA2Cwy;Rrnk!9 z&Umi=z}fw4CIn3RY$ni@~Ka8dQBKQe(9KU#_?;YER>m%?zd;;4+ zuZeYMlXfz5Ul10Z95mzb>+-v(FV{k#1ZdvBru4>ZPhBVI3EjZ$=QbVE>tO2M?iALK zIq7ly6764yiJ)FSS}w)=p1S>T41NLEyUcp^enb-QwRr3KIhou~^4kFr1MQC+t@o#= zxQ+%l_hTJ`f>5Mm`dFYee@lOV#WFkssWK~Qe!{QEl^^%uGfKp51kHPr^&jB1AE`eC z@_AG@?>-NnJ?^4-vvW?N-am-R{xr{YfO=jVqApNLPlZ-;5~Hw5~p`{CYHwDE4Bt_C!M+rjPM#kgeI>1VfNi-Kmh zljmKuk3tM|zu(vQ24++D0VKf9ZynC?`$4nP@#N>)=yuxu4C;BodU8F-Gw4tRTu;G= zvza)aU3hePm!VA+xD9l9FSGO6g}Od41Y+RMXKP$CpStgfE#|n=@eZeb9HxPK^IEU` z4)aIUuYuzH?Rq<9@`gVM8gE`Y-_MBI0f#`n{$|E_;?4Cu&lW;vZ=X!w1m0qfw*)aa zK_gJ_6q~PnU&=7*--NN?K8Ld|vv&#kzMIbXW7>ZPJ3zfltv4`$V-~m)3W4m~herM5 zsCu3K{?+5N=+dB>fLGV2^0co8bwIuQt+zdO4?!>J25$cjv0k~RBiq9y-uaF+4FUsw_dopY z9_LIW=g5aav(fS8rR^1P6{wHPOHu;2Q`ZclAmwhR?s~8eUvxRgd5*6OZJvhbK%(S0 zud@VmYhwv@Yd{@R8BGMu2`7FNuP5Or(DiY+G$fyU2eCY$JE%j}o&DqyUl}yP`RV1_ zmo@`oBxwJ?YPXZM5U!+t8+-=ta{a?D*R{G_R|U;gc(v@J{ZDWVG{23$H}xEI?!jEY z0=M6DJi>Nybh;~>tdb#?DTj%{kvX~PlIL}e%;OuC+1an9W?LO z*8e7TTBge1S&Zv5+c~^j9q&xq&xeJeUQQ{bcpr+(mXGD{b9fVYPdVN@k*y_Wz2m)B zItFiRc_Uly;%|3MNgqqm?S|P9G=mza`{8Zkw&48I@p21Uifp#d6mD0X(;LRy$?<-L z?_1dAc)8Ul#oI@nmY?|hT=_=u7JN@z8*_;E$KV8rMb=CEJ!=`k7kD-T)F)9<;>!}R z%RL{jUk+tJmrosONM3cRyA$pP`MwHSKJxi{xjsGAjwxO4NxZi^c|AzXV=xYMeQN4^ z17A{?ghL?L2bWpbI;OGDxbN@em*++H)6f7kzmC4glj|ohQa>I>fjfTcbvb+g8{HT* z&*Clb$C{65zY)FySq#!|#jW=wbva(jFk!e53W0pLoSvhtvu=4Fvh+lM*+n*S-NEsf zA?9Yd9n@dW`a4ti1dN1dVKBJQL+*F{r+E)4;mtwwCVt(&jVIacX)Pg?JduVk2-upAzNUa$b)Iw;M6I%eIM zkn<_FHBzEK2F+>wT6T}(+7KKDX(9cd&u^N#&wiA8cf7`lzjT2{8>8`mIq`Nom}PvD z_;SQ+zvcdrYmmg|9i8sCXMKI@cS1^0Uj?oQ8BhB8!~u_<-EXmdK~u}gt7w0=W=^wBn-$#$CUP5*es z{LJw*Ufpl3rTsy;_SLj^ll3O3+W-e)7wk=N--#1W86Pd|RDQQ5_4}}gg64C)VL#TC zdyV}Uv`5~z2K z^_F;@`!rAwszLR(BvaWx9*kJ8jO*0r!j5sAxiIa$i}oF%GpP3`>m5(sG>|fnse8RZ z`a+7XFOlDarc@T*MUFS*tGx5^#!m!I9lYUG7Hq@uoq~LCr1SM}dm8U%>gvEf&=jJ~ zdl#6;{PeN?keB6_`mKULgZw^edVAl6_D{kV(0<70zo*xVzIyl;bf=uZ+Lg=>5mKfJq}rJiPM}X;nn@q6zZ13 zCQ$F=)_VinnaWTHBH$jImG0$xbw3}=7BaOK+sjUKt0_BnuJXGDsp~P3+WQghH^4Wb`?Z{Qyl1e@&jE!YFBE`+z5VZ46K4tjKFduq zar}ev>+&v5%#Cm}Xx?G#Z$MoWxEor4+qW&OTgN9~qF^REc}HnK7)F44Z?N8@)cpxL z*@nt?v;(g0(3+(BIXO?FPhxzC_yFFp^dzM)?Mp*hQ19K=Tc5fn&=y)k0Zy1?j7lHO zvfez@r=G9kL&TRaNqZlnehtijE8WkWnn>~Dlesqr+hHYahGqCRfGoprt@{$%Wh> zhv7Ns0q%MDNt?Tzhs!e?u}ec{4_;kwhSL63cmveiR{o%0W>B{Xq$HTS%hS);S#Ju4 z%%4ua>uA3fz5(_2wBF;?{S7&%u`L2O-y;3|KG*d;jyE?KNHpL4w7(sifqMC>PbuDL z>fV5v@FuvwPg2%;_4i4_mxoLdyt@1r(tZtm4(iP(3lgvV?%zJ@4}$#epS$cDTCZ+* z6L`xx-V@@R&T%#9xVXZ4OH)@4YCr|346eJ2b)PjZ3Wv;{_JWZl*MOL2&;n#h-3_ID ze@2wLM?js@K1%#UPJ9nue+Hfd-L6;i;{)@lTMp|$?xhbUpBNoBmTA05$iy7aR@&@^ zqoDKIzb69Wo zGL7(M*{ksAa(#|A!(cS%a-HLQyy748`4{Tvz;w{#UvVA7CAsPLHI8?O<6TJmZ4j85 z_SQ|!9p~fJb$}kw1>AWJJnegRnI^AfKjzH0e1FtPV#a_jPyaTL$@2T7!r_p~-~w&f ze{VCMxOuP&bbfg}NQ#$x7S9C0jc^V0B$oj;pV4+I-vukbLmV#_G6fxP9on~oHlW@m zcK`YWb-0$D6Fe!sTf;O(!pW*zGYXH(O5&o8GG4?Cv?S3m#I%FQl zuj97{F^!=esGngg#al?-3fKvsz&3El+6e2{ZIc8guL<#c-Rb?xFT|XJ@VvDDh&06i zICalL9EQLsaQzAEm(Psp^MKJZ>=zyX8e+D=0nq#}v;8yeD#pRPZ2O=XlmYjcHvhAJ z|LAAZB&jH0^0CSB-%draxSjRwIl7Hhh3m~>-EQ-@6lgy*#h2|X&$Dj=gMM! zf8?=K-G)fNge!#1)%f*z;b~&tfQ*G{|0bLF1&g@G1GS+%+ywHu=`Q_!e?L22%lfLv zJBdmmQx$({c{9rU#B6{gp#3t`-voGV-{-s&V$cWV`6K;a=seH+?@`!}nPlaVY3k%X znf5DSHK_MP>#eewoS_{wg@(9V!&o}CgZ0XBgN()S%^~xoh`uG?d!nfp!qhl-q*&GEA@ZEAt*3_-!K8$Mpd*^ z-PXpchs1`@mfeiwF6+=y7bcQONYgtLy&>+80{RbtBOA zpRZz(;=M%OYcLhQZJy0cV(RwUI_uVLODd`fgjGh^Qe=ufT{MMjFokGBF#c(tuwzL(PlGj1?|Ur zsc7TL_dtD5y_61e(q1xs-Y7mPIQ!A@q91i5>MEQs?g>>Xb(DmiukX2?^CxD4!~yE z1@q<^6U8GrcCpiL6Vms`68DA7v-oxU{u?o;Ap5HH{NHN*xv9Gpq!eY^51)L#E5YCv zzm$p`&!o1OZ9`@ZUOiqaPW$VjBIxqE-FmB2R~Mu-W;z6K>UVq`Z!PN$w+oq>c1b+aD7RnH6|jr&=2`i1wpkEU34U|C$%4 zZWc&cAb;ar3^{V9`{8lCqrluBGTZU$c6bTxzl5(ry)Rks^>-Na7xhwttNmkM{r()k zcm3~wlIzr_eaQTZSGQLe(Y_dz0v#8Nt+x(!cS1L~8y*CAU0X%&;@5qsgeCA7Or-Pf zOUyuc5j5|lG-SIKr*0NVS;*A=-XG0de)r~8`Xly0$W%zAy$RZX4%E%6Y2G(1~JW`C8$5(uXo-6>PCQ+2~4Me_~jb2<}FiM zUm8iDQ(_N>%!7$^zt1IRIjjWr-(dYasXHL`Yq@vH^fb7i+1Q#zzegSlnLhX#qN$Rf z*sGuksK0^r%jZ^KqkcZT4KqQ`*Z1O;bJ-)-uiH8i#yYXTNTmJSiTN4wtxNm$x~zP! zZZqn;!F})$xc>4l`u*hklMiz|gI~wxOT_Gf{h;G!lFh%xCmdISl!s+n@;|r#YdJnh zE!!?3^8sG%mq%&e9|nPX_gU{7)Wt!{6sFSWdTyu7RdbHxU5{5w_H6VcF$+QWdv*O6 z1OM%Nkh{|lNj$p~Y(}hT1@YfOf%WNrZRfw{mHm`^Z_pW6UJ(0TUun^{fJ8t({xAt$iU&tK8TRIhL%o^ICfSWg_^FD69^)_)G z0*1k3&>!Ud@7Pd(zfxeRpZ6rj#4I~5%=28&{5aj;CyB|knP=ZX`=!6k0D14^8dFv3 zn?MBWfZOLKhWY+8>l{G|{N?fM{;Mr9ec?G!|48ePQ#T7%z(QCGZojv%{<-9?+w0f> zuG={IZy+WKdqMqtm2oQnT%U9N0p%bJrNH&~%qstZA=4UvIHfSAIx&r)Dd=+DVf|6+ z9)TVp&$YUJGupZr+uS3AxDJX}mup{QUW8$w-lX+Tpl%v0fVtp$CtI&9Q|Xfg-Z4(T zOKHCWHi3Hed|@Yb`{6K5D|~jo3o_?BIAmtvEpPkbcVdEDxE2rE&q4WvaqVkAV8iSpOF4z5}zBeH+u?A^*#K55b*WGp4!-f6IKVjXVCA zxbKNy%XvTNK>Qfub^B40_bv}LL6_U3HorF1Jp{d>JGk>c)aG_(`!SULp5q-v`&Z#z zP%o>s6mKVW2jCGkJ^)~n~? zW_ZXn$E(ZdQ`+x?6QJYg%4{jIS92SmDT909`=fjh7gP5bqF<(*B`Q3E^JgdT$A}pS zBSHNiTmMSxHo-pl3U-5g4Pis(-0{aphRkv&{}aSyZ0G(GXus(7^BbtE0ZpI|NPp|| zJts5e9(^Tbj^fqQmi7-r7m%eU*Gqoz^UipJy8fWsFNuj0UvPE0Ux)DeSXc>~*ROWI z>oE{pz=P0M1|@mvIH*42>~Ua5hs=GBcLMEa!-o*Gc@>ic8TWa<;{H2Sh2l^a&T@~; zlG*y|zl1zs&r zeZw&-42SGgN`F4%djnIcdl!~~^uy4ozkS{N3dfUpe#N8XbtP@SfP&wq^W(5xinpG+ zZEz6wf;?|qahvZ7jLJ0c<3py}nzXm(PPU=&76g%{uCqy^cq@O$=PIESw174;ZO-~I z+IM!aQ(bpcQ4>R^6@FcRrxWu5d=A>Lw^;uryEtcsN^lJ{te8Gd@5#eZvW?dDH#{k1 zy5ZIROC#Dp1QS5>zR!B2Nyaa{27O^5xS!o!W!?H2rc~Z<@qC8k-$P9H-CSP+&HGpD zUr*gOI1Jx|`<&0QSN*)@dgpS9j<#%+W(;2^bwOsrI z*IMBwklB~gj{dy#CFGwJG)O}b6G#|YLVlY-Nft#$xN0TA9azEdQLO*@6;xUf5n;K zUx+&eMfa!k`q<|67Fc=K(zHx-jOXoK^kMknHAm zLm5!dpZ=l^Jl>bD-F?#V8_Z{Wq7$;2$a|chuS@lB>Yui>=>pF?p0};1LMWU0f%;!T z&hO?CFJojG)8qoKk2xOwUaZr9r=Pct_=7S-z85RsN&gwcKx_ZKqYFc(CGma}R<55} zhHx`zfB$0l$4^o>2*$v0kmXopBKHCqUuBuP<2L#}_eY()-lzR)*aF&5Cw*@q+d-c5 zgTf&5*U!3!FpVz`nb0Tc{7TWLB2)#sFx!9HE~U|F3C-bj)%mOkSU8- zOCRE%g4aOvyGq`G`yeZwCOoyms8WPRX?7 ze_!uocpq@Q!9$#rKp51^PvuJShFX*z&)<5&BZf!zRj`_*TK^Lc|YyDKtE9L zBI}jko0>@dbdcYha=imGd1H9vcy)ifn3&b@IjFaNDqZ9KO5Hz@=NDcBw;xtnuYM*c z@?ppvalBX2{yL~4vG`;=^^o;8q^=cogtp*%1986})SJY6!TR)hemC0pgF&EPR$VFH zSn4Lj`!E+u;L>Z#<*hf@c-pWJPc9Fcj(D{n614vmHi3GdwccIS{RDr&ui)m}G*iCO zk9a=T$@etvFFee00rd{I-tyE{hlWrKTyHc}zL7-89Lgf!2Z&SenExT)Sf+dvcnf@* zzJBmHz7Y_2yaTQGPwIk4IJSe!U<59?ZY<+=y!FawCl0>J_+Q2KN4$ERa2@R%Kp)V2 z|IvQjs|SPJUR!P`^3?bPjo-{2s)`^iq3ypc~s=55FO7wvN& zhEg(j~(N<0j9uE7!8wg&Vy+=`Fxc1 zub#;Bgt81NvCUj(*pSYDJu&+r-|@76r1j_eo%IJQLop}^Mc(2Vy1YL|O7pjjL0Pxu zST|L^44H@V>-dWkvlJ4b`E$r8#ruxBpFqknrYGg^lK;8QcdwtCZLH^xKXAhD|I3)_ zay@1J*HBjpq||0A-+#N#<}7(jIpf~WbKiJ%d^ezdOK1=3_3VDM(qo*jQa=)+UmIAh)SKUWbN|8m4P~JO$T6?}zSJL1U(0qh@m0ut=6D;?zAdx| z^ExA}f` zNHF$#GL`=QopC46LB@85%(0WHwHvyzfW9s&UIHl;bc#&O<=g-pP zc^>V*grnv^E%G`v0|}G(J8gasQ1>Xr zppQ(+N4JSXZEmv7D#Uz;e+ijS9q(Y;kA(@K-g~TfCUuKI%7;v|8s|lD%K3g0?@qko zRBIk1q5Y4L>vY=N!Ftx{Yx38SDYG%Xow|;gTJQp>|0CQ48 zx=vbeo~iyg&~24;Me;<*w8yXc&nG4UpMhv)Ip&o&V*C9!bzVkxQwZ{dTyGkRGk-3| zg>~!oCi7>=JmchDTG~T9P;c0Jj~~ir-ll#b%m%kl7H7&i@)yU|c*Cibj9EwfZSW1K zm#;RK;^oht-4p>SrI^a+F!VaEtPfK3I5m8d`vguuTu1wxp(d#JA?tmZx?UjV8K&;| z@U5p$ADZaj8wvlz^Y4y#5bYPj=b+x0^~&eC@&>Y-Fcbv0A9B3oFFSpvH++h5=k#x7 z+BbqbLA~5klHyf4#yKSQ!(lMUHm4K5(k!>0)~jP8ayn%4Y)Wr;UZeeVSOV(hl3dDr zkh(u0UyyMD@_8tIPGErb>T{1Kn`f@UtNYu+v@ZqaLA@Nxro21fWcx&YU6}m`TiufB z{nzA7`Nr_p!W&M7^86Dq_dzF+Zk6%NE?J8A40SKUco+$D7(2GxrCxzT3pugyok8(r)i!cz<{LWjpP^haW-SS^8zT?+qQH z?l_1~KDXbRzR+>p(dKD_p2@%250HQVqJ5A9q{~3o1o4fK7ufBbdWq}j)Ykxa-6&6v zQ9R}Ggi}pfUbJZokAe2*c>lG~l{{!%23pt$jw{L3$+5egXUQ?1!!uo-{KnCCCaeI> z&pwA3I3aa8*@l6epP4S#Zanic9^LPjq)i2=44PjXh9t#nMO_<^azE1tL5~Nt|73b* z9iUw}muF_;&!39oSt(+A!(h ze$0&j+~346^vnv!{}i!<;6>2+U*qTLef^CwuTn4NAb-2L%DhX_?N<0A&uqu5Wdd>2 zAOX7kKk;7-d`sOv_yt^Nck+$nIf|#e6`iI{sSC23xuE%d>A&XPmp8k47zRLZ7=I`G zBet!Q*E~D#J?#2uE@3_2njTlb(mt3kyLkY#U+p%)`>~~ z>v>qXpl5C+G0po0V#dJ?Q2)&~@1@kOg|A^FYz6mwC6cpz|4_}HxFr54eqApP5OWOv z0PPpu4hAk{p8!%Wl__IF#)b5Y7C9D`ZEUQNXZktbBDB95+CyfqJkPk2`mbRlxc9pZ z$H3w~v#u5P%xJv2T|GhjjEm@3P_JIkDn?y7kWz)I`&lW?w*vcSIX+F|U5r=vV-ecl z0r!G>?RM4cMO_R=zzg6W>ql(9I({QXJhKI_ZWqSUei3{Dy8OzdGBjR}i`j3%HBbbK zgYN>miE@PU! z!ZSsi$g*LUJ2WUT#jufvbgK|3cOJF{@*G=2ZIeQxsztS@`@M?LOKXwuGJ;-KJ z_A^!e7c+V=)%7<)TwXiC<>h(3`K>u(4mfd>Y}`^_)3_vYWu3S~wEqMC2AO+#KQ2>C z33!*VeS-@@<7Ip-V;)S{GtHg6kFLu+UXvQ5+PUmt3{@@$)I(~@|n;njXFfO!>x(d*)Xs-w$ZN3f6*pud&|GsrweB>|t8(;D7e7ZpXq` zG5)rv^W9JTqwqVZSHHJ1<1)_uKuQ6bI{mBL8|~jX-ZGB25bdvq>p;D?*nDrJt}(QO zyTR?>WtsXRR>CuN9k1s5AaUxgZ@uS}uPN!7_IPzX^uRX=#({2Unpy7}>bAfk*a<&? zoAU;nbGGs6{amD!XWnq~&R;OQDGXPD=H1%*OH+3vNNG5Nf6mp3 zY0sQ+^8K3jzrgRH-oe%@<03yda|?lv3q4OO!smu$%;|UwU*nm}cBIE~F=DQRN}ygI zTS?_xm%8TA0osDQ?8;{HCh^vAyt>>TAx^!oTkrWSx5%}OH@v!^?}hJq7~^=kEt$&q z1L{`8*RTbulcW9)Y(1OrB=+&C>#b!xGvCSgAnncNZ2v*WF^705Z&~W9KvSp%^+A@M z{#I3=Ons4xD(9Jvj$iwu4YArE@BfSbh~nLkw_xf`jCl~>lQ0N0?={vtk-8bM3KqhL z;4Z_lHg9+Ri(SW+tFPGIS^s8+vBr8PAKYTd(h!8$46Z@s6SWH24NI@BP+WrU>UW z&=6|E?GSF9-uCZs+8@>E|xA?+b%Ky;ZC?PTfpc0t-OKo^JQ5%+J)%mAPKxon_(xYx4!kBpf2M| zj*lTHxMQQW^`1E{sN$K+zfO;fBD60L?Lhmvwe`-YZaI7j>tG|eIrqtwv-DT8s%L8A z*W>U|nB!9@0-E=1>#ssxEocG_K-~I!GCAJ!`$Nx1qBncy9=uwjwC@W2K$g_qu+;Yk zrct*5J_5O}Uon^Os)sXD%`;Eo(eb;HHhbV7(D@JhZ{qDKmfakNvc<_AE`}jE#@gJb z*{Pi4&EptRN+jZ$Dfq*w|M59kVtPSe(D@(jzvd05?iG+C$8+*LSmxtpz4n*Dy9%$a z�V3qA(T`%UX@xsYeAs6PpZ;5fKrxbyKQtC1-i%Zu(aZCA} zeC0D*$p(yLyyg8^(}eat;dRjdxXNxnt6$Ch!{g8zIzScNwL$K8HMKd*_im=X+YV>A zv1cB~uj|QDVz$73(7gG&1u0&E((JFG9Fzk0TyL{=>w1#F`x4$rDwNO1(7q8g1N9d0 zU-LRq*A1lflxfNT9Dj%Cj{pz4C7XC=w$mRm+K-0$pxz4B`zLj$A@?=(6&xW)9oHvq zzPWMA*o!pt%$JV$I@;d?w}ERBe=1-@8yVCwi7zn!j z!1om*k0)sblhg;xo_)PM z4+p3*JV%`T3ecuB^aP#%CcejOS&r*^Fa^3pACPg{5Kn?-)0(Ml6Wr}&>|T!#=J*2n zH`jI9%_UG0G|xx;mje;%?tnW%my!7Xz?;NV0+06N{j});Pk{F0<-W&ze26j6Q!iy8 zf9rl?hckX8$LcJjNE^@G=6GKu?sb?8I{)luq<9y;!*AYDzZbT_ci^s5RTih`Uq82% z#D7129bZR@@p#aq8>s(!>u*(_>&fsg^niZQ8fPc#?PI66khl87_j_gp{v5u;Tzmt| z56Xc0!`6Qrb&VhjE#Y2pk56*&K$!IRMt47le~ROOh?oH|7qs7NS-<>F!UYxB&%q_& z_D#V|?pS-Smpb02wC@02LA?)J?*!`JhWRi9bJkJNj zECbyh4EA5l^7A|i;`4l$-cHH)fUF_*OVGT=`SIQ*H~M3&7}LVw9!CzadCB>UY`0?_ z7{7S+II05e8^b-I-Zj>{oVxY!9qfQrxHengw|1(Z`Hwy5nPzx(z4(jvS61Yl4b)r8 z?ic$|Hvq=N2#{s3*YCIb zJ2aCw@rY;Mb-bNvKNQA;dV5&!Zt4y}=q9dbGj+WOt+x^Dg5(?T>Y258bv?M8nDTH3 zsP}E_mFE>kQ$HSZ|3YQS^nSeI(zDlrWH-+C0V)nuz(DjR5w3I-%%Iq^C4pQD= zIuze%IKsBaEX&64B6=pUD?JXT(`J4Z?wM3g`%c+B^H$?o6Bq-JLT|{Aqbx+2(N0Wd zeLZu}gtv&sJW~@_nT#WlK97*_>RPN zhn`OSefIscPv!Xw>UCQ$)#3i08AiM=$AP^5GQ0x196R{&-gxTX0V#8ssz>@n%bD#0 z-Wgfs^&WBBFLJMfl95$j3F1G=BCijL*Sxy>@#mFS_&LuUz^mJZwfJ_!kD%kLy7d;S z!MY7nN-`}Ye>-DW=ULBPrCs8A&z!^`mj6&H5>p=-F&s^{LhY>Rc7J&Bq zvXs$ypN`>pj{4(p0OWhprhVwIBMa&*-R48 ztxlc=Yh^bjpdx6$-Rhqhc^#{*Kb-G+bLd zJ%2ysOL@G0)D3|VF#LA^99W;HK4#}nzxy#V#xrj@`RV*EC06I}LRrvud!BjzV#F_X z;$>W|Bz6sCBS@Ct{qhI#?zoB*x7mp++Mjg_);sSzCl!|U=M0m??;&2-ldZ(^g>voO-;9_vslL3jdmv`h<&z#1qr5NqY!u6p2@ulsLs?^m6T~-nkBfjAG z8qH_?c)cAw02w|-_(h3 z88hZJV#hi03sP@yGM?bI{@~`HB>rJ1ehP8(;8W1?%3}{w0)J8$sKc=zs6)of=Pll*ekREC7H*COR-C=u6L{A<^IZwq65>7qo$oPrzIRh6WiM0LSsSN$!!w5+ z&k5T61^zW{Z^>t$h-(L$Z-=1o zZN+QtLCOQXF27?e{pK%O|6k2FiMNO2?L_-N@RH-rY4cr4-6q%t+d=w4e{X3)rsW$R z@0s`TYLVwQe6EZK~vCvyGZ_Ed32!eQIPV4OwYBPC-B_G-c-}nKe{}g zCQkF}=&LexdANB+i7!FCj+0MbGiETcFN5ZFudnwG@|u)5uN~%ZcYO_f?5|fkPU3i* zIo@}OnE|sMZ+lUqRk;$9HyC(~;sh=JX1OEqa zhfLn^B+vYlg*UI`9r{0bduH-R@m}^rdi?4*E8=)Z{SV#&nY?klH)P?x*73gaKX^xH z@+R>%%)(p6@xJ*#cqeD_hU1=jC<|{L$2;wR@Gi*YjpBXI@yhV*!W+h0A`9<}j`yp7;f>&}nT7Wi z$D8~Y-YDLCvhcp)c=!DaZwzm*EWB?yUcC=|KI=ss?}#kCGaT>nf01tj?@Y%#AKz;D z1cLbF_~oSaW^cf=9Z&&^KxsJEmKWRk$8M{fZG>L0iN5WbHI84$+pWX~tUrf;`1&8m zvFBRvVt99F;jQm@^Zg5N9PdfT+YDa^=mgpyms;;z)Xjm;<85X0-EI4~6|e2h)W3n1XP*~D@#fl}UN71b^DuOAy!Tn} zdqa#_4pLS#b(dS_{*B`;>3C0bO7R5FzK-_+>n$Jy#1{EX`nkLbyb;ISmTSNLaSm|2 zovn8Sby`O8_qqBviT7T|tK;ld$E)}8&SyO~?|9}3$E)LEqT}sr^F5#O5XL()3-46N z8~YdD2;Nza_nu?ii^BP?N@!Ko;I#9WR&O&)XZt zJIV3>iSHzwcD(u=d%lM0?aoE~eXjK)j(3UU)&9MNINfh<`Y-vOb32Lm%PhP_9q+dP z;yqWsNxVn0@RoGEJO72(Oy~aAPye}Ilykg$|AjY*q@#^On&L`gl-cycOw-3)c-aLkuE&!y)q4`DhO@XY;rL4ub0aJO-Co+qo4g^7c}5xLz*Oi!u03tO z1MF1Y(K#O9nVHVJauYtA0B?YLC#MqNBil{M6)Hkm=&%|uNUj6yRK4-JoaZ~<=V|{k zj0E-8vEE74%>XIy%CzKv-hWeX67O2PTAs^k%pzhw0x`(-gZ9$l+#meRI=3)&`?rJa zu;%gkEIi>P$T+MhM6r>bky7%hz z=XkUqbU7vPzT$X`(Y`!X1nu90wtt&a*9N3K#MJ%FUS@CXUC(^%c>llZ-#Fg=c=bBT zqvY`-i~-Hpo~L*x_}ubr>K8(;?Ii7t*U^kE$yu*2$LDiAjaQ!w`;eGx?&Q8bs8|2l29a-FhxWmDIzo~2}uz`G5IV~Q3zpF6h)y_B!j4k zQm6+G}7_n9-HF_b+6i(xiYX~_5l@s0Cd zc}B1|&k(t3+;96f7w=l?{|J#Ya^6^0>q7M?YXHYWBe3slct0=RB;I|Dw;lD*g9||8 zZQ{MXD7z8{LO-y_Pn+_*X}nh)p6iD})E@!&gL+$d@8gs`1(GI{SFiu)?SVck8G9k* zjyLhnp#JMH7u4IqdzVnQ3?zLm-(a!cSnuYh-r@pj9aT>2;@$O6g`fvnjKiuZM z=Tg=MBwb8y$3xHyxqist9gkPHXZybD+?BMs8r0h%P=#)I%DJXYmo%Ke?RueJ-9E%- zgxvH3-W!bfoPXg>;Cjx`TdZ>y9uvucg9oyId}ooJJx&W zQMLpmeI&Wr?x=Sz*Cge-WPDc0g}Lyr5;?;54m78h3;4Rvzw@)xJbS>q#!23*->vuYzGLKWeSI1=r z?}Y`t9~sP@0h4J3@FT4r7qwwnZ`39dmi#`yDOP0(1-n%m! zjy))sR8#T-<43oDF3t0)#(Mzu4}&8>y)St0(Ui3UNvBC(iZ_mT9$roDsoxoTfEXm+ zgMx|0liC-#t0=z#wtEhSWtPO_zRQj8Td6Y~Mu5h5OyCKPxW0^ggmOub^SAwehb|}G zj%M&y!W+yQ?^lcQo?qHNW4tx|`dGeZux`A}v=_y1=KKA;aphiRzgoaM$9NC^8{SoU z-WcAaOg}8b_c?rHy!ZKjDASSeU_dpf2zI}^$$PaQQh3`M?_Sie1NA`r_XF>3L|Jo? zbnewGlT!BA8N3%7Z!6lJ0cU}Fxg91c)RnSca20GEw7s{O`!cfZG~U>2A$Pm+YP|i8 z*Pk|o{z<$Eyieh+6U5|h!}lHcgWk*5Bi-#9cS|Xsv>Z&^Zqrw zy57qA^&xFOGT#2)o4+dK<_4K>_b7;~n@fyh*%28Si?0Kf`av%j?i2g(7FO zKLJTqB{%Cue!OYCyKKm<$2F+m6xxE0httbtRiQ^H8wXS1DX{z1DtY4}Gl%B`@alT} z4)qto$DrP8ymvEYlD3ln4Ay&#_v&^$@dnQan0O-`r0fB;K)ua^%|fU(WoN;q&=tnv z((heQ@m~FoN9N6t8*JjemijOJ>|Byuz1@SE3Ee@NrhDb@0{yG;#^*AA@mBH;9;E)` zFagy2i(hWDDVq~WB-6xlRQUwDeZcJbgS$iIQ^1T@HxT^?Z2hHF86-48w%4v%hB>>lUx z9bniW>^`Q_{9yaCtsmdwy#D)~w*&RN!R4Ud-F-jGd&=*n{Bal!c7CVidEMK*_YAKt zpDEOT9$o|W9_PK$^MVeoL|zfBcaisMKPK_EG2Wx7-ww_P^`7ay%P3m~KfyO(y@|K- z&Sw{d+@+=;jya$ASilXS-Z|b|rE^&qgT_!Fx(#(M{&wJN>vQej#JhZ7%*1;o^>2Wi zK)s8-_YTU2fuxb-HeMa4ef{@rQg|OS-Uq1v47>vBJrGrt@o;FOtUC%WgicUt0mll^ zwuJ9nk&An-KfZR0xxQt*S5to=+yd$yB!A!?O4$j)-|hkaF0{U?H;(s(0^UcAcl5vT zCh;yd-U;~Rdj-!L?_=IOld?G=>21jiY+p3qG~O?bSNma+@jme{;&n@SZ-((|ydN3w z#D5WQ9B=iFx%F)&zHecJ@#^oi{zBOwAgTC*pda$T$FKd6!n;3S-R_*n`R}W2u_CmS zFlD=Sh9AFjo?Mmkd&%WI*^b|Cew^ugk-^&xZ;bYmYS6A89A~^Qd+#91M#5;2-<7q; z34OiydcR)8J_xzicr{I<&3h2-k~sG z?BU_E{11zw-l}wW~glP-; z+s5=hE}2JNU*eyJ_)VCgzWnn!HRa}v+>#fc>4B%<@l1^NV@>c{2fIJ2MIT#l;`5M`_v~xDC!AQu zy-u6Opz-SY@L;BGr2JQSh`+7(_&je0@7s9wIIY4(oIk@}px*laxc@ZDI)S9Fl9#go zjD5lW6R)O=sXqYjfN~VdcI%qJTl@`WKf$g&0(V97(Sz9z66+eaUqi^_UxnNj6X!nE zsSAgI#(9^Ivk_&@K~gKp3&g3vEuX}@GY|ag{EPP#I1AMKXr8w#)AGHeeZQ(Vjd%Y% zuf%(a@jjF1{X6kGZm1nyziD`2-)-=)@xJc8iz)jQ)hGNx?=|KD7<aoV+p(?H`rKWlQKvnlHak}j3Jz&KNH67PovyuFRL>%Z`3 z@NO>Pz0P=h{0ncKo48ds=f=Y=_=dp<c=B)%72hpDedD-m^@+Gx5!XcZ`>x63@o_31w?Q(s$&gZO;?yLar}fO`EA-<`V8l zf*53seG+(!t5Oz&1Hd|K&<80zBaG(|>NJ67AkD>714u<5o?7Hu8iy2SX#a?5--hWO zVIXK6!}+5M$8Y5?<^CGffb4#o2cH+Q(XB@unGHODf=B!RMCzOgoj}KTclkh;>y4D% z38Ua1u*-FpU#@zcGW~tX)%_`VJ#j4c)6lACZhQZn_fEfzdznza7uN>KSHlW?>%4QT z&*hrpM!)e*Zwa~X_;vdSM#i0G#&&M~IvU_0yq`*FJ z(2R=#cE6v-`vhKHUUL0+I&EG8^^TMPnD6}SzxF&yoRV~TxnDUSH}SrK?<4pWv_E_M z^`&obj$vR4jECo-4RN;jvG&f3S%OIvh20|K-$I*EAFe%s`X7>kOWfyD)&;JI9?%Qy z@=6u(r^|-e*tC7U@c_8x)*u(ZJa-5-^*Mab_e3s{@zIa za#!&FEKu)pS*;7D-r)B>DL(^F23glK_~f?|*LknLS2kHL?2f~$sXO)iKwr@DwM#Iu z=w`}>g2pMu8QPy=+TY9cCtxy2H_G;-rc`A8pH10(SOn^jWnW!&<#b1-e{gL+fmE6>|B z^WK({({Ivufid`3kEhdk2jZ>n<2{x7ouMnJ_lRIxs3&E8K+@IZ_PI87U&J-u?0!BR zcEe1(*HeEK+}<}gKJ|IpAy+dE-htWhCRDnbZ5{nliE9b1$i=U}At;|8-zDtE;g89G zNH1T*JJVnxXxuI3560&wlzk17Hjqo)joGL7z^!rX`%zuxu$yY)mgg2W)8=PTuOCPM z=(&YB-Vg9W!f%DyY8mle!g9O)2?=bb{X1TY1%dP?V6i* z`xj^z-;?cuY1h)XYiHUWP@r9kcEe1&GpXMdx|?=&e7j31)A@5X!u)oqEZHDk<=fqC z+8tP+U4nKKO}pEDyZcPLx&_*$Y4@UO_n>e0q-l3hfp)RI!fw84_q1;}%e1Rkpk0!7 z%Yt@EnL~N*R7lfKl8l#~dT_iK%33?6=Cvi$G@o-y8&z_SY; zx+t4EvJMLajpunh5#kwDz%!h4M@dOMdmGQ4v_FU)>V3w;ttaQ-iQ+QUuNTChZNGqe zG7n2keK|m=#^+8b@VR4s{4N%DCz{Xwg!XG-o$<);URN#e%1NhYbj} zA4if)lJSuJJ!-#Q&rtsw6MqNl31^%7efivqd~UkH=Z^F7C)o%N4m?Tu9Cn{s?l+$7 z^%DAFUIEYJ-jl*J#>De5?S;pT=XqIFcor4#JfY)(jqB6`o)3&?q4z8+;2G~dF*dgI z@aXYY?83m(_?*#9AjIv3PDB$bueQ|aQyBpv0)K9}4(EdBo`{q;jJ|qkHhI?NI-+{*W zG4;i_2GrLo&zCCTo8o;*c0Nsv?_2Nt#rRIj^Q8;;7I|Ncozlt1_lNgYxG@*s$$7p^ z0pAAiOXKTge7oS;8}>E6*4}pjWru;2W5T@S`bv~ZO0x6oX?#tnFTN8&`;V`fWXH4m zVg-Ely)VvAae(o)@xD&RcS@cwUclGZ`y4wu`_lN<8Q&c5d*ArZ$n(j8%b&(y_F#tbSDzgW zFXYhWyWIQM8Xu2VZ#TcO0>1j*7jF=DRgCXD?{mrAc$P<-W&5n-IbOim*8ALHVOPia z%Hfgqqnh!ZndeIs@b&h-G`?oWx2N~jGrqI(e8~d7;og@#JnT+4z6Rdc!uUGo`BDXZ zQ@k(Ukn;%RJJI_(8lODQX8SK)z_-Zz+!0}Sz44vreU}^GIeETJ0pAAiOXIuS`1*R^ z?Z($B&nGvP{xtq5%WnS~h241L8{&PB8Xvp&?dCUDz*pb<;zx$v%f>g(`=%S;d3nBg z0bg71bB)99eSDh6@`o@BpCmcn=q!ISo)feQj_z~+j`GKoF+5)zj~?eQFdn(Ij3=Ao z)Gz)m_*?#6L_J}NsXxkpZtnu0J3)`%@a&6+>*3k7oc62XYvY-Qr-Iu)A z`U6b;B=u)dKUmt%&8MEQz|@}-)Gt4yKtD|K{gA>lACD$^KdJDM@vOxY<~(#>0Z+=0 zlQf=X#`6cmOjv0=zxj9;74SUmg|)_W9^+5@%^k&g^zTyBCFLKj zzroZ`nEEm5?@^%sW>debsUN5QVFl`MHTAoj`U&cvT%dl@O}X{%VpBg!{VoOShfV#S zrhbb0*A=M0lc|5Xsh_6)Jq7AlG4-!7^)u9eDyT2r>Gq&r9jIsO^U6|J-jCbFF=02G z`Yh6Hno7NPOnb%D=MX5nomp03xli%is}!DP=5ybp{ipD`@vsVtXS?f-v12*DGV`a~ zr;?j<{XHOPmyIt@{a;MHyHHQ4>g%^)h05+ab-irC{hB{=>wV)}czza|fu!T8zn}b} z^-l`B1E{a5=Iwl^4UPm!$5UUzDa-b9O@aP+#;*s7Q#tMlJV|M%`;%FN0#8dkve@)< zlhi-O)PIF~Z^1jh{t49Y3)C;4+uLpbm+0JSVRtbeKRem)+sJorRvXXZQV-9D0`ZU2 z{U@HQ@yNVNI-X#K^~TdwCg5>g_}@N~KmM4Y`yV`m@#y~WH`)tsaL^AjUoE|-QUT8l zKfaQ9?!)6ROKjU-RyUqAyeC$`Gs(x3!t(^48d8^}`+>T~bDm6KzUmk7q?-V-n2nddzjJg?y)CFP%!X@Be4Wn2g2=_eD2r)>ex6kT3z!|pvi`OE!E z;~DHdi2|Op8WCivhlp+ zJyQyJmU)jmJ?suQ9=SIoykk6byeD12vxqWDF+3;X(e+|1Wx{91^R856{A3DvX8C@O z<2m2NqwD)O#`A&qY$)K#`1wlU>4is^*RQmHnr8tccjVUh&&0#=udDp$?Z&fydBxg= zSs`-$+=2E&N8_pIw}+Jqcw&@EO5nK!v&uQM1DB$Vs<8fz%-4YXz?k`?3 z9=_f#zXeu4S-|t0@8=|*RmQWF_QJ=;GgLf`pFssY&+B%heb{X=9zBjb^3L3HU+F!= z3wWk_PXbTXGEy<<=W}cF9Y{FVc)s$UQ3X5`D3g@NQ`>khqUNZ`K z=6O%71J_55NACj$tbk{Ot`~S(agrWntj;vt?j1w324Cxzz% z6OX*NPCCXZ(RkL;Uf5tf z$N2fGQ^3>Mds2ArG9K;cV}|6$&ka7FRs}p^KVKO>d98GoNm19ADjwXI~*i|mddHWpBJGr^Ge;s+gcK~HKfu!3d zul?uiSn5sSJ;Zn)AdWHcG~|0{QT8gl4R3<=*2#-EjkmS&en|b*unzLQ?RfC-N6NQC zH+cxq#M?N}8#^cLdKB=M9s19_t@6A{yhDt)0=_+A@4xWYq+C*dyn6hu{hPu2BwpQK z)uG*?(5Qg7Ic06&95@5)^G_XpykBvgA>VV2cM7{NO}rOSU-qLrLw^7EWZE?#>95{{ zpz$X0mM@zd?>EqHFbn}%EzI~WKa8@GQ0To=;**rdw--KLA0D8-?5D>S@X7bE##3&e zd9(eQ6`srS9=(u$a zB6%;aOxO6NO@j94{}1hxw7<->pGCa7UgynEk*wFRoBol{PtksWY5z~-Pt$$`?f>rb znaAhb_47~5=RBU9`wx9_d@uYD^OvCgJO4xbB<)xI5A9R5cg6pHe5Gk$`G07iq5Z!9 zLwk2V*ZpY!UyYAAz83g&d-#rwXO0KTb8?SP$=hkJvm3==F-dFI(vbDK>M1A>9CHcLi z{N*p-r$2z{g_gfO2P`Rr?;R6oJ?cL(qsV;%HcqOBhJWSUkxZ8qCoe6|L?Y}~8}CWf zm*)-JljnQSqO1!@`tr)6ZTklutCH*dr}1tz-ivA17y3cIw?AdKgQO;nw*TI=y49Pw zAndA@%Pp@Rd53!M{p6+fgX_ZjZ@hZ_Nq#3FKVJPE0f|?pm*$P(J;iua#39$YCz9uT z<@eW~@$t&E%Z7aK zT&6Ad-sR+_#hd6FcB73qL;dez6Xbh;qO53mFdic0rFk=W-!R_)svlzA!tN8}?Zvh1 zYoR~n$9p4Xm3+Lrk(buLDZHDESFbC|d+hVQ`R_|F&6~!%bNSqQA@`_+#|w<#VOPq? z4U$YR&6~k{fbo{&SX0=W`OJ^ErtbqW%klT0too5EWolpDWy5l0QqNsq}pFGUv`#k8?L=BLO@ zTW+og*AI>Nzv|yO-ZPB1>?rO@!hw+A5BpQ5Nv4+;ZxU}0y#%j7zV~&?7J{T@ z%H#EuxlF0Ew=^KUjeH@y~k%G zbfMxAeE$#jgx5Rp-LeDu-Wc!95nsaRx?W`PjxgRjw2^a_2IS>@yhnSlWDO~o)P(#P zC~aFQ^d6$!`|H!N{ zc#Pr-$|YSx-XC`4PvPHc{2KqQ#^2ER|7rXg{QE?6%XJXm5pcipAL9KFQT7x_dX{`T z>?r=^Ra}oS{xogghU@up2<@M`-oKFYPeIaZ^0lxdf9&e8yAZz~qU_qBtowm>n?e12 zRa8=_!bsj-!t?~337x=xw>;&?=DRxPX_UhMl<{9o*=~6D03G-KaWr%E<=j>BiM9WH zUqIbyybFwXZ+wTtQJ`_}5nR>^ok!Wla19(Xne8CCbx$b}ck&v(A5xO*mm6s_6dnhS zyMgzwq-;I>2=(PchlxAw-Fp2x-Y@KqHr}1?adlPLQfu}+Hd6FzE#>eZFErc&% zDSQGp=1R-9zh@+kGWaw2tIK~#8)>uqeSEhYH15-V+}BffJKPJyz;4H5-YxIlmg_k2 z>$$F2A-7%@@qKE!HuM7R)Vq7|k)fHC)nvM)Is9GPI+MiP(s<`ne;IrX>fJL?g}$Wh zdysT7_oPenX7KjFtLxzw+J)|CUkU1!ZrF`}u20!f&;sQ5By1lK&+FrO|FFBmc+a4X z+$Zfqp6|Vovfd!+8p+K#mVJ*T9mh$$Pyau7(|8vfZ-3&D-!7EjCCrak;=I+zd&dsq z&EWkBuU;=4M*X_nSACG&dQpZRrfh=vNR!F!I173qcfBk=Anallg8?e_r&9lQco)QQ zDwF)w;!h}B2S0!v3u%^F8c!=cy8Pw2ieISr8%TWOIY~Z%_<}6>SL&3uoHBU3;f?u5 zWq7!~8q@^!9vn;y9ZlIua3-{co~P!vzl;31YR7#kS-;XZ@Z2=sI^Nrr`j5g`P;Vpe z-9(vtAn4DXC11{R0PRc3-{iXP2ap`daXwyMPI|7s8|}o~j((`-z5b)KnVhc|>W57} z-W1*$#;eay?_s>MoMinf!}UB(GQE&jkH6A*7va_I*Hjt`(?R1^?>v?I>4m)d{*(;f zjV4}wUUnx2NWQm32Mu1CUdXHQx|_nTWT#yJ>hlh>{rV;SEAf)H8)q`TwDll{xAy;o zH;y;{|KLsFJ=b{iuiyMtKUATAOY4Uu-hOy>k?h6zsSAhran_#B?d<#aCCcW4q=k}~ zvb~Mn%6$~$T}u6xuo`4Mh&TH@BFpUu%6POuX_OMCNwhdx2MzJfq!!HjP1gQu^T(a<)4btV^6|5I2A>b==}qoX+n1WCQ-aSp)= zRQ`K`bUbA6&cv(xi(0fh5n6+KQ(2P>O{8oVEPy#+y;FT(=y*un$#qQ=?+WUF51T-} zx?b$`F!91curJv4VwLx9ix=;A-W#V|4x@fsI3LOpr;LZ}bF-`$k5V=j7DF25!HR30 z+k|tJY@I(U<33`nsas|f@gGi`li+Mn{|N6NM%kk<1)`gsdy?FqC#MVf?+&|Ncggk7o3vRDKZ1_872bbF zito`u68eGrnDGy?%wj&*zDbVYy-RqtUq(~^X_yM?uAZO3_wn3;@t#4O&d?Jy-ud1;in4L=G(1;j`*_`oU^(e>mmfu1 zg;&#yw0RBQ1Syr}!{eoriq=r3%O*Z5?0z)y$oFwd#`0VSXgptMo8^u>YcOpI^=$vu z&xG*Ery(`$B$~GnWK-g8NmRld6 zqW(0P0~+tQ-upRa>)?0z5$x~y^z_~@yf^k>*tM%(#x?fwRvgFo_TXqx@AzO^Xc%SV z;Z>Lkqj630zF9tBgZD>>kLG)?dj!wfRN`6RRn)KWIO`3lx1;wy`UKl1SO$xr#wWCc z6vraO7oMM=^o>`J`0SL?DD>gT=pl|OL>JNcN@7bciAR& zZL@z&fY7jGBhxD5Ifi1#YWk|1d?d1>(`#&iGFc<-V9!;pgf zei%#HGazXid1>AZ-m{H2|GACq_9|=2ZFl6q@?1x0UN?d7RTyu6|NfPCNBtYa`>OHI zX8!DRN7lQLX&?E1_^bPHy4+HDw;FH1R~Y9v@V#By=lAbw$~JiK&*X*rLA~)OdH-N6 zHy-}0en{XQXuR_70HNrqKgSy^zTjV(URt~U?_M=?{g8j3-Yz#A?~d-% zyQg@b+<5b!JjX`;)nI^yx=-Zz0VJ&;{~G#zR>s`|y1$To zF8eq=k4jDB`$YKlJnbjiRGGx@oq+nE40ar$)s%e?Ri9=WRD|KUQ;=cbJjH*Go{LBv z$r+qS)ynyM(B^8m4rDtd@zYFFC`H*Mcm<|I`-!>pk@}fn9`twMk~2BKtetz#_+9F+ zgl|CO{@QzoJ;QzlR>DG93UPexy>p1qtFr&!)-SJy-6i<7Un)%I{1Iw`#@#hI6%9?E z!m~8+7R&*A{5s3Kx80|jA9kPP)$ zX|ANu!IU+IR&XpxKdh5$K>S(H_rtdHs|CC#z2veE@pr;5d_XSVDb#-rmV$a8_TDnjvo6CvPz~fdz@)cv6K~HvuX{J_-o~q` zA@%3?;e8wARL}OqBf-StvnlHVeL%kNG`wvP>m-~RJT5QHY6Iaad|#D(f3{b8e=hlc*!A{a32FfKhrkF>?^c;W zyb~##4)Y-mQ^k8=ux!%&E#pbN^8Wh72VpnVco$LsGx!43yU}}pqO9x-G79*eKyrIO zQJj)A-uQ=np98NZxo%mBHoJq4qi>j4+I7oCKGwke#~*UtGKqH~UfpgVi0>FU0d!n( zTUb(PBxRFeDZB!6VFOOLD(HhsKDYa`#B#ppX!_$b+N_0dLHnbD_x~(q(}VsfAusg3 z5qS^$&ip1t2JcRFbN%r<=Ogl6=~|%URi@G(MOAQB;vpS7USl7H-BG5!+~?bedi#U+ zr*AJ|X49ceQ-}0njQNe@Ioo*tX&gz~52U@W*FU%BUGh-5O|F0ZTyA%ME7MCmeof;Y zYrOx}c0Gf4nepa7w<+5Rjkgi~^>?2KjepGZ%*NZCw)VWvdfPDVERgh9=XJV2PUGF< zARiI+&!^qR&>Li&?30VP=vvAKfi7e5$5wD%-?Sgb^oL*yNCY)=?ThDAwhF!jyZx>& z#8Xv1kjIzzqO1;xLw?UfuD7IU-^sVXm`V+p-U3>Jw)gk_ z%eABIJdkZvoX<|M{gd%}Altv#r#uH`;^;ufamw~`4DBX@F1M4YXSbKrnWoEL`l}ya$u*6V zzQp^D_f8}3G;KbFjPc$c#9c1(BHL%E4YDjo`*r!QAsvP9Ea(KXL6hYqUQ*~z%I*hAkCU&#w*};IK(TKF15W6*fp2SY4$0%fOzq;tsi z_|J|vJ>E~2i@0%kbv$&Yet$@Uj<@z%lMB5`*@qzMEAsC^?xl^oEH{oNb{P{B=x0f( zP{gH8KmSCVonB)Zg2pY|TTejQ-3n71&urV z{xH0YUMEhdJcrMO3Q&W7tq+`Gqm=k4Yr--X}NYM9plATVQOW_`n2xU1Q5PWvI zPbm8uz6ZNcN#i{)<@=#h#2xQ_(oD9Od%RKB?FZ^(6Sm!UDF1nh#G385mvVfW!F!SS zrfGi|zT@FkmBu?BuckrNzZXV^ebiM=LP*(QSt))cna&h+^0(8t%+At zHR>M)$AZr9mBHkqvncBd+JDj}wR^-JYT94Q^haSV=z4v-Z@-+f)u8DI{+8o_hEXc) z8F9_c{QbtX@O*xk6LkK53p}B{D60dK4kd3(U+MX$j+24RTXsK(_cXjZP8w1FL^u`H z+baktbOB{Op&wicI-lY^*DntpC$2`sb;YaO;Tx$x7RG~m`+4shl)VR%J|?en$)Cry zo+GCAinzWe-Y=-X34R6j>U9l?cjvdb<^uWg_RNbnwm17D)4zMs<_KsHx|}Nbc<-d_ zewYGd;3;U&b)pJ9uu_L*(BHd9GB)>qEZANq_KCQs@$0x>NSkjU`gYE*&$&0J>=ft@ z9U%eMKid0c>`(IB<8+MulJVb4o5vsx8vnUI{>_vXE#Ui5P!Xzv_0RJDM~y$eZ^SLc zFUQ}Kn$qS3I2*Lzdj^w2*HCsd+yg_v?ypyPw;o@({UYuYygE)Er~b1r2h=;;d)HF7 z8OpuG?>&)Q?>g_*>%bYj>+r^cwyrvD_J<~*-i6+K9%UE96%bv@&kW#7u+g2uvJ9^c zwllK6$aW@EE8>2^tLw|Hv>6U#LA|H?^>99AAHWLOn|-@oU#fert}m(D5f|pdhW5jE zwD}cwdN=2t?7dAXI{{7s`JGSet>eA=+;ejOh^vNI`yoLa>4%==8ZVEcOA1LpJV?3p z!&q_|6LOtR#&l!v)!(&C9uRQ{;MMW)B=x7lTu^V9VCaXwrR-;L3;CW2{c7WF<-Ix{ z;&mdfp^0}_+SG)Gpx*57_z>?oly!&8;nRCLufwIwt(*7ia*H1raV?GaCfW>z$3VTy zeY^`P`xw^3DzN>~H?JS!btA4FUL6m=Q9rVX<1tY0gTbaP)Pk~8;Vh8vHQDidi}&hy za0f;BUf7?P+a<>PviFv@+(zcb>*_^ZFT6U=M&TO=(~WnT_sTf?g7S4BN0-ww>vi8IeFg1ArbeG z=?7ikS{v_H?=5Y8dq1xq;)h1u1iZ0qNPO=H->oppcq_{WnRw?=wg^6hPOs6ybPOc+DLu3nBQOr9cM>*@3EA%hI61j*zMUS@9o7k(d=B}aGg%3lNW!(G6&gK)*zQ-fk|e+kvuHomf_cNQI|H2;3R3w zoXGLw6W)InWdq?3knic*<=4!+bzCG4kGQpXC0&i$QbsM;OG5wT`+;%158>7A_JhRr z6ubbsT-5s+W#7Ob@FUpo5%lx@C&$y-?-3joag+Z);>9};uWnaLKIEAPI09sKKbd|Q zBLUM7D=AwKRhDwhBh$%c-?#x}Ne%Kb*Cyt}KvL{jj_-`W6>a3YayN4IXHU@ZkE3h~ zyahAib+G4r;dQ}wOZ-(i&XbgkN8BEV=lc6o+N^^OApI@z?;BJN?avPLFu&70hFrGe z8oQ1(JuZ#6h`57{_ju}egv&tVZtlH1FXtE?TEdZVG}Iy1#y;LwK3BKIooN+uWASUh zccD#h=nES6jov?mvQZ#u40-ygVE>~rOFoP3qx5;~0tsp48tT4g`&}VYa3VHKXiAkaQ}! z-TrDH=y7W7x`?~fcso$P3>*0_72 z)H^kp7J7=ZX&`Afx!eaH-Inh}L~`5vDC>0**KkwUN8Igr^>}11^_RhCpk6%>-$2=~ z5L!i_gZ8h)y2UTAZDXN-#NBQBVc%Ez?kH_`0rmRptD!w8t1Uj#aK=Ds{Ts*o2wq*E z>(TCXI1hCE9+Wk?&>+f2!ZYwFj0Zi2l9+`RSF-fTb5jWlR$BVR?4X=U5 zozB*Dp&;XV5T>mG+aGnjTaVA;H$>bIrayk9{?FoEo%4PZgs{zfG}D@Z?T=R8tK-ex z7;*iM$gLOWQ@;yb1{&{=dEV!k_6%6>ggkEs?=-x+e_c-f)$ldQl9KhUOt8qx@A4(j zs=@xC*Qz?Q&V|1V`d7BcZeYZHYq;o^Oh`)*9ZG z1_wa{u+Lt!@^R}}koxi4BW^$ZG5HT^BW-?%qOWty?H*ZxY$uPWtSuyL|X8InRHDNBK*XUS*69JXs)e5}Dz4Bnj} z*K#GL?~J&sP26wM<}>&L)cE?TxNfNg8s>N4F42wq+h^p12W$29xrmcK>G2BYjk98{clYDV9zx^{@MZegy63tG)N~&1KyK@H@N?%b_>ELC~A+_AKv~d-UINel02SQpA0WKbHL; zKh3>`KCZ>HD&!jX<$jzTN?B8o)STRYw^r9teJ(FHE8-%J1Me?U?weBo0eAs4?h)QQ z?`O`D;nZI^?uYu&=7%ya0pd-P@5-`Mw|stTF2|$zHOc+@w`lhsNQAN<8^vUMzy4#U z*|Cw{6!wRxL4BV2lxrJKf*!Rg?9OsbsZ$_M_yWgq~=9jcf7hB52Sua zxD3?GtGOhFUZw0k_#VE7_lawjk9CvJWf}e<+md%8?qR%goHvtD%5UYJ5zrj8pO5w4 z!Ia$#FTzB49%}tq#x(@#gX77o(a&~0kG;q70)9=}&+pJy`}uhMrS)?+@3;M&!27Q8 zF2(nUIDg9>_tywMwCu^0T@G>_-4~ZUtLr}Ceu|%OsWyP=?sxhUbiR4?SW|3S%oHu7zp8 zE7SLY{XpA$d-i+phvv0U(7p}rb$il?=`EoZ=y;L#a(zYK_tiRE$~L7Lh4hp3mG-yf zx^GM4?ehQNjeWuX*m&C!PZzihba`mJNy_eoQE+*^GVUI78*|z(4~<#+GlhSs@sFj= z^Y9|%_s6T0EPy4@eG8vz`eRYPdsW0eg;&p$^55&4Jsy?-=;x2{{oVJvCh)#&y!!h| zvs>lXcfb6%?Z4zhWO`}Oucq*RV7&R?`?T?jPt%UR_nF4~HC|1tnb!^Q6UcbIh=2Ul zBKa}kongE2zB=MIoA&FOtF2ItdXl95OWD6%d2MIMXLYtalHzzOG|j~!zl*sCj=hZM zmA~Oh;Hham^1Fb)LQUhDUy5f>A5Rj`F~%eBuaIR_8;|zOlR>xz-(QiY{VBB9_4rWQ z$?p(<1ky9wud*IXIE{ULM@w$Tt@f3!6B)eSjkg8$<(=C4{`!1xYwvBl1F!p%`&(vy zWjX4yl=zId;BwS{i{W{|#HYV+D$BCae2ZI>OfPM|<9Mf=_^emj|K0c!c-}Md<-ga< zc(Thy+>-w4y~`f?q3B)M!~ zFJ>@K%$kC6^uG7@TU^BJUJCcAy`JjUL|k3`x*b&i=f?llKlI!EY2xdMJJrNrv#8h& zsLMW-T;ty@SdT)3DZ3Y*g-2lm*fEju+i;10+xfy;#+!*hO`DbQC8)od_t!03>>5Ek zh{H)>{cdw`JS6d}Kl2U88~9^EAGix>b2VHC>c7_erOI>SB+Ve7Eq~Yk^FFyf&&lfb z)yz8X%NhUMv{?rmKuofH^*%yzaj~lelB!Go7jC)6pIjetdokm&Y;BH9sDA`B0Wn;P zw?{B7dpz4(e5Cf07x2nCZ1%p~cRcTfSI5h_)b9gVfqL)p-rFg=2P8ctc>%AEl?>iy zc;ngH%ro_u!H=L`9fv2CD|Q#bop3Y6SZ?+GvWxpX#&%rdjcwxi0k3X{CsY4rcn{QD zGr!`4Q}jAkWGs@lD_yYPk36`X1ZN{U76%_jDaZn?pdo<;}S8v*lhqYx`r+ z{Ox-j?-zLM_y&jJI{`WyZ*}jzld?x)HcSzSG411Ak?+uY+cL%%%V_^nZ_i*Fx>*J1>i@MM8>w2=5HWi}9t~#iHk@p`%*~!oe4xmAM za(#A2#>XP>*L6jj#mh(CX8by?FQUy*xChigQIFq|ju_UIIz4k@**r0|zNHn&`x z)21DC0Etxkf45-RhAyS-Y8U{~)3(3A75DCK%e6(+)imB)Xfp<$0FAqg_e%KT%ESvh zK^3rLrft5P`tjqUt|5L+&1rKAbO0UCeri!K${q&0KEzIly5^?6{0{9T>P!Yn*CEmN z8jF<2Y1i7cdye`u;Wd!@{Y|^~DATqX+I6Izj*~S^tFUXas|V5_(oVLrXF@C*|_6lu|smit+)c2-z3^cU0uBM zvbC8<>R$jafX02Z_pYtZ_7u+8oqmG@U>31vAkDFm`z7d?yIFtk^ZUEZxl#8p{+Rc_ zO`DHkHK>2N_y0;+`8_yJfQnEVy7AnaUc1`h{rb$7D3j+!-G>GIwP>sU%-{68UxWCq zKX!i9eT84QFHP~D3g?6N`vt+gg&v^nX?P3LPzhhmJKOtQuG7kKSLTAKYtTG5-d9k6 zE&K@T9p}AcIKPp!+n&X47qI)$TfA4tda_H@oq|`#;a6#%*P%^qQ17!@n+qLDS>;!Q z|LjTL>eAd8m+hb=8H3sHk>l-xSNCsnpT7m|TNFi z_cVOx!{x@ySJEYg?xidR<6*_%GTV7a`hHMv8t*FwyfciqCW;+-=j3@4-JG(p&l|rm>Mm}P>)+ATp9n94F1J^_cQIw3!$w#Ky4{xL z)op7qhP59uc<(b_xpq@#FPs81FWZf--ka?W|Bqa&v+;^sl6qbDsC&kE!}xZGeT|pL zk|bsC%O62`Gm!i8TWSUSM)CE{i#Lh)HRD~3pe6148gJiVlbAgokq?;7v=8MEvz;56 z=Z#$yb-x*}{0_&@w5zmtt{=8|ul^3l=}gQ29gbCb-VELv$K{q=FWTG*BaN5S5=o)S zl)VVALfyIBANN)HZTsbx>=AW`4@2^jsJj`jZtpu&e*laC-CkBI3F56D z-K+RD-A$X(@F+<4%6L06@E47z>^ac!AZ=2#|A_Xw{hG=24`C%}d}sOirqtwo9jfnJ z?7k=e4Q3FN?nmeN_+%TV#{urzs9SIR9cbGd`hoWAEkW?1QIw5?X)qb)%;etKAHh7w zeXiHc(s+xH&y9nZslOOL1ob}ey{jnO0Fr){+>BdUCnV{5mb@BPAuk$b-L zmc02-4B-6DcsI}{RIAt>1?uIoRY{@uDEkD~!Ixn7XCw2x@f)LV1m61DrhG59cCkAV zE&}ylCO01OE~G32zrqhtg%MW^q(2+_T)rE;cZ%o8Z;HC!Ez7uAwkf}Zw?D^gFb}j} zU&Jfd;g{9H2{#^C>}o+hC@xdvszZzl^T_2h>~TY4MAWUsul-!BF4t?|e9*Y($RGIU zQT9H32^o-aHmWSgW}I)1BNw-hv)H{+cgP93xOY3K*c}WlLA@KicQ|FE;VBpgwx4Si z2VQxeD0>`uU(~fQ-gl_K28!$Dy#1tOi1%vBZi3-(2UzdOJa23i=jC{{AGkH@7SLuP zXuJ)BE%~b;SJ84D1DJ;BD?H_w~Kd#CXp zK>gET1gN)#_nvkL$M(6&3LO&|3Ekx)SL9)qbX|zl1?MH@rqN@wsAH(>fSNl4%F`k zJwUx--7LjDxth__Gr}YW4u38zoY^8J3+m7dv8t34u+=C z5UjUWp4X+K?r7s}N&U8P2B>$2_jaPJJ4m{W+eFfZQZV^P=3c*BQr%mJr^dTaAs4=E(y!+4$YCGZZ2SI6%ydEWTgsJjEN zp7;Mw{ap{|I1=R@DPslgjKrG8OE)>DC*m*bnW{c)uH&fT7r%kSLPBA4H} zv-|pP-mUw3>AWQV`Nl8zGY_KeA)s+z;r&uy(~jTIKpfen0Oz+S~-%A0K$H{(jyQOe^&Jc_Z`P1e3;pxbZ(j+nF#6 zv_G;B9ufDulr4u0JkxCZz8;t7j*XAHlkoP-&NA=Iqs<>s_K2Lf7zHU*g|ZkN0(D>x zu0`Ir!spwLuO~!Z!o=H%`YoXqXuP$&wb}NHO3FXWsJ|N4fTT%`xhCYhaY?B+vFSA=-CjP*xsasTvr$*( zq}=@P(wO7@XUe#8lY{3mWSs~OTU}@`rX2{98ju&-4(oN8*mF_0J6_#RsDCXC zf_$$$r}Zf1PeA^2TFvsjvFBMIjCUGs=D-rj_pYVvN7xD%}NxTw=Ch3>IntxgUGk7bWoa@iepK(t3;?(Vz6Ta=dGQBi!d>Yro z@#^`?0rcB3a0y7fPt#ouf*?a_%07Va;A7ykm@M<6NwY1D1P-#Gg}?yu42F?bxrpQhUV-hbo?9J_&} zbI7|uE1Vs@SL0u0`X{zB>WWUytuL3*=61Lf)c-~hN+@z7&nAPUW5`c{9=Q9%aK^U! zqSNH2zt`cvsLo-WLyIlK6x0`5pznj^5vyytMT(iT42G?Lqyaa1Th_ui@48 z=G#`B|HHW_F%2q%e2;YkanB&`slI<~+{q2xe=z|^m!fu*ZK)Mp8;@^{x))7ceVBGD3mI9xwW+U9g14#{OXv-ly>05HHb>oRPL|ZXQ{2N4=w|$m6rMc61e=*+GY~AHITQ4sQlxEx=9xY2k^{Q4))tKUqyq-tEBvtvN}LyvzFKQVrdSDpux zXT63PZ$e%tp2&X=$Be6g^c+rnOVpiX;vG($4?xPqE8(&_W&8I@ z%Abd4!1hC5KlZlu1Kul)_eJX4-;dUK#VhZJm@hukj($Hnh4)V5?ZZPti)gzPbe!3E zZ(@3eX}6QxcyGyzH;s3U>EEwtQ?3o`J;?ee=d{fwK;j*B3fEU*k5hSmg?t_y&&vQu z;#|ZGP4I5JU5J$}ah=-cmfzE~oei&n`ak!6$ug8nT1~!I{;r+dck7t5{xtrpjei4e z-X6hsYRJ|9Yu4yOyPd{14I~{z-cbJj3%@?^kSH$Uz5CL$&W(Vkv}q0PK~8T!qJMUg zi9D8YA!U7_AIR~6zN@*%E=AkkR~ai;;-2w7X(aE}97z2;Kz+MXPIvz0?@bQEr+p#0 zyjL@Ucd6-z2k?!9i6C<^YeK5hhwU0A+uR1-q{M7rg@yhw< zj=b~oyovH9?#=?<^~M{|YDvi*3q{RJ!SJUs*-{W-dtwCOY6dg_3 zNucR;{#JJ)TH^L=mm3EinRYSs1dY$H2ifC?Yblo`?_*bo&a>oS`D3aK-sAA<@=DU~ zUU;B@_X*0L1xeE@a$kz&lVCwiVfNI0n16;dSyJK>cs0F9yEkDe$a+?WfBe+qwUqq^ z<=bulj6p5@@d_pGZsVy+ogdh~)FNjnWj%iUmu)~|jF{pjalClo~&NthM0aBN4uHuGN^Zn_kKp% zTKFFFpA%cfa<}~u+r7liHQueX37y4tZcy)+-dl~bnjoq7`;1F-e4z1a|0eN%S-@M@ zc()jDqrd6R;4ObV0EOJ6+3c#!7?U5yfVjq#pM{mbDxP;XoB9Z%Ww zFc)3|>pecto7k(w-G?_8v~{bf|0Dbi>OInXtDVhq14(trZ9nL8i?R*N9^39+;wIzO z^|%4`n?Y+(?!@0 zYP^{k$BTG1$#(oU+6)HSBFlD>pL_V*+uIHJCBf6OQ64LA+JSZ%!3CeJ^ji7Tbr8e~$MH+G)IZBmKMk2i@Jf2^MsxXo`$N89NkymA$Y0NZt@wz3h>e+ve zyAy3S?w(BkyK(D&Es3`&UfI5Pr+sI910V(3&-y;R4U}z#YUgu38m3I)IpC^6KX)Ym zXl#*_?L_vzdOgnj3dDOX?KIw-`Qz`#tK%Ypcbbp4AMqZCuMgY>8t;qp0gQ|Jlzjl} zU=_5vneXEHc&C!f?=9S&i)7S>bOYY-GVnpKndDcz;_Uw4;n9r zUy?%eDf<96!WSU@yUEAvs&TyT$3#!ozgUA3SN9w`z$aPn4otAk0-1doZ;i?SasT3N zk5|qoos(@sdLOP*xWt{nh&}^!U^@EOCqQ#;7}%erQ0uf$$Kh z*PkzhPVd5f61WMjg9Xg{3RzwRwSio=^ZLwRrb&tWDz6_#)8v61U ziHmf~jfb)Lo`GkL*B@6Fy-3*`u%%XTJjutoB<=U7y`D!dVER({6m))Xm5TJ^I?8^6 zvR%0rOm4p$Re!f&e)T*ugZB))vV7VwgHhTvfFnS?HM3e5x`VR&U?PkKSzqJ$WWUpf zd=GQ}kUYA?-C*Wd#{WySnGM>Ha(wf5`|(`-lG1n|@$o)O(X042z%Jc#@t&Ej$@NFd z`oLXqD<0bB$0`WdeJB{}oyni=d-M+ZyC2pgScYoITY53Mb#S3%s z-st1KlCm4&VYnB1e9k==zt34jyt1Fv@t-`t#Fd7gZ80)DLWV>HIlrP zwN!5+qu9?HMI|Tb)7gfbNYNmsElq> zC@DfR65UBcNKH!8MX7XAn38m(QWPcAO+^%v5RG(Ilxs;cbP=Kujzs_Gomp?Qnzl1v z=jXqEp0l!MujjmH?X}ll`#Mfsck_7^9srH&r&N94c*>@Nq}h_^6ITrHSiCyE&1d;n z;dM~&O6!&T6<3IlbllavC$-Yi$BTNMIn;>xE8d!^x@H~qeu9f{PkWoEKJ%U2g?ogc z6*PjHWjL<`EeWb6xr}e+>Fd=Y);z~N(=L77(S+-J^Qp4{G~QS7($9S_Q}z}}+SP~W zs@Y&OuM6w~rce8HJFKMMM)(NS`)<-?d|yzu8zgnRgLk#JOnEnR-=V}RX*>I- zdJw_;6<+O6neW|@{itjO60i9F*Y|Ej@fMGy+o2la)PcGnkqxk3{^{FGtXE1QiAw^W z?V$6NINlImO$Vr3{0{E30+g<|==GG1hpC|3ko@f>Pv$tTWsbSS@hoAP)$lGzf0y|5 zyxbfqmkYJZG2c3I$a%RcEUV|` zB#!*f%f+aFR)=(ZoJrmN^tsyP`gfe3YOKPSNDQEDA;qC9`hdne-FoFb$4ivI z2J*cZ?s_}RdNtl~=Nxl#r}TQ;N}ccFM^Nt@)_agLUoR;&rjuL*$)`WW@Ycs$Gga3F zsdqAz1N8<`kbGxSRvRQ;LOz%nGxuxqe39G}6S+OdT!mNLw;{`42c1B@HLQ0GWs@KV z^8P#be9s8m4*Jf61m4k3ybGwa74ks6rz9gZzNU9EcZGZ5ZkUT}33Oo)SZ}==Z@gQM z`PymUNi6?7nBHlxobMs|rcyQ+UWY{>@#=g34_dFTw|I{na|S0MbUQBHhwF}TCTP5+ zt+zI1&$g6Nj`xK~p3izScQU>^-b<<54aPa%P|{?4-%$1^l<&)Y684lWYz~5qjs9|} zT;nypa+rsu$H^;LzAbbFjaSeA-A!2(9)^d&ecxwW>plGaZFtw?mHyyoh?>aq@4_xn zFJGS^$yfPqj-{XpTnchtu{%E5XAB^}kbQ-2Z;9SHWm(=iXPbcY;7pMA zmFvdR2kKg{w6DB_BHW+rWKO)=zSmPv+u=Anp5@oRT{7Yg4d6P7NBiFCcu%q3V`<+A z-anmqwSD_J-YV9cU;7Toh&O>ZzzN?_YTcNj_$I(4$NQx9K1bPNkhDy4kMXRb?GMp` z?BDRpyi(FCmfr?ngSPL7)>~`<`zVl9g?t1t>UCaOcamyPPxZ6-Am-6{b^NWx@|QzP zQ19!hsi*ID%KE`@xEI`bC)#$!XE(RSZZ{r^_PBx-!JD;~A&#RQ)hIiOlQ!RYx(0=|uf_I+N4mVP#EA#-3x2ug; zo~s&2xuneJs?@3N8^`;qZ3kICO1+8jDiq`Yh=*Ckz>~4)p4TKy_{2r`k>zPthXm+55Q9}0mQ4{4Y0;~wI7>N+~?Re?Ui}N zi_}>J>Rn~MwyBa?ws}Md?_G{}z;V1=6X!C=yE?ihQc4x#J#yi6C9%6R0 zk$N9F-ZdFs2{aJptXIBQqd%WZ%J#h)F}#cMhLTHj z-v_<}P~^UJ`+j1*btr2LH^a3c&)02ind-lJwjJcVdz1I{kKw)uyqY?({04aR{`7ch zk28v1IE3R^7z(wyr>+F+SpNRA$m5T3zPVd^{WlxRIT+{xy8g?heu-}iWeeaPcmrhK zJOA{QYl+RZUqvV7n5uYnJ6Ol^U&Ag?Z*A)>@&NBmgYs|^xa(<+_3C{lp~*R>wvAWb z|4^CbuYHYnwIhW zHgehjbf>I8+y{A;()*vr6;f@XeX9-sAI1BYZHK1lM^a}2yaO8VeW_pS+e_J>Q1U^p z^MbT*TO4v+(S_VSt}xSbOkuh3Y?H=YiFz9Ea6Zc~-Vq-0M(|cwF9FuV*A*r^-X~MP zv)Hecl^o9TBFOhwPPV>T${1?93cFzK+XZ@%cX354wKkemat`$V2pVkW`vnJ=$L+*ZvsCI~K2QKV@0| zY`75Aduq~Te61+E1-d~ekmH0({B7c^X>*xd$Z=SBc8;0hc;$RxKkD2A>P@}A$M}xr zd|(Xkvv~FR?m>LxVXot~>%&)a1kWZz9XK1@|JuIMxokf@((OBg0R%~uk5zj3^;;`;=C za=d!puF7cc4Th%B0A#z+d2#cMc8D&Z|K6GIXLqpt!>|x^z1i{5x0kX*aN-!oH5iO* z49w*ZidnC2$Dx;U%x!qJKU~Q24WTipSML|OhO!7qlKVrG*NujGZ^v=G_c`(2PQCkJ zD5zJrH+gT*1nZqj?w+Sfb~1h(?!PZ{-;Cp(&GPTS4p6V&hf?-o#xQ6AbwS#}R8IA; zk~Y_NFt0ElaJ(H@{sEW;>g5)ENxt2b$h<(k%lYhm>)n*i`#R@o9B+c|&pyI;Zh2e>*LdT2t2y5P(2<2wAch+J(0G$V`$InW^6K^V1m0^MZ;`RAZzv9# z@w#65+{>%+hTh0Aw>#cxi})@i#0|RD!T7M$_P4Dwxle5x+soTI=I>tV{vh`+lpfE1u}j+fDqhCm zW4eDKg7?L{(&JefoE4!8XuNv=LQTpp21)XMn*8oxh~xbfuWoM*sMiAInN;;^e`rbh z&DPtAJiql8UY=w2I`Q^k`F?OOxL#?8;gpSs$uN5m=Op%|@8cL;B{lx&coxHZT<`Sw zEBDDfO}%F!(<}GMyh8a>_>(&B@z@yaZEw$`n0L5;&GD|L&WG>?WP0WMdv{a57aklz zBRj|AQ>|C`^AWsPI$n8R;{f#vJ$ke^xx)BSg3si64c9wABi<<9TOIEr>g7`J#C*Kv z_)Pkq>s^`=Zw&7cydhbRREavn#uYISL1sJD;IoTB(q-gc{h_nA?}{Arl;f3l5ajQ4 zy{MA&hbyhO**|#o-sTYArA|96@54Ps)VUR0uk^Ell#PI~a5~RMyVpP0XS8n|@0X4@ zMxE#24aoFvplloL1bN?->phs!zR{IArdXeUzkL&UD>&YNt9{L?9Mb@=&e!+zH+DJ5 zHc6h@4uvOh9uy>%BKMk?+->_q1aAk&EAPJ%PNKT&)&6j@^~(Diy}UX;MDaf0cy-(< zPkq;$ZQMEQj3dXL1l}ol*$pOBLC2kX)~n-Acs1wW9dAL$o#xi7<4z3kr;fLv<4)U* zc;k3~a=Zl{ce-c9o4}jf_utGq-u|uqPz>)L$NO*fhdADxyVL#Q491&1 z>@)Xz>^E!i*(G*7Ybd!hf6(I=z3(lwF2|I|tMfDYu08kr_T1wO+f>O+zK_pqf2{NB zFy6Y3cRhPuVFS41B(miGSl#k@e%?6V=8pI3Aw`VPgugRCuY8`LH-YyyyqcP`{0(pu z$oWmVgfJoXVc~X^-2r-DQi?N1p2~Y z*h>H0XZxtXYHHsg-?5N92Bcp2L+)qAuiKZLCz?gQIUs+x_?uaODog#$cAhALcbVgr z^F+_#e8KT@`-h|>)>GzrBJEeYe~9AUEU|72vRvrn923GHlK&xH zL7iJ+80h-b`=;Kb>>DWgIP-X@M}KH(`$Q+3%lvdGbDhMd95WEF?kCP?`4-R()Y~)l zD}B#U7KdH12^Qg6VSOLlT;@3+a-5miLVt7Gqv#~w6$~eUdWTqVh_dP+Df4}Y+As9F zRQPkw>p0$8)VmV;fVT4}>%C+$_m06JxB=RO+s>uVOl>D_J4d(Wm_q&2_d(93&T?1< z>R)O7yPx3t14t_TBaz-oOYfBlA_zWpA3H}`G4F$Nu6tg<5sp#IyeKRAVR?NApg!@1y& zaV@Q1=dR+9?aVRPIq^56&h>C3=z6u6_k6cg)*B=ZB6qJpX!}U)a{VE+E5~%k8%{25 z%utqp8fJpV&EdKvU;n9`-v&vO$Y(=@STpZIokE+xWZOOTeU2I6w96aR*#zH!`j=V% zc~5b_A#{i9;Wlt%@9wlq^1A~ikRO;QXzD!)+AbTc|DmE>1EG8kECY93 znQGnACzID@@UC{en^=B3{0QpZYP}_2{K$Nk2TXN;Q=8>)g;AjG z@xApv@HFR_;1hTgR>FFG3G3W%^H*r=^3!cU|1HN{Ef28T^cQvfF`mf=4x^I$n@Oq9 ziq@d4K3oC1Pn7;qyBhuC_Z%|}kM6gwVwszu9q8XbJ>~I5DVqe6o|e3F`aF&HHyy7- zc{yeR-cWLBo>OA^mtZld_x;pozO|Hn20y~r;9loxO^o7}ejMlT5C6e^DR}Ez?*W!C zF`d61)Vs}k%TrbjBwaw>374MF)_C>Zg^>e1&xBXk*QG4~!cOi%Cs*$e*4vJ(ow!ycK_j>Csx0Z84GuRJ84!C36FuUILdmo~B6OOkW%by30K-+<7 zxg_5+lr4uX@F6V1wZi&7wz-aLVdFQy;ni`W)J*QvgI1v4`>Z!Gi**GNXan+2>Dtv( z_a!tWmvyK2znkKIQ)6J-yPf4_F8?FBdM8-#LCSoyQ|nF6UwUm9E9kp2SB&7j46p7# zg48=1%7S{QS?@WNT?mrGl6!1#^8O1M#}at2b-ayO{#v*J)ccI}PN(d7ko1b=9^Q2} z-gpVW>4G#coOYP~(pT>N8Vj^+5xI5%FFUjrY3dcU>a;&YfUK?qI(xBs@b zUcFB#=J%Ud@anizo#mTA2T1D(z;Z2E%q+hI1}i}N5PPV$={@z%8K?N*k*AD##GHn-mH z&+*(eyaLZd(Q^u$QXuyiRU#MvA)K<_!sYy?$UUj;B7*ze`P{1l4}yB{wBB;hv#$h6 z*OFJNQP|Xl5+|qUZ?e55=O-2Y=2X0z+OvFD=mDaW<0skmao(=PU6c(5cVCu_(fQGd z-y0mn-S$Lx*a?cm{k$nlOWfH#46n1^??-|tbMS_et-|$Ed@JB@ z(Dn9gs>ytZUSOWHfUyUvLKoVyFSKO6MaiX^WxJ5|W~%wk4|uho-OKXJVEe+f_mK78 z_zLrR7_^w<35e9>UB4i{B{nZPr?A<>ijFn*n-dvJHQrB_;Djo#rRPs`WTL~kBR|$r zz70NrO(0{$o?PZNEHk2Z>UZeANR|&Z^_yDwb-(dtcVo_eojE#ad%WlPrOq9E))CzC zr%aucdo`UXc`l%t-?YN3?Jmyaa*UZm_zkhF??1ITyqWFFs~Mw^@i zl0wb>rn3|GChF{jKS1N&XZ^L`;C(`HGh7R9+;wf-y1$FJ@SA%a?@*Q>2eUxEzgh2> zl>G+9m(qX8UGIPlZ{%vf8SAvi+0*EwtZ~{o^LnfF5B^KWdo0&m zL$~?Omw0vmbTx7GfqOyQS)Zf&m9j$ba7+pTC=KquZ>f#B0qy)J+qtC39e#89;I#j8 z>a>D>p#G7`B~#mD9_3Y6a9@plPVV}*I(}V`p>BS2hvUDRIyb^?pnfi`NlI?-Pf@-M zX2Lvh{blQ>)}_R+e$(A=CgRua@?GkD0l$IzS33U2E9HK3?jeKL;QH%Xzx!VJNDseR z>G%gz=Sg@Pw7>XLE7tcJWjo@vo(PCv1RE!1Y(P@w@#d(#LNM2N2pm`>FF69JeOzX9-Ekei@?tJg5xS!1Xuw zXrBcBYWPd09Hu^Xnm`NCexu{THI&@~lExB{>z1)glAdde_4S*J@s_aO+o*T)V?|6a z>%A8Zw>nGmRinJW_1-6W<$pe|H+TEZb&gl=FMNPH!yWH=)|<*wKeOFm7{c4#X@`;c zo`9!7)}zGRzsq}n1mM`5`H{$Y-P3w6GQA3#jv*Yoqotz~`< zr@`-~Xnm(W+Sqld?HujrH?QFh;gEC=buNP|K)pAlKJwj4Sw9#HL%}`I(Zzc8JV&Cx z-+buAJCo&Kg?B-{w_ERV@A4cu)Pbtt#yh}z56`m)`psUvdi>d%<-0%>w4Iq_OY*Ix zY#aOq-@`8;_clc6d(y^}t^3zldOS(o<2Q$#_9(rM=fvP*P`}>C*qgHZU>1yqsjvj+ zID39~h4srj3R>IkJv^A>g!|L+ze*k7dd5UhzrL^Namr@EW>^f%VZfJ#OsrArJF0eA z{{rTlhtD%c{pM2qy1oBIofF^V_z=`z(T=w_QFbRh0fS)#G`xuMmJ3nRJ}vpTZa`oFsp?pO?;#vxv2A4A^lp%NTIjQRS zbw3(<)Nf9SrpJN0)RE(f7Ub%G-o}3yW%q)l;pC5i>z6(wX*l;3s^3iTo0|Bw{U4*w ztMCS>|MHa5_Z4M7fF%D!V}6x?S3Y`7Kcf97`b`7;x*t7Aor)jxEGDSGxAialgnR0s zueUGxwU^htm znq1~EkxMvtKpS=^4^Q)(G5B;GJH#@@H__)nYKianWNqX7FJ+o4@NcjEruOw1-dT8c zzbV&6<(lUij`wftRj1_Hu8YR;E_1xq@m&hdK>z-j9arw6Y#2<3N8w3W(UM~d{_Z8T z?^JT>A9}7`et#(DH^qje`^WRtSpsi>wue4XxR$byLDCoG@}5W?bHyu3_HT0EbPR8K zywc7u5Z?}#KL9zK)813;c7HBqmq2T14)cj~DQqO>jpXt^yTk1~gY&C+HQmngcfr40S^V1A`j2c-!Nxri`W8Mjp z8j?$!&V4hrFG&5>={Ai&<2M~0Z&Q|U4;?|h?X7nTWpm(lcnOl{m5D7xjE%{~t?Md0 z*KdY6-Va!QCtS28?d@Q_r9Q_6BVh=1!4-uzcxPpJV+;LeiQ_G?mHif+0vhjp>#a{& zQ)mx2fXtnSU7Fgq#*w@6#$NQBPw?uv(3|BSTu{i|Pp;m3?6~#>Wpm**co7!j()R@{ zwcg9w*UFd{e~IyOXxh7qfGdc$0IzCG-cp zHIr+Z_hzwtKL*|@|{y~3um9lr>Q+OYm<7x}ZF~)l3Ttm|P8po%OcNfe541a)n zD_C#NHrgGkLq!;jOSi8P8Quim`|)c3t;Ol6R-os zAlvN_>pd~S`8tqPlia<=t6sg16Mx5VR^ZiCm*s1XFJc;!>v-^DN>%h8${vH6AkS;= zux+}JJhIYn5{~CBmXUjlR+3Bim-yl-PvH%eZGpT>sb^p1cSouJ8}&=tK)&MhJ@6Yy zHK{)*6=w4O{o-G7JPeudA1rxUs$a@DD*Ziy_ae?Wg{}8Q>ePcU==iVCdu^fYcR1^7 zu5Cg|knfGt^MW<4TaM%Jv-9H6dcS$y@i(PT2e=K?|4{08`#zxTH;`0(JAP=1GqW#= ze~9`w`ptI7e;#!%hen|O=dFJTWlw;lS>!K3Hh<(pKhHL&$AcBr*#Wyj{qI=+fF1Nv zkTi#U0kkFlvah83tMo59jvr>@PkiDxS2+GSb+*CRASPL_#q4@5yOZN6s1N5s7pHCd z+O`+>LlD{QH`DMoPDW$Qbu51y+yNT*dDigN=U zB;O{=z6VLalK%y6+vqkeZ8O8hANhjgDg5DNEhOJCuZD`CeopO5^0lU{3rOliJ_!D) z-^{lD=$C$TJAO^_T=wZGDuHhA@+rr(g)^VamO63jKSX`q-beF0C&3huNTgp_yYFer zo&!mX$i3!~y1mB}e)A+=9oOGvd3mqohvf2iGn{Cj@g*qx9wc?&WX#X<@5=u?w##zi zul(jk$1nE<$~}L1)D@HXJII2xYbs0q%ywU31n)|xJr3e4vzy~<(74B?RK6~h4TkCP z5R3;m?vf3T90R3Vd^_9u@bvy;8FexesczXJuWz%I_E+iQ2%?@e+^}~z&+3zdI`??#+KHvbJnDPC+EQ(|48b{erh(k z`V-dwIc48~q+iJYgjv%I9i9{E_Tu^@-}p^i+deJmcqP6|U3Vx?uIp8gYwA=!+cw=c_oj5zvcXz6Zfqwf8Sf2+9cPw(U7MC_j1}r z&##5Pjv(;Bu4$>{DFt(;e0+3CWFS;C{^DV+{^qEE`rKX6Ix!L-oLly-_k$kGKR{#^^@s0 zj(6}^P5qx~N}V=vE6DtdUt`WneOCM-$|k@pknbPtjxWJnaj^BihBx}V-#md&*Owee zzr^yd0IH;~Z_0PX_>}E9I)-ntr9j?$u>Ui@&x4>I4=+4721Uz2v0B=6}=;GKt8`^8Q8dO{!2cyF-r4x#K} zkn}jYTr=pE;gmj+ypO$Tz^uiqe;yWtdiA~c>nYm=J762=_$V<(tzXCVXt99# z(rJeuWO+CU5~i%TvZ-b&?EjVbU4r@~?ojc7+3UnrfzNBf`Ji#>^8mL}b|>5q13~`Y z81cw?g!vh9g?s^X=IHb|Gn(a}g6W{%y%GTZ|9i@Qhrn-adr+?(b4HNAcfIw>dYADa zTq0oFIo>l^{sOod)ay_Ey}tJ-`xSh@b8enou0w@lDepnYEB!xqe8B8%w?jLY9|Xfdy|t}(J!P9=59|VYpV;6={LO5y zW5}gFwEu^41LiWkA!$KUsXrL2p(?2Na_enLS$pUWU0`XA^gjHc_3HPogi8j@^>}q0 zpTxz8`=~P#)O(fnrhcFw)U&Sksbhb-HHgw6Ps{66Gfd@d>L z_aWmw*YWy^W#{|%THcy&Kql)3e`p+(Gd z_B|aMFDl=eICJ@2l6=ppJ9pQ%(0&oa+r{zT$=Ep%27?=~cx&Um)W$oW&-3$!N(IaV zj`!bspGFw(0>@je8@JlQldPZ2c#{oaf5_+g#T&!B7O#%uSMqnZhVCHVqI5d@nQsPV zFTiqm9pc;wQkDKD<63RokL4PheE(jobijP<#Ji2<_rlMhUM?|8^2zmwVt-1hF-^G1 z*WEsJy{)$A%|a&z%r?BClr$Nid|%hef2F)t$^XflY~RxYrh((F$@29e4C>YMg=5c_Os1ebvu??lHd>n%|^!25vG z`=bcUOF!#Qu3kOwIGnOaVJ1w06}WUBvC(?Jr#~E!ea0C96BwKBzb~=;oA5TM_fi}0 zXO!&#N#B#Z?V#J7v_o|-bTU#JS@!S#k5Z*sj|5HO$MWjB>fm$7^cxCYd#+i^F_`ojo_ zLQ7nF?Vzpo%66RG-s%R-4^F(3SbhdP1M1c7_$|uTf~1Y)ZoKYxEb)df446ZBHNA8K z$7Iym22xrQjs3Lnx0K~oN?lt^Q166s>3LnhND*_8&x;gG#Uu5mr=*9!&nlPCo?tms zIXy2QWB<;>^Mi{5=6uI{B6Vs&J;yuSdT*ty2MmA)>xmL?UJ=g6a_~7d!yCst6K^P0 z*E~#}74QuZYVz-V&3d;KFJ|^ZEnhKn0-OSS@R_EmK2*x)avz(l8%eRt0;c%*^gOHs zb$Y`F_-~U!EKLO)~)Z02sa3rlkwI~)iv{2{tb8sXi3w8>UMrt z{6osN!8cHwd+y}?Wt&sEwqc!r(U(G(2TV;T&d$t-_p#}ByS7X8$^h>{OM8E3`3k3U{^z)~x3l$LKzS+3B^BOrF5kV~noM@|DsDqNj1-EKpT0_Gj+v56$pMSRu_+JO9Ksn;;|k#7ZM z8(|M@fv>?`PaoTUrN??wE!u?nJ$~)4e^4iIJbyE&{}Jo&PFWOY!#H>fcHrD^+p=gg zyS>dVY$}7KNV9;s^wIQo{5o~kKmv3MwXX%Gj<|ZukIInQ8ox94I`h3OUG?pPiNzl@il>W1zv6MF)TkFUI1;6MK<2S ze)a|MI!u9?Am`(2f12u7F&nen-r-gppYY(S?r*-KPWeDFb1A6*koA8`+1F4d$k+h^ z*oZR$GG^vkfA1OW7i@dSZs2$Vza3-D)zs+*cZ2%tr@EnU9A#5sASqRgYawnyiT2!uo1M~8(aT(l>G_^Vb?dQ{gCu)an7~w=X6ZIk?q6r=HwPL zC&KBV-saYO5oK3EbJ)`HNbi~qZxrvhj`wEjbc3Ft?V<0Zm`&M>AZZ!-d-CtfM~`#v z`ZPBOOmJely|+;3TlfJq?#FH1)!C_B09Qd6+-rKfZQSzxt(QyxZW}Q5@M=4EVEMaY zAZXkRt+&H}*ssDA7!HqsyaT#S3+AO<7ph7wZGJ@D9RsEp{*uYR)|hS7*$;W3e!X8= z7O8zgG1CYxf-t!4GQj$EP9V!C@DF$VZK*RF#)7sBw~$Hlo%Ub0cen~JgO7Qkv!1_Q zV%>WGe5`Z8yy3LVEiB&)`hv#Y*Lt6&Y%xfRldq9~SI&QZhPnjI7RUb~b+*Gdp#I6$ zpHr%sISC|%$g9e~v-$4`m_HqVE$S?yV_!+G{$6 z>ihs^xJjp1GFcw4Z1C+G(1-Dkb>e&!*RkAMe992xKK z46nH_VBUAUW2y5DJP+zUXuUP*Gw)FTE|k6I$m6ZN3~vPQF2}3=`2)wh*Uq0(`qa;C z{W*%aqlfns$Gfip-WcA49^TI!?@tBr#_|4la=JfgJAC1Ie=dMGfw!9D{R-b6_{H)5 zV!iS`y{GeVSCMk`8JV;?{kKHRBgg&l{Q=%(myS0`9eHl{G;-|^`>j{T{pyrU`iMEB z>rIW$>G3&+x3}ZfcBtie4-}vs;&?|n-t+NY1`QqWpVr%$vTH$7<1R<`-^_STG+<_X zcyDsN2Mgd0<9*Y^+s^U+RRC`k?`Iy~TOIG;1@Ol4{^a59?063qz-xwZ-1bDepXqw* z>UfhksxbZ@%X$mrt?YQUpWW$r3)%T>vLo0Z*~Xm+-g+M1-j26$0lZPXtsSqnLqEq` z#CngV9pZR#R z7cqhNdk^m_$D3OKuX!NAyGhgAvAz%CUB~+$4{z4@A>f_i?2mQc`o7~m!NZ$%-io)3 z6Yq!kw!<#R`(Nvo?@j%ga!J{~H#LTLv=i?~0b~A5w_#l0b-W8X{;E%%%Ru+@6*J-$?^`UF zpEraz;^Do*@m4B;H;i|HgOe8Qw7Wc4pr9+&H6sBX}n`UTueK9B-8j@Bh*c zQM}K2c&~H3XB5C2!@JtUd!ys6S^#ex@0T9lTO9A11@I>D9`x{baJekzzvY{Ypq~!T*7h$~BJiL!M-m?nejpA+K;eFKco?QTM9PiB@-p3s; zuP~J4JC=4Z!vowKeRTUi>3C}tz#GQN4cc6lIPPO5_sQoyc+NOj+fVYN%9>_yrG9U&+T}%|9nyf-@D3I*^+@DBCx-r{&G7Qh?DJH^A>!SPlqfH#JBiHG+# z$6L7o-ZYE0lXo+WgM>_f8XtR z^*XCN?qoau4&yz?@#=nKpyTB$C?p-z`MD_GD;#ed_UiZIj5^-4JlbIdpXWCQ$MD|b zcy&HC+VR%1-eZ~fB=GikyxI<99q)MsXot`k=E06vphnC z4UG+$!H!pt=Ms*$t@R$u@mvJ&V;~`rgW9$K^+9 zK9l=Z-0fm+#&(gwTix+q$NeiI>Qw~U0%W{=*~Tm04t!pV&pMNzO>Qcu$ICStZdu-p z=YAr`ujef|L*v8f4Yvk z+8(Q{|5*0_VZ1XOuO26DaJ+dL?IH1GJFbi1UE+9k-u98>{lmkXZQd5e`@Z9q`vNxM z+~#->Sg+m}u#e9&$Kx^?ZJfZn)A4G&e>z_M9)slius^cJYbJ0%rsF+?uT%w|Spw}B zf7y8DKAakqUkq{|&iUlV=@)e~VwMmh`2RCKy?yI>!3NaTeo;jJ!FF;i=LO?XSw03Y zg0_P`pS+Q>t?&o@1Z{A2fyvy9IU>Uwc|2flbG*eXa_=S#2KC;a`rCa~Dsg=Z8o_0- zBW}!O>zkY5jXlBhsE)TM%MXA-p#9=G>y_+&$|VgW9|`*WhR!P_KYXts%O&uS!yl4L zq_NbQ4+}x#K0Wo3ug_VuFT8tpF|!=1w&M8(*hqV9CKtCn+a%BZnoS(v%uL^x`tCX0 z_x4E<^9i|nQ@2YP-)73TgCzN0%KYvhjo`h-@qS0WlRn`)X&}@4t2k?1|J0H;~kuJU?$7Z(vrs{|;jLhhQ{hddE^W1tiTR&(E9K8Zc)# z-hV6J*cSnFrQ`j#`a@`2z_fR~|5pEv;T`CBpQqiHz=R2@_gc8y#Zt;wgQSh*`L%EO zOU}nT-p^Qm2keH-^|pty-yxZ5=I>45ebMm_SjKyo?ki%xns;=(J1IL3pQIDAc%uo9 zKOAo{PLB!YxsN_G-lWj}kk9jLhdAC{{|{dC703It)7!0O_8#laHf=JK&-3$!@m}qC|E=vJj<=iR{kQsW zWP892bG&WnKhNFCJKUxoJ^o%y+g@qgw*`5A?U2CxwBx;=#Z|oy+P6- z^8CE<9o*;bct_^&o@P>DBz1i_jB#s!&g3Ng5Qnm;r zy+NK|JA}Rom=e#Vx3?86zY*j+D>A(wQ=R}xyUFwQ?hcp=jyKzW=x6KwBa1hI_hP*I zd`~0B^TOxy%qU1?IZ_K9u z-kpN1w4vS<~Jq-c@+@xv!}#FYgteL$2-6A!*|M z_LMCLN$be}>AA1u`y{^)n6EtI{m}6avfg8g7jN-7N5{Lx@#^>W98g<5sp#9<# z>;IFoob%+ja?PJyz6YajYu+`=@tm|rTb^IkxTAYH|ASZ4=`1h%=JUzrb{C18$IT@b zZcNz?;IGX0iQr78ee_rA>$ni%^J~}g&RBAd>-*G_zTuQT0khyvIYt=BacUs-zR$+Q zC$Z`FmB3qg?$O=_j+aM}CFSdFli`j3#QoBacP+jzVY}lklxhxNvD!Q%4%MLwC(UKM z-3Jn9mke*{mw>s?dc!o_dDLkI*MqDHX~$C5JDjqoVFfIPx8P%6Av3@_N06Vw^Q+nx z@<+yg<+%zc?)RwkC!AU*?Z43a`Xd_JiAZ*I4)AzI%}IVP4u>`hsHSTxbT`F7~w*zSk&Q3A^DV z_#EV2s8z2k%yVS)VRDII`>w9EKhAK6iw8}~XVdNS z2h0EGBA#6Z^{%zv_LOyl`=JlG?cM46BikhA3z`~^cO1*lfrX&n^2uI%^S!23SLdq z@U6Xz?@l7u@v=}EIpz%GI?oa=gH-@*m_#33f<@ejZ?mPFAV&)RK z8Ja+A_?UjI?|4brJ}u`+OYbMi!)pgC!N`n?Fhu#9|Pz#(#tPadHs`A)sGm^lX|T}Zy3`trRz;?k7M_S~EJ z%qc-r6K~z*(#BlQ^4CBIQ13OV&wRZp8wF3nW3UoA<*h@6k=18Z=kq4O#E= zEdMra1&K`lZk=zR5@vr5&7dAMgt<*w32h3S-Lz?0a*12MS3;jpkCqRbvG{c!)15kd zIZo(Lu5tIVaX&!WBOqz^AiR~+-$kzNq5JLx-l>jPu4BqGCXYGZ;nthVQa`gjhhk0( znin1K6nyhwx#Jyey~kh1b_JKh1t9O97)%?;yC=rjw$OM@1^UJF>2`>)d|!xywzIw$ z?ODoRhfiP?ybm%*+G?G9GTp=zsTefZ#C=m?Gn&3E@0S|I7!f%qXx_%F=^2(^*1U*$ zkz6hZN`F3uk2#($@g`+!U<1fLZ!R0AyrZ`{PVH}!x8?uicz4-&#r-LDcEAsy@zzNF zT3^l;Tw{T=p)y3Muisw&??xU>uHNR>`v_%EijOo?@_f9}bA#qmyrJaM@}73iL&H)~ zZyW16>%ZWWEUJ>zknv~O+3AE$j6vHUvN0P5v+WRiS8 zQT7)|D%L3f`9`cx&@6G<;X|H9ljFVs_0;>J^;V?pJdiZ$VCs7w{_*_B`9ZVEdgXbG z`qXO;Z9u)-tT#&86YwI;138`?Ouuc+_BMuGzUM)=V-Tm-eijdwn-2M}nyk$OSX6t5i2=Q~QGC(jQ`YPv#vI60gkrF2;8gv;&Q| zs*QIfWlz9s@I0J_uO3MMZA~uySL2N}2%3xK-4-@!e|VdE8m~NOm|y#L@`%@59yDF> zhVaIz{~kWW`=qv$YrL1(c+Y9dIR%Kowa^#eFp&M*RPye;$6UwB(3L?m*CXEU)YEw7 z{cQQgyVN7zDBe$P`xf^ZGXP%<=7Gk`E?1JTMKk8KFb}4~dVC3(OuR+g7B-KtKR!Hv zXc07_7mse=E!5L^shV%Rt#M}dhwxQFa|>SCUxbNw7rwusQ1f)WBW%3$Dfm^rA2cu6cn46wD!%&A0JMF#+jxgk zHU(aV1+b?q`x_hYW^y^tcsSlRLGz(UyvwMk@$SqL?{2SnZw#73FQwX7<{#_ueFZx~ z8+Ai}yFY zHHmlO3G6TM{RAhrOdr2=v+es)E6%rF%W(j7h2Ag>XACwH^B(ev^x;XM$BCw2&~$tG z=zg)0x*B(nEOF0ocXYpq;C%|Oj1zwP)mD6e!XeOpai;u(eo>`0=jY*SXaw?|TuX6E zJ8vYHaagyz*npr}=@IV@)YEvYqD~b07eDb~WpO9<3@7Z{LZ8+Brb>M7}?X59R=?`tm zkLV8%2hGhM@m@kbjdw$qc)NSVYaR)jhitqdnyd-F_RtYD-kmnyH!1rTPPviy)x%(X z6K%Xp$lZBFWCHtpk9aFkPvhk)V)O04YdqqO<4xFjxqZT%gRdbp295Vb{tlAw4$20? zco+$t-YH}@+j#eoA2FUi#{Pcs(f#2G>S?@X@a8w39rTFTJRUS>f28bhD18(6KY-37q(AsO92swDGUqKl;w?u#jkijcc+29oZ~G4O zh}S$FG#}aa{T@*>e9yuQpz+>f+xNt_jLXmj>cfC93z_cah?n{EMBMJR(a_AG$$2&1 zAM`$f8>y%9wzKg{XOkq))w$P>W@W^?i2o1cy%4YThcM$qM|=a}UeI_SwDHcQ>^0Z` ztHC|4UxLd$u8+@Vd~o8`dF3YRX}k|*Y2P&&@yc;$=$W7yVdItK`tA7sfWJWF9dF}3 zg@&#M_2GPw{<|5c^xxg&?)H|L6Ex3w#Cs+6G~NkW;?47jH#|3JHh9F_3a`fd)c+7~ ziCd41*E}0EKYPU6(~0-#Eb*4XnYq11@P?M8`h$#TgYe0C_M{WijF$~M3**al0h zvR}g~#~Jm=-Tg&)e$X_+t4aIAkJQuleIZM{%{}6c;T>q>jnbe8@Lj})P#?5?<2K$o zl)VWF*bFk?X^T_(LoagoI4<%c^AeAE4^U6zU7jW0m`A*EysPlacqZq2i?`<(4ML#t z{%GU9kg_Jw5pIBm_~Ib#`!Ts3XUP0Pt}jPk4w~H_@phx0#=9>|ygR(&#asHdRJ`vJ zZ-0Cb!+6km^K85?QMMd5!$#PT&v0^6+P5URY;XD<;fYs*rXF5R+8+|s(|8YLi8q8Z zv;T${2hE)}-a32{*B*T3BOL#Lgt>+v#}`ljR$opBo`-{R5QPy?6K6w^eMWckdCVy_ zW~mjA2hB8(xEE7bBks`KLGzi7`y)il@ok2$K-;;Ujr;stIVOTTp))MS zw;rUOcaY2V7mYc*GH8mtesnuOKs}8&k|o|!osMqj7~Z;gWxr7k{aAd@!;7Ht4zTgA zqihp=4_|?Mezg*AcRy!V2h9y0@%}w>v3mzE%OMEc)L+g;~kMD-Yy>T#_+yx~cyI&5k51L;*;@v|%jdxO(ct?1}i?<@z-ep`{MZ9_V zf}NO`gT_1C#(ODct)V;I3NlVi##w?JcIJ}LclvL9L(nwAt4YU+!PL`u=Vgg^jYqtp zjX`sd-3_3H1=oKJ1e@FwR|c%QTF(3$#=;#&?MgSNw~wjKK3#(TZtWq1a5 z)hMmZ>tv63L)(I8wByzFUFi0-w~+NpyGhDi-*Yp($@Pu* zHM}8~e}MpV@SP6lgSNx9cuBs+lx>8)@HH&_t&mxQQ`Yx-@>ggFxt>{mI%Qu6&41ra zuQy%aCw57%@AfJ05$iiby-S>Wy1kr2J#D}1vb3MS^U>=&j<-8rS>L;$3ch*}2K_sG z*uS$CW$mCB+z#$|UlzAJ-Y2#P%_xs}2T)Jr?U^OsvpnJr?+BWg@ydC-Ed)Ib-)dL~ z(t>OFG1|u4>5gLNarhkGgHNCy&XzEMbu*ZJ3F}6$p-|mKeh8XhJ>o9hH68cES>j&r z5qBJKrMFV!sQjKFzRFMsw4Fb;ardF@ewYT2!&ZEIK+dZlv~HaT#Py^MH6`-5hYN4%|_cz?|jZ*z}$qj|d=Q`eA)@xV6 zQTxY+8D7~xn!>r}61?)K%6oh-#&-=|2igu}Z95F7>`7Pz^Fij_t#Qh6O&9Vbj?atc znhs99x?RMnr|mF4OFN9nh*!=p#qo~AEAv=M>+$V?-JtQ#wegnf$ruS$;m31}n$T70 z`@bezw~oJwV!7rc+YYtqnio*#dbkPH`=<3SpzH%U06)VLTsNmZcr?Y^>TRlI?)E%G;^+Hj#LP_$onFkS$C0pTF36r&G2X^58r88A{y2 zxBwD!U2?exL1UJ7js7RsG{vt;*I&82(sBQqCGG)uHD<{r?gZX}HtyN%-w)2HH-WPi_=0T}Gd`B7tA&zsijk#pk!sd;Pc8-+GH9vU7eL8hD?u)a; zT@!C+JIC>!ygb!EYSOT0{Th zX}{P^J&kv4mUw%4#2dvMalAUd?QpzftXF?`=KMdJ;g#_%hIb_15S5PS5C0Kg(Z0-| zK-=Lx+YX~Bdj{6R+b|Aa3}hQwLN5Jn$kfz*sOF4Z^Sl$Uw!^2?({|X9r5!eB#4FoJ z1n*WGZ-fB9#+L^NLF4`1#yjF}?%RU5U@`2*muKTG*)4URN#ad@AN*Ol=8#9co2jSq z{*fi#FwV?=7R7ru`vJMnA1Xo4VKdI%8QwzLhgmLs0rM67GS8G$bU^C9rK;rG9xq#eW6D~CqzHMb%IW>7_KVeA zyKBlh?|9u@bI`^u-~Zf|<%ht7px(EwcO7MWp!7i68S;qN-#yhY&LWS~&hj0Ba$PWd zNvt^N9C9)YEvs&Jyo9uXyoJ#w+V>44X|kd{;md(0I${$eJ>~ z2Phj0b0G$DKU557jPZRTxr}Rid=PDzYZiONyO4SsZ+X1=ZFg~xcoTTPwCx+>eAH5W zJKDM812*E@0VQ}&q-2jH=U3rox#lmAc-K)+QF)HGT2RxGCws_i|ne z&H-%?eeS6pWp~0b7!3Q*XT9OfWBtXg``kHp`)HMG>fudI{fwEw@=wB3px#cYU+J4i znWiQ3Z;$O+`*95KqmK7Ymj3|00dlqBJ zjk)GeygI&(V)<#X8Z_={)_XyeV;{H+Izl&y;ag~(ahvP5lC0J?*OXtC?k7)DCk~rH z<6dF?Wry&c?{E{efPMH(&(v{mNpgu>?n{*CTw?85k9b3=y5=sH9|8}9dcU{cmnmBY zAHZ5@{y-r!mvdj@3tR7nIPT+v9-sHXDf#E*{M} zE~o`9@lA%3r*R*A?^Mik43%_KFZx)n$-}Q{+QZxv26I8T#~pkukM_Rnc(-Kn?(y)N$8$|%5AUarcX}4@K@V>jZ!Zt;*N%5W7O%hG z(d`h$JK4kgqvIWx#aq_H8^;^>@E&ly_hj*&<>57xa?NfJZ}CUc{h?nLZ#@rh7;nin zRJ2L^*$IxfTNZC~4{sFj1s>k=jyICU+t$My$J@@sTg~y_oW0+=R4l3 zvUmr3c*A(-dw3f--X>YRV?4Z3ydQaZuX4OKvv{X^c;k2vczADeyeDPx&iC+|Cvwf{ z_5}#i)wG{=cDyHK@hfP3TcwaY#{lDY=o#ji8D%_A4Ae zo?|ld#<=wTEv>CrV~)?{ybU+<$oh*=|77Z10L?(XOy85=|^w#3D zOF&XXa=XR}YUDwPih?>1rHJ{VJd!c>{z4{;h&TT2YJ2~F;?|FLO|KxXW zqdR$S46ogPG^d}7&|*|Q#8EuDDDJ5!Q$pOC=ty)J8h?&?Vlt2CGrly=>>i=`E36g)GC;b$78!+;~+wIMu>`=nn{N$%c)=rj1c#3+iUQ|4~; zUex@o^E;AxPJF23Q^FQ}QO~}&Z?=ENLw?=Ql+NWo3|^CO$iEh?b!~DEl-(m@R!4L#Nw*)wG(-Iq1U3;{x!kAhS%}C0_fgo2XuEd{>%!Vk{s`x6Ut5- zW3sJeUO_Ynev+fX=qSoeMyH_G{yK@PG7B%rk8UAeGK=s`K3~%Bky+cnVJzskSTr7T z4;DnF&h9zn{{UTq8n695+?}t-PV`drLR9z8ZvxZZrG1J=kmKhM-iHRyN7n4sx(w`G2!}t z2U5=gE8txXuk83`?vZ3ByK!98P#v)?DBllN5ycLJXH|w3XiQrU{ zc*#o&i~c%KZ7h|;+cWSU#Phw^$-l=9j8)WlM+V+4rtv!!=*{RgXbE-=mF8Gy2v;$V zjJNp3f@q>^_YW;=MNjsq9WA1q=+xf@I6(V&gPUqc%{Hr5Z4P-~#{RrGF`^XSyBzOg z_{96R<6T2m?fCZso5E9` ztC~~hhq9LnqEDQ?+fz>Ox9&}7{Xah8&A*7a@#wXv`acJ!?Cl^MUuJ)OrE1*YO`c`w zm#EpN?|&kh^KPsYjYjW8Z$S^Hd}WRc{1)&7aYm z1<}mlhabuEEBQO!#B)5^?tMb(3Q`@i5BG7EWbG#I zK6EKsjxI)ZwwQWWGLELgr~a>OJLN0hEr>RLwdx%3DP?{}e?^U-P)y=rgGG-#vkU1##=p!drRvhw8Tny9CZ2DekgQ3ZfUCUs{vD zGkPRyepwNCKO*iobf??+&IH;P9SGl0bXMyqni06aXMEUsBU;Yq0`S|u)0;BG(21zo z-7I!{lvzmJ>*yEghp2wX#_prm1n%djC;M&bR|QeiB~`rZ$lqxOYb$EJdTkELJVM+@ z=pX1$XrDc6MNLQW-D_-aOQ^A8yyf2%M8n}V>3LLM{I})X-(I!;)=k!(yj_SpiF8{h zRi=XSH&EWj!QSLK6g?F+yXGYHnQMr<34IWqg+@hH`^~e#E*rzSRRz&P*WP`u&W{d3 zhaZ&ujfDyKKeqo&~SXtMuQ)@Z;e>`Fj}U@Q!o59r#V?ne+4F-<(d{dkJ6Q?hx$lydFQ; zep&o|LG-laP2Z1td;gRB(QUTwZo{ufvN zIPwfc&vfNmCggeJh`Srr-eteDS@IL_?Y&-A|AVAIjV?s3{(+(V9(Qo=M1A?_8*Xx&+Iab&#%yP(UZ{AQGJJQ4Rd69Yxa#xYuGpHWut$?Z{y^4 z${c?uzmtd>|1p98p}V=4pIwLF5ri8Zg7$#3B=9Z^q4lYXmAA@9eV10Br_fpGJXG(dFDgy!ej|j9=%Z~=N$Hl^=sNgwG2#qBnFjarIW21Z z?*E?|b3t=%niJxs?OxZTssL2~u<8lUN?nCFH zX1DFz&z_whJx07F{dX?q4~ea_xpvuTM|f>Ke$J}*G-aQ2ygSEC$$FSvM$t_DQLUn? z{V`#!+P910?d5o1gzp{neaCxi;9W`F&uA?7*Svn)7%zwSJjYv~{H@U<)ckN);5~!5 z;izOh;hFe#Xz;DsD_-3|RKIeNM29(0B_2 zZ#0j!4wW<~Jb0JCK2I~7b310E-<-W$lD`|eA8P(63cL>x_dF_DO86c+?v`4WzmseJ zsI-}UxlY+=(>JTe-73nodaw@9ZL0W>2>fRdHyWLRPC{=)^_{*kp)V(e@DMj&N_WXd z$2tDFlzAL2N6jyT1ApU(7(-}hbbC~5NdCFW=lNxU`@3+?t?1194X^DFy~(d}-Jj5S zhX>vZh$}@UmlN7PXZ}!l_f5$hFWEI4J?!kghWt07x1z>7KJYFh?o0F+^gC4ZaAiSa z@7!Q-PBO z`JAv`mv+rY-#NQSQ>F}^ftuanb)n1~#8se@<%GJQNI%cDF;co`HrnW|DnEZq{<@E_ z*Pv$i2f^+Gi8~fO2i5QO4@u6cm{z!hR#7-U}w8vYnKq7Pd|2J4CW5VMwh{x3%oy& zKl?bJH=^bb``m7?r+6lVb}Z)}g77Mv=sffpwC`x%+d(yFhK5j|T@B`$ha`7GHrmbcucOQ+PxF0d)cCn| zkYpYp?sfEM^mFtZv@iSF)WAC{gtivOrTS;1lLP+ zf`yDHbPPHHT@L4OXw-)9jE&*>3il(WZoMiyKO0Sk-{g79yo-K_s)d@T!xR3zpNMPl zeDZ8 z%|^rEwR6+I$$t-eA1Vg*SGR;J^Cxkey+~i6?a*S>`+P$1i`KsQyUmoZD9uK5oZbB> zGaM~NjsL{JAH7s3+8ixLw?lVEwLjh%cxQ#sY*+hAMrWh9JU?ZIqQg<+A07DT6SoAF zd_?%Au8aQach8?2n~nZ}-_BFtQs&sjd=C~Cll*ggLYXOgnf^vkMth=tQQxo2+_=$i zdq|3}$VR)qQ?(9`rOb_J8EXByDRm&3`-xkCN?s&vF}CVA{52jW`ucM809U*Y@wsAMz3wl(nDd!nURW~1?rcPsKAiuOg#AA1MhQsS;g z??ubdS!hSN?X$kFT+3$TR{doYv(f$V7YiWsDf2A42sOJ83;fH8TZ>BSyvn$QFa5jz zSFkqenPKi7NO2?VX7`5Y;pPzHrXplzy6&jn-1$=E;$ypMjo( znq5~0yPhNNHB?eTSkpfEd^m@dT$7EO@&cmqE+_wvOZdJ6YP=5w-l4>eLCer-=1X z%SOk*Z}Z|Q%H+S!nF2Nbt>Pz7Q6_IGzlVh$h3sTJLDxlpKd+-(x&Mbh7nkDPNtxeO?u{zH-yirJ5!W1* zY@x6Q?%Tp1SPJibj(02a>prF{p%}DYJQ{fW5jRkL$Y8=@x~_qHF5H^alCs;f(Myhh zG-dRj)-8lKUfv7*FBA8UIFT<2{d4c6NB{g&+-=~_-JXrUhS$c+cPjTLoTwON_aA|` zC2>WlWCy}sb$!`i*P=!6n%x!f*Lm-+{CiW@`1L(GB=cY4FPoW-iX8uu@D4x+IsSsc zKbg3jQOPXAxw_tf{bhG#qy6E}#ii&&%DjTUj+)=M4E&AX;yD#6DI#oJR;%*;IP?1< z_(p$grTETlRN{EIC;uMk-l*|*3A|H?yA74hCHy2 zPlP$7d=>CN2!BG6Jlj5qa=lRV%VmyVWhCo+zWqvAZ=-v%(JRjG!{Iv)Jpnbl$2;C3 z#7l+|UaIR2*j)<$a`*_hzH!@Fx^J7sA=+Qf>%p ze&0=oV1E)M|LV7AYkDs5toeOzHrmqr`oKR(IU!EV`P5eBx{-JzF0H1Wg z){-3KDA;Ugv{HC`JKm=#vkd(VHGf?mj7Q70cb9jb=E1 zkE6^|^ljAm7YF{G-(}vSk^=~j)OFEc$GM)t=vkel;(=`RytCi@auQ|D->s5k%isEC zM#}b*dD-YQXZMBhjYmI2&F*%A_m20tM@94AuM_=1_$xXOzC~!eHhgXtxOJ|#`CtA> zHfqF!3mfNWQ+71^;RjWAcMbfRkNJHT^wdx4M8}|GF6VPyv^U(#`Fu@dypsD(&aIC3 zyw7-cjlPST-NmuzqD=AUoYBy;(Bsfk(X}P`dvfwTW8lOTH|286veD)rR*moRl(`PQ z0X2U=80`M&sQl<&;wA52QLEbAl+6+whvo2gb-WKz?nU$!)a>SKjgrh7;%a}v@7JLP zXmeC!yoAkHoa2Js#;rmX@8B2sa{|atl-UpMi5fqz6-zSb6L%Rp1D%9UL-icf_@@Sb zJ=Zuh+=rCDmyIrU_Loy;=P!AO7&ZRJF@2P|WI5lzL-+oQa{$^2odxH!fp>Kc_7^Yb zxgh*DUecfcX+KKLhyOqL{I49|H=Ny9V#~GY&8YRKc=dU(%%4sCeQ5mMt)i;A+54(w ztW^5^D?SHtyyx=a!P1R*Z;h}f-cjMhh07H>UiGKMcysV>@=?|JdmLMyLl>hp@xDp? zN9en#=PgOuTMX|`@Y;U=1^HK@>rm@I?}v?7F#gc9c~7hbq30ePxGUeOrb!j>_j3H( zQl=BSCt4GKU*ZR%$D=2qp1-sP{*o2h=nUtV^C|OB^m0^w$uT~5Cqyzg688YQ0DTPg z+>_FN`8pe24{t6m8bvRVU!RA(Lnyn&+dE0iZ2vX$36&g0coOQLZzMhW=b!rSwtmY? zQt?eTx)*+?ZY&p2<`(oW)cD6INtxx}@SN~lzK4x&g?2*qolN^1vSq>cg`9)zJ(rSS zvQgWLT2bG?-)I%T$AI=m%`ZD86DRW=aqptFR>MnJ{4ds6RCbqy@J+b&{l?PYdHxTt z&BtbxX^FN*jkh$|9jcB_B<(oV@AGAWxAHmtAK7RzytzLj7 zBhWL@3(%GO@=P&sE)Jo7JI(f;()_}x;Nzu*RZW zqQAk}Xj0;nRw4Y(ojc1K7Dijc-y_(+H)T#i2cpK$Yd(@pr!|}*&`Id&=y_-dIJ*bl zJ|T?m;;fHK%Cm)0ANcKjbvtG5Lmx!V@0SPumx=ofU5P$(B#}i`>(wcN+t!t`!ouim zcn8L{@Eb0a+4M)=i$u-tiGlZ!pRgCb3%v}Tj1GZsLg2hHge|do*I;)^%fjdh$Nwc| zTK&xDT&VHaPnwvyj<`8!1^O)d7TW4+zH5tWEEb1Q{JWc9wkV8NIlpAq@)-!)2{nEm z$4D|GiJOQ%f=)qaqW&B=De#+bRH!`1xcQ`NyuU)3jgGG!eMM;e2Pq@`e-hW=7sc}Z zYQmPfE~@gq+91(6&Yp7?w=Rs@z_0apTz%FR$`qsBQRBDo3wK#ZJbE)a06hoQcW=wF zyUSKQf*{my+&}NeeergM(c$o$Z1*d^K|7<0)jAeFFU~uJIGdwolsk)ZHs1P?HW(d( znq40zq?vb#`vH~wNtpR9@oUp-l735CUA31fU&)SzQK{o^NtrHaSJe2!=c{$!BW@MC z>F-G$^$F+Q#H@h*i?-%o2rIaPv`koQt_0&2XwgzKo5`yiHAIa+eC;4JnYg>rH_?aC z1*pbDyK58PE+O>et@z-==tajrlreGts{H5+%Gx|XEooYOE=ex=o$D!lI0APg)cmc` zxJ%&u1YX^Iw$ui}Wp=rs6k-zlO@XLL{0 z_-*~}Puy_yYIF=b9`*0UEe`cm-aEjbJF+ku?(DyTGB2WEpvKQ@tCCDf-MZ14=nQlu zdIPF+xV;3PMNXU{Aekm_3N&I|7+rYMjLUs%}4cj?CXW^Nv;gs zc5h$Sw=lZT@wOoU4rphURl9I=&%k>SaYv&i=xyah7FCUx-_pFt6h==v-ZLmuie8DD zKSl=LJBgczEQjE51H+k}tRY$+hPmp5~@c%HTf_ zew+8!k6Ad(?tA_V{a6m~_0I05@NJ2J4>f<-ef-75jYTCNH{zVbwdc0+=lih?{w2=tYbbLQdN*qRcqG{U5^-;%E6@tm z`+9cD?$Q$qqi-DV&*X2+57#$AjW>KfCDZ)S{HR^{QTrVg7FEr2vsrU7{yy}Hg;BjP zs`~F+=2sWW?BRHMEGZ$SN`BkGJS>KHdw6X;8}HtZm)jr7UwCKnLo_;vn5_zJ?I?lw z5O}Ts^zQOrTX1jVc-iLu!mH=IHSt>CmBKry273>1ykFM9yFNddy=CxT4zEe+>HG~C zID4TIte?M%PiUIL^i2pCkYI=tZcF({IAL`Agz{K$|qI8`VY|qKg?n z6K3-Fgg7593uEaJ_G`NzDm%F_S_pqG@VBSTCL8m$c|sdc`ukl-<`ClgqLLE{^{gza zLz`S5*}YcDDTUDrc&&d1kbf9D0yVq)1>Wn3n~h2yB7739=`&A#eqg`%Qa+$CYD!1s z;!=DMhcd6DZ=q&)_-b}$C2>Eal0OJ#_i}vEt_HhHPc4l0fYg3$Q)PSP?z5?AY) z{HO@s2;Btr>rQlivY+n5=c;zUADvYgz3%uYz&#y(5;guS0>6UdjabXj1JFZsy>-5ay^YHX_%Cqwuc6GI@Ym;WsT+SI5r=V;BYtPJ2yKsg z{?Z!!Q*u#ZbPN2pkA2BLBK;Ayag%g!^?gj~p4)t5`$8$a4?Er-*n9+f6q@EehPYEu z$r*%y#~TeTjFvjyH!iNtcQ0#4pR-4%d1J!xkJA5+HwW*R@Y*?V2zHD{uSGp?bNqZa zaSx$Sq4&O4{d2fU!N+!QR0eN;_#(bcSwflj(a%tgpdBF({>}TIxcXVv@wUnNK>16D z6-JF+`9jinKrcnr|0;ikGSXc;7ILmZhoh1U3Fl(Ze6%;5`BV9F~vwLmeznZvP(Z|pS(Bbe+2;4IQ_aIw)rWHoJ!fWS+#pHh%{SY-? z`@YLs#WhRD$;O27?<)j88zXjB$W1TgvxKUC+>HEP(0x$j-6HHKClhxLT8a)uKZ8^6 zo{4jH;6I5oUje^yo4c_vIvQRZ*PXe)yn-^bP~+V`@Fwoy+(_E%sK0;6;#={Xk1OCk z&GG(7{#woHJJfi?{LM69SUajuyrc=?;H|6nCUHt^eJuNTVKf5X^@;NOv~u!a^&jN_ zBdS-gUbf!vf3&EVtJkjH??&cpl&_?#AIgu{BA&2SiqK5x-_Yb2iFY;$f&kST!ybzbNq9_*<63)-S5RBl+e377thTm)fZ~ zD{uM5(~fv)h0Cw@DX-->KUlry2jflG=Xrb2Pv#4BQQ99W@9QzU%7`x^e_yoN*)^E> zNyLpq*FI9kJD2!k;$%lh>Py>iyz*mB?OpT-c95wa+7VvOMag{fcOmSEuC9SsdA$90 ztx)TPtr4@}iG4)8`lURD&9CWlve!7pm(C~u8L!%H^~rxe-r8aO>+_H2^W#VTmcw>w z8TQ+FsHq*Q*Xl99i`UwbqrBOv@`|_dv?SPV*z7TE^=>GiuUGb1d5f1H+Yz5b+tJ?^ zZ}q9nR2Q%MlwUgTsjB?)i}$nfEF!)Od8PGIJROP4p%rd@RR8oKPMYNpgd5LP;s+8Z zEp|NCA93Aoepr0k|FYleRsR`(J=GV~_BCMTdZTo$`^K9C%U{-i;#GN{&*RmpbgOrL z@leHc*!V2JA3xqs*`>Ue-*{z%&!_&DuPlCj`6BWyBHw&;3GG%tcH~-RHNVUr>)&?7 z_jd7~SL58qYk8>O>@<4}8?V}vZ;M zJk(@|^^5wfFZJ0tP1~(`Zl}@FJ1rKknZdE?GmrY<}caZgSxxO z2IntJ_o1#m2F7@O@s^$rbU22^~__t_Mytyy65BVT0FWo6*jy4eX4O-y4K{p5UIdp z&t>^*s!wT>|C{`_cPPKr$7?aMq;Zs=pRWfx_8dp)QWMK>&rgKY_NhIAp2mr-MZV|L z9%1!|^|V@jarrJ(m^!Zz-c-r(Qx9M0zFhSIHnRo=JD$E&YxeAxUL zh#k35M(5CRDXez;bmN;u{9wurM0>dV4Dt0KPGzQYj-8vrR&PDxZG7uKwFP()Wy;aD z@X4P(-O5e+?ax2wlV>g(ac=F+{eypQHk5hc)6HJ-IXizwfp7cOgFK^2;9Ojn&zsapmK!-Lr_#l3%L(s`3=J z`enmv$EWa+ZRXQywU`oUxK&m!W*r8JFCi&s50#g`FZLf*b;Z}MCHveWa6 z*JI-or|u7}9{IN;andNoXFk(-RKNT2vO2|YexFZ#4l1eqsd~K~mQQ>>Uz*R_rS|%K zX?xSHStDVxdHIz&H-|8Qn z;u#mP^^5B9yjE^5@ycWQ=BIenZ|z8zY8|k0<*9s2QaIfY=1=kY_AUeG;Ff9}SU&Ol z_~of`mQQ?tm(T2-mCCmvJFHx3s@_Q{9<{RtwoA2dSULICw^Qx$SpM>MTRGWjd@bhG#VJ}$Puse*tir{ zeV%823NLc`wLUHfn>`x$>l?4?57lY)%KyHccznHTzp3^on=kdqw}`a)sP4bS(~)ay zr}MarS4dE&;NRSikr71;$-EO`(~wDcy2IarC-Q>Wa%Dz@AK3t2luF+a{y3F? zT?(H^Lwx-UQuyN(ZcFF;{GC#`TM8eS!lxVNS+6~(xr~m}7~xND$0E$@q%oGS&Chmi zURS>Mr2BGLI^2M^-URNBN`&=2X~PGC=YkJVA|kvOl^LD_-ckvn|CD~IOaC2w3dx6t z^j7%lbMQq07lY3RpY6(PzKLIBMbSLNjZ=l8Bchm5kjQAtZ^vaanplIu2Z9Si`V-*0 z$<5bFV-YS7SYsL(jidry$77S4M6P+#8kIklR-brXo5=3LM0mSz0LyNP+BqMrcB;JW z?p|CRUlWBSb*i2=xm?VxJl%?`=FUhk6iMTgLXrA&JO)~SKEYTylswyp^cCRV;DZCM z(;$jUz^ze9EAUB#yTyq88La*f-xZIJ1UIAXKB2t)^(fcoKk+{X_WZAbTL(VzSAdOw z2w46O@A5`hgSQ8-4f*c{pM!(KcaEc%!Gpo8TzX%e;L|67E&W^aPXyb!Uie(f8$tYW|K2|r zlmAHku@!kFQ^4)Owii4IJ_`JNk{rDO?hAg};iDa1NqR&4p+1x};Dedg;MWrvDgA>~ z`iCxE{0EWO^BXhvok*z~=wUsDEeh!>C05(tct7lK)$Q%|DNl|0Qs9RI(JD zPg_c2l=yEV*EYTyZ$#gK?+WQ2Yu?EXwfINZxCs#d8!6wBKr1&HtaT@RCn35IJQOT$ zNiXJ|IQXg4cutB%YIUd*&0o#uty#CV+X~}Oq+Qe@+Lm>yeT?+a;Ve*m4Ls@^Vupeb z!_L`YnjD`WcB++2{}<&#dU6gIZ~Lfyu6@V$UE1ZgC3~EKJmOdTJipc=@k{t~Nl^|1 zXAmdZm<9B77QlozNnevn--N!ibpDJ&bTD&k9_7ssz*w#)ZC9>3JG^HK9~Ce|udR1*f6hQZPJBfvufwnY?DzHQ@1gqo)IQZ`eJS5b_G3V39oBhIG62k6 ziLOC4cPPgD9Z7ECc#an63)6|HEhSu9TOOsn@JLi5Uur!2wu}W^TV(rvU~l{FVA(EP zrQy4*@%UwkRvW()!G8SC0NdQDL&LO(cNPh<4Y(V)3)j{b#!;Lm9B0eeTOr)9VB3bq z(J_=WKdY^>$G7z!u(eg=d;-||P4nP0mwplUZH|2}5hsyvv|o7Nlz^>1joT?;8@K9< z>%r;^^;6t;yyarov@mY$g`~AZpG76}saNCu6;wV*`kV_yKG=-#$rvSbUD(g1{lR9F ze9#AMK2V#F09%{Yrnr7=lxXaaBzz`D+@pfEHd>oh{x#C9y!c-S8^8E8I?YG_6ZY0k z*}F7l?;9z5HG5>Qe67A|*pPpa{|Vc3Dcdy$ysuvcdtYxEY`6K62`|GK=1{99#iG8_ z{IT*HpQnRutx$Uhfo*Il|5+~o(iWUCsqY}-Buc*#EIw6|_^x5)SdRw+@#5`7XuR5= zg#DQ95B6hrDA?@On7asUe$bd)MV&S#HRg)JHs;hW-78tUG^T}ZOpEW|VB=FeZUS3< z;`gG`2cU1;fnaN!`tDG$^_}|4 zj}5iuTGD-6{8*8#TEEOz`SwDv`Bt_!3ARHMuXh)KZEVRGL%{Nd+9hq?+;(dK_IDug z?Gv{4sXpBgSba71rOsm3UiIY|ul zv#h-KJpR;PwLOoYC#v+H{M8a{_Gm8h=W46@OZV1(>;!3C&;sAbm9WEhQov9}5Z1KRWw92R3`td%V_yXGu4IsXsHc z-}k4m^{4tz*pFA8|IHqa*P-BNC?e7Lc?j(NA#DCod-~HhU;Y@dl|O~{T>;iQEK&Yn zQ~BjY%dhrs47T>FeNDjDKKZ{XSmT=@@xM9((Oel$Xmdq4s7dIq*fNEcsw*KY9*0vn&k zfv}B()~#4?!TW~t^1~xw^Ml68yI^162VkpDek`WZ-j9R8R$jjP3haILv&*mYCo_z# zyz&nL`~0I^y6l??Hh#5lBl^YKCw~che{Br*_ICuE{i^SFu&?iBu(wA)-|W-*Nz^!9 zw{0{<^HM`Se!fBy2hlCV$ta4h!@uK*3crUGkINUpzP~>Qd;5jG{Xc`f{W^zv`}G-) zw{L5(?8i-JUwkbb6~q?C_vZtF{mCnd@6QP}79|=-Zxebue*}9wg-4$VE@_`B2R^Adq)v05 z0b+;0*V1n=bV-sUtz(P1_UoADqxnVq(2Zcf4?PaH@gu+d0rq~`)Xg7_=if>94_Z4up{sVjanlO>fKIOj+Z27ew zeE~N6w2ugDACc%;md>d5EKBRLxNJR^KYD_#KJ}OGy?uW@0`~o-w)_5yeUVJ__>BB0 z>At@ffPH^y{QLfD3ikb_^SZT9_URtM?2|ta0-Jv|UbW9#e{9Yn_Fiy*>Xh^Z&jm`hdzJu{^$+%{?O-%-XB+hy+5>H z_oq&Y{P7%E{?LBHQ0Hk!^7*$gLkFp+$7Hc+Jai?$Z~q{$Z~qBkKOThr{5>7)+dmBK z+y4mIxBp47Z~wbs-~R8xzWv{Ut^Jyh1sMNKuwUav>z}1-zt(3;BSX68%ST|FFB)&p zgN&-=mNpTgds@}>9Zb71e!|JU>DQvB=3)1Bb{ zvI)_6x*yypf&ZoX_22D}|JU$F>y_3Y{*U)}`7+stIZPu;%Mse%FJE2<_G^#Mnttth9PHN~ zVZZjg4D@TyJ7B-|48|AUmwIO7eK`s2eR&($+A3e(3a<1OZI$orY@@wi*w&)|iT3Gv znr~kz*tc&w*tbt-5#PQ!VBbESU48q6)js>Yj=7P^5GPy@sLa;>rc?W#HKR*Qf z{(J@O`%~EWr+$yw_ov3P@6R68<=fjE?Av=L*tb_dee2uH&lFZ`Z$}2HwO4aR*w2-o z;7b26SMxa%;5~XW>vGgX}GXJS-V5o09Fn@}oa(_4s{4{t} zQat9Hgws6V)nMZrO8%wb@gcwb_a4~%C;OW)sl5Gq*4HNFSNhGV^s-cXWAgg);#PU8 ziM5~szxNuh!{~_HJ(f7Lb2fGk0Dm0(qJG&D?E6J?-TFoCIvDKR)d%d`bp_blrM%Xz zTJ4j0dQPZMSnG^1%}d53V~EQb$Ky7?u99Mrefx3c?K=W&_8kD9#@Mv57#t6t240Iw zG_G{d>Bm(Yu#GF(a~|02(>T#H0rQvmJLgsB-xKWl_3YjAKTEpti|;G2@u{EBCBOIA zdEhpQxsm#3JlOi@0_xYEb6sfP1n`UCy8;%Uo>_ao6=3nzN2!{%fmzD`szPzGkE8rL z`HdPkXrM?$epU|e=YC-Gv;24g1+AT`SLYdD?{KiSL*r%*czi-1X+CJa`f;PrM11*U z!B$@Um!{JH>C)xb`C#*_=KFrM+t1Ja!IrN1u8-0Ed_Nzo^O8jKUC;7IB`}`v=P(LA z-(axuX?@xUe^@`u-u2B-`CId{ph5B`jBql*!(s`RzqE&Vf0cpFUuy3-u+^WQ$6CL1 zM)2+7_PVk?vab!;`+F;};v}QCOU@S@gW|me*G2pZoLJP>CR|xtm3J&yc_pub4SAF#K5U$EJ(^1V~#4@;FlAys~; zD=+?;sq{NSdLCiiSF}ey5oS8+-{|%Z$+_qpB_NN3&mp{6osGNeB1QosQQGx$B|7)Dyha$K%WV6-*qT9?~~@=BM@K3#pUbeR*IR5!yFpOcVx zDWT8%9@umJ7}8~D+{XByq-|LR<6{rfg`D*fl+n*utdF<5g$vU$MDBiRnjw5*)NJ;9fQ zcTpm8Jorh%f5eD;ZSa0vALX#dvEiwt9{`@6xG)ml-(j80dw_RBCF0Xw>C5*4Tlu-9 z9}hkpl?V?eH2fI&MDUDIpRneU;icdbu=aC_%AZH*%byRn{HsXUSULoiq_ON>LcF(E zYlhidQ~FAmuJ*46Tl>W?KC4fA&RQzc`iuGM8WN6Th`j<@N5EuTRfk&3@T;d8)kf`||BmojK(sb!uG!k4wL|-ttsPqXg|+sp zRxKGig6TS@47{IE@4m#{i%K#y@ESs`#}eVbih(y;PB0k-_Q zAC(X7epI+y3ZEWurQPgzcFntoq;fWcMEmojaxS9h4sA)Y=MKVqr?Af9mi`sx8&NJC zW8?E7E{?|z=7zl_K9a`!ui|iGbJ-zj+$njl{w_HdX$$_Iuzid;6T`24!1HtLi21eS zs1@;Em26k>xi}dkbMo%xQ@~ZxpV6PS=8!9q2MN?qYLnzbRD910AR7Cl2yN`2hCQpn z-9!En-~+fmJ7A^jS({JS^CX|H=cATBnf!~%eE^2U|3@=Yrdyl4a!AzSV?ub+77Ds6L3VgU^KH?yr;KDv^?%lRfTJ zhvg%~=aK#ac%P7dKX^~-(Yy2#VZDznTv=a86OQ}8UgLr|GykZ*3PR%-)*5bD_3Z_= z`U=>5^%>}hz$tu+!-K$TdoNUSEm(bec#OF30_)t?GhpS{n6vzUfOBA-H6+6O5qi8s z3Llrk>2$iIT6xc>v$xjA94Zmk^T?b4@?Gb|-fRNnvC)`o8yg$%$}>dTe_2T13H&&? z87kQq{4cK0Nnmt5_=wtkw>bDu^$i2(Li#Y$h0k>P^~}iUFHhwcw)`54vab!QzLpti z{KB)Y0dX*gddO;jt29~+9thqlPEE!|Kk%ohJN<1{~_Y>Pr3+%^r(jKs4K(Z=%%Sl_pmuOwfB?;<=c6iDNBq@Pc{ z{o~y94GW3R1ipL)d{(|K>3U~wcF4aQ_;`%1O&Q6-;Avnzqmih-atycf!W9l{Z7U+* zlsI>?wh>i1ezlhE5B6)>!QeI_ztWFPr61+e)xPmywNE}Zzg1p`JBWv|yBX>F&ZuM& z_+;92WddVA_vPCBEWZy<;Y%ETm-6?6wVq4925W4*fbS$qKaey_uc`i%T>Y(BVERyQ z3~>_Svj`3Ax%SOq|6F?#*q&>vevMCGzutXP{dLJFGs8!%m6*FLyS<8PvafB*KJ|;Y zXAs!iGXU)ESq3(H4x>GH!nZ(%Ao9-*!9L-d>K~k{zl3~Nzx;EV!}8CgU~iA+g|}y0 z=bwp`pA23c?9u-JHMj+3B(hJ>r&9ilbIYG`H#4?$Evd==(}=h6rRVe7gI-c*WI(Xj z_H@zt1mAr%`o#N3SZ@k`&;AR`a|p7bzt+E&T!X*>84oZg8{V3 ze4zEEoD^GcredewZJS*`$**;9IygW0LHp{BT(?P*B29lB4iPGOG18@G?tC`a;evK35SG!eh7;$kZ803xE3jc6W%f$it~E@eeHr&v?$f%bmL(RV@Q7!oDKQU2J2mutCSfT1O5kfk4|8G4^shFdD(9E zE0k~f!}t0(wp(kFw_Ees&KIh8JFwNOdh`s&>QSFIA>H~^V?x-*#Czl)0L}|`{|46i z;Sp4l+dFCV2MLVZJ%MX$cQNT#g6FyP1}=RB>B9OfQ!*JWd*us>>eqT@^~UirOE><%d0+#&)*Jg^(`g67ueP@;X?zKiPkS%#$$XFLK~B^bt2e&q4}Y7 z8>6aQzVdb72)4Sl$Ljf83*scgdj96|p$>0d9A}GmX_$n=z}s{ASps8U7IAI->N|#c ze1EDeviD#@vsZn05ZL-o{KtchU%u!MHs4Gqy%hXLKK~$^BUoe7*b==oA4Q$-v(%83o+rArA;FiG_VU~(&_)3R&BYie_n~=XJ_$jd7Tal>z4}_ji zws^dq!{WOQYQh#jy2~3k?83o=d zFFA`SLiT9w_x9w#-X1+)_x9+X+}opPn%V6#WQ`xd+)F(>|9G#`7u4)|u$ zuLd)uVtE?86AnEfVD;T3u=Snn{}}A;e-G^KUk>)hq--yH1i-vT@;)Tc9N2e8>M ze`@c*j96sP4O~^)!`NvIwz1Q5-{d#TF3%+SPXIUJaw43Pi@{nOj8Fb41}{J*X*`+y z-HE@mRh%46FQz}awDt8-(sgD&BT0_WEJRiA{W>$93AQtn?mL=;efzbSSo@W(wb`c+ z59##?B?=qGS5duu{uD;GUK5_m)Q^+(8Nn~Lt3D&hV7%5fett0)eP%F#>x%={X9k_Q z)@KG1mH(8***;@X`Cq`k{NZ)0m){a>pEt*}I^ZJm&AGLz`=&A2&PDQ##=7}N>q7m! zs&(N^>ef27f;&3kf$1j(rPU zi@Fwuu_HdM`&OUMqj_MnU+ZW$uwO^_0k?_SleOVEu#IKeqxXDluE?Itz-Eu0lidOy z7|M(PDX`}+2aBIBiTBY0_guWL%I&##YXuVdr#+$hNBb%+uiRI&IQMMu9jHWS1Nlee zPol9ngwT)03&5k4h;*j>tAu}IljJP$LxisdJRSTiSoeq$&F#5dn?D{S{Zz2lH_0-v z{PA$W+DG)+q3r`L_D{|nPlWW7a6}R1?DL(jr0)ps9@6FSgTUV3M}f`XXOX`jxQ*k} z+HZVHAL`Q8AD4lBe_XC~RHFB`rW5-2!e)ZkDiN6spYE-eQlI9Dstw&2_tn;5>#K$2 zeFCiap(OH^`rdr?Dd|sx%{TJh19{bbHxF#-^8HG%`Cfhd2H5xQyWmktb@Asr@{{*n zTd?^~zSr0?UuoUc*jj)}wm2a9ZK!A9lqmh5gqAMfUJEwg3(s&^zJ3nueZ5fWs6@Vg zpV0gIGqCwu@2qL;`FGYf!(X1S71;P>?-ArTduuvV`Sz5jgMuoj z@^!eVW7qEYOGA;kif!W5MH#Q~1*qJ`me{ z{s&UHC5HR-(J8zlg^#FPJ^!OAyj7-p`uG(7A%%~vS3UnTDcqiZ@%Bwl;dLo|GEVmS zUrgbh8&*%Bmcq3gRZl-Xg*7 zT@WKa6K$8^uLBkzU0scjuCB(1>6Lu4Px+^y5}oao-`lqf*xT0`Ec=)u@p?#*Nc?Cz zr|V+$53MzST**ICX|O)=M-ef;KB}x%-$1ahZxGo0A$v2h`SO>i%Fj)euSk{OF;%`J z*thpYu&=)aZ1wBhJtVK{U6u#wpCTH%fIJfQ*ZpAYujj#f{-bx@SaRaEx&d#JYYi4= z+9LV!bzK%@`Bb8M4n?08K=KYuKEu%a0TMlPmTTu@i$rJqiwNzEzZv;gfVT;D=~?Y2 zT>EFW!gl|u&kOXv&PyUgRR2h@)&CFpt^;ot>N^4aIM}|xuKcgN{11Y^1dCIW#>!vY z`SG9dT?l?5N4`44bGuuyVQ=#^s)z{_dJv@CxFyH zIC(C}P>4lySm_G_9z}kg;WV!$O23BC(obrWoT+tYtsCb^Ld{d8gdcw^&g-3DETDU* zj)Zm|()sChu$`ZT+rne`C~VU^D_5y7BK$!LZ-j#^UC&YW2S1)U&^YVR9 za4w_|r@Vg0L(d^4I$tgW+xbuTk_XbscO=R2y<`vYB?0TadIZ?p+Xp-~G zTLeB293QsG^B!2=ReB(Focd=8*!oBI{s_(mKG`d5_Nx6SP}bTn|CEBwKR=NEI9T`R z66Jp(As6z&$V zjR%FYA88P;fK=EfURFXZ2^z~ftJql9TssTw=h_f(4wYzZUrA_VTWiHU>h){I9I#(2 zo&o!{q5|yKil4x9V)o=2_Rru^0c$Sk8JEq4Pig01@OV_B{=Js#T#SB8E(J$}kzojv?BW1W@WC%t(nud~;$V1IV_4csQA|ABqm(z!!ugQOW7e0%U4 z35@5@cHjj8>uh%l`0Id2?L&LO*Sh?trt%MS`MbjZ7PwXzCz@{$aBcJL7}9kgH8sq? z`t9G}-tN?$WRd>%H+C8dZO9{C2SS*G#baYY_H* z3w|gsF+hB;fQ?`MF@2+|@udE^5$yZp2e9W~12+Ci@Ru}BJ{M38S|7%OUkdFNzTRPt zxA|ZjZ<-%RkyrBrHz#v8FF*FS=0XSJY%ZwmabPQ}be)NO`o{1mz4)5E_#Q&T#O9tz z=_+-mP2u>vO1BWTR`G~9?;zeHEck*W9yoJ!h4#^z2xo`O}r_T#Ohe zOpIH=Q$o7>qm*mwkB3MX9uv~v04uMarAzcY|9Ymv0e=hrF-eX;x70m`d@IrCmOF8c z`(lwjdhgoo(PuyXNb&pb&fsoI_IRDp^@8J|mw>v=_=g?S&GJoBauG+z8*` z@G+F13D)<2BwB|bP#CcMJr8XD9!37=z_>jY*{8a_eIJ0$KJlq9J>O4Y<5PLJ3<+V?3 zLVnw)gjeVBIH8Y;dkz?NV4H#?Jm4l2?8*e-;lVwB9qu3Xz(RQ^)1&p#4u`Q@vP!M-ol zUh4~$KPy%KY*$`$|01xjZ+t5Ml`g-0e>K?m-8EqAJB{rO*v7W@DA_Y6^!0vylD^Zs z2NLaBClT77rO)Or0Cx}R;?ubId_-09DL>0)Wq$FW0XF`zVA+2oDp7x2N@)EthxA*) z*DDcG`gMesE_|oM;(G+_`5txYnhX42>3`kFl!5(yjQq6#m8^rWj8NlQqIVZN5ZY(S zosLYtBXMq=$~@!-LFXFtr_u+5efkwH{RqApP&h5T$25macc_$8aVT!Z48)vl94)-K`O9M)&T72wxIfT$jwg?v4Gf)^yo zaX)z!u5nGzncOTH#cR$$bD>y27=j;}3 zIEcHN%j=LGCp*fK+nP4}duzSx=hyMQz@tKb?HdP!ZQsyyrcG)m z&nT2d^`8dz_4fz+`bUF({SShD{foiA{+GeNe%)(Z{i<(ACW^05_tL(;?qFZvgkIbv9Rv3Dod&l0bT4!`e$C0bi0-up z5Na)yX#7kfwDF;ROxV_4?OPg)wr}Z-JQHkZW{tOoaQX43`%U9h{pW*ol#%FO@G`L7 z3u@o_7Hs2B^RzMf%pd8`joKWYyqkADxE$~u&AW?qh_4(_7Ex*>q zmgKW_QT}fW_WthxHvg;rI`?^h7K59k68WF4xzhjQmp_bu4F0(jd~xuP{IwG7{iSu; z`=@CNZ|Sh?)qdyg?G843Wsly&u<;;&tnYI(hIzctF*j=GaV<f%69JC~9~|nJ zy$^Hk>zfO<`jpn_;a82z<5l?P7V6D~y4BZ9$?yBR zkTmP70&eDB0qeXb=?K>SwSA9XWBD5#Vq;nOO$;1=#GDecJoIeLs_K_Q@amt&j!8Nzz#M>U$uvmmu!nR?3J>fcp^2-if^u zea~wf@CyO!d?a7l`AFaU61MMs&7=JG;D0ns%5PoFTmswoIEI0tsP;V(EkSwYk>ps^ zIud>mqvTy!hE8RD#iZljYTpw%4s87TeujLh&(I|+vFBz&JqMS_zWWKieUE^x{Pg1F z@3Yx^&-rxHGSc61?f(sI?cb90U%@}hk%&H5|DDi2SKpcR-AH>ePNk1nl=K<6&Xbaw zz6+*x%gW2&PlByJorlNZD}Nro1Z-nP>H5swr)%A@boFN!__UEUlQ5A4WYN4Wwg>3*)D9hZ(W=`M>XG#g`e(;{)mlA#+v4e zjTOD~cRP4Qs84(|!N#ZWj7$UDI~*E|8qSBjzE&T@S8wlP*jzDIEZvbE0D#1^I zp9fD5SnH(PYwM8m9|*Sm--0g!-x~67)-QQ(dlnp$E?})mPX(-d>S5s50#<&t&+;q% zQlCBokk8lFi0{lOmweqo)73@iU;F2C@W4u42~To$d$;~zxN zCQc)?XA!bb{xJK6mEUla*y+CwGkAB_j=pUbJg57^FZ^1sHP_y6`_vsd=-=CJ&&Gr9LSS*qEmwZZJwne{~Q z6jY*nfD*#y0*Ls1f9rb!cMv}?PW@~8t=O-1>C@o9d?wd#V1LH`9o#0ASN+Yn_Vuf7 zt6$}1zc0T(*vhMaST3sd4@0`Le>8qdz&3u;<3ac=(rtWf=pLr!2}%FTCW-9ZQ(Y&vaPphp^U<+SHpDtNvvS zl6ObKeUyM`?bF(5YoFG-&S1aR?FF{AZVly60^fs5TArBvZ8!ZMn4}Z97FFrJWXZu` z8L$z7vM9QdHUmU^isq5uQ#6lkoz}iE5j=*rSXp~+G#R_KKl|_L%E#IdRYx7PMT?{& zNCs2;OP{uvB5|7f37U)w%8oAg(~Z=e$G6~9uC z`A_-vy=cp?bI%iCJNNvfBw3rfr~$|*=E9bQO=Fb&PI@n{Hw*ZblH~KYK_S2H#}6k> z>xo34$uQk2KL-(3dT%8nHKm_QyiZqqJ-#@F$E5I8DLmETliDO>$L@Dk{{i^N^G|YE z?-FR;)prafx_@2-wzXJ%dbiQ|gqJ%k|23za`A_NBf_;9bcO{np7%r9m+Ypw0JTj=X zPyDAlzMAlmRQhm--!Ea#V88C8BzoSY@o&$Yl&<$heY*T*>9R+2%KRn!`M2iy(3lItk}>-o0Ywk}{j-|hykjY_n)_vLy{0^_sSG2l@F>-o0M z!g~J7(2dvDLn!W{@bX8Es%bxyK$+1m;1?NxcRSKo^| z0<6z%BGl60wDGtpwgRx zef~7w+@-7km@bw5r}AgJboFN=u#FF;H%X-nTe{|E4s3H(`P;huX)ONpU3sNnk;?C} z@(Wvi%CB>bwO5}>9|Z0m`bX*7Ykc}48%Xc&(r2EMtX2BFN%AOI?R_&w$$gFH&w_w8 zeh%l_j~`rIIes)=`hop;QTzRPQTzOO(Rdn#N;H?J654oC|Gfq7sYFEW-Hp)ND}NmY zHh&3g{uy3Pdv>R7*ApkvcEg;dqVphVng{qVeCOs**E(BX*aO{{%LRUT2!KaN^{rmQ)hs2VJxao zbH&@IbD!C#^6EQZUTc|^*S>HKIEPB6(*D~C*U2%6+V?J@wNLpQ;jo+%5!Jsb*w?S$ zXYuvx`J}I3{ciPd$X~L*E%o^F+Q)o()#dBgSoihslq%oVm2Y@z^1SIbY?5d!Jw)io zmgbUSjYVNU7Q4B0mG@ZZ4m~gO=MKH^^&CTnlUYT8mwnb zr=XILz!ik0sN{!$uS{T+IW1XtE(loVuX5$(?}x$OzJ*}3Z&S*D0q!2kYcFV!SG5_kLSmpPi z{Z?Mj9Q9k4_RR5D%4_^R5VIxcJdJl-TXhc9{5U40D?hjO)$(g?_xW*gW&SQayl4v^ zj7kmy>z>j2L+^I(0Je8KuO@vf@Q0{GYrX6L1ZT>cr-HNHOp+xXs<^iur0Ajux}1^>?V>jBGOKX7gS z8bP}H_mYq<|Fs5tf42embmg}LTY0trgjD)4m#+58Kfb*z5!Kp@i!0mv0QL+6+wZ0< z1K$g-2<_G0HV15bT}}K9p=$icgUz4v*KDx)OZANf`}$UbeSKeptv=0XoeOL}Ydpw* zemvB7{!sp=E`K4LTRZSFI3>ETF9P>YU?jdA*Pc&P*ZeQOR$!}Nd>z1^Z(FeO$v^eL z-v27^$6I%>`DYk>T7Q#o5ikz$kJexBpR2*%Ka;@bAC+fIs4V{uxHGtZ7{B_v8#KA{ zJBS5}|4hd$*$ zg|pnT8*RbgN1mm z2|Kq$eXReLaMa&x-Hz~_n%=eHdpI9o*|pQroX6V9^uCjl)AzuU-gUfvKd;`%07G!7A5(8*(20^I50soU71baKHNk z;u8z;{?e@G`9Q3l=HpM-dZAByyArG4_6z+lklwY=S2zr=jq|&w+Is|_f38TI_Su;8 z!OH5>-|Fk(P)$`;cnoatFUy@@-b&`alRC`gvs|YcaMa0rBkOz*hrxXg$8)rq_eS@_ z3l$RF=WxvAdn4cLx~WK;XH2e_2P%7SG!c$_BiB!#M;7bH|lo8a%3N(Z2oa)9CYXJOlOl@gz8& zA775#zl9pl>pwvGyTISA<(~i_4nJA>3-D9$^WB!#ykGElIO=2i*6>B?t&iUyj{5v) z8?FIx{_U(Q;K=X3`nhoItNVM-KZd_pN@I>f-zdudLuLK(BJ%7HC%y28{`Pm}Lcjj$ zfp4q%UqIgm@D>~f-*51D%-wc%i9Bv@>ZY5GnFLoHjz2@V|eP z)ZcEoqRC!<^XIQAz517=uZ4b}^}K|ChxlvpMgA)OOS~8Pw;IbmQ}ws~`+DTjzdPCf zHFAkX{mc1b4LHvay>PV0N727F?B6*wIA0t9FKn>P7iYnFzL*Q&ROPnEm2k9&^Tk); zm@l+{Y_i|+a}gZlM}OW4hd&*!55jr8{v3|+>NROC$`1RzhA|DduSs50_J;E{}D`o`ZT z%WZos^4zwsbg=hYAvgacHNVYg{aVAyzvcbvX<%-5nzrpX+gU#?YR}6y#kJQ*4`W8Z14SW zw)ZD+w)a^$+xr_h>~-xj7CZ9V1@Vxz3)4dT+O54S!(p$yU1IMWT_?{{3BmiE(}-hT z?YkB8;M=O)cPqRH$nRFTZisg)e#64=cKG_5-gj%h1;@KJ?!iw*b{L--d{<&$IP&{0 z#xZby7h^U&*d#A&N8g(X);>eF@9l85Z*4gATi&LL|8L&?=ptX4ZYbaIuA`d$@-I|& zjAMSg?H%KqH{Qeq$M_}2HNEdWTnf`9C79neR`eb7{}#^q$B;MYcMTNzos)KiW1MTB zeI@Msd}Y@)26lEtNBRFG{bTUSBl(B0B8%>K6Yp8s`t1N``*wuGKGUC= z(p%p0a4yfXqCC@UPu9;gJw!j3rM7;{KPk!0KNpVt`ukHgz3rIWawOOHUOv0aMkcua zvFup?6yL((Th{~D&9QHA&Av0S^)q~lvVV_ky#`y~f>%Q~$;!JA3^OLa;bVHL+;M4n zF;4wHJ#(C@2JoIu+O#)t~Wl*d8{{V+xc+VXI~zKqiwyXSqyuxuKAsJ-Ur9LV_SX@ z&V6YgxUVU$Tqll)vpI-KkOc{tbK-&e@>zY`v)`mO&1u=TgCh{`)Co|m>8 z+bWh1Y>glIEZ;kE$!X6|-aBmuJFX4ZYnD1|z3r3svA#xJ_W5swqaONg01m&|58g({ z&GlX#j`Y_19dOj!^7e;wc?ZBzp4U%*FDm=xdN}*#26&*_r(f=ZqhHw0Ps35Z_C5n^ zuT>mT^BH;VT9-IqyC%c=zS}j@Acx`HkFaJY_P)a4n4Cl$V^Th-gZD`6dtJ-I<1oZF zD{6WgPbk~G%7|Kh$29MptsoGr*DT^(uVZ2BWzese8(T?&?RW)o_;qvi^&mUCbe2Zn zig4DqGo1C^31@wG!J*IcoIkRBT{z_Khw7K@i#1$dafG~gW#6fDJk6`@e03lk^Of_D zzabOzk9}bH zS-;qb%lvW(oX6RLaI~M}%)d3fu%>q$T?*%M73{l&Z-s}vO9;nU);`a}KHJy% z+xDedn|p*R^w|yWZa=$`S4-@(oO8$*&vKNz_Z822?5lr)bKm`UtiHEmMCh}x*jBl( zXix4d8^XD-xDH&%VX&`!k~sGj$5rkt<{jWL*jK(p9DT*PiQ&=KU*=qRJcq%#;?Ks^ z(cs+l7vjD`&EA~nS5>)l!DKk*0)77hIL4N3c@~`8@=Q3l)du7f70IB$g{ne*tXZbz1QHpx99zR_)B~LhCJK53G!^O^K7>F z{jm1x0&Si+kq-#6p5j{4d^JkR2TO%|GE;+{mcD_tbab7 z^?w3;vj5eU^-q99zwNL8vObDz>(igR!qNWPI~LCRmV`rJ-;8DtMM2Vv+ssJ z?b{U2_SwEsU+w9fZ@pede*L#Qoc(uNhd!1YL-ct)oWo&oykAS4^$o&V-*4e;-_PN& z&vz~U1b>`1GH9>Y>a5@SDC=LIv{}Daa*b!XP+o>$g47tZ>;x6b-* zg0sGx;jGVltgP=fIP3d0ob@f;HB_J9t;+f~fU~}taMtIusy>}Zu)YVu*}hqD)^{?T z^?A>m^?ecUYt$8eUxTy0Ti~qkF*xg60B3!#!hK2KXf9e=-xxUS^S7rT3EI}2J4SY;9TCNaFl2IwP}w?FS}nE?D$%yuo6s@Sf->+}8LSf9JzJ^+sO zw(l}s0UyO-kUvix?7Jx|;;##fv{l|^I~YEY!{EDljyKn+2H)K~749#@Sf~7P_+!7y z{{3plgY8c#%TYR3(5KZim2MQ94SJe&f8%lnbY z`%7w`<+FhKI`V5O7kx=?{s%BJ=YI;0{I;QN8@m1^EA^scm2D>s=n1V{gVg7nG{t@)iVyk^II;e6@+Z-3I~ z-vbMM${$T~{h{3Y^^ixkjQ28O$_y>%%jO4{IkkQtBaZsXA5Uz1Sl6hp{E5W+`!YD& zGZ*gXFeu*&BeFcVhjOpMS-w=NkN%RwU(T<-QxNm3^P}@?o*$>dF+b|hz2Weu^XHjK zZuxh@x%~NXf3cpuY@D+M=j(MhAIKj}{2q82>gPVS!8MKJGuAZzjjWU48x<0+AU%)D z%QaW_`uH;OH3H#Y%w7=>79!sz5dvzL;lqc`4#^`et(kdFY{-AeGd+Qxu@Vg zMC>WZQxj|72jFa<^SkyFmH8QUB{+91!&%H750lsXwf>sGXO}C$9tPWDHRABSbM;nm z%-wG`S6gmBhrw&vWyJc=;I-`Q#M28kbNTC>=ehD9aDSECHph}T+D3cwT0|ZoZP=$h zr@&d?sc=7sLHn(H*uOF-@<*zDo5Ih+mSM0jJxm;ZN%>ddkXxSb3g`0NFYG6c!SXhN z$yS2p&4+V&_RG-c+UP1c<{HbFbNOeb^y>dE9QtQ)@&bHdE$;+)A$$Ud;d1y5&bMf= z^)yVAwAgaBXH=G zy>?~3E%C3>Hvx{Z;M`|_^)rLK9C7BADtm9owBzFh{!PzEhP8hIq`Wic{<3={2Jgw; zf0$FK*$~rI|Io@?UTs za_w>dE!*=b+_s1OBN*gE^23o|eZNYqy|2Jwul%RP+V8WtY`^!OeO8X3+-psi`z$`> zpT!>A=fRS?dH>(}X0WpFux!BjtCg+a;hg9C@kp;-KjrqPET_x1<=S%|ob5Ru4ttbe z-XXst$@R~waQN#9?4JQ&W*&|a9Cd};8o{E=w*FT6tf`ypvZ$N3j_7DBzdI3ar7d1} zvaRog!&ddL)1lwIgS9;M(_BM*aTuKSyQa_9x3&kWXcW8$c%?{^#s z_i`BY%h!psU+4zy^ybfOde;j%{hvD02W!$ujtKg6c_4i1^P$Dim7m{CLq4Zw@Oi{m zoaZ)v8qRI}3~U?gF8k{;%kU4u-!ttc&cAo6o8P{KTe{m-k_J;q#Dd>j`k! z`fbu*4NtD=9m}V}F_sr1zXe{k%KdK8t?*ME2J5O{tgE*6_+bs&YCW^98^K|V@A_(+ z{oQ7_h?N!}#lN)8$<6PwxTe(KqsynwKer>hh||dyNO%aolXy(E(Y+FeW&8Tm$*w;f z0~c}_* z@2GOGcW)q%>)$TOor72G;zNS+jp2~H*6xF2?XCUW!P)-Z;jmwOT&rYz_JqTp=P1v$ z@DjB=?cG1gXPwHJgsec^BY=e(Hx$JE%azx~Vh%l?~|NJ@6ohLEeox*!s?d zbA9)NbA6dohSZlX)voX5_=C%F`At-!a$nF->^ndP$I}_a(cjz~us_H8-u~)b7xlG0 zCcx1i&JWhtK4b9uX#b7*!TRhBM}0c;JAU4E|`#21~``S&seW8XI@8D%Scyb4C z(!rQCMBh1yA343be>srP3?G|Deel(bg}4``a?V{{)qlM-?)IGjtjc{q=0kA2pE3=( zdlR=+`ReHN{yDyHReoz2uD3+3%aLCU$M>oHZQwiLAL|5y`hNn4e&4-x?=HWu=iXhs z599k)Z||Z#ISkG>s}VhtO~R-vZAXX6mN@Z$=#bU;Qh> zS^su$*6+F}+rK9q`pth#NB(0|{*%vW`i|d+Fvxci2m4z_xNOL88SMZs;4moPi}C?@#g|g7&^NnHe2hZg&*#4g&9xTM%jXje%kMiUL5^Ep-x9#5*eW$}jB^=6$_m^i? zKELv3D&GNrlk+nxKMwzkbN56H_7B@Cw_ommw%>=4=l0(h?&C1{+gA2<>tt}h<1*q2 zg&O&loQHf33~~MEoNCw&c7DW-C43yVep3=pPpm&2pV6MCUp2`cpX!S7=k?CHA;!xM z8#a60+mpudNAjPFe2)gpeBiT^(7!T{JrEhimV1IS?Nr~LgUqq%`)>yM0^;B+VaxsC z^7xM!wdII&7N>sHdWLlNDW=8}^dW9<`*2qp(=q6{HTeAos?nNP2!G(f^*Ohn8T?(u zorrHL)O;`WeVh+e_Wtt*&g1^mI^G6bM}zm14-&sni0@P)H+{&}za^Gu{nOykuRYc$ z?D2j5#fLAF--FY7k$=26v$=n^Kg9j>tJGKdI1a;QXE*iDYle;ZJl0f~a>25`F$Qm_ zyfHQzHo{-_p?}d%m{E?_h>?oQ`^Pj-`ySHo%1naCk=Ee&FmE0oUcY00^PW*Z#Qm}3 zH#p37^8erRvFF7?)bISJ zul~6vS{}CVEi@zHG1~qu)akThKr>(1uX5Q}CpQ1xaOBsvA0)Z#`>N(wW%2J)&S1^o zbHTiJKh)MU;IP$wo}1wq`|k6+7hT8lnZbRYUE#dX4_;T8irUwe-%@Wb1+CSpALUti_8ax6W%OwNA-wmq&HJ^zg?L7Ia`Wst_9ym1emQwpuX6V*mPSeJSD1bdZ5`?L zgXh@~Q{cXuUt6ck=rm~Sws5x9{oCl{%6IFKzdy;{6S6)rrW`|4;21;l35ng;@p_f_ zbuNboISi)v`kC{;oY=j;W#E{*WashB<0{)XF_k^orm}J~EQa}U3EIC7XW9NU;3!}D zp)rxW~JB&QJHUD@_>eU{tvQaIXkLoS$Kg4eAD>;^vpJ4YBk0zX3>_xn@U zZ}wW(DpJ0Oi+pp^u2j?eTPiDao`26_5}fZZmWAW~;;ZEMJ&M<>zQJ`RrmmS zG>2jMh3xThKD@H>!;@Tn^Wf08I_YnN-)OS8)PFae_0LcF)$ecTWc{naQNH7;56qrd3irICeyFGv4YaEv#9>trSPRBSN#EP5L8ag}Y4E8*N8j)&YH55dtM zw%02i^1oKOT@cgQkZU@l-)&e0oLD+pGxk3S&oK?bd*^+K#}}f`)ZH~juKOq8sJq`? z`YxQmyYw_1_lABq;xRbx1ucJBILi0C6?5VI-HMyxoL^r=e*5+>;B4>naM_6@4N1pBZbVvG= zVaqdUukDrfEeVJG6X;{9+j71!n4aM^B>h2fr1x6!9XPHPuAQt%rNc_2IC`{QN&8Kf|S+f1`_7JHTT&3}Z$%-{ak; z!NR?q2fsl2mEhZ}T(-W!yItJuQ7&8Mvg_W=K8FvszP@9b>w7w!>w5+q^<5i%W6}M1 z)h{nsnPg30s4~l5hVv+EKlm*8?^SMI{x7;5r#*f?rMGXAF<~M7>?Gn*%NJ}d`F6ge z&gpX&Nbv7=o<_W&5d9AM=Qy82{S3}4j}Z3?gnKE>w5P6Gu<&*m9c*8C79MQGWe;X# znrFU8{?*`vs($|t?(VSuHJJazl-}|`$mhKZ3HBA+G4~bwX7m;B*FOo*<1l!C>~+k; z;Qcg1d&vECKRm!;@HZdNC-%P5FhKd^h{OM`$rguWP3G9L>^!#YyV<@i;jqs&L+3s0 ztCW@d%5UL5@;EPev_>!KzparwHP8P(U2Pji+wH*TM^@IhBjIeDbq(7ryYu<-lC)K} z)pupXR>$2TaJJ2U-G@%YU&%O%`1wMtl`p|m&etQ2!N1?7d_lGE8syXAytnXf_y<+4 zzTM%_H~!LQe{TYx8I-f6YRjGTd*OVI$n%hWh3-70erv-~Ki9X;8@RCq>+3rjxxQXs zqrU2MEMi6pu9@r?q0jt>!8!loaOB^Q`k4Q*>Yrob&0ycBHn=yXKKqM7)*r!MQ*MRr zkA`c=Kc9G2^4m`sHcTEpSWFqn+{aSCLB`xRpT1*r-m8${vl!>(*o%IN^q0dQsxv4r9(IScbCGkf42kjm*8VK412+j zizOOt9Spw)d)+d89R4J_m#O+b3x5gjO*{gJ1lxB1?q1h<#(Uk~q8 z>TI}*v34%;3;4)z6pi;o;!`Ty*ZuC=T184dsLwfYuFtt})JOmR9?t%~1`dDf@53lt zwhJI?)vo~*#x?ZC;azd>=UBBad8|6F2TezC?s7dBbCK<^m|9$Xa z)o1;l?T~*z$+c%`(q?;{3&I}dr*_D_E-UZhKo$ONVj0($58~}b?;p7IweKI^p#5jV zs4co9tia~!n7lyy> zPhN|nKbhYC9qDJo_U}hIoFDA7tzq50>voOuto#nryNT~9)Qs;HIgk0z@$GoeeTpP{Yfo_I1AXJ^ei2z7y`t>6uF-f7cgS*CW5LwukH5zrgcqde^mH@K3C4 z{g#At{l>vjKjkZT$o;z81%<|#MvM7;qZs~zYXX755SS% z_V^i`+v7R7kHg@){vX7#cHWozzMb}6hQnZcyO-Hp2v;G$7>@Sx`ZXWU{rl^1)Yty) zJ>ad9<9fKS$zGn#d>fAbrM_*DWql0E zA^IH8S>G|R`t%j5TIHvym|)}{j#k&0F{7%#op0O|3jbN&fp9MGAUN!||9kHe_IbVk zAv{PLgX_ojDKzrG7k|muG~(ttKRmCp^Q+$jjrqj>_Z>Lb=V7>y^v;o-@=r5cdY`%q z_`IJHy!Y{1_H=i_^6r9bm$>(FuJ9RRo-3Au!`8E~bw_w=lf88_?A+7s%_2ehN0Z#S z#c{u|5tp^GV<*ookHL9vaqJA#^!oCraQO25?`rm|VzXS|GThp}br0ze@PeA(J*3w; zpMnm9@AWxv#(RC*yDA*@vHp&YTz{tTA@x53j`VMk|5NaURR1%R-1>hR&h@_!&h>u= z&h`H>oa_HG9Q9v%ZZmF|<1>SO>8;p5r@@weNzQ%AYenu$KEsK=WM6(~%J1B|F+9HN zv#;$8=f1WJ+*jq!?e_JU+t-=Py*T{aF--!W^M2d(9EPpta=*j*3#tFT2uJ_(J)cWR zH>;*M|3+}+cOQn2+V2hc-qb1Z`8EBA=QewYk0$n760E)@;m~(3>3iX)lD$;9Eq5=1 zF4*3Sus`XW=uhUK0_Xgz!J*&$ET2n$tK7xmZ-^M2S0)n2yyA78=4@ZrZJX2KXj|Ln z3^>|GTkeL#7TfCIts@*uuaZ9ck{tJ$&K70H=;4ImIP#jkpipD0^LN;4Ugy}X>%zp^ zzBHU|cMTr4YwNmjcWo!%lW>lWe&sd8>vLQ)Ouu_a`aM#5%bN!0^5`1v@{|vB$n7^_ z&r(yH_gvx`j^%v?dA4sp9QK+1J~+~=e@8f%&oZN}Uwt2jvp%|dTc6kX)8TxLKO46G zJshQNh7B7&l5>N7XBFaT56j1-A?1^#UB2yg6~2!4TJOr{eTcWOL?VLrU2mM);|4hD zy9Mcg36Ecye+Z`khjB{(PdL(RkMl_Ohii!OW+rHl-%kj8)OR|Z^_>BSKF7v0aIAUF z|F@K1`=+Be>^pXshIi6Q1n0?_#9@!~qTlKWkg;KfBleB3v&kW$!=p`Zz|O!eMaD*@HjwnloP) zoIBozJp8YHTf^DDX>izg(v|EBb~WFZSHElKe@WKfk1y2RW1i1> zZ)N@I8Y#EWH(|>(xQ?2My{0iZ{`Q7Lzw4qS;f0O3tP4+vhjSRbXZD^euZz9_4>aO3 zf7}Q=e@v*K8GDT}(4O7h%wR_s)J<}HNn%3RbZzB&I)f(m#&T*|_M}6gcYXJR@JjVX$4!CeH2Rbu;ui zuD%Y(xUyZGH$$K8vMC(x^7@s{z3$O<9zS(PvmXEWDkve?PM;-xZYSUUh;~}+s%Ee6 zraG^?o_75`*ko@_ME*KVRDyeTKKppJ^4k!c-oaXeF)+BHFUdx*FyNQ)Q%DQSgd{J#5=gs}#m^VB5 zTJ+t5JbshMarp7O0m4wY{Whg^T00=M_Lm$TuhzxH1VhyCim70%_~28Vv@Gh)=x`YZ>x%ftVx!%-jm(E&-Fw*Ng0NB?tv z`7=Bx`Rgz6_{#cc#W6$uGZF5qa`kNwhd%waC!E{=U>Gw>u)lr`4u5%_co@#tiTmNO z$LqxK#fDxd)`IhOVj7&U6I;OpwLI5}JHxTg)V|B%Y~PpRY~MX_w(r+)w(pm4wr}F% zL+#rd&i3sIXZ!Yovwa7{VW0l~E}Z-0V{l)skNx*mIQp;kS#61-_1Or{_1O-N`kcKM z*IoFAI{&y%ISPKQ>UXdFQsrIE2i`AV1IPWW?e$GK`{PbH`{PgW!m7``=HIM)xt8a6n+wNybAG-C-oDE9?|;GBzyE^!s$BoB z%mzXDSN|LVhkva98E~%u$#Aa!H{o3W7vbC=7Q#2x@_ZKj2Au0ZhJ{Jg-}c%A&h0e= z4tw;^Y0A4Ag|^qZaQH`i=fTG8eS9!n6pRK%4Wv{Q(hYh{HZUx8n^+wWf56`OUZ~Q>> z&h_V3YV^Av^VwXi$6OC}!*4X=vL5oCrf7fl`CfR|Cx<@uzl*%V`d<$JJO7^xM}P2o zd7g3(gX869V{A6KPxDpczCw-sJDg|v!%1%Wo5NB5NtC}O?C-D{Y`?9Eqy6L^67RlW z(>~wenrYadf^}7_FSY-@aJGLZINSdvINNtEob7+IL;k}KxzAd2es2n6GN zVK@w_pZAbaU)L|{n##d4u2tMJyqvb|%chOK>{xy~oX0ZF(XP95m3pFYIQQNK$K2z! z)O(GE90u984ECPudvG4>--ib{3|>p0BaX4|T6Ht(8f#bE;yrL~i}%9O7H4DMzVN}d zuYU>lp74-Wiu%&GkA}m3``)c^_Wf;e_`)iTkxndRa$6R534@I8q>w8GKz9+%Cz8`~geb0w;eV>4H zeV>H;QhmHP3VSTy=jyrqrQlq?-@(e|`u_%_RZrW^9PS2z1tOV_?*`aL_+@70n1 zSUA$#SI&fUU->GW+y3?ro}bvh=zVeajqhAU+bI84hy3LZ`B>_k^K;oR`B~nxCsCf^ z`r2A~hO56@-D4LY zT-U+Q?ICyk=({{V?t}aAfx-RLKf-zcbOD^(=TGoplf1kmcp7~n%bj~e?ss2B~^`%Gi>zkZ^0vzS}ou7BZ@tqy}<0s%e9*%><-}bKy z;OJkD$6Mgs{;q3s``-%Z_P-0x?eBaY{h~8 zw|%|==k~cD&i-&L3{s{+e{I{*J{za@(LZ##A^yqZ)A745@)*DRYgah@<#=@b#(1>8 zj>lZzYvEj9$3m{}9dOiF|Gx-l|33|9|9kz*{(l9|{@35(f9ux^=k{L#&h5{TY1c>l zw}P|%GvI9ho^ZB*7995f4u5P4KVCX+bN%jx!+*XPaXdVOHZsVcB@T9-dObWo2O zn(LwKF@x*!mpG4gxxb6|7x=J7+|qwBYW5_iES8XCqg@@oYrjpN?(W_x*78z4cm19)rI3tE=IA=T6^evcDKy z>#PpP-02?q{^WnP5tnBfNEco&U5}gIP$v|Aj=SY)_}tv=VI^C@?1O(R>ueqOyOjBmytnx)R*m1U)W=NYzIeQ zbF7{Mhkt#Ci0Px1-yymdp2}fxkMlg@UV)%}|1ieK2JcD#NvwSa+iMJQw3qemg|q)B z!BJoRzYZM!*S_W8u+RQtU(5YvBRJ}7dgYP+&E^`%PA>ljIG2AH9Oawe`?PHT|2Ds4 zp=p?5C9-Wc<8z*auA$tp9P2Qw#7+sZi`RBeH;egkGhyR zzaMoq9Bu2nf{()SuAu3?AJ6H3nbP~N^S|JD*V(pVs%f{)lzC0vmaKild22$--?`44 zM*0sSUpA%RH>J02Pk?jV+E;Vid>PLExe*Tk*tfn8N84JzXW(4Fm*DV+^Q5}-Joz`| zd7jkQQ>wkLyPYHRJZaq*kjG&AyH3pQ@47wO-}@@pfpMQ?e{k-?EhRX&&4hD*I1tYD zJqV8ax-N8X&Fezn`i^Kljs z_muurjrHx}vvQ3d*3DnAYJ&dlwkrFU-wyiU)8VNHDZ>p2#4JLLXx!i3;z>aAJ@paKF;+~AAe)- z7&!aic_93u|1X8Z|MI;ZoZH9!$zLIVjl-aQYZJ%*rupe|ZGE=SfpBimBjG6D_WWdG z)1TXsUi)%-lC;_S-vQ_P-w8+kZLbI5++Huj(O$~!Z(079j`n0NtA`g=dn%oCTd)X0AiyH|P@Jc5rrTHReWH*Jr; zt@-GKHN9;&9nNjN6P(*_c4G6N)RDg*&iOx+(%V;9I<)njL;gQw&GCF@a4z&aaxoYB zyAzJBgNwAej(&vmIh7szj*aLmj?IhVJT^`1*c{7YFmBG70egE}z2o|sD^KRV#+}z3 z*E`Nh60OZ%)sDn@-rg3DvYnR?fERKYTrZwMoaf~)z&9x*_>7TD(U5uB>snlgTwgy5 z_i`8<7w^C~QJ!_33P)Z4itonat2=7j$+vaz=5(-->zhG1`{q7a-x&Np@FBQ_CMv<} z@Z)e?hrNz1MhD9N7y*ZU`r~bI_`|)oElrQj2L00yXaCHBvwtpu2b$#Nx^*oa{;~X7 zJwwZ%3Fq>Uf}?!PI|t6?T@B~*u7PuTx5H7M{(slVMf&ysyW#BrW8v_x{$Gi4ocW81 z_5aGFhx&gNIQ;K3!EeIxOwjw~d*QfW9(_ae&dBRsjf48&Cy?iNSD%D`Q2l)o^7R+v zedtx2^y=Gf%p!gAL5bZ<-U*&k^UEJeZ2B`&di%#caP*J$uzx-r?=ma@dy?OB1MfIs z&mq+w^>4iRqVm+g6CCw5|7CF2e=QvP?GH4`kp9>U=l9>u%D(FwF3Ps=E(1s3wJ*LC&U3-Wa36=k_cxdh+SeVK>b2S5GMEX+ZyBiX$8gs7 z6FBtQH+G_5MccV1KOUY+8iT(592~w?-#6i`?^|%_Q~uKq`OiA!6T61y_dV*I-)DGP zzrS%Aa@WL6$3xb{Z-WOlmSFk!8dIjh`=R;7k^g_=fBR<6zirB|{&#iA-;?BCD=fd4 z!{GhmkBH|LYWBij;ymsbT_-4yb%OS-gzdS1_}nP^hx*osv%YoVtWSC9^B(LpIQQMt z;el$8^|=Vn^}QI*{`wJ|?Rgpwd(`i~X4d~JIP|YT|8X6`lBxvD+ZoQ~^>qy`&wKS; z-d4z?JpH>9+*|ee{=nzq?JN7f%q8&4l^q{nh6gMEX}{*XfqPYUjqTr2iZ!quy zH@^=v#cMG(8Pw+>Br>ZAXjg0ug8e|Dhi^B&_b zaK6VF!6XywKK<$6pUwVU5$>z`E#I6|Icc^<@``lle4#)nI z`e(sef4}L`VNk#QFY7-Y4*m9j^+$j0WXp3c)h-YAxk#}4W1GOSKj!?f73Jo8X6MgA zjUo8GfR%_RQ6_FJ$4CVP`_>l3y&N%*D~t11Pm|K?$##66uP4*s@PX^CQ{aUh2G=`t ziSza3PB^#uUGM;h!F`YiiR1d_{_pSMy#H(aQRaE#z+Ej6xdj6l#2lZbl-f^EDLan#Ri*8AY`3JJE^{>0ISUW4Sg26f6EL(0QG z$B=D2kIxM5sci|z7QD5`x&s^T&aL&I?NB#>_e(UoUIM?^faMZ^+;Z`{JkK5n@4uijY_HE)PYkO+1 zwq$!pz}eoV;cTzh^K9?GTa&1NHOkBS`Dlp#&Ec%yaTNOX*D)RPW0PEeFsz68<8nCs zVfhS!A?447qkj79PB{B3k0<9)_YCtK`ZDYoGHBl$#`whGn&BVB*?#xQvV8dt|9O4O z{#h9g`^tM=aDLCo@s!^)a^EKQeYEFxIG6V@ob7qEL;l?k`Li8z=lIC)czghk@#=eD zY(2H#`|@1{*CcsQ+Gm~NFVov!KfVh85ZpWX8*#{GcQS&#hD=8u*AV9y$5Std!TI2$ z#Dj&H>psx@mYjPd2KP>s#omc)(xrwiT9dkFT>+k2Qgi)h@xB&3hr_Tx759F9!^(Fc zmrt$yL)d-Hm>>O{n7*gCX_b4wC z2R}2|H#^sFyCBEKCAgu1*rR-zB)2bleU83l-Fso{Zm=(&K%D#HOgQwZ z|DX;&BC+{@1LypYB)R!rZ)Sat?O?C1pCo<0ww?(Oau~GtCE~ExzCjgB9hCb!{PTz> z2n6|l;$YJ|H}@(e9KCk42fSm0g&kYL-{ivKdgO#Ee+G6Of4Z`A_b~q_`Cn@K&(`#^ z_mjc@U+AA&^}F60$+6>B{6m;dM?I1FibBme{TSylPWMOtWBBSM|4Ek9>3*JA+r5{K zx(|?lbNH^BU-_;{uJ2~R*>~4tWaOVm{-?VZjUDqpn&kTKIXHaxIO&(5ar$d{&O7J8 zQ6K-t+U4*zlxc9Dd59zC8QI^54>tdcaO9VNlURMP!J*H2bSd->7VWIt=v&Ki{#0e{ zckD&|wD%owf09p3a{aRr9R86_A8h?Mgrol6>)F>G?*`>h6NlXLFMy+b+y9SnZvWrG z?fN4BGo0Jsd9*FZ9}5y&f5&pv-}-so?k9~werICqvqRUS`gF4PD-Zka55C?kw9h6t^DLFg@e?(_bFpJM;c`kfm?zxCS`?&UC8-T}s` zyaVB|ciXQv?UVO$)&GN<{v_n9!C6if+wyNCp9lNip25Gjb2;(9YJT}8`veBR%X==dHW;SeLVqWoRQ370r+dLKkY|LSb3_>D3Ew$iw90BE>fD-7 z)j5*GqDJtC!TAb$;U1H9ulbhVO+9IBSe`^-!@5i^_Bq#E2H$D0PVr8IYqPh(Q#nvs z^tXmJd$;yi_2mAv4jlc-{$trB zbsA)=8LWLE~#ohmCo4-Wa#`1>OG;HqEVW%MHU9{S^BhPKa%aI}wWi66sH zHRiP}??9ZC%R2~;@+^PL#LrXT#g||opw?gh0s}Mn1j>Jc`kqzwyH4J4sYP?U_5Uf8 z;j2|{`Y$arH2uwRTnqgBgZ7W-@ds`zW4kqcNq>g1gcEP$nFnXlUY~{Uf*ArOD1Vi_ zA@_Tucfzp`>{weCjlk>vV3?-lFv)>=PVyyEy-U_^4Bb%PUJW; zSid#kD1Y%g`TiojRwFKQ-@^#`WaR$#i0cP~`M;LrnWRHzIG!n z@@?VJKO6aZuzl8G{&SOD`_|+0Y~KcOa@zn zBmB1)`46IP9Wyqu_SL2?&y2>x%U0c%?KsF~F9%221JpIrtEZ`J6OU3y`G;#bdi1g5 z#_%|N4mK@T3s!y!9P;k3bDbgG9@wboh+1Q-uHe=ZODwrKpBvszdi7tb0R(;IceKM! z``7@SeRKhweRLrlK2qORaMpJv9Qu^&^N`EKsY|fs`Xdf55{`E9?^-?puU_TWZxXt4{rt{!u3s-4^>YlFK98YQ;TS`<>jrR? z=NOjre(SFAU@iZllX+(tj=!sE{?k(a+mYV|Pv$VJ-$z;+bxMQf9%^xTYGw1k6^`@XT=9v!XHP19S);yMXB%I6h?-Jzlj)0>)+t2j5{SJq7``rac{r!8a z55cQpvqArKGmt_qpMfk`f6Lk5vi^?oH+JlpqDwB#+TH4^&0EIbclkW(Z~f$4Ki90e zey$y(ezwo~aBd&x$J{=?Z<6)t`>by-IP^I_Pow-iKAG0r_WgBE(-)uTGlS`86X*2% z!BHRocJ|`%z1U=sw?6@j%$bWY#$u+tk;52z!TY^$ z62Drg;a?_J-+#gC>mjzDqeqP@Gq+5W@XxTg1!)~WzS*06)XxdtU;c%7LLtT=zEIc7 zmH)I+vz8xM*}n(62j{1f#vq?V9Bg`ho73--xmo&_1#1q`rJoyT}Ib0!F$ymIHOu6n0^*#k=}dF z%V5W?!F_G}Mqi<3pVz*W_4UJ9pZT-C$Kb5*dvNHpytO*yOjB*S_U{Pi@{WLWd7p+Y z&$cY%q-(gRt>x&%#}eNy5Y%PA$-2&kL)VH&H+9`}q^Z$|ZBH8~Upx^H zPVHOZxOX1A3D+n1iz*}d?$Wg|E-%6F`^|;Jp7Nb0cwv?M?vndh!#NDzGyj2e+t=Vd z^B>`X2Ftrk|AO-#qJR4<^xO7V!Q*Rs>vt!d>-Ph=ugdKkuffrl@m6ogK*emeO>?M`d$d<`d$y``rZH!a2VV(wQZxm4veSaJa)$7k34oZ zg7er}7ml%G|2PZ|`}Ei0aQMsqbO0RvN&h)NXaCKI!+$4|-}U1a*ktf~9N&k1?rE_9 z`0iEoAIm=v&gJ{vg(%B;{!YR) zY>D4V@OL1btNa}Zv!I%N+2#kI%4KS)#_$92gLBCKCLqZ6%iy#3q>sSwDVZ9%=|XP$ zRXVs+?tOPo-&x*49rEQnc%#aiKy_LpTzD9B6tlZp%?I$votpO+^ZxeMe12q2p`4}h zko|A32_d(i%z&evO#icv^v|XA%3tY_|0c<8XRlAWoqe|2$7cq=Yq=|N{;uVh;pkWP zvj-CY()NM<-izU{ux&iOvg_7^&_Aycmv;b9hGSfe_!jrC@Y*%K?e`Bj+UNIF-gzX_ zkEH$O7pp$Ycke06xBmWyK=!wP+f;v!CC?Hi-=uNFCJbY@2b@G}2=%tzu?EC(Hdi(~8 z_d*x+49$NA9QjTE%E(3Oz4zIC%%XcA$JQxuj4l6;@r|(eO9sd3)Vq z`IF&n|4ML_et=_`7NLLB~|?gZA&} zgU(f(!E-naj)DD&O=D30BypC%42N9(?r~@R?uUeapKo$GZhv1IQ5mqtG(&Tp?`{q2 zqF)*G_vOUd-;cxLZ~gDP{K2OGI2`Ha-z7G^Z2HmY;j~q|9%s#Gqde(n3D7mIyPSjO zbIy%&Mx5XLJ+(jAcCwrcnS`R;HST47gYpgd%;20o6^=RE{D)G<$S+@uJlOpH{hgeD zG93Ax^Dl$*obR4Nl&?K+bnp$>8uE8<&fI`qGdQe5sYd`o{UmG~p-D84j(la1!TW2|e?hd%$g|r=e$lv(GMLYGXsa3w6Cdlh4L+7+jBU zL40b>D<7U%e>?(*Kg>^(A^G=C>CJB)L!bG7obr25X`P`88)T|16kKJxMTIM-qmAif1%9>evR$-(8;z`;Lpj{O7`v|2HRbtwZL0 zlfnG{-PW9cPdMj40FL}ykp5!$#?s*2r!&9)4*l_W+@D^%;n(@hVEI29+2q&c<;tgS zHE_0EYuvKSmmyR>oj%BYGlE>f}lw%Bb-`C8of2`?!4?*4W9)j!0kHfK!v@Tb};S2Sxj_%Os{qhbl#g?G_ zV@WQ%E|2tiy#^5u!Iq(Y&mUZnW*c$d&-l1@m=a{_@jxlO^57ACh zp8Q5)>vtfH68g+Pk+LGc^|igCzP7FM+_qWnyDIA;kM^*0VU$gJ>!`heL zjMpH&a@Bp?kdS`uW!lBRnrp@^s z2RZ-rj{J`I$ge$n!eP%zS2ow|AJcaXet&B+@%Dupw*255Hf;6|g8z7C!!f7GUZaDL z{C2Yj8CU)5@4GXNw4c$)XD9ZZnyQ#lNlcO7w*xAp_gv-#)`-rwJAIujFIGd*lfoelOsuVvBR%Krps`D;nO z9s0+R*Lz}v{`Pke!r%JW`;6@0@o@Op_HzxD+28(=yE%F|-oh%$^V)<+n|kg~9QD+% z&KKFQN5R>zpMa#8<7Kz`qD1_Np8EG4EI&Je*X>}ez%>z(UJa{lwSL{V2piY+r_5Bmh`jmw}$IE8a zZz`V|wD$|iAKH5{JkW@XzphMj{p}uFl<#{UPm#(Jev#Prco~lNkbjrh z{xAWK{$c;w7S8?0^;^hI@4Osr`KHh1e;~2#HwTXP(|@@=wf4y*Szm4F&n%{YM2RP5W{=KklzkM;-dHXat=It`R(3Sn; zbu;{-f3!W=>*V|3UJirv-95xH-+A5rG(4z~;QV2G=K13%@EnB%{qrnw_(y#{1Iha2 z(C7Hv3C`p5W;ptT{oVC{_Sa)@Un#A*Zv7gz{@r{=_hWyr5!x2(a~gSVi`C$PMqK*x zMoDg8eg_=7?Hk*{xo><5&V8dF&UHT-j=EdE*W_IOqi`<&-;HJ4*7d4&>mgsMTY2NU zVLxkaw(hv4j0yI|$BCyFYTB}w{Na1$Tf-sOKKEv`eXeP=Pu_DJv8`UsrI)^2c&CC8R?OR)By4`+Kn3x~bKAL9B5yY4e+ zk9{lbk^SCGu<5;4=JbC}a?|_VH`3dGcST?BzuK4k?+4*r-+kbyuXDpea4(0!{&Ev> z)W`93Gd!S>V0~{f#wJ5)AL6L5bF0_NT>g%5E*}@R%eVbcg{N{DTw7dB9BT{hxgU=5 zw1*;w*n`X3a_#vJ9QNq1SK;uN_N@$O`zFHKzE$AxkM_9^3;VR^NI2W`VL1E8{u6TT zIR?)5df7bntj=@SKb$S@HLk-zZ;gnx1udSsO@8W{Q}PR5<_7)iwLR*iecCcdA;IzGwL0wcZwjvlyFN2m-v2b;b}Kj0l8cQpau3_FHBTVe zm%ZjiU$*Si;av6^aFlIXFT%NQFTwhnAz!{%z%Fhn5^Nn!$5@g0Hi2*@JcHPMF~c43 z<;348#NOi8&HeIVW!EjXrE_1qE{iQuYVLmfg?yg(+s}s0+fKXqn9*Qszbl(I&wsyl zNj{%dG&SEH%B-K{>?i9HezFhPXLBD|6^=eI89Ao6*6ZRQ!qQ9t>k==h<>}{T;OuAh zWj}8YXFtG*H6#;dMB>EV1cjyU_@arCN<+ z%N{8l`)q%wg6J)ol?(5Bf^S<6L zu;rPBQ~xQw+vjH+fUo%(LEGL(9JZ-z3T0(o)8UYte>Kuaer*{GYl{U~*6>mw?T6h| zrFB40BUA2r&Df(DN91!u=i(RrjNl&jpNaPYjS|elYvb4|Ad>;O{?sC-K_Sy~3?UmEpJ`W&|zA|!~ zX5Dy)9fP3!1K1XFxxcbWJbc5;cnJ=qqk2osegcz;bKO&ky&nyBF5DJfc`n=>9wZGa zOZSiOe#y=~hWR5$%^x{>{>TaQN4|6Z$o~6AHXpZqFZNE(8P+A(7eCEe^hNuT<-gd7 zOFwe|AonA`Tao+GLge8~$HEBY;cK6L>_vmbvyZ;Vki&le*sv-5Y0l4Tu=w&`9F=|f zO5z3cS%WYZ;@OV+{0+s>XWRY&UD=-d;jl;hT*C*OUN*fZ*+#AUMA9+iToiTH*3ICs z)x3`TT-FRYbX#}xN8RlgKD)_v^PL&lvOWBbEW__ni94#}vYc$ft0w+g=}eQlS}QGEvRK|$d=%x`52wSqA8rE= zav1*WmS!JdEe9aMweTeB)>{bM?`JNjg7LgyI`$j|FI(l__r8a^%Y0nzX@uIc38!Jp z?I$^^7wb{GCQSr4RHya*AQpJ(N@kU zkH9gX=xbTWYH}HiV>lt$pVuOe{_OLi!{K;7B)^haTl7)XO%-$~x^r|fk*SpWSJ z4*$v1>Cl<4?qJ_0&GG{h+ke)i{IK8tLluYk8y5}n_bj-N!(ja<5l4Rg`A#_d^Br*Z z=T>m`=hpB5hr!<&cn|Tc>M#4}#c=MQ-++5L47ShPNt^Yp4TnDEU0p-vuIobXyW+j1 zf3;E98uKLYOThWw<8nCeJzOjN0e-5c_a4i>sZ9od?@4yg!{FSYe+LWkUfmBH`IjqO zzWpi6_nz)n__iwdp6)KrC}Gtgo1Uhi(=xYsj1 zE^ViGye$LAc=8>&HQ|_Fe8+i3INou#zpfAG{_1#){;GcG&#-4PI{$X?)!2jTaxH0% z>?zhcmZtDoj0MM%W5NDlP}jSNv#$5U>M}TYon>6vy%z22Q%JCG%Oi`rxmWQ9pXa>_ z@2_(H)#1qRSkRU{R=maza2S-IN1Wy7!y(uHnQ+*zJ<7r!=YqxHsK3wgM!@kLPhU@f zt&_q1k>!cQ*OosC&gE-+l<(Z&b$S+cGMIiUaZazlBfZbTY%8BV7);+woYPxgPQMNu z>CgR9vtP0mpBXyG_JhdR=JN-OlxKFZ*Q!Xr?&q8Q-_i+$Pd(l6?hTgolR1y{o%+?c z!+(%RdC?d7eUqa7Q_nQM8mwhGZ&&XdkV+8*}3*}S+v@;ndChVwjh1f1ug&%jYX=b3w8s$GKfq8#%~r?0htGvrZ! z?U(;4+*x+1ytubX9@?6^k>&Bis zmgF+3MviDLJ_;asKXW8;zTY_t4u5^_q-I@VoeW>8{N84Gw$A-Y^EY7^t8)3roM-l) zKJ#i_i`co?xjW`!{kJ8o|D0~Lxv#gkm#AN}qe>b>saV z{7sw`a_#ZEu3?Y)_s8Cl%m3`)eQJK~MO4;lM8#g)Ua#}BI_1oNmVUO`BifmB+sAy% zFWk{eRr&|qn-;QLZ4olUt9AnnInVY?g2Nv3Zwu%A+rj47w<9^C z`)K=CVAv|pOswsvz+tQR9V4-YB~1z5x4#wct!#ep!9$<jjl z_cP`Y_%05E_4WHOxqhQl{gnG%=#bkNrZR}5FKEAihcoQ|@cPa5YMZM68!k&!%%!woK(NlfIRlz zmGl1){&Z!t=v1n*sGOCXE#Y@Q*RcE=C3U0!o1AC;--5ILd*Q7A zcW~DKdpPU=1Dy5SKePVXaMphaob_J}XZ@zl`t8G^-#K_y_(&UsAfHAY{51YB{oYmX zT%o=$;xWVq zKCcV*qmhK+_o_#QOXf&A#N;h4_6pcn8k6 zs;tgyI9I1-JJ&NKtmnUudoE8y#?1k6j2p-K9dI5ecfx%fhX3?8j=VRpe%~mmSvO*& z_jZGoUCZ}#t_=pSJ^jRvZG+zfzneJL!mi!991K~zKMoIY7`$(1XtwXet)KOEY#Ln4 zFG(ErQ=j(+Hz_1|udp(4=yRWhW#5o}67A3a@LC!EaNV>5oYzgZS=86(EXw0K%YU*@ zx%OrIwJ+>{#%^Jo(1lj%)?4H>a`06T`w@s{lhrqc$hr&@G*Iw4Wm%|{_L~Zu(p`QpJ zrjYQ*1Dp1_xWU#7OyKsHv$~oOI(dHzvORqV-yqvx{wLO7y~x8~7rfBee^NIe67-k$ z&MEZY-!Zbjn<2~f-5iekZt-ICn;BoM`45Fha_)Di4F7-UlbDsP|JSR%o$Nb@j_2*I z48gsMC5V?T)XXpPVC4;8ZJr6tt89M#5&31uQ)b6gu>K-R@m~+I%^csumW!F)Bf32| z_&nb69@l8+$C>aw90vC}_act=?fjcP{*A=bkl$1Llk=Z>^ZdsYIb^>25j?qPWkU3>;;ED_4`|UnP(@qzaJ0h{(b@+{aycF0B8T64TpXD_kMU`V_vzQ zJP&7oE`am=|93e1b5vL3Pp`j-+U+kR;-BHA8+fWcn-YgT_6L0v{lWIPe}sKMxT5)9 zl)r^#(B1=xv%S~B*{%f6L14|1bD|YX8IbXvW*# zq%pWJuTNrpxi3Eoc1|_iMdfMY@*NKOIF892-xdh2e=bD9ga!-Wp7@BW@7yYP?^XS= zx9s<2Wy^^6;CDMpd&uQvSa)eAu=L;A#NmJY?;)^lWU#*}%l+*VxKANLxpRA#Zv=>UYln!0LCt z3;jF)p_w0@BMc+)7gJ>GuId4QQ_1U9{#}>@;j5~C+izbu+Ryg~m3vQNxM{QI`w$Oz zH~by=eop=S5eCcaCC=s9-!0F!@UUGB`~I7>j%SZoHPQCy3IbR@s;zL z!S7n_Py9lm|IS`Z)optkZ0n7PaajqjH5{w4){t$h%*Q8oE%*sIo|(xE-ywW^V*ARI zaPBKVg!?!QmS?}u<&mY$lRn+tt2L7h>t@)h$5?PJja%E-x?Pcvfr&~uloPs7`+cYL zD}ScS?||ukturfIABOjk`pinKJ;inlC1{Uro9(f@L4^eEnMh1jg7!?|?5xV#BWHVd zfWsckyV|t>hr2hAldGuyzi;<+W_o6_O!g20bT&-bH`$RU5C{kw5CIo7fFPh~Z~+m8 zPFNHW5CsGgMQ{Q1E3SyR1pzk{aYMxoQ4~}Z_l+da`&~;eO;?-@a4SC$FqeU1fdtby?qg!DW5ovc7ME)oDx`n^j{VPqiD|i`o7hKdasl zpZ$Agvd{iJ8h-B2$4-s+1>cZVq%NsvFk5I!V`A4H$MkY= z?h}8b&;jqlA?ZWoq4c5sO*Mgf?NR>ga7y`m!KM5^!P;-UIQQ!15Idy&n~Bct<=;$n zznATCf3P{e`wV%K{%sZhb^TwAZtGCzutJ4?@9Q5&&Tm3KcDxfGk)E3RL;XJkm->GQ zep`}PzkKye*WJKcPkmG7MEoa=UjRNY>D&G7vF+bW{pq_Iw?g#uiNDWv@wvXA7yKQ2 z`1WndpIh(;{uJN8@byi}gth@Y7Jrto@ge2-=*3TacU<4{-+0@8=eS<_tb^p=iZNcu z4)i$sjix4cCO-f_j;Y!icbxH_Gv0DWGu)f8ocH36 z;GEaZ*Mp~meV#?~{_9N6<^4=vrTx*IO5b$w6r^E&Nwb+?1_cc;o5XIcIzjCdHlx0ONe zV~@ozITn51p#%PSWQX5gT>{Sf9>VsU!QV}M*T9G5CqG&LWYSsQeVaJ%OI_1`Powi1 z>zZ&H{BliL34UAB?>&akf^)}uPxQOs4<)|$MD3&139H|+TU zly$sGe)s$f&bKA(I^kH&ePw+U;aMLcST#7RNz4$?(dgQP^H)+?@sS07EtqAndR^j+ zmlXI7EU@kY9_5gJ3*LzH7X#wH$Z##}mGd~(mKhw{A{`AM-&JQNCtsEDb*Vn()t}|J zBdxuca!C4yq0sfsddfc+tUo1v)8<_IMx1@4{9C}KdN^KTj(}TyuEBQ<(0UMjPyP7<8vL|g;S822BYqnY4erK9>{U`g>cgRRB zti_)YKqrEYpM3&iuLHh}^qmPSuRlupO~G0IQ}A~NYoqin@By4Z7f`Ivd8I5r4_ubt z5?q#F3bwp{un)(Li@(4U(^NK!ec@zs8#X-GbI$${uj|3?mooqN@NEyvV<55pS7NqR zU3|-wTJ-E8^{+#d$7xjtXPX}aQ*|+|!l3btIzZaXa_2+rBbzZX@E5p%T{)R>^{I;+3kG?Ja zb2K>Xvwe<}jJ5xEaJJw2f1UXDo6YD;Z$B1$@PO*Vxh)g41Aor<98iqK)ueO%pPEw( z?QQWSSy;5PQ^oL_cwO)#v_NbbD<$M%s zbv`ogtM)#A2AVWKt|lD?g8%`YU8_a@B`pw9MaTW_(Z^w6wJ~y5lj^TPM z&9kJdwjYty{U(y?mVEx!`(Dm9($nEzNQDLY!7!tyUK`0D>BIM=8AAv8G4%ikUQGhciVot&}uUk}dq ztN#z+T)%j40y$&LUk1+Q#j^>Rj9nY-i*jvnyyckvK4bJDaGOIiMt{yZ&l$l!aMt%& z8q;1AOU^-CaL#j(Yx~~dJ7q$@qVpWX#|FeZ%aC`BKUw)Lo)XLFSiBj01oGF>CzATq zpY{C-{wu-GvyK(T7*j!79L5z_kg0gJ)1p|v*9y{7u;cxhfLH^;pF=qN=ci!DLOb!d zUmX2uo19PRTK5h?y?AquF11K?#(q>n$bLDPbJ;J4fOEYspdOa#@UBqh#pfk#ong#1 z3u84|}VDMt=v1dSs&@72M%D6zFKHTF{Vr{=)8K>sYy-2~{4ps% z=-x($b)eC%;tTClo)AOv0Z7TaP{s@1;mMMuL|E)51lLd%aALP}aTP4k_cm;Tc=U{er)x zkmiG*$@wb*@h))mEh3%uDSs%qlwSib<@YG$E$@AD%RjhaFnot%n-&I-k${Z(!H}xg zmeh`|olrZC5@*%CF|j)2b6Ppi8H2tE@{Tp|77zKYQkLj-|YWS%qZY{<*Le+RnG0=uV?yEfaL#3q1Gm7h;gG(!LoNKa;$~v)$?(5m zl>Glw?B6;n%daT#6VyK!{eMdJ5APWJ>~COP(~TEx6WiXZIew_B#Xo2DG~_=(R=&^n zEbuqL`5Draz+a|5-+LpS1-_f~ha;@s41P08PsNFfc-?dGvbb*NbP^3~`A`Dw`pRl~ z{XVV{?9oGcC)MGBqdgasD($%({n?&};Jo1*|GJ`n<;A7^A2%75w|%eZ zY2TaBo!h7Vi-^C{{srJ{zw4v>_PjpcOnqM8-pU~vzklG|7C`sFcdmITAkJXNVBQyw z<7UOV;B%-$ngwGpEQe(KR&dVk`)~XiTvVTdy!S*T@s*r2 zw!gWY=*ENiz8?H{Y{~H=-}gFY?07ir$zwNdg~Z4qbt zToYrn>!CN^hOLfiuVhAfwJ;Klv(F&xIC6dqnT=QuSpAH$9nLeN!hml;Pl@MINbG*f z3cc^)e{pmd3N-*y-wB+{@*nNNYkTnjprn-F3B?&t+=X#TT~}HeG#k7vwhV^Jn!P{R z`(&BFIrx*{zed9X|3?M?IQaJK(x8oJHNkDtdCx4LWq%C+-o$qwqyNT*O>%xBJYIjy zBp+f6x>>EZ+1!0LtL-!F|6{zBJ+hDQ$n8|sns&8Du}Ic!jOV(=e<`rG{JF=LIkcse zpMgOoerXS0fFDZ!dwTE@__5?a)Ps-5?2;o9$|7nHnm54_hybQefwf?F8^ux z-vK+$CENQ%5C2HwsN}zag(8>#2J$DtKPeWktnUkKQp);%1J3e4h5wcj<|2G3DSyY5 zvGR|Cm3OZb`Zl~+dt8Wd^H>s~{*nG!98>xy_fI>Y^!_9LBb%eSs#@G6{5t2=sSfAe z38dRHA^GFzv&%pA@ zTmGh^y!L;d7|8Wo{sw%W^(ns{eO}gg5IFOdUr}K7-3ZS5#J@vd#+NbgIj)||5)PhOpJ;bD-4~yM_k9glH^x`JLF$06YAxEHt~N5kD(g; zcb>jXI9AiBCw0}qd-DA@U?gR%0C$kRltVfbd?xLiR`A!5mQUEEXOFsH?N>JoM$-Y*;Er9-S%4?tY z45pXmW_!u(OUDfkNbNYY-TN|t{M zvbntacP2mUw|onn%l8wQUQ1;x|4%)*4}F>c0P@Ge|2Bv8NANkEe-#kx?B4NuxY z{DtsJc?VFIw|pz%;H#h~kG%Lif&Ft^(&zI9Zzi4bsnmBF_|u91Ch(=C>E=K;gI`bj zhBO|OUrl?mynJ!y`)tT9l)N_<55K(-dk;iXzilh^|B-ylTLr2($I4G5J(uGy4oTZj z=A3Q+9l9LX+@=pCUtIDZ1ZTeT!^mc={1?H>J1=d-QH5`NI-b+PDUmXc8>rE$^|$uv zZ`H1C)vnP0nf7XPzX!pCm{TNi1AfN-E_!pYYfvE4$8zKez~42uaKxm<_jk`zz-y6_ z^#3$?rT?dbv;Ut%eOH4|iQ<+0bAQ3F(6bx*a((iB&a5ooA&_$UGtl=(CWGfDed4z= z5HtQTczbx58K}g0{7y()GjX0LqO>^}_!fSbVieFASq z`Q2cj_j7BI$M)cq>uTizt4qr5-bJH{R7E#76ZZ6AV=!zx6&^Jfpie!rPyMd!O7ONE zlH<<53zEm3J{#BIxwz!B4dLSp{*}nT7yPwU>-!SkH5uo3ZF6yCJJiN?GyJF0z*7Io z2|MOI++|C~UyE~&Kijc{Be%slZ4RP&P7|NegMWb?C4YztO5919CPcrc1<&}rRjBWYhSys-!fd6^U?@03Fme#7DfDcLXn}X^7>heM#+q5zI#=JP1%5a37fxW`o9wszA102<-wO7A@Lv-DE8zXX)3Mzqgl43d z|2ZFQMcxq{lD>2Ql6_}iJKnQz|AMa1fOo@x((L^serJRsHvUOE%d4*sJF-6a7tWW@ zP4d0-k@dNL=kkv4rQkdsUF%K&muuaN!FjFIw~nvuYkhMyIQ#P7>O+3t9{Fb!^4hZt zN47`%#o2!AyB3`5I|6@rulu?oJ|N4#mm`gFW((6!Nx* zuJ87rxYdK7QegL6&jaTWXn5l39Fp<}lFstRlX0BmX*Kqh>)Su^-yHb;ZsH*QaV+N}0*dW9n{?Tp zbHQbM#JN50r*8wF$06yTA92on{j(+ZmHK9aOMT)j-`hX#-*-k|-oM*k<14q<^~LzS z3LTQ`%K@D8dM01nO8)5u-}-v{e?R!8y$6Czd&Sva+y8oS+5YPazU}`bxYYL`xYQ@k z`fT5B9Jzh=r|rxAX*?bb&gE}7fM*@Sw~pfjQeJ+RzlZis1?T<1SCF3qeuXP2^iQzy z@RUY?;WrNQzZhY4CH9YyJ}&v!y|viAwJIE2RV${Ma=Ti0ZO&w#J*cQ5#J3;q!Pmw&+^ACToszVnFWJi<~P`m!(NM7(iI zZ^zmAs(pB%Z+nh4w~qeaUJ=LV;hgjM)UGSRrCsNOv)%23V!xglyuxot!C%8?3z2b2 zu&;96Btu?YD%SLUxvw4Gzj|k1r`D(*59V6`8OY`O_1m-1UHZ*?cDepu`Cn20`S3U5 zko41A3VHeG75smKhp_jl^>{D8DGGuNHwf!t&pxe(A-QzXEhHyt_uW*v{7aL3E`K4|zoXOT~IssBCT zQvW63tWW)y7Fc`!(IfwG!B_s51^x{9HH^=!-~O9Q%;)}o0KRxz_J5N5t(D+%zx5LE zU6CE;$5(;#{P@4o_qQH>f9%osuR@>W?$PGharYf?_E#_e*VwOoZlCQvl-S7F@pK*o zAdjc{T*$tNwya2Vmi^)NXx1;^wwC-WdiX3^WB8L&yc4!zp8O%YO(?2DZ`6YNB^4cNE zzY^KZ7hgujV=$GL*fE~5`VOVdrM}^TQNH>{2$(ECemTz#Fh<-bNjrg;P=6~R{@xGr z;;hf-BmLYkk4tl2l{kCd>@1Utw=9Uc;L|32fP2j#P?Z4 z*VuhI>@WKvkBL_vRtxvDjfc#uX4%{Po`i)?n{Y*-cY{Ab%Ke;uj0AV z()*tseS1Pc@plN0y`2*F*%*DD`)VOKkB$U;4I{k(ya(r31;hvSJd;zlV?+FB6@0&A z{1Uj$A>D&M>)I|LzRLygKw2B5&Dks%CposP@6}-I)1UTD7Cr&lD}i4z4_XB_uAUkY zACx_wlVv-zhC|udCv*yV>LSd!VY>g4XLyG6yY-cRKOLOg`!IDp3SPz`4IjlbF!=pJ z6+?di?K26tMp!L|za0GHgbxN^13oI@mxG@UHlp&J>@O5N#4&E_wV_(QHoLZaZHroe zH-5CUjGxlZucG(+@DJvYwDY}%ojybE-Z}eDJN<1ollWAX4j?_~tFeI@x_ za>mAb@Z-UU>?iO4q+gUj{5jNxZP}+Q!N&f%*rV<+|Igcep0f7O0i4VJIS^d-&)dLR zm;N4)ZvEZ0^Pp!e0R}tY$2t4J_;F4t<3}H7-TH9z!iO`tSaGlGyCWohcnLWB(7L?_ z%5_`+a9AZ{-PeK3x}D?7x?cj$b?c*}(Use^lDfA9JC^iMh-aR^F{Z_?v9@>|$ApBO zbBu{HW*z|NI*ggU(3xY#81TFJ90N<97w3`*Wxp&~xWJlDgm(((uW_`Oj*d0f{V;Bo zvF}!LF8l5k;9S3B%ksI6x1p1zq`HwjN&l*>^smnY>0inAoy56pU+F{J_g(n8ed>Q* zkAANovwqv}Z$fRqe$~gk5}ce-T-D=vH19MzXkX5A1kg3$S8~qyG}1Gv?=G3p#s@L( z(e@Pbq&oN}(&amXUIM-?)X4qRUAPYiesRLHUO+rz)cFa|S;BsT^c_)MwJ8I|XWZ^A z_W z4m_6l#-6x3^WIqS!{86b;?;}5zXIQ#@TuTOz=H{24DP29+AUdr0G!Le9egB~=Kj19 zJc+<~ZWOP?QyF|2|F?aO_ELO|y^h^npZ3lMm-c#XuDv?UgZDS^$@{vFi_ff|6A<@{ zwxe%Jzb0XSyKY}BPxyG`)%Bc&F8~u>={^n50)w54o|X9iUVS6dZ%ueD`~{?QdHF9W z_||9nvOf1F%H#4dM=j(mSytP!?h{@VpG$fNdHTa+;lhP;>FSV@7l$m0lTi&lE62?r_h&Y$b_B%Z^`+B#GiV6++)5vaEUdr_r|`P`1^rvkK;jF z0cLoGzau0*6Z{O$KTQ0qz#Z^o3Ev9#n)uHJez3r{dL#Hlr0i4aJz%Ey?pSr-cO3a`4y&*at9kP__vG)ccICXU0P=TNOF0`qlD1fH zY0JC7*_L0xKN;-WAz9aL)ZGq!T;ir)PFB$^-Jn= z&dvHh2G*bRlD-GPj^#Fobim2+86NA9yyli351;Xx`*Wtr);B{jzuvC5t7EFUyt!>j z-$8x%_6^mC`VLDExZQ_NulbEr=||x2an5VOBVeyZ^7wE(T!{XC6^2~9j-3D5x8vskHNY9ws-m9*!FrK&h{GG zA-Ll7Rn2CibFO+*s#|P7ibvjDA5vh z98UVugtuah-A_8dQ^WrFEI9XvYsL4$d5j%OdCcnWFSX%cX{_*AnHm)*wb_{tL11I`En#e=7cQEM@F`>w1^x&vMtIO=Ek_s(&`~u_0_!`C2+T(QI z(?$9K_}b~XeR{!Ll6Ypl5n1Q5vjxyQ!0O3sy1(^spZoSy*Z1K&SAU8_`WyH>&Np$` zABx4xoA_y-^;gpxL(8iD#jvf%g^np>LXSk zNWQ+v<(p^3_o%!w@$JWNkk0+6{+Ac}TgW>$UaWG+czQGV69L6%$;J6ua_dt**QdS* zi~bTHjjn9J{_r;$*&nulGjQ2{aj9&xh<8q{y&1t`u)vrS^qBJlJ7mM%=i0w_p0Uh^9O+6 ziB2gz-vqWzlJ&m^oa@)0zIQC^6ZaSX)xJN2%le;9BbB$UsHz5hF;!}Biq~$y8vpwu zQ^x;(;2i(f_Z-UR`t85f;IjY3xqj_AweW|yjS-ozz8k^WK1}BsocN}6?G5%Zp~f@M zrQ^Rfc_w62k_#W)6U;e)etbdGm{nMRSAwegNZ2##-Rp*1P4Yv7IXO0e&N+|G+g}^;opuWJUGOZFe=}kG;`Jyj z`(g)h*%v2+?~27kU-+(?+!vPrF}N&$1Gp@I5BRR4{CB{)ymOWB(kbVvKfy2ODzS6b zWOUeW=jz}-=WK~Qd3m1^yWLz}H3A%{YGIelUbop_wfd_z-)xc(+YK$G-`tm#eiN5| zdkZ-G%@|xk6=e(_3C=NS3|t8=W8xb{%=iq}FVVMAFq8WyVE4B987!ZndKEZ7Q{^*J z-vXDNH=ZwHlFRYzGhUB?%l`b(oKbo8 zePiRX`i?C4+PB#zqw?Z23hcae7``dzrK7;*y!3kTUCDp0G3S%c^OEuR4saQN?xnN6 zj#uZXa=iWvoZGjM_~KSb_niPs!TZBMA;p{gkAqhvY

q8JPf*?uLo(s_P%!ne_IT@l=e~=|M%mW&M70egw1W} z>T$9w{{3JisIFXlrFaXmErB(#99-S-iF4O83*9D;?yvaogEOGIyyBVCjjUik0cD^R zxVqJ|>Bh@2&qG(||55y_Lkm#d8CG|aXi;WRzayWWJao6ZdT%z$!xjlA-Y@ZA3EzO~ z)=8-uZ=-10@}qoqbhG!P7`hA4)$%j```{2rn6ka6`3uA0m5h^c3Fvkgy&c4wL}$Ab z-{ts}gN~5H>U`nrcon{8&HvP%W0}v`LH?a=*x4A^Jw=a==zVf`uZH> zVV22rjBc#U*oh@(-H&4E78;t~UT?0TudU)9A*gPq)z!b7`5?=(|J}^+DPLFLYsy0R z4s^A|X!8UN0?q4>{=%@#XJ%sm0Nhy1qZzHhJP{q;uU6sn0~`m9ucW`ZQ-4qUj@8T? zpene>fT=b3Q~>L$_Mg|3!so@ee1H-X4W|KG+cQ-T$+MM1Yw%33jO@-qL@?Q@Xt z^wu!%16|(?8`n5&)8He>1ozrRK^vF;c4hp|usMdVj(f-P&&`Sb4WPRGB&QUwKeiWP z0*nTC`z*7%+TW9Rg-wCssdlML@oGEm(+t?u{O zw!n6f|yp!sZL+xNisJZKrlXWc%Le}zpS zbhO{R!m_FGKIrX{^d{^YlbEA5xUNKd&3iePw}P&q>&NXEDc%}vKf)>a9ri<6;;Cd~s%h&+iS&81 zsTDSVps(|d+#84wih}Bw@>AyBhwUMd(u}&bd@la)bFU$sm&@N|lM;O(Y)&}q-TYctvZSBvrazu;eQ-Xf$Co2cL6W=M&^7Vr2zHxdjH;M#^`-o{us&2 zP9Cnpzc`cx)va!ID`1O)l>4PV&ob7l2s+-# z`uDQ=J)4Jz!)6h>TGrsd1O5U%F7S$qljcZ)`*0O?U;|=eR1OC2`8%1C;w!Np$mYzNGzX7XFK138-!@tGgQ8Mv$^q>ht9D zE5>cP?hBNCXn&P9S+uX=w11lAeW5>S`#WuW`TIY^v$c;l;XV}Yb-x+O@&rr; z&6^!>Qh#^mJM2<6iyy}Wy$OSjBrQS2U@;f%V zeyS<89%oFmuo>*=UO~GX;Vw|!lU7%rhkq9PaCjah-bliq*S5F)M|HE%okxB&4+;Ed zLnf$h#O^mMuzdqk)=GVz{-e6l$HL}obhT{6e=ii;lI}nDeo44DwjnS9q>QGP>y`^` ztjnmQEyCs}C(f_%*$J2ZoYre;<9q|#WLOGwVF4^-Oe!Dp_noM%HP+OZJ{~rEop}GC z%`rFu+MoDSE%NtWLYFa67XjJFGtnBE)0jBz%`1K$yRaJ9v%Dfy0?p$R8((K^y+O(_ zYKiSr8>twDc#?({RMflh#O9pX1m<%_y675wtcKU*VP@} z0{CY@2~b@gxk~BYj;#tvsVO!2J%*nAZ2>caVmtOI+m`i>J;{Ayr+pWe4}^Dt z#i{j+`R&6;v4ys??}L4Lk$9r#5_YN$AIUw6d6XdvsT=FoLe$xG5ygTO&PF|nTek*JT&Fedx*FNfg z12?bmV*xXqc-_AK&FeD0LVMGB{cQ7+@pU=%QgnQYOY+g8>sbQtT*q6CxSQZM$D3ak z1mofZ>Q=)J*bMIetGb z)WzT>7znby%J)s}Aipj_e>tC-?B9{D^WB~XvL7SI;l`5cQU*(YGC;R&ajk}qwZge9Q!Y43M> z(S2-JAO?M49r5znQ@QTFmA|F$^s{^MegX3sULB7M@UJ3fEvUB!{X_BAr6&GAsdHHR z@4t>mye~NO{q&>8e1`KBX#chLy@C7o`(x&QrtUG%=n(V$billUNB1AE&}J?y0nP78 zo8NcT9e{t}2*~o)`~sdo-?IOZXE_O`U%%GA|@=5PnN{m?U0zOnw?r**s!(!L+WK!&AkCs}k-yo=u8nHcd=7BT%; z{-%$0A1&ibiuQ%Hi#^AB^h$bseL~C*H~`uoPfJ7m#eU}Z4xk!T0ypo`ne%?0^LxDc z{aDkO_MKrCsCT;mn)lQ}uD8LP@H%Y8wHI=DT*t9q{mfZp5YH8ivQj2j9O7IQ%7Sj+ zcla-7RH3dG=(;M^apI#+d;?y;3tEH5ueb4)`t$uF)a!VX>Ll@fh}ZS;5ndk%anSjy z<}U*8ICa^6;g}b4gXSU2U~7MY64$q#ekpW> z{Ts{z?U&9ez42cBm1|D080LW7A8wl4&pm3VIz}TS0_M8W>3+HNH;zG|A*eUI&3hPi zuftrJ4zWBO>x1MRx6>}HtEuzlR|4i1yjnh`{Wka-bR5+1y&3zdI|RD?BqmCH3n%^< zuV+8Xm<5e*Yvbkma|!CT4<$Y_DqtQUJ}m#Cl;!moUMwp|JJGV+J@9ep%utyoRZdg&`x!E zL|@~2zTXrM*6z?tSrom#E3vwKz`?>0Q{hZZn#&Z7Y^yf#kUk@8W`;)^+ zDH%Jc+XH9yC-Hloynf>Kq!en3E7Xk=_sA?!O#3#r3G- z)L#QS7G-RIi#LI%UHP=90&QwQUC{k`6YG)dEB8^~0kjXra}rN@9LGcCqx0L9HZQoCG+>oNPkJu?=Oi=V87sauP3fL z)N#DAl!@nWsA~t0z=Pl}gR-{IbiIh<9p-p@(EeF?0W{ws);o^6sW2aAgX^tsy=RW^ zCvv|JukLR?p#2(H59%FZz1yhU4N~?qb-jKsIOkt@mpJ(zqP=+k0`-n{yrDnO?d=t} z+v`aI^SR@_fViS?HR!mUV7*nTs|~H-4rmH)&J8p5v4q9(=iosj9T#nh=>~m3{qI=+ zcUaceMTi6ZiUuOL||Kgc7kW!TCRp9!y&->ZFk#?~+ z*-tw8Kky;@6ynN*_WNdO$a>qC*KVd>%4!BrR&E`C3A{D&>NvTTxF&FqB(ew1!y>;jr@k0SzV0@4L#Dn?;C&(s zZ)wM?&wYvaChBWguiFpbX7ZXT0rQg65A}#?4y{1@*Z5uPJw#m(cn11{f{$umZFXVmNc;Pj6=@(W#g&Zf- zK2{@hAy-g7rEWX?1gY=*!6U!HT!rcLj4dg#89WDMee(Zn{$WhPjiB3WE+I(Cs7YM| z(0-K41o6K+@y&R>HQWm_Te2@{=g(h8FDEuKGhl+RiNP;1UV8~%27TYoHcmblG1iHd zh#2t&ocKw+J{^{W_G>pkK5&G(lMp!N=dQnt_y_$EpA|4i8`>n8TuGa2p&V!)18p9a zsJj`?nt$T2b@Hgm>rJ5*XdbWGJTA)1Z`4!Y9n>M~dY=nvFgsu(j;A+mUV!&Nw;ys! zO$n4ZO^#3tq*P_+T=LIPfdHr11t0Q=y%EJ4$o`h_G}p@FI)mT&hGc)1I4H-1!X|z zL6+lamSY4@4tCHwE-KLG7PuF5x%Kfq-YDu`hp7+;_t%Tn5`hc7|L(@N_*Mx6;|7!Ta>H1875ClcIOaXbZRa}|^VdH1{FE8mlG z6Lq(OI^?}$#BU~Ek3Z`1dJE_Q+W$ZL@!odo_P_}^3~v7?$wm4~uZcug@?7t@^mx3M z53$_<6+ykX$R8Xp-9nv~`toOMHm3bu&>GZR-+JZyT(z|SKfIAu z99QGjx}2)f<__o%I^PT_Dc)Dq{QzFB40D>PDabuX z5Lehv2gd#5{^Y0JPaU83)+DAeL_xhft#>$e<6s871@3Y>;&|mbjN}H^Ysb5c_Fuw{ zxzpZ%tT$U8a)nFa0uZl0e;O|2=dJlBHV4czc(oMm?>~RqkvJk#R;?Sa?%VU7`*P^a5+yi%k>keD@nSR5YZ9;lE zccuMv@B*m!RqLHX-8}dZ-Urv)G?O>_MZgrstNXK6wBHW9LHpyR^%@R%@<0hF07XFi zR>o%3y7io2`XjnEVCv)7Qk9t6P#1K08~;8e$vZIFC#uH+W8x!uFP6S=mO_%dLgbn@CxOlij3_e?dfTsAKmhd)xU z^O{O!Tfn^P^xGkM9kS(1=T*YyC7)Bjkoqg3AgD+3if8JxDBju5{Fb8q4RAB){Fb%e z2GrdJZ6FsHuUzlE%=3$PwUh4y#Por^px!ptdmw*?ISz$+aQ$K!{{qKv*0(uRzTs~; zZkd?={N+&E$KfAPZ_;{qUX)=DK=5K-XDa7Z-HZ6^P|Qw;vRzAUciCw5#;c_}F;Bs> zpv$KY=VFwMDb&pXnSVJpmJ<6eU(2w_u^Fi+Gpe|I0)V+$e{naVxO{YH}be#GnYc$K)f;cL*m zn)&fwmqO$WgWwsEehO@+ZX4_Y zcOJjRlRV7%Z#>;!ks`E#he7-6eczM%UA%XwUkJ0oowqh6&K|#sBP<8JS~k=E8~6!y zK6l&vLPax7ZpaU=a~aO?uUwzSqsy}xZOTG5(EN_s{O+c%Ep&zlz}+97wE5|J5W~9w zua4iRXg?B`fqJjWoyy)TaYcqH54EAXP?Gy;j1?KT_4r%IuiSGA9}SolPQH)Qejp43 z_1A5ga%zJ)Cy=XN{r$qsq1^=iK1V*#@Xua>>EKMn=1O!sGR-y4woY>lbE3v^p2 zIUW=Dah|JpJUwai3@ij)E~BjH@-XKoP##=QiBfoe515QMH5+3((xw-@2N*VkVG(-g0cx6QQouEGoIt(GS>-(HUr^c}nf zuYo(>Mwj;eXOU zjAjd(EqHXf1h3987s5@T`DMSr@4p4qC14wD1i6-`zcpQ=te>Ag?-0u#G~YYHKQ=-oT^Ra|{7r!Du|=t?MAu@TEbs|E<*fr~Y}VLWY?RAA`>4w|P@91uo+L z{-rnay%wP3PR2~xoA6u~G=JjJaZ;BykHedw$J57rk2ka;=O?fTrot?c^HFfdD*OI*Y@hUg zYotif6vJO7rQo<%V&F8WzlHT*cN6D>a643mTfqH|y0TS#|LgIzKZ(Bzel2Z@83GGI z`?;g<4-~1)x(ijo-OqKw8@VEAn&8oXZcm$sp(p5gdduc1*AZT(ehkQUgtL}e)wBCJ zj<=(eU!0h^un082g*Lw})a``5;5r-P3||>EPdWMhOq*O)IA;UR?=zdHMztSF*rP>JGq3kn2}}RP*OGP@VOWlkA0f zbbYK}o$E$$A83BB`7e46xR%?E`d-k6zunJ5RIK4U^}10U?|NsxpCM)_902uBu-=+C z^4(1}=s#%5-z{);u)dyls$)M=I%slEPUqX`7M3M^2kQO8dcUZdVRpeO_#LKwZ_MOd z{5%)f>6z_EnV@+Dua2X!5&ydM+f3E_kM%w?gWC+$OBuo6?si?)Qz@En0`Jp~cL8w; z*y4CIxXDEE%IIo_R~-YZh>RC z0=N3U0(PqTMz0T=8IE@f?car;LA{-W0C)c(zpoy>A!s%@`L(A_SLhC!-%B>Xe$)*HDKE>k zmA$uQPM%B^=MYv{?!tf%fw+ zwx8Bhw++;hlHL+DwX=x-&WYcDuK1ck)4_>9K-@9-8+1Otw)2s%0q4q43^WJn=OptH z!85?|=zNr>tbDSafN%J31Utg2j81c)U_!`93 zhlfGuqn#h0I$oSh{RiM~*N!kBv0H;?M<&mAv^(K=Zg)JD?qK@}t|wX-&uu~T8y?+{ zwW3WA7zsM=ru!aGz9;B+>Mv}_F&*@Lfb9Ve>DyU$s{4gRt)RK!owWBh+Bb$ppx#fd z_nk&uYl6>UHOO(heokp>7fAKL_X>3rVJ^G_GVenh zupMJTk7X)(>vLPCZqW3`t7SRuKYJG5_w1C?VxTiNco-VDUfHAt2FeNfj`ITd6ss`CPA|uzitl$cV?JE zP#-k!yRAP*bFN#!HE<=k-;YwyzK0%XhVKlTlTO})Xg?O-1@%5}y;WLpjRsmmW03P* zea^N|qqE1QX%RHJrb*_08BP01@D}KDn(2EpW>NP(oHc%kzru-M&g*jB_!B37qK%j9 z#@jQ+$BCEcZ*@KXj@J)DfxFW4wZhKVRO;r#Qjq7+-Q%2kjnAI1aLb^%&B-g&lJy@7 zfNrmDx->P%ap(*!n)BHcobvg#+SaZ61#^GU#PMpGNBgC)9CUr^ zgWx^s`M%H3D^QubTF@M%G-T?o-+Rd|(mrT*JM;M< zZJvTQ_ojU>+xeW*mhCNE+K%THm>!0T&3LXGWcftx^vu4Q_l!TvaTDjx+K)Lo=X)he zKZ5q-BJUC_btjNOXUaGJSkN5Dt7Qi5 z7rkOshMgeilBT7<4Dv9I_hi3?N0;jlv^fH&LHqv;+fT(F;F<;8 z3^#(#m-KrP>pU}NdIe2AC%^i%9|X%m^V?)Ij1^o7A7^QphP+XiQ(Pte@s{pnrNk@In=1~-EHoK%}uXOFuG4~z70^1Flft>72X{95|nK<$Uv)+J!j_^iv`UH$J>VXLt!ka zx9#Qre1A^ePB;QTf_q)3-@Rvh6a9l`4&HDo)R%CQwQ}Pwcbm*axM&aKrLu9kniiTzJ#6Xed*-OL31r$ zErV$<$Dw1H>ioV@IQ44kcc!ONuVYebBg45KQ;i3--hrH+ZY)m z;?tu0jTqhqj(0tAa=!PCK;P%73sNWB|oehuSJ{sOL$4|8X6n=&vvwAmtX1x#g;MxKVgMKgw+??~@@4Mw( zO`heEl6*C2jyid7Bj!i=1JwVM^|yYUbsnCAZqO5SU6g*_Z2j8T;*X4F{hXa%Kc^A% z0VF{CB~(;e@;MypcEQi^Be?w%Zh!Xr8OK``ufL07xzj#pPtKb_y*F9!oz%63ZqO0r zJK%LYSKfN{xzgC{K~v80_ND!+FbCAz!Fu!d;yM^y16P5Z7dN%Oes;PxZqMh(1K$giFHt9DB-59{J>NcQy?VZ#z}wR4-^sLJ1Yd!A*IIA2Cwy;Rrnk!9 z&Umi=z}fw4CIn3RY$ni@~Ka8dQBKQe(9KU#_?;YER>m%?zd;;4+ zuZeYMlXfz5Ul10Z95mzb>+-v(FV{k#1ZdvBru4>ZPhBVI3EjZ$=QbVE>tO2M?iALK zIq7ly6764yiJ)FSS}w)=p1S>T41NLEyUcp^enb-QwRr3KIhou~^4kFr1MQC+t@o#= zxQ+%l_hTJ`f>5Mm`dFYee@lOV#WFkssWK~Qe!{QEl^^%uGfKp51kHPr^&jB1AE`eC z@_AG@?>-NnJ?^4-vvW?N-am-R{xr{YfO=jVqApNLPlZ-;5~Hw5~p`{CYHwDE4Bt_C!M+rjPM#kgeI>1VfNi-Kmh zljmKuk3tM|zu(vQ24++D0VKf9ZynC?`$4nP@#N>)=yuxu4C;BodU8F-Gw4tRTu;G= zvza)aU3hePm!VA+xD9l9FSGO6g}Od41Y+RMXKP$CpStgfE#|n=@eZeb9HxPK^IEU` z4)aIUuYuzH?Rq<9@`gVM8gE`Y-_MBI0f#`n{$|E_;?4Cu&lW;vZ=X!w1m0qfw*)aa zK_gJ_6q~PnU&=7*--NN?K8Ld|vv&#kzMIbXW7>ZPJ3zfltv4`$V-~m)3W4m~herM5 zsCu3K{?+5N=+dB>fLGV2^0co8bwIuQt+zdO4?!>J25$cjv0k~RBiq9y-uaF+4FUsw_dopY z9_LIW=g5aav(fS8rR^1P6{wHPOHu;2Q`ZclAmwhR?s~8eUvxRgd5*6OZJvhbK%(S0 zud@VmYhwv@Yd{@R8BGMu2`7FNuP5Or(DiY+G$fyU2eCY$JE%j}o&DqyUl}yP`RV1_ zmo@`oBxwJ?YPXZM5U!+t8+-=ta{a?D*R{G_R|U;gc(v@J{ZDWVG{23$H}xEI?!jEY z0=M6DJi>Nybh;~>tdb#?DTj%{kvX~PlIL}e%;OuC+1an9W?LO z*8e7TTBge1S&Zv5+c~^j9q&xq&xeJeUQQ{bcpr+(mXGD{b9fVYPdVN@k*y_Wz2m)B zItFiRc_Uly;%|3MNgqqm?S|P9G=mza`{8Zkw&48I@p21Uifp#d6mD0X(;LRy$?<-L z?_1dAc)8Ul#oI@nmY?|hT=_=u7JN@z8*_;E$KV8rMb=CEJ!=`k7kD-T)F)9<;>!}R z%RL{jUk+tJmrosONM3cRyA$pP`MwHSKJxi{xjsGAjwxO4NxZi^c|AzXV=xYMeQN4^ z17A{?ghL?L2bWpbI;OGDxbN@em*++H)6f7kzmC4glj|ohQa>I>fjfTcbvb+g8{HT* z&*Clb$C{65zY)FySq#!|#jW=wbva(jFk!e53W0pLoSvhtvu=4Fvh+lM*+n*S-NEsf zA?9Yd9n@dW`a4ti1dN1dVKBJQL+*F{r+E)4;mtwwCVt(&jVIacX)Pg?JduVk2-upAzNUa$b)Iw;M6I%eIM zkn<_FHBzEK2F+>wT6T}(+7KKDX(9cd&u^N#&wiA8cf7`lzjT2{8>8`mIq`Nom}PvD z_;SQ+zvcdrYmmg|9i8sCXMKI@cS1^0Uj?oQ8BhB8!~u_<-EXmdK~u}gt7w0=W=^wBn-$#$CUP5*es z{LJw*Ufpl3rTsy;_SLj^ll3O3+W-e)7wk=N--#1W86Pd|RDQQ5_4}}gg64C)VL#TC zdyV}Uv`5~z2K z^_F;@`!rAwszLR(BvaWx9*kJ8jO*0r!j5sAxiIa$i}oF%GpP3`>m5(sG>|fnse8RZ z`a+7XFOlDarc@T*MUFS*tGx5^#!m!I9lYUG7Hq@uoq~LCr1SM}dm8U%>gvEf&=jJ~ zdl#6;{PeN?keB6_`mKULgZw^edVAl6_D{kV(0<70zo*xVzIyl;bf=uZ+Lg=>5mKfJq}rJiPM}X;nn@q6zZ13 zCQ$F=)_VinnaWTHBH$jImG0$xbw3}=7BaOK+sjUKt0_BnuJXGDsp~P3+WQghH^4Wb`?Z{Qyl1e@&jE!YFBE`+z5VZ46K4tjKFduq zar}ev>+&v5%#Cm}Xx?G#Z$MoWxEor4+qW&OTgN9~qF^REc}HnK7)F44Z?N8@)cpxL z*@nt?v;(g0(3+(BIXO?FPhxzC_yFFp^dzM)?Mp*hQ19K=Tc5fn&=y)k0Zy1?j7lHO zvfez@r=G9kL&TRaNqZlnehtijE8WkWnn>~Dlesqr+hHYahGqCRfGoprt@{$%Wh> zhv7Ns0q%MDNt?Tzhs!e?u}ec{4_;kwhSL63cmveiR{o%0W>B{Xq$HTS%hS);S#Ju4 z%%4ua>uA3fz5(_2wBF;?{S7&%u`L2O-y;3|KG*d;jyE?KNHpL4w7(sifqMC>PbuDL z>fV5v@FuvwPg2%;_4i4_mxoLdyt@1r(tZtm4(iP(3lgvV?%zJ@4}$#epS$cDTCZ+* z6L`xx-V@@R&T%#9xVXZ4OH)@4YCr|346eJ2b)PjZ3Wv;{_JWZl*MOL2&;n#h-3_ID ze@2wLM?js@K1%#UPJ9nue+Hfd-L6;i;{)@lTMp|$?xhbUpBNoBmTA05$iy7aR@&@^ zqoDKIzb69Wo zGL7(M*{ksAa(#|A!(cS%a-HLQyy748`4{Tvz;w{#UvVA7CAsPLHI8?O<6TJmZ4j85 z_SQ|!9p~fJb$}kw1>AWJJnegRnI^AfKjzH0e1FtPV#a_jPyaTL$@2T7!r_p~-~w&f ze{VCMxOuP&bbfg}NQ#$x7S9C0jc^V0B$oj;pV4+I-vukbLmV#_G6fxP9on~oHlW@m zcK`YWb-0$D6Fe!sTf;O(!pW*zGYXH(O5&o8GG4?Cv?S3m#I%FQl zuj97{F^!=esGngg#al?-3fKvsz&3El+6e2{ZIc8guL<#c-Rb?xFT|XJ@VvDDh&06i zICalL9EQLsaQzAEm(Psp^MKJZ>=zyX8e+D=0nq#}v;8yeD#pRPZ2O=XlmYjcHvhAJ z|LAAZB&jH0^0CSB-%draxSjRwIl7Hhh3m~>-EQ-@6lgy*#h2|X&$Dj=gMM! zf8?=K-G)fNge!#1)%f*z;b~&tfQ*G{|0bLF1&g@G1GS+%+ywHu=`Q_!e?L22%lfLv zJBdmmQx$({c{9rU#B6{gp#3t`-voGV-{-s&V$cWV`6K;a=seH+?@`!}nPlaVY3k%X znf5DSHK_MP>#eewoS_{wg@(9V!&o}CgZ0XBgN()S%^~xoh`uG?d!nfp!qhl-q*&GEA@ZEAt*3_-!K8$Mpd*^ z-PXpchs1`@mfeiwF6+=y7bcQONYgtLy&>+80{RbtBOA zpRZz(;=M%OYcLhQZJy0cV(RwUI_uVLODd`fgjGh^Qe=ufT{MMjFokGBF#c(tuwzL(PlGj1?|Ur zsc7TL_dtD5y_61e(q1xs-Y7mPIQ!A@q91i5>MEQs?g>>Xb(DmiukX2?^CxD4!~yE z1@q<^6U8GrcCpiL6Vms`68DA7v-oxU{u?o;Ap5HH{NHN*xv9Gpq!eY^51)L#E5YCv zzm$p`&!o1OZ9`@ZUOiqaPW$VjBIxqE-FmB2R~Mu-W;z6K>UVq`Z!PN$w+oq>c1b+aD7RnH6|jr&=2`i1wpkEU34U|C$%4 zZWc&cAb;ar3^{V9`{8lCqrluBGTZU$c6bTxzl5(ry)Rks^>-Na7xhwttNmkM{r()k zcm3~wlIzr_eaQTZSGQLe(Y_dz0v#8Nt+x(!cS1L~8y*CAU0X%&;@5qsgeCA7Or-Pf zOUyuc5j5|lG-SIKr*0NVS;*A=-XG0de)r~8`Xly0$W%zAy$RZX4%E%6Y2G(1~JW`C8$5(uXo-6>PCQ+2~4Me_~jb2<}FiM zUm8iDQ(_N>%!7$^zt1IRIjjWr-(dYasXHL`Yq@vH^fb7i+1Q#zzegSlnLhX#qN$Rf z*sGuksK0^r%jZ^KqkcZT4KqQ`*Z1O;bJ-)-uiH8i#yYXTNTmJSiTN4wtxNm$x~zP! zZZqn;!F})$xc>4l`u*hklMiz|gI~wxOT_Gf{h;G!lFh%xCmdISl!s+n@;|r#YdJnh zE!!?3^8sG%mq%&e9|nPX_gU{7)Wt!{6sFSWdTyu7RdbHxU5{5w_H6VcF$+QWdv*O6 z1OM%Nkh{|lNj$p~Y(}hT1@YfOf%WNrZRfw{mHm`^Z_pW6UJ(0TUun^{fJ8t({xAt$iU&tK8TRIhL%o^ICfSWg_^FD69^)_)G z0*1k3&>!Ud@7Pd(zfxeRpZ6rj#4I~5%=28&{5aj;CyB|knP=ZX`=!6k0D14^8dFv3 zn?MBWfZOLKhWY+8>l{G|{N?fM{;Mr9ec?G!|48ePQ#T7%z(QCGZojv%{<-9?+w0f> zuG={IZy+WKdqMqtm2oQnT%U9N0p%bJrNH&~%qstZA=4UvIHfSAIx&r)Dd=+DVf|6+ z9)TVp&$YUJGupZr+uS3AxDJX}mup{QUW8$w-lX+Tpl%v0fVtp$CtI&9Q|Xfg-Z4(T zOKHCWHi3Hed|@Yb`{6K5D|~jo3o_?BIAmtvEpPkbcVdEDxE2rE&q4WvaqVkAV8iSpOF4z5}zBeH+u?A^*#K55b*WGp4!-f6IKVjXVCA zxbKNy%XvTNK>Qfub^B40_bv}LL6_U3HorF1Jp{d>JGk>c)aG_(`!SULp5q-v`&Z#z zP%o>s6mKVW2jCGkJ^)~n~? zW_ZXn$E(ZdQ`+x?6QJYg%4{jIS92SmDT909`=fjh7gP5bqF<(*B`Q3E^JgdT$A}pS zBSHNiTmMSxHo-pl3U-5g4Pis(-0{aphRkv&{}aSyZ0G(GXus(7^BbtE0ZpI|NPp|| zJts5e9(^Tbj^fqQmi7-r7m%eU*Gqoz^UipJy8fWsFNuj0UvPE0Ux)DeSXc>~*ROWI z>oE{pz=P0M1|@mvIH*42>~Ua5hs=GBcLMEa!-o*Gc@>ic8TWa<;{H2Sh2l^a&T@~; zlG*y|zl1zs&r zeZw&-42SGgN`F4%djnIcdl!~~^uy4ozkS{N3dfUpe#N8XbtP@SfP&wq^W(5xinpG+ zZEz6wf;?|qahvZ7jLJ0c<3py}nzXm(PPU=&76g%{uCqy^cq@O$=PIESw174;ZO-~I z+IM!aQ(bpcQ4>R^6@FcRrxWu5d=A>Lw^;uryEtcsN^lJ{te8Gd@5#eZvW?dDH#{k1 zy5ZIROC#Dp1QS5>zR!B2Nyaa{27O^5xS!o!W!?H2rc~Z<@qC8k-$P9H-CSP+&HGpD zUr*gOI1Jx|`<&0QSN*)@dgpS9j<#%+W(;2^bwOsrI z*IMBwklB~gj{dy#CFGwJG)O}b6G#|YLVlY-Nft#$xN0TA9azEdQLO*@6;xUf5n;K zUx+&eMfa!k`q<|67Fc=K(zHx-jOXoK^kMknHAm zLm5!dpZ=l^Jl>bD-F?#V8_Z{Wq7$;2$a|chuS@lB>Yui>=>pF?p0};1LMWU0f%;!T z&hO?CFJojG)8qoKk2xOwUaZr9r=Pct_=7S-z85RsN&gwcKx_ZKqYFc(CGma}R<55} zhHx`zfB$0l$4^o>2*$v0kmXopBKHCqUuBuP<2L#}_eY()-lzR)*aF&5Cw*@q+d-c5 zgTf&5*U!3!FpVz`nb0Tc{7TWLB2)#sFx!9HE~U|F3C-bj)%mOkSU8- zOCRE%g4aOvyGq`G`yeZwCOoyms8WPRX?7 ze_!uocpq@Q!9$#rKp51^PvuJShFX*z&)<5&BZf!zRj`_*TK^Lc|YyDKtE9L zBI}jko0>@dbdcYha=imGd1H9vcy)ifn3&b@IjFaNDqZ9KO5Hz@=NDcBw;xtnuYM*c z@?ppvalBX2{yL~4vG`;=^^o;8q^=cogtp*%1986})SJY6!TR)hemC0pgF&EPR$VFH zSn4Lj`!E+u;L>Z#<*hf@c-pWJPc9Fcj(D{n614vmHi3GdwccIS{RDr&ui)m}G*iCO zk9a=T$@etvFFee00rd{I-tyE{hlWrKTyHc}zL7-89Lgf!2Z&SenExT)Sf+dvcnf@* zzJBmHz7Y_2yaTQGPwIk4IJSe!U<59?ZY<+=y!FawCl0>J_+Q2KN4$ERa2@R%Kp)V2 z|IvQjs|SPJUR!P`^3?bPjo-{2s)`^iq3ypc~s=55FO7wvN& zhEg(j~(N<0j9uE7!8wg&Vy+=`Fxc1 zub#;Bgt81NvCUj(*pSYDJu&+r-|@76r1j_eo%IJQLop}^Mc(2Vy1YL|O7pjjL0Pxu zST|L^44H@V>-dWkvlJ4b`E$r8#ruxBpFqknrYGg^lK;8QcdwtCZLH^xKXAhD|I3)_ zay@1J*HBjpq||0A-+#N#<}7(jIpf~WbKiJ%d^ezdOK1=3_3VDM(qo*jQa=)+UmIAh)SKUWbN|8m4P~JO$T6?}zSJL1U(0qh@m0ut=6D;?zAdx| z^ExA}f` zNHF$#GL`=QopC46LB@85%(0WHwHvyzfW9s&UIHl;bc#&O<=g-pP zc^>V*grnv^E%G`v0|}G(J8gasQ1>Xr zppQ(+N4JSXZEmv7D#Uz;e+ijS9q(Y;kA(@K-g~TfCUuKI%7;v|8s|lD%K3g0?@qko zRBIk1q5Y4L>vY=N!Ftx{Yx38SDYG%Xow|;gTJQp>|0CQ48 zx=vbeo~iyg&~24;Me;<*w8yXc&nG4UpMhv)Ip&o&V*C9!bzVkxQwZ{dTyGkRGk-3| zg>~!oCi7>=JmchDTG~T9P;c0Jj~~ir-ll#b%m%kl7H7&i@)yU|c*Cibj9EwfZSW1K zm#;RK;^oht-4p>SrI^a+F!VaEtPfK3I5m8d`vguuTu1wxp(d#JA?tmZx?UjV8K&;| z@U5p$ADZaj8wvlz^Y4y#5bYPj=b+x0^~&eC@&>Y-Fcbv0A9B3oFFSpvH++h5=k#x7 z+BbqbLA~5klHyf4#yKSQ!(lMUHm4K5(k!>0)~jP8ayn%4Y)Wr;UZeeVSOV(hl3dDr zkh(u0UyyMD@_8tIPGErb>T{1Kn`f@UtNYu+v@ZqaLA@Nxro21fWcx&YU6}m`TiufB z{nzA7`Nr_p!W&M7^86Dq_dzF+Zk6%NE?J8A40SKUco+$D7(2GxrCxzT3pugyok8(r)i!cz<{LWjpP^haW-SS^8zT?+qQH z?l_1~KDXbRzR+>p(dKD_p2@%250HQVqJ5A9q{~3o1o4fK7ufBbdWq}j)Ykxa-6&6v zQ9R}Ggi}pfUbJZokAe2*c>lG~l{{!%23pt$jw{L3$+5egXUQ?1!!uo-{KnCCCaeI> z&pwA3I3aa8*@l6epP4S#Zanic9^LPjq)i2=44PjXh9t#nMO_<^azE1tL5~Nt|73b* z9iUw}muF_;&!39oSt(+A!(h ze$0&j+~346^vnv!{}i!<;6>2+U*qTLef^CwuTn4NAb-2L%DhX_?N<0A&uqu5Wdd>2 zAOX7kKk;7-d`sOv_yt^Nck+$nIf|#e6`iI{sSC23xuE%d>A&XPmp8k47zRLZ7=I`G zBet!Q*E~D#J?#2uE@3_2njTlb(mt3kyLkY#U+p%)`>~~ z>v>qXpl5C+G0po0V#dJ?Q2)&~@1@kOg|A^FYz6mwC6cpz|4_}HxFr54eqApP5OWOv z0PPpu4hAk{p8!%Wl__IF#)b5Y7C9D`ZEUQNXZktbBDB95+CyfqJkPk2`mbRlxc9pZ z$H3w~v#u5P%xJv2T|GhjjEm@3P_JIkDn?y7kWz)I`&lW?w*vcSIX+F|U5r=vV-ecl z0r!G>?RM4cMO_R=zzg6W>ql(9I({QXJhKI_ZWqSUei3{Dy8OzdGBjR}i`j3%HBbbK zgYN>miE@PU! z!ZSsi$g*LUJ2WUT#jufvbgK|3cOJF{@*G=2ZIeQxsztS@`@M?LOKXwuGJ;-KJ z_A^!e7c+V=)%7<)TwXiC<>h(3`K>u(4mfd>Y}`^_)3_vYWu3S~wEqMC2AO+#KQ2>C z33!*VeS-@@<7Ip-V;)S{GtHg6kFLu+UXvQ5+PUmt3{@@$)I(~@|n;njXFfO!>x(d*)Xs-w$ZN3f6*pud&|GsrweB>|t8(;D7e7ZpXq` zG5)rv^W9JTqwqVZSHHJ1<1)_uKuQ6bI{mBL8|~jX-ZGB25bdvq>p;D?*nDrJt}(QO zyTR?>WtsXRR>CuN9k1s5AaUxgZ@uS}uPN!7_IPzX^uRX=#({2Unpy7}>bAfk*a<&? zoAU;nbGGs6{amD!XWnq~&R;OQDGXPD=H1%*OH+3vNNG5Nf6mp3 zY0sQ+^8K3jzrgRH-oe%@<03yda|?lv3q4OO!smu$%;|UwU*nm}cBIE~F=DQRN}ygI zTS?_xm%8TA0osDQ?8;{HCh^vAyt>>TAx^!oTkrWSx5%}OH@v!^?}hJq7~^=kEt$&q z1L{`8*RTbulcW9)Y(1OrB=+&C>#b!xGvCSgAnncNZ2v*WF^705Z&~W9KvSp%^+A@M z{#I3=Ons4xD(9Jvj$iwu4YArE@BfSbh~nLkw_xf`jCl~>lQ0N0?={vtk-8bM3KqhL z;4Z_lHg9+Ri(SW+tFPGIS^s8+vBr8PAKYTd(h!8$46Z@s6SWH24NI@BP+WrU>UW z&=6|E?GSF9-uCZs+8@>E|xA?+b%Ky;ZC?PTfpc0t-OKo^JQ5%+J)%mAPKxon_(xYx4!kBpf2M| zj*lTHxMQQW^`1E{sN$K+zfO;fBD60L?Lhmvwe`-YZaI7j>tG|eIrqtwv-DT8s%L8A z*W>U|nB!9@0-E=1>#ssxEocG_K-~I!GCAJ!`$Nx1qBncy9=uwjwC@W2K$g_qu+;Yk zrct*5J_5O}Uon^Os)sXD%`;Eo(eb;HHhbV7(D@JhZ{qDKmfakNvc<_AE`}jE#@gJb z*{Pi4&EptRN+jZ$Dfq*w|M59kVtPSe(D@(jzvd05?iG+C$8+*LSmxtpz4n*Dy9%$a z�V3qA(T`%UX@xsYeAs6PpZ;5fKrxbyKQtC1-i%Zu(aZCA} zeC0D*$p(yLyyg8^(}eat;dRjdxXNxnt6$Ch!{g8zIzScNwL$K8HMKd*_im=X+YV>A zv1cB~uj|QDVz$73(7gG&1u0&E((JFG9Fzk0TyL{=>w1#F`x4$rDwNO1(7q8g1N9d0 zU-LRq*A1lflxfNT9Dj%Cj{pz4C7XC=w$mRm+K-0$pxz4B`zLj$A@?=(6&xW)9oHvq zzPWMA*o!pt%$JV$I@;d?w}ERBe=1-@8yVCwi7zn!j z!1om*k0)sblhg;xo_)PM z4+p3*JV%`T3ecuB^aP#%CcejOS&r*^Fa^3pACPg{5Kn?-)0(Ml6Wr}&>|T!#=J*2n zH`jI9%_UG0G|xx;mje;%?tnW%my!7Xz?;NV0+06N{j});Pk{F0<-W&ze26j6Q!iy8 zf9rl?hckX8$LcJjNE^@G=6GKu?sb?8I{)luq<9y;!*AYDzZbT_ci^s5RTih`Uq82% z#D7129bZR@@p#aq8>s(!>u*(_>&fsg^niZQ8fPc#?PI66khl87_j_gp{v5u;Tzmt| z56Xc0!`6Qrb&VhjE#Y2pk56*&K$!IRMt47le~ROOh?oH|7qs7NS-<>F!UYxB&%q_& z_D#V|?pS-Smpb02wC@02LA?)J?*!`JhWRi9bJkJNj zECbyh4EA5l^7A|i;`4l$-cHH)fUF_*OVGT=`SIQ*H~M3&7}LVw9!CzadCB>UY`0?_ z7{7S+II05e8^b-I-Zj>{oVxY!9qfQrxHengw|1(Z`Hwy5nPzx(z4(jvS61Yl4b)r8 z?ic$|Hvq=N2#{s3*YCIb zJ2aCw@rY;Mb-bNvKNQA;dV5&!Zt4y}=q9dbGj+WOt+x^Dg5(?T>Y258bv?M8nDTH3 zsP}E_mFE>kQ$HSZ|3YQS^nSeI(zDlrWH-+C0V)nuz(DjR5w3I-%%Iq^C4pQD= zIuze%IKsBaEX&64B6=pUD?JXT(`J4Z?wM3g`%c+B^H$?o6Bq-JLT|{Aqbx+2(N0Wd zeLZu}gtv&sJW~@_nT#WlK97*_>RPN zhn`OSefIscPv!Xw>UCQ$)#3i08AiM=$AP^5GQ0x196R{&-gxTX0V#8ssz>@n%bD#0 z-Wgfs^&WBBFLJMfl95$j3F1G=BCijL*Sxy>@#mFS_&LuUz^mJZwfJ_!kD%kLy7d;S z!MY7nN-`}Ye>-DW=ULBPrCs8A&z!^`mj6&H5>p=-F&s^{LhY>Rc7J&Bq zvXs$ypN`>pj{4(p0OWhprhVwIBMa&*-R48 ztxlc=Yh^bjpdx6$-Rhqhc^#{*Kb-G+bLd zJ%2ysOL@G0)D3|VF#LA^99W;HK4#}nzxy#V#xrj@`RV*EC06I}LRrvud!BjzV#F_X z;$>W|Bz6sCBS@Ct{qhI#?zoB*x7mp++Mjg_);sSzCl!|U=M0m??;&2-ldZ(^g>voO-;9_vslL3jdmv`h<&z#1qr5NqY!u6p2@ulsLs?^m6T~-nkBfjAG z8qH_?c)cAw02w|-_(h3 z88hZJV#hi03sP@yGM?bI{@~`HB>rJ1ehP8(;8W1?%3}{w0)J8$sKc=zs6)of=Pll*ekREC7H*COR-C=u6L{A<^IZwq65>7qo$oPrzIRh6WiM0LSsSN$!!w5+ z&k5T61^zW{Z^>t$h-(L$Z-=1o zZN+QtLCOQXF27?e{pK%O|6k2FiMNO2?L_-N@RH-rY4cr4-6q%t+d=w4e{X3)rsW$R z@0s`TYLVwQe6EZK~vCvyGZ_Ed32!eQIPV4OwYBPC-B_G-c-}nKe{}g zCQkF}=&LexdANB+i7!FCj+0MbGiETcFN5ZFudnwG@|u)5uN~%ZcYO_f?5|fkPU3i* zIo@}OnE|sMZ+lUqRk;$9HyC(~;sh=JX1OEqa zhfLn^B+vYlg*UI`9r{0bduH-R@m}^rdi?4*E8=)Z{SV#&nY?klH)P?x*73gaKX^xH z@+R>%%)(p6@xJ*#cqeD_hU1=jC<|{L$2;wR@Gi*YjpBXI@yhV*!W+h0A`9<}j`yp7;f>&}nT7Wi z$D8~Y-YDLCvhcp)c=!DaZwzm*EWB?yUcC=|KI=ss?}#kCGaT>nf01tj?@Y%#AKz;D z1cLbF_~oSaW^cf=9Z&&^KxsJEmKWRk$8M{fZG>L0iN5WbHI84$+pWX~tUrf;`1&8m zvFBRvVt99F;jQm@^Zg5N9PdfT+YDa^=mgpyms;;z)Xjm;<85X0-EI4~6|e2h)W3n1XP*~D@#fl}UN71b^DuOAy!Tn} zdqa#_4pLS#b(dS_{*B`;>3C0bO7R5FzK-_+>n$Jy#1{EX`nkLbyb;ISmTSNLaSm|2 zovn8Sby`O8_qqBviT7T|tK;ld$E)}8&SyO~?|9}3$E)LEqT}sr^F5#O5XL()3-46N z8~YdD2;Nza_nu?ii^BP?N@!Ko;I#9WR&O&)XZt zJIV3>iSHzwcD(u=d%lM0?aoE~eXjK)j(3UU)&9MNINfh<`Y-vOb32Lm%PhP_9q+dP z;yqWsNxVn0@RoGEJO72(Oy~aAPye}Ilykg$|AjY*q@#^On&L`gl-cycOw-3)c-aLkuE&!y)q4`DhO@XY;rL4ub0aJO-Co+qo4g^7c}5xLz*Oi!u03tO z1MF1Y(K#O9nVHVJauYtA0B?YLC#MqNBil{M6)Hkm=&%|uNUj6yRK4-JoaZ~<=V|{k zj0E-8vEE74%>XIy%CzKv-hWeX67O2PTAs^k%pzhw0x`(-gZ9$l+#meRI=3)&`?rJa zu;%gkEIi>P$T+MhM6r>bky7%hz z=XkUqbU7vPzT$X`(Y`!X1nu90wtt&a*9N3K#MJ%FUS@CXUC(^%c>llZ-#Fg=c=bBT zqvY`-i~-Hpo~L*x_}ubr>K8(;?Ii7t*U^kE$yu*2$LDiAjaQ!w`;eGx?&Q8bs8|2l29a-FhxWmDIzo~2}uz`G5IV~Q3zpF6h)y_B!j4k zQm6+G}7_n9-HF_b+6i(xiYX~_5l@s0Cd zc}B1|&k(t3+;96f7w=l?{|J#Ya^6^0>q7M?YXHYWBe3slct0=RB;I|Dw;lD*g9||8 zZQ{MXD7z8{LO-y_Pn+_*X}nh)p6iD})E@!&gL+$d@8gs`1(GI{SFiu)?SVck8G9k* zjyLhnp#JMH7u4IqdzVnQ3?zLm-(a!cSnuYh-r@pj9aT>2;@$O6g`fvnjKiuZM z=Tg=MBwb8y$3xHyxqist9gkPHXZybD+?BMs8r0h%P=#)I%DJXYmo%Ke?RueJ-9E%- zgxvH3-W!bfoPXg>;Cjx`TdZ>y9uvucg9oyId}ooJJx&W zQMLpmeI&Wr?x=Sz*Cge-WPDc0g}Lyr5;?;54m78h3;4Rvzw@)xJbS>q#!23*->vuYzGLKWeSI1=r z?}Y`t9~sP@0h4J3@FT4r7qwwnZ`39dmi#`yDOP0(1-n%m! zjy))sR8#T-<43oDF3t0)#(Mzu4}&8>y)St0(Ui3UNvBC(iZ_mT9$roDsoxoTfEXm+ zgMx|0liC-#t0=z#wtEhSWtPO_zRQj8Td6Y~Mu5h5OyCKPxW0^ggmOub^SAwehb|}G zj%M&y!W+yQ?^lcQo?qHNW4tx|`dGeZux`A}v=_y1=KKA;aphiRzgoaM$9NC^8{SoU z-WcAaOg}8b_c?rHy!ZKjDASSeU_dpf2zI}^$$PaQQh3`M?_Sie1NA`r_XF>3L|Jo? zbnewGlT!BA8N3%7Z!6lJ0cU}Fxg91c)RnSca20GEw7s{O`!cfZG~U>2A$Pm+YP|i8 z*Pk|o{z<$Eyieh+6U5|h!}lHcgWk*5Bi-#9cS|Xsv>Z&^Zqrw zy57qA^&xFOGT#2)o4+dK<_4K>_b7;~n@fyh*%28Si?0Kf`av%j?i2g(7FO zKLJTqB{%Cue!OYCyKKm<$2F+m6xxE0httbtRiQ^H8wXS1DX{z1DtY4}Gl%B`@alT} z4)qto$DrP8ymvEYlD3ln4Ay&#_v&^$@dnQan0O-`r0fB;K)ua^%|fU(WoN;q&=tnv z((heQ@m~FoN9N6t8*JjemijOJ>|Byuz1@SE3Ee@NrhDb@0{yG;#^*AA@mBH;9;E)` zFagy2i(hWDDVq~WB-6xlRQUwDeZcJbgS$iIQ^1T@HxT^?Z2hHF86-48w%4v%hB>>lUx z9bniW>^`Q_{9yaCtsmdwy#D)~w*&RN!R4Ud-F-jGd&=*n{Bal!c7CVidEMK*_YAKt zpDEOT9$o|W9_PK$^MVeoL|zfBcaisMKPK_EG2Wx7-ww_P^`7ay%P3m~KfyO(y@|K- z&Sw{d+@+=;jya$ASilXS-Z|b|rE^&qgT_!Fx(#(M{&wJN>vQej#JhZ7%*1;o^>2Wi zK)s8-_YTU2fuxb-HeMa4ef{@rQg|OS-Uq1v47>vBJrGrt@o;FOtUC%WgicUt0mll^ zwuJ9nk&An-KfZR0xxQt*S5to=+yd$yB!A!?O4$j)-|hkaF0{U?H;(s(0^UcAcl5vT zCh;yd-U;~Rdj-!L?_=IOld?G=>21jiY+p3qG~O?bSNma+@jme{;&n@SZ-((|ydN3w z#D5WQ9B=iFx%F)&zHecJ@#^oi{zBOwAgTC*pda$T$FKd6!n;3S-R_*n`R}W2u_CmS zFlD=Sh9AFjo?Mmkd&%WI*^b|Cew^ugk-^&xZ;bYmYS6A89A~^Qd+#91M#5;2-<7q; z34OiydcR)8J_xzicr{I<&3h2-k~sG z?BU_E{11zw-l}wW~glP-; z+s5=hE}2JNU*eyJ_)VCgzWnn!HRa}v+>#fc>4B%<@l1^NV@>c{2fIJ2MIT#l;`5M`_v~xDC!AQu zy-u6Opz-SY@L;BGr2JQSh`+7(_&je0@7s9wIIY4(oIk@}px*laxc@ZDI)S9Fl9#go zjD5lW6R)O=sXqYjfN~VdcI%qJTl@`WKf$g&0(V97(Sz9z66+eaUqi^_UxnNj6X!nE zsSAgI#(9^Ivk_&@K~gKp3&g3vEuX}@GY|ag{EPP#I1AMKXr8w#)AGHeeZQ(Vjd%Y% zuf%(a@jjF1{X6kGZm1nyziD`2-)-=)@xJc8iz)jQ)hGNx?=|KD7<aoV+p(?H`rKWlQKvnlHak}j3Jz&KNH67PovyuFRL>%Z`3 z@NO>Pz0P=h{0ncKo48ds=f=Y=_=dp<c=B)%72hpDedD-m^@+Gx5!XcZ`>x63@o_31w?Q(s$&gZO;?yLar}fO`EA-<`V8l zf*53seG+(!t5Oz&1Hd|K&<80zBaG(|>NJ67AkD>714u<5o?7Hu8iy2SX#a?5--hWO zVIXK6!}+5M$8Y5?<^CGffb4#o2cH+Q(XB@unGHODf=B!RMCzOgoj}KTclkh;>y4D% z38Ua1u*-FpU#@zcGW~tX)%_`VJ#j4c)6lACZhQZn_fEfzdznza7uN>KSHlW?>%4QT z&*hrpM!)e*Zwa~X_;vdSM#i0G#&&M~IvU_0yq`*FJ z(2R=#cE6v-`vhKHUUL0+I&EG8^^TMPnD6}SzxF&yoRV~TxnDUSH}SrK?<4pWv_E_M z^`&obj$vR4jECo-4RN;jvG&f3S%OIvh20|K-$I*EAFe%s`X7>kOWfyD)&;JI9?%Qy z@=6u(r^|-e*tC7U@c_8x)*u(ZJa-5-^*Mab_e3s{@zIa za#!&FEKu)pS*;7D-r)B>DL(^F23glK_~f?|*LknLS2kHL?2f~$sXO)iKwr@DwM#Iu z=w`}>g2pMu8QPy=+TY9cCtxy2H_G;-rc`A8pH10(SOn^jWnW!&<#b1-e{gL+fmE6>|B z^WK({({Ivufid`3kEhdk2jZ>n<2{x7ouMnJ_lRIxs3&E8K+@IZ_PI87U&J-u?0!BR zcEe1(*HeEK+}<}gKJ|IpAy+dE-htWhCRDnbZ5{nliE9b1$i=U}At;|8-zDtE;g89G zNH1T*JJVnxXxuI3560&wlzk17Hjqo)joGL7z^!rX`%zuxu$yY)mgg2W)8=PTuOCPM z=(&YB-Vg9W!f%DyY8mle!g9O)2?=bb{X1TY1%dP?V6i* z`xj^z-;?cuY1h)XYiHUWP@r9kcEe1&GpXMdx|?=&e7j31)A@5X!u)oqEZHDk<=fqC z+8tP+U4nKKO}pEDyZcPLx&_*$Y4@UO_n>e0q-l3hfp)RI!fw84_q1;}%e1Rkpk0!7 z%Yt@EnL~N*R7lfKl8l#~dT_iK%33?6=Cvi$G@o-y8&z_SY; zx+t4EvJMLajpunh5#kwDz%!h4M@dOMdmGQ4v_FU)>V3w;ttaQ-iQ+QUuNTChZNGqe zG7n2keK|m=#^+8b@VR4s{4N%DCz{Xwg!XG-o$<);URN#e%1NhYbj} zA4if)lJSuJJ!-#Q&rtsw6MqNl31^%7efivqd~UkH=Z^F7C)o%N4m?Tu9Cn{s?l+$7 z^%DAFUIEYJ-jl*J#>De5?S;pT=XqIFcor4#JfY)(jqB6`o)3&?q4z8+;2G~dF*dgI z@aXYY?83m(_?*#9AjIv3PDB$bueQ|aQyBpv0)K9}4(EdBo`{q;jJ|qkHhI?NI-+{*W zG4;i_2GrLo&zCCTo8o;*c0Nsv?_2Nt#rRIj^Q8;;7I|Ncozlt1_lNgYxG@*s$$7p^ z0pAAiOXKTge7oS;8}>E6*4}pjWru;2W5T@S`bv~ZO0x6oX?#tnFTN8&`;V`fWXH4m zVg-Ely)VvAae(o)@xD&RcS@cwUclGZ`y4wu`_lN<8Q&c5d*ArZ$n(j8%b&(y_F#tbSDzgW zFXYhWyWIQM8Xu2VZ#TcO0>1j*7jF=DRgCXD?{mrAc$P<-W&5n-IbOim*8ALHVOPia z%Hfgqqnh!ZndeIs@b&h-G`?oWx2N~jGrqI(e8~d7;og@#JnT+4z6Rdc!uUGo`BDXZ zQ@k(Ukn;%RJJI_(8lODQX8SK)z_-Zz+!0}Sz44vreU}^GIeETJ0pAAiOXIuS`1*R^ z?Z($B&nGvP{xtq5%WnS~h241L8{&PB8Xvp&?dCUDz*pb<;zx$v%f>g(`=%S;d3nBg z0bg71bB)99eSDh6@`o@BpCmcn=q!ISo)feQj_z~+j`GKoF+5)zj~?eQFdn(Ij3=Ao z)Gz)m_*?#6L_J}NsXxkpZtnu0J3)`%@a&6+>*3k7oc62XYvY-Qr-Iu)A z`U6b;B=u)dKUmt%&8MEQz|@}-)Gt4yKtD|K{gA>lACD$^KdJDM@vOxY<~(#>0Z+=0 zlQf=X#`6cmOjv0=zxj9;74SUmg|)_W9^+5@%^k&g^zTyBCFLKj zzroZ`nEEm5?@^%sW>debsUN5QVFl`MHTAoj`U&cvT%dl@O}X{%VpBg!{VoOShfV#S zrhbb0*A=M0lc|5Xsh_6)Jq7AlG4-!7^)u9eDyT2r>Gq&r9jIsO^U6|J-jCbFF=02G z`Yh6Hno7NPOnb%D=MX5nomp03xli%is}!DP=5ybp{ipD`@vsVtXS?f-v12*DGV`a~ zr;?j<{XHOPmyIt@{a;MHyHHQ4>g%^)h05+ab-irC{hB{=>wV)}czza|fu!T8zn}b} z^-l`B1E{a5=Iwl^4UPm!$5UUzDa-b9O@aP+#;*s7Q#tMlJV|M%`;%FN0#8dkve@)< zlhi-O)PIF~Z^1jh{t49Y3)C;4+uLpbm+0JSVRtbeKRem)+sJorRvXXZQV-9D0`ZU2 z{U@HQ@yNVNI-X#K^~TdwCg5>g_}@N~KmM4Y`yV`m@#y~WH`)tsaL^AjUoE|-QUT8l zKfaQ9?!)6ROKjU-RyUqAyeC$`Gs(x3!t(^48d8^}`+>T~bDm6KzUmk7q?-V-n2nddzjJg?y)CFP%!X@Be4Wn2g2=_eD2r)>ex6kT3z!|pvi`OE!E z;~DHdi2|Op8WCivhlp+ zJyQyJmU)jmJ?suQ9=SIoykk6byeD12vxqWDF+3;X(e+|1Wx{91^R856{A3DvX8C@O z<2m2NqwD)O#`A&qY$)K#`1wlU>4is^*RQmHnr8tccjVUh&&0#=udDp$?Z&fydBxg= zSs`-$+=2E&N8_pIw}+Jqcw&@EO5nK!v&uQM1DB$Vs<8fz%-4YXz?k`?3 z9=_f#zXeu4S-|t0@8=|*RmQWF_QJ=;GgLf`pFssY&+B%heb{X=9zBjb^3L3HU+F!= z3wWk_PXbTXGEy<<=W}cF9Y{FVc)s$UQ3X5`D3g@NQ`>khqUNZ`K z=6O%71J_55NACj$tbk{Ot`~S(agrWntj;vt?j1w324Cxzz% z6OX*NPCCXZ(RkL;Uf5tf z$N2fGQ^3>Mds2ArG9K;cV}|6$&ka7FRs}p^KVKO>d98GoNm19ADjwXI~*i|mddHWpBJGr^Ge;s+gcK~HKfu!3d zul?uiSn5sSJ;Zn)AdWHcG~|0{QT8gl4R3<=*2#-EjkmS&en|b*unzLQ?RfC-N6NQC zH+cxq#M?N}8#^cLdKB=M9s19_t@6A{yhDt)0=_+A@4xWYq+C*dyn6hu{hPu2BwpQK z)uG*?(5Qg7Ic06&95@5)^G_XpykBvgA>VV2cM7{NO}rOSU-qLrLw^7EWZE?#>95{{ zpz$X0mM@zd?>EqHFbn}%EzI~WKa8@GQ0To=;**rdw--KLA0D8-?5D>S@X7bE##3&e zd9(eQ6`srS9=(u$a zB6%;aOxO6NO@j94{}1hxw7<->pGCa7UgynEk*wFRoBol{PtksWY5z~-Pt$$`?f>rb znaAhb_47~5=RBU9`wx9_d@uYD^OvCgJO4xbB<)xI5A9R5cg6pHe5Gk$`G07iq5Z!9 zLwk2V*ZpY!UyYAAz83g&d-#rwXO0KTb8?SP$=hkJvm3==F-dFI(vbDK>M1A>9CHcLi z{N*p-r$2z{g_gfO2P`Rr?;R6oJ?cL(qsV;%HcqOBhJWSUkxZ8qCoe6|L?Y}~8}CWf zm*)-JljnQSqO1!@`tr)6ZTklutCH*dr}1tz-ivA17y3cIw?AdKgQO;nw*TI=y49Pw zAndA@%Pp@Rd53!M{p6+fgX_ZjZ@hZ_Nq#3FKVJPE0f|?pm*$P(J;iua#39$YCz9uT z<@eW~@$t&E%Z7aK zT&6Ad-sR+_#hd6FcB73qL;dez6Xbh;qO53mFdic0rFk=W-!R_)svlzA!tN8}?Zvh1 zYoR~n$9p4Xm3+Lrk(buLDZHDESFbC|d+hVQ`R_|F&6~!%bNSqQA@`_+#|w<#VOPq? z4U$YR&6~k{fbo{&SX0=W`OJ^ErtbqW%klT0too5EWolpDWy5l0QqNsq}pFGUv`#k8?L=BLO@ zTW+og*AI>Nzv|yO-ZPB1>?rO@!hw+A5BpQ5Nv4+;ZxU}0y#%j7zV~&?7J{T@ z%H#EuxlF0Ew=^KUjeH@y~k%G zbfMxAeE$#jgx5Rp-LeDu-Wc!95nsaRx?W`PjxgRjw2^a_2IS>@yhnSlWDO~o)P(#P zC~aFQ^d6$!`|H!N{ zc#Pr-$|YSx-XC`4PvPHc{2KqQ#^2ER|7rXg{QE?6%XJXm5pcipAL9KFQT7x_dX{`T z>?r=^Ra}oS{xogghU@up2<@M`-oKFYPeIaZ^0lxdf9&e8yAZz~qU_qBtowm>n?e12 zRa8=_!bsj-!t?~337x=xw>;&?=DRxPX_UhMl<{9o*=~6D03G-KaWr%E<=j>BiM9WH zUqIbyybFwXZ+wTtQJ`_}5nR>^ok!Wla19(Xne8CCbx$b}ck&v(A5xO*mm6s_6dnhS zyMgzwq-;I>2=(PchlxAw-Fp2x-Y@KqHr}1?adlPLQfu}+Hd6FzE#>eZFErc&% zDSQGp=1R-9zh@+kGWaw2tIK~#8)>uqeSEhYH15-V+}BffJKPJyz;4H5-YxIlmg_k2 z>$$F2A-7%@@qKE!HuM7R)Vq7|k)fHC)nvM)Is9GPI+MiP(s<`ne;IrX>fJL?g}$Wh zdysT7_oPenX7KjFtLxzw+J)|CUkU1!ZrF`}u20!f&;sQ5By1lK&+FrO|FFBmc+a4X z+$Zfqp6|Vovfd!+8p+K#mVJ*T9mh$$Pyau7(|8vfZ-3&D-!7EjCCrak;=I+zd&dsq z&EWkBuU;=4M*X_nSACG&dQpZRrfh=vNR!F!I173qcfBk=Anallg8?e_r&9lQco)QQ zDwF)w;!h}B2S0!v3u%^F8c!=cy8Pw2ieISr8%TWOIY~Z%_<}6>SL&3uoHBU3;f?u5 zWq7!~8q@^!9vn;y9ZlIua3-{co~P!vzl;31YR7#kS-;XZ@Z2=sI^Nrr`j5g`P;Vpe z-9(vtAn4DXC11{R0PRc3-{iXP2ap`daXwyMPI|7s8|}o~j((`-z5b)KnVhc|>W57} z-W1*$#;eay?_s>MoMinf!}UB(GQE&jkH6A*7va_I*Hjt`(?R1^?>v?I>4m)d{*(;f zjV4}wUUnx2NWQm32Mu1CUdXHQx|_nTWT#yJ>hlh>{rV;SEAf)H8)q`TwDll{xAy;o zH;y;{|KLsFJ=b{iuiyMtKUATAOY4Uu-hOy>k?h6zsSAhran_#B?d<#aCCcW4q=k}~ zvb~Mn%6$~$T}u6xuo`4Mh&TH@BFpUu%6POuX_OMCNwhdx2MzJfq!!HjP1gQu^T(a<)4btV^6|5I2A>b==}qoX+n1WCQ-aSp)= zRQ`K`bUbA6&cv(xi(0fh5n6+KQ(2P>O{8oVEPy#+y;FT(=y*un$#qQ=?+WUF51T-} zx?b$`F!91curJv4VwLx9ix=;A-W#V|4x@fsI3LOpr;LZ}bF-`$k5V=j7DF25!HR30 z+k|tJY@I(U<33`nsas|f@gGi`li+Mn{|N6NM%kk<1)`gsdy?FqC#MVf?+&|Ncggk7o3vRDKZ1_872bbF zito`u68eGrnDGy?%wj&*zDbVYy-RqtUq(~^X_yM?uAZO3_wn3;@t#4O&d?Jy-ud1;in4L=G(1;j`*_`oU^(e>mmfu1 zg;&#yw0RBQ1Syr}!{eoriq=r3%O*Z5?0z)y$oFwd#`0VSXgptMo8^u>YcOpI^=$vu z&xG*Ery(`$B$~GnWK-g8NmRld6 zqW(0P0~+tQ-upRa>)?0z5$x~y^z_~@yf^k>*tM%(#x?fwRvgFo_TXqx@AzO^Xc%SV z;Z>Lkqj630zF9tBgZD>>kLG)?dj!wfRN`6RRn)KWIO`3lx1;wy`UKl1SO$xr#wWCc z6vraO7oMM=^o>`J`0SL?DD>gT=pl|OL>JNcN@7bciAR& zZL@z&fY7jGBhxD5Ifi1#YWk|1d?d1>(`#&iGFc<-V9!;pgf zei%#HGazXid1>AZ-m{H2|GACq_9|=2ZFl6q@?1x0UN?d7RTyu6|NfPCNBtYa`>OHI zX8!DRN7lQLX&?E1_^bPHy4+HDw;FH1R~Y9v@V#By=lAbw$~JiK&*X*rLA~)OdH-N6 zHy-}0en{XQXuR_70HNrqKgSy^zTjV(URt~U?_M=?{g8j3-Yz#A?~d-% zyQg@b+<5b!JjX`;)nI^yx=-Zz0VJ&;{~G#zR>s`|y1$To zF8eq=k4jDB`$YKlJnbjiRGGx@oq+nE40ar$)s%e?Ri9=WRD|KUQ;=cbJjH*Go{LBv z$r+qS)ynyM(B^8m4rDtd@zYFFC`H*Mcm<|I`-!>pk@}fn9`twMk~2BKtetz#_+9F+ zgl|CO{@QzoJ;QzlR>DG93UPexy>p1qtFr&!)-SJy-6i<7Un)%I{1Iw`#@#hI6%9?E z!m~8+7R&*A{5s3Kx80|jA9kPP)$ zX|ANu!IU+IR&XpxKdh5$K>S(H_rtdHs|CC#z2veE@pr;5d_XSVDb#-rmV$a8_TDnjvo6CvPz~fdz@)cv6K~HvuX{J_-o~q` zA@%3?;e8wARL}OqBf-StvnlHVeL%kNG`wvP>m-~RJT5QHY6Iaad|#D(f3{b8e=hlc*!A{a32FfKhrkF>?^c;W zyb~##4)Y-mQ^k8=ux!%&E#pbN^8Wh72VpnVco$LsGx!43yU}}pqO9x-G79*eKyrIO zQJj)A-uQ=np98NZxo%mBHoJq4qi>j4+I7oCKGwke#~*UtGKqH~UfpgVi0>FU0d!n( zTUb(PBxRFeDZB!6VFOOLD(HhsKDYa`#B#ppX!_$b+N_0dLHnbD_x~(q(}VsfAusg3 z5qS^$&ip1t2JcRFbN%r<=Ogl6=~|%URi@G(MOAQB;vpS7USl7H-BG5!+~?bedi#U+ zr*AJ|X49ceQ-}0njQNe@Ioo*tX&gz~52U@W*FU%BUGh-5O|F0ZTyA%ME7MCmeof;Y zYrOx}c0Gf4nepa7w<+5Rjkgi~^>?2KjepGZ%*NZCw)VWvdfPDVERgh9=XJV2PUGF< zARiI+&!^qR&>Li&?30VP=vvAKfi7e5$5wD%-?Sgb^oL*yNCY)=?ThDAwhF!jyZx>& z#8Xv1kjIzzqO1;xLw?UfuD7IU-^sVXm`V+p-U3>Jw)gk_ z%eABIJdkZvoX<|M{gd%}Altv#r#uH`;^;ufamw~`4DBX@F1M4YXSbKrnWoEL`l}ya$u*6V zzQp^D_f8}3G;KbFjPc$c#9c1(BHL%E4YDjo`*r!QAsvP9Ea(KXL6hYqUQ*~z%I*hAkCU&#w*};IK(TKF15W6*fp2SY4$0%fOzq;tsi z_|J|vJ>E~2i@0%kbv$&Yet$@Uj<@z%lMB5`*@qzMEAsC^?xl^oEH{oNb{P{B=x0f( zP{gH8KmSCVonB)Zg2pY|TTejQ-3n71&urV z{xH0YUMEhdJcrMO3Q&W7tq+`Gqm=k4Yr--X}NYM9plATVQOW_`n2xU1Q5PWvI zPbm8uz6ZNcN#i{)<@=#h#2xQ_(oD9Od%RKB?FZ^(6Sm!UDF1nh#G385mvVfW!F!SS zrfGi|zT@FkmBu?BuckrNzZXV^ebiM=LP*(QSt))cna&h+^0(8t%+At zHR>M)$AZr9mBHkqvncBd+JDj}wR^-JYT94Q^haSV=z4v-Z@-+f)u8DI{+8o_hEXc) z8F9_c{QbtX@O*xk6LkK53p}B{D60dK4kd3(U+MX$j+24RTXsK(_cXjZP8w1FL^u`H z+baktbOB{Op&wicI-lY^*DntpC$2`sb;YaO;Tx$x7RG~m`+4shl)VR%J|?en$)Cry zo+GCAinzWe-Y=-X34R6j>U9l?cjvdb<^uWg_RNbnwm17D)4zMs<_KsHx|}Nbc<-d_ zewYGd;3;U&b)pJ9uu_L*(BHd9GB)>qEZANq_KCQs@$0x>NSkjU`gYE*&$&0J>=ft@ z9U%eMKid0c>`(IB<8+MulJVb4o5vsx8vnUI{>_vXE#Ui5P!Xzv_0RJDM~y$eZ^SLc zFUQ}Kn$qS3I2*Lzdj^w2*HCsd+yg_v?ypyPw;o@({UYuYygE)Er~b1r2h=;;d)HF7 z8OpuG?>&)Q?>g_*>%bYj>+r^cwyrvD_J<~*-i6+K9%UE96%bv@&kW#7u+g2uvJ9^c zwllK6$aW@EE8>2^tLw|Hv>6U#LA|H?^>99AAHWLOn|-@oU#fert}m(D5f|pdhW5jE zwD}cwdN=2t?7dAXI{{7s`JGSet>eA=+;ejOh^vNI`yoLa>4%==8ZVEcOA1LpJV?3p z!&q_|6LOtR#&l!v)!(&C9uRQ{;MMW)B=x7lTu^V9VCaXwrR-;L3;CW2{c7WF<-Ix{ z;&mdfp^0}_+SG)Gpx*57_z>?oly!&8;nRCLufwIwt(*7ia*H1raV?GaCfW>z$3VTy zeY^`P`xw^3DzN>~H?JS!btA4FUL6m=Q9rVX<1tY0gTbaP)Pk~8;Vh8vHQDidi}&hy za0f;BUf7?P+a<>PviFv@+(zcb>*_^ZFT6U=M&TO=(~WnT_sTf?g7S4BN0-ww>vi8IeFg1ArbeG z=?7ikS{v_H?=5Y8dq1xq;)h1u1iZ0qNPO=H->oppcq_{WnRw?=wg^6hPOs6ybPOc+DLu3nBQOr9cM>*@3EA%hI61j*zMUS@9o7k(d=B}aGg%3lNW!(G6&gK)*zQ-fk|e+kvuHomf_cNQI|H2;3R3w zoXGLw6W)InWdq?3knic*<=4!+bzCG4kGQpXC0&i$QbsM;OG5wT`+;%158>7A_JhRr z6ubbsT-5s+W#7Ob@FUpo5%lx@C&$y-?-3joag+Z);>9};uWnaLKIEAPI09sKKbd|Q zBLUM7D=AwKRhDwhBh$%c-?#x}Ne%Kb*Cyt}KvL{jj_-`W6>a3YayN4IXHU@ZkE3h~ zyahAib+G4r;dQ}wOZ-(i&XbgkN8BEV=lc6o+N^^OApI@z?;BJN?avPLFu&70hFrGe z8oQ1(JuZ#6h`57{_ju}egv&tVZtlH1FXtE?TEdZVG}Iy1#y;LwK3BKIooN+uWASUh zccD#h=nES6jov?mvQZ#u40-ygVE>~rOFoP3qx5;~0tsp48tT4g`&}VYa3VHKXiAkaQ}! z-TrDH=y7W7x`?~fcso$P3>*0_72 z)H^kp7J7=ZX&`Afx!eaH-Inh}L~`5vDC>0**KkwUN8Igr^>}11^_RhCpk6%>-$2=~ z5L!i_gZ8h)y2UTAZDXN-#NBQBVc%Ez?kH_`0rmRptD!w8t1Uj#aK=Ds{Ts*o2wq*E z>(TCXI1hCE9+Wk?&>+f2!ZYwFj0Zi2l9+`RSF-fTb5jWlR$BVR?4X=U5 zozB*Dp&;XV5T>mG+aGnjTaVA;H$>bIrayk9{?FoEo%4PZgs{zfG}D@Z?T=R8tK-ex z7;*iM$gLOWQ@;yb1{&{=dEV!k_6%6>ggkEs?=-x+e_c-f)$ldQl9KhUOt8qx@A4(j zs=@xC*Qz?Q&V|1V`d7BcZeYZHYq;o^Oh`)*9ZG z1_wa{u+Lt!@^R}}koxi4BW^$ZG5HT^BW-?%qOWty?H*ZxY$uPWtSuyL|X8InRHDNBK*XUS*69JXs)e5}Dz4Bnj} z*K#GL?~J&sP26wM<}>&L)cE?TxNfNg8s>N4F42wq+h^p12W$29xrmcK>G2BYjk98{clYDV9zx^{@MZegy63tG)N~&1KyK@H@N?%b_>ELC~A+_AKv~d-UINel02SQpA0WKbHL; zKh3>`KCZ>HD&!jX<$jzTN?B8o)STRYw^r9teJ(FHE8-%J1Me?U?weBo0eAs4?h)QQ z?`O`D;nZI^?uYu&=7%ya0pd-P@5-`Mw|stTF2|$zHOc+@w`lhsNQAN<8^vUMzy4#U z*|Cw{6!wRxL4BV2lxrJKf*!Rg?9OsbsZ$_M_yWgq~=9jcf7hB52Sua zxD3?GtGOhFUZw0k_#VE7_lawjk9CvJWf}e<+md%8?qR%goHvtD%5UYJ5zrj8pO5w4 z!Ia$#FTzB49%}tq#x(@#gX77o(a&~0kG;q70)9=}&+pJy`}uhMrS)?+@3;M&!27Q8 zF2(nUIDg9>_tywMwCu^0T@G>_-4~ZUtLr}Ceu|%OsWyP=?sxhUbiR4?SW|3S%oHu7zp8 zE7SLY{XpA$d-i+phvv0U(7p}rb$il?=`EoZ=y;L#a(zYK_tiRE$~L7Lh4hp3mG-yf zx^GM4?ehQNjeWuX*m&C!PZzihba`mJNy_eoQE+*^GVUI78*|z(4~<#+GlhSs@sFj= z^Y9|%_s6T0EPy4@eG8vz`eRYPdsW0eg;&p$^55&4Jsy?-=;x2{{oVJvCh)#&y!!h| zvs>lXcfb6%?Z4zhWO`}Oucq*RV7&R?`?T?jPt%UR_nF4~HC|1tnb!^Q6UcbIh=2Ul zBKa}kongE2zB=MIoA&FOtF2ItdXl95OWD6%d2MIMXLYtalHzzOG|j~!zl*sCj=hZM zmA~Oh;Hham^1Fb)LQUhDUy5f>A5Rj`F~%eBuaIR_8;|zOlR>xz-(QiY{VBB9_4rWQ z$?p(<1ky9wud*IXIE{ULM@w$Tt@f3!6B)eSjkg8$<(=C4{`!1xYwvBl1F!p%`&(vy zWjX4yl=zId;BwS{i{W{|#HYV+D$BCae2ZI>OfPM|<9Mf=_^emj|K0c!c-}Md<-ga< zc(Thy+>-w4y~`f?q3B)M!~ zFJ>@K%$kC6^uG7@TU^BJUJCcAy`JjUL|k3`x*b&i=f?llKlI!EY2xdMJJrNrv#8h& zsLMW-T;ty@SdT)3DZ3Y*g-2lm*fEju+i;10+xfy;#+!*hO`DbQC8)od_t!03>>5Ek zh{H)>{cdw`JS6d}Kl2U88~9^EAGix>b2VHC>c7_erOI>SB+Ve7Eq~Yk^FFyf&&lfb z)yz8X%NhUMv{?rmKuofH^*%yzaj~lelB!Go7jC)6pIjetdokm&Y;BH9sDA`B0Wn;P zw?{B7dpz4(e5Cf07x2nCZ1%p~cRcTfSI5h_)b9gVfqL)p-rFg=2P8ctc>%AEl?>iy zc;ngH%ro_u!H=L`9fv2CD|Q#bop3Y6SZ?+GvWxpX#&%rdjcwxi0k3X{CsY4rcn{QD zGr!`4Q}jAkWGs@lD_yYPk36`X1ZN{U76%_jDaZn?pdo<;}S8v*lhqYx`r+ z{Ox-j?-zLM_y&jJI{`WyZ*}jzld?x)HcSzSG411Ak?+uY+cL%%%V_^nZ_i*Fx>*J1>i@MM8>w2=5HWi}9t~#iHk@p`%*~!oe4xmAM za(#A2#>XP>*L6jj#mh(CX8by?FQUy*xChigQIFq|ju_UIIz4k@**r0|zNHn&`x z)21DC0Etxkf45-RhAyS-Y8U{~)3(3A75DCK%e6(+)imB)Xfp<$0FAqg_e%KT%ESvh zK^3rLrft5P`tjqUt|5L+&1rKAbO0UCeri!K${q&0KEzIly5^?6{0{9T>P!Yn*CEmN z8jF<2Y1i7cdye`u;Wd!@{Y|^~DATqX+I6Izj*~S^tFUXas|V5_(oVLrXF@C*|_6lu|smit+)c2-z3^cU0uBM zvbC8<>R$jafX02Z_pYtZ_7u+8oqmG@U>31vAkDFm`z7d?yIFtk^ZUEZxl#8p{+Rc_ zO`DHkHK>2N_y0;+`8_yJfQnEVy7AnaUc1`h{rb$7D3j+!-G>GIwP>sU%-{68UxWCq zKX!i9eT84QFHP~D3g?6N`vt+gg&v^nX?P3LPzhhmJKOtQuG7kKSLTAKYtTG5-d9k6 zE&K@T9p}AcIKPp!+n&X47qI)$TfA4tda_H@oq|`#;a6#%*P%^qQ17!@n+qLDS>;!Q z|LjTL>eAd8m+hb=8H3sHk>l-xSNCsnpT7m|TNFi z_cVOx!{x@ySJEYg?xidR<6*_%GTV7a`hHMv8t*FwyfciqCW;+-=j3@4-JG(p&l|rm>Mm}P>)+ATp9n94F1J^_cQIw3!$w#Ky4{xL z)op7qhP59uc<(b_xpq@#FPs81FWZf--ka?W|Bqa&v+;^sl6qbDsC&kE!}xZGeT|pL zk|bsC%O62`Gm!i8TWSUSM)CE{i#Lh)HRD~3pe6148gJiVlbAgokq?;7v=8MEvz;56 z=Z#$yb-x*}{0_&@w5zmtt{=8|ul^3l=}gQ29gbCb-VELv$K{q=FWTG*BaN5S5=o)S zl)VVALfyIBANN)HZTsbx>=AW`4@2^jsJj`jZtpu&e*laC-CkBI3F56D z-K+RD-A$X(@F+<4%6L06@E47z>^ac!AZ=2#|A_Xw{hG=24`C%}d}sOirqtwo9jfnJ z?7k=e4Q3FN?nmeN_+%TV#{urzs9SIR9cbGd`hoWAEkW?1QIw5?X)qb)%;etKAHh7w zeXiHc(s+xH&y9nZslOOL1ob}ey{jnO0Fr){+>BdUCnV{5mb@BPAuk$b-L zmc02-4B-6DcsI}{RIAt>1?uIoRY{@uDEkD~!Ixn7XCw2x@f)LV1m61DrhG59cCkAV zE&}ylCO01OE~G32zrqhtg%MW^q(2+_T)rE;cZ%o8Z;HC!Ez7uAwkf}Zw?D^gFb}j} zU&Jfd;g{9H2{#^C>}o+hC@xdvszZzl^T_2h>~TY4MAWUsul-!BF4t?|e9*Y($RGIU zQT9H32^o-aHmWSgW}I)1BNw-hv)H{+cgP93xOY3K*c}WlLA@KicQ|FE;VBpgwx4Si z2VQxeD0>`uU(~fQ-gl_K28!$Dy#1tOi1%vBZi3-(2UzdOJa23i=jC{{AGkH@7SLuP zXuJ)BE%~b;SJ84D1DJ;BD?H_w~Kd#CXp zK>gET1gN)#_nvkL$M(6&3LO&|3Ekx)SL9)qbX|zl1?MH@rqN@wsAH(>fSNl4%F`k zJwUx--7LjDxth__Gr}YW4u38zoY^8J3+m7dv8t34u+=C z5UjUWp4X+K?r7s}N&U8P2B>$2_jaPJJ4m{W+eFfZQZV^P=3c*BQr%mJr^dTaAs4=E(y!+4$YCGZZ2SI6%ydEWTgsJjEN zp7;Mw{ap{|I1=R@DPslgjKrG8OE)>DC*m*bnW{c)uH&fT7r%kSLPBA4H} zv-|pP-mUw3>AWQV`Nl8zGY_KeA)s+z;r&uy(~jTIKpfen0Oz+S~-%A0K$H{(jyQOe^&Jc_Z`P1e3;pxbZ(j+nF#6 zv_G;B9ufDulr4u0JkxCZz8;t7j*XAHlkoP-&NA=Iqs<>s_K2Lf7zHU*g|ZkN0(D>x zu0`Ir!spwLuO~!Z!o=H%`YoXqXuP$&wb}NHO3FXWsJ|N4fTT%`xhCYhaY?B+vFSA=-CjP*xsasTvr$*( zq}=@P(wO7@XUe#8lY{3mWSs~OTU}@`rX2{98ju&-4(oN8*mF_0J6_#RsDCXC zf_$$$r}Zf1PeA^2TFvsjvFBMIjCUGs=D-rj_pYVvN7xD%}NxTw=Ch3>IntxgUGk7bWoa@iepK(t3;?(Vz6Ta=dGQBi!d>Yro z@#^`?0rcB3a0y7fPt#ouf*?a_%07Va;A7ykm@M<6NwY1D1P-#Gg}?yu42F?bxrpQhUV-hbo?9J_&} zbI7|uE1Vs@SL0u0`X{zB>WWUytuL3*=61Lf)c-~hN+@z7&nAPUW5`c{9=Q9%aK^U! zqSNH2zt`cvsLo-WLyIlK6x0`5pznj^5vyytMT(iT42G?Lqyaa1Th_ui@48 z=G#`B|HHW_F%2q%e2;YkanB&`slI<~+{q2xe=z|^m!fu*ZK)Mp8;@^{x))7ceVBGD3mI9xwW+U9g14#{OXv-ly>05HHb>oRPL|ZXQ{2N4=w|$m6rMc61e=*+GY~AHITQ4sQlxEx=9xY2k^{Q4))tKUqyq-tEBvtvN}LyvzFKQVrdSDpux zXT63PZ$e%tp2&X=$Be6g^c+rnOVpiX;vG($4?xPqE8(&_W&8I@ z%Abd4!1hC5KlZlu1Kul)_eJX4-;dUK#VhZJm@hukj($Hnh4)V5?ZZPti)gzPbe!3E zZ(@3eX}6QxcyGyzH;s3U>EEwtQ?3o`J;?ee=d{fwK;j*B3fEU*k5hSmg?t_y&&vQu z;#|ZGP4I5JU5J$}ah=-cmfzE~oei&n`ak!6$ug8nT1~!I{;r+dck7t5{xtrpjei4e z-X6hsYRJ|9Yu4yOyPd{14I~{z-cbJj3%@?^kSH$Uz5CL$&W(Vkv}q0PK~8T!qJMUg zi9D8YA!U7_AIR~6zN@*%E=AkkR~ai;;-2w7X(aE}97z2;Kz+MXPIvz0?@bQEr+p#0 zyjL@Ucd6-z2k?!9i6C<^YeK5hhwU0A+uR1-q{M7rg@yhw< zj=b~oyovH9?#=?<^~M{|YDvi*3q{RJ!SJUs*-{W-dtwCOY6dg_3 zNucR;{#JJ)TH^L=mm3EinRYSs1dY$H2ifC?Yblo`?_*bo&a>oS`D3aK-sAA<@=DU~ zUU;B@_X*0L1xeE@a$kz&lVCwiVfNI0n16;dSyJK>cs0F9yEkDe$a+?WfBe+qwUqq^ z<=bulj6p5@@d_pGZsVy+ogdh~)FNjnWj%iUmu)~|jF{pjalClo~&NthM0aBN4uHuGN^Zn_kKp% zTKFFFpA%cfa<}~u+r7liHQueX37y4tZcy)+-dl~bnjoq7`;1F-e4z1a|0eN%S-@M@ zc()jDqrd6R;4ObV0EOJ6+3c#!7?U5yfVjq#pM{mbDxP;XoB9Z%Ww zFc)3|>pecto7k(w-G?_8v~{bf|0Dbi>OInXtDVhq14(trZ9nL8i?R*N9^39+;wIzO z^|%4`n?Y+(?!@0 zYP^{k$BTG1$#(oU+6)HSBFlD>pL_V*+uIHJCBf6OQ64LA+JSZ%!3CeJ^ji7Tbr8e~$MH+G)IZBmKMk2i@Jf2^MsxXo`$N89NkymA$Y0NZt@wz3h>e+ve zyAy3S?w(BkyK(D&Es3`&UfI5Pr+sI910V(3&-y;R4U}z#YUgu38m3I)IpC^6KX)Ym zXl#*_?L_vzdOgnj3dDOX?KIw-`Qz`#tK%Ypcbbp4AMqZCuMgY>8t;qp0gQ|Jlzjl} zU=_5vneXEHc&C!f?=9S&i)7S>bOYY-GVnpKndDcz;_Uw4;n9r zUy?%eDf<96!WSU@yUEAvs&TyT$3#!ozgUA3SN9w`z$aPn4otAk0-1doZ;i?SasT3N zk5|qoos(@sdLOP*xWt{nh&}^!U^@EOCqQ#;7}%erQ0uf$$Kh z*PkzhPVd5f61WMjg9Xg{3RzwRwSio=^ZLwRrb&tWDz6_#)8v61U ziHmf~jfb)Lo`GkL*B@6Fy-3*`u%%XTJjutoB<=U7y`D!dVER({6m))Xm5TJ^I?8^6 zvR%0rOm4p$Re!f&e)T*ugZB))vV7VwgHhTvfFnS?HM3e5x`VR&U?PkKSzqJ$WWUpf zd=GQ}kUYA?-C*Wd#{WySnGM>Ha(wf5`|(`-lG1n|@$o)O(X042z%Jc#@t&Ej$@NFd z`oLXqD<0bB$0`WdeJB{}oyni=d-M+ZyC2pgScYoITY53Mb#S3%s z-st1KlCm4&VYnB1e9k==zt34jyt1Fv@t-`t#Fd7gZ80)DLWV>HIlrP zwN!5+qu9?HMI|Tb)7gfbNYNmsElq> zC@DfR65UBcNKH!8MX7XAn38m(QWPcAO+^%v5RG(Ilxs;cbP=Kujzs_Gomp?Qnzl1v z=jXqEp0l!MujjmH?X}ll`#Mfsck_7^9srH&r&N94c*>@Nq}h_^6ITrHSiCyE&1d;n z;dM~&O6!&T6<3IlbllavC$-Yi$BTNMIn;>xE8d!^x@H~qeu9f{PkWoEKJ%U2g?ogc z6*PjHWjL<`EeWb6xr}e+>Fd=Y);z~N(=L77(S+-J^Qp4{G~QS7($9S_Q}z}}+SP~W zs@Y&OuM6w~rce8HJFKMMM)(NS`)<-?d|yzu8zgnRgLk#JOnEnR-=V}RX*>I- zdJw_;6<+O6neW|@{itjO60i9F*Y|Ej@fMGy+o2la)PcGnkqxk3{^{FGtXE1QiAw^W z?V$6NINlImO$Vr3{0{E30+g<|==GG1hpC|3ko@f>Pv$tTWsbSS@hoAP)$lGzf0y|5 zyxbfqmkYJZG2c3I$a%RcEUV|` zB#!*f%f+aFR)=(ZoJrmN^tsyP`gfe3YOKPSNDQEDA;qC9`hdne-FoFb$4ivI z2J*cZ?s_}RdNtl~=Nxl#r}TQ;N}ccFM^Nt@)_agLUoR;&rjuL*$)`WW@Ycs$Gga3F zsdqAz1N8<`kbGxSRvRQ;LOz%nGxuxqe39G}6S+OdT!mNLw;{`42c1B@HLQ0GWs@KV z^8P#be9s8m4*Jf61m4k3ybGwa74ks6rz9gZzNU9EcZGZ5ZkUT}33Oo)SZ}==Z@gQM z`PymUNi6?7nBHlxobMs|rcyQ+UWY{>@#=g34_dFTw|I{na|S0MbUQBHhwF}TCTP5+ zt+zI1&$g6Nj`xK~p3izScQU>^-b<<54aPa%P|{?4-%$1^l<&)Y684lWYz~5qjs9|} zT;nypa+rsu$H^;LzAbbFjaSeA-A!2(9)^d&ecxwW>plGaZFtw?mHyyoh?>aq@4_xn zFJGS^$yfPqj-{XpTnchtu{%E5XAB^}kbQ-2Z;9SHWm(=iXPbcY;7pMA zmFvdR2kKg{w6DB_BHW+rWKO)=zSmPv+u=Anp5@oRT{7Yg4d6P7NBiFCcu%q3V`<+A z-anmqwSD_J-YV9cU;7Toh&O>ZzzN?_YTcNj_$I(4$NQx9K1bPNkhDy4kMXRb?GMp` z?BDRpyi(FCmfr?ngSPL7)>~`<`zVl9g?t1t>UCaOcamyPPxZ6-Am-6{b^NWx@|QzP zQ19!hsi*ID%KE`@xEI`bC)#$!XE(RSZZ{r^_PBx-!JD;~A&#RQ)hIiOlQ!RYx(0=|uf_I+N4mVP#EA#-3x2ug; zo~s&2xuneJs?@3N8^`;qZ3kICO1+8jDiq`Yh=*Ckz>~4)p4TKy_{2r`k>zPthXm+55Q9}0mQ4{4Y0;~wI7>N+~?Re?Ui}N zi_}>J>Rn~MwyBa?ws}Md?_G{}z;V1=6X!C=yE?ihQc4x#J#yi6C9%6R0 zk$N9F-ZdFs2{aJptXIBQqd%WZ%J#h)F}#cMhLTHj z-v_<}P~^UJ`+j1*btr2LH^a3c&)02ind-lJwjJcVdz1I{kKw)uyqY?({04aR{`7ch zk28v1IE3R^7z(wyr>+F+SpNRA$m5T3zPVd^{WlxRIT+{xy8g?heu-}iWeeaPcmrhK zJOA{QYl+RZUqvV7n5uYnJ6Ol^U&Ag?Z*A)>@&NBmgYs|^xa(<+_3C{lp~*R>wvAWb z|4^CbuYHYnwIhW zHgehjbf>I8+y{A;()*vr6;f@XeX9-sAI1BYZHK1lM^a}2yaO8VeW_pS+e_J>Q1U^p z^MbT*TO4v+(S_VSt}xSbOkuh3Y?H=YiFz9Ea6Zc~-Vq-0M(|cwF9FuV*A*r^-X~MP zv)Hecl^o9TBFOhwPPV>T${1?93cFzK+XZ@%cX354wKkemat`$V2pVkW`vnJ=$L+*ZvsCI~K2QKV@0| zY`75Aduq~Te61+E1-d~ekmH0({B7c^X>*xd$Z=SBc8;0hc;$RxKkD2A>P@}A$M}xr zd|(Xkvv~FR?m>LxVXot~>%&)a1kWZz9XK1@|JuIMxokf@((OBg0R%~uk5zj3^;;`;=C za=d!puF7cc4Th%B0A#z+d2#cMc8D&Z|K6GIXLqpt!>|x^z1i{5x0kX*aN-!oH5iO* z49w*ZidnC2$Dx;U%x!qJKU~Q24WTipSML|OhO!7qlKVrG*NujGZ^v=G_c`(2PQCkJ zD5zJrH+gT*1nZqj?w+Sfb~1h(?!PZ{-;Cp(&GPTS4p6V&hf?-o#xQ6AbwS#}R8IA; zk~Y_NFt0ElaJ(H@{sEW;>g5)ENxt2b$h<(k%lYhm>)n*i`#R@o9B+c|&pyI;Zh2e>*LdT2t2y5P(2<2wAch+J(0G$V`$InW^6K^V1m0^MZ;`RAZzv9# z@w#65+{>%+hTh0Aw>#cxi})@i#0|RD!T7M$_P4Dwxle5x+soTI=I>tV{vh`+lpfE1u}j+fDqhCm zW4eDKg7?L{(&JefoE4!8XuNv=LQTpp21)XMn*8oxh~xbfuWoM*sMiAInN;;^e`rbh z&DPtAJiql8UY=w2I`Q^k`F?OOxL#?8;gpSs$uN5m=Op%|@8cL;B{lx&coxHZT<`Sw zEBDDfO}%F!(<}GMyh8a>_>(&B@z@yaZEw$`n0L5;&GD|L&WG>?WP0WMdv{a57aklz zBRj|AQ>|C`^AWsPI$n8R;{f#vJ$ke^xx)BSg3si64c9wABi<<9TOIEr>g7`J#C*Kv z_)Pkq>s^`=Zw&7cydhbRREavn#uYISL1sJD;IoTB(q-gc{h_nA?}{Arl;f3l5ajQ4 zy{MA&hbyhO**|#o-sTYArA|96@54Ps)VUR0uk^Ell#PI~a5~RMyVpP0XS8n|@0X4@ zMxE#24aoFvplloL1bN?->phs!zR{IArdXeUzkL&UD>&YNt9{L?9Mb@=&e!+zH+DJ5 zHc6h@4uvOh9uy>%BKMk?+->_q1aAk&EAPJ%PNKT&)&6j@^~(Diy}UX;MDaf0cy-(< zPkq;$ZQMEQj3dXL1l}ol*$pOBLC2kX)~n-Acs1wW9dAL$o#xi7<4z3kr;fLv<4)U* zc;k3~a=Zl{ce-c9o4}jf_utGq-u|uqPz>)L$NO*fhdADxyVL#Q491&1 z>@)Xz>^E!i*(G*7Ybd!hf6(I=z3(lwF2|I|tMfDYu08kr_T1wO+f>O+zK_pqf2{NB zFy6Y3cRhPuVFS41B(miGSl#k@e%?6V=8pI3Aw`VPgugRCuY8`LH-YyyyqcP`{0(pu z$oWmVgfJoXVc~X^-2r-DQi?N1p2~Y z*h>H0XZxtXYHHsg-?5N92Bcp2L+)qAuiKZLCz?gQIUs+x_?uaODog#$cAhALcbVgr z^F+_#e8KT@`-h|>)>GzrBJEeYe~9AUEU|72vRvrn923GHlK&xH zL7iJ+80h-b`=;Kb>>DWgIP-X@M}KH(`$Q+3%lvdGbDhMd95WEF?kCP?`4-R()Y~)l zD}B#U7KdH12^Qg6VSOLlT;@3+a-5miLVt7Gqv#~w6$~eUdWTqVh_dP+Df4}Y+As9F zRQPkw>p0$8)VmV;fVT4}>%C+$_m06JxB=RO+s>uVOl>D_J4d(Wm_q&2_d(93&T?1< z>R)O7yPx3t14t_TBaz-oOYfBlA_zWpA3H}`G4F$Nu6tg<5sp#IyeKRAVR?NApg!@1y& zaV@Q1=dR+9?aVRPIq^56&h>C3=z6u6_k6cg)*B=ZB6qJpX!}U)a{VE+E5~%k8%{25 z%utqp8fJpV&EdKvU;n9`-v&vO$Y(=@STpZIokE+xWZOOTeU2I6w96aR*#zH!`j=V% zc~5b_A#{i9;Wlt%@9wlq^1A~ikRO;QXzD!)+AbTc|DmE>1EG8kECY93 znQGnACzID@@UC{en^=B3{0QpZYP}_2{K$Nk2TXN;Q=8>)g;AjG z@xApv@HFR_;1hTgR>FFG3G3W%^H*r=^3!cU|1HN{Ef28T^cQvfF`mf=4x^I$n@Oq9 ziq@d4K3oC1Pn7;qyBhuC_Z%|}kM6gwVwszu9q8XbJ>~I5DVqe6o|e3F`aF&HHyy7- zc{yeR-cWLBo>OA^mtZld_x;pozO|Hn20y~r;9loxO^o7}ejMlT5C6e^DR}Ez?*W!C zF`d61)Vs}k%TrbjBwaw>374MF)_C>Zg^>e1&xBXk*QG4~!cOi%Cs*$e*4vJ(ow!ycK_j>Csx0Z84GuRJ84!C36FuUILdmo~B6OOkW%by30K-+<7 zxg_5+lr4uX@F6V1wZi&7wz-aLVdFQy;ni`W)J*QvgI1v4`>Z!Gi**GNXan+2>Dtv( z_a!tWmvyK2znkKIQ)6J-yPf4_F8?FBdM8-#LCSoyQ|nF6UwUm9E9kp2SB&7j46p7# zg48=1%7S{QS?@WNT?mrGl6!1#^8O1M#}at2b-ayO{#v*J)ccI}PN(d7ko1b=9^Q2} z-gpVW>4G#coOYP~(pT>N8Vj^+5xI5%FFUjrY3dcU>a;&YfUK?qI(xBs@b zUcFB#=J%Ud@anizo#mTA2T1D(z;Z2E%q+hI1}i}N5PPV$={@z%8K?N*k*AD##GHn-mH z&+*(eyaLZd(Q^u$QXuyiRU#MvA)K<_!sYy?$UUj;B7*ze`P{1l4}yB{wBB;hv#$h6 z*OFJNQP|Xl5+|qUZ?e55=O-2Y=2X0z+OvFD=mDaW<0skmao(=PU6c(5cVCu_(fQGd z-y0mn-S$Lx*a?cm{k$nlOWfH#46n1^??-|tbMS_et-|$Ed@JB@ z(Dn9gs>ytZUSOWHfUyUvLKoVyFSKO6MaiX^WxJ5|W~%wk4|uho-OKXJVEe+f_mK78 z_zLrR7_^w<35e9>UB4i{B{nZPr?A<>ijFn*n-dvJHQrB_;Djo#rRPs`WTL~kBR|$r zz70NrO(0{$o?PZNEHk2Z>UZeANR|&Z^_yDwb-(dtcVo_eojE#ad%WlPrOq9E))CzC zr%aucdo`UXc`l%t-?YN3?Jmyaa*UZm_zkhF??1ITyqWFFs~Mw^@i zl0wb>rn3|GChF{jKS1N&XZ^L`;C(`HGh7R9+;wf-y1$FJ@SA%a?@*Q>2eUxEzgh2> zl>G+9m(qX8UGIPlZ{%vf8SAvi+0*EwtZ~{o^LnfF5B^KWdo0&m zL$~?Omw0vmbTx7GfqOyQS)Zf&m9j$ba7+pTC=KquZ>f#B0qy)J+qtC39e#89;I#j8 z>a>D>p#G7`B~#mD9_3Y6a9@plPVV}*I(}V`p>BS2hvUDRIyb^?pnfi`NlI?-Pf@-M zX2Lvh{blQ>)}_R+e$(A=CgRua@?GkD0l$IzS33U2E9HK3?jeKL;QH%Xzx!VJNDseR z>G%gz=Sg@Pw7>XLE7tcJWjo@vo(PCv1RE!1Y(P@w@#d(#LNM2N2pm`>FF69JeOzX9-Ekei@?tJg5xS!1Xuw zXrBcBYWPd09Hu^Xnm`NCexu{THI&@~lExB{>z1)glAdde_4S*J@s_aO+o*T)V?|6a z>%A8Zw>nGmRinJW_1-6W<$pe|H+TEZb&gl=FMNPH!yWH=)|<*wKeOFm7{c4#X@`;c zo`9!7)}zGRzsq}n1mM`5`H{$Y-P3w6GQA3#jv*Yoqotz~`< zr@`-~Xnm(W+Sqld?HujrH?QFh;gEC=buNP|K)pAlKJwj4Sw9#HL%}`I(Zzc8JV&Cx z-+buAJCo&Kg?B-{w_ERV@A4cu)Pbtt#yh}z56`m)`psUvdi>d%<-0%>w4Iq_OY*Ix zY#aOq-@`8;_clc6d(y^}t^3zldOS(o<2Q$#_9(rM=fvP*P`}>C*qgHZU>1yqsjvj+ zID39~h4srj3R>IkJv^A>g!|L+ze*k7dd5UhzrL^Namr@EW>^f%VZfJ#OsrArJF0eA z{{rTlhtD%c{pM2qy1oBIofF^V_z=`z(T=w_QFbRh0fS)#G`xuMmJ3nRJ}vpTZa`oFsp?pO?;#vxv2A4A^lp%NTIjQRS zbw3(<)Nf9SrpJN0)RE(f7Ub%G-o}3yW%q)l;pC5i>z6(wX*l;3s^3iTo0|Bw{U4*w ztMCS>|MHa5_Z4M7fF%D!V}6x?S3Y`7Kcf97`b`7;x*t7Aor)jxEGDSGxAialgnR0s zueUGxwU^htm znq1~EkxMvtKpS=^4^Q)(G5B;GJH#@@H__)nYKianWNqX7FJ+o4@NcjEruOw1-dT8c zzbV&6<(lUij`wftRj1_Hu8YR;E_1xq@m&hdK>z-j9arw6Y#2<3N8w3W(UM~d{_Z8T z?^JT>A9}7`et#(DH^qje`^WRtSpsi>wue4XxR$byLDCoG@}5W?bHyu3_HT0EbPR8K zywc7u5Z?}#KL9zK)813;c7HBqmq2T14)cj~DQqO>jpXt^yTk1~gY&C+HQmngcfr40S^V1A`j2c-!Nxri`W8Mjp z8j?$!&V4hrFG&5>={Ai&<2M~0Z&Q|U4;?|h?X7nTWpm(lcnOl{m5D7xjE%{~t?Md0 z*KdY6-Va!QCtS28?d@Q_r9Q_6BVh=1!4-uzcxPpJV+;LeiQ_G?mHif+0vhjp>#a{& zQ)mx2fXtnSU7Fgq#*w@6#$NQBPw?uv(3|BSTu{i|Pp;m3?6~#>Wpm**co7!j()R@{ zwcg9w*UFd{e~IyOXxh7qfGdc$0IzCG-cp zHIr+Z_hzwtKL*|@|{y~3um9lr>Q+OYm<7x}ZF~)l3Ttm|P8po%OcNfe541a)n zD_C#NHrgGkLq!;jOSi8P8Quim`|)c3t;Ol6R-os zAlvN_>pd~S`8tqPlia<=t6sg16Mx5VR^ZiCm*s1XFJc;!>v-^DN>%h8${vH6AkS;= zux+}JJhIYn5{~CBmXUjlR+3Bim-yl-PvH%eZGpT>sb^p1cSouJ8}&=tK)&MhJ@6Yy zHK{)*6=w4O{o-G7JPeudA1rxUs$a@DD*Ziy_ae?Wg{}8Q>ePcU==iVCdu^fYcR1^7 zu5Cg|knfGt^MW<4TaM%Jv-9H6dcS$y@i(PT2e=K?|4{08`#zxTH;`0(JAP=1GqW#= ze~9`w`ptI7e;#!%hen|O=dFJTWlw;lS>!K3Hh<(pKhHL&$AcBr*#Wyj{qI=+fF1Nv zkTi#U0kkFlvah83tMo59jvr>@PkiDxS2+GSb+*CRASPL_#q4@5yOZN6s1N5s7pHCd z+O`+>LlD{QH`DMoPDW$Qbu51y+yNT*dDigN=U zB;O{=z6VLalK%y6+vqkeZ8O8hANhjgDg5DNEhOJCuZD`CeopO5^0lU{3rOliJ_!D) z-^{lD=$C$TJAO^_T=wZGDuHhA@+rr(g)^VamO63jKSX`q-beF0C&3huNTgp_yYFer zo&!mX$i3!~y1mB}e)A+=9oOGvd3mqohvf2iGn{Cj@g*qx9wc?&WX#X<@5=u?w##zi zul(jk$1nE<$~}L1)D@HXJII2xYbs0q%ywU31n)|xJr3e4vzy~<(74B?RK6~h4TkCP z5R3;m?vf3T90R3Vd^_9u@bvy;8FexesczXJuWz%I_E+iQ2%?@e+^}~z&+3zdI`??#+KHvbJnDPC+EQ(|48b{erh(k z`V-dwIc48~q+iJYgjv%I9i9{E_Tu^@-}p^i+deJmcqP6|U3Vx?uIp8gYwA=!+cw=c_oj5zvcXz6Zfqwf8Sf2+9cPw(U7MC_j1}r z&##5Pjv(;Bu4$>{DFt(;e0+3CWFS;C{^DV+{^qEE`rKX6Ix!L-oLly-_k$kGKR{#^^@s0 zj(6}^P5qx~N}V=vE6DtdUt`WneOCM-$|k@pknbPtjxWJnaj^BihBx}V-#md&*Owee zzr^yd0IH;~Z_0PX_>}E9I)-ntr9j?$u>Ui@&x4>I4=+4721Uz2v0B=6}=;GKt8`^8Q8dO{!2cyF-r4x#K} zkn}jYTr=pE;gmj+ypO$Tz^uiqe;yWtdiA~c>nYm=J762=_$V<(tzXCVXt99# z(rJeuWO+CU5~i%TvZ-b&?EjVbU4r@~?ojc7+3UnrfzNBf`Ji#>^8mL}b|>5q13~`Y z81cw?g!vh9g?s^X=IHb|Gn(a}g6W{%y%GTZ|9i@Qhrn-adr+?(b4HNAcfIw>dYADa zTq0oFIo>l^{sOod)ay_Ey}tJ-`xSh@b8enou0w@lDepnYEB!xqe8B8%w?jLY9|Xfdy|t}(J!P9=59|VYpV;6={LO5y zW5}gFwEu^41LiWkA!$KUsXrL2p(?2Na_enLS$pUWU0`XA^gjHc_3HPogi8j@^>}q0 zpTxz8`=~P#)O(fnrhcFw)U&Sksbhb-HHgw6Ps{66Gfd@d>L z_aWmw*YWy^W#{|%THcy&Kql)3e`p+(Gd z_B|aMFDl=eICJ@2l6=ppJ9pQ%(0&oa+r{zT$=Ep%27?=~cx&Um)W$oW&-3$!N(IaV zj`!bspGFw(0>@je8@JlQldPZ2c#{oaf5_+g#T&!B7O#%uSMqnZhVCHVqI5d@nQsPV zFTiqm9pc;wQkDKD<63RokL4PheE(jobijP<#Ji2<_rlMhUM?|8^2zmwVt-1hF-^G1 z*WEsJy{)$A%|a&z%r?BClr$Nid|%hef2F)t$^XflY~RxYrh((F$@29e4C>YMg=5c_Os1ebvu??lHd>n%|^!25vG z`=bcUOF!#Qu3kOwIGnOaVJ1w06}WUBvC(?Jr#~E!ea0C96BwKBzb~=;oA5TM_fi}0 zXO!&#N#B#Z?V#J7v_o|-bTU#JS@!S#k5Z*sj|5HO$MWjB>fm$7^cxCYd#+i^F_`ojo_ zLQ7nF?Vzpo%66RG-s%R-4^F(3SbhdP1M1c7_$|uTf~1Y)ZoKYxEb)df446ZBHNA8K z$7Iym22xrQjs3Lnx0K~oN?lt^Q166s>3LnhND*_8&x;gG#Uu5mr=*9!&nlPCo?tms zIXy2QWB<;>^Mi{5=6uI{B6Vs&J;yuSdT*ty2MmA)>xmL?UJ=g6a_~7d!yCst6K^P0 z*E~#}74QuZYVz-V&3d;KFJ|^ZEnhKn0-OSS@R_EmK2*x)avz(l8%eRt0;c%*^gOHs zb$Y`F_-~U!EKLO)~)Z02sa3rlkwI~)iv{2{tb8sXi3w8>UMrt z{6osN!8cHwd+y}?Wt&sEwqc!r(U(G(2TV;T&d$t-_p#}ByS7X8$^h>{OM8E3`3k3U{^z)~x3l$LKzS+3B^BOrF5kV~noM@|DsDqNj1-EKpT0_Gj+v56$pMSRu_+JO9Ksn;;|k#7ZM z8(|M@fv>?`PaoTUrN??wE!u?nJ$~)4e^4iIJbyE&{}Jo&PFWOY!#H>fcHrD^+p=gg zyS>dVY$}7KNV9;s^wIQo{5o~kKmv3MwXX%Gj<|ZukIInQ8ox94I`h3OUG?pPiNzl@il>W1zv6MF)TkFUI1;6MK<2S ze)a|MI!u9?Am`(2f12u7F&nen-r-gppYY(S?r*-KPWeDFb1A6*koA8`+1F4d$k+h^ z*oZR$GG^vkfA1OW7i@dSZs2$Vza3-D)zs+*cZ2%tr@EnU9A#5sASqRgYawnyiT2!uo1M~8(aT(l>G_^Vb?dQ{gCu)an7~w=X6ZIk?q6r=HwPL zC&KBV-saYO5oK3EbJ)`HNbi~qZxrvhj`wEjbc3Ft?V<0Zm`&M>AZZ!-d-CtfM~`#v z`ZPBOOmJely|+;3TlfJq?#FH1)!C_B09Qd6+-rKfZQSzxt(QyxZW}Q5@M=4EVEMaY zAZXkRt+&H}*ssDA7!HqsyaT#S3+AO<7ph7wZGJ@D9RsEp{*uYR)|hS7*$;W3e!X8= z7O8zgG1CYxf-t!4GQj$EP9V!C@DF$VZK*RF#)7sBw~$Hlo%Ub0cen~JgO7Qkv!1_Q zV%>WGe5`Z8yy3LVEiB&)`hv#Y*Lt6&Y%xfRldq9~SI&QZhPnjI7RUb~b+*Gdp#I6$ zpHr%sISC|%$g9e~v-$4`m_HqVE$S?yV_!+G{$6 z>ihs^xJjp1GFcw4Z1C+G(1-Dkb>e&!*RkAMe992xKK z46nH_VBUAUW2y5DJP+zUXuUP*Gw)FTE|k6I$m6ZN3~vPQF2}3=`2)wh*Uq0(`qa;C z{W*%aqlfns$Gfip-WcA49^TI!?@tBr#_|4la=JfgJAC1Ie=dMGfw!9D{R-b6_{H)5 zV!iS`y{GeVSCMk`8JV;?{kKHRBgg&l{Q=%(myS0`9eHl{G;-|^`>j{T{pyrU`iMEB z>rIW$>G3&+x3}ZfcBtie4-}vs;&?|n-t+NY1`QqWpVr%$vTH$7<1R<`-^_STG+<_X zcyDsN2Mgd0<9*Y^+s^U+RRC`k?`Iy~TOIG;1@Ol4{^a59?063qz-xwZ-1bDepXqw* z>UfhksxbZ@%X$mrt?YQUpWW$r3)%T>vLo0Z*~Xm+-g+M1-j26$0lZPXtsSqnLqEq` z#CngV9pZR#R z7cqhNdk^m_$D3OKuX!NAyGhgAvAz%CUB~+$4{z4@A>f_i?2mQc`o7~m!NZ$%-io)3 z6Yq!kw!<#R`(Nvo?@j%ga!J{~H#LTLv=i?~0b~A5w_#l0b-W8X{;E%%%Ru+@6*J-$?^`UF zpEraz;^Do*@m4B;H;i|HgOe8Qw7Wc4pr9+&H6sBX}n`UTueK9B-8j@Bh*c zQM}K2c&~H3XB5C2!@JtUd!ys6S^#ex@0T9lTO9A11@I>D9`x{baJekzzvY{Ypq~!T*7h$~BJiL!M-m?nejpA+K;eFKco?QTM9PiB@-p3s; zuP~J4JC=4Z!vowKeRTUi>3C}tz#GQN4cc6lIPPO5_sQoyc+NOj+fVYN%9>_yrG9U&+T}%|9nyf-@D3I*^+@DBCx-r{&G7Qh?DJH^A>!SPlqfH#JBiHG+# z$6L7o-ZYE0lXo+WgM>_f8XtR z^*XCN?qoau4&yz?@#=nKpyTB$C?p-z`MD_GD;#ed_UiZIj5^-4JlbIdpXWCQ$MD|b zcy&HC+VR%1-eZ~fB=GikyxI<99q)MsXot`k=E06vphnC z4UG+$!H!pt=Ms*$t@R$u@mvJ&V;~`rgW9$K^+9 zK9l=Z-0fm+#&(gwTix+q$NeiI>Qw~U0%W{=*~Tm04t!pV&pMNzO>Qcu$ICStZdu-p z=YAr`ujef|L*v8f4Yvk z+8(Q{|5*0_VZ1XOuO26DaJ+dL?IH1GJFbi1UE+9k-u98>{lmkXZQd5e`@Z9q`vNxM z+~#->Sg+m}u#e9&$Kx^?ZJfZn)A4G&e>z_M9)slius^cJYbJ0%rsF+?uT%w|Spw}B zf7y8DKAakqUkq{|&iUlV=@)e~VwMmh`2RCKy?yI>!3NaTeo;jJ!FF;i=LO?XSw03Y zg0_P`pS+Q>t?&o@1Z{A2fyvy9IU>Uwc|2flbG*eXa_=S#2KC;a`rCa~Dsg=Z8o_0- zBW}!O>zkY5jXlBhsE)TM%MXA-p#9=G>y_+&$|VgW9|`*WhR!P_KYXts%O&uS!yl4L zq_NbQ4+}x#K0Wo3ug_VuFT8tpF|!=1w&M8(*hqV9CKtCn+a%BZnoS(v%uL^x`tCX0 z_x4E<^9i|nQ@2YP-)73TgCzN0%KYvhjo`h-@qS0WlRn`)X&}@4t2k?1|J0H;~kuJU?$7Z(vrs{|;jLhhQ{hddE^W1tiTR&(E9K8Zc)# z-hV6J*cSnFrQ`j#`a@`2z_fR~|5pEv;T`CBpQqiHz=R2@_gc8y#Zt;wgQSh*`L%EO zOU}nT-p^Qm2keH-^|pty-yxZ5=I>45ebMm_SjKyo?ki%xns;=(J1IL3pQIDAc%uo9 zKOAo{PLB!YxsN_G-lWj}kk9jLhdAC{{|{dC703It)7!0O_8#laHf=JK&-3$!@m}qC|E=vJj<=iR{kQsW zWP892bG&WnKhNFCJKUxoJ^o%y+g@qgw*`5A?U2CxwBx;=#Z|oy+P6- z^8CE<9o*;bct_^&o@P>DBz1i_jB#s!&g3Ng5Qnm;r zy+NK|JA}Rom=e#Vx3?86zY*j+D>A(wQ=R}xyUFwQ?hcp=jyKzW=x6KwBa1hI_hP*I zd`~0B^TOxy%qU1?IZ_K9u z-kpN1w4vS<~Jq-c@+@xv!}#FYgteL$2-6A!*|M z_LMCLN$be}>AA1u`y{^)n6EtI{m}6avfg8g7jN-7N5{Lx@#^>W98g<5sp#9<# z>;IFoob%+ja?PJyz6YajYu+`=@tm|rTb^IkxTAYH|ASZ4=`1h%=JUzrb{C18$IT@b zZcNz?;IGX0iQr78ee_rA>$ni%^J~}g&RBAd>-*G_zTuQT0khyvIYt=BacUs-zR$+Q zC$Z`FmB3qg?$O=_j+aM}CFSdFli`j3#QoBacP+jzVY}lklxhxNvD!Q%4%MLwC(UKM z-3Jn9mke*{mw>s?dc!o_dDLkI*MqDHX~$C5JDjqoVFfIPx8P%6Av3@_N06Vw^Q+nx z@<+yg<+%zc?)RwkC!AU*?Z43a`Xd_JiAZ*I4)AzI%}IVP4u>`hsHSTxbT`F7~w*zSk&Q3A^DV z_#EV2s8z2k%yVS)VRDII`>w9EKhAK6iw8}~XVdNS z2h0EGBA#6Z^{%zv_LOyl`=JlG?cM46BikhA3z`~^cO1*lfrX&n^2uI%^S!23SLdq z@U6Xz?@l7u@v=}EIpz%GI?oa=gH-@*m_#33f<@ejZ?mPFAV&)RK z8Ja+A_?UjI?|4brJ}u`+OYbMi!)pgC!N`n?Fhu#9|Pz#(#tPadHs`A)sGm^lX|T}Zy3`trRz;?k7M_S~EJ z%qc-r6K~z*(#BlQ^4CBIQ13OV&wRZp8wF3nW3UoA<*h@6k=18Z=kq4O#E= zEdMra1&K`lZk=zR5@vr5&7dAMgt<*w32h3S-Lz?0a*12MS3;jpkCqRbvG{c!)15kd zIZo(Lu5tIVaX&!WBOqz^AiR~+-$kzNq5JLx-l>jPu4BqGCXYGZ;nthVQa`gjhhk0( znin1K6nyhwx#Jyey~kh1b_JKh1t9O97)%?;yC=rjw$OM@1^UJF>2`>)d|!xywzIw$ z?ODoRhfiP?ybm%*+G?G9GTp=zsTefZ#C=m?Gn&3E@0S|I7!f%qXx_%F=^2(^*1U*$ zkz6hZN`F3uk2#($@g`+!U<1fLZ!R0AyrZ`{PVH}!x8?uicz4-&#r-LDcEAsy@zzNF zT3^l;Tw{T=p)y3Muisw&??xU>uHNR>`v_%EijOo?@_f9}bA#qmyrJaM@}73iL&H)~ zZyW16>%ZWWEUJ>zknv~O+3AE$j6vHUvN0P5v+WRiS8 zQT7)|D%L3f`9`cx&@6G<;X|H9ljFVs_0;>J^;V?pJdiZ$VCs7w{_*_B`9ZVEdgXbG z`qXO;Z9u)-tT#&86YwI;138`?Ouuc+_BMuGzUM)=V-Tm-eijdwn-2M}nyk$OSX6t5i2=Q~QGC(jQ`YPv#vI60gkrF2;8gv;&Q| zs*QIfWlz9s@I0J_uO3MMZA~uySL2N}2%3xK-4-@!e|VdE8m~NOm|y#L@`%@59yDF> zhVaIz{~kWW`=qv$YrL1(c+Y9dIR%Kowa^#eFp&M*RPye;$6UwB(3L?m*CXEU)YEw7 z{cQQgyVN7zDBe$P`xf^ZGXP%<=7Gk`E?1JTMKk8KFb}4~dVC3(OuR+g7B-KtKR!Hv zXc07_7mse=E!5L^shV%Rt#M}dhwxQFa|>SCUxbNw7rwusQ1f)WBW%3$Dfm^rA2cu6cn46wD!%&A0JMF#+jxgk zHU(aV1+b?q`x_hYW^y^tcsSlRLGz(UyvwMk@$SqL?{2SnZw#73FQwX7<{#_ueFZx~ z8+Ai}yFY zHHmlO3G6TM{RAhrOdr2=v+es)E6%rF%W(j7h2Ag>XACwH^B(ev^x;XM$BCw2&~$tG z=zg)0x*B(nEOF0ocXYpq;C%|Oj1zwP)mD6e!XeOpai;u(eo>`0=jY*SXaw?|TuX6E zJ8vYHaagyz*npr}=@IV@)YEvYqD~b07eDb~WpO9<3@7Z{LZ8+Brb>M7}?X59R=?`tm zkLV8%2hGhM@m@kbjdw$qc)NSVYaR)jhitqdnyd-F_RtYD-kmnyH!1rTPPviy)x%(X z6K%Xp$lZBFWCHtpk9aFkPvhk)V)O04YdqqO<4xFjxqZT%gRdbp295Vb{tlAw4$20? zco+$t-YH}@+j#eoA2FUi#{Pcs(f#2G>S?@X@a8w39rTFTJRUS>f28bhD18(6KY-37q(AsO92swDGUqKl;w?u#jkijcc+29oZ~G4O zh}S$FG#}aa{T@*>e9yuQpz+>f+xNt_jLXmj>cfC93z_cah?n{EMBMJR(a_AG$$2&1 zAM`$f8>y%9wzKg{XOkq))w$P>W@W^?i2o1cy%4YThcM$qM|=a}UeI_SwDHcQ>^0Z` ztHC|4UxLd$u8+@Vd~o8`dF3YRX}k|*Y2P&&@yc;$=$W7yVdItK`tA7sfWJWF9dF}3 zg@&#M_2GPw{<|5c^xxg&?)H|L6Ex3w#Cs+6G~NkW;?47jH#|3JHh9F_3a`fd)c+7~ ziCd41*E}0EKYPU6(~0-#Eb*4XnYq11@P?M8`h$#TgYe0C_M{WijF$~M3**al0h zvR}g~#~Jm=-Tg&)e$X_+t4aIAkJQuleIZM{%{}6c;T>q>jnbe8@Lj})P#?5?<2K$o zl)VWF*bFk?X^T_(LoagoI4<%c^AeAE4^U6zU7jW0m`A*EysPlacqZq2i?`<(4ML#t z{%GU9kg_Jw5pIBm_~Ib#`!Ts3XUP0Pt}jPk4w~H_@phx0#=9>|ygR(&#asHdRJ`vJ zZ-0Cb!+6km^K85?QMMd5!$#PT&v0^6+P5URY;XD<;fYs*rXF5R+8+|s(|8YLi8q8Z zv;T${2hE)}-a32{*B*T3BOL#Lgt>+v#}`ljR$opBo`-{R5QPy?6K6w^eMWckdCVy_ zW~mjA2hB8(xEE7bBks`KLGzi7`y)il@ok2$K-;;Ujr;stIVOTTp))MS zw;rUOcaY2V7mYc*GH8mtesnuOKs}8&k|o|!osMqj7~Z;gWxr7k{aAd@!;7Ht4zTgA zqihp=4_|?Mezg*AcRy!V2h9y0@%}w>v3mzE%OMEc)L+g;~kMD-Yy>T#_+yx~cyI&5k51L;*;@v|%jdxO(ct?1}i?<@z-ep`{MZ9_V zf}NO`gT_1C#(ODct)V;I3NlVi##w?JcIJ}LclvL9L(nwAt4YU+!PL`u=Vgg^jYqtp zjX`sd-3_3H1=oKJ1e@FwR|c%QTF(3$#=;#&?MgSNw~wjKK3#(TZtWq1a5 z)hMmZ>tv63L)(I8wByzFUFi0-w~+NpyGhDi-*Yp($@Pu* zHM}8~e}MpV@SP6lgSNx9cuBs+lx>8)@HH&_t&mxQQ`Yx-@>ggFxt>{mI%Qu6&41ra zuQy%aCw57%@AfJ05$iiby-S>Wy1kr2J#D}1vb3MS^U>=&j<-8rS>L;$3ch*}2K_sG z*uS$CW$mCB+z#$|UlzAJ-Y2#P%_xs}2T)Jr?U^OsvpnJr?+BWg@ydC-Ed)Ib-)dL~ z(t>OFG1|u4>5gLNarhkGgHNCy&XzEMbu*ZJ3F}6$p-|mKeh8XhJ>o9hH68cES>j&r z5qBJKrMFV!sQjKFzRFMsw4Fb;ardF@ewYT2!&ZEIK+dZlv~HaT#Py^MH6`-5hYN4%|_cz?|jZ*z}$qj|d=Q`eA)@xV6 zQTxY+8D7~xn!>r}61?)K%6oh-#&-=|2igu}Z95F7>`7Pz^Fij_t#Qh6O&9Vbj?atc znhs99x?RMnr|mF4OFN9nh*!=p#qo~AEAv=M>+$V?-JtQ#wegnf$ruS$;m31}n$T70 z`@bezw~oJwV!7rc+YYtqnio*#dbkPH`=<3SpzH%U06)VLTsNmZcr?Y^>TRlI?)E%G;^+Hj#LP_$onFkS$C0pTF36r&G2X^58r88A{y2 zxBwD!U2?exL1UJ7js7RsG{vt;*I&82(sBQqCGG)uHD<{r?gZX}HtyN%-w)2HH-WPi_=0T}Gd`B7tA&zsijk#pk!sd;Pc8-+GH9vU7eL8hD?u)a; zT@!C+JIC>!ygb!EYSOT0{Th zX}{P^J&kv4mUw%4#2dvMalAUd?QpzftXF?`=KMdJ;g#_%hIb_15S5PS5C0Kg(Z0-| zK-=Lx+YX~Bdj{6R+b|Aa3}hQwLN5Jn$kfz*sOF4Z^Sl$Uw!^2?({|X9r5!eB#4FoJ z1n*WGZ-fB9#+L^NLF4`1#yjF}?%RU5U@`2*muKTG*)4URN#ad@AN*Ol=8#9co2jSq z{*fi#FwV?=7R7ru`vJMnA1Xo4VKdI%8QwzLhgmLs0rM67GS8G$bU^C9rK;rG9xq#eW6D~CqzHMb%IW>7_KVeA zyKBlh?|9u@bI`^u-~Zf|<%ht7px(EwcO7MWp!7i68S;qN-#yhY&LWS~&hj0Ba$PWd zNvt^N9C9)YEvs&Jyo9uXyoJ#w+V>44X|kd{;md(0I${$eJ>~ z2Phj0b0G$DKU557jPZRTxr}Rid=PDzYZiONyO4SsZ+X1=ZFg~xcoTTPwCx+>eAH5W zJKDM812*E@0VQ}&q-2jH=U3rox#lmAc-K)+QF)HGT2RxGCws_i|ne z&H-%?eeS6pWp~0b7!3Q*XT9OfWBtXg``kHp`)HMG>fudI{fwEw@=wB3px#cYU+J4i znWiQ3Z;$O+`*95KqmK7Ymj3|00dlqBJ zjk)GeygI&(V)<#X8Z_={)_XyeV;{H+Izl&y;ag~(ahvP5lC0J?*OXtC?k7)DCk~rH z<6dF?Wry&c?{E{efPMH(&(v{mNpgu>?n{*CTw?85k9b3=y5=sH9|8}9dcU{cmnmBY zAHZ5@{y-r!mvdj@3tR7nIPT+v9-sHXDf#E*{M} zE~o`9@lA%3r*R*A?^Mik43%_KFZx)n$-}Q{+QZxv26I8T#~pkukM_Rnc(-Kn?(y)N$8$|%5AUarcX}4@K@V>jZ!Zt;*N%5W7O%hG z(d`h$JK4kgqvIWx#aq_H8^;^>@E&ly_hj*&<>57xa?NfJZ}CUc{h?nLZ#@rh7;nin zRJ2L^*$IxfTNZC~4{sFj1s>k=jyICU+t$My$J@@sTg~y_oW0+=R4l3 zvUmr3c*A(-dw3f--X>YRV?4Z3ydQaZuX4OKvv{X^c;k2vczADeyeDPx&iC+|Cvwf{ z_5}#i)wG{=cDyHK@hfP3TcwaY#{lDY=o#ji8D%_A4Ae zo?|ld#<=wTEv>CrV~)?{ybU+<$oh*=|77Z10L?(XOy85=|^w#3D zOF&XXa=XR}YUDwPih?>1rHJ{VJd!c>{z4{;h&TT2YJ2~F;?|FLO|KxXW zqdR$S46ogPG^d}7&|*|Q#8EuDDDJ5!Q$pOC=ty)J8h?&?Vlt2CGrly=>>i=`E36g)GC;b$78!+;~+wIMu>`=nn{N$%c)=rj1c#3+iUQ|4~; zUex@o^E;AxPJF23Q^FQ}QO~}&Z?=ENLw?=Ql+NWo3|^CO$iEh?b!~DEl-(m@R!4L#Nw*)wG(-Iq1U3;{x!kAhS%}C0_fgo2XuEd{>%!Vk{s`x6Ut5- zW3sJeUO_Ynev+fX=qSoeMyH_G{yK@PG7B%rk8UAeGK=s`K3~%Bky+cnVJzskSTr7T z4;DnF&h9zn{{UTq8n695+?}t-PV`drLR9z8ZvxZZrG1J=kmKhM-iHRyN7n4sx(w`G2!}t z2U5=gE8txXuk83`?vZ3ByK!98P#v)?DBllN5ycLJXH|w3XiQrU{ zc*#o&i~c%KZ7h|;+cWSU#Phw^$-l=9j8)WlM+V+4rtv!!=*{RgXbE-=mF8Gy2v;$V zjJNp3f@q>^_YW;=MNjsq9WA1q=+xf@I6(V&gPUqc%{Hr5Z4P-~#{RrGF`^XSyBzOg z_{96R<6T2m?fCZso5E9` ztC~~hhq9LnqEDQ?+fz>Ox9&}7{Xah8&A*7a@#wXv`acJ!?Cl^MUuJ)OrE1*YO`c`w zm#EpN?|&kh^KPsYjYjW8Z$S^Hd}WRc{1)&7aYm z1<}mlhabuEEBQO!#B)5^?tMb(3Q`@i5BG7EWbG#I zK6EKsjxI)ZwwQWWGLELgr~a>OJLN0hEr>RLwdx%3DP?{}e?^U-P)y=rgGG-#vkU1##=p!drRvhw8Tny9CZ2DekgQ3ZfUCUs{vD zGkPRyepwNCKO*iobf??+&IH;P9SGl0bXMyqni06aXMEUsBU;Yq0`S|u)0;BG(21zo z-7I!{lvzmJ>*yEghp2wX#_prm1n%djC;M&bR|QeiB~`rZ$lqxOYb$EJdTkELJVM+@ z=pX1$XrDc6MNLQW-D_-aOQ^A8yyf2%M8n}V>3LLM{I})X-(I!;)=k!(yj_SpiF8{h zRi=XSH&EWj!QSLK6g?F+yXGYHnQMr<34IWqg+@hH`^~e#E*rzSRRz&P*WP`u&W{d3 zhaZ&ujfDyKKeqo&~SXtMuQ)@Z;e>`Fj}U@Q!o59r#V?ne+4F-<(d{dkJ6Q?hx$lydFQ; zep&o|LG-laP2Z1td;gRB(QUTwZo{ufvN zIPwfc&vfNmCggeJh`Srr-eteDS@IL_?Y&-A|AVAIjV?s3{(+(V9(Qo=M1A?_8*Xx&+Iab&#%yP(UZ{AQGJJQ4Rd69Yxa#xYuGpHWut$?Z{y^4 z${c?uzmtd>|1p98p}V=4pIwLF5ri8Zg7$#3B=9Z^q4lYXmAA@9eV10Br_fpGJXG(dFDgy!ej|j9=%Z~=N$Hl^=sNgwG2#qBnFjarIW21Z z?*E?|b3t=%niJxs?OxZTssL2~u<8lUN?nCFH zX1DFz&z_whJx07F{dX?q4~ea_xpvuTM|f>Ke$J}*G-aQ2ygSEC$$FSvM$t_DQLUn? z{V`#!+P910?d5o1gzp{neaCxi;9W`F&uA?7*Svn)7%zwSJjYv~{H@U<)ckN);5~!5 z;izOh;hFe#Xz;DsD_-3|RKIeNM29(0B_2 zZ#0j!4wW<~Jb0JCK2I~7b310E-<-W$lD`|eA8P(63cL>x_dF_DO86c+?v`4WzmseJ zsI-}UxlY+=(>JTe-73nodaw@9ZL0W>2>fRdHyWLRPC{=)^_{*kp)V(e@DMj&N_WXd z$2tDFlzAL2N6jyT1ApU(7(-}hbbC~5NdCFW=lNxU`@3+?t?1194X^DFy~(d}-Jj5S zhX>vZh$}@UmlN7PXZ}!l_f5$hFWEI4J?!kghWt07x1z>7KJYFh?o0F+^gC4ZaAiSa z@7!Q-PBO z`JAv`mv+rY-#NQSQ>F}^ftuanb)n1~#8se@<%GJQNI%cDF;co`HrnW|DnEZq{<@E_ z*Pv$i2f^+Gi8~fO2i5QO4@u6cm{z!hR#7-U}w8vYnKq7Pd|2J4CW5VMwh{x3%oy& zKl?bJH=^bb``m7?r+6lVb}Z)}g77Mv=sffpwC`x%+d(yFhK5j|T@B`$ha`7GHrmbcucOQ+PxF0d)cCn| zkYpYp?sfEM^mFtZv@iSF)WAC{gtivOrTS;1lLP+ zf`yDHbPPHHT@L4OXw-)9jE&*>3il(WZoMiyKO0Sk-{g79yo-K_s)d@T!xR3zpNMPl zeDZ8 z%|^rEwR6+I$$t-eA1Vg*SGR;J^Cxkey+~i6?a*S>`+P$1i`KsQyUmoZD9uK5oZbB> zGaM~NjsL{JAH7s3+8ixLw?lVEwLjh%cxQ#sY*+hAMrWh9JU?ZIqQg<+A07DT6SoAF zd_?%Au8aQach8?2n~nZ}-_BFtQs&sjd=C~Cll*ggLYXOgnf^vkMth=tQQxo2+_=$i zdq|3}$VR)qQ?(9`rOb_J8EXByDRm&3`-xkCN?s&vF}CVA{52jW`ucM809U*Y@wsAMz3wl(nDd!nURW~1?rcPsKAiuOg#AA1MhQsS;g z??ubdS!hSN?X$kFT+3$TR{doYv(f$V7YiWsDf2A42sOJ83;fH8TZ>BSyvn$QFa5jz zSFkqenPKi7NO2?VX7`5Y;pPzHrXplzy6&jn-1$=E;$ypMjo( znq5~0yPhNNHB?eTSkpfEd^m@dT$7EO@&cmqE+_wvOZdJ6YP=5w-l4>eLCer-=1X z%SOk*Z}Z|Q%H+S!nF2Nbt>Pz7Q6_IGzlVh$h3sTJLDxlpKd+-(x&Mbh7nkDPNtxeO?u{zH-yirJ5!W1* zY@x6Q?%Tp1SPJibj(02a>prF{p%}DYJQ{fW5jRkL$Y8=@x~_qHF5H^alCs;f(Myhh zG-dRj)-8lKUfv7*FBA8UIFT<2{d4c6NB{g&+-=~_-JXrUhS$c+cPjTLoTwON_aA|` zC2>WlWCy}sb$!`i*P=!6n%x!f*Lm-+{CiW@`1L(GB=cY4FPoW-iX8uu@D4x+IsSsc zKbg3jQOPXAxw_tf{bhG#qy6E}#ii&&%DjTUj+)=M4E&AX;yD#6DI#oJR;%*;IP?1< z_(p$grTETlRN{EIC;uMk-l*|*3A|H?yA74hCHy2 zPlP$7d=>CN2!BG6Jlj5qa=lRV%VmyVWhCo+zWqvAZ=-v%(JRjG!{Iv)Jpnbl$2;C3 z#7l+|UaIR2*j)<$a`*_hzH!@Fx^J7sA=+Qf>%p ze&0=oV1E)M|LV7AYkDs5toeOzHrmqr`oKR(IU!EV`P5eBx{-JzF0H1Wg z){-3KDA;Ugv{HC`JKm=#vkd(VHGf?mj7Q70cb9jb=E1 zkE6^|^ljAm7YF{G-(}vSk^=~j)OFEc$GM)t=vkel;(=`RytCi@auQ|D->s5k%isEC zM#}b*dD-YQXZMBhjYmI2&F*%A_m20tM@94AuM_=1_$xXOzC~!eHhgXtxOJ|#`CtA> zHfqF!3mfNWQ+71^;RjWAcMbfRkNJHT^wdx4M8}|GF6VPyv^U(#`Fu@dypsD(&aIC3 zyw7-cjlPST-NmuzqD=AUoYBy;(Bsfk(X}P`dvfwTW8lOTH|286veD)rR*moRl(`PQ z0X2U=80`M&sQl<&;wA52QLEbAl+6+whvo2gb-WKz?nU$!)a>SKjgrh7;%a}v@7JLP zXmeC!yoAkHoa2Js#;rmX@8B2sa{|atl-UpMi5fqz6-zSb6L%Rp1D%9UL-icf_@@Sb zJ=Zuh+=rCDmyIrU_Loy;=P!AO7&ZRJF@2P|WI5lzL-+oQa{$^2odxH!fp>Kc_7^Yb zxgh*DUecfcX+KKLhyOqL{I49|H=Ny9V#~GY&8YRKc=dU(%%4sCeQ5mMt)i;A+54(w ztW^5^D?SHtyyx=a!P1R*Z;h}f-cjMhh07H>UiGKMcysV>@=?|JdmLMyLl>hp@xDp? zN9en#=PgOuTMX|`@Y;U=1^HK@>rm@I?}v?7F#gc9c~7hbq30ePxGUeOrb!j>_j3H( zQl=BSCt4GKU*ZR%$D=2qp1-sP{*o2h=nUtV^C|OB^m0^w$uT~5Cqyzg688YQ0DTPg z+>_FN`8pe24{t6m8bvRVU!RA(Lnyn&+dE0iZ2vX$36&g0coOQLZzMhW=b!rSwtmY? zQt?eTx)*+?ZY&p2<`(oW)cD6INtxx}@SN~lzK4x&g?2*qolN^1vSq>cg`9)zJ(rSS zvQgWLT2bG?-)I%T$AI=m%`ZD86DRW=aqptFR>MnJ{4ds6RCbqy@J+b&{l?PYdHxTt z&BtbxX^FN*jkh$|9jcB_B<(oV@AGAWxAHmtAK7RzytzLj7 zBhWL@3(%GO@=P&sE)Jo7JI(f;()_}x;Nzu*RZW zqQAk}Xj0;nRw4Y(ojc1K7Dijc-y_(+H)T#i2cpK$Yd(@pr!|}*&`Id&=y_-dIJ*bl zJ|T?m;;fHK%Cm)0ANcKjbvtG5Lmx!V@0SPumx=ofU5P$(B#}i`>(wcN+t!t`!ouim zcn8L{@Eb0a+4M)=i$u-tiGlZ!pRgCb3%v}Tj1GZsLg2hHge|do*I;)^%fjdh$Nwc| zTK&xDT&VHaPnwvyj<`8!1^O)d7TW4+zH5tWEEb1Q{JWc9wkV8NIlpAq@)-!)2{nEm z$4D|GiJOQ%f=)qaqW&B=De#+bRH!`1xcQ`NyuU)3jgGG!eMM;e2Pq@`e-hW=7sc}Z zYQmPfE~@gq+91(6&Yp7?w=Rs@z_0apTz%FR$`qsBQRBDo3wK#ZJbE)a06hoQcW=wF zyUSKQf*{my+&}NeeergM(c$o$Z1*d^K|7<0)jAeFFU~uJIGdwolsk)ZHs1P?HW(d( znq40zq?vb#`vH~wNtpR9@oUp-l735CUA31fU&)SzQK{o^NtrHaSJe2!=c{$!BW@MC z>F-G$^$F+Q#H@h*i?-%o2rIaPv`koQt_0&2XwgzKo5`yiHAIa+eC;4JnYg>rH_?aC z1*pbDyK58PE+O>et@z-==tajrlreGts{H5+%Gx|XEooYOE=ex=o$D!lI0APg)cmc` zxJ%&u1YX^Iw$ui}Wp=rs6k-zlO@XLL{0 z_-*~}Puy_yYIF=b9`*0UEe`cm-aEjbJF+ku?(DyTGB2WEpvKQ@tCCDf-MZ14=nQlu zdIPF+xV;3PMNXU{Aekm_3N&I|7+rYMjLUs%}4cj?CXW^Nv;gs zc5h$Sw=lZT@wOoU4rphURl9I=&%k>SaYv&i=xyah7FCUx-_pFt6h==v-ZLmuie8DD zKSl=LJBgczEQjE51H+k}tRY$+hPmp5~@c%HTf_ zew+8!k6Ad(?tA_V{a6m~_0I05@NJ2J4>f<-ef-75jYTCNH{zVbwdc0+=lih?{w2=tYbbLQdN*qRcqG{U5^-;%E6@tm z`+9cD?$Q$qqi-DV&*X2+57#$AjW>KfCDZ)S{HR^{QTrVg7FEr2vsrU7{yy}Hg;BjP zs`~F+=2sWW?BRHMEGZ$SN`BkGJS>KHdw6X;8}HtZm)jr7UwCKnLo_;vn5_zJ?I?lw z5O}Ts^zQOrTX1jVc-iLu!mH=IHSt>CmBKry273>1ykFM9yFNddy=CxT4zEe+>HG~C zID4TIte?M%PiUIL^i2pCkYI=tZcF({IAL`Agz{K$|qI8`VY|qKg?n z6K3-Fgg7593uEaJ_G`NzDm%F_S_pqG@VBSTCL8m$c|sdc`ukl-<`ClgqLLE{^{gza zLz`S5*}YcDDTUDrc&&d1kbf9D0yVq)1>Wn3n~h2yB7739=`&A#eqg`%Qa+$CYD!1s z;!=DMhcd6DZ=q&)_-b}$C2>Eal0OJ#_i}vEt_HhHPc4l0fYg3$Q)PSP?z5?AY) z{HO@s2;Btr>rQlivY+n5=c;zUADvYgz3%uYz&#y(5;guS0>6UdjabXj1JFZsy>-5ay^YHX_%Cqwuc6GI@Ym;WsT+SI5r=V;BYtPJ2yKsg z{?Z!!Q*u#ZbPN2pkA2BLBK;Ayag%g!^?gj~p4)t5`$8$a4?Er-*n9+f6q@EehPYEu z$r*%y#~TeTjFvjyH!iNtcQ0#4pR-4%d1J!xkJA5+HwW*R@Y*?V2zHD{uSGp?bNqZa zaSx$Sq4&O4{d2fU!N+!QR0eN;_#(bcSwflj(a%tgpdBF({>}TIxcXVv@wUnNK>16D z6-JF+`9jinKrcnr|0;ikGSXc;7ILmZhoh1U3Fl(Ze6%;5`BV9F~vwLmeznZvP(Z|pS(Bbe+2;4IQ_aIw)rWHoJ!fWS+#pHh%{SY-? z`@YLs#WhRD$;O27?<)j88zXjB$W1TgvxKUC+>HEP(0x$j-6HHKClhxLT8a)uKZ8^6 zo{4jH;6I5oUje^yo4c_vIvQRZ*PXe)yn-^bP~+V`@Fwoy+(_E%sK0;6;#={Xk1OCk z&GG(7{#woHJJfi?{LM69SUajuyrc=?;H|6nCUHt^eJuNTVKf5X^@;NOv~u!a^&jN_ zBdS-gUbf!vf3&EVtJkjH??&cpl&_?#AIgu{BA&2SiqK5x-_Yb2iFY;$f&kST!ybzbNq9_*<63)-S5RBl+e377thTm)fZ~ zD{uM5(~fv)h0Cw@DX-->KUlry2jflG=Xrb2Pv#4BQQ99W@9QzU%7`x^e_yoN*)^E> zNyLpq*FI9kJD2!k;$%lh>Py>iyz*mB?OpT-c95wa+7VvOMag{fcOmSEuC9SsdA$90 ztx)TPtr4@}iG4)8`lURD&9CWlve!7pm(C~u8L!%H^~rxe-r8aO>+_H2^W#VTmcw>w z8TQ+FsHq*Q*Xl99i`UwbqrBOv@`|_dv?SPV*z7TE^=>GiuUGb1d5f1H+Yz5b+tJ?^ zZ}q9nR2Q%MlwUgTsjB?)i}$nfEF!)Od8PGIJROP4p%rd@RR8oKPMYNpgd5LP;s+8Z zEp|NCA93Aoepr0k|FYleRsR`(J=GV~_BCMTdZTo$`^K9C%U{-i;#GN{&*RmpbgOrL z@leHc*!V2JA3xqs*`>Ue-*{z%&!_&DuPlCj`6BWyBHw&;3GG%tcH~-RHNVUr>)&?7 z_jd7~SL58qYk8>O>@<4}8?V}vZ;M zJk(@|^^5wfFZJ0tP1~(`Zl}@FJ1rKknZdE?GmrY<}caZgSxxO z2IntJ_o1#m2F7@O@s^$rbU22^~__t_Mytyy65BVT0FWo6*jy4eX4O-y4K{p5UIdp z&t>^*s!wT>|C{`_cPPKr$7?aMq;Zs=pRWfx_8dp)QWMK>&rgKY_NhIAp2mr-MZV|L z9%1!|^|V@jarrJ(m^!Zz-c-r(Qx9M0zFhSIHnRo=JD$E&YxeAxUL zh#k35M(5CRDXez;bmN;u{9wurM0>dV4Dt0KPGzQYj-8vrR&PDxZG7uKwFP()Wy;aD z@X4P(-O5e+?ax2wlV>g(ac=F+{eypQHk5hc)6HJ-IXizwfp7cOgFK^2;9Ojn&zsapmK!-Lr_#l3%L(s`3=J z`enmv$EWa+ZRXQywU`oUxK&m!W*r8JFCi&s50#g`FZLf*b;Z}MCHveWa6 z*JI-or|u7}9{IN;andNoXFk(-RKNT2vO2|YexFZ#4l1eqsd~K~mQQ>>Uz*R_rS|%K zX?xSHStDVxdHIz&H-|8Qn z;u#mP^^5B9yjE^5@ycWQ=BIenZ|z8zY8|k0<*9s2QaIfY=1=kY_AUeG;Ff9}SU&Ol z_~of`mQQ?tm(T2-mCCmvJFHx3s@_Q{9<{RtwoA2dSULICw^Qx$SpM>MTRGWjd@bhG#VJ}$Puse*tir{ zeV%823NLc`wLUHfn>`x$>l?4?57lY)%KyHccznHTzp3^on=kdqw}`a)sP4bS(~)ay zr}MarS4dE&;NRSikr71;$-EO`(~wDcy2IarC-Q>Wa%Dz@AK3t2luF+a{y3F? zT?(H^Lwx-UQuyN(ZcFF;{GC#`TM8eS!lxVNS+6~(xr~m}7~xND$0E$@q%oGS&Chmi zURS>Mr2BGLI^2M^-URNBN`&=2X~PGC=YkJVA|kvOl^LD_-ckvn|CD~IOaC2w3dx6t z^j7%lbMQq07lY3RpY6(PzKLIBMbSLNjZ=l8Bchm5kjQAtZ^vaanplIu2Z9Si`V-*0 z$<5bFV-YS7SYsL(jidry$77S4M6P+#8kIklR-brXo5=3LM0mSz0LyNP+BqMrcB;JW z?p|CRUlWBSb*i2=xm?VxJl%?`=FUhk6iMTgLXrA&JO)~SKEYTylswyp^cCRV;DZCM z(;$jUz^ze9EAUB#yTyq88La*f-xZIJ1UIAXKB2t)^(fcoKk+{X_WZAbTL(VzSAdOw z2w46O@A5`hgSQ8-4f*c{pM!(KcaEc%!Gpo8TzX%e;L|67E&W^aPXyb!Uie(f8$tYW|K2|r zlmAHku@!kFQ^4)Owii4IJ_`JNk{rDO?hAg};iDa1NqR&4p+1x};Dedg;MWrvDgA>~ z`iCxE{0EWO^BXhvok*z~=wUsDEeh!>C05(tct7lK)$Q%|DNl|0Qs9RI(JD zPg_c2l=yEV*EYTyZ$#gK?+WQ2Yu?EXwfINZxCs#d8!6wBKr1&HtaT@RCn35IJQOT$ zNiXJ|IQXg4cutB%YIUd*&0o#uty#CV+X~}Oq+Qe@+Lm>yeT?+a;Ve*m4Ls@^Vupeb z!_L`YnjD`WcB++2{}<&#dU6gIZ~Lfyu6@V$UE1ZgC3~EKJmOdTJipc=@k{t~Nl^|1 zXAmdZm<9B77QlozNnevn--N!ibpDJ&bTD&k9_7ssz*w#)ZC9>3JG^HK9~Ce|udR1*f6hQZPJBfvufwnY?DzHQ@1gqo)IQZ`eJS5b_G3V39oBhIG62k6 ziLOC4cPPgD9Z7ECc#an63)6|HEhSu9TOOsn@JLi5Uur!2wu}W^TV(rvU~l{FVA(EP zrQy4*@%UwkRvW()!G8SC0NdQDL&LO(cNPh<4Y(V)3)j{b#!;Lm9B0eeTOr)9VB3bq z(J_=WKdY^>$G7z!u(eg=d;-||P4nP0mwplUZH|2}5hsyvv|o7Nlz^>1joT?;8@K9< z>%r;^^;6t;yyarov@mY$g`~AZpG76}saNCu6;wV*`kV_yKG=-#$rvSbUD(g1{lR9F ze9#AMK2V#F09%{Yrnr7=lxXaaBzz`D+@pfEHd>oh{x#C9y!c-S8^8E8I?YG_6ZY0k z*}F7l?;9z5HG5>Qe67A|*pPpa{|Vc3Dcdy$ysuvcdtYxEY`6K62`|GK=1{99#iG8_ z{IT*HpQnRutx$Uhfo*Il|5+~o(iWUCsqY}-Buc*#EIw6|_^x5)SdRw+@#5`7XuR5= zg#DQ95B6hrDA?@On7asUe$bd)MV&S#HRg)JHs;hW-78tUG^T}ZOpEW|VB=FeZUS3< z;`gG`2cU1;fnaN!`tDG$^_}|4 zj}5iuTGD-6{8*8#TEEOz`SwDv`Bt_!3ARHMuXh)KZEVRGL%{Nd+9hq?+;(dK_IDug z?Gv{4sXpBgSba71rOsm3UiIY|ul zv#h-KJpR;PwLOoYC#v+H{M8a{_Gm8h=W46@OZV1(>;!3C&;sAbm9WEhQov9}5Z1KRWw92R3`td%V_yXGu4IsXsHc z-}k4m^{4tz*pFA8|IHqa*P-BNC?e7Lc?j(NA#DCod-~HhU;Y@dl|O~{T>;iQEK&Yn zQ~BjY%dhrs47T>FeNDjDKKZ{XSmT=@@xM9((Oel$Xmdq4s7dIq*fNEcsw*KY9*0vn&k zfv}B()~#4?!TW~t^1~xw^Ml68yI^162VkpDek`WZ-j9R8R$jjP3haILv&*mYCo_z# zyz&nL`~0I^y6l??Hh#5lBl^YKCw~che{Br*_ICuE{i^SFu&?iBu(wA)-|W-*Nz^!9 zw{0{<^HM`Se!fBy2hlCV$ta4h!@uK*3crUGkINUpzP~>Qd;5jG{Xc`f{W^zv`}G-) zw{L5(?8i-JUwkbb6~q?C_vZtF{mCnd@6QP}79|=-Zxebue*}9wg-4$VE@_`B2R^Adq)v05 z0b+;0*V1n=bV-sUtz(P1_UoADqxnVq(2Zcf4?PaH@gu+d0rq~`)Xg7_=if>94_Z4up{sVjanlO>fKIOj+Z27ew zeE~N6w2ugDACc%;md>d5EKBRLxNJR^KYD_#KJ}OGy?uW@0`~o-w)_5yeUVJ__>BB0 z>At@ffPH^y{QLfD3ikb_^SZT9_URtM?2|ta0-Jv|UbW9#e{9Yn_Fiy*>Xh^Z&jm`hdzJu{^$+%{?O-%-XB+hy+5>H z_oq&Y{P7%E{?LBHQ0Hk!^7*$gLkFp+$7Hc+Jai?$Z~q{$Z~qBkKOThr{5>7)+dmBK z+y4mIxBp47Z~wbs-~R8xzWv{Ut^Jyh1sMNKuwUav>z}1-zt(3;BSX68%ST|FFB)&p zgN&-=mNpTgds@}>9Zb71e!|JU>DQvB=3)1Bb{ zvI)_6x*yypf&ZoX_22D}|JU$F>y_3Y{*U)}`7+stIZPu;%Mse%FJE2<_G^#Mnttth9PHN~ zVZZjg4D@TyJ7B-|48|AUmwIO7eK`s2eR&($+A3e(3a<1OZI$orY@@wi*w&)|iT3Gv znr~kz*tc&w*tbt-5#PQ!VBbESU48q6)js>Yj=7P^5GPy@sLa;>rc?W#HKR*Qf z{(J@O`%~EWr+$yw_ov3P@6R68<=fjE?Av=L*tb_dee2uH&lFZ`Z$}2HwO4aR*w2-o z;7b26SMxa%;5~XW>vGgX}GXJS-V5o09Fn@}oa(_4s{4{t} zQat9Hgws6V)nMZrO8%wb@gcwb_a4~%C;OW)sl5Gq*4HNFSNhGV^s-cXWAgg);#PU8 ziM5~szxNuh!{~_HJ(f7Lb2fGk0Dm0(qJG&D?E6J?-TFoCIvDKR)d%d`bp_blrM%Xz zTJ4j0dQPZMSnG^1%}d53V~EQb$Ky7?u99Mrefx3c?K=W&_8kD9#@Mv57#t6t240Iw zG_G{d>Bm(Yu#GF(a~|02(>T#H0rQvmJLgsB-xKWl_3YjAKTEpti|;G2@u{EBCBOIA zdEhpQxsm#3JlOi@0_xYEb6sfP1n`UCy8;%Uo>_ao6=3nzN2!{%fmzD`szPzGkE8rL z`HdPkXrM?$epU|e=YC-Gv;24g1+AT`SLYdD?{KiSL*r%*czi-1X+CJa`f;PrM11*U z!B$@Um!{JH>C)xb`C#*_=KFrM+t1Ja!IrN1u8-0Ed_Nzo^O8jKUC;7IB`}`v=P(LA z-(axuX?@xUe^@`u-u2B-`CId{ph5B`jBql*!(s`RzqE&Vf0cpFUuy3-u+^WQ$6CL1 zM)2+7_PVk?vab!;`+F;};v}QCOU@S@gW|me*G2pZoLJP>CR|xtm3J&yc_pub4SAF#K5U$EJ(^1V~#4@;FlAys~; zD=+?;sq{NSdLCiiSF}ey5oS8+-{|%Z$+_qpB_NN3&mp{6osGNeB1QosQQGx$B|7)Dyha$K%WV6-*qT9?~~@=BM@K3#pUbeR*IR5!yFpOcVx zDWT8%9@umJ7}8~D+{XByq-|LR<6{rfg`D*fl+n*utdF<5g$vU$MDBiRnjw5*)NJ;9fQ zcTpm8Jorh%f5eD;ZSa0vALX#dvEiwt9{`@6xG)ml-(j80dw_RBCF0Xw>C5*4Tlu-9 z9}hkpl?V?eH2fI&MDUDIpRneU;icdbu=aC_%AZH*%byRn{HsXUSULoiq_ON>LcF(E zYlhidQ~FAmuJ*46Tl>W?KC4fA&RQzc`iuGM8WN6Th`j<@N5EuTRfk&3@T;d8)kf`||BmojK(sb!uG!k4wL|-ttsPqXg|+sp zRxKGig6TS@47{IE@4m#{i%K#y@ESs`#}eVbih(y;PB0k-_Q zAC(X7epI+y3ZEWurQPgzcFntoq;fWcMEmojaxS9h4sA)Y=MKVqr?Af9mi`sx8&NJC zW8?E7E{?|z=7zl_K9a`!ui|iGbJ-zj+$njl{w_HdX$$_Iuzid;6T`24!1HtLi21eS zs1@;Em26k>xi}dkbMo%xQ@~ZxpV6PS=8!9q2MN?qYLnzbRD910AR7Cl2yN`2hCQpn z-9!En-~+fmJ7A^jS({JS^CX|H=cATBnf!~%eE^2U|3@=Yrdyl4a!AzSV?ub+77Ds6L3VgU^KH?yr;KDv^?%lRfTJ zhvg%~=aK#ac%P7dKX^~-(Yy2#VZDznTv=a86OQ}8UgLr|GykZ*3PR%-)*5bD_3Z_= z`U=>5^%>}hz$tu+!-K$TdoNUSEm(bec#OF30_)t?GhpS{n6vzUfOBA-H6+6O5qi8s z3Llrk>2$iIT6xc>v$xjA94Zmk^T?b4@?Gb|-fRNnvC)`o8yg$%$}>dTe_2T13H&&? z87kQq{4cK0Nnmt5_=wtkw>bDu^$i2(Li#Y$h0k>P^~}iUFHhwcw)`54vab!QzLpti z{KB)Y0dX*gddO;jt29~+9thqlPEE!|Kk%ohJN<1{~_Y>Pr3+%^r(jKs4K(Z=%%Sl_pmuOwfB?;<=c6iDNBq@Pc{ z{o~y94GW3R1ipL)d{(|K>3U~wcF4aQ_;`%1O&Q6-;Avnzqmih-atycf!W9l{Z7U+* zlsI>?wh>i1ezlhE5B6)>!QeI_ztWFPr61+e)xPmywNE}Zzg1p`JBWv|yBX>F&ZuM& z_+;92WddVA_vPCBEWZy<;Y%ETm-6?6wVq4925W4*fbS$qKaey_uc`i%T>Y(BVERyQ z3~>_Svj`3Ax%SOq|6F?#*q&>vevMCGzutXP{dLJFGs8!%m6*FLyS<8PvafB*KJ|;Y zXAs!iGXU)ESq3(H4x>GH!nZ(%Ao9-*!9L-d>K~k{zl3~Nzx;EV!}8CgU~iA+g|}y0 z=bwp`pA23c?9u-JHMj+3B(hJ>r&9ilbIYG`H#4?$Evd==(}=h6rRVe7gI-c*WI(Xj z_H@zt1mAr%`o#N3SZ@k`&;AR`a|p7bzt+E&T!X*>84oZg8{V3 ze4zEEoD^GcredewZJS*`$**;9IygW0LHp{BT(?P*B29lB4iPGOG18@G?tC`a;evK35SG!eh7;$kZ803xE3jc6W%f$it~E@eeHr&v?$f%bmL(RV@Q7!oDKQU2J2mutCSfT1O5kfk4|8G4^shFdD(9E zE0k~f!}t0(wp(kFw_Ees&KIh8JFwNOdh`s&>QSFIA>H~^V?x-*#Czl)0L}|`{|46i z;Sp4l+dFCV2MLVZJ%MX$cQNT#g6FyP1}=RB>B9OfQ!*JWd*us>>eqT@^~UirOE><%d0+#&)*Jg^(`g67ueP@;X?zKiPkS%#$$XFLK~B^bt2e&q4}Y7 z8>6aQzVdb72)4Sl$Ljf83*scgdj96|p$>0d9A}GmX_$n=z}s{ASps8U7IAI->N|#c ze1EDeviD#@vsZn05ZL-o{KtchU%u!MHs4Gqy%hXLKK~$^BUoe7*b==oA4Q$-v(%83o+rArA;FiG_VU~(&_)3R&BYie_n~=XJ_$jd7Tal>z4}_ji zws^dq!{WOQYQh#jy2~3k?83o=d zFFA`SLiT9w_x9w#-X1+)_x9+X+}opPn%V6#WQ`xd+)F(>|9G#`7u4)|u$ zuLd)uVtE?86AnEfVD;T3u=Snn{}}A;e-G^KUk>)hq--yH1i-vT@;)Tc9N2e8>M ze`@c*j96sP4O~^)!`NvIwz1Q5-{d#TF3%+SPXIUJaw43Pi@{nOj8Fb41}{J*X*`+y z-HE@mRh%46FQz}awDt8-(sgD&BT0_WEJRiA{W>$93AQtn?mL=;efzbSSo@W(wb`c+ z59##?B?=qGS5duu{uD;GUK5_m)Q^+(8Nn~Lt3D&hV7%5fett0)eP%F#>x%={X9k_Q z)@KG1mH(8***;@X`Cq`k{NZ)0m){a>pEt*}I^ZJm&AGLz`=&A2&PDQ##=7}N>q7m! zs&(N^>ef27f;&3kf$1j(rPU zi@Fwuu_HdM`&OUMqj_MnU+ZW$uwO^_0k?_SleOVEu#IKeqxXDluE?Itz-Eu0lidOy z7|M(PDX`}+2aBIBiTBY0_guWL%I&##YXuVdr#+$hNBb%+uiRI&IQMMu9jHWS1Nlee zPol9ngwT)03&5k4h;*j>tAu}IljJP$LxisdJRSTiSoeq$&F#5dn?D{S{Zz2lH_0-v z{PA$W+DG)+q3r`L_D{|nPlWW7a6}R1?DL(jr0)ps9@6FSgTUV3M}f`XXOX`jxQ*k} z+HZVHAL`Q8AD4lBe_XC~RHFB`rW5-2!e)ZkDiN6spYE-eQlI9Dstw&2_tn;5>#K$2 zeFCiap(OH^`rdr?Dd|sx%{TJh19{bbHxF#-^8HG%`Cfhd2H5xQyWmktb@Asr@{{*n zTd?^~zSr0?UuoUc*jj)}wm2a9ZK!A9lqmh5gqAMfUJEwg3(s&^zJ3nueZ5fWs6@Vg zpV0gIGqCwu@2qL;`FGYf!(X1S71;P>?-ArTduuvV`Sz5jgMuoj z@^!eVW7qEYOGA;kif!W5MH#Q~1*qJ`me{ z{s&UHC5HR-(J8zlg^#FPJ^!OAyj7-p`uG(7A%%~vS3UnTDcqiZ@%Bwl;dLo|GEVmS zUrgbh8&*%Bmcq3gRZl-Xg*7 zT@WKa6K$8^uLBkzU0scjuCB(1>6Lu4Px+^y5}oao-`lqf*xT0`Ec=)u@p?#*Nc?Cz zr|V+$53MzST**ICX|O)=M-ef;KB}x%-$1ahZxGo0A$v2h`SO>i%Fj)euSk{OF;%`J z*thpYu&=)aZ1wBhJtVK{U6u#wpCTH%fIJfQ*ZpAYujj#f{-bx@SaRaEx&d#JYYi4= z+9LV!bzK%@`Bb8M4n?08K=KYuKEu%a0TMlPmTTu@i$rJqiwNzEzZv;gfVT;D=~?Y2 zT>EFW!gl|u&kOXv&PyUgRR2h@)&CFpt^;ot>N^4aIM}|xuKcgN{11Y^1dCIW#>!vY z`SG9dT?l?5N4`44bGuuyVQ=#^s)z{_dJv@CxFyH zIC(C}P>4lySm_G_9z}kg;WV!$O23BC(obrWoT+tYtsCb^Ld{d8gdcw^&g-3DETDU* zj)Zm|()sChu$`ZT+rne`C~VU^D_5y7BK$!LZ-j#^UC&YW2S1)U&^YVR9 za4w_|r@Vg0L(d^4I$tgW+xbuTk_XbscO=R2y<`vYB?0TadIZ?p+Xp-~G zTLeB293QsG^B!2=ReB(Focd=8*!oBI{s_(mKG`d5_Nx6SP}bTn|CEBwKR=NEI9T`R z66Jp(As6z&$V zjR%FYA88P;fK=EfURFXZ2^z~ftJql9TssTw=h_f(4wYzZUrA_VTWiHU>h){I9I#(2 zo&o!{q5|yKil4x9V)o=2_Rru^0c$Sk8JEq4Pig01@OV_B{=Js#T#SB8E(J$}kzojv?BW1W@WC%t(nud~;$V1IV_4csQA|ABqm(z!!ugQOW7e0%U4 z35@5@cHjj8>uh%l`0Id2?L&LO*Sh?trt%MS`MbjZ7PwXzCz@{$aBcJL7}9kgH8sq? z`t9G}-tN?$WRd>%H+C8dZO9{C2SS*G#baYY_H* z3w|gsF+hB;fQ?`MF@2+|@udE^5$yZp2e9W~12+Ci@Ru}BJ{M38S|7%OUkdFNzTRPt zxA|ZjZ<-%RkyrBrHz#v8FF*FS=0XSJY%ZwmabPQ}be)NO`o{1mz4)5E_#Q&T#O9tz z=_+-mP2u>vO1BWTR`G~9?;zeHEck*W9yoJ!h4#^z2xo`O}r_T#Ohe zOpIH=Q$o7>qm*mwkB3MX9uv~v04uMarAzcY|9Ymv0e=hrF-eX;x70m`d@IrCmOF8c z`(lwjdhgoo(PuyXNb&pb&fsoI_IRDp^@8J|mw>v=_=g?S&GJoBauG+z8*` z@G+F13D)<2BwB|bP#CcMJr8XD9!37=z_>jY*{8a_eIJ0$KJlq9J>O4Y<5PLJ3<+V?3 zLVnw)gjeVBIH8Y;dkz?NV4H#?Jm4l2?8*e-;lVwB9qu3Xz(RQ^)1&p#4u`Q@vP!M-ol zUh4~$KPy%KY*$`$|01xjZ+t5Ml`g-0e>K?m-8EqAJB{rO*v7W@DA_Y6^!0vylD^Zs z2NLaBClT77rO)Or0Cx}R;?ubId_-09DL>0)Wq$FW0XF`zVA+2oDp7x2N@)EthxA*) z*DDcG`gMesE_|oM;(G+_`5txYnhX42>3`kFl!5(yjQq6#m8^rWj8NlQqIVZN5ZY(S zosLYtBXMq=$~@!-LFXFtr_u+5efkwH{RqApP&h5T$25macc_$8aVT!Z48)vl94)-K`O9M)&T72wxIfT$jwg?v4Gf)^yo zaX)z!u5nGzncOTH#cR$$bD>y27=j;}3 zIEcHN%j=LGCp*fK+nP4}duzSx=hyMQz@tKb?HdP!ZQsyyrcG)m z&nT2d^`8dz_4fz+`bUF({SShD{foiA{+GeNe%)(Z{i<(ACW^05_tL(;?qFZvgkIbv9Rv3Dod&l0bT4!`e$C0bi0-up z5Na)yX#7kfwDF;ROxV_4?OPg)wr}Z-JQHkZW{tOoaQX43`%U9h{pW*ol#%FO@G`L7 z3u@o_7Hs2B^RzMf%pd8`joKWYyqkADxE$~u&AW?qh_4(_7Ex*>q zmgKW_QT}fW_WthxHvg;rI`?^h7K59k68WF4xzhjQmp_bu4F0(jd~xuP{IwG7{iSu; z`=@CNZ|Sh?)qdyg?G843Wsly&u<;;&tnYI(hIzctF*j=GaV<f%69JC~9~|nJ zy$^Hk>zfO<`jpn_;a82z<5l?P7V6D~y4BZ9$?yBR zkTmP70&eDB0qeXb=?K>SwSA9XWBD5#Vq;nOO$;1=#GDecJoIeLs_K_Q@amt&j!8Nzz#M>U$uvmmu!nR?3J>fcp^2-if^u zea~wf@CyO!d?a7l`AFaU61MMs&7=JG;D0ns%5PoFTmswoIEI0tsP;V(EkSwYk>ps^ zIud>mqvTy!hE8RD#iZljYTpw%4s87TeujLh&(I|+vFBz&JqMS_zWWKieUE^x{Pg1F z@3Yx^&-rxHGSc61?f(sI?cb90U%@}hk%&H5|DDi2SKpcR-AH>ePNk1nl=K<6&Xbaw zz6+*x%gW2&PlByJorlNZD}Nro1Z-nP>H5swr)%A@boFN!__UEUlQ5A4WYN4Wwg>3*)D9hZ(W=`M>XG#g`e(;{)mlA#+v4e zjTOD~cRP4Qs84(|!N#ZWj7$UDI~*E|8qSBjzE&T@S8wlP*jzDIEZvbE0D#1^I zp9fD5SnH(PYwM8m9|*Sm--0g!-x~67)-QQ(dlnp$E?})mPX(-d>S5s50#<&t&+;q% zQlCBokk8lFi0{lOmweqo)73@iU;F2C@W4u42~To$d$;~zxN zCQc)?XA!bb{xJK6mEUla*y+CwGkAB_j=pUbJg57^FZ^1sHP_y6`_vsd=-=CJ&&Gr9LSS*qEmwZZJwne{~Q z6jY*nfD*#y0*Ls1f9rb!cMv}?PW@~8t=O-1>C@o9d?wd#V1LH`9o#0ASN+Yn_Vuf7 zt6$}1zc0T(*vhMaST3sd4@0`Le>8qdz&3u;<3ac=(rtWf=pLr!2}%FTCW-9ZQ(Y&vaPphp^U<+SHpDtNvvS zl6ObKeUyM`?bF(5YoFG-&S1aR?FF{AZVly60^fs5TArBvZ8!ZMn4}Z97FFrJWXZu` z8L$z7vM9QdHUmU^isq5uQ#6lkoz}iE5j=*rSXp~+G#R_KKl|_L%E#IdRYx7PMT?{& zNCs2;OP{uvB5|7f37U)w%8oAg(~Z=e$G6~9uC z`A_-vy=cp?bI%iCJNNvfBw3rfr~$|*=E9bQO=Fb&PI@n{Hw*ZblH~KYK_S2H#}6k> z>xo34$uQk2KL-(3dT%8nHKm_QyiZqqJ-#@F$E5I8DLmETliDO>$L@Dk{{i^N^G|YE z?-FR;)prafx_@2-wzXJ%dbiQ|gqJ%k|23za`A_NBf_;9bcO{np7%r9m+Ypw0JTj=X zPyDAlzMAlmRQhm--!Ea#V88C8BzoSY@o&$Yl&<$heY*T*>9R+2%KRn!`M2iy(3lItk}>-o0Ywk}{j-|hykjY_n)_vLy{0^_sSG2l@F>-o0M z!g~J7(2dvDLn!W{@bX8Es%bxyK$+1m;1?NxcRSKo^| z0<6z%BGl60wDGtpwgRx zef~7w+@-7km@bw5r}AgJboFN=u#FF;H%X-nTe{|E4s3H(`P;huX)ONpU3sNnk;?C} z@(Wvi%CB>bwO5}>9|Z0m`bX*7Ykc}48%Xc&(r2EMtX2BFN%AOI?R_&w$$gFH&w_w8 zeh%l_j~`rIIes)=`hop;QTzRPQTzOO(Rdn#N;H?J654oC|Gfq7sYFEW-Hp)ND}NmY zHh&3g{uy3Pdv>R7*ApkvcEg;dqVphVng{qVeCOs**E(BX*aO{{%LRUT2!KaN^{rmQ)hs2VJxao zbH&@IbD!C#^6EQZUTc|^*S>HKIEPB6(*D~C*U2%6+V?J@wNLpQ;jo+%5!Jsb*w?S$ zXYuvx`J}I3{ciPd$X~L*E%o^F+Q)o()#dBgSoihslq%oVm2Y@z^1SIbY?5d!Jw)io zmgbUSjYVNU7Q4B0mG@ZZ4m~gO=MKH^^&CTnlUYT8mwnb zr=XILz!ik0sN{!$uS{T+IW1XtE(loVuX5$(?}x$OzJ*}3Z&S*D0q!2kYcFV!SG5_kLSmpPi z{Z?Mj9Q9k4_RR5D%4_^R5VIxcJdJl-TXhc9{5U40D?hjO)$(g?_xW*gW&SQayl4v^ zj7kmy>z>j2L+^I(0Je8KuO@vf@Q0{GYrX6L1ZT>cr-HNHOp+xXs<^iur0Ajux}1^>?V>jBGOKX7gS z8bP}H_mYq<|Fs5tf42embmg}LTY0trgjD)4m#+58Kfb*z5!Kp@i!0mv0QL+6+wZ0< z1K$g-2<_G0HV15bT}}K9p=$icgUz4v*KDx)OZANf`}$UbeSKeptv=0XoeOL}Ydpw* zemvB7{!sp=E`K4LTRZSFI3>ETF9P>YU?jdA*Pc&P*ZeQOR$!}Nd>z1^Z(FeO$v^eL z-v27^$6I%>`DYk>T7Q#o5ikz$kJexBpR2*%Ka;@bAC+fIs4V{uxHGtZ7{B_v8#KA{ zJBS5}|4hd$*$ zg|pnT8*RbgN1mm z2|Kq$eXReLaMa&x-Hz~_n%=eHdpI9o*|pQroX6V9^uCjl)AzuU-gUfvKd;`%07G!7A5(8*(20^I50soU71baKHNk z;u8z;{?e@G`9Q3l=HpM-dZAByyArG4_6z+lklwY=S2zr=jq|&w+Is|_f38TI_Su;8 z!OH5>-|Fk(P)$`;cnoatFUy@@-b&`alRC`gvs|YcaMa0rBkOz*hrxXg$8)rq_eS@_ z3l$RF=WxvAdn4cLx~WK;XH2e_2P%7SG!c$_BiB!#M;7bH|lo8a%3N(Z2oa)9CYXJOlOl@gz8& zA775#zl9pl>pwvGyTISA<(~i_4nJA>3-D9$^WB!#ykGElIO=2i*6>B?t&iUyj{5v) z8?FIx{_U(Q;K=X3`nhoItNVM-KZd_pN@I>f-zdudLuLK(BJ%7HC%y28{`Pm}Lcjj$ zfp4q%UqIgm@D>~f-*51D%-wc%i9Bv@>ZY5GnFLoHjz2@V|eP z)ZcEoqRC!<^XIQAz517=uZ4b}^}K|ChxlvpMgA)OOS~8Pw;IbmQ}ws~`+DTjzdPCf zHFAkX{mc1b4LHvay>PV0N727F?B6*wIA0t9FKn>P7iYnFzL*Q&ROPnEm2k9&^Tk); zm@l+{Y_i|+a}gZlM}OW4hd&*!55jr8{v3|+>NROC$`1RzhA|DduSs50_J;E{}D`o`ZT z%WZos^4zwsbg=hYAvgacHNVYg{aVAyzvcbvX<%-5nzrpX+gU#?YR}6y#kJQ*4`W8Z14SW zw)ZD+w)a^$+xr_h>~-xj7CZ9V1@Vxz3)4dT+O54S!(p$yU1IMWT_?{{3BmiE(}-hT z?YkB8;M=O)cPqRH$nRFTZisg)e#64=cKG_5-gj%h1;@KJ?!iw*b{L--d{<&$IP&{0 z#xZby7h^U&*d#A&N8g(X);>eF@9l85Z*4gATi&LL|8L&?=ptX4ZYbaIuA`d$@-I|& zjAMSg?H%KqH{Qeq$M_}2HNEdWTnf`9C79neR`eb7{}#^q$B;MYcMTNzos)KiW1MTB zeI@Msd}Y@)26lEtNBRFG{bTUSBl(B0B8%>K6Yp8s`t1N``*wuGKGUC= z(p%p0a4yfXqCC@UPu9;gJw!j3rM7;{KPk!0KNpVt`ukHgz3rIWawOOHUOv0aMkcua zvFup?6yL((Th{~D&9QHA&Av0S^)q~lvVV_ky#`y~f>%Q~$;!JA3^OLa;bVHL+;M4n zF;4wHJ#(C@2JoIu+O#)t~Wl*d8{{V+xc+VXI~zKqiwyXSqyuxuKAsJ-Ur9LV_SX@ z&V6YgxUVU$Tqll)vpI-KkOc{tbK-&e@>zY`v)`mO&1u=TgCh{`)Co|m>8 z+bWh1Y>glIEZ;kE$!X6|-aBmuJFX4ZYnD1|z3r3svA#xJ_W5swqaONg01m&|58g({ z&GlX#j`Y_19dOj!^7e;wc?ZBzp4U%*FDm=xdN}*#26&*_r(f=ZqhHw0Ps35Z_C5n^ zuT>mT^BH;VT9-IqyC%c=zS}j@Acx`HkFaJY_P)a4n4Cl$V^Th-gZD`6dtJ-I<1oZF zD{6WgPbk~G%7|Kh$29MptsoGr*DT^(uVZ2BWzese8(T?&?RW)o_;qvi^&mUCbe2Zn zig4DqGo1C^31@wG!J*IcoIkRBT{z_Khw7K@i#1$dafG~gW#6fDJk6`@e03lk^Of_D zzabOzk9}bH zS-;qb%lvW(oX6RLaI~M}%)d3fu%>q$T?*%M73{l&Z-s}vO9;nU);`a}KHJy% z+xDedn|p*R^w|yWZa=$`S4-@(oO8$*&vKNz_Z822?5lr)bKm`UtiHEmMCh}x*jBl( zXix4d8^XD-xDH&%VX&`!k~sGj$5rkt<{jWL*jK(p9DT*PiQ&=KU*=qRJcq%#;?Ks^ z(cs+l7vjD`&EA~nS5>)l!DKk*0)77hIL4N3c@~`8@=Q3l)du7f70IB$g{ne*tXZbz1QHpx99zR_)B~LhCJK53G!^O^K7>F z{jm1x0&Si+kq-#6p5j{4d^JkR2TO%|GE;+{mcD_tbab7 z^?w3;vj5eU^-q99zwNL8vObDz>(igR!qNWPI~LCRmV`rJ-;8DtMM2Vv+ssJ z?b{U2_SwEsU+w9fZ@pede*L#Qoc(uNhd!1YL-ct)oWo&oykAS4^$o&V-*4e;-_PN& z&vz~U1b>`1GH9>Y>a5@SDC=LIv{}Daa*b!XP+o>$g47tZ>;x6b-* zg0sGx;jGVltgP=fIP3d0ob@f;HB_J9t;+f~fU~}taMtIusy>}Zu)YVu*}hqD)^{?T z^?A>m^?ecUYt$8eUxTy0Ti~qkF*xg60B3!#!hK2KXf9e=-xxUS^S7rT3EI}2J4SY;9TCNaFl2IwP}w?FS}nE?D$%yuo6s@Sf->+}8LSf9JzJ^+sO zw(l}s0UyO-kUvix?7Jx|;;##fv{l|^I~YEY!{EDljyKn+2H)K~749#@Sf~7P_+!7y z{{3plgY8c#%TYR3(5KZim2MQ94SJe&f8%lnbY z`%7w`<+FhKI`V5O7kx=?{s%BJ=YI;0{I;QN8@m1^EA^scm2D>s=n1V{gVg7nG{t@)iVyk^II;e6@+Z-3I~ z-vbMM${$T~{h{3Y^^ixkjQ28O$_y>%%jO4{IkkQtBaZsXA5Uz1Sl6hp{E5W+`!YD& zGZ*gXFeu*&BeFcVhjOpMS-w=NkN%RwU(T<-QxNm3^P}@?o*$>dF+b|hz2Weu^XHjK zZuxh@x%~NXf3cpuY@D+M=j(MhAIKj}{2q82>gPVS!8MKJGuAZzjjWU48x<0+AU%)D z%QaW_`uH;OH3H#Y%w7=>79!sz5dvzL;lqc`4#^`et(kdFY{-AeGd+Qxu@Vg zMC>WZQxj|72jFa<^SkyFmH8QUB{+91!&%H750lsXwf>sGXO}C$9tPWDHRABSbM;nm z%-wG`S6gmBhrw&vWyJc=;I-`Q#M28kbNTC>=ehD9aDSECHph}T+D3cwT0|ZoZP=$h zr@&d?sc=7sLHn(H*uOF-@<*zDo5Ih+mSM0jJxm;ZN%>ddkXxSb3g`0NFYG6c!SXhN z$yS2p&4+V&_RG-c+UP1c<{HbFbNOeb^y>dE9QtQ)@&bHdE$;+)A$$Ud;d1y5&bMf= z^)yVAwAgaBXH=G zy>?~3E%C3>Hvx{Z;M`|_^)rLK9C7BADtm9owBzFh{!PzEhP8hIq`Wic{<3={2Jgw; zf0$FK*$~rI|Io@?UTs za_w>dE!*=b+_s1OBN*gE^23o|eZNYqy|2Jwul%RP+V8WtY`^!OeO8X3+-psi`z$`> zpT!>A=fRS?dH>(}X0WpFux!BjtCg+a;hg9C@kp;-KjrqPET_x1<=S%|ob5Ru4ttbe z-XXst$@R~waQN#9?4JQ&W*&|a9Cd};8o{E=w*FT6tf`ypvZ$N3j_7DBzdI3ar7d1} zvaRog!&ddL)1lwIgS9;M(_BM*aTuKSyQa_9x3&kWXcW8$c%?{^#s z_i`BY%h!psU+4zy^ybfOde;j%{hvD02W!$ujtKg6c_4i1^P$Dim7m{CLq4Zw@Oi{m zoaZ)v8qRI}3~U?gF8k{;%kU4u-!ttc&cAo6o8P{KTe{m-k_J;q#Dd>j`k! z`fbu*4NtD=9m}V}F_sr1zXe{k%KdK8t?*ME2J5O{tgE*6_+bs&YCW^98^K|V@A_(+ z{oQ7_h?N!}#lN)8$<6PwxTe(KqsynwKer>hh||dyNO%aolXy(E(Y+FeW&8Tm$*w;f z0~c}_* z@2GOGcW)q%>)$TOor72G;zNS+jp2~H*6xF2?XCUW!P)-Z;jmwOT&rYz_JqTp=P1v$ z@DjB=?cG1gXPwHJgsec^BY=e(Hx$JE%azx~Vh%l?~|NJ@6ohLEeox*!s?d zbA9)NbA6dohSZlX)voX5_=C%F`At-!a$nF->^ndP$I}_a(cjz~us_H8-u~)b7xlG0 zCcx1i&JWhtK4b9uX#b7*!TRhBM}0c;JAU4E|`#21~``S&seW8XI@8D%Scyb4C z(!rQCMBh1yA343be>srP3?G|Deel(bg}4``a?V{{)qlM-?)IGjtjc{q=0kA2pE3=( zdlR=+`ReHN{yDyHReoz2uD3+3%aLCU$M>oHZQwiLAL|5y`hNn4e&4-x?=HWu=iXhs z599k)Z||Z#ISkG>s}VhtO~R-vZAXX6mN@Z$=#bU;Qh> zS^su$*6+F}+rK9q`pth#NB(0|{*%vW`i|d+Fvxci2m4z_xNOL88SMZs;4moPi}C?@#g|g7&^NnHe2hZg&*#4g&9xTM%jXje%kMiUL5^Ep-x9#5*eW$}jB^=6$_m^i? zKELv3D&GNrlk+nxKMwzkbN56H_7B@Cw_ommw%>=4=l0(h?&C1{+gA2<>tt}h<1*q2 zg&O&loQHf33~~MEoNCw&c7DW-C43yVep3=pPpm&2pV6MCUp2`cpX!S7=k?CHA;!xM z8#a60+mpudNAjPFe2)gpeBiT^(7!T{JrEhimV1IS?Nr~LgUqq%`)>yM0^;B+VaxsC z^7xM!wdII&7N>sHdWLlNDW=8}^dW9<`*2qp(=q6{HTeAos?nNP2!G(f^*Ohn8T?(u zorrHL)O;`WeVh+e_Wtt*&g1^mI^G6bM}zm14-&sni0@P)H+{&}za^Gu{nOykuRYc$ z?D2j5#fLAF--FY7k$=26v$=n^Kg9j>tJGKdI1a;QXE*iDYle;ZJl0f~a>25`F$Qm_ zyfHQzHo{-_p?}d%m{E?_h>?oQ`^Pj-`ySHo%1naCk=Ee&FmE0oUcY00^PW*Z#Qm}3 zH#p37^8erRvFF7?)bISJ zul~6vS{}CVEi@zHG1~qu)akThKr>(1uX5Q}CpQ1xaOBsvA0)Z#`>N(wW%2J)&S1^o zbHTiJKh)MU;IP$wo}1wq`|k6+7hT8lnZbRYUE#dX4_;T8irUwe-%@Wb1+CSpALUti_8ax6W%OwNA-wmq&HJ^zg?L7Ia`Wst_9ym1emQwpuX6V*mPSeJSD1bdZ5`?L zgXh@~Q{cXuUt6ck=rm~Sws5x9{oCl{%6IFKzdy;{6S6)rrW`|4;21;l35ng;@p_f_ zbuNboISi)v`kC{;oY=j;W#E{*WashB<0{)XF_k^orm}J~EQa}U3EIC7XW9NU;3!}D zp)rxW~JB&QJHUD@_>eU{tvQaIXkLoS$Kg4eAD>;^vpJ4YBk0zX3>_xn@U zZ}wW(DpJ0Oi+pp^u2j?eTPiDao`26_5}fZZmWAW~;;ZEMJ&M<>zQJ`RrmmS zG>2jMh3xThKD@H>!;@Tn^Wf08I_YnN-)OS8)PFae_0LcF)$ecTWc{naQNH7;56qrd3irICeyFGv4YaEv#9>trSPRBSN#EP5L8ag}Y4E8*N8j)&YH55dtM zw%02i^1oKOT@cgQkZU@l-)&e0oLD+pGxk3S&oK?bd*^+K#}}f`)ZH~juKOq8sJq`? z`YxQmyYw_1_lABq;xRbx1ucJBILi0C6?5VI-HMyxoL^r=e*5+>;B4>naM_6@4N1pBZbVvG= zVaqdUukDrfEeVJG6X;{9+j71!n4aM^B>h2fr1x6!9XPHPuAQt%rNc_2IC`{QN&8Kf|S+f1`_7JHTT&3}Z$%-{ak; z!NR?q2fsl2mEhZ}T(-W!yItJuQ7&8Mvg_W=K8FvszP@9b>w7w!>w5+q^<5i%W6}M1 z)h{nsnPg30s4~l5hVv+EKlm*8?^SMI{x7;5r#*f?rMGXAF<~M7>?Gn*%NJ}d`F6ge z&gpX&Nbv7=o<_W&5d9AM=Qy82{S3}4j}Z3?gnKE>w5P6Gu<&*m9c*8C79MQGWe;X# znrFU8{?*`vs($|t?(VSuHJJazl-}|`$mhKZ3HBA+G4~bwX7m;B*FOo*<1l!C>~+k; z;Qcg1d&vECKRm!;@HZdNC-%P5FhKd^h{OM`$rguWP3G9L>^!#YyV<@i;jqs&L+3s0 ztCW@d%5UL5@;EPev_>!KzparwHP8P(U2Pji+wH*TM^@IhBjIeDbq(7ryYu<-lC)K} z)pupXR>$2TaJJ2U-G@%YU&%O%`1wMtl`p|m&etQ2!N1?7d_lGE8syXAytnXf_y<+4 zzTM%_H~!LQe{TYx8I-f6YRjGTd*OVI$n%hWh3-70erv-~Ki9X;8@RCq>+3rjxxQXs zqrU2MEMi6pu9@r?q0jt>!8!loaOB^Q`k4Q*>Yrob&0ycBHn=yXKKqM7)*r!MQ*MRr zkA`c=Kc9G2^4m`sHcTEpSWFqn+{aSCLB`xRpT1*r-m8${vl!>(*o%IN^q0dQsxv4r9(IScbCGkf42kjm*8VK412+j zizOOt9Spw)d)+d89R4J_m#O+b3x5gjO*{gJ1lxB1?q1h<#(Uk~q8 z>TI}*v34%;3;4)z6pi;o;!`Ty*ZuC=T184dsLwfYuFtt})JOmR9?t%~1`dDf@53lt zwhJI?)vo~*#x?ZC;azd>=UBBad8|6F2TezC?s7dBbCK<^m|9$Xa z)o1;l?T~*z$+c%`(q?;{3&I}dr*_D_E-UZhKo$ONVj0($58~}b?;p7IweKI^p#5jV zs4co9tia~!n7lyy> zPhN|nKbhYC9qDJo_U}hIoFDA7tzq50>voOuto#nryNT~9)Qs;HIgk0z@$GoeeTpP{Yfo_I1AXJ^ei2z7y`t>6uF-f7cgS*CW5LwukH5zrgcqde^mH@K3C4 z{g#At{l>vjKjkZT$o;z81%<|#MvM7;qZs~zYXX755SS% z_V^i`+v7R7kHg@){vX7#cHWozzMb}6hQnZcyO-Hp2v;G$7>@Sx`ZXWU{rl^1)Yty) zJ>ad9<9fKS$zGn#d>fAbrM_*DWql0E zA^IH8S>G|R`t%j5TIHvym|)}{j#k&0F{7%#op0O|3jbN&fp9MGAUN!||9kHe_IbVk zAv{PLgX_ojDKzrG7k|muG~(ttKRmCp^Q+$jjrqj>_Z>Lb=V7>y^v;o-@=r5cdY`%q z_`IJHy!Y{1_H=i_^6r9bm$>(FuJ9RRo-3Au!`8E~bw_w=lf88_?A+7s%_2ehN0Z#S z#c{u|5tp^GV<*ookHL9vaqJA#^!oCraQO25?`rm|VzXS|GThp}br0ze@PeA(J*3w; zpMnm9@AWxv#(RC*yDA*@vHp&YTz{tTA@x53j`VMk|5NaURR1%R-1>hR&h@_!&h>u= z&h`H>oa_HG9Q9v%ZZmF|<1>SO>8;p5r@@weNzQ%AYenu$KEsK=WM6(~%J1B|F+9HN zv#;$8=f1WJ+*jq!?e_JU+t-=Py*T{aF--!W^M2d(9EPpta=*j*3#tFT2uJ_(J)cWR zH>;*M|3+}+cOQn2+V2hc-qb1Z`8EBA=QewYk0$n760E)@;m~(3>3iX)lD$;9Eq5=1 zF4*3Sus`XW=uhUK0_Xgz!J*&$ET2n$tK7xmZ-^M2S0)n2yyA78=4@ZrZJX2KXj|Ln z3^>|GTkeL#7TfCIts@*uuaZ9ck{tJ$&K70H=;4ImIP#jkpipD0^LN;4Ugy}X>%zp^ zzBHU|cMTr4YwNmjcWo!%lW>lWe&sd8>vLQ)Ouu_a`aM#5%bN!0^5`1v@{|vB$n7^_ z&r(yH_gvx`j^%v?dA4sp9QK+1J~+~=e@8f%&oZN}Uwt2jvp%|dTc6kX)8TxLKO46G zJshQNh7B7&l5>N7XBFaT56j1-A?1^#UB2yg6~2!4TJOr{eTcWOL?VLrU2mM);|4hD zy9Mcg36Ecye+Z`khjB{(PdL(RkMl_Ohii!OW+rHl-%kj8)OR|Z^_>BSKF7v0aIAUF z|F@K1`=+Be>^pXshIi6Q1n0?_#9@!~qTlKWkg;KfBleB3v&kW$!=p`Zz|O!eMaD*@HjwnloP) zoIBozJp8YHTf^DDX>izg(v|EBb~WFZSHElKe@WKfk1y2RW1i1> zZ)N@I8Y#EWH(|>(xQ?2My{0iZ{`Q7Lzw4qS;f0O3tP4+vhjSRbXZD^euZz9_4>aO3 zf7}Q=e@v*K8GDT}(4O7h%wR_s)J<}HNn%3RbZzB&I)f(m#&T*|_M}6gcYXJR@JjVX$4!CeH2Rbu;ui zuD%Y(xUyZGH$$K8vMC(x^7@s{z3$O<9zS(PvmXEWDkve?PM;-xZYSUUh;~}+s%Ee6 zraG^?o_75`*ko@_ME*KVRDyeTKKppJ^4k!c-oaXeF)+BHFUdx*FyNQ)Q%DQSgd{J#5=gs}#m^VB5 zTJ+t5JbshMarp7O0m4wY{Whg^T00=M_Lm$TuhzxH1VhyCim70%_~28Vv@Gh)=x`YZ>x%ftVx!%-jm(E&-Fw*Ng0NB?tv z`7=Bx`Rgz6_{#cc#W6$uGZF5qa`kNwhd%waC!E{=U>Gw>u)lr`4u5%_co@#tiTmNO z$LqxK#fDxd)`IhOVj7&U6I;OpwLI5}JHxTg)V|B%Y~PpRY~MX_w(r+)w(pm4wr}F% zL+#rd&i3sIXZ!Yovwa7{VW0l~E}Z-0V{l)skNx*mIQp;kS#61-_1Or{_1O-N`kcKM z*IoFAI{&y%ISPKQ>UXdFQsrIE2i`AV1IPWW?e$GK`{PbH`{PgW!m7``=HIM)xt8a6n+wNybAG-C-oDE9?|;GBzyE^!s$BoB z%mzXDSN|LVhkva98E~%u$#Aa!H{o3W7vbC=7Q#2x@_ZKj2Au0ZhJ{Jg-}c%A&h0e= z4tw;^Y0A4Ag|^qZaQH`i=fTG8eS9!n6pRK%4Wv{Q(hYh{HZUx8n^+wWf56`OUZ~Q>> z&h_V3YV^Av^VwXi$6OC}!*4X=vL5oCrf7fl`CfR|Cx<@uzl*%V`d<$JJO7^xM}P2o zd7g3(gX869V{A6KPxDpczCw-sJDg|v!%1%Wo5NB5NtC}O?C-D{Y`?9Eqy6L^67RlW z(>~wenrYadf^}7_FSY-@aJGLZINSdvINNtEob7+IL;k}KxzAd2es2n6GN zVK@w_pZAbaU)L|{n##d4u2tMJyqvb|%chOK>{xy~oX0ZF(XP95m3pFYIQQNK$K2z! z)O(GE90u984ECPudvG4>--ib{3|>p0BaX4|T6Ht(8f#bE;yrL~i}%9O7H4DMzVN}d zuYU>lp74-Wiu%&GkA}m3``)c^_Wf;e_`)iTkxndRa$6R534@I8q>w8GKz9+%Cz8`~geb0w;eV>4H zeV>H;QhmHP3VSTy=jyrqrQlq?-@(e|`u_%_RZrW^9PS2z1tOV_?*`aL_+@70n1 zSUA$#SI&fUU->GW+y3?ro}bvh=zVeajqhAU+bI84hy3LZ`B>_k^K;oR`B~nxCsCf^ z`r2A~hO56@-D4LY zT-U+Q?ICyk=({{V?t}aAfx-RLKf-zcbOD^(=TGoplf1kmcp7~n%bj~e?ss2B~^`%Gi>zkZ^0vzS}ou7BZ@tqy}<0s%e9*%><-}bKy z;OJkD$6Mgs{;q3s``-%Z_P-0x?eBaY{h~8 zw|%|==k~cD&i-&L3{s{+e{I{*J{za@(LZ##A^yqZ)A745@)*DRYgah@<#=@b#(1>8 zj>lZzYvEj9$3m{}9dOiF|Gx-l|33|9|9kz*{(l9|{@35(f9ux^=k{L#&h5{TY1c>l zw}P|%GvI9ho^ZB*7995f4u5P4KVCX+bN%jx!+*XPaXdVOHZsVcB@T9-dObWo2O zn(LwKF@x*!mpG4gxxb6|7x=J7+|qwBYW5_iES8XCqg@@oYrjpN?(W_x*78z4cm19)rI3tE=IA=T6^evcDKy z>#PpP-02?q{^WnP5tnBfNEco&U5}gIP$v|Aj=SY)_}tv=VI^C@?1O(R>ueqOyOjBmytnx)R*m1U)W=NYzIeQ zbF7{Mhkt#Ci0Px1-yymdp2}fxkMlg@UV)%}|1ieK2JcD#NvwSa+iMJQw3qemg|q)B z!BJoRzYZM!*S_W8u+RQtU(5YvBRJ}7dgYP+&E^`%PA>ljIG2AH9Oawe`?PHT|2Ds4 zp=p?5C9-Wc<8z*auA$tp9P2Qw#7+sZi`RBeH;egkGhyR zzaMoq9Bu2nf{()SuAu3?AJ6H3nbP~N^S|JD*V(pVs%f{)lzC0vmaKild22$--?`44 zM*0sSUpA%RH>J02Pk?jV+E;Vid>PLExe*Tk*tfn8N84JzXW(4Fm*DV+^Q5}-Joz`| zd7jkQQ>wkLyPYHRJZaq*kjG&AyH3pQ@47wO-}@@pfpMQ?e{k-?EhRX&&4hD*I1tYD zJqV8ax-N8X&Fezn`i^Kljs z_muurjrHx}vvQ3d*3DnAYJ&dlwkrFU-wyiU)8VNHDZ>p2#4JLLXx!i3;z>aAJ@paKF;+~AAe)- z7&!aic_93u|1X8Z|MI;ZoZH9!$zLIVjl-aQYZJ%*rupe|ZGE=SfpBimBjG6D_WWdG z)1TXsUi)%-lC;_S-vQ_P-w8+kZLbI5++Huj(O$~!Z(079j`n0NtA`g=dn%oCTd)X0AiyH|P@Jc5rrTHReWH*Jr; zt@-GKHN9;&9nNjN6P(*_c4G6N)RDg*&iOx+(%V;9I<)njL;gQw&GCF@a4z&aaxoYB zyAzJBgNwAej(&vmIh7szj*aLmj?IhVJT^`1*c{7YFmBG70egE}z2o|sD^KRV#+}z3 z*E`Nh60OZ%)sDn@-rg3DvYnR?fERKYTrZwMoaf~)z&9x*_>7TD(U5uB>snlgTwgy5 z_i`8<7w^C~QJ!_33P)Z4itonat2=7j$+vaz=5(-->zhG1`{q7a-x&Np@FBQ_CMv<} z@Z)e?hrNz1MhD9N7y*ZU`r~bI_`|)oElrQj2L00yXaCHBvwtpu2b$#Nx^*oa{;~X7 zJwwZ%3Fq>Uf}?!PI|t6?T@B~*u7PuTx5H7M{(slVMf&ysyW#BrW8v_x{$Gi4ocW81 z_5aGFhx&gNIQ;K3!EeIxOwjw~d*QfW9(_ae&dBRsjf48&Cy?iNSD%D`Q2l)o^7R+v zedtx2^y=Gf%p!gAL5bZ<-U*&k^UEJeZ2B`&di%#caP*J$uzx-r?=ma@dy?OB1MfIs z&mq+w^>4iRqVm+g6CCw5|7CF2e=QvP?GH4`kp9>U=l9>u%D(FwF3Ps=E(1s3wJ*LC&U3-Wa36=k_cxdh+SeVK>b2S5GMEX+ZyBiX$8gs7 z6FBtQH+G_5MccV1KOUY+8iT(592~w?-#6i`?^|%_Q~uKq`OiA!6T61y_dV*I-)DGP zzrS%Aa@WL6$3xb{Z-WOlmSFk!8dIjh`=R;7k^g_=fBR<6zirB|{&#iA-;?BCD=fd4 z!{GhmkBH|LYWBij;ymsbT_-4yb%OS-gzdS1_}nP^hx*osv%YoVtWSC9^B(LpIQQMt z;el$8^|=Vn^}QI*{`wJ|?Rgpwd(`i~X4d~JIP|YT|8X6`lBxvD+ZoQ~^>qy`&wKS; z-d4z?JpH>9+*|ee{=nzq?JN7f%q8&4l^q{nh6gMEX}{*XfqPYUjqTr2iZ!quy zH@^=v#cMG(8Pw+>Br>ZAXjg0ug8e|Dhi^B&_b zaK6VF!6XywKK<$6pUwVU5$>z`E#I6|Icc^<@``lle4#)nI z`e(sef4}L`VNk#QFY7-Y4*m9j^+$j0WXp3c)h-YAxk#}4W1GOSKj!?f73Jo8X6MgA zjUo8GfR%_RQ6_FJ$4CVP`_>l3y&N%*D~t11Pm|K?$##66uP4*s@PX^CQ{aUh2G=`t ziSza3PB^#uUGM;h!F`YiiR1d_{_pSMy#H(aQRaE#z+Ej6xdj6l#2lZbl-f^EDLan#Ri*8AY`3JJE^{>0ISUW4Sg26f6EL(0QG z$B=D2kIxM5sci|z7QD5`x&s^T&aL&I?NB#>_e(UoUIM?^faMZ^+;Z`{JkK5n@4uijY_HE)PYkO+1 zwq$!pz}eoV;cTzh^K9?GTa&1NHOkBS`Dlp#&Ec%yaTNOX*D)RPW0PEeFsz68<8nCs zVfhS!A?447qkj79PB{B3k0<9)_YCtK`ZDYoGHBl$#`whGn&BVB*?#xQvV8dt|9O4O z{#h9g`^tM=aDLCo@s!^)a^EKQeYEFxIG6V@ob7qEL;l?k`Li8z=lIC)czghk@#=eD zY(2H#`|@1{*CcsQ+Gm~NFVov!KfVh85ZpWX8*#{GcQS&#hD=8u*AV9y$5Std!TI2$ z#Dj&H>psx@mYjPd2KP>s#omc)(xrwiT9dkFT>+k2Qgi)h@xB&3hr_Tx759F9!^(Fc zmrt$yL)d-Hm>>O{n7*gCX_b4wC z2R}2|H#^sFyCBEKCAgu1*rR-zB)2bleU83l-Fso{Zm=(&K%D#HOgQwZ z|DX;&BC+{@1LypYB)R!rZ)Sat?O?C1pCo<0ww?(Oau~GtCE~ExzCjgB9hCb!{PTz> z2n6|l;$YJ|H}@(e9KCk42fSm0g&kYL-{ivKdgO#Ee+G6Of4Z`A_b~q_`Cn@K&(`#^ z_mjc@U+AA&^}F60$+6>B{6m;dM?I1FibBme{TSylPWMOtWBBSM|4Ek9>3*JA+r5{K zx(|?lbNH^BU-_;{uJ2~R*>~4tWaOVm{-?VZjUDqpn&kTKIXHaxIO&(5ar$d{&O7J8 zQ6K-t+U4*zlxc9Dd59zC8QI^54>tdcaO9VNlURMP!J*H2bSd->7VWIt=v&Ki{#0e{ zckD&|wD%owf09p3a{aRr9R86_A8h?Mgrol6>)F>G?*`>h6NlXLFMy+b+y9SnZvWrG z?fN4BGo0Jsd9*FZ9}5y&f5&pv-}-so?k9~werICqvqRUS`gF4PD-Zka55C?kw9h6t^DLFg@e?(_bFpJM;c`kfm?zxCS`?&UC8-T}s` zyaVB|ciXQv?UVO$)&GN<{v_n9!C6if+wyNCp9lNip25Gjb2;(9YJT}8`veBR%X==dHW;SeLVqWoRQ370r+dLKkY|LSb3_>D3Ew$iw90BE>fD-7 z)j5*GqDJtC!TAb$;U1H9ulbhVO+9IBSe`^-!@5i^_Bq#E2H$D0PVr8IYqPh(Q#nvs z^tXmJd$;yi_2mAv4jlc-{$trB zbsA)=8LWLE~#ohmCo4-Wa#`1>OG;HqEVW%MHU9{S^BhPKa%aI}wWi66sH zHRiP}??9ZC%R2~;@+^PL#LrXT#g||opw?gh0s}Mn1j>Jc`kqzwyH4J4sYP?U_5Uf8 z;j2|{`Y$arH2uwRTnqgBgZ7W-@ds`zW4kqcNq>g1gcEP$nFnXlUY~{Uf*ArOD1Vi_ zA@_Tucfzp`>{weCjlk>vV3?-lFv)>=PVyyEy-U_^4Bb%PUJW; zSid#kD1Y%g`TiojRwFKQ-@^#`WaR$#i0cP~`M;LrnWRHzIG!n z@@?VJKO6aZuzl8G{&SOD`_|+0Y~KcOa@zn zBmB1)`46IP9Wyqu_SL2?&y2>x%U0c%?KsF~F9%221JpIrtEZ`J6OU3y`G;#bdi1g5 z#_%|N4mK@T3s!y!9P;k3bDbgG9@wboh+1Q-uHe=ZODwrKpBvszdi7tb0R(;IceKM! z``7@SeRKhweRLrlK2qORaMpJv9Qu^&^N`EKsY|fs`Xdf55{`E9?^-?puU_TWZxXt4{rt{!u3s-4^>YlFK98YQ;TS`<>jrR? z=NOjre(SFAU@iZllX+(tj=!sE{?k(a+mYV|Pv$VJ-$z;+bxMQf9%^xTYGw1k6^`@XT=9v!XHP19S);yMXB%I6h?-Jzlj)0>)+t2j5{SJq7``rac{r!8a z55cQpvqArKGmt_qpMfk`f6Lk5vi^?oH+JlpqDwB#+TH4^&0EIbclkW(Z~f$4Ki90e zey$y(ezwo~aBd&x$J{=?Z<6)t`>by-IP^I_Pow-iKAG0r_WgBE(-)uTGlS`86X*2% z!BHRocJ|`%z1U=sw?6@j%$bWY#$u+tk;52z!TY^$ z62Drg;a?_J-+#gC>mjzDqeqP@Gq+5W@XxTg1!)~WzS*06)XxdtU;c%7LLtT=zEIc7 zmH)I+vz8xM*}n(62j{1f#vq?V9Bg`ho73--xmo&_1#1q`rJoyT}Ib0!F$ymIHOu6n0^*#k=}dF z%V5W?!F_G}Mqi<3pVz*W_4UJ9pZT-C$Kb5*dvNHpytO*yOjB*S_U{Pi@{WLWd7p+Y z&$cY%q-(gRt>x&%#}eNy5Y%PA$-2&kL)VH&H+9`}q^Z$|ZBH8~Upx^H zPVHOZxOX1A3D+n1iz*}d?$Wg|E-%6F`^|;Jp7Nb0cwv?M?vndh!#NDzGyj2e+t=Vd z^B>`X2Ftrk|AO-#qJR4<^xO7V!Q*Rs>vt!d>-Ph=ugdKkuffrl@m6ogK*emeO>?M`d$d<`d$y``rZH!a2VV(wQZxm4veSaJa)$7k34oZ zg7er}7ml%G|2PZ|`}Ei0aQMsqbO0RvN&h)NXaCKI!+$4|-}U1a*ktf~9N&k1?rE_9 z`0iEoAIm=v&gJ{vg(%B;{!YR) zY>D4V@OL1btNa}Zv!I%N+2#kI%4KS)#_$92gLBCKCLqZ6%iy#3q>sSwDVZ9%=|XP$ zRXVs+?tOPo-&x*49rEQnc%#aiKy_LpTzD9B6tlZp%?I$votpO+^ZxeMe12q2p`4}h zko|A32_d(i%z&evO#icv^v|XA%3tY_|0c<8XRlAWoqe|2$7cq=Yq=|N{;uVh;pkWP zvj-CY()NM<-izU{ux&iOvg_7^&_Aycmv;b9hGSfe_!jrC@Y*%K?e`Bj+UNIF-gzX_ zkEH$O7pp$Ycke06xBmWyK=!wP+f;v!CC?Hi-=uNFCJbY@2b@G}2=%tzu?EC(Hdi(~8 z_d*x+49$NA9QjTE%E(3Oz4zIC%%XcA$JQxuj4l6;@r|(eO9sd3)Vq z`IF&n|4ML_et=_`7NLLB~|?gZA&} zgU(f(!E-naj)DD&O=D30BypC%42N9(?r~@R?uUeapKo$GZhv1IQ5mqtG(&Tp?`{q2 zqF)*G_vOUd-;cxLZ~gDP{K2OGI2`Ha-z7G^Z2HmY;j~q|9%s#Gqde(n3D7mIyPSjO zbIy%&Mx5XLJ+(jAcCwrcnS`R;HST47gYpgd%;20o6^=RE{D)G<$S+@uJlOpH{hgeD zG93Ax^Dl$*obR4Nl&?K+bnp$>8uE8<&fI`qGdQe5sYd`o{UmG~p-D84j(la1!TW2|e?hd%$g|r=e$lv(GMLYGXsa3w6Cdlh4L+7+jBU zL40b>D<7U%e>?(*Kg>^(A^G=C>CJB)L!bG7obr25X`P`88)T|16kKJxMTIM-qmAif1%9>evR$-(8;z`;Lpj{O7`v|2HRbtwZL0 zlfnG{-PW9cPdMj40FL}ykp5!$#?s*2r!&9)4*l_W+@D^%;n(@hVEI29+2q&c<;tgS zHE_0EYuvKSmmyR>oj%BYGlE>f}lw%Bb-`C8of2`?!4?*4W9)j!0kHfK!v@Tb};S2Sxj_%Os{qhbl#g?G_ zV@WQ%E|2tiy#^5u!Iq(Y&mUZnW*c$d&-l1@m=a{_@jxlO^57ACh zp8Q5)>vtfH68g+Pk+LGc^|igCzP7FM+_qWnyDIA;kM^*0VU$gJ>!`heL zjMpH&a@Bp?kdS`uW!lBRnrp@^s z2RZ-rj{J`I$ge$n!eP%zS2ow|AJcaXet&B+@%Dupw*255Hf;6|g8z7C!!f7GUZaDL z{C2Yj8CU)5@4GXNw4c$)XD9ZZnyQ#lNlcO7w*xAp_gv-#)`-rwJAIujFIGd*lfoelOsuVvBR%Krps`D;nO z9s0+R*Lz}v{`Pke!r%JW`;6@0@o@Op_HzxD+28(=yE%F|-oh%$^V)<+n|kg~9QD+% z&KKFQN5R>zpMa#8<7Kz`qD1_Np8EG4EI&Je*X>}ez%>z(UJa{lwSL{V2piY+r_5Bmh`jmw}$IE8a zZz`V|wD$|iAKH5{JkW@XzphMj{p}uFl<#{UPm#(Jev#Prco~lNkbjrh z{xAWK{$c;w7S8?0^;^hI@4Osr`KHh1e;~2#HwTXP(|@@=wf4y*Szm4F&n%{YM2RP5W{=KklzkM;-dHXat=It`R(3Sn; zbu;{-f3!W=>*V|3UJirv-95xH-+A5rG(4z~;QV2G=K13%@EnB%{qrnw_(y#{1Iha2 z(C7Hv3C`p5W;ptT{oVC{_Sa)@Un#A*Zv7gz{@r{=_hWyr5!x2(a~gSVi`C$PMqK*x zMoDg8eg_=7?Hk*{xo><5&V8dF&UHT-j=EdE*W_IOqi`<&-;HJ4*7d4&>mgsMTY2NU zVLxkaw(hv4j0yI|$BCyFYTB}w{Na1$Tf-sOKKEv`eXeP=Pu_DJv8`UsrI)^2c&CC8R?OR)By4`+Kn3x~bKAL9B5yY4e+ zk9{lbk^SCGu<5;4=JbC}a?|_VH`3dGcST?BzuK4k?+4*r-+kbyuXDpea4(0!{&Ev> z)W`93Gd!S>V0~{f#wJ5)AL6L5bF0_NT>g%5E*}@R%eVbcg{N{DTw7dB9BT{hxgU=5 zw1*;w*n`X3a_#vJ9QNq1SK;uN_N@$O`zFHKzE$AxkM_9^3;VR^NI2W`VL1E8{u6TT zIR?)5df7bntj=@SKb$S@HLk-zZ;gnx1udSsO@8W{Q}PR5<_7)iwLR*iecCcdA;IzGwL0wcZwjvlyFN2m-v2b;b}Kj0l8cQpau3_FHBTVe zm%ZjiU$*Si;av6^aFlIXFT%NQFTwhnAz!{%z%Fhn5^Nn!$5@g0Hi2*@JcHPMF~c43 z<;348#NOi8&HeIVW!EjXrE_1qE{iQuYVLmfg?yg(+s}s0+fKXqn9*Qszbl(I&wsyl zNj{%dG&SEH%B-K{>?i9HezFhPXLBD|6^=eI89Ao6*6ZRQ!qQ9t>k==h<>}{T;OuAh zWj}8YXFtG*H6#;dMB>EV1cjyU_@arCN<+ z%N{8l`)q%wg6J)ol?(5Bf^S<6L zu;rPBQ~xQw+vjH+fUo%(LEGL(9JZ-z3T0(o)8UYte>Kuaer*{GYl{U~*6>mw?T6h| zrFB40BUA2r&Df(DN91!u=i(RrjNl&jpNaPYjS|elYvb4|Ad>;O{?sC-K_Sy~3?UmEpJ`W&|zA|!~ zX5Dy)9fP3!1K1XFxxcbWJbc5;cnJ=qqk2osegcz;bKO&ky&nyBF5DJfc`n=>9wZGa zOZSiOe#y=~hWR5$%^x{>{>TaQN4|6Z$o~6AHXpZqFZNE(8P+A(7eCEe^hNuT<-gd7 zOFwe|AonA`Tao+GLge8~$HEBY;cK6L>_vmbvyZ;Vki&le*sv-5Y0l4Tu=w&`9F=|f zO5z3cS%WYZ;@OV+{0+s>XWRY&UD=-d;jl;hT*C*OUN*fZ*+#AUMA9+iToiTH*3ICs z)x3`TT-FRYbX#}xN8RlgKD)_v^PL&lvOWBbEW__ni94#}vYc$ft0w+g=}eQlS}QGEvRK|$d=%x`52wSqA8rE= zav1*WmS!JdEe9aMweTeB)>{bM?`JNjg7LgyI`$j|FI(l__r8a^%Y0nzX@uIc38!Jp z?I$^^7wb{GCQSr4RHya*AQpJ(N@kU zkH9gX=xbTWYH}HiV>lt$pVuOe{_OLi!{K;7B)^haTl7)XO%-$~x^r|fk*SpWSJ z4*$v1>Cl<4?qJ_0&GG{h+ke)i{IK8tLluYk8y5}n_bj-N!(ja<5l4Rg`A#_d^Br*Z z=T>m`=hpB5hr!<&cn|Tc>M#4}#c=MQ-++5L47ShPNt^Yp4TnDEU0p-vuIobXyW+j1 zf3;E98uKLYOThWw<8nCeJzOjN0e-5c_a4i>sZ9od?@4yg!{FSYe+LWkUfmBH`IjqO zzWpi6_nz)n__iwdp6)KrC}Gtgo1Uhi(=xYsj1 zE^ViGye$LAc=8>&HQ|_Fe8+i3INou#zpfAG{_1#){;GcG&#-4PI{$X?)!2jTaxH0% z>?zhcmZtDoj0MM%W5NDlP}jSNv#$5U>M}TYon>6vy%z22Q%JCG%Oi`rxmWQ9pXa>_ z@2_(H)#1qRSkRU{R=maza2S-IN1Wy7!y(uHnQ+*zJ<7r!=YqxHsK3wgM!@kLPhU@f zt&_q1k>!cQ*OosC&gE-+l<(Z&b$S+cGMIiUaZazlBfZbTY%8BV7);+woYPxgPQMNu z>CgR9vtP0mpBXyG_JhdR=JN-OlxKFZ*Q!Xr?&q8Q-_i+$Pd(l6?hTgolR1y{o%+?c z!+(%RdC?d7eUqa7Q_nQM8mwhGZ&&XdkV+8*}3*}S+v@;ndChVwjh1f1ug&%jYX=b3w8s$GKfq8#%~r?0htGvrZ! z?U(;4+*x+1ytubX9@?6^k>&Bis zmgF+3MviDLJ_;asKXW8;zTY_t4u5^_q-I@VoeW>8{N84Gw$A-Y^EY7^t8)3roM-l) zKJ#i_i`co?xjW`!{kJ8o|D0~Lxv#gkm#AN}qe>b>saV z{7sw`a_#ZEu3?Y)_s8Cl%m3`)eQJK~MO4;lM8#g)Ua#}BI_1oNmVUO`BifmB+sAy% zFWk{eRr&|qn-;QLZ4olUt9AnnInVY?g2Nv3Zwu%A+rj47w<9^C z`)K=CVAv|pOswsvz+tQR9V4-YB~1z5x4#wct!#ep!9$<jjl z_cP`Y_%05E_4WHOxqhQl{gnG%=#bkNrZR}5FKEAihcoQ|@cPa5YMZM68!k&!%%!woK(NlfIRlz zmGl1){&Z!t=v1n*sGOCXE#Y@Q*RcE=C3U0!o1AC;--5ILd*Q7A zcW~DKdpPU=1Dy5SKePVXaMphaob_J}XZ@zl`t8G^-#K_y_(&UsAfHAY{51YB{oYmX zT%o=$;xWVq zKCcV*qmhK+_o_#QOXf&A#N;h4_6pcn8k6 zs;tgyI9I1-JJ&NKtmnUudoE8y#?1k6j2p-K9dI5ecfx%fhX3?8j=VRpe%~mmSvO*& z_jZGoUCZ}#t_=pSJ^jRvZG+zfzneJL!mi!991K~zKMoIY7`$(1XtwXet)KOEY#Ln4 zFG(ErQ=j(+Hz_1|udp(4=yRWhW#5o}67A3a@LC!EaNV>5oYzgZS=86(EXw0K%YU*@ zx%OrIwJ+>{#%^Jo(1lj%)?4H>a`06T`w@s{lhrqc$hr&@G*Iw4Wm%|{_L~Zu(p`QpJ zrjYQ*1Dp1_xWU#7OyKsHv$~oOI(dHzvORqV-yqvx{wLO7y~x8~7rfBee^NIe67-k$ z&MEZY-!Zbjn<2~f-5iekZt-ICn;BoM`45Fha_)Di4F7-UlbDsP|JSR%o$Nb@j_2*I z48gsMC5V?T)XXpPVC4;8ZJr6tt89M#5&31uQ)b6gu>K-R@m~+I%^csumW!F)Bf32| z_&nb69@l8+$C>aw90vC}_act=?fjcP{*A=bkl$1Llk=Z>^ZdsYIb^>25j?qPWkU3>;;ED_4`|UnP(@qzaJ0h{(b@+{aycF0B8T64TpXD_kMU`V_vzQ zJP&7oE`am=|93e1b5vL3Pp`j-+U+kR;-BHA8+fWcn-YgT_6L0v{lWIPe}sKMxT5)9 zl)r^#(B1=xv%S~B*{%f6L14|1bD|YX8IbXvW*# zq%pWJuTNrpxi3Eoc1|_iMdfMY@*NKOIF892-xdh2e=bD9ga!-Wp7@BW@7yYP?^XS= zx9s<2Wy^^6;CDMpd&uQvSa)eAu=L;A#NmJY?;)^lWU#*}%l+*VxKANLxpRA#Zv=>UYln!0LCt z3;jF)p_w0@BMc+)7gJ>GuId4QQ_1U9{#}>@;j5~C+izbu+Ryg~m3vQNxM{QI`w$Oz zH~by=eop=S5eCcaCC=s9-!0F!@UUGB`~I7>j%SZoHPQCy3IbR@s;zL z!S7n_Py9lm|IS`Z)optkZ0n7PaajqjH5{w4){t$h%*Q8oE%*sIo|(xE-ywW^V*ARI zaPBKVg!?!QmS?}u<&mY$lRn+tt2L7h>t@)h$5?PJja%E-x?Pcvfr&~uloPs7`+cYL zD}ScS?||ukturfIABOjk`pinKJ;inlC1{Uro9(f@L4^eEnMh1jg7!?|?5xV#BWHVd zfWsckyV|t>hr2hAldGuyzi;<+W_o6_O!g20bT&-bH`$RU5C{kw5CIo7fFPh~Z~+m8 zPFNHW5CsGgMQ{Q1E3SyR1pzk{aYMxoQ4~}Z_l+da`&~;eO;?-@a4SC$FqeU1fdtby?qg!DW5ovc7ME)oDx`n^j{VPqiD|i`o7hKdasl zpZ$Agvd{iJ8h-B2$4-s+1>cZVq%NsvFk5I!V`A4H$MkY= z?h}8b&;jqlA?ZWoq4c5sO*Mgf?NR>ga7y`m!KM5^!P;-UIQQ!15Idy&n~Bct<=;$n zznATCf3P{e`wV%K{%sZhb^TwAZtGCzutJ4?@9Q5&&Tm3KcDxfGk)E3RL;XJkm->GQ zep`}PzkKye*WJKcPkmG7MEoa=UjRNY>D&G7vF+bW{pq_Iw?g#uiNDWv@wvXA7yKQ2 z`1WndpIh(;{uJN8@byi}gth@Y7Jrto@ge2-=*3TacU<4{-+0@8=eS<_tb^p=iZNcu z4)i$sjix4cCO-f_j;Y!icbxH_Gv0DWGu)f8ocH36 z;GEaZ*Mp~meV#?~{_9N6<^4=vrTx*IO5b$w6r^E&Nwb+?1_cc;o5XIcIzjCdHlx0ONe zV~@ozITn51p#%PSWQX5gT>{Sf9>VsU!QV}M*T9G5CqG&LWYSsQeVaJ%OI_1`Powi1 z>zZ&H{BliL34UAB?>&akf^)}uPxQOs4<)|$MD3&139H|+TU zly$sGe)s$f&bKA(I^kH&ePw+U;aMLcST#7RNz4$?(dgQP^H)+?@sS07EtqAndR^j+ zmlXI7EU@kY9_5gJ3*LzH7X#wH$Z##}mGd~(mKhw{A{`AM-&JQNCtsEDb*Vn()t}|J zBdxuca!C4yq0sfsddfc+tUo1v)8<_IMx1@4{9C}KdN^KTj(}TyuEBQ<(0UMjPyP7<8vL|g;S822BYqnY4erK9>{U`g>cgRRB zti_)YKqrEYpM3&iuLHh}^qmPSuRlupO~G0IQ}A~NYoqin@By4Z7f`Ivd8I5r4_ubt z5?q#F3bwp{un)(Li@(4U(^NK!ec@zs8#X-GbI$${uj|3?mooqN@NEyvV<55pS7NqR zU3|-wTJ-E8^{+#d$7xjtXPX}aQ*|+|!l3btIzZaXa_2+rBbzZX@E5p%T{)R>^{I;+3kG?Ja zb2K>Xvwe<}jJ5xEaJJw2f1UXDo6YD;Z$B1$@PO*Vxh)g41Aor<98iqK)ueO%pPEw( z?QQWSSy;5PQ^oL_cwO)#v_NbbD<$M%s zbv`ogtM)#A2AVWKt|lD?g8%`YU8_a@B`pw9MaTW_(Z^w6wJ~y5lj^TPM z&9kJdwjYty{U(y?mVEx!`(Dm9($nEzNQDLY!7!tyUK`0D>BIM=8AAv8G4%ikUQGhciVot&}uUk}dq ztN#z+T)%j40y$&LUk1+Q#j^>Rj9nY-i*jvnyyckvK4bJDaGOIiMt{yZ&l$l!aMt%& z8q;1AOU^-CaL#j(Yx~~dJ7q$@qVpWX#|FeZ%aC`BKUw)Lo)XLFSiBj01oGF>CzATq zpY{C-{wu-GvyK(T7*j!79L5z_kg0gJ)1p|v*9y{7u;cxhfLH^;pF=qN=ci!DLOb!d zUmX2uo19PRTK5h?y?AquF11K?#(q>n$bLDPbJ;J4fOEYspdOa#@UBqh#pfk#ong#1 z3u84|}VDMt=v1dSs&@72M%D6zFKHTF{Vr{=)8K>sYy-2~{4ps% z=-x($b)eC%;tTClo)AOv0Z7TaP{s@1;mMMuL|E)51lLd%aALP}aTP4k_cm;Tc=U{er)x zkmiG*$@wb*@h))mEh3%uDSs%qlwSib<@YG$E$@AD%RjhaFnot%n-&I-k${Z(!H}xg zmeh`|olrZC5@*%CF|j)2b6Ppi8H2tE@{Tp|77zKYQkLj-|YWS%qZY{<*Le+RnG0=uV?yEfaL#3q1Gm7h;gG(!LoNKa;$~v)$?(5m zl>Glw?B6;n%daT#6VyK!{eMdJ5APWJ>~COP(~TEx6WiXZIew_B#Xo2DG~_=(R=&^n zEbuqL`5Draz+a|5-+LpS1-_f~ha;@s41P08PsNFfc-?dGvbb*NbP^3~`A`Dw`pRl~ z{XVV{?9oGcC)MGBqdgasD($%({n?&};Jo1*|GJ`n<;A7^A2%75w|%eZ zY2TaBo!h7Vi-^C{{srJ{zw4v>_PjpcOnqM8-pU~vzklG|7C`sFcdmITAkJXNVBQyw z<7UOV;B%-$ngwGpEQe(KR&dVk`)~XiTvVTdy!S*T@s*r2 zw!gWY=*ENiz8?H{Y{~H=-}gFY?07ir$zwNdg~Z4qbt zToYrn>!CN^hOLfiuVhAfwJ;Klv(F&xIC6dqnT=QuSpAH$9nLeN!hml;Pl@MINbG*f z3cc^)e{pmd3N-*y-wB+{@*nNNYkTnjprn-F3B?&t+=X#TT~}HeG#k7vwhV^Jn!P{R z`(&BFIrx*{zed9X|3?M?IQaJK(x8oJHNkDtdCx4LWq%C+-o$qwqyNT*O>%xBJYIjy zBp+f6x>>EZ+1!0LtL-!F|6{zBJ+hDQ$n8|sns&8Du}Ic!jOV(=e<`rG{JF=LIkcse zpMgOoerXS0fFDZ!dwTE@__5?a)Ps-5?2;o9$|7nHnm54_hybQefwf?F8^ux z-vK+$CENQ%5C2HwsN}zag(8>#2J$DtKPeWktnUkKQp);%1J3e4h5wcj<|2G3DSyY5 zvGR|Cm3OZb`Zl~+dt8Wd^H>s~{*nG!98>xy_fI>Y^!_9LBb%eSs#@G6{5t2=sSfAe z38dRHA^GFzv&%pA@ zTmGh^y!L;d7|8Wo{sw%W^(ns{eO}gg5IFOdUr}K7-3ZS5#J@vd#+NbgIj)||5)PhOpJ;bD-4~yM_k9glH^x`JLF$06YAxEHt~N5kD(g; zcb>jXI9AiBCw0}qd-DA@U?gR%0C$kRltVfbd?xLiR`A!5mQUEEXOFsH?N>JoM$-Y*;Er9-S%4?tY z45pXmW_!u(OUDfkNbNYY-TN|t{M zvbntacP2mUw|onn%l8wQUQ1;x|4%)*4}F>c0P@Ge|2Bv8NANkEe-#kx?B4NuxY z{DtsJc?VFIw|pz%;H#h~kG%Lif&Ft^(&zI9Zzi4bsnmBF_|u91Ch(=C>E=K;gI`bj zhBO|OUrl?mynJ!y`)tT9l)N_<55K(-dk;iXzilh^|B-ylTLr2($I4G5J(uGy4oTZj z=A3Q+9l9LX+@=pCUtIDZ1ZTeT!^mc={1?H>J1=d-QH5`NI-b+PDUmXc8>rE$^|$uv zZ`H1C)vnP0nf7XPzX!pCm{TNi1AfN-E_!pYYfvE4$8zKez~42uaKxm<_jk`zz-y6_ z^#3$?rT?dbv;Ut%eOH4|iQ<+0bAQ3F(6bx*a((iB&a5ooA&_$UGtl=(CWGfDed4z= z5HtQTczbx58K}g0{7y()GjX0LqO>^}_!fSbVieFASq z`Q2cj_j7BI$M)cq>uTizt4qr5-bJH{R7E#76ZZ6AV=!zx6&^Jfpie!rPyMd!O7ONE zlH<<53zEm3J{#BIxwz!B4dLSp{*}nT7yPwU>-!SkH5uo3ZF6yCJJiN?GyJF0z*7Io z2|MOI++|C~UyE~&Kijc{Be%slZ4RP&P7|NegMWb?C4YztO5919CPcrc1<&}rRjBWYhSys-!fd6^U?@03Fme#7DfDcLXn}X^7>heM#+q5zI#=JP1%5a37fxW`o9wszA102<-wO7A@Lv-DE8zXX)3Mzqgl43d z|2ZFQMcxq{lD>2Ql6_}iJKnQz|AMa1fOo@x((L^serJRsHvUOE%d4*sJF-6a7tWW@ zP4d0-k@dNL=kkv4rQkdsUF%K&muuaN!FjFIw~nvuYkhMyIQ#P7>O+3t9{Fb!^4hZt zN47`%#o2!AyB3`5I|6@rulu?oJ|N4#mm`gFW((6!Nx* zuJ87rxYdK7QegL6&jaTWXn5l39Fp<}lFstRlX0BmX*Kqh>)Su^-yHb;ZsH*QaV+N}0*dW9n{?Tp zbHQbM#JN50r*8wF$06yTA92on{j(+ZmHK9aOMT)j-`hX#-*-k|-oM*k<14q<^~LzS z3LTQ`%K@D8dM01nO8)5u-}-v{e?R!8y$6Czd&Sva+y8oS+5YPazU}`bxYYL`xYQ@k z`fT5B9Jzh=r|rxAX*?bb&gE}7fM*@Sw~pfjQeJ+RzlZis1?T<1SCF3qeuXP2^iQzy z@RUY?;WrNQzZhY4CH9YyJ}&v!y|viAwJIE2RV${Ma=Ti0ZO&w#J*cQ5#J3;q!Pmw&+^ACToszVnFWJi<~P`m!(NM7(iI zZ^zmAs(pB%Z+nh4w~qeaUJ=LV;hgjM)UGSRrCsNOv)%23V!xglyuxot!C%8?3z2b2 zu&;96Btu?YD%SLUxvw4Gzj|k1r`D(*59V6`8OY`O_1m-1UHZ*?cDepu`Cn20`S3U5 zko41A3VHeG75smKhp_jl^>{D8DGGuNHwf!t&pxe(A-QzXEhHyt_uW*v{7aL3E`K4|zoXOT~IssBCT zQvW63tWW)y7Fc`!(IfwG!B_s51^x{9HH^=!-~O9Q%;)}o0KRxz_J5N5t(D+%zx5LE zU6CE;$5(;#{P@4o_qQH>f9%osuR@>W?$PGharYf?_E#_e*VwOoZlCQvl-S7F@pK*o zAdjc{T*$tNwya2Vmi^)NXx1;^wwC-WdiX3^WB8L&yc4!zp8O%YO(?2DZ`6YNB^4cNE zzY^KZ7hgujV=$GL*fE~5`VOVdrM}^TQNH>{2$(ECemTz#Fh<-bNjrg;P=6~R{@xGr z;;hf-BmLYkk4tl2l{kCd>@1Utw=9Uc;L|32fP2j#P?Z4 z*VuhI>@WKvkBL_vRtxvDjfc#uX4%{Po`i)?n{Y*-cY{Ab%Ke;uj0AV z()*tseS1Pc@plN0y`2*F*%*DD`)VOKkB$U;4I{k(ya(r31;hvSJd;zlV?+FB6@0&A z{1Uj$A>D&M>)I|LzRLygKw2B5&Dks%CposP@6}-I)1UTD7Cr&lD}i4z4_XB_uAUkY zACx_wlVv-zhC|udCv*yV>LSd!VY>g4XLyG6yY-cRKOLOg`!IDp3SPz`4IjlbF!=pJ z6+?di?K26tMp!L|za0GHgbxN^13oI@mxG@UHlp&J>@O5N#4&E_wV_(QHoLZaZHroe zH-5CUjGxlZucG(+@DJvYwDY}%ojybE-Z}eDJN<1ollWAX4j?_~tFeI@x_ za>mAb@Z-UU>?iO4q+gUj{5jNxZP}+Q!N&f%*rV<+|Igcep0f7O0i4VJIS^d-&)dLR zm;N4)ZvEZ0^Pp!e0R}tY$2t4J_;F4t<3}H7-TH9z!iO`tSaGlGyCWohcnLWB(7L?_ z%5_`+a9AZ{-PeK3x}D?7x?cj$b?c*}(Use^lDfA9JC^iMh-aR^F{Z_?v9@>|$ApBO zbBu{HW*z|NI*ggU(3xY#81TFJ90N<97w3`*Wxp&~xWJlDgm(((uW_`Oj*d0f{V;Bo zvF}!LF8l5k;9S3B%ksI6x1p1zq`HwjN&l*>^smnY>0inAoy56pU+F{J_g(n8ed>Q* zkAANovwqv}Z$fRqe$~gk5}ce-T-D=vH19MzXkX5A1kg3$S8~qyG}1Gv?=G3p#s@L( z(e@Pbq&oN}(&amXUIM-?)X4qRUAPYiesRLHUO+rz)cFa|S;BsT^c_)MwJ8I|XWZ^A z_W z4m_6l#-6x3^WIqS!{86b;?;}5zXIQ#@TuTOz=H{24DP29+AUdr0G!Le9egB~=Kj19 zJc+<~ZWOP?QyF|2|F?aO_ELO|y^h^npZ3lMm-c#XuDv?UgZDS^$@{vFi_ff|6A<@{ zwxe%Jzb0XSyKY}BPxyG`)%Bc&F8~u>={^n50)w54o|X9iUVS6dZ%ueD`~{?QdHF9W z_||9nvOf1F%H#4dM=j(mSytP!?h{@VpG$fNdHTa+;lhP;>FSV@7l$m0lTi&lE62?r_h&Y$b_B%Z^`+B#GiV6++)5vaEUdr_r|`P`1^rvkK;jF z0cLoGzau0*6Z{O$KTQ0qz#Z^o3Ev9#n)uHJez3r{dL#Hlr0i4aJz%Ey?pSr-cO3a`4y&*at9kP__vG)ccICXU0P=TNOF0`qlD1fH zY0JC7*_L0xKN;-WAz9aL)ZGq!T;ir)PFB$^-Jn= z&dvHh2G*bRlD-GPj^#Fobim2+86NA9yyli351;Xx`*Wtr);B{jzuvC5t7EFUyt!>j z-$8x%_6^mC`VLDExZQ_NulbEr=||x2an5VOBVeyZ^7wE(T!{XC6^2~9j-3D5x8vskHNY9ws-m9*!FrK&h{GG zA-Ll7Rn2CibFO+*s#|P7ibvjDA5vh z98UVugtuah-A_8dQ^WrFEI9XvYsL4$d5j%OdCcnWFSX%cX{_*AnHm)*wb_{tL11I`En#e=7cQEM@F`>w1^x&vMtIO=Ek_s(&`~u_0_!`C2+T(QI z(?$9K_}b~XeR{!Ll6Ypl5n1Q5vjxyQ!0O3sy1(^spZoSy*Z1K&SAU8_`WyH>&Np$` zABx4xoA_y-^;gpxL(8iD#jvf%g^np>LXSk zNWQ+v<(p^3_o%!w@$JWNkk0+6{+Ac}TgW>$UaWG+czQGV69L6%$;J6ua_dt**QdS* zi~bTHjjn9J{_r;$*&nulGjQ2{aj9&xh<8q{y&1t`u)vrS^qBJlJ7mM%=i0w_p0Uh^9O+6 ziB2gz-vqWzlJ&m^oa@)0zIQC^6ZaSX)xJN2%le;9BbB$UsHz5hF;!}Biq~$y8vpwu zQ^x;(;2i(f_Z-UR`t85f;IjY3xqj_AweW|yjS-ozz8k^WK1}BsocN}6?G5%Zp~f@M zrQ^Rfc_w62k_#W)6U;e)etbdGm{nMRSAwegNZ2##-Rp*1P4Yv7IXO0e&N+|G+g}^;opuWJUGOZFe=}kG;`Jyj z`(g)h*%v2+?~27kU-+(?+!vPrF}N&$1Gp@I5BRR4{CB{)ymOWB(kbVvKfy2ODzS6b zWOUeW=jz}-=WK~Qd3m1^yWLz}H3A%{YGIelUbop_wfd_z-)xc(+YK$G-`tm#eiN5| zdkZ-G%@|xk6=e(_3C=NS3|t8=W8xb{%=iq}FVVMAFq8WyVE4B987!ZndKEZ7Q{^*J z-vXDNH=ZwHlFRYzGhUB?%l`b(oKbo8 zePiRX`i?C4+PB#zqw?Z23hcae7``dzrK7;*y!3kTUCDp0G3S%c^OEuR4saQN?xnN6 zj#uZXa=iWvoZGjM_~KSb_niPs!TZBMA;p{gkAqhvY